commit a0df89c6933b6020d6d00d271dadc4018a556b33
Author: wehub-resource-sync <resource-sync@wehub.local>
Date:   Mon Jul 13 12:08:39 2026 +0800

    chore: import upstream snapshot with attribution

diff --git a/.air.toml b/.air.toml
new file mode 100644
index 0000000..6e7c00b
--- /dev/null
+++ b/.air.toml
@@ -0,0 +1,52 @@
+root = "."
+testdata_dir = "testdata"
+tmp_dir = ".tmp"
+
+[build]
+  args_bin = []
+  bin = "./dist/portainer"
+  cmd = "SKIP_GO_GET=true make build-server"
+  delay = 1000
+  exclude_dir = []
+  exclude_file = []
+  exclude_regex = ["_test.go"]
+  exclude_unchanged = false
+  follow_symlink = false
+  full_bin = "./dist/portainer --log-level=DEBUG"
+  include_dir = ["api"]
+  include_ext = ["go"]
+  include_file = []
+  kill_delay = "0s"
+  log = "build-errors.log"
+  poll = false
+  poll_interval = 0
+  post_cmd = []
+  pre_cmd = []
+  rerun = false
+  rerun_delay = 500
+  send_interrupt = false
+  stop_on_error = false
+
+[color]
+  app = ""
+  build = "yellow"
+  main = "magenta"
+  runner = "green"
+  watcher = "cyan"
+
+[log]
+  main_only = false
+  silent = false
+  time = false
+
+[misc]
+  clean_on_exit = false
+
+[proxy]
+  app_port = 0
+  enabled = false
+  proxy_port = 0
+
+[screen]
+  clear_on_rebuild = false
+  keep_scroll = true
diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..8b26d6a
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,5 @@
+*
+!dist
+!build
+!metadata.json
+!docker-extension/build
diff --git a/.env.defaults b/.env.defaults
new file mode 100644
index 0000000..18cd58c
--- /dev/null
+++ b/.env.defaults
@@ -0,0 +1 @@
+PORTAINER_EDITION=CE
\ No newline at end of file
diff --git a/.git-blame-ignore-revs b/.git-blame-ignore-revs
new file mode 100644
index 0000000..678766d
--- /dev/null
+++ b/.git-blame-ignore-revs
@@ -0,0 +1,8 @@
+# prettier
+cf5056d9c03b62d91a25c3b9127caac838695f98
+
+# prettier v2
+42e7db0ae7897d3cb72b0ea1ecf57ee2dd694169
+
+# tailwind prettier
+58d66d3142950bb90a7d85511c034ac9fabba9ba
\ No newline at end of file
diff --git a/.github/DISCUSSION_TEMPLATE/help.yaml b/.github/DISCUSSION_TEMPLATE/help.yaml
new file mode 100644
index 0000000..8a7aa13
--- /dev/null
+++ b/.github/DISCUSSION_TEMPLATE/help.yaml
@@ -0,0 +1,11 @@
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Before asking a question, make sure it hasn't been already asked and answered. You can search our [discussions](https://github.com/orgs/portainer/discussions) and [bug reports](https://github.com/portainer/portainer/issues) in GitHub.  Also, be sure to check our [knowledge base](https://portal.portainer.io/knowledge) and [documentation](https://docs.portainer.io/) first.
+
+  - type: textarea
+    attributes:
+      label: Ask a Question!
+    validations:
+      required: true
diff --git a/.github/DISCUSSION_TEMPLATE/ideas.yaml b/.github/DISCUSSION_TEMPLATE/ideas.yaml
new file mode 100644
index 0000000..9dd504b
--- /dev/null
+++ b/.github/DISCUSSION_TEMPLATE/ideas.yaml
@@ -0,0 +1,38 @@
+body:
+  - type: markdown
+    attributes:
+      value: |
+        # Welcome!
+
+        Thanks for suggesting an idea for Portainer!
+
+        Before opening a new idea or feature request, make sure that we do not have any duplicates already open. You can ensure this by [searching this discussion category](https://github.com/orgs/portainer/discussions/categories/ideas). If there is a duplicate, please add a comment to the existing idea instead.
+
+        Also, be sure to check our [knowledge base](https://portal.portainer.io/knowledge) and [documentation](https://docs.portainer.io) as they may point you toward a solution.
+
+        **DO NOT FILE DUPLICATE REQUESTS.**
+
+  - type: textarea
+    attributes:
+      label: Is your feature request related to a problem? Please describe
+      description: Short list of what the feature request aims to address.
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Describe the solution you'd like
+      description: A clear and concise description of what you want to happen.
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Describe alternatives you've considered
+      description: A clear and concise description of any alternative solutions or features you've considered.
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Additional context
+      description: Add any other context or screenshots about the feature request here.
+    validations:
+      required: false
diff --git a/.github/ISSUE_TEMPLATE.md b/.github/ISSUE_TEMPLATE.md
new file mode 100644
index 0000000..156bf90
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE.md
@@ -0,0 +1,42 @@
+<!--
+
+Thanks for opening an issue on Portainer !
+
+Do you need help or have a question? Come chat with us on Slack https://portainer.io/slack/ or gitter https://gitter.im/portainer/Lobby.
+
+If you are reporting a new issue, make sure that we do not have any duplicates
+already open. You can ensure this by searching the issue list for this
+repository. If there is a duplicate, please close your issue and add a comment
+to the existing issue instead.
+
+Also, be sure to check our FAQ and documentation first: https://portainer.readthedocs.io
+
+If you suspect your issue is a bug, please edit your issue description to
+include the BUG REPORT INFORMATION shown below.
+
+---------------------------------------------------
+BUG REPORT INFORMATION
+---------------------------------------------------
+You do NOT have to include this information if this is a FEATURE REQUEST
+-->
+
+**Description**
+
+<!--
+Briefly describe the problem you are having in a few paragraphs.
+-->
+
+**Steps to reproduce the issue:**
+
+1. 2. 3.
+
+Any other info e.g. Why do you consider this to be a bug? What did you expect to happen instead?
+
+**Technical details:**
+
+- Portainer version:
+- Target Docker version (the host/cluster you manage):
+- Platform (windows/linux):
+- Command used to start Portainer (`docker run -p 9443:9443 portainer/portainer`):
+- Target Swarm version (if applicable):
+- Browser:
diff --git a/.github/ISSUE_TEMPLATE/Custom.md.old b/.github/ISSUE_TEMPLATE/Custom.md.old
new file mode 100644
index 0000000..e17510f
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/Custom.md.old
@@ -0,0 +1,25 @@
+---
+name: Question
+about: Ask us a question about Portainer usage or deployment
+title: ''
+labels: ''
+assignees: ''
+---
+
+Before you start, we need a little bit more information from you:
+
+Use Case (delete as appropriate): Using Portainer at Home, Using Portainer in a Commercial setup.
+
+Have you reviewed our technical documentation and knowledge base? Yes/No
+
+<!--
+
+You can find more information about Portainer support framework policy here: https://old.portainer.io/2019/04/portainer-support-policy/
+
+Do you need help or have a question? Come chat with us on Slack https://portainer.io/slack/
+
+Also, be sure to check our FAQ and documentation first: https://documentation.portainer.io/
+-->
+
+**Question**:
+How can I deploy Portainer on... ?
diff --git a/.github/ISSUE_TEMPLATE/Feature_request.md.old b/.github/ISSUE_TEMPLATE/Feature_request.md.old
new file mode 100644
index 0000000..de27fd9
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/Feature_request.md.old
@@ -0,0 +1,33 @@
+---
+name: Feature request
+about: Suggest a feature/enhancement that should be added in Portainer
+title: ''
+labels: ''
+assignees: ''
+---
+
+<!--
+
+Thanks for opening a feature request for Portainer !
+
+Do you need help or have a question? Come chat with us on Slack https://portainer.io/slack/
+
+Before opening a new issue, make sure that we do not have any duplicates
+already open. You can ensure this by searching the issue list for this
+repository. If there is a duplicate, please close your issue and add a comment
+to the existing issue instead.
+
+Also, be sure to check our FAQ and documentation first: https://documentation.portainer.io/
+-->
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Additional context**
+Add any other context or screenshots about the feature request here.
diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
new file mode 100644
index 0000000..f452836
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -0,0 +1,180 @@
+name: Bug Report
+description: Create a report to help us improve.
+labels: kind/bug,bug/need-confirmation
+body:
+  - type: markdown
+    attributes:
+      value: |
+        # Welcome!
+
+        The issue tracker is for reporting bugs. If you have an [idea for a new feature](https://github.com/orgs/portainer/discussions/categories/ideas) or a [general question about Portainer](https://github.com/orgs/portainer/discussions/categories/help) please post in our [GitHub Discussions](https://github.com/orgs/portainer/discussions).
+
+        You can also ask for help in our [community Slack channel](https://join.slack.com/t/portainer/shared_invite/zt-txh3ljab-52QHTyjCqbe5RibC2lcjKA).
+
+        Please note that we only provide support for current versions of Portainer. You can find a list of supported versions in our [lifecycle policy](https://docs.portainer.io/start/lifecycle).
+
+        **DO NOT FILE ISSUES FOR GENERAL SUPPORT QUESTIONS**.
+
+  - type: checkboxes
+    id: terms
+    attributes:
+      label: Before you start please confirm the following.
+      options:
+        - label: Yes, I've searched similar issues on [GitHub](https://github.com/portainer/portainer/issues).
+          required: true
+        - label: Yes, I've checked whether this issue is covered in the Portainer [documentation](https://docs.portainer.io).
+          required: true
+
+  - type: markdown
+    attributes:
+      value: |
+        # About your issue
+
+        Tell us a bit about the issue you're having.
+
+        How to write a good bug report:
+
+        - Respect the issue template as much as possible.
+        - Summarize the issue so that we understand what is going wrong.
+        - Describe what you would have expected to have happened, and what actually happened instead.
+        - Provide easy to follow steps to reproduce the issue. 
+        - Remain clear and concise.
+        - Format your messages to help the reader focus on what matters and understand the structure of your message, use [Markdown syntax](https://help.github.com/articles/github-flavored-markdown).
+
+  - type: textarea
+    attributes:
+      label: Problem Description
+      description: A clear and concise description of what the bug is.
+    validations:
+      required: true
+
+  - type: textarea
+    attributes:
+      label: Expected Behavior
+      description: A clear and concise description of what you expected to happen.
+    validations:
+      required: true
+
+  - type: textarea
+    attributes:
+      label: Actual Behavior
+      description: A clear and concise description of what actually happens.
+    validations:
+      required: true
+
+  - type: textarea
+    attributes:
+      label: Steps to Reproduce
+      description: Please be as detailed as possible when providing steps to reproduce.
+      placeholder: |
+        1. Go to '...'
+        2. Click on '....'
+        3. Scroll down to '....'
+        4. See error
+    validations:
+      required: true
+
+  - type: textarea
+    attributes:
+      label: Portainer logs or screenshots
+      description: Provide Portainer container logs or any screenshots related to the issue.
+    validations:
+      required: false
+
+  - type: markdown
+    attributes:
+      value: |
+        # About your environment
+
+        Tell us a bit about your Portainer environment.
+
+  - type: dropdown
+    attributes:
+      label: Portainer version
+      description: We only provide support for current versions of Portainer as per the lifecycle policy linked above. If you are on an older version of Portainer we recommend [updating first](https://docs.portainer.io/start/upgrade) in case your bug has already been fixed.
+      multiple: false
+      options:
+        - '2.43.0'
+        - '2.42.0'
+        - '2.41.1'
+        - '2.41.0'
+        - '2.40.0'
+        - '2.39.4'
+        - '2.39.3'
+        - '2.39.2'
+        - '2.39.1'
+        - '2.39.0'
+        - '2.38.1'
+        - '2.38.0'
+        - '2.37.0'
+        - '2.36.0'
+        - '2.35.0'
+        - '2.34.0'
+        - '2.33.8'
+        - '2.33.7'
+        - '2.33.6'
+        - '2.33.5'
+        - '2.33.4'
+        - '2.33.3'
+        - '2.33.2'
+        - '2.33.1'
+        - '2.33.0'
+
+    validations:
+      required: true
+
+  - type: dropdown
+    attributes:
+      label: Portainer Edition
+      multiple: false
+      options:
+        - 'Business Edition (BE/EE) with 5NF / 3NF license'
+        - 'Business Edition (BE/EE) with Home & Student license'
+        - 'Business Edition (BE/EE) with Starter license'
+        - 'Business Edition (BE/EE) with Professional or Enterprise license'
+        - 'Community Edition (CE)'
+    validations:
+      required: true
+
+  - type: input
+    attributes:
+      label: Platform and Version
+      description: |
+        Enter your container management platform (Docker | Swarm | Kubernetes) along with the version. 
+        Example: Docker 24.0.3 | Docker Swarm 24.0.3 | Kubernetes 1.26
+        You can find our supported platforms [in our documentation](https://docs.portainer.io/start/requirements-and-prerequisites).
+    validations:
+      required: true
+
+  - type: input
+    attributes:
+      label: OS and Architecture
+      description: |
+        Enter your Operating System, Version and Architecture. Example: Ubuntu 22.04, AMD64 | Raspbian OS, ARM64
+    validations:
+      required: true
+
+  - type: input
+    attributes:
+      label: Browser
+      description: |
+        Enter your browser and version. Example: Google Chrome 114.0
+    validations:
+      required: false
+
+  - type: textarea
+    attributes:
+      label: What command did you use to deploy Portainer?
+      description: |
+        Example: `docker run -d -p 8000:8000 -p 9443:9443 --name portainer --restart=always -v /var/run/docker.sock:/var/run/docker.sock -v portainer_data:/data portainer/portainer-ce:latest`
+        If you deployed Portainer using a compose file or manifest you can provide this here as well.
+      render: bash
+    validations:
+      required: false
+
+  - type: textarea
+    attributes:
+      label: Additional Information
+      description: Any additional information about your environment, the bug, or anything else you think might be helpful.
+    validations:
+      required: false
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
new file mode 100644
index 0000000..69207c9
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -0,0 +1,11 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Question
+    url: https://github.com/orgs/portainer/discussions/new?category=help
+    about: Ask us a question about Portainer usage or deployment.
+  - name: Idea or Feature Request
+    url: https://github.com/orgs/portainer/discussions/new?category=ideas
+    about: Suggest an idea or feature/enhancement that should be added in Portainer.
+  - name: Portainer Business Edition - Get 3 Nodes Free
+    url: https://www.portainer.io/take-3
+    about: Portainer Business Edition has more features, more support and you can now get 3 nodes free for as long as you want.
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
new file mode 100644
index 0000000..c79aa50
--- /dev/null
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -0,0 +1,4 @@
+closes #0 <!-- Github issue number (remove if unknown) -->
+closes [CE-0] <!-- Jira link number (remove if unknown). Please also add the same [CE-XXX] at the back of the PR title -->
+
+### Changes:
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..3797a9d
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,22 @@
+node_modules
+bower_components
+dist
+portainer-checksum.txt
+api/cmd/portainer/portainer*
+storybook-static
+debug-storybook.log
+.tmp
+**/.vscode/settings.json
+**/.vscode/tasks.json
+.vscode
+*.DS_Store
+
+.eslintcache
+__debug_bin*
+
+.idea
+.env
+go.work.sum
+
+.vitest
+
diff --git a/.golangci-forward.yaml b/.golangci-forward.yaml
new file mode 100644
index 0000000..d1b1125
--- /dev/null
+++ b/.golangci-forward.yaml
@@ -0,0 +1,13 @@
+version: '2'
+linters:
+  default: none
+  enable:
+    - forbidigo
+  settings:
+    forbidigo:
+      forbid:
+        - pattern: ^dataservices.DataStore.(EdgeGroup|EdgeJob|EdgeStack|EndpointRelation|Endpoint|GitCredential|Registry|ResourceControl|Role|Settings|Snapshot|SSLSettings|Stack|Tag|User)$
+          msg: Use a transaction instead
+        - pattern: ^(filepath|path)\.Join$
+          msg: Use filesystem.JoinPaths() from github.com/portainer/portainer/api/filesystem to prevent path traversal attacks
+      analyze-types: true
diff --git a/.golangci.yaml b/.golangci.yaml
new file mode 100644
index 0000000..0bdc00e
--- /dev/null
+++ b/.golangci.yaml
@@ -0,0 +1,126 @@
+version: '2'
+
+run:
+  allow-parallel-runners: true
+linters:
+  default: none
+  enable:
+    - gocritic
+    - bodyclose
+    - copyloopvar
+    - depguard
+    - errcheck
+    - errorlint
+    - forbidigo
+    - govet
+    - ineffassign
+    - intrange
+    - perfsprint
+    - staticcheck
+    - unused
+    - mirror
+    - durationcheck
+    - errorlint
+    - govet
+    - usetesting
+    - zerologlint
+    - testifylint
+    - modernize
+    - unconvert
+    - unused
+    - zerologlint
+    - exptostd
+  settings:
+    staticcheck:
+      checks: ['all', '-ST1003', '-ST1005', '-ST1016', '-SA1019', '-QF1003']
+    depguard:
+      rules:
+        main:
+          files:
+            - '!**/*_test.go'
+            - '!**/base.go'
+            - '!**/base_tx.go'
+          deny:
+            - pkg: encoding/json
+              desc: use github.com/segmentio/encoding/json
+            - pkg: golang.org/x/exp
+              desc: exp is not allowed
+            - pkg: github.com/portainer/libcrypto
+              desc: use github.com/portainer/portainer/pkg/libcrypto
+            - pkg: github.com/portainer/libhttp
+              desc: use github.com/portainer/portainer/pkg/libhttp
+            - pkg: golang.org/x/crypto
+              desc: golang.org/x/crypto is not allowed because of FIPS mode
+            - pkg: github.com/ProtonMail/go-crypto/openpgp
+              desc: github.com/ProtonMail/go-crypto/openpgp is not allowed because of FIPS mode
+            - pkg: github.com/cosi-project/runtime
+              desc: github.com/cosi-project/runtime is not allowed because of FIPS mode
+            - pkg: gopkg.in/yaml.v2
+              desc: use go.yaml.in/yaml/v3 instead
+            - pkg: gopkg.in/yaml.v3
+              desc: use go.yaml.in/yaml/v3 instead
+            - pkg: github.com/golang-jwt/jwt/v4
+              desc: use github.com/golang-jwt/jwt/v5 instead
+            - pkg: github.com/mitchellh/mapstructure
+              desc: use github.com/go-viper/mapstructure/v2 instead
+            - pkg: gopkg.in/alecthomas/kingpin.v2
+              desc: use github.com/alecthomas/kingpin/v2 instead
+            - pkg: github.com/jcmturner/gokrb5$
+              desc: use github.com/jcmturner/gokrb5/v8 instead
+            - pkg: github.com/gofrs/uuid
+              desc: use github.com/google/uuid
+            - pkg: github.com/Masterminds/semver$
+              desc: use github.com/Masterminds/semver/v3
+            - pkg: github.com/blang/semver
+              desc: use github.com/Masterminds/semver/v3
+            - pkg: github.com/coreos/go-semver
+              desc: use github.com/Masterminds/semver/v3
+            - pkg: github.com/hashicorp/go-version
+              desc: use github.com/Masterminds/semver/v3
+    gocritic:
+      disable-all: true
+      enabled-checks:
+        - ruleguard
+      settings:
+        ruleguard:
+          rules: './analysis/ssrf.go,./analysis/git.go'
+    forbidigo:
+      forbid:
+        - pattern: ^tls\.Config$
+          msg: Use crypto.CreateTLSConfiguration() instead
+        - pattern: ^tls\.Config\.(InsecureSkipVerify|MinVersion|MaxVersion|CipherSuites|CurvePreferences)$
+          msg: Do not set this field directly, use crypto.CreateTLSConfiguration() instead
+        - pattern: ^object\.(Commit|Tag)\.Verify$
+          msg: 'Not allowed because of FIPS mode'
+        - pattern: ^(types\.SystemContext\.)?(DockerDaemonInsecureSkipTLSVerify|DockerInsecureSkipTLSVerify|OCIInsecureSkipTLSVerify)$
+          msg: 'Not allowed because of FIPS mode'
+        - pattern: ^git\.PlainClone(Context|WithOptions)?$
+          msg: Use git.CloneContext with NewNoSymlinkFS to prevent symlink traversal attacks
+      analyze-types: true
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+    rules:
+      - path: pkg/libhttp/ssrf
+        linters:
+          - gocritic
+        text: ruleguard
+      - path: pkg/libhttp/ssrf/builder\.go
+        linters:
+          - forbidigo
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
+formatters:
+  enable:
+    - gofmt
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
diff --git a/.husky/pre-commit b/.husky/pre-commit
new file mode 100755
index 0000000..2adb9da
--- /dev/null
+++ b/.husky/pre-commit
@@ -0,0 +1,4 @@
+#!/usr/bin/env sh
+. "$(dirname -- "$0")/_/husky.sh"
+
+cd $(dirname -- "$0") && pnpm lint-staged
\ No newline at end of file
diff --git a/.prettierignore b/.prettierignore
new file mode 100644
index 0000000..6241c7e
--- /dev/null
+++ b/.prettierignore
@@ -0,0 +1,5 @@
+dist
+api/datastore/test_data
+coverage
+
+pnpm-lock.yaml
diff --git a/.prettierrc b/.prettierrc
new file mode 100644
index 0000000..cc4553a
--- /dev/null
+++ b/.prettierrc
@@ -0,0 +1,22 @@
+{
+  "printWidth": 180,
+  "singleQuote": true,
+  "htmlWhitespaceSensitivity": "strict",
+  "trailingComma": "es5",
+  "overrides": [
+    {
+      "files": ["*.html"],
+      "options": {
+        "parser": "angular"
+      }
+    },
+    {
+      "files": ["*.{j,t}sx", "*.ts"],
+      "options": {
+        "printWidth": 80
+      }
+    }
+  ],
+  "plugins": ["prettier-plugin-tailwindcss"],
+  "tailwindFunctions": ["clsx"]
+}
diff --git a/.storybook/main.ts b/.storybook/main.ts
new file mode 100644
index 0000000..af328a0
--- /dev/null
+++ b/.storybook/main.ts
@@ -0,0 +1,115 @@
+// This file has been automatically migrated to valid ESM format by Storybook.
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+import path, { dirname } from 'path';
+
+import { StorybookConfig } from '@storybook/react-webpack5';
+
+import { Configuration } from 'webpack';
+import postcss from 'postcss';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+const require = createRequire(import.meta.url);
+
+const config: StorybookConfig = {
+  stories: ['../app/**/*.stories.@(ts|tsx)'],
+  addons: [
+    '@storybook/addon-links',
+    '@storybook/addon-webpack5-compiler-swc',
+    '@chromatic-com/storybook',
+    {
+      name: '@storybook/addon-styling-webpack',
+
+      options: {
+        rules: [
+          {
+            test: /\.css$/,
+            sideEffects: true,
+            use: [
+              require.resolve('style-loader'),
+              {
+                loader: require.resolve('css-loader'),
+                options: {
+                  importLoaders: 1,
+                  modules: {
+                    localIdentName: '[path][name]__[local]',
+                    auto: true,
+                    exportLocalsConvention: 'camelCaseOnly',
+                  },
+                },
+              },
+              {
+                loader: require.resolve('postcss-loader'),
+                options: {
+                  implementation: postcss,
+                },
+              },
+            ],
+          },
+        ],
+      },
+    },
+    '@storybook/addon-docs',
+  ],
+  webpackFinal: (config) => {
+    const rules = config?.module?.rules || [];
+
+    const imageRule = rules.find((rule) => {
+      const test = (rule as { test: RegExp }).test;
+
+      if (!test) {
+        return false;
+      }
+
+      return test.test('.svg');
+    }) as { [key: string]: any };
+
+    imageRule.exclude = /\.svg$/;
+
+    rules.unshift({
+      test: /\.svg$/i,
+      type: 'asset',
+      resourceQuery: {
+        not: [/c/],
+      }, // exclude react component if *.svg?url
+    });
+
+    rules.unshift({
+      test: /\.svg$/i,
+      issuer: /\.(js|ts)(x)?$/,
+      resourceQuery: /c/,
+      // *.svg?c
+      use: [
+        {
+          loader: '@svgr/webpack',
+          options: {
+            icon: true,
+          },
+        },
+      ],
+    });
+    return {
+      ...config,
+      resolve: {
+        ...config.resolve,
+        tsconfig: path.resolve(__dirname, '..', 'tsconfig.json'),
+      },
+      module: {
+        ...config.module,
+        rules,
+      },
+    } satisfies Configuration;
+  },
+  staticDirs: ['./public'],
+  typescript: {
+    reactDocgen: 'react-docgen',
+  },
+  framework: {
+    name: '@storybook/react-webpack5',
+    options: {},
+  },
+  docs: {},
+};
+
+export default config;
diff --git a/.storybook/preview.tsx b/.storybook/preview.tsx
new file mode 100644
index 0000000..ec1a36c
--- /dev/null
+++ b/.storybook/preview.tsx
@@ -0,0 +1,86 @@
+import { useEffect } from 'react';
+import '../app/assets/css';
+import { pushStateLocationPlugin, UIRouter } from '@uirouter/react';
+import { initialize as initMSW, mswLoader } from 'msw-storybook-addon';
+import { handlers } from '../app/setup-tests/server-handlers';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { Preview } from '@storybook/react-webpack5';
+
+initMSW(
+  {
+    onUnhandledRequest: ({ method, url }) => {
+      if (url.startsWith('/api')) {
+        console.error(`Unhandled ${method} request to ${url}.
+
+        This exception has been only logged in the console, however, it's strongly recommended to resolve this error as you don't want unmocked data in Storybook stories.
+
+        If you wish to mock an error response, please refer to this guide: https://mswjs.io/docs/recipes/mocking-error-responses
+      `);
+      }
+    },
+  },
+  handlers
+);
+
+const testQueryClient = new QueryClient({
+  defaultOptions: { queries: { retry: false } },
+});
+
+const preview: Preview = {
+  globalTypes: {
+    theme: {
+      description: 'Portainer color theme',
+      toolbar: {
+        title: 'Theme',
+        icon: 'paintbrush',
+        items: [
+          { value: 'light', title: 'Light', icon: 'sun' },
+          { value: 'dark', title: 'Dark', icon: 'moon' },
+          { value: 'highcontrast', title: 'High Contrast', icon: 'eye' },
+        ],
+        dynamicTitle: true,
+      },
+    },
+  },
+  initialGlobals: {
+    theme: 'light',
+  },
+  decorators: (Story, context) => {
+    const theme = context.globals.theme;
+
+    useEffect(() => {
+      if (theme === 'light') {
+        document.documentElement.removeAttribute('theme');
+      } else {
+        document.documentElement.setAttribute('theme', theme);
+      }
+    }, [theme]);
+
+    return (
+      <QueryClientProvider client={testQueryClient}>
+        <UIRouter plugins={[pushStateLocationPlugin]}>
+          <Story />
+        </UIRouter>
+      </QueryClientProvider>
+    );
+  },
+  loaders: [mswLoader],
+  parameters: {
+    options: {
+      storySort: {
+        order: ['Design System', 'Components', '*'],
+      },
+    },
+    controls: {
+      matchers: {
+        color: /(background|color)$/i,
+        date: /Date$/,
+      },
+    },
+    msw: {
+      handlers,
+    },
+  },
+};
+
+export default preview;
diff --git a/.storybook/public/mockServiceWorker.js b/.storybook/public/mockServiceWorker.js
new file mode 100644
index 0000000..71d697e
--- /dev/null
+++ b/.storybook/public/mockServiceWorker.js
@@ -0,0 +1,336 @@
+/* eslint-disable */
+/* tslint:disable */
+
+/**
+ * Mock Service Worker.
+ * @see https://github.com/mswjs/msw
+ * - Please do NOT modify this file.
+ */
+
+const PACKAGE_VERSION = '2.12.10';
+const INTEGRITY_CHECKSUM = '4db4a41e972cec1b64cc569c66952d82';
+const IS_MOCKED_RESPONSE = Symbol('isMockedResponse');
+const activeClientIds = new Set();
+
+addEventListener('install', function () {
+  self.skipWaiting();
+});
+
+addEventListener('activate', function (event) {
+  event.waitUntil(self.clients.claim());
+});
+
+addEventListener('message', async function (event) {
+  const clientId = Reflect.get(event.source || {}, 'id');
+
+  if (!clientId || !self.clients) {
+    return;
+  }
+
+  const client = await self.clients.get(clientId);
+
+  if (!client) {
+    return;
+  }
+
+  const allClients = await self.clients.matchAll({
+    type: 'window',
+  });
+
+  switch (event.data) {
+    case 'KEEPALIVE_REQUEST': {
+      sendToClient(client, {
+        type: 'KEEPALIVE_RESPONSE',
+      });
+      break;
+    }
+
+    case 'INTEGRITY_CHECK_REQUEST': {
+      sendToClient(client, {
+        type: 'INTEGRITY_CHECK_RESPONSE',
+        payload: {
+          packageVersion: PACKAGE_VERSION,
+          checksum: INTEGRITY_CHECKSUM,
+        },
+      });
+      break;
+    }
+
+    case 'MOCK_ACTIVATE': {
+      activeClientIds.add(clientId);
+
+      sendToClient(client, {
+        type: 'MOCKING_ENABLED',
+        payload: {
+          client: {
+            id: client.id,
+            frameType: client.frameType,
+          },
+        },
+      });
+      break;
+    }
+
+    case 'CLIENT_CLOSED': {
+      activeClientIds.delete(clientId);
+
+      const remainingClients = allClients.filter((client) => {
+        return client.id !== clientId;
+      });
+
+      // Unregister itself when there are no more clients
+      if (remainingClients.length === 0) {
+        self.registration.unregister();
+      }
+
+      break;
+    }
+  }
+});
+
+addEventListener('fetch', function (event) {
+  const requestInterceptedAt = Date.now();
+
+  // Bypass navigation requests.
+  if (event.request.mode === 'navigate') {
+    return;
+  }
+
+  // Opening the DevTools triggers the "only-if-cached" request
+  // that cannot be handled by the worker. Bypass such requests.
+  if (event.request.cache === 'only-if-cached' && event.request.mode !== 'same-origin') {
+    return;
+  }
+
+  // Bypass all requests when there are no active clients.
+  // Prevents the self-unregistered worked from handling requests
+  // after it's been terminated (still remains active until the next reload).
+  if (activeClientIds.size === 0) {
+    return;
+  }
+
+  const requestId = crypto.randomUUID();
+  event.respondWith(handleRequest(event, requestId, requestInterceptedAt));
+});
+
+/**
+ * @param {FetchEvent} event
+ * @param {string} requestId
+ * @param {number} requestInterceptedAt
+ */
+async function handleRequest(event, requestId, requestInterceptedAt) {
+  const client = await resolveMainClient(event);
+  const requestCloneForEvents = event.request.clone();
+  const response = await getResponse(event, client, requestId, requestInterceptedAt);
+
+  // Send back the response clone for the "response:*" life-cycle events.
+  // Ensure MSW is active and ready to handle the message, otherwise
+  // this message will pend indefinitely.
+  if (client && activeClientIds.has(client.id)) {
+    const serializedRequest = await serializeRequest(requestCloneForEvents);
+
+    // Clone the response so both the client and the library could consume it.
+    const responseClone = response.clone();
+
+    sendToClient(
+      client,
+      {
+        type: 'RESPONSE',
+        payload: {
+          isMockedResponse: IS_MOCKED_RESPONSE in response,
+          request: {
+            id: requestId,
+            ...serializedRequest,
+          },
+          response: {
+            type: responseClone.type,
+            status: responseClone.status,
+            statusText: responseClone.statusText,
+            headers: Object.fromEntries(responseClone.headers.entries()),
+            body: responseClone.body,
+          },
+        },
+      },
+      responseClone.body ? [serializedRequest.body, responseClone.body] : []
+    );
+  }
+
+  return response;
+}
+
+/**
+ * Resolve the main client for the given event.
+ * Client that issues a request doesn't necessarily equal the client
+ * that registered the worker. It's with the latter the worker should
+ * communicate with during the response resolving phase.
+ * @param {FetchEvent} event
+ * @returns {Promise<Client | undefined>}
+ */
+async function resolveMainClient(event) {
+  const client = await self.clients.get(event.clientId);
+
+  if (activeClientIds.has(event.clientId)) {
+    return client;
+  }
+
+  if (client?.frameType === 'top-level') {
+    return client;
+  }
+
+  const allClients = await self.clients.matchAll({
+    type: 'window',
+  });
+
+  return allClients
+    .filter((client) => {
+      // Get only those clients that are currently visible.
+      return client.visibilityState === 'visible';
+    })
+    .find((client) => {
+      // Find the client ID that's recorded in the
+      // set of clients that have registered the worker.
+      return activeClientIds.has(client.id);
+    });
+}
+
+/**
+ * @param {FetchEvent} event
+ * @param {Client | undefined} client
+ * @param {string} requestId
+ * @param {number} requestInterceptedAt
+ * @returns {Promise<Response>}
+ */
+async function getResponse(event, client, requestId, requestInterceptedAt) {
+  // Clone the request because it might've been already used
+  // (i.e. its body has been read and sent to the client).
+  const requestClone = event.request.clone();
+
+  function passthrough() {
+    // Cast the request headers to a new Headers instance
+    // so the headers can be manipulated with.
+    const headers = new Headers(requestClone.headers);
+
+    // Remove the "accept" header value that marked this request as passthrough.
+    // This prevents request alteration and also keeps it compliant with the
+    // user-defined CORS policies.
+    const acceptHeader = headers.get('accept');
+    if (acceptHeader) {
+      const values = acceptHeader.split(',').map((value) => value.trim());
+      const filteredValues = values.filter((value) => value !== 'msw/passthrough');
+
+      if (filteredValues.length > 0) {
+        headers.set('accept', filteredValues.join(', '));
+      } else {
+        headers.delete('accept');
+      }
+    }
+
+    return fetch(requestClone, { headers });
+  }
+
+  // Bypass mocking when the client is not active.
+  if (!client) {
+    return passthrough();
+  }
+
+  // Bypass initial page load requests (i.e. static assets).
+  // The absence of the immediate/parent client in the map of the active clients
+  // means that MSW hasn't dispatched the "MOCK_ACTIVATE" event yet
+  // and is not ready to handle requests.
+  if (!activeClientIds.has(client.id)) {
+    return passthrough();
+  }
+
+  // Notify the client that a request has been intercepted.
+  const serializedRequest = await serializeRequest(event.request);
+  const clientMessage = await sendToClient(
+    client,
+    {
+      type: 'REQUEST',
+      payload: {
+        id: requestId,
+        interceptedAt: requestInterceptedAt,
+        ...serializedRequest,
+      },
+    },
+    [serializedRequest.body]
+  );
+
+  switch (clientMessage.type) {
+    case 'MOCK_RESPONSE': {
+      return respondWithMock(clientMessage.data);
+    }
+
+    case 'PASSTHROUGH': {
+      return passthrough();
+    }
+  }
+
+  return passthrough();
+}
+
+/**
+ * @param {Client} client
+ * @param {any} message
+ * @param {Array<Transferable>} transferrables
+ * @returns {Promise<any>}
+ */
+function sendToClient(client, message, transferrables = []) {
+  return new Promise((resolve, reject) => {
+    const channel = new MessageChannel();
+
+    channel.port1.onmessage = (event) => {
+      if (event.data && event.data.error) {
+        return reject(event.data.error);
+      }
+
+      resolve(event.data);
+    };
+
+    client.postMessage(message, [channel.port2, ...transferrables.filter(Boolean)]);
+  });
+}
+
+/**
+ * @param {Response} response
+ * @returns {Response}
+ */
+function respondWithMock(response) {
+  // Setting response status code to 0 is a no-op.
+  // However, when responding with a "Response.error()", the produced Response
+  // instance will have status code set to 0. Since it's not possible to create
+  // a Response instance with status code 0, handle that use-case separately.
+  if (response.status === 0) {
+    return Response.error();
+  }
+
+  const mockedResponse = new Response(response.body, response);
+
+  Reflect.defineProperty(mockedResponse, IS_MOCKED_RESPONSE, {
+    value: true,
+    enumerable: true,
+  });
+
+  return mockedResponse;
+}
+
+/**
+ * @param {Request} request
+ */
+async function serializeRequest(request) {
+  return {
+    url: request.url,
+    mode: request.mode,
+    method: request.method,
+    headers: Object.fromEntries(request.headers.entries()),
+    cache: request.cache,
+    credentials: request.credentials,
+    destination: request.destination,
+    integrity: request.integrity,
+    redirect: request.redirect,
+    referrer: request.referrer,
+    referrerPolicy: request.referrerPolicy,
+    body: await request.arrayBuffer(),
+    keepalive: request.keepalive,
+  };
+}
diff --git a/ATTRIBUTIONS.md b/ATTRIBUTIONS.md
new file mode 100644
index 0000000..8758a54
--- /dev/null
+++ b/ATTRIBUTIONS.md
@@ -0,0 +1,32 @@
+# Open Source License Attribution
+
+This application uses Open Source components. You can find the source
+code of their open source projects along with license information below.
+We acknowledge and are grateful to these developers for their contributions
+to open source.
+
+### [angular-json-tree](https://github.com/awendland/angular-json-tree)
+
+by [Alex Wendland](https://github.com/awendland) is licensed under [CC BY 4.0 License](https://creativecommons.org/licenses/by/4.0/)
+
+### [caniuse-db](https://github.com/Fyrd/caniuse)
+
+by [caniuse.com](caniuse.com) is licensed under [CC BY 4.0 License](https://creativecommons.org/licenses/by/4.0/)
+
+### [caniuse-lite](https://github.com/ben-eb/caniuse-lite)
+
+by [caniuse.com](caniuse.com) is licensed under [CC BY 4.0 License](https://creativecommons.org/licenses/by/4.0/)
+
+### [spdx-exceptions](https://github.com/jslicense/spdx-exceptions.json)
+
+by Kyle Mitchell using [SPDX](https://spdx.dev/) from Linux Foundation licensed under [CC BY 3.0 License](https://creativecommons.org/licenses/by/3.0/)
+
+### [fontawesome-free](https://github.com/FortAwesome/Font-Awesome) Icons
+
+by [Fort Awesome](https://fortawesome.com/) is licensed under [CC BY 4.0 License](https://creativecommons.org/licenses/by/4.0/)
+
+Portainer also contains the following code, which is licensed under the [MIT license](https://opensource.org/licenses/MIT):
+
+UI For Docker: Copyright (c) 2013-2016 Michael Crosby (crosbymichael.com), Kevan Ahlquist (kevanahlquist.com), Anthony Lapenna (portainer.io)
+
+rdash-angular: Copyright (c) [2014][elliot hesp]
diff --git a/CLAUDE.md b/CLAUDE.md
new file mode 100644
index 0000000..38369d6
--- /dev/null
+++ b/CLAUDE.md
@@ -0,0 +1,59 @@
+# Portainer Community Edition
+
+Open-source container management platform with full Docker and Kubernetes support.
+
+## Project Structure
+
+For a detailed breakdown of frontend and backend directory layout, feature locations, and common development tasks, see [docs/guidelines/project-structure.md](../../docs/guidelines/project-structure.md).
+
+## Frontend Guidelines
+
+- [docs/guidelines/frontend-conventions.md](../../docs/guidelines/frontend-conventions.md) — component structure, React Query patterns, shared components, forms, theming
+- [docs/guidelines/typescript-conventions.md](../../docs/guidelines/typescript-conventions.md) — types, anti-patterns, union types, named constants
+- [docs/guidelines/frontend-unit-testing.md](../../docs/guidelines/frontend-unit-testing.md) — Vitest, React Testing Library
+
+## Backend Guidelines
+
+- [docs/guidelines/go-conventions.md](../../docs/guidelines/go-conventions.md) — error handling, naming, testing, code style
+- [docs/guidelines/server-architecture.md](../../docs/guidelines/server-architecture.md) — Clean Architecture layers, transactions, CE/EE sharing patterns
+- [docs/guidelines/logging.md](../../docs/guidelines/logging.md) — zerolog usage, log levels, message style
+- [docs/guidelines/backend-code-reusability.md](../../docs/guidelines/backend-code-reusability.md) — how CE and EE share backend code
+
+## Package Manager
+
+- **PNPM** 10+ (for frontend)
+- **Go** 1.26.1 (for backend)
+
+## Build Commands
+
+```bash
+# Full build
+make build              # Build both client and server
+make build-client       # Build React/AngularJS frontend
+make build-server       # Build Go binary
+make build-image        # Build Docker image
+
+# Development
+make dev                # Run both in dev mode
+make dev-client         # Start webpack-dev-server (port 8999)
+make dev-server         # Run containerized Go server
+
+# Frontend
+pnpm dev            # Webpack dev server
+pnpm build          # Build frontend with webpack
+pnpm typecheck      # Run typecheck for frontend (with tsc)
+pnpm lint           # lint frontend (with eslint)
+pnpm test           # test frontend (with vitest)
+pnpm format         # format frontend (with prettier)
+
+# Testing
+make test               # All tests (backend + frontend)
+make test-server        # Backend tests only
+make lint               # Lint all code
+make format             # Format code
+```
+
+## Development Servers
+
+- Frontend: http://localhost:8999
+- Backend: http://localhost:9000 (HTTP) / https://localhost:9443 (HTTPS)
diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
new file mode 100644
index 0000000..382ee49
--- /dev/null
+++ b/CODE_OF_CONDUCT.md
@@ -0,0 +1,46 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to making participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, gender identity and expression, level of experience, nationality, personal appearance, race, religion, or sexual identity and orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to creating a positive environment include:
+
+- Using welcoming and inclusive language
+- Being respectful of differing viewpoints and experiences
+- Gracefully accepting constructive criticism
+- Focusing on what is best for the community
+- Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+- The use of sexualized language or imagery and unwelcome sexual attention or advances
+- Trolling, insulting/derogatory comments, and personal or political attacks
+- Public or private harassment
+- Publishing others' private information, such as a physical or electronic address, without explicit permission
+- Other conduct which could reasonably be considered inappropriate in a professional setting
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies both within project spaces and in public spaces when an individual is representing the project or its community. Examples of representing a project or community include using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. Representation of a project may be further defined and clarified by project maintainers.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at contribute@portainer.io. The project team will review and investigate all complaints, and will respond in a way that it deems appropriate to the circumstances. The project team is obligated to maintain confidentiality with regard to the reporter of an incident. Further details of specific enforcement policies may be posted separately.
+
+Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4, available at [http://contributor-covenant.org/version/1/4][version]
+
+[homepage]: http://contributor-covenant.org
+[version]: http://contributor-covenant.org/version/1/4/
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..1b70daf
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,158 @@
+# Contributing Guidelines
+
+Some basic conventions for contributing to this project.
+
+## General
+
+Please make sure that there aren't existing pull requests attempting to address the issue mentioned. Likewise, please check for issues related to update, as someone else may be working on the issue in a branch or fork.
+
+- Please open a discussion in a new issue / existing issue to talk about the changes you'd like to bring
+- Develop in a topic branch, not master/develop
+
+When creating a new branch, prefix it with the _type_ of the change (see section **Commit Message Format** below), the associated opened issue number, a dash and some text describing the issue (using dash as a separator).
+
+For example, if you work on a bugfix for the issue #361, you could name the branch `fix361-template-selection`.
+
+## Issues open to contribution
+
+Want to contribute but don't know where to start? Have a look at the issues labeled with the `good first issue` label: https://github.com/portainer/portainer/issues?q=is%3Aopen+is%3Aissue+label%3A%22good+first+issue%22
+
+## Commit Message Format
+
+Each commit message should include a **type**, a **scope** and a **subject**:
+
+```
+ <type>(<scope>): <subject>
+```
+
+Lines should not exceed 100 characters. This allows the message to be easier to read on GitHub as well as in various git tools and produces a nice, neat commit log ie:
+
+```
+ #271 feat(containers): add exposed ports in the containers view
+ #270 fix(templates): fix a display issue in the templates view
+ #269 style(dashboard): update dashboard with new layout
+```
+
+### Type
+
+Must be one of the following:
+
+- **feat**: A new feature
+- **fix**: A bug fix
+- **docs**: Documentation only changes
+- **style**: Changes that do not affect the meaning of the code (white-space, formatting, missing
+  semi-colons, etc)
+- **refactor**: A code change that neither fixes a bug or adds a feature
+- **test**: Adding missing tests
+- **chore**: Changes to the build process or auxiliary tools and libraries such as documentation
+  generation
+
+### Scope
+
+The scope could be anything specifying place of the commit change. For example `networks`,
+`containers`, `images` etc...
+You can use the **area** label tag associated on the issue here (for `area/containers` use `containers` as a scope...)
+
+### Subject
+
+The subject contains succinct description of the change:
+
+- use the imperative, present tense: "change" not "changed" nor "changes"
+- don't capitalize first letter
+- no dot (.) at the end
+
+## Contribution process
+
+Our contribution process is described below. Some of the steps can be visualized inside GitHub via specific `status/` labels, such as `status/1-functional-review` or `status/2-technical-review`.
+
+### Bug report
+
+![portainer_bugreport_workflow](https://user-images.githubusercontent.com/5485061/45727219-50190a00-bbf5-11e8-9fe8-3a563bb8d5d7.png)
+
+### Feature request
+
+The feature request process is similar to the bug report process but has an extra functional validation before the technical validation as well as a documentation validation before the testing phase.
+
+![portainer_featurerequest_workflow](https://user-images.githubusercontent.com/5485061/45727229-5ad39f00-bbf5-11e8-9550-16ba66c50615.png)
+
+## Build and run Portainer locally
+
+Ensure you have Docker, Node.js, pnpm, and Golang installed in the correct versions.
+
+Install dependencies:
+
+```sh
+$ make deps
+```
+
+Then build and run the project in a Docker container:
+
+```sh
+$ make dev
+```
+
+Portainer server can now be accessed at <https://localhost:9443>. and UI dev server runs on <http://localhost:8999>.
+
+if you want to build the project you can run:
+
+```sh
+make build-all
+```
+
+For additional make commands, run `make help`.
+
+Find more detailed steps at <https://docs.portainer.io/contribute/build>.
+
+### Build customization
+
+You can customize the following settings:
+
+- `PORTAINER_DATA`: The host dir or volume name used by portainer (default is `/tmp/portainer`, which won't persist over reboots).
+- `PORTAINER_PROJECT`: The root dir of the repository - `${portainerRoot}/dist/` is imported into the container to get the build artifacts and external tools (defaults to `your current dir`).
+- `PORTAINER_FLAGS`: a list of flags to be used on the portainer commandline, in the form `--admin-password=<pwd hash> --feat fdo=false --feat open-amt` (default: `""`).
+
+## Testing your build
+
+The `--log-level=DEBUG` flag can be passed to the Portainer container in order to provide additional debug output which may be useful when troubleshooting your builds. Please note that this flag was originally intended for internal use and as such the format, functionality and output may change between releases without warning.
+
+## Adding api docs
+
+When adding a new resource (or a route handler), we should add a new tag to api/http/handler/handler.go#L136 like this:
+
+```
+// @tag.name <Name of resource>
+// @tag.description a short description
+```
+
+When adding a new route to an existing handler use the following as a template (you can use `swapi` snippet if you're using vscode):
+
+```
+// @id
+// @summary
+// @description
+// @description **Access policy**:
+// @tags
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @produce json
+// @param id path int true "identifier"
+// @param body body Object true "details"
+// @success 200 {object} portainer. "Success"
+// @success 204 "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied"
+// @failure 404 " not found"
+// @failure 500 "Server error"
+// @router /{id} [get]
+```
+
+explanation about each line can be found [here](https://github.com/swaggo/swag#api-operation)
+
+After changing these annotations, regenerate the TypeScript API client and types — see [Generating API types](./README.md#generating-api-types).
+
+## Licensing
+
+See the [LICENSE](https://github.com/portainer/portainer/blob/develop/LICENSE) file for our project's licensing. We will ask you to confirm the licensing of your contribution.
+
+We may ask you to sign a [Contributor License Agreement (CLA)](http://en.wikipedia.org/wiki/Contributor_License_Agreement) for larger changes.
diff --git a/LICENSE b/LICENSE
new file mode 100644
index 0000000..231ab8b
--- /dev/null
+++ b/LICENSE
@@ -0,0 +1,17 @@
+Copyright (c) 2018 Portainer.io
+
+This software is provided 'as-is', without any express or implied
+warranty.  In no event will the authors be held liable for any damages
+arising from the use of this software.
+
+Permission is granted to anyone to use this software for any purpose,
+including commercial applications, and to alter it and redistribute it
+freely, subject to the following restrictions:
+
+1. The origin of this software must not be misrepresented; you must not
+   claim that you wrote the original software. If you use this software
+   in a product, an acknowledgment in the product documentation would be
+   appreciated but is not required.
+2. Altered source versions must be plainly marked as such, and must not be
+   misrepresented as being the original software.
+3. This notice may not be removed or altered from any source distribution.
\ No newline at end of file
diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..355526d
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,156 @@
+# build target, can be one of "production", "testing", "development"
+ENV=development
+WEBPACK_CONFIG=webpack/webpack.$(ENV).js
+TAG=local
+
+SWAG=go run github.com/swaggo/swag/cmd/swag@v1.16.6
+GOTESTSUM_VERSION?=v1.13.0
+GOTESTSUM=go run gotest.tools/gotestsum@$(GOTESTSUM_VERSION)
+GOLANGCI_LINT_VERSION := $(shell cat $(shell git rev-parse --show-toplevel)/.golangci-version)
+
+# Don't change anything below this line unless you know what you're doing
+.DEFAULT_GOAL := help
+
+
+##@ Building
+.PHONY: all init-dist build-storybook build build-client build-server build-image devops
+init-dist:
+	@mkdir -p dist
+
+all: tidy deps build-server build-client ## Build the client, server and download external dependancies (doesn't build an image)
+
+build-all: all ## Alias for the 'all' target (used by CI)
+
+build-client: init-dist ## Build the client
+	export NODE_ENV=$(ENV) && pnpm run build --config $(WEBPACK_CONFIG)
+
+build-server: init-dist ## Build the server binary
+	./build/build_binary.sh "$(PLATFORM)" "$(ARCH)"
+
+build-image: build-all ## Build the Portainer image locally
+	docker buildx build --load -t portainerci/portainer-ce:$(TAG) -f build/linux/Dockerfile .
+
+build-storybook: ## Build and serve the storybook files
+	pnpm run storybook:build
+
+##@ Build dependencies
+.PHONY: deps server-deps client-deps tidy
+deps: server-deps client-deps ## Download all client and server build dependancies
+
+## This is empty because the pipeline requires it but ce has no server deps
+server-deps: init-dist ## Download dependant server binaries
+
+client-deps: ## Install client dependencies
+	pnpm install
+
+tidy: ## Tidy up the go.mod file
+	@go mod tidy
+
+##@ Cleanup
+.PHONY: clean
+clean: ## Remove all build and download artifacts
+	@echo "Clearing the dist directory..."
+	@rm -rf dist/*
+
+##@ Testing
+.PHONY: test test-client test-server
+test: test-server test-client ## Run all tests
+
+test-client: ## Run client tests
+	pnpm run test $(ARGS) --coverage
+
+TEST_PACKAGES?=./...
+
+test-server:	## Run server tests
+	$(GOTESTSUM) --format pkgname-and-test-fails --format-hide-empty-pkg --hide-summary skipped -- -cover -covermode=atomic -coverprofile=coverage.out $(TEST_PACKAGES)
+
+##@ Dev
+.PHONY: dev dev-client dev-server
+dev: ## Run both the client and server in development mode
+	make dev-server
+	make dev-client
+
+dev-client: ## Run the client in development mode
+	pnpm install && pnpm run dev
+
+dev-server: build-server ## Run the server in development mode
+	@./dev/run_container.sh
+
+dev-server-podman: build-server ## Run the server in development mode
+	@./dev/run_container_podman.sh
+
+##@ Format
+.PHONY: format format-client format-server
+
+format: format-client format-server ## Format all code
+
+format-client: ## Format client code
+	pnpm run format
+
+format-server: ## Format server code
+	go fmt ./...
+
+##@ Lint
+.PHONY: lint lint-client lint-server check-lint-version
+lint: lint-client lint-server ## Lint all code
+
+lint-client: ## Lint client code
+	pnpm run lint
+
+check-lint-version:
+	@installed=v$$(golangci-lint --version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1); \
+	if [ "$$installed" = "v" ]; then \
+		echo "ERROR: golangci-lint not found, need $(GOLANGCI_LINT_VERSION)"; \
+		echo "Install: go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@$(GOLANGCI_LINT_VERSION)"; \
+		exit 1; \
+	elif [ "$$installed" != "$(GOLANGCI_LINT_VERSION)" ]; then \
+		echo "ERROR: golangci-lint $$installed installed, need $(GOLANGCI_LINT_VERSION)"; \
+		echo "Install: go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@$(GOLANGCI_LINT_VERSION)"; \
+		exit 1; \
+	fi
+
+lint-server: tidy check-lint-version ## Lint server code
+	golangci-lint run --timeout=10m -c .golangci.yaml
+	golangci-lint run --timeout=10m --new-from-rev=HEAD~ -c .golangci-forward.yaml
+
+##@ Extension
+.PHONY: dev-extension
+dev-extension: build-server build-client ## Run the extension in development mode
+	make local -f build/docker-extension/Makefile
+
+##@ Docs
+.PHONY: docs-build docs-validate docs-sync-check docs-clean docs-validate-clean
+docs-build: ## Build docs
+	go mod download
+	mkdir -p api/docs
+	cd api && $(SWAG) init -o "./docs" -ot "yaml" -g ./http/handler/handler.go --parseDependency --parseInternal --parseDepth 2 -p pascalcase --markdownFiles ./ --overridesFile .swaggo
+
+docs-validate: docs-build ## Validate docs
+	pnpm swagger2openapi --warnOnly api/docs/swagger.yaml -o api/docs/openapi.yaml
+	pnpm swagger-cli validate api/docs/openapi.yaml
+
+docs-sync-check: docs-build ## Check if committed API spec is in sync with Go annotations; fail if not
+	@if ! git diff --exit-code api/docs/swagger.yaml > /dev/null 2>&1; then \
+		echo ""; \
+		echo "ERROR: API spec is out of sync with Go annotations."; \
+		echo "Run 'make generate-api' in package/server-ce and commit the result."; \
+		echo ""; \
+		git diff --stat api/docs/swagger.yaml; \
+		exit 1; \
+	fi
+
+.PHONY: docs-serve
+docs-serve: docs-build ## Serve docs locally with Swagger UI on port 8080
+	docker run -p 8080:8080 \
+		-e SWAGGER_JSON=/foo/swagger.yaml \
+		-v $(PWD)/api/docs:/foo \
+		swaggerapi/swagger-ui
+
+.PHONY: generate-api
+generate-api: docs-validate ## Generate API client and types from OpenAPI spec
+	pnpm generate-api
+
+##@ Helpers
+.PHONY: help
+help:  ## Display this help
+	@awk 'BEGIN {FS = ":.*##"; printf "Usage:\n  make \033[36m<target>\033[0m\n"} /^[a-zA-Z_-]+:.*?##/ { printf "  \033[36m%-15s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..883e418
--- /dev/null
+++ b/README.md
@@ -0,0 +1,95 @@
+<p align="center">
+  <img title="portainer" src='https://github.com/portainer/portainer/blob/develop/app/assets/images/portainer-github-banner.png?raw=true' />
+</p>
+
+**Portainer Community Edition** is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. It is designed to be as simple to deploy as it is to use. The application allows you to manage all your orchestrator resources (containers, images, volumes, networks and more) through a ‘smart’ GUI and/or an extensive API.
+
+Portainer consists of a single container that can run on any cluster. It can be deployed as a Linux container or a Windows native container.
+
+**Portainer Business Edition** builds on the open-source base and includes a range of advanced features and functions (like RBAC and Support) that are specific to the needs of business users.
+
+- [Compare Portainer CE and Compare Portainer BE](https://www.portainer.io/features)
+- [Take3 – get 3 free nodes of Portainer Business for as long as you want them](https://www.portainer.io/take-3)
+- [Portainer BE install guide](https://academy.portainer.io/install/)
+
+## Latest Version
+
+Portainer CE is updated regularly. We aim to do an update release every couple of months.
+
+[![latest version](https://img.shields.io/github/v/release/portainer/portainer?color=%2344cc11&label=Latest%20release&style=for-the-badge)](https://github.com/portainer/portainer/releases/latest)
+
+## Getting started
+
+- [Deploy Portainer](https://docs.portainer.io/start/install-ce)
+- [Documentation](https://docs.portainer.io)
+- [Contribute to the project](https://docs.portainer.io/contribute/contribute)
+
+## Features & Functions
+
+View [this](https://www.portainer.io/features) table to see all of the Portainer CE functionality and compare to Portainer Business.
+
+## Getting help
+
+Portainer CE is an open source project and is supported by the community. You can buy a supported version of Portainer at portainer.io
+
+Learn more about Portainer's community support channels [here.](https://www.portainer.io/resources/get-help/get-support)
+
+- Issues: https://github.com/portainer/portainer/issues
+- Slack (chat): [https://portainer.io/slack](https://portainer.io/slack)
+
+You can join the Portainer Community by visiting [https://www.portainer.io/join-our-community](https://www.portainer.io/join-our-community). This will give you advance notice of events, content and other related Portainer content.
+
+## Reporting bugs and contributing
+
+- Want to report a bug or request a feature? Please open [an issue](https://github.com/portainer/portainer/issues/new).
+- Want to help us build **_portainer_**? Follow our [contribution guidelines](https://docs.portainer.io/contribute/contribute) to build it locally and make a pull request.
+
+## Generating API types
+
+The frontend consumes a TypeScript API client (SDK functions and request/response types) that is generated from the Go API's Swagger annotations. Regenerate it after any API change — a new endpoint, a changed request/response shape, or a removed endpoint:
+
+```bash
+make generate-api
+```
+
+This runs the following pipeline:
+
+```
+Go Swagger annotations
+  → dist/docs/swagger.yaml       (make docs-build, via swaggo/swag)
+  → dist/docs/openapi.yaml       (swagger2openapi + validation)
+  → app/react/portainer/generated-api/portainer/   (hey-api/openapi-ts)
+```
+
+The generator is configured in [`openapi-ts.config.ts`](./openapi-ts.config.ts), which controls the output path, plugins, and tag filters (for example, `deprecated` endpoints and `edge_agent`-tagged routes are excluded).
+
+The generated files live in `app/react/portainer/generated-api/portainer/` and must **not** be edited by hand — your changes would be overwritten on the next run. Import the generated SDK functions and types instead of writing direct HTTP calls:
+
+- `@api/sdk.gen` — SDK functions
+- `@api/types.gen` — request/response types
+
+See [Adding api docs](./CONTRIBUTING.md#adding-api-docs) for how to annotate handlers so they are picked up by the generator.
+
+## Security
+
+For information about reporting security vulnerabilities, please see our [Security Policy](SECURITY.md).
+
+## Work for us
+
+If you are a developer, and our code in this repo makes sense to you, we would love to hear from you. We are always on the hunt for awesome devs, either freelance or employed. Drop us a line to success@portainer.io with your details and/or visit our [careers page](https://apply.workable.com/portainer/).
+
+## Privacy
+
+**To make sure we focus our development effort in the right places we need to know which features get used most often. To give us this information we use [Matomo Analytics](https://matomo.org/), which is hosted in Germany and is fully GDPR compliant.**
+
+When Portainer first starts, you are given the option to DISABLE analytics. If you **don't** choose to disable it, we collect anonymous usage as per [our privacy policy](https://www.portainer.io/legal/privacy-policy). **Please note**, there is no personally identifiable information sent or stored at any time and we only use the data to help us improve Portainer.
+
+## Limitations
+
+Portainer supports "Current - 2 docker versions only. Prior versions may operate, however these are not supported.
+
+## Licensing
+
+Portainer is licensed under the zlib license. See [LICENSE](./LICENSE) for reference.
+
+Portainer also contains code from open source projects. See [ATTRIBUTIONS.md](./ATTRIBUTIONS.md) for a list.
diff --git a/README.wehub.md b/README.wehub.md
new file mode 100644
index 0000000..b1a7dfc
--- /dev/null
+++ b/README.wehub.md
@@ -0,0 +1,7 @@
+# WeHub 来源说明
+
+- 原始项目：`portainer/portainer`
+- 原始仓库：https://github.com/portainer/portainer
+- 导入方式：上游默认分支的最新快照
+- 原作者、版权和许可证信息以原始仓库及本仓库 LICENSE 为准
+- 本文件仅用于记录来源，不代表 WeHub 是原项目作者
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..beeeff8
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,60 @@
+# Security Policy
+
+## Supported Versions
+
+Portainer maintains both Short-Term Support (STS) and Long-Term Support (LTS) versions in accordance with our official [Portainer Lifecycle Policy](https://docs.portainer.io/start/lifecycle).
+
+| Version Type             | Support Status                              |
+| ------------------------ | ------------------------------------------- |
+| LTS (Long-Term Support)  | Supported for critical security fixes       |
+| STS (Short-Term Support) | Supported until the next STS or LTS release |
+| Legacy / EOL             | Not supported                               |
+
+For a detailed breakdown of current versions and their specific End of Life (EOL) dates,
+please refer to the [Portainer Lifecycle Policy](https://docs.portainer.io/start/lifecycle).
+
+## Reporting a Vulnerability
+
+The Portainer team takes the security of our products seriously. If you believe you have found a security vulnerability in any Portainer-owned repository, please report it to us responsibly.
+
+**Please do not report security vulnerabilities via public GitHub issues.**
+
+### Disclosure Process
+
+1. **Report**: You can report in one of two ways:
+
+   - **GitHub**: Use the **Report a vulnerability** button on the **Security** tab of this repository.
+
+   - **Email**: Send your findings to security@portainer.io.
+
+2. **Details**: To help us verify the issue, please include:
+
+   - A description of the vulnerability and its potential impact.
+
+   - Step-by-step instructions to reproduce the issue (e.g. proof-of-concept code, scripts, or screenshots).
+
+   - The version of the software and the environment in which it was found.
+
+3. **Acknowledge**: We will acknowledge receipt of your report and provide an initial assessment.
+
+4. **Resolution**: We will work to resolve the issue as quickly as possible. We request that you do not disclose the vulnerability publicly until we have released a fix and notified affected users.
+
+## Our Commitment
+
+If you follow the responsible disclosure process, we will:
+
+- Respond to your report in a timely manner.
+
+- Provide an estimated timeline for remediation.
+
+- Notify you when the vulnerability has been patched.
+
+- Give credit for the discovery (if desired) once the fix is public.
+
+We will make every effort to promptly address any security weaknesses. Security advisories and fixes will be published through GitHub Security Advisories and other channels as needed.
+
+Thank you for helping keep Portainer and our community secure.
+
+## Resources
+
+- [Contributing to Portainer](https://docs.portainer.io/contribute/contribute#contributing-to-the-portainer-ce-codebase)
diff --git a/__mocks__/@reach/menu-button.tsx b/__mocks__/@reach/menu-button.tsx
new file mode 100644
index 0000000..1755687
--- /dev/null
+++ b/__mocks__/@reach/menu-button.tsx
@@ -0,0 +1,118 @@
+import {
+  Children,
+  useState,
+  useEffect,
+  useRef,
+  useContext,
+  createContext,
+  ReactNode,
+} from 'react';
+
+type MenuCtxType = {
+  isOpen: boolean;
+  setOpen: (v: boolean) => void;
+  menuRef: React.RefObject<HTMLDivElement>;
+  label: string;
+  setLabel: (v: string) => void;
+};
+
+const MenuCtx = createContext<MenuCtxType | null>(null);
+
+export function Menu({ children }: { children?: ReactNode }) {
+  const [isOpen, setOpen] = useState(false);
+  const [label, setLabel] = useState('');
+  const menuRef = useRef<HTMLDivElement>(null);
+
+  useEffect(() => {
+    function handleDocDown(e: MouseEvent) {
+      const target = e.target as Node | null;
+      if (
+        isOpen &&
+        menuRef.current &&
+        target &&
+        !menuRef.current.contains(target)
+      ) {
+        setOpen(false);
+      }
+    }
+
+    document.addEventListener('mousedown', handleDocDown);
+    return () => document.removeEventListener('mousedown', handleDocDown);
+  }, [isOpen]);
+
+  return (
+    <MenuCtx.Provider value={{ isOpen, setOpen, menuRef, label, setLabel }}>
+      <div ref={menuRef}>{children}</div>
+    </MenuCtx.Provider>
+  );
+}
+
+export function MenuButton({
+  children,
+  onClick: externalOnClick,
+  ...props
+}: {
+  children?: ReactNode;
+  onClick?: () => void;
+  [key: string]: unknown;
+}) {
+  const ctx = useContext(MenuCtx);
+
+  useEffect(() => {
+    const firstText = Children.toArray(children).find(
+      (c) => typeof c === 'string'
+    );
+    if (firstText) ctx?.setLabel(firstText as string);
+  });
+
+  function handleClick() {
+    externalOnClick?.();
+    ctx?.setOpen(!ctx.isOpen);
+  }
+
+  return (
+    <button type="button" onClick={handleClick} {...props}>
+      {children}
+    </button>
+  );
+}
+
+export function MenuList({
+  children,
+  className,
+}: {
+  children?: ReactNode;
+  className?: string;
+}) {
+  const ctx = useContext(MenuCtx);
+  if (!ctx?.isOpen) return null;
+  return (
+    <div role="menu" aria-label={ctx.label || undefined} className={className}>
+      {children}
+    </div>
+  );
+}
+
+export function MenuItem({
+  children,
+  onSelect,
+  className,
+}: {
+  children?: ReactNode;
+  onSelect?: () => void;
+  className?: string;
+}) {
+  const ctx = useContext(MenuCtx);
+
+  function handleClick() {
+    onSelect?.();
+    ctx?.setOpen(false);
+  }
+
+  return (
+    // eslint-disable-next-line jsx-a11y/click-events-have-key-events, jsx-a11y/interactive-supports-focus
+    <div role="menuitem" onClick={handleClick} className={className}>
+      {children}
+    </div>
+  );
+}
diff --git a/analysis/git.go b/analysis/git.go
new file mode 100644
index 0000000..37d5e40
--- /dev/null
+++ b/analysis/git.go
@@ -0,0 +1,18 @@
+//go:build ignore
+
+package gorules
+
+import "github.com/quasilyte/go-ruleguard/dsl"
+
+// inMemoryCloneWithWorktree flags git clone calls that use memory.NewStorage() as
+// the storer while also writing files to a real worktree. This holds all git objects
+// in heap for the duration of the clone, which is unbounded for user-supplied repos.
+func inMemoryCloneWithWorktree(m dsl.Matcher) {
+	m.Match(`git.CloneContext($_, memory.NewStorage(), $wt, $_)`).
+		Where(m["wt"].Text != "nil").
+		Report(`git.CloneContext with memory.NewStorage() holds all git objects in heap; use gogitfs.NewStorage with a filesystem storer instead`)
+
+	m.Match(`git.Clone(memory.NewStorage(), $wt, $_)`).
+		Where(m["wt"].Text != "nil").
+		Report(`git.Clone with memory.NewStorage() holds all git objects in heap; use gogitfs.NewStorage with a filesystem storer instead`)
+}
diff --git a/analysis/ssrf.go b/analysis/ssrf.go
new file mode 100644
index 0000000..b183a7f
--- /dev/null
+++ b/analysis/ssrf.go
@@ -0,0 +1,75 @@
+//go:build ignore
+
+package gorules
+
+import "github.com/quasilyte/go-ruleguard/dsl"
+
+// unwrappedHTTPTransport flags any bare http.Transport composite literal.
+// All transports must be created via ssrf.NewTransport or ssrf.NewInternalTransport,
+// which clone http.DefaultTransport and handle SSRF protection internally.
+func unwrappedHTTPTransport(m dsl.Matcher) {
+	m.Match(`$f(&http.Transport{$*_})`).
+		Report(`$f receives a bare *http.Transport; use ssrf.NewTransport(tlsConfig) or ssrf.NewInternalTransport(tlsConfig) instead`)
+
+	m.Match(`$_ := &http.Transport{$*_}`).
+		Report(`bare *http.Transport variable; use ssrf.NewTransport(tlsConfig) or ssrf.NewInternalTransport(tlsConfig) instead`)
+
+	m.Match(`$_.Transport = &http.Transport{$*_}`).
+		Report(`bare *http.Transport field assignment; use ssrf.NewTransport(tlsConfig) or ssrf.NewInternalTransport(tlsConfig) instead`)
+}
+
+// helmGetterTransport flags getter.WithTransport calls that receive a bare *http.Transport.
+// Helm v4 installs its own transport and bypasses http.DefaultTransport, so the transport
+// passed here must be created via ssrf.NewTransport.
+func helmGetterTransport(m dsl.Matcher) {
+	m.Match(`getter.WithTransport(&http.Transport{$*_})`).
+		Report(`getter.WithTransport called with a bare *http.Transport; use ssrf.NewTransport(tlsConfig) as Helm v4 bypasses http.DefaultTransport`)
+}
+
+// cloneDefaultTransport flags direct clones of *http.Transport outside main.go.
+// The one legitimate clone is in main.go where http.DefaultTransport is globally
+// wrapped with SSRF protection at server startup.
+func cloneDefaultTransport(m dsl.Matcher) {
+	m.Match(`$_.(*http.Transport).Clone()`).
+		Where(!m.File().Name.Matches(`^main\.go$`)).
+		Report(`cloning *http.Transport directly is forbidden; use ssrf.NewTransport(tlsConfig) or ssrf.NewInternalTransport(tlsConfig) instead`)
+}
+
+// internalTransportMisuse flags calls to NewInternalTransport outside the proxy
+// factory files where Chisel-tunnel and in-cluster K8s destinations are valid exemptions.
+func internalTransportMisuse(m dsl.Matcher) {
+	m.Match(`ssrf.NewInternalTransport($*_)`).
+		Where(
+			!(m.File().PkgPath.Matches(`proxy/factory`) &&
+				m.File().Name.Matches(`^(docker|agent|local_transport|edge_transport|docker_unix|docker_windows)\.go$`))).
+		Report(`NewInternalTransport bypasses SSRF validation; only valid in the proxy factory files for local sockets and internally-routed endpoints`)
+}
+
+// dialerOverride flags direct assignments to any of the dialer fields on a transport.
+// The only valid assignments are in docker_unix.go and docker_windows.go where a
+// custom dialer is required for unix sockets and named pipes.
+func dialerOverride(m dsl.Matcher) {
+	m.Match(`$_.DialContext = $*_`).
+		Where(
+			!(m.File().PkgPath.Matches(`proxy/factory`) &&
+				m.File().Name.Matches(`^(docker_unix|docker_windows)\.go$`))).
+		Report(`direct DialContext assignment replaces the transport dialer; use ssrf.NewTransport or ssrf.NewInternalTransport instead`)
+
+	m.Match(`$_.Dial = $*_`).
+		Where(
+			!(m.File().PkgPath.Matches(`proxy/factory`) &&
+				m.File().Name.Matches(`^(docker_unix|docker_windows)\.go$`))).
+		Report(`direct Dial assignment replaces the transport dialer; use ssrf.NewTransport or ssrf.NewInternalTransport instead`)
+
+	m.Match(`$_.DialTLSContext = $*_`).
+		Where(
+			!(m.File().PkgPath.Matches(`proxy/factory`) &&
+				m.File().Name.Matches(`^(docker_unix|docker_windows)\.go$`))).
+		Report(`direct DialTLSContext assignment replaces the transport dialer; use ssrf.NewTransport or ssrf.NewInternalTransport instead`)
+
+	m.Match(`$_.DialTLS = $*_`).
+		Where(
+			!(m.File().PkgPath.Matches(`proxy/factory`) &&
+				m.File().Name.Matches(`^(docker_unix|docker_windows)\.go$`))).
+		Report(`direct DialTLS assignment replaces the transport dialer; use ssrf.NewTransport or ssrf.NewInternalTransport instead`)
+}
diff --git a/analysis/tools.go b/analysis/tools.go
new file mode 100644
index 0000000..55f01d8
--- /dev/null
+++ b/analysis/tools.go
@@ -0,0 +1,5 @@
+//go:build tools
+
+package gorules
+
+import _ "github.com/quasilyte/go-ruleguard/dsl"
diff --git a/api/.swaggo b/api/.swaggo
new file mode 100644
index 0000000..3f60894
--- /dev/null
+++ b/api/.swaggo
@@ -0,0 +1 @@
+replace k8s.io/apimachinery/pkg/apis/meta/v1.Duration string
diff --git a/api/adminmonitor/admin_monitor.go b/api/adminmonitor/admin_monitor.go
new file mode 100644
index 0000000..e309959
--- /dev/null
+++ b/api/adminmonitor/admin_monitor.go
@@ -0,0 +1,116 @@
+package adminmonitor
+
+import (
+	"context"
+	"net/http"
+	"strings"
+	"sync"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+
+	"github.com/rs/zerolog/log"
+)
+
+const RedirectReasonAdminInitTimeout string = "AdminInitTimeout"
+
+type Monitor struct {
+	timeout           time.Duration
+	datastore         dataservices.DataStore
+	cancellationFunc  context.CancelFunc
+	mu                sync.RWMutex
+	adminInitDisabled bool
+}
+
+// New creates a monitor that when started will wait for the timeout duration and then shutdown the application unless it has been initialized.
+func New(timeout time.Duration, datastore dataservices.DataStore) *Monitor {
+	return &Monitor{
+		timeout:           timeout,
+		datastore:         datastore,
+		adminInitDisabled: false,
+	}
+}
+
+// Start starts the monitor. The monitor will stop when ctx is cancelled, or when Stop is called.
+func (m *Monitor) Start(ctx context.Context) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	if m.cancellationFunc != nil {
+		return
+	}
+
+	cancellationCtx, cancellationFunc := context.WithCancel(ctx)
+	m.cancellationFunc = cancellationFunc
+
+	go func() {
+		log.Debug().Msg("start initialization monitor")
+
+		select {
+		case <-time.After(m.timeout):
+			initialized, err := m.WasInitialized()
+			if err != nil {
+				log.Error().Err(err).Msg("AdminMonitor failed to determine if Portainer is Initialized")
+				return
+			}
+
+			if !initialized {
+				log.Info().Msg("the Portainer instance timed out for security purposes, to re-enable your Portainer instance, you will need to restart Portainer")
+
+				m.mu.Lock()
+				defer m.mu.Unlock()
+
+				m.adminInitDisabled = true
+				return
+			}
+		case <-cancellationCtx.Done():
+			log.Debug().Msg("canceling initialization monitor")
+		}
+	}()
+}
+
+// Stop stops monitor. Safe to call even if monitor wasn't started.
+func (m *Monitor) Stop() {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	if m.cancellationFunc == nil {
+		return
+	}
+
+	m.cancellationFunc()
+	m.cancellationFunc = nil
+}
+
+// WasInitialized is a system initialization check
+func (m *Monitor) WasInitialized() (bool, error) {
+	users, err := m.datastore.User().UsersByRole(portainer.AdministratorRole)
+	if err != nil {
+		return false, err
+	}
+
+	return len(users) > 0, nil
+}
+
+func (m *Monitor) WasInstanceDisabled() bool {
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+
+	return m.adminInitDisabled
+}
+
+// WithRedirect checks whether administrator initialisation timeout. If so, it will return the error with redirect reason.
+// Otherwise, it will pass through the request to next
+func (m *Monitor) WithRedirect(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if m.WasInstanceDisabled() && strings.HasPrefix(r.RequestURI, "/api") && r.RequestURI != "/api/status" && r.RequestURI != "/api/settings/public" {
+			w.Header().Set("redirect-reason", RedirectReasonAdminInitTimeout)
+			httperror.WriteError(w, http.StatusSeeOther, "Administrator initialization timeout", nil)
+			return
+		}
+
+		next.ServeHTTP(w, r)
+	})
+}
diff --git a/api/adminmonitor/admin_monitor_test.go b/api/adminmonitor/admin_monitor_test.go
new file mode 100644
index 0000000..6195d49
--- /dev/null
+++ b/api/adminmonitor/admin_monitor_test.go
@@ -0,0 +1,63 @@
+package adminmonitor
+
+import (
+	"testing"
+	"testing/synctest"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	i "github.com/portainer/portainer/api/internal/testhelpers"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_stopWithoutStarting(t *testing.T) {
+	t.Parallel()
+	monitor := New(1*time.Minute, nil)
+	monitor.Stop()
+}
+
+func Test_stopCouldBeCalledMultipleTimes(t *testing.T) {
+	t.Parallel()
+	monitor := New(1*time.Minute, nil)
+	monitor.Stop()
+	monitor.Stop()
+}
+
+func Test_startOrStopCouldBeCalledMultipleTimesConcurrently(t *testing.T) {
+	t.Parallel()
+	synctest.Test(t, test_startOrStopCouldBeCalledMultipleTimesConcurrently)
+}
+
+func test_startOrStopCouldBeCalledMultipleTimesConcurrently(t *testing.T) {
+	monitor := New(1*time.Minute, nil)
+
+	go monitor.Start(t.Context())
+	monitor.Start(t.Context())
+
+	go monitor.Stop()
+	monitor.Stop()
+
+	time.Sleep(2 * time.Second)
+}
+
+func Test_canStopStartedMonitor(t *testing.T) {
+	t.Parallel()
+	monitor := New(1*time.Minute, nil)
+	monitor.Start(t.Context())
+	assert.NotNil(t, monitor.cancellationFunc, "cancellation function is missing in started monitor")
+
+	monitor.Stop()
+	assert.Nil(t, monitor.cancellationFunc, "cancellation function should absent in stopped monitor")
+}
+
+func Test_start_shouldDisableInstanceAfterTimeout_ifNotInitialized(t *testing.T) {
+	t.Parallel()
+	timeout := 10 * time.Millisecond
+
+	datastore := i.NewDatastore(i.WithUsers([]portainer.User{}))
+	monitor := New(timeout, datastore)
+	monitor.Start(t.Context())
+
+	<-time.After(20 * timeout)
+	assert.True(t, monitor.WasInstanceDisabled(), "monitor should have been timeout and instance is disabled")
+}
diff --git a/api/agent/version.go b/api/agent/version.go
new file mode 100644
index 0000000..ff61d03
--- /dev/null
+++ b/api/agent/version.go
@@ -0,0 +1,80 @@
+package agent
+
+import (
+	"context"
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"strconv"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/url"
+	"github.com/portainer/portainer/pkg/libhttp/ssrf"
+
+	"github.com/rs/zerolog/log"
+)
+
+// GetAgentVersionAndPlatform returns the agent version and platform
+//
+// it sends a ping to the agent and parses the version and platform from the headers
+func GetAgentVersionAndPlatform(endpointUrl string, tlsConfig *tls.Config) (portainer.AgentPlatform, string, error) { //nolint:forbidigo
+	if err := ssrf.CheckURL(context.Background(), endpointUrl); err != nil {
+		return 0, "", err
+	}
+
+	httpCli := &http.Client{Timeout: 3 * time.Second}
+
+	if tlsConfig != nil {
+		httpCli.Transport = ssrf.NewTransport(tlsConfig)
+	}
+
+	parsedURL, err := url.ParseURL(endpointUrl + "/ping")
+	if err != nil {
+		return 0, "", err
+	}
+
+	parsedURL.Scheme = "https"
+
+	req, err := http.NewRequest(http.MethodGet, parsedURL.String(), nil)
+	if err != nil {
+		return 0, "", err
+	}
+
+	resp, err := httpCli.Do(req)
+	if err != nil {
+		return 0, "", err
+	}
+
+	_, _ = io.Copy(io.Discard, resp.Body)
+	if err := resp.Body.Close(); err != nil {
+		log.Warn().Err(err).Msg("failed to close response body")
+	}
+
+	if resp.StatusCode != http.StatusNoContent {
+		return 0, "", fmt.Errorf("Failed request with status %d", resp.StatusCode)
+	}
+
+	version := resp.Header.Get(portainer.PortainerAgentHeader)
+	if version == "" {
+		return 0, "", errors.New("Version Header is missing")
+	}
+
+	agentPlatformHeader := resp.Header.Get(portainer.HTTPResponseAgentPlatform)
+	if agentPlatformHeader == "" {
+		return 0, "", errors.New("Agent Platform Header is missing")
+	}
+
+	agentPlatformNumber, err := strconv.Atoi(agentPlatformHeader)
+	if err != nil {
+		return 0, "", err
+	}
+
+	if agentPlatformNumber == 0 {
+		return 0, "", errors.New("Agent platform is invalid")
+	}
+
+	return portainer.AgentPlatform(agentPlatformNumber), version, nil
+}
diff --git a/api/agent/version_test.go b/api/agent/version_test.go
new file mode 100644
index 0000000..ce51c2f
--- /dev/null
+++ b/api/agent/version_test.go
@@ -0,0 +1,119 @@
+package agent
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+
+	"github.com/stretchr/testify/require"
+)
+
+func tlsServer(t *testing.T, handler http.HandlerFunc) *httptest.Server {
+	t.Helper()
+	srv := httptest.NewTLSServer(handler)
+	t.Cleanup(srv.Close)
+
+	return srv
+}
+
+func TestGetAgentVersionAndPlatform_Success(t *testing.T) {
+	t.Parallel()
+
+	srv := tlsServer(t, func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set(portainer.PortainerAgentHeader, "2.19.0")
+		w.Header().Set(portainer.HTTPResponseAgentPlatform, "1")
+		w.WriteHeader(http.StatusNoContent)
+	})
+
+	tlsCfg := srv.Client().Transport.(*http.Transport).TLSClientConfig
+	platform, version, err := GetAgentVersionAndPlatform(srv.URL, tlsCfg)
+	require.NoError(t, err)
+	require.Equal(t, portainer.AgentPlatformDocker, platform)
+	require.Equal(t, "2.19.0", version)
+}
+
+func TestGetAgentVersionAndPlatform_NonOKStatus(t *testing.T) {
+	t.Parallel()
+
+	srv := tlsServer(t, func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusUnauthorized)
+	})
+
+	tlsCfg := srv.Client().Transport.(*http.Transport).TLSClientConfig
+	_, _, err := GetAgentVersionAndPlatform(srv.URL, tlsCfg)
+	require.Error(t, err)
+}
+
+func TestGetAgentVersionAndPlatform_MissingVersionHeader(t *testing.T) {
+	t.Parallel()
+
+	srv := tlsServer(t, func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set(portainer.HTTPResponseAgentPlatform, "1")
+		w.WriteHeader(http.StatusNoContent)
+	})
+
+	tlsCfg := srv.Client().Transport.(*http.Transport).TLSClientConfig
+	_, _, err := GetAgentVersionAndPlatform(srv.URL, tlsCfg)
+	require.Error(t, err)
+}
+
+func TestGetAgentVersionAndPlatform_MissingPlatformHeader(t *testing.T) {
+	t.Parallel()
+
+	srv := tlsServer(t, func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set(portainer.PortainerAgentHeader, "2.19.0")
+		w.WriteHeader(http.StatusNoContent)
+	})
+
+	tlsCfg := srv.Client().Transport.(*http.Transport).TLSClientConfig
+	_, _, err := GetAgentVersionAndPlatform(srv.URL, tlsCfg)
+	require.Error(t, err)
+}
+
+func TestGetAgentVersionAndPlatform_InvalidPlatformZero(t *testing.T) {
+	t.Parallel()
+
+	srv := tlsServer(t, func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set(portainer.PortainerAgentHeader, "2.19.0")
+		w.Header().Set(portainer.HTTPResponseAgentPlatform, "0")
+		w.WriteHeader(http.StatusNoContent)
+	})
+
+	tlsCfg := srv.Client().Transport.(*http.Transport).TLSClientConfig
+	_, _, err := GetAgentVersionAndPlatform(srv.URL, tlsCfg)
+	require.Error(t, err)
+}
+
+func TestGetAgentVersionAndPlatform_NonNumericPlatform(t *testing.T) {
+	t.Parallel()
+
+	srv := tlsServer(t, func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set(portainer.PortainerAgentHeader, "2.19.0")
+		w.Header().Set(portainer.HTTPResponseAgentPlatform, "docker")
+		w.WriteHeader(http.StatusNoContent)
+	})
+
+	tlsCfg := srv.Client().Transport.(*http.Transport).TLSClientConfig
+	_, _, err := GetAgentVersionAndPlatform(srv.URL, tlsCfg)
+	require.Error(t, err)
+}
+
+func TestGetAgentVersionAndPlatform_PingPathAppended(t *testing.T) {
+	t.Parallel()
+
+	var gotPath string
+	srv := tlsServer(t, func(w http.ResponseWriter, r *http.Request) {
+		gotPath = r.URL.Path
+		w.Header().Set(portainer.PortainerAgentHeader, "2.19.0")
+		w.Header().Set(portainer.HTTPResponseAgentPlatform, strconv.Itoa(int(portainer.AgentPlatformKubernetes)))
+		w.WriteHeader(http.StatusNoContent)
+	})
+
+	tlsCfg := srv.Client().Transport.(*http.Transport).TLSClientConfig
+	_, _, err := GetAgentVersionAndPlatform(srv.URL, tlsCfg)
+	require.NoError(t, err)
+	require.Equal(t, "/ping", gotPath)
+}
diff --git a/api/api.md b/api/api.md
new file mode 100644
index 0000000..8e53c40
--- /dev/null
+++ b/api/api.md
@@ -0,0 +1,61 @@
+The Portainer API is an HTTP API served by Portainer. It is used by the Portainer UI, and anything you can do in the UI can also be done via the HTTP API.
+
+API examples are available in the [Portainer documentation](https://documentation.portainer.io/api/api-examples/)
+
+You can find out more about Portainer [on our website](http://portainer.io) and get some support on [Slack](http://portainer.io/slack/).
+
+# Authentication
+
+Most of the API endpoints require authentication, as well as some level of authorization.
+Portainer uses JSON Web Tokens to manage authentication. You must provide a token in the **Authorization** header of each request using the **Bearer** scheme.
+
+Example:
+
+```
+Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6MSwidXNlcm5hbWUiOiJhZG1pbiIsInJvbGUiOjEsImV4cCI6MTQ5OTM3NjE1NH0.NJ6vE8FY1WG6jsRQzfMqeatJ4vh2TWAeeYfDhP71YEE
+```
+
+# Security
+
+Each API endpoint has an associated access policy, documented in its description.
+
+The following policies are available:
+
+- Public access
+- Authenticated access
+- Restricted access
+- Administrator access
+
+### Public access
+
+No authentication is required.
+
+### Authenticated access
+
+Authentication is required.
+
+### Restricted access
+
+Authentication is required. Additional checks may apply to verify access to the resource, and returned data may be filtered.
+
+### Administrator access
+
+Authentication and an administrator role are both required.
+
+# Execute Docker requests
+
+Portainer does not expose dedicated endpoints for managing Docker resources (create a container, remove a volume, etc).
+
+Instead, it acts as a reverse-proxy to the Docker HTTP API, allowing you to execute Docker requests via the Portainer HTTP API.
+
+To do so, use the `/endpoints/{id}/docker` endpoint. Note that this endpoint is not documented below due to Swagger limitations. It has a restricted access policy, so authentication is still required. Any request made to this endpoint is proxied to the Docker API of the associated environment - request and response objects are identical to those in the [Docker official documentation](https://docs.docker.com/engine/api).
+
+# Private Registry
+
+When using a private registry, include a Base64-encoded JSON string in the request header. The header parameter name is `X-Registry-Auth` and the value should encode the following structure: ‘{"registryId":\<registryId\>}’ where `<registryId>` is the ID of the registry where the repository was created.
+
+Example encoded value:
+
+```
+eyJyZWdpc3RyeUlkIjoxfQ==
+```
diff --git a/api/apikey/apikey.go b/api/apikey/apikey.go
new file mode 100644
index 0000000..de70b32
--- /dev/null
+++ b/api/apikey/apikey.go
@@ -0,0 +1,17 @@
+package apikey
+
+import (
+	portainer "github.com/portainer/portainer/api"
+)
+
+// APIKeyService represents a service for managing API keys.
+type APIKeyService interface {
+	HashRaw(rawKey string) string
+	GenerateApiKey(user portainer.User, description string) (string, *portainer.APIKey, error)
+	GetAPIKey(apiKeyID portainer.APIKeyID) (*portainer.APIKey, error)
+	GetAPIKeys(userID portainer.UserID) ([]portainer.APIKey, error)
+	GetDigestUserAndKey(digest string) (portainer.User, portainer.APIKey, error)
+	UpdateAPIKey(apiKey *portainer.APIKey) error
+	DeleteAPIKey(apiKeyID portainer.APIKeyID) error
+	InvalidateUserKeyCache(userId portainer.UserID) bool
+}
diff --git a/api/apikey/apikey_test.go b/api/apikey/apikey_test.go
new file mode 100644
index 0000000..b85c9ce
--- /dev/null
+++ b/api/apikey/apikey_test.go
@@ -0,0 +1,53 @@
+package apikey
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_generateRandomKey(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	tests := []struct {
+		name       string
+		wantLength int
+	}{
+		{
+			name:       "Generate a random key of length 16",
+			wantLength: 16,
+		},
+		{
+			name:       "Generate a random key of length 32",
+			wantLength: 32,
+		},
+		{
+			name:       "Generate a random key of length 64",
+			wantLength: 64,
+		},
+		{
+			name:       "Generate a random key of length 128",
+			wantLength: 128,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := GenerateRandomKey(tt.wantLength)
+			is.Len(got, tt.wantLength)
+		})
+	}
+
+	t.Run("Generated keys are unique", func(t *testing.T) {
+		keys := make(map[string]bool)
+
+		for range 100 {
+			key := GenerateRandomKey(8)
+			_, ok := keys[string(key)]
+			is.False(ok)
+
+			keys[string(key)] = true
+		}
+	})
+}
diff --git a/api/apikey/cache.go b/api/apikey/cache.go
new file mode 100644
index 0000000..b5d336a
--- /dev/null
+++ b/api/apikey/cache.go
@@ -0,0 +1,79 @@
+package apikey
+
+import (
+	portainer "github.com/portainer/portainer/api"
+
+	lru "github.com/hashicorp/golang-lru"
+)
+
+const DefaultAPIKeyCacheSize = 1024
+
+// entry is a tuple containing the user and API key associated to an API key digest
+type entry[T any] struct {
+	user   T
+	apiKey portainer.APIKey
+}
+
+type UserCompareFn[T any] func(T, portainer.UserID) bool
+
+// ApiKeyCache is a concurrency-safe, in-memory cache which primarily exists for to reduce database roundtrips.
+// We store the api-key digest (keys) and the associated user and key-data (values) in the cache.
+// This is required because HTTP requests will contain only the api-key digest in the x-api-key request header;
+// digest value must be mapped to a portainer user (and respective key data) for validation.
+// This cache is used to avoid multiple database queries to retrieve these user/key associated to the digest.
+type ApiKeyCache[T any] struct {
+	// cache type [string]entry cache (key: string(digest), value: user/key entry)
+	// note: []byte keys are not supported by golang-lru Cache
+	cache     *lru.Cache
+	userCmpFn UserCompareFn[T]
+}
+
+// NewAPIKeyCache creates a new cache for API keys
+func NewAPIKeyCache[T any](cacheSize int, userCompareFn UserCompareFn[T]) *ApiKeyCache[T] {
+	cache, _ := lru.New(cacheSize)
+
+	return &ApiKeyCache[T]{cache: cache, userCmpFn: userCompareFn}
+}
+
+// Get returns the user/key associated to an api-key's digest
+// This is required because HTTP requests will contain the digest of the API key in header,
+// the digest value must be mapped to a portainer user.
+func (c *ApiKeyCache[T]) Get(digest string) (T, portainer.APIKey, bool) {
+	val, ok := c.cache.Get(digest)
+	if !ok {
+		var t T
+
+		return t, portainer.APIKey{}, false
+	}
+
+	tuple := val.(entry[T])
+
+	return tuple.user, tuple.apiKey, true
+}
+
+// Set persists a user/key entry to the cache
+func (c *ApiKeyCache[T]) Set(digest string, user T, apiKey portainer.APIKey) {
+	c.cache.Add(digest, entry[T]{
+		user:   user,
+		apiKey: apiKey,
+	})
+}
+
+// Delete evicts a digest's user/key entry key from the cache
+func (c *ApiKeyCache[T]) Delete(digest string) {
+	c.cache.Remove(digest)
+}
+
+// InvalidateUserKeyCache loops through all the api-keys associated to a user and removes them from the cache
+func (c *ApiKeyCache[T]) InvalidateUserKeyCache(userId portainer.UserID) bool {
+	present := false
+
+	for _, k := range c.cache.Keys() {
+		user, _, _ := c.Get(k.(string))
+		if c.userCmpFn(user, userId) {
+			present = c.cache.Remove(k) || present
+		}
+	}
+
+	return present
+}
diff --git a/api/apikey/cache_test.go b/api/apikey/cache_test.go
new file mode 100644
index 0000000..b6ccb86
--- /dev/null
+++ b/api/apikey/cache_test.go
@@ -0,0 +1,186 @@
+package apikey
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_apiKeyCacheGet(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	keyCache := NewAPIKeyCache(10, compareUser)
+
+	// pre-populate cache
+	keyCache.cache.Add(string("foo"), entry[portainer.User]{user: portainer.User{}, apiKey: portainer.APIKey{}})
+	keyCache.cache.Add(string(""), entry[portainer.User]{user: portainer.User{}, apiKey: portainer.APIKey{}})
+
+	tests := []struct {
+		digest string
+		found  bool
+	}{
+		{
+			digest: "foo",
+			found:  true,
+		},
+		{
+			digest: "",
+			found:  true,
+		},
+		{
+			digest: "bar",
+			found:  false,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.digest, func(t *testing.T) {
+			_, _, found := keyCache.Get(test.digest)
+			is.Equal(test.found, found)
+		})
+	}
+}
+
+func Test_apiKeyCacheSet(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	keyCache := NewAPIKeyCache(10, compareUser)
+
+	// pre-populate cache
+	keyCache.Set("bar", portainer.User{ID: 2}, portainer.APIKey{})
+	keyCache.Set("foo", portainer.User{ID: 1}, portainer.APIKey{})
+
+	// overwrite existing entry
+	keyCache.Set("foo", portainer.User{ID: 3}, portainer.APIKey{})
+
+	val, ok := keyCache.cache.Get(string("bar"))
+	is.True(ok)
+
+	tuple := val.(entry[portainer.User])
+	is.Equal(portainer.User{ID: 2}, tuple.user)
+
+	val, ok = keyCache.cache.Get(string("foo"))
+	is.True(ok)
+
+	tuple = val.(entry[portainer.User])
+	is.Equal(portainer.User{ID: 3}, tuple.user)
+}
+
+func Test_apiKeyCacheDelete(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	keyCache := NewAPIKeyCache(10, compareUser)
+
+	t.Run("Delete an existing entry", func(t *testing.T) {
+		keyCache.cache.Add(string("foo"), entry[portainer.User]{user: portainer.User{ID: 1}, apiKey: portainer.APIKey{}})
+		keyCache.Delete("foo")
+
+		_, ok := keyCache.cache.Get(string("foo"))
+		is.False(ok)
+	})
+
+	t.Run("Delete a non-existing entry", func(t *testing.T) {
+		nonPanicFunc := func() { keyCache.Delete("non-existent-key") }
+		is.NotPanics(nonPanicFunc)
+	})
+}
+
+func Test_apiKeyCacheLRU(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	tests := []struct {
+		name        string
+		cacheLen    int
+		key         []string
+		foundKeys   []string
+		evictedKeys []string
+	}{
+		{
+			name:        "Cache length is 1, add 2 keys",
+			cacheLen:    1,
+			key:         []string{"foo", "bar"},
+			foundKeys:   []string{"bar"},
+			evictedKeys: []string{"foo"},
+		},
+		{
+			name:        "Cache length is 1, add 3 keys",
+			cacheLen:    1,
+			key:         []string{"foo", "bar", "baz"},
+			foundKeys:   []string{"baz"},
+			evictedKeys: []string{"foo", "bar"},
+		},
+		{
+			name:        "Cache length is 2, add 3 keys",
+			cacheLen:    2,
+			key:         []string{"foo", "bar", "baz"},
+			foundKeys:   []string{"bar", "baz"},
+			evictedKeys: []string{"foo"},
+		},
+		{
+			name:        "Cache length is 2, add 4 keys",
+			cacheLen:    2,
+			key:         []string{"foo", "bar", "baz", "qux"},
+			foundKeys:   []string{"baz", "qux"},
+			evictedKeys: []string{"foo", "bar"},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			keyCache := NewAPIKeyCache(test.cacheLen, compareUser)
+
+			for _, key := range test.key {
+				keyCache.Set(key, portainer.User{ID: 1}, portainer.APIKey{})
+			}
+
+			for _, key := range test.foundKeys {
+				_, _, found := keyCache.Get(key)
+				is.True(found, "Key %s not found", key)
+			}
+
+			for _, key := range test.evictedKeys {
+				_, _, found := keyCache.Get(key)
+				is.False(found, "key %s should have been evicted", key)
+			}
+		})
+	}
+}
+
+func Test_apiKeyCacheInvalidateUserKeyCache(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	keyCache := NewAPIKeyCache(10, compareUser)
+
+	t.Run("Removes users keys from cache", func(t *testing.T) {
+		keyCache.cache.Add(string("foo"), entry[portainer.User]{user: portainer.User{ID: 1}, apiKey: portainer.APIKey{}})
+
+		ok := keyCache.InvalidateUserKeyCache(1)
+		is.True(ok)
+
+		_, ok = keyCache.cache.Get(string("foo"))
+		is.False(ok)
+	})
+
+	t.Run("Does not affect other keys", func(t *testing.T) {
+		keyCache.cache.Add(string("foo"), entry[portainer.User]{user: portainer.User{ID: 1}, apiKey: portainer.APIKey{}})
+		keyCache.cache.Add(string("bar"), entry[portainer.User]{user: portainer.User{ID: 2}, apiKey: portainer.APIKey{}})
+
+		ok := keyCache.InvalidateUserKeyCache(1)
+		is.True(ok)
+
+		ok = keyCache.InvalidateUserKeyCache(1)
+		is.False(ok)
+
+		_, ok = keyCache.cache.Get(string("foo"))
+		is.False(ok)
+
+		_, ok = keyCache.cache.Get(string("bar"))
+		is.True(ok)
+	})
+}
diff --git a/api/apikey/service.go b/api/apikey/service.go
new file mode 100644
index 0000000..88b4e86
--- /dev/null
+++ b/api/apikey/service.go
@@ -0,0 +1,143 @@
+package apikey
+
+import (
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
+	"fmt"
+	"io"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+
+	"github.com/pkg/errors"
+)
+
+const portainerAPIKeyPrefix = "ptr_"
+
+var ErrInvalidAPIKey = errors.New("Invalid API key")
+
+type apiKeyService struct {
+	apiKeyRepository dataservices.APIKeyRepository
+	userRepository   dataservices.UserService
+	cache            *ApiKeyCache[portainer.User]
+}
+
+// GenerateRandomKey generates a random key of specified length
+// source: https://github.com/gorilla/securecookie/blob/master/securecookie.go#L515
+func GenerateRandomKey(length int) []byte {
+	k := make([]byte, length)
+	if _, err := io.ReadFull(rand.Reader, k); err != nil {
+		return nil
+	}
+
+	return k
+}
+
+func compareUser(u portainer.User, id portainer.UserID) bool {
+	return u.ID == id
+}
+
+func NewAPIKeyService(apiKeyRepository dataservices.APIKeyRepository, userRepository dataservices.UserService) *apiKeyService {
+	return &apiKeyService{
+		apiKeyRepository: apiKeyRepository,
+		userRepository:   userRepository,
+		cache:            NewAPIKeyCache(DefaultAPIKeyCacheSize, compareUser),
+	}
+}
+
+// HashRaw computes a hash digest of provided raw API key.
+func (a *apiKeyService) HashRaw(rawKey string) string {
+	hashDigest := sha256.Sum256([]byte(rawKey))
+
+	return base64.StdEncoding.EncodeToString(hashDigest[:])
+}
+
+// GenerateApiKey generates a raw API key for a user (for one-time display).
+// The generated API key is stored in the cache and database.
+func (a *apiKeyService) GenerateApiKey(user portainer.User, description string) (string, *portainer.APIKey, error) {
+	randKey := GenerateRandomKey(32)
+	encodedRawAPIKey := base64.StdEncoding.EncodeToString(randKey)
+	prefixedAPIKey := portainerAPIKeyPrefix + encodedRawAPIKey
+	hashDigest := a.HashRaw(prefixedAPIKey)
+
+	apiKey := &portainer.APIKey{
+		UserID:      user.ID,
+		Description: description,
+		Prefix:      prefixedAPIKey[:7],
+		DateCreated: time.Now().Unix(),
+		Digest:      hashDigest,
+	}
+
+	if err := a.apiKeyRepository.Create(apiKey); err != nil {
+		return "", nil, errors.Wrap(err, "Unable to create API key")
+	}
+
+	// persist api-key to cache
+	a.cache.Set(apiKey.Digest, user, *apiKey)
+
+	return prefixedAPIKey, apiKey, nil
+}
+
+// GetAPIKey returns an API key by its ID.
+func (a *apiKeyService) GetAPIKey(apiKeyID portainer.APIKeyID) (*portainer.APIKey, error) {
+	return a.apiKeyRepository.Read(apiKeyID)
+}
+
+// GetAPIKeys returns all the API keys associated to a user.
+func (a *apiKeyService) GetAPIKeys(userID portainer.UserID) ([]portainer.APIKey, error) {
+	return a.apiKeyRepository.GetAPIKeysByUserID(userID)
+}
+
+// GetDigestUserAndKey returns the user and api-key associated to a specified hash digest.
+// A cache lookup is performed first; if the user/api-key is not found in the cache, respective database lookups are performed.
+func (a *apiKeyService) GetDigestUserAndKey(digest string) (portainer.User, portainer.APIKey, error) {
+	cachedUser, cachedKey, ok := a.cache.Get(digest)
+	if ok {
+		return cachedUser, cachedKey, nil
+	}
+
+	apiKey, err := a.apiKeyRepository.GetAPIKeyByDigest(digest)
+	if err != nil {
+		return portainer.User{}, portainer.APIKey{}, errors.Wrap(err, "Unable to retrieve API key")
+	}
+
+	user, err := a.userRepository.Read(apiKey.UserID)
+	if err != nil {
+		return portainer.User{}, portainer.APIKey{}, errors.Wrap(err, "Unable to retrieve digest user")
+	}
+
+	// persist api-key to cache - for quicker future lookups
+	a.cache.Set(apiKey.Digest, *user, *apiKey)
+
+	return *user, *apiKey, nil
+}
+
+// UpdateAPIKey updates an API key and in cache and database.
+func (a *apiKeyService) UpdateAPIKey(apiKey *portainer.APIKey) error {
+	user, _, err := a.GetDigestUserAndKey(apiKey.Digest)
+	if err != nil {
+		return errors.Wrap(err, "Unable to retrieve API key")
+	}
+
+	a.cache.Set(apiKey.Digest, user, *apiKey)
+
+	return a.apiKeyRepository.Update(apiKey.ID, apiKey)
+}
+
+// DeleteAPIKey deletes an API key and removes the digest/api-key entry from the cache.
+func (a *apiKeyService) DeleteAPIKey(apiKeyID portainer.APIKeyID) error {
+	apiKey, err := a.apiKeyRepository.Read(apiKeyID)
+	if err != nil {
+		return errors.Wrap(err, fmt.Sprintf("Unable to retrieve API key: %d", apiKeyID))
+	}
+
+	a.cache.Delete(apiKey.Digest)
+
+	return a.apiKeyRepository.Delete(apiKeyID)
+}
+
+func (a *apiKeyService) InvalidateUserKeyCache(userId portainer.UserID) bool {
+	return a.cache.InvalidateUserKeyCache(userId)
+}
diff --git a/api/apikey/service_test.go b/api/apikey/service_test.go
new file mode 100644
index 0000000..b86468c
--- /dev/null
+++ b/api/apikey/service_test.go
@@ -0,0 +1,315 @@
+package apikey
+
+import (
+	"crypto/sha256"
+	"encoding/base64"
+	"fmt"
+	"strings"
+	"testing"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+
+	"github.com/rs/zerolog/log"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_SatisfiesAPIKeyServiceInterface(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+	is.Implements((*APIKeyService)(nil), NewAPIKeyService(nil, nil))
+}
+
+func Test_GenerateApiKey(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	_, store := datastore.MustNewTestStore(t, true, true)
+
+	service := NewAPIKeyService(store.APIKeyRepository(), store.User())
+
+	t.Run("Successfully generates API key", func(t *testing.T) {
+		desc := "test-1"
+		rawKey, apiKey, err := service.GenerateApiKey(portainer.User{ID: 1}, desc)
+		require.NoError(t, err)
+		is.NotEmpty(rawKey)
+		is.NotEmpty(apiKey)
+		is.Equal(desc, apiKey.Description)
+	})
+
+	t.Run("Api key prefix is 7 chars", func(t *testing.T) {
+		rawKey, apiKey, err := service.GenerateApiKey(portainer.User{ID: 1}, "test-2")
+		require.NoError(t, err)
+
+		is.Equal(rawKey[:7], apiKey.Prefix)
+		is.Len(apiKey.Prefix, 7)
+	})
+
+	t.Run("Api key has 'ptr_' as prefix", func(t *testing.T) {
+		rawKey, _, err := service.GenerateApiKey(portainer.User{ID: 1}, "test-x")
+		require.NoError(t, err)
+
+		is.Equal(portainerAPIKeyPrefix, "ptr_")
+		is.True(strings.HasPrefix(rawKey, "ptr_"))
+	})
+
+	t.Run("Successfully caches API key", func(t *testing.T) {
+		user := portainer.User{ID: 1}
+		_, apiKey, err := service.GenerateApiKey(user, "test-3")
+		require.NoError(t, err)
+
+		userFromCache, apiKeyFromCache, ok := service.cache.Get(apiKey.Digest)
+		is.True(ok)
+		is.Equal(user, userFromCache)
+		is.Equal(apiKey, &apiKeyFromCache)
+	})
+
+	t.Run("Decoded raw api-key digest matches generated digest", func(t *testing.T) {
+		rawKey, apiKey, err := service.GenerateApiKey(portainer.User{ID: 1}, "test-4")
+		require.NoError(t, err)
+
+		generatedDigest := sha256.Sum256([]byte(rawKey))
+
+		is.Equal(apiKey.Digest, base64.StdEncoding.EncodeToString(generatedDigest[:]))
+	})
+}
+
+func Test_GetAPIKey(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	_, store := datastore.MustNewTestStore(t, true, true)
+
+	service := NewAPIKeyService(store.APIKeyRepository(), store.User())
+
+	t.Run("Successfully returns all API keys", func(t *testing.T) {
+		user := portainer.User{ID: 1}
+		_, apiKey, err := service.GenerateApiKey(user, "test-1")
+		require.NoError(t, err)
+
+		apiKeyGot, err := service.GetAPIKey(apiKey.ID)
+		require.NoError(t, err)
+
+		is.Equal(apiKey, apiKeyGot)
+	})
+}
+
+func Test_GetAPIKeys(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	_, store := datastore.MustNewTestStore(t, true, true)
+
+	service := NewAPIKeyService(store.APIKeyRepository(), store.User())
+
+	t.Run("Successfully returns all API keys", func(t *testing.T) {
+		user := portainer.User{ID: 1}
+		_, _, err := service.GenerateApiKey(user, "test-1")
+		require.NoError(t, err)
+		_, _, err = service.GenerateApiKey(user, "test-2")
+		require.NoError(t, err)
+
+		keys, err := service.GetAPIKeys(user.ID)
+		require.NoError(t, err)
+		is.Len(keys, 2)
+	})
+}
+
+func Test_GetDigestUserAndKey(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	_, store := datastore.MustNewTestStore(t, true, true)
+
+	service := NewAPIKeyService(store.APIKeyRepository(), store.User())
+
+	t.Run("Successfully returns user and api key associated to digest", func(t *testing.T) {
+		user := portainer.User{ID: 1}
+		_, apiKey, err := service.GenerateApiKey(user, "test-1")
+		require.NoError(t, err)
+
+		userGot, apiKeyGot, err := service.GetDigestUserAndKey(apiKey.Digest)
+		require.NoError(t, err)
+		is.Equal(user, userGot)
+		is.Equal(*apiKey, apiKeyGot)
+	})
+
+	t.Run("Successfully caches user and api key associated to digest", func(t *testing.T) {
+		user := portainer.User{ID: 1}
+		_, apiKey, err := service.GenerateApiKey(user, "test-1")
+		require.NoError(t, err)
+
+		userGot, apiKeyGot, err := service.GetDigestUserAndKey(apiKey.Digest)
+		require.NoError(t, err)
+		is.Equal(user, userGot)
+		is.Equal(*apiKey, apiKeyGot)
+
+		userFromCache, apiKeyFromCache, ok := service.cache.Get(apiKey.Digest)
+		is.True(ok)
+		is.Equal(userGot, userFromCache)
+		is.Equal(apiKeyGot, apiKeyFromCache)
+	})
+}
+
+func Test_UpdateAPIKey(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	_, store := datastore.MustNewTestStore(t, true, true)
+
+	service := NewAPIKeyService(store.APIKeyRepository(), store.User())
+
+	t.Run("Successfully updates the api-key LastUsed time", func(t *testing.T) {
+		user := portainer.User{ID: 1}
+
+		err := store.User().Create(&user)
+		require.NoError(t, err)
+
+		_, apiKey, err := service.GenerateApiKey(user, "test-x")
+		require.NoError(t, err)
+
+		apiKey.LastUsed = time.Now().UTC().Unix()
+		err = service.UpdateAPIKey(apiKey)
+		require.NoError(t, err)
+
+		_, apiKeyGot, err := service.GetDigestUserAndKey(apiKey.Digest)
+		require.NoError(t, err)
+
+		log.Debug().Str("wanted", fmt.Sprintf("%+v", apiKey)).Str("got", fmt.Sprintf("%+v", apiKeyGot)).Msg("")
+
+		is.Equal(apiKey.LastUsed, apiKeyGot.LastUsed)
+	})
+
+	t.Run("Successfully updates api-key in cache upon api-key update", func(t *testing.T) {
+		_, apiKey, err := service.GenerateApiKey(portainer.User{ID: 1}, "test-x2")
+		require.NoError(t, err)
+
+		_, apiKeyFromCache, ok := service.cache.Get(apiKey.Digest)
+		is.True(ok)
+		is.Equal(*apiKey, apiKeyFromCache)
+
+		apiKey.LastUsed = time.Now().UTC().Unix()
+		is.NotEqual(*apiKey, apiKeyFromCache)
+
+		err = service.UpdateAPIKey(apiKey)
+		require.NoError(t, err)
+
+		_, updatedAPIKeyFromCache, ok := service.cache.Get(apiKey.Digest)
+		is.True(ok)
+		is.Equal(*apiKey, updatedAPIKeyFromCache)
+	})
+}
+
+func Test_DeleteAPIKey(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	_, store := datastore.MustNewTestStore(t, true, true)
+
+	service := NewAPIKeyService(store.APIKeyRepository(), store.User())
+
+	t.Run("Successfully updates the api-key", func(t *testing.T) {
+		user := portainer.User{ID: 1}
+		_, apiKey, err := service.GenerateApiKey(user, "test-1")
+		require.NoError(t, err)
+
+		_, apiKeyGot, err := service.GetDigestUserAndKey(apiKey.Digest)
+		require.NoError(t, err)
+		is.Equal(*apiKey, apiKeyGot)
+
+		err = service.DeleteAPIKey(apiKey.ID)
+		require.NoError(t, err)
+
+		_, _, err = service.GetDigestUserAndKey(apiKey.Digest)
+		require.Error(t, err)
+	})
+
+	t.Run("Successfully removes api-key from cache upon deletion", func(t *testing.T) {
+		user := portainer.User{ID: 1}
+		_, apiKey, err := service.GenerateApiKey(user, "test-1")
+		require.NoError(t, err)
+
+		_, apiKeyFromCache, ok := service.cache.Get(apiKey.Digest)
+		is.True(ok)
+		is.Equal(*apiKey, apiKeyFromCache)
+
+		err = service.DeleteAPIKey(apiKey.ID)
+		require.NoError(t, err)
+
+		_, _, ok = service.cache.Get(apiKey.Digest)
+		is.False(ok)
+	})
+}
+
+func Test_InvalidateUserKeyCache(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	_, store := datastore.MustNewTestStore(t, true, true)
+
+	service := NewAPIKeyService(store.APIKeyRepository(), store.User())
+
+	t.Run("Successfully updates evicts keys from cache", func(t *testing.T) {
+		// generate api keys
+		user := portainer.User{ID: 1}
+		_, apiKey1, err := service.GenerateApiKey(user, "test-1")
+		require.NoError(t, err)
+
+		_, apiKey2, err := service.GenerateApiKey(user, "test-2")
+		require.NoError(t, err)
+
+		// verify api keys are present in cache
+		_, apiKeyFromCache, ok := service.cache.Get(apiKey1.Digest)
+		is.True(ok)
+		is.Equal(*apiKey1, apiKeyFromCache)
+
+		_, apiKeyFromCache, ok = service.cache.Get(apiKey2.Digest)
+		is.True(ok)
+		is.Equal(*apiKey2, apiKeyFromCache)
+
+		// evict cache
+		ok = service.InvalidateUserKeyCache(user.ID)
+		is.True(ok)
+
+		// verify users keys have been flushed from cache
+		_, _, ok = service.cache.Get(apiKey1.Digest)
+		is.False(ok)
+
+		_, _, ok = service.cache.Get(apiKey2.Digest)
+		is.False(ok)
+	})
+
+	t.Run("User key eviction does not affect other users keys", func(t *testing.T) {
+		// generate keys for 2 users
+		user1 := portainer.User{ID: 1}
+		_, apiKey1, err := service.GenerateApiKey(user1, "test-1")
+		require.NoError(t, err)
+
+		user2 := portainer.User{ID: 2}
+		_, apiKey2, err := service.GenerateApiKey(user2, "test-2")
+		require.NoError(t, err)
+
+		// verify keys in cache
+		_, apiKeyFromCache, ok := service.cache.Get(apiKey1.Digest)
+		is.True(ok)
+		is.Equal(*apiKey1, apiKeyFromCache)
+
+		_, apiKeyFromCache, ok = service.cache.Get(apiKey2.Digest)
+		is.True(ok)
+		is.Equal(*apiKey2, apiKeyFromCache)
+
+		// evict key of single user from cache
+		ok = service.cache.InvalidateUserKeyCache(user1.ID)
+		is.True(ok)
+
+		// verify user1 key has been flushed from cache
+		_, _, ok = service.cache.Get(apiKey1.Digest)
+		is.False(ok)
+
+		// verify user2 key is still in cache
+		_, _, ok = service.cache.Get(apiKey2.Digest)
+		is.True(ok)
+	})
+}
diff --git a/api/archive/tar.go b/api/archive/tar.go
new file mode 100644
index 0000000..9643199
--- /dev/null
+++ b/api/archive/tar.go
@@ -0,0 +1,70 @@
+package archive
+
+import (
+	"archive/tar"
+	"bytes"
+)
+
+// TarFileInBuffer will create a tar archive containing a single file named via fileName and using the content
+// specified in fileContent. Returns the archive as a byte array.
+func TarFileInBuffer(fileContent []byte, fileName string, mode int64) ([]byte, error) {
+	var buffer bytes.Buffer
+	tarWriter := tar.NewWriter(&buffer)
+
+	header := &tar.Header{
+		Name: fileName,
+		Mode: mode,
+		Size: int64(len(fileContent)),
+	}
+
+	if err := tarWriter.WriteHeader(header); err != nil {
+		return nil, err
+	}
+
+	if _, err := tarWriter.Write(fileContent); err != nil {
+		return nil, err
+	}
+
+	if err := tarWriter.Close(); err != nil {
+		return nil, err
+	}
+
+	return buffer.Bytes(), nil
+}
+
+// tarFileInBuffer represents a tar archive buffer.
+type tarFileInBuffer struct {
+	b *bytes.Buffer
+	w *tar.Writer
+}
+
+func NewTarFileInBuffer() *tarFileInBuffer {
+	var b bytes.Buffer
+	return &tarFileInBuffer{b: &b, w: tar.NewWriter(&b)}
+}
+
+// Put puts a single file to tar archive buffer.
+func (t *tarFileInBuffer) Put(fileContent []byte, fileName string, mode int64) error {
+	hdr := &tar.Header{
+		Name: fileName,
+		Mode: mode,
+		Size: int64(len(fileContent)),
+	}
+
+	if err := t.w.WriteHeader(hdr); err != nil {
+		return err
+	}
+
+	_, err := t.w.Write(fileContent)
+
+	return err
+}
+
+// Bytes returns the archive as a byte array.
+func (t *tarFileInBuffer) Bytes() []byte {
+	return t.b.Bytes()
+}
+
+func (t *tarFileInBuffer) Close() error {
+	return t.w.Close()
+}
diff --git a/api/archive/targz.go b/api/archive/targz.go
new file mode 100644
index 0000000..2f34963
--- /dev/null
+++ b/api/archive/targz.go
@@ -0,0 +1,132 @@
+package archive
+
+import (
+	"archive/tar"
+	"compress/gzip"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/portainer/portainer/api/filesystem"
+	"github.com/portainer/portainer/api/logs"
+)
+
+// TarGzDir creates a tar.gz archive and returns it's path.
+// abosolutePath should be an absolute path to a directory.
+// Archive name will be <directoryName>.tar.gz and will be placed next to the directory.
+func TarGzDir(absolutePath string) (string, error) {
+	targzPath := filepath.Join(absolutePath, filepath.Base(absolutePath)+".tar.gz")
+	outFile, err := os.Create(targzPath)
+	if err != nil {
+		return "", err
+	}
+	defer logs.CloseAndLogErr(outFile)
+
+	zipWriter := gzip.NewWriter(outFile)
+	defer logs.CloseAndLogErr(zipWriter)
+
+	tarWriter := tar.NewWriter(zipWriter)
+	defer logs.CloseAndLogErr(tarWriter)
+
+	err = filepath.Walk(absolutePath, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+
+		if path == targzPath {
+			return nil // skip archive file
+		}
+
+		pathInArchive := filepath.Clean(strings.TrimPrefix(path, absolutePath))
+		if pathInArchive == "" {
+			return nil // skip root dir
+		}
+
+		return addToArchive(tarWriter, pathInArchive, path, info)
+	})
+
+	return targzPath, err
+}
+
+func addToArchive(tarWriter *tar.Writer, pathInArchive string, path string, info os.FileInfo) error {
+	if info.IsDir() {
+		return nil
+	}
+
+	file, err := os.Open(path)
+	if err != nil {
+		return err
+	}
+
+	stat, err := file.Stat()
+	if err != nil {
+		return err
+	}
+
+	header, err := tar.FileInfoHeader(stat, stat.Name())
+	if err != nil {
+		return err
+	}
+	header.Name = pathInArchive // use relative paths in archive
+
+	err = tarWriter.WriteHeader(header)
+	if err != nil {
+		return err
+	}
+	if stat.IsDir() {
+		return nil
+	}
+
+	_, err = io.Copy(tarWriter, file)
+	return err
+}
+
+// ExtractTarGz reads a .tar.gz archive from the reader and extracts it into outputDirPath directory
+func ExtractTarGz(r io.Reader, outputDirPath string) error {
+	zipReader, err := gzip.NewReader(r)
+	if err != nil {
+		return err
+	}
+	defer logs.CloseAndLogErr(zipReader)
+
+	tarReader := tar.NewReader(zipReader)
+
+	for {
+		header, err := tarReader.Next()
+
+		if errors.Is(err, io.EOF) {
+			break
+		}
+
+		if err != nil {
+			return err
+		}
+
+		switch header.Typeflag {
+		case tar.TypeDir:
+			// skip, dir will be created with a file
+		case tar.TypeReg:
+			p := filesystem.JoinPaths(outputDirPath, header.Name)
+			if err := os.MkdirAll(filepath.Dir(p), 0o744); err != nil {
+				return fmt.Errorf("Failed to extract dir %s", filepath.Dir(p))
+			}
+			outFile, err := os.Create(p)
+			if err != nil {
+				return fmt.Errorf("Failed to create file %s", header.Name)
+			}
+			if _, err := io.Copy(outFile, tarReader); err != nil {
+				return fmt.Errorf("Failed to extract file %s", header.Name)
+			}
+			logs.CloseAndLogErr(outFile)
+		default:
+			return fmt.Errorf("tar: unknown type: %v in %s",
+				header.Typeflag,
+				header.Name)
+		}
+	}
+
+	return nil
+}
diff --git a/api/archive/targz_test.go b/api/archive/targz_test.go
new file mode 100644
index 0000000..08d579b
--- /dev/null
+++ b/api/archive/targz_test.go
@@ -0,0 +1,168 @@
+package archive
+
+import (
+	"archive/tar"
+	"compress/gzip"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"testing"
+
+	"github.com/portainer/portainer/api/filesystem"
+	"github.com/rs/zerolog/log"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func listFiles(dir string) []string {
+	items := make([]string, 0)
+
+	if err := filepath.Walk(dir, func(path string, info os.FileInfo, err error) error {
+		if path == dir {
+			return nil
+		}
+
+		items = append(items, path)
+
+		return nil
+	}); err != nil {
+		log.Warn().Err(err).Msg("failed to list files in directory")
+	}
+
+	return items
+}
+
+func Test_shouldCreateArchive(t *testing.T) {
+	t.Parallel()
+	tmpdir := t.TempDir()
+	content := []byte("content")
+
+	err := os.WriteFile(filesystem.JoinPaths(tmpdir, "outer"), content, 0600)
+	require.NoError(t, err)
+
+	err = os.MkdirAll(filesystem.JoinPaths(tmpdir, "dir"), 0700)
+	require.NoError(t, err)
+
+	err = os.WriteFile(filesystem.JoinPaths(tmpdir, "dir", ".dotfile"), content, 0600)
+	require.NoError(t, err)
+
+	err = os.WriteFile(filesystem.JoinPaths(tmpdir, "dir", "inner"), content, 0600)
+	require.NoError(t, err)
+
+	gzPath, err := TarGzDir(tmpdir)
+	require.NoError(t, err)
+	assert.Equal(t, filesystem.JoinPaths(tmpdir, filepath.Base(tmpdir)+".tar.gz"), gzPath)
+
+	extractionDir := t.TempDir()
+	cmd := exec.Command("tar", "-xzf", gzPath, "-C", extractionDir)
+	if err := cmd.Run(); err != nil {
+		t.Fatal("Failed to extract archive: ", err)
+	}
+	extractedFiles := listFiles(extractionDir)
+
+	wasExtracted := func(p string) {
+		fullpath := filesystem.JoinPaths(extractionDir, p)
+		assert.Contains(t, extractedFiles, fullpath)
+		copyContent, err := os.ReadFile(fullpath)
+		require.NoError(t, err)
+		assert.Equal(t, content, copyContent)
+	}
+
+	wasExtracted("outer")
+	wasExtracted("dir/inner")
+	wasExtracted("dir/.dotfile")
+}
+
+func Test_shouldCreateArchive2(t *testing.T) {
+	t.Parallel()
+	tmpdir := t.TempDir()
+	content := []byte("content")
+
+	err := os.WriteFile(filesystem.JoinPaths(tmpdir, "outer"), content, 0600)
+	require.NoError(t, err)
+
+	err = os.MkdirAll(filesystem.JoinPaths(tmpdir, "dir"), 0700)
+	require.NoError(t, err)
+
+	err = os.WriteFile(filesystem.JoinPaths(tmpdir, "dir", ".dotfile"), content, 0600)
+	require.NoError(t, err)
+
+	err = os.WriteFile(filesystem.JoinPaths(tmpdir, "dir", "inner"), content, 0600)
+	require.NoError(t, err)
+
+	gzPath, err := TarGzDir(tmpdir)
+	require.NoError(t, err)
+	assert.Equal(t, filesystem.JoinPaths(tmpdir, filepath.Base(tmpdir)+".tar.gz"), gzPath)
+
+	extractionDir := t.TempDir()
+	r, _ := os.Open(gzPath)
+	if err := ExtractTarGz(r, extractionDir); err != nil {
+		t.Fatal("Failed to extract archive: ", err)
+	}
+	extractedFiles := listFiles(extractionDir)
+
+	wasExtracted := func(p string) {
+		fullpath := filesystem.JoinPaths(extractionDir, p)
+		assert.Contains(t, extractedFiles, fullpath)
+		copyContent, _ := os.ReadFile(fullpath)
+		assert.Equal(t, content, copyContent)
+	}
+
+	wasExtracted("outer")
+	wasExtracted("dir/inner")
+	wasExtracted("dir/.dotfile")
+}
+
+func TestExtractTarGzPathTraversal(t *testing.T) {
+	t.Parallel()
+	testDir := t.TempDir()
+
+	// Create an evil file with a path traversal attempt
+	tarPath := filesystem.JoinPaths(testDir, "evil.tar.gz")
+
+	evilFile, err := os.Create(tarPath)
+	require.NoError(t, err)
+
+	gzWriter := gzip.NewWriter(evilFile)
+	tarWriter := tar.NewWriter(gzWriter)
+
+	content := []byte("evil content")
+
+	header := &tar.Header{
+		Name:     "../evil.txt",
+		Mode:     0600,
+		Size:     int64(len(content)),
+		Typeflag: tar.TypeReg,
+	}
+
+	err = tarWriter.WriteHeader(header)
+	require.NoError(t, err)
+
+	_, err = tarWriter.Write(content)
+	require.NoError(t, err)
+
+	err = tarWriter.Close()
+	require.NoError(t, err)
+
+	err = gzWriter.Close()
+	require.NoError(t, err)
+
+	err = evilFile.Close()
+	require.NoError(t, err)
+
+	// Attempt to extract the evil file
+	extractionDir := filesystem.JoinPaths(testDir, "extraction")
+	err = os.Mkdir(extractionDir, 0700)
+	require.NoError(t, err)
+
+	tarFile, err := os.Open(tarPath)
+	require.NoError(t, err)
+
+	// Check that the file didn't escape
+	err = ExtractTarGz(tarFile, extractionDir)
+	require.NoError(t, err)
+	require.NoFileExists(t, filesystem.JoinPaths(testDir, "evil.txt"))
+
+	err = tarFile.Close()
+	require.NoError(t, err)
+}
diff --git a/api/archive/testdata/sample_archive.zip b/api/archive/testdata/sample_archive.zip
new file mode 100644
index 0000000..de28924
Binary files /dev/null and b/api/archive/testdata/sample_archive.zip differ
diff --git a/api/archive/zip.go b/api/archive/zip.go
new file mode 100644
index 0000000..331b2ce
--- /dev/null
+++ b/api/archive/zip.go
@@ -0,0 +1,73 @@
+package archive
+
+import (
+	"archive/zip"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/portainer/portainer/api/logs"
+
+	"github.com/pkg/errors"
+)
+
+// UnzipFile will decompress a zip archive, moving all files and folders
+// within the zip file (parameter 1) to an output directory (parameter 2).
+func UnzipFile(src string, dest string) error {
+	r, err := zip.OpenReader(src)
+	if err != nil {
+		return err
+	}
+	defer logs.CloseAndLogErr(r)
+
+	for _, f := range r.File {
+		p := filepath.Join(dest, f.Name)
+
+		// Check for ZipSlip. More Info: http://bit.ly/2MsjAWE
+		if !strings.HasPrefix(p, filepath.Clean(dest)+string(os.PathSeparator)) {
+			return fmt.Errorf("%s: illegal file path", p)
+		}
+
+		if f.FileInfo().IsDir() {
+			// Make Folder
+			if err := os.MkdirAll(p, os.ModePerm); err != nil {
+				return err
+			}
+
+			continue
+		}
+
+		if err := unzipFile(f, p); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func unzipFile(f *zip.File, p string) error {
+	// Make File
+	if err := os.MkdirAll(filepath.Dir(p), os.ModePerm); err != nil {
+		return errors.Wrapf(err, "unzipFile: can't make a path %s", p)
+	}
+
+	outFile, err := os.OpenFile(p, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, f.Mode())
+	if err != nil {
+		return errors.Wrapf(err, "unzipFile: can't create file %s", p)
+	}
+	defer logs.CloseAndLogErr(outFile)
+
+	rc, err := f.Open()
+	if err != nil {
+		return errors.Wrapf(err, "unzipFile: can't open zip file %s in the archive", f.Name)
+	}
+	defer logs.CloseAndLogErr(rc)
+
+	if _, err = io.Copy(outFile, rc); err != nil {
+		return errors.Wrapf(err, "unzipFile: can't copy an archived file content")
+	}
+
+	return nil
+}
diff --git a/api/archive/zip_test.go b/api/archive/zip_test.go
new file mode 100644
index 0000000..52e5917
--- /dev/null
+++ b/api/archive/zip_test.go
@@ -0,0 +1,32 @@
+package archive
+
+import (
+	"testing"
+
+	"github.com/portainer/portainer/api/filesystem"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestUnzipFile(t *testing.T) {
+	t.Parallel()
+	dir := t.TempDir()
+	/*
+		Archive structure.
+		├── 0
+		│	├── 1
+		│	│	└── 2.txt
+		│	└── 1.txt
+		└── 0.txt
+	*/
+
+	err := UnzipFile("./testdata/sample_archive.zip", dir)
+
+	require.NoError(t, err)
+	archiveDir := dir + "/sample_archive"
+	assert.FileExists(t, filesystem.JoinPaths(archiveDir, "0.txt"))
+	assert.FileExists(t, filesystem.JoinPaths(archiveDir, "0", "1.txt"))
+	assert.FileExists(t, filesystem.JoinPaths(archiveDir, "0", "1", "2.txt"))
+
+}
diff --git a/api/aws/ecr/authorization_token.go b/api/aws/ecr/authorization_token.go
new file mode 100644
index 0000000..d211462
--- /dev/null
+++ b/api/aws/ecr/authorization_token.go
@@ -0,0 +1,61 @@
+package ecr
+
+import (
+	"context"
+	"encoding/base64"
+	"errors"
+	"strings"
+	"time"
+)
+
+func (s *Service) GetEncodedAuthorizationToken(ctx context.Context) (token *string, expiry *time.Time, err error) {
+	getAuthorizationTokenOutput, err := s.client.GetAuthorizationToken(ctx, nil)
+	if err != nil {
+		return
+	}
+
+	if len(getAuthorizationTokenOutput.AuthorizationData) == 0 {
+		err = errors.New("AuthorizationData is empty")
+		return
+	}
+
+	authData := getAuthorizationTokenOutput.AuthorizationData[0]
+
+	token = authData.AuthorizationToken
+	expiry = authData.ExpiresAt
+
+	return
+}
+
+func (s *Service) GetAuthorizationToken(ctx context.Context) (token *string, expiry *time.Time, err error) {
+	tokenEncodedStr, expiry, err := s.GetEncodedAuthorizationToken(ctx)
+	if err != nil {
+		return
+	}
+
+	tokenByte, err := base64.StdEncoding.DecodeString(*tokenEncodedStr)
+	if err != nil {
+		return
+	}
+	tokenStr := string(tokenByte)
+	token = &tokenStr
+
+	return
+}
+
+func (s *Service) ParseAuthorizationToken(token string) (username string, password string, err error) {
+	if len(token) == 0 {
+		return
+	}
+
+	splitToken := strings.Split(token, ":")
+	if len(splitToken) < 2 {
+		err = errors.New("invalid ECR authorization token")
+		return
+	}
+
+	username = splitToken[0]
+	password = splitToken[1]
+
+	return
+}
diff --git a/api/aws/ecr/ecr.go b/api/aws/ecr/ecr.go
new file mode 100644
index 0000000..0fc81db
--- /dev/null
+++ b/api/aws/ecr/ecr.go
@@ -0,0 +1,41 @@
+package ecr
+
+import (
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/credentials"
+	"github.com/aws/aws-sdk-go-v2/service/ecr"
+)
+
+// Registry represents an ECR registry endpoint information.
+// This struct is used to parse and validate ECR endpoint URLs.
+type Registry struct {
+	ID     string // AWS account ID (empty for accountless endpoints like "ecr-fips.us-west-1.amazonaws.com")
+	FIPS   bool   // Whether this is a FIPS endpoint (contains "-fips" in the URL)
+	Region string // AWS region (e.g., "us-east-1", "us-gov-west-1")
+	Public bool   // Whether this is ecr-public.aws.com
+}
+
+type (
+	Service struct {
+		accessKey string
+		secretKey string
+		region    string
+		client    *ecr.Client
+	}
+)
+
+func NewService(accessKey, secretKey, region string) *Service {
+	options := ecr.Options{
+		Region:      region,
+		Credentials: aws.NewCredentialsCache(credentials.NewStaticCredentialsProvider(accessKey, secretKey, "")),
+	}
+
+	client := ecr.New(options)
+
+	return &Service{
+		accessKey: accessKey,
+		secretKey: secretKey,
+		region:    region,
+		client:    client,
+	}
+}
diff --git a/api/aws/ecr/parse_endpoints.go b/api/aws/ecr/parse_endpoints.go
new file mode 100644
index 0000000..7c942c0
--- /dev/null
+++ b/api/aws/ecr/parse_endpoints.go
@@ -0,0 +1,70 @@
+package ecr
+
+import (
+	"fmt"
+	"net/url"
+	"regexp"
+	"strings"
+)
+
+// ecrEndpointPattern matches all valid ECR endpoints including account-prefixed and accountless formats.
+// Based on AWS ECR credential helper regex but extended to support accountless endpoints.
+//
+// Supported formats:
+//   - Account-prefixed: 123456789012.dkr.ecr-fips.us-east-1.amazonaws.com
+//   - Account-prefixed (hyphen): 123456789012.dkr-ecr-fips.us-west-1.on.aws
+//   - Accountless service: ecr-fips.us-west-1.amazonaws.com
+//   - Accountless API: ecr-fips.us-east-1.api.aws
+//   - Non-FIPS variants: All formats above without "-fips"
+//
+// Regex groups:
+//   - Group 1: Full account prefix (optional) - e.g., "123456789012.dkr." or "123456789012.dkr-"
+//   - Group 2: Account ID (optional) - e.g., "123456789012"
+//   - Group 3: FIPS flag (optional) - either "-fips" or empty string
+//   - Group 4: Region - e.g., "us-east-1", "us-gov-west-1"
+//   - Group 5: Domain suffix - e.g., "amazonaws.com", "api.aws"
+var ecrEndpointPattern = regexp.MustCompile(
+	`^((\d{12})\.dkr[\.\-])?ecr(\-fips)?\.([a-zA-Z0-9][a-zA-Z0-9-_]*)\.(amazonaws\.(?:com(?:\.cn)?|eu)|api\.aws|on\.(?:aws|amazonwebservices\.com\.cn)|sc2s\.sgov\.gov|c2s\.ic\.gov|cloud\.adc-e\.uk|csp\.hci\.ic\.gov)$`,
+)
+
+// ParseECREndpoint parses an ECR registry URL and extracts registry information.
+
+// This function replaces the AWS ECR credential helper library's ExtractRegistry function,
+// which only supports account-prefixed endpoints.
+//
+// Reference: https://docs.aws.amazon.com/general/latest/gr/ecr.html
+func ParseECREndpoint(urlStr string) (*Registry, error) {
+	// Normalize URL by adding https:// prefix if not present
+	if !strings.HasPrefix(urlStr, "https://") && !strings.HasPrefix(urlStr, "http://") {
+		urlStr = "https://" + urlStr
+	}
+
+	u, err := url.Parse(urlStr)
+	if err != nil {
+		return nil, fmt.Errorf("invalid URL: %w", err)
+	}
+
+	hostname := u.Hostname()
+
+	// Special case: ECR Public
+	// ECR Public uses a different domain and doesn't have FIPS variant
+	if hostname == "ecr-public.aws.com" {
+		return &Registry{
+			FIPS:   false,
+			Public: true,
+		}, nil
+	}
+
+	// Parse standard ECR endpoints using regex
+	matches := ecrEndpointPattern.FindStringSubmatch(hostname)
+	if len(matches) == 0 {
+		return nil, fmt.Errorf("not a valid ECR endpoint: %s", hostname)
+	}
+
+	return &Registry{
+		ID:     matches[2],            // Account ID (may be empty for accountless endpoints)
+		FIPS:   matches[3] == "-fips", // Check if "-fips" is present
+		Region: matches[4],            // AWS region
+		Public: false,
+	}, nil
+}
diff --git a/api/aws/ecr/parse_endpoints_test.go b/api/aws/ecr/parse_endpoints_test.go
new file mode 100644
index 0000000..4f25697
--- /dev/null
+++ b/api/aws/ecr/parse_endpoints_test.go
@@ -0,0 +1,254 @@
+package ecr
+
+import (
+	"testing"
+)
+
+func TestParseECREndpoint(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name      string
+		url       string
+		want      *Registry
+		wantError bool
+	}{
+		// Standard AWS Commercial - Account-prefixed FIPS
+		{
+			name: "account-prefixed FIPS us-east-1",
+			url:  "123456789012.dkr.ecr-fips.us-east-1.amazonaws.com",
+			want: &Registry{
+				ID:     "123456789012",
+				FIPS:   true,
+				Region: "us-east-1",
+				Public: false,
+			},
+		},
+		{
+			name: "account-prefixed FIPS us-west-2",
+			url:  "123456789012.dkr.ecr-fips.us-west-2.amazonaws.com",
+			want: &Registry{
+				ID:     "123456789012",
+				FIPS:   true,
+				Region: "us-west-2",
+				Public: false,
+			},
+		},
+
+		// Accountless FIPS service endpoints
+		{
+			name: "accountless FIPS us-west-1",
+			url:  "ecr-fips.us-west-1.amazonaws.com",
+			want: &Registry{
+				ID:     "",
+				FIPS:   true,
+				Region: "us-west-1",
+				Public: false,
+			},
+		},
+		{
+			name: "accountless FIPS us-east-2",
+			url:  "ecr-fips.us-east-2.amazonaws.com",
+			want: &Registry{
+				ID:     "",
+				FIPS:   true,
+				Region: "us-east-2",
+				Public: false,
+			},
+		},
+
+		// Accountless FIPS API endpoints
+		{
+			name: "accountless FIPS API us-west-1",
+			url:  "ecr-fips.us-west-1.api.aws",
+			want: &Registry{
+				ID:     "",
+				FIPS:   true,
+				Region: "us-west-1",
+				Public: false,
+			},
+		},
+		{
+			name: "accountless FIPS API us-east-1",
+			url:  "ecr-fips.us-east-1.api.aws",
+			want: &Registry{
+				ID:     "",
+				FIPS:   true,
+				Region: "us-east-1",
+				Public: false,
+			},
+		},
+
+		// on.aws domain with hyphen separator
+		{
+			name: "account-prefixed FIPS hyphen us-west-1",
+			url:  "123456789012.dkr-ecr-fips.us-west-1.on.aws",
+			want: &Registry{
+				ID:     "123456789012",
+				FIPS:   true,
+				Region: "us-west-1",
+				Public: false,
+			},
+		},
+		{
+			name: "account-prefixed FIPS hyphen us-east-2",
+			url:  "123456789012.dkr-ecr-fips.us-east-2.on.aws",
+			want: &Registry{
+				ID:     "123456789012",
+				FIPS:   true,
+				Region: "us-east-2",
+				Public: false,
+			},
+		},
+
+		// AWS GovCloud
+		{
+			name: "account-prefixed FIPS us-gov-east-1",
+			url:  "123456789012.dkr.ecr-fips.us-gov-east-1.amazonaws.com",
+			want: &Registry{
+				ID:     "123456789012",
+				FIPS:   true,
+				Region: "us-gov-east-1",
+				Public: false,
+			},
+		},
+		{
+			name: "account-prefixed FIPS us-gov-west-1",
+			url:  "123456789012.dkr.ecr-fips.us-gov-west-1.amazonaws.com",
+			want: &Registry{
+				ID:     "123456789012",
+				FIPS:   true,
+				Region: "us-gov-west-1",
+				Public: false,
+			},
+		},
+		{
+			name: "accountless FIPS us-gov-west-1",
+			url:  "ecr-fips.us-gov-west-1.amazonaws.com",
+			want: &Registry{
+				ID:     "",
+				FIPS:   true,
+				Region: "us-gov-west-1",
+				Public: false,
+			},
+		},
+		{
+			name: "accountless FIPS API us-gov-east-1",
+			url:  "ecr-fips.us-gov-east-1.api.aws",
+			want: &Registry{
+				ID:     "",
+				FIPS:   true,
+				Region: "us-gov-east-1",
+				Public: false,
+			},
+		},
+
+		// ECR Public
+		{
+			name: "ecr-public",
+			url:  "ecr-public.aws.com",
+			want: &Registry{
+				ID:     "",
+				FIPS:   false,
+				Region: "",
+				Public: true,
+			},
+		},
+
+		// Non-FIPS endpoints (valid ECR but FIPS=false)
+		{
+			name: "account-prefixed non-FIPS us-east-1",
+			url:  "123456789012.dkr.ecr.us-east-1.amazonaws.com",
+			want: &Registry{
+				ID:     "123456789012",
+				FIPS:   false,
+				Region: "us-east-1",
+				Public: false,
+			},
+		},
+		{
+			name: "accountless non-FIPS us-west-1",
+			url:  "ecr.us-west-1.amazonaws.com",
+			want: &Registry{
+				ID:     "",
+				FIPS:   false,
+				Region: "us-west-1",
+				Public: false,
+			},
+		},
+		{
+			name: "accountless non-FIPS API us-east-2",
+			url:  "ecr.us-east-2.api.aws",
+			want: &Registry{
+				ID:     "",
+				FIPS:   false,
+				Region: "us-east-2",
+				Public: false,
+			},
+		},
+
+		// URLs with https:// prefix
+		{
+			name: "with https prefix",
+			url:  "https://ecr-fips.us-west-1.amazonaws.com",
+			want: &Registry{
+				ID:     "",
+				FIPS:   true,
+				Region: "us-west-1",
+				Public: false,
+			},
+		},
+
+		// Invalid endpoints
+		{
+			name:      "not an ECR URL",
+			url:       "not-an-ecr-url.com",
+			wantError: true,
+		},
+		{
+			name:      "invalid account ID length",
+			url:       "123.dkr.ecr-fips.us-east-1.amazonaws.com",
+			wantError: true,
+		},
+		{
+			name:      "empty string",
+			url:       "",
+			wantError: true,
+		},
+		{
+			name:      "docker hub",
+			url:       "docker.io",
+			wantError: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := ParseECREndpoint(tt.url)
+
+			if tt.wantError {
+				if err == nil {
+					t.Errorf("ParseECREndpoint() expected error but got none")
+				}
+				return
+			}
+
+			if err != nil {
+				t.Errorf("ParseECREndpoint() unexpected error: %v", err)
+				return
+			}
+
+			if got.ID != tt.want.ID {
+				t.Errorf("ParseECREndpoint() ID = %v, want %v", got.ID, tt.want.ID)
+			}
+			if got.FIPS != tt.want.FIPS {
+				t.Errorf("ParseECREndpoint() FIPS = %v, want %v", got.FIPS, tt.want.FIPS)
+			}
+			if got.Region != tt.want.Region {
+				t.Errorf("ParseECREndpoint() Region = %v, want %v", got.Region, tt.want.Region)
+			}
+			if got.Public != tt.want.Public {
+				t.Errorf("ParseECREndpoint() Public = %v, want %v", got.Public, tt.want.Public)
+			}
+		})
+	}
+}
diff --git a/api/backup/backup.go b/api/backup/backup.go
new file mode 100644
index 0000000..3d4bb68
--- /dev/null
+++ b/api/backup/backup.go
@@ -0,0 +1,110 @@
+package backup
+
+import (
+	"fmt"
+	"os"
+	"path"
+	"path/filepath"
+	"time"
+
+	"github.com/portainer/portainer/api/archive"
+	"github.com/portainer/portainer/api/crypto"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/filesystem"
+	"github.com/portainer/portainer/api/http/offlinegate"
+	"github.com/portainer/portainer/api/logs"
+
+	"github.com/pkg/errors"
+	"github.com/rs/zerolog/log"
+)
+
+const rwxr__r__ os.FileMode = 0o744
+
+var filesToBackup = []string{
+	"certs",
+	"chisel",
+	"compose",
+	"config.json",
+	"custom_templates",
+	"edge_jobs",
+	"edge_stacks",
+	"extensions",
+	"portainer.key",
+	"portainer.pub",
+	"tls",
+}
+
+// Creates a tar.gz system archive and encrypts it if password is not empty. Returns a path to the archive file.
+func CreateBackupArchive(password string, gate *offlinegate.OfflineGate, datastore dataservices.DataStore, filestorePath string) (string, error) {
+	backupDirPath, err := backupDatabaseAndFilesystem(gate, datastore, filestorePath)
+	if err != nil {
+		return "", err
+	}
+
+	archivePath, err := archive.TarGzDir(backupDirPath)
+	if err != nil {
+		return "", errors.Wrap(err, "Failed to make an archive")
+	}
+
+	if password != "" {
+		archivePath, err = encrypt(archivePath, password)
+		if err != nil {
+			return "", errors.Wrap(err, "Failed to encrypt backup with the password")
+		}
+	}
+
+	return archivePath, nil
+}
+
+func backupDatabaseAndFilesystem(gate *offlinegate.OfflineGate, datastore dataservices.DataStore, filestorePath string) (string, error) {
+	unlock := gate.Lock()
+	defer unlock()
+
+	backupDirPath := filepath.Join(filestorePath, "backup", time.Now().Format("2006-01-02_15-04-05"))
+	if err := os.MkdirAll(backupDirPath, rwxr__r__); err != nil {
+		return "", errors.Wrap(err, "Failed to create backup dir")
+	}
+
+	// new export
+	exportFilename := path.Join(backupDirPath, fmt.Sprintf("export-%d.json", time.Now().Unix()))
+
+	if err := datastore.Export(exportFilename); err != nil {
+		log.Error().Err(err).Str("filename", exportFilename).Msg("failed to export")
+	} else {
+		log.Debug().Str("filename", exportFilename).Msg("file exported")
+	}
+
+	if err := backupDb(backupDirPath, datastore); err != nil {
+		return "", errors.Wrap(err, "Failed to backup database")
+	}
+
+	for _, filename := range filesToBackup {
+		if err := filesystem.CopyPath(filepath.Join(filestorePath, filename), backupDirPath); err != nil {
+			return "", errors.Wrap(err, "Failed to create backup file")
+		}
+	}
+
+	return backupDirPath, nil
+}
+
+func backupDb(backupDirPath string, datastore dataservices.DataStore) error {
+	dbFileName := datastore.Connection().GetDatabaseFileName()
+	_, err := datastore.Backup(filepath.Join(backupDirPath, dbFileName))
+	return err
+}
+
+func encrypt(path string, passphrase string) (string, error) {
+	in, err := os.Open(path)
+	if err != nil {
+		return "", err
+	}
+	defer logs.CloseAndLogErr(in)
+
+	outFileName := path + ".encrypted"
+	out, err := os.Create(outFileName)
+	if err != nil {
+		return "", err
+	}
+
+	return outFileName, crypto.AesEncrypt(in, out, []byte(passphrase))
+}
diff --git a/api/backup/backup_test.go b/api/backup/backup_test.go
new file mode 100644
index 0000000..43889df
--- /dev/null
+++ b/api/backup/backup_test.go
@@ -0,0 +1,274 @@
+package backup
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/portainer/portainer/api/archive"
+	"github.com/portainer/portainer/api/crypto"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/filesystem"
+	"github.com/portainer/portainer/api/http/offlinegate"
+	"github.com/portainer/portainer/pkg/fips"
+
+	"github.com/stretchr/testify/require"
+)
+
+func init() {
+	fips.InitFIPS(false)
+}
+
+func TestGetRestoreSourcePath_DBAtRoot(t *testing.T) {
+	t.Parallel()
+
+	dir := t.TempDir()
+	err := os.WriteFile(filesystem.JoinPaths(dir, "portainer.db"), []byte("db"), 0o600)
+	require.NoError(t, err)
+
+	result, err := getRestoreSourcePath(dir)
+	require.NoError(t, err)
+	require.Equal(t, dir, result)
+}
+
+func TestGetRestoreSourcePath_EncryptedDBAtRoot(t *testing.T) {
+	t.Parallel()
+
+	dir := t.TempDir()
+	err := os.WriteFile(filesystem.JoinPaths(dir, "portainer.edb"), []byte("db"), 0o600)
+	require.NoError(t, err)
+
+	result, err := getRestoreSourcePath(dir)
+	require.NoError(t, err)
+	require.Equal(t, dir, result)
+}
+
+func TestGetRestoreSourcePath_DBInSubdirectory(t *testing.T) {
+	t.Parallel()
+
+	dir := t.TempDir()
+	sub := filesystem.JoinPaths(dir, "backup-2024-01-01")
+	err := os.Mkdir(sub, 0o700)
+	require.NoError(t, err)
+
+	err = os.WriteFile(filesystem.JoinPaths(sub, "portainer.db"), []byte("db"), 0o600)
+	require.NoError(t, err)
+
+	result, err := getRestoreSourcePath(dir)
+	require.NoError(t, err)
+	require.Equal(t, sub, result)
+}
+
+func TestGetRestoreSourcePath_NoDBFile(t *testing.T) {
+	t.Parallel()
+
+	dir := t.TempDir()
+	err := os.WriteFile(filesystem.JoinPaths(dir, "other.file"), []byte("data"), 0o600)
+	require.NoError(t, err)
+
+	result, err := getRestoreSourcePath(dir)
+	require.NoError(t, err)
+	require.Equal(t, dir, result)
+}
+
+func TestGetRestoreSourcePath_EmptyDir(t *testing.T) {
+	t.Parallel()
+
+	dir := t.TempDir()
+
+	result, err := getRestoreSourcePath(dir)
+	require.NoError(t, err)
+	require.Equal(t, dir, result)
+}
+
+func TestEncryptDecrypt_RoundTrip(t *testing.T) {
+	t.Parallel()
+
+	dir := t.TempDir()
+	plaintext := []byte("sensitive portainer backup data")
+
+	srcPath := filesystem.JoinPaths(dir, "archive.tar.gz")
+	err := os.WriteFile(srcPath, plaintext, 0o600)
+	require.NoError(t, err)
+
+	encryptedPath, err := encrypt(srcPath, "mysecretpassword")
+	require.NoError(t, err)
+	require.Equal(t, srcPath+".encrypted", encryptedPath)
+
+	encryptedData, err := os.ReadFile(encryptedPath)
+	require.NoError(t, err)
+
+	decryptedReader, err := crypto.AesDecrypt(bytes.NewReader(encryptedData), []byte("mysecretpassword"))
+	require.NoError(t, err)
+
+	decrypted, err := io.ReadAll(decryptedReader)
+	require.NoError(t, err)
+	require.Equal(t, plaintext, decrypted)
+}
+
+func TestEncryptDecrypt_WrongPassword(t *testing.T) {
+	t.Parallel()
+
+	dir := t.TempDir()
+
+	srcPath := filesystem.JoinPaths(dir, "archive.tar.gz")
+	err := os.WriteFile(srcPath, []byte("data"), 0o600)
+	require.NoError(t, err)
+
+	encryptedPath, err := encrypt(srcPath, "correctpassword")
+	require.NoError(t, err)
+
+	encryptedData, err := os.ReadFile(encryptedPath)
+	require.NoError(t, err)
+
+	_, err = crypto.AesDecrypt(bytes.NewReader(encryptedData), []byte("wrongpassword"))
+	require.Error(t, err)
+}
+
+func TestCreateBackupArchive_NoPassword(t *testing.T) {
+	t.Parallel()
+
+	_, store := datastore.MustNewTestStore(t, true, false)
+	storePath := store.GetConnection().GetStorePath()
+	gate := offlinegate.NewOfflineGate()
+
+	archivePath, err := CreateBackupArchive("", gate, store, storePath)
+	require.NoError(t, err)
+
+	f, err := os.Open(archivePath)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		err := f.Close()
+		require.NoError(t, err)
+	})
+
+	extractDir := t.TempDir()
+	err = archive.ExtractTarGz(f, extractDir)
+	require.NoError(t, err)
+
+	dbFound := false
+	err = filepath.Walk(extractDir, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+		if info.Name() == "portainer.db" {
+			dbFound = true
+		}
+
+		return nil
+	})
+	require.NoError(t, err)
+	require.True(t, dbFound, "archive should contain portainer.db")
+}
+
+func TestCreateBackupArchive_WithPassword(t *testing.T) {
+	t.Parallel()
+
+	_, store := datastore.MustNewTestStore(t, true, false)
+	storePath := store.GetConnection().GetStorePath()
+	gate := offlinegate.NewOfflineGate()
+
+	archivePath, err := CreateBackupArchive("backup-secret", gate, store, storePath)
+	require.NoError(t, err)
+	require.Contains(t, archivePath, ".encrypted")
+
+	encryptedData, err := os.ReadFile(archivePath)
+	require.NoError(t, err)
+
+	decryptedReader, err := crypto.AesDecrypt(bytes.NewReader(encryptedData), []byte("backup-secret"))
+	require.NoError(t, err)
+
+	extractDir := t.TempDir()
+	err = archive.ExtractTarGz(decryptedReader, extractDir)
+	require.NoError(t, err)
+
+	dbFound := false
+	err = filepath.Walk(extractDir, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+		if info.Name() == "portainer.db" {
+			dbFound = true
+		}
+
+		return nil
+	})
+	require.NoError(t, err)
+	require.True(t, dbFound, "decrypted archive should contain portainer.db")
+}
+
+func TestRestoreArchive_NoPassword(t *testing.T) {
+	t.Parallel()
+
+	_, store1 := datastore.MustNewTestStore(t, true, false)
+	storePath1 := store1.GetConnection().GetStorePath()
+	gate := offlinegate.NewOfflineGate()
+
+	archivePath, err := CreateBackupArchive("", gate, store1, storePath1)
+	require.NoError(t, err)
+
+	archiveData, err := os.ReadFile(archivePath)
+	require.NoError(t, err)
+
+	_, store2 := datastore.MustNewTestStore(t, true, false)
+	storePath2 := store2.GetConnection().GetStorePath()
+
+	ctx, cancel := context.WithCancel(t.Context())
+	err = RestoreArchive(bytes.NewReader(archiveData), "", storePath2, gate, store2, cancel)
+	require.NoError(t, err)
+
+	require.ErrorIs(t, ctx.Err(), context.Canceled)
+
+	_, err = os.Stat(filesystem.JoinPaths(storePath2, "portainer.db"))
+	require.NoError(t, err)
+}
+
+func TestRestoreArchive_WithPassword(t *testing.T) {
+	t.Parallel()
+
+	_, store1 := datastore.MustNewTestStore(t, true, false)
+	storePath1 := store1.GetConnection().GetStorePath()
+	gate := offlinegate.NewOfflineGate()
+
+	archivePath, err := CreateBackupArchive("restore-secret", gate, store1, storePath1)
+	require.NoError(t, err)
+
+	archiveData, err := os.ReadFile(archivePath)
+	require.NoError(t, err)
+
+	_, store2 := datastore.MustNewTestStore(t, true, false)
+	storePath2 := store2.GetConnection().GetStorePath()
+
+	ctx, cancel := context.WithCancel(t.Context())
+	err = RestoreArchive(bytes.NewReader(archiveData), "restore-secret", storePath2, gate, store2, cancel)
+	require.NoError(t, err)
+
+	require.ErrorIs(t, ctx.Err(), context.Canceled)
+
+	_, err = os.Stat(filesystem.JoinPaths(storePath2, "portainer.db"))
+	require.NoError(t, err)
+}
+
+func TestRestoreArchive_WrongPassword(t *testing.T) {
+	t.Parallel()
+
+	_, store1 := datastore.MustNewTestStore(t, true, false)
+	storePath1 := store1.GetConnection().GetStorePath()
+	gate := offlinegate.NewOfflineGate()
+
+	archivePath, err := CreateBackupArchive("correct-password", gate, store1, storePath1)
+	require.NoError(t, err)
+
+	archiveData, err := os.ReadFile(archivePath)
+	require.NoError(t, err)
+
+	_, store2 := datastore.MustNewTestStore(t, true, false)
+	storePath2 := store2.GetConnection().GetStorePath()
+
+	_, cancel := context.WithCancel(t.Context())
+	err = RestoreArchive(bytes.NewReader(archiveData), "wrong-password", storePath2, gate, store2, cancel)
+	require.Error(t, err)
+}
diff --git a/api/backup/restore.go b/api/backup/restore.go
new file mode 100644
index 0000000..ccfe082
--- /dev/null
+++ b/api/backup/restore.go
@@ -0,0 +1,121 @@
+package backup
+
+import (
+	"context"
+	"io"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"regexp"
+	"time"
+
+	"github.com/pkg/errors"
+	"github.com/portainer/portainer/api/archive"
+	"github.com/portainer/portainer/api/crypto"
+	"github.com/portainer/portainer/api/database/boltdb"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/filesystem"
+	"github.com/portainer/portainer/api/http/offlinegate"
+
+	"github.com/rs/zerolog/log"
+)
+
+var filesToRestore = append(filesToBackup, "portainer.db")
+
+// Restores system state from backup archive, will trigger system shutdown, when finished.
+func RestoreArchive(archive io.Reader, password string, filestorePath string, gate *offlinegate.OfflineGate, datastore dataservices.DataStore, shutdownTrigger context.CancelFunc) error {
+	var err error
+	if password != "" {
+		archive, err = decrypt(archive, password)
+		if err != nil {
+			return errors.Wrap(err, "failed to decrypt the archive. Please ensure the password is correct and try again")
+		}
+	}
+
+	restorePath := filepath.Join(filestorePath, "restore", time.Now().Format("20060102150405"))
+	defer func() {
+		if err := os.RemoveAll(filepath.Dir(restorePath)); err != nil {
+			log.Warn().Err(err).Msg("failed to clean up restore files")
+		}
+	}()
+
+	if err := extractArchive(archive, restorePath); err != nil {
+		return errors.Wrap(err, "cannot extract files from the archive. Please ensure the password is correct and try again")
+	}
+
+	unlock := gate.Lock()
+	defer unlock()
+
+	if err := datastore.Close(); err != nil {
+		return errors.Wrap(err, "Failed to stop db")
+	}
+
+	// At some point, backups were created containing a subdirectory, now we need to handle both
+	restorePath, err = getRestoreSourcePath(restorePath)
+	if err != nil {
+		return errors.Wrap(err, "failed to restore from backup. Portainer database missing from backup file")
+	}
+
+	if err := restoreFiles(restorePath, filestorePath); err != nil {
+		return errors.Wrap(err, "failed to restore the system state")
+	}
+
+	shutdownTrigger()
+	return nil
+}
+
+func decrypt(r io.Reader, password string) (io.Reader, error) {
+	return crypto.AesDecrypt(r, []byte(password))
+}
+
+func extractArchive(r io.Reader, destinationDirPath string) error {
+	return archive.ExtractTarGz(r, destinationDirPath)
+}
+
+func getRestoreSourcePath(dir string) (string, error) {
+	// find portainer.db or portainer.edb file. Return the parent directory
+	var portainerdbRegex = regexp.MustCompile(`^portainer.e?db$`)
+
+	backupDirPath := dir
+	err := filepath.WalkDir(dir, func(path string, d fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+
+		if portainerdbRegex.MatchString(d.Name()) {
+			backupDirPath = filepath.Dir(path)
+			return filepath.SkipDir
+		}
+		return nil
+	})
+
+	return backupDirPath, err
+}
+
+func restoreFiles(srcDir string, destinationDir string) error {
+	for _, filename := range filesToRestore {
+		if err := filesystem.CopyPath(filepath.Join(srcDir, filename), destinationDir); err != nil {
+			return err
+		}
+	}
+
+	// TODO:  This is very boltdb module specific once again due to the filename.  Move to bolt module? Refactor for another day
+
+	// Prevent the possibility of having both databases.  Remove any default new instance
+	if err := os.Remove(filepath.Join(destinationDir, boltdb.DatabaseFileName)); err != nil && !os.IsNotExist(err) {
+		return err
+	}
+
+	if err := os.Remove(filepath.Join(destinationDir, boltdb.EncryptedDatabaseFileName)); err != nil && !os.IsNotExist(err) {
+		return err
+	}
+
+	// Now copy the database.  It'll be either portainer.db or portainer.edb
+
+	// Note: CopyPath does not return an error if the source file doesn't exist
+	if err := filesystem.CopyPath(filepath.Join(srcDir, boltdb.EncryptedDatabaseFileName), destinationDir); err != nil {
+		return err
+	}
+
+	return filesystem.CopyPath(filepath.Join(srcDir, boltdb.DatabaseFileName), destinationDir)
+}
diff --git a/api/chisel/crypto/crypto.go b/api/chisel/crypto/crypto.go
new file mode 100644
index 0000000..78ac4ac
--- /dev/null
+++ b/api/chisel/crypto/crypto.go
@@ -0,0 +1,61 @@
+package crypto
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/x509"
+	"encoding/pem"
+	"fmt"
+	"io"
+	"math/big"
+
+	chshare "github.com/jpillora/chisel/share"
+)
+
+var one = new(big.Int).SetInt64(1)
+
+// GenerateGo119CompatibleKey This function is basically copied from chshare.GenerateKey.
+func GenerateGo119CompatibleKey(seed string) ([]byte, error) {
+	r := chshare.NewDetermRand([]byte(seed))
+	priv, err := ecdsaGenerateKey(elliptic.P256(), r)
+	if err != nil {
+		return nil, err
+	}
+	b, err := x509.MarshalECPrivateKey(priv)
+	if err != nil {
+		return nil, fmt.Errorf("Unable to marshal ECDSA private key: %w", err)
+	}
+	return pem.EncodeToMemory(&pem.Block{Type: "EC PRIVATE KEY", Bytes: b}), nil
+}
+
+// This function is copied from Go1.19
+func randFieldElement(c elliptic.Curve, rand io.Reader) (k *big.Int, err error) {
+	params := c.Params()
+	// Note that for P-521 this will actually be 63 bits more than the order, as
+	// division rounds down, but the extra bit is inconsequential.
+	b := make([]byte, params.N.BitLen()/8+8)
+	_, err = io.ReadFull(rand, b)
+	if err != nil {
+		return
+	}
+
+	k = new(big.Int).SetBytes(b)
+	n := new(big.Int).Sub(params.N, one)
+	k.Mod(k, n)
+	k.Add(k, one)
+	return
+}
+
+// This function is copied from Go1.19
+func ecdsaGenerateKey(c elliptic.Curve, rand io.Reader) (*ecdsa.PrivateKey, error) {
+	k, err := randFieldElement(c, rand)
+	if err != nil {
+		return nil, err
+	}
+
+	priv := new(ecdsa.PrivateKey)
+	priv.Curve = c
+	priv.D = k
+	priv.X, priv.Y = c.ScalarBaseMult(k.Bytes())
+	return priv, nil
+}
diff --git a/api/chisel/crypto/crypto_test.go b/api/chisel/crypto/crypto_test.go
new file mode 100644
index 0000000..652fd42
--- /dev/null
+++ b/api/chisel/crypto/crypto_test.go
@@ -0,0 +1,38 @@
+package crypto
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestGenerateGo119CompatibleKey(t *testing.T) {
+	t.Parallel()
+	type args struct {
+		seed string
+	}
+	tests := []struct {
+		name    string
+		args    args
+		want    []byte
+		wantErr bool
+	}{
+		{
+			name:    "Generate Go 1.19 compatible private key with a given seed",
+			args:    args{seed: "94qh17MCIk8BOkiI"},
+			want:    []byte("-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIHeohwk0Gy3RHVVViaHz7pz/HOiqA7fkv1FTM3mGgfT3oAoGCCqGSM49\nAwEHoUQDQgAEN7riX06xDsLNPuUmOvYFluNEakcFwZZRVvOcIYk/9VYnanDzW0Km\n8/BUUiKyJDuuGdS4fj9SlQ4iL8yBK01uKg==\n-----END EC PRIVATE KEY-----\n"),
+			wantErr: false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := GenerateGo119CompatibleKey(tt.args.seed)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("GenerateGo119CompatibleKey() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+			if !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("GenerateGo119CompatibleKey()\ngot: Z %v\nwant: %v", got, tt.want)
+			}
+		})
+	}
+}
diff --git a/api/chisel/key.go b/api/chisel/key.go
new file mode 100644
index 0000000..7629f20
--- /dev/null
+++ b/api/chisel/key.go
@@ -0,0 +1,24 @@
+package chisel
+
+import (
+	"encoding/base64"
+	"fmt"
+	"strconv"
+	"strings"
+)
+
+// GenerateEdgeKey will generate a key that can be used by an Edge agent to register with a Portainer instance.
+// The key represents the following data in this particular format:
+// portainer_instance_url|tunnel_server_addr|tunnel_server_fingerprint|endpoint_ID
+// The key returned by this function is a base64 encoded version of the data.
+func (service *Service) GenerateEdgeKey(url, host string, endpointIdentifier int) string {
+	keyInformation := []string{
+		url,
+		fmt.Sprintf("%s:%s", host, service.serverPort),
+		service.serverFingerprint,
+		strconv.Itoa(endpointIdentifier),
+	}
+
+	key := strings.Join(keyInformation, "|")
+	return base64.RawStdEncoding.EncodeToString([]byte(key))
+}
diff --git a/api/chisel/service.go b/api/chisel/service.go
new file mode 100644
index 0000000..10996d4
--- /dev/null
+++ b/api/chisel/service.go
@@ -0,0 +1,339 @@
+package chisel
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"net/http"
+	"sync"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/proxy"
+	"github.com/portainer/portainer/pkg/schedule"
+
+	chserver "github.com/jpillora/chisel/server"
+	"github.com/jpillora/chisel/share/ccrypto"
+	"github.com/rs/zerolog/log"
+)
+
+const (
+	tunnelCleanupInterval   = 10 * time.Second
+	activeTimeout           = 4*time.Minute + 30*time.Second
+	pingTimeout             = 8 * time.Second
+	tunnelKeepAliveInterval = 25 * time.Second
+)
+
+// Service represents a service to manage the state of multiple reverse tunnels.
+// It is used to start a reverse tunnel server and to manage the connection status of each tunnel
+// connected to the tunnel server.
+type Service struct {
+	serverFingerprint      string
+	serverPort             string
+	activeTunnels          map[portainer.EndpointID]*portainer.TunnelDetails
+	edgeJobs               map[portainer.EndpointID][]portainer.EdgeJob
+	dataStore              dataservices.DataStore
+	snapshotService        portainer.SnapshotService
+	chiselServer           *chserver.Server
+	shutdownCtx            context.Context
+	ProxyManager           *proxy.Manager
+	mu                     sync.RWMutex
+	fileService            portainer.FileService
+	defaultCheckinInterval int
+}
+
+// NewService returns a pointer to a new instance of Service
+func NewService(dataStore dataservices.DataStore, shutdownCtx context.Context, fileService portainer.FileService) *Service {
+	defaultCheckinInterval := portainer.DefaultEdgeAgentCheckinIntervalInSeconds
+
+	settings, err := dataStore.Settings().Settings()
+	if err == nil {
+		defaultCheckinInterval = settings.EdgeAgentCheckinInterval
+	} else {
+		log.Error().Err(err).Msg("unable to retrieve the settings from the database")
+	}
+
+	return &Service{
+		activeTunnels:          make(map[portainer.EndpointID]*portainer.TunnelDetails),
+		edgeJobs:               make(map[portainer.EndpointID][]portainer.EdgeJob),
+		dataStore:              dataStore,
+		shutdownCtx:            shutdownCtx,
+		fileService:            fileService,
+		defaultCheckinInterval: defaultCheckinInterval,
+	}
+}
+
+// pingAgent ping the given agent so that the agent can keep the tunnel alive
+func (service *Service) pingAgent(endpointID portainer.EndpointID) error {
+	endpoint, err := service.dataStore.Endpoint().Endpoint(endpointID)
+	if err != nil {
+		return err
+	}
+
+	tunnelAddr, err := service.TunnelAddr(endpoint)
+	if err != nil {
+		return err
+	}
+
+	requestURL := fmt.Sprintf("http://%s/ping", tunnelAddr)
+	req, err := http.NewRequest(http.MethodHead, requestURL, nil)
+	if err != nil {
+		return err
+	}
+
+	httpClient := &http.Client{
+		Timeout: pingTimeout,
+	}
+
+	resp, err := httpClient.Do(req)
+	if err != nil {
+		return err
+	}
+
+	_, _ = io.Copy(io.Discard, resp.Body)
+	return resp.Body.Close()
+}
+
+// KeepTunnelAlive keeps the tunnel of the given environment for maxAlive duration, or until ctx is done
+func (service *Service) KeepTunnelAlive(endpointID portainer.EndpointID, ctx context.Context, maxAlive time.Duration) {
+	go service.keepTunnelAlive(endpointID, ctx, maxAlive)
+}
+
+func (service *Service) keepTunnelAlive(endpointID portainer.EndpointID, ctx context.Context, maxAlive time.Duration) {
+	log.Debug().
+		Int("endpoint_id", int(endpointID)).
+		Float64("max_alive_minutes", maxAlive.Minutes()).
+		Msg("KeepTunnelAlive: start")
+
+	maxAliveTicker := time.NewTicker(maxAlive)
+	defer maxAliveTicker.Stop()
+
+	pingTicker := time.NewTicker(tunnelCleanupInterval)
+	defer pingTicker.Stop()
+
+	for {
+		select {
+		case <-pingTicker.C:
+			service.UpdateLastActivity(endpointID)
+
+			if err := service.pingAgent(endpointID); err != nil {
+				log.Debug().
+					Int("endpoint_id", int(endpointID)).
+					Err(err).
+					Msg("KeepTunnelAlive: ping agent")
+			}
+		case <-maxAliveTicker.C:
+			log.Debug().
+				Int("endpoint_id", int(endpointID)).
+				Float64("timeout_minutes", maxAlive.Minutes()).
+				Msg("KeepTunnelAlive: tunnel keep alive timeout")
+
+			return
+		case <-ctx.Done():
+			err := ctx.Err()
+			log.Debug().
+				Int("endpoint_id", int(endpointID)).
+				Err(err).
+				Msg("KeepTunnelAlive: tunnel stop")
+
+			return
+		}
+	}
+}
+
+// StartTunnelServer starts a tunnel server on the specified addr and port.
+// It uses a seed to generate a new private/public key pair. If the seed cannot
+// be found inside the database, it will generate a new one randomly and persist it.
+// It starts the tunnel status verification process in the background.
+// The snapshotter is used in the tunnel status verification process.
+func (service *Service) StartTunnelServer(addr, port string, snapshotService portainer.SnapshotService) error {
+	privateKeyFile, err := service.retrievePrivateKeyFile()
+	if err != nil {
+		return err
+	}
+
+	config := &chserver.Config{
+		Reverse:   true,
+		KeyFile:   privateKeyFile,
+		KeepAlive: tunnelKeepAliveInterval,
+	}
+
+	chiselServer, err := chserver.NewServer(config)
+	if err != nil {
+		return err
+	}
+
+	service.serverFingerprint = chiselServer.GetFingerprint()
+	service.serverPort = port
+
+	if err := chiselServer.Start(addr, port); err != nil {
+		return err
+	}
+
+	service.chiselServer = chiselServer
+
+	// TODO: work-around Chisel default behavior.
+	// By default, Chisel will allow anyone to connect if no user exists.
+	username, password := generateRandomCredentials()
+	if err = service.chiselServer.AddUser(username, password, "127.0.0.1"); err != nil {
+		return err
+	}
+
+	service.snapshotService = snapshotService
+
+	go service.startTunnelVerificationLoop()
+
+	return nil
+}
+
+// StopTunnelServer stops tunnel http server
+func (service *Service) StopTunnelServer() error {
+	return service.chiselServer.Close()
+}
+
+func (service *Service) retrievePrivateKeyFile() (string, error) {
+	privateKeyFile := service.fileService.GetDefaultChiselPrivateKeyPath()
+
+	if exists, _ := service.fileService.FileExists(privateKeyFile); exists {
+		log.Info().
+			Str("private-key", privateKeyFile).
+			Msg("found Chisel private key file on disk")
+
+		return privateKeyFile, nil
+	}
+
+	log.Debug().
+		Str("private-key", privateKeyFile).
+		Msg("chisel private key file does not exist")
+
+	privateKey, err := ccrypto.GenerateKey("")
+	if err != nil {
+		log.Error().
+			Err(err).
+			Msg("failed to generate chisel private key")
+
+		return "", err
+	}
+
+	if err = service.fileService.StoreChiselPrivateKey(privateKey); err != nil {
+		log.Error().
+			Err(err).
+			Msg("failed to save Chisel private key to disk")
+
+		return "", err
+	}
+
+	log.Info().
+		Str("private-key", privateKeyFile).
+		Msg("generated a new Chisel private key file")
+
+	return privateKeyFile, nil
+}
+
+func (service *Service) startTunnelVerificationLoop() {
+	log.Debug().
+		Float64("check_interval_seconds", tunnelCleanupInterval.Seconds()).
+		Msg("starting tunnel management process")
+
+	schedule.RunOnInterval(service.shutdownCtx, tunnelCleanupInterval, service.checkTunnels, func() {
+		log.Debug().Msg("shutting down tunnel service")
+
+		if err := service.StopTunnelServer(); err != nil {
+			log.Debug().Err(err).Msg("stopped tunnel service")
+		}
+	})
+}
+
+// checkTunnels finds tunnels that need snapshots and processes them one at a time.
+// For active tunnels missing an initial snapshot, it takes one without closing the tunnel.
+// For tunnels idle past activeTimeout, it snapshots and closes them.
+func (service *Service) checkTunnels() {
+	service.mu.RLock()
+
+	for endpointID, tunnel := range service.activeTunnels {
+		elapsed := time.Since(tunnel.LastActivity)
+		log.Debug().
+			Int("endpoint_id", int(endpointID)).
+			Float64("last_activity_seconds", elapsed.Seconds()).
+			Msg("environment tunnel monitoring")
+
+		tunnelPort := tunnel.Port
+
+		if !tunnel.HasSnapshot && elapsed < activeTimeout {
+			service.mu.RUnlock()
+
+			if endpointHasSnapshot(service.dataStore, endpointID) {
+				service.markSnapshotTaken(endpointID)
+
+				return
+			}
+
+			log.Debug().
+				Int("endpoint_id", int(endpointID)).
+				Msg("taking initial snapshot for active Edge environment")
+
+			if service.snapshotAndLog(endpointID, tunnelPort) {
+				service.markSnapshotTaken(endpointID)
+			}
+
+			return
+		}
+
+		if tunnel.Status == portainer.EdgeAgentManagementRequired && elapsed < activeTimeout {
+			continue
+		}
+
+		service.mu.RUnlock()
+
+		log.Debug().
+			Int("endpoint_id", int(endpointID)).
+			Float64("last_activity_seconds", elapsed.Seconds()).
+			Float64("timeout_seconds", activeTimeout.Seconds()).
+			Msg("last activity timeout exceeded")
+
+		service.snapshotAndLog(endpointID, tunnelPort)
+		service.close(endpointID)
+
+		return
+	}
+
+	service.mu.RUnlock()
+}
+
+func (service *Service) snapshotAndLog(endpointID portainer.EndpointID, tunnelPort int) bool {
+	if err := service.snapshotEnvironment(endpointID, tunnelPort); err != nil {
+		log.Error().
+			Int("endpoint_id", int(endpointID)).
+			Err(err).
+			Msg("unable to snapshot Edge environment")
+
+		if service.dataStore.IsErrObjectNotFound(err) {
+			service.close(endpointID)
+		}
+
+		return false
+	}
+
+	return true
+}
+
+func (service *Service) markSnapshotTaken(endpointID portainer.EndpointID) {
+	service.mu.Lock()
+	defer service.mu.Unlock()
+
+	if tun, ok := service.activeTunnels[endpointID]; ok {
+		tun.HasSnapshot = true
+	}
+}
+
+func (service *Service) snapshotEnvironment(endpointID portainer.EndpointID, tunnelPort int) error {
+	endpoint, err := service.dataStore.Endpoint().Endpoint(endpointID)
+	if err != nil {
+		return err
+	}
+
+	endpoint.URL = fmt.Sprintf("tcp://127.0.0.1:%d", tunnelPort)
+
+	return service.snapshotService.SnapshotEndpoint(endpoint)
+}
diff --git a/api/chisel/service_test.go b/api/chisel/service_test.go
new file mode 100644
index 0000000..fb923b8
--- /dev/null
+++ b/api/chisel/service_test.go
@@ -0,0 +1,238 @@
+package chisel
+
+import (
+	"context"
+	"errors"
+	"net"
+	"net/http"
+	"testing"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/pkg/fips"
+
+	"github.com/stretchr/testify/require"
+)
+
+func init() {
+	fips.InitFIPS(false)
+}
+
+type mockSnapshotService struct {
+	snapshotFn func(endpoint *portainer.Endpoint) error
+}
+
+func (m *mockSnapshotService) Start(_ context.Context) {}
+
+func (m *mockSnapshotService) SetSnapshotInterval(_ string) error { return nil }
+
+func (m *mockSnapshotService) SnapshotEndpoint(endpoint *portainer.Endpoint) error {
+	if m.snapshotFn != nil {
+		return m.snapshotFn(endpoint)
+	}
+
+	return nil
+}
+
+func (m *mockSnapshotService) FillSnapshotData(_ *portainer.Endpoint, _ bool) error { return nil }
+
+func newEdgeEndpoint(id portainer.EndpointID) *portainer.Endpoint {
+	return &portainer.Endpoint{
+		ID:          id,
+		EdgeID:      "test-edge-id",
+		Type:        portainer.EdgeAgentOnDockerEnvironment,
+		UserTrusted: true,
+	}
+}
+
+func TestPingAgentPanic(t *testing.T) {
+	t.Parallel()
+	endpoint := newEdgeEndpoint(1)
+
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	s := NewService(store, nil, nil)
+
+	defer func() {
+		require.Nil(t, recover())
+	}()
+
+	mux := http.NewServeMux()
+	mux.HandleFunc("/ping", func(w http.ResponseWriter, r *http.Request) {
+		time.Sleep(pingTimeout + 1*time.Second)
+	})
+
+	ln, err := net.ListenTCP("tcp", &net.TCPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 0})
+	require.NoError(t, err)
+
+	srv := &http.Server{Handler: mux}
+
+	errCh := make(chan error)
+	go func() {
+		errCh <- srv.Serve(ln)
+	}()
+
+	err = s.Open(endpoint)
+	require.NoError(t, err)
+	s.activeTunnels[endpoint.ID].Port = ln.Addr().(*net.TCPAddr).Port
+
+	require.Error(t, s.pingAgent(endpoint.ID))
+	require.NoError(t, srv.Shutdown(t.Context()))
+	require.ErrorIs(t, <-errCh, http.ErrServerClosed)
+}
+
+func TestOpenDefaultsHasSnapshotToFalse(t *testing.T) {
+	t.Parallel()
+
+	endpoint := newEdgeEndpoint(1)
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	s := NewService(store, nil, nil)
+
+	err := s.Open(endpoint)
+	require.NoError(t, err)
+
+	require.False(t, s.activeTunnels[endpoint.ID].HasSnapshot)
+}
+
+func TestCheckTunnelsSetsHasSnapshotWhenSnapshotExists(t *testing.T) {
+	t.Parallel()
+
+	endpoint := newEdgeEndpoint(2)
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	err := store.Endpoint().Create(endpoint)
+	require.NoError(t, err)
+
+	snap := &portainer.Snapshot{
+		EndpointID: endpoint.ID,
+		Docker:     &portainer.DockerSnapshot{},
+	}
+	err = store.Snapshot().Create(snap)
+	require.NoError(t, err)
+
+	s := NewService(store, nil, nil)
+	s.activeTunnels[endpoint.ID] = &portainer.TunnelDetails{
+		Status:       portainer.EdgeAgentManagementRequired,
+		Port:         50003,
+		LastActivity: time.Now(),
+	}
+
+	s.checkTunnels()
+
+	require.NotNil(t, s.activeTunnels[endpoint.ID], "tunnel must remain open")
+	require.True(t, s.activeTunnels[endpoint.ID].HasSnapshot)
+}
+
+func TestCheckTunnelsSnapshotsActiveEnvironmentAndKeepsTunnelAlive(t *testing.T) {
+	t.Parallel()
+
+	endpoint := newEdgeEndpoint(3)
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	err := store.Endpoint().Create(endpoint)
+	require.NoError(t, err)
+
+	snapshotCalled := false
+	svc := &mockSnapshotService{
+		snapshotFn: func(_ *portainer.Endpoint) error {
+			snapshotCalled = true
+
+			return nil
+		},
+	}
+
+	s := NewService(store, nil, nil)
+	s.snapshotService = svc
+	s.activeTunnels[endpoint.ID] = &portainer.TunnelDetails{
+		Status:       portainer.EdgeAgentManagementRequired,
+		Port:         50000,
+		LastActivity: time.Now(),
+	}
+
+	s.checkTunnels()
+
+	require.True(t, snapshotCalled)
+	require.NotNil(t, s.activeTunnels[endpoint.ID], "tunnel must remain open after snapshot")
+	require.True(t, s.activeTunnels[endpoint.ID].HasSnapshot)
+}
+
+func TestCheckTunnelsKeepsHasSnapshotFalseOnSnapshotFailure(t *testing.T) {
+	t.Parallel()
+
+	endpoint := newEdgeEndpoint(4)
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	err := store.Endpoint().Create(endpoint)
+	require.NoError(t, err)
+
+	svc := &mockSnapshotService{
+		snapshotFn: func(_ *portainer.Endpoint) error {
+			return errors.New("snapshot failed")
+		},
+	}
+
+	s := NewService(store, nil, nil)
+	s.snapshotService = svc
+	s.activeTunnels[endpoint.ID] = &portainer.TunnelDetails{
+		Status:       portainer.EdgeAgentManagementRequired,
+		Port:         50001,
+		LastActivity: time.Now(),
+	}
+
+	s.checkTunnels()
+
+	require.NotNil(t, s.activeTunnels[endpoint.ID], "tunnel must remain open after failed snapshot")
+	require.False(t, s.activeTunnels[endpoint.ID].HasSnapshot, "HasSnapshot must stay false after failure")
+}
+
+func TestCheckTunnelsClosesStaleEntryForDeletedEndpoint(t *testing.T) {
+	t.Parallel()
+
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	// Endpoint is not created in the store, simulates deletion while tunnel stays open.
+	s := NewService(store, nil, nil)
+	s.activeTunnels[1] = &portainer.TunnelDetails{
+		Status:       portainer.EdgeAgentManagementRequired,
+		Port:         50010,
+		LastActivity: time.Now(),
+	}
+
+	s.checkTunnels()
+
+	require.Nil(t, s.activeTunnels[1], "stale tunnel for deleted endpoint must be removed immediately")
+}
+
+func TestCheckTunnelsClosesIdleTunnelAndSnapshots(t *testing.T) {
+	t.Parallel()
+
+	endpoint := newEdgeEndpoint(5)
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	err := store.Endpoint().Create(endpoint)
+	require.NoError(t, err)
+
+	snapshotCalled := false
+	svc := &mockSnapshotService{
+		snapshotFn: func(_ *portainer.Endpoint) error {
+			snapshotCalled = true
+
+			return nil
+		},
+	}
+
+	s := NewService(store, nil, nil)
+	s.snapshotService = svc
+	s.activeTunnels[endpoint.ID] = &portainer.TunnelDetails{
+		Status:       portainer.EdgeAgentManagementRequired,
+		Port:         50002,
+		LastActivity: time.Now().Add(-(activeTimeout + time.Second)),
+	}
+
+	s.checkTunnels()
+
+	require.True(t, snapshotCalled)
+	require.Nil(t, s.activeTunnels[endpoint.ID], "tunnel must be closed after idle timeout")
+}
diff --git a/api/chisel/tunnel.go b/api/chisel/tunnel.go
new file mode 100644
index 0000000..fa321d7
--- /dev/null
+++ b/api/chisel/tunnel.go
@@ -0,0 +1,256 @@
+package chisel
+
+import (
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"net"
+	"strings"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/internal/edge"
+	"github.com/portainer/portainer/api/internal/edge/cache"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+	"github.com/portainer/portainer/pkg/libcrypto"
+	"github.com/portainer/portainer/pkg/librand"
+
+	"github.com/dchest/uniuri"
+	"github.com/rs/zerolog/log"
+)
+
+const (
+	minAvailablePort = 49152
+	maxAvailablePort = 65535
+)
+
+var (
+	ErrNonEdgeEnv = errors.New("cannot open a tunnel for non-edge environments")
+	ErrAsyncEnv   = errors.New("cannot open a tunnel for async edge environments")
+	ErrInvalidEnv = errors.New("cannot open a tunnel for an invalid environment")
+)
+
+// Open will mark the tunnel as REQUIRED so the agent opens it
+func (s *Service) Open(endpoint *portainer.Endpoint) error {
+	if !endpointutils.IsEdgeEndpoint(endpoint) {
+		return ErrNonEdgeEnv
+	}
+
+	if endpoint.Edge.AsyncMode {
+		return ErrAsyncEnv
+	}
+
+	if endpoint.ID == 0 || endpoint.EdgeID == "" || !endpoint.UserTrusted {
+		return ErrInvalidEnv
+	}
+
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	if _, ok := s.activeTunnels[endpoint.ID]; ok {
+		return nil
+	}
+
+	defer cache.Del(endpoint.ID)
+
+	tun := &portainer.TunnelDetails{
+		Status:       portainer.EdgeAgentManagementRequired,
+		Port:         s.getUnusedPort(),
+		LastActivity: time.Now(),
+	}
+
+	username, password := generateRandomCredentials()
+
+	if s.chiselServer != nil {
+		authorizedRemote := fmt.Sprintf("^R:0.0.0.0:%d$", tun.Port)
+
+		if err := s.chiselServer.AddUser(username, password, authorizedRemote); err != nil {
+			return err
+		}
+	}
+
+	credentials, err := encryptCredentials(username, password, endpoint.EdgeID)
+	if err != nil {
+		return err
+	}
+
+	tun.Credentials = credentials
+
+	s.activeTunnels[endpoint.ID] = tun
+
+	return nil
+}
+
+// close removes the tunnel from the map so the agent will close it.
+// The lock is released before cleaning up the chisel user and proxy to avoid
+// blocking Config/Open callers while DeleteUser interacts with chisel internals.
+func (s *Service) close(endpointID portainer.EndpointID) {
+	s.mu.Lock()
+
+	tun, ok := s.activeTunnels[endpointID]
+	if !ok {
+		s.mu.Unlock()
+		return
+	}
+
+	delete(s.activeTunnels, endpointID)
+	cache.Del(endpointID)
+
+	s.mu.Unlock()
+
+	if s.chiselServer != nil {
+		user, _, _ := strings.Cut(tun.Credentials, ":")
+		s.chiselServer.DeleteUser(user)
+	}
+
+	if s.ProxyManager != nil {
+		s.ProxyManager.DeleteEndpointProxy(endpointID)
+	}
+}
+
+// Config returns the tunnel details needed for the agent to connect
+func (s *Service) Config(endpointID portainer.EndpointID) portainer.TunnelDetails {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	if tun, ok := s.activeTunnels[endpointID]; ok {
+		return *tun
+	}
+
+	return portainer.TunnelDetails{Status: portainer.EdgeAgentIdle}
+}
+
+// TunnelAddr returns the address of the local tunnel, including the port, it
+// will block until the tunnel is ready
+func (s *Service) TunnelAddr(endpoint *portainer.Endpoint) (string, error) {
+	if err := s.Open(endpoint); err != nil {
+		return "", err
+	}
+
+	tun := s.Config(endpoint.ID)
+	checkinInterval := time.Duration(s.tryEffectiveCheckinInterval(endpoint)) * time.Second
+
+	for t0 := time.Now(); ; {
+		if time.Since(t0) > 2*checkinInterval {
+			return "", errors.New("unable to open the tunnel")
+		}
+
+		// Check if the tunnel is established
+		conn, err := net.DialTCP("tcp", nil, &net.TCPAddr{IP: net.IPv4(127, 0, 0, 1), Port: tun.Port})
+		if err != nil {
+			time.Sleep(checkinInterval / 100)
+
+			continue
+		}
+
+		if err := conn.Close(); err != nil {
+			log.Warn().Err(err).Msg("failed to close tcp connection")
+		}
+
+		break
+	}
+
+	s.UpdateLastActivity(endpoint.ID)
+
+	return fmt.Sprintf("127.0.0.1:%d", tun.Port), nil
+}
+
+// tryEffectiveCheckinInterval avoids a potential deadlock by returning a
+// previous known value after a timeout
+func (s *Service) tryEffectiveCheckinInterval(endpoint *portainer.Endpoint) int {
+	ch := make(chan int, 1)
+
+	go func() {
+		ch <- edge.EffectiveCheckinInterval(s.dataStore, endpoint)
+	}()
+
+	select {
+	case <-time.After(50 * time.Millisecond):
+		s.mu.RLock()
+		defer s.mu.RUnlock()
+
+		return s.defaultCheckinInterval
+	case i := <-ch:
+		s.mu.Lock()
+		s.defaultCheckinInterval = i
+		s.mu.Unlock()
+
+		return i
+	}
+}
+
+// UpdateLastActivity sets the current timestamp to avoid the tunnel timeout
+func (s *Service) UpdateLastActivity(endpointID portainer.EndpointID) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	if tun, ok := s.activeTunnels[endpointID]; ok {
+		tun.LastActivity = time.Now()
+	}
+}
+
+// NOTE: it needs to be called with the lock acquired
+// getUnusedPort is used to generate an unused random port in the dynamic port range.
+// Dynamic ports (also called private ports) are 49152 to 65535.
+func (service *Service) getUnusedPort() int {
+	port := randomInt(minAvailablePort, maxAvailablePort)
+
+	for _, tunnel := range service.activeTunnels {
+		if tunnel.Port == port {
+			return service.getUnusedPort()
+		}
+	}
+
+	conn, err := net.DialTCP("tcp", nil, &net.TCPAddr{IP: net.IPv4(127, 0, 0, 1), Port: port})
+	if err == nil {
+		if err := conn.Close(); err != nil {
+			log.Warn().Msg("failed to close tcp connection that checks if port is free")
+		}
+
+		log.Debug().
+			Int("port", port).
+			Msg("selected port is in use, trying a different one")
+
+		return service.getUnusedPort()
+	}
+
+	return port
+}
+
+func randomInt(min, max int) int {
+	return min + librand.Intn(max-min)
+}
+
+func generateRandomCredentials() (string, string) {
+	username := uniuri.NewLen(8)
+	password := uniuri.NewLen(8)
+
+	return username, password
+}
+
+func encryptCredentials(username, password, key string) (string, error) {
+	credentials := fmt.Sprintf("%s:%s", username, password)
+
+	encryptedCredentials, err := libcrypto.Encrypt([]byte(credentials), []byte(key))
+	if err != nil {
+		return "", err
+	}
+
+	return base64.RawStdEncoding.EncodeToString(encryptedCredentials), nil
+}
+
+func endpointHasSnapshot(dataStore dataservices.DataStore, endpointID portainer.EndpointID) bool {
+	var hasSnapshot bool
+	_ = dataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
+		s, err := tx.Snapshot().Read(endpointID)
+		if err != nil {
+			return err
+		}
+
+		hasSnapshot = s.Docker != nil || s.Kubernetes != nil
+		return nil
+	})
+
+	return hasSnapshot
+}
diff --git a/api/chisel/tunnel_test.go b/api/chisel/tunnel_test.go
new file mode 100644
index 0000000..079d5db
--- /dev/null
+++ b/api/chisel/tunnel_test.go
@@ -0,0 +1,80 @@
+package chisel
+
+import (
+	"net"
+	"strings"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+)
+
+type testSettingsService struct {
+	dataservices.SettingsService
+}
+
+func (s *testSettingsService) Settings() (*portainer.Settings, error) {
+	return &portainer.Settings{
+		EdgeAgentCheckinInterval: 1,
+	}, nil
+}
+
+type testStore struct {
+	dataservices.DataStore
+}
+
+func (s *testStore) Settings() dataservices.SettingsService {
+	return &testSettingsService{}
+}
+
+func TestGetUnusedPort(t *testing.T) {
+	t.Parallel()
+	testCases := []struct {
+		name            string
+		existingTunnels map[portainer.EndpointID]*portainer.TunnelDetails
+		expectedError   error
+	}{
+		{
+			name: "simple case",
+		},
+		{
+			name: "existing tunnels",
+			existingTunnels: map[portainer.EndpointID]*portainer.TunnelDetails{
+				portainer.EndpointID(1): {
+					Port: 53072,
+				},
+				portainer.EndpointID(2): {
+					Port: 63072,
+				},
+			},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			store := &testStore{}
+			s := NewService(store, nil, nil)
+			s.activeTunnels = tc.existingTunnels
+			port := s.getUnusedPort()
+
+			if port < 49152 || port > 65535 {
+				t.Fatalf("Expected port to be inbetween 49152 and 65535 but got %d", port)
+			}
+
+			for _, tun := range tc.existingTunnels {
+				if tun.Port == port {
+					t.Fatalf("returned port %d already has an existing tunnel", port)
+				}
+			}
+
+			conn, err := net.DialTCP("tcp", nil, &net.TCPAddr{IP: net.IPv4(127, 0, 0, 1), Port: port})
+			if err == nil {
+				// Ignore error
+				_ = conn.Close()
+				t.Fatalf("expected port %d to be unused", port)
+			} else if !strings.Contains(err.Error(), "connection refused") {
+				t.Fatalf("unexpected error: %v", err)
+			}
+		})
+	}
+}
diff --git a/api/cli/cli.go b/api/cli/cli.go
new file mode 100644
index 0000000..d7fa93c
--- /dev/null
+++ b/api/cli/cli.go
@@ -0,0 +1,220 @@
+package cli
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+
+	"github.com/alecthomas/kingpin/v2"
+	"github.com/rs/zerolog/log"
+)
+
+// Service implements the CLIService interface
+type Service struct{}
+
+var (
+	ErrInvalidEndpointProtocol       = errors.New("Invalid environment protocol: Portainer only supports unix://, npipe:// or tcp://")
+	ErrSocketOrNamedPipeNotFound     = errors.New("Unable to locate Unix socket or named pipe")
+	ErrInvalidSnapshotInterval       = errors.New("Invalid snapshot interval")
+	ErrAdminPassExcludeAdminPassFile = errors.New("Cannot use --admin-password with --admin-password-file")
+)
+
+func CLIFlags() *portainer.CLIFlags {
+	return &portainer.CLIFlags{
+		Addr:                      kingpin.Flag("bind", "Address and port to serve Portainer").Default(defaultBindAddress).Short('p').String(),
+		AddrHTTPS:                 kingpin.Flag("bind-https", "Address and port to serve Portainer via https").Default(defaultHTTPSBindAddress).String(),
+		TunnelAddr:                kingpin.Flag("tunnel-addr", "Address to serve the tunnel server").Default(defaultTunnelServerAddress).String(),
+		TunnelPort:                kingpin.Flag("tunnel-port", "Port to serve the tunnel server").Default(defaultTunnelServerPort).String(),
+		Assets:                    kingpin.Flag("assets", "Path to the assets").Default(defaultAssetsDirectory).Short('a').String(),
+		Data:                      kingpin.Flag("data", "Path to the folder where the data is stored").Default(defaultDataDirectory).Short('d').String(),
+		EndpointURL:               kingpin.Flag("host", "Environment URL").Short('H').String(),
+		FeatureFlags:              kingpin.Flag("feat", "List of feature flags").Envar(portainer.FeatureFlagEnvVar).Strings(),
+		EnableEdgeComputeFeatures: kingpin.Flag("edge-compute", "Enable Edge Compute features").Bool(),
+		NoAnalytics:               kingpin.Flag("no-analytics", "Disable Analytics in app (deprecated)").Bool(),
+		TLSSkipVerify:             kingpin.Flag("tlsskipverify", "Disable TLS server verification").Default(defaultTLSSkipVerify).Bool(),
+		HTTPDisabled:              kingpin.Flag("http-disabled", "Serve portainer only on https").Default(defaultHTTPDisabled).Bool(),
+		HTTPEnabled:               kingpin.Flag("http-enabled", "Serve portainer on http").Default(defaultHTTPEnabled).Bool(),
+		Rollback:                  kingpin.Flag("rollback", "Rollback the database to the previous backup").Bool(),
+		SnapshotInterval:          kingpin.Flag("snapshot-interval", "Duration between each environment snapshot job").String(),
+		AdminPassword:             kingpin.Flag("admin-password", "Set admin password with provided hash").String(),
+		AdminPasswordFile:         kingpin.Flag("admin-password-file", "Path to the file containing the password for the admin user").String(),
+		Labels:                    pairs(kingpin.Flag("hide-label", "Hide containers with a specific label in the UI").Short('l')),
+		Logo:                      kingpin.Flag("logo", "URL for the logo displayed in the UI").String(),
+		Templates:                 kingpin.Flag("templates", "URL to the templates definitions.").Short('t').String(),
+		BaseURL:                   kingpin.Flag("base-url", "Base URL parameter such as portainer if running portainer as http://yourdomain.com/portainer/.").Short('b').Default(defaultBaseURL).String(),
+		InitialMmapSize:           kingpin.Flag("initial-mmap-size", "Initial mmap size of the database in bytes").Int(),
+		MaxBatchSize:              kingpin.Flag("max-batch-size", "Maximum size of a batch").Int(),
+		MaxBatchDelay:             kingpin.Flag("max-batch-delay", "Maximum delay before a batch starts").Duration(),
+		SecretKeyName:             kingpin.Flag("secret-key-name", "Secret key name for encryption and will be used as /run/secrets/<secret-key-name>.").Default(defaultSecretKeyName).String(),
+		LogLevel:                  kingpin.Flag("log-level", "Set the minimum logging level to show").Default("INFO").Enum("DEBUG", "INFO", "WARN", "ERROR"),
+		LogMode:                   kingpin.Flag("log-mode", "Set the logging output mode").Default("PRETTY").Enum("NOCOLOR", "PRETTY", "JSON"),
+		PullLimitCheckDisabled:    kingpin.Flag("pull-limit-check-disabled", "Pull limit check").Envar(portainer.PullLimitCheckDisabledEnvVar).Default(defaultPullLimitCheckDisabled).Bool(),
+		TrustedOrigins:            kingpin.Flag("trusted-origins", "List of trusted origins for CSRF protection. Separate multiple origins with a comma.").Envar(portainer.TrustedOriginsEnvVar).String(),
+		CSP:                       kingpin.Flag("csp", "Content Security Policy (CSP) header").Envar(portainer.CSPEnvVar).Default("true").Bool(),
+		CompactDB:                 kingpin.Flag("compact-db", "Enable database compaction on startup").Envar(portainer.CompactDBEnvVar).Default("false").Bool(),
+		NoSetupToken:              kingpin.Flag("no-setup-token", "Disable the setup token requirement for admin initialization and restore on an uninitialized instance").Envar(portainer.NoSetupTokenEnvVar).Bool(),
+		SetupToken:                kingpin.Flag("setup-token", "Set a custom setup token for admin initialization and restore on an uninitialized instance (overrides auto-generation)").Envar(portainer.SetupTokenEnvVar).String(),
+	}
+}
+
+// ParseFlags parse the CLI flags and return a portainer.Flags struct
+func (Service) ParseFlags(version string) (*portainer.CLIFlags, error) {
+	kingpin.Version(version)
+
+	var hasSSLFlag, hasSSLCertFlag, hasSSLKeyFlag bool
+	sslFlag := kingpin.Flag(
+		"ssl",
+		"Secure Portainer instance using SSL (deprecated)",
+	).Default(defaultSSL).IsSetByUser(&hasSSLFlag)
+	ssl := sslFlag.Bool()
+	sslCertFlag := kingpin.Flag(
+		"sslcert",
+		"Path to the SSL certificate used to secure the Portainer instance",
+	).IsSetByUser(&hasSSLCertFlag)
+	sslCert := sslCertFlag.String()
+	sslKeyFlag := kingpin.Flag(
+		"sslkey",
+		"Path to the SSL key used to secure the Portainer instance",
+	).IsSetByUser(&hasSSLKeyFlag)
+	sslKey := sslKeyFlag.String()
+
+	flags := CLIFlags()
+
+	var hasTLSFlag, hasTLSCertFlag, hasTLSKeyFlag bool
+	tlsFlag := kingpin.Flag("tlsverify", "TLS support").Default(defaultTLS).IsSetByUser(&hasTLSFlag)
+	flags.TLS = tlsFlag.Bool()
+	tlsCertFlag := kingpin.Flag(
+		"tlscert",
+		"Path to the TLS certificate file",
+	).Default(defaultTLSCertPath).IsSetByUser(&hasTLSCertFlag)
+	flags.TLSCert = tlsCertFlag.String()
+	tlsKeyFlag := kingpin.Flag("tlskey", "Path to the TLS key").Default(defaultTLSKeyPath).IsSetByUser(&hasTLSKeyFlag)
+	flags.TLSKey = tlsKeyFlag.String()
+	flags.TLSCacert = kingpin.Flag("tlscacert", "Path to the CA").Default(defaultTLSCACertPath).String()
+
+	var hasKubectlShellImageFlag bool
+	kubectlShellImageFlag := kingpin.Flag(
+		"kubectl-shell-image",
+		"Kubectl shell image",
+	).Envar(portainer.KubectlShellImageEnvVar).
+		Default(portainer.DefaultKubectlShellImage).
+		IsSetByUser(&hasKubectlShellImageFlag)
+	flags.KubectlShellImage = kubectlShellImageFlag.String()
+
+	kingpin.Parse()
+
+	_, kubectlShellImageEnvVarSet := os.LookupEnv(portainer.KubectlShellImageEnvVar)
+	flags.KubectlShellImageSet = hasKubectlShellImageFlag || kubectlShellImageEnvVarSet
+
+	if !filepath.IsAbs(*flags.Assets) {
+		ex, err := os.Executable()
+		if err != nil {
+			panic(err)
+		}
+
+		*flags.Assets = filepath.Join(filepath.Dir(ex), *flags.Assets)
+	}
+
+	// If the user didn't provide a tls flag remove the defaults to match previous behaviour
+	if !hasTLSFlag {
+		if !hasTLSCertFlag {
+			*flags.TLSCert = ""
+		}
+
+		if !hasTLSKeyFlag {
+			*flags.TLSKey = ""
+		}
+	}
+
+	if hasSSLFlag {
+		log.Warn().Msgf("the %q flag is deprecated. use %q instead.", sslFlag.Model().Name, tlsFlag.Model().Name)
+
+		if !hasTLSFlag {
+			flags.TLS = ssl
+		}
+	}
+
+	if hasSSLCertFlag {
+		log.Warn().Msgf("the %q flag is deprecated. use %q instead.", sslCertFlag.Model().Name, tlsCertFlag.Model().Name)
+
+		if !hasTLSCertFlag {
+			flags.TLSCert = sslCert
+		}
+	}
+
+	if hasSSLKeyFlag {
+		log.Warn().Msgf("the %q flag is deprecated. use %q instead.", sslKeyFlag.Model().Name, tlsKeyFlag.Model().Name)
+
+		if !hasTLSKeyFlag {
+			flags.TLSKey = sslKey
+		}
+	}
+
+	return flags, nil
+}
+
+// ValidateFlags validates the values of the flags.
+func (Service) ValidateFlags(flags *portainer.CLIFlags) error {
+	displayDeprecationWarnings(flags)
+
+	if err := ValidateEndpointURL(*flags.EndpointURL); err != nil {
+		return err
+	}
+
+	if err := ValidateSnapshotInterval(*flags.SnapshotInterval); err != nil {
+		return err
+	}
+
+	if *flags.AdminPassword != "" && *flags.AdminPasswordFile != "" {
+		return ErrAdminPassExcludeAdminPassFile
+	}
+
+	return nil
+}
+
+func displayDeprecationWarnings(flags *portainer.CLIFlags) {
+	if *flags.NoAnalytics {
+		log.Warn().Msg("the --no-analytics flag has been kept to allow migration of instances running a previous version of Portainer with this flag enabled, to version 2.0 where enabling this flag will have no effect")
+	}
+}
+
+func ValidateEndpointURL(endpointURL string) error {
+	if endpointURL == "" {
+		return nil
+	}
+
+	if !strings.HasPrefix(endpointURL, "unix://") && !strings.HasPrefix(endpointURL, "tcp://") && !strings.HasPrefix(endpointURL, "npipe://") {
+		return ErrInvalidEndpointProtocol
+	}
+
+	if strings.HasPrefix(endpointURL, "unix://") || strings.HasPrefix(endpointURL, "npipe://") {
+		socketPath := strings.TrimPrefix(endpointURL, "unix://")
+		socketPath = strings.TrimPrefix(socketPath, "npipe://")
+
+		if _, err := os.Stat(socketPath); err != nil {
+			if os.IsNotExist(err) {
+				return ErrSocketOrNamedPipeNotFound
+			}
+
+			return err
+		}
+	}
+
+	return nil
+}
+
+func ValidateSnapshotInterval(snapshotInterval string) error {
+	if snapshotInterval == "" {
+		return nil
+	}
+
+	if _, err := time.ParseDuration(snapshotInterval); err != nil {
+		return ErrInvalidSnapshotInterval
+	}
+
+	return nil
+}
diff --git a/api/cli/cli_test.go b/api/cli/cli_test.go
new file mode 100644
index 0000000..1480fb9
--- /dev/null
+++ b/api/cli/cli_test.go
@@ -0,0 +1,263 @@
+package cli
+
+import (
+	"io"
+	"os"
+	"strings"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	zerolog "github.com/rs/zerolog/log"
+	"github.com/stretchr/testify/require"
+)
+
+func TestOptionParser(t *testing.T) {
+	p := Service{}
+	require.NotNil(t, p)
+
+	a := os.Args
+	defer func() { os.Args = a }()
+
+	os.Args = []string{"portainer", "--edge-compute"}
+
+	opts, err := p.ParseFlags("2.34.5")
+	require.NoError(t, err)
+
+	require.False(t, *opts.HTTPDisabled)
+	require.True(t, *opts.EnableEdgeComputeFeatures)
+}
+
+func TestParseKubectlShellImageFlag(t *testing.T) {
+	tests := []struct {
+		name                         string
+		args                         []string
+		envVars                      map[string]string
+		expectedKubectlShellImageSet bool
+		expectedKubectlShellFlag     string
+	}{
+		{
+			name:                         "no flag, no env var",
+			expectedKubectlShellImageSet: false,
+			expectedKubectlShellFlag:     portainer.DefaultKubectlShellImage,
+		},
+		{
+			name:                         "explicit flag",
+			args:                         []string{"portainer", "--kubectl-shell-image=myimage:v2"},
+			expectedKubectlShellImageSet: true,
+			expectedKubectlShellFlag:     "myimage:v2",
+		},
+		{
+			name:                         "env var",
+			envVars:                      map[string]string{portainer.KubectlShellImageEnvVar: "myimage:v3"},
+			expectedKubectlShellImageSet: true,
+			expectedKubectlShellFlag:     "myimage:v3",
+		},
+		{
+			name:                         "both env var and flag set",
+			args:                         []string{"portainer", "--kubectl-shell-image=myimage:v2"},
+			envVars:                      map[string]string{portainer.KubectlShellImageEnvVar: "myimage:v3"},
+			expectedKubectlShellImageSet: true,
+			expectedKubectlShellFlag:     "myimage:v2",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			if tc.args == nil {
+				tc.args = []string{"portainer"}
+			}
+			setOsArgs(t, tc.args)
+
+			for k, v := range tc.envVars {
+				t.Setenv(k, v)
+			}
+
+			flags, err := Service{}.ParseFlags("test-version")
+			require.NoError(t, err)
+			require.Equal(t, tc.expectedKubectlShellImageSet, flags.KubectlShellImageSet)
+			require.Equal(t, tc.expectedKubectlShellFlag, *flags.KubectlShellImage)
+		})
+	}
+}
+
+func TestParseTLSFlags(t *testing.T) {
+	testCases := []struct {
+		name                string
+		args                []string
+		expectedTLSFlag     bool
+		expectedTLSCertFlag string
+		expectedTLSKeyFlag  string
+		expectedLogMessages []string
+	}{
+		{
+			name:                "no flags",
+			expectedTLSFlag:     false,
+			expectedTLSCertFlag: "",
+			expectedTLSKeyFlag:  "",
+		},
+		{
+			name: "only ssl flag",
+			args: []string{
+				"portainer",
+				"--ssl",
+			},
+			expectedTLSFlag:     true,
+			expectedTLSCertFlag: "",
+			expectedTLSKeyFlag:  "",
+		},
+		{
+			name: "only tls flag",
+			args: []string{
+				"portainer",
+				"--tlsverify",
+			},
+			expectedTLSFlag:     true,
+			expectedTLSCertFlag: defaultTLSCertPath,
+			expectedTLSKeyFlag:  defaultTLSKeyPath,
+		},
+		{
+			name: "partial ssl flags",
+			args: []string{
+				"portainer",
+				"--ssl",
+				"--sslcert=ssl-cert-flag-value",
+			},
+			expectedTLSFlag:     true,
+			expectedTLSCertFlag: "ssl-cert-flag-value",
+			expectedTLSKeyFlag:  "",
+		},
+		{
+			name: "partial tls flags",
+			args: []string{
+				"portainer",
+				"--tlsverify",
+				"--tlscert=tls-cert-flag-value",
+			},
+			expectedTLSFlag:     true,
+			expectedTLSCertFlag: "tls-cert-flag-value",
+			expectedTLSKeyFlag:  defaultTLSKeyPath,
+		},
+		{
+			name: "partial tls and ssl flags",
+			args: []string{
+				"portainer",
+				"--tlsverify",
+				"--tlscert=tls-cert-flag-value",
+				"--sslkey=ssl-key-flag-value",
+			},
+			expectedTLSFlag:     true,
+			expectedTLSCertFlag: "tls-cert-flag-value",
+			expectedTLSKeyFlag:  "ssl-key-flag-value",
+		},
+		{
+			name: "partial tls and ssl flags 2",
+			args: []string{
+				"portainer",
+				"--ssl",
+				"--tlscert=tls-cert-flag-value",
+				"--sslkey=ssl-key-flag-value",
+			},
+			expectedTLSFlag:     true,
+			expectedTLSCertFlag: "tls-cert-flag-value",
+			expectedTLSKeyFlag:  "ssl-key-flag-value",
+		},
+		{
+			name: "ssl flags",
+			args: []string{
+				"portainer",
+				"--ssl",
+				"--sslcert=ssl-cert-flag-value",
+				"--sslkey=ssl-key-flag-value",
+			},
+			expectedTLSFlag:     true,
+			expectedTLSCertFlag: "ssl-cert-flag-value",
+			expectedTLSKeyFlag:  "ssl-key-flag-value",
+			expectedLogMessages: []string{
+				"the \\\"ssl\\\" flag is deprecated. use \\\"tlsverify\\\" instead.",
+				"the \\\"sslcert\\\" flag is deprecated. use \\\"tlscert\\\" instead.",
+				"the \\\"sslkey\\\" flag is deprecated. use \\\"tlskey\\\" instead.",
+			},
+		},
+		{
+			name: "tls flags",
+			args: []string{
+				"portainer",
+				"--tlsverify",
+				"--tlscert=tls-cert-flag-value",
+				"--tlskey=tls-key-flag-value",
+			},
+			expectedTLSFlag:     true,
+			expectedTLSCertFlag: "tls-cert-flag-value",
+			expectedTLSKeyFlag:  "tls-key-flag-value",
+		},
+		{
+			name: "tls and ssl flags",
+			args: []string{
+				"portainer",
+				"--tlsverify",
+				"--tlscert=tls-cert-flag-value",
+				"--tlskey=tls-key-flag-value",
+				"--ssl",
+				"--sslcert=ssl-cert-flag-value",
+				"--sslkey=ssl-key-flag-value",
+			},
+			expectedTLSFlag:     true,
+			expectedTLSCertFlag: "tls-cert-flag-value",
+			expectedTLSKeyFlag:  "tls-key-flag-value",
+			expectedLogMessages: []string{
+				"the \\\"ssl\\\" flag is deprecated. use \\\"tlsverify\\\" instead.",
+				"the \\\"sslcert\\\" flag is deprecated. use \\\"tlscert\\\" instead.",
+				"the \\\"sslkey\\\" flag is deprecated. use \\\"tlskey\\\" instead.",
+			},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			var logOutput strings.Builder
+			setupLogOutput(t, &logOutput)
+
+			if tc.args == nil {
+				tc.args = []string{"portainer"}
+			}
+			setOsArgs(t, tc.args)
+
+			s := Service{}
+			flags, err := s.ParseFlags("test-version")
+			if err != nil {
+				t.Fatalf("error parsing flags: %v", err)
+			}
+
+			if flags.TLS == nil {
+				t.Fatal("TLS flag was nil")
+			}
+
+			require.Equal(t, tc.expectedTLSFlag, *flags.TLS, "tlsverify flag didn't match")
+			require.Equal(t, tc.expectedTLSCertFlag, *flags.TLSCert, "tlscert flag didn't match")
+			require.Equal(t, tc.expectedTLSKeyFlag, *flags.TLSKey, "tlskey flag didn't match")
+
+			for _, expectedLogMessage := range tc.expectedLogMessages {
+				require.Contains(t, logOutput.String(), expectedLogMessage, "Log didn't contain expected message")
+			}
+		})
+	}
+}
+
+func setOsArgs(t *testing.T, args []string) {
+	t.Helper()
+	previousArgs := os.Args
+	os.Args = args
+	t.Cleanup(func() {
+		os.Args = previousArgs
+	})
+}
+
+func setupLogOutput(t *testing.T, w io.Writer) {
+	t.Helper()
+
+	oldLogger := zerolog.Logger
+	zerolog.Logger = zerolog.Output(w)
+	t.Cleanup(func() {
+		zerolog.Logger = oldLogger
+	})
+}
diff --git a/api/cli/confirm.go b/api/cli/confirm.go
new file mode 100644
index 0000000..0681f5c
--- /dev/null
+++ b/api/cli/confirm.go
@@ -0,0 +1,23 @@
+package cli
+
+import (
+	"bufio"
+	"fmt"
+	"os"
+	"strings"
+)
+
+// Confirm starts a rollback db cli application
+func Confirm(message string) (bool, error) {
+	fmt.Printf("%s [y/N] ", message)
+
+	reader := bufio.NewReader(os.Stdin)
+
+	answer, err := reader.ReadString('\n')
+	if err != nil {
+		return false, err
+	}
+
+	answer = strings.ReplaceAll(answer, "\n", "")
+	return strings.EqualFold(answer, "y") || strings.EqualFold(answer, "yes"), nil
+}
diff --git a/api/cli/defaults.go b/api/cli/defaults.go
new file mode 100644
index 0000000..23af32a
--- /dev/null
+++ b/api/cli/defaults.go
@@ -0,0 +1,23 @@
+//go:build !windows
+
+package cli
+
+const (
+	defaultBindAddress            = ":9000"
+	defaultHTTPSBindAddress       = ":9443"
+	defaultTunnelServerAddress    = "0.0.0.0"
+	defaultTunnelServerPort       = "8000"
+	defaultDataDirectory          = "/data"
+	defaultAssetsDirectory        = "./"
+	defaultTLS                    = "false"
+	defaultTLSSkipVerify          = "false"
+	defaultTLSCACertPath          = "/certs/ca.pem"
+	defaultTLSCertPath            = "/certs/cert.pem"
+	defaultTLSKeyPath             = "/certs/key.pem"
+	defaultHTTPDisabled           = "false"
+	defaultHTTPEnabled            = "false"
+	defaultSSL                    = "false"
+	defaultBaseURL                = "/"
+	defaultSecretKeyName          = "portainer"
+	defaultPullLimitCheckDisabled = "false"
+)
diff --git a/api/cli/defaults_windows.go b/api/cli/defaults_windows.go
new file mode 100644
index 0000000..a9d02da
--- /dev/null
+++ b/api/cli/defaults_windows.go
@@ -0,0 +1,22 @@
+package cli
+
+const (
+	defaultBindAddress            = ":9000"
+	defaultHTTPSBindAddress       = ":9443"
+	defaultTunnelServerAddress    = "0.0.0.0"
+	defaultTunnelServerPort       = "8000"
+	defaultDataDirectory          = "C:\\data"
+	defaultAssetsDirectory        = "./"
+	defaultTLS                    = "false"
+	defaultTLSSkipVerify          = "false"
+	defaultTLSCACertPath          = "C:\\certs\\ca.pem"
+	defaultTLSCertPath            = "C:\\certs\\cert.pem"
+	defaultTLSKeyPath             = "C:\\certs\\key.pem"
+	defaultHTTPDisabled           = "false"
+	defaultHTTPEnabled            = "false"
+	defaultSSL                    = "false"
+	defaultSnapshotInterval       = "5m"
+	defaultBaseURL                = "/"
+	defaultSecretKeyName          = "portainer"
+	defaultPullLimitCheckDisabled = "false"
+)
diff --git a/api/cli/pairlist.go b/api/cli/pairlist.go
new file mode 100644
index 0000000..ded08bf
--- /dev/null
+++ b/api/cli/pairlist.go
@@ -0,0 +1,41 @@
+package cli
+
+import (
+	portainer "github.com/portainer/portainer/api"
+
+	"fmt"
+	"strings"
+
+	"github.com/alecthomas/kingpin/v2"
+)
+
+type pairList []portainer.Pair
+
+// Set implementation for a list of portainer.Pair
+func (l *pairList) Set(value string) error {
+	parts := strings.SplitN(value, "=", 2)
+	if len(parts) != 2 {
+		return fmt.Errorf("expected NAME=VALUE got '%s'", value)
+	}
+	p := new(portainer.Pair)
+	p.Name = parts[0]
+	p.Value = parts[1]
+	*l = append(*l, *p)
+	return nil
+}
+
+// String implementation for a list of pair
+func (l *pairList) String() string {
+	return ""
+}
+
+// IsCumulative implementation for a list of pair
+func (l *pairList) IsCumulative() bool {
+	return true
+}
+
+func pairs(s kingpin.Settings) (target *[]portainer.Pair) {
+	target = new([]portainer.Pair)
+	s.SetValue((*pairList)(target))
+	return
+}
diff --git a/api/cmd/portainer/main.go b/api/cmd/portainer/main.go
new file mode 100644
index 0000000..d5104db
--- /dev/null
+++ b/api/cmd/portainer/main.go
@@ -0,0 +1,728 @@
+package main
+
+import (
+	"cmp"
+	"context"
+	"crypto/sha256"
+	nethttp "net/http"
+	"os"
+	"path"
+	"strings"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/apikey"
+	"github.com/portainer/portainer/api/chisel"
+	"github.com/portainer/portainer/api/cli"
+	"github.com/portainer/portainer/api/crypto"
+	"github.com/portainer/portainer/api/database"
+	"github.com/portainer/portainer/api/database/boltdb"
+	"github.com/portainer/portainer/api/database/models"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/datastore/migrator"
+	"github.com/portainer/portainer/api/datastore/postinit"
+	"github.com/portainer/portainer/api/docker"
+	dockerclient "github.com/portainer/portainer/api/docker/client"
+	"github.com/portainer/portainer/api/exec"
+	"github.com/portainer/portainer/api/filesystem"
+	"github.com/portainer/portainer/api/git"
+	"github.com/portainer/portainer/api/http"
+	"github.com/portainer/portainer/api/http/proxy"
+	kubeproxy "github.com/portainer/portainer/api/http/proxy/factory/kubernetes"
+	"github.com/portainer/portainer/api/http/security/setuptoken"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/internal/edge/edgestacks"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+	"github.com/portainer/portainer/api/internal/snapshot"
+	"github.com/portainer/portainer/api/internal/ssl"
+	"github.com/portainer/portainer/api/internal/upgrade"
+	"github.com/portainer/portainer/api/jwt"
+	"github.com/portainer/portainer/api/kubernetes"
+	kubecli "github.com/portainer/portainer/api/kubernetes/cli"
+	"github.com/portainer/portainer/api/ldap"
+	"github.com/portainer/portainer/api/logs"
+	"github.com/portainer/portainer/api/oauth"
+	"github.com/portainer/portainer/api/pendingactions"
+	"github.com/portainer/portainer/api/pendingactions/actions"
+	"github.com/portainer/portainer/api/pendingactions/handlers"
+	"github.com/portainer/portainer/api/platform"
+	"github.com/portainer/portainer/api/scheduler"
+	"github.com/portainer/portainer/api/stacks/deployments"
+	"github.com/portainer/portainer/pkg/build"
+	"github.com/portainer/portainer/pkg/featureflags"
+	"github.com/portainer/portainer/pkg/fips"
+	"github.com/portainer/portainer/pkg/libhelm"
+	"github.com/portainer/portainer/pkg/libhttp/ssrf"
+	"github.com/portainer/portainer/pkg/libstack/compose"
+	libswarm "github.com/portainer/portainer/pkg/libstack/swarm"
+	"github.com/portainer/portainer/pkg/validate"
+
+	gogitclient "github.com/go-git/go-git/v5/plumbing/transport/client"
+	gogitraw "github.com/go-git/go-git/v5/plumbing/transport/git"
+	gogithttp "github.com/go-git/go-git/v5/plumbing/transport/http"
+	gogitssh "github.com/go-git/go-git/v5/plumbing/transport/ssh"
+	"github.com/google/uuid"
+	"github.com/rs/zerolog/log"
+)
+
+func initCLI() *portainer.CLIFlags {
+	cliService := cli.Service{}
+
+	flags, err := cliService.ParseFlags(portainer.APIVersion)
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed parsing flags")
+	}
+
+	if err := cliService.ValidateFlags(flags); err != nil {
+		log.Fatal().Err(err).Msg("failed validating flags")
+	}
+
+	return flags
+}
+
+func initFileService(dataStorePath string) portainer.FileService {
+	fileService, err := filesystem.NewService(dataStorePath, "")
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed creating file service")
+	}
+
+	return fileService
+}
+
+func initDataStore(flags *portainer.CLIFlags, secretKey []byte, fileService portainer.FileService, shutdownCtx context.Context) dataservices.DataStore {
+	connection, err := database.NewDatabase("boltdb", *flags.Data, secretKey, *flags.CompactDB)
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed creating database connection")
+	}
+
+	if bconn, ok := connection.(*boltdb.DbConnection); ok {
+		bconn.MaxBatchSize = *flags.MaxBatchSize
+		bconn.MaxBatchDelay = *flags.MaxBatchDelay
+		bconn.InitialMmapSize = *flags.InitialMmapSize
+	} else {
+		log.Fatal().Msg("failed creating database connection: expecting a boltdb database type but a different one was received")
+	}
+
+	store := datastore.NewStore(flags, fileService, connection)
+
+	isNew, err := store.Open()
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed opening store")
+	}
+
+	if *flags.Rollback {
+		if err := store.Rollback(false); err != nil {
+			log.Fatal().Err(err).Msg("failed rolling back")
+		}
+
+		log.Info().Msg("exiting rollback")
+		os.Exit(0)
+	}
+
+	// Init sets some defaults - it's basically a migration
+	if err := store.Init(); err != nil {
+		log.Fatal().Err(err).Msg("failed initializing data store")
+	}
+
+	if isNew {
+		instanceId, err := uuid.NewRandom()
+		if err != nil {
+			log.Fatal().Err(err).Msg("failed generating instance id")
+		}
+
+		migratorInstance := migrator.NewMigrator(&migrator.MigratorParameters{Flags: flags})
+		migratorCount := migratorInstance.GetMigratorCountOfCurrentAPIVersion()
+
+		// from MigrateData
+		v := models.Version{
+			SchemaVersion: portainer.APIVersion,
+			Edition:       int(portainer.PortainerCE),
+			InstanceID:    instanceId.String(),
+			MigratorCount: migratorCount,
+		}
+
+		if err := store.VersionService.UpdateVersion(&v); err != nil {
+			log.Fatal().Err(err).Msg("failed to update version")
+		}
+
+		if err := updateSettingsFromFlags(store, flags); err != nil {
+			log.Fatal().Err(err).Msg("failed updating settings from flags")
+		}
+	} else if err := store.MigrateData(); err != nil {
+		log.Fatal().Err(err).Msg("failed migration")
+	}
+
+	if err := updateSettingsFromFlags(store, flags); err != nil {
+		log.Fatal().Err(err).Msg("failed updating settings from flags")
+	}
+
+	// this is for the db restore functionality - needs more tests.
+	go func() {
+		<-shutdownCtx.Done()
+
+		defer logs.CloseAndLogErr(connection)
+	}()
+
+	return store
+}
+
+// checkDBSchemaServerVersionMatch checks if the server version matches the db scehma version
+func checkDBSchemaServerVersionMatch(dbStore dataservices.DataStore, serverVersion string, serverEdition int) bool {
+	v, err := dbStore.Version().Version()
+	if err != nil {
+		return false
+	}
+
+	return v.SchemaVersion == serverVersion && v.Edition == serverEdition
+}
+
+func initKubernetesDeployer(kubernetesTokenCacheManager *kubeproxy.TokenCacheManager, kubernetesClientFactory *kubecli.ClientFactory, dataStore dataservices.DataStore, reverseTunnelService portainer.ReverseTunnelService, signatureService portainer.DigitalSignatureService, proxyManager *proxy.Manager) portainer.KubernetesDeployer {
+	return exec.NewKubernetesDeployer(kubernetesTokenCacheManager, kubernetesClientFactory, dataStore, reverseTunnelService, signatureService, proxyManager)
+}
+
+func initAPIKeyService(datastore dataservices.DataStore) apikey.APIKeyService {
+	return apikey.NewAPIKeyService(datastore.APIKeyRepository(), datastore.User())
+}
+
+func initJWTService(userSessionTimeout string, dataStore dataservices.DataStore) (portainer.JWTService, error) {
+	if userSessionTimeout == "" {
+		userSessionTimeout = portainer.DefaultUserSessionTimeout
+	}
+
+	return jwt.NewService(userSessionTimeout, dataStore)
+}
+
+func initDigitalSignatureService() portainer.DigitalSignatureService {
+	return crypto.NewECDSAService(os.Getenv("AGENT_SECRET"))
+}
+
+func initSSLService(addr, certPath, keyPath string, fileService portainer.FileService, dataStore dataservices.DataStore, shutdownTrigger context.CancelFunc) (*ssl.Service, error) {
+	slices := strings.Split(addr, ":")
+
+	host := slices[0]
+	if host == "" {
+		host = "0.0.0.0"
+	}
+
+	sslService := ssl.NewService(fileService, dataStore, shutdownTrigger)
+
+	if err := sslService.Init(host, certPath, keyPath); err != nil {
+		return nil, err
+	}
+
+	return sslService, nil
+}
+
+func initSnapshotService(
+	snapshotIntervalFromFlag string,
+	dataStore dataservices.DataStore,
+	dockerClientFactory *dockerclient.ClientFactory,
+	kubernetesClientFactory *kubecli.ClientFactory,
+	pendingActionsService *pendingactions.PendingActionsService,
+) (portainer.SnapshotService, error) {
+	dockerSnapshotter := docker.NewSnapshotter(dockerClientFactory)
+	kubernetesSnapshotter := kubernetes.NewSnapshotter(kubernetesClientFactory)
+
+	snapshotService, err := snapshot.NewService(snapshotIntervalFromFlag, dataStore, dockerSnapshotter, kubernetesSnapshotter, pendingActionsService)
+	if err != nil {
+		return nil, err
+	}
+
+	return snapshotService, nil
+}
+
+func resolveSetupToken(tx dataservices.DataStoreTx, providedToken string) (string, error) {
+	admins, err := tx.User().UsersByRole(portainer.AdministratorRole)
+	if err != nil {
+		return "", err
+	}
+	if len(admins) > 0 {
+		return "", nil
+	}
+
+	if providedToken != "" {
+		log.Info().Msg("using custom setup token; admin initialization and backup restore require this token in the X-Setup-Token header")
+		return providedToken, nil
+	}
+
+	token, err := setuptoken.Generate()
+	if err != nil {
+		return "", err
+	}
+
+	log.Info().
+		Str("setup_token", token).
+		Msg("no administrator account configured; admin initialization and backup restore require this setup token in the X-Setup-Token header. Start with --no-setup-token to disable.")
+
+	return token, nil
+}
+
+func initStatus(instanceID string) *portainer.Status {
+	return &portainer.Status{
+		Version:    portainer.APIVersion,
+		InstanceID: instanceID,
+	}
+}
+
+func updateSettingsFromFlags(dataStore dataservices.DataStore, flags *portainer.CLIFlags) error {
+	settings, err := dataStore.Settings().Settings()
+	if err != nil {
+		return err
+	}
+
+	settings.SnapshotInterval = cmp.Or(*flags.SnapshotInterval, settings.SnapshotInterval)
+	settings.LogoURL = cmp.Or(*flags.Logo, settings.LogoURL)
+	settings.EnableEdgeComputeFeatures = cmp.Or(*flags.EnableEdgeComputeFeatures, settings.EnableEdgeComputeFeatures)
+	settings.TemplatesURL = cmp.Or(*flags.Templates, settings.TemplatesURL)
+
+	if flags.KubectlShellImageSet {
+		settings.KubectlShellImage = *flags.KubectlShellImage
+	}
+
+	if *flags.Labels != nil {
+		settings.BlackListedLabels = *flags.Labels
+	}
+
+	settings.AgentSecret = ""
+	if agentKey, ok := os.LookupEnv("AGENT_SECRET"); ok {
+		settings.AgentSecret = agentKey
+	}
+
+	if err := dataStore.Settings().UpdateSettings(settings); err != nil {
+		return err
+	}
+
+	sslSettings, err := dataStore.SSLSettings().Settings()
+	if err != nil {
+		return err
+	}
+
+	if *flags.HTTPDisabled {
+		sslSettings.HTTPEnabled = false
+	} else if *flags.HTTPEnabled {
+		sslSettings.HTTPEnabled = true
+	}
+
+	return dataStore.SSLSettings().UpdateSettings(sslSettings)
+}
+
+func loadAndParseKeyPair(fileService portainer.FileService, signatureService portainer.DigitalSignatureService) error {
+	private, public, err := fileService.LoadKeyPair()
+	if err != nil {
+		return err
+	}
+
+	return signatureService.ParseKeyPair(private, public)
+}
+
+func generateAndStoreKeyPair(fileService portainer.FileService, signatureService portainer.DigitalSignatureService) error {
+	private, public, err := signatureService.GenerateKeyPair()
+	if err != nil {
+		return err
+	}
+
+	privateHeader, publicHeader := signatureService.PEMHeaders()
+
+	return fileService.StoreKeyPair(private, public, privateHeader, publicHeader)
+}
+
+func initKeyPair(fileService portainer.FileService, signatureService portainer.DigitalSignatureService) error {
+	existingKeyPair, err := fileService.KeyPairFilesExist()
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed checking for existing key pair")
+	}
+
+	if existingKeyPair {
+		return loadAndParseKeyPair(fileService, signatureService)
+	}
+
+	return generateAndStoreKeyPair(fileService, signatureService)
+}
+
+// dbSecretPath build the path to the file that contains the db encryption
+// secret. Normally in Docker this is built from the static path inside
+// /run/secrets for example: /run/secrets/<keyFilenameFlag> but for ease of
+// use outside Docker it also accepts an absolute path
+func dbSecretPath(keyFilenameFlag string) string {
+	if path.IsAbs(keyFilenameFlag) {
+		return keyFilenameFlag
+	}
+	return path.Join("/run/secrets", keyFilenameFlag)
+}
+
+func loadEncryptionSecretKey(keyfilename string) []byte {
+	content, err := os.ReadFile(keyfilename)
+	if err != nil {
+		if os.IsNotExist(err) {
+			log.Info().Str("filename", keyfilename).Msg("encryption key file not present")
+		} else {
+			log.Info().Err(err).Msg("error reading encryption key file")
+		}
+
+		return nil
+	}
+
+	// return a 32 byte hash of the secret (required for AES)
+	// fips compliant version of this is not implemented in -ce
+	hash := sha256.Sum256(content)
+
+	return hash[:]
+}
+
+func buildServer(flags *portainer.CLIFlags, shutdownCtx context.Context, shutdownTrigger context.CancelFunc) portainer.Server {
+	if flags.FeatureFlags != nil {
+		featureflags.Parse(*flags.FeatureFlags, portainer.SupportedFeatureFlags)
+	}
+
+	trustedOrigins := []string{}
+	if *flags.TrustedOrigins != "" {
+		// validate if the trusted origins are valid urls
+		for origin := range strings.SplitSeq(*flags.TrustedOrigins, ",") {
+			if !validate.IsTrustedOrigin(origin) {
+				log.Fatal().Str("trusted_origin", origin).Msg("invalid trusted origin: must be scheme://host or scheme://host:port (e.g. https://example.com)")
+			}
+
+			trustedOrigins = append(trustedOrigins, origin)
+		}
+	}
+
+	// -ce can not ever be run in FIPS mode
+	fips.InitFIPS(false)
+
+	fileService := initFileService(*flags.Data)
+	encryptionKey := loadEncryptionSecretKey(dbSecretPath(*flags.SecretKeyName))
+	if encryptionKey == nil {
+		log.Info().Msg("proceeding without encryption key")
+	}
+
+	dataStore := initDataStore(flags, encryptionKey, fileService, shutdownCtx)
+
+	if err := dataStore.CheckCurrentEdition(); err != nil {
+		log.Fatal().Err(err).Msg("")
+	}
+
+	// check if the db schema version matches with server version
+	if !checkDBSchemaServerVersionMatch(dataStore, portainer.APIVersion, int(portainer.Edition)) {
+		log.Fatal().Msg("The database schema version does not align with the server version. Please consider reverting to the previous server version or addressing the database migration issue.")
+	}
+
+	if err := ssrf.Configure(dataStore.AllowList()); err != nil {
+		log.Fatal().Err(err).Msg("failed initializing ssrf service")
+	}
+
+	if !ssrf.WrapDefaultTransport() {
+		log.Fatal().Msg("failed to wrap default HTTP transport with SSRF protection")
+	}
+
+	gogithttp.DefaultClient = gogithttp.NewClient(&nethttp.Client{Transport: nethttp.DefaultTransport})
+	gogitclient.InstallProtocol("git", git.NewSSRFGitTransport(gogitraw.DefaultClient))
+	gogitclient.InstallProtocol("ssh", git.NewSSRFGitTransport(gogitssh.DefaultClient))
+	gogitclient.InstallProtocol("file", nil)
+
+	instanceID, err := dataStore.Version().InstanceID()
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed getting instance id")
+	}
+
+	apiKeyService := initAPIKeyService(dataStore)
+
+	settings, err := dataStore.Settings().Settings()
+	if err != nil {
+		log.Fatal().Err(err).Msg("")
+	}
+
+	jwtService, err := initJWTService(settings.UserSessionTimeout, dataStore)
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed initializing JWT service")
+	}
+
+	ldapService := ldap.Service{}
+
+	oauthService := oauth.NewService()
+
+	gitService := git.NewService(shutdownCtx)
+
+	cryptoService := crypto.Service{}
+
+	signatureService := initDigitalSignatureService()
+
+	edgeStacksService := edgestacks.NewService(dataStore)
+
+	sslService, err := initSSLService(*flags.AddrHTTPS, *flags.TLSCert, *flags.TLSKey, fileService, dataStore, shutdownTrigger)
+	if err != nil {
+		log.Fatal().Err(err).Msg("")
+	}
+
+	sslSettings, err := sslService.GetSSLSettings()
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed to get SSL settings")
+	}
+
+	if err := initKeyPair(fileService, signatureService); err != nil {
+		log.Fatal().Err(err).Msg("failed initializing key pair")
+	}
+
+	reverseTunnelService := chisel.NewService(dataStore, shutdownCtx, fileService)
+
+	dockerClientFactory := dockerclient.NewClientFactory(signatureService, reverseTunnelService)
+
+	kubernetesClientFactory, err := kubecli.NewClientFactory(signatureService, reverseTunnelService, dataStore, instanceID, *flags.AddrHTTPS, settings.UserSessionTimeout)
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed initializing Kubernetes Client Factory service")
+	}
+
+	authorizationService := authorization.NewService(dataStore)
+	authorizationService.K8sClientFactory = kubernetesClientFactory
+
+	kubernetesTokenCacheManager := kubeproxy.NewTokenCacheManager()
+
+	kubeClusterAccessService := kubernetes.NewKubeClusterAccessService(*flags.BaseURL, *flags.AddrHTTPS, sslSettings.CertPath)
+
+	proxyManager := proxy.NewManager(kubernetesClientFactory)
+
+	reverseTunnelService.ProxyManager = proxyManager
+
+	composeDeployer := compose.NewComposeDeployer()
+
+	composeStackManager := exec.NewComposeStackManager(composeDeployer, proxyManager)
+
+	swarmStackManager := exec.NewSwarmStackManager(libswarm.NewSwarmDeployer(), proxyManager)
+
+	kubernetesDeployer := initKubernetesDeployer(kubernetesTokenCacheManager, kubernetesClientFactory, dataStore, reverseTunnelService, signatureService, proxyManager)
+
+	pendingActionsService := pendingactions.NewService(dataStore, kubernetesClientFactory)
+	pendingActionsService.RegisterHandler(actions.CleanNAPWithOverridePolicies, handlers.NewHandlerCleanNAPWithOverridePolicies(authorizationService, dataStore))
+	pendingActionsService.RegisterHandler(actions.DeletePortainerK8sRegistrySecrets, handlers.NewHandlerDeleteRegistrySecrets(authorizationService, dataStore, kubernetesClientFactory))
+	pendingActionsService.RegisterHandler(actions.PostInitMigrateEnvironment, handlers.NewHandlerPostInitMigrateEnvironment(authorizationService, dataStore, kubernetesClientFactory, dockerClientFactory, *flags.Assets, kubernetesDeployer))
+
+	snapshotService, err := initSnapshotService(*flags.SnapshotInterval, dataStore, dockerClientFactory, kubernetesClientFactory, pendingActionsService)
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed initializing snapshot service")
+	}
+
+	snapshotService.Start(shutdownCtx)
+
+	proxyManager.NewProxyFactory(dataStore, signatureService, reverseTunnelService, dockerClientFactory, kubernetesClientFactory, kubernetesTokenCacheManager, gitService, snapshotService, jwtService)
+
+	helmPackageManager := libhelm.NewHelmPackageManager()
+
+	applicationStatus := initStatus(instanceID)
+
+	// channel to control when the admin user is created
+	adminCreationDone := make(chan struct{}, 1)
+
+	go endpointutils.InitEndpoint(shutdownCtx, adminCreationDone, flags, dataStore, snapshotService)
+
+	adminPasswordHash := ""
+
+	if *flags.AdminPasswordFile != "" {
+		content, err := fileService.GetFileContent(*flags.AdminPasswordFile, "")
+		if err != nil {
+			log.Fatal().Err(err).Msg("failed getting admin password file")
+		}
+
+		adminPasswordHash, err = cryptoService.Hash(strings.TrimSuffix(string(content), "\n"))
+		if err != nil {
+			log.Fatal().Err(err).Msg("failed hashing admin password")
+		}
+	} else if *flags.AdminPassword != "" {
+		adminPasswordHash = *flags.AdminPassword
+	}
+
+	if adminPasswordHash != "" {
+		users, err := dataStore.User().UsersByRole(portainer.AdministratorRole)
+		if err != nil {
+			log.Fatal().Err(err).Msg("failed getting admin user")
+		}
+
+		if len(users) == 0 {
+			log.Info().Msg("created admin user with the given password.")
+
+			user := &portainer.User{
+				Username: "admin",
+				Role:     portainer.AdministratorRole,
+				Password: adminPasswordHash,
+			}
+
+			if err := dataStore.User().Create(user); err != nil {
+				log.Fatal().Err(err).Msg("failed creating admin user")
+			}
+
+			// notify the admin user is created, the endpoint initialization can start
+			adminCreationDone <- struct{}{}
+		} else {
+			log.Info().Msg("instance already has an administrator user defined, skipping admin password related flags.")
+		}
+	}
+
+	setupToken := ""
+	if adminPasswordHash == "" && !*flags.NoSetupToken {
+		if err := dataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
+			var txErr error
+			setupToken, txErr = resolveSetupToken(tx, *flags.SetupToken)
+			return txErr
+		}); err != nil {
+			log.Fatal().Err(err).Msg("failed initializing setup token")
+		}
+	}
+
+	if err := reverseTunnelService.StartTunnelServer(*flags.TunnelAddr, *flags.TunnelPort, snapshotService); err != nil {
+		log.Fatal().Err(err).Msg("failed starting tunnel server")
+	}
+
+	scheduler := scheduler.NewScheduler(shutdownCtx)
+	stackDeployer := deployments.NewStackDeployer(swarmStackManager, composeStackManager, kubernetesDeployer, dockerClientFactory, dataStore)
+	if err := deployments.StartStackSchedules(scheduler, stackDeployer, dataStore, gitService); err != nil {
+		log.Fatal().Err(err).Msg("failed to start stack scheduler")
+	}
+
+	sslDBSettings, err := dataStore.SSLSettings().Settings()
+	if err != nil {
+		log.Fatal().Msg("failed to fetch SSL settings from DB")
+	}
+
+	platformService := platform.NewService(dataStore)
+
+	upgradeService, err := upgrade.NewService(
+		*flags.Assets,
+		kubernetesClientFactory,
+		dockerClientFactory,
+		composeStackManager,
+		dataStore,
+		fileService,
+		stackDeployer,
+	)
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed initializing upgrade service")
+	}
+
+	// Our normal migrations run as part of the database initialization
+	// but some more complex migrations require access to a kubernetes or docker
+	// client. Therefore we run a separate migration process just before
+	// starting the server.
+	postInitMigrator := postinit.NewPostInitMigrator(
+		kubernetesClientFactory,
+		dockerClientFactory,
+		dataStore,
+		*flags.Assets,
+		kubernetesDeployer,
+	)
+	if err := postInitMigrator.PostInitMigrate(); err != nil {
+		log.Fatal().Err(err).Msg("failure during post init migrations")
+	}
+
+	if err := dataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return recoverStaleDeployingStacks(tx)
+	}); err != nil {
+		log.Info().Err(err).
+			Msg("Error recovering stale deploying stacks")
+	}
+
+	return &http.Server{
+		AuthorizationService:        authorizationService,
+		ReverseTunnelService:        reverseTunnelService,
+		Status:                      applicationStatus,
+		BindAddress:                 *flags.Addr,
+		BindAddressHTTPS:            *flags.AddrHTTPS,
+		CSP:                         *flags.CSP,
+		HTTPEnabled:                 sslDBSettings.HTTPEnabled,
+		AssetsPath:                  *flags.Assets,
+		DataStore:                   dataStore,
+		EdgeStacksService:           edgeStacksService,
+		SwarmStackManager:           swarmStackManager,
+		ComposeStackManager:         composeStackManager,
+		KubernetesDeployer:          kubernetesDeployer,
+		HelmPackageManager:          helmPackageManager,
+		APIKeyService:               apiKeyService,
+		CryptoService:               cryptoService,
+		JWTService:                  jwtService,
+		FileService:                 fileService,
+		LDAPService:                 ldapService,
+		OAuthService:                oauthService,
+		GitService:                  gitService,
+		ProxyManager:                proxyManager,
+		KubernetesTokenCacheManager: kubernetesTokenCacheManager,
+		KubeClusterAccessService:    kubeClusterAccessService,
+		SignatureService:            signatureService,
+		SnapshotService:             snapshotService,
+		SSLService:                  sslService,
+		DockerClientFactory:         dockerClientFactory,
+		KubernetesClientFactory:     kubernetesClientFactory,
+		Scheduler:                   scheduler,
+		ShutdownTrigger:             shutdownTrigger,
+		StackDeployer:               stackDeployer,
+		UpgradeService:              upgradeService,
+		AdminCreationDone:           adminCreationDone,
+		PendingActionsService:       pendingActionsService,
+		PlatformService:             platformService,
+		PullLimitCheckDisabled:      *flags.PullLimitCheckDisabled,
+		TrustedOrigins:              trustedOrigins,
+		SetupToken:                  setupToken,
+	}
+}
+
+func main() {
+	logs.ConfigureLogger()
+	logs.SetLoggingMode("PRETTY")
+
+	flags := initCLI()
+
+	logs.SetLoggingLevel(*flags.LogLevel)
+	logs.SetLoggingMode(*flags.LogMode)
+
+	for {
+		shutdownCtx, shutdownTrigger := context.WithCancel(context.Background())
+		server := buildServer(flags, shutdownCtx, shutdownTrigger)
+
+		log.Info().
+			Str("version", portainer.APIVersion).
+			Str("build_number", build.BuildNumber).
+			Str("image_tag", build.ImageTag).
+			Str("nodejs_version", build.NodejsVersion).
+			Str("pnpm_version", build.PnpmVersion).
+			Str("webpack_version", build.WebpackVersion).
+			Str("go_version", build.GoVersion).
+			Msg("starting Portainer")
+
+		err := server.Start(shutdownCtx)
+
+		log.Info().Err(err).Msg("HTTP server exited")
+	}
+}
+
+// recoverStaleDeployingStacks resets any stack that was left in the Deploying state
+// (e.g. because the server was restarted mid-deployment) to the Error state so the
+// user can retry.
+func recoverStaleDeployingStacks(tx dataservices.DataStoreTx) error {
+	stacks, err := tx.Stack().ReadAll(func(s portainer.Stack) bool {
+		return s.Status == portainer.StackStatusDeploying
+	})
+	if err != nil {
+		return err
+	}
+
+	for _, stack := range stacks {
+		stack.Status = portainer.StackStatusError
+		stack.DeploymentStatus = append(stack.DeploymentStatus, portainer.StackDeploymentStatus{
+			Status:  portainer.StackStatusError,
+			Time:    time.Now().Unix(),
+			Message: "Deployment interrupted by server restart",
+		})
+
+		if err := tx.Stack().Update(stack.ID, &stack); err != nil {
+			log.Warn().Err(err).
+				Int("stack_id", int(stack.ID)).
+				Str("context", "RecoverStaleDeployingStacks").
+				Msg("Unable to recover stale deploying stack")
+			continue
+		}
+		log.Debug().
+			Int("stack_id", int(stack.ID)).
+			Str("stack_name", stack.Name).
+			Str("context", "RecoverStaleDeployingStacks").
+			Msg("Recovered stale deploying stack to error state")
+	}
+
+	return nil
+}
diff --git a/api/cmd/portainer/main_test.go b/api/cmd/portainer/main_test.go
new file mode 100644
index 0000000..de9e4c1
--- /dev/null
+++ b/api/cmd/portainer/main_test.go
@@ -0,0 +1,159 @@
+package main
+
+import (
+	"os"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/filesystem"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_resolveSetupToken(t *testing.T) {
+	t.Parallel()
+
+	t.Run("admin already exists — returns empty token", func(t *testing.T) {
+		admin := portainer.User{Role: portainer.AdministratorRole}
+		store := testhelpers.NewDatastore(testhelpers.WithUsers([]portainer.User{admin}))
+		token, err := resolveSetupToken(store, "")
+		require.NoError(t, err)
+		assert.Empty(t, token)
+	})
+
+	t.Run("no admin — generates a 64-char hex token", func(t *testing.T) {
+		store := testhelpers.NewDatastore(testhelpers.WithUsers([]portainer.User{}))
+		token, err := resolveSetupToken(store, "")
+		require.NoError(t, err)
+		assert.Len(t, token, 64)
+
+		token2, err := resolveSetupToken(store, "")
+		require.NoError(t, err)
+		assert.NotEqual(t, token, token2)
+	})
+
+	t.Run("no admin — uses provided token", func(t *testing.T) {
+		store := testhelpers.NewDatastore(testhelpers.WithUsers([]portainer.User{}))
+		token, err := resolveSetupToken(store, "mysecrettoken")
+		require.NoError(t, err)
+		assert.Equal(t, "mysecrettoken", token)
+	})
+
+	t.Run("admin already exists — ignores provided token", func(t *testing.T) {
+		admin := portainer.User{Role: portainer.AdministratorRole}
+		store := testhelpers.NewDatastore(testhelpers.WithUsers([]portainer.User{admin}))
+		token, err := resolveSetupToken(store, "mysecrettoken")
+		require.NoError(t, err)
+		assert.Empty(t, token)
+	})
+}
+
+const secretFileName = "secret.txt"
+
+func createPasswordFile(t *testing.T, secretPath, password string) string {
+	err := os.WriteFile(secretPath, []byte(password), 0o600)
+	require.NoError(t, err)
+	return secretPath
+}
+
+func TestLoadEncryptionSecretKey(t *testing.T) {
+	t.Parallel()
+	tempDir := t.TempDir()
+	secretPath := filesystem.JoinPaths(tempDir, secretFileName)
+
+	// first pointing to file that does not exist, gives nil hash (no encryption)
+	encryptionKey := loadEncryptionSecretKey(secretPath)
+	require.Nil(t, encryptionKey)
+
+	// point to a directory instead of a file
+	encryptionKey = loadEncryptionSecretKey(tempDir)
+	require.Nil(t, encryptionKey)
+
+	password := "portainer@1234"
+	createPasswordFile(t, secretPath, password)
+
+	encryptionKey = loadEncryptionSecretKey(secretPath)
+	require.NotNil(t, encryptionKey)
+	// should be 32 bytes for aes256 encryption
+	require.Len(t, encryptionKey, 32)
+}
+
+func TestUpdateSettingsFromFlags_KubectlShellImage(t *testing.T) {
+	const existingImage = "existing-image:v1"
+	const newImage = "new-image:v2"
+
+	emptyString := ""
+	falseBool := false
+	var emptyLabels []portainer.Pair
+
+	tests := []struct {
+		name                      string
+		imageSet                  bool
+		flagImage                 string
+		expectedKubectlShellImage string
+	}{
+		{
+			name:                      "flag not set — DB image unchanged",
+			imageSet:                  false,
+			flagImage:                 portainer.DefaultKubectlShellImage,
+			expectedKubectlShellImage: existingImage,
+		},
+		{
+			name:                      "flag set — DB image updated",
+			imageSet:                  true,
+			flagImage:                 newImage,
+			expectedKubectlShellImage: newImage,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			store := testhelpers.NewDatastore(
+				testhelpers.WithSettingsService(&portainer.Settings{
+					KubectlShellImage: existingImage,
+				}),
+				testhelpers.WithSSLSettingsService(&portainer.SSLSettings{}),
+			)
+
+			flags := &portainer.CLIFlags{
+				SnapshotInterval:          &emptyString,
+				Logo:                      &emptyString,
+				EnableEdgeComputeFeatures: &falseBool,
+				Templates:                 &emptyString,
+				Labels:                    &emptyLabels,
+				HTTPDisabled:              &falseBool,
+				HTTPEnabled:               &falseBool,
+			}
+			flags.KubectlShellImage = &tc.flagImage
+			flags.KubectlShellImageSet = tc.imageSet
+
+			err := updateSettingsFromFlags(store, flags)
+			require.NoError(t, err)
+
+			settings, err := store.Settings().Settings()
+			require.NoError(t, err)
+			require.Equal(t, tc.expectedKubectlShellImage, settings.KubectlShellImage)
+		})
+	}
+}
+
+func TestDBSecretPath(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		keyFilenameFlag string
+		expected        string
+	}{
+		{keyFilenameFlag: "secret.txt", expected: "/run/secrets/secret.txt"},
+		{keyFilenameFlag: "/tmp/secret.txt", expected: "/tmp/secret.txt"},
+		{keyFilenameFlag: "/run/secrets/secret.txt", expected: "/run/secrets/secret.txt"},
+		{keyFilenameFlag: "./secret.txt", expected: "/run/secrets/secret.txt"},
+		{keyFilenameFlag: "../secret.txt", expected: "/run/secret.txt"},
+		{keyFilenameFlag: "foo/bar/secret.txt", expected: "/run/secrets/foo/bar/secret.txt"},
+	}
+
+	for _, test := range tests {
+		assert.Equal(t, test.expected, dbSecretPath(test.keyFilenameFlag))
+	}
+}
diff --git a/api/concurrent/concurrent.go b/api/concurrent/concurrent.go
new file mode 100644
index 0000000..e588732
--- /dev/null
+++ b/api/concurrent/concurrent.go
@@ -0,0 +1,148 @@
+// Package concurrent provides utilities for running multiple functions concurrently in Go.
+// For example, many kubernetes calls can take a while to fulfill.  Oftentimes in Portainer
+// we need to get a list of objects from multiple kubernetes REST APIs. We can often call these
+// apis concurrently to speed up the response time.
+// This package provides a clean way to do just that.
+//
+// Examples:
+//   The ConfigMaps and Secrets function converted using concurrent.Run.
+/*
+
+// GetConfigMapsAndSecrets gets all the ConfigMaps AND all the Secrets for a
+// given namespace in a k8s endpoint. The result is a list of both config maps
+// and secrets. The IsSecret boolean property indicates if a given struct is a
+// secret or configmap.
+func (kcl *KubeClient) GetConfigMapsAndSecrets(namespace string) ([]models.K8sConfigMapOrSecret, error) {
+
+	// use closures to capture the current kube client and namespace by declaring wrapper functions
+	// that match the interface signature for concurrent.Func
+
+	listConfigMaps := func(ctx context.Context) (any, error) {
+		return kcl.cli.CoreV1().ConfigMaps(namespace).List(context.Background(), meta.ListOptions{})
+	}
+
+	listSecrets := func(ctx context.Context) (any, error) {
+		return kcl.cli.CoreV1().Secrets(namespace).List(context.Background(), meta.ListOptions{})
+	}
+
+	// run the functions concurrently and wait for results.  We can also pass in a context to cancel.
+	// e.g. Deadline timer.
+	results, err := concurrent.Run(context.TODO(), listConfigMaps, listSecrets)
+	if err != nil {
+		return nil, err
+	}
+
+	var configMapList *core.ConfigMapList
+	var secretList *core.SecretList
+	for _, r := range results {
+		switch v := r.Result.(type) {
+		case *core.ConfigMapList:
+			configMapList = v
+		case *core.SecretList:
+			secretList = v
+		}
+	}
+
+	// TODO: Applications
+	var combined []models.K8sConfigMapOrSecret
+	for _, m := range configMapList.Items {
+		var cm models.K8sConfigMapOrSecret
+		cm.UID = string(m.UID)
+		cm.Name = m.Name
+		cm.Namespace = m.Namespace
+		cm.Annotations = m.Annotations
+		cm.Data = m.Data
+		cm.CreationDate = m.CreationTimestamp.Time.UTC().Format(time.RFC3339)
+		combined = append(combined, cm)
+	}
+
+	for _, s := range secretList.Items {
+		var secret models.K8sConfigMapOrSecret
+		secret.UID = string(s.UID)
+		secret.Name = s.Name
+		secret.Namespace = s.Namespace
+		secret.Annotations = s.Annotations
+		secret.Data = msbToMss(s.Data)
+		secret.CreationDate = s.CreationTimestamp.Time.UTC().Format(time.RFC3339)
+		secret.IsSecret = true
+		secret.SecretType = string(s.Type)
+		combined = append(combined, secret)
+	}
+
+	return combined, nil
+}
+
+*/
+
+package concurrent
+
+import (
+	"context"
+	"sync"
+)
+
+// Result contains the result and any error returned from running a client task function
+type Result struct {
+	Result any   // the result of running the task function
+	Err    error // any error that occurred while running the task function
+}
+
+// Func is a function returns a result or error
+type Func func(ctx context.Context) (any, error)
+
+// Run runs a list of functions returns the results
+func Run(ctx context.Context, maxConcurrency int, tasks ...Func) ([]Result, error) {
+	var wg sync.WaitGroup
+
+	resultsChan := make(chan Result, len(tasks))
+	taskChan := make(chan Func, len(tasks))
+
+	localCtx, cancelCtx := context.WithCancel(ctx)
+	defer cancelCtx()
+
+	runTask := func() {
+		defer wg.Done()
+
+		for fn := range taskChan {
+			result, err := fn(localCtx)
+			resultsChan <- Result{Result: result, Err: err}
+		}
+	}
+
+	// Set maxConcurrency to the number of tasks if zero or negative
+	if maxConcurrency <= 0 {
+		maxConcurrency = len(tasks)
+	}
+
+	// Start worker goroutines
+	for range maxConcurrency {
+		wg.Add(1)
+		go runTask()
+	}
+
+	// Add tasks to the task channel
+	for _, fn := range tasks {
+		taskChan <- fn
+	}
+
+	// Close the task channel to signal workers to stop when all tasks are done
+	close(taskChan)
+
+	// Wait for all workers to complete
+	wg.Wait()
+	close(resultsChan)
+
+	// Collect the results and cancel on error
+	results := make([]Result, 0, len(tasks))
+	for r := range resultsChan {
+		if r.Err != nil {
+			cancelCtx()
+
+			return nil, r.Err
+		}
+
+		results = append(results, r)
+	}
+
+	return results, nil
+}
diff --git a/api/concurrent/concurrent_test.go b/api/concurrent/concurrent_test.go
new file mode 100644
index 0000000..5809e3a
--- /dev/null
+++ b/api/concurrent/concurrent_test.go
@@ -0,0 +1,149 @@
+package concurrent
+
+import (
+	"context"
+	"errors"
+	"sync/atomic"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestRun_AllSucceed(t *testing.T) {
+	t.Parallel()
+
+	fn1 := func(ctx context.Context) (any, error) { return "one", nil }
+	fn2 := func(ctx context.Context) (any, error) { return "two", nil }
+	fn3 := func(ctx context.Context) (any, error) { return "three", nil }
+
+	results, err := Run(t.Context(), 0, fn1, fn2, fn3)
+
+	require.NoError(t, err)
+	require.Len(t, results, 3)
+
+	values := make([]string, 0, len(results))
+	for _, r := range results {
+		values = append(values, r.Result.(string))
+	}
+	require.ElementsMatch(t, []string{"one", "two", "three"}, values)
+}
+
+func TestRun_OneError(t *testing.T) {
+	t.Parallel()
+
+	sentinel := errors.New("task failed")
+
+	fn1 := func(ctx context.Context) (any, error) { return "ok", nil }
+	fn2 := func(ctx context.Context) (any, error) { return nil, sentinel }
+
+	_, err := Run(t.Context(), 0, fn1, fn2)
+
+	require.ErrorIs(t, err, sentinel)
+}
+
+func TestRun_NoTasks(t *testing.T) {
+	t.Parallel()
+
+	results, err := Run(t.Context(), 0)
+
+	require.NoError(t, err)
+	require.Empty(t, results)
+}
+
+func TestRun_MaxConcurrency(t *testing.T) {
+	t.Parallel()
+
+	const numTasks = 10
+	var peak atomic.Int32
+	var active atomic.Int32
+
+	task := func(ctx context.Context) (any, error) {
+		current := active.Add(1)
+		if current > peak.Load() {
+			peak.Store(current)
+		}
+
+		time.Sleep(10 * time.Millisecond)
+		active.Add(-1)
+
+		return nil, nil
+	}
+
+	tasks := make([]Func, numTasks)
+	for i := range tasks {
+		tasks[i] = task
+	}
+
+	synctest.Test(t, func(t *testing.T) {
+		results, err := Run(t.Context(), 3, tasks...)
+		require.NoError(t, err)
+		require.Len(t, results, numTasks)
+		require.LessOrEqual(t, peak.Load(), int32(3))
+	})
+}
+
+func TestRun_ZeroConcurrencyUsesAllTasks(t *testing.T) {
+	t.Parallel()
+
+	const numTasks = 5
+	var peak atomic.Int32
+	var active atomic.Int32
+
+	task := func(ctx context.Context) (any, error) {
+		current := active.Add(1)
+		if current > peak.Load() {
+			peak.Store(current)
+		}
+
+		time.Sleep(20 * time.Millisecond)
+		active.Add(-1)
+
+		return nil, nil
+	}
+
+	tasks := make([]Func, numTasks)
+	for i := range tasks {
+		tasks[i] = task
+	}
+
+	synctest.Test(t, func(t *testing.T) {
+		results, err := Run(t.Context(), 0, tasks...)
+		require.NoError(t, err)
+		require.Len(t, results, numTasks)
+		require.Equal(t, int32(numTasks), peak.Load())
+	})
+}
+
+func TestRun_ContextCancelledBeforeStart(t *testing.T) {
+	t.Parallel()
+
+	ctx, cancel := context.WithCancel(t.Context())
+	cancel()
+
+	called := atomic.Bool{}
+	fn := func(ctx context.Context) (any, error) {
+		called.Store(true)
+		return nil, ctx.Err()
+	}
+
+	_, err := Run(ctx, 1, fn, fn, fn)
+	require.Error(t, err)
+}
+
+func TestRun_ContextPassedToTasks(t *testing.T) {
+	t.Parallel()
+
+	type key struct{}
+	ctx := context.WithValue(t.Context(), key{}, "testvalue")
+
+	fn := func(ctx context.Context) (any, error) {
+		return ctx.Value(key{}), nil
+	}
+
+	results, err := Run(ctx, 0, fn)
+
+	require.NoError(t, err)
+	require.Equal(t, "testvalue", results[0].Result)
+}
diff --git a/api/connection.go b/api/connection.go
new file mode 100644
index 0000000..7a31e26
--- /dev/null
+++ b/api/connection.go
@@ -0,0 +1,56 @@
+package portainer
+
+import (
+	"io"
+)
+
+type ReadTransaction interface {
+	GetObject(bucketName string, key []byte, object any) error
+	GetRawBytes(bucketName string, key []byte) ([]byte, error)
+	GetAll(bucketName string, obj any, append func(o any) (any, error)) error
+	GetAllWithKeyPrefix(bucketName string, keyPrefix []byte, obj any, append func(o any) (any, error)) error
+	KeyExists(bucketName string, key []byte) (bool, error)
+}
+
+type Transaction interface {
+	ReadTransaction
+
+	SetServiceName(bucketName string) error
+	UpdateObject(bucketName string, key []byte, object any) error
+	DeleteObject(bucketName string, key []byte) error
+	CreateObject(bucketName string, fn func(uint64) (int, any)) error
+	CreateObjectWithId(bucketName string, id int, obj any) error
+	CreateObjectWithStringId(bucketName string, id []byte, obj any) error
+	DeleteAllObjects(bucketName string, obj any, matching func(o any) (id int, ok bool)) error
+	GetNextIdentifier(bucketName string) int
+}
+
+type Connection interface {
+	Transaction
+
+	Open() error
+	Close() error
+
+	UpdateTx(fn func(Transaction) error) error
+	ViewTx(fn func(Transaction) error) error
+
+	// write the db contents to filename as json (the schema needs defining)
+	ExportRaw(filename string) error
+
+	// TODO: this one is very database specific atm
+	BackupTo(w io.Writer) error
+	GetDatabaseFileName() string
+	GetDatabaseFilePath() string
+	GetStorePath() string
+	GetDatabaseFileSize() (int64, error)
+
+	IsEncryptedStore() bool
+	NeedsEncryptionMigration() (bool, error)
+	SetEncrypted(encrypted bool) error
+
+	BackupMetadata() (map[string]any, error)
+	RestoreMetadata(s map[string]any) error
+
+	UpdateObjectFunc(bucketName string, key []byte, object any, updateFn func()) error
+	ConvertToKey(v int) []byte
+}
diff --git a/api/crypto/aes.go b/api/crypto/aes.go
new file mode 100644
index 0000000..d20e716
--- /dev/null
+++ b/api/crypto/aes.go
@@ -0,0 +1,410 @@
+package crypto
+
+import (
+	"bufio"
+	"bytes"
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/pbkdf2"
+	"crypto/rand"
+	"crypto/sha256"
+	"errors"
+	"fmt"
+	"io"
+	"strings"
+
+	"github.com/portainer/portainer/pkg/fips"
+
+	// Not allowed in FIPS mode
+	"golang.org/x/crypto/argon2" //nolint:depguard
+	"golang.org/x/crypto/scrypt" //nolint:depguard
+)
+
+const (
+	// AES GCM settings
+	aesGcmHeader    = "AES256-GCM" // The encrypted file header
+	aesGcmBlockSize = 1024 * 1024  // 1MB block for aes gcm
+
+	aesGcmFIPSHeader    = "FIPS-AES256-GCM"
+	aesGcmFIPSBlockSize = 16 * 1024 * 1024 // 16MB block for aes gcm
+
+	// Argon2 settings
+	// Recommended settings lower memory hardware according to current OWASP recommendations
+	// Considering some people run portainer on a NAS I think it's prudent not to assume we're on server grade hardware
+	// https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#argon2id
+	argon2MemoryCost = 12 * 1024
+	argon2TimeCost   = 3
+	argon2Threads    = 1
+	argon2KeyLength  = 32
+
+	pbkdf2Iterations = 600_000 // use recommended iterations from https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2 a little overkill for this use
+	pbkdf2SaltLength = 32
+)
+
+// AesEncrypt reads from input, encrypts with AES-256 and writes to output. passphrase is used to generate an encryption key
+func AesEncrypt(input io.Reader, output io.Writer, passphrase []byte) error {
+	if fips.FIPSMode() {
+		if err := aesEncryptGCMFIPS(input, output, passphrase); err != nil {
+			return fmt.Errorf("error encrypting file: %w", err)
+		}
+	} else {
+		if err := aesEncryptGCM(input, output, passphrase); err != nil {
+			return fmt.Errorf("error encrypting file: %w", err)
+		}
+	}
+
+	return nil
+}
+
+// AesDecrypt reads from input, decrypts with AES-256 and returns the reader to read the decrypted content from
+func AesDecrypt(input io.Reader, passphrase []byte) (io.Reader, error) {
+	return aesDecrypt(input, passphrase, fips.FIPSMode())
+}
+
+func aesDecrypt(input io.Reader, passphrase []byte, fipsMode bool) (io.Reader, error) {
+	// Read file header to determine how it was encrypted
+	inputReader := bufio.NewReader(input)
+	header, err := inputReader.Peek(len(aesGcmFIPSHeader))
+	if err != nil {
+		return nil, fmt.Errorf("error reading encrypted backup file header: %w", err)
+	}
+
+	if strings.HasPrefix(string(header), aesGcmFIPSHeader) {
+		if !fipsMode {
+			return nil, errors.New("fips encrypted file detected but fips mode is not enabled")
+		}
+
+		reader, err := aesDecryptGCMFIPS(inputReader, passphrase)
+		if err != nil {
+			return nil, fmt.Errorf("error decrypting file: %w", err)
+		}
+
+		return reader, nil
+	}
+
+	if strings.HasPrefix(string(header), aesGcmHeader) {
+		if fipsMode {
+			return nil, errors.New("fips mode is enabled but non-fips encrypted file detected")
+		}
+
+		reader, err := aesDecryptGCM(inputReader, passphrase)
+		if err != nil {
+			return nil, fmt.Errorf("error decrypting file: %w", err)
+		}
+
+		return reader, nil
+	}
+
+	// Use the previous decryption routine which has no header (to support older archives)
+	reader, err := aesDecryptOFB(inputReader, passphrase)
+	if err != nil {
+		return nil, fmt.Errorf("error decrypting legacy file backup: %w", err)
+	}
+
+	return reader, nil
+}
+
+// aesEncryptGCM reads from input, encrypts with AES-256 and writes to output. passphrase is used to generate an encryption key.
+func aesEncryptGCM(input io.Reader, output io.Writer, passphrase []byte) error {
+	// Derive key using argon2 with a random salt
+	salt := make([]byte, 16) // 16 bytes salt
+	if _, err := io.ReadFull(rand.Reader, salt); err != nil {
+		return err
+	}
+
+	key := argon2.IDKey(passphrase, salt, argon2TimeCost, argon2MemoryCost, argon2Threads, 32)
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return err
+	}
+
+	aesgcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return err
+	}
+
+	// Generate nonce
+	nonce, err := NewRandomNonce(aesgcm.NonceSize())
+	if err != nil {
+		return err
+	}
+
+	// write the header
+	if _, err := output.Write([]byte(aesGcmHeader)); err != nil {
+		return err
+	}
+
+	// Write nonce and salt to the output file
+	if _, err := output.Write(salt); err != nil {
+		return err
+	}
+	if _, err := output.Write(nonce.Value()); err != nil {
+		return err
+	}
+
+	// Buffer for reading plaintext blocks
+	buf := make([]byte, aesGcmBlockSize) // Adjust buffer size as needed
+	ciphertext := make([]byte, len(buf)+aesgcm.Overhead())
+
+	// Encrypt plaintext in blocks
+	for {
+		n, err := io.ReadFull(input, buf)
+		if n == 0 {
+			break // end of plaintext input
+		}
+
+		if err != nil && !errors.Is(err, io.EOF) && !errors.Is(err, io.ErrUnexpectedEOF) {
+			return err
+		}
+
+		// Seal encrypts the plaintext using the nonce returning the updated slice.
+		ciphertext = aesgcm.Seal(ciphertext[:0], nonce.Value(), buf[:n], nil)
+
+		if _, err := output.Write(ciphertext); err != nil {
+			return err
+		}
+
+		if err := nonce.Increment(); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// aesDecryptGCM reads from input, decrypts with AES-256 and returns the reader to read the decrypted content from.
+func aesDecryptGCM(input io.Reader, passphrase []byte) (io.Reader, error) {
+	// Reader & verify header
+	header := make([]byte, len(aesGcmHeader))
+	if _, err := io.ReadFull(input, header); err != nil {
+		return nil, err
+	}
+
+	if string(header) != aesGcmHeader {
+		return nil, errors.New("invalid header")
+	}
+
+	// Read salt
+	salt := make([]byte, 16) // Salt size
+	if _, err := io.ReadFull(input, salt); err != nil {
+		return nil, err
+	}
+
+	key := argon2.IDKey(passphrase, salt, argon2TimeCost, argon2MemoryCost, argon2Threads, 32)
+
+	// Initialize AES cipher block
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, err
+	}
+
+	// Create GCM mode with the cipher block
+	aesgcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return nil, err
+	}
+
+	// Read nonce from the input reader
+	nonce := NewNonce(aesgcm.NonceSize())
+	if err := nonce.Read(input); err != nil {
+		return nil, err
+	}
+
+	// Initialize a buffer to store decrypted data
+	buf := bytes.Buffer{}
+	plaintext := make([]byte, aesGcmBlockSize)
+
+	// Decrypt the ciphertext in blocks
+	for {
+		// Read a block of ciphertext from the input reader
+		ciphertextBlock := make([]byte, aesGcmBlockSize+aesgcm.Overhead()) // Adjust block size as needed
+		n, err := io.ReadFull(input, ciphertextBlock)
+		if n == 0 {
+			break // end of ciphertext
+		}
+
+		if err != nil && !errors.Is(err, io.EOF) && !errors.Is(err, io.ErrUnexpectedEOF) {
+			return nil, err
+		}
+
+		// Decrypt the block of ciphertext
+		plaintext, err = aesgcm.Open(plaintext[:0], nonce.Value(), ciphertextBlock[:n], nil)
+		if err != nil {
+			return nil, err
+		}
+
+		if _, err := buf.Write(plaintext); err != nil {
+			return nil, err
+		}
+
+		if err := nonce.Increment(); err != nil {
+			return nil, err
+		}
+	}
+
+	return &buf, nil
+}
+
+// aesEncryptGCMFIPS reads from input, encrypts with AES-256 in a fips compliant
+// way and writes to output. passphrase is used to generate an encryption key.
+func aesEncryptGCMFIPS(input io.Reader, output io.Writer, passphrase []byte) error {
+	salt := make([]byte, pbkdf2SaltLength)
+	if _, err := io.ReadFull(rand.Reader, salt); err != nil {
+		return err
+	}
+
+	key, err := pbkdf2.Key(sha256.New, string(passphrase), salt, pbkdf2Iterations, 32)
+	if err != nil {
+		return fmt.Errorf("error deriving key: %w", err)
+	}
+
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return err
+	}
+
+	// write the header
+	if _, err := output.Write([]byte(aesGcmFIPSHeader)); err != nil {
+		return err
+	}
+
+	// Write nonce and salt to the output file
+	if _, err := output.Write(salt); err != nil {
+		return err
+	}
+
+	// Buffer for reading plaintext blocks
+	buf := make([]byte, aesGcmFIPSBlockSize)
+
+	// Encrypt plaintext in blocks
+	for {
+		// new random nonce for each block
+		aesgcm, err := cipher.NewGCMWithRandomNonce(block)
+		if err != nil {
+			return fmt.Errorf("error creating gcm: %w", err)
+		}
+
+		n, err := io.ReadFull(input, buf)
+		if n == 0 {
+			break // end of plaintext input
+		}
+
+		if err != nil && !errors.Is(err, io.EOF) && !errors.Is(err, io.ErrUnexpectedEOF) {
+			return err
+		}
+
+		// Seal encrypts the plaintext
+		ciphertext := aesgcm.Seal(nil, nil, buf[:n], nil)
+
+		if _, err := output.Write(ciphertext); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// aesDecryptGCMFIPS reads from input, decrypts with AES-256 in a fips compliant
+// way and returns the reader to read the decrypted content from.
+func aesDecryptGCMFIPS(input io.Reader, passphrase []byte) (io.Reader, error) {
+	// Reader & verify header
+	header := make([]byte, len(aesGcmFIPSHeader))
+	if _, err := io.ReadFull(input, header); err != nil {
+		return nil, err
+	}
+
+	if string(header) != aesGcmFIPSHeader {
+		return nil, errors.New("invalid header")
+	}
+
+	// Read salt
+	salt := make([]byte, pbkdf2SaltLength)
+	if _, err := io.ReadFull(input, salt); err != nil {
+		return nil, err
+	}
+
+	key, err := pbkdf2.Key(sha256.New, string(passphrase), salt, pbkdf2Iterations, 32)
+	if err != nil {
+		return nil, fmt.Errorf("error deriving key: %w", err)
+	}
+
+	// Initialize AES cipher block
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, err
+	}
+
+	// Initialize a buffer to store decrypted data
+	buf := bytes.Buffer{}
+
+	// Decrypt the ciphertext in blocks
+	for {
+		// Create GCM mode with the cipher block
+		aesgcm, err := cipher.NewGCMWithRandomNonce(block)
+		if err != nil {
+			return nil, err
+		}
+
+		// Read a block of ciphertext from the input reader
+		ciphertextBlock := make([]byte, aesGcmFIPSBlockSize+aesgcm.Overhead())
+		n, err := io.ReadFull(input, ciphertextBlock)
+		if n == 0 {
+			break // end of ciphertext
+		}
+
+		if err != nil && !errors.Is(err, io.EOF) && !errors.Is(err, io.ErrUnexpectedEOF) {
+			return nil, err
+		}
+
+		// Decrypt the block of ciphertext
+		plaintext, err := aesgcm.Open(nil, nil, ciphertextBlock[:n], nil)
+		if err != nil {
+			return nil, err
+		}
+
+		if _, err := buf.Write(plaintext); err != nil {
+			return nil, err
+		}
+	}
+
+	return &buf, nil
+}
+
+// aesDecryptOFB reads from input, decrypts with AES-256 and returns the reader to a read decrypted content from.
+// passphrase is used to generate an encryption key.
+// note: This function used to decrypt files that were encrypted without a header i.e. old archives
+func aesDecryptOFB(input io.Reader, passphrase []byte) (io.Reader, error) {
+	// making a 32 bytes key that would correspond to AES-256
+	// don't necessarily need a salt, so just kept in empty
+	key, err := scrypt.Key(passphrase, nil, 32768, 8, 1, 32)
+	if err != nil {
+		return nil, err
+	}
+
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, err
+	}
+
+	// If the key is unique for each ciphertext, then it's ok to use a zero IV.
+	var iv [aes.BlockSize]byte
+	stream := cipher.NewOFB(block, iv[:])
+	reader := &cipher.StreamReader{S: stream, R: input}
+
+	return reader, nil
+}
+
+// HasEncryptedHeader checks if the data has an encrypted header, note that fips
+// mode changes this behavior and so will only recognize data encrypted by the
+// same mode (fips enabled or disabled)
+func HasEncryptedHeader(data []byte) bool {
+	return hasEncryptedHeader(data, fips.FIPSMode())
+}
+
+func hasEncryptedHeader(data []byte, fipsMode bool) bool {
+	if fipsMode {
+		return bytes.HasPrefix(data, []byte(aesGcmFIPSHeader))
+	}
+
+	return bytes.HasPrefix(data, []byte(aesGcmHeader))
+}
diff --git a/api/crypto/aes_test.go b/api/crypto/aes_test.go
new file mode 100644
index 0000000..dbff93e
--- /dev/null
+++ b/api/crypto/aes_test.go
@@ -0,0 +1,449 @@
+package crypto
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"io"
+	"math/rand"
+	"os"
+	"testing"
+
+	"github.com/portainer/portainer/api/filesystem"
+	"github.com/portainer/portainer/api/logs"
+	"github.com/portainer/portainer/pkg/fips"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/crypto/scrypt"
+)
+
+func init() {
+	fips.InitFIPS(false)
+}
+
+const letterBytes = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
+
+func randBytes(n int) []byte {
+	b := make([]byte, n)
+	for i := range b {
+		b[i] = letterBytes[rand.Intn(len(letterBytes))]
+	}
+
+	return b
+}
+
+type encryptFunc func(input io.Reader, output io.Writer, passphrase []byte) error
+type decryptFunc func(input io.Reader, passphrase []byte) (io.Reader, error)
+
+func Test_encryptAndDecrypt_withTheSamePassword(t *testing.T) {
+	const passphrase = "passphrase"
+
+	testFunc := func(t *testing.T, encrypt encryptFunc, decrypt decryptFunc, decryptShouldSucceed bool) {
+		tmpdir := t.TempDir()
+
+		var (
+			originFilePath    = filesystem.JoinPaths(tmpdir, "origin")
+			encryptedFilePath = filesystem.JoinPaths(tmpdir, "encrypted")
+			decryptedFilePath = filesystem.JoinPaths(tmpdir, "decrypted")
+		)
+
+		content := randBytes(1024*1024*100 + 523)
+		err := os.WriteFile(originFilePath, content, 0600)
+		require.NoError(t, err)
+
+		originFile, _ := os.Open(originFilePath)
+		defer logs.CloseAndLogErr(originFile)
+
+		encryptedFileWriter, _ := os.Create(encryptedFilePath)
+
+		err = encrypt(originFile, encryptedFileWriter, []byte(passphrase))
+		require.NoError(t, err, "Failed to encrypt a file")
+		logs.CloseAndLogErr(encryptedFileWriter)
+
+		encryptedContent, err := os.ReadFile(encryptedFilePath)
+		require.NoError(t, err, "Couldn't read encrypted file")
+		assert.NotEqual(t, encryptedContent, content, "Content wasn't encrypted")
+
+		encryptedFileReader, err := os.Open(encryptedFilePath)
+		require.NoError(t, err)
+		defer logs.CloseAndLogErr(encryptedFileReader)
+
+		decryptedFileWriter, err := os.Create(decryptedFilePath)
+		require.NoError(t, err)
+		defer logs.CloseAndLogErr(decryptedFileWriter)
+
+		decryptedReader, err := decrypt(encryptedFileReader, []byte(passphrase))
+		if !decryptShouldSucceed {
+			require.Error(t, err, "Failed to decrypt file as indicated by decryptShouldSucceed")
+		} else {
+			require.NoError(t, err, "Failed to decrypt file indicated by decryptShouldSucceed")
+
+			_, err = io.Copy(decryptedFileWriter, decryptedReader)
+			require.NoError(t, err)
+
+			decryptedContent, err := os.ReadFile(decryptedFilePath)
+			require.NoError(t, err)
+			assert.Equal(t, content, decryptedContent, "Original and decrypted content should match")
+		}
+	}
+
+	t.Run("fips", func(t *testing.T) {
+		testFunc(t, aesEncryptGCMFIPS, aesDecryptGCMFIPS, true)
+	})
+
+	t.Run("non_fips", func(t *testing.T) {
+		testFunc(t, aesEncryptGCM, aesDecryptGCM, true)
+	})
+
+	t.Run("system_fips_mode_public_entry_points", func(t *testing.T) {
+		// use the init mode, public entry points
+		testFunc(t, AesEncrypt, AesDecrypt, true)
+	})
+
+	t.Run("fips_encrypted_file_header_fails_in_non_fips_mode", func(t *testing.T) {
+		// use aesDecrypt which checks the header, confirm that it fails
+		decrypt := func(input io.Reader, passphrase []byte) (io.Reader, error) {
+			return aesDecrypt(input, passphrase, false)
+		}
+
+		testFunc(t, aesEncryptGCMFIPS, decrypt, false)
+	})
+
+	t.Run("non_fips_encrypted_file_header_fails_in_fips_mode", func(t *testing.T) {
+		// use aesDecrypt which checks the header, confirm that it fails
+		decrypt := func(input io.Reader, passphrase []byte) (io.Reader, error) {
+			return aesDecrypt(input, passphrase, true)
+		}
+
+		testFunc(t, aesEncryptGCM, decrypt, false)
+	})
+
+	t.Run("fips_encrypted_file_fails_in_non_fips_mode", func(t *testing.T) {
+		testFunc(t, aesEncryptGCMFIPS, aesDecryptGCM, false)
+	})
+
+	t.Run("non_fips_encrypted_file_with_fips_mode_should_fail", func(t *testing.T) {
+		testFunc(t, aesEncryptGCM, aesDecryptGCMFIPS, false)
+	})
+
+	t.Run("fips_with_base_aesDecrypt", func(t *testing.T) {
+		// maximize coverage, use the base aesDecrypt function with valid fips mode
+		decrypt := func(input io.Reader, passphrase []byte) (io.Reader, error) {
+			return aesDecrypt(input, passphrase, true)
+		}
+
+		testFunc(t, aesEncryptGCMFIPS, decrypt, true)
+	})
+
+	t.Run("legacy", func(t *testing.T) {
+		testFunc(t, legacyAesEncrypt, aesDecryptOFB, true)
+	})
+}
+
+func Test_encryptAndDecrypt_withStrongPassphrase(t *testing.T) {
+	t.Parallel()
+	const passphrase = "A strong passphrase with special characters: !@#$%^&*()_+"
+
+	testFunc := func(t *testing.T, encrypt encryptFunc, decrypt decryptFunc) {
+		tmpdir := t.TempDir()
+
+		var (
+			originFilePath    = filesystem.JoinPaths(tmpdir, "origin2")
+			encryptedFilePath = filesystem.JoinPaths(tmpdir, "encrypted2")
+			decryptedFilePath = filesystem.JoinPaths(tmpdir, "decrypted2")
+		)
+
+		content := randBytes(500)
+
+		err := os.WriteFile(originFilePath, content, 0600)
+		require.NoError(t, err)
+
+		originFile, err := os.Open(originFilePath)
+		require.NoError(t, err)
+		defer logs.CloseAndLogErr(originFile)
+
+		encryptedFileWriter, _ := os.Create(encryptedFilePath)
+
+		err = encrypt(originFile, encryptedFileWriter, []byte(passphrase))
+		require.NoError(t, err, "Failed to encrypt a file")
+		logs.CloseAndLogErr(encryptedFileWriter)
+
+		encryptedContent, err := os.ReadFile(encryptedFilePath)
+		require.NoError(t, err, "Couldn't read encrypted file")
+		assert.NotEqual(t, encryptedContent, content, "Content wasn't encrypted")
+
+		encryptedFileReader, err := os.Open(encryptedFilePath)
+		require.NoError(t, err)
+		defer logs.CloseAndLogErr(encryptedFileReader)
+
+		decryptedFileWriter, err := os.Create(decryptedFilePath)
+		require.NoError(t, err)
+		defer logs.CloseAndLogErr(decryptedFileWriter)
+
+		decryptedReader, err := decrypt(encryptedFileReader, []byte(passphrase))
+		require.NoError(t, err, "Failed to decrypt file")
+
+		_, err = io.Copy(decryptedFileWriter, decryptedReader)
+		require.NoError(t, err)
+
+		decryptedContent, err := os.ReadFile(decryptedFilePath)
+		require.NoError(t, err)
+		assert.Equal(t, content, decryptedContent, "Original and decrypted content should match")
+	}
+
+	t.Run("fips", func(t *testing.T) {
+		testFunc(t, aesEncryptGCMFIPS, aesDecryptGCMFIPS)
+	})
+
+	t.Run("non_fips", func(t *testing.T) {
+		testFunc(t, aesEncryptGCM, aesDecryptGCM)
+	})
+}
+
+func Test_encryptAndDecrypt_withTheSamePasswordSmallFile(t *testing.T) {
+	t.Parallel()
+	testFunc := func(t *testing.T, encrypt encryptFunc, decrypt decryptFunc) {
+		tmpdir := t.TempDir()
+
+		var (
+			originFilePath    = filesystem.JoinPaths(tmpdir, "origin2")
+			encryptedFilePath = filesystem.JoinPaths(tmpdir, "encrypted2")
+			decryptedFilePath = filesystem.JoinPaths(tmpdir, "decrypted2")
+		)
+
+		content := randBytes(500)
+		err := os.WriteFile(originFilePath, content, 0600)
+		require.NoError(t, err)
+
+		originFile, err := os.Open(originFilePath)
+		require.NoError(t, err)
+		defer logs.CloseAndLogErr(originFile)
+
+		encryptedFileWriter, err := os.Create(encryptedFilePath)
+		require.NoError(t, err)
+
+		err = encrypt(originFile, encryptedFileWriter, []byte("passphrase"))
+		require.NoError(t, err, "Failed to encrypt a file")
+		logs.CloseAndLogErr(encryptedFileWriter)
+
+		encryptedContent, err := os.ReadFile(encryptedFilePath)
+		require.NoError(t, err, "Couldn't read encrypted file")
+		assert.NotEqual(t, encryptedContent, content, "Content wasn't encrypted")
+
+		encryptedFileReader, err := os.Open(encryptedFilePath)
+		require.NoError(t, err)
+		defer logs.CloseAndLogErr(encryptedFileReader)
+
+		decryptedFileWriter, err := os.Create(decryptedFilePath)
+		require.NoError(t, err)
+		defer logs.CloseAndLogErr(decryptedFileWriter)
+
+		decryptedReader, err := decrypt(encryptedFileReader, []byte("passphrase"))
+		require.NoError(t, err, "Failed to decrypt file")
+
+		_, err = io.Copy(decryptedFileWriter, decryptedReader)
+		require.NoError(t, err)
+
+		decryptedContent, err := os.ReadFile(decryptedFilePath)
+		require.NoError(t, err)
+		assert.Equal(t, content, decryptedContent, "Original and decrypted content should match")
+	}
+
+	t.Run("fips", func(t *testing.T) {
+		testFunc(t, aesEncryptGCMFIPS, aesDecryptGCMFIPS)
+	})
+
+	t.Run("non_fips", func(t *testing.T) {
+		testFunc(t, aesEncryptGCM, aesDecryptGCM)
+	})
+}
+
+func Test_encryptAndDecrypt_withEmptyPassword(t *testing.T) {
+	t.Parallel()
+	testFunc := func(t *testing.T, encrypt encryptFunc, decrypt decryptFunc) {
+		tmpdir := t.TempDir()
+
+		var (
+			originFilePath    = filesystem.JoinPaths(tmpdir, "origin")
+			encryptedFilePath = filesystem.JoinPaths(tmpdir, "encrypted")
+			decryptedFilePath = filesystem.JoinPaths(tmpdir, "decrypted")
+		)
+
+		content := randBytes(1024 * 50)
+		err := os.WriteFile(originFilePath, content, 0600)
+		require.NoError(t, err)
+
+		originFile, err := os.Open(originFilePath)
+		require.NoError(t, err)
+		defer logs.CloseAndLogErr(originFile)
+
+		encryptedFileWriter, err := os.Create(encryptedFilePath)
+		require.NoError(t, err)
+		defer logs.CloseAndLogErr(encryptedFileWriter)
+
+		err = encrypt(originFile, encryptedFileWriter, []byte(""))
+		require.NoError(t, err, "Failed to encrypt a file")
+
+		encryptedContent, err := os.ReadFile(encryptedFilePath)
+		require.NoError(t, err, "Couldn't read encrypted file")
+		assert.NotEqual(t, encryptedContent, content, "Content wasn't encrypted")
+
+		encryptedFileReader, err := os.Open(encryptedFilePath)
+		require.NoError(t, err)
+		defer logs.CloseAndLogErr(encryptedFileReader)
+
+		decryptedFileWriter, err := os.Create(decryptedFilePath)
+		require.NoError(t, err)
+		defer logs.CloseAndLogErr(decryptedFileWriter)
+
+		decryptedReader, err := decrypt(encryptedFileReader, []byte(""))
+		require.NoError(t, err, "Failed to decrypt file")
+
+		_, err = io.Copy(decryptedFileWriter, decryptedReader)
+		require.NoError(t, err)
+
+		decryptedContent, err := os.ReadFile(decryptedFilePath)
+		require.NoError(t, err)
+		assert.Equal(t, content, decryptedContent, "Original and decrypted content should match")
+	}
+
+	t.Run("fips", func(t *testing.T) {
+		testFunc(t, aesEncryptGCMFIPS, aesDecryptGCMFIPS)
+	})
+
+	t.Run("non_fips", func(t *testing.T) {
+		testFunc(t, aesEncryptGCM, aesDecryptGCM)
+	})
+}
+
+func Test_decryptWithDifferentPassphrase_shouldProduceWrongResult(t *testing.T) {
+	t.Parallel()
+	testFunc := func(t *testing.T, encrypt encryptFunc, decrypt decryptFunc) {
+		tmpdir := t.TempDir()
+
+		var (
+			originFilePath    = filesystem.JoinPaths(tmpdir, "origin")
+			encryptedFilePath = filesystem.JoinPaths(tmpdir, "encrypted")
+			decryptedFilePath = filesystem.JoinPaths(tmpdir, "decrypted")
+		)
+
+		content := randBytes(1034)
+		err := os.WriteFile(originFilePath, content, 0600)
+		require.NoError(t, err)
+
+		originFile, err := os.Open(originFilePath)
+		require.NoError(t, err)
+		defer logs.CloseAndLogErr(originFile)
+
+		encryptedFileWriter, err := os.Create(encryptedFilePath)
+		require.NoError(t, err)
+		defer logs.CloseAndLogErr(encryptedFileWriter)
+
+		err = encrypt(originFile, encryptedFileWriter, []byte("passphrase"))
+		require.NoError(t, err, "Failed to encrypt a file")
+		encryptedContent, err := os.ReadFile(encryptedFilePath)
+		require.NoError(t, err, "Couldn't read encrypted file")
+		assert.NotEqual(t, encryptedContent, content, "Content wasn't encrypted")
+
+		encryptedFileReader, err := os.Open(encryptedFilePath)
+		require.NoError(t, err)
+		defer logs.CloseAndLogErr(encryptedFileReader)
+
+		decryptedFileWriter, err := os.Create(decryptedFilePath)
+		require.NoError(t, err)
+		defer logs.CloseAndLogErr(decryptedFileWriter)
+
+		_, err = decrypt(encryptedFileReader, []byte("garbage"))
+		require.Error(t, err, "Should not allow decrypt with wrong passphrase")
+	}
+
+	t.Run("fips", func(t *testing.T) {
+		testFunc(t, aesEncryptGCMFIPS, aesDecryptGCMFIPS)
+	})
+
+	t.Run("non_fips", func(t *testing.T) {
+		testFunc(t, aesEncryptGCM, aesDecryptGCM)
+	})
+}
+
+func legacyAesEncrypt(input io.Reader, output io.Writer, passphrase []byte) error {
+	key, err := scrypt.Key(passphrase, nil, 32768, 8, 1, 32)
+	if err != nil {
+		return err
+	}
+
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return err
+	}
+
+	var iv [aes.BlockSize]byte
+	stream := cipher.NewOFB(block, iv[:])
+
+	writer := &cipher.StreamWriter{S: stream, W: output}
+	if _, err := io.Copy(writer, input); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func Test_hasEncryptedHeader(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name     string
+		data     []byte
+		fipsMode bool
+		want     bool
+	}{
+		{
+			name:     "non-FIPS mode with valid header",
+			data:     []byte("AES256-GCM" + "some encrypted data"),
+			fipsMode: false,
+			want:     true,
+		},
+		{
+			name:     "non-FIPS mode with FIPS header",
+			data:     []byte("FIPS-AES256-GCM" + "some encrypted data"),
+			fipsMode: false,
+			want:     false,
+		},
+		{
+			name:     "FIPS mode with valid header",
+			data:     []byte("FIPS-AES256-GCM" + "some encrypted data"),
+			fipsMode: true,
+			want:     true,
+		},
+		{
+			name:     "FIPS mode with non-FIPS header",
+			data:     []byte("AES256-GCM" + "some encrypted data"),
+			fipsMode: true,
+			want:     false,
+		},
+		{
+			name:     "invalid header",
+			data:     []byte("INVALID-HEADER" + "some data"),
+			fipsMode: false,
+			want:     false,
+		},
+		{
+			name:     "empty data",
+			data:     []byte{},
+			fipsMode: false,
+			want:     false,
+		},
+		{
+			name:     "nil data",
+			data:     nil,
+			fipsMode: false,
+			want:     false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := hasEncryptedHeader(tt.data, tt.fipsMode)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
diff --git a/api/crypto/ecdsa.go b/api/crypto/ecdsa.go
new file mode 100644
index 0000000..e7eabdd
--- /dev/null
+++ b/api/crypto/ecdsa.go
@@ -0,0 +1,135 @@
+package crypto
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/hex"
+
+	"github.com/portainer/portainer/pkg/libcrypto"
+)
+
+const (
+	// PrivateKeyPemHeader represents the header that is appended to the PEM file when
+	// storing the private key.
+	PrivateKeyPemHeader = "EC PRIVATE KEY"
+	// PublicKeyPemHeader represents the header that is appended to the PEM file when
+	// storing the public key.
+	PublicKeyPemHeader = "ECDSA PUBLIC KEY"
+)
+
+// ECDSAService is a service used to create digital signatures when communicating with
+// an agent based environment(endpoint). It will automatically generates a key pair using ECDSA or
+// can also reuse an existing ECDSA key pair.
+type ECDSAService struct {
+	privateKey    *ecdsa.PrivateKey
+	publicKey     *ecdsa.PublicKey
+	encodedPubKey string
+	secret        string
+}
+
+// NewECDSAService returns a pointer to a ECDSAService.
+// An optional secret can be specified
+func NewECDSAService(secret string) *ECDSAService {
+	return &ECDSAService{
+		secret: secret,
+	}
+}
+
+// EncodedPublicKey returns the encoded version of the public that can be used
+// to be shared with other services. It's the hexadecimal encoding of the public key
+// content.
+func (service *ECDSAService) EncodedPublicKey() string {
+	return service.encodedPubKey
+}
+
+// PEMHeaders returns the ECDSA PEM headers.
+func (service *ECDSAService) PEMHeaders() (string, string) {
+	return PrivateKeyPemHeader, PublicKeyPemHeader
+}
+
+// ParseKeyPair parses existing private/public key pair content and associate
+// the parsed keys to the service.
+func (service *ECDSAService) ParseKeyPair(private, public []byte) error {
+	privateKey, err := x509.ParseECPrivateKey(private)
+	if err != nil {
+		return err
+	}
+
+	service.privateKey = privateKey
+
+	encodedKey := hex.EncodeToString(public)
+	service.encodedPubKey = encodedKey
+
+	publicKey, err := x509.ParsePKIXPublicKey(public)
+	if err != nil {
+		return err
+	}
+
+	service.publicKey = publicKey.(*ecdsa.PublicKey)
+
+	return nil
+}
+
+// GenerateKeyPair will create a new key pair using ECDSA.
+func (service *ECDSAService) GenerateKeyPair() ([]byte, []byte, error) {
+	pubkeyCurve := elliptic.P256()
+
+	privatekey, err := ecdsa.GenerateKey(pubkeyCurve, rand.Reader)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	service.privateKey = privatekey
+	service.publicKey = &privatekey.PublicKey
+
+	private, err := x509.MarshalECPrivateKey(service.privateKey)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	public, err := x509.MarshalPKIXPublicKey(service.publicKey)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	encodedKey := hex.EncodeToString(public)
+	service.encodedPubKey = encodedKey
+
+	return private, public, nil
+}
+
+// CreateSignature creates a digital signature.
+// It automatically hash a specific message using MD5 and creates a signature from
+// that hash.
+// If a secret is associated to the service, it will be used instead of the specified
+// message.
+// It then encodes the generated signature in base64.
+func (service *ECDSAService) CreateSignature(message string) (string, error) {
+	if service.secret != "" {
+		message = service.secret
+	}
+
+	hash := libcrypto.InsecureHashFromBytes([]byte(message))
+
+	r, s, err := ecdsa.Sign(rand.Reader, service.privateKey, hash)
+	if err != nil {
+		return "", err
+	}
+
+	keyBytes := service.privateKey.Params().BitSize / 8
+
+	rBytes := r.Bytes()
+	rBytesPadded := make([]byte, keyBytes)
+	copy(rBytesPadded[keyBytes-len(rBytes):], rBytes)
+
+	sBytes := s.Bytes()
+	sBytesPadded := make([]byte, keyBytes)
+	copy(sBytesPadded[keyBytes-len(sBytes):], sBytes)
+
+	signature := append(rBytesPadded, sBytesPadded...)
+
+	return base64.RawStdEncoding.EncodeToString(signature), nil
+}
diff --git a/api/crypto/ecdsa_test.go b/api/crypto/ecdsa_test.go
new file mode 100644
index 0000000..a45e83a
--- /dev/null
+++ b/api/crypto/ecdsa_test.go
@@ -0,0 +1,23 @@
+package crypto
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestCreateSignature(t *testing.T) {
+	t.Parallel()
+	var s = NewECDSAService("secret")
+
+	privKey, pubKey, err := s.GenerateKeyPair()
+	require.NoError(t, err)
+	require.NotEmpty(t, privKey)
+	require.NotEmpty(t, pubKey)
+
+	m := "test message"
+	r, err := s.CreateSignature(m)
+	require.NoError(t, err)
+	require.NotEqual(t, r, m)
+	require.NotEmpty(t, r)
+}
diff --git a/api/crypto/hash.go b/api/crypto/hash.go
new file mode 100644
index 0000000..e8b222a
--- /dev/null
+++ b/api/crypto/hash.go
@@ -0,0 +1,24 @@
+package crypto
+
+import (
+	// Not allowed in FIPS mode
+	"golang.org/x/crypto/bcrypt" //nolint:depguard
+)
+
+// Service represents a service for encrypting/hashing data.
+type Service struct{}
+
+// Hash hashes a string using the bcrypt algorithm
+func (Service) Hash(data string) (string, error) {
+	bytes, err := bcrypt.GenerateFromPassword([]byte(data), bcrypt.DefaultCost)
+	if err != nil {
+		return "", err
+	}
+
+	return string(bytes), err
+}
+
+// CompareHashAndData compares a hash to clear data and returns an error if the comparison fails.
+func (Service) CompareHashAndData(hash string, data string) error {
+	return bcrypt.CompareHashAndPassword([]byte(hash), []byte(data))
+}
diff --git a/api/crypto/hash_test.go b/api/crypto/hash_test.go
new file mode 100644
index 0000000..b5e5857
--- /dev/null
+++ b/api/crypto/hash_test.go
@@ -0,0 +1,65 @@
+package crypto
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestService_Hash(t *testing.T) {
+	t.Parallel()
+	var s = Service{}
+
+	type args struct {
+		hash string
+		data string
+	}
+	tests := []struct {
+		name   string
+		args   args
+		expect bool
+	}{
+		{
+			name: "Empty",
+			args: args{
+				hash: "",
+				data: "",
+			},
+			expect: false,
+		},
+		{
+			name: "Matching",
+			args: args{
+				hash: "$2a$10$6BFGd94oYx8k0bFNO6f33uPUpcpAJyg8UVX.akLe9EthF/ZBTXqcy",
+				data: "Passw0rd!",
+			},
+			expect: true,
+		},
+		{
+			name: "Not matching",
+			args: args{
+				hash: "$2a$10$ltKrUZ7492xyutHOb0/XweevU4jyw7QO66rP32jTVOMb3EX3JxA/a",
+				data: "Passw0rd!",
+			},
+			expect: false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+
+			err := s.CompareHashAndData(tt.args.hash, tt.args.data)
+			if (err != nil) == tt.expect {
+				t.Errorf("Service.CompareHashAndData() = %v", err)
+			}
+		})
+	}
+}
+
+func TestHash(t *testing.T) {
+	t.Parallel()
+	s := Service{}
+
+	hash, err := s.Hash("Passw0rd!")
+	require.NoError(t, err)
+	require.NotEmpty(t, hash)
+}
diff --git a/api/crypto/nonce.go b/api/crypto/nonce.go
new file mode 100644
index 0000000..4753374
--- /dev/null
+++ b/api/crypto/nonce.go
@@ -0,0 +1,62 @@
+package crypto
+
+import (
+	"crypto/rand"
+	"errors"
+	"io"
+	"slices"
+)
+
+type Nonce struct {
+	val []byte
+}
+
+func NewNonce(size int) *Nonce {
+	return &Nonce{val: make([]byte, size)}
+}
+
+// NewRandomNonce generates a new initial nonce with the lower byte set to a random value
+// This ensures there are plenty of nonce values available before rolling over
+// Based on ideas from the Secure Programming Cookbook for C and C++ by John Viega, Matt Messier
+// https://www.oreilly.com/library/view/secure-programming-cookbook/0596003943/ch04s09.html
+func NewRandomNonce(size int) (*Nonce, error) {
+	randomBytes := 1
+	if size <= randomBytes {
+		return nil, errors.New("nonce size must be greater than the number of random bytes")
+	}
+
+	randomPart := make([]byte, randomBytes)
+	if _, err := rand.Read(randomPart); err != nil {
+		return nil, err
+	}
+
+	zeroPart := make([]byte, size-randomBytes)
+	nonceVal := append(randomPart, zeroPart...)
+	return &Nonce{val: nonceVal}, nil
+}
+
+func (n *Nonce) Read(stream io.Reader) error {
+	_, err := io.ReadFull(stream, n.val)
+	return err
+}
+
+func (n *Nonce) Value() []byte {
+	return n.val
+}
+
+func (n *Nonce) Increment() error {
+	// Start incrementing from the least significant byte
+	for i := range slices.Backward(n.val) {
+		// Increment the current byte
+		n.val[i]++
+
+		// Check for overflow
+		if n.val[i] != 0 {
+			// No overflow, nonce is successfully incremented
+			return nil
+		}
+	}
+
+	// If we reach here, it means the nonce has overflowed
+	return errors.New("nonce overflow")
+}
diff --git a/api/crypto/tls.go b/api/crypto/tls.go
new file mode 100644
index 0000000..df717a3
--- /dev/null
+++ b/api/crypto/tls.go
@@ -0,0 +1,124 @@
+package crypto
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"os"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/pkg/fips"
+)
+
+// CreateTLSConfiguration creates a basic tls.Config with recommended TLS settings
+func CreateTLSConfiguration(insecureSkipVerify bool) *tls.Config { //nolint:forbidigo
+	return createTLSConfiguration(fips.FIPSMode(), insecureSkipVerify)
+}
+
+func createTLSConfiguration(fipsEnabled bool, insecureSkipVerify bool) *tls.Config { //nolint:forbidigo
+	if fipsEnabled {
+		return &tls.Config{ //nolint:forbidigo
+			MinVersion: tls.VersionTLS12,
+			MaxVersion: tls.VersionTLS13,
+			CipherSuites: []uint16{
+				tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+				tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
+				tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
+				tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
+			},
+			CurvePreferences: []tls.CurveID{tls.CurveP256, tls.CurveP384, tls.CurveP521},
+		}
+	}
+
+	return &tls.Config{ //nolint:forbidigo
+		MinVersion: tls.VersionTLS12,
+		CipherSuites: []uint16{
+			tls.TLS_AES_128_GCM_SHA256,
+			tls.TLS_AES_256_GCM_SHA384,
+			tls.TLS_CHACHA20_POLY1305_SHA256,
+			tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
+			tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+			tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
+			tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
+			tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
+			tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
+			tls.TLS_RSA_WITH_AES_128_GCM_SHA256,
+			tls.TLS_RSA_WITH_AES_256_GCM_SHA384,
+			tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
+			tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
+			tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
+			tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
+			tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
+			tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
+		},
+		InsecureSkipVerify: insecureSkipVerify, //nolint:forbidigo
+	}
+}
+
+// CreateTLSConfigurationFromBytes initializes a tls.Config using a CA certificate, a certificate and a key
+// loaded from memory.
+func CreateTLSConfigurationFromBytes(useTLS bool, caCert, cert, key []byte, skipClientVerification, skipServerVerification bool) (*tls.Config, error) { //nolint:forbidigo
+	return createTLSConfigurationFromBytes(fips.FIPSMode(), useTLS, caCert, cert, key, skipClientVerification, skipServerVerification)
+}
+
+func createTLSConfigurationFromBytes(fipsEnabled, useTLS bool, caCert, cert, key []byte, skipClientVerification, skipServerVerification bool) (*tls.Config, error) { //nolint:forbidigo
+	if !useTLS {
+		return nil, nil
+	}
+
+	config := createTLSConfiguration(fipsEnabled, skipServerVerification)
+
+	if !skipClientVerification || fipsEnabled {
+		certificate, err := tls.X509KeyPair(cert, key)
+		if err != nil {
+			return nil, err
+		}
+
+		config.Certificates = []tls.Certificate{certificate}
+	}
+
+	if !skipServerVerification || fipsEnabled {
+		caCertPool := x509.NewCertPool()
+		caCertPool.AppendCertsFromPEM(caCert)
+		config.RootCAs = caCertPool
+	}
+
+	return config, nil
+}
+
+// CreateTLSConfigurationFromDisk initializes a tls.Config using a CA certificate, a certificate and a key
+// loaded from disk.
+func CreateTLSConfigurationFromDisk(config portainer.TLSConfiguration) (*tls.Config, error) { //nolint:forbidigo
+	return createTLSConfigurationFromDisk(fips.FIPSMode(), config)
+}
+
+func createTLSConfigurationFromDisk(fipsEnabled bool, config portainer.TLSConfiguration) (*tls.Config, error) { //nolint:forbidigo
+	if !config.TLS && fipsEnabled {
+		return nil, fips.ErrTLSRequired
+	} else if !config.TLS {
+		return nil, nil
+	}
+
+	tlsConfig := createTLSConfiguration(fipsEnabled, config.TLSSkipVerify)
+
+	if config.TLSCertPath != "" && config.TLSKeyPath != "" {
+		cert, err := tls.LoadX509KeyPair(config.TLSCertPath, config.TLSKeyPath)
+		if err != nil {
+			return nil, err
+		}
+
+		tlsConfig.Certificates = []tls.Certificate{cert}
+	}
+
+	if !tlsConfig.InsecureSkipVerify && config.TLSCACertPath != "" { //nolint:forbidigo
+		caCert, err := os.ReadFile(config.TLSCACertPath)
+		if err != nil {
+			return nil, err
+		}
+
+		caCertPool := x509.NewCertPool()
+		caCertPool.AppendCertsFromPEM(caCert)
+		tlsConfig.RootCAs = caCertPool
+	}
+
+	return tlsConfig, nil
+}
diff --git a/api/crypto/tls_test.go b/api/crypto/tls_test.go
new file mode 100644
index 0000000..52c643a
--- /dev/null
+++ b/api/crypto/tls_test.go
@@ -0,0 +1,92 @@
+package crypto
+
+import (
+	"crypto/tls"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestCreateTLSConfiguration(t *testing.T) {
+	t.Parallel()
+	// InsecureSkipVerify = false
+	config := CreateTLSConfiguration(false)
+	require.Equal(t, config.MinVersion, uint16(tls.VersionTLS12)) //nolint:forbidigo
+	require.False(t, config.InsecureSkipVerify)                   //nolint:forbidigo
+
+	// InsecureSkipVerify = true
+	config = CreateTLSConfiguration(true)
+	require.Equal(t, config.MinVersion, uint16(tls.VersionTLS12)) //nolint:forbidigo
+	require.True(t, config.InsecureSkipVerify)                    //nolint:forbidigo
+}
+
+func TestCreateTLSConfigurationFIPS(t *testing.T) {
+	t.Parallel()
+	fips := true
+
+	fipsCipherSuites := []uint16{
+		tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+		tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
+		tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
+		tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
+	}
+
+	fipsCurvePreferences := []tls.CurveID{tls.CurveP256, tls.CurveP384, tls.CurveP521}
+
+	config := createTLSConfiguration(fips, false)
+	require.Equal(t, config.MinVersion, uint16(tls.VersionTLS12))   //nolint:forbidigo
+	require.Equal(t, config.MaxVersion, uint16(tls.VersionTLS13))   //nolint:forbidigo
+	require.Equal(t, config.CipherSuites, fipsCipherSuites)         //nolint:forbidigo
+	require.Equal(t, config.CurvePreferences, fipsCurvePreferences) //nolint:forbidigo
+	require.False(t, config.InsecureSkipVerify)                     //nolint:forbidigo
+}
+
+func TestCreateTLSConfigurationFromBytes(t *testing.T) {
+	t.Parallel()
+	// No TLS
+	config, err := CreateTLSConfigurationFromBytes(false, nil, nil, nil, false, false)
+	require.NoError(t, err)
+	require.Nil(t, config)
+
+	// Skip TLS client/server verifications
+	config, err = CreateTLSConfigurationFromBytes(true, nil, nil, nil, true, true)
+	require.NoError(t, err)
+	require.NotNil(t, config)
+
+	// Empty TLS
+	config, err = CreateTLSConfigurationFromBytes(true, nil, nil, nil, false, false)
+	require.Error(t, err)
+	require.Nil(t, config)
+}
+
+func TestCreateTLSConfigurationFromDisk(t *testing.T) {
+	t.Parallel()
+	// No TLS
+	config, err := CreateTLSConfigurationFromDisk(portainer.TLSConfiguration{})
+	require.NoError(t, err)
+	require.Nil(t, config)
+
+	// Skip TLS verifications
+	config, err = CreateTLSConfigurationFromDisk(portainer.TLSConfiguration{
+		TLS:           true,
+		TLSSkipVerify: true,
+	})
+	require.NoError(t, err)
+	require.NotNil(t, config)
+}
+
+func TestCreateTLSConfigurationFromDiskFIPS(t *testing.T) {
+	t.Parallel()
+	fips := true
+
+	// Skipping TLS verifications cannot be done in FIPS mode
+	config, err := createTLSConfigurationFromDisk(fips, portainer.TLSConfiguration{
+		TLS:           true,
+		TLSSkipVerify: true,
+	})
+	require.NoError(t, err)
+	require.NotNil(t, config)
+	require.False(t, config.InsecureSkipVerify) //nolint:forbidigo
+}
diff --git a/api/database/boltdb/db.go b/api/database/boltdb/db.go
new file mode 100644
index 0000000..adfbdeb
--- /dev/null
+++ b/api/database/boltdb/db.go
@@ -0,0 +1,503 @@
+package boltdb
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"io"
+	"math"
+	"os"
+	"path"
+	"strconv"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	dserrors "github.com/portainer/portainer/api/dataservices/errors"
+
+	"github.com/rs/zerolog/log"
+	bolt "go.etcd.io/bbolt"
+)
+
+const (
+	DatabaseFileName          = "portainer.db"
+	EncryptedDatabaseFileName = "portainer.edb"
+
+	txMaxSize       = 65536
+	compactedSuffix = ".compacted"
+)
+
+var (
+	ErrHaveEncryptedAndUnencrypted = errors.New("Portainer has detected both an encrypted and un-encrypted database and cannot start.  Only one database should exist")
+	ErrHaveEncryptedWithNoKey      = errors.New("The portainer database is encrypted, but no secret was loaded")
+)
+
+type DbConnection struct {
+	Path            string
+	MaxBatchSize    int
+	MaxBatchDelay   time.Duration
+	InitialMmapSize int
+	EncryptionKey   []byte
+	isEncrypted     bool
+	Compact         bool
+
+	gcm cipher.AEAD
+
+	*bolt.DB
+}
+
+// GetDatabaseFileName get the database filename
+func (connection *DbConnection) GetDatabaseFileName() string {
+	if connection.IsEncryptedStore() {
+		return EncryptedDatabaseFileName
+	}
+
+	return DatabaseFileName
+}
+
+// GetDataseFilePath get the path + filename for the database file
+func (connection *DbConnection) GetDatabaseFilePath() string {
+	if connection.IsEncryptedStore() {
+		return path.Join(connection.Path, EncryptedDatabaseFileName)
+	}
+
+	return path.Join(connection.Path, DatabaseFileName)
+}
+
+// GetStorePath get the filename and path for the database file
+func (connection *DbConnection) GetStorePath() string {
+	return connection.Path
+}
+
+func (connection *DbConnection) GetDatabaseFileSize() (int64, error) {
+	file, err := os.Stat(connection.GetDatabaseFilePath())
+	if err != nil {
+		return 0, fmt.Errorf("Failed to stat database file path: %s err: %w", connection.GetDatabaseFilePath(), err)
+	}
+
+	return file.Size(), nil
+}
+
+func (connection *DbConnection) SetEncrypted(flag bool) error {
+	connection.isEncrypted = flag
+
+	if !flag || connection.EncryptionKey == nil {
+		connection.gcm = nil
+
+		return nil
+	}
+
+	block, err := aes.NewCipher(connection.EncryptionKey)
+	if err != nil {
+		return fmt.Errorf("creating AES cipher for database encryption: %w", err)
+	}
+
+	gcm, err := cipher.NewGCMWithRandomNonce(block)
+	if err != nil {
+		return fmt.Errorf("creating GCM cipher for database encryption: %w", err)
+	}
+
+	connection.gcm = gcm
+
+	return nil
+}
+
+// Return true if the database is encrypted
+func (connection *DbConnection) IsEncryptedStore() bool {
+	return connection.getEncryptionKey() != nil
+}
+
+// NeedsEncryptionMigration returns true if database encryption is enabled and
+// we have an un-encrypted DB that requires migration to an encrypted DB
+func (connection *DbConnection) NeedsEncryptionMigration() (bool, error) {
+	// Cases:  Note, we need to check both portainer.db and portainer.edb
+	// to determine if it's a new store.   We only need to differentiate between cases 2,3 and 5
+
+	// 1) portainer.edb + key     => False
+	// 2) portainer.edb + no key  => ERROR Fatal!
+	// 3) portainer.db  + key     => True  (needs migration)
+	// 4) portainer.db  + no key  => False
+	// 5) NoDB (new)    + key     => False
+	// 6) NoDB (new)    + no key  => False
+	// 7) portainer.db & portainer.edb => ERROR Fatal!
+
+	// If we have a loaded encryption key, always set encrypted
+	if connection.EncryptionKey != nil {
+		if err := connection.SetEncrypted(true); err != nil {
+			return false, err
+		}
+	}
+
+	// Check for portainer.db
+	dbFile := path.Join(connection.Path, DatabaseFileName)
+	_, err := os.Stat(dbFile)
+	haveDbFile := err == nil
+
+	// Check for portainer.edb
+	edbFile := path.Join(connection.Path, EncryptedDatabaseFileName)
+	_, err = os.Stat(edbFile)
+	haveEdbFile := err == nil
+
+	if haveDbFile && haveEdbFile {
+		// 7 - encrypted and unencrypted db?
+		return false, ErrHaveEncryptedAndUnencrypted
+	}
+
+	if haveDbFile && connection.EncryptionKey != nil {
+		// 3 - needs migration
+		return true, nil
+	}
+
+	if haveEdbFile && connection.EncryptionKey == nil {
+		// 2 - encrypted db, but no key?
+		return false, ErrHaveEncryptedWithNoKey
+	}
+
+	// 1, 4, 5, 6
+	return false, nil
+}
+
+// Open opens and initializes the BoltDB database.
+func (connection *DbConnection) Open() error {
+	log.Info().Str("filename", connection.GetDatabaseFileName()).Msg("loading PortainerDB")
+
+	databasePath := connection.GetDatabaseFilePath()
+	db, err := bolt.Open(databasePath, 0600, connection.boltOptions(connection.Compact))
+	if err != nil {
+		return err
+	}
+
+	db.MaxBatchSize = connection.MaxBatchSize
+	db.MaxBatchDelay = connection.MaxBatchDelay
+	connection.DB = db
+
+	if connection.Compact {
+		log.Info().Msg("compacting database")
+		if err := connection.compact(); err != nil {
+			log.Error().Err(err).Msg("failed to compact database")
+
+			// Close the read-only database and re-open in read-write mode
+			if err := connection.Close(); err != nil {
+				log.Warn().Err(err).Msg("failure to close the database after failed compaction")
+			}
+
+			connection.Compact = false
+
+			return connection.Open()
+		} else {
+			log.Info().Msg("database compaction completed")
+		}
+	}
+
+	return nil
+}
+
+// Close closes the BoltDB database.
+// Safe to being called multiple times.
+func (connection *DbConnection) Close() error {
+	log.Info().Msg("closing PortainerDB")
+
+	if connection.DB != nil {
+		return connection.DB.Close()
+	}
+
+	return nil
+}
+
+func (connection *DbConnection) txFn(fn func(portainer.Transaction) error) func(*bolt.Tx) error {
+	return func(tx *bolt.Tx) error {
+		return fn(&DbTransaction{conn: connection, tx: tx})
+	}
+}
+
+// UpdateTx executes the given function inside a read-write transaction
+func (connection *DbConnection) UpdateTx(fn func(portainer.Transaction) error) error {
+	if connection.MaxBatchDelay > 0 && connection.MaxBatchSize > 1 {
+		return connection.Batch(connection.txFn(fn))
+	}
+
+	return connection.Update(connection.txFn(fn))
+}
+
+// ViewTx executes the given function inside a read-only transaction
+func (connection *DbConnection) ViewTx(fn func(portainer.Transaction) error) error {
+	return connection.View(connection.txFn(fn))
+}
+
+// BackupTo backs up db to a provided writer.
+// It does hot backup and doesn't block other database reads and writes
+func (connection *DbConnection) BackupTo(w io.Writer) error {
+	return connection.View(func(tx *bolt.Tx) error {
+		_, err := tx.WriteTo(w)
+
+		return err
+	})
+}
+
+func (connection *DbConnection) ExportRaw(filename string) error {
+	databasePath := connection.GetDatabaseFilePath()
+	if _, err := os.Stat(databasePath); err != nil {
+		return fmt.Errorf("stat on %s failed, error: %w", databasePath, err)
+	}
+
+	b, err := connection.ExportJSON(databasePath, true)
+	if err != nil {
+		return err
+	}
+
+	return os.WriteFile(filename, b, 0600)
+}
+
+// ConvertToKey returns an 8-byte big endian representation of v.
+// This function is typically used for encoding integer IDs to byte slices
+// so that they can be used as BoltDB keys.
+func (connection *DbConnection) ConvertToKey(v int) []byte {
+	b := make([]byte, 8)
+	binary.BigEndian.PutUint64(b, uint64(v))
+
+	return b
+}
+
+// keyToString Converts a key to a string value suitable for logging
+func keyToString(b []byte) string {
+	if len(b) != 8 {
+		return string(b)
+	}
+
+	v := binary.BigEndian.Uint64(b)
+	if v <= math.MaxInt32 {
+		return strconv.FormatUint(v, 10)
+	}
+
+	return string(b)
+}
+
+// CreateBucket is a generic function used to create a bucket inside a database.
+func (connection *DbConnection) SetServiceName(bucketName string) error {
+	return connection.UpdateTx(func(tx portainer.Transaction) error {
+		return tx.SetServiceName(bucketName)
+	})
+}
+
+// GetObject is a generic function used to retrieve an unmarshalled object from a database.
+func (connection *DbConnection) GetObject(bucketName string, key []byte, object any) error {
+	return connection.ViewTx(func(tx portainer.Transaction) error {
+		return tx.GetObject(bucketName, key, object)
+	})
+}
+
+func (connection *DbConnection) GetRawBytes(bucketName string, key []byte) ([]byte, error) {
+	var value []byte
+
+	err := connection.ViewTx(func(tx portainer.Transaction) error {
+		var err error
+		value, err = tx.GetRawBytes(bucketName, key)
+
+		return err
+	})
+
+	return value, err
+}
+
+func (connection *DbConnection) KeyExists(bucketName string, key []byte) (bool, error) {
+	var exists bool
+
+	err := connection.ViewTx(func(tx portainer.Transaction) error {
+		var err error
+		exists, err = tx.KeyExists(bucketName, key)
+
+		return err
+	})
+
+	return exists, err
+}
+
+func (connection *DbConnection) getEncryptionKey() []byte {
+	if !connection.isEncrypted {
+		return nil
+	}
+
+	return connection.EncryptionKey
+}
+
+// UpdateObject is a generic function used to update an object inside a database.
+func (connection *DbConnection) UpdateObject(bucketName string, key []byte, object any) error {
+	return connection.UpdateTx(func(tx portainer.Transaction) error {
+		return tx.UpdateObject(bucketName, key, object)
+	})
+}
+
+// UpdateObjectFunc is a generic function used to update an object safely without race conditions.
+func (connection *DbConnection) UpdateObjectFunc(bucketName string, key []byte, object any, updateFn func()) error {
+	return connection.Batch(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(bucketName))
+
+		data := bucket.Get(key)
+		if data == nil {
+			return fmt.Errorf("%w (bucket=%s, key=%s)", dserrors.ErrObjectNotFound, bucketName, keyToString(key))
+		}
+
+		err := connection.UnmarshalObject(data, object)
+		if err != nil {
+			return err
+		}
+
+		updateFn()
+
+		data, err = connection.MarshalObject(object)
+		if err != nil {
+			return err
+		}
+
+		return bucket.Put(key, data)
+	})
+}
+
+// DeleteObject is a generic function used to delete an object inside a database.
+func (connection *DbConnection) DeleteObject(bucketName string, key []byte) error {
+	return connection.UpdateTx(func(tx portainer.Transaction) error {
+		return tx.DeleteObject(bucketName, key)
+	})
+}
+
+// DeleteAllObjects delete all objects where matching() returns (id, ok).
+// TODO: think about how to return the error inside (maybe change ok to type err, and use "notfound"?
+func (connection *DbConnection) DeleteAllObjects(bucketName string, obj any, matching func(o any) (id int, ok bool)) error {
+	return connection.UpdateTx(func(tx portainer.Transaction) error {
+		return tx.DeleteAllObjects(bucketName, obj, matching)
+	})
+}
+
+// GetNextIdentifier is a generic function that returns the specified bucket identifier incremented by 1.
+func (connection *DbConnection) GetNextIdentifier(bucketName string) int {
+	var identifier int
+
+	_ = connection.UpdateTx(func(tx portainer.Transaction) error {
+		identifier = tx.GetNextIdentifier(bucketName)
+		return nil
+	})
+
+	return identifier
+}
+
+// CreateObject creates a new object in the bucket, using the next bucket sequence id
+func (connection *DbConnection) CreateObject(bucketName string, fn func(uint64) (int, any)) error {
+	return connection.UpdateTx(func(tx portainer.Transaction) error {
+		return tx.CreateObject(bucketName, fn)
+	})
+}
+
+// CreateObjectWithId creates a new object in the bucket, using the specified id
+func (connection *DbConnection) CreateObjectWithId(bucketName string, id int, obj any) error {
+	return connection.UpdateTx(func(tx portainer.Transaction) error {
+		return tx.CreateObjectWithId(bucketName, id, obj)
+	})
+}
+
+// CreateObjectWithStringId creates a new object in the bucket, using the specified id
+func (connection *DbConnection) CreateObjectWithStringId(bucketName string, id []byte, obj any) error {
+	return connection.UpdateTx(func(tx portainer.Transaction) error {
+		return tx.CreateObjectWithStringId(bucketName, id, obj)
+	})
+}
+
+func (connection *DbConnection) GetAll(bucketName string, obj any, appendFn func(o any) (any, error)) error {
+	return connection.ViewTx(func(tx portainer.Transaction) error {
+		return tx.GetAll(bucketName, obj, appendFn)
+	})
+}
+
+func (connection *DbConnection) GetAllWithKeyPrefix(bucketName string, keyPrefix []byte, obj any, appendFn func(o any) (any, error)) error {
+	return connection.ViewTx(func(tx portainer.Transaction) error {
+		return tx.GetAllWithKeyPrefix(bucketName, keyPrefix, obj, appendFn)
+	})
+}
+
+// BackupMetadata will return a copy of the boltdb sequence numbers for all buckets.
+func (connection *DbConnection) BackupMetadata() (map[string]any, error) {
+	buckets := map[string]any{}
+
+	err := connection.View(func(tx *bolt.Tx) error {
+		return tx.ForEach(func(name []byte, bucket *bolt.Bucket) error {
+			bucketName := string(name)
+			seqId := bucket.Sequence()
+			buckets[bucketName] = int(seqId)
+
+			return nil
+		})
+	})
+
+	return buckets, err
+}
+
+// RestoreMetadata will restore the boltdb sequence numbers for all buckets.
+func (connection *DbConnection) RestoreMetadata(s map[string]any) error {
+	var err error
+
+	for bucketName, v := range s {
+		id, ok := v.(float64) // JSON ints are unmarshalled to interface as float64. See: https://pkg.go.dev/encoding/json#Decoder.Decode
+		if !ok {
+			log.Error().Str("bucket", bucketName).Msg("failed to restore metadata to bucket, skipped")
+
+			continue
+		}
+
+		err = connection.Batch(func(tx *bolt.Tx) error {
+			bucket, err := tx.CreateBucketIfNotExists([]byte(bucketName))
+			if err != nil {
+				return err
+			}
+
+			return bucket.SetSequence(uint64(id))
+		})
+	}
+
+	return err
+}
+
+// compact attempts to compact the database and replace it iff it succeeds
+func (connection *DbConnection) compact() (err error) {
+	compactedPath := connection.GetDatabaseFilePath() + compactedSuffix
+
+	if err := os.Remove(compactedPath); err != nil && !errors.Is(err, os.ErrNotExist) {
+		return fmt.Errorf("failure to remove an existing compacted database: %w", err)
+	}
+
+	compactedDB, err := bolt.Open(compactedPath, 0o600, connection.boltOptions(false))
+	if err != nil {
+		return fmt.Errorf("failure to create the compacted database: %w", err)
+	}
+
+	compactedDB.MaxBatchSize = connection.MaxBatchSize
+	compactedDB.MaxBatchDelay = connection.MaxBatchDelay
+
+	if err := bolt.Compact(compactedDB, connection.DB, txMaxSize); err != nil {
+		return fmt.Errorf("failure to compact the database: %w",
+			errors.Join(err, compactedDB.Close(), os.Remove(compactedPath)))
+	}
+
+	if err := os.Rename(compactedPath, connection.GetDatabaseFilePath()); err != nil {
+		return fmt.Errorf("failure to move the compacted database: %w",
+			errors.Join(err, compactedDB.Close(), os.Remove(compactedPath)))
+	}
+
+	if err := connection.Close(); err != nil {
+		log.Warn().Err(err).Msg("failure to close the database after compaction")
+	}
+
+	connection.DB = compactedDB
+
+	return nil
+}
+
+func (connection *DbConnection) boltOptions(readOnly bool) *bolt.Options {
+	return &bolt.Options{
+		Timeout:         1 * time.Second,
+		InitialMmapSize: connection.InitialMmapSize,
+		FreelistType:    bolt.FreelistMapType,
+		NoFreelistSync:  true,
+		ReadOnly:        readOnly,
+		NoStatistics:    true,
+	}
+}
diff --git a/api/database/boltdb/db_test.go b/api/database/boltdb/db_test.go
new file mode 100644
index 0000000..15d9abe
--- /dev/null
+++ b/api/database/boltdb/db_test.go
@@ -0,0 +1,252 @@
+package boltdb
+
+import (
+	"os"
+	"testing"
+
+	"github.com/portainer/portainer/api/filesystem"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.etcd.io/bbolt"
+)
+
+func Test_NeedsEncryptionMigration(t *testing.T) {
+	t.Parallel()
+	// Test the specific scenarios mentioned in NeedsEncryptionMigration
+
+	// i.e.
+	// Cases:  Note, we need to check both portainer.db and portainer.edb
+	// to determine if it's a new store.   We only need to differentiate between cases 2,3 and 5
+
+	// 1) portainer.edb + key     => False
+	// 2) portainer.edb + no key  => ERROR Fatal!
+	// 3) portainer.db  + key     => True  (needs migration)
+	// 4) portainer.db  + no key  => False
+	// 5) NoDB (new)    + key     => False
+	// 6) NoDB (new)    + no key  => False
+	// 7) portainer.db & portainer.edb (key not important) => ERROR Fatal!
+
+	is := assert.New(t)
+	dir := t.TempDir()
+
+	cases := []struct {
+		name         string
+		dbname       string
+		key          bool
+		expectError  error
+		expectResult bool
+	}{
+		{
+			name:         "portainer.edb + key",
+			dbname:       EncryptedDatabaseFileName,
+			key:          true,
+			expectError:  nil,
+			expectResult: false,
+		},
+		{
+			name:         "portainer.db + key (migration needed)",
+			dbname:       DatabaseFileName,
+			key:          true,
+			expectError:  nil,
+			expectResult: true,
+		},
+		{
+			name:         "portainer.db + no key",
+			dbname:       DatabaseFileName,
+			key:          false,
+			expectError:  nil,
+			expectResult: false,
+		},
+		{
+			name:         "NoDB (new) + key",
+			dbname:       "",
+			key:          false,
+			expectError:  nil,
+			expectResult: false,
+		},
+		{
+			name:         "NoDB (new) + no key",
+			dbname:       "",
+			key:          false,
+			expectError:  nil,
+			expectResult: false,
+		},
+
+		// error tests
+		{
+			name:         "portainer.edb + no key",
+			dbname:       EncryptedDatabaseFileName,
+			key:          false,
+			expectError:  ErrHaveEncryptedWithNoKey,
+			expectResult: false,
+		},
+		{
+			name:         "portainer.db & portainer.edb",
+			dbname:       "both",
+			key:          true,
+			expectError:  ErrHaveEncryptedAndUnencrypted,
+			expectResult: false,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			connection := DbConnection{Path: dir}
+
+			if tc.dbname == "both" {
+				// Special case.  If portainer.db and portainer.edb exist.
+				dbFile1 := filesystem.JoinPaths(connection.Path, DatabaseFileName)
+				f, _ := os.Create(dbFile1)
+
+				err := f.Close()
+				require.NoError(t, err)
+
+				defer func() {
+					err := os.Remove(dbFile1)
+					require.NoError(t, err)
+				}()
+
+				dbFile2 := filesystem.JoinPaths(connection.Path, EncryptedDatabaseFileName)
+				f, _ = os.Create(dbFile2)
+
+				err = f.Close()
+				require.NoError(t, err)
+
+				defer func() {
+					err := os.Remove(dbFile2)
+					require.NoError(t, err)
+				}()
+			} else if tc.dbname != "" {
+				dbFile := filesystem.JoinPaths(connection.Path, tc.dbname)
+				f, _ := os.Create(dbFile)
+
+				err := f.Close()
+				require.NoError(t, err)
+
+				defer func() {
+					err := os.Remove(dbFile)
+					require.NoError(t, err)
+				}()
+			}
+
+			if tc.key {
+				connection.EncryptionKey = secretToEncryptionKey("secret")
+			}
+
+			result, err := connection.NeedsEncryptionMigration()
+
+			is.Equal(tc.expectError, err, "Fatal Error failure. Test: %s", tc.name)
+			is.Equal(result, tc.expectResult, "Failed test: %s", tc.name)
+		})
+	}
+}
+
+func TestSetEncrypted_InvalidKeyReturnsError(t *testing.T) {
+	t.Parallel()
+
+	conn := DbConnection{EncryptionKey: []byte("bad")}
+	err := conn.SetEncrypted(true)
+	require.Error(t, err)
+	require.Nil(t, conn.gcm)
+}
+
+func TestSetEncrypted_NilKeyDoesNotSetGCM(t *testing.T) {
+	t.Parallel()
+
+	conn := DbConnection{}
+	err := conn.SetEncrypted(true)
+	require.NoError(t, err)
+	require.Nil(t, conn.gcm)
+}
+
+func TestSetEncrypted_EnableThenDisableStopsEncryption(t *testing.T) {
+	t.Parallel()
+
+	key := secretToEncryptionKey(passphrase)
+	conn := DbConnection{EncryptionKey: key}
+
+	err := conn.SetEncrypted(true)
+	require.NoError(t, err)
+	require.NotNil(t, conn.gcm)
+
+	err = conn.SetEncrypted(false)
+	require.NoError(t, err)
+	require.Nil(t, conn.gcm)
+
+	// MarshalObject must return plaintext after encryption is disabled
+	data, err := conn.MarshalObject("hello")
+	require.NoError(t, err)
+	require.Equal(t, "hello", string(data))
+}
+
+func TestNeedsEncryptionMigration_InvalidKeyError(t *testing.T) {
+	t.Parallel()
+
+	conn := DbConnection{
+		Path:          t.TempDir(),
+		EncryptionKey: []byte("bad"),
+	}
+
+	result, err := conn.NeedsEncryptionMigration()
+	require.Error(t, err)
+	require.False(t, result)
+}
+
+func TestDBCompaction(t *testing.T) {
+	t.Parallel()
+	db := &DbConnection{Path: t.TempDir()}
+
+	err := db.Open()
+	require.NoError(t, err)
+
+	err = db.Update(func(tx *bbolt.Tx) error {
+		b, err := tx.CreateBucketIfNotExists([]byte("testbucket"))
+		if err != nil {
+			return err
+		}
+
+		err = b.Put([]byte("key"), []byte("value"))
+		require.NoError(t, err)
+
+		return nil
+	})
+	require.NoError(t, err)
+
+	err = db.Close()
+	require.NoError(t, err)
+
+	// Reopen the DB to trigger compaction
+	db.Compact = true
+	err = db.Open()
+	require.NoError(t, err)
+
+	// Check that the data is still there
+	err = db.View(func(tx *bbolt.Tx) error {
+		b := tx.Bucket([]byte("testbucket"))
+		if b == nil {
+			return nil
+		}
+
+		val := b.Get([]byte("key"))
+		require.Equal(t, []byte("value"), val)
+
+		return nil
+	})
+	require.NoError(t, err)
+
+	err = db.Close()
+	require.NoError(t, err)
+
+	// Failures
+	compactedPath := db.GetDatabaseFilePath() + compactedSuffix
+	err = os.Mkdir(compactedPath, 0o755)
+	require.NoError(t, err)
+
+	f, err := os.Create(filesystem.JoinPaths(compactedPath, "somefile"))
+	require.NoError(t, err)
+	require.NoError(t, f.Close())
+
+	err = db.Open()
+	require.NoError(t, err)
+}
diff --git a/api/database/boltdb/export.go b/api/database/boltdb/export.go
new file mode 100644
index 0000000..e5a56a8
--- /dev/null
+++ b/api/database/boltdb/export.go
@@ -0,0 +1,108 @@
+package boltdb
+
+import (
+	"time"
+
+	"github.com/portainer/portainer/api/logs"
+	"github.com/rs/zerolog/log"
+	"github.com/segmentio/encoding/json"
+	bolt "go.etcd.io/bbolt"
+)
+
+func backupMetadata(connection *bolt.DB) (map[string]any, error) {
+	buckets := map[string]any{}
+
+	err := connection.View(func(tx *bolt.Tx) error {
+		err := tx.ForEach(func(name []byte, bucket *bolt.Bucket) error {
+			bucketName := string(name)
+			seqId := bucket.Sequence()
+			buckets[bucketName] = int(seqId)
+			return nil
+		})
+
+		return err
+	})
+
+	return buckets, err
+}
+
+// ExportJSON creates a JSON representation from a DbConnection. You can include
+// the database's metadata or ignore it. Ensure the database is closed before
+// using this function.
+// inspired by github.com/konoui/boltdb-exporter (which has no license)
+// but very much simplified, based on how we use boltdb
+func (c *DbConnection) ExportJSON(databasePath string, metadata bool) ([]byte, error) {
+	log.Debug().Str("databasePath", databasePath).Msg("exportJson")
+
+	connection, err := bolt.Open(databasePath, 0600, &bolt.Options{Timeout: 1 * time.Second, ReadOnly: true, NoStatistics: true})
+	if err != nil {
+		return []byte("{}"), err
+	}
+	defer logs.CloseAndLogErr(connection)
+
+	backup := make(map[string]any)
+	if metadata {
+		meta, err := backupMetadata(connection)
+		if err != nil {
+			log.Error().Err(err).Msg("failed exporting metadata")
+		}
+
+		backup["__metadata"] = meta
+	}
+
+	if err := connection.View(func(tx *bolt.Tx) error {
+		return tx.ForEach(func(name []byte, bucket *bolt.Bucket) error {
+			bucketName := string(name)
+			var list []any
+			version := make(map[string]string)
+			cursor := bucket.Cursor()
+			for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+				if v == nil {
+					continue
+				}
+
+				var obj any
+				err := c.UnmarshalObject(v, &obj)
+				if err != nil {
+					log.Error().
+						Str("bucket", bucketName).
+						Str("object", string(v)).
+						Err(err).
+						Msg("failed to unmarshal")
+
+					obj = v
+				}
+
+				if bucketName == "version" {
+					version[string(k)] = string(v)
+				} else {
+					list = append(list, obj)
+				}
+			}
+
+			if bucketName == "version" {
+				backup[bucketName] = version
+				return nil
+			}
+
+			if bucketName == "ssl" ||
+				bucketName == "settings" ||
+				bucketName == "tunnel_server" {
+				backup[bucketName] = nil
+				if len(list) > 0 {
+					backup[bucketName] = list[0]
+				}
+
+				return nil
+			}
+
+			backup[bucketName] = list
+
+			return nil
+		})
+	}); err != nil {
+		return []byte("{}"), err
+	}
+
+	return json.MarshalIndent(backup, "", "  ")
+}
diff --git a/api/database/boltdb/json.go b/api/database/boltdb/json.go
new file mode 100644
index 0000000..094c8ab
--- /dev/null
+++ b/api/database/boltdb/json.go
@@ -0,0 +1,80 @@
+package boltdb
+
+import (
+	"bytes"
+	"crypto/cipher"
+
+	"github.com/pkg/errors"
+	"github.com/segmentio/encoding/json"
+)
+
+var errEncryptedStringTooShort = errors.New("encrypted string too short")
+
+// MarshalObject encodes an object to binary format
+func (connection *DbConnection) MarshalObject(object any) ([]byte, error) {
+	buf := &bytes.Buffer{}
+
+	// Special case for the VERSION bucket. Here we're not using json
+	if v, ok := object.(string); ok {
+		buf.WriteString(v)
+	} else {
+		enc := json.NewEncoder(buf)
+		enc.SetSortMapKeys(false)
+		enc.SetAppendNewline(false)
+
+		if err := enc.Encode(object); err != nil {
+			return nil, err
+		}
+	}
+
+	if connection.gcm == nil {
+		return buf.Bytes(), nil
+	}
+
+	return encrypt(buf.Bytes(), connection.gcm), nil
+}
+
+// UnmarshalObject decodes an object from binary data
+func (connection *DbConnection) UnmarshalObject(data []byte, object any) error {
+	var err error
+	if connection.gcm != nil {
+		data, err = decrypt(data, connection.gcm)
+		if err != nil {
+			return errors.Wrap(err, "Failed decrypting object")
+		}
+	}
+
+	if err := json.Unmarshal(data, object); err != nil {
+		// Special case for the VERSION bucket. Here we're not using json
+		// So we need to return it as a string
+		s, ok := object.(*string)
+		if !ok {
+			return errors.Wrap(err, "Failed unmarshalling object")
+		}
+
+		*s = string(data)
+	}
+
+	return err
+}
+
+func encrypt(plaintext []byte, gcm cipher.AEAD) []byte {
+	return gcm.Seal(nil, nil, plaintext, nil)
+}
+
+func decrypt(encrypted []byte, gcm cipher.AEAD) ([]byte, error) {
+	if string(encrypted) == "false" {
+		return []byte("false"), nil
+	}
+
+	if len(encrypted) < gcm.Overhead() {
+		return encrypted, errEncryptedStringTooShort
+	}
+
+	plaintextByte, err := gcm.Open(nil, nil, encrypted, nil)
+	if err != nil {
+		return encrypted, errors.Wrap(err, "Error decrypting text")
+	}
+
+	return plaintextByte, nil
+}
diff --git a/api/database/boltdb/json_test.go b/api/database/boltdb/json_test.go
new file mode 100644
index 0000000..4cd6049
--- /dev/null
+++ b/api/database/boltdb/json_test.go
@@ -0,0 +1,391 @@
+package boltdb
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
+	"fmt"
+	"io"
+	"testing"
+
+	"github.com/google/uuid"
+	"github.com/pkg/errors"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	jsonobject = `{"LogoURL":"","BlackListedLabels":[],"AuthenticationMethod":1,"InternalAuthSettings": {"RequiredPasswordLength": 12}"LDAPSettings":{"AnonymousMode":true,"ReaderDN":"","URL":"","TLSConfig":{"TLS":false,"TLSSkipVerify":false},"StartTLS":false,"SearchSettings":[{"BaseDN":"","Filter":"","UserNameAttribute":""}],"GroupSearchSettings":[{"GroupBaseDN":"","GroupFilter":"","GroupAttribute":""}],"AutoCreateUsers":true},"OAuthSettings":{"ClientID":"","AccessTokenURI":"","AuthorizationURI":"","ResourceURI":"","RedirectURI":"","UserIdentifier":"","Scopes":"","OAuthAutoCreateUsers":false,"DefaultTeamID":0,"SSO":true,"LogoutURI":"","KubeSecretKey":"j0zLVtY/lAWBk62ByyF0uP80SOXaitsABP0TTJX8MhI="},"FeatureFlagSettings":{},"SnapshotInterval":"5m","TemplatesURL":"https://raw.githubusercontent.com/portainer/templates/master/templates-2.0.json","EdgeAgentCheckinInterval":5,"EnableEdgeComputeFeatures":false,"UserSessionTimeout":"8h","KubeconfigExpiry":"0","HelmRepositoryURL":"https://charts.bitnami.com/bitnami","KubectlShellImage":"portainer/kubectl-shell","DisplayDonationHeader":false,"DisplayExternalContributors":false,"EnableHostManagementFeatures":false,"AllowVolumeBrowserForRegularUsers":false,"AllowBindMountsForRegularUsers":false,"AllowPrivilegedModeForRegularUsers":false,"AllowHostNamespaceForRegularUsers":false,"AllowStackManagementForRegularUsers":false,"AllowDeviceMappingForRegularUsers":false,"AllowContainerCapabilitiesForRegularUsers":false}`
+	passphrase = "my secret key"
+)
+
+func secretToEncryptionKey(passphrase string) []byte {
+	hash := sha256.Sum256([]byte(passphrase))
+	return hash[:]
+}
+
+func Test_MarshalObjectUnencrypted(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	uuid := uuid.New()
+
+	tests := []struct {
+		object   any
+		expected string
+	}{
+		{
+			object:   nil,
+			expected: `null`,
+		},
+		{
+			object:   true,
+			expected: `true`,
+		},
+		{
+			object:   false,
+			expected: `false`,
+		},
+		{
+			object:   123,
+			expected: `123`,
+		},
+		{
+			object:   "456",
+			expected: "456",
+		},
+		{
+			object:   uuid,
+			expected: "\"" + uuid.String() + "\"",
+		},
+		{
+			object:   uuid.String(),
+			expected: uuid.String(),
+		},
+		{
+			object:   map[string]any{"key": "value"},
+			expected: `{"key":"value"}`,
+		},
+		{
+			object:   []bool{true, false},
+			expected: `[true,false]`,
+		},
+		{
+			object:   []int{1, 2, 3},
+			expected: `[1,2,3]`,
+		},
+		{
+			object:   []string{"1", "2", "3"},
+			expected: `["1","2","3"]`,
+		},
+		{
+			object:   []map[string]any{{"key1": "value1"}, {"key2": "value2"}},
+			expected: `[{"key1":"value1"},{"key2":"value2"}]`,
+		},
+		{
+			object:   []any{1, "2", false, map[string]any{"key1": "value1"}},
+			expected: `[1,"2",false,{"key1":"value1"}]`,
+		},
+	}
+
+	conn := DbConnection{}
+
+	for _, test := range tests {
+		t.Run(fmt.Sprintf("%s -> %s", test.object, test.expected), func(t *testing.T) {
+			data, err := conn.MarshalObject(test.object)
+			require.NoError(t, err)
+			is.Equal(test.expected, string(data))
+		})
+	}
+}
+
+func Test_UnMarshalObjectUnencrypted(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	// Based on actual data entering and what we expect out of the function
+
+	tests := []struct {
+		object   []byte
+		expected string
+	}{
+		{
+			object:   []byte(""),
+			expected: "",
+		},
+		{
+			object:   []byte("35"),
+			expected: "35",
+		},
+		{
+			// An unmarshalled byte string should return the same without error
+			object:   []byte("9ca4a1dd-a439-4593-b386-a7dfdc2e9fc6"),
+			expected: "9ca4a1dd-a439-4593-b386-a7dfdc2e9fc6",
+		},
+		{
+			// An un-marshalled json object string should return the same as a string without error also
+			object:   []byte(jsonobject),
+			expected: jsonobject,
+		},
+	}
+
+	conn := DbConnection{}
+
+	for _, test := range tests {
+		t.Run(fmt.Sprintf("%s -> %s", test.object, test.expected), func(t *testing.T) {
+			var object string
+			err := conn.UnmarshalObject(test.object, &object)
+			require.NoError(t, err)
+			is.Equal(test.expected, object)
+		})
+	}
+}
+
+func Test_ObjectMarshallingEncrypted(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	// Based on actual data entering and what we expect out of the function
+
+	tests := []struct {
+		object   []byte
+		expected string
+	}{
+		{
+			object: []byte(""),
+		},
+		{
+			object: []byte("35"),
+		},
+		{
+			// An unmarshalled byte string should return the same without error
+			object: []byte("9ca4a1dd-a439-4593-b386-a7dfdc2e9fc6"),
+		},
+		{
+			// An un-marshalled json object string should return the same as a string without error also
+			object: []byte(jsonobject),
+		},
+	}
+
+	key := secretToEncryptionKey(passphrase)
+	conn := DbConnection{EncryptionKey: key}
+	err := conn.SetEncrypted(true)
+	require.NoError(t, err)
+
+	for _, test := range tests {
+		t.Run(fmt.Sprintf("%s -> %s", test.object, test.expected), func(t *testing.T) {
+
+			data, err := conn.MarshalObject(test.object)
+			require.NoError(t, err)
+
+			var object []byte
+			err = conn.UnmarshalObject(data, &object)
+
+			require.NoError(t, err)
+			is.Equal(test.object, object)
+		})
+	}
+}
+
+func Test_NonceSources(t *testing.T) {
+	t.Parallel()
+	// ensure that the new go 1.24 NewGCMWithRandomNonce works correctly with
+	// the old way of creating and including the nonce
+
+	encryptOldFn := func(plaintext []byte, passphrase []byte) (encrypted []byte, err error) {
+		block, _ := aes.NewCipher(passphrase)
+		gcm, err := cipher.NewGCM(block)
+		if err != nil {
+			return encrypted, err
+		}
+
+		nonce := make([]byte, gcm.NonceSize())
+		if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
+			return encrypted, err
+		}
+
+		return gcm.Seal(nonce, nonce, plaintext, nil), nil
+	}
+
+	decryptOldFn := func(encrypted []byte, passphrase []byte) (plaintext []byte, err error) {
+		block, err := aes.NewCipher(passphrase)
+		if err != nil {
+			return encrypted, errors.Wrap(err, "Error creating cypher block")
+		}
+
+		gcm, err := cipher.NewGCM(block)
+		if err != nil {
+			return encrypted, errors.Wrap(err, "Error creating GCM")
+		}
+
+		nonceSize := gcm.NonceSize()
+		if len(encrypted) < nonceSize {
+			return encrypted, errEncryptedStringTooShort
+		}
+
+		nonce, ciphertextByteClean := encrypted[:nonceSize], encrypted[nonceSize:]
+
+		plaintext, err = gcm.Open(nil, nonce, ciphertextByteClean, nil)
+		if err != nil {
+			return encrypted, errors.Wrap(err, "Error decrypting text")
+		}
+
+		return plaintext, err
+	}
+
+	passphrase := make([]byte, 32)
+	_, err := io.ReadFull(rand.Reader, passphrase)
+	require.NoError(t, err)
+
+	block, err := aes.NewCipher(passphrase)
+	require.NoError(t, err)
+
+	gcm, err := cipher.NewGCMWithRandomNonce(block)
+	require.NoError(t, err)
+
+	junk := make([]byte, 1024)
+	_, err = io.ReadFull(rand.Reader, junk)
+	require.NoError(t, err)
+
+	junkEnc := make([]byte, base64.StdEncoding.EncodedLen(len(junk)))
+	base64.StdEncoding.Encode(junkEnc, junk)
+
+	cases := [][]byte{
+		[]byte("test"),
+		[]byte("35"),
+		[]byte("9ca4a1dd-a439-4593-b386-a7dfdc2e9fc6"),
+		[]byte(jsonobject),
+		passphrase,
+		junk,
+		junkEnc,
+	}
+
+	for _, plain := range cases {
+		var enc, dec []byte
+		var err error
+
+		enc, err = encryptOldFn(plain, passphrase)
+		require.NoError(t, err)
+
+		dec, err = decrypt(enc, gcm)
+		require.NoError(t, err)
+
+		require.Equal(t, plain, dec)
+
+		enc = encrypt(plain, gcm)
+
+		dec, err = decryptOldFn(enc, passphrase)
+		require.NoError(t, err)
+
+		require.Equal(t, plain, dec)
+	}
+}
+
+func TestDecrypt_FalseStringBypassesDecryption(t *testing.T) {
+	t.Parallel()
+
+	key := secretToEncryptionKey(passphrase)
+	block, err := aes.NewCipher(key)
+	require.NoError(t, err)
+
+	gcm, err := cipher.NewGCMWithRandomNonce(block)
+	require.NoError(t, err)
+
+	result, err := decrypt([]byte("false"), gcm)
+	require.NoError(t, err)
+	require.Equal(t, []byte("false"), result)
+}
+
+func TestDecrypt_ShortDataReturnsError(t *testing.T) {
+	t.Parallel()
+
+	key := secretToEncryptionKey(passphrase)
+	block, err := aes.NewCipher(key)
+	require.NoError(t, err)
+
+	gcm, err := cipher.NewGCMWithRandomNonce(block)
+	require.NoError(t, err)
+
+	short := []byte("short")
+	result, err := decrypt(short, gcm)
+	require.ErrorIs(t, err, errEncryptedStringTooShort)
+	require.Equal(t, short, result)
+}
+
+func TestDecrypt_CorruptDataReturnsError(t *testing.T) {
+	t.Parallel()
+
+	key := secretToEncryptionKey(passphrase)
+	block, err := aes.NewCipher(key)
+	require.NoError(t, err)
+
+	gcm, err := cipher.NewGCMWithRandomNonce(block)
+	require.NoError(t, err)
+
+	// 30 bytes passes the length check but fails authentication
+	corrupted := make([]byte, 30)
+	_, err = io.ReadFull(rand.Reader, corrupted)
+	require.NoError(t, err)
+
+	result, err := decrypt(corrupted, gcm)
+	require.Error(t, err)
+	require.Equal(t, corrupted, result)
+}
+
+// BenchmarkEncryptCachedCipher measures the new approach: cipher created once and reused.
+func BenchmarkEncryptCachedCipher(b *testing.B) {
+	key := secretToEncryptionKey(passphrase)
+	conn := DbConnection{EncryptionKey: key}
+	err := conn.SetEncrypted(true)
+	require.NoError(b, err)
+
+	data := []byte(jsonobject)
+
+	b.ResetTimer()
+
+	for b.Loop() {
+		_ = encrypt(data, conn.gcm)
+	}
+}
+
+// BenchmarkEncryptPerCallCipher measures the old approach: cipher created on every call.
+func BenchmarkEncryptPerCallCipher(b *testing.B) {
+	key := secretToEncryptionKey(passphrase)
+	data := []byte(jsonobject)
+
+	b.ResetTimer()
+
+	for b.Loop() {
+		block, err := aes.NewCipher(key)
+		if err != nil {
+			b.Fatal(err)
+		}
+
+		gcm, err := cipher.NewGCMWithRandomNonce(block)
+		if err != nil {
+			b.Fatal(err)
+		}
+
+		_ = gcm.Seal(nil, nil, data, nil)
+	}
+}
+
+// BenchmarkEncryptCachedCipherParallel verifies the cached cipher is safe for concurrent use.
+func BenchmarkEncryptCachedCipherParallel(b *testing.B) {
+	key := secretToEncryptionKey(passphrase)
+	conn := DbConnection{EncryptionKey: key}
+	err := conn.SetEncrypted(true)
+	require.NoError(b, err)
+
+	data := []byte(jsonobject)
+
+	b.ResetTimer()
+
+	b.RunParallel(func(pb *testing.PB) {
+		for pb.Next() {
+			_ = encrypt(data, conn.gcm)
+		}
+	})
+}
diff --git a/api/database/boltdb/tx.go b/api/database/boltdb/tx.go
new file mode 100644
index 0000000..3e8e9ca
--- /dev/null
+++ b/api/database/boltdb/tx.go
@@ -0,0 +1,179 @@
+package boltdb
+
+import (
+	"bytes"
+	"fmt"
+
+	dserrors "github.com/portainer/portainer/api/dataservices/errors"
+
+	"github.com/pkg/errors"
+	"github.com/rs/zerolog/log"
+	bolt "go.etcd.io/bbolt"
+)
+
+type DbTransaction struct {
+	conn *DbConnection
+	tx   *bolt.Tx
+}
+
+func (tx *DbTransaction) SetServiceName(bucketName string) error {
+	_, err := tx.tx.CreateBucketIfNotExists([]byte(bucketName))
+	return err
+}
+
+func (tx *DbTransaction) GetObject(bucketName string, key []byte, object any) error {
+	bucket := tx.tx.Bucket([]byte(bucketName))
+
+	value := bucket.Get(key)
+	if value == nil {
+		return fmt.Errorf("%w (bucket=%s, key=%s)", dserrors.ErrObjectNotFound, bucketName, keyToString(key))
+	}
+
+	return tx.conn.UnmarshalObject(value, object)
+}
+
+func (tx *DbTransaction) GetRawBytes(bucketName string, key []byte) ([]byte, error) {
+	bucket := tx.tx.Bucket([]byte(bucketName))
+
+	value := bucket.Get(key)
+	if value == nil {
+		return nil, fmt.Errorf("%w (bucket=%s, key=%s)", dserrors.ErrObjectNotFound, bucketName, keyToString(key))
+	}
+
+	if tx.conn.gcm != nil {
+		var err error
+
+		if value, err = decrypt(value, tx.conn.gcm); err != nil {
+			return value, errors.Wrap(err, "Failed decrypting object")
+		}
+	}
+
+	return value, nil
+}
+
+func (tx *DbTransaction) KeyExists(bucketName string, key []byte) (bool, error) {
+	bucket := tx.tx.Bucket([]byte(bucketName))
+
+	value := bucket.Get(key)
+
+	return value != nil, nil
+}
+
+func (tx *DbTransaction) UpdateObject(bucketName string, key []byte, object any) error {
+	data, err := tx.conn.MarshalObject(object)
+	if err != nil {
+		return err
+	}
+
+	bucket := tx.tx.Bucket([]byte(bucketName))
+	return bucket.Put(key, data)
+}
+
+func (tx *DbTransaction) DeleteObject(bucketName string, key []byte) error {
+	bucket := tx.tx.Bucket([]byte(bucketName))
+	return bucket.Delete(key)
+}
+
+func (tx *DbTransaction) DeleteAllObjects(bucketName string, obj any, matchingFn func(o any) (id int, ok bool)) error {
+	var ids []int
+
+	bucket := tx.tx.Bucket([]byte(bucketName))
+
+	cursor := bucket.Cursor()
+	for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+		err := tx.conn.UnmarshalObject(v, &obj)
+		if err != nil {
+			return err
+		}
+
+		if id, ok := matchingFn(obj); ok {
+			ids = append(ids, id)
+		}
+	}
+
+	for _, id := range ids {
+		if err := bucket.Delete(tx.conn.ConvertToKey(id)); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (tx *DbTransaction) GetNextIdentifier(bucketName string) int {
+	bucket := tx.tx.Bucket([]byte(bucketName))
+
+	id, err := bucket.NextSequence()
+	if err != nil {
+		log.Error().Err(err).Str("bucket", bucketName).Msg("failed to get the next identifier")
+
+		return 0
+	}
+
+	return int(id)
+}
+
+func (tx *DbTransaction) CreateObject(bucketName string, fn func(uint64) (int, any)) error {
+	bucket := tx.tx.Bucket([]byte(bucketName))
+
+	seqId, _ := bucket.NextSequence()
+	id, obj := fn(seqId)
+
+	data, err := tx.conn.MarshalObject(obj)
+	if err != nil {
+		return err
+	}
+
+	return bucket.Put(tx.conn.ConvertToKey(id), data)
+}
+
+func (tx *DbTransaction) CreateObjectWithId(bucketName string, id int, obj any) error {
+	bucket := tx.tx.Bucket([]byte(bucketName))
+	data, err := tx.conn.MarshalObject(obj)
+	if err != nil {
+		return err
+	}
+
+	return bucket.Put(tx.conn.ConvertToKey(id), data)
+}
+
+func (tx *DbTransaction) CreateObjectWithStringId(bucketName string, id []byte, obj any) error {
+	bucket := tx.tx.Bucket([]byte(bucketName))
+	data, err := tx.conn.MarshalObject(obj)
+	if err != nil {
+		return err
+	}
+
+	return bucket.Put(id, data)
+}
+
+func (tx *DbTransaction) GetAll(bucketName string, obj any, appendFn func(o any) (any, error)) error {
+	bucket := tx.tx.Bucket([]byte(bucketName))
+
+	return bucket.ForEach(func(k []byte, v []byte) error {
+		err := tx.conn.UnmarshalObject(v, obj)
+		if err == nil {
+			obj, err = appendFn(obj)
+		}
+
+		return err
+	})
+}
+
+func (tx *DbTransaction) GetAllWithKeyPrefix(bucketName string, keyPrefix []byte, obj any, appendFn func(o any) (any, error)) error {
+	cursor := tx.tx.Bucket([]byte(bucketName)).Cursor()
+
+	for k, v := cursor.Seek(keyPrefix); k != nil && bytes.HasPrefix(k, keyPrefix); k, v = cursor.Next() {
+		err := tx.conn.UnmarshalObject(v, obj)
+		if err != nil {
+			return err
+		}
+
+		obj, err = appendFn(obj)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
diff --git a/api/database/boltdb/tx_test.go b/api/database/boltdb/tx_test.go
new file mode 100644
index 0000000..6bbfb2f
--- /dev/null
+++ b/api/database/boltdb/tx_test.go
@@ -0,0 +1,160 @@
+package boltdb
+
+import (
+	"errors"
+	"strconv"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/stretchr/testify/require"
+)
+
+const testBucketName = "test-bucket"
+const testId = 1234
+
+type testStruct struct {
+	Key   string
+	Value string
+}
+
+func TestTxs(t *testing.T) {
+	t.Parallel()
+	conn := DbConnection{Path: t.TempDir()}
+
+	err := conn.Open()
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		err := conn.Close()
+		require.NoError(t, err)
+	})
+
+	// Error propagation
+	err = conn.UpdateTx(func(tx portainer.Transaction) error {
+		return errors.New("this is an error")
+	})
+	require.Error(t, err)
+
+	// Create an object
+	newObj := testStruct{Key: "key", Value: "value"}
+
+	err = conn.UpdateTx(func(tx portainer.Transaction) error {
+		if err := tx.SetServiceName(testBucketName); err != nil {
+			return err
+		}
+
+		return tx.CreateObjectWithId(testBucketName, testId, newObj)
+	})
+	require.NoError(t, err)
+
+	obj := testStruct{}
+	err = conn.ViewTx(func(tx portainer.Transaction) error {
+		return tx.GetObject(testBucketName, conn.ConvertToKey(testId), &obj)
+	})
+	require.NoError(t, err)
+
+	if obj.Key != newObj.Key || obj.Value != newObj.Value {
+		t.Fatalf("expected %s:%s, got %s:%s instead", newObj.Key, newObj.Value, obj.Key, obj.Value)
+	}
+
+	// Update an object
+	updatedObj := testStruct{Key: "updated-key", Value: "updated-value"}
+
+	err = conn.UpdateTx(func(tx portainer.Transaction) error {
+		return tx.UpdateObject(testBucketName, conn.ConvertToKey(testId), &updatedObj)
+	})
+	require.NoError(t, err)
+
+	err = conn.ViewTx(func(tx portainer.Transaction) error {
+		return tx.GetObject(testBucketName, conn.ConvertToKey(testId), &obj)
+	})
+	require.NoError(t, err)
+
+	if obj.Key != updatedObj.Key || obj.Value != updatedObj.Value {
+		t.Fatalf("expected %s:%s, got %s:%s instead", updatedObj.Key, updatedObj.Value, obj.Key, obj.Value)
+	}
+
+	// Delete an object
+	err = conn.UpdateTx(func(tx portainer.Transaction) error {
+		return tx.DeleteObject(testBucketName, conn.ConvertToKey(testId))
+	})
+	require.NoError(t, err)
+
+	err = conn.ViewTx(func(tx portainer.Transaction) error {
+		return tx.GetObject(testBucketName, conn.ConvertToKey(testId), &obj)
+	})
+	require.True(t, dataservices.IsErrObjectNotFound(err))
+
+	// Get next identifier
+	err = conn.UpdateTx(func(tx portainer.Transaction) error {
+		id1 := tx.GetNextIdentifier(testBucketName)
+		id2 := tx.GetNextIdentifier(testBucketName)
+
+		if id1+1 != id2 {
+			return errors.New("unexpected identifier sequence")
+		}
+
+		return nil
+	})
+	require.NoError(t, err)
+
+	// Try to write in a read transaction
+	err = conn.ViewTx(func(tx portainer.Transaction) error {
+		return tx.CreateObjectWithId(testBucketName, testId, newObj)
+	})
+	require.Error(t, err)
+}
+
+func BenchmarkGetAll(b *testing.B) {
+	const endpointBucket = "endpoints"
+	const n = 10000
+
+	conn := DbConnection{Path: b.TempDir()}
+
+	err := conn.Open()
+	require.NoError(b, err)
+	b.Cleanup(func() {
+		err := conn.Close()
+		require.NoError(b, err)
+	})
+
+	err = conn.UpdateTx(func(tx portainer.Transaction) error {
+		if err := tx.SetServiceName(endpointBucket); err != nil {
+			return err
+		}
+
+		for i := 1; i <= n; i++ {
+			ep := portainer.Endpoint{
+				ID:              portainer.EndpointID(i),
+				Name:            "env-" + strconv.Itoa(i),
+				Type:            portainer.DockerEnvironment,
+				URL:             "tcp://192.168.1." + strconv.Itoa(i%254+1) + ":2375",
+				PublicURL:       "https://env-" + strconv.Itoa(i) + ".example.com",
+				GroupID:         portainer.EndpointGroupID(i%10 + 1),
+				TagIDs:          []portainer.TagID{portainer.TagID(i%5 + 1), portainer.TagID(i%3 + 1)},
+				LastCheckInDate: int64(i) * 1000,
+				EdgeID:          "edge-" + strconv.Itoa(i),
+			}
+
+			if err := tx.CreateObjectWithId(endpointBucket, i, &ep); err != nil {
+				return err
+			}
+		}
+
+		return nil
+	})
+	require.NoError(b, err)
+
+	b.ResetTimer()
+	b.ReportAllocs()
+
+	for b.Loop() {
+		var collection []portainer.Endpoint
+
+		if err := conn.ViewTx(func(tx portainer.Transaction) error {
+			return tx.GetAll(endpointBucket, new(portainer.Endpoint), dataservices.AppendFn(&collection))
+		}); err != nil {
+			b.Fatal(err)
+		}
+	}
+}
diff --git a/api/database/database.go b/api/database/database.go
new file mode 100644
index 0000000..c3c3cc2
--- /dev/null
+++ b/api/database/database.go
@@ -0,0 +1,21 @@
+package database
+
+import (
+	"fmt"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/database/boltdb"
+)
+
+// NewDatabase should use config options to return a connection to the requested database
+func NewDatabase(storeType, storePath string, encryptionKey []byte, compact bool) (connection portainer.Connection, err error) {
+	if storeType == "boltdb" {
+		return &boltdb.DbConnection{
+			Path:          storePath,
+			EncryptionKey: encryptionKey,
+			Compact:       compact,
+		}, nil
+	}
+
+	return nil, fmt.Errorf("Unknown storage database: %s", storeType)
+}
diff --git a/api/database/database_test.go b/api/database/database_test.go
new file mode 100644
index 0000000..340f69c
--- /dev/null
+++ b/api/database/database_test.go
@@ -0,0 +1,25 @@
+package database
+
+import (
+	"testing"
+
+	"github.com/portainer/portainer/api/database/boltdb"
+	"github.com/portainer/portainer/api/filesystem"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestNewDatabase(t *testing.T) {
+	t.Parallel()
+	dbPath := filesystem.JoinPaths(t.TempDir(), "test.db")
+	connection, err := NewDatabase("boltdb", dbPath, nil, false)
+	require.NoError(t, err)
+	require.NotNil(t, connection)
+
+	_, ok := connection.(*boltdb.DbConnection)
+	require.True(t, ok)
+
+	connection, err = NewDatabase("unknown", dbPath, nil, false)
+	require.Error(t, err)
+	require.Nil(t, connection)
+}
diff --git a/api/database/models/version.go b/api/database/models/version.go
new file mode 100644
index 0000000..a84e04e
--- /dev/null
+++ b/api/database/models/version.go
@@ -0,0 +1,8 @@
+package models
+
+type Version struct {
+	SchemaVersion string
+	MigratorCount int
+	Edition       int
+	InstanceID    string
+}
diff --git a/api/dataservices/allowlist/allowlist.go b/api/dataservices/allowlist/allowlist.go
new file mode 100644
index 0000000..adaa885
--- /dev/null
+++ b/api/dataservices/allowlist/allowlist.go
@@ -0,0 +1,131 @@
+package allowlist
+
+import (
+	"fmt"
+
+	lru "github.com/hashicorp/golang-lru"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/pkg/libhttp/ssrf"
+)
+
+const (
+	BucketName = "allowlist"
+)
+
+type Service struct {
+	baseService dataservices.BaseDataService[portainer.AllowList, portainer.AllowListKey]
+	cache       *lru.Cache
+}
+
+func (service *Service) BucketName() string {
+	return service.baseService.BucketName()
+}
+
+func NewService(connection portainer.Connection) (*Service, error) {
+	err := connection.SetServiceName(BucketName)
+	if err != nil {
+		return nil, err
+	}
+
+	service := &Service{
+		baseService: dataservices.BaseDataService[portainer.AllowList, portainer.AllowListKey]{
+			Bucket:     BucketName,
+			Connection: connection,
+		},
+	}
+
+	err = service.populateCache()
+
+	return service, err
+}
+
+func (service *Service) populateCache() error {
+	allowListKeys := []portainer.AllowListKey{portainer.AllowListSSRF}
+	cache, err := lru.New(len(allowListKeys))
+	if err != nil {
+		return err
+	}
+
+	for _, k := range allowListKeys {
+		allowList, err := service.baseService.Read(k)
+		if dataservices.IsErrObjectNotFound(err) {
+			allowList = &portainer.AllowList{
+				ID:      k,
+				Mode:    portainer.SSRFModeOff,
+				Entries: []string{},
+			}
+		} else if err != nil {
+			return err
+		}
+
+		parsedAllowList := ssrf.ParseAllowedHosts(allowList.Entries)
+		parsedAllowList.Mode = allowList.Mode
+
+		cache.Add(k, &parsedAllowList)
+	}
+
+	service.cache = cache
+
+	return nil
+}
+
+func (service *Service) Tx(tx portainer.Transaction) *ServiceTx {
+	return &ServiceTx{
+		baseService: service.baseService.Tx(tx),
+		cache:       service.cache,
+	}
+}
+
+func (service *Service) Read(id portainer.AllowListKey) (*portainer.AllowList, error) {
+	var result *portainer.AllowList
+	if err := service.baseService.Connection.ViewTx(func(tx portainer.Transaction) error {
+		var err error
+		result, err = service.Tx(tx).Read(id)
+		return err
+	}); err != nil {
+		return nil, err
+	}
+
+	return result, nil
+}
+
+func (service *Service) ReadAll() ([]portainer.AllowList, error) {
+	var result []portainer.AllowList
+	if err := service.baseService.Connection.ViewTx(func(tx portainer.Transaction) error {
+		var err error
+		result, err = service.Tx(tx).ReadAll()
+		return err
+	}); err != nil {
+		return nil, err
+	}
+
+	return result, nil
+}
+
+func (service *Service) ReadParsed(id portainer.AllowListKey) (*portainer.ParsedAllowList, error) {
+	allowListAny, ok := service.cache.Get(id)
+	if ok {
+		allowList, ok := allowListAny.(*portainer.ParsedAllowList)
+		if !ok {
+			return nil, fmt.Errorf("expected ParsedAllowList in cache but got %T", allowListAny)
+		}
+
+		return allowList, nil
+	}
+
+	var result *portainer.ParsedAllowList
+	err := service.baseService.Connection.ViewTx(func(tx portainer.Transaction) error {
+		var err error
+		result, err = service.Tx(tx).ReadParsed(id)
+		return err
+	})
+
+	return result, err
+}
+
+func (service *Service) Update(id portainer.AllowListKey, allowList *portainer.AllowList) error {
+	return service.baseService.Connection.UpdateTx(func(tx portainer.Transaction) error {
+		return service.Tx(tx).Update(id, allowList)
+	})
+}
diff --git a/api/dataservices/allowlist/allowlist_test.go b/api/dataservices/allowlist/allowlist_test.go
new file mode 100644
index 0000000..480f369
--- /dev/null
+++ b/api/dataservices/allowlist/allowlist_test.go
@@ -0,0 +1,89 @@
+package allowlist_test
+
+import (
+	"net"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/stretchr/testify/require"
+)
+
+func TestAllowListReadEmpty(t *testing.T) {
+	t.Parallel()
+	_, ds := datastore.MustNewTestStore(t, false, false)
+	got, err := ds.AllowList().Read(portainer.AllowListSSRF)
+	expected := &portainer.AllowList{
+		ID:      portainer.AllowListSSRF,
+		Mode:    portainer.SSRFModeOff,
+		Entries: []string{},
+	}
+	require.NoError(t, err)
+	require.Equal(t, expected, got)
+}
+
+func TestAllowListUpdate(t *testing.T) {
+	t.Parallel()
+	_, ds := datastore.MustNewTestStore(t, false, false)
+
+	expected := &portainer.AllowList{
+		ID:      portainer.AllowListSSRF,
+		Mode:    portainer.SSRFModeEnforce,
+		Entries: []string{"example.com", "10.0.0.0/8"},
+	}
+
+	require.NoError(t, ds.AllowList().Update(portainer.AllowListSSRF, expected))
+
+	got, err := ds.AllowList().Read(portainer.AllowListSSRF)
+	require.NoError(t, err)
+	require.Equal(t, expected, got)
+}
+
+func TestAllowListReadAllEmpty(t *testing.T) {
+	t.Parallel()
+	_, ds := datastore.MustNewTestStore(t, false, false)
+
+	got, err := ds.AllowList().ReadAll()
+	require.NoError(t, err)
+	require.Equal(t, []portainer.AllowList{}, got)
+}
+
+func TestAllowListReadAllAfterUpdate(t *testing.T) {
+	t.Parallel()
+	_, ds := datastore.MustNewTestStore(t, false, false)
+
+	expected := portainer.AllowList{
+		ID:      portainer.AllowListSSRF,
+		Mode:    portainer.SSRFModeEnforce,
+		Entries: []string{"example.com", "10.0.0.0/8"},
+	}
+
+	require.NoError(t, ds.AllowList().Update(portainer.AllowListSSRF, &expected))
+
+	got, err := ds.AllowList().ReadAll()
+	require.NoError(t, err)
+	require.Equal(t, []portainer.AllowList{expected}, got)
+}
+
+func TestAllowListReadParsedAfterUpdate(t *testing.T) {
+	t.Parallel()
+	_, ds := datastore.MustNewTestStore(t, false, false)
+
+	require.NoError(t, ds.AllowList().Update(portainer.AllowListSSRF, &portainer.AllowList{
+		ID:      portainer.AllowListSSRF,
+		Mode:    portainer.SSRFModeEnforce,
+		Entries: []string{"example.com"},
+	}))
+
+	expected := &portainer.ParsedAllowList{
+		Mode: portainer.SSRFModeEnforce,
+		Nets: []*net.IPNet{},
+		Hosts: map[string]bool{
+			"example.com": true,
+		},
+	}
+
+	got, err := ds.AllowList().ReadParsed(portainer.AllowListSSRF)
+	require.NoError(t, err)
+	require.Equal(t, expected, got)
+}
diff --git a/api/dataservices/allowlist/tx.go b/api/dataservices/allowlist/tx.go
new file mode 100644
index 0000000..dcf49a5
--- /dev/null
+++ b/api/dataservices/allowlist/tx.go
@@ -0,0 +1,77 @@
+package allowlist
+
+import (
+	"fmt"
+
+	lru "github.com/hashicorp/golang-lru"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/pkg/libhttp/ssrf"
+)
+
+type ServiceTx struct {
+	baseService dataservices.BaseDataServiceTx[portainer.AllowList, portainer.AllowListKey]
+	cache       *lru.Cache
+}
+
+func (service *ServiceTx) BucketName() string {
+	return service.baseService.BucketName()
+}
+
+func (service *ServiceTx) ReadParsed(id portainer.AllowListKey) (*portainer.ParsedAllowList, error) {
+	allowListAny, ok := service.cache.Get(id)
+	if ok {
+		allowList, ok := allowListAny.(*portainer.ParsedAllowList)
+		if !ok {
+			return nil, fmt.Errorf("expected ParsedAllowList in cache but got %T", allowListAny)
+		}
+
+		return allowList, nil
+	}
+
+	allowList, err := service.Read(id)
+	if err != nil {
+		return nil, err
+	}
+
+	parsed := ssrf.ParseAllowedHosts(allowList.Entries)
+	parsed.Mode = allowList.Mode
+	service.cache.Add(id, &parsed)
+
+	return &parsed, nil
+}
+
+func (service *ServiceTx) Read(id portainer.AllowListKey) (*portainer.AllowList, error) {
+	allowList, err := service.baseService.Read(id)
+	if dataservices.IsErrObjectNotFound(err) {
+		allowList = &portainer.AllowList{
+			ID:      id,
+			Mode:    portainer.SSRFModeOff,
+			Entries: []string{},
+		}
+	} else if err != nil {
+		return nil, err
+	}
+
+	return allowList, nil
+}
+
+func (service *ServiceTx) ReadAll() ([]portainer.AllowList, error) {
+	allowLists, err := service.baseService.ReadAll()
+	if err != nil && !dataservices.IsErrObjectNotFound(err) {
+		return nil, err
+	}
+
+	return allowLists, nil
+}
+
+func (service *ServiceTx) Update(id portainer.AllowListKey, allowList *portainer.AllowList) error {
+	if err := service.baseService.Update(id, allowList); err != nil {
+		return err
+	}
+
+	parsed := ssrf.ParseAllowedHosts(allowList.Entries)
+	parsed.Mode = allowList.Mode
+	service.cache.Add(id, &parsed)
+	return nil
+}
diff --git a/api/dataservices/allowlist/tx_test.go b/api/dataservices/allowlist/tx_test.go
new file mode 100644
index 0000000..3b00345
--- /dev/null
+++ b/api/dataservices/allowlist/tx_test.go
@@ -0,0 +1,92 @@
+package allowlist_test
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/stretchr/testify/require"
+)
+
+func TestAllowListReadTx(t *testing.T) {
+	t.Parallel()
+	_, ds := datastore.MustNewTestStore(t, false, false)
+
+	var got *portainer.AllowList
+	require.NoError(t, ds.ViewTx(func(tx dataservices.DataStoreTx) error {
+		var err error
+		got, err = tx.AllowList().Read(portainer.AllowListSSRF)
+		return err
+	}))
+
+	expected := &portainer.AllowList{
+		ID:      portainer.AllowListSSRF,
+		Mode:    portainer.SSRFModeOff,
+		Entries: []string{},
+	}
+
+	require.Equal(t, expected, got)
+}
+
+func TestAllowListReadAllEmptyTx(t *testing.T) {
+	t.Parallel()
+	_, ds := datastore.MustNewTestStore(t, false, false)
+
+	var got []portainer.AllowList
+	require.NoError(t, ds.ViewTx(func(tx dataservices.DataStoreTx) error {
+		var err error
+		got, err = tx.AllowList().ReadAll()
+		return err
+	}))
+
+	require.Equal(t, []portainer.AllowList{}, got)
+}
+
+func TestAllowListReadAllAfterUpdateTx(t *testing.T) {
+	t.Parallel()
+	_, ds := datastore.MustNewTestStore(t, false, false)
+
+	expected := portainer.AllowList{
+		ID:      portainer.AllowListSSRF,
+		Mode:    portainer.SSRFModeEnforce,
+		Entries: []string{"example.com"},
+	}
+
+	require.NoError(t, ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.AllowList().Update(portainer.AllowListSSRF, &expected)
+	}))
+
+	var got []portainer.AllowList
+	require.NoError(t, ds.ViewTx(func(tx dataservices.DataStoreTx) error {
+		var err error
+		got, err = tx.AllowList().ReadAll()
+		return err
+	}))
+
+	require.Equal(t, []portainer.AllowList{expected}, got)
+}
+
+func TestAllowListUpdateTx(t *testing.T) {
+	t.Parallel()
+	_, ds := datastore.MustNewTestStore(t, false, false)
+
+	expected := &portainer.AllowList{
+		ID:      portainer.AllowListSSRF,
+		Mode:    portainer.SSRFModeEnforce,
+		Entries: []string{"example.com"},
+	}
+
+	require.NoError(t, ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.AllowList().Update(portainer.AllowListSSRF, expected)
+	}))
+
+	var got *portainer.AllowList
+	require.NoError(t, ds.ViewTx(func(tx dataservices.DataStoreTx) error {
+		var err error
+		got, err = tx.AllowList().Read(portainer.AllowListSSRF)
+		return err
+	}))
+
+	require.Equal(t, expected, got)
+}
diff --git a/api/dataservices/apikeyrepository/apikeyrepository.go b/api/dataservices/apikeyrepository/apikeyrepository.go
new file mode 100644
index 0000000..1b03585
--- /dev/null
+++ b/api/dataservices/apikeyrepository/apikeyrepository.go
@@ -0,0 +1,82 @@
+package apikeyrepository
+
+import (
+	"errors"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	dserrors "github.com/portainer/portainer/api/dataservices/errors"
+)
+
+// BucketName represents the name of the bucket where this service stores data.
+const BucketName = "api_key"
+
+// Service represents a service for managing api-key data.
+type Service struct {
+	dataservices.BaseDataService[portainer.APIKey, portainer.APIKeyID]
+}
+
+// NewService creates a new instance of a service.
+func NewService(connection portainer.Connection) (*Service, error) {
+	if err := connection.SetServiceName(BucketName); err != nil {
+		return nil, err
+	}
+
+	return &Service{
+		BaseDataService: dataservices.BaseDataService[portainer.APIKey, portainer.APIKeyID]{
+			Bucket:     BucketName,
+			Connection: connection,
+		},
+	}, nil
+}
+
+// GetAPIKeysByUserID returns a slice containing all the APIKeys a user has access to.
+func (service *Service) GetAPIKeysByUserID(userID portainer.UserID) ([]portainer.APIKey, error) {
+	result := make([]portainer.APIKey, 0)
+
+	err := service.Connection.GetAll(
+		BucketName,
+		&portainer.APIKey{},
+		dataservices.FilterFn(&result, func(record portainer.APIKey) bool {
+			return record.UserID == userID
+		}),
+	)
+
+	return result, err
+}
+
+// GetAPIKeyByDigest returns the API key for the associated digest.
+// Note: there is a 1-to-1 mapping of api-key and digest
+func (service *Service) GetAPIKeyByDigest(digest string) (*portainer.APIKey, error) {
+	var found portainer.APIKey
+
+	err := service.Connection.GetAll(
+		BucketName,
+		&portainer.APIKey{},
+		dataservices.FirstFn(&found, func(key portainer.APIKey) bool {
+			return key.Digest == digest
+		}),
+	)
+
+	if errors.Is(err, dataservices.ErrStop) {
+		return &found, nil
+	}
+
+	if err == nil {
+		return nil, dserrors.ErrObjectNotFound
+	}
+
+	return nil, err
+}
+
+// Create creates a new APIKey object.
+func (service *Service) Create(record *portainer.APIKey) error {
+	return service.Connection.CreateObject(
+		BucketName,
+		func(id uint64) (int, any) {
+			record.ID = portainer.APIKeyID(id)
+
+			return int(record.ID), record
+		},
+	)
+}
diff --git a/api/dataservices/base.go b/api/dataservices/base.go
new file mode 100644
index 0000000..18839b6
--- /dev/null
+++ b/api/dataservices/base.go
@@ -0,0 +1,81 @@
+package dataservices
+
+import (
+	portainer "github.com/portainer/portainer/api"
+
+	"golang.org/x/exp/constraints"
+)
+
+type BaseCRUD[T any, I constraints.Integer] interface {
+	Create(element *T) error
+	Read(ID I) (*T, error)
+	Exists(ID I) (bool, error)
+	ReadAll(predicates ...func(T) bool) ([]T, error)
+	Update(ID I, element *T) error
+	Delete(ID I) error
+}
+
+type BaseDataService[T any, I constraints.Integer] struct {
+	Bucket     string
+	Connection portainer.Connection
+}
+
+func (s *BaseDataService[T, I]) BucketName() string {
+	return s.Bucket
+}
+
+func (service *BaseDataService[T, I]) Tx(tx portainer.Transaction) BaseDataServiceTx[T, I] {
+	return BaseDataServiceTx[T, I]{
+		Bucket:     service.Bucket,
+		Connection: service.Connection,
+		Tx:         tx,
+	}
+}
+
+func (service BaseDataService[T, I]) Read(ID I) (*T, error) {
+	var element *T
+
+	return element, service.Connection.ViewTx(func(tx portainer.Transaction) error {
+		var err error
+		element, err = service.Tx(tx).Read(ID)
+
+		return err
+	})
+}
+
+func (service BaseDataService[T, I]) Exists(ID I) (bool, error) {
+	var exists bool
+
+	err := service.Connection.ViewTx(func(tx portainer.Transaction) error {
+		var err error
+		exists, err = service.Tx(tx).Exists(ID)
+
+		return err
+	})
+
+	return exists, err
+}
+
+// ReadAll retrieves all the elements that satisfy all the provided predicates.
+func (service BaseDataService[T, I]) ReadAll(predicates ...func(T) bool) ([]T, error) {
+	var collection = make([]T, 0)
+
+	return collection, service.Connection.ViewTx(func(tx portainer.Transaction) error {
+		var err error
+		collection, err = service.Tx(tx).ReadAll(predicates...)
+
+		return err
+	})
+}
+
+func (service BaseDataService[T, I]) Update(ID I, element *T) error {
+	return service.Connection.UpdateTx(func(tx portainer.Transaction) error {
+		return service.Tx(tx).Update(ID, element)
+	})
+}
+
+func (service BaseDataService[T, I]) Delete(ID I) error {
+	return service.Connection.UpdateTx(func(tx portainer.Transaction) error {
+		return service.Tx(tx).Delete(ID)
+	})
+}
diff --git a/api/dataservices/base_test.go b/api/dataservices/base_test.go
new file mode 100644
index 0000000..da849b4
--- /dev/null
+++ b/api/dataservices/base_test.go
@@ -0,0 +1,92 @@
+package dataservices
+
+import (
+	"strconv"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/slicesx"
+
+	"github.com/stretchr/testify/require"
+)
+
+type testObject struct {
+	ID    int
+	Value int
+}
+
+type mockConnection struct {
+	store map[int]testObject
+
+	portainer.Connection
+}
+
+func (m mockConnection) UpdateObject(bucket string, key []byte, value any) error {
+	obj := value.(*testObject)
+
+	m.store[obj.ID] = *obj
+
+	return nil
+}
+
+func (m mockConnection) GetAll(bucketName string, obj any, appendFn func(o any) (any, error)) error {
+	for _, v := range m.store {
+		if _, err := appendFn(&v); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (m mockConnection) UpdateTx(fn func(portainer.Transaction) error) error {
+	return fn(m)
+}
+
+func (m mockConnection) ViewTx(fn func(portainer.Transaction) error) error {
+	return fn(m)
+}
+
+func (m mockConnection) ConvertToKey(v int) []byte {
+	return []byte(strconv.Itoa(v))
+}
+func TestReadAll(t *testing.T) {
+	t.Parallel()
+	service := BaseDataService[testObject, int]{
+		Bucket:     "testBucket",
+		Connection: mockConnection{store: make(map[int]testObject)},
+	}
+
+	data := []testObject{
+		{ID: 1, Value: 1},
+		{ID: 2, Value: 2},
+		{ID: 3, Value: 3},
+		{ID: 4, Value: 4},
+		{ID: 5, Value: 5},
+	}
+
+	for _, item := range data {
+		err := service.Update(item.ID, &item)
+		require.NoError(t, err)
+	}
+
+	// ReadAll without predicates
+	result, err := service.ReadAll()
+	require.NoError(t, err)
+
+	expected := append([]testObject{}, data...)
+
+	require.ElementsMatch(t, expected, result)
+
+	// ReadAll with predicates
+	hasLowID := func(obj testObject) bool { return obj.ID < 3 }
+	isEven := func(obj testObject) bool { return obj.Value%2 == 0 }
+
+	result, err = service.ReadAll(hasLowID, isEven)
+	require.NoError(t, err)
+
+	expected = slicesx.Filter(expected, hasLowID)
+	expected = slicesx.Filter(expected, isEven)
+
+	require.ElementsMatch(t, expected, result)
+}
diff --git a/api/dataservices/base_tx.go b/api/dataservices/base_tx.go
new file mode 100644
index 0000000..fb5b4ad
--- /dev/null
+++ b/api/dataservices/base_tx.go
@@ -0,0 +1,84 @@
+package dataservices
+
+import (
+	portainer "github.com/portainer/portainer/api"
+
+	"golang.org/x/exp/constraints"
+)
+
+type BaseDataServiceTx[T any, I constraints.Integer] struct {
+	Bucket     string
+	Connection portainer.Connection
+	Tx         portainer.Transaction
+}
+
+func (service BaseDataServiceTx[T, I]) BucketName() string {
+	return service.Bucket
+}
+
+func (service BaseDataServiceTx[T, I]) Read(ID I) (*T, error) {
+	var element T
+	identifier := service.Connection.ConvertToKey(int(ID))
+
+	err := service.Tx.GetObject(service.Bucket, identifier, &element)
+	if err != nil {
+		return nil, err
+	}
+
+	return &element, nil
+}
+
+func (service BaseDataServiceTx[T, I]) Exists(ID I) (bool, error) {
+	identifier := service.Connection.ConvertToKey(int(ID))
+
+	return service.Tx.KeyExists(service.Bucket, identifier)
+}
+
+// ReadAll retrieves all the elements that satisfy all the provided predicates.
+func (service BaseDataServiceTx[T, I]) ReadAll(predicates ...func(T) bool) ([]T, error) {
+	var collection = make([]T, 0)
+
+	if len(predicates) == 0 {
+		return collection, service.Tx.GetAll(
+			service.Bucket,
+			new(T),
+			AppendFn(&collection),
+		)
+	}
+
+	filterFn := func(element T) bool {
+		for _, p := range predicates {
+			if !p(element) {
+				return false
+			}
+		}
+
+		return true
+	}
+
+	return collection, service.Tx.GetAll(
+		service.Bucket,
+		new(T),
+		FilterFn(&collection, filterFn),
+	)
+}
+
+func (service BaseDataServiceTx[T, I]) Update(ID I, element *T) error {
+	identifier := service.Connection.ConvertToKey(int(ID))
+	return service.Tx.UpdateObject(service.Bucket, identifier, element)
+}
+
+func (service BaseDataServiceTx[T, I]) Delete(ID I) error {
+	identifier := service.Connection.ConvertToKey(int(ID))
+	return service.Tx.DeleteObject(service.Bucket, identifier)
+}
+
+func Read[T any](tx portainer.Transaction, bucket string, key []byte) (*T, error) {
+	var element T
+
+	if err := tx.GetObject(bucket, key, &element); err != nil {
+		return nil, err
+	}
+
+	return &element, nil
+}
diff --git a/api/dataservices/customtemplate/customtemplate.go b/api/dataservices/customtemplate/customtemplate.go
new file mode 100644
index 0000000..de23948
--- /dev/null
+++ b/api/dataservices/customtemplate/customtemplate.go
@@ -0,0 +1,39 @@
+package customtemplate
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+)
+
+// BucketName represents the name of the bucket where this service stores data.
+const BucketName = "customtemplates"
+
+// Service represents a service for managing custom template data.
+type Service struct {
+	dataservices.BaseDataService[portainer.CustomTemplate, portainer.CustomTemplateID]
+}
+
+// NewService creates a new instance of a service.
+func NewService(connection portainer.Connection) (*Service, error) {
+	err := connection.SetServiceName(BucketName)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Service{
+		BaseDataService: dataservices.BaseDataService[portainer.CustomTemplate, portainer.CustomTemplateID]{
+			Bucket:     BucketName,
+			Connection: connection,
+		},
+	}, nil
+}
+
+func (service *Service) GetNextIdentifier() int {
+	return service.Connection.GetNextIdentifier(BucketName)
+}
+
+func (service *Service) Create(customTemplate *portainer.CustomTemplate) error {
+	return service.Connection.UpdateTx(func(tx portainer.Transaction) error {
+		return service.Tx(tx).Create(customTemplate)
+	})
+}
diff --git a/api/dataservices/customtemplate/customtemplate_test.go b/api/dataservices/customtemplate/customtemplate_test.go
new file mode 100644
index 0000000..b72ece6
--- /dev/null
+++ b/api/dataservices/customtemplate/customtemplate_test.go
@@ -0,0 +1,20 @@
+package customtemplate_test
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/stretchr/testify/require"
+)
+
+func TestCustomTemplateCreate(t *testing.T) {
+	t.Parallel()
+	_, ds := datastore.MustNewTestStore(t, false, false)
+	require.NotNil(t, ds)
+
+	require.NoError(t, ds.CustomTemplate().Create(&portainer.CustomTemplate{ID: 1}))
+	e, err := ds.CustomTemplate().Read(1)
+	require.NoError(t, err)
+	require.Equal(t, portainer.CustomTemplateID(1), e.ID)
+}
diff --git a/api/dataservices/customtemplate/tx.go b/api/dataservices/customtemplate/tx.go
new file mode 100644
index 0000000..60b0120
--- /dev/null
+++ b/api/dataservices/customtemplate/tx.go
@@ -0,0 +1,31 @@
+package customtemplate
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+)
+
+// Service represents a service for managing custom template data.
+type ServiceTx struct {
+	dataservices.BaseDataServiceTx[portainer.CustomTemplate, portainer.CustomTemplateID]
+}
+
+func (service *Service) Tx(tx portainer.Transaction) ServiceTx {
+	return ServiceTx{
+		BaseDataServiceTx: dataservices.BaseDataServiceTx[portainer.CustomTemplate, portainer.CustomTemplateID]{
+			Bucket:     BucketName,
+			Connection: service.Connection,
+			Tx:         tx,
+		},
+	}
+}
+
+func (service ServiceTx) GetNextIdentifier() int {
+	return service.Tx.GetNextIdentifier(BucketName)
+}
+
+// CreateCustomTemplate uses the existing id and saves it.
+// TODO: where does the ID come from, and is it safe?
+func (service ServiceTx) Create(customTemplate *portainer.CustomTemplate) error {
+	return service.Tx.CreateObjectWithId(BucketName, int(customTemplate.ID), customTemplate)
+}
diff --git a/api/dataservices/customtemplate/tx_test.go b/api/dataservices/customtemplate/tx_test.go
new file mode 100644
index 0000000..8f87cf0
--- /dev/null
+++ b/api/dataservices/customtemplate/tx_test.go
@@ -0,0 +1,29 @@
+package customtemplate_test
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/stretchr/testify/require"
+)
+
+func TestCustomTemplateCreateTx(t *testing.T) {
+	t.Parallel()
+	_, ds := datastore.MustNewTestStore(t, false, false)
+	require.NotNil(t, ds)
+
+	require.NoError(t, ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.CustomTemplate().Create(&portainer.CustomTemplate{ID: 1})
+	}))
+
+	var template *portainer.CustomTemplate
+	require.NoError(t, ds.ViewTx(func(tx dataservices.DataStoreTx) error {
+		var err error
+		template, err = tx.CustomTemplate().Read(1)
+		return err
+	}))
+
+	require.Equal(t, portainer.CustomTemplateID(1), template.ID)
+}
diff --git a/api/dataservices/dockerhub/dockerhub.go b/api/dataservices/dockerhub/dockerhub.go
new file mode 100644
index 0000000..3d0b772
--- /dev/null
+++ b/api/dataservices/dockerhub/dockerhub.go
@@ -0,0 +1,49 @@
+package dockerhub
+
+import (
+	portainer "github.com/portainer/portainer/api"
+)
+
+const (
+	// BucketName represents the name of the bucket where this service stores data.
+	BucketName   = "dockerhub"
+	dockerHubKey = "DOCKERHUB"
+)
+
+// Service represents a service for managing Dockerhub data.
+type Service struct {
+	connection portainer.Connection
+}
+
+func (service *Service) BucketName() string {
+	return BucketName
+}
+
+// NewService creates a new instance of a service.
+func NewService(connection portainer.Connection) (*Service, error) {
+	err := connection.SetServiceName(BucketName)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Service{
+		connection: connection,
+	}, nil
+}
+
+// DockerHub returns the DockerHub object.
+func (service *Service) DockerHub() (*portainer.DockerHub, error) {
+	var dockerhub portainer.DockerHub
+
+	err := service.connection.GetObject(BucketName, []byte(dockerHubKey), &dockerhub)
+	if err != nil {
+		return nil, err
+	}
+
+	return &dockerhub, nil
+}
+
+// UpdateDockerHub updates a DockerHub object.
+func (service *Service) UpdateDockerHub(dockerhub *portainer.DockerHub) error {
+	return service.connection.UpdateObject(BucketName, []byte(dockerHubKey), dockerhub)
+}
diff --git a/api/dataservices/edgegroup/edgegroup.go b/api/dataservices/edgegroup/edgegroup.go
new file mode 100644
index 0000000..315587e
--- /dev/null
+++ b/api/dataservices/edgegroup/edgegroup.go
@@ -0,0 +1,60 @@
+package edgegroup
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+)
+
+// BucketName represents the name of the bucket where this service stores data.
+const BucketName = "edgegroups"
+
+// Service represents a service for managing Edge group data.
+type Service struct {
+	dataservices.BaseDataService[portainer.EdgeGroup, portainer.EdgeGroupID]
+}
+
+func (service *Service) BucketName() string {
+	return BucketName
+}
+
+// NewService creates a new instance of a service.
+func NewService(connection portainer.Connection) (*Service, error) {
+	err := connection.SetServiceName(BucketName)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Service{
+		BaseDataService: dataservices.BaseDataService[portainer.EdgeGroup, portainer.EdgeGroupID]{
+			Bucket:     BucketName,
+			Connection: connection,
+		},
+	}, nil
+}
+
+func (service *Service) Tx(tx portainer.Transaction) ServiceTx {
+	return ServiceTx{
+		BaseDataServiceTx: dataservices.BaseDataServiceTx[portainer.EdgeGroup, portainer.EdgeGroupID]{
+			Bucket:     BucketName,
+			Connection: service.Connection,
+			Tx:         tx,
+		},
+	}
+}
+
+// Deprecated: UpdateEdgeGroupFunc updates an edge group inside a transaction avoiding data races.
+func (service *Service) UpdateEdgeGroupFunc(ID portainer.EdgeGroupID, updateFunc func(edgeGroup *portainer.EdgeGroup)) error {
+	id := service.Connection.ConvertToKey(int(ID))
+	edgeGroup := &portainer.EdgeGroup{}
+
+	return service.Connection.UpdateObjectFunc(BucketName, id, edgeGroup, func() {
+		updateFunc(edgeGroup)
+	})
+}
+
+// CreateEdgeGroup assign an ID to a new Edge group and saves it.
+func (service *Service) Create(group *portainer.EdgeGroup) error {
+	return service.Connection.UpdateTx(func(tx portainer.Transaction) error {
+		return service.Tx(tx).Create(group)
+	})
+}
diff --git a/api/dataservices/edgegroup/tx.go b/api/dataservices/edgegroup/tx.go
new file mode 100644
index 0000000..2fba688
--- /dev/null
+++ b/api/dataservices/edgegroup/tx.go
@@ -0,0 +1,45 @@
+package edgegroup
+
+import (
+	"errors"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+)
+
+type ServiceTx struct {
+	dataservices.BaseDataServiceTx[portainer.EdgeGroup, portainer.EdgeGroupID]
+}
+
+// UpdateEdgeGroupFunc is a no-op inside a transaction.
+func (service ServiceTx) UpdateEdgeGroupFunc(ID portainer.EdgeGroupID, updateFunc func(edgeGroup *portainer.EdgeGroup)) error {
+	return errors.New("cannot be called inside a transaction")
+}
+
+func (service ServiceTx) Create(group *portainer.EdgeGroup) error {
+	es := group.Endpoints
+	group.Endpoints = nil // Clear deprecated field
+
+	err := service.Tx.CreateObject(
+		BucketName,
+		func(id uint64) (int, any) {
+			group.ID = portainer.EdgeGroupID(id)
+			return int(group.ID), group
+		},
+	)
+
+	group.Endpoints = es // Restore endpoints after create
+
+	return err
+}
+
+func (service ServiceTx) Update(ID portainer.EdgeGroupID, group *portainer.EdgeGroup) error {
+	es := group.Endpoints
+	group.Endpoints = nil // Clear deprecated field
+
+	err := service.BaseDataServiceTx.Update(ID, group)
+
+	group.Endpoints = es // Restore endpoints after update
+
+	return err
+}
diff --git a/api/dataservices/edgejob/edgejob.go b/api/dataservices/edgejob/edgejob.go
new file mode 100644
index 0000000..1c3c907
--- /dev/null
+++ b/api/dataservices/edgejob/edgejob.go
@@ -0,0 +1,70 @@
+package edgejob
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+)
+
+// BucketName represents the name of the bucket where this service stores data.
+const BucketName = "edgejobs"
+
+// Service represents a service for managing edge jobs data.
+type Service struct {
+	dataservices.BaseDataService[portainer.EdgeJob, portainer.EdgeJobID]
+}
+
+// NewService creates a new instance of a service.
+func NewService(connection portainer.Connection) (*Service, error) {
+	err := connection.SetServiceName(BucketName)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Service{
+		BaseDataService: dataservices.BaseDataService[portainer.EdgeJob, portainer.EdgeJobID]{
+			Bucket:     BucketName,
+			Connection: connection,
+		},
+	}, nil
+}
+
+func (service *Service) Tx(tx portainer.Transaction) ServiceTx {
+	return ServiceTx{
+		BaseDataServiceTx: dataservices.BaseDataServiceTx[portainer.EdgeJob, portainer.EdgeJobID]{
+			Bucket:     BucketName,
+			Connection: service.Connection,
+			Tx:         tx,
+		},
+	}
+}
+
+// Create creates a new EdgeJob
+func (service *Service) Create(edgeJob *portainer.EdgeJob) error {
+	return service.CreateWithID(portainer.EdgeJobID(service.GetNextIdentifier()), edgeJob)
+}
+
+// CreateWithID creates a new EdgeJob
+func (service *Service) CreateWithID(ID portainer.EdgeJobID, edgeJob *portainer.EdgeJob) error {
+	edgeJob.ID = ID
+
+	return service.Connection.CreateObjectWithId(
+		BucketName,
+		int(edgeJob.ID),
+		edgeJob,
+	)
+}
+
+// UpdateEdgeJobFunc updates an edge job inside a transaction avoiding data races.
+func (service *Service) UpdateEdgeJobFunc(ID portainer.EdgeJobID, updateFunc func(edgeJob *portainer.EdgeJob)) error {
+	id := service.Connection.ConvertToKey(int(ID))
+	edgeJob := &portainer.EdgeJob{}
+
+	return service.Connection.UpdateObjectFunc(BucketName, id, edgeJob, func() {
+		updateFunc(edgeJob)
+	})
+}
+
+// GetNextIdentifier returns the next identifier for an environment(endpoint).
+func (service *Service) GetNextIdentifier() int {
+	return service.Connection.GetNextIdentifier(BucketName)
+}
diff --git a/api/dataservices/edgejob/tx.go b/api/dataservices/edgejob/tx.go
new file mode 100644
index 0000000..6a8111f
--- /dev/null
+++ b/api/dataservices/edgejob/tx.go
@@ -0,0 +1,34 @@
+package edgejob
+
+import (
+	"errors"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+)
+
+type ServiceTx struct {
+	dataservices.BaseDataServiceTx[portainer.EdgeJob, portainer.EdgeJobID]
+}
+
+// Create creates a new EdgeJob
+func (service ServiceTx) Create(edgeJob *portainer.EdgeJob) error {
+	return service.CreateWithID(portainer.EdgeJobID(service.GetNextIdentifier()), edgeJob)
+}
+
+// CreateWithID creates a new EdgeJob
+func (service ServiceTx) CreateWithID(ID portainer.EdgeJobID, edgeJob *portainer.EdgeJob) error {
+	edgeJob.ID = ID
+
+	return service.Tx.CreateObjectWithId(BucketName, int(edgeJob.ID), edgeJob)
+}
+
+// UpdateEdgeJobFunc is a no-op inside a transaction.
+func (service ServiceTx) UpdateEdgeJobFunc(ID portainer.EdgeJobID, updateFunc func(edgeJob *portainer.EdgeJob)) error {
+	return errors.New("cannot be called inside a transaction")
+}
+
+// GetNextIdentifier returns the next identifier for an environment(endpoint).
+func (service ServiceTx) GetNextIdentifier() int {
+	return service.Tx.GetNextIdentifier(BucketName)
+}
diff --git a/api/dataservices/edgestack/edgestack.go b/api/dataservices/edgestack/edgestack.go
new file mode 100644
index 0000000..aa65610
--- /dev/null
+++ b/api/dataservices/edgestack/edgestack.go
@@ -0,0 +1,176 @@
+package edgestack
+
+import (
+	"sync"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+)
+
+// BucketName represents the name of the bucket where this service stores data.
+const BucketName = "edge_stack"
+
+// Service represents a service for managing Edge stack data.
+type Service struct {
+	connection          portainer.Connection
+	idxVersion          map[portainer.EdgeStackID]int
+	mu                  sync.RWMutex
+	cacheInvalidationFn func(portainer.Transaction, portainer.EdgeStackID)
+}
+
+func (service *Service) BucketName() string {
+	return BucketName
+}
+
+// NewService creates a new instance of a service.
+func NewService(connection portainer.Connection, cacheInvalidationFn func(portainer.Transaction, portainer.EdgeStackID)) (*Service, error) {
+	err := connection.SetServiceName(BucketName)
+	if err != nil {
+		return nil, err
+	}
+
+	s := &Service{
+		connection:          connection,
+		idxVersion:          make(map[portainer.EdgeStackID]int),
+		cacheInvalidationFn: cacheInvalidationFn,
+	}
+
+	if s.cacheInvalidationFn == nil {
+		s.cacheInvalidationFn = func(portainer.Transaction, portainer.EdgeStackID) {}
+	}
+
+	es, err := s.EdgeStacks()
+	if err != nil {
+		return nil, err
+	}
+
+	for _, e := range es {
+		s.idxVersion[e.ID] = e.Version
+	}
+
+	return s, nil
+}
+
+func (service *Service) Tx(tx portainer.Transaction) ServiceTx {
+	return ServiceTx{
+		service: service,
+		tx:      tx,
+	}
+}
+
+// EdgeStacks returns an array containing all edge stacks
+func (service *Service) EdgeStacks() ([]portainer.EdgeStack, error) {
+	var stacks = make([]portainer.EdgeStack, 0)
+
+	return stacks, service.connection.GetAll(
+		BucketName,
+		&portainer.EdgeStack{},
+		dataservices.AppendFn(&stacks),
+	)
+}
+
+// EdgeStack returns an Edge stack by ID.
+func (service *Service) EdgeStack(ID portainer.EdgeStackID) (*portainer.EdgeStack, error) {
+	var stack portainer.EdgeStack
+	identifier := service.connection.ConvertToKey(int(ID))
+
+	err := service.connection.GetObject(BucketName, identifier, &stack)
+	if err != nil {
+		return nil, err
+	}
+
+	return &stack, nil
+}
+
+// EdgeStackVersion returns the version of the given edge stack ID directly from an in-memory index
+func (service *Service) EdgeStackVersion(ID portainer.EdgeStackID) (int, bool) {
+	service.mu.RLock()
+	v, ok := service.idxVersion[ID]
+	service.mu.RUnlock()
+
+	return v, ok
+}
+
+// CreateEdgeStack saves an Edge stack object to db.
+func (service *Service) Create(id portainer.EdgeStackID, edgeStack *portainer.EdgeStack) error {
+	edgeStack.ID = id
+
+	err := service.connection.CreateObjectWithId(
+		BucketName,
+		int(edgeStack.ID),
+		edgeStack,
+	)
+	if err != nil {
+		return err
+	}
+
+	service.mu.Lock()
+	service.idxVersion[id] = edgeStack.Version
+	service.cacheInvalidationFn(service.connection, id)
+	service.mu.Unlock()
+
+	return nil
+}
+
+// Deprecated: Use UpdateEdgeStackFunc instead.
+func (service *Service) UpdateEdgeStack(ID portainer.EdgeStackID, edgeStack *portainer.EdgeStack) error {
+	service.mu.Lock()
+	defer service.mu.Unlock()
+
+	identifier := service.connection.ConvertToKey(int(ID))
+
+	err := service.connection.UpdateObject(BucketName, identifier, edgeStack)
+	if err != nil {
+		return err
+	}
+
+	service.idxVersion[ID] = edgeStack.Version
+	service.cacheInvalidationFn(service.connection, ID)
+
+	return nil
+}
+
+// UpdateEdgeStackFunc updates an Edge stack inside a transaction avoiding data races.
+func (service *Service) UpdateEdgeStackFunc(ID portainer.EdgeStackID, updateFunc func(edgeStack *portainer.EdgeStack)) error {
+	id := service.connection.ConvertToKey(int(ID))
+	edgeStack := &portainer.EdgeStack{}
+
+	service.mu.Lock()
+	defer service.mu.Unlock()
+
+	return service.connection.UpdateObjectFunc(BucketName, id, edgeStack, func() {
+		updateFunc(edgeStack)
+
+		service.idxVersion[ID] = edgeStack.Version
+		service.cacheInvalidationFn(service.connection, ID)
+	})
+}
+
+// UpdateEdgeStackFuncTx is a helper function used to call UpdateEdgeStackFunc inside a transaction.
+func (service *Service) UpdateEdgeStackFuncTx(tx portainer.Transaction, ID portainer.EdgeStackID, updateFunc func(edgeStack *portainer.EdgeStack)) error {
+	return service.Tx(tx).UpdateEdgeStackFunc(ID, updateFunc)
+}
+
+// DeleteEdgeStack deletes an Edge stack.
+func (service *Service) DeleteEdgeStack(ID portainer.EdgeStackID) error {
+	service.mu.Lock()
+	defer service.mu.Unlock()
+
+	identifier := service.connection.ConvertToKey(int(ID))
+
+	err := service.connection.DeleteObject(BucketName, identifier)
+	if err != nil {
+		return err
+	}
+
+	delete(service.idxVersion, ID)
+
+	service.cacheInvalidationFn(service.connection, ID)
+
+	return nil
+}
+
+// GetNextIdentifier returns the next identifier for an environment(endpoint).
+func (service *Service) GetNextIdentifier() int {
+	return service.connection.GetNextIdentifier(BucketName)
+}
diff --git a/api/dataservices/edgestack/edgestack_test.go b/api/dataservices/edgestack/edgestack_test.go
new file mode 100644
index 0000000..82413b0
--- /dev/null
+++ b/api/dataservices/edgestack/edgestack_test.go
@@ -0,0 +1,52 @@
+package edgestack
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/database/boltdb"
+	"github.com/portainer/portainer/api/logs"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestUpdate(t *testing.T) {
+	t.Parallel()
+	var conn portainer.Connection = &boltdb.DbConnection{Path: t.TempDir()}
+	err := conn.Open()
+	require.NoError(t, err)
+
+	defer logs.CloseAndLogErr(conn)
+
+	service, err := NewService(conn, func(portainer.Transaction, portainer.EdgeStackID) {})
+	require.NoError(t, err)
+
+	const edgeStackID = 1
+	edgeStack := &portainer.EdgeStack{
+		ID:   edgeStackID,
+		Name: "Test Stack",
+	}
+
+	err = service.Create(edgeStackID, edgeStack)
+	require.NoError(t, err)
+
+	err = service.UpdateEdgeStackFunc(edgeStackID, func(edgeStack *portainer.EdgeStack) {
+		edgeStack.Name = "Updated Stack"
+	})
+	require.NoError(t, err)
+
+	updatedStack, err := service.EdgeStack(edgeStackID)
+	require.NoError(t, err)
+	require.Equal(t, "Updated Stack", updatedStack.Name)
+
+	err = conn.UpdateTx(func(tx portainer.Transaction) error {
+		return service.UpdateEdgeStackFuncTx(tx, edgeStackID, func(edgeStack *portainer.EdgeStack) {
+			edgeStack.Name = "Updated Stack Again"
+		})
+	})
+	require.NoError(t, err)
+
+	updatedStack, err = service.EdgeStack(edgeStackID)
+	require.NoError(t, err)
+	require.Equal(t, "Updated Stack Again", updatedStack.Name)
+}
diff --git a/api/dataservices/edgestack/tx.go b/api/dataservices/edgestack/tx.go
new file mode 100644
index 0000000..a2ec6b3
--- /dev/null
+++ b/api/dataservices/edgestack/tx.go
@@ -0,0 +1,121 @@
+package edgestack
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+)
+
+type ServiceTx struct {
+	service *Service
+	tx      portainer.Transaction
+}
+
+func (service ServiceTx) BucketName() string {
+	return BucketName
+}
+
+// EdgeStacks returns an array containing all edge stacks
+func (service ServiceTx) EdgeStacks() ([]portainer.EdgeStack, error) {
+	var stacks = make([]portainer.EdgeStack, 0)
+
+	err := service.tx.GetAll(
+		BucketName,
+		&portainer.EdgeStack{},
+		dataservices.AppendFn(&stacks),
+	)
+
+	return stacks, err
+}
+
+// EdgeStack returns an Edge stack by ID.
+func (service ServiceTx) EdgeStack(ID portainer.EdgeStackID) (*portainer.EdgeStack, error) {
+	var stack portainer.EdgeStack
+	identifier := service.service.connection.ConvertToKey(int(ID))
+
+	if err := service.tx.GetObject(BucketName, identifier, &stack); err != nil {
+		return nil, err
+	}
+
+	return &stack, nil
+}
+
+// EdgeStackVersion returns the version of the given edge stack ID directly from an in-memory index
+func (service ServiceTx) EdgeStackVersion(ID portainer.EdgeStackID) (int, bool) {
+	service.service.mu.RLock()
+	v, ok := service.service.idxVersion[ID]
+	service.service.mu.RUnlock()
+
+	return v, ok
+}
+
+// CreateEdgeStack saves an Edge stack object to db.
+func (service ServiceTx) Create(id portainer.EdgeStackID, edgeStack *portainer.EdgeStack) error {
+	edgeStack.ID = id
+
+	if err := service.tx.CreateObjectWithId(
+		BucketName,
+		int(edgeStack.ID),
+		edgeStack,
+	); err != nil {
+		return err
+	}
+
+	service.service.mu.Lock()
+	service.service.idxVersion[id] = edgeStack.Version
+	service.service.cacheInvalidationFn(service.tx, id)
+	service.service.mu.Unlock()
+
+	return nil
+}
+
+// UpdateEdgeStack updates an Edge stack.
+func (service ServiceTx) UpdateEdgeStack(ID portainer.EdgeStackID, edgeStack *portainer.EdgeStack) error {
+	service.service.mu.Lock()
+	defer service.service.mu.Unlock()
+
+	identifier := service.service.connection.ConvertToKey(int(ID))
+
+	if err := service.tx.UpdateObject(BucketName, identifier, edgeStack); err != nil {
+		return err
+	}
+
+	service.service.idxVersion[ID] = edgeStack.Version
+	service.service.cacheInvalidationFn(service.tx, ID)
+
+	return nil
+}
+
+// Deprecated: use UpdateEdgeStack inside a transaction instead.
+func (service ServiceTx) UpdateEdgeStackFunc(ID portainer.EdgeStackID, updateFunc func(edgeStack *portainer.EdgeStack)) error {
+	edgeStack, err := service.EdgeStack(ID)
+	if err != nil {
+		return err
+	}
+
+	updateFunc(edgeStack)
+
+	return service.UpdateEdgeStack(ID, edgeStack)
+}
+
+// DeleteEdgeStack deletes an Edge stack.
+func (service ServiceTx) DeleteEdgeStack(ID portainer.EdgeStackID) error {
+	service.service.mu.Lock()
+	defer service.service.mu.Unlock()
+
+	identifier := service.service.connection.ConvertToKey(int(ID))
+
+	if err := service.tx.DeleteObject(BucketName, identifier); err != nil {
+		return err
+	}
+
+	delete(service.service.idxVersion, ID)
+
+	service.service.cacheInvalidationFn(service.tx, ID)
+
+	return nil
+}
+
+// GetNextIdentifier returns the next identifier for an environment(endpoint).
+func (service ServiceTx) GetNextIdentifier() int {
+	return service.tx.GetNextIdentifier(BucketName)
+}
diff --git a/api/dataservices/edgestackstatus/edgestackstatus.go b/api/dataservices/edgestackstatus/edgestackstatus.go
new file mode 100644
index 0000000..8fbec25
--- /dev/null
+++ b/api/dataservices/edgestackstatus/edgestackstatus.go
@@ -0,0 +1,95 @@
+package edgestackstatus
+
+import (
+	"encoding/binary"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+)
+
+var _ dataservices.EdgeStackStatusService = &Service{}
+
+const BucketName = "edge_stack_status"
+
+type Service struct {
+	conn portainer.Connection
+}
+
+func (service *Service) BucketName() string {
+	return BucketName
+}
+
+func NewService(connection portainer.Connection) (*Service, error) {
+	if err := connection.SetServiceName(BucketName); err != nil {
+		return nil, err
+	}
+
+	return &Service{conn: connection}, nil
+}
+
+func (s *Service) Tx(tx portainer.Transaction) ServiceTx {
+	return ServiceTx{
+		service: s,
+		tx:      tx,
+	}
+}
+
+func (s *Service) Create(edgeStackID portainer.EdgeStackID, endpointID portainer.EndpointID, status *portainer.EdgeStackStatusForEnv) error {
+	return s.conn.UpdateTx(func(tx portainer.Transaction) error {
+		return s.Tx(tx).Create(edgeStackID, endpointID, status)
+	})
+}
+
+func (s *Service) Read(edgeStackID portainer.EdgeStackID, endpointID portainer.EndpointID) (*portainer.EdgeStackStatusForEnv, error) {
+	var element *portainer.EdgeStackStatusForEnv
+
+	return element, s.conn.ViewTx(func(tx portainer.Transaction) error {
+		var err error
+		element, err = s.Tx(tx).Read(edgeStackID, endpointID)
+
+		return err
+	})
+}
+
+func (s *Service) ReadAll(edgeStackID portainer.EdgeStackID) ([]portainer.EdgeStackStatusForEnv, error) {
+	var collection = make([]portainer.EdgeStackStatusForEnv, 0)
+
+	return collection, s.conn.ViewTx(func(tx portainer.Transaction) error {
+		var err error
+		collection, err = s.Tx(tx).ReadAll(edgeStackID)
+
+		return err
+	})
+}
+
+func (s *Service) Update(edgeStackID portainer.EdgeStackID, endpointID portainer.EndpointID, status *portainer.EdgeStackStatusForEnv) error {
+	return s.conn.UpdateTx(func(tx portainer.Transaction) error {
+		return s.Tx(tx).Update(edgeStackID, endpointID, status)
+	})
+}
+
+func (s *Service) Delete(edgeStackID portainer.EdgeStackID, endpointID portainer.EndpointID) error {
+	return s.conn.UpdateTx(func(tx portainer.Transaction) error {
+		return s.Tx(tx).Delete(edgeStackID, endpointID)
+	})
+}
+
+func (s *Service) DeleteAll(edgeStackID portainer.EdgeStackID) error {
+	return s.conn.UpdateTx(func(tx portainer.Transaction) error {
+		return s.Tx(tx).DeleteAll(edgeStackID)
+	})
+}
+
+func (s *Service) Clear(edgeStackID portainer.EdgeStackID, relatedEnvironmentsIDs []portainer.EndpointID) error {
+	return s.conn.UpdateTx(func(tx portainer.Transaction) error {
+		return s.Tx(tx).Clear(edgeStackID, relatedEnvironmentsIDs)
+	})
+}
+
+func (s *Service) key(edgeStackID portainer.EdgeStackID, endpointID portainer.EndpointID) []byte {
+	k := make([]byte, 16)
+	binary.BigEndian.PutUint64(k[:8], uint64(edgeStackID))
+	binary.BigEndian.PutUint64(k[8:], uint64(endpointID))
+
+	return k
+}
diff --git a/api/dataservices/edgestackstatus/tx.go b/api/dataservices/edgestackstatus/tx.go
new file mode 100644
index 0000000..b0dc148
--- /dev/null
+++ b/api/dataservices/edgestackstatus/tx.go
@@ -0,0 +1,95 @@
+package edgestackstatus
+
+import (
+	"fmt"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+)
+
+var _ dataservices.EdgeStackStatusService = &Service{}
+
+type ServiceTx struct {
+	service *Service
+	tx      portainer.Transaction
+}
+
+func (service ServiceTx) Create(edgeStackID portainer.EdgeStackID, endpointID portainer.EndpointID, status *portainer.EdgeStackStatusForEnv) error {
+	identifier := service.service.key(edgeStackID, endpointID)
+	return service.tx.CreateObjectWithStringId(BucketName, identifier, status)
+}
+
+func (s ServiceTx) Read(edgeStackID portainer.EdgeStackID, endpointID portainer.EndpointID) (*portainer.EdgeStackStatusForEnv, error) {
+	var status portainer.EdgeStackStatusForEnv
+	identifier := s.service.key(edgeStackID, endpointID)
+
+	if err := s.tx.GetObject(BucketName, identifier, &status); err != nil {
+		return nil, err
+	}
+
+	return &status, nil
+}
+
+func (s ServiceTx) ReadAll(edgeStackID portainer.EdgeStackID) ([]portainer.EdgeStackStatusForEnv, error) {
+	keyPrefix := s.service.conn.ConvertToKey(int(edgeStackID))
+
+	statuses := make([]portainer.EdgeStackStatusForEnv, 0)
+
+	if err := s.tx.GetAllWithKeyPrefix(BucketName, keyPrefix, &portainer.EdgeStackStatusForEnv{}, dataservices.AppendFn(&statuses)); err != nil {
+		return nil, fmt.Errorf("unable to retrieve EdgeStackStatus for EdgeStack %d: %w", edgeStackID, err)
+	}
+
+	return statuses, nil
+}
+
+func (s ServiceTx) Update(edgeStackID portainer.EdgeStackID, endpointID portainer.EndpointID, status *portainer.EdgeStackStatusForEnv) error {
+	identifier := s.service.key(edgeStackID, endpointID)
+	return s.tx.UpdateObject(BucketName, identifier, status)
+}
+
+func (s ServiceTx) Delete(edgeStackID portainer.EdgeStackID, endpointID portainer.EndpointID) error {
+	identifier := s.service.key(edgeStackID, endpointID)
+	return s.tx.DeleteObject(BucketName, identifier)
+}
+
+func (s ServiceTx) DeleteAll(edgeStackID portainer.EdgeStackID) error {
+	keyPrefix := s.service.conn.ConvertToKey(int(edgeStackID))
+
+	statuses := make([]portainer.EdgeStackStatusForEnv, 0)
+
+	if err := s.tx.GetAllWithKeyPrefix(BucketName, keyPrefix, &portainer.EdgeStackStatusForEnv{}, dataservices.AppendFn(&statuses)); err != nil {
+		return fmt.Errorf("unable to retrieve EdgeStackStatus for EdgeStack %d: %w", edgeStackID, err)
+	}
+
+	for _, status := range statuses {
+		if err := s.tx.DeleteObject(BucketName, s.service.key(edgeStackID, status.EndpointID)); err != nil {
+			return fmt.Errorf("unable to delete EdgeStackStatus for EdgeStack %d and Endpoint %d: %w", edgeStackID, status.EndpointID, err)
+		}
+	}
+
+	return nil
+}
+
+func (s ServiceTx) Clear(edgeStackID portainer.EdgeStackID, relatedEnvironmentsIDs []portainer.EndpointID) error {
+	for _, envID := range relatedEnvironmentsIDs {
+		existingStatus, err := s.Read(edgeStackID, envID)
+		if err != nil && !dataservices.IsErrObjectNotFound(err) {
+			return fmt.Errorf("unable to retrieve status for environment %d: %w", envID, err)
+		}
+
+		var deploymentInfo portainer.StackDeploymentInfo
+		if existingStatus != nil {
+			deploymentInfo = existingStatus.DeploymentInfo
+		}
+
+		if err := s.Update(edgeStackID, envID, &portainer.EdgeStackStatusForEnv{
+			EndpointID:     envID,
+			Status:         []portainer.EdgeStackDeploymentStatus{},
+			DeploymentInfo: deploymentInfo,
+		}); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
diff --git a/api/dataservices/endpoint/endpoint.go b/api/dataservices/endpoint/endpoint.go
new file mode 100644
index 0000000..e8ae096
--- /dev/null
+++ b/api/dataservices/endpoint/endpoint.go
@@ -0,0 +1,194 @@
+package endpoint
+
+import (
+	"sync"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+
+	"github.com/rs/zerolog/log"
+)
+
+// BucketName represents the name of the bucket where this service stores data.
+const BucketName = "endpoints"
+
+// Service represents a service for managing environment(endpoint) data.
+type Service struct {
+	connection portainer.Connection
+	mu         sync.RWMutex
+	idxEdgeID  map[string]portainer.EndpointID
+	heartbeats sync.Map
+}
+
+func (service *Service) BucketName() string {
+	return BucketName
+}
+
+// NewService creates a new instance of a service.
+func NewService(connection portainer.Connection) (*Service, error) {
+	err := connection.SetServiceName(BucketName)
+	if err != nil {
+		return nil, err
+	}
+
+	s := &Service{
+		connection: connection,
+		idxEdgeID:  make(map[string]portainer.EndpointID),
+	}
+
+	es, err := s.endpoints()
+	if err != nil {
+		return nil, err
+	}
+
+	for _, e := range es {
+		if len(e.EdgeID) > 0 {
+			s.idxEdgeID[e.EdgeID] = e.ID
+		}
+
+		s.heartbeats.Store(e.ID, e.LastCheckInDate)
+	}
+
+	return s, nil
+}
+
+func (service *Service) Tx(tx portainer.Transaction) ServiceTx {
+	return ServiceTx{
+		service: service,
+		tx:      tx,
+	}
+}
+
+// Endpoint returns an environment(endpoint) by ID.
+func (service *Service) Endpoint(ID portainer.EndpointID) (*portainer.Endpoint, error) {
+	var endpoint *portainer.Endpoint
+	var err error
+
+	err = service.connection.ViewTx(func(tx portainer.Transaction) error {
+		endpoint, err = service.Tx(tx).Endpoint(ID)
+		return err
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	endpoint.LastCheckInDate, _ = service.Heartbeat(ID)
+
+	return endpoint, nil
+}
+
+// UpdateEndpoint updates an environment(endpoint).
+func (service *Service) UpdateEndpoint(ID portainer.EndpointID, endpoint *portainer.Endpoint) error {
+	return service.connection.UpdateTx(func(tx portainer.Transaction) error {
+		return service.Tx(tx).UpdateEndpoint(ID, endpoint)
+	})
+}
+
+// DeleteEndpoint deletes an environment(endpoint).
+func (service *Service) DeleteEndpoint(ID portainer.EndpointID) error {
+	return service.connection.UpdateTx(func(tx portainer.Transaction) error {
+		return service.Tx(tx).DeleteEndpoint(ID)
+	})
+}
+
+func (service *Service) endpoints() ([]portainer.Endpoint, error) {
+	var endpoints []portainer.Endpoint
+	var err error
+
+	err = service.connection.ViewTx(func(tx portainer.Transaction) error {
+		endpoints, err = service.Tx(tx).Endpoints()
+		return err
+	})
+
+	return endpoints, err
+}
+
+// Endpoints return an array containing all the environments(endpoints).
+func (service *Service) Endpoints() ([]portainer.Endpoint, error) {
+	endpoints, err := service.endpoints()
+	if err != nil {
+		return nil, err
+	}
+
+	for i, e := range endpoints {
+		t, _ := service.Heartbeat(e.ID)
+		endpoints[i].LastCheckInDate = t
+	}
+
+	return endpoints, nil
+}
+
+// ReadAll retrieves all the elements that satisfy all the provided predicates.
+func (service *Service) ReadAll(predicates ...func(endpoint portainer.Endpoint) bool) ([]portainer.Endpoint, error) {
+	var endpoints []portainer.Endpoint
+	var err error
+
+	err = service.connection.ViewTx(func(tx portainer.Transaction) error {
+		endpoints, err = service.Tx(tx).ReadAll(predicates...)
+		return err
+	})
+
+	return endpoints, err
+}
+
+// EndpointIDByEdgeID returns the EndpointID from the given EdgeID using an in-memory index
+func (service *Service) EndpointIDByEdgeID(edgeID string) (portainer.EndpointID, bool) {
+	service.mu.RLock()
+	endpointID, ok := service.idxEdgeID[edgeID]
+	service.mu.RUnlock()
+
+	return endpointID, ok
+}
+
+func (service *Service) Heartbeat(endpointID portainer.EndpointID) (int64, bool) {
+	if t, ok := service.heartbeats.Load(endpointID); ok {
+		return t.(int64), true
+	}
+
+	return 0, false
+}
+
+func (service *Service) UpdateHeartbeat(endpointID portainer.EndpointID) {
+	service.heartbeats.Store(endpointID, time.Now().Unix())
+}
+
+// CreateEndpoint assign an ID to a new environment(endpoint) and saves it.
+func (service *Service) Create(endpoint *portainer.Endpoint) error {
+	return service.connection.UpdateTx(func(tx portainer.Transaction) error {
+		return service.Tx(tx).Create(endpoint)
+	})
+}
+
+func (service *Service) EndpointsByTeamID(teamID portainer.TeamID) ([]portainer.Endpoint, error) {
+	var endpoints = make([]portainer.Endpoint, 0)
+
+	return endpoints, service.connection.GetAll(
+		BucketName,
+		&portainer.Endpoint{},
+		dataservices.FilterFn(&endpoints, func(e portainer.Endpoint) bool {
+			for t := range e.TeamAccessPolicies {
+				if t == teamID {
+					return true
+				}
+			}
+
+			return false
+		}),
+	)
+}
+
+// GetNextIdentifier returns the next identifier for an environment(endpoint).
+func (service *Service) GetNextIdentifier() int {
+	var identifier int
+
+	if err := service.connection.UpdateTx(func(tx portainer.Transaction) error {
+		identifier = service.Tx(tx).GetNextIdentifier()
+
+		return nil
+	}); err != nil {
+		log.Error().Err(err).Str("bucket", BucketName).Msg("could not get the next identifier")
+	}
+
+	return identifier
+}
diff --git a/api/dataservices/endpoint/tx.go b/api/dataservices/endpoint/tx.go
new file mode 100644
index 0000000..d06c717
--- /dev/null
+++ b/api/dataservices/endpoint/tx.go
@@ -0,0 +1,151 @@
+package endpoint
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/internal/edge/cache"
+
+	"github.com/rs/zerolog/log"
+)
+
+type ServiceTx struct {
+	service *Service
+	tx      portainer.Transaction
+}
+
+func (service ServiceTx) BucketName() string {
+	return BucketName
+}
+
+// Endpoint returns an environment(endpoint) by ID.
+func (service ServiceTx) Endpoint(ID portainer.EndpointID) (*portainer.Endpoint, error) {
+	var endpoint portainer.Endpoint
+
+	identifier := service.service.connection.ConvertToKey(int(ID))
+
+	if err := service.tx.GetObject(BucketName, identifier, &endpoint); err != nil {
+		return nil, err
+	}
+
+	endpoint.LastCheckInDate, _ = service.service.Heartbeat(ID)
+
+	return &endpoint, nil
+}
+
+// UpdateEndpoint updates an environment(endpoint).
+func (service ServiceTx) UpdateEndpoint(ID portainer.EndpointID, endpoint *portainer.Endpoint) error {
+	identifier := service.service.connection.ConvertToKey(int(ID))
+
+	if err := service.tx.UpdateObject(BucketName, identifier, endpoint); err != nil {
+		return err
+	}
+
+	service.service.mu.Lock()
+	if len(endpoint.EdgeID) > 0 {
+		service.service.idxEdgeID[endpoint.EdgeID] = ID
+	}
+
+	service.service.heartbeats.Store(ID, endpoint.LastCheckInDate)
+	service.service.mu.Unlock()
+
+	cache.Del(endpoint.ID)
+
+	return nil
+}
+
+// DeleteEndpoint deletes an environment(endpoint).
+func (service ServiceTx) DeleteEndpoint(ID portainer.EndpointID) error {
+	identifier := service.service.connection.ConvertToKey(int(ID))
+
+	if err := service.tx.DeleteObject(BucketName, identifier); err != nil {
+		return err
+	}
+
+	service.service.mu.Lock()
+	for edgeID, endpointID := range service.service.idxEdgeID {
+		if endpointID == ID {
+			delete(service.service.idxEdgeID, edgeID)
+
+			break
+		}
+	}
+
+	service.service.heartbeats.Delete(ID)
+	service.service.mu.Unlock()
+
+	cache.Del(ID)
+
+	return nil
+}
+
+// Endpoints return an array containing all the environments(endpoints).
+func (service ServiceTx) Endpoints() ([]portainer.Endpoint, error) {
+	var endpoints = make([]portainer.Endpoint, 0)
+
+	return endpoints, service.tx.GetAll(
+		BucketName,
+		&portainer.Endpoint{},
+		dataservices.AppendFn(&endpoints),
+	)
+}
+
+// ReadAll retrieves all the elements that satisfy all the provided predicates.
+func (service ServiceTx) ReadAll(predicates ...func(endpoint portainer.Endpoint) bool) ([]portainer.Endpoint, error) {
+	return dataservices.BaseDataServiceTx[portainer.Endpoint, portainer.EndpointID]{Bucket: BucketName, Connection: service.service.connection, Tx: service.tx}.ReadAll(predicates...)
+}
+
+func (service ServiceTx) EndpointIDByEdgeID(edgeID string) (portainer.EndpointID, bool) {
+	log.Error().Str("func", "EndpointIDByEdgeID").Msg("cannot be called inside a transaction")
+
+	return 0, false
+}
+
+func (service ServiceTx) Heartbeat(endpointID portainer.EndpointID) (int64, bool) {
+	log.Error().Str("func", "Heartbeat").Msg("cannot be called inside a transaction")
+
+	return 0, false
+}
+
+func (service ServiceTx) UpdateHeartbeat(endpointID portainer.EndpointID) {
+	log.Error().Str("func", "UpdateHeartbeat").Msg("cannot be called inside a transaction")
+}
+
+// CreateEndpoint assign an ID to a new environment(endpoint) and saves it.
+func (service ServiceTx) Create(endpoint *portainer.Endpoint) error {
+	if err := service.tx.CreateObjectWithId(BucketName, int(endpoint.ID), endpoint); err != nil {
+		return err
+	}
+
+	service.service.mu.Lock()
+	if len(endpoint.EdgeID) > 0 {
+		service.service.idxEdgeID[endpoint.EdgeID] = endpoint.ID
+	}
+
+	service.service.heartbeats.Store(endpoint.ID, endpoint.LastCheckInDate)
+	service.service.mu.Unlock()
+
+	return nil
+}
+
+func (service ServiceTx) EndpointsByTeamID(teamID portainer.TeamID) ([]portainer.Endpoint, error) {
+	var endpoints = make([]portainer.Endpoint, 0)
+
+	return endpoints, service.tx.GetAll(
+		BucketName,
+		&portainer.Endpoint{},
+		dataservices.FilterFn(&endpoints, func(e portainer.Endpoint) bool {
+			for t := range e.TeamAccessPolicies {
+				if t == teamID {
+					return true
+				}
+			}
+
+			return false
+		}),
+	)
+}
+
+// GetNextIdentifier returns the next identifier for an environment(endpoint).
+func (service ServiceTx) GetNextIdentifier() int {
+	return service.tx.GetNextIdentifier(BucketName)
+}
diff --git a/api/dataservices/endpointgroup/endpointgroup.go b/api/dataservices/endpointgroup/endpointgroup.go
new file mode 100644
index 0000000..2aef980
--- /dev/null
+++ b/api/dataservices/endpointgroup/endpointgroup.go
@@ -0,0 +1,49 @@
+package endpointgroup
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+)
+
+const BucketName = "endpoint_groups"
+
+// Service represents a service for managing environment(endpoint) data.
+type Service struct {
+	dataservices.BaseDataService[portainer.EndpointGroup, portainer.EndpointGroupID]
+}
+
+// NewService creates a new instance of a service.
+func NewService(connection portainer.Connection) (*Service, error) {
+	err := connection.SetServiceName(BucketName)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Service{
+		BaseDataService: dataservices.BaseDataService[portainer.EndpointGroup, portainer.EndpointGroupID]{
+			Bucket:     BucketName,
+			Connection: connection,
+		},
+	}, nil
+}
+
+func (service *Service) Tx(tx portainer.Transaction) ServiceTx {
+	return ServiceTx{
+		BaseDataServiceTx: dataservices.BaseDataServiceTx[portainer.EndpointGroup, portainer.EndpointGroupID]{
+			Bucket:     BucketName,
+			Connection: service.Connection,
+			Tx:         tx,
+		},
+	}
+}
+
+// CreateEndpointGroup assign an ID to a new environment(endpoint) group and saves it.
+func (service *Service) Create(endpointGroup *portainer.EndpointGroup) error {
+	return service.Connection.CreateObject(
+		BucketName,
+		func(id uint64) (int, any) {
+			endpointGroup.ID = portainer.EndpointGroupID(id)
+			return int(endpointGroup.ID), endpointGroup
+		},
+	)
+}
diff --git a/api/dataservices/endpointgroup/tx.go b/api/dataservices/endpointgroup/tx.go
new file mode 100644
index 0000000..65c3dc3
--- /dev/null
+++ b/api/dataservices/endpointgroup/tx.go
@@ -0,0 +1,21 @@
+package endpointgroup
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+)
+
+type ServiceTx struct {
+	dataservices.BaseDataServiceTx[portainer.EndpointGroup, portainer.EndpointGroupID]
+}
+
+// CreateEndpointGroup assign an ID to a new environment(endpoint) group and saves it.
+func (service ServiceTx) Create(endpointGroup *portainer.EndpointGroup) error {
+	return service.Tx.CreateObject(
+		BucketName,
+		func(id uint64) (int, any) {
+			endpointGroup.ID = portainer.EndpointGroupID(id)
+			return int(endpointGroup.ID), endpointGroup
+		},
+	)
+}
diff --git a/api/dataservices/endpointrelation/endpointrelation.go b/api/dataservices/endpointrelation/endpointrelation.go
new file mode 100644
index 0000000..509def8
--- /dev/null
+++ b/api/dataservices/endpointrelation/endpointrelation.go
@@ -0,0 +1,114 @@
+package endpointrelation
+
+import (
+	"sync"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/internal/edge/cache"
+)
+
+// BucketName represents the name of the bucket where this service stores data.
+const BucketName = "endpoint_relations"
+
+// Service represents a service for managing environment(endpoint) relation data.
+type Service struct {
+	connection             portainer.Connection
+	updateStackFnTx        func(tx portainer.Transaction, ID portainer.EdgeStackID, updateFunc func(edgeStack *portainer.EdgeStack)) error
+	endpointRelationsCache []portainer.EndpointRelation
+	mu                     sync.Mutex
+}
+
+var _ dataservices.EndpointRelationService = &Service{}
+
+func (service *Service) BucketName() string {
+	return BucketName
+}
+
+func (service *Service) RegisterUpdateStackFunction(
+	updateFuncTx func(portainer.Transaction, portainer.EdgeStackID, func(*portainer.EdgeStack)) error,
+) {
+	service.mu.Lock()
+	defer service.mu.Unlock()
+
+	service.updateStackFnTx = updateFuncTx
+}
+
+// NewService creates a new instance of a service.
+func NewService(connection portainer.Connection) (*Service, error) {
+	if err := connection.SetServiceName(BucketName); err != nil {
+		return nil, err
+	}
+
+	return &Service{
+		connection: connection,
+	}, nil
+}
+
+func (service *Service) Tx(tx portainer.Transaction) ServiceTx {
+	return ServiceTx{
+		service: service,
+		tx:      tx,
+	}
+}
+
+// EndpointRelations returns an array of all EndpointRelations
+func (service *Service) EndpointRelations() ([]portainer.EndpointRelation, error) {
+	var all = make([]portainer.EndpointRelation, 0)
+
+	return all, service.connection.GetAll(
+		BucketName,
+		&portainer.EndpointRelation{},
+		dataservices.AppendFn(&all),
+	)
+}
+
+// EndpointRelation returns a Environment(Endpoint) relation object by EndpointID
+func (service *Service) EndpointRelation(endpointID portainer.EndpointID) (*portainer.EndpointRelation, error) {
+	var endpointRelation portainer.EndpointRelation
+	identifier := service.connection.ConvertToKey(int(endpointID))
+
+	if err := service.connection.GetObject(BucketName, identifier, &endpointRelation); err != nil {
+		return nil, err
+	}
+
+	return &endpointRelation, nil
+}
+
+// CreateEndpointRelation saves endpointRelation
+func (service *Service) Create(endpointRelation *portainer.EndpointRelation) error {
+	err := service.connection.CreateObjectWithId(BucketName, int(endpointRelation.EndpointID), endpointRelation)
+	cache.Del(endpointRelation.EndpointID)
+
+	service.mu.Lock()
+	service.endpointRelationsCache = nil
+	service.mu.Unlock()
+
+	return err
+}
+
+// UpdateEndpointRelation updates an Environment(Endpoint) relation object
+func (service *Service) UpdateEndpointRelation(endpointID portainer.EndpointID, endpointRelation *portainer.EndpointRelation) error {
+	return service.connection.UpdateTx(func(tx portainer.Transaction) error {
+		return service.Tx(tx).UpdateEndpointRelation(endpointID, endpointRelation)
+	})
+}
+
+func (service *Service) AddEndpointRelationsForEdgeStack(endpointIDs []portainer.EndpointID, edgeStack *portainer.EdgeStack) error {
+	return service.connection.UpdateTx(func(tx portainer.Transaction) error {
+		return service.Tx(tx).AddEndpointRelationsForEdgeStack(endpointIDs, edgeStack)
+	})
+}
+
+func (service *Service) RemoveEndpointRelationsForEdgeStack(endpointIDs []portainer.EndpointID, edgeStackID portainer.EdgeStackID) error {
+	return service.connection.UpdateTx(func(tx portainer.Transaction) error {
+		return service.Tx(tx).RemoveEndpointRelationsForEdgeStack(endpointIDs, edgeStackID)
+	})
+}
+
+// DeleteEndpointRelation deletes an Environment(Endpoint) relation object
+func (service *Service) DeleteEndpointRelation(endpointID portainer.EndpointID) error {
+	return service.connection.UpdateTx(func(tx portainer.Transaction) error {
+		return service.Tx(tx).DeleteEndpointRelation(endpointID)
+	})
+}
diff --git a/api/dataservices/endpointrelation/endpointrelation_test.go b/api/dataservices/endpointrelation/endpointrelation_test.go
new file mode 100644
index 0000000..c906150
--- /dev/null
+++ b/api/dataservices/endpointrelation/endpointrelation_test.go
@@ -0,0 +1,144 @@
+package endpointrelation
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/database/boltdb"
+	"github.com/portainer/portainer/api/dataservices/edgestack"
+	"github.com/portainer/portainer/api/internal/edge/cache"
+	"github.com/portainer/portainer/api/logs"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestUpdateRelation(t *testing.T) {
+	t.Parallel()
+	const endpointID = 1
+	const edgeStackID1 = 1
+	const edgeStackID2 = 2
+
+	var conn portainer.Connection = &boltdb.DbConnection{Path: t.TempDir()}
+	err := conn.Open()
+	require.NoError(t, err)
+
+	defer logs.CloseAndLogErr(conn)
+
+	service, err := NewService(conn)
+	require.NoError(t, err)
+
+	updateStackFnTxCalled := false
+
+	edgeStacks := make(map[portainer.EdgeStackID]portainer.EdgeStack)
+	edgeStacks[edgeStackID1] = portainer.EdgeStack{ID: edgeStackID1}
+	edgeStacks[edgeStackID2] = portainer.EdgeStack{ID: edgeStackID2}
+
+	service.RegisterUpdateStackFunction(func(tx portainer.Transaction, ID portainer.EdgeStackID, updateFunc func(edgeStack *portainer.EdgeStack)) error {
+		updateStackFnTxCalled = true
+
+		s, ok := edgeStacks[ID]
+		require.True(t, ok)
+
+		updateFunc(&s)
+		edgeStacks[ID] = s
+
+		return nil
+	})
+
+	// Nil relation
+
+	cache.Set(endpointID, []byte("value"))
+
+	err = service.UpdateEndpointRelation(endpointID, nil)
+	_, cacheKeyExists := cache.Get(endpointID)
+	require.NoError(t, err)
+	require.False(t, updateStackFnTxCalled)
+	require.False(t, cacheKeyExists)
+
+	// Add a relation to two edge stacks
+
+	cache.Set(endpointID, []byte("value"))
+
+	err = service.UpdateEndpointRelation(endpointID, &portainer.EndpointRelation{
+		EndpointID: endpointID,
+		EdgeStacks: map[portainer.EdgeStackID]bool{
+			edgeStackID1: true,
+			edgeStackID2: true,
+		},
+	})
+	_, cacheKeyExists = cache.Get(endpointID)
+	require.NoError(t, err)
+	require.True(t, updateStackFnTxCalled)
+	require.False(t, cacheKeyExists)
+	require.Equal(t, 1, edgeStacks[edgeStackID1].NumDeployments)
+	require.Equal(t, 1, edgeStacks[edgeStackID2].NumDeployments)
+
+	// Remove a relation to one edge stack
+
+	updateStackFnTxCalled = false
+	cache.Set(endpointID, []byte("value"))
+
+	err = service.UpdateEndpointRelation(endpointID, &portainer.EndpointRelation{
+		EndpointID: endpointID,
+		EdgeStacks: map[portainer.EdgeStackID]bool{
+			2: true,
+		},
+	})
+	_, cacheKeyExists = cache.Get(endpointID)
+	require.NoError(t, err)
+	require.True(t, updateStackFnTxCalled)
+	require.False(t, cacheKeyExists)
+	require.Equal(t, 0, edgeStacks[edgeStackID1].NumDeployments)
+	require.Equal(t, 1, edgeStacks[edgeStackID2].NumDeployments)
+
+	// Delete the relation
+
+	updateStackFnTxCalled = false
+	cache.Set(endpointID, []byte("value"))
+
+	err = service.DeleteEndpointRelation(endpointID)
+
+	_, cacheKeyExists = cache.Get(endpointID)
+	require.NoError(t, err)
+	require.True(t, updateStackFnTxCalled)
+	require.False(t, cacheKeyExists)
+	require.Equal(t, 0, edgeStacks[edgeStackID1].NumDeployments)
+	require.Equal(t, 0, edgeStacks[edgeStackID2].NumDeployments)
+}
+
+func TestAddEndpointRelationsForEdgeStack(t *testing.T) {
+	t.Parallel()
+	var conn portainer.Connection = &boltdb.DbConnection{Path: t.TempDir()}
+	err := conn.Open()
+	require.NoError(t, err)
+
+	defer logs.CloseAndLogErr(conn)
+
+	service, err := NewService(conn)
+	require.NoError(t, err)
+
+	edgeStackService, err := edgestack.NewService(conn, func(t portainer.Transaction, esi portainer.EdgeStackID) {})
+	require.NoError(t, err)
+
+	service.RegisterUpdateStackFunction(edgeStackService.UpdateEdgeStackFuncTx)
+	require.NoError(t, edgeStackService.Create(1, &portainer.EdgeStack{}))
+	require.NoError(t, service.Create(&portainer.EndpointRelation{EndpointID: 1, EdgeStacks: map[portainer.EdgeStackID]bool{}}))
+	require.NoError(t, service.AddEndpointRelationsForEdgeStack([]portainer.EndpointID{1}, &portainer.EdgeStack{ID: 1}))
+}
+
+func TestEndpointRelations(t *testing.T) {
+	t.Parallel()
+	var conn portainer.Connection = &boltdb.DbConnection{Path: t.TempDir()}
+	err := conn.Open()
+	require.NoError(t, err)
+
+	defer logs.CloseAndLogErr(conn)
+
+	service, err := NewService(conn)
+	require.NoError(t, err)
+
+	require.NoError(t, service.Create(&portainer.EndpointRelation{EndpointID: 1}))
+	rels, err := service.EndpointRelations()
+	require.NoError(t, err)
+	require.Len(t, rels, 1)
+}
diff --git a/api/dataservices/endpointrelation/tx.go b/api/dataservices/endpointrelation/tx.go
new file mode 100644
index 0000000..36639a4
--- /dev/null
+++ b/api/dataservices/endpointrelation/tx.go
@@ -0,0 +1,238 @@
+package endpointrelation
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/internal/edge/cache"
+
+	"github.com/rs/zerolog/log"
+)
+
+type ServiceTx struct {
+	service *Service
+	tx      portainer.Transaction
+}
+
+var _ dataservices.EndpointRelationService = &ServiceTx{}
+
+func (service ServiceTx) BucketName() string {
+	return BucketName
+}
+
+// EndpointRelations returns an array of all EndpointRelations
+func (service ServiceTx) EndpointRelations() ([]portainer.EndpointRelation, error) {
+	var all = make([]portainer.EndpointRelation, 0)
+
+	return all, service.tx.GetAll(
+		BucketName,
+		&portainer.EndpointRelation{},
+		dataservices.AppendFn(&all),
+	)
+}
+
+// EndpointRelation returns an Environment(Endpoint) relation object by EndpointID
+func (service ServiceTx) EndpointRelation(endpointID portainer.EndpointID) (*portainer.EndpointRelation, error) {
+	var endpointRelation portainer.EndpointRelation
+	identifier := service.service.connection.ConvertToKey(int(endpointID))
+
+	if err := service.tx.GetObject(BucketName, identifier, &endpointRelation); err != nil {
+		return nil, err
+	}
+
+	return &endpointRelation, nil
+}
+
+// CreateEndpointRelation saves endpointRelation
+func (service ServiceTx) Create(endpointRelation *portainer.EndpointRelation) error {
+	err := service.tx.CreateObjectWithId(BucketName, int(endpointRelation.EndpointID), endpointRelation)
+	cache.Del(endpointRelation.EndpointID)
+
+	service.service.mu.Lock()
+	service.service.endpointRelationsCache = nil
+	service.service.mu.Unlock()
+
+	return err
+}
+
+// UpdateEndpointRelation updates an Environment(Endpoint) relation object
+func (service ServiceTx) UpdateEndpointRelation(endpointID portainer.EndpointID, endpointRelation *portainer.EndpointRelation) error {
+	previousRelationState, _ := service.EndpointRelation(endpointID)
+
+	identifier := service.service.connection.ConvertToKey(int(endpointID))
+	err := service.tx.UpdateObject(BucketName, identifier, endpointRelation)
+	cache.Del(endpointID)
+	if err != nil {
+		return err
+	}
+
+	updatedRelationState, _ := service.EndpointRelation(endpointID)
+
+	service.service.mu.Lock()
+	service.service.endpointRelationsCache = nil
+	service.service.mu.Unlock()
+
+	service.updateEdgeStacksAfterRelationChange(previousRelationState, updatedRelationState)
+
+	return nil
+}
+
+func (service ServiceTx) AddEndpointRelationsForEdgeStack(endpointIDs []portainer.EndpointID, edgeStack *portainer.EdgeStack) error {
+	for _, endpointID := range endpointIDs {
+		rel, err := service.EndpointRelation(endpointID)
+		if err != nil {
+			return err
+		}
+
+		rel.EdgeStacks[edgeStack.ID] = true
+
+		identifier := service.service.connection.ConvertToKey(int(endpointID))
+		err = service.tx.UpdateObject(BucketName, identifier, rel)
+		cache.Del(endpointID)
+		if err != nil {
+			return err
+		}
+	}
+
+	service.service.mu.Lock()
+	service.service.endpointRelationsCache = nil
+	service.service.mu.Unlock()
+
+	if err := service.service.updateStackFnTx(service.tx, edgeStack.ID, func(es *portainer.EdgeStack) {
+		es.NumDeployments += len(endpointIDs)
+
+		// sync changes in `edgeStack` in case it is re-persisted after `AddEndpointRelationsForEdgeStack` call
+		// to avoid overriding with the previous values
+		edgeStack.NumDeployments = es.NumDeployments
+	}); err != nil {
+		log.Error().Err(err).Msg("could not update the number of deployments")
+	}
+
+	return nil
+}
+
+func (service ServiceTx) RemoveEndpointRelationsForEdgeStack(endpointIDs []portainer.EndpointID, edgeStackID portainer.EdgeStackID) error {
+	for _, endpointID := range endpointIDs {
+		rel, err := service.EndpointRelation(endpointID)
+		if err != nil {
+			return err
+		}
+
+		delete(rel.EdgeStacks, edgeStackID)
+
+		identifier := service.service.connection.ConvertToKey(int(endpointID))
+		err = service.tx.UpdateObject(BucketName, identifier, rel)
+		cache.Del(endpointID)
+		if err != nil {
+			return err
+		}
+	}
+
+	service.service.mu.Lock()
+	service.service.endpointRelationsCache = nil
+	service.service.mu.Unlock()
+
+	if err := service.service.updateStackFnTx(service.tx, edgeStackID, func(edgeStack *portainer.EdgeStack) {
+		edgeStack.NumDeployments -= len(endpointIDs)
+	}); err != nil {
+		log.Error().Err(err).Msg("could not update the number of deployments")
+	}
+
+	return nil
+}
+
+// DeleteEndpointRelation deletes an Environment(Endpoint) relation object
+func (service ServiceTx) DeleteEndpointRelation(endpointID portainer.EndpointID) error {
+	deletedRelation, _ := service.EndpointRelation(endpointID)
+
+	identifier := service.service.connection.ConvertToKey(int(endpointID))
+	err := service.tx.DeleteObject(BucketName, identifier)
+	cache.Del(endpointID)
+	if err != nil {
+		return err
+	}
+
+	service.service.mu.Lock()
+	service.service.endpointRelationsCache = nil
+	service.service.mu.Unlock()
+
+	service.updateEdgeStacksAfterRelationChange(deletedRelation, nil)
+
+	return nil
+}
+
+func (service ServiceTx) InvalidateEdgeCacheForEdgeStack(edgeStackID portainer.EdgeStackID) {
+	rels, err := service.cachedEndpointRelations()
+	if err != nil {
+		log.Error().Err(err).Msg("cannot retrieve endpoint relations")
+		return
+	}
+
+	for _, rel := range rels {
+		if _, ok := rel.EdgeStacks[edgeStackID]; ok {
+			cache.Del(rel.EndpointID)
+		}
+	}
+}
+
+func (service ServiceTx) cachedEndpointRelations() ([]portainer.EndpointRelation, error) {
+	service.service.mu.Lock()
+	defer service.service.mu.Unlock()
+
+	if service.service.endpointRelationsCache == nil {
+		var err error
+		service.service.endpointRelationsCache, err = service.EndpointRelations()
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	return service.service.endpointRelationsCache, nil
+}
+
+func (service ServiceTx) updateEdgeStacksAfterRelationChange(previousRelationState *portainer.EndpointRelation, updatedRelationState *portainer.EndpointRelation) {
+	if previousRelationState != nil {
+		for stackId, enabled := range previousRelationState.EdgeStacks {
+			// flag stack for update if stack is not in the updated relation state
+			// = stack has been removed for this relation
+			// or this relation has been deleted
+			if enabled && (updatedRelationState == nil || !updatedRelationState.EdgeStacks[stackId]) {
+				if err := service.service.updateStackFnTx(service.tx, stackId, func(edgeStack *portainer.EdgeStack) {
+					// Sanity check
+					if edgeStack.NumDeployments <= 0 {
+						log.Error().
+							Int("edgestack_id", int(edgeStack.ID)).
+							Int("endpoint_id", int(previousRelationState.EndpointID)).
+							Int("num_deployments", edgeStack.NumDeployments).
+							Msg("cannot decrement the number of deployments for an edge stack with zero deployments")
+
+						return
+					}
+
+					edgeStack.NumDeployments--
+				}); err != nil {
+					log.Error().Err(err).Msg("could not update the number of deployments")
+				}
+
+				cache.Del(previousRelationState.EndpointID)
+			}
+		}
+	}
+
+	if updatedRelationState == nil {
+		return
+	}
+
+	for stackId, enabled := range updatedRelationState.EdgeStacks {
+		// flag stack for update if stack is not in the previous relation state
+		// = stack has been added for this relation
+		if enabled && (previousRelationState == nil || !previousRelationState.EdgeStacks[stackId]) {
+			if err := service.service.updateStackFnTx(service.tx, stackId, func(edgeStack *portainer.EdgeStack) {
+				edgeStack.NumDeployments++
+			}); err != nil {
+				log.Error().Err(err).Msg("could not update the number of deployments")
+			}
+
+			cache.Del(updatedRelationState.EndpointID)
+		}
+	}
+}
diff --git a/api/dataservices/errors/errors.go b/api/dataservices/errors/errors.go
new file mode 100644
index 0000000..f8fbe84
--- /dev/null
+++ b/api/dataservices/errors/errors.go
@@ -0,0 +1,12 @@
+package errors
+
+import (
+	"errors"
+)
+
+var (
+	ErrObjectNotFound     = errors.New("object not found inside the database")
+	ErrWrongDBEdition     = errors.New("the Portainer database is set for Portainer Business Edition, please follow the instructions in our documentation to downgrade it: https://docs.portainer.io/faqs/upgrading/can-i-downgrade-from-portainer-business-to-portainer-ce")
+	ErrDBImportFailed     = errors.New("importing backup failed")
+	ErrDatabaseIsUpdating = errors.New("database is currently in updating state. Failed prior upgrade. Please restore from backup or delete the database and restart Portainer")
+)
diff --git a/api/dataservices/extension/extension.go b/api/dataservices/extension/extension.go
new file mode 100644
index 0000000..2af6fac
--- /dev/null
+++ b/api/dataservices/extension/extension.go
@@ -0,0 +1,66 @@
+package extension
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+)
+
+// BucketName represents the name of the bucket where this service stores data.
+const BucketName = "extension"
+
+// Service represents a service for managing environment(endpoint) data.
+type Service struct {
+	connection portainer.Connection
+}
+
+func (service *Service) BucketName() string {
+	return BucketName
+}
+
+// NewService creates a new instance of a service.
+func NewService(connection portainer.Connection) (*Service, error) {
+	err := connection.SetServiceName(BucketName)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Service{
+		connection: connection,
+	}, nil
+}
+
+// Extension returns a extension by ID
+func (service *Service) Extension(ID portainer.ExtensionID) (*portainer.Extension, error) {
+	var extension portainer.Extension
+	identifier := service.connection.ConvertToKey(int(ID))
+
+	err := service.connection.GetObject(BucketName, identifier, &extension)
+	if err != nil {
+		return nil, err
+	}
+
+	return &extension, nil
+}
+
+// Extensions return an array containing all the extensions.
+func (service *Service) Extensions() ([]portainer.Extension, error) {
+	var extensions = make([]portainer.Extension, 0)
+
+	return extensions, service.connection.GetAll(
+		BucketName,
+		&portainer.Extension{},
+		dataservices.AppendFn(&extensions),
+	)
+
+}
+
+// Persist persists a extension inside the database.
+func (service *Service) Persist(extension *portainer.Extension) error {
+	return service.connection.CreateObjectWithId(BucketName, int(extension.ID), extension)
+}
+
+// DeleteExtension deletes a Extension.
+func (service *Service) DeleteExtension(ID portainer.ExtensionID) error {
+	identifier := service.connection.ConvertToKey(int(ID))
+	return service.connection.DeleteObject(BucketName, identifier)
+}
diff --git a/api/dataservices/helmuserrepository/helmuserrepository.go b/api/dataservices/helmuserrepository/helmuserrepository.go
new file mode 100644
index 0000000..0b2dbcf
--- /dev/null
+++ b/api/dataservices/helmuserrepository/helmuserrepository.go
@@ -0,0 +1,53 @@
+package helmuserrepository
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+)
+
+// BucketName represents the name of the bucket where this service stores data.
+const BucketName = "helm_user_repository"
+
+// Service represents a service for managing environment(endpoint) data.
+type Service struct {
+	dataservices.BaseDataService[portainer.HelmUserRepository, portainer.HelmUserRepositoryID]
+}
+
+// NewService creates a new instance of a service.
+func NewService(connection portainer.Connection) (*Service, error) {
+	err := connection.SetServiceName(BucketName)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Service{
+		BaseDataService: dataservices.BaseDataService[portainer.HelmUserRepository, portainer.HelmUserRepositoryID]{
+			Bucket:     BucketName,
+			Connection: connection,
+		},
+	}, nil
+}
+
+// HelmUserRepositoryByUserID return an array containing all the HelmUserRepository objects where the specified userID is present.
+func (service *Service) HelmUserRepositoryByUserID(userID portainer.UserID) ([]portainer.HelmUserRepository, error) {
+	var result = make([]portainer.HelmUserRepository, 0)
+
+	return result, service.Connection.GetAll(
+		BucketName,
+		&portainer.HelmUserRepository{},
+		dataservices.FilterFn(&result, func(e portainer.HelmUserRepository) bool {
+			return e.UserID == userID
+		}),
+	)
+}
+
+// CreateHelmUserRepository creates a new HelmUserRepository object.
+func (service *Service) Create(record *portainer.HelmUserRepository) error {
+	return service.Connection.CreateObject(
+		BucketName,
+		func(id uint64) (int, any) {
+			record.ID = portainer.HelmUserRepositoryID(id)
+			return int(record.ID), record
+		},
+	)
+}
diff --git a/api/dataservices/helpers.go b/api/dataservices/helpers.go
new file mode 100644
index 0000000..e2733fa
--- /dev/null
+++ b/api/dataservices/helpers.go
@@ -0,0 +1,77 @@
+package dataservices
+
+import (
+	"errors"
+	"fmt"
+
+	perrors "github.com/portainer/portainer/api/dataservices/errors"
+
+	"github.com/rs/zerolog/log"
+)
+
+// ErrStop signals the stop of computation when filtering results
+var ErrStop = errors.New("stop")
+
+func IsErrObjectNotFound(e error) bool {
+	return errors.Is(e, perrors.ErrObjectNotFound)
+}
+
+// AppendFn appends elements to the given collection slice
+func AppendFn[T any](collection *[]T) func(obj any) (any, error) {
+	return func(obj any) (any, error) {
+		element, ok := obj.(*T)
+		if !ok {
+			log.Debug().Str("obj", fmt.Sprintf("%#v", obj)).Msg("type assertion failed")
+			return nil, fmt.Errorf("failed to convert to %T object: %#v", new(T), obj)
+		}
+
+		*collection = append(*collection, *element)
+
+		var zero T
+		*element = zero
+
+		return element, nil
+	}
+}
+
+// FilterFn appends elements to the given collection when the predicate is true
+func FilterFn[T any](collection *[]T, predicate func(T) bool) func(obj any) (any, error) {
+	return func(obj any) (any, error) {
+		element, ok := obj.(*T)
+		if !ok {
+			log.Debug().Str("obj", fmt.Sprintf("%#v", obj)).Msg("type assertion failed")
+			return nil, fmt.Errorf("failed to convert to %T object: %#v", new(T), obj)
+		}
+
+		if predicate(*element) {
+			*collection = append(*collection, *element)
+		}
+
+		var zero T
+		*element = zero
+
+		return element, nil
+	}
+}
+
+// FirstFn sets the element to the first one that satisfies the predicate and stops the computation, returns ErrStop on
+// success
+func FirstFn[T any](element *T, predicate func(T) bool) func(obj any) (any, error) {
+	return func(obj any) (any, error) {
+		e, ok := obj.(*T)
+		if !ok {
+			log.Debug().Str("obj", fmt.Sprintf("%#v", obj)).Msg("type assertion failed")
+			return nil, fmt.Errorf("failed to convert to %T object: %#v", new(T), obj)
+		}
+
+		if predicate(*e) {
+			*element = *e
+			return e, ErrStop
+		}
+
+		var zero T
+		*e = zero
+
+		return e, nil
+	}
+}
diff --git a/api/dataservices/interface.go b/api/dataservices/interface.go
new file mode 100644
index 0000000..c301616
--- /dev/null
+++ b/api/dataservices/interface.go
@@ -0,0 +1,282 @@
+package dataservices
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/database/models"
+)
+
+type (
+	DataStoreTx interface {
+		IsErrObjectNotFound(err error) bool
+		AllowList() AllowListService
+		CustomTemplate() CustomTemplateService
+		EdgeGroup() EdgeGroupService
+		EdgeJob() EdgeJobService
+		EdgeStack() EdgeStackService
+		EdgeStackStatus() EdgeStackStatusService
+		Endpoint() EndpointService
+		EndpointGroup() EndpointGroupService
+		EndpointRelation() EndpointRelationService
+		HelmUserRepository() HelmUserRepositoryService
+		Registry() RegistryService
+		ResourceControl() ResourceControlService
+		Role() RoleService
+		APIKeyRepository() APIKeyRepository
+		Settings() SettingsService
+		Snapshot() SnapshotService
+		SSLSettings() SSLSettingsService
+		Source() SourceService
+		Stack() StackService
+		Tag() TagService
+		TeamMembership() TeamMembershipService
+		Team() TeamService
+		TunnelServer() TunnelServerService
+		User() UserService
+		Version() VersionService
+		Webhook() WebhookService
+		Workflow() WorkflowService
+		PendingActions() PendingActionsService
+	}
+
+	DataStore interface {
+		Connection() portainer.Connection
+		Open() (newStore bool, err error)
+		Init() error
+		Close() error
+		UpdateTx(func(tx DataStoreTx) error) error
+		ViewTx(func(tx DataStoreTx) error) error
+		MigrateData() error
+		Rollback(force bool) error
+		CheckCurrentEdition() error
+		Backup(path string) (string, error)
+		Export(filename string) (err error)
+
+		DataStoreTx
+	}
+
+	// AllowListService represents a service for managing the URL allow list
+	AllowListService interface {
+		Read(id portainer.AllowListKey) (*portainer.AllowList, error)
+		ReadAll() ([]portainer.AllowList, error)
+		ReadParsed(id portainer.AllowListKey) (*portainer.ParsedAllowList, error)
+		Update(id portainer.AllowListKey, allowList *portainer.AllowList) error
+		BucketName() string
+	}
+
+	// CustomTemplateService represents a service to manage custom templates
+	CustomTemplateService interface {
+		BaseCRUD[portainer.CustomTemplate, portainer.CustomTemplateID]
+		GetNextIdentifier() int
+	}
+
+	// EdgeGroupService represents a service to manage Edge groups
+	EdgeGroupService interface {
+		BaseCRUD[portainer.EdgeGroup, portainer.EdgeGroupID]
+		UpdateEdgeGroupFunc(ID portainer.EdgeGroupID, updateFunc func(group *portainer.EdgeGroup)) error
+	}
+
+	// EdgeJobService represents a service to manage Edge jobs
+	EdgeJobService interface {
+		BaseCRUD[portainer.EdgeJob, portainer.EdgeJobID]
+		CreateWithID(ID portainer.EdgeJobID, edgeJob *portainer.EdgeJob) error
+		UpdateEdgeJobFunc(ID portainer.EdgeJobID, updateFunc func(edgeJob *portainer.EdgeJob)) error
+		GetNextIdentifier() int
+	}
+
+	PendingActionsService interface {
+		BaseCRUD[portainer.PendingAction, portainer.PendingActionID]
+		GetNextIdentifier() int
+		DeleteByEndpointID(ID portainer.EndpointID) error
+	}
+
+	// EdgeStackService represents a service to manage Edge stacks
+	EdgeStackService interface {
+		EdgeStacks() ([]portainer.EdgeStack, error)
+		EdgeStack(ID portainer.EdgeStackID) (*portainer.EdgeStack, error)
+		EdgeStackVersion(ID portainer.EdgeStackID) (int, bool)
+		Create(id portainer.EdgeStackID, edgeStack *portainer.EdgeStack) error
+		UpdateEdgeStack(ID portainer.EdgeStackID, edgeStack *portainer.EdgeStack) error
+		UpdateEdgeStackFunc(ID portainer.EdgeStackID, updateFunc func(edgeStack *portainer.EdgeStack)) error
+		DeleteEdgeStack(ID portainer.EdgeStackID) error
+		GetNextIdentifier() int
+		BucketName() string
+	}
+
+	EdgeStackStatusService interface {
+		Create(edgeStackID portainer.EdgeStackID, endpointID portainer.EndpointID, status *portainer.EdgeStackStatusForEnv) error
+		Read(edgeStackID portainer.EdgeStackID, endpointID portainer.EndpointID) (*portainer.EdgeStackStatusForEnv, error)
+		ReadAll(edgeStackID portainer.EdgeStackID) ([]portainer.EdgeStackStatusForEnv, error)
+		Update(edgeStackID portainer.EdgeStackID, endpointID portainer.EndpointID, status *portainer.EdgeStackStatusForEnv) error
+		Delete(edgeStackID portainer.EdgeStackID, endpointID portainer.EndpointID) error
+		DeleteAll(edgeStackID portainer.EdgeStackID) error
+		Clear(edgeStackID portainer.EdgeStackID, relatedEnvironmentsIDs []portainer.EndpointID) error
+	}
+
+	// EndpointService represents a service for managing environment(endpoint) data
+	EndpointService interface {
+		// partial dataservices.BaseCRUD[portainer.Endpoint, portainer.EndpointID]
+		ReadAll(predicates ...func(endpoint portainer.Endpoint) bool) ([]portainer.Endpoint, error)
+
+		Endpoint(ID portainer.EndpointID) (*portainer.Endpoint, error)
+		EndpointIDByEdgeID(edgeID string) (portainer.EndpointID, bool)
+		EndpointsByTeamID(teamID portainer.TeamID) ([]portainer.Endpoint, error)
+		Heartbeat(endpointID portainer.EndpointID) (int64, bool)
+		UpdateHeartbeat(endpointID portainer.EndpointID)
+		Endpoints() ([]portainer.Endpoint, error)
+		Create(endpoint *portainer.Endpoint) error
+		UpdateEndpoint(ID portainer.EndpointID, endpoint *portainer.Endpoint) error
+		DeleteEndpoint(ID portainer.EndpointID) error
+		GetNextIdentifier() int
+		BucketName() string
+	}
+
+	// EndpointGroupService represents a service for managing environment(endpoint) group data
+	EndpointGroupService interface {
+		BaseCRUD[portainer.EndpointGroup, portainer.EndpointGroupID]
+	}
+
+	// EndpointRelationService represents a service for managing environment(endpoint) relations data
+	EndpointRelationService interface {
+		EndpointRelations() ([]portainer.EndpointRelation, error)
+		EndpointRelation(EndpointID portainer.EndpointID) (*portainer.EndpointRelation, error)
+		Create(endpointRelation *portainer.EndpointRelation) error
+		UpdateEndpointRelation(EndpointID portainer.EndpointID, endpointRelation *portainer.EndpointRelation) error
+		AddEndpointRelationsForEdgeStack(endpointIDs []portainer.EndpointID, edgeStack *portainer.EdgeStack) error
+		RemoveEndpointRelationsForEdgeStack(endpointIDs []portainer.EndpointID, edgeStackID portainer.EdgeStackID) error
+		DeleteEndpointRelation(EndpointID portainer.EndpointID) error
+		BucketName() string
+	}
+
+	// HelmUserRepositoryService represents a service to manage HelmUserRepositories
+	HelmUserRepositoryService interface {
+		BaseCRUD[portainer.HelmUserRepository, portainer.HelmUserRepositoryID]
+		HelmUserRepositoryByUserID(userID portainer.UserID) ([]portainer.HelmUserRepository, error)
+	}
+
+	// RegistryService represents a service for managing registry data
+	RegistryService interface {
+		BaseCRUD[portainer.Registry, portainer.RegistryID]
+	}
+
+	// ResourceControlService represents a service for managing resource control data
+	ResourceControlService interface {
+		BaseCRUD[portainer.ResourceControl, portainer.ResourceControlID]
+		ResourceControlByResourceIDAndType(resourceID string, resourceType portainer.ResourceControlType) (*portainer.ResourceControl, error)
+	}
+
+	// RoleService represents a service for managing user roles
+	RoleService interface {
+		BaseCRUD[portainer.Role, portainer.RoleID]
+	}
+
+	// APIKeyRepositoryService
+	APIKeyRepository interface {
+		BaseCRUD[portainer.APIKey, portainer.APIKeyID]
+		GetAPIKeysByUserID(userID portainer.UserID) ([]portainer.APIKey, error)
+		GetAPIKeyByDigest(digest string) (*portainer.APIKey, error)
+	}
+
+	// SettingsService represents a service for managing application settings
+	SettingsService interface {
+		Settings() (*portainer.Settings, error)
+		UpdateSettings(settings *portainer.Settings) error
+		BucketName() string
+	}
+
+	SnapshotService interface {
+		BaseCRUD[portainer.Snapshot, portainer.EndpointID]
+		ReadWithoutSnapshotRaw(ID portainer.EndpointID) (*portainer.Snapshot, error)
+	}
+
+	// SSLSettingsService represents a service for managing application settings
+	SSLSettingsService interface {
+		Settings() (*portainer.SSLSettings, error)
+		UpdateSettings(settings *portainer.SSLSettings) error
+		BucketName() string
+	}
+
+	SourceServiceUserContext interface {
+		ID() portainer.UserID
+		TeamMemberships() []portainer.TeamMembership
+		IsAdmin() bool
+	}
+
+	// SourceService represents a service for managing GitOps source data
+	SourceService interface {
+		Create(context SourceServiceUserContext, source *portainer.Source) error
+		Read(context SourceServiceUserContext, ID portainer.SourceID) (*portainer.Source, error)
+		Exists(context SourceServiceUserContext, ID portainer.SourceID) (bool, error)
+		ReadAll(context SourceServiceUserContext, predicates ...func(portainer.Source) bool) ([]portainer.Source, error)
+		Update(context SourceServiceUserContext, ID portainer.SourceID, source *portainer.Source) error
+		Delete(context SourceServiceUserContext, ID portainer.SourceID) error
+		FindOrCreateGitSource(context SourceServiceUserContext, source *portainer.Source) (*portainer.Source, error)
+	}
+
+	// StackService represents a service for managing stack data
+	StackService interface {
+		BaseCRUD[portainer.Stack, portainer.StackID]
+		StackByName(name string) (*portainer.Stack, error)
+		StacksByName(name string) ([]portainer.Stack, error)
+		GetNextIdentifier() int
+		StackByWebhookID(ID string) (*portainer.Stack, error)
+		RefreshableStacks() ([]portainer.Stack, error)
+	}
+
+	// TagService represents a service for managing tag data
+	TagService interface {
+		BaseCRUD[portainer.Tag, portainer.TagID]
+		UpdateTagFunc(ID portainer.TagID, updateFunc func(tag *portainer.Tag)) error
+	}
+
+	// TeamService represents a service for managing user data
+	TeamService interface {
+		BaseCRUD[portainer.Team, portainer.TeamID]
+		TeamByName(name string) (*portainer.Team, error)
+	}
+
+	// TeamMembershipService represents a service for managing team membership data
+	TeamMembershipService interface {
+		BaseCRUD[portainer.TeamMembership, portainer.TeamMembershipID]
+		TeamMembershipsByUserID(userID portainer.UserID) ([]portainer.TeamMembership, error)
+		TeamMembershipsByTeamID(teamID portainer.TeamID) ([]portainer.TeamMembership, error)
+		DeleteTeamMembershipByUserID(userID portainer.UserID) error
+		DeleteTeamMembershipByTeamID(teamID portainer.TeamID) error
+		DeleteTeamMembershipByTeamIDAndUserID(teamID portainer.TeamID, userID portainer.UserID) error
+	}
+
+	// TunnelServerService represents a service for managing data associated to the tunnel server
+	TunnelServerService interface {
+		Info() (*portainer.TunnelServerInfo, error)
+		UpdateInfo(info *portainer.TunnelServerInfo) error
+		BucketName() string
+	}
+
+	// UserService represents a service for managing user data
+	UserService interface {
+		BaseCRUD[portainer.User, portainer.UserID]
+		UserByUsername(username string) (*portainer.User, error)
+		UserIDByUsername(username string) (portainer.UserID, error)
+		UsersByRole(role portainer.UserRole) ([]portainer.User, error)
+	}
+
+	// VersionService represents a service for managing version data
+	VersionService interface {
+		InstanceID() (string, error)
+		UpdateInstanceID(ID string) error
+		Edition() (portainer.SoftwareEdition, error)
+		Version() (*models.Version, error)
+		UpdateVersion(*models.Version) error
+	}
+
+	// WebhookService represents a service for managing webhook data.
+	WebhookService interface {
+		BaseCRUD[portainer.Webhook, portainer.WebhookID]
+		WebhookByResourceID(resourceID string) (*portainer.Webhook, error)
+		WebhookByToken(token string) (*portainer.Webhook, error)
+	}
+
+	// WorkflowService represents a service for managing GitOps workflow data
+	WorkflowService interface {
+		BaseCRUD[portainer.Workflow, portainer.WorkflowID]
+	}
+)
diff --git a/api/dataservices/pendingactions/pendingactions.go b/api/dataservices/pendingactions/pendingactions.go
new file mode 100644
index 0000000..5fd2793
--- /dev/null
+++ b/api/dataservices/pendingactions/pendingactions.go
@@ -0,0 +1,59 @@
+package pendingactions
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+)
+
+const BucketName = "pending_actions"
+
+type Service struct {
+	dataservices.BaseDataService[portainer.PendingAction, portainer.PendingActionID]
+}
+
+func NewService(connection portainer.Connection) (*Service, error) {
+	err := connection.SetServiceName(BucketName)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Service{
+		BaseDataService: dataservices.BaseDataService[portainer.PendingAction, portainer.PendingActionID]{
+			Bucket:     BucketName,
+			Connection: connection,
+		},
+	}, nil
+}
+
+// GetNextIdentifier returns the next identifier for a custom template.
+func (service *Service) GetNextIdentifier() int {
+	return service.Connection.GetNextIdentifier(BucketName)
+}
+
+func (s Service) Create(config *portainer.PendingAction) error {
+	return s.Connection.UpdateTx(func(tx portainer.Transaction) error {
+		return s.Tx(tx).Create(config)
+	})
+}
+
+func (s Service) Update(ID portainer.PendingActionID, config *portainer.PendingAction) error {
+	return s.Connection.UpdateTx(func(tx portainer.Transaction) error {
+		return s.Tx(tx).Update(ID, config)
+	})
+}
+
+func (s Service) DeleteByEndpointID(ID portainer.EndpointID) error {
+	return s.Connection.UpdateTx(func(tx portainer.Transaction) error {
+		return s.Tx(tx).DeleteByEndpointID(ID)
+	})
+}
+
+func (service *Service) Tx(tx portainer.Transaction) ServiceTx {
+	return ServiceTx{
+		BaseDataServiceTx: dataservices.BaseDataServiceTx[portainer.PendingAction, portainer.PendingActionID]{
+			Bucket:     BucketName,
+			Connection: service.Connection,
+			Tx:         tx,
+		},
+	}
+}
diff --git a/api/dataservices/pendingactions/pendingactions_test.go b/api/dataservices/pendingactions/pendingactions_test.go
new file mode 100644
index 0000000..a9583f8
--- /dev/null
+++ b/api/dataservices/pendingactions/pendingactions_test.go
@@ -0,0 +1,33 @@
+package pendingactions_test
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestDeleteByEndpoint(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, false)
+
+	// Create Endpoint 1
+	err := store.PendingActions().Create(&portainer.PendingAction{EndpointID: 1})
+	require.NoError(t, err)
+
+	// Create Endpoint 2
+	err = store.PendingActions().Create(&portainer.PendingAction{EndpointID: 2})
+	require.NoError(t, err)
+
+	// Delete Endpoint 1
+	err = store.PendingActions().DeleteByEndpointID(1)
+	require.NoError(t, err)
+
+	// Check that only Endpoint 2 remains
+	pendingActions, err := store.PendingActions().ReadAll()
+	require.NoError(t, err)
+	require.Len(t, pendingActions, 1)
+	require.Equal(t, portainer.EndpointID(2), pendingActions[0].EndpointID)
+}
diff --git a/api/dataservices/pendingactions/tx.go b/api/dataservices/pendingactions/tx.go
new file mode 100644
index 0000000..40090a2
--- /dev/null
+++ b/api/dataservices/pendingactions/tx.go
@@ -0,0 +1,49 @@
+package pendingactions
+
+import (
+	"fmt"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/rs/zerolog/log"
+)
+
+type ServiceTx struct {
+	dataservices.BaseDataServiceTx[portainer.PendingAction, portainer.PendingActionID]
+}
+
+func (s ServiceTx) Create(config *portainer.PendingAction) error {
+	return s.Tx.CreateObject(BucketName, func(id uint64) (int, any) {
+		config.ID = portainer.PendingActionID(id)
+		config.CreatedAt = time.Now().Unix()
+
+		return int(config.ID), config
+	})
+}
+
+func (s ServiceTx) Update(ID portainer.PendingActionID, config *portainer.PendingAction) error {
+	return s.BaseDataServiceTx.Update(ID, config)
+}
+
+func (s ServiceTx) DeleteByEndpointID(ID portainer.EndpointID) error {
+	log.Debug().Int("endpointId", int(ID)).Msg("deleting pending actions for endpoint")
+	pendingActions, err := s.ReadAll()
+	if err != nil {
+		return fmt.Errorf("failed to retrieve pending-actions for endpoint (%d): %w", ID, err)
+	}
+
+	for _, pendingAction := range pendingActions {
+		if pendingAction.EndpointID == ID {
+			if err := s.Delete(pendingAction.ID); err != nil {
+				log.Debug().Int("endpointId", int(ID)).Msgf("failed to delete pending action: %v", err)
+			}
+		}
+	}
+	return nil
+}
+
+// GetNextIdentifier returns the next identifier for a custom template.
+func (service ServiceTx) GetNextIdentifier() int {
+	return service.Tx.GetNextIdentifier(BucketName)
+}
diff --git a/api/dataservices/registry/registry.go b/api/dataservices/registry/registry.go
new file mode 100644
index 0000000..c35013f
--- /dev/null
+++ b/api/dataservices/registry/registry.go
@@ -0,0 +1,50 @@
+package registry
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+)
+
+// BucketName represents the name of the bucket where this service stores data.
+const BucketName = "registries"
+
+// Service represents a service for managing environment(endpoint) data.
+type Service struct {
+	dataservices.BaseDataService[portainer.Registry, portainer.RegistryID]
+}
+
+// NewService creates a new instance of a service.
+func NewService(connection portainer.Connection) (*Service, error) {
+	err := connection.SetServiceName(BucketName)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Service{
+		BaseDataService: dataservices.BaseDataService[portainer.Registry, portainer.RegistryID]{
+			Bucket:     BucketName,
+			Connection: connection,
+		},
+	}, nil
+}
+
+func (service *Service) Tx(tx portainer.Transaction) ServiceTx {
+	return ServiceTx{
+		BaseDataServiceTx: dataservices.BaseDataServiceTx[portainer.Registry, portainer.RegistryID]{
+			Bucket:     BucketName,
+			Connection: service.Connection,
+			Tx:         tx,
+		},
+	}
+}
+
+// Create creates a new registry.
+func (service *Service) Create(registry *portainer.Registry) error {
+	return service.Connection.CreateObject(
+		BucketName,
+		func(id uint64) (int, any) {
+			registry.ID = portainer.RegistryID(id)
+			return int(registry.ID), registry
+		},
+	)
+}
diff --git a/api/dataservices/registry/tx.go b/api/dataservices/registry/tx.go
new file mode 100644
index 0000000..410bf12
--- /dev/null
+++ b/api/dataservices/registry/tx.go
@@ -0,0 +1,21 @@
+package registry
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+)
+
+type ServiceTx struct {
+	dataservices.BaseDataServiceTx[portainer.Registry, portainer.RegistryID]
+}
+
+// Create creates a new registry.
+func (service ServiceTx) Create(registry *portainer.Registry) error {
+	return service.Tx.CreateObject(
+		BucketName,
+		func(id uint64) (int, any) {
+			registry.ID = portainer.RegistryID(id)
+			return int(registry.ID), registry
+		},
+	)
+}
diff --git a/api/dataservices/resourcecontrol/resourcecontrol.go b/api/dataservices/resourcecontrol/resourcecontrol.go
new file mode 100644
index 0000000..306ad33
--- /dev/null
+++ b/api/dataservices/resourcecontrol/resourcecontrol.go
@@ -0,0 +1,79 @@
+package resourcecontrol
+
+import (
+	"errors"
+	"slices"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+)
+
+// BucketName represents the name of the bucket where this service stores data.
+const BucketName = "resource_control"
+
+// Service represents a service for managing environment(endpoint) data.
+type Service struct {
+	dataservices.BaseDataService[portainer.ResourceControl, portainer.ResourceControlID]
+}
+
+// NewService creates a new instance of a service.
+func NewService(connection portainer.Connection) (*Service, error) {
+	err := connection.SetServiceName(BucketName)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Service{
+		BaseDataService: dataservices.BaseDataService[portainer.ResourceControl, portainer.ResourceControlID]{
+			Bucket:     BucketName,
+			Connection: connection,
+		},
+	}, nil
+}
+
+func (service *Service) Tx(tx portainer.Transaction) ServiceTx {
+	return ServiceTx{
+		BaseDataServiceTx: dataservices.BaseDataServiceTx[portainer.ResourceControl, portainer.ResourceControlID]{
+			Bucket:     BucketName,
+			Connection: service.Connection,
+			Tx:         tx,
+		},
+	}
+}
+
+// ResourceControlByResourceIDAndType returns a ResourceControl object by checking if the resourceID is equal
+// to the main ResourceID or in SubResourceIDs. It also performs a check on the resource type. Return nil
+// if no ResourceControl was found.
+func (service *Service) ResourceControlByResourceIDAndType(resourceID string, resourceType portainer.ResourceControlType) (*portainer.ResourceControl, error) {
+	var found portainer.ResourceControl
+
+	err := service.Connection.GetAll(
+		BucketName,
+		&portainer.ResourceControl{},
+		dataservices.FirstFn(&found, func(rc portainer.ResourceControl) bool {
+			return (rc.ResourceID == resourceID && rc.Type == resourceType) ||
+				slices.Contains(rc.SubResourceIDs, resourceID)
+		}),
+	)
+
+	if errors.Is(err, dataservices.ErrStop) {
+		return &found, nil
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	return nil, nil
+}
+
+// CreateResourceControl creates a new ResourceControl object
+func (service *Service) Create(resourceControl *portainer.ResourceControl) error {
+	return service.Connection.CreateObject(
+		BucketName,
+		func(id uint64) (int, any) {
+			resourceControl.ID = portainer.ResourceControlID(id)
+			return int(resourceControl.ID), resourceControl
+		},
+	)
+}
diff --git a/api/dataservices/resourcecontrol/tx.go b/api/dataservices/resourcecontrol/tx.go
new file mode 100644
index 0000000..d795ce9
--- /dev/null
+++ b/api/dataservices/resourcecontrol/tx.go
@@ -0,0 +1,50 @@
+package resourcecontrol
+
+import (
+	"errors"
+	"slices"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+)
+
+type ServiceTx struct {
+	dataservices.BaseDataServiceTx[portainer.ResourceControl, portainer.ResourceControlID]
+}
+
+// ResourceControlByResourceIDAndType returns a ResourceControl object by checking if the resourceID is equal
+// to the main ResourceID or in SubResourceIDs. It also performs a check on the resource type. Return nil
+// if no ResourceControl was found.
+func (service ServiceTx) ResourceControlByResourceIDAndType(resourceID string, resourceType portainer.ResourceControlType) (*portainer.ResourceControl, error) {
+	var found portainer.ResourceControl
+
+	err := service.Tx.GetAll(
+		BucketName,
+		&portainer.ResourceControl{},
+		dataservices.FirstFn(&found, func(rc portainer.ResourceControl) bool {
+			return (rc.ResourceID == resourceID && rc.Type == resourceType) ||
+				slices.Contains(rc.SubResourceIDs, resourceID)
+		}),
+	)
+
+	if errors.Is(err, dataservices.ErrStop) {
+		return &found, nil
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	return nil, nil
+}
+
+// CreateResourceControl creates a new ResourceControl object
+func (service ServiceTx) Create(resourceControl *portainer.ResourceControl) error {
+	return service.Tx.CreateObject(
+		BucketName,
+		func(id uint64) (int, any) {
+			resourceControl.ID = portainer.ResourceControlID(id)
+			return int(resourceControl.ID), resourceControl
+		},
+	)
+}
diff --git a/api/dataservices/role/role.go b/api/dataservices/role/role.go
new file mode 100644
index 0000000..04c4cd1
--- /dev/null
+++ b/api/dataservices/role/role.go
@@ -0,0 +1,50 @@
+package role
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+)
+
+// BucketName represents the name of the bucket where this service stores data.
+const BucketName = "roles"
+
+// Service represents a service for managing environment(endpoint) data.
+type Service struct {
+	dataservices.BaseDataService[portainer.Role, portainer.RoleID]
+}
+
+// NewService creates a new instance of a service.
+func NewService(connection portainer.Connection) (*Service, error) {
+	err := connection.SetServiceName(BucketName)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Service{
+		BaseDataService: dataservices.BaseDataService[portainer.Role, portainer.RoleID]{
+			Bucket:     BucketName,
+			Connection: connection,
+		},
+	}, nil
+}
+
+func (service *Service) Tx(tx portainer.Transaction) ServiceTx {
+	return ServiceTx{
+		BaseDataServiceTx: dataservices.BaseDataServiceTx[portainer.Role, portainer.RoleID]{
+			Bucket:     BucketName,
+			Connection: service.Connection,
+			Tx:         tx,
+		},
+	}
+}
+
+// CreateRole creates a new Role.
+func (service *Service) Create(role *portainer.Role) error {
+	return service.Connection.CreateObject(
+		BucketName,
+		func(id uint64) (int, any) {
+			role.ID = portainer.RoleID(id)
+			return int(role.ID), role
+		},
+	)
+}
diff --git a/api/dataservices/role/tx.go b/api/dataservices/role/tx.go
new file mode 100644
index 0000000..ea2ec7a
--- /dev/null
+++ b/api/dataservices/role/tx.go
@@ -0,0 +1,21 @@
+package role
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+)
+
+type ServiceTx struct {
+	dataservices.BaseDataServiceTx[portainer.Role, portainer.RoleID]
+}
+
+// CreateRole creates a new Role.
+func (service ServiceTx) Create(role *portainer.Role) error {
+	return service.Tx.CreateObject(
+		BucketName,
+		func(id uint64) (int, any) {
+			role.ID = portainer.RoleID(id)
+			return int(role.ID), role
+		},
+	)
+}
diff --git a/api/dataservices/schedule/schedule.go b/api/dataservices/schedule/schedule.go
new file mode 100644
index 0000000..d8df531
--- /dev/null
+++ b/api/dataservices/schedule/schedule.go
@@ -0,0 +1,90 @@
+package schedule
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+)
+
+// BucketName represents the name of the bucket where this service stores data.
+const BucketName = "schedules"
+
+// Service represents a service for managing schedule data.
+type Service struct {
+	connection portainer.Connection
+}
+
+func (service *Service) BucketName() string {
+	return BucketName
+}
+
+// NewService creates a new instance of a service.
+func NewService(connection portainer.Connection) (*Service, error) {
+	err := connection.SetServiceName(BucketName)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Service{
+		connection: connection,
+	}, nil
+}
+
+// Schedule returns a schedule by ID.
+func (service *Service) Schedule(ID portainer.ScheduleID) (*portainer.Schedule, error) {
+	var schedule portainer.Schedule
+	identifier := service.connection.ConvertToKey(int(ID))
+
+	err := service.connection.GetObject(BucketName, identifier, &schedule)
+	if err != nil {
+		return nil, err
+	}
+
+	return &schedule, nil
+}
+
+// UpdateSchedule updates a schedule.
+func (service *Service) UpdateSchedule(ID portainer.ScheduleID, schedule *portainer.Schedule) error {
+	identifier := service.connection.ConvertToKey(int(ID))
+	return service.connection.UpdateObject(BucketName, identifier, schedule)
+}
+
+// DeleteSchedule deletes a schedule.
+func (service *Service) DeleteSchedule(ID portainer.ScheduleID) error {
+	identifier := service.connection.ConvertToKey(int(ID))
+	return service.connection.DeleteObject(BucketName, identifier)
+}
+
+// Schedules return a array containing all the schedules.
+func (service *Service) Schedules() ([]portainer.Schedule, error) {
+	var schedules = make([]portainer.Schedule, 0)
+
+	return schedules, service.connection.GetAll(
+		BucketName,
+		&portainer.Schedule{},
+		dataservices.AppendFn(&schedules),
+	)
+}
+
+// SchedulesByJobType return a array containing all the schedules
+// with the specified JobType.
+func (service *Service) SchedulesByJobType(jobType portainer.JobType) ([]portainer.Schedule, error) {
+	var schedules = make([]portainer.Schedule, 0)
+
+	return schedules, service.connection.GetAll(
+		BucketName,
+		&portainer.Schedule{},
+		dataservices.FilterFn(&schedules, func(e portainer.Schedule) bool {
+			return e.JobType == jobType
+		}),
+	)
+}
+
+// Create assign an ID to a new schedule and saves it.
+func (service *Service) CreateSchedule(schedule *portainer.Schedule) error {
+	return service.connection.CreateObjectWithId(BucketName, int(schedule.ID), schedule)
+}
+
+// GetNextIdentifier returns the next identifier for a schedule.
+func (service *Service) GetNextIdentifier() int {
+	return service.connection.GetNextIdentifier(BucketName)
+}
diff --git a/api/dataservices/settings/settings.go b/api/dataservices/settings/settings.go
new file mode 100644
index 0000000..cb991d0
--- /dev/null
+++ b/api/dataservices/settings/settings.go
@@ -0,0 +1,56 @@
+package settings
+
+import (
+	portainer "github.com/portainer/portainer/api"
+)
+
+const (
+	// BucketName represents the name of the bucket where this service stores data.
+	BucketName  = "settings"
+	settingsKey = "SETTINGS"
+)
+
+// Service represents a service for managing environment(endpoint) data.
+type Service struct {
+	connection portainer.Connection
+}
+
+func (service *Service) BucketName() string {
+	return BucketName
+}
+
+// NewService creates a new instance of a service.
+func NewService(connection portainer.Connection) (*Service, error) {
+	err := connection.SetServiceName(BucketName)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Service{
+		connection: connection,
+	}, nil
+}
+
+func (service *Service) Tx(tx portainer.Transaction) ServiceTx {
+	return ServiceTx{
+		service: service,
+		tx:      tx,
+	}
+}
+
+// Settings retrieve the settings object.
+func (service *Service) Settings() (*portainer.Settings, error) {
+	var settings portainer.Settings
+
+	err := service.connection.GetObject(BucketName, []byte(settingsKey), &settings)
+	if err != nil {
+		return nil, err
+	}
+
+	return &settings, nil
+}
+
+// UpdateSettings persists a Settings object.
+func (service *Service) UpdateSettings(settings *portainer.Settings) error {
+	return service.connection.UpdateObject(BucketName, []byte(settingsKey), settings)
+}
diff --git a/api/dataservices/settings/tx.go b/api/dataservices/settings/tx.go
new file mode 100644
index 0000000..7e6899d
--- /dev/null
+++ b/api/dataservices/settings/tx.go
@@ -0,0 +1,31 @@
+package settings
+
+import (
+	portainer "github.com/portainer/portainer/api"
+)
+
+type ServiceTx struct {
+	service *Service
+	tx      portainer.Transaction
+}
+
+func (service ServiceTx) BucketName() string {
+	return BucketName
+}
+
+// Settings retrieve the settings object.
+func (service ServiceTx) Settings() (*portainer.Settings, error) {
+	var settings portainer.Settings
+
+	err := service.tx.GetObject(BucketName, []byte(settingsKey), &settings)
+	if err != nil {
+		return nil, err
+	}
+
+	return &settings, nil
+}
+
+// UpdateSettings persists a Settings object.
+func (service ServiceTx) UpdateSettings(settings *portainer.Settings) error {
+	return service.tx.UpdateObject(BucketName, []byte(settingsKey), settings)
+}
diff --git a/api/dataservices/snapshot/snapshot.go b/api/dataservices/snapshot/snapshot.go
new file mode 100644
index 0000000..c006631
--- /dev/null
+++ b/api/dataservices/snapshot/snapshot.go
@@ -0,0 +1,70 @@
+package snapshot
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+)
+
+const BucketName = "snapshots"
+
+type Service struct {
+	dataservices.BaseDataService[portainer.Snapshot, portainer.EndpointID]
+}
+
+func NewService(connection portainer.Connection) (*Service, error) {
+	err := connection.SetServiceName(BucketName)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Service{
+		BaseDataService: dataservices.BaseDataService[portainer.Snapshot, portainer.EndpointID]{
+			Bucket:     BucketName,
+			Connection: connection,
+		},
+	}, nil
+}
+
+func (service *Service) Tx(tx portainer.Transaction) ServiceTx {
+	return ServiceTx{
+		BaseDataServiceTx: dataservices.BaseDataServiceTx[portainer.Snapshot, portainer.EndpointID]{
+			Bucket:     BucketName,
+			Connection: service.Connection,
+			Tx:         tx,
+		},
+	}
+}
+
+func (service *Service) Create(snapshot *portainer.Snapshot) error {
+	return service.Connection.CreateObjectWithId(BucketName, int(snapshot.EndpointID), snapshot)
+}
+
+func (service *Service) ReadWithoutSnapshotRaw(ID portainer.EndpointID) (*portainer.Snapshot, error) {
+	var snapshot *portainer.Snapshot
+
+	err := service.Connection.ViewTx(func(tx portainer.Transaction) error {
+		var err error
+		snapshot, err = service.Tx(tx).ReadWithoutSnapshotRaw(ID)
+
+		return err
+	})
+
+	return snapshot, err
+}
+
+func (service *Service) ReadRawMessage(ID portainer.EndpointID) (*portainer.SnapshotRawMessage, error) {
+	var snapshot *portainer.SnapshotRawMessage
+
+	err := service.Connection.ViewTx(func(tx portainer.Transaction) error {
+		var err error
+		snapshot, err = service.Tx(tx).ReadRawMessage(ID)
+
+		return err
+	})
+
+	return snapshot, err
+}
+
+func (service *Service) CreateRawMessage(snapshot *portainer.SnapshotRawMessage) error {
+	return service.Connection.CreateObjectWithId(BucketName, int(snapshot.EndpointID), snapshot)
+}
diff --git a/api/dataservices/snapshot/tx.go b/api/dataservices/snapshot/tx.go
new file mode 100644
index 0000000..45d1df9
--- /dev/null
+++ b/api/dataservices/snapshot/tx.go
@@ -0,0 +1,53 @@
+package snapshot
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+)
+
+type ServiceTx struct {
+	dataservices.BaseDataServiceTx[portainer.Snapshot, portainer.EndpointID]
+}
+
+func (service ServiceTx) Create(snapshot *portainer.Snapshot) error {
+	return service.Tx.CreateObjectWithId(BucketName, int(snapshot.EndpointID), snapshot)
+}
+
+func (service ServiceTx) ReadWithoutSnapshotRaw(ID portainer.EndpointID) (*portainer.Snapshot, error) {
+	var snapshot struct {
+		Docker *struct {
+			X struct{} `json:"DockerSnapshotRaw"`
+			*portainer.DockerSnapshot
+		} `json:"Docker"`
+
+		portainer.Snapshot
+	}
+
+	identifier := service.Connection.ConvertToKey(int(ID))
+
+	if err := service.Tx.GetObject(service.Bucket, identifier, &snapshot); err != nil {
+		return nil, err
+	}
+
+	if snapshot.Docker != nil {
+		snapshot.Snapshot.Docker = snapshot.Docker.DockerSnapshot
+	}
+
+	return &snapshot.Snapshot, nil
+}
+
+func (service ServiceTx) ReadRawMessage(ID portainer.EndpointID) (*portainer.SnapshotRawMessage, error) {
+	var snapshot = portainer.SnapshotRawMessage{}
+
+	identifier := service.Connection.ConvertToKey(int(ID))
+
+	if err := service.Tx.GetObject(service.Bucket, identifier, &snapshot); err != nil {
+		return nil, err
+	}
+
+	return &snapshot, nil
+}
+
+func (service ServiceTx) CreateRawMessage(snapshot *portainer.SnapshotRawMessage) error {
+	return service.Tx.CreateObjectWithId(BucketName, int(snapshot.EndpointID), snapshot)
+}
diff --git a/api/dataservices/source/access_rules.go b/api/dataservices/source/access_rules.go
new file mode 100644
index 0000000..d36a186
--- /dev/null
+++ b/api/dataservices/source/access_rules.go
@@ -0,0 +1,130 @@
+package source
+
+import (
+	"errors"
+	"slices"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/set"
+	"github.com/portainer/portainer/api/slicesx"
+)
+
+var (
+	ErrInvalidSource       = errors.New("invalid source")
+	ErrInvalidUserContext  = errors.New("invalid user context")
+	ErrNotEnoughPermission = errors.New("not enough permissions to perform this action")
+	ErrDuplicateSource     = errors.New("a source with this URL and credentials already exists")
+)
+
+func validateUserContext(ctx UserContext) error {
+	if ctx == nil {
+		return ErrInvalidUserContext
+	}
+
+	return nil
+}
+
+type actionType string
+
+const (
+	actionRead  actionType = "read"
+	actionWrite actionType = "write"
+)
+
+func enforceUserPermissions(ctx UserContext, source *portainer.Source, action actionType) error {
+	if action == actionRead && userCanReadSource(source, ctx) {
+		return nil
+	}
+
+	if action == actionWrite && userCanWriteSource(source, ctx) {
+		return nil
+	}
+
+	return ErrNotEnoughPermission
+}
+
+func userCanWriteSource(source *portainer.Source, context UserContext) bool {
+	if source == nil || context == nil {
+		return false
+	}
+
+	if context.IsAdmin() {
+		return true
+	}
+
+	if source.OwnerID != 0 && source.OwnerID == context.ID() && userCanReadSource(source, context) {
+		return true
+	}
+
+	return false
+}
+
+func filterSources(sources []portainer.Source, context UserContext) []portainer.Source {
+	return slicesx.Filter(sources, func(s portainer.Source) bool {
+		return userCanReadSource(&s, context)
+	})
+}
+
+func userCanReadSource(source *portainer.Source, context UserContext) bool {
+	if source == nil || context == nil {
+		return false
+	}
+
+	userTeams := context.TeamMemberships()
+
+	if context.IsAdmin() || source.Public {
+		return true
+	}
+
+	if source.AdministratorsOnly {
+		return false
+	}
+
+	if slices.Contains(source.UserAccesses, context.ID()) {
+		return true
+	}
+
+	if len(userTeams) == 0 || len(source.TeamAccesses) == 0 {
+		return false
+	}
+
+	sTeams := set.ToSet(source.TeamAccesses)
+	uTeams := set.ToSet(slicesx.Map(userTeams, func(u portainer.TeamMembership) portainer.TeamID { return u.TeamID }))
+
+	return set.Intersection(sTeams, uTeams).Len() != 0
+}
+
+// enforceUniqueGitSource validates there are no other git sources with the same URL and credentials
+// It ignores itself
+func enforceUniqueGitSource(tx ServiceTx, src *portainer.Source) error {
+	if src.Type != portainer.SourceTypeGit || src.Git == nil {
+		return nil
+	}
+
+	normalized, err := normalizeGitSource(src)
+	if err != nil {
+		return err
+	}
+
+	existing, err := tx.base.ReadAll(func(s portainer.Source) bool {
+		if src.ID == s.ID {
+			return false
+		}
+
+		n, err := normalizeGitSource(&s)
+		if err != nil {
+			return false
+		}
+
+		return normalized.Equal(n)
+	})
+
+	if err != nil {
+		return err
+	}
+
+	if len(existing) > 0 {
+		return ErrDuplicateSource
+	}
+	return nil
+}
diff --git a/api/dataservices/source/normalize_source.go b/api/dataservices/source/normalize_source.go
new file mode 100644
index 0000000..0b6f68b
--- /dev/null
+++ b/api/dataservices/source/normalize_source.go
@@ -0,0 +1,43 @@
+package source
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	gittypes "github.com/portainer/portainer/api/git/types"
+)
+
+type normalizedGitSource struct {
+	url      string
+	username string
+	password string
+}
+
+func (a *normalizedGitSource) Equal(b *normalizedGitSource) bool {
+	return a != nil && b != nil &&
+		a.url == b.url &&
+		a.username == b.username &&
+		a.password == b.password
+}
+
+// normalize git source to a lighter object used to compare sources together
+func normalizeGitSource(src *portainer.Source) (*normalizedGitSource, error) {
+	if src == nil || src.Type != portainer.SourceTypeGit || src.Git == nil {
+		return nil, ErrInvalidSource
+	}
+
+	url, err := gittypes.NormalizeURL(gittypes.SanitizeURL(src.Git.URL))
+	if err != nil {
+		return nil, err
+	}
+
+	username, password := "", ""
+	if src.Git.Authentication != nil {
+		username = src.Git.Authentication.Username
+		password = src.Git.Authentication.Password
+	}
+
+	return &normalizedGitSource{
+		url:      url,
+		username: username,
+		password: password,
+	}, nil
+}
diff --git a/api/dataservices/source/sanitize_git.go b/api/dataservices/source/sanitize_git.go
new file mode 100644
index 0000000..0b66fed
--- /dev/null
+++ b/api/dataservices/source/sanitize_git.go
@@ -0,0 +1,74 @@
+package source
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	gittypes "github.com/portainer/portainer/api/git/types"
+)
+
+// Sanitize the source URL and enforce fields values based on user context
+func sanitizeGitSource(source *portainer.Source) error {
+	if source == nil {
+		return ErrInvalidSource
+	}
+
+	if source.Type != portainer.SourceTypeGit {
+		return nil
+	}
+
+	if source.Git == nil {
+		return ErrInvalidSource
+	}
+
+	var err error
+
+	source.Git.URL, err = gittypes.NormalizeURL(gittypes.SanitizeURL(source.Git.URL))
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func sanitizeAccesses(ctx UserContext, newValues *portainer.Source, previousValues *portainer.Source) error {
+	if newValues == nil {
+		return ErrInvalidSource
+	}
+
+	if ctx.IsAdmin() {
+		if newValues.Public && newValues.AdministratorsOnly {
+			newValues.Public = false
+		}
+
+		if newValues.Public || newValues.AdministratorsOnly {
+			newValues.UserAccesses = []portainer.UserID{}
+			newValues.TeamAccesses = []portainer.TeamID{}
+		}
+
+		if !newValues.Public && !newValues.AdministratorsOnly && len(newValues.UserAccesses) == 0 && len(newValues.TeamAccesses) == 0 {
+			newValues.AdministratorsOnly = true
+		}
+
+		return nil
+	}
+
+	// Update flow ; regular user is not allowed to change the UAC, visibility or ownership of the source
+	if previousValues != nil {
+		newValues.UserAccesses = previousValues.UserAccesses
+		newValues.TeamAccesses = previousValues.TeamAccesses
+		newValues.Public = previousValues.Public
+		newValues.AdministratorsOnly = previousValues.AdministratorsOnly
+		newValues.OwnerID = previousValues.OwnerID
+		return nil
+	}
+
+	// Create flow
+	userAccesses := []portainer.UserID{ctx.ID()}
+	if newValues.Public {
+		userAccesses = []portainer.UserID{}
+	}
+	newValues.UserAccesses = userAccesses
+	newValues.TeamAccesses = []portainer.TeamID{}
+	newValues.AdministratorsOnly = false
+	newValues.OwnerID = ctx.ID()
+	return nil
+}
diff --git a/api/dataservices/source/sanitize_git_test.go b/api/dataservices/source/sanitize_git_test.go
new file mode 100644
index 0000000..0699bba
--- /dev/null
+++ b/api/dataservices/source/sanitize_git_test.go
@@ -0,0 +1,72 @@
+package source
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	"github.com/stretchr/testify/require"
+)
+
+type vFn func(new *portainer.Source, old *portainer.Source, err error)
+
+func testUAC(
+	t *testing.T,
+	userContext UserContext,
+	new *portainer.Source,
+	old *portainer.Source,
+	validationFuncs ...vFn,
+) {
+	t.Helper()
+	err := sanitizeAccesses(userContext, new, old)
+	for _, validate := range validationFuncs {
+		validate(new, old, err)
+	}
+}
+
+func Test_SanitizeAccesses_Admin(t *testing.T) {
+	errInvalidSource := func(_, _ *portainer.Source, err error) {
+		t.Helper()
+		require.ErrorIs(t, err, ErrInvalidSource)
+	}
+
+	noError := func(_, _ *portainer.Source, err error) { t.Helper(); require.NoError(t, err) }
+	noOwner := func(new, _ *portainer.Source, _ error) { t.Helper(); require.Zero(t, new.OwnerID) }
+	emptyUsers := func(new, _ *portainer.Source, _ error) { t.Helper(); require.Empty(t, new.UserAccesses) }
+	emptyTeams := func(new, _ *portainer.Source, _ error) { t.Helper(); require.Empty(t, new.TeamAccesses) }
+	public := func(v bool) func(new, _ *portainer.Source, _ error) {
+		return func(new, _ *portainer.Source, _ error) { t.Helper(); require.Equal(t, v, new.Public) }
+	}
+	adminOnly := func(v bool) func(new, _ *portainer.Source, _ error) {
+		return func(new, _ *portainer.Source, _ error) { t.Helper(); require.Equal(t, v, new.AdministratorsOnly) }
+	}
+
+	adminUserContext := NewUserContext(&portainer.User{Role: portainer.AdministratorRole}, []portainer.TeamMembership{})
+
+	test := func(new *portainer.Source, old *portainer.Source, validationFuncs ...vFn) {
+		t.Helper()
+		testUAC(t, adminUserContext, new, old, validationFuncs...)
+	}
+
+	test(nil, nil, errInvalidSource)
+	test(&portainer.Source{}, nil, noError)
+	test(&portainer.Source{Git: &gittypes.GitSource{}}, nil,
+		noError, emptyUsers, emptyTeams, adminOnly(true), noOwner, public(false),
+	)
+	test(&portainer.Source{Git: &gittypes.GitSource{}, Public: true}, nil,
+		noError, emptyUsers, emptyTeams, adminOnly(false), noOwner, public(true),
+	)
+	test(&portainer.Source{Git: &gittypes.GitSource{}, AdministratorsOnly: true}, nil,
+		noError, emptyUsers, emptyTeams, adminOnly(true), noOwner, public(false),
+	)
+	test(&portainer.Source{Git: &gittypes.GitSource{}, AdministratorsOnly: true, Public: true}, nil,
+		noError, emptyUsers, emptyTeams, adminOnly(true), noOwner, public(false),
+	)
+	test(&portainer.Source{Git: &gittypes.GitSource{}, AdministratorsOnly: true, Public: true, UserAccesses: []portainer.UserID{1, 2}}, nil,
+		noError, emptyUsers, emptyTeams, adminOnly(true), noOwner, public(false),
+	)
+}
+
+// func Test_SanitizeAccesses_User(t *testing.T) {
+// 	user := NewUserContext(&portainer.User{Role: portainer.StandardUserRole}, []portainer.TeamMembership{})
+// }
diff --git a/api/dataservices/source/source.go b/api/dataservices/source/source.go
new file mode 100644
index 0000000..372fd5f
--- /dev/null
+++ b/api/dataservices/source/source.go
@@ -0,0 +1,106 @@
+package source
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+)
+
+// BucketName represents the name of the bucket where this service stores data.
+const BucketName = "sources"
+
+// Service represents a service for managing GitOps source data.
+type Service struct {
+	base dataservices.BaseDataService[portainer.Source, portainer.SourceID]
+}
+
+// NewService creates a new instance of a service.
+func NewService(connection portainer.Connection) (*Service, error) {
+	err := connection.SetServiceName(BucketName)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Service{
+		base: dataservices.BaseDataService[portainer.Source, portainer.SourceID]{
+			Bucket:     BucketName,
+			Connection: connection,
+		},
+	}, nil
+}
+
+func (service *Service) Tx(tx portainer.Transaction) ServiceTx {
+	return ServiceTx{
+		base: dataservices.BaseDataServiceTx[portainer.Source, portainer.SourceID]{
+			Bucket:     BucketName,
+			Connection: service.base.Connection,
+			Tx:         tx,
+		},
+	}
+}
+
+// Create creates a new source.
+func (service *Service) Create(context UserContext, source *portainer.Source) error {
+	return service.base.Connection.UpdateTx(func(tx portainer.Transaction) error {
+		return service.Tx(tx).Create(context, source)
+	})
+}
+
+func (service *Service) Read(context UserContext, ID portainer.SourceID) (*portainer.Source, error) {
+	var result *portainer.Source
+
+	err := service.base.Connection.ViewTx(func(tx portainer.Transaction) error {
+		var err error
+		result, err = service.Tx(tx).Read(context, ID)
+		return err
+	})
+
+	return result, err
+}
+
+func (service *Service) Exists(context UserContext, ID portainer.SourceID) (bool, error) {
+	var result bool
+
+	err := service.base.Connection.ViewTx(func(tx portainer.Transaction) error {
+		var err error
+		result, err = service.Tx(tx).Exists(context, ID)
+		return err
+	})
+
+	return result, err
+}
+
+func (service *Service) ReadAll(context UserContext, predicates ...func(portainer.Source) bool) ([]portainer.Source, error) {
+	var result []portainer.Source
+
+	err := service.base.Connection.ViewTx(func(tx portainer.Transaction) error {
+		var err error
+		result, err = service.Tx(tx).ReadAll(context, predicates...)
+		return err
+	})
+
+	return result, err
+}
+
+func (service *Service) Update(context UserContext, ID portainer.SourceID, source *portainer.Source) error {
+	return service.base.Connection.UpdateTx(func(tx portainer.Transaction) error {
+		return service.Tx(tx).Update(context, ID, source)
+	})
+}
+
+func (service *Service) Delete(context UserContext, ID portainer.SourceID) error {
+	return service.base.Connection.UpdateTx(func(tx portainer.Transaction) error {
+		return service.Tx(tx).Delete(context, ID)
+	})
+}
+
+func (service *Service) FindOrCreateGitSource(context UserContext, source *portainer.Source) (*portainer.Source, error) {
+	var result *portainer.Source
+
+	err := service.base.Connection.UpdateTx(func(tx portainer.Transaction) error {
+		var err error
+		result, err = service.Tx(tx).FindOrCreateGitSource(context, source)
+		return err
+	})
+
+	return result, err
+}
diff --git a/api/dataservices/source/tx.go b/api/dataservices/source/tx.go
new file mode 100644
index 0000000..864e86e
--- /dev/null
+++ b/api/dataservices/source/tx.go
@@ -0,0 +1,204 @@
+package source
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	gittypes "github.com/portainer/portainer/api/git/types"
+)
+
+type ServiceTx struct {
+	base dataservices.BaseDataServiceTx[portainer.Source, portainer.SourceID]
+}
+
+// Create creates a new source.
+func (service ServiceTx) Create(context UserContext, source *portainer.Source) error {
+	if err := validateUserContext(context); err != nil {
+		return err
+	}
+
+	if source == nil {
+		return ErrInvalidSource
+	}
+
+	if err := sanitizeGitSource(source); err != nil {
+		return err
+	}
+
+	if err := sanitizeAccesses(context, source, nil); err != nil {
+		return err
+	}
+
+	if err := enforceUniqueGitSource(service, source); err != nil {
+		return err
+	}
+
+	return service.base.Tx.CreateObject(
+		BucketName,
+		func(id uint64) (int, any) {
+			source.ID = portainer.SourceID(id)
+			return int(source.ID), source
+		},
+	)
+}
+
+func (service ServiceTx) Read(context UserContext, ID portainer.SourceID) (*portainer.Source, error) {
+	if err := validateUserContext(context); err != nil {
+		return nil, err
+	}
+
+	source, err := service.base.Read(ID)
+	if err != nil {
+		return nil, err
+	}
+
+	if err := enforceUserPermissions(context, source, actionRead); err != nil {
+		return nil, err
+	}
+
+	return source, err
+}
+
+// Access is not enforced on this to avoid the cost of deserialize
+// Any user can scan the DB IDs using this method, so be mindful with usage of this func.
+func (service ServiceTx) Exists(context UserContext, ID portainer.SourceID) (bool, error) {
+	if err := validateUserContext(context); err != nil {
+		return false, err
+	}
+
+	return service.base.Exists(ID)
+}
+
+// ReadAll fetches all sources the user can access, matching predicates
+func (service ServiceTx) ReadAll(context UserContext, predicates ...func(portainer.Source) bool) ([]portainer.Source, error) {
+	if err := validateUserContext(context); err != nil {
+		return nil, err
+	}
+
+	list, err := service.base.ReadAll(predicates...)
+	if err != nil {
+		return nil, err
+	}
+
+	return filterSources(list, context), nil
+}
+
+// Update updates the source of id `ID` with the `source` content
+// It validates that the user has access to the source, and has enough permissions to perform the action
+func (service ServiceTx) Update(context UserContext, ID portainer.SourceID, source *portainer.Source) error {
+	if err := validateUserContext(context); err != nil {
+		return err
+	}
+
+	originalSource, err := service.base.Read(ID)
+	if err != nil {
+		return err
+	}
+
+	if source == nil || originalSource == nil {
+		return ErrInvalidSource
+	}
+
+	if err := enforceUserPermissions(context, originalSource, actionWrite); err != nil {
+		return err
+	}
+
+	if err := sanitizeGitSource(source); err != nil {
+		return err
+	}
+
+	if err := sanitizeAccesses(context, source, originalSource); err != nil {
+		return err
+	}
+
+	if err := enforceUniqueGitSource(service, source); err != nil {
+		return err
+	}
+
+	return service.base.Update(ID, source)
+}
+
+// Delete deletes a source
+// It validates that the user has access to the source, and has enough permissions to perform the action
+func (service ServiceTx) Delete(context UserContext, ID portainer.SourceID) error {
+	if err := validateUserContext(context); err != nil {
+		return err
+	}
+
+	source, err := service.base.Read(ID)
+	if err != nil {
+		return err
+	}
+
+	if err := enforceUserPermissions(context, source, actionWrite); err != nil {
+		return err
+	}
+
+	return service.base.Delete(ID)
+}
+
+// FindOrCreateGitSource returns an existing Source whose URL and authentication match cfg,
+// or creates a new one. Only URL, authentication, and TLSSkipVerify are stored on the Source;
+// per-stack fields (ReferenceName, ConfigFilePath, ConfigHash) belong in the Artifact.
+// The function auto adds the user to an existing source if the user doesn't have access but provided a valid full
+// config (URL+Auth)
+func (service ServiceTx) FindOrCreateGitSource(context UserContext, src *portainer.Source) (*portainer.Source, error) {
+	if err := validateUserContext(context); err != nil {
+		return nil, err
+	}
+
+	if src == nil || src.Git == nil {
+		return nil, ErrInvalidSource
+	}
+
+	normalized, err := normalizeGitSource(src)
+	if err != nil {
+		return nil, err
+	}
+
+	existing, err := service.base.ReadAll(func(s portainer.Source) bool {
+		n, err := normalizeGitSource(&s)
+		if err != nil {
+			return false
+		}
+		return normalized.Equal(n)
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	if len(existing) > 0 {
+		allowed := filterSources(existing, context)
+		if len(allowed) > 0 {
+			return &allowed[0], nil
+		}
+
+		// give user access to the first source if he doesn't have access
+		// to any of the sources that have the same url+auth
+		existing[0].UserAccesses = append(existing[0].UserAccesses, context.ID())
+		if err := service.base.Update(existing[0].ID, &existing[0]); err != nil {
+			return nil, err
+		}
+		return &existing[0], nil
+	}
+
+	toCreate := &portainer.Source{
+		Name: src.Name,
+		Type: portainer.SourceTypeGit,
+		Git: &gittypes.GitSource{
+			URL:            src.Git.URL,
+			Authentication: src.Git.Authentication,
+			TLSSkipVerify:  src.Git.TLSSkipVerify,
+		},
+		Public:             src.Public,
+		AdministratorsOnly: src.AdministratorsOnly,
+		UserAccesses:       src.UserAccesses,
+		TeamAccesses:       src.TeamAccesses,
+		OwnerID:            src.OwnerID,
+	}
+
+	if err := service.Create(context, toCreate); err != nil {
+		return nil, err
+	}
+
+	return toCreate, nil
+}
diff --git a/api/dataservices/source/user_context.go b/api/dataservices/source/user_context.go
new file mode 100644
index 0000000..67f1b07
--- /dev/null
+++ b/api/dataservices/source/user_context.go
@@ -0,0 +1,39 @@
+package source
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+)
+
+type UserContext = dataservices.SourceServiceUserContext
+
+type userContext struct {
+	id          portainer.UserID
+	role        portainer.UserRole
+	memberships []portainer.TeamMembership
+}
+
+func (uc userContext) ID() portainer.UserID {
+	return uc.id
+}
+
+func (uc userContext) TeamMemberships() []portainer.TeamMembership {
+	return uc.memberships
+}
+
+func (uc userContext) IsAdmin() bool {
+	return uc.role == portainer.AdministratorRole
+}
+
+// Create a new admin context
+//
+// # THIS FUNCTION MUST NOT BE USED IN A USER-AWARE FLOW, ONLY FOR MIGRATIONS AND TESTS
+//
+// The only flows outside of migrations/test allowed to use this func is the datastore.Import/Export for sources
+func InsecureNewAdminContext() UserContext {
+	return NewUserContext(&portainer.User{Role: portainer.AdministratorRole}, []portainer.TeamMembership{})
+}
+
+func NewUserContext(user *portainer.User, userMemberships []portainer.TeamMembership) UserContext {
+	return userContext{id: user.ID, role: user.Role, memberships: userMemberships}
+}
diff --git a/api/dataservices/source/validation_rules_test.go b/api/dataservices/source/validation_rules_test.go
new file mode 100644
index 0000000..22b14cd
--- /dev/null
+++ b/api/dataservices/source/validation_rules_test.go
@@ -0,0 +1,97 @@
+package source
+
+// var adminUserContext = InsecureNewAdminContext()
+
+// func newSourceWithAuth(url, username, password string) *portainer.Source {
+// 	return &portainer.Source{
+// 		Type: portainer.SourceTypeGit,
+// 		Git: &gittypes.RepoConfig{
+// 			URL: url,
+// 			Authentication: &gittypes.GitAuthentication{
+// 				Username: username,
+// 				Password: password,
+// 			},
+// 		},
+// 	}
+// }
+
+// func newAuthlessSource(url string) *portainer.Source {
+// 	return &portainer.Source{
+// 		Type: portainer.SourceTypeGit,
+// 		Git:  &gittypes.RepoConfig{URL: url},
+// 	}
+// }
+
+// func validateUniqueSourceInStore(t *testing.T, tx ServiceTx, url, username, password string, sourceID portainer.SourceID) bool {
+// 	t.Helper()
+
+// 		var isUnique bool
+// 		require.NoError(t, store.ViewTx(func(tx dataservices.DataStoreTx) error {
+// 			var err error
+// 			isUnique, err =// enforceUniqueGitSource(tx, url, username, password, sourceID)
+// 			return err
+// 		}))
+
+// 	return isUnique
+// }
+
+// func TestValidateUniqueSource_SameURLAndCreds_IsDuplicate(t *testing.T) {
+// 	t.Parallel()
+// 	_, store := datastore.MustNewTestStore(t, false, true)
+
+// 	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+// 		return tx.Source().Create(adminUserContext, newSourceWithAuth("https://github.com/org/repo.git", "alice", "secret"))
+// 	}))
+
+// 	require.False(t, validateUniqueSourceInStore(t, store, "https://github.com/org/repo.git", "alice", "secret", 0))
+// }
+
+// func TestValidateUniqueSource_SameURLDifferentCreds_IsUnique(t *testing.T) {
+// 	t.Parallel()
+// 	_, store := datastore.MustNewTestStore(t, false, true)
+
+// 	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+// 		return tx.Source().Create(adminUserContext, newSourceWithAuth("https://github.com/org/repo.git", "alice", "secret"))
+// 	}))
+
+// 	require.True(t, validateUniqueSourceInStore(t, store, "https://github.com/org/repo.git", "bob", "other", 0))
+// }
+
+// func TestValidateUniqueSource_TwoAuthlessSameURL_IsDuplicate(t *testing.T) {
+// 	t.Parallel()
+// 	_, store := datastore.MustNewTestStore(t, false, true)
+
+// 	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+// 		return tx.Source().Create(adminUserContext, newAuthlessSource("https://github.com/org/repo.git"))
+// 	}))
+
+// 	require.False(t, validateUniqueSourceInStore(t, store, "https://github.com/org/repo.git", "", "", 0))
+// }
+
+// func TestValidateUniqueSource_AuthlessVsAuthenticated_IsUnique(t *testing.T) {
+// 	t.Parallel()
+// 	_, store := datastore.MustNewTestStore(t, false, true)
+
+// 	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+// 		return tx.Source().Create(adminUserContext, newAuthlessSource("https://github.com/org/repo.git"))
+// 	}))
+
+// 	require.True(t, validateUniqueSourceInStore(t, store, "https://github.com/org/repo.git", "alice", "secret", 0))
+// }
+
+// func TestValidateUniqueSource_ExcludesSelf(t *testing.T) {
+// 	t.Parallel()
+// 	_, store := datastore.MustNewTestStore(t, false, true)
+
+// 	var srcID portainer.SourceID
+// 	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+// 		src := newSourceWithAuth("https://github.com/org/repo.git", "alice", "secret")
+// 		if err := tx.Source().Create(adminUserContext, src); err != nil {
+// 			return err
+// 		}
+// 		srcID = src.ID
+// 		return nil
+// 	}))
+
+// 	require.True(t, validateUniqueSourceInStore(t, store, "https://github.com/org/repo.git", "alice", "secret", srcID))
+// }
diff --git a/api/dataservices/ssl/ssl.go b/api/dataservices/ssl/ssl.go
new file mode 100644
index 0000000..4270c85
--- /dev/null
+++ b/api/dataservices/ssl/ssl.go
@@ -0,0 +1,56 @@
+package ssl
+
+import (
+	portainer "github.com/portainer/portainer/api"
+)
+
+const (
+	// BucketName represents the name of the bucket where this service stores data.
+	BucketName = "ssl"
+	key        = "SSL"
+)
+
+// Service represents a service for managing ssl data.
+type Service struct {
+	connection portainer.Connection
+}
+
+func (service *Service) BucketName() string {
+	return BucketName
+}
+
+// NewService creates a new instance of a service.
+func NewService(connection portainer.Connection) (*Service, error) {
+	err := connection.SetServiceName(BucketName)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Service{
+		connection: connection,
+	}, nil
+}
+
+func (service *Service) Tx(tx portainer.Transaction) ServiceTx {
+	return ServiceTx{
+		service: service,
+		tx:      tx,
+	}
+}
+
+// Settings retrieve the ssl settings object.
+func (service *Service) Settings() (*portainer.SSLSettings, error) {
+	var settings portainer.SSLSettings
+
+	err := service.connection.GetObject(BucketName, []byte(key), &settings)
+	if err != nil {
+		return nil, err
+	}
+
+	return &settings, nil
+}
+
+// UpdateSettings persists a SSLSettings object.
+func (service *Service) UpdateSettings(settings *portainer.SSLSettings) error {
+	return service.connection.UpdateObject(BucketName, []byte(key), settings)
+}
diff --git a/api/dataservices/ssl/tx.go b/api/dataservices/ssl/tx.go
new file mode 100644
index 0000000..d0a2f27
--- /dev/null
+++ b/api/dataservices/ssl/tx.go
@@ -0,0 +1,31 @@
+package ssl
+
+import (
+	portainer "github.com/portainer/portainer/api"
+)
+
+type ServiceTx struct {
+	service *Service
+	tx      portainer.Transaction
+}
+
+func (service ServiceTx) BucketName() string {
+	return BucketName
+}
+
+// Settings retrieve the settings object.
+func (service ServiceTx) Settings() (*portainer.SSLSettings, error) {
+	var settings portainer.SSLSettings
+
+	err := service.tx.GetObject(BucketName, []byte(key), &settings)
+	if err != nil {
+		return nil, err
+	}
+
+	return &settings, nil
+}
+
+// UpdateSettings persists a Settings object.
+func (service ServiceTx) UpdateSettings(settings *portainer.SSLSettings) error {
+	return service.tx.UpdateObject(BucketName, []byte(key), settings)
+}
diff --git a/api/dataservices/stack/stack.go b/api/dataservices/stack/stack.go
new file mode 100644
index 0000000..9c54c28
--- /dev/null
+++ b/api/dataservices/stack/stack.go
@@ -0,0 +1,136 @@
+package stack
+
+import (
+	"errors"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	dserrors "github.com/portainer/portainer/api/dataservices/errors"
+
+	"github.com/rs/zerolog/log"
+)
+
+// BucketName represents the name of the bucket where this service stores data.
+const BucketName = "stacks"
+
+// Service represents a service for managing environment(endpoint) data.
+type Service struct {
+	dataservices.BaseDataService[portainer.Stack, portainer.StackID]
+}
+
+// NewService creates a new instance of a service.
+func NewService(connection portainer.Connection) (*Service, error) {
+	err := connection.SetServiceName(BucketName)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Service{
+		BaseDataService: dataservices.BaseDataService[portainer.Stack, portainer.StackID]{
+			Bucket:     BucketName,
+			Connection: connection,
+		},
+	}, nil
+}
+
+func (service *Service) Tx(tx portainer.Transaction) ServiceTx {
+	return ServiceTx{
+		BaseDataServiceTx: service.BaseDataService.Tx(tx),
+	}
+}
+
+// StackByName returns a stack object by name.
+func (service *Service) StackByName(name string) (*portainer.Stack, error) {
+	var s portainer.Stack
+
+	err := service.Connection.GetAll(
+		BucketName,
+		&portainer.Stack{},
+		dataservices.FirstFn(&s, func(e portainer.Stack) bool {
+			return e.Name == name
+		}),
+	)
+
+	if errors.Is(err, dataservices.ErrStop) {
+		return &s, nil
+	}
+
+	if err == nil {
+		return nil, dserrors.ErrObjectNotFound
+	}
+
+	return nil, err
+}
+
+// Stacks returns an array containing all the stacks with same name
+func (service *Service) StacksByName(name string) ([]portainer.Stack, error) {
+	var stacks = make([]portainer.Stack, 0)
+
+	return stacks, service.Connection.GetAll(
+		BucketName,
+		&portainer.Stack{},
+		dataservices.FilterFn(&stacks, func(e portainer.Stack) bool {
+			return e.Name == name
+		}),
+	)
+}
+
+// GetNextIdentifier returns the next identifier for a stack.
+func (service *Service) GetNextIdentifier() int {
+	return service.Connection.GetNextIdentifier(BucketName)
+}
+
+// CreateStack creates a new stack.
+func (service *Service) Create(stack *portainer.Stack) error {
+	if stack.GitConfig != nil {
+		log.Warn().Int("stackID", int(stack.ID)).Str("url", stack.GitConfig.URL).Msg("stack persisted with non-nil GitConfig; GitConfig is deprecated, use WorkflowID/Source instead")
+	}
+
+	return service.Connection.CreateObjectWithId(BucketName, int(stack.ID), stack)
+}
+
+func (service *Service) Update(ID portainer.StackID, stack *portainer.Stack) error {
+	if stack.GitConfig != nil {
+		log.Warn().Int("stackID", int(ID)).Str("url", stack.GitConfig.URL).Msg("stack persisted with non-nil GitConfig; GitConfig is deprecated, use WorkflowID/Source instead")
+	}
+
+	return service.BaseDataService.Update(ID, stack)
+}
+
+// StackByWebhookID returns a pointer to a stack object by webhook ID.
+// It returns nil, errors.ErrObjectNotFound if there's no stack associated with the webhook ID.
+func (service *Service) StackByWebhookID(id string) (*portainer.Stack, error) {
+	var s portainer.Stack
+
+	err := service.Connection.GetAll(
+		BucketName,
+		&portainer.Stack{},
+		dataservices.FirstFn(&s, func(e portainer.Stack) bool {
+			return e.AutoUpdate != nil && strings.EqualFold(e.AutoUpdate.Webhook, id)
+		}),
+	)
+
+	if errors.Is(err, dataservices.ErrStop) {
+		return &s, nil
+	}
+
+	if err == nil {
+		return nil, dserrors.ErrObjectNotFound
+	}
+
+	return nil, err
+}
+
+// RefreshableStacks returns stacks that are configured for a periodic update
+func (service *Service) RefreshableStacks() ([]portainer.Stack, error) {
+	stacks := make([]portainer.Stack, 0)
+
+	return stacks, service.Connection.GetAll(
+		BucketName,
+		&portainer.Stack{},
+		dataservices.FilterFn(&stacks, func(e portainer.Stack) bool {
+			return e.WorkflowID != 0 && e.AutoUpdate != nil && e.AutoUpdate.Interval != ""
+		}),
+	)
+}
diff --git a/api/dataservices/stack/tests/stack_test.go b/api/dataservices/stack/tests/stack_test.go
new file mode 100644
index 0000000..1cafe95
--- /dev/null
+++ b/api/dataservices/stack/tests/stack_test.go
@@ -0,0 +1,107 @@
+package tests
+
+import (
+	"testing"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/filesystem"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func newGuidString(t *testing.T) string {
+	uuid, err := uuid.NewRandom()
+	require.NoError(t, err)
+
+	return uuid.String()
+}
+
+type stackBuilder struct {
+	t     *testing.T
+	count int
+	store *datastore.Store
+}
+
+func TestService_StackByWebhookID(t *testing.T) {
+	t.Parallel()
+	if testing.Short() {
+		t.Skip("skipping test in short mode. Normally takes ~1s to run.")
+	}
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	b := stackBuilder{t: t, store: store}
+	b.createNewStack(newGuidString(t))
+	for range 10 {
+		b.createNewStack("")
+	}
+	webhookID := newGuidString(t)
+	stack := b.createNewStack(webhookID)
+
+	// can find a stack by webhook ID
+	got, err := store.StackService.StackByWebhookID(webhookID)
+	require.NoError(t, err)
+	assert.Equal(t, stack, *got)
+
+	// returns nil and object not found error if there's no stack associated with the webhook
+	got, err = store.StackService.StackByWebhookID(newGuidString(t))
+	assert.Nil(t, got)
+	assert.True(t, store.IsErrObjectNotFound(err))
+}
+
+func (b *stackBuilder) createNewStack(webhookID string) portainer.Stack {
+	b.count++
+	stack := portainer.Stack{
+		ID:           portainer.StackID(b.count),
+		Name:         "Name",
+		Type:         portainer.DockerComposeStack,
+		EndpointID:   2,
+		EntryPoint:   filesystem.ComposeFileDefaultName,
+		Env:          []portainer.Pair{{Name: "Name1", Value: "Value1"}},
+		Status:       portainer.StackStatusActive,
+		CreationDate: time.Now().Unix(),
+		ProjectPath:  "/tmp/project",
+		CreatedBy:    "test",
+	}
+
+	if webhookID == "" {
+		if b.count%2 == 0 {
+			stack.AutoUpdate = &portainer.AutoUpdateSettings{
+				Interval: "",
+				Webhook:  "",
+			}
+		} // else keep AutoUpdate nil
+	} else {
+		stack.AutoUpdate = &portainer.AutoUpdateSettings{Webhook: webhookID}
+	}
+
+	err := b.store.StackService.Create(&stack)
+	assert.NoError(b.t, err)
+
+	return stack
+}
+
+func Test_RefreshableStacks(t *testing.T) {
+	t.Parallel()
+	if testing.Short() {
+		t.Skip("skipping test in short mode. Normally takes ~1s to run.")
+	}
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	staticStack := portainer.Stack{ID: 1}
+	stackWithWebhook := portainer.Stack{ID: 2, AutoUpdate: &portainer.AutoUpdateSettings{Webhook: "webhook"}}
+	intervalNoWorkflow := portainer.Stack{ID: 3, AutoUpdate: &portainer.AutoUpdateSettings{Interval: "1m"}}
+	refreshableStack := portainer.Stack{ID: 4, WorkflowID: 1, AutoUpdate: &portainer.AutoUpdateSettings{Interval: "1m"}}
+
+	for _, stack := range []*portainer.Stack{&staticStack, &stackWithWebhook, &intervalNoWorkflow, &refreshableStack} {
+		err := store.Stack().Create(stack)
+		require.NoError(t, err)
+	}
+
+	stacks, err := store.Stack().RefreshableStacks()
+	require.NoError(t, err)
+	require.ElementsMatch(t, []portainer.Stack{refreshableStack}, stacks)
+}
diff --git a/api/dataservices/stack/tx.go b/api/dataservices/stack/tx.go
new file mode 100644
index 0000000..c05216e
--- /dev/null
+++ b/api/dataservices/stack/tx.go
@@ -0,0 +1,112 @@
+package stack
+
+import (
+	"errors"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	dserrors "github.com/portainer/portainer/api/dataservices/errors"
+
+	"github.com/rs/zerolog/log"
+)
+
+type ServiceTx struct {
+	dataservices.BaseDataServiceTx[portainer.Stack, portainer.StackID]
+}
+
+// StackByName returns a stack object by name.
+func (service ServiceTx) StackByName(name string) (*portainer.Stack, error) {
+	var s portainer.Stack
+
+	err := service.Tx.GetAll(
+		BucketName,
+		&portainer.Stack{},
+		dataservices.FirstFn(&s, func(e portainer.Stack) bool {
+			return e.Name == name
+		}),
+	)
+
+	if errors.Is(err, dataservices.ErrStop) {
+		return &s, nil
+	}
+
+	if err == nil {
+		return nil, dserrors.ErrObjectNotFound
+	}
+
+	return nil, err
+}
+
+// Stacks returns an array containing all the stacks with same name
+func (service ServiceTx) StacksByName(name string) ([]portainer.Stack, error) {
+	var stacks = make([]portainer.Stack, 0)
+
+	return stacks, service.Tx.GetAll(
+		BucketName,
+		&portainer.Stack{},
+		dataservices.FilterFn(&stacks, func(e portainer.Stack) bool {
+			return e.Name == name
+		}),
+	)
+}
+
+// GetNextIdentifier returns the next identifier for a stack.
+func (service ServiceTx) GetNextIdentifier() int {
+	return service.Tx.GetNextIdentifier(BucketName)
+}
+
+// CreateStack creates a new stack.
+func (service ServiceTx) Create(stack *portainer.Stack) error {
+	if stack.GitConfig != nil {
+		log.Warn().Int("stackID", int(stack.ID)).Str("url", stack.GitConfig.URL).Msg("stack persisted with non-nil GitConfig; GitConfig is deprecated, use WorkflowID/Source instead")
+	}
+
+	return service.Tx.CreateObjectWithId(BucketName, int(stack.ID), stack)
+}
+
+func (service ServiceTx) Update(ID portainer.StackID, stack *portainer.Stack) error {
+	if stack.GitConfig != nil {
+		log.Warn().Int("stackID", int(ID)).Str("url", stack.GitConfig.URL).Msg("stack persisted with non-nil GitConfig; GitConfig is deprecated, use WorkflowID/Source instead")
+	}
+
+	return service.BaseDataServiceTx.Update(ID, stack)
+}
+
+// StackByWebhookID returns a pointer to a stack object by webhook ID.
+// It returns nil, errors.ErrObjectNotFound if there's no stack associated with the webhook ID.
+func (service ServiceTx) StackByWebhookID(id string) (*portainer.Stack, error) {
+	var s portainer.Stack
+
+	err := service.Tx.GetAll(
+		BucketName,
+		&portainer.Stack{},
+		dataservices.FirstFn(&s, func(e portainer.Stack) bool {
+			return e.AutoUpdate != nil && strings.EqualFold(e.AutoUpdate.Webhook, id)
+		}),
+	)
+
+	if errors.Is(err, dataservices.ErrStop) {
+		return &s, nil
+	}
+
+	if err == nil {
+		return nil, dserrors.ErrObjectNotFound
+	}
+
+	return nil, err
+
+}
+
+// RefreshableStacks returns stacks that are configured for a periodic update
+func (service ServiceTx) RefreshableStacks() ([]portainer.Stack, error) {
+	stacks := make([]portainer.Stack, 0)
+
+	return stacks, service.Tx.GetAll(
+		BucketName,
+		&portainer.Stack{},
+		dataservices.FilterFn(&stacks, func(e portainer.Stack) bool {
+			return e.WorkflowID != 0 && e.AutoUpdate != nil && e.AutoUpdate.Interval != ""
+		}),
+	)
+}
diff --git a/api/dataservices/tag/tag.go b/api/dataservices/tag/tag.go
new file mode 100644
index 0000000..052cb10
--- /dev/null
+++ b/api/dataservices/tag/tag.go
@@ -0,0 +1,60 @@
+package tag
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+)
+
+// BucketName represents the name of the bucket where this service stores data.
+const BucketName = "tags"
+
+// Service represents a service for managing environment(endpoint) data.
+type Service struct {
+	dataservices.BaseDataService[portainer.Tag, portainer.TagID]
+}
+
+// NewService creates a new instance of a service.
+func NewService(connection portainer.Connection) (*Service, error) {
+	err := connection.SetServiceName(BucketName)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Service{
+		BaseDataService: dataservices.BaseDataService[portainer.Tag, portainer.TagID]{
+			Bucket:     BucketName,
+			Connection: connection,
+		},
+	}, nil
+}
+
+func (service *Service) Tx(tx portainer.Transaction) ServiceTx {
+	return ServiceTx{
+		BaseDataServiceTx: dataservices.BaseDataServiceTx[portainer.Tag, portainer.TagID]{
+			Bucket:     BucketName,
+			Connection: service.Connection,
+			Tx:         tx,
+		},
+	}
+}
+
+// CreateTag creates a new tag.
+func (service *Service) Create(tag *portainer.Tag) error {
+	return service.Connection.CreateObject(
+		BucketName,
+		func(id uint64) (int, any) {
+			tag.ID = portainer.TagID(id)
+			return int(tag.ID), tag
+		},
+	)
+}
+
+// UpdateTagFunc updates a tag inside a transaction avoiding data races.
+func (service *Service) UpdateTagFunc(ID portainer.TagID, updateFunc func(tag *portainer.Tag)) error {
+	id := service.Connection.ConvertToKey(int(ID))
+	tag := &portainer.Tag{}
+
+	return service.Connection.UpdateObjectFunc(BucketName, id, tag, func() {
+		updateFunc(tag)
+	})
+}
diff --git a/api/dataservices/tag/tx.go b/api/dataservices/tag/tx.go
new file mode 100644
index 0000000..6ee1a9e
--- /dev/null
+++ b/api/dataservices/tag/tx.go
@@ -0,0 +1,28 @@
+package tag
+
+import (
+	"errors"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+)
+
+type ServiceTx struct {
+	dataservices.BaseDataServiceTx[portainer.Tag, portainer.TagID]
+}
+
+// CreateTag creates a new tag.
+func (service ServiceTx) Create(tag *portainer.Tag) error {
+	return service.Tx.CreateObject(
+		BucketName,
+		func(id uint64) (int, any) {
+			tag.ID = portainer.TagID(id)
+			return int(tag.ID), tag
+		},
+	)
+}
+
+// UpdateTagFunc is a no-op inside a transaction.
+func (service ServiceTx) UpdateTagFunc(ID portainer.TagID, updateFunc func(tag *portainer.Tag)) error {
+	return errors.New("cannot be called inside a transaction")
+}
diff --git a/api/dataservices/team/team.go b/api/dataservices/team/team.go
new file mode 100644
index 0000000..3d9fddc
--- /dev/null
+++ b/api/dataservices/team/team.go
@@ -0,0 +1,76 @@
+package team
+
+import (
+	"errors"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	dserrors "github.com/portainer/portainer/api/dataservices/errors"
+)
+
+// BucketName represents the name of the bucket where this service stores data.
+const BucketName = "teams"
+
+// Service represents a service for managing environment(endpoint) data.
+type Service struct {
+	dataservices.BaseDataService[portainer.Team, portainer.TeamID]
+}
+
+// NewService creates a new instance of a service.
+func NewService(connection portainer.Connection) (*Service, error) {
+	if err := connection.SetServiceName(BucketName); err != nil {
+		return nil, err
+	}
+
+	return &Service{
+		BaseDataService: dataservices.BaseDataService[portainer.Team, portainer.TeamID]{
+			Bucket:     BucketName,
+			Connection: connection,
+		},
+	}, nil
+}
+
+func (service *Service) Tx(tx portainer.Transaction) ServiceTx {
+	return ServiceTx{
+		BaseDataServiceTx: dataservices.BaseDataServiceTx[portainer.Team, portainer.TeamID]{
+			Bucket:     BucketName,
+			Connection: service.Connection,
+			Tx:         tx,
+		},
+	}
+}
+
+// TeamByName returns a team by name.
+func (service *Service) TeamByName(name string) (*portainer.Team, error) {
+	var t portainer.Team
+
+	err := service.Connection.GetAll(
+		BucketName,
+		&portainer.Team{},
+		dataservices.FirstFn(&t, func(e portainer.Team) bool {
+			return strings.EqualFold(e.Name, name)
+		}),
+	)
+
+	if errors.Is(err, dataservices.ErrStop) {
+		return &t, nil
+	}
+
+	if err == nil {
+		return nil, dserrors.ErrObjectNotFound
+	}
+
+	return nil, err
+}
+
+// CreateTeam creates a new Team.
+func (service *Service) Create(team *portainer.Team) error {
+	return service.Connection.CreateObject(
+		BucketName,
+		func(id uint64) (int, any) {
+			team.ID = portainer.TeamID(id)
+			return int(team.ID), team
+		},
+	)
+}
diff --git a/api/dataservices/team/tests/team_test.go b/api/dataservices/team/tests/team_test.go
new file mode 100644
index 0000000..fa08a5b
--- /dev/null
+++ b/api/dataservices/team/tests/team_test.go
@@ -0,0 +1,73 @@
+package tests
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices/errors"
+	"github.com/portainer/portainer/api/datastore"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type teamBuilder struct {
+	t     *testing.T
+	count int
+	store *datastore.Store
+}
+
+func (b *teamBuilder) createNew(name string) *portainer.Team {
+	b.count++
+	team := &portainer.Team{
+		ID:   portainer.TeamID(b.count),
+		Name: name,
+	}
+
+	err := b.store.Team().Create(team)
+	assert.NoError(b.t, err)
+
+	return team
+}
+
+func Test_teamByName(t *testing.T) {
+	t.Parallel()
+	t.Run("When store is empty should return ErrObjectNotFound", func(t *testing.T) {
+		_, store := datastore.MustNewTestStore(t, false, true)
+
+		_, err := store.Team().TeamByName("name")
+		require.ErrorIs(t, err, errors.ErrObjectNotFound)
+
+	})
+
+	t.Run("When there is no object with the same name should return ErrObjectNotFound", func(t *testing.T) {
+		_, store := datastore.MustNewTestStore(t, false, true)
+
+		teamBuilder := teamBuilder{
+			t:     t,
+			store: store,
+			count: 0,
+		}
+
+		teamBuilder.createNew("name1")
+
+		_, err := store.Team().TeamByName("name")
+		require.ErrorIs(t, err, errors.ErrObjectNotFound)
+	})
+
+	t.Run("When there is an object with the same name should return the object", func(t *testing.T) {
+		_, store := datastore.MustNewTestStore(t, false, true)
+
+		teamBuilder := teamBuilder{
+			t:     t,
+			store: store,
+			count: 0,
+		}
+
+		expectedTeam := teamBuilder.createNew("name1")
+
+		team, err := store.Team().TeamByName("name1")
+		require.NoError(t, err, "TeamByName should succeed")
+		assert.Equal(t, expectedTeam, team)
+	})
+}
diff --git a/api/dataservices/team/tx.go b/api/dataservices/team/tx.go
new file mode 100644
index 0000000..4887aa4
--- /dev/null
+++ b/api/dataservices/team/tx.go
@@ -0,0 +1,48 @@
+package team
+
+import (
+	"errors"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	dserrors "github.com/portainer/portainer/api/dataservices/errors"
+)
+
+type ServiceTx struct {
+	dataservices.BaseDataServiceTx[portainer.Team, portainer.TeamID]
+}
+
+// TeamByName returns a team by name.
+func (service ServiceTx) TeamByName(name string) (*portainer.Team, error) {
+	var t portainer.Team
+
+	err := service.Tx.GetAll(
+		BucketName,
+		&portainer.Team{},
+		dataservices.FirstFn(&t, func(e portainer.Team) bool {
+			return strings.EqualFold(e.Name, name)
+		}),
+	)
+
+	if errors.Is(err, dataservices.ErrStop) {
+		return &t, nil
+	}
+
+	if err == nil {
+		return nil, dserrors.ErrObjectNotFound
+	}
+
+	return nil, err
+}
+
+// CreateTeam creates a new Team.
+func (service ServiceTx) Create(team *portainer.Team) error {
+	return service.Tx.CreateObject(
+		BucketName,
+		func(id uint64) (int, any) {
+			team.ID = portainer.TeamID(id)
+			return int(team.ID), team
+		},
+	)
+}
diff --git a/api/dataservices/teammembership/teammembership.go b/api/dataservices/teammembership/teammembership.go
new file mode 100644
index 0000000..4c8e80d
--- /dev/null
+++ b/api/dataservices/teammembership/teammembership.go
@@ -0,0 +1,142 @@
+package teammembership
+
+import (
+	"fmt"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+
+	"github.com/rs/zerolog/log"
+)
+
+// BucketName represents the name of the bucket where this service stores data.
+const BucketName = "team_membership"
+
+// Service represents a service for managing environment(endpoint) data.
+type Service struct {
+	dataservices.BaseDataService[portainer.TeamMembership, portainer.TeamMembershipID]
+}
+
+// NewService creates a new instance of a service.
+func NewService(connection portainer.Connection) (*Service, error) {
+	err := connection.SetServiceName(BucketName)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Service{
+		BaseDataService: dataservices.BaseDataService[portainer.TeamMembership, portainer.TeamMembershipID]{
+			Bucket:     BucketName,
+			Connection: connection,
+		},
+	}, nil
+}
+
+func (service *Service) Tx(tx portainer.Transaction) ServiceTx {
+	return ServiceTx{
+		BaseDataServiceTx: dataservices.BaseDataServiceTx[portainer.TeamMembership, portainer.TeamMembershipID]{
+			Bucket:     BucketName,
+			Connection: service.Connection,
+			Tx:         tx,
+		},
+	}
+}
+
+// TeamMembershipsByUserID return an array containing all the TeamMembership objects where the specified userID is present.
+func (service *Service) TeamMembershipsByUserID(userID portainer.UserID) ([]portainer.TeamMembership, error) {
+	var memberships = make([]portainer.TeamMembership, 0)
+
+	return memberships, service.Connection.GetAll(
+		BucketName,
+		&portainer.TeamMembership{},
+		dataservices.FilterFn(&memberships, func(e portainer.TeamMembership) bool {
+			return e.UserID == userID
+		}),
+	)
+}
+
+// TeamMembershipsByTeamID return an array containing all the TeamMembership objects where the specified teamID is present.
+func (service *Service) TeamMembershipsByTeamID(teamID portainer.TeamID) ([]portainer.TeamMembership, error) {
+	var memberships = make([]portainer.TeamMembership, 0)
+
+	return memberships, service.Connection.GetAll(
+		BucketName,
+		&portainer.TeamMembership{},
+		dataservices.FilterFn(&memberships, func(e portainer.TeamMembership) bool {
+			return e.TeamID == teamID
+		}),
+	)
+}
+
+// CreateTeamMembership creates a new TeamMembership object.
+func (service *Service) Create(membership *portainer.TeamMembership) error {
+	return service.Connection.CreateObject(
+		BucketName,
+		func(id uint64) (int, any) {
+			membership.ID = portainer.TeamMembershipID(id)
+			return int(membership.ID), membership
+		},
+	)
+}
+
+// DeleteTeamMembershipByUserID deletes all the TeamMembership object associated to a UserID.
+func (service *Service) DeleteTeamMembershipByUserID(userID portainer.UserID) error {
+	return service.Connection.DeleteAllObjects(
+		BucketName,
+		&portainer.TeamMembership{},
+		func(obj any) (id int, ok bool) {
+			membership, ok := obj.(*portainer.TeamMembership)
+			if !ok {
+				log.Debug().Str("obj", fmt.Sprintf("%#v", obj)).Msg("failed to convert to TeamMembership object")
+				//return fmt.Errorf("Failed to convert to TeamMembership object: %s", obj)
+				return -1, false
+			}
+
+			if membership.UserID == userID {
+				return int(membership.ID), true
+			}
+
+			return -1, false
+		})
+}
+
+// DeleteTeamMembershipByTeamID deletes all the TeamMembership object associated to a TeamID.
+func (service *Service) DeleteTeamMembershipByTeamID(teamID portainer.TeamID) error {
+	return service.Connection.DeleteAllObjects(
+		BucketName,
+		&portainer.TeamMembership{},
+		func(obj any) (id int, ok bool) {
+			membership, ok := obj.(*portainer.TeamMembership)
+			if !ok {
+				log.Debug().Str("obj", fmt.Sprintf("%#v", obj)).Msg("failed to convert to TeamMembership object")
+				//return fmt.Errorf("Failed to convert to TeamMembership object: %s", obj)
+				return -1, false
+			}
+
+			if membership.TeamID == teamID {
+				return int(membership.ID), true
+			}
+
+			return -1, false
+		})
+}
+
+func (service *Service) DeleteTeamMembershipByTeamIDAndUserID(teamID portainer.TeamID, userID portainer.UserID) error {
+	return service.Connection.DeleteAllObjects(
+		BucketName,
+		&portainer.TeamMembership{},
+		func(obj any) (id int, ok bool) {
+			membership, ok := obj.(*portainer.TeamMembership)
+			if !ok {
+				log.Debug().Str("obj", fmt.Sprintf("%#v", obj)).Msg("failed to convert to TeamMembership object")
+				//return fmt.Errorf("Failed to convert to TeamMembership object: %s", obj)
+				return -1, false
+			}
+
+			if membership.TeamID == teamID && membership.UserID == userID {
+				return int(membership.ID), true
+			}
+
+			return -1, false
+		})
+}
diff --git a/api/dataservices/teammembership/tx.go b/api/dataservices/teammembership/tx.go
new file mode 100644
index 0000000..3175eb6
--- /dev/null
+++ b/api/dataservices/teammembership/tx.go
@@ -0,0 +1,113 @@
+package teammembership
+
+import (
+	"fmt"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+
+	"github.com/rs/zerolog/log"
+)
+
+type ServiceTx struct {
+	dataservices.BaseDataServiceTx[portainer.TeamMembership, portainer.TeamMembershipID]
+}
+
+// TeamMembershipsByUserID return an array containing all the TeamMembership objects where the specified userID is present.
+func (service ServiceTx) TeamMembershipsByUserID(userID portainer.UserID) ([]portainer.TeamMembership, error) {
+	var memberships = make([]portainer.TeamMembership, 0)
+
+	return memberships, service.Tx.GetAll(
+		BucketName,
+		&portainer.TeamMembership{},
+		dataservices.FilterFn(&memberships, func(e portainer.TeamMembership) bool {
+			return e.UserID == userID
+		}),
+	)
+}
+
+// TeamMembershipsByTeamID return an array containing all the TeamMembership objects where the specified teamID is present.
+func (service ServiceTx) TeamMembershipsByTeamID(teamID portainer.TeamID) ([]portainer.TeamMembership, error) {
+	var memberships = make([]portainer.TeamMembership, 0)
+
+	return memberships, service.Tx.GetAll(
+		BucketName,
+		&portainer.TeamMembership{},
+		dataservices.FilterFn(&memberships, func(e portainer.TeamMembership) bool {
+			return e.TeamID == teamID
+		}),
+	)
+}
+
+// CreateTeamMembership creates a new TeamMembership object.
+func (service ServiceTx) Create(membership *portainer.TeamMembership) error {
+	return service.Tx.CreateObject(
+		BucketName,
+		func(id uint64) (int, any) {
+			membership.ID = portainer.TeamMembershipID(id)
+			return int(membership.ID), membership
+		},
+	)
+}
+
+// DeleteTeamMembershipByUserID deletes all the TeamMembership object associated to a UserID.
+func (service ServiceTx) DeleteTeamMembershipByUserID(userID portainer.UserID) error {
+	return service.Tx.DeleteAllObjects(
+		BucketName,
+		&portainer.TeamMembership{},
+		func(obj any) (id int, ok bool) {
+			membership, ok := obj.(portainer.TeamMembership)
+			if !ok {
+				log.Debug().Str("obj", fmt.Sprintf("%#v", obj)).Msg("failed to convert to TeamMembership object")
+				//return fmt.Errorf("Failed to convert to TeamMembership object: %s", obj)
+				return -1, false
+			}
+
+			if membership.UserID == userID {
+				return int(membership.ID), true
+			}
+
+			return -1, false
+		})
+}
+
+// DeleteTeamMembershipByTeamID deletes all the TeamMembership object associated to a TeamID.
+func (service ServiceTx) DeleteTeamMembershipByTeamID(teamID portainer.TeamID) error {
+	return service.Tx.DeleteAllObjects(
+		BucketName,
+		&portainer.TeamMembership{},
+		func(obj any) (id int, ok bool) {
+			membership, ok := obj.(portainer.TeamMembership)
+			if !ok {
+				log.Debug().Str("obj", fmt.Sprintf("%#v", obj)).Msg("failed to convert to TeamMembership object")
+				//return fmt.Errorf("Failed to convert to TeamMembership object: %s", obj)
+				return -1, false
+			}
+
+			if membership.TeamID == teamID {
+				return int(membership.ID), true
+			}
+
+			return -1, false
+		})
+}
+
+func (service ServiceTx) DeleteTeamMembershipByTeamIDAndUserID(teamID portainer.TeamID, userID portainer.UserID) error {
+	return service.Tx.DeleteAllObjects(
+		BucketName,
+		&portainer.TeamMembership{},
+		func(obj any) (id int, ok bool) {
+			membership, ok := obj.(portainer.TeamMembership)
+			if !ok {
+				log.Debug().Str("obj", fmt.Sprintf("%#v", obj)).Msg("failed to convert to TeamMembership object")
+				//return fmt.Errorf("Failed to convert to TeamMembership object: %s", obj)
+				return -1, false
+			}
+
+			if membership.TeamID == teamID && membership.UserID == userID {
+				return int(membership.ID), true
+			}
+
+			return -1, false
+		})
+}
diff --git a/api/dataservices/tunnelserver/tunnelserver.go b/api/dataservices/tunnelserver/tunnelserver.go
new file mode 100644
index 0000000..ea573e7
--- /dev/null
+++ b/api/dataservices/tunnelserver/tunnelserver.go
@@ -0,0 +1,49 @@
+package tunnelserver
+
+import (
+	portainer "github.com/portainer/portainer/api"
+)
+
+const (
+	// BucketName represents the name of the bucket where this service stores data.
+	BucketName = "tunnel_server"
+	infoKey    = "INFO"
+)
+
+// Service represents a service for managing environment(endpoint) data.
+type Service struct {
+	connection portainer.Connection
+}
+
+func (service *Service) BucketName() string {
+	return BucketName
+}
+
+// NewService creates a new instance of a service.
+func NewService(connection portainer.Connection) (*Service, error) {
+	err := connection.SetServiceName(BucketName)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Service{
+		connection: connection,
+	}, nil
+}
+
+// Info retrieve the TunnelServerInfo object.
+func (service *Service) Info() (*portainer.TunnelServerInfo, error) {
+	var info portainer.TunnelServerInfo
+
+	err := service.connection.GetObject(BucketName, []byte(infoKey), &info)
+	if err != nil {
+		return nil, err
+	}
+
+	return &info, nil
+}
+
+// UpdateInfo persists a TunnelServerInfo object.
+func (service *Service) UpdateInfo(settings *portainer.TunnelServerInfo) error {
+	return service.connection.UpdateObject(BucketName, []byte(infoKey), settings)
+}
diff --git a/api/dataservices/user/tx.go b/api/dataservices/user/tx.go
new file mode 100644
index 0000000..5162b94
--- /dev/null
+++ b/api/dataservices/user/tx.go
@@ -0,0 +1,75 @@
+package user
+
+import (
+	"errors"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	dserrors "github.com/portainer/portainer/api/dataservices/errors"
+)
+
+type ServiceTx struct {
+	dataservices.BaseDataServiceTx[portainer.User, portainer.UserID]
+}
+
+// UserByUsername returns a user by username.
+func (service ServiceTx) UserByUsername(username string) (*portainer.User, error) {
+	var u portainer.User
+
+	err := service.Tx.GetAll(
+		BucketName,
+		&portainer.User{},
+		dataservices.FirstFn(&u, func(e portainer.User) bool {
+			return strings.EqualFold(e.Username, username)
+		}),
+	)
+
+	if errors.Is(err, dataservices.ErrStop) {
+		return &u, nil
+	}
+
+	if err == nil {
+		return nil, dserrors.ErrObjectNotFound
+	}
+
+	return nil, err
+}
+
+func (service ServiceTx) UserIDByUsername(username string) (portainer.UserID, error) {
+	user, err := service.UserByUsername(username)
+	if err != nil {
+		return 0, err
+	}
+
+	if user == nil {
+		return 0, dserrors.ErrObjectNotFound
+	}
+	return user.ID, nil
+}
+
+// UsersByRole return an array containing all the users with the specified role.
+func (service ServiceTx) UsersByRole(role portainer.UserRole) ([]portainer.User, error) {
+	var users = make([]portainer.User, 0)
+
+	return users, service.Tx.GetAll(
+		BucketName,
+		&portainer.User{},
+		dataservices.FilterFn(&users, func(e portainer.User) bool {
+			return e.Role == role
+		}),
+	)
+}
+
+// CreateUser creates a new user.
+func (service ServiceTx) Create(user *portainer.User) error {
+	return service.Tx.CreateObject(
+		BucketName,
+		func(id uint64) (int, any) {
+			user.ID = portainer.UserID(id)
+			user.Username = strings.ToLower(user.Username)
+
+			return int(user.ID), user
+		},
+	)
+}
diff --git a/api/dataservices/user/user.go b/api/dataservices/user/user.go
new file mode 100644
index 0000000..2ab1a52
--- /dev/null
+++ b/api/dataservices/user/user.go
@@ -0,0 +1,104 @@
+package user
+
+import (
+	"errors"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	dserrors "github.com/portainer/portainer/api/dataservices/errors"
+)
+
+// BucketName represents the name of the bucket where this service stores data.
+const BucketName = "users"
+
+// Service represents a service for managing environment(endpoint) data.
+type Service struct {
+	dataservices.BaseDataService[portainer.User, portainer.UserID]
+}
+
+// NewService creates a new instance of a service.
+func NewService(connection portainer.Connection) (*Service, error) {
+	err := connection.SetServiceName(BucketName)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Service{
+		BaseDataService: dataservices.BaseDataService[portainer.User, portainer.UserID]{
+			Bucket:     BucketName,
+			Connection: connection,
+		},
+	}, nil
+}
+
+func (service *Service) Tx(tx portainer.Transaction) ServiceTx {
+	return ServiceTx{
+		BaseDataServiceTx: dataservices.BaseDataServiceTx[portainer.User, portainer.UserID]{
+			Bucket:     BucketName,
+			Connection: service.Connection,
+			Tx:         tx,
+		},
+	}
+}
+
+// UserByUsername returns a user by username.
+func (service *Service) UserByUsername(username string) (*portainer.User, error) {
+	var u portainer.User
+
+	err := service.Connection.GetAll(
+		BucketName,
+		&portainer.User{},
+		dataservices.FirstFn(&u, func(e portainer.User) bool {
+			return strings.EqualFold(e.Username, username)
+		}),
+	)
+
+	if errors.Is(err, dataservices.ErrStop) {
+		return &u, nil
+	}
+
+	if err == nil {
+		return nil, dserrors.ErrObjectNotFound
+	}
+
+	return nil, err
+}
+
+func (service *Service) UserIDByUsername(username string) (portainer.UserID, error) {
+	user, err := service.UserByUsername(username)
+	if err != nil {
+		return 0, err
+	}
+
+	if user == nil {
+		return 0, dserrors.ErrObjectNotFound
+	}
+	return user.ID, nil
+}
+
+// UsersByRole return an array containing all the users with the specified role.
+func (service *Service) UsersByRole(role portainer.UserRole) ([]portainer.User, error) {
+	var users = make([]portainer.User, 0)
+
+	return users, service.Connection.GetAll(
+		BucketName,
+		&portainer.User{},
+		dataservices.FilterFn(&users, func(e portainer.User) bool {
+			return e.Role == role
+		}),
+	)
+}
+
+// CreateUser creates a new user.
+func (service *Service) Create(user *portainer.User) error {
+	return service.Connection.CreateObject(
+		BucketName,
+		func(id uint64) (int, any) {
+			user.ID = portainer.UserID(id)
+			user.Username = strings.ToLower(user.Username)
+
+			return int(user.ID), user
+		},
+	)
+}
diff --git a/api/dataservices/version/tx.go b/api/dataservices/version/tx.go
new file mode 100644
index 0000000..b87f89f
--- /dev/null
+++ b/api/dataservices/version/tx.go
@@ -0,0 +1,70 @@
+package version
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/database/models"
+	"github.com/portainer/portainer/api/dataservices"
+)
+
+type ServiceTx struct {
+	dataservices.BaseDataServiceTx[models.Version, int] // ID is not used
+}
+
+func (tx ServiceTx) InstanceID() (string, error) {
+	v, err := tx.Version()
+	if err != nil {
+		return "", err
+	}
+
+	return v.InstanceID, nil
+}
+
+func (tx ServiceTx) UpdateInstanceID(ID string) error {
+	v, err := tx.Version()
+	if err != nil {
+		if !dataservices.IsErrObjectNotFound(err) {
+			return err
+		}
+
+		v = &models.Version{}
+	}
+
+	v.InstanceID = ID
+
+	return tx.UpdateVersion(v)
+}
+
+func (tx ServiceTx) Edition() (portainer.SoftwareEdition, error) {
+	v, err := tx.Version()
+	if err != nil {
+		return 0, err
+	}
+
+	return portainer.SoftwareEdition(v.Edition), nil
+}
+
+func (tx ServiceTx) Version() (*models.Version, error) {
+	var v models.Version
+
+	err := tx.Tx.GetObject(BucketName, []byte(versionKey), &v)
+	if err != nil {
+		return nil, err
+	}
+
+	return &v, nil
+}
+
+func (tx ServiceTx) UpdateVersion(version *models.Version) error {
+	return tx.Tx.UpdateObject(BucketName, []byte(versionKey), version)
+}
+
+func (tx ServiceTx) SchemaVersion() (string, error) {
+	var v models.Version
+
+	err := tx.Tx.GetObject(BucketName, []byte(versionKey), &v)
+	if err != nil {
+		return "", err
+	}
+
+	return v.SchemaVersion, nil
+}
diff --git a/api/dataservices/version/version.go b/api/dataservices/version/version.go
new file mode 100644
index 0000000..bf47c45
--- /dev/null
+++ b/api/dataservices/version/version.go
@@ -0,0 +1,133 @@
+package version
+
+import (
+	"errors"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/database/models"
+	"github.com/portainer/portainer/api/dataservices"
+	dserrors "github.com/portainer/portainer/api/dataservices/errors"
+)
+
+const (
+	// BucketName represents the name of the bucket where this service stores data.
+	BucketName  = "version"
+	versionKey  = "VERSION"
+	updatingKey = "DB_UPDATING"
+)
+
+// Service represents a service to manage stored versions.
+type Service struct {
+	connection portainer.Connection
+}
+
+// NewService creates a new instance of a service.
+func NewService(connection portainer.Connection) (*Service, error) {
+	err := connection.SetServiceName(BucketName)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Service{
+		connection: connection,
+	}, nil
+}
+
+func (service *Service) Tx(tx portainer.Transaction) ServiceTx {
+	return ServiceTx{
+		BaseDataServiceTx: dataservices.BaseDataServiceTx[models.Version, int]{
+			Bucket:     BucketName,
+			Connection: service.connection,
+			Tx:         tx,
+		},
+	}
+}
+
+func (service *Service) SchemaVersion() (string, error) {
+	v, err := service.Version()
+	if err != nil {
+		return "", err
+	}
+
+	return v.SchemaVersion, nil
+}
+
+func (service *Service) UpdateSchemaVersion(version string) error {
+	v, err := service.Version()
+	if err != nil {
+		return err
+	}
+
+	v.SchemaVersion = version
+	return service.UpdateVersion(v)
+}
+
+func (service *Service) Edition() (portainer.SoftwareEdition, error) {
+	v, err := service.Version()
+	if err != nil {
+		return 0, err
+	}
+
+	return portainer.SoftwareEdition(v.Edition), nil
+}
+
+// IsUpdating retrieves the database updating status.
+func (service *Service) IsUpdating() (bool, error) {
+	var isUpdating bool
+	err := service.connection.GetObject(BucketName, []byte(updatingKey), &isUpdating)
+	if err != nil && errors.Is(err, dserrors.ErrObjectNotFound) {
+		return false, nil
+	}
+	return isUpdating, err
+}
+
+// StoreIsUpdating store the database updating status.
+func (service *Service) StoreIsUpdating(isUpdating bool) error {
+	if isUpdating {
+		return service.connection.UpdateObject(BucketName, []byte(updatingKey), isUpdating)
+	}
+
+	return service.connection.DeleteObject(BucketName, []byte(updatingKey))
+}
+
+// InstanceID retrieves the stored instance ID.
+func (service *Service) InstanceID() (string, error) {
+	v, err := service.Version()
+	if err != nil {
+		return "", err
+	}
+
+	return v.InstanceID, nil
+}
+
+// StoreInstanceID store the instance ID.
+func (service *Service) UpdateInstanceID(id string) error {
+	v, err := service.Version()
+	if err != nil {
+		if !dataservices.IsErrObjectNotFound(err) {
+			return err
+		}
+
+		v = &models.Version{}
+	}
+
+	v.InstanceID = id
+	return service.UpdateVersion(v)
+}
+
+// Version retrieve the version object.
+func (service *Service) Version() (*models.Version, error) {
+	var v models.Version
+
+	err := service.connection.GetObject(BucketName, []byte(versionKey), &v)
+	if err != nil {
+		return nil, err
+	}
+
+	return &v, nil
+}
+
+// UpdateVersion persists a Version object.
+func (service *Service) UpdateVersion(version *models.Version) error {
+	return service.connection.UpdateObject(BucketName, []byte(versionKey), version)
+}
diff --git a/api/dataservices/webhook/webhook.go b/api/dataservices/webhook/webhook.go
new file mode 100644
index 0000000..58347cb
--- /dev/null
+++ b/api/dataservices/webhook/webhook.go
@@ -0,0 +1,89 @@
+package webhook
+
+import (
+	"errors"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	dserrors "github.com/portainer/portainer/api/dataservices/errors"
+)
+
+// BucketName represents the name of the bucket where this service stores data.
+const BucketName = "webhooks"
+
+// Service represents a service for managing webhook data.
+type Service struct {
+	dataservices.BaseDataService[portainer.Webhook, portainer.WebhookID]
+}
+
+// NewService creates a new instance of a service.
+func NewService(connection portainer.Connection) (*Service, error) {
+	err := connection.SetServiceName(BucketName)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Service{
+		BaseDataService: dataservices.BaseDataService[portainer.Webhook, portainer.WebhookID]{
+			Bucket:     BucketName,
+			Connection: connection,
+		},
+	}, nil
+}
+
+// WebhookByResourceID returns a webhook by the ResourceID it is associated with.
+func (service *Service) WebhookByResourceID(ID string) (*portainer.Webhook, error) {
+	var w portainer.Webhook
+
+	err := service.Connection.GetAll(
+		BucketName,
+		&portainer.Webhook{},
+		dataservices.FirstFn(&w, func(e portainer.Webhook) bool {
+			return e.ResourceID == ID
+		}),
+	)
+
+	if errors.Is(err, dataservices.ErrStop) {
+		return &w, nil
+	}
+
+	if err == nil {
+		return nil, dserrors.ErrObjectNotFound
+	}
+
+	return nil, err
+}
+
+// WebhookByToken returns a webhook by the random token it is associated with.
+func (service *Service) WebhookByToken(token string) (*portainer.Webhook, error) {
+	var w portainer.Webhook
+
+	err := service.Connection.GetAll(
+		BucketName,
+		&portainer.Webhook{},
+		dataservices.FirstFn(&w, func(e portainer.Webhook) bool {
+			return e.Token == token
+		}),
+	)
+
+	if errors.Is(err, dataservices.ErrStop) {
+		return &w, nil
+	}
+
+	if err == nil {
+		return nil, dserrors.ErrObjectNotFound
+	}
+
+	return nil, err
+}
+
+// CreateWebhook assign an ID to a new webhook and saves it.
+func (service *Service) Create(webhook *portainer.Webhook) error {
+	return service.Connection.CreateObject(
+		BucketName,
+		func(id uint64) (int, any) {
+			webhook.ID = portainer.WebhookID(id)
+			return int(webhook.ID), webhook
+		},
+	)
+}
diff --git a/api/dataservices/workflow/service.go b/api/dataservices/workflow/service.go
new file mode 100644
index 0000000..8901ecb
--- /dev/null
+++ b/api/dataservices/workflow/service.go
@@ -0,0 +1,46 @@
+package workflow
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+)
+
+const BucketName = "workflows"
+
+type Service struct {
+	dataservices.BaseDataService[portainer.Workflow, portainer.WorkflowID]
+}
+
+func NewService(connection portainer.Connection) (*Service, error) {
+	err := connection.SetServiceName(BucketName)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Service{
+		BaseDataService: dataservices.BaseDataService[portainer.Workflow, portainer.WorkflowID]{
+			Bucket:     BucketName,
+			Connection: connection,
+		},
+	}, nil
+}
+
+func (service *Service) Tx(tx portainer.Transaction) ServiceTx {
+	return ServiceTx{
+		BaseDataServiceTx: dataservices.BaseDataServiceTx[portainer.Workflow, portainer.WorkflowID]{
+			Bucket:     BucketName,
+			Connection: service.Connection,
+			Tx:         tx,
+		},
+	}
+}
+
+func (service *Service) Create(workflow *portainer.Workflow) error {
+	return service.Connection.CreateObject(
+		BucketName,
+		func(id uint64) (int, any) {
+			workflow.ID = portainer.WorkflowID(id)
+			return int(workflow.ID), workflow
+		},
+	)
+}
diff --git a/api/dataservices/workflow/tx.go b/api/dataservices/workflow/tx.go
new file mode 100644
index 0000000..8fe38fd
--- /dev/null
+++ b/api/dataservices/workflow/tx.go
@@ -0,0 +1,20 @@
+package workflow
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+)
+
+type ServiceTx struct {
+	dataservices.BaseDataServiceTx[portainer.Workflow, portainer.WorkflowID]
+}
+
+func (service ServiceTx) Create(workflow *portainer.Workflow) error {
+	return service.Tx.CreateObject(
+		BucketName,
+		func(id uint64) (int, any) {
+			workflow.ID = portainer.WorkflowID(id)
+			return int(workflow.ID), workflow
+		},
+	)
+}
diff --git a/api/datastore/backup.go b/api/datastore/backup.go
new file mode 100644
index 0000000..8cf9a18
--- /dev/null
+++ b/api/datastore/backup.go
@@ -0,0 +1,102 @@
+package datastore
+
+import (
+	"fmt"
+	"os"
+	"path"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/rs/zerolog/log"
+)
+
+// Backup takes an optional output path and creates a backup of the database.
+// The database connection is stopped before running the backup to avoid any
+// corruption and if a path is not given a default is used.
+// The path or an error are returned.
+func (store *Store) Backup(path string) (string, error) {
+	if err := store.Close(); err != nil {
+		return "", fmt.Errorf("failed to close store before backup: %w", err)
+	}
+
+	filename, err := store.backupDBFile(path)
+	if err != nil {
+		return "", err
+	}
+
+	if _, err := store.Open(); err != nil {
+		return "", fmt.Errorf("failed to reopen store after backup: %w", err)
+	}
+
+	return filename, nil
+}
+
+// backupDBFile copies the database file to the backup location.
+// Does not manage connection state - works with the database file directly regardless of connection state.
+func (store *Store) backupDBFile(backupPath string) (string, error) {
+	if err := store.createBackupPath(); err != nil {
+		return "", err
+	}
+
+	backupFilename := store.backupFilename()
+	if backupPath != "" {
+		backupFilename = backupPath
+	}
+
+	log.Info().Str("from", store.connection.GetDatabaseFilePath()).Str("to", backupFilename).Msg("Backing up database")
+
+	if err := store.fileService.Copy(store.connection.GetDatabaseFilePath(), backupFilename, true); err != nil {
+		return "", fmt.Errorf("failed to create backup file: %w", err)
+	}
+
+	return backupFilename, nil
+}
+
+func (store *Store) Restore() error {
+	backupFilename := store.backupFilename()
+	return store.RestoreFromFile(backupFilename)
+}
+
+func (store *Store) RestoreFromFile(backupFilename string) error {
+	if err := store.Close(); err != nil {
+		return err
+	}
+
+	if err := store.fileService.Copy(backupFilename, store.connection.GetDatabaseFilePath(), true); err != nil {
+		return fmt.Errorf("unable to restore backup file %q. err: %w", backupFilename, err)
+	}
+
+	log.Info().Str("from", backupFilename).Str("to", store.connection.GetDatabaseFilePath()).Msgf("database restored")
+
+	if _, err := store.Open(); err != nil {
+		return fmt.Errorf("unable to determine version of restored portainer backup file: %w", err)
+	}
+
+	// determine the db version
+	version, err := store.VersionService.Version()
+	if err != nil {
+		return fmt.Errorf("unable to determine restored database version. err: %w", err)
+	}
+
+	editionLabel := portainer.SoftwareEdition(version.Edition).GetEditionLabel()
+	log.Info().Msgf("Restored database version: Portainer %s %s", editionLabel, version.SchemaVersion)
+	return nil
+}
+
+func (store *Store) createBackupPath() error {
+	backupDir := path.Join(store.connection.GetStorePath(), "backups")
+	if exists, _ := store.fileService.FileExists(backupDir); !exists {
+		if err := os.MkdirAll(backupDir, 0o700); err != nil {
+			return fmt.Errorf("unable to create backup folder: %w", err)
+		}
+	}
+
+	return nil
+}
+
+func (store *Store) backupFilename() string {
+	return path.Join(store.connection.GetStorePath(), "backups", store.connection.GetDatabaseFileName()+".bak")
+}
+
+func (store *Store) databasePath() string {
+	return store.connection.GetDatabaseFilePath()
+}
diff --git a/api/datastore/backup_test.go b/api/datastore/backup_test.go
new file mode 100644
index 0000000..330a4cf
--- /dev/null
+++ b/api/datastore/backup_test.go
@@ -0,0 +1,146 @@
+package datastore
+
+import (
+	"os"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/database/boltdb"
+	"github.com/portainer/portainer/api/database/models"
+	"github.com/stretchr/testify/require"
+
+	"github.com/rs/zerolog/log"
+)
+
+func TestStoreCreation(t *testing.T) {
+	t.Parallel()
+	_, store := MustNewTestStore(t, true, true)
+	require.NotNil(t, store)
+
+	v, err := store.VersionService.Version()
+	if err != nil {
+		log.Fatal().Err(err).Msg("")
+	}
+
+	if portainer.SoftwareEdition(v.Edition) != portainer.PortainerCE {
+		t.Error("Expect to get CE Edition")
+	}
+
+	if v.SchemaVersion != portainer.APIVersion {
+		t.Error("Expect to get APIVersion")
+	}
+}
+
+func TestBackup(t *testing.T) {
+	t.Parallel()
+	_, store := MustNewTestStore(t, true, true)
+	backupFileName := store.backupFilename()
+	t.Run("Backup should create "+backupFileName, func(t *testing.T) {
+		v := models.Version{
+			Edition:       int(portainer.PortainerCE),
+			SchemaVersion: portainer.APIVersion,
+		}
+
+		err := store.VersionService.UpdateVersion(&v)
+		require.NoError(t, err)
+
+		_, err = store.Backup("")
+		require.NoError(t, err)
+
+		if !isFileExist(backupFileName) {
+			t.Errorf("Expect backup file to be created %s", backupFileName)
+		}
+	})
+}
+
+func TestRestore(t *testing.T) {
+	t.Parallel()
+	_, store := MustNewTestStore(t, true, false)
+
+	t.Run("Basic Restore", func(t *testing.T) {
+		// override and set initial db version and edition
+		updateEdition(store, portainer.PortainerCE)
+		updateVersion(store, "2.4")
+
+		_, err := store.Backup("")
+		require.NoError(t, err)
+
+		updateVersion(store, "2.16")
+		testVersion(store, "2.16", t)
+
+		err = store.Restore()
+		require.NoError(t, err)
+
+		// check if the restore is successful and the version is correct
+		testVersion(store, "2.4", t)
+	})
+
+	t.Run("Basic Restore After Multiple Backups", func(t *testing.T) {
+		// override and set initial db version and edition
+		updateEdition(store, portainer.PortainerCE)
+		updateVersion(store, "2.4")
+
+		_, err := store.Backup("")
+		require.NoError(t, err)
+
+		updateVersion(store, "2.14")
+		updateVersion(store, "2.16")
+		testVersion(store, "2.16", t)
+
+		err = store.Restore()
+		require.NoError(t, err)
+
+		// check if the restore is successful and the version is correct
+		testVersion(store, "2.4", t)
+	})
+}
+
+func TestBackupDBFile(t *testing.T) {
+	t.Parallel()
+	_, store := MustNewTestStore(t, true, false)
+
+	t.Run("creates backup file without managing connection state", func(t *testing.T) {
+		// Verify connection is usable before
+		_, err := store.VersionService.Version()
+		require.NoError(t, err, "connection should be usable before backupDBFile")
+
+		// backupDBFile should work without closing the connection
+		backupFilename, err := store.backupDBFile("")
+		require.NoError(t, err)
+		require.FileExists(t, backupFilename)
+
+		// Verify connection is still usable after (not closed/reopened)
+		_, err = store.VersionService.Version()
+		require.NoError(t, err, "connection should still be usable after backupDBFile")
+
+		require.NoError(t, os.Remove(backupFilename))
+	})
+
+	t.Run("uses custom path when provided", func(t *testing.T) {
+		customPath := t.TempDir() + "/custom-backup.db"
+		backupFilename, err := store.backupDBFile(customPath)
+		require.NoError(t, err)
+		require.Equal(t, customPath, backupFilename)
+		require.FileExists(t, backupFilename)
+	})
+}
+
+func TestBackupDBFileUsesCorrectPath(t *testing.T) {
+	t.Parallel()
+	_, store := MustNewTestStore(t, true, false)
+
+	t.Run("backs up unencrypted db when encrypted flag is false", func(t *testing.T) {
+		err := store.connection.SetEncrypted(false)
+		require.NoError(t, err)
+
+		backupFilename, err := store.backupDBFile("")
+		require.NoError(t, err)
+		require.FileExists(t, backupFilename)
+
+		// Verify it backed up the unencrypted file (portainer.db)
+		require.Contains(t, backupFilename, boltdb.DatabaseFileName)
+		require.NotContains(t, backupFilename, boltdb.EncryptedDatabaseFileName)
+
+		require.NoError(t, os.Remove(backupFilename))
+	})
+}
diff --git a/api/datastore/datastore.go b/api/datastore/datastore.go
new file mode 100644
index 0000000..b31988f
--- /dev/null
+++ b/api/datastore/datastore.go
@@ -0,0 +1,190 @@
+package datastore
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	portainerErrors "github.com/portainer/portainer/api/dataservices/errors"
+
+	"github.com/rs/zerolog/log"
+)
+
+// NewStore initializes a new Store and the associated services
+func NewStore(cliFlags *portainer.CLIFlags, fileService portainer.FileService, connection portainer.Connection) *Store {
+	return &Store{
+		flags:       cliFlags,
+		fileService: fileService,
+		connection:  connection,
+	}
+}
+
+// Open opens and initializes the BoltDB database.
+func (store *Store) Open() (newStore bool, err error) {
+	encryptionReq, err := store.connection.NeedsEncryptionMigration()
+	if err != nil {
+		return false, err
+	}
+
+	if encryptionReq {
+		// NeedsEncryptionMigration() sets encrypted=true as a side effect when a key exists.
+		// We need to set it back to false so GetDatabaseFilePath() returns the path to the
+		// actual unencrypted file (portainer.db) that we want to back up.
+		if err := store.connection.SetEncrypted(false); err != nil {
+			return false, err
+		}
+
+		// Use backupDBFile directly since connection isn't open yet
+		// and we don't want to trigger the close/open cycle of Backup()
+		backupFilename, err := store.backupDBFile("")
+		if err != nil {
+			return false, fmt.Errorf("failed to backup database prior to encrypting: %w", err)
+		}
+
+		if err := store.encryptDB(); err != nil {
+			innerErr := store.RestoreFromFile(backupFilename) // restore from backup if encryption fails
+			return false, errors.Join(err, innerErr)
+		}
+	}
+
+	if err := store.connection.Open(); err != nil {
+		return false, err
+	}
+
+	if err := store.initServices(); err != nil {
+		return false, err
+	}
+
+	// If no settings object exists then assume we have a new store
+	if _, err := store.SettingsService.Settings(); err != nil {
+		if store.IsErrObjectNotFound(err) {
+			return true, nil
+		}
+
+		return false, err
+	}
+
+	return false, nil
+}
+
+func (store *Store) Close() error {
+	return store.connection.Close()
+}
+
+func (store *Store) UpdateTx(fn func(dataservices.DataStoreTx) error) error {
+	return store.connection.UpdateTx(func(tx portainer.Transaction) error {
+		return fn(&StoreTx{store: store, tx: tx})
+	})
+}
+
+func (store *Store) ViewTx(fn func(dataservices.DataStoreTx) error) error {
+	return store.connection.ViewTx(func(tx portainer.Transaction) error {
+		return fn(&StoreTx{store: store, tx: tx})
+	})
+}
+
+// BackupTo backs up db to a provided writer.
+// It does hot backup and doesn't block other database reads and writes
+func (store *Store) BackupTo(w io.Writer) error {
+	return store.connection.BackupTo(w)
+}
+
+// CheckCurrentEdition checks if current edition is community edition
+func (store *Store) CheckCurrentEdition() error {
+	if store.edition() != portainer.Edition {
+		return portainerErrors.ErrWrongDBEdition
+	}
+
+	return nil
+}
+
+func (store *Store) edition() portainer.SoftwareEdition {
+	edition, err := store.VersionService.Edition()
+	if store.IsErrObjectNotFound(err) {
+		edition = portainer.PortainerCE
+	}
+
+	return edition
+}
+
+// TODO: move the use of this to dataservices.IsErrObjectNotFound()?
+func (store *Store) IsErrObjectNotFound(e error) bool {
+	return errors.Is(e, portainerErrors.ErrObjectNotFound)
+}
+
+func (store *Store) Connection() portainer.Connection {
+	return store.connection
+}
+
+func (store *Store) Rollback(force bool) error {
+	return store.connectionRollback(force)
+}
+
+func (store *Store) encryptDB() error {
+	if err := store.connection.SetEncrypted(false); err != nil {
+		return err
+	}
+
+	if err := store.connection.Open(); err != nil {
+		return err
+	}
+
+	if err := store.initServices(); err != nil {
+		return err
+	}
+
+	// The DB is not currently encrypted.  First save the encrypted db filename
+	oldFilename := store.connection.GetDatabaseFilePath()
+	log.Info().Msg("encrypting database")
+
+	// export file path for backup
+	exportFilename := path.Join(store.databasePath() + "." + fmt.Sprintf("backup-%d.json", time.Now().Unix()))
+
+	log.Info().Str("filename", exportFilename).Msg("exporting database backup")
+
+	if err := store.Export(exportFilename); err != nil {
+		log.Error().Str("filename", exportFilename).Err(err).Msg("failed to export")
+
+		return err
+	}
+
+	log.Info().Msg("database backup exported")
+
+	// Close existing un-encrypted db so that we can delete the file later
+	if err := store.connection.Close(); err != nil {
+		return err
+	}
+
+	if err := store.Import(exportFilename); err != nil {
+		log.Error().Err(err).Msg("failed to import database backup")
+
+		// Remove the new encrypted file that we failed to import
+		if err := os.Remove(store.connection.GetDatabaseFilePath()); err != nil {
+			log.Error().Msg("failed to remove the file after import failure")
+		}
+
+		log.Fatal().Err(portainerErrors.ErrDBImportFailed).Msg("")
+	}
+
+	if err := os.Remove(oldFilename); err != nil {
+		log.Error().Msg("failed to remove the un-encrypted db file")
+	}
+
+	if err := os.Remove(exportFilename); err != nil {
+		log.Error().Msg("failed to remove the json backup file")
+	}
+
+	// Close db connection
+	if err := store.connection.Close(); err != nil {
+		return err
+	}
+
+	log.Info().Msg("database successfully encrypted")
+
+	return nil
+}
diff --git a/api/datastore/datastore_test.go b/api/datastore/datastore_test.go
new file mode 100644
index 0000000..2a76530
--- /dev/null
+++ b/api/datastore/datastore_test.go
@@ -0,0 +1,383 @@
+package datastore
+
+import (
+	"fmt"
+	"runtime"
+	"strings"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/chisel"
+	"github.com/portainer/portainer/api/crypto"
+
+	"github.com/dchest/uniuri"
+	"github.com/pkg/errors"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	adminUsername                       = "admin"
+	adminPassword                       = "password"
+	standardUsername                    = "standard"
+	standardPassword                    = "password"
+	agentOnDockerEnvironmentUrl         = "tcp://192.168.167.207:30775"
+	edgeAgentOnKubernetesEnvironmentUrl = "tcp://192.168.167.207"
+	kubernetesLocalEnvironmentUrl       = "https://kubernetes.default.svc"
+)
+
+// TestStoreFull an eventually comprehensive set of tests for the Store.
+// The idea is what we write to the store, we should read back.
+func TestStoreFull(t *testing.T) {
+	t.Parallel()
+	_, store := MustNewTestStore(t, true, true)
+
+	testCases := map[string]func(t *testing.T){
+		"User Accounts":    store.testUserAccounts,
+		"Environments":     store.testEnvironments,
+		"Settings":         store.testSettings,
+		"SSL Settings":     store.testSSLSettings,
+		"Tunnel Server":    store.testTunnelServer,
+		"Custom Templates": store.testCustomTemplates,
+		"Registries":       store.testRegistries,
+		"Resource Control": store.testResourceControl,
+		"Schedules":        store.testSchedules,
+		"Tags":             store.testTags,
+	}
+
+	for name, test := range testCases {
+		t.Run(name, test)
+	}
+}
+
+func (store *Store) testEnvironments(t *testing.T) {
+	id := store.CreateEndpoint(t, "local", portainer.KubernetesLocalEnvironment, "", true)
+	store.CreateEndpointRelation(t, id)
+
+	id = store.CreateEndpoint(t, "agent", portainer.AgentOnDockerEnvironment, agentOnDockerEnvironmentUrl, true)
+	store.CreateEndpointRelation(t, id)
+
+	id = store.CreateEndpoint(t, "edge", portainer.EdgeAgentOnKubernetesEnvironment, edgeAgentOnKubernetesEnvironmentUrl, true)
+	store.CreateEndpointRelation(t, id)
+}
+
+func newEndpoint(endpointType portainer.EndpointType, id portainer.EndpointID, name, URL string, TLS bool) *portainer.Endpoint {
+	endpoint := &portainer.Endpoint{
+		ID:        id,
+		Name:      name,
+		URL:       URL,
+		Type:      endpointType,
+		GroupID:   portainer.EndpointGroupID(1),
+		PublicURL: "",
+		TLSConfig: portainer.TLSConfiguration{
+			TLS: false,
+		},
+		TagIDs:    nil,
+		Status:    portainer.EndpointStatusUp,
+		Snapshots: nil,
+		Kubernetes: portainer.KubernetesData{
+			Configuration: portainer.KubernetesConfiguration{
+				UseLoadBalancer:          false,
+				UseServerMetrics:         false,
+				EnableResourceOverCommit: true,
+			},
+		},
+	}
+
+	if TLS {
+		endpoint.TLSConfig = portainer.TLSConfiguration{
+			TLS:           true,
+			TLSSkipVerify: true,
+		}
+	}
+
+	return endpoint
+}
+
+func setEndpointAuthorizations(endpoint *portainer.Endpoint) {
+	endpoint.SecuritySettings = portainer.DefaultEndpointSecuritySettings()
+}
+
+func (store *Store) CreateEndpoint(t *testing.T, name string, endpointType portainer.EndpointType, URL string, tls bool) portainer.EndpointID {
+	is := assert.New(t)
+
+	var expectedEndpoint *portainer.Endpoint
+	id := portainer.EndpointID(store.Endpoint().GetNextIdentifier())
+
+	switch endpointType {
+	case portainer.DockerEnvironment:
+		if URL == "" {
+			URL = "unix:///var/run/docker.sock"
+			if runtime.GOOS == "windows" {
+				URL = "npipe:////./pipe/docker_engine"
+			}
+		}
+		expectedEndpoint = newEndpoint(endpointType, id, name, URL, tls)
+
+	case portainer.AgentOnDockerEnvironment:
+		expectedEndpoint = newEndpoint(endpointType, id, name, URL, tls)
+
+	case portainer.AgentOnKubernetesEnvironment:
+		URL = strings.TrimPrefix(URL, "tcp://")
+		expectedEndpoint = newEndpoint(endpointType, id, name, URL, tls)
+
+	case portainer.EdgeAgentOnKubernetesEnvironment:
+		cs := chisel.NewService(store, nil, nil)
+		expectedEndpoint = newEndpoint(endpointType, id, name, URL, tls)
+		edgeKey := cs.GenerateEdgeKey(URL, "", int(id))
+		expectedEndpoint.EdgeKey = edgeKey
+		store.testTunnelServer(t)
+
+	case portainer.KubernetesLocalEnvironment:
+		if URL == "" {
+			URL = kubernetesLocalEnvironmentUrl
+		}
+		expectedEndpoint = newEndpoint(endpointType, id, name, URL, tls)
+	}
+
+	setEndpointAuthorizations(expectedEndpoint)
+
+	err := store.Endpoint().Create(expectedEndpoint)
+	require.NoError(t, err)
+
+	endpoint, err := store.Endpoint().Endpoint(id)
+	require.NoError(t, err, "Endpoint() should not return an error")
+	is.Equal(expectedEndpoint, endpoint, "endpoint should be the same")
+
+	return endpoint.ID
+}
+
+func (store *Store) CreateEndpointRelation(t *testing.T, id portainer.EndpointID) {
+	relation := &portainer.EndpointRelation{
+		EndpointID: id,
+		EdgeStacks: map[portainer.EdgeStackID]bool{},
+	}
+
+	err := store.EndpointRelation().Create(relation)
+	require.NoError(t, err)
+}
+
+func (store *Store) testSSLSettings(t *testing.T) {
+	is := assert.New(t)
+	ssl := &portainer.SSLSettings{
+		CertPath:    "/data/certs/cert.pem",
+		HTTPEnabled: true,
+		KeyPath:     "/data/certs/key.pem",
+		SelfSigned:  true,
+	}
+
+	err := store.SSLSettings().UpdateSettings(ssl)
+	require.NoError(t, err)
+
+	settings, err := store.SSLSettings().Settings()
+	require.NoError(t, err, "Get sslsettings should succeed")
+	is.Equal(ssl, settings, "Stored SSLSettings should be the same as what is read out")
+}
+
+func (store *Store) testTunnelServer(t *testing.T) {
+	is := assert.New(t)
+	expectPrivateKeySeed := uniuri.NewLen(16)
+
+	err := store.TunnelServer().UpdateInfo(&portainer.TunnelServerInfo{PrivateKeySeed: expectPrivateKeySeed})
+	require.NoError(t, err, "UpdateInfo should have succeeded")
+
+	serverInfo, err := store.TunnelServer().Info()
+	require.NoError(t, err, "Info should have succeeded")
+
+	is.Equal(expectPrivateKeySeed, serverInfo.PrivateKeySeed, "hashed passwords should not differ")
+}
+
+// add users, read them back and check the details are unchanged
+func (store *Store) testUserAccounts(t *testing.T) {
+	err := store.createAccount(adminUsername, adminPassword, portainer.AdministratorRole)
+	require.NoError(t, err, "CreateAccount should succeed")
+
+	err = store.checkAccount(adminUsername, adminPassword, portainer.AdministratorRole)
+	require.NoError(t, err, "Account failure")
+
+	err = store.createAccount(standardUsername, standardPassword, portainer.StandardUserRole)
+	require.NoError(t, err, "CreateAccount should succeed")
+
+	err = store.checkAccount(standardUsername, standardPassword, portainer.StandardUserRole)
+	require.NoError(t, err, "Account failure")
+}
+
+// create an account with the provided details
+func (store *Store) createAccount(username, password string, role portainer.UserRole) error {
+	var err error
+	user := &portainer.User{Username: username, Role: role}
+
+	// encrypt the password
+	cs := crypto.Service{}
+	user.Password, err = cs.Hash(password)
+	if err != nil {
+		return err
+	}
+
+	return store.User().Create(user)
+}
+
+func (store *Store) checkAccount(username, expectPassword string, expectRole portainer.UserRole) error {
+	// Read the account for username.  Check password and role is what we expect
+
+	user, err := store.User().UserByUsername(username)
+	if err != nil {
+		return errors.Wrap(err, "failed to find user")
+	}
+
+	if user.Username != username || user.Role != expectRole {
+		return fmt.Errorf("%s user details do not match", user.Username)
+	}
+
+	// Check the password
+	cs := crypto.Service{}
+	if cs.CompareHashAndData(user.Password, expectPassword) != nil {
+		return fmt.Errorf("%s user password hash failure", user.Username)
+	}
+
+	return nil
+}
+
+func (store *Store) testSettings(t *testing.T) {
+	is := assert.New(t)
+
+	// since many settings are default and basically nil, I'm going to update some and read them back
+	expectedSettings, err := store.Settings().Settings()
+	require.NoError(t, err, "Settings() should not return an error")
+	expectedSettings.TemplatesURL = "http://portainer.io/application-templates"
+	expectedSettings.HelmRepositoryURL = "http://portainer.io/helm-repository"
+	expectedSettings.EdgeAgentCheckinInterval = 60
+	expectedSettings.AuthenticationMethod = portainer.AuthenticationLDAP
+	expectedSettings.LDAPSettings = portainer.LDAPSettings{
+		AnonymousMode:   true,
+		StartTLS:        true,
+		AutoCreateUsers: true,
+		Password:        "random",
+	}
+	expectedSettings.SnapshotInterval = "10m"
+
+	err = store.Settings().UpdateSettings(expectedSettings)
+	require.NoError(t, err, "UpdateSettings() should succeed")
+
+	settings, err := store.Settings().Settings()
+	require.NoError(t, err, "Settings() should not return an error")
+	is.Equal(expectedSettings, settings, "stored settings should match")
+}
+
+func (store *Store) testCustomTemplates(t *testing.T) {
+	is := assert.New(t)
+
+	customTemplate := store.CustomTemplate()
+	is.NotNil(customTemplate, "customTemplate Service shouldn't be nil")
+
+	expectedTemplate := &portainer.CustomTemplate{
+		ID:              portainer.CustomTemplateID(customTemplate.GetNextIdentifier()),
+		Title:           "Custom Title",
+		Description:     "Custom Template Description",
+		ProjectPath:     "/data/custom_template/1",
+		Note:            "A note about this custom template",
+		EntryPoint:      "docker-compose.yaml",
+		CreatedByUserID: 10,
+	}
+
+	err := customTemplate.Create(expectedTemplate)
+	require.NoError(t, err)
+
+	actualTemplate, err := customTemplate.Read(expectedTemplate.ID)
+	require.NoError(t, err, "CustomTemplate should not return an error")
+	is.Equal(expectedTemplate, actualTemplate, "expected and actual template do not match")
+}
+
+func (store *Store) testRegistries(t *testing.T) {
+	is := assert.New(t)
+
+	regService := store.RegistryService
+	is.NotNil(regService, "RegistryService shouldn't be nil")
+
+	reg1 := &portainer.Registry{
+		ID:   1,
+		Type: portainer.DockerHubRegistry,
+		Name: "Dockerhub Registry Test",
+	}
+
+	reg2 := &portainer.Registry{
+		ID:   2,
+		Type: portainer.GitlabRegistry,
+		Name: "Gitlab Registry Test",
+		Gitlab: portainer.GitlabRegistryData{
+			ProjectID:   12345,
+			InstanceURL: "http://gitlab.com/12345",
+			ProjectPath: "mytestproject",
+		},
+	}
+
+	err := regService.Create(reg1)
+	require.NoError(t, err)
+
+	err = regService.Create(reg2)
+	require.NoError(t, err)
+
+	actualReg1, err := regService.Read(reg1.ID)
+	require.NoError(t, err)
+	is.Equal(reg1, actualReg1, "registries differ")
+
+	actualReg2, err := regService.Read(reg2.ID)
+	require.NoError(t, err)
+	is.Equal(reg2, actualReg2, "registries differ")
+}
+
+func (store *Store) testResourceControl(t *testing.T) {
+	// is := assert.New(t)
+	// resControl := store.ResourceControl()
+	// ctrl := &portainer.ResourceControl{
+	// }
+	// resControl().Create()
+}
+
+func (store *Store) testSchedules(t *testing.T) {
+	is := assert.New(t)
+
+	schedule := store.ScheduleService
+	s := &portainer.Schedule{
+		ID:             portainer.ScheduleID(schedule.GetNextIdentifier()),
+		Name:           "My Custom Schedule 1",
+		CronExpression: "*/5 * * * * portainer /bin/sh -c echo 'hello world'",
+	}
+
+	err := schedule.CreateSchedule(s)
+	require.NoError(t, err, "CreateSchedule should succeed")
+
+	actual, err := schedule.Schedule(s.ID)
+	require.NoError(t, err, "schedule should be found")
+	is.Equal(s, actual, "schedules differ")
+}
+
+func (store *Store) testTags(t *testing.T) {
+	is := assert.New(t)
+
+	tags := store.TagService
+
+	tag1 := &portainer.Tag{
+		ID:   1,
+		Name: "Tag 1",
+	}
+
+	tag2 := &portainer.Tag{
+		ID:   2,
+		Name: "Tag 1",
+	}
+
+	err := tags.Create(tag1)
+	require.NoError(t, err, "Tags.Create should succeed")
+
+	err = tags.Create(tag2)
+	require.NoError(t, err, "Tags.Create should succeed")
+
+	actual, err := tags.Read(tag1.ID)
+	require.NoError(t, err, "tag1 should be found")
+	is.Equal(tag1, actual, "tags differ")
+
+	actual, err = tags.Read(tag2.ID)
+	require.NoError(t, err, "tag2 should be found")
+	is.Equal(tag2, actual, "tags differ")
+}
diff --git a/api/datastore/helpers_test.go b/api/datastore/helpers_test.go
new file mode 100644
index 0000000..1419d31
--- /dev/null
+++ b/api/datastore/helpers_test.go
@@ -0,0 +1,58 @@
+package datastore
+
+import (
+	"path/filepath"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+
+	"github.com/rs/zerolog/log"
+)
+
+// isFileExist is helper function to check for file existence
+func isFileExist(path string) bool {
+	matches, err := filepath.Glob(path)
+	if err != nil {
+		return false
+	}
+	return len(matches) > 0
+}
+
+func updateVersion(store *Store, v string) {
+	version, err := store.VersionService.Version()
+	if err != nil {
+		log.Fatal().Err(err).Msg("")
+	}
+
+	version.SchemaVersion = v
+
+	err = store.VersionService.UpdateVersion(version)
+	if err != nil {
+		log.Fatal().Err(err).Msg("")
+	}
+}
+
+func updateEdition(store *Store, edition portainer.SoftwareEdition) {
+	version, err := store.VersionService.Version()
+	if err != nil {
+		log.Fatal().Err(err).Msg("")
+	}
+
+	version.Edition = int(edition)
+
+	err = store.VersionService.UpdateVersion(version)
+	if err != nil {
+		log.Fatal().Err(err).Msg("")
+	}
+}
+
+// testVersion is a helper which tests current store version against wanted version
+func testVersion(store *Store, versionWant string, t *testing.T) {
+	v, err := store.VersionService.Version()
+	if err != nil {
+		log.Fatal().Err(err).Msg("")
+	}
+	if v.SchemaVersion != versionWant {
+		t.Errorf("Expect store version to be %s but was %s", versionWant, v.SchemaVersion)
+	}
+}
diff --git a/api/datastore/init.go b/api/datastore/init.go
new file mode 100644
index 0000000..191457b
--- /dev/null
+++ b/api/datastore/init.go
@@ -0,0 +1,115 @@
+package datastore
+
+import (
+	"os"
+
+	portainer "github.com/portainer/portainer/api"
+)
+
+// Init creates the default data set.
+func (store *Store) Init() error {
+	err := store.checkOrCreateDefaultSettings()
+	if err != nil {
+		return err
+	}
+
+	err = store.checkOrCreateDefaultSSLSettings()
+	if err != nil {
+		return err
+	}
+
+	return store.checkOrCreateDefaultData()
+}
+
+func (store *Store) checkOrCreateDefaultSettings() error {
+	isDDExtention := false
+	if _, ok := os.LookupEnv("DOCKER_EXTENSION"); ok {
+		isDDExtention = true
+	}
+
+	// TODO: these need to also be applied when importing
+	settings, err := store.SettingsService.Settings()
+	if store.IsErrObjectNotFound(err) {
+		defaultSettings := &portainer.Settings{
+			AuthenticationMethod: portainer.AuthenticationInternal,
+			BlackListedLabels:    make([]portainer.Pair, 0),
+			InternalAuthSettings: portainer.InternalAuthSettings{
+				RequiredPasswordLength: 12,
+			},
+			LDAPSettings: portainer.LDAPSettings{
+				AnonymousMode:   true,
+				AutoCreateUsers: true,
+				TLSConfig:       portainer.TLSConfiguration{},
+				SearchSettings: []portainer.LDAPSearchSettings{
+					{},
+				},
+				GroupSearchSettings: []portainer.LDAPGroupSearchSettings{
+					{},
+				},
+			},
+			OAuthSettings: portainer.OAuthSettings{
+				SSO: true,
+			},
+			SnapshotInterval:         portainer.DefaultSnapshotInterval,
+			EdgeAgentCheckinInterval: portainer.DefaultEdgeAgentCheckinIntervalInSeconds,
+			TemplatesURL:             "",
+			HelmRepositoryURL:        portainer.DefaultHelmRepositoryURL,
+			UserSessionTimeout:       portainer.DefaultUserSessionTimeout,
+			KubeconfigExpiry:         portainer.DefaultKubeconfigExpiry,
+			KubectlShellImage:        *store.flags.KubectlShellImage,
+
+			IsDockerDesktopExtension: isDDExtention,
+			EnforceEdgeID:            true,
+		}
+
+		return store.SettingsService.UpdateSettings(defaultSettings)
+	}
+	if err != nil {
+		return err
+	}
+
+	if settings.UserSessionTimeout == "" {
+		settings.UserSessionTimeout = portainer.DefaultUserSessionTimeout
+		return store.Settings().UpdateSettings(settings)
+	}
+
+	return nil
+}
+
+func (store *Store) checkOrCreateDefaultSSLSettings() error {
+	_, err := store.SSLSettings().Settings()
+	if store.IsErrObjectNotFound(err) {
+		defaultSSLSettings := &portainer.SSLSettings{
+			HTTPEnabled: true,
+		}
+
+		return store.SSLSettings().UpdateSettings(defaultSSLSettings)
+	}
+
+	return err
+}
+
+func (store *Store) checkOrCreateDefaultData() error {
+	groups, err := store.EndpointGroupService.ReadAll()
+	if err != nil {
+		return err
+	}
+
+	if len(groups) == 0 {
+		unassignedGroup := &portainer.EndpointGroup{
+			Name:               "Unassigned",
+			Description:        "Unassigned environments",
+			Labels:             []portainer.Pair{},
+			UserAccessPolicies: portainer.UserAccessPolicies{},
+			TeamAccessPolicies: portainer.TeamAccessPolicies{},
+			TagIDs:             []portainer.TagID{},
+		}
+
+		err = store.EndpointGroupService.Create(unassignedGroup)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
diff --git a/api/datastore/migrate_data.go b/api/datastore/migrate_data.go
new file mode 100644
index 0000000..4a2e9de
--- /dev/null
+++ b/api/datastore/migrate_data.go
@@ -0,0 +1,151 @@
+package datastore
+
+import (
+	"fmt"
+	"os"
+	"runtime/debug"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/cli"
+	"github.com/portainer/portainer/api/database/models"
+	dserrors "github.com/portainer/portainer/api/dataservices/errors"
+	"github.com/portainer/portainer/api/datastore/migrator"
+	"github.com/portainer/portainer/api/internal/authorization"
+
+	"github.com/pkg/errors"
+	"github.com/rs/zerolog/log"
+)
+
+func (store *Store) MigrateData() error {
+	updating, err := store.VersionService.IsUpdating()
+	if err != nil {
+		return errors.Wrap(err, "while checking if the store is updating")
+	}
+
+	if updating {
+		return dserrors.ErrDatabaseIsUpdating
+	}
+
+	// migrate new version bucket if required (doesn't write anything to db yet)
+	version, err := store.getOrMigrateLegacyVersion()
+	if err != nil {
+		return errors.Wrap(err, "while migrating legacy version")
+	}
+
+	migratorParams := store.newMigratorParameters(version, store.flags)
+	migrator := migrator.NewMigrator(migratorParams)
+
+	if !migrator.NeedsMigration() {
+		return nil
+	}
+
+	// before we alter anything in the DB, create a backup
+	if _, err := store.Backup(""); err != nil {
+		return errors.Wrap(err, "while backing up database")
+	}
+
+	if err := store.FailSafeMigrate(migrator, version); err != nil {
+		err = errors.Wrap(err, "failed to migrate database")
+
+		log.Warn().Err(err).Msg("migration failed, restoring database to previous version")
+		restoreErr := store.Restore()
+		if restoreErr != nil {
+			return errors.Wrap(restoreErr, "failed to restore database")
+		}
+
+		log.Info().Msg("database restored to previous version")
+		return err
+	}
+
+	return nil
+}
+
+func (store *Store) newMigratorParameters(version *models.Version, flags *portainer.CLIFlags) *migrator.MigratorParameters {
+	return &migrator.MigratorParameters{
+		Flags:                   flags,
+		CurrentDBVersion:        version,
+		EndpointGroupService:    store.EndpointGroupService,
+		EndpointService:         store.EndpointService,
+		EndpointRelationService: store.EndpointRelationService,
+		ExtensionService:        store.ExtensionService,
+		RegistryService:         store.RegistryService,
+		ResourceControlService:  store.ResourceControlService,
+		RoleService:             store.RoleService,
+		ScheduleService:         store.ScheduleService,
+		SettingsService:         store.SettingsService,
+		SnapshotService:         store.SnapshotService,
+		StackService:            store.StackService,
+		TagService:              store.TagService,
+		TeamMembershipService:   store.TeamMembershipService,
+		UserService:             store.UserService,
+		VersionService:          store.VersionService,
+		FileService:             store.fileService,
+		DockerhubService:        store.DockerHubService,
+		AuthorizationService:    authorization.NewService(store),
+		EdgeStackService:        store.EdgeStackService,
+		EdgeStackStatusService:  store.EdgeStackStatusService,
+		EdgeJobService:          store.EdgeJobService,
+		EdgeGroupService:        store.EdgeGroupService,
+		TunnelServerService:     store.TunnelServerService,
+		PendingActionsService:   store.PendingActionsService,
+		CustomTemplateService:   store.CustomTemplateService,
+		SourceService:           store.SourceService,
+		WorkflowService:         store.WorkflowService,
+	}
+}
+
+// FailSafeMigrate backup and restore DB if migration fail
+func (store *Store) FailSafeMigrate(migrator *migrator.Migrator, version *models.Version) (err error) {
+	defer func() {
+		if e := recover(); e != nil {
+			// return error with cause and stacktrace (recover() doesn't include a stacktrace)
+			err = fmt.Errorf("%v %s", e, string(debug.Stack()))
+		}
+	}()
+
+	err = store.VersionService.StoreIsUpdating(true)
+	if err != nil {
+		return errors.Wrap(err, "while updating the store")
+	}
+
+	// now update the version to the new struct (if required)
+	err = store.finishMigrateLegacyVersion(version)
+	if err != nil {
+		return errors.Wrap(err, "while updating version")
+	}
+
+	log.Info().Msg("migrating database from version " + version.SchemaVersion + " to " + portainer.APIVersion)
+
+	err = migrator.Migrate()
+	if err != nil {
+		return err
+	}
+
+	// Special test code to simulate a failure (used by migrate_data_test.go).  Do not remove...
+	if os.Getenv("PORTAINER_TEST_MIGRATE_FAIL") == "FAIL" {
+		panic("test migration failure")
+	}
+
+	err = store.VersionService.StoreIsUpdating(false)
+	if err != nil {
+		return errors.Wrap(err, "failed to update the store")
+	}
+
+	return nil
+}
+
+// Rollback to a pre-upgrade backup copy/snapshot of portainer.db
+func (store *Store) connectionRollback(force bool) error {
+	if !force {
+		confirmed, err := cli.Confirm("Are you sure you want to rollback your database to the previous backup?")
+		if err != nil || !confirmed {
+			return err
+		}
+	}
+
+	if err := store.Restore(); err != nil {
+		return err
+	}
+
+	return store.connection.Close()
+}
diff --git a/api/datastore/migrate_data_test.go b/api/datastore/migrate_data_test.go
new file mode 100644
index 0000000..0b52fee
--- /dev/null
+++ b/api/datastore/migrate_data_test.go
@@ -0,0 +1,542 @@
+package datastore
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/database/boltdb"
+	"github.com/portainer/portainer/api/database/models"
+	"github.com/portainer/portainer/api/datastore/migrator"
+	"github.com/portainer/portainer/api/filesystem"
+
+	"github.com/Masterminds/semver/v3"
+	"github.com/google/go-cmp/cmp"
+	"github.com/rs/zerolog/log"
+	"github.com/stretchr/testify/require"
+)
+
+func TestMigrateData(t *testing.T) {
+	tests := []struct {
+		testName           string
+		srcPath            string
+		wantPath           string
+		overrideInstanceId bool
+	}{
+		{
+			testName:           "migrate version 24 to latest",
+			srcPath:            "test_data/input_24.json",
+			wantPath:           "test_data/output_24_to_latest.json",
+			overrideInstanceId: true,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.testName, func(t *testing.T) {
+			err := migrateDBTestHelper(t, test.srcPath, test.wantPath, test.overrideInstanceId)
+			if err != nil {
+				t.Errorf(
+					"Failed migrating mock database %v: %v",
+					test.srcPath,
+					err,
+				)
+			}
+		})
+	}
+
+	t.Run("MigrateData for New Store & Re-Open Check", func(t *testing.T) {
+		newStore, store := MustNewTestStore(t, true, false)
+		if !newStore {
+			t.Error("Expect a new DB")
+		}
+
+		testVersion(store, portainer.APIVersion, t)
+		err := store.Close()
+		require.NoError(t, err)
+
+		newStore, err = store.Open()
+		require.NoError(t, err)
+		if newStore {
+			t.Error("Expect store to NOT be new DB")
+		}
+	})
+
+	t.Run("MigrateData should create backup file upon update", func(t *testing.T) {
+		_, store := MustNewTestStore(t, true, false)
+		err := store.VersionService.UpdateVersion(&models.Version{SchemaVersion: "2.0", Edition: int(portainer.PortainerCE)})
+		require.NoError(t, err)
+
+		err = store.MigrateData()
+		require.NoError(t, err)
+
+		backupfilename := store.backupFilename()
+		if exists, _ := store.fileService.FileExists(backupfilename); !exists {
+			t.Errorf("Expect backup file to be created %s", backupfilename)
+		}
+	})
+
+	t.Run("MigrateData should recover and restore backup during migration critical failure", func(t *testing.T) {
+		t.Setenv("PORTAINER_TEST_MIGRATE_FAIL", "FAIL")
+
+		version := "2.15"
+		_, store := MustNewTestStore(t, true, false)
+
+		err := store.VersionService.UpdateVersion(&models.Version{SchemaVersion: version, Edition: int(portainer.PortainerCE)})
+		require.NoError(t, err)
+
+		err = store.MigrateData()
+		require.Error(t, err)
+
+		testVersion(store, version, t)
+	})
+
+	t.Run("MigrateData should fail to create backup if database file is set to updating", func(t *testing.T) {
+		_, store := MustNewTestStore(t, true, false)
+
+		err := store.VersionService.StoreIsUpdating(true)
+		require.NoError(t, err)
+
+		err = store.MigrateData()
+		require.Error(t, err)
+
+		// If you get an error, it usually means that the backup folder doesn't exist (no backups). Expected!
+		// If the backup file is not blank, then it means a backup was created.  We don't want that because we
+		// only create a backup when the version changes.
+		backupfilename := store.backupFilename()
+		if exists, _ := store.fileService.FileExists(backupfilename); exists {
+			t.Errorf("Backup file should not exist for dirty database")
+		}
+	})
+
+	t.Run("MigrateData should not create backup on startup if portainer version matches db", func(t *testing.T) {
+		_, store := MustNewTestStore(t, true, false)
+
+		// Set migrator the count to match our migrations array (simulate no changes).
+		// Should not create a backup
+		v, err := store.VersionService.Version()
+		if err != nil {
+			t.Errorf("Unable to read version from db: %s", err)
+			t.FailNow()
+		}
+
+		migratorParams := store.newMigratorParameters(v, store.flags)
+		m := migrator.NewMigrator(migratorParams)
+		latestMigrations := m.LatestMigrations()
+
+		if latestMigrations.Version.Equal(semver.MustParse(portainer.APIVersion)) {
+			v.MigratorCount = len(latestMigrations.MigrationFuncs)
+			err = store.VersionService.UpdateVersion(v)
+			require.NoError(t, err)
+		}
+
+		err = store.MigrateData()
+		require.NoError(t, err)
+
+		// If you get an error, it usually means that the backup folder doesn't exist (no backups). Expected!
+		// If the backup file is not blank, then it means a backup was created.  We don't want that because we
+		// only create a backup when the version changes.
+		backupfilename := store.backupFilename()
+		if exists, _ := store.fileService.FileExists(backupfilename); exists {
+			t.Errorf("Backup file should not exist for dirty database")
+		}
+	})
+
+	t.Run("MigrateData should create backup on startup if portainer version matches db and migrationFuncs counts differ", func(t *testing.T) {
+		_, store := MustNewTestStore(t, true, false)
+
+		// Set migrator count very large to simulate changes
+		// Should not create a backup
+		v, err := store.VersionService.Version()
+		if err != nil {
+			t.Errorf("Unable to read version from db: %s", err)
+			t.FailNow()
+		}
+
+		v.MigratorCount = 1000
+
+		err = store.VersionService.UpdateVersion(v)
+		require.NoError(t, err)
+
+		err = store.MigrateData()
+		require.NoError(t, err)
+
+		// If you get an error, it usually means that the backup folder doesn't exist (no backups). Expected!
+		// If the backup file is not blank, then it means a backup was created.  We don't want that because we
+		// only create a backup when the version changes.
+		backupfilename := store.backupFilename()
+		if exists, _ := store.fileService.FileExists(backupfilename); !exists {
+			t.Errorf("DB backup should exist and there should be no error")
+		}
+	})
+}
+
+func TestRollback(t *testing.T) {
+	t.Parallel()
+	t.Run("Rollback should restore upgrade after backup", func(t *testing.T) {
+		version := "2.11"
+
+		v := models.Version{SchemaVersion: version}
+
+		_, store := MustNewTestStore(t, false, false)
+
+		err := store.VersionService.UpdateVersion(&v)
+		require.NoError(t, err)
+
+		_, err = store.Backup("")
+		if err != nil {
+			log.Fatal().Err(err).Msg("")
+		}
+
+		v.SchemaVersion = "2.14"
+		// Change the current edition
+		err = store.VersionService.UpdateVersion(&v)
+		if err != nil {
+			log.Fatal().Err(err).Msg("")
+		}
+
+		err = store.Rollback(true)
+		if err != nil {
+			t.Logf("Rollback failed: %s", err)
+			t.Fail()
+			return
+		}
+
+		_, err = store.Open()
+		require.NoError(t, err)
+
+		testVersion(store, version, t)
+	})
+
+	t.Run("Rollback should restore upgrade after backup", func(t *testing.T) {
+		version := "2.15"
+
+		v := models.Version{
+			SchemaVersion: version,
+			Edition:       int(portainer.PortainerCE),
+		}
+
+		_, store := MustNewTestStore(t, true, false)
+
+		err := store.VersionService.UpdateVersion(&v)
+		require.NoError(t, err)
+
+		_, err = store.Backup("")
+		if err != nil {
+			log.Fatal().Err(err).Msg("")
+		}
+
+		v.SchemaVersion = "2.14"
+		// Change the current edition
+		err = store.VersionService.UpdateVersion(&v)
+		if err != nil {
+			log.Fatal().Err(err).Msg("")
+		}
+
+		err = store.Rollback(true)
+		if err != nil {
+			t.Logf("Rollback failed: %s", err)
+			t.Fail()
+			return
+		}
+
+		_, err = store.Open()
+		require.NoError(t, err)
+		testVersion(store, version, t)
+	})
+}
+
+// migrateDBTestHelper loads a json representation of a bolt database from srcPath,
+// parses it into a database, runs a migration on that database, and then
+// compares it with an expected output database.
+func migrateDBTestHelper(t *testing.T, srcPath, wantPath string, overrideInstanceId bool) error {
+	srcJSON, err := os.ReadFile(srcPath)
+	if err != nil {
+		t.Fatalf("failed loading source JSON file %v: %v", srcPath, err)
+	}
+
+	// Parse source json to db.
+	// When we create a new test store, it sets its version field automatically to latest.
+	_, store := MustNewTestStore(t, true, false)
+
+	fmt.Println("store.path=", store.GetConnection().GetDatabaseFilePath())
+
+	err = store.connection.DeleteObject("version", []byte("VERSION"))
+	require.NoError(t, err)
+
+	//	defer teardown()
+	if err := importJSON(t, bytes.NewReader(srcJSON), store); err != nil {
+		return err
+	}
+
+	// Run the actual migrations on our input database.
+	if err := store.MigrateData(); err != nil {
+		return err
+	}
+
+	if overrideInstanceId {
+		// old versions of portainer did not have instance-id.  Because this gets generated
+		// we need to override the expected output to match the expected value to pass the test
+		v, err := store.VersionService.Version()
+		if err != nil {
+			return err
+		}
+
+		v.InstanceID = "463d5c47-0ea5-4aca-85b1-405ceefee254"
+		if err := store.VersionService.UpdateVersion(v); err != nil {
+			return err
+		}
+	}
+
+	// Assert that our database connection is using bolt so we can call
+	// exportJson rather than ExportRaw. The exportJson function allows us to
+	// strip out the metadata which we don't want for our tests.
+	// TODO: update connection interface in CE to allow us to use ExportRaw and pass meta false
+	if err := store.connection.Close(); err != nil {
+		t.Fatalf("err closing bolt connection: %v", err)
+	}
+
+	con, ok := store.connection.(*boltdb.DbConnection)
+	if !ok {
+		t.Fatalf("backing database is not using boltdb, but the migrations test requires it")
+	}
+
+	// Convert database back to json.
+	databasePath := con.GetDatabaseFilePath()
+	if _, err := os.Stat(databasePath); err != nil {
+		return fmt.Errorf("stat on %s failed: %w", databasePath, err)
+	}
+
+	gotJSON, err := con.ExportJSON(databasePath, false)
+	if err != nil {
+		t.Logf(
+			"failed re-exporting database %s to JSON: %v",
+			databasePath,
+			err,
+		)
+	}
+
+	wantJSON, err := os.ReadFile(wantPath)
+	if err != nil {
+		t.Fatalf("failed loading want JSON file %v: %v", wantPath, err)
+	}
+
+	// Compare the result we got with the one we wanted.
+	if diff := cmp.Diff(wantJSON, gotJSON); diff != "" {
+		gotPath := filesystem.JoinPaths(os.TempDir(), "portainer-migrator-test-fail.json")
+		err = os.WriteFile(
+			gotPath,
+			gotJSON,
+			0o600,
+		)
+		if err != nil {
+			log.Warn().Err(err).Msg("failed writing migrated output to temp file")
+		}
+
+		t.Errorf(
+			"migrate data from %s to %s failed\nwrote migrated input to %s\nmismatch (-want +got):\n%s",
+			srcPath,
+			wantPath,
+			gotPath,
+			diff,
+		)
+	}
+	return nil
+}
+
+// importJSON reads input JSON and commits it to a portainer datastore.Store.
+// Errors are logged with the testing package.
+func importJSON(t *testing.T, r io.Reader, store *Store) error {
+	objects := make(map[string]any)
+
+	// Parse json into map of objects.
+	d := json.NewDecoder(r)
+	d.UseNumber()
+	err := d.Decode(&objects)
+	if err != nil {
+		return err
+	}
+
+	// Get database connection from store.
+	con := store.connection
+
+	for k, v := range objects {
+		switch k {
+		case "version":
+			versions, ok := v.(map[string]any)
+			if !ok {
+				t.Logf("failed casting %s to map[string]any", k)
+			}
+
+			// New format db
+			version, ok := versions["VERSION"]
+			if ok {
+				err := con.CreateObjectWithStringId(
+					k,
+					[]byte("VERSION"),
+					version,
+				)
+				if err != nil {
+					t.Logf("failed writing VERSION in %s: %v", k, err)
+				}
+			}
+
+			// old format db
+
+			dbVersion, ok := versions["DB_VERSION"]
+			if ok {
+				numDBVersion, ok := dbVersion.(json.Number)
+				if !ok {
+					t.Logf("failed parsing DB_VERSION as json number from %s", k)
+				}
+
+				intDBVersion, err := numDBVersion.Int64()
+				if err != nil {
+					t.Logf("failed casting %v to int: %v", numDBVersion, intDBVersion)
+				}
+
+				err = con.CreateObjectWithStringId(
+					k,
+					[]byte("DB_VERSION"),
+					int(intDBVersion),
+				)
+				if err != nil {
+					t.Logf("failed writing DB_VERSION in %s: %v", k, err)
+				}
+			}
+
+			instanceID, ok := versions["INSTANCE_ID"]
+			if ok {
+				err = con.CreateObjectWithStringId(
+					k,
+					[]byte("INSTANCE_ID"),
+					instanceID,
+				)
+				if err != nil {
+					t.Logf("failed writing INSTANCE_ID in %s: %v", k, err)
+				}
+			}
+
+			edition, ok := versions["EDITION"]
+			if ok {
+				err = con.CreateObjectWithStringId(
+					k,
+					[]byte("EDITION"),
+					edition,
+				)
+				if err != nil {
+					t.Logf("failed writing EDITION in %s: %v", k, err)
+				}
+			}
+
+		case "dockerhub":
+			obj, ok := v.([]any)
+			if !ok {
+				t.Logf("failed to cast %s to []any", k)
+			}
+			err := con.CreateObjectWithStringId(
+				k,
+				[]byte("DOCKERHUB"),
+				obj[0],
+			)
+			if err != nil {
+				t.Logf("failed writing DOCKERHUB in %s: %v", k, err)
+			}
+
+		case "ssl":
+			obj, ok := v.(map[string]any)
+			if !ok {
+				t.Logf("failed to case %s to map[string]any", k)
+			}
+			err := con.CreateObjectWithStringId(
+				k,
+				[]byte("SSL"),
+				obj,
+			)
+			if err != nil {
+				t.Logf("failed writing SSL in %s: %v", k, err)
+			}
+
+		case "settings":
+			obj, ok := v.(map[string]any)
+			if !ok {
+				t.Logf("failed to case %s to map[string]any", k)
+			}
+			err := con.CreateObjectWithStringId(
+				k,
+				[]byte("SETTINGS"),
+				obj,
+			)
+			if err != nil {
+				t.Logf("failed writing SETTINGS in %s: %v", k, err)
+			}
+
+		case "tunnel_server":
+			obj, ok := v.(map[string]any)
+			if !ok {
+				t.Logf("failed to case %s to map[string]any", k)
+			}
+			err := con.CreateObjectWithStringId(
+				k,
+				[]byte("INFO"),
+				obj,
+			)
+			if err != nil {
+				t.Logf("failed writing INFO in %s: %v", k, err)
+			}
+		case "templates":
+			continue
+
+		default:
+			objlist, ok := v.([]any)
+			if !ok {
+				t.Logf("failed to cast %s to []any", k)
+			}
+
+			for _, obj := range objlist {
+				value, ok := obj.(map[string]any)
+				if !ok {
+					t.Logf("failed to cast %v to map[string]any", obj)
+				} else {
+					var ok bool
+					var id any
+					switch k {
+					case "endpoint_relations":
+						// TODO: need to make into an int, then do that weird
+						// stringification
+						id, ok = value["EndpointID"]
+					default:
+						id, ok = value["Id"]
+					}
+					if !ok {
+						// endpoint_relations: EndpointID
+						t.Logf("missing Id field: %s", k)
+						id = "error"
+					}
+					n, ok := id.(json.Number)
+					if !ok {
+						t.Logf("failed to cast %v to json.Number in %s", id, k)
+					} else {
+						key, err := n.Int64()
+						if err != nil {
+							t.Logf("failed to cast %v to int in %s", n, k)
+						} else {
+							err := con.CreateObjectWithId(
+								k,
+								int(key),
+								value,
+							)
+							if err != nil {
+								t.Logf("failed writing %v in %s: %v", key, k, err)
+							}
+						}
+					}
+				}
+			}
+		}
+	}
+
+	return nil
+}
diff --git a/api/datastore/migrate_dbversion29_test.go b/api/datastore/migrate_dbversion29_test.go
new file mode 100644
index 0000000..04c8167
--- /dev/null
+++ b/api/datastore/migrate_dbversion29_test.go
@@ -0,0 +1,91 @@
+package datastore
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore/migrator"
+	"github.com/portainer/portainer/api/internal/authorization"
+)
+
+const dummyLogoURL = "example.com"
+
+// initTestingDBConn creates a settings service with raw database DB connection
+// for unit testing usage only since using NewStore will cause cycle import inside migrator pkg
+func initTestingSettingsService(dbConn portainer.Connection, preSetObj map[string]any) error {
+	//insert a obj
+	return dbConn.UpdateObject("settings", []byte("SETTINGS"), preSetObj)
+}
+
+func setup(store *Store) error {
+	dummySettingsObj := map[string]any{
+		"LogoURL": dummyLogoURL,
+	}
+
+	return initTestingSettingsService(store.connection, dummySettingsObj)
+}
+
+func TestMigrateSettings(t *testing.T) {
+	t.Parallel()
+	_, store := MustNewTestStore(t, false, true)
+
+	err := setup(store)
+	if err != nil {
+		t.Errorf("failed to complete testing setups, err: %v", err)
+	}
+
+	updatedSettings, err := store.SettingsService.Settings()
+	// SO -basically, this test _isn't_ testing migration, its testing golang type defaults.
+	if updatedSettings.LogoURL != dummyLogoURL { // ensure a pre-migrate setting isn't unset
+		t.Errorf("unexpected value changes in the updated settings, want LogoURL value: %s, got LogoURL value: %s", dummyLogoURL, updatedSettings.LogoURL)
+	}
+
+	if updatedSettings.OAuthSettings.SSO != false { // I recon golang defaulting will make this false
+		t.Errorf("unexpected default OAuth SSO setting, want: false, got: %t", updatedSettings.OAuthSettings.SSO)
+	}
+
+	if updatedSettings.OAuthSettings.LogoutURI != "" {
+		t.Errorf("unexpected default OAuth HideInternalAuth setting, want:, got: %s", updatedSettings.OAuthSettings.LogoutURI)
+	}
+
+	m := migrator.NewMigrator(&migrator.MigratorParameters{
+		Flags:                   store.flags,
+		EndpointGroupService:    store.EndpointGroupService,
+		EndpointService:         store.EndpointService,
+		EndpointRelationService: store.EndpointRelationService,
+		ExtensionService:        store.ExtensionService,
+		RegistryService:         store.RegistryService,
+		ResourceControlService:  store.ResourceControlService,
+		RoleService:             store.RoleService,
+		ScheduleService:         store.ScheduleService,
+		SettingsService:         store.SettingsService,
+		StackService:            store.StackService,
+		TagService:              store.TagService,
+		TeamMembershipService:   store.TeamMembershipService,
+		UserService:             store.UserService,
+		VersionService:          store.VersionService,
+		FileService:             store.fileService,
+		DockerhubService:        store.DockerHubService,
+		AuthorizationService:    authorization.NewService(store),
+	})
+
+	if err := m.MigrateSettingsToDB30(); err != nil {
+		t.Errorf("failed to update settings: %v", err)
+	}
+
+	if err != nil {
+		t.Errorf("failed to retrieve the updated settings: %v", err)
+	}
+
+	if updatedSettings.LogoURL != dummyLogoURL {
+		t.Errorf("unexpected value changes in the updated settings, want LogoURL value: %s, got LogoURL value: %s", dummyLogoURL, updatedSettings.LogoURL)
+	}
+
+	if updatedSettings.OAuthSettings.SSO != false {
+		t.Errorf("unexpected default OAuth SSO setting, want: false, got: %t", updatedSettings.OAuthSettings.SSO)
+	}
+
+	if updatedSettings.OAuthSettings.LogoutURI != "" {
+		t.Errorf("unexpected default OAuth HideInternalAuth setting, want:, got: %s", updatedSettings.OAuthSettings.LogoutURI)
+	}
+}
diff --git a/api/datastore/migrate_dbversion33_test.go b/api/datastore/migrate_dbversion33_test.go
new file mode 100644
index 0000000..633094a
--- /dev/null
+++ b/api/datastore/migrate_dbversion33_test.go
@@ -0,0 +1,55 @@
+package datastore
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore/migrator"
+	gittypes "github.com/portainer/portainer/api/git/types"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestMigrateStackEntryPoint(t *testing.T) {
+	t.Parallel()
+	_, store := MustNewTestStore(t, false, true)
+
+	stackService := store.Stack()
+
+	stacks := []*portainer.Stack{
+		{
+			ID:         1,
+			EntryPoint: "dir/sub/compose.yml",
+		},
+		{
+			ID:         2,
+			EntryPoint: "dir/sub/compose.yml",
+			GitConfig:  &gittypes.RepoConfig{},
+		},
+	}
+
+	for _, s := range stacks {
+		err := stackService.Create(s)
+		require.NoError(t, err, "failed to create stack")
+	}
+
+	s, err := stackService.Read(1)
+	require.NoError(t, err)
+	assert.Nil(t, s.GitConfig, "first stack should not have git config")
+
+	s, err = stackService.Read(2)
+	require.NoError(t, err)
+	assert.Empty(t, s.GitConfig.ConfigFilePath, "not migrated yet migrated")
+
+	err = migrator.MigrateStackEntryPoint(stackService)
+	require.NoError(t, err, "failed to migrate entry point to Git ConfigFilePath")
+
+	s, err = stackService.Read(1)
+	require.NoError(t, err)
+	assert.Nil(t, s.GitConfig, "first stack should not have git config")
+
+	s, err = stackService.Read(2)
+	require.NoError(t, err)
+	assert.Equal(t, "dir/sub/compose.yml", s.GitConfig.ConfigFilePath, "second stack should have config file path migrated")
+}
diff --git a/api/datastore/migrate_legacyversion.go b/api/datastore/migrate_legacyversion.go
new file mode 100644
index 0000000..4b7eee0
--- /dev/null
+++ b/api/datastore/migrate_legacyversion.go
@@ -0,0 +1,122 @@
+package datastore
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/database/models"
+	"github.com/portainer/portainer/api/dataservices"
+)
+
+const (
+	bucketName         = "version"
+	legacyDBVersionKey = "DB_VERSION"
+	legacyInstanceKey  = "INSTANCE_ID"
+	legacyEditionKey   = "EDITION"
+)
+
+var dbVerToSemVerMap = map[int]string{
+	18: "1.21",
+	19: "1.22",
+	20: "1.22.1",
+	21: "1.22.2",
+	22: "1.23",
+	23: "1.24",
+	24: "1.24.1",
+	25: "2.0",
+	26: "2.1",
+	27: "2.2",
+	28: "2.4",
+	29: "2.4",
+	30: "2.6",
+	31: "2.7",
+	32: "2.9",
+	33: "2.9.1",
+	34: "2.10",
+	35: "2.9.3",
+	36: "2.11",
+	40: "2.13",
+	50: "2.14",
+	51: "2.14.1",
+	52: "2.14.2",
+	60: "2.15",
+	61: "2.15.1",
+	70: "2.16",
+	80: "2.17",
+}
+
+func dbVersionToSemanticVersion(dbVersion int) string {
+	if dbVersion < 18 {
+		return "1.0.0"
+	}
+
+	ver, ok := dbVerToSemVerMap[dbVersion]
+	if ok {
+		return ver
+	}
+
+	// We should always return something sensible
+	switch {
+	case dbVersion < 40:
+		return "2.11"
+	case dbVersion < 50:
+		return "2.13"
+	case dbVersion < 60:
+		return "2.14.2"
+	case dbVersion < 70:
+		return "2.15.1"
+	}
+
+	return "2.16.0"
+}
+
+// getOrMigrateLegacyVersion to new Version struct
+func (store *Store) getOrMigrateLegacyVersion() (*models.Version, error) {
+	// Very old versions of portainer did not have a version bucket, lets set some defaults
+	dbVersion := 24
+	edition := int(portainer.PortainerCE)
+	instanceId := ""
+
+	// If we already have a version key, we don't need to migrate
+	v, err := store.VersionService.Version()
+	if err == nil || !dataservices.IsErrObjectNotFound(err) {
+		return v, err
+	}
+
+	err = store.connection.GetObject(bucketName, []byte(legacyDBVersionKey), &dbVersion)
+	if err != nil && !dataservices.IsErrObjectNotFound(err) {
+		return nil, err
+	}
+
+	err = store.connection.GetObject(bucketName, []byte(legacyEditionKey), &edition)
+	if err != nil && !dataservices.IsErrObjectNotFound(err) {
+		return nil, err
+	}
+
+	err = store.connection.GetObject(bucketName, []byte(legacyInstanceKey), &instanceId)
+	if err != nil && !dataservices.IsErrObjectNotFound(err) {
+		return nil, err
+	}
+
+	return &models.Version{
+		SchemaVersion: dbVersionToSemanticVersion(dbVersion),
+		Edition:       edition,
+		InstanceID:    instanceId,
+	}, nil
+}
+
+// finishMigrateLegacyVersion writes the new version to the DB and removes the old version keys from the DB
+func (store *Store) finishMigrateLegacyVersion(versionToWrite *models.Version) error {
+	if err := store.VersionService.UpdateVersion(versionToWrite); err != nil {
+		return err
+	}
+
+	// Remove legacy keys if present
+	if err := store.connection.DeleteObject(bucketName, []byte(legacyDBVersionKey)); err != nil {
+		return err
+	}
+
+	if err := store.connection.DeleteObject(bucketName, []byte(legacyEditionKey)); err != nil {
+		return err
+	}
+
+	return store.connection.DeleteObject(bucketName, []byte(legacyInstanceKey))
+}
diff --git a/api/datastore/migrator/migrate_2_31_0.go b/api/datastore/migrator/migrate_2_31_0.go
new file mode 100644
index 0000000..7afea98
--- /dev/null
+++ b/api/datastore/migrator/migrate_2_31_0.go
@@ -0,0 +1,31 @@
+package migrator
+
+import portainer "github.com/portainer/portainer/api"
+
+func (m *Migrator) migrateEdgeStacksStatuses_2_31_0() error {
+	edgeStacks, err := m.edgeStackService.EdgeStacks()
+	if err != nil {
+		return err
+	}
+
+	for _, edgeStack := range edgeStacks {
+		for envID, status := range edgeStack.Status {
+			if err := m.edgeStackStatusService.Create(edgeStack.ID, envID, &portainer.EdgeStackStatusForEnv{
+				EndpointID:       envID,
+				Status:           status.Status,
+				DeploymentInfo:   status.DeploymentInfo,
+				ReadyRePullImage: status.ReadyRePullImage,
+			}); err != nil {
+				return err
+			}
+		}
+
+		edgeStack.Status = nil
+
+		if err := m.edgeStackService.UpdateEdgeStack(edgeStack.ID, &edgeStack); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
diff --git a/api/datastore/migrator/migrate_2_32_0.go b/api/datastore/migrator/migrate_2_32_0.go
new file mode 100644
index 0000000..c32a63c
--- /dev/null
+++ b/api/datastore/migrator/migrate_2_32_0.go
@@ -0,0 +1,33 @@
+package migrator
+
+import (
+	"github.com/pkg/errors"
+	portainer "github.com/portainer/portainer/api"
+	perrors "github.com/portainer/portainer/api/dataservices/errors"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+)
+
+func (m *Migrator) addEndpointRelationForEdgeAgents_2_32_0() error {
+	endpoints, err := m.endpointService.Endpoints()
+	if err != nil {
+		return err
+	}
+
+	for _, endpoint := range endpoints {
+		if endpointutils.IsEdgeEndpoint(&endpoint) {
+			_, err := m.endpointRelationService.EndpointRelation(endpoint.ID)
+			if err != nil && errors.Is(err, perrors.ErrObjectNotFound) {
+				relation := &portainer.EndpointRelation{
+					EndpointID: endpoint.ID,
+					EdgeStacks: make(map[portainer.EdgeStackID]bool),
+				}
+
+				if err := m.endpointRelationService.Create(relation); err != nil {
+					return err
+				}
+			}
+		}
+	}
+
+	return nil
+}
diff --git a/api/datastore/migrator/migrate_2_33_0.go b/api/datastore/migrator/migrate_2_33_0.go
new file mode 100644
index 0000000..83a822c
--- /dev/null
+++ b/api/datastore/migrator/migrate_2_33_0.go
@@ -0,0 +1,25 @@
+package migrator
+
+import (
+	"github.com/portainer/portainer/api/roar"
+)
+
+func (m *Migrator) migrateEdgeGroupEndpointsToRoars_2_33_0() error {
+	egs, err := m.edgeGroupService.ReadAll()
+	if err != nil {
+		return err
+	}
+
+	for _, eg := range egs {
+		if eg.EndpointIDs.Len() == 0 {
+			eg.EndpointIDs = roar.FromSlice(eg.Endpoints)
+			eg.Endpoints = nil
+		}
+
+		if err := m.edgeGroupService.Update(eg.ID, &eg); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
diff --git a/api/datastore/migrator/migrate_2_33_test.go b/api/datastore/migrator/migrate_2_33_test.go
new file mode 100644
index 0000000..f0e3443
--- /dev/null
+++ b/api/datastore/migrator/migrate_2_33_test.go
@@ -0,0 +1,57 @@
+package migrator
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/database/boltdb"
+	"github.com/portainer/portainer/api/dataservices/edgegroup"
+	"github.com/portainer/portainer/api/logs"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestMigrateEdgeGroupEndpointsToRoars_2_33_0Idempotency(t *testing.T) {
+	t.Parallel()
+	var conn portainer.Connection = &boltdb.DbConnection{Path: t.TempDir()}
+	err := conn.Open()
+	require.NoError(t, err)
+
+	defer logs.CloseAndLogErr(conn)
+
+	edgeGroupService, err := edgegroup.NewService(conn)
+	require.NoError(t, err)
+
+	edgeGroup := &portainer.EdgeGroup{
+		ID:        1,
+		Name:      "test-edge-group",
+		Endpoints: []portainer.EndpointID{1, 2, 3},
+	}
+
+	err = conn.CreateObjectWithId(edgegroup.BucketName, int(edgeGroup.ID), edgeGroup)
+	require.NoError(t, err)
+
+	m := NewMigrator(&MigratorParameters{EdgeGroupService: edgeGroupService})
+
+	// Run migration once
+
+	err = m.migrateEdgeGroupEndpointsToRoars_2_33_0()
+	require.NoError(t, err)
+
+	migratedEdgeGroup, err := edgeGroupService.Read(edgeGroup.ID)
+	require.NoError(t, err)
+
+	require.Empty(t, migratedEdgeGroup.Endpoints)
+	require.Equal(t, len(edgeGroup.Endpoints), migratedEdgeGroup.EndpointIDs.Len())
+
+	// Run migration again to ensure the results didn't change
+
+	err = m.migrateEdgeGroupEndpointsToRoars_2_33_0()
+	require.NoError(t, err)
+
+	migratedEdgeGroup, err = edgeGroupService.Read(edgeGroup.ID)
+	require.NoError(t, err)
+
+	require.Empty(t, migratedEdgeGroup.Endpoints)
+	require.Equal(t, len(edgeGroup.Endpoints), migratedEdgeGroup.EndpointIDs.Len())
+}
diff --git a/api/datastore/migrator/migrate_2_40_test.go b/api/datastore/migrator/migrate_2_40_test.go
new file mode 100644
index 0000000..39dc925
--- /dev/null
+++ b/api/datastore/migrator/migrate_2_40_test.go
@@ -0,0 +1,206 @@
+package migrator
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/database/boltdb"
+	"github.com/portainer/portainer/api/dataservices/endpoint"
+	"github.com/portainer/portainer/api/dataservices/pendingactions"
+	"github.com/portainer/portainer/api/dataservices/registry"
+	"github.com/portainer/portainer/api/logs"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestMigrateRegistryAccessSASecrets_2_40_0(t *testing.T) {
+	t.Parallel()
+	var conn portainer.Connection = &boltdb.DbConnection{Path: t.TempDir()}
+	err := conn.Open()
+	require.NoError(t, err)
+	defer logs.CloseAndLogErr(conn)
+
+	registryService, err := registry.NewService(conn)
+	require.NoError(t, err)
+
+	endpointService, err := endpoint.NewService(conn)
+	require.NoError(t, err)
+
+	pendingActionsService, err := pendingactions.NewService(conn)
+	require.NoError(t, err)
+
+	t.Run("sets MigrateRegistrySASecrets flag for k8s endpoints with registry access", func(t *testing.T) {
+		k8sEndpoint := &portainer.Endpoint{
+			ID:   1,
+			Name: "k8s-cluster",
+			Type: portainer.AgentOnKubernetesEnvironment,
+		}
+		dockerEndpoint := &portainer.Endpoint{
+			ID:   2,
+			Name: "docker-standalone",
+			Type: portainer.DockerEnvironment,
+		}
+
+		err := conn.CreateObjectWithId(endpoint.BucketName, int(k8sEndpoint.ID), k8sEndpoint)
+		require.NoError(t, err)
+		err = conn.CreateObjectWithId(endpoint.BucketName, int(dockerEndpoint.ID), dockerEndpoint)
+		require.NoError(t, err)
+
+		reg := &portainer.Registry{
+			ID:   1,
+			Name: "test-registry",
+			RegistryAccesses: portainer.RegistryAccesses{
+				k8sEndpoint.ID: portainer.RegistryAccessPolicies{
+					Namespaces: []string{"default", "production"},
+				},
+				dockerEndpoint.ID: portainer.RegistryAccessPolicies{
+					Namespaces: []string{"ignored"},
+				},
+			},
+		}
+
+		err = conn.CreateObjectWithId(registry.BucketName, int(reg.ID), reg)
+		require.NoError(t, err)
+
+		m := NewMigrator(&MigratorParameters{
+			RegistryService:       registryService,
+			EndpointService:       endpointService,
+			PendingActionsService: pendingActionsService,
+		})
+
+		err = m.migrateRegistryAccessSASecrets_2_40_0()
+		require.NoError(t, err)
+
+		updatedK8sEndpoint, err := endpointService.Endpoint(k8sEndpoint.ID)
+		require.NoError(t, err)
+		assert.True(t, updatedK8sEndpoint.PostInitMigrations.MigrateRegistrySASecrets, "should have set MigrateRegistrySASecrets flag for k8s endpoint")
+
+		updatedDockerEndpoint, err := endpointService.Endpoint(dockerEndpoint.ID)
+		require.NoError(t, err)
+		assert.False(t, updatedDockerEndpoint.PostInitMigrations.MigrateRegistrySASecrets, "should not have set MigrateRegistrySASecrets flag for docker endpoint")
+	})
+
+	t.Run("skips endpoints with empty namespaces", func(t *testing.T) {
+		conn2 := &boltdb.DbConnection{Path: t.TempDir()}
+		err := conn2.Open()
+		require.NoError(t, err)
+		defer logs.CloseAndLogErr(conn2)
+
+		registryService2, _ := registry.NewService(conn2)
+		endpointService2, _ := endpoint.NewService(conn2)
+		pendingActionsService2, _ := pendingactions.NewService(conn2)
+
+		k8sEndpoint := &portainer.Endpoint{
+			ID:   10,
+			Name: "k8s-cluster",
+			Type: portainer.AgentOnKubernetesEnvironment,
+		}
+		err = conn2.CreateObjectWithId(endpoint.BucketName, int(k8sEndpoint.ID), k8sEndpoint)
+		require.NoError(t, err)
+
+		reg := &portainer.Registry{
+			ID:   10,
+			Name: "empty-registry",
+			RegistryAccesses: portainer.RegistryAccesses{
+				k8sEndpoint.ID: portainer.RegistryAccessPolicies{
+					Namespaces: []string{},
+				},
+			},
+		}
+		err = conn2.CreateObjectWithId(registry.BucketName, int(reg.ID), reg)
+		require.NoError(t, err)
+
+		m := NewMigrator(&MigratorParameters{
+			RegistryService:       registryService2,
+			EndpointService:       endpointService2,
+			PendingActionsService: pendingActionsService2,
+		})
+
+		err = m.migrateRegistryAccessSASecrets_2_40_0()
+		require.NoError(t, err)
+
+		allPAs, err := pendingActionsService2.ReadAll()
+		require.NoError(t, err)
+		assert.Empty(t, allPAs, "should not create pending actions for empty namespaces")
+	})
+
+	t.Run("skips non-existent endpoints", func(t *testing.T) {
+		conn3 := &boltdb.DbConnection{Path: t.TempDir()}
+		err := conn3.Open()
+		require.NoError(t, err)
+		defer logs.CloseAndLogErr(conn3)
+
+		registryService3, _ := registry.NewService(conn3)
+		endpointService3, _ := endpoint.NewService(conn3)
+		pendingActionsService3, _ := pendingactions.NewService(conn3)
+
+		reg := &portainer.Registry{
+			ID:   20,
+			Name: "orphan-registry",
+			RegistryAccesses: portainer.RegistryAccesses{
+				999: portainer.RegistryAccessPolicies{
+					Namespaces: []string{"default"},
+				},
+			},
+		}
+		err = conn3.CreateObjectWithId(registry.BucketName, int(reg.ID), reg)
+		require.NoError(t, err)
+
+		m := NewMigrator(&MigratorParameters{
+			RegistryService:       registryService3,
+			EndpointService:       endpointService3,
+			PendingActionsService: pendingActionsService3,
+		})
+
+		err = m.migrateRegistryAccessSASecrets_2_40_0()
+		require.NoError(t, err)
+
+		allPAs, err := pendingActionsService3.ReadAll()
+		require.NoError(t, err)
+		assert.Empty(t, allPAs, "should not create pending actions for non-existent endpoints")
+	})
+
+	t.Run("idempotent - running twice creates duplicate actions but doesn't error", func(t *testing.T) {
+		conn4 := &boltdb.DbConnection{Path: t.TempDir()}
+		err := conn4.Open()
+		require.NoError(t, err)
+		defer logs.CloseAndLogErr(conn4)
+
+		registryService4, _ := registry.NewService(conn4)
+		endpointService4, _ := endpoint.NewService(conn4)
+		pendingActionsService4, _ := pendingactions.NewService(conn4)
+
+		k8sEndpoint := &portainer.Endpoint{
+			ID:   30,
+			Name: "k8s-cluster",
+			Type: portainer.AgentOnKubernetesEnvironment,
+		}
+		err = conn4.CreateObjectWithId(endpoint.BucketName, int(k8sEndpoint.ID), k8sEndpoint)
+		require.NoError(t, err)
+
+		reg := &portainer.Registry{
+			ID:   30,
+			Name: "test-registry",
+			RegistryAccesses: portainer.RegistryAccesses{
+				k8sEndpoint.ID: portainer.RegistryAccessPolicies{
+					Namespaces: []string{"default"},
+				},
+			},
+		}
+		err = conn4.CreateObjectWithId(registry.BucketName, int(reg.ID), reg)
+		require.NoError(t, err)
+
+		m := NewMigrator(&MigratorParameters{
+			RegistryService:       registryService4,
+			EndpointService:       endpointService4,
+			PendingActionsService: pendingActionsService4,
+		})
+
+		err = m.migrateRegistryAccessSASecrets_2_40_0()
+		require.NoError(t, err)
+
+		err = m.migrateRegistryAccessSASecrets_2_40_0()
+		require.NoError(t, err)
+	})
+}
diff --git a/api/datastore/migrator/migrate_2_43_0.go b/api/datastore/migrator/migrate_2_43_0.go
new file mode 100644
index 0000000..4365872
--- /dev/null
+++ b/api/datastore/migrator/migrate_2_43_0.go
@@ -0,0 +1,333 @@
+package migrator
+
+import (
+	"fmt"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices/source"
+	"github.com/portainer/portainer/api/dataservices/stack"
+	gittypes "github.com/portainer/portainer/api/git/types"
+
+	"github.com/rs/zerolog/log"
+)
+
+type legacyRepoConfig struct {
+	URL            string
+	ReferenceName  string
+	ConfigFilePath string
+	Authentication *legacyGitAuthentication
+	ConfigHash     string
+	TLSSkipVerify  bool
+}
+
+type legacyGitAuthentication struct {
+	Username          string
+	Password          string
+	Provider          int `json:",omitempty"`
+	AuthorizationType int `json:",omitempty"`
+}
+
+func (lrc *legacyRepoConfig) toRepoConfig() *gittypes.RepoConfig {
+	if lrc == nil {
+		return nil
+	}
+
+	cfg := &gittypes.RepoConfig{
+		URL:            lrc.URL,
+		ReferenceName:  lrc.ReferenceName,
+		ConfigFilePath: lrc.ConfigFilePath,
+		ConfigHash:     lrc.ConfigHash,
+		TLSSkipVerify:  lrc.TLSSkipVerify,
+	}
+
+	if lrc.Authentication != nil {
+		cfg.Authentication = &gittypes.GitAuthentication{
+			Username:          lrc.Authentication.Username,
+			Password:          lrc.Authentication.Password,
+			Provider:          gittypes.GitProvider(lrc.Authentication.Provider),
+			AuthorizationType: gittypes.GitCredentialAuthType(lrc.Authentication.AuthorizationType),
+		}
+	}
+
+	return cfg
+}
+
+type legacyStack struct {
+	ID              int               `json:"Id"`
+	GitConfig       *legacyRepoConfig `json:"GitConfig"`
+	WorkflowID      *int
+	ResourceControl *portainer.ResourceControl `json:"ResourceControl"`
+	CreatedBy       string
+}
+
+// sourceDedupeKey is the identity used to detect duplicate Sources during migration.
+// Two stacks sharing the same URL and credentials must reuse the same Source record.
+type sourceDedupeKey struct {
+	url      string
+	username string
+	password string
+}
+
+func gitSourceKey(cfg *gittypes.RepoConfig) sourceDedupeKey {
+	url, err := gittypes.NormalizeURL(gittypes.SanitizeURL(cfg.URL))
+	if err != nil {
+		log.Warn().Err(err).Str("url", cfg.URL).Msg("failed to normalize git URL for deduplication, using raw URL")
+		url = cfg.URL
+	}
+
+	key := sourceDedupeKey{url: url}
+	if cfg.Authentication != nil {
+		key.username = cfg.Authentication.Username
+		key.password = cfg.Authentication.Password
+	}
+
+	return key
+}
+
+func (m *Migrator) migrateGitConfigToSources_2_43_0() error {
+	log.Info().Msg("migrating git-backed stacks to Source+Workflow records")
+
+	var legacyStacks []legacyStack
+
+	err := m.stackService.Connection.GetAll(
+		stack.BucketName,
+		new(legacyStack),
+		func(obj any) (any, error) {
+			s, ok := obj.(*legacyStack)
+			if !ok {
+				return nil, fmt.Errorf("unexpected type reading stack bucket: %T", obj)
+			}
+
+			legacyStacks = append(legacyStacks, *s)
+
+			return new(legacyStack), nil
+		},
+	)
+	if err != nil {
+		return err
+	}
+
+	adminUserContext := source.InsecureNewAdminContext()
+	existingSources, err := m.sourceService.ReadAll(adminUserContext)
+	if err != nil {
+		return err
+	}
+
+	sourcesByKey := make(map[sourceDedupeKey]portainer.SourceID, len(existingSources))
+	for _, src := range existingSources {
+		if src.Git != nil {
+			sourcesByKey[gitSourceKey(&gittypes.RepoConfig{URL: src.Git.URL, Authentication: src.Git.Authentication})] = src.ID
+		}
+	}
+
+	for _, ls := range legacyStacks {
+		if ls.GitConfig == nil || (ls.WorkflowID != nil && *ls.WorkflowID != 0) {
+			continue
+		}
+
+		cfg := ls.GitConfig.toRepoConfig()
+		cfg.URL = gittypes.SanitizeURL(cfg.URL)
+		key := gitSourceKey(cfg)
+
+		var newSrcID portainer.SourceID
+
+		if err := m.stackService.Connection.UpdateTx(func(tx portainer.Transaction) error {
+			liveStack, err := m.stackService.Tx(tx).Read(portainer.StackID(ls.ID))
+			if err != nil {
+				return fmt.Errorf("failed to read stack %d: %w", ls.ID, err)
+			}
+
+			rc := ls.ResourceControl
+			if rc == nil {
+				rcID := fmt.Sprintf("%d_%s", liveStack.EndpointID, liveStack.Name)
+				rc, err = m.resourceControlService.Tx(tx).ResourceControlByResourceIDAndType(rcID, portainer.StackResourceControl)
+				if err != nil {
+					return fmt.Errorf("failed to read resource control for stack %d: %w", ls.ID, err)
+				}
+			}
+
+			users, teams, public, adminOnly, ownerId := GetValuesForUsersFromResourceOwnershipAndAccesses_2_43_0(rc,
+				func() (portainer.UserID, portainer.UserRole, error) {
+					user, err := m.userService.Tx(tx).UserByUsername(ls.CreatedBy)
+					if err != nil {
+						return 0, 0, err
+					}
+					return user.ID, user.Role, nil
+				},
+				func(userId portainer.UserID) ([]portainer.TeamMembership, error) {
+					return m.teamMembershipService.Tx(tx).TeamMembershipsByUserID(userId)
+				},
+			)
+
+			srcID, exists := sourcesByKey[key]
+
+			if !exists {
+				src := &portainer.Source{
+					Name: gittypes.RepoName(cfg.URL),
+					Type: portainer.SourceTypeGit,
+					Git: &gittypes.GitSource{
+						URL:            cfg.URL,
+						Authentication: cfg.Authentication,
+						TLSSkipVerify:  cfg.TLSSkipVerify,
+					},
+					OwnerID:            ownerId,
+					Public:             public,
+					AdministratorsOnly: adminOnly,
+					UserAccesses:       users,
+					TeamAccesses:       teams,
+				}
+
+				if err := m.sourceService.Tx(tx).Create(adminUserContext, src); err != nil {
+					return fmt.Errorf("failed to create source for stack %d: %w", ls.ID, err)
+				}
+				srcID = src.ID
+				newSrcID = src.ID
+			} else {
+				src, err := m.sourceService.Tx(tx).Read(adminUserContext, srcID)
+				if err != nil {
+					return fmt.Errorf("failed to read source %d for stack %d: %w", srcID, ls.ID, err)
+				}
+
+				ApplyUACOnSourceUpdate_2_43_0(src, users, teams, public, adminOnly, ownerId)
+
+				if err := m.sourceService.Tx(tx).Update(adminUserContext, srcID, src); err != nil {
+					return fmt.Errorf("failed to update source %d for stack %d: %w", srcID, ls.ID, err)
+				}
+			}
+
+			wf := &portainer.Workflow{
+				Name: liveStack.Name,
+				Artifacts: []portainer.Artifact{{
+					StackID: portainer.StackID(ls.ID),
+					Files: []portainer.ArtifactFile{{
+						SourceID: srcID,
+						Path:     cfg.ConfigFilePath,
+						Ref:      cfg.ReferenceName,
+						Hash:     cfg.ConfigHash,
+					}},
+				}},
+			}
+			if err := m.workflowService.Tx(tx).Create(wf); err != nil {
+				return fmt.Errorf("failed to create workflow for stack %d: %w", ls.ID, err)
+			}
+
+			liveStack.WorkflowID = wf.ID
+			liveStack.GitConfig = nil
+
+			return m.stackService.Tx(tx).Update(portainer.StackID(ls.ID), liveStack)
+		}); err != nil {
+			return fmt.Errorf("failed to migrate stack %d: %w", ls.ID, err)
+		}
+
+		if newSrcID != 0 {
+			sourcesByKey[key] = newSrcID
+		}
+	}
+
+	return nil
+}
+
+func (m *Migrator) migrateCustomTemplateGitConfigToSources_2_43_0() error {
+	log.Info().Msg("migrating git-backed custom templates to Source records")
+
+	templates, err := m.customTemplateService.ReadAll()
+	if err != nil {
+		return err
+	}
+
+	adminUserContext := source.InsecureNewAdminContext()
+	existingSources, err := m.sourceService.ReadAll(adminUserContext)
+	if err != nil {
+		return err
+	}
+
+	sourcesByKey := make(map[sourceDedupeKey]portainer.SourceID, len(existingSources))
+	for _, src := range existingSources {
+		if src.Git != nil {
+			sourcesByKey[gitSourceKey(&gittypes.RepoConfig{URL: src.Git.URL, Authentication: src.Git.Authentication})] = src.ID
+		}
+	}
+
+	for i := range templates {
+		t := &templates[i]
+		if t.GitConfig == nil || t.Artifact != nil {
+			continue
+		}
+
+		cfg := &gittypes.GitSource{
+			URL:            gittypes.SanitizeURL(t.GitConfig.URL),
+			Authentication: t.GitConfig.Authentication,
+			TLSSkipVerify:  t.GitConfig.TLSSkipVerify,
+		}
+
+		key := gitSourceKey(&gittypes.RepoConfig{URL: cfg.URL, Authentication: cfg.Authentication})
+
+		var newSrcID portainer.SourceID
+
+		if err := m.stackService.Connection.UpdateTx(func(tx portainer.Transaction) error {
+			users, teams, public, adminOnly, ownerId := GetValuesForUsersFromResourceOwnershipAndAccesses_2_43_0(t.ResourceControl,
+				func() (portainer.UserID, portainer.UserRole, error) {
+					user, err := m.userService.Tx(tx).Read(t.CreatedByUserID)
+					if err != nil {
+						return 0, 0, err
+					}
+					return user.ID, user.Role, nil
+				},
+				func(userId portainer.UserID) ([]portainer.TeamMembership, error) {
+					return m.teamMembershipService.Tx(tx).TeamMembershipsByUserID(userId)
+				},
+			)
+
+			srcID, exists := sourcesByKey[key]
+
+			if !exists {
+				src := &portainer.Source{
+					Name:               gittypes.RepoName(cfg.URL),
+					Type:               portainer.SourceTypeGit,
+					Git:                cfg,
+					OwnerID:            ownerId,
+					Public:             public,
+					AdministratorsOnly: adminOnly,
+					UserAccesses:       users,
+					TeamAccesses:       teams,
+				}
+				if err := m.sourceService.Tx(tx).Create(adminUserContext, src); err != nil {
+					return fmt.Errorf("failed to create source for custom template %d: %w", t.ID, err)
+				}
+				srcID = src.ID
+				newSrcID = src.ID
+			} else {
+				src, err := m.sourceService.Tx(tx).Read(adminUserContext, srcID)
+				if err != nil {
+					return fmt.Errorf("failed to read source %d for custom template %d: %w", srcID, t.ID, err)
+				}
+
+				ApplyUACOnSourceUpdate_2_43_0(src, users, teams, public, adminOnly, ownerId)
+
+				if err := m.sourceService.Tx(tx).Update(adminUserContext, srcID, src); err != nil {
+					return fmt.Errorf("failed to update source %d for custom template %d: %w", srcID, t.ID, err)
+				}
+			}
+
+			t.Artifact = &portainer.Artifact{
+				Files: []portainer.ArtifactFile{{
+					SourceID: srcID,
+					Path:     t.GitConfig.ConfigFilePath,
+					Ref:      t.GitConfig.ReferenceName,
+					Hash:     t.GitConfig.ConfigHash,
+				}},
+			}
+			t.GitConfig = nil
+
+			return m.customTemplateService.Tx(tx).Update(t.ID, t)
+		}); err != nil {
+			return fmt.Errorf("failed to migrate custom template %d: %w", t.ID, err)
+		}
+
+		if newSrcID != 0 {
+			sourcesByKey[key] = newSrcID
+		}
+	}
+
+	return nil
+}
diff --git a/api/datastore/migrator/migrate_2_43_0_test.go b/api/datastore/migrator/migrate_2_43_0_test.go
new file mode 100644
index 0000000..13a99b0
--- /dev/null
+++ b/api/datastore/migrator/migrate_2_43_0_test.go
@@ -0,0 +1,707 @@
+package migrator
+
+import (
+	"fmt"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/database/boltdb"
+	"github.com/portainer/portainer/api/dataservices/customtemplate"
+	"github.com/portainer/portainer/api/dataservices/resourcecontrol"
+	"github.com/portainer/portainer/api/dataservices/source"
+	"github.com/portainer/portainer/api/dataservices/stack"
+	"github.com/portainer/portainer/api/dataservices/teammembership"
+	"github.com/portainer/portainer/api/dataservices/user"
+	"github.com/portainer/portainer/api/dataservices/workflow"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	"github.com/portainer/portainer/api/logs"
+
+	"github.com/stretchr/testify/require"
+)
+
+// TODO: generate tests for UAC migrations
+
+var adminUserContext = source.InsecureNewAdminContext()
+
+func TestMigrateGitConfigToSources_2_43_0_GitStackMigrated(t *testing.T) {
+	t.Parallel()
+
+	conn := &boltdb.DbConnection{Path: t.TempDir()}
+	err := conn.Open()
+	require.NoError(t, err)
+	defer logs.CloseAndLogErr(conn)
+
+	stackSvc, err := stack.NewService(conn)
+	require.NoError(t, err)
+	sourceSvc, err := source.NewService(conn)
+	require.NoError(t, err)
+	workflowSvc, err := workflow.NewService(conn)
+	require.NoError(t, err)
+	rcSvc, err := resourcecontrol.NewService(conn)
+	require.NoError(t, err)
+
+	m := NewMigrator(&MigratorParameters{
+		StackService:           stackSvc,
+		SourceService:          sourceSvc,
+		WorkflowService:        workflowSvc,
+		ResourceControlService: rcSvc,
+	})
+
+	gitStack := &portainer.Stack{
+		ID:   1,
+		Name: "git-stack",
+		GitConfig: &gittypes.RepoConfig{
+			URL:           "https://github.com/example/repo",
+			ReferenceName: "refs/heads/main",
+			ConfigHash:    "abc123",
+		},
+	}
+	err = conn.CreateObjectWithId(stack.BucketName, int(gitStack.ID), gitStack)
+	require.NoError(t, err)
+
+	err = m.migrateGitConfigToSources_2_43_0()
+	require.NoError(t, err)
+
+	migrated, err := stackSvc.Read(gitStack.ID)
+	require.NoError(t, err)
+	require.NotZero(t, migrated.WorkflowID)
+	require.Nil(t, migrated.GitConfig)
+
+	wf, err := workflowSvc.Read(migrated.WorkflowID)
+	require.NoError(t, err)
+	require.Len(t, wf.Artifacts, 1)
+	require.Len(t, wf.Artifacts[0].Files, 1)
+
+	src, err := sourceSvc.Read(adminUserContext, wf.Artifacts[0].Files[0].SourceID)
+	require.NoError(t, err)
+	require.Equal(t, portainer.SourceTypeGit, src.Type)
+	require.Equal(t, gitStack.GitConfig.URL, src.Git.URL)
+	require.Equal(t, gitStack.GitConfig.ReferenceName, wf.Artifacts[0].Files[0].Ref)
+}
+
+func TestMigrateGitConfigToSources_2_43_0_NonGitStackUntouched(t *testing.T) {
+	t.Parallel()
+
+	conn := &boltdb.DbConnection{Path: t.TempDir()}
+	err := conn.Open()
+	require.NoError(t, err)
+	defer logs.CloseAndLogErr(conn)
+
+	stackSvc, err := stack.NewService(conn)
+	require.NoError(t, err)
+	sourceSvc, err := source.NewService(conn)
+	require.NoError(t, err)
+	workflowSvc, err := workflow.NewService(conn)
+	require.NoError(t, err)
+	rcSvc, err := resourcecontrol.NewService(conn)
+	require.NoError(t, err)
+
+	m := NewMigrator(&MigratorParameters{
+		StackService:           stackSvc,
+		SourceService:          sourceSvc,
+		WorkflowService:        workflowSvc,
+		ResourceControlService: rcSvc,
+	})
+
+	plainStack := &portainer.Stack{
+		ID:   1,
+		Name: "plain-stack",
+	}
+	err = conn.CreateObjectWithId(stack.BucketName, int(plainStack.ID), plainStack)
+	require.NoError(t, err)
+
+	err = m.migrateGitConfigToSources_2_43_0()
+	require.NoError(t, err)
+
+	result, err := stackSvc.Read(plainStack.ID)
+	require.NoError(t, err)
+	require.Zero(t, result.WorkflowID)
+	require.Nil(t, result.GitConfig)
+
+	sources, err := sourceSvc.ReadAll(adminUserContext)
+	require.NoError(t, err)
+	require.Empty(t, sources)
+
+	workflows, err := workflowSvc.ReadAll()
+	require.NoError(t, err)
+	require.Empty(t, workflows)
+}
+
+func TestMigrateGitConfigToSources_2_43_0_DuplicateSourcesDeduped(t *testing.T) {
+	t.Parallel()
+
+	conn := &boltdb.DbConnection{Path: t.TempDir()}
+	err := conn.Open()
+	require.NoError(t, err)
+	defer logs.CloseAndLogErr(conn)
+
+	stackSvc, err := stack.NewService(conn)
+	require.NoError(t, err)
+	sourceSvc, err := source.NewService(conn)
+	require.NoError(t, err)
+	workflowSvc, err := workflow.NewService(conn)
+	require.NoError(t, err)
+	rcSvc, err := resourcecontrol.NewService(conn)
+	require.NoError(t, err)
+
+	m := NewMigrator(&MigratorParameters{
+		StackService:           stackSvc,
+		SourceService:          sourceSvc,
+		WorkflowService:        workflowSvc,
+		ResourceControlService: rcSvc,
+	})
+
+	sharedURL := "https://github.com/example/shared-repo"
+
+	stack1 := &portainer.Stack{
+		ID:   1,
+		Name: "stack-a",
+		GitConfig: &gittypes.RepoConfig{
+			URL:           sharedURL,
+			ReferenceName: "refs/heads/main",
+		},
+	}
+	stack2 := &portainer.Stack{
+		ID:   2,
+		Name: "stack-b",
+		GitConfig: &gittypes.RepoConfig{
+			URL:           sharedURL,
+			ReferenceName: "refs/heads/develop",
+		},
+	}
+	err = conn.CreateObjectWithId(stack.BucketName, int(stack1.ID), stack1)
+	require.NoError(t, err)
+	err = conn.CreateObjectWithId(stack.BucketName, int(stack2.ID), stack2)
+	require.NoError(t, err)
+
+	err = m.migrateGitConfigToSources_2_43_0()
+	require.NoError(t, err)
+
+	sources, err := sourceSvc.ReadAll(adminUserContext)
+	require.NoError(t, err)
+	require.Len(t, sources, 1, "two stacks with the same URL must share one Source")
+
+	workflows, err := workflowSvc.ReadAll()
+	require.NoError(t, err)
+	require.Len(t, workflows, 2, "each stack must get its own Workflow")
+
+	sharedSourceID := sources[0].ID
+	for _, wf := range workflows {
+		require.Len(t, wf.Artifacts, 1)
+		require.Len(t, wf.Artifacts[0].Files, 1)
+		require.Equal(t, sharedSourceID, wf.Artifacts[0].Files[0].SourceID)
+	}
+}
+
+func TestMigrateGitConfigToSources_2_43_0_DotGitSuffixDeduped(t *testing.T) {
+	t.Parallel()
+
+	conn := &boltdb.DbConnection{Path: t.TempDir()}
+	err := conn.Open()
+	require.NoError(t, err)
+	defer logs.CloseAndLogErr(conn)
+
+	stackSvc, err := stack.NewService(conn)
+	require.NoError(t, err)
+	sourceSvc, err := source.NewService(conn)
+	require.NoError(t, err)
+	workflowSvc, err := workflow.NewService(conn)
+	require.NoError(t, err)
+	rcSvc, err := resourcecontrol.NewService(conn)
+	require.NoError(t, err)
+
+	m := NewMigrator(&MigratorParameters{
+		StackService:           stackSvc,
+		SourceService:          sourceSvc,
+		WorkflowService:        workflowSvc,
+		ResourceControlService: rcSvc,
+	})
+
+	// One stack uses the .git suffix, the other does not. Both refer to the
+	// same repository and must share a single Source record after migration.
+	stack1 := &portainer.Stack{
+		ID:   1,
+		Name: "stack-a",
+		GitConfig: &gittypes.RepoConfig{
+			URL:           "https://github.com/example/shared-repo.git",
+			ReferenceName: "refs/heads/main",
+		},
+	}
+	stack2 := &portainer.Stack{
+		ID:   2,
+		Name: "stack-b",
+		GitConfig: &gittypes.RepoConfig{
+			URL:           "https://github.com/example/shared-repo",
+			ReferenceName: "refs/heads/develop",
+		},
+	}
+	err = conn.CreateObjectWithId(stack.BucketName, int(stack1.ID), stack1)
+	require.NoError(t, err)
+	err = conn.CreateObjectWithId(stack.BucketName, int(stack2.ID), stack2)
+	require.NoError(t, err)
+
+	err = m.migrateGitConfigToSources_2_43_0()
+	require.NoError(t, err)
+
+	sources, err := sourceSvc.ReadAll(adminUserContext)
+	require.NoError(t, err)
+	require.Len(t, sources, 1, "stacks whose URLs differ only in .git suffix must share one Source")
+
+	workflows, err := workflowSvc.ReadAll()
+	require.NoError(t, err)
+	require.Len(t, workflows, 2, "each stack must get its own Workflow")
+
+	sharedSourceID := sources[0].ID
+	for _, wf := range workflows {
+		require.Len(t, wf.Artifacts, 1)
+		require.Len(t, wf.Artifacts[0].Files, 1)
+		require.Equal(t, sharedSourceID, wf.Artifacts[0].Files[0].SourceID)
+	}
+}
+
+func TestMigrateGitConfigToSources_2_43_0_Idempotent(t *testing.T) {
+	t.Parallel()
+
+	conn := &boltdb.DbConnection{Path: t.TempDir()}
+	err := conn.Open()
+	require.NoError(t, err)
+	defer logs.CloseAndLogErr(conn)
+
+	stackSvc, err := stack.NewService(conn)
+	require.NoError(t, err)
+	sourceSvc, err := source.NewService(conn)
+	require.NoError(t, err)
+	workflowSvc, err := workflow.NewService(conn)
+	require.NoError(t, err)
+	rcSvc, err := resourcecontrol.NewService(conn)
+	require.NoError(t, err)
+
+	m := NewMigrator(&MigratorParameters{
+		StackService:           stackSvc,
+		SourceService:          sourceSvc,
+		WorkflowService:        workflowSvc,
+		ResourceControlService: rcSvc,
+	})
+
+	gitStack := &portainer.Stack{
+		ID:   1,
+		Name: "git-stack",
+		GitConfig: &gittypes.RepoConfig{
+			URL: "https://github.com/example/repo",
+		},
+	}
+	err = conn.CreateObjectWithId(stack.BucketName, int(gitStack.ID), gitStack)
+	require.NoError(t, err)
+
+	err = m.migrateGitConfigToSources_2_43_0()
+	require.NoError(t, err)
+
+	// Second run must not create duplicate Source/Workflow records
+	err = m.migrateGitConfigToSources_2_43_0()
+	require.NoError(t, err)
+
+	sources, err := sourceSvc.ReadAll(adminUserContext)
+	require.NoError(t, err)
+	require.Len(t, sources, 1)
+
+	workflows, err := workflowSvc.ReadAll()
+	require.NoError(t, err)
+	require.Len(t, workflows, 1)
+}
+
+func TestMigrateCustomTemplateGitConfigToSources_2_43_0_GitTemplateMigrated(t *testing.T) {
+	t.Parallel()
+
+	conn := &boltdb.DbConnection{Path: t.TempDir()}
+	err := conn.Open()
+	require.NoError(t, err)
+	defer logs.CloseAndLogErr(conn)
+
+	stackSvc, err := stack.NewService(conn)
+	require.NoError(t, err)
+	sourceSvc, err := source.NewService(conn)
+	require.NoError(t, err)
+	customTemplateSvc, err := customtemplate.NewService(conn)
+	require.NoError(t, err)
+
+	m := NewMigrator(&MigratorParameters{
+		StackService:          stackSvc,
+		SourceService:         sourceSvc,
+		CustomTemplateService: customTemplateSvc,
+	})
+
+	tmpl := &portainer.CustomTemplate{
+		ID: 1,
+		GitConfig: &gittypes.RepoConfig{
+			URL:            "https://github.com/example/repo",
+			ReferenceName:  "refs/heads/main",
+			ConfigFilePath: "docker-compose.yml",
+			ConfigHash:     "abc123",
+		},
+	}
+	err = conn.CreateObjectWithId(customtemplate.BucketName, int(tmpl.ID), tmpl)
+	require.NoError(t, err)
+
+	err = m.migrateCustomTemplateGitConfigToSources_2_43_0()
+	require.NoError(t, err)
+
+	migrated, err := customTemplateSvc.Read(tmpl.ID)
+	require.NoError(t, err)
+	require.NotNil(t, migrated.Artifact)
+	require.Nil(t, migrated.GitConfig)
+	require.Len(t, migrated.Artifact.Files, 1)
+	require.Equal(t, "refs/heads/main", migrated.Artifact.Files[0].Ref)
+	require.Equal(t, "docker-compose.yml", migrated.Artifact.Files[0].Path)
+	require.Equal(t, "abc123", migrated.Artifact.Files[0].Hash)
+
+	src, err := sourceSvc.Read(adminUserContext, migrated.Artifact.Files[0].SourceID)
+	require.NoError(t, err)
+	require.Equal(t, portainer.SourceTypeGit, src.Type)
+	require.Equal(t, "https://github.com/example/repo", src.Git.URL)
+}
+
+func TestMigrateCustomTemplateGitConfigToSources_2_43_0_NonGitTemplateUntouched(t *testing.T) {
+	t.Parallel()
+
+	conn := &boltdb.DbConnection{Path: t.TempDir()}
+	err := conn.Open()
+	require.NoError(t, err)
+	defer logs.CloseAndLogErr(conn)
+
+	stackSvc, err := stack.NewService(conn)
+	require.NoError(t, err)
+	sourceSvc, err := source.NewService(conn)
+	require.NoError(t, err)
+	customTemplateSvc, err := customtemplate.NewService(conn)
+	require.NoError(t, err)
+
+	m := NewMigrator(&MigratorParameters{
+		StackService:          stackSvc,
+		SourceService:         sourceSvc,
+		CustomTemplateService: customTemplateSvc,
+	})
+
+	tmpl := &portainer.CustomTemplate{ID: 1, Title: "plain-template"}
+	err = conn.CreateObjectWithId(customtemplate.BucketName, int(tmpl.ID), tmpl)
+	require.NoError(t, err)
+
+	err = m.migrateCustomTemplateGitConfigToSources_2_43_0()
+	require.NoError(t, err)
+
+	result, err := customTemplateSvc.Read(tmpl.ID)
+	require.NoError(t, err)
+	require.Nil(t, result.Artifact)
+	require.Nil(t, result.GitConfig)
+
+	sources, err := sourceSvc.ReadAll(adminUserContext)
+	require.NoError(t, err)
+	require.Empty(t, sources)
+}
+
+func TestMigrateCustomTemplateGitConfigToSources_2_43_0_AlreadyMigratedSkipped(t *testing.T) {
+	t.Parallel()
+
+	conn := &boltdb.DbConnection{Path: t.TempDir()}
+	err := conn.Open()
+	require.NoError(t, err)
+	defer logs.CloseAndLogErr(conn)
+
+	stackSvc, err := stack.NewService(conn)
+	require.NoError(t, err)
+	sourceSvc, err := source.NewService(conn)
+	require.NoError(t, err)
+	customTemplateSvc, err := customtemplate.NewService(conn)
+	require.NoError(t, err)
+
+	m := NewMigrator(&MigratorParameters{
+		StackService:          stackSvc,
+		SourceService:         sourceSvc,
+		CustomTemplateService: customTemplateSvc,
+	})
+
+	// Template already has Artifact set (already migrated)
+	srcID := portainer.SourceID(99)
+	tmpl := &portainer.CustomTemplate{
+		ID: 1,
+		GitConfig: &gittypes.RepoConfig{
+			URL: "https://github.com/example/repo",
+		},
+		Artifact: &portainer.Artifact{
+			Files: []portainer.ArtifactFile{{SourceID: srcID}},
+		},
+	}
+	err = conn.CreateObjectWithId(customtemplate.BucketName, int(tmpl.ID), tmpl)
+	require.NoError(t, err)
+
+	err = m.migrateCustomTemplateGitConfigToSources_2_43_0()
+	require.NoError(t, err)
+
+	sources, err := sourceSvc.ReadAll(adminUserContext)
+	require.NoError(t, err)
+	require.Empty(t, sources, "no new sources should be created for already-migrated templates")
+}
+
+func TestMigrateCustomTemplateGitConfigToSources_2_43_0_DuplicateSourcesDeduped(t *testing.T) {
+	t.Parallel()
+
+	conn := &boltdb.DbConnection{Path: t.TempDir()}
+	err := conn.Open()
+	require.NoError(t, err)
+	defer logs.CloseAndLogErr(conn)
+
+	stackSvc, err := stack.NewService(conn)
+	require.NoError(t, err)
+	sourceSvc, err := source.NewService(conn)
+	require.NoError(t, err)
+	customTemplateSvc, err := customtemplate.NewService(conn)
+	require.NoError(t, err)
+
+	m := NewMigrator(&MigratorParameters{
+		StackService:          stackSvc,
+		SourceService:         sourceSvc,
+		CustomTemplateService: customTemplateSvc,
+	})
+
+	sharedURL := "https://github.com/example/shared-repo"
+
+	tmpl1 := &portainer.CustomTemplate{
+		ID:    1,
+		Title: "template-a",
+		GitConfig: &gittypes.RepoConfig{
+			URL:           sharedURL,
+			ReferenceName: "refs/heads/main",
+		},
+	}
+	tmpl2 := &portainer.CustomTemplate{
+		ID:    2,
+		Title: "template-b",
+		GitConfig: &gittypes.RepoConfig{
+			URL:           sharedURL,
+			ReferenceName: "refs/heads/develop",
+		},
+	}
+	err = conn.CreateObjectWithId(customtemplate.BucketName, int(tmpl1.ID), tmpl1)
+	require.NoError(t, err)
+	err = conn.CreateObjectWithId(customtemplate.BucketName, int(tmpl2.ID), tmpl2)
+	require.NoError(t, err)
+
+	err = m.migrateCustomTemplateGitConfigToSources_2_43_0()
+	require.NoError(t, err)
+
+	sources, err := sourceSvc.ReadAll(adminUserContext)
+	require.NoError(t, err)
+	require.Len(t, sources, 1, "two templates with the same URL must share one Source")
+
+	sharedSrcID := sources[0].ID
+
+	migrated1, err := customTemplateSvc.Read(tmpl1.ID)
+	require.NoError(t, err)
+	require.NotNil(t, migrated1.Artifact)
+	require.Equal(t, sharedSrcID, migrated1.Artifact.Files[0].SourceID)
+
+	migrated2, err := customTemplateSvc.Read(tmpl2.ID)
+	require.NoError(t, err)
+	require.NotNil(t, migrated2.Artifact)
+	require.Equal(t, sharedSrcID, migrated2.Artifact.Files[0].SourceID)
+}
+
+func TestMigrateCustomTemplateGitConfigToSources_2_43_0_DotGitSuffixDeduped(t *testing.T) {
+	t.Parallel()
+
+	conn := &boltdb.DbConnection{Path: t.TempDir()}
+	err := conn.Open()
+	require.NoError(t, err)
+	defer logs.CloseAndLogErr(conn)
+
+	stackSvc, err := stack.NewService(conn)
+	require.NoError(t, err)
+	sourceSvc, err := source.NewService(conn)
+	require.NoError(t, err)
+	customTemplateSvc, err := customtemplate.NewService(conn)
+	require.NoError(t, err)
+
+	m := NewMigrator(&MigratorParameters{
+		StackService:          stackSvc,
+		SourceService:         sourceSvc,
+		CustomTemplateService: customTemplateSvc,
+	})
+
+	// One template uses the .git suffix, the other does not. Both refer to the
+	// same repository and must share a single Source record after migration.
+	tmpl1 := &portainer.CustomTemplate{
+		ID:    1,
+		Title: "template-a",
+		GitConfig: &gittypes.RepoConfig{
+			URL:           "https://github.com/example/shared-repo.git",
+			ReferenceName: "refs/heads/main",
+		},
+	}
+	tmpl2 := &portainer.CustomTemplate{
+		ID:    2,
+		Title: "template-b",
+		GitConfig: &gittypes.RepoConfig{
+			URL:           "https://github.com/example/shared-repo",
+			ReferenceName: "refs/heads/develop",
+		},
+	}
+	err = conn.CreateObjectWithId(customtemplate.BucketName, int(tmpl1.ID), tmpl1)
+	require.NoError(t, err)
+	err = conn.CreateObjectWithId(customtemplate.BucketName, int(tmpl2.ID), tmpl2)
+	require.NoError(t, err)
+
+	err = m.migrateCustomTemplateGitConfigToSources_2_43_0()
+	require.NoError(t, err)
+
+	sources, err := sourceSvc.ReadAll(adminUserContext)
+	require.NoError(t, err)
+	require.Len(t, sources, 1, "templates whose URLs differ only in .git suffix must share one Source")
+
+	sharedSrcID := sources[0].ID
+
+	migrated1, err := customTemplateSvc.Read(tmpl1.ID)
+	require.NoError(t, err)
+	require.NotNil(t, migrated1.Artifact)
+	require.Equal(t, sharedSrcID, migrated1.Artifact.Files[0].SourceID)
+
+	migrated2, err := customTemplateSvc.Read(tmpl2.ID)
+	require.NoError(t, err)
+	require.NotNil(t, migrated2.Artifact)
+	require.Equal(t, sharedSrcID, migrated2.Artifact.Files[0].SourceID)
+}
+
+// TestMigrateGitConfigToSources_2_43_0_StandardUserStackPreservesAccess is the regression
+// test for the bug where stacks owned by standard users became inaccessible after upgrading
+// to 2.43. ResourceControls are stored in a separate bucket and are never embedded in the
+// stack record, so the migration must look them up explicitly.
+func TestMigrateGitConfigToSources_2_43_0_StandardUserStackPreservesAccess(t *testing.T) {
+	t.Parallel()
+
+	conn := &boltdb.DbConnection{Path: t.TempDir()}
+	err := conn.Open()
+	require.NoError(t, err)
+	defer logs.CloseAndLogErr(conn)
+
+	stackSvc, err := stack.NewService(conn)
+	require.NoError(t, err)
+	sourceSvc, err := source.NewService(conn)
+	require.NoError(t, err)
+	workflowSvc, err := workflow.NewService(conn)
+	require.NoError(t, err)
+	rcSvc, err := resourcecontrol.NewService(conn)
+	require.NoError(t, err)
+	userSvc, err := user.NewService(conn)
+	require.NoError(t, err)
+	teamMembershipSvc, err := teammembership.NewService(conn)
+	require.NoError(t, err)
+
+	m := NewMigrator(&MigratorParameters{
+		StackService:           stackSvc,
+		SourceService:          sourceSvc,
+		WorkflowService:        workflowSvc,
+		ResourceControlService: rcSvc,
+		UserService:            userSvc,
+		TeamMembershipService:  teamMembershipSvc,
+	})
+
+	standardUser := &portainer.User{
+		Username: "standarduser",
+		Role:     portainer.StandardUserRole,
+	}
+	err = userSvc.Create(standardUser)
+	require.NoError(t, err)
+
+	const endpointID portainer.EndpointID = 1
+
+	gitStack := &portainer.Stack{
+		ID:         1,
+		Name:       "git-stack",
+		EndpointID: endpointID,
+		CreatedBy:  "standarduser",
+		GitConfig: &gittypes.RepoConfig{
+			URL:           "https://github.com/example/repo",
+			ReferenceName: "refs/heads/main",
+		},
+	}
+	err = conn.CreateObjectWithId(stack.BucketName, int(gitStack.ID), gitStack)
+	require.NoError(t, err)
+
+	// ResourceControls are stored separately from stacks; the stack record never embeds one.
+	// The migration must look up the RC by resource ID to avoid defaulting to adminOnly=true.
+	rc := &portainer.ResourceControl{
+		ResourceID: fmt.Sprintf("%d_%s", endpointID, gitStack.Name),
+		Type:       portainer.StackResourceControl,
+		UserAccesses: []portainer.UserResourceAccess{
+			{UserID: standardUser.ID, AccessLevel: portainer.ReadWriteAccessLevel},
+		},
+		AdministratorsOnly: false,
+		Public:             false,
+	}
+	err = rcSvc.Create(rc)
+	require.NoError(t, err)
+
+	err = m.migrateGitConfigToSources_2_43_0()
+	require.NoError(t, err)
+
+	migrated, err := stackSvc.Read(gitStack.ID)
+	require.NoError(t, err)
+	require.NotZero(t, migrated.WorkflowID)
+
+	wf, err := workflowSvc.Read(migrated.WorkflowID)
+	require.NoError(t, err)
+	require.Len(t, wf.Artifacts, 1)
+	require.Len(t, wf.Artifacts[0].Files, 1)
+
+	srcID := wf.Artifacts[0].Files[0].SourceID
+	src, err := sourceSvc.Read(adminUserContext, srcID)
+	require.NoError(t, err)
+	require.False(t, src.AdministratorsOnly, "source must not be admin-only after migrating a standard user's stack")
+	require.Contains(t, src.UserAccesses, standardUser.ID)
+
+	// The standard user must be able to read the source through the normal access filter
+	userCtx := source.NewUserContext(standardUser, nil)
+	userSrc, err := sourceSvc.Read(userCtx, srcID)
+	require.NoError(t, err)
+	require.Equal(t, srcID, userSrc.ID)
+}
+
+func TestMigrateCustomTemplateGitConfigToSources_2_43_0_Idempotent(t *testing.T) {
+	t.Parallel()
+
+	conn := &boltdb.DbConnection{Path: t.TempDir()}
+	err := conn.Open()
+	require.NoError(t, err)
+	defer logs.CloseAndLogErr(conn)
+
+	stackSvc, err := stack.NewService(conn)
+	require.NoError(t, err)
+	sourceSvc, err := source.NewService(conn)
+	require.NoError(t, err)
+	customTemplateSvc, err := customtemplate.NewService(conn)
+	require.NoError(t, err)
+
+	m := NewMigrator(&MigratorParameters{
+		StackService:          stackSvc,
+		SourceService:         sourceSvc,
+		CustomTemplateService: customTemplateSvc,
+	})
+
+	tmpl := &portainer.CustomTemplate{
+		ID: 1,
+		GitConfig: &gittypes.RepoConfig{
+			URL: "https://github.com/example/repo",
+		},
+	}
+	err = conn.CreateObjectWithId(customtemplate.BucketName, int(tmpl.ID), tmpl)
+	require.NoError(t, err)
+
+	err = m.migrateCustomTemplateGitConfigToSources_2_43_0()
+	require.NoError(t, err)
+
+	// Second run must not create duplicate Source records
+	err = m.migrateCustomTemplateGitConfigToSources_2_43_0()
+	require.NoError(t, err)
+
+	sources, err := sourceSvc.ReadAll(adminUserContext)
+	require.NoError(t, err)
+	require.Len(t, sources, 1)
+}
diff --git a/api/datastore/migrator/migrate_2_43_sources.go b/api/datastore/migrator/migrate_2_43_sources.go
new file mode 100644
index 0000000..b8089f4
--- /dev/null
+++ b/api/datastore/migrator/migrate_2_43_sources.go
@@ -0,0 +1,122 @@
+package migrator
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/slicesx"
+	"github.com/rs/zerolog/log"
+)
+
+// DB accesses enforcement are trying to restrict accesses as much as possible
+// but because accesses are applied sequentially, we want the accesses to be more open on migration
+// so that users retain their accesses
+func ApplyUACOnSourceUpdate_2_43_0(source *portainer.Source,
+	users []portainer.UserID, teams []portainer.TeamID,
+	public bool, adminOnly bool,
+	ownerId portainer.UserID,
+) {
+	// sources already public should remain public
+	// OR
+	// the resource using this source is public, so the source should be public
+	if source.Public || public {
+		source.Public = true
+		source.AdministratorsOnly = false
+		source.UserAccesses = []portainer.UserID{}
+		source.TeamAccesses = []portainer.TeamID{}
+		return
+	}
+
+	// add users and teams to source accesses only if the incoming resource is not admninonly
+	// to avoid saving leftover user/teams from adminonly resources
+	if !adminOnly {
+		source.UserAccesses = slicesx.Unique(append(source.UserAccesses, users...))
+		source.TeamAccesses = slicesx.Unique(append(source.TeamAccesses, teams...))
+	}
+
+	// regardless of the incoming resource's ResourceControl values (func params)
+	// no accesses means adminonly source not owned by anyone
+	// we don't want users to own sources they don't have access to
+	// neither we want to default them to public
+	// all in all as we are doing an update it's probably redundant, but just in case...
+	if len(source.UserAccesses) == 0 && len(source.TeamAccesses) == 0 {
+		source.AdministratorsOnly = true
+		source.OwnerID = 0
+		return
+	}
+
+	// if owner of the incoming resource (ownerid) is the only one with access, we give the ownership to the user.
+	// The source could previously be adminonly so we change that as well as we want the most open situation
+	if len(source.UserAccesses) == 1 && len(source.TeamAccesses) == 0 && ownerId == source.UserAccesses[0] {
+		source.OwnerID = ownerId
+		source.AdministratorsOnly = false
+		return
+	}
+
+	// Anything else will have multiple accesses (multiple teams or users), from multiple resources (source update flow)
+	// So we remove the ownership of the source in case it existed
+	// Scenario:
+	// - source created for resource owned by Bob
+	// - now we try to update with the RC from an admin-owned resource, shared to other users/teams
+	// - we don't want Bob to own the source anymore
+	source.OwnerID = 0
+
+}
+
+func GetValuesForUsersFromResourceOwnershipAndAccesses_2_43_0(
+	rc *portainer.ResourceControl,
+	getCreator func() (portainer.UserID, portainer.UserRole, error),
+	getCreatorMemberships func(portainer.UserID) ([]portainer.TeamMembership, error),
+) (
+	users []portainer.UserID, teams []portainer.TeamID,
+	public bool, adminOnly bool,
+	ownerId portainer.UserID,
+) {
+	users = []portainer.UserID{}
+	teams = []portainer.TeamID{}
+	public = false
+	adminOnly = true
+
+	if rc == nil {
+		return
+	}
+
+	adminOnly = rc.AdministratorsOnly
+	public = rc.Public
+
+	if adminOnly || public {
+		return
+	}
+
+	// only transfer users/teams when the stack is not admin nor public
+	// this allows avoiding transfering access of sources to users/teams that don't have real access to the stack
+	// but that may have had their accesses retained in DB
+
+	users = slicesx.Map(rc.UserAccesses, func(ura portainer.UserResourceAccess) portainer.UserID { return ura.UserID })
+	teams = slicesx.Map(rc.TeamAccesses, func(tra portainer.TeamResourceAccess) portainer.TeamID { return tra.TeamID })
+
+	userId, userRole, err := getCreator()
+	if err != nil {
+		log.Error().Err(err).Msgf("failed to read user when migrating to source")
+		return
+	}
+
+	// we don't want to save the ownerid if the user is admin
+	// this avoids admins taking ownership of a new source
+	if userRole == portainer.AdministratorRole {
+		return
+	}
+
+	// We also don't want to get the ownerid if the user doesn't have access to the resource anymore
+	userTeams, err := getCreatorMemberships(userId)
+	if err != nil {
+		log.Error().Err(err).Msgf("failed to read user %d teams when migrating source", userId)
+		return
+	}
+
+	teamIds := slicesx.Map(userTeams, func(membership portainer.TeamMembership) portainer.TeamID { return membership.TeamID })
+	if authorization.UserCanAccessResource(userId, teamIds, rc) {
+		ownerId = userId
+	}
+
+	return
+}
diff --git a/api/datastore/migrator/migrate_ce.go b/api/datastore/migrator/migrate_ce.go
new file mode 100644
index 0000000..e5dddbd
--- /dev/null
+++ b/api/datastore/migrator/migrate_ce.go
@@ -0,0 +1,123 @@
+package migrator
+
+import (
+	"reflect"
+	"runtime"
+
+	"github.com/pkg/errors"
+	portainer "github.com/portainer/portainer/api"
+
+	"github.com/Masterminds/semver/v3"
+	"github.com/rs/zerolog/log"
+)
+
+func migrationError(err error, context string) error {
+	return errors.Wrap(err, "failed in "+context)
+}
+
+func GetFunctionName(i any) string {
+	return runtime.FuncForPC(reflect.ValueOf(i).Pointer()).Name()
+}
+
+// Migrate checks the database version and migrate the existing data to the most recent data model.
+func (m *Migrator) Migrate() error {
+	version, err := m.versionService.Version()
+	if err != nil {
+		return migrationError(err, "get version service")
+	}
+
+	schemaVersion, err := semver.NewVersion(version.SchemaVersion)
+	if err != nil {
+		return migrationError(err, "invalid db schema version")
+	}
+
+	newMigratorCount := 0
+	apiVersion := semver.MustParse(portainer.APIVersion)
+	if schemaVersion.Equal(apiVersion) {
+		// detect and run migrations when the versions are the same.
+		// e.g. development builds
+		latestMigrations := m.LatestMigrations()
+		if latestMigrations.Version.Equal(schemaVersion) &&
+			version.MigratorCount != len(latestMigrations.MigrationFuncs) {
+			if err := runMigrations(latestMigrations.MigrationFuncs); err != nil {
+				return err
+			}
+
+			newMigratorCount = len(latestMigrations.MigrationFuncs)
+		}
+	} else {
+		// regular path when major/minor/patch versions differ
+		for _, migration := range m.migrations {
+			if schemaVersion.LessThan(migration.Version) {
+				log.Info().Msgf("migrating data to %s", migration.Version.String())
+
+				if err := runMigrations(migration.MigrationFuncs); err != nil {
+					return err
+				}
+			}
+
+			if apiVersion.Equal(migration.Version) {
+				newMigratorCount = len(migration.MigrationFuncs)
+			}
+		}
+	}
+
+	if err := m.Always(); err != nil {
+		return migrationError(err, "Always migrations returned error")
+	}
+
+	version.SchemaVersion = portainer.APIVersion
+	version.MigratorCount = newMigratorCount
+
+	if err := m.versionService.UpdateVersion(version); err != nil {
+		return migrationError(err, "StoreDBVersion")
+	}
+
+	log.Info().Msgf("db migrated to %s", portainer.APIVersion)
+
+	return nil
+}
+
+func runMigrations(migrationFuncs []func() error) error {
+	for _, migrationFunc := range migrationFuncs {
+		err := migrationFunc()
+		if err != nil {
+			return migrationError(err, GetFunctionName(migrationFunc))
+		}
+	}
+	return nil
+}
+
+func (m *Migrator) NeedsMigration() bool {
+	// we need to migrate if anything changes with the version in the DB vs what our software version is.
+	// If the version matches, then it's all down to the number of migration funcs we have for the current version
+	// i.e. the MigratorCount
+
+	// In this particular instance we should log a fatal error
+	if m.CurrentDBEdition() != portainer.PortainerCE {
+		log.Fatal().Msg("the Portainer database is set for Portainer Business Edition, please follow the instructions in our documentation to downgrade it: https://docs.portainer.io/faqs/upgrading/can-i-downgrade-from-portainer-business-to-portainer-ce")
+
+		return false
+	}
+
+	if m.CurrentSemanticDBVersion().LessThan(semver.MustParse(portainer.APIVersion)) {
+		return true
+	}
+
+	// Check if we have any migrations for the current version
+	latestMigrations := m.LatestMigrations()
+	if latestMigrations.Version.Equal(semver.MustParse(portainer.APIVersion)) {
+		if m.currentDBVersion.MigratorCount != len(latestMigrations.MigrationFuncs) {
+			return true
+		}
+	} else {
+		// One remaining possibility if we get here.  If our migrator count > 0 and we have no migration funcs
+		// for the current version (i.e. they were deleted during development).  Then we we need to migrate.
+		// This is to reset the migrator count back to 0
+		if m.currentDBVersion.MigratorCount > 0 {
+			return true
+		}
+	}
+
+	return false
+}
diff --git a/api/datastore/migrator/migrate_dbversion100.go b/api/datastore/migrator/migrate_dbversion100.go
new file mode 100644
index 0000000..59b15b0
--- /dev/null
+++ b/api/datastore/migrator/migrate_dbversion100.go
@@ -0,0 +1,162 @@
+package migrator
+
+import (
+	"os"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/chisel/crypto"
+	"github.com/portainer/portainer/api/dataservices"
+
+	"github.com/rs/zerolog/log"
+)
+
+func (m *Migrator) migrateDockerDesktopExtensionSetting() error {
+	log.Info().Msg("updating docker desktop extension flag in settings")
+
+	isDDExtension := false
+	if _, ok := os.LookupEnv("DOCKER_EXTENSION"); ok {
+		isDDExtension = true
+	}
+
+	settings, err := m.settingsService.Settings()
+	if err != nil {
+		return err
+	}
+
+	settings.IsDockerDesktopExtension = isDDExtension
+
+	return m.settingsService.UpdateSettings(settings)
+}
+
+func (m *Migrator) convertSeedToPrivateKeyForDB100() error {
+	var serverInfo *portainer.TunnelServerInfo
+
+	serverInfo, err := m.TunnelServerService.Info()
+	if err != nil {
+		if dataservices.IsErrObjectNotFound(err) {
+			log.Info().Msg("ServerInfo object not found")
+			return nil
+		}
+
+		log.Error().
+			Err(err).
+			Msg("Failed to read ServerInfo from DB")
+
+		return err
+	}
+
+	if serverInfo.PrivateKeySeed != "" {
+		key, err := crypto.GenerateGo119CompatibleKey(serverInfo.PrivateKeySeed)
+		if err != nil {
+			log.Error().
+				Err(err).
+				Msg("Failed to read ServerInfo from DB")
+
+			return err
+		}
+
+		if err := m.fileService.StoreChiselPrivateKey(key); err != nil {
+			log.Error().
+				Err(err).
+				Msg("Failed to save Chisel private key to disk")
+
+			return err
+		}
+	} else {
+		log.Info().Msg("PrivateKeySeed is blank")
+	}
+
+	serverInfo.PrivateKeySeed = ""
+	if err := m.TunnelServerService.UpdateInfo(serverInfo); err != nil {
+		log.Error().
+			Err(err).
+			Msg("Failed to clean private key seed in DB")
+	} else {
+		log.Info().Msg("Success to migrate private key seed to private key file")
+	}
+
+	return err
+}
+
+func (m *Migrator) updateEdgeStackStatusForDB100() error {
+	log.Info().Msg("update edge stack status to have deployment steps")
+
+	edgeStacks, err := m.edgeStackService.EdgeStacks()
+	if err != nil {
+		return err
+	}
+
+	for _, edgeStack := range edgeStacks {
+		for environmentID, environmentStatus := range edgeStack.Status {
+			// Skip if status is already updated
+			if len(environmentStatus.Status) > 0 {
+				continue
+			}
+
+			if environmentStatus.Details == nil {
+				continue
+			}
+
+			statusArray := []portainer.EdgeStackDeploymentStatus{}
+			if environmentStatus.Details.Pending {
+				statusArray = append(statusArray, portainer.EdgeStackDeploymentStatus{
+					Type: portainer.EdgeStackStatusPending,
+					Time: time.Now().Unix(),
+				})
+			}
+
+			if environmentStatus.Details.Acknowledged {
+				statusArray = append(statusArray, portainer.EdgeStackDeploymentStatus{
+					Type: portainer.EdgeStackStatusAcknowledged,
+					Time: time.Now().Unix(),
+				})
+			}
+
+			if environmentStatus.Details.Error {
+				statusArray = append(statusArray, portainer.EdgeStackDeploymentStatus{
+					Type:  portainer.EdgeStackStatusError,
+					Error: environmentStatus.Error,
+					Time:  time.Now().Unix(),
+				})
+			}
+
+			if environmentStatus.Details.Ok {
+				statusArray = append(statusArray,
+					portainer.EdgeStackDeploymentStatus{
+						Type: portainer.EdgeStackStatusDeploymentReceived,
+						Time: time.Now().Unix(),
+					},
+					portainer.EdgeStackDeploymentStatus{
+						Type: portainer.EdgeStackStatusRunning,
+						Time: time.Now().Unix(),
+					},
+				)
+			}
+
+			if environmentStatus.Details.ImagesPulled {
+				statusArray = append(statusArray, portainer.EdgeStackDeploymentStatus{
+					Type: portainer.EdgeStackStatusImagesPulled,
+					Time: time.Now().Unix(),
+				})
+			}
+
+			if environmentStatus.Details.Remove {
+				statusArray = append(statusArray, portainer.EdgeStackDeploymentStatus{
+					Type: portainer.EdgeStackStatusRemoving,
+					Time: time.Now().Unix(),
+				})
+			}
+
+			environmentStatus.Status = statusArray
+
+			edgeStack.Status[environmentID] = environmentStatus
+		}
+
+		if err := m.edgeStackService.UpdateEdgeStack(edgeStack.ID, &edgeStack); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
diff --git a/api/datastore/migrator/migrate_dbversion110.go b/api/datastore/migrator/migrate_dbversion110.go
new file mode 100644
index 0000000..13a797b
--- /dev/null
+++ b/api/datastore/migrator/migrate_dbversion110.go
@@ -0,0 +1,51 @@
+package migrator
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/rs/zerolog/log"
+)
+
+// updateAppTemplatesVersionForDB110 changes the templates URL to be empty if it was never changed
+// from the default value (version 2.0 URL)
+func (migrator *Migrator) updateAppTemplatesVersionForDB110() error {
+	log.Info().Msg("updating app templates url to v3.0")
+
+	version2URL := "https://raw.githubusercontent.com/portainer/templates/master/templates-2.0.json"
+
+	settings, err := migrator.settingsService.Settings()
+	if err != nil {
+		return err
+	}
+
+	if settings.TemplatesURL == version2URL || settings.TemplatesURL == portainer.DefaultTemplatesURL {
+		settings.TemplatesURL = ""
+	}
+
+	return migrator.settingsService.UpdateSettings(settings)
+}
+
+// In PortainerCE the resource overcommit option should always be true across all endpoints
+func (migrator *Migrator) updateResourceOverCommitToDB110() error {
+	log.Info().Msg("updating resource overcommit setting to true")
+
+	endpoints, err := migrator.endpointService.Endpoints()
+	if err != nil {
+		return err
+	}
+
+	for _, endpoint := range endpoints {
+		if endpoint.Type == portainer.KubernetesLocalEnvironment ||
+			endpoint.Type == portainer.AgentOnKubernetesEnvironment ||
+			endpoint.Type == portainer.EdgeAgentOnKubernetesEnvironment {
+
+			endpoint.Kubernetes.Configuration.EnableResourceOverCommit = true
+
+			err = migrator.endpointService.UpdateEndpoint(endpoint.ID, &endpoint)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
diff --git a/api/datastore/migrator/migrate_dbversion111.go b/api/datastore/migrator/migrate_dbversion111.go
new file mode 100644
index 0000000..bd7c0d4
--- /dev/null
+++ b/api/datastore/migrator/migrate_dbversion111.go
@@ -0,0 +1,32 @@
+package migrator
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/rs/zerolog/log"
+)
+
+func (migrator *Migrator) cleanPendingActionsForDeletedEndpointsForDB111() error {
+	log.Info().Msg("cleaning up pending actions for deleted endpoints")
+
+	pendingActions, err := migrator.pendingActionsService.ReadAll()
+	if err != nil {
+		return err
+	}
+
+	endpoints := make(map[portainer.EndpointID]struct{})
+	for _, action := range pendingActions {
+		endpoints[action.EndpointID] = struct{}{}
+	}
+
+	for endpointId := range endpoints {
+		_, err := migrator.endpointService.Endpoint(endpointId)
+		if dataservices.IsErrObjectNotFound(err) {
+			err := migrator.pendingActionsService.DeleteByEndpointID(endpointId)
+			if err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
diff --git a/api/datastore/migrator/migrate_dbversion130.go b/api/datastore/migrator/migrate_dbversion130.go
new file mode 100644
index 0000000..7fa87e6
--- /dev/null
+++ b/api/datastore/migrator/migrate_dbversion130.go
@@ -0,0 +1,33 @@
+package migrator
+
+import (
+	"github.com/segmentio/encoding/json"
+
+	"github.com/rs/zerolog/log"
+)
+
+func (migrator *Migrator) migratePendingActionsDataForDB130() error {
+	log.Info().Msg("Migrating pending actions data")
+
+	pendingActions, err := migrator.pendingActionsService.ReadAll()
+	if err != nil {
+		return err
+	}
+
+	for _, pa := range pendingActions {
+		actionData, err := json.Marshal(pa.ActionData)
+		if err != nil {
+			return err
+		}
+
+		pa.ActionData = string(actionData)
+
+		// Update the pending action
+		err = migrator.pendingActionsService.Update(pa.ID, &pa)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
diff --git a/api/datastore/migrator/migrate_dbversion140.go b/api/datastore/migrator/migrate_dbversion140.go
new file mode 100644
index 0000000..bb51fd3
--- /dev/null
+++ b/api/datastore/migrator/migrate_dbversion140.go
@@ -0,0 +1,58 @@
+package migrator
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+	"github.com/rs/zerolog/log"
+)
+
+// migrateRegistryAccessSASecrets_2_40_0 marks Kubernetes endpoints that have
+// registry access configured so that imagePullSecrets can be added to their
+// default ServiceAccounts during the post-init migration phase (when cluster
+// access is available).
+func (m *Migrator) migrateRegistryAccessSASecrets_2_40_0() error {
+	log.Info().Msg("migrating registry access service account secrets")
+
+	registries, err := m.registryService.ReadAll()
+	if err != nil {
+		return err
+	}
+
+	endpoints, err := m.endpointService.Endpoints()
+	if err != nil {
+		return err
+	}
+
+	// Collect the IDs of endpoints that have at least one registry with
+	// non-empty namespace access - these need the SA imagePullSecrets migration.
+	needsMigration := make(map[portainer.EndpointID]bool)
+	for _, registry := range registries {
+		for endpointID, access := range registry.RegistryAccesses {
+			if len(access.Namespaces) > 0 {
+				needsMigration[endpointID] = true
+			}
+		}
+	}
+
+	for i := range endpoints {
+		endpoint := &endpoints[i]
+
+		if !endpointutils.IsKubernetesEndpoint(endpoint) {
+			continue
+		}
+
+		if !needsMigration[endpoint.ID] {
+			continue
+		}
+
+		endpoint.PostInitMigrations.MigrateRegistrySASecrets = true
+		if err := m.endpointService.UpdateEndpoint(endpoint.ID, endpoint); err != nil {
+			log.Warn().
+				Err(err).
+				Int("endpointID", int(endpoint.ID)).
+				Msg("failed to set registry SA secret migration flag for endpoint")
+		}
+	}
+
+	return nil
+}
diff --git a/api/datastore/migrator/migrate_dbversion17.go b/api/datastore/migrator/migrate_dbversion17.go
new file mode 100644
index 0000000..0bd6cc0
--- /dev/null
+++ b/api/datastore/migrator/migrate_dbversion17.go
@@ -0,0 +1,135 @@
+package migrator
+
+import (
+	portainer "github.com/portainer/portainer/api"
+
+	"github.com/rs/zerolog/log"
+)
+
+func (m *Migrator) updateUsersToDBVersion18() error {
+	log.Info().Msg("updating users")
+
+	legacyUsers, err := m.userService.ReadAll()
+	if err != nil {
+		return err
+	}
+
+	for _, user := range legacyUsers {
+		user.PortainerAuthorizations = map[portainer.Authorization]bool{
+			portainer.OperationPortainerDockerHubInspect:        true,
+			portainer.OperationPortainerEndpointGroupList:       true,
+			portainer.OperationPortainerEndpointList:            true,
+			portainer.OperationPortainerEndpointInspect:         true,
+			portainer.OperationPortainerEndpointExtensionAdd:    true,
+			portainer.OperationPortainerEndpointExtensionRemove: true,
+			portainer.OperationPortainerExtensionList:           true,
+			portainer.OperationPortainerMOTD:                    true,
+			portainer.OperationPortainerRegistryList:            true,
+			portainer.OperationPortainerRegistryInspect:         true,
+			portainer.OperationPortainerTeamList:                true,
+			portainer.OperationPortainerTemplateList:            true,
+			portainer.OperationPortainerTemplateInspect:         true,
+			portainer.OperationPortainerUserList:                true,
+			portainer.OperationPortainerUserMemberships:         true,
+		}
+
+		err = m.userService.Update(user.ID, &user)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (m *Migrator) updateEndpointsToDBVersion18() error {
+	log.Info().Msg("updating endpoints")
+
+	legacyEndpoints, err := m.endpointService.Endpoints()
+	if err != nil {
+		return err
+	}
+
+	for _, endpoint := range legacyEndpoints {
+		endpoint.UserAccessPolicies = make(portainer.UserAccessPolicies)
+		for _, userID := range endpoint.AuthorizedUsers {
+			endpoint.UserAccessPolicies[userID] = portainer.AccessPolicy{
+				RoleID: 4,
+			}
+		}
+
+		endpoint.TeamAccessPolicies = make(portainer.TeamAccessPolicies)
+		for _, teamID := range endpoint.AuthorizedTeams {
+			endpoint.TeamAccessPolicies[teamID] = portainer.AccessPolicy{
+				RoleID: 4,
+			}
+		}
+
+		err = m.endpointService.UpdateEndpoint(endpoint.ID, &endpoint)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (m *Migrator) updateEndpointGroupsToDBVersion18() error {
+	log.Info().Msg("updating endpoint groups")
+
+	legacyEndpointGroups, err := m.endpointGroupService.ReadAll()
+	if err != nil {
+		return err
+	}
+
+	for _, endpointGroup := range legacyEndpointGroups {
+		endpointGroup.UserAccessPolicies = make(portainer.UserAccessPolicies)
+		for _, userID := range endpointGroup.AuthorizedUsers {
+			endpointGroup.UserAccessPolicies[userID] = portainer.AccessPolicy{
+				RoleID: 4,
+			}
+		}
+
+		endpointGroup.TeamAccessPolicies = make(portainer.TeamAccessPolicies)
+		for _, teamID := range endpointGroup.AuthorizedTeams {
+			endpointGroup.TeamAccessPolicies[teamID] = portainer.AccessPolicy{
+				RoleID: 4,
+			}
+		}
+
+		err = m.endpointGroupService.Update(endpointGroup.ID, &endpointGroup)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (m *Migrator) updateRegistriesToDBVersion18() error {
+	log.Info().Msg("updating registries")
+
+	legacyRegistries, err := m.registryService.ReadAll()
+	if err != nil {
+		return err
+	}
+
+	for _, registry := range legacyRegistries {
+		registry.UserAccessPolicies = make(portainer.UserAccessPolicies)
+		for _, userID := range registry.AuthorizedUsers {
+			registry.UserAccessPolicies[userID] = portainer.AccessPolicy{}
+		}
+
+		registry.TeamAccessPolicies = make(portainer.TeamAccessPolicies)
+		for _, teamID := range registry.AuthorizedTeams {
+			registry.TeamAccessPolicies[teamID] = portainer.AccessPolicy{}
+		}
+
+		err = m.registryService.Update(registry.ID, &registry)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
diff --git a/api/datastore/migrator/migrate_dbversion18.go b/api/datastore/migrator/migrate_dbversion18.go
new file mode 100644
index 0000000..9270694
--- /dev/null
+++ b/api/datastore/migrator/migrate_dbversion18.go
@@ -0,0 +1,22 @@
+package migrator
+
+import (
+	portainer "github.com/portainer/portainer/api"
+
+	"github.com/rs/zerolog/log"
+)
+
+func (m *Migrator) updateSettingsToDBVersion19() error {
+	log.Info().Msg("updating settings")
+
+	legacySettings, err := m.settingsService.Settings()
+	if err != nil {
+		return err
+	}
+
+	if legacySettings.EdgeAgentCheckinInterval == 0 {
+		legacySettings.EdgeAgentCheckinInterval = portainer.DefaultEdgeAgentCheckinIntervalInSeconds
+	}
+
+	return m.settingsService.UpdateSettings(legacySettings)
+}
diff --git a/api/datastore/migrator/migrate_dbversion19.go b/api/datastore/migrator/migrate_dbversion19.go
new file mode 100644
index 0000000..78375cd
--- /dev/null
+++ b/api/datastore/migrator/migrate_dbversion19.go
@@ -0,0 +1,64 @@
+package migrator
+
+import (
+	"strings"
+
+	"github.com/rs/zerolog/log"
+)
+
+const scheduleScriptExecutionJobType = 1
+
+func (m *Migrator) updateUsersToDBVersion20() error {
+	log.Info().Msg("updating user authentication")
+
+	return m.authorizationService.UpdateUsersAuthorizations()
+}
+
+func (m *Migrator) updateSettingsToDBVersion20() error {
+	log.Info().Msg("updating settings")
+	legacySettings, err := m.settingsService.Settings()
+	if err != nil {
+		return err
+	}
+
+	legacySettings.AllowVolumeBrowserForRegularUsers = false
+
+	return m.settingsService.UpdateSettings(legacySettings)
+}
+
+func (m *Migrator) updateSchedulesToDBVersion20() error {
+	log.Info().Msg("updating schedules")
+
+	legacySchedules, err := m.scheduleService.Schedules()
+	if err != nil {
+		return err
+	}
+
+	for _, schedule := range legacySchedules {
+		if schedule.JobType == scheduleScriptExecutionJobType {
+			if schedule.CronExpression == "0 0 * * *" {
+				schedule.CronExpression = "0 * * * *"
+			} else if schedule.CronExpression == "0 0 0/2 * *" {
+				schedule.CronExpression = "0 */2 * * *"
+			} else if schedule.CronExpression == "0 0 0 * *" {
+				schedule.CronExpression = "0 0 * * *"
+			} else {
+				revisedCronExpression := strings.Split(schedule.CronExpression, " ")
+				if len(revisedCronExpression) == 5 {
+					continue
+				}
+
+				revisedCronExpression = revisedCronExpression[1:]
+				schedule.CronExpression = strings.Join(revisedCronExpression, " ")
+			}
+
+			err := m.scheduleService.UpdateSchedule(schedule.ID, &schedule)
+			if err != nil {
+				return err
+			}
+		}
+
+	}
+
+	return nil
+}
diff --git a/api/datastore/migrator/migrate_dbversion20.go b/api/datastore/migrator/migrate_dbversion20.go
new file mode 100644
index 0000000..bad999c
--- /dev/null
+++ b/api/datastore/migrator/migrate_dbversion20.go
@@ -0,0 +1,99 @@
+package migrator
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/internal/authorization"
+
+	"github.com/rs/zerolog/log"
+)
+
+func (m *Migrator) updateResourceControlsToDBVersion22() error {
+	log.Info().Msg("updating resource controls")
+
+	legacyResourceControls, err := m.resourceControlService.ReadAll()
+	if err != nil {
+		return err
+	}
+
+	for _, resourceControl := range legacyResourceControls {
+		resourceControl.AdministratorsOnly = false
+
+		if err := m.resourceControlService.Update(resourceControl.ID, &resourceControl); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (m *Migrator) updateUsersAndRolesToDBVersion22() error {
+	log.Info().Msg("updating users and roles")
+
+	legacyUsers, err := m.userService.ReadAll()
+	if err != nil {
+		return err
+	}
+
+	settings, err := m.settingsService.Settings()
+	if err != nil {
+		return err
+	}
+
+	for _, user := range legacyUsers {
+		user.PortainerAuthorizations = authorization.DefaultPortainerAuthorizations()
+
+		if err := m.userService.Update(user.ID, &user); err != nil {
+			return err
+		}
+	}
+
+	endpointAdministratorRole, err := m.roleService.Read(portainer.RoleID(1))
+	if err != nil {
+		return err
+	}
+
+	endpointAdministratorRole.Priority = 1
+	endpointAdministratorRole.Authorizations = authorization.DefaultEndpointAuthorizationsForEndpointAdministratorRole()
+
+	if err := m.roleService.Update(endpointAdministratorRole.ID, endpointAdministratorRole); err != nil {
+		return err
+	}
+
+	helpDeskRole, err := m.roleService.Read(portainer.RoleID(2))
+	if err != nil {
+		return err
+	}
+
+	helpDeskRole.Priority = 2
+	helpDeskRole.Authorizations = authorization.DefaultEndpointAuthorizationsForHelpDeskRole(settings.AllowVolumeBrowserForRegularUsers)
+
+	if err := m.roleService.Update(helpDeskRole.ID, helpDeskRole); err != nil {
+		return err
+	}
+
+	standardUserRole, err := m.roleService.Read(portainer.RoleID(3))
+	if err != nil {
+		return err
+	}
+
+	standardUserRole.Priority = 3
+	standardUserRole.Authorizations = authorization.DefaultEndpointAuthorizationsForStandardUserRole(settings.AllowVolumeBrowserForRegularUsers)
+
+	if err := m.roleService.Update(standardUserRole.ID, standardUserRole); err != nil {
+		return err
+	}
+
+	readOnlyUserRole, err := m.roleService.Read(portainer.RoleID(4))
+	if err != nil {
+		return err
+	}
+
+	readOnlyUserRole.Priority = 4
+	readOnlyUserRole.Authorizations = authorization.DefaultEndpointAuthorizationsForReadOnlyUserRole(settings.AllowVolumeBrowserForRegularUsers)
+
+	if err := m.roleService.Update(readOnlyUserRole.ID, readOnlyUserRole); err != nil {
+		return err
+	}
+
+	return m.authorizationService.UpdateUsersAuthorizations()
+}
diff --git a/api/datastore/migrator/migrate_dbversion22.go b/api/datastore/migrator/migrate_dbversion22.go
new file mode 100644
index 0000000..ccf4665
--- /dev/null
+++ b/api/datastore/migrator/migrate_dbversion22.go
@@ -0,0 +1,102 @@
+package migrator
+
+import (
+	portainer "github.com/portainer/portainer/api"
+
+	"github.com/rs/zerolog/log"
+)
+
+func (m *Migrator) updateTagsToDBVersion23() error {
+	log.Info().Msg("updating tags")
+
+	tags, err := m.tagService.ReadAll()
+	if err != nil {
+		return err
+	}
+
+	for _, tag := range tags {
+		tag.EndpointGroups = make(map[portainer.EndpointGroupID]bool)
+		tag.Endpoints = make(map[portainer.EndpointID]bool)
+		err = m.tagService.Update(tag.ID, &tag)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (m *Migrator) updateEndpointsAndEndpointGroupsToDBVersion23() error {
+	log.Info().Msg("updating endpoints and endpoint groups")
+
+	tags, err := m.tagService.ReadAll()
+	if err != nil {
+		return err
+	}
+
+	tagsNameMap := make(map[string]portainer.Tag)
+	for _, tag := range tags {
+		tagsNameMap[tag.Name] = tag
+	}
+
+	endpoints, err := m.endpointService.Endpoints()
+	if err != nil {
+		return err
+	}
+
+	for _, endpoint := range endpoints {
+		endpointTags := make([]portainer.TagID, 0)
+		for _, tagName := range endpoint.Tags {
+			tag, ok := tagsNameMap[tagName]
+			if ok {
+				endpointTags = append(endpointTags, tag.ID)
+				tag.Endpoints[endpoint.ID] = true
+			}
+		}
+		endpoint.TagIDs = endpointTags
+		err = m.endpointService.UpdateEndpoint(endpoint.ID, &endpoint)
+		if err != nil {
+			return err
+		}
+
+		relation := &portainer.EndpointRelation{
+			EndpointID: endpoint.ID,
+			EdgeStacks: map[portainer.EdgeStackID]bool{},
+		}
+
+		err = m.endpointRelationService.Create(relation)
+		if err != nil {
+			return err
+		}
+	}
+
+	endpointGroups, err := m.endpointGroupService.ReadAll()
+	if err != nil {
+		return err
+	}
+
+	for _, endpointGroup := range endpointGroups {
+		endpointGroupTags := make([]portainer.TagID, 0)
+		for _, tagName := range endpointGroup.Tags {
+			tag, ok := tagsNameMap[tagName]
+			if ok {
+				endpointGroupTags = append(endpointGroupTags, tag.ID)
+				tag.EndpointGroups[endpointGroup.ID] = true
+			}
+		}
+		endpointGroup.TagIDs = endpointGroupTags
+		err = m.endpointGroupService.Update(endpointGroup.ID, &endpointGroup)
+		if err != nil {
+			return err
+		}
+	}
+
+	for _, tag := range tagsNameMap {
+		err = m.tagService.Update(tag.ID, &tag)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
diff --git a/api/datastore/migrator/migrate_dbversion23.go b/api/datastore/migrator/migrate_dbversion23.go
new file mode 100644
index 0000000..f501058
--- /dev/null
+++ b/api/datastore/migrator/migrate_dbversion23.go
@@ -0,0 +1,42 @@
+package migrator
+
+import (
+	portainer "github.com/portainer/portainer/api"
+
+	"github.com/rs/zerolog/log"
+)
+
+func (m *Migrator) updateSettingsToDB24() error {
+	log.Info().Msg("updating Settings")
+
+	legacySettings, err := m.settingsService.Settings()
+	if err != nil {
+		return err
+	}
+
+	legacySettings.AllowHostNamespaceForRegularUsers = true
+	legacySettings.AllowDeviceMappingForRegularUsers = true
+	legacySettings.AllowStackManagementForRegularUsers = true
+
+	return m.settingsService.UpdateSettings(legacySettings)
+}
+
+func (m *Migrator) updateStacksToDB24() error {
+	log.Info().Msg("updating stacks")
+
+	stacks, err := m.stackService.ReadAll()
+	if err != nil {
+		return err
+	}
+
+	for idx := range stacks {
+		stack := &stacks[idx]
+		stack.Status = portainer.StackStatusActive
+
+		if err := m.stackService.Update(stack.ID, stack); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
diff --git a/api/datastore/migrator/migrate_dbversion24.go b/api/datastore/migrator/migrate_dbversion24.go
new file mode 100644
index 0000000..33a0bab
--- /dev/null
+++ b/api/datastore/migrator/migrate_dbversion24.go
@@ -0,0 +1,28 @@
+package migrator
+
+import (
+	portainer "github.com/portainer/portainer/api"
+
+	"github.com/rs/zerolog/log"
+)
+
+func (m *Migrator) updateSettingsToDB25() error {
+	log.Info().Msg("updating settings")
+
+	legacySettings, err := m.settingsService.Settings()
+	if err != nil {
+		return err
+	}
+
+	// to keep the same migration functionality as before 2.20.0, we need to set the templates URL to v2
+	version2URL := "https://raw.githubusercontent.com/portainer/templates/master/templates-2.0.json"
+	if legacySettings.TemplatesURL == "" {
+		legacySettings.TemplatesURL = version2URL
+	}
+
+	legacySettings.UserSessionTimeout = portainer.DefaultUserSessionTimeout
+
+	legacySettings.AllowContainerCapabilitiesForRegularUsers = true
+
+	return m.settingsService.UpdateSettings(legacySettings)
+}
diff --git a/api/datastore/migrator/migrate_dbversion25.go b/api/datastore/migrator/migrate_dbversion25.go
new file mode 100644
index 0000000..dfaaa12
--- /dev/null
+++ b/api/datastore/migrator/migrate_dbversion25.go
@@ -0,0 +1,55 @@
+package migrator
+
+import (
+	portainer "github.com/portainer/portainer/api"
+
+	"github.com/rs/zerolog/log"
+)
+
+func (m *Migrator) updateEndpointSettingsToDB25() error {
+	log.Info().Msg("updating endpoint settings")
+
+	settings, err := m.settingsService.Settings()
+	if err != nil {
+		return err
+	}
+
+	endpoints, err := m.endpointService.Endpoints()
+	if err != nil {
+		return err
+	}
+
+	for i := range endpoints {
+		endpoint := endpoints[i]
+
+		securitySettings := portainer.EndpointSecuritySettings{}
+
+		if endpoint.Type == portainer.EdgeAgentOnDockerEnvironment ||
+			endpoint.Type == portainer.AgentOnDockerEnvironment ||
+			endpoint.Type == portainer.DockerEnvironment {
+
+			securitySettings = portainer.EndpointSecuritySettings{
+				AllowBindMountsForRegularUsers:            settings.AllowBindMountsForRegularUsers,
+				AllowContainerCapabilitiesForRegularUsers: settings.AllowContainerCapabilitiesForRegularUsers,
+				AllowDeviceMappingForRegularUsers:         settings.AllowDeviceMappingForRegularUsers,
+				AllowHostNamespaceForRegularUsers:         settings.AllowHostNamespaceForRegularUsers,
+				AllowPrivilegedModeForRegularUsers:        settings.AllowPrivilegedModeForRegularUsers,
+				AllowStackManagementForRegularUsers:       settings.AllowStackManagementForRegularUsers,
+			}
+
+			if endpoint.Type == portainer.AgentOnDockerEnvironment || endpoint.Type == portainer.EdgeAgentOnDockerEnvironment {
+				securitySettings.AllowVolumeBrowserForRegularUsers = settings.AllowVolumeBrowserForRegularUsers
+				securitySettings.EnableHostManagementFeatures = settings.EnableHostManagementFeatures
+			}
+		}
+
+		endpoint.SecuritySettings = securitySettings
+
+		err = m.endpointService.UpdateEndpoint(endpoint.ID, &endpoint)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
diff --git a/api/datastore/migrator/migrate_dbversion26.go b/api/datastore/migrator/migrate_dbversion26.go
new file mode 100644
index 0000000..9e68be2
--- /dev/null
+++ b/api/datastore/migrator/migrate_dbversion26.go
@@ -0,0 +1,44 @@
+package migrator
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+
+	"github.com/rs/zerolog/log"
+)
+
+func (m *Migrator) updateStackResourceControlToDB27() error {
+	log.Info().Msg("updating stack resource controls")
+
+	resourceControls, err := m.resourceControlService.ReadAll()
+	if err != nil {
+		return err
+	}
+
+	for _, resource := range resourceControls {
+		if resource.Type != portainer.StackResourceControl {
+			continue
+		}
+
+		stackName := resource.ResourceID
+
+		stack, err := m.stackService.StackByName(stackName)
+		if err != nil {
+			if dataservices.IsErrObjectNotFound(err) {
+				continue
+			}
+
+			return err
+		}
+
+		resource.ResourceID = stackutils.ResourceControlID(stack.EndpointID, stack.Name)
+
+		err = m.resourceControlService.Update(resource.ID, &resource)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
diff --git a/api/datastore/migrator/migrate_dbversion29.go b/api/datastore/migrator/migrate_dbversion29.go
new file mode 100644
index 0000000..ce54aef
--- /dev/null
+++ b/api/datastore/migrator/migrate_dbversion29.go
@@ -0,0 +1,24 @@
+package migrator
+
+import "github.com/rs/zerolog/log"
+
+func (m *Migrator) migrateDBVersionToDB30() error {
+	log.Info().Msg("updating legacy settings")
+
+	return m.MigrateSettingsToDB30()
+}
+
+// so setting to false and "", is what would happen without this code
+// I'm going to bet there's zero point to changing the value inthe DB
+// Public for testing
+func (m *Migrator) MigrateSettingsToDB30() error {
+	legacySettings, err := m.settingsService.Settings()
+	if err != nil {
+		return err
+	}
+
+	legacySettings.OAuthSettings.SSO = false
+	legacySettings.OAuthSettings.LogoutURI = ""
+
+	return m.settingsService.UpdateSettings(legacySettings)
+}
diff --git a/api/datastore/migrator/migrate_dbversion31.go b/api/datastore/migrator/migrate_dbversion31.go
new file mode 100644
index 0000000..09e7690
--- /dev/null
+++ b/api/datastore/migrator/migrate_dbversion31.go
@@ -0,0 +1,285 @@
+package migrator
+
+import (
+	"fmt"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+	snapshotutils "github.com/portainer/portainer/api/internal/snapshot"
+
+	"github.com/docker/docker/api/types/volume"
+	"github.com/rs/zerolog/log"
+)
+
+func (m *Migrator) migrateDBVersionToDB32() error {
+	err := m.updateRegistriesToDB32()
+	if err != nil {
+		return err
+	}
+
+	err = m.updateDockerhubToDB32()
+	if err != nil {
+		return err
+	}
+
+	if err := m.updateVolumeResourceControlToDB32(); err != nil {
+		return err
+	}
+
+	if err := m.kubeconfigExpiryToDB32(); err != nil {
+		return err
+	}
+
+	if err := m.helmRepositoryURLToDB32(); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (m *Migrator) updateRegistriesToDB32() error {
+	log.Info().Msg("updating registries")
+
+	registries, err := m.registryService.ReadAll()
+	if err != nil {
+		return err
+	}
+
+	endpoints, err := m.endpointService.Endpoints()
+	if err != nil {
+		return err
+	}
+
+	for _, registry := range registries {
+
+		registry.RegistryAccesses = portainer.RegistryAccesses{}
+
+		for _, endpoint := range endpoints {
+
+			filteredUserAccessPolicies := portainer.UserAccessPolicies{}
+			for userId, registryPolicy := range registry.UserAccessPolicies {
+				if _, found := endpoint.UserAccessPolicies[userId]; found {
+					filteredUserAccessPolicies[userId] = registryPolicy
+				}
+			}
+
+			filteredTeamAccessPolicies := portainer.TeamAccessPolicies{}
+			for teamId, registryPolicy := range registry.TeamAccessPolicies {
+				if _, found := endpoint.TeamAccessPolicies[teamId]; found {
+					filteredTeamAccessPolicies[teamId] = registryPolicy
+				}
+			}
+
+			registry.RegistryAccesses[endpoint.ID] = portainer.RegistryAccessPolicies{
+				UserAccessPolicies: filteredUserAccessPolicies,
+				TeamAccessPolicies: filteredTeamAccessPolicies,
+				Namespaces:         []string{},
+			}
+		}
+
+		if err := m.registryService.Update(registry.ID, &registry); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (m *Migrator) updateDockerhubToDB32() error {
+	log.Info().Msg("updating dockerhub")
+
+	dockerhub, err := m.dockerhubService.DockerHub()
+	if dataservices.IsErrObjectNotFound(err) {
+		return nil
+	} else if err != nil {
+		return err
+	}
+
+	if !dockerhub.Authentication {
+		return nil
+	}
+
+	registry := &portainer.Registry{
+		Type:             portainer.DockerHubRegistry,
+		Name:             "Dockerhub (authenticated - migrated)",
+		URL:              "docker.io",
+		Authentication:   true,
+		Username:         dockerhub.Username,
+		Password:         dockerhub.Password,
+		RegistryAccesses: portainer.RegistryAccesses{},
+	}
+
+	// The following code will make this function idempotent.
+	// i.e. if run again, it will not change the data.  It will ensure that
+	// we only have one migrated registry entry. Duplicates will be removed
+	// if they exist and which has been happening due to earlier migration bugs
+	migrated := false
+	registries, _ := m.registryService.ReadAll()
+	for _, r := range registries {
+		if r.Type == registry.Type &&
+			r.Name == registry.Name &&
+			r.URL == registry.URL &&
+			r.Authentication == registry.Authentication {
+
+			if !migrated {
+				// keep this one entry
+				migrated = true
+				// delete subsequent duplicates
+			} else if err := m.registryService.Delete(r.ID); err != nil {
+				return err
+			}
+
+		}
+	}
+
+	if migrated {
+		return nil
+	}
+
+	endpoints, err := m.endpointService.Endpoints()
+	if err != nil {
+		return err
+	}
+
+	for _, endpoint := range endpoints {
+		if endpoint.Type != portainer.KubernetesLocalEnvironment &&
+			endpoint.Type != portainer.AgentOnKubernetesEnvironment &&
+			endpoint.Type != portainer.EdgeAgentOnKubernetesEnvironment {
+
+			userAccessPolicies := portainer.UserAccessPolicies{}
+			for userId := range endpoint.UserAccessPolicies {
+				if _, found := endpoint.UserAccessPolicies[userId]; found {
+					userAccessPolicies[userId] = portainer.AccessPolicy{RoleID: 0}
+				}
+			}
+
+			teamAccessPolicies := portainer.TeamAccessPolicies{}
+			for teamId := range endpoint.TeamAccessPolicies {
+				if _, found := endpoint.TeamAccessPolicies[teamId]; found {
+					teamAccessPolicies[teamId] = portainer.AccessPolicy{RoleID: 0}
+				}
+			}
+
+			registry.RegistryAccesses[endpoint.ID] = portainer.RegistryAccessPolicies{
+				UserAccessPolicies: userAccessPolicies,
+				TeamAccessPolicies: teamAccessPolicies,
+				Namespaces:         []string{},
+			}
+		}
+	}
+
+	return m.registryService.Create(registry)
+}
+
+func (m *Migrator) updateVolumeResourceControlToDB32() error {
+	log.Info().Msg("updating resource controls")
+
+	endpoints, err := m.endpointService.Endpoints()
+	if err != nil {
+		return fmt.Errorf("failed fetching environments: %w", err)
+	}
+
+	resourceControls, err := m.resourceControlService.ReadAll()
+	if err != nil {
+		return fmt.Errorf("failed fetching resource controls: %w", err)
+	}
+
+	toUpdate := map[portainer.ResourceControlID]string{}
+	volumeResourceControls := map[string]*portainer.ResourceControl{}
+
+	for i := range resourceControls {
+		resourceControl := resourceControls[i]
+		if resourceControl.Type == portainer.VolumeResourceControl {
+			volumeResourceControls[resourceControl.ResourceID] = &resourceControl
+		}
+	}
+
+	for _, endpoint := range endpoints {
+		if !endpointutils.IsDockerEndpoint(&endpoint) {
+			continue
+		}
+
+		totalSnapshots := len(endpoint.Snapshots)
+		if totalSnapshots == 0 {
+			log.Debug().Msg("no snapshot found")
+			continue
+		}
+
+		snapshot := endpoint.Snapshots[totalSnapshots-1]
+
+		endpointDockerID, err := snapshotutils.FetchDockerID(snapshot)
+		if err != nil {
+			log.Warn().Err(err).Msg("failed fetching environment docker id")
+			continue
+		}
+
+		volumesData := snapshot.SnapshotRaw.Volumes
+		if volumesData.Volumes == nil {
+			log.Debug().Msg("no volume data found")
+			continue
+		}
+
+		findResourcesToUpdateForDB32(endpointDockerID, volumesData, toUpdate, volumeResourceControls)
+
+	}
+
+	for _, resourceControl := range volumeResourceControls {
+		if newResourceID, ok := toUpdate[resourceControl.ID]; ok {
+			resourceControl.ResourceID = newResourceID
+
+			err := m.resourceControlService.Update(resourceControl.ID, resourceControl)
+			if err != nil {
+				return fmt.Errorf("failed updating resource control %d: %w", resourceControl.ID, err)
+			}
+		} else {
+			err := m.resourceControlService.Delete(resourceControl.ID)
+			if err != nil {
+				return fmt.Errorf("failed deleting resource control %d: %w", resourceControl.ID, err)
+			}
+
+			log.Debug().Str("resource_id", resourceControl.ResourceID).Msg("legacy resource control has been deleted")
+		}
+	}
+
+	return nil
+}
+
+func findResourcesToUpdateForDB32(dockerID string, volumesData volume.ListResponse, toUpdate map[portainer.ResourceControlID]string, volumeResourceControls map[string]*portainer.ResourceControl) {
+	volumes := volumesData.Volumes
+	for _, volume := range volumes {
+		volumeName := volume.Name
+		createTime := volume.CreatedAt
+
+		oldResourceID := fmt.Sprintf("%s%s", volumeName, createTime)
+		resourceControl, ok := volumeResourceControls[oldResourceID]
+
+		if ok {
+			toUpdate[resourceControl.ID] = fmt.Sprintf("%s_%s", volumeName, dockerID)
+		}
+	}
+}
+
+func (m *Migrator) kubeconfigExpiryToDB32() error {
+	log.Info().Msg("updating kubeconfig expiry")
+
+	settings, err := m.settingsService.Settings()
+	if err != nil {
+		return err
+	}
+
+	settings.KubeconfigExpiry = portainer.DefaultKubeconfigExpiry
+	return m.settingsService.UpdateSettings(settings)
+}
+
+func (m *Migrator) helmRepositoryURLToDB32() error {
+	log.Info().Msg("setting default helm repository URL")
+
+	settings, err := m.settingsService.Settings()
+	if err != nil {
+		return err
+	}
+
+	settings.HelmRepositoryURL = portainer.DefaultHelmRepositoryURL
+	return m.settingsService.UpdateSettings(settings)
+}
diff --git a/api/datastore/migrator/migrate_dbversion32.go b/api/datastore/migrator/migrate_dbversion32.go
new file mode 100644
index 0000000..391e01b
--- /dev/null
+++ b/api/datastore/migrator/migrate_dbversion32.go
@@ -0,0 +1,24 @@
+package migrator
+
+import (
+	"github.com/rs/zerolog/log"
+)
+
+func (m *Migrator) migrateDBVersionToDB33() error {
+	log.Info().Msg("updating settings")
+
+	return m.migrateSettingsToDB33()
+}
+
+func (m *Migrator) migrateSettingsToDB33() error {
+	log.Info().Msg("setting default kubctl shell")
+	settings, err := m.settingsService.Settings()
+	if err != nil {
+		return err
+	}
+
+	log.Info().Msg("setting default kubectl shell image")
+	settings.KubectlShellImage = *m.flags.KubectlShellImage
+
+	return m.settingsService.UpdateSettings(settings)
+}
diff --git a/api/datastore/migrator/migrate_dbversion33.go b/api/datastore/migrator/migrate_dbversion33.go
new file mode 100644
index 0000000..1268298
--- /dev/null
+++ b/api/datastore/migrator/migrate_dbversion33.go
@@ -0,0 +1,35 @@
+package migrator
+
+import (
+	"github.com/portainer/portainer/api/dataservices"
+
+	"github.com/rs/zerolog/log"
+)
+
+func (m *Migrator) migrateDBVersionToDB34() error {
+	log.Info().Msg("updating stacks")
+
+	return MigrateStackEntryPoint(m.stackService)
+}
+
+// MigrateStackEntryPoint exported for testing
+func MigrateStackEntryPoint(stackService dataservices.StackService) error {
+	stacks, err := stackService.ReadAll()
+	if err != nil {
+		return err
+	}
+
+	for i := range stacks {
+		stack := &stacks[i]
+		if stack.GitConfig == nil {
+			continue
+		}
+
+		stack.GitConfig.ConfigFilePath = stack.EntryPoint
+		if err := stackService.Update(stack.ID, stack); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
diff --git a/api/datastore/migrator/migrate_dbversion34.go b/api/datastore/migrator/migrate_dbversion34.go
new file mode 100644
index 0000000..870194e
--- /dev/null
+++ b/api/datastore/migrator/migrate_dbversion34.go
@@ -0,0 +1,7 @@
+package migrator
+
+func (m *Migrator) migrateDBVersionToDB35() error {
+	// These should have been migrated already, but due to an earlier bug and a bunch of duplicates,
+	// calling it again will now fix the issue as the function has been repaired.
+	return m.updateDockerhubToDB32()
+}
diff --git a/api/datastore/migrator/migrate_dbversion35.go b/api/datastore/migrator/migrate_dbversion35.go
new file mode 100644
index 0000000..726ecfb
--- /dev/null
+++ b/api/datastore/migrator/migrate_dbversion35.go
@@ -0,0 +1,37 @@
+package migrator
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/internal/authorization"
+
+	"github.com/rs/zerolog/log"
+)
+
+func (m *Migrator) migrateDBVersionToDB36() error {
+	log.Info().Msg("updating user authorizations")
+
+	return m.migrateUsersToDB36()
+}
+
+func (m *Migrator) migrateUsersToDB36() error {
+	log.Info().Msg("updating user authorizations")
+
+	users, err := m.userService.ReadAll()
+	if err != nil {
+		return err
+	}
+
+	for _, user := range users {
+		currentAuthorizations := authorization.DefaultPortainerAuthorizations()
+		currentAuthorizations[portainer.OperationPortainerUserListToken] = true
+		currentAuthorizations[portainer.OperationPortainerUserCreateToken] = true
+		currentAuthorizations[portainer.OperationPortainerUserRevokeToken] = true
+		user.PortainerAuthorizations = currentAuthorizations
+		err = m.userService.Update(user.ID, &user)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
diff --git a/api/datastore/migrator/migrate_dbversion40.go b/api/datastore/migrator/migrate_dbversion40.go
new file mode 100644
index 0000000..a33e1d2
--- /dev/null
+++ b/api/datastore/migrator/migrate_dbversion40.go
@@ -0,0 +1,32 @@
+package migrator
+
+import (
+	"github.com/portainer/portainer/api/internal/endpointutils"
+
+	"github.com/rs/zerolog/log"
+)
+
+func (m *Migrator) migrateDBVersionToDB40() error {
+	return m.trustCurrentEdgeEndpointsDB40()
+}
+
+func (m *Migrator) trustCurrentEdgeEndpointsDB40() error {
+	log.Info().Msg("trusting current edge endpoints")
+
+	endpoints, err := m.endpointService.Endpoints()
+	if err != nil {
+		return err
+	}
+
+	for _, endpoint := range endpoints {
+		if endpointutils.IsEdgeEndpoint(&endpoint) {
+			endpoint.UserTrusted = true
+			err = m.endpointService.UpdateEndpoint(endpoint.ID, &endpoint)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
diff --git a/api/datastore/migrator/migrate_dbversion50.go b/api/datastore/migrator/migrate_dbversion50.go
new file mode 100644
index 0000000..8a58f4e
--- /dev/null
+++ b/api/datastore/migrator/migrate_dbversion50.go
@@ -0,0 +1,22 @@
+package migrator
+
+import (
+	"github.com/pkg/errors"
+	"github.com/rs/zerolog/log"
+)
+
+func (m *Migrator) migrateDBVersionToDB50() error {
+	return m.migratePasswordLengthSettings()
+}
+
+func (m *Migrator) migratePasswordLengthSettings() error {
+	log.Info().Msg("updating required password length")
+
+	s, err := m.settingsService.Settings()
+	if err != nil {
+		return errors.Wrap(err, "unable to retrieve settings")
+	}
+
+	s.InternalAuthSettings.RequiredPasswordLength = 12
+	return m.settingsService.UpdateSettings(s)
+}
diff --git a/api/datastore/migrator/migrate_dbversion60.go b/api/datastore/migrator/migrate_dbversion60.go
new file mode 100644
index 0000000..fc7fa50
--- /dev/null
+++ b/api/datastore/migrator/migrate_dbversion60.go
@@ -0,0 +1,32 @@
+package migrator
+
+import (
+	portainer "github.com/portainer/portainer/api"
+
+	"github.com/rs/zerolog/log"
+)
+
+func (m *Migrator) migrateDBVersionToDB60() error {
+	return m.addGpuInputFieldDB60()
+}
+
+func (m *Migrator) addGpuInputFieldDB60() error {
+	log.Info().Msg("add gpu input field")
+
+	endpoints, err := m.endpointService.Endpoints()
+	if err != nil {
+		return err
+	}
+
+	for _, endpoint := range endpoints {
+		if endpoint.Gpus == nil {
+			endpoint.Gpus = []portainer.Pair{}
+			err = m.endpointService.UpdateEndpoint(endpoint.ID, &endpoint)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
diff --git a/api/datastore/migrator/migrate_dbversion70.go b/api/datastore/migrator/migrate_dbversion70.go
new file mode 100644
index 0000000..0106cde
--- /dev/null
+++ b/api/datastore/migrator/migrate_dbversion70.go
@@ -0,0 +1,71 @@
+package migrator
+
+import (
+	portainer "github.com/portainer/portainer/api"
+
+	"github.com/rs/zerolog/log"
+)
+
+func (m *Migrator) migrateDBVersionToDB70() error {
+	log.Info().Msg("add IngressAvailabilityPerNamespace field")
+	if err := m.updateIngressFieldsForEnvDB70(); err != nil {
+		return err
+	}
+
+	endpoints, err := m.endpointService.Endpoints()
+	if err != nil {
+		return err
+	}
+
+	for _, endpoint := range endpoints {
+		// copy snapshots to new object
+		log.Info().Msg("moving snapshots from endpoint to new object")
+		snapshot := portainer.Snapshot{EndpointID: endpoint.ID}
+
+		if len(endpoint.Snapshots) > 0 {
+			snapshot.Docker = &endpoint.Snapshots[len(endpoint.Snapshots)-1]
+		}
+
+		if len(endpoint.Kubernetes.Snapshots) > 0 {
+			snapshot.Kubernetes = &endpoint.Kubernetes.Snapshots[len(endpoint.Kubernetes.Snapshots)-1]
+		}
+
+		// save new object
+		err = m.snapshotService.Create(&snapshot)
+		if err != nil {
+			return err
+		}
+
+		// set to nil old fields
+		log.Info().Msg("deleting snapshot from endpoint")
+		endpoint.Snapshots = []portainer.DockerSnapshot{}
+		endpoint.Kubernetes.Snapshots = []portainer.KubernetesSnapshot{}
+
+		// update endpoint
+		err = m.endpointService.UpdateEndpoint(endpoint.ID, &endpoint)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (m *Migrator) updateIngressFieldsForEnvDB70() error {
+	endpoints, err := m.endpointService.Endpoints()
+	if err != nil {
+		return err
+	}
+
+	for _, endpoint := range endpoints {
+		endpoint.Kubernetes.Configuration.IngressAvailabilityPerNamespace = true
+		endpoint.Kubernetes.Configuration.AllowNoneIngressClass = false
+		endpoint.PostInitMigrations.MigrateIngresses = true
+
+		err = m.endpointService.UpdateEndpoint(endpoint.ID, &endpoint)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
diff --git a/api/datastore/migrator/migrate_dbversion71.go b/api/datastore/migrator/migrate_dbversion71.go
new file mode 100644
index 0000000..d1081a8
--- /dev/null
+++ b/api/datastore/migrator/migrate_dbversion71.go
@@ -0,0 +1,36 @@
+package migrator
+
+import (
+	"github.com/portainer/portainer/api/dataservices"
+
+	"github.com/rs/zerolog/log"
+)
+
+func (m *Migrator) migrateDBVersionToDB71() error {
+	log.Info().Msg("removing orphaned snapshots")
+
+	snapshots, err := m.snapshotService.ReadAll()
+	if err != nil {
+		return err
+	}
+
+	for _, s := range snapshots {
+		_, err := m.endpointService.Endpoint(s.EndpointID)
+		if err == nil {
+			log.Debug().Int("endpoint_id", int(s.EndpointID)).Msg("keeping snapshot")
+			continue
+		} else if !dataservices.IsErrObjectNotFound(err) {
+			log.Debug().Int("endpoint_id", int(s.EndpointID)).Err(err).Msg("database error")
+			return err
+		}
+
+		log.Debug().Int("endpoint_id", int(s.EndpointID)).Msg("removing snapshot")
+
+		err = m.snapshotService.Delete(s.EndpointID)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
diff --git a/api/datastore/migrator/migrate_dbversion80.go b/api/datastore/migrator/migrate_dbversion80.go
new file mode 100644
index 0000000..a738e51
--- /dev/null
+++ b/api/datastore/migrator/migrate_dbversion80.go
@@ -0,0 +1,106 @@
+package migrator
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+
+	"github.com/rs/zerolog/log"
+)
+
+func (m *Migrator) migrateDBVersionToDB80() error {
+	if err := m.updateEdgeStackStatusForDB80(); err != nil {
+		return err
+	}
+
+	if err := m.updateExistingEndpointsToNotDetectMetricsAPIForDB80(); err != nil {
+		return err
+	}
+
+	if err := m.updateExistingEndpointsToNotDetectStorageAPIForDB80(); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (m *Migrator) updateExistingEndpointsToNotDetectMetricsAPIForDB80() error {
+	log.Info().Msg("updating existing endpoints to not detect metrics API for existing endpoints (k8s)")
+
+	endpoints, err := m.endpointService.Endpoints()
+	if err != nil {
+		return err
+	}
+
+	for _, endpoint := range endpoints {
+		if endpointutils.IsKubernetesEndpoint(&endpoint) {
+			endpoint.Kubernetes.Flags.IsServerMetricsDetected = true
+			err = m.endpointService.UpdateEndpoint(endpoint.ID, &endpoint)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
+
+func (m *Migrator) updateExistingEndpointsToNotDetectStorageAPIForDB80() error {
+	log.Info().Msg("updating existing endpoints to not detect metrics API for existing endpoints (k8s)")
+
+	endpoints, err := m.endpointService.Endpoints()
+	if err != nil {
+		return err
+	}
+
+	for _, endpoint := range endpoints {
+		if endpointutils.IsKubernetesEndpoint(&endpoint) {
+			endpoint.Kubernetes.Flags.IsServerStorageDetected = true
+			err = m.endpointService.UpdateEndpoint(endpoint.ID, &endpoint)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
+
+func (m *Migrator) updateEdgeStackStatusForDB80() error {
+	log.Info().Msg("transfer type field to details field for edge stack status")
+
+	edgeStacks, err := m.edgeStackService.EdgeStacks()
+	if err != nil {
+		return err
+	}
+
+	for _, edgeStack := range edgeStacks {
+		for endpointId, status := range edgeStack.Status {
+			if status.Details == nil {
+				status.Details = &portainer.EdgeStackStatusDetails{}
+			}
+
+			switch status.Type {
+			case portainer.EdgeStackStatusPending:
+				status.Details.Pending = true
+			case portainer.EdgeStackStatusDeploymentReceived:
+				status.Details.Ok = true
+			case portainer.EdgeStackStatusError:
+				status.Details.Error = true
+			case portainer.EdgeStackStatusAcknowledged:
+				status.Details.Acknowledged = true
+			case portainer.EdgeStackStatusRemoved:
+				status.Details.Remove = true
+			case portainer.EdgeStackStatusRemoteUpdateSuccess:
+				status.Details.RemoteUpdateSuccess = true
+			}
+
+			edgeStack.Status[endpointId] = status
+		}
+
+		if err := m.edgeStackService.UpdateEdgeStack(edgeStack.ID, &edgeStack); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
diff --git a/api/datastore/migrator/migrate_dbversion90.go b/api/datastore/migrator/migrate_dbversion90.go
new file mode 100644
index 0000000..129def8
--- /dev/null
+++ b/api/datastore/migrator/migrate_dbversion90.go
@@ -0,0 +1,92 @@
+package migrator
+
+import (
+	"github.com/rs/zerolog/log"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+)
+
+func (m *Migrator) migrateDBVersionToDB90() error {
+	if err := m.updateUserThemeForDB90(); err != nil {
+		return err
+	}
+
+	if err := m.updateEnableGpuManagementFeatures(); err != nil {
+		return err
+	}
+
+	return m.updateEdgeStackStatusForDB90()
+}
+
+func (m *Migrator) updateEdgeStackStatusForDB90() error {
+	log.Info().Msg("clean up deleted endpoints from edge jobs")
+
+	edgeJobs, err := m.edgeJobService.ReadAll()
+	if err != nil {
+		return err
+	}
+
+	for _, edgeJob := range edgeJobs {
+		for endpointId := range edgeJob.Endpoints {
+			_, err := m.endpointService.Endpoint(endpointId)
+			if dataservices.IsErrObjectNotFound(err) {
+				delete(edgeJob.Endpoints, endpointId)
+
+				err = m.edgeJobService.Update(edgeJob.ID, &edgeJob)
+				if err != nil {
+					return err
+				}
+			}
+		}
+	}
+
+	return nil
+}
+
+func (m *Migrator) updateUserThemeForDB90() error {
+	log.Info().Msg("updating existing user theme settings")
+
+	users, err := m.userService.ReadAll()
+	if err != nil {
+		return err
+	}
+
+	for i := range users {
+		user := &users[i]
+		if user.UserTheme != "" {
+			user.ThemeSettings.Color = user.UserTheme
+		}
+
+		if err := m.userService.Update(user.ID, user); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (m *Migrator) updateEnableGpuManagementFeatures() error {
+	// get all environments
+	environments, err := m.endpointService.Endpoints()
+	if err != nil {
+		return err
+	}
+
+	for _, environment := range environments {
+		if environment.Type == portainer.DockerEnvironment {
+			// set the PostInitMigrations.MigrateGPUs to true on this environment to run the migration only on the 2.18 upgrade
+			environment.PostInitMigrations.MigrateGPUs = true
+			// if there's one or more gpu, set the EnableGpuManagement setting to true
+			gpuList := environment.Gpus
+			if len(gpuList) > 0 {
+				environment.EnableGPUManagement = true
+			}
+			// update the environment
+			if err := m.endpointService.UpdateEndpoint(environment.ID, &environment); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
diff --git a/api/datastore/migrator/migrator.go b/api/datastore/migrator/migrator.go
new file mode 100644
index 0000000..f7fd38f
--- /dev/null
+++ b/api/datastore/migrator/migrator.go
@@ -0,0 +1,294 @@
+package migrator
+
+import (
+	"errors"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/database/models"
+	"github.com/portainer/portainer/api/dataservices/customtemplate"
+	"github.com/portainer/portainer/api/dataservices/dockerhub"
+	"github.com/portainer/portainer/api/dataservices/edgegroup"
+	"github.com/portainer/portainer/api/dataservices/edgejob"
+	"github.com/portainer/portainer/api/dataservices/edgestack"
+	"github.com/portainer/portainer/api/dataservices/edgestackstatus"
+	"github.com/portainer/portainer/api/dataservices/endpoint"
+	"github.com/portainer/portainer/api/dataservices/endpointgroup"
+	"github.com/portainer/portainer/api/dataservices/endpointrelation"
+	"github.com/portainer/portainer/api/dataservices/extension"
+	"github.com/portainer/portainer/api/dataservices/pendingactions"
+	"github.com/portainer/portainer/api/dataservices/registry"
+	"github.com/portainer/portainer/api/dataservices/resourcecontrol"
+	"github.com/portainer/portainer/api/dataservices/role"
+	"github.com/portainer/portainer/api/dataservices/schedule"
+	"github.com/portainer/portainer/api/dataservices/settings"
+	"github.com/portainer/portainer/api/dataservices/snapshot"
+	"github.com/portainer/portainer/api/dataservices/source"
+	"github.com/portainer/portainer/api/dataservices/stack"
+	"github.com/portainer/portainer/api/dataservices/tag"
+	"github.com/portainer/portainer/api/dataservices/teammembership"
+	"github.com/portainer/portainer/api/dataservices/tunnelserver"
+	"github.com/portainer/portainer/api/dataservices/user"
+	"github.com/portainer/portainer/api/dataservices/version"
+	"github.com/portainer/portainer/api/dataservices/workflow"
+	"github.com/portainer/portainer/api/internal/authorization"
+
+	"github.com/Masterminds/semver/v3"
+	"github.com/rs/zerolog/log"
+)
+
+type (
+	// Migrator defines a service to migrate data after a Portainer version update.
+	Migrator struct {
+		flags            *portainer.CLIFlags
+		currentDBVersion *models.Version
+		migrations       []Migrations
+
+		endpointGroupService    *endpointgroup.Service
+		endpointService         *endpoint.Service
+		endpointRelationService *endpointrelation.Service
+		extensionService        *extension.Service
+		registryService         *registry.Service
+		resourceControlService  *resourcecontrol.Service
+		roleService             *role.Service
+		scheduleService         *schedule.Service
+		settingsService         *settings.Service
+		snapshotService         *snapshot.Service
+		stackService            *stack.Service
+		tagService              *tag.Service
+		teamMembershipService   *teammembership.Service
+		userService             *user.Service
+		versionService          *version.Service
+		fileService             portainer.FileService
+		authorizationService    *authorization.Service
+		dockerhubService        *dockerhub.Service
+		edgeStackService        *edgestack.Service
+		edgeStackStatusService  *edgestackstatus.Service
+		edgeJobService          *edgejob.Service
+		edgeGroupService        *edgegroup.Service
+		TunnelServerService     *tunnelserver.Service
+		pendingActionsService   *pendingactions.Service
+		customTemplateService   *customtemplate.Service
+		sourceService           *source.Service
+		workflowService         *workflow.Service
+	}
+
+	// MigratorParameters represents the required parameters to create a new Migrator instance.
+	MigratorParameters struct {
+		Flags                   *portainer.CLIFlags
+		CurrentDBVersion        *models.Version
+		EndpointGroupService    *endpointgroup.Service
+		EndpointService         *endpoint.Service
+		EndpointRelationService *endpointrelation.Service
+		ExtensionService        *extension.Service
+		RegistryService         *registry.Service
+		ResourceControlService  *resourcecontrol.Service
+		RoleService             *role.Service
+		ScheduleService         *schedule.Service
+		SettingsService         *settings.Service
+		SnapshotService         *snapshot.Service
+		StackService            *stack.Service
+		TagService              *tag.Service
+		TeamMembershipService   *teammembership.Service
+		UserService             *user.Service
+		VersionService          *version.Service
+		FileService             portainer.FileService
+		AuthorizationService    *authorization.Service
+		DockerhubService        *dockerhub.Service
+		EdgeStackService        *edgestack.Service
+		EdgeStackStatusService  *edgestackstatus.Service
+		EdgeJobService          *edgejob.Service
+		EdgeGroupService        *edgegroup.Service
+		TunnelServerService     *tunnelserver.Service
+		PendingActionsService   *pendingactions.Service
+		CustomTemplateService   *customtemplate.Service
+		SourceService           *source.Service
+		WorkflowService         *workflow.Service
+	}
+)
+
+// NewMigrator creates a new Migrator.
+func NewMigrator(parameters *MigratorParameters) *Migrator {
+	migrator := &Migrator{
+		flags:                   parameters.Flags,
+		currentDBVersion:        parameters.CurrentDBVersion,
+		endpointGroupService:    parameters.EndpointGroupService,
+		endpointService:         parameters.EndpointService,
+		endpointRelationService: parameters.EndpointRelationService,
+		extensionService:        parameters.ExtensionService,
+		registryService:         parameters.RegistryService,
+		resourceControlService:  parameters.ResourceControlService,
+		roleService:             parameters.RoleService,
+		scheduleService:         parameters.ScheduleService,
+		settingsService:         parameters.SettingsService,
+		snapshotService:         parameters.SnapshotService,
+		tagService:              parameters.TagService,
+		teamMembershipService:   parameters.TeamMembershipService,
+		stackService:            parameters.StackService,
+		userService:             parameters.UserService,
+		versionService:          parameters.VersionService,
+		fileService:             parameters.FileService,
+		authorizationService:    parameters.AuthorizationService,
+		dockerhubService:        parameters.DockerhubService,
+		edgeStackService:        parameters.EdgeStackService,
+		edgeStackStatusService:  parameters.EdgeStackStatusService,
+		edgeJobService:          parameters.EdgeJobService,
+		edgeGroupService:        parameters.EdgeGroupService,
+		TunnelServerService:     parameters.TunnelServerService,
+		pendingActionsService:   parameters.PendingActionsService,
+		customTemplateService:   parameters.CustomTemplateService,
+		sourceService:           parameters.SourceService,
+		workflowService:         parameters.WorkflowService,
+	}
+
+	migrator.initMigrations()
+
+	return migrator
+}
+
+func (m *Migrator) CurrentDBVersion() string {
+	return m.currentDBVersion.SchemaVersion
+}
+
+func (m *Migrator) CurrentDBEdition() portainer.SoftwareEdition {
+	return portainer.SoftwareEdition(m.currentDBVersion.Edition)
+}
+
+func (m *Migrator) CurrentSemanticDBVersion() *semver.Version {
+	v, err := semver.NewVersion(m.currentDBVersion.SchemaVersion)
+	if err != nil {
+		log.Fatal().Stack().Err(err).Msg("failed to parse current version")
+	}
+
+	return v
+}
+
+func (m *Migrator) addMigrations(v string, funcs ...func() error) {
+	m.migrations = append(m.migrations, Migrations{
+		Version:        semver.MustParse(v),
+		MigrationFuncs: funcs,
+	})
+}
+
+func (m *Migrator) LatestMigrations() Migrations {
+	return m.migrations[len(m.migrations)-1]
+}
+
+func (m *Migrator) GetMigratorCountOfCurrentAPIVersion() int {
+	migratorCount := 0
+	latestMigrations := m.LatestMigrations()
+
+	if latestMigrations.Version.Equal(semver.MustParse(portainer.APIVersion)) {
+		migratorCount = len(latestMigrations.MigrationFuncs)
+	}
+
+	return migratorCount
+}
+
+// !NOTE: Migration funtions should ideally be idempotent.
+// !      Which simply means the function can run over the same data many times but only transform it once.
+// !      In practice this really just means an extra check or two to ensure we're not destroying valid data.
+// !      This is not a hard rule though.  Understand the limitations.  A migration function may only run over
+// !      the data more than once if a new migration function is added and the version of your database schema is
+// !      the same.  e.g. two developers working on the same version add two different functions for different things.
+// !      This increases the migration funcs count and so they all run again.
+
+type Migrations struct {
+	Version        *semver.Version
+	MigrationFuncs MigrationFuncs
+}
+
+type MigrationFuncs []func() error
+
+func (m *Migrator) initMigrations() {
+	// !IMPORTANT: Do not be tempted to alter the order of these migrations.
+	// !           Even though one of them looks out of order. Caused by history related
+	// !           to maintaining two versions and releasing at different times
+
+	m.addMigrations("1.0.0", dbTooOldError) // default version found after migration
+
+	m.addMigrations("1.21",
+		m.updateUsersToDBVersion18,
+		m.updateEndpointsToDBVersion18,
+		m.updateEndpointGroupsToDBVersion18,
+		m.updateRegistriesToDBVersion18)
+
+	m.addMigrations("1.22", m.updateSettingsToDBVersion19)
+
+	m.addMigrations("1.22.1",
+		m.updateUsersToDBVersion20,
+		m.updateSettingsToDBVersion20,
+		m.updateSchedulesToDBVersion20)
+
+	m.addMigrations("1.23",
+		m.updateResourceControlsToDBVersion22,
+		m.updateUsersAndRolesToDBVersion22)
+
+	m.addMigrations("1.24",
+		m.updateTagsToDBVersion23,
+		m.updateEndpointsAndEndpointGroupsToDBVersion23)
+
+	m.addMigrations("1.24.1", m.updateSettingsToDB24)
+
+	m.addMigrations("2.0",
+		m.updateSettingsToDB25,
+		m.updateStacksToDB24)
+
+	m.addMigrations("2.1", m.updateEndpointSettingsToDB25)
+	m.addMigrations("2.2", m.updateStackResourceControlToDB27)
+	m.addMigrations("2.6", m.migrateDBVersionToDB30)
+	m.addMigrations("2.9", m.migrateDBVersionToDB32)
+	m.addMigrations("2.9.2", m.migrateDBVersionToDB33)
+	m.addMigrations("2.10.0", m.migrateDBVersionToDB34)
+	m.addMigrations("2.9.3", m.migrateDBVersionToDB35)
+	m.addMigrations("2.12", m.migrateDBVersionToDB36)
+	m.addMigrations("2.13", m.migrateDBVersionToDB40)
+	m.addMigrations("2.14", m.migrateDBVersionToDB50)
+	m.addMigrations("2.15", m.migrateDBVersionToDB60)
+	m.addMigrations("2.16", m.migrateDBVersionToDB70)
+	m.addMigrations("2.16.1", m.migrateDBVersionToDB71)
+	m.addMigrations("2.17", m.migrateDBVersionToDB80)
+	m.addMigrations("2.18", m.migrateDBVersionToDB90)
+	m.addMigrations("2.19",
+		m.convertSeedToPrivateKeyForDB100,
+		m.migrateDockerDesktopExtensionSetting,
+		m.updateEdgeStackStatusForDB100,
+	)
+	m.addMigrations("2.20",
+		m.updateAppTemplatesVersionForDB110,
+		m.updateResourceOverCommitToDB110,
+	)
+	m.addMigrations("2.20.2",
+		m.cleanPendingActionsForDeletedEndpointsForDB111,
+	)
+	m.addMigrations("2.22.0",
+		m.migratePendingActionsDataForDB130,
+	)
+
+	m.addMigrations("2.31.0", m.migrateEdgeStacksStatuses_2_31_0)
+
+	m.addMigrations("2.32.0", m.addEndpointRelationForEdgeAgents_2_32_0)
+
+	m.addMigrations("2.33.1", m.migrateEdgeGroupEndpointsToRoars_2_33_0)
+
+	m.addMigrations("2.40.0", m.migrateRegistryAccessSASecrets_2_40_0)
+
+	m.addMigrations("2.43.0",
+		m.migrateGitConfigToSources_2_43_0,
+		m.migrateCustomTemplateGitConfigToSources_2_43_0,
+	)
+
+	// WARNING: do not change migrations that have already been released!
+
+	// Add new migrations above...
+	// One function per migration, each versions migration funcs in the same file.
+}
+
+// Always is always run at the end of migrations
+func (m *Migrator) Always() error {
+	// currently nothing to be done in CE... yet
+	return nil
+}
+
+func dbTooOldError() error {
+	return errors.New("migrating from less than Portainer 1.21.0 is not supported, please contact Portainer support")
+}
diff --git a/api/datastore/pendingactions_test.go b/api/datastore/pendingactions_test.go
new file mode 100644
index 0000000..3c4d40e
--- /dev/null
+++ b/api/datastore/pendingactions_test.go
@@ -0,0 +1,104 @@
+package datastore
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/pendingactions/actions"
+	"github.com/portainer/portainer/api/pendingactions/handlers"
+	"github.com/stretchr/testify/require"
+)
+
+type cleanNAPWithOverridePolicies struct {
+	EndpointGroupID portainer.EndpointGroupID
+}
+
+func Test_ConvertCleanNAPWithOverridePoliciesPayload(t *testing.T) {
+	t.Parallel()
+	t.Run("test ConvertCleanNAPWithOverridePoliciesPayload", func(t *testing.T) {
+
+		_, store := MustNewTestStore(t, true, false)
+		defer func() {
+			err := store.Close()
+			require.NoError(t, err)
+		}()
+
+		gid := portainer.EndpointGroupID(1)
+
+		testData := []struct {
+			Name          string
+			PendingAction portainer.PendingAction
+			Expected      any
+			Err           bool
+		}{
+			{
+				Name: "test actiondata with EndpointGroupID 1",
+				PendingAction: handlers.NewCleanNAPWithOverridePolicies(
+					1,
+					&gid,
+				),
+				Expected: portainer.EndpointGroupID(1),
+			},
+			{
+				Name: "test actionData nil",
+				PendingAction: handlers.NewCleanNAPWithOverridePolicies(
+					2,
+					nil,
+				),
+				Expected: nil,
+			},
+			{
+				Name: "test actionData empty and expected error",
+				PendingAction: portainer.PendingAction{
+					EndpointID: 2,
+					Action:     actions.CleanNAPWithOverridePolicies,
+					ActionData: "",
+				},
+				Expected: nil,
+				Err:      true,
+			},
+		}
+
+		for _, d := range testData {
+			err := store.PendingActions().Create(&d.PendingAction)
+			if err != nil {
+				t.Error(err)
+				return
+			}
+
+			pendingActions, err := store.PendingActions().ReadAll()
+			if err != nil {
+				t.Error(err)
+				return
+			}
+
+			for _, endpointPendingAction := range pendingActions {
+				t.Run(d.Name, func(t *testing.T) {
+					if endpointPendingAction.Action == actions.CleanNAPWithOverridePolicies {
+						var payload cleanNAPWithOverridePolicies
+
+						err := endpointPendingAction.UnmarshallActionData(&payload)
+
+						if d.Err && err == nil {
+							t.Error(err)
+						}
+
+						if d.Expected == nil && payload.EndpointGroupID != 0 {
+							t.Errorf("expected nil, got %d", payload.EndpointGroupID)
+						}
+
+						if d.Expected != nil {
+							expected := d.Expected.(portainer.EndpointGroupID)
+							if d.Expected != nil && expected != payload.EndpointGroupID {
+								t.Errorf("expected EndpointGroupID %d, got %d", expected, payload.EndpointGroupID)
+							}
+						}
+					}
+				})
+			}
+
+			err = store.PendingActions().Delete(d.PendingAction.ID)
+			require.NoError(t, err)
+		}
+	})
+}
diff --git a/api/datastore/postinit/migrate_post_init.go b/api/datastore/postinit/migrate_post_init.go
new file mode 100644
index 0000000..d8961f9
--- /dev/null
+++ b/api/datastore/postinit/migrate_post_init.go
@@ -0,0 +1,334 @@
+package postinit
+
+import (
+	"cmp"
+	"context"
+	"fmt"
+	"slices"
+
+	"github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/client"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	dockerClient "github.com/portainer/portainer/api/docker/client"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+	"github.com/portainer/portainer/api/internal/registryutils"
+	"github.com/portainer/portainer/api/kubernetes/cli"
+	"github.com/portainer/portainer/api/logs"
+	"github.com/portainer/portainer/api/pendingactions/actions"
+	"github.com/portainer/portainer/pkg/endpoints"
+
+	"github.com/rs/zerolog/log"
+)
+
+type PostInitMigrator struct {
+	kubeFactory        *cli.ClientFactory
+	dockerFactory      *dockerClient.ClientFactory
+	dataStore          dataservices.DataStore
+	assetsPath         string
+	kubernetesDeployer portainer.KubernetesDeployer
+}
+
+func NewPostInitMigrator(
+	kubeFactory *cli.ClientFactory,
+	dockerFactory *dockerClient.ClientFactory,
+	dataStore dataservices.DataStore,
+	assetsPath string,
+	kubernetesDeployer portainer.KubernetesDeployer,
+) *PostInitMigrator {
+	return &PostInitMigrator{
+		kubeFactory:        kubeFactory,
+		dockerFactory:      dockerFactory,
+		dataStore:          dataStore,
+		assetsPath:         assetsPath,
+		kubernetesDeployer: kubernetesDeployer,
+	}
+}
+
+// PostInitMigrate will run all post-init migrations, which require docker/kube clients for all edge or non-edge environments
+func (postInitMigrator *PostInitMigrator) PostInitMigrate() error {
+	var environments []portainer.Endpoint
+
+	if err := postInitMigrator.dataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		var err error
+		if environments, err = tx.Endpoint().ReadAll(func(endpoint portainer.Endpoint) bool {
+			return endpoints.HasDirectConnectivity(&endpoint)
+		}); err != nil {
+			return fmt.Errorf("failed to retrieve environments: %w", err)
+		}
+
+		var pendingActions []portainer.PendingAction
+		if pendingActions, err = tx.PendingActions().ReadAll(func(action portainer.PendingAction) bool {
+			return action.Action == actions.PostInitMigrateEnvironment
+		}); err != nil {
+			return fmt.Errorf("failed to retrieve pending actions: %w", err)
+		}
+
+		// Sort for the binary search in createPostInitMigrationPendingAction()
+		slices.SortFunc(pendingActions, func(a, b portainer.PendingAction) int {
+			return cmp.Compare(a.EndpointID, b.EndpointID)
+		})
+
+		for _, environment := range environments {
+			if !endpoints.IsEdgeEndpoint(&environment) {
+				continue
+			}
+
+			// Edge environments will run after the server starts, in pending actions
+			log.Info().
+				Int("endpoint_id", int(environment.ID)).
+				Msg("adding pending action 'PostInitMigrateEnvironment' for environment")
+
+			if err := postInitMigrator.createPostInitMigrationPendingAction(tx, environment.ID, pendingActions); err != nil {
+				log.Error().
+					Err(err).
+					Int("endpoint_id", int(environment.ID)).
+					Msg("error creating pending action for environment")
+			}
+		}
+
+		return err
+	}); err != nil {
+		log.Error().Err(err).Msg("error running post-init migrations")
+
+		return err
+	}
+
+	for _, environment := range environments {
+		if endpoints.IsEdgeEndpoint(&environment) {
+			continue
+		}
+
+		// Non-edge environments will run before the server starts.
+		if err := postInitMigrator.MigrateEnvironment(&environment); err != nil {
+			log.Error().
+				Err(err).
+				Int("endpoint_id", int(environment.ID)).
+				Msg("error running post-init migrations for non-edge environment")
+		}
+	}
+
+	return nil
+}
+
+// try to create a post init migration pending action. If it already exists, do nothing
+// this function exists for readability, not reusability
+// pending actions must be passed in ascending order by endpoint ID
+func (postInitMigrator *PostInitMigrator) createPostInitMigrationPendingAction(tx dataservices.DataStoreTx, environmentID portainer.EndpointID, pendingActions []portainer.PendingAction) error {
+	action := portainer.PendingAction{
+		EndpointID: environmentID,
+		Action:     actions.PostInitMigrateEnvironment,
+	}
+
+	if _, found := slices.BinarySearchFunc(pendingActions, environmentID, func(e portainer.PendingAction, id portainer.EndpointID) int {
+		return cmp.Compare(e.EndpointID, id)
+	}); found {
+		log.Debug().
+			Str("action", action.Action).
+			Int("endpoint_id", int(action.EndpointID)).
+			Msg("pending action already exists for environment, skipping...")
+
+		return nil
+	}
+
+	return tx.PendingActions().Create(&action)
+}
+
+// MigrateEnvironment runs migrations on a single environment
+func (migrator *PostInitMigrator) MigrateEnvironment(environment *portainer.Endpoint) error {
+	log.Info().
+		Int("endpoint_id", int(environment.ID)).
+		Msg("executing post init migration for environment")
+
+	switch {
+	case endpointutils.IsKubernetesEndpoint(environment):
+		// get the kubeclient for the environment, and skip all kube migrations if there's an error
+		kubeclient, err := migrator.kubeFactory.GetPrivilegedKubeClient(environment)
+		if err != nil {
+			log.Error().
+				Err(err).
+				Int("endpoint_id", int(environment.ID)).
+				Msg("error creating kubeclient for environment")
+
+			return err
+		}
+
+		// If one environment fails, it is logged and the next migration runs. The error is returned at the end and handled by pending actions
+		var latestErr error
+		kubernetesMigrations := []func() error{
+			func() error { return migrator.MigrateIngresses(*environment, kubeclient) },
+			func() error { return migrator.MigrateRegistrySASecrets(*environment, kubeclient) },
+		}
+
+		for _, migration := range kubernetesMigrations {
+			if err := migration(); err != nil {
+				latestErr = err
+			}
+		}
+
+		return latestErr
+	case endpointutils.IsDockerEndpoint(environment):
+		// get the docker client for the environment, and skip all docker migrations if there's an error
+		dockerClient, err := migrator.dockerFactory.CreateClient(environment, "", nil)
+		if err != nil {
+			log.Error().
+				Err(err).
+				Int("endpoint_id", int(environment.ID)).
+				Msg("error creating docker client for environment")
+
+			return err
+		}
+		defer logs.CloseAndLogErr(dockerClient)
+
+		if err := migrator.MigrateGPUs(*environment, dockerClient); err != nil {
+			log.Error().
+				Err(err).
+				Int("endpoint_id", int(environment.ID)).
+				Msg("error migrating GPUs for environment")
+
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (migrator *PostInitMigrator) MigrateRegistrySASecrets(environment portainer.Endpoint, kubeclient *cli.KubeClient) error {
+	if !environment.PostInitMigrations.MigrateRegistrySASecrets {
+		return nil
+	}
+
+	log.Debug().
+		Int("endpoint_id", int(environment.ID)).
+		Msg("migrating registry SA secrets for environment")
+
+	return migrator.dataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		env, err := tx.Endpoint().Endpoint(environment.ID)
+		if err != nil {
+			return err
+		}
+
+		if !env.PostInitMigrations.MigrateRegistrySASecrets {
+			return nil
+		}
+
+		registries, err := tx.Registry().ReadAll()
+		if err != nil {
+			return err
+		}
+
+		for _, registry := range registries {
+			access, ok := registry.RegistryAccesses[env.ID]
+			if !ok || len(access.Namespaces) == 0 {
+				continue
+			}
+
+			secretName := registryutils.RegistrySecretName(registry.ID)
+			for _, namespace := range access.Namespaces {
+				if err := kubeclient.AddImagePullSecretToServiceAccount(namespace, "default", secretName); err != nil {
+					log.Warn().
+						Err(err).
+						Int("endpoint_id", int(env.ID)).
+						Str("namespace", namespace).
+						Str("secret", secretName).
+						Msg("failed to add imagePullSecret to service account during registry SA secret migration")
+				}
+			}
+		}
+
+		env.PostInitMigrations.MigrateRegistrySASecrets = false
+		return tx.Endpoint().UpdateEndpoint(env.ID, env)
+	})
+}
+
+func (migrator *PostInitMigrator) MigrateIngresses(environment portainer.Endpoint, kubeclient *cli.KubeClient) error {
+	// Early exit if we do not need to migrate!
+	if !environment.PostInitMigrations.MigrateIngresses {
+		return nil
+	}
+
+	log.Debug().
+		Int("endpoint_id", int(environment.ID)).
+		Msg("migrating ingresses for environment")
+
+	if err := migrator.kubeFactory.MigrateEndpointIngresses(&environment, migrator.dataStore, kubeclient); err != nil {
+		log.Error().
+			Err(err).
+			Int("endpoint_id", int(environment.ID)).
+			Msg("error migrating ingresses for environment")
+
+		return err
+	}
+
+	return nil
+}
+
+// MigrateGPUs will check all docker endpoints for containers with GPUs and set EnableGPUManagement to true if any are found
+// If there's an error getting the containers, we'll log it and move on
+func (migrator *PostInitMigrator) MigrateGPUs(e portainer.Endpoint, dockerClient *client.Client) error {
+	return migrator.dataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		environment, err := tx.Endpoint().Endpoint(e.ID)
+		if err != nil {
+			log.Error().
+				Err(err).
+				Int("endpoint_id", int(e.ID)).
+				Msg("error getting environment")
+
+			return err
+		}
+
+		// Early exit if we do not need to migrate!
+		if !environment.PostInitMigrations.MigrateGPUs {
+			return nil
+		}
+
+		log.Debug().
+			Int("endpoint_id", int(e.ID)).
+			Msg("migrating GPUs for environment")
+
+		// Get all containers
+		containers, err := dockerClient.ContainerList(context.Background(), container.ListOptions{All: true})
+		if err != nil {
+			log.Error().
+				Err(err).
+				Int("endpoint_id", int(environment.ID)).
+				Msg("failed to list containers for environment")
+
+			return err
+		}
+
+		// Check for a gpu on each container. If even one GPU is found, set EnableGPUManagement to true for the whole environment
+	containersLoop:
+		for _, container := range containers {
+			// https://www.sobyte.net/post/2022-10/go-docker/ has nice documentation on the docker client with GPUs
+			containerDetails, err := dockerClient.ContainerInspect(context.Background(), container.ID)
+			if err != nil {
+				log.Error().Err(err).Msg("failed to inspect container")
+
+				continue
+			}
+
+			deviceRequests := containerDetails.HostConfig.DeviceRequests
+			for _, deviceRequest := range deviceRequests {
+				if deviceRequest.Driver == "nvidia" {
+					environment.EnableGPUManagement = true
+
+					break containersLoop
+				}
+			}
+		}
+
+		// Set the MigrateGPUs flag to false so we don't run this again
+		environment.PostInitMigrations.MigrateGPUs = false
+		if err := tx.Endpoint().UpdateEndpoint(environment.ID, environment); err != nil {
+			log.Error().
+				Err(err).
+				Int("endpoint_id", int(environment.ID)).
+				Msg("error updating EnableGPUManagement flag for environment")
+
+			return err
+		}
+
+		return nil
+	})
+}
diff --git a/api/datastore/postinit/migrate_post_init_test.go b/api/datastore/postinit/migrate_post_init_test.go
new file mode 100644
index 0000000..69e3587
--- /dev/null
+++ b/api/datastore/postinit/migrate_post_init_test.go
@@ -0,0 +1,176 @@
+package postinit
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/pendingactions/actions"
+
+	"github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/client"
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestMigrateGPUs(t *testing.T) {
+	t.Parallel()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if strings.HasSuffix(r.URL.Path, "/containers/json") {
+			containerSummary := []container.Summary{{ID: "container1"}}
+
+			if err := json.NewEncoder(w).Encode(containerSummary); err != nil {
+				w.WriteHeader(http.StatusInternalServerError)
+			}
+
+			return
+		}
+
+		container := container.InspectResponse{
+			ContainerJSONBase: &container.ContainerJSONBase{
+				ID: "container1",
+				HostConfig: &container.HostConfig{
+					Resources: container.Resources{
+						DeviceRequests: []container.DeviceRequest{
+							{Driver: "nvidia"},
+						},
+					},
+				},
+			},
+		}
+
+		if err := json.NewEncoder(w).Encode(container); err != nil {
+			w.WriteHeader(http.StatusInternalServerError)
+		}
+	}))
+	defer srv.Close()
+
+	_, store := datastore.MustNewTestStore(t, true, false)
+
+	migrator := &PostInitMigrator{dataStore: store}
+
+	dockerCli, err := client.NewClientWithOpts(client.WithHost(srv.URL), client.WithHTTPClient(http.DefaultClient))
+	require.NoError(t, err)
+
+	// Nonexistent endpoint
+
+	err = migrator.MigrateGPUs(portainer.Endpoint{}, dockerCli)
+	require.Error(t, err)
+
+	// Valid endpoint
+
+	endpoint := portainer.Endpoint{ID: 1, PostInitMigrations: portainer.EndpointPostInitMigrations{MigrateGPUs: true}}
+
+	err = store.Endpoint().Create(&endpoint)
+	require.NoError(t, err)
+
+	err = migrator.MigrateGPUs(endpoint, dockerCli)
+	require.NoError(t, err)
+
+	migratedEndpoint, err := store.Endpoint().Endpoint(endpoint.ID)
+	require.NoError(t, err)
+
+	require.Equal(t, endpoint.ID, migratedEndpoint.ID)
+	require.False(t, migratedEndpoint.PostInitMigrations.MigrateGPUs)
+	require.True(t, migratedEndpoint.EnableGPUManagement)
+}
+
+func TestPostInitMigrate_PendingActionsCreated(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name                   string
+		existingPendingActions []*portainer.PendingAction
+		expectedPendingActions int
+		expectedAction         string
+	}{
+		{
+			name: "when existing non-matching action exists, should add migration action",
+			existingPendingActions: []*portainer.PendingAction{
+				{
+					EndpointID: 7,
+					Action:     "some-other-action",
+				},
+			},
+			expectedPendingActions: 2,
+			expectedAction:         actions.PostInitMigrateEnvironment,
+		},
+		{
+			name: "when matching action exists, should not add duplicate",
+			existingPendingActions: []*portainer.PendingAction{
+				{
+					EndpointID: 7,
+					Action:     actions.PostInitMigrateEnvironment,
+				},
+			},
+			expectedPendingActions: 1,
+			expectedAction:         actions.PostInitMigrateEnvironment,
+		},
+		{
+			name:                   "when no actions exist, should add migration action",
+			existingPendingActions: []*portainer.PendingAction{},
+			expectedPendingActions: 1,
+			expectedAction:         actions.PostInitMigrateEnvironment,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			is := assert.New(t)
+			_, store := datastore.MustNewTestStore(t, true, true)
+
+			// Create test endpoint
+			endpoint := &portainer.Endpoint{
+				ID:          7,
+				UserTrusted: true,
+				Type:        portainer.EdgeAgentOnDockerEnvironment,
+				Edge: portainer.EnvironmentEdgeSettings{
+					AsyncMode: false,
+				},
+				EdgeID: "edgeID",
+			}
+			err := store.Endpoint().Create(endpoint)
+			require.NoError(t, err, "error creating endpoint")
+
+			// Create any existing pending actions
+			for _, action := range tt.existingPendingActions {
+				err = store.PendingActions().Create(action)
+				require.NoError(t, err, "error creating pending action")
+			}
+
+			migrator := NewPostInitMigrator(
+				nil, // kubeFactory not needed for this test
+				nil, // dockerFactory not needed for this test
+				store,
+				"",  // assetsPath not needed for this test
+				nil, // kubernetesDeployer not needed for this test
+			)
+
+			err = migrator.PostInitMigrate()
+			require.NoError(t, err, "PostInitMigrate should not return error")
+
+			// Verify the results
+			pendingActions, err := store.PendingActions().ReadAll()
+			require.NoError(t, err, "error reading pending actions")
+			is.Len(pendingActions, tt.expectedPendingActions, "unexpected number of pending actions")
+
+			// If we expect any actions, verify at least one has the expected action type
+			if tt.expectedPendingActions > 0 {
+				hasExpectedAction := false
+				for _, action := range pendingActions {
+					if action.Action == tt.expectedAction {
+						hasExpectedAction = true
+						is.Equal(endpoint.ID, action.EndpointID, "action should reference correct endpoint")
+
+						break
+					}
+				}
+
+				is.True(hasExpectedAction, "should have found action of expected type")
+			}
+		})
+	}
+}
diff --git a/api/datastore/services.go b/api/datastore/services.go
new file mode 100644
index 0000000..5480314
--- /dev/null
+++ b/api/datastore/services.go
@@ -0,0 +1,823 @@
+package datastore
+
+import (
+	"fmt"
+	"os"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/database/models"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/dataservices/allowlist"
+	"github.com/portainer/portainer/api/dataservices/apikeyrepository"
+	"github.com/portainer/portainer/api/dataservices/customtemplate"
+	"github.com/portainer/portainer/api/dataservices/dockerhub"
+	"github.com/portainer/portainer/api/dataservices/edgegroup"
+	"github.com/portainer/portainer/api/dataservices/edgejob"
+	"github.com/portainer/portainer/api/dataservices/edgestack"
+	"github.com/portainer/portainer/api/dataservices/edgestackstatus"
+	"github.com/portainer/portainer/api/dataservices/endpoint"
+	"github.com/portainer/portainer/api/dataservices/endpointgroup"
+	"github.com/portainer/portainer/api/dataservices/endpointrelation"
+	"github.com/portainer/portainer/api/dataservices/extension"
+	"github.com/portainer/portainer/api/dataservices/helmuserrepository"
+	"github.com/portainer/portainer/api/dataservices/pendingactions"
+	"github.com/portainer/portainer/api/dataservices/registry"
+	"github.com/portainer/portainer/api/dataservices/resourcecontrol"
+	"github.com/portainer/portainer/api/dataservices/role"
+	"github.com/portainer/portainer/api/dataservices/schedule"
+	"github.com/portainer/portainer/api/dataservices/settings"
+	"github.com/portainer/portainer/api/dataservices/snapshot"
+	"github.com/portainer/portainer/api/dataservices/source"
+	"github.com/portainer/portainer/api/dataservices/ssl"
+	"github.com/portainer/portainer/api/dataservices/stack"
+	"github.com/portainer/portainer/api/dataservices/tag"
+	"github.com/portainer/portainer/api/dataservices/team"
+	"github.com/portainer/portainer/api/dataservices/teammembership"
+	"github.com/portainer/portainer/api/dataservices/tunnelserver"
+	"github.com/portainer/portainer/api/dataservices/user"
+	"github.com/portainer/portainer/api/dataservices/version"
+	"github.com/portainer/portainer/api/dataservices/webhook"
+	"github.com/portainer/portainer/api/dataservices/workflow"
+
+	"github.com/rs/zerolog/log"
+	"github.com/segmentio/encoding/json"
+)
+
+var _ dataservices.DataStore = &Store{}
+
+// Store defines the implementation of portainer.DataStore using
+// BoltDB as the storage system.
+type Store struct {
+	flags      *portainer.CLIFlags
+	connection portainer.Connection
+
+	fileService               portainer.FileService
+	AllowListService          *allowlist.Service
+	CustomTemplateService     *customtemplate.Service
+	DockerHubService          *dockerhub.Service
+	EdgeGroupService          *edgegroup.Service
+	EdgeJobService            *edgejob.Service
+	EdgeStackService          *edgestack.Service
+	EdgeStackStatusService    *edgestackstatus.Service
+	EndpointGroupService      *endpointgroup.Service
+	EndpointService           *endpoint.Service
+	EndpointRelationService   *endpointrelation.Service
+	ExtensionService          *extension.Service
+	HelmUserRepositoryService *helmuserrepository.Service
+	RegistryService           *registry.Service
+	ResourceControlService    *resourcecontrol.Service
+	RoleService               *role.Service
+	APIKeyRepositoryService   *apikeyrepository.Service
+	ScheduleService           *schedule.Service
+	SettingsService           *settings.Service
+	SnapshotService           *snapshot.Service
+	SourceService             *source.Service
+	SSLSettingsService        *ssl.Service
+	StackService              *stack.Service
+	TagService                *tag.Service
+	TeamMembershipService     *teammembership.Service
+	TeamService               *team.Service
+	TunnelServerService       *tunnelserver.Service
+	UserService               *user.Service
+	VersionService            *version.Service
+	WebhookService            *webhook.Service
+	WorkflowService           *workflow.Service
+	PendingActionsService     *pendingactions.Service
+}
+
+func (store *Store) initServices() error {
+	allowListService, err := allowlist.NewService(store.connection)
+	if err != nil {
+		return err
+	}
+	store.AllowListService = allowListService
+
+	authorizationsetService, err := role.NewService(store.connection)
+	if err != nil {
+		return err
+	}
+	store.RoleService = authorizationsetService
+
+	customTemplateService, err := customtemplate.NewService(store.connection)
+	if err != nil {
+		return err
+	}
+	store.CustomTemplateService = customTemplateService
+
+	dockerhubService, err := dockerhub.NewService(store.connection)
+	if err != nil {
+		return err
+	}
+	store.DockerHubService = dockerhubService
+
+	endpointRelationService, err := endpointrelation.NewService(store.connection)
+	if err != nil {
+		return err
+	}
+	store.EndpointRelationService = endpointRelationService
+
+	edgeStackService, err := edgestack.NewService(store.connection, func(tx portainer.Transaction, ID portainer.EdgeStackID) {
+		endpointRelationService.Tx(tx).InvalidateEdgeCacheForEdgeStack(ID)
+	})
+	if err != nil {
+		return err
+	}
+	store.EdgeStackService = edgeStackService
+	endpointRelationService.RegisterUpdateStackFunction(edgeStackService.UpdateEdgeStackFuncTx)
+
+	edgeStackStatusService, err := edgestackstatus.NewService(store.connection)
+	if err != nil {
+		return err
+	}
+	store.EdgeStackStatusService = edgeStackStatusService
+
+	edgeGroupService, err := edgegroup.NewService(store.connection)
+	if err != nil {
+		return err
+	}
+	store.EdgeGroupService = edgeGroupService
+
+	edgeJobService, err := edgejob.NewService(store.connection)
+	if err != nil {
+		return err
+	}
+	store.EdgeJobService = edgeJobService
+
+	endpointgroupService, err := endpointgroup.NewService(store.connection)
+	if err != nil {
+		return err
+	}
+	store.EndpointGroupService = endpointgroupService
+
+	endpointService, err := endpoint.NewService(store.connection)
+	if err != nil {
+		return err
+	}
+	store.EndpointService = endpointService
+
+	extensionService, err := extension.NewService(store.connection)
+	if err != nil {
+		return err
+	}
+	store.ExtensionService = extensionService
+
+	helmUserRepositoryService, err := helmuserrepository.NewService(store.connection)
+	if err != nil {
+		return err
+	}
+	store.HelmUserRepositoryService = helmUserRepositoryService
+
+	registryService, err := registry.NewService(store.connection)
+	if err != nil {
+		return err
+	}
+	store.RegistryService = registryService
+
+	resourcecontrolService, err := resourcecontrol.NewService(store.connection)
+	if err != nil {
+		return err
+	}
+	store.ResourceControlService = resourcecontrolService
+
+	settingsService, err := settings.NewService(store.connection)
+	if err != nil {
+		return err
+	}
+	store.SettingsService = settingsService
+
+	snapshotService, err := snapshot.NewService(store.connection)
+	if err != nil {
+		return err
+	}
+	store.SnapshotService = snapshotService
+
+	sourceService, err := source.NewService(store.connection)
+	if err != nil {
+		return err
+	}
+	store.SourceService = sourceService
+
+	sslSettingsService, err := ssl.NewService(store.connection)
+	if err != nil {
+		return err
+	}
+	store.SSLSettingsService = sslSettingsService
+
+	stackService, err := stack.NewService(store.connection)
+	if err != nil {
+		return err
+	}
+	store.StackService = stackService
+
+	tagService, err := tag.NewService(store.connection)
+	if err != nil {
+		return err
+	}
+	store.TagService = tagService
+
+	teammembershipService, err := teammembership.NewService(store.connection)
+	if err != nil {
+		return err
+	}
+	store.TeamMembershipService = teammembershipService
+
+	teamService, err := team.NewService(store.connection)
+	if err != nil {
+		return err
+	}
+	store.TeamService = teamService
+
+	tunnelServerService, err := tunnelserver.NewService(store.connection)
+	if err != nil {
+		return err
+	}
+	store.TunnelServerService = tunnelServerService
+
+	userService, err := user.NewService(store.connection)
+	if err != nil {
+		return err
+	}
+	store.UserService = userService
+
+	apiKeyService, err := apikeyrepository.NewService(store.connection)
+	if err != nil {
+		return err
+	}
+	store.APIKeyRepositoryService = apiKeyService
+
+	versionService, err := version.NewService(store.connection)
+	if err != nil {
+		return err
+	}
+	store.VersionService = versionService
+
+	webhookService, err := webhook.NewService(store.connection)
+	if err != nil {
+		return err
+	}
+	store.WebhookService = webhookService
+
+	workflowService, err := workflow.NewService(store.connection)
+	if err != nil {
+		return err
+	}
+	store.WorkflowService = workflowService
+
+	scheduleService, err := schedule.NewService(store.connection)
+	if err != nil {
+		return err
+	}
+	store.ScheduleService = scheduleService
+
+	pendingActionsService, err := pendingactions.NewService(store.connection)
+	if err != nil {
+		return err
+	}
+	store.PendingActionsService = pendingActionsService
+
+	return nil
+}
+
+// PendingActions gives access to the PendingActions data management layer
+func (store *Store) PendingActions() dataservices.PendingActionsService {
+	return store.PendingActionsService
+}
+
+// AllowList gives access to the AllowList data management layer
+func (store *Store) AllowList() dataservices.AllowListService {
+	return store.AllowListService
+}
+
+// CustomTemplate gives access to the CustomTemplate data management layer
+func (store *Store) CustomTemplate() dataservices.CustomTemplateService {
+	return store.CustomTemplateService
+}
+
+// EdgeGroup gives access to the EdgeGroup data management layer
+func (store *Store) EdgeGroup() dataservices.EdgeGroupService {
+	return store.EdgeGroupService
+}
+
+// EdgeJob gives access to the EdgeJob data management layer
+func (store *Store) EdgeJob() dataservices.EdgeJobService {
+	return store.EdgeJobService
+}
+
+// EdgeStack gives access to the EdgeStack data management layer
+func (store *Store) EdgeStack() dataservices.EdgeStackService {
+	return store.EdgeStackService
+}
+
+func (store *Store) EdgeStackStatus() dataservices.EdgeStackStatusService {
+	return store.EdgeStackStatusService
+}
+
+// Environment(Endpoint) gives access to the Environment(Endpoint) data management layer
+func (store *Store) Endpoint() dataservices.EndpointService {
+	return store.EndpointService
+}
+
+// EndpointGroup gives access to the EndpointGroup data management layer
+func (store *Store) EndpointGroup() dataservices.EndpointGroupService {
+	return store.EndpointGroupService
+}
+
+// EndpointRelation gives access to the EndpointRelation data management layer
+func (store *Store) EndpointRelation() dataservices.EndpointRelationService {
+	return store.EndpointRelationService
+}
+
+// HelmUserRepository access the helm user repository settings
+func (store *Store) HelmUserRepository() dataservices.HelmUserRepositoryService {
+	return store.HelmUserRepositoryService
+}
+
+// Registry gives access to the Registry data management layer
+func (store *Store) Registry() dataservices.RegistryService {
+	return store.RegistryService
+}
+
+// ResourceControl gives access to the ResourceControl data management layer
+func (store *Store) ResourceControl() dataservices.ResourceControlService {
+	return store.ResourceControlService
+}
+
+// Role gives access to the Role data management layer
+func (store *Store) Role() dataservices.RoleService {
+	return store.RoleService
+}
+
+// APIKeyRepository gives access to the api-key data management layer
+func (store *Store) APIKeyRepository() dataservices.APIKeyRepository {
+	return store.APIKeyRepositoryService
+}
+
+// Settings gives access to the Settings data management layer
+func (store *Store) Settings() dataservices.SettingsService {
+	return store.SettingsService
+}
+
+func (store *Store) Snapshot() dataservices.SnapshotService {
+	return store.SnapshotService
+}
+
+// Source gives access to the Source data management layer
+func (store *Store) Source() dataservices.SourceService {
+	return store.SourceService
+}
+
+// SSLSettings gives access to the SSL Settings data management layer
+func (store *Store) SSLSettings() dataservices.SSLSettingsService {
+	return store.SSLSettingsService
+}
+
+// Stack gives access to the Stack data management layer
+func (store *Store) Stack() dataservices.StackService {
+	return store.StackService
+}
+
+// Tag gives access to the Tag data management layer
+func (store *Store) Tag() dataservices.TagService {
+	return store.TagService
+}
+
+// TeamMembership gives access to the TeamMembership data management layer
+func (store *Store) TeamMembership() dataservices.TeamMembershipService {
+	return store.TeamMembershipService
+}
+
+// Team gives access to the Team data management layer
+func (store *Store) Team() dataservices.TeamService {
+	return store.TeamService
+}
+
+// TunnelServer gives access to the TunnelServer data management layer
+func (store *Store) TunnelServer() dataservices.TunnelServerService {
+	return store.TunnelServerService
+}
+
+// User gives access to the User data management layer
+func (store *Store) User() dataservices.UserService {
+	return store.UserService
+}
+
+// Version gives access to the Version data management layer
+func (store *Store) Version() dataservices.VersionService {
+	return store.VersionService
+}
+
+// Webhook gives access to the Webhook data management layer
+func (store *Store) Webhook() dataservices.WebhookService {
+	return store.WebhookService
+}
+
+// Workflow gives access to the Workflow data management layer
+func (store *Store) Workflow() dataservices.WorkflowService {
+	return store.WorkflowService
+}
+
+type storeExport struct {
+	CustomTemplate     []portainer.CustomTemplate     `json:"customtemplates,omitempty"`
+	EdgeGroup          []portainer.EdgeGroup          `json:"edgegroups,omitempty"`
+	EdgeJob            []portainer.EdgeJob            `json:"edgejobs,omitempty"`
+	EdgeStack          []portainer.EdgeStack          `json:"edge_stack,omitempty"`
+	Endpoint           []portainer.Endpoint           `json:"endpoints,omitempty"`
+	EndpointGroup      []portainer.EndpointGroup      `json:"endpoint_groups,omitempty"`
+	EndpointRelation   []portainer.EndpointRelation   `json:"endpoint_relations,omitempty"`
+	Extensions         []portainer.Extension          `json:"extension,omitempty"`
+	HelmUserRepository []portainer.HelmUserRepository `json:"helm_user_repository,omitempty"`
+	Registry           []portainer.Registry           `json:"registries,omitempty"`
+	ResourceControl    []portainer.ResourceControl    `json:"resource_control,omitempty"`
+	Role               []portainer.Role               `json:"roles,omitempty"`
+	Schedules          []portainer.Schedule           `json:"schedules,omitempty"`
+	Settings           portainer.Settings             `json:"settings,omitzero"`
+	Snapshot           []portainer.Snapshot           `json:"snapshots,omitempty"`
+	SSLSettings        portainer.SSLSettings          `json:"ssl,omitzero"`
+	Source             []portainer.Source             `json:"sources,omitempty"`
+	Stack              []portainer.Stack              `json:"stacks,omitempty"`
+	Tag                []portainer.Tag                `json:"tags,omitempty"`
+	TeamMembership     []portainer.TeamMembership     `json:"team_membership,omitempty"`
+	Team               []portainer.Team               `json:"teams,omitempty"`
+	TunnelServer       portainer.TunnelServerInfo     `json:"tunnel_server,omitzero"`
+	User               []portainer.User               `json:"users,omitempty"`
+	Version            models.Version                 `json:"version,omitzero"`
+	Webhook            []portainer.Webhook            `json:"webhooks,omitempty"`
+	Workflow           []portainer.Workflow           `json:"workflows,omitempty"`
+	Metadata           map[string]any                 `json:"metadata,omitempty"`
+}
+
+func (store *Store) Export(filename string) (err error) {
+	backup := storeExport{}
+
+	if c, err := store.CustomTemplate().ReadAll(); err != nil {
+		if !store.IsErrObjectNotFound(err) {
+			log.Error().Err(err).Msg("exporting Custom Templates")
+		}
+	} else {
+		backup.CustomTemplate = c
+	}
+
+	if e, err := store.EdgeGroup().ReadAll(); err != nil {
+		if !store.IsErrObjectNotFound(err) {
+			log.Error().Err(err).Msg("exporting Edge Groups")
+		}
+	} else {
+		backup.EdgeGroup = e
+	}
+
+	if e, err := store.EdgeJob().ReadAll(); err != nil {
+		if !store.IsErrObjectNotFound(err) {
+			log.Error().Err(err).Msg("exporting Edge Jobs")
+		}
+	} else {
+		backup.EdgeJob = e
+	}
+
+	if e, err := store.EdgeStack().EdgeStacks(); err != nil {
+		if !store.IsErrObjectNotFound(err) {
+			log.Error().Err(err).Msg("exporting Edge Stacks")
+		}
+	} else {
+		backup.EdgeStack = e
+	}
+
+	if e, err := store.Endpoint().Endpoints(); err != nil {
+		if !store.IsErrObjectNotFound(err) {
+			log.Error().Err(err).Msg("exporting Endpoints")
+		}
+	} else {
+		backup.Endpoint = e
+	}
+
+	if e, err := store.EndpointGroup().ReadAll(); err != nil {
+		if !store.IsErrObjectNotFound(err) {
+			log.Error().Err(err).Msg("exporting Endpoint Groups")
+		}
+	} else {
+		backup.EndpointGroup = e
+	}
+
+	if r, err := store.EndpointRelation().EndpointRelations(); err != nil {
+		if !store.IsErrObjectNotFound(err) {
+			log.Error().Err(err).Msg("exporting Endpoint Relations")
+		}
+	} else {
+		backup.EndpointRelation = r
+	}
+
+	if r, err := store.ExtensionService.Extensions(); err != nil {
+		if !store.IsErrObjectNotFound(err) {
+			log.Error().Err(err).Msg("exporting Extensions")
+		}
+	} else {
+		backup.Extensions = r
+	}
+
+	if r, err := store.HelmUserRepository().ReadAll(); err != nil {
+		if !store.IsErrObjectNotFound(err) {
+			log.Error().Err(err).Msg("exporting Helm User Repositories")
+		}
+	} else {
+		backup.HelmUserRepository = r
+	}
+
+	if r, err := store.Registry().ReadAll(); err != nil {
+		if !store.IsErrObjectNotFound(err) {
+			log.Error().Err(err).Msg("exporting Registries")
+		}
+	} else {
+		backup.Registry = r
+	}
+
+	if c, err := store.ResourceControl().ReadAll(); err != nil {
+		if !store.IsErrObjectNotFound(err) {
+			log.Error().Err(err).Msg("exporting Resource Controls")
+		}
+	} else {
+		backup.ResourceControl = c
+	}
+
+	if role, err := store.Role().ReadAll(); err != nil {
+		if !store.IsErrObjectNotFound(err) {
+			log.Error().Err(err).Msg("exporting Roles")
+		}
+	} else {
+		backup.Role = role
+	}
+
+	if r, err := store.ScheduleService.Schedules(); err != nil {
+		if !store.IsErrObjectNotFound(err) {
+			log.Error().Err(err).Msg("exporting Schedules")
+		}
+	} else {
+		backup.Schedules = r
+	}
+
+	if settings, err := store.Settings().Settings(); err != nil {
+		if !store.IsErrObjectNotFound(err) {
+			log.Error().Err(err).Msg("exporting Settings")
+		}
+	} else {
+		backup.Settings = *settings
+	}
+
+	if snapshot, err := store.Snapshot().ReadAll(); err != nil {
+		if !store.IsErrObjectNotFound(err) {
+			log.Error().Err(err).Msg("exporting Snapshots")
+		}
+	} else {
+		backup.Snapshot = snapshot
+	}
+
+	if settings, err := store.SSLSettings().Settings(); err != nil {
+		if !store.IsErrObjectNotFound(err) {
+			log.Error().Err(err).Msg("exporting SSL Settings")
+		}
+	} else {
+		backup.SSLSettings = *settings
+	}
+
+	if s, err := store.Source().ReadAll(source.InsecureNewAdminContext()); err != nil {
+		if !store.IsErrObjectNotFound(err) {
+			log.Error().Err(err).Msg("exporting Sources")
+		}
+	} else {
+		backup.Source = s
+	}
+
+	if t, err := store.Stack().ReadAll(); err != nil {
+		if !store.IsErrObjectNotFound(err) {
+			log.Error().Err(err).Msg("exporting Stacks")
+		}
+	} else {
+		backup.Stack = t
+	}
+
+	if t, err := store.Tag().ReadAll(); err != nil {
+		if !store.IsErrObjectNotFound(err) {
+			log.Error().Err(err).Msg("exporting Tags")
+		}
+	} else {
+		backup.Tag = t
+	}
+
+	if t, err := store.TeamMembership().ReadAll(); err != nil {
+		if !store.IsErrObjectNotFound(err) {
+			log.Error().Err(err).Msg("exporting Team Memberships")
+		}
+	} else {
+		backup.TeamMembership = t
+	}
+
+	if t, err := store.Team().ReadAll(); err != nil {
+		if !store.IsErrObjectNotFound(err) {
+			log.Error().Err(err).Msg("exporting Teams")
+		}
+	} else {
+		backup.Team = t
+	}
+
+	if info, err := store.TunnelServer().Info(); err != nil {
+		if !store.IsErrObjectNotFound(err) {
+			log.Error().Err(err).Msg("exporting Tunnel Server")
+		}
+	} else {
+		backup.TunnelServer = *info
+	}
+
+	if users, err := store.User().ReadAll(); err != nil {
+		if !store.IsErrObjectNotFound(err) {
+			log.Error().Err(err).Msg("exporting Users")
+		}
+	} else {
+		backup.User = users
+	}
+
+	if webhooks, err := store.Webhook().ReadAll(); err != nil {
+		if !store.IsErrObjectNotFound(err) {
+			log.Error().Err(err).Msg("exporting Webhooks")
+		}
+	} else {
+		backup.Webhook = webhooks
+	}
+
+	if w, err := store.Workflow().ReadAll(); err != nil {
+		if !store.IsErrObjectNotFound(err) {
+			log.Error().Err(err).Msg("exporting Workflows")
+		}
+	} else {
+		backup.Workflow = w
+	}
+
+	if version, err := store.Version().Version(); err != nil {
+		if !store.IsErrObjectNotFound(err) {
+			log.Error().Err(err).Msg("exporting Version")
+		}
+	} else {
+		backup.Version = *version
+	}
+
+	backup.Metadata, err = store.connection.BackupMetadata()
+	if err != nil {
+		log.Error().Err(err).Msg("exporting Metadata")
+	}
+
+	b, err := json.MarshalIndent(backup, "", "  ")
+	if err != nil {
+		return err
+	}
+
+	return os.WriteFile(filename, b, 0o600)
+}
+
+func (store *Store) Import(filename string) (err error) {
+	backup := storeExport{}
+
+	s, err := os.ReadFile(filename)
+	if err != nil {
+		return err
+	}
+	err = json.Unmarshal(s, &backup)
+	if err != nil {
+		return err
+	}
+
+	err = store.Version().UpdateVersion(&backup.Version)
+	if err != nil {
+		return err
+	}
+
+	for _, v := range backup.CustomTemplate {
+		if err := store.CustomTemplate().Update(v.ID, &v); err != nil {
+			log.Warn().Err(err).Msg("failed to update the custom template in the database")
+		}
+	}
+
+	for _, v := range backup.EdgeGroup {
+		if err := store.EdgeGroup().Update(v.ID, &v); err != nil {
+			log.Warn().Err(err).Msg("failed to update the edge group in the database")
+		}
+	}
+
+	for _, v := range backup.EdgeJob {
+		if err := store.EdgeJob().Update(v.ID, &v); err != nil {
+			log.Warn().Err(err).Msg("failed to update the edge job in the database")
+		}
+	}
+
+	for _, v := range backup.EdgeStack {
+		if err := store.EdgeStack().UpdateEdgeStack(v.ID, &v); err != nil {
+			log.Warn().Err(err).Msg("failed to update the edge stack in the database")
+		}
+	}
+
+	for _, v := range backup.Endpoint {
+		if err := store.Endpoint().UpdateEndpoint(v.ID, &v); err != nil {
+			log.Warn().Err(err).Msg("failed to update the endpoint in the database")
+		}
+	}
+
+	for _, v := range backup.EndpointGroup {
+		if err := store.EndpointGroup().Update(v.ID, &v); err != nil {
+			log.Warn().Err(err).Msg("failed to update the endpoint group in the database")
+		}
+	}
+
+	for _, v := range backup.EndpointRelation {
+		if err := store.EndpointRelation().UpdateEndpointRelation(v.EndpointID, &v); err != nil {
+			log.Warn().Err(err).Msg("failed to update the endpoint relation in the database")
+		}
+	}
+
+	for _, v := range backup.HelmUserRepository {
+		if err := store.HelmUserRepository().Update(v.ID, &v); err != nil {
+			log.Warn().Err(err).Msg("failed to update the helm user repository in the database")
+		}
+	}
+
+	for _, v := range backup.Registry {
+		if err := store.Registry().Update(v.ID, &v); err != nil {
+			log.Warn().Err(err).Msg("failed to update the registry in the database")
+		}
+	}
+
+	for _, v := range backup.ResourceControl {
+		if err := store.ResourceControl().Update(v.ID, &v); err != nil {
+			log.Warn().Err(err).Msg("failed to update the resource control in the database")
+		}
+	}
+
+	for _, v := range backup.Role {
+		if err := store.Role().Update(v.ID, &v); err != nil {
+			log.Warn().Err(err).Msg("failed to update the role in the database")
+		}
+	}
+
+	if err := store.Settings().UpdateSettings(&backup.Settings); err != nil {
+		log.Warn().Err(err).Msg("failed to update the settings in the database")
+	}
+
+	if err := store.SSLSettings().UpdateSettings(&backup.SSLSettings); err != nil {
+		log.Warn().Err(err).Msg("failed to update the SSL settings in the database")
+	}
+
+	for _, v := range backup.Snapshot {
+		if err := store.Snapshot().Update(v.EndpointID, &v); err != nil {
+			log.Warn().Err(err).Msg("failed to update the snapshot in the database")
+		}
+	}
+
+	for _, v := range backup.Source {
+		if err := store.Source().Update(source.InsecureNewAdminContext(), v.ID, &v); err != nil {
+			log.Warn().Err(err).Msg("failed to update the source in the database")
+		}
+	}
+
+	for _, v := range backup.Workflow {
+		if err := store.Workflow().Update(v.ID, &v); err != nil {
+			log.Warn().Err(err).Msg("failed to update the workflow in the database")
+		}
+	}
+
+	for _, v := range backup.Stack {
+		if err := store.Stack().Update(v.ID, &v); err != nil {
+			log.Warn().Err(err).Msg("failed to update the stack in the database")
+		}
+	}
+
+	for _, v := range backup.Tag {
+		if err := store.Tag().Update(v.ID, &v); err != nil {
+			log.Warn().Err(err).Msg("failed to update the tag in the database")
+		}
+	}
+
+	for _, v := range backup.TeamMembership {
+		if err := store.TeamMembership().Update(v.ID, &v); err != nil {
+			log.Warn().Err(err).Msg("failed to update the team membership in the database")
+		}
+	}
+
+	for _, v := range backup.Team {
+		if err := store.Team().Update(v.ID, &v); err != nil {
+			log.Warn().Err(err).Msg("failed to update the team in the database")
+		}
+	}
+
+	if err := store.TunnelServer().UpdateInfo(&backup.TunnelServer); err != nil {
+		log.Warn().Err(err).Msg("failed to update the tunnel server info in the database")
+	}
+
+	for _, user := range backup.User {
+		if err := store.User().Update(user.ID, &user); err != nil {
+			log.Warn().Str("user", fmt.Sprintf("%+v", user)).Err(err).Msg("failed to update the user in the database")
+		}
+	}
+
+	for _, v := range backup.Webhook {
+		if err := store.Webhook().Update(v.ID, &v); err != nil {
+			log.Warn().Err(err).Msg("failed to update the webhook in the database")
+		}
+	}
+
+	return store.connection.RestoreMetadata(backup.Metadata)
+}
diff --git a/api/datastore/services_tx.go b/api/datastore/services_tx.go
new file mode 100644
index 0000000..bfb9dc7
--- /dev/null
+++ b/api/datastore/services_tx.go
@@ -0,0 +1,116 @@
+package datastore
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+)
+
+type StoreTx struct {
+	store *Store
+	tx    portainer.Transaction
+}
+
+func (tx *StoreTx) IsErrObjectNotFound(err error) bool {
+	return tx.store.IsErrObjectNotFound(err)
+}
+
+func (tx *StoreTx) AllowList() dataservices.AllowListService {
+	return tx.store.AllowListService.Tx(tx.tx)
+}
+
+func (tx *StoreTx) CustomTemplate() dataservices.CustomTemplateService {
+	return tx.store.CustomTemplateService.Tx(tx.tx)
+}
+
+func (tx *StoreTx) PendingActions() dataservices.PendingActionsService {
+	return tx.store.PendingActionsService.Tx(tx.tx)
+}
+
+func (tx *StoreTx) EdgeGroup() dataservices.EdgeGroupService {
+	return tx.store.EdgeGroupService.Tx(tx.tx)
+}
+
+func (tx *StoreTx) EdgeJob() dataservices.EdgeJobService {
+	return tx.store.EdgeJobService.Tx(tx.tx)
+}
+
+func (tx *StoreTx) EdgeStack() dataservices.EdgeStackService {
+	return tx.store.EdgeStackService.Tx(tx.tx)
+}
+
+func (tx *StoreTx) EdgeStackStatus() dataservices.EdgeStackStatusService {
+	return tx.store.EdgeStackStatusService.Tx(tx.tx)
+}
+
+func (tx *StoreTx) Endpoint() dataservices.EndpointService {
+	return tx.store.EndpointService.Tx(tx.tx)
+}
+
+func (tx *StoreTx) EndpointGroup() dataservices.EndpointGroupService {
+	return tx.store.EndpointGroupService.Tx(tx.tx)
+}
+
+func (tx *StoreTx) EndpointRelation() dataservices.EndpointRelationService {
+	return tx.store.EndpointRelationService.Tx(tx.tx)
+}
+
+func (tx *StoreTx) HelmUserRepository() dataservices.HelmUserRepositoryService { return nil }
+
+func (tx *StoreTx) Registry() dataservices.RegistryService {
+	return tx.store.RegistryService.Tx(tx.tx)
+}
+
+func (tx *StoreTx) ResourceControl() dataservices.ResourceControlService {
+	return tx.store.ResourceControlService.Tx(tx.tx)
+}
+
+func (tx *StoreTx) Role() dataservices.RoleService {
+	return tx.store.RoleService.Tx(tx.tx)
+}
+
+func (tx *StoreTx) APIKeyRepository() dataservices.APIKeyRepository { return nil }
+
+func (tx *StoreTx) Settings() dataservices.SettingsService {
+	return tx.store.SettingsService.Tx(tx.tx)
+}
+
+func (tx *StoreTx) Snapshot() dataservices.SnapshotService {
+	return tx.store.SnapshotService.Tx(tx.tx)
+}
+
+func (tx *StoreTx) Source() dataservices.SourceService {
+	return tx.store.SourceService.Tx(tx.tx)
+}
+
+func (tx *StoreTx) SSLSettings() dataservices.SSLSettingsService {
+	return tx.store.SSLSettingsService.Tx(tx.tx)
+}
+
+func (tx *StoreTx) Stack() dataservices.StackService {
+	return tx.store.StackService.Tx(tx.tx)
+}
+
+func (tx *StoreTx) Tag() dataservices.TagService {
+	return tx.store.TagService.Tx(tx.tx)
+}
+
+func (tx *StoreTx) TeamMembership() dataservices.TeamMembershipService {
+	return tx.store.TeamMembershipService.Tx(tx.tx)
+}
+
+func (tx *StoreTx) Team() dataservices.TeamService {
+	return tx.store.TeamService.Tx(tx.tx)
+}
+
+func (tx *StoreTx) TunnelServer() dataservices.TunnelServerService { return nil }
+
+func (tx *StoreTx) User() dataservices.UserService {
+	return tx.store.UserService.Tx(tx.tx)
+}
+
+func (tx *StoreTx) Version() dataservices.VersionService { return nil }
+func (tx *StoreTx) Webhook() dataservices.WebhookService { return nil }
+
+func (tx *StoreTx) Workflow() dataservices.WorkflowService {
+	return tx.store.WorkflowService.Tx(tx.tx)
+}
diff --git a/api/datastore/test_data/input_24.json b/api/datastore/test_data/input_24.json
new file mode 100644
index 0000000..e89d59d
--- /dev/null
+++ b/api/datastore/test_data/input_24.json
@@ -0,0 +1,3093 @@
+{
+  "dockerhub": [
+    {
+      "Authentication": false,
+      "Username": ""
+    }
+  ],
+  "endpoint_groups": [
+    {
+      "AuthorizedTeams": null,
+      "AuthorizedUsers": null,
+      "Description": "Unassigned endpoints",
+      "Id": 1,
+      "Labels": [],
+      "Name": "Unassigned",
+      "TagIds": [],
+      "Tags": null,
+      "TeamAccessPolicies": {},
+      "UserAccessPolicies": {}
+    }
+  ],
+  "endpoint_relations": [
+    {
+      "EdgeStacks": {},
+      "EndpointID": 1
+    }
+  ],
+  "endpoints": [
+    {
+      "AuthorizedTeams": null,
+      "AuthorizedUsers": null,
+      "AzureCredentials": {
+        "ApplicationID": "",
+        "AuthenticationKey": "",
+        "TenantID": ""
+      },
+      "EdgeKey": "",
+      "Extensions": [],
+      "GroupId": 1,
+      "Heartbeat": false,
+      "Id": 1,
+      "Name": "local",
+      "PublicURL": "",
+      "Snapshots": [
+        {
+          "DiagnosticsData": {
+            "Log": "",
+            "DNS": {},
+            "Proxy": {},
+            "Telnet": {}
+          },
+          "DockerVersion": "20.10.13",
+          "HealthyContainerCount": 0,
+          "ImageCount": 9,
+          "RunningContainerCount": 5,
+          "ServiceCount": 0,
+          "SnapshotRaw": {
+            "Containers": [
+              {
+                "Command": "/docker-entrypoint.sh nginx -g 'daemon off;'",
+                "Created": 1648609973,
+                "HostConfig": {
+                  "NetworkMode": "nginx_default"
+                },
+                "Id": "0eca796ba47ad6e479a09191d90be17b5d151b63227f30ec1974338a55a24f11",
+                "Image": "nginx:latest",
+                "ImageID": "sha256:c919045c4c2b0b0007c606e763ed2c830c7b1d038ce878a3c0d6f5b81e6ab80b",
+                "Labels": {
+                  "com.docker.compose.config-hash": "b6013e48916cd17f37d6675ae35e0cac34cace20",
+                  "com.docker.compose.container-number": "1",
+                  "com.docker.compose.oneoff": "False",
+                  "com.docker.compose.project": "nginx",
+                  "com.docker.compose.service": "redis-master",
+                  "com.docker.compose.version": "1.5.0",
+                  "maintainer": "NGINX Docker Maintainers \u003cdocker-maint@nginx.com\u003e"
+                },
+                "Mounts": [],
+                "Names": [
+                  "/nginx_redis-master_1"
+                ],
+                "NetworkSettings": {
+                  "Networks": {
+                    "nginx_default": {
+                      "Aliases": null,
+                      "DriverOpts": null,
+                      "EndpointID": "f761433ec60e0514f2a4ce9e7e408029af6c363a95e5723e31f82a497597ede4",
+                      "Gateway": "172.20.0.1",
+                      "GlobalIPv6Address": "",
+                      "GlobalIPv6PrefixLen": 0,
+                      "IPAMConfig": {},
+                      "IPAddress": "172.20.0.2",
+                      "IPPrefixLen": 16,
+                      "IPv6Gateway": "",
+                      "Links": null,
+                      "MacAddress": "02:42:ac:14:00:02",
+                      "NetworkID": "d9576d8c709d65504ca1d0a654cdc7b13ab17ebc6ae051f74e6b124d9d368c9a"
+                    }
+                  }
+                },
+                "Ports": [
+                  {
+                    "IP": "0.0.0.0",
+                    "PrivatePort": 80,
+                    "PublicPort": 8080,
+                    "Type": "tcp"
+                  },
+                  {
+                    "IP": "::",
+                    "PrivatePort": 80,
+                    "PublicPort": 8080,
+                    "Type": "tcp"
+                  }
+                ],
+                "State": "running",
+                "Status": "Up 2 minutes"
+              },
+              {
+                "Command": "apache2-foreground",
+                "Created": 1648609919,
+                "HostConfig": {
+                  "NetworkMode": "redis_default"
+                },
+                "Id": "ab541bbf504f9ef6cddfbd0dd06224f36fe7b291a2d9a3bc1ed406140312bf7a",
+                "Image": "gcr.io/google-samples/gb-frontend:v4",
+                "ImageID": "sha256:e2b3e8542af735080e6bda06873ce666e2319eea353884a88e45f3c9ef996846",
+                "Labels": {
+                  "com.docker.compose.config-hash": "7c2882b6ebdb0d582b4a326e9383d0ea5b3cc155",
+                  "com.docker.compose.container-number": "1",
+                  "com.docker.compose.oneoff": "False",
+                  "com.docker.compose.project": "redis",
+                  "com.docker.compose.service": "frontend",
+                  "com.docker.compose.version": "1.5.0",
+                  "kompose.service.type": "LoadBalancer"
+                },
+                "Mounts": [],
+                "Names": [
+                  "/redis_frontend_1"
+                ],
+                "NetworkSettings": {
+                  "Networks": {
+                    "redis_default": {
+                      "Aliases": null,
+                      "DriverOpts": null,
+                      "EndpointID": "f9c6fb004c9546d999230b1a3b64f0e680eef8a74d494f7e0455ba64a190b322",
+                      "Gateway": "172.19.0.1",
+                      "GlobalIPv6Address": "",
+                      "GlobalIPv6PrefixLen": 0,
+                      "IPAMConfig": {},
+                      "IPAddress": "172.19.0.2",
+                      "IPPrefixLen": 16,
+                      "IPv6Gateway": "",
+                      "Links": null,
+                      "MacAddress": "02:42:ac:13:00:02",
+                      "NetworkID": "9fa60f4b6a71b29a95127e99ae0ba09f616386a58ae790f0e8f975e8029f791d"
+                    }
+                  }
+                },
+                "Ports": [
+                  {
+                    "IP": "0.0.0.0",
+                    "PrivatePort": 80,
+                    "PublicPort": 80,
+                    "Type": "tcp"
+                  },
+                  {
+                    "IP": "::",
+                    "PrivatePort": 80,
+                    "PublicPort": 80,
+                    "Type": "tcp"
+                  }
+                ],
+                "State": "running",
+                "Status": "Up 3 minutes"
+              },
+              {
+                "Command": "redis-server /etc/redis/redis.conf",
+                "Created": 1648609919,
+                "HostConfig": {
+                  "NetworkMode": "redis_default"
+                },
+                "Id": "621d31f8aa50ad8ee182f3bc581fe19fa67c4f3728b412cfe3d20aa0d6deb2ef",
+                "Image": "k8s.gcr.io/redis:e2e",
+                "ImageID": "sha256:e5e67996c442f903cda78dd983ea6e94bb4e542950fd2eba666b44cbd303df42",
+                "Labels": {
+                  "com.docker.compose.config-hash": "86f8fef221e155eb14f94d707313986c865e8ac5",
+                  "com.docker.compose.container-number": "1",
+                  "com.docker.compose.oneoff": "False",
+                  "com.docker.compose.project": "redis",
+                  "com.docker.compose.service": "redis-master",
+                  "com.docker.compose.version": "1.5.0"
+                },
+                "Mounts": [
+                  {
+                    "Destination": "/data",
+                    "Driver": "local",
+                    "Mode": "",
+                    "Name": "a3fedc4b90b70e9f28456b4f88f8a2ebd90f76cf8a8a5e4fb5dcbd0b90ff0153",
+                    "Propagation": "",
+                    "RW": true,
+                    "Source": "",
+                    "Type": "volume"
+                  }
+                ],
+                "Names": [
+                  "/redis_redis-master_1"
+                ],
+                "NetworkSettings": {
+                  "Networks": {
+                    "redis_default": {
+                      "Aliases": null,
+                      "DriverOpts": null,
+                      "EndpointID": "7efb43c9f1b67e518e53b2dbcee2cfbbab07dcfa4788bad8c9fde8334cb6a213",
+                      "Gateway": "172.19.0.1",
+                      "GlobalIPv6Address": "",
+                      "GlobalIPv6PrefixLen": 0,
+                      "IPAMConfig": {},
+                      "IPAddress": "172.19.0.3",
+                      "IPPrefixLen": 16,
+                      "IPv6Gateway": "",
+                      "Links": null,
+                      "MacAddress": "02:42:ac:13:00:03",
+                      "NetworkID": "9fa60f4b6a71b29a95127e99ae0ba09f616386a58ae790f0e8f975e8029f791d"
+                    }
+                  }
+                },
+                "Ports": [
+                  {
+                    "IP": "0.0.0.0",
+                    "PrivatePort": 6379,
+                    "PublicPort": 49154,
+                    "Type": "tcp"
+                  },
+                  {
+                    "IP": "::",
+                    "PrivatePort": 6379,
+                    "PublicPort": 49154,
+                    "Type": "tcp"
+                  }
+                ],
+                "State": "running",
+                "Status": "Up 3 minutes"
+              },
+              {
+                "Command": "/entrypoint.sh /bin/sh -c /run.sh",
+                "Created": 1648609919,
+                "HostConfig": {
+                  "NetworkMode": "redis_default"
+                },
+                "Id": "536f5789838e57d3e24658cf5a45d7957861542ac4d8dab688d7a64d2be274f1",
+                "Image": "gcr.io/google_samples/gb-redisslave:v1",
+                "ImageID": "sha256:5f026ddffa27f011242781f7f2498538334e173869e7fe757008881fb48180b6",
+                "Labels": {
+                  "com.docker.compose.config-hash": "757a0da54b072e33a11a367408e83d930ad1f30f",
+                  "com.docker.compose.container-number": "1",
+                  "com.docker.compose.oneoff": "False",
+                  "com.docker.compose.project": "redis",
+                  "com.docker.compose.service": "redis-slave",
+                  "com.docker.compose.version": "1.5.0"
+                },
+                "Mounts": [
+                  {
+                    "Destination": "/data",
+                    "Driver": "local",
+                    "Mode": "",
+                    "Name": "5f93240d96e42d0b3728435cbfb43b6fcb3b01446d5c7d4be1cba8f9336c0a58",
+                    "Propagation": "",
+                    "RW": true,
+                    "Source": "",
+                    "Type": "volume"
+                  }
+                ],
+                "Names": [
+                  "/redis_redis-slave_1"
+                ],
+                "NetworkSettings": {
+                  "Networks": {
+                    "redis_default": {
+                      "Aliases": null,
+                      "DriverOpts": null,
+                      "EndpointID": "78b76382fcb909030a6e96caf5ce579d852bb565d82d47293302900eb81042ee",
+                      "Gateway": "172.19.0.1",
+                      "GlobalIPv6Address": "",
+                      "GlobalIPv6PrefixLen": 0,
+                      "IPAMConfig": {},
+                      "IPAddress": "172.19.0.4",
+                      "IPPrefixLen": 16,
+                      "IPv6Gateway": "",
+                      "Links": null,
+                      "MacAddress": "02:42:ac:13:00:04",
+                      "NetworkID": "9fa60f4b6a71b29a95127e99ae0ba09f616386a58ae790f0e8f975e8029f791d"
+                    }
+                  }
+                },
+                "Ports": [
+                  {
+                    "IP": "0.0.0.0",
+                    "PrivatePort": 6379,
+                    "PublicPort": 49155,
+                    "Type": "tcp"
+                  },
+                  {
+                    "IP": "::",
+                    "PrivatePort": 6379,
+                    "PublicPort": 49155,
+                    "Type": "tcp"
+                  }
+                ],
+                "State": "running",
+                "Status": "Up 3 minutes"
+              },
+              {
+                "Command": "httpd-foreground",
+                "Created": 1647381304,
+                "HostConfig": {
+                  "NetworkMode": "bridge"
+                },
+                "Id": "74034d9d05b07b2592fbe4ec878486eac5c743e960f75816884750e0aa40939b",
+                "Image": "httpd:latest",
+                "ImageID": "sha256:6b8e87fff1072470bbfc957a735e7e46007177864a7f61bd9e0f5872d3d7b4a5",
+                "Labels": {},
+                "Mounts": [
+                  {
+                    "Destination": "/usr/local/apache2/htdocs",
+                    "Driver": "local",
+                    "Mode": "z",
+                    "Name": "f1d6fe0188cc05f24309a86b58cf8130f89fa21aaa73f37789ad36fd188b38e2",
+                    "Propagation": "",
+                    "RW": true,
+                    "Source": "/var/lib/docker/volumes/f1d6fe0188cc05f24309a86b58cf8130f89fa21aaa73f37789ad36fd188b38e2/_data",
+                    "Type": "volume"
+                  }
+                ],
+                "Names": [
+                  "/httpd"
+                ],
+                "NetworkSettings": {
+                  "Networks": {
+                    "bridge": {
+                      "Aliases": null,
+                      "DriverOpts": null,
+                      "EndpointID": "2914aa7399460c2e7d48e9c7ae17b29a099bbda9e4fd514ac4cb660c30edf677",
+                      "Gateway": "172.17.0.1",
+                      "GlobalIPv6Address": "",
+                      "GlobalIPv6PrefixLen": 0,
+                      "IPAMConfig": null,
+                      "IPAddress": "172.17.0.2",
+                      "IPPrefixLen": 16,
+                      "IPv6Gateway": "",
+                      "Links": null,
+                      "MacAddress": "02:42:ac:11:00:02",
+                      "NetworkID": "ed5a12608291f91d5c344f685f97665e3b7252d32c71ec15b10c55c3d8eb8235"
+                    }
+                  }
+                },
+                "Ports": [
+                  {
+                    "IP": "0.0.0.0",
+                    "PrivatePort": 80,
+                    "PublicPort": 49153,
+                    "Type": "tcp"
+                  },
+                  {
+                    "IP": "::",
+                    "PrivatePort": 80,
+                    "PublicPort": 49153,
+                    "Type": "tcp"
+                  }
+                ],
+                "State": "running",
+                "Status": "Up 2 days"
+              }
+            ],
+            "Images": [
+              {
+                "Containers": -1,
+                "Created": 1648010665,
+                "Id": "sha256:86a511f3915ac296298506d2caf827e9597483bf84115bbe4e1707829de8534a",
+                "Labels": null,
+                "ParentId": "sha256:d03d4e751a04005e130d20ca4f22b3074b1ffbfdcf6b59a5d85727e267d31d98",
+                "RepoDigests": [
+                  "prabhat/ubuntu@sha256:bfe1371854e7e0e28517a041bfda08ecb3b345738c62092bfdf04f0513c27219"
+                ],
+                "RepoTags": [
+                  "ubuntu-prabhat:latest",
+                  "prabhat/ubuntu:latest"
+                ],
+                "SharedSize": -1,
+                "Size": 753642080,
+                "VirtualSize": 753642080
+              },
+              {
+                "Containers": -1,
+                "Created": 1647581440,
+                "Id": "sha256:ff0fea8310f3957d9b1e6ba494f3e4b63cb348c76160c6c15578e65995ffaa87",
+                "Labels": null,
+                "ParentId": "",
+                "RepoDigests": [
+                  "ubuntu@sha256:bea6d19168bbfd6af8d77c2cc3c572114eb5d113e6f422573c93cb605a0e2ffb"
+                ],
+                "RepoTags": [
+                  "ubuntu:latest"
+                ],
+                "SharedSize": -1,
+                "Size": 72759731,
+                "VirtualSize": 72759731
+              },
+              {
+                "Containers": -1,
+                "Created": 1647285410,
+                "Id": "sha256:6b8e87fff1072470bbfc957a735e7e46007177864a7f61bd9e0f5872d3d7b4a5",
+                "Labels": null,
+                "ParentId": "",
+                "RepoDigests": [
+                  "httpd@sha256:73496cbfc473872dd185154a3b96faa4407d773e893c6a7b9d8f977c331bc45d"
+                ],
+                "RepoTags": [
+                  "httpd:latest"
+                ],
+                "SharedSize": -1,
+                "Size": 143974476,
+                "VirtualSize": 143974476
+              },
+              {
+                "Containers": -1,
+                "Created": 1646799692,
+                "Id": "sha256:a4ca82e34b45e34c0a8bffe4e974983a528e8beca6030c1f9d17ac7f96c7847f",
+                "Labels": null,
+                "ParentId": "",
+                "RepoDigests": [
+                  "portainer/agent@sha256:ca1a51a745f2490cf5345883dd8c5f6a953a15251ab95af246ca9e2fb3436dde"
+                ],
+                "RepoTags": null,
+                "SharedSize": -1,
+                "Size": 154347153,
+                "VirtualSize": 154347153
+              },
+              {
+                "Containers": -1,
+                "Created": 1646143205,
+                "Id": "sha256:c919045c4c2b0b0007c606e763ed2c830c7b1d038ce878a3c0d6f5b81e6ab80b",
+                "Labels": {
+                  "maintainer": "NGINX Docker Maintainers \u003cdocker-maint@nginx.com\u003e"
+                },
+                "ParentId": "",
+                "RepoDigests": [
+                  "nginx@sha256:1c13bc6de5dfca749c377974146ac05256791ca2fe1979fc8e8278bf0121d285",
+                  "prabhat/nginx@sha256:2468d48e476b6a079eb646e87620f96ce1818ac0c5b3a8450532cea64b3421f4"
+                ],
+                "RepoTags": [
+                  "nginx:latest",
+                  "prabhat/nginx:latest"
+                ],
+                "SharedSize": -1,
+                "Size": 141505630,
+                "VirtualSize": 141505630
+              },
+              {
+                "Containers": -1,
+                "Created": 1551997193,
+                "Id": "sha256:6d1ef012b5674ad8a127ecfa9b5e6f5178d171b90ee462846974177fd9bdd39f",
+                "Labels": null,
+                "ParentId": "",
+                "RepoDigests": [
+                  "alpine@sha256:8421d9a84432575381bfabd248f1eb56f3aa21d9d7cd2511583c68c9b7511d10"
+                ],
+                "RepoTags": null,
+                "SharedSize": -1,
+                "Size": 4206494,
+                "VirtualSize": 4206494
+              },
+              {
+                "Containers": -1,
+                "Created": 1460421063,
+                "Id": "sha256:e2b3e8542af735080e6bda06873ce666e2319eea353884a88e45f3c9ef996846",
+                "Labels": {},
+                "ParentId": "",
+                "RepoDigests": [
+                  "gcr.io/google-samples/gb-frontend@sha256:d44e7d7491a537f822e7fe8615437e4a8a08f3a7a1d7d4cb9066b92f7556ba6d"
+                ],
+                "RepoTags": [
+                  "gcr.io/google-samples/gb-frontend:v4"
+                ],
+                "SharedSize": -1,
+                "Size": 512161546,
+                "VirtualSize": 512161546
+              },
+              {
+                "Containers": -1,
+                "Created": 1439232099,
+                "Id": "sha256:5f026ddffa27f011242781f7f2498538334e173869e7fe757008881fb48180b6",
+                "Labels": null,
+                "ParentId": "",
+                "RepoDigests": [
+                  "gcr.io/google_samples/gb-redisslave@sha256:90f62695e641e1a27d1a5e0bbb8b622205a48e18311b51b0da419ffad24b9016"
+                ],
+                "RepoTags": [
+                  "gcr.io/google_samples/gb-redisslave:v1"
+                ],
+                "SharedSize": -1,
+                "Size": 109508753,
+                "VirtualSize": 109508753
+              },
+              {
+                "Containers": -1,
+                "Created": 1426838165,
+                "Id": "sha256:e5e67996c442f903cda78dd983ea6e94bb4e542950fd2eba666b44cbd303df42",
+                "Labels": null,
+                "ParentId": "",
+                "RepoDigests": [
+                  "k8s.gcr.io/redis@sha256:f066bcf26497fbc55b9bf0769cb13a35c0afa2aa42e737cc46b7fb04b23a2f25"
+                ],
+                "RepoTags": [
+                  "k8s.gcr.io/redis:e2e"
+                ],
+                "SharedSize": -1,
+                "Size": 419003740,
+                "VirtualSize": 419003740
+              }
+            ],
+            "Info": {
+              "Architecture": "x86_64",
+              "BridgeNfIp6tables": true,
+              "BridgeNfIptables": true,
+              "CPUSet": true,
+              "CPUShares": true,
+              "CgroupDriver": "cgroupfs",
+              "ClusterAdvertise": "",
+              "ClusterStore": "",
+              "ContainerdCommit": {
+                "Expected": "2a1d4dbdb2a1030dc5b01e96fb110a9d9f150ecc",
+                "ID": "2a1d4dbdb2a1030dc5b01e96fb110a9d9f150ecc"
+              },
+              "Containers": 5,
+              "ContainersPaused": 0,
+              "ContainersRunning": 5,
+              "ContainersStopped": 0,
+              "CpuCfsPeriod": true,
+              "CpuCfsQuota": true,
+              "Debug": false,
+              "DefaultRuntime": "runc",
+              "DockerRootDir": "/var/lib/docker",
+              "Driver": "overlay2",
+              "DriverStatus": [
+                [
+                  "Backing Filesystem",
+                  "extfs"
+                ],
+                [
+                  "Supports d_type",
+                  "true"
+                ],
+                [
+                  "Native Overlay Diff",
+                  "true"
+                ],
+                [
+                  "userxattr",
+                  "false"
+                ]
+              ],
+              "ExperimentalBuild": false,
+              "GenericResources": null,
+              "HttpProxy": "",
+              "HttpsProxy": "",
+              "ID": "UQ2Y:ZHNN:XIZL:66ZK:NJCU:EO2L:BH35:SXHA:6TLU:AA25:PCAE:UQVE",
+              "IPv4Forwarding": true,
+              "Images": 13,
+              "IndexServerAddress": "https://index.docker.io/v1/",
+              "InitBinary": "docker-init",
+              "InitCommit": {
+                "Expected": "de40ad0",
+                "ID": "de40ad0"
+              },
+              "Isolation": "",
+              "KernelMemory": true,
+              "KernelMemoryTCP": true,
+              "KernelVersion": "5.13.0-35-generic",
+              "Labels": [],
+              "LiveRestoreEnabled": false,
+              "LoggingDriver": "json-file",
+              "MemTotal": 25098706944,
+              "MemoryLimit": true,
+              "NCPU": 8,
+              "NEventsListener": 0,
+              "NFd": 813,
+              "NGoroutines": 68,
+              "Name": "prabhat-linux",
+              "NoProxy": "",
+              "OSType": "linux",
+              "OomKillDisable": true,
+              "OperatingSystem": "Zorin OS 16.1",
+              "PidsLimit": true,
+              "Plugins": {
+                "Authorization": null,
+                "Log": [
+                  "awslogs",
+                  "fluentd",
+                  "gcplogs",
+                  "gelf",
+                  "journald",
+                  "json-file",
+                  "local",
+                  "logentries",
+                  "splunk",
+                  "syslog"
+                ],
+                "Network": [
+                  "bridge",
+                  "host",
+                  "ipvlan",
+                  "macvlan",
+                  "null",
+                  "overlay"
+                ],
+                "Volume": [
+                  "local"
+                ]
+              },
+              "RegistryConfig": {
+                "AllowNondistributableArtifactsCIDRs": [],
+                "AllowNondistributableArtifactsHostnames": [],
+                "IndexConfigs": {
+                  "docker.io": {
+                    "Mirrors": [],
+                    "Name": "docker.io",
+                    "Official": true,
+                    "Secure": true
+                  }
+                },
+                "InsecureRegistryCIDRs": [
+                  "127.0.0.0/8"
+                ],
+                "Mirrors": []
+              },
+              "RuncCommit": {
+                "Expected": "v1.0.3-0-gf46b6ba",
+                "ID": "v1.0.3-0-gf46b6ba"
+              },
+              "Runtimes": {
+                "io.containerd.runc.v2": {
+                  "path": "runc"
+                },
+                "io.containerd.runtime.v1.linux": {
+                  "path": "runc"
+                },
+                "runc": {
+                  "path": "runc"
+                }
+              },
+              "SecurityOptions": [
+                "name=apparmor",
+                "name=seccomp,profile=default"
+              ],
+              "ServerVersion": "20.10.13",
+              "SwapLimit": true,
+              "Swarm": {
+                "ControlAvailable": false,
+                "Error": "",
+                "LocalNodeState": "inactive",
+                "NodeAddr": "",
+                "NodeID": "",
+                "RemoteManagers": null
+              },
+              "SystemStatus": null,
+              "SystemTime": "2022-03-30T16:15:12.017274117+13:00",
+              "Warnings": null
+            },
+            "Networks": [
+              {
+                "Attachable": false,
+                "ConfigFrom": {
+                  "Network": ""
+                },
+                "ConfigOnly": false,
+                "Containers": {},
+                "Created": "2022-03-28T08:57:24.093279463+13:00",
+                "Driver": "bridge",
+                "EnableIPv6": false,
+                "IPAM": {
+                  "Config": [
+                    {
+                      "Gateway": "172.17.0.1",
+                      "Subnet": "172.17.0.0/16"
+                    }
+                  ],
+                  "Driver": "default",
+                  "Options": null
+                },
+                "Id": "ed5a12608291f91d5c344f685f97665e3b7252d32c71ec15b10c55c3d8eb8235",
+                "Ingress": false,
+                "Internal": false,
+                "Labels": {},
+                "Name": "bridge",
+                "Options": {
+                  "com.docker.network.bridge.default_bridge": "true",
+                  "com.docker.network.bridge.enable_icc": "true",
+                  "com.docker.network.bridge.enable_ip_masquerade": "true",
+                  "com.docker.network.bridge.host_binding_ipv4": "0.0.0.0",
+                  "com.docker.network.bridge.name": "docker0",
+                  "com.docker.network.driver.mtu": "1500"
+                },
+                "Scope": "local"
+              },
+              {
+                "Attachable": false,
+                "ConfigFrom": {
+                  "Network": ""
+                },
+                "ConfigOnly": false,
+                "Containers": {},
+                "Created": "2022-03-03T23:31:59.297633861+13:00",
+                "Driver": "null",
+                "EnableIPv6": false,
+                "IPAM": {
+                  "Config": [],
+                  "Driver": "default",
+                  "Options": null
+                },
+                "Id": "33c89bff6ff59323ac1c9b10dc7c2920b994b03eca696cfdbabce802f236f6e2",
+                "Ingress": false,
+                "Internal": false,
+                "Labels": {},
+                "Name": "none",
+                "Options": {},
+                "Scope": "local"
+              },
+              {
+                "Attachable": false,
+                "ConfigFrom": {
+                  "Network": ""
+                },
+                "ConfigOnly": false,
+                "Containers": {},
+                "Created": "2022-03-03T23:31:59.309101595+13:00",
+                "Driver": "host",
+                "EnableIPv6": false,
+                "IPAM": {
+                  "Config": [],
+                  "Driver": "default",
+                  "Options": null
+                },
+                "Id": "968304627a446dbe28a9985cbc2b7b8a0414cbb400cfc6533d26dafc715ff175",
+                "Ingress": false,
+                "Internal": false,
+                "Labels": {},
+                "Name": "host",
+                "Options": {},
+                "Scope": "local"
+              },
+              {
+                "Attachable": false,
+                "ConfigFrom": {
+                  "Network": ""
+                },
+                "ConfigOnly": false,
+                "Containers": {},
+                "Created": "2022-03-28T10:01:18.600583916+13:00",
+                "Driver": "bridge",
+                "EnableIPv6": false,
+                "IPAM": {
+                  "Config": [
+                    {
+                      "Gateway": "172.18.0.1",
+                      "Subnet": "172.18.0.0/16"
+                    }
+                  ],
+                  "Driver": "default",
+                  "Options": null
+                },
+                "Id": "817c5491280dd743a47eb32119fe15eb0fc5bff118ae485dcd0d95673fdd55fd",
+                "Ingress": false,
+                "Internal": false,
+                "Labels": {},
+                "Name": "docker_gwbridge",
+                "Options": {
+                  "com.docker.network.bridge.enable_icc": "false",
+                  "com.docker.network.bridge.enable_ip_masquerade": "true",
+                  "com.docker.network.bridge.name": "docker_gwbridge"
+                },
+                "Scope": "local"
+              },
+              {
+                "Attachable": false,
+                "ConfigFrom": {
+                  "Network": ""
+                },
+                "ConfigOnly": false,
+                "Containers": {},
+                "Created": "2022-03-30T16:11:59.214342406+13:00",
+                "Driver": "bridge",
+                "EnableIPv6": false,
+                "IPAM": {
+                  "Config": [
+                    {
+                      "Gateway": "172.19.0.1",
+                      "Subnet": "172.19.0.0/16"
+                    }
+                  ],
+                  "Driver": "default",
+                  "Options": null
+                },
+                "Id": "9fa60f4b6a71b29a95127e99ae0ba09f616386a58ae790f0e8f975e8029f791d",
+                "Ingress": false,
+                "Internal": false,
+                "Labels": {},
+                "Name": "redis_default",
+                "Options": {},
+                "Scope": "local"
+              },
+              {
+                "Attachable": false,
+                "ConfigFrom": {
+                  "Network": ""
+                },
+                "ConfigOnly": false,
+                "Containers": {},
+                "Created": "2022-03-30T16:12:52.93768265+13:00",
+                "Driver": "bridge",
+                "EnableIPv6": false,
+                "IPAM": {
+                  "Config": [
+                    {
+                      "Gateway": "172.20.0.1",
+                      "Subnet": "172.20.0.0/16"
+                    }
+                  ],
+                  "Driver": "default",
+                  "Options": null
+                },
+                "Id": "d9576d8c709d65504ca1d0a654cdc7b13ab17ebc6ae051f74e6b124d9d368c9a",
+                "Ingress": false,
+                "Internal": false,
+                "Labels": {},
+                "Name": "nginx_default",
+                "Options": {},
+                "Scope": "local"
+              }
+            ],
+            "Version": {
+              "ApiVersion": "1.41",
+              "Arch": "amd64",
+              "BuildTime": "2022-03-10T14:05:44.000000000+00:00",
+              "Components": [
+                {
+                  "Details": {
+                    "ApiVersion": "1.41",
+                    "Arch": "amd64",
+                    "BuildTime": "2022-03-10T14:05:44.000000000+00:00",
+                    "Experimental": "false",
+                    "GitCommit": "906f57f",
+                    "GoVersion": "go1.16.15",
+                    "KernelVersion": "5.13.0-35-generic",
+                    "MinAPIVersion": "1.12",
+                    "Os": "linux"
+                  },
+                  "Name": "Engine",
+                  "Version": "20.10.13"
+                },
+                {
+                  "Details": {
+                    "GitCommit": "2a1d4dbdb2a1030dc5b01e96fb110a9d9f150ecc"
+                  },
+                  "Name": "containerd",
+                  "Version": "1.5.10"
+                },
+                {
+                  "Details": {
+                    "GitCommit": "v1.0.3-0-gf46b6ba"
+                  },
+                  "Name": "runc",
+                  "Version": "1.0.3"
+                },
+                {
+                  "Details": {
+                    "GitCommit": "de40ad0"
+                  },
+                  "Name": "docker-init",
+                  "Version": "0.19.0"
+                }
+              ],
+              "GitCommit": "906f57f",
+              "GoVersion": "go1.16.15",
+              "KernelVersion": "5.13.0-35-generic",
+              "MinAPIVersion": "1.12",
+              "Os": "linux",
+              "Platform": {
+                "Name": "Docker Engine - Community"
+              },
+              "Version": "20.10.13"
+            },
+            "Volumes": {
+              "Volumes": [
+                {
+                  "CreatedAt": "2022-03-22T19:52:28+13:00",
+                  "Driver": "local",
+                  "Labels": null,
+                  "Mountpoint": "/var/lib/docker/volumes/prabhat/_data",
+                  "Name": "prabhat",
+                  "Options": {
+                    "device": "/home/prabhat/portainer/mounted",
+                    "type": "tmpfs"
+                  },
+                  "Scope": "local"
+                },
+                {
+                  "CreatedAt": "2022-03-18T13:51:39+13:00",
+                  "Driver": "local",
+                  "Labels": null,
+                  "Mountpoint": "/var/lib/docker/volumes/bc9d2f97a920b6be6869dc69738b1e682234d3b530539986eb5343bcf5572983/_data",
+                  "Name": "bc9d2f97a920b6be6869dc69738b1e682234d3b530539986eb5343bcf5572983",
+                  "Options": null,
+                  "Scope": "local"
+                },
+                {
+                  "CreatedAt": "2022-03-30T16:12:01+13:00",
+                  "Driver": "local",
+                  "Labels": null,
+                  "Mountpoint": "/var/lib/docker/volumes/a3fedc4b90b70e9f28456b4f88f8a2ebd90f76cf8a8a5e4fb5dcbd0b90ff0153/_data",
+                  "Name": "a3fedc4b90b70e9f28456b4f88f8a2ebd90f76cf8a8a5e4fb5dcbd0b90ff0153",
+                  "Options": null,
+                  "Scope": "local"
+                },
+                {
+                  "CreatedAt": "2022-03-30T16:12:01+13:00",
+                  "Driver": "local",
+                  "Labels": null,
+                  "Mountpoint": "/var/lib/docker/volumes/5f93240d96e42d0b3728435cbfb43b6fcb3b01446d5c7d4be1cba8f9336c0a58/_data",
+                  "Name": "5f93240d96e42d0b3728435cbfb43b6fcb3b01446d5c7d4be1cba8f9336c0a58",
+                  "Options": null,
+                  "Scope": "local"
+                },
+                {
+                  "CreatedAt": "2022-03-16T10:55:05+13:00",
+                  "Driver": "local",
+                  "Labels": null,
+                  "Mountpoint": "/var/lib/docker/volumes/f1d6fe0188cc05f24309a86b58cf8130f89fa21aaa73f37789ad36fd188b38e2/_data",
+                  "Name": "f1d6fe0188cc05f24309a86b58cf8130f89fa21aaa73f37789ad36fd188b38e2",
+                  "Options": null,
+                  "Scope": "local"
+                },
+                {
+                  "CreatedAt": "2022-03-09T12:05:37+13:00",
+                  "Driver": "local",
+                  "Labels": null,
+                  "Mountpoint": "/var/lib/docker/volumes/83aea89faf9721ec0065ea37b32608a504088ac86a882069776be3899a0034a5/_data",
+                  "Name": "83aea89faf9721ec0065ea37b32608a504088ac86a882069776be3899a0034a5",
+                  "Options": null,
+                  "Scope": "local"
+                },
+                {
+                  "CreatedAt": "2022-03-11T08:56:01+13:00",
+                  "Driver": "local",
+                  "Labels": null,
+                  "Mountpoint": "/var/lib/docker/volumes/d38856ca6c6879a8c667c300aa6e4c35c2ba93d1a1b06ba78813141fd27b0697/_data",
+                  "Name": "d38856ca6c6879a8c667c300aa6e4c35c2ba93d1a1b06ba78813141fd27b0697",
+                  "Options": null,
+                  "Scope": "local"
+                },
+                {
+                  "CreatedAt": "2022-03-22T22:06:49+13:00",
+                  "Driver": "local",
+                  "Labels": null,
+                  "Mountpoint": "/var/lib/docker/volumes/pk/_data",
+                  "Name": "pk",
+                  "Options": {},
+                  "Scope": "local"
+                },
+                {
+                  "CreatedAt": "2022-03-22T22:02:46+13:00",
+                  "Driver": "local",
+                  "Labels": {},
+                  "Mountpoint": "/var/lib/docker/volumes/test-vol/_data",
+                  "Name": "test-vol",
+                  "Options": {},
+                  "Scope": "local"
+                },
+                {
+                  "CreatedAt": "2022-03-16T10:49:47+13:00",
+                  "Driver": "local",
+                  "Labels": null,
+                  "Mountpoint": "/var/lib/docker/volumes/326d246e9371e4b426b018a7093a522f699a79bf6dda185314ef6683747a5836/_data",
+                  "Name": "326d246e9371e4b426b018a7093a522f699a79bf6dda185314ef6683747a5836",
+                  "Options": null,
+                  "Scope": "local"
+                }
+              ],
+              "Warnings": null
+            }
+          },
+          "StackCount": 2,
+          "StoppedContainerCount": 0,
+          "Swarm": false,
+          "Time": 1648610112,
+          "TotalCPU": 8,
+          "TotalMemory": 25098706944,
+          "UnhealthyContainerCount": 0,
+          "VolumeCount": 10
+        }
+      ],
+      "Status": 1,
+      "TLSConfig": {
+        "TLS": false,
+        "TLSSkipVerify": false
+      },
+      "TagIds": [],
+      "Tags": null,
+      "TeamAccessPolicies": {},
+      "Type": 1,
+      "URL": "unix:///var/run/docker.sock",
+      "UserAccessPolicies": {}
+    }
+  ],
+  "registries": [
+    {
+      "Authentication": true,
+      "AuthorizedTeams": null,
+      "AuthorizedUsers": null,
+      "Gitlab": {
+        "InstanceURL": "",
+        "ProjectId": 0,
+        "ProjectPath": ""
+      },
+      "Id": 1,
+      "ManagementConfiguration": null,
+      "Name": "canister.io",
+      "Password": "MjWbx8A6YK7cw7",
+      "TeamAccessPolicies": {},
+      "Type": 3,
+      "URL": "cloud.canister.io:5000",
+      "UserAccessPolicies": {},
+      "Username": "prabhatkhera"
+    }
+  ],
+  "resource_control": [
+    {
+      "AdministratorsOnly": false,
+      "Id": 2,
+      "Public": true,
+      "ResourceId": "762gbwaj8r4gcsdy8ld1u4why",
+      "SubResourceIds": [],
+      "System": false,
+      "TeamAccesses": [],
+      "Type": 5,
+      "UserAccesses": []
+    },
+    {
+      "AdministratorsOnly": false,
+      "Id": 3,
+      "Public": true,
+      "ResourceId": "alpine",
+      "SubResourceIds": [],
+      "System": false,
+      "TeamAccesses": [],
+      "Type": 6,
+      "UserAccesses": []
+    },
+    {
+      "AdministratorsOnly": false,
+      "Id": 4,
+      "Public": true,
+      "ResourceId": "redis",
+      "SubResourceIds": [],
+      "System": false,
+      "TeamAccesses": [],
+      "Type": 6,
+      "UserAccesses": []
+    },
+    {
+      "AdministratorsOnly": false,
+      "Id": 5,
+      "Public": false,
+      "ResourceId": "nginx",
+      "SubResourceIds": [],
+      "System": false,
+      "TeamAccesses": [
+        {
+          "AccessLevel": 1,
+          "TeamId": 1
+        }
+      ],
+      "Type": 6,
+      "UserAccesses": []
+    }
+  ],
+  "roles": [
+    {
+      "Authorizations": {
+        "DockerAgentBrowseDelete": true,
+        "DockerAgentBrowseGet": true,
+        "DockerAgentBrowseList": true,
+        "DockerAgentBrowsePut": true,
+        "DockerAgentBrowseRename": true,
+        "DockerAgentHostInfo": true,
+        "DockerAgentList": true,
+        "DockerAgentPing": true,
+        "DockerAgentUndefined": true,
+        "DockerBuildCancel": true,
+        "DockerBuildPrune": true,
+        "DockerConfigCreate": true,
+        "DockerConfigDelete": true,
+        "DockerConfigInspect": true,
+        "DockerConfigList": true,
+        "DockerConfigUpdate": true,
+        "DockerContainerArchive": true,
+        "DockerContainerArchiveInfo": true,
+        "DockerContainerAttach": true,
+        "DockerContainerAttachWebsocket": true,
+        "DockerContainerChanges": true,
+        "DockerContainerCreate": true,
+        "DockerContainerDelete": true,
+        "DockerContainerExec": true,
+        "DockerContainerExport": true,
+        "DockerContainerInspect": true,
+        "DockerContainerKill": true,
+        "DockerContainerList": true,
+        "DockerContainerLogs": true,
+        "DockerContainerPause": true,
+        "DockerContainerPrune": true,
+        "DockerContainerPutContainerArchive": true,
+        "DockerContainerRename": true,
+        "DockerContainerResize": true,
+        "DockerContainerRestart": true,
+        "DockerContainerStart": true,
+        "DockerContainerStats": true,
+        "DockerContainerStop": true,
+        "DockerContainerTop": true,
+        "DockerContainerUnpause": true,
+        "DockerContainerUpdate": true,
+        "DockerContainerWait": true,
+        "DockerDistributionInspect": true,
+        "DockerEvents": true,
+        "DockerExecInspect": true,
+        "DockerExecResize": true,
+        "DockerExecStart": true,
+        "DockerImageBuild": true,
+        "DockerImageCommit": true,
+        "DockerImageCreate": true,
+        "DockerImageDelete": true,
+        "DockerImageGet": true,
+        "DockerImageGetAll": true,
+        "DockerImageHistory": true,
+        "DockerImageInspect": true,
+        "DockerImageList": true,
+        "DockerImageLoad": true,
+        "DockerImagePrune": true,
+        "DockerImagePush": true,
+        "DockerImageSearch": true,
+        "DockerImageTag": true,
+        "DockerInfo": true,
+        "DockerNetworkConnect": true,
+        "DockerNetworkCreate": true,
+        "DockerNetworkDelete": true,
+        "DockerNetworkDisconnect": true,
+        "DockerNetworkInspect": true,
+        "DockerNetworkList": true,
+        "DockerNetworkPrune": true,
+        "DockerNodeDelete": true,
+        "DockerNodeInspect": true,
+        "DockerNodeList": true,
+        "DockerNodeUpdate": true,
+        "DockerPing": true,
+        "DockerPluginCreate": true,
+        "DockerPluginDelete": true,
+        "DockerPluginDisable": true,
+        "DockerPluginEnable": true,
+        "DockerPluginInspect": true,
+        "DockerPluginList": true,
+        "DockerPluginPrivileges": true,
+        "DockerPluginPull": true,
+        "DockerPluginPush": true,
+        "DockerPluginSet": true,
+        "DockerPluginUpgrade": true,
+        "DockerSecretCreate": true,
+        "DockerSecretDelete": true,
+        "DockerSecretInspect": true,
+        "DockerSecretList": true,
+        "DockerSecretUpdate": true,
+        "DockerServiceCreate": true,
+        "DockerServiceDelete": true,
+        "DockerServiceInspect": true,
+        "DockerServiceList": true,
+        "DockerServiceLogs": true,
+        "DockerServiceUpdate": true,
+        "DockerSessionStart": true,
+        "DockerSwarmInit": true,
+        "DockerSwarmInspect": true,
+        "DockerSwarmJoin": true,
+        "DockerSwarmLeave": true,
+        "DockerSwarmUnlock": true,
+        "DockerSwarmUnlockKey": true,
+        "DockerSwarmUpdate": true,
+        "DockerSystem": true,
+        "DockerTaskInspect": true,
+        "DockerTaskList": true,
+        "DockerTaskLogs": true,
+        "DockerUndefined": true,
+        "DockerVersion": true,
+        "DockerVolumeCreate": true,
+        "DockerVolumeDelete": true,
+        "DockerVolumeInspect": true,
+        "DockerVolumeList": true,
+        "DockerVolumePrune": true,
+        "EndpointResourcesAccess": true,
+        "IntegrationStoridgeAdmin": true,
+        "PortainerResourceControlCreate": true,
+        "PortainerResourceControlUpdate": true,
+        "PortainerStackCreate": true,
+        "PortainerStackDelete": true,
+        "PortainerStackFile": true,
+        "PortainerStackInspect": true,
+        "PortainerStackList": true,
+        "PortainerStackMigrate": true,
+        "PortainerStackUpdate": true,
+        "PortainerWebhookCreate": true,
+        "PortainerWebhookDelete": true,
+        "PortainerWebhookList": true,
+        "PortainerWebsocketExec": true
+      },
+      "Description": "Full control of all resources in an endpoint",
+      "Id": 1,
+      "Name": "Endpoint administrator",
+      "Priority": 1
+    },
+    {
+      "Authorizations": {
+        "DockerAgentHostInfo": true,
+        "DockerAgentList": true,
+        "DockerAgentPing": true,
+        "DockerConfigInspect": true,
+        "DockerConfigList": true,
+        "DockerContainerArchiveInfo": true,
+        "DockerContainerChanges": true,
+        "DockerContainerInspect": true,
+        "DockerContainerList": true,
+        "DockerContainerLogs": true,
+        "DockerContainerStats": true,
+        "DockerContainerTop": true,
+        "DockerDistributionInspect": true,
+        "DockerEvents": true,
+        "DockerImageGet": true,
+        "DockerImageGetAll": true,
+        "DockerImageHistory": true,
+        "DockerImageInspect": true,
+        "DockerImageList": true,
+        "DockerImageSearch": true,
+        "DockerInfo": true,
+        "DockerNetworkInspect": true,
+        "DockerNetworkList": true,
+        "DockerNodeInspect": true,
+        "DockerNodeList": true,
+        "DockerPing": true,
+        "DockerPluginList": true,
+        "DockerSecretInspect": true,
+        "DockerSecretList": true,
+        "DockerServiceInspect": true,
+        "DockerServiceList": true,
+        "DockerServiceLogs": true,
+        "DockerSwarmInspect": true,
+        "DockerSystem": true,
+        "DockerTaskInspect": true,
+        "DockerTaskList": true,
+        "DockerTaskLogs": true,
+        "DockerVersion": true,
+        "DockerVolumeInspect": true,
+        "DockerVolumeList": true,
+        "EndpointResourcesAccess": true,
+        "PortainerStackFile": true,
+        "PortainerStackInspect": true,
+        "PortainerStackList": true,
+        "PortainerWebhookList": true
+      },
+      "Description": "Read-only access of all resources in an endpoint",
+      "Id": 2,
+      "Name": "Helpdesk",
+      "Priority": 2
+    },
+    {
+      "Authorizations": {
+        "DockerAgentHostInfo": true,
+        "DockerAgentList": true,
+        "DockerAgentPing": true,
+        "DockerAgentUndefined": true,
+        "DockerBuildCancel": true,
+        "DockerBuildPrune": true,
+        "DockerConfigCreate": true,
+        "DockerConfigDelete": true,
+        "DockerConfigInspect": true,
+        "DockerConfigList": true,
+        "DockerConfigUpdate": true,
+        "DockerContainerArchive": true,
+        "DockerContainerArchiveInfo": true,
+        "DockerContainerAttach": true,
+        "DockerContainerAttachWebsocket": true,
+        "DockerContainerChanges": true,
+        "DockerContainerCreate": true,
+        "DockerContainerDelete": true,
+        "DockerContainerExec": true,
+        "DockerContainerExport": true,
+        "DockerContainerInspect": true,
+        "DockerContainerKill": true,
+        "DockerContainerList": true,
+        "DockerContainerLogs": true,
+        "DockerContainerPause": true,
+        "DockerContainerPutContainerArchive": true,
+        "DockerContainerRename": true,
+        "DockerContainerResize": true,
+        "DockerContainerRestart": true,
+        "DockerContainerStart": true,
+        "DockerContainerStats": true,
+        "DockerContainerStop": true,
+        "DockerContainerTop": true,
+        "DockerContainerUnpause": true,
+        "DockerContainerUpdate": true,
+        "DockerContainerWait": true,
+        "DockerDistributionInspect": true,
+        "DockerEvents": true,
+        "DockerExecInspect": true,
+        "DockerExecResize": true,
+        "DockerExecStart": true,
+        "DockerImageBuild": true,
+        "DockerImageCommit": true,
+        "DockerImageCreate": true,
+        "DockerImageDelete": true,
+        "DockerImageGet": true,
+        "DockerImageGetAll": true,
+        "DockerImageHistory": true,
+        "DockerImageInspect": true,
+        "DockerImageList": true,
+        "DockerImageLoad": true,
+        "DockerImagePush": true,
+        "DockerImageSearch": true,
+        "DockerImageTag": true,
+        "DockerInfo": true,
+        "DockerNetworkConnect": true,
+        "DockerNetworkCreate": true,
+        "DockerNetworkDelete": true,
+        "DockerNetworkDisconnect": true,
+        "DockerNetworkInspect": true,
+        "DockerNetworkList": true,
+        "DockerNodeDelete": true,
+        "DockerNodeInspect": true,
+        "DockerNodeList": true,
+        "DockerNodeUpdate": true,
+        "DockerPing": true,
+        "DockerPluginCreate": true,
+        "DockerPluginDelete": true,
+        "DockerPluginDisable": true,
+        "DockerPluginEnable": true,
+        "DockerPluginInspect": true,
+        "DockerPluginList": true,
+        "DockerPluginPrivileges": true,
+        "DockerPluginPull": true,
+        "DockerPluginPush": true,
+        "DockerPluginSet": true,
+        "DockerPluginUpgrade": true,
+        "DockerSecretCreate": true,
+        "DockerSecretDelete": true,
+        "DockerSecretInspect": true,
+        "DockerSecretList": true,
+        "DockerSecretUpdate": true,
+        "DockerServiceCreate": true,
+        "DockerServiceDelete": true,
+        "DockerServiceInspect": true,
+        "DockerServiceList": true,
+        "DockerServiceLogs": true,
+        "DockerServiceUpdate": true,
+        "DockerSessionStart": true,
+        "DockerSwarmInit": true,
+        "DockerSwarmInspect": true,
+        "DockerSwarmJoin": true,
+        "DockerSwarmLeave": true,
+        "DockerSwarmUnlock": true,
+        "DockerSwarmUnlockKey": true,
+        "DockerSwarmUpdate": true,
+        "DockerSystem": true,
+        "DockerTaskInspect": true,
+        "DockerTaskList": true,
+        "DockerTaskLogs": true,
+        "DockerUndefined": true,
+        "DockerVersion": true,
+        "DockerVolumeCreate": true,
+        "DockerVolumeDelete": true,
+        "DockerVolumeInspect": true,
+        "DockerVolumeList": true,
+        "PortainerResourceControlUpdate": true,
+        "PortainerStackCreate": true,
+        "PortainerStackDelete": true,
+        "PortainerStackFile": true,
+        "PortainerStackInspect": true,
+        "PortainerStackList": true,
+        "PortainerStackMigrate": true,
+        "PortainerStackUpdate": true,
+        "PortainerWebhookCreate": true,
+        "PortainerWebhookList": true,
+        "PortainerWebsocketExec": true
+      },
+      "Description": "Full control of assigned resources in an endpoint",
+      "Id": 3,
+      "Name": "Standard user",
+      "Priority": 3
+    },
+    {
+      "Authorizations": {
+        "DockerAgentHostInfo": true,
+        "DockerAgentList": true,
+        "DockerAgentPing": true,
+        "DockerConfigInspect": true,
+        "DockerConfigList": true,
+        "DockerContainerArchiveInfo": true,
+        "DockerContainerChanges": true,
+        "DockerContainerInspect": true,
+        "DockerContainerList": true,
+        "DockerContainerLogs": true,
+        "DockerContainerStats": true,
+        "DockerContainerTop": true,
+        "DockerDistributionInspect": true,
+        "DockerEvents": true,
+        "DockerImageGet": true,
+        "DockerImageGetAll": true,
+        "DockerImageHistory": true,
+        "DockerImageInspect": true,
+        "DockerImageList": true,
+        "DockerImageSearch": true,
+        "DockerInfo": true,
+        "DockerNetworkInspect": true,
+        "DockerNetworkList": true,
+        "DockerNodeInspect": true,
+        "DockerNodeList": true,
+        "DockerPing": true,
+        "DockerPluginList": true,
+        "DockerSecretInspect": true,
+        "DockerSecretList": true,
+        "DockerServiceInspect": true,
+        "DockerServiceList": true,
+        "DockerServiceLogs": true,
+        "DockerSwarmInspect": true,
+        "DockerSystem": true,
+        "DockerTaskInspect": true,
+        "DockerTaskList": true,
+        "DockerTaskLogs": true,
+        "DockerVersion": true,
+        "DockerVolumeInspect": true,
+        "DockerVolumeList": true,
+        "PortainerStackFile": true,
+        "PortainerStackInspect": true,
+        "PortainerStackList": true,
+        "PortainerWebhookList": true
+      },
+      "Description": "Read-only access of assigned resources in an endpoint",
+      "Id": 4,
+      "Name": "Read-only user",
+      "Priority": 4
+    }
+  ],
+  "schedules": [
+    {
+      "Created": 1648608136,
+      "CronExpression": "@every 5m",
+      "EdgeSchedule": null,
+      "EndpointSyncJob": null,
+      "Id": 1,
+      "JobType": 2,
+      "Name": "system_snapshot",
+      "Recurring": true,
+      "ScriptExecutionJob": null,
+      "SnapshotJob": {}
+    }
+  ],
+  "settings": {
+    "AllowBindMountsForRegularUsers": true,
+    "AllowContainerCapabilitiesForRegularUsers": true,
+    "AllowDeviceMappingForRegularUsers": true,
+    "AllowHostNamespaceForRegularUsers": true,
+    "AllowPrivilegedModeForRegularUsers": true,
+    "AllowStackManagementForRegularUsers": true,
+    "AllowVolumeBrowserForRegularUsers": false,
+    "AuthenticationMethod": 1,
+    "BlackListedLabels": [],
+    "DisplayDonationHeader": false,
+    "DisplayExternalContributors": false,
+    "EdgeAgentCheckinInterval": 5,
+    "EnableEdgeComputeFeatures": false,
+    "EnableHostManagementFeatures": false,
+    "LDAPSettings": {
+      "AnonymousMode": true,
+      "AutoCreateUsers": true,
+      "GroupSearchSettings": [
+        {
+          "GroupAttribute": "",
+          "GroupBaseDN": "",
+          "GroupFilter": ""
+        }
+      ],
+      "ReaderDN": "",
+      "SearchSettings": [
+        {
+          "BaseDN": "",
+          "Filter": "",
+          "UserNameAttribute": ""
+        }
+      ],
+      "StartTLS": false,
+      "TLSConfig": {
+        "TLS": false,
+        "TLSSkipVerify": false
+      },
+      "URL": ""
+    },
+    "LogoURL": "",
+    "OAuthSettings": {
+      "AccessTokenURI": "",
+      "AuthorizationURI": "",
+      "ClientID": "",
+      "DefaultTeamID": 0,
+      "OAuthAutoCreateUsers": false,
+      "RedirectURI": "",
+      "ResourceURI": "",
+      "Scopes": "",
+      "UserIdentifier": ""
+    },
+    "SnapshotInterval": "5m",
+    "TemplatesURL": ""
+  },
+  "stacks": [
+    {
+      "EndpointId": 1,
+      "EntryPoint": "docker/alpine37-compose.yml",
+      "Env": [],
+      "Id": 2,
+      "Name": "alpine",
+      "ProjectPath": "/home/prabhat/portainer/data/ce1.25/compose/2",
+      "ResourceControl": null,
+      "SwarmId": "s3fd604zdba7z13tbq2x6lyue",
+      "Type": 1
+    },
+    {
+      "EndpointId": 1,
+      "EntryPoint": "docker-compose.yml",
+      "Env": [],
+      "Id": 5,
+      "Name": "redis",
+      "ProjectPath": "/home/prabhat/portainer/data/ce1.25/compose/5",
+      "ResourceControl": null,
+      "SwarmId": "",
+      "Type": 2
+    },
+    {
+      "EndpointId": 1,
+      "EntryPoint": "docker-compose.yml",
+      "Env": [],
+      "Id": 6,
+      "Name": "nginx",
+      "ProjectPath": "/home/prabhat/portainer/data/ce1.25/compose/6",
+      "ResourceControl": null,
+      "SwarmId": "",
+      "Type": 2
+    }
+  ],
+  "teams": [
+    {
+      "Id": 1,
+      "Name": "hello"
+    }
+  ],
+  "templates": [
+    {
+      "Id": 1,
+      "administrator_only": false,
+      "categories": [
+        "docker"
+      ],
+      "description": "Docker image registry",
+      "image": "registry:latest",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/registry.png",
+      "platform": "linux",
+      "ports": [
+        "5000/tcp"
+      ],
+      "repository": {
+        "stackfile": "",
+        "url": ""
+      },
+      "stackFile": "",
+      "title": "Registry",
+      "type": 1,
+      "volumes": [
+        {
+          "container": "/var/lib/registry"
+        }
+      ]
+    },
+    {
+      "Id": 2,
+      "administrator_only": false,
+      "categories": [
+        "webserver"
+      ],
+      "description": "High performance web server",
+      "image": "nginx:latest",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/nginx.png",
+      "platform": "linux",
+      "ports": [
+        "80/tcp",
+        "443/tcp"
+      ],
+      "repository": {
+        "stackfile": "",
+        "url": ""
+      },
+      "stackFile": "",
+      "title": "Nginx",
+      "type": 1,
+      "volumes": [
+        {
+          "container": "/etc/nginx"
+        },
+        {
+          "container": "/usr/share/nginx/html"
+        }
+      ]
+    },
+    {
+      "Id": 3,
+      "administrator_only": false,
+      "categories": [
+        "webserver"
+      ],
+      "description": "Open-source HTTP server",
+      "image": "httpd:latest",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/httpd.png",
+      "platform": "linux",
+      "ports": [
+        "80/tcp"
+      ],
+      "repository": {
+        "stackfile": "",
+        "url": ""
+      },
+      "stackFile": "",
+      "title": "Httpd",
+      "type": 1,
+      "volumes": [
+        {
+          "container": "/usr/local/apache2/htdocs/"
+        }
+      ]
+    },
+    {
+      "Id": 4,
+      "administrator_only": false,
+      "categories": [
+        "webserver"
+      ],
+      "description": "HTTP/2 web server with automatic HTTPS",
+      "image": "abiosoft/caddy:latest",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/caddy.png",
+      "platform": "linux",
+      "ports": [
+        "80/tcp",
+        "443/tcp",
+        "2015/tcp"
+      ],
+      "repository": {
+        "stackfile": "",
+        "url": ""
+      },
+      "stackFile": "",
+      "title": "Caddy",
+      "type": 1,
+      "volumes": [
+        {
+          "container": "/root/.caddy"
+        }
+      ]
+    },
+    {
+      "Id": 5,
+      "administrator_only": false,
+      "categories": [
+        "database"
+      ],
+      "description": "The most popular open-source database",
+      "env": [
+        {
+          "label": "Root password",
+          "name": "MYSQL_ROOT_PASSWORD"
+        }
+      ],
+      "image": "mysql:latest",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/mysql.png",
+      "platform": "linux",
+      "ports": [
+        "3306/tcp"
+      ],
+      "repository": {
+        "stackfile": "",
+        "url": ""
+      },
+      "stackFile": "",
+      "title": "MySQL",
+      "type": 1,
+      "volumes": [
+        {
+          "container": "/var/lib/mysql"
+        }
+      ]
+    },
+    {
+      "Id": 6,
+      "administrator_only": false,
+      "categories": [
+        "database"
+      ],
+      "description": "Performance beyond MySQL",
+      "env": [
+        {
+          "label": "Root password",
+          "name": "MYSQL_ROOT_PASSWORD"
+        }
+      ],
+      "image": "mariadb:latest",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/mariadb.png",
+      "platform": "linux",
+      "ports": [
+        "3306/tcp"
+      ],
+      "repository": {
+        "stackfile": "",
+        "url": ""
+      },
+      "stackFile": "",
+      "title": "MariaDB",
+      "type": 1,
+      "volumes": [
+        {
+          "container": "/var/lib/mysql"
+        }
+      ]
+    },
+    {
+      "Id": 7,
+      "administrator_only": false,
+      "categories": [
+        "database"
+      ],
+      "description": "The most advanced open-source database",
+      "env": [
+        {
+          "label": "Superuser",
+          "name": "POSTGRES_USER"
+        },
+        {
+          "label": "Superuser password",
+          "name": "POSTGRES_PASSWORD"
+        }
+      ],
+      "image": "postgres:latest",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/postgres.png",
+      "platform": "linux",
+      "ports": [
+        "5432/tcp"
+      ],
+      "repository": {
+        "stackfile": "",
+        "url": ""
+      },
+      "stackFile": "",
+      "title": "PostgreSQL",
+      "type": 1,
+      "volumes": [
+        {
+          "container": "/var/lib/postgresql/data"
+        }
+      ]
+    },
+    {
+      "Id": 8,
+      "administrator_only": false,
+      "categories": [
+        "database"
+      ],
+      "description": "Open-source document-oriented database",
+      "image": "mongo:latest",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/mongo.png",
+      "platform": "linux",
+      "ports": [
+        "27017/tcp"
+      ],
+      "repository": {
+        "stackfile": "",
+        "url": ""
+      },
+      "stackFile": "",
+      "title": "Mongo",
+      "type": 1,
+      "volumes": [
+        {
+          "container": "/data/db"
+        }
+      ]
+    },
+    {
+      "Id": 9,
+      "administrator_only": false,
+      "categories": [
+        "database"
+      ],
+      "command": "start --insecure",
+      "description": "An open-source, survivable, strongly consistent, scale-out SQL database",
+      "image": "cockroachdb/cockroach:latest",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/cockroachdb.png",
+      "platform": "linux",
+      "ports": [
+        "26257/tcp",
+        "8080/tcp"
+      ],
+      "repository": {
+        "stackfile": "",
+        "url": ""
+      },
+      "stackFile": "",
+      "title": "CockroachDB",
+      "type": 1,
+      "volumes": [
+        {
+          "container": "/cockroach/cockroach-data"
+        }
+      ]
+    },
+    {
+      "Id": 10,
+      "administrator_only": false,
+      "categories": [
+        "database"
+      ],
+      "description": "An open-source distributed SQL database",
+      "image": "crate:latest",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/cratedb.png",
+      "platform": "linux",
+      "ports": [
+        "4200/tcp",
+        "4300/tcp"
+      ],
+      "repository": {
+        "stackfile": "",
+        "url": ""
+      },
+      "stackFile": "",
+      "title": "CrateDB",
+      "type": 1,
+      "volumes": [
+        {
+          "container": "/data"
+        }
+      ]
+    },
+    {
+      "Id": 11,
+      "administrator_only": false,
+      "categories": [
+        "database"
+      ],
+      "description": "Open-source search and analytics engine",
+      "image": "elasticsearch:latest",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/elasticsearch.png",
+      "platform": "linux",
+      "ports": [
+        "9200/tcp",
+        "9300/tcp"
+      ],
+      "repository": {
+        "stackfile": "",
+        "url": ""
+      },
+      "stackFile": "",
+      "title": "Elasticsearch",
+      "type": 1,
+      "volumes": [
+        {
+          "container": "/usr/share/elasticsearch/data"
+        }
+      ]
+    },
+    {
+      "Id": 12,
+      "administrator_only": false,
+      "categories": [
+        "development",
+        "project-management"
+      ],
+      "description": "Open-source end-to-end software development platform",
+      "image": "gitlab/gitlab-ce:latest",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/gitlab_ce.png",
+      "note": "Default username is \u003cb\u003eroot\u003c/b\u003e. Check the \u003ca href=\"https://docs.gitlab.com/omnibus/docker/README.html#after-starting-a-container\" target=\"_blank\"\u003eGitlab documentation\u003c/a\u003e to get started.",
+      "platform": "linux",
+      "ports": [
+        "80/tcp",
+        "443/tcp",
+        "22/tcp"
+      ],
+      "repository": {
+        "stackfile": "",
+        "url": ""
+      },
+      "stackFile": "",
+      "title": "Gitlab CE",
+      "type": 1,
+      "volumes": [
+        {
+          "container": "/etc/gitlab"
+        },
+        {
+          "container": "/var/log/gitlab"
+        },
+        {
+          "container": "/var/opt/gitlab"
+        }
+      ]
+    },
+    {
+      "Id": 13,
+      "administrator_only": false,
+      "categories": [
+        "storage"
+      ],
+      "command": "server /data",
+      "description": "A distributed object storage server built for cloud applications and devops",
+      "env": [
+        {
+          "label": "Minio access key",
+          "name": "MINIO_ACCESS_KEY"
+        },
+        {
+          "label": "Minio secret key",
+          "name": "MINIO_SECRET_KEY"
+        }
+      ],
+      "image": "minio/minio:latest",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/minio.png",
+      "platform": "linux",
+      "ports": [
+        "9000/tcp"
+      ],
+      "repository": {
+        "stackfile": "",
+        "url": ""
+      },
+      "stackFile": "",
+      "title": "Minio",
+      "type": 1,
+      "volumes": [
+        {
+          "container": "/data"
+        },
+        {
+          "container": "/root/.minio"
+        }
+      ]
+    },
+    {
+      "Id": 14,
+      "administrator_only": false,
+      "categories": [
+        "storage"
+      ],
+      "description": "Standalone AWS S3 protocol server",
+      "env": [
+        {
+          "label": "Scality S3 access key",
+          "name": "SCALITY_ACCESS_KEY"
+        },
+        {
+          "label": "Scality S3 secret key",
+          "name": "SCALITY_SECRET_KEY"
+        }
+      ],
+      "image": "scality/s3server",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/scality-s3.png",
+      "platform": "linux",
+      "ports": [
+        "8000/tcp"
+      ],
+      "repository": {
+        "stackfile": "",
+        "url": ""
+      },
+      "stackFile": "",
+      "title": "Scality S3",
+      "type": 1,
+      "volumes": [
+        {
+          "container": "/usr/src/app/localData"
+        },
+        {
+          "container": "/usr/src/app/localMetadata"
+        }
+      ]
+    },
+    {
+      "Id": 15,
+      "administrator_only": false,
+      "categories": [
+        "database"
+      ],
+      "description": "Microsoft SQL Server on Linux",
+      "env": [
+        {
+          "name": "ACCEPT_EULA"
+        },
+        {
+          "label": "SA password",
+          "name": "SA_PASSWORD"
+        }
+      ],
+      "image": "microsoft/mssql-server-linux:2017-GA",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/microsoft.png",
+      "note": "Password needs to include at least 8 characters including uppercase, lowercase letters, base-10 digits and/or non-alphanumeric symbols.",
+      "platform": "linux",
+      "ports": [
+        "1433/tcp"
+      ],
+      "repository": {
+        "stackfile": "",
+        "url": ""
+      },
+      "stackFile": "",
+      "title": "SQL Server",
+      "type": 1
+    },
+    {
+      "Id": 16,
+      "administrator_only": false,
+      "categories": [
+        "database"
+      ],
+      "description": "Microsoft SQL Server Developer for Windows containers",
+      "env": [
+        {
+          "name": "ACCEPT_EULA"
+        },
+        {
+          "label": "SA password",
+          "name": "sa_password"
+        }
+      ],
+      "image": "microsoft/mssql-server-windows-developer:latest",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/microsoft.png",
+      "note": "Password needs to include at least 8 characters including uppercase, lowercase letters, base-10 digits and/or non-alphanumeric symbols.",
+      "platform": "windows",
+      "ports": [
+        "1433/tcp"
+      ],
+      "repository": {
+        "stackfile": "",
+        "url": ""
+      },
+      "stackFile": "",
+      "title": "SQL Server",
+      "type": 1,
+      "volumes": [
+        {
+          "container": "C:/temp/"
+        }
+      ]
+    },
+    {
+      "Id": 17,
+      "administrator_only": false,
+      "categories": [
+        "database"
+      ],
+      "description": "Microsoft SQL Server Express for Windows containers",
+      "env": [
+        {
+          "name": "ACCEPT_EULA"
+        },
+        {
+          "label": "SA password",
+          "name": "sa_password"
+        }
+      ],
+      "image": "microsoft/mssql-server-windows-express:latest",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/microsoft.png",
+      "note": "Password needs to include at least 8 characters including uppercase, lowercase letters, base-10 digits and/or non-alphanumeric symbols.",
+      "platform": "windows",
+      "ports": [
+        "1433/tcp"
+      ],
+      "repository": {
+        "stackfile": "",
+        "url": ""
+      },
+      "stackFile": "",
+      "title": "SQL Server Express",
+      "type": 1,
+      "volumes": [
+        {
+          "container": "C:/temp/"
+        }
+      ]
+    },
+    {
+      "Id": 18,
+      "administrator_only": false,
+      "categories": [
+        "serverless"
+      ],
+      "description": "Open-source serverless computing platform",
+      "image": "iron/functions:latest",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/ironfunctions.png",
+      "platform": "linux",
+      "ports": [
+        "8080/tcp"
+      ],
+      "privileged": true,
+      "repository": {
+        "stackfile": "",
+        "url": ""
+      },
+      "stackFile": "",
+      "title": "IronFunctions API",
+      "type": 1,
+      "volumes": [
+        {
+          "container": "/app/data"
+        }
+      ]
+    },
+    {
+      "Id": 19,
+      "administrator_only": false,
+      "categories": [
+        "serverless"
+      ],
+      "description": "Open-source user interface for IronFunctions",
+      "env": [
+        {
+          "label": "API URL",
+          "name": "API_URL"
+        }
+      ],
+      "image": "iron/functions-ui:latest",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/ironfunctions.png",
+      "platform": "linux",
+      "ports": [
+        "4000/tcp"
+      ],
+      "privileged": true,
+      "repository": {
+        "stackfile": "",
+        "url": ""
+      },
+      "stackFile": "",
+      "title": "IronFunctions UI",
+      "type": 1,
+      "volumes": [
+        {
+          "container": "/app/data"
+        }
+      ]
+    },
+    {
+      "Id": 20,
+      "administrator_only": false,
+      "categories": [
+        "search-engine"
+      ],
+      "description": "Open-source enterprise search platform",
+      "image": "solr:latest",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/solr.png",
+      "platform": "linux",
+      "ports": [
+        "8983/tcp"
+      ],
+      "repository": {
+        "stackfile": "",
+        "url": ""
+      },
+      "stackFile": "",
+      "title": "Solr",
+      "type": 1,
+      "volumes": [
+        {
+          "container": "/opt/solr/mydata"
+        }
+      ]
+    },
+    {
+      "Id": 21,
+      "administrator_only": false,
+      "categories": [
+        "database"
+      ],
+      "description": "Open-source in-memory data structure store",
+      "image": "redis:latest",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/redis.png",
+      "platform": "linux",
+      "ports": [
+        "6379/tcp"
+      ],
+      "repository": {
+        "stackfile": "",
+        "url": ""
+      },
+      "stackFile": "",
+      "title": "Redis",
+      "type": 1,
+      "volumes": [
+        {
+          "container": "/data"
+        }
+      ]
+    },
+    {
+      "Id": 22,
+      "administrator_only": false,
+      "categories": [
+        "messaging"
+      ],
+      "description": "Highly reliable enterprise messaging system",
+      "image": "rabbitmq:latest",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/rabbitmq.png",
+      "platform": "linux",
+      "ports": [
+        "5671/tcp",
+        "5672/tcp"
+      ],
+      "repository": {
+        "stackfile": "",
+        "url": ""
+      },
+      "stackFile": "",
+      "title": "RabbitMQ",
+      "type": 1,
+      "volumes": [
+        {
+          "container": "/var/lib/rabbitmq"
+        }
+      ]
+    },
+    {
+      "Id": 23,
+      "administrator_only": false,
+      "categories": [
+        "blog"
+      ],
+      "description": "Free and open-source blogging platform",
+      "image": "ghost:latest",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/ghost.png",
+      "note": "Access the blog management interface under \u003ccode\u003e/ghost/\u003c/code\u003e.",
+      "platform": "linux",
+      "ports": [
+        "2368/tcp"
+      ],
+      "repository": {
+        "stackfile": "",
+        "url": ""
+      },
+      "stackFile": "",
+      "title": "Ghost",
+      "type": 1,
+      "volumes": [
+        {
+          "container": "/var/lib/ghost/content"
+        }
+      ]
+    },
+    {
+      "Id": 24,
+      "administrator_only": false,
+      "categories": [
+        "CMS"
+      ],
+      "description": "WebOps platform and hosting control panel",
+      "image": "plesk/plesk:preview",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/plesk.png",
+      "note": "Default credentials: admin / changeme",
+      "platform": "linux",
+      "ports": [
+        "21/tcp",
+        "80/tcp",
+        "443/tcp",
+        "8880/tcp",
+        "8443/tcp",
+        "8447/tcp"
+      ],
+      "repository": {
+        "stackfile": "",
+        "url": ""
+      },
+      "stackFile": "",
+      "title": "Plesk",
+      "type": 1
+    },
+    {
+      "Id": 25,
+      "administrator_only": false,
+      "categories": [
+        "CMS"
+      ],
+      "description": "Another free and open-source CMS",
+      "env": [
+        {
+          "label": "MySQL database host",
+          "name": "JOOMLA_DB_HOST"
+        },
+        {
+          "label": "Database password",
+          "name": "JOOMLA_DB_PASSWORD"
+        }
+      ],
+      "image": "joomla:latest",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/joomla.png",
+      "platform": "linux",
+      "ports": [
+        "80/tcp"
+      ],
+      "repository": {
+        "stackfile": "",
+        "url": ""
+      },
+      "stackFile": "",
+      "title": "Joomla",
+      "type": 1,
+      "volumes": [
+        {
+          "container": "/var/www/html"
+        }
+      ]
+    },
+    {
+      "Id": 26,
+      "administrator_only": false,
+      "categories": [
+        "CMS"
+      ],
+      "description": "Open-source content management framework",
+      "image": "drupal:latest",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/drupal.png",
+      "platform": "linux",
+      "ports": [
+        "80/tcp"
+      ],
+      "repository": {
+        "stackfile": "",
+        "url": ""
+      },
+      "stackFile": "",
+      "title": "Drupal",
+      "type": 1,
+      "volumes": [
+        {
+          "container": "/var/www/html"
+        }
+      ]
+    },
+    {
+      "Id": 27,
+      "administrator_only": false,
+      "categories": [
+        "CMS"
+      ],
+      "description": "A free and open-source CMS built on top of Zope",
+      "image": "plone:latest",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/plone.png",
+      "platform": "linux",
+      "ports": [
+        "8080/tcp"
+      ],
+      "repository": {
+        "stackfile": "",
+        "url": ""
+      },
+      "stackFile": "",
+      "title": "Plone",
+      "type": 1,
+      "volumes": [
+        {
+          "container": "/data"
+        }
+      ]
+    },
+    {
+      "Id": 28,
+      "administrator_only": false,
+      "categories": [
+        "CMS"
+      ],
+      "description": "Open-source e-commerce platform",
+      "image": "alankent/gsd:latest",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/magento.png",
+      "platform": "linux",
+      "ports": [
+        "80/tcp",
+        "3000/tcp",
+        "3001/tcp"
+      ],
+      "repository": {
+        "stackfile": "",
+        "url": ""
+      },
+      "stackFile": "",
+      "title": "Magento 2",
+      "type": 1,
+      "volumes": [
+        {
+          "container": "/var/www/html/"
+        }
+      ]
+    },
+    {
+      "Id": 29,
+      "administrator_only": false,
+      "categories": [
+        "Log Management",
+        "Monitoring"
+      ],
+      "description": "Collect logs, metrics and docker events",
+      "env": [
+        {
+          "label": "Logs token",
+          "name": "LOGSENE_TOKEN"
+        },
+        {
+          "label": "SPM monitoring token",
+          "name": "SPM_TOKEN"
+        }
+      ],
+      "image": "sematext/sematext-agent-docker:latest",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/sematext_agent.png",
+      "name": "sematext-agent",
+      "platform": "linux",
+      "privileged": true,
+      "repository": {
+        "stackfile": "",
+        "url": ""
+      },
+      "stackFile": "",
+      "title": "Sematext Docker Agent",
+      "type": 1,
+      "volumes": [
+        {
+          "bind": "/var/run/docker.sock",
+          "container": "/var/run/docker.sock"
+        }
+      ]
+    },
+    {
+      "Id": 30,
+      "administrator_only": false,
+      "categories": [
+        "Monitoring"
+      ],
+      "description": "Collect events and metrics",
+      "env": [
+        {
+          "label": "Datadog API key",
+          "name": "DD_API_KEY"
+        }
+      ],
+      "image": "datadog/agent:latest",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/datadog_agent.png",
+      "platform": "linux",
+      "repository": {
+        "stackfile": "",
+        "url": ""
+      },
+      "stackFile": "",
+      "title": "Datadog agent",
+      "type": 1,
+      "volumes": [
+        {
+          "bind": "/var/run/docker.sock",
+          "container": "/var/run/docker.sock",
+          "readonly": true
+        },
+        {
+          "bind": "/sys/fs/cgroup",
+          "container": "/host/sys/fs/cgroup",
+          "readonly": true
+        },
+        {
+          "bind": "/proc",
+          "container": "/host/proc",
+          "readonly": true
+        }
+      ]
+    },
+    {
+      "Id": 31,
+      "administrator_only": false,
+      "categories": [
+        "marketing"
+      ],
+      "description": "Open-source marketing automation platform",
+      "env": [
+        {
+          "label": "MySQL database host",
+          "name": "MAUTIC_DB_HOST"
+        },
+        {
+          "label": "Database password",
+          "name": "MAUTIC_DB_PASSWORD"
+        }
+      ],
+      "image": "mautic/mautic:latest",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/mautic.png",
+      "platform": "linux",
+      "ports": [
+        "80/tcp"
+      ],
+      "repository": {
+        "stackfile": "",
+        "url": ""
+      },
+      "stackFile": "",
+      "title": "Mautic",
+      "type": 1,
+      "volumes": [
+        {
+          "container": "/var/www/html"
+        }
+      ]
+    },
+    {
+      "Id": 32,
+      "administrator_only": false,
+      "categories": [
+        "streaming"
+      ],
+      "description": "Streaming media server",
+      "env": [
+        {
+          "label": "Agree to Wowza EULA",
+          "name": "WOWZA_ACCEPT_LICENSE"
+        },
+        {
+          "label": "License key",
+          "name": "WOWZA_KEY"
+        }
+      ],
+      "image": "sameersbn/wowza:4.1.2-8",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/wowza.png",
+      "platform": "linux",
+      "ports": [
+        "1935/tcp",
+        "8086/tcp",
+        "8087/tcp",
+        "8088/tcp"
+      ],
+      "repository": {
+        "stackfile": "",
+        "url": ""
+      },
+      "stackFile": "",
+      "title": "Wowza",
+      "type": 1,
+      "volumes": [
+        {
+          "container": "/var/lib/wowza"
+        }
+      ]
+    },
+    {
+      "Id": 33,
+      "administrator_only": false,
+      "categories": [
+        "continuous-integration"
+      ],
+      "description": "Open-source continuous integration tool",
+      "env": [
+        {
+          "label": "Jenkins options",
+          "name": "JENKINS_OPTS"
+        }
+      ],
+      "image": "jenkins/jenkins:lts",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/jenkins.png",
+      "platform": "linux",
+      "ports": [
+        "8080/tcp",
+        "50000/tcp"
+      ],
+      "repository": {
+        "stackfile": "",
+        "url": ""
+      },
+      "stackFile": "",
+      "title": "Jenkins",
+      "type": 1,
+      "volumes": [
+        {
+          "container": "/var/jenkins_home"
+        }
+      ]
+    },
+    {
+      "Id": 34,
+      "administrator_only": false,
+      "categories": [
+        "project-management"
+      ],
+      "description": "Open-source project management tool",
+      "image": "redmine:latest",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/redmine.png",
+      "platform": "linux",
+      "ports": [
+        "3000/tcp"
+      ],
+      "repository": {
+        "stackfile": "",
+        "url": ""
+      },
+      "stackFile": "",
+      "title": "Redmine",
+      "type": 1,
+      "volumes": [
+        {
+          "container": "/usr/src/redmine/files"
+        }
+      ]
+    },
+    {
+      "Id": 35,
+      "administrator_only": false,
+      "categories": [
+        "project-management"
+      ],
+      "description": "Open-source business apps",
+      "env": [
+        {
+          "label": "PostgreSQL database host",
+          "name": "HOST"
+        },
+        {
+          "label": "Database user",
+          "name": "USER"
+        },
+        {
+          "label": "Database password",
+          "name": "PASSWORD"
+        }
+      ],
+      "image": "odoo:latest",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/odoo.png",
+      "platform": "linux",
+      "ports": [
+        "8069/tcp"
+      ],
+      "repository": {
+        "stackfile": "",
+        "url": ""
+      },
+      "stackFile": "",
+      "title": "Odoo",
+      "type": 1,
+      "volumes": [
+        {
+          "container": "/var/lib/odoo"
+        },
+        {
+          "container": "/mnt/extra-addons"
+        }
+      ]
+    },
+    {
+      "Id": 36,
+      "administrator_only": false,
+      "categories": [
+        "backup"
+      ],
+      "description": "Open-source network backup",
+      "image": "cfstras/urbackup",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/urbackup.png",
+      "note": "This application web interface is exposed on the port 55414 inside the container.",
+      "platform": "linux",
+      "ports": [
+        "55413/tcp",
+        "55414/tcp",
+        "55415/tcp",
+        "35622/tcp"
+      ],
+      "repository": {
+        "stackfile": "",
+        "url": ""
+      },
+      "stackFile": "",
+      "title": "Urbackup",
+      "type": 1,
+      "volumes": [
+        {
+          "container": "/var/urbackup"
+        }
+      ]
+    },
+    {
+      "Id": 37,
+      "administrator_only": false,
+      "categories": [
+        "filesystem",
+        "storage"
+      ],
+      "command": "--port 80 --database /data/database.db --scope /srv",
+      "description": "A web file manager",
+      "image": "filebrowser/filebrowser:latest",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/filebrowser.png",
+      "note": "Default credentials: admin/admin",
+      "platform": "linux",
+      "ports": [
+        "80/tcp"
+      ],
+      "repository": {
+        "stackfile": "",
+        "url": ""
+      },
+      "stackFile": "",
+      "title": "File browser",
+      "type": 1,
+      "volumes": [
+        {
+          "container": "/data"
+        },
+        {
+          "container": "/srv"
+        }
+      ]
+    },
+    {
+      "Id": 38,
+      "administrator_only": false,
+      "categories": [
+        "development"
+      ],
+      "description": "ColdFusion (CFML) CLI",
+      "env": [
+        {
+          "name": "CFENGINE"
+        }
+      ],
+      "image": "ortussolutions/commandbox:latest",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/ortussolutions-commandbox.png",
+      "platform": "linux",
+      "ports": [
+        "8080/tcp",
+        "8443/tcp"
+      ],
+      "repository": {
+        "stackfile": "",
+        "url": ""
+      },
+      "stackFile": "",
+      "title": "CommandBox",
+      "type": 1
+    },
+    {
+      "Id": 39,
+      "administrator_only": false,
+      "categories": [
+        "CMS"
+      ],
+      "description": "Open-source modular CMS",
+      "env": [
+        {
+          "name": "express"
+        },
+        {
+          "name": "install"
+        },
+        {
+          "name": "CFENGINE"
+        }
+      ],
+      "image": "ortussolutions/contentbox:latest",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/ortussolutions-contentbox.png",
+      "platform": "linux",
+      "ports": [
+        "8080/tcp",
+        "8443/tcp"
+      ],
+      "repository": {
+        "stackfile": "",
+        "url": ""
+      },
+      "stackFile": "",
+      "title": "ContentBox",
+      "type": 1,
+      "volumes": [
+        {
+          "container": "/data/contentbox/db"
+        },
+        {
+          "container": "/app/includes/shared/media"
+        }
+      ]
+    },
+    {
+      "Id": 40,
+      "administrator_only": false,
+      "categories": [
+        "portainer"
+      ],
+      "description": "Manage all the resources in your Swarm cluster",
+      "image": "",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/portainer.png",
+      "note": "The agent will be deployed globally inside your cluster and available on port 9001.",
+      "platform": "linux",
+      "repository": {
+        "stackfile": "stacks/portainer-agent/docker-stack.yml",
+        "url": "https://github.com/portainer/templates"
+      },
+      "stackFile": "",
+      "title": "Portainer Agent",
+      "type": 2
+    },
+    {
+      "Id": 41,
+      "administrator_only": false,
+      "categories": [
+        "serverless"
+      ],
+      "description": "Serverless functions made simple",
+      "image": "",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/openfaas.png",
+      "name": "func",
+      "note": "Deploys the API gateway and sample functions. You can access the UI on port 8080. \u003cb\u003eWarning\u003c/b\u003e: the name of the stack must be 'func'.",
+      "platform": "linux",
+      "repository": {
+        "stackfile": "docker-compose.yml",
+        "url": "https://github.com/openfaas/faas"
+      },
+      "stackFile": "",
+      "title": "OpenFaaS",
+      "type": 2
+    },
+    {
+      "Id": 42,
+      "administrator_only": false,
+      "categories": [
+        "serverless"
+      ],
+      "description": "Open-source serverless computing platform",
+      "image": "",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/ironfunctions.png",
+      "note": "Deploys the IronFunctions API and UI.",
+      "platform": "linux",
+      "repository": {
+        "stackfile": "stacks/ironfunctions/docker-stack.yml",
+        "url": "https://github.com/portainer/templates"
+      },
+      "stackFile": "",
+      "title": "IronFunctions",
+      "type": 2
+    },
+    {
+      "Id": 43,
+      "administrator_only": false,
+      "categories": [
+        "database"
+      ],
+      "description": "CockroachDB cluster",
+      "image": "",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/cockroachdb.png",
+      "note": "Deploys an insecure CockroachDB cluster, please refer to \u003ca href=\"https://www.cockroachlabs.com/docs/stable/orchestrate-cockroachdb-with-docker-swarm.html\" target=\"_blank\"\u003eCockroachDB documentation\u003c/a\u003e for production deployments.",
+      "platform": "linux",
+      "repository": {
+        "stackfile": "stacks/cockroachdb/docker-stack.yml",
+        "url": "https://github.com/portainer/templates"
+      },
+      "stackFile": "",
+      "title": "CockroachDB",
+      "type": 2
+    },
+    {
+      "Id": 44,
+      "administrator_only": false,
+      "categories": [
+        "CMS"
+      ],
+      "description": "Wordpress setup with a MySQL database",
+      "env": [
+        {
+          "description": "Password used by the MySQL root user.",
+          "label": "Database root password",
+          "name": "MYSQL_DATABASE_PASSWORD"
+        }
+      ],
+      "image": "",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/wordpress.png",
+      "note": "Deploys a Wordpress instance connected to a MySQL database.",
+      "platform": "linux",
+      "repository": {
+        "stackfile": "stacks/wordpress/docker-stack.yml",
+        "url": "https://github.com/portainer/templates"
+      },
+      "stackFile": "",
+      "title": "Wordpress",
+      "type": 2
+    },
+    {
+      "Id": 45,
+      "administrator_only": false,
+      "categories": [
+        "CMS"
+      ],
+      "description": "Wordpress setup with a MySQL database",
+      "env": [
+        {
+          "description": "Password used by the MySQL root user.",
+          "label": "Database root password",
+          "name": "MYSQL_DATABASE_PASSWORD"
+        }
+      ],
+      "image": "",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/wordpress.png",
+      "note": "Deploys a Wordpress instance connected to a MySQL database.",
+      "platform": "linux",
+      "repository": {
+        "stackfile": "stacks/wordpress/docker-compose.yml",
+        "url": "https://github.com/portainer/templates"
+      },
+      "stackFile": "",
+      "title": "Wordpress",
+      "type": 3
+    },
+    {
+      "Id": 46,
+      "administrator_only": false,
+      "categories": [
+        "OPS"
+      ],
+      "description": "Microsoft Operations Management Suite Linux agent.",
+      "env": [
+        {
+          "description": "Azure Workspace ID",
+          "label": "Workspace ID",
+          "name": "AZURE_WORKSPACE_ID"
+        },
+        {
+          "description": "Azure primary key",
+          "label": "Primary key",
+          "name": "AZURE_PRIMARY_KEY"
+        }
+      ],
+      "image": "",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/microsoft.png",
+      "platform": "linux",
+      "repository": {
+        "stackfile": "stacks/microsoft-oms/docker-stack.yml",
+        "url": "https://github.com/portainer/templates"
+      },
+      "stackFile": "",
+      "title": "Microsoft OMS Agent",
+      "type": 2
+    },
+    {
+      "Id": 47,
+      "administrator_only": false,
+      "categories": [
+        "Log Management",
+        "Monitoring"
+      ],
+      "description": "Collect logs, metrics and docker events",
+      "env": [
+        {
+          "label": "Logs token",
+          "name": "LOGSENE_TOKEN"
+        },
+        {
+          "label": "SPM monitoring token",
+          "name": "SPM_TOKEN"
+        }
+      ],
+      "image": "",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/sematext_agent.png",
+      "platform": "linux",
+      "repository": {
+        "stackfile": "stacks/sematext-agent-docker/docker-stack.yml",
+        "url": "https://github.com/portainer/templates"
+      },
+      "stackFile": "",
+      "title": "Sematext Docker Agent",
+      "type": 2
+    },
+    {
+      "Id": 48,
+      "administrator_only": false,
+      "categories": [
+        "Monitoring"
+      ],
+      "description": "Collect events and metrics",
+      "env": [
+        {
+          "label": "Datadog API key",
+          "name": "API_KEY"
+        }
+      ],
+      "image": "",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/datadog_agent.png",
+      "platform": "linux",
+      "repository": {
+        "stackfile": "stacks/datadog-agent/docker-stack.yml",
+        "url": "https://github.com/portainer/templates"
+      },
+      "stackFile": "",
+      "title": "Datadog agent",
+      "type": 2
+    },
+    {
+      "Id": 49,
+      "administrator_only": false,
+      "categories": [
+        "docker"
+      ],
+      "description": "Sonatype Nexus3 registry manager",
+      "image": "sonatype/nexus3:latest",
+      "logo": "https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/sonatype.png",
+      "platform": "linux",
+      "ports": [
+        "8081/tcp"
+      ],
+      "repository": {
+        "stackfile": "",
+        "url": ""
+      },
+      "stackFile": "",
+      "title": "Sonatype Nexus3",
+      "type": 1,
+      "volumes": [
+        {
+          "container": "/nexus-data"
+        }
+      ]
+    }
+  ],
+  "tunnel_server": {
+    "PrivateKeySeed": "IvX6ZPRuWtLS5zyg"
+  },
+  "users": [
+    {
+      "EndpointAuthorizations": null,
+      "Id": 1,
+      "Password": "$2a$10$siRDprr/5uUFAU8iom3Sr./WXQkN2dhSNjAC471pkJaALkghS762a",
+      "PortainerAuthorizations": {
+        "PortainerDockerHubInspect": true,
+        "PortainerEndpointExtensionAdd": true,
+        "PortainerEndpointExtensionRemove": true,
+        "PortainerEndpointGroupList": true,
+        "PortainerEndpointInspect": true,
+        "PortainerEndpointList": true,
+        "PortainerExtensionList": true,
+        "PortainerMOTD": true,
+        "PortainerRegistryInspect": true,
+        "PortainerRegistryList": true,
+        "PortainerTeamList": true,
+        "PortainerTemplateInspect": true,
+        "PortainerTemplateList": true,
+        "PortainerUserInspect": true,
+        "PortainerUserList": true,
+        "PortainerUserMemberships": true
+      },
+      "Role": 1,
+      "Username": "admin"
+    },
+    {
+      "EndpointAuthorizations": null,
+      "Id": 2,
+      "Password": "$2a$10$WpCAW8mSt6FRRp1GkynbFOGSZnHR6E5j9cETZ8HiMlw06hVlDW/Li",
+      "PortainerAuthorizations": {
+        "PortainerDockerHubInspect": true,
+        "PortainerEndpointExtensionAdd": true,
+        "PortainerEndpointExtensionRemove": true,
+        "PortainerEndpointGroupList": true,
+        "PortainerEndpointInspect": true,
+        "PortainerEndpointList": true,
+        "PortainerExtensionList": true,
+        "PortainerMOTD": true,
+        "PortainerRegistryInspect": true,
+        "PortainerRegistryList": true,
+        "PortainerTeamList": true,
+        "PortainerTemplateInspect": true,
+        "PortainerTemplateList": true,
+        "PortainerUserInspect": true,
+        "PortainerUserList": true,
+        "PortainerUserMemberships": true
+      },
+      "Role": 1,
+      "Username": "prabhat"
+    }
+  ],
+  "version": {
+    "DB_VERSION": 24
+  }
+}
\ No newline at end of file
diff --git a/api/datastore/test_data/output_24_to_latest.json b/api/datastore/test_data/output_24_to_latest.json
new file mode 100644
index 0000000..16d6c3c
--- /dev/null
+++ b/api/datastore/test_data/output_24_to_latest.json
@@ -0,0 +1,928 @@
+{
+  "allowlist": null,
+  "api_key": null,
+  "customtemplates": null,
+  "dockerhub": [
+    {
+      "Authentication": false,
+      "Username": ""
+    }
+  ],
+  "edge_stack": null,
+  "edge_stack_status": null,
+  "edgegroups": null,
+  "edgejobs": null,
+  "endpoint_groups": [
+    {
+      "AuthorizedTeams": null,
+      "AuthorizedUsers": null,
+      "Description": "Unassigned endpoints",
+      "Id": 1,
+      "Labels": [],
+      "Name": "Unassigned",
+      "TagIds": [],
+      "Tags": null,
+      "TeamAccessPolicies": {},
+      "UserAccessPolicies": {}
+    }
+  ],
+  "endpoint_relations": [
+    {
+      "EdgeStacks": {},
+      "EndpointID": 1
+    }
+  ],
+  "endpoints": [
+    {
+      "Agent": {},
+      "AzureCredentials": {
+        "ApplicationID": "",
+        "AuthenticationKey": "",
+        "TenantID": ""
+      },
+      "ComposeSyntaxMaxVersion": "",
+      "ContainerEngine": "",
+      "Edge": {
+        "AsyncMode": false,
+        "CommandInterval": 0,
+        "PingInterval": 0,
+        "SnapshotInterval": 0
+      },
+      "EdgeCheckinInterval": 0,
+      "EdgeKey": "",
+      "GroupId": 1,
+      "Heartbeat": false,
+      "Id": 1,
+      "Kubernetes": {
+        "Configuration": {
+          "AllowNoneIngressClass": false,
+          "EnableResourceOverCommit": false,
+          "IngressAvailabilityPerNamespace": true,
+          "ResourceOverCommitPercentage": 0,
+          "RestrictDefaultNamespace": false,
+          "UseLoadBalancer": false,
+          "UseServerMetrics": false
+        },
+        "Flags": {
+          "IsServerIngressClassDetected": false,
+          "IsServerMetricsDetected": false,
+          "IsServerStorageDetected": false
+        }
+      },
+      "LastCheckInDate": 0,
+      "Name": "local",
+      "PostInitMigrations": {
+        "MigrateGPUs": true,
+        "MigrateIngresses": true,
+        "MigrateRegistrySASecrets": false
+      },
+      "PublicURL": "",
+      "SecuritySettings": {
+        "allowBindMountsForRegularUsers": true,
+        "allowContainerCapabilitiesForRegularUsers": true,
+        "allowDeviceMappingForRegularUsers": true,
+        "allowHostNamespaceForRegularUsers": true,
+        "allowPrivilegedModeForRegularUsers": true,
+        "allowSecurityOptForRegularUsers": false,
+        "allowStackManagementForRegularUsers": true,
+        "allowSysctlSettingForRegularUsers": false,
+        "allowVolumeBrowserForRegularUsers": false,
+        "enableHostManagementFeatures": false
+      },
+      "Status": 1,
+      "TLSConfig": {
+        "TLS": false,
+        "TLSSkipVerify": false
+      },
+      "Type": 1,
+      "URL": "unix:///var/run/docker.sock"
+    }
+  ],
+  "extension": null,
+  "helm_user_repository": null,
+  "pending_actions": null,
+  "registries": [
+    {
+      "Authentication": true,
+      "AuthorizedTeams": null,
+      "AuthorizedUsers": null,
+      "BaseURL": "",
+      "Ecr": {
+        "Region": ""
+      },
+      "Github": {
+        "OrganisationName": "",
+        "UseOrganisation": false
+      },
+      "Gitlab": {
+        "InstanceURL": "",
+        "ProjectId": 0,
+        "ProjectPath": ""
+      },
+      "Id": 1,
+      "ManagementConfiguration": null,
+      "Name": "canister.io",
+      "Password": "MjWbx8A6YK7cw7",
+      "Quay": {
+        "OrganisationName": ""
+      },
+      "RegistryAccesses": {
+        "1": {
+          "Namespaces": [],
+          "TeamAccessPolicies": {},
+          "UserAccessPolicies": {}
+        }
+      },
+      "TeamAccessPolicies": {},
+      "Type": 3,
+      "URL": "cloud.canister.io:5000",
+      "UserAccessPolicies": {},
+      "Username": "prabhatkhera"
+    }
+  ],
+  "resource_control": [
+    {
+      "AdministratorsOnly": false,
+      "Id": 2,
+      "Public": true,
+      "ResourceId": "762gbwaj8r4gcsdy8ld1u4why",
+      "SubResourceIds": [],
+      "System": false,
+      "TeamAccesses": [],
+      "Type": 5,
+      "UserAccesses": []
+    },
+    {
+      "AdministratorsOnly": false,
+      "Id": 3,
+      "Public": true,
+      "ResourceId": "1_alpine",
+      "SubResourceIds": [],
+      "System": false,
+      "TeamAccesses": [],
+      "Type": 6,
+      "UserAccesses": []
+    },
+    {
+      "AdministratorsOnly": false,
+      "Id": 4,
+      "Public": true,
+      "ResourceId": "1_redis",
+      "SubResourceIds": [],
+      "System": false,
+      "TeamAccesses": [],
+      "Type": 6,
+      "UserAccesses": []
+    },
+    {
+      "AdministratorsOnly": false,
+      "Id": 5,
+      "Public": false,
+      "ResourceId": "1_nginx",
+      "SubResourceIds": [],
+      "System": false,
+      "TeamAccesses": [
+        {
+          "AccessLevel": 1,
+          "TeamId": 1
+        }
+      ],
+      "Type": 6,
+      "UserAccesses": []
+    }
+  ],
+  "roles": [
+    {
+      "Authorizations": {
+        "DockerAgentBrowseDelete": true,
+        "DockerAgentBrowseGet": true,
+        "DockerAgentBrowseList": true,
+        "DockerAgentBrowsePut": true,
+        "DockerAgentBrowseRename": true,
+        "DockerAgentHostInfo": true,
+        "DockerAgentList": true,
+        "DockerAgentPing": true,
+        "DockerAgentUndefined": true,
+        "DockerBuildCancel": true,
+        "DockerBuildPrune": true,
+        "DockerConfigCreate": true,
+        "DockerConfigDelete": true,
+        "DockerConfigInspect": true,
+        "DockerConfigList": true,
+        "DockerConfigUpdate": true,
+        "DockerContainerArchive": true,
+        "DockerContainerArchiveInfo": true,
+        "DockerContainerAttach": true,
+        "DockerContainerAttachWebsocket": true,
+        "DockerContainerChanges": true,
+        "DockerContainerCreate": true,
+        "DockerContainerDelete": true,
+        "DockerContainerExec": true,
+        "DockerContainerExport": true,
+        "DockerContainerInspect": true,
+        "DockerContainerKill": true,
+        "DockerContainerList": true,
+        "DockerContainerLogs": true,
+        "DockerContainerPause": true,
+        "DockerContainerPrune": true,
+        "DockerContainerPutContainerArchive": true,
+        "DockerContainerRename": true,
+        "DockerContainerResize": true,
+        "DockerContainerRestart": true,
+        "DockerContainerStart": true,
+        "DockerContainerStats": true,
+        "DockerContainerStop": true,
+        "DockerContainerTop": true,
+        "DockerContainerUnpause": true,
+        "DockerContainerUpdate": true,
+        "DockerContainerWait": true,
+        "DockerDistributionInspect": true,
+        "DockerEvents": true,
+        "DockerExecInspect": true,
+        "DockerExecResize": true,
+        "DockerExecStart": true,
+        "DockerImageBuild": true,
+        "DockerImageCommit": true,
+        "DockerImageCreate": true,
+        "DockerImageDelete": true,
+        "DockerImageGet": true,
+        "DockerImageGetAll": true,
+        "DockerImageHistory": true,
+        "DockerImageInspect": true,
+        "DockerImageList": true,
+        "DockerImageLoad": true,
+        "DockerImagePrune": true,
+        "DockerImagePush": true,
+        "DockerImageSearch": true,
+        "DockerImageTag": true,
+        "DockerInfo": true,
+        "DockerNetworkConnect": true,
+        "DockerNetworkCreate": true,
+        "DockerNetworkDelete": true,
+        "DockerNetworkDisconnect": true,
+        "DockerNetworkInspect": true,
+        "DockerNetworkList": true,
+        "DockerNetworkPrune": true,
+        "DockerNodeDelete": true,
+        "DockerNodeInspect": true,
+        "DockerNodeList": true,
+        "DockerNodeUpdate": true,
+        "DockerPing": true,
+        "DockerPluginCreate": true,
+        "DockerPluginDelete": true,
+        "DockerPluginDisable": true,
+        "DockerPluginEnable": true,
+        "DockerPluginInspect": true,
+        "DockerPluginList": true,
+        "DockerPluginPrivileges": true,
+        "DockerPluginPull": true,
+        "DockerPluginPush": true,
+        "DockerPluginSet": true,
+        "DockerPluginUpgrade": true,
+        "DockerSecretCreate": true,
+        "DockerSecretDelete": true,
+        "DockerSecretInspect": true,
+        "DockerSecretList": true,
+        "DockerSecretUpdate": true,
+        "DockerServiceCreate": true,
+        "DockerServiceDelete": true,
+        "DockerServiceInspect": true,
+        "DockerServiceList": true,
+        "DockerServiceLogs": true,
+        "DockerServiceUpdate": true,
+        "DockerSessionStart": true,
+        "DockerSwarmInit": true,
+        "DockerSwarmInspect": true,
+        "DockerSwarmJoin": true,
+        "DockerSwarmLeave": true,
+        "DockerSwarmUnlock": true,
+        "DockerSwarmUnlockKey": true,
+        "DockerSwarmUpdate": true,
+        "DockerSystem": true,
+        "DockerTaskInspect": true,
+        "DockerTaskList": true,
+        "DockerTaskLogs": true,
+        "DockerUndefined": true,
+        "DockerVersion": true,
+        "DockerVolumeCreate": true,
+        "DockerVolumeDelete": true,
+        "DockerVolumeInspect": true,
+        "DockerVolumeList": true,
+        "DockerVolumePrune": true,
+        "EndpointResourcesAccess": true,
+        "IntegrationStoridgeAdmin": true,
+        "PortainerResourceControlCreate": true,
+        "PortainerResourceControlUpdate": true,
+        "PortainerStackCreate": true,
+        "PortainerStackDelete": true,
+        "PortainerStackFile": true,
+        "PortainerStackInspect": true,
+        "PortainerStackList": true,
+        "PortainerStackMigrate": true,
+        "PortainerStackUpdate": true,
+        "PortainerWebhookCreate": true,
+        "PortainerWebhookDelete": true,
+        "PortainerWebhookList": true,
+        "PortainerWebsocketExec": true
+      },
+      "Description": "Full control of all resources in an endpoint",
+      "Id": 1,
+      "Name": "Endpoint administrator",
+      "Priority": 1
+    },
+    {
+      "Authorizations": {
+        "DockerAgentHostInfo": true,
+        "DockerAgentList": true,
+        "DockerAgentPing": true,
+        "DockerConfigInspect": true,
+        "DockerConfigList": true,
+        "DockerContainerArchiveInfo": true,
+        "DockerContainerChanges": true,
+        "DockerContainerInspect": true,
+        "DockerContainerList": true,
+        "DockerContainerLogs": true,
+        "DockerContainerStats": true,
+        "DockerContainerTop": true,
+        "DockerDistributionInspect": true,
+        "DockerEvents": true,
+        "DockerImageGet": true,
+        "DockerImageGetAll": true,
+        "DockerImageHistory": true,
+        "DockerImageInspect": true,
+        "DockerImageList": true,
+        "DockerImageSearch": true,
+        "DockerInfo": true,
+        "DockerNetworkInspect": true,
+        "DockerNetworkList": true,
+        "DockerNodeInspect": true,
+        "DockerNodeList": true,
+        "DockerPing": true,
+        "DockerPluginList": true,
+        "DockerSecretInspect": true,
+        "DockerSecretList": true,
+        "DockerServiceInspect": true,
+        "DockerServiceList": true,
+        "DockerServiceLogs": true,
+        "DockerSwarmInspect": true,
+        "DockerSystem": true,
+        "DockerTaskInspect": true,
+        "DockerTaskList": true,
+        "DockerTaskLogs": true,
+        "DockerVersion": true,
+        "DockerVolumeInspect": true,
+        "DockerVolumeList": true,
+        "EndpointResourcesAccess": true,
+        "PortainerStackFile": true,
+        "PortainerStackInspect": true,
+        "PortainerStackList": true,
+        "PortainerWebhookList": true
+      },
+      "Description": "Read-only access of all resources in an endpoint",
+      "Id": 2,
+      "Name": "Helpdesk",
+      "Priority": 2
+    },
+    {
+      "Authorizations": {
+        "DockerAgentHostInfo": true,
+        "DockerAgentList": true,
+        "DockerAgentPing": true,
+        "DockerAgentUndefined": true,
+        "DockerBuildCancel": true,
+        "DockerBuildPrune": true,
+        "DockerConfigCreate": true,
+        "DockerConfigDelete": true,
+        "DockerConfigInspect": true,
+        "DockerConfigList": true,
+        "DockerConfigUpdate": true,
+        "DockerContainerArchive": true,
+        "DockerContainerArchiveInfo": true,
+        "DockerContainerAttach": true,
+        "DockerContainerAttachWebsocket": true,
+        "DockerContainerChanges": true,
+        "DockerContainerCreate": true,
+        "DockerContainerDelete": true,
+        "DockerContainerExec": true,
+        "DockerContainerExport": true,
+        "DockerContainerInspect": true,
+        "DockerContainerKill": true,
+        "DockerContainerList": true,
+        "DockerContainerLogs": true,
+        "DockerContainerPause": true,
+        "DockerContainerPutContainerArchive": true,
+        "DockerContainerRename": true,
+        "DockerContainerResize": true,
+        "DockerContainerRestart": true,
+        "DockerContainerStart": true,
+        "DockerContainerStats": true,
+        "DockerContainerStop": true,
+        "DockerContainerTop": true,
+        "DockerContainerUnpause": true,
+        "DockerContainerUpdate": true,
+        "DockerContainerWait": true,
+        "DockerDistributionInspect": true,
+        "DockerEvents": true,
+        "DockerExecInspect": true,
+        "DockerExecResize": true,
+        "DockerExecStart": true,
+        "DockerImageBuild": true,
+        "DockerImageCommit": true,
+        "DockerImageCreate": true,
+        "DockerImageDelete": true,
+        "DockerImageGet": true,
+        "DockerImageGetAll": true,
+        "DockerImageHistory": true,
+        "DockerImageInspect": true,
+        "DockerImageList": true,
+        "DockerImageLoad": true,
+        "DockerImagePush": true,
+        "DockerImageSearch": true,
+        "DockerImageTag": true,
+        "DockerInfo": true,
+        "DockerNetworkConnect": true,
+        "DockerNetworkCreate": true,
+        "DockerNetworkDelete": true,
+        "DockerNetworkDisconnect": true,
+        "DockerNetworkInspect": true,
+        "DockerNetworkList": true,
+        "DockerNodeDelete": true,
+        "DockerNodeInspect": true,
+        "DockerNodeList": true,
+        "DockerNodeUpdate": true,
+        "DockerPing": true,
+        "DockerPluginCreate": true,
+        "DockerPluginDelete": true,
+        "DockerPluginDisable": true,
+        "DockerPluginEnable": true,
+        "DockerPluginInspect": true,
+        "DockerPluginList": true,
+        "DockerPluginPrivileges": true,
+        "DockerPluginPull": true,
+        "DockerPluginPush": true,
+        "DockerPluginSet": true,
+        "DockerPluginUpgrade": true,
+        "DockerSecretCreate": true,
+        "DockerSecretDelete": true,
+        "DockerSecretInspect": true,
+        "DockerSecretList": true,
+        "DockerSecretUpdate": true,
+        "DockerServiceCreate": true,
+        "DockerServiceDelete": true,
+        "DockerServiceInspect": true,
+        "DockerServiceList": true,
+        "DockerServiceLogs": true,
+        "DockerServiceUpdate": true,
+        "DockerSessionStart": true,
+        "DockerSwarmInit": true,
+        "DockerSwarmInspect": true,
+        "DockerSwarmJoin": true,
+        "DockerSwarmLeave": true,
+        "DockerSwarmUnlock": true,
+        "DockerSwarmUnlockKey": true,
+        "DockerSwarmUpdate": true,
+        "DockerSystem": true,
+        "DockerTaskInspect": true,
+        "DockerTaskList": true,
+        "DockerTaskLogs": true,
+        "DockerUndefined": true,
+        "DockerVersion": true,
+        "DockerVolumeCreate": true,
+        "DockerVolumeDelete": true,
+        "DockerVolumeInspect": true,
+        "DockerVolumeList": true,
+        "PortainerResourceControlUpdate": true,
+        "PortainerStackCreate": true,
+        "PortainerStackDelete": true,
+        "PortainerStackFile": true,
+        "PortainerStackInspect": true,
+        "PortainerStackList": true,
+        "PortainerStackMigrate": true,
+        "PortainerStackUpdate": true,
+        "PortainerWebhookCreate": true,
+        "PortainerWebhookList": true,
+        "PortainerWebsocketExec": true
+      },
+      "Description": "Full control of assigned resources in an endpoint",
+      "Id": 3,
+      "Name": "Standard user",
+      "Priority": 3
+    },
+    {
+      "Authorizations": {
+        "DockerAgentHostInfo": true,
+        "DockerAgentList": true,
+        "DockerAgentPing": true,
+        "DockerConfigInspect": true,
+        "DockerConfigList": true,
+        "DockerContainerArchiveInfo": true,
+        "DockerContainerChanges": true,
+        "DockerContainerInspect": true,
+        "DockerContainerList": true,
+        "DockerContainerLogs": true,
+        "DockerContainerStats": true,
+        "DockerContainerTop": true,
+        "DockerDistributionInspect": true,
+        "DockerEvents": true,
+        "DockerImageGet": true,
+        "DockerImageGetAll": true,
+        "DockerImageHistory": true,
+        "DockerImageInspect": true,
+        "DockerImageList": true,
+        "DockerImageSearch": true,
+        "DockerInfo": true,
+        "DockerNetworkInspect": true,
+        "DockerNetworkList": true,
+        "DockerNodeInspect": true,
+        "DockerNodeList": true,
+        "DockerPing": true,
+        "DockerPluginList": true,
+        "DockerSecretInspect": true,
+        "DockerSecretList": true,
+        "DockerServiceInspect": true,
+        "DockerServiceList": true,
+        "DockerServiceLogs": true,
+        "DockerSwarmInspect": true,
+        "DockerSystem": true,
+        "DockerTaskInspect": true,
+        "DockerTaskList": true,
+        "DockerTaskLogs": true,
+        "DockerVersion": true,
+        "DockerVolumeInspect": true,
+        "DockerVolumeList": true,
+        "PortainerStackFile": true,
+        "PortainerStackInspect": true,
+        "PortainerStackList": true,
+        "PortainerWebhookList": true
+      },
+      "Description": "Read-only access of assigned resources in an endpoint",
+      "Id": 4,
+      "Name": "Read-only user",
+      "Priority": 4
+    }
+  ],
+  "schedules": [
+    {
+      "Created": 1648608136,
+      "CronExpression": "@every 5m",
+      "EdgeSchedule": null,
+      "EndpointSyncJob": null,
+      "Id": 1,
+      "JobType": 2,
+      "Name": "system_snapshot",
+      "Recurring": true,
+      "ScriptExecutionJob": null,
+      "SnapshotJob": {}
+    }
+  ],
+  "settings": {
+    "AgentSecret": "",
+    "AllowBindMountsForRegularUsers": true,
+    "AllowContainerCapabilitiesForRegularUsers": true,
+    "AllowDeviceMappingForRegularUsers": true,
+    "AllowHostNamespaceForRegularUsers": true,
+    "AllowPrivilegedModeForRegularUsers": true,
+    "AllowStackManagementForRegularUsers": true,
+    "AuthenticationMethod": 1,
+    "BlackListedLabels": [],
+    "Edge": {
+      "CommandInterval": 0,
+      "PingInterval": 0,
+      "SnapshotInterval": 0
+    },
+    "EdgeAgentCheckinInterval": 5,
+    "EdgePortainerUrl": "",
+    "EnableEdgeComputeFeatures": false,
+    "EnforceEdgeID": false,
+    "FeatureFlagSettings": null,
+    "ForceSecureCookies": false,
+    "GlobalDeploymentOptions": {
+      "hideStacksFunctionality": false
+    },
+    "HelmRepositoryURL": "https://charts.bitnami.com/bitnami",
+    "InternalAuthSettings": {
+      "RequiredPasswordLength": 12
+    },
+    "KubeconfigExpiry": "0",
+    "KubectlShellImage": "portainer/kubectl-shell:2.43.0",
+    "LDAPSettings": {
+      "AnonymousMode": true,
+      "AutoCreateUsers": true,
+      "GroupSearchSettings": [
+        {
+          "GroupAttribute": "",
+          "GroupBaseDN": "",
+          "GroupFilter": ""
+        }
+      ],
+      "ReaderDN": "",
+      "SearchSettings": [
+        {
+          "BaseDN": "",
+          "Filter": "",
+          "UserNameAttribute": ""
+        }
+      ],
+      "StartTLS": false,
+      "TLSConfig": {
+        "TLS": false,
+        "TLSSkipVerify": false
+      },
+      "URL": ""
+    },
+    "LogoURL": "",
+    "OAuthSettings": {
+      "AccessTokenURI": "",
+      "AuthStyle": 0,
+      "AuthorizationURI": "",
+      "ClientID": "",
+      "DefaultTeamID": 0,
+      "KubeSecretKey": null,
+      "LogoutURI": "",
+      "OAuthAutoCreateUsers": false,
+      "RedirectURI": "",
+      "ResourceURI": "",
+      "SSO": false,
+      "Scopes": "",
+      "UserIdentifier": ""
+    },
+    "SnapshotInterval": "5m",
+    "TemplatesURL": "",
+    "TrustOnFirstConnect": false,
+    "UserSessionTimeout": "8h"
+  },
+  "snapshots": [
+    {
+      "Docker": {
+        "ContainerCount": 0,
+        "DiagnosticsData": {},
+        "DockerSnapshotRaw": {
+          "Info": {
+            "Architecture": "",
+            "CDISpecDirs": null,
+            "CPUSet": false,
+            "CPUShares": false,
+            "CgroupDriver": "",
+            "ContainerdCommit": {
+              "ID": ""
+            },
+            "Containers": 0,
+            "ContainersPaused": 0,
+            "ContainersRunning": 0,
+            "ContainersStopped": 0,
+            "CpuCfsPeriod": false,
+            "CpuCfsQuota": false,
+            "Debug": false,
+            "DefaultRuntime": "",
+            "DockerRootDir": "",
+            "Driver": "",
+            "DriverStatus": null,
+            "ExperimentalBuild": false,
+            "GenericResources": null,
+            "HttpProxy": "",
+            "HttpsProxy": "",
+            "ID": "",
+            "IPv4Forwarding": false,
+            "Images": 0,
+            "IndexServerAddress": "",
+            "InitBinary": "",
+            "InitCommit": {
+              "ID": ""
+            },
+            "Isolation": "",
+            "KernelVersion": "",
+            "Labels": null,
+            "LiveRestoreEnabled": false,
+            "LoggingDriver": "",
+            "MemTotal": 0,
+            "MemoryLimit": false,
+            "NCPU": 0,
+            "NEventsListener": 0,
+            "NFd": 0,
+            "NGoroutines": 0,
+            "Name": "",
+            "NoProxy": "",
+            "OSType": "",
+            "OSVersion": "",
+            "OomKillDisable": false,
+            "OperatingSystem": "",
+            "PidsLimit": false,
+            "Plugins": {
+              "Authorization": null,
+              "Log": null,
+              "Network": null,
+              "Volume": null
+            },
+            "RegistryConfig": null,
+            "RuncCommit": {
+              "ID": ""
+            },
+            "Runtimes": null,
+            "SecurityOptions": null,
+            "ServerVersion": "",
+            "SwapLimit": false,
+            "Swarm": {
+              "ControlAvailable": false,
+              "Error": "",
+              "LocalNodeState": "",
+              "NodeAddr": "",
+              "NodeID": "",
+              "RemoteManagers": null
+            },
+            "SystemTime": "",
+            "Warnings": null
+          },
+          "Version": {
+            "ApiVersion": "",
+            "Arch": "",
+            "GitCommit": "",
+            "GoVersion": "",
+            "Os": "",
+            "Platform": {
+              "Name": ""
+            },
+            "Version": ""
+          },
+          "Volumes": {
+            "Volumes": null,
+            "Warnings": null
+          }
+        },
+        "DockerVersion": "20.10.13",
+        "GpuUseAll": false,
+        "HealthyContainerCount": 0,
+        "ImageCount": 9,
+        "IsPodman": false,
+        "NodeCount": 0,
+        "RunningContainerCount": 5,
+        "ServiceCount": 0,
+        "StackCount": 2,
+        "StoppedContainerCount": 0,
+        "Swarm": false,
+        "Time": 1648610112,
+        "TotalCPU": 8,
+        "TotalMemory": 25098706944,
+        "UnhealthyContainerCount": 0,
+        "VolumeCount": 10
+      },
+      "EndpointId": 1,
+      "Kubernetes": null
+    }
+  ],
+  "sources": null,
+  "ssl": {
+    "certPath": "",
+    "httpEnabled": true,
+    "keyPath": "",
+    "selfSigned": false
+  },
+  "stacks": [
+    {
+      "AdditionalFiles": null,
+      "AutoUpdate": null,
+      "CreatedBy": "",
+      "CreationDate": 0,
+      "DeploymentStartStatus": 0,
+      "EndpointId": 1,
+      "EntryPoint": "docker/alpine37-compose.yml",
+      "Env": [],
+      "FromAppTemplate": false,
+      "GitConfig": null,
+      "Id": 2,
+      "Name": "alpine",
+      "Namespace": "",
+      "Option": null,
+      "ProjectPath": "/home/prabhat/portainer/data/ce1.25/compose/2",
+      "ResourceControl": null,
+      "Status": 1,
+      "SwarmId": "s3fd604zdba7z13tbq2x6lyue",
+      "Type": 1,
+      "UpdateDate": 0,
+      "UpdatedBy": ""
+    },
+    {
+      "AdditionalFiles": null,
+      "AutoUpdate": null,
+      "CreatedBy": "",
+      "CreationDate": 0,
+      "DeploymentStartStatus": 0,
+      "EndpointId": 1,
+      "EntryPoint": "docker-compose.yml",
+      "Env": [],
+      "FromAppTemplate": false,
+      "GitConfig": null,
+      "Id": 5,
+      "Name": "redis",
+      "Namespace": "",
+      "Option": null,
+      "ProjectPath": "/home/prabhat/portainer/data/ce1.25/compose/5",
+      "ResourceControl": null,
+      "Status": 1,
+      "SwarmId": "",
+      "Type": 2,
+      "UpdateDate": 0,
+      "UpdatedBy": ""
+    },
+    {
+      "AdditionalFiles": null,
+      "AutoUpdate": null,
+      "CreatedBy": "",
+      "CreationDate": 0,
+      "DeploymentStartStatus": 0,
+      "EndpointId": 1,
+      "EntryPoint": "docker-compose.yml",
+      "Env": [],
+      "FromAppTemplate": false,
+      "GitConfig": null,
+      "Id": 6,
+      "Name": "nginx",
+      "Namespace": "",
+      "Option": null,
+      "ProjectPath": "/home/prabhat/portainer/data/ce1.25/compose/6",
+      "ResourceControl": null,
+      "Status": 1,
+      "SwarmId": "",
+      "Type": 2,
+      "UpdateDate": 0,
+      "UpdatedBy": ""
+    }
+  ],
+  "tags": null,
+  "team_membership": null,
+  "teams": [
+    {
+      "Id": 1,
+      "Name": "hello"
+    }
+  ],
+  "tunnel_server": {
+    "PrivateKeySeed": ""
+  },
+  "users": [
+    {
+      "EndpointAuthorizations": null,
+      "Id": 1,
+      "Password": "$2a$10$siRDprr/5uUFAU8iom3Sr./WXQkN2dhSNjAC471pkJaALkghS762a",
+      "PortainerAuthorizations": {
+        "PortainerDockerHubInspect": true,
+        "PortainerEndpointGroupList": true,
+        "PortainerEndpointInspect": true,
+        "PortainerEndpointList": true,
+        "PortainerMOTD": true,
+        "PortainerRegistryInspect": true,
+        "PortainerRegistryList": true,
+        "PortainerTeamList": true,
+        "PortainerTemplateInspect": true,
+        "PortainerTemplateList": true,
+        "PortainerUserCreateToken": true,
+        "PortainerUserInspect": true,
+        "PortainerUserList": true,
+        "PortainerUserListToken": true,
+        "PortainerUserMemberships": true,
+        "PortainerUserRevokeToken": true
+      },
+      "Role": 1,
+      "ThemeSettings": {
+        "color": ""
+      },
+      "TokenIssueAt": 0,
+      "UseCache": false,
+      "Username": "admin"
+    },
+    {
+      "EndpointAuthorizations": null,
+      "Id": 2,
+      "Password": "$2a$10$WpCAW8mSt6FRRp1GkynbFOGSZnHR6E5j9cETZ8HiMlw06hVlDW/Li",
+      "PortainerAuthorizations": {
+        "PortainerDockerHubInspect": true,
+        "PortainerEndpointGroupList": true,
+        "PortainerEndpointInspect": true,
+        "PortainerEndpointList": true,
+        "PortainerMOTD": true,
+        "PortainerRegistryInspect": true,
+        "PortainerRegistryList": true,
+        "PortainerTeamList": true,
+        "PortainerTemplateInspect": true,
+        "PortainerTemplateList": true,
+        "PortainerUserCreateToken": true,
+        "PortainerUserInspect": true,
+        "PortainerUserList": true,
+        "PortainerUserListToken": true,
+        "PortainerUserMemberships": true,
+        "PortainerUserRevokeToken": true
+      },
+      "Role": 1,
+      "ThemeSettings": {
+        "color": ""
+      },
+      "TokenIssueAt": 0,
+      "UseCache": false,
+      "Username": "prabhat"
+    }
+  ],
+  "version": {
+    "VERSION": "{\"SchemaVersion\":\"2.43.0\",\"MigratorCount\":2,\"Edition\":1,\"InstanceID\":\"463d5c47-0ea5-4aca-85b1-405ceefee254\"}"
+  },
+  "webhooks": null,
+  "workflows": null
+}
\ No newline at end of file
diff --git a/api/datastore/teststore.go b/api/datastore/teststore.go
new file mode 100644
index 0000000..5d9573a
--- /dev/null
+++ b/api/datastore/teststore.go
@@ -0,0 +1,82 @@
+package datastore
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/database"
+	"github.com/portainer/portainer/api/database/models"
+	"github.com/portainer/portainer/api/filesystem"
+
+	"github.com/rs/zerolog/log"
+)
+
+func (store *Store) GetConnection() portainer.Connection {
+	return store.connection
+}
+
+func MustNewTestStore(t testing.TB, init, secure bool) (bool, *Store) {
+	newStore, store, teardown, err := NewTestStore(t, init, secure)
+	if err != nil {
+		log.Fatal().Err(err).Msg("")
+	}
+
+	t.Cleanup(teardown)
+
+	return newStore, store
+}
+
+func NewTestStore(t testing.TB, init, secure bool) (bool, *Store, func(), error) {
+	// Creates unique temp directory in a concurrency friendly manner.
+	storePath := t.TempDir()
+	defaultKubectlShellImage := portainer.DefaultKubectlShellImage
+	flags := &portainer.CLIFlags{
+		KubectlShellImage: &defaultKubectlShellImage,
+	}
+
+	fileService, err := filesystem.NewService(storePath, "")
+	if err != nil {
+		return false, nil, nil, err
+	}
+
+	secretKey := []byte("apassphrasewhichneedstobe32bytes")
+	if !secure {
+		secretKey = nil
+	}
+
+	connection, err := database.NewDatabase("boltdb", storePath, secretKey, false)
+	if err != nil {
+		panic(err)
+	}
+
+	store := NewStore(flags, fileService, connection)
+	newStore, err := store.Open()
+	if err != nil {
+		return newStore, nil, nil, err
+	}
+
+	if init {
+		if err := store.Init(); err != nil {
+			return newStore, nil, nil, err
+		}
+	}
+
+	if newStore {
+		// From MigrateData
+		v := models.Version{
+			SchemaVersion: portainer.APIVersion,
+			Edition:       int(portainer.PortainerCE),
+		}
+		if err := store.VersionService.UpdateVersion(&v); err != nil {
+			return newStore, nil, nil, err
+		}
+	}
+
+	teardown := func() {
+		if err := store.Close(); err != nil {
+			log.Fatal().Err(err).Msg("")
+		}
+	}
+
+	return newStore, store, teardown, nil
+}
diff --git a/api/docker/client/client.go b/api/docker/client/client.go
new file mode 100644
index 0000000..eff3184
--- /dev/null
+++ b/api/docker/client/client.go
@@ -0,0 +1,212 @@
+package client
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/crypto"
+	"github.com/portainer/portainer/pkg/libhttp/ssrf"
+
+	"github.com/rs/zerolog/log"
+
+	"github.com/docker/docker/api/types/image"
+	"github.com/docker/docker/client"
+	"github.com/segmentio/encoding/json"
+)
+
+var errUnsupportedEnvironmentType = errors.New("environment not supported")
+
+const (
+	defaultDockerRequestTimeout = 60 * time.Second
+	dockerClientVersion         = "1.37"
+)
+
+type NodeNamesCtxKey struct{}
+
+// ClientFactory is used to create Docker clients
+type ClientFactory struct {
+	signatureService     portainer.DigitalSignatureService
+	reverseTunnelService portainer.ReverseTunnelService
+}
+
+// NewClientFactory returns a new instance of a ClientFactory
+func NewClientFactory(signatureService portainer.DigitalSignatureService, reverseTunnelService portainer.ReverseTunnelService) *ClientFactory {
+	return &ClientFactory{
+		signatureService:     signatureService,
+		reverseTunnelService: reverseTunnelService,
+	}
+}
+
+// CreateClient is a generic function to create a Docker client based on
+// a specific environment(endpoint) configuration. The nodeName parameter can be used
+// with an agent enabled environment(endpoint) to target a specific node in an agent cluster.
+// The underlying http client timeout may be specified, a default value is used otherwise.
+func (factory *ClientFactory) CreateClient(endpoint *portainer.Endpoint, nodeName string, timeout *time.Duration) (*client.Client, error) {
+	switch endpoint.Type {
+	case portainer.AzureEnvironment:
+		return nil, errUnsupportedEnvironmentType
+	case portainer.AgentOnDockerEnvironment:
+		return createAgentClient(endpoint, endpoint.URL, factory.signatureService, nodeName, timeout)
+	case portainer.EdgeAgentOnDockerEnvironment:
+		tunnelAddr, err := factory.reverseTunnelService.TunnelAddr(endpoint)
+		if err != nil {
+			return nil, err
+		}
+
+		endpointURL := "http://" + tunnelAddr
+
+		return createAgentClient(endpoint, endpointURL, factory.signatureService, nodeName, timeout)
+	}
+
+	if strings.HasPrefix(endpoint.URL, "unix://") || strings.HasPrefix(endpoint.URL, "npipe://") {
+		return createLocalClient(endpoint)
+	}
+
+	return createTCPClient(endpoint, timeout)
+}
+
+func createLocalClient(endpoint *portainer.Endpoint) (*client.Client, error) {
+	return client.NewClientWithOpts(
+		client.WithHost(endpoint.URL),
+		client.WithAPIVersionNegotiation(),
+	)
+}
+
+func createTCPClient(endpoint *portainer.Endpoint, timeout *time.Duration) (*client.Client, error) {
+	httpCli, err := httpClient(endpoint, timeout)
+	if err != nil {
+		return nil, err
+	}
+
+	opts := []client.Opt{
+		client.WithHost(endpoint.URL),
+		client.WithAPIVersionNegotiation(),
+		client.WithHTTPClient(httpCli),
+	}
+
+	if endpoint.TLSConfig.TLS {
+		opts = append(opts, client.WithScheme("https"))
+	}
+
+	return client.NewClientWithOpts(opts...)
+}
+
+func createAgentClient(endpoint *portainer.Endpoint, endpointURL string, signatureService portainer.DigitalSignatureService, nodeName string, timeout *time.Duration) (*client.Client, error) {
+	httpCli, err := httpClient(endpoint, timeout)
+	if err != nil {
+		return nil, err
+	}
+
+	signature, err := signatureService.CreateSignature(portainer.PortainerAgentSignatureMessage)
+	if err != nil {
+		return nil, err
+	}
+
+	headers := map[string]string{
+		portainer.PortainerAgentPublicKeyHeader: signatureService.EncodedPublicKey(),
+		portainer.PortainerAgentSignatureHeader: signature,
+	}
+
+	if nodeName != "" {
+		headers[portainer.PortainerAgentTargetHeader] = nodeName
+	}
+
+	opts := []client.Opt{
+		client.WithHost(endpointURL),
+		client.WithAPIVersionNegotiation(),
+		client.WithHTTPClient(httpCli),
+		client.WithHTTPHeaders(headers),
+	}
+
+	if endpoint.TLSConfig.TLS {
+		opts = append(opts, client.WithScheme("https"))
+	}
+
+	return client.NewClientWithOpts(opts...)
+}
+
+type NodeNameTransport struct {
+	*http.Transport
+}
+
+func (t *NodeNameTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	resp, err := t.Transport.RoundTrip(req)
+	if err != nil ||
+		resp.StatusCode != http.StatusOK ||
+		resp.ContentLength == 0 ||
+		!strings.HasSuffix(req.URL.Path, "/images/json") {
+		return resp, err
+	}
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		if err := resp.Body.Close(); err != nil {
+			log.Warn().Err(err).Msg("failed to close response body")
+		}
+
+		return resp, err
+	}
+
+	if err := resp.Body.Close(); err != nil {
+		log.Warn().Err(err).Msg("failed to close response body")
+	}
+
+	resp.Body = io.NopCloser(bytes.NewReader(body))
+
+	var rs []struct {
+		image.Summary
+		Portainer struct {
+			Agent struct {
+				NodeName string
+			}
+		}
+	}
+
+	if err = json.Unmarshal(body, &rs); err != nil {
+		return resp, nil
+	}
+
+	nodeNames, ok := req.Context().Value(NodeNamesCtxKey{}).(map[string]string)
+	if ok {
+		for idx, r := range rs {
+			// as there is no way to differentiate the same image available in multiple nodes only by their ID
+			// we append the index of the image in the payload response to match the node name later
+			// from the image.Summary[] list returned by docker's client.ImageList()
+			nodeNames[fmt.Sprintf("%s-%d", r.ID, idx)] = r.Portainer.Agent.NodeName
+		}
+	}
+
+	return resp, err
+}
+
+func httpClient(endpoint *portainer.Endpoint, timeout *time.Duration) (*http.Client, error) {
+	var transport *NodeNameTransport
+	if endpoint.TLSConfig.TLS {
+		tlsConfig, err := crypto.CreateTLSConfigurationFromDisk(endpoint.TLSConfig)
+		if err != nil {
+			return nil, err
+		}
+
+		t := ssrf.NewTransport(tlsConfig)
+		t.Protocols = ssrf.HTTP1Only()
+		transport = &NodeNameTransport{Transport: t}
+	} else {
+		transport = &NodeNameTransport{Transport: ssrf.NewTransport(nil)}
+	}
+
+	clientTimeout := defaultDockerRequestTimeout
+	if timeout != nil {
+		clientTimeout = *timeout
+	}
+
+	return &http.Client{
+		Transport: transport,
+		Timeout:   clientTimeout,
+	}, nil
+}
diff --git a/api/docker/client/client_test.go b/api/docker/client/client_test.go
new file mode 100644
index 0000000..cf1f1bd
--- /dev/null
+++ b/api/docker/client/client_test.go
@@ -0,0 +1,31 @@
+package client
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/pkg/fips"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestHttpClient(t *testing.T) {
+	t.Parallel()
+	fips.InitFIPS(false)
+
+	// Valid TLS configuration
+	endpoint := &portainer.Endpoint{}
+	endpoint.TLSConfig = portainer.TLSConfiguration{TLS: true}
+
+	cli, err := httpClient(endpoint, nil)
+	require.NoError(t, err)
+	require.NotNil(t, cli)
+
+	// Invalid TLS configuration
+	endpoint.TLSConfig.TLSCertPath = "/invalid/path/client.crt"
+	endpoint.TLSConfig.TLSKeyPath = "/invalid/path/client.key"
+
+	cli, err = httpClient(endpoint, nil)
+	require.Error(t, err)
+	require.Nil(t, cli)
+}
diff --git a/api/docker/consts/labels.go b/api/docker/consts/labels.go
new file mode 100644
index 0000000..aeb24ba
--- /dev/null
+++ b/api/docker/consts/labels.go
@@ -0,0 +1,9 @@
+package consts
+
+const (
+	ComposeStackNameLabel = "com.docker.compose.project"
+	SwarmStackNameLabel   = "com.docker.stack.namespace"
+	SwarmServiceIDLabel   = "com.docker.swarm.service.id"
+	SwarmNodeIDLabel      = "com.docker.swarm.node.id"
+	HideStackLabel        = "io.portainer.hideStack"
+)
diff --git a/api/docker/container.go b/api/docker/container.go
new file mode 100644
index 0000000..2b8cfd5
--- /dev/null
+++ b/api/docker/container.go
@@ -0,0 +1,239 @@
+package docker
+
+import (
+	"context"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	dockerclient "github.com/portainer/portainer/api/docker/client"
+	"github.com/portainer/portainer/api/docker/images"
+	"github.com/portainer/portainer/api/logs"
+
+	"github.com/Masterminds/semver/v3"
+	"github.com/docker/docker/api/types"
+	dockercontainer "github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/api/types/network"
+	"github.com/pkg/errors"
+	"github.com/rs/zerolog/log"
+)
+
+type ContainerService struct {
+	factory   *dockerclient.ClientFactory
+	dataStore dataservices.DataStore
+}
+
+func NewContainerService(factory *dockerclient.ClientFactory, dataStore dataservices.DataStore) *ContainerService {
+	return &ContainerService{
+		factory:   factory,
+		dataStore: dataStore,
+	}
+}
+
+// applyVersionConstraint uses the version to apply a transformation function to
+// the value when the constraint is satisfied
+func applyVersionConstraint[T any](currentVersion, versionConstraint string, value T, transform func(T) T) (T, error) {
+	newValue := value
+
+	constraint, err := semver.NewConstraint(versionConstraint)
+	if err != nil {
+		return newValue, errors.New("invalid version constraint specified")
+	}
+
+	currentVer, err := semver.NewVersion(currentVersion)
+	if err != nil {
+		log.Warn().Err(err).Msg("Unable to parse the Docker client version")
+
+		return newValue, nil
+	}
+
+	if satisfiesConstraint, _ := constraint.Validate(currentVer); satisfiesConstraint {
+		newValue = transform(value)
+	}
+
+	return newValue, nil
+}
+
+func clearMacAddrs(n network.NetworkingConfig) network.NetworkingConfig {
+	netConfig := network.NetworkingConfig{
+		EndpointsConfig: make(map[string]*network.EndpointSettings),
+	}
+
+	for k := range n.EndpointsConfig {
+		endpointConfig := n.EndpointsConfig[k].Copy()
+		endpointConfig.MacAddress = ""
+		netConfig.EndpointsConfig[k] = endpointConfig
+	}
+
+	return netConfig
+}
+
+// Recreate a container
+func (c *ContainerService) Recreate(ctx context.Context, endpoint *portainer.Endpoint, containerId string, forcePullImage bool, imageTag, nodeName string) (*types.ContainerJSON, error) {
+	cli, err := c.factory.CreateClient(endpoint, nodeName, nil)
+	if err != nil {
+		return nil, errors.Wrap(err, "create client error")
+	}
+	defer logs.CloseAndLogErr(cli)
+
+	log.Debug().Str("container_id", containerId).Msg("starting to fetch container information")
+
+	container, _, err := cli.ContainerInspectWithRaw(ctx, containerId, true)
+	if err != nil {
+		return nil, errors.Wrap(err, "fetch container information error")
+	}
+
+	log.Debug().Str("image", container.Config.Image).Msg("starting to parse image")
+	img, err := images.ParseImage(images.ParseImageOptions{
+		Name: container.Config.Image,
+	})
+	if err != nil {
+		return nil, errors.Wrap(err, "parse image error")
+	}
+
+	if imageTag != "" {
+		if err := img.WithTag(imageTag); err != nil {
+			return nil, errors.Wrapf(err, "set image tag error %s", imageTag)
+		}
+
+		log.Debug().Str("image", container.Config.Image).Msg("new image with tag")
+
+		container.Config.Image = img.FullName()
+	}
+
+	// 1. pull image if you need force pull
+	if forcePullImage {
+		puller := images.NewPuller(cli, images.NewRegistryClient(c.dataStore), c.dataStore)
+		if err := puller.Pull(ctx, img); err != nil {
+			return nil, errors.Wrapf(err, "pull image error %s", img.FullName())
+		}
+	}
+
+	// 2. stop the current container
+	log.Debug().Str("container_id", containerId).Msg("starting to stop the container")
+	if err := cli.ContainerStop(ctx, containerId, dockercontainer.StopOptions{}); err != nil {
+		return nil, errors.Wrap(err, "stop container error")
+	}
+
+	// 3. rename the current container
+	log.Debug().Str("container_id", containerId).Msg("starting to rename the container")
+	if err := cli.ContainerRename(ctx, containerId, container.Name+"-old"); err != nil {
+		return nil, errors.Wrap(err, "rename container error")
+	}
+
+	initialNetwork := network.NetworkingConfig{
+		EndpointsConfig: make(map[string]*network.EndpointSettings),
+	}
+
+	// 4. disconnect all networks from the current container
+	for name, network := range container.NetworkSettings.Networks {
+		// This allows new container to use the same IP address if specified
+		if err := cli.NetworkDisconnect(ctx, network.NetworkID, containerId, true); err != nil {
+			return nil, errors.Wrap(err, "disconnect network from old container error")
+		}
+
+		// 5. get the first network attached to the current container
+		if len(initialNetwork.EndpointsConfig) == 0 {
+			// Retrieve the first network that is linked to the present container, which
+			// will be utilized when creating the container.
+			initialNetwork.EndpointsConfig[name] = network
+		}
+	}
+
+	restore := true
+
+	defer func() {
+		if !restore {
+			return
+		}
+
+		log.Debug().Str("container_id", containerId).Str("container", container.Name).Msg("restoring the container")
+		if err := cli.ContainerRename(ctx, containerId, container.Name); err != nil {
+			log.Warn().Err(err).Msg("failure to rename container")
+		}
+
+		for _, network := range container.NetworkSettings.Networks {
+			if err := cli.NetworkConnect(ctx, network.NetworkID, containerId, network); err != nil {
+				log.Warn().Err(err).Msg("failure to connect container to network")
+			}
+		}
+
+		if err := cli.ContainerStart(ctx, containerId, dockercontainer.StartOptions{}); err != nil {
+			log.Warn().Err(err).Msg("failure to start container")
+		}
+	}()
+
+	log.Debug().Str("container", strings.Split(container.Name, "/")[1]).Msg("starting to create a new container")
+
+	// 6. create a new container
+	// when a container is created without a network, docker connected it by default to the
+	// bridge network with a random IP, also it can only connect to one network on creation.
+	// to retain the same network settings we have to connect on creation to one of the old
+	// container's networks, and connect to the other networks after creation.
+	// see: https://portainer.atlassian.net/browse/EE-5448
+
+	// Docker API < 1.44 does not support specifying MAC addresses
+	// https://github.com/moby/moby/blob/6aea26b431ea152a8b085e453da06ea403f89886/client/container_create.go#L44-L46
+	initialNetwork, err = applyVersionConstraint(cli.ClientVersion(), "< 1.44", initialNetwork, clearMacAddrs)
+	if err != nil {
+		return nil, err
+	}
+
+	create, err := cli.ContainerCreate(ctx, container.Config, container.HostConfig, &initialNetwork, nil, container.Name)
+	if err != nil {
+		return nil, errors.Wrap(err, "create container error")
+	}
+
+	defer func() {
+		if !restore {
+			return
+		}
+
+		log.Debug().Str("container_id", create.ID).Msg("removing the new container")
+
+		if err := cli.ContainerStop(ctx, create.ID, dockercontainer.StopOptions{}); err != nil {
+			log.Warn().Err(err).Msg("failure to stop container")
+		}
+
+		if err := cli.ContainerRemove(ctx, create.ID, dockercontainer.RemoveOptions{}); err != nil {
+			log.Warn().Err(err).Msg("failure to remove container")
+		}
+	}()
+
+	newContainerId := create.ID
+
+	// 7. connect to networks
+	// docker can connect to only one network at creation, so we need to connect to networks after creation
+	// see https://github.com/moby/moby/issues/17750
+	log.Debug().Str("container_id", newContainerId).Msg("connecting networks to container")
+	networks := container.NetworkSettings.Networks
+	for key, network := range networks {
+		if _, ok := initialNetwork.EndpointsConfig[key]; ok {
+			// skip the network that is used during container creation
+			continue
+		}
+
+		if err := cli.NetworkConnect(ctx, network.NetworkID, newContainerId, network); err != nil {
+			return nil, errors.Wrap(err, "connect container network error")
+		}
+	}
+
+	// 8. start the new container
+	log.Debug().Str("container_id", newContainerId).Msg("starting the new container")
+	if err := cli.ContainerStart(ctx, newContainerId, dockercontainer.StartOptions{}); err != nil {
+		return nil, errors.Wrap(err, "start container error")
+	}
+
+	// 9. delete the old container
+	log.Debug().Str("container_id", containerId).Msg("starting to remove the old container")
+	_ = cli.ContainerRemove(ctx, containerId, dockercontainer.RemoveOptions{})
+
+	restore = false
+
+	newContainer, _, err := cli.ContainerInspectWithRaw(ctx, newContainerId, true)
+	if err != nil {
+		return nil, errors.Wrap(err, "fetch container information error")
+	}
+
+	return &newContainer, nil
+}
diff --git a/api/docker/container_test.go b/api/docker/container_test.go
new file mode 100644
index 0000000..58aa605
--- /dev/null
+++ b/api/docker/container_test.go
@@ -0,0 +1,53 @@
+package docker
+
+import (
+	"testing"
+
+	"github.com/docker/docker/api/types/network"
+	"github.com/stretchr/testify/require"
+)
+
+func TestApplyVersionConstraint(t *testing.T) {
+	t.Parallel()
+	initialNet := network.NetworkingConfig{
+		EndpointsConfig: map[string]*network.EndpointSettings{
+			"key1": {
+				MacAddress: "mac1",
+				EndpointID: "endpointID1",
+			},
+			"key2": {
+				MacAddress: "mac2",
+				EndpointID: "endpointID2",
+			},
+		},
+	}
+
+	f := func(currentVer string, constraint string, success, emptyMac bool) {
+		t.Helper()
+
+		transformedNet, err := applyVersionConstraint(currentVer, constraint, initialNet, clearMacAddrs)
+		if success {
+			require.NoError(t, err)
+		} else {
+			require.Error(t, err)
+		}
+
+		require.Len(t, transformedNet.EndpointsConfig, len(initialNet.EndpointsConfig))
+
+		for k := range initialNet.EndpointsConfig {
+			if emptyMac {
+				require.NotEqual(t, initialNet.EndpointsConfig[k], transformedNet.EndpointsConfig[k])
+				require.Empty(t, transformedNet.EndpointsConfig[k].MacAddress)
+
+				continue
+			}
+
+			require.Equal(t, initialNet.EndpointsConfig[k], transformedNet.EndpointsConfig[k])
+		}
+	}
+
+	f("1.45", "< 1.44", true, false)  // No transformation
+	f("1.43", "< 1.44", true, true)   // Transformation
+	f("a.b.", "< 1.44", true, false)  // Invalid current version
+	f("1.45", "z 1.44", false, false) // Invalid version constraint
+}
diff --git a/api/docker/errors.go b/api/docker/errors.go
new file mode 100644
index 0000000..04e4159
--- /dev/null
+++ b/api/docker/errors.go
@@ -0,0 +1,8 @@
+package docker
+
+import "errors"
+
+// Docker errors
+var (
+	ErrUnableToPingEndpoint = errors.New("Unable to communicate with the environment")
+)
diff --git a/api/docker/images/digest.go b/api/docker/images/digest.go
new file mode 100644
index 0000000..7641b8f
--- /dev/null
+++ b/api/docker/images/digest.go
@@ -0,0 +1,178 @@
+package images
+
+import (
+	"context"
+	"strings"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+
+	"github.com/docker/docker/api/types/image"
+	dockerclient "github.com/docker/docker/client"
+	"github.com/opencontainers/go-digest"
+	"github.com/pkg/errors"
+	"github.com/rs/zerolog/log"
+	"go.podman.io/image/v5/docker"
+	imagetypes "go.podman.io/image/v5/types"
+)
+
+const digestFetchTimeout = 5 * time.Second
+
+// ClientFactory creates Docker clients for a given environment.
+type ClientFactory interface {
+	CreateClient(endpoint *portainer.Endpoint, nodeName string, timeout *time.Duration) (*dockerclient.Client, error)
+}
+
+// RegistryAuthProvider looks up registry credentials for an image.
+type RegistryAuthProvider interface {
+	RegistryAuth(image Image) (string, string, error)
+}
+
+type DigestClient struct {
+	clientFactory  ClientFactory
+	sysCtx         *imagetypes.SystemContext
+	registryClient RegistryAuthProvider
+}
+
+func NewClientWithRegistry(registryClient RegistryAuthProvider, clientFactory ClientFactory) *DigestClient {
+	return &DigestClient{
+		clientFactory:  clientFactory,
+		registryClient: registryClient,
+	}
+}
+
+func (c *DigestClient) RemoteDigest(ctx context.Context, image Image) (digest.Digest, error) {
+	ctx, cancel := context.WithTimeout(ctx, digestFetchTimeout)
+	defer cancel()
+
+	// Docker references with both a tag and digest are currently not supported
+	if image.Tag != "" && image.Digest != "" {
+		if err := image.TrimDigest(); err != nil {
+			return "", err
+		}
+	}
+
+	rmRef, err := ParseReference(image.String())
+	if err != nil {
+		return "", errors.Wrap(err, "Cannot parse the image reference")
+	}
+
+	sysCtx := c.sysCtx
+	if c.registryClient != nil {
+		username, password, err := c.registryClient.RegistryAuth(image)
+		if err != nil {
+			log.Info().Str("image up to date indicator", image.String()).Msg("No environment registry credentials found, using anonymous access")
+		} else {
+			sysCtx = &imagetypes.SystemContext{
+				DockerAuthConfig: &imagetypes.DockerAuthConfig{
+					Username: username,
+					Password: password,
+				},
+			}
+		}
+	}
+
+	// Retrieve remote digest through HEAD request
+	rmDigest, err := docker.GetDigest(ctx, sysCtx, rmRef)
+	if err != nil {
+		// Fallback to public registry for hub
+		if image.HubLink != "" {
+			rmDigest, err = docker.GetDigest(ctx, c.sysCtx, rmRef)
+			if err == nil {
+				return rmDigest, nil
+			}
+		}
+
+		log.Debug().Err(err).Msg("get remote digest error")
+
+		return "", errors.Wrap(err, "Cannot get image digest from HEAD request")
+	}
+
+	return rmDigest, nil
+}
+
+func ParseLocalImage(inspect image.InspectResponse) (*Image, error) {
+	if IsLocalImage(inspect) || IsDanglingImage(inspect) {
+		return nil, errors.New("the image is not regular")
+	}
+
+	fromRepoDigests, err := ParseImage(ParseImageOptions{
+		// including image name but no tag
+		Name: inspect.RepoDigests[0],
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	if IsNoTagImage(inspect) {
+		return &fromRepoDigests, nil
+	}
+
+	fromRepoTags, err := ParseImage(ParseImageOptions{
+		Name: inspect.RepoTags[0],
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	fromRepoDigests.Tag = fromRepoTags.Tag
+
+	return &fromRepoDigests, nil
+}
+
+func ParseRepoDigests(repoDigests []string) []digest.Digest {
+	digests := make([]digest.Digest, 0)
+	for _, repoDigest := range repoDigests {
+		d := ParseRepoDigest(repoDigest)
+		if d == "" {
+			continue
+		}
+
+		digests = append(digests, d)
+	}
+
+	return digests
+}
+
+func ParseRepoTags(repoTags []string) []*Image {
+	images := make([]*Image, 0)
+	for _, repoTag := range repoTags {
+		if image := ParseRepoTag(repoTag); image != nil {
+			images = append(images, image)
+		}
+	}
+
+	return images
+}
+
+func ParseRepoDigest(repoDigest string) digest.Digest {
+	if !strings.ContainsAny(repoDigest, "@") {
+		return ""
+	}
+
+	d, err := digest.Parse(strings.Split(repoDigest, "@")[1])
+	if err != nil {
+		log.Warn().Err(err).Str("digest", repoDigest).Msg("skip invalid repo item")
+
+		return ""
+	}
+
+	return d
+}
+
+func ParseRepoTag(repoTag string) *Image {
+	if repoTag == "" {
+		return nil
+	}
+
+	image, err := ParseImage(ParseImageOptions{
+		Name: repoTag,
+	})
+	if err != nil {
+		log.Warn().Err(err).Str("repoTag", repoTag).Msg("RepoTag cannot be parsed.")
+
+		return nil
+	}
+
+	return &image
+}
diff --git a/api/docker/images/digest_test.go b/api/docker/images/digest_test.go
new file mode 100644
index 0000000..dc1a4e0
--- /dev/null
+++ b/api/docker/images/digest_test.go
@@ -0,0 +1,34 @@
+package images
+
+import (
+	"testing"
+
+	"github.com/docker/docker/api/types/image"
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseLocalImage(t *testing.T) {
+	t.Parallel()
+	// Test with a regular image
+
+	img, err := ParseLocalImage(image.InspectResponse{
+		ID:          "sha256:9234e8fb04c47cfe0f49931e4ac7eb76fa904e33b7f8576aec0501c085f02516",
+		RepoTags:    []string{"myimage:latest"},
+		RepoDigests: []string{"myimage@sha256:4bcff63911fcb4448bd4fdacec207030997caf25e9bea4045fa6c8c44de311d1"},
+	})
+	require.NoError(t, err)
+	require.NotNil(t, img)
+	require.Equal(t, "library/myimage", img.Path)
+	require.Equal(t, "latest", img.Tag)
+	require.Equal(t, "sha256:4bcff63911fcb4448bd4fdacec207030997caf25e9bea4045fa6c8c44de311d1", img.Digest.String())
+
+	// Test with a dangling image
+
+	img, err = ParseLocalImage(image.InspectResponse{
+		ID:          "sha256:abcdef1234567890",
+		RepoTags:    []string{"<none>:<none>"},
+		RepoDigests: []string{"<none>@<none>"},
+	})
+	require.Error(t, err)
+	require.Nil(t, img)
+}
diff --git a/api/docker/images/image.go b/api/docker/images/image.go
new file mode 100644
index 0000000..3d60e36
--- /dev/null
+++ b/api/docker/images/image.go
@@ -0,0 +1,189 @@
+package images
+
+import (
+	"bytes"
+	"fmt"
+	"path/filepath"
+	"strings"
+	"text/template"
+
+	"github.com/docker/docker/api/types"
+	"github.com/docker/docker/api/types/image"
+	"github.com/opencontainers/go-digest"
+	"github.com/pkg/errors"
+	"go.podman.io/image/v5/docker/reference"
+)
+
+type ImageID string
+
+// Image holds information about an image.
+type Image struct {
+	// Domain is the registry host of this image
+	Domain string
+	// Path may include username like portainer/portainer-ee, no Tag or Digest
+	Path    string
+	Tag     string
+	Digest  digest.Digest
+	HubLink string
+	named   reference.Named
+	Opts    ParseImageOptions `json:"-"`
+}
+
+// ParseImageOptions holds image options for parsing.
+type ParseImageOptions struct {
+	Name   string
+	HubTpl string
+}
+
+// Name returns the full name representation of an image but no Tag or Digest.
+func (i *Image) Name() string {
+	return i.named.Name()
+}
+
+// FullName return the real full name may include Tag or Digest of the image, Tag first.
+func (i *Image) FullName() string {
+	if i.Tag == "" {
+		return i.Name() + "@" + i.Digest.String()
+	}
+
+	return i.Name() + ":" + i.Tag
+}
+
+// String returns the string representation of an image, including Tag and Digest if existed.
+func (i *Image) String() string {
+	return i.named.String()
+}
+
+// Reference returns either the digest if it is non-empty or the tag for the image.
+func (i *Image) Reference() string {
+	if len(i.Digest.String()) > 1 {
+		return i.Digest.String()
+	}
+
+	return i.Tag
+}
+
+// WithDigest sets the digest for an image.
+func (i *Image) WithDigest(digest digest.Digest) (err error) {
+	i.Digest = digest
+	i.named, err = reference.WithDigest(i.named, digest)
+
+	return err
+}
+
+func (i *Image) WithTag(tag string) (err error) {
+	i.Tag = tag
+	i.named, err = reference.WithTag(i.named, tag)
+
+	return err
+}
+
+func (i *Image) TrimDigest() error {
+	i.Digest = ""
+	named, err := ParseImage(ParseImageOptions{Name: i.FullName()})
+	if err != nil {
+		return err
+	}
+	i.named = &named
+
+	return nil
+}
+
+// ParseImage returns an Image struct with all the values filled in for a given image.
+func ParseImage(parseOpts ParseImageOptions) (Image, error) {
+	// Parse the image name and tag.
+	named, err := reference.ParseNormalizedNamed(parseOpts.Name)
+	if err != nil {
+		return Image{}, errors.Wrapf(err, "parsing image %s failed", parseOpts.Name)
+	}
+
+	// Add the latest lag if they did not provide one.
+	named = reference.TagNameOnly(named)
+
+	i := Image{
+		Opts:   parseOpts,
+		named:  named,
+		Domain: reference.Domain(named),
+		Path:   reference.Path(named),
+	}
+
+	// Hub link
+	i.HubLink, err = i.hubLink()
+	if err != nil {
+		return Image{}, errors.Wrap(err, fmt.Sprintf("resolving hub link for image %s failed", parseOpts.Name))
+	}
+
+	// Add the tag if there was one.
+	if tagged, ok := named.(reference.Tagged); ok {
+		i.Tag = tagged.Tag()
+	}
+
+	// Add the digest if there was one.
+	if canonical, ok := named.(reference.Canonical); ok {
+		i.Digest = canonical.Digest()
+	}
+
+	return i, nil
+}
+
+func (i *Image) hubLink() (string, error) {
+	if i.Opts.HubTpl != "" {
+		var out bytes.Buffer
+		tmpl, err := template.New("tmpl").
+			Option("missingkey=error").
+			Parse(i.Opts.HubTpl)
+		if err != nil {
+			return "", err
+		}
+		err = tmpl.Execute(&out, i)
+
+		return out.String(), err
+	}
+
+	switch i.Domain {
+	case "docker.io":
+		prefix := "r"
+		path := i.Path
+		if strings.HasPrefix(i.Path, "library/") {
+			prefix = "_"
+			path = strings.Replace(i.Path, "library/", "", 1)
+		}
+
+		return "https://hub.docker.com/" + prefix + "/" + path, nil
+	case "docker.bintray.io", "jfrog-docker-reg2.bintray.io":
+		return "https://bintray.com/jfrog/reg2/" + strings.ReplaceAll(i.Path, "/", "%3A"), nil
+	case "docker.pkg.github.com":
+		return "https://github.com/" + filepath.ToSlash(filepath.Dir(i.Path)) + "/packages", nil
+	case "gcr.io":
+		return "https://" + i.Domain + "/" + i.Path, nil
+	case "ghcr.io":
+		ref := strings.Split(i.Path, "/")
+		ghUser, ghPackage := ref[0], ref[1]
+		return "https://github.com/users/" + ghUser + "/packages/container/package/" + ghPackage, nil
+	case "quay.io":
+		return "https://quay.io/repository/" + i.Path, nil
+	case "registry.access.redhat.com":
+		return "https://access.redhat.com/containers/#/registry.access.redhat.com/" + i.Path, nil
+	case "registry.gitlab.com":
+		return "https://gitlab.com/" + i.Path + "/container_registry", nil
+	default:
+		return "", nil
+	}
+}
+
+// IsLocalImage checks if the image has been built locally
+func IsLocalImage(image types.ImageInspect) bool {
+	return len(image.RepoDigests) == 0
+}
+
+// IsDanglingImage returns whether the given image is "dangling" which means
+// that there are no repository references to the given image and it has no
+// child images
+func IsDanglingImage(image image.InspectResponse) bool {
+	return len(image.RepoTags) == 1 && image.RepoTags[0] == "<none>:<none>" && len(image.RepoDigests) == 1 && image.RepoDigests[0] == "<none>@<none>"
+}
+
+// IsNoTagImage returns whether the given image is damaged, has no tags
+func IsNoTagImage(image image.InspectResponse) bool {
+	return len(image.RepoTags) == 0
+}
diff --git a/api/docker/images/image_test.go b/api/docker/images/image_test.go
new file mode 100644
index 0000000..46bdd44
--- /dev/null
+++ b/api/docker/images/image_test.go
@@ -0,0 +1,125 @@
+package images
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestImageParser(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	// portainer/portainer-ee
+	t.Run("", func(t *testing.T) {
+		image, err := ParseImage(ParseImageOptions{
+			Name: "portainer/portainer-ee",
+		})
+		require.NoError(t, err)
+		is.Equal("docker.io/portainer/portainer-ee:latest", image.FullName())
+		is.Equal("portainer/portainer-ee", image.Opts.Name)
+		is.Equal("latest", image.Tag)
+		is.Equal("portainer/portainer-ee", image.Path)
+		is.Equal("docker.io", image.Domain)
+		is.Equal("docker.io/portainer/portainer-ee", image.Name())
+		is.Equal("latest", image.Reference())
+		is.Equal("docker.io/portainer/portainer-ee:latest", image.String())
+
+	})
+	// gcr.io/k8s-minikube/kicbase@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2
+	t.Run("", func(t *testing.T) {
+		image, err := ParseImage(ParseImageOptions{
+			Name: "gcr.io/k8s-minikube/kicbase@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2",
+		})
+		require.NoError(t, err)
+		is.Equal("gcr.io/k8s-minikube/kicbase@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2", image.FullName())
+		is.Equal("gcr.io/k8s-minikube/kicbase@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2", image.Opts.Name)
+		is.Empty(image.Tag)
+		is.Equal("k8s-minikube/kicbase", image.Path)
+		is.Equal("gcr.io", image.Domain)
+		is.Equal("https://gcr.io/k8s-minikube/kicbase", image.HubLink)
+		is.Equal("gcr.io/k8s-minikube/kicbase", image.Name())
+		is.Equal("sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2", image.Reference())
+		is.Equal("gcr.io/k8s-minikube/kicbase@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2", image.String())
+	})
+
+	// gcr.io/k8s-minikube/kicbase:v0.0.30@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2
+	t.Run("", func(t *testing.T) {
+		image, err := ParseImage(ParseImageOptions{
+			Name: "gcr.io/k8s-minikube/kicbase:v0.0.30@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2",
+		})
+		require.NoError(t, err)
+		is.Equal("gcr.io/k8s-minikube/kicbase:v0.0.30", image.FullName())
+		is.Equal("gcr.io/k8s-minikube/kicbase:v0.0.30@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2", image.Opts.Name)
+		is.Equal("v0.0.30", image.Tag)
+		is.Equal("k8s-minikube/kicbase", image.Path)
+		is.Equal("gcr.io", image.Domain)
+		is.Equal("https://gcr.io/k8s-minikube/kicbase", image.HubLink)
+		is.Equal("gcr.io/k8s-minikube/kicbase", image.Name())
+		is.Equal("sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2", image.Reference())
+		is.Equal("gcr.io/k8s-minikube/kicbase:v0.0.30@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2", image.String())
+	})
+}
+
+func TestUpdateParsedImage(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	// gcr.io/k8s-minikube/kicbase:v0.0.30@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2
+	t.Run("", func(t *testing.T) {
+		image, err := ParseImage(ParseImageOptions{
+			Name: "gcr.io/k8s-minikube/kicbase:v0.0.30@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2",
+		})
+		require.NoError(t, err)
+		err = image.WithTag("v0.0.31")
+		require.NoError(t, err)
+		is.Equal("gcr.io/k8s-minikube/kicbase:v0.0.31", image.FullName())
+		is.Equal("gcr.io/k8s-minikube/kicbase:v0.0.30@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2", image.Opts.Name)
+		is.Equal("v0.0.31", image.Tag)
+		is.Equal("k8s-minikube/kicbase", image.Path)
+		is.Equal("gcr.io", image.Domain)
+		is.Equal("https://gcr.io/k8s-minikube/kicbase", image.HubLink)
+		is.Equal("gcr.io/k8s-minikube/kicbase", image.Name())
+		is.Equal("sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2", image.Reference())
+		is.Equal("gcr.io/k8s-minikube/kicbase:v0.0.31@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2", image.String())
+	})
+
+	// gcr.io/k8s-minikube/kicbase:v0.0.30@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2
+	t.Run("", func(t *testing.T) {
+		image, err := ParseImage(ParseImageOptions{
+			Name: "gcr.io/k8s-minikube/kicbase:v0.0.30@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2",
+		})
+		require.NoError(t, err)
+		err = image.WithDigest("sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b3")
+		require.NoError(t, err)
+		is.Equal("gcr.io/k8s-minikube/kicbase:v0.0.30", image.FullName())
+		is.Equal("gcr.io/k8s-minikube/kicbase:v0.0.30@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2", image.Opts.Name)
+		is.Equal("v0.0.30", image.Tag)
+		is.Equal("k8s-minikube/kicbase", image.Path)
+		is.Equal("gcr.io", image.Domain)
+		is.Equal("https://gcr.io/k8s-minikube/kicbase", image.HubLink)
+		is.Equal("gcr.io/k8s-minikube/kicbase", image.Name())
+		is.Equal("sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b3", image.Reference())
+		is.Equal("gcr.io/k8s-minikube/kicbase:v0.0.30@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b3", image.String())
+	})
+
+	// gcr.io/k8s-minikube/kicbase:v0.0.30@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2
+	t.Run("", func(t *testing.T) {
+		image, err := ParseImage(ParseImageOptions{
+			Name: "gcr.io/k8s-minikube/kicbase:v0.0.30@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2",
+		})
+		require.NoError(t, err)
+		err = image.TrimDigest()
+		require.NoError(t, err)
+		is.Equal("gcr.io/k8s-minikube/kicbase:v0.0.30", image.FullName())
+		is.Equal("gcr.io/k8s-minikube/kicbase:v0.0.30@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2", image.Opts.Name)
+		is.Equal("v0.0.30", image.Tag)
+		is.Equal("k8s-minikube/kicbase", image.Path)
+		is.Equal("gcr.io", image.Domain)
+		is.Equal("https://gcr.io/k8s-minikube/kicbase", image.HubLink)
+		is.Equal("gcr.io/k8s-minikube/kicbase", image.Name())
+		is.Equal("v0.0.30", image.Reference())
+		is.Equal("gcr.io/k8s-minikube/kicbase:v0.0.30", image.String())
+	})
+}
diff --git a/api/docker/images/puller.go b/api/docker/images/puller.go
new file mode 100644
index 0000000..a0f35cd
--- /dev/null
+++ b/api/docker/images/puller.go
@@ -0,0 +1,51 @@
+package images
+
+import (
+	"context"
+	"io"
+
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/logs"
+
+	"github.com/docker/docker/api/types/image"
+	"github.com/docker/docker/client"
+	"github.com/rs/zerolog/log"
+)
+
+type Puller struct {
+	client         *client.Client
+	registryClient *RegistryClient
+	dataStore      dataservices.DataStore
+}
+
+func NewPuller(client *client.Client, registryClient *RegistryClient, dataStore dataservices.DataStore) *Puller {
+	return &Puller{
+		client:         client,
+		registryClient: registryClient,
+		dataStore:      dataStore,
+	}
+}
+
+func (puller *Puller) Pull(ctx context.Context, img Image) error {
+	log.Debug().Str("image", img.FullName()).Msg("starting to pull the image")
+
+	registryAuth, err := puller.registryClient.EncodedRegistryAuth(img)
+	if err != nil {
+		log.Debug().
+			Str("image", img.FullName()).
+			Err(err).
+			Msg("failed to get an encoded registry auth via image, try to pull image without registry auth")
+	}
+
+	out, err := puller.client.ImagePull(ctx, img.FullName(), image.PullOptions{
+		RegistryAuth: registryAuth,
+	})
+	if err != nil {
+		return err
+	}
+	defer logs.CloseAndLogErr(out)
+
+	_, err = io.ReadAll(out)
+
+	return err
+}
diff --git a/api/docker/images/ref.go b/api/docker/images/ref.go
new file mode 100644
index 0000000..83a0fa4
--- /dev/null
+++ b/api/docker/images/ref.go
@@ -0,0 +1,15 @@
+package images
+
+import (
+	"strings"
+
+	"go.podman.io/image/v5/docker"
+	"go.podman.io/image/v5/types"
+)
+
+func ParseReference(imageStr string) (types.ImageReference, error) {
+	if !strings.HasPrefix(imageStr, "//") {
+		imageStr = "//" + imageStr
+	}
+	return docker.ParseReference(imageStr)
+}
diff --git a/api/docker/images/registry.go b/api/docker/images/registry.go
new file mode 100644
index 0000000..346df29
--- /dev/null
+++ b/api/docker/images/registry.go
@@ -0,0 +1,155 @@
+package images
+
+import (
+	"cmp"
+	"strings"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/internal/registryutils"
+
+	"github.com/patrickmn/go-cache"
+	"github.com/pkg/errors"
+)
+
+var registriesCache = cache.New(5*time.Minute, 5*time.Minute)
+
+type RegistryClient struct {
+	dataStore dataservices.DataStore
+}
+
+func NewRegistryClient(dataStore dataservices.DataStore) *RegistryClient {
+	return &RegistryClient{dataStore: dataStore}
+}
+
+func (c *RegistryClient) RegistryAuth(image Image) (string, string, error) {
+	registry, err := cachedRegistry(image.Opts.Name)
+	if err != nil {
+		var registries []portainer.Registry
+		err = c.dataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
+			var err error
+			registries, err = tx.Registry().ReadAll()
+			return err
+		})
+		if err != nil {
+			return "", "", err
+		}
+
+		registry, err = findBestMatchRegistry(image.Opts.Name, registries)
+		if err != nil {
+			return "", "", err
+		}
+	}
+
+	if !registry.Authentication {
+		return "", "", errors.New("authentication is disabled")
+	}
+
+	return c.CertainRegistryAuth(registry)
+}
+
+func (c *RegistryClient) CertainRegistryAuth(registry *portainer.Registry) (string, string, error) {
+	if err := registryutils.EnsureRegTokenValid(c.dataStore, registry); err != nil {
+		return "", "", err
+	}
+
+	if !registry.Authentication {
+		return "", "", errors.New("authentication is disabled")
+	}
+
+	return registryutils.GetRegEffectiveCredential(registry)
+}
+
+func (c *RegistryClient) EncodedRegistryAuth(image Image) (string, error) {
+	registry, err := cachedRegistry(image.Opts.Name)
+	if err != nil {
+		var registries []portainer.Registry
+		err = c.dataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
+			var err error
+			registries, err = tx.Registry().ReadAll()
+			return err
+		})
+		if err != nil {
+			return "", err
+		}
+
+		registry, err = findBestMatchRegistry(image.Opts.Name, registries)
+		if err != nil {
+			return "", err
+		}
+	}
+
+	if !registry.Authentication {
+		return "", errors.New("authentication is disabled")
+	}
+
+	return c.EncodedCertainRegistryAuth(registry)
+}
+
+func (c *RegistryClient) EncodedCertainRegistryAuth(registry *portainer.Registry) (string, error) {
+	if err := registryutils.EnsureRegTokenValid(c.dataStore, registry); err != nil {
+		return "", err
+	}
+
+	return registryutils.GetRegistryAuthHeader(registry)
+}
+
+// findBestMatchRegistry finds out the best match registry for repository @Meng
+// matching precedence:
+// 1. both domain name and username matched (for dockerhub only)
+// 2. only URL matched
+// 3. pick up the first dockerhub registry
+func findBestMatchRegistry(repository string, registries []portainer.Registry) (*portainer.Registry, error) {
+	cachedRegistry, err := cachedRegistry(repository)
+	if err == nil {
+		return cachedRegistry, nil
+	}
+
+	var match1, match2, match3 *portainer.Registry
+
+	for _, registry := range registries {
+		if strings.Contains(repository, registry.URL) {
+			match2 = &registry
+		}
+
+		if registry.Type != portainer.DockerHubRegistry {
+			continue
+		}
+
+		// try to match repository examples:
+		//   <USERNAME>/nginx:latest
+		//   docker.io/<USERNAME>/nginx:latest
+		if strings.HasPrefix(repository, registry.Username+"/") || strings.HasPrefix(repository, registry.URL+"/"+registry.Username+"/") {
+			match1 = &registry
+		}
+
+		// try to match repository examples:
+		//   portainer/portainer-ee:latest
+		//   <NON-USERNAME>/portainer-ee:latest
+		if match3 == nil {
+			match3 = &registry
+		}
+	}
+
+	match := cmp.Or(match1, match2, match3)
+	if match == nil {
+		return nil, errors.New("no registries matched")
+	}
+
+	registriesCache.Set(repository, *match, 0)
+
+	return match, nil
+}
+
+func cachedRegistry(cacheKey string) (*portainer.Registry, error) {
+	r, ok := registriesCache.Get(cacheKey)
+	if ok {
+		registry, ok := r.(portainer.Registry)
+		if ok {
+			return &registry, nil
+		}
+	}
+
+	return nil, errors.Errorf("no registry found in cache: %s", cacheKey)
+}
diff --git a/api/docker/images/registry_test.go b/api/docker/images/registry_test.go
new file mode 100644
index 0000000..750e165
--- /dev/null
+++ b/api/docker/images/registry_test.go
@@ -0,0 +1,87 @@
+package images
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestFindBestMatchNeedAuthRegistry(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	t.Run("", func(t *testing.T) {
+		image := "USERNAME/nginx:latest"
+		registries := []portainer.Registry{createNewRegistry("docker.io", "USERNAME", false),
+			createNewRegistry("hub-mirror.c.163.com", "", false)}
+		r, err := findBestMatchRegistry(image, registries)
+		require.NoError(t, err)
+		is.NotNil(r)
+		is.False(r.Authentication)
+		is.Equal("docker.io", r.URL)
+	})
+
+	t.Run("", func(t *testing.T) {
+		image := "USERNAME/nginx:latest"
+		registries := []portainer.Registry{createNewRegistry("docker.io", "", false),
+			createNewRegistry("hub-mirror.c.163.com", "USERNAME", false)}
+		r, err := findBestMatchRegistry(image, registries)
+		require.NoError(t, err)
+		is.NotNil(r)
+		is.False(r.Authentication)
+		is.Equal("docker.io", r.URL)
+	})
+
+	t.Run("", func(t *testing.T) {
+		image := "docker.io/<USERNAME>/nginx:latest"
+		registries := []portainer.Registry{createNewRegistry("docker.io", "USERNAME", true),
+			createNewRegistry("hub-mirror.c.163.com", "", false)}
+		r, err := findBestMatchRegistry(image, registries)
+		require.NoError(t, err)
+		is.NotNil(r)
+		is.True(r.Authentication)
+		is.Equal("docker.io", r.URL)
+	})
+
+	t.Run("", func(t *testing.T) {
+		image := "portainer/portainer-ee:latest"
+		registries := []portainer.Registry{createNewRegistry("docker.io", "", true)}
+		r, err := findBestMatchRegistry(image, registries)
+		require.NoError(t, err)
+		is.NotNil(r)
+		is.True(r.Authentication)
+		is.Equal("docker.io", r.URL)
+	})
+}
+
+func TestFindBestMatchRegistryCachesResult(t *testing.T) {
+	t.Parallel()
+
+	repository := "caching-test/nginx:latest"
+	registries := []portainer.Registry{createNewRegistry("docker.io", "", true)}
+
+	r, err := findBestMatchRegistry(repository, registries)
+	require.NoError(t, err)
+
+	cached, err := cachedRegistry(repository)
+	require.NoError(t, err)
+	require.Equal(t, r.URL, cached.URL)
+	require.Equal(t, r.Authentication, cached.Authentication)
+}
+
+func createNewRegistry(domain, username string, auth bool) portainer.Registry {
+	registry := portainer.Registry{
+		URL:            domain,
+		Authentication: auth,
+		Username:       username,
+	}
+
+	if domain == "docker.io" {
+		registry.Type = portainer.DockerHubRegistry
+	}
+
+	return registry
+}
diff --git a/api/docker/images/status.go b/api/docker/images/status.go
new file mode 100644
index 0000000..09a0111
--- /dev/null
+++ b/api/docker/images/status.go
@@ -0,0 +1,307 @@
+package images
+
+import (
+	"context"
+	"slices"
+	"strings"
+	"time"
+
+	"github.com/docker/docker/api/types"
+	"github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/api/types/filters"
+	portainer "github.com/portainer/portainer/api"
+	consts "github.com/portainer/portainer/api/docker/consts"
+
+	"github.com/opencontainers/go-digest"
+	"github.com/patrickmn/go-cache"
+	"github.com/pkg/errors"
+	"github.com/rs/zerolog/log"
+	"golang.org/x/sync/errgroup"
+)
+
+// Status constants
+const (
+	Processing = Status("processing")
+	Outdated   = Status("outdated")
+	Updated    = Status("updated")
+	Skipped    = Status("skipped")
+	Preparing  = Status("preparing")
+	Error      = Status("error")
+)
+
+const (
+	errorStatusCacheTTL       = 5 * time.Minute
+	maxConcurrentStatusChecks = 8
+)
+
+var (
+	statusCache       = cache.New(24*time.Hour, 24*time.Hour)
+	remoteDigestCache = cache.New(5*time.Second, 5*time.Second)
+	swarmID2NameCache = cache.New(5*time.Second, 5*time.Second)
+)
+
+// Status holds Docker image  analysis
+type Status string
+
+func (c *DigestClient) ContainersImageStatus(ctx context.Context, containers []types.Container, endpoint *portainer.Endpoint) Status {
+	cli, err := c.clientFactory.CreateClient(endpoint, "", nil)
+	if err != nil {
+		log.Error().Err(err).Msg("cannot create docker client")
+
+		return Error
+	}
+
+	statuses := make([]Status, len(containers))
+
+	g, ctx := errgroup.WithContext(ctx)
+	g.SetLimit(maxConcurrentStatusChecks)
+
+	containerStatus := func(ct types.Container) Status {
+		var nodeName string
+		if swarmNodeId := ct.Labels[consts.SwarmNodeIDLabel]; swarmNodeId != "" {
+			if swarmNodeName, ok := swarmID2NameCache.Get(swarmNodeId); ok {
+				nodeName, _ = swarmNodeName.(string)
+			} else {
+				node, _, err := cli.NodeInspectWithRaw(ctx, swarmNodeId)
+				if err != nil {
+					return Error
+				}
+
+				nodeName = node.Description.Hostname
+				swarmID2NameCache.Set(swarmNodeId, nodeName, 0)
+			}
+		}
+
+		s, err := c.ContainerImageStatus(ctx, ct.ID, endpoint, nodeName)
+		if err != nil {
+			log.Warn().Str("containerId", ct.ID).Err(err).Msg("error when fetching image status for container")
+			return Error
+		}
+
+		return s
+	}
+
+	for i, ct := range containers {
+		g.Go(func() error {
+			statuses[i] = containerStatus(ct)
+			return nil
+		})
+	}
+
+	_ = g.Wait()
+
+	return AggregateImageStatus(statuses)
+}
+
+func AggregateImageStatus(statuses []Status) Status {
+	if allMatch(statuses, Skipped) {
+		return Skipped
+	}
+
+	if allMatch(statuses, Preparing) {
+		return Preparing
+	}
+
+	if slices.Contains(statuses, Outdated) {
+		return Outdated
+	} else if slices.Contains(statuses, Processing) {
+		return Processing
+	} else if slices.Contains(statuses, Error) {
+		return Error
+	}
+
+	return Updated
+}
+
+func (c *DigestClient) ContainerImageStatus(ctx context.Context, containerID string, endpoint *portainer.Endpoint, nodeName string) (Status, error) {
+	cli, err := c.clientFactory.CreateClient(endpoint, nodeName, nil)
+	if err != nil {
+		log.Warn().Str("swarmNodeId", nodeName).Msg("Cannot create new docker client.")
+	}
+
+	container, err := cli.ContainerInspect(ctx, containerID)
+	if err != nil {
+		log.Warn().Err(err).Str("containerID", containerID).Msg("Inspect container error.")
+		return Skipped, nil
+	}
+
+	var imageID string
+	if strings.Contains(container.Image, "sha256") {
+		imageID = container.Image[strings.Index(container.Image, "sha256"):]
+	}
+
+	if imageID == "" {
+		return Skipped, nil
+	}
+
+	digs := make([]digest.Digest, 0)
+	images := make([]*Image, 0)
+	if i, err := ParseImage(ParseImageOptions{Name: container.Config.Image}); err == nil {
+		images = append(images, &i)
+	}
+
+	imageInspect, _, err := cli.ImageInspectWithRaw(ctx, imageID)
+	if err != nil {
+		log.Debug().Str("imageID", imageID).Msg("inspect failed")
+		return Error, err
+	}
+
+	if len(imageInspect.RepoDigests) > 0 {
+		digs = append(digs, ParseRepoDigests(imageInspect.RepoDigests)...)
+	}
+
+	if len(imageInspect.RepoTags) > 0 {
+		images = append(images, ParseRepoTags(imageInspect.RepoTags)...)
+	}
+
+	s, err := c.checkStatus(ctx, images, digs)
+	if err != nil {
+		log.Debug().Str("image", container.Image).Err(err).Msg("fetching a certain image status")
+		return Error, err
+	}
+
+	statusCache.Set(imageID, s, 0)
+
+	return s, err
+}
+
+func (c *DigestClient) ServiceImageStatus(ctx context.Context, serviceID string, endpoint *portainer.Endpoint) (Status, error) {
+	cli, err := c.clientFactory.CreateClient(endpoint, "", nil)
+	if err != nil {
+		return Error, nil
+	}
+
+	containers, err := cli.ContainerList(ctx, container.ListOptions{
+		All:     true,
+		Filters: filters.NewArgs(filters.Arg("label", consts.SwarmServiceIDLabel+"="+serviceID)),
+	})
+	if err != nil {
+		log.Warn().Err(err).Str("serviceID", serviceID).Msg("cannot list container for the service")
+		return Error, err
+	}
+
+	nonExistedOrStoppedContainers := make([]types.Container, 0)
+	for _, container := range containers {
+		if container.State == "exited" || container.State == "stopped" {
+			continue
+		}
+
+		// When there is a container with the state "Created" under the service, it
+		// indicates that the Docker Swarm is replacing the existing task with
+		// a new task. At the moment, the state of the new task is "Created", and
+		// the state of the old task is "Running".
+		// Until the new task runs up, the image status should be set "Preparing"
+		if container.State == "created" {
+			return Preparing, nil
+		}
+		nonExistedOrStoppedContainers = append(nonExistedOrStoppedContainers, container)
+	}
+
+	if len(nonExistedOrStoppedContainers) == 0 {
+		return Preparing, nil
+	}
+
+	return c.ContainersImageStatus(ctx, nonExistedOrStoppedContainers, endpoint), nil
+}
+
+func (c *DigestClient) checkStatus(ctx context.Context, images []*Image, digests []digest.Digest) (Status, error) {
+	if digests == nil {
+		digests = make([]digest.Digest, 0)
+	}
+
+	for _, img := range images {
+		if img.Digest != "" && !slices.Contains(digests, img.Digest) {
+			log.Info().Str("localDigest", img.Domain).Msg("incoming local digest is not nil")
+			digests = append([]digest.Digest{img.Digest}, digests...)
+		}
+	}
+
+	if len(digests) == 0 {
+		return Skipped, nil
+	}
+
+	var imageStatus Status
+
+	for _, img := range images {
+		var remoteDigest digest.Digest
+		var err error
+		if rd, ok := remoteDigestCache.Get(img.FullName()); ok {
+			remoteDigest, _ = rd.(digest.Digest)
+		}
+		if remoteDigest == "" {
+			remoteDigest, err = c.RemoteDigest(ctx, *img)
+			if err != nil {
+				log.Error().Str("image", img.String()).Msg("error when fetch remote digest for image")
+				return Error, err
+			}
+		}
+		remoteDigestCache.Set(img.FullName(), remoteDigest, 0)
+
+		log.Debug().Str("image", img.FullName()).Stringer("remote_digest", remoteDigest).
+			Int("local_digest_size", len(digests)).
+			Msg("Digests")
+
+		// final locals vs remote one
+		for _, dig := range digests {
+			log.Debug().
+				Str("image", img.FullName()).
+				Stringer("remote_digest", remoteDigest).
+				Stringer("local_digest", dig).
+				Msg("Comparing")
+
+			if dig == remoteDigest {
+				log.Debug().Str("image", img.FullName()).
+					Stringer("remote_digest", remoteDigest).
+					Stringer("local_digest", dig).
+					Msg("Found a match")
+				return Updated, nil
+			}
+		}
+	}
+
+	imageStatus = Outdated
+
+	return imageStatus, nil
+}
+
+func CachedResourceImageStatus(resourceID string) (Status, error) {
+	if s, ok := statusCache.Get(resourceID); ok {
+		return s.(Status), nil
+	}
+
+	return "", errors.Errorf("no image found in cache: %s", resourceID)
+}
+
+func CacheResourceImageStatus(resourceID string, status Status) {
+	statusCache.Set(resourceID, status, 0)
+}
+
+func CacheErrorImageStatus(resourceID string) {
+	statusCache.Set(resourceID, Error, errorStatusCacheTTL)
+}
+
+func CachedImageDigest(resourceID string) (Status, error) {
+	if s, ok := statusCache.Get(resourceID); ok {
+		return s.(Status), nil
+	}
+
+	return "", errors.Errorf("no image found in cache: %s", resourceID)
+}
+
+func EvictImageStatus(resourceID string) {
+	statusCache.Delete(resourceID)
+}
+
+func allMatch(statuses []Status, status Status) bool {
+	if len(statuses) == 0 {
+		return false
+	}
+
+	for _, s := range statuses {
+		if s != status {
+			return false
+		}
+	}
+
+	return true
+}
diff --git a/api/docker/images/status_test.go b/api/docker/images/status_test.go
new file mode 100644
index 0000000..e7135c2
--- /dev/null
+++ b/api/docker/images/status_test.go
@@ -0,0 +1,63 @@
+package images
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestAggregateImageStatus(t *testing.T) {
+	t.Parallel()
+
+	f := func(statuses []Status, expected Status) {
+		t.Helper()
+		require.Equal(t, expected, AggregateImageStatus(statuses))
+	}
+
+	f([]Status{Skipped, Skipped, Skipped}, Skipped)
+	f([]Status{Preparing, Preparing}, Preparing)
+	f([]Status{Updated, Outdated, Processing, Error}, Outdated)
+	f([]Status{Updated, Processing, Error}, Processing)
+	f([]Status{Updated, Error}, Error)
+	f([]Status{Updated, Updated}, Updated)
+	f([]Status{}, Updated)
+	f([]Status{Updated, Skipped}, Updated)
+}
+
+func TestCachedResourceImageStatusMiss(t *testing.T) {
+	t.Parallel()
+
+	_, err := CachedResourceImageStatus("status-test-miss-key")
+	require.Error(t, err)
+}
+
+func TestCachedResourceImageStatusHitAndEvict(t *testing.T) {
+	t.Parallel()
+
+	key := "status-test-hit-evict-key"
+
+	CacheResourceImageStatus(key, Updated)
+
+	s, err := CachedResourceImageStatus(key)
+	require.NoError(t, err)
+	require.Equal(t, Updated, s)
+
+	EvictImageStatus(key)
+
+	_, err = CachedResourceImageStatus(key)
+	require.Error(t, err)
+}
+
+func TestCacheErrorImageStatus(t *testing.T) {
+	t.Parallel()
+
+	key := "status-test-error-key"
+
+	CacheErrorImageStatus(key)
+
+	s, err := CachedResourceImageStatus(key)
+	require.NoError(t, err)
+	require.Equal(t, Error, s)
+
+	EvictImageStatus(key)
+}
diff --git a/api/docker/snapshot.go b/api/docker/snapshot.go
new file mode 100644
index 0000000..c7cb804
--- /dev/null
+++ b/api/docker/snapshot.go
@@ -0,0 +1,31 @@
+package docker
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	dockerclient "github.com/portainer/portainer/api/docker/client"
+	"github.com/portainer/portainer/api/logs"
+	"github.com/portainer/portainer/pkg/snapshot"
+)
+
+// Snapshotter represents a service used to create environment(endpoint) snapshots
+type Snapshotter struct {
+	clientFactory *dockerclient.ClientFactory
+}
+
+// NewSnapshotter returns a new Snapshotter instance
+func NewSnapshotter(clientFactory *dockerclient.ClientFactory) *Snapshotter {
+	return &Snapshotter{
+		clientFactory: clientFactory,
+	}
+}
+
+// CreateSnapshot creates a snapshot of a specific Docker environment(endpoint)
+func (snapshotter *Snapshotter) CreateSnapshot(endpoint *portainer.Endpoint) (*portainer.DockerSnapshot, error) {
+	cli, err := snapshotter.clientFactory.CreateClient(endpoint, "", nil)
+	if err != nil {
+		return nil, err
+	}
+	defer logs.CloseAndLogErr(cli)
+
+	return snapshot.CreateDockerSnapshot(cli)
+}
diff --git a/api/docker/stats/container_stats.go b/api/docker/stats/container_stats.go
new file mode 100644
index 0000000..a3f98f6
--- /dev/null
+++ b/api/docker/stats/container_stats.go
@@ -0,0 +1,138 @@
+package stats
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"sync"
+
+	"github.com/containerd/containerd/errdefs"
+	"github.com/docker/docker/api/types/container"
+)
+
+type ContainerStats struct {
+	Running   int `json:"running"`
+	Stopped   int `json:"stopped"`
+	Healthy   int `json:"healthy"`
+	Unhealthy int `json:"unhealthy"`
+	Total     int `json:"total"`
+}
+
+type DockerClient interface {
+	ContainerInspect(ctx context.Context, containerID string) (container.InspectResponse, error)
+}
+
+func CalculateContainerStats(ctx context.Context, cli DockerClient, isSwarm bool, containers []container.Summary) (ContainerStats, error) {
+	if isSwarm {
+		return CalculateContainerStatsForSwarm(containers), nil
+	}
+
+	var running, stopped, healthy, unhealthy int
+
+	var mu sync.Mutex
+	var wg sync.WaitGroup
+	semaphore := make(chan struct{}, 5)
+
+	var aggErr error
+	var aggMu sync.Mutex
+
+	var processedCount int
+	for i := range containers {
+		id := containers[i].ID
+
+		semaphore <- struct{}{}
+		wg.Go(func() {
+			defer func() { <-semaphore }()
+
+			containerInspection, err := cli.ContainerInspect(ctx, id)
+			stat := ContainerStats{}
+			if err != nil {
+				if errdefs.IsNotFound(err) {
+					// An edge case is reported that Docker can list containers with no names,
+					// but when inspecting a container with specific ID and it is not found.
+					// In this case, we can safely ignore the error.
+					// ref@https://linear.app/portainer/issue/BE-12567/500-error-when-loading-docker-dashboard-in-portainer
+					return
+				}
+
+				aggMu.Lock()
+				aggErr = errors.Join(aggErr, err)
+				processedCount++
+				aggMu.Unlock()
+				return
+			}
+			stat = getContainerStatus(containerInspection.State)
+
+			mu.Lock()
+			running += stat.Running
+			stopped += stat.Stopped
+			healthy += stat.Healthy
+			unhealthy += stat.Unhealthy
+			processedCount++
+			mu.Unlock()
+		})
+	}
+
+	wg.Wait()
+
+	return ContainerStats{
+		Running:   running,
+		Stopped:   stopped,
+		Healthy:   healthy,
+		Unhealthy: unhealthy,
+		Total:     processedCount,
+	}, aggErr
+}
+
+func getContainerStatus(state *container.State) ContainerStats {
+	stat := ContainerStats{}
+	if state == nil {
+		return stat
+	}
+
+	switch state.Status {
+	case container.StateRunning:
+		stat.Running++
+	case container.StateExited, container.StateDead:
+		stat.Stopped++
+	}
+
+	if state.Health != nil {
+		switch state.Health.Status {
+		case container.Healthy:
+			stat.Healthy++
+		case container.Unhealthy:
+			stat.Unhealthy++
+		}
+	}
+
+	return stat
+}
+
+// This is a temporary workaround to calculate container stats for Swarm
+// TODO: Remove this once we have a proper way to calculate container stats for Swarm
+func CalculateContainerStatsForSwarm(containers []container.Summary) ContainerStats {
+	var running, stopped, healthy, unhealthy int
+	for _, container := range containers {
+		switch container.State {
+		case "running":
+			running++
+		case "exited", "stopped":
+			stopped++
+		}
+
+		if strings.Contains(container.Status, "(healthy)") {
+			healthy++
+		} else if strings.Contains(container.Status, "(unhealthy)") {
+			unhealthy++
+		}
+	}
+
+	return ContainerStats{
+		Running:   running,
+		Stopped:   stopped,
+		Healthy:   healthy,
+		Unhealthy: unhealthy,
+		Total:     len(containers),
+	}
+}
diff --git a/api/docker/stats/container_stats_test.go b/api/docker/stats/container_stats_test.go
new file mode 100644
index 0000000..1a034ed
--- /dev/null
+++ b/api/docker/stats/container_stats_test.go
@@ -0,0 +1,255 @@
+package stats
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/containerd/containerd/errdefs"
+	"github.com/docker/docker/api/types/container"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+)
+
+// MockDockerClient implements the DockerClient interface for testing
+type MockDockerClient struct {
+	mock.Mock
+}
+
+func (m *MockDockerClient) ContainerInspect(ctx context.Context, containerID string) (container.InspectResponse, error) {
+	args := m.Called(ctx, containerID)
+	return args.Get(0).(container.InspectResponse), args.Error(1)
+}
+
+func TestCalculateContainerStats(t *testing.T) {
+	t.Parallel()
+	mockClient := new(MockDockerClient)
+
+	// Test containers - using enough containers to test concurrent processing
+	containers := []container.Summary{
+		{ID: "container1"},
+		{ID: "container2"},
+		{ID: "container3"},
+		{ID: "container4"},
+		{ID: "container5"},
+		{ID: "container6"},
+		{ID: "container7"},
+		{ID: "container8"},
+		{ID: "container9"},
+		{ID: "container10"},
+		{ID: "container11"},
+	}
+
+	// Setup mock expectations with different container states to test various scenarios
+	containerStates := []struct {
+		id       string
+		status   string
+		health   *container.Health
+		expected ContainerStats
+	}{
+		{"container1", container.StateRunning, &container.Health{Status: container.Healthy}, ContainerStats{Running: 1, Stopped: 0, Healthy: 1, Unhealthy: 0}},
+		{"container2", container.StateRunning, &container.Health{Status: container.Unhealthy}, ContainerStats{Running: 1, Stopped: 0, Healthy: 0, Unhealthy: 1}},
+		{"container3", container.StateRunning, nil, ContainerStats{Running: 1, Stopped: 0, Healthy: 0, Unhealthy: 0}},
+		{"container4", container.StateExited, nil, ContainerStats{Running: 0, Stopped: 1, Healthy: 0, Unhealthy: 0}},
+		{"container5", container.StateDead, nil, ContainerStats{Running: 0, Stopped: 1, Healthy: 0, Unhealthy: 0}},
+		{"container6", container.StateRunning, &container.Health{Status: container.Healthy}, ContainerStats{Running: 1, Stopped: 0, Healthy: 1, Unhealthy: 0}},
+		{"container7", container.StateRunning, &container.Health{Status: container.Unhealthy}, ContainerStats{Running: 1, Stopped: 0, Healthy: 0, Unhealthy: 1}},
+		{"container8", container.StateExited, nil, ContainerStats{Running: 0, Stopped: 1, Healthy: 0, Unhealthy: 0}},
+		{"container9", container.StateRunning, nil, ContainerStats{Running: 1, Stopped: 0, Healthy: 0, Unhealthy: 0}},
+		{"container10", container.StateDead, nil, ContainerStats{Running: 0, Stopped: 1, Healthy: 0, Unhealthy: 0}},
+	}
+
+	// Setup mock expectations for all containers with artificial delays to simulate real Docker calls
+	for _, state := range containerStates {
+		mockClient.On("ContainerInspect", mock.Anything, state.id).Return(container.InspectResponse{
+			ContainerJSONBase: &container.ContainerJSONBase{
+				State: &container.State{
+					Status: state.status,
+					Health: state.health,
+				},
+			},
+		}, nil).After(30 * time.Millisecond) // Simulate 30ms Docker API call
+	}
+
+	// Setup mock expectation for a container that returns NotFound error
+	mockClient.On("ContainerInspect", mock.Anything, "container11").Return(container.InspectResponse{}, fmt.Errorf("No such container: %w", errdefs.ErrNotFound)).After(50 * time.Millisecond)
+
+	// Call the function and measure time
+	startTime := time.Now()
+	stats, err := CalculateContainerStats(t.Context(), mockClient, false, containers)
+	require.NoError(t, err, "failed to calculate container stats")
+	duration := time.Since(startTime)
+
+	// Assert results
+	assert.Equal(t, 6, stats.Running)
+	assert.Equal(t, 4, stats.Stopped)
+	assert.Equal(t, 2, stats.Healthy)
+	assert.Equal(t, 2, stats.Unhealthy)
+	assert.Equal(t, 10, stats.Total)
+
+	// Verify concurrent processing by checking that all mock calls were made
+	mockClient.AssertExpectations(t)
+
+	// Test concurrency: With 5 workers and 10 containers taking 50ms each:
+	// Sequential would take: 10 * 50ms = 500ms
+	sequentialTime := 10 * 50 * time.Millisecond
+
+	// Verify that concurrent processing is actually faster than sequential
+	// Allow some overhead for goroutine scheduling
+	assert.Less(t, duration, sequentialTime, "Concurrent processing should be faster than sequential")
+	// Concurrent should take: ~100-150ms (depending on scheduling)
+	assert.Less(t, duration, 150*time.Millisecond, "Concurrent processing should be significantly faster")
+	assert.Greater(t, duration, 100*time.Millisecond, "Concurrent processing should be longer than 100ms")
+}
+
+func TestCalculateContainerStatsAllErrors(t *testing.T) {
+	t.Parallel()
+	mockClient := new(MockDockerClient)
+
+	// Test containers
+	containers := []container.Summary{
+		{ID: "container1"},
+		{ID: "container2"},
+	}
+
+	// Setup mock expectations with all calls returning errors
+	mockClient.On("ContainerInspect", mock.Anything, "container1").Return(container.InspectResponse{}, errors.New("network error"))
+	mockClient.On("ContainerInspect", mock.Anything, "container2").Return(container.InspectResponse{}, errors.New("permission denied"))
+
+	// Call the function
+	stats, err := CalculateContainerStats(t.Context(), mockClient, false, containers)
+
+	// Assert that an error was returned
+	require.Error(t, err, "should return error when all containers fail to inspect")
+	assert.Contains(t, err.Error(), "network error", "error should contain one of the original error messages")
+	assert.Contains(t, err.Error(), "permission denied", "error should contain the other original error message")
+
+	// Assert that stats are zero since no containers were successfully processed
+	expectedStats := ContainerStats{
+		Running:   0,
+		Stopped:   0,
+		Healthy:   0,
+		Unhealthy: 0,
+		Total:     2, // total containers processed
+	}
+	assert.Equal(t, expectedStats, stats)
+
+	// Verify all mock calls were made
+	mockClient.AssertExpectations(t)
+}
+
+func TestGetContainerStatus(t *testing.T) {
+	t.Parallel()
+	testCases := []struct {
+		name     string
+		state    *container.State
+		expected ContainerStats
+	}{
+		{
+			name: "running healthy container",
+			state: &container.State{
+				Status: container.StateRunning,
+				Health: &container.Health{
+					Status: container.Healthy,
+				},
+			},
+			expected: ContainerStats{
+				Running:   1,
+				Stopped:   0,
+				Healthy:   1,
+				Unhealthy: 0,
+			},
+		},
+		{
+			name: "running unhealthy container",
+			state: &container.State{
+				Status: container.StateRunning,
+				Health: &container.Health{
+					Status: container.Unhealthy,
+				},
+			},
+			expected: ContainerStats{
+				Running:   1,
+				Stopped:   0,
+				Healthy:   0,
+				Unhealthy: 1,
+			},
+		},
+		{
+			name: "running container without health check",
+			state: &container.State{
+				Status: container.StateRunning,
+			},
+			expected: ContainerStats{
+				Running:   1,
+				Stopped:   0,
+				Healthy:   0,
+				Unhealthy: 0,
+			},
+		},
+		{
+			name: "exited container",
+			state: &container.State{
+				Status: container.StateExited,
+			},
+			expected: ContainerStats{
+				Running:   0,
+				Stopped:   1,
+				Healthy:   0,
+				Unhealthy: 0,
+			},
+		},
+		{
+			name: "dead container",
+			state: &container.State{
+				Status: container.StateDead,
+			},
+			expected: ContainerStats{
+				Running:   0,
+				Stopped:   1,
+				Healthy:   0,
+				Unhealthy: 0,
+			},
+		},
+		{
+			name:  "nil state",
+			state: nil,
+			expected: ContainerStats{
+				Running:   0,
+				Stopped:   0,
+				Healthy:   0,
+				Unhealthy: 0,
+			},
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			stat := getContainerStatus(testCase.state)
+			assert.Equal(t, testCase.expected, stat)
+		})
+	}
+}
+
+func TestCalculateContainerStatsForSwarm(t *testing.T) {
+	t.Parallel()
+	containers := []container.Summary{
+		{State: "running"},
+		{State: "running", Status: "Up 5 minutes (healthy)"},
+		{State: "exited"},
+		{State: "stopped"},
+		{State: "running", Status: "Up 10 minutes"},
+		{State: "running", Status: "Up about an hour (unhealthy)"},
+	}
+
+	stats := CalculateContainerStatsForSwarm(containers)
+
+	assert.Equal(t, 4, stats.Running)
+	assert.Equal(t, 2, stats.Stopped)
+	assert.Equal(t, 1, stats.Healthy)
+	assert.Equal(t, 1, stats.Unhealthy)
+	assert.Equal(t, 6, stats.Total)
+}
diff --git a/api/docs/openapi.yaml b/api/docs/openapi.yaml
new file mode 100644
index 0000000..3f96b56
--- /dev/null
+++ b/api/docs/openapi.yaml
@@ -0,0 +1,21461 @@
+openapi: 3.0.0
+info:
+  contact:
+    email: info@portainer.io
+  description: >
+    The Portainer API is an HTTP API served by Portainer. It is used by the
+    Portainer UI, and anything you can do in the UI can also be done via the
+    HTTP API.
+
+
+    API examples are available in the [Portainer documentation](https://documentation.portainer.io/api/api-examples/)
+
+
+    You can find out more about Portainer [on our website](http://portainer.io) and get some support on [Slack](http://portainer.io/slack/).
+
+
+    # Authentication
+
+
+    Most of the API endpoints require authentication, as well as some level of authorization.
+
+    Portainer uses JSON Web Tokens to manage authentication. You must provide a token in the **Authorization** header of each request using the **Bearer** scheme.
+
+
+    Example:
+
+
+    ```
+
+    Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6MSwidXNlcm5hbWUiOiJhZG1pbiIsInJvbGUiOjEsImV4cCI6MTQ5OTM3NjE1NH0.NJ6vE8FY1WG6jsRQzfMqeatJ4vh2TWAeeYfDhP71YEE
+
+    ```
+
+
+    # Security
+
+
+    Each API endpoint has an associated access policy, documented in its description.
+
+
+    The following policies are available:
+
+
+    - Public access
+
+    - Authenticated access
+
+    - Restricted access
+
+    - Administrator access
+
+
+    ### Public access
+
+
+    No authentication is required.
+
+
+    ### Authenticated access
+
+
+    Authentication is required.
+
+
+    ### Restricted access
+
+
+    Authentication is required. Additional checks may apply to verify access to the resource, and returned data may be filtered.
+
+
+    ### Administrator access
+
+
+    Authentication and an administrator role are both required.
+
+
+    # Execute Docker requests
+
+
+    Portainer does not expose dedicated endpoints for managing Docker resources (create a container, remove a volume, etc).
+
+
+    Instead, it acts as a reverse-proxy to the Docker HTTP API, allowing you to execute Docker requests via the Portainer HTTP API.
+
+
+    To do so, use the `/endpoints/{id}/docker` endpoint. Note that this endpoint is not documented below due to Swagger limitations. It has a restricted access policy, so authentication is still required. Any request made to this endpoint is proxied to the Docker API of the associated environment - request and response objects are identical to those in the [Docker official documentation](https://docs.docker.com/engine/api).
+
+
+    # Private Registry
+
+
+    When using a private registry, include a Base64-encoded JSON string in the request header. The header parameter name is `X-Registry-Auth` and the value should encode the following structure: ‘{"registryId":\<registryId\>}’ where `<registryId>` is the ID of the registry where the repository was created.
+
+
+    Example encoded value:
+
+
+    ```
+
+    eyJyZWdpc3RyeUlkIjoxfQ==
+
+    ```
+  license:
+    name: zlib
+    url: https://github.com/portainer/portainer/blob/develop/LICENSE
+  title: PortainerCE API
+  version: 2.43.0
+paths:
+  /auth:
+    post:
+      description: >-
+        **Access policy**: public
+
+        Use this environment(endpoint) to authenticate against Portainer using a username and password.
+      operationId: AuthenticateUser
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/auth.authenticatePayload"
+        description: Credentials used for authentication
+        required: true
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/auth.authenticateResponse"
+        "400":
+          description: Invalid request
+        "422":
+          description: Invalid Credentials
+        "500":
+          description: Server error
+      summary: Authenticate
+      tags:
+        - auth
+  /auth/logout:
+    post:
+      description: "**Access policy**: public"
+      operationId: Logout
+      responses:
+        "204":
+          description: Success
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Logout
+      tags:
+        - auth
+  /auth/oauth/validate:
+    post:
+      description: "**Access policy**: public"
+      operationId: ValidateOAuth
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/auth.oauthPayload"
+        description: OAuth Credentials used for authentication
+        required: true
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/auth.authenticateResponse"
+        "400":
+          description: Invalid request
+        "422":
+          description: Invalid Credentials
+        "500":
+          description: Server error
+      summary: Authenticate with OAuth
+      tags:
+        - auth
+  /backup:
+    post:
+      description: >-
+        Creates an archive with a system data snapshot that could be used to
+        restore the system.
+
+        **Access policy**: admin
+      operationId: Backup
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/backup.backupPayload"
+        description: An object contains the password to encrypt the backup with
+      responses:
+        "200":
+          description: Success
+        "400":
+          description: Invalid request
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Creates an archive with a system data snapshot that could be used to
+        restore the system.
+      tags:
+        - backup
+  /custom_templates:
+    get:
+      description: |-
+        List available custom templates.
+        **Access policy**: authenticated
+      operationId: CustomTemplateList
+      parameters:
+        - description: Template types
+          in: query
+          name: type
+          required: true
+          style: form
+          explode: false
+          schema:
+            type: array
+            items:
+              enum:
+                - 1
+                - 2
+                - 3
+              type: integer
+        - description: Filter by edge templates
+          in: query
+          name: edge
+          schema:
+            type: boolean
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/portainer.CustomTemplate"
+                type: array
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: List available custom templates
+      tags:
+        - custom_templates
+  "/custom_templates/{id}":
+    delete:
+      description: |-
+        Remove a template.
+        **Access policy**: authenticated
+      operationId: CustomTemplateDelete
+      parameters:
+        - description: Template identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "403":
+          description: Access denied to resource
+        "404":
+          description: Template not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Remove a template
+      tags:
+        - custom_templates
+    get:
+      description: |-
+        Retrieve details about a template.
+        **Access policy**: authenticated
+      operationId: CustomTemplateInspect
+      parameters:
+        - description: Template identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.CustomTemplate"
+        "400":
+          description: Invalid request
+        "404":
+          description: Template not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Inspect a custom template
+      tags:
+        - custom_templates
+    put:
+      description: |-
+        Update a template.
+        **Access policy**: authenticated
+      operationId: CustomTemplateUpdate
+      parameters:
+        - description: Template identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/customtemplates.customTemplateUpdatePayload"
+        description: Template details
+        required: true
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.CustomTemplate"
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied to access template
+        "404":
+          description: Template not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Update a template
+      tags:
+        - custom_templates
+  "/custom_templates/{id}/file":
+    get:
+      description: |-
+        Retrieve the content of the Stack file for the specified custom template
+        **Access policy**: authenticated
+      operationId: CustomTemplateFile
+      parameters:
+        - description: Template identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/customtemplates.fileResponse"
+        "400":
+          description: Invalid request
+        "404":
+          description: Custom template not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Get Template stack file content.
+      tags:
+        - custom_templates
+  "/custom_templates/{id}/git_fetch":
+    put:
+      description: |-
+        Retrieve details about a template created from git repository method.
+        **Access policy**: authenticated
+      operationId: CustomTemplateGitFetch
+      parameters:
+        - description: Template identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/customtemplates.fileResponse"
+        "400":
+          description: Invalid request
+        "404":
+          description: Custom template not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Fetch the latest config file content based on custom template's git
+        repository configuration
+      tags:
+        - custom_templates
+  /custom_templates/create/file:
+    post:
+      description: |-
+        Create a custom template.
+        **Access policy**: authenticated
+      operationId: CustomTemplateCreateFile
+      requestBody:
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              properties:
+                Title:
+                  description: Title of the template
+                  type: string
+                Description:
+                  description: Description of the template
+                  type: string
+                Note:
+                  description: A note that will be displayed in the UI. Supports HTML content
+                  type: string
+                Platform:
+                  description: Platform associated to the template (1 - 'linux', 2 - 'windows')
+                  type: integer
+                  enum:
+                    - 1
+                    - 2
+                Type:
+                  description: Type of created stack (1 - swarm, 2 - compose, 3 - kubernetes)
+                  type: integer
+                  enum:
+                    - 1
+                    - 2
+                    - 3
+                File:
+                  description: File
+                  type: string
+                  format: binary
+                Logo:
+                  description: URL of the template's logo
+                  type: string
+                Variables:
+                  description: A json array of variables definitions
+                  type: string
+              required:
+                - Title
+                - Description
+                - Note
+                - Platform
+                - Type
+                - File
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.CustomTemplate"
+        "400":
+          description: Invalid request
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Create a custom template
+      tags:
+        - custom_templates
+  /custom_templates/create/repository:
+    post:
+      description: |-
+        Create a custom template.
+        **Access policy**: authenticated
+      operationId: CustomTemplateCreateRepository
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/customtemplates.customTemplateFromGitRepositoryPayl\
+                oad"
+        description: Required when using method=repository
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.CustomTemplate"
+        "400":
+          description: Invalid request
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Create a custom template
+      tags:
+        - custom_templates
+  /custom_templates/create/string:
+    post:
+      description: |-
+        Create a custom template.
+        **Access policy**: authenticated
+      operationId: CustomTemplateCreateString
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/customtemplates.customTemplateFromFileContentPayloa\
+                d"
+        description: body
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.CustomTemplate"
+        "400":
+          description: Invalid request
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Create a custom template
+      tags:
+        - custom_templates
+  "/docker/{environmentId}/containers/{containerId}/gpus":
+    get:
+      description: "**Access policy**:"
+      operationId: dockerContainerGpusInspect
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: environmentId
+          required: true
+          schema:
+            type: integer
+        - description: Container identifier
+          in: path
+          name: containerId
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/containers.containerGpusResponse"
+        "400":
+          description: Bad request
+        "404":
+          description: Environment or container not found
+        "500":
+          description: Internal server error
+      security:
+        - jwt: []
+      summary: Fetch container gpus data
+      tags:
+        - docker
+  "/docker/{environmentId}/dashboard":
+    get:
+      description: "**Access policy**: restricted"
+      operationId: dockerDashboard
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: environmentId
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/docker.dashboardResponse"
+        "400":
+          description: Bad request
+        "500":
+          description: Internal server error
+      security:
+        - jwt: []
+      summary: Get counters for the dashboard
+      tags:
+        - docker
+  "/docker/{environmentId}/images":
+    get:
+      description: "**Access policy**:"
+      operationId: dockerImagesList
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: environmentId
+          required: true
+          schema:
+            type: integer
+        - description: Include image usage information
+          in: query
+          name: withUsage
+          schema:
+            type: boolean
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/images.ImageResponse"
+                type: array
+        "400":
+          description: Bad request
+        "500":
+          description: Internal server error
+      security:
+        - jwt: []
+      summary: Fetch images
+      tags:
+        - docker
+  /edge_groups:
+    get:
+      description: "**Access policy**: administrator"
+      operationId: EdgeGroupList
+      responses:
+        "200":
+          description: EdgeGroups
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/edgegroups.decoratedEdgeGroup"
+                type: array
+        "500":
+          description: Internal Server Error
+        "503":
+          description: Edge compute features are disabled
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: list EdgeGroups
+      tags:
+        - edge_groups
+    post:
+      description: "**Access policy**: administrator"
+      operationId: EdgeGroupCreate
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/edgegroups.edgeGroupCreatePayload"
+        description: EdgeGroup data
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.EdgeGroup"
+        "500":
+          description: Internal Server Error
+        "503":
+          description: Edge compute features are disabled
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Create an EdgeGroup
+      tags:
+        - edge_groups
+  "/edge_groups/{id}":
+    delete:
+      description: "**Access policy**: administrator"
+      operationId: EdgeGroupDelete
+      parameters:
+        - description: EdgeGroup Id
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "204":
+          description: No Content
+        "409":
+          description: Edge group is in use by an Edge stack or Edge job
+        "500":
+          description: Server error
+        "503":
+          description: Edge compute features are disabled
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Deletes an EdgeGroup
+      tags:
+        - edge_groups
+    get:
+      description: "**Access policy**: administrator"
+      operationId: EdgeGroupInspect
+      parameters:
+        - description: EdgeGroup Id
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.EdgeGroup"
+        "500":
+          description: Internal Server Error
+        "503":
+          description: Edge compute features are disabled
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Inspects an EdgeGroup
+      tags:
+        - edge_groups
+    put:
+      description: "**Access policy**: administrator"
+      operationId: EdgeGroupUpdate
+      parameters:
+        - description: EdgeGroup Id
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/edgegroups.edgeGroupUpdatePayload"
+        description: EdgeGroup data
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.EdgeGroup"
+        "500":
+          description: Internal Server Error
+        "503":
+          description: Edge compute features are disabled
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Updates an EdgeGroup
+      tags:
+        - edge_groups
+  /edge_jobs:
+    get:
+      description: "**Access policy**: administrator"
+      operationId: EdgeJobList
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/portainer.EdgeJob"
+                type: array
+        "400":
+          description: Bad Request
+        "500":
+          description: Internal Server Error
+        "503":
+          description: Edge compute features are disabled
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Fetch EdgeJobs list
+      tags:
+        - edge_jobs
+  "/edge_jobs/{id}":
+    delete:
+      description: "**Access policy**: administrator"
+      operationId: EdgeJobDelete
+      parameters:
+        - description: EdgeJob Id
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "204":
+          description: No Content
+        "400":
+          description: Bad Request
+        "500":
+          description: Internal Server Error
+        "503":
+          description: Edge compute features are disabled
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Delete an EdgeJob
+      tags:
+        - edge_jobs
+    get:
+      description: "**Access policy**: administrator"
+      operationId: EdgeJobInspect
+      parameters:
+        - description: EdgeJob Id
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.EdgeJob"
+        "400":
+          description: Bad Request
+        "500":
+          description: Internal Server Error
+        "503":
+          description: Edge compute features are disabled
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Inspect an EdgeJob
+      tags:
+        - edge_jobs
+    put:
+      description: "**Access policy**: administrator"
+      operationId: EdgeJobUpdate
+      parameters:
+        - description: EdgeJob Id
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/edgejobs.edgeJobUpdatePayload"
+        description: EdgeGroup data
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.EdgeJob"
+        "400":
+          description: Bad Request
+        "500":
+          description: Internal Server Error
+        "503":
+          description: Edge compute features are disabled
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Update an EdgeJob
+      tags:
+        - edge_jobs
+  "/edge_jobs/{id}/file":
+    get:
+      description: "**Access policy**: administrator"
+      operationId: EdgeJobFile
+      parameters:
+        - description: EdgeJob Id
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/edgejobs.edgeJobFileResponse"
+        "400":
+          description: Bad Request
+        "500":
+          description: Internal Server Error
+        "503":
+          description: Edge compute features are disabled
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Fetch a file of an EdgeJob
+      tags:
+        - edge_jobs
+  "/edge_jobs/{id}/tasks":
+    get:
+      description: "**Access policy**: administrator"
+      operationId: EdgeJobTasksList
+      parameters:
+        - description: EdgeJob Id
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/edgejobs.taskContainer"
+                type: array
+        "400":
+          description: Bad Request
+        "500":
+          description: Internal Server Error
+        "503":
+          description: Edge compute features are disabled
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Fetch the list of tasks on an EdgeJob
+      tags:
+        - edge_jobs
+  "/edge_jobs/{id}/tasks/{taskID}/logs":
+    delete:
+      description: "**Access policy**: administrator"
+      operationId: EdgeJobTasksClear
+      parameters:
+        - description: EdgeJob Id
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Task Id
+          in: path
+          name: taskID
+          required: true
+          schema:
+            type: integer
+      responses:
+        "204":
+          description: No Content
+        "400":
+          description: Bad Request
+        "500":
+          description: Internal Server Error
+        "503":
+          description: Edge compute features are disabled
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Clear the log for a specifc task on an EdgeJob
+      tags:
+        - edge_jobs
+    get:
+      description: "**Access policy**: administrator"
+      operationId: EdgeJobTaskLogsInspect
+      parameters:
+        - description: EdgeJob Id
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Task Id
+          in: path
+          name: taskID
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/edgejobs.fileResponse"
+        "400":
+          description: Bad Request
+        "500":
+          description: Internal Server Error
+        "503":
+          description: Edge compute features are disabled
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Fetch the log for a specifc task on an EdgeJob
+      tags:
+        - edge_jobs
+    post:
+      description: "**Access policy**: administrator"
+      operationId: EdgeJobTasksCollect
+      parameters:
+        - description: EdgeJob Id
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Task Id
+          in: path
+          name: taskID
+          required: true
+          schema:
+            type: integer
+      responses:
+        "204":
+          description: No Content
+        "400":
+          description: Bad Request
+        "500":
+          description: Internal Server Error
+        "503":
+          description: Edge compute features are disabled
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Collect the log for a specifc task on an EdgeJob
+      tags:
+        - edge_jobs
+  /edge_jobs/create/file:
+    post:
+      description: "**Access policy**: administrator"
+      operationId: EdgeJobCreateFile
+      requestBody:
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              properties:
+                file:
+                  description: Content of the Stack file
+                  type: string
+                  format: binary
+                Name:
+                  description: Name of the stack
+                  type: string
+                CronExpression:
+                  description: A cron expression to schedule this job
+                  type: string
+                EdgeGroups:
+                  description: JSON stringified array of Edge Groups ids
+                  type: string
+                Endpoints:
+                  description: JSON stringified array of Environment ids
+                  type: string
+                Recurring:
+                  description: If recurring
+                  type: boolean
+              required:
+                - file
+                - Name
+                - CronExpression
+                - EdgeGroups
+                - Endpoints
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.EdgeGroup"
+        "500":
+          description: Internal Server Error
+        "503":
+          description: Edge compute features are disabled
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Create an EdgeJob from a file
+      tags:
+        - edge_jobs
+  /edge_jobs/create/string:
+    post:
+      description: "**Access policy**: administrator"
+      operationId: EdgeJobCreateString
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/edgejobs.edgeJobCreateFromFileContentPayload"
+        description: EdgeGroup data when method is string
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.EdgeGroup"
+        "500":
+          description: Internal Server Error
+        "503":
+          description: Edge compute features are disabled
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Create an EdgeJob from a text
+      tags:
+        - edge_jobs
+  /edge_stacks:
+    get:
+      description: "**Access policy**: administrator"
+      operationId: EdgeStackList
+      parameters:
+        - description: will summarize the statuses
+          in: query
+          name: summarizeStatuses
+          schema:
+            type: boolean
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/portainer.EdgeStack"
+                type: array
+        "400":
+          description: Bad Request
+        "500":
+          description: Internal Server Error
+        "503":
+          description: Edge compute features are disabled
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Fetches the list of EdgeStacks
+      tags:
+        - edge_stacks
+  "/edge_stacks/{id}":
+    delete:
+      description: "**Access policy**: administrator"
+      operationId: EdgeStackDelete
+      parameters:
+        - description: EdgeStack Id
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "204":
+          description: No Content
+        "400":
+          description: Bad Request
+        "500":
+          description: Internal Server Error
+        "503":
+          description: Edge compute features are disabled
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Delete an EdgeStack
+      tags:
+        - edge_stacks
+    get:
+      description: "**Access policy**: administrator"
+      operationId: EdgeStackInspect
+      parameters:
+        - description: EdgeStack Id
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.EdgeStack"
+        "400":
+          description: Bad Request
+        "500":
+          description: Internal Server Error
+        "503":
+          description: Edge compute features are disabled
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Inspect an EdgeStack
+      tags:
+        - edge_stacks
+    put:
+      description: "**Access policy**: administrator"
+      operationId: EdgeStackUpdate
+      parameters:
+        - description: EdgeStack Id
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/edgestacks.updateEdgeStackPayload"
+        description: EdgeStack data
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.EdgeStack"
+        "400":
+          description: Bad Request
+        "500":
+          description: Internal Server Error
+        "503":
+          description: Edge compute features are disabled
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Update an EdgeStack
+      tags:
+        - edge_stacks
+  "/edge_stacks/{id}/file":
+    get:
+      description: "**Access policy**: administrator"
+      operationId: EdgeStackFile
+      parameters:
+        - description: EdgeStack Id
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/edgestacks.stackFileResponse"
+        "400":
+          description: Bad Request
+        "500":
+          description: Internal Server Error
+        "503":
+          description: Edge compute features are disabled
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Fetches the stack file for an EdgeStack
+      tags:
+        - edge_stacks
+  "/edge_stacks/{id}/status":
+    put:
+      description: Authorized only if the request is done by an Edge Environment(Endpoint)
+      operationId: EdgeStackStatusUpdate
+      parameters:
+        - description: EdgeStack Id
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/edgestacks.updateStatusPayload"
+        description: EdgeStack status payload
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.EdgeStack"
+        "400":
+          description: Bad Request
+        "403":
+          description: Forbidden
+        "404":
+          description: Not Found
+        "500":
+          description: Internal Server Error
+      summary: Update an EdgeStack status
+      tags:
+        - edge_stacks
+  /edge_stacks/create/file:
+    post:
+      description: "**Access policy**: administrator"
+      operationId: EdgeStackCreateFile
+      parameters:
+        - description: if true, will not create an edge stack, but just will check the
+            settings and return a non-persisted edge stack object
+          in: query
+          name: dryrun
+          schema:
+            type: string
+      requestBody:
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              properties:
+                Name:
+                  description: Name of the stack. it must only consist of lowercase alphanumeric
+                    characters, hyphens, or underscores as well as start with a
+                    letter or number
+                  type: string
+                file:
+                  description: Content of the Stack file
+                  type: string
+                  format: binary
+                EdgeGroups:
+                  description: JSON stringified array of Edge Groups ids
+                  type: string
+                DeploymentType:
+                  description: deploy type 0 - 'compose', 1 - 'kubernetes'
+                  type: integer
+                Registries:
+                  description: JSON stringified array of Registry ids to use for this stack
+                  type: string
+                UseManifestNamespaces:
+                  description: Uses the manifest's namespaces instead of the default one, relevant
+                    only for kube environments
+                  type: boolean
+                PrePullImage:
+                  description: Pre Pull image
+                  type: boolean
+                RetryDeploy:
+                  description: Retry deploy
+                  type: boolean
+              required:
+                - Name
+                - file
+                - EdgeGroups
+                - DeploymentType
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.EdgeStack"
+        "400":
+          description: Bad request
+        "500":
+          description: Internal server error
+        "503":
+          description: Edge compute features are disabled
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Create an EdgeStack from file
+      tags:
+        - edge_stacks
+  /edge_stacks/create/repository:
+    post:
+      description: "**Access policy**: administrator"
+      operationId: EdgeStackCreateRepository
+      parameters:
+        - description: if true, will not create an edge stack, but just will check the
+            settings and return a non-persisted edge stack object
+          in: query
+          name: dryrun
+          schema:
+            type: string
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/edgestacks.edgeStackFromGitRepositoryPayload"
+        description: stack config
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.EdgeStack"
+        "400":
+          description: Bad request
+        "500":
+          description: Internal server error
+        "503":
+          description: Edge compute features are disabled
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Create an EdgeStack from a git repository
+      tags:
+        - edge_stacks
+  /edge_stacks/create/string:
+    post:
+      description: "**Access policy**: administrator"
+      operationId: EdgeStackCreateString
+      parameters:
+        - description: if true, will not create an edge stack, but just will check the
+            settings and return a non-persisted edge stack object
+          in: query
+          name: dryrun
+          schema:
+            type: string
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/edgestacks.edgeStackFromStringPayload"
+        description: stack config
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.EdgeStack"
+        "400":
+          description: Bad request
+        "500":
+          description: Internal server error
+        "503":
+          description: Edge compute features are disabled
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Create an EdgeStack from a text
+      tags:
+        - edge_stacks
+  /endpoint_groups:
+    get:
+      description: >-
+        List all environment(endpoint) groups based on the current user
+        authorizations. Will
+
+        return all environment(endpoint) groups if using an administrator account otherwise it will
+
+        only return authorized environment(endpoint) groups.
+
+        **Access policy**: restricted
+      operationId: EndpointGroupList
+      parameters:
+        - description: If true, each environment(endpoint) group will include the number
+            of environments(endpoints) associated to it and breakdown by type
+          in: query
+          name: size
+          schema:
+            type: boolean
+      responses:
+        "200":
+          description: Environment(Endpoint) group
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/endpointgroups.EndpointGroupResponse"
+                type: array
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: List Environment(Endpoint) groups
+      tags:
+        - endpoint_groups
+    post:
+      description: |-
+        Create a new environment(endpoint) group.
+        **Access policy**: administrator
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/endpointgroups.endpointGroupCreatePayload"
+        description: Environment(Endpoint) Group details
+        required: true
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.EndpointGroup"
+        "400":
+          description: Invalid request
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Create an Environment(Endpoint) Group
+      tags:
+        - endpoint_groups
+  "/endpoint_groups/{id}":
+    delete:
+      description: |-
+        Remove an environment(endpoint) group.
+        **Access policy**: administrator
+      operationId: EndpointGroupDelete
+      parameters:
+        - description: EndpointGroup identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "404":
+          description: EndpointGroup not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Remove an environment(endpoint) group
+      tags:
+        - endpoint_groups
+    get:
+      description: |-
+        Retrieve details abont an environment(endpoint) group.
+        **Access policy**: administrator
+      parameters:
+        - description: Environment(Endpoint) group identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: If true, include the number of environments and breakdown by type
+          in: query
+          name: size
+          schema:
+            type: boolean
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/endpointgroups.EndpointGroupResponse"
+        "400":
+          description: Invalid request
+        "404":
+          description: EndpointGroup not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Inspect an Environment(Endpoint) group
+      tags:
+        - endpoint_groups
+    put:
+      description: |-
+        Update an environment(endpoint) group.
+        **Access policy**: administrator
+      operationId: EndpointGroupUpdate
+      parameters:
+        - description: EndpointGroup identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/endpointgroups.endpointGroupUpdatePayload"
+        description: EndpointGroup details
+        required: true
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.EndpointGroup"
+        "400":
+          description: Invalid request
+        "404":
+          description: EndpointGroup not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Update an environment(endpoint) group
+      tags:
+        - endpoint_groups
+  "/endpoint_groups/{id}/endpoints/{endpointId}":
+    delete:
+      description: "**Access policy**: administrator"
+      operationId: EndpointGroupDeleteEndpoint
+      parameters:
+        - description: EndpointGroup identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Environment(Endpoint) identifier
+          in: path
+          name: endpointId
+          required: true
+          schema:
+            type: integer
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "404":
+          description: EndpointGroup not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Removes environment(endpoint) from an environment(endpoint) group
+      tags:
+        - endpoint_groups
+    put:
+      description: |-
+        Add an environment(endpoint) to an environment(endpoint) group
+        **Access policy**: administrator
+      operationId: EndpointGroupAddEndpoint
+      parameters:
+        - description: EndpointGroup identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Environment(Endpoint) identifier
+          in: path
+          name: endpointId
+          required: true
+          schema:
+            type: integer
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "404":
+          description: EndpointGroup not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Add an environment(endpoint) to an environment(endpoint) group
+      tags:
+        - endpoint_groups
+  /endpoints:
+    delete:
+      deprecated: true
+      description: >-
+        Deprecated: use the `POST` endpoint instead.
+
+        Remove multiple environments and optionally clean-up associated resources.
+
+        **Access policy**: Administrator only.
+      operationId: EndpointDeleteBatchDeprecated
+      requestBody:
+        $ref: "#/components/requestBodies/endpoints.endpointDeleteBatchPayload"
+      responses:
+        "204":
+          description: Environment(s) successfully deleted.
+        "207":
+          description: Partial success. Some environments were deleted successfully, while
+            others failed.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/endpoints.endpointDeleteBatchPartialResponse"
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "403":
+          description: Unauthorized access or operation not allowed.
+        "500":
+          description: Server error occurred while attempting to delete the specified
+            environments.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Remove multiple environments
+      tags:
+        - endpoints
+    get:
+      description: >-
+        List all environments(endpoints) based on the current user
+        authorizations. Will
+
+        return all environments(endpoints) if using an administrator or team leader account otherwise it will
+
+        only return authorized environments(endpoints).
+
+        **Access policy**: restricted
+      operationId: EndpointList
+      parameters:
+        - description: Start searching from
+          in: query
+          name: start
+          schema:
+            type: integer
+        - description: Limit results to this value
+          in: query
+          name: limit
+          schema:
+            type: integer
+        - description: Sort results by this value
+          in: query
+          name: sort
+          schema:
+            type: string
+            enum:
+              - Name
+              - Group
+              - Status
+              - LastCheckIn
+              - EdgeID
+              - PlatformType
+              - Health
+              - Id
+        - description: Order sorted results by desc/asc
+          in: query
+          name: order
+          schema:
+            type: string
+        - description: Search query
+          in: query
+          name: search
+          schema:
+            type: string
+        - description: List environments(endpoints) of these groups
+          in: query
+          name: groupIds
+          style: form
+          explode: false
+          schema:
+            type: array
+            items:
+              type: integer
+        - description: List environments(endpoints) by this status
+          in: query
+          name: status
+          style: form
+          explode: false
+          schema:
+            type: array
+            items:
+              type: integer
+        - description: List environments(endpoints) of this type
+          in: query
+          name: types
+          style: form
+          explode: false
+          schema:
+            type: array
+            items:
+              enum:
+                - 0
+                - 1
+                - 2
+                - 3
+                - 4
+                - 5
+                - 6
+                - 7
+              type: integer
+        - description: Filter environments by platform type
+          in: query
+          name: platformTypes
+          style: form
+          explode: false
+          schema:
+            type: array
+            items:
+              enum:
+                - 0
+                - 1
+                - 2
+                - 3
+                - 4
+              type: integer
+        - description: If true, return only environments with an outdated agent
+          in: query
+          name: outdated
+          schema:
+            type: boolean
+        - description: Exclude environments of these groups
+          in: query
+          name: excludeGroupIds
+          style: form
+          explode: false
+          schema:
+            type: array
+            items:
+              type: integer
+        - description: search environments(endpoints) with these tags (depends on
+            tagsPartialMatch)
+          in: query
+          name: tagIds
+          style: form
+          explode: false
+          schema:
+            type: array
+            items:
+              type: integer
+        - description: If true, will return environment(endpoint) which has one of tagIds,
+            if false (or missing) will return only environments(endpoints) that
+            has all the tags
+          in: query
+          name: tagsPartialMatch
+          schema:
+            type: boolean
+        - description: will return only these environments(endpoints)
+          in: query
+          name: endpointIds
+          style: form
+          explode: false
+          schema:
+            type: array
+            items:
+              type: integer
+        - description: will exclude these environments(endpoints)
+          in: query
+          name: excludeIds
+          style: form
+          explode: false
+          schema:
+            type: array
+            items:
+              type: integer
+        - description: will return only environments with on of these agent versions
+          in: query
+          name: agentVersions
+          style: form
+          explode: false
+          schema:
+            type: array
+            items:
+              type: string
+        - description: if exists true show only edge async agents, false show only
+            standard edge agents. if missing, will show both types (relevant
+            only for edge agents)
+          in: query
+          name: edgeAsync
+          schema:
+            type: boolean
+        - description: if true, show only untrusted edge agents, if false show only
+            trusted edge agents (relevant only for edge agents)
+          in: query
+          name: edgeDeviceUntrusted
+          schema:
+            type: boolean
+        - description: if bigger then zero, show only edge agents that checked-in in the
+            last provided seconds (relevant only for edge agents)
+          in: query
+          name: edgeCheckInPassedSeconds
+          schema:
+            type: number
+        - description: if true, the snapshot data won't be retrieved
+          in: query
+          name: excludeSnapshots
+          schema:
+            type: boolean
+        - description: will return only environments(endpoints) with this name
+          in: query
+          name: name
+          schema:
+            type: string
+        - description: will return the environments of the specified edge stack
+          in: query
+          name: edgeStackId
+          schema:
+            type: integer
+        - description: only applied when edgeStackId exists. Filter the returned
+            environments based on their deployment status in the stack (not the
+            environment status!)
+          in: query
+          name: edgeStackStatus
+          schema:
+            type: integer
+            enum:
+              - 0
+              - 1
+              - 2
+              - 3
+              - 4
+              - 5
+              - 6
+              - 7
+              - 8
+              - 9
+              - 10
+              - 11
+              - 12
+              - 13
+        - description: List environments(endpoints) of these edge groups
+          in: query
+          name: edgeGroupIds
+          style: form
+          explode: false
+          schema:
+            type: array
+            items:
+              type: integer
+        - description: Exclude environments(endpoints) of these edge groups
+          in: query
+          name: excludeEdgeGroupIds
+          style: form
+          explode: false
+          schema:
+            type: array
+            items:
+              type: integer
+      responses:
+        "200":
+          description: Endpoints
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/portainer.Endpoint"
+                type: array
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: List environments(endpoints)
+      tags:
+        - endpoints
+    post:
+      description: >-
+        Create a new environment(endpoint) that will be used to manage an
+        environment(endpoint).
+
+        **Access policy**: administrator
+      operationId: EndpointCreate
+      requestBody:
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              properties:
+                Name:
+                  description: "Name that will be used to identify this environment(endpoint)
+                    (example: my-environment)"
+                  type: string
+                EndpointCreationType:
+                  description: "Environment(Endpoint) type. Value must be one of: 1 (Local Docker
+                    environment), 2 (Agent environment), 3 (Azure environment),
+                    4 (Edge agent environment) or 5 (Local Kubernetes
+                    Environment)"
+                  type: integer
+                  enum:
+                    - 0
+                    - 1
+                    - 2
+                    - 3
+                    - 4
+                    - 5
+                ContainerEngine:
+                  description: "Container engine used by the environment(endpoint). Value must be
+                    one of: 'docker' or 'podman'"
+                  type: string
+                URL:
+                  description: "URL or IP address of a Docker host (example:
+                    docker.mydomain.tld:2375). Defaults to local if not
+                    specified (Linux: /var/run/docker.sock, Windows:
+                    //./pipe/docker_engine). Cannot be empty if
+                    EndpointCreationType is set to 4 (Edge agent environment)"
+                  type: string
+                PublicURL:
+                  description: "URL or IP address where exposed containers will be reachable.
+                    Defaults to URL if not specified (example:
+                    docker.mydomain.tld:2375)"
+                  type: string
+                GroupID:
+                  description: Environment(Endpoint) group identifier. If not specified will
+                    default to 1 (unassigned).
+                  type: integer
+                TLS:
+                  description: Require TLS to connect against this environment(endpoint). Must be
+                    true if EndpointCreationType is set to 2 (Agent environment)
+                  type: boolean
+                TLSSkipVerify:
+                  description: Skip server verification when using TLS. Must be true if
+                    EndpointCreationType is set to 2 (Agent environment)
+                  type: boolean
+                TLSSkipClientVerify:
+                  description: Skip client verification when using TLS. Must be true if
+                    EndpointCreationType is set to 2 (Agent environment)
+                  type: boolean
+                TLSCACertFile:
+                  description: TLS CA certificate file
+                  type: string
+                  format: binary
+                TLSCertFile:
+                  description: TLS client certificate file
+                  type: string
+                  format: binary
+                TLSKeyFile:
+                  description: TLS client key file
+                  type: string
+                  format: binary
+                AzureApplicationID:
+                  description: Azure application ID. Required if environment(endpoint) type is set
+                    to 3
+                  type: string
+                AzureTenantID:
+                  description: Azure tenant ID. Required if environment(endpoint) type is set to 3
+                  type: string
+                AzureAuthenticationKey:
+                  description: Azure authentication key. Required if environment(endpoint) type is
+                    set to 3
+                  type: string
+                TagIds:
+                  description: JSON-parsable array of tag identifiers to which this
+                    environment(endpoint) is associated
+                  type: string
+                EdgeCheckinInterval:
+                  description: The check in interval for edge agent (in seconds)
+                  type: integer
+                EdgeTunnelServerAddress:
+                  description: URL or IP address that will be used to establish a reverse tunnel
+                  type: string
+                Gpus:
+                  description: List of GPUs - json stringified array of {name, value} structs
+                  type: string
+              required:
+                - Name
+                - EndpointCreationType
+        required: true
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.Endpoint"
+        "400":
+          description: Invalid request
+        "409":
+          description: Name is not unique
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Create a new environment(endpoint)
+      tags:
+        - endpoints
+  "/endpoints/{id}":
+    delete:
+      description: >-
+        Remove the environment associated to the specified identifier and
+        optionally clean-up associated resources.
+
+        **Access policy**: Administrator only.
+      operationId: EndpointDelete
+      parameters:
+        - description: Environment(Endpoint) identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "204":
+          description: Environment successfully deleted.
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "403":
+          description: Unauthorized access or operation not allowed.
+        "404":
+          description: Unable to find the environment with the specified identifier inside
+            the database.
+        "500":
+          description: Server error occurred while attempting to delete the environment.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Remove an environment
+      tags:
+        - endpoints
+    get:
+      description: |-
+        Retrieve details about an environment(endpoint).
+        **Access policy**: restricted
+      operationId: EndpointInspect
+      parameters:
+        - description: Environment(Endpoint) identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: if true, the snapshot data won't be retrieved
+          in: query
+          name: excludeSnapshot
+          schema:
+            type: boolean
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.Endpoint"
+        "400":
+          description: Invalid request
+        "404":
+          description: Environment(Endpoint) not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Inspect an environment(endpoint)
+      tags:
+        - endpoints
+    put:
+      description: |-
+        Update an environment(endpoint).
+        **Access policy**: authenticated
+      operationId: EndpointUpdate
+      parameters:
+        - description: Environment(Endpoint) identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/endpoints.endpointUpdatePayload"
+        description: Environment(Endpoint) details
+        required: true
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.Endpoint"
+        "400":
+          description: Invalid request
+        "404":
+          description: Environment(Endpoint) not found
+        "409":
+          description: Name is not unique
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Update an environment(endpoint)
+      tags:
+        - endpoints
+  "/endpoints/{id}/association":
+    put:
+      description: |-
+        De-association an edge environment(endpoint).
+        **Access policy**: administrator
+      operationId: EndpointAssociationDelete
+      parameters:
+        - description: Environment(Endpoint) identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "404":
+          description: Environment(Endpoint) not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: De-association an edge environment(endpoint)
+      tags:
+        - endpoints
+  "/endpoints/{id}/docker/v2/browse/put":
+    post:
+      description: |-
+        Use this environment(endpoint) to upload TLS files.
+        **Access policy**: administrator
+      parameters:
+        - description: Environment(Endpoint) identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Optional volume identifier to upload the file
+          in: query
+          name: volumeID
+          schema:
+            type: string
+      requestBody:
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              properties:
+                Path:
+                  description: The destination path to upload the file to
+                  type: string
+                file:
+                  description: The file to upload
+                  type: string
+                  format: binary
+              required:
+                - Path
+                - file
+        required: true
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Upload a file under a specific path on the file system of an
+        environment (endpoint)
+      tags:
+        - endpoints
+  "/endpoints/{id}/dockerhub/{registryId}":
+    get:
+      description: |-
+        get docker pull limits for a docker hub registry in the environment
+        **Access policy**:
+      operationId: endpointDockerhubStatus
+      parameters:
+        - description: endpoint ID
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: registry ID
+          in: path
+          name: registryId
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/endpoints.dockerhubStatusResponse"
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: registry or endpoint not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: fetch docker pull limits
+      tags:
+        - endpoints
+  "/endpoints/{id}/edge/jobs/{jobID}/logs":
+    post:
+      description: "**Access policy**: Edge agent only — requires
+        X-PortainerAgent-EdgeID header"
+      parameters:
+        - description: environment Id
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Job Id
+          in: path
+          name: jobID
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: OK
+        "400":
+          description: Bad Request
+        "403":
+          description: Forbidden
+        "500":
+          description: Internal Server Error
+      summary: Update the logs collected from an Edge Job
+      tags:
+        - edge_agent
+  "/endpoints/{id}/edge/stacks/{stackId}":
+    get:
+      description: "**Access policy**: Edge agent only — requires
+        X-PortainerAgent-EdgeID header"
+      parameters:
+        - description: environment Id
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: EdgeStack Id
+          in: path
+          name: stackId
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/edge.StackPayload"
+        "400":
+          description: Bad Request
+        "404":
+          description: Not Found
+        "500":
+          description: Internal Server Error
+      summary: Inspect an Edge Stack for an Environment
+      tags:
+        - edge_agent
+        - edge_stacks
+  "/endpoints/{id}/edge/status":
+    get:
+      description: >-
+        Endpoint for edge agent to check status of environment
+
+        **Access policy**: Edge agent only — requires X-PortainerAgent-EdgeID header
+      operationId: EndpointEdgeStatusInspect
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            "*/*":
+              schema:
+                $ref: "#/components/schemas/endpointedge.endpointEdgeStatusInspectResponse"
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied to access environment
+        "404":
+          description: Environment not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Get environment status
+      tags:
+        - edge_agent
+  "/endpoints/{id}/forceupdateservice":
+    put:
+      description: |-
+        force update a docker service
+        **Access policy**: authenticated
+      operationId: endpointForceUpdateService
+      parameters:
+        - description: endpoint identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/endpoints.forceUpdateServicePayload"
+        description: details
+        required: true
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/swarm.ServiceUpdateResponse"
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: endpoint not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: force update a docker service
+      tags:
+        - endpoints
+  "/endpoints/{id}/kubernetes/helm":
+    get:
+      description: "**Access policy**: authenticated"
+      operationId: HelmList
+      parameters:
+        - description: Environment(Endpoint) identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: specify an optional namespace
+          in: query
+          name: namespace
+          schema:
+            type: string
+        - description: specify an optional filter
+          in: query
+          name: filter
+          schema:
+            type: string
+        - description: specify an optional selector
+          in: query
+          name: selector
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/release.ReleaseElement"
+                type: array
+        "400":
+          description: Invalid environment(endpoint) identifier
+        "401":
+          description: Unauthorized
+        "404":
+          description: Environment(Endpoint) or ServiceAccount not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: List Helm Releases
+      tags:
+        - helm
+    post:
+      description: "**Access policy**: authenticated"
+      operationId: HelmInstall
+      parameters:
+        - description: Environment(Endpoint) identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Dry run
+          in: query
+          name: dryRun
+          schema:
+            type: boolean
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/helm.installChartPayload"
+        description: Chart details
+        required: true
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/release.Release"
+        "400":
+          description: Invalid request payload
+        "401":
+          description: Unauthorized
+        "404":
+          description: Environment(Endpoint) or ServiceAccount not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Install Helm Chart
+      tags:
+        - helm
+  "/endpoints/{id}/kubernetes/helm/{release}":
+    delete:
+      description: "**Access policy**: authenticated"
+      operationId: HelmDelete
+      parameters:
+        - description: Environment(Endpoint) identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: The name of the release/application to uninstall
+          in: path
+          name: release
+          required: true
+          schema:
+            type: string
+        - description: An optional namespace
+          in: query
+          name: namespace
+          schema:
+            type: string
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid environment(endpoint) id or bad request
+        "401":
+          description: Unauthorized
+        "404":
+          description: Environment(Endpoint) or ServiceAccount not found
+        "500":
+          description: Server error or helm error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Delete Helm Release
+      tags:
+        - helm
+    get:
+      description: |-
+        Get details of a helm release by release name
+        **Access policy**: authenticated
+      operationId: HelmGet
+      parameters:
+        - description: Environment(Endpoint) identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Helm release name
+          in: path
+          name: release
+          required: true
+          schema:
+            type: string
+        - description: specify an optional namespace
+          in: query
+          name: namespace
+          schema:
+            type: string
+        - description: show resources of the release
+          in: query
+          name: showResources
+          schema:
+            type: boolean
+        - description: specify an optional revision
+          in: query
+          name: revision
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/release.Release"
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve the release.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get a helm release
+      tags:
+        - helm
+  "/endpoints/{id}/kubernetes/helm/{release}/history":
+    get:
+      description: |-
+        Get a historical list of releases by release name
+        **Access policy**: authenticated
+      operationId: HelmGetHistory
+      parameters:
+        - description: Environment(Endpoint) identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Helm release name
+          in: path
+          name: release
+          required: true
+          schema:
+            type: string
+        - description: specify an optional namespace
+          in: query
+          name: namespace
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/release.Release"
+                type: array
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve the historical
+            list of releases.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get a historical list of releases
+      tags:
+        - helm
+  "/endpoints/{id}/kubernetes/helm/{release}/rollback":
+    post:
+      description: |-
+        Rollback a helm release to a previous revision
+        **Access policy**: authenticated
+      operationId: HelmRollback
+      parameters:
+        - description: Environment(Endpoint) identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Helm release name
+          in: path
+          name: release
+          required: true
+          schema:
+            type: string
+        - description: specify an optional namespace
+          in: query
+          name: namespace
+          schema:
+            type: string
+        - description: specify the revision to rollback to (defaults to previous revision
+            if not specified)
+          in: query
+          name: revision
+          schema:
+            type: integer
+        - description: "wait for resources to be ready (default: false)"
+          in: query
+          name: wait
+          schema:
+            type: boolean
+        - description: "wait for jobs to complete before marking the release as successful
+            (default: false)"
+          in: query
+          name: waitForJobs
+          schema:
+            type: boolean
+        - description: "performs pods restart for the resource if applicable (default:
+            true)"
+          in: query
+          name: recreate
+          schema:
+            type: boolean
+        - description: "force resource update through delete/recreate if needed (default:
+            false)"
+          in: query
+          name: force
+          schema:
+            type: boolean
+        - description: "time to wait for any individual Kubernetes operation in seconds
+            (default: 300)"
+          in: query
+          name: timeout
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/release.Release"
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier or
+            release name.
+        "500":
+          description: Server error occurred while attempting to rollback the release.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Rollback a helm release
+      tags:
+        - helm
+  "/endpoints/{id}/registries":
+    get:
+      description: >-
+        List all registries based on the current user authorizations in current
+        environment.
+
+        **Access policy**: authenticated
+      operationId: endpointRegistriesList
+      parameters:
+        - description: required if kubernetes environment, will show registries by namespace
+          in: query
+          name: namespace
+          schema:
+            type: string
+        - description: Environment(Endpoint) identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/portainer.Registry"
+                type: array
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: List Registries on environment
+      tags:
+        - endpoints
+  "/endpoints/{id}/registries/{registryId}":
+    put:
+      description: "**Access policy**: authenticated"
+      operationId: endpointRegistryAccess
+      parameters:
+        - description: Environment(Endpoint) identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Registry identifier
+          in: path
+          name: registryId
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/endpoints.registryAccessPayload"
+        description: details
+        required: true
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: Endpoint not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: update registry access for environment
+      tags:
+        - endpoints
+  "/endpoints/{id}/settings":
+    put:
+      description: |-
+        Update settings for an environment(endpoint).
+        **Access policy**: authenticated
+      operationId: EndpointSettingsUpdate
+      parameters:
+        - description: Environment(Endpoint) identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/endpoints.endpointSettingsUpdatePayload"
+        description: Environment(Endpoint) details
+        required: true
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.Endpoint"
+        "400":
+          description: Invalid request
+        "404":
+          description: Environment(Endpoint) not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Update settings for an environment(endpoint)
+      tags:
+        - endpoints
+  "/endpoints/{id}/snapshot":
+    post:
+      description: |-
+        Snapshots an environment(endpoint)
+        **Access policy**: administrator
+      operationId: EndpointSnapshot
+      parameters:
+        - description: Environment(Endpoint) identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "404":
+          description: Environment(Endpoint) not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Snapshots an environment(endpoint)
+      tags:
+        - endpoints
+  /endpoints/delete:
+    post:
+      description: >-
+        Remove multiple environments and optionally clean-up associated
+        resources.
+
+        **Access policy**: Administrator only.
+      operationId: EndpointDeleteBatch
+      requestBody:
+        $ref: "#/components/requestBodies/endpoints.endpointDeleteBatchPayload"
+      responses:
+        "204":
+          description: Environment(s) successfully deleted.
+        "207":
+          description: Partial success. Some environments were deleted successfully, while
+            others failed.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/endpoints.endpointDeleteBatchPartialResponse"
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "403":
+          description: Unauthorized access or operation not allowed.
+        "500":
+          description: Server error occurred while attempting to delete the specified
+            environments.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Remove multiple environments
+      tags:
+        - endpoints
+  /endpoints/global-key:
+    post:
+      operationId: EndpointCreateGlobalKey
+      responses:
+        "200":
+          description: Success
+          content:
+            "*/*":
+              schema:
+                $ref: "#/components/schemas/endpoints.endpointCreateGlobalKeyResponse"
+        "400":
+          description: Invalid request
+        "500":
+          description: Server error
+      summary: Create or retrieve the endpoint for an EdgeID
+      tags:
+        - endpoints
+  /endpoints/relations:
+    put:
+      description: |-
+        Update relations for a list of environments
+        Edge groups, tags and environment group can be updated.
+
+        **Access policy**: administrator
+      operationId: EndpointUpdateRelations
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/endpoints.endpointUpdateRelationsPayload"
+        description: Environment relations data
+        required: true
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "401":
+          description: Unauthorized
+        "404":
+          description: Not found
+        "500":
+          description: Server error
+      security:
+        - jwt: []
+      summary: Update relations for a list of environments
+      tags:
+        - endpoints
+  /endpoints/snapshot:
+    post:
+      description: |-
+        Snapshot all environments(endpoints)
+        **Access policy**: administrator
+      operationId: EndpointSnapshots
+      responses:
+        "204":
+          description: Success
+        "500":
+          description: Server Error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Snapshot all environments(endpoints)
+      tags:
+        - endpoints
+  /endpoints/summary:
+    get:
+      description: >-
+        Returns counts of environments by status (up, down) and ungrouped
+        environments (unassigned), plus breakdowns by group, type, and health.
+
+        **Access policy**: restricted
+      operationId: EndpointSummaryCounts
+      responses:
+        "200":
+          description: Environment summary counts
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/endpoints.EnvironmentSummaryCountsResponse"
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Get environment summary counts
+      tags:
+        - endpoints
+  /gitops/repo/file/preview:
+    post:
+      description: |-
+        Retrieve the compose file content based on git repository configuration
+        **Access policy**: authenticated
+      operationId: GitOperationRepoFilePreview
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/gitops.repositoryFilePreviewPayload"
+        description: Template details
+        required: true
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/gitops.fileResponse"
+        "400":
+          description: Invalid request
+        "404":
+          description: Source not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: preview the content of target file in the git repository
+      tags:
+        - gitops
+  /gitops/sources:
+    get:
+      description: >-
+        Returns a deduplicated list of git repositories used across all GitOps
+        workflows.
+
+        **Access policy**: authenticated
+      operationId: GitOpsSourcesList
+      parameters:
+        - description: Search term (matches URL)
+          in: query
+          name: search
+          schema:
+            type: string
+        - description: "Sort field: name | status | type"
+          in: query
+          name: sort
+          schema:
+            type: string
+        - description: "Sort order: asc or desc"
+          in: query
+          name: order
+          schema:
+            type: string
+        - description: Pagination start index
+          in: query
+          name: start
+          schema:
+            type: integer
+        - description: Pagination limit (0 = unlimited)
+          in: query
+          name: limit
+          schema:
+            type: integer
+        - description: "Filter by status: healthy | syncing | error | paused | unknown"
+          in: query
+          name: status
+          schema:
+            type: string
+        - description: "Filter by source type: git | oci | helm"
+          in: query
+          name: type
+          schema:
+            type: string
+            enum:
+              - git
+              - helm
+              - oci
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/sources.Source"
+                type: array
+        "400":
+          description: Invalid status parameter
+        "403":
+          description: Access denied
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: List all GitOps sources
+      tags:
+        - gitops
+  "/gitops/sources/{id}":
+    delete:
+      description: >-
+        Deletes an existing GitOps source. Returns 409 if the source is
+        referenced by any workflow or custom template.
+
+        **Access policy**: authenticated
+      operationId: GitOpsSourcesDelete
+      parameters:
+        - description: Source identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "204":
+          description: Source deleted
+        "400":
+          description: Invalid request
+        "403":
+          description: Access denied
+        "404":
+          description: Source not found
+        "409":
+          description: Source is in use by one or more workflows or custom templates
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Delete a source
+      tags:
+        - gitops
+    get:
+      description: >-
+        Returns a single GitOps source with its connection settings and linked
+        workflows.
+
+        **Access policy**: authenticated
+      operationId: GitOpsSourceGet
+      parameters:
+        - description: Source identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/sources.SourceDetail"
+        "400":
+          description: Invalid request
+        "403":
+          description: Access denied
+        "404":
+          description: Source not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Get a GitOps source by ID
+      tags:
+        - gitops
+    put:
+      description: |-
+        Updates an existing GitOps source backed by a Git repository.
+        **Access policy**: authenticated
+      operationId: GitOpsSourcesUpdateGit
+      parameters:
+        - description: Source identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/sources.GitSourceUpdatePayload"
+        description: Git source details
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.Source"
+        "400":
+          description: Invalid request payload
+        "403":
+          description: Access denied
+        "404":
+          description: Source not found
+        "409":
+          description: A source with this URL and credentials already exists
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Update a Git source
+      tags:
+        - gitops
+  "/gitops/sources/{id}/access":
+    put:
+      description: |-
+        Updates the access control settings for an existing GitOps source.
+        **Access policy**: administrator
+      operationId: GitOpsSourcesUpdateAccess
+      parameters:
+        - description: Source identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/sources.SourceAccessUpdatePayload"
+        description: Source access control
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.Source"
+        "400":
+          description: Invalid request payload
+        "403":
+          description: Access denied
+        "404":
+          description: Source not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Update a GitOps source's access control
+      tags:
+        - gitops
+  "/gitops/sources/{id}/test":
+    post:
+      description: >-
+        Tests connectivity for a GitOps source, applying optional overrides to
+        the stored configuration.
+
+        **Access policy**: authenticated
+      operationId: GitOpsSourcesTestById
+      parameters:
+        - description: Source identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/sources.GitSourceUpdatePayload"
+        description: Optional connection overrides; omitted fields fall back to stored
+          values
+      responses:
+        "200":
+          description: Connection test result
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/sources.ConnectionTestResult"
+        "400":
+          description: Invalid request payload
+        "403":
+          description: Access denied
+        "404":
+          description: Source not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Test the connection of a stored source
+      tags:
+        - gitops
+  /gitops/sources/git:
+    post:
+      description: |-
+        Creates a new GitOps source backed by a Git repository.
+        **Access policy**: authenticated
+      operationId: GitOpsSourcesCreateGit
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/sources.GitSourceCreatePayload"
+        description: Git source details
+        required: true
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.Source"
+        "400":
+          description: Invalid request payload
+        "403":
+          description: Access denied
+        "409":
+          description: A source with this URL and credentials already exists
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Create a Git source
+      tags:
+        - gitops
+  /gitops/sources/summary:
+    get:
+      description: |-
+        Returns a count of sources per status.
+        **Access policy**: authenticated
+      operationId: GitOpsSourcesSummary
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/workflows.StatusSummary"
+        "403":
+          description: Access denied
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Summarize GitOps source status counts
+      tags:
+        - gitops
+  /gitops/sources/test:
+    post:
+      description: >-
+        Tests connectivity for Git connection details that have not been
+        persisted yet.
+
+        **Access policy**: authenticated
+      operationId: GitOpsSourcesTest
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/sources.GitSourceCreatePayload"
+        description: Git connection details
+        required: true
+      responses:
+        "200":
+          description: Connection test result
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/sources.ConnectionTestResult"
+        "400":
+          description: Invalid request payload
+        "403":
+          description: Access denied
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Test a Git source connection
+      tags:
+        - gitops
+  /gitops/workflows:
+    get:
+      description: >-
+        Returns a unified list of all stacks that have GitOps (GitConfig)
+        configured.
+
+        **Access policy**: authenticated
+      operationId: GitOpsWorkflowsList
+      parameters:
+        - description: Search term (matches name or repository URL)
+          in: query
+          name: search
+          schema:
+            type: string
+        - description: "Sort field: name | type | status | creationDate | lastSyncDate"
+          in: query
+          name: sort
+          schema:
+            type: string
+        - description: "Sort order: asc or desc"
+          in: query
+          name: order
+          schema:
+            type: string
+        - description: Pagination start index
+          in: query
+          name: start
+          schema:
+            type: integer
+        - description: Pagination limit (0 = unlimited)
+          in: query
+          name: limit
+          schema:
+            type: integer
+        - description: Filter by environment IDs (e.g. endpointIds[]=1&endpointIds[]=2)
+          in: query
+          name: endpointIds
+          style: form
+          explode: false
+          schema:
+            type: array
+            items:
+              type: integer
+        - description: "Filter by status: healthy | syncing | error | paused | unknown"
+          in: query
+          name: status
+          schema:
+            type: string
+        - description: "Filter by type: stack"
+          in: query
+          name: type
+          schema:
+            type: string
+        - description: "Filter by platform: dockerStandalone | dockerSwarm | kubernetes"
+          in: query
+          name: platform
+          schema:
+            type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/workflows.Workflow"
+                type: array
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: List all GitOps workflows
+      tags:
+        - gitops
+  "/gitops/workflows/{id}":
+    get:
+      description: >-
+        Returns the detail view of a single GitOps workflow, with one entry per
+        backing
+
+        stack or edge stack artifact.
+
+        **Access policy**: authenticated
+      operationId: GitOpsWorkflowGet
+      parameters:
+        - description: Workflow identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/workflows.WorkflowDetail"
+        "400":
+          description: Invalid request
+        "404":
+          description: Workflow not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Get a GitOps workflow by ID
+      tags:
+        - gitops
+  /gitops/workflows/summary:
+    get:
+      description: |-
+        Returns a count of workflows per status across all environments.
+        **Access policy**: authenticated
+      operationId: GitOpsWorkflowsSummary
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/workflows.StatusSummary"
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Summarize GitOps workflow status counts
+      tags:
+        - gitops
+  "/kubernetes/{id}/applications":
+    get:
+      description: >-
+        Get a list of applications across all namespaces in the cluster. If the
+        nodeName is provided, it will return the applications running on that
+        node.
+
+        **Access policy**: authenticated
+      operationId: GetAllKubernetesApplications
+      parameters:
+        - description: Environment(Endpoint) identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Namespace name
+          in: query
+          name: namespace
+          required: true
+          schema:
+            type: string
+        - description: Node name
+          in: query
+          name: nodeName
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/kubernetes.K8sApplication"
+                type: array
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve the list of
+            applications from the cluster.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get a list of applications across all namespaces in the cluster. If the
+        nodeName is provided, it will return the applications running on that
+        node.
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/applications/count":
+    get:
+      description: >-
+        Get the count of Applications across all namespaces in the cluster. If
+        the nodeName is provided, it will return the count of applications
+        running on that node.
+
+        **Access policy**: Authenticated user.
+      operationId: GetAllKubernetesApplicationsCount
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                type: integer
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve the count of all
+            applications from the cluster.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get Applications count
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/cluster_role_bindings/delete":
+    post:
+      description: |-
+        Delete the provided list of cluster role bindings.
+        **Access policy**: Authenticated user.
+      operationId: DeleteClusterRoleBindings
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              items:
+                type: string
+              type: array
+        description: A list of cluster role bindings to delete
+        required: true
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier or
+            unable to find a specific cluster role binding.
+        "500":
+          description: Server error occurred while attempting to delete cluster role
+            bindings.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Delete cluster role bindings
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/cluster_roles/delete":
+    post:
+      description: |-
+        Delete the provided list of cluster roles.
+        **Access policy**: Authenticated user.
+      operationId: DeleteClusterRoles
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              items:
+                type: string
+              type: array
+        description: A list of cluster roles to delete
+        required: true
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier or
+            unable to find a specific cluster role.
+        "500":
+          description: Server error occurred while attempting to delete cluster roles.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Delete cluster roles
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/clusterrolebindings":
+    get:
+      description: >-
+        Get a list of kubernetes cluster role bindings within the given
+        environment at the cluster level.
+
+        **Access policy**: Authenticated user.
+      operationId: GetAllKubernetesClusterRoleBindings
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/kubernetes.K8sClusterRoleBinding"
+                type: array
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve the list of
+            cluster role bindings.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get a list of kubernetes cluster role bindings
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/clusterroles":
+    get:
+      description: >-
+        Get a list of kubernetes cluster roles within the given environment at
+        the cluster level.
+
+        **Access policy**: Authenticated user.
+      operationId: GetAllKubernetesClusterRoles
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/kubernetes.K8sClusterRole"
+                type: array
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve the list of
+            cluster roles.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get a list of kubernetes cluster roles
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/configmaps":
+    get:
+      description: >-
+        Get a list of ConfigMaps across all namespaces in the cluster. For
+        non-admin users, it will only return ConfigMaps based on the namespaces
+        that they have access to.
+
+        **Access policy**: Authenticated user.
+      operationId: GetAllKubernetesConfigMaps
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Set to true to include information about applications that use the
+            ConfigMaps in the response
+          in: query
+          name: isUsed
+          required: true
+          schema:
+            type: boolean
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/kubernetes.K8sConfigMap"
+                type: array
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve all configmaps
+            from the cluster.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get a list of ConfigMaps
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/configmaps/count":
+    get:
+      description: >-
+        Get the count of ConfigMaps across all namespaces in the cluster. For
+        non-admin users, it will only return the count of ConfigMaps based on
+        the namespaces that they have access to.
+
+        **Access policy**: Authenticated user.
+      operationId: GetAllKubernetesConfigMapsCount
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                type: integer
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve the count of all
+            configmaps from the cluster.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get ConfigMaps count
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/cron_jobs":
+    get:
+      description: |-
+        Get a list of kubernetes Cron Jobs that the user has access to.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesCronJobs
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/kubernetes.K8sCronJob"
+                type: array
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve the list of Cron
+            Jobs.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get a list of kubernetes Cron Jobs
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/cron_jobs/delete":
+    post:
+      description: |-
+        Delete the provided list of Cron Jobs.
+        **Access policy**: Authenticated user.
+      operationId: DeleteCronJobs
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/kubernetes.K8sCronJobDeleteRequests"
+        description: A map where the key is the namespace and the value is an array of
+          Cron Jobs to delete
+        required: true
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier or
+            unable to find a specific service account.
+        "500":
+          description: Server error occurred while attempting to delete Cron Jobs.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Delete Cron Jobs
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/dashboard":
+    get:
+      description: >-
+        Get the dashboard summary data which is simply a count of a range of
+        different commonly used kubernetes resources.
+
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesDashboard
+      parameters:
+        - description: Environment (Endpoint) identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/kubernetes.K8sDashboard"
+                type: array
+        "400":
+          description: Invalid request
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get the dashboard summary data
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/describe":
+    get:
+      description: |-
+        Get a description of a kubernetes resource.
+        **Access policy**: Authenticated user.
+      operationId: DescribeResource
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Resource name
+          in: query
+          name: name
+          required: true
+          schema:
+            type: string
+        - description: Resource kind
+          in: query
+          name: kind
+          required: true
+          schema:
+            type: string
+        - description: Namespace
+          in: query
+          name: namespace
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/kubernetes.describeResourceResponse"
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve resource
+            description
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get a description of a kubernetes resource
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/events":
+    get:
+      description: |-
+        Get events by query param resourceId
+        **Access policy**: Authenticated user.
+      operationId: getAllKubernetesEvents
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: The resource id of the involved kubernetes object
+          in: query
+          name: resourceId
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/kubernetes.K8sEvent"
+                type: array
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "500":
+          description: Server error occurred while attempting to retrieve the events.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Gets kubernetes events
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/ingresscontrollers":
+    get:
+      description: >-
+        Get a list of ingress controllers for the given environment. If the
+        allowedOnly query parameter is set, only ingress controllers that are
+        allowed by the environment's ingress configuration will be returned.
+
+        **Access policy**: Authenticated user.
+      operationId: GetAllKubernetesIngressControllers
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Only return allowed ingress controllers
+          in: query
+          name: allowedOnly
+          schema:
+            type: boolean
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/kubernetes.K8sIngressController"
+                type: array
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve ingress
+            controllers
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get a list of ingress controllers
+      tags:
+        - kubernetes
+    put:
+      description: |-
+        Update (block/unblock) ingress controllers for the provided environment.
+        **Access policy**: Authenticated user.
+      operationId: UpdateKubernetesIngressControllers
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        $ref: "#/components/requestBodies/kubernetes.K8sIngressControllerArray"
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier or
+            unable to find the ingress controllers to update.
+        "500":
+          description: Server error occurred while attempting to update ingress controllers.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Update (block/unblock) ingress controllers
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/ingresses":
+    get:
+      description: >-
+        Get kubernetes ingresses at the cluster level for the provided
+        environment.
+
+        **Access policy**: Authenticated user.
+      operationId: GetAllKubernetesClusterIngresses
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Lookup services associated with each ingress
+          in: query
+          name: withServices
+          schema:
+            type: boolean
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/kubernetes.K8sIngressInfo"
+                type: array
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve ingresses.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get kubernetes ingresses at the cluster level
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/ingresses/count":
+    get:
+      description: |-
+        Get the number of kubernetes ingresses within the given environment.
+        **Access policy**: Authenticated user.
+      operationId: GetAllKubernetesClusterIngressesCount
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                type: integer
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve ingresses count.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get Ingresses count
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/ingresses/delete":
+    post:
+      description: |-
+        Delete one or more Ingresses in the provided environment.
+        **Access policy**: Authenticated user.
+      operationId: DeleteKubernetesIngresses
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/kubernetes.K8sIngressDeleteRequests"
+        description: Ingress details
+        required: true
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier or
+            unable to find a specific ingress.
+        "500":
+          description: Server error occurred while attempting to delete specified ingresses.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Delete one or more Ingresses
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/jobs":
+    get:
+      description: |-
+        Get a list of kubernetes Jobs that the user has access to.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesJobs
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Whether to include Jobs that have a cronjob owner
+          in: query
+          name: includeCronJobChildren
+          schema:
+            type: boolean
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/kubernetes.K8sJob"
+                type: array
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve the list of Jobs.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get a list of kubernetes Jobs
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/jobs/delete":
+    post:
+      description: |-
+        Delete the provided list of Jobs.
+        **Access policy**: Authenticated user.
+      operationId: DeleteJobs
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/kubernetes.K8sJobDeleteRequests"
+        description: A map where the key is the namespace and the value is an array of
+          Jobs to delete
+        required: true
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier or
+            unable to find a specific service account.
+        "500":
+          description: Server error occurred while attempting to delete Jobs.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Delete Jobs
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/max_resource_limits":
+    get:
+      description: >-
+        Get max CPU and memory limits (unused resources) of all nodes within k8s
+        cluster.
+
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesMaxResourceLimits
+      parameters:
+        - description: Environment(Endpoint) identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.K8sNodesLimits"
+        "400":
+          description: Invalid request
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve nodes limits.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get max CPU and memory limits of all nodes within k8s cluster
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/metrics/applications_resources":
+    get:
+      description: >-
+        Get the total CPU (cores) and memory (bytes) requests and limits of all
+        applications across all namespaces.
+
+        **Access policy**: Authenticated user.
+      operationId: GetApplicationsResources
+      parameters:
+        - description: Environment(Endpoint) identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Node name
+          in: query
+          name: node
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/kubernetes.K8sApplicationResource"
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve the total
+            resource requests and limits for all applications from the cluster.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get the total resource requests and limits of all applications
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/metrics/nodes":
+    get:
+      description: |-
+        Get a list of metrics associated with all nodes of a cluster.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesMetricsForAllNodes
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/v1beta1.NodeMetricsList"
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "500":
+          description: Server error occurred while attempting to retrieve the list of
+            nodes with their live metrics.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get a list of nodes with their live metrics
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/metrics/nodes/{name}":
+    get:
+      description: |-
+        Get live metrics for the specified node.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesMetricsForNode
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Node identifier
+          in: path
+          name: name
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/v1beta1.NodeMetrics"
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "500":
+          description: Server error occurred while attempting to retrieve the live metrics
+            for the specified node.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get live metrics for a node
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/metrics/pods/{namespace}":
+    get:
+      description: |-
+        Get a list of pods with their live metrics for the specified namespace.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesMetricsForAllPods
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Namespace
+          in: path
+          name: namespace
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/v1beta1.PodMetricsList"
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "500":
+          description: Server error occurred while attempting to retrieve the list of pods
+            with their live metrics.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get a list of pods with their live metrics
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/metrics/pods/{namespace}/{name}":
+    get:
+      description: |-
+        Get live metrics for the specified pod.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesMetricsForPod
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Namespace
+          in: path
+          name: namespace
+          required: true
+          schema:
+            type: string
+        - description: Pod identifier
+          in: path
+          name: name
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/v1beta1.PodMetrics"
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "500":
+          description: Server error occurred while attempting to retrieve the live metrics
+            for the specified pod.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get live metrics for a pod
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/namespaces":
+    delete:
+      description: |-
+        Delete a kubernetes namespace within the given environment.
+        **Access policy**: Authenticated user.
+      operationId: DeleteKubernetesNamespace
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            "*/*":
+              schema:
+                type: string
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "403":
+          description: Unauthorized access or operation not allowed.
+        "500":
+          description: Server error occurred while attempting to delete the namespace.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Delete a kubernetes namespace
+      tags:
+        - kubernetes
+    get:
+      description: >-
+        Get a list of all namespaces within the given environment based on the
+        user role and permissions. If the user is an admin, they can access all
+        namespaces. If the user is not an admin, they can only access namespaces
+        that they have access to.
+
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesNamespaces
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: When set to true, include the resource quota information as part of
+            the Namespace information. Default is false
+          in: query
+          name: withResourceQuota
+          required: true
+          schema:
+            type: boolean
+        - description: When set to true, include the unhealthy events information as part
+            of the Namespace information. Default is false
+          in: query
+          name: withUnhealthyEvents
+          required: true
+          schema:
+            type: boolean
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/portainer.K8sNamespaceInfo"
+                type: array
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve the list of
+            namespaces.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get a list of namespaces
+      tags:
+        - kubernetes
+    post:
+      description: |-
+        Create a namespace within the given environment.
+        **Access policy**: Authenticated user.
+      operationId: CreateKubernetesNamespace
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/kubernetes.K8sNamespaceDetails"
+        description: Namespace configuration details
+        required: true
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.K8sNamespaceInfo"
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "409":
+          description: Conflict - the namespace already exists.
+        "500":
+          description: Server error occurred while attempting to create the namespace.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Create a namespace
+      tags:
+        - kubernetes
+    put:
+      description: |-
+        Update a namespace within the given environment.
+        **Access policy**: Authenticated user.
+      operationId: UpdateKubernetesNamespaceDeprecated
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Namespace
+          in: path
+          name: namespace
+          required: true
+          schema:
+            type: string
+      requestBody:
+        $ref: "#/components/requestBodies/kubernetes.K8sNamespaceDetails"
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.K8sNamespaceInfo"
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier or
+            unable to find a specific namespace.
+        "500":
+          description: Server error occurred while attempting to update the namespace.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Update a namespace
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/namespaces/{namespace}":
+    get:
+      description: >-
+        Get namespace details for the provided namespace within the given
+        environment.
+
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesNamespace
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: The namespace name to get details for
+          in: path
+          name: namespace
+          required: true
+          schema:
+            type: string
+        - description: When set to true, include the resource quota information as part of
+            the Namespace information. Default is false
+          in: query
+          name: withResourceQuota
+          required: true
+          schema:
+            type: boolean
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.K8sNamespaceInfo"
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier or
+            unable to find a specific namespace.
+        "500":
+          description: Server error occurred while attempting to retrieve specified
+            namespace information.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get namespace details
+      tags:
+        - kubernetes
+    put:
+      description: |-
+        Update a namespace within the given environment.
+        **Access policy**: Authenticated user.
+      operationId: UpdateKubernetesNamespace
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Namespace
+          in: path
+          name: namespace
+          required: true
+          schema:
+            type: string
+      requestBody:
+        $ref: "#/components/requestBodies/kubernetes.K8sNamespaceDetails"
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.K8sNamespaceInfo"
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier or
+            unable to find a specific namespace.
+        "500":
+          description: Server error occurred while attempting to update the namespace.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Update a namespace
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/namespaces/{namespace}/configmaps/{configmap}":
+    get:
+      description: |-
+        Get a ConfigMap by name for a given namespace.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesConfigMap
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: The namespace name where the configmap is located
+          in: path
+          name: namespace
+          required: true
+          schema:
+            type: string
+        - description: The configmap name to get details for
+          in: path
+          name: configmap
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/kubernetes.K8sConfigMap"
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier or a
+            configmap with the specified name in the given namespace.
+        "500":
+          description: Server error occurred while attempting to retrieve a configmap by
+            name within the specified namespace.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get a ConfigMap
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/namespaces/{namespace}/events":
+    get:
+      description: |-
+        Get events by optional query param resourceId for a given namespace.
+        **Access policy**: Authenticated user.
+      operationId: getKubernetesEventsForNamespace
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: The namespace name the events are associated to
+          in: path
+          name: namespace
+          required: true
+          schema:
+            type: string
+        - description: The resource id of the involved kubernetes object
+          in: query
+          name: resourceId
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/kubernetes.K8sEvent"
+                type: array
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "500":
+          description: Server error occurred while attempting to retrieve the events
+            within the specified namespace.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Gets kubernetes events for namespace
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/namespaces/{namespace}/ingresscontrollers":
+    get:
+      description: >-
+        Get a list of ingress controllers for the given environment in the
+        provided namespace.
+
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesIngressControllersByNamespace
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Namespace
+          in: path
+          name: namespace
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/kubernetes.K8sIngressController"
+                type: array
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier or a
+            namespace with the specified name.
+        "500":
+          description: Server error occurred while attempting to retrieve ingress
+            controllers by a namespace
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get a list ingress controllers by namespace
+      tags:
+        - kubernetes
+    put:
+      description: >-
+        Update (block/unblock) ingress controllers by namespace for the provided
+        environment.
+
+        **Access policy**: Authenticated user.
+      operationId: UpdateKubernetesIngressControllersByNamespace
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Namespace name
+          in: path
+          name: namespace
+          required: true
+          schema:
+            type: string
+      requestBody:
+        $ref: "#/components/requestBodies/kubernetes.K8sIngressControllerArray"
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to update ingress
+            controllers by namespace.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Update (block/unblock) ingress controllers by namespace
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/namespaces/{namespace}/ingresses":
+    get:
+      description: >-
+        Get a list of Ingresses. If namespace is provided, it will return the
+        list of Ingresses in that namespace.
+
+        **Access policy**: Authenticated user.
+      operationId: GetAllKubernetesIngresses
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Namespace name
+          in: path
+          name: namespace
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/kubernetes.K8sIngressInfo"
+                type: array
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve ingresses
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get a list of Ingresses
+      tags:
+        - kubernetes
+    post:
+      description: |-
+        Create an Ingress for the provided environment.
+        **Access policy**: Authenticated user.
+      operationId: CreateKubernetesIngress
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Namespace name
+          in: path
+          name: namespace
+          required: true
+          schema:
+            type: string
+      requestBody:
+        $ref: "#/components/requestBodies/kubernetes.K8sIngressInfo"
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "409":
+          description: Conflict - an ingress with the same name already exists in the
+            specified namespace.
+        "500":
+          description: Server error occurred while attempting to create an ingress.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Create an Ingress
+      tags:
+        - kubernetes
+    put:
+      description: |-
+        Update an Ingress for the provided environment.
+        **Access policy**: Authenticated user.
+      operationId: UpdateKubernetesIngress
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Namespace name
+          in: path
+          name: namespace
+          required: true
+          schema:
+            type: string
+      requestBody:
+        $ref: "#/components/requestBodies/kubernetes.K8sIngressInfo"
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier or
+            unable to find the specified ingress.
+        "500":
+          description: Server error occurred while attempting to update the specified
+            ingress.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Update an Ingress
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/namespaces/{namespace}/ingresses/{ingress}":
+    get:
+      description: |-
+        Get an Ingress by name for the provided environment.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesIngress
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Namespace name
+          in: path
+          name: namespace
+          required: true
+          schema:
+            type: string
+        - description: Ingress name
+          in: path
+          name: ingress
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/kubernetes.K8sIngressInfo"
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier or
+            unable to find an ingress with the specified name.
+        "500":
+          description: Server error occurred while attempting to retrieve an ingress.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get an Ingress by name
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/namespaces/{namespace}/persistent_volume_claims":
+    get:
+      description: |-
+        Get a list of PersistentVolumeClaims in the specified namespace.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesPersistentVolumeClaimsInNamespace
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Namespace name
+          in: path
+          name: namespace
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/kubernetes.K8sPersistentVolumeClaim"
+                type: array
+        "400":
+          description: Invalid request payload.
+        "403":
+          description: Unauthorized access or operation not allowed.
+        "500":
+          description: Server error occurred while attempting to retrieve persistent
+            volume claims.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get PersistentVolumeClaims in a namespace
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/namespaces/{namespace}/persistent_volume_claims/{name}":
+    get:
+      description: |-
+        Get a PersistentVolumeClaim by name within a namespace.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesPersistentVolumeClaim
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Namespace name
+          in: path
+          name: namespace
+          required: true
+          schema:
+            type: string
+        - description: PVC name
+          in: path
+          name: name
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/kubernetes.K8sPersistentVolumeClaim"
+        "400":
+          description: Invalid request payload.
+        "403":
+          description: Unauthorized access or operation not allowed.
+        "404":
+          description: PVC not found.
+        "500":
+          description: Server error occurred while attempting to retrieve the persistent
+            volume claim.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get a specific PersistentVolumeClaim
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/namespaces/{namespace}/pods/{name}":
+    delete:
+      description: |-
+        Delete a single Kubernetes pod in the given namespace. The owning
+        controller (Deployment, StatefulSet, DaemonSet, ...) is responsible
+        for recreating the pod. For naked pods the pod is removed permanently.
+        **Access policy**: Authenticated user.
+      operationId: DeleteKubernetesPod
+      parameters:
+        - description: Environment(Endpoint) identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Namespace
+          in: path
+          name: namespace
+          required: true
+          schema:
+            type: string
+        - description: Pod name
+          in: path
+          name: name
+          required: true
+          schema:
+            type: string
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier or
+            unable to find the specified pod.
+        "500":
+          description: Server error occurred while attempting to delete the pod.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Delete a kubernetes pod
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/namespaces/{namespace}/pods/{name}/restart":
+    post:
+      description: |-
+        Restart all containers in a single Kubernetes pod in place using
+        the Kubernetes 1.35 alpha pod-restart subresource. The pod itself
+        is preserved. Requires the cluster to expose the corresponding
+        subresource (and the matching feature gate to be enabled).
+        **Access policy**: Authenticated user.
+      operationId: RestartKubernetesPod
+      parameters:
+        - description: Environment(Endpoint) identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Namespace
+          in: path
+          name: namespace
+          required: true
+          schema:
+            type: string
+        - description: Pod name
+          in: path
+          name: name
+          required: true
+          schema:
+            type: string
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment, the specified pod, or the cluster
+            does not expose the pod-restart subresource (Kubernetes <1.35 or
+            feature gate disabled).
+        "405":
+          description: The cluster does not support the pod-restart subresource
+            (Kubernetes <1.35 or feature gate disabled).
+        "500":
+          description: Server error occurred while attempting to restart the pod.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Restart all containers in a Kubernetes pod
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/namespaces/{namespace}/secrets/{secret}":
+    get:
+      description: |-
+        Get a Secret by name for a given namespace.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesSecret
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: The namespace name where the secret is located
+          in: path
+          name: namespace
+          required: true
+          schema:
+            type: string
+        - description: The secret name to get details for
+          in: path
+          name: secret
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/kubernetes.K8sSecret"
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve a secret by name
+            belong in a namespace.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get a Secret
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/namespaces/{namespace}/service_accounts/{name}":
+    get:
+      description: |-
+        Get a kubernetes service account in the given namespace.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesServiceAccount
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Namespace
+          in: path
+          name: namespace
+          required: true
+          schema:
+            type: string
+        - description: Service account name
+          in: path
+          name: name
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/kubernetes.K8sServiceAccount"
+        "400":
+          description: Invalid request
+        "401":
+          description: Unauthorized
+        "403":
+          description: Permission denied
+        "404":
+          description: Service account not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get a kubernetes service account
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/namespaces/{namespace}/service_accounts/{name}/image_pull_secrets":
+    put:
+      description: >-
+        Replace the imagePullSecrets list on a service account with the provided
+        list.
+
+        **Access policy**: Authenticated user.
+      operationId: UpdateKubernetesServiceAccountImagePullSecrets
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Namespace
+          in: path
+          name: namespace
+          required: true
+          schema:
+            type: string
+        - description: Service account name
+          in: path
+          name: name
+          required: true
+          schema:
+            type: string
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/kubernetes.K8sServiceAccountImagePullSecretsUpdateP\
+                ayload"
+        description: New imagePullSecrets list
+        required: true
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier,
+            namespace, or service account.
+        "500":
+          description: Server error occurred while attempting to update image pull secrets
+            for the service account.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Update image pull secrets for a service account
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/namespaces/{namespace}/services":
+    get:
+      description: |-
+        Get a list of services for a given namespace.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesServicesByNamespace
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Namespace name
+          in: path
+          name: namespace
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/kubernetes.K8sServiceInfo"
+                type: array
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve all services for
+            a namespace.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get a list of services for a given namespace
+      tags:
+        - kubernetes
+    post:
+      description: |-
+        Create a service within a given namespace
+        **Access policy**: Authenticated user.
+      operationId: CreateKubernetesService
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Namespace name
+          in: path
+          name: namespace
+          required: true
+          schema:
+            type: string
+      requestBody:
+        $ref: "#/components/requestBodies/kubernetes.K8sServiceInfo"
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to create a service.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Create a service
+      tags:
+        - kubernetes
+    put:
+      description: |-
+        Update a service within a given namespace.
+        **Access policy**: Authenticated user.
+      operationId: UpdateKubernetesService
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Namespace name
+          in: path
+          name: namespace
+          required: true
+          schema:
+            type: string
+      requestBody:
+        $ref: "#/components/requestBodies/kubernetes.K8sServiceInfo"
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier or
+            unable to find the service to update.
+        "500":
+          description: Server error occurred while attempting to update a service.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Update a service
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/namespaces/{namespace}/system":
+    put:
+      description: |-
+        Toggle the system state for a namespace
+        **Access policy**: Administrator or environment administrator.
+      operationId: KubernetesNamespacesToggleSystem
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Namespace name
+          in: path
+          name: namespace
+          required: true
+          schema:
+            type: string
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/kubernetes.namespacesToggleSystemPayload"
+        description: Update details
+        required: true
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier or
+            unable to find the namespace to update.
+        "500":
+          description: Server error occurred while attempting to update the system state
+            of the namespace.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Toggle the system state for a namespace
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/namespaces/{namespace}/volumes":
+    get:
+      description: >-
+        Get a list of kubernetes volumes within the specified namespace in the
+        given environment (Endpoint). The Endpoint ID must be a valid Portainer
+        environment identifier.
+
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesVolumesInNamespace
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Namespace identifier
+          in: path
+          name: namespace
+          required: true
+          schema:
+            type: string
+        - description: When set to True, include the applications that are using the
+            volumes. It is set to false by default
+          in: query
+          name: withApplications
+          schema:
+            type: boolean
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                additionalProperties:
+                  $ref: "#/components/schemas/kubernetes.K8sVolumeInfo"
+                type: object
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "403":
+          description: Unauthorized access or operation not allowed.
+        "500":
+          description: Server error occurred while attempting to retrieve kubernetes
+            volumes in the namespace.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get Kubernetes volumes within a namespace in the given Portainer
+        environment
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/namespaces/count":
+    get:
+      description: >-
+        Get the total number of kubernetes namespaces within the given
+        environment, including the system namespaces. The total count depends on
+        the user's role and permissions.
+
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesNamespacesCount
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                type: integer
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to compute the namespace
+            count.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get the total number of kubernetes namespaces within the given
+        Portainer environment.
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/nodes":
+    get:
+      description: |-
+        Returns the list of Kubernetes nodes for the selected environment.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesNodes
+      parameters:
+        - description: Environment(Endpoint) identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/kubernetes.KubernetesNodeResponse"
+                type: array
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource.
+        "500":
+          description: Server error occurred while attempting to retrieve the list of nodes.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get Kubernetes cluster nodes
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/nodes/{name}/drain":
+    post:
+      description: >-
+        Drain a Kubernetes node by safely evicting all pods from the node,
+        preparing it for maintenance or removal
+
+        **Access policy**: authenticated
+      operationId: drainNode
+      parameters:
+        - description: Environment(Endpoint) identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Name of the node to drain
+          in: path
+          name: name
+          required: true
+          schema:
+            type: string
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request, such as missing required fields or fields not
+            meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier or
+            unable to find the specified node.
+        "500":
+          description: Server error occurred while attempting to drain node.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Drain a Kubernetes node
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/nodes_limits":
+    get:
+      description: |-
+        Get CPU and memory limits of all nodes within k8s cluster.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesNodesLimits
+      parameters:
+        - description: Environment(Endpoint) identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.K8sNodesLimits"
+        "400":
+          description: Invalid request
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve nodes limits.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get CPU and memory limits of all nodes within k8s cluster
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/persistent_volume_claims":
+    get:
+      description: >-
+        Get a list of all PersistentVolumeClaims within the given environment.
+        Scoped by namespace for non-admin users.
+
+        **Access policy**: Authenticated user.
+      operationId: GetAllKubernetesPersistentVolumeClaims
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/kubernetes.K8sPersistentVolumeClaim"
+                type: array
+        "400":
+          description: Invalid request payload.
+        "403":
+          description: Unauthorized access or operation not allowed.
+        "500":
+          description: Server error occurred while attempting to retrieve persistent
+            volume claims.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get all PersistentVolumeClaims
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/persistent_volume_claims/delete":
+    post:
+      description: |-
+        Delete the provided list of PersistentVolumeClaims.
+        **Access policy**: Authenticated user.
+      operationId: DeleteKubernetesPersistentVolumeClaims
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              items:
+                $ref: "#/components/schemas/kubernetes.K8sVolumeDeleteRequest"
+              type: array
+        description: List of PVCs to delete (namespace + name)
+        required: true
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload.
+        "403":
+          description: Unauthorized access or operation not allowed.
+        "500":
+          description: Server error occurred while attempting to delete persistent volume
+            claims.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Delete PersistentVolumeClaims
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/persistent_volume_claims/resize":
+    put:
+      description: >-
+        Resize a PVC to a new size. The StorageClass must support volume
+        expansion.
+
+        **Access policy**: Authenticated user.
+      operationId: ResizeKubernetesPersistentVolumeClaim
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/kubernetes.K8sPVCResizeRequest"
+        description: PVC resize request
+        required: true
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload.
+        "403":
+          description: Unauthorized access or operation not allowed.
+        "500":
+          description: Server error occurred while attempting to resize the persistent
+            volume claim.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Resize a PersistentVolumeClaim
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/persistent_volumes":
+    get:
+      description: |-
+        Get a list of all PersistentVolumes in the given environment.
+        **Access policy**: Authenticated user.
+      operationId: GetAllKubernetesPersistentVolumes
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/kubernetes.K8sPersistentVolume"
+                type: array
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "403":
+          description: Unauthorized access or operation not allowed.
+        "500":
+          description: Server error occurred while attempting to retrieve persistent
+            volumes.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get all PersistentVolumes in the cluster
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/persistent_volumes/{name}":
+    get:
+      description: |-
+        Get a PersistentVolume by name in the given environment.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesPersistentVolume
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: PersistentVolume name
+          in: path
+          name: name
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/kubernetes.K8sPersistentVolume"
+        "400":
+          description: Invalid request payload.
+        "403":
+          description: Unauthorized access or operation not allowed.
+        "404":
+          description: PersistentVolume not found.
+        "500":
+          description: Server error occurred while attempting to retrieve the persistent
+            volume.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get a specific PersistentVolume
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/persistent_volumes/delete":
+    post:
+      description: |-
+        Delete the provided list of PersistentVolumes.
+        **Access policy**: Authenticated user.
+      operationId: DeleteKubernetesPersistentVolumes
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              items:
+                type: string
+              type: array
+        description: List of PV names to delete
+        required: true
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload.
+        "403":
+          description: Unauthorized access or operation not allowed.
+        "500":
+          description: Server error occurred while attempting to delete persistent volumes.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Delete PersistentVolumes
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/persistent_volumes/reclaim_policy":
+    put:
+      description: |-
+        Update the reclaim policy of a PersistentVolume.
+        **Access policy**: Authenticated user.
+      operationId: UpdateKubernetesPersistentVolumeReclaimPolicy
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/kubernetes.K8sPVReclaimPolicyRequest"
+        description: Reclaim policy update request
+        required: true
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload.
+        "403":
+          description: Unauthorized access or operation not allowed.
+        "500":
+          description: Server error occurred while attempting to update reclaim policy.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Update reclaim policy of a PersistentVolume
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/rbac_enabled":
+    get:
+      description: |-
+        Check if RBAC is enabled in the specified Kubernetes cluster.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesRBACStatus
+      parameters:
+        - description: Environment(Endpoint) identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: RBAC status
+          content:
+            application/json:
+              schema:
+                type: boolean
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve the RBAC status.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Check if RBAC is enabled
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/role_bindings/delete":
+    post:
+      description: |-
+        Delete the provided list of role bindings.
+        **Access policy**: Authenticated user.
+      operationId: DeleteRoleBindings
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/kubernetes.K8sRoleBindingDeleteRequests"
+        description: A map where the key is the namespace and the value is an array of
+          role bindings to delete
+        required: true
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier or
+            unable to find a specific role binding.
+        "500":
+          description: Server error occurred while attempting to delete role bindings.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Delete role bindings
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/rolebindings":
+    get:
+      description: |-
+        Get a list of kubernetes role bindings that the user has access to.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesRoleBindings
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/kubernetes.K8sRoleBinding"
+                type: array
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve the list of role
+            bindings.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get a list of kubernetes role bindings
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/roles":
+    get:
+      description: |-
+        Get a list of kubernetes roles that the user has access to.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesRoles
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/kubernetes.K8sRole"
+                type: array
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve the list of roles.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get a list of kubernetes roles
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/roles/delete":
+    post:
+      description: |-
+        Delete the provided list of roles.
+        **Access policy**: Authenticated user.
+      operationId: DeleteRoles
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/kubernetes.K8sRoleDeleteRequests"
+        description: A map where the key is the namespace and the value is an array of
+          roles to delete
+        required: true
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier or
+            unable to find a specific role.
+        "500":
+          description: Server error occurred while attempting to delete roles.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Delete roles
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/secrets":
+    get:
+      description: >-
+        Get a list of Secrets for a given namespace. If isUsed is set to true,
+        information about the applications that use the secrets is also
+        returned.
+
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesSecrets
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: When set to true, associate the Secrets with the applications that
+            use them
+          in: query
+          name: isUsed
+          required: true
+          schema:
+            type: boolean
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/kubernetes.K8sSecret"
+                type: array
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve all secrets from
+            the cluster.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get a list of Secrets
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/secrets/count":
+    get:
+      description: >-
+        Get the count of Secrets across all namespaces that the user has access
+        to.
+
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesSecretsCount
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                type: integer
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve the count of all
+            secrets from the cluster.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get Secrets count
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/service_accounts/delete":
+    post:
+      description: |-
+        Delete the provided list of service accounts.
+        **Access policy**: Authenticated user.
+      operationId: DeleteServiceAccounts
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/kubernetes.K8sServiceAccountDeleteRequests"
+        description: A map where the key is the namespace and the value is an array of
+          service accounts to delete
+        required: true
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier or
+            unable to find a specific service account.
+        "500":
+          description: Server error occurred while attempting to delete service accounts.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Delete service accounts
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/serviceaccounts":
+    get:
+      description: |-
+        Get a list of kubernetes service accounts that the user has access to.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesServiceAccounts
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/kubernetes.K8sServiceAccount"
+                type: array
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve the list of
+            service accounts.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get a list of kubernetes service accounts
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/services":
+    get:
+      description: |-
+        Get a list of services that the user has access to.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesServices
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Lookup applications associated with each service
+          in: query
+          name: withApplications
+          schema:
+            type: boolean
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/kubernetes.K8sServiceInfo"
+                type: array
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve all services.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get a list of services
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/services/count":
+    get:
+      description: |-
+        Get the count of services that the user has access to.
+        **Access policy**: Authenticated user.
+      operationId: GetAllKubernetesServicesCount
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                type: integer
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve the total count
+            of all services.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get services count
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/services/delete":
+    post:
+      description: |-
+        Delete the provided list of services.
+        **Access policy**: Authenticated user.
+      operationId: DeleteKubernetesServices
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/kubernetes.K8sServiceDeleteRequests"
+        description: A map where the key is the namespace and the value is an array of
+          services to delete
+        required: true
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier or
+            unable to find a specific service.
+        "500":
+          description: Server error occurred while attempting to delete services.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Delete services
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/storage_classes":
+    get:
+      description: |-
+        Get a list of all StorageClasses in the given environment.
+        **Access policy**: Authenticated user.
+      operationId: GetAllKubernetesStorageClasses
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/kubernetes.K8sStorageClass"
+                type: array
+        "400":
+          description: Invalid request payload.
+        "403":
+          description: Unauthorized access or operation not allowed.
+        "500":
+          description: Server error occurred while attempting to retrieve storage classes.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get all StorageClasses
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/storage_classes/{name}":
+    get:
+      description: |-
+        Get a StorageClass by name in the given environment.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesStorageClass
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: StorageClass name
+          in: path
+          name: name
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/kubernetes.K8sStorageClass"
+        "400":
+          description: Invalid request payload.
+        "403":
+          description: Unauthorized access or operation not allowed.
+        "404":
+          description: StorageClass not found.
+        "500":
+          description: Server error occurred while attempting to retrieve the storage class.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get a specific StorageClass
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/storage_classes/{name}/default":
+    put:
+      description: >-
+        Set the specified StorageClass as the cluster default, removing default
+        from any other.
+
+        **Access policy**: Authenticated user.
+      operationId: SetDefaultKubernetesStorageClass
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: StorageClass name
+          in: path
+          name: name
+          required: true
+          schema:
+            type: string
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload.
+        "403":
+          description: Unauthorized access or operation not allowed.
+        "500":
+          description: Server error occurred while attempting to set default storage class.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Set a StorageClass as default
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/storage_classes/delete":
+    post:
+      description: |-
+        Delete the provided list of StorageClasses.
+        **Access policy**: Authenticated user.
+      operationId: DeleteKubernetesStorageClasses
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              items:
+                type: string
+              type: array
+        description: List of StorageClass names to delete
+        required: true
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload.
+        "403":
+          description: Unauthorized access or operation not allowed.
+        "500":
+          description: Server error occurred while attempting to delete storage classes.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Delete StorageClasses
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/version":
+    get:
+      description: |-
+        Get the Kubernetes cluster version (major, minor, gitVersion, ...)
+        as reported by the cluster's discovery API, augmented with capability
+        flags Portainer uses to gate UI features (e.g. supportsPodRestart).
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesVersion
+      parameters:
+        - description: Environment(Endpoint) identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/kubernetes.kubernetesVersionResponse"
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve the cluster
+            version.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get the Kubernetes cluster version and Portainer-relevant capabilities
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/volumes":
+    get:
+      description: >-
+        Get a list of all kubernetes volumes within the given environment
+        (Endpoint). The Endpoint ID must be a valid Portainer environment
+        identifier.
+
+        **Access policy**: Authenticated user.
+      operationId: GetAllKubernetesVolumes
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: When set to True, include the applications that are using the
+            volumes. It is set to false by default
+          in: query
+          name: withApplications
+          schema:
+            type: boolean
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                additionalProperties:
+                  $ref: "#/components/schemas/kubernetes.K8sVolumeInfo"
+                type: object
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "403":
+          description: Unauthorized access or operation not allowed.
+        "500":
+          description: Server error occurred while attempting to retrieve kubernetes
+            volumes.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get Kubernetes volumes within the given Portainer environment
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/volumes/{namespace}/{volume}":
+    get:
+      description: >-
+        Get a Kubernetes volume within the given environment (Endpoint). The
+        Endpoint ID must be a valid Portainer environment identifier.
+
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesVolume
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Namespace identifier
+          in: path
+          name: namespace
+          required: true
+          schema:
+            type: string
+        - description: Volume name
+          in: path
+          name: volume
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/kubernetes.K8sVolumeInfo"
+        "400":
+          description: Invalid request
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get a Kubernetes volume within the given Portainer environment
+      tags:
+        - kubernetes
+  "/kubernetes/{id}/volumes/count":
+    get:
+      description: >-
+        Get the total number of kubernetes volumes within the given environment
+        (Endpoint). The total count depends on the user's role and permissions.
+        The Endpoint ID must be a valid Portainer environment identifier.
+
+        **Access policy**: Authenticated user.
+      operationId: getAllKubernetesVolumesCount
+      parameters:
+        - description: Environment identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                type: integer
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "403":
+          description: Unauthorized access or operation not allowed.
+        "500":
+          description: Server error occurred while attempting to retrieve kubernetes
+            volumes count.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Get the total number of kubernetes volumes within the given Portainer
+        environment.
+      tags:
+        - kubernetes
+  /kubernetes/config:
+    get:
+      description: >-
+        Generate a kubeconfig file that allows a client to communicate with the
+        Kubernetes API server
+
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesConfig
+      parameters:
+        - description: will include only these environments(endpoints)
+          in: query
+          name: ids
+          style: form
+          explode: false
+          schema:
+            type: array
+            items:
+              type: integer
+        - description: will exclude these environments(endpoints)
+          in: query
+          name: excludeIds
+          style: form
+          explode: false
+          schema:
+            type: array
+            items:
+              type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema: {}
+            " application/yaml":
+              schema: {}
+        "400":
+          description: Invalid request payload, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does not
+            have the necessary permissions. Ensure that you have provided a
+            valid API key or JWT token, and that you have the required
+            permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not have the
+            necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to generate the kubeconfig
+            file.
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Generate a kubeconfig file
+      tags:
+        - kubernetes
+  /ldap/check:
+    post:
+      description: |-
+        Test LDAP connectivity using LDAP details
+        **Access policy**: administrator
+      operationId: LDAPCheck
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/ldap.checkPayload"
+        description: details
+        required: true
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Test LDAP connectivity
+      tags:
+        - ldap
+  /motd:
+    get:
+      description: "**Access policy**: restricted"
+      operationId: MOTD
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/motd.Motd"
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: fetches the message of the day
+      tags:
+        - motd
+  /registries:
+    get:
+      description: >-
+        List all registries based on the current user authorizations.
+
+        Will return all registries if using an administrator account otherwise it
+
+        will only return authorized registries.
+
+        **Access policy**: restricted
+      operationId: RegistryList
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/portainer.Registry"
+                type: array
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: List Registries
+      tags:
+        - registries
+    post:
+      description: |-
+        Create a new registry.
+        **Access policy**: restricted
+      operationId: RegistryCreate
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/registries.registryCreatePayload"
+        description: Registry details
+        required: true
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.Registry"
+        "400":
+          description: Invalid request
+        "409":
+          description: Another registry with the same name or same URL & credentials
+            already exists
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Create a new registry
+      tags:
+        - registries
+  "/registries/{id}":
+    delete:
+      description: |-
+        Remove a registry
+        **Access policy**: restricted
+      operationId: RegistryDelete
+      parameters:
+        - description: Registry identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "404":
+          description: Registry not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Remove a registry
+      tags:
+        - registries
+    get:
+      description: |-
+        Retrieve details about a registry.
+        **Access policy**: restricted
+      operationId: RegistryInspect
+      parameters:
+        - description: Registry identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.Registry"
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied to access registry
+        "404":
+          description: Registry not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Inspect a registry
+      tags:
+        - registries
+    put:
+      description: |-
+        Update a registry
+        **Access policy**: restricted
+      operationId: RegistryUpdate
+      parameters:
+        - description: Registry identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/registries.registryUpdatePayload"
+        description: Registry details
+        required: true
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.Registry"
+        "400":
+          description: Invalid request
+        "404":
+          description: Registry not found
+        "409":
+          description: Another registry with the same name or same URL & credentials
+            already exists
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Update a registry
+      tags:
+        - registries
+  "/registries/{id}/configure":
+    post:
+      description: |-
+        Configures a registry.
+        **Access policy**: restricted
+      operationId: RegistryConfigure
+      parameters:
+        - description: Registry identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/registries.registryConfigurePayload"
+        description: Registry configuration
+        required: true
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: Registry not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Configures a registry
+      tags:
+        - registries
+  /registries/ping:
+    post:
+      description: |-
+        Test connection to a registry with provided credentials
+        **Access policy**: authenticated
+      operationId: RegistryPing
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/registries.registryPingPayload"
+        description: Registry credentials to test
+        required: true
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/registries.registryPingResponse"
+        "400":
+          description: Invalid request
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Test registry connection
+      tags:
+        - registries
+  /resource_controls:
+    post:
+      description: |-
+        Create a new resource control to restrict access to a Docker resource.
+        **Access policy**: administrator
+      operationId: ResourceControlCreate
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/resourcecontrols.resourceControlCreatePayload"
+        description: Resource control details
+        required: true
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.ResourceControl"
+        "400":
+          description: Invalid request
+        "409":
+          description: A resource control is already associated to this resource
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Create a new resource control
+      tags:
+        - resource_controls
+  "/resource_controls/{id}":
+    delete:
+      description: |-
+        Remove a resource control.
+        **Access policy**: administrator
+      operationId: ResourceControlDelete
+      parameters:
+        - description: Resource control identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "404":
+          description: Resource control not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Remove a resource control
+      tags:
+        - resource_controls
+    put:
+      description: |-
+        Update a resource control
+        **Access policy**: authenticated
+      operationId: ResourceControlUpdate
+      parameters:
+        - description: Resource control identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/resourcecontrols.resourceControlUpdatePayload"
+        description: Resource control details
+        required: true
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.ResourceControl"
+        "400":
+          description: Invalid request
+        "403":
+          description: Unauthorized
+        "404":
+          description: Resource control not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Update a resource control
+      tags:
+        - resource_controls
+  /restore:
+    post:
+      description: >-
+        Triggers a system restore using provided backup file
+
+        **Access policy**: public (requires the X-Setup-Token header on an uninitialized instance unless --no-setup-token is set)
+      operationId: Restore
+      parameters:
+        - description: Setup token (required when instance is uninitialized and
+            --no-setup-token is not set)
+          in: header
+          name: X-Setup-Token
+          schema:
+            type: string
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/backup.restorePayload"
+        description: Restore request payload
+        required: true
+      responses:
+        "200":
+          description: Success
+        "400":
+          description: Invalid request
+        "403":
+          description: Access denied - invalid or missing setup token
+        "500":
+          description: Server error
+      summary: Triggers a system restore using provided backup file
+      tags:
+        - backup
+  /roles:
+    get:
+      description: |-
+        List all roles available for use
+        **Access policy**: administrator
+      operationId: RoleList
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/portainer.Role"
+                type: array
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: List roles
+      tags:
+        - roles
+  /settings:
+    get:
+      description: |-
+        Retrieve Portainer settings.
+        **Access policy**: administrator
+      operationId: SettingsInspect
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.Settings"
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Retrieve Portainer settings
+      tags:
+        - settings
+    put:
+      description: |-
+        Update Portainer settings.
+        **Access policy**: administrator
+      operationId: SettingsUpdate
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/settings.settingsUpdatePayload"
+        description: New settings
+        required: true
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.Settings"
+        "400":
+          description: Invalid request
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Update Portainer settings
+      tags:
+        - settings
+  /settings/public:
+    get:
+      description: >-
+        Retrieve public settings. Returns a small set of settings that are not
+        reserved to administrators only.
+
+        **Access policy**: public
+      operationId: SettingsPublic
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/settings.publicSettingsResponse"
+        "500":
+          description: Server error
+      summary: Retrieve Portainer public settings
+      tags:
+        - settings
+  /ssl:
+    get:
+      description: |-
+        Retrieve the ssl settings.
+        **Access policy**: administrator
+      operationId: SSLInspect
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.SSLSettings"
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied to access settings
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Inspect the ssl settings
+      tags:
+        - ssl
+    put:
+      description: |-
+        Update the ssl settings.
+        **Access policy**: administrator
+      operationId: SSLUpdate
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/ssl.sslUpdatePayload"
+        description: SSL Settings
+        required: true
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied to access settings
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Update the ssl settings
+      tags:
+        - ssl
+  /stacks:
+    get:
+      description: |-
+        List all stacks based on the current user authorizations.
+        Will return all stacks if using an administrator account otherwise it
+        will only return the list of stacks the user have access to.
+        Limited stacks will not be returned by this endpoint.
+        **Access policy**: authenticated
+      operationId: StackList
+      parameters:
+        - description: "Filters to process on the stack list. Encoded as JSON (a
+            map[string]string). For example, {'SwarmID':
+            'jpofkc0i9uo9wtx1zesuk649w'} will only return stacks that are part
+            of the specified Swarm cluster. Available filters: EndpointID,
+            SwarmID."
+          in: query
+          name: filters
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Success
+          content:
+            "*/*":
+              schema:
+                items:
+                  $ref: "#/components/schemas/portainer.Stack"
+                type: array
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: List stacks
+      tags:
+        - stacks
+  "/stacks/{id}":
+    delete:
+      description: |-
+        Remove a stack.
+        **Access policy**: restricted
+      operationId: StackDelete
+      parameters:
+        - description: Stack identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Set to true to delete an external stack. Only external Swarm stacks
+            are supported
+          in: query
+          name: external
+          schema:
+            type: boolean
+        - description: Environment identifier
+          in: query
+          name: endpointId
+          required: true
+          schema:
+            type: integer
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: Not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Remove a stack
+      tags:
+        - stacks
+    get:
+      description: |-
+        Retrieve details about a stack.
+        **Access policy**: restricted
+      operationId: StackInspect
+      parameters:
+        - description: Stack identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/stacks.stackResponse"
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: Stack not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Inspect a stack
+      tags:
+        - stacks
+    put:
+      description: |-
+        Update a stack, only for file based stacks.
+        **Access policy**: authenticated
+      operationId: StackUpdate
+      parameters:
+        - description: Stack identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Environment identifier
+          in: query
+          name: endpointId
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/stacks.updateSwarmStackPayload"
+        description: Stack details
+        required: true
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.Stack"
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: Not found
+        "409":
+          description: Conflict
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Update a stack
+      tags:
+        - stacks
+  "/stacks/{id}/associate":
+    put:
+      description: "**Access policy**: administrator"
+      operationId: StackAssociate
+      parameters:
+        - description: Stack identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Environment identifier
+          in: query
+          name: endpointId
+          required: true
+          schema:
+            type: integer
+        - description: Swarm identifier
+          in: query
+          name: swarmId
+          required: true
+          schema:
+            type: integer
+        - description: Indicates whether the stack is orphaned
+          in: query
+          name: orphanedRunning
+          required: true
+          schema:
+            type: boolean
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.Stack"
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: Stack not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Associate an orphaned stack to a new environment(endpoint)
+      tags:
+        - stacks
+  "/stacks/{id}/file":
+    get:
+      description: |-
+        Get Stack file content.
+        **Access policy**: restricted
+      operationId: StackFileInspect
+      parameters:
+        - description: Stack identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/stacks.stackFileResponse"
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: Stack not found
+        "409":
+          description: Git settings changed, redeploy required
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Retrieve the content of the Stack file for the specified stack
+      tags:
+        - stacks
+  "/stacks/{id}/git":
+    post:
+      description: >-
+        Update the Git settings in a stack, e.g., RepositoryReferenceName and
+        AutoUpdate. When SourceID is set, URL/auth/TLS are taken from the
+        referenced Source.
+
+        **Access policy**: authenticated
+      operationId: StackUpdateGit
+      parameters:
+        - description: Stack identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Stacks created before version 1.18.0 might not have an associated
+            environment(endpoint) identifier. Use this optional parameter to set
+            the environment(endpoint) identifier used by the stack.
+          in: query
+          name: endpointId
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/stacks.stackGitUpdatePayload"
+        description: Git configs for pull and redeploy a stack
+        required: true
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/stacks.stackResponse"
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: Not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Update a stack's Git configs
+      tags:
+        - stacks
+  "/stacks/{id}/git/redeploy":
+    put:
+      description: |-
+        Pull and redeploy a stack via Git
+        **Access policy**: authenticated
+      operationId: StackGitRedeploy
+      parameters:
+        - description: Stack identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Stacks created before version 1.18.0 might not have an associated
+            environment(endpoint) identifier. Use this optional parameter to set
+            the environment(endpoint) identifier used by the stack.
+          in: query
+          name: endpointId
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/stacks.stackGitRedeployPayload"
+        description: Git configs for pull and redeploy of a stack. **StackName** may
+          only be populated for Kuberenetes stacks, and if specified with a
+          blank string, it will be set to blank
+        required: true
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.Stack"
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: Not found
+        "409":
+          description: Conflict
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Redeploy a stack
+      tags:
+        - stacks
+  "/stacks/{id}/migrate":
+    post:
+      description: >-
+        Migrate a stack from an environment(endpoint) to another
+        environment(endpoint). It will re-create the stack inside the target
+        environment(endpoint) before removing the original stack.
+
+        **Access policy**: authenticated
+      operationId: StackMigrate
+      parameters:
+        - description: Stack identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Stacks created before version 1.18.0 might not have an associated
+            environment(endpoint) identifier. Use this optional parameter to set
+            the environment(endpoint) identifier used by the stack.
+          in: query
+          name: endpointId
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/stacks.stackMigratePayload"
+        description: Stack migration details
+        required: true
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.Stack"
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: Stack not found
+        "409":
+          description: A stack with the same name is already running on the target
+            environment(endpoint)
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Migrate a stack to another environment(endpoint)
+      tags:
+        - stacks
+  "/stacks/{id}/start":
+    post:
+      description: |-
+        Starts a stopped Stack.
+        **Access policy**: authenticated
+      operationId: StackStart
+      parameters:
+        - description: Stack identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Environment identifier
+          in: query
+          name: endpointId
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            "*/*":
+              schema:
+                $ref: "#/components/schemas/portainer.Stack"
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: Not found
+        "409":
+          description: Stack is already active, deploying, or in error state
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Starts a stopped Stack
+      tags:
+        - stacks
+  "/stacks/{id}/stop":
+    post:
+      description: |-
+        Stop a running Stack.
+        **Access policy**: authenticated
+      operationId: StackStop
+      parameters:
+        - description: Stack identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Environment identifier
+          in: query
+          name: endpointId
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            "*/*":
+              schema:
+                $ref: "#/components/schemas/portainer.Stack"
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: Not found
+        "409":
+          description: Conflict
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Stop a running Stack
+      tags:
+        - stacks
+  /stacks/create/kubernetes/repository:
+    post:
+      description: >-
+        Deploy a new stack into a Docker environment specified via the
+        environment identifier.
+
+        **Access policy**: authenticated
+      operationId: StackCreateKubernetesGit
+      parameters:
+        - description: Identifier of the environment that will be used to deploy the stack
+          in: query
+          name: endpointId
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/stacks.kubernetesGitDeploymentPayload"
+        description: stack config
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.Stack"
+        "400":
+          description: Invalid request
+        "409":
+          description: Stack name or webhook ID already exists
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Deploy a new kubernetes stack from a git repository
+      tags:
+        - stacks
+  /stacks/create/kubernetes/string:
+    post:
+      description: >-
+        Deploy a new stack into a Docker environment specified via the
+        environment identifier.
+
+        **Access policy**: authenticated
+      operationId: StackCreateKubernetesFile
+      parameters:
+        - description: Identifier of the environment that will be used to deploy the stack
+          in: query
+          name: endpointId
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/stacks.kubernetesStringDeploymentPayload"
+        description: stack config
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.Stack"
+        "400":
+          description: Invalid request
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Deploy a new kubernetes stack from a file
+      tags:
+        - stacks
+  /stacks/create/kubernetes/url:
+    post:
+      description: >-
+        Deploy a new stack into a Docker environment specified via the
+        environment identifier.
+
+        **Access policy**: authenticated
+      operationId: StackCreateKubernetesUrl
+      parameters:
+        - description: Identifier of the environment that will be used to deploy the stack
+          in: query
+          name: endpointId
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/stacks.kubernetesManifestURLDeploymentPayload"
+        description: stack config
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.Stack"
+        "400":
+          description: Invalid request
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Deploy a new kubernetes stack from a url
+      tags:
+        - stacks
+  /stacks/create/standalone/file:
+    post:
+      description: >-
+        Deploy a new stack into a Docker environment specified via the
+        environment identifier.
+
+        **Access policy**: authenticated
+      operationId: StackCreateDockerStandaloneFile
+      parameters:
+        - description: Identifier of the environment that will be used to deploy the stack
+          in: query
+          name: endpointId
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              properties:
+                Name:
+                  description: Name of the stack
+                  type: string
+                Env:
+                  description: "Environment variables passed during deployment, represented as a
+                    JSON array [{'name': 'name', 'value': 'value'}]."
+                  type: string
+                file:
+                  description: Stack file
+                  type: string
+                  format: binary
+              required:
+                - Name
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.Stack"
+        "400":
+          description: Invalid request
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Deploy a new compose stack from a file
+      tags:
+        - stacks
+  /stacks/create/standalone/repository:
+    post:
+      description: >-
+        Deploy a new stack into a Docker environment specified via the
+        environment identifier.
+
+        **Access policy**: authenticated
+      operationId: StackCreateDockerStandaloneRepository
+      parameters:
+        - description: Identifier of the environment that will be used to deploy the stack
+          in: query
+          name: endpointId
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/stacks.composeStackFromGitRepositoryPayload"
+        description: stack config
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.Stack"
+        "400":
+          description: Invalid request
+        "409":
+          description: Stack name or webhook ID already exists
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Deploy a new compose stack from repository
+      tags:
+        - stacks
+  /stacks/create/standalone/string:
+    post:
+      description: >-
+        Deploy a new stack into a Docker environment specified via the
+        environment identifier.
+
+        **Access policy**: authenticated
+      operationId: StackCreateDockerStandaloneString
+      parameters:
+        - description: Identifier of the environment that will be used to deploy the stack
+          in: query
+          name: endpointId
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/stacks.composeStackFromFileContentPayload"
+        description: stack config
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.Stack"
+        "400":
+          description: Invalid request
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Deploy a new compose stack from a text
+      tags:
+        - stacks
+  /stacks/create/swarm/file:
+    post:
+      description: >-
+        Deploy a new stack into a Docker environment specified via the
+        environment identifier.
+
+        **Access policy**: authenticated
+      operationId: StackCreateDockerSwarmFile
+      parameters:
+        - description: Identifier of the environment that will be used to deploy the stack
+          in: query
+          name: endpointId
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              properties:
+                Name:
+                  description: Name of the stack
+                  type: string
+                SwarmID:
+                  description: Swarm cluster identifier.
+                  type: string
+                Env:
+                  description: "Environment variables passed during deployment, represented as a
+                    JSON array [{'name': 'name', 'value': 'value'}]. Optional"
+                  type: string
+                file:
+                  description: Stack file
+                  type: string
+                  format: binary
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.Stack"
+        "400":
+          description: Invalid request
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Deploy a new swarm stack from a file
+      tags:
+        - stacks
+  /stacks/create/swarm/repository:
+    post:
+      description: >-
+        Deploy a new stack into a Docker environment specified via the
+        environment identifier.
+
+        **Access policy**: authenticated
+      operationId: StackCreateDockerSwarmRepository
+      parameters:
+        - description: Identifier of the environment that will be used to deploy the stack
+          in: query
+          name: endpointId
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/stacks.swarmStackFromGitRepositoryPayload"
+        description: stack config
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.Stack"
+        "400":
+          description: Invalid request
+        "409":
+          description: Stack name or webhook ID already exists
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Deploy a new swarm stack from a git repository
+      tags:
+        - stacks
+  /stacks/create/swarm/string:
+    post:
+      description: >-
+        Deploy a new stack into a Docker environment specified via the
+        environment identifier.
+
+        **Access policy**: authenticated
+      operationId: StackCreateDockerSwarmString
+      parameters:
+        - description: Identifier of the environment that will be used to deploy the stack
+          in: query
+          name: endpointId
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/stacks.swarmStackFromFileContentPayload"
+        description: stack config
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.Stack"
+        "400":
+          description: Invalid request
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Deploy a new swarm stack from a text
+      tags:
+        - stacks
+  "/stacks/name/{name}":
+    delete:
+      description: |-
+        Remove a stack.
+        **Access policy**: restricted
+      operationId: StackDeleteKubernetesByName
+      parameters:
+        - description: Stack name
+          in: path
+          name: name
+          required: true
+          schema:
+            type: string
+        - description: Set to true to delete an external stack. Only external Swarm stacks
+            are supported
+          in: query
+          name: external
+          schema:
+            type: boolean
+        - description: Environment identifier
+          in: query
+          name: endpointId
+          required: true
+          schema:
+            type: integer
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: Not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Remove Kubernetes stacks by name
+      tags:
+        - stacks
+  "/stacks/webhooks/{webhookID}":
+    post:
+      description: "**Access policy**: public"
+      operationId: WebhookInvoke
+      parameters:
+        - description: Stack identifier
+          in: path
+          name: webhookID
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Success
+        "400":
+          description: Invalid request
+        "409":
+          description: Autoupdate for the stack isn't available" or "Stack deployment is
+            already in progress
+        "500":
+          description: Server error
+      summary: Webhook for triggering stack updates from git
+      tags:
+        - stacks
+  /status:
+    get:
+      deprecated: true
+      description: |-
+        Deprecated: use the `/system/status` endpoint instead.
+        Retrieve Portainer status
+        **Access policy**: public
+      operationId: StatusInspect
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/system.status"
+      summary: Check Portainer status
+      tags:
+        - status
+  /system/info:
+    get:
+      description: "**Access policy**: authenticated"
+      operationId: systemInfo
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/system.systemInfoResponse"
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Retrieve system info
+      tags:
+        - system
+  /system/nodes:
+    get:
+      description: "**Access policy**: authenticated"
+      operationId: systemNodesCount
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/system.nodesCountResponse"
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Retrieve the count of nodes
+      tags:
+        - system
+  /system/status:
+    get:
+      description: |-
+        Retrieve Portainer status
+        **Access policy**: public
+      operationId: systemStatus
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/system.status"
+      summary: Check Portainer status
+      tags:
+        - system
+  /system/upgrade:
+    post:
+      description: |-
+        Upgrade Portainer to BE
+        **Access policy**: administrator
+      operationId: systemUpgrade
+      responses:
+        "204":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/system.status"
+      summary: Upgrade Portainer to BE
+      tags:
+        - system
+  /system/version:
+    get:
+      description: |-
+        Check if portainer has an update available
+        **Access policy**: authenticated
+      operationId: systemVersion
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/system.versionResponse"
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Check for portainer updates
+      tags:
+        - system
+  /tags:
+    get:
+      description: |-
+        List tags.
+        **Access policy**: authenticated
+      operationId: TagList
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/portainer.Tag"
+                type: array
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: List tags
+      tags:
+        - tags
+    post:
+      description: |-
+        Create a new tag.
+        **Access policy**: administrator
+      operationId: TagCreate
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/tags.tagCreatePayload"
+        description: Tag details
+        required: true
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.Tag"
+        "409":
+          description: This name is already associated to a tag
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Create a new tag
+      tags:
+        - tags
+  "/tags/{id}":
+    delete:
+      description: |-
+        Remove a tag.
+        **Access policy**: administrator
+      operationId: TagDelete
+      parameters:
+        - description: Tag identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: Tag not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Remove a tag
+      tags:
+        - tags
+  /team_memberships:
+    get:
+      description: >-
+        List team memberships. Access is only available to administrators and
+        team leaders.
+
+        **Access policy**: administrator
+      operationId: TeamMembershipList
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/portainer.TeamMembership"
+                type: array
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: List team memberships
+      tags:
+        - team_memberships
+    post:
+      description: >-
+        Create a new team memberships. Access is only available to
+        administrators leaders of the associated team.
+
+        **Access policy**: administrator
+      operationId: TeamMembershipCreate
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/teammemberships.teamMembershipCreatePayload"
+        description: Team membership details
+        required: true
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.TeamMembership"
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied to manage memberships
+        "409":
+          description: Team membership already registered
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Create a new team membership
+      tags:
+        - team_memberships
+  "/team_memberships/{id}":
+    delete:
+      description: >-
+        Remove a team membership. Access is only available to administrators
+        leaders of the associated team.
+
+        **Access policy**: administrator
+      operationId: TeamMembershipDelete
+      parameters:
+        - description: TeamMembership identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: TeamMembership not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Remove a team membership
+      tags:
+        - team_memberships
+    put:
+      description: >-
+        Update a team membership. Access is only available to administrators or
+        leaders of the associated team.
+
+        **Access policy**: administrator or leaders of the associated team
+      operationId: TeamMembershipUpdate
+      parameters:
+        - description: Team membership identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/teammemberships.teamMembershipUpdatePayload"
+        description: Team membership details
+        required: true
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.TeamMembership"
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: TeamMembership not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Update a team membership
+      tags:
+        - team_memberships
+  /teams:
+    get:
+      description: >-
+        List teams. For non-administrator users, will only list the teams they
+        are member of.
+
+        **Access policy**: restricted
+      operationId: TeamList
+      parameters:
+        - description: Only list teams that the user is leader of
+          in: query
+          name: onlyLedTeams
+          schema:
+            type: boolean
+        - description: Identifier of the environment(endpoint) that will be used to filter
+            the authorized teams
+          in: query
+          name: environmentId
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/portainer.Team"
+                type: array
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: List teams
+      tags:
+        - teams
+    post:
+      description: |-
+        Create a new team.
+        **Access policy**: administrator
+      operationId: TeamCreate
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/teams.teamCreatePayload"
+        description: details
+        required: true
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.Team"
+        "400":
+          description: Invalid request
+        "409":
+          description: A team with the same name already exists
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Create a new team
+      tags:
+        - teams
+  "/teams/{id}":
+    delete:
+      description: |-
+        Remove a team.
+        **Access policy**: administrator
+      operationId: TeamDelete
+      parameters:
+        - description: Team Id
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: Team not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Remove a team
+      tags:
+        - teams
+    get:
+      description: >-
+        Retrieve details about a team. Access is only available for
+        administrator and leaders of that team.
+
+        **Access policy**: administrator
+      operationId: TeamInspect
+      parameters:
+        - description: Team identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.Team"
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: Team not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Inspect a team
+      tags:
+        - teams
+    put:
+      description: |-
+        Update a team.
+        **Access policy**: administrator
+      operationId: TeamUpdate
+      parameters:
+        - description: Team identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/teams.teamUpdatePayload"
+        description: Team details
+        required: true
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.Team"
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: Team not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Update a team
+      tags:
+        - teams
+  "/teams/{id}/memberships":
+    get:
+      description: >-
+        List team memberships. Access is only available to administrators and
+        team leaders.
+
+        **Access policy**: restricted
+      operationId: TeamMemberships
+      parameters:
+        - description: Team Id
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/portainer.TeamMembership"
+                type: array
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: List team memberships
+      tags:
+        - team_memberships
+  /templates:
+    get:
+      description: |-
+        List available templates.
+        **Access policy**: authenticated
+      operationId: TemplateList
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/templates.listResponse"
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: List available templates
+      tags:
+        - templates
+  "/templates/{id}/file":
+    post:
+      description: |-
+        Get a template's file
+        **Access policy**: authenticated
+      operationId: TemplateFile
+      parameters:
+        - description: Template identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/templates.fileResponse"
+        "400":
+          description: Invalid request
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Get a template's file
+      tags:
+        - templates
+  /templates/helm:
+    get:
+      description: "**Access policy**: authenticated"
+      operationId: HelmRepoSearch
+      parameters:
+        - description: Helm repository URL
+          in: query
+          name: repo
+          required: true
+          schema:
+            type: string
+        - description: Helm chart name
+          in: query
+          name: chart
+          schema:
+            type: string
+        - description: If true will use cache to search
+          in: query
+          name: useCache
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                type: string
+        "400":
+          description: Bad request
+        "401":
+          description: Unauthorized
+        "404":
+          description: Not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Search Helm Charts
+      tags:
+        - helm
+  "/templates/helm/{command}":
+    get:
+      description: "**Access policy**: authenticated"
+      operationId: HelmShow
+      parameters:
+        - description: Helm repository URL
+          in: query
+          name: repo
+          required: true
+          schema:
+            type: string
+        - description: Chart name
+          in: query
+          name: chart
+          required: true
+          schema:
+            type: string
+        - description: Chart version
+          in: query
+          name: version
+          schema:
+            type: string
+        - description: chart/values/readme
+          in: path
+          name: command
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Success
+          content:
+            text/plain:
+              schema:
+                type: string
+        "401":
+          description: Unauthorized
+        "404":
+          description: Environment(Endpoint) or ServiceAccount not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Show Helm Chart Information
+      tags:
+        - helm
+  "/upload/tls/{certificate}":
+    post:
+      description: |-
+        Use this environment(endpoint) to upload TLS files.
+        **Access policy**: administrator
+      operationId: UploadTLS
+      parameters:
+        - description: TLS file type. Valid values are 'ca', 'cert' or 'key'.
+          in: path
+          name: certificate
+          required: true
+          schema:
+            type: string
+            enum:
+              - ca
+              - cert
+              - key
+      requestBody:
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              properties:
+                folder:
+                  description: Folder where the TLS file will be stored. Will be created if not
+                    existing
+                  type: string
+                file:
+                  description: The file to upload
+                  type: string
+                  format: binary
+              required:
+                - folder
+                - file
+        required: true
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Upload TLS files
+      tags:
+        - upload
+  /users:
+    get:
+      description: >-
+        List Portainer users.
+
+        Non-administrator users will only be able to list other non-administrator user accounts.
+
+        User passwords are filtered out, and should never be accessible.
+
+        **Access policy**: restricted
+      operationId: UserList
+      parameters:
+        - description: Identifier of the environment(endpoint) that will be used to filter
+            the authorized users
+          in: query
+          name: environmentId
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/portainer.User"
+                type: array
+        "400":
+          description: Invalid request
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: List users
+      tags:
+        - users
+    post:
+      description: |-
+        Create a new Portainer user.
+        Only administrators can create users.
+        **Access policy**: restricted
+      operationId: UserCreate
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/users.userCreatePayload"
+        description: User details
+        required: true
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.User"
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "409":
+          description: User already exists
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Create a new user
+      tags:
+        - users
+  "/users/{id}":
+    delete:
+      description: |-
+        Remove a user.
+        **Access policy**: administrator
+      operationId: UserDelete
+      parameters:
+        - description: User identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: User not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Remove a user
+      tags:
+        - users
+    get:
+      description: |-
+        Retrieve details about a user.
+        User passwords are filtered out, and should never be accessible.
+        **Access policy**: authenticated
+      operationId: UserInspect
+      parameters:
+        - description: User identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.User"
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: User not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Inspect a user
+      tags:
+        - users
+    put:
+      description: |-
+        Update user details. A regular user account can only update his details.
+        A regular user account cannot change their username or role.
+        **Access policy**: authenticated
+      operationId: UserUpdate
+      parameters:
+        - description: User identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/users.userUpdatePayload"
+        description: User details
+        required: true
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.User"
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: User not found
+        "409":
+          description: Username already exist
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Update a user
+      tags:
+        - users
+  "/users/{id}/effective-access":
+    get:
+      description: |-
+        Returns the resolved role for each environment the user can access,
+        following the policy precedence used by the access viewer
+        (user-endpoint, user-group, team-endpoint, team-group).
+        Environments where the user has no role are omitted.
+        **Access policy**: restricted
+      operationId: UserEffectiveAccessInspect
+      parameters:
+        - description: User identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/users.EffectiveAccessEntry"
+                type: array
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: User not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+          jwt: []
+      summary: Inspect a user's effective access on every environment
+      tags:
+        - users
+  "/users/{id}/helm/repositories":
+    get:
+      description: |-
+        Inspect a user helm repositories.
+        **Access policy**: authenticated
+      operationId: HelmUserRepositoriesList
+      parameters:
+        - description: User identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/users.helmUserRepositoryResponse"
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: List a users helm repositories
+      tags:
+        - helm
+    post:
+      description: |-
+        Create a user helm repository.
+        **Access policy**: authenticated
+      operationId: HelmUserRepositoryCreate
+      parameters:
+        - description: User identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/users.addHelmRepoUrlPayload"
+        description: Helm Repository
+        required: true
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.HelmUserRepository"
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Create a user helm repository
+      tags:
+        - helm
+  "/users/{id}/helm/repositories/{repositoryID}":
+    delete:
+      description: "**Access policy**: authenticated"
+      operationId: HelmUserRepositoryDelete
+      parameters:
+        - description: User identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Repository identifier
+          in: path
+          name: repositoryID
+          required: true
+          schema:
+            type: integer
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Delete a users helm repositoryies
+      tags:
+        - helm
+  "/users/{id}/memberships":
+    get:
+      description: |-
+        Inspect a user memberships.
+        **Access policy**: restricted
+      operationId: UserMembershipsInspect
+      parameters:
+        - description: User identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.TeamMembership"
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Inspect a user memberships
+      tags:
+        - users
+  "/users/{id}/passwd":
+    put:
+      description: |-
+        Update password for the specified user.
+        **Access policy**: authenticated
+      operationId: UserUpdatePassword
+      parameters:
+        - description: identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/users.userUpdatePasswordPayload"
+        description: details
+        required: true
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: User not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Update password for a user
+      tags:
+        - users
+  "/users/{id}/tokens":
+    get:
+      description: |-
+        Gets all API keys for a user.
+        Only the calling user or admin can retrieve api-keys.
+        **Access policy**: authenticated
+      operationId: UserGetAPIKeys
+      parameters:
+        - description: User identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/portainer.APIKey"
+                type: array
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: User not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Get all API keys for a user
+      tags:
+        - users
+    post:
+      description: |-
+        Generates an API key for a user.
+        Only the calling user can generate a token for themselves.
+        Password is required only for internal authentication.
+        **Access policy**: restricted
+      operationId: UserGenerateAPIKey
+      parameters:
+        - description: User identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/users.userAccessTokenCreatePayload"
+        description: details
+        required: true
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/users.accessTokenResponse"
+        "400":
+          description: Invalid request
+        "401":
+          description: Unauthorized
+        "403":
+          description: Permission denied
+        "404":
+          description: User not found
+        "500":
+          description: Server error
+      security:
+        - jwt: []
+      summary: Generate an API key for a user
+      tags:
+        - users
+  "/users/{id}/tokens/{keyID}":
+    delete:
+      description: |-
+        Remove an api-key associated to a user..
+        Only the calling user or admin can remove api-key.
+        **Access policy**: authenticated
+      operationId: UserRemoveAPIKey
+      parameters:
+        - description: User identifier
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+        - description: Api Key identifier
+          in: path
+          name: keyID
+          required: true
+          schema:
+            type: integer
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: Not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Remove an api-key associated to a user
+      tags:
+        - users
+  /users/admin/check:
+    get:
+      description: |-
+        Check if an administrator account exists in the database.
+        **Access policy**: public
+      operationId: UserAdminCheck
+      responses:
+        "204":
+          description: Success
+        "404":
+          description: User not found
+      summary: Check administrator account existence
+      tags:
+        - users
+  /users/admin/init:
+    post:
+      description: >-
+        Initialize the 'admin' user account.
+
+        **Access policy**: public (requires the X-Setup-Token header on an uninitialized instance unless --no-setup-token is set)
+      operationId: UserAdminInit
+      parameters:
+        - description: Setup token (required when instance is uninitialized and
+            --no-setup-token is not set)
+          in: header
+          name: X-Setup-Token
+          schema:
+            type: string
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/users.adminInitPayload"
+        description: User details
+        required: true
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.User"
+        "400":
+          description: Invalid request
+        "403":
+          description: Access denied - invalid or missing setup token
+        "409":
+          description: Admin user already initialized
+        "500":
+          description: Server error
+      summary: Initialize administrator account
+      tags:
+        - users
+  /users/me:
+    get:
+      description: |-
+        Retrieve details about the current  user.
+        User passwords are filtered out, and should never be accessible.
+        **Access policy**: authenticated
+      operationId: CurrentUserInspect
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.User"
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: User not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Inspect the current user user
+      tags:
+        - users
+  /webhooks:
+    get:
+      description: "**Access policy**: authenticated"
+      parameters:
+        - description: Filters (json-string)
+          example: '{"EndpointID":1,"ResourceID":"abc12345-abcd-2345-ab12-58005b4a0260"}'
+          in: query
+          name: filters
+          schema:
+            type: string
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: "#/components/schemas/portainer.Webhook"
+                type: array
+        "400":
+          description: Bad Request
+        "500":
+          description: Internal Server Error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: List webhooks
+      tags:
+        - webhooks
+    post:
+      description: "**Access policy**: authenticated"
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/webhooks.webhookCreatePayload"
+        description: Webhook data
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.Webhook"
+        "400":
+          description: Invalid request
+        "409":
+          description: A webhook for this resource already exists
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Create a webhook
+      tags:
+        - webhooks
+  "/webhooks/{id}":
+    delete:
+      description: "**Access policy**: authenticated"
+      parameters:
+        - description: Webhook id
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      responses:
+        "202":
+          description: Webhook deleted
+        "400":
+          description: Bad Request
+        "500":
+          description: Internal Server Error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Delete a webhook
+      tags:
+        - webhooks
+    post:
+      description: |-
+        Acts on a passed in token UUID to restart the docker service
+        **Access policy**: public
+      parameters:
+        - description: Webhook token
+          in: path
+          name: id
+          required: true
+          schema:
+            type: string
+      responses:
+        "202":
+          description: Webhook executed
+        "400":
+          description: Bad Request
+        "500":
+          description: Internal Server Error
+      summary: Execute a webhook
+      tags:
+        - webhooks
+    put:
+      description: "**Access policy**: authenticated"
+      parameters:
+        - description: Webhook id
+          in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/webhooks.webhookUpdatePayload"
+        description: Webhook data
+        required: true
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/portainer.Webhook"
+        "400":
+          description: Bad Request
+        "409":
+          description: Conflict
+        "500":
+          description: Internal Server Error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Update a webhook
+      tags:
+        - webhooks
+  /websocket/attach:
+    get:
+      description: >-
+        If the nodeName query parameter is present, the request will be proxied
+        to the underlying agent environment(endpoint).
+
+        If the nodeName query parameter is not specified, the request will be upgraded to the websocket protocol and
+
+        an AttachStart operation HTTP request will be created and hijacked.
+
+        **Access policy**: authenticated
+      parameters:
+        - description: environment(endpoint) ID of the environment(endpoint) where the
+            resource is located
+          in: query
+          name: endpointId
+          required: true
+          schema:
+            type: integer
+        - description: node name
+          in: query
+          name: nodeName
+          schema:
+            type: string
+      responses:
+        "200":
+          description: OK
+        "400":
+          description: Bad Request
+        "403":
+          description: Forbidden
+        "404":
+          description: Not Found
+        "500":
+          description: Internal Server Error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Attach a websocket
+      tags:
+        - websocket
+  /websocket/exec:
+    get:
+      description: >-
+        If the nodeName query parameter is present, the request will be proxied
+        to the underlying agent environment(endpoint).
+
+        If the nodeName query parameter is not specified, the request will be upgraded to the websocket protocol and
+
+        an ExecStart operation HTTP request will be created and hijacked.
+      parameters:
+        - description: environment(endpoint) ID of the environment(endpoint) where the
+            resource is located
+          in: query
+          name: endpointId
+          required: true
+          schema:
+            type: integer
+        - description: node name
+          in: query
+          name: nodeName
+          schema:
+            type: string
+      responses:
+        "200":
+          description: OK
+        "400":
+          description: Bad Request
+        "409":
+          description: Conflict
+        "500":
+          description: Internal Server Error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Execute a websocket
+      tags:
+        - websocket
+  /websocket/kubernetes-shell:
+    get:
+      description: >-
+        The request will be upgraded to the websocket protocol. The request will
+        proxy input from the client to the pod via long-lived websocket
+        connection.
+
+        **Access policy**: authenticated
+      parameters:
+        - description: environment(endpoint) ID of the environment(endpoint) where the
+            resource is located
+          in: query
+          name: endpointId
+          required: true
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Success
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: Environment not found
+        "500":
+          description: Server error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Execute a websocket on kubectl shell pod
+      tags:
+        - websocket
+  /websocket/pod:
+    get:
+      description: |-
+        The request will be upgraded to the websocket protocol.
+        **Access policy**: authenticated
+      parameters:
+        - description: environment(endpoint) ID of the environment(endpoint) where the
+            resource is located
+          in: query
+          name: endpointId
+          required: true
+          schema:
+            type: integer
+        - description: namespace where the container is located
+          in: query
+          name: namespace
+          required: true
+          schema:
+            type: string
+        - description: name of the pod containing the container
+          in: query
+          name: podName
+          required: true
+          schema:
+            type: string
+        - description: name of the container
+          in: query
+          name: containerName
+          required: true
+          schema:
+            type: string
+        - description: command to execute in the container
+          in: query
+          name: command
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: OK
+        "400":
+          description: Bad Request
+        "403":
+          description: Forbidden
+        "404":
+          description: Not Found
+        "500":
+          description: Internal Server Error
+      security:
+        - ApiKeyAuth: []
+        - jwt: []
+      summary: Execute a websocket on pod
+      tags:
+        - websocket
+tags:
+  - description: Authenticate against Portainer HTTP API
+    name: auth
+    x-displayName: Authentication
+  - description: Manage backups
+    name: backup
+    x-displayName: Backup
+  - description: Manage Custom Templates
+    name: custom_templates
+    x-displayName: Custom templates
+  - description: Manage Docker resources
+    name: docker
+    x-displayName: Docker resources
+  - description: Manage Edge related settings
+    name: edge
+    x-displayName: Edge settings
+  - description: Manage an Edge agent
+    name: edge_agent
+    x-displayName: Edge agent
+  - description: Manage Edge Groups
+    name: edge_groups
+    x-displayName: Edge groups
+  - description: Manage Edge Jobs
+    name: edge_jobs
+    x-displayName: Edge jobs
+  - description: Manage Edge Stacks
+    name: edge_stacks
+    x-displayName: Edge stacks
+  - description: Manage Edge Templates
+    name: edge_templates
+    x-displayName: Edge templates
+  - description: Manage environment groups
+    name: endpoint_groups
+    x-displayName: Environment groups
+  - description: Manage environments
+    name: endpoints
+    x-displayName: Environments
+  - description: Operate git repository
+    name: gitops
+    x-displayName: GitOps
+  - description: Manage Helm charts
+    name: helm
+    x-displayName: Helm charts
+  - description: Manage Kubernetes cluster
+    name: kubernetes
+    x-displayName: Kubernetes
+  - description: Manage LDAP settings
+    name: ldap
+    x-displayName: LDAP
+  - description: Fetch the message of the day
+    name: motd
+    x-displayName: Message of the day
+  - description: Manage Docker registries
+    name: registries
+    x-displayName: Registries
+  - description: Manage access control on Docker resources
+    name: resource_controls
+    x-displayName: Resource controls
+  - description: Manage roles
+    name: roles
+    x-displayName: Roles
+  - description: Manage Portainer settings
+    name: settings
+    x-displayName: Portainer settings
+  - description: Manage ssl settings
+    name: ssl
+    x-displayName: SSL
+  - description: Manage stacks
+    name: stacks
+    x-displayName: Stacks
+  - description: Information about the Portainer instance
+    name: status
+    x-displayName: Portainer status
+  - description: Manage Portainer system
+    name: system
+    x-displayName: Portainer system
+  - description: Manage tags
+    name: tags
+    x-displayName: Tags
+  - description: Manage team memberships
+    name: team_memberships
+    x-displayName: Team memberships
+  - description: Manage teams
+    name: teams
+    x-displayName: Teams
+  - description: Manage App Templates
+    name: templates
+    x-displayName: App templates
+  - description: Upload files
+    name: upload
+    x-displayName: Upload files
+  - description: Manage users
+    name: users
+    x-displayName: Users
+  - description: Manage webhooks
+    name: webhooks
+    x-displayName: Webhooks
+  - description: Create exec sessions using websockets
+    name: websocket
+    x-displayName: Websocket
+x-tagGroups:
+  - name: Access Control
+    tags:
+      - auth
+      - roles
+      - team_memberships
+      - teams
+      - users
+  - name: Administration
+    tags:
+      - backup
+      - ldap
+      - motd
+      - settings
+      - status
+      - system
+      - ssl
+      - upload
+  - name: Docker
+    tags:
+      - templates
+      - custom_templates
+      - docker
+      - registries
+      - resource_controls
+      - stacks
+      - webhooks
+      - websocket
+  - name: Edge Compute
+    tags:
+      - edge_agent
+      - edge_groups
+      - edge_jobs
+      - edge
+      - edge_stacks
+  - name: Environment Management
+    tags:
+      - endpoint_groups
+      - endpoints
+      - tags
+  - name: GitOps
+    tags:
+      - gitops
+  - name: Kubernetes
+    tags:
+      - helm
+      - kubernetes
+servers:
+  - url: /api
+components:
+  requestBodies:
+    kubernetes.K8sIngressControllerArray:
+      content:
+        application/json:
+          schema:
+            items:
+              $ref: "#/components/schemas/kubernetes.K8sIngressController"
+            type: array
+      description: Ingress controllers
+      required: true
+    endpoints.endpointDeleteBatchPayload:
+      content:
+        application/json:
+          schema:
+            $ref: "#/components/schemas/endpoints.endpointDeleteBatchPayload"
+      description: List of environments to delete, with optional deleteCluster flag to
+        clean-up associated resources (cloud environments only)
+      required: true
+    kubernetes.K8sNamespaceDetails:
+      content:
+        application/json:
+          schema:
+            $ref: "#/components/schemas/kubernetes.K8sNamespaceDetails"
+      description: Namespace details
+      required: true
+    kubernetes.K8sIngressInfo:
+      content:
+        application/json:
+          schema:
+            $ref: "#/components/schemas/kubernetes.K8sIngressInfo"
+      description: Ingress details
+      required: true
+    kubernetes.K8sServiceInfo:
+      content:
+        application/json:
+          schema:
+            $ref: "#/components/schemas/kubernetes.K8sServiceInfo"
+      description: Service definition
+      required: true
+  securitySchemes:
+    ApiKeyAuth:
+      in: header
+      name: X-API-KEY
+      type: apiKey
+    jwt:
+      in: header
+      name: Authorization
+      type: apiKey
+  schemas:
+    auth.authenticatePayload:
+      properties:
+        Password:
+          description: Password
+          example: mypassword
+          type: string
+        Username:
+          description: Username
+          example: admin
+          type: string
+      required:
+        - Password
+        - Username
+      type: object
+    auth.authenticateResponse:
+      properties:
+        jwt:
+          description: JWT token used to authenticate against the API
+          example: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyzAB
+          type: string
+      type: object
+    auth.oauthPayload:
+      properties:
+        Code:
+          description: OAuth code returned from OAuth Provided
+          type: string
+      type: object
+    backup.backupPayload:
+      properties:
+        Password:
+          type: string
+      type: object
+    backup.restorePayload:
+      properties:
+        FileContent:
+          items:
+            format: int32
+            type: integer
+          type: array
+        FileName:
+          type: string
+        Password:
+          type: string
+      type: object
+    build.BuildInfo:
+      properties:
+        BuildNumber:
+          type: string
+        GitCommit:
+          type: string
+        GoVersion:
+          type: string
+        ImageTag:
+          type: string
+        NodejsVersion:
+          type: string
+        PnpmVersion:
+          type: string
+        WebpackVersion:
+          type: string
+      type: object
+    build.DependenciesInfo:
+      properties:
+        ComposeVersion:
+          type: string
+        DockerVersion:
+          type: string
+        HelmVersion:
+          type: string
+        KubectlVersion:
+          type: string
+      type: object
+    build.RuntimeInfo:
+      properties:
+        Env:
+          items:
+            type: string
+          type: array
+      type: object
+    containers.containerGpusResponse:
+      properties:
+        gpus:
+          type: string
+      type: object
+    customtemplates.customTemplateFromFileContentPayload:
+      properties:
+        Description:
+          description: Description of the template
+          example: High performance web server
+          type: string
+        EdgeTemplate:
+          description: EdgeTemplate indicates if this template purpose for Edge Stack
+          example: false
+          type: boolean
+        FileContent:
+          description: Content of stack file
+          type: string
+        Logo:
+          description: URL of the template's logo
+          example: https://portainer.io/img/logo.svg
+          type: string
+        Note:
+          description: A note that will be displayed in the UI. Supports HTML content
+          example: This is my <b>custom</b> template
+          type: string
+        Platform:
+          allOf:
+            - $ref: "#/components/schemas/portainer.CustomTemplatePlatform"
+          description: |-
+            Platform associated to the template.
+            Valid values are: 1 - 'linux', 2 - 'windows'
+            Required for Docker stacks
+          enum:
+            - 1
+            - 2
+          example: 1
+        Title:
+          description: Title of the template
+          example: Nginx
+          type: string
+        Type:
+          allOf:
+            - $ref: "#/components/schemas/portainer.StackType"
+          description: |-
+            Type of created stack:
+            * 1 - swarm
+            * 2 - compose
+            * 3 - kubernetes
+          enum:
+            - 1
+            - 2
+            - 3
+          example: 1
+        Variables:
+          description: Definitions of variables in the stack file
+          items:
+            $ref: "#/components/schemas/portainer.CustomTemplateVariableDefinition"
+          type: array
+      required:
+        - Description
+        - FileContent
+        - Title
+        - Type
+      type: object
+    customtemplates.customTemplateFromGitRepositoryPayload:
+      properties:
+        ComposeFilePathInRepository:
+          default: docker-compose.yml
+          description: Path to the Stack file inside the Git repository
+          example: docker-compose.yml
+          type: string
+        Description:
+          description: Description of the template
+          example: High performance web server
+          type: string
+        EdgeTemplate:
+          description: EdgeTemplate indicates if this template purpose for Edge Stack
+          example: false
+          type: boolean
+        IsComposeFormat:
+          description: IsComposeFormat indicates if the Kubernetes template is created
+            from a Docker Compose file
+          example: false
+          type: boolean
+        Logo:
+          description: URL of the template's logo
+          example: https://portainer.io/img/logo.svg
+          type: string
+        Note:
+          description: A note that will be displayed in the UI. Supports HTML content
+          example: This is my <b>custom</b> template
+          type: string
+        Platform:
+          allOf:
+            - $ref: "#/components/schemas/portainer.CustomTemplatePlatform"
+          description: |-
+            Platform associated to the template.
+            Valid values are: 1 - 'linux', 2 - 'windows'
+            Required for Docker stacks
+          enum:
+            - 1
+            - 2
+          example: 1
+        RepositoryAuthentication:
+          description: "Deprecated: use SourceID instead. Use basic authentication to
+            clone the Git repository."
+          example: true
+          type: boolean
+        RepositoryPassword:
+          description: "Deprecated: use SourceID instead. Password used in basic
+            authentication. Required when RepositoryAuthentication is true."
+          example: myGitPassword
+          type: string
+        RepositoryReferenceName:
+          description: Reference name of a Git repository hosting the Stack file
+          example: refs/heads/master
+          type: string
+        RepositoryURL:
+          description: "Deprecated: use SourceID instead. URL of a Git repository hosting
+            the Stack file."
+          example: https://github.com/openfaas/faas
+          type: string
+        RepositoryUsername:
+          description: "Deprecated: use SourceID instead. Username used in basic
+            authentication. Required when RepositoryAuthentication is true."
+          example: myGitUsername
+          type: string
+        SourceID:
+          description: |-
+            SourceID references an existing Source for git credentials/URL.
+            When set, the inline URL and authentication fields are ignored.
+          example: 1
+          type: integer
+        TLSSkipVerify:
+          description: "Deprecated: use SourceID instead. TLSSkipVerify skips SSL
+            verification when cloning the Git repository."
+          example: false
+          type: boolean
+        Title:
+          description: Title of the template
+          example: Nginx
+          type: string
+        Type:
+          allOf:
+            - $ref: "#/components/schemas/portainer.StackType"
+          description: |-
+            Type of created stack:
+            * 1 - swarm
+            * 2 - compose
+            * 3 - kubernetes
+          enum:
+            - 1
+            - 2
+          example: 1
+        Variables:
+          description: Definitions of variables in the stack file
+          items:
+            $ref: "#/components/schemas/portainer.CustomTemplateVariableDefinition"
+          type: array
+      required:
+        - Description
+        - SourceID
+        - Title
+        - Type
+      type: object
+    customtemplates.customTemplateUpdatePayload:
+      properties:
+        ComposeFilePathInRepository:
+          default: docker-compose.yml
+          description: Path to the Stack file inside the Git repository
+          example: docker-compose.yml
+          type: string
+        Description:
+          description: Description of the template
+          example: High performance web server
+          type: string
+        EdgeTemplate:
+          description: EdgeTemplate indicates if this template purpose for Edge Stack
+          example: false
+          type: boolean
+        FileContent:
+          description: Content of stack file
+          type: string
+        IsComposeFormat:
+          description: IsComposeFormat indicates if the Kubernetes template is created
+            from a Docker Compose file
+          example: false
+          type: boolean
+        Logo:
+          description: URL of the template's logo
+          example: https://portainer.io/img/logo.svg
+          type: string
+        Note:
+          description: A note that will be displayed in the UI. Supports HTML content
+          example: This is my <b>custom</b> template
+          type: string
+        Platform:
+          allOf:
+            - $ref: "#/components/schemas/portainer.CustomTemplatePlatform"
+          description: |-
+            Platform associated to the template.
+            Valid values are: 1 - 'linux', 2 - 'windows'
+            Required for Docker stacks
+          enum:
+            - 1
+            - 2
+          example: 1
+        RepositoryAuthentication:
+          description: "Deprecated: use SourceID instead. Use authentication to clone the
+            Git repository."
+          example: true
+          type: boolean
+        RepositoryPassword:
+          description: "Deprecated: use SourceID instead. Password used in basic
+            authentication or token used in token authentication. Required when
+            RepositoryAuthentication is true."
+          example: myGitPassword
+          type: string
+        RepositoryReferenceName:
+          description: Reference name of a Git repository hosting the Stack file
+          example: refs/heads/master
+          type: string
+        RepositoryURL:
+          description: "Deprecated: use SourceID instead. URL of a Git repository hosting
+            the Stack file."
+          example: https://github.com/openfaas/faas
+          type: string
+        RepositoryUsername:
+          description: "Deprecated: use SourceID instead. Username used in basic
+            authentication. Required when RepositoryAuthentication is true."
+          example: myGitUsername
+          type: string
+        SourceID:
+          description: |-
+            SourceID references an existing Source for git credentials/URL.
+            When set, the inline URL and authentication fields are ignored.
+          example: 1
+          type: integer
+        TLSSkipVerify:
+          description: "Deprecated: use SourceID instead. TLSSkipVerify skips SSL
+            verification when cloning the Git repository."
+          example: false
+          type: boolean
+        Title:
+          description: Title of the template
+          example: Nginx
+          type: string
+        Type:
+          allOf:
+            - $ref: "#/components/schemas/portainer.StackType"
+          description: Type of created stack (1 - swarm, 2 - compose, 3 - kubernetes)
+          enum:
+            - 1
+            - 2
+            - 3
+          example: 1
+        Variables:
+          description: Definitions of variables in the stack file
+          items:
+            $ref: "#/components/schemas/portainer.CustomTemplateVariableDefinition"
+          type: array
+      required:
+        - Description
+        - FileContent
+        - Title
+        - Type
+      type: object
+    customtemplates.fileResponse:
+      properties:
+        FileContent:
+          type: string
+      type: object
+    docker.dashboardResponse:
+      properties:
+        containers:
+          $ref: "#/components/schemas/stats.ContainerStats"
+        images:
+          $ref: "#/components/schemas/docker.imagesCounters"
+        networks:
+          type: integer
+        services:
+          type: integer
+        stacks:
+          type: integer
+        volumes:
+          type: integer
+      type: object
+    docker.imagesCounters:
+      properties:
+        size:
+          type: integer
+        total:
+          type: integer
+      type: object
+    edge.DeployerOptionsPayload:
+      properties:
+        ForceRecreate:
+          description: >-
+            ForceRecreate is a flag indicating if the agent must force the
+            redeployment of the stack.
+
+            This field is only used when the Force Redeployment is triggered.
+
+            Once the stack is redeployed, this field will be reset to false.
+
+            For standard edge agent, this field is used in agent side
+
+            For async edge agent, this field is used in both agent side and server side.
+
+            This flag drives `docker compose up --force-recreate` option
+          type: boolean
+        Prune:
+          description: >-
+            Prune is a flag indicating if the agent must prune the containers or
+            not when creating/updating an edge stack
+
+            This flag drives `docker compose up --remove-orphans` and `docker stack up --prune` options
+
+            Used only for EE
+          type: boolean
+        RemoveVolumes:
+          description: >-
+            RemoveVolumes is a flag indicating if the agent must remove the
+            named volumes declared
+
+            in the compose file and anonymouse volumes attached to containers
+
+            This flag drives `docker compose down --volumes` option
+
+            Used only for EE
+          type: boolean
+      type: object
+    edge.RegistryCredentials:
+      properties:
+        Secret:
+          type: string
+        ServerURL:
+          type: string
+        Username:
+          type: string
+      type: object
+    edge.StackPayload:
+      properties:
+        AlwaysCloneGitRepoForRelativePath:
+          description: >-
+            AlwaysCloneGitRepoForRelativePath is a flag indicating if the agent
+            must always clone the git repository for relative path.
+
+            This field is only valid when SupportRelativePath is true.
+
+            Used only for EE
+          type: boolean
+        CreatedBy:
+          description: |-
+            CreatedBy is the username that created this stack
+            Used for adding labels to Kubernetes manifests
+          type: string
+        CreatedByUserId:
+          description: |-
+            CreatedByUserId is the user ID that created this stack
+            Used for adding labels to Kubernetes manifests
+          type: string
+        DeployerOptionsPayload:
+          $ref: "#/components/schemas/edge.DeployerOptionsPayload"
+        DirEntries:
+          description: Content of stack folder
+          items:
+            $ref: "#/components/schemas/filesystem.DirEntry"
+          type: array
+        EdgeUpdateID:
+          description: |-
+            EdgeUpdateID is the ID of the edge update related to this stack.
+            Used only for EE
+          type: integer
+        EntryFileName:
+          description: Name of the stack entry file
+          type: string
+        EnvVars:
+          description: |-
+            Used only for EE
+            EnvVars is a list of environment variables to inject into the stack
+          items:
+            $ref: "#/components/schemas/portainer.Pair"
+          type: array
+        FilesystemPath:
+          description: Mount point for relative path
+          type: string
+        ForceUpdate:
+          description: >-
+            ForceUpdate is a flag indicating if the agent must force the update
+            of the stack.
+
+            Used only for EE
+          type: boolean
+        HelmConfig:
+          allOf:
+            - $ref: "#/components/schemas/portainer.HelmConfig"
+          description: HelmConfig represents the Helm configuration for an edge stack
+        ID:
+          description: ID of the stack
+          type: integer
+        Name:
+          description: Name of the stack
+          type: string
+        Namespace:
+          description: Namespace to use for kubernetes stack. Keep empty to use the
+            manifest namespace.
+          type: string
+        PrePullImage:
+          description: >-
+            PrePullImage is a flag indicating if the agent must pull the image
+            before deploying the stack.
+
+            Used only for EE
+          type: boolean
+        RePullImage:
+          description: >-
+            RePullImage is a flag indicating if the agent must pull the image if
+            it is already present on the node.
+
+            Used only for EE
+          type: boolean
+        ReadyRePullImage:
+          description: >-
+            Used only for EE async edge agent
+
+            ReadyRePullImage is a flag to indicate whether the auto update is trigger to re-pull image
+
+            Deprecated(2.36): use DeployerOptionsPayload.ForceRecreate instead
+          type: boolean
+        RegistryCredentials:
+          description: |-
+            RegistryCredentials holds the credentials for a Docker registry.
+            Used only for EE
+          items:
+            $ref: "#/components/schemas/edge.RegistryCredentials"
+          type: array
+        RetryDeploy:
+          description: >-
+            RetryDeploy is a flag indicating if the agent must retry to deploy
+            the stack if it fails.
+
+            Used only for EE
+          type: boolean
+        RetryPeriod:
+          description: >-
+            RetryPeriod specifies the duration, in seconds, for which the agent
+            should continue attempting to deploy the stack after a failure
+
+            Used only for EE
+          type: integer
+        RollbackTo:
+          description: RollbackTo specifies the stack file version to rollback to (only
+            support to rollback to the last version currently)
+          type: integer
+        StackFileContent:
+          description: Content of the stack file (for compatibility to agent version less
+            than 2.19.0)
+          type: string
+        SupportPerDeviceConfigs:
+          description: Whether the edge stack supports per device configs
+          type: boolean
+        SupportRelativePath:
+          description: Is relative path supported
+          type: boolean
+        Version:
+          description: Version of the stack file
+          type: integer
+      type: object
+    edgegroups.decoratedEdgeGroup:
+      properties:
+        Dynamic:
+          type: boolean
+        EndpointIds:
+          description: Shadow to avoid exposing in the API
+          type: integer
+        EndpointTypes:
+          items:
+            $ref: "#/components/schemas/portainer.EndpointType"
+          type: array
+        Endpoints:
+          description: "Deprecated: only used for API responses"
+          items:
+            type: integer
+          type: array
+        HasEdgeJob:
+          type: boolean
+        HasEdgeStack:
+          type: boolean
+        Id:
+          description: EdgeGroup Identifier
+          example: 1
+          type: integer
+        Name:
+          type: string
+        PartialMatch:
+          type: boolean
+        TagIds:
+          items:
+            type: integer
+          type: array
+        TrustedEndpoints:
+          items:
+            type: integer
+          type: array
+      type: object
+    edgegroups.edgeGroupCreatePayload:
+      properties:
+        Dynamic:
+          type: boolean
+        Endpoints:
+          items:
+            type: integer
+          type: array
+        Name:
+          type: string
+        PartialMatch:
+          type: boolean
+        TagIDs:
+          items:
+            type: integer
+          type: array
+      type: object
+    edgegroups.edgeGroupUpdatePayload:
+      properties:
+        Dynamic:
+          type: boolean
+        Endpoints:
+          items:
+            type: integer
+          type: array
+        Name:
+          type: string
+        PartialMatch:
+          type: boolean
+        TagIDs:
+          items:
+            type: integer
+          type: array
+      type: object
+    edgejobs.edgeJobCreateFromFileContentPayload:
+      properties:
+        CronExpression:
+          type: string
+        EdgeGroups:
+          items:
+            type: integer
+          type: array
+        Endpoints:
+          items:
+            type: integer
+          type: array
+        FileContent:
+          type: string
+        Name:
+          type: string
+        Recurring:
+          type: boolean
+      type: object
+    edgejobs.edgeJobFileResponse:
+      properties:
+        FileContent:
+          type: string
+      type: object
+    edgejobs.edgeJobUpdatePayload:
+      properties:
+        CronExpression:
+          type: string
+        EdgeGroups:
+          items:
+            type: integer
+          type: array
+        Endpoints:
+          items:
+            type: integer
+          type: array
+        FileContent:
+          type: string
+        Name:
+          type: string
+        Recurring:
+          type: boolean
+      type: object
+    edgejobs.fileResponse:
+      properties:
+        FileContent:
+          type: string
+      type: object
+    edgejobs.taskContainer:
+      properties:
+        EndpointId:
+          type: integer
+        EndpointName:
+          type: string
+        Id:
+          type: string
+        LogsStatus:
+          $ref: "#/components/schemas/portainer.EdgeJobLogsStatus"
+      type: object
+    edgestacks.edgeStackFromGitRepositoryPayload:
+      properties:
+        DeploymentType:
+          allOf:
+            - $ref: "#/components/schemas/portainer.EdgeStackDeploymentType"
+          description: |-
+            Deployment type to deploy this stack
+            Valid values are: 0 - 'compose', 1 - 'kubernetes'
+            compose is enabled only for docker environments
+            kubernetes is enabled only for kubernetes environments
+          enum:
+            - 0
+            - 1
+            - 2
+          example: 0
+        EdgeGroups:
+          description: List of identifiers of EdgeGroups
+          example:
+            - 1
+          items:
+            type: integer
+          type: array
+        FilePathInRepository:
+          default: docker-compose.yml
+          description: Path to the Stack file inside the Git repository
+          example: docker-compose.yml
+          type: string
+        Name:
+          description: >-
+            Name of the stack
+
+            Max length: 255
+
+            Name must only contains lowercase characters, numbers, hyphens, or underscores
+
+            Name must start with a lowercase character or number
+
+            Example: stack-name or stack_123 or stackName
+          example: stack-name
+          type: string
+        Registries:
+          description: List of Registries to use for this stack
+          items:
+            type: integer
+          type: array
+        RepositoryAuthentication:
+          description: "Deprecated: Use SourceID instead. Use basic authentication to
+            clone the Git repository."
+          example: true
+          type: boolean
+        RepositoryPassword:
+          description: "Deprecated: Use SourceID instead. Password used in basic
+            authentication."
+          example: myGitPassword
+          type: string
+        RepositoryReferenceName:
+          description: Reference name of a Git repository hosting the Stack file
+          example: refs/heads/master
+          type: string
+        RepositoryURL:
+          description: "Deprecated: Use SourceID instead. URL of a Git repository hosting
+            the Stack file."
+          example: https://github.com/openfaas/faas
+          type: string
+        RepositoryUsername:
+          description: "Deprecated: Use SourceID instead. Username used in basic
+            authentication."
+          example: myGitUsername
+          type: string
+        SourceID:
+          description: |-
+            SourceID references an existing Source for git credentials/URL.
+            When set, the inline URL and authentication fields are ignored.
+          example: 1
+          type: integer
+        TLSSkipVerify:
+          description: "Deprecated: Use SourceID instead. TLSSkipVerify skips SSL
+            verification when cloning the Git repository."
+          example: false
+          type: boolean
+        UseManifestNamespaces:
+          description: Uses the manifest's namespaces instead of the default one
+          type: boolean
+      required:
+        - EdgeGroups
+        - Name
+      type: object
+    edgestacks.edgeStackFromStringPayload:
+      properties:
+        DeploymentType:
+          allOf:
+            - $ref: "#/components/schemas/portainer.EdgeStackDeploymentType"
+          description: |-
+            Deployment type to deploy this stack
+            Valid values are: 0 - 'compose', 1 - 'kubernetes'
+            compose is enabled only for docker environments
+            kubernetes is enabled only for kubernetes environments
+          enum:
+            - 0
+            - 1
+            - 2
+          example: 0
+        EdgeGroups:
+          description: List of identifiers of EdgeGroups
+          example:
+            - 1
+          items:
+            type: integer
+          type: array
+        Name:
+          description: >-
+            Name of the stack
+
+            Max length: 255
+
+            Name must only contains lowercase characters, numbers, hyphens, or underscores
+
+            Name must start with a lowercase character or number
+
+            Example: stack-name or stack_123 or stackName
+          example: stack-name
+          type: string
+        Registries:
+          description: List of Registries to use for this stack
+          items:
+            type: integer
+          type: array
+        StackFileContent:
+          description: Content of the Stack file
+          example: |-
+            version: 3
+             services:
+             web:
+             image:nginx
+          type: string
+        UseManifestNamespaces:
+          description: Uses the manifest's namespaces instead of the default one
+          type: boolean
+      required:
+        - Name
+        - StackFileContent
+      type: object
+    edgestacks.stackFileResponse:
+      properties:
+        StackFileContent:
+          type: string
+      type: object
+    edgestacks.updateEdgeStackPayload:
+      properties:
+        DeploymentType:
+          $ref: "#/components/schemas/portainer.EdgeStackDeploymentType"
+        EdgeGroups:
+          items:
+            type: integer
+          type: array
+        StackFileContent:
+          type: string
+        UpdateVersion:
+          type: boolean
+        UseManifestNamespaces:
+          description: Uses the manifest's namespaces instead of the default one
+          type: boolean
+      type: object
+    edgestacks.updateStatusPayload:
+      properties:
+        EndpointID:
+          type: integer
+        Error:
+          type: string
+        Status:
+          $ref: "#/components/schemas/portainer.EdgeStackStatusType"
+        Time:
+          format: int64
+          type: integer
+        Version:
+          type: integer
+      type: object
+    endpointedge.edgeJobResponse:
+      properties:
+        CollectLogs:
+          description: Whether to collect logs
+          example: true
+          type: boolean
+        CronExpression:
+          description: A cron expression to schedule this job
+          example: "* * * * *"
+          type: string
+        Id:
+          description: EdgeJob Identifier
+          example: 2
+          type: integer
+        Script:
+          description: Script to run
+          example: echo hello
+          type: string
+        Version:
+          description: Version of this EdgeJob
+          example: 2
+          type: integer
+      type: object
+    endpointedge.endpointEdgeStatusInspectResponse:
+      properties:
+        checkin:
+          description: The current value of CheckinInterval
+          example: 5
+          type: integer
+        credentials:
+          type: string
+        port:
+          description: The tunnel port
+          example: 8732
+          type: integer
+        schedules:
+          description: List of requests for jobs to run on the environment(endpoint)
+          items:
+            $ref: "#/components/schemas/endpointedge.edgeJobResponse"
+          type: array
+        stacks:
+          description: List of stacks to be deployed on the environments(endpoints)
+          items:
+            $ref: "#/components/schemas/endpointedge.stackStatusResponse"
+          type: array
+        status:
+          description: Status represents the environment(endpoint) status
+          example: REQUIRED
+          type: string
+      type: object
+    endpointedge.stackStatusResponse:
+      properties:
+        ID:
+          description: EdgeStack Identifier
+          example: 1
+          type: integer
+        Version:
+          description: Version of this stack
+          example: 3
+          type: integer
+      type: object
+    endpointgroups.EndpointGroupResponse:
+      properties:
+        Description:
+          description: Description associated to the environment(endpoint) group
+          example: Environment(Endpoint) group description
+          type: string
+        Id:
+          description: Environment(Endpoint) group Identifier
+          example: 1
+          type: integer
+        Name:
+          description: Environment(Endpoint) group name
+          example: my-environment-group
+          type: string
+        TagIds:
+          description: List of tags associated to this environment(endpoint) group
+          items:
+            type: integer
+          type: array
+        TeamAccessPolicies:
+          $ref: "#/components/schemas/portainer.TeamAccessPolicies"
+        Total:
+          type: integer
+        TypeInfo:
+          $ref: "#/components/schemas/endpointgroups.EndpointGroupTypeInfo"
+        UserAccessPolicies:
+          $ref: "#/components/schemas/portainer.UserAccessPolicies"
+      required:
+        - Description
+        - Id
+        - Name
+      type: object
+    endpointgroups.EndpointGroupTypeInfo:
+      properties:
+        Docker:
+          type: integer
+        Kubernetes:
+          type: integer
+        Mixed:
+          type: boolean
+        Podman:
+          type: integer
+      required:
+        - Docker
+        - Kubernetes
+        - Mixed
+        - Podman
+      type: object
+    endpointgroups.endpointGroupCreatePayload:
+      properties:
+        AssociatedEndpoints:
+          description: List of environment(endpoint) identifiers that will be part of this
+            group
+          example:
+            - 1
+            - 3
+          items:
+            type: integer
+          type: array
+        Description:
+          description: Environment(Endpoint) group description
+          example: description
+          type: string
+        Name:
+          description: Environment(Endpoint) group name
+          example: my-environment-group
+          type: string
+        TagIDs:
+          description: List of tag identifiers to which this environment(endpoint) group
+            is associated
+          example:
+            - 1
+            - 2
+          items:
+            type: integer
+          type: array
+      required:
+        - Name
+      type: object
+    endpointgroups.endpointGroupUpdatePayload:
+      properties:
+        AssociatedEndpoints:
+          description: List of environment(endpoint) identifiers that will be part of this
+            group
+          example:
+            - 1
+            - 3
+          items:
+            type: integer
+          type: array
+        Description:
+          description: Environment(Endpoint) group description
+          example: description
+          type: string
+        Name:
+          description: Environment(Endpoint) group name
+          example: my-environment-group
+          type: string
+        TagIDs:
+          description: List of tag identifiers associated to the environment(endpoint) group
+          example:
+            - 3
+            - 4
+          items:
+            type: integer
+          type: array
+        TeamAccessPolicies:
+          $ref: "#/components/schemas/portainer.TeamAccessPolicies"
+        UserAccessPolicies:
+          $ref: "#/components/schemas/portainer.UserAccessPolicies"
+      type: object
+    endpoints.EnvironmentSummaryCountsResponse:
+      properties:
+        byGroup:
+          items:
+            $ref: "#/components/schemas/endpoints.groupCount"
+          type: array
+        byHealth:
+          $ref: "#/components/schemas/endpoints.healthCounts"
+        byPlatformType:
+          $ref: "#/components/schemas/endpoints.platformCounts"
+        down:
+          type: integer
+        outdated:
+          type: integer
+        total:
+          type: integer
+        unassigned:
+          type: integer
+        up:
+          type: integer
+      type: object
+    endpoints.dockerhubStatusResponse:
+      properties:
+        limit:
+          description: Daily limit
+          type: integer
+        remaining:
+          description: Remaiming images to pull
+          type: integer
+      type: object
+    endpoints.endpointCreateGlobalKeyResponse:
+      properties:
+        endpointID:
+          type: integer
+      type: object
+    endpoints.endpointDeleteBatchPartialResponse:
+      properties:
+        deleted:
+          items:
+            type: integer
+          type: array
+        errors:
+          items:
+            type: integer
+          type: array
+      type: object
+    endpoints.endpointDeleteBatchPayload:
+      properties:
+        endpoints:
+          items:
+            $ref: "#/components/schemas/endpoints.endpointDeleteRequest"
+          type: array
+      type: object
+    endpoints.endpointDeleteRequest:
+      properties:
+        deleteCluster:
+          type: boolean
+        id:
+          type: integer
+      type: object
+    endpoints.endpointSettingsUpdatePayload:
+      properties:
+        allowBindMountsForRegularUsers:
+          description: Whether non-administrator should be able to use bind mounts when
+            creating containers
+          example: false
+          type: boolean
+        allowContainerCapabilitiesForRegularUsers:
+          description: Whether non-administrator should be able to use container
+            capabilities
+          example: true
+          type: boolean
+        allowDeviceMappingForRegularUsers:
+          description: Whether non-administrator should be able to use device mapping
+          example: true
+          type: boolean
+        allowHostNamespaceForRegularUsers:
+          description: Whether non-administrator should be able to use the host pid
+          example: true
+          type: boolean
+        allowPrivilegedModeForRegularUsers:
+          description: Whether non-administrator should be able to use privileged mode
+            when creating containers
+          example: false
+          type: boolean
+        allowSecurityOptForRegularUsers:
+          description: Whether non-administrator should be able to use security-opt settings
+          example: true
+          type: boolean
+        allowStackManagementForRegularUsers:
+          description: Whether non-administrator should be able to manage stacks
+          example: true
+          type: boolean
+        allowSysctlSettingForRegularUsers:
+          description: Whether non-administrator should be able to use sysctl settings
+          example: true
+          type: boolean
+        allowVolumeBrowserForRegularUsers:
+          description: Whether non-administrator should be able to browse volumes
+          example: true
+          type: boolean
+        enableGPUManagement:
+          example: false
+          type: boolean
+        enableHostManagementFeatures:
+          description: Whether host management features are enabled
+          example: true
+          type: boolean
+        gpus:
+          items:
+            $ref: "#/components/schemas/portainer.Pair"
+          type: array
+      type: object
+    endpoints.endpointUpdatePayload:
+      properties:
+        AzureApplicationID:
+          description: Azure application ID
+          example: eag7cdo9-o09l-9i83-9dO9-f0b23oe78db4
+          type: string
+        AzureAuthenticationKey:
+          description: Azure authentication key
+          example: cOrXoK/1D35w8YQ8nH1/8ZGwzz45JIYD5jxHKXEQknk=
+          type: string
+        AzureTenantID:
+          description: Azure tenant ID
+          example: 34ddc78d-4fel-2358-8cc1-df84c8o839f5
+          type: string
+        EdgeCheckinInterval:
+          description: The check in interval for edge agent (in seconds)
+          example: 5
+          type: integer
+        Gpus:
+          description: GPUs information
+          items:
+            $ref: "#/components/schemas/portainer.Pair"
+          type: array
+        GroupID:
+          description: Group identifier
+          example: 1
+          type: integer
+        Kubernetes:
+          allOf:
+            - $ref: "#/components/schemas/portainer.KubernetesData"
+          description: Associated Kubernetes data
+        Name:
+          description: Name that will be used to identify this environment(endpoint)
+          example: my-environment
+          type: string
+        PublicURL:
+          description: |-
+            URL or IP address where exposed containers will be reachable.\
+            Defaults to URL if not specified
+          example: docker.mydomain.tld:2375
+          type: string
+        Status:
+          description: The status of the environment(endpoint) (1 - up, 2 - down)
+          example: 1
+          type: integer
+        TLS:
+          description: Require TLS to connect against this environment(endpoint)
+          example: true
+          type: boolean
+        TLSSkipClientVerify:
+          description: Skip client verification when using TLS
+          example: false
+          type: boolean
+        TLSSkipVerify:
+          description: Skip server verification when using TLS
+          example: false
+          type: boolean
+        TagIDs:
+          description: List of tag identifiers to which this environment(endpoint) is
+            associated
+          example:
+            - 1
+            - 2
+          items:
+            type: integer
+          type: array
+        TeamAccessPolicies:
+          $ref: "#/components/schemas/portainer.TeamAccessPolicies"
+        URL:
+          description: URL or IP address of a Docker host
+          example: docker.mydomain.tld:2375
+          type: string
+        UserAccessPolicies:
+          $ref: "#/components/schemas/portainer.UserAccessPolicies"
+      type: object
+    endpoints.endpointUpdateRelationsPayload:
+      properties:
+        Relations:
+          additionalProperties:
+            properties:
+              EdgeGroups:
+                items:
+                  type: integer
+                type: array
+              Group:
+                type: integer
+              Tags:
+                items:
+                  type: integer
+                type: array
+            type: object
+          type: object
+      type: object
+    endpoints.forceUpdateServicePayload:
+      properties:
+        PullImage:
+          description: PullImage if true will pull the image
+          type: boolean
+        ServiceID:
+          description: ServiceId to update
+          type: string
+      type: object
+    endpoints.groupCount:
+      properties:
+        count:
+          type: integer
+        groupID:
+          type: integer
+        groupName:
+          type: string
+      type: object
+    endpoints.healthCounts:
+      properties:
+        down:
+          type: integer
+        heartbeat:
+          type: integer
+        outdated:
+          type: integer
+        up:
+          type: integer
+      type: object
+    endpoints.platformCounts:
+      properties:
+        azure:
+          type: integer
+        docker:
+          type: integer
+        kubernetes:
+          type: integer
+        podman:
+          type: integer
+      type: object
+    endpoints.registryAccessPayload:
+      properties:
+        Namespaces:
+          items:
+            type: string
+          type: array
+        TeamAccessPolicies:
+          $ref: "#/components/schemas/portainer.TeamAccessPolicies"
+        UserAccessPolicies:
+          $ref: "#/components/schemas/portainer.UserAccessPolicies"
+      type: object
+    filesystem.DirEntry:
+      properties:
+        Content:
+          type: string
+        IsFile:
+          type: boolean
+        Name:
+          type: string
+        Permissions:
+          type: integer
+      type: object
+    github_com_portainer_portainer_pkg_libhelm_release.Hook:
+      properties:
+        delete_policies:
+          description: DeletePolicies are the policies that indicate when to delete the hook
+          items:
+            type: string
+          type: array
+        events:
+          description: Events are the events that this hook fires on.
+          items:
+            type: string
+          type: array
+        kind:
+          description: Kind is the Kubernetes kind.
+          type: string
+        last_run:
+          allOf:
+            - $ref: "#/components/schemas/release.HookExecution"
+          description: LastRun indicates the date/time this was last run.
+        manifest:
+          description: Manifest is the manifest contents.
+          type: string
+        name:
+          type: string
+        path:
+          description: Path is the chart-relative path to the template.
+          type: string
+        weight:
+          description: Weight indicates the sort order for execution among similar Hook type
+          type: integer
+      type: object
+    gitops.fileResponse:
+      properties:
+        FileContent:
+          type: string
+      type: object
+    gitops.repositoryFilePreviewPayload:
+      properties:
+        password:
+          description: |-
+            Password for git authentication.
+            Deprecated: use SourceID instead
+          example: myGitPassword
+          type: string
+        reference:
+          example: refs/heads/master
+          type: string
+        repository:
+          description: |-
+            URL of a Git repository to preview.
+            Deprecated: use SourceID instead
+          example: https://github.com/openfaas/faas
+          type: string
+        sourceID:
+          description: >-
+            SourceID resolves URL and auth from the stored Source record.
+
+            When set, the inline Repository/Username/Password/TLSSkipVerify fields are ignored.
+          example: 1
+          type: integer
+        targetFile:
+          description: Path to file whose content will be read
+          example: docker-compose.yml
+          type: string
+        tlsSkipVerify:
+          description: >-
+            TLSSkipVerify skips SSL verification when cloning the Git
+            repository.
+
+            Deprecated: use SourceID instead
+          example: false
+          type: boolean
+        username:
+          description: |-
+            Username for git authentication.
+            Deprecated: use SourceID instead
+          example: myGitUsername
+          type: string
+      type: object
+    gittypes.GitAuthentication:
+      properties:
+        AuthorizationType:
+          type: integer
+        Password:
+          type: string
+        Provider:
+          type: integer
+        Username:
+          type: string
+      type: object
+    gittypes.GitSource:
+      properties:
+        Authentication:
+          $ref: "#/components/schemas/gittypes.GitAuthentication"
+        TLSSkipVerify:
+          example: false
+          type: boolean
+        URL:
+          example: https://github.com/portainer/portainer.git
+          type: string
+      type: object
+    gittypes.RepoConfig:
+      properties:
+        Authentication:
+          allOf:
+            - $ref: "#/components/schemas/gittypes.GitAuthentication"
+          description: Git credentials
+        ConfigFilePath:
+          description: >-
+            ConfigFilePath is the path to the config file within the repository.
+
+            NOTE: For stacks, this mirrors Stack.EntryPoint and the two are kept in sync by stackUpdateGit.
+          example: docker-compose.yml
+          type: string
+        ConfigHash:
+          description: Repository hash
+          example: bc4c183d756879ea4d173315338110b31004b8e0
+          type: string
+        ReferenceName:
+          description: The reference name
+          example: refs/heads/branch_name
+          type: string
+        TLSSkipVerify:
+          description: TLSSkipVerify skips SSL verification when cloning the Git repository
+          example: false
+          type: boolean
+        URL:
+          description: The repo url
+          example: https://github.com/portainer/portainer.git
+          type: string
+      type: object
+    helm.installChartPayload:
+      properties:
+        atomic:
+          type: boolean
+        chart:
+          type: string
+        name:
+          type: string
+        namespace:
+          type: string
+        repo:
+          type: string
+        values:
+          type: string
+        version:
+          type: string
+      type: object
+    images.ImageResponse:
+      properties:
+        created:
+          type: integer
+        id:
+          type: string
+        nodeName:
+          type: string
+        size:
+          type: integer
+        tags:
+          items:
+            type: string
+          type: array
+        used:
+          description: |-
+            Used is true if the image is used by at least one container
+            supplied only when withUsage is true
+          type: boolean
+      type: object
+    intstr.IntOrString:
+      properties:
+        IntVal:
+          type: integer
+        StrVal:
+          type: string
+        Type:
+          $ref: "#/components/schemas/intstr.Type"
+      type: object
+    intstr.Type:
+      enum:
+        - 0
+        - 1
+      format: int64
+      type: integer
+      x-enum-comments:
+        Int: The IntOrString holds an int.
+        String: The IntOrString holds a string.
+      x-enum-descriptions:
+        - The IntOrString holds an int.
+        - The IntOrString holds a string.
+      x-enum-varnames:
+        - Int
+        - String
+    k8s_io_api_core_v1.ConditionStatus:
+      enum:
+        - "True"
+        - "False"
+        - Unknown
+      type: string
+      x-enum-varnames:
+        - ConditionTrue
+        - ConditionFalse
+        - ConditionUnknown
+    k8s_io_api_core_v1.HTTPHeader:
+      properties:
+        name:
+          description: >-
+            The header field name.
+
+            This will be canonicalized upon output, so case-variant names will be understood as the same header.
+          type: string
+        value:
+          description: The header field value
+          type: string
+      type: object
+    k8s_io_api_core_v1.LocalObjectReference:
+      properties:
+        name:
+          description: >-
+            Name of the referent.
+
+            This field is effectively required, but due to backwards compatibility is
+
+            allowed to be empty. Instances of this type with an empty value here are
+
+            almost certainly wrong.
+
+            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+
+            +optional
+
+            +default=""
+
+            +kubebuilder:default=""
+
+            TODO: Drop `kubebuilder:default` when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.
+          type: string
+      type: object
+    k8s_io_api_core_v1.ObjectReference:
+      properties:
+        apiVersion:
+          description: |-
+            API version of the referent.
+            +optional
+          type: string
+        fieldPath:
+          description: >-
+            If referring to a piece of an object instead of an entire object,
+            this string
+
+            should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2].
+
+            For example, if the object reference is to a container within a pod, this would take on a value like:
+
+            "spec.containers{name}" (where "name" refers to the name of the container that triggered
+
+            the event) or if no container name is specified "spec.containers[2]" (container with
+
+            index 2 in this pod). This syntax is chosen only to have some well-defined way of
+
+            referencing a part of an object.
+
+            TODO: this design is not final and this field is subject to change in the future.
+
+            +optional
+          type: string
+        kind:
+          description: >-
+            Kind of the referent.
+
+            More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+
+            +optional
+          type: string
+        name:
+          description: >-
+            Name of the referent.
+
+            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+
+            +optional
+          type: string
+        namespace:
+          description: >-
+            Namespace of the referent.
+
+            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
+
+            +optional
+          type: string
+        resourceVersion:
+          description: >-
+            Specific resourceVersion to which this reference is made, if any.
+
+            More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
+
+            +optional
+          type: string
+        uid:
+          description: >-
+            UID of the referent.
+
+            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids
+
+            +optional
+          type: string
+      type: object
+    k8s_io_api_core_v1.ResourceClaim:
+      properties:
+        name:
+          description: |-
+            Name must match the name of one entry in pod.spec.resourceClaims of
+            the Pod where this field is used. It makes that resource available
+            inside a container.
+          type: string
+        request:
+          description: |-
+            Request is the name chosen for a request in the referenced claim.
+            If empty, everything from the claim is made available, otherwise
+            only the result of this request.
+
+            +optional
+          type: string
+      type: object
+    k8s_io_api_rbac_v1.Subject:
+      properties:
+        apiGroup:
+          description: |-
+            APIGroup holds the API group of the referenced subject.
+            Defaults to "" for ServiceAccount subjects.
+            Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
+            +optional
+          type: string
+        kind:
+          description: >-
+            Kind of object being referenced. Values defined by this API group
+            are "User", "Group", and "ServiceAccount".
+
+            If the Authorizer does not recognized the kind value, the Authorizer should report an error.
+          type: string
+        name:
+          description: |-
+            Name of the object being referenced.
+            +required
+            +k8s:required
+          type: string
+        namespace:
+          description: >-
+            Namespace of the referenced object.  If the object kind is
+            non-namespace, such as "User" or "Group", and this value is not
+            empty
+
+            the Authorizer should report an error.
+
+            +optional
+          type: string
+      type: object
+    kubernetes.Configuration:
+      properties:
+        ConfigurationOwner:
+          type: string
+        Data:
+          additionalProperties: {}
+          type: object
+        Kind:
+          type: string
+      type: object
+    kubernetes.CustomResourceMetadata:
+      properties:
+        apiVersion:
+          type: string
+        kind:
+          type: string
+        name:
+          type: string
+        plural:
+          type: string
+        scope:
+          type: string
+      type: object
+    kubernetes.IngressRule:
+      properties:
+        Host:
+          type: string
+        IP:
+          type: string
+        Path:
+          type: string
+        TLS:
+          items:
+            $ref: "#/components/schemas/kubernetes.TLSInfo"
+          type: array
+      type: object
+    kubernetes.K8sApplication:
+      properties:
+        Annotations:
+          additionalProperties:
+            type: string
+          type: object
+        ApplicationOwner:
+          type: string
+        ApplicationType:
+          type: string
+        Configurations:
+          items:
+            $ref: "#/components/schemas/kubernetes.Configuration"
+          type: array
+        Containers:
+          items: {}
+          type: array
+        CreationDate:
+          type: string
+        CustomResourceMetadata:
+          $ref: "#/components/schemas/kubernetes.CustomResourceMetadata"
+        DeploymentType:
+          type: string
+        Id:
+          type: string
+        Image:
+          type: string
+        Kind:
+          type: string
+        Labels:
+          additionalProperties:
+            type: string
+          type: object
+        LoadBalancerIPAddress:
+          type: string
+        MatchLabels:
+          additionalProperties:
+            type: string
+          type: object
+        Metadata:
+          $ref: "#/components/schemas/kubernetes.Metadata"
+        Name:
+          type: string
+        Namespace:
+          type: string
+        Pods:
+          items:
+            $ref: "#/components/schemas/kubernetes.Pod"
+          type: array
+        PublishedPorts:
+          items:
+            $ref: "#/components/schemas/kubernetes.PublishedPort"
+          type: array
+        Resource:
+          $ref: "#/components/schemas/kubernetes.K8sApplicationResource"
+        ResourcePool:
+          type: string
+        RunningPodsCount:
+          type: integer
+        ServiceId:
+          type: string
+        ServiceName:
+          type: string
+        ServiceType:
+          type: string
+        StackId:
+          type: string
+        StackKind:
+          type: string
+        StackName:
+          type: string
+        Status:
+          type: string
+        TotalPodsCount:
+          type: integer
+        Uid:
+          type: string
+      type: object
+    kubernetes.K8sApplicationResource:
+      properties:
+        CpuLimit:
+          type: number
+        CpuRequest:
+          type: number
+        MemoryLimit:
+          type: integer
+        MemoryRequest:
+          type: integer
+      type: object
+    kubernetes.K8sClusterRole:
+      properties:
+        creationDate:
+          type: string
+        isSystem:
+          type: boolean
+        name:
+          type: string
+        uid:
+          type: string
+      type: object
+    kubernetes.K8sClusterRoleBinding:
+      properties:
+        creationDate:
+          type: string
+        isSystem:
+          type: boolean
+        name:
+          type: string
+        namespace:
+          type: string
+        roleRef:
+          $ref: "#/components/schemas/v1.RoleRef"
+        subjects:
+          items:
+            $ref: "#/components/schemas/k8s_io_api_rbac_v1.Subject"
+          type: array
+        uid:
+          type: string
+      type: object
+    kubernetes.K8sConfigMap:
+      properties:
+        Annotations:
+          additionalProperties:
+            type: string
+          type: object
+        ConfigurationOwner:
+          type: string
+        ConfigurationOwnerId:
+          type: string
+        ConfigurationOwners:
+          items:
+            $ref: "#/components/schemas/kubernetes.K8sConfigurationOwnerResource"
+          type: array
+        CreationDate:
+          type: string
+        Data:
+          additionalProperties:
+            type: string
+          type: object
+        IsUsed:
+          type: boolean
+        Labels:
+          additionalProperties:
+            type: string
+          type: object
+        Name:
+          type: string
+        Namespace:
+          type: string
+        UID:
+          type: string
+      type: object
+    kubernetes.K8sConfigurationOwnerResource:
+      properties:
+        Id:
+          type: string
+        Name:
+          type: string
+        ResourceKind:
+          type: string
+      type: object
+    kubernetes.K8sCronJob:
+      properties:
+        Command:
+          type: string
+        Id:
+          type: string
+        IsSystem:
+          type: boolean
+        Jobs:
+          items:
+            $ref: "#/components/schemas/kubernetes.K8sJob"
+          type: array
+        Name:
+          type: string
+        Namespace:
+          type: string
+        Schedule:
+          type: string
+        Suspend:
+          type: boolean
+        Timezone:
+          type: string
+      type: object
+    kubernetes.K8sCronJobDeleteRequests:
+      additionalProperties:
+        items:
+          type: string
+        type: array
+      type: object
+    kubernetes.K8sDashboard:
+      properties:
+        applicationsCount:
+          type: integer
+        configMapsCount:
+          type: integer
+        ingressesCount:
+          type: integer
+        namespacesCount:
+          type: integer
+        secretsCount:
+          type: integer
+        servicesCount:
+          type: integer
+        volumesCount:
+          type: integer
+      type: object
+    kubernetes.K8sEvent:
+      properties:
+        count:
+          type: integer
+        eventTime:
+          type: string
+        firstTimestamp:
+          type: string
+        involvedObject:
+          $ref: "#/components/schemas/kubernetes.K8sEventInvolvedObject"
+        kind:
+          type: string
+        lastTimestamp:
+          type: string
+        message:
+          type: string
+        name:
+          type: string
+        namespace:
+          type: string
+        reason:
+          type: string
+        type:
+          type: string
+        uid:
+          type: string
+      type: object
+    kubernetes.K8sEventInvolvedObject:
+      properties:
+        kind:
+          type: string
+        name:
+          type: string
+        namespace:
+          type: string
+        uid:
+          type: string
+      type: object
+    kubernetes.K8sIngressController:
+      properties:
+        Availability:
+          type: boolean
+        ClassName:
+          type: string
+        Name:
+          type: string
+        New:
+          type: boolean
+        Type:
+          type: string
+        Used:
+          type: boolean
+      type: object
+    kubernetes.K8sIngressDeleteRequests:
+      additionalProperties:
+        items:
+          type: string
+        type: array
+      type: object
+    kubernetes.K8sIngressInfo:
+      properties:
+        Annotations:
+          additionalProperties:
+            type: string
+          type: object
+        ClassName:
+          type: string
+        CreationDate:
+          type: string
+        Hosts:
+          items:
+            type: string
+          type: array
+        Labels:
+          additionalProperties:
+            type: string
+          type: object
+        Name:
+          type: string
+        Namespace:
+          type: string
+        Paths:
+          items:
+            $ref: "#/components/schemas/kubernetes.K8sIngressPath"
+          type: array
+        TLS:
+          items:
+            $ref: "#/components/schemas/kubernetes.K8sIngressTLS"
+          type: array
+        Type:
+          type: string
+        UID:
+          type: string
+      type: object
+    kubernetes.K8sIngressPath:
+      properties:
+        HasService:
+          type: boolean
+        Host:
+          type: string
+        IngressName:
+          type: string
+        Path:
+          type: string
+        PathType:
+          type: string
+        Port:
+          type: integer
+        ServiceName:
+          type: string
+      type: object
+    kubernetes.K8sIngressTLS:
+      properties:
+        Hosts:
+          items:
+            type: string
+          type: array
+        SecretName:
+          type: string
+      type: object
+    kubernetes.K8sJob:
+      properties:
+        BackoffLimit:
+          type: integer
+        Command:
+          type: string
+        Completions:
+          type: integer
+        Container:
+          $ref: "#/components/schemas/v1.Container"
+        Duration:
+          type: string
+        FailedReason:
+          type: string
+        FinishTime:
+          type: string
+        Id:
+          type: string
+        IsSystem:
+          type: boolean
+        Name:
+          type: string
+        Namespace:
+          type: string
+        PodName:
+          type: string
+        StartTime:
+          type: string
+        Status:
+          type: string
+      type: object
+    kubernetes.K8sJobDeleteRequests:
+      additionalProperties:
+        items:
+          type: string
+        type: array
+      type: object
+    kubernetes.K8sNamespaceDetails:
+      properties:
+        Annotations:
+          additionalProperties:
+            type: string
+          type: object
+        Name:
+          type: string
+        Owner:
+          type: string
+        ResourceQuota:
+          $ref: "#/components/schemas/kubernetes.K8sResourceQuota"
+      type: object
+    kubernetes.K8sPVCResizeRequest:
+      properties:
+        name:
+          type: string
+        namespace:
+          type: string
+        newSize:
+          type: string
+      type: object
+    kubernetes.K8sPVReclaimPolicyRequest:
+      properties:
+        name:
+          type: string
+        reclaimPolicy:
+          $ref: "#/components/schemas/v1.PersistentVolumeReclaimPolicy"
+      type: object
+    kubernetes.K8sPersistentVolume:
+      properties:
+        accessModes:
+          items:
+            type: string
+          type: array
+        annotations:
+          additionalProperties:
+            type: string
+          type: object
+        capacity:
+          $ref: "#/components/schemas/v1.ResourceList"
+        claimRef:
+          $ref: "#/components/schemas/k8s_io_api_core_v1.ObjectReference"
+        creationDate:
+          type: string
+        csi:
+          $ref: "#/components/schemas/v1.CSIPersistentVolumeSource"
+        humanReadableAccessModes:
+          items:
+            $ref: "#/components/schemas/v1.PersistentVolumeAccessMode"
+          type: array
+        labels:
+          additionalProperties:
+            type: string
+          type: object
+        name:
+          type: string
+        persistentVolumeReclaimPolicy:
+          $ref: "#/components/schemas/v1.PersistentVolumeReclaimPolicy"
+        status:
+          $ref: "#/components/schemas/v1.PersistentVolumePhase"
+        storageClassName:
+          type: string
+        volumeMode:
+          $ref: "#/components/schemas/v1.PersistentVolumeMode"
+      type: object
+    kubernetes.K8sPersistentVolumeClaim:
+      properties:
+        accessModes:
+          items:
+            type: string
+          type: array
+        allowVolumeExpansion:
+          type: boolean
+        creationDate:
+          type: string
+        humanReadableAccessModes:
+          items:
+            $ref: "#/components/schemas/v1.PersistentVolumeAccessMode"
+          type: array
+        id:
+          type: string
+        labels:
+          additionalProperties:
+            type: string
+          type: object
+        name:
+          type: string
+        namespace:
+          type: string
+        owningApplications:
+          items:
+            $ref: "#/components/schemas/kubernetes.K8sApplication"
+          type: array
+        phase:
+          $ref: "#/components/schemas/v1.PersistentVolumeClaimPhase"
+        resourcesRequests:
+          $ref: "#/components/schemas/v1.ResourceList"
+        storage:
+          type: integer
+        storageClass:
+          type: string
+        storageRequest:
+          type: string
+        volumeMode:
+          $ref: "#/components/schemas/v1.PersistentVolumeMode"
+        volumeName:
+          type: string
+      type: object
+    kubernetes.K8sResourceQuota:
+      properties:
+        cpu:
+          type: string
+        enabled:
+          type: boolean
+        memory:
+          type: string
+      type: object
+    kubernetes.K8sRole:
+      properties:
+        creationDate:
+          type: string
+        isSystem:
+          description: >-
+            isSystem is true if prefixed with "system:" or exists in the
+            kube-system namespace
+
+            or is one of the portainer roles
+          type: boolean
+        name:
+          type: string
+        namespace:
+          type: string
+        uid:
+          type: string
+      type: object
+    kubernetes.K8sRoleBinding:
+      properties:
+        creationDate:
+          type: string
+        isSystem:
+          type: boolean
+        name:
+          type: string
+        namespace:
+          type: string
+        roleRef:
+          $ref: "#/components/schemas/v1.RoleRef"
+        subjects:
+          items:
+            $ref: "#/components/schemas/k8s_io_api_rbac_v1.Subject"
+          type: array
+        uid:
+          type: string
+      type: object
+    kubernetes.K8sRoleBindingDeleteRequests:
+      additionalProperties:
+        items:
+          type: string
+        type: array
+      type: object
+    kubernetes.K8sRoleDeleteRequests:
+      additionalProperties:
+        items:
+          type: string
+        type: array
+      type: object
+    kubernetes.K8sSecret:
+      properties:
+        Annotations:
+          additionalProperties:
+            type: string
+          type: object
+        ConfigurationOwner:
+          type: string
+        ConfigurationOwnerId:
+          type: string
+        ConfigurationOwners:
+          items:
+            $ref: "#/components/schemas/kubernetes.K8sConfigurationOwnerResource"
+          type: array
+        CreationDate:
+          type: string
+        Data:
+          additionalProperties:
+            type: string
+          type: object
+        IsUsed:
+          type: boolean
+        Labels:
+          additionalProperties:
+            type: string
+          type: object
+        Name:
+          type: string
+        Namespace:
+          type: string
+        SecretType:
+          type: string
+        UID:
+          type: string
+      type: object
+    kubernetes.K8sServiceAccount:
+      properties:
+        annotations:
+          additionalProperties:
+            type: string
+          type: object
+        automountServiceAccountToken:
+          type: boolean
+        creationDate:
+          type: string
+        imagePullSecrets:
+          items:
+            $ref: "#/components/schemas/k8s_io_api_core_v1.LocalObjectReference"
+          type: array
+        isSystem:
+          type: boolean
+        labels:
+          additionalProperties:
+            type: string
+          type: object
+        name:
+          type: string
+        namespace:
+          type: string
+        uid:
+          type: string
+      type: object
+    kubernetes.K8sServiceAccountDeleteRequests:
+      additionalProperties:
+        items:
+          type: string
+        type: array
+      type: object
+    kubernetes.K8sServiceAccountImagePullSecretsUpdatePayload:
+      properties:
+        secretNames:
+          items:
+            type: string
+          type: array
+      type: object
+    kubernetes.K8sServiceDeleteRequests:
+      additionalProperties:
+        items:
+          type: string
+        type: array
+      type: object
+    kubernetes.K8sServiceInfo:
+      properties:
+        AllocateLoadBalancerNodePorts:
+          type: boolean
+        Annotations:
+          additionalProperties:
+            type: string
+          type: object
+        Applications:
+          description: serviceList screen
+          items:
+            $ref: "#/components/schemas/kubernetes.K8sApplication"
+          type: array
+        ClusterIPs:
+          items:
+            type: string
+          type: array
+        CreationDate:
+          type: string
+        ExternalIPs:
+          items:
+            type: string
+          type: array
+        ExternalName:
+          type: string
+        IngressStatus:
+          items:
+            $ref: "#/components/schemas/kubernetes.K8sServiceIngress"
+          type: array
+        Labels:
+          additionalProperties:
+            type: string
+          type: object
+        Name:
+          type: string
+        Namespace:
+          type: string
+        Ports:
+          items:
+            $ref: "#/components/schemas/kubernetes.K8sServicePort"
+          type: array
+        Selector:
+          additionalProperties:
+            type: string
+          type: object
+        Type:
+          type: string
+        UID:
+          type: string
+      type: object
+    kubernetes.K8sServiceIngress:
+      properties:
+        Hostname:
+          type: string
+        IP:
+          type: string
+      type: object
+    kubernetes.K8sServicePort:
+      properties:
+        Name:
+          type: string
+        NodePort:
+          type: integer
+        Port:
+          type: integer
+        Protocol:
+          type: string
+        TargetPort:
+          type: string
+      type: object
+    kubernetes.K8sStorageClass:
+      properties:
+        allowVolumeExpansion:
+          type: boolean
+        annotations:
+          additionalProperties:
+            type: string
+          type: object
+        creationDate:
+          type: string
+        isDefault:
+          type: boolean
+        labels:
+          additionalProperties:
+            type: string
+          type: object
+        mountOptions:
+          items:
+            type: string
+          type: array
+        name:
+          type: string
+        parameters:
+          additionalProperties:
+            type: string
+          type: object
+        provisioner:
+          type: string
+        reclaimPolicy:
+          $ref: "#/components/schemas/v1.PersistentVolumeReclaimPolicy"
+      type: object
+    kubernetes.K8sVolumeDeleteRequest:
+      properties:
+        name:
+          type: string
+        namespace:
+          type: string
+      type: object
+    kubernetes.K8sVolumeInfo:
+      properties:
+        persistentVolume:
+          $ref: "#/components/schemas/kubernetes.K8sPersistentVolume"
+        persistentVolumeClaim:
+          $ref: "#/components/schemas/kubernetes.K8sPersistentVolumeClaim"
+        storageClass:
+          $ref: "#/components/schemas/kubernetes.K8sStorageClass"
+      type: object
+    kubernetes.KubernetesNodeResponse:
+      properties:
+        apiVersion:
+          description: >-
+            APIVersion defines the versioned schema of this representation of an
+            object.
+
+            Servers should convert recognized schemas to the latest internal value, and
+
+            may reject unrecognized values.
+
+            More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+
+            +optional
+          type: string
+        kind:
+          description: >-
+            Kind is a string value representing the REST resource this object
+            represents.
+
+            Servers may infer this from the endpoint the client submits requests to.
+
+            Cannot be updated.
+
+            In CamelCase.
+
+            More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+
+            +optional
+          type: string
+        metadata:
+          allOf:
+            - $ref: "#/components/schemas/v1.ObjectMeta"
+          description: >-
+            Standard object's metadata.
+
+            More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+
+            +optional
+        spec:
+          allOf:
+            - $ref: "#/components/schemas/v1.NodeSpec"
+          description: >-
+            Spec defines the behavior of a node.
+
+            https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+
+            +optional
+        status:
+          allOf:
+            - $ref: "#/components/schemas/v1.NodeStatus"
+          description: >-
+            Most recently observed status of the node.
+
+            Populated by the system.
+
+            Read-only.
+
+            More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+
+            +optional
+      type: object
+    kubernetes.Metadata:
+      properties:
+        annotations:
+          additionalProperties:
+            type: string
+          type: object
+        labels:
+          additionalProperties:
+            type: string
+          type: object
+      type: object
+    kubernetes.Pod:
+      properties:
+        ContainerName:
+          type: string
+        CreationDate:
+          type: string
+        Image:
+          type: string
+        ImagePullPolicy:
+          type: string
+        Name:
+          type: string
+        NodeName:
+          type: string
+        PodIP:
+          type: string
+        Resource:
+          $ref: "#/components/schemas/kubernetes.K8sApplicationResource"
+        Status:
+          type: string
+        Uid:
+          type: string
+      type: object
+    kubernetes.PublishedPort:
+      properties:
+        IngressRules:
+          items:
+            $ref: "#/components/schemas/kubernetes.IngressRule"
+          type: array
+        Port:
+          type: integer
+      type: object
+    kubernetes.TLSInfo:
+      properties:
+        hosts:
+          items:
+            type: string
+          type: array
+      type: object
+    kubernetes.describeResourceResponse:
+      properties:
+        describe:
+          type: string
+      type: object
+    kubernetes.kubernetesVersionResponse:
+      properties:
+        buildDate:
+          type: string
+        compiler:
+          type: string
+        emulationMajor:
+          description: EmulationMajor is the major version of the emulation version
+          type: string
+        emulationMinor:
+          description: EmulationMinor is the minor version of the emulation version
+          type: string
+        gitCommit:
+          type: string
+        gitTreeState:
+          type: string
+        gitVersion:
+          type: string
+        goVersion:
+          type: string
+        major:
+          description: Major is the major version of the binary version
+          type: string
+        minCompatibilityMajor:
+          description: MinCompatibilityMajor is the major version of the minimum
+            compatibility version
+          type: string
+        minCompatibilityMinor:
+          description: MinCompatibilityMinor is the minor version of the minimum
+            compatibility version
+          type: string
+        minor:
+          description: Minor is the minor version of the binary version
+          type: string
+        platform:
+          type: string
+        supportsPodRestart:
+          description: >-
+            SupportsPodRestart is true when the cluster exposes the
+            `pods/restart`
+
+            subresource via API discovery — i.e. the feature gate is enabled and
+
+            the cluster version is recent enough. This is the authoritative
+
+            signal for whether Portainer can call the pod-restart endpoint, and
+
+            is preferred over a raw Kubernetes-version comparison.
+          type: boolean
+      type: object
+    kubernetes.namespacesToggleSystemPayload:
+      properties:
+        System:
+          description: Toggle the system state of this namespace to true or false
+          example: true
+          type: boolean
+      type: object
+    ldap.checkPayload:
+      properties:
+        LDAPSettings:
+          $ref: "#/components/schemas/portainer.LDAPSettings"
+      type: object
+    motd.Motd:
+      properties:
+        ContentLayout:
+          additionalProperties:
+            type: string
+          type: object
+        Hash:
+          items:
+            type: integer
+          type: array
+        Message:
+          type: string
+        Style:
+          type: string
+        Title:
+          type: string
+      type: object
+    oauth2.AuthStyle:
+      enum:
+        - 0
+        - 1
+        - 2
+      type: integer
+      x-enum-varnames:
+        - AuthStyleAutoDetect
+        - AuthStyleInParams
+        - AuthStyleInHeader
+    platform.ContainerPlatform:
+      enum:
+        - Docker
+        - Docker Standalone
+        - Docker Swarm
+        - Kubernetes
+        - Podman
+      type: string
+      x-enum-varnames:
+        - PlatformDocker
+        - PlatformDockerStandalone
+        - PlatformDockerSwarm
+        - PlatformKubernetes
+        - PlatformPodman
+    portainer.APIKey:
+      properties:
+        dateCreated:
+          description: Unix timestamp (UTC) when the API key was created
+          type: integer
+        description:
+          example: portainer-api-key
+          type: string
+        digest:
+          description: Digest represents SHA256 hash of the raw API key
+          type: string
+        id:
+          example: 1
+          type: integer
+        lastUsed:
+          description: Unix timestamp (UTC) when the API key was last used
+          type: integer
+        prefix:
+          description: API key identifier (7 char prefix)
+          type: string
+        userId:
+          example: 1
+          type: integer
+      type: object
+    portainer.AccessPolicy:
+      properties:
+        Namespaces:
+          description: Namespaces is a list of namespaces that this access policy applies
+            to. Only used for namespaced level roles
+          items:
+            type: string
+          type: array
+        RoleId:
+          description: Role identifier. Reference the role that will be associated to this
+            access policy
+          example: 1
+          type: integer
+      required:
+        - RoleId
+      type: object
+    portainer.Artifact:
+      properties:
+        edgeGroups:
+          items:
+            type: integer
+          type: array
+        edgeStackId:
+          type: integer
+        envGroups:
+          items:
+            type: integer
+          type: array
+        envIds:
+          items:
+            type: integer
+          type: array
+        files:
+          items:
+            $ref: "#/components/schemas/portainer.ArtifactFile"
+          type: array
+        stackId:
+          type: integer
+      type: object
+    portainer.ArtifactFile:
+      properties:
+        hash:
+          example: abc123
+          type: string
+        path:
+          example: portainer.yaml
+          type: string
+        pathError:
+          type: string
+        pathStatus:
+          $ref: "#/components/schemas/portainer.SourceStatus"
+        ref:
+          example: refs/heads/main
+          type: string
+        refError:
+          type: string
+        refStatus:
+          $ref: "#/components/schemas/portainer.SourceStatus"
+        sourceId:
+          type: integer
+      type: object
+    portainer.AuthenticationMethod:
+      enum:
+        - 0
+        - 1
+        - 2
+        - 3
+      type: integer
+      x-enum-varnames:
+        - _
+        - AuthenticationInternal
+        - AuthenticationLDAP
+        - AuthenticationOAuth
+    portainer.Authorizations:
+      additionalProperties:
+        type: boolean
+      type: object
+    portainer.AutoUpdateSettings:
+      properties:
+        ForcePullImage:
+          description: Pull latest image
+          example: false
+          type: boolean
+        ForceUpdate:
+          description: Force update ignores repo changes
+          example: false
+          type: boolean
+        Interval:
+          description: Auto update interval
+          example: 1m30s
+          type: string
+        JobID:
+          description: Autoupdate job id
+          example: "15"
+          type: string
+        Webhook:
+          description: A UUID generated from client
+          example: 05de31a2-79fa-4644-9c12-faa67e5c49f0
+          type: string
+      type: object
+    portainer.AzureCredentials:
+      properties:
+        ApplicationID:
+          description: Azure application ID
+          example: eag7cdo9-o09l-9i83-9dO9-f0b23oe78db4
+          type: string
+        AuthenticationKey:
+          description: Azure authentication key
+          example: cOrXoK/1D35w8YQ8nH1/8ZGwzz45JIYD5jxHKXEQknk=
+          type: string
+        TenantID:
+          description: Azure tenant ID
+          example: 34ddc78d-4fel-2358-8cc1-df84c8o839f5
+          type: string
+      required:
+        - ApplicationID
+        - AuthenticationKey
+        - TenantID
+      type: object
+    portainer.CustomTemplate:
+      properties:
+        CreatedByUserId:
+          description: User identifier who created this template
+          example: 3
+          type: integer
+        Description:
+          description: Description of the template
+          example: High performance web server
+          type: string
+        EdgeTemplate:
+          description: EdgeTemplate indicates if this template purpose for Edge Stack
+          example: false
+          type: boolean
+        EntryPoint:
+          description: Path to the Stack file
+          example: docker-compose.yml
+          type: string
+        GitConfig:
+          $ref: "#/components/schemas/gittypes.RepoConfig"
+        Id:
+          description: CustomTemplate Identifier
+          example: 1
+          type: integer
+        IsComposeFormat:
+          description: IsComposeFormat indicates if the Kubernetes template is created
+            from a Docker Compose file
+          example: false
+          type: boolean
+        Logo:
+          description: URL of the template's logo
+          example: https://portainer.io/img/logo.svg
+          type: string
+        Note:
+          description: A note that will be displayed in the UI. Supports HTML content
+          example: This is my <b>custom</b> template
+          type: string
+        Platform:
+          allOf:
+            - $ref: "#/components/schemas/portainer.CustomTemplatePlatform"
+          description: |-
+            Platform associated to the template.
+            Valid values are: 1 - 'linux', 2 - 'windows'
+          enum:
+            - 1
+            - 2
+          example: 1
+        ProjectPath:
+          description: Path on disk to the repository hosting the Stack file
+          example: /data/custom_template/3
+          type: string
+        ResourceControl:
+          $ref: "#/components/schemas/portainer.ResourceControl"
+        Title:
+          description: Title of the template
+          example: Nginx
+          type: string
+        Type:
+          allOf:
+            - $ref: "#/components/schemas/portainer.StackType"
+          description: |-
+            Type of created stack:
+            * 1 - swarm
+            * 2 - compose
+            * 3 - kubernetes
+          enum:
+            - 1
+            - 2
+            - 3
+          example: 1
+        Variables:
+          items:
+            $ref: "#/components/schemas/portainer.CustomTemplateVariableDefinition"
+          type: array
+        artifact:
+          $ref: "#/components/schemas/portainer.Artifact"
+      type: object
+    portainer.CustomTemplatePlatform:
+      enum:
+        - 0
+        - 1
+        - 2
+      type: integer
+      x-enum-varnames:
+        - _
+        - CustomTemplatePlatformLinux
+        - CustomTemplatePlatformWindows
+    portainer.CustomTemplateVariableDefinition:
+      properties:
+        defaultValue:
+          example: default value
+          type: string
+        description:
+          example: Description
+          type: string
+        label:
+          example: My Variable
+          type: string
+        name:
+          example: MY_VAR
+          type: string
+      type: object
+    portainer.DiagnosticsData:
+      properties:
+        DNS:
+          additionalProperties:
+            type: string
+          type: object
+        Log:
+          type: string
+        Proxy:
+          additionalProperties:
+            type: string
+          type: object
+        Telnet:
+          additionalProperties:
+            type: string
+          type: object
+      type: object
+    portainer.DockerSnapshot:
+      properties:
+        ContainerCount:
+          type: integer
+        DiagnosticsData:
+          $ref: "#/components/schemas/portainer.DiagnosticsData"
+        DockerSnapshotRaw:
+          $ref: "#/components/schemas/portainer.DockerSnapshotRaw"
+        DockerVersion:
+          type: string
+        GpuUseAll:
+          type: boolean
+        GpuUseList:
+          items:
+            type: string
+          type: array
+        HealthyContainerCount:
+          type: integer
+        ImageCount:
+          type: integer
+        IsPodman:
+          type: boolean
+        NodeCount:
+          type: integer
+        PerformanceMetrics:
+          $ref: "#/components/schemas/portainer.PerformanceMetrics"
+        RunningContainerCount:
+          type: integer
+        ServiceCount:
+          type: integer
+        StackCount:
+          type: integer
+        StoppedContainerCount:
+          type: integer
+        Swarm:
+          type: boolean
+        Time:
+          type: integer
+        TotalCPU:
+          type: integer
+        TotalMemory:
+          type: integer
+        UnhealthyContainerCount:
+          type: integer
+        VolumeCount:
+          type: integer
+      required:
+        - ContainerCount
+        - DockerVersion
+        - GpuUseAll
+        - HealthyContainerCount
+        - ImageCount
+        - IsPodman
+        - NodeCount
+        - RunningContainerCount
+        - ServiceCount
+        - StackCount
+        - StoppedContainerCount
+        - Swarm
+        - Time
+        - TotalCPU
+        - TotalMemory
+        - UnhealthyContainerCount
+        - VolumeCount
+      type: object
+    portainer.DockerSnapshotRaw:
+      type: object
+    portainer.EcrData:
+      properties:
+        Region:
+          example: ap-southeast-2
+          type: string
+      type: object
+    portainer.Edge:
+      properties:
+        AsyncMode:
+          description: Deprecated 2.18
+          example: false
+          type: boolean
+        CommandInterval:
+          description: The command list interval for edge agent - used in edge async mode
+            (in seconds)
+          example: 5
+          type: integer
+        PingInterval:
+          description: The ping interval for edge agent - used in edge async mode (in
+            seconds)
+          example: 5
+          type: integer
+        SnapshotInterval:
+          description: The snapshot interval for edge agent - used in edge async mode (in
+            seconds)
+          example: 5
+          type: integer
+      type: object
+    portainer.EdgeGroup:
+      properties:
+        Dynamic:
+          type: boolean
+        EndpointIds:
+          $ref: "#/components/schemas/roar.Roar-portainer_EndpointID"
+        Endpoints:
+          description: "Deprecated: only used for API responses"
+          items:
+            type: integer
+          type: array
+        Id:
+          description: EdgeGroup Identifier
+          example: 1
+          type: integer
+        Name:
+          type: string
+        PartialMatch:
+          type: boolean
+        TagIds:
+          items:
+            type: integer
+          type: array
+      type: object
+    portainer.EdgeJob:
+      properties:
+        Created:
+          type: integer
+        CronExpression:
+          type: string
+        EdgeGroups:
+          items:
+            type: integer
+          type: array
+        Endpoints:
+          additionalProperties:
+            $ref: "#/components/schemas/portainer.EdgeJobEndpointMeta"
+          type: object
+        GroupLogsCollection:
+          additionalProperties:
+            $ref: "#/components/schemas/portainer.EdgeJobEndpointMeta"
+          description: Field used for log collection of Endpoints belonging to EdgeGroups
+          type: object
+        Id:
+          description: EdgeJob Identifier
+          example: 1
+          type: integer
+        Name:
+          type: string
+        Recurring:
+          type: boolean
+        ScriptPath:
+          type: string
+        Version:
+          type: integer
+      type: object
+    portainer.EdgeJobEndpointMeta:
+      properties:
+        CollectLogs:
+          type: boolean
+        LogsStatus:
+          $ref: "#/components/schemas/portainer.EdgeJobLogsStatus"
+      type: object
+    portainer.EdgeJobLogsStatus:
+      enum:
+        - 0
+        - 1
+        - 2
+        - 3
+      type: integer
+      x-enum-varnames:
+        - _
+        - EdgeJobLogsStatusIdle
+        - EdgeJobLogsStatusPending
+        - EdgeJobLogsStatusCollected
+    portainer.EdgeStack:
+      properties:
+        CreatedBy:
+          description: The username which created this stack
+          example: admin
+          type: string
+        CreatedByUserId:
+          description: The username id which created this stack
+          example: "1"
+          type: string
+        CreationDate:
+          description: StatusArray    map[EndpointID][]EdgeStackStatus `json:"StatusArray"`
+          type: integer
+        DeploymentType:
+          $ref: "#/components/schemas/portainer.EdgeStackDeploymentType"
+        EdgeGroups:
+          items:
+            type: integer
+          type: array
+        EntryPoint:
+          type: string
+        Id:
+          description: EdgeStack Identifier
+          example: 1
+          type: integer
+        ManifestPath:
+          type: string
+        Name:
+          type: string
+        NumDeployments:
+          type: integer
+        ProjectPath:
+          type: string
+        Status:
+          additionalProperties:
+            $ref: "#/components/schemas/portainer.EdgeStackStatus"
+          type: object
+        UseManifestNamespaces:
+          description: Uses the manifest's namespaces instead of the default one
+          type: boolean
+        Version:
+          type: integer
+      type: object
+    portainer.EdgeStackDeploymentStatus:
+      properties:
+        Error:
+          type: string
+        RollbackTo:
+          description: EE only feature
+          type: integer
+        Time:
+          format: int64
+          type: integer
+        Type:
+          $ref: "#/components/schemas/portainer.EdgeStackStatusType"
+        Version:
+          type: integer
+      type: object
+    portainer.EdgeStackDeploymentType:
+      enum:
+        - 0
+        - 1
+      type: integer
+      x-enum-varnames:
+        - EdgeStackDeploymentCompose
+        - EdgeStackDeploymentKubernetes
+    portainer.EdgeStackStatus:
+      properties:
+        DeploymentInfo:
+          allOf:
+            - $ref: "#/components/schemas/portainer.StackDeploymentInfo"
+          description: EE only feature
+        Details:
+          allOf:
+            - $ref: "#/components/schemas/portainer.EdgeStackStatusDetails"
+          description: Deprecated
+        EndpointID:
+          type: integer
+        Error:
+          description: Deprecated
+          type: string
+        ReadyRePullImage:
+          description: ReadyRePullImage is a flag to indicate whether the auto update is
+            trigger to re-pull image
+          type: boolean
+        Status:
+          items:
+            $ref: "#/components/schemas/portainer.EdgeStackDeploymentStatus"
+          type: array
+        Type:
+          allOf:
+            - $ref: "#/components/schemas/portainer.EdgeStackStatusType"
+          description: Deprecated
+      type: object
+    portainer.EdgeStackStatusDetails:
+      properties:
+        Acknowledged:
+          type: boolean
+        Error:
+          type: boolean
+        ImagesPulled:
+          type: boolean
+        Ok:
+          type: boolean
+        Pending:
+          type: boolean
+        RemoteUpdateSuccess:
+          type: boolean
+        Remove:
+          type: boolean
+      type: object
+    portainer.EdgeStackStatusType:
+      enum:
+        - 0
+        - 1
+        - 2
+        - 3
+        - 4
+        - 5
+        - 6
+        - 7
+        - 8
+        - 9
+        - 10
+        - 11
+        - 12
+        - 13
+      type: integer
+      x-enum-varnames:
+        - EdgeStackStatusPending
+        - EdgeStackStatusDeploymentReceived
+        - EdgeStackStatusError
+        - EdgeStackStatusAcknowledged
+        - EdgeStackStatusRemoved
+        - EdgeStackStatusRemoteUpdateSuccess
+        - EdgeStackStatusImagesPulled
+        - EdgeStackStatusRunning
+        - EdgeStackStatusDeploying
+        - EdgeStackStatusRemoving
+        - EdgeStackStatusPausedDeploying
+        - EdgeStackStatusRollingBack
+        - EdgeStackStatusRolledBack
+        - EdgeStackStatusCompleted
+    portainer.Endpoint:
+      properties:
+        Agent:
+          $ref: "#/components/schemas/portainer.EnvironmentAgentData"
+        AzureCredentials:
+          $ref: "#/components/schemas/portainer.AzureCredentials"
+        ComposeSyntaxMaxVersion:
+          description: Maximum version of docker-compose
+          example: "3.8"
+          type: string
+        ContainerEngine:
+          description: ContainerEngine represents the container engine type. This can be
+            'docker' or 'podman' when interacting directly with these
+            environments, otherwise '' for kubernetes environments.
+          example: docker
+          type: string
+        Edge:
+          $ref: "#/components/schemas/portainer.EnvironmentEdgeSettings"
+        EdgeCheckinInterval:
+          description: The check in interval for edge agent (in seconds)
+          example: 5
+          type: integer
+        EdgeID:
+          description: The identifier of the edge agent associated with this
+            environment(endpoint)
+          type: string
+        EdgeKey:
+          description: The key which is used to map the agent to Portainer
+          type: string
+        EnableGPUManagement:
+          type: boolean
+        Gpus:
+          items:
+            $ref: "#/components/schemas/portainer.Pair"
+          type: array
+        GroupId:
+          description: Environment(Endpoint) group identifier
+          example: 1
+          type: integer
+        Heartbeat:
+          description: Heartbeat indicates the heartbeat status of an edge environment
+          example: true
+          type: boolean
+        Id:
+          description: Environment(Endpoint) Identifier
+          example: 1
+          type: integer
+        Kubernetes:
+          allOf:
+            - $ref: "#/components/schemas/portainer.KubernetesData"
+          description: Associated Kubernetes data
+        LastCheckInDate:
+          description: LastCheckInDate mark last check-in date on checkin
+          type: integer
+        Name:
+          description: Environment(Endpoint) name
+          example: my-environment
+          type: string
+        PublicURL:
+          description: URL or IP address where exposed containers will be reachable
+          example: docker.mydomain.tld:2375
+          type: string
+        SecuritySettings:
+          allOf:
+            - $ref: "#/components/schemas/portainer.EndpointSecuritySettings"
+          description: Environment(Endpoint) specific security settings
+        Snapshots:
+          description: List of snapshots
+          items:
+            $ref: "#/components/schemas/portainer.DockerSnapshot"
+          type: array
+        Status:
+          allOf:
+            - $ref: "#/components/schemas/portainer.EndpointStatus"
+          description: The status of the environment(endpoint) (1 - up, 2 - down, 3 -
+            provisioning, 4 - error)
+          enum:
+            - 1
+            - 2
+            - 3
+            - 4
+          example: 1
+        TLSConfig:
+          $ref: "#/components/schemas/portainer.TLSConfiguration"
+        TagIds:
+          description: List of tag identifiers to which this environment(endpoint) is
+            associated
+          items:
+            type: integer
+          type: array
+        TeamAccessPolicies:
+          allOf:
+            - $ref: "#/components/schemas/portainer.TeamAccessPolicies"
+          description: List of team identifiers authorized to connect to this
+            environment(endpoint)
+        Type:
+          allOf:
+            - $ref: "#/components/schemas/portainer.EndpointType"
+          description: Environment(Endpoint) environment(endpoint) type. 1 for a Docker
+            environment(endpoint), 2 for an agent on Docker
+            environment(endpoint) or 3 for an Azure environment(endpoint).
+          example: 1
+        URL:
+          description: URL or IP address of the Docker host associated to this
+            environment(endpoint)
+          example: docker.mydomain.tld:2375
+          type: string
+        UserAccessPolicies:
+          allOf:
+            - $ref: "#/components/schemas/portainer.UserAccessPolicies"
+          description: List of user identifiers authorized to connect to this
+            environment(endpoint)
+        UserTrusted:
+          description: Whether the device has been trusted or not by the user
+          type: boolean
+      required:
+        - Agent
+        - ComposeSyntaxMaxVersion
+        - ContainerEngine
+        - Edge
+        - EdgeCheckinInterval
+        - EdgeKey
+        - GroupId
+        - Id
+        - Kubernetes
+        - LastCheckInDate
+        - Name
+        - PublicURL
+        - SecuritySettings
+        - TLSConfig
+        - Type
+        - URL
+      type: object
+    portainer.EndpointGroup:
+      properties:
+        Description:
+          description: Description associated to the environment(endpoint) group
+          example: Environment(Endpoint) group description
+          type: string
+        Id:
+          description: Environment(Endpoint) group Identifier
+          example: 1
+          type: integer
+        Name:
+          description: Environment(Endpoint) group name
+          example: my-environment-group
+          type: string
+        TagIds:
+          description: List of tags associated to this environment(endpoint) group
+          items:
+            type: integer
+          type: array
+        TeamAccessPolicies:
+          $ref: "#/components/schemas/portainer.TeamAccessPolicies"
+        UserAccessPolicies:
+          $ref: "#/components/schemas/portainer.UserAccessPolicies"
+      required:
+        - Description
+        - Id
+        - Name
+      type: object
+    portainer.EndpointSecuritySettings:
+      properties:
+        allowBindMountsForRegularUsers:
+          description: Whether non-administrator should be able to use bind mounts when
+            creating containers
+          example: false
+          type: boolean
+        allowContainerCapabilitiesForRegularUsers:
+          description: Whether non-administrator should be able to use container
+            capabilities
+          example: true
+          type: boolean
+        allowDeviceMappingForRegularUsers:
+          description: Whether non-administrator should be able to use device mapping
+          example: true
+          type: boolean
+        allowHostNamespaceForRegularUsers:
+          description: Whether non-administrator should be able to use the host pid
+          example: true
+          type: boolean
+        allowPrivilegedModeForRegularUsers:
+          description: Whether non-administrator should be able to use privileged mode
+            when creating containers
+          example: false
+          type: boolean
+        allowSecurityOptForRegularUsers:
+          description: Whether non-administrator should be able to use security-opt settings
+          example: true
+          type: boolean
+        allowStackManagementForRegularUsers:
+          description: Whether non-administrator should be able to manage stacks
+          example: true
+          type: boolean
+        allowSysctlSettingForRegularUsers:
+          description: Whether non-administrator should be able to use sysctl settings
+          example: true
+          type: boolean
+        allowVolumeBrowserForRegularUsers:
+          description: Whether non-administrator should be able to browse volumes
+          example: true
+          type: boolean
+        enableHostManagementFeatures:
+          description: Whether host management features are enabled
+          example: true
+          type: boolean
+      required:
+        - allowBindMountsForRegularUsers
+        - allowContainerCapabilitiesForRegularUsers
+        - allowDeviceMappingForRegularUsers
+        - allowHostNamespaceForRegularUsers
+        - allowPrivilegedModeForRegularUsers
+        - allowSecurityOptForRegularUsers
+        - allowStackManagementForRegularUsers
+        - allowSysctlSettingForRegularUsers
+        - allowVolumeBrowserForRegularUsers
+        - enableHostManagementFeatures
+      type: object
+    portainer.EndpointStatus:
+      enum:
+        - 0
+        - 1
+        - 2
+      type: integer
+      x-enum-varnames:
+        - _
+        - EndpointStatusUp
+        - EndpointStatusDown
+    portainer.EndpointType:
+      enum:
+        - 0
+        - 1
+        - 2
+        - 3
+        - 4
+        - 5
+        - 6
+        - 7
+      type: integer
+      x-enum-varnames:
+        - _
+        - DockerEnvironment
+        - AgentOnDockerEnvironment
+        - AzureEnvironment
+        - EdgeAgentOnDockerEnvironment
+        - KubernetesLocalEnvironment
+        - AgentOnKubernetesEnvironment
+        - EdgeAgentOnKubernetesEnvironment
+    portainer.EnvironmentAgentData:
+      properties:
+        Version:
+          example: 1.0.0
+          type: string
+      type: object
+    portainer.EnvironmentEdgeSettings:
+      properties:
+        AsyncMode:
+          description: Whether the device has been started in edge async mode
+          type: boolean
+        CommandInterval:
+          description: The command list interval for edge agent - used in edge async mode
+            [seconds]
+          example: 60
+          type: integer
+        PingInterval:
+          description: The ping interval for edge agent - used in edge async mode [seconds]
+          example: 60
+          type: integer
+        SnapshotInterval:
+          description: The snapshot interval for edge agent - used in edge async mode
+            [seconds]
+          example: 60
+          type: integer
+      required:
+        - AsyncMode
+        - CommandInterval
+        - PingInterval
+        - SnapshotInterval
+      type: object
+    portainer.GithubRegistryData:
+      properties:
+        OrganisationName:
+          type: string
+        UseOrganisation:
+          type: boolean
+      type: object
+    portainer.GitlabRegistryData:
+      properties:
+        InstanceURL:
+          type: string
+        ProjectId:
+          type: integer
+        ProjectPath:
+          type: string
+      type: object
+    portainer.GlobalDeploymentOptions:
+      properties:
+        hideStacksFunctionality:
+          example: false
+          type: boolean
+      type: object
+    portainer.HelmConfig:
+      properties:
+        Atomic:
+          description: >-
+            Atomic enables automatic rollback on deployment failure (equivalent
+            to helm --atomic).
+
+            Used by both git repo and Helm repository deployments.
+          example: true
+          type: boolean
+        ChartName:
+          description: |-
+            ChartName is the name of the Helm chart within the repository.
+            Required for Helm repository deployments.
+          example: nginx
+          type: string
+        ChartPath:
+          description: >-
+            ChartPath is the path to a Helm chart folder within the cloned git
+            repository.
+
+            Used exclusively for git repo helm deployments. Mutually exclusive with ChartURL.
+          example: charts/my-app
+          type: string
+        ChartURL:
+          description: >-
+            ChartURL is the URL of a Helm chart repository.
+
+            Used exclusively for Helm repository deployments. Mutually exclusive with ChartPath.
+          example: https://charts.bitnami.com/bitnami
+          type: string
+        ChartVersion:
+          description: >-
+            ChartVersion is the version of the Helm chart to deploy. Empty means
+            latest.
+
+            Used exclusively for Helm repository deployments.
+          example: 15.0.0
+          type: string
+        Namespace:
+          description: |-
+            Namespace is the Kubernetes namespace to deploy the Helm chart into.
+            Used by both git repo and Helm repository deployments.
+          example: default
+          type: string
+        Timeout:
+          description: >-
+            Timeout sets the deadline for Helm operations (equivalent to helm
+            --timeout, e.g. "5m0s").
+
+            Used by both git repo and Helm repository deployments.
+          example: 5m0s
+          type: string
+        ValuesFiles:
+          description: >-
+            ValuesFiles is a list of relative paths to Helm values YAML files
+            within the cloned git repository.
+
+            Used exclusively for git repo helm deployments.
+          example:
+            - "['values/prod.yaml'"
+            - " 'values/secrets.yaml']"
+          items:
+            type: string
+          type: array
+        ValuesInline:
+          description: |-
+            ValuesInline is the inline YAML string of Helm values.
+            Used exclusively for Helm repository deployments.
+          example: "replicaCount: 2"
+          type: string
+      type: object
+    portainer.HelmUserRepository:
+      properties:
+        Id:
+          description: Membership Identifier
+          example: 1
+          type: integer
+        URL:
+          description: Helm repository URL
+          example: https://charts.bitnami.com/bitnami
+          type: string
+        UserId:
+          description: User identifier
+          example: 1
+          type: integer
+      type: object
+    portainer.InternalAuthSettings:
+      properties:
+        RequiredPasswordLength:
+          type: integer
+      type: object
+    portainer.K8sNamespaceInfo:
+      properties:
+        Annotations:
+          additionalProperties:
+            type: string
+          type: object
+        CreationDate:
+          type: string
+        Id:
+          type: string
+        IsDefault:
+          type: boolean
+        IsSystem:
+          type: boolean
+        Name:
+          type: string
+        NamespaceOwner:
+          type: string
+        ResourceQuota:
+          $ref: "#/components/schemas/v1.ResourceQuota"
+        Status:
+          $ref: "#/components/schemas/v1.NamespaceStatus"
+        UnhealthyEventCount:
+          type: integer
+      type: object
+    portainer.K8sNodeLimits:
+      properties:
+        CPU:
+          type: integer
+        Memory:
+          type: integer
+      type: object
+    portainer.K8sNodesLimits:
+      additionalProperties:
+        $ref: "#/components/schemas/portainer.K8sNodeLimits"
+      type: object
+    portainer.KubernetesConfiguration:
+      properties:
+        AllowNoneIngressClass:
+          type: boolean
+        EnableResourceOverCommit:
+          type: boolean
+        IngressAvailabilityPerNamespace:
+          type: boolean
+        IngressClasses:
+          items:
+            $ref: "#/components/schemas/portainer.KubernetesIngressClassConfig"
+          type: array
+        ResourceOverCommitPercentage:
+          type: integer
+        RestrictDefaultNamespace:
+          type: boolean
+        StorageClasses:
+          items:
+            $ref: "#/components/schemas/portainer.KubernetesStorageClassConfig"
+          type: array
+        UseLoadBalancer:
+          type: boolean
+        UseServerMetrics:
+          type: boolean
+      required:
+        - AllowNoneIngressClass
+        - IngressAvailabilityPerNamespace
+      type: object
+    portainer.KubernetesData:
+      properties:
+        Configuration:
+          $ref: "#/components/schemas/portainer.KubernetesConfiguration"
+        Flags:
+          $ref: "#/components/schemas/portainer.KubernetesFlags"
+        Snapshots:
+          items:
+            $ref: "#/components/schemas/portainer.KubernetesSnapshot"
+          type: array
+      required:
+        - Configuration
+        - Flags
+      type: object
+    portainer.KubernetesFlags:
+      properties:
+        GPUOperator:
+          type: boolean
+        IsServerIngressClassDetected:
+          type: boolean
+        IsServerMetricsDetected:
+          type: boolean
+        IsServerStorageDetected:
+          type: boolean
+      required:
+        - IsServerIngressClassDetected
+        - IsServerMetricsDetected
+        - IsServerStorageDetected
+      type: object
+    portainer.KubernetesIngressClassConfig:
+      properties:
+        Blocked:
+          type: boolean
+        BlockedNamespaces:
+          items:
+            type: string
+          type: array
+        Name:
+          type: string
+        Type:
+          type: string
+      required:
+        - Name
+        - Type
+      type: object
+    portainer.KubernetesSnapshot:
+      properties:
+        ClusterType:
+          type: string
+        DiagnosticsData:
+          $ref: "#/components/schemas/portainer.DiagnosticsData"
+        GPUNodeCount:
+          type: integer
+        KubernetesVersion:
+          type: string
+        NodeCount:
+          type: integer
+        PerformanceMetrics:
+          $ref: "#/components/schemas/portainer.PerformanceMetrics"
+        Time:
+          type: integer
+        TotalCPU:
+          type: integer
+        TotalGPU:
+          additionalProperties:
+            format: int64
+            type: integer
+          type: object
+        TotalMemory:
+          type: integer
+      required:
+        - KubernetesVersion
+        - NodeCount
+        - Time
+        - TotalCPU
+        - TotalMemory
+      type: object
+    portainer.KubernetesStorageClassConfig:
+      properties:
+        AccessModes:
+          items:
+            type: string
+          type: array
+        AllowVolumeExpansion:
+          type: boolean
+        Name:
+          type: string
+        Provisioner:
+          type: string
+      required:
+        - AllowVolumeExpansion
+        - Name
+        - Provisioner
+      type: object
+    portainer.LDAPGroupSearchSettings:
+      properties:
+        GroupAttribute:
+          description: LDAP attribute which denotes the group membership
+          example: member
+          type: string
+        GroupBaseDN:
+          description: The distinguished name of the element from which the LDAP server
+            will search for groups
+          example: dc=ldap,dc=domain,dc=tld
+          type: string
+        GroupFilter:
+          description: The LDAP search filter used to select group elements, optional
+          example: (objectClass=account
+          type: string
+      type: object
+    portainer.LDAPSearchSettings:
+      properties:
+        BaseDN:
+          description: The distinguished name of the element from which the LDAP server
+            will search for users
+          example: dc=ldap,dc=domain,dc=tld
+          type: string
+        Filter:
+          description: Optional LDAP search filter used to select user elements
+          example: (objectClass=account)
+          type: string
+        UserNameAttribute:
+          description: LDAP attribute which denotes the username
+          example: uid
+          type: string
+      type: object
+    portainer.LDAPSettings:
+      properties:
+        AnonymousMode:
+          description: Enable this option if the server is configured for Anonymous
+            access. When enabled, ReaderDN and Password will not be used
+          example: true
+          type: boolean
+        AutoCreateUsers:
+          description: Automatically provision users and assign them to matching LDAP
+            group names
+          example: true
+          type: boolean
+        GroupSearchSettings:
+          items:
+            $ref: "#/components/schemas/portainer.LDAPGroupSearchSettings"
+          type: array
+        Password:
+          description: Password of the account that will be used to search users
+          example: readonly-password
+          type: string
+        ReaderDN:
+          description: Account that will be used to search for users
+          example: cn=readonly-account,dc=ldap,dc=domain,dc=tld
+          type: string
+        SearchSettings:
+          items:
+            $ref: "#/components/schemas/portainer.LDAPSearchSettings"
+          type: array
+        StartTLS:
+          description: Whether LDAP connection should use StartTLS
+          example: true
+          type: boolean
+        TLSConfig:
+          $ref: "#/components/schemas/portainer.TLSConfiguration"
+        URL:
+          description: URL or IP address of the LDAP server
+          example: myldap.domain.tld:389
+          type: string
+      type: object
+    portainer.MembershipRole:
+      enum:
+        - 0
+        - 1
+        - 2
+      type: integer
+      x-enum-varnames:
+        - _
+        - TeamLeader
+        - TeamMember
+    portainer.OAuthSettings:
+      properties:
+        AccessTokenURI:
+          type: string
+        AuthStyle:
+          $ref: "#/components/schemas/oauth2.AuthStyle"
+        AuthorizationURI:
+          type: string
+        ClientID:
+          type: string
+        ClientSecret:
+          type: string
+        DefaultTeamID:
+          type: integer
+        KubeSecretKey:
+          items:
+            type: integer
+          type: array
+        LogoutURI:
+          type: string
+        OAuthAutoCreateUsers:
+          type: boolean
+        RedirectURI:
+          type: string
+        ResourceURI:
+          type: string
+        SSO:
+          type: boolean
+        Scopes:
+          type: string
+        UserIdentifier:
+          type: string
+      type: object
+    portainer.Pair:
+      properties:
+        name:
+          example: name
+          type: string
+        value:
+          example: value
+          type: string
+      required:
+        - name
+        - value
+      type: object
+    portainer.PerformanceMetrics:
+      properties:
+        CPUUsage:
+          type: number
+        DiskUsage:
+          type: number
+        MemoryUsage:
+          type: number
+        NetworkUsage:
+          type: number
+      type: object
+    portainer.QuayRegistryData:
+      properties:
+        OrganisationName:
+          type: string
+        UseOrganisation:
+          type: boolean
+      type: object
+    portainer.Registry:
+      properties:
+        AccessToken:
+          description: Stores temporary access token
+          type: string
+        AccessTokenExpiry:
+          type: integer
+        Authentication:
+          description: Is authentication against this registry enabled
+          example: true
+          type: boolean
+        AuthorizedTeams:
+          description: Deprecated in DBVersion == 18
+          items:
+            type: integer
+          type: array
+        AuthorizedUsers:
+          description: Deprecated in DBVersion == 18
+          items:
+            type: integer
+          type: array
+        BaseURL:
+          description: Base URL, introduced for ProGet registry
+          example: registry.mydomain.tld:2375
+          type: string
+        Ecr:
+          $ref: "#/components/schemas/portainer.EcrData"
+        Github:
+          $ref: "#/components/schemas/portainer.GithubRegistryData"
+        Gitlab:
+          $ref: "#/components/schemas/portainer.GitlabRegistryData"
+        Id:
+          description: Registry Identifier
+          example: 1
+          type: integer
+        ManagementConfiguration:
+          $ref: "#/components/schemas/portainer.RegistryManagementConfiguration"
+        Name:
+          description: Registry Name
+          example: my-registry
+          type: string
+        Password:
+          description: Password or SecretAccessKey used to authenticate against this
+            registry
+          example: registry_password
+          type: string
+        Quay:
+          $ref: "#/components/schemas/portainer.QuayRegistryData"
+        RegistryAccesses:
+          $ref: "#/components/schemas/portainer.RegistryAccesses"
+        TeamAccessPolicies:
+          allOf:
+            - $ref: "#/components/schemas/portainer.TeamAccessPolicies"
+          description: Deprecated in DBVersion == 31
+        Type:
+          allOf:
+            - $ref: "#/components/schemas/portainer.RegistryType"
+          description: Registry Type (1 - Quay, 2 - Azure, 3 - Custom, 4 - Gitlab, 5 -
+            ProGet, 6 - DockerHub, 7 - ECR)
+          enum:
+            - 1
+            - 2
+            - 3
+            - 4
+            - 5
+            - 6
+            - 7
+        URL:
+          description: URL or IP address of the Docker registry
+          example: registry.mydomain.tld:2375
+          type: string
+        UserAccessPolicies:
+          allOf:
+            - $ref: "#/components/schemas/portainer.UserAccessPolicies"
+          description: |-
+            Deprecated fields
+            Deprecated in DBVersion == 31
+        Username:
+          description: Username or AccessKeyID used to authenticate against this registry
+          example: registry user
+          type: string
+      type: object
+    portainer.RegistryAccessPolicies:
+      properties:
+        Namespaces:
+          description: Kubernetes specific fields (with kubernetes, namespaces have access
+            to a registry, if users/teams have access to the same namespace,
+            they have access to the registry)
+          items:
+            type: string
+          type: array
+        TeamAccessPolicies:
+          $ref: "#/components/schemas/portainer.TeamAccessPolicies"
+        UserAccessPolicies:
+          allOf:
+            - $ref: "#/components/schemas/portainer.UserAccessPolicies"
+          description: Docker specific fields (with docker, users/teams have access to a
+            registry)
+      type: object
+    portainer.RegistryAccesses:
+      additionalProperties:
+        $ref: "#/components/schemas/portainer.RegistryAccessPolicies"
+      type: object
+    portainer.RegistryManagementConfiguration:
+      properties:
+        AccessToken:
+          type: string
+        AccessTokenExpiry:
+          type: integer
+        Authentication:
+          type: boolean
+        Ecr:
+          $ref: "#/components/schemas/portainer.EcrData"
+        Password:
+          type: string
+        TLSConfig:
+          $ref: "#/components/schemas/portainer.TLSConfiguration"
+        Type:
+          $ref: "#/components/schemas/portainer.RegistryType"
+        Username:
+          type: string
+      type: object
+    portainer.RegistryType:
+      enum:
+        - 0
+        - 1
+        - 2
+        - 3
+        - 4
+        - 5
+        - 6
+        - 7
+        - 8
+      type: integer
+      x-enum-varnames:
+        - _
+        - QuayRegistry
+        - AzureRegistry
+        - CustomRegistry
+        - GitlabRegistry
+        - ProGetRegistry
+        - DockerHubRegistry
+        - EcrRegistry
+        - GithubRegistry
+    portainer.ResourceAccessLevel:
+      enum:
+        - 0
+        - 1
+      type: integer
+      x-enum-varnames:
+        - _
+        - ReadWriteAccessLevel
+    portainer.ResourceControl:
+      properties:
+        AccessLevel:
+          $ref: "#/components/schemas/portainer.ResourceAccessLevel"
+        AdministratorsOnly:
+          description: Permit access to resource only to admins
+          example: true
+          type: boolean
+        Id:
+          description: ResourceControl Identifier
+          example: 1
+          type: integer
+        OwnerId:
+          description: |-
+            Deprecated fields
+            Deprecated in DBVersion == 2
+          type: integer
+        Public:
+          description: Permit access to the associated resource to any user
+          example: true
+          type: boolean
+        ResourceId:
+          description: >-
+            Docker resource identifier on which access control will be applied.\
+
+            In the case of a resource control applied to a stack, use the stack name as identifier
+          example: 617c5f22bb9b023d6daab7cba43a57576f83492867bc767d1c59416b065e5f08
+          type: string
+        SubResourceIds:
+          description: List of Docker resources that will inherit this access control
+          example:
+            - 617c5f22bb9b023d6daab7cba43a57576f83492867bc767d1c59416b065e5f08
+          items:
+            type: string
+          type: array
+        System:
+          type: boolean
+        TeamAccesses:
+          items:
+            $ref: "#/components/schemas/portainer.TeamResourceAccess"
+          type: array
+        Type:
+          allOf:
+            - $ref: "#/components/schemas/portainer.ResourceControlType"
+          description: |-
+            Type of Docker resource. Valid values are: 1- container, 2 -service
+            3 - volume, 4 - secret, 5 - stack, 6 - config or 7 - custom template
+          example: 1
+        UserAccesses:
+          items:
+            $ref: "#/components/schemas/portainer.UserResourceAccess"
+          type: array
+      type: object
+    portainer.ResourceControlType:
+      enum:
+        - 0
+        - 1
+        - 2
+        - 3
+        - 4
+        - 5
+        - 6
+        - 7
+        - 8
+        - 9
+      type: integer
+      x-enum-varnames:
+        - _
+        - ContainerResourceControl
+        - ServiceResourceControl
+        - VolumeResourceControl
+        - NetworkResourceControl
+        - SecretResourceControl
+        - StackResourceControl
+        - ConfigResourceControl
+        - CustomTemplateResourceControl
+        - ContainerGroupResourceControl
+    portainer.Role:
+      properties:
+        Authorizations:
+          allOf:
+            - $ref: "#/components/schemas/portainer.Authorizations"
+          description: Authorizations associated to a role
+        Description:
+          description: Role description
+          example: Read-only access of all resources in an environment(endpoint)
+          type: string
+        Id:
+          description: Role Identifier
+          example: 1
+          type: integer
+        Name:
+          description: Role name
+          example: HelpDesk
+          type: string
+        Priority:
+          type: integer
+      type: object
+    portainer.SSLSettings:
+      properties:
+        certPath:
+          type: string
+        httpEnabled:
+          type: boolean
+        keyPath:
+          type: string
+        selfSigned:
+          type: boolean
+      type: object
+    portainer.Settings:
+      properties:
+        AgentSecret:
+          description: Container environment parameter AGENT_SECRET
+          type: string
+        AllowBindMountsForRegularUsers:
+          type: boolean
+        AllowContainerCapabilitiesForRegularUsers:
+          type: boolean
+        AllowDeviceMappingForRegularUsers:
+          type: boolean
+        AllowHostNamespaceForRegularUsers:
+          type: boolean
+        AllowPrivilegedModeForRegularUsers:
+          type: boolean
+        AllowStackManagementForRegularUsers:
+          type: boolean
+        AllowVolumeBrowserForRegularUsers:
+          type: boolean
+        AuthenticationMethod:
+          allOf:
+            - $ref: "#/components/schemas/portainer.AuthenticationMethod"
+          description: "Active authentication method for the Portainer instance. Valid
+            values are: 1 for internal, 2 for LDAP, or 3 for oauth"
+          example: 1
+        BlackListedLabels:
+          description: A list of label name & value that will be used to hide containers
+            when querying containers
+          items:
+            $ref: "#/components/schemas/portainer.Pair"
+          type: array
+        DisplayDonationHeader:
+          description: Deprecated fields
+          type: boolean
+        DisplayExternalContributors:
+          type: boolean
+        Edge:
+          $ref: "#/components/schemas/portainer.Edge"
+        EdgeAgentCheckinInterval:
+          description: The default check in interval for edge agent (in seconds)
+          example: 5
+          type: integer
+        EdgePortainerUrl:
+          description: EdgePortainerURL is the URL that is exposed to edge agents
+          type: string
+        EnableEdgeComputeFeatures:
+          description: Whether edge compute features are enabled
+          type: boolean
+        EnableHostManagementFeatures:
+          description: Deprecated fields v26
+          type: boolean
+        EnforceEdgeID:
+          description: EnforceEdgeID makes Portainer store the Edge ID instead of
+            accepting anyone
+          example: false
+          type: boolean
+        FeatureFlagSettings:
+          additionalProperties:
+            type: boolean
+          type: object
+        ForceSecureCookies:
+          description: >-
+            ForceSecureCookies forces the Secure attribute on auth cookies
+            regardless of detected scheme.
+
+            Enable when Portainer runs behind a TLS-terminating proxy.
+          example: false
+          type: boolean
+        GlobalDeploymentOptions:
+          allOf:
+            - $ref: "#/components/schemas/portainer.GlobalDeploymentOptions"
+          description: Deployment options for encouraging git ops workflows
+        HelmRepositoryURL:
+          description: Helm repository URL, defaults to "https://charts.bitnami.com/bitnami"
+          example: https://charts.bitnami.com/bitnami
+          type: string
+        InternalAuthSettings:
+          $ref: "#/components/schemas/portainer.InternalAuthSettings"
+        IsDockerDesktopExtension:
+          type: boolean
+        KubeconfigExpiry:
+          description: The expiry of a Kubeconfig
+          example: 24h
+          type: string
+        KubectlShellImage:
+          description: KubectlImage, defaults to portainer/kubectl-shell
+          example: portainer/kubectl-shell
+          type: string
+        LDAPSettings:
+          $ref: "#/components/schemas/portainer.LDAPSettings"
+        LogoURL:
+          description: URL to a logo that will be displayed on the login page as well as
+            on top of the sidebar. Will use default Portainer logo when value is
+            empty string
+          example: https://mycompany.mydomain.tld/logo.png
+          type: string
+        OAuthSettings:
+          $ref: "#/components/schemas/portainer.OAuthSettings"
+        SnapshotInterval:
+          description: The interval in which environment(endpoint) snapshots are created
+          example: 5m
+          type: string
+        TemplatesURL:
+          description: URL to the templates that will be displayed in the UI when
+            navigating to App Templates
+          example: https://raw.githubusercontent.com/portainer/templates/master/templates.json
+          type: string
+        TrustOnFirstConnect:
+          description: TrustOnFirstConnect makes Portainer accepting edge agent connection
+            by default
+          example: false
+          type: boolean
+        UserSessionTimeout:
+          description: The duration of a user session
+          example: 5m
+          type: string
+      type: object
+    portainer.Source:
+      properties:
+        administratorsOnly:
+          type: boolean
+        git:
+          $ref: "#/components/schemas/gittypes.GitSource"
+        helm:
+          $ref: "#/components/schemas/portainer.HelmConfig"
+        id:
+          example: 1
+          type: integer
+        lastSync:
+          example: 1587399600
+          type: integer
+        name:
+          example: my-source
+          type: string
+        ownerID:
+          type: integer
+        public:
+          type: boolean
+        registry:
+          $ref: "#/components/schemas/portainer.Registry"
+        status:
+          $ref: "#/components/schemas/portainer.SourceStatus"
+        statusError:
+          type: string
+        teamAccesses:
+          items:
+            type: integer
+          type: array
+        type:
+          allOf:
+            - $ref: "#/components/schemas/portainer.SourceType"
+          example: 1
+        userAccesses:
+          items:
+            type: integer
+          type: array
+      type: object
+    portainer.SourceStatus:
+      enum:
+        - 0
+        - 1
+        - 2
+      type: integer
+      x-enum-varnames:
+        - SourceStatusUnknown
+        - SourceStatusHealthy
+        - SourceStatusError
+    portainer.SourceType:
+      enum:
+        - 0
+        - 1
+        - 2
+        - 3
+      type: integer
+      x-enum-varnames:
+        - _
+        - SourceTypeGit
+        - SourceTypeRegistry
+        - SourceTypeHelm
+    portainer.Stack:
+      properties:
+        AdditionalFiles:
+          description: Only applies when deploying stack with multiple files
+          items:
+            type: string
+          type: array
+        AutoUpdate:
+          allOf:
+            - $ref: "#/components/schemas/portainer.AutoUpdateSettings"
+          description: The GitOps update settings of a git stack
+        CreatedBy:
+          description: The username which created this stack
+          example: admin
+          type: string
+        CreationDate:
+          description: The date in unix time when stack was created
+          example: 1587399600
+          type: integer
+        CurrentDeploymentInfo:
+          allOf:
+            - $ref: "#/components/schemas/portainer.StackDeploymentInfo"
+          description: CurrentDeploymentInfo records the git repository state at the time
+            of the last actual deployment.
+        DeploymentStartStatus:
+          allOf:
+            - $ref: "#/components/schemas/portainer.StackStatus"
+          description: >-
+            DeploymentStartStatus is the stack status captured when the current
+
+            deployment starts. It is used by deployment logic during the current
+
+            deployment attempt and is cleared/replaced when a new deployment begins.
+          example: 1
+        DeploymentStatus:
+          description: >-
+            DeploymentStatus records the status progression of the current
+            deployment.
+
+            Cleared when a new deployment starts.
+          items:
+            $ref: "#/components/schemas/portainer.StackDeploymentStatus"
+          type: array
+        EndpointId:
+          description: Environment(Endpoint) identifier. Reference the
+            environment(endpoint) that will be used for deployment
+          example: 1
+          type: integer
+        EntryPoint:
+          description: >-
+            EntryPoint is the path to the config file relative to the project
+            root.
+
+            NOTE: For git stacks this mirrors GitConfig.ConfigFilePath and the two are kept in sync
+
+            by stackUpdateGit. The deploy command builder (compose_unpacker_cmd_builder) uses this
+
+            field directly; Kubernetes deploy and git clone operations use GitConfig.ConfigFilePath.
+          example: docker-compose.yml
+          type: string
+        Env:
+          description: A list of environment(endpoint) variables used during stack
+            deployment
+          items:
+            $ref: "#/components/schemas/portainer.Pair"
+          type: array
+        FromAppTemplate:
+          description: Whether the stack is from a app template
+          example: false
+          type: boolean
+        GitConfig:
+          allOf:
+            - $ref: "#/components/schemas/gittypes.RepoConfig"
+          description: >-
+            GitConfig is the git repository configuration for git-backed stacks.
+
+            Deprecated: loaded from Source via WorkflowID; kept for DB backwards-compatibility only.
+
+            Non-migration code must not read or write this field; use Source records instead.
+        Id:
+          description: Stack Identifier
+          example: 1
+          type: integer
+        Name:
+          description: Stack name
+          example: myStack
+          type: string
+        Namespace:
+          description: Kubernetes namespace if stack is a kube application
+          example: default
+          type: string
+        Option:
+          allOf:
+            - $ref: "#/components/schemas/portainer.StackOption"
+          description: The stack deployment option
+        ProjectPath:
+          description: Path on disk to the repository hosting the Stack file
+          example: /data/compose/myStack_jpofkc0i9uo9wtx1zesuk649w
+          type: string
+        ResourceControl:
+          $ref: "#/components/schemas/portainer.ResourceControl"
+        Status:
+          allOf:
+            - $ref: "#/components/schemas/portainer.StackStatus"
+          description: Stack status (1 - active, 2 - inactive, 3 - deploying, 4 - error)
+          example: 1
+        SwarmId:
+          description: Cluster identifier of the Swarm cluster where the stack is deployed
+          example: jpofkc0i9uo9wtx1zesuk649w
+          type: string
+        Type:
+          allOf:
+            - $ref: "#/components/schemas/portainer.StackType"
+          description: Stack type. 1 for a Swarm stack, 2 for a Compose stack
+          example: 2
+        UpdateDate:
+          description: The date in unix time when stack was last updated
+          example: 1587399600
+          type: integer
+        UpdatedBy:
+          description: The username which last updated this stack
+          example: bob
+          type: string
+        WorkflowID:
+          description: WorkflowID is the ID of the Workflow that owns the Source for this
+            stack.
+          type: integer
+      type: object
+    portainer.StackDeploymentInfo:
+      properties:
+        AdditionalFiles:
+          description: AdditionalFiles are the additional files used for deploying the stack
+          items:
+            type: string
+          type: array
+        ConfigFilePath:
+          description: ConfigFilePath is the path to the config file in the git repository
+            used for deploying the stack
+          type: string
+        ConfigHash:
+          description: ConfigHash is the commit hash of the git repository used for
+            deploying the stack
+          type: string
+        FileVersion:
+          description: FileVersion is the version of the stack file, used to detect changes
+          type: integer
+        ReferenceName:
+          description: ReferenceName is the git reference (branch/tag) used for deploying
+            the stack
+          type: string
+        RepositoryURL:
+          description: RepositoryURL is the git repository URL used for deploying the stack
+          type: string
+        SourceID:
+          description: SourceID is the Source used for deploying the stack
+          type: integer
+        Version:
+          description: Version is the version of the stack and also is the deployed
+            version in edge agent
+          type: integer
+      type: object
+    portainer.StackDeploymentStatus:
+      properties:
+        Message:
+          description: populated on Error entries
+          type: string
+        Status:
+          $ref: "#/components/schemas/portainer.StackStatus"
+        Time:
+          type: integer
+      type: object
+    portainer.StackOption:
+      properties:
+        HelmAtomic:
+          description: Enable atomic rollback on failure (Helm --atomic flag for
+            Kubernetes Helm stacks)
+          example: false
+          type: boolean
+        Prune:
+          description: Prune services that are no longer referenced
+          example: false
+          type: boolean
+      type: object
+    portainer.StackStatus:
+      enum:
+        - 0
+        - 1
+        - 2
+        - 3
+        - 4
+      type: integer
+      x-enum-comments:
+        StackStatusActive: 1 - deployed and running
+        StackStatusDeploying: 3 - deployment in progress
+        StackStatusError: 4 - deployment failed
+        StackStatusInactive: 2 - intentionally stopped
+      x-enum-descriptions:
+        - ""
+        - 1 - deployed and running
+        - 2 - intentionally stopped
+        - 3 - deployment in progress
+        - 4 - deployment failed
+      x-enum-varnames:
+        - _
+        - StackStatusActive
+        - StackStatusInactive
+        - StackStatusDeploying
+        - StackStatusError
+    portainer.StackType:
+      enum:
+        - 0
+        - 1
+        - 2
+        - 3
+      type: integer
+      x-enum-varnames:
+        - _
+        - DockerSwarmStack
+        - DockerComposeStack
+        - KubernetesStack
+    portainer.TLSConfiguration:
+      properties:
+        TLS:
+          description: Use TLS
+          example: true
+          type: boolean
+        TLSCACert:
+          description: Path to the TLS CA certificate file
+          example: /data/tls/ca.pem
+          type: string
+        TLSCert:
+          description: Path to the TLS client certificate file
+          example: /data/tls/cert.pem
+          type: string
+        TLSKey:
+          description: Path to the TLS client key file
+          example: /data/tls/key.pem
+          type: string
+        TLSSkipVerify:
+          description: Skip the verification of the server TLS certificate
+          example: false
+          type: boolean
+      required:
+        - TLS
+        - TLSSkipVerify
+      type: object
+    portainer.Tag:
+      properties:
+        EndpointGroups:
+          additionalProperties:
+            type: boolean
+          description: A set of environment(endpoint) group ids that have this tag
+          type: object
+        Endpoints:
+          additionalProperties:
+            type: boolean
+          description: A set of environment(endpoint) ids that have this tag
+          type: object
+        ID:
+          description: Tag identifier
+          example: 1
+          type: integer
+        Name:
+          description: Tag name
+          example: org/acme
+          type: string
+      type: object
+    portainer.Team:
+      properties:
+        Id:
+          description: Team Identifier
+          example: 1
+          type: integer
+        Name:
+          description: Team name
+          example: developers
+          type: string
+      type: object
+    portainer.TeamAccessPolicies:
+      additionalProperties:
+        $ref: "#/components/schemas/portainer.AccessPolicy"
+      type: object
+    portainer.TeamMembership:
+      properties:
+        Id:
+          description: Membership Identifier
+          example: 1
+          type: integer
+        Role:
+          allOf:
+            - $ref: "#/components/schemas/portainer.MembershipRole"
+          description: Team role (1 for team leader and 2 for team member)
+          example: 1
+        TeamID:
+          description: Team identifier
+          example: 1
+          type: integer
+        UserID:
+          description: User identifier
+          example: 1
+          type: integer
+      type: object
+    portainer.TeamResourceAccess:
+      properties:
+        AccessLevel:
+          $ref: "#/components/schemas/portainer.ResourceAccessLevel"
+        TeamId:
+          type: integer
+      type: object
+    portainer.Template:
+      properties:
+        administrator_only:
+          description: Whether the template should be available to administrators only
+          example: true
+          type: boolean
+        categories:
+          description: A list of categories associated to the template
+          example:
+            - database
+          items:
+            type: string
+          type: array
+        command:
+          description: The command that will be executed in a container template
+          example: ls -lah
+          type: string
+        description:
+          description: Description of the template
+          example: High performance web server
+          type: string
+        env:
+          description: A list of environment(endpoint) variables used during the template
+            deployment
+          items:
+            $ref: "#/components/schemas/portainer.TemplateEnv"
+          type: array
+        hostname:
+          description: Container hostname
+          example: mycontainer
+          type: string
+        id:
+          description: |-
+            Mandatory container/stack fields
+            Template Identifier
+          example: 1
+          type: integer
+        image:
+          description: >-
+            Mandatory container fields
+
+            Image associated to a container template. Mandatory for a container template
+          example: nginx:latest
+          type: string
+        interactive:
+          description: |-
+            Whether the container should be started in
+            interactive mode (-i -t equivalent on the CLI)
+          example: true
+          type: boolean
+        labels:
+          description: Container labels
+          items:
+            $ref: "#/components/schemas/portainer.Pair"
+          type: array
+        logo:
+          description: URL of the template's logo
+          example: https://portainer.io/img/logo.svg
+          type: string
+        name:
+          description: |-
+            Optional stack/container fields
+            Default name for the stack/container to be used on deployment
+          example: mystackname
+          type: string
+        network:
+          description: Name of a network that will be used on container deployment if it
+            exists inside the environment(endpoint)
+          example: mynet
+          type: string
+        note:
+          description: A note that will be displayed in the UI. Supports HTML content
+          example: This is my <b>custom</b> template
+          type: string
+        platform:
+          description: >-
+            Platform associated to the template.
+
+            Valid values are: 'linux', 'windows' or leave empty for multi-platform
+          example: linux
+          type: string
+        ports:
+          description: A list of ports exposed by the container
+          example:
+            - 8080:80/tcp
+          items:
+            type: string
+          type: array
+        privileged:
+          description: Whether the container should be started in privileged mode
+          example: true
+          type: boolean
+        registry:
+          description: >-
+            Optional container fields
+
+            The URL of a registry associated to the image for a container template
+          example: quay.io
+          type: string
+        repository:
+          allOf:
+            - $ref: "#/components/schemas/portainer.TemplateRepository"
+          description: Mandatory stack fields
+        restart_policy:
+          description: Container restart policy
+          example: on-failure
+          type: string
+        stackFile:
+          description: |-
+            Mandatory Edge stack fields
+            Stack file used for this template
+          type: string
+        title:
+          description: Title of the template
+          example: Nginx
+          type: string
+        type:
+          allOf:
+            - $ref: "#/components/schemas/portainer.TemplateType"
+          description: "Template type. Valid values are: 1 (container), 2 (Swarm stack), 3
+            (Compose stack), 4 (Compose edge stack)"
+          example: 1
+        volumes:
+          description: A list of volumes used during the container template deployment
+          items:
+            $ref: "#/components/schemas/portainer.TemplateVolume"
+          type: array
+      type: object
+    portainer.TemplateEnv:
+      properties:
+        default:
+          description: Default value that will be set for the variable
+          example: default_value
+          type: string
+        description:
+          description: Content of the tooltip that will be generated in the UI
+          example: MySQL root account password
+          type: string
+        label:
+          description: Text for the label that will be generated in the UI
+          example: Root password
+          type: string
+        name:
+          description: name of the environment(endpoint) variable
+          example: MYSQL_ROOT_PASSWORD
+          type: string
+        preset:
+          description: If set to true, will not generate any input for this variable in
+            the UI
+          example: false
+          type: boolean
+        select:
+          description: A list of name/value that will be used to generate a dropdown in
+            the UI
+          items:
+            $ref: "#/components/schemas/portainer.TemplateEnvSelect"
+          type: array
+      type: object
+    portainer.TemplateEnvSelect:
+      properties:
+        default:
+          description: Will set this choice as the default choice
+          example: false
+          type: boolean
+        text:
+          description: Some text that will displayed as a choice
+          example: text value
+          type: string
+        value:
+          description: A value that will be associated to the choice
+          example: value
+          type: string
+      type: object
+    portainer.TemplateRepository:
+      properties:
+        stackfile:
+          description: Path to the stack file inside the git repository
+          example: ./subfolder/docker-compose.yml
+          type: string
+        url:
+          description: URL of a git repository used to deploy a stack template. Mandatory
+            for a Swarm/Compose stack template
+          example: https://github.com/portainer/portainer-compose
+          type: string
+      type: object
+    portainer.TemplateType:
+      enum:
+        - 0
+        - 1
+        - 2
+        - 3
+      type: integer
+      x-enum-varnames:
+        - _
+        - ContainerTemplate
+        - SwarmStackTemplate
+        - ComposeStackTemplate
+    portainer.TemplateVolume:
+      properties:
+        bind:
+          description: Path on the host
+          example: /tmp
+          type: string
+        container:
+          description: Path inside the container
+          example: /data
+          type: string
+        readonly:
+          description: Whether the volume used should be readonly
+          example: true
+          type: boolean
+      type: object
+    portainer.User:
+      properties:
+        Id:
+          description: User Identifier
+          example: 1
+          type: integer
+        Role:
+          allOf:
+            - $ref: "#/components/schemas/portainer.UserRole"
+          description: User role (1 for administrator account and 2 for regular account)
+          example: 1
+        ThemeSettings:
+          $ref: "#/components/schemas/portainer.UserThemeSettings"
+        TokenIssueAt:
+          example: 1
+          type: integer
+        UseCache:
+          example: true
+          type: boolean
+        Username:
+          example: bob
+          type: string
+      required:
+        - Id
+        - Role
+        - Username
+      type: object
+    portainer.UserAccessPolicies:
+      additionalProperties:
+        $ref: "#/components/schemas/portainer.AccessPolicy"
+      type: object
+    portainer.UserResourceAccess:
+      properties:
+        AccessLevel:
+          $ref: "#/components/schemas/portainer.ResourceAccessLevel"
+        UserId:
+          type: integer
+      type: object
+    portainer.UserRole:
+      enum:
+        - 0
+        - 1
+        - 2
+      type: integer
+      x-enum-varnames:
+        - _
+        - AdministratorRole
+        - StandardUserRole
+    portainer.UserThemeSettings:
+      properties:
+        color:
+          description: Color represents the color theme of the UI
+          enum:
+            - dark
+            - light
+            - highcontrast
+            - auto
+            - ""
+          example: dark
+          type: string
+      type: object
+    portainer.Webhook:
+      properties:
+        EndpointId:
+          type: integer
+        Id:
+          description: Webhook Identifier
+          example: 1
+          type: integer
+        RegistryId:
+          type: integer
+        ResourceId:
+          type: string
+        Token:
+          type: string
+        Type:
+          allOf:
+            - $ref: "#/components/schemas/portainer.WebhookType"
+          description: Type of webhook (1 - service)
+      type: object
+    portainer.WebhookType:
+      enum:
+        - 0
+        - 1
+      type: integer
+      x-enum-varnames:
+        - _
+        - ServiceWebhook
+    registries.registryConfigurePayload:
+      properties:
+        Authentication:
+          description: Is authentication against this registry enabled
+          example: false
+          type: boolean
+        Password:
+          description: Password used to authenticate against this registry. required when
+            Authentication is true
+          example: registry_password
+          type: string
+        Region:
+          description: ECR region
+          type: string
+        TLS:
+          description: Use TLS
+          example: true
+          type: boolean
+        TLSCACertFile:
+          description: The TLS CA certificate file
+          items:
+            format: int32
+            type: integer
+          type: array
+        TLSCertFile:
+          description: The TLS client certificate file
+          items:
+            format: int32
+            type: integer
+          type: array
+        TLSKeyFile:
+          description: The TLS client key file
+          items:
+            format: int32
+            type: integer
+          type: array
+        TLSSkipVerify:
+          description: Skip the verification of the server TLS certificate
+          example: false
+          type: boolean
+        Username:
+          description: Username used to authenticate against this registry. Required when
+            Authentication is true
+          example: registry_user
+          type: string
+      required:
+        - Authentication
+      type: object
+    registries.registryCreatePayload:
+      properties:
+        Authentication:
+          description: Is authentication against this registry enabled
+          example: false
+          type: boolean
+        BaseURL:
+          description: BaseURL required for ProGet registry
+          example: registry.mydomain.tld:2375
+          type: string
+        Ecr:
+          allOf:
+            - $ref: "#/components/schemas/portainer.EcrData"
+          description: ECR specific details, required when type = 7
+        Gitlab:
+          allOf:
+            - $ref: "#/components/schemas/portainer.GitlabRegistryData"
+          description: Gitlab specific details, required when type = 4
+        Name:
+          description: Name that will be used to identify this registry
+          example: my-registry
+          type: string
+        Password:
+          description: Password used to authenticate against this registry. required when
+            Authentication is true
+          example: registry_password
+          type: string
+        Quay:
+          allOf:
+            - $ref: "#/components/schemas/portainer.QuayRegistryData"
+          description: Quay specific details, required when type = 1
+        TLS:
+          description: Use TLS
+          example: true
+          type: boolean
+        Type:
+          allOf:
+            - $ref: "#/components/schemas/portainer.RegistryType"
+          description: |-
+            Registry Type. Valid values are:
+            	1 (Quay.io),
+            	2 (Azure container registry),
+            	3 (custom registry),
+            	4 (Gitlab registry),
+            	5 (ProGet registry),
+            	6 (DockerHub)
+            	7 (ECR)
+          enum:
+            - 1
+            - 2
+            - 3
+            - 4
+            - 5
+            - 6
+            - 7
+          example: 1
+        URL:
+          description: URL or IP address of the Docker registry
+          example: registry.mydomain.tld:2375/feed
+          type: string
+        Username:
+          description: Username used to authenticate against this registry. Required when
+            Authentication is true
+          example: registry_user
+          type: string
+      required:
+        - Authentication
+        - Name
+        - Type
+        - URL
+      type: object
+    registries.registryPingPayload:
+      properties:
+        Password:
+          description: Password used to authenticate against this registry
+          example: registry_password
+          type: string
+        TLS:
+          description: Use TLS
+          example: true
+          type: boolean
+        Type:
+          allOf:
+            - $ref: "#/components/schemas/portainer.RegistryType"
+          description: |-
+            Registry Type. Valid values are:
+            	1 (Quay.io),
+            	2 (Azure container registry),
+            	3 (custom registry),
+            	4 (Gitlab registry),
+            	5 (ProGet registry),
+            	6 (DockerHub)
+            	7 (ECR)
+            	8 (Github registry)
+          enum:
+            - 1
+            - 2
+            - 3
+            - 4
+            - 5
+            - 6
+            - 7
+            - 8
+          example: 6
+        URL:
+          description: URL or IP address of the Docker registry
+          example: registry-1.docker.io
+          type: string
+        Username:
+          description: Username used to authenticate against this registry
+          example: registry_user
+          type: string
+      required:
+        - Type
+        - URL
+      type: object
+    registries.registryPingResponse:
+      properties:
+        message:
+          description: Message provides details about the connection test result
+          example: Registry connection successful
+          type: string
+        success:
+          description: Success indicates if the registry connection was successful
+          example: true
+          type: boolean
+      type: object
+    registries.registryUpdatePayload:
+      properties:
+        Authentication:
+          description: Is authentication against this registry enabled
+          example: false
+          type: boolean
+        BaseURL:
+          description: BaseURL is used for quay registry
+          example: registry.mydomain.tld:2375
+          type: string
+        Ecr:
+          allOf:
+            - $ref: "#/components/schemas/portainer.EcrData"
+          description: ECR data
+        Name:
+          description: Name that will be used to identify this registry
+          example: my-registry
+          type: string
+        Password:
+          description: Password used to authenticate against this registry. required when
+            Authentication is true
+          example: registry_password
+          type: string
+        Quay:
+          allOf:
+            - $ref: "#/components/schemas/portainer.QuayRegistryData"
+          description: Quay data
+        RegistryAccesses:
+          allOf:
+            - $ref: "#/components/schemas/portainer.RegistryAccesses"
+          description: Registry access control
+        URL:
+          description: URL or IP address of the Docker registry
+          example: registry.mydomain.tld:2375
+          type: string
+        Username:
+          description: Username used to authenticate against this registry. Required when
+            Authentication is true
+          example: registry_user
+          type: string
+      required:
+        - Authentication
+        - Name
+        - URL
+      type: object
+    release.Chart:
+      properties:
+        files:
+          description: |-
+            Files are miscellaneous files in a chart archive,
+            e.g. README, LICENSE, etc.
+          items:
+            $ref: "#/components/schemas/release.File"
+          type: array
+        lock:
+          allOf:
+            - $ref: "#/components/schemas/release.Lock"
+          description: Lock is the contents of Chart.lock.
+        metadata:
+          allOf:
+            - $ref: "#/components/schemas/release.Metadata"
+          description: Metadata is the contents of the Chartfile.
+        schema:
+          description: Schema is an optional JSON schema for imposing structure on Values
+          items:
+            type: integer
+          type: array
+        templates:
+          description: Templates for this chart.
+          items:
+            $ref: "#/components/schemas/release.File"
+          type: array
+        values:
+          additionalProperties: {}
+          description: Values are default config for this chart.
+          type: object
+      type: object
+    release.ChartReference:
+      properties:
+        chartPath:
+          type: string
+        registryID:
+          type: integer
+        repoURL:
+          type: string
+      type: object
+    release.Dependency:
+      properties:
+        alias:
+          description: Alias usable alias to be used for the chart
+          type: string
+        condition:
+          description: A yaml path that resolves to a boolean, used for enabling/disabling
+            charts (e.g. subchart1.enabled )
+          type: string
+        enabled:
+          description: Enabled bool determines if chart should be loaded
+          type: boolean
+        import-values:
+          description: >-
+            ImportValues holds the mapping of source values to parent key to be
+            imported. Each item can be a
+
+            string or pair of child/parent sublist items.
+          items: {}
+          type: array
+        name:
+          description: |-
+            Name is the name of the dependency.
+
+            This must mach the name in the dependency's Chart.yaml.
+          type: string
+        repository:
+          description: >-
+            The URL to the repository.
+
+
+            Appending `index.yaml` to this string should result in a URL that can be
+
+            used to fetch the repository index.
+          type: string
+        tags:
+          description: Tags can be used to group charts for enabling/disabling together
+          items:
+            type: string
+          type: array
+        version:
+          description: |-
+            Version is the version (range) of this chart.
+
+            A lock file will always produce a single version, while a dependency
+            may contain a semantic version range.
+          type: string
+      type: object
+    release.File:
+      properties:
+        data:
+          description: Data is the template as byte data.
+          items:
+            type: integer
+          type: array
+        name:
+          description: Name is the path-like name of the template.
+          type: string
+      type: object
+    release.HookExecution:
+      properties:
+        completed_at:
+          description: CompletedAt indicates the date/time this hook was completed.
+          type: string
+        phase:
+          description: Phase indicates whether the hook completed successfully
+          type: string
+        started_at:
+          description: StartedAt indicates the date/time this hook was started
+          type: string
+      type: object
+    release.Info:
+      properties:
+        deleted:
+          description: Deleted tracks when this object was deleted.
+          type: string
+        description:
+          description: Description is human-friendly "log entry" about this release.
+          type: string
+        first_deployed:
+          description: FirstDeployed is when the release was first deployed.
+          type: string
+        last_deployed:
+          description: LastDeployed is when the release was last deployed.
+          type: string
+        notes:
+          description: Contains the rendered templates/NOTES.txt if available
+          type: string
+        resources:
+          description: Resources is the list of resources that are part of the release
+          items:
+            $ref: "#/components/schemas/unstructured.Unstructured"
+          type: array
+        status:
+          description: Status is the current state of the release
+          type: string
+      type: object
+    release.Lock:
+      properties:
+        dependencies:
+          description: Dependencies is the list of dependencies that this lock file has
+            locked.
+          items:
+            $ref: "#/components/schemas/release.Dependency"
+          type: array
+        digest:
+          description: Digest is a hash of the dependencies in Chart.yaml.
+          type: string
+        generated:
+          description: Generated is the date the lock file was last generated.
+          type: string
+      type: object
+    release.Maintainer:
+      properties:
+        email:
+          description: Email is an optional email address to contact the named maintainer
+          type: string
+        name:
+          description: Name is a user name or organization name
+          type: string
+        url:
+          description: URL is an optional URL to an address for the named maintainer
+          type: string
+      type: object
+    release.Metadata:
+      properties:
+        annotations:
+          additionalProperties:
+            type: string
+          description: |-
+            Annotations are additional mappings uninterpreted by Helm,
+            made available for inspection by other applications.
+          type: object
+        apiVersion:
+          description: The API Version of this chart. Required.
+          type: string
+        appVersion:
+          description: The version of the application enclosed inside of this chart.
+          type: string
+        condition:
+          description: The condition to check to enable chart
+          type: string
+        dependencies:
+          description: Dependencies are a list of dependencies for a chart.
+          items:
+            $ref: "#/components/schemas/release.Dependency"
+          type: array
+        deprecated:
+          description: Whether or not this chart is deprecated
+          type: boolean
+        description:
+          description: A one-sentence description of the chart
+          type: string
+        home:
+          description: The URL to a relevant project page, git repo, or contact person
+          type: string
+        icon:
+          description: The URL to an icon file.
+          type: string
+        keywords:
+          description: A list of string keywords
+          items:
+            type: string
+          type: array
+        kubeVersion:
+          description: KubeVersion is a SemVer constraint specifying the version of
+            Kubernetes required.
+          type: string
+        maintainers:
+          description: A list of name and URL/email address combinations for the
+            maintainer(s)
+          items:
+            $ref: "#/components/schemas/release.Maintainer"
+          type: array
+        name:
+          description: The name of the chart. Required.
+          type: string
+        sources:
+          description: Source is the URL to the source code of this chart
+          items:
+            type: string
+          type: array
+        tags:
+          description: The tags to check to enable chart
+          type: string
+        type:
+          description: "Specifies the chart type: application or library"
+          type: string
+        version:
+          description: A SemVer 2 conformant version string of the chart. Required.
+          type: string
+      type: object
+    release.Release:
+      properties:
+        appVersion:
+          description: AppVersion is the app version of the release.
+          type: string
+        chart:
+          allOf:
+            - $ref: "#/components/schemas/release.Chart"
+          description: Chart is the chart that was released.
+        chartReference:
+          allOf:
+            - $ref: "#/components/schemas/release.ChartReference"
+          description: ChartReference are the labels that are used to identify the chart
+            source.
+        config:
+          additionalProperties: {}
+          description: |-
+            Config is the set of extra Values added to the chart.
+            These values override the default values inside of the chart.
+          type: object
+        hooks:
+          description: Hooks are all of the hooks declared for this release.
+          items:
+            $ref: "#/components/schemas/github_com_portainer_portainer_pkg_libhelm_release.\
+              Hook"
+          type: array
+        info:
+          allOf:
+            - $ref: "#/components/schemas/release.Info"
+          description: Info provides information about a release
+        manifest:
+          description: Manifest is the string representation of the rendered template.
+          type: string
+        name:
+          description: Name is the name of the release
+          type: string
+        namespace:
+          description: Namespace is the kubernetes namespace of the release.
+          type: string
+        stackID:
+          description: StackID is the ID of the Portainer stack associated with this
+            release (if using GitOps)
+          type: integer
+        values:
+          allOf:
+            - $ref: "#/components/schemas/release.Values"
+          description: Values are the values used to deploy the chart.
+        version:
+          description: Version is an int which represents the revision of the release.
+          type: integer
+      type: object
+    release.ReleaseElement:
+      properties:
+        appVersion:
+          type: string
+        chart:
+          type: string
+        name:
+          type: string
+        namespace:
+          type: string
+        revision:
+          type: string
+        status:
+          type: string
+        updated:
+          type: string
+      type: object
+    release.Values:
+      properties:
+        computedValues:
+          type: string
+        userSuppliedValues:
+          type: string
+      type: object
+    resource.Quantity:
+      properties:
+        Format:
+          enum:
+            - DecimalExponent
+            - BinarySI
+            - DecimalSI
+          type: string
+          x-enum-comments:
+            BinarySI: e.g., 12Mi (12 * 2^20)
+            DecimalExponent: e.g., 12e6
+            DecimalSI: e.g., 12M  (12 * 10^6)
+          x-enum-descriptions:
+            - e.g., 12e6
+            - e.g., 12Mi (12 * 2^20)
+            - e.g., 12M  (12 * 10^6)
+          x-enum-varnames:
+            - DecimalExponent
+            - BinarySI
+            - DecimalSI
+      type: object
+    resourcecontrols.resourceControlCreatePayload:
+      properties:
+        AdministratorsOnly:
+          description: Permit access to resource only to admins
+          example: true
+          type: boolean
+        Public:
+          description: Permit access to the associated resource to any user
+          example: true
+          type: boolean
+        ResourceID:
+          example: 617c5f22bb9b023d6daab7cba43a57576f83492867bc767d1c59416b065e5f08
+          type: string
+        SubResourceIDs:
+          description: List of Docker resources that will inherit this access control
+          example:
+            - 617c5f22bb9b023d6daab7cba43a57576f83492867bc767d1c59416b065e5f08
+          items:
+            type: string
+          type: array
+        Teams:
+          description: List of team identifiers with access to the associated resource
+          example:
+            - 56
+            - 7
+          items:
+            type: integer
+          type: array
+        Type:
+          allOf:
+            - $ref: "#/components/schemas/portainer.ResourceControlType"
+          description: >-
+            Type of Resource. Valid values are: 1 - container, 2 - service
+
+            3 - volume, 4 - network, 5 - secret, 6 - stack, 7 - config, 8 - custom template, 9 - azure-container-group
+          enum:
+            - 1
+            - 2
+            - 3
+            - 4
+            - 5
+            - 6
+            - 7
+            - 8
+            - 9
+          example: 1
+        Users:
+          description: List of user identifiers with access to the associated resource
+          example:
+            - 1
+            - 4
+          items:
+            type: integer
+          type: array
+      required:
+        - ResourceID
+        - Type
+      type: object
+    resourcecontrols.resourceControlUpdatePayload:
+      properties:
+        AdministratorsOnly:
+          description: Permit access to resource only to admins
+          example: true
+          type: boolean
+        Public:
+          description: Permit access to the associated resource to any user
+          example: true
+          type: boolean
+        Teams:
+          description: List of team identifiers with access to the associated resource
+          example:
+            - 7
+          items:
+            type: integer
+          type: array
+        Users:
+          description: List of user identifiers with access to the associated resource
+          example:
+            - 4
+          items:
+            type: integer
+          type: array
+      type: object
+    roar.Roar-portainer_EndpointID:
+      type: object
+    settings.publicSettingsResponse:
+      properties:
+        AuthenticationMethod:
+          allOf:
+            - $ref: "#/components/schemas/portainer.AuthenticationMethod"
+          description: "Active authentication method for the Portainer instance. Valid
+            values are: 1 for internal, 2 for LDAP, or 3 for oauth"
+          example: 1
+        Edge:
+          properties:
+            CheckinInterval:
+              description: The check in interval for edge agent (in seconds) - used in non
+                async mode [seconds]
+              example: 60
+              type: integer
+            CommandInterval:
+              description: The command list interval for edge agent - used in edge async mode
+                [seconds]
+              example: 60
+              type: integer
+            PingInterval:
+              description: The ping interval for edge agent - used in edge async mode
+                [seconds]
+              example: 60
+              type: integer
+            SnapshotInterval:
+              description: The snapshot interval for edge agent - used in edge async mode
+                [seconds]
+              example: 60
+              type: integer
+          type: object
+        EnableEdgeComputeFeatures:
+          description: Whether edge compute features are enabled
+          example: true
+          type: boolean
+        Features:
+          additionalProperties:
+            type: boolean
+          description: Supported feature flags
+          type: object
+        GlobalDeploymentOptions:
+          allOf:
+            - $ref: "#/components/schemas/portainer.GlobalDeploymentOptions"
+          description: Deployment options for encouraging deployment as code
+        IsDockerDesktopExtension:
+          example: false
+          type: boolean
+        KubeconfigExpiry:
+          default: "0"
+          description: The expiry of a Kubeconfig
+          example: 24h
+          type: string
+        LogoURL:
+          description: URL to a logo that will be displayed on the login page as well as
+            on top of the sidebar. Will use default Portainer logo when value is
+            empty string
+          example: https://mycompany.mydomain.tld/logo.png
+          type: string
+        OAuthLoginURI:
+          description: The URL used for oauth login
+          example: https://gitlab.com/oauth
+          type: string
+        OAuthLogoutURI:
+          description: The URL used for oauth logout
+          example: https://gitlab.com/oauth/logout
+          type: string
+        RequiredPasswordLength:
+          description: The minimum required length for a password of any user when using
+            internal auth mode
+          example: 1
+          type: integer
+        RequiresSetupToken:
+          description: Whether the setup wizard must send the X-Setup-Token header for
+            admin init / restore
+          example: false
+          type: boolean
+        TeamSync:
+          description: Whether team sync is enabled
+          example: true
+          type: boolean
+      type: object
+    settings.settingsUpdatePayload:
+      properties:
+        AuthenticationMethod:
+          description: "Active authentication method for the Portainer instance. Valid
+            values are: 1 for internal, 2 for LDAP, or 3 for oauth"
+          example: 1
+          type: integer
+        BlackListedLabels:
+          description: A list of label name & value that will be used to hide containers
+            when querying containers
+          items:
+            $ref: "#/components/schemas/portainer.Pair"
+          type: array
+        EdgeAgentCheckinInterval:
+          example: 5
+          type: integer
+        EdgePortainerURL:
+          description: EdgePortainerURL is the URL that is exposed to edge agents
+          type: string
+        EnableEdgeComputeFeatures:
+          description: Whether edge compute features are enabled
+          example: true
+          type: boolean
+        EnforceEdgeID:
+          description: EnforceEdgeID makes Portainer store the Edge ID instead of
+            accepting anyone
+          example: false
+          type: boolean
+        ForceSecureCookies:
+          description: ForceSecureCookies forces the Secure attribute on auth cookies
+            regardless of the detected scheme
+          example: false
+          type: boolean
+        GlobalDeploymentOptions:
+          allOf:
+            - $ref: "#/components/schemas/portainer.GlobalDeploymentOptions"
+          description: Deployment options for encouraging deployment as code
+        HelmRepositoryURL:
+          description: Helm repository URL
+          example: https://charts.bitnami.com/bitnami
+          type: string
+        InternalAuthSettings:
+          $ref: "#/components/schemas/portainer.InternalAuthSettings"
+        KubeconfigExpiry:
+          default: "0"
+          description: The expiry of a Kubeconfig
+          example: 24h
+          type: string
+        KubectlShellImage:
+          description: Kubectl Shell Image
+          example: portainer/kubectl-shell:latest
+          type: string
+        LDAPSettings:
+          $ref: "#/components/schemas/portainer.LDAPSettings"
+        LogoURL:
+          description: URL to a logo that will be displayed on the login page as well as
+            on top of the sidebar. Will use default Portainer logo when value is
+            empty string
+          example: https://mycompany.mydomain.tld/logo.png
+          type: string
+        OAuthSettings:
+          $ref: "#/components/schemas/portainer.OAuthSettings"
+        SnapshotInterval:
+          description: The interval in which environment(endpoint) snapshots are created
+          example: 5m
+          type: string
+        TemplatesURL:
+          description: URL to the templates that will be displayed in the UI when
+            navigating to App Templates
+          example: https://raw.githubusercontent.com/portainer/templates/master/templates.json
+          type: string
+        TrustOnFirstConnect:
+          description: TrustOnFirstConnect makes Portainer accepting edge agent connection
+            by default
+          example: false
+          type: boolean
+        UserSessionTimeout:
+          description: The duration of a user session
+          example: 5m
+          type: string
+      type: object
+    sources.AutoUpdateInfo:
+      properties:
+        fetchInterval:
+          type: string
+        mechanism:
+          type: string
+      type: object
+    sources.ConnectionTestResult:
+      properties:
+        error:
+          type: string
+        success:
+          type: boolean
+      type: object
+    sources.GitAuthenticationPayload:
+      properties:
+        password:
+          type: string
+        username:
+          type: string
+      type: object
+    sources.GitAuthenticationUpdatePayload:
+      properties:
+        password:
+          type: string
+        username:
+          type: string
+      type: object
+    sources.GitSourceCreatePayload:
+      properties:
+        administratorsOnly:
+          example: true
+          type: boolean
+        authentication:
+          $ref: "#/components/schemas/sources.GitAuthenticationPayload"
+        name:
+          type: string
+        public:
+          example: true
+          type: boolean
+        teamAccesses:
+          items:
+            type: integer
+          type: array
+        tlsSkipVerify:
+          type: boolean
+        url:
+          type: string
+        userAccesses:
+          items:
+            type: integer
+          type: array
+      required:
+        - url
+      type: object
+    sources.GitSourceUpdatePayload:
+      properties:
+        authentication:
+          $ref: "#/components/schemas/sources.GitAuthenticationUpdatePayload"
+        name:
+          type: string
+        tlsSkipVerify:
+          type: boolean
+        url:
+          type: string
+      type: object
+    sources.Source:
+      properties:
+        environments:
+          type: integer
+        error:
+          type: string
+        id:
+          type: integer
+        lastSync:
+          type: integer
+        name:
+          type: string
+        status:
+          $ref: "#/components/schemas/workflows.Status"
+        type:
+          $ref: "#/components/schemas/sources.SourceType"
+        url:
+          type: string
+        usedBy:
+          type: integer
+      required:
+        - id
+        - name
+        - status
+        - type
+        - url
+      type: object
+    sources.SourceAccess:
+      properties:
+        public:
+          type: boolean
+        teams:
+          items:
+            type: integer
+          type: array
+        users:
+          items:
+            type: integer
+          type: array
+      type: object
+    sources.SourceAccessUpdatePayload:
+      properties:
+        public:
+          type: boolean
+        teams:
+          items:
+            type: integer
+          type: array
+        users:
+          items:
+            type: integer
+          type: array
+      type: object
+    sources.SourceDetail:
+      properties:
+        access:
+          $ref: "#/components/schemas/sources.SourceAccess"
+        autoUpdate:
+          $ref: "#/components/schemas/sources.AutoUpdateInfo"
+        connection:
+          $ref: "#/components/schemas/sources.connectionInfo"
+        environments:
+          type: integer
+        error:
+          type: string
+        id:
+          type: integer
+        lastSync:
+          type: integer
+        name:
+          type: string
+        status:
+          $ref: "#/components/schemas/workflows.Status"
+        type:
+          $ref: "#/components/schemas/sources.SourceType"
+        url:
+          type: string
+        usedBy:
+          type: integer
+        workflows:
+          items:
+            $ref: "#/components/schemas/workflows.Workflow"
+          type: array
+      required:
+        - connection
+        - id
+        - name
+        - status
+        - type
+        - url
+      type: object
+    sources.SourceType:
+      enum:
+        - git
+        - helm
+        - oci
+      type: string
+      x-enum-varnames:
+        - SourceTypeGit
+        - SourceTypeHelm
+        - SourceTypeOCI
+    sources.Status:
+      enum:
+        - unknown
+        - healthy
+        - error
+      type: string
+      x-enum-varnames:
+        - SourceStatusUnknown
+        - SourceStatusHealthy
+        - SourceStatusError
+    sources.connectionInfo:
+      properties:
+        authentication:
+          $ref: "#/components/schemas/sources.gitAuthInfo"
+        tlsSkipVerify:
+          type: boolean
+      type: object
+    sources.gitAuthInfo:
+      properties:
+        username:
+          type: string
+      type: object
+    ssl.sslUpdatePayload:
+      properties:
+        Cert:
+          description: SSL Certificates
+          type: string
+        HTTPEnabled:
+          type: boolean
+        Key:
+          type: string
+      type: object
+    stacks.composeStackFromFileContentPayload:
+      properties:
+        Env:
+          description: A list of environment variables used during stack deployment
+          items:
+            $ref: "#/components/schemas/portainer.Pair"
+          type: array
+        FromAppTemplate:
+          description: Whether the stack is from a app template
+          example: false
+          type: boolean
+        Name:
+          description: Name of the stack
+          example: myStack
+          type: string
+        StackFileContent:
+          description: Content of the Stack file
+          example: |-
+            version: 3
+             services:
+             web:
+             image:nginx
+          type: string
+      required:
+        - Name
+        - StackFileContent
+      type: object
+    stacks.composeStackFromGitRepositoryPayload:
+      properties:
+        AdditionalFiles:
+          description: Applicable when deploying with multiple stack files
+          example:
+            - "[nz.compose.yml"
+            - " uat.compose.yml]"
+          items:
+            type: string
+          type: array
+        AutoUpdate:
+          allOf:
+            - $ref: "#/components/schemas/portainer.AutoUpdateSettings"
+          description: Optional GitOps update configuration
+        ComposeFile:
+          default: docker-compose.yml
+          description: Path to the Stack file inside the Git repository
+          example: docker-compose.yml
+          type: string
+        Env:
+          description: A list of environment variables used during stack deployment
+          items:
+            $ref: "#/components/schemas/portainer.Pair"
+          type: array
+        FromAppTemplate:
+          description: Whether the stack is from a app template
+          example: false
+          type: boolean
+        Name:
+          description: Name of the stack
+          example: myStack
+          type: string
+        RepositoryAuthentication:
+          description: "Deprecated: use SourceID instead. Use basic authentication to
+            clone the Git repository."
+          example: true
+          type: boolean
+        RepositoryPassword:
+          description: "Deprecated: use SourceID instead. Password used in basic
+            authentication."
+          example: myGitPassword
+          type: string
+        RepositoryReferenceName:
+          description: Reference name of a Git repository hosting the Stack file
+          example: refs/heads/master
+          type: string
+        RepositoryURL:
+          description: "Deprecated: use SourceID instead. URL of a Git repository hosting
+            the Stack file."
+          example: https://github.com/openfaas/faas
+          type: string
+        RepositoryUsername:
+          description: "Deprecated: use SourceID instead. Username used in basic
+            authentication."
+          example: myGitUsername
+          type: string
+        SourceID:
+          description: |-
+            SourceID references an existing Source for git credentials/URL.
+            When set, the inline URL and authentication fields are ignored.
+          example: 1
+          type: integer
+        TLSSkipVerify:
+          description: "Deprecated: use SourceID instead. TLSSkipVerify skips SSL
+            verification when cloning the Git repository."
+          example: false
+          type: boolean
+      required:
+        - Name
+      type: object
+    stacks.kubernetesGitDeploymentPayload:
+      properties:
+        AdditionalFiles:
+          items:
+            type: string
+          type: array
+        AutoUpdate:
+          $ref: "#/components/schemas/portainer.AutoUpdateSettings"
+        ComposeFormat:
+          type: boolean
+        ManifestFile:
+          type: string
+        Namespace:
+          type: string
+        RepositoryAuthentication:
+          description: "Deprecated: use SourceID instead. Use basic authentication to
+            clone the Git repository."
+          type: boolean
+        RepositoryPassword:
+          description: "Deprecated: use SourceID instead. Password used in basic
+            authentication."
+          type: string
+        RepositoryReferenceName:
+          description: "Deprecated: use SourceID instead. Reference name of a Git
+            repository hosting the Stack file."
+          type: string
+        RepositoryURL:
+          description: "Deprecated: use SourceID instead. URL of a Git repository hosting
+            the Stack file."
+          type: string
+        RepositoryUsername:
+          description: "Deprecated: use SourceID instead. Username used in basic
+            authentication."
+          type: string
+        SourceID:
+          description: |-
+            SourceID references an existing Source for git credentials/URL.
+            When set, the inline URL and authentication fields are ignored.
+          example: 1
+          type: integer
+        StackName:
+          type: string
+        TLSSkipVerify:
+          description: "Deprecated: use SourceID instead. TLSSkipVerify skips SSL
+            verification when cloning the Git repository."
+          example: false
+          type: boolean
+      type: object
+    stacks.kubernetesManifestURLDeploymentPayload:
+      properties:
+        ComposeFormat:
+          type: boolean
+        ManifestURL:
+          type: string
+        Namespace:
+          type: string
+        StackName:
+          type: string
+      type: object
+    stacks.kubernetesStringDeploymentPayload:
+      properties:
+        ComposeFormat:
+          type: boolean
+        FromAppTemplate:
+          description: Whether the stack is from a app template
+          example: false
+          type: boolean
+        Namespace:
+          type: string
+        StackFileContent:
+          type: string
+        StackName:
+          type: string
+      type: object
+    stacks.stackFileResponse:
+      properties:
+        StackFileContent:
+          description: Content of the Stack file
+          example: |-
+            version: 3
+             services:
+             web:
+             image:nginx
+          type: string
+      type: object
+    stacks.stackGitRedeployPayload:
+      properties:
+        Env:
+          items:
+            $ref: "#/components/schemas/portainer.Pair"
+          type: array
+        Prune:
+          type: boolean
+        PullImage:
+          description: >-
+            Deprecated(2.36): use RepullImageAndRedeploy instead for cleaner
+            responsibility
+
+            Force a pulling to current image with the original tag though the image is already the latest
+          example: false
+          type: boolean
+        RepositoryAuthentication:
+          description: When true and RepositoryPassword is non-empty, stored credentials
+            are replaced.
+          type: boolean
+        RepositoryPassword:
+          description: Non-empty value (with RepositoryAuthentication=true) replaces
+            stored credentials; leave blank to keep them.
+          type: string
+        RepositoryReferenceName:
+          type: string
+        RepositoryUsername:
+          type: string
+        RepullImageAndRedeploy:
+          description: RepullImageAndRedeploy indicates whether to force repulling images
+            and redeploying the stack
+          type: boolean
+        StackName:
+          type: string
+      type: object
+    stacks.stackGitUpdatePayload:
+      properties:
+        AdditionalFiles:
+          items:
+            type: string
+          type: array
+        AutoUpdate:
+          $ref: "#/components/schemas/portainer.AutoUpdateSettings"
+        ConfigFilePath:
+          type: string
+        Env:
+          items:
+            $ref: "#/components/schemas/portainer.Pair"
+          type: array
+        Prune:
+          type: boolean
+        RepositoryAuthentication:
+          description: "Deprecated: use SourceID instead. Use basic authentication to
+            clone the Git repository."
+          type: boolean
+        RepositoryPassword:
+          description: "Deprecated: use SourceID instead. Password used in basic
+            authentication."
+          type: string
+        RepositoryReferenceName:
+          type: string
+        RepositoryURL:
+          description: "Deprecated: use SourceID instead. URL of a Git repository hosting
+            the Stack file."
+          type: string
+        RepositoryUsername:
+          description: "Deprecated: use SourceID instead. Username used in basic
+            authentication."
+          type: string
+        SourceID:
+          description: |-
+            SourceID references an existing Source for git credentials/URL.
+            When set, the inline URL and authentication fields are ignored.
+          type: integer
+        TLSSkipVerify:
+          description: "Deprecated: use SourceID instead. Skip TLS verification when
+            cloning the Git repository."
+          type: boolean
+      type: object
+    stacks.stackMigratePayload:
+      properties:
+        EndpointID:
+          description: Environment(Endpoint) identifier of the target
+            environment(endpoint) where the stack will be relocated
+          example: 2
+          type: integer
+        Name:
+          description: If provided will rename the migrated stack
+          example: new-stack
+          type: string
+        SwarmID:
+          description: Swarm cluster identifier, must match the identifier of the cluster
+            where the stack will be relocated
+          example: jpofkc0i9uo9wtx1zesuk649w
+          type: string
+      required:
+        - EndpointID
+      type: object
+    stacks.stackResponse:
+      properties:
+        AdditionalFiles:
+          description: Only applies when deploying stack with multiple files
+          items:
+            type: string
+          type: array
+        AutoUpdate:
+          allOf:
+            - $ref: "#/components/schemas/portainer.AutoUpdateSettings"
+          description: The GitOps update settings of a git stack
+        CreatedBy:
+          description: The username which created this stack
+          example: admin
+          type: string
+        CreationDate:
+          description: The date in unix time when stack was created
+          example: 1587399600
+          type: integer
+        CurrentDeploymentInfo:
+          allOf:
+            - $ref: "#/components/schemas/portainer.StackDeploymentInfo"
+          description: CurrentDeploymentInfo records the git repository state at the time
+            of the last actual deployment.
+        DeploymentStartStatus:
+          allOf:
+            - $ref: "#/components/schemas/portainer.StackStatus"
+          description: >-
+            DeploymentStartStatus is the stack status captured when the current
+
+            deployment starts. It is used by deployment logic during the current
+
+            deployment attempt and is cleared/replaced when a new deployment begins.
+          example: 1
+        DeploymentStatus:
+          description: >-
+            DeploymentStatus records the status progression of the current
+            deployment.
+
+            Cleared when a new deployment starts.
+          items:
+            $ref: "#/components/schemas/portainer.StackDeploymentStatus"
+          type: array
+        EndpointId:
+          description: Environment(Endpoint) identifier. Reference the
+            environment(endpoint) that will be used for deployment
+          example: 1
+          type: integer
+        EntryPoint:
+          description: >-
+            EntryPoint is the path to the config file relative to the project
+            root.
+
+            NOTE: For git stacks this mirrors GitConfig.ConfigFilePath and the two are kept in sync
+
+            by stackUpdateGit. The deploy command builder (compose_unpacker_cmd_builder) uses this
+
+            field directly; Kubernetes deploy and git clone operations use GitConfig.ConfigFilePath.
+          example: docker-compose.yml
+          type: string
+        Env:
+          description: A list of environment(endpoint) variables used during stack
+            deployment
+          items:
+            $ref: "#/components/schemas/portainer.Pair"
+          type: array
+        FromAppTemplate:
+          description: Whether the stack is from a app template
+          example: false
+          type: boolean
+        GitConfig:
+          allOf:
+            - $ref: "#/components/schemas/gittypes.RepoConfig"
+          description: >-
+            GitConfig is the git repository configuration for git-backed stacks.
+
+            Deprecated: loaded from Source via WorkflowID; kept for DB backwards-compatibility only.
+
+            Non-migration code must not read or write this field; use Source records instead.
+        GitSourceId:
+          type: integer
+        Id:
+          description: Stack Identifier
+          example: 1
+          type: integer
+        Name:
+          description: Stack name
+          example: myStack
+          type: string
+        Namespace:
+          description: Kubernetes namespace if stack is a kube application
+          example: default
+          type: string
+        Option:
+          allOf:
+            - $ref: "#/components/schemas/portainer.StackOption"
+          description: The stack deployment option
+        ProjectPath:
+          description: Path on disk to the repository hosting the Stack file
+          example: /data/compose/myStack_jpofkc0i9uo9wtx1zesuk649w
+          type: string
+        ResourceControl:
+          $ref: "#/components/schemas/portainer.ResourceControl"
+        Status:
+          allOf:
+            - $ref: "#/components/schemas/portainer.StackStatus"
+          description: Stack status (1 - active, 2 - inactive, 3 - deploying, 4 - error)
+          example: 1
+        SwarmId:
+          description: Cluster identifier of the Swarm cluster where the stack is deployed
+          example: jpofkc0i9uo9wtx1zesuk649w
+          type: string
+        Type:
+          allOf:
+            - $ref: "#/components/schemas/portainer.StackType"
+          description: Stack type. 1 for a Swarm stack, 2 for a Compose stack
+          example: 2
+        UpdateDate:
+          description: The date in unix time when stack was last updated
+          example: 1587399600
+          type: integer
+        UpdatedBy:
+          description: The username which last updated this stack
+          example: bob
+          type: string
+        WorkflowID:
+          description: WorkflowID is the ID of the Workflow that owns the Source for this
+            stack.
+          type: integer
+      type: object
+    stacks.swarmStackFromFileContentPayload:
+      properties:
+        Env:
+          description: A list of environment variables used during stack deployment
+          items:
+            $ref: "#/components/schemas/portainer.Pair"
+          type: array
+        FromAppTemplate:
+          description: Whether the stack is from a app template
+          example: false
+          type: boolean
+        Name:
+          description: Name of the stack
+          example: myStack
+          type: string
+        StackFileContent:
+          description: Content of the Stack file
+          example: |-
+            version: 3
+             services:
+             web:
+             image:nginx
+          type: string
+        SwarmID:
+          description: Swarm cluster identifier
+          example: jpofkc0i9uo9wtx1zesuk649w
+          type: string
+      required:
+        - Name
+        - StackFileContent
+        - SwarmID
+      type: object
+    stacks.swarmStackFromGitRepositoryPayload:
+      properties:
+        AdditionalFiles:
+          description: Applicable when deploying with multiple stack files
+          example:
+            - "[nz.compose.yml"
+            - " uat.compose.yml]"
+          items:
+            type: string
+          type: array
+        AutoUpdate:
+          allOf:
+            - $ref: "#/components/schemas/portainer.AutoUpdateSettings"
+          description: Optional GitOps update configuration
+        ComposeFile:
+          default: docker-compose.yml
+          description: Path to the Stack file inside the Git repository
+          example: docker-compose.yml
+          type: string
+        Env:
+          description: A list of environment variables used during stack deployment
+          items:
+            $ref: "#/components/schemas/portainer.Pair"
+          type: array
+        FromAppTemplate:
+          description: Whether the stack is from a app template
+          example: false
+          type: boolean
+        Name:
+          description: Name of the stack
+          example: myStack
+          type: string
+        RepositoryAuthentication:
+          description: "Deprecated: use SourceID instead. Use basic authentication to
+            clone the Git repository."
+          example: true
+          type: boolean
+        RepositoryPassword:
+          description: "Deprecated: use SourceID instead. Password used in basic
+            authentication."
+          example: myGitPassword
+          type: string
+        RepositoryReferenceName:
+          description: Reference name of a Git repository hosting the Stack file
+          example: refs/heads/master
+          type: string
+        RepositoryURL:
+          description: "Deprecated: use SourceID instead. URL of a Git repository hosting
+            the Stack file."
+          example: https://github.com/openfaas/faas
+          type: string
+        RepositoryUsername:
+          description: "Deprecated: use SourceID instead. Username used in basic
+            authentication."
+          example: myGitUsername
+          type: string
+        SourceID:
+          description: |-
+            SourceID references an existing Source for git credentials/URL.
+            When set, the inline URL and authentication fields are ignored.
+          example: 1
+          type: integer
+        SwarmID:
+          description: Swarm cluster identifier
+          example: jpofkc0i9uo9wtx1zesuk649w
+          type: string
+        TLSSkipVerify:
+          description: "Deprecated: use SourceID instead. TLSSkipVerify skips SSL
+            verification when cloning the Git repository."
+          example: false
+          type: boolean
+      required:
+        - Name
+        - SwarmID
+      type: object
+    stacks.updateSwarmStackPayload:
+      properties:
+        Env:
+          description: A list of environment(endpoint) variables used during stack
+            deployment
+          items:
+            $ref: "#/components/schemas/portainer.Pair"
+          type: array
+        Prune:
+          description: Prune services that are no longer referenced
+          example: true
+          type: boolean
+        PullImage:
+          description: >-
+            Deprecated(2.36): use RepullImageAndRedeploy instead for cleaner
+            responsibility
+
+            Force a pulling to current image with the original tag though the image is already the latest
+          example: false
+          type: boolean
+        RepullImageAndRedeploy:
+          description: RepullImageAndRedeploy indicates whether to force repulling images
+            and redeploying the stack
+          type: boolean
+        StackFileContent:
+          description: New content of the Stack file
+          example: |-
+            version: 3
+             services:
+             web:
+             image:nginx
+          type: string
+      type: object
+    stats.ContainerStats:
+      properties:
+        healthy:
+          type: integer
+        running:
+          type: integer
+        stopped:
+          type: integer
+        total:
+          type: integer
+        unhealthy:
+          type: integer
+      type: object
+    swarm.ServiceUpdateResponse:
+      properties:
+        Warnings:
+          description: Optional warning messages
+          items:
+            type: string
+          type: array
+      type: object
+    system.nodesCountResponse:
+      properties:
+        nodes:
+          type: integer
+      type: object
+    system.status:
+      properties:
+        InstanceID:
+          description: Server Instance ID
+          example: 299ab403-70a8-4c05-92f7-bf7a994d50df
+          type: string
+        Version:
+          description: Portainer API version
+          example: 2.0.0
+          type: string
+      type: object
+    system.systemInfoResponse:
+      properties:
+        agents:
+          type: integer
+        edgeAgents:
+          type: integer
+        platform:
+          $ref: "#/components/schemas/platform.ContainerPlatform"
+      type: object
+    system.versionResponse:
+      properties:
+        Build:
+          $ref: "#/components/schemas/build.BuildInfo"
+        DatabaseVersion:
+          type: string
+        Dependencies:
+          $ref: "#/components/schemas/build.DependenciesInfo"
+        LatestVersion:
+          description: The latest version available
+          example: 2.0.0
+          type: string
+        Runtime:
+          $ref: "#/components/schemas/build.RuntimeInfo"
+        ServerEdition:
+          example: CE/EE
+          type: string
+        ServerVersion:
+          type: string
+        UpdateAvailable:
+          description: Whether portainer has an update available
+          example: false
+          type: boolean
+        VersionSupport:
+          example: STS/LTS
+          type: string
+      type: object
+    tags.tagCreatePayload:
+      properties:
+        Name:
+          example: org/acme
+          type: string
+      required:
+        - Name
+      type: object
+    teammemberships.teamMembershipCreatePayload:
+      properties:
+        Role:
+          description: Role for the user inside the team (1 for leader and 2 for regular
+            member)
+          enum:
+            - 1
+            - 2
+          example: 1
+          type: integer
+        TeamID:
+          description: Team identifier
+          example: 1
+          type: integer
+        UserID:
+          description: User identifier
+          example: 1
+          type: integer
+      required:
+        - Role
+        - TeamID
+        - UserID
+      type: object
+    teammemberships.teamMembershipUpdatePayload:
+      properties:
+        Role:
+          description: Role for the user inside the team (1 for leader and 2 for regular
+            member)
+          enum:
+            - 1
+            - 2
+          example: 1
+          type: integer
+        TeamID:
+          description: Team identifier
+          example: 1
+          type: integer
+        UserID:
+          description: User identifier
+          example: 1
+          type: integer
+      required:
+        - Role
+        - TeamID
+        - UserID
+      type: object
+    teams.teamCreatePayload:
+      properties:
+        Name:
+          description: Name
+          example: developers
+          type: string
+        TeamLeaders:
+          description: TeamLeaders
+          example:
+            - 3
+            - 5
+          items:
+            type: integer
+          type: array
+      required:
+        - Name
+      type: object
+    teams.teamUpdatePayload:
+      properties:
+        Name:
+          description: Name
+          example: developers
+          type: string
+      type: object
+    templates.fileResponse:
+      properties:
+        FileContent:
+          description: The requested file content
+          example: version:2
+          type: string
+      type: object
+    templates.listResponse:
+      properties:
+        templates:
+          items:
+            $ref: "#/components/schemas/portainer.Template"
+          type: array
+        version:
+          type: string
+      type: object
+    unstructured.Unstructured:
+      properties:
+        Object:
+          additionalProperties: true
+          description: >-
+            Object is a JSON compatible map with string, float, int, bool,
+            []interface{}, or
+
+            map[string]interface{}
+
+            children.
+          type: object
+      type: object
+    users.AccessLocation:
+      enum:
+        - environment
+        - environmentGroup
+      type: string
+      x-enum-varnames:
+        - AccessLocationEnvironment
+        - AccessLocationEnvironmentGroup
+    users.EffectiveAccessEntry:
+      properties:
+        accessLocation:
+          $ref: "#/components/schemas/users.AccessLocation"
+        endpointId:
+          type: integer
+        endpointName:
+          type: string
+        groupId:
+          type: integer
+        groupName:
+          type: string
+        roleId:
+          type: integer
+        roleName:
+          type: string
+        rolePriority:
+          type: integer
+        teamId:
+          type: integer
+        teamName:
+          type: string
+      type: object
+    users.accessTokenResponse:
+      properties:
+        apiKey:
+          $ref: "#/components/schemas/portainer.APIKey"
+        rawAPIKey:
+          type: string
+      type: object
+    users.addHelmRepoUrlPayload:
+      properties:
+        url:
+          type: string
+      type: object
+    users.adminInitPayload:
+      properties:
+        Password:
+          description: Password for the admin user
+          example: admin-password
+          type: string
+        Username:
+          description: Username for the admin user
+          example: admin
+          type: string
+      required:
+        - Password
+        - Username
+      type: object
+    users.helmUserRepositoryResponse:
+      properties:
+        GlobalRepository:
+          type: string
+        UserRepositories:
+          items:
+            $ref: "#/components/schemas/portainer.HelmUserRepository"
+          type: array
+      type: object
+    users.themePayload:
+      properties:
+        color:
+          description: Color represents the color theme of the UI
+          enum:
+            - dark
+            - light
+            - highcontrast
+            - auto
+          example: dark
+          type: string
+      type: object
+    users.userAccessTokenCreatePayload:
+      properties:
+        description:
+          example: github-api-key
+          type: string
+        password:
+          example: password
+          type: string
+      required:
+        - description
+        - password
+      type: object
+    users.userCreatePayload:
+      properties:
+        Password:
+          example: cg9Wgky3
+          type: string
+        Role:
+          description: User role (1 for administrator account and 2 for regular account)
+          enum:
+            - 1
+            - 2
+          example: 2
+          type: integer
+        Username:
+          example: bob
+          type: string
+      required:
+        - Password
+        - Role
+        - Username
+      type: object
+    users.userUpdatePasswordPayload:
+      properties:
+        NewPassword:
+          description: New Password
+          example: new_passwd
+          type: string
+        Password:
+          description: Current Password
+          example: passwd
+          type: string
+      required:
+        - NewPassword
+        - Password
+      type: object
+    users.userUpdatePayload:
+      properties:
+        NewPassword:
+          example: asfj2emv
+          type: string
+        Password:
+          example: cg9Wgky3
+          type: string
+        Role:
+          description: User role (1 for administrator account and 2 for regular account)
+          enum:
+            - 1
+            - 2
+          example: 2
+          type: integer
+        Theme:
+          $ref: "#/components/schemas/users.themePayload"
+        UseCache:
+          example: true
+          type: boolean
+        Username:
+          example: bob
+          type: string
+      required:
+        - NewPassword
+        - Password
+        - Role
+        - UseCache
+        - Username
+      type: object
+    v1.AppArmorProfile:
+      properties:
+        localhostProfile:
+          description: >-
+            localhostProfile indicates a profile loaded on the node that should
+            be used.
+
+            The profile must be preconfigured on the node to work.
+
+            Must match the loaded name of the profile.
+
+            Must be set if and only if type is "Localhost".
+
+            +optional
+          type: string
+        type:
+          allOf:
+            - $ref: "#/components/schemas/v1.AppArmorProfileType"
+          description: |-
+            type indicates which kind of AppArmor profile will be applied.
+            Valid options are:
+              Localhost - a profile pre-loaded on the node.
+              RuntimeDefault - the container runtime's default profile.
+              Unconfined - no AppArmor enforcement.
+            +unionDiscriminator
+      type: object
+    v1.AppArmorProfileType:
+      enum:
+        - Unconfined
+        - RuntimeDefault
+        - Localhost
+      type: string
+      x-enum-varnames:
+        - AppArmorProfileTypeUnconfined
+        - AppArmorProfileTypeRuntimeDefault
+        - AppArmorProfileTypeLocalhost
+    v1.AttachedVolume:
+      properties:
+        devicePath:
+          description: DevicePath represents the device path where the volume should be
+            available
+          type: string
+        name:
+          description: Name of the attached volume
+          type: string
+      type: object
+    v1.CSIPersistentVolumeSource:
+      properties:
+        controllerExpandSecretRef:
+          allOf:
+            - $ref: "#/components/schemas/v1.SecretReference"
+          description: >-
+            controllerExpandSecretRef is a reference to the secret object
+            containing
+
+            sensitive information to pass to the CSI driver to complete the CSI
+
+            ControllerExpandVolume call.
+
+            This field is optional, and may be empty if no secret is required. If the
+
+            secret object contains more than one secret, all secrets are passed.
+
+            +optional
+        controllerPublishSecretRef:
+          allOf:
+            - $ref: "#/components/schemas/v1.SecretReference"
+          description: >-
+            controllerPublishSecretRef is a reference to the secret object
+            containing
+
+            sensitive information to pass to the CSI driver to complete the CSI
+
+            ControllerPublishVolume and ControllerUnpublishVolume calls.
+
+            This field is optional, and may be empty if no secret is required. If the
+
+            secret object contains more than one secret, all secrets are passed.
+
+            +optional
+        driver:
+          description: |-
+            driver is the name of the driver to use for this volume.
+            Required.
+          type: string
+        fsType:
+          description: >-
+            fsType to mount. Must be a filesystem type supported by the host
+            operating system.
+
+            Ex. "ext4", "xfs", "ntfs".
+
+            +optional
+          type: string
+        nodeExpandSecretRef:
+          allOf:
+            - $ref: "#/components/schemas/v1.SecretReference"
+          description: >-
+            nodeExpandSecretRef is a reference to the secret object containing
+
+            sensitive information to pass to the CSI driver to complete the CSI
+
+            NodeExpandVolume call.
+
+            This field is optional, may be omitted if no secret is required. If the
+
+            secret object contains more than one secret, all secrets are passed.
+
+            +optional
+        nodePublishSecretRef:
+          allOf:
+            - $ref: "#/components/schemas/v1.SecretReference"
+          description: >-
+            nodePublishSecretRef is a reference to the secret object containing
+
+            sensitive information to pass to the CSI driver to complete the CSI
+
+            NodePublishVolume and NodeUnpublishVolume calls.
+
+            This field is optional, and may be empty if no secret is required. If the
+
+            secret object contains more than one secret, all secrets are passed.
+
+            +optional
+        nodeStageSecretRef:
+          allOf:
+            - $ref: "#/components/schemas/v1.SecretReference"
+          description: >-
+            nodeStageSecretRef is a reference to the secret object containing
+            sensitive
+
+            information to pass to the CSI driver to complete the CSI NodeStageVolume
+
+            and NodeStageVolume and NodeUnstageVolume calls.
+
+            This field is optional, and may be empty if no secret is required. If the
+
+            secret object contains more than one secret, all secrets are passed.
+
+            +optional
+        readOnly:
+          description: |-
+            readOnly value to pass to ControllerPublishVolumeRequest.
+            Defaults to false (read/write).
+            +optional
+          type: boolean
+        volumeAttributes:
+          additionalProperties:
+            type: string
+          description: |-
+            volumeAttributes of the volume to publish.
+            +optional
+          type: object
+        volumeHandle:
+          description: >-
+            volumeHandle is the unique volume name returned by the CSI volume
+
+            plugin’s CreateVolume to refer to the volume on all subsequent calls.
+
+            Required.
+          type: string
+      type: object
+    v1.Capabilities:
+      properties:
+        add:
+          description: |-
+            Added capabilities
+            +optional
+            +listType=atomic
+          items:
+            type: string
+          type: array
+        drop:
+          description: |-
+            Removed capabilities
+            +optional
+            +listType=atomic
+          items:
+            type: string
+          type: array
+      type: object
+    v1.ConfigMapEnvSource:
+      properties:
+        name:
+          description: >-
+            Name of the referent.
+
+            This field is effectively required, but due to backwards compatibility is
+
+            allowed to be empty. Instances of this type with an empty value here are
+
+            almost certainly wrong.
+
+            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+
+            +optional
+
+            +default=""
+
+            +kubebuilder:default=""
+
+            TODO: Drop `kubebuilder:default` when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.
+          type: string
+        optional:
+          description: |-
+            Specify whether the ConfigMap must be defined
+            +optional
+          type: boolean
+      type: object
+    v1.ConfigMapKeySelector:
+      properties:
+        key:
+          description: The key to select.
+          type: string
+        name:
+          description: >-
+            Name of the referent.
+
+            This field is effectively required, but due to backwards compatibility is
+
+            allowed to be empty. Instances of this type with an empty value here are
+
+            almost certainly wrong.
+
+            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+
+            +optional
+
+            +default=""
+
+            +kubebuilder:default=""
+
+            TODO: Drop `kubebuilder:default` when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.
+          type: string
+        optional:
+          description: |-
+            Specify whether the ConfigMap or its key must be defined
+            +optional
+          type: boolean
+      type: object
+    v1.ConfigMapNodeConfigSource:
+      properties:
+        kubeletConfigKey:
+          description: >-
+            KubeletConfigKey declares which key of the referenced ConfigMap
+            corresponds to the KubeletConfiguration structure
+
+            This field is required in all cases.
+          type: string
+        name:
+          description: |-
+            Name is the metadata.name of the referenced ConfigMap.
+            This field is required in all cases.
+          type: string
+        namespace:
+          description: |-
+            Namespace is the metadata.namespace of the referenced ConfigMap.
+            This field is required in all cases.
+          type: string
+        resourceVersion:
+          description: >-
+            ResourceVersion is the metadata.ResourceVersion of the referenced
+            ConfigMap.
+
+            This field is forbidden in Node.Spec, and required in Node.Status.
+
+            +optional
+          type: string
+        uid:
+          description: |-
+            UID is the metadata.UID of the referenced ConfigMap.
+            This field is forbidden in Node.Spec, and required in Node.Status.
+            +optional
+          type: string
+      type: object
+    v1.Container:
+      properties:
+        args:
+          description: >-
+            Arguments to the entrypoint.
+
+            The container image's CMD is used if this is not provided.
+
+            Variable references $(VAR_NAME) are expanded using the container's environment. If a variable
+
+            cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced
+
+            to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will
+
+            produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless
+
+            of whether the variable exists or not. Cannot be updated.
+
+            More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell
+
+            +optional
+
+            +listType=atomic
+          items:
+            type: string
+          type: array
+        command:
+          description: >-
+            Entrypoint array. Not executed within a shell.
+
+            The container image's ENTRYPOINT is used if this is not provided.
+
+            Variable references $(VAR_NAME) are expanded using the container's environment. If a variable
+
+            cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced
+
+            to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will
+
+            produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless
+
+            of whether the variable exists or not. Cannot be updated.
+
+            More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell
+
+            +optional
+
+            +listType=atomic
+          items:
+            type: string
+          type: array
+        env:
+          description: |-
+            List of environment variables to set in the container.
+            Cannot be updated.
+            +optional
+            +patchMergeKey=name
+            +patchStrategy=merge
+            +listType=map
+            +listMapKey=name
+          items:
+            $ref: "#/components/schemas/v1.EnvVar"
+          type: array
+        envFrom:
+          description: >-
+            List of sources to populate environment variables in the container.
+
+            The keys defined within a source may consist of any printable ASCII characters except '='.
+
+            When a key exists in multiple
+
+            sources, the value associated with the last source will take precedence.
+
+            Values defined by an Env with a duplicate key will take precedence.
+
+            Cannot be updated.
+
+            +optional
+
+            +listType=atomic
+          items:
+            $ref: "#/components/schemas/v1.EnvFromSource"
+          type: array
+        image:
+          description: >-
+            Container image name.
+
+            More info: https://kubernetes.io/docs/concepts/containers/images
+
+            This field is optional to allow higher level config management to default or override
+
+            container images in workload controllers like Deployments and StatefulSets.
+
+            +optional
+          type: string
+        imagePullPolicy:
+          allOf:
+            - $ref: "#/components/schemas/v1.PullPolicy"
+          description: >-
+            Image pull policy.
+
+            One of Always, Never, IfNotPresent.
+
+            Defaults to Always if :latest tag is specified, or IfNotPresent otherwise.
+
+            Cannot be updated.
+
+            More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
+
+            +optional
+        lifecycle:
+          allOf:
+            - $ref: "#/components/schemas/v1.Lifecycle"
+          description: >-
+            Actions that the management system should take in response to
+            container lifecycle events.
+
+            Cannot be updated.
+
+            +optional
+        livenessProbe:
+          allOf:
+            - $ref: "#/components/schemas/v1.Probe"
+          description: >-
+            Periodic probe of container liveness.
+
+            Container will be restarted if the probe fails.
+
+            Cannot be updated.
+
+            More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+
+            +optional
+        name:
+          description: |-
+            Name of the container specified as a DNS_LABEL.
+            Each container in a pod must have a unique name (DNS_LABEL).
+            Cannot be updated.
+          type: string
+        ports:
+          description: >-
+            List of ports to expose from the container. Not specifying a port
+            here
+
+            DOES NOT prevent that port from being exposed. Any port which is
+
+            listening on the default "0.0.0.0" address inside a container will be
+
+            accessible from the network.
+
+            Modifying this array with strategic merge patch may corrupt the data.
+
+            For more information See https://github.com/kubernetes/kubernetes/issues/108255.
+
+            Cannot be updated.
+
+            +optional
+
+            +patchMergeKey=containerPort
+
+            +patchStrategy=merge
+
+            +listType=map
+
+            +listMapKey=containerPort
+
+            +listMapKey=protocol
+          items:
+            $ref: "#/components/schemas/v1.ContainerPort"
+          type: array
+        readinessProbe:
+          allOf:
+            - $ref: "#/components/schemas/v1.Probe"
+          description: >-
+            Periodic probe of container service readiness.
+
+            Container will be removed from service endpoints if the probe fails.
+
+            Cannot be updated.
+
+            More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+
+            +optional
+        resizePolicy:
+          description: |-
+            Resources resize policy for the container.
+            This field cannot be set on ephemeral containers.
+            +featureGate=InPlacePodVerticalScaling
+            +optional
+            +listType=atomic
+          items:
+            $ref: "#/components/schemas/v1.ContainerResizePolicy"
+          type: array
+        resources:
+          allOf:
+            - $ref: "#/components/schemas/v1.ResourceRequirements"
+          description: >-
+            Compute Resources required by this container.
+
+            Cannot be updated.
+
+            More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+
+            +optional
+        restartPolicy:
+          allOf:
+            - $ref: "#/components/schemas/v1.ContainerRestartPolicy"
+          description: >-
+            RestartPolicy defines the restart behavior of individual containers
+            in a pod.
+
+            This overrides the pod-level restart policy. When this field is not specified,
+
+            the restart behavior is defined by the Pod's restart policy and the container type.
+
+            Additionally, setting the RestartPolicy as "Always" for the init container will
+
+            have the following effect:
+
+            this init container will be continually restarted on
+
+            exit until all regular containers have terminated. Once all regular
+
+            containers have completed, all init containers with restartPolicy "Always"
+
+            will be shut down. This lifecycle differs from normal init containers and
+
+            is often referred to as a "sidecar" container. Although this init
+
+            container still starts in the init container sequence, it does not wait
+
+            for the container to complete before proceeding to the next init
+
+            container. Instead, the next init container starts immediately after this
+
+            init container is started, or after any startupProbe has successfully
+
+            completed.
+
+            +optional
+        restartPolicyRules:
+          description: >-
+            Represents a list of rules to be checked to determine if the
+
+            container should be restarted on exit. The rules are evaluated in
+
+            order. Once a rule matches a container exit condition, the remaining
+
+            rules are ignored. If no rule matches the container exit condition,
+
+            the Container-level restart policy determines the whether the container
+
+            is restarted or not. Constraints on the rules:
+
+            - At most 20 rules are allowed.
+
+            - Rules can have the same action.
+
+            - Identical rules are not forbidden in validations.
+
+            When rules are specified, container MUST set RestartPolicy explicitly
+
+            even it if matches the Pod's RestartPolicy.
+
+            +featureGate=ContainerRestartRules
+
+            +optional
+
+            +listType=atomic
+          items:
+            $ref: "#/components/schemas/v1.ContainerRestartRule"
+          type: array
+        securityContext:
+          allOf:
+            - $ref: "#/components/schemas/v1.SecurityContext"
+          description: >-
+            SecurityContext defines the security options the container should be
+            run with.
+
+            If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.
+
+            More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+
+            +optional
+        startupProbe:
+          allOf:
+            - $ref: "#/components/schemas/v1.Probe"
+          description: >-
+            StartupProbe indicates that the Pod has successfully initialized.
+
+            If specified, no other probes are executed until this completes successfully.
+
+            If this probe fails, the Pod will be restarted, just as if the livenessProbe failed.
+
+            This can be used to provide different probe parameters at the beginning of a Pod's lifecycle,
+
+            when it might take a long time to load data or warm a cache, than during steady-state operation.
+
+            This cannot be updated.
+
+            More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+
+            +optional
+        stdin:
+          description: >-
+            Whether this container should allocate a buffer for stdin in the
+            container runtime. If this
+
+            is not set, reads from stdin in the container will always result in EOF.
+
+            Default is false.
+
+            +optional
+          type: boolean
+        stdinOnce:
+          description: >-
+            Whether the container runtime should close the stdin channel after
+            it has been opened by
+
+            a single attach. When stdin is true the stdin stream will remain open across multiple attach
+
+            sessions. If stdinOnce is set to true, stdin is opened on container start, is empty until the
+
+            first client attaches to stdin, and then remains open and accepts data until the client disconnects,
+
+            at which time stdin is closed and remains closed until the container is restarted. If this
+
+            flag is false, a container processes that reads from stdin will never receive an EOF.
+
+            Default is false
+
+            +optional
+          type: boolean
+        terminationMessagePath:
+          description: >-
+            Optional: Path at which the file to which the container's
+            termination message
+
+            will be written is mounted into the container's filesystem.
+
+            Message written is intended to be brief final status, such as an assertion failure message.
+
+            Will be truncated by the node if greater than 4096 bytes. The total message length across
+
+            all containers will be limited to 12kb.
+
+            Defaults to /dev/termination-log.
+
+            Cannot be updated.
+
+            +optional
+          type: string
+        terminationMessagePolicy:
+          allOf:
+            - $ref: "#/components/schemas/v1.TerminationMessagePolicy"
+          description: >-
+            Indicate how the termination message should be populated. File will
+            use the contents of
+
+            terminationMessagePath to populate the container status message on both success and failure.
+
+            FallbackToLogsOnError will use the last chunk of container log output if the termination
+
+            message file is empty and the container exited with an error.
+
+            The log output is limited to 2048 bytes or 80 lines, whichever is smaller.
+
+            Defaults to File.
+
+            Cannot be updated.
+
+            +optional
+        tty:
+          description: >-
+            Whether this container should allocate a TTY for itself, also
+            requires 'stdin' to be true.
+
+            Default is false.
+
+            +optional
+          type: boolean
+        volumeDevices:
+          description: >-
+            volumeDevices is the list of block devices to be used by the
+            container.
+
+            +patchMergeKey=devicePath
+
+            +patchStrategy=merge
+
+            +listType=map
+
+            +listMapKey=devicePath
+
+            +optional
+          items:
+            $ref: "#/components/schemas/v1.VolumeDevice"
+          type: array
+        volumeMounts:
+          description: |-
+            Pod volumes to mount into the container's filesystem.
+            Cannot be updated.
+            +optional
+            +patchMergeKey=mountPath
+            +patchStrategy=merge
+            +listType=map
+            +listMapKey=mountPath
+          items:
+            $ref: "#/components/schemas/v1.VolumeMount"
+          type: array
+        workingDir:
+          description: >-
+            Container's working directory.
+
+            If not specified, the container runtime's default will be used, which
+
+            might be configured in the container image.
+
+            Cannot be updated.
+
+            +optional
+          type: string
+      type: object
+    v1.ContainerImage:
+      properties:
+        names:
+          description: >-
+            Names by which this image is known.
+
+            e.g. ["kubernetes.example/hyperkube:v1.0.7", "cloud-vendor.registry.example/cloud-vendor/hyperkube:v1.0.7"]
+
+            +optional
+
+            +listType=atomic
+          items:
+            type: string
+          type: array
+        sizeBytes:
+          description: |-
+            The size of the image in bytes.
+            +optional
+          type: integer
+      type: object
+    v1.ContainerPort:
+      properties:
+        containerPort:
+          description: |-
+            Number of port to expose on the pod's IP address.
+            This must be a valid port number, 0 < x < 65536.
+          type: integer
+        hostIP:
+          description: |-
+            What host IP to bind the external port to.
+            +optional
+          type: string
+        hostPort:
+          description: |-
+            Number of port to expose on the host.
+            If specified, this must be a valid port number, 0 < x < 65536.
+            If HostNetwork is specified, this must match ContainerPort.
+            Most containers do not need this.
+            +optional
+          type: integer
+        name:
+          description: >-
+            If specified, this must be an IANA_SVC_NAME and unique within the
+            pod. Each
+
+            named port in a pod must have a unique name. Name for the port that can be
+
+            referred to by services.
+
+            +optional
+          type: string
+        protocol:
+          allOf:
+            - $ref: "#/components/schemas/v1.Protocol"
+          description: |-
+            Protocol for port. Must be UDP, TCP, or SCTP.
+            Defaults to "TCP".
+            +optional
+            +default="TCP"
+      type: object
+    v1.ContainerResizePolicy:
+      properties:
+        resourceName:
+          allOf:
+            - $ref: "#/components/schemas/v1.ResourceName"
+          description: |-
+            Name of the resource to which this resource resize policy applies.
+            Supported values: cpu, memory.
+        restartPolicy:
+          allOf:
+            - $ref: "#/components/schemas/v1.ResourceResizeRestartPolicy"
+          description: |-
+            Restart policy to apply when specified resource is resized.
+            If not specified, it defaults to NotRequired.
+      type: object
+    v1.ContainerRestartPolicy:
+      enum:
+        - Always
+        - Never
+        - OnFailure
+      type: string
+      x-enum-varnames:
+        - ContainerRestartPolicyAlways
+        - ContainerRestartPolicyNever
+        - ContainerRestartPolicyOnFailure
+    v1.ContainerRestartRule:
+      properties:
+        action:
+          allOf:
+            - $ref: "#/components/schemas/v1.ContainerRestartRuleAction"
+          description: |-
+            Specifies the action taken on a container exit if the requirements
+            are satisfied. The only possible value is "Restart" to restart the
+            container.
+            +required
+        exitCodes:
+          allOf:
+            - $ref: "#/components/schemas/v1.ContainerRestartRuleOnExitCodes"
+          description: |-
+            Represents the exit codes to check on container exits.
+            +optional
+            +oneOf=when
+      type: object
+    v1.ContainerRestartRuleAction:
+      enum:
+        - Restart
+        - RestartAllContainers
+      type: string
+      x-enum-varnames:
+        - ContainerRestartRuleActionRestart
+        - ContainerRestartRuleActionRestartAllContainers
+    v1.ContainerRestartRuleOnExitCodes:
+      properties:
+        operator:
+          allOf:
+            - $ref: "#/components/schemas/v1.ContainerRestartRuleOnExitCodesOperator"
+          description: >-
+            Represents the relationship between the container exit code(s) and
+            the
+
+            specified values. Possible values are:
+
+            - In: the requirement is satisfied if the container exit code is in the
+              set of specified values.
+            - NotIn: the requirement is satisfied if the container exit code is
+              not in the set of specified values.
+            +required
+        values:
+          description: |-
+            Specifies the set of values to check for container exit codes.
+            At most 255 elements are allowed.
+            +optional
+            +listType=set
+          items:
+            type: integer
+          type: array
+      type: object
+    v1.ContainerRestartRuleOnExitCodesOperator:
+      enum:
+        - In
+        - NotIn
+      type: string
+      x-enum-varnames:
+        - ContainerRestartRuleOnExitCodesOpIn
+        - ContainerRestartRuleOnExitCodesOpNotIn
+    v1.DaemonEndpoint:
+      properties:
+        Port:
+          description: Port number of the given endpoint.
+          type: integer
+      type: object
+    v1.EnvFromSource:
+      properties:
+        configMapRef:
+          allOf:
+            - $ref: "#/components/schemas/v1.ConfigMapEnvSource"
+          description: |-
+            The ConfigMap to select from
+            +optional
+        prefix:
+          description: |-
+            Optional text to prepend to the name of each environment variable.
+            May consist of any printable ASCII characters except '='.
+            +optional
+          type: string
+        secretRef:
+          allOf:
+            - $ref: "#/components/schemas/v1.SecretEnvSource"
+          description: |-
+            The Secret to select from
+            +optional
+      type: object
+    v1.EnvVar:
+      properties:
+        name:
+          description: |-
+            Name of the environment variable.
+            May consist of any printable ASCII characters except '='.
+          type: string
+        value:
+          description: >-
+            Variable references $(VAR_NAME) are expanded
+
+            using the previously defined environment variables in the container and
+
+            any service environment variables. If a variable cannot be resolved,
+
+            the reference in the input string will be unchanged. Double $$ are reduced
+
+            to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
+
+            "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
+
+            Escaped references will never be expanded, regardless of whether the variable
+
+            exists or not.
+
+            Defaults to "".
+
+            +optional
+          type: string
+        valueFrom:
+          allOf:
+            - $ref: "#/components/schemas/v1.EnvVarSource"
+          description: >-
+            Source for the environment variable's value. Cannot be used if value
+            is not empty.
+
+            +optional
+      type: object
+    v1.EnvVarSource:
+      properties:
+        configMapKeyRef:
+          allOf:
+            - $ref: "#/components/schemas/v1.ConfigMapKeySelector"
+          description: |-
+            Selects a key of a ConfigMap.
+            +optional
+        fieldRef:
+          allOf:
+            - $ref: "#/components/schemas/v1.ObjectFieldSelector"
+          description: >-
+            Selects a field of the pod: supports metadata.name,
+            metadata.namespace, `metadata.labels['<KEY>']`,
+            `metadata.annotations['<KEY>']`,
+
+            spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.
+
+            +optional
+        fileKeyRef:
+          allOf:
+            - $ref: "#/components/schemas/v1.FileKeySelector"
+          description: |-
+            FileKeyRef selects a key of the env file.
+            Requires the EnvFiles feature gate to be enabled.
+
+            +featureGate=EnvFiles
+            +optional
+        resourceFieldRef:
+          allOf:
+            - $ref: "#/components/schemas/v1.ResourceFieldSelector"
+          description: >-
+            Selects a resource of the container: only resources limits and
+            requests
+
+            (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.
+
+            +optional
+        secretKeyRef:
+          allOf:
+            - $ref: "#/components/schemas/v1.SecretKeySelector"
+          description: |-
+            Selects a key of a secret in the pod's namespace
+            +optional
+      type: object
+    v1.ExecAction:
+      properties:
+        command:
+          description: >-
+            Command is the command line to execute inside the container, the
+            working directory for the
+
+            command  is root ('/') in the container's filesystem. The command is simply exec'd, it is
+
+            not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+
+            a shell, you need to explicitly call out to that shell.
+
+            Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
+
+            +optional
+
+            +listType=atomic
+          items:
+            type: string
+          type: array
+      type: object
+    v1.FieldsV1:
+      type: object
+    v1.FileKeySelector:
+      properties:
+        key:
+          description: >-
+            The key within the env file. An invalid key will prevent the pod
+            from starting.
+
+            The keys defined within a source may consist of any printable ASCII characters except '='.
+
+            During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+
+            +required
+          type: string
+        optional:
+          description: >-
+            Specify whether the file or its key must be defined. If the file or
+            key
+
+            does not exist, then the env var is not published.
+
+            If optional is set to true and the specified key does not exist,
+
+            the environment variable will not be set in the Pod's containers.
+
+
+            If optional is set to false and the specified key does not exist,
+
+            an error will be returned during Pod creation.
+
+            +optional
+
+            +default=false
+          type: boolean
+        path:
+          description: >-
+            The path within the volume from which to select the file.
+
+            Must be relative and may not contain the '..' path or start with '..'.
+
+            +required
+          type: string
+        volumeName:
+          description: |-
+            The name of the volume mount containing the env file.
+            +required
+          type: string
+      type: object
+    v1.GRPCAction:
+      properties:
+        port:
+          description: Port number of the gRPC service. Number must be in the range 1 to
+            65535.
+          type: integer
+        service:
+          description: >-
+            Service is the name of the service to place in the gRPC
+            HealthCheckRequest
+
+            (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+
+
+            If this is not specified, the default behavior is defined by gRPC.
+
+            +optional
+
+            +default=""
+          type: string
+      type: object
+    v1.HTTPGetAction:
+      properties:
+        host:
+          description: >-
+            Host name to connect to, defaults to the pod IP. You probably want
+            to set
+
+            "Host" in httpHeaders instead.
+
+            +optional
+          type: string
+        httpHeaders:
+          description: |-
+            Custom headers to set in the request. HTTP allows repeated headers.
+            +optional
+            +listType=atomic
+          items:
+            $ref: "#/components/schemas/k8s_io_api_core_v1.HTTPHeader"
+          type: array
+        path:
+          description: |-
+            Path to access on the HTTP server.
+            +optional
+          type: string
+        port:
+          allOf:
+            - $ref: "#/components/schemas/intstr.IntOrString"
+          description: |-
+            Name or number of the port to access on the container.
+            Number must be in the range 1 to 65535.
+            Name must be an IANA_SVC_NAME.
+        scheme:
+          allOf:
+            - $ref: "#/components/schemas/v1.URIScheme"
+          description: |-
+            Scheme to use for connecting to the host.
+            Defaults to HTTP.
+            +optional
+      type: object
+    v1.Lifecycle:
+      properties:
+        postStart:
+          allOf:
+            - $ref: "#/components/schemas/v1.LifecycleHandler"
+          description: >-
+            PostStart is called immediately after a container is created. If the
+            handler fails,
+
+            the container is terminated and restarted according to its restart policy.
+
+            Other management of the container blocks until the hook completes.
+
+            More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks
+
+            +optional
+        preStop:
+          allOf:
+            - $ref: "#/components/schemas/v1.LifecycleHandler"
+          description: >-
+            PreStop is called immediately before a container is terminated due
+            to an
+
+            API request or management event such as liveness/startup probe failure,
+
+            preemption, resource contention, etc. The handler is not called if the
+
+            container crashes or exits. The Pod's termination grace period countdown begins before the
+
+            PreStop hook is executed. Regardless of the outcome of the handler, the
+
+            container will eventually terminate within the Pod's termination grace
+
+            period (unless delayed by finalizers). Other management of the container blocks until the hook completes
+
+            or until the termination grace period is reached.
+
+            More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks
+
+            +optional
+        stopSignal:
+          allOf:
+            - $ref: "#/components/schemas/v1.Signal"
+          description: >-
+            StopSignal defines which signal will be sent to a container when it
+            is being stopped.
+
+            If not specified, the default is defined by the container runtime in use.
+
+            StopSignal can only be set for Pods with a non-empty .spec.os.name
+
+            +optional
+      type: object
+    v1.LifecycleHandler:
+      properties:
+        exec:
+          allOf:
+            - $ref: "#/components/schemas/v1.ExecAction"
+          description: |-
+            Exec specifies a command to execute in the container.
+            +optional
+        httpGet:
+          allOf:
+            - $ref: "#/components/schemas/v1.HTTPGetAction"
+          description: |-
+            HTTPGet specifies an HTTP GET request to perform.
+            +optional
+        sleep:
+          allOf:
+            - $ref: "#/components/schemas/v1.SleepAction"
+          description: |-
+            Sleep represents a duration that the container should sleep.
+            +optional
+        tcpSocket:
+          allOf:
+            - $ref: "#/components/schemas/v1.TCPSocketAction"
+          description: >-
+            Deprecated. TCPSocket is NOT supported as a LifecycleHandler and
+            kept
+
+            for backward compatibility. There is no validation of this field and
+
+            lifecycle hooks will fail at runtime when it is specified.
+
+            +optional
+      type: object
+    v1.ListMeta:
+      properties:
+        continue:
+          description: >-
+            continue may be set if the user set a limit on the number of items
+            returned, and indicates that
+
+            the server has more data available. The value is opaque and may be used to issue another request
+
+            to the endpoint that served this list to retrieve the next set of available objects. Continuing a
+
+            consistent list may not be possible if the server configuration has changed or more than a few
+
+            minutes have passed. The resourceVersion field returned when using this continue value will be
+
+            identical to the value in the first response, unless you have received this token from an error
+
+            message.
+          type: string
+        remainingItemCount:
+          description: >-
+            remainingItemCount is the number of subsequent items in the list
+            which are not included in this
+
+            list response. If the list request contained label or field selectors, then the number of
+
+            remaining items is unknown and the field will be left unset and omitted during serialization.
+
+            If the list is complete (either because it is not chunking or because this is the last chunk),
+
+            then there are no more remaining items and this field will be left unset and omitted during
+
+            serialization.
+
+            Servers older than v1.15 do not set this field.
+
+            The intended use of the remainingItemCount is *estimating* the size of a collection. Clients
+
+            should not rely on the remainingItemCount to be set or to be exact.
+
+            +optional
+          type: integer
+        resourceVersion:
+          description: >-
+            String that identifies the server's internal version of this object
+            that
+
+            can be used by clients to determine when objects have changed.
+
+            Value must be treated as opaque by clients and passed unmodified back to the server.
+
+            Populated by the system.
+
+            Read-only.
+
+            More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
+
+            +optional
+          type: string
+        selfLink:
+          description: >-
+            Deprecated: selfLink is a legacy read-only field that is no longer
+            populated by the system.
+
+            +optional
+          type: string
+      type: object
+    v1.ManagedFieldsEntry:
+      properties:
+        apiVersion:
+          description: |-
+            APIVersion defines the version of this resource that this field set
+            applies to. The format is "group/version" just like the top-level
+            APIVersion field. It is necessary to track the version of a field
+            set because it cannot be automatically converted.
+          type: string
+        fieldsType:
+          description: >-
+            FieldsType is the discriminator for the different fields format and
+            version.
+
+            There is currently only one possible value: "FieldsV1"
+          type: string
+        fieldsV1:
+          allOf:
+            - $ref: "#/components/schemas/v1.FieldsV1"
+          description: >-
+            FieldsV1 holds the first JSON version format as described in the
+            "FieldsV1" type.
+
+            +optional
+        manager:
+          description: Manager is an identifier of the workflow managing these fields.
+          type: string
+        operation:
+          allOf:
+            - $ref: "#/components/schemas/v1.ManagedFieldsOperationType"
+          description: >-
+            Operation is the type of operation which lead to this
+            ManagedFieldsEntry being created.
+
+            The only valid values for this field are 'Apply' and 'Update'.
+        subresource:
+          description: >-
+            Subresource is the name of the subresource used to update that
+            object, or
+
+            empty string if the object was updated through the main resource. The
+
+            value of this field is used to distinguish between managers, even if they
+
+            share the same name. For example, a status update will be distinct from a
+
+            regular update using the same manager name.
+
+            Note that the APIVersion field is not related to the Subresource field and
+
+            it always corresponds to the version of the main resource.
+          type: string
+        time:
+          description: |-
+            Time is the timestamp of when the ManagedFields entry was added. The
+            timestamp will also be updated if a field is added, the manager
+            changes any of the owned fields value or removes a field. The
+            timestamp does not update when a field is removed from the entry
+            because another manager took it over.
+            +optional
+          type: string
+      type: object
+    v1.ManagedFieldsOperationType:
+      enum:
+        - Apply
+        - Update
+      type: string
+      x-enum-varnames:
+        - ManagedFieldsOperationApply
+        - ManagedFieldsOperationUpdate
+    v1.MountPropagationMode:
+      enum:
+        - None
+        - HostToContainer
+        - Bidirectional
+      type: string
+      x-enum-varnames:
+        - MountPropagationNone
+        - MountPropagationHostToContainer
+        - MountPropagationBidirectional
+    v1.NamespaceCondition:
+      properties:
+        lastTransitionTime:
+          description: |-
+            Last time the condition transitioned from one status to another.
+            +optional
+          type: string
+        message:
+          description: |-
+            Human-readable message indicating details about last transition.
+            +optional
+          type: string
+        reason:
+          description: >-
+            Unique, one-word, CamelCase reason for the condition's last
+            transition.
+
+            +optional
+          type: string
+        status:
+          allOf:
+            - $ref: "#/components/schemas/k8s_io_api_core_v1.ConditionStatus"
+          description: Status of the condition, one of True, False, Unknown.
+        type:
+          allOf:
+            - $ref: "#/components/schemas/v1.NamespaceConditionType"
+          description: Type of namespace controller condition.
+      type: object
+    v1.NamespaceConditionType:
+      enum:
+        - NamespaceDeletionDiscoveryFailure
+        - NamespaceDeletionContentFailure
+        - NamespaceDeletionGroupVersionParsingFailure
+        - NamespaceContentRemaining
+        - NamespaceFinalizersRemaining
+      type: string
+      x-enum-varnames:
+        - NamespaceDeletionDiscoveryFailure
+        - NamespaceDeletionContentFailure
+        - NamespaceDeletionGVParsingFailure
+        - NamespaceContentRemaining
+        - NamespaceFinalizersRemaining
+    v1.NamespacePhase:
+      enum:
+        - Active
+        - Terminating
+      type: string
+      x-enum-varnames:
+        - NamespaceActive
+        - NamespaceTerminating
+    v1.NamespaceStatus:
+      properties:
+        conditions:
+          description: >-
+            Represents the latest available observations of a namespace's
+            current state.
+
+            +optional
+
+            +patchMergeKey=type
+
+            +patchStrategy=merge
+
+            +listType=map
+
+            +listMapKey=type
+          items:
+            $ref: "#/components/schemas/v1.NamespaceCondition"
+          type: array
+        phase:
+          allOf:
+            - $ref: "#/components/schemas/v1.NamespacePhase"
+          description: >-
+            Phase is the current lifecycle phase of the namespace.
+
+            More info: https://kubernetes.io/docs/tasks/administer-cluster/namespaces/
+
+            +optional
+      type: object
+    v1.NodeAddress:
+      properties:
+        address:
+          description: The node address.
+          type: string
+        type:
+          allOf:
+            - $ref: "#/components/schemas/v1.NodeAddressType"
+          description: Node address type, one of Hostname, ExternalIP or InternalIP.
+      type: object
+    v1.NodeAddressType:
+      enum:
+        - Hostname
+        - InternalIP
+        - ExternalIP
+        - InternalDNS
+        - ExternalDNS
+      type: string
+      x-enum-varnames:
+        - NodeHostName
+        - NodeInternalIP
+        - NodeExternalIP
+        - NodeInternalDNS
+        - NodeExternalDNS
+    v1.NodeCondition:
+      properties:
+        lastHeartbeatTime:
+          description: |-
+            Last time we got an update on a given condition.
+            +optional
+          type: string
+        lastTransitionTime:
+          description: |-
+            Last time the condition transit from one status to another.
+            +optional
+          type: string
+        message:
+          description: |-
+            Human readable message indicating details about last transition.
+            +optional
+          type: string
+        reason:
+          description: |-
+            (brief) reason for the condition's last transition.
+            +optional
+          type: string
+        status:
+          allOf:
+            - $ref: "#/components/schemas/k8s_io_api_core_v1.ConditionStatus"
+          description: Status of the condition, one of True, False, Unknown.
+        type:
+          allOf:
+            - $ref: "#/components/schemas/v1.NodeConditionType"
+          description: Type of node condition.
+      type: object
+    v1.NodeConditionType:
+      enum:
+        - Ready
+        - MemoryPressure
+        - DiskPressure
+        - PIDPressure
+        - NetworkUnavailable
+      type: string
+      x-enum-varnames:
+        - NodeReady
+        - NodeMemoryPressure
+        - NodeDiskPressure
+        - NodePIDPressure
+        - NodeNetworkUnavailable
+    v1.NodeConfigSource:
+      properties:
+        configMap:
+          allOf:
+            - $ref: "#/components/schemas/v1.ConfigMapNodeConfigSource"
+          description: ConfigMap is a reference to a Node's ConfigMap
+      type: object
+    v1.NodeConfigStatus:
+      properties:
+        active:
+          allOf:
+            - $ref: "#/components/schemas/v1.NodeConfigSource"
+          description: >-
+            Active reports the checkpointed config the node is actively using.
+
+            Active will represent either the current version of the Assigned config,
+
+            or the current LastKnownGood config, depending on whether attempting to use the
+
+            Assigned config results in an error.
+
+            +optional
+        assigned:
+          allOf:
+            - $ref: "#/components/schemas/v1.NodeConfigSource"
+          description: >-
+            Assigned reports the checkpointed config the node will try to use.
+
+            When Node.Spec.ConfigSource is updated, the node checkpoints the associated
+
+            config payload to local disk, along with a record indicating intended
+
+            config. The node refers to this record to choose its config checkpoint, and
+
+            reports this record in Assigned. Assigned only updates in the status after
+
+            the record has been checkpointed to disk. When the Kubelet is restarted,
+
+            it tries to make the Assigned config the Active config by loading and
+
+            validating the checkpointed payload identified by Assigned.
+
+            +optional
+        error:
+          description: >-
+            Error describes any problems reconciling the Spec.ConfigSource to
+            the Active config.
+
+            Errors may occur, for example, attempting to checkpoint Spec.ConfigSource to the local Assigned
+
+            record, attempting to checkpoint the payload associated with Spec.ConfigSource, attempting
+
+            to load or validate the Assigned config, etc.
+
+            Errors may occur at different points while syncing config. Earlier errors (e.g. download or
+
+            checkpointing errors) will not result in a rollback to LastKnownGood, and may resolve across
+
+            Kubelet retries. Later errors (e.g. loading or validating a checkpointed config) will result in
+
+            a rollback to LastKnownGood. In the latter case, it is usually possible to resolve the error
+
+            by fixing the config assigned in Spec.ConfigSource.
+
+            You can find additional information for debugging by searching the error message in the Kubelet log.
+
+            Error is a human-readable description of the error state; machines can check whether or not Error
+
+            is empty, but should not rely on the stability of the Error text across Kubelet versions.
+
+            +optional
+          type: string
+        lastKnownGood:
+          allOf:
+            - $ref: "#/components/schemas/v1.NodeConfigSource"
+          description: >-
+            LastKnownGood reports the checkpointed config the node will fall
+            back to
+
+            when it encounters an error attempting to use the Assigned config.
+
+            The Assigned config becomes the LastKnownGood config when the node determines
+
+            that the Assigned config is stable and correct.
+
+            This is currently implemented as a 10-minute soak period starting when the local
+
+            record of Assigned config is updated. If the Assigned config is Active at the end
+
+            of this period, it becomes the LastKnownGood. Note that if Spec.ConfigSource is
+
+            reset to nil (use local defaults), the LastKnownGood is also immediately reset to nil,
+
+            because the local default config is always assumed good.
+
+            You should not make assumptions about the node's method of determining config stability
+
+            and correctness, as this may change or become configurable in the future.
+
+            +optional
+      type: object
+    v1.NodeDaemonEndpoints:
+      properties:
+        kubeletEndpoint:
+          allOf:
+            - $ref: "#/components/schemas/v1.DaemonEndpoint"
+          description: |-
+            Endpoint on which Kubelet is listening.
+            +optional
+      type: object
+    v1.NodeFeatures:
+      properties:
+        supplementalGroupsPolicy:
+          description: >-
+            SupplementalGroupsPolicy is set to true if the runtime supports
+            SupplementalGroupsPolicy and ContainerUser.
+
+            +optional
+          type: boolean
+      type: object
+    v1.NodePhase:
+      enum:
+        - Pending
+        - Running
+        - Terminated
+      type: string
+      x-enum-varnames:
+        - NodePending
+        - NodeRunning
+        - NodeTerminated
+    v1.NodeRuntimeHandler:
+      properties:
+        features:
+          allOf:
+            - $ref: "#/components/schemas/v1.NodeRuntimeHandlerFeatures"
+          description: |-
+            Supported features.
+            +optional
+        name:
+          description: |-
+            Runtime handler name.
+            Empty for the default runtime handler.
+            +optional
+          type: string
+      type: object
+    v1.NodeRuntimeHandlerFeatures:
+      properties:
+        recursiveReadOnlyMounts:
+          description: >-
+            RecursiveReadOnlyMounts is set to true if the runtime handler
+            supports RecursiveReadOnlyMounts.
+
+            +optional
+          type: boolean
+        userNamespaces:
+          description: >-
+            UserNamespaces is set to true if the runtime handler supports
+            UserNamespaces, including for volumes.
+
+            +featureGate=UserNamespacesSupport
+
+            +optional
+          type: boolean
+      type: object
+    v1.NodeSpec:
+      properties:
+        configSource:
+          allOf:
+            - $ref: "#/components/schemas/v1.NodeConfigSource"
+          description: >-
+            Deprecated: Previously used to specify the source of the node's
+            configuration for the DynamicKubeletConfig feature. This feature is
+            removed.
+
+            +optional
+        externalID:
+          description: >-
+            Deprecated. Not all kubelets will set this field. Remove field after
+            1.13.
+
+            see: https://issues.k8s.io/61966
+
+            +optional
+          type: string
+        podCIDR:
+          description: |-
+            PodCIDR represents the pod IP range assigned to the node.
+            +optional
+          type: string
+        podCIDRs:
+          description: >-
+            podCIDRs represents the IP ranges assigned to the node for usage by
+            Pods on that node. If this
+
+            field is specified, the 0th entry must match the podCIDR field. It may contain at most 1 value for
+
+            each of IPv4 and IPv6.
+
+            +optional
+
+            +patchStrategy=merge
+
+            +listType=set
+          items:
+            type: string
+          type: array
+        providerID:
+          description: >-
+            ID of the node assigned by the cloud provider in the format:
+            <ProviderName>://<ProviderSpecificNodeID>
+
+            +optional
+          type: string
+        taints:
+          description: |-
+            If specified, the node's taints.
+            +optional
+            +listType=atomic
+          items:
+            $ref: "#/components/schemas/v1.Taint"
+          type: array
+        unschedulable:
+          description: >-
+            Unschedulable controls node schedulability of new pods. By default,
+            node is schedulable.
+
+            More info: https://kubernetes.io/docs/concepts/nodes/node/#manual-node-administration
+
+            +optional
+          type: boolean
+      type: object
+    v1.NodeStatus:
+      properties:
+        addresses:
+          description: >-
+            List of addresses reachable to the node.
+
+            Queried from cloud provider, if available.
+
+            More info: https://kubernetes.io/docs/reference/node/node-status/#addresses
+
+            Note: This field is declared as mergeable, but the merge key is not sufficiently
+
+            unique, which can cause data corruption when it is merged. Callers should instead
+
+            use a full-replacement patch. See https://pr.k8s.io/79391 for an example.
+
+            Consumers should assume that addresses can change during the
+
+            lifetime of a Node. However, there are some exceptions where this may not
+
+            be possible, such as Pods that inherit a Node's address in its own status or
+
+            consumers of the downward API (status.hostIP).
+
+            +optional
+
+            +patchMergeKey=type
+
+            +patchStrategy=merge
+
+            +listType=map
+
+            +listMapKey=type
+          items:
+            $ref: "#/components/schemas/v1.NodeAddress"
+          type: array
+        allocatable:
+          allOf:
+            - $ref: "#/components/schemas/v1.ResourceList"
+          description: >-
+            Allocatable represents the resources of a node that are available
+            for scheduling.
+
+            Defaults to Capacity.
+
+            +optional
+        capacity:
+          allOf:
+            - $ref: "#/components/schemas/v1.ResourceList"
+          description: >-
+            Capacity represents the total resources of a node.
+
+            More info: https://kubernetes.io/docs/reference/node/node-status/#capacity
+
+            +optional
+        conditions:
+          description: >-
+            Conditions is an array of current observed node conditions.
+
+            More info: https://kubernetes.io/docs/reference/node/node-status/#condition
+
+            +optional
+
+            +patchMergeKey=type
+
+            +patchStrategy=merge
+
+            +listType=map
+
+            +listMapKey=type
+          items:
+            $ref: "#/components/schemas/v1.NodeCondition"
+          type: array
+        config:
+          allOf:
+            - $ref: "#/components/schemas/v1.NodeConfigStatus"
+          description: >-
+            Status of the config assigned to the node via the dynamic Kubelet
+            config feature.
+
+            +optional
+        daemonEndpoints:
+          allOf:
+            - $ref: "#/components/schemas/v1.NodeDaemonEndpoints"
+          description: |-
+            Endpoints of daemons running on the Node.
+            +optional
+        declaredFeatures:
+          description: >-
+            DeclaredFeatures represents the features related to feature gates
+            that are declared by the node.
+
+            +featureGate=NodeDeclaredFeatures
+
+            +optional
+
+            +listType=atomic
+          items:
+            type: string
+          type: array
+        features:
+          allOf:
+            - $ref: "#/components/schemas/v1.NodeFeatures"
+          description: >-
+            Features describes the set of features implemented by the CRI
+            implementation.
+
+            +featureGate=SupplementalGroupsPolicy
+
+            +optional
+        images:
+          description: |-
+            List of container images on this node
+            +optional
+            +listType=atomic
+          items:
+            $ref: "#/components/schemas/v1.ContainerImage"
+          type: array
+        nodeInfo:
+          allOf:
+            - $ref: "#/components/schemas/v1.NodeSystemInfo"
+          description: >-
+            Set of ids/uuids to uniquely identify the node.
+
+            More info: https://kubernetes.io/docs/reference/node/node-status/#info
+
+            +optional
+        phase:
+          allOf:
+            - $ref: "#/components/schemas/v1.NodePhase"
+          description: |-
+            NodePhase is the recently observed lifecycle phase of the node.
+            More info: https://kubernetes.io/docs/concepts/nodes/node/#phase
+            The field is never populated, and now is deprecated.
+            +optional
+        runtimeHandlers:
+          description: |-
+            The available runtime handlers.
+            +featureGate=UserNamespacesSupport
+            +optional
+            +listType=atomic
+          items:
+            $ref: "#/components/schemas/v1.NodeRuntimeHandler"
+          type: array
+        volumesAttached:
+          description: |-
+            List of volumes that are attached to the node.
+            +optional
+            +listType=atomic
+          items:
+            $ref: "#/components/schemas/v1.AttachedVolume"
+          type: array
+        volumesInUse:
+          description: |-
+            List of attachable volumes in use (mounted) by the node.
+            +optional
+            +listType=atomic
+          items:
+            type: string
+          type: array
+      type: object
+    v1.NodeSwapStatus:
+      properties:
+        capacity:
+          description: |-
+            Total amount of swap memory in bytes.
+            +optional
+          type: integer
+      type: object
+    v1.NodeSystemInfo:
+      properties:
+        architecture:
+          description: The Architecture reported by the node
+          type: string
+        bootID:
+          description: Boot ID reported by the node.
+          type: string
+        containerRuntimeVersion:
+          description: ContainerRuntime Version reported by the node through runtime
+            remote API (e.g. containerd://1.4.2).
+          type: string
+        kernelVersion:
+          description: Kernel Version reported by the node from 'uname -r' (e.g.
+            3.16.0-0.bpo.4-amd64).
+          type: string
+        kubeProxyVersion:
+          description: "Deprecated: KubeProxy Version reported by the node."
+          type: string
+        kubeletVersion:
+          description: Kubelet Version reported by the node.
+          type: string
+        machineID:
+          description: |-
+            MachineID reported by the node. For unique machine identification
+            in the cluster this field is preferred. Learn more from man(5)
+            machine-id: http://man7.org/linux/man-pages/man5/machine-id.5.html
+          type: string
+        operatingSystem:
+          description: The Operating System reported by the node
+          type: string
+        osImage:
+          description: OS Image reported by the node from /etc/os-release (e.g. Debian
+            GNU/Linux 7 (wheezy)).
+          type: string
+        swap:
+          allOf:
+            - $ref: "#/components/schemas/v1.NodeSwapStatus"
+          description: Swap Info reported by the node.
+        systemUUID:
+          description: >-
+            SystemUUID reported by the node. For unique machine identification
+
+            MachineID is preferred. This field is specific to Red Hat hosts
+
+            https://access.redhat.com/documentation/en-us/red_hat_subscription_management/1/html/rhsm/uuid
+          type: string
+      type: object
+    v1.ObjectFieldSelector:
+      properties:
+        apiVersion:
+          description: >-
+            Version of the schema the FieldPath is written in terms of, defaults
+            to "v1".
+
+            +optional
+          type: string
+        fieldPath:
+          description: Path of the field to select in the specified API version.
+          type: string
+      type: object
+    v1.ObjectMeta:
+      properties:
+        annotations:
+          additionalProperties:
+            type: string
+          description: >-
+            Annotations is an unstructured key value map stored with a resource
+            that may be
+
+            set by external tools to store and retrieve arbitrary metadata. They are not
+
+            queryable and should be preserved when modifying objects.
+
+            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
+
+            +optional
+          type: object
+        creationTimestamp:
+          description: >-
+            CreationTimestamp is a timestamp representing the server time when
+            this object was
+
+            created. It is not guaranteed to be set in happens-before order across separate operations.
+
+            Clients may not set this value. It is represented in RFC3339 form and is in UTC.
+
+
+            Populated by the system.
+
+            Read-only.
+
+            Null for lists.
+
+            More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+
+            +optional
+          type: string
+        deletionGracePeriodSeconds:
+          description: >-
+            Number of seconds allowed for this object to gracefully terminate
+            before
+
+            it will be removed from the system. Only set when deletionTimestamp is also set.
+
+            May only be shortened.
+
+            Read-only.
+
+            +optional
+          type: integer
+        deletionTimestamp:
+          description: >-
+            DeletionTimestamp is RFC 3339 date and time at which this resource
+            will be deleted. This
+
+            field is set by the server when a graceful deletion is requested by the user, and is not
+
+            directly settable by a client. The resource is expected to be deleted (no longer visible
+
+            from resource lists, and not reachable by name) after the time in this field, once the
+
+            finalizers list is empty. As long as the finalizers list contains items, deletion is blocked.
+
+            Once the deletionTimestamp is set, this value may not be unset or be set further into the
+
+            future, although it may be shortened or the resource may be deleted prior to this time.
+
+            For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react
+
+            by sending a graceful termination signal to the containers in the pod. After that 30 seconds,
+
+            the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup,
+
+            remove the pod from the API. In the presence of network partitions, this object may still
+
+            exist after this timestamp, until an administrator or automated process can determine the
+
+            resource is fully terminated.
+
+            If not set, graceful deletion of the object has not been requested.
+
+
+            Populated by the system when a graceful deletion is requested.
+
+            Read-only.
+
+            More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+
+            +optional
+          type: string
+        finalizers:
+          description: >-
+            Must be empty before the object is deleted from the registry. Each
+            entry
+
+            is an identifier for the responsible component that will remove the entry
+
+            from the list. If the deletionTimestamp of the object is non-nil, entries
+
+            in this list can only be removed.
+
+            Finalizers may be processed and removed in any order.  Order is NOT enforced
+
+            because it introduces significant risk of stuck finalizers.
+
+            finalizers is a shared field, any actor with permission can reorder it.
+
+            If the finalizer list is processed in order, then this can lead to a situation
+
+            in which the component responsible for the first finalizer in the list is
+
+            waiting for a signal (field value, external system, or other) produced by a
+
+            component responsible for a finalizer later in the list, resulting in a deadlock.
+
+            Without enforced ordering finalizers are free to order amongst themselves and
+
+            are not vulnerable to ordering changes in the list.
+
+            +optional
+
+            +patchStrategy=merge
+
+            +listType=set
+          items:
+            type: string
+          type: array
+        generateName:
+          description: >-
+            GenerateName is an optional prefix, used by the server, to generate
+            a unique
+
+            name ONLY IF the Name field has not been provided.
+
+            If this field is used, the name returned to the client will be different
+
+            than the name passed. This value will also be combined with a unique suffix.
+
+            The provided value has the same validation rules as the Name field,
+
+            and may be truncated by the length of the suffix required to make the value
+
+            unique on the server.
+
+
+            If this field is specified and the generated name exists, the server will return a 409.
+
+
+            Applied only if Name is not specified.
+
+            More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency
+
+            +optional
+          type: string
+        generation:
+          description: >-
+            A sequence number representing a specific generation of the desired
+            state.
+
+            Populated by the system. Read-only.
+
+            +optional
+          type: integer
+        labels:
+          additionalProperties:
+            type: string
+          description: >-
+            Map of string keys and values that can be used to organize and
+            categorize
+
+            (scope and select) objects. May match selectors of replication controllers
+
+            and services.
+
+            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
+
+            +optional
+          type: object
+        managedFields:
+          description: |-
+            ManagedFields maps workflow-id and version to the set of fields
+            that are managed by that workflow. This is mostly for internal
+            housekeeping, and users typically shouldn't need to set or
+            understand this field. A workflow can be the user's name, a
+            controller's name, or the name of a specific apply path like
+            "ci-cd". The set of fields is always in the version that the
+            workflow used when modifying the object.
+
+            +optional
+            +listType=atomic
+          items:
+            $ref: "#/components/schemas/v1.ManagedFieldsEntry"
+          type: array
+        name:
+          description: >-
+            Name must be unique within a namespace. Is required when creating
+            resources, although
+
+            some resources may allow a client to request the generation of an appropriate name
+
+            automatically. Name is primarily intended for creation idempotence and configuration
+
+            definition.
+
+            Cannot be updated.
+
+            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
+
+            +optional
+          type: string
+        namespace:
+          description: >-
+            Namespace defines the space within which each name must be unique.
+            An empty namespace is
+
+            equivalent to the "default" namespace, but "default" is the canonical representation.
+
+            Not all objects are required to be scoped to a namespace - the value of this field for
+
+            those objects will be empty.
+
+
+            Must be a DNS_LABEL.
+
+            Cannot be updated.
+
+            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces
+
+            +optional
+          type: string
+        ownerReferences:
+          description: >-
+            List of objects depended by this object. If ALL objects in the list
+            have
+
+            been deleted, this object will be garbage collected. If this object is managed by a controller,
+
+            then an entry in this list will point to this controller, with the controller field set to true.
+
+            There cannot be more than one managing controller.
+
+            +optional
+
+            +patchMergeKey=uid
+
+            +patchStrategy=merge
+
+            +listType=map
+
+            +listMapKey=uid
+          items:
+            $ref: "#/components/schemas/v1.OwnerReference"
+          type: array
+        resourceVersion:
+          description: >-
+            An opaque value that represents the internal version of this object
+            that can
+
+            be used by clients to determine when objects have changed. May be used for optimistic
+
+            concurrency, change detection, and the watch operation on a resource or set of resources.
+
+            Clients must treat these values as opaque and passed unmodified back to the server.
+
+            They may only be valid for a particular resource or set of resources.
+
+
+            Populated by the system.
+
+            Read-only.
+
+            Value must be treated as opaque by clients and .
+
+            More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
+
+            +optional
+          type: string
+        selfLink:
+          description: >-
+            Deprecated: selfLink is a legacy read-only field that is no longer
+            populated by the system.
+
+            +optional
+          type: string
+        uid:
+          description: >-
+            UID is the unique in time and space value for this object. It is
+            typically generated by
+
+            the server on successful creation of a resource and is not allowed to change on PUT
+
+            operations.
+
+
+            Populated by the system.
+
+            Read-only.
+
+            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids
+
+            +optional
+          type: string
+      type: object
+    v1.OwnerReference:
+      properties:
+        apiVersion:
+          description: API version of the referent.
+          type: string
+        blockOwnerDeletion:
+          description: >-
+            If true, AND if the owner has the "foregroundDeletion" finalizer,
+            then
+
+            the owner cannot be deleted from the key-value store until this
+
+            reference is removed.
+
+            See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion
+
+            for how the garbage collector interacts with this field and enforces the foreground deletion.
+
+            Defaults to false.
+
+            To set this field, a user needs "delete" permission of the owner,
+
+            otherwise 422 (Unprocessable Entity) will be returned.
+
+            +optional
+          type: boolean
+        controller:
+          description: |-
+            If true, this reference points to the managing controller.
+            +optional
+          type: boolean
+        kind:
+          description: >-
+            Kind of the referent.
+
+            More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+          type: string
+        name:
+          description: >-
+            Name of the referent.
+
+            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
+          type: string
+        uid:
+          description: >-
+            UID of the referent.
+
+            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids
+          type: string
+      type: object
+    v1.PersistentVolumeAccessMode:
+      enum:
+        - ReadWriteOnce
+        - ReadOnlyMany
+        - ReadWriteMany
+        - ReadWriteOncePod
+      type: string
+      x-enum-varnames:
+        - ReadWriteOnce
+        - ReadOnlyMany
+        - ReadWriteMany
+        - ReadWriteOncePod
+    v1.PersistentVolumeClaimPhase:
+      enum:
+        - Pending
+        - Bound
+        - Lost
+      type: string
+      x-enum-varnames:
+        - ClaimPending
+        - ClaimBound
+        - ClaimLost
+    v1.PersistentVolumeMode:
+      enum:
+        - Block
+        - Filesystem
+      type: string
+      x-enum-varnames:
+        - PersistentVolumeBlock
+        - PersistentVolumeFilesystem
+    v1.PersistentVolumePhase:
+      enum:
+        - Pending
+        - Available
+        - Bound
+        - Released
+        - Failed
+      type: string
+      x-enum-varnames:
+        - VolumePending
+        - VolumeAvailable
+        - VolumeBound
+        - VolumeReleased
+        - VolumeFailed
+    v1.PersistentVolumeReclaimPolicy:
+      enum:
+        - Recycle
+        - Delete
+        - Retain
+      type: string
+      x-enum-varnames:
+        - PersistentVolumeReclaimRecycle
+        - PersistentVolumeReclaimDelete
+        - PersistentVolumeReclaimRetain
+    v1.Probe:
+      properties:
+        exec:
+          allOf:
+            - $ref: "#/components/schemas/v1.ExecAction"
+          description: |-
+            Exec specifies a command to execute in the container.
+            +optional
+        failureThreshold:
+          description: >-
+            Minimum consecutive failures for the probe to be considered failed
+            after having succeeded.
+
+            Defaults to 3. Minimum value is 1.
+
+            +optional
+          type: integer
+        grpc:
+          allOf:
+            - $ref: "#/components/schemas/v1.GRPCAction"
+          description: |-
+            GRPC specifies a GRPC HealthCheckRequest.
+            +optional
+        httpGet:
+          allOf:
+            - $ref: "#/components/schemas/v1.HTTPGetAction"
+          description: |-
+            HTTPGet specifies an HTTP GET request to perform.
+            +optional
+        initialDelaySeconds:
+          description: >-
+            Number of seconds after the container has started before liveness
+            probes are initiated.
+
+            More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+
+            +optional
+          type: integer
+        periodSeconds:
+          description: |-
+            How often (in seconds) to perform the probe.
+            Default to 10 seconds. Minimum value is 1.
+            +optional
+          type: integer
+        successThreshold:
+          description: >-
+            Minimum consecutive successes for the probe to be considered
+            successful after having failed.
+
+            Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
+
+            +optional
+          type: integer
+        tcpSocket:
+          allOf:
+            - $ref: "#/components/schemas/v1.TCPSocketAction"
+          description: |-
+            TCPSocket specifies a connection to a TCP port.
+            +optional
+        terminationGracePeriodSeconds:
+          description: >-
+            Optional duration in seconds the pod needs to terminate gracefully
+            upon probe failure.
+
+            The grace period is the duration in seconds after the processes running in the pod are sent
+
+            a termination signal and the time when the processes are forcibly halted with a kill signal.
+
+            Set this value longer than the expected cleanup time for your process.
+
+            If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this
+
+            value overrides the value provided by the pod spec.
+
+            Value must be non-negative integer. The value zero indicates stop immediately via
+
+            the kill signal (no opportunity to shut down).
+
+            This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.
+
+            Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset.
+
+            +optional
+          type: integer
+        timeoutSeconds:
+          description: >-
+            Number of seconds after which the probe times out.
+
+            Defaults to 1 second. Minimum value is 1.
+
+            More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+
+            +optional
+          type: integer
+      type: object
+    v1.ProcMountType:
+      enum:
+        - Default
+        - Unmasked
+      type: string
+      x-enum-varnames:
+        - DefaultProcMount
+        - UnmaskedProcMount
+    v1.Protocol:
+      enum:
+        - TCP
+        - UDP
+        - SCTP
+      type: string
+      x-enum-varnames:
+        - ProtocolTCP
+        - ProtocolUDP
+        - ProtocolSCTP
+    v1.PullPolicy:
+      enum:
+        - Always
+        - Never
+        - IfNotPresent
+      type: string
+      x-enum-varnames:
+        - PullAlways
+        - PullNever
+        - PullIfNotPresent
+    v1.RecursiveReadOnlyMode:
+      enum:
+        - Disabled
+        - IfPossible
+        - Enabled
+      type: string
+      x-enum-varnames:
+        - RecursiveReadOnlyDisabled
+        - RecursiveReadOnlyIfPossible
+        - RecursiveReadOnlyEnabled
+    v1.ResourceFieldSelector:
+      properties:
+        containerName:
+          description: |-
+            Container name: required for volumes, optional for env vars
+            +optional
+          type: string
+        divisor:
+          allOf:
+            - $ref: "#/components/schemas/resource.Quantity"
+          description: >-
+            Specifies the output format of the exposed resources, defaults to
+            "1"
+
+            +optional
+        resource:
+          description: "Required: resource to select"
+          type: string
+      type: object
+    v1.ResourceList:
+      additionalProperties:
+        $ref: "#/components/schemas/resource.Quantity"
+      type: object
+    v1.ResourceName:
+      enum:
+        - cpu
+        - memory
+        - storage
+        - ephemeral-storage
+        - pods
+        - services
+        - replicationcontrollers
+        - resourcequotas
+        - secrets
+        - configmaps
+        - persistentvolumeclaims
+        - services.nodeports
+        - services.loadbalancers
+        - requests.cpu
+        - requests.memory
+        - requests.storage
+        - requests.ephemeral-storage
+        - limits.cpu
+        - limits.memory
+        - limits.ephemeral-storage
+      type: string
+      x-enum-varnames:
+        - ResourceCPU
+        - ResourceMemory
+        - ResourceStorage
+        - ResourceEphemeralStorage
+        - ResourcePods
+        - ResourceServices
+        - ResourceReplicationControllers
+        - ResourceQuotas
+        - ResourceSecrets
+        - ResourceConfigMaps
+        - ResourcePersistentVolumeClaims
+        - ResourceServicesNodePorts
+        - ResourceServicesLoadBalancers
+        - ResourceRequestsCPU
+        - ResourceRequestsMemory
+        - ResourceRequestsStorage
+        - ResourceRequestsEphemeralStorage
+        - ResourceLimitsCPU
+        - ResourceLimitsMemory
+        - ResourceLimitsEphemeralStorage
+    v1.ResourceQuota:
+      properties:
+        apiVersion:
+          description: >-
+            APIVersion defines the versioned schema of this representation of an
+            object.
+
+            Servers should convert recognized schemas to the latest internal value, and
+
+            may reject unrecognized values.
+
+            More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+
+            +optional
+          type: string
+        kind:
+          description: >-
+            Kind is a string value representing the REST resource this object
+            represents.
+
+            Servers may infer this from the endpoint the client submits requests to.
+
+            Cannot be updated.
+
+            In CamelCase.
+
+            More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+
+            +optional
+          type: string
+        metadata:
+          allOf:
+            - $ref: "#/components/schemas/v1.ObjectMeta"
+          description: >-
+            Standard object's metadata.
+
+            More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+
+            +optional
+        spec:
+          allOf:
+            - $ref: "#/components/schemas/v1.ResourceQuotaSpec"
+          description: >-
+            Spec defines the desired quota.
+
+            https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+
+            +optional
+        status:
+          allOf:
+            - $ref: "#/components/schemas/v1.ResourceQuotaStatus"
+          description: >-
+            Status defines the actual enforced quota and its current usage.
+
+            https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+
+            +optional
+      type: object
+    v1.ResourceQuotaScope:
+      enum:
+        - Terminating
+        - NotTerminating
+        - BestEffort
+        - NotBestEffort
+        - PriorityClass
+        - CrossNamespacePodAffinity
+        - VolumeAttributesClass
+      type: string
+      x-enum-varnames:
+        - ResourceQuotaScopeTerminating
+        - ResourceQuotaScopeNotTerminating
+        - ResourceQuotaScopeBestEffort
+        - ResourceQuotaScopeNotBestEffort
+        - ResourceQuotaScopePriorityClass
+        - ResourceQuotaScopeCrossNamespacePodAffinity
+        - ResourceQuotaScopeVolumeAttributesClass
+    v1.ResourceQuotaSpec:
+      properties:
+        hard:
+          allOf:
+            - $ref: "#/components/schemas/v1.ResourceList"
+          description: >-
+            hard is the set of desired hard limits for each named resource.
+
+            More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/
+
+            +optional
+        scopeSelector:
+          allOf:
+            - $ref: "#/components/schemas/v1.ScopeSelector"
+          description: >-
+            scopeSelector is also a collection of filters like scopes that must
+            match each object tracked by a quota
+
+            but expressed using ScopeSelectorOperator in combination with possible values.
+
+            For a resource to match, both scopes AND scopeSelector (if specified in spec), must be matched.
+
+            +optional
+        scopes:
+          description: >-
+            A collection of filters that must match each object tracked by a
+            quota.
+
+            If not specified, the quota matches all objects.
+
+            +optional
+
+            +listType=atomic
+          items:
+            $ref: "#/components/schemas/v1.ResourceQuotaScope"
+          type: array
+      type: object
+    v1.ResourceQuotaStatus:
+      properties:
+        hard:
+          allOf:
+            - $ref: "#/components/schemas/v1.ResourceList"
+          description: >-
+            Hard is the set of enforced hard limits for each named resource.
+
+            More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/
+
+            +optional
+        used:
+          allOf:
+            - $ref: "#/components/schemas/v1.ResourceList"
+          description: >-
+            Used is the current observed total usage of the resource in the
+            namespace.
+
+            +optional
+      type: object
+    v1.ResourceRequirements:
+      properties:
+        claims:
+          description: |-
+            Claims lists the names of resources, defined in spec.resourceClaims,
+            that are used by this container.
+
+            This field depends on the
+            DynamicResourceAllocation feature gate.
+
+            This field is immutable. It can only be set for containers.
+
+            +listType=map
+            +listMapKey=name
+            +featureGate=DynamicResourceAllocation
+            +optional
+          items:
+            $ref: "#/components/schemas/k8s_io_api_core_v1.ResourceClaim"
+          type: array
+        limits:
+          allOf:
+            - $ref: "#/components/schemas/v1.ResourceList"
+          description: >-
+            Limits describes the maximum amount of compute resources allowed.
+
+            More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+
+            +optional
+        requests:
+          allOf:
+            - $ref: "#/components/schemas/v1.ResourceList"
+          description: >-
+            Requests describes the minimum amount of compute resources required.
+
+            If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+
+            otherwise to an implementation-defined value. Requests cannot exceed Limits.
+
+            More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+
+            +optional
+      type: object
+    v1.ResourceResizeRestartPolicy:
+      enum:
+        - NotRequired
+        - RestartContainer
+      type: string
+      x-enum-varnames:
+        - NotRequired
+        - RestartContainer
+    v1.RoleRef:
+      properties:
+        apiGroup:
+          description: APIGroup is the group for the resource being referenced
+          type: string
+        kind:
+          description: Kind is the type of resource being referenced
+          type: string
+        name:
+          description: |-
+            Name is the name of resource being referenced
+            +required
+            +k8s:required
+          type: string
+      type: object
+    v1.SELinuxOptions:
+      properties:
+        level:
+          description: |-
+            Level is SELinux level label that applies to the container.
+            +optional
+          type: string
+        role:
+          description: |-
+            Role is a SELinux role label that applies to the container.
+            +optional
+          type: string
+        type:
+          description: |-
+            Type is a SELinux type label that applies to the container.
+            +optional
+          type: string
+        user:
+          description: |-
+            User is a SELinux user label that applies to the container.
+            +optional
+          type: string
+      type: object
+    v1.ScopeSelector:
+      properties:
+        matchExpressions:
+          description: |-
+            A list of scope selector requirements by scope of the resources.
+            +optional
+            +listType=atomic
+          items:
+            $ref: "#/components/schemas/v1.ScopedResourceSelectorRequirement"
+          type: array
+      type: object
+    v1.ScopeSelectorOperator:
+      enum:
+        - In
+        - NotIn
+        - Exists
+        - DoesNotExist
+      type: string
+      x-enum-varnames:
+        - ScopeSelectorOpIn
+        - ScopeSelectorOpNotIn
+        - ScopeSelectorOpExists
+        - ScopeSelectorOpDoesNotExist
+    v1.ScopedResourceSelectorRequirement:
+      properties:
+        operator:
+          allOf:
+            - $ref: "#/components/schemas/v1.ScopeSelectorOperator"
+          description: |-
+            Represents a scope's relationship to a set of values.
+            Valid operators are In, NotIn, Exists, DoesNotExist.
+        scopeName:
+          allOf:
+            - $ref: "#/components/schemas/v1.ResourceQuotaScope"
+          description: The name of the scope that the selector applies to.
+        values:
+          description: >-
+            An array of string values. If the operator is In or NotIn,
+
+            the values array must be non-empty. If the operator is Exists or DoesNotExist,
+
+            the values array must be empty.
+
+            This array is replaced during a strategic merge patch.
+
+            +optional
+
+            +listType=atomic
+          items:
+            type: string
+          type: array
+      type: object
+    v1.SeccompProfile:
+      properties:
+        localhostProfile:
+          description: >-
+            localhostProfile indicates a profile defined in a file on the node
+            should be used.
+
+            The profile must be preconfigured on the node to work.
+
+            Must be a descending path, relative to the kubelet's configured seccomp profile location.
+
+            Must be set if type is "Localhost". Must NOT be set for any other type.
+
+            +optional
+          type: string
+        type:
+          allOf:
+            - $ref: "#/components/schemas/v1.SeccompProfileType"
+          description: >-
+            type indicates which kind of seccomp profile will be applied.
+
+            Valid options are:
+
+
+            Localhost - a profile defined in a file on the node should be used.
+
+            RuntimeDefault - the container runtime default profile should be used.
+
+            Unconfined - no profile should be applied.
+
+            +unionDiscriminator
+      type: object
+    v1.SeccompProfileType:
+      enum:
+        - Unconfined
+        - RuntimeDefault
+        - Localhost
+      type: string
+      x-enum-varnames:
+        - SeccompProfileTypeUnconfined
+        - SeccompProfileTypeRuntimeDefault
+        - SeccompProfileTypeLocalhost
+    v1.SecretEnvSource:
+      properties:
+        name:
+          description: >-
+            Name of the referent.
+
+            This field is effectively required, but due to backwards compatibility is
+
+            allowed to be empty. Instances of this type with an empty value here are
+
+            almost certainly wrong.
+
+            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+
+            +optional
+
+            +default=""
+
+            +kubebuilder:default=""
+
+            TODO: Drop `kubebuilder:default` when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.
+          type: string
+        optional:
+          description: |-
+            Specify whether the Secret must be defined
+            +optional
+          type: boolean
+      type: object
+    v1.SecretKeySelector:
+      properties:
+        key:
+          description: The key of the secret to select from.  Must be a valid secret key.
+          type: string
+        name:
+          description: >-
+            Name of the referent.
+
+            This field is effectively required, but due to backwards compatibility is
+
+            allowed to be empty. Instances of this type with an empty value here are
+
+            almost certainly wrong.
+
+            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+
+            +optional
+
+            +default=""
+
+            +kubebuilder:default=""
+
+            TODO: Drop `kubebuilder:default` when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.
+          type: string
+        optional:
+          description: |-
+            Specify whether the Secret or its key must be defined
+            +optional
+          type: boolean
+      type: object
+    v1.SecretReference:
+      properties:
+        name:
+          description: |-
+            name is unique within a namespace to reference a secret resource.
+            +optional
+          type: string
+        namespace:
+          description: >-
+            namespace defines the space within which the secret name must be
+            unique.
+
+            +optional
+          type: string
+      type: object
+    v1.SecurityContext:
+      properties:
+        allowPrivilegeEscalation:
+          description: |-
+            AllowPrivilegeEscalation controls whether a process can gain more
+            privileges than its parent process. This bool directly controls if
+            the no_new_privs flag will be set on the container process.
+            AllowPrivilegeEscalation is true always when the container is:
+            1) run as Privileged
+            2) has CAP_SYS_ADMIN
+            Note that this field cannot be set when spec.os.name is windows.
+            +optional
+          type: boolean
+        appArmorProfile:
+          allOf:
+            - $ref: "#/components/schemas/v1.AppArmorProfile"
+          description: >-
+            appArmorProfile is the AppArmor options to use by this container. If
+            set, this profile
+
+            overrides the pod's appArmorProfile.
+
+            Note that this field cannot be set when spec.os.name is windows.
+
+            +optional
+        capabilities:
+          allOf:
+            - $ref: "#/components/schemas/v1.Capabilities"
+          description: >-
+            The capabilities to add/drop when running containers.
+
+            Defaults to the default set of capabilities granted by the container runtime.
+
+            Note that this field cannot be set when spec.os.name is windows.
+
+            +optional
+        privileged:
+          description: >-
+            Run container in privileged mode.
+
+            Processes in privileged containers are essentially equivalent to root on the host.
+
+            Defaults to false.
+
+            Note that this field cannot be set when spec.os.name is windows.
+
+            +optional
+          type: boolean
+        procMount:
+          allOf:
+            - $ref: "#/components/schemas/v1.ProcMountType"
+          description: >-
+            procMount denotes the type of proc mount to use for the containers.
+
+            The default value is Default which uses the container runtime defaults for
+
+            readonly paths and masked paths.
+
+            This requires the ProcMountType feature flag to be enabled.
+
+            Note that this field cannot be set when spec.os.name is windows.
+
+            +optional
+        readOnlyRootFilesystem:
+          description: |-
+            Whether this container has a read-only root filesystem.
+            Default is false.
+            Note that this field cannot be set when spec.os.name is windows.
+            +optional
+          type: boolean
+        runAsGroup:
+          description: >-
+            The GID to run the entrypoint of the container process.
+
+            Uses runtime default if unset.
+
+            May also be set in PodSecurityContext.  If set in both SecurityContext and
+
+            PodSecurityContext, the value specified in SecurityContext takes precedence.
+
+            Note that this field cannot be set when spec.os.name is windows.
+
+            +optional
+          type: integer
+        runAsNonRoot:
+          description: >-
+            Indicates that the container must run as a non-root user.
+
+            If true, the Kubelet will validate the image at runtime to ensure that it
+
+            does not run as UID 0 (root) and fail to start the container if it does.
+
+            If unset or false, no such validation will be performed.
+
+            May also be set in PodSecurityContext.  If set in both SecurityContext and
+
+            PodSecurityContext, the value specified in SecurityContext takes precedence.
+
+            +optional
+          type: boolean
+        runAsUser:
+          description: >-
+            The UID to run the entrypoint of the container process.
+
+            Defaults to user specified in image metadata if unspecified.
+
+            May also be set in PodSecurityContext.  If set in both SecurityContext and
+
+            PodSecurityContext, the value specified in SecurityContext takes precedence.
+
+            Note that this field cannot be set when spec.os.name is windows.
+
+            +optional
+          type: integer
+        seLinuxOptions:
+          allOf:
+            - $ref: "#/components/schemas/v1.SELinuxOptions"
+          description: >-
+            The SELinux context to be applied to the container.
+
+            If unspecified, the container runtime will allocate a random SELinux context for each
+
+            container.  May also be set in PodSecurityContext.  If set in both SecurityContext and
+
+            PodSecurityContext, the value specified in SecurityContext takes precedence.
+
+            Note that this field cannot be set when spec.os.name is windows.
+
+            +optional
+        seccompProfile:
+          allOf:
+            - $ref: "#/components/schemas/v1.SeccompProfile"
+          description: |-
+            The seccomp options to use by this container. If seccomp options are
+            provided at both the pod & container level, the container options
+            override the pod options.
+            Note that this field cannot be set when spec.os.name is windows.
+            +optional
+        windowsOptions:
+          allOf:
+            - $ref: "#/components/schemas/v1.WindowsSecurityContextOptions"
+          description: >-
+            The Windows specific settings applied to all containers.
+
+            If unspecified, the options from the PodSecurityContext will be used.
+
+            If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
+
+            Note that this field cannot be set when spec.os.name is linux.
+
+            +optional
+      type: object
+    v1.Signal:
+      enum:
+        - SIGABRT
+        - SIGALRM
+        - SIGBUS
+        - SIGCHLD
+        - SIGCLD
+        - SIGCONT
+        - SIGFPE
+        - SIGHUP
+        - SIGILL
+        - SIGINT
+        - SIGIO
+        - SIGIOT
+        - SIGKILL
+        - SIGPIPE
+        - SIGPOLL
+        - SIGPROF
+        - SIGPWR
+        - SIGQUIT
+        - SIGSEGV
+        - SIGSTKFLT
+        - SIGSTOP
+        - SIGSYS
+        - SIGTERM
+        - SIGTRAP
+        - SIGTSTP
+        - SIGTTIN
+        - SIGTTOU
+        - SIGURG
+        - SIGUSR1
+        - SIGUSR2
+        - SIGVTALRM
+        - SIGWINCH
+        - SIGXCPU
+        - SIGXFSZ
+        - SIGRTMIN
+        - SIGRTMIN+1
+        - SIGRTMIN+2
+        - SIGRTMIN+3
+        - SIGRTMIN+4
+        - SIGRTMIN+5
+        - SIGRTMIN+6
+        - SIGRTMIN+7
+        - SIGRTMIN+8
+        - SIGRTMIN+9
+        - SIGRTMIN+10
+        - SIGRTMIN+11
+        - SIGRTMIN+12
+        - SIGRTMIN+13
+        - SIGRTMIN+14
+        - SIGRTMIN+15
+        - SIGRTMAX-14
+        - SIGRTMAX-13
+        - SIGRTMAX-12
+        - SIGRTMAX-11
+        - SIGRTMAX-10
+        - SIGRTMAX-9
+        - SIGRTMAX-8
+        - SIGRTMAX-7
+        - SIGRTMAX-6
+        - SIGRTMAX-5
+        - SIGRTMAX-4
+        - SIGRTMAX-3
+        - SIGRTMAX-2
+        - SIGRTMAX-1
+        - SIGRTMAX
+      type: string
+      x-enum-varnames:
+        - SIGABRT
+        - SIGALRM
+        - SIGBUS
+        - SIGCHLD
+        - SIGCLD
+        - SIGCONT
+        - SIGFPE
+        - SIGHUP
+        - SIGILL
+        - SIGINT
+        - SIGIO
+        - SIGIOT
+        - SIGKILL
+        - SIGPIPE
+        - SIGPOLL
+        - SIGPROF
+        - SIGPWR
+        - SIGQUIT
+        - SIGSEGV
+        - SIGSTKFLT
+        - SIGSTOP
+        - SIGSYS
+        - SIGTERM
+        - SIGTRAP
+        - SIGTSTP
+        - SIGTTIN
+        - SIGTTOU
+        - SIGURG
+        - SIGUSR1
+        - SIGUSR2
+        - SIGVTALRM
+        - SIGWINCH
+        - SIGXCPU
+        - SIGXFSZ
+        - SIGRTMIN
+        - SIGRTMINPLUS1
+        - SIGRTMINPLUS2
+        - SIGRTMINPLUS3
+        - SIGRTMINPLUS4
+        - SIGRTMINPLUS5
+        - SIGRTMINPLUS6
+        - SIGRTMINPLUS7
+        - SIGRTMINPLUS8
+        - SIGRTMINPLUS9
+        - SIGRTMINPLUS10
+        - SIGRTMINPLUS11
+        - SIGRTMINPLUS12
+        - SIGRTMINPLUS13
+        - SIGRTMINPLUS14
+        - SIGRTMINPLUS15
+        - SIGRTMAXMINUS14
+        - SIGRTMAXMINUS13
+        - SIGRTMAXMINUS12
+        - SIGRTMAXMINUS11
+        - SIGRTMAXMINUS10
+        - SIGRTMAXMINUS9
+        - SIGRTMAXMINUS8
+        - SIGRTMAXMINUS7
+        - SIGRTMAXMINUS6
+        - SIGRTMAXMINUS5
+        - SIGRTMAXMINUS4
+        - SIGRTMAXMINUS3
+        - SIGRTMAXMINUS2
+        - SIGRTMAXMINUS1
+        - SIGRTMAX
+    v1.SleepAction:
+      properties:
+        seconds:
+          description: Seconds is the number of seconds to sleep.
+          type: integer
+      type: object
+    v1.TCPSocketAction:
+      properties:
+        host:
+          description: |-
+            Optional: Host name to connect to, defaults to the pod IP.
+            +optional
+          type: string
+        port:
+          allOf:
+            - $ref: "#/components/schemas/intstr.IntOrString"
+          description: |-
+            Number or name of the port to access on the container.
+            Number must be in the range 1 to 65535.
+            Name must be an IANA_SVC_NAME.
+      type: object
+    v1.Taint:
+      properties:
+        effect:
+          allOf:
+            - $ref: "#/components/schemas/v1.TaintEffect"
+          description: |-
+            Required. The effect of the taint on pods
+            that do not tolerate the taint.
+            Valid effects are NoSchedule, PreferNoSchedule and NoExecute.
+        key:
+          description: Required. The taint key to be applied to a node.
+          type: string
+        timeAdded:
+          description: |-
+            TimeAdded represents the time at which the taint was added.
+            +optional
+          type: string
+        value:
+          description: |-
+            The taint value corresponding to the taint key.
+            +optional
+          type: string
+      type: object
+    v1.TaintEffect:
+      enum:
+        - NoSchedule
+        - PreferNoSchedule
+        - NoExecute
+      type: string
+      x-enum-varnames:
+        - TaintEffectNoSchedule
+        - TaintEffectPreferNoSchedule
+        - TaintEffectNoExecute
+    v1.TerminationMessagePolicy:
+      enum:
+        - File
+        - FallbackToLogsOnError
+      type: string
+      x-enum-varnames:
+        - TerminationMessageReadFile
+        - TerminationMessageFallbackToLogsOnError
+    v1.URIScheme:
+      enum:
+        - HTTP
+        - HTTPS
+      type: string
+      x-enum-varnames:
+        - URISchemeHTTP
+        - URISchemeHTTPS
+    v1.VolumeDevice:
+      properties:
+        devicePath:
+          description: devicePath is the path inside of the container that the device will
+            be mapped to.
+          type: string
+        name:
+          description: name must match the name of a persistentVolumeClaim in the pod
+          type: string
+      type: object
+    v1.VolumeMount:
+      properties:
+        mountPath:
+          description: >-
+            Path within the container at which the volume should be
+            mounted.  Must
+
+            not contain ':'.
+          type: string
+        mountPropagation:
+          allOf:
+            - $ref: "#/components/schemas/v1.MountPropagationMode"
+          description: >-
+            mountPropagation determines how mounts are propagated from the host
+
+            to container and the other way around.
+
+            When not set, MountPropagationNone is used.
+
+            This field is beta in 1.10.
+
+            When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified
+
+            (which defaults to None).
+
+            +optional
+        name:
+          description: This must match the Name of a Volume.
+          type: string
+        readOnly:
+          description: >-
+            Mounted read-only if true, read-write otherwise (false or
+            unspecified).
+
+            Defaults to false.
+
+            +optional
+          type: boolean
+        recursiveReadOnly:
+          allOf:
+            - $ref: "#/components/schemas/v1.RecursiveReadOnlyMode"
+          description: >-
+            RecursiveReadOnly specifies whether read-only mounts should be
+            handled
+
+            recursively.
+
+
+            If ReadOnly is false, this field has no meaning and must be unspecified.
+
+
+            If ReadOnly is true, and this field is set to Disabled, the mount is not made
+
+            recursively read-only.  If this field is set to IfPossible, the mount is made
+
+            recursively read-only, if it is supported by the container runtime.  If this
+
+            field is set to Enabled, the mount is made recursively read-only if it is
+
+            supported by the container runtime, otherwise the pod will not be started and
+
+            an error will be generated to indicate the reason.
+
+
+            If this field is set to IfPossible or Enabled, MountPropagation must be set to
+
+            None (or be unspecified, which defaults to None).
+
+
+            If this field is not specified, it is treated as an equivalent of Disabled.
+
+            +optional
+        subPath:
+          description: >-
+            Path within the volume from which the container's volume should be
+            mounted.
+
+            Defaults to "" (volume's root).
+
+            +optional
+          type: string
+        subPathExpr:
+          description: >-
+            Expanded path within the volume from which the container's volume
+            should be mounted.
+
+            Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.
+
+            Defaults to "" (volume's root).
+
+            SubPathExpr and SubPath are mutually exclusive.
+
+            +optional
+          type: string
+      type: object
+    v1.WindowsSecurityContextOptions:
+      properties:
+        gmsaCredentialSpec:
+          description: >-
+            GMSACredentialSpec is where the GMSA admission webhook
+
+            (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the
+
+            GMSA credential spec named by the GMSACredentialSpecName field.
+
+            +optional
+          type: string
+        gmsaCredentialSpecName:
+          description: >-
+            GMSACredentialSpecName is the name of the GMSA credential spec to
+            use.
+
+            +optional
+          type: string
+        hostProcess:
+          description: >-
+            HostProcess determines if a container should be run as a 'Host
+            Process' container.
+
+            All of a Pod's containers must have the same effective HostProcess value
+
+            (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).
+
+            In addition, if HostProcess is true then HostNetwork must also be set to true.
+
+            +optional
+          type: boolean
+        runAsUserName:
+          description: >-
+            The UserName in Windows to run the entrypoint of the container
+            process.
+
+            Defaults to the user specified in image metadata if unspecified.
+
+            May also be set in PodSecurityContext. If set in both SecurityContext and
+
+            PodSecurityContext, the value specified in SecurityContext takes precedence.
+
+            +optional
+          type: string
+      type: object
+    v1beta1.ContainerMetrics:
+      properties:
+        name:
+          description: Container name corresponding to the one from pod.spec.containers.
+          type: string
+        usage:
+          allOf:
+            - $ref: "#/components/schemas/v1.ResourceList"
+          description: The memory usage is the memory working set.
+      type: object
+    v1beta1.NodeMetrics:
+      properties:
+        apiVersion:
+          description: >-
+            APIVersion defines the versioned schema of this representation of an
+            object.
+
+            Servers should convert recognized schemas to the latest internal value, and
+
+            may reject unrecognized values.
+
+            More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+
+            +optional
+          type: string
+        kind:
+          description: >-
+            Kind is a string value representing the REST resource this object
+            represents.
+
+            Servers may infer this from the endpoint the client submits requests to.
+
+            Cannot be updated.
+
+            In CamelCase.
+
+            More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+
+            +optional
+          type: string
+        metadata:
+          allOf:
+            - $ref: "#/components/schemas/v1.ObjectMeta"
+          description: >-
+            Standard object's metadata.
+
+            More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+
+            +optional
+        timestamp:
+          description: |-
+            The following fields define time interval from which metrics were
+            collected from the interval [Timestamp-Window, Timestamp].
+          type: string
+        usage:
+          allOf:
+            - $ref: "#/components/schemas/v1.ResourceList"
+          description: The memory usage is the memory working set.
+        window:
+          type: string
+      type: object
+    v1beta1.NodeMetricsList:
+      properties:
+        apiVersion:
+          description: >-
+            APIVersion defines the versioned schema of this representation of an
+            object.
+
+            Servers should convert recognized schemas to the latest internal value, and
+
+            may reject unrecognized values.
+
+            More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+
+            +optional
+          type: string
+        items:
+          description: List of node metrics.
+          items:
+            $ref: "#/components/schemas/v1beta1.NodeMetrics"
+          type: array
+        kind:
+          description: >-
+            Kind is a string value representing the REST resource this object
+            represents.
+
+            Servers may infer this from the endpoint the client submits requests to.
+
+            Cannot be updated.
+
+            In CamelCase.
+
+            More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+
+            +optional
+          type: string
+        metadata:
+          allOf:
+            - $ref: "#/components/schemas/v1.ListMeta"
+          description: >-
+            Standard list metadata.
+
+            More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+      type: object
+    v1beta1.PodMetrics:
+      properties:
+        apiVersion:
+          description: >-
+            APIVersion defines the versioned schema of this representation of an
+            object.
+
+            Servers should convert recognized schemas to the latest internal value, and
+
+            may reject unrecognized values.
+
+            More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+
+            +optional
+          type: string
+        containers:
+          description: >-
+            Metrics for all containers are collected within the same time
+            window.
+
+            +listType=atomic
+          items:
+            $ref: "#/components/schemas/v1beta1.ContainerMetrics"
+          type: array
+        kind:
+          description: >-
+            Kind is a string value representing the REST resource this object
+            represents.
+
+            Servers may infer this from the endpoint the client submits requests to.
+
+            Cannot be updated.
+
+            In CamelCase.
+
+            More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+
+            +optional
+          type: string
+        metadata:
+          allOf:
+            - $ref: "#/components/schemas/v1.ObjectMeta"
+          description: >-
+            Standard object's metadata.
+
+            More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+
+            +optional
+        timestamp:
+          description: |-
+            The following fields define time interval from which metrics were
+            collected from the interval [Timestamp-Window, Timestamp].
+          type: string
+        window:
+          type: string
+      type: object
+    v1beta1.PodMetricsList:
+      properties:
+        apiVersion:
+          description: >-
+            APIVersion defines the versioned schema of this representation of an
+            object.
+
+            Servers should convert recognized schemas to the latest internal value, and
+
+            may reject unrecognized values.
+
+            More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+
+            +optional
+          type: string
+        items:
+          description: List of pod metrics.
+          items:
+            $ref: "#/components/schemas/v1beta1.PodMetrics"
+          type: array
+        kind:
+          description: >-
+            Kind is a string value representing the REST resource this object
+            represents.
+
+            Servers may infer this from the endpoint the client submits requests to.
+
+            Cannot be updated.
+
+            In CamelCase.
+
+            More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+
+            +optional
+          type: string
+        metadata:
+          allOf:
+            - $ref: "#/components/schemas/v1.ListMeta"
+          description: >-
+            Standard list metadata.
+
+            More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+      type: object
+    webhooks.webhookCreatePayload:
+      properties:
+        EndpointID:
+          type: integer
+        RegistryID:
+          type: integer
+        ResourceID:
+          type: string
+        WebhookType:
+          allOf:
+            - $ref: "#/components/schemas/portainer.WebhookType"
+          description: Type of webhook (1 - service)
+      type: object
+    webhooks.webhookUpdatePayload:
+      properties:
+        RegistryID:
+          type: integer
+      type: object
+    workflows.ArtifactDetail:
+      properties:
+        autoUpdate:
+          $ref: "#/components/schemas/portainer.AutoUpdateSettings"
+        creationDate:
+          type: integer
+        files:
+          items:
+            $ref: "#/components/schemas/workflows.ArtifactFileDetail"
+          type: array
+        id:
+          type: integer
+        lastSyncDate:
+          type: integer
+        name:
+          type: string
+        platform:
+          $ref: "#/components/schemas/workflows.DeploymentPlatform"
+        status:
+          $ref: "#/components/schemas/workflows.WorkflowStatusObject"
+        target:
+          $ref: "#/components/schemas/workflows.Target"
+        type:
+          $ref: "#/components/schemas/workflows.Type"
+      required:
+        - id
+        - name
+        - type
+      type: object
+    workflows.ArtifactFileDetail:
+      properties:
+        hash:
+          example: abc123
+          type: string
+        path:
+          example: portainer.yaml
+          type: string
+        pathError:
+          type: string
+        pathStatus:
+          $ref: "#/components/schemas/sources.Status"
+        ref:
+          example: refs/heads/main
+          type: string
+        refError:
+          type: string
+        refStatus:
+          $ref: "#/components/schemas/sources.Status"
+        sourceId:
+          type: integer
+      type: object
+    workflows.DeploymentPlatform:
+      enum:
+        - dockerStandalone
+        - dockerSwarm
+        - kubernetes
+      type: string
+      x-enum-varnames:
+        - DeploymentPlatformDockerStandalone
+        - DeploymentPlatformDockerSwarm
+        - DeploymentPlatformKubernetes
+    workflows.Status:
+      enum:
+        - healthy
+        - syncing
+        - error
+        - paused
+        - unknown
+      type: string
+      x-enum-varnames:
+        - StatusHealthy
+        - StatusSyncing
+        - StatusError
+        - StatusPaused
+        - StatusUnknown
+    workflows.StatusSummary:
+      properties:
+        error:
+          type: integer
+        healthy:
+          type: integer
+        paused:
+          type: integer
+        syncing:
+          type: integer
+        unknown:
+          type: integer
+      type: object
+    workflows.Target:
+      properties:
+        edgeGroupIds:
+          items:
+            type: integer
+          type: array
+        endpointId:
+          type: integer
+        groupStatus:
+          additionalProperties:
+            $ref: "#/components/schemas/workflows.Status"
+          type: object
+        namespace:
+          type: string
+        resolvedEndpointIds:
+          items:
+            type: integer
+          type: array
+      type: object
+    workflows.Type:
+      enum:
+        - stack
+        - edgeStack
+      type: string
+      x-enum-varnames:
+        - TypeStack
+        - TypeEdgeStack
+    workflows.Workflow:
+      properties:
+        autoUpdate:
+          $ref: "#/components/schemas/portainer.AutoUpdateSettings"
+        creationDate:
+          type: integer
+        gitConfig:
+          $ref: "#/components/schemas/gittypes.RepoConfig"
+        id:
+          type: integer
+        lastSyncDate:
+          type: integer
+        name:
+          type: string
+        platform:
+          $ref: "#/components/schemas/workflows.DeploymentPlatform"
+        sourceId:
+          type: integer
+        status:
+          $ref: "#/components/schemas/workflows.WorkflowStatusObject"
+        target:
+          $ref: "#/components/schemas/workflows.Target"
+        type:
+          $ref: "#/components/schemas/workflows.Type"
+      required:
+        - id
+        - name
+        - platform
+        - status
+        - target
+        - type
+      type: object
+    workflows.WorkflowDetail:
+      properties:
+        artifacts:
+          items:
+            $ref: "#/components/schemas/workflows.ArtifactDetail"
+          type: array
+        id:
+          type: integer
+        name:
+          type: string
+      required:
+        - id
+        - name
+      type: object
+    workflows.WorkflowPhaseStatus:
+      properties:
+        error:
+          type: string
+        status:
+          $ref: "#/components/schemas/workflows.Status"
+      type: object
+    workflows.WorkflowStatusObject:
+      properties:
+        artifact:
+          $ref: "#/components/schemas/workflows.WorkflowPhaseStatus"
+        source:
+          $ref: "#/components/schemas/workflows.WorkflowPhaseStatus"
+        target:
+          $ref: "#/components/schemas/workflows.WorkflowPhaseStatus"
+      type: object
diff --git a/api/docs/swagger.yaml b/api/docs/swagger.yaml
new file mode 100644
index 0000000..7651b3b
--- /dev/null
+++ b/api/docs/swagger.yaml
@@ -0,0 +1,20045 @@
+basePath: /api
+definitions:
+  auth.authenticatePayload:
+    properties:
+      Password:
+        description: Password
+        example: mypassword
+        type: string
+      Username:
+        description: Username
+        example: admin
+        type: string
+    required:
+    - Password
+    - Username
+    type: object
+  auth.authenticateResponse:
+    properties:
+      jwt:
+        description: JWT token used to authenticate against the API
+        example: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyzAB
+        type: string
+    type: object
+  auth.oauthPayload:
+    properties:
+      Code:
+        description: OAuth code returned from OAuth Provided
+        type: string
+    type: object
+  backup.backupPayload:
+    properties:
+      Password:
+        type: string
+    type: object
+  backup.restorePayload:
+    properties:
+      FileContent:
+        items:
+          format: int32
+          type: integer
+        type: array
+      FileName:
+        type: string
+      Password:
+        type: string
+    type: object
+  build.BuildInfo:
+    properties:
+      BuildNumber:
+        type: string
+      GitCommit:
+        type: string
+      GoVersion:
+        type: string
+      ImageTag:
+        type: string
+      NodejsVersion:
+        type: string
+      PnpmVersion:
+        type: string
+      WebpackVersion:
+        type: string
+    type: object
+  build.DependenciesInfo:
+    properties:
+      ComposeVersion:
+        type: string
+      DockerVersion:
+        type: string
+      HelmVersion:
+        type: string
+      KubectlVersion:
+        type: string
+    type: object
+  build.RuntimeInfo:
+    properties:
+      Env:
+        items:
+          type: string
+        type: array
+    type: object
+  containers.containerGpusResponse:
+    properties:
+      gpus:
+        type: string
+    type: object
+  customtemplates.customTemplateFromFileContentPayload:
+    properties:
+      Description:
+        description: Description of the template
+        example: High performance web server
+        type: string
+      EdgeTemplate:
+        description: EdgeTemplate indicates if this template purpose for Edge Stack
+        example: false
+        type: boolean
+      FileContent:
+        description: Content of stack file
+        type: string
+      Logo:
+        description: URL of the template's logo
+        example: https://portainer.io/img/logo.svg
+        type: string
+      Note:
+        description: A note that will be displayed in the UI. Supports HTML content
+        example: This is my <b>custom</b> template
+        type: string
+      Platform:
+        allOf:
+        - $ref: '#/definitions/portainer.CustomTemplatePlatform'
+        description: |-
+          Platform associated to the template.
+          Valid values are: 1 - 'linux', 2 - 'windows'
+          Required for Docker stacks
+        enum:
+        - 1
+        - 2
+        example: 1
+      Title:
+        description: Title of the template
+        example: Nginx
+        type: string
+      Type:
+        allOf:
+        - $ref: '#/definitions/portainer.StackType'
+        description: |-
+          Type of created stack:
+          * 1 - swarm
+          * 2 - compose
+          * 3 - kubernetes
+        enum:
+        - 1
+        - 2
+        - 3
+        example: 1
+      Variables:
+        description: Definitions of variables in the stack file
+        items:
+          $ref: '#/definitions/portainer.CustomTemplateVariableDefinition'
+        type: array
+    required:
+    - Description
+    - FileContent
+    - Title
+    - Type
+    type: object
+  customtemplates.customTemplateFromGitRepositoryPayload:
+    properties:
+      ComposeFilePathInRepository:
+        default: docker-compose.yml
+        description: Path to the Stack file inside the Git repository
+        example: docker-compose.yml
+        type: string
+      Description:
+        description: Description of the template
+        example: High performance web server
+        type: string
+      EdgeTemplate:
+        description: EdgeTemplate indicates if this template purpose for Edge Stack
+        example: false
+        type: boolean
+      IsComposeFormat:
+        description: IsComposeFormat indicates if the Kubernetes template is created
+          from a Docker Compose file
+        example: false
+        type: boolean
+      Logo:
+        description: URL of the template's logo
+        example: https://portainer.io/img/logo.svg
+        type: string
+      Note:
+        description: A note that will be displayed in the UI. Supports HTML content
+        example: This is my <b>custom</b> template
+        type: string
+      Platform:
+        allOf:
+        - $ref: '#/definitions/portainer.CustomTemplatePlatform'
+        description: |-
+          Platform associated to the template.
+          Valid values are: 1 - 'linux', 2 - 'windows'
+          Required for Docker stacks
+        enum:
+        - 1
+        - 2
+        example: 1
+      RepositoryAuthentication:
+        description: 'Deprecated: use SourceID instead. Use basic authentication to
+          clone the Git repository.'
+        example: true
+        type: boolean
+      RepositoryPassword:
+        description: 'Deprecated: use SourceID instead. Password used in basic authentication.
+          Required when RepositoryAuthentication is true.'
+        example: myGitPassword
+        type: string
+      RepositoryReferenceName:
+        description: Reference name of a Git repository hosting the Stack file
+        example: refs/heads/master
+        type: string
+      RepositoryURL:
+        description: 'Deprecated: use SourceID instead. URL of a Git repository hosting
+          the Stack file.'
+        example: https://github.com/openfaas/faas
+        type: string
+      RepositoryUsername:
+        description: 'Deprecated: use SourceID instead. Username used in basic authentication.
+          Required when RepositoryAuthentication is true.'
+        example: myGitUsername
+        type: string
+      SourceID:
+        description: |-
+          SourceID references an existing Source for git credentials/URL.
+          When set, the inline URL and authentication fields are ignored.
+        example: 1
+        type: integer
+      TLSSkipVerify:
+        description: 'Deprecated: use SourceID instead. TLSSkipVerify skips SSL verification
+          when cloning the Git repository.'
+        example: false
+        type: boolean
+      Title:
+        description: Title of the template
+        example: Nginx
+        type: string
+      Type:
+        allOf:
+        - $ref: '#/definitions/portainer.StackType'
+        description: |-
+          Type of created stack:
+          * 1 - swarm
+          * 2 - compose
+          * 3 - kubernetes
+        enum:
+        - 1
+        - 2
+        example: 1
+      Variables:
+        description: Definitions of variables in the stack file
+        items:
+          $ref: '#/definitions/portainer.CustomTemplateVariableDefinition'
+        type: array
+    required:
+    - Description
+    - SourceID
+    - Title
+    - Type
+    type: object
+  customtemplates.customTemplateUpdatePayload:
+    properties:
+      ComposeFilePathInRepository:
+        default: docker-compose.yml
+        description: Path to the Stack file inside the Git repository
+        example: docker-compose.yml
+        type: string
+      Description:
+        description: Description of the template
+        example: High performance web server
+        type: string
+      EdgeTemplate:
+        description: EdgeTemplate indicates if this template purpose for Edge Stack
+        example: false
+        type: boolean
+      FileContent:
+        description: Content of stack file
+        type: string
+      IsComposeFormat:
+        description: IsComposeFormat indicates if the Kubernetes template is created
+          from a Docker Compose file
+        example: false
+        type: boolean
+      Logo:
+        description: URL of the template's logo
+        example: https://portainer.io/img/logo.svg
+        type: string
+      Note:
+        description: A note that will be displayed in the UI. Supports HTML content
+        example: This is my <b>custom</b> template
+        type: string
+      Platform:
+        allOf:
+        - $ref: '#/definitions/portainer.CustomTemplatePlatform'
+        description: |-
+          Platform associated to the template.
+          Valid values are: 1 - 'linux', 2 - 'windows'
+          Required for Docker stacks
+        enum:
+        - 1
+        - 2
+        example: 1
+      RepositoryAuthentication:
+        description: 'Deprecated: use SourceID instead. Use authentication to clone
+          the Git repository.'
+        example: true
+        type: boolean
+      RepositoryPassword:
+        description: 'Deprecated: use SourceID instead. Password used in basic authentication
+          or token used in token authentication. Required when RepositoryAuthentication
+          is true.'
+        example: myGitPassword
+        type: string
+      RepositoryReferenceName:
+        description: Reference name of a Git repository hosting the Stack file
+        example: refs/heads/master
+        type: string
+      RepositoryURL:
+        description: 'Deprecated: use SourceID instead. URL of a Git repository hosting
+          the Stack file.'
+        example: https://github.com/openfaas/faas
+        type: string
+      RepositoryUsername:
+        description: 'Deprecated: use SourceID instead. Username used in basic authentication.
+          Required when RepositoryAuthentication is true.'
+        example: myGitUsername
+        type: string
+      SourceID:
+        description: |-
+          SourceID references an existing Source for git credentials/URL.
+          When set, the inline URL and authentication fields are ignored.
+        example: 1
+        type: integer
+      TLSSkipVerify:
+        description: 'Deprecated: use SourceID instead. TLSSkipVerify skips SSL verification
+          when cloning the Git repository.'
+        example: false
+        type: boolean
+      Title:
+        description: Title of the template
+        example: Nginx
+        type: string
+      Type:
+        allOf:
+        - $ref: '#/definitions/portainer.StackType'
+        description: Type of created stack (1 - swarm, 2 - compose, 3 - kubernetes)
+        enum:
+        - 1
+        - 2
+        - 3
+        example: 1
+      Variables:
+        description: Definitions of variables in the stack file
+        items:
+          $ref: '#/definitions/portainer.CustomTemplateVariableDefinition'
+        type: array
+    required:
+    - Description
+    - FileContent
+    - Title
+    - Type
+    type: object
+  customtemplates.fileResponse:
+    properties:
+      FileContent:
+        type: string
+    type: object
+  docker.dashboardResponse:
+    properties:
+      containers:
+        $ref: '#/definitions/stats.ContainerStats'
+      images:
+        $ref: '#/definitions/docker.imagesCounters'
+      networks:
+        type: integer
+      services:
+        type: integer
+      stacks:
+        type: integer
+      volumes:
+        type: integer
+    type: object
+  docker.imagesCounters:
+    properties:
+      size:
+        type: integer
+      total:
+        type: integer
+    type: object
+  edge.DeployerOptionsPayload:
+    properties:
+      ForceRecreate:
+        description: |-
+          ForceRecreate is a flag indicating if the agent must force the redeployment of the stack.
+          This field is only used when the Force Redeployment is triggered.
+          Once the stack is redeployed, this field will be reset to false.
+          For standard edge agent, this field is used in agent side
+          For async edge agent, this field is used in both agent side and server side.
+          This flag drives `docker compose up --force-recreate` option
+        type: boolean
+      Prune:
+        description: |-
+          Prune is a flag indicating if the agent must prune the containers or not when creating/updating an edge stack
+          This flag drives `docker compose up --remove-orphans` and `docker stack up --prune` options
+          Used only for EE
+        type: boolean
+      RemoveVolumes:
+        description: |-
+          RemoveVolumes is a flag indicating if the agent must remove the named volumes declared
+          in the compose file and anonymouse volumes attached to containers
+          This flag drives `docker compose down --volumes` option
+          Used only for EE
+        type: boolean
+    type: object
+  edge.RegistryCredentials:
+    properties:
+      Secret:
+        type: string
+      ServerURL:
+        type: string
+      Username:
+        type: string
+    type: object
+  edge.StackPayload:
+    properties:
+      AlwaysCloneGitRepoForRelativePath:
+        description: |-
+          AlwaysCloneGitRepoForRelativePath is a flag indicating if the agent must always clone the git repository for relative path.
+          This field is only valid when SupportRelativePath is true.
+          Used only for EE
+        type: boolean
+      CreatedBy:
+        description: |-
+          CreatedBy is the username that created this stack
+          Used for adding labels to Kubernetes manifests
+        type: string
+      CreatedByUserId:
+        description: |-
+          CreatedByUserId is the user ID that created this stack
+          Used for adding labels to Kubernetes manifests
+        type: string
+      DeployerOptionsPayload:
+        $ref: '#/definitions/edge.DeployerOptionsPayload'
+      DirEntries:
+        description: Content of stack folder
+        items:
+          $ref: '#/definitions/filesystem.DirEntry'
+        type: array
+      EdgeUpdateID:
+        description: |-
+          EdgeUpdateID is the ID of the edge update related to this stack.
+          Used only for EE
+        type: integer
+      EntryFileName:
+        description: Name of the stack entry file
+        type: string
+      EnvVars:
+        description: |-
+          Used only for EE
+          EnvVars is a list of environment variables to inject into the stack
+        items:
+          $ref: '#/definitions/portainer.Pair'
+        type: array
+      FilesystemPath:
+        description: Mount point for relative path
+        type: string
+      ForceUpdate:
+        description: |-
+          ForceUpdate is a flag indicating if the agent must force the update of the stack.
+          Used only for EE
+        type: boolean
+      HelmConfig:
+        allOf:
+        - $ref: '#/definitions/portainer.HelmConfig'
+        description: HelmConfig represents the Helm configuration for an edge stack
+      ID:
+        description: ID of the stack
+        type: integer
+      Name:
+        description: Name of the stack
+        type: string
+      Namespace:
+        description: Namespace to use for kubernetes stack. Keep empty to use the
+          manifest namespace.
+        type: string
+      PrePullImage:
+        description: |-
+          PrePullImage is a flag indicating if the agent must pull the image before deploying the stack.
+          Used only for EE
+        type: boolean
+      RePullImage:
+        description: |-
+          RePullImage is a flag indicating if the agent must pull the image if it is already present on the node.
+          Used only for EE
+        type: boolean
+      ReadyRePullImage:
+        description: |-
+          Used only for EE async edge agent
+          ReadyRePullImage is a flag to indicate whether the auto update is trigger to re-pull image
+          Deprecated(2.36): use DeployerOptionsPayload.ForceRecreate instead
+        type: boolean
+      RegistryCredentials:
+        description: |-
+          RegistryCredentials holds the credentials for a Docker registry.
+          Used only for EE
+        items:
+          $ref: '#/definitions/edge.RegistryCredentials'
+        type: array
+      RetryDeploy:
+        description: |-
+          RetryDeploy is a flag indicating if the agent must retry to deploy the stack if it fails.
+          Used only for EE
+        type: boolean
+      RetryPeriod:
+        description: |-
+          RetryPeriod specifies the duration, in seconds, for which the agent should continue attempting to deploy the stack after a failure
+          Used only for EE
+        type: integer
+      RollbackTo:
+        description: RollbackTo specifies the stack file version to rollback to (only
+          support to rollback to the last version currently)
+        type: integer
+      StackFileContent:
+        description: Content of the stack file (for compatibility to agent version
+          less than 2.19.0)
+        type: string
+      SupportPerDeviceConfigs:
+        description: Whether the edge stack supports per device configs
+        type: boolean
+      SupportRelativePath:
+        description: Is relative path supported
+        type: boolean
+      Version:
+        description: Version of the stack file
+        type: integer
+    type: object
+  edgegroups.decoratedEdgeGroup:
+    properties:
+      Dynamic:
+        type: boolean
+      EndpointIds:
+        description: Shadow to avoid exposing in the API
+        type: integer
+      EndpointTypes:
+        items:
+          $ref: '#/definitions/portainer.EndpointType'
+        type: array
+      Endpoints:
+        description: 'Deprecated: only used for API responses'
+        items:
+          type: integer
+        type: array
+      HasEdgeJob:
+        type: boolean
+      HasEdgeStack:
+        type: boolean
+      Id:
+        description: EdgeGroup Identifier
+        example: 1
+        type: integer
+      Name:
+        type: string
+      PartialMatch:
+        type: boolean
+      TagIds:
+        items:
+          type: integer
+        type: array
+      TrustedEndpoints:
+        items:
+          type: integer
+        type: array
+    type: object
+  edgegroups.edgeGroupCreatePayload:
+    properties:
+      Dynamic:
+        type: boolean
+      Endpoints:
+        items:
+          type: integer
+        type: array
+      Name:
+        type: string
+      PartialMatch:
+        type: boolean
+      TagIDs:
+        items:
+          type: integer
+        type: array
+    type: object
+  edgegroups.edgeGroupUpdatePayload:
+    properties:
+      Dynamic:
+        type: boolean
+      Endpoints:
+        items:
+          type: integer
+        type: array
+      Name:
+        type: string
+      PartialMatch:
+        type: boolean
+      TagIDs:
+        items:
+          type: integer
+        type: array
+    type: object
+  edgejobs.edgeJobCreateFromFileContentPayload:
+    properties:
+      CronExpression:
+        type: string
+      EdgeGroups:
+        items:
+          type: integer
+        type: array
+      Endpoints:
+        items:
+          type: integer
+        type: array
+      FileContent:
+        type: string
+      Name:
+        type: string
+      Recurring:
+        type: boolean
+    type: object
+  edgejobs.edgeJobFileResponse:
+    properties:
+      FileContent:
+        type: string
+    type: object
+  edgejobs.edgeJobUpdatePayload:
+    properties:
+      CronExpression:
+        type: string
+      EdgeGroups:
+        items:
+          type: integer
+        type: array
+      Endpoints:
+        items:
+          type: integer
+        type: array
+      FileContent:
+        type: string
+      Name:
+        type: string
+      Recurring:
+        type: boolean
+    type: object
+  edgejobs.fileResponse:
+    properties:
+      FileContent:
+        type: string
+    type: object
+  edgejobs.taskContainer:
+    properties:
+      EndpointId:
+        type: integer
+      EndpointName:
+        type: string
+      Id:
+        type: string
+      LogsStatus:
+        $ref: '#/definitions/portainer.EdgeJobLogsStatus'
+    type: object
+  edgestacks.edgeStackFromGitRepositoryPayload:
+    properties:
+      DeploymentType:
+        allOf:
+        - $ref: '#/definitions/portainer.EdgeStackDeploymentType'
+        description: |-
+          Deployment type to deploy this stack
+          Valid values are: 0 - 'compose', 1 - 'kubernetes'
+          compose is enabled only for docker environments
+          kubernetes is enabled only for kubernetes environments
+        enum:
+        - 0
+        - 1
+        - 2
+        example: 0
+      EdgeGroups:
+        description: List of identifiers of EdgeGroups
+        example:
+        - 1
+        items:
+          type: integer
+        type: array
+      FilePathInRepository:
+        default: docker-compose.yml
+        description: Path to the Stack file inside the Git repository
+        example: docker-compose.yml
+        type: string
+      Name:
+        description: |-
+          Name of the stack
+          Max length: 255
+          Name must only contains lowercase characters, numbers, hyphens, or underscores
+          Name must start with a lowercase character or number
+          Example: stack-name or stack_123 or stackName
+        example: stack-name
+        type: string
+      Registries:
+        description: List of Registries to use for this stack
+        items:
+          type: integer
+        type: array
+      RepositoryAuthentication:
+        description: 'Deprecated: Use SourceID instead. Use basic authentication to
+          clone the Git repository.'
+        example: true
+        type: boolean
+      RepositoryPassword:
+        description: 'Deprecated: Use SourceID instead. Password used in basic authentication.'
+        example: myGitPassword
+        type: string
+      RepositoryReferenceName:
+        description: Reference name of a Git repository hosting the Stack file
+        example: refs/heads/master
+        type: string
+      RepositoryURL:
+        description: 'Deprecated: Use SourceID instead. URL of a Git repository hosting
+          the Stack file.'
+        example: https://github.com/openfaas/faas
+        type: string
+      RepositoryUsername:
+        description: 'Deprecated: Use SourceID instead. Username used in basic authentication.'
+        example: myGitUsername
+        type: string
+      SourceID:
+        description: |-
+          SourceID references an existing Source for git credentials/URL.
+          When set, the inline URL and authentication fields are ignored.
+        example: 1
+        type: integer
+      TLSSkipVerify:
+        description: 'Deprecated: Use SourceID instead. TLSSkipVerify skips SSL verification
+          when cloning the Git repository.'
+        example: false
+        type: boolean
+      UseManifestNamespaces:
+        description: Uses the manifest's namespaces instead of the default one
+        type: boolean
+    required:
+    - EdgeGroups
+    - Name
+    type: object
+  edgestacks.edgeStackFromStringPayload:
+    properties:
+      DeploymentType:
+        allOf:
+        - $ref: '#/definitions/portainer.EdgeStackDeploymentType'
+        description: |-
+          Deployment type to deploy this stack
+          Valid values are: 0 - 'compose', 1 - 'kubernetes'
+          compose is enabled only for docker environments
+          kubernetes is enabled only for kubernetes environments
+        enum:
+        - 0
+        - 1
+        - 2
+        example: 0
+      EdgeGroups:
+        description: List of identifiers of EdgeGroups
+        example:
+        - 1
+        items:
+          type: integer
+        type: array
+      Name:
+        description: |-
+          Name of the stack
+          Max length: 255
+          Name must only contains lowercase characters, numbers, hyphens, or underscores
+          Name must start with a lowercase character or number
+          Example: stack-name or stack_123 or stackName
+        example: stack-name
+        type: string
+      Registries:
+        description: List of Registries to use for this stack
+        items:
+          type: integer
+        type: array
+      StackFileContent:
+        description: Content of the Stack file
+        example: |-
+          version: 3
+           services:
+           web:
+           image:nginx
+        type: string
+      UseManifestNamespaces:
+        description: Uses the manifest's namespaces instead of the default one
+        type: boolean
+    required:
+    - Name
+    - StackFileContent
+    type: object
+  edgestacks.stackFileResponse:
+    properties:
+      StackFileContent:
+        type: string
+    type: object
+  edgestacks.updateEdgeStackPayload:
+    properties:
+      DeploymentType:
+        $ref: '#/definitions/portainer.EdgeStackDeploymentType'
+      EdgeGroups:
+        items:
+          type: integer
+        type: array
+      StackFileContent:
+        type: string
+      UpdateVersion:
+        type: boolean
+      UseManifestNamespaces:
+        description: Uses the manifest's namespaces instead of the default one
+        type: boolean
+    type: object
+  edgestacks.updateStatusPayload:
+    properties:
+      EndpointID:
+        type: integer
+      Error:
+        type: string
+      Status:
+        $ref: '#/definitions/portainer.EdgeStackStatusType'
+      Time:
+        format: int64
+        type: integer
+      Version:
+        type: integer
+    type: object
+  endpointedge.edgeJobResponse:
+    properties:
+      CollectLogs:
+        description: Whether to collect logs
+        example: true
+        type: boolean
+      CronExpression:
+        description: A cron expression to schedule this job
+        example: '* * * * *'
+        type: string
+      Id:
+        description: EdgeJob Identifier
+        example: 2
+        type: integer
+      Script:
+        description: Script to run
+        example: echo hello
+        type: string
+      Version:
+        description: Version of this EdgeJob
+        example: 2
+        type: integer
+    type: object
+  endpointedge.endpointEdgeStatusInspectResponse:
+    properties:
+      checkin:
+        description: The current value of CheckinInterval
+        example: 5
+        type: integer
+      credentials:
+        type: string
+      port:
+        description: The tunnel port
+        example: 8732
+        type: integer
+      schedules:
+        description: List of requests for jobs to run on the environment(endpoint)
+        items:
+          $ref: '#/definitions/endpointedge.edgeJobResponse'
+        type: array
+      stacks:
+        description: List of stacks to be deployed on the environments(endpoints)
+        items:
+          $ref: '#/definitions/endpointedge.stackStatusResponse'
+        type: array
+      status:
+        description: Status represents the environment(endpoint) status
+        example: REQUIRED
+        type: string
+    type: object
+  endpointedge.stackStatusResponse:
+    properties:
+      ID:
+        description: EdgeStack Identifier
+        example: 1
+        type: integer
+      Version:
+        description: Version of this stack
+        example: 3
+        type: integer
+    type: object
+  endpointgroups.EndpointGroupResponse:
+    properties:
+      Description:
+        description: Description associated to the environment(endpoint) group
+        example: Environment(Endpoint) group description
+        type: string
+      Id:
+        description: Environment(Endpoint) group Identifier
+        example: 1
+        type: integer
+      Name:
+        description: Environment(Endpoint) group name
+        example: my-environment-group
+        type: string
+      TagIds:
+        description: List of tags associated to this environment(endpoint) group
+        items:
+          type: integer
+        type: array
+      TeamAccessPolicies:
+        $ref: '#/definitions/portainer.TeamAccessPolicies'
+      Total:
+        type: integer
+      TypeInfo:
+        $ref: '#/definitions/endpointgroups.EndpointGroupTypeInfo'
+      UserAccessPolicies:
+        $ref: '#/definitions/portainer.UserAccessPolicies'
+    required:
+    - Description
+    - Id
+    - Name
+    type: object
+  endpointgroups.EndpointGroupTypeInfo:
+    properties:
+      Docker:
+        type: integer
+      Kubernetes:
+        type: integer
+      Mixed:
+        type: boolean
+      Podman:
+        type: integer
+    required:
+    - Docker
+    - Kubernetes
+    - Mixed
+    - Podman
+    type: object
+  endpointgroups.endpointGroupCreatePayload:
+    properties:
+      AssociatedEndpoints:
+        description: List of environment(endpoint) identifiers that will be part of
+          this group
+        example:
+        - 1
+        - 3
+        items:
+          type: integer
+        type: array
+      Description:
+        description: Environment(Endpoint) group description
+        example: description
+        type: string
+      Name:
+        description: Environment(Endpoint) group name
+        example: my-environment-group
+        type: string
+      TagIDs:
+        description: List of tag identifiers to which this environment(endpoint) group
+          is associated
+        example:
+        - 1
+        - 2
+        items:
+          type: integer
+        type: array
+    required:
+    - Name
+    type: object
+  endpointgroups.endpointGroupUpdatePayload:
+    properties:
+      AssociatedEndpoints:
+        description: List of environment(endpoint) identifiers that will be part of
+          this group
+        example:
+        - 1
+        - 3
+        items:
+          type: integer
+        type: array
+      Description:
+        description: Environment(Endpoint) group description
+        example: description
+        type: string
+      Name:
+        description: Environment(Endpoint) group name
+        example: my-environment-group
+        type: string
+      TagIDs:
+        description: List of tag identifiers associated to the environment(endpoint)
+          group
+        example:
+        - 3
+        - 4
+        items:
+          type: integer
+        type: array
+      TeamAccessPolicies:
+        $ref: '#/definitions/portainer.TeamAccessPolicies'
+      UserAccessPolicies:
+        $ref: '#/definitions/portainer.UserAccessPolicies'
+    type: object
+  endpoints.EnvironmentSummaryCountsResponse:
+    properties:
+      byGroup:
+        items:
+          $ref: '#/definitions/endpoints.groupCount'
+        type: array
+      byHealth:
+        $ref: '#/definitions/endpoints.healthCounts'
+      byPlatformType:
+        $ref: '#/definitions/endpoints.platformCounts'
+      down:
+        type: integer
+      outdated:
+        type: integer
+      total:
+        type: integer
+      unassigned:
+        type: integer
+      up:
+        type: integer
+    type: object
+  endpoints.dockerhubStatusResponse:
+    properties:
+      limit:
+        description: Daily limit
+        type: integer
+      remaining:
+        description: Remaiming images to pull
+        type: integer
+    type: object
+  endpoints.endpointCreateGlobalKeyResponse:
+    properties:
+      endpointID:
+        type: integer
+    type: object
+  endpoints.endpointDeleteBatchPartialResponse:
+    properties:
+      deleted:
+        items:
+          type: integer
+        type: array
+      errors:
+        items:
+          type: integer
+        type: array
+    type: object
+  endpoints.endpointDeleteBatchPayload:
+    properties:
+      endpoints:
+        items:
+          $ref: '#/definitions/endpoints.endpointDeleteRequest'
+        type: array
+    type: object
+  endpoints.endpointDeleteRequest:
+    properties:
+      deleteCluster:
+        type: boolean
+      id:
+        type: integer
+    type: object
+  endpoints.endpointSettingsUpdatePayload:
+    properties:
+      allowBindMountsForRegularUsers:
+        description: Whether non-administrator should be able to use bind mounts when
+          creating containers
+        example: false
+        type: boolean
+      allowContainerCapabilitiesForRegularUsers:
+        description: Whether non-administrator should be able to use container capabilities
+        example: true
+        type: boolean
+      allowDeviceMappingForRegularUsers:
+        description: Whether non-administrator should be able to use device mapping
+        example: true
+        type: boolean
+      allowHostNamespaceForRegularUsers:
+        description: Whether non-administrator should be able to use the host pid
+        example: true
+        type: boolean
+      allowPrivilegedModeForRegularUsers:
+        description: Whether non-administrator should be able to use privileged mode
+          when creating containers
+        example: false
+        type: boolean
+      allowSecurityOptForRegularUsers:
+        description: Whether non-administrator should be able to use security-opt
+          settings
+        example: true
+        type: boolean
+      allowStackManagementForRegularUsers:
+        description: Whether non-administrator should be able to manage stacks
+        example: true
+        type: boolean
+      allowSysctlSettingForRegularUsers:
+        description: Whether non-administrator should be able to use sysctl settings
+        example: true
+        type: boolean
+      allowVolumeBrowserForRegularUsers:
+        description: Whether non-administrator should be able to browse volumes
+        example: true
+        type: boolean
+      enableGPUManagement:
+        example: false
+        type: boolean
+      enableHostManagementFeatures:
+        description: Whether host management features are enabled
+        example: true
+        type: boolean
+      gpus:
+        items:
+          $ref: '#/definitions/portainer.Pair'
+        type: array
+    type: object
+  endpoints.endpointUpdatePayload:
+    properties:
+      AzureApplicationID:
+        description: Azure application ID
+        example: eag7cdo9-o09l-9i83-9dO9-f0b23oe78db4
+        type: string
+      AzureAuthenticationKey:
+        description: Azure authentication key
+        example: cOrXoK/1D35w8YQ8nH1/8ZGwzz45JIYD5jxHKXEQknk=
+        type: string
+      AzureTenantID:
+        description: Azure tenant ID
+        example: 34ddc78d-4fel-2358-8cc1-df84c8o839f5
+        type: string
+      EdgeCheckinInterval:
+        description: The check in interval for edge agent (in seconds)
+        example: 5
+        type: integer
+      Gpus:
+        description: GPUs information
+        items:
+          $ref: '#/definitions/portainer.Pair'
+        type: array
+      GroupID:
+        description: Group identifier
+        example: 1
+        type: integer
+      Kubernetes:
+        allOf:
+        - $ref: '#/definitions/portainer.KubernetesData'
+        description: Associated Kubernetes data
+      Name:
+        description: Name that will be used to identify this environment(endpoint)
+        example: my-environment
+        type: string
+      PublicURL:
+        description: |-
+          URL or IP address where exposed containers will be reachable.\
+          Defaults to URL if not specified
+        example: docker.mydomain.tld:2375
+        type: string
+      Status:
+        description: The status of the environment(endpoint) (1 - up, 2 - down)
+        example: 1
+        type: integer
+      TLS:
+        description: Require TLS to connect against this environment(endpoint)
+        example: true
+        type: boolean
+      TLSSkipClientVerify:
+        description: Skip client verification when using TLS
+        example: false
+        type: boolean
+      TLSSkipVerify:
+        description: Skip server verification when using TLS
+        example: false
+        type: boolean
+      TagIDs:
+        description: List of tag identifiers to which this environment(endpoint) is
+          associated
+        example:
+        - 1
+        - 2
+        items:
+          type: integer
+        type: array
+      TeamAccessPolicies:
+        $ref: '#/definitions/portainer.TeamAccessPolicies'
+      URL:
+        description: URL or IP address of a Docker host
+        example: docker.mydomain.tld:2375
+        type: string
+      UserAccessPolicies:
+        $ref: '#/definitions/portainer.UserAccessPolicies'
+    type: object
+  endpoints.endpointUpdateRelationsPayload:
+    properties:
+      Relations:
+        additionalProperties:
+          properties:
+            EdgeGroups:
+              items:
+                type: integer
+              type: array
+            Group:
+              type: integer
+            Tags:
+              items:
+                type: integer
+              type: array
+          type: object
+        type: object
+    type: object
+  endpoints.forceUpdateServicePayload:
+    properties:
+      PullImage:
+        description: PullImage if true will pull the image
+        type: boolean
+      ServiceID:
+        description: ServiceId to update
+        type: string
+    type: object
+  endpoints.groupCount:
+    properties:
+      count:
+        type: integer
+      groupID:
+        type: integer
+      groupName:
+        type: string
+    type: object
+  endpoints.healthCounts:
+    properties:
+      down:
+        type: integer
+      heartbeat:
+        type: integer
+      outdated:
+        type: integer
+      up:
+        type: integer
+    type: object
+  endpoints.platformCounts:
+    properties:
+      azure:
+        type: integer
+      docker:
+        type: integer
+      kubernetes:
+        type: integer
+      podman:
+        type: integer
+    type: object
+  endpoints.registryAccessPayload:
+    properties:
+      Namespaces:
+        items:
+          type: string
+        type: array
+      TeamAccessPolicies:
+        $ref: '#/definitions/portainer.TeamAccessPolicies'
+      UserAccessPolicies:
+        $ref: '#/definitions/portainer.UserAccessPolicies'
+    type: object
+  filesystem.DirEntry:
+    properties:
+      Content:
+        type: string
+      IsFile:
+        type: boolean
+      Name:
+        type: string
+      Permissions:
+        type: integer
+    type: object
+  github_com_portainer_portainer_pkg_libhelm_release.Hook:
+    properties:
+      delete_policies:
+        description: DeletePolicies are the policies that indicate when to delete
+          the hook
+        items:
+          type: string
+        type: array
+      events:
+        description: Events are the events that this hook fires on.
+        items:
+          type: string
+        type: array
+      kind:
+        description: Kind is the Kubernetes kind.
+        type: string
+      last_run:
+        allOf:
+        - $ref: '#/definitions/release.HookExecution'
+        description: LastRun indicates the date/time this was last run.
+      manifest:
+        description: Manifest is the manifest contents.
+        type: string
+      name:
+        type: string
+      path:
+        description: Path is the chart-relative path to the template.
+        type: string
+      weight:
+        description: Weight indicates the sort order for execution among similar Hook
+          type
+        type: integer
+    type: object
+  gitops.fileResponse:
+    properties:
+      FileContent:
+        type: string
+    type: object
+  gitops.repositoryFilePreviewPayload:
+    properties:
+      password:
+        description: |-
+          Password for git authentication.
+          Deprecated: use SourceID instead
+        example: myGitPassword
+        type: string
+      reference:
+        example: refs/heads/master
+        type: string
+      repository:
+        description: |-
+          URL of a Git repository to preview.
+          Deprecated: use SourceID instead
+        example: https://github.com/openfaas/faas
+        type: string
+      sourceID:
+        description: |-
+          SourceID resolves URL and auth from the stored Source record.
+          When set, the inline Repository/Username/Password/TLSSkipVerify fields are ignored.
+        example: 1
+        type: integer
+      targetFile:
+        description: Path to file whose content will be read
+        example: docker-compose.yml
+        type: string
+      tlsSkipVerify:
+        description: |-
+          TLSSkipVerify skips SSL verification when cloning the Git repository.
+          Deprecated: use SourceID instead
+        example: false
+        type: boolean
+      username:
+        description: |-
+          Username for git authentication.
+          Deprecated: use SourceID instead
+        example: myGitUsername
+        type: string
+    type: object
+  gittypes.GitAuthentication:
+    properties:
+      AuthorizationType:
+        type: integer
+      Password:
+        type: string
+      Provider:
+        type: integer
+      Username:
+        type: string
+    type: object
+  gittypes.GitSource:
+    properties:
+      Authentication:
+        $ref: '#/definitions/gittypes.GitAuthentication'
+      TLSSkipVerify:
+        example: false
+        type: boolean
+      URL:
+        example: https://github.com/portainer/portainer.git
+        type: string
+    type: object
+  gittypes.RepoConfig:
+    properties:
+      Authentication:
+        allOf:
+        - $ref: '#/definitions/gittypes.GitAuthentication'
+        description: Git credentials
+      ConfigFilePath:
+        description: |-
+          ConfigFilePath is the path to the config file within the repository.
+          NOTE: For stacks, this mirrors Stack.EntryPoint and the two are kept in sync by stackUpdateGit.
+        example: docker-compose.yml
+        type: string
+      ConfigHash:
+        description: Repository hash
+        example: bc4c183d756879ea4d173315338110b31004b8e0
+        type: string
+      ReferenceName:
+        description: The reference name
+        example: refs/heads/branch_name
+        type: string
+      TLSSkipVerify:
+        description: TLSSkipVerify skips SSL verification when cloning the Git repository
+        example: false
+        type: boolean
+      URL:
+        description: The repo url
+        example: https://github.com/portainer/portainer.git
+        type: string
+    type: object
+  helm.installChartPayload:
+    properties:
+      atomic:
+        type: boolean
+      chart:
+        type: string
+      name:
+        type: string
+      namespace:
+        type: string
+      repo:
+        type: string
+      values:
+        type: string
+      version:
+        type: string
+    type: object
+  images.ImageResponse:
+    properties:
+      created:
+        type: integer
+      id:
+        type: string
+      nodeName:
+        type: string
+      size:
+        type: integer
+      tags:
+        items:
+          type: string
+        type: array
+      used:
+        description: |-
+          Used is true if the image is used by at least one container
+          supplied only when withUsage is true
+        type: boolean
+    type: object
+  intstr.IntOrString:
+    properties:
+      IntVal:
+        type: integer
+      StrVal:
+        type: string
+      Type:
+        $ref: '#/definitions/intstr.Type'
+    type: object
+  intstr.Type:
+    enum:
+    - 0
+    - 1
+    format: int64
+    type: integer
+    x-enum-comments:
+      Int: The IntOrString holds an int.
+      String: The IntOrString holds a string.
+    x-enum-descriptions:
+    - The IntOrString holds an int.
+    - The IntOrString holds a string.
+    x-enum-varnames:
+    - Int
+    - String
+  k8s_io_api_core_v1.ConditionStatus:
+    enum:
+    - "True"
+    - "False"
+    - Unknown
+    type: string
+    x-enum-varnames:
+    - ConditionTrue
+    - ConditionFalse
+    - ConditionUnknown
+  k8s_io_api_core_v1.HTTPHeader:
+    properties:
+      name:
+        description: |-
+          The header field name.
+          This will be canonicalized upon output, so case-variant names will be understood as the same header.
+        type: string
+      value:
+        description: The header field value
+        type: string
+    type: object
+  k8s_io_api_core_v1.LocalObjectReference:
+    properties:
+      name:
+        description: |-
+          Name of the referent.
+          This field is effectively required, but due to backwards compatibility is
+          allowed to be empty. Instances of this type with an empty value here are
+          almost certainly wrong.
+          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+          +optional
+          +default=""
+          +kubebuilder:default=""
+          TODO: Drop `kubebuilder:default` when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.
+        type: string
+    type: object
+  k8s_io_api_core_v1.ObjectReference:
+    properties:
+      apiVersion:
+        description: |-
+          API version of the referent.
+          +optional
+        type: string
+      fieldPath:
+        description: |-
+          If referring to a piece of an object instead of an entire object, this string
+          should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2].
+          For example, if the object reference is to a container within a pod, this would take on a value like:
+          "spec.containers{name}" (where "name" refers to the name of the container that triggered
+          the event) or if no container name is specified "spec.containers[2]" (container with
+          index 2 in this pod). This syntax is chosen only to have some well-defined way of
+          referencing a part of an object.
+          TODO: this design is not final and this field is subject to change in the future.
+          +optional
+        type: string
+      kind:
+        description: |-
+          Kind of the referent.
+          More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+          +optional
+        type: string
+      name:
+        description: |-
+          Name of the referent.
+          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+          +optional
+        type: string
+      namespace:
+        description: |-
+          Namespace of the referent.
+          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
+          +optional
+        type: string
+      resourceVersion:
+        description: |-
+          Specific resourceVersion to which this reference is made, if any.
+          More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
+          +optional
+        type: string
+      uid:
+        description: |-
+          UID of the referent.
+          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids
+          +optional
+        type: string
+    type: object
+  k8s_io_api_core_v1.ResourceClaim:
+    properties:
+      name:
+        description: |-
+          Name must match the name of one entry in pod.spec.resourceClaims of
+          the Pod where this field is used. It makes that resource available
+          inside a container.
+        type: string
+      request:
+        description: |-
+          Request is the name chosen for a request in the referenced claim.
+          If empty, everything from the claim is made available, otherwise
+          only the result of this request.
+
+          +optional
+        type: string
+    type: object
+  k8s_io_api_rbac_v1.Subject:
+    properties:
+      apiGroup:
+        description: |-
+          APIGroup holds the API group of the referenced subject.
+          Defaults to "" for ServiceAccount subjects.
+          Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
+          +optional
+        type: string
+      kind:
+        description: |-
+          Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
+          If the Authorizer does not recognized the kind value, the Authorizer should report an error.
+        type: string
+      name:
+        description: |-
+          Name of the object being referenced.
+          +required
+          +k8s:required
+        type: string
+      namespace:
+        description: |-
+          Namespace of the referenced object.  If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
+          the Authorizer should report an error.
+          +optional
+        type: string
+    type: object
+  kubernetes.Configuration:
+    properties:
+      ConfigurationOwner:
+        type: string
+      Data:
+        additionalProperties: {}
+        type: object
+      Kind:
+        type: string
+    type: object
+  kubernetes.CustomResourceMetadata:
+    properties:
+      apiVersion:
+        type: string
+      kind:
+        type: string
+      name:
+        type: string
+      plural:
+        type: string
+      scope:
+        type: string
+    type: object
+  kubernetes.IngressRule:
+    properties:
+      Host:
+        type: string
+      IP:
+        type: string
+      Path:
+        type: string
+      TLS:
+        items:
+          $ref: '#/definitions/kubernetes.TLSInfo'
+        type: array
+    type: object
+  kubernetes.K8sApplication:
+    properties:
+      Annotations:
+        additionalProperties:
+          type: string
+        type: object
+      ApplicationOwner:
+        type: string
+      ApplicationType:
+        type: string
+      Configurations:
+        items:
+          $ref: '#/definitions/kubernetes.Configuration'
+        type: array
+      Containers:
+        items: {}
+        type: array
+      CreationDate:
+        type: string
+      CustomResourceMetadata:
+        $ref: '#/definitions/kubernetes.CustomResourceMetadata'
+      DeploymentType:
+        type: string
+      Id:
+        type: string
+      Image:
+        type: string
+      Kind:
+        type: string
+      Labels:
+        additionalProperties:
+          type: string
+        type: object
+      LoadBalancerIPAddress:
+        type: string
+      MatchLabels:
+        additionalProperties:
+          type: string
+        type: object
+      Metadata:
+        $ref: '#/definitions/kubernetes.Metadata'
+      Name:
+        type: string
+      Namespace:
+        type: string
+      Pods:
+        items:
+          $ref: '#/definitions/kubernetes.Pod'
+        type: array
+      PublishedPorts:
+        items:
+          $ref: '#/definitions/kubernetes.PublishedPort'
+        type: array
+      Resource:
+        $ref: '#/definitions/kubernetes.K8sApplicationResource'
+      ResourcePool:
+        type: string
+      RunningPodsCount:
+        type: integer
+      ServiceId:
+        type: string
+      ServiceName:
+        type: string
+      ServiceType:
+        type: string
+      StackId:
+        type: string
+      StackKind:
+        type: string
+      StackName:
+        type: string
+      Status:
+        type: string
+      TotalPodsCount:
+        type: integer
+      Uid:
+        type: string
+    type: object
+  kubernetes.K8sApplicationResource:
+    properties:
+      CpuLimit:
+        type: number
+      CpuRequest:
+        type: number
+      MemoryLimit:
+        type: integer
+      MemoryRequest:
+        type: integer
+    type: object
+  kubernetes.K8sClusterRole:
+    properties:
+      creationDate:
+        type: string
+      isSystem:
+        type: boolean
+      name:
+        type: string
+      uid:
+        type: string
+    type: object
+  kubernetes.K8sClusterRoleBinding:
+    properties:
+      creationDate:
+        type: string
+      isSystem:
+        type: boolean
+      name:
+        type: string
+      namespace:
+        type: string
+      roleRef:
+        $ref: '#/definitions/v1.RoleRef'
+      subjects:
+        items:
+          $ref: '#/definitions/k8s_io_api_rbac_v1.Subject'
+        type: array
+      uid:
+        type: string
+    type: object
+  kubernetes.K8sConfigMap:
+    properties:
+      Annotations:
+        additionalProperties:
+          type: string
+        type: object
+      ConfigurationOwner:
+        type: string
+      ConfigurationOwnerId:
+        type: string
+      ConfigurationOwners:
+        items:
+          $ref: '#/definitions/kubernetes.K8sConfigurationOwnerResource'
+        type: array
+      CreationDate:
+        type: string
+      Data:
+        additionalProperties:
+          type: string
+        type: object
+      IsUsed:
+        type: boolean
+      Labels:
+        additionalProperties:
+          type: string
+        type: object
+      Name:
+        type: string
+      Namespace:
+        type: string
+      UID:
+        type: string
+    type: object
+  kubernetes.K8sConfigurationOwnerResource:
+    properties:
+      Id:
+        type: string
+      Name:
+        type: string
+      ResourceKind:
+        type: string
+    type: object
+  kubernetes.K8sCronJob:
+    properties:
+      Command:
+        type: string
+      Id:
+        type: string
+      IsSystem:
+        type: boolean
+      Jobs:
+        items:
+          $ref: '#/definitions/kubernetes.K8sJob'
+        type: array
+      Name:
+        type: string
+      Namespace:
+        type: string
+      Schedule:
+        type: string
+      Suspend:
+        type: boolean
+      Timezone:
+        type: string
+    type: object
+  kubernetes.K8sCronJobDeleteRequests:
+    additionalProperties:
+      items:
+        type: string
+      type: array
+    type: object
+  kubernetes.K8sDashboard:
+    properties:
+      applicationsCount:
+        type: integer
+      configMapsCount:
+        type: integer
+      ingressesCount:
+        type: integer
+      namespacesCount:
+        type: integer
+      secretsCount:
+        type: integer
+      servicesCount:
+        type: integer
+      volumesCount:
+        type: integer
+    type: object
+  kubernetes.K8sEvent:
+    properties:
+      count:
+        type: integer
+      eventTime:
+        type: string
+      firstTimestamp:
+        type: string
+      involvedObject:
+        $ref: '#/definitions/kubernetes.K8sEventInvolvedObject'
+      kind:
+        type: string
+      lastTimestamp:
+        type: string
+      message:
+        type: string
+      name:
+        type: string
+      namespace:
+        type: string
+      reason:
+        type: string
+      type:
+        type: string
+      uid:
+        type: string
+    type: object
+  kubernetes.K8sEventInvolvedObject:
+    properties:
+      kind:
+        type: string
+      name:
+        type: string
+      namespace:
+        type: string
+      uid:
+        type: string
+    type: object
+  kubernetes.K8sIngressController:
+    properties:
+      Availability:
+        type: boolean
+      ClassName:
+        type: string
+      Name:
+        type: string
+      New:
+        type: boolean
+      Type:
+        type: string
+      Used:
+        type: boolean
+    type: object
+  kubernetes.K8sIngressDeleteRequests:
+    additionalProperties:
+      items:
+        type: string
+      type: array
+    type: object
+  kubernetes.K8sIngressInfo:
+    properties:
+      Annotations:
+        additionalProperties:
+          type: string
+        type: object
+      ClassName:
+        type: string
+      CreationDate:
+        type: string
+      Hosts:
+        items:
+          type: string
+        type: array
+      Labels:
+        additionalProperties:
+          type: string
+        type: object
+      Name:
+        type: string
+      Namespace:
+        type: string
+      Paths:
+        items:
+          $ref: '#/definitions/kubernetes.K8sIngressPath'
+        type: array
+      TLS:
+        items:
+          $ref: '#/definitions/kubernetes.K8sIngressTLS'
+        type: array
+      Type:
+        type: string
+      UID:
+        type: string
+    type: object
+  kubernetes.K8sIngressPath:
+    properties:
+      HasService:
+        type: boolean
+      Host:
+        type: string
+      IngressName:
+        type: string
+      Path:
+        type: string
+      PathType:
+        type: string
+      Port:
+        type: integer
+      ServiceName:
+        type: string
+    type: object
+  kubernetes.K8sIngressTLS:
+    properties:
+      Hosts:
+        items:
+          type: string
+        type: array
+      SecretName:
+        type: string
+    type: object
+  kubernetes.K8sJob:
+    properties:
+      BackoffLimit:
+        type: integer
+      Command:
+        type: string
+      Completions:
+        type: integer
+      Container:
+        $ref: '#/definitions/v1.Container'
+      Duration:
+        type: string
+      FailedReason:
+        type: string
+      FinishTime:
+        type: string
+      Id:
+        type: string
+      IsSystem:
+        type: boolean
+      Name:
+        type: string
+      Namespace:
+        type: string
+      PodName:
+        type: string
+      StartTime:
+        type: string
+      Status:
+        type: string
+    type: object
+  kubernetes.K8sJobDeleteRequests:
+    additionalProperties:
+      items:
+        type: string
+      type: array
+    type: object
+  kubernetes.K8sNamespaceDetails:
+    properties:
+      Annotations:
+        additionalProperties:
+          type: string
+        type: object
+      Name:
+        type: string
+      Owner:
+        type: string
+      ResourceQuota:
+        $ref: '#/definitions/kubernetes.K8sResourceQuota'
+    type: object
+  kubernetes.K8sPVCResizeRequest:
+    properties:
+      name:
+        type: string
+      namespace:
+        type: string
+      newSize:
+        type: string
+    type: object
+  kubernetes.K8sPVReclaimPolicyRequest:
+    properties:
+      name:
+        type: string
+      reclaimPolicy:
+        $ref: '#/definitions/v1.PersistentVolumeReclaimPolicy'
+    type: object
+  kubernetes.K8sPersistentVolume:
+    properties:
+      accessModes:
+        items:
+          type: string
+        type: array
+      annotations:
+        additionalProperties:
+          type: string
+        type: object
+      capacity:
+        $ref: '#/definitions/v1.ResourceList'
+      claimRef:
+        $ref: '#/definitions/k8s_io_api_core_v1.ObjectReference'
+      creationDate:
+        type: string
+      csi:
+        $ref: '#/definitions/v1.CSIPersistentVolumeSource'
+      humanReadableAccessModes:
+        items:
+          $ref: '#/definitions/v1.PersistentVolumeAccessMode'
+        type: array
+      labels:
+        additionalProperties:
+          type: string
+        type: object
+      name:
+        type: string
+      persistentVolumeReclaimPolicy:
+        $ref: '#/definitions/v1.PersistentVolumeReclaimPolicy'
+      status:
+        $ref: '#/definitions/v1.PersistentVolumePhase'
+      storageClassName:
+        type: string
+      volumeMode:
+        $ref: '#/definitions/v1.PersistentVolumeMode'
+    type: object
+  kubernetes.K8sPersistentVolumeClaim:
+    properties:
+      accessModes:
+        items:
+          type: string
+        type: array
+      allowVolumeExpansion:
+        type: boolean
+      creationDate:
+        type: string
+      humanReadableAccessModes:
+        items:
+          $ref: '#/definitions/v1.PersistentVolumeAccessMode'
+        type: array
+      id:
+        type: string
+      labels:
+        additionalProperties:
+          type: string
+        type: object
+      name:
+        type: string
+      namespace:
+        type: string
+      owningApplications:
+        items:
+          $ref: '#/definitions/kubernetes.K8sApplication'
+        type: array
+      phase:
+        $ref: '#/definitions/v1.PersistentVolumeClaimPhase'
+      resourcesRequests:
+        $ref: '#/definitions/v1.ResourceList'
+      storage:
+        type: integer
+      storageClass:
+        type: string
+      storageRequest:
+        type: string
+      volumeMode:
+        $ref: '#/definitions/v1.PersistentVolumeMode'
+      volumeName:
+        type: string
+    type: object
+  kubernetes.K8sResourceQuota:
+    properties:
+      cpu:
+        type: string
+      enabled:
+        type: boolean
+      memory:
+        type: string
+    type: object
+  kubernetes.K8sRole:
+    properties:
+      creationDate:
+        type: string
+      isSystem:
+        description: |-
+          isSystem is true if prefixed with "system:" or exists in the kube-system namespace
+          or is one of the portainer roles
+        type: boolean
+      name:
+        type: string
+      namespace:
+        type: string
+      uid:
+        type: string
+    type: object
+  kubernetes.K8sRoleBinding:
+    properties:
+      creationDate:
+        type: string
+      isSystem:
+        type: boolean
+      name:
+        type: string
+      namespace:
+        type: string
+      roleRef:
+        $ref: '#/definitions/v1.RoleRef'
+      subjects:
+        items:
+          $ref: '#/definitions/k8s_io_api_rbac_v1.Subject'
+        type: array
+      uid:
+        type: string
+    type: object
+  kubernetes.K8sRoleBindingDeleteRequests:
+    additionalProperties:
+      items:
+        type: string
+      type: array
+    type: object
+  kubernetes.K8sRoleDeleteRequests:
+    additionalProperties:
+      items:
+        type: string
+      type: array
+    type: object
+  kubernetes.K8sSecret:
+    properties:
+      Annotations:
+        additionalProperties:
+          type: string
+        type: object
+      ConfigurationOwner:
+        type: string
+      ConfigurationOwnerId:
+        type: string
+      ConfigurationOwners:
+        items:
+          $ref: '#/definitions/kubernetes.K8sConfigurationOwnerResource'
+        type: array
+      CreationDate:
+        type: string
+      Data:
+        additionalProperties:
+          type: string
+        type: object
+      IsUsed:
+        type: boolean
+      Labels:
+        additionalProperties:
+          type: string
+        type: object
+      Name:
+        type: string
+      Namespace:
+        type: string
+      SecretType:
+        type: string
+      UID:
+        type: string
+    type: object
+  kubernetes.K8sServiceAccount:
+    properties:
+      annotations:
+        additionalProperties:
+          type: string
+        type: object
+      automountServiceAccountToken:
+        type: boolean
+      creationDate:
+        type: string
+      imagePullSecrets:
+        items:
+          $ref: '#/definitions/k8s_io_api_core_v1.LocalObjectReference'
+        type: array
+      isSystem:
+        type: boolean
+      labels:
+        additionalProperties:
+          type: string
+        type: object
+      name:
+        type: string
+      namespace:
+        type: string
+      uid:
+        type: string
+    type: object
+  kubernetes.K8sServiceAccountDeleteRequests:
+    additionalProperties:
+      items:
+        type: string
+      type: array
+    type: object
+  kubernetes.K8sServiceAccountImagePullSecretsUpdatePayload:
+    properties:
+      secretNames:
+        items:
+          type: string
+        type: array
+    type: object
+  kubernetes.K8sServiceDeleteRequests:
+    additionalProperties:
+      items:
+        type: string
+      type: array
+    type: object
+  kubernetes.K8sServiceInfo:
+    properties:
+      AllocateLoadBalancerNodePorts:
+        type: boolean
+      Annotations:
+        additionalProperties:
+          type: string
+        type: object
+      Applications:
+        description: serviceList screen
+        items:
+          $ref: '#/definitions/kubernetes.K8sApplication'
+        type: array
+      ClusterIPs:
+        items:
+          type: string
+        type: array
+      CreationDate:
+        type: string
+      ExternalIPs:
+        items:
+          type: string
+        type: array
+      ExternalName:
+        type: string
+      IngressStatus:
+        items:
+          $ref: '#/definitions/kubernetes.K8sServiceIngress'
+        type: array
+      Labels:
+        additionalProperties:
+          type: string
+        type: object
+      Name:
+        type: string
+      Namespace:
+        type: string
+      Ports:
+        items:
+          $ref: '#/definitions/kubernetes.K8sServicePort'
+        type: array
+      Selector:
+        additionalProperties:
+          type: string
+        type: object
+      Type:
+        type: string
+      UID:
+        type: string
+    type: object
+  kubernetes.K8sServiceIngress:
+    properties:
+      Hostname:
+        type: string
+      IP:
+        type: string
+    type: object
+  kubernetes.K8sServicePort:
+    properties:
+      Name:
+        type: string
+      NodePort:
+        type: integer
+      Port:
+        type: integer
+      Protocol:
+        type: string
+      TargetPort:
+        type: string
+    type: object
+  kubernetes.K8sStorageClass:
+    properties:
+      allowVolumeExpansion:
+        type: boolean
+      annotations:
+        additionalProperties:
+          type: string
+        type: object
+      creationDate:
+        type: string
+      isDefault:
+        type: boolean
+      labels:
+        additionalProperties:
+          type: string
+        type: object
+      mountOptions:
+        items:
+          type: string
+        type: array
+      name:
+        type: string
+      parameters:
+        additionalProperties:
+          type: string
+        type: object
+      provisioner:
+        type: string
+      reclaimPolicy:
+        $ref: '#/definitions/v1.PersistentVolumeReclaimPolicy'
+    type: object
+  kubernetes.K8sVolumeDeleteRequest:
+    properties:
+      name:
+        type: string
+      namespace:
+        type: string
+    type: object
+  kubernetes.K8sVolumeInfo:
+    properties:
+      persistentVolume:
+        $ref: '#/definitions/kubernetes.K8sPersistentVolume'
+      persistentVolumeClaim:
+        $ref: '#/definitions/kubernetes.K8sPersistentVolumeClaim'
+      storageClass:
+        $ref: '#/definitions/kubernetes.K8sStorageClass'
+    type: object
+  kubernetes.KubernetesNodeResponse:
+    properties:
+      apiVersion:
+        description: |-
+          APIVersion defines the versioned schema of this representation of an object.
+          Servers should convert recognized schemas to the latest internal value, and
+          may reject unrecognized values.
+          More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+          +optional
+        type: string
+      kind:
+        description: |-
+          Kind is a string value representing the REST resource this object represents.
+          Servers may infer this from the endpoint the client submits requests to.
+          Cannot be updated.
+          In CamelCase.
+          More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+          +optional
+        type: string
+      metadata:
+        allOf:
+        - $ref: '#/definitions/v1.ObjectMeta'
+        description: |-
+          Standard object's metadata.
+          More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+          +optional
+      spec:
+        allOf:
+        - $ref: '#/definitions/v1.NodeSpec'
+        description: |-
+          Spec defines the behavior of a node.
+          https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+          +optional
+      status:
+        allOf:
+        - $ref: '#/definitions/v1.NodeStatus'
+        description: |-
+          Most recently observed status of the node.
+          Populated by the system.
+          Read-only.
+          More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+          +optional
+    type: object
+  kubernetes.Metadata:
+    properties:
+      annotations:
+        additionalProperties:
+          type: string
+        type: object
+      labels:
+        additionalProperties:
+          type: string
+        type: object
+    type: object
+  kubernetes.Pod:
+    properties:
+      ContainerName:
+        type: string
+      CreationDate:
+        type: string
+      Image:
+        type: string
+      ImagePullPolicy:
+        type: string
+      Name:
+        type: string
+      NodeName:
+        type: string
+      PodIP:
+        type: string
+      Resource:
+        $ref: '#/definitions/kubernetes.K8sApplicationResource'
+      Status:
+        type: string
+      Uid:
+        type: string
+    type: object
+  kubernetes.PublishedPort:
+    properties:
+      IngressRules:
+        items:
+          $ref: '#/definitions/kubernetes.IngressRule'
+        type: array
+      Port:
+        type: integer
+    type: object
+  kubernetes.TLSInfo:
+    properties:
+      hosts:
+        items:
+          type: string
+        type: array
+    type: object
+  kubernetes.describeResourceResponse:
+    properties:
+      describe:
+        type: string
+    type: object
+  kubernetes.kubernetesVersionResponse:
+    properties:
+      buildDate:
+        type: string
+      compiler:
+        type: string
+      emulationMajor:
+        description: EmulationMajor is the major version of the emulation version
+        type: string
+      emulationMinor:
+        description: EmulationMinor is the minor version of the emulation version
+        type: string
+      gitCommit:
+        type: string
+      gitTreeState:
+        type: string
+      gitVersion:
+        type: string
+      goVersion:
+        type: string
+      major:
+        description: Major is the major version of the binary version
+        type: string
+      minCompatibilityMajor:
+        description: MinCompatibilityMajor is the major version of the minimum compatibility
+          version
+        type: string
+      minCompatibilityMinor:
+        description: MinCompatibilityMinor is the minor version of the minimum compatibility
+          version
+        type: string
+      minor:
+        description: Minor is the minor version of the binary version
+        type: string
+      platform:
+        type: string
+      supportsPodRestart:
+        description: |-
+          SupportsPodRestart is true when the cluster exposes the `pods/restart`
+          subresource via API discovery — i.e. the feature gate is enabled and
+          the cluster version is recent enough. This is the authoritative
+          signal for whether Portainer can call the pod-restart endpoint, and
+          is preferred over a raw Kubernetes-version comparison.
+        type: boolean
+    type: object
+  kubernetes.namespacesToggleSystemPayload:
+    properties:
+      System:
+        description: Toggle the system state of this namespace to true or false
+        example: true
+        type: boolean
+    type: object
+  ldap.checkPayload:
+    properties:
+      LDAPSettings:
+        $ref: '#/definitions/portainer.LDAPSettings'
+    type: object
+  motd.Motd:
+    properties:
+      ContentLayout:
+        additionalProperties:
+          type: string
+        type: object
+      Hash:
+        items:
+          type: integer
+        type: array
+      Message:
+        type: string
+      Style:
+        type: string
+      Title:
+        type: string
+    type: object
+  oauth2.AuthStyle:
+    enum:
+    - 0
+    - 1
+    - 2
+    type: integer
+    x-enum-varnames:
+    - AuthStyleAutoDetect
+    - AuthStyleInParams
+    - AuthStyleInHeader
+  platform.ContainerPlatform:
+    enum:
+    - Docker
+    - Docker Standalone
+    - Docker Swarm
+    - Kubernetes
+    - Podman
+    type: string
+    x-enum-varnames:
+    - PlatformDocker
+    - PlatformDockerStandalone
+    - PlatformDockerSwarm
+    - PlatformKubernetes
+    - PlatformPodman
+  portainer.APIKey:
+    properties:
+      dateCreated:
+        description: Unix timestamp (UTC) when the API key was created
+        type: integer
+      description:
+        example: portainer-api-key
+        type: string
+      digest:
+        description: Digest represents SHA256 hash of the raw API key
+        type: string
+      id:
+        example: 1
+        type: integer
+      lastUsed:
+        description: Unix timestamp (UTC) when the API key was last used
+        type: integer
+      prefix:
+        description: API key identifier (7 char prefix)
+        type: string
+      userId:
+        example: 1
+        type: integer
+    type: object
+  portainer.AccessPolicy:
+    properties:
+      Namespaces:
+        description: Namespaces is a list of namespaces that this access policy applies
+          to. Only used for namespaced level roles
+        items:
+          type: string
+        type: array
+      RoleId:
+        description: Role identifier. Reference the role that will be associated to
+          this access policy
+        example: 1
+        type: integer
+    required:
+    - RoleId
+    type: object
+  portainer.Artifact:
+    properties:
+      edgeGroups:
+        items:
+          type: integer
+        type: array
+      edgeStackId:
+        type: integer
+      envGroups:
+        items:
+          type: integer
+        type: array
+      envIds:
+        items:
+          type: integer
+        type: array
+      files:
+        items:
+          $ref: '#/definitions/portainer.ArtifactFile'
+        type: array
+      stackId:
+        type: integer
+    type: object
+  portainer.ArtifactFile:
+    properties:
+      hash:
+        example: abc123
+        type: string
+      path:
+        example: portainer.yaml
+        type: string
+      pathError:
+        type: string
+      pathStatus:
+        $ref: '#/definitions/portainer.SourceStatus'
+      ref:
+        example: refs/heads/main
+        type: string
+      refError:
+        type: string
+      refStatus:
+        $ref: '#/definitions/portainer.SourceStatus'
+      sourceId:
+        type: integer
+    type: object
+  portainer.AuthenticationMethod:
+    enum:
+    - 0
+    - 1
+    - 2
+    - 3
+    type: integer
+    x-enum-varnames:
+    - _
+    - AuthenticationInternal
+    - AuthenticationLDAP
+    - AuthenticationOAuth
+  portainer.Authorizations:
+    additionalProperties:
+      type: boolean
+    type: object
+  portainer.AutoUpdateSettings:
+    properties:
+      ForcePullImage:
+        description: Pull latest image
+        example: false
+        type: boolean
+      ForceUpdate:
+        description: Force update ignores repo changes
+        example: false
+        type: boolean
+      Interval:
+        description: Auto update interval
+        example: 1m30s
+        type: string
+      JobID:
+        description: Autoupdate job id
+        example: "15"
+        type: string
+      Webhook:
+        description: A UUID generated from client
+        example: 05de31a2-79fa-4644-9c12-faa67e5c49f0
+        type: string
+    type: object
+  portainer.AzureCredentials:
+    properties:
+      ApplicationID:
+        description: Azure application ID
+        example: eag7cdo9-o09l-9i83-9dO9-f0b23oe78db4
+        type: string
+      AuthenticationKey:
+        description: Azure authentication key
+        example: cOrXoK/1D35w8YQ8nH1/8ZGwzz45JIYD5jxHKXEQknk=
+        type: string
+      TenantID:
+        description: Azure tenant ID
+        example: 34ddc78d-4fel-2358-8cc1-df84c8o839f5
+        type: string
+    required:
+    - ApplicationID
+    - AuthenticationKey
+    - TenantID
+    type: object
+  portainer.CustomTemplate:
+    properties:
+      CreatedByUserId:
+        description: User identifier who created this template
+        example: 3
+        type: integer
+      Description:
+        description: Description of the template
+        example: High performance web server
+        type: string
+      EdgeTemplate:
+        description: EdgeTemplate indicates if this template purpose for Edge Stack
+        example: false
+        type: boolean
+      EntryPoint:
+        description: Path to the Stack file
+        example: docker-compose.yml
+        type: string
+      GitConfig:
+        $ref: '#/definitions/gittypes.RepoConfig'
+      Id:
+        description: CustomTemplate Identifier
+        example: 1
+        type: integer
+      IsComposeFormat:
+        description: IsComposeFormat indicates if the Kubernetes template is created
+          from a Docker Compose file
+        example: false
+        type: boolean
+      Logo:
+        description: URL of the template's logo
+        example: https://portainer.io/img/logo.svg
+        type: string
+      Note:
+        description: A note that will be displayed in the UI. Supports HTML content
+        example: This is my <b>custom</b> template
+        type: string
+      Platform:
+        allOf:
+        - $ref: '#/definitions/portainer.CustomTemplatePlatform'
+        description: |-
+          Platform associated to the template.
+          Valid values are: 1 - 'linux', 2 - 'windows'
+        enum:
+        - 1
+        - 2
+        example: 1
+      ProjectPath:
+        description: Path on disk to the repository hosting the Stack file
+        example: /data/custom_template/3
+        type: string
+      ResourceControl:
+        $ref: '#/definitions/portainer.ResourceControl'
+      Title:
+        description: Title of the template
+        example: Nginx
+        type: string
+      Type:
+        allOf:
+        - $ref: '#/definitions/portainer.StackType'
+        description: |-
+          Type of created stack:
+          * 1 - swarm
+          * 2 - compose
+          * 3 - kubernetes
+        enum:
+        - 1
+        - 2
+        - 3
+        example: 1
+      Variables:
+        items:
+          $ref: '#/definitions/portainer.CustomTemplateVariableDefinition'
+        type: array
+      artifact:
+        $ref: '#/definitions/portainer.Artifact'
+    type: object
+  portainer.CustomTemplatePlatform:
+    enum:
+    - 0
+    - 1
+    - 2
+    type: integer
+    x-enum-varnames:
+    - _
+    - CustomTemplatePlatformLinux
+    - CustomTemplatePlatformWindows
+  portainer.CustomTemplateVariableDefinition:
+    properties:
+      defaultValue:
+        example: default value
+        type: string
+      description:
+        example: Description
+        type: string
+      label:
+        example: My Variable
+        type: string
+      name:
+        example: MY_VAR
+        type: string
+    type: object
+  portainer.DiagnosticsData:
+    properties:
+      DNS:
+        additionalProperties:
+          type: string
+        type: object
+      Log:
+        type: string
+      Proxy:
+        additionalProperties:
+          type: string
+        type: object
+      Telnet:
+        additionalProperties:
+          type: string
+        type: object
+    type: object
+  portainer.DockerSnapshot:
+    properties:
+      ContainerCount:
+        type: integer
+      DiagnosticsData:
+        $ref: '#/definitions/portainer.DiagnosticsData'
+      DockerSnapshotRaw:
+        $ref: '#/definitions/portainer.DockerSnapshotRaw'
+      DockerVersion:
+        type: string
+      GpuUseAll:
+        type: boolean
+      GpuUseList:
+        items:
+          type: string
+        type: array
+      HealthyContainerCount:
+        type: integer
+      ImageCount:
+        type: integer
+      IsPodman:
+        type: boolean
+      NodeCount:
+        type: integer
+      PerformanceMetrics:
+        $ref: '#/definitions/portainer.PerformanceMetrics'
+      RunningContainerCount:
+        type: integer
+      ServiceCount:
+        type: integer
+      StackCount:
+        type: integer
+      StoppedContainerCount:
+        type: integer
+      Swarm:
+        type: boolean
+      Time:
+        type: integer
+      TotalCPU:
+        type: integer
+      TotalMemory:
+        type: integer
+      UnhealthyContainerCount:
+        type: integer
+      VolumeCount:
+        type: integer
+    required:
+    - ContainerCount
+    - DockerVersion
+    - GpuUseAll
+    - HealthyContainerCount
+    - ImageCount
+    - IsPodman
+    - NodeCount
+    - RunningContainerCount
+    - ServiceCount
+    - StackCount
+    - StoppedContainerCount
+    - Swarm
+    - Time
+    - TotalCPU
+    - TotalMemory
+    - UnhealthyContainerCount
+    - VolumeCount
+    type: object
+  portainer.DockerSnapshotRaw:
+    type: object
+  portainer.EcrData:
+    properties:
+      Region:
+        example: ap-southeast-2
+        type: string
+    type: object
+  portainer.Edge:
+    properties:
+      AsyncMode:
+        description: Deprecated 2.18
+        example: false
+        type: boolean
+      CommandInterval:
+        description: The command list interval for edge agent - used in edge async
+          mode (in seconds)
+        example: 5
+        type: integer
+      PingInterval:
+        description: The ping interval for edge agent - used in edge async mode (in
+          seconds)
+        example: 5
+        type: integer
+      SnapshotInterval:
+        description: The snapshot interval for edge agent - used in edge async mode
+          (in seconds)
+        example: 5
+        type: integer
+    type: object
+  portainer.EdgeGroup:
+    properties:
+      Dynamic:
+        type: boolean
+      EndpointIds:
+        $ref: '#/definitions/roar.Roar-portainer_EndpointID'
+      Endpoints:
+        description: 'Deprecated: only used for API responses'
+        items:
+          type: integer
+        type: array
+      Id:
+        description: EdgeGroup Identifier
+        example: 1
+        type: integer
+      Name:
+        type: string
+      PartialMatch:
+        type: boolean
+      TagIds:
+        items:
+          type: integer
+        type: array
+    type: object
+  portainer.EdgeJob:
+    properties:
+      Created:
+        type: integer
+      CronExpression:
+        type: string
+      EdgeGroups:
+        items:
+          type: integer
+        type: array
+      Endpoints:
+        additionalProperties:
+          $ref: '#/definitions/portainer.EdgeJobEndpointMeta'
+        type: object
+      GroupLogsCollection:
+        additionalProperties:
+          $ref: '#/definitions/portainer.EdgeJobEndpointMeta'
+        description: Field used for log collection of Endpoints belonging to EdgeGroups
+        type: object
+      Id:
+        description: EdgeJob Identifier
+        example: 1
+        type: integer
+      Name:
+        type: string
+      Recurring:
+        type: boolean
+      ScriptPath:
+        type: string
+      Version:
+        type: integer
+    type: object
+  portainer.EdgeJobEndpointMeta:
+    properties:
+      CollectLogs:
+        type: boolean
+      LogsStatus:
+        $ref: '#/definitions/portainer.EdgeJobLogsStatus'
+    type: object
+  portainer.EdgeJobLogsStatus:
+    enum:
+    - 0
+    - 1
+    - 2
+    - 3
+    type: integer
+    x-enum-varnames:
+    - _
+    - EdgeJobLogsStatusIdle
+    - EdgeJobLogsStatusPending
+    - EdgeJobLogsStatusCollected
+  portainer.EdgeStack:
+    properties:
+      CreatedBy:
+        description: The username which created this stack
+        example: admin
+        type: string
+      CreatedByUserId:
+        description: The username id which created this stack
+        example: "1"
+        type: string
+      CreationDate:
+        description: StatusArray    map[EndpointID][]EdgeStackStatus `json:"StatusArray"`
+        type: integer
+      DeploymentType:
+        $ref: '#/definitions/portainer.EdgeStackDeploymentType'
+      EdgeGroups:
+        items:
+          type: integer
+        type: array
+      EntryPoint:
+        type: string
+      Id:
+        description: EdgeStack Identifier
+        example: 1
+        type: integer
+      ManifestPath:
+        type: string
+      Name:
+        type: string
+      NumDeployments:
+        type: integer
+      ProjectPath:
+        type: string
+      Status:
+        additionalProperties:
+          $ref: '#/definitions/portainer.EdgeStackStatus'
+        type: object
+      UseManifestNamespaces:
+        description: Uses the manifest's namespaces instead of the default one
+        type: boolean
+      Version:
+        type: integer
+    type: object
+  portainer.EdgeStackDeploymentStatus:
+    properties:
+      Error:
+        type: string
+      RollbackTo:
+        description: EE only feature
+        type: integer
+      Time:
+        format: int64
+        type: integer
+      Type:
+        $ref: '#/definitions/portainer.EdgeStackStatusType'
+      Version:
+        type: integer
+    type: object
+  portainer.EdgeStackDeploymentType:
+    enum:
+    - 0
+    - 1
+    type: integer
+    x-enum-varnames:
+    - EdgeStackDeploymentCompose
+    - EdgeStackDeploymentKubernetes
+  portainer.EdgeStackStatus:
+    properties:
+      DeploymentInfo:
+        allOf:
+        - $ref: '#/definitions/portainer.StackDeploymentInfo'
+        description: EE only feature
+      Details:
+        allOf:
+        - $ref: '#/definitions/portainer.EdgeStackStatusDetails'
+        description: Deprecated
+      EndpointID:
+        type: integer
+      Error:
+        description: Deprecated
+        type: string
+      ReadyRePullImage:
+        description: ReadyRePullImage is a flag to indicate whether the auto update
+          is trigger to re-pull image
+        type: boolean
+      Status:
+        items:
+          $ref: '#/definitions/portainer.EdgeStackDeploymentStatus'
+        type: array
+      Type:
+        allOf:
+        - $ref: '#/definitions/portainer.EdgeStackStatusType'
+        description: Deprecated
+    type: object
+  portainer.EdgeStackStatusDetails:
+    properties:
+      Acknowledged:
+        type: boolean
+      Error:
+        type: boolean
+      ImagesPulled:
+        type: boolean
+      Ok:
+        type: boolean
+      Pending:
+        type: boolean
+      RemoteUpdateSuccess:
+        type: boolean
+      Remove:
+        type: boolean
+    type: object
+  portainer.EdgeStackStatusType:
+    enum:
+    - 0
+    - 1
+    - 2
+    - 3
+    - 4
+    - 5
+    - 6
+    - 7
+    - 8
+    - 9
+    - 10
+    - 11
+    - 12
+    - 13
+    type: integer
+    x-enum-varnames:
+    - EdgeStackStatusPending
+    - EdgeStackStatusDeploymentReceived
+    - EdgeStackStatusError
+    - EdgeStackStatusAcknowledged
+    - EdgeStackStatusRemoved
+    - EdgeStackStatusRemoteUpdateSuccess
+    - EdgeStackStatusImagesPulled
+    - EdgeStackStatusRunning
+    - EdgeStackStatusDeploying
+    - EdgeStackStatusRemoving
+    - EdgeStackStatusPausedDeploying
+    - EdgeStackStatusRollingBack
+    - EdgeStackStatusRolledBack
+    - EdgeStackStatusCompleted
+  portainer.Endpoint:
+    properties:
+      Agent:
+        $ref: '#/definitions/portainer.EnvironmentAgentData'
+      AzureCredentials:
+        $ref: '#/definitions/portainer.AzureCredentials'
+      ComposeSyntaxMaxVersion:
+        description: Maximum version of docker-compose
+        example: "3.8"
+        type: string
+      ContainerEngine:
+        description: ContainerEngine represents the container engine type. This can
+          be 'docker' or 'podman' when interacting directly with these environments,
+          otherwise '' for kubernetes environments.
+        example: docker
+        type: string
+      Edge:
+        $ref: '#/definitions/portainer.EnvironmentEdgeSettings'
+      EdgeCheckinInterval:
+        description: The check in interval for edge agent (in seconds)
+        example: 5
+        type: integer
+      EdgeID:
+        description: The identifier of the edge agent associated with this environment(endpoint)
+        type: string
+      EdgeKey:
+        description: The key which is used to map the agent to Portainer
+        type: string
+      EnableGPUManagement:
+        type: boolean
+      Gpus:
+        items:
+          $ref: '#/definitions/portainer.Pair'
+        type: array
+      GroupId:
+        description: Environment(Endpoint) group identifier
+        example: 1
+        type: integer
+      Heartbeat:
+        description: Heartbeat indicates the heartbeat status of an edge environment
+        example: true
+        type: boolean
+      Id:
+        description: Environment(Endpoint) Identifier
+        example: 1
+        type: integer
+      Kubernetes:
+        allOf:
+        - $ref: '#/definitions/portainer.KubernetesData'
+        description: Associated Kubernetes data
+      LastCheckInDate:
+        description: LastCheckInDate mark last check-in date on checkin
+        type: integer
+      Name:
+        description: Environment(Endpoint) name
+        example: my-environment
+        type: string
+      PublicURL:
+        description: URL or IP address where exposed containers will be reachable
+        example: docker.mydomain.tld:2375
+        type: string
+      SecuritySettings:
+        allOf:
+        - $ref: '#/definitions/portainer.EndpointSecuritySettings'
+        description: Environment(Endpoint) specific security settings
+      Snapshots:
+        description: List of snapshots
+        items:
+          $ref: '#/definitions/portainer.DockerSnapshot'
+        type: array
+      Status:
+        allOf:
+        - $ref: '#/definitions/portainer.EndpointStatus'
+        description: The status of the environment(endpoint) (1 - up, 2 - down, 3
+          - provisioning, 4 - error)
+        enum:
+        - 1
+        - 2
+        - 3
+        - 4
+        example: 1
+      TLSConfig:
+        $ref: '#/definitions/portainer.TLSConfiguration'
+      TagIds:
+        description: List of tag identifiers to which this environment(endpoint) is
+          associated
+        items:
+          type: integer
+        type: array
+      TeamAccessPolicies:
+        allOf:
+        - $ref: '#/definitions/portainer.TeamAccessPolicies'
+        description: List of team identifiers authorized to connect to this environment(endpoint)
+      Type:
+        allOf:
+        - $ref: '#/definitions/portainer.EndpointType'
+        description: Environment(Endpoint) environment(endpoint) type. 1 for a Docker
+          environment(endpoint), 2 for an agent on Docker environment(endpoint) or
+          3 for an Azure environment(endpoint).
+        example: 1
+      URL:
+        description: URL or IP address of the Docker host associated to this environment(endpoint)
+        example: docker.mydomain.tld:2375
+        type: string
+      UserAccessPolicies:
+        allOf:
+        - $ref: '#/definitions/portainer.UserAccessPolicies'
+        description: List of user identifiers authorized to connect to this environment(endpoint)
+      UserTrusted:
+        description: Whether the device has been trusted or not by the user
+        type: boolean
+    required:
+    - Agent
+    - ComposeSyntaxMaxVersion
+    - ContainerEngine
+    - Edge
+    - EdgeCheckinInterval
+    - EdgeKey
+    - GroupId
+    - Id
+    - Kubernetes
+    - LastCheckInDate
+    - Name
+    - PublicURL
+    - SecuritySettings
+    - TLSConfig
+    - Type
+    - URL
+    type: object
+  portainer.EndpointGroup:
+    properties:
+      Description:
+        description: Description associated to the environment(endpoint) group
+        example: Environment(Endpoint) group description
+        type: string
+      Id:
+        description: Environment(Endpoint) group Identifier
+        example: 1
+        type: integer
+      Name:
+        description: Environment(Endpoint) group name
+        example: my-environment-group
+        type: string
+      TagIds:
+        description: List of tags associated to this environment(endpoint) group
+        items:
+          type: integer
+        type: array
+      TeamAccessPolicies:
+        $ref: '#/definitions/portainer.TeamAccessPolicies'
+      UserAccessPolicies:
+        $ref: '#/definitions/portainer.UserAccessPolicies'
+    required:
+    - Description
+    - Id
+    - Name
+    type: object
+  portainer.EndpointSecuritySettings:
+    properties:
+      allowBindMountsForRegularUsers:
+        description: Whether non-administrator should be able to use bind mounts when
+          creating containers
+        example: false
+        type: boolean
+      allowContainerCapabilitiesForRegularUsers:
+        description: Whether non-administrator should be able to use container capabilities
+        example: true
+        type: boolean
+      allowDeviceMappingForRegularUsers:
+        description: Whether non-administrator should be able to use device mapping
+        example: true
+        type: boolean
+      allowHostNamespaceForRegularUsers:
+        description: Whether non-administrator should be able to use the host pid
+        example: true
+        type: boolean
+      allowPrivilegedModeForRegularUsers:
+        description: Whether non-administrator should be able to use privileged mode
+          when creating containers
+        example: false
+        type: boolean
+      allowSecurityOptForRegularUsers:
+        description: Whether non-administrator should be able to use security-opt
+          settings
+        example: true
+        type: boolean
+      allowStackManagementForRegularUsers:
+        description: Whether non-administrator should be able to manage stacks
+        example: true
+        type: boolean
+      allowSysctlSettingForRegularUsers:
+        description: Whether non-administrator should be able to use sysctl settings
+        example: true
+        type: boolean
+      allowVolumeBrowserForRegularUsers:
+        description: Whether non-administrator should be able to browse volumes
+        example: true
+        type: boolean
+      enableHostManagementFeatures:
+        description: Whether host management features are enabled
+        example: true
+        type: boolean
+    required:
+    - allowBindMountsForRegularUsers
+    - allowContainerCapabilitiesForRegularUsers
+    - allowDeviceMappingForRegularUsers
+    - allowHostNamespaceForRegularUsers
+    - allowPrivilegedModeForRegularUsers
+    - allowSecurityOptForRegularUsers
+    - allowStackManagementForRegularUsers
+    - allowSysctlSettingForRegularUsers
+    - allowVolumeBrowserForRegularUsers
+    - enableHostManagementFeatures
+    type: object
+  portainer.EndpointStatus:
+    enum:
+    - 0
+    - 1
+    - 2
+    type: integer
+    x-enum-varnames:
+    - _
+    - EndpointStatusUp
+    - EndpointStatusDown
+  portainer.EndpointType:
+    enum:
+    - 0
+    - 1
+    - 2
+    - 3
+    - 4
+    - 5
+    - 6
+    - 7
+    type: integer
+    x-enum-varnames:
+    - _
+    - DockerEnvironment
+    - AgentOnDockerEnvironment
+    - AzureEnvironment
+    - EdgeAgentOnDockerEnvironment
+    - KubernetesLocalEnvironment
+    - AgentOnKubernetesEnvironment
+    - EdgeAgentOnKubernetesEnvironment
+  portainer.EnvironmentAgentData:
+    properties:
+      Version:
+        example: 1.0.0
+        type: string
+    type: object
+  portainer.EnvironmentEdgeSettings:
+    properties:
+      AsyncMode:
+        description: Whether the device has been started in edge async mode
+        type: boolean
+      CommandInterval:
+        description: The command list interval for edge agent - used in edge async
+          mode [seconds]
+        example: 60
+        type: integer
+      PingInterval:
+        description: The ping interval for edge agent - used in edge async mode [seconds]
+        example: 60
+        type: integer
+      SnapshotInterval:
+        description: The snapshot interval for edge agent - used in edge async mode
+          [seconds]
+        example: 60
+        type: integer
+    required:
+    - AsyncMode
+    - CommandInterval
+    - PingInterval
+    - SnapshotInterval
+    type: object
+  portainer.GithubRegistryData:
+    properties:
+      OrganisationName:
+        type: string
+      UseOrganisation:
+        type: boolean
+    type: object
+  portainer.GitlabRegistryData:
+    properties:
+      InstanceURL:
+        type: string
+      ProjectId:
+        type: integer
+      ProjectPath:
+        type: string
+    type: object
+  portainer.GlobalDeploymentOptions:
+    properties:
+      hideStacksFunctionality:
+        example: false
+        type: boolean
+    type: object
+  portainer.HelmConfig:
+    properties:
+      Atomic:
+        description: |-
+          Atomic enables automatic rollback on deployment failure (equivalent to helm --atomic).
+          Used by both git repo and Helm repository deployments.
+        example: true
+        type: boolean
+      ChartName:
+        description: |-
+          ChartName is the name of the Helm chart within the repository.
+          Required for Helm repository deployments.
+        example: nginx
+        type: string
+      ChartPath:
+        description: |-
+          ChartPath is the path to a Helm chart folder within the cloned git repository.
+          Used exclusively for git repo helm deployments. Mutually exclusive with ChartURL.
+        example: charts/my-app
+        type: string
+      ChartURL:
+        description: |-
+          ChartURL is the URL of a Helm chart repository.
+          Used exclusively for Helm repository deployments. Mutually exclusive with ChartPath.
+        example: https://charts.bitnami.com/bitnami
+        type: string
+      ChartVersion:
+        description: |-
+          ChartVersion is the version of the Helm chart to deploy. Empty means latest.
+          Used exclusively for Helm repository deployments.
+        example: 15.0.0
+        type: string
+      Namespace:
+        description: |-
+          Namespace is the Kubernetes namespace to deploy the Helm chart into.
+          Used by both git repo and Helm repository deployments.
+        example: default
+        type: string
+      Timeout:
+        description: |-
+          Timeout sets the deadline for Helm operations (equivalent to helm --timeout, e.g. "5m0s").
+          Used by both git repo and Helm repository deployments.
+        example: 5m0s
+        type: string
+      ValuesFiles:
+        description: |-
+          ValuesFiles is a list of relative paths to Helm values YAML files within the cloned git repository.
+          Used exclusively for git repo helm deployments.
+        example:
+        - '[''values/prod.yaml'''
+        - ' ''values/secrets.yaml'']'
+        items:
+          type: string
+        type: array
+      ValuesInline:
+        description: |-
+          ValuesInline is the inline YAML string of Helm values.
+          Used exclusively for Helm repository deployments.
+        example: 'replicaCount: 2'
+        type: string
+    type: object
+  portainer.HelmUserRepository:
+    properties:
+      Id:
+        description: Membership Identifier
+        example: 1
+        type: integer
+      URL:
+        description: Helm repository URL
+        example: https://charts.bitnami.com/bitnami
+        type: string
+      UserId:
+        description: User identifier
+        example: 1
+        type: integer
+    type: object
+  portainer.InternalAuthSettings:
+    properties:
+      RequiredPasswordLength:
+        type: integer
+    type: object
+  portainer.K8sNamespaceInfo:
+    properties:
+      Annotations:
+        additionalProperties:
+          type: string
+        type: object
+      CreationDate:
+        type: string
+      Id:
+        type: string
+      IsDefault:
+        type: boolean
+      IsSystem:
+        type: boolean
+      Name:
+        type: string
+      NamespaceOwner:
+        type: string
+      ResourceQuota:
+        $ref: '#/definitions/v1.ResourceQuota'
+      Status:
+        $ref: '#/definitions/v1.NamespaceStatus'
+      UnhealthyEventCount:
+        type: integer
+    type: object
+  portainer.K8sNodeLimits:
+    properties:
+      CPU:
+        type: integer
+      Memory:
+        type: integer
+    type: object
+  portainer.K8sNodesLimits:
+    additionalProperties:
+      $ref: '#/definitions/portainer.K8sNodeLimits'
+    type: object
+  portainer.KubernetesConfiguration:
+    properties:
+      AllowNoneIngressClass:
+        type: boolean
+      EnableResourceOverCommit:
+        type: boolean
+      IngressAvailabilityPerNamespace:
+        type: boolean
+      IngressClasses:
+        items:
+          $ref: '#/definitions/portainer.KubernetesIngressClassConfig'
+        type: array
+      ResourceOverCommitPercentage:
+        type: integer
+      RestrictDefaultNamespace:
+        type: boolean
+      StorageClasses:
+        items:
+          $ref: '#/definitions/portainer.KubernetesStorageClassConfig'
+        type: array
+      UseLoadBalancer:
+        type: boolean
+      UseServerMetrics:
+        type: boolean
+    required:
+    - AllowNoneIngressClass
+    - IngressAvailabilityPerNamespace
+    type: object
+  portainer.KubernetesData:
+    properties:
+      Configuration:
+        $ref: '#/definitions/portainer.KubernetesConfiguration'
+      Flags:
+        $ref: '#/definitions/portainer.KubernetesFlags'
+      Snapshots:
+        items:
+          $ref: '#/definitions/portainer.KubernetesSnapshot'
+        type: array
+    required:
+    - Configuration
+    - Flags
+    type: object
+  portainer.KubernetesFlags:
+    properties:
+      GPUOperator:
+        type: boolean
+      IsServerIngressClassDetected:
+        type: boolean
+      IsServerMetricsDetected:
+        type: boolean
+      IsServerStorageDetected:
+        type: boolean
+    required:
+    - IsServerIngressClassDetected
+    - IsServerMetricsDetected
+    - IsServerStorageDetected
+    type: object
+  portainer.KubernetesIngressClassConfig:
+    properties:
+      Blocked:
+        type: boolean
+      BlockedNamespaces:
+        items:
+          type: string
+        type: array
+      Name:
+        type: string
+      Type:
+        type: string
+    required:
+    - Name
+    - Type
+    type: object
+  portainer.KubernetesSnapshot:
+    properties:
+      ClusterType:
+        type: string
+      DiagnosticsData:
+        $ref: '#/definitions/portainer.DiagnosticsData'
+      GPUNodeCount:
+        type: integer
+      KubernetesVersion:
+        type: string
+      NodeCount:
+        type: integer
+      PerformanceMetrics:
+        $ref: '#/definitions/portainer.PerformanceMetrics'
+      Time:
+        type: integer
+      TotalCPU:
+        type: integer
+      TotalGPU:
+        additionalProperties:
+          format: int64
+          type: integer
+        type: object
+      TotalMemory:
+        type: integer
+    required:
+    - KubernetesVersion
+    - NodeCount
+    - Time
+    - TotalCPU
+    - TotalMemory
+    type: object
+  portainer.KubernetesStorageClassConfig:
+    properties:
+      AccessModes:
+        items:
+          type: string
+        type: array
+      AllowVolumeExpansion:
+        type: boolean
+      Name:
+        type: string
+      Provisioner:
+        type: string
+    required:
+    - AllowVolumeExpansion
+    - Name
+    - Provisioner
+    type: object
+  portainer.LDAPGroupSearchSettings:
+    properties:
+      GroupAttribute:
+        description: LDAP attribute which denotes the group membership
+        example: member
+        type: string
+      GroupBaseDN:
+        description: The distinguished name of the element from which the LDAP server
+          will search for groups
+        example: dc=ldap,dc=domain,dc=tld
+        type: string
+      GroupFilter:
+        description: The LDAP search filter used to select group elements, optional
+        example: (objectClass=account
+        type: string
+    type: object
+  portainer.LDAPSearchSettings:
+    properties:
+      BaseDN:
+        description: The distinguished name of the element from which the LDAP server
+          will search for users
+        example: dc=ldap,dc=domain,dc=tld
+        type: string
+      Filter:
+        description: Optional LDAP search filter used to select user elements
+        example: (objectClass=account)
+        type: string
+      UserNameAttribute:
+        description: LDAP attribute which denotes the username
+        example: uid
+        type: string
+    type: object
+  portainer.LDAPSettings:
+    properties:
+      AnonymousMode:
+        description: Enable this option if the server is configured for Anonymous
+          access. When enabled, ReaderDN and Password will not be used
+        example: true
+        type: boolean
+      AutoCreateUsers:
+        description: Automatically provision users and assign them to matching LDAP
+          group names
+        example: true
+        type: boolean
+      GroupSearchSettings:
+        items:
+          $ref: '#/definitions/portainer.LDAPGroupSearchSettings'
+        type: array
+      Password:
+        description: Password of the account that will be used to search users
+        example: readonly-password
+        type: string
+      ReaderDN:
+        description: Account that will be used to search for users
+        example: cn=readonly-account,dc=ldap,dc=domain,dc=tld
+        type: string
+      SearchSettings:
+        items:
+          $ref: '#/definitions/portainer.LDAPSearchSettings'
+        type: array
+      StartTLS:
+        description: Whether LDAP connection should use StartTLS
+        example: true
+        type: boolean
+      TLSConfig:
+        $ref: '#/definitions/portainer.TLSConfiguration'
+      URL:
+        description: URL or IP address of the LDAP server
+        example: myldap.domain.tld:389
+        type: string
+    type: object
+  portainer.MembershipRole:
+    enum:
+    - 0
+    - 1
+    - 2
+    type: integer
+    x-enum-varnames:
+    - _
+    - TeamLeader
+    - TeamMember
+  portainer.OAuthSettings:
+    properties:
+      AccessTokenURI:
+        type: string
+      AuthStyle:
+        $ref: '#/definitions/oauth2.AuthStyle'
+      AuthorizationURI:
+        type: string
+      ClientID:
+        type: string
+      ClientSecret:
+        type: string
+      DefaultTeamID:
+        type: integer
+      KubeSecretKey:
+        items:
+          type: integer
+        type: array
+      LogoutURI:
+        type: string
+      OAuthAutoCreateUsers:
+        type: boolean
+      RedirectURI:
+        type: string
+      ResourceURI:
+        type: string
+      SSO:
+        type: boolean
+      Scopes:
+        type: string
+      UserIdentifier:
+        type: string
+    type: object
+  portainer.Pair:
+    properties:
+      name:
+        example: name
+        type: string
+      value:
+        example: value
+        type: string
+    required:
+    - name
+    - value
+    type: object
+  portainer.PerformanceMetrics:
+    properties:
+      CPUUsage:
+        type: number
+      DiskUsage:
+        type: number
+      MemoryUsage:
+        type: number
+      NetworkUsage:
+        type: number
+    type: object
+  portainer.QuayRegistryData:
+    properties:
+      OrganisationName:
+        type: string
+      UseOrganisation:
+        type: boolean
+    type: object
+  portainer.Registry:
+    properties:
+      AccessToken:
+        description: Stores temporary access token
+        type: string
+      AccessTokenExpiry:
+        type: integer
+      Authentication:
+        description: Is authentication against this registry enabled
+        example: true
+        type: boolean
+      AuthorizedTeams:
+        description: Deprecated in DBVersion == 18
+        items:
+          type: integer
+        type: array
+      AuthorizedUsers:
+        description: Deprecated in DBVersion == 18
+        items:
+          type: integer
+        type: array
+      BaseURL:
+        description: Base URL, introduced for ProGet registry
+        example: registry.mydomain.tld:2375
+        type: string
+      Ecr:
+        $ref: '#/definitions/portainer.EcrData'
+      Github:
+        $ref: '#/definitions/portainer.GithubRegistryData'
+      Gitlab:
+        $ref: '#/definitions/portainer.GitlabRegistryData'
+      Id:
+        description: Registry Identifier
+        example: 1
+        type: integer
+      ManagementConfiguration:
+        $ref: '#/definitions/portainer.RegistryManagementConfiguration'
+      Name:
+        description: Registry Name
+        example: my-registry
+        type: string
+      Password:
+        description: Password or SecretAccessKey used to authenticate against this
+          registry
+        example: registry_password
+        type: string
+      Quay:
+        $ref: '#/definitions/portainer.QuayRegistryData'
+      RegistryAccesses:
+        $ref: '#/definitions/portainer.RegistryAccesses'
+      TeamAccessPolicies:
+        allOf:
+        - $ref: '#/definitions/portainer.TeamAccessPolicies'
+        description: Deprecated in DBVersion == 31
+      Type:
+        allOf:
+        - $ref: '#/definitions/portainer.RegistryType'
+        description: Registry Type (1 - Quay, 2 - Azure, 3 - Custom, 4 - Gitlab, 5
+          - ProGet, 6 - DockerHub, 7 - ECR)
+        enum:
+        - 1
+        - 2
+        - 3
+        - 4
+        - 5
+        - 6
+        - 7
+      URL:
+        description: URL or IP address of the Docker registry
+        example: registry.mydomain.tld:2375
+        type: string
+      UserAccessPolicies:
+        allOf:
+        - $ref: '#/definitions/portainer.UserAccessPolicies'
+        description: |-
+          Deprecated fields
+          Deprecated in DBVersion == 31
+      Username:
+        description: Username or AccessKeyID used to authenticate against this registry
+        example: registry user
+        type: string
+    type: object
+  portainer.RegistryAccessPolicies:
+    properties:
+      Namespaces:
+        description: Kubernetes specific fields (with kubernetes, namespaces have
+          access to a registry, if users/teams have access to the same namespace,
+          they have access to the registry)
+        items:
+          type: string
+        type: array
+      TeamAccessPolicies:
+        $ref: '#/definitions/portainer.TeamAccessPolicies'
+      UserAccessPolicies:
+        allOf:
+        - $ref: '#/definitions/portainer.UserAccessPolicies'
+        description: Docker specific fields (with docker, users/teams have access
+          to a registry)
+    type: object
+  portainer.RegistryAccesses:
+    additionalProperties:
+      $ref: '#/definitions/portainer.RegistryAccessPolicies'
+    type: object
+  portainer.RegistryManagementConfiguration:
+    properties:
+      AccessToken:
+        type: string
+      AccessTokenExpiry:
+        type: integer
+      Authentication:
+        type: boolean
+      Ecr:
+        $ref: '#/definitions/portainer.EcrData'
+      Password:
+        type: string
+      TLSConfig:
+        $ref: '#/definitions/portainer.TLSConfiguration'
+      Type:
+        $ref: '#/definitions/portainer.RegistryType'
+      Username:
+        type: string
+    type: object
+  portainer.RegistryType:
+    enum:
+    - 0
+    - 1
+    - 2
+    - 3
+    - 4
+    - 5
+    - 6
+    - 7
+    - 8
+    type: integer
+    x-enum-varnames:
+    - _
+    - QuayRegistry
+    - AzureRegistry
+    - CustomRegistry
+    - GitlabRegistry
+    - ProGetRegistry
+    - DockerHubRegistry
+    - EcrRegistry
+    - GithubRegistry
+  portainer.ResourceAccessLevel:
+    enum:
+    - 0
+    - 1
+    type: integer
+    x-enum-varnames:
+    - _
+    - ReadWriteAccessLevel
+  portainer.ResourceControl:
+    properties:
+      AccessLevel:
+        $ref: '#/definitions/portainer.ResourceAccessLevel'
+      AdministratorsOnly:
+        description: Permit access to resource only to admins
+        example: true
+        type: boolean
+      Id:
+        description: ResourceControl Identifier
+        example: 1
+        type: integer
+      OwnerId:
+        description: |-
+          Deprecated fields
+          Deprecated in DBVersion == 2
+        type: integer
+      Public:
+        description: Permit access to the associated resource to any user
+        example: true
+        type: boolean
+      ResourceId:
+        description: |-
+          Docker resource identifier on which access control will be applied.\
+          In the case of a resource control applied to a stack, use the stack name as identifier
+        example: 617c5f22bb9b023d6daab7cba43a57576f83492867bc767d1c59416b065e5f08
+        type: string
+      SubResourceIds:
+        description: List of Docker resources that will inherit this access control
+        example:
+        - 617c5f22bb9b023d6daab7cba43a57576f83492867bc767d1c59416b065e5f08
+        items:
+          type: string
+        type: array
+      System:
+        type: boolean
+      TeamAccesses:
+        items:
+          $ref: '#/definitions/portainer.TeamResourceAccess'
+        type: array
+      Type:
+        allOf:
+        - $ref: '#/definitions/portainer.ResourceControlType'
+        description: |-
+          Type of Docker resource. Valid values are: 1- container, 2 -service
+          3 - volume, 4 - secret, 5 - stack, 6 - config or 7 - custom template
+        example: 1
+      UserAccesses:
+        items:
+          $ref: '#/definitions/portainer.UserResourceAccess'
+        type: array
+    type: object
+  portainer.ResourceControlType:
+    enum:
+    - 0
+    - 1
+    - 2
+    - 3
+    - 4
+    - 5
+    - 6
+    - 7
+    - 8
+    - 9
+    type: integer
+    x-enum-varnames:
+    - _
+    - ContainerResourceControl
+    - ServiceResourceControl
+    - VolumeResourceControl
+    - NetworkResourceControl
+    - SecretResourceControl
+    - StackResourceControl
+    - ConfigResourceControl
+    - CustomTemplateResourceControl
+    - ContainerGroupResourceControl
+  portainer.Role:
+    properties:
+      Authorizations:
+        allOf:
+        - $ref: '#/definitions/portainer.Authorizations'
+        description: Authorizations associated to a role
+      Description:
+        description: Role description
+        example: Read-only access of all resources in an environment(endpoint)
+        type: string
+      Id:
+        description: Role Identifier
+        example: 1
+        type: integer
+      Name:
+        description: Role name
+        example: HelpDesk
+        type: string
+      Priority:
+        type: integer
+    type: object
+  portainer.SSLSettings:
+    properties:
+      certPath:
+        type: string
+      httpEnabled:
+        type: boolean
+      keyPath:
+        type: string
+      selfSigned:
+        type: boolean
+    type: object
+  portainer.Settings:
+    properties:
+      AgentSecret:
+        description: Container environment parameter AGENT_SECRET
+        type: string
+      AllowBindMountsForRegularUsers:
+        type: boolean
+      AllowContainerCapabilitiesForRegularUsers:
+        type: boolean
+      AllowDeviceMappingForRegularUsers:
+        type: boolean
+      AllowHostNamespaceForRegularUsers:
+        type: boolean
+      AllowPrivilegedModeForRegularUsers:
+        type: boolean
+      AllowStackManagementForRegularUsers:
+        type: boolean
+      AllowVolumeBrowserForRegularUsers:
+        type: boolean
+      AuthenticationMethod:
+        allOf:
+        - $ref: '#/definitions/portainer.AuthenticationMethod'
+        description: 'Active authentication method for the Portainer instance. Valid
+          values are: 1 for internal, 2 for LDAP, or 3 for oauth'
+        example: 1
+      BlackListedLabels:
+        description: A list of label name & value that will be used to hide containers
+          when querying containers
+        items:
+          $ref: '#/definitions/portainer.Pair'
+        type: array
+      DisplayDonationHeader:
+        description: Deprecated fields
+        type: boolean
+      DisplayExternalContributors:
+        type: boolean
+      Edge:
+        $ref: '#/definitions/portainer.Edge'
+      EdgeAgentCheckinInterval:
+        description: The default check in interval for edge agent (in seconds)
+        example: 5
+        type: integer
+      EdgePortainerUrl:
+        description: EdgePortainerURL is the URL that is exposed to edge agents
+        type: string
+      EnableEdgeComputeFeatures:
+        description: Whether edge compute features are enabled
+        type: boolean
+      EnableHostManagementFeatures:
+        description: Deprecated fields v26
+        type: boolean
+      EnforceEdgeID:
+        description: EnforceEdgeID makes Portainer store the Edge ID instead of accepting
+          anyone
+        example: false
+        type: boolean
+      FeatureFlagSettings:
+        additionalProperties:
+          type: boolean
+        type: object
+      ForceSecureCookies:
+        description: |-
+          ForceSecureCookies forces the Secure attribute on auth cookies regardless of detected scheme.
+          Enable when Portainer runs behind a TLS-terminating proxy.
+        example: false
+        type: boolean
+      GlobalDeploymentOptions:
+        allOf:
+        - $ref: '#/definitions/portainer.GlobalDeploymentOptions'
+        description: Deployment options for encouraging git ops workflows
+      HelmRepositoryURL:
+        description: Helm repository URL, defaults to "https://charts.bitnami.com/bitnami"
+        example: https://charts.bitnami.com/bitnami
+        type: string
+      InternalAuthSettings:
+        $ref: '#/definitions/portainer.InternalAuthSettings'
+      IsDockerDesktopExtension:
+        type: boolean
+      KubeconfigExpiry:
+        description: The expiry of a Kubeconfig
+        example: 24h
+        type: string
+      KubectlShellImage:
+        description: KubectlImage, defaults to portainer/kubectl-shell
+        example: portainer/kubectl-shell
+        type: string
+      LDAPSettings:
+        $ref: '#/definitions/portainer.LDAPSettings'
+      LogoURL:
+        description: URL to a logo that will be displayed on the login page as well
+          as on top of the sidebar. Will use default Portainer logo when value is
+          empty string
+        example: https://mycompany.mydomain.tld/logo.png
+        type: string
+      OAuthSettings:
+        $ref: '#/definitions/portainer.OAuthSettings'
+      SnapshotInterval:
+        description: The interval in which environment(endpoint) snapshots are created
+        example: 5m
+        type: string
+      TemplatesURL:
+        description: URL to the templates that will be displayed in the UI when navigating
+          to App Templates
+        example: https://raw.githubusercontent.com/portainer/templates/master/templates.json
+        type: string
+      TrustOnFirstConnect:
+        description: TrustOnFirstConnect makes Portainer accepting edge agent connection
+          by default
+        example: false
+        type: boolean
+      UserSessionTimeout:
+        description: The duration of a user session
+        example: 5m
+        type: string
+    type: object
+  portainer.Source:
+    properties:
+      administratorsOnly:
+        type: boolean
+      git:
+        $ref: '#/definitions/gittypes.GitSource'
+      helm:
+        $ref: '#/definitions/portainer.HelmConfig'
+      id:
+        example: 1
+        type: integer
+      lastSync:
+        example: 1587399600
+        type: integer
+      name:
+        example: my-source
+        type: string
+      ownerID:
+        type: integer
+      public:
+        type: boolean
+      registry:
+        $ref: '#/definitions/portainer.Registry'
+      status:
+        $ref: '#/definitions/portainer.SourceStatus'
+      statusError:
+        type: string
+      teamAccesses:
+        items:
+          type: integer
+        type: array
+      type:
+        allOf:
+        - $ref: '#/definitions/portainer.SourceType'
+        example: 1
+      userAccesses:
+        items:
+          type: integer
+        type: array
+    type: object
+  portainer.SourceStatus:
+    enum:
+    - 0
+    - 1
+    - 2
+    type: integer
+    x-enum-varnames:
+    - SourceStatusUnknown
+    - SourceStatusHealthy
+    - SourceStatusError
+  portainer.SourceType:
+    enum:
+    - 0
+    - 1
+    - 2
+    - 3
+    type: integer
+    x-enum-varnames:
+    - _
+    - SourceTypeGit
+    - SourceTypeRegistry
+    - SourceTypeHelm
+  portainer.Stack:
+    properties:
+      AdditionalFiles:
+        description: Only applies when deploying stack with multiple files
+        items:
+          type: string
+        type: array
+      AutoUpdate:
+        allOf:
+        - $ref: '#/definitions/portainer.AutoUpdateSettings'
+        description: The GitOps update settings of a git stack
+      CreatedBy:
+        description: The username which created this stack
+        example: admin
+        type: string
+      CreationDate:
+        description: The date in unix time when stack was created
+        example: 1587399600
+        type: integer
+      CurrentDeploymentInfo:
+        allOf:
+        - $ref: '#/definitions/portainer.StackDeploymentInfo'
+        description: CurrentDeploymentInfo records the git repository state at the
+          time of the last actual deployment.
+      DeploymentStartStatus:
+        allOf:
+        - $ref: '#/definitions/portainer.StackStatus'
+        description: |-
+          DeploymentStartStatus is the stack status captured when the current
+          deployment starts. It is used by deployment logic during the current
+          deployment attempt and is cleared/replaced when a new deployment begins.
+        example: 1
+      DeploymentStatus:
+        description: |-
+          DeploymentStatus records the status progression of the current deployment.
+          Cleared when a new deployment starts.
+        items:
+          $ref: '#/definitions/portainer.StackDeploymentStatus'
+        type: array
+      EndpointId:
+        description: Environment(Endpoint) identifier. Reference the environment(endpoint)
+          that will be used for deployment
+        example: 1
+        type: integer
+      EntryPoint:
+        description: |-
+          EntryPoint is the path to the config file relative to the project root.
+          NOTE: For git stacks this mirrors GitConfig.ConfigFilePath and the two are kept in sync
+          by stackUpdateGit. The deploy command builder (compose_unpacker_cmd_builder) uses this
+          field directly; Kubernetes deploy and git clone operations use GitConfig.ConfigFilePath.
+        example: docker-compose.yml
+        type: string
+      Env:
+        description: A list of environment(endpoint) variables used during stack deployment
+        items:
+          $ref: '#/definitions/portainer.Pair'
+        type: array
+      FromAppTemplate:
+        description: Whether the stack is from a app template
+        example: false
+        type: boolean
+      GitConfig:
+        allOf:
+        - $ref: '#/definitions/gittypes.RepoConfig'
+        description: |-
+          GitConfig is the git repository configuration for git-backed stacks.
+          Deprecated: loaded from Source via WorkflowID; kept for DB backwards-compatibility only.
+          Non-migration code must not read or write this field; use Source records instead.
+      Id:
+        description: Stack Identifier
+        example: 1
+        type: integer
+      Name:
+        description: Stack name
+        example: myStack
+        type: string
+      Namespace:
+        description: Kubernetes namespace if stack is a kube application
+        example: default
+        type: string
+      Option:
+        allOf:
+        - $ref: '#/definitions/portainer.StackOption'
+        description: The stack deployment option
+      ProjectPath:
+        description: Path on disk to the repository hosting the Stack file
+        example: /data/compose/myStack_jpofkc0i9uo9wtx1zesuk649w
+        type: string
+      ResourceControl:
+        $ref: '#/definitions/portainer.ResourceControl'
+      Status:
+        allOf:
+        - $ref: '#/definitions/portainer.StackStatus'
+        description: Stack status (1 - active, 2 - inactive, 3 - deploying, 4 - error)
+        example: 1
+      SwarmId:
+        description: Cluster identifier of the Swarm cluster where the stack is deployed
+        example: jpofkc0i9uo9wtx1zesuk649w
+        type: string
+      Type:
+        allOf:
+        - $ref: '#/definitions/portainer.StackType'
+        description: Stack type. 1 for a Swarm stack, 2 for a Compose stack
+        example: 2
+      UpdateDate:
+        description: The date in unix time when stack was last updated
+        example: 1587399600
+        type: integer
+      UpdatedBy:
+        description: The username which last updated this stack
+        example: bob
+        type: string
+      WorkflowID:
+        description: WorkflowID is the ID of the Workflow that owns the Source for
+          this stack.
+        type: integer
+    type: object
+  portainer.StackDeploymentInfo:
+    properties:
+      AdditionalFiles:
+        description: AdditionalFiles are the additional files used for deploying the
+          stack
+        items:
+          type: string
+        type: array
+      ConfigFilePath:
+        description: ConfigFilePath is the path to the config file in the git repository
+          used for deploying the stack
+        type: string
+      ConfigHash:
+        description: ConfigHash is the commit hash of the git repository used for
+          deploying the stack
+        type: string
+      FileVersion:
+        description: FileVersion is the version of the stack file, used to detect
+          changes
+        type: integer
+      ReferenceName:
+        description: ReferenceName is the git reference (branch/tag) used for deploying
+          the stack
+        type: string
+      RepositoryURL:
+        description: RepositoryURL is the git repository URL used for deploying the
+          stack
+        type: string
+      SourceID:
+        description: SourceID is the Source used for deploying the stack
+        type: integer
+      Version:
+        description: Version is the version of the stack and also is the deployed
+          version in edge agent
+        type: integer
+    type: object
+  portainer.StackDeploymentStatus:
+    properties:
+      Message:
+        description: populated on Error entries
+        type: string
+      Status:
+        $ref: '#/definitions/portainer.StackStatus'
+      Time:
+        type: integer
+    type: object
+  portainer.StackOption:
+    properties:
+      HelmAtomic:
+        description: Enable atomic rollback on failure (Helm --atomic flag for Kubernetes
+          Helm stacks)
+        example: false
+        type: boolean
+      Prune:
+        description: Prune services that are no longer referenced
+        example: false
+        type: boolean
+    type: object
+  portainer.StackStatus:
+    enum:
+    - 0
+    - 1
+    - 2
+    - 3
+    - 4
+    type: integer
+    x-enum-comments:
+      StackStatusActive: 1 - deployed and running
+      StackStatusDeploying: 3 - deployment in progress
+      StackStatusError: 4 - deployment failed
+      StackStatusInactive: 2 - intentionally stopped
+    x-enum-descriptions:
+    - ""
+    - 1 - deployed and running
+    - 2 - intentionally stopped
+    - 3 - deployment in progress
+    - 4 - deployment failed
+    x-enum-varnames:
+    - _
+    - StackStatusActive
+    - StackStatusInactive
+    - StackStatusDeploying
+    - StackStatusError
+  portainer.StackType:
+    enum:
+    - 0
+    - 1
+    - 2
+    - 3
+    type: integer
+    x-enum-varnames:
+    - _
+    - DockerSwarmStack
+    - DockerComposeStack
+    - KubernetesStack
+  portainer.TLSConfiguration:
+    properties:
+      TLS:
+        description: Use TLS
+        example: true
+        type: boolean
+      TLSCACert:
+        description: Path to the TLS CA certificate file
+        example: /data/tls/ca.pem
+        type: string
+      TLSCert:
+        description: Path to the TLS client certificate file
+        example: /data/tls/cert.pem
+        type: string
+      TLSKey:
+        description: Path to the TLS client key file
+        example: /data/tls/key.pem
+        type: string
+      TLSSkipVerify:
+        description: Skip the verification of the server TLS certificate
+        example: false
+        type: boolean
+    required:
+    - TLS
+    - TLSSkipVerify
+    type: object
+  portainer.Tag:
+    properties:
+      EndpointGroups:
+        additionalProperties:
+          type: boolean
+        description: A set of environment(endpoint) group ids that have this tag
+        type: object
+      Endpoints:
+        additionalProperties:
+          type: boolean
+        description: A set of environment(endpoint) ids that have this tag
+        type: object
+      ID:
+        description: Tag identifier
+        example: 1
+        type: integer
+      Name:
+        description: Tag name
+        example: org/acme
+        type: string
+    type: object
+  portainer.Team:
+    properties:
+      Id:
+        description: Team Identifier
+        example: 1
+        type: integer
+      Name:
+        description: Team name
+        example: developers
+        type: string
+    type: object
+  portainer.TeamAccessPolicies:
+    additionalProperties:
+      $ref: '#/definitions/portainer.AccessPolicy'
+    type: object
+  portainer.TeamMembership:
+    properties:
+      Id:
+        description: Membership Identifier
+        example: 1
+        type: integer
+      Role:
+        allOf:
+        - $ref: '#/definitions/portainer.MembershipRole'
+        description: Team role (1 for team leader and 2 for team member)
+        example: 1
+      TeamID:
+        description: Team identifier
+        example: 1
+        type: integer
+      UserID:
+        description: User identifier
+        example: 1
+        type: integer
+    type: object
+  portainer.TeamResourceAccess:
+    properties:
+      AccessLevel:
+        $ref: '#/definitions/portainer.ResourceAccessLevel'
+      TeamId:
+        type: integer
+    type: object
+  portainer.Template:
+    properties:
+      administrator_only:
+        description: Whether the template should be available to administrators only
+        example: true
+        type: boolean
+      categories:
+        description: A list of categories associated to the template
+        example:
+        - database
+        items:
+          type: string
+        type: array
+      command:
+        description: The command that will be executed in a container template
+        example: ls -lah
+        type: string
+      description:
+        description: Description of the template
+        example: High performance web server
+        type: string
+      env:
+        description: A list of environment(endpoint) variables used during the template
+          deployment
+        items:
+          $ref: '#/definitions/portainer.TemplateEnv'
+        type: array
+      hostname:
+        description: Container hostname
+        example: mycontainer
+        type: string
+      id:
+        description: |-
+          Mandatory container/stack fields
+          Template Identifier
+        example: 1
+        type: integer
+      image:
+        description: |-
+          Mandatory container fields
+          Image associated to a container template. Mandatory for a container template
+        example: nginx:latest
+        type: string
+      interactive:
+        description: |-
+          Whether the container should be started in
+          interactive mode (-i -t equivalent on the CLI)
+        example: true
+        type: boolean
+      labels:
+        description: Container labels
+        items:
+          $ref: '#/definitions/portainer.Pair'
+        type: array
+      logo:
+        description: URL of the template's logo
+        example: https://portainer.io/img/logo.svg
+        type: string
+      name:
+        description: |-
+          Optional stack/container fields
+          Default name for the stack/container to be used on deployment
+        example: mystackname
+        type: string
+      network:
+        description: Name of a network that will be used on container deployment if
+          it exists inside the environment(endpoint)
+        example: mynet
+        type: string
+      note:
+        description: A note that will be displayed in the UI. Supports HTML content
+        example: This is my <b>custom</b> template
+        type: string
+      platform:
+        description: |-
+          Platform associated to the template.
+          Valid values are: 'linux', 'windows' or leave empty for multi-platform
+        example: linux
+        type: string
+      ports:
+        description: A list of ports exposed by the container
+        example:
+        - 8080:80/tcp
+        items:
+          type: string
+        type: array
+      privileged:
+        description: Whether the container should be started in privileged mode
+        example: true
+        type: boolean
+      registry:
+        description: |-
+          Optional container fields
+          The URL of a registry associated to the image for a container template
+        example: quay.io
+        type: string
+      repository:
+        allOf:
+        - $ref: '#/definitions/portainer.TemplateRepository'
+        description: Mandatory stack fields
+      restart_policy:
+        description: Container restart policy
+        example: on-failure
+        type: string
+      stackFile:
+        description: |-
+          Mandatory Edge stack fields
+          Stack file used for this template
+        type: string
+      title:
+        description: Title of the template
+        example: Nginx
+        type: string
+      type:
+        allOf:
+        - $ref: '#/definitions/portainer.TemplateType'
+        description: 'Template type. Valid values are: 1 (container), 2 (Swarm stack),
+          3 (Compose stack), 4 (Compose edge stack)'
+        example: 1
+      volumes:
+        description: A list of volumes used during the container template deployment
+        items:
+          $ref: '#/definitions/portainer.TemplateVolume'
+        type: array
+    type: object
+  portainer.TemplateEnv:
+    properties:
+      default:
+        description: Default value that will be set for the variable
+        example: default_value
+        type: string
+      description:
+        description: Content of the tooltip that will be generated in the UI
+        example: MySQL root account password
+        type: string
+      label:
+        description: Text for the label that will be generated in the UI
+        example: Root password
+        type: string
+      name:
+        description: name of the environment(endpoint) variable
+        example: MYSQL_ROOT_PASSWORD
+        type: string
+      preset:
+        description: If set to true, will not generate any input for this variable
+          in the UI
+        example: false
+        type: boolean
+      select:
+        description: A list of name/value that will be used to generate a dropdown
+          in the UI
+        items:
+          $ref: '#/definitions/portainer.TemplateEnvSelect'
+        type: array
+    type: object
+  portainer.TemplateEnvSelect:
+    properties:
+      default:
+        description: Will set this choice as the default choice
+        example: false
+        type: boolean
+      text:
+        description: Some text that will displayed as a choice
+        example: text value
+        type: string
+      value:
+        description: A value that will be associated to the choice
+        example: value
+        type: string
+    type: object
+  portainer.TemplateRepository:
+    properties:
+      stackfile:
+        description: Path to the stack file inside the git repository
+        example: ./subfolder/docker-compose.yml
+        type: string
+      url:
+        description: URL of a git repository used to deploy a stack template. Mandatory
+          for a Swarm/Compose stack template
+        example: https://github.com/portainer/portainer-compose
+        type: string
+    type: object
+  portainer.TemplateType:
+    enum:
+    - 0
+    - 1
+    - 2
+    - 3
+    type: integer
+    x-enum-varnames:
+    - _
+    - ContainerTemplate
+    - SwarmStackTemplate
+    - ComposeStackTemplate
+  portainer.TemplateVolume:
+    properties:
+      bind:
+        description: Path on the host
+        example: /tmp
+        type: string
+      container:
+        description: Path inside the container
+        example: /data
+        type: string
+      readonly:
+        description: Whether the volume used should be readonly
+        example: true
+        type: boolean
+    type: object
+  portainer.User:
+    properties:
+      Id:
+        description: User Identifier
+        example: 1
+        type: integer
+      Role:
+        allOf:
+        - $ref: '#/definitions/portainer.UserRole'
+        description: User role (1 for administrator account and 2 for regular account)
+        example: 1
+      ThemeSettings:
+        $ref: '#/definitions/portainer.UserThemeSettings'
+      TokenIssueAt:
+        example: 1
+        type: integer
+      UseCache:
+        example: true
+        type: boolean
+      Username:
+        example: bob
+        type: string
+    required:
+    - Id
+    - Role
+    - Username
+    type: object
+  portainer.UserAccessPolicies:
+    additionalProperties:
+      $ref: '#/definitions/portainer.AccessPolicy'
+    type: object
+  portainer.UserResourceAccess:
+    properties:
+      AccessLevel:
+        $ref: '#/definitions/portainer.ResourceAccessLevel'
+      UserId:
+        type: integer
+    type: object
+  portainer.UserRole:
+    enum:
+    - 0
+    - 1
+    - 2
+    type: integer
+    x-enum-varnames:
+    - _
+    - AdministratorRole
+    - StandardUserRole
+  portainer.UserThemeSettings:
+    properties:
+      color:
+        description: Color represents the color theme of the UI
+        enum:
+        - dark
+        - light
+        - highcontrast
+        - auto
+        - ""
+        example: dark
+        type: string
+    type: object
+  portainer.Webhook:
+    properties:
+      EndpointId:
+        type: integer
+      Id:
+        description: Webhook Identifier
+        example: 1
+        type: integer
+      RegistryId:
+        type: integer
+      ResourceId:
+        type: string
+      Token:
+        type: string
+      Type:
+        allOf:
+        - $ref: '#/definitions/portainer.WebhookType'
+        description: Type of webhook (1 - service)
+    type: object
+  portainer.WebhookType:
+    enum:
+    - 0
+    - 1
+    type: integer
+    x-enum-varnames:
+    - _
+    - ServiceWebhook
+  registries.registryConfigurePayload:
+    properties:
+      Authentication:
+        description: Is authentication against this registry enabled
+        example: false
+        type: boolean
+      Password:
+        description: Password used to authenticate against this registry. required
+          when Authentication is true
+        example: registry_password
+        type: string
+      Region:
+        description: ECR region
+        type: string
+      TLS:
+        description: Use TLS
+        example: true
+        type: boolean
+      TLSCACertFile:
+        description: The TLS CA certificate file
+        items:
+          format: int32
+          type: integer
+        type: array
+      TLSCertFile:
+        description: The TLS client certificate file
+        items:
+          format: int32
+          type: integer
+        type: array
+      TLSKeyFile:
+        description: The TLS client key file
+        items:
+          format: int32
+          type: integer
+        type: array
+      TLSSkipVerify:
+        description: Skip the verification of the server TLS certificate
+        example: false
+        type: boolean
+      Username:
+        description: Username used to authenticate against this registry. Required
+          when Authentication is true
+        example: registry_user
+        type: string
+    required:
+    - Authentication
+    type: object
+  registries.registryCreatePayload:
+    properties:
+      Authentication:
+        description: Is authentication against this registry enabled
+        example: false
+        type: boolean
+      BaseURL:
+        description: BaseURL required for ProGet registry
+        example: registry.mydomain.tld:2375
+        type: string
+      Ecr:
+        allOf:
+        - $ref: '#/definitions/portainer.EcrData'
+        description: ECR specific details, required when type = 7
+      Gitlab:
+        allOf:
+        - $ref: '#/definitions/portainer.GitlabRegistryData'
+        description: Gitlab specific details, required when type = 4
+      Name:
+        description: Name that will be used to identify this registry
+        example: my-registry
+        type: string
+      Password:
+        description: Password used to authenticate against this registry. required
+          when Authentication is true
+        example: registry_password
+        type: string
+      Quay:
+        allOf:
+        - $ref: '#/definitions/portainer.QuayRegistryData'
+        description: Quay specific details, required when type = 1
+      TLS:
+        description: Use TLS
+        example: true
+        type: boolean
+      Type:
+        allOf:
+        - $ref: '#/definitions/portainer.RegistryType'
+        description: "Registry Type. Valid values are:\n\t1 (Quay.io),\n\t2 (Azure
+          container registry),\n\t3 (custom registry),\n\t4 (Gitlab registry),\n\t5
+          (ProGet registry),\n\t6 (DockerHub)\n\t7 (ECR)"
+        enum:
+        - 1
+        - 2
+        - 3
+        - 4
+        - 5
+        - 6
+        - 7
+        example: 1
+      URL:
+        description: URL or IP address of the Docker registry
+        example: registry.mydomain.tld:2375/feed
+        type: string
+      Username:
+        description: Username used to authenticate against this registry. Required
+          when Authentication is true
+        example: registry_user
+        type: string
+    required:
+    - Authentication
+    - Name
+    - Type
+    - URL
+    type: object
+  registries.registryPingPayload:
+    properties:
+      Password:
+        description: Password used to authenticate against this registry
+        example: registry_password
+        type: string
+      TLS:
+        description: Use TLS
+        example: true
+        type: boolean
+      Type:
+        allOf:
+        - $ref: '#/definitions/portainer.RegistryType'
+        description: "Registry Type. Valid values are:\n\t1 (Quay.io),\n\t2 (Azure
+          container registry),\n\t3 (custom registry),\n\t4 (Gitlab registry),\n\t5
+          (ProGet registry),\n\t6 (DockerHub)\n\t7 (ECR)\n\t8 (Github registry)"
+        enum:
+        - 1
+        - 2
+        - 3
+        - 4
+        - 5
+        - 6
+        - 7
+        - 8
+        example: 6
+      URL:
+        description: URL or IP address of the Docker registry
+        example: registry-1.docker.io
+        type: string
+      Username:
+        description: Username used to authenticate against this registry
+        example: registry_user
+        type: string
+    required:
+    - Type
+    - URL
+    type: object
+  registries.registryPingResponse:
+    properties:
+      message:
+        description: Message provides details about the connection test result
+        example: Registry connection successful
+        type: string
+      success:
+        description: Success indicates if the registry connection was successful
+        example: true
+        type: boolean
+    type: object
+  registries.registryUpdatePayload:
+    properties:
+      Authentication:
+        description: Is authentication against this registry enabled
+        example: false
+        type: boolean
+      BaseURL:
+        description: BaseURL is used for quay registry
+        example: registry.mydomain.tld:2375
+        type: string
+      Ecr:
+        allOf:
+        - $ref: '#/definitions/portainer.EcrData'
+        description: ECR data
+      Name:
+        description: Name that will be used to identify this registry
+        example: my-registry
+        type: string
+      Password:
+        description: Password used to authenticate against this registry. required
+          when Authentication is true
+        example: registry_password
+        type: string
+      Quay:
+        allOf:
+        - $ref: '#/definitions/portainer.QuayRegistryData'
+        description: Quay data
+      RegistryAccesses:
+        allOf:
+        - $ref: '#/definitions/portainer.RegistryAccesses'
+        description: Registry access control
+      URL:
+        description: URL or IP address of the Docker registry
+        example: registry.mydomain.tld:2375
+        type: string
+      Username:
+        description: Username used to authenticate against this registry. Required
+          when Authentication is true
+        example: registry_user
+        type: string
+    required:
+    - Authentication
+    - Name
+    - URL
+    type: object
+  release.Chart:
+    properties:
+      files:
+        description: |-
+          Files are miscellaneous files in a chart archive,
+          e.g. README, LICENSE, etc.
+        items:
+          $ref: '#/definitions/release.File'
+        type: array
+      lock:
+        allOf:
+        - $ref: '#/definitions/release.Lock'
+        description: Lock is the contents of Chart.lock.
+      metadata:
+        allOf:
+        - $ref: '#/definitions/release.Metadata'
+        description: Metadata is the contents of the Chartfile.
+      schema:
+        description: Schema is an optional JSON schema for imposing structure on Values
+        items:
+          type: integer
+        type: array
+      templates:
+        description: Templates for this chart.
+        items:
+          $ref: '#/definitions/release.File'
+        type: array
+      values:
+        additionalProperties: {}
+        description: Values are default config for this chart.
+        type: object
+    type: object
+  release.ChartReference:
+    properties:
+      chartPath:
+        type: string
+      registryID:
+        type: integer
+      repoURL:
+        type: string
+    type: object
+  release.Dependency:
+    properties:
+      alias:
+        description: Alias usable alias to be used for the chart
+        type: string
+      condition:
+        description: A yaml path that resolves to a boolean, used for enabling/disabling
+          charts (e.g. subchart1.enabled )
+        type: string
+      enabled:
+        description: Enabled bool determines if chart should be loaded
+        type: boolean
+      import-values:
+        description: |-
+          ImportValues holds the mapping of source values to parent key to be imported. Each item can be a
+          string or pair of child/parent sublist items.
+        items: {}
+        type: array
+      name:
+        description: |-
+          Name is the name of the dependency.
+
+          This must mach the name in the dependency's Chart.yaml.
+        type: string
+      repository:
+        description: |-
+          The URL to the repository.
+
+          Appending `index.yaml` to this string should result in a URL that can be
+          used to fetch the repository index.
+        type: string
+      tags:
+        description: Tags can be used to group charts for enabling/disabling together
+        items:
+          type: string
+        type: array
+      version:
+        description: |-
+          Version is the version (range) of this chart.
+
+          A lock file will always produce a single version, while a dependency
+          may contain a semantic version range.
+        type: string
+    type: object
+  release.File:
+    properties:
+      data:
+        description: Data is the template as byte data.
+        items:
+          type: integer
+        type: array
+      name:
+        description: Name is the path-like name of the template.
+        type: string
+    type: object
+  release.HookExecution:
+    properties:
+      completed_at:
+        description: CompletedAt indicates the date/time this hook was completed.
+        type: string
+      phase:
+        description: Phase indicates whether the hook completed successfully
+        type: string
+      started_at:
+        description: StartedAt indicates the date/time this hook was started
+        type: string
+    type: object
+  release.Info:
+    properties:
+      deleted:
+        description: Deleted tracks when this object was deleted.
+        type: string
+      description:
+        description: Description is human-friendly "log entry" about this release.
+        type: string
+      first_deployed:
+        description: FirstDeployed is when the release was first deployed.
+        type: string
+      last_deployed:
+        description: LastDeployed is when the release was last deployed.
+        type: string
+      notes:
+        description: Contains the rendered templates/NOTES.txt if available
+        type: string
+      resources:
+        description: Resources is the list of resources that are part of the release
+        items:
+          $ref: '#/definitions/unstructured.Unstructured'
+        type: array
+      status:
+        description: Status is the current state of the release
+        type: string
+    type: object
+  release.Lock:
+    properties:
+      dependencies:
+        description: Dependencies is the list of dependencies that this lock file
+          has locked.
+        items:
+          $ref: '#/definitions/release.Dependency'
+        type: array
+      digest:
+        description: Digest is a hash of the dependencies in Chart.yaml.
+        type: string
+      generated:
+        description: Generated is the date the lock file was last generated.
+        type: string
+    type: object
+  release.Maintainer:
+    properties:
+      email:
+        description: Email is an optional email address to contact the named maintainer
+        type: string
+      name:
+        description: Name is a user name or organization name
+        type: string
+      url:
+        description: URL is an optional URL to an address for the named maintainer
+        type: string
+    type: object
+  release.Metadata:
+    properties:
+      annotations:
+        additionalProperties:
+          type: string
+        description: |-
+          Annotations are additional mappings uninterpreted by Helm,
+          made available for inspection by other applications.
+        type: object
+      apiVersion:
+        description: The API Version of this chart. Required.
+        type: string
+      appVersion:
+        description: The version of the application enclosed inside of this chart.
+        type: string
+      condition:
+        description: The condition to check to enable chart
+        type: string
+      dependencies:
+        description: Dependencies are a list of dependencies for a chart.
+        items:
+          $ref: '#/definitions/release.Dependency'
+        type: array
+      deprecated:
+        description: Whether or not this chart is deprecated
+        type: boolean
+      description:
+        description: A one-sentence description of the chart
+        type: string
+      home:
+        description: The URL to a relevant project page, git repo, or contact person
+        type: string
+      icon:
+        description: The URL to an icon file.
+        type: string
+      keywords:
+        description: A list of string keywords
+        items:
+          type: string
+        type: array
+      kubeVersion:
+        description: KubeVersion is a SemVer constraint specifying the version of
+          Kubernetes required.
+        type: string
+      maintainers:
+        description: A list of name and URL/email address combinations for the maintainer(s)
+        items:
+          $ref: '#/definitions/release.Maintainer'
+        type: array
+      name:
+        description: The name of the chart. Required.
+        type: string
+      sources:
+        description: Source is the URL to the source code of this chart
+        items:
+          type: string
+        type: array
+      tags:
+        description: The tags to check to enable chart
+        type: string
+      type:
+        description: 'Specifies the chart type: application or library'
+        type: string
+      version:
+        description: A SemVer 2 conformant version string of the chart. Required.
+        type: string
+    type: object
+  release.Release:
+    properties:
+      appVersion:
+        description: AppVersion is the app version of the release.
+        type: string
+      chart:
+        allOf:
+        - $ref: '#/definitions/release.Chart'
+        description: Chart is the chart that was released.
+      chartReference:
+        allOf:
+        - $ref: '#/definitions/release.ChartReference'
+        description: ChartReference are the labels that are used to identify the chart
+          source.
+      config:
+        additionalProperties: {}
+        description: |-
+          Config is the set of extra Values added to the chart.
+          These values override the default values inside of the chart.
+        type: object
+      hooks:
+        description: Hooks are all of the hooks declared for this release.
+        items:
+          $ref: '#/definitions/github_com_portainer_portainer_pkg_libhelm_release.Hook'
+        type: array
+      info:
+        allOf:
+        - $ref: '#/definitions/release.Info'
+        description: Info provides information about a release
+      manifest:
+        description: Manifest is the string representation of the rendered template.
+        type: string
+      name:
+        description: Name is the name of the release
+        type: string
+      namespace:
+        description: Namespace is the kubernetes namespace of the release.
+        type: string
+      stackID:
+        description: StackID is the ID of the Portainer stack associated with this
+          release (if using GitOps)
+        type: integer
+      values:
+        allOf:
+        - $ref: '#/definitions/release.Values'
+        description: Values are the values used to deploy the chart.
+      version:
+        description: Version is an int which represents the revision of the release.
+        type: integer
+    type: object
+  release.ReleaseElement:
+    properties:
+      appVersion:
+        type: string
+      chart:
+        type: string
+      name:
+        type: string
+      namespace:
+        type: string
+      revision:
+        type: string
+      status:
+        type: string
+      updated:
+        type: string
+    type: object
+  release.Values:
+    properties:
+      computedValues:
+        type: string
+      userSuppliedValues:
+        type: string
+    type: object
+  resource.Quantity:
+    properties:
+      Format:
+        enum:
+        - DecimalExponent
+        - BinarySI
+        - DecimalSI
+        type: string
+        x-enum-comments:
+          BinarySI: e.g., 12Mi (12 * 2^20)
+          DecimalExponent: e.g., 12e6
+          DecimalSI: e.g., 12M  (12 * 10^6)
+        x-enum-descriptions:
+        - e.g., 12e6
+        - e.g., 12Mi (12 * 2^20)
+        - e.g., 12M  (12 * 10^6)
+        x-enum-varnames:
+        - DecimalExponent
+        - BinarySI
+        - DecimalSI
+    type: object
+  resourcecontrols.resourceControlCreatePayload:
+    properties:
+      AdministratorsOnly:
+        description: Permit access to resource only to admins
+        example: true
+        type: boolean
+      Public:
+        description: Permit access to the associated resource to any user
+        example: true
+        type: boolean
+      ResourceID:
+        example: 617c5f22bb9b023d6daab7cba43a57576f83492867bc767d1c59416b065e5f08
+        type: string
+      SubResourceIDs:
+        description: List of Docker resources that will inherit this access control
+        example:
+        - 617c5f22bb9b023d6daab7cba43a57576f83492867bc767d1c59416b065e5f08
+        items:
+          type: string
+        type: array
+      Teams:
+        description: List of team identifiers with access to the associated resource
+        example:
+        - 56
+        - 7
+        items:
+          type: integer
+        type: array
+      Type:
+        allOf:
+        - $ref: '#/definitions/portainer.ResourceControlType'
+        description: |-
+          Type of Resource. Valid values are: 1 - container, 2 - service
+          3 - volume, 4 - network, 5 - secret, 6 - stack, 7 - config, 8 - custom template, 9 - azure-container-group
+        enum:
+        - 1
+        - 2
+        - 3
+        - 4
+        - 5
+        - 6
+        - 7
+        - 8
+        - 9
+        example: 1
+      Users:
+        description: List of user identifiers with access to the associated resource
+        example:
+        - 1
+        - 4
+        items:
+          type: integer
+        type: array
+    required:
+    - ResourceID
+    - Type
+    type: object
+  resourcecontrols.resourceControlUpdatePayload:
+    properties:
+      AdministratorsOnly:
+        description: Permit access to resource only to admins
+        example: true
+        type: boolean
+      Public:
+        description: Permit access to the associated resource to any user
+        example: true
+        type: boolean
+      Teams:
+        description: List of team identifiers with access to the associated resource
+        example:
+        - 7
+        items:
+          type: integer
+        type: array
+      Users:
+        description: List of user identifiers with access to the associated resource
+        example:
+        - 4
+        items:
+          type: integer
+        type: array
+    type: object
+  roar.Roar-portainer_EndpointID:
+    type: object
+  settings.publicSettingsResponse:
+    properties:
+      AuthenticationMethod:
+        allOf:
+        - $ref: '#/definitions/portainer.AuthenticationMethod'
+        description: 'Active authentication method for the Portainer instance. Valid
+          values are: 1 for internal, 2 for LDAP, or 3 for oauth'
+        example: 1
+      Edge:
+        properties:
+          CheckinInterval:
+            description: The check in interval for edge agent (in seconds) - used
+              in non async mode [seconds]
+            example: 60
+            type: integer
+          CommandInterval:
+            description: The command list interval for edge agent - used in edge async
+              mode [seconds]
+            example: 60
+            type: integer
+          PingInterval:
+            description: The ping interval for edge agent - used in edge async mode
+              [seconds]
+            example: 60
+            type: integer
+          SnapshotInterval:
+            description: The snapshot interval for edge agent - used in edge async
+              mode [seconds]
+            example: 60
+            type: integer
+        type: object
+      EnableEdgeComputeFeatures:
+        description: Whether edge compute features are enabled
+        example: true
+        type: boolean
+      Features:
+        additionalProperties:
+          type: boolean
+        description: Supported feature flags
+        type: object
+      GlobalDeploymentOptions:
+        allOf:
+        - $ref: '#/definitions/portainer.GlobalDeploymentOptions'
+        description: Deployment options for encouraging deployment as code
+      IsDockerDesktopExtension:
+        example: false
+        type: boolean
+      KubeconfigExpiry:
+        default: "0"
+        description: The expiry of a Kubeconfig
+        example: 24h
+        type: string
+      LogoURL:
+        description: URL to a logo that will be displayed on the login page as well
+          as on top of the sidebar. Will use default Portainer logo when value is
+          empty string
+        example: https://mycompany.mydomain.tld/logo.png
+        type: string
+      OAuthLoginURI:
+        description: The URL used for oauth login
+        example: https://gitlab.com/oauth
+        type: string
+      OAuthLogoutURI:
+        description: The URL used for oauth logout
+        example: https://gitlab.com/oauth/logout
+        type: string
+      RequiredPasswordLength:
+        description: The minimum required length for a password of any user when using
+          internal auth mode
+        example: 1
+        type: integer
+      RequiresSetupToken:
+        description: Whether the setup wizard must send the X-Setup-Token header for
+          admin init / restore
+        example: false
+        type: boolean
+      TeamSync:
+        description: Whether team sync is enabled
+        example: true
+        type: boolean
+    type: object
+  settings.settingsUpdatePayload:
+    properties:
+      AuthenticationMethod:
+        description: 'Active authentication method for the Portainer instance. Valid
+          values are: 1 for internal, 2 for LDAP, or 3 for oauth'
+        example: 1
+        type: integer
+      BlackListedLabels:
+        description: A list of label name & value that will be used to hide containers
+          when querying containers
+        items:
+          $ref: '#/definitions/portainer.Pair'
+        type: array
+      EdgeAgentCheckinInterval:
+        example: 5
+        type: integer
+      EdgePortainerURL:
+        description: EdgePortainerURL is the URL that is exposed to edge agents
+        type: string
+      EnableEdgeComputeFeatures:
+        description: Whether edge compute features are enabled
+        example: true
+        type: boolean
+      EnforceEdgeID:
+        description: EnforceEdgeID makes Portainer store the Edge ID instead of accepting
+          anyone
+        example: false
+        type: boolean
+      ForceSecureCookies:
+        description: ForceSecureCookies forces the Secure attribute on auth cookies
+          regardless of the detected scheme
+        example: false
+        type: boolean
+      GlobalDeploymentOptions:
+        allOf:
+        - $ref: '#/definitions/portainer.GlobalDeploymentOptions'
+        description: Deployment options for encouraging deployment as code
+      HelmRepositoryURL:
+        description: Helm repository URL
+        example: https://charts.bitnami.com/bitnami
+        type: string
+      InternalAuthSettings:
+        $ref: '#/definitions/portainer.InternalAuthSettings'
+      KubeconfigExpiry:
+        default: "0"
+        description: The expiry of a Kubeconfig
+        example: 24h
+        type: string
+      KubectlShellImage:
+        description: Kubectl Shell Image
+        example: portainer/kubectl-shell:latest
+        type: string
+      LDAPSettings:
+        $ref: '#/definitions/portainer.LDAPSettings'
+      LogoURL:
+        description: URL to a logo that will be displayed on the login page as well
+          as on top of the sidebar. Will use default Portainer logo when value is
+          empty string
+        example: https://mycompany.mydomain.tld/logo.png
+        type: string
+      OAuthSettings:
+        $ref: '#/definitions/portainer.OAuthSettings'
+      SnapshotInterval:
+        description: The interval in which environment(endpoint) snapshots are created
+        example: 5m
+        type: string
+      TemplatesURL:
+        description: URL to the templates that will be displayed in the UI when navigating
+          to App Templates
+        example: https://raw.githubusercontent.com/portainer/templates/master/templates.json
+        type: string
+      TrustOnFirstConnect:
+        description: TrustOnFirstConnect makes Portainer accepting edge agent connection
+          by default
+        example: false
+        type: boolean
+      UserSessionTimeout:
+        description: The duration of a user session
+        example: 5m
+        type: string
+    type: object
+  sources.AutoUpdateInfo:
+    properties:
+      fetchInterval:
+        type: string
+      mechanism:
+        type: string
+    type: object
+  sources.ConnectionTestResult:
+    properties:
+      error:
+        type: string
+      success:
+        type: boolean
+    type: object
+  sources.GitAuthenticationPayload:
+    properties:
+      password:
+        type: string
+      username:
+        type: string
+    type: object
+  sources.GitAuthenticationUpdatePayload:
+    properties:
+      password:
+        type: string
+      username:
+        type: string
+    type: object
+  sources.GitSourceCreatePayload:
+    properties:
+      administratorsOnly:
+        example: true
+        type: boolean
+      authentication:
+        $ref: '#/definitions/sources.GitAuthenticationPayload'
+      name:
+        type: string
+      public:
+        example: true
+        type: boolean
+      teamAccesses:
+        items:
+          type: integer
+        type: array
+      tlsSkipVerify:
+        type: boolean
+      url:
+        type: string
+      userAccesses:
+        items:
+          type: integer
+        type: array
+    required:
+    - url
+    type: object
+  sources.GitSourceUpdatePayload:
+    properties:
+      authentication:
+        $ref: '#/definitions/sources.GitAuthenticationUpdatePayload'
+      name:
+        type: string
+      tlsSkipVerify:
+        type: boolean
+      url:
+        type: string
+    type: object
+  sources.Source:
+    properties:
+      environments:
+        type: integer
+      error:
+        type: string
+      id:
+        type: integer
+      lastSync:
+        type: integer
+      name:
+        type: string
+      status:
+        $ref: '#/definitions/workflows.Status'
+      type:
+        $ref: '#/definitions/sources.SourceType'
+      url:
+        type: string
+      usedBy:
+        type: integer
+    required:
+    - id
+    - name
+    - status
+    - type
+    - url
+    type: object
+  sources.SourceAccess:
+    properties:
+      public:
+        type: boolean
+      teams:
+        items:
+          type: integer
+        type: array
+      users:
+        items:
+          type: integer
+        type: array
+    type: object
+  sources.SourceAccessUpdatePayload:
+    properties:
+      public:
+        type: boolean
+      teams:
+        items:
+          type: integer
+        type: array
+      users:
+        items:
+          type: integer
+        type: array
+    type: object
+  sources.SourceDetail:
+    properties:
+      access:
+        $ref: '#/definitions/sources.SourceAccess'
+      autoUpdate:
+        $ref: '#/definitions/sources.AutoUpdateInfo'
+      connection:
+        $ref: '#/definitions/sources.connectionInfo'
+      environments:
+        type: integer
+      error:
+        type: string
+      id:
+        type: integer
+      lastSync:
+        type: integer
+      name:
+        type: string
+      status:
+        $ref: '#/definitions/workflows.Status'
+      type:
+        $ref: '#/definitions/sources.SourceType'
+      url:
+        type: string
+      usedBy:
+        type: integer
+      workflows:
+        items:
+          $ref: '#/definitions/workflows.Workflow'
+        type: array
+    required:
+    - connection
+    - id
+    - name
+    - status
+    - type
+    - url
+    type: object
+  sources.SourceType:
+    enum:
+    - git
+    - helm
+    - oci
+    type: string
+    x-enum-varnames:
+    - SourceTypeGit
+    - SourceTypeHelm
+    - SourceTypeOCI
+  sources.Status:
+    enum:
+    - unknown
+    - healthy
+    - error
+    type: string
+    x-enum-varnames:
+    - SourceStatusUnknown
+    - SourceStatusHealthy
+    - SourceStatusError
+  sources.connectionInfo:
+    properties:
+      authentication:
+        $ref: '#/definitions/sources.gitAuthInfo'
+      tlsSkipVerify:
+        type: boolean
+    type: object
+  sources.gitAuthInfo:
+    properties:
+      username:
+        type: string
+    type: object
+  ssl.sslUpdatePayload:
+    properties:
+      Cert:
+        description: SSL Certificates
+        type: string
+      HTTPEnabled:
+        type: boolean
+      Key:
+        type: string
+    type: object
+  stacks.composeStackFromFileContentPayload:
+    properties:
+      Env:
+        description: A list of environment variables used during stack deployment
+        items:
+          $ref: '#/definitions/portainer.Pair'
+        type: array
+      FromAppTemplate:
+        description: Whether the stack is from a app template
+        example: false
+        type: boolean
+      Name:
+        description: Name of the stack
+        example: myStack
+        type: string
+      StackFileContent:
+        description: Content of the Stack file
+        example: |-
+          version: 3
+           services:
+           web:
+           image:nginx
+        type: string
+    required:
+    - Name
+    - StackFileContent
+    type: object
+  stacks.composeStackFromGitRepositoryPayload:
+    properties:
+      AdditionalFiles:
+        description: Applicable when deploying with multiple stack files
+        example:
+        - '[nz.compose.yml'
+        - ' uat.compose.yml]'
+        items:
+          type: string
+        type: array
+      AutoUpdate:
+        allOf:
+        - $ref: '#/definitions/portainer.AutoUpdateSettings'
+        description: Optional GitOps update configuration
+      ComposeFile:
+        default: docker-compose.yml
+        description: Path to the Stack file inside the Git repository
+        example: docker-compose.yml
+        type: string
+      Env:
+        description: A list of environment variables used during stack deployment
+        items:
+          $ref: '#/definitions/portainer.Pair'
+        type: array
+      FromAppTemplate:
+        description: Whether the stack is from a app template
+        example: false
+        type: boolean
+      Name:
+        description: Name of the stack
+        example: myStack
+        type: string
+      RepositoryAuthentication:
+        description: 'Deprecated: use SourceID instead. Use basic authentication to
+          clone the Git repository.'
+        example: true
+        type: boolean
+      RepositoryPassword:
+        description: 'Deprecated: use SourceID instead. Password used in basic authentication.'
+        example: myGitPassword
+        type: string
+      RepositoryReferenceName:
+        description: Reference name of a Git repository hosting the Stack file
+        example: refs/heads/master
+        type: string
+      RepositoryURL:
+        description: 'Deprecated: use SourceID instead. URL of a Git repository hosting
+          the Stack file.'
+        example: https://github.com/openfaas/faas
+        type: string
+      RepositoryUsername:
+        description: 'Deprecated: use SourceID instead. Username used in basic authentication.'
+        example: myGitUsername
+        type: string
+      SourceID:
+        description: |-
+          SourceID references an existing Source for git credentials/URL.
+          When set, the inline URL and authentication fields are ignored.
+        example: 1
+        type: integer
+      TLSSkipVerify:
+        description: 'Deprecated: use SourceID instead. TLSSkipVerify skips SSL verification
+          when cloning the Git repository.'
+        example: false
+        type: boolean
+    required:
+    - Name
+    type: object
+  stacks.kubernetesGitDeploymentPayload:
+    properties:
+      AdditionalFiles:
+        items:
+          type: string
+        type: array
+      AutoUpdate:
+        $ref: '#/definitions/portainer.AutoUpdateSettings'
+      ComposeFormat:
+        type: boolean
+      ManifestFile:
+        type: string
+      Namespace:
+        type: string
+      RepositoryAuthentication:
+        description: 'Deprecated: use SourceID instead. Use basic authentication to
+          clone the Git repository.'
+        type: boolean
+      RepositoryPassword:
+        description: 'Deprecated: use SourceID instead. Password used in basic authentication.'
+        type: string
+      RepositoryReferenceName:
+        description: 'Deprecated: use SourceID instead. Reference name of a Git repository
+          hosting the Stack file.'
+        type: string
+      RepositoryURL:
+        description: 'Deprecated: use SourceID instead. URL of a Git repository hosting
+          the Stack file.'
+        type: string
+      RepositoryUsername:
+        description: 'Deprecated: use SourceID instead. Username used in basic authentication.'
+        type: string
+      SourceID:
+        description: |-
+          SourceID references an existing Source for git credentials/URL.
+          When set, the inline URL and authentication fields are ignored.
+        example: 1
+        type: integer
+      StackName:
+        type: string
+      TLSSkipVerify:
+        description: 'Deprecated: use SourceID instead. TLSSkipVerify skips SSL verification
+          when cloning the Git repository.'
+        example: false
+        type: boolean
+    type: object
+  stacks.kubernetesManifestURLDeploymentPayload:
+    properties:
+      ComposeFormat:
+        type: boolean
+      ManifestURL:
+        type: string
+      Namespace:
+        type: string
+      StackName:
+        type: string
+    type: object
+  stacks.kubernetesStringDeploymentPayload:
+    properties:
+      ComposeFormat:
+        type: boolean
+      FromAppTemplate:
+        description: Whether the stack is from a app template
+        example: false
+        type: boolean
+      Namespace:
+        type: string
+      StackFileContent:
+        type: string
+      StackName:
+        type: string
+    type: object
+  stacks.stackFileResponse:
+    properties:
+      StackFileContent:
+        description: Content of the Stack file
+        example: |-
+          version: 3
+           services:
+           web:
+           image:nginx
+        type: string
+    type: object
+  stacks.stackGitRedeployPayload:
+    properties:
+      Env:
+        items:
+          $ref: '#/definitions/portainer.Pair'
+        type: array
+      Prune:
+        type: boolean
+      PullImage:
+        description: |-
+          Deprecated(2.36): use RepullImageAndRedeploy instead for cleaner responsibility
+          Force a pulling to current image with the original tag though the image is already the latest
+        example: false
+        type: boolean
+      RepositoryAuthentication:
+        description: When true and RepositoryPassword is non-empty, stored credentials
+          are replaced.
+        type: boolean
+      RepositoryPassword:
+        description: Non-empty value (with RepositoryAuthentication=true) replaces
+          stored credentials; leave blank to keep them.
+        type: string
+      RepositoryReferenceName:
+        type: string
+      RepositoryUsername:
+        type: string
+      RepullImageAndRedeploy:
+        description: RepullImageAndRedeploy indicates whether to force repulling images
+          and redeploying the stack
+        type: boolean
+      StackName:
+        type: string
+    type: object
+  stacks.stackGitUpdatePayload:
+    properties:
+      AdditionalFiles:
+        items:
+          type: string
+        type: array
+      AutoUpdate:
+        $ref: '#/definitions/portainer.AutoUpdateSettings'
+      ConfigFilePath:
+        type: string
+      Env:
+        items:
+          $ref: '#/definitions/portainer.Pair'
+        type: array
+      Prune:
+        type: boolean
+      RepositoryAuthentication:
+        description: 'Deprecated: use SourceID instead. Use basic authentication to
+          clone the Git repository.'
+        type: boolean
+      RepositoryPassword:
+        description: 'Deprecated: use SourceID instead. Password used in basic authentication.'
+        type: string
+      RepositoryReferenceName:
+        type: string
+      RepositoryURL:
+        description: 'Deprecated: use SourceID instead. URL of a Git repository hosting
+          the Stack file.'
+        type: string
+      RepositoryUsername:
+        description: 'Deprecated: use SourceID instead. Username used in basic authentication.'
+        type: string
+      SourceID:
+        description: |-
+          SourceID references an existing Source for git credentials/URL.
+          When set, the inline URL and authentication fields are ignored.
+        type: integer
+      TLSSkipVerify:
+        description: 'Deprecated: use SourceID instead. Skip TLS verification when
+          cloning the Git repository.'
+        type: boolean
+    type: object
+  stacks.stackMigratePayload:
+    properties:
+      EndpointID:
+        description: Environment(Endpoint) identifier of the target environment(endpoint)
+          where the stack will be relocated
+        example: 2
+        type: integer
+      Name:
+        description: If provided will rename the migrated stack
+        example: new-stack
+        type: string
+      SwarmID:
+        description: Swarm cluster identifier, must match the identifier of the cluster
+          where the stack will be relocated
+        example: jpofkc0i9uo9wtx1zesuk649w
+        type: string
+    required:
+    - EndpointID
+    type: object
+  stacks.stackResponse:
+    properties:
+      AdditionalFiles:
+        description: Only applies when deploying stack with multiple files
+        items:
+          type: string
+        type: array
+      AutoUpdate:
+        allOf:
+        - $ref: '#/definitions/portainer.AutoUpdateSettings'
+        description: The GitOps update settings of a git stack
+      CreatedBy:
+        description: The username which created this stack
+        example: admin
+        type: string
+      CreationDate:
+        description: The date in unix time when stack was created
+        example: 1587399600
+        type: integer
+      CurrentDeploymentInfo:
+        allOf:
+        - $ref: '#/definitions/portainer.StackDeploymentInfo'
+        description: CurrentDeploymentInfo records the git repository state at the
+          time of the last actual deployment.
+      DeploymentStartStatus:
+        allOf:
+        - $ref: '#/definitions/portainer.StackStatus'
+        description: |-
+          DeploymentStartStatus is the stack status captured when the current
+          deployment starts. It is used by deployment logic during the current
+          deployment attempt and is cleared/replaced when a new deployment begins.
+        example: 1
+      DeploymentStatus:
+        description: |-
+          DeploymentStatus records the status progression of the current deployment.
+          Cleared when a new deployment starts.
+        items:
+          $ref: '#/definitions/portainer.StackDeploymentStatus'
+        type: array
+      EndpointId:
+        description: Environment(Endpoint) identifier. Reference the environment(endpoint)
+          that will be used for deployment
+        example: 1
+        type: integer
+      EntryPoint:
+        description: |-
+          EntryPoint is the path to the config file relative to the project root.
+          NOTE: For git stacks this mirrors GitConfig.ConfigFilePath and the two are kept in sync
+          by stackUpdateGit. The deploy command builder (compose_unpacker_cmd_builder) uses this
+          field directly; Kubernetes deploy and git clone operations use GitConfig.ConfigFilePath.
+        example: docker-compose.yml
+        type: string
+      Env:
+        description: A list of environment(endpoint) variables used during stack deployment
+        items:
+          $ref: '#/definitions/portainer.Pair'
+        type: array
+      FromAppTemplate:
+        description: Whether the stack is from a app template
+        example: false
+        type: boolean
+      GitConfig:
+        allOf:
+        - $ref: '#/definitions/gittypes.RepoConfig'
+        description: |-
+          GitConfig is the git repository configuration for git-backed stacks.
+          Deprecated: loaded from Source via WorkflowID; kept for DB backwards-compatibility only.
+          Non-migration code must not read or write this field; use Source records instead.
+      GitSourceId:
+        type: integer
+      Id:
+        description: Stack Identifier
+        example: 1
+        type: integer
+      Name:
+        description: Stack name
+        example: myStack
+        type: string
+      Namespace:
+        description: Kubernetes namespace if stack is a kube application
+        example: default
+        type: string
+      Option:
+        allOf:
+        - $ref: '#/definitions/portainer.StackOption'
+        description: The stack deployment option
+      ProjectPath:
+        description: Path on disk to the repository hosting the Stack file
+        example: /data/compose/myStack_jpofkc0i9uo9wtx1zesuk649w
+        type: string
+      ResourceControl:
+        $ref: '#/definitions/portainer.ResourceControl'
+      Status:
+        allOf:
+        - $ref: '#/definitions/portainer.StackStatus'
+        description: Stack status (1 - active, 2 - inactive, 3 - deploying, 4 - error)
+        example: 1
+      SwarmId:
+        description: Cluster identifier of the Swarm cluster where the stack is deployed
+        example: jpofkc0i9uo9wtx1zesuk649w
+        type: string
+      Type:
+        allOf:
+        - $ref: '#/definitions/portainer.StackType'
+        description: Stack type. 1 for a Swarm stack, 2 for a Compose stack
+        example: 2
+      UpdateDate:
+        description: The date in unix time when stack was last updated
+        example: 1587399600
+        type: integer
+      UpdatedBy:
+        description: The username which last updated this stack
+        example: bob
+        type: string
+      WorkflowID:
+        description: WorkflowID is the ID of the Workflow that owns the Source for
+          this stack.
+        type: integer
+    type: object
+  stacks.swarmStackFromFileContentPayload:
+    properties:
+      Env:
+        description: A list of environment variables used during stack deployment
+        items:
+          $ref: '#/definitions/portainer.Pair'
+        type: array
+      FromAppTemplate:
+        description: Whether the stack is from a app template
+        example: false
+        type: boolean
+      Name:
+        description: Name of the stack
+        example: myStack
+        type: string
+      StackFileContent:
+        description: Content of the Stack file
+        example: |-
+          version: 3
+           services:
+           web:
+           image:nginx
+        type: string
+      SwarmID:
+        description: Swarm cluster identifier
+        example: jpofkc0i9uo9wtx1zesuk649w
+        type: string
+    required:
+    - Name
+    - StackFileContent
+    - SwarmID
+    type: object
+  stacks.swarmStackFromGitRepositoryPayload:
+    properties:
+      AdditionalFiles:
+        description: Applicable when deploying with multiple stack files
+        example:
+        - '[nz.compose.yml'
+        - ' uat.compose.yml]'
+        items:
+          type: string
+        type: array
+      AutoUpdate:
+        allOf:
+        - $ref: '#/definitions/portainer.AutoUpdateSettings'
+        description: Optional GitOps update configuration
+      ComposeFile:
+        default: docker-compose.yml
+        description: Path to the Stack file inside the Git repository
+        example: docker-compose.yml
+        type: string
+      Env:
+        description: A list of environment variables used during stack deployment
+        items:
+          $ref: '#/definitions/portainer.Pair'
+        type: array
+      FromAppTemplate:
+        description: Whether the stack is from a app template
+        example: false
+        type: boolean
+      Name:
+        description: Name of the stack
+        example: myStack
+        type: string
+      RepositoryAuthentication:
+        description: 'Deprecated: use SourceID instead. Use basic authentication to
+          clone the Git repository.'
+        example: true
+        type: boolean
+      RepositoryPassword:
+        description: 'Deprecated: use SourceID instead. Password used in basic authentication.'
+        example: myGitPassword
+        type: string
+      RepositoryReferenceName:
+        description: Reference name of a Git repository hosting the Stack file
+        example: refs/heads/master
+        type: string
+      RepositoryURL:
+        description: 'Deprecated: use SourceID instead. URL of a Git repository hosting
+          the Stack file.'
+        example: https://github.com/openfaas/faas
+        type: string
+      RepositoryUsername:
+        description: 'Deprecated: use SourceID instead. Username used in basic authentication.'
+        example: myGitUsername
+        type: string
+      SourceID:
+        description: |-
+          SourceID references an existing Source for git credentials/URL.
+          When set, the inline URL and authentication fields are ignored.
+        example: 1
+        type: integer
+      SwarmID:
+        description: Swarm cluster identifier
+        example: jpofkc0i9uo9wtx1zesuk649w
+        type: string
+      TLSSkipVerify:
+        description: 'Deprecated: use SourceID instead. TLSSkipVerify skips SSL verification
+          when cloning the Git repository.'
+        example: false
+        type: boolean
+    required:
+    - Name
+    - SwarmID
+    type: object
+  stacks.updateSwarmStackPayload:
+    properties:
+      Env:
+        description: A list of environment(endpoint) variables used during stack deployment
+        items:
+          $ref: '#/definitions/portainer.Pair'
+        type: array
+      Prune:
+        description: Prune services that are no longer referenced
+        example: true
+        type: boolean
+      PullImage:
+        description: |-
+          Deprecated(2.36): use RepullImageAndRedeploy instead for cleaner responsibility
+          Force a pulling to current image with the original tag though the image is already the latest
+        example: false
+        type: boolean
+      RepullImageAndRedeploy:
+        description: RepullImageAndRedeploy indicates whether to force repulling images
+          and redeploying the stack
+        type: boolean
+      StackFileContent:
+        description: New content of the Stack file
+        example: |-
+          version: 3
+           services:
+           web:
+           image:nginx
+        type: string
+    type: object
+  stats.ContainerStats:
+    properties:
+      healthy:
+        type: integer
+      running:
+        type: integer
+      stopped:
+        type: integer
+      total:
+        type: integer
+      unhealthy:
+        type: integer
+    type: object
+  swarm.ServiceUpdateResponse:
+    properties:
+      Warnings:
+        description: Optional warning messages
+        items:
+          type: string
+        type: array
+    type: object
+  system.nodesCountResponse:
+    properties:
+      nodes:
+        type: integer
+    type: object
+  system.status:
+    properties:
+      InstanceID:
+        description: Server Instance ID
+        example: 299ab403-70a8-4c05-92f7-bf7a994d50df
+        type: string
+      Version:
+        description: Portainer API version
+        example: 2.0.0
+        type: string
+    type: object
+  system.systemInfoResponse:
+    properties:
+      agents:
+        type: integer
+      edgeAgents:
+        type: integer
+      platform:
+        $ref: '#/definitions/platform.ContainerPlatform'
+    type: object
+  system.versionResponse:
+    properties:
+      Build:
+        $ref: '#/definitions/build.BuildInfo'
+      DatabaseVersion:
+        type: string
+      Dependencies:
+        $ref: '#/definitions/build.DependenciesInfo'
+      LatestVersion:
+        description: The latest version available
+        example: 2.0.0
+        type: string
+      Runtime:
+        $ref: '#/definitions/build.RuntimeInfo'
+      ServerEdition:
+        example: CE/EE
+        type: string
+      ServerVersion:
+        type: string
+      UpdateAvailable:
+        description: Whether portainer has an update available
+        example: false
+        type: boolean
+      VersionSupport:
+        example: STS/LTS
+        type: string
+    type: object
+  tags.tagCreatePayload:
+    properties:
+      Name:
+        example: org/acme
+        type: string
+    required:
+    - Name
+    type: object
+  teammemberships.teamMembershipCreatePayload:
+    properties:
+      Role:
+        description: Role for the user inside the team (1 for leader and 2 for regular
+          member)
+        enum:
+        - 1
+        - 2
+        example: 1
+        type: integer
+      TeamID:
+        description: Team identifier
+        example: 1
+        type: integer
+      UserID:
+        description: User identifier
+        example: 1
+        type: integer
+    required:
+    - Role
+    - TeamID
+    - UserID
+    type: object
+  teammemberships.teamMembershipUpdatePayload:
+    properties:
+      Role:
+        description: Role for the user inside the team (1 for leader and 2 for regular
+          member)
+        enum:
+        - 1
+        - 2
+        example: 1
+        type: integer
+      TeamID:
+        description: Team identifier
+        example: 1
+        type: integer
+      UserID:
+        description: User identifier
+        example: 1
+        type: integer
+    required:
+    - Role
+    - TeamID
+    - UserID
+    type: object
+  teams.teamCreatePayload:
+    properties:
+      Name:
+        description: Name
+        example: developers
+        type: string
+      TeamLeaders:
+        description: TeamLeaders
+        example:
+        - 3
+        - 5
+        items:
+          type: integer
+        type: array
+    required:
+    - Name
+    type: object
+  teams.teamUpdatePayload:
+    properties:
+      Name:
+        description: Name
+        example: developers
+        type: string
+    type: object
+  templates.fileResponse:
+    properties:
+      FileContent:
+        description: The requested file content
+        example: version:2
+        type: string
+    type: object
+  templates.listResponse:
+    properties:
+      templates:
+        items:
+          $ref: '#/definitions/portainer.Template'
+        type: array
+      version:
+        type: string
+    type: object
+  unstructured.Unstructured:
+    properties:
+      Object:
+        additionalProperties: true
+        description: |-
+          Object is a JSON compatible map with string, float, int, bool, []interface{}, or
+          map[string]interface{}
+          children.
+        type: object
+    type: object
+  users.AccessLocation:
+    enum:
+    - environment
+    - environmentGroup
+    type: string
+    x-enum-varnames:
+    - AccessLocationEnvironment
+    - AccessLocationEnvironmentGroup
+  users.EffectiveAccessEntry:
+    properties:
+      accessLocation:
+        $ref: '#/definitions/users.AccessLocation'
+      endpointId:
+        type: integer
+      endpointName:
+        type: string
+      groupId:
+        type: integer
+      groupName:
+        type: string
+      roleId:
+        type: integer
+      roleName:
+        type: string
+      rolePriority:
+        type: integer
+      teamId:
+        type: integer
+      teamName:
+        type: string
+    type: object
+  users.accessTokenResponse:
+    properties:
+      apiKey:
+        $ref: '#/definitions/portainer.APIKey'
+      rawAPIKey:
+        type: string
+    type: object
+  users.addHelmRepoUrlPayload:
+    properties:
+      url:
+        type: string
+    type: object
+  users.adminInitPayload:
+    properties:
+      Password:
+        description: Password for the admin user
+        example: admin-password
+        type: string
+      Username:
+        description: Username for the admin user
+        example: admin
+        type: string
+    required:
+    - Password
+    - Username
+    type: object
+  users.helmUserRepositoryResponse:
+    properties:
+      GlobalRepository:
+        type: string
+      UserRepositories:
+        items:
+          $ref: '#/definitions/portainer.HelmUserRepository'
+        type: array
+    type: object
+  users.themePayload:
+    properties:
+      color:
+        description: Color represents the color theme of the UI
+        enum:
+        - dark
+        - light
+        - highcontrast
+        - auto
+        example: dark
+        type: string
+    type: object
+  users.userAccessTokenCreatePayload:
+    properties:
+      description:
+        example: github-api-key
+        type: string
+      password:
+        example: password
+        type: string
+    required:
+    - description
+    - password
+    type: object
+  users.userCreatePayload:
+    properties:
+      Password:
+        example: cg9Wgky3
+        type: string
+      Role:
+        description: User role (1 for administrator account and 2 for regular account)
+        enum:
+        - 1
+        - 2
+        example: 2
+        type: integer
+      Username:
+        example: bob
+        type: string
+    required:
+    - Password
+    - Role
+    - Username
+    type: object
+  users.userUpdatePasswordPayload:
+    properties:
+      NewPassword:
+        description: New Password
+        example: new_passwd
+        type: string
+      Password:
+        description: Current Password
+        example: passwd
+        type: string
+    required:
+    - NewPassword
+    - Password
+    type: object
+  users.userUpdatePayload:
+    properties:
+      NewPassword:
+        example: asfj2emv
+        type: string
+      Password:
+        example: cg9Wgky3
+        type: string
+      Role:
+        description: User role (1 for administrator account and 2 for regular account)
+        enum:
+        - 1
+        - 2
+        example: 2
+        type: integer
+      Theme:
+        $ref: '#/definitions/users.themePayload'
+      UseCache:
+        example: true
+        type: boolean
+      Username:
+        example: bob
+        type: string
+    required:
+    - NewPassword
+    - Password
+    - Role
+    - UseCache
+    - Username
+    type: object
+  v1.AppArmorProfile:
+    properties:
+      localhostProfile:
+        description: |-
+          localhostProfile indicates a profile loaded on the node that should be used.
+          The profile must be preconfigured on the node to work.
+          Must match the loaded name of the profile.
+          Must be set if and only if type is "Localhost".
+          +optional
+        type: string
+      type:
+        allOf:
+        - $ref: '#/definitions/v1.AppArmorProfileType'
+        description: |-
+          type indicates which kind of AppArmor profile will be applied.
+          Valid options are:
+            Localhost - a profile pre-loaded on the node.
+            RuntimeDefault - the container runtime's default profile.
+            Unconfined - no AppArmor enforcement.
+          +unionDiscriminator
+    type: object
+  v1.AppArmorProfileType:
+    enum:
+    - Unconfined
+    - RuntimeDefault
+    - Localhost
+    type: string
+    x-enum-varnames:
+    - AppArmorProfileTypeUnconfined
+    - AppArmorProfileTypeRuntimeDefault
+    - AppArmorProfileTypeLocalhost
+  v1.AttachedVolume:
+    properties:
+      devicePath:
+        description: DevicePath represents the device path where the volume should
+          be available
+        type: string
+      name:
+        description: Name of the attached volume
+        type: string
+    type: object
+  v1.CSIPersistentVolumeSource:
+    properties:
+      controllerExpandSecretRef:
+        allOf:
+        - $ref: '#/definitions/v1.SecretReference'
+        description: |-
+          controllerExpandSecretRef is a reference to the secret object containing
+          sensitive information to pass to the CSI driver to complete the CSI
+          ControllerExpandVolume call.
+          This field is optional, and may be empty if no secret is required. If the
+          secret object contains more than one secret, all secrets are passed.
+          +optional
+      controllerPublishSecretRef:
+        allOf:
+        - $ref: '#/definitions/v1.SecretReference'
+        description: |-
+          controllerPublishSecretRef is a reference to the secret object containing
+          sensitive information to pass to the CSI driver to complete the CSI
+          ControllerPublishVolume and ControllerUnpublishVolume calls.
+          This field is optional, and may be empty if no secret is required. If the
+          secret object contains more than one secret, all secrets are passed.
+          +optional
+      driver:
+        description: |-
+          driver is the name of the driver to use for this volume.
+          Required.
+        type: string
+      fsType:
+        description: |-
+          fsType to mount. Must be a filesystem type supported by the host operating system.
+          Ex. "ext4", "xfs", "ntfs".
+          +optional
+        type: string
+      nodeExpandSecretRef:
+        allOf:
+        - $ref: '#/definitions/v1.SecretReference'
+        description: |-
+          nodeExpandSecretRef is a reference to the secret object containing
+          sensitive information to pass to the CSI driver to complete the CSI
+          NodeExpandVolume call.
+          This field is optional, may be omitted if no secret is required. If the
+          secret object contains more than one secret, all secrets are passed.
+          +optional
+      nodePublishSecretRef:
+        allOf:
+        - $ref: '#/definitions/v1.SecretReference'
+        description: |-
+          nodePublishSecretRef is a reference to the secret object containing
+          sensitive information to pass to the CSI driver to complete the CSI
+          NodePublishVolume and NodeUnpublishVolume calls.
+          This field is optional, and may be empty if no secret is required. If the
+          secret object contains more than one secret, all secrets are passed.
+          +optional
+      nodeStageSecretRef:
+        allOf:
+        - $ref: '#/definitions/v1.SecretReference'
+        description: |-
+          nodeStageSecretRef is a reference to the secret object containing sensitive
+          information to pass to the CSI driver to complete the CSI NodeStageVolume
+          and NodeStageVolume and NodeUnstageVolume calls.
+          This field is optional, and may be empty if no secret is required. If the
+          secret object contains more than one secret, all secrets are passed.
+          +optional
+      readOnly:
+        description: |-
+          readOnly value to pass to ControllerPublishVolumeRequest.
+          Defaults to false (read/write).
+          +optional
+        type: boolean
+      volumeAttributes:
+        additionalProperties:
+          type: string
+        description: |-
+          volumeAttributes of the volume to publish.
+          +optional
+        type: object
+      volumeHandle:
+        description: |-
+          volumeHandle is the unique volume name returned by the CSI volume
+          plugin’s CreateVolume to refer to the volume on all subsequent calls.
+          Required.
+        type: string
+    type: object
+  v1.Capabilities:
+    properties:
+      add:
+        description: |-
+          Added capabilities
+          +optional
+          +listType=atomic
+        items:
+          type: string
+        type: array
+      drop:
+        description: |-
+          Removed capabilities
+          +optional
+          +listType=atomic
+        items:
+          type: string
+        type: array
+    type: object
+  v1.ConfigMapEnvSource:
+    properties:
+      name:
+        description: |-
+          Name of the referent.
+          This field is effectively required, but due to backwards compatibility is
+          allowed to be empty. Instances of this type with an empty value here are
+          almost certainly wrong.
+          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+          +optional
+          +default=""
+          +kubebuilder:default=""
+          TODO: Drop `kubebuilder:default` when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.
+        type: string
+      optional:
+        description: |-
+          Specify whether the ConfigMap must be defined
+          +optional
+        type: boolean
+    type: object
+  v1.ConfigMapKeySelector:
+    properties:
+      key:
+        description: The key to select.
+        type: string
+      name:
+        description: |-
+          Name of the referent.
+          This field is effectively required, but due to backwards compatibility is
+          allowed to be empty. Instances of this type with an empty value here are
+          almost certainly wrong.
+          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+          +optional
+          +default=""
+          +kubebuilder:default=""
+          TODO: Drop `kubebuilder:default` when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.
+        type: string
+      optional:
+        description: |-
+          Specify whether the ConfigMap or its key must be defined
+          +optional
+        type: boolean
+    type: object
+  v1.ConfigMapNodeConfigSource:
+    properties:
+      kubeletConfigKey:
+        description: |-
+          KubeletConfigKey declares which key of the referenced ConfigMap corresponds to the KubeletConfiguration structure
+          This field is required in all cases.
+        type: string
+      name:
+        description: |-
+          Name is the metadata.name of the referenced ConfigMap.
+          This field is required in all cases.
+        type: string
+      namespace:
+        description: |-
+          Namespace is the metadata.namespace of the referenced ConfigMap.
+          This field is required in all cases.
+        type: string
+      resourceVersion:
+        description: |-
+          ResourceVersion is the metadata.ResourceVersion of the referenced ConfigMap.
+          This field is forbidden in Node.Spec, and required in Node.Status.
+          +optional
+        type: string
+      uid:
+        description: |-
+          UID is the metadata.UID of the referenced ConfigMap.
+          This field is forbidden in Node.Spec, and required in Node.Status.
+          +optional
+        type: string
+    type: object
+  v1.Container:
+    properties:
+      args:
+        description: |-
+          Arguments to the entrypoint.
+          The container image's CMD is used if this is not provided.
+          Variable references $(VAR_NAME) are expanded using the container's environment. If a variable
+          cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced
+          to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will
+          produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless
+          of whether the variable exists or not. Cannot be updated.
+          More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell
+          +optional
+          +listType=atomic
+        items:
+          type: string
+        type: array
+      command:
+        description: |-
+          Entrypoint array. Not executed within a shell.
+          The container image's ENTRYPOINT is used if this is not provided.
+          Variable references $(VAR_NAME) are expanded using the container's environment. If a variable
+          cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced
+          to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will
+          produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless
+          of whether the variable exists or not. Cannot be updated.
+          More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell
+          +optional
+          +listType=atomic
+        items:
+          type: string
+        type: array
+      env:
+        description: |-
+          List of environment variables to set in the container.
+          Cannot be updated.
+          +optional
+          +patchMergeKey=name
+          +patchStrategy=merge
+          +listType=map
+          +listMapKey=name
+        items:
+          $ref: '#/definitions/v1.EnvVar'
+        type: array
+      envFrom:
+        description: |-
+          List of sources to populate environment variables in the container.
+          The keys defined within a source may consist of any printable ASCII characters except '='.
+          When a key exists in multiple
+          sources, the value associated with the last source will take precedence.
+          Values defined by an Env with a duplicate key will take precedence.
+          Cannot be updated.
+          +optional
+          +listType=atomic
+        items:
+          $ref: '#/definitions/v1.EnvFromSource'
+        type: array
+      image:
+        description: |-
+          Container image name.
+          More info: https://kubernetes.io/docs/concepts/containers/images
+          This field is optional to allow higher level config management to default or override
+          container images in workload controllers like Deployments and StatefulSets.
+          +optional
+        type: string
+      imagePullPolicy:
+        allOf:
+        - $ref: '#/definitions/v1.PullPolicy'
+        description: |-
+          Image pull policy.
+          One of Always, Never, IfNotPresent.
+          Defaults to Always if :latest tag is specified, or IfNotPresent otherwise.
+          Cannot be updated.
+          More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
+          +optional
+      lifecycle:
+        allOf:
+        - $ref: '#/definitions/v1.Lifecycle'
+        description: |-
+          Actions that the management system should take in response to container lifecycle events.
+          Cannot be updated.
+          +optional
+      livenessProbe:
+        allOf:
+        - $ref: '#/definitions/v1.Probe'
+        description: |-
+          Periodic probe of container liveness.
+          Container will be restarted if the probe fails.
+          Cannot be updated.
+          More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+          +optional
+      name:
+        description: |-
+          Name of the container specified as a DNS_LABEL.
+          Each container in a pod must have a unique name (DNS_LABEL).
+          Cannot be updated.
+        type: string
+      ports:
+        description: |-
+          List of ports to expose from the container. Not specifying a port here
+          DOES NOT prevent that port from being exposed. Any port which is
+          listening on the default "0.0.0.0" address inside a container will be
+          accessible from the network.
+          Modifying this array with strategic merge patch may corrupt the data.
+          For more information See https://github.com/kubernetes/kubernetes/issues/108255.
+          Cannot be updated.
+          +optional
+          +patchMergeKey=containerPort
+          +patchStrategy=merge
+          +listType=map
+          +listMapKey=containerPort
+          +listMapKey=protocol
+        items:
+          $ref: '#/definitions/v1.ContainerPort'
+        type: array
+      readinessProbe:
+        allOf:
+        - $ref: '#/definitions/v1.Probe'
+        description: |-
+          Periodic probe of container service readiness.
+          Container will be removed from service endpoints if the probe fails.
+          Cannot be updated.
+          More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+          +optional
+      resizePolicy:
+        description: |-
+          Resources resize policy for the container.
+          This field cannot be set on ephemeral containers.
+          +featureGate=InPlacePodVerticalScaling
+          +optional
+          +listType=atomic
+        items:
+          $ref: '#/definitions/v1.ContainerResizePolicy'
+        type: array
+      resources:
+        allOf:
+        - $ref: '#/definitions/v1.ResourceRequirements'
+        description: |-
+          Compute Resources required by this container.
+          Cannot be updated.
+          More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+          +optional
+      restartPolicy:
+        allOf:
+        - $ref: '#/definitions/v1.ContainerRestartPolicy'
+        description: |-
+          RestartPolicy defines the restart behavior of individual containers in a pod.
+          This overrides the pod-level restart policy. When this field is not specified,
+          the restart behavior is defined by the Pod's restart policy and the container type.
+          Additionally, setting the RestartPolicy as "Always" for the init container will
+          have the following effect:
+          this init container will be continually restarted on
+          exit until all regular containers have terminated. Once all regular
+          containers have completed, all init containers with restartPolicy "Always"
+          will be shut down. This lifecycle differs from normal init containers and
+          is often referred to as a "sidecar" container. Although this init
+          container still starts in the init container sequence, it does not wait
+          for the container to complete before proceeding to the next init
+          container. Instead, the next init container starts immediately after this
+          init container is started, or after any startupProbe has successfully
+          completed.
+          +optional
+      restartPolicyRules:
+        description: |-
+          Represents a list of rules to be checked to determine if the
+          container should be restarted on exit. The rules are evaluated in
+          order. Once a rule matches a container exit condition, the remaining
+          rules are ignored. If no rule matches the container exit condition,
+          the Container-level restart policy determines the whether the container
+          is restarted or not. Constraints on the rules:
+          - At most 20 rules are allowed.
+          - Rules can have the same action.
+          - Identical rules are not forbidden in validations.
+          When rules are specified, container MUST set RestartPolicy explicitly
+          even it if matches the Pod's RestartPolicy.
+          +featureGate=ContainerRestartRules
+          +optional
+          +listType=atomic
+        items:
+          $ref: '#/definitions/v1.ContainerRestartRule'
+        type: array
+      securityContext:
+        allOf:
+        - $ref: '#/definitions/v1.SecurityContext'
+        description: |-
+          SecurityContext defines the security options the container should be run with.
+          If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.
+          More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+          +optional
+      startupProbe:
+        allOf:
+        - $ref: '#/definitions/v1.Probe'
+        description: |-
+          StartupProbe indicates that the Pod has successfully initialized.
+          If specified, no other probes are executed until this completes successfully.
+          If this probe fails, the Pod will be restarted, just as if the livenessProbe failed.
+          This can be used to provide different probe parameters at the beginning of a Pod's lifecycle,
+          when it might take a long time to load data or warm a cache, than during steady-state operation.
+          This cannot be updated.
+          More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+          +optional
+      stdin:
+        description: |-
+          Whether this container should allocate a buffer for stdin in the container runtime. If this
+          is not set, reads from stdin in the container will always result in EOF.
+          Default is false.
+          +optional
+        type: boolean
+      stdinOnce:
+        description: |-
+          Whether the container runtime should close the stdin channel after it has been opened by
+          a single attach. When stdin is true the stdin stream will remain open across multiple attach
+          sessions. If stdinOnce is set to true, stdin is opened on container start, is empty until the
+          first client attaches to stdin, and then remains open and accepts data until the client disconnects,
+          at which time stdin is closed and remains closed until the container is restarted. If this
+          flag is false, a container processes that reads from stdin will never receive an EOF.
+          Default is false
+          +optional
+        type: boolean
+      terminationMessagePath:
+        description: |-
+          Optional: Path at which the file to which the container's termination message
+          will be written is mounted into the container's filesystem.
+          Message written is intended to be brief final status, such as an assertion failure message.
+          Will be truncated by the node if greater than 4096 bytes. The total message length across
+          all containers will be limited to 12kb.
+          Defaults to /dev/termination-log.
+          Cannot be updated.
+          +optional
+        type: string
+      terminationMessagePolicy:
+        allOf:
+        - $ref: '#/definitions/v1.TerminationMessagePolicy'
+        description: |-
+          Indicate how the termination message should be populated. File will use the contents of
+          terminationMessagePath to populate the container status message on both success and failure.
+          FallbackToLogsOnError will use the last chunk of container log output if the termination
+          message file is empty and the container exited with an error.
+          The log output is limited to 2048 bytes or 80 lines, whichever is smaller.
+          Defaults to File.
+          Cannot be updated.
+          +optional
+      tty:
+        description: |-
+          Whether this container should allocate a TTY for itself, also requires 'stdin' to be true.
+          Default is false.
+          +optional
+        type: boolean
+      volumeDevices:
+        description: |-
+          volumeDevices is the list of block devices to be used by the container.
+          +patchMergeKey=devicePath
+          +patchStrategy=merge
+          +listType=map
+          +listMapKey=devicePath
+          +optional
+        items:
+          $ref: '#/definitions/v1.VolumeDevice'
+        type: array
+      volumeMounts:
+        description: |-
+          Pod volumes to mount into the container's filesystem.
+          Cannot be updated.
+          +optional
+          +patchMergeKey=mountPath
+          +patchStrategy=merge
+          +listType=map
+          +listMapKey=mountPath
+        items:
+          $ref: '#/definitions/v1.VolumeMount'
+        type: array
+      workingDir:
+        description: |-
+          Container's working directory.
+          If not specified, the container runtime's default will be used, which
+          might be configured in the container image.
+          Cannot be updated.
+          +optional
+        type: string
+    type: object
+  v1.ContainerImage:
+    properties:
+      names:
+        description: |-
+          Names by which this image is known.
+          e.g. ["kubernetes.example/hyperkube:v1.0.7", "cloud-vendor.registry.example/cloud-vendor/hyperkube:v1.0.7"]
+          +optional
+          +listType=atomic
+        items:
+          type: string
+        type: array
+      sizeBytes:
+        description: |-
+          The size of the image in bytes.
+          +optional
+        type: integer
+    type: object
+  v1.ContainerPort:
+    properties:
+      containerPort:
+        description: |-
+          Number of port to expose on the pod's IP address.
+          This must be a valid port number, 0 < x < 65536.
+        type: integer
+      hostIP:
+        description: |-
+          What host IP to bind the external port to.
+          +optional
+        type: string
+      hostPort:
+        description: |-
+          Number of port to expose on the host.
+          If specified, this must be a valid port number, 0 < x < 65536.
+          If HostNetwork is specified, this must match ContainerPort.
+          Most containers do not need this.
+          +optional
+        type: integer
+      name:
+        description: |-
+          If specified, this must be an IANA_SVC_NAME and unique within the pod. Each
+          named port in a pod must have a unique name. Name for the port that can be
+          referred to by services.
+          +optional
+        type: string
+      protocol:
+        allOf:
+        - $ref: '#/definitions/v1.Protocol'
+        description: |-
+          Protocol for port. Must be UDP, TCP, or SCTP.
+          Defaults to "TCP".
+          +optional
+          +default="TCP"
+    type: object
+  v1.ContainerResizePolicy:
+    properties:
+      resourceName:
+        allOf:
+        - $ref: '#/definitions/v1.ResourceName'
+        description: |-
+          Name of the resource to which this resource resize policy applies.
+          Supported values: cpu, memory.
+      restartPolicy:
+        allOf:
+        - $ref: '#/definitions/v1.ResourceResizeRestartPolicy'
+        description: |-
+          Restart policy to apply when specified resource is resized.
+          If not specified, it defaults to NotRequired.
+    type: object
+  v1.ContainerRestartPolicy:
+    enum:
+    - Always
+    - Never
+    - OnFailure
+    type: string
+    x-enum-varnames:
+    - ContainerRestartPolicyAlways
+    - ContainerRestartPolicyNever
+    - ContainerRestartPolicyOnFailure
+  v1.ContainerRestartRule:
+    properties:
+      action:
+        allOf:
+        - $ref: '#/definitions/v1.ContainerRestartRuleAction'
+        description: |-
+          Specifies the action taken on a container exit if the requirements
+          are satisfied. The only possible value is "Restart" to restart the
+          container.
+          +required
+      exitCodes:
+        allOf:
+        - $ref: '#/definitions/v1.ContainerRestartRuleOnExitCodes'
+        description: |-
+          Represents the exit codes to check on container exits.
+          +optional
+          +oneOf=when
+    type: object
+  v1.ContainerRestartRuleAction:
+    enum:
+    - Restart
+    - RestartAllContainers
+    type: string
+    x-enum-varnames:
+    - ContainerRestartRuleActionRestart
+    - ContainerRestartRuleActionRestartAllContainers
+  v1.ContainerRestartRuleOnExitCodes:
+    properties:
+      operator:
+        allOf:
+        - $ref: '#/definitions/v1.ContainerRestartRuleOnExitCodesOperator'
+        description: |-
+          Represents the relationship between the container exit code(s) and the
+          specified values. Possible values are:
+          - In: the requirement is satisfied if the container exit code is in the
+            set of specified values.
+          - NotIn: the requirement is satisfied if the container exit code is
+            not in the set of specified values.
+          +required
+      values:
+        description: |-
+          Specifies the set of values to check for container exit codes.
+          At most 255 elements are allowed.
+          +optional
+          +listType=set
+        items:
+          type: integer
+        type: array
+    type: object
+  v1.ContainerRestartRuleOnExitCodesOperator:
+    enum:
+    - In
+    - NotIn
+    type: string
+    x-enum-varnames:
+    - ContainerRestartRuleOnExitCodesOpIn
+    - ContainerRestartRuleOnExitCodesOpNotIn
+  v1.DaemonEndpoint:
+    properties:
+      Port:
+        description: Port number of the given endpoint.
+        type: integer
+    type: object
+  v1.EnvFromSource:
+    properties:
+      configMapRef:
+        allOf:
+        - $ref: '#/definitions/v1.ConfigMapEnvSource'
+        description: |-
+          The ConfigMap to select from
+          +optional
+      prefix:
+        description: |-
+          Optional text to prepend to the name of each environment variable.
+          May consist of any printable ASCII characters except '='.
+          +optional
+        type: string
+      secretRef:
+        allOf:
+        - $ref: '#/definitions/v1.SecretEnvSource'
+        description: |-
+          The Secret to select from
+          +optional
+    type: object
+  v1.EnvVar:
+    properties:
+      name:
+        description: |-
+          Name of the environment variable.
+          May consist of any printable ASCII characters except '='.
+        type: string
+      value:
+        description: |-
+          Variable references $(VAR_NAME) are expanded
+          using the previously defined environment variables in the container and
+          any service environment variables. If a variable cannot be resolved,
+          the reference in the input string will be unchanged. Double $$ are reduced
+          to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
+          "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
+          Escaped references will never be expanded, regardless of whether the variable
+          exists or not.
+          Defaults to "".
+          +optional
+        type: string
+      valueFrom:
+        allOf:
+        - $ref: '#/definitions/v1.EnvVarSource'
+        description: |-
+          Source for the environment variable's value. Cannot be used if value is not empty.
+          +optional
+    type: object
+  v1.EnvVarSource:
+    properties:
+      configMapKeyRef:
+        allOf:
+        - $ref: '#/definitions/v1.ConfigMapKeySelector'
+        description: |-
+          Selects a key of a ConfigMap.
+          +optional
+      fieldRef:
+        allOf:
+        - $ref: '#/definitions/v1.ObjectFieldSelector'
+        description: |-
+          Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['<KEY>']`, `metadata.annotations['<KEY>']`,
+          spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.
+          +optional
+      fileKeyRef:
+        allOf:
+        - $ref: '#/definitions/v1.FileKeySelector'
+        description: |-
+          FileKeyRef selects a key of the env file.
+          Requires the EnvFiles feature gate to be enabled.
+
+          +featureGate=EnvFiles
+          +optional
+      resourceFieldRef:
+        allOf:
+        - $ref: '#/definitions/v1.ResourceFieldSelector'
+        description: |-
+          Selects a resource of the container: only resources limits and requests
+          (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.
+          +optional
+      secretKeyRef:
+        allOf:
+        - $ref: '#/definitions/v1.SecretKeySelector'
+        description: |-
+          Selects a key of a secret in the pod's namespace
+          +optional
+    type: object
+  v1.ExecAction:
+    properties:
+      command:
+        description: |-
+          Command is the command line to execute inside the container, the working directory for the
+          command  is root ('/') in the container's filesystem. The command is simply exec'd, it is
+          not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+          a shell, you need to explicitly call out to that shell.
+          Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
+          +optional
+          +listType=atomic
+        items:
+          type: string
+        type: array
+    type: object
+  v1.FieldsV1:
+    type: object
+  v1.FileKeySelector:
+    properties:
+      key:
+        description: |-
+          The key within the env file. An invalid key will prevent the pod from starting.
+          The keys defined within a source may consist of any printable ASCII characters except '='.
+          During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+          +required
+        type: string
+      optional:
+        description: |-
+          Specify whether the file or its key must be defined. If the file or key
+          does not exist, then the env var is not published.
+          If optional is set to true and the specified key does not exist,
+          the environment variable will not be set in the Pod's containers.
+
+          If optional is set to false and the specified key does not exist,
+          an error will be returned during Pod creation.
+          +optional
+          +default=false
+        type: boolean
+      path:
+        description: |-
+          The path within the volume from which to select the file.
+          Must be relative and may not contain the '..' path or start with '..'.
+          +required
+        type: string
+      volumeName:
+        description: |-
+          The name of the volume mount containing the env file.
+          +required
+        type: string
+    type: object
+  v1.GRPCAction:
+    properties:
+      port:
+        description: Port number of the gRPC service. Number must be in the range
+          1 to 65535.
+        type: integer
+      service:
+        description: |-
+          Service is the name of the service to place in the gRPC HealthCheckRequest
+          (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+
+          If this is not specified, the default behavior is defined by gRPC.
+          +optional
+          +default=""
+        type: string
+    type: object
+  v1.HTTPGetAction:
+    properties:
+      host:
+        description: |-
+          Host name to connect to, defaults to the pod IP. You probably want to set
+          "Host" in httpHeaders instead.
+          +optional
+        type: string
+      httpHeaders:
+        description: |-
+          Custom headers to set in the request. HTTP allows repeated headers.
+          +optional
+          +listType=atomic
+        items:
+          $ref: '#/definitions/k8s_io_api_core_v1.HTTPHeader'
+        type: array
+      path:
+        description: |-
+          Path to access on the HTTP server.
+          +optional
+        type: string
+      port:
+        allOf:
+        - $ref: '#/definitions/intstr.IntOrString'
+        description: |-
+          Name or number of the port to access on the container.
+          Number must be in the range 1 to 65535.
+          Name must be an IANA_SVC_NAME.
+      scheme:
+        allOf:
+        - $ref: '#/definitions/v1.URIScheme'
+        description: |-
+          Scheme to use for connecting to the host.
+          Defaults to HTTP.
+          +optional
+    type: object
+  v1.Lifecycle:
+    properties:
+      postStart:
+        allOf:
+        - $ref: '#/definitions/v1.LifecycleHandler'
+        description: |-
+          PostStart is called immediately after a container is created. If the handler fails,
+          the container is terminated and restarted according to its restart policy.
+          Other management of the container blocks until the hook completes.
+          More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks
+          +optional
+      preStop:
+        allOf:
+        - $ref: '#/definitions/v1.LifecycleHandler'
+        description: |-
+          PreStop is called immediately before a container is terminated due to an
+          API request or management event such as liveness/startup probe failure,
+          preemption, resource contention, etc. The handler is not called if the
+          container crashes or exits. The Pod's termination grace period countdown begins before the
+          PreStop hook is executed. Regardless of the outcome of the handler, the
+          container will eventually terminate within the Pod's termination grace
+          period (unless delayed by finalizers). Other management of the container blocks until the hook completes
+          or until the termination grace period is reached.
+          More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks
+          +optional
+      stopSignal:
+        allOf:
+        - $ref: '#/definitions/v1.Signal'
+        description: |-
+          StopSignal defines which signal will be sent to a container when it is being stopped.
+          If not specified, the default is defined by the container runtime in use.
+          StopSignal can only be set for Pods with a non-empty .spec.os.name
+          +optional
+    type: object
+  v1.LifecycleHandler:
+    properties:
+      exec:
+        allOf:
+        - $ref: '#/definitions/v1.ExecAction'
+        description: |-
+          Exec specifies a command to execute in the container.
+          +optional
+      httpGet:
+        allOf:
+        - $ref: '#/definitions/v1.HTTPGetAction'
+        description: |-
+          HTTPGet specifies an HTTP GET request to perform.
+          +optional
+      sleep:
+        allOf:
+        - $ref: '#/definitions/v1.SleepAction'
+        description: |-
+          Sleep represents a duration that the container should sleep.
+          +optional
+      tcpSocket:
+        allOf:
+        - $ref: '#/definitions/v1.TCPSocketAction'
+        description: |-
+          Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept
+          for backward compatibility. There is no validation of this field and
+          lifecycle hooks will fail at runtime when it is specified.
+          +optional
+    type: object
+  v1.ListMeta:
+    properties:
+      continue:
+        description: |-
+          continue may be set if the user set a limit on the number of items returned, and indicates that
+          the server has more data available. The value is opaque and may be used to issue another request
+          to the endpoint that served this list to retrieve the next set of available objects. Continuing a
+          consistent list may not be possible if the server configuration has changed or more than a few
+          minutes have passed. The resourceVersion field returned when using this continue value will be
+          identical to the value in the first response, unless you have received this token from an error
+          message.
+        type: string
+      remainingItemCount:
+        description: |-
+          remainingItemCount is the number of subsequent items in the list which are not included in this
+          list response. If the list request contained label or field selectors, then the number of
+          remaining items is unknown and the field will be left unset and omitted during serialization.
+          If the list is complete (either because it is not chunking or because this is the last chunk),
+          then there are no more remaining items and this field will be left unset and omitted during
+          serialization.
+          Servers older than v1.15 do not set this field.
+          The intended use of the remainingItemCount is *estimating* the size of a collection. Clients
+          should not rely on the remainingItemCount to be set or to be exact.
+          +optional
+        type: integer
+      resourceVersion:
+        description: |-
+          String that identifies the server's internal version of this object that
+          can be used by clients to determine when objects have changed.
+          Value must be treated as opaque by clients and passed unmodified back to the server.
+          Populated by the system.
+          Read-only.
+          More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
+          +optional
+        type: string
+      selfLink:
+        description: |-
+          Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.
+          +optional
+        type: string
+    type: object
+  v1.ManagedFieldsEntry:
+    properties:
+      apiVersion:
+        description: |-
+          APIVersion defines the version of this resource that this field set
+          applies to. The format is "group/version" just like the top-level
+          APIVersion field. It is necessary to track the version of a field
+          set because it cannot be automatically converted.
+        type: string
+      fieldsType:
+        description: |-
+          FieldsType is the discriminator for the different fields format and version.
+          There is currently only one possible value: "FieldsV1"
+        type: string
+      fieldsV1:
+        allOf:
+        - $ref: '#/definitions/v1.FieldsV1'
+        description: |-
+          FieldsV1 holds the first JSON version format as described in the "FieldsV1" type.
+          +optional
+      manager:
+        description: Manager is an identifier of the workflow managing these fields.
+        type: string
+      operation:
+        allOf:
+        - $ref: '#/definitions/v1.ManagedFieldsOperationType'
+        description: |-
+          Operation is the type of operation which lead to this ManagedFieldsEntry being created.
+          The only valid values for this field are 'Apply' and 'Update'.
+      subresource:
+        description: |-
+          Subresource is the name of the subresource used to update that object, or
+          empty string if the object was updated through the main resource. The
+          value of this field is used to distinguish between managers, even if they
+          share the same name. For example, a status update will be distinct from a
+          regular update using the same manager name.
+          Note that the APIVersion field is not related to the Subresource field and
+          it always corresponds to the version of the main resource.
+        type: string
+      time:
+        description: |-
+          Time is the timestamp of when the ManagedFields entry was added. The
+          timestamp will also be updated if a field is added, the manager
+          changes any of the owned fields value or removes a field. The
+          timestamp does not update when a field is removed from the entry
+          because another manager took it over.
+          +optional
+        type: string
+    type: object
+  v1.ManagedFieldsOperationType:
+    enum:
+    - Apply
+    - Update
+    type: string
+    x-enum-varnames:
+    - ManagedFieldsOperationApply
+    - ManagedFieldsOperationUpdate
+  v1.MountPropagationMode:
+    enum:
+    - None
+    - HostToContainer
+    - Bidirectional
+    type: string
+    x-enum-varnames:
+    - MountPropagationNone
+    - MountPropagationHostToContainer
+    - MountPropagationBidirectional
+  v1.NamespaceCondition:
+    properties:
+      lastTransitionTime:
+        description: |-
+          Last time the condition transitioned from one status to another.
+          +optional
+        type: string
+      message:
+        description: |-
+          Human-readable message indicating details about last transition.
+          +optional
+        type: string
+      reason:
+        description: |-
+          Unique, one-word, CamelCase reason for the condition's last transition.
+          +optional
+        type: string
+      status:
+        allOf:
+        - $ref: '#/definitions/k8s_io_api_core_v1.ConditionStatus'
+        description: Status of the condition, one of True, False, Unknown.
+      type:
+        allOf:
+        - $ref: '#/definitions/v1.NamespaceConditionType'
+        description: Type of namespace controller condition.
+    type: object
+  v1.NamespaceConditionType:
+    enum:
+    - NamespaceDeletionDiscoveryFailure
+    - NamespaceDeletionContentFailure
+    - NamespaceDeletionGroupVersionParsingFailure
+    - NamespaceContentRemaining
+    - NamespaceFinalizersRemaining
+    type: string
+    x-enum-varnames:
+    - NamespaceDeletionDiscoveryFailure
+    - NamespaceDeletionContentFailure
+    - NamespaceDeletionGVParsingFailure
+    - NamespaceContentRemaining
+    - NamespaceFinalizersRemaining
+  v1.NamespacePhase:
+    enum:
+    - Active
+    - Terminating
+    type: string
+    x-enum-varnames:
+    - NamespaceActive
+    - NamespaceTerminating
+  v1.NamespaceStatus:
+    properties:
+      conditions:
+        description: |-
+          Represents the latest available observations of a namespace's current state.
+          +optional
+          +patchMergeKey=type
+          +patchStrategy=merge
+          +listType=map
+          +listMapKey=type
+        items:
+          $ref: '#/definitions/v1.NamespaceCondition'
+        type: array
+      phase:
+        allOf:
+        - $ref: '#/definitions/v1.NamespacePhase'
+        description: |-
+          Phase is the current lifecycle phase of the namespace.
+          More info: https://kubernetes.io/docs/tasks/administer-cluster/namespaces/
+          +optional
+    type: object
+  v1.NodeAddress:
+    properties:
+      address:
+        description: The node address.
+        type: string
+      type:
+        allOf:
+        - $ref: '#/definitions/v1.NodeAddressType'
+        description: Node address type, one of Hostname, ExternalIP or InternalIP.
+    type: object
+  v1.NodeAddressType:
+    enum:
+    - Hostname
+    - InternalIP
+    - ExternalIP
+    - InternalDNS
+    - ExternalDNS
+    type: string
+    x-enum-varnames:
+    - NodeHostName
+    - NodeInternalIP
+    - NodeExternalIP
+    - NodeInternalDNS
+    - NodeExternalDNS
+  v1.NodeCondition:
+    properties:
+      lastHeartbeatTime:
+        description: |-
+          Last time we got an update on a given condition.
+          +optional
+        type: string
+      lastTransitionTime:
+        description: |-
+          Last time the condition transit from one status to another.
+          +optional
+        type: string
+      message:
+        description: |-
+          Human readable message indicating details about last transition.
+          +optional
+        type: string
+      reason:
+        description: |-
+          (brief) reason for the condition's last transition.
+          +optional
+        type: string
+      status:
+        allOf:
+        - $ref: '#/definitions/k8s_io_api_core_v1.ConditionStatus'
+        description: Status of the condition, one of True, False, Unknown.
+      type:
+        allOf:
+        - $ref: '#/definitions/v1.NodeConditionType'
+        description: Type of node condition.
+    type: object
+  v1.NodeConditionType:
+    enum:
+    - Ready
+    - MemoryPressure
+    - DiskPressure
+    - PIDPressure
+    - NetworkUnavailable
+    type: string
+    x-enum-varnames:
+    - NodeReady
+    - NodeMemoryPressure
+    - NodeDiskPressure
+    - NodePIDPressure
+    - NodeNetworkUnavailable
+  v1.NodeConfigSource:
+    properties:
+      configMap:
+        allOf:
+        - $ref: '#/definitions/v1.ConfigMapNodeConfigSource'
+        description: ConfigMap is a reference to a Node's ConfigMap
+    type: object
+  v1.NodeConfigStatus:
+    properties:
+      active:
+        allOf:
+        - $ref: '#/definitions/v1.NodeConfigSource'
+        description: |-
+          Active reports the checkpointed config the node is actively using.
+          Active will represent either the current version of the Assigned config,
+          or the current LastKnownGood config, depending on whether attempting to use the
+          Assigned config results in an error.
+          +optional
+      assigned:
+        allOf:
+        - $ref: '#/definitions/v1.NodeConfigSource'
+        description: |-
+          Assigned reports the checkpointed config the node will try to use.
+          When Node.Spec.ConfigSource is updated, the node checkpoints the associated
+          config payload to local disk, along with a record indicating intended
+          config. The node refers to this record to choose its config checkpoint, and
+          reports this record in Assigned. Assigned only updates in the status after
+          the record has been checkpointed to disk. When the Kubelet is restarted,
+          it tries to make the Assigned config the Active config by loading and
+          validating the checkpointed payload identified by Assigned.
+          +optional
+      error:
+        description: |-
+          Error describes any problems reconciling the Spec.ConfigSource to the Active config.
+          Errors may occur, for example, attempting to checkpoint Spec.ConfigSource to the local Assigned
+          record, attempting to checkpoint the payload associated with Spec.ConfigSource, attempting
+          to load or validate the Assigned config, etc.
+          Errors may occur at different points while syncing config. Earlier errors (e.g. download or
+          checkpointing errors) will not result in a rollback to LastKnownGood, and may resolve across
+          Kubelet retries. Later errors (e.g. loading or validating a checkpointed config) will result in
+          a rollback to LastKnownGood. In the latter case, it is usually possible to resolve the error
+          by fixing the config assigned in Spec.ConfigSource.
+          You can find additional information for debugging by searching the error message in the Kubelet log.
+          Error is a human-readable description of the error state; machines can check whether or not Error
+          is empty, but should not rely on the stability of the Error text across Kubelet versions.
+          +optional
+        type: string
+      lastKnownGood:
+        allOf:
+        - $ref: '#/definitions/v1.NodeConfigSource'
+        description: |-
+          LastKnownGood reports the checkpointed config the node will fall back to
+          when it encounters an error attempting to use the Assigned config.
+          The Assigned config becomes the LastKnownGood config when the node determines
+          that the Assigned config is stable and correct.
+          This is currently implemented as a 10-minute soak period starting when the local
+          record of Assigned config is updated. If the Assigned config is Active at the end
+          of this period, it becomes the LastKnownGood. Note that if Spec.ConfigSource is
+          reset to nil (use local defaults), the LastKnownGood is also immediately reset to nil,
+          because the local default config is always assumed good.
+          You should not make assumptions about the node's method of determining config stability
+          and correctness, as this may change or become configurable in the future.
+          +optional
+    type: object
+  v1.NodeDaemonEndpoints:
+    properties:
+      kubeletEndpoint:
+        allOf:
+        - $ref: '#/definitions/v1.DaemonEndpoint'
+        description: |-
+          Endpoint on which Kubelet is listening.
+          +optional
+    type: object
+  v1.NodeFeatures:
+    properties:
+      supplementalGroupsPolicy:
+        description: |-
+          SupplementalGroupsPolicy is set to true if the runtime supports SupplementalGroupsPolicy and ContainerUser.
+          +optional
+        type: boolean
+    type: object
+  v1.NodePhase:
+    enum:
+    - Pending
+    - Running
+    - Terminated
+    type: string
+    x-enum-varnames:
+    - NodePending
+    - NodeRunning
+    - NodeTerminated
+  v1.NodeRuntimeHandler:
+    properties:
+      features:
+        allOf:
+        - $ref: '#/definitions/v1.NodeRuntimeHandlerFeatures'
+        description: |-
+          Supported features.
+          +optional
+      name:
+        description: |-
+          Runtime handler name.
+          Empty for the default runtime handler.
+          +optional
+        type: string
+    type: object
+  v1.NodeRuntimeHandlerFeatures:
+    properties:
+      recursiveReadOnlyMounts:
+        description: |-
+          RecursiveReadOnlyMounts is set to true if the runtime handler supports RecursiveReadOnlyMounts.
+          +optional
+        type: boolean
+      userNamespaces:
+        description: |-
+          UserNamespaces is set to true if the runtime handler supports UserNamespaces, including for volumes.
+          +featureGate=UserNamespacesSupport
+          +optional
+        type: boolean
+    type: object
+  v1.NodeSpec:
+    properties:
+      configSource:
+        allOf:
+        - $ref: '#/definitions/v1.NodeConfigSource'
+        description: |-
+          Deprecated: Previously used to specify the source of the node's configuration for the DynamicKubeletConfig feature. This feature is removed.
+          +optional
+      externalID:
+        description: |-
+          Deprecated. Not all kubelets will set this field. Remove field after 1.13.
+          see: https://issues.k8s.io/61966
+          +optional
+        type: string
+      podCIDR:
+        description: |-
+          PodCIDR represents the pod IP range assigned to the node.
+          +optional
+        type: string
+      podCIDRs:
+        description: |-
+          podCIDRs represents the IP ranges assigned to the node for usage by Pods on that node. If this
+          field is specified, the 0th entry must match the podCIDR field. It may contain at most 1 value for
+          each of IPv4 and IPv6.
+          +optional
+          +patchStrategy=merge
+          +listType=set
+        items:
+          type: string
+        type: array
+      providerID:
+        description: |-
+          ID of the node assigned by the cloud provider in the format: <ProviderName>://<ProviderSpecificNodeID>
+          +optional
+        type: string
+      taints:
+        description: |-
+          If specified, the node's taints.
+          +optional
+          +listType=atomic
+        items:
+          $ref: '#/definitions/v1.Taint'
+        type: array
+      unschedulable:
+        description: |-
+          Unschedulable controls node schedulability of new pods. By default, node is schedulable.
+          More info: https://kubernetes.io/docs/concepts/nodes/node/#manual-node-administration
+          +optional
+        type: boolean
+    type: object
+  v1.NodeStatus:
+    properties:
+      addresses:
+        description: |-
+          List of addresses reachable to the node.
+          Queried from cloud provider, if available.
+          More info: https://kubernetes.io/docs/reference/node/node-status/#addresses
+          Note: This field is declared as mergeable, but the merge key is not sufficiently
+          unique, which can cause data corruption when it is merged. Callers should instead
+          use a full-replacement patch. See https://pr.k8s.io/79391 for an example.
+          Consumers should assume that addresses can change during the
+          lifetime of a Node. However, there are some exceptions where this may not
+          be possible, such as Pods that inherit a Node's address in its own status or
+          consumers of the downward API (status.hostIP).
+          +optional
+          +patchMergeKey=type
+          +patchStrategy=merge
+          +listType=map
+          +listMapKey=type
+        items:
+          $ref: '#/definitions/v1.NodeAddress'
+        type: array
+      allocatable:
+        allOf:
+        - $ref: '#/definitions/v1.ResourceList'
+        description: |-
+          Allocatable represents the resources of a node that are available for scheduling.
+          Defaults to Capacity.
+          +optional
+      capacity:
+        allOf:
+        - $ref: '#/definitions/v1.ResourceList'
+        description: |-
+          Capacity represents the total resources of a node.
+          More info: https://kubernetes.io/docs/reference/node/node-status/#capacity
+          +optional
+      conditions:
+        description: |-
+          Conditions is an array of current observed node conditions.
+          More info: https://kubernetes.io/docs/reference/node/node-status/#condition
+          +optional
+          +patchMergeKey=type
+          +patchStrategy=merge
+          +listType=map
+          +listMapKey=type
+        items:
+          $ref: '#/definitions/v1.NodeCondition'
+        type: array
+      config:
+        allOf:
+        - $ref: '#/definitions/v1.NodeConfigStatus'
+        description: |-
+          Status of the config assigned to the node via the dynamic Kubelet config feature.
+          +optional
+      daemonEndpoints:
+        allOf:
+        - $ref: '#/definitions/v1.NodeDaemonEndpoints'
+        description: |-
+          Endpoints of daemons running on the Node.
+          +optional
+      declaredFeatures:
+        description: |-
+          DeclaredFeatures represents the features related to feature gates that are declared by the node.
+          +featureGate=NodeDeclaredFeatures
+          +optional
+          +listType=atomic
+        items:
+          type: string
+        type: array
+      features:
+        allOf:
+        - $ref: '#/definitions/v1.NodeFeatures'
+        description: |-
+          Features describes the set of features implemented by the CRI implementation.
+          +featureGate=SupplementalGroupsPolicy
+          +optional
+      images:
+        description: |-
+          List of container images on this node
+          +optional
+          +listType=atomic
+        items:
+          $ref: '#/definitions/v1.ContainerImage'
+        type: array
+      nodeInfo:
+        allOf:
+        - $ref: '#/definitions/v1.NodeSystemInfo'
+        description: |-
+          Set of ids/uuids to uniquely identify the node.
+          More info: https://kubernetes.io/docs/reference/node/node-status/#info
+          +optional
+      phase:
+        allOf:
+        - $ref: '#/definitions/v1.NodePhase'
+        description: |-
+          NodePhase is the recently observed lifecycle phase of the node.
+          More info: https://kubernetes.io/docs/concepts/nodes/node/#phase
+          The field is never populated, and now is deprecated.
+          +optional
+      runtimeHandlers:
+        description: |-
+          The available runtime handlers.
+          +featureGate=UserNamespacesSupport
+          +optional
+          +listType=atomic
+        items:
+          $ref: '#/definitions/v1.NodeRuntimeHandler'
+        type: array
+      volumesAttached:
+        description: |-
+          List of volumes that are attached to the node.
+          +optional
+          +listType=atomic
+        items:
+          $ref: '#/definitions/v1.AttachedVolume'
+        type: array
+      volumesInUse:
+        description: |-
+          List of attachable volumes in use (mounted) by the node.
+          +optional
+          +listType=atomic
+        items:
+          type: string
+        type: array
+    type: object
+  v1.NodeSwapStatus:
+    properties:
+      capacity:
+        description: |-
+          Total amount of swap memory in bytes.
+          +optional
+        type: integer
+    type: object
+  v1.NodeSystemInfo:
+    properties:
+      architecture:
+        description: The Architecture reported by the node
+        type: string
+      bootID:
+        description: Boot ID reported by the node.
+        type: string
+      containerRuntimeVersion:
+        description: ContainerRuntime Version reported by the node through runtime
+          remote API (e.g. containerd://1.4.2).
+        type: string
+      kernelVersion:
+        description: Kernel Version reported by the node from 'uname -r' (e.g. 3.16.0-0.bpo.4-amd64).
+        type: string
+      kubeProxyVersion:
+        description: 'Deprecated: KubeProxy Version reported by the node.'
+        type: string
+      kubeletVersion:
+        description: Kubelet Version reported by the node.
+        type: string
+      machineID:
+        description: |-
+          MachineID reported by the node. For unique machine identification
+          in the cluster this field is preferred. Learn more from man(5)
+          machine-id: http://man7.org/linux/man-pages/man5/machine-id.5.html
+        type: string
+      operatingSystem:
+        description: The Operating System reported by the node
+        type: string
+      osImage:
+        description: OS Image reported by the node from /etc/os-release (e.g. Debian
+          GNU/Linux 7 (wheezy)).
+        type: string
+      swap:
+        allOf:
+        - $ref: '#/definitions/v1.NodeSwapStatus'
+        description: Swap Info reported by the node.
+      systemUUID:
+        description: |-
+          SystemUUID reported by the node. For unique machine identification
+          MachineID is preferred. This field is specific to Red Hat hosts
+          https://access.redhat.com/documentation/en-us/red_hat_subscription_management/1/html/rhsm/uuid
+        type: string
+    type: object
+  v1.ObjectFieldSelector:
+    properties:
+      apiVersion:
+        description: |-
+          Version of the schema the FieldPath is written in terms of, defaults to "v1".
+          +optional
+        type: string
+      fieldPath:
+        description: Path of the field to select in the specified API version.
+        type: string
+    type: object
+  v1.ObjectMeta:
+    properties:
+      annotations:
+        additionalProperties:
+          type: string
+        description: |-
+          Annotations is an unstructured key value map stored with a resource that may be
+          set by external tools to store and retrieve arbitrary metadata. They are not
+          queryable and should be preserved when modifying objects.
+          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
+          +optional
+        type: object
+      creationTimestamp:
+        description: |-
+          CreationTimestamp is a timestamp representing the server time when this object was
+          created. It is not guaranteed to be set in happens-before order across separate operations.
+          Clients may not set this value. It is represented in RFC3339 form and is in UTC.
+
+          Populated by the system.
+          Read-only.
+          Null for lists.
+          More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+          +optional
+        type: string
+      deletionGracePeriodSeconds:
+        description: |-
+          Number of seconds allowed for this object to gracefully terminate before
+          it will be removed from the system. Only set when deletionTimestamp is also set.
+          May only be shortened.
+          Read-only.
+          +optional
+        type: integer
+      deletionTimestamp:
+        description: |-
+          DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This
+          field is set by the server when a graceful deletion is requested by the user, and is not
+          directly settable by a client. The resource is expected to be deleted (no longer visible
+          from resource lists, and not reachable by name) after the time in this field, once the
+          finalizers list is empty. As long as the finalizers list contains items, deletion is blocked.
+          Once the deletionTimestamp is set, this value may not be unset or be set further into the
+          future, although it may be shortened or the resource may be deleted prior to this time.
+          For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react
+          by sending a graceful termination signal to the containers in the pod. After that 30 seconds,
+          the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup,
+          remove the pod from the API. In the presence of network partitions, this object may still
+          exist after this timestamp, until an administrator or automated process can determine the
+          resource is fully terminated.
+          If not set, graceful deletion of the object has not been requested.
+
+          Populated by the system when a graceful deletion is requested.
+          Read-only.
+          More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+          +optional
+        type: string
+      finalizers:
+        description: |-
+          Must be empty before the object is deleted from the registry. Each entry
+          is an identifier for the responsible component that will remove the entry
+          from the list. If the deletionTimestamp of the object is non-nil, entries
+          in this list can only be removed.
+          Finalizers may be processed and removed in any order.  Order is NOT enforced
+          because it introduces significant risk of stuck finalizers.
+          finalizers is a shared field, any actor with permission can reorder it.
+          If the finalizer list is processed in order, then this can lead to a situation
+          in which the component responsible for the first finalizer in the list is
+          waiting for a signal (field value, external system, or other) produced by a
+          component responsible for a finalizer later in the list, resulting in a deadlock.
+          Without enforced ordering finalizers are free to order amongst themselves and
+          are not vulnerable to ordering changes in the list.
+          +optional
+          +patchStrategy=merge
+          +listType=set
+        items:
+          type: string
+        type: array
+      generateName:
+        description: |-
+          GenerateName is an optional prefix, used by the server, to generate a unique
+          name ONLY IF the Name field has not been provided.
+          If this field is used, the name returned to the client will be different
+          than the name passed. This value will also be combined with a unique suffix.
+          The provided value has the same validation rules as the Name field,
+          and may be truncated by the length of the suffix required to make the value
+          unique on the server.
+
+          If this field is specified and the generated name exists, the server will return a 409.
+
+          Applied only if Name is not specified.
+          More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency
+          +optional
+        type: string
+      generation:
+        description: |-
+          A sequence number representing a specific generation of the desired state.
+          Populated by the system. Read-only.
+          +optional
+        type: integer
+      labels:
+        additionalProperties:
+          type: string
+        description: |-
+          Map of string keys and values that can be used to organize and categorize
+          (scope and select) objects. May match selectors of replication controllers
+          and services.
+          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
+          +optional
+        type: object
+      managedFields:
+        description: |-
+          ManagedFields maps workflow-id and version to the set of fields
+          that are managed by that workflow. This is mostly for internal
+          housekeeping, and users typically shouldn't need to set or
+          understand this field. A workflow can be the user's name, a
+          controller's name, or the name of a specific apply path like
+          "ci-cd". The set of fields is always in the version that the
+          workflow used when modifying the object.
+
+          +optional
+          +listType=atomic
+        items:
+          $ref: '#/definitions/v1.ManagedFieldsEntry'
+        type: array
+      name:
+        description: |-
+          Name must be unique within a namespace. Is required when creating resources, although
+          some resources may allow a client to request the generation of an appropriate name
+          automatically. Name is primarily intended for creation idempotence and configuration
+          definition.
+          Cannot be updated.
+          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
+          +optional
+        type: string
+      namespace:
+        description: |-
+          Namespace defines the space within which each name must be unique. An empty namespace is
+          equivalent to the "default" namespace, but "default" is the canonical representation.
+          Not all objects are required to be scoped to a namespace - the value of this field for
+          those objects will be empty.
+
+          Must be a DNS_LABEL.
+          Cannot be updated.
+          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces
+          +optional
+        type: string
+      ownerReferences:
+        description: |-
+          List of objects depended by this object. If ALL objects in the list have
+          been deleted, this object will be garbage collected. If this object is managed by a controller,
+          then an entry in this list will point to this controller, with the controller field set to true.
+          There cannot be more than one managing controller.
+          +optional
+          +patchMergeKey=uid
+          +patchStrategy=merge
+          +listType=map
+          +listMapKey=uid
+        items:
+          $ref: '#/definitions/v1.OwnerReference'
+        type: array
+      resourceVersion:
+        description: |-
+          An opaque value that represents the internal version of this object that can
+          be used by clients to determine when objects have changed. May be used for optimistic
+          concurrency, change detection, and the watch operation on a resource or set of resources.
+          Clients must treat these values as opaque and passed unmodified back to the server.
+          They may only be valid for a particular resource or set of resources.
+
+          Populated by the system.
+          Read-only.
+          Value must be treated as opaque by clients and .
+          More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
+          +optional
+        type: string
+      selfLink:
+        description: |-
+          Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.
+          +optional
+        type: string
+      uid:
+        description: |-
+          UID is the unique in time and space value for this object. It is typically generated by
+          the server on successful creation of a resource and is not allowed to change on PUT
+          operations.
+
+          Populated by the system.
+          Read-only.
+          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids
+          +optional
+        type: string
+    type: object
+  v1.OwnerReference:
+    properties:
+      apiVersion:
+        description: API version of the referent.
+        type: string
+      blockOwnerDeletion:
+        description: |-
+          If true, AND if the owner has the "foregroundDeletion" finalizer, then
+          the owner cannot be deleted from the key-value store until this
+          reference is removed.
+          See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion
+          for how the garbage collector interacts with this field and enforces the foreground deletion.
+          Defaults to false.
+          To set this field, a user needs "delete" permission of the owner,
+          otherwise 422 (Unprocessable Entity) will be returned.
+          +optional
+        type: boolean
+      controller:
+        description: |-
+          If true, this reference points to the managing controller.
+          +optional
+        type: boolean
+      kind:
+        description: |-
+          Kind of the referent.
+          More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+        type: string
+      name:
+        description: |-
+          Name of the referent.
+          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
+        type: string
+      uid:
+        description: |-
+          UID of the referent.
+          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids
+        type: string
+    type: object
+  v1.PersistentVolumeAccessMode:
+    enum:
+    - ReadWriteOnce
+    - ReadOnlyMany
+    - ReadWriteMany
+    - ReadWriteOncePod
+    type: string
+    x-enum-varnames:
+    - ReadWriteOnce
+    - ReadOnlyMany
+    - ReadWriteMany
+    - ReadWriteOncePod
+  v1.PersistentVolumeClaimPhase:
+    enum:
+    - Pending
+    - Bound
+    - Lost
+    type: string
+    x-enum-varnames:
+    - ClaimPending
+    - ClaimBound
+    - ClaimLost
+  v1.PersistentVolumeMode:
+    enum:
+    - Block
+    - Filesystem
+    type: string
+    x-enum-varnames:
+    - PersistentVolumeBlock
+    - PersistentVolumeFilesystem
+  v1.PersistentVolumePhase:
+    enum:
+    - Pending
+    - Available
+    - Bound
+    - Released
+    - Failed
+    type: string
+    x-enum-varnames:
+    - VolumePending
+    - VolumeAvailable
+    - VolumeBound
+    - VolumeReleased
+    - VolumeFailed
+  v1.PersistentVolumeReclaimPolicy:
+    enum:
+    - Recycle
+    - Delete
+    - Retain
+    type: string
+    x-enum-varnames:
+    - PersistentVolumeReclaimRecycle
+    - PersistentVolumeReclaimDelete
+    - PersistentVolumeReclaimRetain
+  v1.Probe:
+    properties:
+      exec:
+        allOf:
+        - $ref: '#/definitions/v1.ExecAction'
+        description: |-
+          Exec specifies a command to execute in the container.
+          +optional
+      failureThreshold:
+        description: |-
+          Minimum consecutive failures for the probe to be considered failed after having succeeded.
+          Defaults to 3. Minimum value is 1.
+          +optional
+        type: integer
+      grpc:
+        allOf:
+        - $ref: '#/definitions/v1.GRPCAction'
+        description: |-
+          GRPC specifies a GRPC HealthCheckRequest.
+          +optional
+      httpGet:
+        allOf:
+        - $ref: '#/definitions/v1.HTTPGetAction'
+        description: |-
+          HTTPGet specifies an HTTP GET request to perform.
+          +optional
+      initialDelaySeconds:
+        description: |-
+          Number of seconds after the container has started before liveness probes are initiated.
+          More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+          +optional
+        type: integer
+      periodSeconds:
+        description: |-
+          How often (in seconds) to perform the probe.
+          Default to 10 seconds. Minimum value is 1.
+          +optional
+        type: integer
+      successThreshold:
+        description: |-
+          Minimum consecutive successes for the probe to be considered successful after having failed.
+          Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
+          +optional
+        type: integer
+      tcpSocket:
+        allOf:
+        - $ref: '#/definitions/v1.TCPSocketAction'
+        description: |-
+          TCPSocket specifies a connection to a TCP port.
+          +optional
+      terminationGracePeriodSeconds:
+        description: |-
+          Optional duration in seconds the pod needs to terminate gracefully upon probe failure.
+          The grace period is the duration in seconds after the processes running in the pod are sent
+          a termination signal and the time when the processes are forcibly halted with a kill signal.
+          Set this value longer than the expected cleanup time for your process.
+          If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this
+          value overrides the value provided by the pod spec.
+          Value must be non-negative integer. The value zero indicates stop immediately via
+          the kill signal (no opportunity to shut down).
+          This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.
+          Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset.
+          +optional
+        type: integer
+      timeoutSeconds:
+        description: |-
+          Number of seconds after which the probe times out.
+          Defaults to 1 second. Minimum value is 1.
+          More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+          +optional
+        type: integer
+    type: object
+  v1.ProcMountType:
+    enum:
+    - Default
+    - Unmasked
+    type: string
+    x-enum-varnames:
+    - DefaultProcMount
+    - UnmaskedProcMount
+  v1.Protocol:
+    enum:
+    - TCP
+    - UDP
+    - SCTP
+    type: string
+    x-enum-varnames:
+    - ProtocolTCP
+    - ProtocolUDP
+    - ProtocolSCTP
+  v1.PullPolicy:
+    enum:
+    - Always
+    - Never
+    - IfNotPresent
+    type: string
+    x-enum-varnames:
+    - PullAlways
+    - PullNever
+    - PullIfNotPresent
+  v1.RecursiveReadOnlyMode:
+    enum:
+    - Disabled
+    - IfPossible
+    - Enabled
+    type: string
+    x-enum-varnames:
+    - RecursiveReadOnlyDisabled
+    - RecursiveReadOnlyIfPossible
+    - RecursiveReadOnlyEnabled
+  v1.ResourceFieldSelector:
+    properties:
+      containerName:
+        description: |-
+          Container name: required for volumes, optional for env vars
+          +optional
+        type: string
+      divisor:
+        allOf:
+        - $ref: '#/definitions/resource.Quantity'
+        description: |-
+          Specifies the output format of the exposed resources, defaults to "1"
+          +optional
+      resource:
+        description: 'Required: resource to select'
+        type: string
+    type: object
+  v1.ResourceList:
+    additionalProperties:
+      $ref: '#/definitions/resource.Quantity'
+    type: object
+  v1.ResourceName:
+    enum:
+    - cpu
+    - memory
+    - storage
+    - ephemeral-storage
+    - pods
+    - services
+    - replicationcontrollers
+    - resourcequotas
+    - secrets
+    - configmaps
+    - persistentvolumeclaims
+    - services.nodeports
+    - services.loadbalancers
+    - requests.cpu
+    - requests.memory
+    - requests.storage
+    - requests.ephemeral-storage
+    - limits.cpu
+    - limits.memory
+    - limits.ephemeral-storage
+    type: string
+    x-enum-varnames:
+    - ResourceCPU
+    - ResourceMemory
+    - ResourceStorage
+    - ResourceEphemeralStorage
+    - ResourcePods
+    - ResourceServices
+    - ResourceReplicationControllers
+    - ResourceQuotas
+    - ResourceSecrets
+    - ResourceConfigMaps
+    - ResourcePersistentVolumeClaims
+    - ResourceServicesNodePorts
+    - ResourceServicesLoadBalancers
+    - ResourceRequestsCPU
+    - ResourceRequestsMemory
+    - ResourceRequestsStorage
+    - ResourceRequestsEphemeralStorage
+    - ResourceLimitsCPU
+    - ResourceLimitsMemory
+    - ResourceLimitsEphemeralStorage
+  v1.ResourceQuota:
+    properties:
+      apiVersion:
+        description: |-
+          APIVersion defines the versioned schema of this representation of an object.
+          Servers should convert recognized schemas to the latest internal value, and
+          may reject unrecognized values.
+          More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+          +optional
+        type: string
+      kind:
+        description: |-
+          Kind is a string value representing the REST resource this object represents.
+          Servers may infer this from the endpoint the client submits requests to.
+          Cannot be updated.
+          In CamelCase.
+          More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+          +optional
+        type: string
+      metadata:
+        allOf:
+        - $ref: '#/definitions/v1.ObjectMeta'
+        description: |-
+          Standard object's metadata.
+          More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+          +optional
+      spec:
+        allOf:
+        - $ref: '#/definitions/v1.ResourceQuotaSpec'
+        description: |-
+          Spec defines the desired quota.
+          https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+          +optional
+      status:
+        allOf:
+        - $ref: '#/definitions/v1.ResourceQuotaStatus'
+        description: |-
+          Status defines the actual enforced quota and its current usage.
+          https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+          +optional
+    type: object
+  v1.ResourceQuotaScope:
+    enum:
+    - Terminating
+    - NotTerminating
+    - BestEffort
+    - NotBestEffort
+    - PriorityClass
+    - CrossNamespacePodAffinity
+    - VolumeAttributesClass
+    type: string
+    x-enum-varnames:
+    - ResourceQuotaScopeTerminating
+    - ResourceQuotaScopeNotTerminating
+    - ResourceQuotaScopeBestEffort
+    - ResourceQuotaScopeNotBestEffort
+    - ResourceQuotaScopePriorityClass
+    - ResourceQuotaScopeCrossNamespacePodAffinity
+    - ResourceQuotaScopeVolumeAttributesClass
+  v1.ResourceQuotaSpec:
+    properties:
+      hard:
+        allOf:
+        - $ref: '#/definitions/v1.ResourceList'
+        description: |-
+          hard is the set of desired hard limits for each named resource.
+          More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/
+          +optional
+      scopeSelector:
+        allOf:
+        - $ref: '#/definitions/v1.ScopeSelector'
+        description: |-
+          scopeSelector is also a collection of filters like scopes that must match each object tracked by a quota
+          but expressed using ScopeSelectorOperator in combination with possible values.
+          For a resource to match, both scopes AND scopeSelector (if specified in spec), must be matched.
+          +optional
+      scopes:
+        description: |-
+          A collection of filters that must match each object tracked by a quota.
+          If not specified, the quota matches all objects.
+          +optional
+          +listType=atomic
+        items:
+          $ref: '#/definitions/v1.ResourceQuotaScope'
+        type: array
+    type: object
+  v1.ResourceQuotaStatus:
+    properties:
+      hard:
+        allOf:
+        - $ref: '#/definitions/v1.ResourceList'
+        description: |-
+          Hard is the set of enforced hard limits for each named resource.
+          More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/
+          +optional
+      used:
+        allOf:
+        - $ref: '#/definitions/v1.ResourceList'
+        description: |-
+          Used is the current observed total usage of the resource in the namespace.
+          +optional
+    type: object
+  v1.ResourceRequirements:
+    properties:
+      claims:
+        description: |-
+          Claims lists the names of resources, defined in spec.resourceClaims,
+          that are used by this container.
+
+          This field depends on the
+          DynamicResourceAllocation feature gate.
+
+          This field is immutable. It can only be set for containers.
+
+          +listType=map
+          +listMapKey=name
+          +featureGate=DynamicResourceAllocation
+          +optional
+        items:
+          $ref: '#/definitions/k8s_io_api_core_v1.ResourceClaim'
+        type: array
+      limits:
+        allOf:
+        - $ref: '#/definitions/v1.ResourceList'
+        description: |-
+          Limits describes the maximum amount of compute resources allowed.
+          More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+          +optional
+      requests:
+        allOf:
+        - $ref: '#/definitions/v1.ResourceList'
+        description: |-
+          Requests describes the minimum amount of compute resources required.
+          If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+          otherwise to an implementation-defined value. Requests cannot exceed Limits.
+          More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+          +optional
+    type: object
+  v1.ResourceResizeRestartPolicy:
+    enum:
+    - NotRequired
+    - RestartContainer
+    type: string
+    x-enum-varnames:
+    - NotRequired
+    - RestartContainer
+  v1.RoleRef:
+    properties:
+      apiGroup:
+        description: APIGroup is the group for the resource being referenced
+        type: string
+      kind:
+        description: Kind is the type of resource being referenced
+        type: string
+      name:
+        description: |-
+          Name is the name of resource being referenced
+          +required
+          +k8s:required
+        type: string
+    type: object
+  v1.SELinuxOptions:
+    properties:
+      level:
+        description: |-
+          Level is SELinux level label that applies to the container.
+          +optional
+        type: string
+      role:
+        description: |-
+          Role is a SELinux role label that applies to the container.
+          +optional
+        type: string
+      type:
+        description: |-
+          Type is a SELinux type label that applies to the container.
+          +optional
+        type: string
+      user:
+        description: |-
+          User is a SELinux user label that applies to the container.
+          +optional
+        type: string
+    type: object
+  v1.ScopeSelector:
+    properties:
+      matchExpressions:
+        description: |-
+          A list of scope selector requirements by scope of the resources.
+          +optional
+          +listType=atomic
+        items:
+          $ref: '#/definitions/v1.ScopedResourceSelectorRequirement'
+        type: array
+    type: object
+  v1.ScopeSelectorOperator:
+    enum:
+    - In
+    - NotIn
+    - Exists
+    - DoesNotExist
+    type: string
+    x-enum-varnames:
+    - ScopeSelectorOpIn
+    - ScopeSelectorOpNotIn
+    - ScopeSelectorOpExists
+    - ScopeSelectorOpDoesNotExist
+  v1.ScopedResourceSelectorRequirement:
+    properties:
+      operator:
+        allOf:
+        - $ref: '#/definitions/v1.ScopeSelectorOperator'
+        description: |-
+          Represents a scope's relationship to a set of values.
+          Valid operators are In, NotIn, Exists, DoesNotExist.
+      scopeName:
+        allOf:
+        - $ref: '#/definitions/v1.ResourceQuotaScope'
+        description: The name of the scope that the selector applies to.
+      values:
+        description: |-
+          An array of string values. If the operator is In or NotIn,
+          the values array must be non-empty. If the operator is Exists or DoesNotExist,
+          the values array must be empty.
+          This array is replaced during a strategic merge patch.
+          +optional
+          +listType=atomic
+        items:
+          type: string
+        type: array
+    type: object
+  v1.SeccompProfile:
+    properties:
+      localhostProfile:
+        description: |-
+          localhostProfile indicates a profile defined in a file on the node should be used.
+          The profile must be preconfigured on the node to work.
+          Must be a descending path, relative to the kubelet's configured seccomp profile location.
+          Must be set if type is "Localhost". Must NOT be set for any other type.
+          +optional
+        type: string
+      type:
+        allOf:
+        - $ref: '#/definitions/v1.SeccompProfileType'
+        description: |-
+          type indicates which kind of seccomp profile will be applied.
+          Valid options are:
+
+          Localhost - a profile defined in a file on the node should be used.
+          RuntimeDefault - the container runtime default profile should be used.
+          Unconfined - no profile should be applied.
+          +unionDiscriminator
+    type: object
+  v1.SeccompProfileType:
+    enum:
+    - Unconfined
+    - RuntimeDefault
+    - Localhost
+    type: string
+    x-enum-varnames:
+    - SeccompProfileTypeUnconfined
+    - SeccompProfileTypeRuntimeDefault
+    - SeccompProfileTypeLocalhost
+  v1.SecretEnvSource:
+    properties:
+      name:
+        description: |-
+          Name of the referent.
+          This field is effectively required, but due to backwards compatibility is
+          allowed to be empty. Instances of this type with an empty value here are
+          almost certainly wrong.
+          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+          +optional
+          +default=""
+          +kubebuilder:default=""
+          TODO: Drop `kubebuilder:default` when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.
+        type: string
+      optional:
+        description: |-
+          Specify whether the Secret must be defined
+          +optional
+        type: boolean
+    type: object
+  v1.SecretKeySelector:
+    properties:
+      key:
+        description: The key of the secret to select from.  Must be a valid secret
+          key.
+        type: string
+      name:
+        description: |-
+          Name of the referent.
+          This field is effectively required, but due to backwards compatibility is
+          allowed to be empty. Instances of this type with an empty value here are
+          almost certainly wrong.
+          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+          +optional
+          +default=""
+          +kubebuilder:default=""
+          TODO: Drop `kubebuilder:default` when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.
+        type: string
+      optional:
+        description: |-
+          Specify whether the Secret or its key must be defined
+          +optional
+        type: boolean
+    type: object
+  v1.SecretReference:
+    properties:
+      name:
+        description: |-
+          name is unique within a namespace to reference a secret resource.
+          +optional
+        type: string
+      namespace:
+        description: |-
+          namespace defines the space within which the secret name must be unique.
+          +optional
+        type: string
+    type: object
+  v1.SecurityContext:
+    properties:
+      allowPrivilegeEscalation:
+        description: |-
+          AllowPrivilegeEscalation controls whether a process can gain more
+          privileges than its parent process. This bool directly controls if
+          the no_new_privs flag will be set on the container process.
+          AllowPrivilegeEscalation is true always when the container is:
+          1) run as Privileged
+          2) has CAP_SYS_ADMIN
+          Note that this field cannot be set when spec.os.name is windows.
+          +optional
+        type: boolean
+      appArmorProfile:
+        allOf:
+        - $ref: '#/definitions/v1.AppArmorProfile'
+        description: |-
+          appArmorProfile is the AppArmor options to use by this container. If set, this profile
+          overrides the pod's appArmorProfile.
+          Note that this field cannot be set when spec.os.name is windows.
+          +optional
+      capabilities:
+        allOf:
+        - $ref: '#/definitions/v1.Capabilities'
+        description: |-
+          The capabilities to add/drop when running containers.
+          Defaults to the default set of capabilities granted by the container runtime.
+          Note that this field cannot be set when spec.os.name is windows.
+          +optional
+      privileged:
+        description: |-
+          Run container in privileged mode.
+          Processes in privileged containers are essentially equivalent to root on the host.
+          Defaults to false.
+          Note that this field cannot be set when spec.os.name is windows.
+          +optional
+        type: boolean
+      procMount:
+        allOf:
+        - $ref: '#/definitions/v1.ProcMountType'
+        description: |-
+          procMount denotes the type of proc mount to use for the containers.
+          The default value is Default which uses the container runtime defaults for
+          readonly paths and masked paths.
+          This requires the ProcMountType feature flag to be enabled.
+          Note that this field cannot be set when spec.os.name is windows.
+          +optional
+      readOnlyRootFilesystem:
+        description: |-
+          Whether this container has a read-only root filesystem.
+          Default is false.
+          Note that this field cannot be set when spec.os.name is windows.
+          +optional
+        type: boolean
+      runAsGroup:
+        description: |-
+          The GID to run the entrypoint of the container process.
+          Uses runtime default if unset.
+          May also be set in PodSecurityContext.  If set in both SecurityContext and
+          PodSecurityContext, the value specified in SecurityContext takes precedence.
+          Note that this field cannot be set when spec.os.name is windows.
+          +optional
+        type: integer
+      runAsNonRoot:
+        description: |-
+          Indicates that the container must run as a non-root user.
+          If true, the Kubelet will validate the image at runtime to ensure that it
+          does not run as UID 0 (root) and fail to start the container if it does.
+          If unset or false, no such validation will be performed.
+          May also be set in PodSecurityContext.  If set in both SecurityContext and
+          PodSecurityContext, the value specified in SecurityContext takes precedence.
+          +optional
+        type: boolean
+      runAsUser:
+        description: |-
+          The UID to run the entrypoint of the container process.
+          Defaults to user specified in image metadata if unspecified.
+          May also be set in PodSecurityContext.  If set in both SecurityContext and
+          PodSecurityContext, the value specified in SecurityContext takes precedence.
+          Note that this field cannot be set when spec.os.name is windows.
+          +optional
+        type: integer
+      seLinuxOptions:
+        allOf:
+        - $ref: '#/definitions/v1.SELinuxOptions'
+        description: |-
+          The SELinux context to be applied to the container.
+          If unspecified, the container runtime will allocate a random SELinux context for each
+          container.  May also be set in PodSecurityContext.  If set in both SecurityContext and
+          PodSecurityContext, the value specified in SecurityContext takes precedence.
+          Note that this field cannot be set when spec.os.name is windows.
+          +optional
+      seccompProfile:
+        allOf:
+        - $ref: '#/definitions/v1.SeccompProfile'
+        description: |-
+          The seccomp options to use by this container. If seccomp options are
+          provided at both the pod & container level, the container options
+          override the pod options.
+          Note that this field cannot be set when spec.os.name is windows.
+          +optional
+      windowsOptions:
+        allOf:
+        - $ref: '#/definitions/v1.WindowsSecurityContextOptions'
+        description: |-
+          The Windows specific settings applied to all containers.
+          If unspecified, the options from the PodSecurityContext will be used.
+          If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
+          Note that this field cannot be set when spec.os.name is linux.
+          +optional
+    type: object
+  v1.Signal:
+    enum:
+    - SIGABRT
+    - SIGALRM
+    - SIGBUS
+    - SIGCHLD
+    - SIGCLD
+    - SIGCONT
+    - SIGFPE
+    - SIGHUP
+    - SIGILL
+    - SIGINT
+    - SIGIO
+    - SIGIOT
+    - SIGKILL
+    - SIGPIPE
+    - SIGPOLL
+    - SIGPROF
+    - SIGPWR
+    - SIGQUIT
+    - SIGSEGV
+    - SIGSTKFLT
+    - SIGSTOP
+    - SIGSYS
+    - SIGTERM
+    - SIGTRAP
+    - SIGTSTP
+    - SIGTTIN
+    - SIGTTOU
+    - SIGURG
+    - SIGUSR1
+    - SIGUSR2
+    - SIGVTALRM
+    - SIGWINCH
+    - SIGXCPU
+    - SIGXFSZ
+    - SIGRTMIN
+    - SIGRTMIN+1
+    - SIGRTMIN+2
+    - SIGRTMIN+3
+    - SIGRTMIN+4
+    - SIGRTMIN+5
+    - SIGRTMIN+6
+    - SIGRTMIN+7
+    - SIGRTMIN+8
+    - SIGRTMIN+9
+    - SIGRTMIN+10
+    - SIGRTMIN+11
+    - SIGRTMIN+12
+    - SIGRTMIN+13
+    - SIGRTMIN+14
+    - SIGRTMIN+15
+    - SIGRTMAX-14
+    - SIGRTMAX-13
+    - SIGRTMAX-12
+    - SIGRTMAX-11
+    - SIGRTMAX-10
+    - SIGRTMAX-9
+    - SIGRTMAX-8
+    - SIGRTMAX-7
+    - SIGRTMAX-6
+    - SIGRTMAX-5
+    - SIGRTMAX-4
+    - SIGRTMAX-3
+    - SIGRTMAX-2
+    - SIGRTMAX-1
+    - SIGRTMAX
+    type: string
+    x-enum-varnames:
+    - SIGABRT
+    - SIGALRM
+    - SIGBUS
+    - SIGCHLD
+    - SIGCLD
+    - SIGCONT
+    - SIGFPE
+    - SIGHUP
+    - SIGILL
+    - SIGINT
+    - SIGIO
+    - SIGIOT
+    - SIGKILL
+    - SIGPIPE
+    - SIGPOLL
+    - SIGPROF
+    - SIGPWR
+    - SIGQUIT
+    - SIGSEGV
+    - SIGSTKFLT
+    - SIGSTOP
+    - SIGSYS
+    - SIGTERM
+    - SIGTRAP
+    - SIGTSTP
+    - SIGTTIN
+    - SIGTTOU
+    - SIGURG
+    - SIGUSR1
+    - SIGUSR2
+    - SIGVTALRM
+    - SIGWINCH
+    - SIGXCPU
+    - SIGXFSZ
+    - SIGRTMIN
+    - SIGRTMINPLUS1
+    - SIGRTMINPLUS2
+    - SIGRTMINPLUS3
+    - SIGRTMINPLUS4
+    - SIGRTMINPLUS5
+    - SIGRTMINPLUS6
+    - SIGRTMINPLUS7
+    - SIGRTMINPLUS8
+    - SIGRTMINPLUS9
+    - SIGRTMINPLUS10
+    - SIGRTMINPLUS11
+    - SIGRTMINPLUS12
+    - SIGRTMINPLUS13
+    - SIGRTMINPLUS14
+    - SIGRTMINPLUS15
+    - SIGRTMAXMINUS14
+    - SIGRTMAXMINUS13
+    - SIGRTMAXMINUS12
+    - SIGRTMAXMINUS11
+    - SIGRTMAXMINUS10
+    - SIGRTMAXMINUS9
+    - SIGRTMAXMINUS8
+    - SIGRTMAXMINUS7
+    - SIGRTMAXMINUS6
+    - SIGRTMAXMINUS5
+    - SIGRTMAXMINUS4
+    - SIGRTMAXMINUS3
+    - SIGRTMAXMINUS2
+    - SIGRTMAXMINUS1
+    - SIGRTMAX
+  v1.SleepAction:
+    properties:
+      seconds:
+        description: Seconds is the number of seconds to sleep.
+        type: integer
+    type: object
+  v1.TCPSocketAction:
+    properties:
+      host:
+        description: |-
+          Optional: Host name to connect to, defaults to the pod IP.
+          +optional
+        type: string
+      port:
+        allOf:
+        - $ref: '#/definitions/intstr.IntOrString'
+        description: |-
+          Number or name of the port to access on the container.
+          Number must be in the range 1 to 65535.
+          Name must be an IANA_SVC_NAME.
+    type: object
+  v1.Taint:
+    properties:
+      effect:
+        allOf:
+        - $ref: '#/definitions/v1.TaintEffect'
+        description: |-
+          Required. The effect of the taint on pods
+          that do not tolerate the taint.
+          Valid effects are NoSchedule, PreferNoSchedule and NoExecute.
+      key:
+        description: Required. The taint key to be applied to a node.
+        type: string
+      timeAdded:
+        description: |-
+          TimeAdded represents the time at which the taint was added.
+          +optional
+        type: string
+      value:
+        description: |-
+          The taint value corresponding to the taint key.
+          +optional
+        type: string
+    type: object
+  v1.TaintEffect:
+    enum:
+    - NoSchedule
+    - PreferNoSchedule
+    - NoExecute
+    type: string
+    x-enum-varnames:
+    - TaintEffectNoSchedule
+    - TaintEffectPreferNoSchedule
+    - TaintEffectNoExecute
+  v1.TerminationMessagePolicy:
+    enum:
+    - File
+    - FallbackToLogsOnError
+    type: string
+    x-enum-varnames:
+    - TerminationMessageReadFile
+    - TerminationMessageFallbackToLogsOnError
+  v1.URIScheme:
+    enum:
+    - HTTP
+    - HTTPS
+    type: string
+    x-enum-varnames:
+    - URISchemeHTTP
+    - URISchemeHTTPS
+  v1.VolumeDevice:
+    properties:
+      devicePath:
+        description: devicePath is the path inside of the container that the device
+          will be mapped to.
+        type: string
+      name:
+        description: name must match the name of a persistentVolumeClaim in the pod
+        type: string
+    type: object
+  v1.VolumeMount:
+    properties:
+      mountPath:
+        description: |-
+          Path within the container at which the volume should be mounted.  Must
+          not contain ':'.
+        type: string
+      mountPropagation:
+        allOf:
+        - $ref: '#/definitions/v1.MountPropagationMode'
+        description: |-
+          mountPropagation determines how mounts are propagated from the host
+          to container and the other way around.
+          When not set, MountPropagationNone is used.
+          This field is beta in 1.10.
+          When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified
+          (which defaults to None).
+          +optional
+      name:
+        description: This must match the Name of a Volume.
+        type: string
+      readOnly:
+        description: |-
+          Mounted read-only if true, read-write otherwise (false or unspecified).
+          Defaults to false.
+          +optional
+        type: boolean
+      recursiveReadOnly:
+        allOf:
+        - $ref: '#/definitions/v1.RecursiveReadOnlyMode'
+        description: |-
+          RecursiveReadOnly specifies whether read-only mounts should be handled
+          recursively.
+
+          If ReadOnly is false, this field has no meaning and must be unspecified.
+
+          If ReadOnly is true, and this field is set to Disabled, the mount is not made
+          recursively read-only.  If this field is set to IfPossible, the mount is made
+          recursively read-only, if it is supported by the container runtime.  If this
+          field is set to Enabled, the mount is made recursively read-only if it is
+          supported by the container runtime, otherwise the pod will not be started and
+          an error will be generated to indicate the reason.
+
+          If this field is set to IfPossible or Enabled, MountPropagation must be set to
+          None (or be unspecified, which defaults to None).
+
+          If this field is not specified, it is treated as an equivalent of Disabled.
+          +optional
+      subPath:
+        description: |-
+          Path within the volume from which the container's volume should be mounted.
+          Defaults to "" (volume's root).
+          +optional
+        type: string
+      subPathExpr:
+        description: |-
+          Expanded path within the volume from which the container's volume should be mounted.
+          Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.
+          Defaults to "" (volume's root).
+          SubPathExpr and SubPath are mutually exclusive.
+          +optional
+        type: string
+    type: object
+  v1.WindowsSecurityContextOptions:
+    properties:
+      gmsaCredentialSpec:
+        description: |-
+          GMSACredentialSpec is where the GMSA admission webhook
+          (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the
+          GMSA credential spec named by the GMSACredentialSpecName field.
+          +optional
+        type: string
+      gmsaCredentialSpecName:
+        description: |-
+          GMSACredentialSpecName is the name of the GMSA credential spec to use.
+          +optional
+        type: string
+      hostProcess:
+        description: |-
+          HostProcess determines if a container should be run as a 'Host Process' container.
+          All of a Pod's containers must have the same effective HostProcess value
+          (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).
+          In addition, if HostProcess is true then HostNetwork must also be set to true.
+          +optional
+        type: boolean
+      runAsUserName:
+        description: |-
+          The UserName in Windows to run the entrypoint of the container process.
+          Defaults to the user specified in image metadata if unspecified.
+          May also be set in PodSecurityContext. If set in both SecurityContext and
+          PodSecurityContext, the value specified in SecurityContext takes precedence.
+          +optional
+        type: string
+    type: object
+  v1beta1.ContainerMetrics:
+    properties:
+      name:
+        description: Container name corresponding to the one from pod.spec.containers.
+        type: string
+      usage:
+        allOf:
+        - $ref: '#/definitions/v1.ResourceList'
+        description: The memory usage is the memory working set.
+    type: object
+  v1beta1.NodeMetrics:
+    properties:
+      apiVersion:
+        description: |-
+          APIVersion defines the versioned schema of this representation of an object.
+          Servers should convert recognized schemas to the latest internal value, and
+          may reject unrecognized values.
+          More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+          +optional
+        type: string
+      kind:
+        description: |-
+          Kind is a string value representing the REST resource this object represents.
+          Servers may infer this from the endpoint the client submits requests to.
+          Cannot be updated.
+          In CamelCase.
+          More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+          +optional
+        type: string
+      metadata:
+        allOf:
+        - $ref: '#/definitions/v1.ObjectMeta'
+        description: |-
+          Standard object's metadata.
+          More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+          +optional
+      timestamp:
+        description: |-
+          The following fields define time interval from which metrics were
+          collected from the interval [Timestamp-Window, Timestamp].
+        type: string
+      usage:
+        allOf:
+        - $ref: '#/definitions/v1.ResourceList'
+        description: The memory usage is the memory working set.
+      window:
+        type: string
+    type: object
+  v1beta1.NodeMetricsList:
+    properties:
+      apiVersion:
+        description: |-
+          APIVersion defines the versioned schema of this representation of an object.
+          Servers should convert recognized schemas to the latest internal value, and
+          may reject unrecognized values.
+          More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+          +optional
+        type: string
+      items:
+        description: List of node metrics.
+        items:
+          $ref: '#/definitions/v1beta1.NodeMetrics'
+        type: array
+      kind:
+        description: |-
+          Kind is a string value representing the REST resource this object represents.
+          Servers may infer this from the endpoint the client submits requests to.
+          Cannot be updated.
+          In CamelCase.
+          More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+          +optional
+        type: string
+      metadata:
+        allOf:
+        - $ref: '#/definitions/v1.ListMeta'
+        description: |-
+          Standard list metadata.
+          More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+    type: object
+  v1beta1.PodMetrics:
+    properties:
+      apiVersion:
+        description: |-
+          APIVersion defines the versioned schema of this representation of an object.
+          Servers should convert recognized schemas to the latest internal value, and
+          may reject unrecognized values.
+          More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+          +optional
+        type: string
+      containers:
+        description: |-
+          Metrics for all containers are collected within the same time window.
+          +listType=atomic
+        items:
+          $ref: '#/definitions/v1beta1.ContainerMetrics'
+        type: array
+      kind:
+        description: |-
+          Kind is a string value representing the REST resource this object represents.
+          Servers may infer this from the endpoint the client submits requests to.
+          Cannot be updated.
+          In CamelCase.
+          More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+          +optional
+        type: string
+      metadata:
+        allOf:
+        - $ref: '#/definitions/v1.ObjectMeta'
+        description: |-
+          Standard object's metadata.
+          More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+          +optional
+      timestamp:
+        description: |-
+          The following fields define time interval from which metrics were
+          collected from the interval [Timestamp-Window, Timestamp].
+        type: string
+      window:
+        type: string
+    type: object
+  v1beta1.PodMetricsList:
+    properties:
+      apiVersion:
+        description: |-
+          APIVersion defines the versioned schema of this representation of an object.
+          Servers should convert recognized schemas to the latest internal value, and
+          may reject unrecognized values.
+          More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+          +optional
+        type: string
+      items:
+        description: List of pod metrics.
+        items:
+          $ref: '#/definitions/v1beta1.PodMetrics'
+        type: array
+      kind:
+        description: |-
+          Kind is a string value representing the REST resource this object represents.
+          Servers may infer this from the endpoint the client submits requests to.
+          Cannot be updated.
+          In CamelCase.
+          More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+          +optional
+        type: string
+      metadata:
+        allOf:
+        - $ref: '#/definitions/v1.ListMeta'
+        description: |-
+          Standard list metadata.
+          More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+    type: object
+  webhooks.webhookCreatePayload:
+    properties:
+      EndpointID:
+        type: integer
+      RegistryID:
+        type: integer
+      ResourceID:
+        type: string
+      WebhookType:
+        allOf:
+        - $ref: '#/definitions/portainer.WebhookType'
+        description: Type of webhook (1 - service)
+    type: object
+  webhooks.webhookUpdatePayload:
+    properties:
+      RegistryID:
+        type: integer
+    type: object
+  workflows.ArtifactDetail:
+    properties:
+      autoUpdate:
+        $ref: '#/definitions/portainer.AutoUpdateSettings'
+      creationDate:
+        type: integer
+      files:
+        items:
+          $ref: '#/definitions/workflows.ArtifactFileDetail'
+        type: array
+      id:
+        type: integer
+      lastSyncDate:
+        type: integer
+      name:
+        type: string
+      platform:
+        $ref: '#/definitions/workflows.DeploymentPlatform'
+      status:
+        $ref: '#/definitions/workflows.WorkflowStatusObject'
+      target:
+        $ref: '#/definitions/workflows.Target'
+      type:
+        $ref: '#/definitions/workflows.Type'
+    required:
+    - id
+    - name
+    - type
+    type: object
+  workflows.ArtifactFileDetail:
+    properties:
+      hash:
+        example: abc123
+        type: string
+      path:
+        example: portainer.yaml
+        type: string
+      pathError:
+        type: string
+      pathStatus:
+        $ref: '#/definitions/sources.Status'
+      ref:
+        example: refs/heads/main
+        type: string
+      refError:
+        type: string
+      refStatus:
+        $ref: '#/definitions/sources.Status'
+      sourceId:
+        type: integer
+    type: object
+  workflows.DeploymentPlatform:
+    enum:
+    - dockerStandalone
+    - dockerSwarm
+    - kubernetes
+    type: string
+    x-enum-varnames:
+    - DeploymentPlatformDockerStandalone
+    - DeploymentPlatformDockerSwarm
+    - DeploymentPlatformKubernetes
+  workflows.Status:
+    enum:
+    - healthy
+    - syncing
+    - error
+    - paused
+    - unknown
+    type: string
+    x-enum-varnames:
+    - StatusHealthy
+    - StatusSyncing
+    - StatusError
+    - StatusPaused
+    - StatusUnknown
+  workflows.StatusSummary:
+    properties:
+      error:
+        type: integer
+      healthy:
+        type: integer
+      paused:
+        type: integer
+      syncing:
+        type: integer
+      unknown:
+        type: integer
+    type: object
+  workflows.Target:
+    properties:
+      edgeGroupIds:
+        items:
+          type: integer
+        type: array
+      endpointId:
+        type: integer
+      groupStatus:
+        additionalProperties:
+          $ref: '#/definitions/workflows.Status'
+        type: object
+      namespace:
+        type: string
+      resolvedEndpointIds:
+        items:
+          type: integer
+        type: array
+    type: object
+  workflows.Type:
+    enum:
+    - stack
+    - edgeStack
+    type: string
+    x-enum-varnames:
+    - TypeStack
+    - TypeEdgeStack
+  workflows.Workflow:
+    properties:
+      autoUpdate:
+        $ref: '#/definitions/portainer.AutoUpdateSettings'
+      creationDate:
+        type: integer
+      gitConfig:
+        $ref: '#/definitions/gittypes.RepoConfig'
+      id:
+        type: integer
+      lastSyncDate:
+        type: integer
+      name:
+        type: string
+      platform:
+        $ref: '#/definitions/workflows.DeploymentPlatform'
+      sourceId:
+        type: integer
+      status:
+        $ref: '#/definitions/workflows.WorkflowStatusObject'
+      target:
+        $ref: '#/definitions/workflows.Target'
+      type:
+        $ref: '#/definitions/workflows.Type'
+    required:
+    - id
+    - name
+    - platform
+    - status
+    - target
+    - type
+    type: object
+  workflows.WorkflowDetail:
+    properties:
+      artifacts:
+        items:
+          $ref: '#/definitions/workflows.ArtifactDetail'
+        type: array
+      id:
+        type: integer
+      name:
+        type: string
+    required:
+    - id
+    - name
+    type: object
+  workflows.WorkflowPhaseStatus:
+    properties:
+      error:
+        type: string
+      status:
+        $ref: '#/definitions/workflows.Status'
+    type: object
+  workflows.WorkflowStatusObject:
+    properties:
+      artifact:
+        $ref: '#/definitions/workflows.WorkflowPhaseStatus'
+      source:
+        $ref: '#/definitions/workflows.WorkflowPhaseStatus'
+      target:
+        $ref: '#/definitions/workflows.WorkflowPhaseStatus'
+    type: object
+info:
+  contact:
+    email: info@portainer.io
+  description: |
+    The Portainer API is an HTTP API served by Portainer. It is used by the Portainer UI, and anything you can do in the UI can also be done via the HTTP API.
+
+    API examples are available in the [Portainer documentation](https://documentation.portainer.io/api/api-examples/)
+
+    You can find out more about Portainer [on our website](http://portainer.io) and get some support on [Slack](http://portainer.io/slack/).
+
+    # Authentication
+
+    Most of the API endpoints require authentication, as well as some level of authorization.
+    Portainer uses JSON Web Tokens to manage authentication. You must provide a token in the **Authorization** header of each request using the **Bearer** scheme.
+
+    Example:
+
+    ```
+    Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6MSwidXNlcm5hbWUiOiJhZG1pbiIsInJvbGUiOjEsImV4cCI6MTQ5OTM3NjE1NH0.NJ6vE8FY1WG6jsRQzfMqeatJ4vh2TWAeeYfDhP71YEE
+    ```
+
+    # Security
+
+    Each API endpoint has an associated access policy, documented in its description.
+
+    The following policies are available:
+
+    - Public access
+    - Authenticated access
+    - Restricted access
+    - Administrator access
+
+    ### Public access
+
+    No authentication is required.
+
+    ### Authenticated access
+
+    Authentication is required.
+
+    ### Restricted access
+
+    Authentication is required. Additional checks may apply to verify access to the resource, and returned data may be filtered.
+
+    ### Administrator access
+
+    Authentication and an administrator role are both required.
+
+    # Execute Docker requests
+
+    Portainer does not expose dedicated endpoints for managing Docker resources (create a container, remove a volume, etc).
+
+    Instead, it acts as a reverse-proxy to the Docker HTTP API, allowing you to execute Docker requests via the Portainer HTTP API.
+
+    To do so, use the `/endpoints/{id}/docker` endpoint. Note that this endpoint is not documented below due to Swagger limitations. It has a restricted access policy, so authentication is still required. Any request made to this endpoint is proxied to the Docker API of the associated environment - request and response objects are identical to those in the [Docker official documentation](https://docs.docker.com/engine/api).
+
+    # Private Registry
+
+    When using a private registry, include a Base64-encoded JSON string in the request header. The header parameter name is `X-Registry-Auth` and the value should encode the following structure: ‘{"registryId":\<registryId\>}’ where `<registryId>` is the ID of the registry where the repository was created.
+
+    Example encoded value:
+
+    ```
+    eyJyZWdpc3RyeUlkIjoxfQ==
+    ```
+  license:
+    name: zlib
+    url: https://github.com/portainer/portainer/blob/develop/LICENSE
+  title: PortainerCE API
+  version: 2.43.0
+paths:
+  /auth:
+    post:
+      consumes:
+      - application/json
+      description: |-
+        **Access policy**: public
+        Use this environment(endpoint) to authenticate against Portainer using a username and password.
+      operationId: AuthenticateUser
+      parameters:
+      - description: Credentials used for authentication
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/auth.authenticatePayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/auth.authenticateResponse'
+        "400":
+          description: Invalid request
+        "422":
+          description: Invalid Credentials
+        "500":
+          description: Server error
+      summary: Authenticate
+      tags:
+      - auth
+  /auth/logout:
+    post:
+      description: '**Access policy**: public'
+      operationId: Logout
+      responses:
+        "204":
+          description: Success
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Logout
+      tags:
+      - auth
+  /auth/oauth/validate:
+    post:
+      consumes:
+      - application/json
+      description: '**Access policy**: public'
+      operationId: ValidateOAuth
+      parameters:
+      - description: OAuth Credentials used for authentication
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/auth.oauthPayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/auth.authenticateResponse'
+        "400":
+          description: Invalid request
+        "422":
+          description: Invalid Credentials
+        "500":
+          description: Server error
+      summary: Authenticate with OAuth
+      tags:
+      - auth
+  /backup:
+    post:
+      consumes:
+      - application/json
+      description: |-
+        Creates an archive with a system data snapshot that could be used to restore the system.
+        **Access policy**: admin
+      operationId: Backup
+      parameters:
+      - description: An object contains the password to encrypt the backup with
+        in: body
+        name: body
+        schema:
+          $ref: '#/definitions/backup.backupPayload'
+      produces:
+      - application/octet-stream
+      responses:
+        "200":
+          description: Success
+        "400":
+          description: Invalid request
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Creates an archive with a system data snapshot that could be used to
+        restore the system.
+      tags:
+      - backup
+  /custom_templates:
+    get:
+      description: |-
+        List available custom templates.
+        **Access policy**: authenticated
+      operationId: CustomTemplateList
+      parameters:
+      - collectionFormat: csv
+        description: Template types
+        in: query
+        items:
+          enum:
+          - 1
+          - 2
+          - 3
+          type: integer
+        name: type
+        required: true
+        type: array
+      - description: Filter by edge templates
+        in: query
+        name: edge
+        type: boolean
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            items:
+              $ref: '#/definitions/portainer.CustomTemplate'
+            type: array
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: List available custom templates
+      tags:
+      - custom_templates
+  /custom_templates/{id}:
+    delete:
+      description: |-
+        Remove a template.
+        **Access policy**: authenticated
+      operationId: CustomTemplateDelete
+      parameters:
+      - description: Template identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "403":
+          description: Access denied to resource
+        "404":
+          description: Template not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Remove a template
+      tags:
+      - custom_templates
+    get:
+      description: |-
+        Retrieve details about a template.
+        **Access policy**: authenticated
+      operationId: CustomTemplateInspect
+      parameters:
+      - description: Template identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/portainer.CustomTemplate'
+        "400":
+          description: Invalid request
+        "404":
+          description: Template not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Inspect a custom template
+      tags:
+      - custom_templates
+    put:
+      consumes:
+      - application/json
+      description: |-
+        Update a template.
+        **Access policy**: authenticated
+      operationId: CustomTemplateUpdate
+      parameters:
+      - description: Template identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Template details
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/customtemplates.customTemplateUpdatePayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/portainer.CustomTemplate'
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied to access template
+        "404":
+          description: Template not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Update a template
+      tags:
+      - custom_templates
+  /custom_templates/{id}/file:
+    get:
+      description: |-
+        Retrieve the content of the Stack file for the specified custom template
+        **Access policy**: authenticated
+      operationId: CustomTemplateFile
+      parameters:
+      - description: Template identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/customtemplates.fileResponse'
+        "400":
+          description: Invalid request
+        "404":
+          description: Custom template not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Get Template stack file content.
+      tags:
+      - custom_templates
+  /custom_templates/{id}/git_fetch:
+    put:
+      description: |-
+        Retrieve details about a template created from git repository method.
+        **Access policy**: authenticated
+      operationId: CustomTemplateGitFetch
+      parameters:
+      - description: Template identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/customtemplates.fileResponse'
+        "400":
+          description: Invalid request
+        "404":
+          description: Custom template not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Fetch the latest config file content based on custom template's git
+        repository configuration
+      tags:
+      - custom_templates
+  /custom_templates/create/file:
+    post:
+      consumes:
+      - multipart/form-data
+      description: |-
+        Create a custom template.
+        **Access policy**: authenticated
+      operationId: CustomTemplateCreateFile
+      parameters:
+      - description: Title of the template
+        in: formData
+        name: Title
+        required: true
+        type: string
+      - description: Description of the template
+        in: formData
+        name: Description
+        required: true
+        type: string
+      - description: A note that will be displayed in the UI. Supports HTML content
+        in: formData
+        name: Note
+        required: true
+        type: string
+      - description: Platform associated to the template (1 - 'linux', 2 - 'windows')
+        enum:
+        - 1
+        - 2
+        in: formData
+        name: Platform
+        required: true
+        type: integer
+      - description: Type of created stack (1 - swarm, 2 - compose, 3 - kubernetes)
+        enum:
+        - 1
+        - 2
+        - 3
+        in: formData
+        name: Type
+        required: true
+        type: integer
+      - description: File
+        in: formData
+        name: File
+        required: true
+        type: file
+      - description: URL of the template's logo
+        in: formData
+        name: Logo
+        type: string
+      - description: A json array of variables definitions
+        in: formData
+        name: Variables
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/portainer.CustomTemplate'
+        "400":
+          description: Invalid request
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Create a custom template
+      tags:
+      - custom_templates
+  /custom_templates/create/repository:
+    post:
+      consumes:
+      - application/json
+      description: |-
+        Create a custom template.
+        **Access policy**: authenticated
+      operationId: CustomTemplateCreateRepository
+      parameters:
+      - description: Required when using method=repository
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/customtemplates.customTemplateFromGitRepositoryPayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/portainer.CustomTemplate'
+        "400":
+          description: Invalid request
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Create a custom template
+      tags:
+      - custom_templates
+  /custom_templates/create/string:
+    post:
+      consumes:
+      - application/json
+      description: |-
+        Create a custom template.
+        **Access policy**: authenticated
+      operationId: CustomTemplateCreateString
+      parameters:
+      - description: body
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/customtemplates.customTemplateFromFileContentPayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/portainer.CustomTemplate'
+        "400":
+          description: Invalid request
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Create a custom template
+      tags:
+      - custom_templates
+  /docker/{environmentId}/containers/{containerId}/gpus:
+    get:
+      consumes:
+      - application/json
+      description: '**Access policy**:'
+      operationId: dockerContainerGpusInspect
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: environmentId
+        required: true
+        type: integer
+      - description: Container identifier
+        in: path
+        name: containerId
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/containers.containerGpusResponse'
+        "400":
+          description: Bad request
+        "404":
+          description: Environment or container not found
+        "500":
+          description: Internal server error
+      security:
+      - jwt: []
+      summary: Fetch container gpus data
+      tags:
+      - docker
+  /docker/{environmentId}/dashboard:
+    get:
+      consumes:
+      - application/json
+      description: '**Access policy**: restricted'
+      operationId: dockerDashboard
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: environmentId
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/docker.dashboardResponse'
+        "400":
+          description: Bad request
+        "500":
+          description: Internal server error
+      security:
+      - jwt: []
+      summary: Get counters for the dashboard
+      tags:
+      - docker
+  /docker/{environmentId}/images:
+    get:
+      description: '**Access policy**:'
+      operationId: dockerImagesList
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: environmentId
+        required: true
+        type: integer
+      - description: Include image usage information
+        in: query
+        name: withUsage
+        type: boolean
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            items:
+              $ref: '#/definitions/images.ImageResponse'
+            type: array
+        "400":
+          description: Bad request
+        "500":
+          description: Internal server error
+      security:
+      - jwt: []
+      summary: Fetch images
+      tags:
+      - docker
+  /edge_groups:
+    get:
+      description: '**Access policy**: administrator'
+      operationId: EdgeGroupList
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: EdgeGroups
+          schema:
+            items:
+              $ref: '#/definitions/edgegroups.decoratedEdgeGroup'
+            type: array
+        "500":
+          description: Internal Server Error
+        "503":
+          description: Edge compute features are disabled
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: list EdgeGroups
+      tags:
+      - edge_groups
+    post:
+      consumes:
+      - application/json
+      description: '**Access policy**: administrator'
+      operationId: EdgeGroupCreate
+      parameters:
+      - description: EdgeGroup data
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/edgegroups.edgeGroupCreatePayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/portainer.EdgeGroup'
+        "500":
+          description: Internal Server Error
+        "503":
+          description: Edge compute features are disabled
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Create an EdgeGroup
+      tags:
+      - edge_groups
+  /edge_groups/{id}:
+    delete:
+      description: '**Access policy**: administrator'
+      operationId: EdgeGroupDelete
+      parameters:
+      - description: EdgeGroup Id
+        in: path
+        name: id
+        required: true
+        type: integer
+      responses:
+        "204":
+          description: No Content
+        "409":
+          description: Edge group is in use by an Edge stack or Edge job
+        "500":
+          description: Server error
+        "503":
+          description: Edge compute features are disabled
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Deletes an EdgeGroup
+      tags:
+      - edge_groups
+    get:
+      description: '**Access policy**: administrator'
+      operationId: EdgeGroupInspect
+      parameters:
+      - description: EdgeGroup Id
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/portainer.EdgeGroup'
+        "500":
+          description: Internal Server Error
+        "503":
+          description: Edge compute features are disabled
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Inspects an EdgeGroup
+      tags:
+      - edge_groups
+    put:
+      consumes:
+      - application/json
+      description: '**Access policy**: administrator'
+      operationId: EdgeGroupUpdate
+      parameters:
+      - description: EdgeGroup Id
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: EdgeGroup data
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/edgegroups.edgeGroupUpdatePayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/portainer.EdgeGroup'
+        "500":
+          description: Internal Server Error
+        "503":
+          description: Edge compute features are disabled
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Updates an EdgeGroup
+      tags:
+      - edge_groups
+  /edge_jobs:
+    get:
+      description: '**Access policy**: administrator'
+      operationId: EdgeJobList
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            items:
+              $ref: '#/definitions/portainer.EdgeJob'
+            type: array
+        "400":
+          description: Bad Request
+        "500":
+          description: Internal Server Error
+        "503":
+          description: Edge compute features are disabled
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Fetch EdgeJobs list
+      tags:
+      - edge_jobs
+  /edge_jobs/{id}:
+    delete:
+      description: '**Access policy**: administrator'
+      operationId: EdgeJobDelete
+      parameters:
+      - description: EdgeJob Id
+        in: path
+        name: id
+        required: true
+        type: integer
+      responses:
+        "204":
+          description: No Content
+        "400":
+          description: Bad Request
+        "500":
+          description: Internal Server Error
+        "503":
+          description: Edge compute features are disabled
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Delete an EdgeJob
+      tags:
+      - edge_jobs
+    get:
+      description: '**Access policy**: administrator'
+      operationId: EdgeJobInspect
+      parameters:
+      - description: EdgeJob Id
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/portainer.EdgeJob'
+        "400":
+          description: Bad Request
+        "500":
+          description: Internal Server Error
+        "503":
+          description: Edge compute features are disabled
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Inspect an EdgeJob
+      tags:
+      - edge_jobs
+    put:
+      consumes:
+      - application/json
+      description: '**Access policy**: administrator'
+      operationId: EdgeJobUpdate
+      parameters:
+      - description: EdgeJob Id
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: EdgeGroup data
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/edgejobs.edgeJobUpdatePayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/portainer.EdgeJob'
+        "400":
+          description: Bad Request
+        "500":
+          description: Internal Server Error
+        "503":
+          description: Edge compute features are disabled
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Update an EdgeJob
+      tags:
+      - edge_jobs
+  /edge_jobs/{id}/file:
+    get:
+      description: '**Access policy**: administrator'
+      operationId: EdgeJobFile
+      parameters:
+      - description: EdgeJob Id
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/edgejobs.edgeJobFileResponse'
+        "400":
+          description: Bad Request
+        "500":
+          description: Internal Server Error
+        "503":
+          description: Edge compute features are disabled
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Fetch a file of an EdgeJob
+      tags:
+      - edge_jobs
+  /edge_jobs/{id}/tasks:
+    get:
+      description: '**Access policy**: administrator'
+      operationId: EdgeJobTasksList
+      parameters:
+      - description: EdgeJob Id
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            items:
+              $ref: '#/definitions/edgejobs.taskContainer'
+            type: array
+        "400":
+          description: Bad Request
+        "500":
+          description: Internal Server Error
+        "503":
+          description: Edge compute features are disabled
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Fetch the list of tasks on an EdgeJob
+      tags:
+      - edge_jobs
+  /edge_jobs/{id}/tasks/{taskID}/logs:
+    delete:
+      description: '**Access policy**: administrator'
+      operationId: EdgeJobTasksClear
+      parameters:
+      - description: EdgeJob Id
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Task Id
+        in: path
+        name: taskID
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "204":
+          description: No Content
+        "400":
+          description: Bad Request
+        "500":
+          description: Internal Server Error
+        "503":
+          description: Edge compute features are disabled
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Clear the log for a specifc task on an EdgeJob
+      tags:
+      - edge_jobs
+    get:
+      description: '**Access policy**: administrator'
+      operationId: EdgeJobTaskLogsInspect
+      parameters:
+      - description: EdgeJob Id
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Task Id
+        in: path
+        name: taskID
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/edgejobs.fileResponse'
+        "400":
+          description: Bad Request
+        "500":
+          description: Internal Server Error
+        "503":
+          description: Edge compute features are disabled
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Fetch the log for a specifc task on an EdgeJob
+      tags:
+      - edge_jobs
+    post:
+      description: '**Access policy**: administrator'
+      operationId: EdgeJobTasksCollect
+      parameters:
+      - description: EdgeJob Id
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Task Id
+        in: path
+        name: taskID
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "204":
+          description: No Content
+        "400":
+          description: Bad Request
+        "500":
+          description: Internal Server Error
+        "503":
+          description: Edge compute features are disabled
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Collect the log for a specifc task on an EdgeJob
+      tags:
+      - edge_jobs
+  /edge_jobs/create/file:
+    post:
+      consumes:
+      - multipart/form-data
+      description: '**Access policy**: administrator'
+      operationId: EdgeJobCreateFile
+      parameters:
+      - description: Content of the Stack file
+        in: formData
+        name: file
+        required: true
+        type: file
+      - description: Name of the stack
+        in: formData
+        name: Name
+        required: true
+        type: string
+      - description: A cron expression to schedule this job
+        in: formData
+        name: CronExpression
+        required: true
+        type: string
+      - description: JSON stringified array of Edge Groups ids
+        in: formData
+        name: EdgeGroups
+        required: true
+        type: string
+      - description: JSON stringified array of Environment ids
+        in: formData
+        name: Endpoints
+        required: true
+        type: string
+      - description: If recurring
+        in: formData
+        name: Recurring
+        type: boolean
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/portainer.EdgeGroup'
+        "500":
+          description: Internal Server Error
+        "503":
+          description: Edge compute features are disabled
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Create an EdgeJob from a file
+      tags:
+      - edge_jobs
+  /edge_jobs/create/string:
+    post:
+      description: '**Access policy**: administrator'
+      operationId: EdgeJobCreateString
+      parameters:
+      - description: EdgeGroup data when method is string
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/edgejobs.edgeJobCreateFromFileContentPayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/portainer.EdgeGroup'
+        "500":
+          description: Internal Server Error
+        "503":
+          description: Edge compute features are disabled
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Create an EdgeJob from a text
+      tags:
+      - edge_jobs
+  /edge_stacks:
+    get:
+      description: '**Access policy**: administrator'
+      operationId: EdgeStackList
+      parameters:
+      - description: will summarize the statuses
+        in: query
+        name: summarizeStatuses
+        type: boolean
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            items:
+              $ref: '#/definitions/portainer.EdgeStack'
+            type: array
+        "400":
+          description: Bad Request
+        "500":
+          description: Internal Server Error
+        "503":
+          description: Edge compute features are disabled
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Fetches the list of EdgeStacks
+      tags:
+      - edge_stacks
+  /edge_stacks/{id}:
+    delete:
+      description: '**Access policy**: administrator'
+      operationId: EdgeStackDelete
+      parameters:
+      - description: EdgeStack Id
+        in: path
+        name: id
+        required: true
+        type: integer
+      responses:
+        "204":
+          description: No Content
+        "400":
+          description: Bad Request
+        "500":
+          description: Internal Server Error
+        "503":
+          description: Edge compute features are disabled
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Delete an EdgeStack
+      tags:
+      - edge_stacks
+    get:
+      description: '**Access policy**: administrator'
+      operationId: EdgeStackInspect
+      parameters:
+      - description: EdgeStack Id
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/portainer.EdgeStack'
+        "400":
+          description: Bad Request
+        "500":
+          description: Internal Server Error
+        "503":
+          description: Edge compute features are disabled
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Inspect an EdgeStack
+      tags:
+      - edge_stacks
+    put:
+      consumes:
+      - application/json
+      description: '**Access policy**: administrator'
+      operationId: EdgeStackUpdate
+      parameters:
+      - description: EdgeStack Id
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: EdgeStack data
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/edgestacks.updateEdgeStackPayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/portainer.EdgeStack'
+        "400":
+          description: Bad Request
+        "500":
+          description: Internal Server Error
+        "503":
+          description: Edge compute features are disabled
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Update an EdgeStack
+      tags:
+      - edge_stacks
+  /edge_stacks/{id}/file:
+    get:
+      description: '**Access policy**: administrator'
+      operationId: EdgeStackFile
+      parameters:
+      - description: EdgeStack Id
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/edgestacks.stackFileResponse'
+        "400":
+          description: Bad Request
+        "500":
+          description: Internal Server Error
+        "503":
+          description: Edge compute features are disabled
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Fetches the stack file for an EdgeStack
+      tags:
+      - edge_stacks
+  /edge_stacks/{id}/status:
+    put:
+      consumes:
+      - application/json
+      description: Authorized only if the request is done by an Edge Environment(Endpoint)
+      operationId: EdgeStackStatusUpdate
+      parameters:
+      - description: EdgeStack Id
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: EdgeStack status payload
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/edgestacks.updateStatusPayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/portainer.EdgeStack'
+        "400":
+          description: Bad Request
+        "403":
+          description: Forbidden
+        "404":
+          description: Not Found
+        "500":
+          description: Internal Server Error
+      summary: Update an EdgeStack status
+      tags:
+      - edge_stacks
+  /edge_stacks/create/file:
+    post:
+      consumes:
+      - multipart/form-data
+      description: '**Access policy**: administrator'
+      operationId: EdgeStackCreateFile
+      parameters:
+      - description: Name of the stack. it must only consist of lowercase alphanumeric
+          characters, hyphens, or underscores as well as start with a letter or number
+        in: formData
+        name: Name
+        required: true
+        type: string
+      - description: Content of the Stack file
+        in: formData
+        name: file
+        required: true
+        type: file
+      - description: JSON stringified array of Edge Groups ids
+        in: formData
+        name: EdgeGroups
+        required: true
+        type: string
+      - description: deploy type 0 - 'compose', 1 - 'kubernetes'
+        in: formData
+        name: DeploymentType
+        required: true
+        type: integer
+      - description: JSON stringified array of Registry ids to use for this stack
+        in: formData
+        name: Registries
+        type: string
+      - description: Uses the manifest's namespaces instead of the default one, relevant
+          only for kube environments
+        in: formData
+        name: UseManifestNamespaces
+        type: boolean
+      - description: Pre Pull image
+        in: formData
+        name: PrePullImage
+        type: boolean
+      - description: Retry deploy
+        in: formData
+        name: RetryDeploy
+        type: boolean
+      - description: if true, will not create an edge stack, but just will check the
+          settings and return a non-persisted edge stack object
+        in: query
+        name: dryrun
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/portainer.EdgeStack'
+        "400":
+          description: Bad request
+        "500":
+          description: Internal server error
+        "503":
+          description: Edge compute features are disabled
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Create an EdgeStack from file
+      tags:
+      - edge_stacks
+  /edge_stacks/create/repository:
+    post:
+      description: '**Access policy**: administrator'
+      operationId: EdgeStackCreateRepository
+      parameters:
+      - description: stack config
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/edgestacks.edgeStackFromGitRepositoryPayload'
+      - description: if true, will not create an edge stack, but just will check the
+          settings and return a non-persisted edge stack object
+        in: query
+        name: dryrun
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/portainer.EdgeStack'
+        "400":
+          description: Bad request
+        "500":
+          description: Internal server error
+        "503":
+          description: Edge compute features are disabled
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Create an EdgeStack from a git repository
+      tags:
+      - edge_stacks
+  /edge_stacks/create/string:
+    post:
+      description: '**Access policy**: administrator'
+      operationId: EdgeStackCreateString
+      parameters:
+      - description: stack config
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/edgestacks.edgeStackFromStringPayload'
+      - description: if true, will not create an edge stack, but just will check the
+          settings and return a non-persisted edge stack object
+        in: query
+        name: dryrun
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/portainer.EdgeStack'
+        "400":
+          description: Bad request
+        "500":
+          description: Internal server error
+        "503":
+          description: Edge compute features are disabled
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Create an EdgeStack from a text
+      tags:
+      - edge_stacks
+  /endpoint_groups:
+    get:
+      description: |-
+        List all environment(endpoint) groups based on the current user authorizations. Will
+        return all environment(endpoint) groups if using an administrator account otherwise it will
+        only return authorized environment(endpoint) groups.
+        **Access policy**: restricted
+      operationId: EndpointGroupList
+      parameters:
+      - description: If true, each environment(endpoint) group will include the number
+          of environments(endpoints) associated to it and breakdown by type
+        in: query
+        name: size
+        type: boolean
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Environment(Endpoint) group
+          schema:
+            items:
+              $ref: '#/definitions/endpointgroups.EndpointGroupResponse'
+            type: array
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: List Environment(Endpoint) groups
+      tags:
+      - endpoint_groups
+    post:
+      consumes:
+      - application/json
+      description: |-
+        Create a new environment(endpoint) group.
+        **Access policy**: administrator
+      parameters:
+      - description: Environment(Endpoint) Group details
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/endpointgroups.endpointGroupCreatePayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/portainer.EndpointGroup'
+        "400":
+          description: Invalid request
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Create an Environment(Endpoint) Group
+      tags:
+      - endpoint_groups
+  /endpoint_groups/{id}:
+    delete:
+      description: |-
+        Remove an environment(endpoint) group.
+        **Access policy**: administrator
+      operationId: EndpointGroupDelete
+      parameters:
+      - description: EndpointGroup identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "404":
+          description: EndpointGroup not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Remove an environment(endpoint) group
+      tags:
+      - endpoint_groups
+    get:
+      consumes:
+      - application/json
+      description: |-
+        Retrieve details abont an environment(endpoint) group.
+        **Access policy**: administrator
+      parameters:
+      - description: Environment(Endpoint) group identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: If true, include the number of environments and breakdown by
+          type
+        in: query
+        name: size
+        type: boolean
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/endpointgroups.EndpointGroupResponse'
+        "400":
+          description: Invalid request
+        "404":
+          description: EndpointGroup not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Inspect an Environment(Endpoint) group
+      tags:
+      - endpoint_groups
+    put:
+      consumes:
+      - application/json
+      description: |-
+        Update an environment(endpoint) group.
+        **Access policy**: administrator
+      operationId: EndpointGroupUpdate
+      parameters:
+      - description: EndpointGroup identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: EndpointGroup details
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/endpointgroups.endpointGroupUpdatePayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/portainer.EndpointGroup'
+        "400":
+          description: Invalid request
+        "404":
+          description: EndpointGroup not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Update an environment(endpoint) group
+      tags:
+      - endpoint_groups
+  /endpoint_groups/{id}/endpoints/{endpointId}:
+    delete:
+      description: '**Access policy**: administrator'
+      operationId: EndpointGroupDeleteEndpoint
+      parameters:
+      - description: EndpointGroup identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Environment(Endpoint) identifier
+        in: path
+        name: endpointId
+        required: true
+        type: integer
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "404":
+          description: EndpointGroup not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Removes environment(endpoint) from an environment(endpoint) group
+      tags:
+      - endpoint_groups
+    put:
+      description: |-
+        Add an environment(endpoint) to an environment(endpoint) group
+        **Access policy**: administrator
+      operationId: EndpointGroupAddEndpoint
+      parameters:
+      - description: EndpointGroup identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Environment(Endpoint) identifier
+        in: path
+        name: endpointId
+        required: true
+        type: integer
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "404":
+          description: EndpointGroup not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Add an environment(endpoint) to an environment(endpoint) group
+      tags:
+      - endpoint_groups
+  /endpoints:
+    delete:
+      consumes:
+      - application/json
+      deprecated: true
+      description: |-
+        Deprecated: use the `POST` endpoint instead.
+        Remove multiple environments and optionally clean-up associated resources.
+        **Access policy**: Administrator only.
+      operationId: EndpointDeleteBatchDeprecated
+      parameters:
+      - description: List of environments to delete, with optional deleteCluster flag
+          to clean-up associated resources (cloud environments only)
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/endpoints.endpointDeleteBatchPayload'
+      produces:
+      - application/json
+      responses:
+        "204":
+          description: Environment(s) successfully deleted.
+        "207":
+          description: Partial success. Some environments were deleted successfully,
+            while others failed.
+          schema:
+            $ref: '#/definitions/endpoints.endpointDeleteBatchPartialResponse'
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "403":
+          description: Unauthorized access or operation not allowed.
+        "500":
+          description: Server error occurred while attempting to delete the specified
+            environments.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Remove multiple environments
+      tags:
+      - endpoints
+    get:
+      description: |-
+        List all environments(endpoints) based on the current user authorizations. Will
+        return all environments(endpoints) if using an administrator or team leader account otherwise it will
+        only return authorized environments(endpoints).
+        **Access policy**: restricted
+      operationId: EndpointList
+      parameters:
+      - description: Start searching from
+        in: query
+        name: start
+        type: integer
+      - description: Limit results to this value
+        in: query
+        name: limit
+        type: integer
+      - description: Sort results by this value
+        enum:
+        - Name
+        - Group
+        - Status
+        - LastCheckIn
+        - EdgeID
+        - PlatformType
+        - Health
+        - Id
+        in: query
+        name: sort
+        type: string
+      - description: Order sorted results by desc/asc
+        in: query
+        name: order
+        type: string
+      - description: Search query
+        in: query
+        name: search
+        type: string
+      - collectionFormat: csv
+        description: List environments(endpoints) of these groups
+        in: query
+        items:
+          type: integer
+        name: groupIds
+        type: array
+      - collectionFormat: csv
+        description: List environments(endpoints) by this status
+        in: query
+        items:
+          type: integer
+        name: status
+        type: array
+      - collectionFormat: csv
+        description: List environments(endpoints) of this type
+        in: query
+        items:
+          enum:
+          - 0
+          - 1
+          - 2
+          - 3
+          - 4
+          - 5
+          - 6
+          - 7
+          type: integer
+        name: types
+        type: array
+      - collectionFormat: csv
+        description: Filter environments by platform type
+        in: query
+        items:
+          enum:
+          - 0
+          - 1
+          - 2
+          - 3
+          - 4
+          type: integer
+        name: platformTypes
+        type: array
+      - description: If true, return only environments with an outdated agent
+        in: query
+        name: outdated
+        type: boolean
+      - collectionFormat: csv
+        description: Exclude environments of these groups
+        in: query
+        items:
+          type: integer
+        name: excludeGroupIds
+        type: array
+      - collectionFormat: csv
+        description: search environments(endpoints) with these tags (depends on tagsPartialMatch)
+        in: query
+        items:
+          type: integer
+        name: tagIds
+        type: array
+      - description: If true, will return environment(endpoint) which has one of tagIds,
+          if false (or missing) will return only environments(endpoints) that has
+          all the tags
+        in: query
+        name: tagsPartialMatch
+        type: boolean
+      - collectionFormat: csv
+        description: will return only these environments(endpoints)
+        in: query
+        items:
+          type: integer
+        name: endpointIds
+        type: array
+      - collectionFormat: csv
+        description: will exclude these environments(endpoints)
+        in: query
+        items:
+          type: integer
+        name: excludeIds
+        type: array
+      - collectionFormat: csv
+        description: will return only environments with on of these agent versions
+        in: query
+        items:
+          type: string
+        name: agentVersions
+        type: array
+      - description: if exists true show only edge async agents, false show only standard
+          edge agents. if missing, will show both types (relevant only for edge agents)
+        in: query
+        name: edgeAsync
+        type: boolean
+      - description: if true, show only untrusted edge agents, if false show only
+          trusted edge agents (relevant only for edge agents)
+        in: query
+        name: edgeDeviceUntrusted
+        type: boolean
+      - description: if bigger then zero, show only edge agents that checked-in in
+          the last provided seconds (relevant only for edge agents)
+        in: query
+        name: edgeCheckInPassedSeconds
+        type: number
+      - description: if true, the snapshot data won't be retrieved
+        in: query
+        name: excludeSnapshots
+        type: boolean
+      - description: will return only environments(endpoints) with this name
+        in: query
+        name: name
+        type: string
+      - description: will return the environments of the specified edge stack
+        in: query
+        name: edgeStackId
+        type: integer
+      - description: only applied when edgeStackId exists. Filter the returned environments
+          based on their deployment status in the stack (not the environment status!)
+        enum:
+        - 0
+        - 1
+        - 2
+        - 3
+        - 4
+        - 5
+        - 6
+        - 7
+        - 8
+        - 9
+        - 10
+        - 11
+        - 12
+        - 13
+        in: query
+        name: edgeStackStatus
+        type: integer
+      - collectionFormat: csv
+        description: List environments(endpoints) of these edge groups
+        in: query
+        items:
+          type: integer
+        name: edgeGroupIds
+        type: array
+      - collectionFormat: csv
+        description: Exclude environments(endpoints) of these edge groups
+        in: query
+        items:
+          type: integer
+        name: excludeEdgeGroupIds
+        type: array
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Endpoints
+          schema:
+            items:
+              $ref: '#/definitions/portainer.Endpoint'
+            type: array
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: List environments(endpoints)
+      tags:
+      - endpoints
+    post:
+      consumes:
+      - multipart/form-data
+      description: |-
+        Create a new environment(endpoint) that will be used to manage an environment(endpoint).
+        **Access policy**: administrator
+      operationId: EndpointCreate
+      parameters:
+      - description: 'Name that will be used to identify this environment(endpoint)
+          (example: my-environment)'
+        in: formData
+        name: Name
+        required: true
+        type: string
+      - description: 'Environment(Endpoint) type. Value must be one of: 1 (Local Docker
+          environment), 2 (Agent environment), 3 (Azure environment), 4 (Edge agent
+          environment) or 5 (Local Kubernetes Environment)'
+        enum:
+        - 0
+        - 1
+        - 2
+        - 3
+        - 4
+        - 5
+        in: formData
+        name: EndpointCreationType
+        required: true
+        type: integer
+      - description: 'Container engine used by the environment(endpoint). Value must
+          be one of: ''docker'' or ''podman'''
+        in: formData
+        name: ContainerEngine
+        type: string
+      - description: 'URL or IP address of a Docker host (example: docker.mydomain.tld:2375).
+          Defaults to local if not specified (Linux: /var/run/docker.sock, Windows:
+          //./pipe/docker_engine). Cannot be empty if EndpointCreationType is set
+          to 4 (Edge agent environment)'
+        in: formData
+        name: URL
+        type: string
+      - description: 'URL or IP address where exposed containers will be reachable.
+          Defaults to URL if not specified (example: docker.mydomain.tld:2375)'
+        in: formData
+        name: PublicURL
+        type: string
+      - description: Environment(Endpoint) group identifier. If not specified will
+          default to 1 (unassigned).
+        in: formData
+        name: GroupID
+        type: integer
+      - description: Require TLS to connect against this environment(endpoint). Must
+          be true if EndpointCreationType is set to 2 (Agent environment)
+        in: formData
+        name: TLS
+        type: boolean
+      - description: Skip server verification when using TLS. Must be true if EndpointCreationType
+          is set to 2 (Agent environment)
+        in: formData
+        name: TLSSkipVerify
+        type: boolean
+      - description: Skip client verification when using TLS. Must be true if EndpointCreationType
+          is set to 2 (Agent environment)
+        in: formData
+        name: TLSSkipClientVerify
+        type: boolean
+      - description: TLS CA certificate file
+        in: formData
+        name: TLSCACertFile
+        type: file
+      - description: TLS client certificate file
+        in: formData
+        name: TLSCertFile
+        type: file
+      - description: TLS client key file
+        in: formData
+        name: TLSKeyFile
+        type: file
+      - description: Azure application ID. Required if environment(endpoint) type
+          is set to 3
+        in: formData
+        name: AzureApplicationID
+        type: string
+      - description: Azure tenant ID. Required if environment(endpoint) type is set
+          to 3
+        in: formData
+        name: AzureTenantID
+        type: string
+      - description: Azure authentication key. Required if environment(endpoint) type
+          is set to 3
+        in: formData
+        name: AzureAuthenticationKey
+        type: string
+      - description: JSON-parsable array of tag identifiers to which this environment(endpoint)
+          is associated
+        in: formData
+        name: TagIds
+        type: string
+      - description: The check in interval for edge agent (in seconds)
+        in: formData
+        name: EdgeCheckinInterval
+        type: integer
+      - description: URL or IP address that will be used to establish a reverse tunnel
+        in: formData
+        name: EdgeTunnelServerAddress
+        type: string
+      - description: List of GPUs - json stringified array of {name, value} structs
+        in: formData
+        name: Gpus
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/portainer.Endpoint'
+        "400":
+          description: Invalid request
+        "409":
+          description: Name is not unique
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Create a new environment(endpoint)
+      tags:
+      - endpoints
+  /endpoints/{id}:
+    delete:
+      description: |-
+        Remove the environment associated to the specified identifier and optionally clean-up associated resources.
+        **Access policy**: Administrator only.
+      operationId: EndpointDelete
+      parameters:
+      - description: Environment(Endpoint) identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      responses:
+        "204":
+          description: Environment successfully deleted.
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "403":
+          description: Unauthorized access or operation not allowed.
+        "404":
+          description: Unable to find the environment with the specified identifier
+            inside the database.
+        "500":
+          description: Server error occurred while attempting to delete the environment.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Remove an environment
+      tags:
+      - endpoints
+    get:
+      description: |-
+        Retrieve details about an environment(endpoint).
+        **Access policy**: restricted
+      operationId: EndpointInspect
+      parameters:
+      - description: Environment(Endpoint) identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: if true, the snapshot data won't be retrieved
+        in: query
+        name: excludeSnapshot
+        type: boolean
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/portainer.Endpoint'
+        "400":
+          description: Invalid request
+        "404":
+          description: Environment(Endpoint) not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Inspect an environment(endpoint)
+      tags:
+      - endpoints
+    put:
+      consumes:
+      - application/json
+      description: |-
+        Update an environment(endpoint).
+        **Access policy**: authenticated
+      operationId: EndpointUpdate
+      parameters:
+      - description: Environment(Endpoint) identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Environment(Endpoint) details
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/endpoints.endpointUpdatePayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/portainer.Endpoint'
+        "400":
+          description: Invalid request
+        "404":
+          description: Environment(Endpoint) not found
+        "409":
+          description: Name is not unique
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Update an environment(endpoint)
+      tags:
+      - endpoints
+  /endpoints/{id}/association:
+    put:
+      description: |-
+        De-association an edge environment(endpoint).
+        **Access policy**: administrator
+      operationId: EndpointAssociationDelete
+      parameters:
+      - description: Environment(Endpoint) identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "404":
+          description: Environment(Endpoint) not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: De-association an edge environment(endpoint)
+      tags:
+      - endpoints
+  /endpoints/{id}/docker/v2/browse/put:
+    post:
+      consumes:
+      - multipart/form-data
+      description: |-
+        Use this environment(endpoint) to upload TLS files.
+        **Access policy**: administrator
+      parameters:
+      - description: Environment(Endpoint) identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Optional volume identifier to upload the file
+        in: query
+        name: volumeID
+        type: string
+      - description: The destination path to upload the file to
+        in: formData
+        name: Path
+        required: true
+        type: string
+      - description: The file to upload
+        in: formData
+        name: file
+        required: true
+        type: file
+      produces:
+      - application/json
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Upload a file under a specific path on the file system of an environment
+        (endpoint)
+      tags:
+      - endpoints
+  /endpoints/{id}/dockerhub/{registryId}:
+    get:
+      description: |-
+        get docker pull limits for a docker hub registry in the environment
+        **Access policy**:
+      operationId: endpointDockerhubStatus
+      parameters:
+      - description: endpoint ID
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: registry ID
+        in: path
+        name: registryId
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/endpoints.dockerhubStatusResponse'
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: registry or endpoint not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: fetch docker pull limits
+      tags:
+      - endpoints
+  /endpoints/{id}/edge/jobs/{jobID}/logs:
+    post:
+      consumes:
+      - application/json
+      description: '**Access policy**: Edge agent only — requires X-PortainerAgent-EdgeID
+        header'
+      parameters:
+      - description: environment Id
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Job Id
+        in: path
+        name: jobID
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+        "400":
+          description: Bad Request
+        "403":
+          description: Forbidden
+        "500":
+          description: Internal Server Error
+      summary: Update the logs collected from an Edge Job
+      tags:
+      - edge_agent
+  /endpoints/{id}/edge/stacks/{stackId}:
+    get:
+      consumes:
+      - application/json
+      description: '**Access policy**: Edge agent only — requires X-PortainerAgent-EdgeID
+        header'
+      parameters:
+      - description: environment Id
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: EdgeStack Id
+        in: path
+        name: stackId
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/edge.StackPayload'
+        "400":
+          description: Bad Request
+        "404":
+          description: Not Found
+        "500":
+          description: Internal Server Error
+      summary: Inspect an Edge Stack for an Environment
+      tags:
+      - edge_agent
+      - edge_stacks
+  /endpoints/{id}/edge/status:
+    get:
+      description: |-
+        Endpoint for edge agent to check status of environment
+        **Access policy**: Edge agent only — requires X-PortainerAgent-EdgeID header
+      operationId: EndpointEdgeStatusInspect
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/endpointedge.endpointEdgeStatusInspectResponse'
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied to access environment
+        "404":
+          description: Environment not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Get environment status
+      tags:
+      - edge_agent
+  /endpoints/{id}/forceupdateservice:
+    put:
+      consumes:
+      - application/json
+      description: |-
+        force update a docker service
+        **Access policy**: authenticated
+      operationId: endpointForceUpdateService
+      parameters:
+      - description: endpoint identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: details
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/endpoints.forceUpdateServicePayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/swarm.ServiceUpdateResponse'
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: endpoint not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: force update a docker service
+      tags:
+      - endpoints
+  /endpoints/{id}/kubernetes/helm:
+    get:
+      description: '**Access policy**: authenticated'
+      operationId: HelmList
+      parameters:
+      - description: Environment(Endpoint) identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: specify an optional namespace
+        in: query
+        name: namespace
+        type: string
+      - description: specify an optional filter
+        in: query
+        name: filter
+        type: string
+      - description: specify an optional selector
+        in: query
+        name: selector
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            items:
+              $ref: '#/definitions/release.ReleaseElement'
+            type: array
+        "400":
+          description: Invalid environment(endpoint) identifier
+        "401":
+          description: Unauthorized
+        "404":
+          description: Environment(Endpoint) or ServiceAccount not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: List Helm Releases
+      tags:
+      - helm
+    post:
+      consumes:
+      - application/json
+      description: '**Access policy**: authenticated'
+      operationId: HelmInstall
+      parameters:
+      - description: Environment(Endpoint) identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Chart details
+        in: body
+        name: payload
+        required: true
+        schema:
+          $ref: '#/definitions/helm.installChartPayload'
+      - description: Dry run
+        in: query
+        name: dryRun
+        type: boolean
+      produces:
+      - application/json
+      responses:
+        "201":
+          description: Created
+          schema:
+            $ref: '#/definitions/release.Release'
+        "400":
+          description: Invalid request payload
+        "401":
+          description: Unauthorized
+        "404":
+          description: Environment(Endpoint) or ServiceAccount not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Install Helm Chart
+      tags:
+      - helm
+  /endpoints/{id}/kubernetes/helm/{release}:
+    delete:
+      description: '**Access policy**: authenticated'
+      operationId: HelmDelete
+      parameters:
+      - description: Environment(Endpoint) identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: The name of the release/application to uninstall
+        in: path
+        name: release
+        required: true
+        type: string
+      - description: An optional namespace
+        in: query
+        name: namespace
+        type: string
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid environment(endpoint) id or bad request
+        "401":
+          description: Unauthorized
+        "404":
+          description: Environment(Endpoint) or ServiceAccount not found
+        "500":
+          description: Server error or helm error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Delete Helm Release
+      tags:
+      - helm
+    get:
+      description: |-
+        Get details of a helm release by release name
+        **Access policy**: authenticated
+      operationId: HelmGet
+      parameters:
+      - description: Environment(Endpoint) identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Helm release name
+        in: path
+        name: release
+        required: true
+        type: string
+      - description: specify an optional namespace
+        in: query
+        name: namespace
+        type: string
+      - description: show resources of the release
+        in: query
+        name: showResources
+        type: boolean
+      - description: specify an optional revision
+        in: query
+        name: revision
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/release.Release'
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve the release.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get a helm release
+      tags:
+      - helm
+  /endpoints/{id}/kubernetes/helm/{release}/history:
+    get:
+      description: |-
+        Get a historical list of releases by release name
+        **Access policy**: authenticated
+      operationId: HelmGetHistory
+      parameters:
+      - description: Environment(Endpoint) identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Helm release name
+        in: path
+        name: release
+        required: true
+        type: string
+      - description: specify an optional namespace
+        in: query
+        name: namespace
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            items:
+              $ref: '#/definitions/release.Release'
+            type: array
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve the historical
+            list of releases.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get a historical list of releases
+      tags:
+      - helm
+  /endpoints/{id}/kubernetes/helm/{release}/rollback:
+    post:
+      description: |-
+        Rollback a helm release to a previous revision
+        **Access policy**: authenticated
+      operationId: HelmRollback
+      parameters:
+      - description: Environment(Endpoint) identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Helm release name
+        in: path
+        name: release
+        required: true
+        type: string
+      - description: specify an optional namespace
+        in: query
+        name: namespace
+        type: string
+      - description: specify the revision to rollback to (defaults to previous revision
+          if not specified)
+        in: query
+        name: revision
+        type: integer
+      - description: 'wait for resources to be ready (default: false)'
+        in: query
+        name: wait
+        type: boolean
+      - description: 'wait for jobs to complete before marking the release as successful
+          (default: false)'
+        in: query
+        name: waitForJobs
+        type: boolean
+      - description: 'performs pods restart for the resource if applicable (default:
+          true)'
+        in: query
+        name: recreate
+        type: boolean
+      - description: 'force resource update through delete/recreate if needed (default:
+          false)'
+        in: query
+        name: force
+        type: boolean
+      - description: 'time to wait for any individual Kubernetes operation in seconds
+          (default: 300)'
+        in: query
+        name: timeout
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/release.Release'
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier
+            or release name.
+        "500":
+          description: Server error occurred while attempting to rollback the release.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Rollback a helm release
+      tags:
+      - helm
+  /endpoints/{id}/registries:
+    get:
+      description: |-
+        List all registries based on the current user authorizations in current environment.
+        **Access policy**: authenticated
+      operationId: endpointRegistriesList
+      parameters:
+      - description: required if kubernetes environment, will show registries by namespace
+        in: query
+        name: namespace
+        type: string
+      - description: Environment(Endpoint) identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            items:
+              $ref: '#/definitions/portainer.Registry'
+            type: array
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: List Registries on environment
+      tags:
+      - endpoints
+  /endpoints/{id}/registries/{registryId}:
+    put:
+      consumes:
+      - application/json
+      description: '**Access policy**: authenticated'
+      operationId: endpointRegistryAccess
+      parameters:
+      - description: Environment(Endpoint) identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Registry identifier
+        in: path
+        name: registryId
+        required: true
+        type: integer
+      - description: details
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/endpoints.registryAccessPayload'
+      produces:
+      - application/json
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: Endpoint not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: update registry access for environment
+      tags:
+      - endpoints
+  /endpoints/{id}/settings:
+    put:
+      consumes:
+      - application/json
+      description: |-
+        Update settings for an environment(endpoint).
+        **Access policy**: authenticated
+      operationId: EndpointSettingsUpdate
+      parameters:
+      - description: Environment(Endpoint) identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Environment(Endpoint) details
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/endpoints.endpointSettingsUpdatePayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/portainer.Endpoint'
+        "400":
+          description: Invalid request
+        "404":
+          description: Environment(Endpoint) not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Update settings for an environment(endpoint)
+      tags:
+      - endpoints
+  /endpoints/{id}/snapshot:
+    post:
+      description: |-
+        Snapshots an environment(endpoint)
+        **Access policy**: administrator
+      operationId: EndpointSnapshot
+      parameters:
+      - description: Environment(Endpoint) identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "404":
+          description: Environment(Endpoint) not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Snapshots an environment(endpoint)
+      tags:
+      - endpoints
+  /endpoints/delete:
+    post:
+      consumes:
+      - application/json
+      description: |-
+        Remove multiple environments and optionally clean-up associated resources.
+        **Access policy**: Administrator only.
+      operationId: EndpointDeleteBatch
+      parameters:
+      - description: List of environments to delete, with optional deleteCluster flag
+          to clean-up associated resources (cloud environments only)
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/endpoints.endpointDeleteBatchPayload'
+      produces:
+      - application/json
+      responses:
+        "204":
+          description: Environment(s) successfully deleted.
+        "207":
+          description: Partial success. Some environments were deleted successfully,
+            while others failed.
+          schema:
+            $ref: '#/definitions/endpoints.endpointDeleteBatchPartialResponse'
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "403":
+          description: Unauthorized access or operation not allowed.
+        "500":
+          description: Server error occurred while attempting to delete the specified
+            environments.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Remove multiple environments
+      tags:
+      - endpoints
+  /endpoints/global-key:
+    post:
+      operationId: EndpointCreateGlobalKey
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/endpoints.endpointCreateGlobalKeyResponse'
+        "400":
+          description: Invalid request
+        "500":
+          description: Server error
+      summary: Create or retrieve the endpoint for an EdgeID
+      tags:
+      - endpoints
+  /endpoints/relations:
+    put:
+      consumes:
+      - application/json
+      description: |-
+        Update relations for a list of environments
+        Edge groups, tags and environment group can be updated.
+
+        **Access policy**: administrator
+      operationId: EndpointUpdateRelations
+      parameters:
+      - description: Environment relations data
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/endpoints.endpointUpdateRelationsPayload'
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "401":
+          description: Unauthorized
+        "404":
+          description: Not found
+        "500":
+          description: Server error
+      security:
+      - jwt: []
+      summary: Update relations for a list of environments
+      tags:
+      - endpoints
+  /endpoints/snapshot:
+    post:
+      description: |-
+        Snapshot all environments(endpoints)
+        **Access policy**: administrator
+      operationId: EndpointSnapshots
+      responses:
+        "204":
+          description: Success
+        "500":
+          description: Server Error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Snapshot all environments(endpoints)
+      tags:
+      - endpoints
+  /endpoints/summary:
+    get:
+      description: |-
+        Returns counts of environments by status (up, down) and ungrouped environments (unassigned), plus breakdowns by group, type, and health.
+        **Access policy**: restricted
+      operationId: EndpointSummaryCounts
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Environment summary counts
+          schema:
+            $ref: '#/definitions/endpoints.EnvironmentSummaryCountsResponse'
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Get environment summary counts
+      tags:
+      - endpoints
+  /gitops/repo/file/preview:
+    post:
+      description: |-
+        Retrieve the compose file content based on git repository configuration
+        **Access policy**: authenticated
+      operationId: GitOperationRepoFilePreview
+      parameters:
+      - description: Template details
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/gitops.repositoryFilePreviewPayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/gitops.fileResponse'
+        "400":
+          description: Invalid request
+        "404":
+          description: Source not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: preview the content of target file in the git repository
+      tags:
+      - gitops
+  /gitops/sources:
+    get:
+      description: |-
+        Returns a deduplicated list of git repositories used across all GitOps workflows.
+        **Access policy**: authenticated
+      operationId: GitOpsSourcesList
+      parameters:
+      - description: Search term (matches URL)
+        in: query
+        name: search
+        type: string
+      - description: 'Sort field: name | status | type'
+        in: query
+        name: sort
+        type: string
+      - description: 'Sort order: asc or desc'
+        in: query
+        name: order
+        type: string
+      - description: Pagination start index
+        in: query
+        name: start
+        type: integer
+      - description: Pagination limit (0 = unlimited)
+        in: query
+        name: limit
+        type: integer
+      - description: 'Filter by status: healthy | syncing | error | paused | unknown'
+        in: query
+        name: status
+        type: string
+      - description: 'Filter by source type: git | oci | helm'
+        enum:
+        - git
+        - helm
+        - oci
+        in: query
+        name: type
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            items:
+              $ref: '#/definitions/sources.Source'
+            type: array
+        "400":
+          description: Invalid status parameter
+        "403":
+          description: Access denied
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: List all GitOps sources
+      tags:
+      - gitops
+  /gitops/sources/{id}:
+    delete:
+      description: |-
+        Deletes an existing GitOps source. Returns 409 if the source is referenced by any workflow or custom template.
+        **Access policy**: authenticated
+      operationId: GitOpsSourcesDelete
+      parameters:
+      - description: Source identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      responses:
+        "204":
+          description: Source deleted
+        "400":
+          description: Invalid request
+        "403":
+          description: Access denied
+        "404":
+          description: Source not found
+        "409":
+          description: Source is in use by one or more workflows or custom templates
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Delete a source
+      tags:
+      - gitops
+    get:
+      description: |-
+        Returns a single GitOps source with its connection settings and linked workflows.
+        **Access policy**: authenticated
+      operationId: GitOpsSourceGet
+      parameters:
+      - description: Source identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/sources.SourceDetail'
+        "400":
+          description: Invalid request
+        "403":
+          description: Access denied
+        "404":
+          description: Source not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Get a GitOps source by ID
+      tags:
+      - gitops
+    put:
+      consumes:
+      - application/json
+      description: |-
+        Updates an existing GitOps source backed by a Git repository.
+        **Access policy**: authenticated
+      operationId: GitOpsSourcesUpdateGit
+      parameters:
+      - description: Source identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Git source details
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/sources.GitSourceUpdatePayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/portainer.Source'
+        "400":
+          description: Invalid request payload
+        "403":
+          description: Access denied
+        "404":
+          description: Source not found
+        "409":
+          description: A source with this URL and credentials already exists
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Update a Git source
+      tags:
+      - gitops
+  /gitops/sources/{id}/access:
+    put:
+      consumes:
+      - application/json
+      description: |-
+        Updates the access control settings for an existing GitOps source.
+        **Access policy**: administrator
+      operationId: GitOpsSourcesUpdateAccess
+      parameters:
+      - description: Source identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Source access control
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/sources.SourceAccessUpdatePayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/portainer.Source'
+        "400":
+          description: Invalid request payload
+        "403":
+          description: Access denied
+        "404":
+          description: Source not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Update a GitOps source's access control
+      tags:
+      - gitops
+  /gitops/sources/{id}/test:
+    post:
+      consumes:
+      - application/json
+      description: |-
+        Tests connectivity for a GitOps source, applying optional overrides to the stored configuration.
+        **Access policy**: authenticated
+      operationId: GitOpsSourcesTestById
+      parameters:
+      - description: Source identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Optional connection overrides; omitted fields fall back to stored
+          values
+        in: body
+        name: body
+        schema:
+          $ref: '#/definitions/sources.GitSourceUpdatePayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Connection test result
+          schema:
+            $ref: '#/definitions/sources.ConnectionTestResult'
+        "400":
+          description: Invalid request payload
+        "403":
+          description: Access denied
+        "404":
+          description: Source not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Test the connection of a stored source
+      tags:
+      - gitops
+  /gitops/sources/git:
+    post:
+      consumes:
+      - application/json
+      description: |-
+        Creates a new GitOps source backed by a Git repository.
+        **Access policy**: authenticated
+      operationId: GitOpsSourcesCreateGit
+      parameters:
+      - description: Git source details
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/sources.GitSourceCreatePayload'
+      produces:
+      - application/json
+      responses:
+        "201":
+          description: Created
+          schema:
+            $ref: '#/definitions/portainer.Source'
+        "400":
+          description: Invalid request payload
+        "403":
+          description: Access denied
+        "409":
+          description: A source with this URL and credentials already exists
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Create a Git source
+      tags:
+      - gitops
+  /gitops/sources/summary:
+    get:
+      description: |-
+        Returns a count of sources per status.
+        **Access policy**: authenticated
+      operationId: GitOpsSourcesSummary
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/workflows.StatusSummary'
+        "403":
+          description: Access denied
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Summarize GitOps source status counts
+      tags:
+      - gitops
+  /gitops/sources/test:
+    post:
+      consumes:
+      - application/json
+      description: |-
+        Tests connectivity for Git connection details that have not been persisted yet.
+        **Access policy**: authenticated
+      operationId: GitOpsSourcesTest
+      parameters:
+      - description: Git connection details
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/sources.GitSourceCreatePayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Connection test result
+          schema:
+            $ref: '#/definitions/sources.ConnectionTestResult'
+        "400":
+          description: Invalid request payload
+        "403":
+          description: Access denied
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Test a Git source connection
+      tags:
+      - gitops
+  /gitops/workflows:
+    get:
+      description: |-
+        Returns a unified list of all stacks that have GitOps (GitConfig) configured.
+        **Access policy**: authenticated
+      operationId: GitOpsWorkflowsList
+      parameters:
+      - description: Search term (matches name or repository URL)
+        in: query
+        name: search
+        type: string
+      - description: 'Sort field: name | type | status | creationDate | lastSyncDate'
+        in: query
+        name: sort
+        type: string
+      - description: 'Sort order: asc or desc'
+        in: query
+        name: order
+        type: string
+      - description: Pagination start index
+        in: query
+        name: start
+        type: integer
+      - description: Pagination limit (0 = unlimited)
+        in: query
+        name: limit
+        type: integer
+      - collectionFormat: csv
+        description: Filter by environment IDs (e.g. endpointIds[]=1&endpointIds[]=2)
+        in: query
+        items:
+          type: integer
+        name: endpointIds
+        type: array
+      - description: 'Filter by status: healthy | syncing | error | paused | unknown'
+        in: query
+        name: status
+        type: string
+      - description: 'Filter by type: stack'
+        in: query
+        name: type
+        type: string
+      - description: 'Filter by platform: dockerStandalone | dockerSwarm | kubernetes'
+        in: query
+        name: platform
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            items:
+              $ref: '#/definitions/workflows.Workflow'
+            type: array
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: List all GitOps workflows
+      tags:
+      - gitops
+  /gitops/workflows/{id}:
+    get:
+      description: |-
+        Returns the detail view of a single GitOps workflow, with one entry per backing
+        stack or edge stack artifact.
+        **Access policy**: authenticated
+      operationId: GitOpsWorkflowGet
+      parameters:
+      - description: Workflow identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/workflows.WorkflowDetail'
+        "400":
+          description: Invalid request
+        "404":
+          description: Workflow not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Get a GitOps workflow by ID
+      tags:
+      - gitops
+  /gitops/workflows/summary:
+    get:
+      description: |-
+        Returns a count of workflows per status across all environments.
+        **Access policy**: authenticated
+      operationId: GitOpsWorkflowsSummary
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/workflows.StatusSummary'
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Summarize GitOps workflow status counts
+      tags:
+      - gitops
+  /kubernetes/{id}/applications:
+    get:
+      description: |-
+        Get a list of applications across all namespaces in the cluster. If the nodeName is provided, it will return the applications running on that node.
+        **Access policy**: authenticated
+      operationId: GetAllKubernetesApplications
+      parameters:
+      - description: Environment(Endpoint) identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Namespace name
+        in: query
+        name: namespace
+        required: true
+        type: string
+      - description: Node name
+        in: query
+        name: nodeName
+        required: true
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            items:
+              $ref: '#/definitions/kubernetes.K8sApplication'
+            type: array
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve the list
+            of applications from the cluster.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get a list of applications across all namespaces in the cluster. If
+        the nodeName is provided, it will return the applications running on that
+        node.
+      tags:
+      - kubernetes
+  /kubernetes/{id}/applications/count:
+    get:
+      description: |-
+        Get the count of Applications across all namespaces in the cluster. If the nodeName is provided, it will return the count of applications running on that node.
+        **Access policy**: Authenticated user.
+      operationId: GetAllKubernetesApplicationsCount
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            type: integer
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve the count
+            of all applications from the cluster.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get Applications count
+      tags:
+      - kubernetes
+  /kubernetes/{id}/cluster_role_bindings/delete:
+    post:
+      consumes:
+      - application/json
+      description: |-
+        Delete the provided list of cluster role bindings.
+        **Access policy**: Authenticated user.
+      operationId: DeleteClusterRoleBindings
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: A list of cluster role bindings to delete
+        in: body
+        name: payload
+        required: true
+        schema:
+          items:
+            type: string
+          type: array
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier
+            or unable to find a specific cluster role binding.
+        "500":
+          description: Server error occurred while attempting to delete cluster role
+            bindings.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Delete cluster role bindings
+      tags:
+      - kubernetes
+  /kubernetes/{id}/cluster_roles/delete:
+    post:
+      consumes:
+      - application/json
+      description: |-
+        Delete the provided list of cluster roles.
+        **Access policy**: Authenticated user.
+      operationId: DeleteClusterRoles
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: A list of cluster roles to delete
+        in: body
+        name: payload
+        required: true
+        schema:
+          items:
+            type: string
+          type: array
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier
+            or unable to find a specific cluster role.
+        "500":
+          description: Server error occurred while attempting to delete cluster roles.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Delete cluster roles
+      tags:
+      - kubernetes
+  /kubernetes/{id}/clusterrolebindings:
+    get:
+      description: |-
+        Get a list of kubernetes cluster role bindings within the given environment at the cluster level.
+        **Access policy**: Authenticated user.
+      operationId: GetAllKubernetesClusterRoleBindings
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            items:
+              $ref: '#/definitions/kubernetes.K8sClusterRoleBinding'
+            type: array
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve the list
+            of cluster role bindings.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get a list of kubernetes cluster role bindings
+      tags:
+      - kubernetes
+  /kubernetes/{id}/clusterroles:
+    get:
+      description: |-
+        Get a list of kubernetes cluster roles within the given environment at the cluster level.
+        **Access policy**: Authenticated user.
+      operationId: GetAllKubernetesClusterRoles
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            items:
+              $ref: '#/definitions/kubernetes.K8sClusterRole'
+            type: array
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve the list
+            of cluster roles.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get a list of kubernetes cluster roles
+      tags:
+      - kubernetes
+  /kubernetes/{id}/configmaps:
+    get:
+      description: |-
+        Get a list of ConfigMaps across all namespaces in the cluster. For non-admin users, it will only return ConfigMaps based on the namespaces that they have access to.
+        **Access policy**: Authenticated user.
+      operationId: GetAllKubernetesConfigMaps
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Set to true to include information about applications that use
+          the ConfigMaps in the response
+        in: query
+        name: isUsed
+        required: true
+        type: boolean
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            items:
+              $ref: '#/definitions/kubernetes.K8sConfigMap'
+            type: array
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve all configmaps
+            from the cluster.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get a list of ConfigMaps
+      tags:
+      - kubernetes
+  /kubernetes/{id}/configmaps/count:
+    get:
+      description: |-
+        Get the count of ConfigMaps across all namespaces in the cluster. For non-admin users, it will only return the count of ConfigMaps based on the namespaces that they have access to.
+        **Access policy**: Authenticated user.
+      operationId: GetAllKubernetesConfigMapsCount
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            type: integer
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve the count
+            of all configmaps from the cluster.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get ConfigMaps count
+      tags:
+      - kubernetes
+  /kubernetes/{id}/cron_jobs:
+    get:
+      description: |-
+        Get a list of kubernetes Cron Jobs that the user has access to.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesCronJobs
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            items:
+              $ref: '#/definitions/kubernetes.K8sCronJob'
+            type: array
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve the list
+            of Cron Jobs.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get a list of kubernetes Cron Jobs
+      tags:
+      - kubernetes
+  /kubernetes/{id}/cron_jobs/delete:
+    post:
+      consumes:
+      - application/json
+      description: |-
+        Delete the provided list of Cron Jobs.
+        **Access policy**: Authenticated user.
+      operationId: DeleteCronJobs
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: A map where the key is the namespace and the value is an array
+          of Cron Jobs to delete
+        in: body
+        name: payload
+        required: true
+        schema:
+          $ref: '#/definitions/kubernetes.K8sCronJobDeleteRequests'
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier
+            or unable to find a specific service account.
+        "500":
+          description: Server error occurred while attempting to delete Cron Jobs.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Delete Cron Jobs
+      tags:
+      - kubernetes
+  /kubernetes/{id}/dashboard:
+    get:
+      consumes:
+      - application/json
+      description: |-
+        Get the dashboard summary data which is simply a count of a range of different commonly used kubernetes resources.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesDashboard
+      parameters:
+      - description: Environment (Endpoint) identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            items:
+              $ref: '#/definitions/kubernetes.K8sDashboard'
+            type: array
+        "400":
+          description: Invalid request
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get the dashboard summary data
+      tags:
+      - kubernetes
+  /kubernetes/{id}/describe:
+    get:
+      description: |-
+        Get a description of a kubernetes resource.
+        **Access policy**: Authenticated user.
+      operationId: DescribeResource
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Resource name
+        in: query
+        name: name
+        required: true
+        type: string
+      - description: Resource kind
+        in: query
+        name: kind
+        required: true
+        type: string
+      - description: Namespace
+        in: query
+        name: namespace
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/kubernetes.describeResourceResponse'
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve resource
+            description
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get a description of a kubernetes resource
+      tags:
+      - kubernetes
+  /kubernetes/{id}/events:
+    get:
+      description: |-
+        Get events by query param resourceId
+        **Access policy**: Authenticated user.
+      operationId: getAllKubernetesEvents
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: The resource id of the involved kubernetes object
+        in: query
+        name: resourceId
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            items:
+              $ref: '#/definitions/kubernetes.K8sEvent'
+            type: array
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "500":
+          description: Server error occurred while attempting to retrieve the events.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Gets kubernetes events
+      tags:
+      - kubernetes
+  /kubernetes/{id}/ingresscontrollers:
+    get:
+      description: |-
+        Get a list of ingress controllers for the given environment. If the allowedOnly query parameter is set, only ingress controllers that are allowed by the environment's ingress configuration will be returned.
+        **Access policy**: Authenticated user.
+      operationId: GetAllKubernetesIngressControllers
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Only return allowed ingress controllers
+        in: query
+        name: allowedOnly
+        type: boolean
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            items:
+              $ref: '#/definitions/kubernetes.K8sIngressController'
+            type: array
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve ingress
+            controllers
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get a list of ingress controllers
+      tags:
+      - kubernetes
+    put:
+      consumes:
+      - application/json
+      description: |-
+        Update (block/unblock) ingress controllers for the provided environment.
+        **Access policy**: Authenticated user.
+      operationId: UpdateKubernetesIngressControllers
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Ingress controllers
+        in: body
+        name: body
+        required: true
+        schema:
+          items:
+            $ref: '#/definitions/kubernetes.K8sIngressController'
+          type: array
+      produces:
+      - application/json
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier
+            or unable to find the ingress controllers to update.
+        "500":
+          description: Server error occurred while attempting to update ingress controllers.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Update (block/unblock) ingress controllers
+      tags:
+      - kubernetes
+  /kubernetes/{id}/ingresses:
+    get:
+      description: |-
+        Get kubernetes ingresses at the cluster level for the provided environment.
+        **Access policy**: Authenticated user.
+      operationId: GetAllKubernetesClusterIngresses
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Lookup services associated with each ingress
+        in: query
+        name: withServices
+        type: boolean
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            items:
+              $ref: '#/definitions/kubernetes.K8sIngressInfo'
+            type: array
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve ingresses.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get kubernetes ingresses at the cluster level
+      tags:
+      - kubernetes
+  /kubernetes/{id}/ingresses/count:
+    get:
+      description: |-
+        Get the number of kubernetes ingresses within the given environment.
+        **Access policy**: Authenticated user.
+      operationId: GetAllKubernetesClusterIngressesCount
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            type: integer
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve ingresses
+            count.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get Ingresses count
+      tags:
+      - kubernetes
+  /kubernetes/{id}/ingresses/delete:
+    post:
+      consumes:
+      - application/json
+      description: |-
+        Delete one or more Ingresses in the provided environment.
+        **Access policy**: Authenticated user.
+      operationId: DeleteKubernetesIngresses
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Ingress details
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/kubernetes.K8sIngressDeleteRequests'
+      produces:
+      - application/json
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier
+            or unable to find a specific ingress.
+        "500":
+          description: Server error occurred while attempting to delete specified
+            ingresses.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Delete one or more Ingresses
+      tags:
+      - kubernetes
+  /kubernetes/{id}/jobs:
+    get:
+      description: |-
+        Get a list of kubernetes Jobs that the user has access to.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesJobs
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Whether to include Jobs that have a cronjob owner
+        in: query
+        name: includeCronJobChildren
+        type: boolean
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            items:
+              $ref: '#/definitions/kubernetes.K8sJob'
+            type: array
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve the list
+            of Jobs.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get a list of kubernetes Jobs
+      tags:
+      - kubernetes
+  /kubernetes/{id}/jobs/delete:
+    post:
+      consumes:
+      - application/json
+      description: |-
+        Delete the provided list of Jobs.
+        **Access policy**: Authenticated user.
+      operationId: DeleteJobs
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: A map where the key is the namespace and the value is an array
+          of Jobs to delete
+        in: body
+        name: payload
+        required: true
+        schema:
+          $ref: '#/definitions/kubernetes.K8sJobDeleteRequests'
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier
+            or unable to find a specific service account.
+        "500":
+          description: Server error occurred while attempting to delete Jobs.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Delete Jobs
+      tags:
+      - kubernetes
+  /kubernetes/{id}/max_resource_limits:
+    get:
+      description: |-
+        Get max CPU and memory limits (unused resources) of all nodes within k8s cluster.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesMaxResourceLimits
+      parameters:
+      - description: Environment(Endpoint) identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/portainer.K8sNodesLimits'
+        "400":
+          description: Invalid request
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve nodes limits.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get max CPU and memory limits of all nodes within k8s cluster
+      tags:
+      - kubernetes
+  /kubernetes/{id}/metrics/applications_resources:
+    get:
+      description: |-
+        Get the total CPU (cores) and memory (bytes) requests and limits of all applications across all namespaces.
+        **Access policy**: Authenticated user.
+      operationId: GetApplicationsResources
+      parameters:
+      - description: Environment(Endpoint) identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Node name
+        in: query
+        name: node
+        required: true
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/kubernetes.K8sApplicationResource'
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve the total
+            resource requests and limits for all applications from the cluster.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get the total resource requests and limits of all applications
+      tags:
+      - kubernetes
+  /kubernetes/{id}/metrics/nodes:
+    get:
+      description: |-
+        Get a list of metrics associated with all nodes of a cluster.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesMetricsForAllNodes
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/v1beta1.NodeMetricsList'
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "500":
+          description: Server error occurred while attempting to retrieve the list
+            of nodes with their live metrics.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get a list of nodes with their live metrics
+      tags:
+      - kubernetes
+  /kubernetes/{id}/metrics/nodes/{name}:
+    get:
+      description: |-
+        Get live metrics for the specified node.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesMetricsForNode
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Node identifier
+        in: path
+        name: name
+        required: true
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/v1beta1.NodeMetrics'
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "500":
+          description: Server error occurred while attempting to retrieve the live
+            metrics for the specified node.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get live metrics for a node
+      tags:
+      - kubernetes
+  /kubernetes/{id}/metrics/pods/{namespace}:
+    get:
+      description: |-
+        Get a list of pods with their live metrics for the specified namespace.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesMetricsForAllPods
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Namespace
+        in: path
+        name: namespace
+        required: true
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/v1beta1.PodMetricsList'
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "500":
+          description: Server error occurred while attempting to retrieve the list
+            of pods with their live metrics.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get a list of pods with their live metrics
+      tags:
+      - kubernetes
+  /kubernetes/{id}/metrics/pods/{namespace}/{name}:
+    get:
+      description: |-
+        Get live metrics for the specified pod.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesMetricsForPod
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Namespace
+        in: path
+        name: namespace
+        required: true
+        type: string
+      - description: Pod identifier
+        in: path
+        name: name
+        required: true
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/v1beta1.PodMetrics'
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "500":
+          description: Server error occurred while attempting to retrieve the live
+            metrics for the specified pod.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get live metrics for a pod
+      tags:
+      - kubernetes
+  /kubernetes/{id}/namespaces:
+    delete:
+      description: |-
+        Delete a kubernetes namespace within the given environment.
+        **Access policy**: Authenticated user.
+      operationId: DeleteKubernetesNamespace
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      responses:
+        "200":
+          description: Success
+          schema:
+            type: string
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "403":
+          description: Unauthorized access or operation not allowed.
+        "500":
+          description: Server error occurred while attempting to delete the namespace.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Delete a kubernetes namespace
+      tags:
+      - kubernetes
+    get:
+      description: |-
+        Get a list of all namespaces within the given environment based on the user role and permissions. If the user is an admin, they can access all namespaces. If the user is not an admin, they can only access namespaces that they have access to.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesNamespaces
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: When set to true, include the resource quota information as part
+          of the Namespace information. Default is false
+        in: query
+        name: withResourceQuota
+        required: true
+        type: boolean
+      - description: When set to true, include the unhealthy events information as
+          part of the Namespace information. Default is false
+        in: query
+        name: withUnhealthyEvents
+        required: true
+        type: boolean
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            items:
+              $ref: '#/definitions/portainer.K8sNamespaceInfo'
+            type: array
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve the list
+            of namespaces.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get a list of namespaces
+      tags:
+      - kubernetes
+    post:
+      consumes:
+      - application/json
+      description: |-
+        Create a namespace within the given environment.
+        **Access policy**: Authenticated user.
+      operationId: CreateKubernetesNamespace
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Namespace configuration details
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/kubernetes.K8sNamespaceDetails'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/portainer.K8sNamespaceInfo'
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "409":
+          description: Conflict - the namespace already exists.
+        "500":
+          description: Server error occurred while attempting to create the namespace.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Create a namespace
+      tags:
+      - kubernetes
+    put:
+      consumes:
+      - application/json
+      description: |-
+        Update a namespace within the given environment.
+        **Access policy**: Authenticated user.
+      operationId: UpdateKubernetesNamespaceDeprecated
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Namespace
+        in: path
+        name: namespace
+        required: true
+        type: string
+      - description: Namespace details
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/kubernetes.K8sNamespaceDetails'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/portainer.K8sNamespaceInfo'
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier
+            or unable to find a specific namespace.
+        "500":
+          description: Server error occurred while attempting to update the namespace.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Update a namespace
+      tags:
+      - kubernetes
+  /kubernetes/{id}/namespaces/{namespace}:
+    get:
+      description: |-
+        Get namespace details for the provided namespace within the given environment.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesNamespace
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: The namespace name to get details for
+        in: path
+        name: namespace
+        required: true
+        type: string
+      - description: When set to true, include the resource quota information as part
+          of the Namespace information. Default is false
+        in: query
+        name: withResourceQuota
+        required: true
+        type: boolean
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/portainer.K8sNamespaceInfo'
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier
+            or unable to find a specific namespace.
+        "500":
+          description: Server error occurred while attempting to retrieve specified
+            namespace information.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get namespace details
+      tags:
+      - kubernetes
+    put:
+      consumes:
+      - application/json
+      description: |-
+        Update a namespace within the given environment.
+        **Access policy**: Authenticated user.
+      operationId: UpdateKubernetesNamespace
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Namespace
+        in: path
+        name: namespace
+        required: true
+        type: string
+      - description: Namespace details
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/kubernetes.K8sNamespaceDetails'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/portainer.K8sNamespaceInfo'
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier
+            or unable to find a specific namespace.
+        "500":
+          description: Server error occurred while attempting to update the namespace.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Update a namespace
+      tags:
+      - kubernetes
+  /kubernetes/{id}/namespaces/{namespace}/configmaps/{configmap}:
+    get:
+      description: |-
+        Get a ConfigMap by name for a given namespace.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesConfigMap
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: The namespace name where the configmap is located
+        in: path
+        name: namespace
+        required: true
+        type: string
+      - description: The configmap name to get details for
+        in: path
+        name: configmap
+        required: true
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/kubernetes.K8sConfigMap'
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier
+            or a configmap with the specified name in the given namespace.
+        "500":
+          description: Server error occurred while attempting to retrieve a configmap
+            by name within the specified namespace.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get a ConfigMap
+      tags:
+      - kubernetes
+  /kubernetes/{id}/namespaces/{namespace}/events:
+    get:
+      description: |-
+        Get events by optional query param resourceId for a given namespace.
+        **Access policy**: Authenticated user.
+      operationId: getKubernetesEventsForNamespace
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: The namespace name the events are associated to
+        in: path
+        name: namespace
+        required: true
+        type: string
+      - description: The resource id of the involved kubernetes object
+        in: query
+        name: resourceId
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            items:
+              $ref: '#/definitions/kubernetes.K8sEvent'
+            type: array
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "500":
+          description: Server error occurred while attempting to retrieve the events
+            within the specified namespace.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Gets kubernetes events for namespace
+      tags:
+      - kubernetes
+  /kubernetes/{id}/namespaces/{namespace}/ingresscontrollers:
+    get:
+      description: |-
+        Get a list of ingress controllers for the given environment in the provided namespace.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesIngressControllersByNamespace
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Namespace
+        in: path
+        name: namespace
+        required: true
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            items:
+              $ref: '#/definitions/kubernetes.K8sIngressController'
+            type: array
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier
+            or a namespace with the specified name.
+        "500":
+          description: Server error occurred while attempting to retrieve ingress
+            controllers by a namespace
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get a list ingress controllers by namespace
+      tags:
+      - kubernetes
+    put:
+      consumes:
+      - application/json
+      description: |-
+        Update (block/unblock) ingress controllers by namespace for the provided environment.
+        **Access policy**: Authenticated user.
+      operationId: UpdateKubernetesIngressControllersByNamespace
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Namespace name
+        in: path
+        name: namespace
+        required: true
+        type: string
+      - description: Ingress controllers
+        in: body
+        name: body
+        required: true
+        schema:
+          items:
+            $ref: '#/definitions/kubernetes.K8sIngressController'
+          type: array
+      produces:
+      - application/json
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to update ingress controllers
+            by namespace.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Update (block/unblock) ingress controllers by namespace
+      tags:
+      - kubernetes
+  /kubernetes/{id}/namespaces/{namespace}/ingresses:
+    get:
+      description: |-
+        Get a list of Ingresses. If namespace is provided, it will return the list of Ingresses in that namespace.
+        **Access policy**: Authenticated user.
+      operationId: GetAllKubernetesIngresses
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Namespace name
+        in: path
+        name: namespace
+        required: true
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            items:
+              $ref: '#/definitions/kubernetes.K8sIngressInfo'
+            type: array
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve ingresses
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get a list of Ingresses
+      tags:
+      - kubernetes
+    post:
+      consumes:
+      - application/json
+      description: |-
+        Create an Ingress for the provided environment.
+        **Access policy**: Authenticated user.
+      operationId: CreateKubernetesIngress
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Namespace name
+        in: path
+        name: namespace
+        required: true
+        type: string
+      - description: Ingress details
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/kubernetes.K8sIngressInfo'
+      produces:
+      - application/json
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "409":
+          description: Conflict - an ingress with the same name already exists in
+            the specified namespace.
+        "500":
+          description: Server error occurred while attempting to create an ingress.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Create an Ingress
+      tags:
+      - kubernetes
+    put:
+      consumes:
+      - application/json
+      description: |-
+        Update an Ingress for the provided environment.
+        **Access policy**: Authenticated user.
+      operationId: UpdateKubernetesIngress
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Namespace name
+        in: path
+        name: namespace
+        required: true
+        type: string
+      - description: Ingress details
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/kubernetes.K8sIngressInfo'
+      produces:
+      - application/json
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier
+            or unable to find the specified ingress.
+        "500":
+          description: Server error occurred while attempting to update the specified
+            ingress.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Update an Ingress
+      tags:
+      - kubernetes
+  /kubernetes/{id}/namespaces/{namespace}/ingresses/{ingress}:
+    get:
+      description: |-
+        Get an Ingress by name for the provided environment.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesIngress
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Namespace name
+        in: path
+        name: namespace
+        required: true
+        type: string
+      - description: Ingress name
+        in: path
+        name: ingress
+        required: true
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/kubernetes.K8sIngressInfo'
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier
+            or unable to find an ingress with the specified name.
+        "500":
+          description: Server error occurred while attempting to retrieve an ingress.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get an Ingress by name
+      tags:
+      - kubernetes
+  /kubernetes/{id}/namespaces/{namespace}/persistent_volume_claims:
+    get:
+      description: |-
+        Get a list of PersistentVolumeClaims in the specified namespace.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesPersistentVolumeClaimsInNamespace
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Namespace name
+        in: path
+        name: namespace
+        required: true
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            items:
+              $ref: '#/definitions/kubernetes.K8sPersistentVolumeClaim'
+            type: array
+        "400":
+          description: Invalid request payload.
+        "403":
+          description: Unauthorized access or operation not allowed.
+        "500":
+          description: Server error occurred while attempting to retrieve persistent
+            volume claims.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get PersistentVolumeClaims in a namespace
+      tags:
+      - kubernetes
+  /kubernetes/{id}/namespaces/{namespace}/persistent_volume_claims/{name}:
+    get:
+      description: |-
+        Get a PersistentVolumeClaim by name within a namespace.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesPersistentVolumeClaim
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Namespace name
+        in: path
+        name: namespace
+        required: true
+        type: string
+      - description: PVC name
+        in: path
+        name: name
+        required: true
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/kubernetes.K8sPersistentVolumeClaim'
+        "400":
+          description: Invalid request payload.
+        "403":
+          description: Unauthorized access or operation not allowed.
+        "404":
+          description: PVC not found.
+        "500":
+          description: Server error occurred while attempting to retrieve the persistent
+            volume claim.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get a specific PersistentVolumeClaim
+      tags:
+      - kubernetes
+  /kubernetes/{id}/namespaces/{namespace}/pods/{name}:
+    delete:
+      description: |-
+        Delete a single Kubernetes pod in the given namespace. The owning
+        controller (Deployment, StatefulSet, DaemonSet, ...) is responsible
+        for recreating the pod. For naked pods the pod is removed permanently.
+        **Access policy**: Authenticated user.
+      operationId: DeleteKubernetesPod
+      parameters:
+      - description: Environment(Endpoint) identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Namespace
+        in: path
+        name: namespace
+        required: true
+        type: string
+      - description: Pod name
+        in: path
+        name: name
+        required: true
+        type: string
+      produces:
+      - application/json
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier
+            or unable to find the specified pod.
+        "500":
+          description: Server error occurred while attempting to delete the pod.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Delete a kubernetes pod
+      tags:
+      - kubernetes
+  /kubernetes/{id}/namespaces/{namespace}/pods/{name}/restart:
+    post:
+      description: |-
+        Restart all containers in a single Kubernetes pod in place using
+        the Kubernetes 1.35 alpha pod-restart subresource. The pod itself
+        is preserved. Requires the cluster to expose the corresponding
+        subresource (and the matching feature gate to be enabled).
+        **Access policy**: Authenticated user.
+      operationId: RestartKubernetesPod
+      parameters:
+      - description: Environment(Endpoint) identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Namespace
+        in: path
+        name: namespace
+        required: true
+        type: string
+      - description: Pod name
+        in: path
+        name: name
+        required: true
+        type: string
+      produces:
+      - application/json
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment, the specified pod, or the cluster
+            does not expose the pod-restart subresource (Kubernetes <1.35 or feature
+            gate disabled).
+        "405":
+          description: The cluster does not support the pod-restart subresource (Kubernetes
+            <1.35 or feature gate disabled).
+        "500":
+          description: Server error occurred while attempting to restart the pod.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Restart all containers in a Kubernetes pod
+      tags:
+      - kubernetes
+  /kubernetes/{id}/namespaces/{namespace}/secrets/{secret}:
+    get:
+      description: |-
+        Get a Secret by name for a given namespace.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesSecret
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: The namespace name where the secret is located
+        in: path
+        name: namespace
+        required: true
+        type: string
+      - description: The secret name to get details for
+        in: path
+        name: secret
+        required: true
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/kubernetes.K8sSecret'
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve a secret
+            by name belong in a namespace.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get a Secret
+      tags:
+      - kubernetes
+  /kubernetes/{id}/namespaces/{namespace}/service_accounts/{name}:
+    get:
+      description: |-
+        Get a kubernetes service account in the given namespace.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesServiceAccount
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Namespace
+        in: path
+        name: namespace
+        required: true
+        type: string
+      - description: Service account name
+        in: path
+        name: name
+        required: true
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/kubernetes.K8sServiceAccount'
+        "400":
+          description: Invalid request
+        "401":
+          description: Unauthorized
+        "403":
+          description: Permission denied
+        "404":
+          description: Service account not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get a kubernetes service account
+      tags:
+      - kubernetes
+  /kubernetes/{id}/namespaces/{namespace}/service_accounts/{name}/image_pull_secrets:
+    put:
+      consumes:
+      - application/json
+      description: |-
+        Replace the imagePullSecrets list on a service account with the provided list.
+        **Access policy**: Authenticated user.
+      operationId: UpdateKubernetesServiceAccountImagePullSecrets
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Namespace
+        in: path
+        name: namespace
+        required: true
+        type: string
+      - description: Service account name
+        in: path
+        name: name
+        required: true
+        type: string
+      - description: New imagePullSecrets list
+        in: body
+        name: payload
+        required: true
+        schema:
+          $ref: '#/definitions/kubernetes.K8sServiceAccountImagePullSecretsUpdatePayload'
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier,
+            namespace, or service account.
+        "500":
+          description: Server error occurred while attempting to update image pull
+            secrets for the service account.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Update image pull secrets for a service account
+      tags:
+      - kubernetes
+  /kubernetes/{id}/namespaces/{namespace}/services:
+    get:
+      description: |-
+        Get a list of services for a given namespace.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesServicesByNamespace
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Namespace name
+        in: path
+        name: namespace
+        required: true
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            items:
+              $ref: '#/definitions/kubernetes.K8sServiceInfo'
+            type: array
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve all services
+            for a namespace.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get a list of services for a given namespace
+      tags:
+      - kubernetes
+    post:
+      consumes:
+      - application/json
+      description: |-
+        Create a service within a given namespace
+        **Access policy**: Authenticated user.
+      operationId: CreateKubernetesService
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Namespace name
+        in: path
+        name: namespace
+        required: true
+        type: string
+      - description: Service definition
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/kubernetes.K8sServiceInfo'
+      produces:
+      - application/json
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to create a service.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Create a service
+      tags:
+      - kubernetes
+    put:
+      consumes:
+      - application/json
+      description: |-
+        Update a service within a given namespace.
+        **Access policy**: Authenticated user.
+      operationId: UpdateKubernetesService
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Namespace name
+        in: path
+        name: namespace
+        required: true
+        type: string
+      - description: Service definition
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/kubernetes.K8sServiceInfo'
+      produces:
+      - application/json
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier
+            or unable to find the service to update.
+        "500":
+          description: Server error occurred while attempting to update a service.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Update a service
+      tags:
+      - kubernetes
+  /kubernetes/{id}/namespaces/{namespace}/system:
+    put:
+      consumes:
+      - application/json
+      description: |-
+        Toggle the system state for a namespace
+        **Access policy**: Administrator or environment administrator.
+      operationId: KubernetesNamespacesToggleSystem
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Namespace name
+        in: path
+        name: namespace
+        required: true
+        type: string
+      - description: Update details
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/kubernetes.namespacesToggleSystemPayload'
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier
+            or unable to find the namespace to update.
+        "500":
+          description: Server error occurred while attempting to update the system
+            state of the namespace.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Toggle the system state for a namespace
+      tags:
+      - kubernetes
+  /kubernetes/{id}/namespaces/{namespace}/volumes:
+    get:
+      description: |-
+        Get a list of kubernetes volumes within the specified namespace in the given environment (Endpoint). The Endpoint ID must be a valid Portainer environment identifier.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesVolumesInNamespace
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Namespace identifier
+        in: path
+        name: namespace
+        required: true
+        type: string
+      - description: When set to True, include the applications that are using the
+          volumes. It is set to false by default
+        in: query
+        name: withApplications
+        type: boolean
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            additionalProperties:
+              $ref: '#/definitions/kubernetes.K8sVolumeInfo'
+            type: object
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "403":
+          description: Unauthorized access or operation not allowed.
+        "500":
+          description: Server error occurred while attempting to retrieve kubernetes
+            volumes in the namespace.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get Kubernetes volumes within a namespace in the given Portainer environment
+      tags:
+      - kubernetes
+  /kubernetes/{id}/namespaces/count:
+    get:
+      description: |-
+        Get the total number of kubernetes namespaces within the given environment, including the system namespaces. The total count depends on the user's role and permissions.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesNamespacesCount
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            type: integer
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to compute the namespace
+            count.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get the total number of kubernetes namespaces within the given Portainer
+        environment.
+      tags:
+      - kubernetes
+  /kubernetes/{id}/nodes:
+    get:
+      description: |-
+        Returns the list of Kubernetes nodes for the selected environment.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesNodes
+      parameters:
+      - description: Environment(Endpoint) identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            items:
+              $ref: '#/definitions/kubernetes.KubernetesNodeResponse'
+            type: array
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource.
+        "500":
+          description: Server error occurred while attempting to retrieve the list
+            of nodes.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get Kubernetes cluster nodes
+      tags:
+      - kubernetes
+  /kubernetes/{id}/nodes/{name}/drain:
+    post:
+      consumes:
+      - application/json
+      description: |-
+        Drain a Kubernetes node by safely evicting all pods from the node, preparing it for maintenance or removal
+        **Access policy**: authenticated
+      operationId: drainNode
+      parameters:
+      - description: Environment(Endpoint) identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Name of the node to drain
+        in: path
+        name: name
+        required: true
+        type: string
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request, such as missing required fields or fields
+            not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier
+            or unable to find the specified node.
+        "500":
+          description: Server error occurred while attempting to drain node.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Drain a Kubernetes node
+      tags:
+      - kubernetes
+  /kubernetes/{id}/nodes_limits:
+    get:
+      description: |-
+        Get CPU and memory limits of all nodes within k8s cluster.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesNodesLimits
+      parameters:
+      - description: Environment(Endpoint) identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/portainer.K8sNodesLimits'
+        "400":
+          description: Invalid request
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve nodes limits.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get CPU and memory limits of all nodes within k8s cluster
+      tags:
+      - kubernetes
+  /kubernetes/{id}/persistent_volume_claims:
+    get:
+      description: |-
+        Get a list of all PersistentVolumeClaims within the given environment. Scoped by namespace for non-admin users.
+        **Access policy**: Authenticated user.
+      operationId: GetAllKubernetesPersistentVolumeClaims
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            items:
+              $ref: '#/definitions/kubernetes.K8sPersistentVolumeClaim'
+            type: array
+        "400":
+          description: Invalid request payload.
+        "403":
+          description: Unauthorized access or operation not allowed.
+        "500":
+          description: Server error occurred while attempting to retrieve persistent
+            volume claims.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get all PersistentVolumeClaims
+      tags:
+      - kubernetes
+  /kubernetes/{id}/persistent_volume_claims/delete:
+    post:
+      consumes:
+      - application/json
+      description: |-
+        Delete the provided list of PersistentVolumeClaims.
+        **Access policy**: Authenticated user.
+      operationId: DeleteKubernetesPersistentVolumeClaims
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: List of PVCs to delete (namespace + name)
+        in: body
+        name: body
+        required: true
+        schema:
+          items:
+            $ref: '#/definitions/kubernetes.K8sVolumeDeleteRequest'
+          type: array
+      produces:
+      - application/json
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload.
+        "403":
+          description: Unauthorized access or operation not allowed.
+        "500":
+          description: Server error occurred while attempting to delete persistent
+            volume claims.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Delete PersistentVolumeClaims
+      tags:
+      - kubernetes
+  /kubernetes/{id}/persistent_volume_claims/resize:
+    put:
+      consumes:
+      - application/json
+      description: |-
+        Resize a PVC to a new size. The StorageClass must support volume expansion.
+        **Access policy**: Authenticated user.
+      operationId: ResizeKubernetesPersistentVolumeClaim
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: PVC resize request
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/kubernetes.K8sPVCResizeRequest'
+      produces:
+      - application/json
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload.
+        "403":
+          description: Unauthorized access or operation not allowed.
+        "500":
+          description: Server error occurred while attempting to resize the persistent
+            volume claim.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Resize a PersistentVolumeClaim
+      tags:
+      - kubernetes
+  /kubernetes/{id}/persistent_volumes:
+    get:
+      description: |-
+        Get a list of all PersistentVolumes in the given environment.
+        **Access policy**: Authenticated user.
+      operationId: GetAllKubernetesPersistentVolumes
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            items:
+              $ref: '#/definitions/kubernetes.K8sPersistentVolume'
+            type: array
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "403":
+          description: Unauthorized access or operation not allowed.
+        "500":
+          description: Server error occurred while attempting to retrieve persistent
+            volumes.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get all PersistentVolumes in the cluster
+      tags:
+      - kubernetes
+  /kubernetes/{id}/persistent_volumes/{name}:
+    get:
+      description: |-
+        Get a PersistentVolume by name in the given environment.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesPersistentVolume
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: PersistentVolume name
+        in: path
+        name: name
+        required: true
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/kubernetes.K8sPersistentVolume'
+        "400":
+          description: Invalid request payload.
+        "403":
+          description: Unauthorized access or operation not allowed.
+        "404":
+          description: PersistentVolume not found.
+        "500":
+          description: Server error occurred while attempting to retrieve the persistent
+            volume.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get a specific PersistentVolume
+      tags:
+      - kubernetes
+  /kubernetes/{id}/persistent_volumes/delete:
+    post:
+      consumes:
+      - application/json
+      description: |-
+        Delete the provided list of PersistentVolumes.
+        **Access policy**: Authenticated user.
+      operationId: DeleteKubernetesPersistentVolumes
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: List of PV names to delete
+        in: body
+        name: body
+        required: true
+        schema:
+          items:
+            type: string
+          type: array
+      produces:
+      - application/json
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload.
+        "403":
+          description: Unauthorized access or operation not allowed.
+        "500":
+          description: Server error occurred while attempting to delete persistent
+            volumes.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Delete PersistentVolumes
+      tags:
+      - kubernetes
+  /kubernetes/{id}/persistent_volumes/reclaim_policy:
+    put:
+      consumes:
+      - application/json
+      description: |-
+        Update the reclaim policy of a PersistentVolume.
+        **Access policy**: Authenticated user.
+      operationId: UpdateKubernetesPersistentVolumeReclaimPolicy
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Reclaim policy update request
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/kubernetes.K8sPVReclaimPolicyRequest'
+      produces:
+      - application/json
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload.
+        "403":
+          description: Unauthorized access or operation not allowed.
+        "500":
+          description: Server error occurred while attempting to update reclaim policy.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Update reclaim policy of a PersistentVolume
+      tags:
+      - kubernetes
+  /kubernetes/{id}/rbac_enabled:
+    get:
+      description: |-
+        Check if RBAC is enabled in the specified Kubernetes cluster.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesRBACStatus
+      parameters:
+      - description: Environment(Endpoint) identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: RBAC status
+          schema:
+            type: boolean
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve the RBAC
+            status.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Check if RBAC is enabled
+      tags:
+      - kubernetes
+  /kubernetes/{id}/role_bindings/delete:
+    post:
+      consumes:
+      - application/json
+      description: |-
+        Delete the provided list of role bindings.
+        **Access policy**: Authenticated user.
+      operationId: DeleteRoleBindings
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: A map where the key is the namespace and the value is an array
+          of role bindings to delete
+        in: body
+        name: payload
+        required: true
+        schema:
+          $ref: '#/definitions/kubernetes.K8sRoleBindingDeleteRequests'
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier
+            or unable to find a specific role binding.
+        "500":
+          description: Server error occurred while attempting to delete role bindings.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Delete role bindings
+      tags:
+      - kubernetes
+  /kubernetes/{id}/rolebindings:
+    get:
+      description: |-
+        Get a list of kubernetes role bindings that the user has access to.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesRoleBindings
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            items:
+              $ref: '#/definitions/kubernetes.K8sRoleBinding'
+            type: array
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve the list
+            of role bindings.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get a list of kubernetes role bindings
+      tags:
+      - kubernetes
+  /kubernetes/{id}/roles:
+    get:
+      description: |-
+        Get a list of kubernetes roles that the user has access to.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesRoles
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            items:
+              $ref: '#/definitions/kubernetes.K8sRole'
+            type: array
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve the list
+            of roles.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get a list of kubernetes roles
+      tags:
+      - kubernetes
+  /kubernetes/{id}/roles/delete:
+    post:
+      consumes:
+      - application/json
+      description: |-
+        Delete the provided list of roles.
+        **Access policy**: Authenticated user.
+      operationId: DeleteRoles
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: A map where the key is the namespace and the value is an array
+          of roles to delete
+        in: body
+        name: payload
+        required: true
+        schema:
+          $ref: '#/definitions/kubernetes.K8sRoleDeleteRequests'
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier
+            or unable to find a specific role.
+        "500":
+          description: Server error occurred while attempting to delete roles.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Delete roles
+      tags:
+      - kubernetes
+  /kubernetes/{id}/secrets:
+    get:
+      description: |-
+        Get a list of Secrets for a given namespace. If isUsed is set to true, information about the applications that use the secrets is also returned.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesSecrets
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: When set to true, associate the Secrets with the applications
+          that use them
+        in: query
+        name: isUsed
+        required: true
+        type: boolean
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            items:
+              $ref: '#/definitions/kubernetes.K8sSecret'
+            type: array
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve all secrets
+            from the cluster.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get a list of Secrets
+      tags:
+      - kubernetes
+  /kubernetes/{id}/secrets/count:
+    get:
+      description: |-
+        Get the count of Secrets across all namespaces that the user has access to.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesSecretsCount
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            type: integer
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve the count
+            of all secrets from the cluster.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get Secrets count
+      tags:
+      - kubernetes
+  /kubernetes/{id}/service_accounts/delete:
+    post:
+      consumes:
+      - application/json
+      description: |-
+        Delete the provided list of service accounts.
+        **Access policy**: Authenticated user.
+      operationId: DeleteServiceAccounts
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: A map where the key is the namespace and the value is an array
+          of service accounts to delete
+        in: body
+        name: payload
+        required: true
+        schema:
+          $ref: '#/definitions/kubernetes.K8sServiceAccountDeleteRequests'
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier
+            or unable to find a specific service account.
+        "500":
+          description: Server error occurred while attempting to delete service accounts.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Delete service accounts
+      tags:
+      - kubernetes
+  /kubernetes/{id}/serviceaccounts:
+    get:
+      description: |-
+        Get a list of kubernetes service accounts that the user has access to.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesServiceAccounts
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            items:
+              $ref: '#/definitions/kubernetes.K8sServiceAccount'
+            type: array
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve the list
+            of service accounts.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get a list of kubernetes service accounts
+      tags:
+      - kubernetes
+  /kubernetes/{id}/services:
+    get:
+      description: |-
+        Get a list of services that the user has access to.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesServices
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Lookup applications associated with each service
+        in: query
+        name: withApplications
+        type: boolean
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            items:
+              $ref: '#/definitions/kubernetes.K8sServiceInfo'
+            type: array
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve all services.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get a list of services
+      tags:
+      - kubernetes
+  /kubernetes/{id}/services/count:
+    get:
+      description: |-
+        Get the count of services that the user has access to.
+        **Access policy**: Authenticated user.
+      operationId: GetAllKubernetesServicesCount
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            type: integer
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve the total
+            count of all services.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get services count
+      tags:
+      - kubernetes
+  /kubernetes/{id}/services/delete:
+    post:
+      consumes:
+      - application/json
+      description: |-
+        Delete the provided list of services.
+        **Access policy**: Authenticated user.
+      operationId: DeleteKubernetesServices
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: A map where the key is the namespace and the value is an array
+          of services to delete
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/kubernetes.K8sServiceDeleteRequests'
+      produces:
+      - application/json
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier
+            or unable to find a specific service.
+        "500":
+          description: Server error occurred while attempting to delete services.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Delete services
+      tags:
+      - kubernetes
+  /kubernetes/{id}/storage_classes:
+    get:
+      description: |-
+        Get a list of all StorageClasses in the given environment.
+        **Access policy**: Authenticated user.
+      operationId: GetAllKubernetesStorageClasses
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            items:
+              $ref: '#/definitions/kubernetes.K8sStorageClass'
+            type: array
+        "400":
+          description: Invalid request payload.
+        "403":
+          description: Unauthorized access or operation not allowed.
+        "500":
+          description: Server error occurred while attempting to retrieve storage
+            classes.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get all StorageClasses
+      tags:
+      - kubernetes
+  /kubernetes/{id}/storage_classes/{name}:
+    get:
+      description: |-
+        Get a StorageClass by name in the given environment.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesStorageClass
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: StorageClass name
+        in: path
+        name: name
+        required: true
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/kubernetes.K8sStorageClass'
+        "400":
+          description: Invalid request payload.
+        "403":
+          description: Unauthorized access or operation not allowed.
+        "404":
+          description: StorageClass not found.
+        "500":
+          description: Server error occurred while attempting to retrieve the storage
+            class.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get a specific StorageClass
+      tags:
+      - kubernetes
+  /kubernetes/{id}/storage_classes/{name}/default:
+    put:
+      consumes:
+      - application/json
+      description: |-
+        Set the specified StorageClass as the cluster default, removing default from any other.
+        **Access policy**: Authenticated user.
+      operationId: SetDefaultKubernetesStorageClass
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: StorageClass name
+        in: path
+        name: name
+        required: true
+        type: string
+      produces:
+      - application/json
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload.
+        "403":
+          description: Unauthorized access or operation not allowed.
+        "500":
+          description: Server error occurred while attempting to set default storage
+            class.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Set a StorageClass as default
+      tags:
+      - kubernetes
+  /kubernetes/{id}/storage_classes/delete:
+    post:
+      consumes:
+      - application/json
+      description: |-
+        Delete the provided list of StorageClasses.
+        **Access policy**: Authenticated user.
+      operationId: DeleteKubernetesStorageClasses
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: List of StorageClass names to delete
+        in: body
+        name: body
+        required: true
+        schema:
+          items:
+            type: string
+          type: array
+      produces:
+      - application/json
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request payload.
+        "403":
+          description: Unauthorized access or operation not allowed.
+        "500":
+          description: Server error occurred while attempting to delete storage classes.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Delete StorageClasses
+      tags:
+      - kubernetes
+  /kubernetes/{id}/version:
+    get:
+      description: |-
+        Get the Kubernetes cluster version (major, minor, gitVersion, ...)
+        as reported by the cluster's discovery API, augmented with capability
+        flags Portainer uses to gate UI features (e.g. supportsPodRestart).
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesVersion
+      parameters:
+      - description: Environment(Endpoint) identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/kubernetes.kubernetesVersionResponse'
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to retrieve the cluster
+            version.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get the Kubernetes cluster version and Portainer-relevant capabilities
+      tags:
+      - kubernetes
+  /kubernetes/{id}/volumes:
+    get:
+      description: |-
+        Get a list of all kubernetes volumes within the given environment (Endpoint). The Endpoint ID must be a valid Portainer environment identifier.
+        **Access policy**: Authenticated user.
+      operationId: GetAllKubernetesVolumes
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: When set to True, include the applications that are using the
+          volumes. It is set to false by default
+        in: query
+        name: withApplications
+        type: boolean
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            additionalProperties:
+              $ref: '#/definitions/kubernetes.K8sVolumeInfo'
+            type: object
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "403":
+          description: Unauthorized access or operation not allowed.
+        "500":
+          description: Server error occurred while attempting to retrieve kubernetes
+            volumes.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get Kubernetes volumes within the given Portainer environment
+      tags:
+      - kubernetes
+  /kubernetes/{id}/volumes/{namespace}/{volume}:
+    get:
+      description: |-
+        Get a Kubernetes volume within the given environment (Endpoint). The Endpoint ID must be a valid Portainer environment identifier.
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesVolume
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Namespace identifier
+        in: path
+        name: namespace
+        required: true
+        type: string
+      - description: Volume name
+        in: path
+        name: volume
+        required: true
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/kubernetes.K8sVolumeInfo'
+        "400":
+          description: Invalid request
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get a Kubernetes volume within the given Portainer environment
+      tags:
+      - kubernetes
+  /kubernetes/{id}/volumes/count:
+    get:
+      description: |-
+        Get the total number of kubernetes volumes within the given environment (Endpoint). The total count depends on the user's role and permissions. The Endpoint ID must be a valid Portainer environment identifier.
+        **Access policy**: Authenticated user.
+      operationId: getAllKubernetesVolumesCount
+      parameters:
+      - description: Environment identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            type: integer
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "403":
+          description: Unauthorized access or operation not allowed.
+        "500":
+          description: Server error occurred while attempting to retrieve kubernetes
+            volumes count.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Get the total number of kubernetes volumes within the given Portainer
+        environment.
+      tags:
+      - kubernetes
+  /kubernetes/config:
+    get:
+      description: |-
+        Generate a kubeconfig file that allows a client to communicate with the Kubernetes API server
+        **Access policy**: Authenticated user.
+      operationId: GetKubernetesConfig
+      parameters:
+      - collectionFormat: csv
+        description: will include only these environments(endpoints)
+        in: query
+        items:
+          type: integer
+        name: ids
+        type: array
+      - collectionFormat: csv
+        description: will exclude these environments(endpoints)
+        in: query
+        items:
+          type: integer
+        name: excludeIds
+        type: array
+      produces:
+      - application/json
+      - ' application/yaml'
+      responses:
+        "200":
+          description: Success
+          schema: {}
+        "400":
+          description: Invalid request payload, such as missing required fields or
+            fields not meeting validation criteria.
+        "401":
+          description: Unauthorized access - the user is not authenticated or does
+            not have the necessary permissions. Ensure that you have provided a valid
+            API key or JWT token, and that you have the required permissions.
+        "403":
+          description: Permission denied - the user is authenticated but does not
+            have the necessary permissions to access the requested resource or perform
+            the specified operation. Check your user roles and permissions.
+        "404":
+          description: Unable to find an environment with the specified identifier.
+        "500":
+          description: Server error occurred while attempting to generate the kubeconfig
+            file.
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Generate a kubeconfig file
+      tags:
+      - kubernetes
+  /ldap/check:
+    post:
+      consumes:
+      - application/json
+      description: |-
+        Test LDAP connectivity using LDAP details
+        **Access policy**: administrator
+      operationId: LDAPCheck
+      parameters:
+      - description: details
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/ldap.checkPayload'
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Test LDAP connectivity
+      tags:
+      - ldap
+  /motd:
+    get:
+      description: '**Access policy**: restricted'
+      operationId: MOTD
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/motd.Motd'
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: fetches the message of the day
+      tags:
+      - motd
+  /registries:
+    get:
+      description: |-
+        List all registries based on the current user authorizations.
+        Will return all registries if using an administrator account otherwise it
+        will only return authorized registries.
+        **Access policy**: restricted
+      operationId: RegistryList
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            items:
+              $ref: '#/definitions/portainer.Registry'
+            type: array
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: List Registries
+      tags:
+      - registries
+    post:
+      consumes:
+      - application/json
+      description: |-
+        Create a new registry.
+        **Access policy**: restricted
+      operationId: RegistryCreate
+      parameters:
+      - description: Registry details
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/registries.registryCreatePayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/portainer.Registry'
+        "400":
+          description: Invalid request
+        "409":
+          description: Another registry with the same name or same URL & credentials
+            already exists
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Create a new registry
+      tags:
+      - registries
+  /registries/{id}:
+    delete:
+      description: |-
+        Remove a registry
+        **Access policy**: restricted
+      operationId: RegistryDelete
+      parameters:
+      - description: Registry identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "404":
+          description: Registry not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Remove a registry
+      tags:
+      - registries
+    get:
+      description: |-
+        Retrieve details about a registry.
+        **Access policy**: restricted
+      operationId: RegistryInspect
+      parameters:
+      - description: Registry identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/portainer.Registry'
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied to access registry
+        "404":
+          description: Registry not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Inspect a registry
+      tags:
+      - registries
+    put:
+      consumes:
+      - application/json
+      description: |-
+        Update a registry
+        **Access policy**: restricted
+      operationId: RegistryUpdate
+      parameters:
+      - description: Registry identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Registry details
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/registries.registryUpdatePayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/portainer.Registry'
+        "400":
+          description: Invalid request
+        "404":
+          description: Registry not found
+        "409":
+          description: Another registry with the same name or same URL & credentials
+            already exists
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Update a registry
+      tags:
+      - registries
+  /registries/{id}/configure:
+    post:
+      consumes:
+      - application/json
+      description: |-
+        Configures a registry.
+        **Access policy**: restricted
+      operationId: RegistryConfigure
+      parameters:
+      - description: Registry identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Registry configuration
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/registries.registryConfigurePayload'
+      produces:
+      - application/json
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: Registry not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Configures a registry
+      tags:
+      - registries
+  /registries/ping:
+    post:
+      consumes:
+      - application/json
+      description: |-
+        Test connection to a registry with provided credentials
+        **Access policy**: authenticated
+      operationId: RegistryPing
+      parameters:
+      - description: Registry credentials to test
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/registries.registryPingPayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/registries.registryPingResponse'
+        "400":
+          description: Invalid request
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Test registry connection
+      tags:
+      - registries
+  /resource_controls:
+    post:
+      consumes:
+      - application/json
+      description: |-
+        Create a new resource control to restrict access to a Docker resource.
+        **Access policy**: administrator
+      operationId: ResourceControlCreate
+      parameters:
+      - description: Resource control details
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/resourcecontrols.resourceControlCreatePayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/portainer.ResourceControl'
+        "400":
+          description: Invalid request
+        "409":
+          description: A resource control is already associated to this resource
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Create a new resource control
+      tags:
+      - resource_controls
+  /resource_controls/{id}:
+    delete:
+      description: |-
+        Remove a resource control.
+        **Access policy**: administrator
+      operationId: ResourceControlDelete
+      parameters:
+      - description: Resource control identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "404":
+          description: Resource control not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Remove a resource control
+      tags:
+      - resource_controls
+    put:
+      consumes:
+      - application/json
+      description: |-
+        Update a resource control
+        **Access policy**: authenticated
+      operationId: ResourceControlUpdate
+      parameters:
+      - description: Resource control identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Resource control details
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/resourcecontrols.resourceControlUpdatePayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/portainer.ResourceControl'
+        "400":
+          description: Invalid request
+        "403":
+          description: Unauthorized
+        "404":
+          description: Resource control not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Update a resource control
+      tags:
+      - resource_controls
+  /restore:
+    post:
+      consumes:
+      - application/json
+      description: |-
+        Triggers a system restore using provided backup file
+        **Access policy**: public (requires the X-Setup-Token header on an uninitialized instance unless --no-setup-token is set)
+      operationId: Restore
+      parameters:
+      - description: Setup token (required when instance is uninitialized and --no-setup-token
+          is not set)
+        in: header
+        name: X-Setup-Token
+        type: string
+      - description: Restore request payload
+        in: body
+        name: restorePayload
+        required: true
+        schema:
+          $ref: '#/definitions/backup.restorePayload'
+      responses:
+        "200":
+          description: Success
+        "400":
+          description: Invalid request
+        "403":
+          description: Access denied - invalid or missing setup token
+        "500":
+          description: Server error
+      summary: Triggers a system restore using provided backup file
+      tags:
+      - backup
+  /roles:
+    get:
+      description: |-
+        List all roles available for use
+        **Access policy**: administrator
+      operationId: RoleList
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            items:
+              $ref: '#/definitions/portainer.Role'
+            type: array
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: List roles
+      tags:
+      - roles
+  /settings:
+    get:
+      description: |-
+        Retrieve Portainer settings.
+        **Access policy**: administrator
+      operationId: SettingsInspect
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/portainer.Settings'
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Retrieve Portainer settings
+      tags:
+      - settings
+    put:
+      consumes:
+      - application/json
+      description: |-
+        Update Portainer settings.
+        **Access policy**: administrator
+      operationId: SettingsUpdate
+      parameters:
+      - description: New settings
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/settings.settingsUpdatePayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/portainer.Settings'
+        "400":
+          description: Invalid request
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Update Portainer settings
+      tags:
+      - settings
+  /settings/public:
+    get:
+      description: |-
+        Retrieve public settings. Returns a small set of settings that are not reserved to administrators only.
+        **Access policy**: public
+      operationId: SettingsPublic
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/settings.publicSettingsResponse'
+        "500":
+          description: Server error
+      summary: Retrieve Portainer public settings
+      tags:
+      - settings
+  /ssl:
+    get:
+      description: |-
+        Retrieve the ssl settings.
+        **Access policy**: administrator
+      operationId: SSLInspect
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/portainer.SSLSettings'
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied to access settings
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Inspect the ssl settings
+      tags:
+      - ssl
+    put:
+      consumes:
+      - application/json
+      description: |-
+        Update the ssl settings.
+        **Access policy**: administrator
+      operationId: SSLUpdate
+      parameters:
+      - description: SSL Settings
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/ssl.sslUpdatePayload'
+      produces:
+      - application/json
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied to access settings
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Update the ssl settings
+      tags:
+      - ssl
+  /stacks:
+    get:
+      description: |-
+        List all stacks based on the current user authorizations.
+        Will return all stacks if using an administrator account otherwise it
+        will only return the list of stacks the user have access to.
+        Limited stacks will not be returned by this endpoint.
+        **Access policy**: authenticated
+      operationId: StackList
+      parameters:
+      - description: 'Filters to process on the stack list. Encoded as JSON (a map[string]string).
+          For example, {''SwarmID'': ''jpofkc0i9uo9wtx1zesuk649w''} will only return
+          stacks that are part of the specified Swarm cluster. Available filters:
+          EndpointID, SwarmID.'
+        in: query
+        name: filters
+        type: string
+      responses:
+        "200":
+          description: Success
+          schema:
+            items:
+              $ref: '#/definitions/portainer.Stack'
+            type: array
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: List stacks
+      tags:
+      - stacks
+  /stacks/{id}:
+    delete:
+      description: |-
+        Remove a stack.
+        **Access policy**: restricted
+      operationId: StackDelete
+      parameters:
+      - description: Stack identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Set to true to delete an external stack. Only external Swarm
+          stacks are supported
+        in: query
+        name: external
+        type: boolean
+      - description: Environment identifier
+        in: query
+        name: endpointId
+        required: true
+        type: integer
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: Not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Remove a stack
+      tags:
+      - stacks
+    get:
+      description: |-
+        Retrieve details about a stack.
+        **Access policy**: restricted
+      operationId: StackInspect
+      parameters:
+      - description: Stack identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/stacks.stackResponse'
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: Stack not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Inspect a stack
+      tags:
+      - stacks
+    put:
+      consumes:
+      - application/json
+      description: |-
+        Update a stack, only for file based stacks.
+        **Access policy**: authenticated
+      operationId: StackUpdate
+      parameters:
+      - description: Stack identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Environment identifier
+        in: query
+        name: endpointId
+        required: true
+        type: integer
+      - description: Stack details
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/stacks.updateSwarmStackPayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/portainer.Stack'
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: Not found
+        "409":
+          description: Conflict
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Update a stack
+      tags:
+      - stacks
+  /stacks/{id}/associate:
+    put:
+      description: '**Access policy**: administrator'
+      operationId: StackAssociate
+      parameters:
+      - description: Stack identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Environment identifier
+        in: query
+        name: endpointId
+        required: true
+        type: integer
+      - description: Swarm identifier
+        in: query
+        name: swarmId
+        required: true
+        type: integer
+      - description: Indicates whether the stack is orphaned
+        in: query
+        name: orphanedRunning
+        required: true
+        type: boolean
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/portainer.Stack'
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: Stack not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Associate an orphaned stack to a new environment(endpoint)
+      tags:
+      - stacks
+  /stacks/{id}/file:
+    get:
+      description: |-
+        Get Stack file content.
+        **Access policy**: restricted
+      operationId: StackFileInspect
+      parameters:
+      - description: Stack identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/stacks.stackFileResponse'
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: Stack not found
+        "409":
+          description: Git settings changed, redeploy required
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Retrieve the content of the Stack file for the specified stack
+      tags:
+      - stacks
+  /stacks/{id}/git:
+    post:
+      consumes:
+      - application/json
+      description: |-
+        Update the Git settings in a stack, e.g., RepositoryReferenceName and AutoUpdate. When SourceID is set, URL/auth/TLS are taken from the referenced Source.
+        **Access policy**: authenticated
+      operationId: StackUpdateGit
+      parameters:
+      - description: Stack identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Stacks created before version 1.18.0 might not have an associated
+          environment(endpoint) identifier. Use this optional parameter to set the
+          environment(endpoint) identifier used by the stack.
+        in: query
+        name: endpointId
+        type: integer
+      - description: Git configs for pull and redeploy a stack
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/stacks.stackGitUpdatePayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/stacks.stackResponse'
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: Not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Update a stack's Git configs
+      tags:
+      - stacks
+  /stacks/{id}/git/redeploy:
+    put:
+      consumes:
+      - application/json
+      description: |-
+        Pull and redeploy a stack via Git
+        **Access policy**: authenticated
+      operationId: StackGitRedeploy
+      parameters:
+      - description: Stack identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Stacks created before version 1.18.0 might not have an associated
+          environment(endpoint) identifier. Use this optional parameter to set the
+          environment(endpoint) identifier used by the stack.
+        in: query
+        name: endpointId
+        type: integer
+      - description: Git configs for pull and redeploy of a stack. **StackName** may
+          only be populated for Kuberenetes stacks, and if specified with a blank
+          string, it will be set to blank
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/stacks.stackGitRedeployPayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/portainer.Stack'
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: Not found
+        "409":
+          description: Conflict
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Redeploy a stack
+      tags:
+      - stacks
+  /stacks/{id}/migrate:
+    post:
+      description: |-
+        Migrate a stack from an environment(endpoint) to another environment(endpoint). It will re-create the stack inside the target environment(endpoint) before removing the original stack.
+        **Access policy**: authenticated
+      operationId: StackMigrate
+      parameters:
+      - description: Stack identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Stacks created before version 1.18.0 might not have an associated
+          environment(endpoint) identifier. Use this optional parameter to set the
+          environment(endpoint) identifier used by the stack.
+        in: query
+        name: endpointId
+        type: integer
+      - description: Stack migration details
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/stacks.stackMigratePayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/portainer.Stack'
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: Stack not found
+        "409":
+          description: A stack with the same name is already running on the target
+            environment(endpoint)
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Migrate a stack to another environment(endpoint)
+      tags:
+      - stacks
+  /stacks/{id}/start:
+    post:
+      description: |-
+        Starts a stopped Stack.
+        **Access policy**: authenticated
+      operationId: StackStart
+      parameters:
+      - description: Stack identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Environment identifier
+        in: query
+        name: endpointId
+        required: true
+        type: integer
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/portainer.Stack'
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: Not found
+        "409":
+          description: Stack is already active, deploying, or in error state
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Starts a stopped Stack
+      tags:
+      - stacks
+  /stacks/{id}/stop:
+    post:
+      description: |-
+        Stop a running Stack.
+        **Access policy**: authenticated
+      operationId: StackStop
+      parameters:
+      - description: Stack identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Environment identifier
+        in: query
+        name: endpointId
+        required: true
+        type: integer
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/portainer.Stack'
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: Not found
+        "409":
+          description: Conflict
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Stop a running Stack
+      tags:
+      - stacks
+  /stacks/create/kubernetes/repository:
+    post:
+      description: |-
+        Deploy a new stack into a Docker environment specified via the environment identifier.
+        **Access policy**: authenticated
+      operationId: StackCreateKubernetesGit
+      parameters:
+      - description: stack config
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/stacks.kubernetesGitDeploymentPayload'
+      - description: Identifier of the environment that will be used to deploy the
+          stack
+        in: query
+        name: endpointId
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/portainer.Stack'
+        "400":
+          description: Invalid request
+        "409":
+          description: Stack name or webhook ID already exists
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Deploy a new kubernetes stack from a git repository
+      tags:
+      - stacks
+  /stacks/create/kubernetes/string:
+    post:
+      description: |-
+        Deploy a new stack into a Docker environment specified via the environment identifier.
+        **Access policy**: authenticated
+      operationId: StackCreateKubernetesFile
+      parameters:
+      - description: stack config
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/stacks.kubernetesStringDeploymentPayload'
+      - description: Identifier of the environment that will be used to deploy the
+          stack
+        in: query
+        name: endpointId
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/portainer.Stack'
+        "400":
+          description: Invalid request
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Deploy a new kubernetes stack from a file
+      tags:
+      - stacks
+  /stacks/create/kubernetes/url:
+    post:
+      description: |-
+        Deploy a new stack into a Docker environment specified via the environment identifier.
+        **Access policy**: authenticated
+      operationId: StackCreateKubernetesUrl
+      parameters:
+      - description: stack config
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/stacks.kubernetesManifestURLDeploymentPayload'
+      - description: Identifier of the environment that will be used to deploy the
+          stack
+        in: query
+        name: endpointId
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/portainer.Stack'
+        "400":
+          description: Invalid request
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Deploy a new kubernetes stack from a url
+      tags:
+      - stacks
+  /stacks/create/standalone/file:
+    post:
+      consumes:
+      - multipart/form-data
+      description: |-
+        Deploy a new stack into a Docker environment specified via the environment identifier.
+        **Access policy**: authenticated
+      operationId: StackCreateDockerStandaloneFile
+      parameters:
+      - description: Name of the stack
+        in: formData
+        name: Name
+        required: true
+        type: string
+      - description: 'Environment variables passed during deployment, represented
+          as a JSON array [{''name'': ''name'', ''value'': ''value''}].'
+        in: formData
+        name: Env
+        type: string
+      - description: Stack file
+        in: formData
+        name: file
+        type: file
+      - description: Identifier of the environment that will be used to deploy the
+          stack
+        in: query
+        name: endpointId
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/portainer.Stack'
+        "400":
+          description: Invalid request
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Deploy a new compose stack from a file
+      tags:
+      - stacks
+  /stacks/create/standalone/repository:
+    post:
+      consumes:
+      - application/json
+      description: |-
+        Deploy a new stack into a Docker environment specified via the environment identifier.
+        **Access policy**: authenticated
+      operationId: StackCreateDockerStandaloneRepository
+      parameters:
+      - description: Identifier of the environment that will be used to deploy the
+          stack
+        in: query
+        name: endpointId
+        required: true
+        type: integer
+      - description: stack config
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/stacks.composeStackFromGitRepositoryPayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/portainer.Stack'
+        "400":
+          description: Invalid request
+        "409":
+          description: Stack name or webhook ID already exists
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Deploy a new compose stack from repository
+      tags:
+      - stacks
+  /stacks/create/standalone/string:
+    post:
+      consumes:
+      - application/json
+      description: |-
+        Deploy a new stack into a Docker environment specified via the environment identifier.
+        **Access policy**: authenticated
+      operationId: StackCreateDockerStandaloneString
+      parameters:
+      - description: stack config
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/stacks.composeStackFromFileContentPayload'
+      - description: Identifier of the environment that will be used to deploy the
+          stack
+        in: query
+        name: endpointId
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/portainer.Stack'
+        "400":
+          description: Invalid request
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Deploy a new compose stack from a text
+      tags:
+      - stacks
+  /stacks/create/swarm/file:
+    post:
+      consumes:
+      - multipart/form-data
+      description: |-
+        Deploy a new stack into a Docker environment specified via the environment identifier.
+        **Access policy**: authenticated
+      operationId: StackCreateDockerSwarmFile
+      parameters:
+      - description: Name of the stack
+        in: formData
+        name: Name
+        type: string
+      - description: Swarm cluster identifier.
+        in: formData
+        name: SwarmID
+        type: string
+      - description: 'Environment variables passed during deployment, represented
+          as a JSON array [{''name'': ''name'', ''value'': ''value''}]. Optional'
+        in: formData
+        name: Env
+        type: string
+      - description: Stack file
+        in: formData
+        name: file
+        type: file
+      - description: Identifier of the environment that will be used to deploy the
+          stack
+        in: query
+        name: endpointId
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/portainer.Stack'
+        "400":
+          description: Invalid request
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Deploy a new swarm stack from a file
+      tags:
+      - stacks
+  /stacks/create/swarm/repository:
+    post:
+      consumes:
+      - application/json
+      description: |-
+        Deploy a new stack into a Docker environment specified via the environment identifier.
+        **Access policy**: authenticated
+      operationId: StackCreateDockerSwarmRepository
+      parameters:
+      - description: Identifier of the environment that will be used to deploy the
+          stack
+        in: query
+        name: endpointId
+        required: true
+        type: integer
+      - description: stack config
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/stacks.swarmStackFromGitRepositoryPayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/portainer.Stack'
+        "400":
+          description: Invalid request
+        "409":
+          description: Stack name or webhook ID already exists
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Deploy a new swarm stack from a git repository
+      tags:
+      - stacks
+  /stacks/create/swarm/string:
+    post:
+      consumes:
+      - application/json
+      description: |-
+        Deploy a new stack into a Docker environment specified via the environment identifier.
+        **Access policy**: authenticated
+      operationId: StackCreateDockerSwarmString
+      parameters:
+      - description: stack config
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/stacks.swarmStackFromFileContentPayload'
+      - description: Identifier of the environment that will be used to deploy the
+          stack
+        in: query
+        name: endpointId
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/portainer.Stack'
+        "400":
+          description: Invalid request
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Deploy a new swarm stack from a text
+      tags:
+      - stacks
+  /stacks/name/{name}:
+    delete:
+      description: |-
+        Remove a stack.
+        **Access policy**: restricted
+      operationId: StackDeleteKubernetesByName
+      parameters:
+      - description: Stack name
+        in: path
+        name: name
+        required: true
+        type: string
+      - description: Set to true to delete an external stack. Only external Swarm
+          stacks are supported
+        in: query
+        name: external
+        type: boolean
+      - description: Environment identifier
+        in: query
+        name: endpointId
+        required: true
+        type: integer
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: Not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Remove Kubernetes stacks by name
+      tags:
+      - stacks
+  /stacks/webhooks/{webhookID}:
+    post:
+      description: '**Access policy**: public'
+      operationId: WebhookInvoke
+      parameters:
+      - description: Stack identifier
+        in: path
+        name: webhookID
+        required: true
+        type: string
+      responses:
+        "200":
+          description: Success
+        "400":
+          description: Invalid request
+        "409":
+          description: Autoupdate for the stack isn't available" or "Stack deployment
+            is already in progress
+        "500":
+          description: Server error
+      summary: Webhook for triggering stack updates from git
+      tags:
+      - stacks
+  /status:
+    get:
+      deprecated: true
+      description: |-
+        Deprecated: use the `/system/status` endpoint instead.
+        Retrieve Portainer status
+        **Access policy**: public
+      operationId: StatusInspect
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/system.status'
+      summary: Check Portainer status
+      tags:
+      - status
+  /system/info:
+    get:
+      description: '**Access policy**: authenticated'
+      operationId: systemInfo
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/system.systemInfoResponse'
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Retrieve system info
+      tags:
+      - system
+  /system/nodes:
+    get:
+      description: '**Access policy**: authenticated'
+      operationId: systemNodesCount
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/system.nodesCountResponse'
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Retrieve the count of nodes
+      tags:
+      - system
+  /system/status:
+    get:
+      description: |-
+        Retrieve Portainer status
+        **Access policy**: public
+      operationId: systemStatus
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/system.status'
+      summary: Check Portainer status
+      tags:
+      - system
+  /system/upgrade:
+    post:
+      description: |-
+        Upgrade Portainer to BE
+        **Access policy**: administrator
+      operationId: systemUpgrade
+      produces:
+      - application/json
+      responses:
+        "204":
+          description: Success
+          schema:
+            $ref: '#/definitions/system.status'
+      summary: Upgrade Portainer to BE
+      tags:
+      - system
+  /system/version:
+    get:
+      description: |-
+        Check if portainer has an update available
+        **Access policy**: authenticated
+      operationId: systemVersion
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/system.versionResponse'
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Check for portainer updates
+      tags:
+      - system
+  /tags:
+    get:
+      description: |-
+        List tags.
+        **Access policy**: authenticated
+      operationId: TagList
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            items:
+              $ref: '#/definitions/portainer.Tag'
+            type: array
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: List tags
+      tags:
+      - tags
+    post:
+      consumes:
+      - application/json
+      description: |-
+        Create a new tag.
+        **Access policy**: administrator
+      operationId: TagCreate
+      parameters:
+      - description: Tag details
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/tags.tagCreatePayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/portainer.Tag'
+        "409":
+          description: This name is already associated to a tag
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Create a new tag
+      tags:
+      - tags
+  /tags/{id}:
+    delete:
+      description: |-
+        Remove a tag.
+        **Access policy**: administrator
+      operationId: TagDelete
+      parameters:
+      - description: Tag identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: Tag not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Remove a tag
+      tags:
+      - tags
+  /team_memberships:
+    get:
+      description: |-
+        List team memberships. Access is only available to administrators and team leaders.
+        **Access policy**: administrator
+      operationId: TeamMembershipList
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            items:
+              $ref: '#/definitions/portainer.TeamMembership'
+            type: array
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: List team memberships
+      tags:
+      - team_memberships
+    post:
+      consumes:
+      - application/json
+      description: |-
+        Create a new team memberships. Access is only available to administrators leaders of the associated team.
+        **Access policy**: administrator
+      operationId: TeamMembershipCreate
+      parameters:
+      - description: Team membership details
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/teammemberships.teamMembershipCreatePayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/portainer.TeamMembership'
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied to manage memberships
+        "409":
+          description: Team membership already registered
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Create a new team membership
+      tags:
+      - team_memberships
+  /team_memberships/{id}:
+    delete:
+      description: |-
+        Remove a team membership. Access is only available to administrators leaders of the associated team.
+        **Access policy**: administrator
+      operationId: TeamMembershipDelete
+      parameters:
+      - description: TeamMembership identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: TeamMembership not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Remove a team membership
+      tags:
+      - team_memberships
+    put:
+      consumes:
+      - application/json
+      description: |-
+        Update a team membership. Access is only available to administrators or leaders of the associated team.
+        **Access policy**: administrator or leaders of the associated team
+      operationId: TeamMembershipUpdate
+      parameters:
+      - description: Team membership identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Team membership details
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/teammemberships.teamMembershipUpdatePayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/portainer.TeamMembership'
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: TeamMembership not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Update a team membership
+      tags:
+      - team_memberships
+  /teams:
+    get:
+      description: |-
+        List teams. For non-administrator users, will only list the teams they are member of.
+        **Access policy**: restricted
+      operationId: TeamList
+      parameters:
+      - description: Only list teams that the user is leader of
+        in: query
+        name: onlyLedTeams
+        type: boolean
+      - description: Identifier of the environment(endpoint) that will be used to
+          filter the authorized teams
+        in: query
+        name: environmentId
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            items:
+              $ref: '#/definitions/portainer.Team'
+            type: array
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: List teams
+      tags:
+      - teams
+    post:
+      consumes:
+      - application/json
+      description: |-
+        Create a new team.
+        **Access policy**: administrator
+      operationId: TeamCreate
+      parameters:
+      - description: details
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/teams.teamCreatePayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/portainer.Team'
+        "400":
+          description: Invalid request
+        "409":
+          description: A team with the same name already exists
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Create a new team
+      tags:
+      - teams
+  /teams/{id}:
+    delete:
+      description: |-
+        Remove a team.
+        **Access policy**: administrator
+      operationId: TeamDelete
+      parameters:
+      - description: Team Id
+        in: path
+        name: id
+        required: true
+        type: integer
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: Team not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Remove a team
+      tags:
+      - teams
+    get:
+      description: |-
+        Retrieve details about a team. Access is only available for administrator and leaders of that team.
+        **Access policy**: administrator
+      operationId: TeamInspect
+      parameters:
+      - description: Team identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/portainer.Team'
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: Team not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Inspect a team
+      tags:
+      - teams
+    put:
+      consumes:
+      - application/json
+      description: |-
+        Update a team.
+        **Access policy**: administrator
+      operationId: TeamUpdate
+      parameters:
+      - description: Team identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Team details
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/teams.teamUpdatePayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/portainer.Team'
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: Team not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Update a team
+      tags:
+      - teams
+  /teams/{id}/memberships:
+    get:
+      description: |-
+        List team memberships. Access is only available to administrators and team leaders.
+        **Access policy**: restricted
+      operationId: TeamMemberships
+      parameters:
+      - description: Team Id
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            items:
+              $ref: '#/definitions/portainer.TeamMembership'
+            type: array
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: List team memberships
+      tags:
+      - team_memberships
+  /templates:
+    get:
+      description: |-
+        List available templates.
+        **Access policy**: authenticated
+      operationId: TemplateList
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/templates.listResponse'
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: List available templates
+      tags:
+      - templates
+  /templates/{id}/file:
+    post:
+      consumes:
+      - application/json
+      description: |-
+        Get a template's file
+        **Access policy**: authenticated
+      operationId: TemplateFile
+      parameters:
+      - description: Template identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/templates.fileResponse'
+        "400":
+          description: Invalid request
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Get a template's file
+      tags:
+      - templates
+  /templates/helm:
+    get:
+      description: '**Access policy**: authenticated'
+      operationId: HelmRepoSearch
+      parameters:
+      - description: Helm repository URL
+        in: query
+        name: repo
+        required: true
+        type: string
+      - description: Helm chart name
+        in: query
+        name: chart
+        type: string
+      - description: If true will use cache to search
+        in: query
+        name: useCache
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            type: string
+        "400":
+          description: Bad request
+        "401":
+          description: Unauthorized
+        "404":
+          description: Not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Search Helm Charts
+      tags:
+      - helm
+  /templates/helm/{command}:
+    get:
+      consumes:
+      - application/json
+      description: '**Access policy**: authenticated'
+      operationId: HelmShow
+      parameters:
+      - description: Helm repository URL
+        in: query
+        name: repo
+        required: true
+        type: string
+      - description: Chart name
+        in: query
+        name: chart
+        required: true
+        type: string
+      - description: Chart version
+        in: query
+        name: version
+        type: string
+      - description: chart/values/readme
+        in: path
+        name: command
+        required: true
+        type: string
+      produces:
+      - text/plain
+      responses:
+        "200":
+          description: Success
+          schema:
+            type: string
+        "401":
+          description: Unauthorized
+        "404":
+          description: Environment(Endpoint) or ServiceAccount not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Show Helm Chart Information
+      tags:
+      - helm
+  /upload/tls/{certificate}:
+    post:
+      consumes:
+      - multipart/form-data
+      description: |-
+        Use this environment(endpoint) to upload TLS files.
+        **Access policy**: administrator
+      operationId: UploadTLS
+      parameters:
+      - description: TLS file type. Valid values are 'ca', 'cert' or 'key'.
+        enum:
+        - ca
+        - cert
+        - key
+        in: path
+        name: certificate
+        required: true
+        type: string
+      - description: Folder where the TLS file will be stored. Will be created if
+          not existing
+        in: formData
+        name: folder
+        required: true
+        type: string
+      - description: The file to upload
+        in: formData
+        name: file
+        required: true
+        type: file
+      produces:
+      - application/json
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Upload TLS files
+      tags:
+      - upload
+  /users:
+    get:
+      description: |-
+        List Portainer users.
+        Non-administrator users will only be able to list other non-administrator user accounts.
+        User passwords are filtered out, and should never be accessible.
+        **Access policy**: restricted
+      operationId: UserList
+      parameters:
+      - description: Identifier of the environment(endpoint) that will be used to
+          filter the authorized users
+        in: query
+        name: environmentId
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            items:
+              $ref: '#/definitions/portainer.User'
+            type: array
+        "400":
+          description: Invalid request
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: List users
+      tags:
+      - users
+    post:
+      consumes:
+      - application/json
+      description: |-
+        Create a new Portainer user.
+        Only administrators can create users.
+        **Access policy**: restricted
+      operationId: UserCreate
+      parameters:
+      - description: User details
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/users.userCreatePayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/portainer.User'
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "409":
+          description: User already exists
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Create a new user
+      tags:
+      - users
+  /users/{id}:
+    delete:
+      description: |-
+        Remove a user.
+        **Access policy**: administrator
+      operationId: UserDelete
+      parameters:
+      - description: User identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: User not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Remove a user
+      tags:
+      - users
+    get:
+      description: |-
+        Retrieve details about a user.
+        User passwords are filtered out, and should never be accessible.
+        **Access policy**: authenticated
+      operationId: UserInspect
+      parameters:
+      - description: User identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/portainer.User'
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: User not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Inspect a user
+      tags:
+      - users
+    put:
+      consumes:
+      - application/json
+      description: |-
+        Update user details. A regular user account can only update his details.
+        A regular user account cannot change their username or role.
+        **Access policy**: authenticated
+      operationId: UserUpdate
+      parameters:
+      - description: User identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: User details
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/users.userUpdatePayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/portainer.User'
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: User not found
+        "409":
+          description: Username already exist
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Update a user
+      tags:
+      - users
+  /users/{id}/effective-access:
+    get:
+      description: |-
+        Returns the resolved role for each environment the user can access,
+        following the policy precedence used by the access viewer
+        (user-endpoint, user-group, team-endpoint, team-group).
+        Environments where the user has no role are omitted.
+        **Access policy**: restricted
+      operationId: UserEffectiveAccessInspect
+      parameters:
+      - description: User identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            items:
+              $ref: '#/definitions/users.EffectiveAccessEntry'
+            type: array
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: User not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+        jwt: []
+      summary: Inspect a user's effective access on every environment
+      tags:
+      - users
+  /users/{id}/helm/repositories:
+    get:
+      description: |-
+        Inspect a user helm repositories.
+        **Access policy**: authenticated
+      operationId: HelmUserRepositoriesList
+      parameters:
+      - description: User identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/users.helmUserRepositoryResponse'
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: List a users helm repositories
+      tags:
+      - helm
+    post:
+      consumes:
+      - application/json
+      description: |-
+        Create a user helm repository.
+        **Access policy**: authenticated
+      operationId: HelmUserRepositoryCreate
+      parameters:
+      - description: User identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Helm Repository
+        in: body
+        name: payload
+        required: true
+        schema:
+          $ref: '#/definitions/users.addHelmRepoUrlPayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/portainer.HelmUserRepository'
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Create a user helm repository
+      tags:
+      - helm
+  /users/{id}/helm/repositories/{repositoryID}:
+    delete:
+      description: '**Access policy**: authenticated'
+      operationId: HelmUserRepositoryDelete
+      parameters:
+      - description: User identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Repository identifier
+        in: path
+        name: repositoryID
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Delete a users helm repositoryies
+      tags:
+      - helm
+  /users/{id}/memberships:
+    get:
+      description: |-
+        Inspect a user memberships.
+        **Access policy**: restricted
+      operationId: UserMembershipsInspect
+      parameters:
+      - description: User identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/portainer.TeamMembership'
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Inspect a user memberships
+      tags:
+      - users
+  /users/{id}/passwd:
+    put:
+      consumes:
+      - application/json
+      description: |-
+        Update password for the specified user.
+        **Access policy**: authenticated
+      operationId: UserUpdatePassword
+      parameters:
+      - description: identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: details
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/users.userUpdatePasswordPayload'
+      produces:
+      - application/json
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: User not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Update password for a user
+      tags:
+      - users
+  /users/{id}/tokens:
+    get:
+      description: |-
+        Gets all API keys for a user.
+        Only the calling user or admin can retrieve api-keys.
+        **Access policy**: authenticated
+      operationId: UserGetAPIKeys
+      parameters:
+      - description: User identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            items:
+              $ref: '#/definitions/portainer.APIKey'
+            type: array
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: User not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Get all API keys for a user
+      tags:
+      - users
+    post:
+      consumes:
+      - application/json
+      description: |-
+        Generates an API key for a user.
+        Only the calling user can generate a token for themselves.
+        Password is required only for internal authentication.
+        **Access policy**: restricted
+      operationId: UserGenerateAPIKey
+      parameters:
+      - description: User identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: details
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/users.userAccessTokenCreatePayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/users.accessTokenResponse'
+        "400":
+          description: Invalid request
+        "401":
+          description: Unauthorized
+        "403":
+          description: Permission denied
+        "404":
+          description: User not found
+        "500":
+          description: Server error
+      security:
+      - jwt: []
+      summary: Generate an API key for a user
+      tags:
+      - users
+  /users/{id}/tokens/{keyID}:
+    delete:
+      description: |-
+        Remove an api-key associated to a user..
+        Only the calling user or admin can remove api-key.
+        **Access policy**: authenticated
+      operationId: UserRemoveAPIKey
+      parameters:
+      - description: User identifier
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Api Key identifier
+        in: path
+        name: keyID
+        required: true
+        type: integer
+      responses:
+        "204":
+          description: Success
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: Not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Remove an api-key associated to a user
+      tags:
+      - users
+  /users/admin/check:
+    get:
+      description: |-
+        Check if an administrator account exists in the database.
+        **Access policy**: public
+      operationId: UserAdminCheck
+      responses:
+        "204":
+          description: Success
+        "404":
+          description: User not found
+      summary: Check administrator account existence
+      tags:
+      - users
+  /users/admin/init:
+    post:
+      consumes:
+      - application/json
+      description: |-
+        Initialize the 'admin' user account.
+        **Access policy**: public (requires the X-Setup-Token header on an uninitialized instance unless --no-setup-token is set)
+      operationId: UserAdminInit
+      parameters:
+      - description: Setup token (required when instance is uninitialized and --no-setup-token
+          is not set)
+        in: header
+        name: X-Setup-Token
+        type: string
+      - description: User details
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/users.adminInitPayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/portainer.User'
+        "400":
+          description: Invalid request
+        "403":
+          description: Access denied - invalid or missing setup token
+        "409":
+          description: Admin user already initialized
+        "500":
+          description: Server error
+      summary: Initialize administrator account
+      tags:
+      - users
+  /users/me:
+    get:
+      description: |-
+        Retrieve details about the current  user.
+        User passwords are filtered out, and should never be accessible.
+        **Access policy**: authenticated
+      operationId: CurrentUserInspect
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            $ref: '#/definitions/portainer.User'
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: User not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Inspect the current user user
+      tags:
+      - users
+  /webhooks:
+    get:
+      consumes:
+      - application/json
+      description: '**Access policy**: authenticated'
+      parameters:
+      - description: Filters (json-string)
+        example: '{"EndpointID":1,"ResourceID":"abc12345-abcd-2345-ab12-58005b4a0260"}'
+        in: query
+        name: filters
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            items:
+              $ref: '#/definitions/portainer.Webhook'
+            type: array
+        "400":
+          description: Bad Request
+        "500":
+          description: Internal Server Error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: List webhooks
+      tags:
+      - webhooks
+    post:
+      consumes:
+      - application/json
+      description: '**Access policy**: authenticated'
+      parameters:
+      - description: Webhook data
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/webhooks.webhookCreatePayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/portainer.Webhook'
+        "400":
+          description: Invalid request
+        "409":
+          description: A webhook for this resource already exists
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Create a webhook
+      tags:
+      - webhooks
+  /webhooks/{id}:
+    delete:
+      description: '**Access policy**: authenticated'
+      parameters:
+      - description: Webhook id
+        in: path
+        name: id
+        required: true
+        type: integer
+      responses:
+        "202":
+          description: Webhook deleted
+        "400":
+          description: Bad Request
+        "500":
+          description: Internal Server Error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Delete a webhook
+      tags:
+      - webhooks
+    post:
+      description: |-
+        Acts on a passed in token UUID to restart the docker service
+        **Access policy**: public
+      parameters:
+      - description: Webhook token
+        in: path
+        name: id
+        required: true
+        type: string
+      responses:
+        "202":
+          description: Webhook executed
+        "400":
+          description: Bad Request
+        "500":
+          description: Internal Server Error
+      summary: Execute a webhook
+      tags:
+      - webhooks
+    put:
+      consumes:
+      - application/json
+      description: '**Access policy**: authenticated'
+      parameters:
+      - description: Webhook id
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: Webhook data
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/webhooks.webhookUpdatePayload'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/portainer.Webhook'
+        "400":
+          description: Bad Request
+        "409":
+          description: Conflict
+        "500":
+          description: Internal Server Error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Update a webhook
+      tags:
+      - webhooks
+  /websocket/attach:
+    get:
+      consumes:
+      - application/json
+      description: |-
+        If the nodeName query parameter is present, the request will be proxied to the underlying agent environment(endpoint).
+        If the nodeName query parameter is not specified, the request will be upgraded to the websocket protocol and
+        an AttachStart operation HTTP request will be created and hijacked.
+        **Access policy**: authenticated
+      parameters:
+      - description: environment(endpoint) ID of the environment(endpoint) where the
+          resource is located
+        in: query
+        name: endpointId
+        required: true
+        type: integer
+      - description: node name
+        in: query
+        name: nodeName
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+        "400":
+          description: Bad Request
+        "403":
+          description: Forbidden
+        "404":
+          description: Not Found
+        "500":
+          description: Internal Server Error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Attach a websocket
+      tags:
+      - websocket
+  /websocket/exec:
+    get:
+      consumes:
+      - application/json
+      description: |-
+        If the nodeName query parameter is present, the request will be proxied to the underlying agent environment(endpoint).
+        If the nodeName query parameter is not specified, the request will be upgraded to the websocket protocol and
+        an ExecStart operation HTTP request will be created and hijacked.
+      parameters:
+      - description: environment(endpoint) ID of the environment(endpoint) where the
+          resource is located
+        in: query
+        name: endpointId
+        required: true
+        type: integer
+      - description: node name
+        in: query
+        name: nodeName
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+        "400":
+          description: Bad Request
+        "409":
+          description: Conflict
+        "500":
+          description: Internal Server Error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Execute a websocket
+      tags:
+      - websocket
+  /websocket/kubernetes-shell:
+    get:
+      consumes:
+      - application/json
+      description: |-
+        The request will be upgraded to the websocket protocol. The request will proxy input from the client to the pod via long-lived websocket connection.
+        **Access policy**: authenticated
+      parameters:
+      - description: environment(endpoint) ID of the environment(endpoint) where the
+          resource is located
+        in: query
+        name: endpointId
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+        "400":
+          description: Invalid request
+        "403":
+          description: Permission denied
+        "404":
+          description: Environment not found
+        "500":
+          description: Server error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Execute a websocket on kubectl shell pod
+      tags:
+      - websocket
+  /websocket/pod:
+    get:
+      consumes:
+      - application/json
+      description: |-
+        The request will be upgraded to the websocket protocol.
+        **Access policy**: authenticated
+      parameters:
+      - description: environment(endpoint) ID of the environment(endpoint) where the
+          resource is located
+        in: query
+        name: endpointId
+        required: true
+        type: integer
+      - description: namespace where the container is located
+        in: query
+        name: namespace
+        required: true
+        type: string
+      - description: name of the pod containing the container
+        in: query
+        name: podName
+        required: true
+        type: string
+      - description: name of the container
+        in: query
+        name: containerName
+        required: true
+        type: string
+      - description: command to execute in the container
+        in: query
+        name: command
+        required: true
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+        "400":
+          description: Bad Request
+        "403":
+          description: Forbidden
+        "404":
+          description: Not Found
+        "500":
+          description: Internal Server Error
+      security:
+      - ApiKeyAuth: []
+      - jwt: []
+      summary: Execute a websocket on pod
+      tags:
+      - websocket
+schemes:
+- http
+- https
+securityDefinitions:
+  ApiKeyAuth:
+    in: header
+    name: X-API-KEY
+    type: apiKey
+  jwt:
+    in: header
+    name: Authorization
+    type: apiKey
+swagger: "2.0"
+tags:
+- description: Authenticate against Portainer HTTP API
+  name: auth
+  x-displayName: Authentication
+- description: Manage backups
+  name: backup
+  x-displayName: Backup
+- description: Manage Custom Templates
+  name: custom_templates
+  x-displayName: Custom templates
+- description: Manage Docker resources
+  name: docker
+  x-displayName: Docker resources
+- description: Manage Edge related settings
+  name: edge
+  x-displayName: Edge settings
+- description: Manage an Edge agent
+  name: edge_agent
+  x-displayName: Edge agent
+- description: Manage Edge Groups
+  name: edge_groups
+  x-displayName: Edge groups
+- description: Manage Edge Jobs
+  name: edge_jobs
+  x-displayName: Edge jobs
+- description: Manage Edge Stacks
+  name: edge_stacks
+  x-displayName: Edge stacks
+- description: Manage Edge Templates
+  name: edge_templates
+  x-displayName: Edge templates
+- description: Manage environment groups
+  name: endpoint_groups
+  x-displayName: Environment groups
+- description: Manage environments
+  name: endpoints
+  x-displayName: Environments
+- description: Operate git repository
+  name: gitops
+  x-displayName: GitOps
+- description: Manage Helm charts
+  name: helm
+  x-displayName: Helm charts
+- description: Manage Kubernetes cluster
+  name: kubernetes
+  x-displayName: Kubernetes
+- description: Manage LDAP settings
+  name: ldap
+  x-displayName: LDAP
+- description: Fetch the message of the day
+  name: motd
+  x-displayName: Message of the day
+- description: Manage Docker registries
+  name: registries
+  x-displayName: Registries
+- description: Manage access control on Docker resources
+  name: resource_controls
+  x-displayName: Resource controls
+- description: Manage roles
+  name: roles
+  x-displayName: Roles
+- description: Manage Portainer settings
+  name: settings
+  x-displayName: Portainer settings
+- description: Manage ssl settings
+  name: ssl
+  x-displayName: SSL
+- description: Manage stacks
+  name: stacks
+  x-displayName: Stacks
+- description: Information about the Portainer instance
+  name: status
+  x-displayName: Portainer status
+- description: Manage Portainer system
+  name: system
+  x-displayName: Portainer system
+- description: Manage tags
+  name: tags
+  x-displayName: Tags
+- description: Manage team memberships
+  name: team_memberships
+  x-displayName: Team memberships
+- description: Manage teams
+  name: teams
+  x-displayName: Teams
+- description: Manage App Templates
+  name: templates
+  x-displayName: App templates
+- description: Upload files
+  name: upload
+  x-displayName: Upload files
+- description: Manage users
+  name: users
+  x-displayName: Users
+- description: Manage webhooks
+  name: webhooks
+  x-displayName: Webhooks
+- description: Create exec sessions using websockets
+  name: websocket
+  x-displayName: Websocket
+x-tagGroups:
+- name: Access Control
+  tags:
+  - auth
+  - roles
+  - team_memberships
+  - teams
+  - users
+- name: Administration
+  tags:
+  - backup
+  - ldap
+  - motd
+  - settings
+  - status
+  - system
+  - ssl
+  - upload
+- name: Docker
+  tags:
+  - templates
+  - custom_templates
+  - docker
+  - registries
+  - resource_controls
+  - stacks
+  - webhooks
+  - websocket
+- name: Edge Compute
+  tags:
+  - edge_agent
+  - edge_groups
+  - edge_jobs
+  - edge
+  - edge_stacks
+- name: Environment Management
+  tags:
+  - endpoint_groups
+  - endpoints
+  - tags
+- name: GitOps
+  tags:
+  - gitops
+- name: Kubernetes
+  tags:
+  - helm
+  - kubernetes
diff --git a/api/edge/edge.go b/api/edge/edge.go
new file mode 100644
index 0000000..a73d582
--- /dev/null
+++ b/api/edge/edge.go
@@ -0,0 +1,114 @@
+package edge
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/filesystem"
+)
+
+type (
+
+	// StackPayload represents the payload sent to the agent
+	StackPayload struct {
+		// ID of the stack
+		ID int
+		// Name of the stack
+		Name string
+
+		// Content of the stack file (for compatibility to agent version less than 2.19.0)
+		StackFileContent string
+
+		// Content of stack folder
+		DirEntries []filesystem.DirEntry
+		// Name of the stack entry file
+		EntryFileName string
+		// Namespace to use for kubernetes stack. Keep empty to use the manifest namespace.
+		Namespace string
+		// Version of the stack file
+		Version int
+		// RollbackTo specifies the stack file version to rollback to (only support to rollback to the last version currently)
+		RollbackTo *int
+
+		// RegistryCredentials holds the credentials for a Docker registry.
+		// Used only for EE
+		RegistryCredentials []RegistryCredentials
+		// PrePullImage is a flag indicating if the agent must pull the image before deploying the stack.
+		// Used only for EE
+		PrePullImage bool
+		// RePullImage is a flag indicating if the agent must pull the image if it is already present on the node.
+		// Used only for EE
+		RePullImage bool
+		// RetryDeploy is a flag indicating if the agent must retry to deploy the stack if it fails.
+		// Used only for EE
+		RetryDeploy bool
+		// RetryPeriod specifies the duration, in seconds, for which the agent should continue attempting to deploy the stack after a failure
+		// Used only for EE
+		RetryPeriod int
+		// EdgeUpdateID is the ID of the edge update related to this stack.
+		// Used only for EE
+		EdgeUpdateID int
+
+		// Is relative path supported
+		SupportRelativePath bool
+		// AlwaysCloneGitRepoForRelativePath is a flag indicating if the agent must always clone the git repository for relative path.
+		// This field is only valid when SupportRelativePath is true.
+		// Used only for EE
+		AlwaysCloneGitRepoForRelativePath bool
+
+		// Whether the edge stack supports per device configs
+		SupportPerDeviceConfigs bool
+
+		// Mount point for relative path
+		FilesystemPath string
+		// Used only for EE
+		// EnvVars is a list of environment variables to inject into the stack
+		EnvVars []portainer.Pair
+
+		// ForceUpdate is a flag indicating if the agent must force the update of the stack.
+		// Used only for EE
+		ForceUpdate bool
+
+		DeployerOptionsPayload DeployerOptionsPayload
+
+		// Used only for EE async edge agent
+		// ReadyRePullImage is a flag to indicate whether the auto update is trigger to re-pull image
+		// Deprecated(2.36): use DeployerOptionsPayload.ForceRecreate instead
+		ReadyRePullImage bool
+
+		// CreatedBy is the username that created this stack
+		// Used for adding labels to Kubernetes manifests
+		CreatedBy string
+		// CreatedByUserId is the user ID that created this stack
+		// Used for adding labels to Kubernetes manifests
+		CreatedByUserId string
+
+		// HelmConfig represents the Helm configuration for an edge stack
+		HelmConfig portainer.HelmConfig
+	}
+
+	DeployerOptionsPayload struct {
+		// Prune is a flag indicating if the agent must prune the containers or not when creating/updating an edge stack
+		// This flag drives `docker compose up --remove-orphans` and `docker stack up --prune` options
+		// Used only for EE
+		Prune bool
+		// RemoveVolumes is a flag indicating if the agent must remove the named volumes declared
+		// in the compose file and anonymouse volumes attached to containers
+		// This flag drives `docker compose down --volumes` option
+		// Used only for EE
+		RemoveVolumes bool
+
+		// ForceRecreate is a flag indicating if the agent must force the redeployment of the stack.
+		// This field is only used when the Force Redeployment is triggered.
+		// Once the stack is redeployed, this field will be reset to false.
+		// For standard edge agent, this field is used in agent side
+		// For async edge agent, this field is used in both agent side and server side.
+		// This flag drives `docker compose up --force-recreate` option
+		ForceRecreate bool
+	}
+
+	// RegistryCredentials holds the credentials for a Docker registry.
+	RegistryCredentials struct {
+		ServerURL string
+		Username  string
+		Secret    string
+	}
+)
diff --git a/api/exec/common.go b/api/exec/common.go
new file mode 100644
index 0000000..593b204
--- /dev/null
+++ b/api/exec/common.go
@@ -0,0 +1,79 @@
+package exec
+
+import (
+	"fmt"
+	"regexp"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/proxy"
+	"github.com/portainer/portainer/api/http/proxy/factory"
+	"github.com/portainer/portainer/api/internal/registryutils"
+
+	"github.com/docker/cli/cli/config/types"
+	"github.com/rs/zerolog/log"
+)
+
+var stackNameNormalizeRegex = regexp.MustCompile("[^-_a-z0-9]+")
+
+func normalizeStackName(name string) string {
+	return stackNameNormalizeRegex.ReplaceAllString(strings.ToLower(name), "")
+}
+
+// fetchEndpointProxy returns the Docker host URL for the given endpoint.
+// For remote endpoints it creates a local proxy that handles TLS termination and
+// Portainer agent header injection; for local unix/npipe sockets no proxy is needed.
+func fetchEndpointProxy(proxyManager *proxy.Manager, endpoint *portainer.Endpoint) (string, *factory.ProxyServer, error) {
+	if strings.HasPrefix(endpoint.URL, "unix://") || strings.HasPrefix(endpoint.URL, "npipe://") {
+		return "", nil, nil
+	}
+
+	proxy, err := proxyManager.CreateAgentProxyServer(endpoint)
+	if err != nil {
+		return "", nil, err
+	}
+
+	return fmt.Sprintf("tcp://127.0.0.1:%d", proxy.Port), proxy, nil
+}
+
+// portainerRegistriesToAuthConfigs converts registries to Docker auth configs.
+// Callers must ensure ECR tokens are valid before calling this function (e.g. via
+// registryutils.RefreshAndPersistECRTokens with a real DataStoreTx). This function
+// intentionally performs no DB writes to avoid write-lock contention when called inside
+// an active BoltDB write transaction.
+func portainerRegistriesToAuthConfigs(registries []portainer.Registry) []types.AuthConfig {
+	var authConfigs []types.AuthConfig
+
+	for _, r := range registries {
+		ac := types.AuthConfig{
+			Username:      r.Username,
+			Password:      r.Password,
+			ServerAddress: r.URL,
+		}
+
+		if r.Authentication {
+			var err error
+
+			ac.Username, ac.Password, err = getEffectiveRegUsernamePassword(&r)
+			if err != nil {
+				continue
+			}
+		}
+
+		authConfigs = append(authConfigs, ac)
+	}
+
+	return authConfigs
+}
+
+func getEffectiveRegUsernamePassword(registry *portainer.Registry) (string, string, error) {
+	username, password, err := registryutils.GetRegEffectiveCredential(registry)
+	if err != nil {
+		log.Warn().
+			Err(err).
+			Str("RegistryName", registry.Name).
+			Msg("Failed to get effective credential. Skip logging with this registry.")
+	}
+
+	return username, password, err
+}
diff --git a/api/exec/compose_stack.go b/api/exec/compose_stack.go
new file mode 100644
index 0000000..4b133b3
--- /dev/null
+++ b/api/exec/compose_stack.go
@@ -0,0 +1,215 @@
+package exec
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"os"
+	"path"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/proxy"
+	"github.com/portainer/portainer/api/logs"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+	"github.com/portainer/portainer/pkg/libstack"
+)
+
+// ComposeStackManager is a wrapper for docker-compose binary
+type ComposeStackManager struct {
+	deployer     libstack.Deployer
+	proxyManager *proxy.Manager
+}
+
+// NewComposeStackManager returns a Compose stack manager
+func NewComposeStackManager(deployer libstack.Deployer, proxyManager *proxy.Manager) *ComposeStackManager {
+	return &ComposeStackManager{
+		deployer:     deployer,
+		proxyManager: proxyManager,
+	}
+}
+
+// ComposeSyntaxMaxVersion returns the maximum supported version of the docker compose syntax
+func (manager *ComposeStackManager) ComposeSyntaxMaxVersion() string {
+	return portainer.ComposeSyntaxMaxVersion
+}
+
+// Up builds, (re)creates and starts containers in the background. Wraps `docker-compose up -d` command
+func (manager *ComposeStackManager) Up(ctx context.Context, stack *portainer.Stack, endpoint *portainer.Endpoint, options portainer.ComposeUpOptions) error {
+	url, proxy, err := fetchEndpointProxy(manager.proxyManager, endpoint)
+	if err != nil {
+		return fmt.Errorf("failed to fetch environment proxy: %w", err)
+	}
+
+	if proxy != nil {
+		defer proxy.Close()
+	}
+
+	envFilePath, err := createEnvFile(stack)
+	if err != nil {
+		return fmt.Errorf("failed to create env file: %w", err)
+	}
+
+	filePaths := stackutils.GetStackFilePaths(stack, true)
+	if err = manager.deployer.Deploy(ctx, filePaths, libstack.DeployOptions{
+		Options: libstack.Options{
+			WorkingDir:  stack.ProjectPath,
+			EnvFilePath: envFilePath,
+			Host:        url,
+			ProjectName: stack.Name,
+			Registries:  portainerRegistriesToAuthConfigs(options.Registries),
+		},
+		ForceRecreate:        options.ForceRecreate,
+		AbortOnContainerExit: options.AbortOnContainerExit,
+		RemoveOrphans:        options.Prune,
+	}); err != nil {
+		return fmt.Errorf("failed to deploy a stack: %w", err)
+	}
+	return nil
+}
+
+// Run runs a one-off command on a service. Wraps `docker-compose run` command
+func (manager *ComposeStackManager) Run(ctx context.Context, stack *portainer.Stack, endpoint *portainer.Endpoint, serviceName string, options portainer.ComposeRunOptions) error {
+	url, proxy, err := fetchEndpointProxy(manager.proxyManager, endpoint)
+	if err != nil {
+		return fmt.Errorf("failed to fetch environment proxy: %w", err)
+	}
+
+	if proxy != nil {
+		defer proxy.Close()
+	}
+
+	envFilePath, err := createEnvFile(stack)
+	if err != nil {
+		return fmt.Errorf("failed to create env file: %w", err)
+	}
+
+	filePaths := stackutils.GetStackFilePaths(stack, true)
+	if err = manager.deployer.Run(ctx, filePaths, serviceName, libstack.RunOptions{
+		Options: libstack.Options{
+			WorkingDir:  stack.ProjectPath,
+			EnvFilePath: envFilePath,
+			Host:        url,
+			ProjectName: stack.Name,
+			Registries:  portainerRegistriesToAuthConfigs(options.Registries),
+		},
+		Remove:   options.Remove,
+		Args:     options.Args,
+		Detached: options.Detached,
+	}); err != nil {
+		return fmt.Errorf("failed to deploy a stack: %w", err)
+	}
+	return nil
+}
+
+// Down stops and removes containers, networks, images, and volumes
+func (manager *ComposeStackManager) Down(ctx context.Context, stack *portainer.Stack, endpoint *portainer.Endpoint) error {
+	url, proxy, err := fetchEndpointProxy(manager.proxyManager, endpoint)
+	if err != nil {
+		return fmt.Errorf("failed to fetch environment proxy: %w", err)
+	} else if proxy != nil {
+		defer proxy.Close()
+	}
+
+	if err = manager.deployer.Remove(ctx, stack.Name, nil, libstack.RemoveOptions{
+		Options: libstack.Options{
+			WorkingDir: "",
+			Host:       url,
+		},
+	}); err != nil {
+		return fmt.Errorf("failed to remove a stack: %w", err)
+	}
+	return nil
+}
+
+// Pull an image associated with a service defined in a docker-compose.yml or docker-stack.yml file,
+// but does not start containers based on those images.
+func (manager *ComposeStackManager) Pull(ctx context.Context, stack *portainer.Stack, endpoint *portainer.Endpoint, options portainer.ComposeOptions) error {
+	url, proxy, err := fetchEndpointProxy(manager.proxyManager, endpoint)
+	if err != nil {
+		return fmt.Errorf("failed to fetch environment proxy: %w", err)
+	} else if proxy != nil {
+		defer proxy.Close()
+	}
+
+	envFilePath, err := createEnvFile(stack)
+	if err != nil {
+		return fmt.Errorf("failed to create env file: %w", err)
+	}
+
+	filePaths := stackutils.GetStackFilePaths(stack, true)
+	if err = manager.deployer.Pull(ctx, filePaths, libstack.Options{
+		WorkingDir:  stack.ProjectPath,
+		EnvFilePath: envFilePath,
+		Host:        url,
+		ProjectName: stack.Name,
+		Registries:  portainerRegistriesToAuthConfigs(options.Registries),
+	}); err != nil {
+		return fmt.Errorf("failed to pull images of the stack: %w", err)
+	}
+	return nil
+}
+
+// NormalizeStackName returns a new stack name with unsupported characters replaced
+func (manager *ComposeStackManager) NormalizeStackName(name string) string {
+	return normalizeStackName(name)
+}
+
+// createEnvFile creates a file that would hold both "in-place" and default environment variables.
+// It will return the name of the file if the stack has "in-place" env vars, otherwise empty string.
+func createEnvFile(stack *portainer.Stack) (string, error) {
+	if len(stack.Env) == 0 {
+		return "", nil
+	}
+
+	envFilePath := path.Join(stack.ProjectPath, "stack.env")
+	envfile, err := os.OpenFile(envFilePath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o600)
+	if err != nil {
+		return "", err
+	}
+	defer logs.CloseAndLogErr(envfile)
+
+	// Copy from default .env file
+	defaultEnvPath := path.Join(stack.ProjectPath, path.Dir(stack.EntryPoint), ".env")
+	if err := copyDefaultEnvFile(envfile, defaultEnvPath); err != nil {
+		return "", err
+	}
+
+	// Copy from stack env vars
+	if err := copyConfigEnvVars(envfile, stack.Env); err != nil {
+		return "", err
+	}
+
+	return envFilePath, nil
+}
+
+// copyDefaultEnvFile copies the default .env file if it exists to the provided writer
+func copyDefaultEnvFile(w io.Writer, defaultEnvFilePath string) error {
+	defaultEnvFile, err := os.Open(defaultEnvFilePath)
+	if err != nil {
+		// If cannot open a default file, then don't need to copy it.
+		// We could as well stat it and check if it exists, but this is more efficient.
+		return nil
+	}
+
+	defer logs.CloseAndLogErr(defaultEnvFile)
+
+	if _, err = io.Copy(w, defaultEnvFile); err == nil {
+		if _, err = fmt.Fprintf(w, "\n"); err != nil {
+			return fmt.Errorf("failed to copy default env file: %w", err)
+		}
+	}
+
+	return nil
+	// If couldn't copy the .env file, then ignore the error and try to continue
+}
+
+// copyConfigEnvVars write the environment variables from stack configuration to the writer
+func copyConfigEnvVars(w io.Writer, envs []portainer.Pair) error {
+	for _, v := range envs {
+		if _, err := fmt.Fprintf(w, "%s=%s\n", v.Name, v.Value); err != nil {
+			return fmt.Errorf("failed to copy config env vars: %w", err)
+		}
+	}
+
+	return nil
+}
diff --git a/api/exec/compose_stack_integration_test.go b/api/exec/compose_stack_integration_test.go
new file mode 100644
index 0000000..9d52edf
--- /dev/null
+++ b/api/exec/compose_stack_integration_test.go
@@ -0,0 +1,79 @@
+package exec
+
+import (
+	"os"
+	"os/exec"
+	"strings"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/filesystem"
+	"github.com/portainer/portainer/pkg/libstack/compose"
+	"github.com/portainer/portainer/pkg/testhelpers"
+	"github.com/stretchr/testify/require"
+
+	"github.com/rs/zerolog/log"
+)
+
+const composeFile = `version: "3.9"
+services:
+  busybox:
+    image: "alpine:latest"
+    container_name: "compose_wrapper_test"`
+const composedContainerName = "compose_wrapper_test"
+
+func setup(t *testing.T) (*portainer.Stack, *portainer.Endpoint) {
+	dir := t.TempDir()
+	composeFileName := "compose_wrapper_test.yml"
+	f, err := os.Create(filesystem.JoinPaths(dir, composeFileName))
+	require.NoError(t, err)
+
+	_, err = f.WriteString(composeFile)
+	require.NoError(t, err)
+
+	stack := &portainer.Stack{
+		ProjectPath: dir,
+		EntryPoint:  composeFileName,
+		Name:        "project-name",
+	}
+
+	return stack, &portainer.Endpoint{URL: "unix://"}
+}
+
+func Test_UpAndDown(t *testing.T) {
+	t.Parallel()
+	testhelpers.IntegrationTest(t)
+
+	stack, endpoint := setup(t)
+
+	deployer := compose.NewComposeDeployer()
+
+	w := NewComposeStackManager(deployer, nil)
+
+	if err := w.Up(t.Context(), stack, endpoint, portainer.ComposeUpOptions{}); err != nil {
+		t.Fatalf("Error calling docker-compose up: %s", err)
+	}
+
+	if !containerExists(composedContainerName) {
+		t.Fatal("container should exist")
+	}
+
+	if err := w.Down(t.Context(), stack, endpoint); err != nil {
+		t.Fatalf("Error calling docker-compose down: %s", err)
+	}
+
+	if containerExists(composedContainerName) {
+		t.Fatal("container should be removed")
+	}
+}
+
+func containerExists(containerName string) bool {
+	cmd := exec.Command("docker", "ps", "-a", "-f", "name="+containerName)
+
+	out, err := cmd.Output()
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed to list containers")
+	}
+
+	return strings.Contains(string(out), containerName)
+}
diff --git a/api/exec/compose_stack_test.go b/api/exec/compose_stack_test.go
new file mode 100644
index 0000000..f277b77
--- /dev/null
+++ b/api/exec/compose_stack_test.go
@@ -0,0 +1,169 @@
+package exec
+
+import (
+	"io"
+	"os"
+	"testing"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/filesystem"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_createEnvFile(t *testing.T) {
+	t.Parallel()
+	dir := t.TempDir()
+
+	tests := []struct {
+		name         string
+		stack        *portainer.Stack
+		expected     string
+		expectedFile bool
+	}{
+		{
+			name: "should not add env file option if stack doesn't have env variables",
+			stack: &portainer.Stack{
+				ProjectPath: dir,
+				Env:         nil,
+			},
+			expected: "",
+		},
+		{
+			name: "should not add env file option if stack's env variables are empty",
+			stack: &portainer.Stack{
+				ProjectPath: dir,
+				Env:         []portainer.Pair{},
+			},
+			expected: "",
+		},
+		{
+			name: "should add env file option if stack has env variables",
+			stack: &portainer.Stack{
+				ProjectPath: dir,
+				Env: []portainer.Pair{
+					{Name: "var1", Value: "value1"},
+					{Name: "var2", Value: "value2"},
+				},
+			},
+			expected: "var1=value1\nvar2=value2\n",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result, _ := createEnvFile(tt.stack)
+
+			if tt.expected != "" {
+				assert.Equal(t, filesystem.JoinPaths(tt.stack.ProjectPath, "stack.env"), result)
+
+				f, _ := os.Open(filesystem.JoinPaths(dir, "stack.env"))
+				content, _ := io.ReadAll(f)
+
+				assert.Equal(t, tt.expected, string(content))
+			} else {
+				assert.Empty(t, result)
+			}
+		})
+	}
+}
+
+func Test_createEnvFile_mergesDefultAndInplaceEnvVars(t *testing.T) {
+	t.Parallel()
+	dir := t.TempDir()
+	err := os.WriteFile(filesystem.JoinPaths(dir, ".env"), []byte("VAR1=VAL1\nVAR2=VAL2\n"), 0600)
+	require.NoError(t, err)
+
+	stack := &portainer.Stack{
+		ProjectPath: dir,
+		Env: []portainer.Pair{
+			{Name: "VAR1", Value: "NEW_VAL1"},
+			{Name: "VAR3", Value: "VAL3"},
+		},
+	}
+	result, err := createEnvFile(stack)
+	assert.Equal(t, filesystem.JoinPaths(stack.ProjectPath, "stack.env"), result)
+	require.NoError(t, err)
+	assert.FileExists(t, filesystem.JoinPaths(dir, "stack.env"))
+
+	f, err := os.Open(filesystem.JoinPaths(dir, "stack.env"))
+	require.NoError(t, err)
+
+	content, err := io.ReadAll(f)
+	require.NoError(t, err)
+
+	assert.Equal(t, []byte("VAR1=VAL1\nVAR2=VAL2\n\nVAR1=NEW_VAL1\nVAR3=VAL3\n"), content)
+}
+
+func Test_portainerRegistriesToAuthConfigs(t *testing.T) {
+	t.Parallel()
+
+	t.Run("returns empty slice for empty input", func(t *testing.T) {
+		t.Parallel()
+		result := portainerRegistriesToAuthConfigs([]portainer.Registry{})
+		require.Nil(t, result)
+	})
+
+	t.Run("uses registry URL, username and password for non-authenticated registry", func(t *testing.T) {
+		t.Parallel()
+		registries := []portainer.Registry{
+			{URL: "registry.example.com", Username: "user", Password: "pass", Authentication: false},
+		}
+		result := portainerRegistriesToAuthConfigs(registries)
+		require.Len(t, result, 1)
+		require.Equal(t, "registry.example.com", result[0].ServerAddress)
+		require.Equal(t, "user", result[0].Username)
+		require.Equal(t, "pass", result[0].Password)
+	})
+
+	t.Run("uses username and password for authenticated non-ECR registry", func(t *testing.T) {
+		t.Parallel()
+		registries := []portainer.Registry{
+			{URL: "registry.example.com", Username: "user", Password: "pass", Authentication: true, Type: portainer.CustomRegistry},
+		}
+		result := portainerRegistriesToAuthConfigs(registries)
+		require.Len(t, result, 1)
+		require.Equal(t, "user", result[0].Username)
+		require.Equal(t, "pass", result[0].Password)
+	})
+
+	t.Run("parses ECR access token for authenticated ECR registry with valid token", func(t *testing.T) {
+		t.Parallel()
+		registries := []portainer.Registry{
+			{
+				URL:               "123456789.dkr.ecr.us-east-1.amazonaws.com",
+				Username:          "AKIAIOSFODNN7EXAMPLE",
+				Password:          "secretkey",
+				Authentication:    true,
+				Type:              portainer.EcrRegistry,
+				Ecr:               portainer.EcrData{Region: "us-east-1"},
+				AccessToken:       "AWS:ecr-password",
+				AccessTokenExpiry: time.Now().Add(time.Hour).Unix(),
+			},
+		}
+		result := portainerRegistriesToAuthConfigs(registries)
+		require.Len(t, result, 1)
+		require.Equal(t, "AWS", result[0].Username)
+		require.Equal(t, "ecr-password", result[0].Password)
+	})
+
+	t.Run("includes valid registries and skips ones with credential errors", func(t *testing.T) {
+		t.Parallel()
+		registries := []portainer.Registry{
+			{URL: "valid.example.com", Username: "user", Password: "pass", Authentication: false},
+			{
+				URL:               "123456789.dkr.ecr.us-east-1.amazonaws.com",
+				Authentication:    true,
+				Type:              portainer.EcrRegistry,
+				Ecr:               portainer.EcrData{Region: "us-east-1"},
+				AccessToken:       "no-colon-token",
+				AccessTokenExpiry: time.Now().Add(time.Hour).Unix(),
+			},
+		}
+		result := portainerRegistriesToAuthConfigs(registries)
+		require.Len(t, result, 1)
+		require.Equal(t, "valid.example.com", result[0].ServerAddress)
+	})
+}
diff --git a/api/exec/exectest/kubernetes_mocks.go b/api/exec/exectest/kubernetes_mocks.go
new file mode 100644
index 0000000..3b2de18
--- /dev/null
+++ b/api/exec/exectest/kubernetes_mocks.go
@@ -0,0 +1,28 @@
+package exectest
+
+import (
+	"context"
+
+	portainer "github.com/portainer/portainer/api"
+)
+
+type kubernetesMockDeployer struct {
+	portainer.KubernetesDeployer
+}
+
+// NewKubernetesDeployer creates a mock kubernetes deployer
+func NewKubernetesDeployer() *kubernetesMockDeployer {
+	return &kubernetesMockDeployer{}
+}
+
+func (deployer *kubernetesMockDeployer) Deploy(_ context.Context, userID portainer.UserID, endpoint *portainer.Endpoint, manifestFiles []string, namespace string) (string, error) {
+	return "", nil
+}
+
+func (deployer *kubernetesMockDeployer) Remove(_ context.Context, userID portainer.UserID, endpoint *portainer.Endpoint, manifestFiles []string, namespace string) (string, error) {
+	return "", nil
+}
+
+func (deployer *kubernetesMockDeployer) Restart(_ context.Context, userID portainer.UserID, endpoint *portainer.Endpoint, manifestFiles []string, namespace string) (string, error) {
+	return "", nil
+}
diff --git a/api/exec/kubernetes_deploy.go b/api/exec/kubernetes_deploy.go
new file mode 100644
index 0000000..db6d9b4
--- /dev/null
+++ b/api/exec/kubernetes_deploy.go
@@ -0,0 +1,138 @@
+package exec
+
+import (
+	"context"
+	"fmt"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/proxy"
+	"github.com/portainer/portainer/api/http/proxy/factory"
+	"github.com/portainer/portainer/api/http/proxy/factory/kubernetes"
+	"github.com/portainer/portainer/api/kubernetes/cli"
+	"github.com/portainer/portainer/pkg/libkubectl"
+
+	"github.com/pkg/errors"
+)
+
+const (
+	defaultServerURL = "https://kubernetes.default.svc"
+)
+
+// KubernetesDeployer represents a service to deploy resources inside a Kubernetes environment(endpoint).
+type KubernetesDeployer struct {
+	dataStore                   dataservices.DataStore
+	reverseTunnelService        portainer.ReverseTunnelService
+	signatureService            portainer.DigitalSignatureService
+	kubernetesClientFactory     *cli.ClientFactory
+	kubernetesTokenCacheManager *kubernetes.TokenCacheManager
+	proxyManager                *proxy.Manager
+}
+
+// NewKubernetesDeployer initializes a new KubernetesDeployer service.
+func NewKubernetesDeployer(kubernetesTokenCacheManager *kubernetes.TokenCacheManager, kubernetesClientFactory *cli.ClientFactory, datastore dataservices.DataStore, reverseTunnelService portainer.ReverseTunnelService, signatureService portainer.DigitalSignatureService, proxyManager *proxy.Manager) *KubernetesDeployer {
+	return &KubernetesDeployer{
+		dataStore:                   datastore,
+		reverseTunnelService:        reverseTunnelService,
+		signatureService:            signatureService,
+		kubernetesClientFactory:     kubernetesClientFactory,
+		kubernetesTokenCacheManager: kubernetesTokenCacheManager,
+		proxyManager:                proxyManager,
+	}
+}
+
+func (deployer *KubernetesDeployer) getToken(userID portainer.UserID, endpoint *portainer.Endpoint, setLocalAdminToken bool) (string, error) {
+	kubeCLI, err := deployer.kubernetesClientFactory.GetPrivilegedKubeClient(endpoint)
+	if err != nil {
+		return "", err
+	}
+
+	tokenCache := deployer.kubernetesTokenCacheManager.GetOrCreateTokenCache(endpoint.ID)
+
+	tokenManager, err := kubernetes.NewTokenManager(kubeCLI, deployer.dataStore, tokenCache, setLocalAdminToken)
+	if err != nil {
+		return "", err
+	}
+
+	user, err := deployer.dataStore.User().Read(userID)
+	if err != nil {
+		return "", errors.Wrap(err, "failed to fetch the user")
+	}
+
+	if user.Role == portainer.AdministratorRole {
+		return tokenManager.GetAdminServiceAccountToken(), nil
+	}
+
+	token, err := tokenManager.GetUserServiceAccountToken(int(user.ID), endpoint.ID)
+	if err != nil {
+		return "", err
+	}
+
+	if token == "" {
+		return "", errors.New("can not get a valid user service account token")
+	}
+
+	return token, nil
+}
+
+// Deploy upserts Kubernetes resources defined in manifest(s)
+func (deployer *KubernetesDeployer) Deploy(ctx context.Context, userID portainer.UserID, endpoint *portainer.Endpoint, resources []string, namespace string) (string, error) {
+	return deployer.command(ctx, "apply", userID, endpoint, resources, namespace)
+}
+
+// Remove deletes Kubernetes resources defined in manifest(s)
+func (deployer *KubernetesDeployer) Remove(ctx context.Context, userID portainer.UserID, endpoint *portainer.Endpoint, resources []string, namespace string) (string, error) {
+	return deployer.command(ctx, "delete", userID, endpoint, resources, namespace)
+}
+
+func (deployer *KubernetesDeployer) command(ctx context.Context, operation string, userID portainer.UserID, endpoint *portainer.Endpoint, resources []string, namespace string) (string, error) {
+	token, err := deployer.getToken(userID, endpoint, endpoint.Type == portainer.KubernetesLocalEnvironment)
+	if err != nil {
+		return "", errors.Wrap(err, "failed generating a user token")
+	}
+
+	serverURL := defaultServerURL
+	if endpoint.Type == portainer.AgentOnKubernetesEnvironment || endpoint.Type == portainer.EdgeAgentOnKubernetesEnvironment {
+		url, proxy, err := deployer.getAgentURL(endpoint)
+		if err != nil {
+			return "", errors.WithMessage(err, "failed generating endpoint URL")
+		}
+		defer proxy.Close()
+
+		serverURL = url
+	}
+
+	client, err := libkubectl.NewClient(&libkubectl.ClientAccess{
+		Token:     token,
+		ServerUrl: serverURL,
+	}, namespace, "", true)
+	if err != nil {
+		return "", errors.Wrap(err, "failed to create kubectl client")
+	}
+
+	operations := map[string]func(context.Context, []string) (string, error){
+		"apply":  client.ApplyDynamic,
+		"delete": client.DeleteDynamic,
+	}
+
+	operationFunc, ok := operations[operation]
+	if !ok {
+		return "", errors.Errorf("unsupported operation: %s", operation)
+	}
+
+	output, err := operationFunc(ctx, resources)
+	if err != nil {
+		return "", errors.Wrapf(err, "failed to execute kubectl %s command", operation)
+	}
+
+	return output, nil
+}
+
+func (deployer *KubernetesDeployer) getAgentURL(endpoint *portainer.Endpoint) (string, *factory.ProxyServer, error) {
+	proxy, err := deployer.proxyManager.CreateAgentProxyServer(endpoint)
+	if err != nil {
+		return "", nil, err
+	}
+
+	return fmt.Sprintf("http://127.0.0.1:%d/kubernetes", proxy.Port), proxy, nil
+}
diff --git a/api/exec/kubernetes_deploy_test.go b/api/exec/kubernetes_deploy_test.go
new file mode 100644
index 0000000..8fb357e
--- /dev/null
+++ b/api/exec/kubernetes_deploy_test.go
@@ -0,0 +1,181 @@
+package exec
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type mockKubectlClient struct {
+	applyFunc          func(ctx context.Context, files []string) error
+	deleteFunc         func(ctx context.Context, files []string) error
+	rolloutRestartFunc func(ctx context.Context, resources []string) error
+}
+
+func (m *mockKubectlClient) Apply(ctx context.Context, files []string) error {
+	if m.applyFunc != nil {
+		return m.applyFunc(ctx, files)
+	}
+	return nil
+}
+
+func (m *mockKubectlClient) Delete(ctx context.Context, files []string) error {
+	if m.deleteFunc != nil {
+		return m.deleteFunc(ctx, files)
+	}
+	return nil
+}
+
+func (m *mockKubectlClient) RolloutRestart(ctx context.Context, resources []string) error {
+	if m.rolloutRestartFunc != nil {
+		return m.rolloutRestartFunc(ctx, resources)
+	}
+	return nil
+}
+
+func testExecuteKubectlOperation(client *mockKubectlClient, operation string, manifestFiles []string) error {
+	operations := map[string]func(context.Context, []string) error{
+		"apply":           client.Apply,
+		"delete":          client.Delete,
+		"rollout-restart": client.RolloutRestart,
+	}
+
+	operationFunc, ok := operations[operation]
+	if !ok {
+		return fmt.Errorf("unsupported operation: %s", operation)
+	}
+
+	if err := operationFunc(context.Background(), manifestFiles); err != nil {
+		return fmt.Errorf("failed to execute kubectl %s command: %w", operation, err)
+	}
+
+	return nil
+}
+
+func TestExecuteKubectlOperation_Apply_Success(t *testing.T) {
+	t.Parallel()
+	called := false
+	mockClient := &mockKubectlClient{
+		applyFunc: func(ctx context.Context, files []string) error {
+			called = true
+			assert.Equal(t, []string{"manifest1.yaml", "manifest2.yaml"}, files)
+			return nil
+		},
+	}
+
+	manifests := []string{"manifest1.yaml", "manifest2.yaml"}
+	err := testExecuteKubectlOperation(mockClient, "apply", manifests)
+
+	require.NoError(t, err)
+	assert.True(t, called)
+}
+
+func TestExecuteKubectlOperation_Apply_Error(t *testing.T) {
+	t.Parallel()
+	expectedErr := errors.New("kubectl apply failed")
+	called := false
+	mockClient := &mockKubectlClient{
+		applyFunc: func(ctx context.Context, files []string) error {
+			called = true
+			assert.Equal(t, []string{"error.yaml"}, files)
+			return expectedErr
+		},
+	}
+
+	manifests := []string{"error.yaml"}
+	err := testExecuteKubectlOperation(mockClient, "apply", manifests)
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), expectedErr.Error())
+	assert.True(t, called)
+}
+
+func TestExecuteKubectlOperation_Delete_Success(t *testing.T) {
+	t.Parallel()
+	called := false
+	mockClient := &mockKubectlClient{
+		deleteFunc: func(ctx context.Context, files []string) error {
+			called = true
+			assert.Equal(t, []string{"manifest1.yaml"}, files)
+			return nil
+		},
+	}
+
+	manifests := []string{"manifest1.yaml"}
+	err := testExecuteKubectlOperation(mockClient, "delete", manifests)
+
+	require.NoError(t, err)
+	assert.True(t, called)
+}
+
+func TestExecuteKubectlOperation_Delete_Error(t *testing.T) {
+	t.Parallel()
+	expectedErr := errors.New("kubectl delete failed")
+	called := false
+	mockClient := &mockKubectlClient{
+		deleteFunc: func(ctx context.Context, files []string) error {
+			called = true
+			assert.Equal(t, []string{"error.yaml"}, files)
+			return expectedErr
+		},
+	}
+
+	manifests := []string{"error.yaml"}
+	err := testExecuteKubectlOperation(mockClient, "delete", manifests)
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), expectedErr.Error())
+	assert.True(t, called)
+}
+
+func TestExecuteKubectlOperation_RolloutRestart_Success(t *testing.T) {
+	t.Parallel()
+	called := false
+	mockClient := &mockKubectlClient{
+		rolloutRestartFunc: func(ctx context.Context, resources []string) error {
+			called = true
+			assert.Equal(t, []string{"deployment/nginx"}, resources)
+			return nil
+		},
+	}
+
+	resources := []string{"deployment/nginx"}
+	err := testExecuteKubectlOperation(mockClient, "rollout-restart", resources)
+
+	require.NoError(t, err)
+	assert.True(t, called)
+}
+
+func TestExecuteKubectlOperation_RolloutRestart_Error(t *testing.T) {
+	t.Parallel()
+	expectedErr := errors.New("kubectl rollout restart failed")
+	called := false
+	mockClient := &mockKubectlClient{
+		rolloutRestartFunc: func(ctx context.Context, resources []string) error {
+			called = true
+			assert.Equal(t, []string{"deployment/error"}, resources)
+			return expectedErr
+		},
+	}
+
+	resources := []string{"deployment/error"}
+	err := testExecuteKubectlOperation(mockClient, "rollout-restart", resources)
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), expectedErr.Error())
+	assert.True(t, called)
+}
+
+func TestExecuteKubectlOperation_UnsupportedOperation(t *testing.T) {
+	t.Parallel()
+	mockClient := &mockKubectlClient{}
+
+	err := testExecuteKubectlOperation(mockClient, "unsupported", []string{})
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "unsupported operation")
+}
diff --git a/api/exec/swarm_stack.go b/api/exec/swarm_stack.go
new file mode 100644
index 0000000..ca7cf18
--- /dev/null
+++ b/api/exec/swarm_stack.go
@@ -0,0 +1,112 @@
+package exec
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/proxy"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+	"github.com/portainer/portainer/pkg/libstack"
+	"github.com/portainer/portainer/pkg/libstack/swarm"
+)
+
+// postDeployFailureCheckTimeout bounds how long Deploy waits for tasks to start or fail after being accepted by Swarm.
+const postDeployFailureCheckTimeout = 30 * time.Second
+
+// SwarmStackManager represents a service for managing stacks.
+type SwarmStackManager struct {
+	deployer     swarm.Deployer
+	proxyManager *proxy.Manager
+}
+
+// NewSwarmStackManager creates a new SwarmStackManager.
+func NewSwarmStackManager(
+	deployer swarm.Deployer,
+	proxyManager *proxy.Manager,
+) *SwarmStackManager {
+	return &SwarmStackManager{
+		deployer:     deployer,
+		proxyManager: proxyManager,
+	}
+}
+
+// Deploy creates or updates a Docker Swarm stack.
+func (manager *SwarmStackManager) Deploy(
+	ctx context.Context,
+	stack *portainer.Stack,
+	prune bool,
+	pullImage bool,
+	endpoint *portainer.Endpoint,
+	registries []portainer.Registry,
+) error {
+	url, proxy, err := fetchEndpointProxy(manager.proxyManager, endpoint)
+	if err != nil {
+		return fmt.Errorf("failed to fetch environment proxy: %w", err)
+	}
+
+	if proxy != nil {
+		defer proxy.Close()
+	}
+
+	filePaths := stackutils.GetStackFilePaths(stack, true)
+
+	env := make([]string, 0, len(stack.Env))
+	for _, ev := range stack.Env {
+		env = append(env, ev.Name+"="+ev.Value)
+	}
+
+	options := swarm.Options{
+		ProjectName: stack.Name,
+		Host:        url,
+		Env:         env,
+		Registries:  portainerRegistriesToAuthConfigs(registries),
+	}
+
+	if err := manager.deployer.Deploy(context.TODO(), filePaths, swarm.DeployOptions{
+		Options:       options,
+		RemoveOrphans: prune,
+		PullImage:     pullImage,
+	}); err != nil {
+		return err
+	}
+
+	// Swarm schedules and pulls images asynchronously, so check for early failures before reporting success.
+	waitCtx, cancel := context.WithTimeout(ctx, postDeployFailureCheckTimeout)
+	defer cancel()
+
+	result := manager.deployer.WaitForStatus(waitCtx, stack.Name, options, libstack.StatusRunning)
+	if result.Status == libstack.StatusError {
+		return fmt.Errorf("deployment failed: %s", result.ErrorMsg)
+	}
+
+	return nil
+}
+
+// Remove deletes all resources belonging to a Swarm stack.
+func (manager *SwarmStackManager) Remove(
+	ctx context.Context,
+	stack *portainer.Stack,
+	endpoint *portainer.Endpoint,
+) error {
+	url, proxy, err := fetchEndpointProxy(manager.proxyManager, endpoint)
+	if err != nil {
+		return fmt.Errorf("failed to fetch environment proxy: %w", err)
+	}
+
+	if proxy != nil {
+		defer proxy.Close()
+	}
+
+	return manager.deployer.Remove(context.TODO(), stack.Name, swarm.RemoveOptions{
+		Options: swarm.Options{
+			Host: url,
+		},
+	})
+}
+
+// NormalizeStackName returns a new stack name with unsupported characters replaced.
+func (manager *SwarmStackManager) NormalizeStackName(name string) string {
+	return normalizeStackName(name)
+}
diff --git a/api/filesystem/copy.go b/api/filesystem/copy.go
new file mode 100644
index 0000000..40d3974
--- /dev/null
+++ b/api/filesystem/copy.go
@@ -0,0 +1,86 @@
+package filesystem
+
+import (
+	"errors"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/portainer/portainer/api/logs"
+)
+
+// CopyPath copies file or directory defined by the path to the toDir path
+func CopyPath(path string, toDir string) error {
+	info, err := os.Stat(path)
+	if err != nil && errors.Is(err, os.ErrNotExist) {
+		// skip copy if file does not exist
+		return nil
+	} else if err != nil {
+		return err
+	}
+
+	if !info.IsDir() {
+		destination := filepath.Join(toDir, info.Name())
+		return copyFile(path, destination)
+	}
+
+	return CopyDir(path, toDir, true)
+}
+
+// CopyDir copies contents of fromDir to toDir.
+// When keepParent is true, contents will be copied with their immediate parent dir,
+// i.e. given /from/dirA and /to/dirB with keepParent == true, result will be /to/dirB/dirA/<children>
+func CopyDir(fromDir, toDir string, keepParent bool) error {
+	cleanedSourcePath := filepath.Clean(fromDir)
+	parentDirectory := filepath.Dir(cleanedSourcePath)
+	err := filepath.Walk(cleanedSourcePath, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+		var destination string
+		if keepParent {
+			destination = filepath.Join(toDir, strings.TrimPrefix(path, parentDirectory))
+		} else {
+			destination = filepath.Join(toDir, strings.TrimPrefix(path, cleanedSourcePath))
+		}
+
+		if destination == "" {
+			return nil
+		}
+
+		if info.IsDir() {
+			return nil // skip directory creations
+		}
+
+		if info.Mode()&os.ModeSymlink != 0 { // entry is a symlink
+			return nil // don't copy symlinks
+		}
+
+		return copyFile(path, destination)
+	})
+
+	return err
+}
+
+// copies regular a file from src to dst
+func copyFile(src, dst string) error {
+	from, err := os.Open(src)
+	if err != nil {
+		return err
+	}
+	defer logs.CloseAndLogErr(from)
+
+	// has to include 'execute' bit, otherwise fails. MkdirAll follows `mkdir -m` restrictions
+	if err := os.MkdirAll(filepath.Dir(dst), 0755); err != nil {
+		return err
+	}
+	to, err := os.Create(dst)
+	if err != nil {
+		return err
+	}
+	defer logs.CloseAndLogErr(to)
+
+	_, err = io.Copy(to, from)
+	return err
+}
diff --git a/api/filesystem/copy_test.go b/api/filesystem/copy_test.go
new file mode 100644
index 0000000..93bea75
--- /dev/null
+++ b/api/filesystem/copy_test.go
@@ -0,0 +1,111 @@
+package filesystem
+
+import (
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_copyFile_returnsError_whenSourceDoesNotExist(t *testing.T) {
+	t.Parallel()
+	tmpdir := t.TempDir()
+	err := copyFile("does-not-exist", tmpdir)
+	require.Error(t, err)
+}
+
+func Test_copyFile_shouldMakeAbackup(t *testing.T) {
+	t.Parallel()
+	tmpdir := t.TempDir()
+	content := []byte("content")
+
+	err := os.WriteFile(JoinPaths(tmpdir, "origin"), content, 0600)
+	require.NoError(t, err)
+
+	err = copyFile(JoinPaths(tmpdir, "origin"), JoinPaths(tmpdir, "copy"))
+	require.NoError(t, err)
+
+	copyContent, err := os.ReadFile(JoinPaths(tmpdir, "copy"))
+	require.NoError(t, err)
+	assert.Equal(t, content, copyContent)
+}
+
+func Test_CopyDir_shouldCopyAllFilesAndDirectories(t *testing.T) {
+	t.Parallel()
+	destination := t.TempDir()
+	err := CopyDir("./testdata/copy_test", destination, true)
+	require.NoError(t, err)
+
+	assert.FileExists(t, JoinPaths(destination, "copy_test", "outer"))
+	assert.FileExists(t, JoinPaths(destination, "copy_test", "dir", ".dotfile"))
+	assert.FileExists(t, JoinPaths(destination, "copy_test", "dir", "inner"))
+}
+
+func Test_CopyDir_shouldCopyOnlyDirContents(t *testing.T) {
+	t.Parallel()
+	destination := t.TempDir()
+	err := CopyDir("./testdata/copy_test", destination, false)
+	require.NoError(t, err)
+
+	assert.FileExists(t, JoinPaths(destination, "outer"))
+	assert.FileExists(t, JoinPaths(destination, "dir", ".dotfile"))
+	assert.FileExists(t, JoinPaths(destination, "dir", "inner"))
+}
+
+func Test_CopyPath_shouldSkipWhenNotExist(t *testing.T) {
+	t.Parallel()
+	tmpdir := t.TempDir()
+	err := CopyPath("does-not-exists", tmpdir)
+	require.NoError(t, err)
+
+	assert.NoFileExists(t, tmpdir)
+}
+
+func Test_CopyPath_shouldCopyFile(t *testing.T) {
+	t.Parallel()
+	tmpdir := t.TempDir()
+	content := []byte("content")
+
+	err := os.WriteFile(JoinPaths(tmpdir, "file"), content, 0600)
+	require.NoError(t, err)
+
+	err = os.MkdirAll(JoinPaths(tmpdir, "backup"), 0700)
+	require.NoError(t, err)
+
+	err = CopyPath(JoinPaths(tmpdir, "file"), JoinPaths(tmpdir, "backup"))
+	require.NoError(t, err)
+
+	copyContent, err := os.ReadFile(JoinPaths(tmpdir, "backup", "file"))
+	require.NoError(t, err)
+	assert.Equal(t, content, copyContent)
+}
+
+func Test_CopyPath_shouldCopyDir(t *testing.T) {
+	t.Parallel()
+	destination := t.TempDir()
+	err := CopyPath("./testdata/copy_test", destination)
+	require.NoError(t, err)
+
+	assert.FileExists(t, JoinPaths(destination, "copy_test", "outer"))
+	assert.FileExists(t, JoinPaths(destination, "copy_test", "dir", ".dotfile"))
+	assert.FileExists(t, JoinPaths(destination, "copy_test", "dir", "inner"))
+}
+
+func TestCopyPathPanic(t *testing.T) {
+	t.Parallel()
+	dir := t.TempDir()
+	p := JoinPaths(dir, "myfile")
+
+	err := os.WriteFile(p, []byte("contents"), 0644)
+	require.NoError(t, err)
+
+	err = os.Chmod(dir, 0)
+	require.NoError(t, err)
+
+	err = CopyPath(p, t.TempDir())
+	require.Error(t, err)
+
+	err = os.Chmod(dir, 0755)
+	require.NoError(t, err)
+}
diff --git a/api/filesystem/filesystem.go b/api/filesystem/filesystem.go
new file mode 100644
index 0000000..28afb38
--- /dev/null
+++ b/api/filesystem/filesystem.go
@@ -0,0 +1,1047 @@
+package filesystem
+
+import (
+	"bytes"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/logs"
+
+	"github.com/google/uuid"
+	"github.com/rs/zerolog/log"
+	"github.com/segmentio/encoding/json"
+)
+
+const (
+	// TLSStorePath represents the subfolder where TLS files are stored in the file store folder.
+	TLSStorePath = "tls"
+	// LDAPStorePath represents the subfolder where LDAP TLS files are stored in the TLSStorePath.
+	LDAPStorePath = "ldap"
+	// TLSCACertFile represents the name on disk for a TLS CA file.
+	TLSCACertFile = "ca.pem"
+	// TLSCertFile represents the name on disk for a TLS certificate file.
+	TLSCertFile = "cert.pem"
+	// TLSKeyFile represents the name on disk for a TLS key file.
+	TLSKeyFile = "key.pem"
+	// ComposeStorePath represents the subfolder where compose files are stored in the file store folder.
+	ComposeStorePath = "compose"
+	// ComposeFileDefaultName represents the default name of a compose file.
+	ComposeFileDefaultName = "docker-compose.yml"
+	// ManifestFileDefaultName represents the default name of a k8s manifest file.
+	ManifestFileDefaultName = "k8s-deployment.yml"
+	// EdgeStackStorePath represents the subfolder where edge stack files are stored in the file store folder.
+	EdgeStackStorePath = "edge_stacks"
+	// PrivateKeyFile represents the name on disk of the file containing the private key.
+	PrivateKeyFile = "portainer.key"
+	// PublicKeyFile represents the name on disk of the file containing the public key.
+	PublicKeyFile = "portainer.pub"
+	// BinaryStorePath represents the subfolder where binaries are stored in the file store folder.
+	BinaryStorePath = "bin"
+	// EdgeJobStorePath represents the subfolder where schedule files are stored.
+	EdgeJobStorePath = "edge_jobs"
+	// ExtensionRegistryManagementStorePath represents the subfolder where files related to the
+	// registry management extension are stored.
+	ExtensionRegistryManagementStorePath = "extensions"
+	// CustomTemplateStorePath represents the subfolder where custom template files are stored in the file store folder.
+	CustomTemplateStorePath = "custom_templates"
+	// TempPath represent the subfolder where temporary files are saved
+	TempPath = "tmp"
+	// SSLCertPath represents the default ssl certificates path
+	SSLCertPath = "certs"
+	// SSLCertFilename represents the ssl certificate file name
+	SSLCertFilename = "cert.pem"
+	// SSLKeyFilename represents the ssl key file name
+	SSLKeyFilename = "key.pem"
+	// SSLCACertFilename represents the CA ssl certificate file name for mTLS
+	SSLCACertFilename = "ca-cert.pem"
+
+	MTLSCertFilename   = "mtls-cert.pem"
+	MTLSCACertFilename = "mtls-ca-cert.pem"
+	MTLSKeyFilename    = "mtls-key.pem"
+
+	// ChiselPath represents the default chisel path
+	ChiselPath = "chisel"
+	// ChiselPrivateKeyFilename represents the chisel private key file name
+	ChiselPrivateKeyFilename = "private-key.pem"
+)
+
+// ErrUndefinedTLSFileType represents an error returned on undefined TLS file type
+var ErrUndefinedTLSFileType = errors.New("Undefined TLS file type")
+
+// Service represents a service for managing files and directories.
+type Service struct {
+	dataStorePath string
+	fileStorePath string
+}
+
+// JoinPaths takes a trusted root path and a list of untrusted paths and joins
+// them together using directory separators while enforcing that the untrusted
+// paths cannot go higher up than the trusted root
+func JoinPaths(trustedRoot string, untrustedPaths ...string) string {
+	if trustedRoot == "" {
+		trustedRoot = "."
+	}
+
+	p := filepath.Join(trustedRoot, filepath.Join(append([]string{"/"}, untrustedPaths...)...))
+
+	// avoid setting a volume name from the untrusted paths
+	vnp := filepath.VolumeName(p)
+	if filepath.VolumeName(trustedRoot) == "" && vnp != "" {
+		return strings.TrimPrefix(strings.TrimPrefix(p, vnp), `\`)
+	}
+
+	return p
+}
+
+// NewService initializes a new service. It creates a data directory and a directory to store files
+// inside this directory if they don't exist.
+func NewService(dataStorePath, fileStorePath string) (*Service, error) {
+	service := &Service{
+		dataStorePath: dataStorePath,
+		fileStorePath: JoinPaths(dataStorePath, fileStorePath),
+	}
+
+	err := os.MkdirAll(dataStorePath, 0755)
+	if err != nil {
+		return nil, err
+	}
+
+	err = service.createDirectoryInStore(SSLCertPath)
+	if err != nil {
+		return nil, err
+	}
+
+	err = service.createDirectoryInStore(TLSStorePath)
+	if err != nil {
+		return nil, err
+	}
+
+	err = service.createDirectoryInStore(ComposeStorePath)
+	if err != nil {
+		return nil, err
+	}
+
+	err = service.createDirectoryInStore(BinaryStorePath)
+	if err != nil {
+		return nil, err
+	}
+
+	return service, nil
+}
+
+// GetBinaryFolder returns the full path to the binary store on the filesystem
+func (service *Service) GetBinaryFolder() string {
+	return JoinPaths(service.fileStorePath, BinaryStorePath)
+}
+
+// RemoveDirectory removes a directory on the filesystem.
+func (service *Service) RemoveDirectory(directoryPath string) error {
+	return os.RemoveAll(directoryPath)
+}
+
+// GetStackProjectPath returns the absolute path on the FS for a stack based
+// on its identifier.
+func (service *Service) GetStackProjectPath(stackIdentifier string) string {
+	return JoinPaths(service.wrapFileStore(ComposeStorePath), stackIdentifier)
+}
+
+// GetStackProjectPathByVersion returns the absolute path on the FS for a stack based
+// on its identifier and version.
+func (service *Service) GetStackProjectPathByVersion(stackIdentifier string, version int, commitHash string) string {
+	versionStr := ""
+	if version != 0 {
+		versionStr = fmt.Sprintf("v%d", version)
+	}
+
+	if commitHash != "" {
+		versionStr = commitHash
+	}
+	return JoinPaths(service.wrapFileStore(ComposeStorePath), stackIdentifier, versionStr)
+}
+
+// Copy copies the file on fromFilePath to toFilePath
+// if toFilePath exists func will fail unless deleteIfExists is true
+func (service *Service) Copy(fromFilePath string, toFilePath string, deleteIfExists bool) error {
+	exists, err := service.FileExists(fromFilePath)
+	if err != nil {
+		return err
+	}
+
+	if !exists {
+		return fmt.Errorf("File (%s) doesn't exist", fromFilePath)
+	}
+
+	finput, err := os.Open(fromFilePath)
+	if err != nil {
+		return err
+	}
+
+	defer logs.CloseAndLogErr(finput)
+
+	exists, err = service.FileExists(toFilePath)
+	if err != nil {
+		return err
+	}
+
+	if exists {
+		if !deleteIfExists {
+			return errors.New("Destination file exists")
+		}
+
+		err := os.Remove(toFilePath)
+		if err != nil {
+			return err
+		}
+	}
+
+	foutput, err := os.Create(toFilePath)
+	if err != nil {
+		return err
+	}
+
+	defer logs.CloseAndLogErr(foutput)
+
+	buf := make([]byte, 1024)
+	for {
+		n, err := finput.Read(buf)
+		if err != nil && err != io.EOF {
+			return err
+		}
+		if n == 0 {
+			break
+		}
+
+		if _, err := foutput.Write(buf[:n]); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// StoreStackFileFromBytes creates a subfolder in the ComposeStorePath and stores a new file from bytes.
+// It returns the path to the folder where the file is stored.
+func (service *Service) StoreStackFileFromBytes(stackIdentifier, fileName string, data []byte) (string, error) {
+	stackStorePath := JoinPaths(ComposeStorePath, stackIdentifier)
+	err := service.createDirectoryInStore(stackStorePath)
+	if err != nil {
+		return "", err
+	}
+
+	composeFilePath := JoinPaths(stackStorePath, fileName)
+	r := bytes.NewReader(data)
+
+	err = service.createFileInStore(composeFilePath, r)
+	if err != nil {
+		return "", err
+	}
+
+	return service.wrapFileStore(stackStorePath), nil
+}
+
+// StoreStackFileFromBytesByVersion creates a version subfolder in the ComposeStorePath and stores a new file from bytes.
+// It returns the path to the folder where version folders are stored.
+func (service *Service) StoreStackFileFromBytesByVersion(stackIdentifier, fileName string, version int, data []byte) (string, error) {
+	versionStr := ""
+	if version != 0 {
+		versionStr = fmt.Sprintf("v%d", version)
+	}
+	stackStorePath := JoinPaths(ComposeStorePath, stackIdentifier)
+	stackVersionPath := JoinPaths(stackStorePath, versionStr)
+	err := service.createDirectoryInStore(stackVersionPath)
+	if err != nil {
+		return "", err
+	}
+
+	composeFilePath := JoinPaths(stackVersionPath, fileName)
+	r := bytes.NewReader(data)
+
+	err = service.createFileInStore(composeFilePath, r)
+	if err != nil {
+		return "", err
+	}
+
+	return service.wrapFileStore(stackStorePath), nil
+}
+
+// UpdateStoreStackFileFromBytes makes stack file backup and updates a new file from bytes.
+// It returns the path to the folder where the file is stored.
+func (service *Service) UpdateStoreStackFileFromBytes(stackIdentifier, fileName string, data []byte) (string, error) {
+	stackStorePath := JoinPaths(ComposeStorePath, stackIdentifier)
+	composeFilePath := JoinPaths(stackStorePath, fileName)
+	err := service.createBackupFileInStore(composeFilePath)
+	if err != nil {
+		return "", err
+	}
+
+	r := bytes.NewReader(data)
+	err = service.createFileInStore(composeFilePath, r)
+	if err != nil {
+		return "", err
+	}
+
+	return service.wrapFileStore(stackStorePath), nil
+}
+
+// UpdateStoreStackFileFromBytesByVersion makes stack file backup and updates a new file from bytes.
+// It returns the path to the folder where the file is stored.
+func (service *Service) UpdateStoreStackFileFromBytesByVersion(stackIdentifier, fileName string, version int, commitHash string, data []byte) (string, error) {
+	stackStorePath := JoinPaths(ComposeStorePath, stackIdentifier)
+
+	versionStr := ""
+	if version != 0 {
+		versionStr = fmt.Sprintf("v%d", version)
+	}
+	if commitHash != "" {
+		versionStr = commitHash
+	}
+
+	if versionStr != "" {
+		stackStorePath = JoinPaths(stackStorePath, versionStr)
+	}
+
+	composeFilePath := JoinPaths(stackStorePath, fileName)
+	err := service.createBackupFileInStore(composeFilePath)
+	if err != nil {
+		return "", err
+	}
+
+	r := bytes.NewReader(data)
+	err = service.createFileInStore(composeFilePath, r)
+	if err != nil {
+		return "", err
+	}
+
+	return service.wrapFileStore(stackStorePath), nil
+}
+
+// RemoveStackFileBackup removes the stack file backup in the ComposeStorePath.
+func (service *Service) RemoveStackFileBackup(stackIdentifier, fileName string) error {
+	stackStorePath := JoinPaths(ComposeStorePath, stackIdentifier)
+	composeFilePath := JoinPaths(stackStorePath, fileName)
+
+	return service.removeBackupFileInStore(composeFilePath)
+}
+
+// RemoveStackFileBackupByVersion removes the stack file backup by version in the ComposeStorePath.
+func (service *Service) RemoveStackFileBackupByVersion(stackIdentifier string, version int, fileName string) error {
+	versionStr := ""
+	if version != 0 {
+		versionStr = fmt.Sprintf("v%d", version)
+	}
+	stackStorePath := JoinPaths(ComposeStorePath, stackIdentifier, versionStr)
+	composeFilePath := JoinPaths(stackStorePath, fileName)
+
+	return service.removeBackupFileInStore(composeFilePath)
+}
+
+// RollbackStackFile rollbacks the stack file backup in the ComposeStorePath.
+func (service *Service) RollbackStackFile(stackIdentifier, fileName string) error {
+	stackStorePath := JoinPaths(ComposeStorePath, stackIdentifier)
+	composeFilePath := JoinPaths(stackStorePath, fileName)
+	path := service.wrapFileStore(composeFilePath)
+	backupPath := path + ".bak"
+
+	exists, err := service.FileExists(backupPath)
+	if err != nil {
+		return err
+	}
+
+	if !exists {
+		// keep the updated/failed stack file
+		return nil
+	}
+
+	err = service.Copy(backupPath, path, true)
+	if err != nil {
+		return err
+	}
+
+	return os.Remove(backupPath)
+}
+
+// RollbackStackFileByVersion rollbacks the stack file backup by version in the ComposeStorePath.
+func (service *Service) RollbackStackFileByVersion(stackIdentifier string, version int, fileName string) error {
+	versionStr := ""
+	if version != 0 {
+		versionStr = "v" + strconv.Itoa(version)
+	}
+	stackStorePath := JoinPaths(ComposeStorePath, stackIdentifier, versionStr)
+	composeFilePath := JoinPaths(stackStorePath, fileName)
+	path := service.wrapFileStore(composeFilePath)
+	backupPath := path + ".bak"
+
+	exists, err := service.FileExists(backupPath)
+	if err != nil {
+		return err
+	}
+
+	if !exists {
+		// keep the updated/failed stack file
+		return nil
+	}
+
+	err = service.Copy(backupPath, path, true)
+	if err != nil {
+		return err
+	}
+
+	return os.Remove(backupPath)
+}
+
+// GetEdgeStackProjectPath returns the absolute path on the FS for a edge stack based
+// on its identifier.
+func (service *Service) GetEdgeStackProjectPath(edgeStackIdentifier string) string {
+	return JoinPaths(service.wrapFileStore(EdgeStackStorePath), edgeStackIdentifier)
+}
+
+// StoreEdgeStackFileFromBytes creates a subfolder in the EdgeStackStorePath and stores a new file from bytes.
+// It returns the path to the folder where the file is stored.
+func (service *Service) StoreEdgeStackFileFromBytes(edgeStackIdentifier, fileName string, data []byte) (string, error) {
+	stackStorePath := JoinPaths(EdgeStackStorePath, edgeStackIdentifier)
+	err := service.createDirectoryInStore(stackStorePath)
+	if err != nil {
+		return "", err
+	}
+
+	composeFilePath := JoinPaths(stackStorePath, fileName)
+	r := bytes.NewReader(data)
+
+	err = service.createFileInStore(composeFilePath, r)
+	if err != nil {
+		return "", err
+	}
+
+	return service.wrapFileStore(stackStorePath), nil
+}
+
+// GetEdgeStackProjectPathByVersion returns the absolute path on the FS for a edge stack based
+// on its identifier and version.
+// EE only feature
+func (service *Service) GetEdgeStackProjectPathByVersion(edgeStackIdentifier string, version int, commitHash string) string {
+	versionStr := ""
+	if version != 0 {
+		versionStr = fmt.Sprintf("v%d", version)
+	}
+
+	if commitHash != "" {
+		versionStr = commitHash
+	}
+
+	return JoinPaths(service.wrapFileStore(EdgeStackStorePath), edgeStackIdentifier, versionStr)
+}
+
+// StoreEdgeStackFileFromBytesByVersion creates a subfolder in the EdgeStackStorePath with version and stores a new file from bytes.
+// It returns the path to the folder where the file is stored.
+// EE only feature
+func (service *Service) StoreEdgeStackFileFromBytesByVersion(edgeStackIdentifier, fileName string, version int, data []byte) (string, error) {
+	versionStr := ""
+	if version != 0 {
+		versionStr = fmt.Sprintf("v%d", version)
+	}
+	stackStorePath := JoinPaths(EdgeStackStorePath, edgeStackIdentifier, versionStr)
+
+	err := service.createDirectoryInStore(stackStorePath)
+	if err != nil {
+		return "", err
+	}
+
+	composeFilePath := JoinPaths(stackStorePath, fileName)
+	r := bytes.NewReader(data)
+
+	err = service.createFileInStore(composeFilePath, r)
+	if err != nil {
+		return "", err
+	}
+
+	return service.wrapFileStore(stackStorePath), nil
+}
+
+// FormProjectPathByVersion returns the absolute path on the FS for a project based with version
+func (service *Service) FormProjectPathByVersion(path string, version int, commitHash string) string {
+	versionStr := ""
+	if version != 0 {
+		versionStr = fmt.Sprintf("v%d", version)
+	}
+
+	if commitHash != "" {
+		versionStr = commitHash
+	}
+
+	return JoinPaths(path, versionStr)
+}
+
+// StoreRegistryManagementFileFromBytes creates a subfolder in the
+// ExtensionRegistryManagementStorePath and stores a new file from bytes.
+// It returns the path to the folder where the file is stored.
+func (service *Service) StoreRegistryManagementFileFromBytes(folder, fileName string, data []byte) (string, error) {
+	extensionStorePath := JoinPaths(ExtensionRegistryManagementStorePath, folder)
+	err := service.createDirectoryInStore(extensionStorePath)
+	if err != nil {
+		return "", err
+	}
+
+	file := JoinPaths(extensionStorePath, fileName)
+	r := bytes.NewReader(data)
+
+	err = service.createFileInStore(file, r)
+	if err != nil {
+		return "", err
+	}
+
+	return service.wrapFileStore(file), nil
+}
+
+// StoreTLSFileFromBytes creates a folder in the TLSStorePath and stores a new file from bytes.
+// It returns the path to the newly created file.
+func (service *Service) StoreTLSFileFromBytes(folder string, fileType portainer.TLSFileType, data []byte) (string, error) {
+	storePath := JoinPaths(TLSStorePath, folder)
+	err := service.createDirectoryInStore(storePath)
+	if err != nil {
+		return "", err
+	}
+
+	var fileName string
+	switch fileType {
+	case portainer.TLSFileCA:
+		fileName = TLSCACertFile
+	case portainer.TLSFileCert:
+		fileName = TLSCertFile
+	case portainer.TLSFileKey:
+		fileName = TLSKeyFile
+	default:
+		return "", ErrUndefinedTLSFileType
+	}
+
+	tlsFilePath := JoinPaths(storePath, fileName)
+	r := bytes.NewReader(data)
+	err = service.createFileInStore(tlsFilePath, r)
+	if err != nil {
+		return "", err
+	}
+	return service.wrapFileStore(tlsFilePath), nil
+}
+
+// GetPathForTLSFile returns the absolute path to a specific TLS file for an environment(endpoint).
+func (service *Service) GetPathForTLSFile(folder string, fileType portainer.TLSFileType) (string, error) {
+	var fileName string
+	switch fileType {
+	case portainer.TLSFileCA:
+		fileName = TLSCACertFile
+	case portainer.TLSFileCert:
+		fileName = TLSCertFile
+	case portainer.TLSFileKey:
+		fileName = TLSKeyFile
+	default:
+		return "", ErrUndefinedTLSFileType
+	}
+	return JoinPaths(service.wrapFileStore(TLSStorePath), folder, fileName), nil
+}
+
+// DeleteTLSFiles deletes a folder in the TLS store path.
+func (service *Service) DeleteTLSFiles(folder string) error {
+	storePath := JoinPaths(service.wrapFileStore(TLSStorePath), folder)
+	return os.RemoveAll(storePath)
+}
+
+// DeleteTLSFile deletes a specific TLS file from a folder.
+func (service *Service) DeleteTLSFile(folder string, fileType portainer.TLSFileType) error {
+	var fileName string
+	switch fileType {
+	case portainer.TLSFileCA:
+		fileName = TLSCACertFile
+	case portainer.TLSFileCert:
+		fileName = TLSCertFile
+	case portainer.TLSFileKey:
+		fileName = TLSKeyFile
+	default:
+		return ErrUndefinedTLSFileType
+	}
+
+	filePath := JoinPaths(service.wrapFileStore(TLSStorePath), folder, fileName)
+
+	return os.Remove(filePath)
+}
+
+// GetFileContent returns the content of a file as bytes.
+func (service *Service) GetFileContent(trustedRoot, filePath string) ([]byte, error) {
+	content, err := os.ReadFile(JoinPaths(trustedRoot, filePath))
+	if err != nil {
+		if filePath == "" {
+			filePath = trustedRoot
+		}
+		return nil, fmt.Errorf("could not get the contents of the file '%s'", filePath)
+	}
+
+	return content, nil
+}
+
+// Rename renames a file or directory
+func (service *Service) Rename(oldPath, newPath string) error {
+	return os.Rename(oldPath, newPath)
+}
+
+// WriteJSONToFile writes JSON to the specified file.
+func (service *Service) WriteJSONToFile(path string, content any) error {
+	jsonContent, err := json.Marshal(content)
+	if err != nil {
+		return err
+	}
+
+	return os.WriteFile(path, jsonContent, 0644)
+}
+
+// FileExists checks for the existence of the specified file.
+func (service *Service) FileExists(filePath string) (bool, error) {
+	return FileExists(filePath)
+}
+
+// KeyPairFilesExist checks for the existence of the key files.
+func (service *Service) KeyPairFilesExist() (bool, error) {
+	privateKeyPath := JoinPaths(service.dataStorePath, PrivateKeyFile)
+	exists, err := service.FileExists(privateKeyPath)
+	if err != nil || !exists {
+		return false, err
+	}
+
+	publicKeyPath := JoinPaths(service.dataStorePath, PublicKeyFile)
+	exists, err = service.FileExists(publicKeyPath)
+	if err != nil || !exists {
+		return false, err
+	}
+
+	return true, nil
+}
+
+// StoreKeyPair store the specified keys content as PEM files on disk.
+func (service *Service) StoreKeyPair(private, public []byte, privatePEMHeader, publicPEMHeader string) error {
+	err := service.createPEMFileInStore(private, privatePEMHeader, PrivateKeyFile)
+	if err != nil {
+		return err
+	}
+
+	return service.createPEMFileInStore(public, publicPEMHeader, PublicKeyFile)
+}
+
+// LoadKeyPair retrieve the content of both key files on disk.
+func (service *Service) LoadKeyPair() ([]byte, []byte, error) {
+	privateKey, err := service.getContentFromPEMFile(PrivateKeyFile)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	publicKey, err := service.getContentFromPEMFile(PublicKeyFile)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return privateKey, publicKey, nil
+}
+
+// createDirectoryInStore creates a new directory in the file store
+func (service *Service) createDirectoryInStore(name string) error {
+	path := service.wrapFileStore(name)
+	return os.MkdirAll(path, 0700)
+}
+
+// createFile creates a new file in the file store with the content from r.
+func (service *Service) createFileInStore(filePath string, r io.Reader) error {
+	path := service.wrapFileStore(filePath)
+
+	return CreateFile(path, r)
+}
+
+// createBackupFileInStore makes a copy in the file store.
+func (service *Service) createBackupFileInStore(filePath string) error {
+	path := service.wrapFileStore(filePath)
+	backupPath := path + ".bak"
+
+	return service.Copy(path, backupPath, true)
+}
+
+// removeBackupFileInStore removes the copy in the file store.
+func (service *Service) removeBackupFileInStore(filePath string) error {
+	path := service.wrapFileStore(filePath)
+	backupPath := path + ".bak"
+
+	exists, err := service.FileExists(backupPath)
+	if err != nil {
+		return err
+	}
+
+	if exists {
+		return os.Remove(backupPath)
+	}
+
+	return nil
+}
+
+func (service *Service) createPEMFileInStore(content []byte, fileType, filePath string) error {
+	path := service.wrapFileStore(filePath)
+	block := &pem.Block{Type: fileType, Bytes: content}
+
+	out, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
+	if err != nil {
+		return err
+	}
+	defer logs.CloseAndLogErr(out)
+
+	return pem.Encode(out, block)
+}
+
+func (service *Service) getContentFromPEMFile(filePath string) ([]byte, error) {
+	path := service.wrapFileStore(filePath)
+
+	fileContent, err := os.ReadFile(path)
+	if err != nil {
+		return nil, err
+	}
+
+	block, _ := pem.Decode(fileContent)
+	return block.Bytes, nil
+}
+
+// GetCustomTemplateProjectPath returns the absolute path on the FS for a custom template based
+// on its identifier.
+func (service *Service) GetCustomTemplateProjectPath(identifier string) string {
+	return JoinPaths(service.wrapFileStore(CustomTemplateStorePath), identifier)
+}
+
+// StoreCustomTemplateFileFromBytes creates a subfolder in the CustomTemplateStorePath and stores a new file from bytes.
+// It returns the path to the folder where the file is stored.
+func (service *Service) StoreCustomTemplateFileFromBytes(identifier, fileName string, data []byte) (string, error) {
+	customTemplateStorePath := JoinPaths(CustomTemplateStorePath, identifier)
+	err := service.createDirectoryInStore(customTemplateStorePath)
+	if err != nil {
+		return "", err
+	}
+
+	templateFilePath := JoinPaths(customTemplateStorePath, fileName)
+	r := bytes.NewReader(data)
+
+	err = service.createFileInStore(templateFilePath, r)
+	if err != nil {
+		return "", err
+	}
+
+	return service.wrapFileStore(customTemplateStorePath), nil
+}
+
+// GetEdgeJobFolder returns the absolute path on the filesystem for an Edge job based
+// on its identifier.
+func (service *Service) GetEdgeJobFolder(identifier string) string {
+	return JoinPaths(service.wrapFileStore(EdgeJobStorePath), identifier)
+}
+
+// StoreEdgeJobFileFromBytes creates a subfolder in the EdgeJobStorePath and stores a new file from bytes.
+// It returns the path to the folder where the file is stored.
+func (service *Service) StoreEdgeJobFileFromBytes(identifier string, data []byte) (string, error) {
+	edgeJobStorePath := JoinPaths(EdgeJobStorePath, identifier)
+	err := service.createDirectoryInStore(edgeJobStorePath)
+	if err != nil {
+		return "", err
+	}
+
+	filePath := JoinPaths(edgeJobStorePath, createEdgeJobFileName(identifier))
+	r := bytes.NewReader(data)
+	err = service.createFileInStore(filePath, r)
+	if err != nil {
+		return "", err
+	}
+
+	return service.wrapFileStore(filePath), nil
+}
+
+func createEdgeJobFileName(identifier string) string {
+	return "job_" + identifier + ".sh"
+}
+
+// ClearEdgeJobTaskLogs clears the Edge job task logs
+func (service *Service) ClearEdgeJobTaskLogs(edgeJobID string, taskID string) error {
+	path := service.getEdgeJobTaskLogPath(edgeJobID, taskID)
+	return os.Remove(path)
+}
+
+// GetEdgeJobTaskLogFileContent fetches the Edge job task logs
+func (service *Service) GetEdgeJobTaskLogFileContent(edgeJobID string, taskID string) (string, error) {
+	path := service.getEdgeJobTaskLogPath(edgeJobID, taskID)
+
+	fileContent, err := os.ReadFile(path)
+	if err != nil {
+		return "", err
+	}
+
+	return string(fileContent), nil
+}
+
+// StoreEdgeJobTaskLogFileFromBytes stores the log file
+func (service *Service) StoreEdgeJobTaskLogFileFromBytes(edgeJobID, taskID string, data []byte) error {
+	edgeJobStorePath := JoinPaths(EdgeJobStorePath, edgeJobID)
+	err := service.createDirectoryInStore(edgeJobStorePath)
+	if err != nil {
+		return err
+	}
+
+	filePath := JoinPaths(edgeJobStorePath, "logs_"+taskID)
+	r := bytes.NewReader(data)
+	return service.createFileInStore(filePath, r)
+}
+
+func (service *Service) getEdgeJobTaskLogPath(edgeJobID string, taskID string) string {
+	return fmt.Sprintf("%s/logs_%s", service.GetEdgeJobFolder(edgeJobID), taskID)
+}
+
+// GetTemporaryPath returns a temp folder
+func (service *Service) GetTemporaryPath() (string, error) {
+	uid, err := uuid.NewRandom()
+	if err != nil {
+		return "", err
+	}
+
+	return JoinPaths(service.wrapFileStore(TempPath), uid.String()), nil
+}
+
+// GetDataStorePath returns path to data folder
+func (service *Service) GetDatastorePath() string {
+	return service.dataStorePath
+}
+
+func (service *Service) wrapFileStore(filepath string) string {
+	return JoinPaths(service.fileStorePath, filepath)
+}
+
+func defaultCertPathUnderFileStore() (string, string) {
+	certPath := JoinPaths(SSLCertPath, SSLCertFilename)
+	keyPath := JoinPaths(SSLCertPath, SSLKeyFilename)
+	return certPath, keyPath
+}
+
+// GetDefaultSSLCertsPath returns the ssl certs path
+func (service *Service) GetDefaultSSLCertsPath() (string, string) {
+	certPath, keyPath := defaultCertPathUnderFileStore()
+	return service.wrapFileStore(certPath), service.wrapFileStore(keyPath)
+}
+
+func defaultMTLSCertPathUnderFileStore() (string, string, string) {
+	caCertPath := JoinPaths(SSLCertPath, MTLSCACertFilename)
+	certPath := JoinPaths(SSLCertPath, MTLSCertFilename)
+	keyPath := JoinPaths(SSLCertPath, MTLSKeyFilename)
+
+	return caCertPath, certPath, keyPath
+}
+
+// GetDefaultChiselPrivateKeyPath returns the chisel private key path
+func (service *Service) GetDefaultChiselPrivateKeyPath() string {
+	privateKeyPath := defaultChiselPrivateKeyPathUnderFileStore()
+	return service.wrapFileStore(privateKeyPath)
+}
+
+func defaultChiselPrivateKeyPathUnderFileStore() string {
+	return JoinPaths(ChiselPath, ChiselPrivateKeyFilename)
+}
+
+// StoreChiselPrivateKey store the specified chisel private key content on disk.
+func (service *Service) StoreChiselPrivateKey(privateKey []byte) error {
+	err := service.createDirectoryInStore(ChiselPath)
+	if err != nil && !os.IsExist(err) {
+		return err
+	}
+
+	r := bytes.NewReader(privateKey)
+	privateKeyPath := defaultChiselPrivateKeyPathUnderFileStore()
+	return service.createFileInStore(privateKeyPath, r)
+}
+
+// StoreSSLCertPair stores a ssl certificate pair
+func (service *Service) StoreSSLCertPair(cert, key []byte) (string, string, error) {
+	certPath, keyPath := defaultCertPathUnderFileStore()
+
+	r := bytes.NewReader(cert)
+	err := service.createFileInStore(certPath, r)
+	if err != nil {
+		return "", "", err
+	}
+
+	r = bytes.NewReader(key)
+	err = service.createFileInStore(keyPath, r)
+	if err != nil {
+		return "", "", err
+	}
+
+	return service.wrapFileStore(certPath), service.wrapFileStore(keyPath), nil
+}
+
+// CopySSLCertPair copies a ssl certificate pair
+func (service *Service) CopySSLCertPair(certPath, keyPath string) (string, string, error) {
+	defCertPath, defKeyPath := service.GetDefaultSSLCertsPath()
+
+	err := service.Copy(certPath, defCertPath, true)
+	if err != nil {
+		return "", "", err
+	}
+
+	err = service.Copy(keyPath, defKeyPath, true)
+	if err != nil {
+		return "", "", err
+	}
+
+	return defCertPath, defKeyPath, nil
+}
+
+// CopySSLCACert copies the specified caCert pem file
+func (service *Service) CopySSLCACert(caCertPath string) (string, error) {
+	toFilePath := service.wrapFileStore(JoinPaths(SSLCertPath, SSLCACertFilename))
+
+	err := service.Copy(caCertPath, toFilePath, true)
+	if err != nil {
+		return "", err
+	}
+
+	return toFilePath, nil
+}
+
+// FileExists checks for the existence of the specified file.
+func FileExists(filePath string) (bool, error) {
+	if _, err := os.Stat(filePath); err != nil {
+		if os.IsNotExist(err) {
+			return false, nil
+		}
+		return false, err
+	}
+	return true, nil
+}
+
+// SafeCopyDirectory copies a directory from src to dst in a safe way.
+func (service *Service) SafeMoveDirectory(originalPath, newPath string) error {
+	// 1. Backup the source directory to a different folder
+	backupDir := fmt.Sprintf("%s-%s", filepath.Dir(originalPath), "backup")
+	err := MoveDirectory(originalPath, backupDir, false)
+	if err != nil {
+		return fmt.Errorf("failed to backup source directory: %w", err)
+	}
+
+	defer func() {
+		if err != nil {
+			// If an error occurred, rollback the backup directory
+			restoreErr := restoreBackup(originalPath, backupDir)
+			if restoreErr != nil {
+				log.Warn().Err(restoreErr).Msg("failed to restore backup during creating versioning folder")
+			}
+		}
+	}()
+
+	// 2. Copy the backup directory to the destination directory
+	err = CopyDir(backupDir, newPath, false)
+	if err != nil {
+		return fmt.Errorf("failed to copy backup directory to destination directory: %w", err)
+	}
+
+	// 3. Delete the backup directory
+	err = os.RemoveAll(backupDir)
+	if err != nil {
+		return fmt.Errorf("failed to delete backup directory: %w", err)
+	}
+
+	return nil
+}
+
+func restoreBackup(src, backupDir string) error {
+	// Rollback by deleting the original directory and copying the
+	// backup direcotry back to the source directory, and then deleting
+	// the backup directory
+	err := os.RemoveAll(src)
+	if err != nil {
+		return fmt.Errorf("failed to delete destination directory: %w", err)
+	}
+
+	err = MoveDirectory(backupDir, src, false)
+	if err != nil {
+		return fmt.Errorf("failed to restore backup directory: %w", err)
+	}
+	return nil
+}
+
+func MoveDirectory(originalPath, newPath string, overwriteTargetPath bool) error {
+	if _, err := os.Stat(originalPath); err != nil {
+		return err
+	}
+
+	alreadyExists, err := FileExists(newPath)
+	if err != nil {
+		return err
+	}
+
+	if alreadyExists {
+		if !overwriteTargetPath {
+			return errors.New("Target path already exists")
+		}
+
+		if err = os.RemoveAll(newPath); err != nil {
+			return fmt.Errorf("failed to overwrite path %s: %s", newPath, err.Error())
+		}
+	}
+
+	return os.Rename(originalPath, newPath)
+}
+
+func CreateFile(path string, r io.Reader) error {
+	out, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
+	if err != nil {
+		return err
+	}
+
+	defer logs.CloseAndLogErr(out)
+
+	_, err = io.Copy(out, r)
+	return err
+}
+
+func (service *Service) StoreMTLSCertificates(caCert, cert, key []byte) (string, string, string, error) {
+	caCertPath, certPath, keyPath := defaultMTLSCertPathUnderFileStore()
+
+	r := bytes.NewReader(caCert)
+	if err := service.createFileInStore(caCertPath, r); err != nil {
+		return "", "", "", err
+	}
+
+	r = bytes.NewReader(cert)
+	if err := service.createFileInStore(certPath, r); err != nil {
+		return "", "", "", err
+	}
+
+	r = bytes.NewReader(key)
+	if err := service.createFileInStore(keyPath, r); err != nil {
+		return "", "", "", err
+	}
+
+	return service.wrapFileStore(caCertPath), service.wrapFileStore(certPath), service.wrapFileStore(keyPath), nil
+}
+
+func (service *Service) GetMTLSCertificates() (string, string, string, error) {
+	caCertPath, certPath, keyPath := defaultMTLSCertPathUnderFileStore()
+
+	caCertPath = service.wrapFileStore(caCertPath)
+	certPath = service.wrapFileStore(certPath)
+	keyPath = service.wrapFileStore(keyPath)
+
+	paths := [...]string{caCertPath, certPath, keyPath}
+	for _, path := range paths {
+		exists, err := service.FileExists(path)
+		if err != nil {
+			return "", "", "", err
+		}
+
+		if !exists {
+			return "", "", "", fmt.Errorf("file %s does not exist", path)
+		}
+	}
+
+	return caCertPath, certPath, keyPath, nil
+}
diff --git a/api/filesystem/filesystem_fileexists_test.go b/api/filesystem/filesystem_fileexists_test.go
new file mode 100644
index 0000000..1555604
--- /dev/null
+++ b/api/filesystem/filesystem_fileexists_test.go
@@ -0,0 +1,60 @@
+package filesystem
+
+import (
+	"fmt"
+	"math/rand"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_fileSystemService_FileExists_whenFileExistsShouldReturnTrue(t *testing.T) {
+	t.Parallel()
+	service := createService(t)
+	testHelperFileExists_fileExists(t, service.FileExists)
+}
+
+func Test_fileSystemService_FileExists_whenFileNotExistsShouldReturnFalse(t *testing.T) {
+	t.Parallel()
+	service := createService(t)
+	testHelperFileExists_fileNotExists(t, service.FileExists)
+}
+
+func Test_FileExists_whenFileExistsShouldReturnTrue(t *testing.T) {
+	t.Parallel()
+	testHelperFileExists_fileExists(t, FileExists)
+}
+
+func Test_FileExists_whenFileNotExistsShouldReturnFalse(t *testing.T) {
+	t.Parallel()
+	testHelperFileExists_fileNotExists(t, FileExists)
+}
+
+func testHelperFileExists_fileExists(t *testing.T, checker func(path string) (bool, error)) {
+	file, err := os.CreateTemp(t.TempDir(), t.Name())
+	require.NoError(t, err, "CreateTemp should not fail")
+
+	t.Cleanup(func() {
+		err := os.RemoveAll(file.Name())
+		require.NoError(t, err)
+	})
+
+	exists, err := checker(file.Name())
+	require.NoError(t, err, "FileExists should not fail")
+
+	assert.True(t, exists)
+}
+
+func testHelperFileExists_fileNotExists(t *testing.T, checker func(path string) (bool, error)) {
+	filePath := JoinPaths(t.TempDir(), fmt.Sprintf("%s%d", t.Name(), rand.Int()))
+
+	err := os.RemoveAll(filePath)
+	require.NoError(t, err, "RemoveAll should not fail")
+
+	exists, err := checker(filePath)
+	require.NoError(t, err, "FileExists should not fail")
+
+	assert.False(t, exists)
+}
diff --git a/api/filesystem/filesystem_linux_test.go b/api/filesystem/filesystem_linux_test.go
new file mode 100644
index 0000000..58c77bd
--- /dev/null
+++ b/api/filesystem/filesystem_linux_test.go
@@ -0,0 +1,71 @@
+package filesystem
+
+import "testing"
+
+func TestJoinPaths(t *testing.T) {
+	t.Parallel()
+	var ts = []struct {
+		trusted   string
+		untrusted string
+		expected  string
+	}{
+		{"", "", "."},
+		{"", ".", "."},
+		{"", "d/e/f", "d/e/f"},
+		{"", "./d/e/f", "d/e/f"},
+		{"", "../d/e/f", "d/e/f"},
+		{"", "/d/e/f", "d/e/f"},
+		{"", "../../../etc/shadow", "etc/shadow"},
+
+		{".", "", "."},
+		{".", ".", "."},
+		{".", "d/e/f", "d/e/f"},
+		{".", "./d/e/f", "d/e/f"},
+		{".", "../d/e/f", "d/e/f"},
+		{".", "/d/e/f", "d/e/f"},
+		{".", "../../../etc/shadow", "etc/shadow"},
+
+		{"./", "", "."},
+		{"./", ".", "."},
+		{"./", "d/e/f", "d/e/f"},
+		{"./", "./d/e/f", "d/e/f"},
+		{"./", "../d/e/f", "d/e/f"},
+		{"./", "/d/e/f", "d/e/f"},
+		{"./", "../../../etc/shadow", "etc/shadow"},
+
+		{"a/b/c", "", "a/b/c"},
+		{"a/b/c", ".", "a/b/c"},
+		{"a/b/c", "d/e/f", "a/b/c/d/e/f"},
+		{"a/b/c", "./d/e/f", "a/b/c/d/e/f"},
+		{"a/b/c", "../d/e/f", "a/b/c/d/e/f"},
+		{"a/b/c", "../../../etc/shadow", "a/b/c/etc/shadow"},
+
+		{"/a/b/c", "", "/a/b/c"},
+		{"/a/b/c", ".", "/a/b/c"},
+		{"/a/b/c", "d/e/f", "/a/b/c/d/e/f"},
+		{"/a/b/c", "./d/e/f", "/a/b/c/d/e/f"},
+		{"/a/b/c", "../d/e/f", "/a/b/c/d/e/f"},
+		{"/a/b/c", "../../../etc/shadow", "/a/b/c/etc/shadow"},
+
+		{"./a/b/c", "", "a/b/c"},
+		{"./a/b/c", ".", "a/b/c"},
+		{"./a/b/c", "d/e/f", "a/b/c/d/e/f"},
+		{"./a/b/c", "./d/e/f", "a/b/c/d/e/f"},
+		{"./a/b/c", "../d/e/f", "a/b/c/d/e/f"},
+		{"./a/b/c", "../../../etc/shadow", "a/b/c/etc/shadow"},
+
+		{"../a/b/c", "", "../a/b/c"},
+		{"../a/b/c", ".", "../a/b/c"},
+		{"../a/b/c", "d/e/f", "../a/b/c/d/e/f"},
+		{"../a/b/c", "./d/e/f", "../a/b/c/d/e/f"},
+		{"../a/b/c", "../d/e/f", "../a/b/c/d/e/f"},
+		{"../a/b/c", "../../../etc/shadow", "../a/b/c/etc/shadow"},
+	}
+
+	for _, c := range ts {
+		r := JoinPaths(c.trusted, c.untrusted)
+		if r != c.expected {
+			t.Fatalf("expected '%s', got '%s'. Inputs = '%s', '%s'", c.expected, r, c.trusted, c.untrusted)
+		}
+	}
+}
diff --git a/api/filesystem/filesystem_move_test.go b/api/filesystem/filesystem_move_test.go
new file mode 100644
index 0000000..e8a5354
--- /dev/null
+++ b/api/filesystem/filesystem_move_test.go
@@ -0,0 +1,97 @@
+package filesystem
+
+import (
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+var content = []byte("content")
+
+func Test_movePath_shouldFailIfSourceDirDoesNotExist(t *testing.T) {
+	t.Parallel()
+	sourceDir := "missing"
+	destinationDir := t.TempDir()
+	file1 := addFile(t, destinationDir, "dir", "file")
+	file2 := addFile(t, destinationDir, "file")
+
+	err := MoveDirectory(sourceDir, destinationDir, false)
+	require.Error(t, err, "move directory should fail when source path is missing")
+	assert.FileExists(t, file1, "destination dir contents should remain")
+	assert.FileExists(t, file2, "destination dir contents should remain")
+}
+
+func Test_movePath_shouldFailIfDestinationDirExists(t *testing.T) {
+	t.Parallel()
+	sourceDir := t.TempDir()
+	file1 := addFile(t, sourceDir, "dir", "file")
+	file2 := addFile(t, sourceDir, "file")
+	destinationDir := t.TempDir()
+	file3 := addFile(t, destinationDir, "dir", "file")
+	file4 := addFile(t, destinationDir, "file")
+
+	err := MoveDirectory(sourceDir, destinationDir, false)
+	require.Error(t, err, "move directory should fail when destination directory already exists")
+	assert.FileExists(t, file1, "source dir contents should remain")
+	assert.FileExists(t, file2, "source dir contents should remain")
+	assert.FileExists(t, file3, "destination dir contents should remain")
+	assert.FileExists(t, file4, "destination dir contents should remain")
+}
+
+func Test_movePath_succesIfOverwriteSetWhenDestinationDirExists(t *testing.T) {
+	t.Parallel()
+	sourceDir := t.TempDir()
+	file1 := addFile(t, sourceDir, "dir", "file")
+	file2 := addFile(t, sourceDir, "file")
+	destinationDir := t.TempDir()
+	file3 := addFile(t, destinationDir, "dir", "file")
+	file4 := addFile(t, destinationDir, "file")
+
+	err := MoveDirectory(sourceDir, destinationDir, true)
+	require.NoError(t, err)
+	assert.NoFileExists(t, file1, "source dir contents should be moved")
+	assert.NoFileExists(t, file2, "source dir contents should be moved")
+	assert.FileExists(t, file3, "destination dir contents should remain")
+	assert.FileExists(t, file4, "destination dir contents should remain")
+}
+
+func Test_movePath_successWhenSourceExistsAndDestinationIsMissing(t *testing.T) {
+	t.Parallel()
+	tmp := t.TempDir()
+	sourceDir := JoinPaths(tmp, "source")
+	err := os.Mkdir(sourceDir, 0766)
+	require.NoError(t, err)
+
+	file1 := addFile(t, sourceDir, "dir", "file")
+	file2 := addFile(t, sourceDir, "file")
+	destinationDir := JoinPaths(tmp, "destination")
+
+	err = MoveDirectory(sourceDir, destinationDir, false)
+	require.NoError(t, err)
+	assert.NoFileExists(t, file1, "source dir contents should be moved")
+	assert.NoFileExists(t, file2, "source dir contents should be moved")
+	assertFileContent(t, JoinPaths(destinationDir, "file"))
+	assertFileContent(t, JoinPaths(destinationDir, "dir", "file"))
+}
+
+func addFile(t *testing.T, fileParts ...string) (filepath string) {
+	if len(fileParts) > 2 {
+		dir := JoinPaths(fileParts[0], fileParts[1:len(fileParts)-1]...)
+		err := os.MkdirAll(dir, 0766)
+		require.NoError(t, err)
+	}
+
+	p := JoinPaths(fileParts[0], fileParts[1:]...)
+	err := os.WriteFile(p, content, 0766)
+	require.NoError(t, err)
+
+	return p
+}
+
+func assertFileContent(t *testing.T, filePath string) {
+	actualContent, err := os.ReadFile(filePath)
+	require.NoError(t, err, "failed to read file %s", filePath)
+	assert.Equal(t, content, actualContent, "file %s content doesn't match", filePath)
+}
diff --git a/api/filesystem/filesystem_test.go b/api/filesystem/filesystem_test.go
new file mode 100644
index 0000000..e2a702f
--- /dev/null
+++ b/api/filesystem/filesystem_test.go
@@ -0,0 +1,22 @@
+package filesystem
+
+import (
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func createService(t *testing.T) *Service {
+	dataStorePath := JoinPaths(t.TempDir(), t.Name())
+
+	service, err := NewService(dataStorePath, "")
+	require.NoError(t, err, "NewService should not fail")
+
+	t.Cleanup(func() {
+		err := os.RemoveAll(dataStorePath)
+		require.NoError(t, err)
+	})
+
+	return service
+}
diff --git a/api/filesystem/filesystem_windows_test.go b/api/filesystem/filesystem_windows_test.go
new file mode 100644
index 0000000..06f8378
--- /dev/null
+++ b/api/filesystem/filesystem_windows_test.go
@@ -0,0 +1,121 @@
+package filesystem
+
+import "testing"
+
+func TestJoinPaths(t *testing.T) {
+	t.Parallel()
+	var ts = []struct {
+		trusted   string
+		untrusted string
+		expected  string
+	}{
+		{"", "", "."},
+		{"", ".", "."},
+		{"", "d/e/f", `d\e\f`},
+		{"", "./d/e/f", `d\e\f`},
+		{"", "../d/e/f", `d\e\f`},
+		{"", "/d/e/f", `d\e\f`},
+		{"", "../../../windows/system.ini", `windows\system.ini`},
+		{"", `C:\windows\system.ini`, `windows\system.ini`},
+		{"", `..\..\..\..\C:\windows\system.ini`, `windows\system.ini`},
+		{"", `\\server\a\b\c`, `server\a\b\c`},
+		{"", `..\..\..\..\\server\a\b\c`, `server\a\b\c`},
+
+		{".", "", "."},
+		{".", ".", "."},
+		{".", "d/e/f", `d\e\f`},
+		{".", "./d/e/f", `d\e\f`},
+		{".", "../d/e/f", `d\e\f`},
+		{".", "/d/e/f", `d\e\f`},
+		{".", "../../../windows/system.ini", `windows\system.ini`},
+		{".", `C:\windows\system.ini`, `windows\system.ini`},
+		{".", `..\..\..\..\C:\windows\system.ini`, `windows\system.ini`},
+		{".", `\\server\a\b\c`, `server\a\b\c`},
+		{".", `..\..\..\..\\server\a\b\c`, `server\a\b\c`},
+
+		{"./", "", "."},
+		{"./", ".", "."},
+		{"./", "d/e/f", `d\e\f`},
+		{"./", "./d/e/f", `d\e\f`},
+		{"./", "../d/e/f", `d\e\f`},
+		{"./", "/d/e/f", `d\e\f`},
+		{"./", "../../../windows/system.ini", `windows\system.ini`},
+		{"./", `C:\windows\system.ini`, `windows\system.ini`},
+		{"./", `..\..\..\..\C:\windows\system.ini`, `windows\system.ini`},
+		{"./", `\\server\a\b\c`, `server\a\b\c`},
+		{"./", `..\..\..\..\\server\a\b\c`, `server\a\b\c`},
+
+		{"a/b/c", "", `a\b\c`},
+		{"a/b/c", ".", `a\b\c`},
+		{"a/b/c", "d/e/f", `a\b\c\d\e\f`},
+		{"a/b/c", "./d/e/f", `a\b\c\d\e\f`},
+		{"a/b/c", "../d/e/f", `a\b\c\d\e\f`},
+		{"a/b/c", "../../../windows/system.ini", `a\b\c\windows\system.ini`},
+		{"a/b/c", `C:\windows\system.ini`, `a\b\c\C:\windows\system.ini`},
+		{"a/b/c", `..\..\..\..\C:\windows\system.ini`, `a\b\c\C:\windows\system.ini`},
+		{"a/b/c", `\\server\a\b\c`, `a\b\c\server\a\b\c`},
+		{"a/b/c", `..\..\..\..\\server\a\b\c`, `a\b\c\server\a\b\c`},
+
+		{"/a/b/c", "", `\a\b\c`},
+		{"/a/b/c", ".", `\a\b\c`},
+		{"/a/b/c", "d/e/f", `\a\b\c\d\e\f`},
+		{"/a/b/c", "./d/e/f", `\a\b\c\d\e\f`},
+		{"/a/b/c", "../d/e/f", `\a\b\c\d\e\f`},
+		{"/a/b/c", "../../../windows/system.ini", `\a\b\c\windows\system.ini`},
+		{"/a/b/c", `C:\windows\system.ini`, `\a\b\c\C:\windows\system.ini`},
+		{"/a/b/c", `..\..\..\..\C:\windows\system.ini`, `\a\b\c\C:\windows\system.ini`},
+		{"/a/b/c", `\\server\a\b\c`, `\a\b\c\server\a\b\c`},
+		{"/a/b/c", `..\..\..\..\\server\a\b\c`, `\a\b\c\server\a\b\c`},
+
+		{"./a/b/c", "", `a\b\c`},
+		{"./a/b/c", ".", `a\b\c`},
+		{"./a/b/c", "d/e/f", `a\b\c\d\e\f`},
+		{"./a/b/c", "./d/e/f", `a\b\c\d\e\f`},
+		{"./a/b/c", "../d/e/f", `a\b\c\d\e\f`},
+		{"./a/b/c", "../../../windows/system.ini", `a\b\c\windows\system.ini`},
+		{"./a/b/c", `C:\windows\system.ini`, `a\b\c\C:\windows\system.ini`},
+		{"./a/b/c", `..\..\..\..\C:\windows\system.ini`, `a\b\c\C:\windows\system.ini`},
+		{"./a/b/c", `\\server\a\b\c`, `a\b\c\server\a\b\c`},
+		{"./a/b/c", `..\..\..\..\\server\a\b\c`, `a\b\c\server\a\b\c`},
+
+		{"../a/b/c", "", `..\a\b\c`},
+		{"../a/b/c", ".", `..\a\b\c`},
+		{"../a/b/c", "d/e/f", `..\a\b\c\d\e\f`},
+		{"../a/b/c", "./d/e/f", `..\a\b\c\d\e\f`},
+		{"../a/b/c", "../d/e/f", `..\a\b\c\d\e\f`},
+		{"../a/b/c", "../../../windows/system.ini", `..\a\b\c\windows\system.ini`},
+		{"../a/b/c", `C:\windows\system.ini`, `..\a\b\c\C:\windows\system.ini`},
+		{"../a/b/c", `..\..\..\..\C:\windows\system.ini`, `..\a\b\c\C:\windows\system.ini`},
+		{"../a/b/c", `\\server\a\b\c`, `..\a\b\c\server\a\b\c`},
+		{"../a/b/c", `..\..\..\..\\server\a\b\c`, `..\a\b\c\server\a\b\c`},
+
+		{"C:/a/b/c", "", `C:\a\b\c`},
+		{"C:/a/b/c", ".", `C:\a\b\c`},
+		{"C:/a/b/c", "d/e/f", `C:\a\b\c\d\e\f`},
+		{"C:/a/b/c", "./d/e/f", `C:\a\b\c\d\e\f`},
+		{"C:/a/b/c", "../d/e/f", `C:\a\b\c\d\e\f`},
+		{"C:/a/b/c", "../../../windows/system.ini", `C:\a\b\c\windows\system.ini`},
+		{"C:/a/b/c", `C:\windows\system.ini`, `C:\a\b\c\C:\windows\system.ini`},
+		{"C:/a/b/c", `..\..\..\..\C:\windows\system.ini`, `C:\a\b\c\C:\windows\system.ini`},
+		{"C:/a/b/c", `\\server\a\b\c`, `C:\a\b\c\server\a\b\c`},
+		{"C:/a/b/c", `..\..\..\..\\server\a\b\c`, `C:\a\b\c\server\a\b\c`},
+
+		{`\\server\a\b\c`, "", `\\server\a\b\c`},
+		{`\\server\a\b\c`, ".", `\\server\a\b\c`},
+		{`\\server\a\b\c`, "d/e/f", `\\server\a\b\c\d\e\f`},
+		{`\\server\a\b\c`, "./d/e/f", `\\server\a\b\c\d\e\f`},
+		{`\\server\a\b\c`, "../d/e/f", `\\server\a\b\c\d\e\f`},
+		{`\\server\a\b\c`, "../../../windows/system.ini", `\\server\a\b\c\windows\system.ini`},
+		{`\\server\a\b\c`, `C:\windows\system.ini`, `\\server\a\b\c\C:\windows\system.ini`},
+		{`\\server\a\b\c`, `..\..\..\C:\windows\system.ini`, `\\server\a\b\c\C:\windows\system.ini`},
+		{`\\server\a\b\c`, `\\server\a\b\c`, `\\server\a\b\c\server\a\b\c`},
+		{`\\server\a\b\c`, `..\..\..\\server\a\b\c`, `\\server\a\b\c\server\a\b\c`},
+	}
+
+	for _, c := range ts {
+		r := JoinPaths(c.trusted, c.untrusted)
+		if r != c.expected {
+			t.Fatalf("expected '%s', got '%s'. Inputs = '%s', '%s'", c.expected, r, c.trusted, c.untrusted)
+		}
+	}
+}
diff --git a/api/filesystem/serialize.go b/api/filesystem/serialize.go
new file mode 100644
index 0000000..8dfeca2
--- /dev/null
+++ b/api/filesystem/serialize.go
@@ -0,0 +1,185 @@
+package filesystem
+
+import (
+	"encoding/base64"
+	"fmt"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+
+	"golang.org/x/mod/semver"
+)
+
+type DirEntry struct {
+	Name        string
+	Content     string
+	IsFile      bool
+	Permissions os.FileMode `swaggertype:"integer"`
+}
+
+// FilterDirForEntryFile filers the given dirEntries, returns entries of the entryFile and .env file
+func FilterDirForEntryFile(dirEntries []DirEntry, entryFile string) []DirEntry {
+	var filteredDirEntries []DirEntry
+
+	dotEnvFile := filepath.Join(filepath.Dir(entryFile), ".env")
+	filters := []string{entryFile, dotEnvFile}
+
+	for _, dirEntry := range dirEntries {
+		match := false
+		if dirEntry.IsFile {
+			if slices.Contains(filters, dirEntry.Name) {
+				match = true
+			}
+		} else {
+			for _, filter := range filters {
+				if strings.HasPrefix(filter, dirEntry.Name) {
+					match = true
+					break
+				}
+			}
+		}
+		if match {
+			filteredDirEntries = append(filteredDirEntries, dirEntry)
+		}
+	}
+
+	return filteredDirEntries
+}
+
+// FilterDirForCompatibility returns the content of the entry file if agent version is less than 2.19.0
+func FilterDirForCompatibility(dirEntries []DirEntry, entryFilePath, agentVersion string) (string, error) {
+	if semver.Compare("v"+agentVersion, "v2.19.0") == -1 {
+		for _, dirEntry := range dirEntries {
+			if dirEntry.IsFile {
+				if dirEntry.Name == entryFilePath {
+					return DecodeFileContent(dirEntry.Content)
+				}
+			}
+		}
+		return "", fmt.Errorf("Entry file %s not found in dir entries", entryFilePath)
+	}
+
+	return "", nil
+}
+
+// LoadDir reads all files and folders recursively from the given directory
+// File content is base64-encoded
+func LoadDir(dir string) ([]DirEntry, error) {
+	var dirEntries []DirEntry
+
+	err := filepath.WalkDir(
+		dir,
+		func(path string, d os.DirEntry, err error) error {
+			if err != nil {
+				return err
+			}
+
+			fileInfo, err := d.Info()
+			if err != nil {
+				return err
+			}
+
+			relativePath, err := filepath.Rel(dir, path)
+			if err != nil {
+				return err
+			}
+			if relativePath == "." {
+				return nil
+			}
+
+			dirEntry := DirEntry{
+				Name:        relativePath,
+				Permissions: fileInfo.Mode().Perm(),
+			}
+
+			if !fileInfo.IsDir() {
+				// Read file contents
+				fileContent, err := os.ReadFile(path)
+				if err != nil {
+					return err
+				}
+
+				dirEntry.Content = base64.StdEncoding.EncodeToString(fileContent)
+				dirEntry.IsFile = true
+			}
+
+			dirEntries = append(dirEntries, dirEntry)
+			return nil
+		})
+
+	if err != nil {
+		return nil, err
+	}
+
+	return dirEntries, nil
+}
+
+// PersistDir writes the provided array of files and folders back to the given directory.
+func PersistDir(dir string, dirEntries []DirEntry) error {
+	for _, dirEntry := range dirEntries {
+		path := filepath.Join(dir, dirEntry.Name)
+
+		if dirEntry.IsFile {
+			// Create the directory path if it doesn't exist
+			err := os.MkdirAll(filepath.Dir(path), 0744)
+			if err != nil {
+				return err
+			}
+
+			// Write file contents
+			err = os.WriteFile(path, []byte(dirEntry.Content), dirEntry.Permissions)
+			if err != nil {
+				return err
+			}
+		} else {
+			// Create the directory
+			err := os.MkdirAll(path, dirEntry.Permissions)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
+
+func DecodeFileContent(encodedFileContent string) (string, error) {
+	decodedBytes, err := base64.StdEncoding.DecodeString(encodedFileContent)
+	if err != nil {
+		return "", err
+	}
+	return string(decodedBytes), nil
+}
+
+func DecodeDirEntries(dirEntries []DirEntry) error {
+	for index, dirEntry := range dirEntries {
+		if dirEntry.IsFile && dirEntry.Content != "" {
+			decodedFile, err := DecodeFileContent(dirEntry.Content)
+			if err != nil {
+				return err
+			}
+			dirEntries[index].Content = decodedFile
+		}
+	}
+
+	return nil
+}
+
+// GetDirEntriesByFilenames returns the dir entries that are files and match the provided filenames
+func GetDirEntriesByFilenames(dirEntries []DirEntry, names []string) []DirEntry {
+	var filteredDirEntries []DirEntry
+
+	for _, dirEntry := range dirEntries {
+		if !dirEntry.IsFile {
+			continue
+		}
+		for _, name := range names {
+			if dirEntry.Name == name {
+				filteredDirEntries = append(filteredDirEntries, dirEntry)
+			}
+		}
+	}
+
+	return filteredDirEntries
+}
diff --git a/api/filesystem/serialize_per_dev_configs.go b/api/filesystem/serialize_per_dev_configs.go
new file mode 100644
index 0000000..d603ec7
--- /dev/null
+++ b/api/filesystem/serialize_per_dev_configs.go
@@ -0,0 +1,156 @@
+package filesystem
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+)
+
+type MultiFilterArgs []struct {
+	FilterKey  string
+	FilterType portainer.PerDevConfigsFilterType
+}
+
+// MultiFilterDirForPerDevConfigs filers the given dirEntries with multiple filter args, returns the merged entries for the given device
+func MultiFilterDirForPerDevConfigs(dirEntries []DirEntry, configPath string, multiFilterArgs MultiFilterArgs) ([]DirEntry, []string) {
+	var filteredDirEntries []DirEntry
+
+	var envFiles []string
+
+	for _, multiFilterArg := range multiFilterArgs {
+		tmp, efs := FilterDirForPerDevConfigs(dirEntries, multiFilterArg.FilterKey, configPath, multiFilterArg.FilterType)
+		filteredDirEntries = append(filteredDirEntries, tmp...)
+
+		envFiles = append(envFiles, efs...)
+	}
+
+	return deduplicate(filteredDirEntries), envFiles
+}
+
+// MultiFilterDirForPerDevConfigsWithDefaults filers the given dirEntries with multiple filter args, returns the merged entries for the given device
+// and always includes the defaultFilenames
+func MultiFilterDirForPerDevConfigsWithDefaults(dirEntries []DirEntry, configPath string, multiFilterArgs MultiFilterArgs, defaultFilenames []string) ([]DirEntry, []string) {
+
+	filteredDirEntries, envFiles := MultiFilterDirForPerDevConfigs(dirEntries, configPath, multiFilterArgs)
+
+	// Add files that should always be included
+	// e.g. entrypoint files
+	defaultDirEntries := GetDirEntriesByFilenames(dirEntries, defaultFilenames)
+	filteredDirEntries = append(filteredDirEntries, defaultDirEntries...)
+
+	return deduplicate(filteredDirEntries), envFiles
+}
+
+func deduplicate(dirEntries []DirEntry) []DirEntry {
+	var deduplicatedDirEntries []DirEntry
+
+	marks := make(map[string]struct{})
+
+	for _, dirEntry := range dirEntries {
+		if _, ok := marks[dirEntry.Name]; !ok {
+			marks[dirEntry.Name] = struct{}{}
+			deduplicatedDirEntries = append(deduplicatedDirEntries, dirEntry)
+		}
+	}
+
+	return deduplicatedDirEntries
+}
+
+// FilterDirForPerDevConfigs filers the given dirEntries, returns entries for the given device
+// For given configPath A/B/C, return entries:
+//  1. all entries outside of dir A/B/C
+//  2. For filterType file:
+//     file entries: A/B/C/<deviceName> and A/B/C/<deviceName>.*
+//  3. For filterType dir:
+//     dir entry:   A/B/C/<deviceName>
+//     all entries: A/B/C/<deviceName>/*
+func FilterDirForPerDevConfigs(dirEntries []DirEntry, deviceName, configPath string, filterType portainer.PerDevConfigsFilterType) ([]DirEntry, []string) {
+	var filteredDirEntries []DirEntry
+
+	var envFiles []string
+
+	for _, dirEntry := range dirEntries {
+		if shouldIncludeEntry(dirEntry, deviceName, configPath, filterType) {
+			filteredDirEntries = append(filteredDirEntries, dirEntry)
+
+			if shouldParseEnvVars(dirEntry, deviceName, configPath, filterType) {
+				envFiles = append(envFiles, dirEntry.Name)
+			}
+		}
+	}
+
+	return filteredDirEntries, envFiles
+}
+
+func shouldIncludeEntry(dirEntry DirEntry, deviceName, configPath string, filterType portainer.PerDevConfigsFilterType) bool {
+	// Include all entries outside of dir A
+	if !isInConfigDir(dirEntry, configPath) {
+		return true
+	}
+
+	if filterType == portainer.PerDevConfigsTypeFile {
+		// Include file entries A/B/C/<deviceName> or A/B/C/<deviceName>.*
+		return shouldIncludeFile(dirEntry, deviceName, configPath)
+	}
+
+	if filterType == portainer.PerDevConfigsTypeDir {
+		// Include:
+		// dir entry A/B/C/<deviceName>
+		// all entries A/B/C/<deviceName>/*
+		return shouldIncludeDir(dirEntry, deviceName, configPath)
+	}
+
+	return false
+}
+
+func isInConfigDir(dirEntry DirEntry, configPath string) bool {
+	// return true if entry name starts with "A/B"
+	return strings.HasPrefix(dirEntry.Name, appendTailSeparator(configPath))
+}
+
+func shouldIncludeFile(dirEntry DirEntry, deviceName, configPath string) bool {
+	if !dirEntry.IsFile {
+		return false
+	}
+
+	// example: A/B/C/<deviceName>
+	filterEqual := filepath.Join(configPath, deviceName)
+
+	// example: A/B/C/<deviceName>/
+	filterPrefix := filterEqual + "."
+
+	// include file entries: A/B/C/<deviceName> or A/B/C/<deviceName>.*
+	return dirEntry.Name == filterEqual || strings.HasPrefix(dirEntry.Name, filterPrefix)
+}
+
+func shouldIncludeDir(dirEntry DirEntry, deviceName, configPath string) bool {
+	// example: A/B/C/'/<deviceName>
+	filterEqual := filepath.Join(configPath, deviceName)
+
+	// example: A/B/C/<deviceName>/
+	filterPrefix := appendTailSeparator(filterEqual)
+
+	// include dir entry: A/B/C/<deviceName>
+	if !dirEntry.IsFile && dirEntry.Name == filterEqual {
+		return true
+	}
+
+	// include all entries A/B/C/<deviceName>/*
+	return strings.HasPrefix(dirEntry.Name, filterPrefix)
+}
+
+func shouldParseEnvVars(dirEntry DirEntry, deviceName, configPath string, filterType portainer.PerDevConfigsFilterType) bool {
+	if !dirEntry.IsFile {
+		return false
+	}
+
+	return isInConfigDir(dirEntry, configPath) &&
+		filepath.Base(dirEntry.Name) == deviceName+".env"
+}
+
+func appendTailSeparator(path string) string {
+	return fmt.Sprintf("%s%c", path, os.PathSeparator)
+}
diff --git a/api/filesystem/serialize_per_dev_configs_test.go b/api/filesystem/serialize_per_dev_configs_test.go
new file mode 100644
index 0000000..84e739a
--- /dev/null
+++ b/api/filesystem/serialize_per_dev_configs_test.go
@@ -0,0 +1,242 @@
+package filesystem
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestMultiFilterDirForPerDevConfigs(t *testing.T) {
+	t.Parallel()
+	f := func(dirEntries []DirEntry, configPath string, multiFilterArgs MultiFilterArgs, wantDirEntries []DirEntry) {
+		t.Helper()
+
+		dirEntries, _ = MultiFilterDirForPerDevConfigs(dirEntries, configPath, multiFilterArgs)
+		require.Equal(t, wantDirEntries, dirEntries)
+	}
+
+	baseDirEntries := []DirEntry{
+		{".env", "", true, 420},
+		{"docker-compose.yaml", "", true, 420},
+		{"configs", "", false, 420},
+		{"configs/file1.conf", "", true, 420},
+		{"configs/file2.conf", "", true, 420},
+		{"configs/folder1", "", false, 420},
+		{"configs/folder1/config1", "", true, 420},
+		{"configs/folder2", "", false, 420},
+		{"configs/folder2/config2", "", true, 420},
+	}
+
+	// Filter file1
+	f(
+		baseDirEntries,
+		"configs",
+		MultiFilterArgs{{"file1", portainer.PerDevConfigsTypeFile}},
+		[]DirEntry{baseDirEntries[0], baseDirEntries[1], baseDirEntries[2], baseDirEntries[3]},
+	)
+
+	// Filter folder1
+	f(
+		baseDirEntries,
+		"configs",
+		MultiFilterArgs{{"folder1", portainer.PerDevConfigsTypeDir}},
+		[]DirEntry{baseDirEntries[0], baseDirEntries[1], baseDirEntries[2], baseDirEntries[5], baseDirEntries[6]},
+	)
+
+	// Filter file1 and folder1
+	f(
+		baseDirEntries,
+		"configs",
+		MultiFilterArgs{
+			{"file1", portainer.PerDevConfigsTypeFile},
+			{"folder1", portainer.PerDevConfigsTypeDir},
+		},
+		[]DirEntry{baseDirEntries[0], baseDirEntries[1], baseDirEntries[2], baseDirEntries[3], baseDirEntries[5], baseDirEntries[6]},
+	)
+
+	// Filter file1 and file2
+	f(
+		baseDirEntries,
+		"configs",
+		MultiFilterArgs{
+			{"file1", portainer.PerDevConfigsTypeFile},
+			{"file2", portainer.PerDevConfigsTypeFile},
+		},
+		[]DirEntry{baseDirEntries[0], baseDirEntries[1], baseDirEntries[2], baseDirEntries[3], baseDirEntries[4]},
+	)
+
+	// Filter folder1 and folder2
+	f(
+		baseDirEntries,
+		"configs",
+		MultiFilterArgs{
+			{"folder1", portainer.PerDevConfigsTypeDir},
+			{"folder2", portainer.PerDevConfigsTypeDir},
+		},
+		[]DirEntry{baseDirEntries[0], baseDirEntries[1], baseDirEntries[2], baseDirEntries[5], baseDirEntries[6], baseDirEntries[7], baseDirEntries[8]},
+	)
+}
+
+func TestMultiFilterDirForPerDevConfigsWithDefaults(t *testing.T) {
+	t.Parallel()
+	f := func(dirEntries []DirEntry, configPath string, multiFilterArgs MultiFilterArgs, defaultFilenames []string, wantDirEntries []DirEntry) {
+		t.Helper()
+
+		dirEntries, _ = MultiFilterDirForPerDevConfigsWithDefaults(dirEntries, configPath, multiFilterArgs, defaultFilenames)
+		require.Equal(t, wantDirEntries, dirEntries)
+	}
+
+	baseDirEntries := []DirEntry{
+		{".env", "", true, 420},
+		{"docker-compose.yaml", "", true, 420},
+		{"configs", "", false, 420},
+		{"configs/file1.conf", "", true, 420},
+		{"configs/file2.conf", "", true, 420},
+		{"configs/folder1", "", false, 420},
+		{"configs/folder1/config1", "", true, 420},
+		{"configs/folder2", "", false, 420},
+		{"configs/folder2/config2", "", true, 420},
+		{"configs/docker-compose-2.yaml", "", true, 420},
+		{"configs/folder2/docker-compose-3.yaml", "", true, 420},
+	}
+
+	// Filter file1
+	f(
+		baseDirEntries,
+		"configs",
+		MultiFilterArgs{{"file1", portainer.PerDevConfigsTypeFile}},
+		nil,
+		[]DirEntry{baseDirEntries[0], baseDirEntries[1], baseDirEntries[2], baseDirEntries[3]},
+	)
+
+	// Filter folder1
+	f(
+		baseDirEntries,
+		"configs",
+		MultiFilterArgs{{"folder1", portainer.PerDevConfigsTypeDir}},
+		nil,
+		[]DirEntry{baseDirEntries[0], baseDirEntries[1], baseDirEntries[2], baseDirEntries[5], baseDirEntries[6]},
+	)
+
+	// Filter file1 and folder1
+	f(
+		baseDirEntries,
+		"configs",
+		MultiFilterArgs{
+			{"file1", portainer.PerDevConfigsTypeFile},
+			{"folder1", portainer.PerDevConfigsTypeDir},
+		},
+		nil,
+		[]DirEntry{baseDirEntries[0], baseDirEntries[1], baseDirEntries[2], baseDirEntries[3], baseDirEntries[5], baseDirEntries[6]},
+	)
+
+	// Filter file1 and file2
+	f(
+		baseDirEntries,
+		"configs",
+		MultiFilterArgs{
+			{"file1", portainer.PerDevConfigsTypeFile},
+			{"file2", portainer.PerDevConfigsTypeFile},
+		},
+		nil,
+		[]DirEntry{baseDirEntries[0], baseDirEntries[1], baseDirEntries[2], baseDirEntries[3], baseDirEntries[4]},
+	)
+
+	// Filter folder1 and folder2
+	f(
+		baseDirEntries,
+		"configs",
+		MultiFilterArgs{
+			{"folder1", portainer.PerDevConfigsTypeDir},
+			{"folder2", portainer.PerDevConfigsTypeDir},
+		},
+		nil,
+		[]DirEntry{baseDirEntries[0], baseDirEntries[1], baseDirEntries[2], baseDirEntries[5], baseDirEntries[6], baseDirEntries[7], baseDirEntries[8], baseDirEntries[10]},
+	)
+
+	// Filter file1 and folder1 and docker-compose-2.yaml
+	f(
+		baseDirEntries,
+		"configs",
+		MultiFilterArgs{
+			{"file1", portainer.PerDevConfigsTypeFile},
+			{"folder1", portainer.PerDevConfigsTypeDir},
+		},
+		[]string{"configs/docker-compose-2.yaml"},
+		[]DirEntry{baseDirEntries[0], baseDirEntries[1], baseDirEntries[2], baseDirEntries[3], baseDirEntries[5], baseDirEntries[6], baseDirEntries[9]},
+	)
+
+	// Filter file1 and docker-compose-3.yaml
+	f(
+		baseDirEntries,
+		"configs",
+		MultiFilterArgs{
+			{"file1", portainer.PerDevConfigsTypeFile},
+		},
+		[]string{"configs/folder2/docker-compose-3.yaml"},
+		[]DirEntry{baseDirEntries[0], baseDirEntries[1], baseDirEntries[2], baseDirEntries[3], baseDirEntries[10]},
+	)
+}
+
+func TestMultiFilterDirForPerDevConfigsEnvFiles(t *testing.T) {
+	t.Parallel()
+	f := func(dirEntries []DirEntry, configPath string, multiFilterArgs MultiFilterArgs, wantEnvFiles []string) {
+		t.Helper()
+
+		_, envFiles := MultiFilterDirForPerDevConfigs(dirEntries, configPath, multiFilterArgs)
+		require.Equal(t, wantEnvFiles, envFiles)
+	}
+
+	baseDirEntries := []DirEntry{
+		{".env", "", true, 420},
+		{"docker-compose.yaml", "", true, 420},
+		{"configs", "", false, 420},
+		{"configs/edge-id/edge-id.env", "", true, 420},
+	}
+
+	f(
+		baseDirEntries,
+		"configs",
+		MultiFilterArgs{{"edge-id", portainer.PerDevConfigsTypeDir}},
+		[]string{"configs/edge-id/edge-id.env"},
+	)
+
+}
+
+func TestIsInConfigDir(t *testing.T) {
+	t.Parallel()
+	f := func(dirEntry DirEntry, configPath string, expect bool) {
+		t.Helper()
+
+		actual := isInConfigDir(dirEntry, configPath)
+		assert.Equal(t, expect, actual)
+	}
+
+	f(DirEntry{Name: "edge-configs"}, "edge-configs", false)
+	f(DirEntry{Name: "edge-configs_backup"}, "edge-configs", false)
+	f(DirEntry{Name: "edge-configs/standalone-edge-agent-standard"}, "edge-configs", true)
+	f(DirEntry{Name: "parent/edge-configs/"}, "edge-configs", false)
+	f(DirEntry{Name: "edgestacktest"}, "edgestacktest/edge-configs", false)
+	f(DirEntry{Name: "edgestacktest/edgeconfigs-test.yaml"}, "edgestacktest/edge-configs", false)
+	f(DirEntry{Name: "edgestacktest/file1.conf"}, "edgestacktest/edge-configs", false)
+	f(DirEntry{Name: "edgeconfigs-test.yaml"}, "edgestacktest/edge-configs", false)
+	f(DirEntry{Name: "edgestacktest/edge-configs"}, "edgestacktest/edge-configs", false)
+	f(DirEntry{Name: "edgestacktest/edge-configs/standalone-edge-agent-async"}, "edgestacktest/edge-configs", true)
+	f(DirEntry{Name: "edgestacktest/edge-configs/abc.txt"}, "edgestacktest/edge-configs", true)
+}
+
+func TestShouldIncludeDir(t *testing.T) {
+	t.Parallel()
+	f := func(dirEntry DirEntry, deviceName, configPath string, expect bool) {
+		t.Helper()
+
+		actual := shouldIncludeDir(dirEntry, deviceName, configPath)
+		assert.Equal(t, expect, actual)
+	}
+
+	f(DirEntry{Name: "app/blue-app", IsFile: false}, "blue-app", "app", true)
+	f(DirEntry{Name: "app/blue-app/values.yaml", IsFile: true}, "blue-app", "app", true)
+}
diff --git a/api/filesystem/testdata/copy_test/dir/.dotfile b/api/filesystem/testdata/copy_test/dir/.dotfile
new file mode 100644
index 0000000..d95f3ad
--- /dev/null
+++ b/api/filesystem/testdata/copy_test/dir/.dotfile
@@ -0,0 +1 @@
+content
diff --git a/api/filesystem/testdata/copy_test/dir/inner b/api/filesystem/testdata/copy_test/dir/inner
new file mode 100644
index 0000000..d95f3ad
--- /dev/null
+++ b/api/filesystem/testdata/copy_test/dir/inner
@@ -0,0 +1 @@
+content
diff --git a/api/filesystem/testdata/copy_test/outer b/api/filesystem/testdata/copy_test/outer
new file mode 100644
index 0000000..d95f3ad
--- /dev/null
+++ b/api/filesystem/testdata/copy_test/outer
@@ -0,0 +1 @@
+content
diff --git a/api/filesystem/write.go b/api/filesystem/write.go
new file mode 100644
index 0000000..be8cf7d
--- /dev/null
+++ b/api/filesystem/write.go
@@ -0,0 +1,25 @@
+package filesystem
+
+import (
+	"os"
+	"path/filepath"
+
+	"github.com/pkg/errors"
+	"github.com/portainer/portainer/api/logs"
+)
+
+// WriteToFile creates a file in the filesystem storage
+func WriteToFile(dst string, content []byte) error {
+	if err := os.MkdirAll(filepath.Dir(dst), 0744); err != nil {
+		return errors.Wrapf(err, "failed to create filestructure for the path %q", dst)
+	}
+
+	file, err := os.Create(dst)
+	if err != nil {
+		return errors.Wrapf(err, "failed to open a file %q", dst)
+	}
+	defer logs.CloseAndLogErr(file)
+
+	_, err = file.Write(content)
+	return errors.Wrapf(err, "failed to write a file %q", dst)
+}
diff --git a/api/filesystem/write_test.go b/api/filesystem/write_test.go
new file mode 100644
index 0000000..7a75625
--- /dev/null
+++ b/api/filesystem/write_test.go
@@ -0,0 +1,51 @@
+package filesystem
+
+import (
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_WriteFile_CanStoreContentInANewFile(t *testing.T) {
+	t.Parallel()
+	tmpDir := t.TempDir()
+	tmpFilePath := JoinPaths(tmpDir, "dummy")
+
+	content := []byte("content")
+	err := WriteToFile(tmpFilePath, content)
+	require.NoError(t, err)
+
+	fileContent, _ := os.ReadFile(tmpFilePath)
+	assert.Equal(t, content, fileContent)
+}
+
+func Test_WriteFile_CanOverwriteExistingFile(t *testing.T) {
+	t.Parallel()
+	tmpDir := t.TempDir()
+	tmpFilePath := JoinPaths(tmpDir, "dummy")
+
+	err := WriteToFile(tmpFilePath, []byte("content"))
+	require.NoError(t, err)
+
+	content := []byte("new content")
+	err = WriteToFile(tmpFilePath, content)
+	require.NoError(t, err)
+
+	fileContent, _ := os.ReadFile(tmpFilePath)
+	assert.Equal(t, content, fileContent)
+}
+
+func Test_WriteFile_CanWriteANestedPath(t *testing.T) {
+	t.Parallel()
+	tmpDir := t.TempDir()
+	tmpFilePath := JoinPaths(tmpDir, "dir", "sub-dir", "dummy")
+
+	content := []byte("content")
+	err := WriteToFile(tmpFilePath, content)
+	require.NoError(t, err)
+
+	fileContent, _ := os.ReadFile(tmpFilePath)
+	assert.Equal(t, content, fileContent)
+}
diff --git a/api/git/azure.go b/api/git/azure.go
new file mode 100644
index 0000000..fa46f4b
--- /dev/null
+++ b/api/git/azure.go
@@ -0,0 +1,589 @@
+package git
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/portainer/portainer/api/archive"
+	"github.com/portainer/portainer/api/crypto"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	"github.com/portainer/portainer/api/logs"
+	"github.com/portainer/portainer/pkg/libhttp/ssrf"
+
+	"github.com/go-git/go-git/v5"
+	"github.com/go-git/go-git/v5/plumbing/filemode"
+	githttp "github.com/go-git/go-git/v5/plumbing/transport/http"
+	"github.com/pkg/errors"
+	"github.com/rs/zerolog/log"
+	"github.com/segmentio/encoding/json"
+)
+
+const (
+	azureDevOpsHost        = "dev.azure.com"
+	visualStudioHostSuffix = ".visualstudio.com"
+)
+
+func IsAzureUrl(s string) bool {
+	return strings.Contains(s, azureDevOpsHost) ||
+		strings.Contains(s, visualStudioHostSuffix)
+}
+
+type azureOptions struct {
+	organisation, project, repository string
+	// a user may pass credentials in a repository URL,
+	// for example https://<username>:<password>@<domain>/<path>
+	username, password string
+}
+
+// azureRef abstracts from the response of https://docs.microsoft.com/en-us/rest/api/azure/devops/git/refs/list?view=azure-devops-rest-6.0#refs
+type azureRef struct {
+	Name     string `json:"name"`
+	ObjectID string `json:"objectId"`
+}
+
+// azureItem abstracts from the response of https://docs.microsoft.com/en-us/rest/api/azure/devops/git/items/get?view=azure-devops-rest-6.0#download
+type azureItem struct {
+	ObjectID string `json:"objectId"`
+	CommitId string `json:"commitId"`
+	Path     string `json:"path"`
+}
+
+type azureClient struct {
+	baseUrl string
+}
+
+func NewAzureClient() *azureClient {
+	return &azureClient{
+		baseUrl: "https://dev.azure.com",
+	}
+}
+
+func newHttpClientForAzure(insecureSkipVerify bool) *http.Client {
+	return &http.Client{
+		Transport: ssrf.NewTransport(crypto.CreateTLSConfiguration(insecureSkipVerify)),
+		Timeout:   300 * time.Second,
+	}
+}
+
+func (a *azureClient) Download(ctx context.Context, destination string, opt *git.CloneOptions) error {
+	if opt == nil {
+		return errors.New("options cannot be nil")
+	}
+
+	zipFilepath, err := a.downloadZipFromAzureDevOps(ctx, opt)
+	if err != nil {
+		return errors.Wrap(err, "failed to download a zip file from Azure DevOps")
+	}
+	defer func() {
+		if err := os.Remove(zipFilepath); err != nil {
+			log.Warn().Err(err).Msg("failed to remove temporary zip file")
+		}
+	}()
+
+	if err := archive.UnzipFile(zipFilepath, destination); err != nil {
+		return errors.Wrap(err, "failed to unzip file")
+	}
+
+	return nil
+}
+
+func (a *azureClient) downloadZipFromAzureDevOps(ctx context.Context, opt *git.CloneOptions) (string, error) {
+	config, err := parseUrl(opt.URL)
+	if err != nil {
+		return "", errors.WithMessage(err, "failed to parse url")
+	}
+
+	downloadUrl, err := a.buildDownloadUrl(config, string(opt.ReferenceName))
+	if err != nil {
+		return "", errors.WithMessage(err, "failed to build download url")
+	}
+
+	zipFile, err := os.CreateTemp("", "azure-git-repo-*.zip")
+	if err != nil {
+		return "", errors.WithMessage(err, "failed to create temp file")
+	}
+
+	defer logs.CloseAndLogErr(zipFile)
+
+	var basicAuth *githttp.BasicAuth
+	if opt.Auth != nil {
+		var ok bool
+		basicAuth, ok = opt.Auth.(*githttp.BasicAuth)
+		if !ok {
+			return "", errors.New("only basic auth is supported for azure")
+		}
+	}
+
+	req, err := http.NewRequestWithContext(ctx, "GET", downloadUrl, nil)
+	if basicAuth != nil {
+		req.SetBasicAuth(basicAuth.Username, basicAuth.Password)
+	} else if config.username != "" || config.password != "" {
+		req.SetBasicAuth(config.username, config.password)
+	}
+
+	if err != nil {
+		return "", errors.WithMessage(err, "failed to create a new HTTP request")
+	}
+
+	client := newHttpClientForAzure(opt.InsecureSkipTLS)
+	defer client.CloseIdleConnections()
+
+	res, err := client.Do(req)
+	if err != nil {
+		return "", errors.WithMessage(err, "failed to make an HTTP request")
+	}
+
+	defer func() {
+		if err := res.Body.Close(); err != nil {
+			log.Warn().Err(err).Msg("failed to close response body")
+		}
+	}()
+
+	if res.StatusCode != http.StatusOK {
+		return "", fmt.Errorf("failed to download zip with a status \"%v\"", res.Status)
+	}
+
+	if _, err := io.Copy(zipFile, res.Body); err != nil {
+		return "", errors.WithMessage(err, "failed to save HTTP response to a file")
+	}
+
+	return zipFile.Name(), nil
+}
+
+func (a *azureClient) LatestCommitID(ctx context.Context, repositoryUrl, referenceName string, opt *git.ListOptions) (string, error) {
+	if opt == nil {
+		return "", errors.New("options cannot be nil")
+	}
+
+	rootItem, err := a.getRootItem(ctx, repositoryUrl, referenceName, opt)
+	if err != nil {
+		return "", err
+	}
+
+	return rootItem.CommitId, nil
+}
+
+func (a *azureClient) getRootItem(ctx context.Context, repositoryUrl, referenceName string, opt *git.ListOptions) (*azureItem, error) {
+	config, err := parseUrl(repositoryUrl)
+	if err != nil {
+		return nil, errors.WithMessage(err, "failed to parse url")
+	}
+
+	rootItemUrl, err := a.buildRootItemUrl(config, referenceName)
+	if err != nil {
+		return nil, errors.WithMessage(err, "failed to build azure root item url")
+	}
+
+	var basicAuth *githttp.BasicAuth
+	if opt.Auth != nil {
+		var ok bool
+		basicAuth, ok = opt.Auth.(*githttp.BasicAuth)
+		if !ok {
+			return nil, errors.New("only basic auth is supported for azure")
+		}
+	}
+
+	req, err := http.NewRequestWithContext(ctx, "GET", rootItemUrl, nil)
+	if basicAuth != nil {
+		req.SetBasicAuth(basicAuth.Username, basicAuth.Password)
+	} else if config.username != "" || config.password != "" {
+		req.SetBasicAuth(config.username, config.password)
+	}
+
+	if err != nil {
+		return nil, errors.WithMessage(err, "failed to create a new HTTP request")
+	}
+
+	client := newHttpClientForAzure(opt.InsecureSkipTLS)
+	defer client.CloseIdleConnections()
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, errors.WithMessage(err, "failed to make an HTTP request")
+	}
+	defer func() {
+		if err := resp.Body.Close(); err != nil {
+			log.Warn().Err(err).Msg("failed to close response body")
+		}
+	}()
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, checkAzureStatusCode(fmt.Errorf("failed to get repository root item with a status \"%v\"", resp.Status), resp.StatusCode)
+	}
+
+	var items struct {
+		Value []azureItem
+	}
+
+	if err := json.NewDecoder(resp.Body).Decode(&items); err != nil {
+		return nil, errors.Wrap(err, "could not parse Azure items response")
+	}
+
+	if len(items.Value) == 0 || items.Value[0].CommitId == "" {
+		return nil, errors.Errorf("failed to get latest commitID in the repository")
+	}
+
+	return &items.Value[0], nil
+}
+
+func parseUrl(rawUrl string) (*azureOptions, error) {
+	if strings.HasPrefix(rawUrl, "https://") || strings.HasPrefix(rawUrl, "http://") {
+		return parseHttpUrl(rawUrl)
+	}
+	if strings.HasPrefix(rawUrl, "git@ssh") {
+		return parseSshUrl(rawUrl)
+	}
+	if strings.HasPrefix(rawUrl, "ssh://") {
+		r := []rune(rawUrl)
+		return parseSshUrl(string(r[6:])) // remove the prefix
+	}
+
+	return nil, errors.Errorf("supported url schemes are https and ssh; recevied URL %s rawUrl", rawUrl)
+}
+
+const expectedSshUrl = "git@ssh.dev.azure.com:v3/Organisation/Project/Repository"
+
+func parseSshUrl(rawUrl string) (*azureOptions, error) {
+	path := strings.Split(rawUrl, "/")
+
+	unexpectedUrlErr := errors.Errorf("want url %s, got %s", expectedSshUrl, rawUrl)
+	if len(path) != 4 {
+		return nil, unexpectedUrlErr
+	}
+	return &azureOptions{
+		organisation: path[1],
+		project:      path[2],
+		repository:   path[3],
+	}, nil
+}
+
+const (
+	expectedAzureDevOpsHttpUrl  = "https://Organisation@dev.azure.com/Organisation/Project/_git/Repository"
+	expectedVisualStudioHttpUrl = "https://organisation.visualstudio.com/project/_git/repository"
+)
+
+func parseHttpUrl(rawUrl string) (*azureOptions, error) {
+	u, err := url.Parse(rawUrl)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to parse HTTP url")
+	}
+
+	opt := azureOptions{}
+	switch {
+	case u.Host == azureDevOpsHost:
+		path := strings.Split(u.Path, "/")
+		if len(path) != 5 {
+			return nil, errors.Errorf("want url %s, got %s", expectedAzureDevOpsHttpUrl, u)
+		}
+		opt.organisation = path[1]
+		opt.project = path[2]
+		opt.repository = path[4]
+	case strings.HasSuffix(u.Host, visualStudioHostSuffix):
+		path := strings.Split(u.Path, "/")
+		if len(path) != 4 {
+			return nil, errors.Errorf("want url %s, got %s", expectedVisualStudioHttpUrl, u)
+		}
+		opt.organisation = strings.TrimSuffix(u.Host, visualStudioHostSuffix)
+		opt.project = path[1]
+		opt.repository = path[3]
+	default:
+		return nil, errors.Errorf("unknown azure host in url \"%s\"", rawUrl)
+	}
+
+	opt.username = u.User.Username()
+	opt.password, _ = u.User.Password()
+
+	return &opt, nil
+}
+
+func (a *azureClient) buildDownloadUrl(config *azureOptions, referenceName string) (string, error) {
+	rawUrl := fmt.Sprintf("%s/%s/%s/_apis/git/repositories/%s/items",
+		a.baseUrl,
+		url.PathEscape(config.organisation),
+		url.PathEscape(config.project),
+		url.PathEscape(config.repository))
+	u, err := url.Parse(rawUrl)
+	if err != nil {
+		return "", errors.Wrapf(err, "failed to parse download url path %s", rawUrl)
+	}
+	q := u.Query()
+	// scopePath=/&download=true&versionDescriptor.version=main&$format=zip&recursionLevel=full&api-version=6.0
+	q.Set("scopePath", "/")
+	q.Set("download", "true")
+	if referenceName != "" {
+		q.Set("versionDescriptor.versionType", getVersionType(referenceName))
+		q.Set("versionDescriptor.version", formatReferenceName(referenceName))
+	}
+	q.Set("$format", "zip")
+	q.Set("recursionLevel", "full")
+	q.Set("api-version", "6.0")
+	u.RawQuery = q.Encode()
+
+	return u.String(), nil
+}
+
+func (a *azureClient) buildRootItemUrl(config *azureOptions, referenceName string) (string, error) {
+	rawUrl := fmt.Sprintf("%s/%s/%s/_apis/git/repositories/%s/items",
+		a.baseUrl,
+		url.PathEscape(config.organisation),
+		url.PathEscape(config.project),
+		url.PathEscape(config.repository))
+	u, err := url.Parse(rawUrl)
+	if err != nil {
+		return "", errors.Wrapf(err, "failed to parse root item url path %s", rawUrl)
+	}
+
+	q := u.Query()
+	q.Set("scopePath", "/")
+	if referenceName != "" {
+		q.Set("versionDescriptor.versionType", getVersionType(referenceName))
+		q.Set("versionDescriptor.version", formatReferenceName(referenceName))
+	}
+	q.Set("api-version", "6.0")
+	u.RawQuery = q.Encode()
+
+	return u.String(), nil
+}
+
+func (a *azureClient) buildRefsUrl(config *azureOptions) (string, error) {
+	// ref@https://docs.microsoft.com/en-us/rest/api/azure/devops/git/refs/list?view=azure-devops-rest-6.0#gitref
+	rawUrl := fmt.Sprintf("%s/%s/%s/_apis/git/repositories/%s/refs",
+		a.baseUrl,
+		url.PathEscape(config.organisation),
+		url.PathEscape(config.project),
+		url.PathEscape(config.repository))
+	u, err := url.Parse(rawUrl)
+	if err != nil {
+		return "", errors.Wrapf(err, "failed to parse list refs url path %s", rawUrl)
+	}
+
+	q := u.Query()
+	q.Set("api-version", "6.0")
+	u.RawQuery = q.Encode()
+
+	return u.String(), nil
+}
+
+func (a *azureClient) buildTreeUrl(config *azureOptions, rootObjectHash string) (string, error) {
+	// ref@https://docs.microsoft.com/en-us/rest/api/azure/devops/git/trees/get?view=azure-devops-rest-6.0
+	rawUrl := fmt.Sprintf("%s/%s/%s/_apis/git/repositories/%s/trees/%s",
+		a.baseUrl,
+		url.PathEscape(config.organisation),
+		url.PathEscape(config.project),
+		url.PathEscape(config.repository),
+		url.PathEscape(rootObjectHash),
+	)
+	u, err := url.Parse(rawUrl)
+	if err != nil {
+		return "", errors.Wrapf(err, "failed to parse list tree url path %s", rawUrl)
+	}
+
+	q := u.Query()
+	// projectId={projectId}&recursive=true&fileName={fileName}&$format={$format}&api-version=6.0
+	q.Set("recursive", "true")
+	q.Set("api-version", "6.0")
+	u.RawQuery = q.Encode()
+
+	return u.String(), nil
+}
+
+const (
+	branchPrefix = "refs/heads/"
+	tagPrefix    = "refs/tags/"
+)
+
+func formatReferenceName(name string) string {
+	if after, ok := strings.CutPrefix(name, branchPrefix); ok {
+		return after
+	}
+
+	if after, ok := strings.CutPrefix(name, tagPrefix); ok {
+		return after
+	}
+
+	return name
+}
+
+func getVersionType(name string) string {
+	if strings.HasPrefix(name, branchPrefix) {
+		return "branch"
+	}
+
+	if strings.HasPrefix(name, tagPrefix) {
+		return "tag"
+	}
+
+	return "commit"
+}
+
+func (a *azureClient) ListRefs(ctx context.Context, repositoryUrl string, opt *git.ListOptions) ([]string, error) {
+	if opt == nil {
+		return nil, errors.New("options cannot be nil")
+	}
+
+	config, err := parseUrl(repositoryUrl)
+	if err != nil {
+		return nil, errors.WithMessage(err, "failed to parse url")
+	}
+
+	listRefsUrl, err := a.buildRefsUrl(config)
+	if err != nil {
+		return nil, errors.WithMessage(err, "failed to build list refs url")
+	}
+
+	var basicAuth *githttp.BasicAuth
+	if opt.Auth != nil {
+		var ok bool
+		basicAuth, ok = opt.Auth.(*githttp.BasicAuth)
+		if !ok {
+			return nil, errors.New("only basic auth is supported for azure")
+		}
+	}
+
+	req, err := http.NewRequestWithContext(ctx, "GET", listRefsUrl, nil)
+	if basicAuth != nil {
+		req.SetBasicAuth(basicAuth.Username, basicAuth.Password)
+	} else if config.username != "" || config.password != "" {
+		req.SetBasicAuth(config.username, config.password)
+	}
+
+	if err != nil {
+		return nil, errors.WithMessage(err, "failed to create a new HTTP request")
+	}
+
+	client := newHttpClientForAzure(opt.InsecureSkipTLS)
+	defer client.CloseIdleConnections()
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, errors.WithMessage(err, "failed to make an HTTP request")
+	}
+	defer func() {
+		if err := resp.Body.Close(); err != nil {
+			log.Warn().Err(err).Msg("failed to close response body")
+		}
+	}()
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, checkAzureStatusCode(fmt.Errorf("failed to list refs with a status \"%v\"", resp.Status), resp.StatusCode)
+	}
+
+	var refs struct {
+		Value []azureRef
+	}
+
+	if err := json.NewDecoder(resp.Body).Decode(&refs); err != nil {
+		return nil, errors.Wrap(err, "could not parse Azure refs response")
+	}
+
+	var ret []string
+	for _, value := range refs.Value {
+		if value.Name == "HEAD" {
+			continue
+		}
+		ret = append(ret, value.Name)
+	}
+
+	return ret, nil
+}
+
+// listFiles list all filenames under the specific repository
+func (a *azureClient) ListFiles(ctx context.Context, dirOnly bool, opt *git.CloneOptions) ([]string, error) {
+	if opt == nil {
+		return nil, errors.New("options cannot be nil")
+	}
+
+	listOptions := &git.ListOptions{
+		Auth:            opt.Auth,
+		InsecureSkipTLS: opt.InsecureSkipTLS,
+	}
+	rootItem, err := a.getRootItem(ctx, opt.URL, string(opt.ReferenceName), listOptions)
+	if err != nil {
+		return nil, err
+	}
+
+	config, err := parseUrl(opt.URL)
+	if err != nil {
+		return nil, errors.WithMessage(err, "failed to parse url")
+	}
+
+	listTreeUrl, err := a.buildTreeUrl(config, rootItem.ObjectID)
+	if err != nil {
+		return nil, errors.WithMessage(err, "failed to build list tree url")
+	}
+
+	var basicAuth *githttp.BasicAuth
+	if opt.Auth != nil {
+		var ok bool
+		basicAuth, ok = opt.Auth.(*githttp.BasicAuth)
+		if !ok {
+			return nil, errors.New("only basic auth is supported for azure")
+		}
+	}
+
+	req, err := http.NewRequestWithContext(ctx, "GET", listTreeUrl, nil)
+	if basicAuth != nil {
+		req.SetBasicAuth(basicAuth.Username, basicAuth.Password)
+	} else if config.username != "" || config.password != "" {
+		req.SetBasicAuth(config.username, config.password)
+	}
+
+	if err != nil {
+		return nil, errors.WithMessage(err, "failed to create a new HTTP request")
+	}
+
+	client := newHttpClientForAzure(opt.InsecureSkipTLS)
+	defer client.CloseIdleConnections()
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, errors.WithMessage(err, "failed to make an HTTP request")
+	}
+	defer func() {
+		if err := resp.Body.Close(); err != nil {
+			log.Warn().Err(err).Msg("failed to close response body")
+		}
+	}()
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("failed to list tree url with a status \"%v\"", resp.Status)
+	}
+
+	var tree struct {
+		TreeEntries []struct {
+			RelativePath string `json:"relativePath"`
+			Mode         string `json:"mode"`
+		} `json:"treeEntries"`
+	}
+
+	if err := json.NewDecoder(resp.Body).Decode(&tree); err != nil {
+		return nil, errors.Wrap(err, "could not parse Azure tree response")
+	}
+
+	var allPaths []string
+	for _, treeEntry := range tree.TreeEntries {
+		mode, _ := filemode.New(treeEntry.Mode)
+		isDir := filemode.Dir == mode
+		if dirOnly == isDir {
+			allPaths = append(allPaths, treeEntry.RelativePath)
+		}
+	}
+
+	return allPaths, nil
+}
+
+func checkAzureStatusCode(err error, code int) error {
+	if code == http.StatusNotFound {
+		return gittypes.ErrIncorrectRepositoryURL
+	} else if code == http.StatusUnauthorized || code == http.StatusNonAuthoritativeInfo {
+		return gittypes.ErrAuthenticationFailure
+	}
+
+	return err
+}
diff --git a/api/git/azure_integration_test.go b/api/git/azure_integration_test.go
new file mode 100644
index 0000000..ac0b790
--- /dev/null
+++ b/api/git/azure_integration_test.go
@@ -0,0 +1,362 @@
+package git
+
+import (
+	"fmt"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/portainer/portainer/api/filesystem"
+	gittypes "github.com/portainer/portainer/api/git/types"
+
+	_ "github.com/joho/godotenv/autoload"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const privateAzureRepoURL = "https://portainer.visualstudio.com/gitops-test/_git/gitops-test"
+
+func TestService_ClonePublicRepository_Azure(t *testing.T) {
+	t.Parallel()
+	ensureIntegrationTest(t)
+
+	pat := getRequiredValue(t, "AZURE_DEVOPS_PAT")
+	service := NewService(t.Context())
+
+	type args struct {
+		repositoryURLFormat string
+		referenceName       string
+		username            string
+		password            string
+	}
+	tests := []struct {
+		name    string
+		args    args
+		wantErr bool
+	}{
+		{
+			name: "Clone Azure DevOps repo branch",
+			args: args{
+				repositoryURLFormat: "https://:%s@portainer.visualstudio.com/gitops-test/_git/gitops-test",
+				referenceName:       "refs/heads/main",
+				username:            "",
+				password:            pat,
+			},
+			wantErr: false,
+		},
+		{
+			name: "Clone Azure DevOps repo tag",
+			args: args{
+				repositoryURLFormat: "https://:%s@portainer.visualstudio.com/gitops-test/_git/gitops-test",
+				referenceName:       "refs/heads/tags/v1.1",
+				username:            "",
+				password:            pat,
+			},
+			wantErr: false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			dst := t.TempDir()
+			repositoryUrl := fmt.Sprintf(tt.args.repositoryURLFormat, tt.args.password)
+			err := service.CloneRepository(
+				t.Context(),
+				dst,
+				repositoryUrl,
+				tt.args.referenceName,
+				"",
+				"",
+				false,
+			)
+			require.NoError(t, err)
+			assert.FileExists(t, filesystem.JoinPaths(dst, "README.md"))
+		})
+	}
+}
+
+func TestService_ClonePrivateRepository_Azure(t *testing.T) {
+	t.Parallel()
+	ensureIntegrationTest(t)
+
+	pat := getRequiredValue(t, "AZURE_DEVOPS_PAT")
+	service := NewService(t.Context())
+
+	dst := t.TempDir()
+
+	err := service.CloneRepository(
+		t.Context(),
+		dst,
+		privateAzureRepoURL,
+		"refs/heads/main",
+		"",
+		pat,
+		false,
+	)
+	require.NoError(t, err)
+	assert.FileExists(t, filesystem.JoinPaths(dst, "README.md"))
+}
+
+func TestService_LatestCommitID_Azure(t *testing.T) {
+	t.Parallel()
+	ensureIntegrationTest(t)
+
+	pat := getRequiredValue(t, "AZURE_DEVOPS_PAT")
+	service := NewService(t.Context())
+
+	id, err := service.LatestCommitID(
+		t.Context(),
+		privateAzureRepoURL,
+		"refs/heads/main",
+		"",
+		pat,
+		false,
+	)
+	require.NoError(t, err)
+	assert.NotEmpty(t, id, "cannot guarantee commit id, but it should be not empty")
+}
+
+func TestService_ListRefs_Azure(t *testing.T) {
+	t.Parallel()
+	ensureIntegrationTest(t)
+
+	accessToken := getRequiredValue(t, "AZURE_DEVOPS_PAT")
+	username := getRequiredValue(t, "AZURE_DEVOPS_USERNAME")
+	service := NewService(t.Context())
+
+	refs, err := service.ListRefs(
+		t.Context(),
+		privateAzureRepoURL,
+		username,
+		accessToken,
+		false,
+		false,
+	)
+	require.NoError(t, err)
+	assert.GreaterOrEqual(t, len(refs), 1)
+}
+
+func TestService_ListRefs_Azure_Concurrently(t *testing.T) {
+	t.Parallel()
+	ensureIntegrationTest(t)
+
+	accessToken := getRequiredValue(t, "AZURE_DEVOPS_PAT")
+	username := getRequiredValue(t, "AZURE_DEVOPS_USERNAME")
+	service := newService(t.Context(), repositoryCacheSize, 200*time.Millisecond)
+
+	go func() {
+		_, _ = service.ListRefs(t.Context(), privateAzureRepoURL, username, accessToken, false, false)
+	}()
+
+	_, err := service.ListRefs(t.Context(), privateAzureRepoURL, username, accessToken, false, false)
+	require.NoError(t, err)
+
+	time.Sleep(2 * time.Second)
+}
+
+func TestService_ListFiles_Azure(t *testing.T) {
+	t.Parallel()
+	ensureIntegrationTest(t)
+
+	type args struct {
+		repositoryUrl string
+		referenceName string
+		username      string
+		password      string
+		extensions    []string
+	}
+
+	type expectResult struct {
+		shouldFail   bool
+		err          error
+		matchedCount int
+	}
+
+	service := newService(t.Context(), 0, 0)
+	accessToken := getRequiredValue(t, "AZURE_DEVOPS_PAT")
+	username := getRequiredValue(t, "AZURE_DEVOPS_USERNAME")
+
+	tests := []struct {
+		name   string
+		args   args
+		expect expectResult
+	}{
+		{
+			name: "list tree with real repository and head ref but incorrect credential",
+			args: args{
+				repositoryUrl: privateAzureRepoURL,
+				referenceName: "refs/heads/main",
+				username:      "test-username",
+				password:      "test-token",
+				extensions:    []string{},
+			},
+			expect: expectResult{
+				shouldFail: true,
+				err:        gittypes.ErrAuthenticationFailure,
+			},
+		},
+		{
+			name: "list tree with real repository and head ref but no credential",
+			args: args{
+				repositoryUrl: privateAzureRepoURL,
+				referenceName: "refs/heads/main",
+				username:      "",
+				password:      "",
+				extensions:    []string{},
+			},
+			expect: expectResult{
+				shouldFail: true,
+				err:        gittypes.ErrAuthenticationFailure,
+			},
+		},
+		{
+			name: "list tree with real repository and head ref",
+			args: args{
+				repositoryUrl: privateAzureRepoURL,
+				referenceName: "refs/heads/main",
+				username:      username,
+				password:      accessToken,
+				extensions:    []string{},
+			},
+			expect: expectResult{
+				err:          nil,
+				matchedCount: 19,
+			},
+		},
+		{
+			name: "list tree with real repository and head ref and existing file extension",
+			args: args{
+				repositoryUrl: privateAzureRepoURL,
+				referenceName: "refs/heads/main",
+				username:      username,
+				password:      accessToken,
+				extensions:    []string{"yml"},
+			},
+			expect: expectResult{
+				err:          nil,
+				matchedCount: 2,
+			},
+		},
+		{
+			name: "list tree with real repository and head ref and non-existing file extension",
+			args: args{
+				repositoryUrl: privateAzureRepoURL,
+				referenceName: "refs/heads/main",
+				username:      username,
+				password:      accessToken,
+				extensions:    []string{"hcl"},
+			},
+			expect: expectResult{
+				err:          nil,
+				matchedCount: 2,
+			},
+		},
+		{
+			name: "list tree with real repository but non-existing ref",
+			args: args{
+				repositoryUrl: privateAzureRepoURL,
+				referenceName: "refs/fake/feature",
+				username:      username,
+				password:      accessToken,
+				extensions:    []string{},
+			},
+			expect: expectResult{
+				shouldFail: true,
+			},
+		},
+		{
+			name: "list tree with fake repository ",
+			args: args{
+				repositoryUrl: privateAzureRepoURL + "fake",
+				referenceName: "refs/fake/feature",
+				username:      username,
+				password:      accessToken,
+				extensions:    []string{},
+			},
+			expect: expectResult{
+				shouldFail: true,
+				err:        gittypes.ErrIncorrectRepositoryURL,
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			paths, err := service.ListFiles(
+				t.Context(),
+				tt.args.repositoryUrl,
+				tt.args.referenceName,
+				tt.args.username,
+				tt.args.password,
+				false,
+				false,
+				tt.args.extensions,
+				false,
+			)
+
+			if tt.expect.shouldFail {
+				require.Error(t, err)
+				if tt.expect.err != nil {
+					assert.Equal(t, tt.expect.err, err)
+				}
+			} else {
+				require.NoError(t, err)
+				if tt.expect.matchedCount > 0 {
+					assert.NotEmpty(t, paths)
+				}
+			}
+		})
+	}
+}
+
+func TestService_ListFiles_Azure_Concurrently(t *testing.T) {
+	t.Parallel()
+	ensureIntegrationTest(t)
+
+	accessToken := getRequiredValue(t, "AZURE_DEVOPS_PAT")
+	username := getRequiredValue(t, "AZURE_DEVOPS_USERNAME")
+	service := newService(t.Context(), repositoryCacheSize, 200*time.Millisecond)
+
+	go func() {
+		_, _ = service.ListFiles(
+			t.Context(),
+			privateAzureRepoURL,
+			"refs/heads/main",
+			username,
+			accessToken,
+			false,
+			false,
+			[]string{},
+			false,
+		)
+	}()
+
+	_, err := service.ListFiles(
+		t.Context(),
+		privateAzureRepoURL,
+		"refs/heads/main",
+		username,
+		accessToken,
+		false,
+		false,
+		[]string{},
+		false,
+	)
+	require.NoError(t, err)
+
+	time.Sleep(2 * time.Second)
+}
+
+func getRequiredValue(t *testing.T, name string) string {
+	value, ok := os.LookupEnv(name)
+	if !ok {
+		t.Fatalf("can't find required env var \"%s\"", name)
+	}
+
+	return value
+}
+
+func ensureIntegrationTest(t *testing.T) {
+	if _, ok := os.LookupEnv("INTEGRATION_TEST"); !ok {
+		t.Skip("skip an integration test")
+	}
+}
diff --git a/api/git/azure_test.go b/api/git/azure_test.go
new file mode 100644
index 0000000..b3468c7
--- /dev/null
+++ b/api/git/azure_test.go
@@ -0,0 +1,662 @@
+package git
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+
+	"github.com/go-git/go-git/v5"
+	"github.com/go-git/go-git/v5/plumbing"
+	githttp "github.com/go-git/go-git/v5/plumbing/transport/http"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	"github.com/portainer/portainer/pkg/fips"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_buildDownloadUrl(t *testing.T) {
+	t.Parallel()
+	a := NewAzureClient()
+	u, err := a.buildDownloadUrl(&azureOptions{
+		organisation: "organisation",
+		project:      "project",
+		repository:   "repository",
+	}, "refs/heads/main")
+	require.NoError(t, err)
+
+	expectedUrl, err := url.Parse("https://dev.azure.com/organisation/project/_apis/git/repositories/repository/items?scopePath=/&download=true&versionDescriptor.version=main&$format=zip&recursionLevel=full&api-version=6.0&versionDescriptor.versionType=branch")
+	require.NoError(t, err)
+
+	actualUrl, err := url.Parse(u)
+	require.NoError(t, err)
+
+	assert.Equal(t, expectedUrl.Host, actualUrl.Host)
+	assert.Equal(t, expectedUrl.Scheme, actualUrl.Scheme)
+	assert.Equal(t, expectedUrl.Path, actualUrl.Path)
+	assert.Equal(t, expectedUrl.Query(), actualUrl.Query())
+}
+
+func Test_buildRootItemUrl(t *testing.T) {
+	t.Parallel()
+	a := NewAzureClient()
+	u, err := a.buildRootItemUrl(&azureOptions{
+		organisation: "organisation",
+		project:      "project",
+		repository:   "repository",
+	}, "refs/heads/main")
+
+	expectedUrl, _ := url.Parse("https://dev.azure.com/organisation/project/_apis/git/repositories/repository/items?scopePath=/&api-version=6.0&versionDescriptor.version=main&versionDescriptor.versionType=branch")
+	actualUrl, _ := url.Parse(u)
+	require.NoError(t, err)
+	assert.Equal(t, expectedUrl.Host, actualUrl.Host)
+	assert.Equal(t, expectedUrl.Scheme, actualUrl.Scheme)
+	assert.Equal(t, expectedUrl.Path, actualUrl.Path)
+	assert.Equal(t, expectedUrl.Query(), actualUrl.Query())
+}
+
+func Test_buildRefsUrl(t *testing.T) {
+	t.Parallel()
+	a := NewAzureClient()
+	u, err := a.buildRefsUrl(&azureOptions{
+		organisation: "organisation",
+		project:      "project",
+		repository:   "repository",
+	})
+
+	expectedUrl, _ := url.Parse("https://dev.azure.com/organisation/project/_apis/git/repositories/repository/refs?api-version=6.0")
+	actualUrl, _ := url.Parse(u)
+	require.NoError(t, err)
+	assert.Equal(t, expectedUrl.Host, actualUrl.Host)
+	assert.Equal(t, expectedUrl.Scheme, actualUrl.Scheme)
+	assert.Equal(t, expectedUrl.Path, actualUrl.Path)
+	assert.Equal(t, expectedUrl.Query(), actualUrl.Query())
+}
+
+func Test_buildTreeUrl(t *testing.T) {
+	t.Parallel()
+	a := NewAzureClient()
+	u, err := a.buildTreeUrl(&azureOptions{
+		organisation: "organisation",
+		project:      "project",
+		repository:   "repository",
+	}, "sha1")
+
+	expectedUrl, _ := url.Parse("https://dev.azure.com/organisation/project/_apis/git/repositories/repository/trees/sha1?api-version=6.0&recursive=true")
+	actualUrl, _ := url.Parse(u)
+	require.NoError(t, err)
+	assert.Equal(t, expectedUrl.Host, actualUrl.Host)
+	assert.Equal(t, expectedUrl.Scheme, actualUrl.Scheme)
+	assert.Equal(t, expectedUrl.Path, actualUrl.Path)
+	assert.Equal(t, expectedUrl.Query(), actualUrl.Query())
+}
+
+func Test_parseAzureUrl(t *testing.T) {
+	t.Parallel()
+	type args struct {
+		url string
+	}
+	tests := []struct {
+		name    string
+		args    args
+		want    *azureOptions
+		wantErr bool
+	}{
+		{
+			name: "Expected SSH URL format starting with ssh://",
+			args: args{
+				url: "ssh://git@ssh.dev.azure.com:v3/Organisation/Project/Repository",
+			},
+			want: &azureOptions{
+				organisation: "Organisation",
+				project:      "Project",
+				repository:   "Repository",
+			},
+			wantErr: false,
+		},
+		{
+			name: "Expected SSH URL format starting with git@ssh",
+			args: args{
+				url: "git@ssh.dev.azure.com:v3/Organisation/Project/Repository",
+			},
+			want: &azureOptions{
+				organisation: "Organisation",
+				project:      "Project",
+				repository:   "Repository",
+			},
+			wantErr: false,
+		},
+		{
+			name: "Unexpected SSH URL format",
+			args: args{
+				url: "git@ssh.dev.azure.com:v3/Organisation/Repository",
+			},
+			wantErr: true,
+		},
+		{
+			name: "Expected HTTPS URL format",
+			args: args{
+				url: "https://Organisation@dev.azure.com/Organisation/Project/_git/Repository",
+			},
+			want: &azureOptions{
+				organisation: "Organisation",
+				project:      "Project",
+				repository:   "Repository",
+				username:     "Organisation",
+			},
+			wantErr: false,
+		},
+		{
+			name: "HTTPS URL with credentials",
+			args: args{
+				url: "https://username:password@dev.azure.com/Organisation/Project/_git/Repository",
+			},
+			want: &azureOptions{
+				organisation: "Organisation",
+				project:      "Project",
+				repository:   "Repository",
+				username:     "username",
+				password:     "password",
+			},
+			wantErr: false,
+		},
+		{
+			name: "HTTPS URL with password",
+			args: args{
+				url: "https://:password@dev.azure.com/Organisation/Project/_git/Repository",
+			},
+			want: &azureOptions{
+				organisation: "Organisation",
+				project:      "Project",
+				repository:   "Repository",
+				password:     "password",
+			},
+			wantErr: false,
+		},
+		{
+			name: "Visual Studio HTTPS URL with credentials",
+			args: args{
+				url: "https://username:password@organisation.visualstudio.com/project/_git/repository",
+			},
+			want: &azureOptions{
+				organisation: "organisation",
+				project:      "project",
+				repository:   "repository",
+				username:     "username",
+				password:     "password",
+			},
+			wantErr: false,
+		},
+		{
+			name: "Unexpected HTTPS URL format",
+			args: args{
+				url: "https://Organisation@dev.azure.com/Project/_git/Repository",
+			},
+			wantErr: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := parseUrl(tt.args.url)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("parseUrl() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
+
+func Test_isAzureUrl(t *testing.T) {
+	t.Parallel()
+	type args struct {
+		s string
+	}
+	tests := []struct {
+		name string
+		args args
+		want bool
+	}{
+		{
+			name: "Is Azure url",
+			args: args{
+				s: "https://Organisation@dev.azure.com/Organisation/Project/_git/Repository",
+			},
+			want: true,
+		},
+		{
+			name: "Is Azure url",
+			args: args{
+				s: "https://portainer.visualstudio.com/project/_git/repository",
+			},
+			want: true,
+		},
+		{
+			name: "Is NOT Azure url",
+			args: args{
+				s: "https://github.com/Organisation/Repository",
+			},
+			want: false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, IsAzureUrl(tt.args.s))
+		})
+	}
+}
+
+func Test_azureDownloader_downloadZipFromAzureDevOps(t *testing.T) {
+	t.Parallel()
+	fips.InitFIPS(false)
+
+	type args struct {
+		repositoryUrl string
+		username      string
+		password      string
+	}
+	type basicAuth struct {
+		username, password string
+	}
+	tests := []struct {
+		name string
+		args args
+		want *basicAuth
+	}{
+		{
+			name: "username, password embedded",
+			args: args{
+				repositoryUrl: "https://username:password@dev.azure.com/Organisation/Project/_git/Repository",
+			},
+			want: &basicAuth{
+				username: "username",
+				password: "password",
+			},
+		},
+		{
+			name: "username, password embedded, clone options take precedence",
+			args: args{
+				repositoryUrl: "https://username:password@dev.azure.com/Organisation/Project/_git/Repository",
+				username:      "u",
+				password:      "p",
+			},
+			want: &basicAuth{
+				username: "u",
+				password: "p",
+			},
+		},
+		{
+			name: "no credentials",
+			args: args{
+				repositoryUrl: "https://dev.azure.com/Organisation/Project/_git/Repository",
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var zipRequestAuth *basicAuth
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				if username, password, ok := r.BasicAuth(); ok {
+					zipRequestAuth = &basicAuth{username, password}
+				}
+				w.WriteHeader(http.StatusNotFound) // this makes function under test to return an error
+			}))
+			defer server.Close()
+
+			a := &azureClient{
+				baseUrl: server.URL,
+			}
+
+			option := &git.CloneOptions{
+				URL: tt.args.repositoryUrl,
+			}
+			if tt.args.username != "" || tt.args.password != "" {
+				option.Auth = &githttp.BasicAuth{
+					Username: tt.args.username,
+					Password: tt.args.password,
+				}
+			}
+			_, err := a.downloadZipFromAzureDevOps(t.Context(), option)
+			require.Error(t, err)
+			assert.Equal(t, tt.want, zipRequestAuth)
+		})
+	}
+}
+
+func Test_azureDownloader_latestCommitID(t *testing.T) {
+	t.Parallel()
+	fips.InitFIPS(false)
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		response := `{
+		  "count": 1,
+		  "value": [
+			{
+			  "objectId": "1a5630f017127db7de24d8771da0f536ff98fc9b",
+			  "gitObjectType": "tree",
+			  "commitId": "27104ad7549d9e66685e115a497533f18024be9c",
+			  "path": "/",
+			  "isFolder": true,
+			  "url": "https://dev.azure.com/simonmeng0474/4b546a97-c481-4506-bdd5-976e9592f91a/_apis/git/repositories/a22247ad-053f-43bc-88a7-62ff4846bb97/items?path=%2F&versionType=Branch&versionOptions=None"
+			}
+		  ]
+		}`
+		w.Header().Set("Content-Type", "application/json")
+
+		_, _ = w.Write([]byte(response))
+	}))
+	defer server.Close()
+
+	a := &azureClient{baseUrl: server.URL}
+
+	type args struct {
+		repositoryUrl string
+		referenceName string
+	}
+
+	tests := []struct {
+		name    string
+		args    args
+		want    string
+		wantErr bool
+	}{
+		{
+			name: "should be able to parse response",
+			args: args{
+				repositoryUrl: "https://dev.azure.com/Organisation/Project/_git/Repository",
+				referenceName: "",
+			},
+			want:    "27104ad7549d9e66685e115a497533f18024be9c",
+			wantErr: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			id, err := a.LatestCommitID(t.Context(), tt.args.repositoryUrl, tt.args.referenceName, &git.ListOptions{})
+			if (err != nil) != tt.wantErr {
+				t.Errorf("azureDownloader.latestCommitID() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+			assert.Equal(t, tt.want, id)
+		})
+	}
+}
+
+type testRepoManager struct {
+	called bool
+}
+
+func (t *testRepoManager) Download(_ context.Context, _ string, _ *git.CloneOptions) error {
+	t.called = true
+	return nil
+}
+
+func (t *testRepoManager) LatestCommitID(_ context.Context, _, _ string, _ *git.ListOptions) (string, error) {
+	return "", nil
+}
+
+func (t *testRepoManager) ListRefs(_ context.Context, _ string, _ *git.ListOptions) ([]string, error) {
+	return nil, nil
+}
+
+func (t *testRepoManager) ListFiles(_ context.Context, _ bool, _ *git.CloneOptions) ([]string, error) {
+	return nil, nil
+}
+
+func Test_cloneRepository_azure(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name   string
+		url    string
+		called bool
+	}{
+		{
+			name:   "Azure HTTP URL",
+			url:    "https://Organisation@dev.azure.com/Organisation/Project/_git/Repository",
+			called: true,
+		},
+		{
+			name:   "Azure SSH URL",
+			url:    "git@ssh.dev.azure.com:v3/Organisation/Project/Repository",
+			called: true,
+		},
+		{
+			name:   "Something else",
+			url:    "https://example.com",
+			called: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			azure := &testRepoManager{}
+			git := &testRepoManager{}
+
+			s := &Service{azure: azure, git: git}
+			err := s.CloneRepository(t.Context(), "", tt.url, "", "", "", false)
+			require.NoError(t, err)
+
+			// if azure API is called, git isn't and vice versa
+			assert.Equal(t, tt.called, azure.called)
+			assert.Equal(t, tt.called, !git.called)
+		})
+	}
+}
+
+func Test_listRefs_azure(t *testing.T) {
+	t.Parallel()
+	ensureIntegrationTest(t)
+
+	client := NewAzureClient()
+
+	type args struct {
+		repositoryUrl string
+		username      string
+		password      string
+	}
+
+	type expectResult struct {
+		err       error
+		refsCount int
+	}
+
+	accessToken := getRequiredValue(t, "AZURE_DEVOPS_PAT")
+	username := getRequiredValue(t, "AZURE_DEVOPS_USERNAME")
+
+	tests := []struct {
+		name   string
+		args   args
+		expect expectResult
+	}{
+		{
+			name: "list refs of a real repository",
+			args: args{
+				repositoryUrl: privateAzureRepoURL,
+				username:      username,
+				password:      accessToken,
+			},
+			expect: expectResult{
+				err:       nil,
+				refsCount: 2,
+			},
+		},
+		{
+			name: "list refs of a real repository with incorrect credential",
+			args: args{
+				repositoryUrl: privateAzureRepoURL,
+				username:      "test-username",
+				password:      "test-token",
+			},
+			expect: expectResult{
+				err: gittypes.ErrAuthenticationFailure,
+			},
+		},
+		{
+			name: "list refs of a real repository without providing credential",
+			args: args{
+				repositoryUrl: privateAzureRepoURL,
+				username:      "",
+				password:      "",
+			},
+			expect: expectResult{
+				err: gittypes.ErrAuthenticationFailure,
+			},
+		},
+		{
+			name: "list refs of a fake repository",
+			args: args{
+				repositoryUrl: privateAzureRepoURL + "fake",
+				username:      username,
+				password:      accessToken,
+			},
+			expect: expectResult{
+				err: gittypes.ErrIncorrectRepositoryURL,
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			option := &git.ListOptions{}
+			if tt.args.username != "" || tt.args.password != "" {
+				option.Auth = &githttp.BasicAuth{
+					Username: tt.args.username,
+					Password: tt.args.password,
+				}
+			}
+			refs, err := client.ListRefs(t.Context(), tt.args.repositoryUrl, option)
+			if tt.expect.err == nil {
+				require.NoError(t, err)
+				if tt.expect.refsCount > 0 {
+					assert.NotEmpty(t, refs)
+				}
+			} else {
+				require.Error(t, err)
+				assert.Equal(t, tt.expect.err, err)
+			}
+		})
+	}
+}
+
+func Test_listFiles_azure(t *testing.T) {
+	t.Parallel()
+	ensureIntegrationTest(t)
+
+	client := NewAzureClient()
+
+	type args struct {
+		repositoryUrl string
+		referenceName string
+		username      string
+		password      string
+	}
+
+	type expectResult struct {
+		shouldFail   bool
+		err          error
+		matchedCount int
+	}
+
+	accessToken := getRequiredValue(t, "AZURE_DEVOPS_PAT")
+	username := getRequiredValue(t, "AZURE_DEVOPS_USERNAME")
+	tests := []struct {
+		name   string
+		args   args
+		expect expectResult
+	}{
+		{
+			name: "list tree with real repository and head ref but incorrect credential",
+			args: args{
+				repositoryUrl: privateAzureRepoURL,
+				referenceName: "refs/heads/main",
+				username:      "test-username",
+				password:      "test-token",
+			},
+			expect: expectResult{
+				shouldFail: true,
+				err:        gittypes.ErrAuthenticationFailure,
+			},
+		},
+		{
+			name: "list tree with real repository and head ref but no credential",
+			args: args{
+				repositoryUrl: privateAzureRepoURL,
+				referenceName: "refs/heads/main",
+				username:      "",
+				password:      "",
+			},
+			expect: expectResult{
+				shouldFail: true,
+				err:        gittypes.ErrAuthenticationFailure,
+			},
+		},
+		{
+			name: "list tree with real repository and head ref",
+			args: args{
+				repositoryUrl: privateAzureRepoURL,
+				referenceName: "refs/heads/main",
+				username:      username,
+				password:      accessToken,
+			},
+			expect: expectResult{
+				err:          nil,
+				matchedCount: 19,
+			},
+		},
+		{
+			name: "list tree with real repository but non-existing ref",
+			args: args{
+				repositoryUrl: privateAzureRepoURL,
+				referenceName: "refs/fake/feature",
+				username:      username,
+				password:      accessToken,
+			},
+			expect: expectResult{
+				shouldFail: true,
+			},
+		},
+		{
+			name: "list tree with fake repository ",
+			args: args{
+				repositoryUrl: privateAzureRepoURL + "fake",
+				referenceName: "refs/fake/feature",
+				username:      username,
+				password:      accessToken,
+			},
+			expect: expectResult{
+				shouldFail: true,
+				err:        gittypes.ErrIncorrectRepositoryURL,
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			option := &git.CloneOptions{
+				URL:           tt.args.repositoryUrl,
+				ReferenceName: plumbing.ReferenceName(tt.args.referenceName),
+			}
+			if tt.args.username != "" || tt.args.password != "" {
+				option.Auth = &githttp.BasicAuth{
+					Username: tt.args.username,
+					Password: tt.args.password,
+				}
+			}
+			paths, err := client.ListFiles(t.Context(), false, option)
+			if tt.expect.shouldFail {
+				require.Error(t, err)
+				if tt.expect.err != nil {
+					assert.Equal(t, tt.expect.err, err)
+				}
+			} else {
+				require.NoError(t, err)
+				if tt.expect.matchedCount > 0 {
+					assert.NotEmpty(t, paths)
+				}
+			}
+		})
+	}
+}
diff --git a/api/git/backup.go b/api/git/backup.go
new file mode 100644
index 0000000..3dbbc9b
--- /dev/null
+++ b/api/git/backup.go
@@ -0,0 +1,69 @@
+package git
+
+import (
+	"context"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/filesystem"
+	gittypes "github.com/portainer/portainer/api/git/types"
+
+	"github.com/pkg/errors"
+	"github.com/rs/zerolog/log"
+)
+
+var (
+	ErrInvalidGitCredential = errors.New("Invalid git credential")
+)
+
+type CloneOptions struct {
+	ProjectPath   string
+	URL           string
+	ReferenceName string
+	Username      string
+	Password      string
+	// TLSSkipVerify skips SSL verification when cloning the Git repository
+	TLSSkipVerify bool `example:"false"`
+}
+
+func CloneWithBackup(ctx context.Context, gitService portainer.GitService, fileService portainer.FileService, options CloneOptions) (clean func(), err error) {
+	backupProjectPath := options.ProjectPath + "-old"
+	cleanUp := false
+	cleanFn := func() {
+		if !cleanUp {
+			return
+		}
+
+		if err := fileService.RemoveDirectory(backupProjectPath); err != nil {
+			log.Warn().Err(err).Msg("unable to remove git repository directory")
+		}
+	}
+
+	if err := filesystem.MoveDirectory(options.ProjectPath, backupProjectPath, true); err != nil {
+		return cleanFn, errors.WithMessage(err, "Unable to move git repository directory")
+	}
+
+	cleanUp = true
+
+	if err := gitService.CloneRepository(
+		ctx,
+		options.ProjectPath,
+		options.URL,
+		options.ReferenceName,
+		options.Username,
+		options.Password,
+		options.TLSSkipVerify,
+	); err != nil {
+		cleanUp = false
+		if err := filesystem.MoveDirectory(backupProjectPath, options.ProjectPath, false); err != nil {
+			log.Warn().Err(err).Msg("failed restoring backup folder")
+		}
+
+		if errors.Is(err, gittypes.ErrAuthenticationFailure) {
+			return cleanFn, errors.WithMessage(err, ErrInvalidGitCredential.Error())
+		}
+
+		return cleanFn, errors.WithMessage(err, "Unable to clone git repository")
+	}
+
+	return cleanFn, nil
+}
diff --git a/api/git/credentials.go b/api/git/credentials.go
new file mode 100644
index 0000000..3a1fd5c
--- /dev/null
+++ b/api/git/credentials.go
@@ -0,0 +1,13 @@
+package git
+
+import (
+	gittypes "github.com/portainer/portainer/api/git/types"
+)
+
+func GetCredentials(auth *gittypes.GitAuthentication) (string, string) {
+	if auth == nil {
+		return "", ""
+	}
+
+	return auth.Username, auth.Password
+}
diff --git a/api/git/git.go b/api/git/git.go
new file mode 100644
index 0000000..79b5a21
--- /dev/null
+++ b/api/git/git.go
@@ -0,0 +1,189 @@
+package git
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/portainer/portainer/api/filesystem"
+	gittypes "github.com/portainer/portainer/api/git/types"
+
+	"github.com/go-git/go-billy/v5"
+	"github.com/go-git/go-billy/v5/osfs"
+	"github.com/go-git/go-git/v5"
+	"github.com/go-git/go-git/v5/config"
+	"github.com/go-git/go-git/v5/plumbing/cache"
+	"github.com/go-git/go-git/v5/plumbing/filemode"
+	"github.com/go-git/go-git/v5/plumbing/object"
+	gogitfs "github.com/go-git/go-git/v5/storage/filesystem"
+	"github.com/go-git/go-git/v5/storage/memory"
+	"github.com/pkg/errors"
+	"github.com/rs/zerolog/log"
+)
+
+// noSymlinkFS wraps a billy.Filesystem and rejects symlink creation to prevent
+// symlink traversal attacks from untrusted git repositories
+type noSymlinkFS struct {
+	billy.Filesystem
+}
+
+func (fs noSymlinkFS) Symlink(_, _ string) error {
+	return gittypes.ErrSymlinkDetected
+}
+
+// NewNoSymlinkFS wraps fs and rejects any symlink creation
+func NewNoSymlinkFS(fs billy.Filesystem) billy.Filesystem {
+	return noSymlinkFS{fs}
+}
+
+type gitClient struct {
+	preserveGitDirectory bool
+}
+
+func NewGitClient(preserveGitDir bool) *gitClient {
+	return &gitClient{
+		preserveGitDirectory: preserveGitDir,
+	}
+}
+
+func (c *gitClient) Download(ctx context.Context, dst string, opt *git.CloneOptions) error {
+	resolved, err := filepath.EvalSymlinks(dst)
+	if err != nil && !errors.Is(err, os.ErrNotExist) {
+		return errors.Wrap(err, "failed to resolve destination path")
+	}
+	if err == nil {
+		dst = resolved
+	}
+
+	wt := NewNoSymlinkFS(osfs.New(dst))
+	dot := osfs.New(filesystem.JoinPaths(dst, ".git"))
+	storer := gogitfs.NewStorage(dot, cache.NewObjectLRU(0))
+
+	_, err = git.CloneContext(ctx, storer, wt, opt)
+	if err != nil {
+		if err.Error() == "authentication required" {
+			return gittypes.ErrAuthenticationFailure
+		}
+
+		return errors.Wrap(err, "failed to clone git repository")
+	}
+
+	if c.preserveGitDirectory {
+		return nil
+	}
+
+	if err := os.RemoveAll(filesystem.JoinPaths(dst, ".git")); err != nil {
+		log.Error().Err(err).Msg("failed to remove .git directory")
+	}
+
+	return nil
+}
+
+func (c *gitClient) LatestCommitID(ctx context.Context, repositoryUrl, referenceName string, opt *git.ListOptions) (string, error) {
+	remote := git.NewRemote(memory.NewStorage(), &config.RemoteConfig{
+		Name: "origin",
+		URLs: []string{repositoryUrl},
+	})
+
+	refs, err := remote.ListContext(ctx, opt)
+	if err != nil {
+		if err.Error() == "authentication required" {
+			return "", gittypes.ErrAuthenticationFailure
+		}
+
+		return "", errors.Wrap(err, "failed to list repository refs")
+	}
+
+	if referenceName == "" {
+		for _, ref := range refs {
+			if strings.EqualFold(ref.Name().String(), "HEAD") {
+				referenceName = ref.Target().String()
+			}
+		}
+	}
+
+	for _, ref := range refs {
+		if strings.EqualFold(ref.Name().String(), referenceName) {
+			return ref.Hash().String(), nil
+		}
+	}
+
+	return "", errors.Errorf("could not find ref %q in the repository", referenceName)
+}
+
+func (c *gitClient) ListRefs(ctx context.Context, repositoryUrl string, opt *git.ListOptions) ([]string, error) {
+	rem := git.NewRemote(memory.NewStorage(), &config.RemoteConfig{
+		Name: "origin",
+		URLs: []string{repositoryUrl},
+	})
+
+	refs, err := rem.ListContext(ctx, opt)
+	if err != nil {
+		return nil, checkGitError(err)
+	}
+
+	var ret []string
+	for _, ref := range refs {
+		if ref.Name().String() == "HEAD" {
+			continue
+		}
+
+		ret = append(ret, ref.Name().String())
+	}
+
+	return ret, nil
+}
+
+// listFiles list all filenames under the specific repository
+func (c *gitClient) ListFiles(ctx context.Context, dirOnly bool, opt *git.CloneOptions) ([]string, error) {
+	repo, err := git.Clone(memory.NewStorage(), nil, opt)
+	if err != nil {
+		return nil, checkGitError(err)
+	}
+
+	head, err := repo.Head()
+	if err != nil {
+		return nil, err
+	}
+
+	commit, err := repo.CommitObject(head.Hash())
+	if err != nil {
+		return nil, err
+	}
+
+	tree, err := commit.Tree()
+	if err != nil {
+		return nil, err
+	}
+
+	var allPaths []string
+
+	w := object.NewTreeWalker(tree, true, nil)
+	defer w.Close()
+
+	for {
+		name, entry, err := w.Next()
+		if err != nil {
+			break
+		}
+
+		isDir := entry.Mode == filemode.Dir
+		if dirOnly == isDir {
+			allPaths = append(allPaths, name)
+		}
+	}
+
+	return allPaths, nil
+}
+
+func checkGitError(err error) error {
+	errMsg := err.Error()
+	if strings.Contains(errMsg, "repository not found") {
+		return gittypes.ErrIncorrectRepositoryURL
+	} else if errMsg == "authentication required" {
+		return gittypes.ErrAuthenticationFailure
+	}
+
+	return err
+}
diff --git a/api/git/git_integration_test.go b/api/git/git_integration_test.go
new file mode 100644
index 0000000..af88544
--- /dev/null
+++ b/api/git/git_integration_test.go
@@ -0,0 +1,508 @@
+package git
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/portainer/portainer/api/filesystem"
+	gittypes "github.com/portainer/portainer/api/git/types"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	privateGitRepoURL string = "https://github.com/portainer/private-test-repository.git"
+)
+
+func TestService_ClonePrivateRepository_GitHub(t *testing.T) {
+	t.Parallel()
+	ensureIntegrationTest(t)
+
+	accessToken := getRequiredValue(t, "GITHUB_PAT")
+	username := getRequiredValue(t, "GITHUB_USERNAME")
+	service := newService(t.Context(), 0, 0)
+
+	dst := t.TempDir()
+
+	repositoryUrl := privateGitRepoURL
+	err := service.CloneRepository(
+		t.Context(),
+		dst,
+		repositoryUrl,
+		"refs/heads/main",
+		username,
+		accessToken,
+		false,
+	)
+	require.NoError(t, err)
+	assert.FileExists(t, filesystem.JoinPaths(dst, "README.md"))
+}
+
+func TestService_LatestCommitID_GitHub(t *testing.T) {
+	t.Parallel()
+	ensureIntegrationTest(t)
+
+	accessToken := getRequiredValue(t, "GITHUB_PAT")
+	username := getRequiredValue(t, "GITHUB_USERNAME")
+	service := newService(t.Context(), 0, 0)
+
+	repositoryUrl := privateGitRepoURL
+	id, err := service.LatestCommitID(
+		t.Context(),
+		repositoryUrl,
+		"refs/heads/main",
+		username,
+		accessToken,
+		false,
+	)
+	require.NoError(t, err)
+	assert.NotEmpty(t, id, "cannot guarantee commit id, but it should be not empty")
+}
+
+func TestService_ListRefs_GitHub(t *testing.T) {
+	t.Parallel()
+	ensureIntegrationTest(t)
+
+	accessToken := getRequiredValue(t, "GITHUB_PAT")
+	username := getRequiredValue(t, "GITHUB_USERNAME")
+	service := newService(t.Context(), 0, 0)
+
+	repositoryUrl := privateGitRepoURL
+	refs, err := service.ListRefs(t.Context(), repositoryUrl, username, accessToken, false, false)
+	require.NoError(t, err)
+	assert.GreaterOrEqual(t, len(refs), 1)
+}
+
+func TestService_ListRefs_Github_Concurrently(t *testing.T) {
+	t.Parallel()
+	ensureIntegrationTest(t)
+
+	accessToken := getRequiredValue(t, "GITHUB_PAT")
+	username := getRequiredValue(t, "GITHUB_USERNAME")
+	service := newService(t.Context(), repositoryCacheSize, 200*time.Millisecond)
+
+	repositoryUrl := privateGitRepoURL
+	go func() {
+		_, _ = service.ListRefs(t.Context(), repositoryUrl, username, accessToken, false, false)
+	}()
+
+	_, err := service.ListRefs(t.Context(), repositoryUrl, username, accessToken, false, false)
+	require.NoError(t, err)
+
+	time.Sleep(2 * time.Second)
+}
+
+func TestService_ListFiles_GitHub(t *testing.T) {
+	t.Parallel()
+	ensureIntegrationTest(t)
+
+	type args struct {
+		repositoryUrl string
+		referenceName string
+		username      string
+		password      string
+		extensions    []string
+	}
+
+	type expectResult struct {
+		shouldFail   bool
+		err          error
+		matchedCount int
+	}
+	service := newService(t.Context(), 0, 0)
+	accessToken := getRequiredValue(t, "GITHUB_PAT")
+	username := getRequiredValue(t, "GITHUB_USERNAME")
+
+	tests := []struct {
+		name   string
+		args   args
+		expect expectResult
+	}{
+		{
+			name: "list tree with real repository and head ref but incorrect credential",
+			args: args{
+				repositoryUrl: privateGitRepoURL,
+				referenceName: "refs/heads/main",
+				username:      "test-username",
+				password:      "test-token",
+				extensions:    []string{},
+			},
+			expect: expectResult{
+				shouldFail: true,
+				err:        gittypes.ErrAuthenticationFailure,
+			},
+		},
+		{
+			name: "list tree with real repository and head ref but no credential",
+			args: args{
+				repositoryUrl: privateGitRepoURL + "fake",
+				referenceName: "refs/heads/main",
+				username:      "",
+				password:      "",
+				extensions:    []string{},
+			},
+			expect: expectResult{
+				shouldFail: true,
+				err:        gittypes.ErrAuthenticationFailure,
+			},
+		},
+		{
+			name: "list tree with real repository and head ref",
+			args: args{
+				repositoryUrl: privateGitRepoURL,
+				referenceName: "refs/heads/main",
+				username:      username,
+				password:      accessToken,
+				extensions:    []string{},
+			},
+			expect: expectResult{
+				err:          nil,
+				matchedCount: 15,
+			},
+		},
+		{
+			name: "list tree with real repository and head ref and existing file extension",
+			args: args{
+				repositoryUrl: privateGitRepoURL,
+				referenceName: "refs/heads/main",
+				username:      username,
+				password:      accessToken,
+				extensions:    []string{"yml"},
+			},
+			expect: expectResult{
+				err:          nil,
+				matchedCount: 2,
+			},
+		},
+		{
+			name: "list tree with real repository and head ref and non-existing file extension",
+			args: args{
+				repositoryUrl: privateGitRepoURL,
+				referenceName: "refs/heads/main",
+				username:      username,
+				password:      accessToken,
+				extensions:    []string{"hcl"},
+			},
+			expect: expectResult{
+				err:          nil,
+				matchedCount: 2,
+			},
+		},
+		{
+			name: "list tree with real repository but non-existing ref",
+			args: args{
+				repositoryUrl: privateGitRepoURL,
+				referenceName: "refs/fake/feature",
+				username:      username,
+				password:      accessToken,
+				extensions:    []string{},
+			},
+			expect: expectResult{
+				shouldFail: true,
+			},
+		},
+		{
+			name: "list tree with fake repository ",
+			args: args{
+				repositoryUrl: privateGitRepoURL + "fake",
+				referenceName: "refs/fake/feature",
+				username:      username,
+				password:      accessToken,
+				extensions:    []string{},
+			},
+			expect: expectResult{
+				shouldFail: true,
+				err:        gittypes.ErrIncorrectRepositoryURL,
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			paths, err := service.ListFiles(
+				t.Context(),
+				tt.args.repositoryUrl,
+				tt.args.referenceName,
+				tt.args.username,
+				tt.args.password,
+				false,
+				false,
+				tt.args.extensions,
+				false,
+			)
+			if tt.expect.shouldFail {
+				require.Error(t, err)
+				if tt.expect.err != nil {
+					assert.Equal(t, tt.expect.err, err)
+				}
+			} else {
+				require.NoError(t, err)
+				if tt.expect.matchedCount > 0 {
+					assert.NotEmpty(t, paths)
+				}
+			}
+		})
+	}
+}
+
+func TestService_ListFiles_Github_Concurrently(t *testing.T) {
+	t.Parallel()
+	ensureIntegrationTest(t)
+
+	repositoryUrl := privateGitRepoURL
+	accessToken := getRequiredValue(t, "GITHUB_PAT")
+	username := getRequiredValue(t, "GITHUB_USERNAME")
+	service := newService(t.Context(), repositoryCacheSize, 200*time.Millisecond)
+
+	go func() {
+		_, _ = service.ListFiles(
+			t.Context(),
+			repositoryUrl,
+			"refs/heads/main",
+			username,
+			accessToken,
+			false,
+			false,
+			[]string{},
+			false,
+		)
+	}()
+
+	_, err := service.ListFiles(
+		t.Context(),
+		repositoryUrl,
+		"refs/heads/main",
+		username,
+		accessToken,
+		false,
+		false,
+		[]string{},
+		false,
+	)
+	require.NoError(t, err)
+
+	time.Sleep(2 * time.Second)
+}
+
+func TestService_purgeCache_Github(t *testing.T) {
+	t.Parallel()
+	ensureIntegrationTest(t)
+
+	repositoryUrl := privateGitRepoURL
+	accessToken := getRequiredValue(t, "GITHUB_PAT")
+	username := getRequiredValue(t, "GITHUB_USERNAME")
+	service := NewService(t.Context())
+
+	_, err := service.ListRefs(t.Context(), repositoryUrl, username, accessToken, false, false)
+	require.NoError(t, err)
+
+	_, err = service.ListFiles(
+		t.Context(),
+		repositoryUrl,
+		"refs/heads/main",
+		username,
+		accessToken,
+		false,
+		false,
+		[]string{},
+		false,
+	)
+	require.NoError(t, err)
+
+	assert.Equal(t, 1, service.repoRefCache.Len())
+	assert.Equal(t, 1, service.repoFileCache.Len())
+
+	service.purgeCache()
+	assert.Equal(t, 0, service.repoRefCache.Len())
+	assert.Equal(t, 0, service.repoFileCache.Len())
+}
+
+func TestService_purgeCacheByTTL_Github(t *testing.T) {
+	t.Parallel()
+	ensureIntegrationTest(t)
+
+	timeout := 100 * time.Millisecond
+	repositoryUrl := privateGitRepoURL
+	accessToken := getRequiredValue(t, "GITHUB_PAT")
+	username := getRequiredValue(t, "GITHUB_USERNAME")
+	// 40*timeout is designed for giving enough time for ListRefs and ListFiles to cache the result
+	service := newService(t.Context(), 2, 40*timeout)
+
+	_, err := service.ListRefs(t.Context(), repositoryUrl, username, accessToken, false, false)
+	require.NoError(t, err)
+	_, err = service.ListFiles(
+		t.Context(),
+		repositoryUrl,
+		"refs/heads/main",
+		username,
+		accessToken,
+		false,
+		false,
+		[]string{},
+		false,
+	)
+	require.NoError(t, err)
+	assert.Equal(t, 1, service.repoRefCache.Len())
+	assert.Equal(t, 1, service.repoFileCache.Len())
+
+	// 40*timeout is designed for giving enough time for TTL being activated
+	time.Sleep(40 * timeout)
+	assert.Equal(t, 0, service.repoRefCache.Len())
+	assert.Equal(t, 0, service.repoFileCache.Len())
+}
+
+func TestService_HardRefresh_ListRefs_GitHub(t *testing.T) {
+	t.Parallel()
+	ensureIntegrationTest(t)
+
+	accessToken := getRequiredValue(t, "GITHUB_PAT")
+	username := getRequiredValue(t, "GITHUB_USERNAME")
+	service := newService(t.Context(), 2, 0)
+
+	repositoryUrl := privateGitRepoURL
+	refs, err := service.ListRefs(t.Context(), repositoryUrl, username, accessToken, false, false)
+	require.NoError(t, err)
+	assert.GreaterOrEqual(t, len(refs), 1)
+	assert.Equal(t, 1, service.repoRefCache.Len())
+
+	_, err = service.ListRefs(t.Context(), repositoryUrl, username, "fake-token", false, false)
+	require.Error(t, err)
+	assert.Equal(t, 1, service.repoRefCache.Len())
+}
+
+func TestService_HardRefresh_ListRefs_And_RemoveAllCaches_GitHub(t *testing.T) {
+	t.Parallel()
+	ensureIntegrationTest(t)
+
+	accessToken := getRequiredValue(t, "GITHUB_PAT")
+	username := getRequiredValue(t, "GITHUB_USERNAME")
+	service := newService(t.Context(), 2, 0)
+
+	repositoryUrl := privateGitRepoURL
+	refs, err := service.ListRefs(t.Context(), repositoryUrl, username, accessToken, false, false)
+	require.NoError(t, err)
+	assert.GreaterOrEqual(t, len(refs), 1)
+	assert.Equal(t, 1, service.repoRefCache.Len())
+
+	files, err := service.ListFiles(
+		t.Context(),
+		repositoryUrl,
+		"refs/heads/main",
+		username,
+		accessToken,
+		false,
+		false,
+		[]string{},
+		false,
+	)
+	require.NoError(t, err)
+	assert.GreaterOrEqual(t, len(files), 1)
+	assert.Equal(t, 1, service.repoFileCache.Len())
+
+	files, err = service.ListFiles(
+		t.Context(),
+		repositoryUrl,
+		"refs/heads/test",
+		username,
+		accessToken,
+		false,
+		false,
+		[]string{},
+		false,
+	)
+	require.NoError(t, err)
+	assert.GreaterOrEqual(t, len(files), 1)
+	assert.Equal(t, 2, service.repoFileCache.Len())
+
+	_, err = service.ListRefs(t.Context(), repositoryUrl, username, "fake-token", false, false)
+	require.Error(t, err)
+	assert.Equal(t, 1, service.repoRefCache.Len())
+
+	_, err = service.ListRefs(t.Context(), repositoryUrl, username, "fake-token", true, false)
+	require.Error(t, err)
+	assert.Equal(t, 1, service.repoRefCache.Len())
+	// The relevant file caches should be removed too
+	assert.Equal(t, 0, service.repoFileCache.Len())
+}
+
+func TestService_HardRefresh_ListFiles_GitHub(t *testing.T) {
+	t.Parallel()
+	ensureIntegrationTest(t)
+
+	service := newService(t.Context(), 2, 0)
+	accessToken := getRequiredValue(t, "GITHUB_PAT")
+	username := getRequiredValue(t, "GITHUB_USERNAME")
+	repositoryUrl := privateGitRepoURL
+	files, err := service.ListFiles(
+		t.Context(),
+		repositoryUrl,
+		"refs/heads/main",
+		username,
+		accessToken,
+		false,
+		false,
+		[]string{},
+		false,
+	)
+	require.NoError(t, err)
+	assert.GreaterOrEqual(t, len(files), 1)
+	assert.Equal(t, 1, service.repoFileCache.Len())
+
+	_, err = service.ListFiles(
+		t.Context(),
+		repositoryUrl,
+		"refs/heads/main",
+		username,
+		"fake-token",
+		false,
+		true,
+		[]string{},
+		false,
+	)
+	require.Error(t, err)
+	assert.Equal(t, 0, service.repoFileCache.Len())
+}
+
+func TestService_CloneRepository_TokenAuth(t *testing.T) {
+	t.Parallel()
+	ensureIntegrationTest(t)
+
+	service := newService(t.Context(), 2, 0)
+	var requests []*http.Request
+	testServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		requests = append(requests, r)
+	}))
+	accessToken := "test_access_token"
+	username := "test_username"
+	repositoryUrl := testServer.URL
+
+	// Since we aren't hitting a real git server we ignore the error
+	_ = service.CloneRepository(
+		t.Context(),
+		"test_dir",
+		repositoryUrl,
+		"refs/heads/main",
+		username,
+		accessToken,
+		false,
+	)
+
+	testServer.Close()
+
+	if len(requests) != 1 {
+		t.Fatalf("expected 1 request sent but got %d", len(requests))
+	}
+
+	gotAuthHeader := requests[0].Header.Get("Authorization")
+	if gotAuthHeader == "" {
+		t.Fatal("no Authorization header in git request")
+	}
+
+	expectedAuthHeader := "Bearer test_access_token"
+	if gotAuthHeader != expectedAuthHeader {
+		t.Fatalf("expected Authorization header %q but got %q", expectedAuthHeader, gotAuthHeader)
+	}
+}
diff --git a/api/git/git_test.go b/api/git/git_test.go
new file mode 100644
index 0000000..edd2b1c
--- /dev/null
+++ b/api/git/git_test.go
@@ -0,0 +1,506 @@
+package git
+
+import (
+	"os"
+	"testing"
+	"time"
+
+	"github.com/portainer/portainer/api/archive"
+	"github.com/portainer/portainer/api/filesystem"
+	gittypes "github.com/portainer/portainer/api/git/types"
+
+	"github.com/go-git/go-billy/v5/osfs"
+	"github.com/go-git/go-git/v5"
+	"github.com/go-git/go-git/v5/plumbing"
+	"github.com/go-git/go-git/v5/plumbing/filemode"
+	"github.com/go-git/go-git/v5/plumbing/object"
+	githttp "github.com/go-git/go-git/v5/plumbing/transport/http"
+	"github.com/pkg/errors"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func setup(t *testing.T) string {
+	dir := t.TempDir()
+	bareRepoDir := filesystem.JoinPaths(dir, "test-clone.git")
+
+	file, err := os.OpenFile("./testdata/test-clone-git-repo.tar.gz", os.O_RDONLY, 0o755)
+	if err != nil {
+		t.Fatal(errors.Wrap(err, "failed to open an archive"))
+	}
+
+	if err := archive.ExtractTarGz(file, dir); err != nil {
+		t.Fatal(errors.Wrapf(err, "failed to extract file from the archive to a folder %s", dir))
+	}
+
+	return bareRepoDir
+}
+
+func Test_checkGitError(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name     string
+		err      error
+		expected error
+	}{
+		{
+			name:     "exact repository not found",
+			err:      errors.New("repository not found"),
+			expected: gittypes.ErrIncorrectRepositoryURL,
+		},
+		{
+			name:     "repository not found with html body",
+			err:      errors.New("repository not found: <html><body>404 Not Found</body></html>"),
+			expected: gittypes.ErrIncorrectRepositoryURL,
+		},
+		{
+			name:     "authentication required",
+			err:      errors.New("authentication required"),
+			expected: gittypes.ErrAuthenticationFailure,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := checkGitError(tt.err)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+
+	t.Run("other error is unchanged", func(t *testing.T) {
+		err := errors.New("some other git error")
+		assert.EqualError(t, checkGitError(err), "some other git error")
+	})
+}
+
+func Test_ClonePublicRepository_Shallow(t *testing.T) {
+	t.Parallel()
+	service := Service{git: NewGitClient(true)} // no need for http client since the test access the repo via file system.
+	repositoryURL := setup(t)
+	referenceName := "refs/heads/main"
+
+	dir := t.TempDir()
+	t.Logf("Cloning into %s", dir)
+	err := service.CloneRepository(t.Context(), dir, repositoryURL, referenceName, "", "", false)
+	require.NoError(t, err)
+	assert.Equal(t, 1, getCommitHistoryLength(t, dir), "cloned repo has incorrect depth")
+}
+
+func Test_ClonePublicRepository_NoGitDirectory(t *testing.T) {
+	t.Parallel()
+	service := Service{git: NewGitClient(false)} // no need for http client since the test access the repo via file system.
+	repositoryURL := setup(t)
+	referenceName := "refs/heads/main"
+
+	dir := t.TempDir()
+	t.Logf("Cloning into %s", dir)
+	err := service.CloneRepository(t.Context(), dir, repositoryURL, referenceName, "", "", false)
+	require.NoError(t, err)
+	assert.NoDirExists(t, filesystem.JoinPaths(dir, ".git"))
+}
+
+func Test_ClonePublicRepository_NonExistentDst(t *testing.T) {
+	t.Parallel()
+	service := Service{git: NewGitClient(false)}
+	repositoryURL := setup(t)
+	referenceName := "refs/heads/main"
+
+	dir := filesystem.JoinPaths(t.TempDir(), "sub", "dir")
+	err := service.CloneRepository(t.Context(), dir, repositoryURL, referenceName, "", "", false)
+	require.NoError(t, err)
+	assert.DirExists(t, dir)
+	assert.NoDirExists(t, filesystem.JoinPaths(dir, ".git"))
+}
+
+func Test_latestCommitID(t *testing.T) {
+	t.Parallel()
+	service := Service{git: NewGitClient(true)} // no need for http client since the test access the repo via file system.
+
+	repositoryURL := setup(t)
+	referenceName := "refs/heads/main"
+
+	id, err := service.LatestCommitID(t.Context(), repositoryURL, referenceName, "", "", false)
+
+	require.NoError(t, err)
+	assert.Equal(t, "68dcaa7bd452494043c64252ab90db0f98ecf8d2", id)
+}
+
+func Test_ListRefs(t *testing.T) {
+	t.Parallel()
+	service := Service{git: NewGitClient(true)}
+
+	repositoryURL := setup(t)
+
+	fs, err := service.ListRefs(t.Context(), repositoryURL, "", "", false, false)
+
+	require.NoError(t, err)
+	assert.Equal(t, []string{"refs/heads/main"}, fs)
+}
+
+func Test_ListFiles(t *testing.T) {
+	t.Parallel()
+	service := Service{git: NewGitClient(true)}
+
+	repositoryURL := setup(t)
+	referenceName := "refs/heads/main"
+
+	fs, err := service.ListFiles(
+		t.Context(),
+		repositoryURL,
+		referenceName,
+		"",
+		"",
+		false,
+		false,
+		[]string{".yml"},
+		false,
+	)
+
+	require.NoError(t, err)
+	assert.Equal(t, []string{"docker-compose.yml"}, fs)
+}
+
+func getCommitHistoryLength(t *testing.T, dir string) int {
+	repo, err := git.PlainOpen(dir)
+	if err != nil {
+		t.Fatalf("can't open a git repo at %s with error %v", dir, err)
+	}
+
+	iter, err := repo.Log(&git.LogOptions{All: true})
+	if err != nil {
+		t.Fatalf("can't get a commit history iterator with error %v", err)
+	}
+
+	count := 0
+	if err := iter.ForEach(func(_ *object.Commit) error {
+		count++
+		return nil
+	}); err != nil {
+		t.Fatalf("can't iterate over the commit history with error %v", err)
+	}
+
+	return count
+}
+
+func Test_noSymlinkFS_Symlink(t *testing.T) {
+	fs := NewNoSymlinkFS(osfs.New(t.TempDir()))
+	err := fs.Symlink("../../../etc/passwd", "evil-link")
+	require.ErrorIs(t, err, gittypes.ErrSymlinkDetected)
+}
+
+func Test_noSymlinkFS_OtherOperations(t *testing.T) {
+	dir := t.TempDir()
+	fs := NewNoSymlinkFS(osfs.New(dir))
+
+	f, err := fs.Create("test.txt")
+	require.NoError(t, err)
+
+	_, err = f.Write([]byte("hello"))
+	require.NoError(t, err)
+
+	err = f.Close()
+	require.NoError(t, err)
+
+	info, err := fs.Stat("test.txt")
+	require.NoError(t, err)
+	require.Equal(t, "test.txt", info.Name())
+}
+
+func createBareRepoWithSymlink(t *testing.T) string {
+	t.Helper()
+
+	bareDir := filesystem.JoinPaths(t.TempDir(), "symlink-repo.git")
+
+	repo, err := git.PlainInit(bareDir, true)
+	require.NoError(t, err)
+
+	storer := repo.Storer
+
+	fileBlob := &plumbing.MemoryObject{}
+	fileBlob.SetType(plumbing.BlobObject)
+
+	_, err = fileBlob.Write([]byte("hello world\n"))
+	require.NoError(t, err)
+
+	fileHash, err := storer.SetEncodedObject(fileBlob)
+	require.NoError(t, err)
+
+	symlinkBlob := &plumbing.MemoryObject{}
+	symlinkBlob.SetType(plumbing.BlobObject)
+
+	_, err = symlinkBlob.Write([]byte("../../../etc/passwd"))
+	require.NoError(t, err)
+
+	symlinkHash, err := storer.SetEncodedObject(symlinkBlob)
+	require.NoError(t, err)
+
+	tree := &object.Tree{
+		Entries: []object.TreeEntry{
+			{Name: "evil-link", Mode: filemode.Symlink, Hash: symlinkHash},
+			{Name: "file.txt", Mode: filemode.Regular, Hash: fileHash},
+		},
+	}
+
+	treeObj := &plumbing.MemoryObject{}
+
+	err = tree.Encode(treeObj)
+	require.NoError(t, err)
+
+	treeHash, err := storer.SetEncodedObject(treeObj)
+	require.NoError(t, err)
+
+	sig := object.Signature{Name: "Test", Email: "test@test.com", When: time.Now()}
+	commit := &object.Commit{
+		Message:   "add symlink",
+		Author:    sig,
+		Committer: sig,
+		TreeHash:  treeHash,
+	}
+
+	commitObj := &plumbing.MemoryObject{}
+
+	err = commit.Encode(commitObj)
+	require.NoError(t, err)
+
+	commitHash, err := storer.SetEncodedObject(commitObj)
+	require.NoError(t, err)
+
+	err = storer.SetReference(plumbing.NewHashReference("refs/heads/main", commitHash))
+	require.NoError(t, err)
+
+	err = storer.SetReference(plumbing.NewSymbolicReference(plumbing.HEAD, "refs/heads/main"))
+	require.NoError(t, err)
+
+	return bareDir
+}
+
+func Test_Download_RejectsSymlink(t *testing.T) {
+	t.Parallel()
+	client := NewGitClient(false)
+	repoURL := createBareRepoWithSymlink(t)
+
+	err := client.Download(t.Context(), t.TempDir(), &git.CloneOptions{
+		URL:          repoURL,
+		Depth:        1,
+		SingleBranch: true,
+		Tags:         git.NoTags,
+	})
+	require.Error(t, err)
+	require.ErrorIs(t, err, gittypes.ErrSymlinkDetected)
+}
+
+func Test_listRefsPrivateRepository(t *testing.T) {
+	t.Parallel()
+	ensureIntegrationTest(t)
+
+	accessToken := getRequiredValue(t, "GITHUB_PAT")
+	username := getRequiredValue(t, "GITHUB_USERNAME")
+
+	client := NewGitClient(false)
+
+	type args struct {
+		repositoryUrl string
+		username      string
+		password      string
+	}
+
+	type expectResult struct {
+		err       error
+		refsCount int
+	}
+
+	tests := []struct {
+		name   string
+		args   args
+		expect expectResult
+	}{
+		{
+			name: "list refs of a real private repository",
+			args: args{
+				repositoryUrl: privateGitRepoURL,
+				username:      username,
+				password:      accessToken,
+			},
+			expect: expectResult{
+				err:       nil,
+				refsCount: 2,
+			},
+		},
+		{
+			name: "list refs of a real private repository with incorrect credential",
+			args: args{
+				repositoryUrl: privateGitRepoURL,
+				username:      "test-username",
+				password:      "test-token",
+			},
+			expect: expectResult{
+				err: gittypes.ErrAuthenticationFailure,
+			},
+		},
+		{
+			name: "list refs of a fake repository without providing credential",
+			args: args{
+				repositoryUrl: privateGitRepoURL + "fake",
+				username:      "",
+				password:      "",
+			},
+			expect: expectResult{
+				err: gittypes.ErrAuthenticationFailure,
+			},
+		},
+		{
+			name: "list refs of a fake repository",
+			args: args{
+				repositoryUrl: privateGitRepoURL + "fake",
+				username:      username,
+				password:      accessToken,
+			},
+			expect: expectResult{
+				err: gittypes.ErrIncorrectRepositoryURL,
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			option := &git.ListOptions{}
+			if tt.args.username != "" || tt.args.password != "" {
+				option.Auth = &githttp.BasicAuth{
+					Username: tt.args.username,
+					Password: tt.args.password,
+				}
+			}
+			refs, err := client.ListRefs(t.Context(), tt.args.repositoryUrl, option)
+			if tt.expect.err == nil {
+				require.NoError(t, err)
+				if tt.expect.refsCount > 0 {
+					assert.NotEmpty(t, refs)
+				}
+			} else {
+				require.Error(t, err)
+				assert.Equal(t, tt.expect.err, err)
+			}
+		})
+	}
+}
+
+func Test_listFilesPrivateRepository(t *testing.T) {
+	t.Parallel()
+	ensureIntegrationTest(t)
+
+	client := NewGitClient(false)
+
+	type args struct {
+		repositoryUrl string
+		referenceName string
+		username      string
+		password      string
+	}
+
+	type expectResult struct {
+		shouldFail   bool
+		err          error
+		matchedCount int
+	}
+
+	accessToken := getRequiredValue(t, "GITHUB_PAT")
+	username := getRequiredValue(t, "GITHUB_USERNAME")
+
+	tests := []struct {
+		name   string
+		args   args
+		expect expectResult
+	}{
+		{
+			name: "list tree with real repository and head ref but incorrect credential",
+			args: args{
+				repositoryUrl: privateGitRepoURL,
+				referenceName: "refs/heads/main",
+				username:      "test-username",
+				password:      "test-token",
+			},
+			expect: expectResult{
+				shouldFail: true,
+				err:        gittypes.ErrAuthenticationFailure,
+			},
+		},
+		{
+			name: "list tree with real repository and head ref but no credential",
+			args: args{
+				repositoryUrl: privateGitRepoURL,
+				referenceName: "refs/heads/main",
+				username:      "",
+				password:      "",
+			},
+			expect: expectResult{
+				shouldFail: true,
+				err:        gittypes.ErrAuthenticationFailure,
+			},
+		},
+		{
+			name: "list tree with real repository and head ref",
+			args: args{
+				repositoryUrl: privateGitRepoURL,
+				referenceName: "refs/heads/main",
+				username:      username,
+				password:      accessToken,
+			},
+			expect: expectResult{
+				err:          nil,
+				matchedCount: 15,
+			},
+		},
+		{
+			name: "list tree with real repository but non-existing ref",
+			args: args{
+				repositoryUrl: privateGitRepoURL,
+				referenceName: "refs/fake/feature",
+				username:      username,
+				password:      accessToken,
+			},
+			expect: expectResult{
+				shouldFail: true,
+			},
+		},
+		{
+			name: "list tree with fake repository ",
+			args: args{
+				repositoryUrl: privateGitRepoURL + "fake",
+				referenceName: "refs/fake/feature",
+				username:      username,
+				password:      accessToken,
+			},
+			expect: expectResult{
+				shouldFail: true,
+				err:        gittypes.ErrIncorrectRepositoryURL,
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			option := &git.CloneOptions{
+				URL:           tt.args.repositoryUrl,
+				ReferenceName: plumbing.ReferenceName(tt.args.referenceName),
+			}
+			if tt.args.username != "" || tt.args.password != "" {
+				option.Auth = &githttp.BasicAuth{
+					Username: tt.args.username,
+					Password: tt.args.password,
+				}
+			}
+			paths, err := client.ListFiles(t.Context(), false, option)
+			if tt.expect.shouldFail {
+				require.Error(t, err)
+				if tt.expect.err != nil {
+					assert.Equal(t, tt.expect.err, err)
+				}
+			} else {
+				require.NoError(t, err)
+				if tt.expect.matchedCount > 0 {
+					assert.NotEmpty(t, paths)
+				}
+			}
+		})
+	}
+}
diff --git a/api/git/service.go b/api/git/service.go
new file mode 100644
index 0000000..a48611a
--- /dev/null
+++ b/api/git/service.go
@@ -0,0 +1,367 @@
+package git
+
+import (
+	"context"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/portainer/portainer/pkg/schedule"
+
+	"github.com/go-git/go-git/v5"
+	"github.com/go-git/go-git/v5/plumbing"
+	"github.com/go-git/go-git/v5/plumbing/transport"
+	githttp "github.com/go-git/go-git/v5/plumbing/transport/http"
+	lru "github.com/hashicorp/golang-lru"
+	"github.com/rs/zerolog/log"
+	"golang.org/x/sync/singleflight"
+)
+
+const (
+	repositoryCacheSize = 4
+	repositoryCacheTTL  = 5 * time.Minute
+)
+
+type RepoManager interface {
+	Download(ctx context.Context, dst string, opt *git.CloneOptions) error
+	LatestCommitID(ctx context.Context, repositoryUrl, referenceName string, opt *git.ListOptions) (string, error)
+	ListRefs(ctx context.Context, repositoryUrl string, opt *git.ListOptions) ([]string, error)
+	ListFiles(ctx context.Context, dirOnly bool, opt *git.CloneOptions) ([]string, error)
+}
+
+// Service represents a service for managing Git.
+type Service struct {
+	azure RepoManager
+	git   RepoManager
+
+	cacheEnabled bool
+	// Cache the result of repository refs, key is repository URL
+	repoRefCache *lru.Cache
+	// Cache the result of repository file tree, key is the concatenated string of repository URL and ref value
+	repoFileCache *lru.Cache
+}
+
+// NewService initializes a new service.
+func NewService(ctx context.Context) *Service {
+	return newService(ctx, repositoryCacheSize, repositoryCacheTTL)
+}
+
+func newService(ctx context.Context, cacheSize int, cacheTTL time.Duration) *Service {
+	service := &Service{
+		azure:        NewAzureClient(),
+		git:          NewGitClient(false),
+		cacheEnabled: cacheSize > 0,
+	}
+
+	if !service.cacheEnabled {
+		return service
+	}
+
+	var err error
+	service.repoRefCache, err = lru.New(cacheSize)
+	if err != nil {
+		log.Debug().Err(err).Msg("failed to create ref cache")
+	}
+
+	service.repoFileCache, err = lru.New(cacheSize)
+	if err != nil {
+		log.Debug().Err(err).Msg("failed to create file cache")
+	}
+
+	if cacheTTL > 0 {
+		go schedule.RunOnInterval(ctx, cacheTTL, service.purgeCache, nil)
+	}
+
+	return service
+}
+
+// CloneRepository clones a git repository using the specified URL in the specified
+// destination folder.
+func (service *Service) CloneRepository(
+	ctx context.Context,
+	destination,
+	repositoryURL,
+	referenceName,
+	username,
+	password string,
+	tlsSkipVerify bool,
+) error {
+	return service.CloneRepositoryWithAuth(ctx, destination, repositoryURL, referenceName, GetBasicAuth(username, password), tlsSkipVerify)
+}
+
+// CloneRepositoryWithAuth clones a git repository using the specified URL in the specified
+// destination folder, using the provided auth method.
+func (service *Service) CloneRepositoryWithAuth(
+	ctx context.Context,
+	destination,
+	repositoryURL,
+	referenceName string,
+	auth transport.AuthMethod,
+	tlsSkipVerify bool,
+) error {
+	gitOptions := &git.CloneOptions{
+		URL:             repositoryURL,
+		Depth:           1,
+		InsecureSkipTLS: tlsSkipVerify,
+		Auth:            auth,
+		Tags:            git.NoTags,
+	}
+
+	if referenceName != "" {
+		gitOptions.ReferenceName = plumbing.ReferenceName(referenceName)
+	}
+
+	return service.repoManager(repositoryURL).Download(ctx, destination, gitOptions)
+}
+
+func (service *Service) repoManager(repositoryURL string) RepoManager {
+	repoManager := service.git
+
+	if IsAzureUrl(repositoryURL) {
+		repoManager = service.azure
+	}
+
+	return repoManager
+}
+
+// LatestCommitID returns SHA1 of the latest commit of the specified reference
+func (service *Service) LatestCommitID(
+	ctx context.Context,
+	repositoryURL,
+	referenceName,
+	username,
+	password string,
+	tlsSkipVerify bool,
+) (string, error) {
+	return service.LatestCommitIDWithAuth(ctx, repositoryURL, referenceName, GetBasicAuth(username, password), tlsSkipVerify)
+}
+
+// LatestCommitIDWithAuth returns SHA1 of the latest commit of the specified reference,
+// using the provided auth method.
+func (service *Service) LatestCommitIDWithAuth(
+	ctx context.Context,
+	repositoryURL,
+	referenceName string,
+	auth transport.AuthMethod,
+	tlsSkipVerify bool,
+) (string, error) {
+	listOptions := &git.ListOptions{
+		Auth:            auth,
+		InsecureSkipTLS: tlsSkipVerify,
+	}
+
+	return service.repoManager(repositoryURL).LatestCommitID(ctx, repositoryURL, referenceName, listOptions)
+}
+
+// ListRefs will list target repository's references without cloning the repository
+func (service *Service) ListRefs(
+	ctx context.Context,
+	repositoryURL,
+	username,
+	password string,
+	hardRefresh bool,
+	tlsSkipVerify bool,
+) ([]string, error) {
+	cacheKey := GenerateCacheKey(repositoryURL, username, password, strconv.FormatBool(tlsSkipVerify))
+	return service.ListRefsWithAuth(ctx, repositoryURL, hardRefresh, GetBasicAuth(username, password), tlsSkipVerify, cacheKey)
+}
+
+// ListRefsWithAuth will list target repository's references without cloning the repository,
+// using the provided auth method. The cacheKey is supplied by the caller.
+func (service *Service) ListRefsWithAuth(
+	ctx context.Context,
+	repositoryURL string,
+	hardRefresh bool,
+	auth transport.AuthMethod,
+	tlsSkipVerify bool,
+	cacheKey string,
+) ([]string, error) {
+	if service.cacheEnabled && hardRefresh {
+		// Should remove the cache explicitly, so that the following normal list can show the correct result
+		service.repoRefCache.Remove(cacheKey)
+		// Remove file caches pointed to the same repository
+		for _, fileCacheKey := range service.repoFileCache.Keys() {
+			if key, ok := fileCacheKey.(string); ok && strings.HasPrefix(key, repositoryURL) {
+				service.repoFileCache.Remove(key)
+			}
+		}
+	}
+
+	if service.repoRefCache != nil {
+		// Lookup the refs cache first
+		if cache, ok := service.repoRefCache.Get(cacheKey); ok {
+			if refs, ok := cache.([]string); ok {
+				return refs, nil
+			}
+		}
+	}
+
+	options := &git.ListOptions{
+		Auth:            auth,
+		InsecureSkipTLS: tlsSkipVerify,
+	}
+
+	refs, err := service.repoManager(repositoryURL).ListRefs(ctx, repositoryURL, options)
+	if err != nil {
+		return nil, err
+	}
+
+	if service.cacheEnabled && service.repoRefCache != nil {
+		service.repoRefCache.Add(cacheKey, refs)
+	}
+
+	return refs, nil
+}
+
+var singleflightGroup = &singleflight.Group{}
+
+// ListFiles will list all the files of the target repository with specific extensions.
+// If extension is not provided, it will list all the files under the target repository
+func (service *Service) ListFiles(
+	ctx context.Context,
+	repositoryURL,
+	referenceName,
+	username,
+	password string,
+	dirOnly,
+	hardRefresh bool,
+	includedExts []string,
+	tlsSkipVerify bool,
+) ([]string, error) {
+	cacheKey := GenerateCacheKey(
+		repositoryURL,
+		referenceName,
+		username,
+		password,
+		strconv.FormatBool(tlsSkipVerify),
+		strconv.FormatBool(dirOnly),
+	)
+	return service.ListFilesWithAuth(ctx, repositoryURL, referenceName, dirOnly, hardRefresh, GetBasicAuth(username, password), includedExts, tlsSkipVerify, cacheKey)
+}
+
+// ListFilesWithAuth will list all the files of the target repository with specific extensions,
+// using the provided auth method. The cacheKey is supplied by the caller.
+func (service *Service) ListFilesWithAuth(
+	ctx context.Context,
+	repositoryURL,
+	referenceName string,
+	dirOnly,
+	hardRefresh bool,
+	auth transport.AuthMethod,
+	includedExts []string,
+	tlsSkipVerify bool,
+	cacheKey string,
+) ([]string, error) {
+	fs, err, _ := singleflightGroup.Do(cacheKey, func() (any, error) {
+		return service.listFilesWithAuth(ctx, repositoryURL, referenceName, dirOnly, hardRefresh, auth, tlsSkipVerify, cacheKey)
+	})
+
+	return filterFiles(fs.([]string), includedExts), err
+}
+
+func (service *Service) listFilesWithAuth(
+	ctx context.Context,
+	repositoryURL,
+	referenceName string,
+	dirOnly,
+	hardRefresh bool,
+	auth transport.AuthMethod,
+	tlsSkipVerify bool,
+	cacheKey string,
+) ([]string, error) {
+	if service.cacheEnabled && hardRefresh {
+		// Should remove the cache explicitly, so that the following normal list can show the correct result
+		service.repoFileCache.Remove(cacheKey)
+	}
+
+	if service.repoFileCache != nil {
+		// lookup the files cache first
+		if cache, ok := service.repoFileCache.Get(cacheKey); ok {
+			if files, ok := cache.([]string); ok {
+				return files, nil
+			}
+		}
+	}
+
+	cloneOption := &git.CloneOptions{
+		URL:             repositoryURL,
+		NoCheckout:      true,
+		Depth:           1,
+		SingleBranch:    true,
+		ReferenceName:   plumbing.ReferenceName(referenceName),
+		Auth:            auth,
+		InsecureSkipTLS: tlsSkipVerify,
+		Tags:            git.NoTags,
+	}
+
+	files, err := service.repoManager(repositoryURL).ListFiles(ctx, dirOnly, cloneOption)
+	if err != nil {
+		return nil, err
+	}
+
+	if service.cacheEnabled && service.repoFileCache != nil {
+		service.repoFileCache.Add(cacheKey, files)
+	}
+
+	return files, nil
+}
+
+func (service *Service) purgeCache() {
+	if service.repoRefCache != nil {
+		service.repoRefCache.Purge()
+	}
+
+	if service.repoFileCache != nil {
+		service.repoFileCache.Purge()
+	}
+}
+
+// GenerateCacheKey generates a cache key from the given parts.
+func GenerateCacheKey(names ...string) string {
+	return strings.Join(names, "-")
+}
+
+func matchExtensions(target string, exts []string) bool {
+	if len(exts) == 0 {
+		return true
+	}
+
+	for _, ext := range exts {
+		if strings.HasSuffix(target, ext) {
+			return true
+		}
+	}
+
+	return false
+}
+
+func filterFiles(paths []string, includedExts []string) []string {
+	if len(includedExts) == 0 {
+		return paths
+	}
+
+	var includedFiles []string
+	for _, filename := range paths {
+		// Filter out the filenames with non-included extension
+		if matchExtensions(filename, includedExts) {
+			includedFiles = append(includedFiles, filename)
+		}
+	}
+
+	return includedFiles
+}
+
+func GetBasicAuth(username, password string) *githttp.BasicAuth {
+	if password == "" {
+		return nil
+	}
+
+	if username == "" {
+		username = "token"
+	}
+
+	return &githttp.BasicAuth{
+		Username: username,
+		Password: password,
+	}
+}
diff --git a/api/git/service_test.go b/api/git/service_test.go
new file mode 100644
index 0000000..25a4bb7
--- /dev/null
+++ b/api/git/service_test.go
@@ -0,0 +1,343 @@
+package git
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/go-git/go-git/v5"
+	"github.com/go-git/go-git/v5/plumbing"
+)
+
+type mockRepoManager struct {
+	downloadErr error
+	commitID    string
+	commitIDErr error
+	refs        []string
+	refsErr     error
+	files       []string
+	filesErr    error
+
+	downloadCalled   int
+	commitIDCalled   int
+	listRefsCalled   int
+	listFilesCalled  int
+	lastCloneOptions *git.CloneOptions
+}
+
+func (m *mockRepoManager) Download(_ context.Context, _ string, opts *git.CloneOptions) error {
+	m.downloadCalled++
+	m.lastCloneOptions = opts
+	return m.downloadErr
+}
+
+func (m *mockRepoManager) LatestCommitID(_ context.Context, _, _ string, _ *git.ListOptions) (string, error) {
+	m.commitIDCalled++
+	return m.commitID, m.commitIDErr
+}
+
+func (m *mockRepoManager) ListRefs(_ context.Context, _ string, _ *git.ListOptions) ([]string, error) {
+	m.listRefsCalled++
+	return m.refs, m.refsErr
+}
+
+func (m *mockRepoManager) ListFiles(_ context.Context, _ bool, _ *git.CloneOptions) ([]string, error) {
+	m.listFilesCalled++
+	return m.files, m.filesErr
+}
+
+func newTestService(ctx context.Context, cacheSize int, gitMgr, azureMgr RepoManager) *Service {
+	s := newService(ctx, cacheSize, 0)
+	s.git = gitMgr
+	s.azure = azureMgr
+	return s
+}
+
+func TestCloneRepository(t *testing.T) {
+	t.Parallel()
+	downloadErr := errors.New("clone failed")
+
+	testCases := []struct {
+		name                       string
+		url                        string
+		referenceName              string
+		gitManagerDownloadCalled   int
+		azureManagerDownloadCalled int
+		managerErr                 bool
+		expectedError              error
+		expectedReferenceName      string
+	}{
+		{
+			name:                       "non-azure URL routes to git manager",
+			url:                        "https://github.com/example/repo.git",
+			gitManagerDownloadCalled:   1,
+			azureManagerDownloadCalled: 0,
+		},
+		{
+			name:                       "azure URL routes to azure manager",
+			url:                        "https://dev.azure.com/org/project/_git/repo",
+			gitManagerDownloadCalled:   0,
+			azureManagerDownloadCalled: 1,
+		},
+		{
+			name:                     "error from manager propagated",
+			url:                      "https://github.com/example/repo.git",
+			managerErr:               true,
+			gitManagerDownloadCalled: 1,
+			expectedError:            downloadErr,
+		},
+		{
+			name:                     "ReferenceName is passed to clone options",
+			url:                      "https://github.com/example/repo.git",
+			referenceName:            "refs/heads/feature-branch",
+			gitManagerDownloadCalled: 1,
+			expectedReferenceName:    "refs/heads/feature-branch",
+		},
+		{
+			name:                     "empty ReferenceName leaves clone options unset",
+			url:                      "https://github.com/example/repo.git",
+			referenceName:            "",
+			gitManagerDownloadCalled: 1,
+			expectedReferenceName:    "",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			gitMgr := &mockRepoManager{}
+			azureMgr := &mockRepoManager{}
+			if tc.managerErr {
+				gitMgr.downloadErr = downloadErr
+				azureMgr.downloadErr = downloadErr
+			}
+			s := newTestService(t.Context(), 4, gitMgr, azureMgr)
+
+			err := s.CloneRepository(t.Context(), "/tmp", tc.url, tc.referenceName, "", "", false)
+			require.Equal(t, tc.expectedError, err)
+			require.Equal(t, tc.gitManagerDownloadCalled, gitMgr.downloadCalled)
+			require.Equal(t, tc.azureManagerDownloadCalled, azureMgr.downloadCalled)
+
+			activeMgr := gitMgr
+			if tc.azureManagerDownloadCalled > 0 {
+				activeMgr = azureMgr
+			}
+			if activeMgr.lastCloneOptions != nil {
+				require.Equal(t, plumbing.ReferenceName(tc.expectedReferenceName), activeMgr.lastCloneOptions.ReferenceName)
+			}
+		})
+	}
+}
+
+func TestLatestCommitID(t *testing.T) {
+	t.Parallel()
+	commitLookupErr := errors.New("commit lookup failed")
+
+	testCases := []struct {
+		name          string
+		url           string
+		gitCommitID   string
+		azureCommitID string
+		commitIDErr   error
+		expectedID    string
+		expectedError error
+		gitCalled     int
+		azureCalled   int
+	}{
+		{
+			name:        "non-azure URL routes to git manager",
+			url:         "https://github.com/example/repo.git",
+			gitCommitID: "abc123",
+			expectedID:  "abc123",
+			gitCalled:   1,
+		},
+		{
+			name:          "azure URL routes to azure manager",
+			url:           "https://dev.azure.com/org/project/_git/repo",
+			azureCommitID: "def456",
+			expectedID:    "def456",
+			azureCalled:   1,
+		},
+		{
+			name:          "error propagated",
+			url:           "https://github.com/example/repo.git",
+			commitIDErr:   commitLookupErr,
+			expectedError: commitLookupErr,
+			gitCalled:     1,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			gitMgr := &mockRepoManager{commitID: tc.gitCommitID, commitIDErr: tc.commitIDErr}
+			azureMgr := &mockRepoManager{commitID: tc.azureCommitID}
+			s := newTestService(t.Context(), 4, gitMgr, azureMgr)
+
+			id, err := s.LatestCommitID(t.Context(), tc.url, "", "", "", false)
+			require.Equal(t, tc.expectedError, err)
+			require.Equal(t, tc.expectedID, id)
+			require.Equal(t, tc.gitCalled, gitMgr.commitIDCalled)
+			require.Equal(t, tc.azureCalled, azureMgr.commitIDCalled)
+		})
+	}
+}
+
+func TestListRefs(t *testing.T) {
+	t.Parallel()
+	t.Run("cache hit on second call", func(t *testing.T) {
+		gitMgr := &mockRepoManager{refs: []string{"refs/heads/main", "refs/heads/develop"}}
+		s := newTestService(t.Context(), 4, gitMgr, &mockRepoManager{})
+
+		refs1, err := s.ListRefs(t.Context(), "https://github.com/example/repo.git", "", "", false, false)
+		require.NoError(t, err)
+
+		refs2, err := s.ListRefs(t.Context(), "https://github.com/example/repo.git", "", "", false, false)
+		require.NoError(t, err)
+
+		require.Equal(t, 1, gitMgr.listRefsCalled, "expected manager to be called once")
+		require.Equal(t, refs1, refs2)
+	})
+
+	t.Run("hard refresh clears cache and calls manager again", func(t *testing.T) {
+		gitMgr := &mockRepoManager{refs: []string{"refs/heads/main"}}
+		s := newTestService(t.Context(), 4, gitMgr, &mockRepoManager{})
+
+		_, err := s.ListRefs(t.Context(), "https://github.com/example/repo.git", "", "", false, false)
+		require.NoError(t, err)
+		_, err = s.ListRefs(t.Context(), "https://github.com/example/repo.git", "", "", true, false)
+		require.NoError(t, err)
+
+		require.Equal(t, 2, gitMgr.listRefsCalled, "expected manager to be called twice with hard refresh")
+	})
+
+	t.Run("error propagated and not cached", func(t *testing.T) {
+		wantErr := errors.New("refs failed")
+		gitMgr := &mockRepoManager{refsErr: wantErr}
+		s := newTestService(t.Context(), 4, gitMgr, &mockRepoManager{})
+
+		_, err := s.ListRefs(t.Context(), "https://github.com/example/repo.git", "", "", false, false)
+		require.Equal(t, wantErr, err)
+
+		_, err = s.ListRefs(t.Context(), "https://github.com/example/repo.git", "", "", true, false)
+		require.Equal(t, wantErr, err)
+		require.Equal(t, 2, gitMgr.listRefsCalled, "expected manager to be called twice after error")
+	})
+
+	t.Run("azure URL routes to azure manager", func(t *testing.T) {
+		gitMgr := &mockRepoManager{}
+		azureMgr := &mockRepoManager{refs: []string{"refs/heads/main"}}
+		s := newTestService(t.Context(), 4, gitMgr, azureMgr)
+
+		_, err := s.ListRefs(t.Context(), "https://dev.azure.com/org/project/_git/repo", "", "", false, false)
+		require.NoError(t, err)
+		require.Equal(t, 1, azureMgr.listRefsCalled, "expected azure.ListRefs to be called once")
+		require.Equal(t, 0, gitMgr.listRefsCalled, "expected git.ListRefs to not be called")
+	})
+
+	t.Run("cache disabled: manager always called", func(t *testing.T) {
+		gitMgr := &mockRepoManager{refs: []string{"refs/heads/main"}}
+		s := newTestService(t.Context(), 0, gitMgr, &mockRepoManager{})
+
+		_, err := s.ListRefs(t.Context(), "https://github.com/example/repo.git", "", "", false, false)
+		require.NoError(t, err)
+		_, err = s.ListRefs(t.Context(), "https://github.com/example/repo.git", "", "", false, false)
+		require.NoError(t, err)
+
+		require.Equal(t, 2, gitMgr.listRefsCalled, "expected manager to be called twice with cache disabled")
+	})
+}
+
+func TestListFiles(t *testing.T) {
+	t.Parallel()
+	t.Run("cache hit on second call", func(t *testing.T) {
+		gitMgr := &mockRepoManager{files: []string{"docker-compose.yml", "README.md"}}
+		s := newTestService(t.Context(), 4, gitMgr, &mockRepoManager{})
+
+		files1, err := s.ListFiles(t.Context(), "https://github.com/example/repo.git", "refs/heads/main", "", "", false, false, nil, false)
+		require.NoError(t, err)
+
+		files2, err := s.ListFiles(t.Context(), "https://github.com/example/repo.git", "refs/heads/main", "", "", false, false, nil, false)
+		require.NoError(t, err)
+
+		require.Equal(t, 1, gitMgr.listFilesCalled, "expected manager to be called once")
+		require.Equal(t, files1, files2)
+	})
+
+	t.Run("hard refresh clears file cache", func(t *testing.T) {
+		gitMgr := &mockRepoManager{files: []string{"docker-compose.yml"}}
+		s := newTestService(t.Context(), 4, gitMgr, &mockRepoManager{})
+
+		_, err := s.ListFiles(t.Context(), "https://github.com/example/repo.git", "refs/heads/main", "", "", false, false, nil, false)
+		require.NoError(t, err)
+		_, err = s.ListFiles(t.Context(), "https://github.com/example/repo.git", "refs/heads/main", "", "", false, true, nil, false)
+		require.NoError(t, err)
+
+		require.Equal(t, 2, gitMgr.listFilesCalled, "expected manager to be called twice with hard refresh")
+	})
+
+	t.Run("azure URL routes to azure manager", func(t *testing.T) {
+		gitMgr := &mockRepoManager{}
+		azureMgr := &mockRepoManager{files: []string{"docker-compose.yml"}}
+		s := newTestService(t.Context(), 4, gitMgr, azureMgr)
+
+		_, err := s.ListFiles(t.Context(), "https://dev.azure.com/org/project/_git/repo", "", "", "", false, false, nil, false)
+		require.NoError(t, err)
+		require.Equal(t, 1, azureMgr.listFilesCalled, "expected azure.ListFiles to be called once")
+		require.Equal(t, 0, gitMgr.listFilesCalled, "expected git.ListFiles to not be called")
+	})
+
+	t.Run("extension filter applied", func(t *testing.T) {
+		gitMgr := &mockRepoManager{files: []string{"docker-compose.yml", "README.md", "stack.yml", "config.json"}}
+		s := newTestService(t.Context(), 4, gitMgr, &mockRepoManager{})
+
+		files, err := s.ListFiles(t.Context(), "https://github.com/example/repo.git", "", "", "", false, false, []string{".yml"}, false)
+		require.NoError(t, err)
+		require.Equal(t, []string{"docker-compose.yml", "stack.yml"}, files)
+	})
+
+	t.Run("error is returned and not cached", func(t *testing.T) {
+		wantErr := errors.New("list files failed")
+		gitMgr := &mockRepoManager{filesErr: wantErr}
+		s := newTestService(t.Context(), 4, gitMgr, &mockRepoManager{})
+
+		files, err := s.ListFiles(t.Context(), "https://github.com/example/repo.git", "refs/heads/main", "", "", false, false, nil, false)
+		require.ErrorIs(t, err, wantErr)
+		require.Nil(t, files)
+	})
+}
+
+func TestFilterFiles(t *testing.T) {
+	t.Parallel()
+	testCases := []struct {
+		name          string
+		files         []string
+		exts          []string
+		expectedFiles []string
+	}{
+		{
+			name:          "empty ext list returns all files",
+			files:         []string{"a.yml", "b.json", "c.txt"},
+			exts:          nil,
+			expectedFiles: []string{"a.yml", "b.json", "c.txt"},
+		},
+		{
+			name:          "non-matching exts returns empty",
+			files:         []string{"a.yml", "b.json"},
+			exts:          []string{".txt"},
+			expectedFiles: nil,
+		},
+		{
+			name:          "partial match returns only matching files",
+			files:         []string{"a.yml", "b.json", "c.yml"},
+			exts:          []string{".yml"},
+			expectedFiles: []string{"a.yml", "c.yml"},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			require.Equal(t, tc.expectedFiles, filterFiles(tc.files, tc.exts))
+		})
+	}
+}
diff --git a/api/git/ssrf_transport.go b/api/git/ssrf_transport.go
new file mode 100644
index 0000000..6ef4614
--- /dev/null
+++ b/api/git/ssrf_transport.go
@@ -0,0 +1,53 @@
+package git
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"strconv"
+
+	"github.com/portainer/portainer/pkg/libhttp/ssrf"
+
+	gittransport "github.com/go-git/go-git/v5/plumbing/transport"
+)
+
+const gitDefaultPort = 9418
+
+// ssrfGitTransport wraps a git:// transport and validates the resolved IP
+// against the SSRF policy before establishing connections.
+type ssrfGitTransport struct {
+	inner gittransport.Transport
+}
+
+// NewSSRFGitTransport wraps inner and blocks connections to private IP ranges
+// according to the active SSRF policy.
+func NewSSRFGitTransport(inner gittransport.Transport) gittransport.Transport {
+	return &ssrfGitTransport{inner: inner}
+}
+
+func (t *ssrfGitTransport) NewUploadPackSession(ep *gittransport.Endpoint, auth gittransport.AuthMethod) (gittransport.UploadPackSession, error) {
+	if err := checkEndpointSSRF(ep); err != nil {
+		return nil, err
+	}
+
+	return t.inner.NewUploadPackSession(ep, auth)
+}
+
+func (t *ssrfGitTransport) NewReceivePackSession(ep *gittransport.Endpoint, auth gittransport.AuthMethod) (gittransport.ReceivePackSession, error) {
+	if err := checkEndpointSSRF(ep); err != nil {
+		return nil, err
+	}
+
+	return t.inner.NewReceivePackSession(ep, auth)
+}
+
+func checkEndpointSSRF(ep *gittransport.Endpoint) error {
+	port := ep.Port
+	if port <= 0 {
+		port = gitDefaultPort
+	}
+
+	rawURL := fmt.Sprintf("git://%s/", net.JoinHostPort(ep.Host, strconv.Itoa(port)))
+
+	return ssrf.CheckURL(context.Background(), rawURL)
+}
diff --git a/api/git/testdata/azure-repo copy.zip b/api/git/testdata/azure-repo copy.zip
new file mode 100644
index 0000000..d4b53d0
Binary files /dev/null and b/api/git/testdata/azure-repo copy.zip differ
diff --git a/api/git/testdata/azure-repo.zip b/api/git/testdata/azure-repo.zip
new file mode 100644
index 0000000..d4b53d0
Binary files /dev/null and b/api/git/testdata/azure-repo.zip differ
diff --git a/api/git/testdata/test-clone-git-repo.tar.gz b/api/git/testdata/test-clone-git-repo.tar.gz
new file mode 100644
index 0000000..cba76a0
Binary files /dev/null and b/api/git/testdata/test-clone-git-repo.tar.gz differ
diff --git a/api/git/types/types.go b/api/git/types/types.go
new file mode 100644
index 0000000..087f6bc
--- /dev/null
+++ b/api/git/types/types.go
@@ -0,0 +1,135 @@
+package gittypes
+
+import (
+	"cmp"
+	"errors"
+	"net/url"
+	"path"
+	"strings"
+)
+
+var (
+	ErrIncorrectRepositoryURL = errors.New("git repository could not be found, please ensure that the URL is correct")
+	ErrAuthenticationFailure  = errors.New("authentication failed, please ensure that the git credentials are correct")
+	ErrSymlinkDetected        = errors.New("repository contains a symlink, which is not allowed for security reasons")
+)
+
+type GitCredentialAuthType int
+
+type GitProvider int
+
+// RepoConfig represents a configuration for a repo
+type RepoConfig struct {
+	// The repo url
+	URL string `example:"https://github.com/portainer/portainer.git"`
+	// The reference name
+	ReferenceName string `example:"refs/heads/branch_name"`
+	// ConfigFilePath is the path to the config file within the repository.
+	// NOTE: For stacks, this mirrors Stack.EntryPoint and the two are kept in sync by stackUpdateGit.
+	ConfigFilePath string `example:"docker-compose.yml"`
+	// Git credentials
+	Authentication *GitAuthentication `json:",omitempty"`
+	// Repository hash
+	ConfigHash string `example:"bc4c183d756879ea4d173315338110b31004b8e0"`
+	// TLSSkipVerify skips SSL verification when cloning the Git repository
+	TLSSkipVerify bool `example:"false"`
+}
+
+// GitSource holds the shared connection fields stored on a Source.
+// Per-file fields (ref, path, hash) are stored on ArtifactFile instead.
+type GitSource struct {
+	URL            string             `example:"https://github.com/portainer/portainer.git"`
+	Authentication *GitAuthentication `json:",omitempty"`
+	TLSSkipVerify  bool               `example:"false"`
+}
+
+// ToRepoConfig returns a RepoConfig populated with the connection fields from gc
+func (gc *GitSource) ToRepoConfig() *RepoConfig {
+	return &RepoConfig{
+		URL:            gc.URL,
+		Authentication: gc.Authentication,
+		TLSSkipVerify:  gc.TLSSkipVerify,
+	}
+}
+
+// SanitizeGitSource returns a copy of gc with the URL sanitized and password cleared,
+// safe to return to clients
+func SanitizeGitSource(gc *GitSource) *GitSource {
+	if gc == nil {
+		return nil
+	}
+
+	result := *gc
+	result.URL = SanitizeURL(result.URL)
+
+	if result.Authentication != nil && result.Authentication.Password != "" {
+		auth := *result.Authentication
+		auth.Password = ""
+		result.Authentication = &auth
+	}
+
+	return &result
+}
+
+// RepoName extracts the repository name from a git URL for use as a display name.
+// e.g. "https://github.com/org/app-config.git" results in "app-config"
+func RepoName(rawURL string) string {
+	return strings.TrimSuffix(path.Base(rawURL), ".git")
+}
+
+// NormalizeURL returns a canonical form of rawURL for deduplication purposes:
+// scheme and host are lowercased, embedded credentials are removed, trailing
+// slashes and the .git suffix are stripped from the path. If the scheme is
+// absent it defaults to https.
+func NormalizeURL(rawURL string) (string, error) {
+	u, err := url.Parse(rawURL)
+	if err != nil {
+		return "", err
+	}
+
+	u.Scheme = strings.ToLower(cmp.Or(u.Scheme, "https"))
+	u.Host = strings.ToLower(u.Host)
+	u.User = nil
+	u.Path = strings.TrimSuffix(strings.TrimRight(u.Path, "/"), ".git")
+
+	return u.String(), nil
+}
+
+// SanitizeURL strips any userinfo (username/password) embedded in rawURL,
+// returning a URL safe to store or return to clients.
+func SanitizeURL(rawURL string) string {
+	u, err := url.Parse(rawURL)
+	if err != nil || u.User == nil {
+		return rawURL
+	}
+
+	u.User = nil
+
+	return u.String()
+}
+
+// SanitizeRepoConfig returns a copy of gc with the URL sanitized and password cleared,
+// safe to return to clients.
+func SanitizeRepoConfig(gc *RepoConfig) *RepoConfig {
+	if gc == nil {
+		return nil
+	}
+
+	result := *gc
+	result.URL = SanitizeURL(result.URL)
+
+	if result.Authentication != nil && result.Authentication.Password != "" {
+		auth := *result.Authentication
+		auth.Password = ""
+		result.Authentication = &auth
+	}
+
+	return &result
+}
+
+type GitAuthentication struct {
+	Username          string
+	Password          string
+	Provider          GitProvider           `json:",omitempty"`
+	AuthorizationType GitCredentialAuthType `json:",omitempty"`
+}
diff --git a/api/git/types/types_test.go b/api/git/types/types_test.go
new file mode 100644
index 0000000..5e11378
--- /dev/null
+++ b/api/git/types/types_test.go
@@ -0,0 +1,26 @@
+package gittypes
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestNormalizeURL(t *testing.T) {
+	t.Parallel()
+
+	f := func(input, expected string) {
+		t.Helper()
+		got, err := NormalizeURL(input)
+		require.NoError(t, err)
+		require.Equal(t, expected, got)
+	}
+
+	f("https://github.com/org/repo.git", "https://github.com/org/repo")
+	f("https://github.com/org/repo/", "https://github.com/org/repo")
+	f("https://github.com/org/repo.git/", "https://github.com/org/repo")
+	f("HTTPS://github.com/org/repo", "https://github.com/org/repo")
+	f("https://GitHub.COM/org/repo", "https://github.com/org/repo")
+	f("https://user:pass@github.com/org/repo.git", "https://github.com/org/repo")
+	f("https://github.com/org/repo", "https://github.com/org/repo")
+}
diff --git a/api/git/update/update.go b/api/git/update/update.go
new file mode 100644
index 0000000..39965a7
--- /dev/null
+++ b/api/git/update/update.go
@@ -0,0 +1,130 @@
+package update
+
+import (
+	"context"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/pkg/errors"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/filesystem"
+	"github.com/portainer/portainer/api/git"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	"github.com/rs/zerolog/log"
+)
+
+// UpdateGitObject updates a git object based on its config
+func UpdateGitObject(ctx context.Context, gitService portainer.GitService, objId string, gitConfig *gittypes.RepoConfig, enableVersionFolder bool, projectPath string) (bool, string, error) {
+	if gitConfig == nil {
+		return false, "", nil
+	}
+
+	log.Debug().
+		Str("url", gitConfig.URL).
+		Str("ref", gitConfig.ReferenceName).
+		Str("object", objId).
+		Msg("the object has a git config, try to poll from git repository")
+
+	username, password := git.GetCredentials(gitConfig.Authentication)
+
+	fetchCtx, cancel := context.WithTimeout(ctx, time.Minute)
+	newHash, err := gitService.LatestCommitID(
+		fetchCtx,
+		gitConfig.URL,
+		gitConfig.ReferenceName,
+		username,
+		password,
+		gitConfig.TLSSkipVerify,
+	)
+	cancel()
+	if err != nil {
+		if fetchCtx.Err() == context.DeadlineExceeded {
+			log.Error().Str("object", objId).Msg("git fetch timed out after 1 minute")
+		}
+
+		return false, "", errors.WithMessagef(err, "failed to fetch latest commit id of %v", objId)
+	}
+
+	hashChanged := !strings.EqualFold(newHash, gitConfig.ConfigHash)
+
+	if !hashChanged {
+		log.Debug().
+			Str("hash", newHash).
+			Str("url", gitConfig.URL).
+			Str("ref", gitConfig.ReferenceName).
+			Str("object", objId).
+			Msg("git repo is up to date")
+
+		return false, newHash, nil
+	}
+
+	toDir := projectPath
+	if enableVersionFolder {
+		toDir = filesystem.JoinPaths(projectPath, newHash)
+	}
+
+	cloneParams := &cloneRepositoryParameters{
+		url:           gitConfig.URL,
+		ref:           gitConfig.ReferenceName,
+		toDir:         toDir,
+		tlsSkipVerify: gitConfig.TLSSkipVerify,
+	}
+	if gitConfig.Authentication != nil {
+		cloneParams.auth = &gitAuth{
+			username: username,
+			password: password,
+		}
+	}
+
+	if err := cloneGitRepository(ctx, gitService, cloneParams); err != nil {
+		if enableVersionFolder {
+			if removeErr := os.RemoveAll(toDir); removeErr != nil {
+				log.Warn().Err(removeErr).Str("dir", toDir).Msg("failed to remove partial clone directory")
+			}
+		}
+		return false, "", errors.WithMessagef(err, "failed to do a fresh clone of %v", objId)
+	}
+
+	log.Debug().
+		Str("hash", newHash).
+		Str("url", gitConfig.URL).
+		Str("ref", gitConfig.ReferenceName).
+		Str("object", objId).
+		Msg("git repo cloned updated")
+
+	return true, newHash, nil
+}
+
+type cloneRepositoryParameters struct {
+	url   string
+	ref   string
+	toDir string
+	auth  *gitAuth
+	// tlsSkipVerify skips SSL verification when cloning the Git repository
+	tlsSkipVerify bool `example:"false"`
+}
+
+type gitAuth struct {
+	username string
+	password string
+}
+
+func cloneGitRepository(ctx context.Context, gitService portainer.GitService, cloneParams *cloneRepositoryParameters) error {
+	username, password := "", ""
+	if cloneParams.auth != nil {
+		username = cloneParams.auth.username
+		password = cloneParams.auth.password
+	}
+
+	return gitService.CloneRepository(
+		ctx,
+		cloneParams.toDir,
+		cloneParams.url,
+		cloneParams.ref,
+		username,
+		password,
+		cloneParams.tlsSkipVerify,
+	)
+}
diff --git a/api/git/update/validate.go b/api/git/update/validate.go
new file mode 100644
index 0000000..8012836
--- /dev/null
+++ b/api/git/update/validate.go
@@ -0,0 +1,35 @@
+package update
+
+import (
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	httperrors "github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/pkg/validate"
+)
+
+func ValidateAutoUpdateSettings(autoUpdate *portainer.AutoUpdateSettings) error {
+	if autoUpdate == nil {
+		return nil
+	}
+
+	if autoUpdate.Webhook == "" && autoUpdate.Interval == "" {
+		return httperrors.NewInvalidPayloadError("Webhook or Interval must be provided")
+	}
+
+	if autoUpdate.Webhook != "" && !validate.IsUUID(autoUpdate.Webhook) {
+		return httperrors.NewInvalidPayloadError("invalid Webhook format")
+	}
+
+	if autoUpdate.Interval == "" {
+		return nil
+	}
+
+	if d, err := time.ParseDuration(autoUpdate.Interval); err != nil {
+		return httperrors.NewInvalidPayloadError("invalid Interval format")
+	} else if d < time.Minute {
+		return httperrors.NewInvalidPayloadError("interval must be at least 1 minute")
+	}
+
+	return nil
+}
diff --git a/api/git/update/validate_test.go b/api/git/update/validate_test.go
new file mode 100644
index 0000000..1628626
--- /dev/null
+++ b/api/git/update/validate_test.go
@@ -0,0 +1,53 @@
+package update
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_ValidateAutoUpdate(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name    string
+		value   *portainer.AutoUpdateSettings
+		wantErr bool
+	}{
+		{
+			name:    "webhook is not a valid UUID",
+			value:   &portainer.AutoUpdateSettings{Webhook: "fake-webhook"},
+			wantErr: true,
+		},
+		{
+			name:    "incorrect interval value",
+			value:   &portainer.AutoUpdateSettings{Interval: "1dd2hh3mm"},
+			wantErr: true,
+		},
+		{
+			name:    "short interval value",
+			value:   &portainer.AutoUpdateSettings{Interval: "1s"},
+			wantErr: true,
+		},
+		{
+			name:    "valid webhook without interval",
+			value:   &portainer.AutoUpdateSettings{Webhook: "8dce8c2f-9ca1-482b-ad20-271e86536ada"},
+			wantErr: false,
+		},
+		{
+			name: "valid auto update",
+			value: &portainer.AutoUpdateSettings{
+				Webhook:  "8dce8c2f-9ca1-482b-ad20-271e86536ada",
+				Interval: "5h30m40s10ms",
+			},
+			wantErr: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := ValidateAutoUpdateSettings(tt.value)
+			assert.Equalf(t, tt.wantErr, err != nil, "received %+v", err)
+		})
+	}
+}
diff --git a/api/gitops/sources/helpers_test.go b/api/gitops/sources/helpers_test.go
new file mode 100644
index 0000000..7ab3154
--- /dev/null
+++ b/api/gitops/sources/helpers_test.go
@@ -0,0 +1,5 @@
+package sources
+
+import "github.com/portainer/portainer/api/dataservices/source"
+
+var adminUserContext = source.InsecureNewAdminContext()
diff --git a/api/gitops/sources/repo_config.go b/api/gitops/sources/repo_config.go
new file mode 100644
index 0000000..4e70954
--- /dev/null
+++ b/api/gitops/sources/repo_config.go
@@ -0,0 +1,56 @@
+package sources
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices/source"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	"github.com/portainer/portainer/pkg/fips"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+)
+
+// RepoConfigInput holds the raw payload fields needed to resolve a git RepoConfig.
+// Set SourceID to resolve URL/auth from a stored source; otherwise provide the inline fields.
+type RepoConfigInput struct {
+	SourceID                 portainer.SourceID
+	ReferenceName            string
+	ConfigFilePath           string
+	RepositoryURL            string
+	TLSSkipVerify            bool
+	RepositoryAuthentication bool
+	Username                 string
+	Password                 string
+	Provider                 gittypes.GitProvider
+	AuthorizationType        gittypes.GitCredentialAuthType
+}
+
+// ResolveRepoConfig builds a RepoConfig from either a SourceID or inline URL/auth fields.
+func ResolveRepoConfig(tx gitSourceStore, userContext source.UserContext, input RepoConfigInput) (gittypes.RepoConfig, *httperror.HandlerError) {
+	cfg := gittypes.RepoConfig{
+		ReferenceName:  input.ReferenceName,
+		ConfigFilePath: input.ConfigFilePath,
+	}
+
+	if input.SourceID != 0 {
+		src, httpErr := ValidateGitSourceAccess(tx, userContext, input.SourceID)
+		if httpErr != nil {
+			return gittypes.RepoConfig{}, httpErr
+		}
+		cfg.URL = src.Git.URL
+		cfg.Authentication = src.Git.Authentication
+		cfg.TLSSkipVerify = src.Git.TLSSkipVerify
+	} else {
+		cfg.URL = input.RepositoryURL
+		cfg.TLSSkipVerify = input.TLSSkipVerify
+		if input.RepositoryAuthentication {
+			cfg.Authentication = &gittypes.GitAuthentication{
+				Username:          input.Username,
+				Password:          input.Password,
+				Provider:          input.Provider,
+				AuthorizationType: input.AuthorizationType,
+			}
+		}
+	}
+
+	cfg.TLSSkipVerify = cfg.TLSSkipVerify && fips.CanTLSSkipVerify()
+	return cfg, nil
+}
diff --git a/api/gitops/sources/repo_config_test.go b/api/gitops/sources/repo_config_test.go
new file mode 100644
index 0000000..abeec31
--- /dev/null
+++ b/api/gitops/sources/repo_config_test.go
@@ -0,0 +1,70 @@
+package sources
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	"github.com/portainer/portainer/pkg/fips"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func init() {
+	fips.InitFIPS(false)
+}
+
+func TestResolveRepoConfig_WithSourceID_ReturnsSourceConfig(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, false)
+
+	src := &portainer.Source{
+		Type: portainer.SourceTypeGit,
+		Git: &gittypes.GitSource{
+			URL:           "https://github.com/org/repo",
+			TLSSkipVerify: true,
+			Authentication: &gittypes.GitAuthentication{
+				Username: "user",
+				Password: "token",
+			},
+		},
+	}
+	require.NoError(t, store.Source().Create(adminUserContext, src))
+
+	cfg, httpErr := ResolveRepoConfig(store, adminUserContext, RepoConfigInput{
+		SourceID:       src.ID,
+		ReferenceName:  "refs/heads/main",
+		ConfigFilePath: "docker-compose.yml",
+		RepositoryURL:  "https://ignored.example.com",
+	})
+
+	require.Nil(t, httpErr)
+	assert.Equal(t, src.Git.URL, cfg.URL)
+	assert.Equal(t, src.Git.Authentication, cfg.Authentication)
+	assert.Equal(t, src.Git.TLSSkipVerify, cfg.TLSSkipVerify)
+	assert.Equal(t, "refs/heads/main", cfg.ReferenceName)
+	assert.Equal(t, "docker-compose.yml", cfg.ConfigFilePath)
+}
+
+func TestResolveRepoConfig_WithInlineURL_ReturnsInlineConfig(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, false)
+
+	cfg, httpErr := ResolveRepoConfig(store, adminUserContext, RepoConfigInput{
+		ReferenceName:            "refs/heads/main",
+		ConfigFilePath:           "docker-compose.yml",
+		RepositoryURL:            "https://github.com/org/repo",
+		TLSSkipVerify:            true,
+		RepositoryAuthentication: true,
+		Username:                 "user",
+		Password:                 "pass",
+	})
+
+	require.Nil(t, httpErr)
+	assert.Equal(t, "https://github.com/org/repo", cfg.URL)
+	assert.True(t, cfg.TLSSkipVerify)
+	require.NotNil(t, cfg.Authentication)
+	assert.Equal(t, "user", cfg.Authentication.Username)
+	assert.Equal(t, "pass", cfg.Authentication.Password)
+}
diff --git a/api/gitops/sources/source_access.go b/api/gitops/sources/source_access.go
new file mode 100644
index 0000000..5501121
--- /dev/null
+++ b/api/gitops/sources/source_access.go
@@ -0,0 +1,38 @@
+package sources
+
+import (
+	"fmt"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/dataservices/source"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+)
+
+// gitSourceStore is the minimal intersection of CE and EE DataStoreTx that these functions need.
+// Both EE and CE DataStoreTx satisfy it, even though they are incompatible as full interface types.
+type gitSourceStore interface {
+	Source() dataservices.SourceService
+	IsErrObjectNotFound(err error) bool
+}
+
+// ValidateGitSourceAccess checks that the given Source exists and is a git Source, and returns it.
+func ValidateGitSourceAccess(tx gitSourceStore, userContext source.UserContext, sourceID portainer.SourceID) (*portainer.Source, *httperror.HandlerError) {
+	src, err := tx.Source().Read(userContext, sourceID)
+	if err != nil {
+		if tx.IsErrObjectNotFound(err) {
+			return nil, httperror.NotFound("Source not found", err)
+		}
+		return nil, httperror.InternalServerError("Unable to read source", err)
+	}
+
+	if src.Type != portainer.SourceTypeGit {
+		return nil, httperror.BadRequest(fmt.Sprintf("source %d is not a git source", sourceID), nil)
+	}
+
+	if src.Git == nil {
+		return nil, httperror.BadRequest("Source has no git configuration", nil)
+	}
+
+	return src, nil
+}
diff --git a/api/gitops/sources/source_access_test.go b/api/gitops/sources/source_access_test.go
new file mode 100644
index 0000000..7c3a518
--- /dev/null
+++ b/api/gitops/sources/source_access_test.go
@@ -0,0 +1,35 @@
+package sources
+
+import (
+	"net/http"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestValidateSourceForStack_ValidGitSource_ReturnsNil(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, false)
+
+	src := &portainer.Source{
+		Type: portainer.SourceTypeGit,
+		Git:  &gittypes.GitSource{URL: "https://github.com/org/repo"},
+	}
+	require.NoError(t, store.Source().Create(adminUserContext, src))
+
+	_, httpErr := ValidateGitSourceAccess(store, adminUserContext, src.ID)
+	assert.Nil(t, httpErr)
+}
+
+func TestValidateSourceForStack_SourceNotFound_Returns404(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, false)
+
+	_, httpErr := ValidateGitSourceAccess(store, adminUserContext, portainer.SourceID(999))
+	require.NotNil(t, httpErr)
+	assert.Equal(t, http.StatusNotFound, httpErr.StatusCode)
+}
diff --git a/api/gitops/sources/status.go b/api/gitops/sources/status.go
new file mode 100644
index 0000000..de8aa9c
--- /dev/null
+++ b/api/gitops/sources/status.go
@@ -0,0 +1,23 @@
+package sources
+
+import portainer "github.com/portainer/portainer/api"
+
+// Status is the string representation of portainer.Status used in API responses.
+type Status string
+
+const (
+	SourceStatusUnknown Status = "unknown"
+	SourceStatusHealthy Status = "healthy"
+	SourceStatusError   Status = "error"
+)
+
+func StatusString(s portainer.SourceStatus) Status {
+	switch s {
+	case portainer.SourceStatusHealthy:
+		return SourceStatusHealthy
+	case portainer.SourceStatusError:
+		return SourceStatusError
+	default:
+		return SourceStatusUnknown
+	}
+}
diff --git a/api/gitops/workflows/fetch.go b/api/gitops/workflows/fetch.go
new file mode 100644
index 0000000..b8bba6a
--- /dev/null
+++ b/api/gitops/workflows/fetch.go
@@ -0,0 +1,218 @@
+package workflows
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/dataservices/source"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/kubernetes/cli"
+	"github.com/portainer/portainer/api/set"
+)
+
+// FetchWorkflows returns all GitOps workflows visible to the given user.
+func FetchWorkflows(
+	tx dataservices.DataStoreTx,
+	k8sFactory *cli.ClientFactory,
+	sc *security.RestrictedRequestContext,
+	endpointIDSet set.Set[portainer.EndpointID],
+) ([]Workflow, error) {
+	gitConfigs := map[portainer.StackID]*gittypes.RepoConfig{}
+	sourceIDs := map[portainer.StackID]portainer.SourceID{}
+	sourcePhases := map[portainer.StackID]WorkflowPhaseStatus{}
+	artifactPhases := map[portainer.StackID]WorkflowPhaseStatus{}
+
+	userContext := source.NewUserContext(sc.User, sc.UserMemberships)
+
+	stacks, err := tx.Stack().ReadAll(func(s portainer.Stack) bool {
+		return s.WorkflowID != 0 && (len(endpointIDSet) == 0 || endpointIDSet.Contains(s.EndpointID))
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	endpointMap, err := BuildEndpointMap(tx, stacks)
+	if err != nil {
+		return nil, err
+	}
+
+	stacks, err = FilterDockerStacksByAccess(tx, stacks, sc)
+	if err != nil {
+		return nil, err
+	}
+
+	// First pass: filter by endpoint/stack-type match and collect workflow IDs.
+	preFiltered := make([]portainer.Stack, 0, len(stacks))
+	workflowIDSet := make(set.Set[portainer.WorkflowID], len(stacks))
+	for _, stack := range stacks {
+		if ep, ok := endpointMap[stack.EndpointID]; ok && !EndpointMatchesStackType(ep, stack.Type) {
+			continue
+		}
+		preFiltered = append(preFiltered, stack)
+		workflowIDSet.Add(stack.WorkflowID)
+	}
+
+	workflowMap, sourceMap, err := LoadWorkflowAndSourceMaps(tx, userContext, workflowIDSet)
+	if err != nil {
+		return nil, err
+	}
+
+	// Second pass: build filtered list using in-memory lookups.
+	var filtered []portainer.Stack
+	for _, stack := range preFiltered {
+		wf := workflowMap[stack.WorkflowID]
+
+		hasAccessibleSource := false
+	outer:
+		for _, as := range wf.Artifacts {
+			if as.StackID != stack.ID {
+				continue
+			}
+
+			for _, f := range as.Files {
+				src, ok := sourceMap[f.SourceID]
+				if !ok {
+					continue
+				}
+
+				hasAccessibleSource = true
+
+				if src.Type == portainer.SourceTypeGit {
+					gitConfigs[stack.ID] = MergeSourceAndFile(&src, &f)
+					sourceIDs[stack.ID] = src.ID
+					sourcePhases[stack.ID] = SourceStatusToPhase(f.RefStatus, f.RefError)
+					artifactPhases[stack.ID] = SourceStatusToPhase(f.PathStatus, f.PathError)
+					break outer
+				}
+			}
+		}
+
+		if stack.Type == portainer.KubernetesStack && !hasAccessibleSource {
+			continue
+		}
+
+		filtered = append(filtered, stack)
+	}
+	stacks = filtered
+
+	accessMap, err := buildEndpointAccessMap(k8sFactory, sc, endpointMap)
+	if err != nil {
+		return nil, err
+	}
+
+	stacks, err = filterK8SStacks(stacks, endpointMap, k8sFactory, accessMap)
+	if err != nil {
+		return nil, err
+	}
+
+	items := make([]Workflow, 0, len(stacks))
+	for _, stack := range stacks {
+		gitConfig := gitConfigs[stack.ID]
+		items = append(items, MapStackToWorkflow(stack, sourceIDs[stack.ID], gitConfig, sourcePhases[stack.ID], artifactPhases[stack.ID]))
+	}
+
+	return items, nil
+}
+
+// SourceStats holds aggregated statistics for a GitOps source.
+type SourceStats struct {
+	WorkflowCount int
+	EndpointIDs   set.Set[portainer.EndpointID]
+}
+
+// FetchSourceStats returns all sources and per-source stats for sources accessible to the given user.
+// It applies the same access control as FetchWorkflows but skips git phase checks.
+func FetchSourceStats(
+	tx dataservices.DataStoreTx,
+	k8sFactory *cli.ClientFactory,
+	sc *security.RestrictedRequestContext,
+) ([]portainer.Source, map[portainer.SourceID]SourceStats, error) {
+	userContext := source.NewUserContext(sc.User, sc.UserMemberships)
+
+	sources, err := tx.Source().ReadAll(userContext)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	allStacks, err := tx.Stack().ReadAll(func(s portainer.Stack) bool { return s.WorkflowID != 0 })
+	if err != nil {
+		return nil, nil, err
+	}
+
+	endpointMap, err := BuildEndpointMap(tx, allStacks)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	allStacks, err = FilterDockerStacksByAccess(tx, allStacks, sc)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	workflowIDSet := make(set.Set[portainer.WorkflowID], len(allStacks))
+	preFiltered := make([]portainer.Stack, 0, len(allStacks))
+	for _, stack := range allStacks {
+		if ep, ok := endpointMap[stack.EndpointID]; ok && !EndpointMatchesStackType(ep, stack.Type) {
+			continue
+		}
+		preFiltered = append(preFiltered, stack)
+		workflowIDSet.Add(stack.WorkflowID)
+	}
+
+	wfMap, err := LoadWorkflowMap(tx, workflowIDSet)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	wfSources := make(map[portainer.WorkflowID][]portainer.SourceID, len(wfMap))
+	for id, wf := range wfMap {
+		for _, as := range wf.Artifacts {
+			for _, f := range as.Files {
+				wfSources[id] = append(wfSources[id], f.SourceID)
+			}
+		}
+	}
+
+	stackSourceIDs := make(map[portainer.StackID][]portainer.SourceID)
+	for _, stack := range preFiltered {
+		if srcIDs := wfSources[stack.WorkflowID]; len(srcIDs) > 0 {
+			stackSourceIDs[stack.ID] = srcIDs
+		}
+	}
+
+	accessMap, err := buildEndpointAccessMap(k8sFactory, sc, endpointMap)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	stacks, err := filterK8SStacks(preFiltered, endpointMap, k8sFactory, accessMap)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	stats := make(map[portainer.SourceID]SourceStats)
+
+	for _, stack := range stacks {
+		var epIDs []portainer.EndpointID
+		if stack.EndpointID != 0 {
+			epIDs = []portainer.EndpointID{stack.EndpointID}
+		}
+		addSourceStats(stats, stackSourceIDs[stack.ID], epIDs)
+	}
+
+	return sources, stats, nil
+}
+
+func addSourceStats(result map[portainer.SourceID]SourceStats, srcIDs []portainer.SourceID, epIDs []portainer.EndpointID) {
+	for _, srcID := range srcIDs {
+		st := result[srcID]
+		if st.EndpointIDs == nil {
+			st.EndpointIDs = make(set.Set[portainer.EndpointID])
+		}
+		st.WorkflowCount++
+		for _, epID := range epIDs {
+			st.EndpointIDs.Add(epID)
+		}
+		result[srcID] = st
+	}
+}
diff --git a/api/gitops/workflows/fetch_test.go b/api/gitops/workflows/fetch_test.go
new file mode 100644
index 0000000..fe576a4
--- /dev/null
+++ b/api/gitops/workflows/fetch_test.go
@@ -0,0 +1,275 @@
+package workflows
+
+import (
+	"strconv"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/set"
+
+	"github.com/stretchr/testify/require"
+)
+
+func adminContext() *security.RestrictedRequestContext {
+	return &security.RestrictedRequestContext{
+		IsAdmin: true,
+		UserID:  1,
+		User:    &portainer.User{ID: 1, Role: portainer.AdministratorRole},
+	}
+}
+
+func mustCreateGitWorkflow(t *testing.T, tx dataservices.DataStoreTx, stack *portainer.Stack) {
+	t.Helper()
+
+	cfg := stack.GitConfig
+
+	src := &portainer.Source{Type: portainer.SourceTypeGit, Git: &gittypes.GitSource{URL: cfg.URL, Authentication: cfg.Authentication, TLSSkipVerify: cfg.TLSSkipVerify}}
+	require.NoError(t, tx.Source().Create(adminUserContext, src))
+
+	wf := &portainer.Workflow{Artifacts: []portainer.Artifact{{
+		StackID: stack.ID,
+		Files:   []portainer.ArtifactFile{{SourceID: src.ID}},
+	}}}
+	require.NoError(t, tx.Workflow().Create(wf))
+
+	stack.WorkflowID = wf.ID
+	stack.GitConfig = nil
+
+	require.NoError(t, tx.Stack().Create(stack))
+}
+
+func TestAddSourceStats_NoOp(t *testing.T) {
+	t.Parallel()
+
+	result := make(map[portainer.SourceID]SourceStats)
+	addSourceStats(result, nil, nil)
+
+	require.Empty(t, result)
+}
+
+func TestAddSourceStats_AccumulatesWorkflowCount(t *testing.T) {
+	t.Parallel()
+
+	result := make(map[portainer.SourceID]SourceStats)
+	addSourceStats(result, []portainer.SourceID{1}, nil)
+	addSourceStats(result, []portainer.SourceID{1}, nil)
+
+	require.Equal(t, 2, result[1].WorkflowCount)
+}
+
+func TestAddSourceStats_CollectsUniqueEndpointIDs(t *testing.T) {
+	t.Parallel()
+
+	result := make(map[portainer.SourceID]SourceStats)
+	addSourceStats(result, []portainer.SourceID{1}, []portainer.EndpointID{10, 20})
+	addSourceStats(result, []portainer.SourceID{1}, []portainer.EndpointID{20, 30})
+
+	require.Len(t, result[1].EndpointIDs, 3)
+	require.True(t, result[1].EndpointIDs[10])
+	require.True(t, result[1].EndpointIDs[20])
+	require.True(t, result[1].EndpointIDs[30])
+}
+
+func TestAddSourceStats_MultipleSourceIDs(t *testing.T) {
+	t.Parallel()
+
+	result := make(map[portainer.SourceID]SourceStats)
+	addSourceStats(result, []portainer.SourceID{1, 2}, []portainer.EndpointID{10})
+
+	require.Equal(t, 1, result[1].WorkflowCount)
+	require.Equal(t, 1, result[2].WorkflowCount)
+	require.True(t, result[1].EndpointIDs[10])
+	require.True(t, result[2].EndpointIDs[10])
+}
+
+func TestFetchWorkflows_ReturnsOnlyGitopsStacks(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		mustCreateGitWorkflow(t, tx, &portainer.Stack{
+			ID:        1,
+			Name:      "gitops-stack",
+			GitConfig: &gittypes.RepoConfig{URL: "https://github.com/x/repo"},
+		})
+		require.NoError(t, tx.Stack().Create(&portainer.Stack{ID: 2, Name: "plain-stack"}))
+
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	var items []Workflow
+	require.NoError(t, store.ViewTx(func(tx dataservices.DataStoreTx) error {
+		var err error
+		items, err = FetchWorkflows(tx, nil, adminContext(), nil)
+		return err
+	}))
+	require.Len(t, items, 1)
+	require.Equal(t, "gitops-stack", items[0].Name)
+}
+
+func TestFetchWorkflows_FiltersByEndpointID(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		for i := 1; i <= 3; i++ {
+			mustCreateGitWorkflow(t, tx, &portainer.Stack{
+				ID:         portainer.StackID(i),
+				Name:       "stack-" + strconv.Itoa(i),
+				EndpointID: portainer.EndpointID(i),
+				GitConfig:  &gittypes.RepoConfig{URL: "https://github.com/x/" + strconv.Itoa(i)},
+			})
+		}
+
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	var items []Workflow
+	require.NoError(t, store.ViewTx(func(tx dataservices.DataStoreTx) error {
+		var err error
+		items, err = FetchWorkflows(tx, nil, adminContext(), set.ToSet([]portainer.EndpointID{1, 2}))
+		return err
+	}))
+	require.Len(t, items, 2)
+
+	names := []string{items[0].Name, items[1].Name}
+	require.Contains(t, names, "stack-1")
+	require.Contains(t, names, "stack-2")
+}
+
+func TestFetchWorkflows_EmptyWhenNoGitopsStacks(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		require.NoError(t, tx.Stack().Create(&portainer.Stack{ID: 1, Name: "plain-1"}))
+		require.NoError(t, tx.Stack().Create(&portainer.Stack{ID: 2, Name: "plain-2"}))
+
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	var items []Workflow
+	require.NoError(t, store.ViewTx(func(tx dataservices.DataStoreTx) error {
+		var err error
+		items, err = FetchWorkflows(tx, nil, adminContext(), nil)
+		return err
+	}))
+	require.Empty(t, items)
+}
+
+func TestFetchWorkflows_NilEndpointSetReturnsAll(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		for i := 1; i <= 3; i++ {
+			mustCreateGitWorkflow(t, tx, &portainer.Stack{
+				ID:         portainer.StackID(i),
+				Name:       "stack-" + strconv.Itoa(i),
+				EndpointID: portainer.EndpointID(i),
+				GitConfig:  &gittypes.RepoConfig{URL: "https://github.com/x/" + strconv.Itoa(i)},
+			})
+		}
+
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	var items []Workflow
+	require.NoError(t, store.ViewTx(func(tx dataservices.DataStoreTx) error {
+		var err error
+		items, err = FetchWorkflows(tx, nil, adminContext(), nil)
+		return err
+	}))
+	require.Len(t, items, 3)
+}
+
+func TestFetchSourceStats_ReturnsAllSources(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		require.NoError(t, tx.Source().Create(adminUserContext, &portainer.Source{Name: "source-1", Type: portainer.SourceTypeGit, Git: &gittypes.GitSource{URL: "http://github.com/org/repo1"}}))
+		require.NoError(t, tx.Source().Create(adminUserContext, &portainer.Source{Name: "source-2", Type: portainer.SourceTypeGit, Git: &gittypes.GitSource{URL: "http://github.com/org/repo2"}}))
+
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	var sources []portainer.Source
+	require.NoError(t, store.ViewTx(func(tx dataservices.DataStoreTx) error {
+		var err error
+		sources, _, err = FetchSourceStats(tx, nil, adminContext())
+
+		return err
+	}))
+
+	require.Len(t, sources, 2)
+}
+
+func TestFetchSourceStats_TracksWorkflowCountAndEndpoints(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var srcID portainer.SourceID
+
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		src := &portainer.Source{Name: "shared", Type: portainer.SourceTypeGit, Git: &gittypes.GitSource{URL: "http://github.com/org/repo"}}
+		require.NoError(t, tx.Source().Create(adminUserContext, src))
+		srcID = src.ID
+
+		for i := 1; i <= 2; i++ {
+			wf := &portainer.Workflow{Artifacts: []portainer.Artifact{{Files: []portainer.ArtifactFile{{SourceID: srcID}}}}}
+			require.NoError(t, tx.Workflow().Create(wf))
+			require.NoError(t, tx.Stack().Create(&portainer.Stack{
+				ID:         portainer.StackID(i),
+				Name:       "stack-" + strconv.Itoa(i),
+				EndpointID: portainer.EndpointID(i),
+				WorkflowID: wf.ID,
+			}))
+		}
+
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	var stats map[portainer.SourceID]SourceStats
+	require.NoError(t, store.ViewTx(func(tx dataservices.DataStoreTx) error {
+		var err error
+		_, stats, err = FetchSourceStats(tx, nil, adminContext())
+
+		return err
+	}))
+
+	st := stats[srcID]
+	require.Equal(t, 2, st.WorkflowCount)
+	require.Len(t, st.EndpointIDs, 2)
+}
+
+func TestFetchSourceStats_UnusedSourceHasZeroStats(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var unusedID portainer.SourceID
+
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		src := &portainer.Source{Name: "unused", Type: portainer.SourceTypeGit, Git: &gittypes.GitSource{URL: "http://github.com/org/repo"}}
+		require.NoError(t, tx.Source().Create(adminUserContext, src))
+		unusedID = src.ID
+
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	var stats map[portainer.SourceID]SourceStats
+	require.NoError(t, store.ViewTx(func(tx dataservices.DataStoreTx) error {
+		var err error
+		_, stats, err = FetchSourceStats(tx, nil, adminContext())
+
+		return err
+	}))
+
+	st := stats[unusedID]
+	require.Zero(t, st.WorkflowCount)
+	require.Empty(t, st.EndpointIDs)
+}
diff --git a/api/gitops/workflows/filter.go b/api/gitops/workflows/filter.go
new file mode 100644
index 0000000..3263f61
--- /dev/null
+++ b/api/gitops/workflows/filter.go
@@ -0,0 +1,189 @@
+package workflows
+
+import (
+	"fmt"
+	"slices"
+	"strconv"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/models/kubernetes"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+	"github.com/portainer/portainer/api/internal/snapshot"
+	"github.com/portainer/portainer/api/kubernetes/cli"
+	"github.com/portainer/portainer/api/set"
+	"github.com/portainer/portainer/api/slicesx"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+
+	"github.com/rs/zerolog/log"
+)
+
+// EndpointMatchesStackType reports whether ep is a valid target for stackType.
+func EndpointMatchesStackType(ep portainer.Endpoint, stackType portainer.StackType) bool {
+	switch stackType {
+	case portainer.DockerSwarmStack:
+		return len(ep.Snapshots) > 0 && ep.Snapshots[0].Swarm
+	case portainer.DockerComposeStack:
+		return len(ep.Snapshots) == 0 || !ep.Snapshots[0].Swarm
+	case portainer.KubernetesStack:
+		return endpointutils.IsKubernetesEndpoint(&ep)
+	default:
+		return true
+	}
+}
+
+// BuildEndpointMap reads and returns the endpoints backing stacks, keyed by endpoint ID, with
+// snapshot data filled in.
+func BuildEndpointMap(tx dataservices.DataStoreTx, stacks []portainer.Stack) (map[portainer.EndpointID]portainer.Endpoint, error) {
+	ids := set.ToSet(slicesx.Map(stacks, func(s portainer.Stack) portainer.EndpointID { return s.EndpointID }))
+
+	endpoints, err := tx.Endpoint().ReadAll(func(ep portainer.Endpoint) bool { return ids[ep.ID] })
+	if err != nil {
+		return nil, err
+	}
+
+	m := make(map[portainer.EndpointID]portainer.Endpoint, len(endpoints))
+	for i := range endpoints {
+		if err := snapshot.FillSnapshotData(tx, &endpoints[i], false); err != nil {
+			return nil, fmt.Errorf("unable to fill snapshot data for endpoint %d: %w", endpoints[i].ID, err)
+		}
+		m[endpoints[i].ID] = endpoints[i]
+	}
+
+	return m, nil
+}
+
+// FilterDockerStacksByAccess filters stacks to only those the current user can access.
+func FilterDockerStacksByAccess(tx dataservices.DataStoreTx, stacks []portainer.Stack, sc *security.RestrictedRequestContext) ([]portainer.Stack, error) {
+	if sc.IsAdmin {
+		return stacks, nil
+	}
+
+	// do not try to check UAC on kube stacks
+	filtered, dockerStacks := slicesx.Partition(stacks, func(s portainer.Stack) bool { return s.Type == portainer.KubernetesStack })
+
+	stackResourceIDSet := set.ToSet(slicesx.Map(dockerStacks, func(s portainer.Stack) string {
+		return stackutils.ResourceControlID(s.EndpointID, s.Name)
+	}))
+
+	resourceControls, err := tx.ResourceControl().ReadAll(func(rc portainer.ResourceControl) bool {
+		return rc.Type == portainer.StackResourceControl && stackResourceIDSet[rc.ResourceID]
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	dockerStacks = authorization.DecorateStacks(dockerStacks, resourceControls)
+
+	userTeamIDs := authorization.TeamIDs(sc.UserMemberships)
+	filtered = append(filtered, authorization.FilterAuthorizedStacks(dockerStacks, sc.UserID, userTeamIDs)...)
+	return filtered, nil
+}
+
+// ResolveKubeAccess determines sc's Kubernetes admin/namespace access on ep.
+func ResolveKubeAccess(k8sFactory *cli.ClientFactory, sc *security.RestrictedRequestContext, ep *portainer.Endpoint) (endpointAccess, error) {
+	if sc.IsAdmin {
+		return endpointAccess{IsKubeAdmin: true}, nil
+	}
+
+	pcli, err := k8sFactory.GetPrivilegedKubeClient(ep)
+	if err != nil {
+		return endpointAccess{}, fmt.Errorf("unable to get privileged kube client for endpoint %d: %w", ep.ID, err)
+	}
+
+	teamIDs := make([]int, 0, len(sc.UserMemberships))
+	for _, m := range sc.UserMemberships {
+		teamIDs = append(teamIDs, int(m.TeamID))
+	}
+
+	nonAdminNamespaces, err := pcli.GetNonAdminNamespaces(int(sc.UserID), teamIDs, ep.Kubernetes.Configuration.RestrictDefaultNamespace)
+	if err != nil {
+		return endpointAccess{}, fmt.Errorf("unable to retrieve non-admin namespaces for endpoint %d: %w", ep.ID, err)
+	}
+
+	return endpointAccess{IsKubeAdmin: false, NonAdminNamespaces: nonAdminNamespaces}, nil
+}
+
+type endpointAccess struct {
+	IsKubeAdmin        bool
+	NonAdminNamespaces []string
+}
+
+// buildEndpointAccessMap resolves sc's Kubernetes access for every Kubernetes endpoint in
+// endpointMap, skipping (and logging) any endpoint whose access cannot be resolved.
+func buildEndpointAccessMap(k8sFactory *cli.ClientFactory, sc *security.RestrictedRequestContext, endpointMap map[portainer.EndpointID]portainer.Endpoint) (map[portainer.EndpointID]endpointAccess, error) {
+	result := make(map[portainer.EndpointID]endpointAccess, len(endpointMap))
+
+	for epID, ep := range endpointMap {
+		if !endpointutils.IsKubernetesEndpoint(&ep) {
+			continue
+		}
+
+		access, err := ResolveKubeAccess(k8sFactory, sc, &ep)
+		if err != nil {
+			log.Warn().Err(err).Str("context", "buildEndpointAccessMap").Int("endpoint_id", int(epID)).Msg("Failed to resolve kube access for endpoint, skipping")
+			continue
+		}
+
+		result[epID] = access
+	}
+
+	return result, nil
+}
+
+// lookup only if env is kube and either not edge or (edge + not async)
+func ShouldPerformEnvLookup(endpoint *portainer.Endpoint) bool {
+	return endpointutils.IsKubernetesEndpoint(endpoint) &&
+		(!endpointutils.IsEdgeEndpoint(endpoint) ||
+			(endpointutils.IsEdgeEndpoint(endpoint) && !endpoint.Edge.AsyncMode))
+}
+
+func filterK8SStacks(items []portainer.Stack, endpointMap map[portainer.EndpointID]portainer.Endpoint, k8sFactory *cli.ClientFactory, accessMap map[portainer.EndpointID]endpointAccess) ([]portainer.Stack, error) {
+	k8sStacks, result := slicesx.Partition(items, func(s portainer.Stack) bool {
+		return s.Type == portainer.KubernetesStack
+	})
+
+	groupedByEnvId := slicesx.GroupBy(k8sStacks, func(s portainer.Stack) portainer.EndpointID {
+		return s.EndpointID
+	})
+
+	for envID, stacks := range groupedByEnvId {
+		ep, ok := endpointMap[envID]
+		if !ok || !ShouldPerformEnvLookup(&ep) {
+			continue
+		}
+
+		kcl, err := k8sFactory.GetPrivilegedKubeClient(&ep)
+		if err != nil {
+			log.Warn().Err(err).Str("context", "filterK8SStacks").Int("endpoint_id", int(envID)).Msg("Failed to get kube client for endpoint, skipping")
+			continue
+		}
+
+		access := accessMap[envID]
+		kcl.SetIsKubeAdmin(access.IsKubeAdmin)
+		kcl.SetClientNonAdminNamespaces(access.NonAdminNamespaces)
+
+		apps, err := kcl.GetApplications("", "")
+		if err != nil {
+			log.Warn().Err(err).Str("context", "filterK8SStacks").Int("endpoint_id", int(envID)).Msg("Failed to get kube applications for endpoint, skipping")
+			continue
+		}
+
+		for _, s := range stacks {
+			idx := slices.IndexFunc(apps, func(app kubernetes.K8sApplication) bool {
+				return app.StackKind != "edge" && app.StackID == strconv.Itoa(int(s.ID))
+			})
+			if idx == -1 {
+				continue
+			}
+
+			app := apps[idx]
+			s.Name = app.Name
+			s.Namespace = app.ResourcePool
+			result = append(result, s)
+		}
+	}
+	return result, nil
+}
diff --git a/api/gitops/workflows/filter_test.go b/api/gitops/workflows/filter_test.go
new file mode 100644
index 0000000..3693f85
--- /dev/null
+++ b/api/gitops/workflows/filter_test.go
@@ -0,0 +1,289 @@
+package workflows
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/kubernetes/cli"
+
+	appsv1 "k8s.io/api/apps/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	kfake "k8s.io/client-go/kubernetes/fake"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestFilterDockerStacksByAccess_KubeStacksPassThrough(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	user := &portainer.User{
+		ID:                      1,
+		Username:                "standard",
+		Role:                    portainer.StandardUserRole,
+		PortainerAuthorizations: authorization.DefaultPortainerAuthorizations(),
+	}
+	require.NoError(t, store.User().Create(user))
+
+	sc := &security.RestrictedRequestContext{
+		IsAdmin: false,
+		UserID:  1,
+	}
+
+	kubeStack := portainer.Stack{ID: 1, Name: "kube-stack", Type: portainer.KubernetesStack}
+	dockerStack := portainer.Stack{ID: 2, Name: "docker-stack", Type: portainer.DockerComposeStack}
+
+	stacks := []portainer.Stack{kubeStack, dockerStack}
+
+	var result []portainer.Stack
+	err := store.ViewTx(func(tx dataservices.DataStoreTx) error {
+		var txErr error
+		result, txErr = FilterDockerStacksByAccess(tx, stacks, sc)
+		return txErr
+	})
+	require.NoError(t, err)
+	require.Len(t, result, 1)
+	require.Equal(t, "kube-stack", result[0].Name)
+}
+
+func TestFilterDockerStacksByAccess_AdminGetsAll(t *testing.T) {
+	t.Parallel()
+
+	sc := &security.RestrictedRequestContext{
+		IsAdmin: true,
+		UserID:  1,
+	}
+
+	stacks := []portainer.Stack{
+		{ID: 1, Name: "kube-stack", Type: portainer.KubernetesStack},
+		{ID: 2, Name: "docker-stack", Type: portainer.DockerComposeStack},
+	}
+
+	result, err := FilterDockerStacksByAccess(nil, stacks, sc)
+	require.NoError(t, err)
+	require.Len(t, result, 2)
+}
+
+func TestBuildEndpointAccessMap_AdminIsKubeAdmin(t *testing.T) {
+	t.Parallel()
+
+	sc := &security.RestrictedRequestContext{
+		IsAdmin: true,
+		UserID:  1,
+	}
+
+	endpointMap := map[portainer.EndpointID]portainer.Endpoint{
+		1: {ID: 1, Type: portainer.KubernetesLocalEnvironment},
+		2: {ID: 2, Type: portainer.DockerEnvironment},
+	}
+
+	result, err := buildEndpointAccessMap(nil, sc, endpointMap)
+	require.NoError(t, err)
+	require.Len(t, result, 1)
+	require.True(t, result[1].IsKubeAdmin)
+	require.Empty(t, result[1].NonAdminNamespaces)
+}
+
+func TestFilterK8SStacks_IncludesMatchingStack(t *testing.T) {
+	t.Parallel()
+
+	fakeKubeClient := kfake.NewSimpleClientset()
+
+	deployment := &appsv1.Deployment{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "my-app",
+			Namespace: "default",
+			Labels: map[string]string{
+				"io.portainer.kubernetes.application.stackid": "1",
+			},
+		},
+		Spec: appsv1.DeploymentSpec{
+			Selector: &metav1.LabelSelector{MatchLabels: map[string]string{"app": "my-app"}},
+		},
+	}
+
+	_, err := fakeKubeClient.AppsV1().Deployments("default").Create(t.Context(), deployment, metav1.CreateOptions{})
+	require.NoError(t, err)
+
+	kcl := cli.NewTestKubeClient(fakeKubeClient)
+	factory := cli.NewTestClientFactory(1, kcl)
+
+	endpointMap := map[portainer.EndpointID]portainer.Endpoint{
+		1: {ID: 1, Type: portainer.KubernetesLocalEnvironment},
+	}
+
+	stacks := []portainer.Stack{
+		{ID: 1, Name: "stack-name", EndpointID: 1, Type: portainer.KubernetesStack},
+	}
+
+	accessMap := map[portainer.EndpointID]endpointAccess{
+		1: {IsKubeAdmin: true},
+	}
+
+	result, err := filterK8SStacks(stacks, endpointMap, factory, accessMap)
+	require.NoError(t, err)
+	require.Len(t, result, 1)
+	assert.Equal(t, "my-app", result[0].Name)
+	assert.Equal(t, "default", result[0].Namespace)
+}
+
+func TestFilterK8SStacks_ExcludesStackWhenNoMatchingDeployment(t *testing.T) {
+	t.Parallel()
+
+	fakeKubeClient := kfake.NewSimpleClientset()
+	kcl := cli.NewTestKubeClient(fakeKubeClient)
+	factory := cli.NewTestClientFactory(1, kcl)
+
+	endpointMap := map[portainer.EndpointID]portainer.Endpoint{
+		1: {ID: 1, Type: portainer.KubernetesLocalEnvironment},
+	}
+
+	stacks := []portainer.Stack{
+		{ID: 1, Name: "stack-name", EndpointID: 1, Type: portainer.KubernetesStack},
+	}
+
+	accessMap := map[portainer.EndpointID]endpointAccess{
+		1: {IsKubeAdmin: true},
+	}
+
+	result, err := filterK8SStacks(stacks, endpointMap, factory, accessMap)
+	require.NoError(t, err)
+	require.Empty(t, result)
+}
+
+func TestFilterK8SStacks_NonAdminWithNamespaceAccess(t *testing.T) {
+	t.Parallel()
+
+	fakeKubeClient := kfake.NewSimpleClientset()
+
+	deployment := &appsv1.Deployment{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "my-app",
+			Namespace: "ns1",
+			Labels: map[string]string{
+				"io.portainer.kubernetes.application.stackid": "1",
+			},
+		},
+		Spec: appsv1.DeploymentSpec{
+			Selector: &metav1.LabelSelector{MatchLabels: map[string]string{"app": "my-app"}},
+		},
+	}
+
+	_, err := fakeKubeClient.AppsV1().Deployments("ns1").Create(t.Context(), deployment, metav1.CreateOptions{})
+	require.NoError(t, err)
+
+	kcl := cli.NewTestKubeClient(fakeKubeClient)
+	factory := cli.NewTestClientFactory(1, kcl)
+
+	endpointMap := map[portainer.EndpointID]portainer.Endpoint{
+		1: {ID: 1, Type: portainer.KubernetesLocalEnvironment},
+	}
+
+	stacks := []portainer.Stack{
+		{ID: 1, Name: "stack-name", EndpointID: 1, Type: portainer.KubernetesStack},
+	}
+
+	accessMap := map[portainer.EndpointID]endpointAccess{
+		1: {IsKubeAdmin: false, NonAdminNamespaces: []string{"ns1"}},
+	}
+
+	result, err := filterK8SStacks(stacks, endpointMap, factory, accessMap)
+	require.NoError(t, err)
+	require.Len(t, result, 1)
+	assert.Equal(t, "my-app", result[0].Name)
+}
+
+func TestResolveKubeAccess_NonAdminWithTeamMemberships(t *testing.T) {
+	t.Parallel()
+
+	fakeKubeClient := kfake.NewSimpleClientset()
+	kcl := cli.NewTestKubeClient(fakeKubeClient)
+	factory := cli.NewTestClientFactory(1, kcl)
+
+	ep := &portainer.Endpoint{
+		ID:   1,
+		Type: portainer.KubernetesLocalEnvironment,
+	}
+
+	sc := &security.RestrictedRequestContext{
+		IsAdmin: false,
+		UserID:  1,
+		UserMemberships: []portainer.TeamMembership{
+			{TeamID: 5},
+		},
+	}
+
+	access, err := ResolveKubeAccess(factory, sc, ep)
+	require.NoError(t, err)
+	require.False(t, access.IsKubeAdmin)
+	require.Equal(t, []string{"default"}, access.NonAdminNamespaces)
+}
+
+func TestResolveKubeAccess_NonAdmin(t *testing.T) {
+	t.Parallel()
+
+	fakeKubeClient := kfake.NewSimpleClientset()
+	kcl := cli.NewTestKubeClient(fakeKubeClient)
+	factory := cli.NewTestClientFactory(1, kcl)
+
+	ep := &portainer.Endpoint{
+		ID:   1,
+		Type: portainer.KubernetesLocalEnvironment,
+	}
+
+	sc := &security.RestrictedRequestContext{
+		IsAdmin: false,
+		UserID:  1,
+	}
+
+	access, err := ResolveKubeAccess(factory, sc, ep)
+	require.NoError(t, err)
+	require.False(t, access.IsKubeAdmin)
+	require.Equal(t, []string{"default"}, access.NonAdminNamespaces)
+}
+
+func TestFilterK8SStacks_NonAdminWithoutNamespaceAccess(t *testing.T) {
+	t.Parallel()
+
+	fakeKubeClient := kfake.NewSimpleClientset()
+
+	deployment := &appsv1.Deployment{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "my-app",
+			Namespace: "ns1",
+			Labels: map[string]string{
+				"io.portainer.kubernetes.application.stackid": "1",
+			},
+		},
+		Spec: appsv1.DeploymentSpec{
+			Selector: &metav1.LabelSelector{MatchLabels: map[string]string{"app": "my-app"}},
+		},
+	}
+
+	_, err := fakeKubeClient.AppsV1().Deployments("ns1").Create(t.Context(), deployment, metav1.CreateOptions{})
+	require.NoError(t, err)
+
+	kcl := cli.NewTestKubeClient(fakeKubeClient)
+	factory := cli.NewTestClientFactory(1, kcl)
+
+	endpointMap := map[portainer.EndpointID]portainer.Endpoint{
+		1: {ID: 1, Type: portainer.KubernetesLocalEnvironment},
+	}
+
+	stacks := []portainer.Stack{
+		{ID: 1, Name: "stack-name", EndpointID: 1, Type: portainer.KubernetesStack},
+	}
+
+	accessMap := map[portainer.EndpointID]endpointAccess{
+		1: {IsKubeAdmin: false, NonAdminNamespaces: []string{}},
+	}
+
+	result, err := filterK8SStacks(stacks, endpointMap, factory, accessMap)
+	require.NoError(t, err)
+	require.Empty(t, result)
+}
diff --git a/api/gitops/workflows/git_phases.go b/api/gitops/workflows/git_phases.go
new file mode 100644
index 0000000..4d0e5c2
--- /dev/null
+++ b/api/gitops/workflows/git_phases.go
@@ -0,0 +1,127 @@
+package workflows
+
+import (
+	"context"
+	"fmt"
+	"path"
+	"slices"
+
+	portainer "github.com/portainer/portainer/api"
+	gittypes "github.com/portainer/portainer/api/git/types"
+)
+
+// ListRefsFunc lists all git refs for a repository.
+type ListRefsFunc func(ctx context.Context) ([]string, error)
+
+// ListFilesFunc lists files in a repository branch filtered by extension.
+type ListFilesFunc func(ctx context.Context, exts []string, dirOnly bool) ([]string, error)
+
+// GitEntries represents a git entry which can be either a file or a directory.
+type GitEntries struct {
+	Name   string
+	IsFile bool
+}
+
+// ComputeGitPhasesForConfig computes source and artifact phases from a RepoConfig and a GitService.
+func ComputeGitPhasesForConfig(ctx context.Context, gitSvc portainer.GitService, cfg *gittypes.RepoConfig) (source, artifact WorkflowPhaseStatus) {
+	if gitSvc == nil || cfg == nil {
+		return WorkflowPhaseStatus{Status: StatusUnknown}, WorkflowPhaseStatus{Status: StatusUnknown}
+	}
+
+	username, password := gitCredentials(cfg)
+	return ComputeGitPhases(ctx, cfg.ReferenceName, []GitEntries{{Name: cfg.ConfigFilePath, IsFile: true}},
+		func(ctx context.Context) ([]string, error) {
+			return gitSvc.ListRefs(ctx, cfg.URL, username, password, false, cfg.TLSSkipVerify)
+		},
+		func(ctx context.Context, exts []string, dirOnly bool) ([]string, error) {
+			return gitSvc.ListFiles(ctx, cfg.URL, cfg.ReferenceName, username, password, dirOnly, false, exts, cfg.TLSSkipVerify)
+		},
+	)
+}
+
+func gitCredentials(cfg *gittypes.RepoConfig) (username, password string) {
+	if cfg.Authentication != nil {
+		return cfg.Authentication.Username, cfg.Authentication.Password
+	}
+	return "", ""
+}
+
+// ComputeGitPhases checks source (ref reachability) and artifact (config file presence).
+// If source fails, artifact is returned as unknown without making a network call.
+func ComputeGitPhases(ctx context.Context, referenceName string, configFilePath []GitEntries, listRefs ListRefsFunc, listFiles ListFilesFunc) (source, artifact WorkflowPhaseStatus) {
+	source = computeSourcePhase(ctx, referenceName, listRefs)
+	if source.Status == StatusError {
+		return source, WorkflowPhaseStatus{Status: StatusUnknown}
+	}
+	return source, computeArtifactPhase(ctx, configFilePath, listFiles)
+}
+
+func computeSourcePhase(ctx context.Context, referenceName string, listRefs ListRefsFunc) WorkflowPhaseStatus {
+	refs, err := listRefs(ctx)
+	if err != nil {
+		return WorkflowPhaseStatus{Status: StatusError, Error: err.Error()}
+	}
+	if referenceName == "" {
+		return WorkflowPhaseStatus{Status: StatusHealthy}
+	}
+	if !slices.Contains(refs, referenceName) {
+		return WorkflowPhaseStatus{Status: StatusError, Error: fmt.Sprintf("ref %q not found", referenceName)}
+	}
+	return WorkflowPhaseStatus{Status: StatusHealthy}
+}
+
+func computeArtifactPhase(ctx context.Context, gitEntries []GitEntries, listFiles ListFilesFunc) WorkflowPhaseStatus {
+	if len(gitEntries) == 0 {
+		return WorkflowPhaseStatus{Status: StatusError, Error: "no config file path specified"}
+	}
+
+	var (
+		exts        []string
+		fileEntries []string
+		dirEntries  []string
+	)
+	for _, gitEntry := range gitEntries {
+		if gitEntry.IsFile {
+			ext := path.Ext(gitEntry.Name)
+			if len(ext) > 0 {
+				ext = ext[1:]
+				exts = append(exts, ext)
+			}
+
+			fileEntries = append(fileEntries, gitEntry.Name)
+			continue
+		}
+
+		dirEntries = append(dirEntries, gitEntry.Name)
+	}
+
+	// Check file entries
+	if len(fileEntries) > 0 {
+		files, err := listFiles(ctx, exts, false)
+		if err != nil {
+			return WorkflowPhaseStatus{Status: StatusError, Error: err.Error()}
+		}
+
+		for _, fileEntry := range fileEntries {
+			if !slices.Contains(files, fileEntry) {
+				return WorkflowPhaseStatus{Status: StatusError, Error: fmt.Sprintf("file %q not found", fileEntry)}
+			}
+		}
+	}
+
+	// Check directory entries
+	if len(dirEntries) > 0 {
+		dirs, err := listFiles(ctx, nil, true)
+		if err != nil {
+			return WorkflowPhaseStatus{Status: StatusError, Error: err.Error()}
+		}
+
+		for _, dirEntry := range dirEntries {
+			if !slices.Contains(dirs, dirEntry) {
+				return WorkflowPhaseStatus{Status: StatusError, Error: fmt.Sprintf("directory %q not found", dirEntry)}
+			}
+		}
+	}
+
+	return WorkflowPhaseStatus{Status: StatusHealthy}
+}
diff --git a/api/gitops/workflows/git_phases_test.go b/api/gitops/workflows/git_phases_test.go
new file mode 100644
index 0000000..956625c
--- /dev/null
+++ b/api/gitops/workflows/git_phases_test.go
@@ -0,0 +1,162 @@
+package workflows
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestComputeGitPhases(t *testing.T) {
+	t.Parallel()
+
+	okRefs := func(_ context.Context) ([]string, error) {
+		return []string{"refs/heads/main"}, nil
+	}
+	okFiles := func(_ context.Context, _ []string, _ bool) ([]string, error) {
+		return []string{"docker-compose.yml"}, nil
+	}
+	errRefs := func(_ context.Context) ([]string, error) {
+		return nil, errors.New("connection refused")
+	}
+	errFiles := func(_ context.Context, _ []string, _ bool) ([]string, error) {
+		return nil, errors.New("connection refused")
+	}
+
+	cases := []struct {
+		name             string
+		referenceName    string
+		configFilePath   []GitEntries
+		listRefs         ListRefsFunc
+		listFiles        ListFilesFunc
+		expectedSource   Status
+		expectedArtifact Status
+	}{
+		{
+			name:             "listRefs errors: source error, artifact unknown",
+			referenceName:    "refs/heads/main",
+			configFilePath:   []GitEntries{{Name: "docker-compose.yml", IsFile: true}},
+			listRefs:         errRefs,
+			listFiles:        okFiles,
+			expectedSource:   StatusError,
+			expectedArtifact: StatusUnknown,
+		},
+		{
+			name:           "ref not in list: source error, artifact unknown",
+			referenceName:  "refs/heads/missing",
+			configFilePath: []GitEntries{{Name: "docker-compose.yml", IsFile: true}},
+			listRefs: func(_ context.Context) ([]string, error) {
+				return []string{"refs/heads/main"}, nil
+			},
+			listFiles:        okFiles,
+			expectedSource:   StatusError,
+			expectedArtifact: StatusUnknown,
+		},
+		{
+			name:             "empty configFilePath: artifact error",
+			referenceName:    "refs/heads/main",
+			configFilePath:   []GitEntries{},
+			listRefs:         okRefs,
+			listFiles:        okFiles,
+			expectedSource:   StatusHealthy,
+			expectedArtifact: StatusError,
+		},
+		{
+			name:             "listFiles errors: artifact error",
+			referenceName:    "refs/heads/main",
+			configFilePath:   []GitEntries{{Name: "docker-compose.yml", IsFile: true}},
+			listRefs:         okRefs,
+			listFiles:        errFiles,
+			expectedSource:   StatusHealthy,
+			expectedArtifact: StatusError,
+		},
+		{
+			name:           "file not in list: artifact error",
+			referenceName:  "refs/heads/main",
+			configFilePath: []GitEntries{{Name: "docker-compose.yml", IsFile: true}},
+			listRefs:       okRefs,
+			listFiles: func(_ context.Context, _ []string, _ bool) ([]string, error) {
+				return []string{"other.yml"}, nil
+			},
+			expectedSource:   StatusHealthy,
+			expectedArtifact: StatusError,
+		},
+		{
+			name:             "both healthy",
+			referenceName:    "refs/heads/main",
+			configFilePath:   []GitEntries{{Name: "docker-compose.yml", IsFile: true}},
+			listRefs:         okRefs,
+			listFiles:        okFiles,
+			expectedSource:   StatusHealthy,
+			expectedArtifact: StatusHealthy,
+		},
+		{
+			name:             "empty referenceName: source healthy (default HEAD)",
+			referenceName:    "",
+			configFilePath:   []GitEntries{{Name: "docker-compose.yml", IsFile: true}},
+			listRefs:         okRefs,
+			listFiles:        okFiles,
+			expectedSource:   StatusHealthy,
+			expectedArtifact: StatusHealthy,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			source, artifact := ComputeGitPhases(t.Context(), tc.referenceName, tc.configFilePath, tc.listRefs, tc.listFiles)
+			assert.Equal(t, tc.expectedSource, source.Status)
+			assert.Equal(t, tc.expectedArtifact, artifact.Status)
+		})
+	}
+}
+
+func TestComputeArtifactPhase_ExtensionFilter(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		configPath string
+		wantExts   []string
+	}{
+		{"docker-compose.yml", []string{"yml"}},
+		{"stack.yaml", []string{"yaml"}},
+		{"subdir/compose.yml", []string{"yml"}},
+		{"Makefile", nil},
+		{"archive.tar.gz", []string{"gz"}},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.configPath, func(t *testing.T) {
+			t.Parallel()
+			var capturedExts []string
+			ComputeGitPhases(
+				t.Context(),
+				"",
+				[]GitEntries{{Name: tc.configPath, IsFile: true}},
+				func(_ context.Context) ([]string, error) { return nil, nil },
+				func(_ context.Context, exts []string, dirOnly bool) ([]string, error) {
+					capturedExts = exts
+					return []string{tc.configPath}, nil
+				},
+			)
+			assert.Equal(t, tc.wantExts, capturedExts)
+		})
+	}
+}
+
+func TestComputeGitPhases_ArtifactNotCalledOnSourceError(t *testing.T) {
+	t.Parallel()
+
+	listFilesCalled := false
+	listRefs := func(_ context.Context) ([]string, error) {
+		return nil, errors.New("repo unreachable")
+	}
+	listFiles := func(_ context.Context, _ []string, _ bool) ([]string, error) {
+		listFilesCalled = true
+		return nil, nil
+	}
+
+	ComputeGitPhases(t.Context(), "refs/heads/main", []GitEntries{{Name: "docker-compose.yml", IsFile: true}}, listRefs, listFiles)
+
+	assert.False(t, listFilesCalled, "listFiles must not be called when source fails")
+}
diff --git a/api/gitops/workflows/helpers_test.go b/api/gitops/workflows/helpers_test.go
new file mode 100644
index 0000000..5231abb
--- /dev/null
+++ b/api/gitops/workflows/helpers_test.go
@@ -0,0 +1,7 @@
+package workflows
+
+import (
+	"github.com/portainer/portainer/api/dataservices/source"
+)
+
+var adminUserContext = source.InsecureNewAdminContext()
diff --git a/api/gitops/workflows/mapping.go b/api/gitops/workflows/mapping.go
new file mode 100644
index 0000000..6c80b94
--- /dev/null
+++ b/api/gitops/workflows/mapping.go
@@ -0,0 +1,238 @@
+package workflows
+
+import (
+	"fmt"
+	"slices"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	"github.com/portainer/portainer/api/gitops/sources"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+	"github.com/portainer/portainer/api/set"
+	"github.com/portainer/portainer/api/slicesx"
+)
+
+// BuildGroupEndpoints builds a map between EdgeGroup id and its endpoints
+func BuildGroupEndpoints(tx dataservices.DataStoreTx, groups []portainer.EdgeGroup) (map[portainer.EdgeGroupID][]portainer.EndpointID, error) {
+	m := make(map[portainer.EdgeGroupID][]portainer.EndpointID, len(groups))
+	for _, g := range groups {
+		if g.Dynamic {
+			ids, err := endpointutils.GetEndpointsByTags(tx, g.TagIDs, g.PartialMatch)
+			if err != nil {
+				return nil, fmt.Errorf("failed to resolve endpoints for dynamic edge group: %w", err)
+			}
+			m[g.ID] = ids
+		} else {
+			m[g.ID] = g.EndpointIDs.ToSlice()
+		}
+	}
+	return m, nil
+}
+
+// MapStackToWorkflow converts a stack to a Workflow. gitConfig is passed separately
+// because EE embeds a different GitConfig type that shadows the CE field.
+// source and artifact are the pre-computed git phase statuses from the caller.
+func MapStackToWorkflow(s portainer.Stack, sourceID portainer.SourceID, gitConfig *gittypes.RepoConfig, source, artifact WorkflowPhaseStatus) Workflow {
+	return Workflow{
+		ID:       s.WorkflowID,
+		Name:     s.Name,
+		Type:     TypeStack,
+		Platform: platformFromStackType(s.Type),
+		Status: WorkflowStatusObject{
+			Source:   source,
+			Artifact: artifact,
+			Target:   deriveStackTargetState(s),
+		},
+		SourceID:   sourceID,
+		GitConfig:  gitConfig,
+		AutoUpdate: s.AutoUpdate,
+		Target: Target{
+			EndpointID: s.EndpointID,
+			Namespace:  s.Namespace,
+		},
+		CreationDate: s.CreationDate,
+		LastSyncDate: StackLastSyncDate(s),
+	}
+}
+
+// MapEdgeStackToWorkflow converts an edge stack to a Workflow. gitConfig is passed separately
+// because EE embeds a different GitConfig type that shadows the CE field.
+// source and artifact are the pre-computed git phase statuses from the caller.
+func MapEdgeStackToWorkflow(wfID portainer.WorkflowID, es portainer.EdgeStack, sourceID portainer.SourceID, gitConfig *gittypes.RepoConfig, statuses []portainer.EdgeStackStatusForEnv, groupEndpoints map[portainer.EdgeGroupID][]portainer.EndpointID, source, artifact WorkflowPhaseStatus) Workflow {
+	platform := DeploymentPlatformDockerStandalone
+	if es.DeploymentType == portainer.EdgeStackDeploymentKubernetes {
+		platform = DeploymentPlatformKubernetes
+	}
+	return Workflow{
+		ID:       wfID,
+		Name:     es.Name,
+		Type:     TypeEdgeStack,
+		Platform: platform,
+		Status: WorkflowStatusObject{
+			Source:   source,
+			Artifact: artifact,
+			Target:   deriveEdgeStackTargetState(statuses),
+		},
+		SourceID:  sourceID,
+		GitConfig: gitConfig,
+		Target: Target{
+			EdgeGroupIDs:        es.EdgeGroups,
+			GroupStatus:         edgeStackTargetStatuses(es.EdgeGroups, statuses, groupEndpoints),
+			ResolvedEndpointIDs: resolveEdgeGroupEndpoints(es.EdgeGroups, groupEndpoints),
+		},
+		CreationDate: es.CreationDate,
+		LastSyncDate: edgeStackLastSyncDate(statuses),
+	}
+}
+
+// MapStackToArtifactDetail converts a stack to an ArtifactDetail. source and artifact are the
+// pre-computed git phase statuses from the caller; files are the artifact's resolved file refs.
+func MapStackToArtifactDetail(stack portainer.Stack, files []portainer.ArtifactFile, source, artifact WorkflowPhaseStatus) ArtifactDetail {
+	return ArtifactDetail{
+		ID:       int(stack.ID),
+		Type:     TypeStack,
+		Name:     stack.Name,
+		Platform: platformFromStackType(stack.Type),
+		Status: WorkflowStatusObject{
+			Source:   source,
+			Artifact: artifact,
+			Target:   deriveStackTargetState(stack),
+		},
+		AutoUpdate: stack.AutoUpdate,
+		Target: Target{
+			EndpointID: stack.EndpointID,
+			Namespace:  stack.Namespace,
+		},
+		Files:        mapFilesToFileDetails(files),
+		CreationDate: stack.CreationDate,
+		LastSyncDate: StackLastSyncDate(stack),
+	}
+}
+
+// MapEdgeStackToArtifactDetail converts an edge stack to an ArtifactDetail. source and artifact are
+// the pre-computed git phase statuses from the caller; files are the artifact's resolved file refs.
+func MapEdgeStackToArtifactDetail(es portainer.EdgeStack, files []portainer.ArtifactFile, statuses []portainer.EdgeStackStatusForEnv, groupEndpoints map[portainer.EdgeGroupID][]portainer.EndpointID, source, artifact WorkflowPhaseStatus) ArtifactDetail {
+	platform := DeploymentPlatformDockerStandalone
+	if es.DeploymentType == portainer.EdgeStackDeploymentKubernetes {
+		platform = DeploymentPlatformKubernetes
+	}
+	return ArtifactDetail{
+		ID:       int(es.ID),
+		Type:     TypeEdgeStack,
+		Name:     es.Name,
+		Platform: platform,
+		Status: WorkflowStatusObject{
+			Source:   source,
+			Artifact: artifact,
+			Target:   deriveEdgeStackTargetState(statuses),
+		},
+		Target: Target{
+			EdgeGroupIDs:        es.EdgeGroups,
+			GroupStatus:         edgeStackTargetStatuses(es.EdgeGroups, statuses, groupEndpoints),
+			ResolvedEndpointIDs: resolveEdgeGroupEndpoints(es.EdgeGroups, groupEndpoints),
+		},
+		Files:        mapFilesToFileDetails(files),
+		CreationDate: es.CreationDate,
+		LastSyncDate: edgeStackLastSyncDate(statuses),
+	}
+}
+
+func StackLastSyncDate(s portainer.Stack) int64 {
+	for _, ds := range slices.Backward(s.DeploymentStatus) {
+		if ds.Status == portainer.StackStatusActive {
+			return ds.Time
+		}
+	}
+	return 0
+}
+
+func edgeStackLastSyncDate(statuses []portainer.EdgeStackStatusForEnv) int64 {
+	var oldest int64
+	for _, epStatus := range statuses {
+		last := endpointLastSyncDate(epStatus)
+		if last == 0 {
+			return 0
+		}
+		if oldest == 0 || last < oldest {
+			oldest = last
+		}
+	}
+	return oldest
+}
+
+func endpointLastSyncDate(epStatus portainer.EdgeStackStatusForEnv) int64 {
+	for _, s := range slices.Backward(epStatus.Status) {
+		if isEdgeStackHealthyStatus(s.Type) {
+			return s.Time
+		}
+	}
+	return 0
+}
+
+func platformFromStackType(t portainer.StackType) DeploymentPlatform {
+	switch t {
+	case portainer.KubernetesStack:
+		return DeploymentPlatformKubernetes
+	case portainer.DockerSwarmStack:
+		return DeploymentPlatformDockerSwarm
+	default:
+		return DeploymentPlatformDockerStandalone
+	}
+}
+
+func isEdgeStackHealthyStatus(t portainer.EdgeStackStatusType) bool {
+	switch t {
+	case portainer.EdgeStackStatusRunning,
+		portainer.EdgeStackStatusRolledBack,
+		portainer.EdgeStackStatusCompleted,
+		portainer.EdgeStackStatusRemoved,
+		portainer.EdgeStackStatusRemoteUpdateSuccess:
+		return true
+	}
+	return false
+}
+
+func resolveEdgeGroupEndpoints(groups []portainer.EdgeGroupID, groupEndpoints map[portainer.EdgeGroupID][]portainer.EndpointID) []portainer.EndpointID {
+	seen := set.Set[portainer.EndpointID]{}
+	for _, gid := range groups {
+		for _, epID := range groupEndpoints[gid] {
+			seen.Add(epID)
+		}
+	}
+	return seen.Keys()
+}
+
+func edgeStackTargetStatuses(
+	groups []portainer.EdgeGroupID,
+	statuses []portainer.EdgeStackStatusForEnv,
+	groupEndpoints map[portainer.EdgeGroupID][]portainer.EndpointID,
+) map[portainer.EdgeGroupID]Status {
+	epMap := make(map[portainer.EndpointID]Status, len(statuses))
+	for _, s := range statuses {
+		ws, _ := endpointWorkflowStatus(s)
+		epMap[s.EndpointID] = ws
+	}
+
+	result := make(map[portainer.EdgeGroupID]Status, len(groups))
+	for _, gid := range groups {
+		gStatus := StatusUnknown
+		for _, epID := range groupEndpoints[gid] {
+			if ws := epMap[epID]; statusPriority(ws) > statusPriority(gStatus) {
+				gStatus = ws
+			}
+		}
+		result[gid] = gStatus
+	}
+	return result
+}
+
+func mapFilesToFileDetails(files []portainer.ArtifactFile) []ArtifactFileDetail {
+	return slicesx.Map(files, func(file portainer.ArtifactFile) ArtifactFileDetail {
+		return ArtifactFileDetail{
+			ArtifactFile: file,
+			RefStatus:    sources.StatusString(file.RefStatus),
+			PathStatus:   sources.StatusString(file.PathStatus),
+		}
+	})
+}
diff --git a/api/gitops/workflows/mapping_test.go b/api/gitops/workflows/mapping_test.go
new file mode 100644
index 0000000..dfd7da4
--- /dev/null
+++ b/api/gitops/workflows/mapping_test.go
@@ -0,0 +1,268 @@
+package workflows
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	gittypes "github.com/portainer/portainer/api/git/types"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestStackLastSyncDate(t *testing.T) {
+	t.Parallel()
+
+	t.Run("no deployment status", func(t *testing.T) {
+		t.Parallel()
+		assert.Equal(t, int64(0), StackLastSyncDate(portainer.Stack{}))
+	})
+
+	t.Run("no active entry", func(t *testing.T) {
+		t.Parallel()
+		s := portainer.Stack{DeploymentStatus: []portainer.StackDeploymentStatus{
+			{Status: portainer.StackStatusDeploying, Time: 100},
+		}}
+		assert.Equal(t, int64(0), StackLastSyncDate(s))
+	})
+
+	t.Run("last entry is active", func(t *testing.T) {
+		t.Parallel()
+		s := portainer.Stack{DeploymentStatus: []portainer.StackDeploymentStatus{
+			{Status: portainer.StackStatusDeploying, Time: 50},
+			{Status: portainer.StackStatusActive, Time: 100},
+		}}
+		assert.Equal(t, int64(100), StackLastSyncDate(s))
+	})
+
+	t.Run("active followed by non-active returns the active time", func(t *testing.T) {
+		t.Parallel()
+		s := portainer.Stack{DeploymentStatus: []portainer.StackDeploymentStatus{
+			{Status: portainer.StackStatusActive, Time: 100},
+			{Status: portainer.StackStatusDeploying, Time: 200},
+		}}
+		assert.Equal(t, int64(100), StackLastSyncDate(s))
+	})
+}
+
+func TestEdgeStackLastSyncDate(t *testing.T) {
+	t.Parallel()
+
+	t.Run("empty statuses", func(t *testing.T) {
+		t.Parallel()
+		assert.Equal(t, int64(0), edgeStackLastSyncDate(nil))
+	})
+
+	t.Run("no healthy status for endpoint", func(t *testing.T) {
+		t.Parallel()
+		statuses := []portainer.EdgeStackStatusForEnv{
+			{EndpointID: 1, Status: []portainer.EdgeStackDeploymentStatus{
+				{Type: portainer.EdgeStackStatusDeploying, Time: 100},
+			}},
+		}
+		assert.Equal(t, int64(0), edgeStackLastSyncDate(statuses))
+	})
+
+	t.Run("single endpoint with healthy status", func(t *testing.T) {
+		t.Parallel()
+		statuses := []portainer.EdgeStackStatusForEnv{
+			{EndpointID: 1, Status: []portainer.EdgeStackDeploymentStatus{
+				{Type: portainer.EdgeStackStatusRunning, Time: 200},
+			}},
+		}
+		assert.Equal(t, int64(200), edgeStackLastSyncDate(statuses))
+	})
+
+	t.Run("returns minimum healthy time across endpoints", func(t *testing.T) {
+		t.Parallel()
+		statuses := []portainer.EdgeStackStatusForEnv{
+			{EndpointID: 1, Status: []portainer.EdgeStackDeploymentStatus{
+				{Type: portainer.EdgeStackStatusRunning, Time: 300},
+			}},
+			{EndpointID: 2, Status: []portainer.EdgeStackDeploymentStatus{
+				{Type: portainer.EdgeStackStatusRunning, Time: 100},
+			}},
+		}
+		assert.Equal(t, int64(100), edgeStackLastSyncDate(statuses))
+	})
+
+	t.Run("one endpoint not yet synced returns 0", func(t *testing.T) {
+		t.Parallel()
+		statuses := []portainer.EdgeStackStatusForEnv{
+			{EndpointID: 1, Status: []portainer.EdgeStackDeploymentStatus{
+				{Type: portainer.EdgeStackStatusRunning, Time: 200},
+			}},
+			{EndpointID: 2, Status: []portainer.EdgeStackDeploymentStatus{
+				{Type: portainer.EdgeStackStatusDeploying, Time: 100},
+			}},
+		}
+		assert.Equal(t, int64(0), edgeStackLastSyncDate(statuses))
+	})
+}
+
+func TestEdgeStackTargetStatuses(t *testing.T) {
+	t.Parallel()
+
+	ep := func(id portainer.EndpointID, typ portainer.EdgeStackStatusType) portainer.EdgeStackStatusForEnv {
+		return portainer.EdgeStackStatusForEnv{
+			EndpointID: id,
+			Status:     []portainer.EdgeStackDeploymentStatus{{Type: typ}},
+		}
+	}
+
+	t.Run("group with no endpoints is unknown", func(t *testing.T) {
+		t.Parallel()
+		result := edgeStackTargetStatuses(
+			[]portainer.EdgeGroupID{1},
+			nil,
+			map[portainer.EdgeGroupID][]portainer.EndpointID{1: {}},
+		)
+		assert.Equal(t, StatusUnknown, result[portainer.EdgeGroupID(1)])
+	})
+
+	t.Run("group inherits highest-priority endpoint status", func(t *testing.T) {
+		t.Parallel()
+		result := edgeStackTargetStatuses(
+			[]portainer.EdgeGroupID{1},
+			[]portainer.EdgeStackStatusForEnv{
+				ep(1, portainer.EdgeStackStatusRunning),
+				ep(2, portainer.EdgeStackStatusDeploying),
+			},
+			map[portainer.EdgeGroupID][]portainer.EndpointID{1: {1, 2}},
+		)
+		assert.Equal(t, StatusSyncing, result[portainer.EdgeGroupID(1)])
+	})
+
+	t.Run("multiple groups tracked separately", func(t *testing.T) {
+		t.Parallel()
+		result := edgeStackTargetStatuses(
+			[]portainer.EdgeGroupID{10, 20},
+			[]portainer.EdgeStackStatusForEnv{
+				ep(1, portainer.EdgeStackStatusRunning),
+				ep(2, portainer.EdgeStackStatusError),
+			},
+			map[portainer.EdgeGroupID][]portainer.EndpointID{
+				10: {1},
+				20: {2},
+			},
+		)
+		assert.Equal(t, StatusHealthy, result[portainer.EdgeGroupID(10)])
+		assert.Equal(t, StatusError, result[portainer.EdgeGroupID(20)])
+	})
+}
+
+func TestMapEdgeStackToWorkflow_DockerPlatform(t *testing.T) {
+	t.Parallel()
+
+	es := portainer.EdgeStack{
+		ID:             1,
+		Name:           "docker-edge",
+		DeploymentType: portainer.EdgeStackDeploymentCompose,
+		EdgeGroups:     []portainer.EdgeGroupID{1},
+		CreationDate:   1587399600,
+	}
+	cfg := &gittypes.RepoConfig{URL: "https://github.com/x/repo"}
+
+	w := MapEdgeStackToWorkflow(2, es, 7, cfg, nil, map[portainer.EdgeGroupID][]portainer.EndpointID{1: {10}}, WorkflowPhaseStatus{Status: StatusHealthy}, WorkflowPhaseStatus{Status: StatusHealthy})
+
+	require.Equal(t, portainer.WorkflowID(2), w.ID)
+	require.Equal(t, es.Name, w.Name)
+	require.Equal(t, TypeEdgeStack, w.Type)
+	require.Equal(t, DeploymentPlatformDockerStandalone, w.Platform)
+	require.Equal(t, es.CreationDate, w.CreationDate)
+	require.Equal(t, cfg, w.GitConfig)
+	require.Equal(t, portainer.SourceID(7), w.SourceID)
+	require.Equal(t, []portainer.EdgeGroupID{1}, w.Target.EdgeGroupIDs)
+}
+
+func TestMapEdgeStackToWorkflow_KubernetesPlatform(t *testing.T) {
+	t.Parallel()
+
+	es := portainer.EdgeStack{
+		ID:             2,
+		Name:           "kube-edge",
+		DeploymentType: portainer.EdgeStackDeploymentKubernetes,
+		EdgeGroups:     []portainer.EdgeGroupID{1},
+	}
+
+	w := MapEdgeStackToWorkflow(1, es, 0, nil, nil, map[portainer.EdgeGroupID][]portainer.EndpointID{}, WorkflowPhaseStatus{Status: StatusUnknown}, WorkflowPhaseStatus{Status: StatusUnknown})
+
+	require.Equal(t, DeploymentPlatformKubernetes, w.Platform)
+}
+
+func TestMapEdgeStackToWorkflow_GroupStatusesAndResolvedEndpoints(t *testing.T) {
+	t.Parallel()
+
+	statuses := []portainer.EdgeStackStatusForEnv{
+		{EndpointID: 10, Status: []portainer.EdgeStackDeploymentStatus{{Type: portainer.EdgeStackStatusRunning}}},
+		{EndpointID: 20, Status: []portainer.EdgeStackDeploymentStatus{{Type: portainer.EdgeStackStatusError, Error: "boom"}}},
+	}
+	groupEndpoints := map[portainer.EdgeGroupID][]portainer.EndpointID{
+		1: {10},
+		2: {20},
+	}
+	es := portainer.EdgeStack{
+		ID:         3,
+		Name:       "multi-group",
+		EdgeGroups: []portainer.EdgeGroupID{1, 2},
+	}
+
+	w := MapEdgeStackToWorkflow(5, es, 0, nil, statuses, groupEndpoints, WorkflowPhaseStatus{Status: StatusUnknown}, WorkflowPhaseStatus{Status: StatusUnknown})
+
+	require.Equal(t, StatusHealthy, w.Target.GroupStatus[1])
+	require.Equal(t, StatusError, w.Target.GroupStatus[2])
+	require.Len(t, w.Target.ResolvedEndpointIDs, 2)
+}
+
+func TestPlatformFromStackType(t *testing.T) {
+	t.Parallel()
+
+	require.Equal(t, DeploymentPlatformKubernetes, platformFromStackType(portainer.KubernetesStack))
+	require.Equal(t, DeploymentPlatformDockerSwarm, platformFromStackType(portainer.DockerSwarmStack))
+	require.Equal(t, DeploymentPlatformDockerStandalone, platformFromStackType(portainer.DockerComposeStack))
+	require.Equal(t, DeploymentPlatformDockerStandalone, platformFromStackType(portainer.StackType(99)))
+}
+
+func TestResolveEdgeGroupEndpoints_Empty(t *testing.T) {
+	t.Parallel()
+
+	result := resolveEdgeGroupEndpoints(nil, map[portainer.EdgeGroupID][]portainer.EndpointID{})
+	require.Empty(t, result)
+}
+
+func TestResolveEdgeGroupEndpoints_DeduplicatesAcrossGroups(t *testing.T) {
+	t.Parallel()
+
+	groupEndpoints := map[portainer.EdgeGroupID][]portainer.EndpointID{
+		1: {10, 20},
+		2: {20, 30},
+	}
+
+	result := resolveEdgeGroupEndpoints([]portainer.EdgeGroupID{1, 2}, groupEndpoints)
+
+	require.Len(t, result, 3)
+}
+
+func TestIsEdgeStackHealthyStatus(t *testing.T) {
+	t.Parallel()
+
+	healthyTypes := []portainer.EdgeStackStatusType{
+		portainer.EdgeStackStatusRunning,
+		portainer.EdgeStackStatusRolledBack,
+		portainer.EdgeStackStatusCompleted,
+		portainer.EdgeStackStatusRemoved,
+		portainer.EdgeStackStatusRemoteUpdateSuccess,
+	}
+	for _, typ := range healthyTypes {
+		require.True(t, isEdgeStackHealthyStatus(typ))
+	}
+
+	unhealthyTypes := []portainer.EdgeStackStatusType{
+		portainer.EdgeStackStatusError,
+		portainer.EdgeStackStatusDeploying,
+		portainer.EdgeStackStatusPending,
+	}
+	for _, typ := range unhealthyTypes {
+		require.False(t, isEdgeStackHealthyStatus(typ))
+	}
+}
diff --git a/api/gitops/workflows/source_artifact.go b/api/gitops/workflows/source_artifact.go
new file mode 100644
index 0000000..3df1825
--- /dev/null
+++ b/api/gitops/workflows/source_artifact.go
@@ -0,0 +1,404 @@
+package workflows
+
+import (
+	"fmt"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/dataservices/source"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	"github.com/portainer/portainer/api/set"
+)
+
+// gitSourceStore is the minimal intersection of CE and EE DataStoreTx that these functions need.
+// Both EE and CE DataStoreTx satisfy it, even though they are incompatible as full interface types.
+type gitSourceStore interface {
+	Workflow() dataservices.WorkflowService
+	Source() dataservices.SourceService
+}
+
+// GitSourceAndArtifactForStack returns the git Source and the ArtifactFile matching stackID
+// from the workflow identified by workflowID.
+// Source carries the shared fields (URL, auth, TLS); ArtifactFile carries the file-specific fields (ref, path, hash).
+// Returns nil, nil, nil when workflowID is 0 or no matching entry is found.
+func GitSourceAndArtifactForStack(tx gitSourceStore, userContext source.UserContext, workflowID portainer.WorkflowID, stackID portainer.StackID) (*portainer.Source, *portainer.ArtifactFile, error) {
+	if workflowID == 0 {
+		return nil, nil, nil
+	}
+
+	wf, err := tx.Workflow().Read(workflowID)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	sourceMap, err := LoadWorkflowSources(tx, userContext, wf)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	for i, as := range wf.Artifacts {
+		if as.StackID != stackID {
+			continue
+		}
+
+		for j, file := range as.Files {
+			src, ok := sourceMap[file.SourceID]
+			if !ok {
+				continue
+			}
+
+			if src.Type == portainer.SourceTypeGit {
+				return &src, &wf.Artifacts[i].Files[j], nil
+			}
+		}
+	}
+
+	return nil, nil, nil
+}
+
+// GitSourceAndArtifactForEdgeStack returns the git Source and the ArtifactFile matching edgeStackID.
+// Returns nil, nil, nil when workflowID is 0 or no matching entry is found.
+func GitSourceAndArtifactForEdgeStack(tx gitSourceStore, userContext source.UserContext, workflowID portainer.WorkflowID, edgeStackID portainer.EdgeStackID) (*portainer.Source, *portainer.ArtifactFile, error) {
+	if workflowID == 0 {
+		return nil, nil, nil
+	}
+
+	wf, err := tx.Workflow().Read(workflowID)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	sourceMap, err := LoadWorkflowSources(tx, userContext, wf)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	for i, as := range wf.Artifacts {
+		if as.EdgeStackID != edgeStackID {
+			continue
+		}
+
+		for j, file := range as.Files {
+			src, ok := sourceMap[file.SourceID]
+			if !ok {
+				continue
+			}
+
+			if src.Type == portainer.SourceTypeGit {
+				return &src, &wf.Artifacts[i].Files[j], nil
+			}
+		}
+	}
+
+	return nil, nil, nil
+}
+
+// MergeSourceAndFile builds a RepoConfig by combining shared fields from src (URL, auth, TLS)
+// with file-specific fields from file (ref, path, hash).
+func MergeSourceAndFile(src *portainer.Source, file *portainer.ArtifactFile) *gittypes.RepoConfig {
+	if src == nil || src.Git == nil {
+		return nil
+	}
+
+	cfg := &gittypes.RepoConfig{
+		URL:            src.Git.URL,
+		Authentication: src.Git.Authentication,
+		TLSSkipVerify:  src.Git.TLSSkipVerify,
+	}
+
+	if file != nil {
+		cfg.ReferenceName = file.Ref
+		cfg.ConfigFilePath = file.Path
+		cfg.ConfigHash = file.Hash
+	}
+
+	return cfg
+}
+
+// UpdateArtifactFileForStack finds the ArtifactFile matching stackID and sourceID in the workflow
+// and applies fn to it, then persists the updated Workflow.
+// A no-op if no matching artifact or file is found.
+func UpdateArtifactFileForStack(tx gitSourceStore, workflowID portainer.WorkflowID, stackID portainer.StackID, sourceID portainer.SourceID, fn func(*portainer.ArtifactFile)) error {
+	wf, err := tx.Workflow().Read(workflowID)
+	if err != nil {
+		return err
+	}
+
+	for i, as := range wf.Artifacts {
+		if as.StackID != stackID {
+			continue
+		}
+
+		for j, file := range as.Files {
+			if file.SourceID == sourceID {
+				fn(&wf.Artifacts[i].Files[j])
+
+				return tx.Workflow().Update(workflowID, wf)
+			}
+		}
+	}
+
+	return nil
+}
+
+// UpdateArtifactFileForEdgeStack finds the ArtifactFile matching edgeStackID and sourceID in the workflow
+// and applies fn to it, then persists the updated Workflow.
+// A no-op if no matching artifact or file is found.
+func UpdateArtifactFileForEdgeStack(tx gitSourceStore, workflowID portainer.WorkflowID, edgeStackID portainer.EdgeStackID, sourceID portainer.SourceID, fn func(*portainer.ArtifactFile)) error {
+	wf, err := tx.Workflow().Read(workflowID)
+	if err != nil {
+		return err
+	}
+
+	for i, as := range wf.Artifacts {
+		if as.EdgeStackID != edgeStackID {
+			continue
+		}
+
+		for j, file := range as.Files {
+			if file.SourceID == sourceID {
+				fn(&wf.Artifacts[i].Files[j])
+
+				return tx.Workflow().Update(workflowID, wf)
+			}
+		}
+	}
+
+	return nil
+}
+
+func UpdateSourceSyncStatus(tx gitSourceStore, userContext source.UserContext, sourceID portainer.SourceID, status portainer.SourceStatus, statusError string) error {
+	if sourceID == 0 {
+		return nil
+	}
+
+	src, err := tx.Source().Read(userContext, sourceID)
+	if err != nil {
+		return fmt.Errorf("failed to read source: %w", err)
+	}
+
+	src.Status = status
+	src.StatusError = statusError
+
+	if status == portainer.SourceStatusHealthy {
+		src.LastSync = time.Now().Unix()
+	}
+
+	return tx.Source().Update(userContext, src.ID, src)
+}
+
+func checkResultStatus(checkErr error) (portainer.SourceStatus, string) {
+	if checkErr != nil {
+		return portainer.SourceStatusError, checkErr.Error()
+	}
+
+	return portainer.SourceStatusHealthy, ""
+}
+
+func SaveSourceStatus(tx gitSourceStore, userContext source.UserContext, sourceID portainer.SourceID, checkErr error) error {
+	status, statusError := checkResultStatus(checkErr)
+
+	return UpdateSourceSyncStatus(tx, userContext, sourceID, status, statusError)
+}
+
+func SaveStackStatus(tx gitSourceStore, userContext source.UserContext, workflowID portainer.WorkflowID, stackID portainer.StackID, sourceID portainer.SourceID, checkErr error) error {
+	if workflowID == 0 {
+		return nil
+	}
+
+	status, statusError := checkResultStatus(checkErr)
+
+	if err := UpdateArtifactFileForStack(tx, workflowID, stackID, sourceID, func(a *portainer.ArtifactFile) {
+		a.RefStatus = status
+		a.RefError = statusError
+		a.PathStatus = status
+		a.PathError = statusError
+	}); err != nil {
+		return err
+	}
+
+	return UpdateSourceSyncStatus(tx, userContext, sourceID, status, statusError)
+}
+
+func SaveEdgeStackStatus(tx gitSourceStore, userContext source.UserContext, workflowID portainer.WorkflowID, edgeStackID portainer.EdgeStackID, sourceID portainer.SourceID, checkErr error) error {
+	if workflowID == 0 {
+		return nil
+	}
+
+	status, statusError := checkResultStatus(checkErr)
+
+	if err := UpdateArtifactFileForEdgeStack(tx, workflowID, edgeStackID, sourceID, func(a *portainer.ArtifactFile) {
+		a.RefStatus = status
+		a.RefError = statusError
+		a.PathStatus = status
+		a.PathError = statusError
+	}); err != nil {
+		return err
+	}
+
+	return UpdateSourceSyncStatus(tx, userContext, sourceID, status, statusError)
+}
+
+// FindOrCreateGitSource returns an existing Source whose URL and authentication match cfg,
+// or creates a new one. Only URL, authentication, and TLSSkipVerify are stored on the Source;
+// per-stack fields (ReferenceName, ConfigFilePath, ConfigHash) belong in the Artifact.
+func FindOrCreateGitSource(tx gitSourceStore, userContext source.UserContext, src *portainer.Source) (*portainer.Source, error) {
+	return tx.Source().FindOrCreateGitSource(userContext, src)
+}
+
+// SaveWorkflowGitConfig persists URL/auth/TLS on the Source and ref/path/hash on the Artifact
+// matched by matchArtifact. When the URL changes, an existing or new Source is located via
+// FindOrCreateGitSource and the Workflow's SourceID is updated atomically alongside the Artifact fields.
+func SaveWorkflowGitConfig(tx gitSourceStore, userContext source.UserContext, workflowID portainer.WorkflowID, matchArtifact func(portainer.Artifact) bool, oldSourceID portainer.SourceID, cfg *gittypes.RepoConfig) error {
+	src, err := tx.Source().Read(userContext, oldSourceID)
+	if err != nil {
+		return fmt.Errorf("failed to read source: %w", err)
+	}
+
+	if src.Git == nil {
+		return fmt.Errorf("source %d has no git configuration", oldSourceID)
+	}
+
+	newSourceID := oldSourceID
+
+	if cfg.URL != src.Git.URL {
+		newSrc, err := FindOrCreateGitSource(tx, userContext, &portainer.Source{
+			Name: gittypes.RepoName(cfg.URL),
+			Type: portainer.SourceTypeGit,
+			Git: &gittypes.GitSource{
+				URL:            cfg.URL,
+				Authentication: cfg.Authentication,
+				TLSSkipVerify:  cfg.TLSSkipVerify,
+			},
+		})
+		if err != nil {
+			return fmt.Errorf("failed to find or create source: %w", err)
+		}
+
+		newSourceID = newSrc.ID
+	} else {
+		src.Git.Authentication = cfg.Authentication
+		src.Git.TLSSkipVerify = cfg.TLSSkipVerify
+
+		if err := tx.Source().Update(userContext, src.ID, src); err != nil {
+			return fmt.Errorf("failed to update source: %w", err)
+		}
+	}
+
+	return SaveWorkflowArtifact(tx, workflowID, matchArtifact, oldSourceID, portainer.ArtifactFile{
+		SourceID: newSourceID,
+		Ref:      cfg.ReferenceName,
+		Path:     cfg.ConfigFilePath,
+		Hash:     cfg.ConfigHash,
+	})
+}
+
+// SaveWorkflowArtifact replaces the ArtifactFile referencing oldSourceID on the Artifact matched by
+// matchArtifact with update (its SourceID may repoint the Artifact to a different Source). It does not
+// modify any Source's git config — the caller is responsible for ensuring update.SourceID
+// references a valid existing Source.
+func SaveWorkflowArtifact(tx gitSourceStore, workflowID portainer.WorkflowID, matchArtifact func(portainer.Artifact) bool, oldSourceID portainer.SourceID, update portainer.ArtifactFile) error {
+	wf, err := tx.Workflow().Read(workflowID)
+	if err != nil {
+		return fmt.Errorf("failed to read workflow: %w", err)
+	}
+
+	for i, as := range wf.Artifacts {
+		if !matchArtifact(as) {
+			continue
+		}
+
+		for j, file := range as.Files {
+			if file.SourceID != oldSourceID {
+				continue
+			}
+
+			f := &wf.Artifacts[i].Files[j]
+			f.SourceID = update.SourceID
+			f.Ref = update.Ref
+			f.Path = update.Path
+			f.Hash = update.Hash
+			f.RefStatus = portainer.SourceStatusUnknown
+			f.RefError = ""
+			f.PathStatus = portainer.SourceStatusUnknown
+			f.PathError = ""
+
+			break
+		}
+
+		break
+	}
+
+	return tx.Workflow().Update(workflowID, wf)
+}
+
+// LoadWorkflowMap fetches workflows by their IDs and returns them keyed by ID.
+func LoadWorkflowMap(tx gitSourceStore, ids set.Set[portainer.WorkflowID]) (map[portainer.WorkflowID]portainer.Workflow, error) {
+	result := make(map[portainer.WorkflowID]portainer.Workflow, len(ids))
+	for id := range ids {
+		wf, err := tx.Workflow().Read(id)
+		if err != nil {
+			return nil, err
+		}
+		result[id] = *wf
+	}
+
+	return result, nil
+}
+
+// LoadWorkflowAndSourceMaps fetches workflows by their IDs and the sources they reference,
+// collecting source IDs in a single pass over the workflows.
+func LoadWorkflowAndSourceMaps(tx gitSourceStore, userContext source.UserContext, ids set.Set[portainer.WorkflowID]) (map[portainer.WorkflowID]portainer.Workflow, map[portainer.SourceID]portainer.Source, error) {
+	wfMap := make(map[portainer.WorkflowID]portainer.Workflow, len(ids))
+	sourceIDs := make(set.Set[portainer.SourceID])
+	for id := range ids {
+		wf, err := tx.Workflow().Read(id)
+		if err != nil {
+			return nil, nil, err
+		}
+		wfMap[id] = *wf
+		for _, as := range wf.Artifacts {
+			for _, f := range as.Files {
+				sourceIDs.Add(f.SourceID)
+			}
+		}
+	}
+
+	srcMap, err := loadSourceMap(tx, userContext, sourceIDs)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return wfMap, srcMap, nil
+}
+
+// LoadWorkflowSources collects all unique SourceIDs referenced by wf and returns them as a map.
+// This avoids reading the same Source record more than once when files share a SourceID.
+func LoadWorkflowSources(tx gitSourceStore, userContext source.UserContext, wf *portainer.Workflow) (map[portainer.SourceID]portainer.Source, error) {
+	ids := make(set.Set[portainer.SourceID])
+	for _, as := range wf.Artifacts {
+		for _, f := range as.Files {
+			ids.Add(f.SourceID)
+		}
+	}
+
+	return loadSourceMap(tx, userContext, ids)
+}
+
+// loadSourceMap fetches sources by their IDs and returns them keyed by ID.
+func loadSourceMap(tx gitSourceStore, userContext source.UserContext, ids set.Set[portainer.SourceID]) (map[portainer.SourceID]portainer.Source, error) {
+	sources, err := tx.Source().ReadAll(userContext, func(s portainer.Source) bool {
+		return ids.Contains(s.ID)
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	result := make(map[portainer.SourceID]portainer.Source, len(ids))
+	for _, src := range sources {
+		result[src.ID] = src
+	}
+
+	return result, nil
+}
diff --git a/api/gitops/workflows/source_artifact_test.go b/api/gitops/workflows/source_artifact_test.go
new file mode 100644
index 0000000..f3a793a
--- /dev/null
+++ b/api/gitops/workflows/source_artifact_test.go
@@ -0,0 +1,1068 @@
+package workflows
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	gittypes "github.com/portainer/portainer/api/git/types"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestMergeSourceAndFile_NilSourceReturnsNil(t *testing.T) {
+	t.Parallel()
+
+	require.Nil(t, MergeSourceAndFile(nil, nil))
+}
+
+func TestMergeSourceAndFile_NilGitConfigReturnsNil(t *testing.T) {
+	t.Parallel()
+
+	src := &portainer.Source{Type: portainer.SourceTypeGit}
+	require.Nil(t, MergeSourceAndFile(src, nil))
+}
+
+func TestMergeSourceAndFile_NilFileLeaveFileFieldsEmpty(t *testing.T) {
+	t.Parallel()
+
+	src := &portainer.Source{
+		Git: &gittypes.GitSource{
+			URL:           "https://github.com/example/repo",
+			TLSSkipVerify: true,
+			Authentication: &gittypes.GitAuthentication{
+				Username: "user",
+				Password: "pass",
+			},
+		},
+	}
+
+	cfg := MergeSourceAndFile(src, nil)
+	require.NotNil(t, cfg)
+	require.Equal(t, "https://github.com/example/repo", cfg.URL)
+	require.True(t, cfg.TLSSkipVerify)
+	require.Equal(t, "user", cfg.Authentication.Username)
+	require.Empty(t, cfg.ReferenceName)
+	require.Empty(t, cfg.ConfigFilePath)
+	require.Empty(t, cfg.ConfigHash)
+}
+
+func TestMergeSourceAndFile_MergesAllFieldsFromFile(t *testing.T) {
+	t.Parallel()
+
+	src := &portainer.Source{
+		Git: &gittypes.GitSource{
+			URL:           "https://github.com/example/repo",
+			TLSSkipVerify: true,
+		},
+	}
+	file := &portainer.ArtifactFile{
+		Path: "docker-compose.yml",
+		Ref:  "refs/heads/main",
+		Hash: "abc123",
+	}
+
+	cfg := MergeSourceAndFile(src, file)
+	require.NotNil(t, cfg)
+	require.Equal(t, "https://github.com/example/repo", cfg.URL)
+	require.True(t, cfg.TLSSkipVerify)
+	require.Equal(t, "refs/heads/main", cfg.ReferenceName)
+	require.Equal(t, "docker-compose.yml", cfg.ConfigFilePath)
+	require.Equal(t, "abc123", cfg.ConfigHash)
+}
+
+func TestGitSourceAndArtifactForStack_ZeroWorkflowIDReturnsNil(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var src *portainer.Source
+	var file *portainer.ArtifactFile
+	err := store.ViewTx(func(tx dataservices.DataStoreTx) error {
+		var txErr error
+		src, file, txErr = GitSourceAndArtifactForStack(tx, adminUserContext, 0, 1)
+		return txErr
+	})
+	require.NoError(t, err)
+	require.Nil(t, src)
+	require.Nil(t, file)
+}
+
+func TestGitSourceAndArtifactForStack_ReturnsMatchingSourceAndFile(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var workflowID portainer.WorkflowID
+	err := store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		gitSrc := &portainer.Source{
+			Type: portainer.SourceTypeGit,
+			Git:  &gittypes.GitSource{URL: "https://github.com/example/repo"},
+		}
+		err := tx.Source().Create(adminUserContext, gitSrc)
+		require.NoError(t, err)
+
+		wf := &portainer.Workflow{
+			Artifacts: []portainer.Artifact{{
+				StackID: 42,
+				Files: []portainer.ArtifactFile{{
+					SourceID: gitSrc.ID,
+					Path:     "docker-compose.yml",
+					Ref:      "refs/heads/main",
+					Hash:     "abc123",
+				}},
+			}},
+		}
+		err = tx.Workflow().Create(wf)
+		require.NoError(t, err)
+		workflowID = wf.ID
+
+		return nil
+	})
+	require.NoError(t, err)
+
+	var src *portainer.Source
+	var file *portainer.ArtifactFile
+	err = store.ViewTx(func(tx dataservices.DataStoreTx) error {
+		var txErr error
+		src, file, txErr = GitSourceAndArtifactForStack(tx, adminUserContext, workflowID, 42)
+		return txErr
+	})
+	require.NoError(t, err)
+	require.NotNil(t, src)
+	require.Equal(t, portainer.SourceTypeGit, src.Type)
+	require.NotNil(t, file)
+	require.Equal(t, "refs/heads/main", file.Ref)
+	require.Equal(t, "docker-compose.yml", file.Path)
+	require.Equal(t, "abc123", file.Hash)
+}
+
+func TestGitSourceAndArtifactForStack_NoMatchingArtifactReturnsNil(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var workflowID portainer.WorkflowID
+	err := store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		src := &portainer.Source{
+			Type: portainer.SourceTypeGit,
+			Git:  &gittypes.GitSource{URL: "https://github.com/example/repo"},
+		}
+		err := tx.Source().Create(adminUserContext, src)
+		require.NoError(t, err)
+
+		wf := &portainer.Workflow{
+			Artifacts: []portainer.Artifact{{
+				StackID: 1,
+				Files:   []portainer.ArtifactFile{{SourceID: src.ID}},
+			}},
+		}
+		err = tx.Workflow().Create(wf)
+		require.NoError(t, err)
+		workflowID = wf.ID
+
+		return nil
+	})
+	require.NoError(t, err)
+
+	var src *portainer.Source
+	var file *portainer.ArtifactFile
+	err = store.ViewTx(func(tx dataservices.DataStoreTx) error {
+		var txErr error
+		src, file, txErr = GitSourceAndArtifactForStack(tx, adminUserContext, workflowID, 99)
+		return txErr
+	})
+	require.NoError(t, err)
+	require.Nil(t, src)
+	require.Nil(t, file)
+}
+
+func TestGitSourceAndArtifactForEdgeStack_ZeroWorkflowIDReturnsNil(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var src *portainer.Source
+	var file *portainer.ArtifactFile
+	err := store.ViewTx(func(tx dataservices.DataStoreTx) error {
+		var txErr error
+		src, file, txErr = GitSourceAndArtifactForEdgeStack(tx, adminUserContext, 0, 1)
+		return txErr
+	})
+	require.NoError(t, err)
+	require.Nil(t, src)
+	require.Nil(t, file)
+}
+
+func TestGitSourceAndArtifactForEdgeStack_ReturnsMatchingSourceAndFile(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var workflowID portainer.WorkflowID
+	err := store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		gitSrc := &portainer.Source{
+			Type: portainer.SourceTypeGit,
+			Git:  &gittypes.GitSource{URL: "https://github.com/example/edge-repo"},
+		}
+		err := tx.Source().Create(adminUserContext, gitSrc)
+		require.NoError(t, err)
+
+		wf := &portainer.Workflow{
+			Artifacts: []portainer.Artifact{{
+				EdgeStackID: 5,
+				Files: []portainer.ArtifactFile{{
+					SourceID: gitSrc.ID,
+					Path:     "edge.yml",
+					Ref:      "refs/heads/edge",
+				}},
+			}},
+		}
+		err = tx.Workflow().Create(wf)
+		require.NoError(t, err)
+		workflowID = wf.ID
+
+		return nil
+	})
+	require.NoError(t, err)
+
+	var src *portainer.Source
+	var file *portainer.ArtifactFile
+	err = store.ViewTx(func(tx dataservices.DataStoreTx) error {
+		var txErr error
+		src, file, txErr = GitSourceAndArtifactForEdgeStack(tx, adminUserContext, workflowID, 5)
+		return txErr
+	})
+	require.NoError(t, err)
+	require.NotNil(t, src)
+	require.Equal(t, portainer.SourceTypeGit, src.Type)
+	require.NotNil(t, file)
+	require.Equal(t, "refs/heads/edge", file.Ref)
+}
+
+func TestUpdateArtifactFileForStack_NoMatchingArtifactIsNoOp(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var workflowID portainer.WorkflowID
+	var sourceID portainer.SourceID
+	err := store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		src := &portainer.Source{Type: portainer.SourceTypeGit, Git: &gittypes.GitSource{URL: "https://example.com"}}
+		err := tx.Source().Create(adminUserContext, src)
+		require.NoError(t, err)
+		sourceID = src.ID
+
+		wf := &portainer.Workflow{
+			Artifacts: []portainer.Artifact{{
+				StackID: 1,
+				Files:   []portainer.ArtifactFile{{SourceID: sourceID, Hash: "original"}},
+			}},
+		}
+		err = tx.Workflow().Create(wf)
+		require.NoError(t, err)
+		workflowID = wf.ID
+
+		return nil
+	})
+	require.NoError(t, err)
+
+	err = store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return UpdateArtifactFileForStack(tx, workflowID, 99, sourceID, func(a *portainer.ArtifactFile) {
+			a.Hash = "changed"
+		})
+	})
+	require.NoError(t, err)
+
+	wf, err := store.Workflow().Read(workflowID)
+	require.NoError(t, err)
+	require.Equal(t, "original", wf.Artifacts[0].Files[0].Hash)
+}
+
+func TestUpdateArtifactFileForStack_AppliesFnAndPersists(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var workflowID portainer.WorkflowID
+	var sourceID portainer.SourceID
+	err := store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		src := &portainer.Source{Type: portainer.SourceTypeGit, Git: &gittypes.GitSource{URL: "https://example.com"}}
+		err := tx.Source().Create(adminUserContext, src)
+		require.NoError(t, err)
+		sourceID = src.ID
+
+		wf := &portainer.Workflow{
+			Artifacts: []portainer.Artifact{{
+				StackID: 1,
+				Files:   []portainer.ArtifactFile{{SourceID: sourceID, Hash: "old-hash"}},
+			}},
+		}
+		err = tx.Workflow().Create(wf)
+		require.NoError(t, err)
+		workflowID = wf.ID
+
+		return nil
+	})
+	require.NoError(t, err)
+
+	err = store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return UpdateArtifactFileForStack(tx, workflowID, 1, sourceID, func(a *portainer.ArtifactFile) {
+			a.Hash = "new-hash"
+		})
+	})
+	require.NoError(t, err)
+
+	wf, err := store.Workflow().Read(workflowID)
+	require.NoError(t, err)
+	require.Equal(t, "new-hash", wf.Artifacts[0].Files[0].Hash)
+}
+
+func TestUpdateArtifactFileForEdgeStack_AppliesFnAndPersists(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var workflowID portainer.WorkflowID
+	var sourceID portainer.SourceID
+	err := store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		src := &portainer.Source{Type: portainer.SourceTypeGit, Git: &gittypes.GitSource{URL: "https://example.com"}}
+		err := tx.Source().Create(adminUserContext, src)
+		require.NoError(t, err)
+		sourceID = src.ID
+
+		wf := &portainer.Workflow{
+			Artifacts: []portainer.Artifact{{
+				EdgeStackID: 7,
+				Files:       []portainer.ArtifactFile{{SourceID: sourceID, Hash: "old-hash"}},
+			}},
+		}
+		err = tx.Workflow().Create(wf)
+		require.NoError(t, err)
+		workflowID = wf.ID
+
+		return nil
+	})
+	require.NoError(t, err)
+
+	err = store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return UpdateArtifactFileForEdgeStack(tx, workflowID, 7, sourceID, func(a *portainer.ArtifactFile) {
+			a.Hash = "new-hash"
+		})
+	})
+	require.NoError(t, err)
+
+	wf, err := store.Workflow().Read(workflowID)
+	require.NoError(t, err)
+	require.Equal(t, "new-hash", wf.Artifacts[0].Files[0].Hash)
+}
+
+func TestFindOrCreateGitSource_CreatesNewSource(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var src *portainer.Source
+	err := store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		var txErr error
+		src, txErr = FindOrCreateGitSource(tx, adminUserContext, &portainer.Source{
+			Name: "my-repo",
+			Type: portainer.SourceTypeGit,
+			Git: &gittypes.GitSource{
+				URL: "https://github.com/example/repo",
+			},
+		})
+		return txErr
+	})
+	require.NoError(t, err)
+	require.NotNil(t, src)
+	require.NotZero(t, src.ID)
+	require.Equal(t, "https://github.com/example/repo", src.Git.URL)
+}
+
+func TestFindOrCreateGitSource_ReusesExistingSourceForSameURLAndAuth(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	makeSource := func(tx dataservices.DataStoreTx) (*portainer.Source, error) {
+		return FindOrCreateGitSource(tx, adminUserContext, &portainer.Source{
+			Type: portainer.SourceTypeGit,
+			Git: &gittypes.GitSource{
+				URL: "https://github.com/example/repo",
+			},
+		})
+	}
+
+	var firstID portainer.SourceID
+	err := store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		s, err := makeSource(tx)
+		if err != nil {
+			return err
+		}
+		firstID = s.ID
+
+		return nil
+	})
+	require.NoError(t, err)
+
+	var secondID portainer.SourceID
+	err = store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		s, err := makeSource(tx)
+		if err != nil {
+			return err
+		}
+		secondID = s.ID
+
+		return nil
+	})
+	require.NoError(t, err)
+	require.Equal(t, firstID, secondID)
+
+	sources, err := store.Source().ReadAll(adminUserContext)
+	require.NoError(t, err)
+	require.Len(t, sources, 1)
+}
+
+func TestFindOrCreateGitSource_DifferentAuthCreatesNewSource(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	err := store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		_, txErr := FindOrCreateGitSource(tx, adminUserContext, &portainer.Source{
+			Type: portainer.SourceTypeGit,
+			Git: &gittypes.GitSource{
+				URL:            "https://github.com/example/repo",
+				Authentication: &gittypes.GitAuthentication{Username: "alice", Password: "pass1"},
+			},
+		})
+		return txErr
+	})
+	require.NoError(t, err)
+
+	err = store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		_, txErr := FindOrCreateGitSource(tx, adminUserContext, &portainer.Source{
+			Type: portainer.SourceTypeGit,
+			Git: &gittypes.GitSource{
+				URL:            "https://github.com/example/repo",
+				Authentication: &gittypes.GitAuthentication{Username: "bob", Password: "pass2"},
+			},
+		})
+		return txErr
+	})
+	require.NoError(t, err)
+
+	sources, err := store.Source().ReadAll(adminUserContext)
+	require.NoError(t, err)
+	require.Len(t, sources, 2)
+}
+
+func TestSaveWorkflowGitConfig_UpdatesFileAndSourceWhenURLUnchanged(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var workflowID portainer.WorkflowID
+	var sourceID portainer.SourceID
+
+	err := store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		src := &portainer.Source{
+			Type: portainer.SourceTypeGit,
+			Git: &gittypes.GitSource{
+				URL:           "https://github.com/example/repo",
+				TLSSkipVerify: false,
+				Authentication: &gittypes.GitAuthentication{
+					Username: "old-user",
+					Password: "old-pass",
+				},
+			},
+		}
+		err := tx.Source().Create(adminUserContext, src)
+		require.NoError(t, err)
+		sourceID = src.ID
+
+		wf := &portainer.Workflow{
+			Artifacts: []portainer.Artifact{{
+				StackID: 1,
+				Files: []portainer.ArtifactFile{{
+					SourceID: sourceID,
+					Path:     "docker-compose.yml",
+					Ref:      "refs/heads/main",
+					Hash:     "old-hash",
+				}},
+			}},
+		}
+		err = tx.Workflow().Create(wf)
+		require.NoError(t, err)
+		workflowID = wf.ID
+
+		return nil
+	})
+	require.NoError(t, err)
+
+	newCfg := &gittypes.RepoConfig{
+		URL:           "https://github.com/example/repo",
+		TLSSkipVerify: true,
+		Authentication: &gittypes.GitAuthentication{
+			Username: "new-user",
+			Password: "new-pass",
+		},
+		ReferenceName:  "refs/heads/dev",
+		ConfigFilePath: "compose.yml",
+		ConfigHash:     "new-hash",
+	}
+
+	err = store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return SaveWorkflowGitConfig(tx, adminUserContext, workflowID, func(a portainer.Artifact) bool {
+			return a.StackID == 1
+		}, sourceID, newCfg)
+	})
+	require.NoError(t, err)
+
+	wf, err := store.Workflow().Read(workflowID)
+	require.NoError(t, err)
+	require.Equal(t, "refs/heads/dev", wf.Artifacts[0].Files[0].Ref)
+	require.Equal(t, "compose.yml", wf.Artifacts[0].Files[0].Path)
+	require.Equal(t, "new-hash", wf.Artifacts[0].Files[0].Hash)
+	require.Equal(t, sourceID, wf.Artifacts[0].Files[0].SourceID)
+
+	src, err := store.Source().Read(adminUserContext, sourceID)
+	require.NoError(t, err)
+	require.Equal(t, "new-user", src.Git.Authentication.Username)
+	require.Equal(t, "new-pass", src.Git.Authentication.Password)
+	require.True(t, src.Git.TLSSkipVerify)
+}
+
+func TestSaveWorkflowGitConfig_CreatesNewSourceOnURLChange(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var workflowID portainer.WorkflowID
+	var oldSourceID portainer.SourceID
+
+	err := store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		src := &portainer.Source{
+			Type: portainer.SourceTypeGit,
+			Git:  &gittypes.GitSource{URL: "https://github.com/example/old-repo"},
+		}
+		err := tx.Source().Create(adminUserContext, src)
+		require.NoError(t, err)
+		oldSourceID = src.ID
+
+		wf := &portainer.Workflow{
+			Artifacts: []portainer.Artifact{{
+				StackID: 1,
+				Files:   []portainer.ArtifactFile{{SourceID: oldSourceID}},
+			}},
+		}
+		err = tx.Workflow().Create(wf)
+		require.NoError(t, err)
+		workflowID = wf.ID
+
+		return nil
+	})
+	require.NoError(t, err)
+
+	newCfg := &gittypes.RepoConfig{URL: "https://github.com/example/new-repo"}
+
+	err = store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return SaveWorkflowGitConfig(tx, adminUserContext, workflowID, func(a portainer.Artifact) bool {
+			return a.StackID == 1
+		}, oldSourceID, newCfg)
+	})
+	require.NoError(t, err)
+
+	wf, err := store.Workflow().Read(workflowID)
+	require.NoError(t, err)
+	newSourceID := wf.Artifacts[0].Files[0].SourceID
+	require.NotEqual(t, oldSourceID, newSourceID)
+
+	newSrc, err := store.Source().Read(adminUserContext, newSourceID)
+	require.NoError(t, err)
+	require.Equal(t, "https://github.com/example/new-repo", newSrc.Git.URL)
+}
+
+func TestSaveWorkflowGitConfig_ReusesExistingSourceOnURLChange(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var workflowID portainer.WorkflowID
+	var oldSourceID, existingSourceID portainer.SourceID
+
+	err := store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		old := &portainer.Source{
+			Type: portainer.SourceTypeGit,
+			Git:  &gittypes.GitSource{URL: "https://github.com/example/old-repo"},
+		}
+		err := tx.Source().Create(adminUserContext, old)
+		require.NoError(t, err)
+		oldSourceID = old.ID
+
+		existing := &portainer.Source{
+			Type: portainer.SourceTypeGit,
+			Git:  &gittypes.GitSource{URL: "https://github.com/example/shared-repo"},
+		}
+		err = tx.Source().Create(adminUserContext, existing)
+		require.NoError(t, err)
+		existingSourceID = existing.ID
+
+		wf := &portainer.Workflow{
+			Artifacts: []portainer.Artifact{{
+				StackID: 1,
+				Files:   []portainer.ArtifactFile{{SourceID: oldSourceID}},
+			}},
+		}
+		err = tx.Workflow().Create(wf)
+		require.NoError(t, err)
+		workflowID = wf.ID
+
+		return nil
+	})
+	require.NoError(t, err)
+
+	newCfg := &gittypes.RepoConfig{URL: "https://github.com/example/shared-repo"}
+
+	err = store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return SaveWorkflowGitConfig(tx, adminUserContext, workflowID, func(a portainer.Artifact) bool {
+			return a.StackID == 1
+		}, oldSourceID, newCfg)
+	})
+	require.NoError(t, err)
+
+	wf, err := store.Workflow().Read(workflowID)
+	require.NoError(t, err)
+	require.Equal(t, existingSourceID, wf.Artifacts[0].Files[0].SourceID)
+
+	sources, err := store.Source().ReadAll(adminUserContext)
+	require.NoError(t, err)
+	require.Len(t, sources, 2)
+}
+
+func TestSaveWorkflowGitConfig_OnlyMatchingArtifactUpdated(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var workflowID portainer.WorkflowID
+	var sourceID portainer.SourceID
+
+	err := store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		src := &portainer.Source{
+			Type: portainer.SourceTypeGit,
+			Git:  &gittypes.GitSource{URL: "https://github.com/example/repo"},
+		}
+		err := tx.Source().Create(adminUserContext, src)
+		require.NoError(t, err)
+		sourceID = src.ID
+
+		wf := &portainer.Workflow{
+			Artifacts: []portainer.Artifact{
+				{
+					StackID: 1,
+					Files:   []portainer.ArtifactFile{{SourceID: sourceID, Hash: "hash-1"}},
+				},
+				{
+					StackID: 2,
+					Files:   []portainer.ArtifactFile{{SourceID: sourceID, Hash: "hash-2"}},
+				},
+			},
+		}
+		err = tx.Workflow().Create(wf)
+		require.NoError(t, err)
+		workflowID = wf.ID
+
+		return nil
+	})
+	require.NoError(t, err)
+
+	err = store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return SaveWorkflowGitConfig(tx, adminUserContext, workflowID, func(a portainer.Artifact) bool {
+			return a.StackID == 1
+		}, sourceID, &gittypes.RepoConfig{
+			URL:        "https://github.com/example/repo",
+			ConfigHash: "updated-hash",
+		})
+	})
+	require.NoError(t, err)
+
+	wf, err := store.Workflow().Read(workflowID)
+	require.NoError(t, err)
+	require.Equal(t, "updated-hash", wf.Artifacts[0].Files[0].Hash)
+	require.Equal(t, "hash-2", wf.Artifacts[1].Files[0].Hash)
+}
+
+func TestUpdateArtifactFileForStack_MultipleArtifactsOnlyMatchingUpdated(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var workflowID portainer.WorkflowID
+	var srcID portainer.SourceID
+	err := store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		src := &portainer.Source{Type: portainer.SourceTypeGit, Git: &gittypes.GitSource{URL: "https://example.com"}}
+		err := tx.Source().Create(adminUserContext, src)
+		require.NoError(t, err)
+		srcID = src.ID
+
+		wf := &portainer.Workflow{
+			Artifacts: []portainer.Artifact{
+				{StackID: 10, Files: []portainer.ArtifactFile{{SourceID: srcID, Hash: "hash-10"}}},
+				{StackID: 20, Files: []portainer.ArtifactFile{{SourceID: srcID, Hash: "hash-20"}}},
+			},
+		}
+		err = tx.Workflow().Create(wf)
+		require.NoError(t, err)
+		workflowID = wf.ID
+
+		return nil
+	})
+	require.NoError(t, err)
+
+	err = store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return UpdateArtifactFileForStack(tx, workflowID, 10, srcID, func(a *portainer.ArtifactFile) {
+			a.Hash = "updated-hash-10"
+		})
+	})
+	require.NoError(t, err)
+
+	wf, err := store.Workflow().Read(workflowID)
+	require.NoError(t, err)
+	require.Equal(t, "updated-hash-10", wf.Artifacts[0].Files[0].Hash)
+	require.Equal(t, "hash-20", wf.Artifacts[1].Files[0].Hash)
+}
+
+func TestSaveWorkflowArtifact_SwitchesSourceWithoutMutatingIt(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var workflowID portainer.WorkflowID
+	var oldSourceID, newSourceID portainer.SourceID
+
+	err := store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		// Two distinct sources sharing the same URL: the case where URL-based
+		// resolution would fail to switch.
+		old := &portainer.Source{
+			Type: portainer.SourceTypeGit,
+			Git:  &gittypes.GitSource{URL: "https://github.com/example/repo"},
+		}
+		err := tx.Source().Create(adminUserContext, old)
+		require.NoError(t, err)
+		oldSourceID = old.ID
+
+		selected := &portainer.Source{
+			Type: portainer.SourceTypeGit,
+			Git: &gittypes.GitSource{
+				URL: "https://github.com/example/repo",
+				Authentication: &gittypes.GitAuthentication{
+					Username: "selected-user",
+					Password: "selected-pass",
+				},
+			},
+		}
+		err = tx.Source().Create(adminUserContext, selected)
+		require.NoError(t, err)
+		newSourceID = selected.ID
+
+		wf := &portainer.Workflow{
+			Artifacts: []portainer.Artifact{{
+				StackID: 1,
+				Files: []portainer.ArtifactFile{{
+					SourceID: oldSourceID,
+					Ref:      "refs/heads/main",
+					Path:     "docker-compose.yml",
+					Hash:     "old-hash",
+				}},
+			}},
+		}
+		err = tx.Workflow().Create(wf)
+		require.NoError(t, err)
+		workflowID = wf.ID
+
+		return nil
+	})
+	require.NoError(t, err)
+
+	err = store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return SaveWorkflowArtifact(tx, workflowID, func(a portainer.Artifact) bool {
+			return a.StackID == 1
+		}, oldSourceID, portainer.ArtifactFile{
+			SourceID: newSourceID,
+			Ref:      "refs/heads/dev",
+			Path:     "compose.yml",
+			Hash:     "new-hash",
+		})
+	})
+	require.NoError(t, err)
+
+	wf, err := store.Workflow().Read(workflowID)
+	require.NoError(t, err)
+	require.Equal(t, newSourceID, wf.Artifacts[0].Files[0].SourceID)
+	require.Equal(t, "refs/heads/dev", wf.Artifacts[0].Files[0].Ref)
+	require.Equal(t, "compose.yml", wf.Artifacts[0].Files[0].Path)
+	require.Equal(t, "new-hash", wf.Artifacts[0].Files[0].Hash)
+
+	// The selected source's git config must be left untouched.
+	selected, err := store.Source().Read(adminUserContext, newSourceID)
+	require.NoError(t, err)
+	require.Equal(t, "https://github.com/example/repo", selected.Git.URL)
+	require.Equal(t, "selected-user", selected.Git.Authentication.Username)
+	require.Equal(t, "selected-pass", selected.Git.Authentication.Password)
+}
+
+func TestUpdateArtifactFileForEdgeStack_MultipleArtifactsOnlyMatchingUpdated(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var workflowID portainer.WorkflowID
+	var srcID portainer.SourceID
+	err := store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		src := &portainer.Source{Type: portainer.SourceTypeGit, Git: &gittypes.GitSource{URL: "https://example.com"}}
+		err := tx.Source().Create(adminUserContext, src)
+		require.NoError(t, err)
+		srcID = src.ID
+
+		wf := &portainer.Workflow{
+			Artifacts: []portainer.Artifact{
+				{EdgeStackID: 10, Files: []portainer.ArtifactFile{{SourceID: srcID, Hash: "hash-10"}}},
+				{EdgeStackID: 20, Files: []portainer.ArtifactFile{{SourceID: srcID, Hash: "hash-20"}}},
+			},
+		}
+		err = tx.Workflow().Create(wf)
+		require.NoError(t, err)
+		workflowID = wf.ID
+
+		return nil
+	})
+	require.NoError(t, err)
+
+	err = store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return UpdateArtifactFileForEdgeStack(tx, workflowID, 10, srcID, func(a *portainer.ArtifactFile) {
+			a.Hash = "updated-hash-10"
+		})
+	})
+	require.NoError(t, err)
+
+	wf, err := store.Workflow().Read(workflowID)
+	require.NoError(t, err)
+	require.Equal(t, "updated-hash-10", wf.Artifacts[0].Files[0].Hash)
+	require.Equal(t, "hash-20", wf.Artifacts[1].Files[0].Hash)
+}
+
+func TestSaveWorkflowArtifact_SameSourceUpdatesArtifactOnly(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var workflowID portainer.WorkflowID
+	var sourceID portainer.SourceID
+
+	err := store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		src := &portainer.Source{
+			Type: portainer.SourceTypeGit,
+			Git:  &gittypes.GitSource{URL: "https://github.com/example/repo"},
+		}
+		err := tx.Source().Create(adminUserContext, src)
+		require.NoError(t, err)
+		sourceID = src.ID
+
+		wf := &portainer.Workflow{
+			Artifacts: []portainer.Artifact{{
+				StackID: 1,
+				Files: []portainer.ArtifactFile{{
+					SourceID: sourceID,
+					Ref:      "refs/heads/main",
+				}},
+			}},
+		}
+		err = tx.Workflow().Create(wf)
+		require.NoError(t, err)
+		workflowID = wf.ID
+
+		return nil
+	})
+	require.NoError(t, err)
+
+	err = store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return SaveWorkflowArtifact(tx, workflowID, func(a portainer.Artifact) bool {
+			return a.StackID == 1
+		}, sourceID, portainer.ArtifactFile{
+			SourceID: sourceID,
+			Ref:      "refs/heads/dev",
+			Path:     "compose.yml",
+			Hash:     "new-hash",
+		})
+	})
+	require.NoError(t, err)
+
+	wf, err := store.Workflow().Read(workflowID)
+	require.NoError(t, err)
+	require.Len(t, wf.Artifacts[0].Files, 1)
+	require.Equal(t, sourceID, wf.Artifacts[0].Files[0].SourceID)
+	require.Equal(t, "refs/heads/dev", wf.Artifacts[0].Files[0].Ref)
+	require.Equal(t, "compose.yml", wf.Artifacts[0].Files[0].Path)
+	require.Equal(t, "new-hash", wf.Artifacts[0].Files[0].Hash)
+}
+
+func TestGitSourceAndArtifactForStack_MultipleArtifactsReturnsCorrectOne(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var workflowID portainer.WorkflowID
+	err := store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		gitSrc := &portainer.Source{
+			Type: portainer.SourceTypeGit,
+			Git:  &gittypes.GitSource{URL: "https://github.com/example/shared-repo"},
+		}
+		err := tx.Source().Create(adminUserContext, gitSrc)
+		require.NoError(t, err)
+
+		wf := &portainer.Workflow{
+			Artifacts: []portainer.Artifact{
+				{StackID: 10, Files: []portainer.ArtifactFile{{SourceID: gitSrc.ID, Ref: "refs/heads/main", Hash: "hash-10"}}},
+				{StackID: 20, Files: []portainer.ArtifactFile{{SourceID: gitSrc.ID, Ref: "refs/heads/dev", Hash: "hash-20"}}},
+			},
+		}
+		err = tx.Workflow().Create(wf)
+		require.NoError(t, err)
+		workflowID = wf.ID
+
+		return nil
+	})
+	require.NoError(t, err)
+
+	var src *portainer.Source
+	var file *portainer.ArtifactFile
+	err = store.ViewTx(func(tx dataservices.DataStoreTx) error {
+		var txErr error
+		src, file, txErr = GitSourceAndArtifactForStack(tx, adminUserContext, workflowID, 20)
+		return txErr
+	})
+	require.NoError(t, err)
+	require.NotNil(t, src)
+	require.NotNil(t, file)
+	require.Equal(t, "refs/heads/dev", file.Ref)
+	require.Equal(t, "hash-20", file.Hash)
+}
+
+func TestGitSourceAndArtifactForEdgeStack_MultipleArtifactsReturnsCorrectOne(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var workflowID portainer.WorkflowID
+	err := store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		gitSrc := &portainer.Source{
+			Type: portainer.SourceTypeGit,
+			Git:  &gittypes.GitSource{URL: "https://github.com/example/shared-edge-repo"},
+		}
+		err := tx.Source().Create(adminUserContext, gitSrc)
+		require.NoError(t, err)
+
+		wf := &portainer.Workflow{
+			Artifacts: []portainer.Artifact{
+				{EdgeStackID: 10, Files: []portainer.ArtifactFile{{SourceID: gitSrc.ID, Ref: "refs/heads/main", Hash: "hash-10"}}},
+				{EdgeStackID: 20, Files: []portainer.ArtifactFile{{SourceID: gitSrc.ID, Ref: "refs/heads/dev", Hash: "hash-20"}}},
+			},
+		}
+		err = tx.Workflow().Create(wf)
+		require.NoError(t, err)
+		workflowID = wf.ID
+
+		return nil
+	})
+	require.NoError(t, err)
+
+	var src *portainer.Source
+	var file *portainer.ArtifactFile
+	err = store.ViewTx(func(tx dataservices.DataStoreTx) error {
+		var txErr error
+		src, file, txErr = GitSourceAndArtifactForEdgeStack(tx, adminUserContext, workflowID, 20)
+		return txErr
+	})
+	require.NoError(t, err)
+	require.NotNil(t, src)
+	require.NotNil(t, file)
+	require.Equal(t, "refs/heads/dev", file.Ref)
+	require.Equal(t, "hash-20", file.Hash)
+}
+
+func TestMergeSourceAndFile_ConfigHashComesFromFileNotSource(t *testing.T) {
+	t.Parallel()
+
+	src := &portainer.Source{
+		Git: &gittypes.GitSource{URL: "https://github.com/example/repo"},
+	}
+	file := &portainer.ArtifactFile{Hash: "artifact-hash"}
+
+	cfg := MergeSourceAndFile(src, file)
+	require.NotNil(t, cfg)
+	require.Equal(t, "artifact-hash", cfg.ConfigHash)
+}
+
+func TestUpdateSourceSyncStatus_HealthyBumpsLastSyncAndClearsError(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var sourceID portainer.SourceID
+	err := store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		src := &portainer.Source{
+			Type:        portainer.SourceTypeGit,
+			Git:         &gittypes.GitSource{URL: "https://example.com"},
+			Status:      portainer.SourceStatusError,
+			StatusError: "previous failure",
+		}
+		err := tx.Source().Create(adminUserContext, src)
+		require.NoError(t, err)
+		sourceID = src.ID
+
+		return nil
+	})
+	require.NoError(t, err)
+
+	err = store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return UpdateSourceSyncStatus(tx, adminUserContext, sourceID, portainer.SourceStatusHealthy, "")
+	})
+	require.NoError(t, err)
+
+	src, err := store.Source().Read(adminUserContext, sourceID)
+	require.NoError(t, err)
+	require.Equal(t, portainer.SourceStatusHealthy, src.Status)
+	require.Empty(t, src.StatusError)
+	require.NotZero(t, src.LastSync)
+}
+
+func TestUpdateSourceSyncStatus_ErrorPreservesPriorLastSync(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var sourceID portainer.SourceID
+	err := store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		src := &portainer.Source{
+			Type:     portainer.SourceTypeGit,
+			Git:      &gittypes.GitSource{URL: "https://example.com"},
+			LastSync: 12345,
+		}
+		err := tx.Source().Create(adminUserContext, src)
+		require.NoError(t, err)
+		sourceID = src.ID
+
+		return nil
+	})
+	require.NoError(t, err)
+
+	err = store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return UpdateSourceSyncStatus(tx, adminUserContext, sourceID, portainer.SourceStatusError, "git fetch failed")
+	})
+	require.NoError(t, err)
+
+	src, err := store.Source().Read(adminUserContext, sourceID)
+	require.NoError(t, err)
+	require.Equal(t, portainer.SourceStatusError, src.Status)
+	require.Equal(t, "git fetch failed", src.StatusError)
+	require.Equal(t, int64(12345), src.LastSync)
+}
+
+func TestFindOrCreateGitSource_StripsEmbeddedCredentialsFromURL(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var src *portainer.Source
+	err := store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		var txErr error
+		src, txErr = FindOrCreateGitSource(tx, adminUserContext, &portainer.Source{
+			Type: portainer.SourceTypeGit,
+			Git: &gittypes.GitSource{
+				URL: "https://user:secret@github.com/example/repo",
+			},
+		})
+		return txErr
+	})
+	require.NoError(t, err)
+	require.Equal(t, "https://github.com/example/repo", src.Git.URL)
+}
diff --git a/api/gitops/workflows/status.go b/api/gitops/workflows/status.go
new file mode 100644
index 0000000..d08adc7
--- /dev/null
+++ b/api/gitops/workflows/status.go
@@ -0,0 +1,162 @@
+package workflows
+
+import portainer "github.com/portainer/portainer/api"
+
+func SourceStatusToPhase(s portainer.SourceStatus, errMsg string) WorkflowPhaseStatus {
+	switch s {
+	case portainer.SourceStatusHealthy:
+		return WorkflowPhaseStatus{Status: StatusHealthy}
+	case portainer.SourceStatusError:
+		return WorkflowPhaseStatus{Status: StatusError, Error: errMsg}
+	default:
+		return WorkflowPhaseStatus{Status: StatusUnknown}
+	}
+}
+
+// ArtifactPhases returns the source and artifact-path health phases for an artifact's files,
+// aggregating the worst-priority status across all of its files. The source phase also folds in
+// each file's Source connectivity status, since a broken source invalidates ref resolution
+// regardless of the file's own cached RefStatus.
+func ArtifactPhases(files []portainer.ArtifactFile, sourceMap map[portainer.SourceID]portainer.Source) (source, artifact WorkflowPhaseStatus) {
+	source = WorkflowPhaseStatus{Status: StatusUnknown}
+	artifact = WorkflowPhaseStatus{Status: StatusUnknown}
+
+	for _, f := range files {
+		src, ok := sourceMap[f.SourceID]
+		if !ok {
+			continue
+		}
+
+		if srcPhase := SourceStatusToPhase(src.Status, src.StatusError); statusPriority(srcPhase.Status) > statusPriority(source.Status) {
+			source = srcPhase
+		}
+		if refPhase := SourceStatusToPhase(f.RefStatus, f.RefError); statusPriority(refPhase.Status) > statusPriority(source.Status) {
+			source = refPhase
+		}
+		if artifactPhase := SourceStatusToPhase(f.PathStatus, f.PathError); statusPriority(artifactPhase.Status) > statusPriority(artifact.Status) {
+			artifact = artifactPhase
+		}
+	}
+
+	return source, artifact
+}
+
+func WorkflowPhaseToStatus(p WorkflowPhaseStatus) (portainer.SourceStatus, string) {
+	switch p.Status {
+	case StatusHealthy:
+		return portainer.SourceStatusHealthy, ""
+	case StatusError:
+		return portainer.SourceStatusError, p.Error
+	default:
+		return portainer.SourceStatusUnknown, ""
+	}
+}
+
+func deriveStackTargetState(s portainer.Stack) WorkflowPhaseStatus {
+	if len(s.DeploymentStatus) == 0 {
+		return WorkflowPhaseStatus{Status: StatusHealthy}
+	}
+	last := s.DeploymentStatus[len(s.DeploymentStatus)-1]
+	switch last.Status {
+	case portainer.StackStatusActive:
+		return WorkflowPhaseStatus{Status: StatusHealthy}
+	case portainer.StackStatusError:
+		return WorkflowPhaseStatus{Status: StatusError, Error: last.Message}
+	case portainer.StackStatusDeploying:
+		return WorkflowPhaseStatus{Status: StatusSyncing}
+	case portainer.StackStatusInactive:
+		return WorkflowPhaseStatus{Status: StatusPaused}
+	default:
+		return WorkflowPhaseStatus{Status: StatusUnknown}
+	}
+}
+
+func deriveEdgeStackTargetState(statuses []portainer.EdgeStackStatusForEnv) WorkflowPhaseStatus {
+	result := StatusUnknown
+	for _, epStatus := range statuses {
+		ws, msg := endpointWorkflowStatus(epStatus)
+		if ws == StatusError {
+			return WorkflowPhaseStatus{Status: ws, Error: msg}
+		}
+		if statusPriority(ws) > statusPriority(result) {
+			result = ws
+		}
+	}
+	return WorkflowPhaseStatus{Status: result}
+}
+
+func endpointWorkflowStatus(epStatus portainer.EdgeStackStatusForEnv) (Status, string) {
+	if len(epStatus.Status) == 0 {
+		return StatusUnknown, ""
+	}
+	last := epStatus.Status[len(epStatus.Status)-1]
+	switch last.Type {
+	case portainer.EdgeStackStatusError:
+		return StatusError, last.Error
+	case portainer.EdgeStackStatusDeploying,
+		portainer.EdgeStackStatusRollingBack,
+		portainer.EdgeStackStatusRemoving,
+		portainer.EdgeStackStatusPending,
+		portainer.EdgeStackStatusDeploymentReceived,
+		portainer.EdgeStackStatusAcknowledged,
+		portainer.EdgeStackStatusImagesPulled:
+		return StatusSyncing, ""
+	case portainer.EdgeStackStatusPausedDeploying:
+		return StatusPaused, ""
+	case portainer.EdgeStackStatusRunning,
+		portainer.EdgeStackStatusRolledBack,
+		portainer.EdgeStackStatusCompleted,
+		portainer.EdgeStackStatusRemoved,
+		portainer.EdgeStackStatusRemoteUpdateSuccess:
+		return StatusHealthy, ""
+	default:
+		return StatusUnknown, ""
+	}
+}
+
+// EffectiveStatus returns the highest-priority status across all three phases of a workflow.
+func EffectiveStatus(w Workflow) Status {
+	s := w.Status.Target.Status
+	if statusPriority(w.Status.Source.Status) > statusPriority(s) {
+		s = w.Status.Source.Status
+	}
+	if statusPriority(w.Status.Artifact.Status) > statusPriority(s) {
+		s = w.Status.Artifact.Status
+	}
+	return s
+}
+
+// CountByStatus counts workflows per effective status and returns a StatusSummary.
+func CountByStatus(workflows []Workflow) StatusSummary {
+	var s StatusSummary
+	for _, w := range workflows {
+		switch EffectiveStatus(w) {
+		case StatusHealthy:
+			s.Healthy++
+		case StatusSyncing:
+			s.Syncing++
+		case StatusError:
+			s.Error++
+		case StatusPaused:
+			s.Paused++
+		default:
+			s.Unknown++
+		}
+	}
+	return s
+}
+
+func statusPriority(s Status) int {
+	switch s {
+	case StatusError:
+		return 4
+	case StatusSyncing:
+		return 3
+	case StatusPaused:
+		return 2
+	case StatusHealthy:
+		return 1
+	default:
+		return 0
+	}
+}
diff --git a/api/gitops/workflows/status_test.go b/api/gitops/workflows/status_test.go
new file mode 100644
index 0000000..d15f4ee
--- /dev/null
+++ b/api/gitops/workflows/status_test.go
@@ -0,0 +1,289 @@
+package workflows
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestEffectiveStatus(t *testing.T) {
+	t.Parallel()
+
+	makeWorkflow := func(source, artifact, target Status) Workflow {
+		return Workflow{
+			Status: WorkflowStatusObject{
+				Source:   WorkflowPhaseStatus{Status: source},
+				Artifact: WorkflowPhaseStatus{Status: artifact},
+				Target:   WorkflowPhaseStatus{Status: target},
+			},
+		}
+	}
+
+	cases := []struct {
+		name string
+		w    Workflow
+		want Status
+	}{
+		{"all healthy", makeWorkflow(StatusHealthy, StatusHealthy, StatusHealthy), StatusHealthy},
+		{"all unknown", makeWorkflow(StatusUnknown, StatusUnknown, StatusUnknown), StatusUnknown},
+		{"source error wins over syncing target", makeWorkflow(StatusError, StatusSyncing, StatusHealthy), StatusError},
+		{"artifact error wins over syncing target", makeWorkflow(StatusHealthy, StatusError, StatusSyncing), StatusError},
+		{"target error wins over healthy phases", makeWorkflow(StatusHealthy, StatusHealthy, StatusError), StatusError},
+		{"syncing beats paused and healthy", makeWorkflow(StatusPaused, StatusSyncing, StatusHealthy), StatusSyncing},
+		{"paused beats healthy", makeWorkflow(StatusHealthy, StatusPaused, StatusHealthy), StatusPaused},
+		{"healthy beats unknown", makeWorkflow(StatusUnknown, StatusHealthy, StatusUnknown), StatusHealthy},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			assert.Equal(t, tc.want, EffectiveStatus(tc.w))
+		})
+	}
+}
+
+func TestCountByStatus(t *testing.T) {
+	t.Parallel()
+
+	makeW := func(s Status) Workflow {
+		return Workflow{
+			Status: WorkflowStatusObject{
+				Source:   WorkflowPhaseStatus{Status: s},
+				Artifact: WorkflowPhaseStatus{Status: s},
+				Target:   WorkflowPhaseStatus{Status: s},
+			},
+		}
+	}
+
+	t.Run("empty list", func(t *testing.T) {
+		t.Parallel()
+		assert.Equal(t, StatusSummary{}, CountByStatus(nil))
+	})
+
+	t.Run("single healthy", func(t *testing.T) {
+		t.Parallel()
+		assert.Equal(t, StatusSummary{Healthy: 1}, CountByStatus([]Workflow{makeW(StatusHealthy)}))
+	})
+
+	t.Run("mixed statuses", func(t *testing.T) {
+		t.Parallel()
+		workflows := []Workflow{
+			makeW(StatusHealthy),
+			makeW(StatusError),
+			makeW(StatusSyncing),
+			makeW(StatusPaused),
+			makeW(StatusUnknown),
+			makeW(StatusError),
+		}
+		assert.Equal(t, StatusSummary{Healthy: 1, Error: 2, Syncing: 1, Paused: 1, Unknown: 1}, CountByStatus(workflows))
+	})
+
+	t.Run("error phase overrides healthy target", func(t *testing.T) {
+		t.Parallel()
+		w := Workflow{
+			Status: WorkflowStatusObject{
+				Source:   WorkflowPhaseStatus{Status: StatusError},
+				Artifact: WorkflowPhaseStatus{Status: StatusUnknown},
+				Target:   WorkflowPhaseStatus{Status: StatusHealthy},
+			},
+		}
+		s := CountByStatus([]Workflow{w})
+		assert.Equal(t, 1, s.Error)
+		assert.Equal(t, 0, s.Healthy)
+	})
+}
+
+func TestDeriveEdgeStackTargetState(t *testing.T) {
+	t.Parallel()
+
+	ep := func(id portainer.EndpointID, typ portainer.EdgeStackStatusType) portainer.EdgeStackStatusForEnv {
+		return portainer.EdgeStackStatusForEnv{
+			EndpointID: id,
+			Status:     []portainer.EdgeStackDeploymentStatus{{Type: typ}},
+		}
+	}
+
+	cases := []struct {
+		name     string
+		statuses []portainer.EdgeStackStatusForEnv
+		want     Status
+	}{
+		{"empty", nil, StatusUnknown},
+		{"all per-env status slices empty", []portainer.EdgeStackStatusForEnv{{EndpointID: 1}}, StatusUnknown},
+		{"running: healthy", []portainer.EdgeStackStatusForEnv{ep(1, portainer.EdgeStackStatusRunning)}, StatusHealthy},
+		{"deploying: syncing", []portainer.EdgeStackStatusForEnv{ep(1, portainer.EdgeStackStatusDeploying)}, StatusSyncing},
+		{"paused deploying: paused", []portainer.EdgeStackStatusForEnv{ep(1, portainer.EdgeStackStatusPausedDeploying)}, StatusPaused},
+		{"error short-circuits", []portainer.EdgeStackStatusForEnv{ep(1, portainer.EdgeStackStatusError)}, StatusError},
+		{
+			"error + running gives error (short-circuit, order matters)",
+			[]portainer.EdgeStackStatusForEnv{
+				ep(1, portainer.EdgeStackStatusError),
+				ep(2, portainer.EdgeStackStatusRunning),
+			},
+			StatusError,
+		},
+		{
+			"syncing beats paused",
+			[]portainer.EdgeStackStatusForEnv{
+				ep(1, portainer.EdgeStackStatusPausedDeploying),
+				ep(2, portainer.EdgeStackStatusDeploying),
+			},
+			StatusSyncing,
+		},
+		{
+			"healthy does not downgrade syncing",
+			[]portainer.EdgeStackStatusForEnv{
+				ep(1, portainer.EdgeStackStatusDeploying),
+				ep(2, portainer.EdgeStackStatusRunning),
+			},
+			StatusSyncing,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			result := deriveEdgeStackTargetState(tc.statuses)
+			assert.Equal(t, tc.want, result.Status)
+		})
+	}
+}
+
+func TestArtifactPhases(t *testing.T) {
+	t.Parallel()
+
+	src := func(id portainer.SourceID, status portainer.SourceStatus, statusError string) portainer.Source {
+		return portainer.Source{ID: id, Status: status, StatusError: statusError}
+	}
+
+	file := func(sourceID portainer.SourceID, refStatus portainer.SourceStatus, refError string, pathStatus portainer.SourceStatus, pathError string) portainer.ArtifactFile {
+		return portainer.ArtifactFile{SourceID: sourceID, RefStatus: refStatus, RefError: refError, PathStatus: pathStatus, PathError: pathError}
+	}
+
+	cases := []struct {
+		name         string
+		files        []portainer.ArtifactFile
+		sourceMap    map[portainer.SourceID]portainer.Source
+		wantSource   WorkflowPhaseStatus
+		wantArtifact WorkflowPhaseStatus
+	}{
+		{
+			name:         "no files",
+			files:        nil,
+			sourceMap:    map[portainer.SourceID]portainer.Source{},
+			wantSource:   WorkflowPhaseStatus{Status: StatusUnknown},
+			wantArtifact: WorkflowPhaseStatus{Status: StatusUnknown},
+		},
+		{
+			name:  "file's source missing from sourceMap is skipped",
+			files: []portainer.ArtifactFile{file(1, portainer.SourceStatusError, "unreachable", portainer.SourceStatusError, "not found")},
+			sourceMap: map[portainer.SourceID]portainer.Source{
+				2: src(2, portainer.SourceStatusHealthy, ""),
+			},
+			wantSource:   WorkflowPhaseStatus{Status: StatusUnknown},
+			wantArtifact: WorkflowPhaseStatus{Status: StatusUnknown},
+		},
+		{
+			name:  "all healthy",
+			files: []portainer.ArtifactFile{file(1, portainer.SourceStatusHealthy, "", portainer.SourceStatusHealthy, "")},
+			sourceMap: map[portainer.SourceID]portainer.Source{
+				1: src(1, portainer.SourceStatusHealthy, ""),
+			},
+			wantSource:   WorkflowPhaseStatus{Status: StatusHealthy},
+			wantArtifact: WorkflowPhaseStatus{Status: StatusHealthy},
+		},
+		{
+			name:  "source-level error dominates a healthy ref",
+			files: []portainer.ArtifactFile{file(1, portainer.SourceStatusHealthy, "", portainer.SourceStatusHealthy, "")},
+			sourceMap: map[portainer.SourceID]portainer.Source{
+				1: src(1, portainer.SourceStatusError, "connection refused"),
+			},
+			wantSource:   WorkflowPhaseStatus{Status: StatusError, Error: "connection refused"},
+			wantArtifact: WorkflowPhaseStatus{Status: StatusHealthy},
+		},
+		{
+			name:  "file-level ref error dominates a healthy source",
+			files: []portainer.ArtifactFile{file(1, portainer.SourceStatusError, "ref not found", portainer.SourceStatusHealthy, "")},
+			sourceMap: map[portainer.SourceID]portainer.Source{
+				1: src(1, portainer.SourceStatusHealthy, ""),
+			},
+			wantSource:   WorkflowPhaseStatus{Status: StatusError, Error: "ref not found"},
+			wantArtifact: WorkflowPhaseStatus{Status: StatusHealthy},
+		},
+		{
+			name:  "path error is independent of a broken source",
+			files: []portainer.ArtifactFile{file(1, portainer.SourceStatusHealthy, "", portainer.SourceStatusHealthy, "")},
+			sourceMap: map[portainer.SourceID]portainer.Source{
+				1: src(1, portainer.SourceStatusError, "connection refused"),
+			},
+			wantSource:   WorkflowPhaseStatus{Status: StatusError, Error: "connection refused"},
+			wantArtifact: WorkflowPhaseStatus{Status: StatusHealthy},
+		},
+		{
+			name:  "path error surfaces on its own",
+			files: []portainer.ArtifactFile{file(1, portainer.SourceStatusHealthy, "", portainer.SourceStatusError, "path not found")},
+			sourceMap: map[portainer.SourceID]portainer.Source{
+				1: src(1, portainer.SourceStatusHealthy, ""),
+			},
+			wantSource:   WorkflowPhaseStatus{Status: StatusHealthy},
+			wantArtifact: WorkflowPhaseStatus{Status: StatusError, Error: "path not found"},
+		},
+		{
+			name:  "tie between source and ref error keeps the source-level message",
+			files: []portainer.ArtifactFile{file(1, portainer.SourceStatusError, "ref not found", portainer.SourceStatusHealthy, "")},
+			sourceMap: map[portainer.SourceID]portainer.Source{
+				1: src(1, portainer.SourceStatusError, "connection refused"),
+			},
+			wantSource:   WorkflowPhaseStatus{Status: StatusError, Error: "connection refused"},
+			wantArtifact: WorkflowPhaseStatus{Status: StatusHealthy},
+		},
+		{
+			name: "worst artifact phase wins across multiple files",
+			files: []portainer.ArtifactFile{
+				file(1, portainer.SourceStatusHealthy, "", portainer.SourceStatusHealthy, ""),
+				file(2, portainer.SourceStatusHealthy, "", portainer.SourceStatusError, "path not found"),
+			},
+			sourceMap: map[portainer.SourceID]portainer.Source{
+				1: src(1, portainer.SourceStatusHealthy, ""),
+				2: src(2, portainer.SourceStatusHealthy, ""),
+			},
+			wantSource:   WorkflowPhaseStatus{Status: StatusHealthy},
+			wantArtifact: WorkflowPhaseStatus{Status: StatusError, Error: "path not found"},
+		},
+		{
+			name: "worst source phase wins across multiple files",
+			files: []portainer.ArtifactFile{
+				file(1, portainer.SourceStatusHealthy, "", portainer.SourceStatusHealthy, ""),
+				file(2, portainer.SourceStatusError, "ref not found", portainer.SourceStatusHealthy, ""),
+			},
+			sourceMap: map[portainer.SourceID]portainer.Source{
+				1: src(1, portainer.SourceStatusHealthy, ""),
+				2: src(2, portainer.SourceStatusHealthy, ""),
+			},
+			wantSource:   WorkflowPhaseStatus{Status: StatusError, Error: "ref not found"},
+			wantArtifact: WorkflowPhaseStatus{Status: StatusHealthy},
+		},
+		{
+			name: "mixed accessible and inaccessible files: only the accessible one drives the result",
+			files: []portainer.ArtifactFile{
+				file(1, portainer.SourceStatusError, "should be ignored", portainer.SourceStatusError, "should be ignored"),
+				file(2, portainer.SourceStatusHealthy, "", portainer.SourceStatusHealthy, ""),
+			},
+			sourceMap: map[portainer.SourceID]portainer.Source{
+				2: src(2, portainer.SourceStatusHealthy, ""),
+			},
+			wantSource:   WorkflowPhaseStatus{Status: StatusHealthy},
+			wantArtifact: WorkflowPhaseStatus{Status: StatusHealthy},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			gotSource, gotArtifact := ArtifactPhases(tc.files, tc.sourceMap)
+			assert.Equal(t, tc.wantSource, gotSource)
+			assert.Equal(t, tc.wantArtifact, gotArtifact)
+		})
+	}
+}
diff --git a/api/gitops/workflows/types.go b/api/gitops/workflows/types.go
new file mode 100644
index 0000000..907d763
--- /dev/null
+++ b/api/gitops/workflows/types.go
@@ -0,0 +1,124 @@
+package workflows
+
+import (
+	"fmt"
+
+	portainer "github.com/portainer/portainer/api"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	"github.com/portainer/portainer/api/gitops/sources"
+)
+
+type Status string
+
+const (
+	StatusHealthy Status = "healthy"
+	StatusSyncing Status = "syncing"
+	StatusError   Status = "error"
+	StatusPaused  Status = "paused"
+	StatusUnknown Status = "unknown"
+)
+
+type Type string
+
+const (
+	TypeStack     Type = "stack"
+	TypeEdgeStack Type = "edgeStack"
+)
+
+type DeploymentPlatform string
+
+const (
+	DeploymentPlatformDockerStandalone DeploymentPlatform = "dockerStandalone"
+	DeploymentPlatformDockerSwarm      DeploymentPlatform = "dockerSwarm"
+	DeploymentPlatformKubernetes       DeploymentPlatform = "kubernetes"
+)
+
+func ParseStatus(s string) (Status, error) {
+	switch Status(s) {
+	case StatusHealthy, StatusSyncing, StatusError, StatusPaused, StatusUnknown:
+		return Status(s), nil
+	}
+	return "", fmt.Errorf("unknown status %q", s)
+}
+
+func ParseType(s string) (Type, error) {
+	switch Type(s) {
+	case TypeStack, TypeEdgeStack:
+		return Type(s), nil
+	}
+	return "", fmt.Errorf("unknown type %q", s)
+}
+
+func ParsePlatform(s string) (DeploymentPlatform, error) {
+	switch DeploymentPlatform(s) {
+	case DeploymentPlatformDockerStandalone, DeploymentPlatformDockerSwarm, DeploymentPlatformKubernetes:
+		return DeploymentPlatform(s), nil
+	}
+	return "", fmt.Errorf("unknown platform %q", s)
+}
+
+type Target struct {
+	EndpointID          portainer.EndpointID             `json:"endpointId,omitempty"`
+	Namespace           string                           `json:"namespace,omitempty"`
+	EdgeGroupIDs        []portainer.EdgeGroupID          `json:"edgeGroupIds,omitempty"`
+	GroupStatus         map[portainer.EdgeGroupID]Status `json:"groupStatus,omitempty"`
+	ResolvedEndpointIDs []portainer.EndpointID           `json:"resolvedEndpointIds,omitempty"`
+}
+
+// WorkflowPhaseStatus represents the status of one phase (source, artifact, or target) of a workflow.
+// All three phases share the Status type; source and artifact only ever emit healthy, error, or unknown.
+type WorkflowPhaseStatus struct {
+	Status Status `json:"status"`
+	Error  string `json:"error,omitempty"`
+}
+
+// WorkflowStatusObject is the structured status reported for a workflow.
+type WorkflowStatusObject struct {
+	Source   WorkflowPhaseStatus `json:"source"`
+	Artifact WorkflowPhaseStatus `json:"artifact"`
+	Target   WorkflowPhaseStatus `json:"target"`
+}
+
+type Workflow struct {
+	ID           portainer.WorkflowID          `json:"id" validate:"required"`
+	Name         string                        `json:"name" validate:"required"`
+	Type         Type                          `json:"type" validate:"required"`
+	Platform     DeploymentPlatform            `json:"platform" validate:"required"`
+	Status       WorkflowStatusObject          `json:"status" validate:"required"`
+	SourceID     portainer.SourceID            `json:"sourceId,omitempty"`
+	GitConfig    *gittypes.RepoConfig          `json:"gitConfig,omitempty"`
+	AutoUpdate   *portainer.AutoUpdateSettings `json:"autoUpdate,omitempty"`
+	Target       Target                        `json:"target" validate:"required"`
+	CreationDate int64                         `json:"creationDate"`
+	LastSyncDate int64                         `json:"lastSyncDate"`
+}
+
+type StatusSummary struct {
+	Healthy int `json:"healthy"`
+	Syncing int `json:"syncing"`
+	Error   int `json:"error"`
+	Paused  int `json:"paused"`
+	Unknown int `json:"unknown"`
+}
+
+// ArtifactDetail describes one Artifact's backing Stack or EdgeStack.
+type ArtifactDetail struct {
+	ID           int                           `json:"id" validate:"required"`
+	Type         Type                          `json:"type" validate:"required"`
+	Name         string                        `json:"name" validate:"required"`
+	Platform     DeploymentPlatform            `json:"platform"`
+	AutoUpdate   *portainer.AutoUpdateSettings `json:"autoUpdate,omitempty"`
+	Target       Target                        `json:"target"`
+	Status       WorkflowStatusObject          `json:"status"`
+	Files        []ArtifactFileDetail          `json:"files"`
+	CreationDate int64                         `json:"creationDate"`
+	LastSyncDate int64                         `json:"lastSyncDate"`
+}
+
+// ArtifactFileDetail describe the representation of portainer.ArtifactFile used in API responses.
+type ArtifactFileDetail struct {
+	portainer.ArtifactFile
+
+	RefStatus  sources.Status `json:"refStatus,omitempty"`
+	PathStatus sources.Status `json:"pathStatus,omitempty"`
+}
diff --git a/api/gitops/workflows/types_test.go b/api/gitops/workflows/types_test.go
new file mode 100644
index 0000000..27fc3c3
--- /dev/null
+++ b/api/gitops/workflows/types_test.go
@@ -0,0 +1,65 @@
+package workflows
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseStatus(t *testing.T) {
+	t.Parallel()
+
+	for _, valid := range []string{"healthy", "error", "syncing", "paused", "unknown"} {
+		t.Run(valid, func(t *testing.T) {
+			t.Parallel()
+			s, err := ParseStatus(valid)
+			require.NoError(t, err)
+			assert.Equal(t, Status(valid), s)
+		})
+	}
+
+	t.Run("invalid returns error", func(t *testing.T) {
+		t.Parallel()
+		_, err := ParseStatus("garbage")
+		assert.Error(t, err)
+	})
+}
+
+func TestParseType(t *testing.T) {
+	t.Parallel()
+
+	for _, valid := range []string{"stack", "edgeStack"} {
+		t.Run(valid, func(t *testing.T) {
+			t.Parallel()
+			tp, err := ParseType(valid)
+			require.NoError(t, err)
+			assert.Equal(t, Type(valid), tp)
+		})
+	}
+
+	t.Run("invalid returns error", func(t *testing.T) {
+		t.Parallel()
+		_, err := ParseType("garbage")
+		assert.Error(t, err)
+	})
+}
+
+func TestParsePlatform(t *testing.T) {
+	t.Parallel()
+
+	for _, valid := range []string{"dockerStandalone", "dockerSwarm", "kubernetes"} {
+		t.Run(valid, func(t *testing.T) {
+			t.Parallel()
+			p, err := ParsePlatform(valid)
+			require.NoError(t, err)
+			assert.Equal(t, DeploymentPlatform(valid), p)
+		})
+	}
+
+	t.Run("invalid returns error", func(t *testing.T) {
+		t.Parallel()
+		_, err := ParsePlatform("garbage")
+		assert.Error(t, err)
+	})
+}
diff --git a/api/http/client/client.go b/api/http/client/client.go
new file mode 100644
index 0000000..8b65777
--- /dev/null
+++ b/api/http/client/client.go
@@ -0,0 +1,160 @@
+package client
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/crypto"
+	"github.com/portainer/portainer/pkg/libhttp/ssrf"
+
+	"github.com/rs/zerolog/log"
+	"github.com/segmentio/encoding/json"
+)
+
+var errInvalidResponseStatus = errors.New("invalid response status (expecting 200)")
+
+const defaultHTTPTimeout = 5
+
+// HTTPClient represents a client to send HTTP requests.
+type HTTPClient struct {
+	*http.Client
+}
+
+// NewHTTPClient is used to build a new HTTPClient.
+func NewHTTPClient() *HTTPClient {
+	return &HTTPClient{
+		&http.Client{
+			Timeout: time.Second * time.Duration(defaultHTTPTimeout),
+		},
+	}
+}
+
+// AzureAuthenticationResponse represents an Azure API authentication response.
+type AzureAuthenticationResponse struct {
+	AccessToken string `json:"access_token"`
+	ExpiresOn   string `json:"expires_on"`
+}
+
+// ExecuteAzureAuthenticationRequest is used to execute an authentication request
+// against the Azure API. It re-uses the same http.Client.
+func (client *HTTPClient) ExecuteAzureAuthenticationRequest(credentials *portainer.AzureCredentials) (*AzureAuthenticationResponse, error) {
+	loginURL := fmt.Sprintf("https://login.microsoftonline.com/%s/oauth2/token", credentials.TenantID)
+	params := url.Values{
+		"grant_type":    {"client_credentials"},
+		"client_id":     {credentials.ApplicationID},
+		"client_secret": {credentials.AuthenticationKey},
+		"resource":      {"https://management.azure.com/"},
+	}
+
+	resp, err := client.PostForm(loginURL, params)
+	if err != nil {
+		return nil, err
+	}
+	defer func() {
+		if err := resp.Body.Close(); err != nil {
+			log.Warn().Err(err).Msg("failed to close response body")
+		}
+	}()
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, errors.New("invalid Azure credentials")
+	}
+
+	var token AzureAuthenticationResponse
+	err = json.NewDecoder(resp.Body).Decode(&token)
+	if err != nil {
+		return nil, err
+	}
+
+	return &token, nil
+}
+
+// Get executes a simple HTTP GET to the specified URL and returns
+// the content of the response body. Timeout can be specified via the timeout parameter,
+// will default to defaultHTTPTimeout if set to 0.
+func Get(url string, timeout int) ([]byte, error) {
+	if timeout == 0 {
+		timeout = defaultHTTPTimeout
+	}
+
+	client := &http.Client{
+		Timeout: time.Second * time.Duration(timeout),
+	}
+
+	response, err := client.Get(url)
+	if err != nil {
+		return nil, err
+	}
+	defer func() {
+		if err := response.Body.Close(); err != nil {
+			log.Warn().Err(err).Msg("failed to close response body")
+		}
+	}()
+
+	if response.StatusCode != http.StatusOK {
+		log.Error().Int("status_code", response.StatusCode).Msg("unexpected status code")
+
+		return nil, errInvalidResponseStatus
+	}
+
+	body, err := io.ReadAll(response.Body)
+	if err != nil {
+		return nil, err
+	}
+
+	return body, nil
+}
+
+// ExecutePingOperation will send a SystemPing operation HTTP request to a Docker environment(endpoint)
+// using the specified host and optional TLS configuration.
+// It uses a new Http.Client for each operation.
+func ExecutePingOperation(host string, tlsConfiguration portainer.TLSConfiguration) (bool, error) {
+	scheme := "http"
+
+	var transport *http.Transport
+	if tlsConfiguration.TLS {
+		tlsConfig, err := crypto.CreateTLSConfigurationFromDisk(tlsConfiguration)
+		if err != nil {
+			return false, err
+		}
+
+		scheme = "https"
+		transport = ssrf.NewTransport(tlsConfig)
+	} else {
+		transport = ssrf.NewTransport(nil)
+	}
+
+	client := &http.Client{
+		Timeout:   3 * time.Second,
+		Transport: transport,
+	}
+
+	target := strings.Replace(host, "tcp://", scheme+"://", 1)
+
+	return pingOperation(client, target)
+}
+
+func pingOperation(client *http.Client, target string) (bool, error) {
+	pingOperationURL := target + "/_ping"
+
+	resp, err := client.Get(pingOperationURL)
+	if err != nil {
+		return false, err
+	}
+
+	_, _ = io.Copy(io.Discard, resp.Body)
+
+	if err := resp.Body.Close(); err != nil {
+		log.Warn().Err(err).Msg("failed to close response body")
+	}
+
+	agentOnDockerEnvironment := resp.Header.Get(portainer.PortainerAgentHeader) != ""
+
+	return agentOnDockerEnvironment, nil
+}
diff --git a/api/http/client/client_test.go b/api/http/client/client_test.go
new file mode 100644
index 0000000..be328e4
--- /dev/null
+++ b/api/http/client/client_test.go
@@ -0,0 +1,49 @@
+package client
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/pkg/fips"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestExecutePingOperationFailure(t *testing.T) {
+	t.Parallel()
+	fips.InitFIPS(false)
+
+	host := "http://localhost:1"
+	config := portainer.TLSConfiguration{
+		TLS:           true,
+		TLSSkipVerify: true,
+	}
+
+	// Invalid host
+	ok, err := ExecutePingOperation(host, config)
+	require.False(t, ok)
+	require.Error(t, err)
+
+	// Invalid TLS configuration
+	config.TLSCertPath = "/invalid/path/to/cert"
+	config.TLSKeyPath = "/invalid/path/to/key"
+
+	ok, err = ExecutePingOperation(host, config)
+	require.False(t, ok)
+	require.Error(t, err)
+
+}
+
+func TestPingOperation(t *testing.T) {
+	t.Parallel()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Add(portainer.PortainerAgentHeader, "1")
+	}))
+	defer srv.Close()
+
+	agentOnDockerEnv, err := pingOperation(http.DefaultClient, srv.URL)
+	require.NoError(t, err)
+	require.True(t, agentOnDockerEnv)
+}
diff --git a/api/http/csrf/csrf.go b/api/http/csrf/csrf.go
new file mode 100644
index 0000000..d71093b
--- /dev/null
+++ b/api/http/csrf/csrf.go
@@ -0,0 +1,48 @@
+package csrf
+
+import (
+	"fmt"
+	"net/http"
+	"os"
+
+	"github.com/rs/zerolog/log"
+)
+
+func WithProtect(handler http.Handler, trustedOrigins []string) (http.Handler, error) {
+	// DOCKER_EXTENSION=1 is set in build/docker-extension/docker-compose.yml
+	isDockerDesktopExtension := false
+	if val, ok := os.LookupEnv("DOCKER_EXTENSION"); ok && val == "1" {
+		isDockerDesktopExtension = true
+	}
+
+	cop := http.NewCrossOriginProtection()
+	for _, origin := range trustedOrigins {
+		if err := cop.AddTrustedOrigin(origin); err != nil {
+			return nil, fmt.Errorf("failed to add trusted origin %q: %w", origin, err)
+		}
+	}
+
+	cop.SetDenyHandler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		log.Error().Err(cop.Check(r)).
+			Str("request_url", r.URL.String()).
+			Str("host", r.Host).
+			Str("origin", r.Header.Get("Origin")).
+			Str("sec_fetch_site", r.Header.Get("Sec-Fetch-Site")).
+			Strs("trusted_origins", trustedOrigins).
+			Msg("CSRF check failed")
+
+		http.Error(w, http.StatusText(http.StatusForbidden), http.StatusForbidden)
+	}))
+
+	protected := cop.Handler(handler)
+
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if isDockerDesktopExtension {
+			handler.ServeHTTP(w, r)
+
+			return
+		}
+
+		protected.ServeHTTP(w, r)
+	}), nil
+}
diff --git a/api/http/csrf/csrf_test.go b/api/http/csrf/csrf_test.go
new file mode 100644
index 0000000..34d1d9c
--- /dev/null
+++ b/api/http/csrf/csrf_test.go
@@ -0,0 +1,170 @@
+package csrf
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+
+	"github.com/stretchr/testify/require"
+)
+
+var okHandler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	w.WriteHeader(http.StatusOK)
+})
+
+func TestWithProtect_invalidTrustedOriginReturnsError(t *testing.T) {
+	t.Parallel()
+
+	_, err := WithProtect(okHandler, []string{"not-a-valid-origin"})
+	require.Error(t, err)
+}
+
+func TestWithProtect_safeMethodsAlwaysAllowed(t *testing.T) {
+	t.Parallel()
+
+	handler, err := WithProtect(okHandler, nil)
+	require.NoError(t, err)
+
+	for _, method := range []string{http.MethodGet, http.MethodHead, http.MethodOptions} {
+		req := httptest.NewRequest(method, "/", nil)
+		req.Header.Set("Sec-Fetch-Site", "cross-site")
+
+		rr := httptest.NewRecorder()
+		handler.ServeHTTP(rr, req)
+		require.Equal(t, http.StatusOK, rr.Code, "method %s should be allowed", method)
+	}
+}
+
+func TestWithProtect_allowsPostWithNoOriginHeaders(t *testing.T) {
+	t.Parallel()
+
+	handler, err := WithProtect(okHandler, nil)
+	require.NoError(t, err)
+
+	req := httptest.NewRequest(http.MethodPost, "/", nil)
+
+	rr := httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+	require.Equal(t, http.StatusOK, rr.Code)
+}
+
+func TestWithProtect_allowsPostWithSameOriginSecFetchSite(t *testing.T) {
+	t.Parallel()
+
+	handler, err := WithProtect(okHandler, nil)
+	require.NoError(t, err)
+
+	req := httptest.NewRequest(http.MethodPost, "/", nil)
+	req.Header.Set("Sec-Fetch-Site", "same-origin")
+
+	rr := httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+	require.Equal(t, http.StatusOK, rr.Code)
+}
+
+func TestWithProtect_allowsPostWithNoneSecFetchSite(t *testing.T) {
+	t.Parallel()
+
+	handler, err := WithProtect(okHandler, nil)
+	require.NoError(t, err)
+
+	req := httptest.NewRequest(http.MethodPost, "/", nil)
+	req.Header.Set("Sec-Fetch-Site", "none")
+
+	rr := httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+	require.Equal(t, http.StatusOK, rr.Code)
+}
+
+func TestWithProtect_blocksCrossSiteSecFetchSite(t *testing.T) {
+	t.Parallel()
+
+	handler, err := WithProtect(okHandler, nil)
+	require.NoError(t, err)
+
+	req := httptest.NewRequest(http.MethodPost, "/", nil)
+	req.Header.Set("Sec-Fetch-Site", "cross-site")
+	req.AddCookie(&http.Cookie{Name: portainer.AuthCookieKey, Value: "some-token"})
+
+	rr := httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+	require.Equal(t, http.StatusForbidden, rr.Code)
+}
+
+func TestWithProtect_blocksSameSiteSecFetchSite(t *testing.T) {
+	t.Parallel()
+
+	handler, err := WithProtect(okHandler, nil)
+	require.NoError(t, err)
+
+	req := httptest.NewRequest(http.MethodPost, "/", nil)
+	req.Header.Set("Sec-Fetch-Site", "same-site")
+	req.AddCookie(&http.Cookie{Name: portainer.AuthCookieKey, Value: "some-token"})
+
+	rr := httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+	require.Equal(t, http.StatusForbidden, rr.Code)
+}
+
+func TestWithProtect_allowsPostWithMatchingOriginHeader(t *testing.T) {
+	t.Parallel()
+
+	handler, err := WithProtect(okHandler, nil)
+	require.NoError(t, err)
+
+	req := httptest.NewRequest(http.MethodPost, "/", nil)
+	req.Host = "portainer.example.com"
+	req.Header.Set("Origin", "https://portainer.example.com")
+
+	rr := httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+	require.Equal(t, http.StatusOK, rr.Code)
+}
+
+func TestWithProtect_blocksMismatchedOriginHeader(t *testing.T) {
+	t.Parallel()
+
+	handler, err := WithProtect(okHandler, nil)
+	require.NoError(t, err)
+
+	req := httptest.NewRequest(http.MethodPost, "/", nil)
+	req.Host = "portainer.example.com"
+	req.Header.Set("Origin", "https://evil.example.com")
+	req.AddCookie(&http.Cookie{Name: portainer.AuthCookieKey, Value: "some-token"})
+
+	rr := httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+	require.Equal(t, http.StatusForbidden, rr.Code)
+}
+
+func TestWithProtect_allowsPostFromTrustedOrigin(t *testing.T) {
+	t.Parallel()
+
+	handler, err := WithProtect(okHandler, []string{"https://trusted.example.com"})
+	require.NoError(t, err)
+
+	req := httptest.NewRequest(http.MethodPost, "/", nil)
+	req.Host = "portainer.example.com"
+	req.Header.Set("Origin", "https://trusted.example.com")
+
+	rr := httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+	require.Equal(t, http.StatusOK, rr.Code)
+}
+
+func TestWithProtect_enforcesCsrfForCookieAuth(t *testing.T) {
+	t.Parallel()
+
+	handler, err := WithProtect(okHandler, nil)
+	require.NoError(t, err)
+
+	req := httptest.NewRequest(http.MethodPost, "/", nil)
+	req.Header.Set("Sec-Fetch-Site", "cross-site")
+	req.AddCookie(&http.Cookie{Name: portainer.AuthCookieKey, Value: "some-token"})
+
+	rr := httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+	require.Equal(t, http.StatusForbidden, rr.Code)
+}
diff --git a/api/http/errors/conflict.go b/api/http/errors/conflict.go
new file mode 100644
index 0000000..cc2d662
--- /dev/null
+++ b/api/http/errors/conflict.go
@@ -0,0 +1,20 @@
+package errors
+
+import "errors"
+
+type ConflictError struct {
+	msg string
+}
+
+func (e *ConflictError) Error() string {
+	return e.msg
+}
+
+func NewConflictError(msg string) *ConflictError {
+	return &ConflictError{msg: msg}
+}
+
+func IsConflictError(err error) bool {
+	var conflictError *ConflictError
+	return errors.As(err, &conflictError)
+}
diff --git a/api/http/errors/errors.go b/api/http/errors/errors.go
new file mode 100644
index 0000000..df896fd
--- /dev/null
+++ b/api/http/errors/errors.go
@@ -0,0 +1,12 @@
+package errors
+
+import "errors"
+
+var (
+	// ErrEndpointAccessDenied Access denied to environment(endpoint) error
+	ErrEndpointAccessDenied = errors.New("Access denied to environment")
+	// ErrUnauthorized Unauthorized error
+	ErrUnauthorized = errors.New("Unauthorized")
+	// ErrResourceAccessDenied Access denied to resource error
+	ErrResourceAccessDenied = errors.New("Access denied to resource")
+)
diff --git a/api/http/errors/invalidpayload.go b/api/http/errors/invalidpayload.go
new file mode 100644
index 0000000..29a6a75
--- /dev/null
+++ b/api/http/errors/invalidpayload.go
@@ -0,0 +1,20 @@
+package errors
+
+import "errors"
+
+type InvalidPayloadError struct {
+	msg string
+}
+
+func (e *InvalidPayloadError) Error() string {
+	return e.msg
+}
+
+func NewInvalidPayloadError(msg string) *InvalidPayloadError {
+	return &InvalidPayloadError{msg: msg}
+}
+
+func IsInvalidPayloadError(err error) bool {
+	var payloadError *InvalidPayloadError
+	return errors.As(err, &payloadError)
+}
diff --git a/api/http/handler/auth/authenticate.go b/api/http/handler/auth/authenticate.go
new file mode 100644
index 0000000..45b99c1
--- /dev/null
+++ b/api/http/handler/auth/authenticate.go
@@ -0,0 +1,242 @@
+package auth
+
+import (
+	"net/http"
+	"strconv"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	httperrors "github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/api/http/middlewares"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/authorization"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+
+	"github.com/pkg/errors"
+	"github.com/rs/zerolog/log"
+)
+
+type authenticatePayload struct {
+	// Username
+	Username string `example:"admin" validate:"required"`
+	// Password
+	Password string `example:"mypassword" validate:"required"`
+}
+
+type authenticateResponse struct {
+	// JWT token used to authenticate against the API
+	JWT string `json:"jwt" example:"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyzAB"`
+}
+
+func (payload *authenticatePayload) Validate(r *http.Request) error {
+	if len(payload.Username) == 0 {
+		return errors.New("Invalid username")
+	}
+
+	if len(payload.Password) == 0 {
+		return errors.New("Invalid password")
+	}
+
+	return nil
+}
+
+// @id AuthenticateUser
+// @summary Authenticate
+// @description **Access policy**: public
+// @description Use this environment(endpoint) to authenticate against Portainer using a username and password.
+// @tags auth
+// @accept json
+// @produce json
+// @param body body authenticatePayload true "Credentials used for authentication"
+// @success 200 {object} authenticateResponse "Success"
+// @failure 400 "Invalid request"
+// @failure 422 "Invalid Credentials"
+// @failure 500 "Server error"
+// @router /auth [post]
+func (handler *Handler) authenticate(rw http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	var payload authenticatePayload
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	var settings *portainer.Settings
+	if err := handler.DataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
+		var err error
+		settings, err = tx.Settings().Settings()
+		return err
+	}); err != nil {
+		return httperror.InternalServerError("Unable to retrieve settings from the database", err)
+	}
+
+	user, err := handler.DataStore.User().UserByUsername(payload.Username)
+	if err != nil {
+		if !handler.DataStore.IsErrObjectNotFound(err) {
+			return httperror.InternalServerError("Unable to retrieve a user with the specified username from the database", err)
+		}
+
+		if settings.AuthenticationMethod == portainer.AuthenticationInternal ||
+			settings.AuthenticationMethod == portainer.AuthenticationOAuth ||
+			(settings.AuthenticationMethod == portainer.AuthenticationLDAP && !settings.LDAPSettings.AutoCreateUsers) {
+			// avoid username enumeration timing attack by creating a fake user
+			// https://en.wikipedia.org/wiki/Timing_attack
+			user = &portainer.User{
+				Username: "portainer-fake-username",
+				Password: "$2a$10$abcdefghijklmnopqrstuvwx..ABCDEFGHIJKLMNOPQRSTUVWXYZ12", // fake but valid format bcrypt hash
+			}
+		}
+	}
+
+	// Clear any existing user caches
+	if user != nil {
+		handler.KubernetesClientFactory.ClearUserClientCache(strconv.Itoa(int(user.ID)))
+	}
+
+	if user != nil && isUserInitialAdmin(user) || settings.AuthenticationMethod == portainer.AuthenticationInternal {
+		return handler.authenticateInternal(rw, r, user, payload.Password, settings.ForceSecureCookies)
+	}
+
+	if settings.AuthenticationMethod == portainer.AuthenticationOAuth {
+		return httperror.NewError(http.StatusUnprocessableEntity, "Only initial admin is allowed to login without oauth", httperrors.ErrUnauthorized)
+	}
+
+	if settings.AuthenticationMethod == portainer.AuthenticationLDAP {
+		return handler.authenticateLDAP(rw, r, user, payload.Username, payload.Password, &settings.LDAPSettings, settings.ForceSecureCookies)
+	}
+
+	return httperror.NewError(http.StatusUnprocessableEntity, "Login method is not supported", httperrors.ErrUnauthorized)
+}
+
+func isUserInitialAdmin(user *portainer.User) bool {
+	return int(user.ID) == 1
+}
+
+func (handler *Handler) authenticateInternal(w http.ResponseWriter, r *http.Request, user *portainer.User, password string, forceSecureCookies bool) *httperror.HandlerError {
+	if err := handler.CryptoService.CompareHashAndData(user.Password, password); err != nil {
+		return httperror.NewError(http.StatusUnprocessableEntity, "Invalid credentials", httperrors.ErrUnauthorized)
+	}
+
+	forceChangePassword := !handler.passwordStrengthChecker.Check(password)
+
+	return handler.writeToken(w, r, user, forceChangePassword, forceSecureCookies)
+}
+
+func (handler *Handler) authenticateLDAP(w http.ResponseWriter, r *http.Request, user *portainer.User, username, password string, ldapSettings *portainer.LDAPSettings, forceSecureCookies bool) *httperror.HandlerError {
+	if err := handler.LDAPService.AuthenticateUser(username, password, ldapSettings); err != nil {
+		if errors.Is(err, httperrors.ErrUnauthorized) {
+			return httperror.NewError(http.StatusUnprocessableEntity, "Invalid credentials", httperrors.ErrUnauthorized)
+		}
+
+		return httperror.InternalServerError("Unable to authenticate user against LDAP", err)
+	}
+
+	if user == nil {
+		user = &portainer.User{
+			Username:                username,
+			Role:                    portainer.StandardUserRole,
+			PortainerAuthorizations: authorization.DefaultPortainerAuthorizations(),
+		}
+
+		if err := handler.DataStore.User().Create(user); err != nil {
+			return httperror.InternalServerError("Unable to persist user inside the database", err)
+		}
+	}
+
+	if err := handler.syncUserTeamsWithLDAPGroups(user, ldapSettings); err != nil {
+		log.Warn().Err(err).Msg("unable to automatically sync user teams with ldap")
+	}
+
+	return handler.writeToken(w, r, user, false, forceSecureCookies)
+}
+
+func (handler *Handler) writeToken(w http.ResponseWriter, r *http.Request, user *portainer.User, forceChangePassword bool, forceSecureCookies bool) *httperror.HandlerError {
+	tokenData := composeTokenData(user, forceChangePassword)
+
+	return handler.persistAndWriteToken(w, r, tokenData, forceSecureCookies)
+}
+
+func (handler *Handler) persistAndWriteToken(w http.ResponseWriter, r *http.Request, tokenData *portainer.TokenData, forceSecureCookies bool) *httperror.HandlerError {
+	token, expirationTime, err := handler.JWTService.GenerateToken(tokenData)
+	if err != nil {
+		return httperror.InternalServerError("Unable to generate JWT token", err)
+	}
+
+	security.AddAuthCookie(w, token, expirationTime, handler.isSecureCookie(r, forceSecureCookies))
+
+	return response.JSON(w, &authenticateResponse{JWT: token})
+}
+
+func (handler *Handler) isSecureCookie(r *http.Request, forceSecureCookies bool) bool {
+	return r.TLS != nil || middlewares.IsHTTPSRequest(r) || forceSecureCookies
+}
+
+func (handler *Handler) syncUserTeamsWithLDAPGroups(user *portainer.User, settings *portainer.LDAPSettings) error {
+	// only sync if there is a group base DN
+	if len(settings.GroupSearchSettings) == 0 || len(settings.GroupSearchSettings[0].GroupBaseDN) == 0 {
+		return nil
+	}
+
+	teams, err := handler.DataStore.Team().ReadAll()
+	if err != nil {
+		return err
+	}
+
+	userGroups, err := handler.LDAPService.GetUserGroups(user.Username, settings)
+	if err != nil {
+		return err
+	}
+
+	userMemberships, err := handler.DataStore.TeamMembership().TeamMembershipsByUserID(user.ID)
+	if err != nil {
+		return err
+	}
+
+	for _, team := range teams {
+		if !teamExists(team.Name, userGroups) || teamMembershipExists(team.ID, userMemberships) {
+			continue
+		}
+
+		membership := &portainer.TeamMembership{
+			UserID: user.ID,
+			TeamID: team.ID,
+			Role:   portainer.TeamMember,
+		}
+
+		if err := handler.DataStore.TeamMembership().Create(membership); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func teamExists(teamName string, ldapGroups []string) bool {
+	for _, group := range ldapGroups {
+		if strings.EqualFold(group, teamName) {
+			return true
+		}
+	}
+
+	return false
+}
+
+func teamMembershipExists(teamID portainer.TeamID, memberships []portainer.TeamMembership) bool {
+	for _, membership := range memberships {
+		if membership.TeamID == teamID {
+			return true
+		}
+	}
+
+	return false
+}
+
+func composeTokenData(user *portainer.User, forceChangePassword bool) *portainer.TokenData {
+	return &portainer.TokenData{
+		ID:                  user.ID,
+		Username:            user.Username,
+		Role:                user.Role,
+		ForceChangePassword: forceChangePassword,
+	}
+}
diff --git a/api/http/handler/auth/authenticate_oauth.go b/api/http/handler/auth/authenticate_oauth.go
new file mode 100644
index 0000000..6760fec
--- /dev/null
+++ b/api/http/handler/auth/authenticate_oauth.go
@@ -0,0 +1,122 @@
+package auth
+
+import (
+	"context"
+	"errors"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	httperrors "github.com/portainer/portainer/api/http/errors"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+
+	"github.com/rs/zerolog/log"
+)
+
+type oauthPayload struct {
+	// OAuth code returned from OAuth Provided
+	Code string
+}
+
+func (payload *oauthPayload) Validate(r *http.Request) error {
+	if len(payload.Code) == 0 {
+		return errors.New("Invalid OAuth authorization code")
+	}
+
+	return nil
+}
+
+func (handler *Handler) authenticateOAuth(ctx context.Context, code string, settings *portainer.OAuthSettings) (string, error) {
+	if code == "" {
+		return "", errors.New("Invalid OAuth authorization code")
+	}
+
+	if settings == nil {
+		return "", errors.New("Invalid OAuth configuration")
+	}
+
+	username, err := handler.OAuthService.Authenticate(ctx, code, settings)
+	if err != nil {
+		return "", err
+	}
+
+	return username, nil
+}
+
+// @id ValidateOAuth
+// @summary Authenticate with OAuth
+// @description **Access policy**: public
+// @tags auth
+// @accept json
+// @produce json
+// @param body body oauthPayload true "OAuth Credentials used for authentication"
+// @success 200 {object} authenticateResponse "Success"
+// @failure 400 "Invalid request"
+// @failure 422 "Invalid Credentials"
+// @failure 500 "Server error"
+// @router /auth/oauth/validate [post]
+func (handler *Handler) validateOAuth(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	var payload oauthPayload
+	err := request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	var settings *portainer.Settings
+	if err := handler.DataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
+		var err error
+		settings, err = tx.Settings().Settings()
+		return err
+	}); err != nil {
+		return httperror.InternalServerError("Unable to retrieve settings from the database", err)
+	}
+
+	if settings.AuthenticationMethod != portainer.AuthenticationOAuth {
+		return httperror.Forbidden("OAuth authentication is not enabled", errors.New("OAuth authentication is not enabled"))
+	}
+
+	username, err := handler.authenticateOAuth(r.Context(), payload.Code, &settings.OAuthSettings)
+	if err != nil {
+		log.Debug().Err(err).Msg("OAuth authentication error")
+
+		return httperror.InternalServerError("Unable to authenticate through OAuth", httperrors.ErrUnauthorized)
+	}
+
+	user, err := handler.DataStore.User().UserByUsername(username)
+	if err != nil && !handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.InternalServerError("Unable to retrieve a user with the specified username from the database", err)
+	}
+
+	if user == nil && !settings.OAuthSettings.OAuthAutoCreateUsers {
+		return httperror.Forbidden("Account not created beforehand in Portainer and automatic user provisioning not enabled", httperrors.ErrUnauthorized)
+	}
+
+	if user == nil {
+		user = &portainer.User{
+			Username: username,
+			Role:     portainer.StandardUserRole,
+		}
+
+		err = handler.DataStore.User().Create(user)
+		if err != nil {
+			return httperror.InternalServerError("Unable to persist user inside the database", err)
+		}
+
+		if settings.OAuthSettings.DefaultTeamID != 0 {
+			membership := &portainer.TeamMembership{
+				UserID: user.ID,
+				TeamID: settings.OAuthSettings.DefaultTeamID,
+				Role:   portainer.TeamMember,
+			}
+
+			err = handler.DataStore.TeamMembership().Create(membership)
+			if err != nil {
+				return httperror.InternalServerError("Unable to persist team membership inside the database", err)
+			}
+		}
+
+	}
+
+	return handler.writeToken(w, r, user, false, settings.ForceSecureCookies)
+}
diff --git a/api/http/handler/auth/handler.go b/api/http/handler/auth/handler.go
new file mode 100644
index 0000000..035ceab
--- /dev/null
+++ b/api/http/handler/auth/handler.go
@@ -0,0 +1,49 @@
+package auth
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/proxy"
+	"github.com/portainer/portainer/api/http/proxy/factory/kubernetes"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/kubernetes/cli"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+
+	"github.com/gorilla/mux"
+)
+
+// Handler is the HTTP handler used to handle authentication operations.
+type Handler struct {
+	*mux.Router
+	DataStore                   dataservices.DataStore
+	CryptoService               portainer.CryptoService
+	JWTService                  portainer.JWTService
+	LDAPService                 portainer.LDAPService
+	OAuthService                portainer.OAuthService
+	ProxyManager                *proxy.Manager
+	KubernetesTokenCacheManager *kubernetes.TokenCacheManager
+	KubernetesClientFactory     *cli.ClientFactory
+	passwordStrengthChecker     security.PasswordStrengthChecker
+	bouncer                     security.BouncerService
+}
+
+// NewHandler creates a handler to manage authentication operations.
+func NewHandler(bouncer security.BouncerService, rateLimiter *security.RateLimiter, passwordStrengthChecker security.PasswordStrengthChecker, kubernetesClientFactory *cli.ClientFactory) *Handler {
+	h := &Handler{
+		Router:                  mux.NewRouter(),
+		passwordStrengthChecker: passwordStrengthChecker,
+		bouncer:                 bouncer,
+		KubernetesClientFactory: kubernetesClientFactory,
+	}
+
+	h.Handle("/auth/oauth/validate",
+		rateLimiter.LimitAccess(bouncer.PublicAccess(httperror.LoggerHandler(h.validateOAuth)))).Methods(http.MethodPost)
+	h.Handle("/auth",
+		rateLimiter.LimitAccess(bouncer.PublicAccess(httperror.LoggerHandler(h.authenticate)))).Methods(http.MethodPost)
+	h.Handle("/auth/logout",
+		bouncer.PublicAccess(httperror.LoggerHandler(h.logout))).Methods(http.MethodPost)
+
+	return h
+}
diff --git a/api/http/handler/auth/logout.go b/api/http/handler/auth/logout.go
new file mode 100644
index 0000000..82a5df0
--- /dev/null
+++ b/api/http/handler/auth/logout.go
@@ -0,0 +1,46 @@
+package auth
+
+import (
+	"net/http"
+	"strconv"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/logoutcontext"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id Logout
+// @summary Logout
+// @description **Access policy**: public
+// @security ApiKeyAuth
+// @security jwt
+// @tags auth
+// @success 204 "Success"
+// @failure 500 "Server error"
+// @router /auth/logout [post]
+func (handler *Handler) logout(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	tokenData, _ := handler.bouncer.CookieAuthLookup(r)
+
+	if tokenData != nil {
+		handler.KubernetesTokenCacheManager.RemoveUserFromCache(tokenData.ID)
+		handler.KubernetesClientFactory.ClearUserClientCache(strconv.Itoa(int(tokenData.ID)))
+		logoutcontext.Cancel(tokenData.Token)
+		handler.bouncer.RevokeJWT(tokenData.Token)
+	}
+
+	var settings *portainer.Settings
+	if err := handler.DataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
+		var err error
+		settings, err = tx.Settings().Settings()
+		return err
+	}); err != nil {
+		return httperror.InternalServerError("Unable to retrieve settings from the database", err)
+	}
+
+	security.RemoveAuthCookie(w, handler.isSecureCookie(r, settings.ForceSecureCookies))
+
+	return response.Empty(w)
+}
diff --git a/api/http/handler/auth/logout_test.go b/api/http/handler/auth/logout_test.go
new file mode 100644
index 0000000..318370f
--- /dev/null
+++ b/api/http/handler/auth/logout_test.go
@@ -0,0 +1,109 @@
+package auth
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/http/proxy/factory/kubernetes"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+	"github.com/portainer/portainer/api/kubernetes/cli"
+
+	"github.com/stretchr/testify/require"
+)
+
+type mockBouncer struct {
+	security.BouncerService
+}
+
+func NewMockBouncer() *mockBouncer {
+	return &mockBouncer{BouncerService: testhelpers.NewTestRequestBouncer()}
+}
+
+func (*mockBouncer) CookieAuthLookup(r *http.Request) (*portainer.TokenData, error) {
+	return &portainer.TokenData{
+		ID:       1,
+		Username: "testuser",
+		Token:    "valid-token",
+	}, nil
+}
+
+func TestLogout(t *testing.T) {
+	t.Parallel()
+	h := NewHandler(NewMockBouncer(), nil, nil, nil)
+	h.KubernetesTokenCacheManager = kubernetes.NewTokenCacheManager()
+	_, h.DataStore = datastore.MustNewTestStore(t, true, false)
+	k, err := cli.NewClientFactory(nil, nil, nil, "", "", "")
+	require.NoError(t, err)
+	h.KubernetesClientFactory = k
+
+	rr := httptest.NewRecorder()
+	req := httptest.NewRequest("POST", "/auth/logout", nil)
+
+	h.ServeHTTP(rr, req)
+	require.Equal(t, http.StatusNoContent, rr.Code)
+}
+
+func TestLogoutNoPanic(t *testing.T) {
+	t.Parallel()
+	h := NewHandler(testhelpers.NewTestRequestBouncer(), nil, nil, nil)
+	_, h.DataStore = datastore.MustNewTestStore(t, true, false)
+
+	rr := httptest.NewRecorder()
+	req := httptest.NewRequest("POST", "/auth/logout", nil)
+
+	h.ServeHTTP(rr, req)
+	require.Equal(t, http.StatusNoContent, rr.Code)
+}
+
+func TestLogout_ClearsCookie(t *testing.T) {
+	tests := []struct {
+		name               string
+		forceSecureCookies bool
+		wantSecure         bool
+	}{
+		{name: "clears cookie without secure flag", forceSecureCookies: false, wantSecure: false},
+		{name: "clears cookie with secure flag when ForceSecureCookies is set", forceSecureCookies: true, wantSecure: true},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			h := NewHandler(NewMockBouncer(), nil, nil, nil)
+			h.KubernetesTokenCacheManager = kubernetes.NewTokenCacheManager()
+			_, h.DataStore = datastore.MustNewTestStore(t, true, false)
+			k, err := cli.NewClientFactory(nil, nil, nil, "", "", "")
+			require.NoError(t, err)
+			h.KubernetesClientFactory = k
+
+			err = h.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+				return tx.Settings().UpdateSettings(&portainer.Settings{ForceSecureCookies: tc.forceSecureCookies})
+			})
+			require.NoError(t, err)
+
+			rr := httptest.NewRecorder()
+			req := httptest.NewRequest("POST", "/auth/logout", nil)
+
+			h.ServeHTTP(rr, req)
+			require.Equal(t, http.StatusNoContent, rr.Code)
+
+			cookies := rr.Result().Cookies()
+			var authCookie *http.Cookie
+			for _, c := range cookies {
+				if c.Name == portainer.AuthCookieKey {
+					authCookie = c
+					break
+				}
+			}
+			require.NotNil(t, authCookie, "expected auth cookie to be present in response so the browser can clear it")
+			require.Empty(t, authCookie.Value)
+			require.Equal(t, -1, authCookie.MaxAge)
+			require.Equal(t, tc.wantSecure, authCookie.Secure)
+		})
+	}
+}
diff --git a/api/http/handler/backup/backup.go b/api/http/handler/backup/backup.go
new file mode 100644
index 0000000..b4a89a0
--- /dev/null
+++ b/api/http/handler/backup/backup.go
@@ -0,0 +1,58 @@
+package backup
+
+import (
+	"net/http"
+	"os"
+	"path/filepath"
+
+	operations "github.com/portainer/portainer/api/backup"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/rs/zerolog/log"
+)
+
+type (
+	backupPayload struct {
+		Password string
+	}
+)
+
+func (p *backupPayload) Validate(r *http.Request) error {
+	return nil
+}
+
+// @id Backup
+// @summary Creates an archive with a system data snapshot that could be used to restore the system.
+// @description  Creates an archive with a system data snapshot that could be used to restore the system.
+// @description **Access policy**: admin
+// @tags backup
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @produce octet-stream
+// @param body body backupPayload false "An object contains the password to encrypt the backup with"
+// @success 200 "Success"
+// @failure 400 "Invalid request"
+// @failure 500 "Server error"
+// @router /backup [post]
+func (h *Handler) backup(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	var payload backupPayload
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	archivePath, err := operations.CreateBackupArchive(payload.Password, h.gate, h.dataStore, h.filestorePath)
+	if err != nil {
+		return httperror.InternalServerError("Failed to create backup", err)
+	}
+	defer func() {
+		if err := os.RemoveAll(filepath.Dir(archivePath)); err != nil {
+			log.Warn().Err(err).Msg("failed to remove backup temp folder")
+		}
+	}()
+
+	w.Header().Set("Content-Disposition", "attachment; filename=portainer-backup_"+filepath.Base(archivePath))
+	http.ServeFile(w, r, archivePath)
+
+	return nil
+}
diff --git a/api/http/handler/backup/backup_test.go b/api/http/handler/backup/backup_test.go
new file mode 100644
index 0000000..05b5d7e
--- /dev/null
+++ b/api/http/handler/backup/backup_test.go
@@ -0,0 +1,166 @@
+package backup
+
+import (
+	"bytes"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/portainer/portainer/api/adminmonitor"
+	"github.com/portainer/portainer/api/crypto"
+	"github.com/portainer/portainer/api/filesystem"
+	"github.com/portainer/portainer/api/http/offlinegate"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+	"github.com/portainer/portainer/pkg/fips"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// prepareFilestorePath copies the test assets to an isolated temp dir so
+// parallel tests don't share the same filestorePath and interfere with each other.
+func prepareFilestorePath(t *testing.T) string {
+	t.Helper()
+	tmpDir := t.TempDir()
+	err := os.CopyFS(tmpDir, os.DirFS("./test_assets/handler_test"))
+	require.NoError(t, err)
+
+	return tmpDir
+}
+
+func init() {
+	fips.InitFIPS(false)
+}
+
+func listFiles(t *testing.T, dir string) []string {
+	items := make([]string, 0)
+
+	err := filepath.Walk(dir, func(path string, info os.FileInfo, err error) error {
+		if path == dir {
+			return nil
+		}
+		items = append(items, path)
+
+		return nil
+	})
+	require.NoError(t, err)
+
+	return items
+}
+
+func contains(t *testing.T, list []string, path string) {
+	assert.Contains(t, list, path)
+	copyContent, err := os.ReadFile(path)
+	require.NoError(t, err)
+
+	assert.Equal(t, "content\n", string(copyContent))
+}
+
+func Test_backupHandlerWithoutPassword_shouldCreateATarballArchive(t *testing.T) {
+	t.Parallel()
+	r := httptest.NewRequest(http.MethodPost, "/", strings.NewReader(`{"password":""}`))
+	w := httptest.NewRecorder()
+
+	gate := offlinegate.NewOfflineGate()
+	adminMonitor := adminmonitor.New(time.Hour, nil)
+
+	handlerErr := NewHandler(
+		testhelpers.NewTestRequestBouncer(),
+		testhelpers.NewDatastore(),
+		gate,
+		prepareFilestorePath(t),
+		func() {},
+		adminMonitor).backup(w, r)
+	assert.Nil(t, handlerErr, "Handler should not fail")
+
+	response := w.Result()
+	body, err := io.ReadAll(response.Body)
+	require.NoError(t, err)
+
+	err = response.Body.Close()
+	require.NoError(t, err)
+
+	tmpdir := t.TempDir()
+
+	archivePath := filesystem.JoinPaths(tmpdir, "archive.tar.gz")
+	if err := os.WriteFile(archivePath, body, 0600); err != nil {
+		t.Fatal("Failed to save downloaded .tar.gz archive: ", err)
+	}
+
+	cmd := exec.Command("tar", "-xzf", archivePath, "-C", tmpdir)
+	if err := cmd.Run(); err != nil {
+		t.Fatal("Failed to extract archive: ", err)
+	}
+
+	createdFiles := listFiles(t, tmpdir)
+
+	contains(t, createdFiles, filesystem.JoinPaths(tmpdir, "portainer.key"))
+	contains(t, createdFiles, filesystem.JoinPaths(tmpdir, "portainer.pub"))
+	contains(t, createdFiles, filesystem.JoinPaths(tmpdir, "tls", "file1"))
+	contains(t, createdFiles, filesystem.JoinPaths(tmpdir, "tls", "file2"))
+	assert.NotContains(t, createdFiles, filesystem.JoinPaths(tmpdir, "extra_file"))
+	assert.NotContains(t, createdFiles, filesystem.JoinPaths(tmpdir, "extra_folder", "file1"))
+}
+
+func Test_backupHandlerWithPassword_shouldCreateEncryptedATarballArchive(t *testing.T) {
+	t.Parallel()
+	r := httptest.NewRequest(http.MethodPost, "/", strings.NewReader(`{"password":"secret"}`))
+	w := httptest.NewRecorder()
+
+	gate := offlinegate.NewOfflineGate()
+	adminMonitor := adminmonitor.New(time.Hour, nil)
+
+	handlerErr := NewHandler(
+		testhelpers.NewTestRequestBouncer(),
+		testhelpers.NewDatastore(),
+		gate,
+		prepareFilestorePath(t),
+		func() {},
+		adminMonitor).backup(w, r)
+	assert.Nil(t, handlerErr, "Handler should not fail")
+
+	response := w.Result()
+	body, _ := io.ReadAll(response.Body)
+
+	err := response.Body.Close()
+	require.NoError(t, err)
+
+	tmpdir := t.TempDir()
+
+	dr, err := crypto.AesDecrypt(bytes.NewReader(body), []byte("secret"))
+	if err != nil {
+		t.Fatal("Failed to decrypt archive")
+	}
+
+	archivePath := filesystem.JoinPaths(tmpdir, "archive.tag.gz")
+	archive, err := os.Create(archivePath)
+	require.NoError(t, err)
+
+	defer func() {
+		err := archive.Close()
+		require.NoError(t, err)
+	}()
+
+	_, err = io.Copy(archive, dr)
+	require.NoError(t, err)
+
+	cmd := exec.Command("tar", "-xzf", archivePath, "-C", tmpdir)
+	if err := cmd.Run(); err != nil {
+		t.Fatal("Failed to extract archive: ", err)
+	}
+
+	createdFiles := listFiles(t, tmpdir)
+
+	contains(t, createdFiles, filesystem.JoinPaths(tmpdir, "portainer.key"))
+	contains(t, createdFiles, filesystem.JoinPaths(tmpdir, "portainer.pub"))
+	contains(t, createdFiles, filesystem.JoinPaths(tmpdir, "tls", "file1"))
+	contains(t, createdFiles, filesystem.JoinPaths(tmpdir, "tls", "file2"))
+	assert.NotContains(t, createdFiles, filesystem.JoinPaths(tmpdir, "extra_file"))
+	assert.NotContains(t, createdFiles, filesystem.JoinPaths(tmpdir, "extra_folder", "file1"))
+}
diff --git a/api/http/handler/backup/handler.go b/api/http/handler/backup/handler.go
new file mode 100644
index 0000000..de0f35a
--- /dev/null
+++ b/api/http/handler/backup/handler.go
@@ -0,0 +1,68 @@
+package backup
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/portainer/portainer/api/adminmonitor"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/offlinegate"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+
+	"github.com/gorilla/mux"
+)
+
+// Handler is an http handler responsible for backup and restore portainer state
+type Handler struct {
+	*mux.Router
+	bouncer         security.BouncerService
+	dataStore       dataservices.DataStore
+	gate            *offlinegate.OfflineGate
+	filestorePath   string
+	shutdownTrigger context.CancelFunc
+	adminMonitor    *adminmonitor.Monitor
+	SetupToken      string
+}
+
+// NewHandler creates an new instance of backup handler
+func NewHandler(
+	bouncer security.BouncerService,
+	dataStore dataservices.DataStore,
+	gate *offlinegate.OfflineGate,
+	filestorePath string,
+	shutdownTrigger context.CancelFunc,
+	adminMonitor *adminmonitor.Monitor,
+) *Handler {
+	h := &Handler{
+		Router:          mux.NewRouter(),
+		bouncer:         bouncer,
+		dataStore:       dataStore,
+		gate:            gate,
+		filestorePath:   filestorePath,
+		shutdownTrigger: shutdownTrigger,
+		adminMonitor:    adminMonitor,
+	}
+
+	h.Handle("/backup", bouncer.RestrictedAccess(adminAccess(httperror.LoggerHandler(h.backup)))).Methods(http.MethodPost)
+	h.Handle("/restore", bouncer.PublicAccess(httperror.LoggerHandler(h.restore))).Methods(http.MethodPost)
+
+	return h
+}
+
+func adminAccess(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		securityContext, err := security.RetrieveRestrictedRequestContext(r)
+		if err != nil {
+			httperror.WriteError(w, http.StatusInternalServerError, "Unable to retrieve user info from request context", err)
+			return
+		}
+
+		if !securityContext.IsAdmin {
+			httperror.WriteError(w, http.StatusUnauthorized, "User is not authorized to perform the action", nil)
+			return
+		}
+
+		next.ServeHTTP(w, r)
+	})
+}
diff --git a/api/http/handler/backup/restore.go b/api/http/handler/backup/restore.go
new file mode 100644
index 0000000..f8e5b7f
--- /dev/null
+++ b/api/http/handler/backup/restore.go
@@ -0,0 +1,74 @@
+package backup
+
+import (
+	"bytes"
+	"io"
+	"net/http"
+
+	"github.com/pkg/errors"
+	operations "github.com/portainer/portainer/api/backup"
+	"github.com/portainer/portainer/api/http/security/setuptoken"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+)
+
+type restorePayload struct {
+	FileContent []byte
+	FileName    string
+	Password    string
+}
+
+// @id Restore
+// @summary Triggers a system restore using provided backup file
+// @description Triggers a system restore using provided backup file
+// @description **Access policy**: public (requires the X-Setup-Token header on an uninitialized instance unless --no-setup-token is set)
+// @tags backup
+// @accept json
+// @param X-Setup-Token header string false "Setup token (required when instance is uninitialized and --no-setup-token is not set)"
+// @param restorePayload body restorePayload true "Restore request payload"
+// @success 200 "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Access denied - invalid or missing setup token"
+// @failure 500 "Server error"
+// @router /restore [post]
+func (h *Handler) restore(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	if err := setuptoken.Validate(r, h.SetupToken); err != nil {
+		return err
+	}
+
+	initialized, err := h.adminMonitor.WasInitialized()
+	if err != nil {
+		return httperror.InternalServerError("Failed to check system initialization", err)
+	}
+	if initialized {
+		return httperror.BadRequest("Cannot restore already initialized instance", errors.New("system already initialized"))
+	}
+	h.adminMonitor.Stop()
+
+	var payload restorePayload
+	err = decodeForm(r, &payload)
+	if err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	var archiveReader io.Reader = bytes.NewReader(payload.FileContent)
+	err = operations.RestoreArchive(archiveReader, payload.Password, h.filestorePath, h.gate, h.dataStore, h.shutdownTrigger)
+	if err != nil {
+		return httperror.InternalServerError("Failed to restore the backup", err)
+	}
+
+	return nil
+}
+
+func decodeForm(r *http.Request, p *restorePayload) error {
+	content, name, err := request.RetrieveMultiPartFormFile(r, "file")
+	if err != nil {
+		return err
+	}
+	p.FileContent = content
+	p.FileName = name
+
+	password, _ := request.RetrieveMultiPartFormValue(r, "password", true)
+	p.Password = password
+	return nil
+}
diff --git a/api/http/handler/backup/restore_test.go b/api/http/handler/backup/restore_test.go
new file mode 100644
index 0000000..1953a0c
--- /dev/null
+++ b/api/http/handler/backup/restore_test.go
@@ -0,0 +1,189 @@
+package backup
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"mime/multipart"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/adminmonitor"
+	"github.com/portainer/portainer/api/http/offlinegate"
+	"github.com/portainer/portainer/api/http/security/setuptoken"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_restoreArchive_usingCombinationOfPasswords(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name            string
+		backupPassword  string
+		restorePassword string
+		fails           bool
+	}{
+		{
+			name:            "empty password to both encrypt and decrypt",
+			backupPassword:  "",
+			restorePassword: "",
+			fails:           false,
+		},
+		{
+			name:            "same password to encrypt and decrypt",
+			backupPassword:  "secret",
+			restorePassword: "secret",
+			fails:           false,
+		},
+		{
+			name:            "different passwords to encrypt and decrypt",
+			backupPassword:  "secret",
+			restorePassword: "terces",
+			fails:           true,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			datastore := testhelpers.NewDatastore(
+				testhelpers.WithUsers([]portainer.User{}),
+				testhelpers.WithEdgeJobs([]portainer.EdgeJob{}),
+			)
+			adminMonitor := adminmonitor.New(time.Hour, datastore)
+
+			h := NewHandler(
+				testhelpers.NewTestRequestBouncer(),
+				datastore,
+				offlinegate.NewOfflineGate(),
+				prepareFilestorePath(t),
+				func() {},
+				adminMonitor,
+			)
+
+			// backup
+			archive := backup(t, h, test.backupPassword)
+
+			// restore
+			w := httptest.NewRecorder()
+			r := prepareMultipartRequest(t, test.restorePassword, archive)
+
+			restoreErr := h.restore(w, r)
+			assert.Equal(t, test.fails, restoreErr != nil, "Didn't meet expectation of failing restore handler")
+		})
+	}
+}
+
+func Test_restoreArchive_shouldFailIfSystemWasAlreadyInitialized(t *testing.T) {
+	t.Parallel()
+	admin := portainer.User{
+		Role: portainer.AdministratorRole,
+	}
+	datastore := testhelpers.NewDatastore(
+		testhelpers.WithUsers([]portainer.User{admin}),
+		testhelpers.WithEdgeJobs([]portainer.EdgeJob{}),
+	)
+	adminMonitor := adminmonitor.New(time.Hour, datastore)
+
+	h := NewHandler(testhelpers.NewTestRequestBouncer(),
+		datastore,
+		offlinegate.NewOfflineGate(),
+		prepareFilestorePath(t),
+		func() {},
+		adminMonitor,
+	)
+
+	// backup
+	archive := backup(t, h, "password")
+
+	// restore
+	w := httptest.NewRecorder()
+	r := prepareMultipartRequest(t, "password", archive)
+
+	restoreErr := h.restore(w, r)
+	assert.NotNil(t, restoreErr, "Should fail, because system it already initialized")
+	assert.Equal(t, "Cannot restore already initialized instance", restoreErr.Message, "Should fail with certain error")
+}
+
+func backup(t *testing.T, h *Handler, password string) []byte {
+	r := httptest.NewRequest(http.MethodPost, "/", strings.NewReader(fmt.Sprintf(`{"password":"%s"}`, password)))
+	w := httptest.NewRecorder()
+
+	backupErr := h.backup(w, r)
+	assert.Nil(t, backupErr, "Backup should not fail")
+
+	response := w.Result()
+	archive, err := io.ReadAll(response.Body)
+	require.NoError(t, err)
+
+	err = response.Body.Close()
+	require.NoError(t, err)
+
+	return archive
+}
+
+func Test_restore_setupTokenGate(t *testing.T) {
+	t.Parallel()
+	datastore := testhelpers.NewDatastore(
+		testhelpers.WithUsers([]portainer.User{}),
+		testhelpers.WithEdgeJobs([]portainer.EdgeJob{}),
+	)
+	adminMonitor := adminmonitor.New(time.Hour, datastore)
+	h := NewHandler(
+		testhelpers.NewTestRequestBouncer(),
+		datastore,
+		offlinegate.NewOfflineGate(),
+		prepareFilestorePath(t),
+		func() {},
+		adminMonitor,
+	)
+	h.SetupToken = "secret-token"
+
+	t.Run("403 without token header", func(t *testing.T) {
+		err := h.restore(httptest.NewRecorder(), prepareMultipartRequest(t, "", []byte("x")))
+		require.Error(t, err)
+		assert.Equal(t, http.StatusForbidden, err.StatusCode)
+	})
+
+	t.Run("403 with wrong token", func(t *testing.T) {
+		r := prepareMultipartRequest(t, "", []byte("x"))
+		r.Header.Set(setuptoken.HeaderName, "wrong")
+		err := h.restore(httptest.NewRecorder(), r)
+		require.Error(t, err)
+		assert.Equal(t, http.StatusForbidden, err.StatusCode)
+	})
+
+	t.Run("passes gate with correct token", func(t *testing.T) {
+		archive := backup(t, h, "")
+		r := prepareMultipartRequest(t, "", archive)
+		r.Header.Set(setuptoken.HeaderName, "secret-token")
+		require.Nil(t, h.restore(httptest.NewRecorder(), r))
+	})
+}
+
+func prepareMultipartRequest(t *testing.T, password string, file []byte) *http.Request {
+	var body bytes.Buffer
+
+	w := multipart.NewWriter(&body)
+	err := w.WriteField("password", password)
+	require.NoError(t, err)
+
+	fw, err := w.CreateFormFile("file", "filename")
+	require.NoError(t, err)
+
+	_, err = io.Copy(fw, bytes.NewReader(file))
+	require.NoError(t, err)
+
+	r := httptest.NewRequest(http.MethodPost, "http://localhost/", &body)
+	r.Header.Set("Content-Type", w.FormDataContentType())
+
+	err = w.Close()
+	require.NoError(t, err)
+
+	return r
+}
diff --git a/api/http/handler/backup/test_assets/handler_test/extra_file b/api/http/handler/backup/test_assets/handler_test/extra_file
new file mode 100644
index 0000000..d95f3ad
--- /dev/null
+++ b/api/http/handler/backup/test_assets/handler_test/extra_file
@@ -0,0 +1 @@
+content
diff --git a/api/http/handler/backup/test_assets/handler_test/extra_folder/file1 b/api/http/handler/backup/test_assets/handler_test/extra_folder/file1
new file mode 100644
index 0000000..d95f3ad
--- /dev/null
+++ b/api/http/handler/backup/test_assets/handler_test/extra_folder/file1
@@ -0,0 +1 @@
+content
diff --git a/api/http/handler/backup/test_assets/handler_test/portainer.key b/api/http/handler/backup/test_assets/handler_test/portainer.key
new file mode 100644
index 0000000..d95f3ad
--- /dev/null
+++ b/api/http/handler/backup/test_assets/handler_test/portainer.key
@@ -0,0 +1 @@
+content
diff --git a/api/http/handler/backup/test_assets/handler_test/portainer.pub b/api/http/handler/backup/test_assets/handler_test/portainer.pub
new file mode 100644
index 0000000..d95f3ad
--- /dev/null
+++ b/api/http/handler/backup/test_assets/handler_test/portainer.pub
@@ -0,0 +1 @@
+content
diff --git a/api/http/handler/backup/test_assets/handler_test/tls/file1 b/api/http/handler/backup/test_assets/handler_test/tls/file1
new file mode 100644
index 0000000..d95f3ad
--- /dev/null
+++ b/api/http/handler/backup/test_assets/handler_test/tls/file1
@@ -0,0 +1 @@
+content
diff --git a/api/http/handler/backup/test_assets/handler_test/tls/file2 b/api/http/handler/backup/test_assets/handler_test/tls/file2
new file mode 100644
index 0000000..d95f3ad
--- /dev/null
+++ b/api/http/handler/backup/test_assets/handler_test/tls/file2
@@ -0,0 +1 @@
+content
diff --git a/api/http/handler/customtemplates/customtemplate_create.go b/api/http/handler/customtemplates/customtemplate_create.go
new file mode 100644
index 0000000..7b2153d
--- /dev/null
+++ b/api/http/handler/customtemplates/customtemplate_create.go
@@ -0,0 +1,530 @@
+package customtemplates
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"os"
+	"strconv"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/dataservices/source"
+	"github.com/portainer/portainer/api/filesystem"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	"github.com/portainer/portainer/api/gitops/sources"
+	"github.com/portainer/portainer/api/gitops/workflows"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/portainer/portainer/pkg/libhttp/ssrf"
+	"github.com/portainer/portainer/pkg/validate"
+
+	"github.com/rs/zerolog/log"
+	"github.com/segmentio/encoding/json"
+)
+
+func (handler *Handler) customTemplateCreate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	method, err := request.RetrieveRouteVariableValue(r, "method")
+	if err != nil {
+		return httperror.BadRequest("Invalid query parameter: method", err)
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	customTemplate, err := handler.createCustomTemplate(method, r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to create custom template", err)
+	}
+
+	customTemplate.CreatedByUserID = securityContext.UserID
+
+	err = handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return createCustomTemplateTx(tx, customTemplate, securityContext)
+	})
+
+	return response.TxResponse(w, customTemplate, err)
+}
+
+func createCustomTemplateTx(tx dataservices.DataStoreTx, customTemplate *portainer.CustomTemplate, sc *security.RestrictedRequestContext) error {
+	existingTemplates, err := tx.CustomTemplate().ReadAll()
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve custom templates from the database", err)
+	}
+
+	for _, existing := range existingTemplates {
+		if existing.Title == customTemplate.Title {
+			return httperror.InternalServerError("Template name must be unique", errors.New("Template name must be unique"))
+		}
+	}
+
+	if err := tx.CustomTemplate().Create(customTemplate); err != nil {
+		return httperror.InternalServerError("Unable to create custom template", err)
+	}
+
+	resourceControl := authorization.NewPrivateResourceControl(strconv.Itoa(int(customTemplate.ID)), portainer.CustomTemplateResourceControl, sc.UserID)
+
+	if err := tx.ResourceControl().Create(resourceControl); err != nil {
+		return httperror.InternalServerError("Unable to persist resource control inside the database", err)
+	}
+
+	customTemplate.ResourceControl = resourceControl
+
+	userContext := source.NewUserContext(sc.User, sc.UserMemberships)
+	populateGitConfig(tx, userContext, customTemplate)
+
+	return nil
+}
+
+func (handler *Handler) createCustomTemplate(method string, r *http.Request) (*portainer.CustomTemplate, error) {
+	switch method {
+	case "string":
+		return handler.createCustomTemplateFromFileContent(r)
+	case "repository":
+		return handler.createCustomTemplateFromGitRepository(r)
+	case "file":
+		return handler.createCustomTemplateFromFileUpload(r)
+	}
+	return nil, errors.New("Invalid value for query parameter: method. Value must be one of: string, repository or file")
+}
+
+type customTemplateFromFileContentPayload struct {
+	// URL of the template's logo
+	Logo string `example:"https://portainer.io/img/logo.svg"`
+	// Title of the template
+	Title string `example:"Nginx" validate:"required"`
+	// Description of the template
+	Description string `example:"High performance web server" validate:"required"`
+	// A note that will be displayed in the UI. Supports HTML content
+	Note string `example:"This is my <b>custom</b> template"`
+	// Platform associated to the template.
+	// Valid values are: 1 - 'linux', 2 - 'windows'
+	// Required for Docker stacks
+	Platform portainer.CustomTemplatePlatform `example:"1" enums:"1,2"`
+	// Type of created stack:
+	// * 1 - swarm
+	// * 2 - compose
+	// * 3 - kubernetes
+	Type portainer.StackType `example:"1" enums:"1,2,3" validate:"required"`
+	// Content of stack file
+	FileContent string `validate:"required"`
+	// Definitions of variables in the stack file
+	Variables []portainer.CustomTemplateVariableDefinition
+	// EdgeTemplate indicates if this template purpose for Edge Stack
+	EdgeTemplate bool `example:"false"`
+}
+
+func (payload *customTemplateFromFileContentPayload) Validate(r *http.Request) error {
+	if len(payload.Title) == 0 {
+		return errors.New("Invalid custom template title")
+	}
+	if len(payload.Description) == 0 {
+		return errors.New("Invalid custom template description")
+	}
+	if len(payload.FileContent) == 0 {
+		return errors.New("Invalid file content")
+	}
+	if payload.Type != portainer.KubernetesStack && payload.Platform != portainer.CustomTemplatePlatformLinux && payload.Platform != portainer.CustomTemplatePlatformWindows {
+		return errors.New("Invalid custom template platform")
+	}
+	// Platform validation is only for docker related stack (docker standalone and docker swarm)
+	if payload.Type != portainer.KubernetesStack && payload.Type != portainer.DockerSwarmStack && payload.Type != portainer.DockerComposeStack {
+		return errors.New("Invalid custom template type")
+	}
+	if !IsValidNote(payload.Note) {
+		return errors.New("Invalid note. <img> tag is not supported")
+	}
+
+	return ValidateVariablesDefinitions(payload.Variables)
+}
+
+// @id CustomTemplateCreateString
+// @summary Create a custom template
+// @description Create a custom template.
+// @description **Access policy**: authenticated
+// @tags custom_templates
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @produce json
+// @param body body customTemplateFromFileContentPayload true "body"
+// @success 200 {object} portainer.CustomTemplate
+// @failure 400 "Invalid request"
+// @failure 500 "Server error"
+// @router /custom_templates/create/string [post]
+func (handler *Handler) createCustomTemplateFromFileContent(r *http.Request) (*portainer.CustomTemplate, error) {
+	var payload customTemplateFromFileContentPayload
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return nil, err
+	}
+
+	customTemplateID := handler.DataStore.CustomTemplate().GetNextIdentifier()
+	customTemplate := &portainer.CustomTemplate{
+		ID:           portainer.CustomTemplateID(customTemplateID),
+		Title:        payload.Title,
+		EntryPoint:   filesystem.ComposeFileDefaultName,
+		Description:  payload.Description,
+		Note:         payload.Note,
+		Platform:     (payload.Platform),
+		Type:         (payload.Type),
+		Logo:         payload.Logo,
+		Variables:    payload.Variables,
+		EdgeTemplate: payload.EdgeTemplate,
+	}
+
+	templateFolder := strconv.Itoa(customTemplateID)
+	projectPath, err := handler.FileService.StoreCustomTemplateFileFromBytes(templateFolder, customTemplate.EntryPoint, []byte(payload.FileContent))
+	if err != nil {
+		return nil, err
+	}
+	customTemplate.ProjectPath = projectPath
+
+	return customTemplate, nil
+}
+
+type customTemplateFromGitRepositoryPayload struct {
+	// URL of the template's logo
+	Logo string `example:"https://portainer.io/img/logo.svg"`
+	// Title of the template
+	Title string `example:"Nginx" validate:"required"`
+	// Description of the template
+	Description string `example:"High performance web server" validate:"required"`
+	// A note that will be displayed in the UI. Supports HTML content
+	Note string `example:"This is my <b>custom</b> template"`
+	// Platform associated to the template.
+	// Valid values are: 1 - 'linux', 2 - 'windows'
+	// Required for Docker stacks
+	Platform portainer.CustomTemplatePlatform `example:"1" enums:"1,2"`
+	// Type of created stack:
+	// * 1 - swarm
+	// * 2 - compose
+	// * 3 - kubernetes
+	Type portainer.StackType `example:"1" enums:"1,2" validate:"required"`
+
+	// SourceID references an existing Source for git credentials/URL.
+	// When set, the inline URL and authentication fields are ignored.
+	SourceID portainer.SourceID `example:"1" validate:"required"`
+	// Deprecated: use SourceID instead. URL of a Git repository hosting the Stack file.
+	RepositoryURL string `example:"https://github.com/openfaas/faas"`
+	// Reference name of a Git repository hosting the Stack file
+	RepositoryReferenceName string `example:"refs/heads/master"`
+	// Deprecated: use SourceID instead. Use basic authentication to clone the Git repository.
+	RepositoryAuthentication bool `example:"true"`
+	// Deprecated: use SourceID instead. Username used in basic authentication. Required when RepositoryAuthentication is true.
+	RepositoryUsername string `example:"myGitUsername"`
+	// Deprecated: use SourceID instead. Password used in basic authentication. Required when RepositoryAuthentication is true.
+	RepositoryPassword string `example:"myGitPassword"`
+	// Path to the Stack file inside the Git repository
+	ComposeFilePathInRepository string `example:"docker-compose.yml" default:"docker-compose.yml"`
+	// Definitions of variables in the stack file
+	Variables []portainer.CustomTemplateVariableDefinition
+	// Deprecated: use SourceID instead. TLSSkipVerify skips SSL verification when cloning the Git repository.
+	TLSSkipVerify bool `example:"false"`
+	// IsComposeFormat indicates if the Kubernetes template is created from a Docker Compose file
+	IsComposeFormat bool `example:"false"`
+	// EdgeTemplate indicates if this template purpose for Edge Stack
+	EdgeTemplate bool `example:"false"`
+}
+
+func (payload *customTemplateFromGitRepositoryPayload) Validate(r *http.Request) error {
+	if len(payload.Title) == 0 {
+		return errors.New("Invalid custom template title")
+	}
+	if len(payload.Description) == 0 {
+		return errors.New("Invalid custom template description")
+	}
+	if payload.SourceID == 0 {
+		if len(payload.RepositoryURL) == 0 || !validate.IsURL(payload.RepositoryURL) {
+			return errors.New("Invalid repository URL. Must correspond to a valid URL format")
+		}
+		if payload.RepositoryAuthentication && (len(payload.RepositoryUsername) == 0 || len(payload.RepositoryPassword) == 0) {
+			return errors.New("Invalid repository credentials. Username and password must be specified when authentication is enabled")
+		}
+	}
+	if len(payload.ComposeFilePathInRepository) == 0 {
+		payload.ComposeFilePathInRepository = filesystem.ComposeFileDefaultName
+	}
+
+	// Platform validation is only for docker related stack (docker standalone and docker swarm)
+	if payload.Type != portainer.KubernetesStack && payload.Platform != portainer.CustomTemplatePlatformLinux && payload.Platform != portainer.CustomTemplatePlatformWindows {
+		return errors.New("Invalid custom template platform")
+	}
+	if payload.Type != portainer.DockerSwarmStack && payload.Type != portainer.DockerComposeStack && payload.Type != portainer.KubernetesStack {
+		return errors.New("Invalid custom template type")
+	}
+	if !IsValidNote(payload.Note) {
+		return errors.New("Invalid note. <img> tag is not supported")
+	}
+
+	return ValidateVariablesDefinitions(payload.Variables)
+}
+
+// @id CustomTemplateCreateRepository
+// @summary Create a custom template
+// @description Create a custom template.
+// @description **Access policy**: authenticated
+// @tags custom_templates
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @produce json
+// @param body body customTemplateFromGitRepositoryPayload true "Required when using method=repository"
+// @success 200 {object} portainer.CustomTemplate
+// @failure 400 "Invalid request"
+// @failure 500 "Server error"
+// @router /custom_templates/create/repository [post]
+func (handler *Handler) createCustomTemplateFromGitRepository(r *http.Request) (*portainer.CustomTemplate, error) {
+	var payload customTemplateFromGitRepositoryPayload
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return nil, err
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return nil, httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	customTemplateID := handler.DataStore.CustomTemplate().GetNextIdentifier()
+	customTemplate := &portainer.CustomTemplate{
+		ID:              portainer.CustomTemplateID(customTemplateID),
+		Title:           payload.Title,
+		Description:     payload.Description,
+		Note:            payload.Note,
+		Platform:        payload.Platform,
+		Type:            payload.Type,
+		Logo:            payload.Logo,
+		Variables:       payload.Variables,
+		IsComposeFormat: payload.IsComposeFormat,
+		EdgeTemplate:    payload.EdgeTemplate,
+	}
+
+	getProjectPath := func() string {
+		return handler.FileService.GetCustomTemplateProjectPath(strconv.Itoa(customTemplateID))
+	}
+	projectPath := getProjectPath()
+	customTemplate.ProjectPath = projectPath
+
+	userContext := source.NewUserContext(securityContext.User, securityContext.UserMemberships)
+
+	gitConfig, httpErr := sources.ResolveRepoConfig(handler.DataStore, userContext, sources.RepoConfigInput{
+		SourceID:                 payload.SourceID,
+		ReferenceName:            payload.RepositoryReferenceName,
+		ConfigFilePath:           payload.ComposeFilePathInRepository,
+		RepositoryURL:            payload.RepositoryURL,
+		TLSSkipVerify:            payload.TLSSkipVerify,
+		RepositoryAuthentication: payload.RepositoryAuthentication,
+		Username:                 payload.RepositoryUsername,
+		Password:                 payload.RepositoryPassword,
+	})
+	if httpErr != nil {
+		return nil, httpErr
+	}
+
+	if err := ssrf.CheckURL(r.Context(), gitConfig.URL); err != nil {
+		return nil, err
+	}
+
+	commitHash, err := stackutils.DownloadGitRepository(context.TODO(), gitConfig, handler.GitService, getProjectPath)
+	if err != nil {
+		return nil, err
+	}
+
+	sourceID := payload.SourceID
+	if sourceID == 0 {
+		src, err := workflows.FindOrCreateGitSource(handler.DataStore, userContext, &portainer.Source{
+			Name: gittypes.RepoName(gitConfig.URL),
+			Type: portainer.SourceTypeGit,
+			Git: &gittypes.GitSource{
+				URL:            gitConfig.URL,
+				Authentication: gitConfig.Authentication,
+				TLSSkipVerify:  gitConfig.TLSSkipVerify,
+			},
+		})
+		if err != nil {
+			return nil, err
+		}
+		sourceID = src.ID
+	}
+
+	customTemplate.Artifact = &portainer.Artifact{
+		Files: []portainer.ArtifactFile{{
+			SourceID: sourceID,
+			Path:     gitConfig.ConfigFilePath,
+			Ref:      gitConfig.ReferenceName,
+			Hash:     commitHash,
+		}},
+	}
+	isValidProject := true
+	defer func() {
+		if !isValidProject {
+			if err := handler.FileService.RemoveDirectory(projectPath); err != nil {
+				log.Warn().Err(err).Msg("unable to remove git repository directory")
+			}
+		}
+	}()
+
+	entryPath := filesystem.JoinPaths(projectPath, gitConfig.ConfigFilePath)
+
+	exists, err := handler.FileService.FileExists(entryPath)
+	if err != nil || !exists {
+		isValidProject = false
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if !exists {
+		if payload.Type == portainer.KubernetesStack {
+			return nil, errors.New("Invalid Manifest file, ensure that the Manifest file path is correct")
+		}
+		return nil, errors.New("Invalid Compose file, ensure that the Compose file path is correct")
+	}
+
+	info, err := os.Lstat(entryPath)
+	if err != nil {
+		isValidProject = false
+		return nil, err
+	}
+	if info.Mode()&os.ModeSymlink != 0 { // entry is a symlink
+		isValidProject = false
+		return nil, errors.New("Invalid Compose file, ensure that the Compose file is not a symbolic link")
+	}
+
+	return customTemplate, nil
+}
+
+type customTemplateFromFileUploadPayload struct {
+	Logo        string
+	Title       string
+	Description string
+	Note        string
+	Platform    portainer.CustomTemplatePlatform
+	// Type of created stack:
+	// * 1 - swarm
+	// * 2 - compose
+	// * 3 - kubernetes
+	Type        portainer.StackType
+	FileContent []byte
+	// Definitions of variables in the stack file
+	Variables []portainer.CustomTemplateVariableDefinition
+	// EdgeTemplate indicates if this template purpose for Edge Stack
+	EdgeTemplate bool `example:"false"`
+}
+
+func (payload *customTemplateFromFileUploadPayload) Validate(r *http.Request) error {
+	title, err := request.RetrieveMultiPartFormValue(r, "Title", false)
+	if err != nil {
+		return errors.New("Invalid custom template title")
+	}
+	payload.Title = title
+
+	description, err := request.RetrieveMultiPartFormValue(r, "Description", false)
+	if err != nil {
+		return errors.New("Invalid custom template description")
+	}
+	payload.Description = description
+
+	logo, _ := request.RetrieveMultiPartFormValue(r, "Logo", true)
+	payload.Logo = logo
+
+	note, _ := request.RetrieveMultiPartFormValue(r, "Note", true)
+	if !IsValidNote(note) {
+		return errors.New("Invalid note. <img> tag is not supported")
+	}
+	payload.Note = note
+
+	typeNumeral, _ := request.RetrieveNumericMultiPartFormValue(r, "Type", true)
+	templateType := portainer.StackType(typeNumeral)
+	if templateType != portainer.KubernetesStack && templateType != portainer.DockerSwarmStack && templateType != portainer.DockerComposeStack {
+		return errors.New("Invalid custom template type")
+	}
+	payload.Type = templateType
+
+	platform, _ := request.RetrieveNumericMultiPartFormValue(r, "Platform", true)
+	templatePlatform := portainer.CustomTemplatePlatform(platform)
+	// Platform validation is only for docker related stack (docker standalone and docker swarm)
+	if templateType != portainer.KubernetesStack && templatePlatform != portainer.CustomTemplatePlatformLinux && templatePlatform != portainer.CustomTemplatePlatformWindows {
+		return errors.New("Invalid custom template platform")
+	}
+
+	payload.Platform = templatePlatform
+
+	composeFileContent, _, err := request.RetrieveMultiPartFormFile(r, "File")
+	if err != nil {
+		return errors.New("Invalid Compose file. Ensure that the Compose file is uploaded correctly")
+	}
+	payload.FileContent = composeFileContent
+
+	varsString, _ := request.RetrieveMultiPartFormValue(r, "Variables", true)
+	if varsString != "" {
+		if err := json.Unmarshal([]byte(varsString), &payload.Variables); err != nil {
+			return errors.New("Invalid variables. Ensure that the variables are valid JSON")
+		}
+		if err := ValidateVariablesDefinitions(payload.Variables); err != nil {
+			return err
+		}
+	}
+
+	edgeTemplate, _ := request.RetrieveBooleanMultiPartFormValue(r, "EdgeTemplate", true)
+	payload.EdgeTemplate = edgeTemplate
+
+	return nil
+}
+
+// @id CustomTemplateCreateFile
+// @summary Create a custom template
+// @description Create a custom template.
+// @description **Access policy**: authenticated
+// @tags custom_templates
+// @security ApiKeyAuth
+// @security jwt
+// @accept multipart/form-data
+// @produce json
+// @param Title formData string true "Title of the template"
+// @param Description formData string true "Description of the template"
+// @param Note formData string true "A note that will be displayed in the UI. Supports HTML content"
+// @param Platform formData int true "Platform associated to the template (1 - 'linux', 2 - 'windows')" Enums(1,2)
+// @param Type formData int true "Type of created stack (1 - swarm, 2 - compose, 3 - kubernetes)" Enums(1,2,3)
+// @param File formData file true "File"
+// @param Logo formData string false "URL of the template's logo" example:"https://portainer.io/img/logo.svg"
+// @param Variables formData string false "A json array of variables definitions" example:"[{\"label\":\"image\",\"description\":\"Image name\",\"defaultValue\":\"nginx:latest\",\"name\":\"image\"}]"
+// @success 200 {object} portainer.CustomTemplate
+// @failure 400 "Invalid request"
+// @failure 500 "Server error"
+// @router /custom_templates/create/file [post]
+func (handler *Handler) createCustomTemplateFromFileUpload(r *http.Request) (*portainer.CustomTemplate, error) {
+	payload := &customTemplateFromFileUploadPayload{}
+	if err := payload.Validate(r); err != nil {
+		return nil, err
+	}
+
+	customTemplateID := handler.DataStore.CustomTemplate().GetNextIdentifier()
+	customTemplate := &portainer.CustomTemplate{
+		ID:           portainer.CustomTemplateID(customTemplateID),
+		Title:        payload.Title,
+		Description:  payload.Description,
+		Note:         payload.Note,
+		Platform:     payload.Platform,
+		Type:         payload.Type,
+		Logo:         payload.Logo,
+		EntryPoint:   filesystem.ComposeFileDefaultName,
+		Variables:    payload.Variables,
+		EdgeTemplate: payload.EdgeTemplate,
+	}
+
+	templateFolder := strconv.Itoa(customTemplateID)
+	projectPath, err := handler.FileService.StoreCustomTemplateFileFromBytes(templateFolder, customTemplate.EntryPoint, payload.FileContent)
+	if err != nil {
+		return nil, err
+	}
+	customTemplate.ProjectPath = projectPath
+
+	return customTemplate, nil
+}
diff --git a/api/http/handler/customtemplates/customtemplate_create_test.go b/api/http/handler/customtemplates/customtemplate_create_test.go
new file mode 100644
index 0000000..0985385
--- /dev/null
+++ b/api/http/handler/customtemplates/customtemplate_create_test.go
@@ -0,0 +1,1171 @@
+package customtemplates
+
+import (
+	"bytes"
+	"context"
+	"mime/multipart"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/filesystem"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	"github.com/portainer/portainer/api/http/security"
+
+	"github.com/gorilla/mux"
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/require"
+)
+
+func createTemplateRequest(t *testing.T, method string, payload any, userID portainer.UserID, role portainer.UserRole) *http.Request {
+	t.Helper()
+
+	body, err := json.Marshal(payload)
+	require.NoError(t, err)
+
+	r := httptest.NewRequest(http.MethodPost, "/custom_templates/create/"+method, bytes.NewReader(body))
+	r.Header.Set("Content-Type", "application/json")
+	r = mux.SetURLVars(r, map[string]string{"method": method})
+
+	ctx := security.StoreTokenData(r, &portainer.TokenData{ID: userID, Role: role})
+	r = r.WithContext(ctx)
+	ctx = security.StoreRestrictedRequestContext(r, &security.RestrictedRequestContext{
+		UserID:  userID,
+		IsAdmin: role == portainer.AdministratorRole,
+		User:    &portainer.User{ID: userID, Role: role},
+	})
+	return r.WithContext(ctx)
+}
+
+func TestCustomTemplateCreate_FromFileContent_Success(t *testing.T) {
+	t.Parallel()
+
+	handler, ds, _ := newTestHandler(t)
+
+	payload := customTemplateFromFileContentPayload{
+		Title:       "My Template",
+		Description: "A test template",
+		FileContent: "version: '3'\nservices:\n  web:\n    image: nginx",
+		Type:        portainer.DockerComposeStack,
+		Platform:    portainer.CustomTemplatePlatformLinux,
+	}
+
+	r := createTemplateRequest(t, "string", payload, 1, portainer.AdministratorRole)
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateCreate(rr, r)
+	require.Nil(t, herr)
+	require.Equal(t, http.StatusOK, rr.Code)
+
+	var tmpl portainer.CustomTemplate
+	require.NoError(t, json.NewDecoder(rr.Body).Decode(&tmpl))
+	require.Equal(t, "My Template", tmpl.Title)
+	require.Equal(t, "A test template", tmpl.Description)
+	require.Equal(t, portainer.UserID(1), tmpl.CreatedByUserID)
+	require.NotNil(t, tmpl.ResourceControl)
+
+	err := ds.ViewTx(func(tx dataservices.DataStoreTx) error {
+		templates, err := tx.CustomTemplate().ReadAll()
+		require.NoError(t, err)
+		require.Len(t, templates, 1)
+		require.Equal(t, "My Template", templates[0].Title)
+
+		rcs, err := tx.ResourceControl().ReadAll()
+		require.NoError(t, err)
+		require.Len(t, rcs, 1)
+
+		return nil
+	})
+	require.NoError(t, err)
+}
+
+func TestCustomTemplateCreate_FromFileContent_DuplicateTitle(t *testing.T) {
+	t.Parallel()
+
+	handler, ds, _ := newTestHandler(t)
+
+	require.NoError(t, ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.CustomTemplate().Create(&portainer.CustomTemplate{
+			ID:    1,
+			Title: "Existing Template",
+		})
+	}))
+
+	payload := customTemplateFromFileContentPayload{
+		Title:       "Existing Template",
+		Description: "Another template",
+		FileContent: "version: '3'",
+		Type:        portainer.DockerComposeStack,
+		Platform:    portainer.CustomTemplatePlatformLinux,
+	}
+
+	r := createTemplateRequest(t, "string", payload, 1, portainer.AdministratorRole)
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateCreate(rr, r)
+	require.NotNil(t, herr)
+	require.Equal(t, http.StatusInternalServerError, herr.StatusCode)
+}
+
+func TestCustomTemplateCreate_FromFileContent_MissingTitle(t *testing.T) {
+	t.Parallel()
+
+	handler, _, _ := newTestHandler(t)
+
+	payload := customTemplateFromFileContentPayload{
+		Description: "A test template",
+		FileContent: "version: '3'",
+		Type:        portainer.DockerComposeStack,
+		Platform:    portainer.CustomTemplatePlatformLinux,
+	}
+
+	r := createTemplateRequest(t, "string", payload, 1, portainer.AdministratorRole)
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateCreate(rr, r)
+	require.NotNil(t, herr)
+	require.Equal(t, http.StatusInternalServerError, herr.StatusCode)
+}
+
+func TestCustomTemplateCreate_FromFileContent_MissingDescription(t *testing.T) {
+	t.Parallel()
+
+	handler, _, _ := newTestHandler(t)
+
+	payload := customTemplateFromFileContentPayload{
+		Title:       "My Template",
+		FileContent: "version: '3'",
+		Type:        portainer.DockerComposeStack,
+		Platform:    portainer.CustomTemplatePlatformLinux,
+	}
+
+	r := createTemplateRequest(t, "string", payload, 1, portainer.AdministratorRole)
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateCreate(rr, r)
+	require.NotNil(t, herr)
+	require.Equal(t, http.StatusInternalServerError, herr.StatusCode)
+}
+
+func TestCustomTemplateCreate_FromFileContent_MissingFileContent(t *testing.T) {
+	t.Parallel()
+
+	handler, _, _ := newTestHandler(t)
+
+	payload := customTemplateFromFileContentPayload{
+		Title:       "My Template",
+		Description: "A test template",
+		Type:        portainer.DockerComposeStack,
+		Platform:    portainer.CustomTemplatePlatformLinux,
+	}
+
+	r := createTemplateRequest(t, "string", payload, 1, portainer.AdministratorRole)
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateCreate(rr, r)
+	require.NotNil(t, herr)
+	require.Equal(t, http.StatusInternalServerError, herr.StatusCode)
+}
+
+func TestCustomTemplateCreate_FromFileContent_InvalidPlatform(t *testing.T) {
+	t.Parallel()
+
+	handler, _, _ := newTestHandler(t)
+
+	payload := customTemplateFromFileContentPayload{
+		Title:       "My Template",
+		Description: "A test template",
+		FileContent: "version: '3'",
+		Type:        portainer.DockerComposeStack,
+		Platform:    0,
+	}
+
+	r := createTemplateRequest(t, "string", payload, 1, portainer.AdministratorRole)
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateCreate(rr, r)
+	require.NotNil(t, herr)
+	require.Equal(t, http.StatusInternalServerError, herr.StatusCode)
+}
+
+func TestCustomTemplateCreate_FromFileContent_NoteWithImage(t *testing.T) {
+	t.Parallel()
+
+	handler, _, _ := newTestHandler(t)
+
+	payload := customTemplateFromFileContentPayload{
+		Title:       "My Template",
+		Description: "A test template",
+		FileContent: "version: '3'",
+		Note:        `Some note with <img src="x" onerror="alert(1)">`,
+		Type:        portainer.DockerComposeStack,
+		Platform:    portainer.CustomTemplatePlatformLinux,
+	}
+
+	r := createTemplateRequest(t, "string", payload, 1, portainer.AdministratorRole)
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateCreate(rr, r)
+	require.NotNil(t, herr)
+	require.Equal(t, http.StatusInternalServerError, herr.StatusCode)
+}
+
+func TestCustomTemplateCreate_FromFileContent_KubernetesTypeIgnoresPlatform(t *testing.T) {
+	t.Parallel()
+
+	handler, ds, _ := newTestHandler(t)
+
+	payload := customTemplateFromFileContentPayload{
+		Title:       "K8s Template",
+		Description: "A kubernetes template",
+		FileContent: "apiVersion: v1\nkind: Pod",
+		Type:        portainer.KubernetesStack,
+		Platform:    0,
+	}
+
+	r := createTemplateRequest(t, "string", payload, 1, portainer.AdministratorRole)
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateCreate(rr, r)
+	require.Nil(t, herr)
+	require.Equal(t, http.StatusOK, rr.Code)
+
+	var tmpl portainer.CustomTemplate
+	require.NoError(t, json.NewDecoder(rr.Body).Decode(&tmpl))
+	require.Equal(t, "K8s Template", tmpl.Title)
+	require.Equal(t, portainer.KubernetesStack, tmpl.Type)
+
+	err := ds.ViewTx(func(tx dataservices.DataStoreTx) error {
+		templates, err := tx.CustomTemplate().ReadAll()
+		require.NoError(t, err)
+		require.Len(t, templates, 1)
+
+		return nil
+	})
+	require.NoError(t, err)
+}
+
+func TestCustomTemplateCreate_FromFileUpload_Success(t *testing.T) {
+	t.Parallel()
+
+	handler, ds, _ := newTestHandler(t)
+
+	var body bytes.Buffer
+	writer := multipart.NewWriter(&body)
+
+	err := writer.WriteField("Title", "Uploaded Template")
+	require.NoError(t, err)
+
+	err = writer.WriteField("Description", "Uploaded from file")
+	require.NoError(t, err)
+
+	err = writer.WriteField("Type", "2")
+	require.NoError(t, err)
+
+	err = writer.WriteField("Platform", "1")
+	require.NoError(t, err)
+
+	part, err := writer.CreateFormFile("File", "docker-compose.yml")
+	require.NoError(t, err)
+
+	_, err = part.Write([]byte("version: '3'\nservices:\n  web:\n    image: nginx"))
+	require.NoError(t, err)
+
+	require.NoError(t, writer.Close())
+
+	r := httptest.NewRequest(http.MethodPost, "/custom_templates/create/file", &body)
+	r.Header.Set("Content-Type", writer.FormDataContentType())
+	r = mux.SetURLVars(r, map[string]string{"method": "file"})
+	ctx := security.StoreTokenData(r, &portainer.TokenData{ID: 1, Role: portainer.AdministratorRole})
+	r = r.WithContext(ctx)
+	r = r.WithContext(security.StoreRestrictedRequestContext(r, &security.RestrictedRequestContext{
+		UserID:  1,
+		IsAdmin: true,
+		User:    &portainer.User{ID: 1, Role: portainer.AdministratorRole},
+	}))
+
+	rr := httptest.NewRecorder()
+	herr := handler.customTemplateCreate(rr, r)
+	require.Nil(t, herr)
+	require.Equal(t, http.StatusOK, rr.Code)
+
+	var tmpl portainer.CustomTemplate
+	require.NoError(t, json.NewDecoder(rr.Body).Decode(&tmpl))
+	require.Equal(t, "Uploaded Template", tmpl.Title)
+	require.Equal(t, filesystem.ComposeFileDefaultName, tmpl.EntryPoint)
+
+	err = ds.ViewTx(func(tx dataservices.DataStoreTx) error {
+		templates, err := tx.CustomTemplate().ReadAll()
+		require.NoError(t, err)
+		require.Len(t, templates, 1)
+
+		return nil
+	})
+	require.NoError(t, err)
+}
+
+func TestCustomTemplateCreate_InvalidMethod(t *testing.T) {
+	t.Parallel()
+
+	handler, _, _ := newTestHandler(t)
+
+	payload := customTemplateFromFileContentPayload{
+		Title:       "My Template",
+		Description: "A test template",
+		FileContent: "version: '3'",
+		Type:        portainer.DockerComposeStack,
+		Platform:    portainer.CustomTemplatePlatformLinux,
+	}
+
+	r := createTemplateRequest(t, "invalid", payload, 1, portainer.AdministratorRole)
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateCreate(rr, r)
+	require.NotNil(t, herr)
+	require.Equal(t, http.StatusInternalServerError, herr.StatusCode)
+}
+
+func TestCustomTemplateCreate_FromFileContent_InvalidType(t *testing.T) {
+	t.Parallel()
+
+	handler, _, _ := newTestHandler(t)
+
+	payload := customTemplateFromFileContentPayload{
+		Title:       "My Template",
+		Description: "A test template",
+		FileContent: "version: '3'",
+		Type:        0,
+		Platform:    portainer.CustomTemplatePlatformLinux,
+	}
+
+	r := createTemplateRequest(t, "string", payload, 1, portainer.AdministratorRole)
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateCreate(rr, r)
+	require.NotNil(t, herr)
+	require.Equal(t, http.StatusInternalServerError, herr.StatusCode)
+}
+
+func TestCustomTemplateCreate_FromFileContent_Variables(t *testing.T) {
+	t.Parallel()
+
+	handler, ds, _ := newTestHandler(t)
+
+	payload := customTemplateFromFileContentPayload{
+		Title:       "Template With Variables",
+		Description: "A test template",
+		FileContent: "version: '3'",
+		Type:        portainer.DockerComposeStack,
+		Platform:    portainer.CustomTemplatePlatformLinux,
+		Variables: []portainer.CustomTemplateVariableDefinition{
+			{Name: "IMAGE", Label: "Docker image"},
+		},
+	}
+
+	r := createTemplateRequest(t, "string", payload, 1, portainer.AdministratorRole)
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateCreate(rr, r)
+	require.Nil(t, herr)
+	require.Equal(t, http.StatusOK, rr.Code)
+
+	var tmpl portainer.CustomTemplate
+	require.NoError(t, json.NewDecoder(rr.Body).Decode(&tmpl))
+	require.Len(t, tmpl.Variables, 1)
+	require.Equal(t, "IMAGE", tmpl.Variables[0].Name)
+
+	err := ds.ViewTx(func(tx dataservices.DataStoreTx) error {
+		stored, err := tx.CustomTemplate().Read(tmpl.ID)
+		require.NoError(t, err)
+		require.Len(t, stored.Variables, 1)
+
+		return nil
+	})
+	require.NoError(t, err)
+}
+
+func TestCustomTemplateCreate_FromFileContent_InvalidVariables(t *testing.T) {
+	t.Parallel()
+
+	handler, _, _ := newTestHandler(t)
+
+	payload := customTemplateFromFileContentPayload{
+		Title:       "My Template",
+		Description: "A test template",
+		FileContent: "version: '3'",
+		Type:        portainer.DockerComposeStack,
+		Platform:    portainer.CustomTemplatePlatformLinux,
+		Variables: []portainer.CustomTemplateVariableDefinition{
+			{Label: "Missing name"},
+		},
+	}
+
+	r := createTemplateRequest(t, "string", payload, 1, portainer.AdministratorRole)
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateCreate(rr, r)
+	require.NotNil(t, herr)
+	require.Equal(t, http.StatusInternalServerError, herr.StatusCode)
+}
+
+func TestCustomTemplateCreate_FromFileContent_EdgeTemplate(t *testing.T) {
+	t.Parallel()
+
+	handler, ds, _ := newTestHandler(t)
+
+	payload := customTemplateFromFileContentPayload{
+		Title:        "Edge Template",
+		Description:  "For edge stacks",
+		FileContent:  "version: '3'\nservices:\n  web:\n    image: nginx",
+		Type:         portainer.DockerComposeStack,
+		Platform:     portainer.CustomTemplatePlatformLinux,
+		EdgeTemplate: true,
+	}
+
+	r := createTemplateRequest(t, "string", payload, 1, portainer.AdministratorRole)
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateCreate(rr, r)
+	require.Nil(t, herr)
+	require.Equal(t, http.StatusOK, rr.Code)
+
+	var tmpl portainer.CustomTemplate
+	require.NoError(t, json.NewDecoder(rr.Body).Decode(&tmpl))
+	require.True(t, tmpl.EdgeTemplate)
+
+	err := ds.ViewTx(func(tx dataservices.DataStoreTx) error {
+		stored, err := tx.CustomTemplate().Read(tmpl.ID)
+		require.NoError(t, err)
+		require.True(t, stored.EdgeTemplate)
+
+		return nil
+	})
+	require.NoError(t, err)
+}
+
+func TestCustomTemplateCreate_FromFileUpload_MissingTitle(t *testing.T) {
+	t.Parallel()
+
+	handler, _, _ := newTestHandler(t)
+
+	var body bytes.Buffer
+	writer := multipart.NewWriter(&body)
+
+	err := writer.WriteField("Description", "A description")
+	require.NoError(t, err)
+
+	err = writer.WriteField("Type", "2")
+	require.NoError(t, err)
+
+	err = writer.WriteField("Platform", "1")
+	require.NoError(t, err)
+
+	part, err := writer.CreateFormFile("File", "docker-compose.yml")
+	require.NoError(t, err)
+
+	_, err = part.Write([]byte("version: '3'"))
+	require.NoError(t, err)
+
+	require.NoError(t, writer.Close())
+
+	r := httptest.NewRequest(http.MethodPost, "/custom_templates/create/file", &body)
+	r.Header.Set("Content-Type", writer.FormDataContentType())
+	r = mux.SetURLVars(r, map[string]string{"method": "file"})
+	ctx := security.StoreTokenData(r, &portainer.TokenData{ID: 1, Role: portainer.AdministratorRole})
+	r = r.WithContext(ctx)
+	r = r.WithContext(security.StoreRestrictedRequestContext(r, &security.RestrictedRequestContext{
+		UserID:  1,
+		IsAdmin: true,
+		User:    &portainer.User{ID: 1, Role: portainer.AdministratorRole},
+	}))
+
+	rr := httptest.NewRecorder()
+	herr := handler.customTemplateCreate(rr, r)
+	require.NotNil(t, herr)
+	require.Equal(t, http.StatusInternalServerError, herr.StatusCode)
+}
+
+func TestCustomTemplateCreate_FromFileUpload_MissingDescription(t *testing.T) {
+	t.Parallel()
+
+	handler, _, _ := newTestHandler(t)
+
+	var body bytes.Buffer
+	writer := multipart.NewWriter(&body)
+
+	err := writer.WriteField("Title", "My Template")
+	require.NoError(t, err)
+
+	err = writer.WriteField("Type", "2")
+	require.NoError(t, err)
+
+	err = writer.WriteField("Platform", "1")
+	require.NoError(t, err)
+
+	part, err := writer.CreateFormFile("File", "docker-compose.yml")
+	require.NoError(t, err)
+
+	_, err = part.Write([]byte("version: '3'"))
+	require.NoError(t, err)
+
+	require.NoError(t, writer.Close())
+
+	r := httptest.NewRequest(http.MethodPost, "/custom_templates/create/file", &body)
+	r.Header.Set("Content-Type", writer.FormDataContentType())
+	r = mux.SetURLVars(r, map[string]string{"method": "file"})
+	ctx := security.StoreTokenData(r, &portainer.TokenData{ID: 1, Role: portainer.AdministratorRole})
+	r = r.WithContext(ctx)
+	r = r.WithContext(security.StoreRestrictedRequestContext(r, &security.RestrictedRequestContext{
+		UserID:  1,
+		IsAdmin: true,
+		User:    &portainer.User{ID: 1, Role: portainer.AdministratorRole},
+	}))
+
+	rr := httptest.NewRecorder()
+	herr := handler.customTemplateCreate(rr, r)
+	require.NotNil(t, herr)
+	require.Equal(t, http.StatusInternalServerError, herr.StatusCode)
+}
+
+func TestCustomTemplateCreate_FromFileUpload_MissingFile(t *testing.T) {
+	t.Parallel()
+
+	handler, _, _ := newTestHandler(t)
+
+	var body bytes.Buffer
+	writer := multipart.NewWriter(&body)
+
+	err := writer.WriteField("Title", "My Template")
+	require.NoError(t, err)
+
+	err = writer.WriteField("Description", "A description")
+	require.NoError(t, err)
+
+	err = writer.WriteField("Type", "2")
+	require.NoError(t, err)
+
+	err = writer.WriteField("Platform", "1")
+	require.NoError(t, err)
+
+	require.NoError(t, writer.Close())
+
+	r := httptest.NewRequest(http.MethodPost, "/custom_templates/create/file", &body)
+	r.Header.Set("Content-Type", writer.FormDataContentType())
+	r = mux.SetURLVars(r, map[string]string{"method": "file"})
+	ctx := security.StoreTokenData(r, &portainer.TokenData{ID: 1, Role: portainer.AdministratorRole})
+	r = r.WithContext(ctx)
+	r = r.WithContext(security.StoreRestrictedRequestContext(r, &security.RestrictedRequestContext{
+		UserID:  1,
+		IsAdmin: true,
+		User:    &portainer.User{ID: 1, Role: portainer.AdministratorRole},
+	}))
+
+	rr := httptest.NewRecorder()
+	herr := handler.customTemplateCreate(rr, r)
+	require.NotNil(t, herr)
+	require.Equal(t, http.StatusInternalServerError, herr.StatusCode)
+}
+
+func TestCustomTemplateCreate_FromFileUpload_InvalidType(t *testing.T) {
+	t.Parallel()
+
+	handler, _, _ := newTestHandler(t)
+
+	var body bytes.Buffer
+	writer := multipart.NewWriter(&body)
+
+	err := writer.WriteField("Title", "My Template")
+	require.NoError(t, err)
+
+	err = writer.WriteField("Description", "A description")
+	require.NoError(t, err)
+
+	err = writer.WriteField("Type", "0")
+	require.NoError(t, err)
+
+	err = writer.WriteField("Platform", "1")
+	require.NoError(t, err)
+
+	part, err := writer.CreateFormFile("File", "docker-compose.yml")
+	require.NoError(t, err)
+
+	_, err = part.Write([]byte("version: '3'"))
+	require.NoError(t, err)
+
+	require.NoError(t, writer.Close())
+
+	r := httptest.NewRequest(http.MethodPost, "/custom_templates/create/file", &body)
+	r.Header.Set("Content-Type", writer.FormDataContentType())
+	r = mux.SetURLVars(r, map[string]string{"method": "file"})
+	ctx := security.StoreTokenData(r, &portainer.TokenData{ID: 1, Role: portainer.AdministratorRole})
+	r = r.WithContext(ctx)
+	r = r.WithContext(security.StoreRestrictedRequestContext(r, &security.RestrictedRequestContext{
+		UserID:  1,
+		IsAdmin: true,
+		User:    &portainer.User{ID: 1, Role: portainer.AdministratorRole},
+	}))
+
+	rr := httptest.NewRecorder()
+	herr := handler.customTemplateCreate(rr, r)
+	require.NotNil(t, herr)
+	require.Equal(t, http.StatusInternalServerError, herr.StatusCode)
+}
+
+func TestCustomTemplateCreate_FromFileUpload_InvalidPlatform(t *testing.T) {
+	t.Parallel()
+
+	handler, _, _ := newTestHandler(t)
+
+	var body bytes.Buffer
+	writer := multipart.NewWriter(&body)
+
+	err := writer.WriteField("Title", "My Template")
+	require.NoError(t, err)
+
+	err = writer.WriteField("Description", "A description")
+	require.NoError(t, err)
+
+	err = writer.WriteField("Type", "2")
+	require.NoError(t, err)
+
+	err = writer.WriteField("Platform", "0")
+	require.NoError(t, err)
+
+	part, err := writer.CreateFormFile("File", "docker-compose.yml")
+	require.NoError(t, err)
+
+	_, err = part.Write([]byte("version: '3'"))
+	require.NoError(t, err)
+
+	require.NoError(t, writer.Close())
+
+	r := httptest.NewRequest(http.MethodPost, "/custom_templates/create/file", &body)
+	r.Header.Set("Content-Type", writer.FormDataContentType())
+	r = mux.SetURLVars(r, map[string]string{"method": "file"})
+	ctx := security.StoreTokenData(r, &portainer.TokenData{ID: 1, Role: portainer.AdministratorRole})
+	r = r.WithContext(ctx)
+	r = r.WithContext(security.StoreRestrictedRequestContext(r, &security.RestrictedRequestContext{
+		UserID:  1,
+		IsAdmin: true,
+		User:    &portainer.User{ID: 1, Role: portainer.AdministratorRole},
+	}))
+
+	rr := httptest.NewRecorder()
+	herr := handler.customTemplateCreate(rr, r)
+	require.NotNil(t, herr)
+	require.Equal(t, http.StatusInternalServerError, herr.StatusCode)
+}
+
+func TestCustomTemplateCreate_FromFileUpload_NoteWithImage(t *testing.T) {
+	t.Parallel()
+
+	handler, _, _ := newTestHandler(t)
+
+	var body bytes.Buffer
+	writer := multipart.NewWriter(&body)
+
+	err := writer.WriteField("Title", "My Template")
+	require.NoError(t, err)
+
+	err = writer.WriteField("Description", "A description")
+	require.NoError(t, err)
+
+	err = writer.WriteField("Note", `Some note <img src="x" onerror="alert(1)">`)
+	require.NoError(t, err)
+
+	err = writer.WriteField("Type", "2")
+	require.NoError(t, err)
+
+	err = writer.WriteField("Platform", "1")
+	require.NoError(t, err)
+
+	part, err := writer.CreateFormFile("File", "docker-compose.yml")
+	require.NoError(t, err)
+
+	_, err = part.Write([]byte("version: '3'"))
+	require.NoError(t, err)
+
+	require.NoError(t, writer.Close())
+
+	r := httptest.NewRequest(http.MethodPost, "/custom_templates/create/file", &body)
+	r.Header.Set("Content-Type", writer.FormDataContentType())
+	r = mux.SetURLVars(r, map[string]string{"method": "file"})
+	ctx := security.StoreTokenData(r, &portainer.TokenData{ID: 1, Role: portainer.AdministratorRole})
+	r = r.WithContext(ctx)
+	r = r.WithContext(security.StoreRestrictedRequestContext(r, &security.RestrictedRequestContext{
+		UserID:  1,
+		IsAdmin: true,
+		User:    &portainer.User{ID: 1, Role: portainer.AdministratorRole},
+	}))
+
+	rr := httptest.NewRecorder()
+	herr := handler.customTemplateCreate(rr, r)
+	require.NotNil(t, herr)
+	require.Equal(t, http.StatusInternalServerError, herr.StatusCode)
+}
+
+func TestCustomTemplateCreate_FromFileUpload_KubernetesIgnoresPlatform(t *testing.T) {
+	t.Parallel()
+
+	handler, ds, _ := newTestHandler(t)
+
+	var body bytes.Buffer
+	writer := multipart.NewWriter(&body)
+
+	err := writer.WriteField("Title", "K8s Upload Template")
+	require.NoError(t, err)
+
+	err = writer.WriteField("Description", "A kubernetes template")
+	require.NoError(t, err)
+
+	err = writer.WriteField("Type", "3")
+	require.NoError(t, err)
+
+	err = writer.WriteField("Platform", "0")
+	require.NoError(t, err)
+
+	part, err := writer.CreateFormFile("File", "deployment.yml")
+	require.NoError(t, err)
+
+	_, err = part.Write([]byte("apiVersion: v1\nkind: Pod"))
+	require.NoError(t, err)
+
+	require.NoError(t, writer.Close())
+
+	r := httptest.NewRequest(http.MethodPost, "/custom_templates/create/file", &body)
+	r.Header.Set("Content-Type", writer.FormDataContentType())
+	r = mux.SetURLVars(r, map[string]string{"method": "file"})
+	ctx := security.StoreTokenData(r, &portainer.TokenData{ID: 1, Role: portainer.AdministratorRole})
+	r = r.WithContext(ctx)
+	r = r.WithContext(security.StoreRestrictedRequestContext(r, &security.RestrictedRequestContext{
+		UserID:  1,
+		IsAdmin: true,
+		User:    &portainer.User{ID: 1, Role: portainer.AdministratorRole},
+	}))
+
+	rr := httptest.NewRecorder()
+	herr := handler.customTemplateCreate(rr, r)
+	require.Nil(t, herr)
+	require.Equal(t, http.StatusOK, rr.Code)
+
+	var tmpl portainer.CustomTemplate
+	require.NoError(t, json.NewDecoder(rr.Body).Decode(&tmpl))
+	require.Equal(t, "K8s Upload Template", tmpl.Title)
+	require.Equal(t, filesystem.ComposeFileDefaultName, tmpl.EntryPoint)
+
+	err = ds.ViewTx(func(tx dataservices.DataStoreTx) error {
+		templates, err := tx.CustomTemplate().ReadAll()
+		require.NoError(t, err)
+		require.Len(t, templates, 1)
+
+		return nil
+	})
+	require.NoError(t, err)
+}
+
+func TestCustomTemplateCreate_FromFileUpload_Variables(t *testing.T) {
+	t.Parallel()
+
+	handler, ds, _ := newTestHandler(t)
+
+	vars, err := json.Marshal([]portainer.CustomTemplateVariableDefinition{{Name: "IMAGE", Label: "Docker image"}})
+	require.NoError(t, err)
+
+	var body bytes.Buffer
+	writer := multipart.NewWriter(&body)
+
+	err = writer.WriteField("Title", "Template With Variables")
+	require.NoError(t, err)
+
+	err = writer.WriteField("Description", "A description")
+	require.NoError(t, err)
+
+	err = writer.WriteField("Type", "2")
+	require.NoError(t, err)
+
+	err = writer.WriteField("Platform", "1")
+	require.NoError(t, err)
+
+	err = writer.WriteField("Variables", string(vars))
+	require.NoError(t, err)
+
+	part, err := writer.CreateFormFile("File", "docker-compose.yml")
+	require.NoError(t, err)
+
+	_, err = part.Write([]byte("version: '3'"))
+	require.NoError(t, err)
+
+	require.NoError(t, writer.Close())
+
+	r := httptest.NewRequest(http.MethodPost, "/custom_templates/create/file", &body)
+	r.Header.Set("Content-Type", writer.FormDataContentType())
+	r = mux.SetURLVars(r, map[string]string{"method": "file"})
+	ctx := security.StoreTokenData(r, &portainer.TokenData{ID: 1, Role: portainer.AdministratorRole})
+	r = r.WithContext(ctx)
+	r = r.WithContext(security.StoreRestrictedRequestContext(r, &security.RestrictedRequestContext{
+		UserID:  1,
+		IsAdmin: true,
+		User:    &portainer.User{ID: 1, Role: portainer.AdministratorRole},
+	}))
+
+	rr := httptest.NewRecorder()
+	herr := handler.customTemplateCreate(rr, r)
+	require.Nil(t, herr)
+	require.Equal(t, http.StatusOK, rr.Code)
+
+	var tmpl portainer.CustomTemplate
+	require.NoError(t, json.NewDecoder(rr.Body).Decode(&tmpl))
+	require.Len(t, tmpl.Variables, 1)
+	require.Equal(t, "IMAGE", tmpl.Variables[0].Name)
+
+	err = ds.ViewTx(func(tx dataservices.DataStoreTx) error {
+		stored, err := tx.CustomTemplate().Read(tmpl.ID)
+		require.NoError(t, err)
+		require.Len(t, stored.Variables, 1)
+
+		return nil
+	})
+	require.NoError(t, err)
+}
+
+func TestCustomTemplateCreate_FromFileUpload_InvalidVariables(t *testing.T) {
+	t.Parallel()
+
+	handler, _, _ := newTestHandler(t)
+
+	var body bytes.Buffer
+	writer := multipart.NewWriter(&body)
+
+	err := writer.WriteField("Title", "My Template")
+	require.NoError(t, err)
+
+	err = writer.WriteField("Description", "A description")
+	require.NoError(t, err)
+
+	err = writer.WriteField("Type", "2")
+	require.NoError(t, err)
+
+	err = writer.WriteField("Platform", "1")
+	require.NoError(t, err)
+
+	err = writer.WriteField("Variables", "not-valid-json")
+	require.NoError(t, err)
+
+	part, err := writer.CreateFormFile("File", "docker-compose.yml")
+	require.NoError(t, err)
+
+	_, err = part.Write([]byte("version: '3'"))
+	require.NoError(t, err)
+
+	require.NoError(t, writer.Close())
+
+	r := httptest.NewRequest(http.MethodPost, "/custom_templates/create/file", &body)
+	r.Header.Set("Content-Type", writer.FormDataContentType())
+	r = mux.SetURLVars(r, map[string]string{"method": "file"})
+	ctx := security.StoreTokenData(r, &portainer.TokenData{ID: 1, Role: portainer.AdministratorRole})
+	r = r.WithContext(ctx)
+	r = r.WithContext(security.StoreRestrictedRequestContext(r, &security.RestrictedRequestContext{
+		UserID:  1,
+		IsAdmin: true,
+		User:    &portainer.User{ID: 1, Role: portainer.AdministratorRole},
+	}))
+
+	rr := httptest.NewRecorder()
+	herr := handler.customTemplateCreate(rr, r)
+	require.NotNil(t, herr)
+	require.Equal(t, http.StatusInternalServerError, herr.StatusCode)
+}
+
+type gitServiceCreatingFile struct {
+	portainer.GitService
+}
+
+func (g *gitServiceCreatingFile) CloneRepository(_ context.Context, destination, _, _, _, _ string, _ bool) error {
+	if err := os.MkdirAll(destination, 0700); err != nil {
+		return err
+	}
+
+	f, err := os.Create(filesystem.JoinPaths(destination, filesystem.ComposeFileDefaultName))
+	if err != nil {
+		return err
+	}
+
+	return f.Close()
+}
+
+func (g *gitServiceCreatingFile) LatestCommitID(_ context.Context, _, _, _, _ string, _ bool) (string, error) {
+	return "deadbeef123", nil
+}
+
+func TestCustomTemplateCreate_FromRepository_Success(t *testing.T) {
+	t.Parallel()
+
+	handler, ds, _ := newTestHandler(t)
+	handler.GitService = &gitServiceCreatingFile{}
+
+	payload := customTemplateFromGitRepositoryPayload{
+		Title:         "Git Template",
+		Description:   "Created from git",
+		RepositoryURL: "https://github.com/example/repo",
+		Type:          portainer.DockerComposeStack,
+		Platform:      portainer.CustomTemplatePlatformLinux,
+	}
+
+	r := createTemplateRequest(t, "repository", payload, 1, portainer.AdministratorRole)
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateCreate(rr, r)
+	require.Nil(t, herr)
+	require.Equal(t, http.StatusOK, rr.Code)
+
+	var tmpl portainer.CustomTemplate
+	require.NoError(t, json.NewDecoder(rr.Body).Decode(&tmpl))
+	require.Equal(t, "Git Template", tmpl.Title)
+	require.NotNil(t, tmpl.Artifact)
+	require.Len(t, tmpl.Artifact.Files, 1)
+	require.Equal(t, "deadbeef123", tmpl.Artifact.Files[0].Hash)
+
+	err := ds.ViewTx(func(tx dataservices.DataStoreTx) error {
+		stored, err := tx.CustomTemplate().Read(tmpl.ID)
+		require.NoError(t, err)
+		require.NotNil(t, stored.Artifact)
+
+		src, err := tx.Source().Read(adminUserContext, stored.Artifact.Files[0].SourceID)
+		require.NoError(t, err)
+		require.Equal(t, portainer.SourceTypeGit, src.Type)
+		require.Equal(t, "https://github.com/example/repo", src.Git.URL)
+
+		return nil
+	})
+	require.NoError(t, err)
+}
+
+func TestCustomTemplateCreate_FromRepository_DeduplicatesSource(t *testing.T) {
+	t.Parallel()
+
+	handler, ds, _ := newTestHandler(t)
+	handler.GitService = &gitServiceCreatingFile{}
+
+	makePayload := func(title string) customTemplateFromGitRepositoryPayload {
+		return customTemplateFromGitRepositoryPayload{
+			Title:         title,
+			Description:   "Created from git",
+			RepositoryURL: "https://github.com/example/repo",
+			Type:          portainer.DockerComposeStack,
+			Platform:      portainer.CustomTemplatePlatformLinux,
+		}
+	}
+
+	r1 := createTemplateRequest(t, "repository", makePayload("Template One"), 1, portainer.AdministratorRole)
+	rr1 := httptest.NewRecorder()
+	herr := handler.customTemplateCreate(rr1, r1)
+	require.Nil(t, herr)
+
+	r2 := createTemplateRequest(t, "repository", makePayload("Template Two"), 1, portainer.AdministratorRole)
+	rr2 := httptest.NewRecorder()
+	herr = handler.customTemplateCreate(rr2, r2)
+	require.Nil(t, herr)
+
+	err := ds.ViewTx(func(tx dataservices.DataStoreTx) error {
+		sources, err := tx.Source().ReadAll(adminUserContext)
+		require.NoError(t, err)
+		require.Len(t, sources, 1, "two templates with the same URL must share one Source")
+
+		return nil
+	})
+	require.NoError(t, err)
+}
+
+func TestCustomTemplateCreate_FromRepository_Validation_MissingTitle(t *testing.T) {
+	t.Parallel()
+
+	handler, _, _ := newTestHandler(t)
+
+	payload := customTemplateFromGitRepositoryPayload{
+		Description:   "A description",
+		RepositoryURL: "https://github.com/example/repo",
+		Type:          portainer.DockerComposeStack,
+		Platform:      portainer.CustomTemplatePlatformLinux,
+	}
+
+	r := createTemplateRequest(t, "repository", payload, 1, portainer.AdministratorRole)
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateCreate(rr, r)
+	require.NotNil(t, herr)
+	require.Equal(t, http.StatusInternalServerError, herr.StatusCode)
+}
+
+func TestCustomTemplateCreate_FromRepository_Validation_MissingDescription(t *testing.T) {
+	t.Parallel()
+
+	handler, _, _ := newTestHandler(t)
+
+	payload := customTemplateFromGitRepositoryPayload{
+		Title:         "My Template",
+		RepositoryURL: "https://github.com/example/repo",
+		Type:          portainer.DockerComposeStack,
+		Platform:      portainer.CustomTemplatePlatformLinux,
+	}
+
+	r := createTemplateRequest(t, "repository", payload, 1, portainer.AdministratorRole)
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateCreate(rr, r)
+	require.NotNil(t, herr)
+	require.Equal(t, http.StatusInternalServerError, herr.StatusCode)
+}
+
+func TestCustomTemplateCreate_FromRepository_Validation_InvalidURL(t *testing.T) {
+	t.Parallel()
+
+	handler, _, _ := newTestHandler(t)
+
+	payload := customTemplateFromGitRepositoryPayload{
+		Title:         "My Template",
+		Description:   "A description",
+		RepositoryURL: "http://",
+		Type:          portainer.DockerComposeStack,
+		Platform:      portainer.CustomTemplatePlatformLinux,
+	}
+
+	r := createTemplateRequest(t, "repository", payload, 1, portainer.AdministratorRole)
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateCreate(rr, r)
+	require.NotNil(t, herr)
+	require.Equal(t, http.StatusInternalServerError, herr.StatusCode)
+}
+
+func TestCustomTemplateCreate_FromRepository_Validation_AuthWithoutCredentials(t *testing.T) {
+	t.Parallel()
+
+	handler, _, _ := newTestHandler(t)
+
+	payload := customTemplateFromGitRepositoryPayload{
+		Title:                    "My Template",
+		Description:              "A description",
+		RepositoryURL:            "https://github.com/example/repo",
+		RepositoryAuthentication: true,
+		Type:                     portainer.DockerComposeStack,
+		Platform:                 portainer.CustomTemplatePlatformLinux,
+	}
+
+	r := createTemplateRequest(t, "repository", payload, 1, portainer.AdministratorRole)
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateCreate(rr, r)
+	require.NotNil(t, herr)
+	require.Equal(t, http.StatusInternalServerError, herr.StatusCode)
+}
+
+func TestCustomTemplateCreate_FromRepository_Validation_InvalidPlatform(t *testing.T) {
+	t.Parallel()
+
+	handler, _, _ := newTestHandler(t)
+
+	payload := customTemplateFromGitRepositoryPayload{
+		Title:         "My Template",
+		Description:   "A description",
+		RepositoryURL: "https://github.com/example/repo",
+		Type:          portainer.DockerComposeStack,
+		Platform:      0,
+	}
+
+	r := createTemplateRequest(t, "repository", payload, 1, portainer.AdministratorRole)
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateCreate(rr, r)
+	require.NotNil(t, herr)
+	require.Equal(t, http.StatusInternalServerError, herr.StatusCode)
+}
+
+func TestCustomTemplateCreate_FromRepository_Validation_InvalidType(t *testing.T) {
+	t.Parallel()
+
+	handler, _, _ := newTestHandler(t)
+
+	payload := customTemplateFromGitRepositoryPayload{
+		Title:         "My Template",
+		Description:   "A description",
+		RepositoryURL: "https://github.com/example/repo",
+		Type:          0,
+		Platform:      portainer.CustomTemplatePlatformLinux,
+	}
+
+	r := createTemplateRequest(t, "repository", payload, 1, portainer.AdministratorRole)
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateCreate(rr, r)
+	require.NotNil(t, herr)
+	require.Equal(t, http.StatusInternalServerError, herr.StatusCode)
+}
+
+func TestCustomTemplateCreate_FromRepository_WithSourceID_Success(t *testing.T) {
+	t.Parallel()
+
+	handler, ds, _ := newTestHandler(t)
+	handler.GitService = &gitServiceCreatingFile{}
+
+	var srcID portainer.SourceID
+	require.NoError(t, ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		src := &portainer.Source{
+			Name: "example/repo",
+			Type: portainer.SourceTypeGit,
+			Git: &gittypes.GitSource{
+				URL: "https://github.com/example/repo",
+			},
+		}
+		err := tx.Source().Create(adminUserContext, src)
+		require.NoError(t, err)
+		srcID = src.ID
+		return nil
+	}))
+
+	payload := customTemplateFromGitRepositoryPayload{
+		Title:       "Source Template",
+		Description: "Created from source ID",
+		SourceID:    srcID,
+		Type:        portainer.DockerComposeStack,
+		Platform:    portainer.CustomTemplatePlatformLinux,
+	}
+
+	r := createTemplateRequest(t, "repository", payload, 1, portainer.AdministratorRole)
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateCreate(rr, r)
+	require.Nil(t, herr)
+	require.Equal(t, http.StatusOK, rr.Code)
+
+	var tmpl portainer.CustomTemplate
+	require.NoError(t, json.NewDecoder(rr.Body).Decode(&tmpl))
+	require.NotNil(t, tmpl.Artifact)
+	require.Len(t, tmpl.Artifact.Files, 1)
+	require.Equal(t, srcID, tmpl.Artifact.Files[0].SourceID)
+	require.Equal(t, "deadbeef123", tmpl.Artifact.Files[0].Hash)
+}
+
+func TestCustomTemplateCreate_FromRepository_WithSourceID_NonExistentSource(t *testing.T) {
+	t.Parallel()
+
+	handler, _, _ := newTestHandler(t)
+	handler.GitService = &gitServiceCreatingFile{}
+
+	payload := customTemplateFromGitRepositoryPayload{
+		Title:       "Source Template",
+		Description: "Created from non-existent source ID",
+		SourceID:    999,
+		Type:        portainer.DockerComposeStack,
+		Platform:    portainer.CustomTemplatePlatformLinux,
+	}
+
+	r := createTemplateRequest(t, "repository", payload, 1, portainer.AdministratorRole)
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateCreate(rr, r)
+	require.NotNil(t, herr)
+	require.Equal(t, http.StatusInternalServerError, herr.StatusCode)
+}
diff --git a/api/http/handler/customtemplates/customtemplate_delete.go b/api/http/handler/customtemplates/customtemplate_delete.go
new file mode 100644
index 0000000..bb8e6d5
--- /dev/null
+++ b/api/http/handler/customtemplates/customtemplate_delete.go
@@ -0,0 +1,79 @@
+package customtemplates
+
+import (
+	"net/http"
+	"strconv"
+
+	portainer "github.com/portainer/portainer/api"
+	httperrors "github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+
+	"github.com/rs/zerolog/log"
+)
+
+// @id CustomTemplateDelete
+// @summary Remove a template
+// @description Remove a template.
+// @description **Access policy**: authenticated
+// @tags custom_templates
+// @security ApiKeyAuth
+// @security jwt
+// @param id path int true "Template identifier"
+// @success 204 "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Access denied to resource"
+// @failure 404 "Template not found"
+// @failure 500 "Server error"
+// @router /custom_templates/{id} [delete]
+func (handler *Handler) customTemplateDelete(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	customTemplateID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid Custom template identifier route variable", err)
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	customTemplate, err := handler.DataStore.CustomTemplate().Read(portainer.CustomTemplateID(customTemplateID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find a custom template with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find a custom template with the specified identifier inside the database", err)
+	}
+
+	resourceControl, err := handler.DataStore.ResourceControl().ResourceControlByResourceIDAndType(strconv.Itoa(customTemplateID), portainer.CustomTemplateResourceControl)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve a resource control associated to the custom template", err)
+	}
+
+	customTemplate.ResourceControl = resourceControl
+	access := userCanEditTemplate(customTemplate, securityContext)
+	if !access {
+		return httperror.Forbidden("Access denied to resource", httperrors.ErrResourceAccessDenied)
+	}
+
+	err = handler.DataStore.CustomTemplate().Delete(portainer.CustomTemplateID(customTemplateID))
+	if err != nil {
+		return httperror.InternalServerError("Unable to remove the custom template from the database", err)
+	}
+
+	err = handler.FileService.RemoveDirectory(customTemplate.ProjectPath)
+	if err != nil {
+		log.Warn().Err(err).Msg("Unable to remove custom template files from disk")
+	}
+
+	if resourceControl != nil {
+		err = handler.DataStore.ResourceControl().Delete(resourceControl.ID)
+		if err != nil {
+			return httperror.InternalServerError("Unable to remove the associated resource control from the database", err)
+		}
+	}
+
+	return response.Empty(w)
+
+}
diff --git a/api/http/handler/customtemplates/customtemplate_delete_test.go b/api/http/handler/customtemplates/customtemplate_delete_test.go
new file mode 100644
index 0000000..accd437
--- /dev/null
+++ b/api/http/handler/customtemplates/customtemplate_delete_test.go
@@ -0,0 +1,296 @@
+package customtemplates
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/security"
+
+	"github.com/gorilla/mux"
+	"github.com/stretchr/testify/require"
+)
+
+func TestCustomTemplateDelete_NotFound(t *testing.T) {
+	t.Parallel()
+
+	handler, _, _ := newTestHandler(t)
+
+	r := httptest.NewRequest(http.MethodDelete, "/custom_templates/99", nil)
+	r = mux.SetURLVars(r, map[string]string{"id": "99"})
+	r = r.WithContext(security.StoreRestrictedRequestContext(r, &security.RestrictedRequestContext{UserID: 1, IsAdmin: true}))
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateDelete(rr, r)
+	require.NotNil(t, herr)
+	require.Equal(t, http.StatusNotFound, herr.StatusCode)
+}
+
+func TestCustomTemplateDelete_Forbidden(t *testing.T) {
+	t.Parallel()
+
+	handler, store, _ := newTestHandler(t)
+
+	err := store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		err := tx.CustomTemplate().Create(&portainer.CustomTemplate{
+			ID:              1,
+			CreatedByUserID: 1,
+		})
+		require.NoError(t, err)
+
+		return nil
+	})
+	require.NoError(t, err)
+
+	// User 2 did not create this template and is not an admin
+	r := httptest.NewRequest(http.MethodDelete, "/custom_templates/1", nil)
+	r = mux.SetURLVars(r, map[string]string{"id": "1"})
+	r = r.WithContext(security.StoreRestrictedRequestContext(r, &security.RestrictedRequestContext{UserID: 2}))
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateDelete(rr, r)
+	require.NotNil(t, herr)
+	require.Equal(t, http.StatusForbidden, herr.StatusCode)
+}
+
+func TestCustomTemplateDelete_CreatorDeniedWhenAdminOnly(t *testing.T) {
+	t.Parallel()
+
+	handler, store, _ := newTestHandler(t)
+
+	err := store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		err := tx.CustomTemplate().Create(&portainer.CustomTemplate{
+			ID:              1,
+			CreatedByUserID: 2,
+		})
+		require.NoError(t, err)
+
+		err = tx.ResourceControl().Create(&portainer.ResourceControl{
+			ID:                 1,
+			ResourceID:         "1",
+			Type:               portainer.CustomTemplateResourceControl,
+			AdministratorsOnly: true,
+		})
+		require.NoError(t, err)
+
+		return nil
+	})
+	require.NoError(t, err)
+
+	// User 2 created the template but an admin later changed it to admins-only
+	r := httptest.NewRequest(http.MethodDelete, "/custom_templates/1", nil)
+	r = mux.SetURLVars(r, map[string]string{"id": "1"})
+	r = r.WithContext(security.StoreRestrictedRequestContext(r, &security.RestrictedRequestContext{UserID: 2}))
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateDelete(rr, r)
+	require.NotNil(t, herr)
+	require.Equal(t, http.StatusForbidden, herr.StatusCode)
+}
+
+func TestCustomTemplateDelete_CreatorDeniedWithoutResourceControl(t *testing.T) {
+	t.Parallel()
+
+	handler, store, _ := newTestHandler(t)
+
+	err := store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.CustomTemplate().Create(&portainer.CustomTemplate{
+			ID:              1,
+			CreatedByUserID: 2,
+		})
+	})
+	require.NoError(t, err)
+
+	// User 2 created this template but there is no resource control
+	r := httptest.NewRequest(http.MethodDelete, "/custom_templates/1", nil)
+	r = mux.SetURLVars(r, map[string]string{"id": "1"})
+	r = r.WithContext(security.StoreRestrictedRequestContext(r, &security.RestrictedRequestContext{UserID: 2}))
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateDelete(rr, r)
+	require.NotNil(t, herr)
+	require.Equal(t, http.StatusForbidden, herr.StatusCode)
+}
+
+func TestCustomTemplateDelete_Success(t *testing.T) {
+	t.Parallel()
+
+	handler, store, _ := newTestHandler(t)
+
+	err := store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		err := tx.CustomTemplate().Create(&portainer.CustomTemplate{
+			ID:              1,
+			CreatedByUserID: 2,
+		})
+		require.NoError(t, err)
+
+		err = tx.ResourceControl().Create(&portainer.ResourceControl{
+			ID:           1,
+			ResourceID:   "1",
+			Type:         portainer.CustomTemplateResourceControl,
+			UserAccesses: []portainer.UserResourceAccess{{UserID: 2}},
+		})
+		require.NoError(t, err)
+
+		return nil
+	})
+	require.NoError(t, err)
+
+	r := httptest.NewRequest(http.MethodDelete, "/custom_templates/1", nil)
+	r = mux.SetURLVars(r, map[string]string{"id": "1"})
+	r = r.WithContext(security.StoreRestrictedRequestContext(r, &security.RestrictedRequestContext{UserID: 2}))
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateDelete(rr, r)
+	require.Nil(t, herr)
+	require.Equal(t, http.StatusNoContent, rr.Code)
+
+	err = store.ViewTx(func(tx dataservices.DataStoreTx) error {
+		_, err := tx.CustomTemplate().Read(1)
+		require.True(t, tx.IsErrObjectNotFound(err))
+
+		return nil
+	})
+	require.NoError(t, err)
+}
+
+func TestCustomTemplateDelete_AdminCanDeleteAdminOnly(t *testing.T) {
+	t.Parallel()
+
+	handler, store, _ := newTestHandler(t)
+
+	err := store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		err := tx.CustomTemplate().Create(&portainer.CustomTemplate{
+			ID:              1,
+			CreatedByUserID: 2,
+		})
+		require.NoError(t, err)
+
+		err = tx.ResourceControl().Create(&portainer.ResourceControl{
+			ID:                 1,
+			ResourceID:         "1",
+			Type:               portainer.CustomTemplateResourceControl,
+			AdministratorsOnly: true,
+		})
+		require.NoError(t, err)
+
+		return nil
+	})
+	require.NoError(t, err)
+
+	r := httptest.NewRequest(http.MethodDelete, "/custom_templates/1", nil)
+	r = mux.SetURLVars(r, map[string]string{"id": "1"})
+	r = r.WithContext(security.StoreRestrictedRequestContext(r, &security.RestrictedRequestContext{UserID: 1, IsAdmin: true}))
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateDelete(rr, r)
+	require.Nil(t, herr)
+	require.Equal(t, http.StatusNoContent, rr.Code)
+}
+
+func TestCustomTemplateDelete_PublicTemplateAllowsAnyUser(t *testing.T) {
+	t.Parallel()
+
+	handler, store, _ := newTestHandler(t)
+
+	err := store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		err := tx.CustomTemplate().Create(&portainer.CustomTemplate{
+			ID:              1,
+			CreatedByUserID: 1,
+		})
+		require.NoError(t, err)
+
+		err = tx.ResourceControl().Create(&portainer.ResourceControl{
+			ID:         1,
+			ResourceID: "1",
+			Type:       portainer.CustomTemplateResourceControl,
+			Public:     true,
+		})
+		require.NoError(t, err)
+
+		return nil
+	})
+	require.NoError(t, err)
+
+	// User 2 is not the creator but the template is public
+	r := httptest.NewRequest(http.MethodDelete, "/custom_templates/1", nil)
+	r = mux.SetURLVars(r, map[string]string{"id": "1"})
+	r = r.WithContext(security.StoreRestrictedRequestContext(r, &security.RestrictedRequestContext{UserID: 2}))
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateDelete(rr, r)
+	require.Nil(t, herr)
+	require.Equal(t, http.StatusNoContent, rr.Code)
+}
+
+func TestCustomTemplateDelete_NonCreatorForbiddenWithPrivateRC(t *testing.T) {
+	t.Parallel()
+
+	handler, store, _ := newTestHandler(t)
+
+	err := store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		err := tx.CustomTemplate().Create(&portainer.CustomTemplate{
+			ID:              1,
+			CreatedByUserID: 1,
+		})
+		require.NoError(t, err)
+
+		err = tx.ResourceControl().Create(&portainer.ResourceControl{
+			ID:           1,
+			ResourceID:   "1",
+			Type:         portainer.CustomTemplateResourceControl,
+			UserAccesses: []portainer.UserResourceAccess{{UserID: 1}},
+		})
+		require.NoError(t, err)
+
+		return nil
+	})
+	require.NoError(t, err)
+
+	// User 2 is not the creator and the template has a private resource control
+	r := httptest.NewRequest(http.MethodDelete, "/custom_templates/1", nil)
+	r = mux.SetURLVars(r, map[string]string{"id": "1"})
+	r = r.WithContext(security.StoreRestrictedRequestContext(r, &security.RestrictedRequestContext{UserID: 2}))
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateDelete(rr, r)
+	require.NotNil(t, herr)
+	require.Equal(t, http.StatusForbidden, herr.StatusCode)
+}
+
+func TestCustomTemplateDelete_CreatorDeniedWithoutAccess(t *testing.T) {
+	t.Parallel()
+
+	handler, store, _ := newTestHandler(t)
+
+	err := store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		err := tx.CustomTemplate().Create(&portainer.CustomTemplate{
+			ID:              1,
+			CreatedByUserID: 2,
+		})
+		require.NoError(t, err)
+
+		// RC exists but only grants access to user 3, not the creator (user 2)
+		err = tx.ResourceControl().Create(&portainer.ResourceControl{
+			ID:           1,
+			ResourceID:   "1",
+			Type:         portainer.CustomTemplateResourceControl,
+			UserAccesses: []portainer.UserResourceAccess{{UserID: 3}},
+		})
+		require.NoError(t, err)
+
+		return nil
+	})
+	require.NoError(t, err)
+
+	r := httptest.NewRequest(http.MethodDelete, "/custom_templates/1", nil)
+	r = mux.SetURLVars(r, map[string]string{"id": "1"})
+	r = r.WithContext(security.StoreRestrictedRequestContext(r, &security.RestrictedRequestContext{UserID: 2}))
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateDelete(rr, r)
+	require.NotNil(t, herr)
+	require.Equal(t, http.StatusForbidden, herr.StatusCode)
+}
diff --git a/api/http/handler/customtemplates/customtemplate_file.go b/api/http/handler/customtemplates/customtemplate_file.go
new file mode 100644
index 0000000..934b6e6
--- /dev/null
+++ b/api/http/handler/customtemplates/customtemplate_file.go
@@ -0,0 +1,93 @@
+package customtemplates
+
+import (
+	"net/http"
+	"strconv"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	httperrors "github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/slicesx"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type fileResponse struct {
+	FileContent string
+}
+
+// @id CustomTemplateFile
+// @summary Get Template stack file content.
+// @description Retrieve the content of the Stack file for the specified custom template
+// @description **Access policy**: authenticated
+// @tags custom_templates
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param id path int true "Template identifier"
+// @success 200 {object} fileResponse "Success"
+// @failure 400 "Invalid request"
+// @failure 404 "Custom template not found"
+// @failure 500 "Server error"
+// @router /custom_templates/{id}/file [get]
+func (handler *Handler) customTemplateFile(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	customTemplateID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid custom template identifier route variable", err)
+	}
+
+	var customTemplate *portainer.CustomTemplate
+	if err := handler.DataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
+		var err error
+		customTemplate, err = tx.CustomTemplate().Read(portainer.CustomTemplateID(customTemplateID))
+		if tx.IsErrObjectNotFound(err) {
+			return httperror.NotFound("Unable to find a custom template with the specified identifier inside the database", err)
+		} else if err != nil {
+			return httperror.InternalServerError("Unable to find a custom template with the specified identifier inside the database", err)
+		}
+
+		resourceControl, err := tx.ResourceControl().ResourceControlByResourceIDAndType(strconv.Itoa(customTemplateID), portainer.CustomTemplateResourceControl)
+		if err != nil {
+			return httperror.InternalServerError("Unable to retrieve a resource control associated to the custom template", err)
+		}
+
+		securityContext, err := security.RetrieveRestrictedRequestContext(r)
+		if err != nil {
+			return httperror.InternalServerError("Unable to retrieve user info from request context", err)
+		}
+
+		customTemplate.ResourceControl = resourceControl
+		canEdit := userCanEditTemplate(customTemplate, securityContext)
+		hasAccess := false
+
+		if resourceControl != nil {
+			teamIDs := slicesx.Map(securityContext.UserMemberships, func(m portainer.TeamMembership) portainer.TeamID {
+				return m.TeamID
+			})
+
+			hasAccess = authorization.UserCanAccessResource(securityContext.UserID, teamIDs, resourceControl)
+		}
+
+		if canEdit || hasAccess {
+			return nil
+		}
+
+		return httperror.Forbidden("Access denied to resource", httperrors.ErrResourceAccessDenied)
+	}); err != nil {
+		return response.TxErrorResponse(err)
+	}
+
+	entryPath := customTemplate.EntryPoint
+	if customTemplate.Artifact != nil && len(customTemplate.Artifact.Files) > 0 {
+		entryPath = customTemplate.Artifact.Files[0].Path
+	}
+	fileContent, err := handler.FileService.GetFileContent(customTemplate.ProjectPath, entryPath)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve custom template file from disk", err)
+	}
+
+	return response.JSON(w, &fileResponse{FileContent: string(fileContent)})
+}
diff --git a/api/http/handler/customtemplates/customtemplate_file_test.go b/api/http/handler/customtemplates/customtemplate_file_test.go
new file mode 100644
index 0000000..977df0f
--- /dev/null
+++ b/api/http/handler/customtemplates/customtemplate_file_test.go
@@ -0,0 +1,184 @@
+package customtemplates
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+
+	"github.com/gorilla/mux"
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/require"
+)
+
+func TestCustomTemplateFile(t *testing.T) {
+	t.Parallel()
+
+	handler, ds, fs := newTestHandler(t)
+
+	templateContent := "some template content"
+	templateEntrypoint := "entrypoint"
+
+	require.NoError(t, ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		// template 1
+		path, err := fs.StoreCustomTemplateFileFromBytes("1", templateEntrypoint, []byte(templateContent))
+		require.NoError(t, err)
+		require.NoError(t, tx.CustomTemplate().Create(&portainer.CustomTemplate{ID: 1, EntryPoint: templateEntrypoint, ProjectPath: path}))
+
+		// template 2
+		path, err = fs.StoreCustomTemplateFileFromBytes("2", templateEntrypoint, []byte(templateContent))
+		require.NoError(t, err)
+		require.NoError(t, tx.CustomTemplate().Create(&portainer.CustomTemplate{ID: 2, EntryPoint: templateEntrypoint, ProjectPath: path}))
+
+		require.NoError(t, tx.ResourceControl().Create(&portainer.ResourceControl{
+			ID: 1, ResourceID: "2", Type: portainer.CustomTemplateResourceControl,
+			UserAccesses: []portainer.UserResourceAccess{{UserID: 2}},
+			TeamAccesses: []portainer.TeamResourceAccess{{TeamID: 1}},
+		}))
+		return nil
+	}))
+
+	test := func(templateID string, restrictedContext *security.RestrictedRequestContext) (*httptest.ResponseRecorder, *httperror.HandlerError) {
+		r := httptest.NewRequest(http.MethodGet, "/custom_templates/"+templateID+"/file", nil)
+		r = mux.SetURLVars(r, map[string]string{"id": templateID})
+		ctx := security.StoreRestrictedRequestContext(r, restrictedContext)
+		r = r.WithContext(ctx)
+		rr := httptest.NewRecorder()
+		return rr, handler.customTemplateFile(rr, r)
+	}
+
+	t.Run("unknown id should get not found error", func(t *testing.T) {
+		_, r := test("0", &security.RestrictedRequestContext{UserID: 1})
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusNotFound, r.StatusCode)
+	})
+
+	t.Run("admin should access adminonly template", func(t *testing.T) {
+		rr, r := test("1", &security.RestrictedRequestContext{UserID: 1, IsAdmin: true})
+		require.Nil(t, r)
+		require.Equal(t, http.StatusOK, rr.Result().StatusCode)
+
+		var res struct{ FileContent string }
+		require.NoError(t, json.NewDecoder(rr.Body).Decode(&res))
+		require.Equal(t, templateContent, res.FileContent)
+	})
+
+	t.Run("std should not access adminonly template", func(t *testing.T) {
+		_, r := test("1", &security.RestrictedRequestContext{UserID: 2})
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusForbidden, r.StatusCode)
+	})
+
+	t.Run("std should access template via direct user access", func(t *testing.T) {
+		rr, r := test("2", &security.RestrictedRequestContext{UserID: 2})
+		require.Nil(t, r)
+		require.Equal(t, http.StatusOK, rr.Result().StatusCode)
+
+		var res struct{ FileContent string }
+		require.NoError(t, json.NewDecoder(rr.Body).Decode(&res))
+		require.Equal(t, templateContent, res.FileContent)
+	})
+
+	t.Run("std should access template via team access", func(t *testing.T) {
+		rr, r := test("2", &security.RestrictedRequestContext{UserID: 3, UserMemberships: []portainer.TeamMembership{{ID: 1, UserID: 3, TeamID: 1}}})
+		require.Nil(t, r)
+		require.Equal(t, http.StatusOK, rr.Result().StatusCode)
+
+		var res struct{ FileContent string }
+		require.NoError(t, json.NewDecoder(rr.Body).Decode(&res))
+		require.Equal(t, templateContent, res.FileContent)
+	})
+
+	t.Run("std should not access template without access", func(t *testing.T) {
+		_, r := test("2", &security.RestrictedRequestContext{UserID: 4})
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusForbidden, r.StatusCode)
+	})
+}
+
+func TestCustomTemplateFile_CreatorDeniedWhenAdminOnly(t *testing.T) {
+	t.Parallel()
+
+	handler, store, fs := newTestHandler(t)
+
+	err := store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		path, err := fs.StoreCustomTemplateFileFromBytes("5", "entrypoint", []byte("content"))
+		require.NoError(t, err)
+
+		err = tx.CustomTemplate().Create(&portainer.CustomTemplate{
+			ID:              5,
+			EntryPoint:      "entrypoint",
+			ProjectPath:     path,
+			CreatedByUserID: 2,
+		})
+		require.NoError(t, err)
+
+		err = tx.ResourceControl().Create(&portainer.ResourceControl{
+			ID:                 5,
+			ResourceID:         "5",
+			Type:               portainer.CustomTemplateResourceControl,
+			AdministratorsOnly: true,
+		})
+		require.NoError(t, err)
+
+		return nil
+	})
+	require.NoError(t, err)
+
+	r := httptest.NewRequest(http.MethodGet, "/custom_templates/5/file", nil)
+	r = mux.SetURLVars(r, map[string]string{"id": "5"})
+	r = r.WithContext(security.StoreRestrictedRequestContext(r, &security.RestrictedRequestContext{UserID: 2}))
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateFile(rr, r)
+	require.NotNil(t, herr)
+	require.Equal(t, http.StatusForbidden, herr.StatusCode)
+}
+
+func TestCustomTemplateFile_GitTemplate(t *testing.T) {
+	t.Parallel()
+
+	handler, ds, fs := newTestHandler(t)
+
+	templateContent := "git template content"
+	configFilePath := "docker-compose.yml"
+
+	require.NoError(t, ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		src := &portainer.Source{
+			Type: portainer.SourceTypeGit,
+			Git:  &gittypes.GitSource{URL: "https://github.com/example/repo"},
+		}
+		err := tx.Source().Create(adminUserContext, src)
+		require.NoError(t, err)
+
+		path, err := fs.StoreCustomTemplateFileFromBytes("10", configFilePath, []byte(templateContent))
+		require.NoError(t, err)
+
+		return tx.CustomTemplate().Create(&portainer.CustomTemplate{
+			ID:          10,
+			EntryPoint:  "should-not-be-used.yml",
+			ProjectPath: path,
+			Artifact: &portainer.Artifact{
+				Files: []portainer.ArtifactFile{{Path: configFilePath, SourceID: src.ID}},
+			},
+		})
+	}))
+
+	r := httptest.NewRequest(http.MethodGet, "/custom_templates/10/file", nil)
+	r = mux.SetURLVars(r, map[string]string{"id": "10"})
+	ctx := security.StoreRestrictedRequestContext(r, &security.RestrictedRequestContext{UserID: 1, IsAdmin: true})
+	r = r.WithContext(ctx)
+	rr := httptest.NewRecorder()
+	herr := handler.customTemplateFile(rr, r)
+	require.Nil(t, herr)
+	require.Equal(t, http.StatusOK, rr.Result().StatusCode)
+
+	var res struct{ FileContent string }
+	require.NoError(t, json.NewDecoder(rr.Body).Decode(&res))
+	require.Equal(t, templateContent, res.FileContent)
+}
diff --git a/api/http/handler/customtemplates/customtemplate_git_fetch.go b/api/http/handler/customtemplates/customtemplate_git_fetch.go
new file mode 100644
index 0000000..b9c4e80
--- /dev/null
+++ b/api/http/handler/customtemplates/customtemplate_git_fetch.go
@@ -0,0 +1,162 @@
+package customtemplates
+
+import (
+	"context"
+	"net/http"
+	"os"
+	"sync"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/dataservices/source"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+
+	"github.com/rs/zerolog/log"
+)
+
+// @id CustomTemplateGitFetch
+// @summary Fetch the latest config file content based on custom template's git repository configuration
+// @description Retrieve details about a template created from git repository method.
+// @description **Access policy**: authenticated
+// @tags custom_templates
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param id path int true "Template identifier"
+// @success 200 {object} fileResponse "Success"
+// @failure 400 "Invalid request"
+// @failure 404 "Custom template not found"
+// @failure 500 "Server error"
+// @router /custom_templates/{id}/git_fetch [put]
+func (handler *Handler) customTemplateGitFetch(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	customTemplateID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid Custom template identifier route variable", err)
+	}
+
+	customTemplate, err := handler.DataStore.CustomTemplate().Read(portainer.CustomTemplateID(customTemplateID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find a custom template with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find a custom template with the specified identifier inside the database", err)
+	}
+
+	if customTemplate.Artifact == nil || len(customTemplate.Artifact.Files) == 0 {
+		return httperror.BadRequest("Git configuration does not exist in this custom template", nil)
+	}
+
+	file := customTemplate.Artifact.Files[0]
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	var src *portainer.Source
+	if err := handler.DataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
+		var err error
+
+		userContext := source.NewUserContext(securityContext.User, securityContext.UserMemberships)
+		src, err = tx.Source().Read(userContext, file.SourceID)
+		if err != nil {
+			return httperror.InternalServerError("Unable to retrieve git source for custom template", err)
+		}
+		return nil
+	}); err != nil {
+		return response.TxErrorResponse(err)
+	}
+
+	if src.Git == nil {
+		return httperror.InternalServerError("Source has no git configuration", nil)
+	}
+
+	gitConfig := &gittypes.RepoConfig{
+		URL:            src.Git.URL,
+		Authentication: src.Git.Authentication,
+		TLSSkipVerify:  src.Git.TLSSkipVerify,
+		ReferenceName:  file.Ref,
+		ConfigFilePath: file.Path,
+		ConfigHash:     file.Hash,
+	}
+
+	// If multiple users are trying to fetch the same custom template simultaneously, a lock needs to be added
+	mu, ok := handler.gitFetchMutexs[portainer.TemplateID(customTemplateID)]
+	if !ok {
+		mu = &sync.Mutex{}
+		handler.gitFetchMutexs[portainer.TemplateID(customTemplateID)] = mu
+	}
+	mu.Lock()
+	defer mu.Unlock()
+
+	// back up the current custom template folder
+	backupPath, err := backupCustomTemplate(customTemplate.ProjectPath)
+	if err != nil {
+		return httperror.InternalServerError("Failed to backup the custom template folder", err)
+	}
+
+	// remove backup custom template folder
+	defer func() {
+		if err := cleanUpBackupCustomTemplate(backupPath); err != nil {
+			log.Warn().Err(err).Msg("failed to remove backup custom template folder")
+		}
+	}()
+
+	commitHash, err := stackutils.DownloadGitRepository(context.TODO(), *gitConfig, handler.GitService, func() string {
+		return customTemplate.ProjectPath
+	})
+	if err != nil {
+		log.Warn().Err(err).Msg("failed to download git repository")
+
+		if rbErr := rollbackCustomTemplate(backupPath, customTemplate.ProjectPath); rbErr != nil {
+			return httperror.InternalServerError("Failed to rollback the custom template folder", rbErr)
+		}
+
+		return httperror.InternalServerError("Failed to download git repository", err)
+	}
+
+	if customTemplate.Artifact.Files[0].Hash != commitHash {
+		customTemplate.Artifact.Files[0].Hash = commitHash
+
+		if err := handler.DataStore.CustomTemplate().Update(customTemplate.ID, customTemplate); err != nil {
+			return httperror.InternalServerError("Unable to persist custom template changes inside the database", err)
+		}
+	}
+
+	fileContent, err := handler.FileService.GetFileContent(customTemplate.ProjectPath, gitConfig.ConfigFilePath)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve custom template file from disk", err)
+	}
+
+	return response.JSON(w, &fileResponse{FileContent: string(fileContent)})
+}
+
+func backupCustomTemplate(projectPath string) (string, error) {
+	stat, err := os.Stat(projectPath)
+	if err != nil {
+		return "", err
+	}
+
+	backupPath := projectPath + "-backup"
+	if err := os.Rename(projectPath, backupPath); err != nil {
+		return "", err
+	}
+
+	return backupPath, os.Mkdir(projectPath, stat.Mode())
+}
+
+func rollbackCustomTemplate(backupPath, projectPath string) error {
+	if err := os.RemoveAll(projectPath); err != nil {
+		return err
+	}
+
+	return os.Rename(backupPath, projectPath)
+}
+
+func cleanUpBackupCustomTemplate(backupPath string) error {
+	return os.RemoveAll(backupPath)
+}
diff --git a/api/http/handler/customtemplates/customtemplate_git_fetch_test.go b/api/http/handler/customtemplates/customtemplate_git_fetch_test.go
new file mode 100644
index 0000000..c4d2696
--- /dev/null
+++ b/api/http/handler/customtemplates/customtemplate_git_fetch_test.go
@@ -0,0 +1,339 @@
+package customtemplates
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"io"
+	"io/fs"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"testing"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/filesystem"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+	"github.com/portainer/portainer/api/jwt"
+	"github.com/portainer/portainer/api/logs"
+	"github.com/portainer/portainer/pkg/fips"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/sync/errgroup"
+)
+
+func init() {
+	fips.InitFIPS(false)
+}
+
+var testFileContent = "abcdefg"
+
+type TestGitService struct {
+	portainer.GitService
+	targetFilePath string
+}
+
+func (g *TestGitService) CloneRepository(
+	_ context.Context,
+	destination string,
+	repositoryURL,
+	referenceName string,
+	username,
+	password string,
+	tlsSkipVerify bool,
+) error {
+	time.Sleep(100 * time.Millisecond)
+
+	return createTestFile(g.targetFilePath)
+}
+
+func (g *TestGitService) LatestCommitID(
+	_ context.Context,
+	repositoryURL,
+	referenceName,
+	username,
+	password string,
+	tlsSkipVerify bool,
+) (string, error) {
+	return "", nil
+}
+
+type TestFileService struct {
+	portainer.FileService
+}
+
+func (f *TestFileService) GetFileContent(projectPath, configFilePath string) ([]byte, error) {
+	return os.ReadFile(filesystem.JoinPaths(projectPath, configFilePath))
+}
+
+type InvalidTestGitService struct {
+	portainer.GitService
+	targetFilePath string
+}
+
+func (g *InvalidTestGitService) CloneRepository(
+	_ context.Context,
+	dest,
+	repoUrl,
+	refName,
+	username,
+	password string,
+	tlsSkipVerify bool,
+) error {
+	return errors.New("simulate network error")
+}
+
+func (g *InvalidTestGitService) LatestCommitID(
+	_ context.Context,
+	repositoryURL,
+	referenceName,
+	username,
+	password string,
+	tlsSkipVerify bool,
+) (string, error) {
+	return "", nil
+}
+
+func createTestFile(targetPath string) error {
+	f, err := os.Create(targetPath)
+	if err != nil {
+		return err
+	}
+	defer logs.CloseAndLogErr(f)
+
+	_, err = f.WriteString(testFileContent)
+
+	return err
+}
+
+func prepareTestFolder(projectPath, filename string) error {
+	if err := os.MkdirAll(projectPath, fs.ModePerm); err != nil {
+		return err
+	}
+
+	return createTestFile(filesystem.JoinPaths(projectPath, filename))
+}
+
+func singleAPIRequest(h *Handler, jwt string, expect string) error {
+	type response struct {
+		FileContent string
+	}
+
+	req := httptest.NewRequest(http.MethodPut, "/custom_templates/1/git_fetch", bytes.NewBufferString("{}"))
+	testhelpers.AddTestSecurityCookie(req, jwt)
+
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, req)
+
+	if rr.Code != http.StatusOK {
+		return errors.New("unexpected status code: " + http.StatusText(rr.Code))
+	}
+
+	body, err := io.ReadAll(rr.Body)
+	if err != nil {
+		return err
+	}
+
+	var resp response
+	if err := json.Unmarshal(body, &resp); err != nil {
+		return err
+	}
+
+	if resp.FileContent != expect {
+		return errors.New("unexpected file content: " + resp.FileContent + ", expected: " + expect)
+	}
+
+	return nil
+}
+
+func Test_customTemplateGitFetch(t *testing.T) {
+	t.Parallel()
+
+	is := assert.New(t)
+
+	_, store := datastore.MustNewTestStore(t, true, true)
+
+	// create user(s)
+	user1 := &portainer.User{ID: 1, Username: "user-1", Role: portainer.StandardUserRole, PortainerAuthorizations: authorization.DefaultPortainerAuthorizations()}
+	err := store.User().Create(user1)
+	require.NoError(t, err, "error creating user 1")
+
+	user2 := &portainer.User{ID: 2, Username: "user-2", Role: portainer.StandardUserRole, PortainerAuthorizations: authorization.DefaultPortainerAuthorizations()}
+	err = store.User().Create(user2)
+	require.NoError(t, err, "error creating user 2")
+
+	dir, err := os.Getwd()
+	require.NoError(t, err, "error to get working directory")
+
+	src := &portainer.Source{
+		ID:     1,
+		Type:   portainer.SourceTypeGit,
+		Public: true,
+		Git: &gittypes.GitSource{
+			URL: "https://github.com/example/repo",
+		},
+	}
+	err = store.Source().Create(adminUserContext, src)
+	require.NoError(t, err, "error creating source")
+
+	const configFilePath = "test-config-path.txt"
+
+	template1 := &portainer.CustomTemplate{
+		ID:          1,
+		Title:       "custom-template-1",
+		ProjectPath: filesystem.JoinPaths(dir, "fixtures/custom_template_1"),
+		Artifact: &portainer.Artifact{
+			Files: []portainer.ArtifactFile{{Path: configFilePath, SourceID: src.ID}},
+		},
+	}
+	err = store.CustomTemplateService.Create(template1)
+	require.NoError(t, err, "error creating custom template 1")
+
+	// prepare testing folder
+	err = prepareTestFolder(template1.ProjectPath, configFilePath)
+	require.NoError(t, err, "error creating testing folder")
+
+	defer func() {
+		err := os.RemoveAll(filesystem.JoinPaths(dir, "fixtures"))
+		require.NoError(t, err)
+	}()
+
+	// setup services
+	jwtService, err := jwt.NewService("1h", store)
+	require.NoError(t, err, "Error initiating jwt service")
+
+	requestBouncer := security.NewRequestBouncer(t.Context(), store, jwtService, nil)
+
+	gitService := &TestGitService{
+		targetFilePath: filesystem.JoinPaths(template1.ProjectPath, configFilePath),
+	}
+	fileService := &TestFileService{}
+
+	h := NewHandler(requestBouncer, store, fileService, gitService)
+
+	// generate two standard users' tokens
+	jwt1, _, err := jwtService.GenerateToken(&portainer.TokenData{ID: user1.ID, Username: user1.Username, Role: user1.Role})
+	require.NoError(t, err)
+
+	jwt2, _, err := jwtService.GenerateToken(&portainer.TokenData{ID: user2.ID, Username: user2.Username, Role: user2.Role})
+	require.NoError(t, err)
+
+	t.Run("can return the expected file content by a single call from one user", func(t *testing.T) {
+		err := singleAPIRequest(h, jwt1, "abcdefg")
+		require.NoError(t, err)
+	})
+
+	t.Run("can return the expected file content by multiple calls from one user", func(t *testing.T) {
+		var g errgroup.Group
+
+		for range 5 {
+			g.Go(func() error {
+				return singleAPIRequest(h, jwt1, "abcdefg")
+			})
+		}
+
+		err := g.Wait()
+		require.NoError(t, err)
+	})
+
+	t.Run("can return the expected file content by multiple calls from different users", func(t *testing.T) {
+		var g errgroup.Group
+
+		for i := range 10 {
+			g.Go(func() error {
+				if i%2 == 0 {
+					return singleAPIRequest(h, jwt1, "abcdefg")
+				}
+
+				return singleAPIRequest(h, jwt2, "abcdefg")
+			})
+		}
+
+		err := g.Wait()
+		require.NoError(t, err)
+	})
+
+	t.Run("can return the expected file content after a new commit is made", func(t *testing.T) {
+		err := singleAPIRequest(h, jwt1, "abcdefg")
+		require.NoError(t, err)
+
+		testFileContent = "gfedcba"
+
+		err = singleAPIRequest(h, jwt2, "gfedcba")
+		require.NoError(t, err)
+	})
+
+	t.Run("restore git repository if it is failed to download the new git repository", func(t *testing.T) {
+		invalidGitService := &InvalidTestGitService{
+			targetFilePath: filesystem.JoinPaths(template1.ProjectPath, configFilePath),
+		}
+		h := NewHandler(requestBouncer, store, fileService, invalidGitService)
+
+		req := httptest.NewRequest(http.MethodPut, "/custom_templates/1/git_fetch", bytes.NewBufferString("{}"))
+		testhelpers.AddTestSecurityCookie(req, jwt1)
+
+		rr := httptest.NewRecorder()
+		h.ServeHTTP(rr, req)
+
+		is.Equal(http.StatusInternalServerError, rr.Code)
+
+		var errResp httperror.HandlerError
+		err = json.NewDecoder(rr.Body).Decode(&errResp)
+		require.NoError(t, err, "failed to parse error body")
+
+		assert.FileExists(t, gitService.targetFilePath, "previous git repository is not restored")
+		fileContent, err := os.ReadFile(gitService.targetFilePath)
+		require.NoError(t, err, "failed to read target file")
+		assert.Equal(t, "gfedcba", string(fileContent))
+	})
+}
+
+func TestCustomTemplateGitFetch_NilArtifactReturnsBadRequest(t *testing.T) {
+	t.Parallel()
+
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	template := &portainer.CustomTemplate{ID: 1, Title: "no-git-template"}
+	err := store.CustomTemplateService.Create(template)
+	require.NoError(t, err)
+
+	h := NewHandler(testhelpers.NewTestRequestBouncer(), store, &TestFileService{}, &TestGitService{})
+
+	req := httptest.NewRequest(http.MethodPut, "/custom_templates/1/git_fetch", bytes.NewBufferString("{}"))
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, req)
+
+	require.Equal(t, http.StatusBadRequest, rr.Code)
+}
+
+func TestCustomTemplateGitFetch_EmptySourceIDsReturnsBadRequest(t *testing.T) {
+	t.Parallel()
+
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	template := &portainer.CustomTemplate{
+		ID:    1,
+		Title: "empty-source-ids",
+		Artifact: &portainer.Artifact{
+			Files: []portainer.ArtifactFile{},
+		},
+	}
+	err := store.CustomTemplateService.Create(template)
+	require.NoError(t, err)
+
+	h := NewHandler(testhelpers.NewTestRequestBouncer(), store, &TestFileService{}, &TestGitService{})
+
+	req := httptest.NewRequest(http.MethodPut, "/custom_templates/1/git_fetch", bytes.NewBufferString("{}"))
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, req)
+
+	require.Equal(t, http.StatusBadRequest, rr.Code)
+}
diff --git a/api/http/handler/customtemplates/customtemplate_inspect.go b/api/http/handler/customtemplates/customtemplate_inspect.go
new file mode 100644
index 0000000..47863a4
--- /dev/null
+++ b/api/http/handler/customtemplates/customtemplate_inspect.go
@@ -0,0 +1,81 @@
+package customtemplates
+
+import (
+	"net/http"
+	"strconv"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/dataservices/source"
+	httperrors "github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/slicesx"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id CustomTemplateInspect
+// @summary Inspect a custom template
+// @description Retrieve details about a template.
+// @description **Access policy**: authenticated
+// @tags custom_templates
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param id path int true "Template identifier"
+// @success 200 {object} portainer.CustomTemplate "Success"
+// @failure 400 "Invalid request"
+// @failure 404 "Template not found"
+// @failure 500 "Server error"
+// @router /custom_templates/{id} [get]
+func (handler *Handler) customTemplateInspect(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	customTemplateID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid Custom template identifier route variable", err)
+	}
+
+	var customTemplate *portainer.CustomTemplate
+	err = handler.DataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
+		customTemplate, err = tx.CustomTemplate().Read(portainer.CustomTemplateID(customTemplateID))
+		if tx.IsErrObjectNotFound(err) {
+			return httperror.NotFound("Unable to find a custom template with the specified identifier inside the database", err)
+		} else if err != nil {
+			return httperror.InternalServerError("Unable to find a custom template with the specified identifier inside the database", err)
+		}
+
+		resourceControl, err := tx.ResourceControl().ResourceControlByResourceIDAndType(strconv.Itoa(customTemplateID), portainer.CustomTemplateResourceControl)
+		if err != nil {
+			return httperror.InternalServerError("Unable to retrieve a resource control associated to the custom template", err)
+		}
+
+		securityContext, err := security.RetrieveRestrictedRequestContext(r)
+		if err != nil {
+			return httperror.InternalServerError("Unable to retrieve user info from request context", err)
+		}
+
+		customTemplate.ResourceControl = resourceControl
+		canEdit := userCanEditTemplate(customTemplate, securityContext)
+		hasAccess := false
+
+		if resourceControl != nil {
+			teamIDs := slicesx.Map(securityContext.UserMemberships, func(m portainer.TeamMembership) portainer.TeamID {
+				return m.TeamID
+			})
+
+			hasAccess = authorization.UserCanAccessResource(securityContext.UserID, teamIDs, resourceControl)
+		}
+
+		if !canEdit && !hasAccess {
+			return httperror.Forbidden("Access denied to resource", httperrors.ErrResourceAccessDenied)
+		}
+
+		userContext := source.NewUserContext(securityContext.User, securityContext.UserMemberships)
+		populateGitConfig(tx, userContext, customTemplate)
+
+		return nil
+	})
+
+	return response.TxResponse(w, customTemplate, err)
+}
diff --git a/api/http/handler/customtemplates/customtemplate_inspect_test.go b/api/http/handler/customtemplates/customtemplate_inspect_test.go
new file mode 100644
index 0000000..47dd9cb
--- /dev/null
+++ b/api/http/handler/customtemplates/customtemplate_inspect_test.go
@@ -0,0 +1,212 @@
+package customtemplates
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/filesystem"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+
+	"github.com/gorilla/mux"
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/require"
+)
+
+// newTestHandler creates a handler with a test datastore, filesystem service, and common fixtures:
+// admin user (ID=1), standard users (ID=2,3,4), endpoint (ID=1) with access for users 2 and 3,
+// team (ID=1), and team membership for user 3.
+func newTestHandler(t *testing.T) (*Handler, dataservices.DataStore, portainer.FileService) {
+	t.Helper()
+
+	_, ds := datastore.MustNewTestStore(t, true, false)
+
+	fs, err := filesystem.NewService(t.TempDir(), t.TempDir())
+	require.NoError(t, err)
+
+	require.NoError(t, ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		require.NoError(t, tx.User().Create(&portainer.User{ID: 1, Username: "admin", Role: portainer.AdministratorRole}))
+		require.NoError(t, tx.User().Create(&portainer.User{ID: 2, Username: "std2", Role: portainer.StandardUserRole}))
+		require.NoError(t, tx.User().Create(&portainer.User{ID: 3, Username: "std3", Role: portainer.StandardUserRole}))
+		require.NoError(t, tx.User().Create(&portainer.User{ID: 4, Username: "std4", Role: portainer.StandardUserRole}))
+		require.NoError(t, tx.Endpoint().Create(&portainer.Endpoint{
+			ID: 1,
+			UserAccessPolicies: portainer.UserAccessPolicies{
+				2: portainer.AccessPolicy{RoleID: 0},
+				3: portainer.AccessPolicy{RoleID: 0},
+			},
+		}))
+		require.NoError(t, tx.Team().Create(&portainer.Team{ID: 1}))
+		require.NoError(t, tx.TeamMembership().Create(&portainer.TeamMembership{ID: 1, UserID: 3, TeamID: 1, Role: portainer.TeamMember}))
+		return nil
+	}))
+
+	handler := NewHandler(testhelpers.NewTestRequestBouncer(), ds, fs, nil)
+
+	return handler, ds, fs
+}
+
+func TestInspectHandler(t *testing.T) {
+	t.Parallel()
+
+	handler, ds, _ := newTestHandler(t)
+
+	require.NoError(t, ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		require.NoError(t, tx.CustomTemplate().Create(&portainer.CustomTemplate{ID: 1}))
+		require.NoError(t, tx.CustomTemplate().Create(&portainer.CustomTemplate{ID: 2}))
+		require.NoError(t, tx.ResourceControl().Create(&portainer.ResourceControl{
+			ID: 1, ResourceID: "2", Type: portainer.CustomTemplateResourceControl,
+			UserAccesses: []portainer.UserResourceAccess{{UserID: 2}},
+			TeamAccesses: []portainer.TeamResourceAccess{{TeamID: 1}},
+		}))
+		return nil
+	}))
+
+	test := func(templateID string, restrictedContext *security.RestrictedRequestContext) (*httptest.ResponseRecorder, *httperror.HandlerError) {
+		r := httptest.NewRequest(http.MethodGet, "/custom_templates/"+templateID, nil)
+		r = mux.SetURLVars(r, map[string]string{"id": templateID})
+		ctx := security.StoreRestrictedRequestContext(r, restrictedContext)
+		r = r.WithContext(ctx)
+		rr := httptest.NewRecorder()
+		return rr, handler.customTemplateInspect(rr, r)
+	}
+
+	t.Run("unknown id should get not found error", func(t *testing.T) {
+		_, r := test("0", &security.RestrictedRequestContext{UserID: 1, User: &portainer.User{ID: 1, Role: portainer.AdministratorRole}})
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusNotFound, r.StatusCode)
+	})
+
+	t.Run("admin should access adminonly template", func(t *testing.T) {
+		rr, r := test("1", &security.RestrictedRequestContext{UserID: 1, IsAdmin: true, User: &portainer.User{ID: 1, Role: portainer.AdministratorRole}})
+		require.Nil(t, r)
+		require.Equal(t, http.StatusOK, rr.Result().StatusCode)
+
+		var template portainer.CustomTemplate
+		require.NoError(t, json.NewDecoder(rr.Body).Decode(&template))
+		require.Equal(t, portainer.CustomTemplateID(1), template.ID)
+	})
+
+	t.Run("std should not access adminonly template", func(t *testing.T) {
+		_, r := test("1", &security.RestrictedRequestContext{UserID: 2, User: &portainer.User{ID: 2, Role: portainer.StandardUserRole}})
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusForbidden, r.StatusCode)
+	})
+
+	t.Run("std should access template via direct user access", func(t *testing.T) {
+		rr, r := test("2", &security.RestrictedRequestContext{UserID: 2, User: &portainer.User{ID: 2, Role: portainer.StandardUserRole}})
+		require.Nil(t, r)
+		require.Equal(t, http.StatusOK, rr.Result().StatusCode)
+
+		var template portainer.CustomTemplate
+		require.NoError(t, json.NewDecoder(rr.Body).Decode(&template))
+		require.Equal(t, portainer.CustomTemplateID(2), template.ID)
+	})
+
+	t.Run("std should access template via team access", func(t *testing.T) {
+		rr, r := test("2", &security.RestrictedRequestContext{UserID: 3, User: &portainer.User{ID: 3, Role: portainer.StandardUserRole}, UserMemberships: []portainer.TeamMembership{{ID: 1, UserID: 3, TeamID: 1}}})
+		require.Nil(t, r)
+		require.Equal(t, http.StatusOK, rr.Result().StatusCode)
+
+		var template portainer.CustomTemplate
+		require.NoError(t, json.NewDecoder(rr.Body).Decode(&template))
+		require.Equal(t, portainer.CustomTemplateID(2), template.ID)
+	})
+
+	t.Run("std should not access template without access", func(t *testing.T) {
+		_, r := test("2", &security.RestrictedRequestContext{UserID: 4, User: &portainer.User{ID: 4, Role: portainer.StandardUserRole}})
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusForbidden, r.StatusCode)
+	})
+}
+
+func TestInspectHandler_CreatorDeniedWhenAdminOnly(t *testing.T) {
+	t.Parallel()
+
+	handler, store, _ := newTestHandler(t)
+
+	err := store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		err := tx.CustomTemplate().Create(&portainer.CustomTemplate{
+			ID:              5,
+			CreatedByUserID: 2,
+		})
+		require.NoError(t, err)
+
+		err = tx.ResourceControl().Create(&portainer.ResourceControl{
+			ID:                 5,
+			ResourceID:         "5",
+			Type:               portainer.CustomTemplateResourceControl,
+			AdministratorsOnly: true,
+		})
+		require.NoError(t, err)
+
+		return nil
+	})
+	require.NoError(t, err)
+
+	r := httptest.NewRequest(http.MethodGet, "/custom_templates/5", nil)
+	r = mux.SetURLVars(r, map[string]string{"id": "5"})
+	r = r.WithContext(security.StoreRestrictedRequestContext(r, &security.RestrictedRequestContext{UserID: 2, User: &portainer.User{ID: 2, Role: portainer.StandardUserRole}}))
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateInspect(rr, r)
+	require.NotNil(t, herr)
+	require.Equal(t, http.StatusForbidden, herr.StatusCode)
+}
+
+func TestInspectHandler_GitConfigPopulatedFromSource(t *testing.T) {
+	t.Parallel()
+
+	handler, ds, _ := newTestHandler(t)
+
+	var srcID portainer.SourceID
+	require.NoError(t, ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		src := &portainer.Source{
+			Type: portainer.SourceTypeGit,
+			Git: &gittypes.GitSource{
+				URL:           "https://github.com/example/repo",
+				TLSSkipVerify: true,
+			},
+		}
+		err := tx.Source().Create(adminUserContext, src)
+		require.NoError(t, err)
+
+		srcID = src.ID
+
+		return tx.CustomTemplate().Create(&portainer.CustomTemplate{
+			ID: 10,
+			Artifact: &portainer.Artifact{
+				Files: []portainer.ArtifactFile{{
+					Ref:      "refs/heads/main",
+					Path:     "docker-compose.yml",
+					Hash:     "abc123",
+					SourceID: srcID,
+				}},
+			},
+		})
+	}))
+
+	r := httptest.NewRequest(http.MethodGet, "/custom_templates/10", nil)
+	r = mux.SetURLVars(r, map[string]string{"id": "10"})
+	ctx := security.StoreRestrictedRequestContext(r, &security.RestrictedRequestContext{UserID: 1, IsAdmin: true, User: &portainer.User{ID: 1, Role: portainer.AdministratorRole}})
+	r = r.WithContext(ctx)
+	rr := httptest.NewRecorder()
+	herr := handler.customTemplateInspect(rr, r)
+	require.Nil(t, herr)
+	require.Equal(t, http.StatusOK, rr.Result().StatusCode)
+
+	var template portainer.CustomTemplate
+	require.NoError(t, json.NewDecoder(rr.Body).Decode(&template))
+	require.NotNil(t, template.GitConfig)
+	require.Equal(t, "https://github.com/example/repo", template.GitConfig.URL)
+	require.True(t, template.GitConfig.TLSSkipVerify)
+	require.Equal(t, "refs/heads/main", template.GitConfig.ReferenceName)
+	require.Equal(t, "docker-compose.yml", template.GitConfig.ConfigFilePath)
+	require.Equal(t, "abc123", template.GitConfig.ConfigHash)
+}
diff --git a/api/http/handler/customtemplates/customtemplate_list.go b/api/http/handler/customtemplates/customtemplate_list.go
new file mode 100644
index 0000000..5c50203
--- /dev/null
+++ b/api/http/handler/customtemplates/customtemplate_list.go
@@ -0,0 +1,150 @@
+package customtemplates
+
+import (
+	"net/http"
+	"strconv"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/dataservices/source"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/slicesx"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+
+	"github.com/pkg/errors"
+	"github.com/rs/zerolog/log"
+)
+
+// @id CustomTemplateList
+// @summary List available custom templates
+// @description List available custom templates.
+// @description **Access policy**: authenticated
+// @tags custom_templates
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param type query []int true "Template types" Enums(1,2,3)
+// @param edge query boolean false "Filter by edge templates"
+// @success 200 {array} portainer.CustomTemplate "Success"
+// @failure 500 "Server error"
+// @router /custom_templates [get]
+func (handler *Handler) customTemplateList(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	templateTypes, err := parseTemplateTypes(r)
+	if err != nil {
+		return httperror.BadRequest("Invalid Custom template type", err)
+	}
+
+	edge := retrieveEdgeParam(r)
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	var customTemplates []portainer.CustomTemplate
+	err = handler.DataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
+		var err error
+		customTemplates, err = tx.CustomTemplate().ReadAll()
+		if err != nil {
+			return httperror.InternalServerError("Unable to retrieve custom templates from the database", err)
+		}
+
+		resourceControls, err := tx.ResourceControl().ReadAll()
+		if err != nil {
+			return httperror.InternalServerError("Unable to retrieve resource controls from the database", err)
+		}
+
+		customTemplates = authorization.DecorateCustomTemplates(customTemplates, resourceControls)
+
+		if !securityContext.IsAdmin {
+			user, err := tx.User().Read(securityContext.UserID)
+			if err != nil {
+				return httperror.InternalServerError("Unable to retrieve user information from the database", err)
+			}
+
+			userTeamIDs := authorization.TeamIDs(securityContext.UserMemberships)
+
+			customTemplates = authorization.FilterAuthorizedCustomTemplates(customTemplates, user, userTeamIDs)
+		}
+
+		customTemplates = filterByType(customTemplates, templateTypes)
+
+		if edge != nil {
+			customTemplates = slicesx.FilterInPlace(customTemplates, func(customTemplate portainer.CustomTemplate) bool {
+				return customTemplate.EdgeTemplate == *edge
+			})
+		}
+
+		userContext := source.NewUserContext(securityContext.User, securityContext.UserMemberships)
+		for i := range customTemplates {
+			populateGitConfig(tx, userContext, &customTemplates[i])
+		}
+
+		return nil
+	})
+
+	return response.TxResponse(w, customTemplates, err)
+}
+
+func retrieveEdgeParam(r *http.Request) *bool {
+	var edge *bool
+	edgeParam, _ := request.RetrieveQueryParameter(r, "edge", true)
+	if edgeParam != "" {
+		edgeVal, err := strconv.ParseBool(edgeParam)
+		if err != nil {
+			log.Warn().Err(err).Msg("failed parsing edge param")
+			return nil
+		}
+
+		edge = &edgeVal
+	}
+	return edge
+}
+
+func parseTemplateTypes(r *http.Request) ([]portainer.StackType, error) {
+	err := r.ParseForm()
+	if err != nil {
+		return nil, errors.WithMessage(err, "failed to parse request params")
+	}
+
+	types, exist := r.Form["type"]
+	if !exist {
+		return []portainer.StackType{}, nil
+	}
+
+	res := []portainer.StackType{}
+	for _, templateTypeStr := range types {
+		templateType, err := strconv.Atoi(templateTypeStr)
+		if err != nil {
+			return nil, errors.WithMessage(err, "failed parsing template type")
+		}
+
+		res = append(res, portainer.StackType(templateType))
+	}
+
+	return res, nil
+}
+
+func filterByType(customTemplates []portainer.CustomTemplate, templateTypes []portainer.StackType) []portainer.CustomTemplate {
+	if len(templateTypes) == 0 {
+		return customTemplates
+	}
+
+	typeSet := map[portainer.StackType]bool{}
+	for _, templateType := range templateTypes {
+		typeSet[templateType] = true
+	}
+
+	filtered := []portainer.CustomTemplate{}
+
+	for _, template := range customTemplates {
+		if typeSet[template.Type] {
+			filtered = append(filtered, template)
+		}
+	}
+
+	return filtered
+}
diff --git a/api/http/handler/customtemplates/customtemplate_list_test.go b/api/http/handler/customtemplates/customtemplate_list_test.go
new file mode 100644
index 0000000..55d4773
--- /dev/null
+++ b/api/http/handler/customtemplates/customtemplate_list_test.go
@@ -0,0 +1,127 @@
+package customtemplates
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	"github.com/portainer/portainer/api/http/security"
+
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/require"
+)
+
+func TestCustomTemplateList_PopulatesGitConfigFromSource(t *testing.T) {
+	t.Parallel()
+
+	handler, ds, _ := newTestHandler(t)
+
+	var srcID portainer.SourceID
+	require.NoError(t, ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		src := &portainer.Source{
+			Type: portainer.SourceTypeGit,
+			Git: &gittypes.GitSource{
+				URL:           "https://github.com/example/repo",
+				TLSSkipVerify: true,
+			},
+		}
+		err := tx.Source().Create(adminUserContext, src)
+		require.NoError(t, err)
+		srcID = src.ID
+		require.NoError(t, tx.CustomTemplate().Create(&portainer.CustomTemplate{
+			ID: 1,
+			Artifact: &portainer.Artifact{
+				Files: []portainer.ArtifactFile{{
+					Ref:      "refs/heads/main",
+					Path:     "docker-compose.yml",
+					Hash:     "abc123",
+					SourceID: srcID,
+				}},
+			},
+		}))
+		require.NoError(t, tx.CustomTemplate().Create(&portainer.CustomTemplate{ID: 2, EntryPoint: "docker-compose.yml"}))
+
+		return nil
+	}))
+
+	r := httptest.NewRequest(http.MethodGet, "/custom_templates", nil)
+	r = r.WithContext(security.StoreRestrictedRequestContext(r, &security.RestrictedRequestContext{UserID: 1, IsAdmin: true, User: &portainer.User{ID: 1, Role: portainer.AdministratorRole}}))
+	rr := httptest.NewRecorder()
+	handler.ServeHTTP(rr, r)
+
+	require.Equal(t, http.StatusOK, rr.Code)
+
+	var templates []portainer.CustomTemplate
+	require.NoError(t, json.NewDecoder(rr.Body).Decode(&templates))
+
+	var gitTemplate portainer.CustomTemplate
+	for _, tpl := range templates {
+		if tpl.ID == 1 {
+			gitTemplate = tpl
+		}
+	}
+
+	require.NotNil(t, gitTemplate.GitConfig)
+	require.Equal(t, "https://github.com/example/repo", gitTemplate.GitConfig.URL)
+	require.True(t, gitTemplate.GitConfig.TLSSkipVerify)
+	require.Equal(t, "refs/heads/main", gitTemplate.GitConfig.ReferenceName)
+	require.Equal(t, "docker-compose.yml", gitTemplate.GitConfig.ConfigFilePath)
+	require.Equal(t, "abc123", gitTemplate.GitConfig.ConfigHash)
+
+	var plainTemplate portainer.CustomTemplate
+	for _, tpl := range templates {
+		if tpl.ID == 2 {
+			plainTemplate = tpl
+		}
+	}
+	require.Nil(t, plainTemplate.GitConfig)
+}
+
+func TestCustomTemplateList_StripsPasswordFromGitConfig(t *testing.T) {
+	t.Parallel()
+
+	handler, ds, _ := newTestHandler(t)
+
+	var srcID portainer.SourceID
+	require.NoError(t, ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		src := &portainer.Source{
+			Type: portainer.SourceTypeGit,
+			Git: &gittypes.GitSource{
+				URL: "https://github.com/example/repo",
+				Authentication: &gittypes.GitAuthentication{
+					Username: "user",
+					Password: "topsecret",
+				},
+			},
+		}
+		err := tx.Source().Create(adminUserContext, src)
+		require.NoError(t, err)
+		srcID = src.ID
+		require.NoError(t, tx.CustomTemplate().Create(&portainer.CustomTemplate{
+			ID: 1,
+			Artifact: &portainer.Artifact{
+				Files: []portainer.ArtifactFile{{SourceID: srcID}},
+			},
+		}))
+
+		return nil
+	}))
+
+	r := httptest.NewRequest(http.MethodGet, "/custom_templates", nil)
+	r = r.WithContext(security.StoreRestrictedRequestContext(r, &security.RestrictedRequestContext{UserID: 1, IsAdmin: true, User: &portainer.User{ID: 1, Role: portainer.AdministratorRole}}))
+	rr := httptest.NewRecorder()
+	handler.ServeHTTP(rr, r)
+
+	require.Equal(t, http.StatusOK, rr.Code)
+
+	var templates []portainer.CustomTemplate
+	require.NoError(t, json.NewDecoder(rr.Body).Decode(&templates))
+	require.Len(t, templates, 1)
+	require.NotNil(t, templates[0].GitConfig)
+	require.NotNil(t, templates[0].GitConfig.Authentication)
+	require.Equal(t, "user", templates[0].GitConfig.Authentication.Username)
+	require.Empty(t, templates[0].GitConfig.Authentication.Password)
+}
diff --git a/api/http/handler/customtemplates/customtemplate_update.go b/api/http/handler/customtemplates/customtemplate_update.go
new file mode 100644
index 0000000..6ea3887
--- /dev/null
+++ b/api/http/handler/customtemplates/customtemplate_update.go
@@ -0,0 +1,284 @@
+package customtemplates
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"strconv"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/dataservices/source"
+	"github.com/portainer/portainer/api/filesystem"
+	"github.com/portainer/portainer/api/git"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	"github.com/portainer/portainer/api/gitops/sources"
+	"github.com/portainer/portainer/api/gitops/workflows"
+	httperrors "github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/portainer/portainer/pkg/validate"
+)
+
+type customTemplateUpdatePayload struct {
+	// URL of the template's logo
+	Logo string `example:"https://portainer.io/img/logo.svg"`
+	// Title of the template
+	Title string `example:"Nginx" validate:"required"`
+	// Description of the template
+	Description string `example:"High performance web server" validate:"required"`
+	// A note that will be displayed in the UI. Supports HTML content
+	Note string `example:"This is my <b>custom</b> template"`
+	// Platform associated to the template.
+	// Valid values are: 1 - 'linux', 2 - 'windows'
+	// Required for Docker stacks
+	Platform portainer.CustomTemplatePlatform `example:"1" enums:"1,2"`
+	// Type of created stack (1 - swarm, 2 - compose, 3 - kubernetes)
+	Type portainer.StackType `example:"1" enums:"1,2,3" validate:"required"`
+	// SourceID references an existing Source for git credentials/URL.
+	// When set, the inline URL and authentication fields are ignored.
+	SourceID portainer.SourceID `example:"1"`
+	// Deprecated: use SourceID instead. URL of a Git repository hosting the Stack file.
+	RepositoryURL string `example:"https://github.com/openfaas/faas"`
+	// Reference name of a Git repository hosting the Stack file
+	RepositoryReferenceName string `example:"refs/heads/master"`
+	// Deprecated: use SourceID instead. Use authentication to clone the Git repository.
+	RepositoryAuthentication bool `example:"true"`
+	// Deprecated: use SourceID instead. Username used in basic authentication. Required when RepositoryAuthentication is true.
+	RepositoryUsername string `example:"myGitUsername"`
+	// Deprecated: use SourceID instead. Password used in basic authentication or token used in token authentication. Required when RepositoryAuthentication is true.
+	RepositoryPassword string `example:"myGitPassword"`
+	// Path to the Stack file inside the Git repository
+	ComposeFilePathInRepository string `example:"docker-compose.yml" default:"docker-compose.yml"`
+	// Content of stack file
+	FileContent string `validate:"required"`
+	// Definitions of variables in the stack file
+	Variables []portainer.CustomTemplateVariableDefinition
+	// Deprecated: use SourceID instead. TLSSkipVerify skips SSL verification when cloning the Git repository.
+	TLSSkipVerify bool `example:"false"`
+	// IsComposeFormat indicates if the Kubernetes template is created from a Docker Compose file
+	IsComposeFormat bool `example:"false"`
+	// EdgeTemplate indicates if this template purpose for Edge Stack
+	EdgeTemplate bool `example:"false"`
+}
+
+func (payload *customTemplateUpdatePayload) Validate(r *http.Request) error {
+	if len(payload.Title) == 0 {
+		return errors.New("Invalid custom template title")
+	}
+
+	if payload.Type != portainer.KubernetesStack && payload.Platform != portainer.CustomTemplatePlatformLinux && payload.Platform != portainer.CustomTemplatePlatformWindows {
+		return errors.New("Invalid custom template platform")
+	}
+
+	if payload.Type != portainer.KubernetesStack && payload.Type != portainer.DockerSwarmStack && payload.Type != portainer.DockerComposeStack {
+		return errors.New("Invalid custom template type")
+	}
+
+	if len(payload.Description) == 0 {
+		return errors.New("Invalid custom template description")
+	}
+
+	if !IsValidNote(payload.Note) {
+		return errors.New("Invalid note. <img> tag is not supported")
+	}
+
+	if len(payload.FileContent) == 0 && payload.SourceID == 0 {
+		if len(payload.RepositoryURL) == 0 {
+			return errors.New("Either file content, git repository url, or source ID need to be provided")
+		}
+
+		if !validate.IsURL(payload.RepositoryURL) {
+			return errors.New("Invalid repository URL. Must correspond to a valid URL format")
+		}
+
+		if payload.RepositoryAuthentication && (len(payload.RepositoryUsername) == 0 || len(payload.RepositoryPassword) == 0) {
+			return errors.New("Invalid repository credentials. Username and password must be specified when authentication is enabled")
+		}
+
+	}
+
+	if len(payload.ComposeFilePathInRepository) == 0 {
+		payload.ComposeFilePathInRepository = filesystem.ComposeFileDefaultName
+	}
+
+	if err := ValidateVariablesDefinitions(payload.Variables); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// @id CustomTemplateUpdate
+// @summary Update a template
+// @description Update a template.
+// @description **Access policy**: authenticated
+// @tags custom_templates
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @produce json
+// @param id path int true "Template identifier"
+// @param body body customTemplateUpdatePayload true "Template details"
+// @success 200 {object} portainer.CustomTemplate "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied to access template"
+// @failure 404 "Template not found"
+// @failure 500 "Server error"
+// @router /custom_templates/{id} [put]
+func (handler *Handler) customTemplateUpdate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	customTemplateID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid Custom template identifier route variable", err)
+	}
+
+	var payload customTemplateUpdatePayload
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	duplicates, err := handler.DataStore.CustomTemplate().ReadAll(func(t portainer.CustomTemplate) bool {
+		return t.ID != portainer.CustomTemplateID(customTemplateID) && t.Title == payload.Title
+	})
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve custom templates from the database", err)
+	}
+
+	if len(duplicates) > 0 {
+		return httperror.InternalServerError("Template name must be unique", errors.New("Template name must be unique"))
+	}
+
+	customTemplate, err := handler.DataStore.CustomTemplate().Read(portainer.CustomTemplateID(customTemplateID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find a custom template with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find a custom template with the specified identifier inside the database", err)
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	resourceControl, err := handler.DataStore.ResourceControl().ResourceControlByResourceIDAndType(strconv.Itoa(customTemplateID), portainer.CustomTemplateResourceControl)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve a resource control associated to the custom template", err)
+	}
+
+	customTemplate.ResourceControl = resourceControl
+	if !userCanEditTemplate(customTemplate, securityContext) {
+		return httperror.Forbidden("Access denied to resource", httperrors.ErrResourceAccessDenied)
+	}
+
+	customTemplate.Title = payload.Title
+	customTemplate.Logo = payload.Logo
+	customTemplate.Description = payload.Description
+	customTemplate.Note = payload.Note
+	customTemplate.Platform = payload.Platform
+	customTemplate.Type = payload.Type
+	customTemplate.Variables = payload.Variables
+	customTemplate.IsComposeFormat = payload.IsComposeFormat
+	customTemplate.EdgeTemplate = payload.EdgeTemplate
+
+	userContext := source.NewUserContext(securityContext.User, securityContext.UserMemberships)
+
+	if payload.SourceID != 0 || payload.RepositoryURL != "" {
+		gitConfig, httpErr := sources.ResolveRepoConfig(handler.DataStore, userContext, sources.RepoConfigInput{
+			SourceID:                 payload.SourceID,
+			ReferenceName:            payload.RepositoryReferenceName,
+			ConfigFilePath:           payload.ComposeFilePathInRepository,
+			RepositoryURL:            payload.RepositoryURL,
+			TLSSkipVerify:            payload.TLSSkipVerify,
+			RepositoryAuthentication: payload.RepositoryAuthentication,
+			Username:                 payload.RepositoryUsername,
+			Password:                 payload.RepositoryPassword,
+		})
+		if httpErr != nil {
+			return httpErr
+		}
+
+		var username, password string
+		if gitConfig.Authentication != nil {
+			username = gitConfig.Authentication.Username
+			password = gitConfig.Authentication.Password
+		}
+
+		cleanBackup, err := git.CloneWithBackup(context.TODO(), handler.GitService, handler.FileService, git.CloneOptions{
+			ProjectPath:   customTemplate.ProjectPath,
+			URL:           gitConfig.URL,
+			ReferenceName: gitConfig.ReferenceName,
+			Username:      username,
+			Password:      password,
+			TLSSkipVerify: gitConfig.TLSSkipVerify,
+		})
+		if err != nil {
+			return httperror.InternalServerError("Unable to clone git repository directory", err)
+		}
+
+		defer cleanBackup()
+
+		commitHash, err := handler.GitService.LatestCommitID(
+			context.TODO(),
+			gitConfig.URL,
+			gitConfig.ReferenceName,
+			username,
+			password,
+			gitConfig.TLSSkipVerify,
+		)
+		if err != nil {
+			return httperror.InternalServerError("Unable get latest commit id", fmt.Errorf("failed to fetch latest commit id of the template %v: %w", customTemplate.ID, err))
+		}
+
+		sourceID := payload.SourceID
+		if sourceID == 0 {
+			src, err := workflows.FindOrCreateGitSource(handler.DataStore, userContext, &portainer.Source{
+				Name: gittypes.RepoName(gitConfig.URL),
+				Type: portainer.SourceTypeGit,
+				Git: &gittypes.GitSource{
+					URL:            gitConfig.URL,
+					Authentication: gitConfig.Authentication,
+					TLSSkipVerify:  gitConfig.TLSSkipVerify,
+				},
+			})
+			if err != nil {
+				return httperror.InternalServerError("Unable to find or create git source", err)
+			}
+			sourceID = src.ID
+		}
+
+		customTemplate.Artifact = &portainer.Artifact{
+			Files: []portainer.ArtifactFile{{
+				SourceID: sourceID,
+				Path:     gitConfig.ConfigFilePath,
+				Ref:      gitConfig.ReferenceName,
+				Hash:     commitHash,
+			}},
+		}
+
+	} else {
+		templateFolder := strconv.Itoa(customTemplateID)
+		projectPath, err := handler.FileService.StoreCustomTemplateFileFromBytes(templateFolder, customTemplate.EntryPoint, []byte(payload.FileContent))
+		if err != nil {
+			return httperror.InternalServerError("Unable to persist updated custom template file on disk", err)
+		}
+
+		customTemplate.ProjectPath = projectPath
+		customTemplate.Artifact = nil
+	}
+
+	err = handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		if err := tx.CustomTemplate().Update(customTemplate.ID, customTemplate); err != nil {
+			return httperror.InternalServerError("Unable to persist custom template changes inside the database", err)
+		}
+
+		userContext := source.NewUserContext(securityContext.User, securityContext.UserMemberships)
+		populateGitConfig(tx, userContext, customTemplate)
+
+		return nil
+	})
+
+	return response.TxResponse(w, customTemplate, err)
+}
diff --git a/api/http/handler/customtemplates/customtemplate_update_test.go b/api/http/handler/customtemplates/customtemplate_update_test.go
new file mode 100644
index 0000000..115337b
--- /dev/null
+++ b/api/http/handler/customtemplates/customtemplate_update_test.go
@@ -0,0 +1,649 @@
+package customtemplates
+
+import (
+	"bytes"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/filesystem"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	"github.com/portainer/portainer/api/http/security"
+
+	"github.com/gorilla/mux"
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/require"
+)
+
+func updateTemplateRequest(t *testing.T, templateID string, payload any, ctx *security.RestrictedRequestContext) *http.Request {
+	t.Helper()
+
+	body, err := json.Marshal(payload)
+	require.NoError(t, err)
+
+	r := httptest.NewRequest(http.MethodPut, "/custom_templates/"+templateID, bytes.NewReader(body))
+	r.Header.Set("Content-Type", "application/json")
+	r = mux.SetURLVars(r, map[string]string{"id": templateID})
+
+	if ctx.User == nil {
+		role := portainer.StandardUserRole
+		if ctx.IsAdmin {
+			role = portainer.AdministratorRole
+		}
+		ctx.User = &portainer.User{ID: ctx.UserID, Role: role}
+	}
+
+	return r.WithContext(security.StoreRestrictedRequestContext(r, ctx))
+}
+
+func TestCustomTemplateUpdate_NotFound(t *testing.T) {
+	t.Parallel()
+
+	handler, _, _ := newTestHandler(t)
+
+	payload := customTemplateUpdatePayload{
+		Title:       "New Title",
+		Description: "New Description",
+		FileContent: "version: '3'",
+		Type:        portainer.DockerComposeStack,
+		Platform:    portainer.CustomTemplatePlatformLinux,
+	}
+
+	r := updateTemplateRequest(t, "99", payload, &security.RestrictedRequestContext{UserID: 1, IsAdmin: true})
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateUpdate(rr, r)
+	require.NotNil(t, herr)
+	require.Equal(t, http.StatusNotFound, herr.StatusCode)
+}
+
+func TestCustomTemplateUpdate_Forbidden(t *testing.T) {
+	t.Parallel()
+
+	handler, ds, _ := newTestHandler(t)
+
+	require.NoError(t, ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.CustomTemplate().Create(&portainer.CustomTemplate{
+			ID:              1,
+			Title:           "Original Title",
+			EntryPoint:      filesystem.ComposeFileDefaultName,
+			CreatedByUserID: 1,
+		})
+	}))
+
+	payload := customTemplateUpdatePayload{
+		Title:       "New Title",
+		Description: "New Description",
+		FileContent: "version: '3'",
+		Type:        portainer.DockerComposeStack,
+		Platform:    portainer.CustomTemplatePlatformLinux,
+	}
+
+	// User 2 did not create this template and is not an admin
+	r := updateTemplateRequest(t, "1", payload, &security.RestrictedRequestContext{UserID: 2})
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateUpdate(rr, r)
+	require.NotNil(t, herr)
+	require.Equal(t, http.StatusForbidden, herr.StatusCode)
+}
+
+func TestCustomTemplateUpdate_DuplicateTitle(t *testing.T) {
+	t.Parallel()
+
+	handler, ds, _ := newTestHandler(t)
+
+	require.NoError(t, ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		require.NoError(t, tx.CustomTemplate().Create(&portainer.CustomTemplate{
+			ID:    1,
+			Title: "Template One",
+		}))
+
+		return tx.CustomTemplate().Create(&portainer.CustomTemplate{
+			ID:    2,
+			Title: "Template Two",
+		})
+	}))
+
+	payload := customTemplateUpdatePayload{
+		Title:       "Template One",
+		Description: "Renamed",
+		FileContent: "version: '3'",
+		Type:        portainer.DockerComposeStack,
+		Platform:    portainer.CustomTemplatePlatformLinux,
+	}
+
+	r := updateTemplateRequest(t, "2", payload, &security.RestrictedRequestContext{UserID: 1, IsAdmin: true})
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateUpdate(rr, r)
+	require.NotNil(t, herr)
+	require.Equal(t, http.StatusInternalServerError, herr.StatusCode)
+}
+
+func TestCustomTemplateUpdate_Success_FileContent(t *testing.T) {
+	t.Parallel()
+
+	handler, ds, _ := newTestHandler(t)
+
+	require.NoError(t, ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.CustomTemplate().Create(&portainer.CustomTemplate{
+			ID:              1,
+			Title:           "Original Title",
+			Description:     "Original Description",
+			EntryPoint:      filesystem.ComposeFileDefaultName,
+			Type:            portainer.DockerComposeStack,
+			Platform:        portainer.CustomTemplatePlatformLinux,
+			CreatedByUserID: 1,
+		})
+	}))
+
+	payload := customTemplateUpdatePayload{
+		Title:       "Updated Title",
+		Description: "Updated Description",
+		FileContent: "version: '3'\nservices:\n  app:\n    image: alpine",
+		Type:        portainer.DockerComposeStack,
+		Platform:    portainer.CustomTemplatePlatformLinux,
+	}
+
+	r := updateTemplateRequest(t, "1", payload, &security.RestrictedRequestContext{UserID: 1, IsAdmin: true})
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateUpdate(rr, r)
+	require.Nil(t, herr)
+	require.Equal(t, http.StatusOK, rr.Code)
+
+	var tmpl portainer.CustomTemplate
+	require.NoError(t, json.NewDecoder(rr.Body).Decode(&tmpl))
+	require.Equal(t, "Updated Title", tmpl.Title)
+	require.Equal(t, "Updated Description", tmpl.Description)
+
+	err := ds.ViewTx(func(tx dataservices.DataStoreTx) error {
+		stored, err := tx.CustomTemplate().Read(1)
+		require.NoError(t, err)
+		require.Equal(t, "Updated Title", stored.Title)
+		require.Equal(t, "Updated Description", stored.Description)
+
+		return nil
+	})
+	require.NoError(t, err)
+}
+
+func TestCustomTemplateUpdate_SameTitleAllowed(t *testing.T) {
+	t.Parallel()
+
+	handler, ds, _ := newTestHandler(t)
+
+	require.NoError(t, ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.CustomTemplate().Create(&portainer.CustomTemplate{
+			ID:         1,
+			Title:      "My Template",
+			EntryPoint: filesystem.ComposeFileDefaultName,
+		})
+	}))
+
+	payload := customTemplateUpdatePayload{
+		Title:       "My Template",
+		Description: "Updated description",
+		FileContent: "version: '3'",
+		Type:        portainer.DockerComposeStack,
+		Platform:    portainer.CustomTemplatePlatformLinux,
+	}
+
+	r := updateTemplateRequest(t, "1", payload, &security.RestrictedRequestContext{UserID: 1, IsAdmin: true})
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateUpdate(rr, r)
+	require.Nil(t, herr)
+	require.Equal(t, http.StatusOK, rr.Code)
+
+	err := ds.ViewTx(func(tx dataservices.DataStoreTx) error {
+		stored, err := tx.CustomTemplate().Read(1)
+		require.NoError(t, err)
+		require.Equal(t, "My Template", stored.Title)
+		require.Equal(t, "Updated description", stored.Description)
+
+		return nil
+	})
+	require.NoError(t, err)
+}
+
+func TestCustomTemplateUpdate_InvalidPayload(t *testing.T) {
+	t.Parallel()
+
+	handler, ds, _ := newTestHandler(t)
+
+	require.NoError(t, ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.CustomTemplate().Create(&portainer.CustomTemplate{
+			ID:         1,
+			Title:      "My Template",
+			EntryPoint: filesystem.ComposeFileDefaultName,
+		})
+	}))
+
+	payload := customTemplateUpdatePayload{
+		// Title is empty - invalid
+		Description: "A description",
+		FileContent: "version: '3'",
+		Type:        portainer.DockerComposeStack,
+		Platform:    portainer.CustomTemplatePlatformLinux,
+	}
+
+	r := updateTemplateRequest(t, "1", payload, &security.RestrictedRequestContext{UserID: 1, IsAdmin: true})
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateUpdate(rr, r)
+	require.NotNil(t, herr)
+	require.Equal(t, http.StatusBadRequest, herr.StatusCode)
+}
+
+func TestCustomTemplateUpdate_Validation_MissingDescription(t *testing.T) {
+	t.Parallel()
+
+	handler, _, _ := newTestHandler(t)
+
+	payload := customTemplateUpdatePayload{
+		Title:       "My Template",
+		FileContent: "version: '3'",
+		Type:        portainer.DockerComposeStack,
+		Platform:    portainer.CustomTemplatePlatformLinux,
+	}
+
+	r := updateTemplateRequest(t, "99", payload, &security.RestrictedRequestContext{UserID: 1, IsAdmin: true})
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateUpdate(rr, r)
+	require.NotNil(t, herr)
+	require.Equal(t, http.StatusBadRequest, herr.StatusCode)
+}
+
+func TestCustomTemplateUpdate_Validation_BothContentAndRepoMissing(t *testing.T) {
+	t.Parallel()
+
+	handler, _, _ := newTestHandler(t)
+
+	payload := customTemplateUpdatePayload{
+		Title:       "My Template",
+		Description: "A description",
+		Type:        portainer.DockerComposeStack,
+		Platform:    portainer.CustomTemplatePlatformLinux,
+	}
+
+	r := updateTemplateRequest(t, "99", payload, &security.RestrictedRequestContext{UserID: 1, IsAdmin: true})
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateUpdate(rr, r)
+	require.NotNil(t, herr)
+	require.Equal(t, http.StatusBadRequest, herr.StatusCode)
+}
+
+func TestCustomTemplateUpdate_Validation_InvalidPlatform(t *testing.T) {
+	t.Parallel()
+
+	handler, _, _ := newTestHandler(t)
+
+	payload := customTemplateUpdatePayload{
+		Title:       "My Template",
+		Description: "A description",
+		FileContent: "version: '3'",
+		Type:        portainer.DockerComposeStack,
+		Platform:    0,
+	}
+
+	r := updateTemplateRequest(t, "99", payload, &security.RestrictedRequestContext{UserID: 1, IsAdmin: true})
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateUpdate(rr, r)
+	require.NotNil(t, herr)
+	require.Equal(t, http.StatusBadRequest, herr.StatusCode)
+}
+
+func TestCustomTemplateUpdate_Validation_InvalidType(t *testing.T) {
+	t.Parallel()
+
+	handler, _, _ := newTestHandler(t)
+
+	payload := customTemplateUpdatePayload{
+		Title:       "My Template",
+		Description: "A description",
+		FileContent: "version: '3'",
+		Type:        0,
+		Platform:    portainer.CustomTemplatePlatformLinux,
+	}
+
+	r := updateTemplateRequest(t, "99", payload, &security.RestrictedRequestContext{UserID: 1, IsAdmin: true})
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateUpdate(rr, r)
+	require.NotNil(t, herr)
+	require.Equal(t, http.StatusBadRequest, herr.StatusCode)
+}
+
+func TestCustomTemplateUpdate_Validation_NoteWithImage(t *testing.T) {
+	t.Parallel()
+
+	handler, _, _ := newTestHandler(t)
+
+	payload := customTemplateUpdatePayload{
+		Title:       "My Template",
+		Description: "A description",
+		FileContent: "version: '3'",
+		Note:        `Some note <img src="x" onerror="alert(1)">`,
+		Type:        portainer.DockerComposeStack,
+		Platform:    portainer.CustomTemplatePlatformLinux,
+	}
+
+	r := updateTemplateRequest(t, "99", payload, &security.RestrictedRequestContext{UserID: 1, IsAdmin: true})
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateUpdate(rr, r)
+	require.NotNil(t, herr)
+	require.Equal(t, http.StatusBadRequest, herr.StatusCode)
+}
+
+func TestCustomTemplateUpdate_Validation_AuthWithoutCredentials(t *testing.T) {
+	t.Parallel()
+
+	handler, _, _ := newTestHandler(t)
+
+	payload := customTemplateUpdatePayload{
+		Title:                    "My Template",
+		Description:              "A description",
+		RepositoryURL:            "https://github.com/example/repo",
+		Type:                     portainer.DockerComposeStack,
+		Platform:                 portainer.CustomTemplatePlatformLinux,
+		RepositoryAuthentication: true,
+	}
+
+	r := updateTemplateRequest(t, "99", payload, &security.RestrictedRequestContext{UserID: 1, IsAdmin: true})
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateUpdate(rr, r)
+	require.NotNil(t, herr)
+	require.Equal(t, http.StatusBadRequest, herr.StatusCode)
+}
+
+func TestCustomTemplateUpdate_ClearsArtifact(t *testing.T) {
+	t.Parallel()
+
+	handler, ds, _ := newTestHandler(t)
+
+	require.NoError(t, ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.CustomTemplate().Create(&portainer.CustomTemplate{
+			ID:              1,
+			Title:           "Git Template",
+			EntryPoint:      filesystem.ComposeFileDefaultName,
+			Type:            portainer.DockerComposeStack,
+			Platform:        portainer.CustomTemplatePlatformLinux,
+			CreatedByUserID: 1,
+			Artifact: &portainer.Artifact{
+				Files: []portainer.ArtifactFile{},
+			},
+		})
+	}))
+
+	payload := customTemplateUpdatePayload{
+		Title:       "Git Template",
+		Description: "Updated with file content",
+		FileContent: "version: '3'\nservices:\n  app:\n    image: alpine",
+		Type:        portainer.DockerComposeStack,
+		Platform:    portainer.CustomTemplatePlatformLinux,
+	}
+
+	r := updateTemplateRequest(t, "1", payload, &security.RestrictedRequestContext{UserID: 1, IsAdmin: true})
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateUpdate(rr, r)
+	require.Nil(t, herr)
+	require.Equal(t, http.StatusOK, rr.Code)
+
+	var tmpl portainer.CustomTemplate
+	require.NoError(t, json.NewDecoder(rr.Body).Decode(&tmpl))
+	require.Nil(t, tmpl.Artifact)
+
+	err := ds.ViewTx(func(tx dataservices.DataStoreTx) error {
+		stored, err := tx.CustomTemplate().Read(1)
+		require.NoError(t, err)
+		require.Nil(t, stored.Artifact)
+
+		return nil
+	})
+	require.NoError(t, err)
+}
+
+func TestCustomTemplateUpdate_CreatorDeniedWhenAdminOnly(t *testing.T) {
+	t.Parallel()
+
+	handler, store, _ := newTestHandler(t)
+
+	err := store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		err := tx.CustomTemplate().Create(&portainer.CustomTemplate{
+			ID:              1,
+			Title:           "User Template",
+			EntryPoint:      filesystem.ComposeFileDefaultName,
+			Type:            portainer.DockerComposeStack,
+			Platform:        portainer.CustomTemplatePlatformLinux,
+			CreatedByUserID: 2,
+		})
+		require.NoError(t, err)
+
+		err = tx.ResourceControl().Create(&portainer.ResourceControl{
+			ID:                 1,
+			ResourceID:         "1",
+			Type:               portainer.CustomTemplateResourceControl,
+			AdministratorsOnly: true,
+		})
+		require.NoError(t, err)
+
+		return nil
+	})
+	require.NoError(t, err)
+
+	payload := customTemplateUpdatePayload{
+		Title:       "User Template Updated",
+		Description: "Attempted update by creator after adminonly change",
+		FileContent: "version: '3'",
+		Type:        portainer.DockerComposeStack,
+		Platform:    portainer.CustomTemplatePlatformLinux,
+	}
+
+	r := updateTemplateRequest(t, "1", payload, &security.RestrictedRequestContext{UserID: 2})
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateUpdate(rr, r)
+	require.NotNil(t, herr)
+	require.Equal(t, http.StatusForbidden, herr.StatusCode)
+}
+
+func TestCustomTemplateUpdate_WithSourceID_Success(t *testing.T) {
+	t.Parallel()
+
+	handler, ds, _ := newTestHandler(t)
+	handler.GitService = &gitServiceCreatingFile{}
+
+	projectDir := t.TempDir()
+
+	var srcID portainer.SourceID
+	require.NoError(t, ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		require.NoError(t, tx.CustomTemplate().Create(&portainer.CustomTemplate{
+			ID:              1,
+			Title:           "Source Template",
+			EntryPoint:      filesystem.ComposeFileDefaultName,
+			Type:            portainer.DockerComposeStack,
+			Platform:        portainer.CustomTemplatePlatformLinux,
+			CreatedByUserID: 1,
+			ProjectPath:     projectDir,
+		}))
+
+		src := &portainer.Source{
+			Name: "example/repo",
+			Type: portainer.SourceTypeGit,
+			Git: &gittypes.GitSource{
+				URL: "https://github.com/example/repo",
+			},
+		}
+		err := tx.Source().Create(adminUserContext, src)
+		require.NoError(t, err)
+		srcID = src.ID
+		return nil
+	}))
+
+	payload := customTemplateUpdatePayload{
+		Title:       "Source Template",
+		Description: "Updated via source ID",
+		SourceID:    srcID,
+		Type:        portainer.DockerComposeStack,
+		Platform:    portainer.CustomTemplatePlatformLinux,
+	}
+
+	r := updateTemplateRequest(t, "1", payload, &security.RestrictedRequestContext{UserID: 1, IsAdmin: true})
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateUpdate(rr, r)
+	require.Nil(t, herr)
+	require.Equal(t, http.StatusOK, rr.Code)
+
+	var tmpl portainer.CustomTemplate
+	require.NoError(t, json.NewDecoder(rr.Body).Decode(&tmpl))
+	require.NotNil(t, tmpl.Artifact)
+	require.Len(t, tmpl.Artifact.Files, 1)
+	require.Equal(t, srcID, tmpl.Artifact.Files[0].SourceID)
+	require.Equal(t, "deadbeef123", tmpl.Artifact.Files[0].Hash)
+}
+
+func TestCustomTemplateUpdate_WithSourceID_NonExistentSource(t *testing.T) {
+	t.Parallel()
+
+	handler, ds, _ := newTestHandler(t)
+	handler.GitService = &gitServiceCreatingFile{}
+
+	require.NoError(t, ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.CustomTemplate().Create(&portainer.CustomTemplate{
+			ID:              1,
+			Title:           "Source Template",
+			EntryPoint:      filesystem.ComposeFileDefaultName,
+			Type:            portainer.DockerComposeStack,
+			Platform:        portainer.CustomTemplatePlatformLinux,
+			CreatedByUserID: 1,
+		})
+	}))
+
+	payload := customTemplateUpdatePayload{
+		Title:       "Source Template",
+		Description: "Updated via non-existent source ID",
+		SourceID:    999,
+		Type:        portainer.DockerComposeStack,
+		Platform:    portainer.CustomTemplatePlatformLinux,
+	}
+
+	r := updateTemplateRequest(t, "1", payload, &security.RestrictedRequestContext{UserID: 1, IsAdmin: true})
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateUpdate(rr, r)
+	require.NotNil(t, herr)
+	require.Equal(t, http.StatusNotFound, herr.StatusCode)
+}
+
+func TestCustomTemplateUpdate_AdminCanUpdateAdminOnly(t *testing.T) {
+	t.Parallel()
+
+	handler, store, _ := newTestHandler(t)
+
+	err := store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		err := tx.CustomTemplate().Create(&portainer.CustomTemplate{
+			ID:              1,
+			Title:           "User Template",
+			EntryPoint:      filesystem.ComposeFileDefaultName,
+			Type:            portainer.DockerComposeStack,
+			Platform:        portainer.CustomTemplatePlatformLinux,
+			CreatedByUserID: 2,
+		})
+		require.NoError(t, err)
+
+		err = tx.ResourceControl().Create(&portainer.ResourceControl{
+			ID:                 1,
+			ResourceID:         "1",
+			Type:               portainer.CustomTemplateResourceControl,
+			AdministratorsOnly: true,
+		})
+		require.NoError(t, err)
+
+		return nil
+	})
+	require.NoError(t, err)
+
+	payload := customTemplateUpdatePayload{
+		Title:       "Updated by Admin",
+		Description: "Admin update of adminonly template",
+		FileContent: "version: '3'",
+		Type:        portainer.DockerComposeStack,
+		Platform:    portainer.CustomTemplatePlatformLinux,
+	}
+
+	r := updateTemplateRequest(t, "1", payload, &security.RestrictedRequestContext{UserID: 1, IsAdmin: true})
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateUpdate(rr, r)
+	require.Nil(t, herr)
+	require.Equal(t, http.StatusOK, rr.Code)
+}
+
+func TestCustomTemplateUpdate_GitRepository_Success(t *testing.T) {
+	t.Parallel()
+
+	handler, ds, _ := newTestHandler(t)
+	handler.GitService = &gitServiceCreatingFile{}
+
+	projectDir := t.TempDir()
+
+	require.NoError(t, ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.CustomTemplate().Create(&portainer.CustomTemplate{
+			ID:              1,
+			Title:           "Git Template",
+			EntryPoint:      filesystem.ComposeFileDefaultName,
+			Type:            portainer.DockerComposeStack,
+			Platform:        portainer.CustomTemplatePlatformLinux,
+			CreatedByUserID: 1,
+			ProjectPath:     projectDir,
+		})
+	}))
+
+	payload := customTemplateUpdatePayload{
+		Title:                       "Git Template",
+		Description:                 "Updated via git",
+		RepositoryURL:               "https://github.com/example/repo",
+		RepositoryReferenceName:     "refs/heads/main",
+		ComposeFilePathInRepository: filesystem.ComposeFileDefaultName,
+		Type:                        portainer.DockerComposeStack,
+		Platform:                    portainer.CustomTemplatePlatformLinux,
+	}
+
+	r := updateTemplateRequest(t, "1", payload, &security.RestrictedRequestContext{UserID: 1, IsAdmin: true})
+	rr := httptest.NewRecorder()
+
+	herr := handler.customTemplateUpdate(rr, r)
+	require.Nil(t, herr)
+	require.Equal(t, http.StatusOK, rr.Code)
+
+	var tmpl portainer.CustomTemplate
+	require.NoError(t, json.NewDecoder(rr.Body).Decode(&tmpl))
+	require.NotNil(t, tmpl.Artifact)
+	require.Len(t, tmpl.Artifact.Files, 1)
+	require.Equal(t, "deadbeef123", tmpl.Artifact.Files[0].Hash)
+
+	err := ds.ViewTx(func(tx dataservices.DataStoreTx) error {
+		stored, err := tx.CustomTemplate().Read(1)
+		require.NoError(t, err)
+		require.NotNil(t, stored.Artifact)
+
+		src, err := tx.Source().Read(adminUserContext, stored.Artifact.Files[0].SourceID)
+		require.NoError(t, err)
+		require.Equal(t, portainer.SourceTypeGit, src.Type)
+		require.Equal(t, "https://github.com/example/repo", src.Git.URL)
+
+		return nil
+	})
+	require.NoError(t, err)
+}
diff --git a/api/http/handler/customtemplates/handler.go b/api/http/handler/customtemplates/handler.go
new file mode 100644
index 0000000..352816c
--- /dev/null
+++ b/api/http/handler/customtemplates/handler.go
@@ -0,0 +1,77 @@
+package customtemplates
+
+import (
+	"net/http"
+	"sync"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/slicesx"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+
+	"github.com/gorilla/mux"
+)
+
+// Handler is the HTTP handler used to handle environment(endpoint) group operations.
+type Handler struct {
+	*mux.Router
+	DataStore      dataservices.DataStore
+	FileService    portainer.FileService
+	GitService     portainer.GitService
+	gitFetchMutexs map[portainer.TemplateID]*sync.Mutex
+}
+
+// NewHandler creates a handler to manage environment(endpoint) group operations.
+func NewHandler(bouncer security.BouncerService, dataStore dataservices.DataStore, fileService portainer.FileService, gitService portainer.GitService) *Handler {
+	h := &Handler{
+		Router:         mux.NewRouter(),
+		DataStore:      dataStore,
+		FileService:    fileService,
+		GitService:     gitService,
+		gitFetchMutexs: make(map[portainer.TemplateID]*sync.Mutex),
+	}
+
+	h.Handle("/custom_templates/create/{method}",
+		bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.customTemplateCreate))).Methods(http.MethodPost)
+	h.Handle("/custom_templates",
+		bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.customTemplateList))).Methods(http.MethodGet)
+	h.Handle("/custom_templates/{id}",
+		bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.customTemplateInspect))).Methods(http.MethodGet)
+	h.Handle("/custom_templates/{id}/file",
+		bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.customTemplateFile))).Methods(http.MethodGet)
+	h.Handle("/custom_templates/{id}",
+		bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.customTemplateUpdate))).Methods(http.MethodPut)
+	h.Handle("/custom_templates/{id}",
+		bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.customTemplateDelete))).Methods(http.MethodDelete)
+	h.Handle("/custom_templates/{id}/git_fetch",
+		bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.customTemplateGitFetch))).Methods(http.MethodPut)
+	return h
+}
+
+func userCanEditTemplate(customTemplate *portainer.CustomTemplate, securityContext *security.RestrictedRequestContext) bool {
+	resourceControl := customTemplate.ResourceControl
+
+	if securityContext.IsAdmin {
+		return true
+	}
+
+	if resourceControl == nil || resourceControl.AdministratorsOnly {
+		return false
+	}
+
+	if resourceControl.Public {
+		return true
+	}
+
+	if customTemplate.CreatedByUserID != securityContext.UserID {
+		return false
+	}
+
+	teamIDs := slicesx.Map(securityContext.UserMemberships, func(m portainer.TeamMembership) portainer.TeamID {
+		return m.TeamID
+	})
+
+	return authorization.UserCanAccessResource(securityContext.UserID, teamIDs, resourceControl)
+}
diff --git a/api/http/handler/customtemplates/helpers_test.go b/api/http/handler/customtemplates/helpers_test.go
new file mode 100644
index 0000000..e938644
--- /dev/null
+++ b/api/http/handler/customtemplates/helpers_test.go
@@ -0,0 +1,5 @@
+package customtemplates
+
+import "github.com/portainer/portainer/api/dataservices/source"
+
+var adminUserContext = source.InsecureNewAdminContext()
diff --git a/api/http/handler/customtemplates/utils.go b/api/http/handler/customtemplates/utils.go
new file mode 100644
index 0000000..d5123fa
--- /dev/null
+++ b/api/http/handler/customtemplates/utils.go
@@ -0,0 +1,63 @@
+package customtemplates
+
+import (
+	"errors"
+	"regexp"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/dataservices/source"
+	gittypes "github.com/portainer/portainer/api/git/types"
+)
+
+func populateGitConfig(tx dataservices.DataStoreTx, userContext source.UserContext, template *portainer.CustomTemplate) {
+	if template.Artifact == nil || len(template.Artifact.Files) == 0 {
+		return
+	}
+
+	file := template.Artifact.Files[0]
+
+	src, err := tx.Source().Read(userContext, file.SourceID)
+	if err != nil || src.Git == nil {
+		return
+	}
+
+	cfg := &gittypes.RepoConfig{
+		URL:            src.Git.URL,
+		Authentication: src.Git.Authentication,
+		TLSSkipVerify:  src.Git.TLSSkipVerify,
+		ReferenceName:  file.Ref,
+		ConfigFilePath: file.Path,
+		ConfigHash:     file.Hash,
+	}
+
+	if cfg.Authentication != nil {
+		sanitized := *cfg.Authentication
+		sanitized.Password = ""
+		cfg.Authentication = &sanitized
+	}
+
+	template.GitConfig = cfg
+}
+
+// IsValidNote reports whether note is safe to display. Notes containing <img> tags are rejected.
+func IsValidNote(note string) bool {
+	if len(note) == 0 {
+		return true
+	}
+	match, _ := regexp.MatchString("<img", note)
+	return !match
+}
+
+// ValidateVariablesDefinitions returns an error if any variable definition is missing a required field.
+func ValidateVariablesDefinitions(variables []portainer.CustomTemplateVariableDefinition) error {
+	for _, variable := range variables {
+		if variable.Name == "" {
+			return errors.New("variable name is required")
+		}
+		if variable.Label == "" {
+			return errors.New("variable label is required")
+		}
+	}
+	return nil
+}
diff --git a/api/http/handler/customtemplates/utils_test.go b/api/http/handler/customtemplates/utils_test.go
new file mode 100644
index 0000000..c643f86
--- /dev/null
+++ b/api/http/handler/customtemplates/utils_test.go
@@ -0,0 +1,142 @@
+package customtemplates
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	gittypes "github.com/portainer/portainer/api/git/types"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestPopulateGitConfig_NilArtifactIsNoOp(t *testing.T) {
+	t.Parallel()
+
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	template := &portainer.CustomTemplate{ID: 1}
+
+	err := store.ViewTx(func(tx dataservices.DataStoreTx) error {
+
+		populateGitConfig(tx, adminUserContext, template)
+
+		return nil
+	})
+	require.NoError(t, err)
+	require.Nil(t, template.GitConfig)
+}
+
+func TestPopulateGitConfig_EmptySourceIDsIsNoOp(t *testing.T) {
+	t.Parallel()
+
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	template := &portainer.CustomTemplate{
+		ID: 1,
+		Artifact: &portainer.Artifact{
+			Files: []portainer.ArtifactFile{},
+		},
+	}
+
+	err := store.ViewTx(func(tx dataservices.DataStoreTx) error {
+		populateGitConfig(tx, adminUserContext, template)
+
+		return nil
+	})
+	require.NoError(t, err)
+	require.Nil(t, template.GitConfig)
+}
+
+func TestPopulateGitConfig_PopulatesFromSourceAndArtifact(t *testing.T) {
+	t.Parallel()
+
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var srcID portainer.SourceID
+	err := store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		src := &portainer.Source{
+			Type: portainer.SourceTypeGit,
+			Git: &gittypes.GitSource{
+				URL:           "https://github.com/example/repo",
+				TLSSkipVerify: true,
+			},
+		}
+		err := tx.Source().Create(adminUserContext, src)
+		require.NoError(t, err)
+		srcID = src.ID
+
+		return nil
+	})
+	require.NoError(t, err)
+
+	template := &portainer.CustomTemplate{
+		ID: 1,
+		Artifact: &portainer.Artifact{
+			Files: []portainer.ArtifactFile{{
+				Ref:      "refs/heads/main",
+				Path:     "docker-compose.yml",
+				Hash:     "abc123",
+				SourceID: srcID,
+			}},
+		},
+	}
+
+	err = store.ViewTx(func(tx dataservices.DataStoreTx) error {
+		populateGitConfig(tx, adminUserContext, template)
+
+		return nil
+	})
+	require.NoError(t, err)
+	require.NotNil(t, template.GitConfig)
+	require.Equal(t, "https://github.com/example/repo", template.GitConfig.URL)
+	require.True(t, template.GitConfig.TLSSkipVerify)
+	require.Equal(t, "refs/heads/main", template.GitConfig.ReferenceName)
+	require.Equal(t, "docker-compose.yml", template.GitConfig.ConfigFilePath)
+	require.Equal(t, "abc123", template.GitConfig.ConfigHash)
+}
+
+func TestPopulateGitConfig_StripsPassword(t *testing.T) {
+	t.Parallel()
+
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var srcID portainer.SourceID
+	err := store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		src := &portainer.Source{
+			Type: portainer.SourceTypeGit,
+			Git: &gittypes.GitSource{
+				URL: "https://github.com/example/repo",
+				Authentication: &gittypes.GitAuthentication{
+					Username: "user",
+					Password: "secret",
+				},
+			},
+		}
+		err := tx.Source().Create(adminUserContext, src)
+		require.NoError(t, err)
+		srcID = src.ID
+
+		return nil
+	})
+	require.NoError(t, err)
+
+	template := &portainer.CustomTemplate{
+		ID: 1,
+		Artifact: &portainer.Artifact{
+			Files: []portainer.ArtifactFile{{SourceID: srcID}},
+		},
+	}
+
+	err = store.ViewTx(func(tx dataservices.DataStoreTx) error {
+		populateGitConfig(tx, adminUserContext, template)
+
+		return nil
+	})
+	require.NoError(t, err)
+	require.NotNil(t, template.GitConfig)
+	require.NotNil(t, template.GitConfig.Authentication)
+	require.Equal(t, "user", template.GitConfig.Authentication.Username)
+	require.Empty(t, template.GitConfig.Authentication.Password)
+}
diff --git a/api/http/handler/docker/containers/container_gpus_inspect.go b/api/http/handler/docker/containers/container_gpus_inspect.go
new file mode 100644
index 0000000..c3ac8f8
--- /dev/null
+++ b/api/http/handler/docker/containers/container_gpus_inspect.go
@@ -0,0 +1,87 @@
+package containers
+
+import (
+	"net/http"
+	"slices"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/middlewares"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+
+	containertypes "github.com/docker/docker/api/types/container"
+)
+
+type containerGpusResponse struct {
+	Gpus string `json:"gpus"`
+}
+
+// @id dockerContainerGpusInspect
+// @summary Fetch container gpus data
+// @description
+// @description **Access policy**:
+// @tags docker
+// @security jwt
+// @accept json
+// @produce json
+// @param environmentId path int true "Environment identifier"
+// @param containerId path int true "Container identifier"
+// @success 200 {object} containerGpusResponse "Success"
+// @failure 404 "Environment or container not found"
+// @failure 400 "Bad request"
+// @failure 500 "Internal server error"
+// @router /docker/{environmentId}/containers/{containerId}/gpus [get]
+func (handler *Handler) containerGpusInspect(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	containerId, err := request.RetrieveRouteVariableValue(r, "containerId")
+	if err != nil {
+		return httperror.BadRequest("Invalid container identifier route variable", err)
+	}
+
+	endpoint, err := middlewares.FetchEndpoint(r)
+	if err != nil {
+		return httperror.NotFound("Unable to find an environment on request context", err)
+	}
+
+	agentTargetHeader := r.Header.Get(portainer.PortainerAgentTargetHeader)
+
+	cli, err := handler.dockerClientFactory.CreateClient(endpoint, agentTargetHeader, nil)
+	if err != nil {
+		return httperror.InternalServerError("Unable to connect to the Docker daemon", err)
+	}
+
+	container, err := cli.ContainerInspect(r.Context(), containerId)
+	if err != nil {
+		return httperror.NotFound("Unable to find the container", err)
+	}
+
+	if container.HostConfig == nil {
+		return httperror.NotFound("Unable to find the container host config", err)
+	}
+
+	gpuOptionsIndex := slices.IndexFunc(container.HostConfig.DeviceRequests, func(opt containertypes.DeviceRequest) bool {
+		if opt.Driver == "nvidia" {
+			return true
+		}
+
+		if len(opt.Capabilities) == 0 || len(opt.Capabilities[0]) == 0 {
+			return false
+		}
+
+		return opt.Capabilities[0][0] == "gpu"
+	})
+
+	if gpuOptionsIndex == -1 {
+		return response.JSON(w, containerGpusResponse{Gpus: "none"})
+	}
+
+	gpuOptions := container.HostConfig.DeviceRequests[gpuOptionsIndex]
+
+	gpu := "all"
+	if gpuOptions.Count != -1 {
+		gpu = "id:" + strings.Join(gpuOptions.DeviceIDs, ",")
+	}
+
+	return response.JSON(w, containerGpusResponse{Gpus: gpu})
+}
diff --git a/api/http/handler/docker/containers/handler.go b/api/http/handler/docker/containers/handler.go
new file mode 100644
index 0000000..4446fdf
--- /dev/null
+++ b/api/http/handler/docker/containers/handler.go
@@ -0,0 +1,40 @@
+package containers
+
+import (
+	"net/http"
+
+	"github.com/gorilla/mux"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/docker"
+	dockerclient "github.com/portainer/portainer/api/docker/client"
+	"github.com/portainer/portainer/api/http/middlewares"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+)
+
+type Handler struct {
+	*mux.Router
+	dockerClientFactory *dockerclient.ClientFactory
+	dataStore           dataservices.DataStore
+	containerService    *docker.ContainerService
+	bouncer             security.BouncerService
+}
+
+// NewHandler creates a handler to process non-proxied requests to docker APIs directly.
+func NewHandler(routePrefix string, bouncer security.BouncerService, dataStore dataservices.DataStore, dockerClientFactory *dockerclient.ClientFactory, containerService *docker.ContainerService) *Handler {
+	h := &Handler{
+		Router:              mux.NewRouter(),
+		dataStore:           dataStore,
+		dockerClientFactory: dockerClientFactory,
+		containerService:    containerService,
+		bouncer:             bouncer,
+	}
+
+	router := h.PathPrefix(routePrefix).Subrouter()
+	router.Use(bouncer.AuthenticatedAccess, middlewares.CheckEndpointAuthorization(bouncer))
+
+	router.Handle("/{containerId}/gpus", httperror.LoggerHandler(h.containerGpusInspect)).Methods(http.MethodGet)
+	router.Handle("/{containerId}/recreate", httperror.LoggerHandler(h.recreate)).Methods(http.MethodPost)
+
+	return h
+}
diff --git a/api/http/handler/docker/containers/recreate.go b/api/http/handler/docker/containers/recreate.go
new file mode 100644
index 0000000..b71fdf0
--- /dev/null
+++ b/api/http/handler/docker/containers/recreate.go
@@ -0,0 +1,98 @@
+package containers
+
+import (
+	"context"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/docker/consts"
+	"github.com/portainer/portainer/api/docker/images"
+	"github.com/portainer/portainer/api/http/middlewares"
+	"github.com/portainer/portainer/api/internal/authorization"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+
+	"github.com/rs/zerolog/log"
+)
+
+type RecreatePayload struct {
+	// PullImage if true will pull the image
+	PullImage bool `json:"PullImage"`
+}
+
+func (r RecreatePayload) Validate(request *http.Request) error {
+	return nil
+}
+
+func (handler *Handler) recreate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	containerID, err := request.RetrieveRouteVariableValue(r, "containerId")
+	if err != nil {
+		return httperror.BadRequest("Invalid containerId", err)
+	}
+
+	var payload RecreatePayload
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	endpoint, err := middlewares.FetchEndpoint(r)
+	if err != nil {
+		return httperror.NotFound("Unable to find an environment on request context", err)
+	}
+
+	if err := handler.bouncer.AuthorizedEndpointOperation(r, endpoint); err != nil {
+		return httperror.Forbidden("Permission denied to force update service", err)
+	}
+
+	agentTargetHeader := r.Header.Get(portainer.PortainerAgentTargetHeader)
+
+	newContainer, err := handler.containerService.Recreate(context.TODO(), endpoint, containerID, payload.PullImage, "", agentTargetHeader)
+	if err != nil {
+		return httperror.InternalServerError("Error recreating container", err)
+	}
+
+	handler.updateWebhook(containerID, newContainer.ID)
+	handler.createResourceControl(containerID, newContainer.ID)
+
+	go func() {
+		images.EvictImageStatus(containerID)
+		images.EvictImageStatus(newContainer.Config.Labels[consts.ComposeStackNameLabel])
+		images.EvictImageStatus(newContainer.Config.Labels[consts.SwarmServiceIDLabel])
+	}()
+
+	return response.JSON(w, newContainer)
+}
+
+func (handler *Handler) createResourceControl(oldContainerId string, newContainerId string) {
+	resourceControls, err := handler.dataStore.ResourceControl().ReadAll()
+	if err != nil {
+		log.Error().Err(err).Msg("Exporting Resource Controls")
+
+		return
+	}
+
+	resourceControl := authorization.GetResourceControlByResourceIDAndType(oldContainerId, portainer.ContainerResourceControl, resourceControls)
+	if resourceControl == nil {
+		return
+	}
+
+	resourceControl.ResourceID = newContainerId
+	if err := handler.dataStore.ResourceControl().Create(resourceControl); err != nil {
+		log.Error().Err(err).Str("containerId", newContainerId).Msg("Failed to create new resource control for container")
+	}
+}
+
+func (handler *Handler) updateWebhook(oldContainerId string, newContainerId string) {
+	webhook, err := handler.dataStore.Webhook().WebhookByResourceID(oldContainerId)
+	if err != nil {
+		log.Error().Err(err).Str("containerId", oldContainerId).Msg("cannot find webhook by containerId")
+
+		return
+	}
+
+	webhook.ResourceID = newContainerId
+	if err := handler.dataStore.Webhook().Update(webhook.ID, webhook); err != nil {
+		log.Error().Err(err).Int("webhookId", int(webhook.ID)).Msg("cannot update webhook")
+	}
+}
diff --git a/api/http/handler/docker/dashboard.go b/api/http/handler/docker/dashboard.go
new file mode 100644
index 0000000..3765370
--- /dev/null
+++ b/api/http/handler/docker/dashboard.go
@@ -0,0 +1,170 @@
+package docker
+
+import (
+	"errors"
+	"net/http"
+
+	"github.com/docker/docker/api/types"
+	"github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/api/types/image"
+	"github.com/docker/docker/api/types/network"
+	"github.com/docker/docker/api/types/swarm"
+	"github.com/docker/docker/api/types/volume"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/docker/stats"
+	"github.com/portainer/portainer/api/http/handler/docker/utils"
+	"github.com/portainer/portainer/api/http/middlewares"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/uac"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type imagesCounters struct {
+	Total int   `json:"total"`
+	Size  int64 `json:"size"`
+}
+
+type dashboardResponse struct {
+	Containers stats.ContainerStats `json:"containers"`
+	Services   int                  `json:"services"`
+	Images     imagesCounters       `json:"images"`
+	Volumes    int                  `json:"volumes"`
+	Networks   int                  `json:"networks"`
+	Stacks     int                  `json:"stacks"`
+}
+
+// @id dockerDashboard
+// @summary Get counters for the dashboard
+// @description **Access policy**: restricted
+// @tags docker
+// @security jwt
+// @param environmentId path int true "Environment identifier"
+// @accept json
+// @produce json
+// @success 200 {object} dashboardResponse "Success"
+// @failure 400 "Bad request"
+// @failure 500 "Internal server error"
+// @router /docker/{environmentId}/dashboard [get]
+func (h *Handler) dashboard(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	var resp dashboardResponse
+	err := h.dataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
+		cli, httpErr := utils.GetClient(r, h.dockerClientFactory)
+		if httpErr != nil {
+			return httpErr
+		}
+
+		context, err := security.RetrieveRestrictedRequestContext(r)
+		if err != nil {
+			return httperror.InternalServerError("Unable to retrieve user details from request context", err)
+		}
+		user, err := tx.User().Read(context.UserID)
+		if err != nil {
+			return httperror.InternalServerError("Unable to retrieve user", err)
+		}
+
+		endpoint, err := middlewares.FetchEndpoint(r)
+		if err != nil {
+			return err
+		}
+
+		containers, err := cli.ContainerList(r.Context(), container.ListOptions{All: true})
+		if err != nil {
+			return httperror.InternalServerError("Unable to retrieve Docker containers", err)
+		}
+
+		if containers, err = uac.FilterByResourceControl(containers, user, context.UserMemberships, uac.ContainerResourceControlGetter(tx, endpoint.ID)); err != nil {
+			return err
+		}
+
+		images, err := cli.ImageList(r.Context(), image.ListOptions{})
+		if err != nil {
+			return httperror.InternalServerError("Unable to retrieve Docker images", err)
+		}
+
+		var totalSize int64
+		for _, image := range images {
+			totalSize += image.Size
+		}
+
+		info, err := cli.Info(r.Context())
+		if err != nil {
+			return httperror.InternalServerError("Unable to retrieve Docker info", err)
+		}
+
+		isSwarmManager := info.Swarm.ControlAvailable && info.Swarm.NodeID != ""
+
+		var services []swarm.Service
+		if isSwarmManager {
+			servicesRes, err := cli.ServiceList(r.Context(), types.ServiceListOptions{})
+			if err != nil {
+				return httperror.InternalServerError("Unable to retrieve Docker services", err)
+			}
+
+			if services, err = uac.FilterByResourceControl(servicesRes, user, context.UserMemberships, uac.ServiceResourceControlGetter(tx, endpoint.ID)); err != nil {
+				return err
+			}
+		}
+
+		volumesRes, err := cli.VolumeList(r.Context(), volume.ListOptions{})
+		if err != nil {
+			return httperror.InternalServerError("Unable to retrieve Docker volumes", err)
+		}
+
+		var volumes []*volume.Volume
+		if volumes, err = uac.FilterByResourceControl(volumesRes.Volumes, user, context.UserMemberships, func(item *volume.Volume) (*portainer.ResourceControl, error) {
+			if item == nil {
+				return nil, errors.New("Found nil volume in volumes list")
+			}
+			return uac.VolumeResourceControlGetter(tx, endpoint.ID)(*item)
+		}); err != nil {
+			return err
+		}
+
+		networks, err := cli.NetworkList(r.Context(), network.ListOptions{})
+		if err != nil {
+			return httperror.InternalServerError("Unable to retrieve Docker networks", err)
+		}
+
+		if networks, err = uac.FilterByResourceControl(networks, user, context.UserMemberships, uac.NetworkResourceControlGetter(tx, endpoint.ID)); err != nil {
+			return err
+		}
+
+		environment, err := middlewares.FetchEndpoint(r)
+		if err != nil {
+			return httperror.InternalServerError("Unable to retrieve environment", err)
+		}
+
+		stackCount := 0
+		if environment.SecuritySettings.AllowStackManagementForRegularUsers || context.IsAdmin {
+			stacks, err := utils.GetDockerStacks(tx, context, environment.ID, containers, services)
+			if err != nil {
+				return httperror.InternalServerError("Unable to retrieve stacks", err)
+			}
+
+			stackCount = len(stacks)
+		}
+
+		containersStats, err := stats.CalculateContainerStats(r.Context(), cli, info.Swarm.ControlAvailable, containers)
+		if err != nil {
+			return httperror.InternalServerError("Unable to retrieve Docker containers stats", err)
+		}
+
+		resp = dashboardResponse{
+			Images: imagesCounters{
+				Total: len(images),
+				Size:  totalSize,
+			},
+			Services:   len(services),
+			Containers: containersStats,
+			Networks:   len(networks),
+			Volumes:    len(volumes),
+			Stacks:     stackCount,
+		}
+
+		return nil
+	})
+
+	return response.TxResponse(w, resp, err)
+}
diff --git a/api/http/handler/docker/endpoint_authorization_test.go b/api/http/handler/docker/endpoint_authorization_test.go
new file mode 100644
index 0000000..f451ec6
--- /dev/null
+++ b/api/http/handler/docker/endpoint_authorization_test.go
@@ -0,0 +1,95 @@
+package docker
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/apikey"
+	"github.com/portainer/portainer/api/datastore"
+	dockerdomain "github.com/portainer/portainer/api/docker"
+	dockerclient "github.com/portainer/portainer/api/docker/client"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+	"github.com/portainer/portainer/api/jwt"
+	"github.com/portainer/portainer/pkg/fips"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// unreachableDockerURL points the test environment at a port that refuses connections, so an
+// authorized caller fails fast when the handler builds a docker client rather than blocking on a
+// real daemon. The authorization middleware runs before this, which is what these tests assert.
+const unreachableDockerURL = "tcp://127.0.0.1:1"
+
+func newDashboardAuthTestHandler(t *testing.T) (*Handler, *jwt.Service, *datastore.Store) {
+	t.Helper()
+	fips.InitFIPS(false)
+
+	_, store := datastore.MustNewTestStore(t, true, true)
+
+	require.NoError(t, store.Endpoint().Create(&portainer.Endpoint{
+		ID: 1, Name: "docker-env", Type: portainer.DockerEnvironment, URL: unreachableDockerURL,
+	}))
+
+	jwtService, err := jwt.NewService("1h", store)
+	require.NoError(t, err)
+
+	bouncer := security.NewRequestBouncer(t.Context(), store, jwtService, apikey.NewAPIKeyService(nil, nil))
+
+	factory := dockerclient.NewClientFactory(nil, nil)
+	authorizationService := authorization.NewService(store)
+	containerService := dockerdomain.NewContainerService(factory, store)
+
+	handler := NewHandler(bouncer, authorizationService, store, factory, containerService)
+
+	return handler, jwtService, store
+}
+
+func dashboardRequest(t *testing.T, handler *Handler, jwtService *jwt.Service, user *portainer.User) *httptest.ResponseRecorder {
+	t.Helper()
+
+	req := httptest.NewRequest(http.MethodGet, "/docker/1/dashboard", nil)
+	tk, _, err := jwtService.GenerateToken(&portainer.TokenData{ID: user.ID, Username: user.Username, Role: user.Role})
+	require.NoError(t, err)
+	testhelpers.AddTestSecurityCookie(req, tk)
+
+	rr := httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+	return rr
+}
+
+// TestEndpointAuthorization_DeniedUser_Returns403 verifies that the docker /dashboard
+// route rejects users with no access policy for the target environment (R8S-1057).
+func TestEndpointAuthorization_DeniedUser_Returns403(t *testing.T) {
+	handler, jwtService, store := newDashboardAuthTestHandler(t)
+
+	noAccessUser := &portainer.User{
+		Username:                "no-access",
+		Role:                    portainer.StandardUserRole,
+		PortainerAuthorizations: authorization.DefaultPortainerAuthorizations(),
+	}
+	require.NoError(t, store.User().Create(noAccessUser))
+
+	// A standard user with no access policy must be rejected before the dashboard handler
+	// builds a docker client for the environment.
+	rr := dashboardRequest(t, handler, jwtService, noAccessUser)
+
+	assert.Equal(t, http.StatusForbidden, rr.Code)
+}
+
+// TestEndpointAuthorization_AuthorizedUser_NotForbidden verifies that the docker /dashboard
+// route lets an authorized caller through the authorization middleware (R8S-1057). The request
+// fails later when the handler cannot reach the docker daemon, but it must not be rejected with 403.
+func TestEndpointAuthorization_AuthorizedUser_NotForbidden(t *testing.T) {
+	handler, jwtService, store := newDashboardAuthTestHandler(t)
+
+	adminUser := &portainer.User{Username: "admin", Role: portainer.AdministratorRole}
+	require.NoError(t, store.User().Create(adminUser))
+
+	rr := dashboardRequest(t, handler, jwtService, adminUser)
+
+	assert.NotEqual(t, http.StatusForbidden, rr.Code)
+}
diff --git a/api/http/handler/docker/handler.go b/api/http/handler/docker/handler.go
new file mode 100644
index 0000000..69b4b66
--- /dev/null
+++ b/api/http/handler/docker/handler.go
@@ -0,0 +1,74 @@
+package docker
+
+import (
+	"errors"
+	"net/http"
+
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/docker"
+	dockerclient "github.com/portainer/portainer/api/docker/client"
+	"github.com/portainer/portainer/api/http/handler/docker/containers"
+	"github.com/portainer/portainer/api/http/handler/docker/images"
+	"github.com/portainer/portainer/api/http/middlewares"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+
+	"github.com/gorilla/mux"
+)
+
+// Handler is the HTTP handler which will natively deal with to external environments(endpoints).
+type Handler struct {
+	*mux.Router
+	requestBouncer       security.BouncerService
+	dataStore            dataservices.DataStore
+	dockerClientFactory  *dockerclient.ClientFactory
+	authorizationService *authorization.Service
+	containerService     *docker.ContainerService
+}
+
+// NewHandler creates a handler to process non-proxied requests to docker APIs directly.
+func NewHandler(bouncer security.BouncerService, authorizationService *authorization.Service, dataStore dataservices.DataStore, dockerClientFactory *dockerclient.ClientFactory, containerService *docker.ContainerService) *Handler {
+	h := &Handler{
+		Router:               mux.NewRouter(),
+		requestBouncer:       bouncer,
+		authorizationService: authorizationService,
+		dataStore:            dataStore,
+		dockerClientFactory:  dockerClientFactory,
+		containerService:     containerService,
+	}
+
+	// endpoints
+	endpointRouter := h.PathPrefix("/docker/{id}").Subrouter()
+	endpointRouter.Use(bouncer.AuthenticatedAccess)
+	endpointRouter.Use(middlewares.WithEndpoint(dataStore.Endpoint(), "id"), dockerOnlyMiddleware)
+
+	// /dashboard is the only route on this router without its own endpoint authorization;
+	// the containers/images sub-routers already apply CheckEndpointAuthorization.
+	endpointRouter.Handle("/dashboard", middlewares.CheckEndpointAuthorization(bouncer)(httperror.LoggerHandler(h.dashboard))).Methods(http.MethodGet)
+
+	containersHandler := containers.NewHandler("/docker/{id}/containers", bouncer, dataStore, dockerClientFactory, containerService)
+	endpointRouter.PathPrefix("/containers").Handler(containersHandler)
+
+	imagesHandler := images.NewHandler("/docker/{id}/images", bouncer, dockerClientFactory)
+	endpointRouter.PathPrefix("/images").Handler(imagesHandler)
+	return h
+}
+
+func dockerOnlyMiddleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(rw http.ResponseWriter, request *http.Request) {
+		endpoint, err := middlewares.FetchEndpoint(request)
+		if err != nil {
+			httperror.WriteError(rw, http.StatusInternalServerError, "Unable to find an environment on request context", err)
+			return
+		}
+
+		if !endpointutils.IsDockerEndpoint(endpoint) {
+			errMessage := "environment is not a docker environment"
+			httperror.WriteError(rw, http.StatusBadRequest, errMessage, errors.New(errMessage))
+			return
+		}
+		next.ServeHTTP(rw, request)
+	})
+}
diff --git a/api/http/handler/docker/images/handler.go b/api/http/handler/docker/images/handler.go
new file mode 100644
index 0000000..aaf3182
--- /dev/null
+++ b/api/http/handler/docker/images/handler.go
@@ -0,0 +1,33 @@
+package images
+
+import (
+	"net/http"
+
+	"github.com/portainer/portainer/api/docker/client"
+	"github.com/portainer/portainer/api/http/middlewares"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+
+	"github.com/gorilla/mux"
+)
+
+type Handler struct {
+	*mux.Router
+	dockerClientFactory *client.ClientFactory
+	bouncer             security.BouncerService
+}
+
+// NewHandler creates a handler to process non-proxied requests to docker APIs directly.
+func NewHandler(routePrefix string, bouncer security.BouncerService, dockerClientFactory *client.ClientFactory) *Handler {
+	h := &Handler{
+		Router:              mux.NewRouter(),
+		dockerClientFactory: dockerClientFactory,
+		bouncer:             bouncer,
+	}
+
+	router := h.PathPrefix(routePrefix).Subrouter()
+	router.Use(bouncer.AuthenticatedAccess, middlewares.CheckEndpointAuthorization(bouncer))
+
+	router.Handle("", httperror.LoggerHandler(h.imagesList)).Methods(http.MethodGet)
+	return h
+}
diff --git a/api/http/handler/docker/images/images_list.go b/api/http/handler/docker/images/images_list.go
new file mode 100644
index 0000000..6d0c902
--- /dev/null
+++ b/api/http/handler/docker/images/images_list.go
@@ -0,0 +1,103 @@
+package images
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/portainer/portainer/api/docker/client"
+	"github.com/portainer/portainer/api/http/handler/docker/utils"
+	"github.com/portainer/portainer/api/set"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+
+	"github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/api/types/image"
+)
+
+type ImageResponse struct {
+	Created  int64    `json:"created"`
+	NodeName string   `json:"nodeName"`
+	ID       string   `json:"id"`
+	Size     int64    `json:"size"`
+	Tags     []string `json:"tags"`
+
+	// Used is true if the image is used by at least one container
+	// supplied only when withUsage is true
+	Used bool `json:"used"`
+}
+
+// @id dockerImagesList
+// @summary Fetch images
+// @description
+// @description **Access policy**:
+// @tags docker
+// @security jwt
+// @param environmentId path int true "Environment identifier"
+// @param withUsage query boolean false "Include image usage information"
+// @produce json
+// @success 200 {array} ImageResponse "Success"
+// @failure 400 "Bad request"
+// @failure 500 "Internal server error"
+// @router /docker/{environmentId}/images [get]
+func (handler *Handler) imagesList(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	cli, httpErr := utils.GetClient(r, handler.dockerClientFactory)
+	if httpErr != nil {
+		return httpErr
+	}
+
+	nodeNames := make(map[string]string)
+
+	// Pass the node names map to the context so the custom NodeNameTransport can use it
+	ctx := context.WithValue(r.Context(), client.NodeNamesCtxKey{}, nodeNames)
+
+	images, err := cli.ImageList(ctx, image.ListOptions{})
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve Docker images", err)
+	}
+
+	withUsage, err := request.RetrieveBooleanQueryParameter(r, "withUsage", true)
+	if err != nil {
+		return httperror.BadRequest("Invalid query parameter: withUsage", err)
+	}
+
+	imageUsageSet := set.Set[string]{}
+	if withUsage {
+		containers, err := cli.ContainerList(r.Context(), container.ListOptions{
+			All: true,
+		})
+		if err != nil {
+			return httperror.InternalServerError("Unable to retrieve Docker containers", err)
+		}
+
+		for _, container := range containers {
+			imageUsageSet.Add(container.ImageID)
+		}
+	}
+
+	imagesList := make([]ImageResponse, len(images))
+	for i, image := range images {
+		if len(image.RepoTags) == 0 && len(image.RepoDigests) > 0 {
+			for _, repoDigest := range image.RepoDigests {
+				image.RepoTags = append(image.RepoTags, repoDigest[0:strings.Index(repoDigest, "@")]+":<none>")
+			}
+		}
+
+		imagesList[i] = ImageResponse{
+			Created: image.Created,
+			// Only works if the order of `images` is not changed between unmarshaling the agent's response
+			// in NodeNameTransport.RoundTrip()  (api/docker/client/client.go)
+			// and docker's cli.ImageList()
+			// As both functions unmarshal the same response body, the resulting array will be ordered the same way.
+			NodeName: nodeNames[fmt.Sprintf("%s-%d", image.ID, i)],
+			ID:       image.ID,
+			Size:     image.Size,
+			Tags:     image.RepoTags,
+			Used:     imageUsageSet.Contains(image.ID),
+		}
+	}
+
+	return response.JSON(w, imagesList)
+}
diff --git a/api/http/handler/docker/utils/get_client.go b/api/http/handler/docker/utils/get_client.go
new file mode 100644
index 0000000..90bb186
--- /dev/null
+++ b/api/http/handler/docker/utils/get_client.go
@@ -0,0 +1,28 @@
+package utils
+
+import (
+	"net/http"
+
+	dockerclient "github.com/docker/docker/client"
+	portainer "github.com/portainer/portainer/api"
+	prclient "github.com/portainer/portainer/api/docker/client"
+	"github.com/portainer/portainer/api/http/middlewares"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+)
+
+// GetClient returns a Docker client based on the request context
+func GetClient(r *http.Request, dockerClientFactory *prclient.ClientFactory) (*dockerclient.Client, *httperror.HandlerError) {
+	endpoint, err := middlewares.FetchEndpoint(r)
+	if err != nil {
+		return nil, httperror.NotFound("Unable to find an environment on request context", err)
+	}
+
+	agentTargetHeader := r.Header.Get(portainer.PortainerAgentTargetHeader)
+
+	cli, err := dockerClientFactory.CreateClient(endpoint, agentTargetHeader, nil)
+	if err != nil {
+		return nil, httperror.InternalServerError("Unable to connect to the Docker daemon", err)
+	}
+
+	return cli, nil
+}
diff --git a/api/http/handler/docker/utils/get_stacks.go b/api/http/handler/docker/utils/get_stacks.go
new file mode 100644
index 0000000..e44a8ff
--- /dev/null
+++ b/api/http/handler/docker/utils/get_stacks.go
@@ -0,0 +1,95 @@
+package utils
+
+import (
+	"fmt"
+
+	"github.com/docker/docker/api/types"
+	"github.com/docker/docker/api/types/swarm"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	dockerconsts "github.com/portainer/portainer/api/docker/consts"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/uac"
+)
+
+type StackViewModel struct {
+	InternalStack *portainer.Stack
+
+	ID         portainer.StackID
+	Name       string
+	IsExternal bool
+	Type       portainer.StackType
+	Labels     map[string]string
+}
+
+// GetDockerStacks retrieves all the stacks associated to a specific environment filtered by the user's access.
+func GetDockerStacks(tx dataservices.DataStoreTx, securityContext *security.RestrictedRequestContext, environmentID portainer.EndpointID, containers []types.Container, services []swarm.Service) ([]StackViewModel, error) {
+	stacks, err := tx.Stack().ReadAll()
+	if err != nil {
+		return nil, fmt.Errorf("Unable to retrieve stacks: %w", err)
+	}
+
+	user, err := tx.User().Read(securityContext.UserID)
+	if err != nil {
+		return nil, fmt.Errorf("Unable to retrieve user: %w", err)
+	}
+
+	stacksNameSet := map[string]*StackViewModel{}
+
+	for i := range stacks {
+		stack := stacks[i]
+		if stack.EndpointID == environmentID {
+			stacksNameSet[stack.Name] = &StackViewModel{
+				InternalStack: &stack,
+				ID:            stack.ID,
+				Name:          stack.Name,
+				IsExternal:    false,
+				Type:          stack.Type,
+			}
+		}
+	}
+
+	for _, container := range containers {
+		name := container.Labels[dockerconsts.ComposeStackNameLabel]
+
+		if name != "" && stacksNameSet[name] == nil && !isHiddenStack(container.Labels) {
+			stacksNameSet[name] = &StackViewModel{
+				Name:       name,
+				IsExternal: true,
+				Type:       portainer.DockerComposeStack,
+				Labels:     container.Labels,
+			}
+		}
+	}
+
+	for _, service := range services {
+		name := service.Spec.Labels[dockerconsts.SwarmStackNameLabel]
+
+		if name != "" && stacksNameSet[name] == nil && !isHiddenStack(service.Spec.Labels) {
+			stacksNameSet[name] = &StackViewModel{
+				Name:       name,
+				IsExternal: true,
+				Type:       portainer.DockerSwarmStack,
+				Labels:     service.Spec.Labels,
+			}
+		}
+	}
+
+	stacksList := make([]StackViewModel, 0)
+	for _, stack := range stacksNameSet {
+		stacksList = append(stacksList, *stack)
+	}
+
+	return uac.FilterByResourceControl(stacksList, user, securityContext.UserMemberships,
+		func(item StackViewModel) (*portainer.ResourceControl, error) {
+			if item.InternalStack != nil {
+				return uac.StackResourceControlGetter(tx, environmentID)(*item.InternalStack)
+			}
+			return uac.ExternalStackResourceControlGetter(tx, environmentID)(uac.ExternalStack{Labels: item.Labels})
+		},
+	)
+}
+
+func isHiddenStack(labels map[string]string) bool {
+	return labels[dockerconsts.HideStackLabel] != ""
+}
diff --git a/api/http/handler/docker/utils/get_stacks_test.go b/api/http/handler/docker/utils/get_stacks_test.go
new file mode 100644
index 0000000..8a01ee9
--- /dev/null
+++ b/api/http/handler/docker/utils/get_stacks_test.go
@@ -0,0 +1,144 @@
+package utils
+
+import (
+	"testing"
+
+	"github.com/docker/docker/api/types"
+	"github.com/docker/docker/api/types/swarm"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/docker/consts"
+	"github.com/portainer/portainer/api/http/security"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestHandler_getDockerStacks(t *testing.T) {
+	t.Parallel()
+	is := require.New(t)
+
+	environment := &portainer.Endpoint{
+		ID: 1,
+		SecuritySettings: portainer.EndpointSecuritySettings{
+			AllowStackManagementForRegularUsers: true,
+		},
+	}
+
+	containers := []types.Container{
+		{
+			Labels: map[string]string{
+				consts.ComposeStackNameLabel: "stack1",
+			},
+		},
+		{
+			Labels: map[string]string{
+				consts.ComposeStackNameLabel:        "stack2",
+				"io.portainer.accesscontrol.public": "true",
+			},
+		},
+	}
+
+	services := []swarm.Service{
+		{
+			Spec: swarm.ServiceSpec{
+				Annotations: swarm.Annotations{
+					Labels: map[string]string{
+						consts.SwarmStackNameLabel: "stack3",
+					},
+				},
+			},
+		},
+	}
+
+	stack1 := portainer.Stack{
+		ID:         1,
+		Name:       "stack1",
+		EndpointID: 1,
+		Type:       portainer.DockerComposeStack,
+	}
+
+	ok, store := datastore.MustNewTestStore(t, false, false)
+	is.True(ok)
+
+	is.NoError(store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		is.NoError(tx.Endpoint().Create(environment))
+		is.NoError(tx.Stack().Create(&stack1))
+		is.NoError(tx.Stack().Create(&portainer.Stack{
+			ID:         2,
+			Name:       "stack2", // stack 2 on env 2
+			EndpointID: 2,
+			Type:       portainer.DockerSwarmStack,
+		}))
+		is.NoError(tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole}))
+		is.NoError(tx.User().Create(&portainer.User{ID: 2, Role: portainer.StandardUserRole}))
+		return nil
+	}))
+
+	// testing admin user
+	is.NoError(store.ViewTx(func(tx dataservices.DataStoreTx) error {
+		stacksList, err := GetDockerStacks(tx, &security.RestrictedRequestContext{
+			IsAdmin: true,
+			UserID:  1,
+		}, environment.ID, containers, services)
+		require.NoError(t, err)
+		assert.Len(t, stacksList, 3)
+
+		expectedStacks := []StackViewModel{
+			{
+				InternalStack: &stack1,
+				ID:            1,
+				Name:          "stack1",
+				IsExternal:    false,
+				Type:          portainer.DockerComposeStack,
+			},
+			{
+				Name:       "stack2",
+				IsExternal: true,
+				Type:       portainer.DockerComposeStack,
+				Labels: map[string]string{
+					consts.ComposeStackNameLabel:        "stack2",
+					"io.portainer.accesscontrol.public": "true",
+				},
+			},
+			{
+				Name:       "stack3",
+				IsExternal: true,
+				Type:       portainer.DockerSwarmStack,
+				Labels: map[string]string{
+					consts.SwarmStackNameLabel: "stack3",
+				},
+			},
+		}
+
+		assert.ElementsMatch(t, expectedStacks, stacksList)
+		return nil
+	}))
+
+	// testing standard user
+	is.NoError(store.ViewTx(func(tx dataservices.DataStoreTx) error {
+		stacksList, err := GetDockerStacks(tx, &security.RestrictedRequestContext{
+			IsAdmin: false,
+			UserID:  2,
+		}, environment.ID, containers, services)
+		require.NoError(t, err)
+		assert.Len(t, stacksList, 1)
+
+		expectedStacks := []StackViewModel{
+			{
+				Name:       "stack2",
+				IsExternal: true,
+				Type:       portainer.DockerComposeStack,
+				Labels: map[string]string{
+					consts.ComposeStackNameLabel:        "stack2",
+					"io.portainer.accesscontrol.public": "true",
+				},
+			},
+		}
+
+		assert.ElementsMatch(t, expectedStacks, stacksList)
+		return nil
+	}))
+
+}
diff --git a/api/http/handler/edgegroups/associated_endpoints.go b/api/http/handler/edgegroups/associated_endpoints.go
new file mode 100644
index 0000000..7310be7
--- /dev/null
+++ b/api/http/handler/edgegroups/associated_endpoints.go
@@ -0,0 +1,32 @@
+package edgegroups
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/roar"
+)
+
+func getTrustedEndpoints(tx dataservices.DataStoreTx, endpointIDs roar.Roar[portainer.EndpointID]) ([]portainer.EndpointID, error) {
+	var innerErr error
+
+	results := []portainer.EndpointID{}
+
+	endpointIDs.Iterate(func(endpointID portainer.EndpointID) bool {
+		endpoint, err := tx.Endpoint().Endpoint(endpointID)
+		if err != nil {
+			innerErr = err
+
+			return false
+		}
+
+		if !endpoint.UserTrusted {
+			return true
+		}
+
+		results = append(results, endpoint.ID)
+
+		return true
+	})
+
+	return results, innerErr
+}
diff --git a/api/http/handler/edgegroups/edgegroup_create.go b/api/http/handler/edgegroups/edgegroup_create.go
new file mode 100644
index 0000000..16e4e6b
--- /dev/null
+++ b/api/http/handler/edgegroups/edgegroup_create.go
@@ -0,0 +1,117 @@
+package edgegroups
+
+import (
+	"errors"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+	"github.com/portainer/portainer/api/roar"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type edgeGroupCreatePayload struct {
+	Name         string
+	Dynamic      bool
+	TagIDs       []portainer.TagID
+	Endpoints    []portainer.EndpointID
+	PartialMatch bool
+}
+
+func (payload *edgeGroupCreatePayload) Validate(r *http.Request) error {
+	if len(payload.Name) == 0 {
+		return errors.New("invalid Edge group name")
+	}
+
+	if payload.Dynamic && len(payload.TagIDs) == 0 {
+		return errors.New("tagIDs is mandatory for a dynamic Edge group")
+	}
+
+	return nil
+}
+
+func calculateEndpointsOrTags(tx dataservices.DataStoreTx, edgeGroup *portainer.EdgeGroup, endpoints []portainer.EndpointID, tagIDs []portainer.TagID) error {
+	if edgeGroup.Dynamic {
+		edgeGroup.TagIDs = tagIDs
+
+		return nil
+	}
+
+	endpointIDs := []portainer.EndpointID{}
+
+	for _, endpointID := range endpoints {
+		endpoint, err := tx.Endpoint().Endpoint(endpointID)
+		if err != nil {
+			return httperror.InternalServerError("Unable to retrieve environment from the database", err)
+		}
+
+		if endpointutils.IsEdgeEndpoint(endpoint) {
+			endpointIDs = append(endpointIDs, endpoint.ID)
+		}
+	}
+
+	edgeGroup.Endpoints = endpointIDs
+	edgeGroup.EndpointIDs = roar.FromSlice(endpointIDs)
+
+	return nil
+}
+
+// @id EdgeGroupCreate
+// @summary Create an EdgeGroup
+// @description **Access policy**: administrator
+// @tags edge_groups
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @produce json
+// @param body body edgeGroupCreatePayload true "EdgeGroup data"
+// @success 200 {object} portainer.EdgeGroup
+// @failure 503 "Edge compute features are disabled"
+// @failure 500
+// @router /edge_groups [post]
+func (handler *Handler) edgeGroupCreate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	var payload edgeGroupCreatePayload
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	var shadowEdgeGroup shadowedEdgeGroup
+	err := handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		edgeGroups, err := tx.EdgeGroup().ReadAll()
+		if err != nil {
+			return httperror.InternalServerError("Unable to retrieve Edge groups from the database", err)
+		}
+
+		for _, edgeGroup := range edgeGroups {
+			if edgeGroup.Name == payload.Name {
+				return httperror.BadRequest("Edge group name must be unique", errors.New("edge group name must be unique"))
+			}
+		}
+
+		edgeGroup := &portainer.EdgeGroup{
+			Name:         payload.Name,
+			Dynamic:      payload.Dynamic,
+			TagIDs:       []portainer.TagID{},
+			Endpoints:    []portainer.EndpointID{},
+			EndpointIDs:  roar.Roar[portainer.EndpointID]{},
+			PartialMatch: payload.PartialMatch,
+		}
+
+		if err := calculateEndpointsOrTags(tx, edgeGroup, payload.Endpoints, payload.TagIDs); err != nil {
+			return err
+		}
+
+		if err := tx.EdgeGroup().Create(edgeGroup); err != nil {
+			return httperror.InternalServerError("Unable to persist the Edge group inside the database", err)
+		}
+
+		shadowEdgeGroup = shadowedEdgeGroup{EdgeGroup: *edgeGroup}
+
+		return nil
+	})
+
+	return response.TxResponse(w, shadowEdgeGroup, err)
+}
diff --git a/api/http/handler/edgegroups/edgegroup_create_test.go b/api/http/handler/edgegroups/edgegroup_create_test.go
new file mode 100644
index 0000000..374bf61
--- /dev/null
+++ b/api/http/handler/edgegroups/edgegroup_create_test.go
@@ -0,0 +1,57 @@
+package edgegroups
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/require"
+)
+
+func TestEdgeGroupCreateHandler(t *testing.T) {
+	t.Parallel()
+	handler, _ := newHandlerWithEdgeEndpoints(t)
+
+	rr := httptest.NewRecorder()
+
+	req := httptest.NewRequest(
+		http.MethodPost,
+		"/edge_groups",
+		strings.NewReader(`{"Name": "New Edge Group", "Endpoints": [1, 2, 3]}`),
+	)
+
+	handler.ServeHTTP(rr, req)
+	require.Equal(t, http.StatusOK, rr.Result().StatusCode)
+
+	var responseGroup portainer.EdgeGroup
+	err := json.NewDecoder(rr.Body).Decode(&responseGroup)
+	require.NoError(t, err)
+
+	require.ElementsMatch(t, []portainer.EndpointID{1, 2, 3}, responseGroup.Endpoints)
+}
+
+func TestEdgeGroupCreatePanic(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	handler := NewHandler(testhelpers.NewTestRequestBouncer())
+	handler.DataStore = store
+
+	err := store.EdgeGroup().Create(&portainer.EdgeGroup{ID: 1, Name: "New Edge Group"})
+	require.NoError(t, err)
+
+	rr := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodPost,
+		"/edge_groups",
+		strings.NewReader(`{"Name": "New Edge Group", "Endpoints": [1, 2, 3]}`),
+	)
+
+	handler.ServeHTTP(rr, req)
+	require.Equal(t, http.StatusBadRequest, rr.Result().StatusCode)
+}
diff --git a/api/http/handler/edgegroups/edgegroup_delete.go b/api/http/handler/edgegroups/edgegroup_delete.go
new file mode 100644
index 0000000..698059b
--- /dev/null
+++ b/api/http/handler/edgegroups/edgegroup_delete.go
@@ -0,0 +1,77 @@
+package edgegroups
+
+import (
+	"errors"
+	"net/http"
+	"slices"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	dserrors "github.com/portainer/portainer/api/dataservices/errors"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id EdgeGroupDelete
+// @summary Deletes an EdgeGroup
+// @description **Access policy**: administrator
+// @tags edge_groups
+// @security ApiKeyAuth
+// @security jwt
+// @param id path int true "EdgeGroup Id"
+// @success 204
+// @failure 409 "Edge group is in use by an Edge stack or Edge job"
+// @failure 503 "Edge compute features are disabled"
+// @failure 500 "Server error"
+// @router /edge_groups/{id} [delete]
+func (handler *Handler) edgeGroupDelete(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	edgeGroupID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid Edge group identifier route variable", err)
+	}
+
+	err = handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return deleteEdgeGroup(tx, portainer.EdgeGroupID(edgeGroupID))
+	})
+
+	return response.TxEmptyResponse(w, err)
+}
+
+func deleteEdgeGroup(tx dataservices.DataStoreTx, ID portainer.EdgeGroupID) error {
+	ok, err := tx.EdgeGroup().Exists(ID)
+	if !ok {
+		return httperror.NotFound("Unable to find an Edge group with the specified identifier inside the database", dserrors.ErrObjectNotFound)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find an Edge group with the specified identifier inside the database", err)
+	}
+
+	edgeStacks, err := tx.EdgeStack().EdgeStacks()
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve Edge stacks from the database", err)
+	}
+
+	for _, edgeStack := range edgeStacks {
+		if slices.Contains(edgeStack.EdgeGroups, ID) {
+			return httperror.Conflict("Edge group is used by an Edge stack", errors.New("edge group is used by an Edge stack"))
+		}
+	}
+
+	edgeJobs, err := tx.EdgeJob().ReadAll()
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve Edge jobs from the database", err)
+	}
+
+	for _, edgeJob := range edgeJobs {
+		if slices.Contains(edgeJob.EdgeGroups, ID) {
+			return httperror.Conflict("Edge group is used by an Edge job", errors.New("edge group is used by an Edge job"))
+		}
+	}
+
+	err = tx.EdgeGroup().Delete(ID)
+	if err != nil {
+		return httperror.InternalServerError("Unable to remove the Edge group from the database", err)
+	}
+
+	return nil
+}
diff --git a/api/http/handler/edgegroups/edgegroup_inspect.go b/api/http/handler/edgegroups/edgegroup_inspect.go
new file mode 100644
index 0000000..2742801
--- /dev/null
+++ b/api/http/handler/edgegroups/edgegroup_inspect.go
@@ -0,0 +1,68 @@
+package edgegroups
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+	"github.com/portainer/portainer/api/roar"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id EdgeGroupInspect
+// @summary Inspects an EdgeGroup
+// @description **Access policy**: administrator
+// @tags edge_groups
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param id path int true "EdgeGroup Id"
+// @success 200 {object} portainer.EdgeGroup
+// @failure 503 "Edge compute features are disabled"
+// @failure 500
+// @router /edge_groups/{id} [get]
+func (handler *Handler) edgeGroupInspect(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	edgeGroupID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid Edge group identifier route variable", err)
+	}
+
+	var shadowEdgeGroup shadowedEdgeGroup
+	err = handler.DataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
+		edgeGroup, err := getEdgeGroup(tx, portainer.EdgeGroupID(edgeGroupID))
+		if err != nil {
+			return err
+		}
+
+		edgeGroup.Endpoints = edgeGroup.EndpointIDs.ToSlice()
+
+		shadowEdgeGroup = shadowedEdgeGroup{EdgeGroup: *edgeGroup}
+
+		return nil
+	})
+
+	return response.TxResponse(w, shadowEdgeGroup, err)
+}
+
+func getEdgeGroup(tx dataservices.DataStoreTx, ID portainer.EdgeGroupID) (*portainer.EdgeGroup, error) {
+	edgeGroup, err := tx.EdgeGroup().Read(ID)
+	if tx.IsErrObjectNotFound(err) {
+		return nil, httperror.NotFound("Unable to find an Edge group with the specified identifier inside the database", err)
+	} else if err != nil {
+		return nil, httperror.InternalServerError("Unable to find an Edge group with the specified identifier inside the database", err)
+	}
+
+	if edgeGroup.Dynamic {
+		endpoints, err := endpointutils.GetEndpointsByTags(tx, edgeGroup.TagIDs, edgeGroup.PartialMatch)
+		if err != nil {
+			return nil, httperror.InternalServerError("Unable to retrieve environments and environment groups for Edge group", err)
+		}
+
+		edgeGroup.EndpointIDs = roar.FromSlice(endpoints)
+	}
+
+	return edgeGroup, err
+}
diff --git a/api/http/handler/edgegroups/edgegroup_inspect_test.go b/api/http/handler/edgegroups/edgegroup_inspect_test.go
new file mode 100644
index 0000000..8bd0aef
--- /dev/null
+++ b/api/http/handler/edgegroups/edgegroup_inspect_test.go
@@ -0,0 +1,201 @@
+package edgegroups
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+	"github.com/portainer/portainer/api/roar"
+
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func newHandlerWithEdgeEndpoints(t *testing.T) (*Handler, *datastore.Store) {
+	t.Helper()
+
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	handler := NewHandler(testhelpers.NewTestRequestBouncer())
+	handler.DataStore = store
+
+	err := store.EndpointGroup().Create(&portainer.EndpointGroup{
+		ID:   1,
+		Name: "Test Group",
+	})
+	require.NoError(t, err)
+
+	for i := range 3 {
+		err = store.Endpoint().Create(&portainer.Endpoint{
+			ID:      portainer.EndpointID(i + 1),
+			Name:    "Test Endpoint " + strconv.Itoa(i+1),
+			Type:    portainer.EdgeAgentOnDockerEnvironment,
+			GroupID: 1,
+		})
+		require.NoError(t, err)
+
+		err = store.EndpointRelation().Create(&portainer.EndpointRelation{
+			EndpointID: portainer.EndpointID(i + 1),
+			EdgeStacks: map[portainer.EdgeStackID]bool{},
+		})
+		require.NoError(t, err)
+	}
+
+	return handler, store
+}
+
+func TestEdgeGroupInspectHandler(t *testing.T) {
+	t.Parallel()
+	handler, store := newHandlerWithEdgeEndpoints(t)
+
+	err := store.EdgeGroup().Create(&portainer.EdgeGroup{
+		ID:          1,
+		Name:        "Test Edge Group",
+		EndpointIDs: roar.FromSlice([]portainer.EndpointID{1, 2, 3}),
+	})
+	require.NoError(t, err)
+
+	rr := httptest.NewRecorder()
+
+	req := httptest.NewRequest(
+		http.MethodGet,
+		"/edge_groups/1",
+		nil,
+	)
+
+	handler.ServeHTTP(rr, req)
+	require.Equal(t, http.StatusOK, rr.Result().StatusCode)
+
+	var responseGroup portainer.EdgeGroup
+	err = json.NewDecoder(rr.Body).Decode(&responseGroup)
+	require.NoError(t, err)
+
+	assert.ElementsMatch(t, []portainer.EndpointID{1, 2, 3}, responseGroup.Endpoints)
+}
+
+func TestEmptyEdgeGroupInspectHandler(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	handler := NewHandler(testhelpers.NewTestRequestBouncer())
+	handler.DataStore = store
+
+	err := store.EndpointGroup().Create(&portainer.EndpointGroup{
+		ID:   1,
+		Name: "Test Group",
+	})
+	require.NoError(t, err)
+
+	err = store.EdgeGroup().Create(&portainer.EdgeGroup{
+		ID:          1,
+		Name:        "Test Edge Group",
+		EndpointIDs: roar.Roar[portainer.EndpointID]{},
+	})
+	require.NoError(t, err)
+
+	rr := httptest.NewRecorder()
+
+	req := httptest.NewRequest(
+		http.MethodGet,
+		"/edge_groups/1",
+		nil,
+	)
+
+	handler.ServeHTTP(rr, req)
+	require.Equal(t, http.StatusOK, rr.Result().StatusCode)
+
+	var responseGroup portainer.EdgeGroup
+	err = json.NewDecoder(rr.Body).Decode(&responseGroup)
+	require.NoError(t, err)
+
+	// Make sure the frontend does not get a null value but a [] instead
+	require.NotNil(t, responseGroup.Endpoints)
+	require.Empty(t, responseGroup.Endpoints)
+}
+
+func TestDynamicEdgeGroupInspectHandler(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	handler := NewHandler(testhelpers.NewTestRequestBouncer())
+	handler.DataStore = store
+
+	err := store.EndpointGroup().Create(&portainer.EndpointGroup{
+		ID:   1,
+		Name: "Test Group",
+	})
+	require.NoError(t, err)
+
+	err = store.Tag().Create(&portainer.Tag{
+		ID:   1,
+		Name: "Test Tag",
+		Endpoints: map[portainer.EndpointID]bool{
+			1: true,
+			2: true,
+			3: true,
+		},
+	})
+	require.NoError(t, err)
+
+	for i := range 3 {
+		err = store.Endpoint().Create(&portainer.Endpoint{
+			ID:          portainer.EndpointID(i + 1),
+			Name:        "Test Endpoint " + strconv.Itoa(i+1),
+			Type:        portainer.EdgeAgentOnDockerEnvironment,
+			GroupID:     1,
+			TagIDs:      []portainer.TagID{1},
+			UserTrusted: true,
+		})
+		require.NoError(t, err)
+
+		err = store.EndpointRelation().Create(&portainer.EndpointRelation{
+			EndpointID: portainer.EndpointID(i + 1),
+			EdgeStacks: map[portainer.EdgeStackID]bool{},
+		})
+		require.NoError(t, err)
+	}
+
+	err = store.EdgeGroup().Create(&portainer.EdgeGroup{
+		ID:      1,
+		Name:    "Test Edge Group",
+		Dynamic: true,
+		TagIDs:  []portainer.TagID{1},
+	})
+	require.NoError(t, err)
+
+	rr := httptest.NewRecorder()
+
+	req := httptest.NewRequest(
+		http.MethodGet,
+		"/edge_groups/1",
+		nil,
+	)
+
+	handler.ServeHTTP(rr, req)
+	require.Equal(t, http.StatusOK, rr.Result().StatusCode)
+
+	var responseGroup portainer.EdgeGroup
+	err = json.NewDecoder(rr.Body).Decode(&responseGroup)
+	require.NoError(t, err)
+
+	require.ElementsMatch(t, []portainer.EndpointID{1, 2, 3}, responseGroup.Endpoints)
+}
+
+func TestEdgeGroupInspectPanic(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	handler := NewHandler(testhelpers.NewTestRequestBouncer())
+	handler.DataStore = store
+
+	rr := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/edge_groups/1", nil)
+
+	handler.ServeHTTP(rr, req)
+	require.Equal(t, http.StatusNotFound, rr.Result().StatusCode)
+}
diff --git a/api/http/handler/edgegroups/edgegroup_list.go b/api/http/handler/edgegroups/edgegroup_list.go
new file mode 100644
index 0000000..24c5818
--- /dev/null
+++ b/api/http/handler/edgegroups/edgegroup_list.go
@@ -0,0 +1,151 @@
+package edgegroups
+
+import (
+	"fmt"
+	"net/http"
+	"slices"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+	"github.com/portainer/portainer/api/roar"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type shadowedEdgeGroup struct {
+	portainer.EdgeGroup
+	EndpointIds int `json:"EndpointIds,omitempty"` // Shadow to avoid exposing in the API
+}
+
+type decoratedEdgeGroup struct {
+	shadowedEdgeGroup
+	HasEdgeStack     bool `json:"HasEdgeStack"`
+	HasEdgeJob       bool `json:"HasEdgeJob"`
+	EndpointTypes    []portainer.EndpointType
+	TrustedEndpoints []portainer.EndpointID `json:"TrustedEndpoints"`
+}
+
+// @id EdgeGroupList
+// @summary list EdgeGroups
+// @description **Access policy**: administrator
+// @tags edge_groups
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @success 200 {array} decoratedEdgeGroup "EdgeGroups"
+// @failure 500
+// @failure 503 "Edge compute features are disabled"
+// @router /edge_groups [get]
+func (handler *Handler) edgeGroupList(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	var decoratedEdgeGroups []decoratedEdgeGroup
+	var err error
+
+	err = handler.DataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
+		decoratedEdgeGroups, err = getEdgeGroupList(tx)
+		return err
+	})
+
+	return response.TxResponse(w, decoratedEdgeGroups, err)
+}
+
+func getEdgeGroupList(tx dataservices.DataStoreTx) ([]decoratedEdgeGroup, error) {
+	edgeGroups, err := tx.EdgeGroup().ReadAll()
+	if err != nil {
+		return nil, httperror.InternalServerError("Unable to retrieve Edge groups from the database", err)
+	}
+
+	edgeStacks, err := tx.EdgeStack().EdgeStacks()
+	if err != nil {
+		return nil, httperror.InternalServerError("Unable to retrieve Edge stacks from the database", err)
+	}
+
+	usedEdgeGroups := make(map[portainer.EdgeGroupID]bool)
+
+	for _, stack := range edgeStacks {
+		for _, groupID := range stack.EdgeGroups {
+			usedEdgeGroups[groupID] = true
+		}
+	}
+
+	edgeJobs, err := tx.EdgeJob().ReadAll()
+	if err != nil {
+		return nil, httperror.InternalServerError("Unable to retrieve Edge jobs from the database", err)
+	}
+
+	decoratedEdgeGroups := []decoratedEdgeGroup{}
+	for _, orgEdgeGroup := range edgeGroups {
+		usedByEdgeJob := false
+		for _, edgeJob := range edgeJobs {
+			if slices.Contains(edgeJob.EdgeGroups, orgEdgeGroup.ID) {
+				usedByEdgeJob = true
+				break
+			}
+		}
+
+		edgeGroup := decoratedEdgeGroup{
+			shadowedEdgeGroup: shadowedEdgeGroup{EdgeGroup: orgEdgeGroup},
+			EndpointTypes:     []portainer.EndpointType{},
+		}
+		if edgeGroup.Dynamic {
+			endpointIDs, err := endpointutils.GetEndpointsByTags(tx, edgeGroup.TagIDs, edgeGroup.PartialMatch)
+			if err != nil {
+				return nil, httperror.InternalServerError("Unable to retrieve environments and environment groups for Edge group", err)
+			}
+
+			edgeGroup.Endpoints = endpointIDs
+			edgeGroup.TrustedEndpoints = endpointIDs
+		} else {
+			trustedEndpoints, err := getTrustedEndpoints(tx, edgeGroup.EndpointIDs)
+			if err != nil {
+				return nil, httperror.InternalServerError("Unable to retrieve environments for Edge group", err)
+			}
+
+			edgeGroup.Endpoints = edgeGroup.EndpointIDs.ToSlice()
+			edgeGroup.TrustedEndpoints = trustedEndpoints
+		}
+
+		endpointTypes, err := getEndpointTypes(tx, edgeGroup.EndpointIDs)
+		if err != nil {
+			return nil, httperror.InternalServerError("Unable to retrieve environment types for Edge group", err)
+		}
+
+		edgeGroup.EndpointTypes = endpointTypes
+		edgeGroup.HasEdgeStack = usedEdgeGroups[edgeGroup.ID]
+		edgeGroup.HasEdgeJob = usedByEdgeJob
+
+		decoratedEdgeGroups = append(decoratedEdgeGroups, edgeGroup)
+	}
+
+	return decoratedEdgeGroups, nil
+}
+
+func getEndpointTypes(tx dataservices.DataStoreTx, endpointIds roar.Roar[portainer.EndpointID]) ([]portainer.EndpointType, error) {
+	var innerErr error
+
+	typeSet := map[portainer.EndpointType]bool{}
+
+	endpointIds.Iterate(func(endpointID portainer.EndpointID) bool {
+		endpoint, err := tx.Endpoint().Endpoint(endpointID)
+		if err != nil {
+			innerErr = fmt.Errorf("failed fetching environment: %w", err)
+
+			return false
+		}
+
+		typeSet[endpoint.Type] = true
+
+		return true
+	})
+
+	if innerErr != nil {
+		return nil, innerErr
+	}
+
+	endpointTypes := make([]portainer.EndpointType, 0, len(typeSet))
+	for endpointType := range typeSet {
+		endpointTypes = append(endpointTypes, endpointType)
+	}
+
+	return endpointTypes, nil
+}
diff --git a/api/http/handler/edgegroups/edgegroup_list_test.go b/api/http/handler/edgegroups/edgegroup_list_test.go
new file mode 100644
index 0000000..aeaac29
--- /dev/null
+++ b/api/http/handler/edgegroups/edgegroup_list_test.go
@@ -0,0 +1,92 @@
+package edgegroups
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+	"github.com/portainer/portainer/api/roar"
+
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_getEndpointTypes(t *testing.T) {
+	t.Parallel()
+	endpoints := []portainer.Endpoint{
+		{ID: 1, Type: portainer.DockerEnvironment},
+		{ID: 2, Type: portainer.AgentOnDockerEnvironment},
+		{ID: 3, Type: portainer.AzureEnvironment},
+		{ID: 4, Type: portainer.EdgeAgentOnDockerEnvironment},
+		{ID: 5, Type: portainer.KubernetesLocalEnvironment},
+		{ID: 6, Type: portainer.AgentOnKubernetesEnvironment},
+		{ID: 7, Type: portainer.EdgeAgentOnKubernetesEnvironment},
+	}
+
+	datastore := testhelpers.NewDatastore(testhelpers.WithEndpoints(endpoints))
+
+	tests := []struct {
+		endpointIds []portainer.EndpointID
+		expected    []portainer.EndpointType
+	}{
+		{endpointIds: []portainer.EndpointID{1}, expected: []portainer.EndpointType{portainer.DockerEnvironment}},
+		{endpointIds: []portainer.EndpointID{2}, expected: []portainer.EndpointType{portainer.AgentOnDockerEnvironment}},
+		{endpointIds: []portainer.EndpointID{3}, expected: []portainer.EndpointType{portainer.AzureEnvironment}},
+		{endpointIds: []portainer.EndpointID{4}, expected: []portainer.EndpointType{portainer.EdgeAgentOnDockerEnvironment}},
+		{endpointIds: []portainer.EndpointID{5}, expected: []portainer.EndpointType{portainer.KubernetesLocalEnvironment}},
+		{endpointIds: []portainer.EndpointID{6}, expected: []portainer.EndpointType{portainer.AgentOnKubernetesEnvironment}},
+		{endpointIds: []portainer.EndpointID{7}, expected: []portainer.EndpointType{portainer.EdgeAgentOnKubernetesEnvironment}},
+		{endpointIds: []portainer.EndpointID{7, 2}, expected: []portainer.EndpointType{portainer.EdgeAgentOnKubernetesEnvironment, portainer.AgentOnDockerEnvironment}},
+		{endpointIds: []portainer.EndpointID{6, 4, 1}, expected: []portainer.EndpointType{portainer.AgentOnKubernetesEnvironment, portainer.EdgeAgentOnDockerEnvironment, portainer.DockerEnvironment}},
+		{endpointIds: []portainer.EndpointID{1, 2, 3}, expected: []portainer.EndpointType{portainer.DockerEnvironment, portainer.AgentOnDockerEnvironment, portainer.AzureEnvironment}},
+	}
+
+	for _, test := range tests {
+		ans, err := getEndpointTypes(datastore, roar.FromSlice(test.endpointIds))
+		require.NoError(t, err, "getEndpointTypes shouldn't fail")
+
+		assert.ElementsMatch(t, test.expected, ans, "getEndpointTypes expected to return %b for %v, but returned %b", test.expected, test.endpointIds, ans)
+	}
+}
+
+func Test_getEndpointTypes_failWhenEndpointDontExist(t *testing.T) {
+	t.Parallel()
+	datastore := testhelpers.NewDatastore(testhelpers.WithEndpoints([]portainer.Endpoint{}))
+
+	_, err := getEndpointTypes(datastore, roar.FromSlice([]portainer.EndpointID{1}))
+	require.Error(t, err, "getEndpointTypes should fail")
+}
+
+func TestEdgeGroupListHandler(t *testing.T) {
+	t.Parallel()
+	handler, store := newHandlerWithEdgeEndpoints(t)
+
+	err := store.EdgeGroup().Create(&portainer.EdgeGroup{
+		ID:          1,
+		Name:        "Test Edge Group",
+		EndpointIDs: roar.FromSlice([]portainer.EndpointID{1, 2, 3}),
+	})
+	require.NoError(t, err)
+
+	rr := httptest.NewRecorder()
+
+	req := httptest.NewRequest(
+		http.MethodGet,
+		"/edge_groups",
+		nil,
+	)
+
+	handler.ServeHTTP(rr, req)
+	require.Equal(t, http.StatusOK, rr.Result().StatusCode)
+
+	var responseGroups []decoratedEdgeGroup
+	err = json.NewDecoder(rr.Body).Decode(&responseGroups)
+	require.NoError(t, err)
+
+	require.Len(t, responseGroups, 1)
+	require.ElementsMatch(t, []portainer.EndpointID{1, 2, 3}, responseGroups[0].Endpoints)
+	require.Empty(t, responseGroups[0].TrustedEndpoints)
+}
diff --git a/api/http/handler/edgegroups/edgegroup_update.go b/api/http/handler/edgegroups/edgegroup_update.go
new file mode 100644
index 0000000..c2d8497
--- /dev/null
+++ b/api/http/handler/edgegroups/edgegroup_update.go
@@ -0,0 +1,203 @@
+package edgegroups
+
+import (
+	"errors"
+	"net/http"
+	"slices"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/internal/edge"
+	"github.com/portainer/portainer/api/internal/edge/cache"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+	"github.com/portainer/portainer/api/slicesx"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type edgeGroupUpdatePayload struct {
+	Name         string
+	Dynamic      bool
+	TagIDs       []portainer.TagID
+	Endpoints    []portainer.EndpointID
+	PartialMatch *bool
+}
+
+func (payload *edgeGroupUpdatePayload) Validate(r *http.Request) error {
+	if payload.Dynamic && len(payload.TagIDs) == 0 {
+		return errors.New("tagIDs is mandatory for a dynamic Edge group")
+	}
+
+	return nil
+}
+
+// @id EdgeGroupUpdate
+// @summary Updates an EdgeGroup
+// @description **Access policy**: administrator
+// @tags edge_groups
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @produce json
+// @param id path int true "EdgeGroup Id"
+// @param body body edgeGroupUpdatePayload true "EdgeGroup data"
+// @success 200 {object} portainer.EdgeGroup
+// @failure 503 "Edge compute features are disabled"
+// @failure 500
+// @router /edge_groups/{id} [put]
+func (handler *Handler) edgeGroupUpdate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	edgeGroupID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid Edge group identifier route variable", err)
+	}
+
+	var payload edgeGroupUpdatePayload
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	var shadowEdgeGroup shadowedEdgeGroup
+	err = handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		edgeGroup, err := tx.EdgeGroup().Read(portainer.EdgeGroupID(edgeGroupID))
+		if handler.DataStore.IsErrObjectNotFound(err) {
+			return httperror.NotFound("Unable to find an Edge group with the specified identifier inside the database", err)
+		} else if err != nil {
+			return httperror.InternalServerError("Unable to find an Edge group with the specified identifier inside the database", err)
+		}
+
+		edgeGroups, err := tx.EdgeGroup().ReadAll()
+		if err != nil {
+			return httperror.InternalServerError("Unable to retrieve Edge groups from the database", err)
+		}
+
+		if payload.Name != "" {
+			for _, edgeGroup := range edgeGroups {
+				if edgeGroup.Name == payload.Name && edgeGroup.ID != portainer.EdgeGroupID(edgeGroupID) {
+					return httperror.BadRequest("Edge group name must be unique", errors.New("edge group name must be unique"))
+				}
+			}
+
+			edgeGroup.Name = payload.Name
+		}
+
+		endpoints, err := tx.Endpoint().Endpoints()
+		if err != nil {
+			return httperror.InternalServerError("Unable to retrieve environments from database", err)
+		}
+
+		endpointGroups, err := tx.EndpointGroup().ReadAll()
+		if err != nil {
+			return httperror.InternalServerError("Unable to retrieve environment groups from database", err)
+		}
+
+		oldRelatedEndpoints := edge.EdgeGroupRelatedEndpoints(edgeGroup, endpoints, endpointGroups)
+
+		edgeGroup.Dynamic = payload.Dynamic
+		if err := calculateEndpointsOrTags(tx, edgeGroup, payload.Endpoints, payload.TagIDs); err != nil {
+			return err
+		}
+
+		if payload.PartialMatch != nil {
+			edgeGroup.PartialMatch = *payload.PartialMatch
+		}
+
+		if err := tx.EdgeGroup().Update(edgeGroup.ID, edgeGroup); err != nil {
+			return httperror.InternalServerError("Unable to persist Edge group changes inside the database", err)
+		}
+
+		newRelatedEndpoints := edge.EdgeGroupRelatedEndpoints(edgeGroup, endpoints, endpointGroups)
+		endpointsToUpdate := slicesx.Unique(append(newRelatedEndpoints, oldRelatedEndpoints...))
+
+		edgeJobs, err := tx.EdgeJob().ReadAll()
+		if err != nil {
+			return httperror.InternalServerError("Unable to fetch Edge jobs", err)
+		}
+
+		edgeStacks, err := tx.EdgeStack().EdgeStacks()
+		if err != nil {
+			return err
+		}
+
+		// Update the edgeGroups with the modified edgeGroup for updateEndpointStacks()
+		for i := range edgeGroups {
+			if edgeGroups[i].ID == edgeGroup.ID {
+				edgeGroups[i] = *edgeGroup
+			}
+		}
+
+		for _, endpointID := range endpointsToUpdate {
+			endpoint, err := tx.Endpoint().Endpoint(endpointID)
+			if err != nil {
+				return httperror.InternalServerError("Unable to get Environment from database", err)
+			}
+
+			if err := handler.updateEndpointStacks(tx, endpoint, edgeGroups, edgeStacks); err != nil {
+				return httperror.InternalServerError("Unable to persist Environment relation changes inside the database", err)
+			}
+
+			if !endpointutils.IsEdgeEndpoint(endpoint) {
+				continue
+			}
+
+			var operation string
+			if slices.Contains(newRelatedEndpoints, endpointID) && slices.Contains(oldRelatedEndpoints, endpointID) {
+				continue
+			} else if slices.Contains(newRelatedEndpoints, endpointID) {
+				operation = "add"
+			} else if slices.Contains(oldRelatedEndpoints, endpointID) {
+				operation = "remove"
+			} else {
+				continue
+			}
+
+			if err := handler.updateEndpointEdgeJobs(edgeGroup.ID, endpoint, edgeJobs, operation); err != nil {
+				return httperror.InternalServerError("Unable to persist Environment Edge Jobs changes inside the database", err)
+			}
+		}
+
+		shadowEdgeGroup = shadowedEdgeGroup{EdgeGroup: *edgeGroup}
+
+		return nil
+	})
+
+	return response.TxResponse(w, shadowEdgeGroup, err)
+}
+
+func (handler *Handler) updateEndpointStacks(tx dataservices.DataStoreTx, endpoint *portainer.Endpoint, edgeGroups []portainer.EdgeGroup, edgeStacks []portainer.EdgeStack) error {
+	relation, err := tx.EndpointRelation().EndpointRelation(endpoint.ID)
+	if err != nil {
+		return err
+	}
+
+	endpointGroup, err := tx.EndpointGroup().Read(endpoint.GroupID)
+	if err != nil {
+		return err
+	}
+
+	edgeStackSet := map[portainer.EdgeStackID]bool{}
+
+	endpointEdgeStacks := edge.EndpointRelatedEdgeStacks(endpoint, endpointGroup, edgeGroups, edgeStacks)
+	for _, edgeStackID := range endpointEdgeStacks {
+		edgeStackSet[edgeStackID] = true
+	}
+
+	relation.EdgeStacks = edgeStackSet
+
+	return tx.EndpointRelation().UpdateEndpointRelation(endpoint.ID, relation)
+}
+
+func (handler *Handler) updateEndpointEdgeJobs(edgeGroupID portainer.EdgeGroupID, endpoint *portainer.Endpoint, edgeJobs []portainer.EdgeJob, operation string) error {
+	for _, edgeJob := range edgeJobs {
+		if !slices.Contains(edgeJob.EdgeGroups, edgeGroupID) {
+			continue
+		}
+
+		switch operation {
+		case "add", "remove":
+			cache.Del(endpoint.ID)
+		}
+	}
+
+	return nil
+}
diff --git a/api/http/handler/edgegroups/edgegroup_update_test.go b/api/http/handler/edgegroups/edgegroup_update_test.go
new file mode 100644
index 0000000..b14ed31
--- /dev/null
+++ b/api/http/handler/edgegroups/edgegroup_update_test.go
@@ -0,0 +1,59 @@
+package edgegroups
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+	"github.com/portainer/portainer/api/roar"
+
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/require"
+)
+
+func TestEdgeGroupUpdateHandler(t *testing.T) {
+	t.Parallel()
+	handler, store := newHandlerWithEdgeEndpoints(t)
+
+	err := store.EdgeGroup().Create(&portainer.EdgeGroup{
+		ID:          1,
+		Name:        "Test Edge Group",
+		EndpointIDs: roar.FromSlice([]portainer.EndpointID{1}),
+	})
+	require.NoError(t, err)
+
+	rr := httptest.NewRecorder()
+
+	req := httptest.NewRequest(
+		http.MethodPut,
+		"/edge_groups/1",
+		strings.NewReader(`{"Endpoints": [1, 2, 3]}`),
+	)
+
+	handler.ServeHTTP(rr, req)
+	require.Equal(t, http.StatusOK, rr.Result().StatusCode)
+
+	var responseGroup portainer.EdgeGroup
+	err = json.NewDecoder(rr.Body).Decode(&responseGroup)
+	require.NoError(t, err)
+
+	require.ElementsMatch(t, []portainer.EndpointID{1, 2, 3}, responseGroup.Endpoints)
+}
+
+func TestEdgeGroupUpdatePanic(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	handler := NewHandler(testhelpers.NewTestRequestBouncer())
+	handler.DataStore = store
+
+	rr := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodPut, "/edge_groups/1", strings.NewReader("{}"))
+
+	handler.ServeHTTP(rr, req)
+	require.Equal(t, http.StatusNotFound, rr.Result().StatusCode)
+}
diff --git a/api/http/handler/edgegroups/handler.go b/api/http/handler/edgegroups/handler.go
new file mode 100644
index 0000000..b813872
--- /dev/null
+++ b/api/http/handler/edgegroups/handler.go
@@ -0,0 +1,38 @@
+package edgegroups
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+
+	"github.com/gorilla/mux"
+)
+
+// Handler is the HTTP handler used to handle environment(endpoint) group operations.
+type Handler struct {
+	*mux.Router
+	DataStore            dataservices.DataStore
+	ReverseTunnelService portainer.ReverseTunnelService
+}
+
+// NewHandler creates a handler to manage environment(endpoint) group operations.
+func NewHandler(bouncer security.BouncerService) *Handler {
+	h := &Handler{
+		Router: mux.NewRouter(),
+	}
+	h.Handle("/edge_groups",
+		bouncer.AdminAccess(bouncer.EdgeComputeOperation(httperror.LoggerHandler(h.edgeGroupCreate)))).Methods(http.MethodPost)
+	h.Handle("/edge_groups",
+		bouncer.AdminAccess(bouncer.EdgeComputeOperation(httperror.LoggerHandler(h.edgeGroupList)))).Methods(http.MethodGet)
+	h.Handle("/edge_groups/{id}",
+		bouncer.AdminAccess(bouncer.EdgeComputeOperation(httperror.LoggerHandler(h.edgeGroupInspect)))).Methods(http.MethodGet)
+	h.Handle("/edge_groups/{id}",
+		bouncer.AdminAccess(bouncer.EdgeComputeOperation(httperror.LoggerHandler(h.edgeGroupUpdate)))).Methods(http.MethodPut)
+	h.Handle("/edge_groups/{id}",
+		bouncer.AdminAccess(bouncer.EdgeComputeOperation(httperror.LoggerHandler(h.edgeGroupDelete)))).Methods(http.MethodDelete)
+
+	return h
+}
diff --git a/api/http/handler/edgejobs/edgejob_create.go b/api/http/handler/edgejobs/edgejob_create.go
new file mode 100644
index 0000000..dab6b11
--- /dev/null
+++ b/api/http/handler/edgejobs/edgejob_create.go
@@ -0,0 +1,271 @@
+package edgejobs
+
+import (
+	"errors"
+	"maps"
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/internal/edge"
+	"github.com/portainer/portainer/api/internal/edge/cache"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/portainer/portainer/pkg/validate"
+)
+
+type edgeJobBasePayload struct {
+	Name           string
+	CronExpression string
+	Recurring      bool
+	Endpoints      []portainer.EndpointID
+	EdgeGroups     []portainer.EdgeGroupID
+}
+
+func (handler *Handler) edgeJobCreate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	method, err := request.RetrieveRouteVariableValue(r, "method")
+	if err != nil {
+		return httperror.BadRequest("Invalid query parameter: method. Valid values are: file or string", err)
+	}
+
+	switch method {
+	case "string":
+		return handler.createEdgeJobFromFileContent(w, r)
+	case "file":
+		return handler.createEdgeJobFromFile(w, r)
+	default:
+		return httperror.BadRequest("Invalid query parameter: method. Valid values are: file or string", errors.New(strings.ToLower(request.ErrInvalidQueryParameter)))
+	}
+}
+
+type edgeJobCreateFromFileContentPayload struct {
+	edgeJobBasePayload
+	FileContent string
+}
+
+func (payload *edgeJobCreateFromFileContentPayload) Validate(r *http.Request) error {
+	if len(payload.Name) == 0 {
+		return errors.New("invalid Edge job name")
+	}
+
+	if !validate.Matches(payload.Name, `^[a-zA-Z0-9][a-zA-Z0-9_.-]*$`) {
+		return errors.New("invalid Edge job name format. Allowed characters are: [a-zA-Z0-9_.-]")
+	}
+
+	if len(payload.CronExpression) == 0 {
+		return errors.New("invalid cron expression")
+	}
+
+	if len(payload.Endpoints) == 0 && len(payload.EdgeGroups) == 0 {
+		return errors.New("no environments or groups have been provided")
+	}
+
+	if len(payload.FileContent) == 0 {
+		return errors.New("invalid script file content")
+	}
+
+	return nil
+}
+
+// @id EdgeJobCreateString
+// @summary Create an EdgeJob from a text
+// @description **Access policy**: administrator
+// @tags edge_jobs
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param body body edgeJobCreateFromFileContentPayload true "EdgeGroup data when method is string"
+// @success 200 {object} portainer.EdgeGroup
+// @failure 503 "Edge compute features are disabled"
+// @failure 500
+// @router /edge_jobs/create/string [post]
+func (handler *Handler) createEdgeJobFromFileContent(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	var payload edgeJobCreateFromFileContentPayload
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	var edgeJob *portainer.EdgeJob
+	var err error
+	err = handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		edgeJob, err = handler.createEdgeJob(tx, &payload.edgeJobBasePayload, []byte(payload.FileContent))
+		return err
+	})
+
+	return response.TxResponse(w, edgeJob, err)
+}
+
+func (handler *Handler) createEdgeJob(tx dataservices.DataStoreTx, payload *edgeJobBasePayload, fileContent []byte) (*portainer.EdgeJob, error) {
+	var err error
+
+	edgeJob := handler.createEdgeJobObjectFromPayload(tx, payload)
+
+	var endpoints []portainer.EndpointID
+	if len(edgeJob.EdgeGroups) > 0 {
+		endpoints, err = edge.GetEndpointsFromEdgeGroups(payload.EdgeGroups, tx)
+		if err != nil {
+			return nil, httperror.InternalServerError("Unable to get Endpoints from EdgeGroups", err)
+		}
+	}
+
+	if err := handler.addAndPersistEdgeJob(tx, edgeJob, fileContent, endpoints); err != nil {
+		return nil, httperror.InternalServerError("Unable to schedule Edge job", err)
+	}
+
+	for _, endpointID := range endpoints {
+		cache.Del(endpointID)
+	}
+
+	return edgeJob, nil
+}
+
+type edgeJobCreateFromFilePayload struct {
+	edgeJobBasePayload
+	File []byte
+}
+
+func (payload *edgeJobCreateFromFilePayload) Validate(r *http.Request) error {
+	name, err := request.RetrieveMultiPartFormValue(r, "Name", false)
+	if err != nil {
+		return errors.New("invalid Edge job name")
+	}
+
+	if !validate.Matches(name, `^[a-zA-Z0-9][a-zA-Z0-9_.-]+$`) {
+		return errors.New("invalid Edge job name format. Allowed characters are: [a-zA-Z0-9_.-]")
+	}
+	payload.Name = name
+
+	cronExpression, err := request.RetrieveMultiPartFormValue(r, "CronExpression", false)
+	if err != nil {
+		return errors.New("invalid cron expression")
+	}
+	payload.CronExpression = cronExpression
+
+	var endpoints []portainer.EndpointID
+	if err := request.RetrieveMultiPartFormJSONValue(r, "Endpoints", &endpoints, true); err != nil {
+		return errors.New("invalid environments")
+	}
+	payload.Endpoints = endpoints
+
+	var edgeGroups []portainer.EdgeGroupID
+	if err := request.RetrieveMultiPartFormJSONValue(r, "EdgeGroups", &edgeGroups, true); err != nil {
+		return errors.New("invalid edge groups")
+	}
+	payload.EdgeGroups = edgeGroups
+
+	if len(payload.Endpoints) == 0 && len(payload.EdgeGroups) == 0 {
+		return errors.New("no environments or groups have been provided")
+	}
+
+	file, _, err := request.RetrieveMultiPartFormFile(r, "file")
+	if err != nil {
+		return errors.New("invalid script file. Ensure that the file is uploaded correctly")
+	}
+	payload.File = file
+
+	return nil
+}
+
+// @id EdgeJobCreateFile
+// @summary Create an EdgeJob from a file
+// @description **Access policy**: administrator
+// @tags edge_jobs
+// @accept multipart/form-data
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param file formData file true "Content of the Stack file"
+// @param Name formData string true "Name of the stack"
+// @param CronExpression formData string true "A cron expression to schedule this job"
+// @param EdgeGroups formData string true "JSON stringified array of Edge Groups ids"
+// @param Endpoints formData string true "JSON stringified array of Environment ids"
+// @param Recurring formData bool false "If recurring"
+// @success 200 {object} portainer.EdgeGroup
+// @failure 503 "Edge compute features are disabled"
+// @failure 500
+// @router /edge_jobs/create/file [post]
+func (handler *Handler) createEdgeJobFromFile(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	payload := &edgeJobCreateFromFilePayload{}
+	if err := payload.Validate(r); err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	var edgeJob *portainer.EdgeJob
+	var err error
+	err = handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		edgeJob, err = handler.createEdgeJob(tx, &payload.edgeJobBasePayload, payload.File)
+		return err
+	})
+
+	return response.TxResponse(w, edgeJob, err)
+}
+
+func (handler *Handler) createEdgeJobObjectFromPayload(tx dataservices.DataStoreTx, payload *edgeJobBasePayload) *portainer.EdgeJob {
+	return &portainer.EdgeJob{
+		ID:                  portainer.EdgeJobID(tx.EdgeJob().GetNextIdentifier()),
+		Name:                payload.Name,
+		CronExpression:      payload.CronExpression,
+		Recurring:           payload.Recurring,
+		Created:             time.Now().Unix(),
+		Endpoints:           convertEndpointsToMetaObject(payload.Endpoints),
+		EdgeGroups:          payload.EdgeGroups,
+		Version:             1,
+		GroupLogsCollection: map[portainer.EndpointID]portainer.EdgeJobEndpointMeta{},
+	}
+}
+
+func (handler *Handler) addAndPersistEdgeJob(tx dataservices.DataStoreTx, edgeJob *portainer.EdgeJob, file []byte, endpointsFromGroups []portainer.EndpointID) error {
+	edgeCronExpression := strings.Split(edgeJob.CronExpression, " ")
+	if len(edgeCronExpression) == 6 {
+		edgeCronExpression = edgeCronExpression[1:]
+	}
+	edgeJob.CronExpression = strings.Join(edgeCronExpression, " ")
+
+	for ID := range edgeJob.Endpoints {
+		endpoint, err := tx.Endpoint().Endpoint(ID)
+		if err != nil {
+			return err
+		}
+
+		if !endpointutils.IsEdgeEndpoint(endpoint) {
+			delete(edgeJob.Endpoints, ID)
+		}
+	}
+
+	scriptPath, err := handler.FileService.StoreEdgeJobFileFromBytes(strconv.Itoa(int(edgeJob.ID)), file)
+	if err != nil {
+		return err
+	}
+	edgeJob.ScriptPath = scriptPath
+
+	var endpointsMap map[portainer.EndpointID]portainer.EdgeJobEndpointMeta
+	if len(endpointsFromGroups) > 0 {
+		endpointsMap = convertEndpointsToMetaObject(endpointsFromGroups)
+
+		for ID := range endpointsMap {
+			endpoint, err := tx.Endpoint().Endpoint(ID)
+			if err != nil {
+				return err
+			}
+
+			if !endpointutils.IsEdgeEndpoint(endpoint) {
+				delete(endpointsMap, ID)
+			}
+		}
+
+		maps.Copy(endpointsMap, edgeJob.Endpoints)
+	} else {
+		endpointsMap = edgeJob.Endpoints
+	}
+
+	if len(endpointsMap) == 0 {
+		return errors.New("environments or edge groups are mandatory for an Edge job")
+	}
+
+	return tx.EdgeJob().CreateWithID(edgeJob.ID, edgeJob)
+}
diff --git a/api/http/handler/edgejobs/edgejob_create_test.go b/api/http/handler/edgejobs/edgejob_create_test.go
new file mode 100644
index 0000000..e0aee3a
--- /dev/null
+++ b/api/http/handler/edgejobs/edgejob_create_test.go
@@ -0,0 +1,160 @@
+package edgejobs
+
+import (
+	"bytes"
+	"encoding/json"
+	"io"
+	"mime/multipart"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/gorilla/mux"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+)
+
+type mockFileService struct {
+	mock.Mock
+	portainer.FileService
+}
+
+func (m *mockFileService) StoreEdgeJobFileFromBytes(id string, file []byte) (string, error) {
+	args := m.Called(id, file)
+	return args.String(0), args.Error(1)
+}
+
+func (m *mockFileService) GetEdgeJobFolder(id string) string {
+	args := m.Called(id)
+
+	return args.String(0)
+}
+
+func (m *mockFileService) RemoveDirectory(path string) error {
+	args := m.Called(path)
+
+	return args.Error(0)
+}
+
+func initStore(t *testing.T) *datastore.Store {
+	_, store := datastore.MustNewTestStore(t, true, true)
+	require.NotNil(t, store)
+
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		require.NoError(t, tx.Endpoint().Create(&portainer.Endpoint{
+			ID:          1,
+			Name:        "endpoint-1",
+			EdgeID:      "edge-id-1",
+			GroupID:     1,
+			Type:        portainer.EdgeAgentOnDockerEnvironment,
+			UserTrusted: true,
+		}))
+
+		require.NoError(t, tx.Endpoint().Create(&portainer.Endpoint{
+			ID:          2,
+			Name:        "endpoint-2",
+			EdgeID:      "edge-id-2",
+			GroupID:     1,
+			Type:        portainer.EdgeAgentOnDockerEnvironment,
+			UserTrusted: false,
+		}))
+		return nil
+	}))
+
+	return store
+}
+
+func Test_edgeJobCreate_StringMethod_Success(t *testing.T) {
+	t.Parallel()
+	store := initStore(t)
+
+	fileService := &mockFileService{}
+	fileService.On("StoreEdgeJobFileFromBytes", mock.Anything, mock.Anything).Return("testfile.txt", nil)
+
+	handler := &Handler{
+		DataStore:   store,
+		FileService: fileService,
+	}
+
+	payload := edgeJobCreateFromFileContentPayload{
+		edgeJobBasePayload: edgeJobBasePayload{
+			Name:           "testjob",
+			CronExpression: "* * * * *",
+			Endpoints:      []portainer.EndpointID{1, 2},
+		},
+		FileContent: "echo hello",
+	}
+
+	body, _ := json.Marshal(payload)
+	req := httptest.NewRequest(http.MethodPost, "/edge_jobs/create/string", bytes.NewReader(body))
+	req = mux.SetURLVars(req, map[string]string{"method": "string"})
+	w := httptest.NewRecorder()
+
+	// Call handler
+	errh := handler.edgeJobCreate(w, req)
+	require.Nil(t, errh)
+	require.Equal(t, http.StatusOK, w.Result().StatusCode)
+
+	// Get edge job ID from response
+	var resp struct {
+		ID int `json:"Id"`
+	}
+	require.NoError(t, json.NewDecoder(w.Body).Decode(&resp))
+
+	edgeJob, err := store.EdgeJob().Read(portainer.EdgeJobID(resp.ID))
+	require.NoError(t, err)
+
+	require.Len(t, edgeJob.Endpoints, 2)
+	require.Contains(t, edgeJob.Endpoints, portainer.EndpointID(1))
+}
+
+func Test_edgeJobCreate_FileMethod_Success(t *testing.T) {
+	t.Parallel()
+	store := initStore(t)
+
+	fileService := &mockFileService{}
+	fileService.On("StoreEdgeJobFileFromBytes", mock.Anything, mock.Anything).Return("testfile.txt", nil)
+
+	handler := &Handler{
+		DataStore:   store,
+		FileService: fileService,
+	}
+
+	var body bytes.Buffer
+	writer := multipart.NewWriter(&body)
+	require.NoError(t, writer.WriteField("Name", "testjob"))
+	require.NoError(t, writer.WriteField("CronExpression", "* * * * *"))
+	require.NoError(t, writer.WriteField("Endpoints", "[1,2]"))
+
+	fileWriter, err := writer.CreateFormFile("file", "test.txt")
+	require.NoError(t, err)
+
+	_, err = io.Copy(fileWriter, strings.NewReader("echo hello"))
+	require.NoError(t, err)
+	require.NoError(t, writer.Close())
+
+	req := httptest.NewRequest(http.MethodPost, "/edge_jobs/create/file", &body)
+	req = mux.SetURLVars(req, map[string]string{"method": "file"})
+	req.Header.Set("Content-Type", writer.FormDataContentType())
+
+	w := httptest.NewRecorder()
+	handlerErr := handler.edgeJobCreate(w, req)
+	require.Nil(t, handlerErr)
+	require.Equal(t, http.StatusOK, w.Result().StatusCode)
+
+	var resp struct {
+		ID int `json:"Id"`
+	}
+	require.NoError(t, json.NewDecoder(w.Body).Decode(&resp))
+
+	edgeJob, err := store.EdgeJob().Read(portainer.EdgeJobID(resp.ID))
+	require.NoError(t, err)
+
+	require.Len(t, edgeJob.Endpoints, 2)
+	require.Contains(t, edgeJob.Endpoints, portainer.EndpointID(1))
+}
diff --git a/api/http/handler/edgejobs/edgejob_delete.go b/api/http/handler/edgejobs/edgejob_delete.go
new file mode 100644
index 0000000..6b26507
--- /dev/null
+++ b/api/http/handler/edgejobs/edgejob_delete.go
@@ -0,0 +1,79 @@
+package edgejobs
+
+import (
+	"maps"
+	"net/http"
+	"strconv"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/internal/edge"
+	"github.com/portainer/portainer/api/internal/edge/cache"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+
+	"github.com/rs/zerolog/log"
+)
+
+// @id EdgeJobDelete
+// @summary Delete an EdgeJob
+// @description **Access policy**: administrator
+// @tags edge_jobs
+// @security ApiKeyAuth
+// @security jwt
+// @param id path int true "EdgeJob Id"
+// @success 204
+// @failure 500
+// @failure 400
+// @failure 503 "Edge compute features are disabled"
+// @router /edge_jobs/{id} [delete]
+func (handler *Handler) edgeJobDelete(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	edgeJobID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid Edge job identifier route variable", err)
+	}
+
+	err = handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return handler.deleteEdgeJob(tx, portainer.EdgeJobID(edgeJobID))
+	})
+
+	return response.TxEmptyResponse(w, err)
+}
+
+func (handler *Handler) deleteEdgeJob(tx dataservices.DataStoreTx, edgeJobID portainer.EdgeJobID) error {
+	edgeJob, err := tx.EdgeJob().Read(edgeJobID)
+	if tx.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find an Edge job with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find an Edge job with the specified identifier inside the database", err)
+	}
+
+	edgeJobFolder := handler.FileService.GetEdgeJobFolder(strconv.Itoa(int(edgeJobID)))
+	if err := handler.FileService.RemoveDirectory(edgeJobFolder); err != nil {
+		log.Warn().Err(err).Msg("Unable to remove the files associated to the Edge job on the filesystem")
+	}
+
+	var endpointsMap map[portainer.EndpointID]portainer.EdgeJobEndpointMeta
+	if len(edgeJob.EdgeGroups) > 0 {
+		endpoints, err := edge.GetEndpointsFromEdgeGroups(edgeJob.EdgeGroups, tx)
+		if err != nil {
+			return httperror.InternalServerError("Unable to get Endpoints from EdgeGroups", err)
+		}
+
+		endpointsMap = convertEndpointsToMetaObject(endpoints)
+		maps.Copy(endpointsMap, edgeJob.Endpoints)
+	} else {
+		endpointsMap = edgeJob.Endpoints
+	}
+
+	for endpointID := range endpointsMap {
+		cache.Del(endpointID)
+	}
+
+	if err := tx.EdgeJob().Delete(edgeJob.ID); err != nil {
+		return httperror.InternalServerError("Unable to remove the Edge job from the database", err)
+	}
+
+	return nil
+}
diff --git a/api/http/handler/edgejobs/edgejob_file.go b/api/http/handler/edgejobs/edgejob_file.go
new file mode 100644
index 0000000..f892420
--- /dev/null
+++ b/api/http/handler/edgejobs/edgejob_file.go
@@ -0,0 +1,48 @@
+package edgejobs
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type edgeJobFileResponse struct {
+	FileContent string `json:"FileContent"`
+}
+
+// @id EdgeJobFile
+// @summary Fetch a file of an EdgeJob
+// @description **Access policy**: administrator
+// @tags edge_jobs
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param id path int true "EdgeJob Id"
+// @success 200 {object} edgeJobFileResponse
+// @failure 500
+// @failure 400
+// @failure 503 "Edge compute features are disabled"
+// @router /edge_jobs/{id}/file [get]
+func (handler *Handler) edgeJobFile(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	edgeJobID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid Edge job identifier route variable", err)
+	}
+
+	edgeJob, err := handler.DataStore.EdgeJob().Read(portainer.EdgeJobID(edgeJobID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find an Edge job with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find an Edge job with the specified identifier inside the database", err)
+	}
+
+	edgeJobFileContent, err := handler.FileService.GetFileContent(edgeJob.ScriptPath, "")
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve Edge job script file from disk", err)
+	}
+
+	return response.JSON(w, &edgeJobFileResponse{FileContent: string(edgeJobFileContent)})
+}
diff --git a/api/http/handler/edgejobs/edgejob_inspect.go b/api/http/handler/edgejobs/edgejob_inspect.go
new file mode 100644
index 0000000..2407b2b
--- /dev/null
+++ b/api/http/handler/edgejobs/edgejob_inspect.go
@@ -0,0 +1,52 @@
+package edgejobs
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type edgeJobInspectResponse struct {
+	*portainer.EdgeJob
+	Endpoints []portainer.EndpointID
+}
+
+// @id EdgeJobInspect
+// @summary Inspect an EdgeJob
+// @description **Access policy**: administrator
+// @tags edge_jobs
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param id path int true "EdgeJob Id"
+// @success 200 {object} portainer.EdgeJob
+// @failure 500
+// @failure 400
+// @failure 503 "Edge compute features are disabled"
+// @router /edge_jobs/{id} [get]
+func (handler *Handler) edgeJobInspect(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	edgeJobID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid Edge job identifier route variable", err)
+	}
+
+	edgeJob, err := handler.DataStore.EdgeJob().Read(portainer.EdgeJobID(edgeJobID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find an Edge job with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find an Edge job with the specified identifier inside the database", err)
+	}
+
+	responseObj := edgeJobInspectResponse{
+		EdgeJob: edgeJob,
+	}
+
+	for endpointID := range edgeJob.Endpoints {
+		responseObj.Endpoints = append(responseObj.Endpoints, endpointID)
+	}
+
+	return response.JSON(w, responseObj)
+}
diff --git a/api/http/handler/edgejobs/edgejob_list.go b/api/http/handler/edgejobs/edgejob_list.go
new file mode 100644
index 0000000..f28c58f
--- /dev/null
+++ b/api/http/handler/edgejobs/edgejob_list.go
@@ -0,0 +1,30 @@
+package edgejobs
+
+import (
+	"net/http"
+
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id EdgeJobList
+// @summary Fetch EdgeJobs list
+// @description **Access policy**: administrator
+// @tags edge_jobs
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @success 200 {array} portainer.EdgeJob
+// @failure 500
+// @failure 400
+// @failure 503 "Edge compute features are disabled"
+// @router /edge_jobs [get]
+// GET request on /api/edge_jobs
+func (handler *Handler) edgeJobList(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	edgeJobs, err := handler.DataStore.EdgeJob().ReadAll()
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve Edge jobs from the database", err)
+	}
+
+	return response.JSON(w, edgeJobs)
+}
diff --git a/api/http/handler/edgejobs/edgejob_tasklogs_clear.go b/api/http/handler/edgejobs/edgejob_tasklogs_clear.go
new file mode 100644
index 0000000..61b422a
--- /dev/null
+++ b/api/http/handler/edgejobs/edgejob_tasklogs_clear.go
@@ -0,0 +1,93 @@
+package edgejobs
+
+import (
+	"net/http"
+	"slices"
+	"strconv"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/internal/edge"
+	"github.com/portainer/portainer/api/internal/edge/cache"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id EdgeJobTasksClear
+// @summary Clear the log for a specifc task on an EdgeJob
+// @description **Access policy**: administrator
+// @tags edge_jobs
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param id path int true "EdgeJob Id"
+// @param taskID path int true "Task Id"
+// @success 204
+// @failure 500
+// @failure 400
+// @failure 503 "Edge compute features are disabled"
+// @router /edge_jobs/{id}/tasks/{taskID}/logs [delete]
+func (handler *Handler) edgeJobTasksClear(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	edgeJobID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid Edge job identifier route variable", err)
+	}
+
+	taskID, err := request.RetrieveNumericRouteVariableValue(r, "taskID")
+	if err != nil {
+		return httperror.BadRequest("Invalid Task identifier route variable", err)
+	}
+
+	mutationFn := func(edgeJob *portainer.EdgeJob, endpointID portainer.EndpointID, endpointsFromGroups []portainer.EndpointID) {
+		if slices.Contains(endpointsFromGroups, endpointID) {
+			edgeJob.GroupLogsCollection[endpointID] = portainer.EdgeJobEndpointMeta{
+				CollectLogs: false,
+				LogsStatus:  portainer.EdgeJobLogsStatusIdle,
+			}
+		} else {
+			meta := edgeJob.Endpoints[endpointID]
+			meta.CollectLogs = false
+			meta.LogsStatus = portainer.EdgeJobLogsStatusIdle
+			edgeJob.Endpoints[endpointID] = meta
+		}
+	}
+
+	err = handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		updateEdgeJobFn := func(edgeJob *portainer.EdgeJob, endpointID portainer.EndpointID, endpointsFromGroups []portainer.EndpointID) error {
+			mutationFn(edgeJob, endpointID, endpointsFromGroups)
+
+			return tx.EdgeJob().Update(edgeJob.ID, edgeJob)
+		}
+
+		return handler.clearEdgeJobTaskLogs(tx, portainer.EdgeJobID(edgeJobID), portainer.EndpointID(taskID), updateEdgeJobFn)
+	})
+
+	return response.TxEmptyResponse(w, err)
+}
+
+func (handler *Handler) clearEdgeJobTaskLogs(tx dataservices.DataStoreTx, edgeJobID portainer.EdgeJobID, endpointID portainer.EndpointID, updateEdgeJob func(*portainer.EdgeJob, portainer.EndpointID, []portainer.EndpointID) error) error {
+	edgeJob, err := tx.EdgeJob().Read(edgeJobID)
+	if tx.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find an Edge job with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find an Edge job with the specified identifier inside the database", err)
+	}
+
+	if err := handler.FileService.ClearEdgeJobTaskLogs(strconv.Itoa(int(edgeJobID)), strconv.Itoa(int(endpointID))); err != nil {
+		return httperror.InternalServerError("Unable to clear log file from disk", err)
+	}
+
+	endpointsFromGroups, err := edge.GetEndpointsFromEdgeGroups(edgeJob.EdgeGroups, tx)
+	if err != nil {
+		return httperror.InternalServerError("Unable to get Endpoints from EdgeGroups", err)
+	}
+
+	if err := updateEdgeJob(edgeJob, endpointID, endpointsFromGroups); err != nil {
+		return httperror.InternalServerError("Unable to persist Edge job changes in the database", err)
+	}
+
+	cache.Del(endpointID)
+
+	return nil
+}
diff --git a/api/http/handler/edgejobs/edgejob_tasklogs_collect.go b/api/http/handler/edgejobs/edgejob_tasklogs_collect.go
new file mode 100644
index 0000000..6f1e802
--- /dev/null
+++ b/api/http/handler/edgejobs/edgejob_tasklogs_collect.go
@@ -0,0 +1,86 @@
+package edgejobs
+
+import (
+	"net/http"
+	"slices"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/internal/edge"
+	"github.com/portainer/portainer/api/internal/edge/cache"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id EdgeJobTasksCollect
+// @summary Collect the log for a specifc task on an EdgeJob
+// @description **Access policy**: administrator
+// @tags edge_jobs
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param id path int true "EdgeJob Id"
+// @param taskID path int true "Task Id"
+// @success 204
+// @failure 500
+// @failure 400
+// @failure 503 "Edge compute features are disabled"
+// @router /edge_jobs/{id}/tasks/{taskID}/logs [post]
+func (handler *Handler) edgeJobTasksCollect(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	edgeJobID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid Edge job identifier route variable", err)
+	}
+
+	taskID, err := request.RetrieveNumericRouteVariableValue(r, "taskID")
+	if err != nil {
+		return httperror.BadRequest("Invalid Task identifier route variable", err)
+	}
+
+	err = handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		edgeJob, err := tx.EdgeJob().Read(portainer.EdgeJobID(edgeJobID))
+		if tx.IsErrObjectNotFound(err) {
+			return httperror.NotFound("Unable to find an Edge job with the specified identifier inside the database", err)
+		} else if err != nil {
+			return httperror.InternalServerError("Unable to find an Edge job with the specified identifier inside the database", err)
+		}
+
+		endpointID := portainer.EndpointID(taskID)
+		endpointsFromGroups, err := edge.GetEndpointsFromEdgeGroups(edgeJob.EdgeGroups, tx)
+		if err != nil {
+			return httperror.InternalServerError("Unable to get Endpoints from EdgeGroups", err)
+		}
+
+		if slices.Contains(endpointsFromGroups, endpointID) {
+			edgeJob.GroupLogsCollection[endpointID] = portainer.EdgeJobEndpointMeta{
+				CollectLogs: true,
+				LogsStatus:  portainer.EdgeJobLogsStatusPending,
+			}
+		} else {
+			meta := edgeJob.Endpoints[endpointID]
+			meta.CollectLogs = true
+			meta.LogsStatus = portainer.EdgeJobLogsStatusPending
+			edgeJob.Endpoints[endpointID] = meta
+		}
+
+		if err := tx.EdgeJob().Update(edgeJob.ID, edgeJob); err != nil {
+			return httperror.InternalServerError("Unable to persist Edge job changes in the database", err)
+		}
+
+		endpoint, err := tx.Endpoint().Endpoint(endpointID)
+		if err != nil {
+			return httperror.InternalServerError("Unable to retrieve environment from the database", err)
+		}
+
+		cache.Del(endpointID)
+
+		if endpoint.Edge.AsyncMode {
+			return httperror.BadRequest("Async Edge Endpoints are not supported in Portainer CE", nil)
+		}
+
+		return nil
+	})
+
+	return response.TxEmptyResponse(w, err)
+}
diff --git a/api/http/handler/edgejobs/edgejob_tasklogs_inspect.go b/api/http/handler/edgejobs/edgejob_tasklogs_inspect.go
new file mode 100644
index 0000000..92aad8c
--- /dev/null
+++ b/api/http/handler/edgejobs/edgejob_tasklogs_inspect.go
@@ -0,0 +1,47 @@
+package edgejobs
+
+import (
+	"net/http"
+	"strconv"
+
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type fileResponse struct {
+	FileContent string `json:"FileContent"`
+}
+
+// @id EdgeJobTaskLogsInspect
+// @summary Fetch the log for a specifc task on an EdgeJob
+// @description **Access policy**: administrator
+// @tags edge_jobs
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param id path int true "EdgeJob Id"
+// @param taskID path int true "Task Id"
+// @success 200 {object} fileResponse
+// @failure 500
+// @failure 400
+// @failure 503 "Edge compute features are disabled"
+// @router /edge_jobs/{id}/tasks/{taskID}/logs [get]
+func (handler *Handler) edgeJobTaskLogsInspect(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	edgeJobID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid Edge job identifier route variable", err)
+	}
+
+	taskID, err := request.RetrieveNumericRouteVariableValue(r, "taskID")
+	if err != nil {
+		return httperror.BadRequest("Invalid Task identifier route variable", err)
+	}
+
+	logFileContent, err := handler.FileService.GetEdgeJobTaskLogFileContent(strconv.Itoa(edgeJobID), strconv.Itoa(taskID))
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve log file from disk", err)
+	}
+
+	return response.JSON(w, &fileResponse{FileContent: logFileContent})
+}
diff --git a/api/http/handler/edgejobs/edgejob_tasks_list.go b/api/http/handler/edgejobs/edgejob_tasks_list.go
new file mode 100644
index 0000000..afde439
--- /dev/null
+++ b/api/http/handler/edgejobs/edgejob_tasks_list.go
@@ -0,0 +1,128 @@
+package edgejobs
+
+import (
+	"errors"
+	"fmt"
+	"maps"
+	"net/http"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/utils/filters"
+	"github.com/portainer/portainer/api/internal/edge"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type taskContainer struct {
+	ID           string                      `json:"Id"`
+	EndpointID   portainer.EndpointID        `json:"EndpointId"`
+	EndpointName string                      `json:"EndpointName"`
+	LogsStatus   portainer.EdgeJobLogsStatus `json:"LogsStatus"`
+}
+
+// @id EdgeJobTasksList
+// @summary Fetch the list of tasks on an EdgeJob
+// @description **Access policy**: administrator
+// @tags edge_jobs
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param id path int true "EdgeJob Id"
+// @success 200 {array} taskContainer
+// @failure 500
+// @failure 400
+// @failure 503 "Edge compute features are disabled"
+// @router /edge_jobs/{id}/tasks [get]
+func (handler *Handler) edgeJobTasksList(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	edgeJobID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid Edge job identifier route variable", err)
+	}
+
+	params := filters.ExtractListModifiersQueryParams(r)
+
+	var tasks []*taskContainer
+	err = handler.DataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
+		tasks, err = listEdgeJobTasks(tx, portainer.EdgeJobID(edgeJobID))
+		return err
+	})
+
+	return response.TxFuncResponse(err, func() *httperror.HandlerError {
+		results := filters.SearchOrderAndPaginate(tasks, params, filters.Config[*taskContainer]{
+			SearchAccessors: []filters.SearchAccessor[*taskContainer]{
+				func(tc *taskContainer) (string, error) {
+					switch tc.LogsStatus {
+					case portainer.EdgeJobLogsStatusPending:
+						return "pending", nil
+					case 0, portainer.EdgeJobLogsStatusIdle:
+						return "idle", nil
+					case portainer.EdgeJobLogsStatusCollected:
+						return "collected", nil
+					}
+					return "", errors.New("unknown state")
+				},
+				func(tc *taskContainer) (string, error) {
+					return tc.EndpointName, nil
+				},
+			},
+			SortBindings: []filters.SortBinding[*taskContainer]{
+				{Key: "EndpointName", Fn: func(a, b *taskContainer) int { return strings.Compare(a.EndpointName, b.EndpointName) }},
+			},
+		})
+
+		filters.ApplyFilterResultsHeaders(&w, results)
+
+		return response.JSON(w, results.Items)
+	})
+}
+
+func listEdgeJobTasks(tx dataservices.DataStoreTx, edgeJobID portainer.EdgeJobID) ([]*taskContainer, error) {
+	edgeJob, err := tx.EdgeJob().Read(edgeJobID)
+	if tx.IsErrObjectNotFound(err) {
+		return nil, httperror.NotFound("Unable to find an Edge job with the specified identifier inside the database", err)
+	} else if err != nil {
+		return nil, httperror.InternalServerError("Unable to find an Edge job with the specified identifier inside the database", err)
+	}
+
+	endpoints, err := tx.Endpoint().Endpoints()
+	if err != nil {
+		return nil, err
+	}
+
+	tasks := make([]*taskContainer, 0)
+
+	endpointsMap := map[portainer.EndpointID]portainer.EdgeJobEndpointMeta{}
+	if len(edgeJob.EdgeGroups) > 0 {
+		endpoints, err := edge.GetEndpointsFromEdgeGroups(edgeJob.EdgeGroups, tx)
+		if err != nil {
+			return nil, httperror.InternalServerError("Unable to get Endpoints from EdgeGroups", err)
+		}
+
+		endpointsMap = convertEndpointsToMetaObject(endpoints)
+		maps.Copy(endpointsMap, edgeJob.GroupLogsCollection)
+	}
+
+	maps.Copy(endpointsMap, edgeJob.Endpoints)
+
+	for endpointID, meta := range endpointsMap {
+
+		endpointName := ""
+		for idx := range endpoints {
+			if endpoints[idx].ID == endpointID {
+				endpointName = endpoints[idx].Name
+			}
+		}
+
+		tasks = append(tasks, &taskContainer{
+			ID:           fmt.Sprintf("edgejob_task_%d_%d", edgeJob.ID, endpointID),
+			EndpointID:   endpointID,
+			EndpointName: endpointName,
+			LogsStatus:   meta.LogsStatus,
+		})
+	}
+
+	return tasks, nil
+}
diff --git a/api/http/handler/edgejobs/edgejob_tasks_list_test.go b/api/http/handler/edgejobs/edgejob_tasks_list_test.go
new file mode 100644
index 0000000..3c729f0
--- /dev/null
+++ b/api/http/handler/edgejobs/edgejob_tasks_list_test.go
@@ -0,0 +1,135 @@
+package edgejobs
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+	"github.com/portainer/portainer/api/roar"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_EdgeJobTasksListHandler(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, true, false)
+
+	handler := NewHandler(testhelpers.NewTestRequestBouncer())
+	handler.DataStore = store
+
+	addEnv := func(env *portainer.Endpoint) {
+		err := store.EndpointService.Create(env)
+		require.NoError(t, err)
+	}
+
+	addEdgeGroup := func(group *portainer.EdgeGroup) {
+		err := store.EdgeGroupService.Create(group)
+		require.NoError(t, err)
+	}
+
+	addJob := func(job *portainer.EdgeJob) {
+		err := store.EdgeJobService.Create(job)
+		require.NoError(t, err)
+	}
+
+	envCount := 6
+
+	for i := range envCount {
+		addEnv(&portainer.Endpoint{ID: portainer.EndpointID(i + 1), Name: "env_" + strconv.Itoa(i+1)})
+	}
+
+	addEdgeGroup(&portainer.EdgeGroup{ID: 1, Name: "edge_group_1", EndpointIDs: roar.FromSlice([]portainer.EndpointID{5, 6})})
+
+	addJob(&portainer.EdgeJob{
+		ID: 1,
+		Endpoints: map[portainer.EndpointID]portainer.EdgeJobEndpointMeta{
+			1: {},
+			2: {LogsStatus: portainer.EdgeJobLogsStatusIdle},
+			3: {LogsStatus: portainer.EdgeJobLogsStatusPending},
+			4: {LogsStatus: portainer.EdgeJobLogsStatusCollected}},
+		EdgeGroups: []portainer.EdgeGroupID{1},
+	})
+
+	test := func(params string, expect []taskContainer, expectedCount int) {
+		rr := httptest.NewRecorder()
+		req := httptest.NewRequest(http.MethodGet, "/edge_jobs/1/tasks"+params, nil)
+		handler.ServeHTTP(rr, req)
+		require.Equal(t, http.StatusOK, rr.Result().StatusCode)
+
+		var response []taskContainer
+		err := json.NewDecoder(rr.Body).Decode(&response)
+		require.NoError(t, err)
+
+		assert.ElementsMatch(t, expect, response)
+
+		tcStr := rr.Header().Get("x-total-count")
+		assert.NotEmpty(t, tcStr)
+
+		totalCount, err := strconv.Atoi(tcStr)
+		require.NoError(t, err)
+		assert.Equal(t, expectedCount, totalCount)
+
+		taStr := rr.Header().Get("x-total-available")
+		assert.NotEmpty(t, taStr)
+
+		totalAvailable, err := strconv.Atoi(taStr)
+		require.NoError(t, err)
+		assert.Equal(t, envCount, totalAvailable)
+
+	}
+
+	tasks := []taskContainer{
+		{},
+		{"edgejob_task_1_1", 1, "env_1", 0},
+		{"edgejob_task_1_2", 2, "env_2", portainer.EdgeJobLogsStatusIdle},
+		{"edgejob_task_1_3", 3, "env_3", portainer.EdgeJobLogsStatusPending},
+		{"edgejob_task_1_4", 4, "env_4", portainer.EdgeJobLogsStatusCollected},
+		{"edgejob_task_1_5", 5, "env_5", 0},
+		{"edgejob_task_1_6", 6, "env_6", 0},
+	}
+
+	t.Run("should return no results", func(t *testing.T) {
+		test("?search=foo", []taskContainer{}, 0)        // unknown search
+		test("?start=100&limit=1", []taskContainer{}, 6) // overflowing start. Still return the correct count header
+	})
+
+	t.Run("should return one element", func(t *testing.T) {
+		// limit the *returned* results but not the total count
+		test("?start=0&limit=1&sort=EndpointName&order=asc", []taskContainer{tasks[1]}, envCount)  // limit
+		test("?start=5&limit=10&sort=EndpointName&order=asc", []taskContainer{tasks[6]}, envCount) // start = last element + overflowing limit
+		// limit the number of results
+		test("?search=env_1", []taskContainer{tasks[1]}, 1) // only 1 result
+	})
+
+	t.Run("should filter by status", func(t *testing.T) {
+		test("?search=idle", []taskContainer{tasks[1], tasks[2], tasks[5], tasks[6]}, 4) // 0 (default value) is IDLE
+		test("?search=pending", []taskContainer{tasks[3]}, 1)
+		test("?search=collected", []taskContainer{tasks[4]}, 1)
+	})
+
+	t.Run("should return all elements", func(t *testing.T) {
+		test("", tasks[1:], envCount)                    // default
+		test("?some=invalid_param", tasks[1:], envCount) // unknown query params
+		test("?limit=-1", tasks[1:], envCount)           // underflowing limit
+		test("?start=100", tasks[1:], envCount)          // overflowing start without limit
+		test("?search=env", tasks[1:], envCount)         // search in a match-all keyword
+	})
+
+	testError := func(params string, status int) {
+		rr := httptest.NewRecorder()
+		req := httptest.NewRequest(http.MethodGet, "/edge_jobs/2/tasks"+params, nil)
+		handler.ServeHTTP(rr, req)
+		require.Equal(t, status, rr.Result().StatusCode)
+	}
+
+	t.Run("errors", func(t *testing.T) {
+		testError("", http.StatusNotFound) // unknown job id
+	})
+
+}
diff --git a/api/http/handler/edgejobs/edgejob_update.go b/api/http/handler/edgejobs/edgejob_update.go
new file mode 100644
index 0000000..b522bec
--- /dev/null
+++ b/api/http/handler/edgejobs/edgejob_update.go
@@ -0,0 +1,233 @@
+package edgejobs
+
+import (
+	"errors"
+	"maps"
+	"net/http"
+	"slices"
+	"strconv"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	dserrors "github.com/portainer/portainer/api/dataservices/errors"
+	"github.com/portainer/portainer/api/internal/edge"
+	"github.com/portainer/portainer/api/internal/edge/cache"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/portainer/portainer/pkg/validate"
+)
+
+type edgeJobUpdatePayload struct {
+	Name           *string
+	CronExpression *string
+	Recurring      *bool
+	Endpoints      []portainer.EndpointID
+	EdgeGroups     []portainer.EdgeGroupID
+	FileContent    *string
+}
+
+func (payload *edgeJobUpdatePayload) Validate(r *http.Request) error {
+	if payload.Name != nil && !validate.Matches(*payload.Name, `^[a-zA-Z0-9][a-zA-Z0-9_.-]+$`) {
+		return errors.New("invalid Edge job name format. Allowed characters are: [a-zA-Z0-9_.-]")
+	}
+
+	return nil
+}
+
+// @id EdgeJobUpdate
+// @summary Update an EdgeJob
+// @description **Access policy**: administrator
+// @tags edge_jobs
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @produce json
+// @param id path int true "EdgeJob Id"
+// @param body body edgeJobUpdatePayload true "EdgeGroup data"
+// @success 200 {object} portainer.EdgeJob
+// @failure 500
+// @failure 400
+// @failure 503 "Edge compute features are disabled"
+// @router /edge_jobs/{id} [put]
+func (handler *Handler) edgeJobUpdate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	edgeJobID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid Edge job identifier route variable", err)
+	}
+
+	var payload edgeJobUpdatePayload
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	var edgeJob *portainer.EdgeJob
+	err = handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		edgeJob, err = handler.updateEdgeJob(tx, portainer.EdgeJobID(edgeJobID), payload)
+		return err
+	})
+
+	return response.TxResponse(w, edgeJob, err)
+}
+
+func (handler *Handler) updateEdgeJob(tx dataservices.DataStoreTx, edgeJobID portainer.EdgeJobID, payload edgeJobUpdatePayload) (*portainer.EdgeJob, error) {
+	edgeJob, err := tx.EdgeJob().Read(edgeJobID)
+	if tx.IsErrObjectNotFound(err) {
+		return nil, httperror.NotFound("Unable to find an Edge job with the specified identifier inside the database", err)
+	} else if err != nil {
+		return nil, httperror.InternalServerError("Unable to find an Edge job with the specified identifier inside the database", err)
+	}
+
+	if err := handler.updateEdgeSchedule(tx, edgeJob, &payload); err != nil {
+		return nil, httperror.InternalServerError("Unable to update Edge job", err)
+	}
+
+	if err := tx.EdgeJob().Update(edgeJob.ID, edgeJob); err != nil {
+		return nil, httperror.InternalServerError("Unable to persist Edge job changes inside the database", err)
+	}
+
+	return edgeJob, nil
+}
+
+func (handler *Handler) updateEdgeSchedule(tx dataservices.DataStoreTx, edgeJob *portainer.EdgeJob, payload *edgeJobUpdatePayload) error {
+	if payload.Name != nil {
+		edgeJob.Name = *payload.Name
+	}
+
+	endpointsToAdd := map[portainer.EndpointID]bool{}
+	endpointsToRemove := map[portainer.EndpointID]bool{}
+
+	if payload.Endpoints != nil {
+		endpointsMap := map[portainer.EndpointID]portainer.EdgeJobEndpointMeta{}
+
+		newEndpoints := endpointutils.EndpointSet(payload.Endpoints)
+		for endpointID := range edgeJob.Endpoints {
+			if !newEndpoints[endpointID] {
+				endpointsToRemove[endpointID] = true
+			}
+		}
+
+		for _, endpointID := range payload.Endpoints {
+			endpoint, err := tx.Endpoint().Endpoint(endpointID)
+			if err != nil {
+				return err
+			}
+
+			if !endpointutils.IsEdgeEndpoint(endpoint) {
+				continue
+			}
+
+			if meta, exists := edgeJob.Endpoints[endpointID]; exists {
+				endpointsMap[endpointID] = meta
+			} else {
+				endpointsMap[endpointID] = portainer.EdgeJobEndpointMeta{}
+				endpointsToAdd[endpointID] = true
+			}
+		}
+
+		edgeJob.Endpoints = endpointsMap
+	}
+
+	if len(payload.EdgeGroups) == 0 && len(edgeJob.EdgeGroups) > 0 {
+		endpoints, err := edge.GetEndpointsFromEdgeGroups(edgeJob.EdgeGroups, tx)
+		if err != nil {
+			return errors.New("unable to get endpoints from edge groups")
+		}
+
+		for _, endpointID := range endpoints {
+			endpointsToRemove[endpointID] = true
+		}
+
+		edgeJob.EdgeGroups = nil
+	}
+
+	edgeGroupsToAdd := []portainer.EdgeGroupID{}
+	edgeGroupsToRemove := []portainer.EdgeGroupID{}
+	endpointsFromGroupsToAddMap := map[portainer.EndpointID]portainer.EdgeJobEndpointMeta{}
+
+	if len(payload.EdgeGroups) > 0 {
+		for _, edgeGroupID := range payload.EdgeGroups {
+			if ok, err := tx.EdgeGroup().Exists(edgeGroupID); !ok {
+				return dserrors.ErrObjectNotFound
+			} else if err != nil {
+				return err
+			}
+
+			if !slices.Contains(edgeJob.EdgeGroups, edgeGroupID) {
+				edgeGroupsToAdd = append(edgeGroupsToAdd, edgeGroupID)
+			}
+		}
+
+		endpointsFromGroupsToAdd, err := edge.GetEndpointsFromEdgeGroups(edgeGroupsToAdd, tx)
+		if err != nil {
+			return errors.New("unable to get endpoints from edge groups")
+		}
+		endpointsFromGroupsToAddMap = convertEndpointsToMetaObject(endpointsFromGroupsToAdd)
+
+		for endpointID := range endpointsFromGroupsToAddMap {
+			endpointsToAdd[endpointID] = true
+		}
+
+		newEdgeGroups := edge.EdgeGroupSet(payload.EdgeGroups)
+		for _, edgeGroupID := range edgeJob.EdgeGroups {
+			if !newEdgeGroups[edgeGroupID] {
+				edgeGroupsToRemove = append(edgeGroupsToRemove, edgeGroupID)
+			}
+		}
+
+		endpointsFromGroupsToRemove, err := edge.GetEndpointsFromEdgeGroups(edgeGroupsToRemove, tx)
+		if err != nil {
+			return errors.New("unable to get endpoints from edge groups")
+		}
+
+		endpointsToRemoveMap := convertEndpointsToMetaObject(endpointsFromGroupsToRemove)
+
+		for endpointID := range endpointsToRemoveMap {
+			endpointsToRemove[endpointID] = true
+		}
+
+		edgeJob.EdgeGroups = payload.EdgeGroups
+	}
+
+	updateVersion := false
+	if payload.CronExpression != nil && *payload.CronExpression != edgeJob.CronExpression {
+		edgeJob.CronExpression = *payload.CronExpression
+		updateVersion = true
+	}
+
+	fileContent, err := handler.FileService.GetFileContent(edgeJob.ScriptPath, "")
+	if err != nil {
+		return err
+	}
+
+	if payload.FileContent != nil && *payload.FileContent != string(fileContent) {
+		fileContent = []byte(*payload.FileContent)
+		if _, err := handler.FileService.StoreEdgeJobFileFromBytes(strconv.Itoa(int(edgeJob.ID)), fileContent); err != nil {
+			return err
+		}
+
+		updateVersion = true
+	}
+
+	if payload.Recurring != nil && *payload.Recurring != edgeJob.Recurring {
+		edgeJob.Recurring = *payload.Recurring
+		updateVersion = true
+	}
+
+	if updateVersion {
+		edgeJob.Version++
+	}
+
+	maps.Copy(endpointsFromGroupsToAddMap, edgeJob.Endpoints)
+
+	for endpointID := range endpointsFromGroupsToAddMap {
+		cache.Del(endpointID)
+	}
+
+	for endpointID := range endpointsToRemove {
+		cache.Del(endpointID)
+	}
+
+	return nil
+}
diff --git a/api/http/handler/edgejobs/handler.go b/api/http/handler/edgejobs/handler.go
new file mode 100644
index 0000000..c91e3dd
--- /dev/null
+++ b/api/http/handler/edgejobs/handler.go
@@ -0,0 +1,60 @@
+package edgejobs
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+
+	"github.com/gorilla/mux"
+)
+
+// Handler is the HTTP handler used to handle Edge job operations.
+type Handler struct {
+	*mux.Router
+	DataStore            dataservices.DataStore
+	FileService          portainer.FileService
+	ReverseTunnelService portainer.ReverseTunnelService
+}
+
+// NewHandler creates a handler to manage Edge job operations.
+func NewHandler(bouncer security.BouncerService) *Handler {
+	h := &Handler{
+		Router: mux.NewRouter(),
+	}
+
+	h.Handle("/edge_jobs",
+		bouncer.AdminAccess(bouncer.EdgeComputeOperation(httperror.LoggerHandler(h.edgeJobList)))).Methods(http.MethodGet)
+	h.Handle("/edge_jobs/create/{method}",
+		bouncer.AdminAccess(bouncer.EdgeComputeOperation(httperror.LoggerHandler(h.edgeJobCreate)))).Methods(http.MethodPost)
+	h.Handle("/edge_jobs/{id}",
+		bouncer.AdminAccess(bouncer.EdgeComputeOperation(httperror.LoggerHandler(h.edgeJobInspect)))).Methods(http.MethodGet)
+	h.Handle("/edge_jobs/{id}",
+		bouncer.AdminAccess(bouncer.EdgeComputeOperation(httperror.LoggerHandler(h.edgeJobUpdate)))).Methods(http.MethodPut)
+	h.Handle("/edge_jobs/{id}",
+		bouncer.AdminAccess(bouncer.EdgeComputeOperation(httperror.LoggerHandler(h.edgeJobDelete)))).Methods(http.MethodDelete)
+	h.Handle("/edge_jobs/{id}/file",
+		bouncer.AdminAccess(bouncer.EdgeComputeOperation(httperror.LoggerHandler(h.edgeJobFile)))).Methods(http.MethodGet)
+	h.Handle("/edge_jobs/{id}/tasks",
+		bouncer.AdminAccess(bouncer.EdgeComputeOperation(httperror.LoggerHandler(h.edgeJobTasksList)))).Methods(http.MethodGet)
+	h.Handle("/edge_jobs/{id}/tasks/{taskID}/logs",
+		bouncer.AdminAccess(bouncer.EdgeComputeOperation(httperror.LoggerHandler(h.edgeJobTaskLogsInspect)))).Methods(http.MethodGet)
+	h.Handle("/edge_jobs/{id}/tasks/{taskID}/logs",
+		bouncer.AdminAccess(bouncer.EdgeComputeOperation(httperror.LoggerHandler(h.edgeJobTasksCollect)))).Methods(http.MethodPost)
+	h.Handle("/edge_jobs/{id}/tasks/{taskID}/logs",
+		bouncer.AdminAccess(bouncer.EdgeComputeOperation(httperror.LoggerHandler(h.edgeJobTasksClear)))).Methods(http.MethodDelete)
+
+	return h
+}
+
+func convertEndpointsToMetaObject(endpoints []portainer.EndpointID) map[portainer.EndpointID]portainer.EdgeJobEndpointMeta {
+	endpointsMap := map[portainer.EndpointID]portainer.EdgeJobEndpointMeta{}
+
+	for _, endpointID := range endpoints {
+		endpointsMap[endpointID] = portainer.EdgeJobEndpointMeta{}
+	}
+
+	return endpointsMap
+}
diff --git a/api/http/handler/edgestacks/edgestack_create.go b/api/http/handler/edgestacks/edgestack_create.go
new file mode 100644
index 0000000..05fbb97
--- /dev/null
+++ b/api/http/handler/edgestacks/edgestack_create.go
@@ -0,0 +1,57 @@
+package edgestacks
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	httperrors "github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+func (handler *Handler) edgeStackCreate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	method, err := request.RetrieveRouteVariableValue(r, "method")
+	if err != nil {
+		return httperror.BadRequest("Invalid query parameter: method", err)
+	}
+
+	dryrun, _ := request.RetrieveBooleanQueryParameter(r, "dryrun", true)
+
+	tokenData, err := security.RetrieveTokenData(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve user details from authentication token", err)
+	}
+
+	var edgeStack *portainer.EdgeStack
+	if err := handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		edgeStack, err = handler.createSwarmStack(tx, method, dryrun, tokenData, r)
+		return err
+	}); err != nil {
+		switch {
+		case httperrors.IsInvalidPayloadError(err):
+			return httperror.BadRequest("Invalid payload", err)
+		case httperrors.IsConflictError(err):
+			return httperror.Conflict(err.Error(), err)
+		default:
+			return httperror.InternalServerError("Unable to create Edge stack", err)
+		}
+	}
+
+	return response.JSON(w, edgeStack)
+}
+
+func (handler *Handler) createSwarmStack(tx dataservices.DataStoreTx, method string, dryrun bool, tokenData *portainer.TokenData, r *http.Request) (*portainer.EdgeStack, error) {
+	switch method {
+	case "string":
+		return handler.createEdgeStackFromFileContent(r, tx, tokenData, dryrun)
+	case "repository":
+		return handler.createEdgeStackFromGitRepository(r, tx, tokenData, dryrun)
+	case "file":
+		return handler.createEdgeStackFromFileUpload(r, tx, tokenData, dryrun)
+	}
+
+	return nil, httperrors.NewInvalidPayloadError("Invalid value for query parameter: method. Value must be one of: string, repository or file")
+}
diff --git a/api/http/handler/edgestacks/edgestack_create_file.go b/api/http/handler/edgestacks/edgestack_create_file.go
new file mode 100644
index 0000000..0129ccd
--- /dev/null
+++ b/api/http/handler/edgestacks/edgestack_create_file.go
@@ -0,0 +1,129 @@
+package edgestacks
+
+import (
+	"fmt"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	httperrors "github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+	"github.com/portainer/portainer/pkg/edge"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+
+	"github.com/pkg/errors"
+)
+
+type edgeStackFromFileUploadPayload struct {
+	// Name of the stack
+	// Max length: 255
+	// Name must only contains lowercase characters, numbers, hyphens, or underscores
+	// Name must start with a lowercase character or number
+	// Example: stack-name or stack_123 or stackName
+	Name             string
+	StackFileContent []byte
+	EdgeGroups       []portainer.EdgeGroupID
+	// Deployment type to deploy this stack
+	// Valid values are: 0 - 'compose', 1 - 'kubernetes'
+	// compose is enabled only for docker environments
+	// kubernetes is enabled only for kubernetes environments
+	DeploymentType portainer.EdgeStackDeploymentType `example:"0" enums:"0,1"`
+	Registries     []portainer.RegistryID
+	// Uses the manifest's namespaces instead of the default one
+	UseManifestNamespaces bool
+}
+
+func (payload *edgeStackFromFileUploadPayload) Validate(r *http.Request) error {
+	name, err := request.RetrieveMultiPartFormValue(r, "Name", false)
+	if err != nil {
+		return httperrors.NewInvalidPayloadError("Invalid stack name")
+	}
+	payload.Name = name
+
+	if !edge.IsValidEdgeStackName(payload.Name) {
+		return httperrors.NewInvalidPayloadError("Invalid stack name. Stack name must only consist of lowercase alpha characters, numbers, hyphens, or underscores as well as start with a lowercase character or number")
+	}
+
+	composeFileContent, _, err := request.RetrieveMultiPartFormFile(r, "file")
+	if err != nil {
+		return httperrors.NewInvalidPayloadError("Invalid Compose file. Ensure that the Compose file is uploaded correctly")
+	}
+	payload.StackFileContent = composeFileContent
+
+	var edgeGroups []portainer.EdgeGroupID
+	err = request.RetrieveMultiPartFormJSONValue(r, "EdgeGroups", &edgeGroups, false)
+	if err != nil || len(edgeGroups) == 0 {
+		return httperrors.NewInvalidPayloadError("Edge Groups are mandatory for an Edge stack")
+	}
+	payload.EdgeGroups = edgeGroups
+
+	deploymentType, err := request.RetrieveNumericMultiPartFormValue(r, "DeploymentType", false)
+	if err != nil {
+		return httperrors.NewInvalidPayloadError("Invalid deployment type")
+	}
+	payload.DeploymentType = portainer.EdgeStackDeploymentType(deploymentType)
+	if payload.DeploymentType != portainer.EdgeStackDeploymentCompose && payload.DeploymentType != portainer.EdgeStackDeploymentKubernetes {
+		return httperrors.NewInvalidPayloadError("Invalid deployment type")
+	}
+
+	var registries []portainer.RegistryID
+	err = request.RetrieveMultiPartFormJSONValue(r, "Registries", &registries, true)
+	if err != nil {
+		return httperrors.NewInvalidPayloadError("Invalid registry type")
+	}
+	payload.Registries = registries
+
+	useManifestNamespaces, _ := request.RetrieveBooleanMultiPartFormValue(r, "UseManifestNamespaces", true)
+	payload.UseManifestNamespaces = useManifestNamespaces
+
+	return nil
+}
+
+// @id EdgeStackCreateFile
+// @summary Create an EdgeStack from file
+// @description **Access policy**: administrator
+// @tags edge_stacks
+// @security ApiKeyAuth
+// @security jwt
+// @accept multipart/form-data
+// @produce json
+// @param Name formData string true "Name of the stack. it must only consist of lowercase alphanumeric characters, hyphens, or underscores as well as start with a letter or number"
+// @param file formData file true "Content of the Stack file"
+// @param EdgeGroups formData string true "JSON stringified array of Edge Groups ids"
+// @param DeploymentType formData int true "deploy type 0 - 'compose', 1 - 'kubernetes'"
+// @param Registries formData string false "JSON stringified array of Registry ids to use for this stack"
+// @param UseManifestNamespaces formData bool false "Uses the manifest's namespaces instead of the default one, relevant only for kube environments"
+// @param PrePullImage formData bool false "Pre Pull image"
+// @param RetryDeploy formData bool false "Retry deploy"
+// @param dryrun query string false "if true, will not create an edge stack, but just will check the settings and return a non-persisted edge stack object"
+// @success 200 {object} portainer.EdgeStack
+// @failure 400 "Bad request"
+// @failure 500 "Internal server error"
+// @failure 503 "Edge compute features are disabled"
+// @router /edge_stacks/create/file [post]
+func (handler *Handler) createEdgeStackFromFileUpload(r *http.Request, tx dataservices.DataStoreTx, tokenData *portainer.TokenData, dryrun bool) (*portainer.EdgeStack, error) {
+	payload := &edgeStackFromFileUploadPayload{}
+	if err := payload.Validate(r); err != nil {
+		return nil, err
+	}
+
+	stack, err := handler.edgeStacksService.BuildEdgeStack(tx, payload.Name, payload.DeploymentType, payload.EdgeGroups, payload.Registries, payload.UseManifestNamespaces)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to create edge stack object")
+	}
+
+	if dryrun {
+		return stack, nil
+	}
+
+	if err := stackutils.ValidateEdgeStackComposeContent(r.Context(), payload.DeploymentType, payload.StackFileContent); err != nil {
+		return nil, httperrors.NewInvalidPayloadError(err.Error())
+	}
+
+	stack.CreatedByUserId = fmt.Sprintf("%d", tokenData.ID)
+	stack.CreatedBy = stackutils.SanitizeLabel(tokenData.Username)
+
+	return handler.edgeStacksService.PersistEdgeStack(tx, stack, func(stackFolder string, relatedEndpointIds []portainer.EndpointID) (composePath string, manifestPath string, projectPath string, err error) {
+		return handler.storeFileContent(tx, stackFolder, payload.DeploymentType, relatedEndpointIds, payload.StackFileContent)
+	})
+}
diff --git a/api/http/handler/edgestacks/edgestack_create_git.go b/api/http/handler/edgestacks/edgestack_create_git.go
new file mode 100644
index 0000000..3541460
--- /dev/null
+++ b/api/http/handler/edgestacks/edgestack_create_git.go
@@ -0,0 +1,208 @@
+package edgestacks
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/dataservices/source"
+	"github.com/portainer/portainer/api/filesystem"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	"github.com/portainer/portainer/api/gitops/sources"
+	"github.com/portainer/portainer/api/gitops/workflows"
+	httperrors "github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+	"github.com/portainer/portainer/pkg/edge"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/ssrf"
+	"github.com/portainer/portainer/pkg/validate"
+
+	"github.com/pkg/errors"
+)
+
+type edgeStackFromGitRepositoryPayload struct {
+	// Name of the stack
+	// Max length: 255
+	// Name must only contains lowercase characters, numbers, hyphens, or underscores
+	// Name must start with a lowercase character or number
+	// Example: stack-name or stack_123 or stackName
+	Name string `example:"stack-name" validate:"required"`
+	// SourceID references an existing Source for git credentials/URL.
+	// When set, the inline URL and authentication fields are ignored.
+	SourceID portainer.SourceID `example:"1"`
+	// Deprecated: Use SourceID instead. URL of a Git repository hosting the Stack file.
+	RepositoryURL string `example:"https://github.com/openfaas/faas"`
+	// Reference name of a Git repository hosting the Stack file
+	RepositoryReferenceName string `example:"refs/heads/master"`
+	// Deprecated: Use SourceID instead. Use basic authentication to clone the Git repository.
+	RepositoryAuthentication bool `example:"true"`
+	// Deprecated: Use SourceID instead. Username used in basic authentication.
+	RepositoryUsername string `example:"myGitUsername"`
+	// Deprecated: Use SourceID instead. Password used in basic authentication.
+	RepositoryPassword string `example:"myGitPassword"`
+	// Path to the Stack file inside the Git repository
+	FilePathInRepository string `example:"docker-compose.yml" default:"docker-compose.yml"`
+	// List of identifiers of EdgeGroups
+	EdgeGroups []portainer.EdgeGroupID `example:"1" validate:"required"`
+	// Deployment type to deploy this stack
+	// Valid values are: 0 - 'compose', 1 - 'kubernetes'
+	// compose is enabled only for docker environments
+	// kubernetes is enabled only for kubernetes environments
+	DeploymentType portainer.EdgeStackDeploymentType `example:"0" enums:"0,1,2"`
+	// List of Registries to use for this stack
+	Registries []portainer.RegistryID
+	// Uses the manifest's namespaces instead of the default one
+	UseManifestNamespaces bool
+	// Deprecated: Use SourceID instead. TLSSkipVerify skips SSL verification when cloning the Git repository.
+	TLSSkipVerify bool `example:"false"`
+}
+
+func (payload *edgeStackFromGitRepositoryPayload) Validate(r *http.Request) error {
+	if len(payload.Name) == 0 {
+		return httperrors.NewInvalidPayloadError("Invalid stack name")
+	}
+
+	if !edge.IsValidEdgeStackName(payload.Name) {
+		return httperrors.NewInvalidPayloadError("Invalid stack name. Stack name must only consist of lowercase alpha characters, numbers, hyphens, or underscores as well as start with a lowercase character or number")
+	}
+
+	if payload.SourceID == 0 {
+		if len(payload.RepositoryURL) == 0 || !validate.IsURL(payload.RepositoryURL) {
+			return httperrors.NewInvalidPayloadError("Invalid repository URL. Must correspond to a valid URL format")
+		}
+		if payload.RepositoryAuthentication && len(payload.RepositoryPassword) == 0 {
+			return httperrors.NewInvalidPayloadError("Invalid repository credentials. Password must be specified when authentication is enabled")
+		}
+	}
+
+	if payload.DeploymentType != portainer.EdgeStackDeploymentCompose && payload.DeploymentType != portainer.EdgeStackDeploymentKubernetes {
+		return httperrors.NewInvalidPayloadError("Invalid deployment type")
+	}
+
+	if len(payload.FilePathInRepository) == 0 {
+		switch payload.DeploymentType {
+		case portainer.EdgeStackDeploymentCompose:
+			payload.FilePathInRepository = filesystem.ComposeFileDefaultName
+		case portainer.EdgeStackDeploymentKubernetes:
+			payload.FilePathInRepository = filesystem.ManifestFileDefaultName
+		}
+	}
+
+	if len(payload.EdgeGroups) == 0 {
+		return httperrors.NewInvalidPayloadError("Invalid edge groups. At least one edge group must be specified")
+	}
+
+	return nil
+}
+
+// @id EdgeStackCreateRepository
+// @summary Create an EdgeStack from a git repository
+// @description **Access policy**: administrator
+// @tags edge_stacks
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param body body edgeStackFromGitRepositoryPayload true "stack config"
+// @param dryrun query string false "if true, will not create an edge stack, but just will check the settings and return a non-persisted edge stack object"
+// @success 200 {object} portainer.EdgeStack
+// @failure 400 "Bad request"
+// @failure 500 "Internal server error"
+// @failure 503 "Edge compute features are disabled"
+// @router /edge_stacks/create/repository [post]
+func (handler *Handler) createEdgeStackFromGitRepository(r *http.Request, tx dataservices.DataStoreTx, tokenData *portainer.TokenData, dryrun bool) (*portainer.EdgeStack, error) {
+	var payload edgeStackFromGitRepositoryPayload
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return nil, err
+	}
+
+	stack, err := handler.edgeStacksService.BuildEdgeStack(tx, payload.Name, payload.DeploymentType, payload.EdgeGroups, payload.Registries, payload.UseManifestNamespaces)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to create edge stack object")
+	}
+
+	if dryrun {
+		return stack, nil
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return nil, httperror.InternalServerError("Unable to retrieve user info from request context", err)
+	}
+	userContext := source.NewUserContext(securityContext.User, securityContext.UserMemberships)
+
+	repoConfig, httpErr := sources.ResolveRepoConfig(tx, userContext, sources.RepoConfigInput{
+		SourceID:                 payload.SourceID,
+		ReferenceName:            payload.RepositoryReferenceName,
+		ConfigFilePath:           payload.FilePathInRepository,
+		RepositoryURL:            payload.RepositoryURL,
+		TLSSkipVerify:            payload.TLSSkipVerify,
+		RepositoryAuthentication: payload.RepositoryAuthentication,
+		Username:                 payload.RepositoryUsername,
+		Password:                 payload.RepositoryPassword,
+	})
+	if httpErr != nil {
+		return nil, httpErr
+	}
+
+	if err := ssrf.CheckURL(r.Context(), repoConfig.URL); err != nil {
+		return nil, errors.Wrap(err, "repository URL blocked by SSRF policy")
+	}
+
+	stack.CreatedByUserId = fmt.Sprintf("%d", tokenData.ID)
+	stack.CreatedBy = stackutils.SanitizeLabel(tokenData.Username)
+
+	return handler.edgeStacksService.PersistEdgeStack(tx, stack, func(stackFolder string, relatedEndpointIds []portainer.EndpointID) (composePath string, manifestPath string, projectPath string, err error) {
+		return handler.storeManifestFromGitRepository(context.TODO(), tx, userContext, payload.SourceID, stackFolder, relatedEndpointIds, payload.DeploymentType, tokenData.ID, repoConfig)
+	})
+}
+
+func (handler *Handler) storeManifestFromGitRepository(ctx context.Context, tx dataservices.DataStoreTx, userContext source.UserContext, sourceID portainer.SourceID, stackFolder string, relatedEndpointIds []portainer.EndpointID, deploymentType portainer.EdgeStackDeploymentType, currentUserID portainer.UserID, repositoryConfig gittypes.RepoConfig) (composePath, manifestPath, projectPath string, err error) {
+	if hasWrongType, err := hasWrongEnvironmentType(tx.Endpoint(), relatedEndpointIds, deploymentType); err != nil {
+		return "", "", "", fmt.Errorf("unable to check for existence of non fitting environments: %w", err)
+	} else if hasWrongType {
+		return "", "", "", errors.New("edge stack with config do not match the environment type")
+	}
+
+	projectPath = handler.FileService.GetEdgeStackProjectPath(stackFolder)
+	repositoryUsername := ""
+	repositoryPassword := ""
+	if repositoryConfig.Authentication != nil && repositoryConfig.Authentication.Password != "" {
+		repositoryUsername = repositoryConfig.Authentication.Username
+		repositoryPassword = repositoryConfig.Authentication.Password
+	}
+
+	if err := handler.GitService.CloneRepository(
+		ctx,
+		projectPath,
+		repositoryConfig.URL,
+		repositoryConfig.ReferenceName,
+		repositoryUsername,
+		repositoryPassword,
+		repositoryConfig.TLSSkipVerify,
+	); err != nil {
+		if statusErr := workflows.SaveSourceStatus(tx, userContext, sourceID, err); statusErr != nil {
+			return "", "", "", fmt.Errorf("%w (and failed to persist status: %w)", err, statusErr)
+		}
+
+		return "", "", "", err
+	}
+
+	if err := workflows.SaveSourceStatus(tx, userContext, sourceID, nil); err != nil {
+		return "", "", "", fmt.Errorf("failed to persist source sync status: %w", err)
+	}
+
+	if deploymentType == portainer.EdgeStackDeploymentCompose {
+		return repositoryConfig.ConfigFilePath, "", projectPath, nil
+	}
+
+	if deploymentType == portainer.EdgeStackDeploymentKubernetes {
+		return "", repositoryConfig.ConfigFilePath, projectPath, nil
+	}
+
+	errMessage := fmt.Sprintf("unknown deployment type: %d", deploymentType)
+	return "", "", "", httperrors.NewInvalidPayloadError(errMessage)
+}
diff --git a/api/http/handler/edgestacks/edgestack_create_string.go b/api/http/handler/edgestacks/edgestack_create_string.go
new file mode 100644
index 0000000..3a573ea
--- /dev/null
+++ b/api/http/handler/edgestacks/edgestack_create_string.go
@@ -0,0 +1,136 @@
+package edgestacks
+
+import (
+	"fmt"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/filesystem"
+	httperrors "github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+	"github.com/portainer/portainer/pkg/edge"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+
+	"github.com/pkg/errors"
+)
+
+type edgeStackFromStringPayload struct {
+	// Name of the stack
+	// Max length: 255
+	// Name must only contains lowercase characters, numbers, hyphens, or underscores
+	// Name must start with a lowercase character or number
+	// Example: stack-name or stack_123 or stackName
+	Name string `example:"stack-name" validate:"required"`
+	// Content of the Stack file
+	StackFileContent string `example:"version: 3\n services:\n web:\n image:nginx" validate:"required"`
+	// List of identifiers of EdgeGroups
+	EdgeGroups []portainer.EdgeGroupID `example:"1"`
+	// Deployment type to deploy this stack
+	// Valid values are: 0 - 'compose', 1 - 'kubernetes'
+	// compose is enabled only for docker environments
+	// kubernetes is enabled only for kubernetes environments
+	DeploymentType portainer.EdgeStackDeploymentType `example:"0" enums:"0,1,2"`
+	// List of Registries to use for this stack
+	Registries []portainer.RegistryID
+	// Uses the manifest's namespaces instead of the default one
+	UseManifestNamespaces bool
+}
+
+func (payload *edgeStackFromStringPayload) Validate(r *http.Request) error {
+	if len(payload.Name) == 0 {
+		return httperrors.NewInvalidPayloadError("Invalid stack name")
+	}
+
+	if !edge.IsValidEdgeStackName(payload.Name) {
+		return httperrors.NewInvalidPayloadError("Invalid stack name. Stack name must only consist of lowercase alpha characters, numbers, hyphens, or underscores as well as start with a lowercase character or number")
+	}
+
+	if len(payload.StackFileContent) == 0 {
+		return httperrors.NewInvalidPayloadError("Invalid stack file content")
+	}
+
+	if len(payload.EdgeGroups) == 0 {
+		return httperrors.NewInvalidPayloadError("Edge Groups are mandatory for an Edge stack")
+	}
+
+	if payload.DeploymentType != portainer.EdgeStackDeploymentCompose && payload.DeploymentType != portainer.EdgeStackDeploymentKubernetes {
+		return httperrors.NewInvalidPayloadError("Invalid deployment type")
+	}
+
+	return nil
+}
+
+// @id EdgeStackCreateString
+// @summary Create an EdgeStack from a text
+// @description **Access policy**: administrator
+// @tags edge_stacks
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param body body edgeStackFromStringPayload true "stack config"
+// @param dryrun query string false "if true, will not create an edge stack, but just will check the settings and return a non-persisted edge stack object"
+// @success 200 {object} portainer.EdgeStack
+// @failure 400 "Bad request"
+// @failure 500 "Internal server error"
+// @failure 503 "Edge compute features are disabled"
+// @router /edge_stacks/create/string [post]
+func (handler *Handler) createEdgeStackFromFileContent(r *http.Request, tx dataservices.DataStoreTx, tokenData *portainer.TokenData, dryrun bool) (*portainer.EdgeStack, error) {
+	var payload edgeStackFromStringPayload
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return nil, err
+	}
+
+	stack, err := handler.edgeStacksService.BuildEdgeStack(tx, payload.Name, payload.DeploymentType, payload.EdgeGroups, payload.Registries, payload.UseManifestNamespaces)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to create Edge stack object")
+	}
+
+	stack.CreatedByUserId = fmt.Sprintf("%d", tokenData.ID)
+	stack.CreatedBy = stackutils.SanitizeLabel(tokenData.Username)
+
+	if dryrun {
+		return stack, nil
+	}
+
+	if err := stackutils.ValidateEdgeStackComposeContent(r.Context(), payload.DeploymentType, []byte(payload.StackFileContent)); err != nil {
+		return nil, httperrors.NewInvalidPayloadError(err.Error())
+	}
+
+	return handler.edgeStacksService.PersistEdgeStack(tx, stack, func(stackFolder string, relatedEndpointIds []portainer.EndpointID) (composePath string, manifestPath string, projectPath string, err error) {
+		return handler.storeFileContent(tx, stackFolder, payload.DeploymentType, relatedEndpointIds, []byte(payload.StackFileContent))
+	})
+}
+
+func (handler *Handler) storeFileContent(tx dataservices.DataStoreTx, stackFolder string, deploymentType portainer.EdgeStackDeploymentType, relatedEndpointIds []portainer.EndpointID, fileContent []byte) (composePath, manifestPath, projectPath string, err error) {
+	if hasWrongType, err := hasWrongEnvironmentType(tx.Endpoint(), relatedEndpointIds, deploymentType); err != nil {
+		return "", "", "", fmt.Errorf("unable to check for existence of non fitting environments: %w", err)
+	} else if hasWrongType {
+		return "", "", "", errors.New("edge stack with config do not match the environment type")
+	}
+
+	if deploymentType == portainer.EdgeStackDeploymentCompose {
+		composePath = filesystem.ComposeFileDefaultName
+
+		projectPath, err := handler.FileService.StoreEdgeStackFileFromBytes(stackFolder, composePath, fileContent)
+		if err != nil {
+			return "", "", "", err
+		}
+
+		return composePath, "", projectPath, nil
+	}
+
+	if deploymentType == portainer.EdgeStackDeploymentKubernetes {
+		manifestPath = filesystem.ManifestFileDefaultName
+
+		projectPath, err := handler.FileService.StoreEdgeStackFileFromBytes(stackFolder, manifestPath, fileContent)
+		if err != nil {
+			return "", "", "", err
+		}
+
+		return "", manifestPath, projectPath, nil
+	}
+
+	errMessage := fmt.Sprintf("invalid deployment type: %d", deploymentType)
+	return "", "", "", httperrors.NewInvalidPayloadError(errMessage)
+}
diff --git a/api/http/handler/edgestacks/edgestack_create_test.go b/api/http/handler/edgestacks/edgestack_create_test.go
new file mode 100644
index 0000000..b9c46f9
--- /dev/null
+++ b/api/http/handler/edgestacks/edgestack_create_test.go
@@ -0,0 +1,216 @@
+package edgestacks
+
+import (
+	"bytes"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/roar"
+
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/require"
+)
+
+// Create
+func TestCreateAndInspect(t *testing.T) {
+	t.Parallel()
+	handler, rawAPIKey := setupHandler(t)
+
+	// Create Endpoint, EdgeGroup and EndpointRelation
+	endpoint := createEndpoint(t, handler.DataStore)
+	edgeGroup := portainer.EdgeGroup{
+		ID:           1,
+		Name:         "EdgeGroup 1",
+		Dynamic:      false,
+		TagIDs:       nil,
+		EndpointIDs:  roar.FromSlice([]portainer.EndpointID{endpoint.ID}),
+		PartialMatch: false,
+	}
+
+	err := handler.DataStore.EdgeGroup().Create(&edgeGroup)
+	require.NoError(t, err)
+
+	endpointRelation := portainer.EndpointRelation{
+		EndpointID: endpoint.ID,
+		EdgeStacks: map[portainer.EdgeStackID]bool{},
+	}
+
+	err = handler.DataStore.EndpointRelation().Create(&endpointRelation)
+	require.NoError(t, err)
+
+	payload := edgeStackFromStringPayload{
+		Name:             "test-stack",
+		StackFileContent: "stack content",
+		EdgeGroups:       []portainer.EdgeGroupID{1},
+		DeploymentType:   portainer.EdgeStackDeploymentCompose,
+	}
+
+	jsonPayload, err := json.Marshal(payload)
+	require.NoError(t, err)
+
+	r := bytes.NewBuffer(jsonPayload)
+
+	// Create EdgeStack
+	req, err := http.NewRequest(http.MethodPost, "/edge_stacks/create/string", r)
+	require.NoError(t, err)
+
+	req.Header.Add("x-api-key", rawAPIKey)
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected a %d response, found: %d", http.StatusOK, rec.Code)
+	}
+
+	data := portainer.EdgeStack{}
+	err = json.NewDecoder(rec.Body).Decode(&data)
+	require.NoError(t, err)
+
+	// Inspect
+	req, err = http.NewRequest(http.MethodGet, fmt.Sprintf("/edge_stacks/%d", data.ID), nil)
+	require.NoError(t, err)
+
+	req.Header.Add("x-api-key", rawAPIKey)
+	rec = httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected a %d response, found: %d", http.StatusOK, rec.Code)
+	}
+
+	data = portainer.EdgeStack{}
+	err = json.NewDecoder(rec.Body).Decode(&data)
+	require.NoError(t, err)
+
+	if payload.Name != data.Name {
+		t.Fatalf("expected EdgeStack Name %s, found %s", payload.Name, data.Name)
+	}
+}
+
+func TestCreateWithInvalidPayload(t *testing.T) {
+	t.Parallel()
+	handler, rawAPIKey := setupHandler(t)
+
+	endpoint := createEndpoint(t, handler.DataStore)
+	edgeStack := createEdgeStack(t, handler.DataStore, endpoint.ID)
+
+	cases := []struct {
+		Name               string
+		Payload            any
+		ExpectedStatusCode int
+		Method             string
+	}{
+		{
+			Name:               "Invalid method parameter",
+			Payload:            edgeStackFromStringPayload{},
+			Method:             "invalid",
+			ExpectedStatusCode: 400,
+		},
+
+		{
+			Name:               "Empty edgeStackFromStringPayload with string method",
+			Payload:            edgeStackFromStringPayload{},
+			Method:             "string",
+			ExpectedStatusCode: 400,
+		},
+		{
+			Name:               "Empty edgeStackFromStringPayload with repository method",
+			Payload:            edgeStackFromStringPayload{},
+			Method:             "repository",
+			ExpectedStatusCode: 400,
+		},
+		{
+			Name:               "Empty edgeStackFromStringPayload with file method",
+			Payload:            edgeStackFromStringPayload{},
+			Method:             "file",
+			ExpectedStatusCode: 400,
+		},
+		{
+			Name: "Duplicated EdgeStack Name",
+			Payload: edgeStackFromStringPayload{
+				Name:             edgeStack.Name,
+				StackFileContent: "content",
+				EdgeGroups:       edgeStack.EdgeGroups,
+				DeploymentType:   edgeStack.DeploymentType,
+			},
+			Method:             "string",
+			ExpectedStatusCode: http.StatusConflict,
+		},
+		{
+			Name: "Empty EdgeStack Groups",
+			Payload: edgeStackFromStringPayload{
+				Name:             edgeStack.Name,
+				StackFileContent: "content",
+				EdgeGroups:       []portainer.EdgeGroupID{},
+				DeploymentType:   edgeStack.DeploymentType,
+			},
+			Method:             "string",
+			ExpectedStatusCode: 400,
+		},
+		{
+			Name: "EdgeStackDeploymentKubernetes with Docker endpoint",
+			Payload: edgeStackFromStringPayload{
+				Name:             "stack-name",
+				StackFileContent: "content",
+				EdgeGroups:       []portainer.EdgeGroupID{1},
+				DeploymentType:   portainer.EdgeStackDeploymentKubernetes,
+			},
+			Method:             "string",
+			ExpectedStatusCode: 500,
+		},
+		{
+			Name: "Empty Stack File Content",
+			Payload: edgeStackFromStringPayload{
+				Name:             "stack-name",
+				StackFileContent: "",
+				EdgeGroups:       []portainer.EdgeGroupID{1},
+				DeploymentType:   portainer.EdgeStackDeploymentCompose,
+			},
+			Method:             "string",
+			ExpectedStatusCode: 400,
+		},
+		{
+			Name: "Clone Git repository error",
+			Payload: edgeStackFromGitRepositoryPayload{
+				Name:                     "stack-name",
+				RepositoryURL:            "github.com/portainer/portainer",
+				RepositoryReferenceName:  "ref name",
+				RepositoryAuthentication: false,
+				RepositoryUsername:       "",
+				RepositoryPassword:       "",
+				FilePathInRepository:     "/file/path",
+				EdgeGroups:               []portainer.EdgeGroupID{1},
+				DeploymentType:           portainer.EdgeStackDeploymentCompose,
+			},
+			Method:             "repository",
+			ExpectedStatusCode: 500,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.Name, func(t *testing.T) {
+			jsonPayload, err := json.Marshal(tc.Payload)
+			if err != nil {
+				t.Fatal("JSON marshal error:", err)
+			}
+			r := bytes.NewBuffer(jsonPayload)
+
+			// Create EdgeStack
+			req, err := http.NewRequest(http.MethodPost, "/edge_stacks/create/"+tc.Method, r)
+			if err != nil {
+				t.Fatal("request error:", err)
+			}
+
+			req.Header.Add("x-api-key", rawAPIKey)
+			rec := httptest.NewRecorder()
+			handler.ServeHTTP(rec, req)
+
+			if rec.Code != tc.ExpectedStatusCode {
+				t.Fatalf("expected a %d response, found: %d", tc.ExpectedStatusCode, rec.Code)
+			}
+		})
+	}
+}
diff --git a/api/http/handler/edgestacks/edgestack_delete.go b/api/http/handler/edgestacks/edgestack_delete.go
new file mode 100644
index 0000000..9371a68
--- /dev/null
+++ b/api/http/handler/edgestacks/edgestack_delete.go
@@ -0,0 +1,57 @@
+package edgestacks
+
+import (
+	"net/http"
+	"strconv"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id EdgeStackDelete
+// @summary Delete an EdgeStack
+// @description **Access policy**: administrator
+// @tags edge_stacks
+// @security ApiKeyAuth
+// @security jwt
+// @param id path int true "EdgeStack Id"
+// @success 204
+// @failure 500
+// @failure 400
+// @failure 503 "Edge compute features are disabled"
+// @router /edge_stacks/{id} [delete]
+func (handler *Handler) edgeStackDelete(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	edgeStackID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid edge stack identifier route variable", err)
+	}
+
+	err = handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return handler.deleteEdgeStack(tx, portainer.EdgeStackID(edgeStackID))
+	})
+
+	return response.TxEmptyResponse(w, err)
+}
+
+func (handler *Handler) deleteEdgeStack(tx dataservices.DataStoreTx, edgeStackID portainer.EdgeStackID) error {
+	edgeStack, err := tx.EdgeStack().EdgeStack(edgeStackID)
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find an edge stack with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find an edge stack with the specified identifier inside the database", err)
+	}
+
+	if err := handler.edgeStacksService.DeleteEdgeStack(tx, edgeStack.ID, edgeStack.EdgeGroups); err != nil {
+		return httperror.InternalServerError("Unable to delete edge stack", err)
+	}
+
+	stackFolder := handler.FileService.GetEdgeStackProjectPath(strconv.Itoa(int(edgeStack.ID)))
+	if err := handler.FileService.RemoveDirectory(stackFolder); err != nil {
+		return httperror.InternalServerError("Unable to remove edge stack project folder", err)
+	}
+
+	return nil
+}
diff --git a/api/http/handler/edgestacks/edgestack_delete_test.go b/api/http/handler/edgestacks/edgestack_delete_test.go
new file mode 100644
index 0000000..b2ffe11
--- /dev/null
+++ b/api/http/handler/edgestacks/edgestack_delete_test.go
@@ -0,0 +1,146 @@
+package edgestacks
+
+import (
+	"bytes"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// Delete
+func TestDeleteAndInspect(t *testing.T) {
+	t.Parallel()
+	handler, rawAPIKey := setupHandler(t)
+
+	// Create
+	endpoint := createEndpoint(t, handler.DataStore)
+	edgeStack := createEdgeStack(t, handler.DataStore, endpoint.ID)
+
+	// Inspect
+	req, err := http.NewRequest(http.MethodGet, fmt.Sprintf("/edge_stacks/%d", edgeStack.ID), nil)
+	require.NoError(t, err)
+
+	req.Header.Add("x-api-key", rawAPIKey)
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected a %d response, found: %d", http.StatusOK, rec.Code)
+	}
+
+	data := portainer.EdgeStack{}
+	err = json.NewDecoder(rec.Body).Decode(&data)
+	require.NoError(t, err)
+
+	if data.ID != edgeStack.ID {
+		t.Fatalf("expected EdgeStackID %d, found %d", int(edgeStack.ID), data.ID)
+	}
+
+	// Delete
+	req, err = http.NewRequest(http.MethodDelete, fmt.Sprintf("/edge_stacks/%d", edgeStack.ID), nil)
+	require.NoError(t, err)
+
+	req.Header.Add("x-api-key", rawAPIKey)
+	rec = httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusNoContent {
+		t.Fatalf("expected a %d response, found: %d", http.StatusNoContent, rec.Code)
+	}
+
+	// Inspect
+	req, err = http.NewRequest(http.MethodGet, fmt.Sprintf("/edge_stacks/%d", edgeStack.ID), nil)
+	require.NoError(t, err)
+
+	req.Header.Add("x-api-key", rawAPIKey)
+	rec = httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusNotFound {
+		t.Fatalf("expected a %d response, found: %d", http.StatusNotFound, rec.Code)
+	}
+}
+
+func TestDeleteInvalidEdgeStack(t *testing.T) {
+	t.Parallel()
+	handler, rawAPIKey := setupHandler(t)
+
+	cases := []struct {
+		Name               string
+		URL                string
+		ExpectedStatusCode int
+	}{
+		{Name: "Non-existing EdgeStackID", URL: "/edge_stacks/-1", ExpectedStatusCode: http.StatusNotFound},
+		{Name: "Invalid EdgeStackID", URL: "/edge_stacks/aaaaaaa", ExpectedStatusCode: http.StatusBadRequest},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.Name, func(t *testing.T) {
+			req, err := http.NewRequest(http.MethodDelete, tc.URL, nil)
+			if err != nil {
+				t.Fatal("request error:", err)
+			}
+
+			req.Header.Add("x-api-key", rawAPIKey)
+			rec := httptest.NewRecorder()
+			handler.ServeHTTP(rec, req)
+
+			if rec.Code != tc.ExpectedStatusCode {
+				t.Fatalf("expected a %d response, found: %d", tc.ExpectedStatusCode, rec.Code)
+			}
+		})
+	}
+}
+
+func TestDeleteEdgeStack_RemoveProjectFolder(t *testing.T) {
+	t.Parallel()
+	handler, rawAPIKey := setupHandler(t)
+
+	edgeGroup := createEdgeGroup(t, handler.DataStore)
+
+	payload := edgeStackFromStringPayload{
+		Name:             "test-stack",
+		DeploymentType:   portainer.EdgeStackDeploymentCompose,
+		EdgeGroups:       []portainer.EdgeGroupID{edgeGroup.ID},
+		StackFileContent: "version: '3.7'\nservices:\n  test:\n    image: test",
+	}
+
+	var buf bytes.Buffer
+	err := json.NewEncoder(&buf).Encode(payload)
+	require.NoError(t, err)
+
+	// Create
+	req, err := http.NewRequest(http.MethodPost, "/edge_stacks/create/string", &buf)
+	require.NoError(t, err)
+
+	req.Header.Add("x-api-key", rawAPIKey)
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected a %d response, found: %d", http.StatusNoContent, rec.Code)
+	}
+
+	assert.DirExists(t, handler.FileService.GetEdgeStackProjectPath("1"))
+
+	// Delete
+	req, err = http.NewRequest(http.MethodDelete, "/edge_stacks/1", nil)
+	require.NoError(t, err)
+
+	req.Header.Add("x-api-key", rawAPIKey)
+	rec = httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusNoContent {
+		t.Fatalf("expected a %d response, found: %d", http.StatusNoContent, rec.Code)
+	}
+
+	assert.NoDirExists(t, handler.FileService.GetEdgeStackProjectPath("1"))
+}
diff --git a/api/http/handler/edgestacks/edgestack_file.go b/api/http/handler/edgestacks/edgestack_file.go
new file mode 100644
index 0000000..70551b8
--- /dev/null
+++ b/api/http/handler/edgestacks/edgestack_file.go
@@ -0,0 +1,51 @@
+package edgestacks
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type stackFileResponse struct {
+	StackFileContent string `json:"StackFileContent"`
+}
+
+// @id EdgeStackFile
+// @summary Fetches the stack file for an EdgeStack
+// @description **Access policy**: administrator
+// @tags edge_stacks
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param id path int true "EdgeStack Id"
+// @success 200 {object} stackFileResponse
+// @failure 500
+// @failure 400
+// @failure 503 "Edge compute features are disabled"
+// @router /edge_stacks/{id}/file [get]
+func (handler *Handler) edgeStackFile(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	stackID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid edge stack identifier route variable", err)
+	}
+
+	stack, err := handler.DataStore.EdgeStack().EdgeStack(portainer.EdgeStackID(stackID))
+	if err != nil {
+		return handlerDBErr(err, "Unable to find an edge stack with the specified identifier inside the database")
+	}
+
+	fileName := stack.EntryPoint
+	if stack.DeploymentType == portainer.EdgeStackDeploymentKubernetes {
+		fileName = stack.ManifestPath
+	}
+
+	stackFileContent, err := handler.FileService.GetFileContent(stack.ProjectPath, fileName)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve stack file from disk", err)
+	}
+
+	return response.JSON(w, &stackFileResponse{StackFileContent: string(stackFileContent)})
+}
diff --git a/api/http/handler/edgestacks/edgestack_inspect.go b/api/http/handler/edgestacks/edgestack_inspect.go
new file mode 100644
index 0000000..2936f32
--- /dev/null
+++ b/api/http/handler/edgestacks/edgestack_inspect.go
@@ -0,0 +1,68 @@
+package edgestacks
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id EdgeStackInspect
+// @summary Inspect an EdgeStack
+// @description **Access policy**: administrator
+// @tags edge_stacks
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param id path int true "EdgeStack Id"
+// @success 200 {object} portainer.EdgeStack
+// @failure 500
+// @failure 400
+// @failure 503 "Edge compute features are disabled"
+// @router /edge_stacks/{id} [get]
+func (handler *Handler) edgeStackInspect(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	edgeStackID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid edge stack identifier route variable", err)
+	}
+
+	edgeStack, err := handler.DataStore.EdgeStack().EdgeStack(portainer.EdgeStackID(edgeStackID))
+	if err != nil {
+		return handlerDBErr(err, "Unable to find an edge stack with the specified identifier inside the database")
+	}
+
+	if err := fillEdgeStackStatus(handler.DataStore, edgeStack); err != nil {
+		return handlerDBErr(err, "Unable to retrieve edge stack status from the database")
+	}
+
+	return response.JSON(w, edgeStack)
+}
+
+func fillEdgeStackStatus(tx dataservices.DataStoreTx, edgeStack *portainer.EdgeStack) error {
+	status, err := tx.EdgeStackStatus().ReadAll(edgeStack.ID)
+	if err != nil {
+		return err
+	}
+
+	edgeStack.Status = make(map[portainer.EndpointID]portainer.EdgeStackStatus, len(status))
+
+	emptyStatus := make([]portainer.EdgeStackDeploymentStatus, 0)
+
+	for _, s := range status {
+		if s.Status == nil {
+			s.Status = emptyStatus
+		}
+
+		edgeStack.Status[s.EndpointID] = portainer.EdgeStackStatus{
+			Status:           s.Status,
+			EndpointID:       s.EndpointID,
+			DeploymentInfo:   s.DeploymentInfo,
+			ReadyRePullImage: s.ReadyRePullImage,
+		}
+	}
+
+	return nil
+}
diff --git a/api/http/handler/edgestacks/edgestack_inspect_test.go b/api/http/handler/edgestacks/edgestack_inspect_test.go
new file mode 100644
index 0000000..6253de6
--- /dev/null
+++ b/api/http/handler/edgestacks/edgestack_inspect_test.go
@@ -0,0 +1,39 @@
+package edgestacks
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+// Inspect
+func TestInspectInvalidEdgeID(t *testing.T) {
+	t.Parallel()
+	handler, rawAPIKey := setupHandler(t)
+
+	cases := []struct {
+		Name               string
+		EdgeStackID        string
+		ExpectedStatusCode int
+	}{
+		{"Invalid EdgeStackID", "x", 400},
+		{"Non-existing EdgeStackID", "5", 404},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.Name, func(t *testing.T) {
+			req, err := http.NewRequest(http.MethodGet, "/edge_stacks/"+tc.EdgeStackID, nil)
+			if err != nil {
+				t.Fatal("request error:", err)
+			}
+
+			req.Header.Add("x-api-key", rawAPIKey)
+			rec := httptest.NewRecorder()
+			handler.ServeHTTP(rec, req)
+
+			if rec.Code != tc.ExpectedStatusCode {
+				t.Fatalf("expected a %d response, found: %d", tc.ExpectedStatusCode, rec.Code)
+			}
+		})
+	}
+}
diff --git a/api/http/handler/edgestacks/edgestack_list.go b/api/http/handler/edgestacks/edgestack_list.go
new file mode 100644
index 0000000..1ea991c
--- /dev/null
+++ b/api/http/handler/edgestacks/edgestack_list.go
@@ -0,0 +1,164 @@
+package edgestacks
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/slicesx"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type aggregatedStatusesMap map[portainer.EdgeStackStatusType]int
+
+type SummarizedStatus string
+
+const (
+	sumStatusUnavailable      SummarizedStatus = "Unavailable"
+	sumStatusDeploying        SummarizedStatus = "Deploying"
+	sumStatusFailed           SummarizedStatus = "Failed"
+	sumStatusPaused           SummarizedStatus = "Paused"
+	sumStatusPartiallyRunning SummarizedStatus = "PartiallyRunning"
+	sumStatusCompleted        SummarizedStatus = "Completed"
+	sumStatusRunning          SummarizedStatus = "Running"
+)
+
+type edgeStackStatusSummary struct {
+	AggregatedStatus aggregatedStatusesMap
+	Status           SummarizedStatus
+	Reason           string
+}
+
+type edgeStackListResponseItem struct {
+	portainer.EdgeStack
+	StatusSummary edgeStackStatusSummary
+}
+
+// @id EdgeStackList
+// @summary Fetches the list of EdgeStacks
+// @description **Access policy**: administrator
+// @tags edge_stacks
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param summarizeStatuses query boolean false "will summarize the statuses"
+// @success 200 {array} portainer.EdgeStack
+// @failure 500
+// @failure 400
+// @failure 503 "Edge compute features are disabled"
+// @router /edge_stacks [get]
+func (handler *Handler) edgeStackList(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	summarizeStatuses, _ := request.RetrieveBooleanQueryParameter(r, "summarizeStatuses", true)
+
+	edgeStacks, err := handler.DataStore.EdgeStack().EdgeStacks()
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve edge stacks from the database", err)
+	}
+
+	res := make([]edgeStackListResponseItem, len(edgeStacks))
+
+	for i := range edgeStacks {
+		res[i].EdgeStack = edgeStacks[i]
+
+		if summarizeStatuses {
+			if err := fillStatusSummary(handler.DataStore, &res[i]); err != nil {
+				return handlerDBErr(err, "Unable to retrieve edge stack status from the database")
+			}
+		} else if err := fillEdgeStackStatus(handler.DataStore, &res[i].EdgeStack); err != nil {
+			return handlerDBErr(err, "Unable to retrieve edge stack status from the database")
+		}
+	}
+
+	return response.JSON(w, res)
+}
+
+func fillStatusSummary(tx dataservices.DataStoreTx, edgeStack *edgeStackListResponseItem) error {
+	statuses, err := tx.EdgeStackStatus().ReadAll(edgeStack.ID)
+	if err != nil {
+		return err
+	}
+
+	aggregated := make(aggregatedStatusesMap)
+
+	for _, envStatus := range statuses {
+		for _, status := range envStatus.Status {
+			aggregated[status.Type]++
+		}
+	}
+
+	status, reason := SummarizeStatuses(statuses, edgeStack.NumDeployments)
+
+	edgeStack.StatusSummary = edgeStackStatusSummary{
+		AggregatedStatus: aggregated,
+		Status:           status,
+		Reason:           reason,
+	}
+
+	edgeStack.Status = map[portainer.EndpointID]portainer.EdgeStackStatus{}
+
+	return nil
+}
+
+func SummarizeStatuses(statuses []portainer.EdgeStackStatusForEnv, numDeployments int) (SummarizedStatus, string) {
+	if numDeployments == 0 {
+		return sumStatusUnavailable, "Your edge stack is currently unavailable due to the absence of an available environment in your edge group"
+	}
+
+	allStatuses := slicesx.FlatMap(statuses, func(x portainer.EdgeStackStatusForEnv) []portainer.EdgeStackDeploymentStatus {
+		return x.Status
+	})
+
+	lastStatuses := slicesx.Map(
+		slicesx.Filter(
+			statuses,
+			func(s portainer.EdgeStackStatusForEnv) bool {
+				return len(s.Status) > 0
+			},
+		),
+		func(x portainer.EdgeStackStatusForEnv) portainer.EdgeStackDeploymentStatus {
+			return x.Status[len(x.Status)-1]
+		},
+	)
+
+	if len(lastStatuses) == 0 {
+		return sumStatusDeploying, ""
+	}
+
+	if allFailed := slicesx.Every(lastStatuses, func(s portainer.EdgeStackDeploymentStatus) bool {
+		return s.Type == portainer.EdgeStackStatusError
+	}); allFailed {
+		return sumStatusFailed, ""
+	}
+
+	if hasPaused := slicesx.Some(allStatuses, func(s portainer.EdgeStackDeploymentStatus) bool {
+		return s.Type == portainer.EdgeStackStatusPausedDeploying
+	}); hasPaused {
+		return sumStatusPaused, ""
+	}
+
+	if len(lastStatuses) < numDeployments {
+		return sumStatusDeploying, ""
+	}
+
+	hasDeploying := slicesx.Some(lastStatuses, func(s portainer.EdgeStackDeploymentStatus) bool { return s.Type == portainer.EdgeStackStatusDeploying })
+	hasRunning := slicesx.Some(lastStatuses, func(s portainer.EdgeStackDeploymentStatus) bool { return s.Type == portainer.EdgeStackStatusRunning })
+	hasFailed := slicesx.Some(lastStatuses, func(s portainer.EdgeStackDeploymentStatus) bool { return s.Type == portainer.EdgeStackStatusError })
+
+	if hasRunning && hasFailed && !hasDeploying {
+		return sumStatusPartiallyRunning, ""
+	}
+
+	if allCompleted := slicesx.Every(lastStatuses, func(s portainer.EdgeStackDeploymentStatus) bool { return s.Type == portainer.EdgeStackStatusCompleted }); allCompleted {
+		return sumStatusCompleted, ""
+	}
+
+	if allRunning := slicesx.Every(lastStatuses, func(s portainer.EdgeStackDeploymentStatus) bool {
+		return s.Type == portainer.EdgeStackStatusRunning
+	}); allRunning {
+		return sumStatusRunning, ""
+	}
+
+	return sumStatusDeploying, ""
+}
diff --git a/api/http/handler/edgestacks/edgestack_status_update.go b/api/http/handler/edgestacks/edgestack_status_update.go
new file mode 100644
index 0000000..2deb5a4
--- /dev/null
+++ b/api/http/handler/edgestacks/edgestack_status_update.go
@@ -0,0 +1,147 @@
+package edgestacks
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+	"slices"
+	"strconv"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type updateStatusPayload struct {
+	Error      string
+	Status     *portainer.EdgeStackStatusType
+	EndpointID portainer.EndpointID
+	Time       int64
+	Version    int
+}
+
+func (payload *updateStatusPayload) Validate(r *http.Request) error {
+	if payload.Status == nil {
+		return errors.New("invalid status")
+	}
+
+	if payload.EndpointID == 0 {
+		return errors.New("invalid EnvironmentID")
+	}
+
+	if *payload.Status == portainer.EdgeStackStatusError && len(payload.Error) == 0 {
+		return errors.New("error message is mandatory when status is error")
+	}
+
+	if payload.Time == 0 {
+		payload.Time = time.Now().Unix()
+	}
+
+	return nil
+}
+
+// @id EdgeStackStatusUpdate
+// @summary Update an EdgeStack status
+// @description Authorized only if the request is done by an Edge Environment(Endpoint)
+// @tags edge_stacks
+// @accept json
+// @produce json
+// @param id path int true "EdgeStack Id"
+// @param body body updateStatusPayload true "EdgeStack status payload"
+// @success 200 {object} portainer.EdgeStack
+// @failure 500
+// @failure 400
+// @failure 404
+// @failure 403
+// @router /edge_stacks/{id}/status [put]
+func (handler *Handler) edgeStackStatusUpdate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	stackID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid stack identifier route variable", err)
+	}
+
+	var payload updateStatusPayload
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return httperror.BadRequest("Invalid request payload", fmt.Errorf("edge polling error: %w. Environment ID: %d", err, payload.EndpointID))
+	}
+
+	endpoint, err := handler.DataStore.Endpoint().Endpoint(payload.EndpointID)
+	if err != nil {
+		return handlerDBErr(fmt.Errorf("unable to find the environment from the database: %w. Environment ID: %d", err, payload.EndpointID), "unable to find the environment")
+	}
+
+	if err := handler.requestBouncer.AuthorizedEdgeEndpointOperation(r, endpoint); err != nil {
+		return httperror.Forbidden("Permission denied to access environment", fmt.Errorf("unauthorized edge endpoint operation: %w. Environment ID: %d", err, payload.EndpointID))
+	}
+
+	var stack *portainer.EdgeStack
+
+	if err := handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		var err error
+		stack, err = tx.EdgeStack().EdgeStack(portainer.EdgeStackID(stackID))
+		if err != nil {
+			if dataservices.IsErrObjectNotFound(err) {
+				return nil
+			}
+
+			return httperror.InternalServerError("Unable to retrieve Edge stack from the database", err)
+		}
+
+		if err := handler.updateEdgeStackStatus(tx, stack, stack.ID, payload); err != nil {
+			return httperror.InternalServerError("Unable to update Edge stack status", err)
+		}
+
+		return nil
+	}); err != nil {
+		return response.TxErrorResponse(err)
+	}
+
+	if ok, _ := strconv.ParseBool(r.Header.Get("X-Portainer-No-Body")); ok {
+		return nil
+	}
+
+	if err := fillEdgeStackStatus(handler.DataStore, stack); err != nil {
+		return handlerDBErr(err, "Unable to retrieve edge stack status from the database")
+	}
+
+	return response.JSON(w, stack)
+}
+
+func (handler *Handler) updateEdgeStackStatus(tx dataservices.DataStoreTx, stack *portainer.EdgeStack, stackID portainer.EdgeStackID, payload updateStatusPayload) error {
+	if payload.Version > 0 && payload.Version < stack.Version {
+		return nil
+	}
+
+	status := *payload.Status
+
+	deploymentStatus := portainer.EdgeStackDeploymentStatus{
+		Type:  status,
+		Error: payload.Error,
+		Time:  payload.Time,
+	}
+
+	if deploymentStatus.Type == portainer.EdgeStackStatusRemoved {
+		return tx.EdgeStackStatus().Delete(stackID, payload.EndpointID)
+	}
+
+	environmentStatus, err := tx.EdgeStackStatus().Read(stackID, payload.EndpointID)
+	if err != nil && !tx.IsErrObjectNotFound(err) {
+		return err
+	} else if tx.IsErrObjectNotFound(err) {
+		environmentStatus = &portainer.EdgeStackStatusForEnv{
+			EndpointID: payload.EndpointID,
+			Status:     []portainer.EdgeStackDeploymentStatus{},
+		}
+	}
+
+	if containsStatus := slices.ContainsFunc(environmentStatus.Status, func(e portainer.EdgeStackDeploymentStatus) bool {
+		return e.Type == deploymentStatus.Type
+	}); !containsStatus {
+		environmentStatus.Status = append(environmentStatus.Status, deploymentStatus)
+	}
+
+	return tx.EdgeStackStatus().Update(stackID, payload.EndpointID, environmentStatus)
+}
diff --git a/api/http/handler/edgestacks/edgestack_status_update_test.go b/api/http/handler/edgestacks/edgestack_status_update_test.go
new file mode 100644
index 0000000..2017363
--- /dev/null
+++ b/api/http/handler/edgestacks/edgestack_status_update_test.go
@@ -0,0 +1,147 @@
+package edgestacks
+
+import (
+	"bytes"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/require"
+)
+
+// Update Status
+func TestUpdateStatusAndInspect(t *testing.T) {
+	t.Parallel()
+	handler, rawAPIKey := setupHandler(t)
+
+	endpoint := createEndpoint(t, handler.DataStore)
+	edgeStack := createEdgeStack(t, handler.DataStore, endpoint.ID)
+
+	// Update edge stack status
+	newStatus := portainer.EdgeStackStatusError
+	payload := updateStatusPayload{
+		Error:      "test-error",
+		Status:     &newStatus,
+		EndpointID: endpoint.ID,
+	}
+
+	jsonPayload, err := json.Marshal(payload)
+	require.NoError(t, err)
+
+	r := bytes.NewBuffer(jsonPayload)
+	req, err := http.NewRequest(http.MethodPut, fmt.Sprintf("/edge_stacks/%d/status", edgeStack.ID), r)
+	require.NoError(t, err)
+
+	req.Header.Set(portainer.PortainerAgentEdgeIDHeader, endpoint.EdgeID)
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected a %d response, found: %d", http.StatusOK, rec.Code)
+	}
+
+	// Get updated edge stack
+	req, err = http.NewRequest(http.MethodGet, fmt.Sprintf("/edge_stacks/%d", edgeStack.ID), nil)
+	require.NoError(t, err)
+
+	req.Header.Add("x-api-key", rawAPIKey)
+	rec = httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected a %d response, found: %d", http.StatusOK, rec.Code)
+	}
+
+	updatedStack := portainer.EdgeStack{}
+	err = json.NewDecoder(rec.Body).Decode(&updatedStack)
+	require.NoError(t, err)
+
+	endpointStatus, ok := updatedStack.Status[payload.EndpointID]
+	require.True(t, ok)
+
+	lastStatus := endpointStatus.Status[len(endpointStatus.Status)-1]
+
+	if len(endpointStatus.Status) == len(edgeStack.Status[payload.EndpointID].Status) {
+		t.Fatal("expected status array to be updated")
+	}
+
+	if lastStatus.Type != *payload.Status {
+		t.Fatalf("expected EdgeStackStatusType %d, found %d", *payload.Status, lastStatus.Type)
+	}
+
+	if endpointStatus.EndpointID != payload.EndpointID {
+		t.Fatalf("expected EndpointID %d, found %d", payload.EndpointID, endpointStatus.EndpointID)
+	}
+}
+
+func TestUpdateStatusWithInvalidPayload(t *testing.T) {
+	t.Parallel()
+	handler, _ := setupHandler(t)
+
+	endpoint := createEndpoint(t, handler.DataStore)
+	edgeStack := createEdgeStack(t, handler.DataStore, endpoint.ID)
+
+	// Update edge stack status
+	statusError := portainer.EdgeStackStatusError
+	statusOk := portainer.EdgeStackStatusDeploymentReceived
+	cases := []struct {
+		Name                 string
+		Payload              updateStatusPayload
+		ExpectedErrorMessage string
+		ExpectedStatusCode   int
+	}{
+		{
+			"Update with nil Status",
+			updateStatusPayload{
+				Error:      "test-error",
+				Status:     nil,
+				EndpointID: endpoint.ID,
+			},
+			"Invalid status",
+			400,
+		},
+		{
+			"Update with error status and empty error message",
+			updateStatusPayload{
+				Error:      "",
+				Status:     &statusError,
+				EndpointID: endpoint.ID,
+			},
+			"Error message is mandatory when status is error",
+			400,
+		},
+		{
+			"Update with missing EndpointID",
+			updateStatusPayload{
+				Error:      "",
+				Status:     &statusOk,
+				EndpointID: 0,
+			},
+			"Invalid EnvironmentID",
+			400,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.Name, func(t *testing.T) {
+			jsonPayload, err := json.Marshal(tc.Payload)
+			require.NoError(t, err)
+
+			r := bytes.NewBuffer(jsonPayload)
+			req, err := http.NewRequest(http.MethodPut, fmt.Sprintf("/edge_stacks/%d/status", edgeStack.ID), r)
+			require.NoError(t, err)
+
+			req.Header.Set(portainer.PortainerAgentEdgeIDHeader, endpoint.EdgeID)
+			rec := httptest.NewRecorder()
+			handler.ServeHTTP(rec, req)
+
+			if rec.Code != tc.ExpectedStatusCode {
+				t.Fatalf("expected a %d response, found: %d", tc.ExpectedStatusCode, rec.Code)
+			}
+		})
+	}
+}
diff --git a/api/http/handler/edgestacks/edgestack_test.go b/api/http/handler/edgestacks/edgestack_test.go
new file mode 100644
index 0000000..caae7c9
--- /dev/null
+++ b/api/http/handler/edgestacks/edgestack_test.go
@@ -0,0 +1,147 @@
+package edgestacks
+
+import (
+	"strconv"
+	"testing"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/apikey"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/filesystem"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/edge/edgestacks"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+	"github.com/portainer/portainer/api/jwt"
+	"github.com/portainer/portainer/api/roar"
+
+	"github.com/pkg/errors"
+	"github.com/stretchr/testify/require"
+)
+
+// Helpers
+func setupHandler(t *testing.T) (*Handler, string) {
+	t.Helper()
+
+	_, store := datastore.MustNewTestStore(t, true, true)
+
+	jwtService, err := jwt.NewService("1h", store)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	user := &portainer.User{ID: 2, Username: "admin", Role: portainer.AdministratorRole}
+	if err := store.User().Create(user); err != nil {
+		t.Fatal(err)
+	}
+
+	apiKeyService := apikey.NewAPIKeyService(store.APIKeyRepository(), store.User())
+	rawAPIKey, _, err := apiKeyService.GenerateApiKey(*user, "test")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	fs, err := filesystem.NewService(t.TempDir(), "")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	handler := NewHandler(
+		security.NewRequestBouncer(t.Context(), store, jwtService, apiKeyService),
+		store,
+		edgestacks.NewService(store),
+	)
+
+	handler.FileService = fs
+
+	settings, err := handler.DataStore.Settings().Settings()
+	require.NoError(t, err)
+
+	settings.EnableEdgeComputeFeatures = true
+
+	err = handler.DataStore.Settings().UpdateSettings(settings)
+	require.NoError(t, err)
+
+	handler.GitService = testhelpers.NewGitService(errors.New("Clone error"), "git-service-id")
+
+	return handler, rawAPIKey
+}
+
+func createEndpointWithId(t *testing.T, store dataservices.DataStore, endpointID portainer.EndpointID) portainer.Endpoint {
+	t.Helper()
+
+	endpoint := portainer.Endpoint{
+		ID:              endpointID,
+		Name:            "test-endpoint-" + strconv.Itoa(int(endpointID)),
+		Type:            portainer.EdgeAgentOnDockerEnvironment,
+		URL:             "https://portainer.io:9443",
+		EdgeID:          "edge-id",
+		LastCheckInDate: time.Now().Unix(),
+	}
+
+	err := store.Endpoint().Create(&endpoint)
+	require.NoError(t, err)
+
+	return endpoint
+}
+
+func createEndpoint(t *testing.T, store dataservices.DataStore) portainer.Endpoint {
+	return createEndpointWithId(t, store, 5)
+}
+
+func createEdgeStack(t *testing.T, store dataservices.DataStore, endpointID portainer.EndpointID) portainer.EdgeStack {
+	t.Helper()
+
+	edgeGroup := portainer.EdgeGroup{
+		ID:           1,
+		Name:         "EdgeGroup 1",
+		Dynamic:      false,
+		TagIDs:       nil,
+		EndpointIDs:  roar.FromSlice([]portainer.EndpointID{endpointID}),
+		PartialMatch: false,
+	}
+
+	err := store.EdgeGroup().Create(&edgeGroup)
+	require.NoError(t, err)
+
+	edgeStackID := portainer.EdgeStackID(14)
+	edgeStack := portainer.EdgeStack{
+		ID:             edgeStackID,
+		Name:           "test-edge-stack-" + strconv.Itoa(int(edgeStackID)),
+		CreationDate:   time.Now().Unix(),
+		EdgeGroups:     []portainer.EdgeGroupID{edgeGroup.ID},
+		ProjectPath:    "/project/path",
+		EntryPoint:     "entrypoint",
+		Version:        237,
+		ManifestPath:   "/manifest/path",
+		DeploymentType: portainer.EdgeStackDeploymentKubernetes,
+	}
+
+	endpointRelation := portainer.EndpointRelation{
+		EndpointID: endpointID,
+		EdgeStacks: map[portainer.EdgeStackID]bool{
+			edgeStack.ID: true,
+		},
+	}
+
+	err = store.EdgeStack().Create(edgeStack.ID, &edgeStack)
+	require.NoError(t, err)
+
+	err = store.EndpointRelation().Create(&endpointRelation)
+	require.NoError(t, err)
+
+	return edgeStack
+}
+
+func createEdgeGroup(t *testing.T, store dataservices.DataStore) portainer.EdgeGroup {
+	edgeGroup := portainer.EdgeGroup{
+		ID:   1,
+		Name: "EdgeGroup 1",
+	}
+
+	err := store.EdgeGroup().Create(&edgeGroup)
+	require.NoError(t, err)
+
+	return edgeGroup
+}
diff --git a/api/http/handler/edgestacks/edgestack_update.go b/api/http/handler/edgestacks/edgestack_update.go
new file mode 100644
index 0000000..efb4d6d
--- /dev/null
+++ b/api/http/handler/edgestacks/edgestack_update.go
@@ -0,0 +1,164 @@
+package edgestacks
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/internal/edge"
+	"github.com/portainer/portainer/api/set"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+
+	"github.com/pkg/errors"
+)
+
+type updateEdgeStackPayload struct {
+	StackFileContent string
+	UpdateVersion    bool
+	EdgeGroups       []portainer.EdgeGroupID
+	DeploymentType   portainer.EdgeStackDeploymentType
+	// Uses the manifest's namespaces instead of the default one
+	UseManifestNamespaces bool
+}
+
+func (payload *updateEdgeStackPayload) Validate(r *http.Request) error {
+	if payload.StackFileContent == "" {
+		return errors.New("invalid stack file content")
+	}
+
+	if len(payload.EdgeGroups) == 0 {
+		return errors.New("edge Groups are mandatory for an Edge stack")
+	}
+
+	return nil
+}
+
+// @id EdgeStackUpdate
+// @summary Update an EdgeStack
+// @description **Access policy**: administrator
+// @tags edge_stacks
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @produce json
+// @param id path int true "EdgeStack Id"
+// @param body body updateEdgeStackPayload true "EdgeStack data"
+// @success 200 {object} portainer.EdgeStack
+// @failure 500
+// @failure 400
+// @failure 503 "Edge compute features are disabled"
+// @router /edge_stacks/{id} [put]
+func (handler *Handler) edgeStackUpdate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	stackID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid stack identifier route variable", err)
+	}
+
+	var payload updateEdgeStackPayload
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	if err := stackutils.ValidateEdgeStackComposeContent(r.Context(), payload.DeploymentType, []byte(payload.StackFileContent)); err != nil {
+		return httperror.BadRequest("Stack file contains a URL blocked by the SSRF policy", err)
+	}
+
+	var stack *portainer.EdgeStack
+	if err := handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		stack, err = handler.updateEdgeStack(tx, portainer.EdgeStackID(stackID), payload)
+		return err
+	}); err != nil {
+		return response.TxErrorResponse(err)
+	}
+
+	if err := fillEdgeStackStatus(handler.DataStore, stack); err != nil {
+		return handlerDBErr(err, "Unable to retrieve edge stack status from the database")
+	}
+
+	return response.JSON(w, stack)
+}
+
+func (handler *Handler) updateEdgeStack(tx dataservices.DataStoreTx, stackID portainer.EdgeStackID, payload updateEdgeStackPayload) (*portainer.EdgeStack, error) {
+	stack, err := tx.EdgeStack().EdgeStack(stackID)
+	if err != nil {
+		return nil, handlerDBErr(err, "Unable to find a stack with the specified identifier inside the database")
+	}
+
+	relationConfig, err := edge.FetchEndpointRelationsConfig(tx)
+	if err != nil {
+		return nil, httperror.InternalServerError("Unable to retrieve environments relations config from database", err)
+	}
+
+	relatedEndpointIds, err := edge.EdgeStackRelatedEndpoints(stack.EdgeGroups, relationConfig.Endpoints, relationConfig.EndpointGroups, relationConfig.EdgeGroups)
+	if err != nil {
+		return nil, httperror.InternalServerError("Unable to retrieve edge stack related environments from database", err)
+	}
+
+	groupsIds := stack.EdgeGroups
+	if payload.EdgeGroups != nil {
+		newRelated, _, err := handler.handleChangeEdgeGroups(tx, stack, payload.EdgeGroups, relatedEndpointIds, relationConfig)
+		if err != nil {
+			return nil, httperror.InternalServerError("Unable to handle edge groups change", err)
+		}
+
+		groupsIds = payload.EdgeGroups
+		relatedEndpointIds = newRelated
+
+	}
+
+	hasWrongType, err := hasWrongEnvironmentType(tx.Endpoint(), relatedEndpointIds, payload.DeploymentType)
+	if err != nil {
+		return nil, httperror.InternalServerError("unable to check for existence of non fitting environments: %w", err)
+	}
+	if hasWrongType {
+		return nil, httperror.BadRequest("edge stack with config do not match the environment type", nil)
+	}
+
+	stack.NumDeployments = len(relatedEndpointIds)
+
+	stack.UseManifestNamespaces = payload.UseManifestNamespaces
+
+	stack.EdgeGroups = groupsIds
+
+	if payload.UpdateVersion {
+		if err := handler.updateStackVersion(tx, stack, payload.DeploymentType, []byte(payload.StackFileContent), "", relatedEndpointIds); err != nil {
+			return nil, httperror.InternalServerError("Unable to update stack version", err)
+		}
+	}
+
+	if err := tx.EdgeStack().UpdateEdgeStack(stack.ID, stack); err != nil {
+		return nil, httperror.InternalServerError("Unable to persist the stack changes inside the database", err)
+	}
+
+	return stack, nil
+}
+
+func (handler *Handler) handleChangeEdgeGroups(tx dataservices.DataStoreTx, edgeStack *portainer.EdgeStack, newEdgeGroupsIDs []portainer.EdgeGroupID, oldRelatedEnvironmentIDs []portainer.EndpointID, relationConfig *edge.EndpointRelationsConfig) ([]portainer.EndpointID, set.Set[portainer.EndpointID], error) {
+	newRelatedEnvironmentIDs, err := edge.EdgeStackRelatedEndpoints(newEdgeGroupsIDs, relationConfig.Endpoints, relationConfig.EndpointGroups, relationConfig.EdgeGroups)
+	if err != nil {
+		return nil, nil, errors.WithMessage(err, "Unable to retrieve edge stack related environments from database")
+	}
+
+	oldRelatedEnvironmentsSet := set.ToSet(oldRelatedEnvironmentIDs)
+	newRelatedEnvironmentsSet := set.ToSet(newRelatedEnvironmentIDs)
+
+	relatedEnvironmentsToAdd := newRelatedEnvironmentsSet.Difference(oldRelatedEnvironmentsSet)
+	relatedEnvironmentsToRemove := oldRelatedEnvironmentsSet.Difference(newRelatedEnvironmentsSet)
+
+	if len(relatedEnvironmentsToRemove) > 0 {
+		if err := tx.EndpointRelation().RemoveEndpointRelationsForEdgeStack(relatedEnvironmentsToRemove.Keys(), edgeStack.ID); err != nil {
+			return nil, nil, errors.WithMessage(err, "Unable to remove edge stack relations from the database")
+		}
+	}
+
+	if len(relatedEnvironmentsToAdd) > 0 {
+		if err := tx.EndpointRelation().AddEndpointRelationsForEdgeStack(relatedEnvironmentsToAdd.Keys(), edgeStack); err != nil {
+			return nil, nil, errors.WithMessage(err, "Unable to add edge stack relations to the database")
+		}
+	}
+
+	return newRelatedEnvironmentIDs, relatedEnvironmentsToAdd, nil
+}
diff --git a/api/http/handler/edgestacks/edgestack_update_test.go b/api/http/handler/edgestacks/edgestack_update_test.go
new file mode 100644
index 0000000..1665f39
--- /dev/null
+++ b/api/http/handler/edgestacks/edgestack_update_test.go
@@ -0,0 +1,238 @@
+package edgestacks
+
+import (
+	"bytes"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"reflect"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/roar"
+
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/require"
+)
+
+// Update
+func TestUpdateAndInspect(t *testing.T) {
+	t.Parallel()
+	handler, rawAPIKey := setupHandler(t)
+
+	endpoint := createEndpoint(t, handler.DataStore)
+	edgeStack := createEdgeStack(t, handler.DataStore, endpoint.ID)
+
+	// Update edge stack: create new Endpoint, EndpointRelation and EdgeGroup
+	endpointID := portainer.EndpointID(6)
+	newEndpoint := createEndpointWithId(t, handler.DataStore, endpointID)
+
+	err := handler.DataStore.Endpoint().Create(&newEndpoint)
+	require.NoError(t, err)
+
+	endpointRelation := portainer.EndpointRelation{
+		EndpointID: endpointID,
+		EdgeStacks: map[portainer.EdgeStackID]bool{
+			edgeStack.ID: true,
+		},
+	}
+
+	err = handler.DataStore.EndpointRelation().Create(&endpointRelation)
+	require.NoError(t, err)
+
+	newEdgeGroup := portainer.EdgeGroup{
+		ID:           2,
+		Name:         "EdgeGroup 2",
+		Dynamic:      false,
+		TagIDs:       nil,
+		EndpointIDs:  roar.FromSlice([]portainer.EndpointID{newEndpoint.ID}),
+		PartialMatch: false,
+	}
+
+	err = handler.DataStore.EdgeGroup().Create(&newEdgeGroup)
+	require.NoError(t, err)
+
+	payload := updateEdgeStackPayload{
+		StackFileContent: "update-test",
+		UpdateVersion:    true,
+		EdgeGroups:       append(edgeStack.EdgeGroups, newEdgeGroup.ID),
+		DeploymentType:   portainer.EdgeStackDeploymentCompose,
+	}
+
+	jsonPayload, err := json.Marshal(payload)
+	require.NoError(t, err)
+
+	r := bytes.NewBuffer(jsonPayload)
+	req, err := http.NewRequest(http.MethodPut, fmt.Sprintf("/edge_stacks/%d", edgeStack.ID), r)
+	require.NoError(t, err)
+
+	req.Header.Add("x-api-key", rawAPIKey)
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected a %d response, found: %d", http.StatusOK, rec.Code)
+	}
+
+	// Get updated edge stack
+	req, err = http.NewRequest(http.MethodGet, fmt.Sprintf("/edge_stacks/%d", edgeStack.ID), nil)
+	require.NoError(t, err)
+
+	req.Header.Add("x-api-key", rawAPIKey)
+	rec = httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected a %d response, found: %d", http.StatusOK, rec.Code)
+	}
+
+	updatedStack := portainer.EdgeStack{}
+	err = json.NewDecoder(rec.Body).Decode(&updatedStack)
+	require.NoError(t, err)
+
+	if payload.UpdateVersion && updatedStack.Version != edgeStack.Version+1 {
+		t.Fatalf("expected EdgeStack version %d, found %d", edgeStack.Version+1, updatedStack.Version+1)
+	}
+
+	if updatedStack.DeploymentType != payload.DeploymentType {
+		t.Fatalf("expected DeploymentType %d, found %d", edgeStack.DeploymentType, updatedStack.DeploymentType)
+	}
+
+	if !reflect.DeepEqual(updatedStack.EdgeGroups, payload.EdgeGroups) {
+		t.Fatalf("expected EdgeGroups to be equal")
+	}
+}
+
+func TestUpdateWithInvalidEdgeGroups(t *testing.T) {
+	t.Parallel()
+	handler, rawAPIKey := setupHandler(t)
+
+	endpoint := createEndpoint(t, handler.DataStore)
+	edgeStack := createEdgeStack(t, handler.DataStore, endpoint.ID)
+
+	newEdgeGroup := portainer.EdgeGroup{
+		ID:           2,
+		Name:         "EdgeGroup 2",
+		Dynamic:      false,
+		TagIDs:       nil,
+		EndpointIDs:  roar.FromSlice([]portainer.EndpointID{8889}),
+		PartialMatch: false,
+	}
+
+	err := handler.DataStore.EdgeGroup().Create(&newEdgeGroup)
+	require.NoError(t, err)
+
+	cases := []struct {
+		Name               string
+		Payload            updateEdgeStackPayload
+		ExpectedStatusCode int
+	}{
+		{
+			"Update with non-existing EdgeGroupID",
+			updateEdgeStackPayload{
+				StackFileContent: "error-test",
+				UpdateVersion:    true,
+				EdgeGroups:       []portainer.EdgeGroupID{9999},
+				DeploymentType:   edgeStack.DeploymentType,
+			},
+			http.StatusInternalServerError,
+		},
+		{
+			"Update with invalid EdgeGroup (non-existing Endpoint)",
+			updateEdgeStackPayload{
+				StackFileContent: "error-test",
+				UpdateVersion:    true,
+				EdgeGroups:       []portainer.EdgeGroupID{2},
+				DeploymentType:   edgeStack.DeploymentType,
+			},
+			http.StatusInternalServerError,
+		},
+		{
+			"Update DeploymentType from Docker to Kubernetes",
+			updateEdgeStackPayload{
+				StackFileContent: "error-test",
+				UpdateVersion:    true,
+				EdgeGroups:       []portainer.EdgeGroupID{1},
+				DeploymentType:   portainer.EdgeStackDeploymentKubernetes,
+			},
+			http.StatusBadRequest,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.Name, func(t *testing.T) {
+			jsonPayload, err := json.Marshal(tc.Payload)
+			if err != nil {
+				t.Fatal("JSON marshal error:", err)
+			}
+
+			r := bytes.NewBuffer(jsonPayload)
+			req, err := http.NewRequest(http.MethodPut, fmt.Sprintf("/edge_stacks/%d", edgeStack.ID), r)
+			if err != nil {
+				t.Fatal("request error:", err)
+			}
+
+			req.Header.Add("x-api-key", rawAPIKey)
+			rec := httptest.NewRecorder()
+			handler.ServeHTTP(rec, req)
+
+			if rec.Code != tc.ExpectedStatusCode {
+				t.Fatalf("expected a %d response, found: %d", tc.ExpectedStatusCode, rec.Code)
+			}
+		})
+	}
+}
+
+func TestUpdateWithInvalidPayload(t *testing.T) {
+	t.Parallel()
+	handler, rawAPIKey := setupHandler(t)
+
+	endpoint := createEndpoint(t, handler.DataStore)
+	edgeStack := createEdgeStack(t, handler.DataStore, endpoint.ID)
+
+	cases := []struct {
+		Name               string
+		Payload            updateEdgeStackPayload
+		ExpectedStatusCode int
+	}{
+		{
+			"Update with empty StackFileContent",
+			updateEdgeStackPayload{
+				StackFileContent: "",
+				UpdateVersion:    true,
+				EdgeGroups:       edgeStack.EdgeGroups,
+				DeploymentType:   edgeStack.DeploymentType,
+			},
+			http.StatusBadRequest,
+		},
+		{
+			"Update with empty EdgeGroups",
+			updateEdgeStackPayload{
+				StackFileContent: "error-test",
+				UpdateVersion:    true,
+				EdgeGroups:       []portainer.EdgeGroupID{},
+				DeploymentType:   edgeStack.DeploymentType,
+			},
+			http.StatusBadRequest,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.Name, func(t *testing.T) {
+			jsonPayload, err := json.Marshal(tc.Payload)
+			require.NoError(t, err)
+
+			r := bytes.NewBuffer(jsonPayload)
+			req, err := http.NewRequest(http.MethodPut, fmt.Sprintf("/edge_stacks/%d", edgeStack.ID), r)
+			require.NoError(t, err)
+
+			req.Header.Add("x-api-key", rawAPIKey)
+			rec := httptest.NewRecorder()
+			handler.ServeHTTP(rec, req)
+
+			if rec.Code != tc.ExpectedStatusCode {
+				t.Fatalf("expected a %d response, found: %d", tc.ExpectedStatusCode, rec.Code)
+			}
+		})
+	}
+}
diff --git a/api/http/handler/edgestacks/endpoints.go b/api/http/handler/edgestacks/endpoints.go
new file mode 100644
index 0000000..0349200
--- /dev/null
+++ b/api/http/handler/edgestacks/endpoints.go
@@ -0,0 +1,45 @@
+package edgestacks
+
+import (
+	"fmt"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+)
+
+func hasKubeEndpoint(endpointService dataservices.EndpointService, endpointIDs []portainer.EndpointID) (bool, error) {
+	return hasEndpointPredicate(endpointService, endpointIDs, endpointutils.IsKubernetesEndpoint)
+}
+
+func hasDockerEndpoint(endpointService dataservices.EndpointService, endpointIDs []portainer.EndpointID) (bool, error) {
+	return hasEndpointPredicate(endpointService, endpointIDs, endpointutils.IsDockerEndpoint)
+}
+
+func hasEndpointPredicate(endpointService dataservices.EndpointService, endpointIDs []portainer.EndpointID, predicate func(*portainer.Endpoint) bool) (bool, error) {
+	for _, endpointID := range endpointIDs {
+		endpoint, err := endpointService.Endpoint(endpointID)
+		if err != nil {
+			return false, fmt.Errorf("failed to retrieve environment from database: %w", err)
+		}
+
+		if predicate(endpoint) {
+			return true, nil
+		}
+	}
+
+	return false, nil
+}
+
+func hasWrongEnvironmentType(endpointService dataservices.EndpointService, endpointIDs []portainer.EndpointID, deploymentType portainer.EdgeStackDeploymentType) (bool, error) {
+	return hasEndpointPredicate(endpointService, endpointIDs, func(e *portainer.Endpoint) bool {
+		switch deploymentType {
+		case portainer.EdgeStackDeploymentKubernetes:
+			return !endpointutils.IsKubernetesEndpoint(e)
+		case portainer.EdgeStackDeploymentCompose:
+			return !endpointutils.IsDockerEndpoint(e)
+		default:
+			return true
+		}
+	})
+}
diff --git a/api/http/handler/edgestacks/endpoints_test.go b/api/http/handler/edgestacks/endpoints_test.go
new file mode 100644
index 0000000..07f623b
--- /dev/null
+++ b/api/http/handler/edgestacks/endpoints_test.go
@@ -0,0 +1,105 @@
+package edgestacks
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_hasKubeEndpoint(t *testing.T) {
+	t.Parallel()
+	endpoints := []portainer.Endpoint{
+		{ID: 1, Type: portainer.DockerEnvironment},
+		{ID: 2, Type: portainer.AgentOnDockerEnvironment},
+		{ID: 3, Type: portainer.AzureEnvironment},
+		{ID: 4, Type: portainer.EdgeAgentOnDockerEnvironment},
+		{ID: 5, Type: portainer.KubernetesLocalEnvironment},
+		{ID: 6, Type: portainer.AgentOnKubernetesEnvironment},
+		{ID: 7, Type: portainer.EdgeAgentOnKubernetesEnvironment},
+	}
+
+	datastore := testhelpers.NewDatastore(testhelpers.WithEndpoints(endpoints))
+
+	tests := []struct {
+		endpointIds []portainer.EndpointID
+		expected    bool
+	}{
+		{endpointIds: []portainer.EndpointID{1}, expected: false},
+		{endpointIds: []portainer.EndpointID{2}, expected: false},
+		{endpointIds: []portainer.EndpointID{3}, expected: false},
+		{endpointIds: []portainer.EndpointID{4}, expected: false},
+		{endpointIds: []portainer.EndpointID{5}, expected: true},
+		{endpointIds: []portainer.EndpointID{6}, expected: true},
+		{endpointIds: []portainer.EndpointID{7}, expected: true},
+		{endpointIds: []portainer.EndpointID{7, 2}, expected: true},
+		{endpointIds: []portainer.EndpointID{6, 4, 1}, expected: true},
+		{endpointIds: []portainer.EndpointID{1, 2, 3}, expected: false},
+	}
+
+	for _, test := range tests {
+
+		ans, err := hasKubeEndpoint(datastore.Endpoint(), test.endpointIds)
+		require.NoError(t, err, "hasKubeEndpoint shouldn't fail")
+
+		assert.Equal(t, test.expected, ans, "hasKubeEndpoint expected to return %b for %v, but returned %b", test.expected, test.endpointIds, ans)
+	}
+}
+
+func Test_hasKubeEndpoint_failWhenEndpointDontExist(t *testing.T) {
+	t.Parallel()
+	datastore := testhelpers.NewDatastore(testhelpers.WithEndpoints([]portainer.Endpoint{}))
+
+	_, err := hasKubeEndpoint(datastore.Endpoint(), []portainer.EndpointID{1})
+	require.Error(t, err, "hasKubeEndpoint should fail")
+}
+
+func Test_hasDockerEndpoint(t *testing.T) {
+	t.Parallel()
+	endpoints := []portainer.Endpoint{
+		{ID: 1, Type: portainer.DockerEnvironment},
+		{ID: 2, Type: portainer.AgentOnDockerEnvironment},
+		{ID: 3, Type: portainer.AzureEnvironment},
+		{ID: 4, Type: portainer.EdgeAgentOnDockerEnvironment},
+		{ID: 5, Type: portainer.KubernetesLocalEnvironment},
+		{ID: 6, Type: portainer.AgentOnKubernetesEnvironment},
+		{ID: 7, Type: portainer.EdgeAgentOnKubernetesEnvironment},
+	}
+
+	datastore := testhelpers.NewDatastore(testhelpers.WithEndpoints(endpoints))
+
+	tests := []struct {
+		endpointIds []portainer.EndpointID
+		expected    bool
+	}{
+		{endpointIds: []portainer.EndpointID{1}, expected: true},
+		{endpointIds: []portainer.EndpointID{2}, expected: true},
+		{endpointIds: []portainer.EndpointID{3}, expected: false},
+		{endpointIds: []portainer.EndpointID{4}, expected: true},
+		{endpointIds: []portainer.EndpointID{5}, expected: false},
+		{endpointIds: []portainer.EndpointID{6}, expected: false},
+		{endpointIds: []portainer.EndpointID{7}, expected: false},
+		{endpointIds: []portainer.EndpointID{7, 2}, expected: true},
+		{endpointIds: []portainer.EndpointID{6, 4, 1}, expected: true},
+		{endpointIds: []portainer.EndpointID{1, 2, 3}, expected: true},
+	}
+
+	for _, test := range tests {
+
+		ans, err := hasDockerEndpoint(datastore.Endpoint(), test.endpointIds)
+		require.NoError(t, err, "hasDockerEndpoint shouldn't fail")
+
+		assert.Equal(t, test.expected, ans, "hasDockerEndpoint expected to return %b for %v, but returned %b", test.expected, test.endpointIds, ans)
+	}
+}
+
+func Test_hasDockerEndpoint_failWhenEndpointDontExist(t *testing.T) {
+	t.Parallel()
+	datastore := testhelpers.NewDatastore(testhelpers.WithEndpoints([]portainer.Endpoint{}))
+
+	_, err := hasDockerEndpoint(datastore.Endpoint(), []portainer.EndpointID{1})
+	require.Error(t, err, "hasDockerEndpoint should fail")
+}
diff --git a/api/http/handler/edgestacks/handler.go b/api/http/handler/edgestacks/handler.go
new file mode 100644
index 0000000..78df853
--- /dev/null
+++ b/api/http/handler/edgestacks/handler.go
@@ -0,0 +1,65 @@
+package edgestacks
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/middlewares"
+	"github.com/portainer/portainer/api/http/security"
+	edgestackservice "github.com/portainer/portainer/api/internal/edge/edgestacks"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+
+	"github.com/gorilla/mux"
+)
+
+// Handler is the HTTP handler used to handle environment(endpoint) group operations.
+type Handler struct {
+	*mux.Router
+	requestBouncer     security.BouncerService
+	DataStore          dataservices.DataStore
+	FileService        portainer.FileService
+	GitService         portainer.GitService
+	edgeStacksService  *edgestackservice.Service
+	KubernetesDeployer portainer.KubernetesDeployer
+}
+
+// NewHandler creates a handler to manage environment(endpoint) group operations.
+func NewHandler(bouncer security.BouncerService, dataStore dataservices.DataStore, edgeStacksService *edgestackservice.Service) *Handler {
+	h := &Handler{
+		Router:            mux.NewRouter(),
+		requestBouncer:    bouncer,
+		DataStore:         dataStore,
+		edgeStacksService: edgeStacksService,
+	}
+
+	h.Handle("/edge_stacks/create/{method}",
+		bouncer.AdminAccess(bouncer.EdgeComputeOperation(httperror.LoggerHandler(h.edgeStackCreate)))).Methods(http.MethodPost)
+	h.Handle("/edge_stacks",
+		bouncer.AdminAccess(bouncer.EdgeComputeOperation(httperror.LoggerHandler(h.edgeStackList)))).Methods(http.MethodGet)
+	h.Handle("/edge_stacks/{id}",
+		bouncer.AdminAccess(bouncer.EdgeComputeOperation(httperror.LoggerHandler(h.edgeStackInspect)))).Methods(http.MethodGet)
+	h.Handle("/edge_stacks/{id}",
+		bouncer.AdminAccess(bouncer.EdgeComputeOperation(httperror.LoggerHandler(h.edgeStackUpdate)))).Methods(http.MethodPut)
+	h.Handle("/edge_stacks/{id}",
+		bouncer.AdminAccess(bouncer.EdgeComputeOperation(httperror.LoggerHandler(h.edgeStackDelete)))).Methods(http.MethodDelete)
+	h.Handle("/edge_stacks/{id}/file",
+		bouncer.AdminAccess(bouncer.EdgeComputeOperation(httperror.LoggerHandler(h.edgeStackFile)))).Methods(http.MethodGet)
+	h.Handle("/edge_stacks/{id}/status",
+		bouncer.PublicAccess(httperror.LoggerHandler(h.edgeStackStatusUpdate))).Methods(http.MethodPut)
+
+	edgeStackStatusRouter := h.NewRoute().Subrouter()
+	edgeStackStatusRouter.Use(middlewares.WithEndpoint(h.DataStore.Endpoint(), "endpoint_id"))
+
+	return h
+}
+
+func handlerDBErr(err error, msg string) *httperror.HandlerError {
+	httpErr := httperror.InternalServerError(msg, err)
+
+	if dataservices.IsErrObjectNotFound(err) {
+		httpErr.StatusCode = http.StatusNotFound
+	}
+
+	return httpErr
+}
diff --git a/api/http/handler/edgestacks/utils_update_stack_version.go b/api/http/handler/edgestacks/utils_update_stack_version.go
new file mode 100644
index 0000000..78ac500
--- /dev/null
+++ b/api/http/handler/edgestacks/utils_update_stack_version.go
@@ -0,0 +1,59 @@
+package edgestacks
+
+import (
+	"fmt"
+	"strconv"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/filesystem"
+
+	"github.com/rs/zerolog/log"
+)
+
+func (handler *Handler) updateStackVersion(tx dataservices.DataStoreTx, stack *portainer.EdgeStack, deploymentType portainer.EdgeStackDeploymentType, config []byte, oldGitHash string, relatedEnvironmentsIDs []portainer.EndpointID) error {
+	stack.Version++
+
+	if err := tx.EdgeStackStatus().Clear(stack.ID, relatedEnvironmentsIDs); err != nil {
+		return err
+	}
+
+	return handler.storeStackFile(stack, deploymentType, config)
+}
+
+func (handler *Handler) storeStackFile(stack *portainer.EdgeStack, deploymentType portainer.EdgeStackDeploymentType, config []byte) error {
+	if deploymentType != stack.DeploymentType {
+		// deployment type was changed - need to delete all old files
+		if err := handler.FileService.RemoveDirectory(stack.ProjectPath); err != nil {
+			log.Warn().Err(err).Msg("Unable to clear old files")
+		}
+
+		stack.EntryPoint = ""
+		stack.ManifestPath = ""
+		stack.DeploymentType = deploymentType
+	}
+
+	stackFolder := strconv.Itoa(int(stack.ID))
+	entryPoint := ""
+	if deploymentType == portainer.EdgeStackDeploymentCompose {
+		if stack.EntryPoint == "" {
+			stack.EntryPoint = filesystem.ComposeFileDefaultName
+		}
+
+		entryPoint = stack.EntryPoint
+	}
+
+	if deploymentType == portainer.EdgeStackDeploymentKubernetes {
+		if stack.ManifestPath == "" {
+			stack.ManifestPath = filesystem.ManifestFileDefaultName
+		}
+
+		entryPoint = stack.ManifestPath
+	}
+
+	if _, err := handler.FileService.StoreEdgeStackFileFromBytes(stackFolder, entryPoint, config); err != nil {
+		return fmt.Errorf("unable to persist updated Compose file with version on disk: %w", err)
+	}
+
+	return nil
+}
diff --git a/api/http/handler/endpointedge/endpointedge_job_logs.go b/api/http/handler/endpointedge/endpointedge_job_logs.go
new file mode 100644
index 0000000..61b99dd
--- /dev/null
+++ b/api/http/handler/endpointedge/endpointedge_job_logs.go
@@ -0,0 +1,112 @@
+package endpointedge
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+	"strconv"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/middlewares"
+	"github.com/portainer/portainer/api/internal/edge/cache"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type logsPayload struct {
+	FileContent string
+}
+
+func (payload *logsPayload) Validate(r *http.Request) error {
+	return nil
+}
+
+// endpointEdgeJobsLogs
+// @summary Update the logs collected from an Edge Job
+// @description **Access policy**: Edge agent only — requires X-PortainerAgent-EdgeID header
+// @tags edge_agent
+// @accept json
+// @produce json
+// @param id path int true "environment Id"
+// @param jobID path int true "Job Id"
+// @success 200
+// @failure 500
+// @failure 400
+// @failure 403
+// @router /endpoints/{id}/edge/jobs/{jobID}/logs [post]
+func (handler *Handler) endpointEdgeJobsLogs(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	endpoint, err := middlewares.FetchEndpoint(r)
+	if err != nil {
+		return httperror.BadRequest("Unable to find an environment on request context", err)
+	}
+
+	if err := handler.requestBouncer.AuthorizedEdgeEndpointOperation(r, endpoint); err != nil {
+		return httperror.Forbidden("Permission denied to access environment", fmt.Errorf("unauthorized edge endpoint operation: %w. Environment ID: %d", err, endpoint.ID))
+	}
+
+	edgeJobID, err := request.RetrieveNumericRouteVariableValue(r, "jobID")
+	if err != nil {
+		return httperror.BadRequest("Invalid edge job identifier route variable", fmt.Errorf("invalid Edge job route variable: %w. Environment ID: %d", err, endpoint.ID))
+	}
+
+	var payload logsPayload
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return httperror.BadRequest("Invalid request payload", fmt.Errorf("invalid Edge job request payload: %w. Environment ID: %d", err, endpoint.ID))
+	}
+
+	if err := handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return handler.updateEdgeJobLogs(tx, endpoint.ID, portainer.EdgeJobID(edgeJobID), payload)
+	}); err != nil {
+		var httpErr *httperror.HandlerError
+		if errors.As(err, &httpErr) {
+			httpErr.Err = fmt.Errorf("edge polling error: %w. Environment ID: %d", httpErr.Err, endpoint.ID)
+			return httpErr
+		}
+
+		return httperror.InternalServerError("Unexpected error", fmt.Errorf("edge polling error: %w. Environment ID: %d", err, endpoint.ID))
+	}
+
+	return response.JSON(w, nil)
+}
+
+func (handler *Handler) updateEdgeJobLogs(tx dataservices.DataStoreTx, endpointID portainer.EndpointID, edgeJobID portainer.EdgeJobID, payload logsPayload) error {
+	endpoint, err := tx.Endpoint().Endpoint(endpointID)
+	if tx.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find an environment with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find an environment with the specified identifier inside the database", err)
+	}
+
+	edgeJob, err := tx.EdgeJob().Read(edgeJobID)
+	if tx.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find an edge job with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find an edge job with the specified identifier inside the database", err)
+	}
+
+	if resp, err := handler.buildSchedules(tx, endpoint, []portainer.EdgeJob{*edgeJob}); err != nil || len(resp) == 0 {
+		return httperror.InternalServerError("Unable to verify if the edge job is assigned to the environment",
+			fmt.Errorf("unable to verify if the edge job is assigned to the environment: %w. Environment name: %s", err, endpoint.Name))
+	}
+
+	if err := handler.FileService.StoreEdgeJobTaskLogFileFromBytes(strconv.Itoa(int(edgeJobID)), strconv.Itoa(int(endpoint.ID)), []byte(payload.FileContent)); err != nil {
+		return httperror.InternalServerError("Unable to save task log to the filesystem", err)
+	}
+
+	meta := portainer.EdgeJobEndpointMeta{CollectLogs: false, LogsStatus: portainer.EdgeJobLogsStatusCollected}
+	if _, ok := edgeJob.GroupLogsCollection[endpoint.ID]; ok {
+		edgeJob.GroupLogsCollection[endpoint.ID] = meta
+	} else {
+		edgeJob.Endpoints[endpoint.ID] = meta
+	}
+
+	if err := tx.EdgeJob().Update(edgeJob.ID, edgeJob); err != nil {
+		return httperror.InternalServerError("Unable to persist edge job changes to the database", err)
+	}
+
+	cache.Del(endpointID)
+
+	return nil
+}
diff --git a/api/http/handler/endpointedge/endpointedge_job_logs_test.go b/api/http/handler/endpointedge/endpointedge_job_logs_test.go
new file mode 100644
index 0000000..740dfb5
--- /dev/null
+++ b/api/http/handler/endpointedge/endpointedge_job_logs_test.go
@@ -0,0 +1,41 @@
+package endpointedge
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestUpdateUnrelatedEdgeJobLogs(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, false)
+
+	h := &Handler{DataStore: store}
+
+	endpointID := portainer.EndpointID(2)
+	edgeJobID := portainer.EdgeJobID(3)
+	payload := logsPayload{FileContent: "log content"}
+
+	err := store.Endpoint().Create(&portainer.Endpoint{
+		ID:   endpointID,
+		Name: "test-endpoint",
+	})
+	require.NoError(t, err)
+
+	err = store.EdgeJob().CreateWithID(edgeJobID, &portainer.EdgeJob{
+		ID:   edgeJobID,
+		Name: "test-edge-job",
+	})
+	require.NoError(t, err)
+
+	// There is no relation between the edge job and the endpoint, so the
+	// update must fail
+	err = store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return h.updateEdgeJobLogs(tx, endpointID, edgeJobID, payload)
+	})
+	require.Error(t, err)
+}
diff --git a/api/http/handler/endpointedge/endpointedge_stack_inspect.go b/api/http/handler/endpointedge/endpointedge_stack_inspect.go
new file mode 100644
index 0000000..70e5f5a
--- /dev/null
+++ b/api/http/handler/endpointedge/endpointedge_stack_inspect.go
@@ -0,0 +1,112 @@
+package endpointedge
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+	"strconv"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/edge"
+	"github.com/portainer/portainer/api/filesystem"
+	"github.com/portainer/portainer/api/http/middlewares"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+	"github.com/portainer/portainer/api/kubernetes"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+
+	"golang.org/x/sync/singleflight"
+)
+
+var edgeStackSingleFlightGroup = singleflight.Group{}
+
+// @summary Inspect an Edge Stack for an Environment
+// @description **Access policy**: Edge agent only — requires X-PortainerAgent-EdgeID header
+// @tags edge_agent, edge_stacks
+// @accept json
+// @produce json
+// @param id path int true "environment Id"
+// @param stackId path int true "EdgeStack Id"
+// @success 200 {object} edge.StackPayload
+// @failure 500
+// @failure 400
+// @failure 404
+// @router /endpoints/{id}/edge/stacks/{stackId} [get]
+func (handler *Handler) endpointEdgeStackInspect(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	endpoint, err := middlewares.FetchEndpoint(r)
+	if err != nil {
+		return httperror.BadRequest("Unable to find an environment on request context", err)
+	}
+
+	if err := handler.requestBouncer.AuthorizedEdgeEndpointOperation(r, endpoint); err != nil {
+		return httperror.Forbidden("Permission denied to access environment", fmt.Errorf("unauthorized edge endpoint operation: %w. Environment ID: %d", err, endpoint.ID))
+	}
+
+	edgeStackID, err := request.RetrieveNumericRouteVariableValue(r, "stackId")
+	if err != nil {
+		return httperror.BadRequest("Invalid edge stack identifier route variable", fmt.Errorf("invalid Edge stack route variable: %w. Environment ID: %d", err, endpoint.ID))
+	}
+
+	s, err, _ := edgeStackSingleFlightGroup.Do(strconv.Itoa(edgeStackID), func() (any, error) {
+		edgeStack, err := handler.DataStore.EdgeStack().EdgeStack(portainer.EdgeStackID(edgeStackID))
+		if handler.DataStore.IsErrObjectNotFound(err) {
+			return nil, httperror.NotFound("Unable to find an edge stack with the specified identifier inside the database", fmt.Errorf("unable to find the Edge stack from database: %w. Environment ID: %d", err, endpoint.ID))
+		}
+
+		return edgeStack, err
+	})
+	if err != nil {
+		var httpErr *httperror.HandlerError
+		if errors.As(err, &httpErr) {
+			return httpErr
+		}
+
+		return httperror.InternalServerError("Unable to find an edge stack with the specified identifier inside the database", fmt.Errorf("failed to find Edge stack from the database: %w. Environment ID: %d", err, endpoint.ID))
+	}
+
+	// WARNING: this variable must not be mutated
+	edgeStack := s.(*portainer.EdgeStack)
+
+	fileName := edgeStack.EntryPoint
+	if endpointutils.IsDockerEndpoint(endpoint) {
+		if fileName == "" {
+			return httperror.BadRequest("Docker is not supported by this stack", fmt.Errorf("no filename is provided for the Docker endpoint. Environment ID: %d", endpoint.ID))
+		}
+	}
+
+	namespace := ""
+	if !edgeStack.UseManifestNamespaces {
+		namespace = kubernetes.DefaultNamespace
+	}
+
+	if endpointutils.IsKubernetesEndpoint(endpoint) {
+		fileName = edgeStack.ManifestPath
+
+		if fileName == "" {
+			return httperror.BadRequest("Kubernetes is not supported by this stack", fmt.Errorf("no filename is provided for the Kubernetes endpoint. Environment ID: %d", endpoint.ID))
+		}
+	}
+
+	dirEntries, err := filesystem.LoadDir(edgeStack.ProjectPath)
+	if err != nil {
+		return httperror.InternalServerError("Unable to load repository", fmt.Errorf("failed to load project directory: %w. Environment ID: %d", err, endpoint.ID))
+	}
+
+	fileContent, err := filesystem.FilterDirForCompatibility(dirEntries, fileName, endpoint.Agent.Version)
+	if err != nil {
+		return httperror.InternalServerError("File not found", fmt.Errorf("unable to find file: %w. Environment ID: %d", err, endpoint.ID))
+	}
+
+	dirEntries = filesystem.FilterDirForEntryFile(dirEntries, fileName)
+
+	return response.JSON(w, edge.StackPayload{
+		DirEntries:       dirEntries,
+		EntryFileName:    fileName,
+		StackFileContent: fileContent,
+		Name:             edgeStack.Name,
+		Namespace:        namespace,
+		CreatedBy:        edgeStack.CreatedBy,
+		CreatedByUserId:  edgeStack.CreatedByUserId,
+	})
+}
diff --git a/api/http/handler/endpointedge/endpointedge_status_inspect.go b/api/http/handler/endpointedge/endpointedge_status_inspect.go
new file mode 100644
index 0000000..23d5434
--- /dev/null
+++ b/api/http/handler/endpointedge/endpointedge_status_inspect.go
@@ -0,0 +1,351 @@
+package endpointedge
+
+import (
+	"bytes"
+	"cmp"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"hash/fnv"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"strings"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/internal/edge"
+	"github.com/portainer/portainer/api/internal/edge/cache"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/rs/zerolog/log"
+)
+
+type stackStatusResponse struct {
+	// EdgeStack Identifier
+	ID portainer.EdgeStackID `example:"1"`
+	// Version of this stack
+	Version int `example:"3"`
+}
+
+type edgeJobResponse struct {
+	// EdgeJob Identifier
+	ID portainer.EdgeJobID `json:"Id" example:"2"`
+	// Whether to collect logs
+	CollectLogs bool `json:"CollectLogs" example:"true"`
+	// A cron expression to schedule this job
+	CronExpression string `json:"CronExpression" example:"* * * * *"`
+	// Script to run
+	Script string `json:"Script" example:"echo hello"`
+	// Version of this EdgeJob
+	Version int `json:"Version" example:"2"`
+}
+
+type endpointEdgeStatusInspectResponse struct {
+	// Status represents the environment(endpoint) status
+	Status string `json:"status" example:"REQUIRED"`
+	// The tunnel port
+	Port int `json:"port" example:"8732"`
+	// List of requests for jobs to run on the environment(endpoint)
+	Schedules []edgeJobResponse `json:"schedules"`
+	// The current value of CheckinInterval
+	CheckinInterval int `json:"checkin" example:"5"`
+	//
+	Credentials string `json:"credentials"`
+	// List of stacks to be deployed on the environments(endpoints)
+	Stacks []stackStatusResponse `json:"stacks"`
+}
+
+// @id EndpointEdgeStatusInspect
+// @summary Get environment status
+// @description Endpoint for edge agent to check status of environment
+// @description **Access policy**: Edge agent only — requires X-PortainerAgent-EdgeID header
+// @tags edge_agent
+// @security ApiKeyAuth
+// @security jwt
+// @param id path int true "Environment identifier"
+// @success 200 {object} endpointEdgeStatusInspectResponse "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied to access environment"
+// @failure 404 "Environment not found"
+// @failure 500 "Server error"
+// @router /endpoints/{id}/edge/status [get]
+func (handler *Handler) endpointEdgeStatusInspect(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	endpointID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid environment identifier route variable", err)
+	}
+
+	if cachedResp := handler.respondFromCache(w, r, portainer.EndpointID(endpointID)); cachedResp {
+		return nil
+	}
+
+	if _, ok := handler.DataStore.Endpoint().Heartbeat(portainer.EndpointID(endpointID)); !ok {
+		// EE-5190
+		return httperror.Forbidden("Permission denied to access environment. The device has not been trusted yet", fmt.Errorf("unable to retrieve endpoint heartbeat. Environment ID: %d", endpointID))
+	}
+
+	endpoint, err := handler.DataStore.Endpoint().Endpoint(portainer.EndpointID(endpointID))
+	if err != nil {
+		// EE-5190
+		return httperror.Forbidden("Permission denied to access environment. The device has not been trusted yet", fmt.Errorf("unable to retrieve endpoint from database: %w. Environment ID: %d", err, endpointID))
+	}
+
+	firstConn := endpoint.LastCheckInDate == 0
+
+	if err := handler.requestBouncer.AuthorizedEdgeEndpointOperation(r, endpoint); err != nil {
+		return httperror.Forbidden("Permission denied to access environment. The device has not been trusted yet", fmt.Errorf("unauthorized Edge endpoint operation: %w. Environment ID: %d", err, endpoint.ID))
+	}
+
+	handler.DataStore.Endpoint().UpdateHeartbeat(endpoint.ID)
+
+	if err := handler.requestBouncer.TrustedEdgeEnvironmentAccess(handler.DataStore, endpoint); err != nil {
+		return httperror.Forbidden("Permission denied to access environment. The device has not been trusted yet", fmt.Errorf("untrusted Edge environment access: %w. Environment ID: %d", err, endpoint.ID))
+	}
+
+	var statusResponse *endpointEdgeStatusInspectResponse
+	if err := handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		statusResponse, err = handler.inspectStatus(tx, r, portainer.EndpointID(endpointID), firstConn)
+		return err
+	}); err != nil {
+		var httpErr *httperror.HandlerError
+		if errors.As(err, &httpErr) {
+			httpErr.Err = fmt.Errorf("edge polling error: %w. Environment ID: %d", httpErr.Err, endpoint.ID)
+			return httpErr
+		}
+
+		return httperror.InternalServerError("Unexpected error", fmt.Errorf("edge polling error: %w. Environment ID: %d", err, endpoint.ID))
+	}
+
+	return cacheResponse(w, endpoint.ID, *statusResponse)
+}
+
+func (handler *Handler) parseHeaders(r *http.Request, endpoint *portainer.Endpoint) error {
+	endpoint.EdgeID = cmp.Or(endpoint.EdgeID, r.Header.Get(portainer.PortainerAgentEdgeIDHeader))
+
+	agentPlatform, agentPlatformErr := parseAgentPlatform(r)
+	if agentPlatformErr != nil {
+		return httperror.BadRequest("agent platform header is not valid", agentPlatformErr)
+	}
+	endpoint.Type = agentPlatform
+
+	version := r.Header.Get(portainer.PortainerAgentHeader)
+	endpoint.Agent.Version = version
+
+	if gpuOperatorHeader := r.Header.Get(portainer.HTTPResponseAgentGPUOperator); gpuOperatorHeader != "" {
+		endpoint.Kubernetes.Flags.GPUOperator = gpuOperatorHeader == "true"
+	}
+
+	return nil
+}
+
+func (handler *Handler) inspectStatus(tx dataservices.DataStoreTx, r *http.Request, endpointID portainer.EndpointID, firstConn bool) (*endpointEdgeStatusInspectResponse, error) {
+	endpoint, err := tx.Endpoint().Endpoint(endpointID)
+	if err != nil {
+		return nil, err
+	}
+
+	if err := handler.parseHeaders(r, endpoint); err != nil {
+		return nil, err
+	}
+
+	// Take an initial snapshot
+	if firstConn {
+		if err := handler.ReverseTunnelService.Open(endpoint); err != nil {
+			log.Error().Err(err).Msg("could not open the tunnel")
+		}
+	}
+
+	endpoint.LastCheckInDate = time.Now().Unix()
+
+	if err := tx.Endpoint().UpdateEndpoint(endpoint.ID, endpoint); err != nil {
+		return nil, httperror.InternalServerError("Unable to persist environment changes inside the database", err)
+	}
+
+	tunnel := handler.ReverseTunnelService.Config(endpoint.ID)
+
+	statusResponse := endpointEdgeStatusInspectResponse{
+		Status:          tunnel.Status,
+		Port:            tunnel.Port,
+		CheckinInterval: edge.EffectiveCheckinInterval(tx, endpoint),
+		Credentials:     tunnel.Credentials,
+	}
+
+	schedules, handlerErr := handler.buildAllSchedules(tx, endpoint)
+	if handlerErr != nil {
+		return nil, handlerErr
+	}
+	statusResponse.Schedules = schedules
+
+	edgeStacksStatus, handlerErr := handler.buildEdgeStacks(tx, endpoint.ID)
+	if handlerErr != nil {
+		return nil, handlerErr
+	}
+	statusResponse.Stacks = edgeStacksStatus
+
+	return &statusResponse, nil
+}
+
+func parseAgentPlatform(r *http.Request) (portainer.EndpointType, error) {
+	agentPlatformHeader := r.Header.Get(portainer.HTTPResponseAgentPlatform)
+	if agentPlatformHeader == "" {
+		return 0, errors.New("agent platform header is missing")
+	}
+
+	agentPlatformNumber, err := strconv.Atoi(agentPlatformHeader)
+	if err != nil {
+		return 0, err
+	}
+
+	agentPlatform := portainer.AgentPlatform(agentPlatformNumber)
+
+	switch agentPlatform {
+	case portainer.AgentPlatformDocker:
+		return portainer.EdgeAgentOnDockerEnvironment, nil
+	case portainer.AgentPlatformKubernetes:
+		return portainer.EdgeAgentOnKubernetesEnvironment, nil
+	default:
+		return 0, fmt.Errorf("agent platform %v is not valid", agentPlatform)
+	}
+}
+
+func (handler *Handler) buildAllSchedules(tx dataservices.DataStoreTx, endpoint *portainer.Endpoint) ([]edgeJobResponse, *httperror.HandlerError) {
+	edgeJobs, err := tx.EdgeJob().ReadAll()
+	if err != nil {
+		return nil, httperror.InternalServerError("Unable to retrieve Edge Jobs", err)
+	}
+
+	return handler.buildSchedules(tx, endpoint, edgeJobs)
+}
+
+func (handler *Handler) buildSchedules(tx dataservices.DataStoreTx, endpoint *portainer.Endpoint, edgeJobs []portainer.EdgeJob) ([]edgeJobResponse, *httperror.HandlerError) {
+	schedules := []edgeJobResponse{}
+
+	endpointGroups, err := tx.EndpointGroup().ReadAll()
+	if err != nil {
+		return nil, httperror.InternalServerError("Unable to retrieve endpoint groups", err)
+	}
+
+	for _, job := range edgeJobs {
+		_, endpointHasJob := job.Endpoints[endpoint.ID]
+		if !endpointHasJob {
+			for _, edgeGroupID := range job.EdgeGroups {
+				member, _, err := edge.EndpointInEdgeGroup(tx, endpoint, edgeGroupID, endpointGroups)
+				if err != nil {
+					return nil, httperror.InternalServerError("Unable to retrieve relations", err)
+				} else if member {
+					endpointHasJob = true
+
+					break
+				}
+			}
+		}
+
+		if !endpointHasJob {
+			continue
+		}
+
+		schedule := edgeJobResponse{
+			ID:             job.ID,
+			CronExpression: job.CronExpression,
+			CollectLogs:    job.GroupLogsCollection[endpoint.ID].CollectLogs || job.Endpoints[endpoint.ID].CollectLogs,
+			Version:        job.Version,
+		}
+
+		file, err := handler.FileService.GetFileContent(job.ScriptPath, "")
+		if err != nil {
+			return nil, httperror.InternalServerError("Unable to retrieve Edge job script file", err)
+		}
+		schedule.Script = base64.RawStdEncoding.EncodeToString(file)
+
+		schedules = append(schedules, schedule)
+	}
+
+	return schedules, nil
+}
+
+func (handler *Handler) buildEdgeStacks(tx dataservices.DataStoreTx, endpointID portainer.EndpointID) ([]stackStatusResponse, *httperror.HandlerError) {
+	relation, err := tx.EndpointRelation().EndpointRelation(endpointID)
+	if err != nil {
+		return nil, httperror.InternalServerError("Unable to retrieve relation object from the database", err)
+	}
+
+	edgeStacksStatus := []stackStatusResponse{}
+	for stackID := range relation.EdgeStacks {
+		version, ok := tx.EdgeStack().EdgeStackVersion(stackID)
+		if !ok {
+			return nil, httperror.InternalServerError("Unable to retrieve edge stack from the database", err)
+		}
+
+		stackStatus := stackStatusResponse{
+			ID:      stackID,
+			Version: version,
+		}
+
+		edgeStacksStatus = append(edgeStacksStatus, stackStatus)
+	}
+
+	return edgeStacksStatus, nil
+}
+
+func cacheResponse(w http.ResponseWriter, endpointID portainer.EndpointID, statusResponse endpointEdgeStatusInspectResponse) *httperror.HandlerError {
+	rr := httptest.NewRecorder()
+
+	if err := response.JSON(rr, statusResponse); err != nil {
+		return err
+	}
+
+	h := fnv.New32a()
+	h.Write(rr.Body.Bytes())
+	etag := strconv.FormatUint(uint64(h.Sum32()), 16)
+
+	cache.Set(endpointID, []byte(etag))
+
+	resp := rr.Result()
+
+	for k, vs := range resp.Header {
+		for _, v := range vs {
+			w.Header().Add(k, v)
+		}
+	}
+
+	w.Header().Set("ETag", etag)
+
+	if _, err := io.Copy(w, resp.Body); err != nil {
+		log.Warn().Err(err).Msg("failed to copy response body")
+	}
+
+	return nil
+}
+
+func (handler *Handler) respondFromCache(w http.ResponseWriter, r *http.Request, endpointID portainer.EndpointID) bool {
+	inmHeader := r.Header.Get("If-None-Match")
+	etags := strings.Split(inmHeader, ",")
+
+	if len(inmHeader) == 0 || etags[0] == "" {
+		return false
+	}
+
+	cachedETag, ok := cache.Get(endpointID)
+	if !ok {
+		return false
+	}
+
+	for _, etag := range etags {
+		if !bytes.Equal([]byte(etag), cachedETag) {
+			continue
+		}
+
+		handler.DataStore.Endpoint().UpdateHeartbeat(endpointID)
+
+		w.Header().Set("ETag", etag)
+		w.WriteHeader(http.StatusNotModified)
+
+		return true
+	}
+
+	return false
+}
diff --git a/api/http/handler/endpointedge/endpointedge_status_inspect_test.go b/api/http/handler/endpointedge/endpointedge_status_inspect_test.go
new file mode 100644
index 0000000..8b07f92
--- /dev/null
+++ b/api/http/handler/endpointedge/endpointedge_status_inspect_test.go
@@ -0,0 +1,440 @@
+package endpointedge
+
+import (
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/apikey"
+	"github.com/portainer/portainer/api/chisel"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/filesystem"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/jwt"
+	"github.com/portainer/portainer/api/roar"
+
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type endpointTestCase struct {
+	endpoint           portainer.Endpoint
+	endpointRelation   portainer.EndpointRelation
+	expectedStatusCode int
+}
+
+var endpointTestCases = []endpointTestCase{
+	{
+		portainer.Endpoint{},
+		portainer.EndpointRelation{},
+		http.StatusForbidden,
+	},
+	{
+		portainer.Endpoint{
+			ID:     -1,
+			Name:   "endpoint-id-1",
+			Type:   portainer.EdgeAgentOnDockerEnvironment,
+			URL:    "https://portainer.io:9443",
+			EdgeID: "edge-id",
+		},
+		portainer.EndpointRelation{
+			EndpointID: -1,
+		},
+		http.StatusForbidden,
+	},
+	{
+		portainer.Endpoint{
+			ID:     2,
+			Name:   "endpoint-id-2",
+			Type:   portainer.EdgeAgentOnDockerEnvironment,
+			URL:    "https://portainer.io:9443",
+			EdgeID: "",
+		},
+		portainer.EndpointRelation{
+			EndpointID: 2,
+		},
+		http.StatusForbidden,
+	},
+	{
+		portainer.Endpoint{
+			ID:     4,
+			Name:   "endpoint-id-4",
+			Type:   portainer.EdgeAgentOnDockerEnvironment,
+			URL:    "https://portainer.io:9443",
+			EdgeID: "edge-id",
+		},
+		portainer.EndpointRelation{
+			EndpointID: 4,
+		},
+		http.StatusOK,
+	},
+}
+
+func mustSetupHandler(t *testing.T) *Handler {
+	tmpDir := t.TempDir()
+	fs, err := filesystem.NewService(tmpDir, "")
+	if err != nil {
+		t.Fatalf("could not start a new filesystem service: %s", err)
+	}
+
+	_, store := datastore.MustNewTestStore(t, true, true)
+
+	jwtService, err := jwt.NewService("1h", store)
+	if err != nil {
+		t.Fatalf("could not start a new JWT service: %s", err)
+	}
+
+	apiKeyService := apikey.NewAPIKeyService(nil, nil)
+
+	settings, err := store.Settings().Settings()
+	if err != nil {
+		t.Fatalf("could not create new settings: %s", err)
+	}
+	settings.TrustOnFirstConnect = true
+
+	if err = store.Settings().UpdateSettings(settings); err != nil {
+		t.Fatalf("could not update settings: %s", err)
+	}
+
+	handler := NewHandler(
+		security.NewRequestBouncer(t.Context(), store, jwtService, apiKeyService),
+		store,
+		fs,
+		chisel.NewService(store, t.Context(), nil),
+	)
+
+	handler.ReverseTunnelService = chisel.NewService(store, t.Context(), nil)
+
+	return handler
+}
+
+func createEndpoint(handler *Handler, endpoint portainer.Endpoint, endpointRelation portainer.EndpointRelation) (err error) {
+	// Avoid setting ID below 0 to generate invalid test cases
+	if endpoint.ID <= 0 {
+		return nil
+	}
+
+	if err := handler.DataStore.Endpoint().Create(&endpoint); err != nil {
+		return err
+	}
+
+	return handler.DataStore.EndpointRelation().Create(&endpointRelation)
+}
+
+func TestMissingEdgeIdentifier(t *testing.T) {
+	t.Parallel()
+	handler := mustSetupHandler(t)
+	endpointID := portainer.EndpointID(45)
+
+	if err := createEndpoint(handler, portainer.Endpoint{
+		ID:     endpointID,
+		Name:   "endpoint-id-45",
+		Type:   portainer.EdgeAgentOnDockerEnvironment,
+		URL:    "https://portainer.io:9443",
+		EdgeID: "edge-id",
+	}, portainer.EndpointRelation{EndpointID: endpointID}); err != nil {
+		t.Fatal(err)
+	}
+
+	req, err := http.NewRequest(http.MethodGet, fmt.Sprintf("/api/endpoints/%d/edge/status", endpointID), nil)
+	if err != nil {
+		t.Fatal("request error:", err)
+	}
+
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("expected a %d response, found: %d without Edge identifier", http.StatusForbidden, rec.Code)
+	}
+}
+
+func TestWithEndpoints(t *testing.T) {
+	t.Parallel()
+	handler := mustSetupHandler(t)
+
+	for _, test := range endpointTestCases {
+		err := createEndpoint(handler, test.endpoint, test.endpointRelation)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		req, err := http.NewRequest(http.MethodGet, fmt.Sprintf("/api/endpoints/%d/edge/status", test.endpoint.ID), nil)
+		if err != nil {
+			t.Fatal("request error:", err)
+		}
+
+		req.Header.Set(portainer.PortainerAgentEdgeIDHeader, test.endpoint.EdgeID)
+		req.Header.Set(portainer.HTTPResponseAgentPlatform, "1")
+
+		rec := httptest.NewRecorder()
+		handler.ServeHTTP(rec, req)
+
+		if rec.Code != test.expectedStatusCode {
+			t.Fatalf("expected a %d response, found: %d for endpoint ID: %d", test.expectedStatusCode, rec.Code, test.endpoint.ID)
+		}
+	}
+}
+
+func TestLastCheckInDateIncreases(t *testing.T) {
+	t.Parallel()
+	synctest.Test(t, testLastCheckInDateIncreases)
+}
+
+func testLastCheckInDateIncreases(t *testing.T) {
+	handler := mustSetupHandler(t)
+
+	endpointID := portainer.EndpointID(56)
+	endpoint := portainer.Endpoint{
+		ID:              endpointID,
+		Name:            "test-endpoint-56",
+		Type:            portainer.EdgeAgentOnDockerEnvironment,
+		URL:             "https://portainer.io:9443",
+		EdgeID:          "edge-id",
+		LastCheckInDate: time.Now().Unix(),
+	}
+
+	endpointRelation := portainer.EndpointRelation{
+		EndpointID: endpoint.ID,
+	}
+
+	if err := createEndpoint(handler, endpoint, endpointRelation); err != nil {
+		t.Fatal(err)
+	}
+
+	time.Sleep(1 * time.Second)
+
+	req, err := http.NewRequest(http.MethodGet, fmt.Sprintf("/api/endpoints/%d/edge/status", endpoint.ID), nil)
+	if err != nil {
+		t.Fatal("request error:", err)
+	}
+
+	req.Header.Set(portainer.PortainerAgentEdgeIDHeader, "edge-id")
+	req.Header.Set(portainer.HTTPResponseAgentPlatform, "1")
+
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected a %d response, found: %d", http.StatusOK, rec.Code)
+	}
+
+	updatedEndpoint, err := handler.DataStore.Endpoint().Endpoint(endpoint.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	assert.Greater(t, updatedEndpoint.LastCheckInDate, endpoint.LastCheckInDate)
+}
+
+func TestEmptyEdgeIdWithAgentPlatformHeader(t *testing.T) {
+	t.Parallel()
+	handler := mustSetupHandler(t)
+
+	endpointID := portainer.EndpointID(44)
+	edgeId := "edge-id"
+	endpoint := portainer.Endpoint{
+		ID:     endpointID,
+		Name:   "test-endpoint-44",
+		Type:   portainer.EdgeAgentOnDockerEnvironment,
+		URL:    "https://portainer.io:9443",
+		EdgeID: "",
+	}
+	endpointRelation := portainer.EndpointRelation{
+		EndpointID: endpoint.ID,
+	}
+
+	if err := createEndpoint(handler, endpoint, endpointRelation); err != nil {
+		t.Fatal(err)
+	}
+
+	req, err := http.NewRequest(http.MethodGet, fmt.Sprintf("/api/endpoints/%d/edge/status", endpoint.ID), nil)
+	if err != nil {
+		t.Fatal("request error:", err)
+	}
+
+	req.Header.Set(portainer.PortainerAgentEdgeIDHeader, edgeId)
+	req.Header.Set(portainer.HTTPResponseAgentPlatform, "1")
+
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected a %d response, found: %d with empty edge ID", http.StatusOK, rec.Code)
+	}
+
+	updatedEndpoint, err := handler.DataStore.Endpoint().Endpoint(endpoint.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	assert.Equal(t, updatedEndpoint.EdgeID, edgeId)
+}
+
+func TestEdgeStackStatus(t *testing.T) {
+	t.Parallel()
+	handler := mustSetupHandler(t)
+
+	endpointID := portainer.EndpointID(7)
+	endpoint := portainer.Endpoint{
+		ID:              endpointID,
+		Name:            "test-endpoint-7",
+		Type:            portainer.EdgeAgentOnDockerEnvironment,
+		URL:             "https://portainer.io:9443",
+		EdgeID:          "edge-id",
+		LastCheckInDate: time.Now().Unix(),
+	}
+
+	edgeStackID := portainer.EdgeStackID(17)
+	edgeStack := portainer.EdgeStack{
+		ID:             edgeStackID,
+		Name:           "test-edge-stack-17",
+		CreationDate:   time.Now().Unix(),
+		EdgeGroups:     []portainer.EdgeGroupID{1, 2},
+		ProjectPath:    "/project/path",
+		EntryPoint:     "entrypoint",
+		Version:        237,
+		ManifestPath:   "/manifest/path",
+		DeploymentType: 1,
+	}
+
+	endpointRelation := portainer.EndpointRelation{
+		EndpointID: endpoint.ID,
+		EdgeStacks: map[portainer.EdgeStackID]bool{
+			edgeStack.ID: true,
+		},
+	}
+
+	err := handler.DataStore.EdgeStack().Create(edgeStack.ID, &edgeStack)
+	require.NoError(t, err)
+
+	if err := createEndpoint(handler, endpoint, endpointRelation); err != nil {
+		t.Fatal(err)
+	}
+
+	req, err := http.NewRequest(http.MethodGet, fmt.Sprintf("/api/endpoints/%d/edge/status", endpoint.ID), nil)
+	if err != nil {
+		t.Fatal("request error:", err)
+	}
+
+	req.Header.Set(portainer.PortainerAgentEdgeIDHeader, "edge-id")
+	req.Header.Set(portainer.HTTPResponseAgentPlatform, "1")
+
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected a %d response, found: %d", http.StatusOK, rec.Code)
+	}
+
+	var data endpointEdgeStatusInspectResponse
+	if err := json.NewDecoder(rec.Body).Decode(&data); err != nil {
+		t.Fatal("error decoding response:", err)
+	}
+
+	assert.Len(t, data.Stacks, 1)
+	assert.Equal(t, edgeStack.ID, data.Stacks[0].ID)
+	assert.Equal(t, edgeStack.Version, data.Stacks[0].Version)
+}
+
+func TestEdgeJobsResponse(t *testing.T) {
+	t.Parallel()
+	handler := mustSetupHandler(t)
+
+	localCreateEndpoint := func(endpointID portainer.EndpointID, tagIDs []portainer.TagID) *portainer.Endpoint {
+		endpoint := portainer.Endpoint{
+			ID:              endpointID,
+			Name:            "test-endpoint-" + strconv.Itoa(int(endpointID)),
+			Type:            portainer.EdgeAgentOnDockerEnvironment,
+			URL:             "https://portainer.io:9443",
+			EdgeID:          "edge-id-" + strconv.Itoa(int(endpointID)),
+			TagIDs:          tagIDs,
+			LastCheckInDate: time.Now().Unix(),
+			UserTrusted:     true,
+		}
+		err := createEndpoint(handler, endpoint,
+			portainer.EndpointRelation{EndpointID: endpointID})
+		require.NoError(t, err)
+
+		return &endpoint
+	}
+
+	dynamicGroupTags := []portainer.TagID{1, 2, 3}
+
+	endpoint := localCreateEndpoint(77, nil)
+	endpointFromStaticEdgeGroup := localCreateEndpoint(78, nil)
+	endpointFromDynamicEdgeGroup := localCreateEndpoint(79, dynamicGroupTags)
+	unrelatedEndpoint := localCreateEndpoint(80, nil)
+
+	staticEdgeGroup := portainer.EdgeGroup{
+		ID:          1,
+		EndpointIDs: roar.FromSlice([]portainer.EndpointID{endpointFromStaticEdgeGroup.ID}),
+	}
+	err := handler.DataStore.EdgeGroup().Create(&staticEdgeGroup)
+	require.NoError(t, err)
+
+	dynamicEdgeGroup := portainer.EdgeGroup{
+		ID:      2,
+		Dynamic: true,
+		TagIDs:  dynamicGroupTags,
+	}
+	err = handler.DataStore.EdgeGroup().Create(&dynamicEdgeGroup)
+	require.NoError(t, err)
+
+	path, err := handler.FileService.StoreEdgeJobFileFromBytes("test-script", []byte("pwd"))
+	require.NoError(t, err)
+
+	edgeJobID := portainer.EdgeJobID(35)
+	edgeJob := portainer.EdgeJob{
+		ID:             edgeJobID,
+		Created:        time.Now().Unix(),
+		CronExpression: "* * * * *",
+		Name:           "test-edge-job",
+		ScriptPath:     path,
+		Recurring:      true,
+		Version:        57,
+		Endpoints: map[portainer.EndpointID]portainer.EdgeJobEndpointMeta{
+			endpoint.ID: {},
+		},
+		EdgeGroups: []portainer.EdgeGroupID{staticEdgeGroup.ID, dynamicEdgeGroup.ID},
+	}
+
+	err = handler.DataStore.EdgeJob().Create(&edgeJob)
+	require.NoError(t, err)
+
+	f := func(endpoint *portainer.Endpoint, scheduleLen int) {
+		req, err := http.NewRequest(http.MethodGet, fmt.Sprintf("/api/endpoints/%d/edge/status", endpoint.ID), nil)
+		require.NoError(t, err)
+
+		req.Header.Set(portainer.PortainerAgentEdgeIDHeader, endpoint.EdgeID)
+		req.Header.Set(portainer.HTTPResponseAgentPlatform, "1")
+
+		rec := httptest.NewRecorder()
+		handler.ServeHTTP(rec, req)
+
+		require.Equal(t, http.StatusOK, rec.Code)
+
+		var data endpointEdgeStatusInspectResponse
+		err = json.NewDecoder(rec.Body).Decode(&data)
+		require.NoError(t, err)
+
+		require.Len(t, data.Schedules, scheduleLen)
+
+		if scheduleLen > 0 {
+			require.Equal(t, edgeJob.ID, data.Schedules[0].ID)
+			require.Equal(t, edgeJob.CronExpression, data.Schedules[0].CronExpression)
+			require.Equal(t, edgeJob.Version, data.Schedules[0].Version)
+		}
+	}
+
+	f(endpoint, 1)
+	f(endpointFromStaticEdgeGroup, 1)
+	f(endpointFromDynamicEdgeGroup, 1)
+	f(unrelatedEndpoint, 0)
+}
diff --git a/api/http/handler/endpointedge/handler.go b/api/http/handler/endpointedge/handler.go
new file mode 100644
index 0000000..626217c
--- /dev/null
+++ b/api/http/handler/endpointedge/handler.go
@@ -0,0 +1,46 @@
+package endpointedge
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/middlewares"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+
+	"github.com/gorilla/mux"
+)
+
+// Handler is the HTTP handler used to handle edge environment(endpoint) operations.
+type Handler struct {
+	*mux.Router
+	requestBouncer       security.BouncerService
+	DataStore            dataservices.DataStore
+	FileService          portainer.FileService
+	ReverseTunnelService portainer.ReverseTunnelService
+}
+
+// NewHandler creates a handler to manage environment(endpoint) operations.
+func NewHandler(bouncer security.BouncerService, dataStore dataservices.DataStore, fileService portainer.FileService, reverseTunnelService portainer.ReverseTunnelService) *Handler {
+	h := &Handler{
+		Router:               mux.NewRouter(),
+		requestBouncer:       bouncer,
+		DataStore:            dataStore,
+		FileService:          fileService,
+		ReverseTunnelService: reverseTunnelService,
+	}
+
+	h.Handle("/api/endpoints/{id}/edge/status", bouncer.PublicAccess(httperror.LoggerHandler(h.endpointEdgeStatusInspect))).Methods(http.MethodGet)
+
+	endpointRouter := h.PathPrefix("/api/endpoints/{id}").Subrouter()
+	endpointRouter.Use(middlewares.WithEndpoint(dataStore.Endpoint(), "id"))
+
+	endpointRouter.PathPrefix("/edge/stacks/{stackId}").Handler(
+		bouncer.PublicAccess(httperror.LoggerHandler(h.endpointEdgeStackInspect))).Methods(http.MethodGet)
+
+	endpointRouter.PathPrefix("/edge/jobs/{jobID}/logs").Handler(
+		bouncer.PublicAccess(httperror.LoggerHandler(h.endpointEdgeJobsLogs))).Methods(http.MethodPost)
+
+	return h
+}
diff --git a/api/http/handler/endpointgroups/endpointgroup_create.go b/api/http/handler/endpointgroups/endpointgroup_create.go
new file mode 100644
index 0000000..59f00ab
--- /dev/null
+++ b/api/http/handler/endpointgroups/endpointgroup_create.go
@@ -0,0 +1,120 @@
+package endpointgroups
+
+import (
+	"errors"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type endpointGroupCreatePayload struct {
+	// Environment(Endpoint) group name
+	Name string `validate:"required" example:"my-environment-group"`
+	// Environment(Endpoint) group description
+	Description string `example:"description"`
+	// List of environment(endpoint) identifiers that will be part of this group
+	AssociatedEndpoints []portainer.EndpointID `example:"1,3"`
+	// List of tag identifiers to which this environment(endpoint) group is associated
+	TagIDs []portainer.TagID `example:"1,2"`
+}
+
+func (payload *endpointGroupCreatePayload) Validate(r *http.Request) error {
+	if len(payload.Name) == 0 {
+		return errors.New("invalid environment group name")
+	}
+
+	if payload.TagIDs == nil {
+		payload.TagIDs = []portainer.TagID{}
+	}
+
+	return nil
+}
+
+// @summary Create an Environment(Endpoint) Group
+// @description Create a new environment(endpoint) group.
+// @description **Access policy**: administrator
+// @tags endpoint_groups
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @produce json
+// @param body body endpointGroupCreatePayload true "Environment(Endpoint) Group details"
+// @success 200 {object} portainer.EndpointGroup "Success"
+// @failure 400 "Invalid request"
+// @failure 500 "Server error"
+// @router /endpoint_groups [post]
+func (handler *Handler) endpointGroupCreate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	var payload endpointGroupCreatePayload
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	var endpointGroup *portainer.EndpointGroup
+	var err error
+	err = handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		endpointGroup, err = handler.createEndpointGroup(tx, payload)
+		return err
+	})
+
+	return response.TxResponse(w, endpointGroup, err)
+}
+
+func (handler *Handler) createEndpointGroup(tx dataservices.DataStoreTx, payload endpointGroupCreatePayload) (*portainer.EndpointGroup, error) {
+	endpointGroup := &portainer.EndpointGroup{
+		Name:               payload.Name,
+		Description:        payload.Description,
+		UserAccessPolicies: portainer.UserAccessPolicies{},
+		TeamAccessPolicies: portainer.TeamAccessPolicies{},
+		TagIDs:             payload.TagIDs,
+	}
+
+	err := tx.EndpointGroup().Create(endpointGroup)
+	if err != nil {
+		return nil, httperror.InternalServerError("Unable to persist the environment group inside the database", err)
+	}
+
+	endpoints, err := tx.Endpoint().Endpoints()
+	if err != nil {
+		return nil, httperror.InternalServerError("Unable to retrieve environments from the database", err)
+	}
+
+	for _, id := range payload.AssociatedEndpoints {
+		for _, endpoint := range endpoints {
+			if endpoint.ID == id {
+				endpoint.GroupID = endpointGroup.ID
+
+				err := tx.Endpoint().UpdateEndpoint(endpoint.ID, &endpoint)
+				if err != nil {
+					return nil, httperror.InternalServerError("Unable to update environment", err)
+				}
+
+				err = handler.updateEndpointRelations(tx, &endpoint, endpointGroup)
+				if err != nil {
+					return nil, httperror.InternalServerError("Unable to persist environment relations changes inside the database", err)
+				}
+
+				break
+			}
+		}
+	}
+
+	for _, tagID := range endpointGroup.TagIDs {
+		tag, err := tx.Tag().Read(tagID)
+		if err != nil {
+			return nil, httperror.InternalServerError("Unable to find a tag inside the database", err)
+		}
+
+		tag.EndpointGroups[endpointGroup.ID] = true
+
+		err = tx.Tag().Update(tagID, tag)
+		if err != nil {
+			return nil, httperror.InternalServerError("Unable to persist tag changes inside the database", err)
+		}
+	}
+
+	return endpointGroup, nil
+}
diff --git a/api/http/handler/endpointgroups/endpointgroup_delete.go b/api/http/handler/endpointgroups/endpointgroup_delete.go
new file mode 100644
index 0000000..9d6cddf
--- /dev/null
+++ b/api/http/handler/endpointgroups/endpointgroup_delete.go
@@ -0,0 +1,90 @@
+package endpointgroups
+
+import (
+	"errors"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id EndpointGroupDelete
+// @summary Remove an environment(endpoint) group
+// @description Remove an environment(endpoint) group.
+// @description **Access policy**: administrator
+// @tags endpoint_groups
+// @security ApiKeyAuth
+// @security jwt
+// @param id path int true "EndpointGroup identifier"
+// @success 204 "Success"
+// @failure 400 "Invalid request"
+// @failure 404 "EndpointGroup not found"
+// @failure 500 "Server error"
+// @router /endpoint_groups/{id} [delete]
+func (handler *Handler) endpointGroupDelete(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	endpointGroupID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid environment group identifier route variable", err)
+	}
+
+	if endpointGroupID == 1 {
+		return httperror.Forbidden("Unable to remove the default 'Unassigned' group", errors.New("Cannot remove the default environment group"))
+	}
+
+	err = handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return handler.deleteEndpointGroup(tx, portainer.EndpointGroupID(endpointGroupID))
+	})
+
+	return response.TxEmptyResponse(w, err)
+}
+
+func (handler *Handler) deleteEndpointGroup(tx dataservices.DataStoreTx, endpointGroupID portainer.EndpointGroupID) error {
+	endpointGroup, err := tx.EndpointGroup().Read(endpointGroupID)
+	if tx.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find an environment group with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find an environment group with the specified identifier inside the database", err)
+	}
+
+	if err := tx.EndpointGroup().Delete(endpointGroupID); err != nil {
+		return httperror.InternalServerError("Unable to remove the environment group from the database", err)
+	}
+
+	endpoints, err := tx.Endpoint().Endpoints()
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve environment from the database", err)
+	}
+
+	for _, endpoint := range endpoints {
+		if endpoint.GroupID != endpointGroupID {
+			continue
+		}
+
+		endpoint.GroupID = portainer.EndpointGroupID(1)
+		if err := tx.Endpoint().UpdateEndpoint(endpoint.ID, &endpoint); err != nil {
+			return httperror.InternalServerError("Unable to update environment", err)
+		}
+
+		if err := handler.updateEndpointRelations(tx, &endpoint, nil); err != nil {
+			return httperror.InternalServerError("Unable to persist environment relations changes inside the database", err)
+		}
+	}
+
+	for _, tagID := range endpointGroup.TagIDs {
+		tag, err := tx.Tag().Read(tagID)
+		if err != nil {
+			return httperror.InternalServerError("Unable to find a tag inside the database", err)
+		}
+
+		delete(tag.EndpointGroups, endpointGroup.ID)
+
+		if err := tx.Tag().Update(tagID, tag); err != nil {
+			return httperror.InternalServerError("Unable to persist tag changes inside the database", err)
+		}
+	}
+
+	return nil
+}
diff --git a/api/http/handler/endpointgroups/endpointgroup_endpoint_add.go b/api/http/handler/endpointgroups/endpointgroup_endpoint_add.go
new file mode 100644
index 0000000..ba66564
--- /dev/null
+++ b/api/http/handler/endpointgroups/endpointgroup_endpoint_add.go
@@ -0,0 +1,73 @@
+package endpointgroups
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id EndpointGroupAddEndpoint
+// @summary Add an environment(endpoint) to an environment(endpoint) group
+// @description Add an environment(endpoint) to an environment(endpoint) group
+// @description **Access policy**: administrator
+// @tags endpoint_groups
+// @security ApiKeyAuth
+// @security jwt
+// @param id path int true "EndpointGroup identifier"
+// @param endpointId path int true "Environment(Endpoint) identifier"
+// @success 204 "Success"
+// @failure 400 "Invalid request"
+// @failure 404 "EndpointGroup not found"
+// @failure 500 "Server error"
+// @router /endpoint_groups/{id}/endpoints/{endpointId} [put]
+func (handler *Handler) endpointGroupAddEndpoint(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	endpointGroupID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid environment group identifier route variable", err)
+	}
+
+	endpointID, err := request.RetrieveNumericRouteVariableValue(r, "endpointId")
+	if err != nil {
+		return httperror.BadRequest("Invalid environment identifier route variable", err)
+	}
+
+	err = handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return handler.addEndpoint(tx, portainer.EndpointGroupID(endpointGroupID), portainer.EndpointID(endpointID))
+	})
+
+	return response.TxEmptyResponse(w, err)
+}
+
+func (handler *Handler) addEndpoint(tx dataservices.DataStoreTx, endpointGroupID portainer.EndpointGroupID, endpointID portainer.EndpointID) error {
+	endpointGroup, err := tx.EndpointGroup().Read(endpointGroupID)
+	if tx.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find an environment group with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find an environment group with the specified identifier inside the database", err)
+	}
+
+	endpoint, err := tx.Endpoint().Endpoint(endpointID)
+	if tx.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find an environment with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find an environment with the specified identifier inside the database", err)
+	}
+
+	endpoint.GroupID = endpointGroup.ID
+
+	err = tx.Endpoint().UpdateEndpoint(endpoint.ID, endpoint)
+	if err != nil {
+		return httperror.InternalServerError("Unable to persist environment changes inside the database", err)
+	}
+
+	err = handler.updateEndpointRelations(tx, endpoint, endpointGroup)
+	if err != nil {
+		return httperror.InternalServerError("Unable to persist environment relations changes inside the database", err)
+	}
+
+	return nil
+}
diff --git a/api/http/handler/endpointgroups/endpointgroup_endpoint_delete.go b/api/http/handler/endpointgroups/endpointgroup_endpoint_delete.go
new file mode 100644
index 0000000..3ec4e65
--- /dev/null
+++ b/api/http/handler/endpointgroups/endpointgroup_endpoint_delete.go
@@ -0,0 +1,73 @@
+package endpointgroups
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	dserrors "github.com/portainer/portainer/api/dataservices/errors"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id EndpointGroupDeleteEndpoint
+// @summary Removes environment(endpoint) from an environment(endpoint) group
+// @description **Access policy**: administrator
+// @tags endpoint_groups
+// @security ApiKeyAuth
+// @security jwt
+// @param id path int true "EndpointGroup identifier"
+// @param endpointId path int true "Environment(Endpoint) identifier"
+// @success 204 "Success"
+// @failure 400 "Invalid request"
+// @failure 404 "EndpointGroup not found"
+// @failure 500 "Server error"
+// @router /endpoint_groups/{id}/endpoints/{endpointId} [delete]
+func (handler *Handler) endpointGroupDeleteEndpoint(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	endpointGroupID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid environment group identifier route variable", err)
+	}
+
+	endpointID, err := request.RetrieveNumericRouteVariableValue(r, "endpointId")
+	if err != nil {
+		return httperror.BadRequest("Invalid environment identifier route variable", err)
+	}
+
+	err = handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return handler.removeEndpoint(tx, portainer.EndpointGroupID(endpointGroupID), portainer.EndpointID(endpointID))
+	})
+
+	return response.TxEmptyResponse(w, err)
+}
+
+func (handler *Handler) removeEndpoint(tx dataservices.DataStoreTx, endpointGroupID portainer.EndpointGroupID, endpointID portainer.EndpointID) error {
+	ok, err := tx.EndpointGroup().Exists(endpointGroupID)
+	if !ok {
+		return httperror.NotFound("Unable to find an environment group with the specified identifier inside the database", dserrors.ErrObjectNotFound)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find an environment group with the specified identifier inside the database", err)
+	}
+
+	endpoint, err := tx.Endpoint().Endpoint(endpointID)
+	if tx.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find an environment with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find an environment with the specified identifier inside the database", err)
+	}
+
+	endpoint.GroupID = portainer.EndpointGroupID(1)
+
+	err = tx.Endpoint().UpdateEndpoint(endpoint.ID, endpoint)
+	if err != nil {
+		return httperror.InternalServerError("Unable to persist environment changes inside the database", err)
+	}
+
+	err = handler.updateEndpointRelations(tx, endpoint, nil)
+	if err != nil {
+		return httperror.InternalServerError("Unable to persist environment relations changes inside the database", err)
+	}
+
+	return nil
+}
diff --git a/api/http/handler/endpointgroups/endpointgroup_inspect.go b/api/http/handler/endpointgroups/endpointgroup_inspect.go
new file mode 100644
index 0000000..a9483a4
--- /dev/null
+++ b/api/http/handler/endpointgroups/endpointgroup_inspect.go
@@ -0,0 +1,72 @@
+package endpointgroups
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @summary Inspect an Environment(Endpoint) group
+// @description Retrieve details abont an environment(endpoint) group.
+// @description **Access policy**: administrator
+// @tags endpoint_groups
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @produce json
+// @param id path int true "Environment(Endpoint) group identifier"
+// @param size query boolean false "If true, include the number of environments and breakdown by type"
+// @success 200 {object} EndpointGroupResponse "Success"
+// @failure 400 "Invalid request"
+// @failure 404 "EndpointGroup not found"
+// @failure 500 "Server error"
+// @router /endpoint_groups/{id} [get]
+func (handler *Handler) endpointGroupInspect(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	endpointGroupID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid environment group identifier route variable", err)
+	}
+
+	includeSize, err := request.RetrieveBooleanQueryParameter(r, "size", true)
+	if err != nil {
+		return httperror.BadRequest("Invalid query parameter: size", err)
+	}
+
+	groupID := portainer.EndpointGroupID(endpointGroupID)
+
+	var endpointGroup *portainer.EndpointGroup
+	var endpoints []portainer.Endpoint
+
+	if err := handler.DataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
+		var err error
+		endpointGroup, err = tx.EndpointGroup().Read(groupID)
+		if err != nil {
+			return err
+		}
+		if includeSize {
+			endpoints, err = tx.Endpoint().Endpoints()
+		}
+		return err
+	}); err != nil {
+		if handler.DataStore.IsErrObjectNotFound(err) {
+			return httperror.NotFound("Unable to find an environment group with the specified identifier inside the database", err)
+		}
+		return httperror.InternalServerError("Unable to retrieve environment group details", err)
+	}
+
+	resp := EndpointGroupResponse{
+		EndpointGroup: *endpointGroup,
+	}
+
+	if includeSize {
+		countMap, typeInfoMap := computeGroupSizeInfo([]portainer.EndpointGroup{*endpointGroup}, endpoints)
+		resp.Total = countMap[groupID]
+		resp.TypeInfo = typeInfoMap[groupID]
+	}
+
+	return response.JSON(w, resp)
+}
diff --git a/api/http/handler/endpointgroups/endpointgroup_list.go b/api/http/handler/endpointgroups/endpointgroup_list.go
new file mode 100644
index 0000000..a574905
--- /dev/null
+++ b/api/http/handler/endpointgroups/endpointgroup_list.go
@@ -0,0 +1,152 @@
+package endpointgroups
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/set"
+	endpointutils "github.com/portainer/portainer/pkg/endpoints"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+func computeGroupSizeInfo(endpointGroups []portainer.EndpointGroup, endpoints []portainer.Endpoint) (map[portainer.EndpointGroupID]int, map[portainer.EndpointGroupID]EndpointGroupTypeInfo) {
+	groupSet := set.Set[portainer.EndpointGroupID]{}
+	for i := range endpointGroups {
+		groupSet[endpointGroups[i].ID] = true
+	}
+
+	countMap := make(map[portainer.EndpointGroupID]int)
+	typeInfoMap := make(map[portainer.EndpointGroupID]EndpointGroupTypeInfo)
+
+	for _, endpoint := range endpoints {
+		if _, ok := groupSet[endpoint.GroupID]; !ok {
+			continue
+		}
+		countMap[endpoint.GroupID]++
+
+		typeInfo := typeInfoMap[endpoint.GroupID]
+		if endpointutils.IsKubernetesEndpoint(&endpoint) {
+			typeInfo.Kubernetes++
+		} else if endpoint.ContainerEngine == portainer.ContainerEnginePodman {
+			typeInfo.Podman++
+		} else {
+			typeInfo.Docker++
+		}
+		typeInfoMap[endpoint.GroupID] = typeInfo
+	}
+
+	for groupID, typeInfo := range typeInfoMap {
+		var bits int
+		if typeInfo.Docker > 0 {
+			bits |= 1
+		}
+		if typeInfo.Kubernetes > 0 {
+			bits |= 2
+		}
+		if typeInfo.Podman > 0 {
+			bits |= 4
+		}
+		typeInfo.Mixed = bits&(bits-1) != 0
+		typeInfoMap[groupID] = typeInfo
+	}
+
+	return countMap, typeInfoMap
+}
+
+type EndpointGroupTypeInfo struct {
+	Docker     int  `json:"Docker" validate:"required"`
+	Kubernetes int  `json:"Kubernetes" validate:"required"`
+	Podman     int  `json:"Podman" validate:"required"`
+	Mixed      bool `json:"Mixed" validate:"required"`
+}
+
+type EndpointGroupResponse struct {
+	portainer.EndpointGroup
+	Total    int                   `json:"Total,omitzero"`
+	TypeInfo EndpointGroupTypeInfo `json:"TypeInfo,omitzero"`
+}
+
+// @id EndpointGroupList
+// @summary List Environment(Endpoint) groups
+// @description List all environment(endpoint) groups based on the current user authorizations. Will
+// @description return all environment(endpoint) groups if using an administrator account otherwise it will
+// @description only return authorized environment(endpoint) groups.
+// @description **Access policy**: restricted
+// @tags endpoint_groups
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param size query boolean false "If true, each environment(endpoint) group will include the number of environments(endpoints) associated to it and breakdown by type"
+// @success 200 {array} EndpointGroupResponse "Environment(Endpoint) group"
+// @failure 500 "Server error"
+// @router /endpoint_groups [get]
+func (handler *Handler) endpointGroupList(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	includeSize, err := request.RetrieveBooleanQueryParameter(r, "size", true)
+	if err != nil {
+		return httperror.BadRequest("Invalid query parameter: size", err)
+	}
+
+	var endpoints []portainer.Endpoint
+	var endpointGroups []portainer.EndpointGroup
+	var handlerErr *httperror.HandlerError
+	if err := handler.DataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
+		var txErr error
+		endpointGroups, txErr = handler.DataStore.EndpointGroup().ReadAll()
+		if txErr != nil {
+			handlerErr = httperror.InternalServerError("Unable to retrieve environment groups from the database", txErr)
+			return handlerErr
+		}
+
+		if includeSize {
+			endpoints, txErr = tx.Endpoint().Endpoints()
+			if txErr != nil {
+				handlerErr = httperror.InternalServerError("Unable to retrieve endpoints from the database", txErr)
+				return handlerErr
+			}
+		}
+
+		return nil
+	}); err != nil {
+		if handlerErr != nil {
+			return handlerErr
+		}
+		return httperror.InternalServerError("Unable to retrieve data from the database", err)
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	endpointGroups = security.FilterEndpointGroups(endpointGroups, securityContext)
+
+	if len(endpointGroups) == 0 {
+		return response.JSON(w, []portainer.EndpointGroup{})
+	}
+
+	var endpointGroupCountMap map[portainer.EndpointGroupID]int
+	var endpointGroupTypeInfoMap map[portainer.EndpointGroupID]EndpointGroupTypeInfo
+	if includeSize {
+		endpointGroupCountMap, endpointGroupTypeInfoMap = computeGroupSizeInfo(endpointGroups, endpoints)
+	}
+
+	endpointGroupsResponse := make([]EndpointGroupResponse, len(endpointGroups))
+	for i := range endpointGroups {
+		groupID := endpointGroups[i].ID
+
+		endpointGroupsResponse[i] = EndpointGroupResponse{
+			EndpointGroup: endpointGroups[i],
+		}
+
+		if includeSize {
+			endpointGroupsResponse[i].Total = endpointGroupCountMap[groupID]
+			endpointGroupsResponse[i].TypeInfo = endpointGroupTypeInfoMap[groupID]
+		}
+	}
+
+	return response.JSON(w, endpointGroupsResponse)
+}
diff --git a/api/http/handler/endpointgroups/endpointgroup_list_test.go b/api/http/handler/endpointgroups/endpointgroup_list_test.go
new file mode 100644
index 0000000..46d2e46
--- /dev/null
+++ b/api/http/handler/endpointgroups/endpointgroup_list_test.go
@@ -0,0 +1,205 @@
+package endpointgroups
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestHandler_endpointGroupList(t *testing.T) {
+	_, store := datastore.MustNewTestStore(t, true, false)
+	handler := setUpHandler(t, store)
+
+	groups := setUpGroups(t, store)
+
+	t.Run("with groups, no size flag", func(t *testing.T) {
+		w := httptest.NewRecorder()
+		req := httptest.NewRequest(http.MethodGet, "/endpoint_groups", nil)
+		rrc := &security.RestrictedRequestContext{
+			IsAdmin: true,
+		}
+		req = req.WithContext(security.StoreRestrictedRequestContext(req, rrc))
+
+		handler.ServeHTTP(w, req)
+
+		require.Equal(t, http.StatusOK, w.Code)
+		res := make([]EndpointGroupResponse, 0)
+		require.NoError(t, json.NewDecoder(w.Body).Decode(&res))
+		require.Len(t, res, len(groups)+1, "should contain an additional default group")
+		for _, group := range res {
+			assert.Zero(t, group.Total)
+			assert.Zero(t, group.TypeInfo.Docker)
+			assert.Zero(t, group.TypeInfo.Kubernetes)
+			assert.Zero(t, group.TypeInfo.Podman)
+			assert.False(t, group.TypeInfo.Mixed)
+		}
+	})
+
+	t.Run("with size flag, no endpoints", func(t *testing.T) {
+		w := httptest.NewRecorder()
+		req := httptest.NewRequest(http.MethodGet, "/endpoint_groups?size=true", nil)
+		rrc := &security.RestrictedRequestContext{
+			IsAdmin: true,
+		}
+		req = req.WithContext(security.StoreRestrictedRequestContext(req, rrc))
+
+		handler.ServeHTTP(w, req)
+
+		require.Equal(t, http.StatusOK, w.Code)
+		res := make([]EndpointGroupResponse, 0)
+		require.NoError(t, json.NewDecoder(w.Body).Decode(&res))
+		for _, group := range res {
+			assert.Zero(t, group.Total)
+		}
+	})
+
+	t.Run("with size flag and single docker endpoint", func(t *testing.T) {
+		endpoint := &portainer.Endpoint{
+			ID:      1,
+			GroupID: groups[0].ID,
+			Type:    portainer.DockerEnvironment,
+		}
+		require.NoError(t, store.Endpoint().Create(endpoint))
+		t.Cleanup(func() { _ = store.Endpoint().DeleteEndpoint(endpoint.ID) })
+
+		w := httptest.NewRecorder()
+		req := httptest.NewRequest(http.MethodGet, "/endpoint_groups?size=true", nil)
+		rrc := &security.RestrictedRequestContext{
+			IsAdmin: true,
+		}
+		req = req.WithContext(security.StoreRestrictedRequestContext(req, rrc))
+
+		handler.ServeHTTP(w, req)
+
+		require.Equal(t, http.StatusOK, w.Code)
+		res := make([]EndpointGroupResponse, 0)
+		require.NoError(t, json.NewDecoder(w.Body).Decode(&res))
+
+		var group1 *EndpointGroupResponse
+		for i := range res {
+			if res[i].ID == groups[0].ID {
+				group1 = &res[i]
+				break
+			}
+		}
+		require.NotNil(t, group1)
+		assert.Equal(t, 1, group1.Total)
+		assert.Equal(t, 1, group1.TypeInfo.Docker)
+		assert.Equal(t, 0, group1.TypeInfo.Kubernetes)
+		assert.Equal(t, 0, group1.TypeInfo.Podman)
+		assert.False(t, group1.TypeInfo.Mixed)
+	})
+
+	t.Run("with mixed endpoint types", func(t *testing.T) {
+		dockerEndpoint := &portainer.Endpoint{
+			ID:      2,
+			GroupID: groups[1].ID,
+			Type:    portainer.DockerEnvironment,
+		}
+		require.NoError(t, store.Endpoint().Create(dockerEndpoint))
+		t.Cleanup(func() { _ = store.Endpoint().DeleteEndpoint(dockerEndpoint.ID) })
+
+		k8sEndpoint := &portainer.Endpoint{
+			ID:      3,
+			GroupID: groups[1].ID,
+			Type:    portainer.KubernetesLocalEnvironment,
+		}
+		require.NoError(t, store.Endpoint().Create(k8sEndpoint))
+		t.Cleanup(func() { _ = store.Endpoint().DeleteEndpoint(k8sEndpoint.ID) })
+
+		w := httptest.NewRecorder()
+		req := httptest.NewRequest(http.MethodGet, "/endpoint_groups?size=true", nil)
+		rrc := &security.RestrictedRequestContext{
+			IsAdmin: true,
+		}
+		req = req.WithContext(security.StoreRestrictedRequestContext(req, rrc))
+
+		handler.ServeHTTP(w, req)
+
+		require.Equal(t, http.StatusOK, w.Code)
+		res := make([]EndpointGroupResponse, 0)
+		require.NoError(t, json.NewDecoder(w.Body).Decode(&res))
+
+		var group2 *EndpointGroupResponse
+		for i := range res {
+			if res[i].ID == groups[1].ID {
+				group2 = &res[i]
+				break
+			}
+		}
+		require.NotNil(t, group2)
+		assert.Equal(t, 2, group2.Total)
+		assert.Equal(t, 1, group2.TypeInfo.Docker)
+		assert.Equal(t, 1, group2.TypeInfo.Kubernetes)
+		assert.Equal(t, 0, group2.TypeInfo.Podman)
+		assert.True(t, group2.TypeInfo.Mixed, "should be marked as mixed when multiple types exist")
+	})
+
+	t.Run("with podman endpoint", func(t *testing.T) {
+		dockerEndpoint := &portainer.Endpoint{
+			ID:      4,
+			GroupID: groups[0].ID,
+			Type:    portainer.DockerEnvironment,
+		}
+		require.NoError(t, store.Endpoint().Create(dockerEndpoint))
+		t.Cleanup(func() { _ = store.Endpoint().DeleteEndpoint(dockerEndpoint.ID) })
+
+		podmanEndpoint := &portainer.Endpoint{
+			ID:              5,
+			GroupID:         groups[0].ID,
+			Type:            portainer.DockerEnvironment,
+			ContainerEngine: portainer.ContainerEnginePodman,
+		}
+		require.NoError(t, store.Endpoint().Create(podmanEndpoint))
+		t.Cleanup(func() { _ = store.Endpoint().DeleteEndpoint(podmanEndpoint.ID) })
+
+		w := httptest.NewRecorder()
+		req := httptest.NewRequest(http.MethodGet, "/endpoint_groups?size=true", nil)
+		rrc := &security.RestrictedRequestContext{
+			IsAdmin: true,
+		}
+		req = req.WithContext(security.StoreRestrictedRequestContext(req, rrc))
+
+		handler.ServeHTTP(w, req)
+
+		require.Equal(t, http.StatusOK, w.Code)
+		res := make([]EndpointGroupResponse, 0)
+		require.NoError(t, json.NewDecoder(w.Body).Decode(&res))
+
+		var group1 *EndpointGroupResponse
+		for i := range res {
+			if res[i].ID == groups[0].ID {
+				group1 = &res[i]
+				break
+			}
+		}
+		require.NotNil(t, group1)
+		assert.Equal(t, 2, group1.Total)
+		assert.Equal(t, 1, group1.TypeInfo.Docker)
+		assert.Equal(t, 0, group1.TypeInfo.Kubernetes)
+		assert.Equal(t, 1, group1.TypeInfo.Podman)
+		assert.True(t, group1.TypeInfo.Mixed)
+	})
+}
+
+func setUpGroups(t *testing.T, store *datastore.Store) []portainer.EndpointGroup {
+	group1 := &portainer.EndpointGroup{
+		ID:   1,
+		Name: "Group 1",
+	}
+	group2 := &portainer.EndpointGroup{
+		ID:   2,
+		Name: "Group 2",
+	}
+	require.NoError(t, store.EndpointGroup().Create(group1))
+	require.NoError(t, store.EndpointGroup().Create(group2))
+
+	return []portainer.EndpointGroup{*group1, *group2}
+}
diff --git a/api/http/handler/endpointgroups/endpointgroup_update.go b/api/http/handler/endpointgroups/endpointgroup_update.go
new file mode 100644
index 0000000..344980e
--- /dev/null
+++ b/api/http/handler/endpointgroups/endpointgroup_update.go
@@ -0,0 +1,224 @@
+package endpointgroups
+
+import (
+	"net/http"
+	"reflect"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+	"github.com/portainer/portainer/api/pendingactions/handlers"
+	"github.com/portainer/portainer/api/tag"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+
+	"github.com/rs/zerolog/log"
+)
+
+type endpointGroupUpdatePayload struct {
+	// Environment(Endpoint) group name
+	Name string `example:"my-environment-group"`
+	// Environment(Endpoint) group description
+	Description *string `example:"description"`
+	// List of environment(endpoint) identifiers that will be part of this group
+	AssociatedEndpoints []portainer.EndpointID `example:"1,3"`
+	// List of tag identifiers associated to the environment(endpoint) group
+	TagIDs             []portainer.TagID `example:"3,4"`
+	UserAccessPolicies portainer.UserAccessPolicies
+	TeamAccessPolicies portainer.TeamAccessPolicies
+}
+
+func (payload *endpointGroupUpdatePayload) Validate(r *http.Request) error {
+	return nil
+}
+
+// @id EndpointGroupUpdate
+// @summary Update an environment(endpoint) group
+// @description Update an environment(endpoint) group.
+// @description **Access policy**: administrator
+// @tags endpoint_groups
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @produce json
+// @param id path int true "EndpointGroup identifier"
+// @param body body endpointGroupUpdatePayload true "EndpointGroup details"
+// @success 200 {object} portainer.EndpointGroup "Success"
+// @failure 400 "Invalid request"
+// @failure 404 "EndpointGroup not found"
+// @failure 500 "Server error"
+// @router /endpoint_groups/{id} [put]
+func (handler *Handler) endpointGroupUpdate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	endpointGroupID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid environment group identifier route variable", err)
+	}
+
+	var payload endpointGroupUpdatePayload
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	var endpointGroup *portainer.EndpointGroup
+
+	err = handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		endpointGroup, err = handler.updateEndpointGroup(tx, portainer.EndpointGroupID(endpointGroupID), payload)
+		return err
+	})
+
+	return response.TxResponse(w, endpointGroup, err)
+}
+
+func (handler *Handler) updateEndpointGroup(tx dataservices.DataStoreTx, endpointGroupID portainer.EndpointGroupID, payload endpointGroupUpdatePayload) (*portainer.EndpointGroup, error) {
+	endpointGroup, err := tx.EndpointGroup().Read(endpointGroupID)
+	if tx.IsErrObjectNotFound(err) {
+		return nil, httperror.NotFound("Unable to find an environment group with the specified identifier inside the database", err)
+	} else if err != nil {
+		return nil, httperror.InternalServerError("Unable to find an environment group with the specified identifier inside the database", err)
+	}
+
+	if payload.Name != "" {
+		endpointGroup.Name = payload.Name
+	}
+
+	if payload.Description != nil {
+		endpointGroup.Description = *payload.Description
+	}
+
+	tagsChanged := false
+	if payload.TagIDs != nil {
+		payloadTagSet := tag.Set(payload.TagIDs)
+		endpointGroupTagSet := tag.Set((endpointGroup.TagIDs))
+		union := tag.Union(payloadTagSet, endpointGroupTagSet)
+		intersection := tag.IntersectionCount(payloadTagSet, endpointGroupTagSet)
+		tagsChanged = len(union) > intersection
+
+		if tagsChanged {
+			removeTags := tag.Difference(endpointGroupTagSet, payloadTagSet)
+
+			for tagID := range removeTags {
+				tag, err := tx.Tag().Read(tagID)
+				if err != nil {
+					return nil, httperror.InternalServerError("Unable to find a tag inside the database", err)
+				}
+
+				delete(tag.EndpointGroups, endpointGroup.ID)
+
+				err = tx.Tag().Update(tagID, tag)
+				if err != nil {
+					return nil, httperror.InternalServerError("Unable to persist tag changes inside the database", err)
+				}
+			}
+
+			endpointGroup.TagIDs = payload.TagIDs
+			for _, tagID := range payload.TagIDs {
+				tag, err := tx.Tag().Read(tagID)
+				if err != nil {
+					return nil, httperror.InternalServerError("Unable to find a tag inside the database", err)
+				}
+
+				tag.EndpointGroups[endpointGroup.ID] = true
+
+				err = tx.Tag().Update(tagID, tag)
+				if err != nil {
+					return nil, httperror.InternalServerError("Unable to persist tag changes inside the database", err)
+				}
+			}
+		}
+	}
+
+	updateAuthorizations := false
+	if payload.UserAccessPolicies != nil && !reflect.DeepEqual(payload.UserAccessPolicies, endpointGroup.UserAccessPolicies) {
+		endpointGroup.UserAccessPolicies = payload.UserAccessPolicies
+		updateAuthorizations = true
+	}
+
+	if payload.TeamAccessPolicies != nil && !reflect.DeepEqual(payload.TeamAccessPolicies, endpointGroup.TeamAccessPolicies) {
+		endpointGroup.TeamAccessPolicies = payload.TeamAccessPolicies
+		updateAuthorizations = true
+	}
+
+	if updateAuthorizations {
+		endpoints, err := tx.Endpoint().Endpoints()
+		if err != nil {
+			return nil, httperror.InternalServerError("Unable to retrieve environments from the database", err)
+		}
+
+		for _, endpoint := range endpoints {
+			if endpoint.GroupID == endpointGroup.ID && endpointutils.IsKubernetesEndpoint(&endpoint) {
+				if err := handler.AuthorizationService.CleanNAPWithOverridePolicies(tx, &endpoint, endpointGroup); err != nil {
+					// Update flag with endpoint and continue
+					if err := handler.PendingActionsService.Create(tx, handlers.NewCleanNAPWithOverridePolicies(endpoint.ID, &endpointGroup.ID)); err != nil {
+						log.Error().Err(err).Msgf("Unable to create pending action to clean NAP with override policies for endpoint (%d) and endpoint group (%d).", endpoint.ID, endpointGroup.ID)
+					}
+				}
+			}
+		}
+	}
+
+	if err := tx.EndpointGroup().Update(endpointGroup.ID, endpointGroup); err != nil {
+		return nil, httperror.InternalServerError("Unable to persist environment group changes inside the database", err)
+	}
+
+	// Handle associated endpoints updates
+	endpointsChanged := false
+	if payload.AssociatedEndpoints != nil {
+		endpoints, err := tx.Endpoint().Endpoints()
+		if err != nil {
+			return nil, httperror.InternalServerError("Unable to retrieve environments from the database", err)
+		}
+
+		// Build a set of the new endpoint IDs for quick lookup
+		newEndpointSet := make(map[portainer.EndpointID]bool)
+		for _, id := range payload.AssociatedEndpoints {
+			newEndpointSet[id] = true
+		}
+
+		for i := range endpoints {
+			endpoint := &endpoints[i]
+			wasInGroup := endpoint.GroupID == endpointGroup.ID
+			shouldBeInGroup := newEndpointSet[endpoint.ID]
+
+			if wasInGroup && !shouldBeInGroup {
+				// Remove from group (move to Unassigned)
+				endpoint.GroupID = portainer.EndpointGroupID(1)
+				if err := tx.Endpoint().UpdateEndpoint(endpoint.ID, endpoint); err != nil {
+					return nil, httperror.InternalServerError("Unable to update environment", err)
+				}
+				if err := handler.updateEndpointRelations(tx, endpoint, nil); err != nil {
+					return nil, httperror.InternalServerError("Unable to persist environment relations changes inside the database", err)
+				}
+				endpointsChanged = true
+			} else if !wasInGroup && shouldBeInGroup {
+				// Add to group
+				endpoint.GroupID = endpointGroup.ID
+				if err := tx.Endpoint().UpdateEndpoint(endpoint.ID, endpoint); err != nil {
+					return nil, httperror.InternalServerError("Unable to update environment", err)
+				}
+				if err := handler.updateEndpointRelations(tx, endpoint, endpointGroup); err != nil {
+					return nil, httperror.InternalServerError("Unable to persist environment relations changes inside the database", err)
+				}
+				endpointsChanged = true
+			}
+		}
+	}
+
+	// Reconcile endpoints in the group if tags changed (but endpoints weren't already reconciled)
+	if tagsChanged && !endpointsChanged {
+		endpoints, err := tx.Endpoint().Endpoints()
+		if err != nil {
+			return nil, httperror.InternalServerError("Unable to retrieve environments from the database", err)
+		}
+
+		for _, endpoint := range endpoints {
+			if endpoint.GroupID == endpointGroup.ID {
+				if err := handler.updateEndpointRelations(tx, &endpoint, endpointGroup); err != nil {
+					return nil, httperror.InternalServerError("Unable to persist environment relations changes inside the database", err)
+				}
+			}
+		}
+	}
+
+	return endpointGroup, nil
+}
diff --git a/api/http/handler/endpointgroups/endpoints.go b/api/http/handler/endpointgroups/endpoints.go
new file mode 100644
index 0000000..8b420f2
--- /dev/null
+++ b/api/http/handler/endpointgroups/endpoints.go
@@ -0,0 +1,49 @@
+package endpointgroups
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/internal/edge"
+)
+
+func (handler *Handler) updateEndpointRelations(tx dataservices.DataStoreTx, endpoint *portainer.Endpoint, endpointGroup *portainer.EndpointGroup) error {
+	if endpoint.Type != portainer.EdgeAgentOnKubernetesEnvironment && endpoint.Type != portainer.EdgeAgentOnDockerEnvironment {
+		return nil
+	}
+
+	if endpointGroup == nil {
+		unassignedGroup, err := tx.EndpointGroup().Read(portainer.EndpointGroupID(1))
+		if err != nil {
+			return err
+		}
+
+		endpointGroup = unassignedGroup
+	}
+
+	endpointRelation, err := tx.EndpointRelation().EndpointRelation(endpoint.ID)
+	if err != nil {
+		return err
+	}
+
+	edgeGroups, err := tx.EdgeGroup().ReadAll()
+	if err != nil {
+		return err
+	}
+
+	edgeStacks, err := tx.EdgeStack().EdgeStacks()
+	if err != nil {
+		if tx.IsErrObjectNotFound(err) {
+			return nil
+		}
+		return err
+	}
+
+	endpointStacks := edge.EndpointRelatedEdgeStacks(endpoint, endpointGroup, edgeGroups, edgeStacks)
+	stacksSet := map[portainer.EdgeStackID]bool{}
+	for _, edgeStackID := range endpointStacks {
+		stacksSet[edgeStackID] = true
+	}
+	endpointRelation.EdgeStacks = stacksSet
+
+	return tx.EndpointRelation().UpdateEndpointRelation(endpoint.ID, endpointRelation)
+}
diff --git a/api/http/handler/endpointgroups/handler.go b/api/http/handler/endpointgroups/handler.go
new file mode 100644
index 0000000..6fe912d
--- /dev/null
+++ b/api/http/handler/endpointgroups/handler.go
@@ -0,0 +1,43 @@
+package endpointgroups
+
+import (
+	"net/http"
+
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/pendingactions"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+
+	"github.com/gorilla/mux"
+)
+
+// Handler is the HTTP handler used to handle environment(endpoint) group operations.
+type Handler struct {
+	*mux.Router
+	AuthorizationService  *authorization.Service
+	DataStore             dataservices.DataStore
+	PendingActionsService *pendingactions.PendingActionsService
+}
+
+// NewHandler creates a handler to manage environment(endpoint) group operations.
+func NewHandler(bouncer security.BouncerService) *Handler {
+	h := &Handler{
+		Router: mux.NewRouter(),
+	}
+	h.Handle("/endpoint_groups",
+		bouncer.AdminAccess(httperror.LoggerHandler(h.endpointGroupCreate))).Methods(http.MethodPost)
+	h.Handle("/endpoint_groups",
+		bouncer.RestrictedAccess(httperror.LoggerHandler(h.endpointGroupList))).Methods(http.MethodGet)
+	h.Handle("/endpoint_groups/{id}",
+		bouncer.AdminAccess(httperror.LoggerHandler(h.endpointGroupInspect))).Methods(http.MethodGet)
+	h.Handle("/endpoint_groups/{id}",
+		bouncer.AdminAccess(httperror.LoggerHandler(h.endpointGroupUpdate))).Methods(http.MethodPut)
+	h.Handle("/endpoint_groups/{id}",
+		bouncer.AdminAccess(httperror.LoggerHandler(h.endpointGroupDelete))).Methods(http.MethodDelete)
+	h.Handle("/endpoint_groups/{id}/endpoints/{endpointId}",
+		bouncer.AdminAccess(httperror.LoggerHandler(h.endpointGroupAddEndpoint))).Methods(http.MethodPut)
+	h.Handle("/endpoint_groups/{id}/endpoints/{endpointId}",
+		bouncer.AdminAccess(httperror.LoggerHandler(h.endpointGroupDeleteEndpoint))).Methods(http.MethodDelete)
+	return h
+}
diff --git a/api/http/handler/endpointgroups/handler_test.go b/api/http/handler/endpointgroups/handler_test.go
new file mode 100644
index 0000000..e24873b
--- /dev/null
+++ b/api/http/handler/endpointgroups/handler_test.go
@@ -0,0 +1,15 @@
+package endpointgroups
+
+import (
+	"testing"
+
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+)
+
+func setUpHandler(t *testing.T, store *datastore.Store) *Handler {
+	t.Helper()
+	handler := NewHandler(testhelpers.NewTestRequestBouncer())
+	handler.DataStore = store
+	return handler
+}
diff --git a/api/http/handler/endpointproxy/handler.go b/api/http/handler/endpointproxy/handler.go
new file mode 100644
index 0000000..64f8654
--- /dev/null
+++ b/api/http/handler/endpointproxy/handler.go
@@ -0,0 +1,39 @@
+package endpointproxy
+
+import (
+	"github.com/gorilla/mux"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/proxy"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+)
+
+// Handler is the HTTP handler used to proxy requests to external APIs.
+type Handler struct {
+	*mux.Router
+	DataStore            dataservices.DataStore
+	requestBouncer       security.BouncerService
+	ProxyManager         *proxy.Manager
+	ReverseTunnelService portainer.ReverseTunnelService
+}
+
+// NewHandler creates a handler to proxy requests to external APIs.
+func NewHandler(bouncer security.BouncerService) *Handler {
+	h := &Handler{
+		Router:         mux.NewRouter(),
+		requestBouncer: bouncer,
+	}
+	h.PathPrefix("/{id}/azure").Handler(
+		bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.proxyRequestsToAzureAPI)))
+	h.PathPrefix("/{id}/docker").Handler(
+		bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.proxyRequestsToDockerAPI)))
+	h.PathPrefix("/{id}/kubernetes").Handler(
+		bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.proxyRequestsToKubernetesAPI)))
+	h.PathPrefix("/{id}/agent/docker").Handler(
+		bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.proxyRequestsToDockerAPI)))
+	h.PathPrefix("/{id}/agent/kubernetes").Handler(
+		bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.proxyRequestsToKubernetesAPI)))
+	h.PathPrefix("/{id}/agent/host").Handler(httperror.LoggerHandler(h.proxyRequestsToAgentHostAPI))
+	return h
+}
diff --git a/api/http/handler/endpointproxy/proxy_agent_host.go b/api/http/handler/endpointproxy/proxy_agent_host.go
new file mode 100644
index 0000000..e686dd5
--- /dev/null
+++ b/api/http/handler/endpointproxy/proxy_agent_host.go
@@ -0,0 +1,59 @@
+package endpointproxy
+
+import (
+	"errors"
+	"net/http"
+	"strconv"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+)
+
+func (handler *Handler) proxyRequestsToAgentHostAPI(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	endpointID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid environment identifier route variable", err)
+	}
+
+	var endpoint *portainer.Endpoint
+	if err := handler.DataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
+		var err error
+		endpoint, err = tx.Endpoint().Endpoint(portainer.EndpointID(endpointID))
+		return err
+	}); handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find an environment with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find an environment with the specified identifier inside the database", err)
+	}
+
+	err = handler.requestBouncer.AuthorizedEndpointOperation(r, endpoint)
+	if err != nil {
+		return httperror.Forbidden("Permission denied to access environment", err)
+	}
+
+	if endpoint.Type == portainer.EdgeAgentOnDockerEnvironment {
+		if endpoint.EdgeID == "" {
+			return httperror.InternalServerError("No Edge agent registered with the environment", errors.New("No agent available"))
+		}
+
+		_, err := handler.ReverseTunnelService.TunnelAddr(endpoint)
+		if err != nil {
+			return httperror.InternalServerError("Unable to get the active tunnel", err)
+		}
+	}
+
+	var proxy http.Handler
+	proxy = handler.ProxyManager.GetEndpointProxy(endpoint)
+	if proxy == nil {
+		proxy, err = handler.ProxyManager.CreateAndRegisterEndpointProxy(endpoint)
+		if err != nil {
+			return httperror.InternalServerError("Unable to create proxy", err)
+		}
+	}
+
+	id := strconv.Itoa(endpointID)
+	http.StripPrefix("/"+id+"/agent", proxy).ServeHTTP(w, r)
+	return nil
+}
diff --git a/api/http/handler/endpointproxy/proxy_agent_host_test.go b/api/http/handler/endpointproxy/proxy_agent_host_test.go
new file mode 100644
index 0000000..6bf9dbb
--- /dev/null
+++ b/api/http/handler/endpointproxy/proxy_agent_host_test.go
@@ -0,0 +1,199 @@
+package endpointproxy
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/http/proxy"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// stubTunnelService is a minimal ReverseTunnelService that controls TunnelAddr behavior.
+type stubTunnelService struct {
+	tunnelAddr    string
+	tunnelAddrErr error
+}
+
+func (s *stubTunnelService) StartTunnelServer(_, _ string, _ portainer.SnapshotService) error {
+	return nil
+}
+func (s *stubTunnelService) StopTunnelServer() error { return nil }
+func (s *stubTunnelService) GenerateEdgeKey(_, _ string, _ int) string {
+	return ""
+}
+func (s *stubTunnelService) Open(_ *portainer.Endpoint) error { return nil }
+func (s *stubTunnelService) Config(_ portainer.EndpointID) portainer.TunnelDetails {
+	return portainer.TunnelDetails{}
+}
+func (s *stubTunnelService) TunnelAddr(_ *portainer.Endpoint) (string, error) {
+	return s.tunnelAddr, s.tunnelAddrErr
+}
+func (s *stubTunnelService) UpdateLastActivity(_ portainer.EndpointID) {}
+func (s *stubTunnelService) KeepTunnelAlive(_ portainer.EndpointID, _ context.Context, _ time.Duration) {
+}
+
+// denyBouncer wraps the test bouncer but rejects AuthorizedEndpointOperation.
+// Used to test the 403 path without setting up a full JWT stack.
+type denyBouncer struct {
+	security.BouncerService
+}
+
+func (denyBouncer) AuthorizedEndpointOperation(_ *http.Request, _ *portainer.Endpoint) error {
+	return errors.New("access denied to environment")
+}
+
+// setupProxyHandler builds a Handler backed by a real (empty) test datastore.
+// The real datastore is required because proxyRequestsToAgentHostAPI uses ViewTx,
+// which must execute its callback to populate the endpoint variable.
+func setupProxyHandler(t *testing.T, bouncer security.BouncerService) (*Handler, *datastore.Store) {
+	t.Helper()
+
+	_, store := datastore.MustNewTestStore(t, false, false)
+
+	h := NewHandler(bouncer)
+	h.DataStore = store
+	h.ProxyManager = proxy.NewManager(nil)
+	h.ReverseTunnelService = &stubTunnelService{}
+
+	return h, store
+}
+
+func TestProxyAgentHostAPI_InvalidEndpointID(t *testing.T) {
+	t.Parallel()
+
+	// A non-numeric environment ID in the URL (e.g. caused by a typo or path-traversal attempt)
+	// must be rejected immediately with 400 Bad Request.
+	h, _ := setupProxyHandler(t, testhelpers.NewTestRequestBouncer())
+
+	rw := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/abc/agent/host/docker-storage", nil)
+
+	h.ServeHTTP(rw, req)
+
+	assert.Equal(t, http.StatusBadRequest, rw.Code)
+}
+
+func TestProxyAgentHostAPI_EndpointNotFound(t *testing.T) {
+	t.Parallel()
+
+	// The environment was deleted from the database while the user still has a
+	// browser tab open. The server should return 404, not a 500 or panic.
+	h, _ := setupProxyHandler(t, testhelpers.NewTestRequestBouncer())
+
+	rw := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/99/agent/host/docker-storage", nil)
+
+	h.ServeHTTP(rw, req)
+
+	assert.Equal(t, http.StatusNotFound, rw.Code)
+}
+
+func TestProxyAgentHostAPI_PermissionDenied(t *testing.T) {
+	t.Parallel()
+
+	// A standard user without access to this environment must receive 403 Forbidden.
+	bouncer := denyBouncer{BouncerService: testhelpers.NewTestRequestBouncer()}
+	h, store := setupProxyHandler(t, bouncer)
+
+	require.NoError(t, store.Endpoint().Create(&portainer.Endpoint{
+		ID:   1,
+		Name: "env-1",
+		Type: portainer.AgentOnDockerEnvironment,
+	}))
+
+	rw := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/1/agent/host/docker-storage", nil)
+
+	h.ServeHTTP(rw, req)
+
+	assert.Equal(t, http.StatusForbidden, rw.Code)
+}
+
+func TestProxyAgentHostAPI_EdgeNoEdgeID(t *testing.T) {
+	t.Parallel()
+
+	// An Edge environment that was registered in Portainer but whose agent has never
+	// connected (EdgeID is empty) cannot be contacted — the server returns 500.
+	h, store := setupProxyHandler(t, testhelpers.NewTestRequestBouncer())
+
+	require.NoError(t, store.Endpoint().Create(&portainer.Endpoint{
+		ID:     2,
+		Name:   "edge-env-no-id",
+		Type:   portainer.EdgeAgentOnDockerEnvironment,
+		EdgeID: "",
+	}))
+
+	rw := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/2/agent/host/docker-storage", nil)
+
+	h.ServeHTTP(rw, req)
+
+	assert.Equal(t, http.StatusInternalServerError, rw.Code)
+}
+
+func TestProxyAgentHostAPI_EdgeTunnelUnavailable(t *testing.T) {
+	t.Parallel()
+
+	// The Edge agent was registered and has an EdgeID but is currently offline
+	// (tunnel establishment fails). The user receives 500 rather than a hang.
+	_, store := datastore.MustNewTestStore(t, false, false)
+
+	h := NewHandler(testhelpers.NewTestRequestBouncer())
+	h.DataStore = store
+	h.ProxyManager = proxy.NewManager(nil)
+	h.ReverseTunnelService = &stubTunnelService{
+		tunnelAddrErr: errors.New("no active tunnel for edge agent"),
+	}
+
+	require.NoError(t, store.Endpoint().Create(&portainer.Endpoint{
+		ID:     3,
+		Name:   "edge-env-offline",
+		Type:   portainer.EdgeAgentOnDockerEnvironment,
+		EdgeID: "registered-edge-id",
+	}))
+
+	rw := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/3/agent/host/docker-storage", nil)
+
+	h.ServeHTTP(rw, req)
+
+	assert.Equal(t, http.StatusInternalServerError, rw.Code)
+}
+
+func TestProxyAgentHostAPI_ProxyCreationFails(t *testing.T) {
+	t.Parallel()
+
+	// When a proxy for the environment has not been cached yet and the proxy factory is
+	// uninitialised (e.g. a misconfigured server), the handler returns 500 rather than panicking.
+	h, store := setupProxyHandler(t, testhelpers.NewTestRequestBouncer())
+
+	require.NoError(t, store.Endpoint().Create(&portainer.Endpoint{
+		ID:   4,
+		Name: "env-4",
+		Type: portainer.AgentOnDockerEnvironment,
+		URL:  "tcp://agent:9001",
+	}))
+
+	rw := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/4/agent/host/docker-storage", nil)
+
+	h.ServeHTTP(rw, req)
+
+	// proxy.NewManager(nil) without NewProxyFactory → ErrProxyFactoryNotInitialized → 500
+	assert.Equal(t, http.StatusInternalServerError, rw.Code)
+}
+
+// Verify the stubTunnelService satisfies the interface at compile time.
+var _ portainer.ReverseTunnelService = (*stubTunnelService)(nil)
+
+// Verify denyBouncer satisfies the interface at compile time.
+var _ security.BouncerService = denyBouncer{}
diff --git a/api/http/handler/endpointproxy/proxy_azure.go b/api/http/handler/endpointproxy/proxy_azure.go
new file mode 100644
index 0000000..b468c50
--- /dev/null
+++ b/api/http/handler/endpointproxy/proxy_azure.go
@@ -0,0 +1,42 @@
+package endpointproxy
+
+import (
+	"net/http"
+	"strconv"
+
+	portainer "github.com/portainer/portainer/api"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+)
+
+func (handler *Handler) proxyRequestsToAzureAPI(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	endpointID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid environment identifier route variable", err)
+	}
+
+	endpoint, err := handler.DataStore.Endpoint().Endpoint(portainer.EndpointID(endpointID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find an environment with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find an environment with the specified identifier inside the database", err)
+	}
+
+	err = handler.requestBouncer.AuthorizedEndpointOperation(r, endpoint)
+	if err != nil {
+		return httperror.Forbidden("Permission denied to access environment", err)
+	}
+
+	var proxy http.Handler
+	proxy = handler.ProxyManager.GetEndpointProxy(endpoint)
+	if proxy == nil {
+		proxy, err = handler.ProxyManager.CreateAndRegisterEndpointProxy(endpoint)
+		if err != nil {
+			return httperror.InternalServerError("Unable to create proxy", err)
+		}
+	}
+
+	id := strconv.Itoa(endpointID)
+	http.StripPrefix("/"+id+"/azure", proxy).ServeHTTP(w, r)
+	return nil
+}
diff --git a/api/http/handler/endpointproxy/proxy_docker.go b/api/http/handler/endpointproxy/proxy_docker.go
new file mode 100644
index 0000000..30782a9
--- /dev/null
+++ b/api/http/handler/endpointproxy/proxy_docker.go
@@ -0,0 +1,61 @@
+package endpointproxy
+
+import (
+	"errors"
+	"net/http"
+	"strconv"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+)
+
+func (handler *Handler) proxyRequestsToDockerAPI(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	endpointID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid environment identifier route variable", err)
+	}
+
+	endpoint, err := handler.DataStore.Endpoint().Endpoint(portainer.EndpointID(endpointID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find an environment with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find an environment with the specified identifier inside the database", err)
+	}
+
+	err = handler.requestBouncer.AuthorizedEndpointOperation(r, endpoint)
+	if err != nil {
+		return httperror.Forbidden("Permission denied to access environment", err)
+	}
+
+	if endpoint.Type == portainer.EdgeAgentOnDockerEnvironment {
+		if endpoint.EdgeID == "" {
+			return httperror.InternalServerError("No Edge agent registered with the environment", errors.New("No agent available"))
+		}
+
+		_, err := handler.ReverseTunnelService.TunnelAddr(endpoint)
+		if err != nil {
+			return httperror.InternalServerError("Unable to get the active tunnel", err)
+		}
+	}
+
+	var proxy http.Handler
+	proxy = handler.ProxyManager.GetEndpointProxy(endpoint)
+	if proxy == nil {
+		proxy, err = handler.ProxyManager.CreateAndRegisterEndpointProxy(endpoint)
+		if err != nil {
+			return httperror.InternalServerError("Unable to create proxy", err)
+		}
+	}
+
+	id := strconv.Itoa(endpointID)
+
+	prefix := "/" + id + "/agent/docker"
+	if !strings.HasPrefix(r.URL.Path, prefix) {
+		prefix = "/" + id + "/docker"
+	}
+
+	http.StripPrefix(prefix, proxy).ServeHTTP(w, r)
+	return nil
+}
diff --git a/api/http/handler/endpointproxy/proxy_kubernetes.go b/api/http/handler/endpointproxy/proxy_kubernetes.go
new file mode 100644
index 0000000..ddf54d6
--- /dev/null
+++ b/api/http/handler/endpointproxy/proxy_kubernetes.go
@@ -0,0 +1,66 @@
+package endpointproxy
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+)
+
+func (handler *Handler) proxyRequestsToKubernetesAPI(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	endpointID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid environment identifier route variable", err)
+	}
+
+	endpoint, err := handler.DataStore.Endpoint().Endpoint(portainer.EndpointID(endpointID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find an environment with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find an environment with the specified identifier inside the database", err)
+	}
+
+	err = handler.requestBouncer.AuthorizedEndpointOperation(r, endpoint)
+	if err != nil {
+		return httperror.Forbidden("Permission denied to access environment", err)
+	}
+
+	if endpoint.Type == portainer.EdgeAgentOnKubernetesEnvironment {
+		if endpoint.EdgeID == "" {
+			return httperror.InternalServerError("No Edge agent registered with the environment", errors.New("No agent available"))
+		}
+
+		_, err := handler.ReverseTunnelService.TunnelAddr(endpoint)
+		if err != nil {
+			return httperror.InternalServerError("Unable to get the active tunnel", err)
+		}
+	}
+
+	var proxy http.Handler
+	proxy = handler.ProxyManager.GetEndpointProxy(endpoint)
+	if proxy == nil {
+		proxy, err = handler.ProxyManager.CreateAndRegisterEndpointProxy(endpoint)
+		if err != nil {
+			return httperror.InternalServerError("Unable to create proxy", err)
+		}
+	}
+
+	//  For KubernetesLocalEnvironment
+	requestPrefix := fmt.Sprintf("/%d/kubernetes", endpointID)
+
+	if endpoint.Type == portainer.AgentOnKubernetesEnvironment || endpoint.Type == portainer.EdgeAgentOnKubernetesEnvironment {
+		requestPrefix = fmt.Sprintf("/%d", endpointID)
+
+		agentPrefix := fmt.Sprintf("/%d/agent/kubernetes", endpointID)
+		if strings.HasPrefix(r.URL.Path, agentPrefix) {
+			requestPrefix = agentPrefix
+		}
+	}
+
+	http.StripPrefix(requestPrefix, proxy).ServeHTTP(w, r)
+	return nil
+}
diff --git a/api/http/handler/endpoints/endpoint_agent_browse_docs.go b/api/http/handler/endpoints/endpoint_agent_browse_docs.go
new file mode 100644
index 0000000..cb22f71
--- /dev/null
+++ b/api/http/handler/endpoints/endpoint_agent_browse_docs.go
@@ -0,0 +1,27 @@
+package endpoints
+
+/// This feature is implemented in the agent API and not directly here.
+/// However, it's proxied.  So we document it here.
+
+// @summary Upload a file under a specific path on the file system of an environment (endpoint)
+// @description Use this environment(endpoint) to upload TLS files.
+// @description **Access policy**: administrator
+// @tags endpoints
+// @security ApiKeyAuth
+// @security jwt
+// @accept multipart/form-data
+// @produce json
+// @param id path int true "Environment(Endpoint) identifier"
+// @param volumeID query string false "Optional volume identifier to upload the file"
+// @param Path formData string true "The destination path to upload the file to"
+// @param file formData file true "The file to upload"
+// @success 204 "Success"
+// @failure 400 "Invalid request"
+// @failure 500 "Server error"
+// @router /endpoints/{id}/docker/v2/browse/put [post]
+//
+//lint:ignore U1000 Ignore unused code, for documentation purposes
+func _fileBrowseFileUploadV2() {
+	// dummy function to make swag pick up the above docs for the following REST call
+	// POST request on /browse/put?volumeID=:id
+}
diff --git a/api/http/handler/endpoints/endpoint_agent_versions.go b/api/http/handler/endpoints/endpoint_agent_versions.go
new file mode 100644
index 0000000..ced7d0b
--- /dev/null
+++ b/api/http/handler/endpoints/endpoint_agent_versions.go
@@ -0,0 +1,50 @@
+package endpoints
+
+import (
+	"net/http"
+
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/set"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id AgentVersions
+// @summary List agent versions
+// @description List all agent versions based on the current user authorizations and query parameters.
+// @description **Access policy**: restricted
+// @tags endpoints
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @success 200 {array} string "List of available agent versions"
+// @failure 500 "Server error"
+// @router /endpoints/agent_versions [get]
+
+func (handler *Handler) agentVersions(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	endpointGroups, err := handler.DataStore.EndpointGroup().ReadAll()
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve environment groups from the database", err)
+	}
+
+	endpoints, err := handler.DataStore.Endpoint().Endpoints()
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve environments from the database", err)
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	filteredEndpoints := security.FilterEndpoints(endpoints, endpointGroups, securityContext)
+
+	agentVersions := set.Set[string]{}
+	for _, endpoint := range filteredEndpoints {
+		if endpoint.Agent.Version != "" {
+			agentVersions[endpoint.Agent.Version] = true
+		}
+	}
+
+	return response.JSON(w, agentVersions.Keys())
+}
diff --git a/api/http/handler/endpoints/endpoint_association_delete.go b/api/http/handler/endpoints/endpoint_association_delete.go
new file mode 100644
index 0000000..55cad59
--- /dev/null
+++ b/api/http/handler/endpoints/endpoint_association_delete.go
@@ -0,0 +1,87 @@
+package endpoints
+
+import (
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"net/http"
+	"regexp"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id EndpointAssociationDelete
+// @summary De-association an edge environment(endpoint)
+// @description De-association an edge environment(endpoint).
+// @description **Access policy**: administrator
+// @security ApiKeyAuth
+// @security jwt
+// @tags endpoints
+// @produce json
+// @param id path int true "Environment(Endpoint) identifier"
+// @success 204 "Success"
+// @failure 400 "Invalid request"
+// @failure 404 "Environment(Endpoint) not found"
+// @failure 500 "Server error"
+// @router /endpoints/{id}/association [put]
+func (handler *Handler) endpointAssociationDelete(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	endpointID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid environment identifier route variable", err)
+	}
+
+	endpoint, err := handler.DataStore.Endpoint().Endpoint(portainer.EndpointID(endpointID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find an environment with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find an environment with the specified identifier inside the database", err)
+	}
+
+	if endpoint.Type != portainer.EdgeAgentOnKubernetesEnvironment && endpoint.Type != portainer.EdgeAgentOnDockerEnvironment {
+		return httperror.BadRequest("Invalid environment type", errors.New("Invalid environment type"))
+	}
+
+	endpoint.EdgeID = ""
+	endpoint.Snapshots = []portainer.DockerSnapshot{}
+	endpoint.Kubernetes.Snapshots = []portainer.KubernetesSnapshot{}
+
+	endpoint.EdgeKey, err = handler.updateEdgeKey(endpoint.EdgeKey)
+	if err != nil {
+		return httperror.InternalServerError("Invalid EdgeKey", err)
+	}
+
+	err = handler.DataStore.Endpoint().UpdateEndpoint(portainer.EndpointID(endpointID), endpoint)
+	if err != nil {
+		return httperror.InternalServerError("Failed persisting environment in database", err)
+	}
+
+	return response.Empty(w)
+}
+
+func (handler *Handler) updateEdgeKey(edgeKey string) (string, error) {
+	oldEdgeKeyByte, err := base64.RawStdEncoding.DecodeString(edgeKey)
+	if err != nil {
+		return "", err
+	}
+
+	oldEdgeKeyStr := string(oldEdgeKeyByte)
+
+	httpPort := getPort(handler.BindAddress)
+	httpsPort := getPort(handler.BindAddressHTTPS)
+
+	// replace "http://" with "https://" and replace ":9000" with ":9443", in the case of default values
+	// oldEdgeKeyStr example: http://10.116.1.178:9000|10.116.1.178:8000|46:99:4a:8d:a6:de:6a:bd:d8:e2:1c:99:81:60:54:55|52
+	r := regexp.MustCompile(fmt.Sprintf("^(http://)([^|]+)(:%s)(|.*)", httpPort))
+	newEdgeKeyStr := r.ReplaceAllString(oldEdgeKeyStr, fmt.Sprintf("https://$2:%s$4", httpsPort))
+
+	return base64.RawStdEncoding.EncodeToString([]byte(newEdgeKeyStr)), nil
+}
+
+func getPort(url string) string {
+	items := strings.Split(url, ":")
+	return items[len(items)-1]
+}
diff --git a/api/http/handler/endpoints/endpoint_create.go b/api/http/handler/endpoints/endpoint_create.go
new file mode 100644
index 0000000..7d95a31
--- /dev/null
+++ b/api/http/handler/endpoints/endpoint_create.go
@@ -0,0 +1,598 @@
+package endpoints
+
+import (
+	"errors"
+	"net/http"
+	"runtime"
+	"strconv"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/agent"
+	"github.com/portainer/portainer/api/crypto"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/client"
+	"github.com/portainer/portainer/api/internal/edge"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+
+	"github.com/google/uuid"
+	"github.com/rs/zerolog/log"
+)
+
+type endpointCreatePayload struct {
+	Name                   string
+	URL                    string
+	EndpointCreationType   endpointCreationEnum
+	PublicURL              string
+	Gpus                   []portainer.Pair
+	GroupID                int
+	TLS                    bool
+	TLSSkipVerify          bool
+	TLSSkipClientVerify    bool
+	TLSCACertFile          []byte
+	TLSCertFile            []byte
+	TLSKeyFile             []byte
+	AzureApplicationID     string
+	AzureTenantID          string
+	AzureAuthenticationKey string
+	TagIDs                 []portainer.TagID
+	EdgeCheckinInterval    int
+	ContainerEngine        string
+}
+
+type endpointCreationEnum int
+
+const (
+	_ endpointCreationEnum = iota
+	localDockerEnvironment
+	agentEnvironment
+	azureEnvironment
+	edgeAgentEnvironment
+	localKubernetesEnvironment
+)
+
+func (payload *endpointCreatePayload) Validate(r *http.Request) error {
+	name, err := request.RetrieveMultiPartFormValue(r, "Name", false)
+	if err != nil {
+		return errors.New("invalid environment name")
+	}
+	payload.Name = name
+
+	endpointCreationType, err := request.RetrieveNumericMultiPartFormValue(r, "EndpointCreationType", false)
+	if err != nil || endpointCreationType == 0 {
+		return errors.New("invalid environment type value. Value must be one of: 1 (Docker environment), 2 (Agent environment), 3 (Azure environment), 4 (Edge Agent environment) or 5 (Local Kubernetes environment)")
+	}
+	payload.EndpointCreationType = endpointCreationEnum(endpointCreationType)
+
+	payload.ContainerEngine, err = request.RetrieveMultiPartFormValue(r, "ContainerEngine", true)
+	if err != nil || (payload.ContainerEngine != "" && payload.ContainerEngine != portainer.ContainerEngineDocker && payload.ContainerEngine != portainer.ContainerEnginePodman) {
+		return errors.New("invalid container engine value. Value must be one of: 'docker' or 'podman'")
+	}
+
+	groupID, _ := request.RetrieveNumericMultiPartFormValue(r, "GroupID", true)
+	if groupID == 0 {
+		groupID = 1
+	}
+	payload.GroupID = groupID
+
+	var tagIDs []portainer.TagID
+	if err := request.RetrieveMultiPartFormJSONValue(r, "TagIds", &tagIDs, true); err != nil {
+		return errors.New("invalid TagIds parameter")
+	}
+	payload.TagIDs = tagIDs
+	if payload.TagIDs == nil {
+		payload.TagIDs = make([]portainer.TagID, 0)
+	}
+
+	useTLS, _ := request.RetrieveBooleanMultiPartFormValue(r, "TLS", true)
+	payload.TLS = useTLS
+
+	if payload.TLS && payload.EndpointCreationType == edgeAgentEnvironment {
+		return errors.New("TLS is not supported for Edge Agent environments")
+	}
+
+	if payload.TLS {
+		skipTLSServerVerification, _ := request.RetrieveBooleanMultiPartFormValue(r, "TLSSkipVerify", true)
+		payload.TLSSkipVerify = skipTLSServerVerification
+		skipTLSClientVerification, _ := request.RetrieveBooleanMultiPartFormValue(r, "TLSSkipClientVerify", true)
+		payload.TLSSkipClientVerify = skipTLSClientVerification
+
+		if !payload.TLSSkipVerify {
+			caCert, _, err := request.RetrieveMultiPartFormFile(r, "TLSCACertFile")
+			if err != nil {
+				return errors.New("invalid CA certificate file. Ensure that the file is uploaded correctly")
+			}
+
+			payload.TLSCACertFile = caCert
+		}
+
+		if !payload.TLSSkipClientVerify {
+			cert, _, err := request.RetrieveMultiPartFormFile(r, "TLSCertFile")
+			if err != nil {
+				return errors.New("invalid certificate file. Ensure that the file is uploaded correctly")
+			}
+			payload.TLSCertFile = cert
+
+			key, _, err := request.RetrieveMultiPartFormFile(r, "TLSKeyFile")
+			if err != nil {
+				return errors.New("invalid key file. Ensure that the file is uploaded correctly")
+			}
+
+			payload.TLSKeyFile = key
+		}
+	}
+
+	switch payload.EndpointCreationType {
+	case azureEnvironment:
+		azureApplicationID, err := request.RetrieveMultiPartFormValue(r, "AzureApplicationID", false)
+		if err != nil {
+			return errors.New("invalid Azure application ID")
+		}
+
+		payload.AzureApplicationID = azureApplicationID
+
+		azureTenantID, err := request.RetrieveMultiPartFormValue(r, "AzureTenantID", false)
+		if err != nil {
+			return errors.New("invalid Azure tenant ID")
+		}
+		payload.AzureTenantID = azureTenantID
+
+		azureAuthenticationKey, err := request.RetrieveMultiPartFormValue(r, "AzureAuthenticationKey", false)
+		if err != nil {
+			return errors.New("invalid Azure authentication key")
+		}
+		payload.AzureAuthenticationKey = azureAuthenticationKey
+
+	case edgeAgentEnvironment:
+		endpointURL, err := request.RetrieveMultiPartFormValue(r, "URL", false)
+		if err != nil || strings.EqualFold("", strings.Trim(endpointURL, " ")) {
+			return errors.New("URL cannot be empty")
+		}
+
+		payload.URL = endpointURL
+
+		publicURL, _ := request.RetrieveMultiPartFormValue(r, "PublicURL", true)
+		payload.PublicURL = publicURL
+
+	default:
+		endpointURL, err := request.RetrieveMultiPartFormValue(r, "URL", true)
+		if err != nil {
+			return errors.New("invalid environment URL")
+		}
+		payload.URL = endpointURL
+
+		publicURL, _ := request.RetrieveMultiPartFormValue(r, "PublicURL", true)
+		payload.PublicURL = publicURL
+	}
+
+	gpus := make([]portainer.Pair, 0)
+	if err := request.RetrieveMultiPartFormJSONValue(r, "Gpus", &gpus, true); err != nil {
+		return errors.New("invalid Gpus parameter")
+	}
+
+	payload.Gpus = gpus
+
+	edgeCheckinInterval, _ := request.RetrieveNumericMultiPartFormValue(r, "EdgeCheckinInterval", true)
+	if edgeCheckinInterval == 0 {
+		// deprecated CheckinInterval
+		edgeCheckinInterval, _ = request.RetrieveNumericMultiPartFormValue(r, "CheckinInterval", true)
+	}
+	payload.EdgeCheckinInterval = edgeCheckinInterval
+
+	return nil
+}
+
+// @id EndpointCreate
+// @summary Create a new environment(endpoint)
+// @description  Create a new environment(endpoint) that will be used to manage an environment(endpoint).
+// @description **Access policy**: administrator
+// @tags endpoints
+// @security ApiKeyAuth
+// @security jwt
+// @accept multipart/form-data
+// @produce json
+// @param Name formData string true "Name that will be used to identify this environment(endpoint) (example: my-environment)"
+// @param EndpointCreationType formData endpointCreationEnum true "Environment(Endpoint) type. Value must be one of: 1 (Local Docker environment), 2 (Agent environment), 3 (Azure environment), 4 (Edge agent environment) or 5 (Local Kubernetes Environment)" Enum(1,2,3,4,5)
+// @param ContainerEngine formData string false "Container engine used by the environment(endpoint). Value must be one of: 'docker' or 'podman'"
+// @param URL formData string false "URL or IP address of a Docker host (example: docker.mydomain.tld:2375). Defaults to local if not specified (Linux: /var/run/docker.sock, Windows: //./pipe/docker_engine). Cannot be empty if EndpointCreationType is set to 4 (Edge agent environment)"
+// @param PublicURL formData string false "URL or IP address where exposed containers will be reachable. Defaults to URL if not specified (example: docker.mydomain.tld:2375)"
+// @param GroupID formData int false "Environment(Endpoint) group identifier. If not specified will default to 1 (unassigned)."
+// @param TLS formData bool false "Require TLS to connect against this environment(endpoint). Must be true if EndpointCreationType is set to 2 (Agent environment)"
+// @param TLSSkipVerify formData bool false "Skip server verification when using TLS. Must be true if EndpointCreationType is set to 2 (Agent environment)"
+// @param TLSSkipClientVerify formData bool false "Skip client verification when using TLS. Must be true if EndpointCreationType is set to 2 (Agent environment)"
+// @param TLSCACertFile formData file false "TLS CA certificate file"
+// @param TLSCertFile formData file false "TLS client certificate file"
+// @param TLSKeyFile formData file false "TLS client key file"
+// @param AzureApplicationID formData string false "Azure application ID. Required if environment(endpoint) type is set to 3"
+// @param AzureTenantID formData string false "Azure tenant ID. Required if environment(endpoint) type is set to 3"
+// @param AzureAuthenticationKey formData string false "Azure authentication key. Required if environment(endpoint) type is set to 3"
+// @param TagIds formData string false "JSON-parsable array of tag identifiers to which this environment(endpoint) is associated"
+// @param EdgeCheckinInterval formData int false "The check in interval for edge agent (in seconds)"
+// @param EdgeTunnelServerAddress formData string false "URL or IP address that will be used to establish a reverse tunnel"
+// @param Gpus formData string false "List of GPUs - json stringified array of {name, value} structs"
+// @success 200 {object} portainer.Endpoint "Success"
+// @failure 400 "Invalid request"
+// @failure 409 "Name is not unique"
+// @failure 500 "Server error"
+// @router /endpoints [post]
+func (handler *Handler) endpointCreate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	payload := &endpointCreatePayload{}
+	if err := payload.Validate(r); err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	isUnique, err := handler.isNameUnique(payload.Name, 0)
+	if err != nil {
+		return httperror.InternalServerError("Unable to check if name is unique", err)
+	}
+
+	if !isUnique {
+		return httperror.Conflict("Name is not unique", nil)
+	}
+
+	endpoint, endpointCreationError := handler.createEndpoint(handler.DataStore, payload)
+	if endpointCreationError != nil {
+		return endpointCreationError
+	}
+
+	endpointGroup, err := handler.DataStore.EndpointGroup().Read(endpoint.GroupID)
+	if err != nil {
+		return httperror.InternalServerError("Unable to find an environment group inside the database", err)
+	}
+
+	edgeGroups, err := handler.DataStore.EdgeGroup().ReadAll()
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve edge groups from the database", err)
+	}
+
+	edgeStacks, err := handler.DataStore.EdgeStack().EdgeStacks()
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve edge stacks from the database", err)
+	}
+
+	relationObject := &portainer.EndpointRelation{
+		EndpointID: endpoint.ID,
+		EdgeStacks: map[portainer.EdgeStackID]bool{},
+	}
+
+	if endpoint.Type == portainer.EdgeAgentOnDockerEnvironment || endpoint.Type == portainer.EdgeAgentOnKubernetesEnvironment {
+		relatedEdgeStacks := edge.EndpointRelatedEdgeStacks(endpoint, endpointGroup, edgeGroups, edgeStacks)
+		for _, stackID := range relatedEdgeStacks {
+			relationObject.EdgeStacks[stackID] = true
+		}
+	} else if endpointutils.IsKubernetesEndpoint(endpoint) {
+		if err := handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+			endpointutils.InitialIngressClassDetection(tx, endpoint, handler.K8sClientFactory)
+			endpointutils.InitialMetricsDetection(tx, endpoint, handler.K8sClientFactory)
+			endpointutils.InitialStorageDetection(tx, handler.DataStore, endpoint, handler.K8sClientFactory)
+			return nil
+		}); err != nil {
+			log.Err(err).Msg("failed to persist initial kube detection")
+		}
+	}
+
+	if err := handler.DataStore.EndpointRelation().Create(relationObject); err != nil {
+		return httperror.InternalServerError("Unable to persist the relation object inside the database", err)
+	}
+
+	return response.JSON(w, endpoint)
+}
+
+func (handler *Handler) createEndpoint(tx dataservices.DataStoreTx, payload *endpointCreatePayload) (*portainer.Endpoint, *httperror.HandlerError) {
+	switch payload.EndpointCreationType {
+	case azureEnvironment:
+		return handler.createAzureEndpoint(tx, payload)
+
+	case edgeAgentEnvironment:
+		return handler.createEdgeAgentEndpoint(tx, payload)
+
+	case localKubernetesEnvironment:
+		return handler.createKubernetesEndpoint(tx, payload)
+	}
+
+	endpointType := portainer.DockerEnvironment
+	var agentVersion string
+	if payload.EndpointCreationType == agentEnvironment {
+		tlsConfig, err := crypto.CreateTLSConfigurationFromBytes(payload.TLS, payload.TLSCACertFile, payload.TLSCertFile, payload.TLSKeyFile, payload.TLSSkipVerify, payload.TLSSkipClientVerify)
+		if err != nil {
+			return nil, httperror.InternalServerError("Unable to create TLS configuration", err)
+		}
+
+		agentPlatform, version, err := agent.GetAgentVersionAndPlatform(payload.URL, tlsConfig)
+		if err != nil {
+			return nil, httperror.InternalServerError("Unable to get environment type", err)
+		}
+
+		agentVersion = version
+		if agentPlatform == portainer.AgentPlatformDocker {
+			endpointType = portainer.AgentOnDockerEnvironment
+		} else if agentPlatform == portainer.AgentPlatformKubernetes {
+			endpointType = portainer.AgentOnKubernetesEnvironment
+			payload.URL = strings.TrimPrefix(payload.URL, "tcp://")
+		}
+	}
+
+	if payload.TLS {
+		return handler.createTLSSecuredEndpoint(tx, payload, endpointType, agentVersion)
+	}
+
+	return handler.createUnsecuredEndpoint(tx, payload)
+}
+
+func (handler *Handler) createAzureEndpoint(tx dataservices.DataStoreTx, payload *endpointCreatePayload) (*portainer.Endpoint, *httperror.HandlerError) {
+	credentials := portainer.AzureCredentials{
+		ApplicationID:     payload.AzureApplicationID,
+		TenantID:          payload.AzureTenantID,
+		AuthenticationKey: payload.AzureAuthenticationKey,
+	}
+
+	httpClient := client.NewHTTPClient()
+	if _, err := httpClient.ExecuteAzureAuthenticationRequest(&credentials); err != nil {
+		return nil, httperror.InternalServerError("Unable to authenticate against Azure", err)
+	}
+
+	endpointID := tx.Endpoint().GetNextIdentifier()
+	endpoint := &portainer.Endpoint{
+		ID:                 portainer.EndpointID(endpointID),
+		Name:               payload.Name,
+		URL:                "https://management.azure.com",
+		Type:               portainer.AzureEnvironment,
+		GroupID:            portainer.EndpointGroupID(payload.GroupID),
+		PublicURL:          payload.PublicURL,
+		Gpus:               payload.Gpus,
+		UserAccessPolicies: portainer.UserAccessPolicies{},
+		TeamAccessPolicies: portainer.TeamAccessPolicies{},
+		AzureCredentials:   credentials,
+		TagIDs:             payload.TagIDs,
+		Status:             portainer.EndpointStatusUp,
+		Snapshots:          []portainer.DockerSnapshot{},
+		Kubernetes:         portainer.KubernetesDefault(),
+	}
+
+	if err := handler.saveEndpointAndUpdateAuthorizations(tx, endpoint); err != nil {
+		return nil, httperror.InternalServerError("An error occurred while trying to create the environment", err)
+	}
+
+	return endpoint, nil
+}
+
+func (handler *Handler) createEdgeAgentEndpoint(tx dataservices.DataStoreTx, payload *endpointCreatePayload) (*portainer.Endpoint, *httperror.HandlerError) {
+	endpointID := handler.DataStore.Endpoint().GetNextIdentifier()
+
+	portainerHost, err := edge.ParseHostForEdge(payload.URL)
+	if err != nil {
+		return nil, httperror.BadRequest("Unable to parse host", err)
+	}
+
+	edgeKey := handler.ReverseTunnelService.GenerateEdgeKey(payload.URL, portainerHost, endpointID)
+
+	endpoint := &portainer.Endpoint{
+		ID:   portainer.EndpointID(endpointID),
+		Name: payload.Name,
+		URL:  portainerHost,
+		Type: func() portainer.EndpointType {
+			// an empty container engine means that the endpoint is a Kubernetes endpoint
+			if payload.ContainerEngine == "" {
+				return portainer.EdgeAgentOnKubernetesEnvironment
+			}
+			return portainer.EdgeAgentOnDockerEnvironment
+		}(),
+		ContainerEngine: payload.ContainerEngine,
+		GroupID:         portainer.EndpointGroupID(payload.GroupID),
+		Gpus:            payload.Gpus,
+		TLSConfig: portainer.TLSConfiguration{
+			TLS: false,
+		},
+		UserAccessPolicies:  portainer.UserAccessPolicies{},
+		TeamAccessPolicies:  portainer.TeamAccessPolicies{},
+		TagIDs:              payload.TagIDs,
+		Status:              portainer.EndpointStatusUp,
+		Snapshots:           []portainer.DockerSnapshot{},
+		EdgeKey:             edgeKey,
+		EdgeCheckinInterval: payload.EdgeCheckinInterval,
+		Kubernetes:          portainer.KubernetesDefault(),
+		UserTrusted:         true,
+	}
+
+	settings, err := handler.DataStore.Settings().Settings()
+	if err != nil {
+		return nil, httperror.InternalServerError("Unable to retrieve the settings from the database", err)
+	}
+
+	if settings.EnforceEdgeID {
+		edgeID, err := uuid.NewRandom()
+		if err != nil {
+			return nil, httperror.InternalServerError("Cannot generate the Edge ID", err)
+		}
+
+		endpoint.EdgeID = edgeID.String()
+	}
+
+	if err := handler.saveEndpointAndUpdateAuthorizations(tx, endpoint); err != nil {
+		return nil, httperror.InternalServerError("An error occurred while trying to create the environment", err)
+	}
+
+	return endpoint, nil
+}
+
+func (handler *Handler) createUnsecuredEndpoint(tx dataservices.DataStoreTx, payload *endpointCreatePayload) (*portainer.Endpoint, *httperror.HandlerError) {
+	endpointType := portainer.DockerEnvironment
+
+	if payload.URL == "" {
+		payload.URL = "unix:///var/run/docker.sock"
+		if runtime.GOOS == "windows" {
+			payload.URL = "npipe:////./pipe/docker_engine"
+		}
+	}
+
+	endpointID := tx.Endpoint().GetNextIdentifier()
+	endpoint := &portainer.Endpoint{
+		ID:              portainer.EndpointID(endpointID),
+		Name:            payload.Name,
+		URL:             payload.URL,
+		Type:            endpointType,
+		ContainerEngine: payload.ContainerEngine,
+		GroupID:         portainer.EndpointGroupID(payload.GroupID),
+		PublicURL:       payload.PublicURL,
+		Gpus:            payload.Gpus,
+		TLSConfig: portainer.TLSConfiguration{
+			TLS: false,
+		},
+		UserAccessPolicies: portainer.UserAccessPolicies{},
+		TeamAccessPolicies: portainer.TeamAccessPolicies{},
+		TagIDs:             payload.TagIDs,
+		Status:             portainer.EndpointStatusUp,
+		Snapshots:          []portainer.DockerSnapshot{},
+		Kubernetes:         portainer.KubernetesDefault(),
+	}
+
+	if err := handler.snapshotAndPersistEndpoint(tx, endpoint); err != nil {
+		return nil, err
+	}
+
+	return endpoint, nil
+}
+
+func (handler *Handler) createKubernetesEndpoint(tx dataservices.DataStoreTx, payload *endpointCreatePayload) (*portainer.Endpoint, *httperror.HandlerError) {
+	if payload.URL == "" {
+		payload.URL = "https://kubernetes.default.svc"
+	}
+
+	endpointID := tx.Endpoint().GetNextIdentifier()
+
+	endpoint := &portainer.Endpoint{
+		ID:        portainer.EndpointID(endpointID),
+		Name:      payload.Name,
+		URL:       payload.URL,
+		Type:      portainer.KubernetesLocalEnvironment,
+		GroupID:   portainer.EndpointGroupID(payload.GroupID),
+		PublicURL: payload.PublicURL,
+		Gpus:      payload.Gpus,
+		TLSConfig: portainer.TLSConfiguration{
+			TLS:           payload.TLS,
+			TLSSkipVerify: payload.TLSSkipVerify,
+		},
+		UserAccessPolicies: portainer.UserAccessPolicies{},
+		TeamAccessPolicies: portainer.TeamAccessPolicies{},
+		TagIDs:             payload.TagIDs,
+		Status:             portainer.EndpointStatusUp,
+		Snapshots:          []portainer.DockerSnapshot{},
+		Kubernetes:         portainer.KubernetesDefault(),
+	}
+
+	if err := handler.snapshotAndPersistEndpoint(tx, endpoint); err != nil {
+		return nil, err
+	}
+
+	return endpoint, nil
+}
+
+func (handler *Handler) createTLSSecuredEndpoint(tx dataservices.DataStoreTx, payload *endpointCreatePayload, endpointType portainer.EndpointType, agentVersion string) (*portainer.Endpoint, *httperror.HandlerError) {
+	endpointID := tx.Endpoint().GetNextIdentifier()
+	endpoint := &portainer.Endpoint{
+		ID:              portainer.EndpointID(endpointID),
+		Name:            payload.Name,
+		URL:             payload.URL,
+		Type:            endpointType,
+		ContainerEngine: payload.ContainerEngine,
+		GroupID:         portainer.EndpointGroupID(payload.GroupID),
+		PublicURL:       payload.PublicURL,
+		Gpus:            payload.Gpus,
+		TLSConfig: portainer.TLSConfiguration{
+			TLS:           payload.TLS,
+			TLSSkipVerify: payload.TLSSkipVerify,
+		},
+		UserAccessPolicies: portainer.UserAccessPolicies{},
+		TeamAccessPolicies: portainer.TeamAccessPolicies{},
+		TagIDs:             payload.TagIDs,
+		Status:             portainer.EndpointStatusUp,
+		Snapshots:          []portainer.DockerSnapshot{},
+		Kubernetes:         portainer.KubernetesDefault(),
+	}
+
+	endpoint.Agent.Version = agentVersion
+
+	if err := handler.storeTLSFiles(endpoint, payload); err != nil {
+		return nil, err
+	}
+
+	if err := handler.snapshotAndPersistEndpoint(tx, endpoint); err != nil {
+		return nil, err
+	}
+
+	return endpoint, nil
+}
+
+func (handler *Handler) snapshotAndPersistEndpoint(tx dataservices.DataStoreTx, endpoint *portainer.Endpoint) *httperror.HandlerError {
+	if err := handler.SnapshotService.SnapshotEndpoint(endpoint); err != nil {
+		if (endpoint.Type == portainer.AgentOnDockerEnvironment && strings.Contains(err.Error(), "Invalid request signature")) ||
+			(endpoint.Type == portainer.AgentOnKubernetesEnvironment && strings.Contains(err.Error(), "unknown")) {
+			err = errors.New("agent already paired with another Portainer instance")
+		}
+
+		return httperror.InternalServerError("Unable to initiate communications with environment", err)
+	}
+
+	if err := handler.saveEndpointAndUpdateAuthorizations(tx, endpoint); err != nil {
+		return httperror.InternalServerError("An error occurred while trying to create the environment", err)
+	}
+
+	return nil
+}
+
+func (handler *Handler) saveEndpointAndUpdateAuthorizations(tx dataservices.DataStoreTx, endpoint *portainer.Endpoint) error {
+	endpoint.SecuritySettings = portainer.DefaultEndpointSecuritySettings()
+
+	if err := tx.Endpoint().Create(endpoint); err != nil {
+		return err
+	}
+
+	if err := endpointutils.InitializeEdgeEndpointRelation(endpoint, tx); err != nil {
+		return err
+	}
+
+	for _, tagID := range endpoint.TagIDs {
+		if err := tx.Tag().UpdateTagFunc(tagID, func(tag *portainer.Tag) {
+			tag.Endpoints[endpoint.ID] = true
+		}); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (handler *Handler) storeTLSFiles(endpoint *portainer.Endpoint, payload *endpointCreatePayload) *httperror.HandlerError {
+	folder := strconv.Itoa(int(endpoint.ID))
+
+	if !payload.TLSSkipVerify {
+		caCertPath, err := handler.FileService.StoreTLSFileFromBytes(folder, portainer.TLSFileCA, payload.TLSCACertFile)
+		if err != nil {
+			return httperror.InternalServerError("Unable to persist TLS CA certificate file on disk", err)
+		}
+
+		endpoint.TLSConfig.TLSCACertPath = caCertPath
+	}
+
+	if payload.TLSSkipClientVerify {
+		return nil
+	}
+
+	certPath, err := handler.FileService.StoreTLSFileFromBytes(folder, portainer.TLSFileCert, payload.TLSCertFile)
+	if err != nil {
+		return httperror.InternalServerError("Unable to persist TLS certificate file on disk", err)
+	}
+
+	endpoint.TLSConfig.TLSCertPath = certPath
+
+	keyPath, err := handler.FileService.StoreTLSFileFromBytes(folder, portainer.TLSFileKey, payload.TLSKeyFile)
+	if err != nil {
+		return httperror.InternalServerError("Unable to persist TLS key file on disk", err)
+	}
+	endpoint.TLSConfig.TLSKeyPath = keyPath
+
+	return nil
+}
diff --git a/api/http/handler/endpoints/endpoint_create_global_key.go b/api/http/handler/endpoints/endpoint_create_global_key.go
new file mode 100644
index 0000000..5593493
--- /dev/null
+++ b/api/http/handler/endpoints/endpoint_create_global_key.go
@@ -0,0 +1,37 @@
+package endpoints
+
+import (
+	"errors"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type endpointCreateGlobalKeyResponse struct {
+	EndpointID portainer.EndpointID `json:"endpointID"`
+}
+
+// @id EndpointCreateGlobalKey
+// @summary Create or retrieve the endpoint for an EdgeID
+// @tags endpoints
+// @success 200 {object} endpointCreateGlobalKeyResponse "Success"
+// @failure 400 "Invalid request"
+// @failure 500 "Server error"
+// @router /endpoints/global-key [post]
+func (handler *Handler) endpointCreateGlobalKey(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	edgeID := r.Header.Get(portainer.PortainerAgentEdgeIDHeader)
+	if edgeID == "" {
+		return httperror.BadRequest("Invalid Edge ID", errors.New("the Edge ID cannot be empty"))
+	}
+
+	// Search for existing endpoints for the given edgeID
+
+	endpointID, ok := handler.DataStore.Endpoint().EndpointIDByEdgeID(edgeID)
+	if ok {
+		return response.JSON(w, endpointCreateGlobalKeyResponse{endpointID})
+	}
+
+	return httperror.NotFound("Unable to find the endpoint in the database", nil)
+}
diff --git a/api/http/handler/endpoints/endpoint_create_global_key_test.go b/api/http/handler/endpoints/endpoint_create_global_key_test.go
new file mode 100644
index 0000000..bdde9d8
--- /dev/null
+++ b/api/http/handler/endpoints/endpoint_create_global_key_test.go
@@ -0,0 +1,29 @@
+package endpoints
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+)
+
+func TestEmptyGlobalKey(t *testing.T) {
+	t.Parallel()
+	handler := NewHandler(testhelpers.NewTestRequestBouncer())
+
+	req, err := http.NewRequest(http.MethodPost, "https://portainer.io:9443/endpoints/global-key", nil)
+	if err != nil {
+		t.Fatal("request error:", err)
+	}
+	req.Header.Set(portainer.PortainerAgentEdgeIDHeader, "")
+
+	rec := httptest.NewRecorder()
+
+	handler.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusBadRequest {
+		t.Fatal("expected a 400 response, found:", rec.Code)
+	}
+}
diff --git a/api/http/handler/endpoints/endpoint_create_test.go b/api/http/handler/endpoints/endpoint_create_test.go
new file mode 100644
index 0000000..d0cd5d1
--- /dev/null
+++ b/api/http/handler/endpoints/endpoint_create_test.go
@@ -0,0 +1,230 @@
+package endpoints
+
+import (
+	"net/http"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/chisel"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+	"github.com/portainer/portainer/pkg/fips"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// EE-only kubeconfig validation tests removed for CE
+
+func TestSaveEndpointAndUpdateAuthorizations(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, true, false)
+
+	endpointGroup := &portainer.EndpointGroup{
+		ID:   1,
+		Name: "test-endpoint-group",
+	}
+
+	err := store.EndpointGroup().Create(endpointGroup)
+	require.NoError(t, err)
+
+	h := &Handler{
+		DataStore: store,
+	}
+
+	testCases := []struct {
+		name           string
+		endpointType   portainer.EndpointType
+		expectRelation bool
+	}{
+		{
+			name:           "create azure environment, expect no relation to be created",
+			endpointType:   portainer.AzureEnvironment,
+			expectRelation: false,
+		},
+		{
+			name:           "create edge agent environment, expect relation to be created",
+			endpointType:   portainer.EdgeAgentOnDockerEnvironment,
+			expectRelation: true,
+		},
+		{
+			name:           "create kubernetes environment, expect no relation to be created",
+			endpointType:   portainer.KubernetesLocalEnvironment,
+			expectRelation: false,
+		},
+		{
+			name:           "create kubeconfig environment, expect no relation to be created",
+			endpointType:   portainer.AgentOnKubernetesEnvironment,
+			expectRelation: false,
+		},
+		{
+			name:           "create agent docker environment, expect no relation to be created",
+			endpointType:   portainer.AgentOnDockerEnvironment,
+			expectRelation: false,
+		},
+		{
+			name:           "create unsecured environment, expect no relation to be created",
+			endpointType:   portainer.DockerEnvironment,
+			expectRelation: false,
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			endpoint := &portainer.Endpoint{
+				ID:      portainer.EndpointID(store.Endpoint().GetNextIdentifier()),
+				Type:    testCase.endpointType,
+				GroupID: endpointGroup.ID,
+			}
+
+			err := h.saveEndpointAndUpdateAuthorizations(store, endpoint)
+			require.NoError(t, err)
+
+			relation, relationErr := store.EndpointRelation().EndpointRelation(endpoint.ID)
+			if testCase.expectRelation {
+				require.NoError(t, relationErr)
+				require.NotNil(t, relation)
+			} else {
+				require.Error(t, relationErr)
+				require.True(t, store.IsErrObjectNotFound(relationErr))
+				require.Nil(t, relation)
+			}
+		})
+	}
+}
+
+func TestCreateEndpointFailure(t *testing.T) {
+	t.Parallel()
+	fips.InitFIPS(false)
+
+	_, store := datastore.MustNewTestStore(t, true, false)
+
+	h := NewHandler(testhelpers.NewTestRequestBouncer())
+	h.DataStore = store
+
+	payload := &endpointCreatePayload{
+		Name:                 "Test Endpoint",
+		EndpointCreationType: agentEnvironment,
+		TLS:                  true,
+		TLSCertFile:          []byte("invalid data"),
+		TLSKeyFile:           []byte("invalid data"),
+	}
+
+	endpoint, httpErr := h.createEndpoint(store, payload)
+	require.NotNil(t, httpErr)
+	require.Equal(t, http.StatusInternalServerError, httpErr.StatusCode)
+	require.Nil(t, endpoint)
+}
+
+func TestValidateEndpointCreatePayload_TLS(t *testing.T) {
+	t.Parallel()
+	fips.InitFIPS(false)
+
+	testCases := []struct {
+		name          string
+		formValues    map[string][]string
+		expectedError string
+	}{
+		{
+			name: "edge agent env with TLS rejected",
+			formValues: map[string][]string{
+				"Name":                 {"Test Endpoint"},
+				"EndpointCreationType": {"4"},
+				"TLS":                  {"true"},
+			},
+			expectedError: "TLS is not supported for Edge Agent environments",
+		},
+		{
+			name: "edge agent env without TLS succeeds",
+			formValues: map[string][]string{
+				"Name":                 {"Test Endpoint"},
+				"EndpointCreationType": {"4"},
+				"URL":                  {"https://portainer.example:9443"},
+			},
+			expectedError: "",
+		},
+		{
+			name: "non-edge agent env with TLS allowed",
+			formValues: map[string][]string{
+				"Name":                 {"Test Endpoint"},
+				"EndpointCreationType": {"2"},
+				"TLS":                  {"true"},
+				"TLSSkipVerify":        {"true"},
+				"TLSSkipClientVerify":  {"true"},
+			},
+			expectedError: "",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			r := http.Request{Form: tc.formValues}
+			p := &endpointCreatePayload{}
+			err := p.Validate(&r)
+
+			if tc.expectedError == "" {
+				require.NoError(t, err)
+			} else {
+				require.EqualError(t, err, tc.expectedError)
+			}
+		})
+	}
+}
+
+func TestCreateEdgeAgentEndpoint_ContainerEngineMapping(t *testing.T) {
+	t.Parallel()
+	fips.InitFIPS(false)
+
+	_, store := datastore.MustNewTestStore(t, true, false)
+
+	// required group for save flow
+	endpointGroup := &portainer.EndpointGroup{ID: 1, Name: "test-group"}
+	err := store.EndpointGroup().Create(endpointGroup)
+	require.NoError(t, err)
+
+	h := &Handler{
+		DataStore:            store,
+		ReverseTunnelService: chisel.NewService(store, nil, nil),
+	}
+
+	tests := []struct {
+		name     string
+		engine   string
+		wantType portainer.EndpointType
+	}{
+		{
+			name:     "empty engine -> EdgeAgentOnKubernetesEnvironment",
+			engine:   "",
+			wantType: portainer.EdgeAgentOnKubernetesEnvironment,
+		},
+		{
+			name:     "docker engine -> EdgeAgentOnDockerEnvironment",
+			engine:   portainer.ContainerEngineDocker,
+			wantType: portainer.EdgeAgentOnDockerEnvironment,
+		},
+		{
+			name:     "podman engine -> EdgeAgentOnDockerEnvironment",
+			engine:   portainer.ContainerEnginePodman,
+			wantType: portainer.EdgeAgentOnDockerEnvironment,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			payload := &endpointCreatePayload{
+				Name:                 "edge-endpoint",
+				EndpointCreationType: edgeAgentEnvironment,
+				ContainerEngine:      tc.engine,
+				GroupID:              1,
+				URL:                  "https://portainer.example:9443",
+			}
+
+			ep, httpErr := h.createEdgeAgentEndpoint(store, payload)
+			require.Nil(t, httpErr)
+			require.NotNil(t, ep)
+
+			assert.Equal(t, tc.wantType, ep.Type)
+			assert.Equal(t, tc.engine, ep.ContainerEngine)
+		})
+	}
+}
diff --git a/api/http/handler/endpoints/endpoint_delete.go b/api/http/handler/endpoints/endpoint_delete.go
new file mode 100644
index 0000000..a468f12
--- /dev/null
+++ b/api/http/handler/endpoints/endpoint_delete.go
@@ -0,0 +1,251 @@
+package endpoints
+
+import (
+	"errors"
+	"net/http"
+	"strconv"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+
+	"github.com/rs/zerolog/log"
+)
+
+type endpointDeleteRequest struct {
+	ID            int  `json:"id"`
+	DeleteCluster bool `json:"deleteCluster"`
+}
+
+type endpointDeleteBatchPayload struct {
+	Endpoints []endpointDeleteRequest `json:"endpoints"`
+}
+
+type endpointDeleteBatchPartialResponse struct {
+	Deleted []int `json:"deleted"`
+	Errors  []int `json:"errors"`
+}
+
+func (payload *endpointDeleteBatchPayload) Validate(r *http.Request) error {
+	if payload == nil || len(payload.Endpoints) == 0 {
+		return errors.New("invalid request payload. You must provide a list of environments to delete")
+	}
+
+	return nil
+}
+
+// @id EndpointDelete
+// @summary Remove an environment
+// @description Remove the environment associated to the specified identifier and optionally clean-up associated resources.
+// @description **Access policy**: Administrator only.
+// @tags endpoints
+// @security ApiKeyAuth || jwt
+// @param id path int true "Environment(Endpoint) identifier"
+// @success 204 "Environment successfully deleted."
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 403 "Unauthorized access or operation not allowed."
+// @failure 404 "Unable to find the environment with the specified identifier inside the database."
+// @failure 500 "Server error occurred while attempting to delete the environment."
+// @router /endpoints/{id} [delete]
+func (handler *Handler) endpointDelete(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	endpointID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid environment identifier route variable", err)
+	}
+
+	// This is a Portainer provisioned cloud environment
+	deleteCluster, err := request.RetrieveBooleanQueryParameter(r, "deleteCluster", true)
+	if err != nil {
+		return httperror.BadRequest("Invalid boolean query parameter", err)
+	}
+
+	err = handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return handler.deleteEndpoint(tx, portainer.EndpointID(endpointID), deleteCluster)
+	})
+
+	return response.TxEmptyResponse(w, err)
+}
+
+// @id EndpointDeleteBatch
+// @summary Remove multiple environments
+// @description Remove multiple environments and optionally clean-up associated resources.
+// @description **Access policy**: Administrator only.
+// @tags endpoints
+// @security ApiKeyAuth || jwt
+// @accept json
+// @produce json
+// @param body body endpointDeleteBatchPayload true "List of environments to delete, with optional deleteCluster flag to clean-up associated resources (cloud environments only)"
+// @success 204 "Environment(s) successfully deleted."
+// @failure 207 {object} endpointDeleteBatchPartialResponse "Partial success. Some environments were deleted successfully, while others failed."
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 403 "Unauthorized access or operation not allowed."
+// @failure 500 "Server error occurred while attempting to delete the specified environments."
+// @router /endpoints/delete [post]
+func (handler *Handler) endpointDeleteBatch(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	var p endpointDeleteBatchPayload
+	if err := request.DecodeAndValidateJSONPayload(r, &p); err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	resp := endpointDeleteBatchPartialResponse{
+		Deleted: []int{},
+		Errors:  []int{},
+	}
+
+	if err := handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		for _, e := range p.Endpoints {
+			if err := handler.deleteEndpoint(tx, portainer.EndpointID(e.ID), e.DeleteCluster); err != nil {
+				resp.Errors = append(resp.Errors, e.ID)
+				log.Warn().Err(err).Int("environment_id", e.ID).Msg("Unable to remove environment")
+
+				continue
+			}
+
+			resp.Deleted = append(resp.Deleted, e.ID)
+		}
+
+		return nil
+	}); err != nil {
+		return httperror.InternalServerError("Unable to delete environments", err)
+	}
+
+	if len(resp.Errors) > 0 {
+		return response.JSONWithStatus(w, resp, http.StatusPartialContent)
+	}
+
+	return response.Empty(w)
+}
+
+// @id EndpointDeleteBatchDeprecated
+// @summary Remove multiple environments
+// @deprecated
+// @description Deprecated: use the `POST` endpoint instead.
+// @description Remove multiple environments and optionally clean-up associated resources.
+// @description **Access policy**: Administrator only.
+// @tags endpoints
+// @security ApiKeyAuth || jwt
+// @accept json
+// @produce json
+// @param body body endpointDeleteBatchPayload true "List of environments to delete, with optional deleteCluster flag to clean-up associated resources (cloud environments only)"
+// @success 204 "Environment(s) successfully deleted."
+// @failure 207 {object} endpointDeleteBatchPartialResponse "Partial success. Some environments were deleted successfully, while others failed."
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 403 "Unauthorized access or operation not allowed."
+// @failure 500 "Server error occurred while attempting to delete the specified environments."
+// @router /endpoints [delete]
+func (handler *Handler) endpointDeleteBatchDeprecated(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	return handler.endpointDeleteBatch(w, r)
+}
+
+func (handler *Handler) deleteEndpoint(tx dataservices.DataStoreTx, endpointID portainer.EndpointID, deleteCluster bool) error {
+	endpoint, err := tx.Endpoint().Endpoint(endpointID)
+	if tx.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find an environment with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to read the environment record from the database", err)
+	}
+
+	if endpoint.TLSConfig.TLS {
+		folder := strconv.Itoa(int(endpointID))
+		if err := handler.FileService.DeleteTLSFiles(folder); err != nil {
+			log.Error().Err(err).Msgf("Unable to remove TLS files from disk when deleting endpoint %d", endpointID)
+		}
+	}
+
+	if err := tx.Snapshot().Delete(endpointID); err != nil {
+		log.Warn().Err(err).Msg("Unable to remove the snapshot from the database")
+	}
+
+	handler.ProxyManager.DeleteEndpointProxy(endpoint.ID)
+
+	if err := tx.EndpointRelation().DeleteEndpointRelation(endpoint.ID); err != nil {
+		log.Warn().Err(err).Msg("Unable to remove environment relation from the database")
+	}
+
+	for _, tagID := range endpoint.TagIDs {
+		var tag *portainer.Tag
+		tag, err = tx.Tag().Read(tagID)
+		if err == nil {
+			delete(tag.Endpoints, endpoint.ID)
+			err = tx.Tag().Update(tagID, tag)
+		}
+
+		if tx.IsErrObjectNotFound(err) {
+			log.Warn().Err(err).Msg("Unable to find tag inside the database")
+		} else if err != nil {
+			log.Warn().Err(err).Msg("Unable to delete tag relation from the database")
+		}
+	}
+
+	edgeGroups, err := tx.EdgeGroup().ReadAll()
+	if err != nil {
+		log.Warn().Err(err).Msgf("Unable to retrieve edge groups from the database")
+	}
+
+	for _, edgeGroup := range edgeGroups {
+		edgeGroup.EndpointIDs.Remove(endpoint.ID)
+
+		if err := tx.EdgeGroup().Update(edgeGroup.ID, &edgeGroup); err != nil {
+			log.Warn().Err(err).Msg("Unable to update edge group")
+		}
+	}
+
+	edgeStacks, err := tx.EdgeStack().EdgeStacks()
+	if err != nil {
+		log.Warn().Err(err).Msg("Unable to retrieve edge stacks from the database")
+	}
+
+	for _, edgeStack := range edgeStacks {
+		if err := tx.EdgeStackStatus().Delete(edgeStack.ID, endpoint.ID); err != nil {
+			log.Warn().Err(err).Msg("Unable to delete edge stack status")
+		}
+	}
+
+	registries, err := tx.Registry().ReadAll()
+	if err != nil {
+		log.Warn().Err(err).Msg("Unable to retrieve registries from the database")
+	}
+
+	for idx := range registries {
+		registry := &registries[idx]
+		if _, ok := registry.RegistryAccesses[endpoint.ID]; ok {
+			delete(registry.RegistryAccesses, endpoint.ID)
+
+			if err := tx.Registry().Update(registry.ID, registry); err != nil {
+				log.Warn().Err(err).Msg("Unable to update registry accesses")
+			}
+		}
+	}
+
+	if endpointutils.IsEdgeEndpoint(endpoint) {
+		edgeJobs, err := tx.EdgeJob().ReadAll()
+		if err != nil {
+			log.Warn().Err(err).Msg("Unable to retrieve edge jobs from the database")
+		}
+
+		for idx := range edgeJobs {
+			edgeJob := &edgeJobs[idx]
+			if _, ok := edgeJob.Endpoints[endpoint.ID]; ok {
+				delete(edgeJob.Endpoints, endpoint.ID)
+
+				if err := tx.EdgeJob().Update(edgeJob.ID, edgeJob); err != nil {
+					log.Warn().Err(err).Msg("Unable to update edge job")
+				}
+			}
+		}
+	}
+
+	// delete the pending actions
+	if err := tx.PendingActions().DeleteByEndpointID(endpoint.ID); err != nil {
+		log.Warn().Err(err).Int("endpointId", int(endpoint.ID)).Msg("Unable to delete pending actions")
+	}
+
+	if err := tx.Endpoint().DeleteEndpoint(endpointID); err != nil {
+		return httperror.InternalServerError("Unable to delete the environment from the database", err)
+	}
+
+	return nil
+}
diff --git a/api/http/handler/endpoints/endpoint_delete_test.go b/api/http/handler/endpoints/endpoint_delete_test.go
new file mode 100644
index 0000000..8537d3b
--- /dev/null
+++ b/api/http/handler/endpoints/endpoint_delete_test.go
@@ -0,0 +1,86 @@
+package endpoints
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"sync"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/http/proxy"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+	"github.com/portainer/portainer/api/roar"
+)
+
+func TestEndpointDeleteEdgeGroupsConcurrently(t *testing.T) {
+	t.Parallel()
+	const endpointsCount = 100
+
+	_, store := datastore.MustNewTestStore(t, true, false)
+
+	handler := NewHandler(testhelpers.NewTestRequestBouncer())
+	handler.DataStore = store
+	handler.ProxyManager = proxy.NewManager(nil)
+	handler.ProxyManager.NewProxyFactory(nil, nil, nil, nil, nil, nil, nil, nil, nil)
+
+	// Create all the environments and add them to the same edge group
+
+	var endpointIDs []portainer.EndpointID
+
+	for i := range endpointsCount {
+		endpointID := portainer.EndpointID(i) + 1
+
+		if err := store.Endpoint().Create(&portainer.Endpoint{
+			ID:   endpointID,
+			Name: "env-" + strconv.Itoa(int(endpointID)),
+			Type: portainer.EdgeAgentOnDockerEnvironment,
+		}); err != nil {
+			t.Fatal("could not create endpoint:", err)
+		}
+
+		endpointIDs = append(endpointIDs, endpointID)
+	}
+
+	if err := store.EdgeGroup().Create(&portainer.EdgeGroup{
+		ID:          1,
+		Name:        "edgegroup-1",
+		EndpointIDs: roar.FromSlice(endpointIDs),
+	}); err != nil {
+		t.Fatal("could not create edge group:", err)
+	}
+
+	// Remove the environments concurrently
+
+	var wg sync.WaitGroup
+	wg.Add(len(endpointIDs))
+
+	for _, endpointID := range endpointIDs {
+		go func(ID portainer.EndpointID) {
+			defer wg.Done()
+
+			req, err := http.NewRequest(http.MethodDelete, "/endpoints/"+strconv.Itoa(int(ID)), nil)
+			if err != nil {
+				t.Fail()
+				return
+			}
+
+			rec := httptest.NewRecorder()
+			handler.ServeHTTP(rec, req)
+		}(endpointID)
+	}
+
+	wg.Wait()
+
+	// Check that the edge group is consistent
+
+	edgeGroup, err := handler.DataStore.EdgeGroup().Read(1)
+	if err != nil {
+		t.Fatal("could not retrieve the edge group:", err)
+	}
+
+	if edgeGroup.EndpointIDs.Len() > 0 {
+		t.Fatal("the edge group is not consistent")
+	}
+}
diff --git a/api/http/handler/endpoints/endpoint_dockerhub_status.go b/api/http/handler/endpoints/endpoint_dockerhub_status.go
new file mode 100644
index 0000000..e028d21
--- /dev/null
+++ b/api/http/handler/endpoints/endpoint_dockerhub_status.go
@@ -0,0 +1,200 @@
+package endpoints
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"strconv"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/client"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/rs/zerolog/log"
+
+	"github.com/segmentio/encoding/json"
+)
+
+type dockerhubStatusResponse struct {
+	// Remaiming images to pull
+	Remaining int `json:"remaining"`
+	// Daily limit
+	Limit int `json:"limit"`
+}
+
+// @id endpointDockerhubStatus
+// @summary fetch docker pull limits
+// @description get docker pull limits for a docker hub registry in the environment
+// @description **Access policy**:
+// @tags endpoints
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param id path int true "endpoint ID"
+// @param registryId path int true "registry ID"
+// @success 200 {object} dockerhubStatusResponse "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied"
+// @failure 404 "registry or endpoint not found"
+// @failure 500 "Server error"
+// @router /endpoints/{id}/dockerhub/{registryId} [get]
+func (handler *Handler) endpointDockerhubStatus(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	endpointID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid environment identifier route variable", err)
+	}
+
+	endpoint, err := handler.DataStore.Endpoint().Endpoint(portainer.EndpointID(endpointID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find an environment with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find an environment with the specified identifier inside the database", err)
+	}
+
+	if !endpointutils.IsLocalEndpoint(endpoint) {
+		return httperror.BadRequest("Invalid environment type", errors.New("Invalid environment type"))
+	}
+
+	registryID, err := request.RetrieveNumericRouteVariableValue(r, "registryId")
+	if err != nil {
+		return httperror.BadRequest("Invalid registry identifier route variable", err)
+	}
+
+	var registry *portainer.Registry
+
+	if registryID == 0 {
+		registry = &portainer.Registry{}
+	} else {
+		registry, err = handler.DataStore.Registry().Read(portainer.RegistryID(registryID))
+		if handler.DataStore.IsErrObjectNotFound(err) {
+			return httperror.NotFound("Unable to find a registry with the specified identifier inside the database", err)
+		} else if err != nil {
+			return httperror.InternalServerError("Unable to find a registry with the specified identifier inside the database", err)
+		}
+
+		if registry.Type != portainer.DockerHubRegistry {
+			return httperror.BadRequest("Invalid registry type", errors.New("Invalid registry type"))
+		}
+	}
+
+	if handler.PullLimitCheckDisabled {
+		return response.JSON(w, &dockerhubStatusResponse{
+			Limit:     10,
+			Remaining: 10,
+		})
+	}
+
+	httpClient := client.NewHTTPClient()
+	token, err := getDockerHubToken(httpClient, registry)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve DockerHub token from DockerHub", err)
+	}
+
+	resp, err := getDockerHubLimits(httpClient, token)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve DockerHub rate limits from DockerHub", err)
+	}
+
+	return response.JSON(w, resp)
+}
+
+func getDockerHubToken(httpClient *client.HTTPClient, registry *portainer.Registry) (string, error) {
+	type dockerhubTokenResponse struct {
+		Token string `json:"token"`
+	}
+
+	requestURL := "https://auth.docker.io/token?service=registry.docker.io&scope=repository:ratelimitpreview/test:pull"
+
+	req, err := http.NewRequest(http.MethodGet, requestURL, nil)
+	if err != nil {
+		return "", err
+	}
+
+	if registry.Authentication {
+		req.SetBasicAuth(registry.Username, registry.Password)
+	}
+
+	resp, err := httpClient.Do(req)
+	if err != nil {
+		return "", err
+	}
+	defer func() {
+		if err := resp.Body.Close(); err != nil {
+			log.Warn().Err(err).Msg("failed to close response body")
+		}
+	}()
+
+	if resp.StatusCode != http.StatusOK {
+		return "", errors.New("failed fetching dockerhub token")
+	}
+
+	var data dockerhubTokenResponse
+	if err := json.NewDecoder(resp.Body).Decode(&data); err != nil {
+		return "", err
+	}
+
+	return data.Token, nil
+}
+
+func getDockerHubLimits(httpClient *client.HTTPClient, token string) (*dockerhubStatusResponse, error) {
+	requestURL := "https://registry-1.docker.io/v2/ratelimitpreview/test/manifests/latest"
+
+	req, err := http.NewRequest(http.MethodHead, requestURL, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	req.Header.Add("Authorization", "Bearer "+token)
+
+	resp, err := httpClient.Do(req)
+	if err != nil {
+		return nil, err
+	}
+
+	_, _ = io.Copy(io.Discard, resp.Body)
+
+	if err := resp.Body.Close(); err != nil {
+		log.Warn().Err(err).Msg("failed to close response body")
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, errors.New("failed fetching dockerhub limits")
+	}
+
+	// An error with rateLimit-Limit or RateLimit-Remaining is likely for dockerhub pro accounts where there is no rate limit.
+	// In that specific case the headers will not be present.  Don't bubble up the error as its normal
+	// See: https://docs.docker.com/docker-hub/download-rate-limit/
+	rateLimit, err := parseRateLimitHeader(resp.Header, "RateLimit-Limit")
+	if err != nil {
+		return nil, nil
+	}
+
+	rateLimitRemaining, err := parseRateLimitHeader(resp.Header, "RateLimit-Remaining")
+	if err != nil {
+		return nil, nil
+	}
+
+	return &dockerhubStatusResponse{
+		Limit:     rateLimit,
+		Remaining: rateLimitRemaining,
+	}, nil
+}
+
+func parseRateLimitHeader(headers http.Header, headerKey string) (int, error) {
+	headerValue := headers.Get(headerKey)
+	if headerValue == "" {
+		return 0, fmt.Errorf("Missing %s header", headerKey)
+	}
+
+	matches := strings.Split(headerValue, ";")
+	value, err := strconv.Atoi(matches[0])
+	if err != nil {
+		return 0, err
+	}
+
+	return value, nil
+}
diff --git a/api/http/handler/endpoints/endpoint_force_update_service.go b/api/http/handler/endpoints/endpoint_force_update_service.go
new file mode 100644
index 0000000..8543f4c
--- /dev/null
+++ b/api/http/handler/endpoints/endpoint_force_update_service.go
@@ -0,0 +1,125 @@
+package endpoints
+
+import (
+	"context"
+	"net/http"
+	"strings"
+
+	portaineree "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/docker/consts"
+	"github.com/portainer/portainer/api/docker/images"
+	"github.com/portainer/portainer/api/logs"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/rs/zerolog/log"
+
+	dockertypes "github.com/docker/docker/api/types"
+	"github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/api/types/filters"
+)
+
+type forceUpdateServicePayload struct {
+	// ServiceId to update
+	ServiceID string
+	// PullImage if true will pull the image
+	PullImage bool
+}
+
+func (payload *forceUpdateServicePayload) Validate(r *http.Request) error {
+	return nil
+}
+
+// @id endpointForceUpdateService
+// @summary force update a docker service
+// @description force update a docker service
+// @description **Access policy**: authenticated
+// @tags endpoints
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @produce json
+// @param id path int true "endpoint identifier"
+// @param body body forceUpdateServicePayload true "details"
+// @success 200 {object} swarm.ServiceUpdateResponse "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied"
+// @failure 404 "endpoint not found"
+// @failure 500 "Server error"
+// @router /endpoints/{id}/forceupdateservice [put]
+func (handler *Handler) endpointForceUpdateService(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	endpointID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid environment identifier route variable", err)
+	}
+
+	var payload forceUpdateServicePayload
+	err = request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	endpoint, err := handler.DataStore.Endpoint().Endpoint(portaineree.EndpointID(endpointID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find an environment with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find an environment with the specified identifier inside the database", err)
+	}
+
+	err = handler.requestBouncer.AuthorizedEndpointOperation(r, endpoint)
+	if err != nil {
+		return httperror.Forbidden("Permission denied to force update service", err)
+	}
+
+	dockerClient, err := handler.DockerClientFactory.CreateClient(endpoint, "", nil)
+	if err != nil {
+		return httperror.InternalServerError("Error creating docker client", err)
+	}
+	closeClient := true
+	defer func() {
+		if closeClient {
+			logs.CloseAndLogErr(dockerClient)
+		}
+	}()
+
+	service, _, err := dockerClient.ServiceInspectWithRaw(context.Background(), payload.ServiceID, dockertypes.ServiceInspectOptions{InsertDefaults: true})
+	if err != nil {
+		return httperror.InternalServerError("Error looking up service", err)
+	}
+
+	service.Spec.TaskTemplate.ForceUpdate++
+
+	if payload.PullImage {
+		service.Spec.TaskTemplate.ContainerSpec.Image = strings.Split(service.Spec.TaskTemplate.ContainerSpec.Image, "@sha")[0]
+	}
+
+	newService, err := dockerClient.ServiceUpdate(context.Background(), payload.ServiceID, service.Version, service.Spec, dockertypes.ServiceUpdateOptions{QueryRegistry: true})
+	if err != nil {
+		return httperror.InternalServerError("Error force update service", err)
+	}
+
+	// The goroutine will close the client
+	closeClient = false
+
+	go func() {
+		defer logs.CloseAndLogErr(dockerClient)
+
+		images.EvictImageStatus(payload.ServiceID)
+		images.EvictImageStatus(service.Spec.Labels[consts.SwarmStackNameLabel])
+
+		// ignore errors from this cleanup function, log them instead
+		containers, err := dockerClient.ContainerList(context.TODO(), container.ListOptions{
+			All:     true,
+			Filters: filters.NewArgs(filters.Arg("label", consts.SwarmServiceIDLabel+"="+payload.ServiceID)),
+		})
+		if err != nil {
+			log.Warn().Err(err).Str("Environment", endpoint.Name).Msg("Error listing containers")
+		}
+
+		for _, container := range containers {
+			images.EvictImageStatus(container.ID)
+		}
+	}()
+
+	return response.JSON(w, newService)
+}
diff --git a/api/http/handler/endpoints/endpoint_inspect.go b/api/http/handler/endpoints/endpoint_inspect.go
new file mode 100644
index 0000000..81d2cb2
--- /dev/null
+++ b/api/http/handler/endpoints/endpoint_inspect.go
@@ -0,0 +1,88 @@
+package endpoints
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/rs/zerolog/log"
+)
+
+// @id EndpointInspect
+// @summary Inspect an environment(endpoint)
+// @description Retrieve details about an environment(endpoint).
+// @description **Access policy**: restricted
+// @tags endpoints
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param id path int true "Environment(Endpoint) identifier"
+// @param excludeSnapshot query bool false "if true, the snapshot data won't be retrieved"
+// @success 200 {object} portainer.Endpoint "Success"
+// @failure 400 "Invalid request"
+// @failure 404 "Environment(Endpoint) not found"
+// @failure 500 "Server error"
+// @router /endpoints/{id} [get]
+func (handler *Handler) endpointInspect(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	endpointID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid environment identifier route variable", err)
+	}
+
+	endpoint, err := handler.DataStore.Endpoint().Endpoint(portainer.EndpointID(endpointID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find an environment with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find an environment with the specified identifier inside the database", err)
+	}
+
+	if err := handler.requestBouncer.AuthorizedEndpointOperation(r, endpoint); err != nil {
+		return httperror.Forbidden("Permission denied to access environment", err)
+	}
+
+	settings, err := handler.DataStore.Settings().Settings()
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve settings from the database", err)
+	}
+
+	hideFields(endpoint)
+	endpointutils.UpdateEdgeEndpointHeartbeat(endpoint, settings)
+	endpoint.ComposeSyntaxMaxVersion = handler.ComposeStackManager.ComposeSyntaxMaxVersion()
+
+	excludeSnapshot, _ := request.RetrieveBooleanQueryParameter(r, "excludeSnapshot", true)
+
+	if !excludeSnapshot {
+		if err := handler.SnapshotService.FillSnapshotData(endpoint, false); err != nil {
+			return httperror.InternalServerError("Unable to add snapshot data", err)
+		}
+	}
+
+	if endpointutils.IsKubernetesEndpoint(endpoint) {
+		isServerMetricsDetected := endpoint.Kubernetes.Flags.IsServerMetricsDetected
+		isServerStorageDetected := endpoint.Kubernetes.Flags.IsServerStorageDetected
+		if (!isServerMetricsDetected || !isServerStorageDetected) && handler.K8sClientFactory != nil {
+			if err := handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+				if !isServerMetricsDetected {
+					endpointutils.InitialMetricsDetection(tx, endpoint, handler.K8sClientFactory)
+				}
+
+				if !isServerStorageDetected {
+					endpointutils.InitialStorageDetection(tx, handler.DataStore, endpoint, handler.K8sClientFactory)
+				}
+
+				return nil
+			}); err != nil {
+				log.Err(err).Msg("failed to persist initial kube detection")
+			}
+		}
+	}
+
+	// Execute endpoint pending actions
+	handler.PendingActionsService.Execute(endpoint.ID)
+
+	return response.JSON(w, endpoint)
+}
diff --git a/api/http/handler/endpoints/endpoint_list.go b/api/http/handler/endpoints/endpoint_list.go
new file mode 100644
index 0000000..2996df8
--- /dev/null
+++ b/api/http/handler/endpoints/endpoint_list.go
@@ -0,0 +1,157 @@
+package endpoints
+
+import (
+	"net/http"
+	"strconv"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+const (
+	EdgeDeviceIntervalMultiplier = 2
+	EdgeDeviceIntervalAdd        = 20
+)
+
+// @id EndpointList
+// @summary List environments(endpoints)
+// @description List all environments(endpoints) based on the current user authorizations. Will
+// @description return all environments(endpoints) if using an administrator or team leader account otherwise it will
+// @description only return authorized environments(endpoints).
+// @description **Access policy**: restricted
+// @tags endpoints
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param start query int false "Start searching from"
+// @param limit query int false "Limit results to this value"
+// @param sort query sortKey false "Sort results by this value" Enum("Name", "Group", "Status", "LastCheckIn", "EdgeID")
+// @param order query string false "Order sorted results by desc/asc" Enum("asc", "desc")
+// @param search query string false "Search query"
+// @param groupIds query []int false "List environments(endpoints) of these groups"
+// @param status query []int false "List environments(endpoints) by this status"
+// @param types query []portainer.EndpointType false "List environments(endpoints) of this type"
+// @param platformTypes query []portainer.PlatformType false "Filter environments by platform type"
+// @param outdated query bool false "If true, return only environments with an outdated agent"
+// @param excludeGroupIds query []int false "Exclude environments of these groups"
+// @param tagIds query []int false "search environments(endpoints) with these tags (depends on tagsPartialMatch)"
+// @param tagsPartialMatch query bool false "If true, will return environment(endpoint) which has one of tagIds, if false (or missing) will return only environments(endpoints) that has all the tags"
+// @param endpointIds query []int false "will return only these environments(endpoints)"
+// @param excludeIds query []int false "will exclude these environments(endpoints)"
+// @param agentVersions query []string false "will return only environments with on of these agent versions"
+// @param edgeAsync query bool false "if exists true show only edge async agents, false show only standard edge agents. if missing, will show both types (relevant only for edge agents)"
+// @param edgeDeviceUntrusted query bool false "if true, show only untrusted edge agents, if false show only trusted edge agents (relevant only for edge agents)"
+// @param edgeCheckInPassedSeconds query number false "if bigger then zero, show only edge agents that checked-in in the last provided seconds (relevant only for edge agents)"
+// @param excludeSnapshots query bool false "if true, the snapshot data won't be retrieved"
+// @param name query string false "will return only environments(endpoints) with this name"
+// @param edgeStackId query int false "will return the environments of the specified edge stack"
+// @param edgeStackStatus query portainer.EdgeStackStatusType false "only applied when edgeStackId exists. Filter the returned environments based on their deployment status in the stack (not the environment status!)" Enum("Pending", "Ok", "Error", "Acknowledged", "Remove", "RemoteUpdateSuccess", "ImagesPulled")
+// @param edgeGroupIds query []int false "List environments(endpoints) of these edge groups"
+// @param excludeEdgeGroupIds query []int false "Exclude environments(endpoints) of these edge groups"
+// @success 200 {array} portainer.Endpoint "Endpoints"
+// @failure 500 "Server error"
+// @router /endpoints [get]
+func (handler *Handler) endpointList(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	start, _ := request.RetrieveNumericQueryParameter(r, "start", true)
+	if start != 0 {
+		start--
+	}
+
+	limit, _ := request.RetrieveNumericQueryParameter(r, "limit", true)
+	sortField, _ := request.RetrieveQueryParameter(r, "sort", true)
+	sortOrder, _ := request.RetrieveQueryParameter(r, "order", true)
+
+	endpointGroups, err := handler.DataStore.EndpointGroup().ReadAll()
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve environment groups from the database", err)
+	}
+
+	edgeGroups, err := handler.DataStore.EdgeGroup().ReadAll()
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve edge groups from the database", err)
+	}
+
+	endpoints, err := handler.DataStore.Endpoint().Endpoints()
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve environments from the database", err)
+	}
+
+	settings, err := handler.DataStore.Settings().Settings()
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve settings from the database", err)
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	query, err := parseQuery(r)
+	if err != nil {
+		return httperror.BadRequest("Invalid query parameters", err)
+	}
+
+	filteredEndpoints, totalAvailableEndpoints, err := handler.filterEndpointsByQuery(endpoints, query, endpointGroups, edgeGroups, settings, securityContext)
+	if err != nil {
+		return httperror.InternalServerError("Unable to filter endpoints", err)
+	}
+	filteredEndpoints = security.FilterEndpoints(filteredEndpoints, endpointGroups, securityContext)
+
+	sortEnvironmentsByField(filteredEndpoints, endpointGroups, getSortKey(sortField), sortOrder == "desc", settings)
+
+	filteredEndpointCount := len(filteredEndpoints)
+
+	paginatedEndpoints := paginateEndpoints(filteredEndpoints, start, limit)
+
+	for idx := range paginatedEndpoints {
+		hideFields(&paginatedEndpoints[idx])
+
+		paginatedEndpoints[idx].ComposeSyntaxMaxVersion = handler.ComposeStackManager.ComposeSyntaxMaxVersion()
+		if paginatedEndpoints[idx].EdgeCheckinInterval == 0 {
+			paginatedEndpoints[idx].EdgeCheckinInterval = settings.EdgeAgentCheckinInterval
+		}
+
+		endpointutils.UpdateEdgeEndpointHeartbeat(&paginatedEndpoints[idx], settings)
+
+		if !query.excludeSnapshots {
+			if err := handler.SnapshotService.FillSnapshotData(&paginatedEndpoints[idx], false); err != nil {
+				return httperror.InternalServerError("Unable to add snapshot data", err)
+			}
+		}
+	}
+
+	w.Header().Set("X-Total-Count", strconv.Itoa(filteredEndpointCount))
+	w.Header().Set("X-Total-Available", strconv.Itoa(totalAvailableEndpoints))
+
+	return response.JSON(w, paginatedEndpoints)
+}
+
+func paginateEndpoints(endpoints []portainer.Endpoint, start, limit int) []portainer.Endpoint {
+	if limit == 0 {
+		return endpoints
+	}
+
+	endpointCount := len(endpoints)
+
+	start = min(max(start, 0), endpointCount)
+	end := min(start+limit, endpointCount)
+
+	return endpoints[start:end]
+}
+
+func getEndpointGroup(groupID portainer.EndpointGroupID, groups []portainer.EndpointGroup) portainer.EndpointGroup {
+	var endpointGroup portainer.EndpointGroup
+	for _, group := range groups {
+		if group.ID == groupID {
+			endpointGroup = group
+
+			break
+		}
+	}
+
+	return endpointGroup
+}
diff --git a/api/http/handler/endpoints/endpoint_list_test.go b/api/http/handler/endpoints/endpoint_list_test.go
new file mode 100644
index 0000000..28e4d97
--- /dev/null
+++ b/api/http/handler/endpoints/endpoint_list_test.go
@@ -0,0 +1,239 @@
+package endpoints
+
+import (
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/snapshot"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type endpointListTest struct {
+	title    string
+	expected []portainer.EndpointID
+}
+
+func Test_EndpointList_AgentVersion(t *testing.T) {
+	t.Parallel()
+	version1Endpoint := portainer.Endpoint{
+		ID:      1,
+		GroupID: 1,
+		Type:    portainer.AgentOnDockerEnvironment,
+		Agent:   portainer.EnvironmentAgentData{Version: "1.0.0"},
+	}
+	version2Endpoint := portainer.Endpoint{
+		ID:      2,
+		GroupID: 1,
+		Type:    portainer.AgentOnDockerEnvironment,
+		Agent:   portainer.EnvironmentAgentData{Version: "2.0.0"},
+	}
+	noVersionEndpoint := portainer.Endpoint{ID: 3, Type: portainer.AgentOnDockerEnvironment, GroupID: 1}
+	notAgentEnvironments := portainer.Endpoint{ID: 4, Type: portainer.DockerEnvironment, GroupID: 1}
+
+	handler := setupEndpointListHandler(t, []portainer.Endpoint{
+		notAgentEnvironments,
+		version1Endpoint,
+		version2Endpoint,
+		noVersionEndpoint,
+	})
+
+	type endpointListAgentVersionTest struct {
+		endpointListTest
+		filter []string
+	}
+
+	tests := []endpointListAgentVersionTest{
+		{
+			endpointListTest{
+				"should show version 1 agent endpoints and non-agent endpoints",
+				[]portainer.EndpointID{version1Endpoint.ID, notAgentEnvironments.ID},
+			},
+			[]string{version1Endpoint.Agent.Version},
+		},
+		{
+			endpointListTest{
+				"should show version 2 endpoints and non-agent endpoints",
+				[]portainer.EndpointID{version2Endpoint.ID, notAgentEnvironments.ID},
+			},
+			[]string{version2Endpoint.Agent.Version},
+		},
+		{
+			endpointListTest{
+				"should show version 1 and 2 endpoints and non-agent endpoints",
+				[]portainer.EndpointID{version2Endpoint.ID, notAgentEnvironments.ID, version1Endpoint.ID},
+			},
+			[]string{version2Endpoint.Agent.Version, version1Endpoint.Agent.Version},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.title, func(t *testing.T) {
+			is := assert.New(t)
+
+			var query strings.Builder
+			for _, filter := range test.filter {
+				_, _ = query.WriteString("agentVersions[]=")
+				_, _ = query.WriteString(filter)
+				_, _ = query.WriteRune('&')
+			}
+
+			req := buildEndpointListRequest(query.String())
+
+			resp, err := doEndpointListRequest(req, handler, is)
+			require.NoError(t, err)
+
+			is.Len(resp, len(test.expected))
+
+			respIds := []portainer.EndpointID{}
+
+			for _, endpoint := range resp {
+				respIds = append(respIds, endpoint.ID)
+			}
+
+			is.ElementsMatch(test.expected, respIds)
+		})
+	}
+}
+
+func Test_endpointList_edgeFilter(t *testing.T) {
+	t.Parallel()
+	trustedEdgeAsync := portainer.Endpoint{ID: 1, UserTrusted: true, Edge: portainer.EnvironmentEdgeSettings{AsyncMode: true}, GroupID: 1, Type: portainer.EdgeAgentOnDockerEnvironment}
+	untrustedEdgeAsync := portainer.Endpoint{ID: 2, UserTrusted: false, Edge: portainer.EnvironmentEdgeSettings{AsyncMode: true}, GroupID: 1, Type: portainer.EdgeAgentOnDockerEnvironment}
+	regularUntrustedEdgeStandard := portainer.Endpoint{ID: 3, UserTrusted: false, Edge: portainer.EnvironmentEdgeSettings{AsyncMode: false}, GroupID: 1, Type: portainer.EdgeAgentOnDockerEnvironment}
+	regularTrustedEdgeStandard := portainer.Endpoint{ID: 4, UserTrusted: true, Edge: portainer.EnvironmentEdgeSettings{AsyncMode: false}, GroupID: 1, Type: portainer.EdgeAgentOnDockerEnvironment}
+	regularEndpoint := portainer.Endpoint{ID: 5, GroupID: 1, Type: portainer.DockerEnvironment}
+
+	handler := setupEndpointListHandler(t, []portainer.Endpoint{
+		trustedEdgeAsync,
+		untrustedEdgeAsync,
+		regularUntrustedEdgeStandard,
+		regularTrustedEdgeStandard,
+		regularEndpoint,
+	})
+
+	type endpointListEdgeTest struct {
+		endpointListTest
+		edgeAsync           *bool
+		edgeDeviceUntrusted bool
+	}
+
+	tests := []endpointListEdgeTest{
+		{
+			endpointListTest: endpointListTest{
+				"should show all endpoints expect of the untrusted devices",
+				[]portainer.EndpointID{trustedEdgeAsync.ID, regularTrustedEdgeStandard.ID, regularEndpoint.ID},
+			},
+		},
+		{
+			endpointListTest: endpointListTest{
+				"should show only trusted edge async agents and regular endpoints",
+				[]portainer.EndpointID{trustedEdgeAsync.ID, regularEndpoint.ID},
+			},
+			edgeAsync: new(true),
+		},
+		{
+			endpointListTest: endpointListTest{
+				"should show only untrusted edge devices and regular endpoints",
+				[]portainer.EndpointID{untrustedEdgeAsync.ID, regularEndpoint.ID},
+			},
+			edgeAsync:           new(true),
+			edgeDeviceUntrusted: true,
+		},
+		{
+			endpointListTest: endpointListTest{
+				"should show no edge devices",
+				[]portainer.EndpointID{regularEndpoint.ID, regularTrustedEdgeStandard.ID},
+			},
+			edgeAsync: new(false),
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.title, func(t *testing.T) {
+			is := assert.New(t)
+
+			query := fmt.Sprintf("edgeDeviceUntrusted=%v&", test.edgeDeviceUntrusted)
+			if test.edgeAsync != nil {
+				query += fmt.Sprintf("edgeAsync=%v&", *test.edgeAsync)
+			}
+
+			req := buildEndpointListRequest(query)
+			resp, err := doEndpointListRequest(req, handler, is)
+			require.NoError(t, err)
+
+			is.Len(resp, len(test.expected))
+
+			respIds := []portainer.EndpointID{}
+
+			for _, endpoint := range resp {
+				respIds = append(respIds, endpoint.ID)
+			}
+
+			is.ElementsMatch(test.expected, respIds)
+		})
+	}
+}
+
+func setupEndpointListHandler(t *testing.T, endpoints []portainer.Endpoint) *Handler {
+	_, store := datastore.MustNewTestStore(t, true, true)
+
+	for _, endpoint := range endpoints {
+		err := store.Endpoint().Create(&endpoint)
+		require.NoError(t, err, "error creating environment")
+	}
+
+	err := store.User().Create(&portainer.User{Username: "admin", Role: portainer.AdministratorRole})
+	require.NoError(t, err, "error creating a user")
+
+	bouncer := testhelpers.NewTestRequestBouncer()
+
+	handler := NewHandler(bouncer)
+	handler.DataStore = store
+	handler.ComposeStackManager = testhelpers.NewComposeStackManager()
+	handler.SnapshotService, _ = snapshot.NewService("1s", store, nil, nil, nil)
+
+	return handler
+}
+
+func buildEndpointListRequest(query string) *http.Request {
+	req := httptest.NewRequest(http.MethodGet, "/endpoints?"+query, nil)
+
+	ctx := security.StoreTokenData(req, &portainer.TokenData{ID: 1, Username: "admin", Role: 1})
+	req = req.WithContext(ctx)
+
+	restrictedCtx := security.StoreRestrictedRequestContext(req, &security.RestrictedRequestContext{UserID: 1, IsAdmin: true})
+	req = req.WithContext(restrictedCtx)
+
+	testhelpers.AddTestSecurityCookie(req, "Bearer dummytoken")
+
+	return req
+}
+
+func doEndpointListRequest(req *http.Request, h *Handler, is *assert.Assertions) ([]portainer.Endpoint, error) {
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, req)
+
+	is.Equal(http.StatusOK, rr.Code, "Status should be 200")
+	body, err := io.ReadAll(rr.Body)
+	if err != nil {
+		return nil, err
+	}
+
+	resp := []portainer.Endpoint{}
+	if err := json.Unmarshal(body, &resp); err != nil {
+		return nil, err
+	}
+
+	return resp, nil
+}
diff --git a/api/http/handler/endpoints/endpoint_registries_list.go b/api/http/handler/endpoints/endpoint_registries_list.go
new file mode 100644
index 0000000..6940576
--- /dev/null
+++ b/api/http/handler/endpoints/endpoint_registries_list.go
@@ -0,0 +1,219 @@
+package endpoints
+
+import (
+	"net/http"
+	"slices"
+
+	"github.com/pkg/errors"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+	"github.com/portainer/portainer/api/kubernetes"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id endpointRegistriesList
+// @summary List Registries on environment
+// @description List all registries based on the current user authorizations in current environment.
+// @description **Access policy**: authenticated
+// @tags endpoints
+// @param namespace query string false "required if kubernetes environment, will show registries by namespace"
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param id path int true "Environment(Endpoint) identifier"
+// @success 200 {array} portainer.Registry "Success"
+// @failure 500 "Server error"
+// @router /endpoints/{id}/registries [get]
+func (handler *Handler) endpointRegistriesList(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	endpointID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid environment identifier route variable", err)
+	}
+
+	var registries []portainer.Registry
+	err = handler.DataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
+		registries, err = handler.listRegistries(tx, r, portainer.EndpointID(endpointID))
+		return err
+	})
+
+	return response.TxResponse(w, registries, err)
+}
+
+func (handler *Handler) listRegistries(tx dataservices.DataStoreTx, r *http.Request, endpointID portainer.EndpointID) ([]portainer.Registry, error) {
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return nil, httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	user, err := tx.User().Read(securityContext.UserID)
+	if err != nil {
+		return nil, httperror.InternalServerError("Unable to retrieve user from the database", err)
+	}
+
+	endpoint, err := tx.Endpoint().Endpoint(endpointID)
+	if tx.IsErrObjectNotFound(err) {
+		return nil, httperror.NotFound("Unable to find an environment with the specified identifier inside the database", err)
+	} else if err != nil {
+		return nil, httperror.InternalServerError("Unable to find an environment with the specified identifier inside the database", err)
+	}
+
+	isAdmin := securityContext.IsAdmin
+
+	registries, err := tx.Registry().ReadAll()
+	if err != nil {
+		return nil, httperror.InternalServerError("Unable to retrieve registries from the database", err)
+	}
+
+	registries, handleError := handler.filterRegistriesByAccess(tx, r, registries, endpoint, user, securityContext.UserMemberships)
+	if handleError != nil {
+		return nil, handleError
+	}
+
+	for idx := range registries {
+		hideRegistryFields(&registries[idx], !isAdmin)
+	}
+
+	return registries, err
+}
+
+func (handler *Handler) filterRegistriesByAccess(tx dataservices.DataStoreTx, r *http.Request, registries []portainer.Registry, endpoint *portainer.Endpoint, user *portainer.User, memberships []portainer.TeamMembership) ([]portainer.Registry, *httperror.HandlerError) {
+	if !endpointutils.IsKubernetesEndpoint(endpoint) {
+		return security.FilterRegistries(registries, user, memberships, endpoint.ID), nil
+	}
+
+	return handler.filterKubernetesEndpointRegistries(tx, r, registries, endpoint, user, memberships)
+}
+
+func (handler *Handler) filterKubernetesEndpointRegistries(tx dataservices.DataStoreTx, r *http.Request, registries []portainer.Registry, endpoint *portainer.Endpoint, user *portainer.User, memberships []portainer.TeamMembership) ([]portainer.Registry, *httperror.HandlerError) {
+	namespaceParam, _ := request.RetrieveQueryParameter(r, "namespace", true)
+	isAdmin, err := security.IsAdmin(r)
+	if err != nil {
+		return nil, httperror.InternalServerError("Unable to check user role", err)
+	}
+
+	if namespaceParam != "" {
+		if authorized, err := handler.isNamespaceAuthorized(endpoint, namespaceParam, user.ID, memberships, isAdmin); err != nil {
+			return nil, httperror.NotFound("Unable to check for namespace authorization", err)
+		} else if !authorized {
+			return nil, httperror.Forbidden("User is not authorized to use namespace", errors.New("user is not authorized to use namespace"))
+		}
+
+		return filterRegistriesByNamespaces(registries, endpoint.ID, []string{namespaceParam}), nil
+	}
+
+	if isAdmin {
+		return registries, nil
+	}
+
+	return handler.filterKubernetesRegistriesByUserRole(tx, r, registries, endpoint, user)
+}
+
+func (handler *Handler) isNamespaceAuthorized(endpoint *portainer.Endpoint, namespace string, userId portainer.UserID, memberships []portainer.TeamMembership, isAdmin bool) (bool, error) {
+	if isAdmin || namespace == "" {
+		return true, nil
+	}
+
+	if !endpoint.Kubernetes.Configuration.RestrictDefaultNamespace && namespace == kubernetes.DefaultNamespace {
+		return true, nil
+	}
+
+	kcl, err := handler.K8sClientFactory.GetPrivilegedKubeClient(endpoint)
+	if err != nil {
+		return false, errors.Wrap(err, "unable to retrieve kubernetes client")
+	}
+
+	accessPolicies, err := kcl.GetNamespaceAccessPolicies()
+	if err != nil {
+		return false, errors.Wrap(err, "unable to retrieve environment's namespaces policies")
+	}
+
+	namespacePolicy, ok := accessPolicies[namespace]
+	if !ok {
+		return false, nil
+	}
+
+	return security.AuthorizedAccess(userId, memberships, namespacePolicy.UserAccessPolicies, namespacePolicy.TeamAccessPolicies), nil
+}
+
+func filterRegistriesByNamespaces(registries []portainer.Registry, endpointId portainer.EndpointID, namespaces []string) []portainer.Registry {
+	filteredRegistries := []portainer.Registry{}
+
+	for _, registry := range registries {
+		if registryAccessPoliciesContainsNamespace(registry.RegistryAccesses[endpointId], namespaces) {
+			filteredRegistries = append(filteredRegistries, registry)
+		}
+	}
+
+	return filteredRegistries
+}
+
+func registryAccessPoliciesContainsNamespace(registryAccess portainer.RegistryAccessPolicies, namespaces []string) bool {
+	for _, authorizedNamespace := range registryAccess.Namespaces {
+		if slices.Contains(namespaces, authorizedNamespace) {
+			return true
+		}
+	}
+	return false
+}
+
+func (handler *Handler) filterKubernetesRegistriesByUserRole(tx dataservices.DataStoreTx, r *http.Request, registries []portainer.Registry, endpoint *portainer.Endpoint, user *portainer.User) ([]portainer.Registry, *httperror.HandlerError) {
+	err := handler.requestBouncer.AuthorizedEndpointOperation(r, endpoint)
+	if errors.Is(err, security.ErrAuthorizationRequired) {
+		return nil, httperror.Forbidden("User is not authorized", err)
+	}
+	if err != nil {
+		return nil, httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	userNamespaces, err := handler.userNamespaces(tx, endpoint, user)
+	if err != nil {
+		return nil, httperror.InternalServerError("unable to retrieve user namespaces", err)
+	}
+
+	return filterRegistriesByNamespaces(registries, endpoint.ID, userNamespaces), nil
+}
+
+func (handler *Handler) userNamespaces(tx dataservices.DataStoreTx, endpoint *portainer.Endpoint, user *portainer.User) ([]string, error) {
+	kcl, err := handler.K8sClientFactory.GetPrivilegedKubeClient(endpoint)
+	if err != nil {
+		return nil, err
+	}
+
+	namespaceAuthorizations, err := kcl.GetNamespaceAccessPolicies()
+	if err != nil {
+		return nil, err
+	}
+
+	userMemberships, err := tx.TeamMembership().TeamMembershipsByUserID(user.ID)
+	if err != nil {
+		return nil, err
+	}
+
+	var userNamespaces []string
+	for namespace, namespaceAuthorization := range namespaceAuthorizations {
+		if _, ok := namespaceAuthorization.UserAccessPolicies[user.ID]; ok {
+			userNamespaces = append(userNamespaces, namespace)
+			continue
+		}
+		for _, userTeam := range userMemberships {
+			if _, ok := namespaceAuthorization.TeamAccessPolicies[userTeam.TeamID]; ok {
+				userNamespaces = append(userNamespaces, namespace)
+				continue
+			}
+		}
+	}
+	return userNamespaces, nil
+}
+
+func hideRegistryFields(registry *portainer.Registry, hideAccesses bool) {
+	registry.Password = ""
+	registry.ManagementConfiguration = nil
+	if hideAccesses {
+		registry.RegistryAccesses = nil
+	}
+}
diff --git a/api/http/handler/endpoints/endpoint_registry_access.go b/api/http/handler/endpoints/endpoint_registry_access.go
new file mode 100644
index 0000000..3389853
--- /dev/null
+++ b/api/http/handler/endpoints/endpoint_registry_access.go
@@ -0,0 +1,186 @@
+package endpoints
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/registryutils"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type registryAccessPayload struct {
+	UserAccessPolicies portainer.UserAccessPolicies
+	TeamAccessPolicies portainer.TeamAccessPolicies
+	Namespaces         []string
+}
+
+func (payload *registryAccessPayload) Validate(r *http.Request) error {
+	return nil
+}
+
+// @id endpointRegistryAccess
+// @summary update registry access for environment
+// @description **Access policy**: authenticated
+// @tags endpoints
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @produce json
+// @param id path int true "Environment(Endpoint) identifier"
+// @param registryId path int true "Registry identifier"
+// @param body body registryAccessPayload true "details"
+// @success 204 "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied"
+// @failure 404 "Endpoint not found"
+// @failure 500 "Server error"
+// @router /endpoints/{id}/registries/{registryId} [put]
+func (handler *Handler) endpointRegistryAccess(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	endpointID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid environment identifier route variable", err)
+	}
+
+	registryID, err := request.RetrieveNumericRouteVariableValue(r, "registryId")
+	if err != nil {
+		return httperror.BadRequest("Invalid registry identifier route variable", err)
+	}
+
+	err = handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return handler.updateRegistryAccess(tx, r, portainer.EndpointID(endpointID), portainer.RegistryID(registryID))
+	})
+
+	return response.TxEmptyResponse(w, err)
+}
+
+func (handler *Handler) updateRegistryAccess(tx dataservices.DataStoreTx, r *http.Request, endpointID portainer.EndpointID, registryID portainer.RegistryID) error {
+	endpoint, err := tx.Endpoint().Endpoint(endpointID)
+	if tx.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find an environment with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find an environment with the specified identifier inside the database", err)
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	err = handler.requestBouncer.AuthorizedEndpointOperation(r, endpoint)
+	if err != nil {
+		return httperror.Forbidden("Permission denied to access environment", err)
+	}
+
+	if !securityContext.IsAdmin {
+		return httperror.Forbidden("User is not authorized", err)
+	}
+
+	registry, err := tx.Registry().Read(registryID)
+	if tx.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find an environment with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find an environment with the specified identifier inside the database", err)
+	}
+
+	var payload registryAccessPayload
+	err = request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	if registry.RegistryAccesses == nil {
+		registry.RegistryAccesses = portainer.RegistryAccesses{}
+	}
+
+	if _, ok := registry.RegistryAccesses[endpoint.ID]; !ok {
+		registry.RegistryAccesses[endpoint.ID] = portainer.RegistryAccessPolicies{}
+	}
+
+	registryAccess := registry.RegistryAccesses[endpoint.ID]
+
+	if endpoint.Type == portainer.KubernetesLocalEnvironment || endpoint.Type == portainer.AgentOnKubernetesEnvironment || endpoint.Type == portainer.EdgeAgentOnKubernetesEnvironment {
+		err := handler.updateKubeAccess(endpoint, registry, registryAccess.Namespaces, payload.Namespaces)
+		if err != nil {
+			return httperror.InternalServerError("Unable to update kube access policies", err)
+		}
+
+		registryAccess.Namespaces = payload.Namespaces
+	} else {
+		registryAccess.UserAccessPolicies = payload.UserAccessPolicies
+		registryAccess.TeamAccessPolicies = payload.TeamAccessPolicies
+	}
+
+	registry.RegistryAccesses[endpointID] = registryAccess
+
+	return tx.Registry().Update(registry.ID, registry)
+}
+
+func (handler *Handler) updateKubeAccess(endpoint *portainer.Endpoint, registry *portainer.Registry, oldNamespaces, newNamespaces []string) error {
+	cli, err := handler.K8sClientFactory.GetPrivilegedKubeClient(endpoint)
+	if err != nil {
+		return err
+	}
+
+	return applyKubeRegistryAccess(cli, registry, oldNamespaces, newNamespaces)
+}
+
+func applyKubeRegistryAccess(cli portainer.KubeClient, registry *portainer.Registry, oldNamespaces, newNamespaces []string) error {
+	oldNamespacesSet := toSet(oldNamespaces)
+	newNamespacesSet := toSet(newNamespaces)
+
+	namespacesToRemove := setDifference(oldNamespacesSet, newNamespacesSet)
+	namespacesToAdd := setDifference(newNamespacesSet, oldNamespacesSet)
+
+	for namespace := range namespacesToRemove {
+		secretName := registryutils.RegistrySecretName(registry.ID)
+
+		if err := cli.RemoveImagePullSecretFromServiceAccount(namespace, "default", secretName); err != nil {
+			return err
+		}
+
+		if err := cli.DeleteRegistrySecret(registry.ID, namespace); err != nil {
+			return err
+		}
+	}
+
+	for namespace := range namespacesToAdd {
+		secretName := registryutils.RegistrySecretName(registry.ID)
+
+		if err := cli.CreateRegistrySecret(registry, namespace); err != nil {
+			return err
+		}
+
+		if err := cli.AddImagePullSecretToServiceAccount(namespace, "default", secretName); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+type stringSet map[string]bool
+
+func toSet(list []string) stringSet {
+	set := stringSet{}
+	for _, el := range list {
+		set[el] = true
+	}
+	return set
+}
+
+// setDifference returns the set difference tagsA - tagsB
+func setDifference(setA stringSet, setB stringSet) stringSet {
+	set := stringSet{}
+
+	for el := range setA {
+		if !setB[el] {
+			set[el] = true
+		}
+	}
+
+	return set
+}
diff --git a/api/http/handler/endpoints/endpoint_registry_access_test.go b/api/http/handler/endpoints/endpoint_registry_access_test.go
new file mode 100644
index 0000000..f2a3058
--- /dev/null
+++ b/api/http/handler/endpoints/endpoint_registry_access_test.go
@@ -0,0 +1,169 @@
+package endpoints
+
+import (
+	"errors"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// spyKubeClient implements portainer.KubeClient for testing applyKubeRegistryAccess.
+// It embeds the interface so unimplemented methods panic, and overrides only the
+// four methods exercised by applyKubeRegistryAccess.
+type spyKubeClient struct {
+	portainer.KubeClient
+
+	createSecretErrors     map[string]error
+	deleteSecretErrors     map[string]error
+	addPullSecretErrors    map[string]error
+	removePullSecretErrors map[string]error
+
+	createdSecrets     []string
+	deletedSecrets     []string
+	addedPullSecrets   []string
+	removedPullSecrets []string
+}
+
+func newSpyKubeClient() *spyKubeClient {
+	return &spyKubeClient{
+		createSecretErrors:     make(map[string]error),
+		deleteSecretErrors:     make(map[string]error),
+		addPullSecretErrors:    make(map[string]error),
+		removePullSecretErrors: make(map[string]error),
+	}
+}
+
+func (s *spyKubeClient) CreateRegistrySecret(_ *portainer.Registry, namespace string) error {
+	s.createdSecrets = append(s.createdSecrets, namespace)
+	return s.createSecretErrors[namespace]
+}
+
+func (s *spyKubeClient) DeleteRegistrySecret(_ portainer.RegistryID, namespace string) error {
+	s.deletedSecrets = append(s.deletedSecrets, namespace)
+	return s.deleteSecretErrors[namespace]
+}
+
+func (s *spyKubeClient) AddImagePullSecretToServiceAccount(namespace, _, _ string) error {
+	s.addedPullSecrets = append(s.addedPullSecrets, namespace)
+	return s.addPullSecretErrors[namespace]
+}
+
+func (s *spyKubeClient) RemoveImagePullSecretFromServiceAccount(namespace, _, _ string) error {
+	s.removedPullSecrets = append(s.removedPullSecrets, namespace)
+	return s.removePullSecretErrors[namespace]
+}
+
+var testRegistry = &portainer.Registry{ID: 3, URL: "registry.example.com"}
+
+func TestApplyKubeRegistryAccess_Grant(t *testing.T) {
+	t.Parallel()
+	t.Run("single namespace granted creates secret then patches SA", func(t *testing.T) {
+		spy := newSpyKubeClient()
+		err := applyKubeRegistryAccess(spy, testRegistry, nil, []string{"ns-a"})
+		require.NoError(t, err)
+		assert.Equal(t, []string{"ns-a"}, spy.createdSecrets)
+		assert.Equal(t, []string{"ns-a"}, spy.addedPullSecrets)
+		assert.Empty(t, spy.deletedSecrets)
+		assert.Empty(t, spy.removedPullSecrets)
+	})
+
+	t.Run("multiple namespaces granted applies to all", func(t *testing.T) {
+		spy := newSpyKubeClient()
+		err := applyKubeRegistryAccess(spy, testRegistry, nil, []string{"ns-a", "ns-b"})
+		require.NoError(t, err)
+		assert.ElementsMatch(t, []string{"ns-a", "ns-b"}, spy.createdSecrets)
+		assert.ElementsMatch(t, []string{"ns-a", "ns-b"}, spy.addedPullSecrets)
+	})
+
+	t.Run("CreateRegistrySecret fails - AddImagePullSecret not called", func(t *testing.T) {
+		spy := newSpyKubeClient()
+		spy.createSecretErrors["ns-a"] = errors.New("secret create failed")
+		err := applyKubeRegistryAccess(spy, testRegistry, nil, []string{"ns-a"})
+		require.Error(t, err)
+		assert.Equal(t, []string{"ns-a"}, spy.createdSecrets)
+		assert.Empty(t, spy.addedPullSecrets)
+	})
+
+	t.Run("AddImagePullSecret fails after secret created - returns error", func(t *testing.T) {
+		spy := newSpyKubeClient()
+		spy.addPullSecretErrors["ns-a"] = errors.New("sa patch failed")
+		err := applyKubeRegistryAccess(spy, testRegistry, nil, []string{"ns-a"})
+		require.Error(t, err)
+		assert.Equal(t, []string{"ns-a"}, spy.createdSecrets)
+		assert.Equal(t, []string{"ns-a"}, spy.addedPullSecrets)
+	})
+}
+
+func TestApplyKubeRegistryAccess_Revoke(t *testing.T) {
+	t.Parallel()
+	t.Run("single namespace revoked removes from SA then deletes secret", func(t *testing.T) {
+		spy := newSpyKubeClient()
+		err := applyKubeRegistryAccess(spy, testRegistry, []string{"ns-a"}, nil)
+		require.NoError(t, err)
+		assert.Equal(t, []string{"ns-a"}, spy.removedPullSecrets)
+		assert.Equal(t, []string{"ns-a"}, spy.deletedSecrets)
+		assert.Empty(t, spy.createdSecrets)
+		assert.Empty(t, spy.addedPullSecrets)
+	})
+
+	t.Run("multiple namespaces revoked applies to all", func(t *testing.T) {
+		spy := newSpyKubeClient()
+		err := applyKubeRegistryAccess(spy, testRegistry, []string{"ns-a", "ns-b"}, nil)
+		require.NoError(t, err)
+		assert.ElementsMatch(t, []string{"ns-a", "ns-b"}, spy.removedPullSecrets)
+		assert.ElementsMatch(t, []string{"ns-a", "ns-b"}, spy.deletedSecrets)
+	})
+
+	t.Run("RemoveImagePullSecret fails - DeleteRegistrySecret not called", func(t *testing.T) {
+		spy := newSpyKubeClient()
+		spy.removePullSecretErrors["ns-a"] = errors.New("sa remove failed")
+		err := applyKubeRegistryAccess(spy, testRegistry, []string{"ns-a"}, nil)
+		require.Error(t, err)
+		assert.Equal(t, []string{"ns-a"}, spy.removedPullSecrets)
+		assert.Empty(t, spy.deletedSecrets)
+	})
+
+	t.Run("DeleteRegistrySecret fails after SA patched - returns error", func(t *testing.T) {
+		spy := newSpyKubeClient()
+		spy.deleteSecretErrors["ns-a"] = errors.New("secret delete failed")
+		err := applyKubeRegistryAccess(spy, testRegistry, []string{"ns-a"}, nil)
+		require.Error(t, err)
+		assert.Equal(t, []string{"ns-a"}, spy.removedPullSecrets)
+		assert.Equal(t, []string{"ns-a"}, spy.deletedSecrets)
+	})
+}
+
+func TestApplyKubeRegistryAccess_Mixed(t *testing.T) {
+	t.Parallel()
+	t.Run("one namespace added and one removed in same call", func(t *testing.T) {
+		spy := newSpyKubeClient()
+		err := applyKubeRegistryAccess(spy, testRegistry, []string{"ns-old"}, []string{"ns-new"})
+		require.NoError(t, err)
+		assert.Equal(t, []string{"ns-old"}, spy.removedPullSecrets)
+		assert.Equal(t, []string{"ns-old"}, spy.deletedSecrets)
+		assert.Equal(t, []string{"ns-new"}, spy.createdSecrets)
+		assert.Equal(t, []string{"ns-new"}, spy.addedPullSecrets)
+	})
+
+	t.Run("empty old and new namespaces - no operations performed", func(t *testing.T) {
+		spy := newSpyKubeClient()
+		err := applyKubeRegistryAccess(spy, testRegistry, nil, nil)
+		require.NoError(t, err)
+		assert.Empty(t, spy.createdSecrets)
+		assert.Empty(t, spy.deletedSecrets)
+		assert.Empty(t, spy.addedPullSecrets)
+		assert.Empty(t, spy.removedPullSecrets)
+	})
+
+	t.Run("namespace present in both old and new - no operations performed for it", func(t *testing.T) {
+		spy := newSpyKubeClient()
+		err := applyKubeRegistryAccess(spy, testRegistry, []string{"ns-keep"}, []string{"ns-keep"})
+		require.NoError(t, err)
+		assert.Empty(t, spy.createdSecrets)
+		assert.Empty(t, spy.deletedSecrets)
+		assert.Empty(t, spy.addedPullSecrets)
+		assert.Empty(t, spy.removedPullSecrets)
+	})
+}
diff --git a/api/http/handler/endpoints/endpoint_settings_update.go b/api/http/handler/endpoints/endpoint_settings_update.go
new file mode 100644
index 0000000..e960b1f
--- /dev/null
+++ b/api/http/handler/endpoints/endpoint_settings_update.go
@@ -0,0 +1,136 @@
+package endpoints
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type endpointSettingsUpdatePayload struct {
+	// Whether non-administrator should be able to use bind mounts when creating containers
+	AllowBindMountsForRegularUsers *bool `json:"allowBindMountsForRegularUsers" example:"false"`
+	// Whether non-administrator should be able to use privileged mode when creating containers
+	AllowPrivilegedModeForRegularUsers *bool `json:"allowPrivilegedModeForRegularUsers" example:"false"`
+	// Whether non-administrator should be able to browse volumes
+	AllowVolumeBrowserForRegularUsers *bool `json:"allowVolumeBrowserForRegularUsers" example:"true"`
+	// Whether non-administrator should be able to use the host pid
+	AllowHostNamespaceForRegularUsers *bool `json:"allowHostNamespaceForRegularUsers" example:"true"`
+	// Whether non-administrator should be able to use device mapping
+	AllowDeviceMappingForRegularUsers *bool `json:"allowDeviceMappingForRegularUsers" example:"true"`
+	// Whether non-administrator should be able to manage stacks
+	AllowStackManagementForRegularUsers *bool `json:"allowStackManagementForRegularUsers" example:"true"`
+	// Whether non-administrator should be able to use container capabilities
+	AllowContainerCapabilitiesForRegularUsers *bool `json:"allowContainerCapabilitiesForRegularUsers" example:"true"`
+	// Whether non-administrator should be able to use sysctl settings
+	AllowSysctlSettingForRegularUsers *bool `json:"allowSysctlSettingForRegularUsers" example:"true"`
+	// Whether non-administrator should be able to use security-opt settings
+	AllowSecurityOptForRegularUsers *bool `json:"allowSecurityOptForRegularUsers" example:"true"`
+	// Whether host management features are enabled
+	EnableHostManagementFeatures *bool `json:"enableHostManagementFeatures" example:"true"`
+
+	EnableGPUManagement *bool `json:"enableGPUManagement" example:"false"`
+
+	Gpus []portainer.Pair `json:"gpus"`
+}
+
+func (payload *endpointSettingsUpdatePayload) Validate(r *http.Request) error {
+	return nil
+}
+
+// @id EndpointSettingsUpdate
+// @summary Update settings for an environment(endpoint)
+// @description Update settings for an environment(endpoint).
+// @description **Access policy**: authenticated
+// @security ApiKeyAuth
+// @security jwt
+// @tags endpoints
+// @accept json
+// @produce json
+// @param id path int true "Environment(Endpoint) identifier"
+// @param body body endpointSettingsUpdatePayload true "Environment(Endpoint) details"
+// @success 200 {object} portainer.Endpoint "Success"
+// @failure 400 "Invalid request"
+// @failure 404 "Environment(Endpoint) not found"
+// @failure 500 "Server error"
+// @router /endpoints/{id}/settings [put]
+func (handler *Handler) endpointSettingsUpdate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	endpointID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid environment identifier route variable", err)
+	}
+
+	var payload endpointSettingsUpdatePayload
+	err = request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	endpoint, err := handler.DataStore.Endpoint().Endpoint(portainer.EndpointID(endpointID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find an environment with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find an environment with the specified identifier inside the database", err)
+	}
+
+	securitySettings := endpoint.SecuritySettings
+
+	if payload.AllowBindMountsForRegularUsers != nil {
+		securitySettings.AllowBindMountsForRegularUsers = *payload.AllowBindMountsForRegularUsers
+	}
+
+	if payload.AllowContainerCapabilitiesForRegularUsers != nil {
+		securitySettings.AllowContainerCapabilitiesForRegularUsers = *payload.AllowContainerCapabilitiesForRegularUsers
+	}
+
+	if payload.AllowDeviceMappingForRegularUsers != nil {
+		securitySettings.AllowDeviceMappingForRegularUsers = *payload.AllowDeviceMappingForRegularUsers
+	}
+
+	if payload.AllowHostNamespaceForRegularUsers != nil {
+		securitySettings.AllowHostNamespaceForRegularUsers = *payload.AllowHostNamespaceForRegularUsers
+	}
+
+	if payload.AllowPrivilegedModeForRegularUsers != nil {
+		securitySettings.AllowPrivilegedModeForRegularUsers = *payload.AllowPrivilegedModeForRegularUsers
+	}
+
+	if payload.AllowStackManagementForRegularUsers != nil {
+		securitySettings.AllowStackManagementForRegularUsers = *payload.AllowStackManagementForRegularUsers
+	}
+
+	if payload.AllowVolumeBrowserForRegularUsers != nil {
+		securitySettings.AllowVolumeBrowserForRegularUsers = *payload.AllowVolumeBrowserForRegularUsers
+	}
+
+	if payload.AllowSysctlSettingForRegularUsers != nil {
+		securitySettings.AllowSysctlSettingForRegularUsers = *payload.AllowSysctlSettingForRegularUsers
+	}
+
+	if payload.EnableHostManagementFeatures != nil {
+		securitySettings.EnableHostManagementFeatures = *payload.EnableHostManagementFeatures
+	}
+
+	if payload.AllowSecurityOptForRegularUsers != nil {
+		securitySettings.AllowSecurityOptForRegularUsers = *payload.AllowSecurityOptForRegularUsers
+	}
+
+	endpoint.SecuritySettings = securitySettings
+
+	if payload.EnableGPUManagement != nil {
+		endpoint.EnableGPUManagement = *payload.EnableGPUManagement
+	}
+
+	if payload.Gpus != nil {
+		endpoint.Gpus = payload.Gpus
+	}
+
+	err = handler.DataStore.Endpoint().UpdateEndpoint(portainer.EndpointID(endpointID), endpoint)
+	if err != nil {
+		return httperror.InternalServerError("Failed persisting environment in database", err)
+	}
+
+	return response.JSON(w, endpoint)
+}
diff --git a/api/http/handler/endpoints/endpoint_snapshot.go b/api/http/handler/endpoints/endpoint_snapshot.go
new file mode 100644
index 0000000..bf641f7
--- /dev/null
+++ b/api/http/handler/endpoints/endpoint_snapshot.go
@@ -0,0 +1,64 @@
+package endpoints
+
+import (
+	"errors"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/internal/snapshot"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id EndpointSnapshot
+// @summary Snapshots an environment(endpoint)
+// @description Snapshots an environment(endpoint)
+// @description **Access policy**: administrator
+// @tags endpoints
+// @security ApiKeyAuth
+// @security jwt
+// @param id path int true "Environment(Endpoint) identifier"
+// @success 204 "Success"
+// @failure 400 "Invalid request"
+// @failure 404 "Environment(Endpoint) not found"
+// @failure 500 "Server error"
+// @router /endpoints/{id}/snapshot [post]
+func (handler *Handler) endpointSnapshot(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	endpointID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid environment identifier route variable", err)
+	}
+
+	endpoint, err := handler.DataStore.Endpoint().Endpoint(portainer.EndpointID(endpointID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find an environment with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find an environment with the specified identifier inside the database", err)
+	}
+
+	if !snapshot.SupportDirectSnapshot(endpoint) {
+		return httperror.BadRequest("Snapshots not supported for this environment", errors.New("Snapshots not supported for this environment"))
+	}
+
+	snapshotError := handler.SnapshotService.SnapshotEndpoint(endpoint)
+
+	latestEndpointReference, err := handler.DataStore.Endpoint().Endpoint(endpoint.ID)
+	if latestEndpointReference == nil {
+		return httperror.NotFound("Unable to find an environment with the specified identifier inside the database", err)
+	}
+
+	latestEndpointReference.Status = portainer.EndpointStatusUp
+	if snapshotError != nil {
+		latestEndpointReference.Status = portainer.EndpointStatusDown
+	}
+
+	latestEndpointReference.Agent.Version = endpoint.Agent.Version
+
+	err = handler.DataStore.Endpoint().UpdateEndpoint(latestEndpointReference.ID, latestEndpointReference)
+	if err != nil {
+		return httperror.InternalServerError("Unable to persist environment changes inside the database", err)
+	}
+
+	return response.Empty(w)
+}
diff --git a/api/http/handler/endpoints/endpoint_snapshots.go b/api/http/handler/endpoints/endpoint_snapshots.go
new file mode 100644
index 0000000..90c232c
--- /dev/null
+++ b/api/http/handler/endpoints/endpoint_snapshots.go
@@ -0,0 +1,72 @@
+package endpoints
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/internal/snapshot"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+
+	"github.com/rs/zerolog/log"
+)
+
+// @id EndpointSnapshots
+// @summary Snapshot all environments(endpoints)
+// @description Snapshot all environments(endpoints)
+// @description **Access policy**: administrator
+// @tags endpoints
+// @security ApiKeyAuth
+// @security jwt
+// @success 204 "Success"
+// @failure 500 "Server Error"
+// @router /endpoints/snapshot [post]
+func (handler *Handler) endpointSnapshots(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	endpoints, err := handler.DataStore.Endpoint().Endpoints()
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve environments from the database", err)
+	}
+
+	for _, endpoint := range endpoints {
+		if !snapshot.SupportDirectSnapshot(&endpoint) {
+			continue
+		}
+
+		if endpoint.URL == "" {
+			continue
+		}
+
+		snapshotError := handler.SnapshotService.SnapshotEndpoint(&endpoint)
+
+		latestEndpointReference, err := handler.DataStore.Endpoint().Endpoint(endpoint.ID)
+		if latestEndpointReference == nil {
+			log.Debug().
+				Str("endpoint", endpoint.Name).
+				Str("URL", endpoint.URL).
+				Err(err).
+				Msg("background schedule error (environment snapshot), environment not found inside the database anymore")
+
+			continue
+		}
+
+		latestEndpointReference.Status = portainer.EndpointStatusUp
+		if snapshotError != nil {
+			log.Debug().
+				Str("endpoint", endpoint.Name).
+				Str("URL", endpoint.URL).
+				Err(snapshotError).
+				Msg("background schedule error (environment snapshot), unable to create snapshot")
+
+			latestEndpointReference.Status = portainer.EndpointStatusDown
+		}
+
+		latestEndpointReference.Agent.Version = endpoint.Agent.Version
+
+		err = handler.DataStore.Endpoint().UpdateEndpoint(latestEndpointReference.ID, latestEndpointReference)
+		if err != nil {
+			return httperror.InternalServerError("Unable to persist environment changes inside the database", err)
+		}
+	}
+
+	return response.Empty(w)
+}
diff --git a/api/http/handler/endpoints/endpoint_snapshots_test.go b/api/http/handler/endpoints/endpoint_snapshots_test.go
new file mode 100644
index 0000000..332393a
--- /dev/null
+++ b/api/http/handler/endpoints/endpoint_snapshots_test.go
@@ -0,0 +1,109 @@
+package endpoints
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"sync/atomic"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_endpointSnapshots(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	endpointID := portainer.EndpointID(123)
+	endpoint := &portainer.Endpoint{
+		ID:     endpointID,
+		Name:   "mock",
+		URL:    "http://mock.example/",
+		Status: portainer.EndpointStatusDown, // starts in down state
+	}
+	err := store.Endpoint().Create(endpoint)
+
+	require.NoError(t, err, "error creating environment")
+
+	err = store.User().Create(
+		&portainer.User{
+			Username: "admin",
+			Role:     portainer.AdministratorRole,
+		},
+	)
+	require.NoError(t, err, "error creating a user")
+
+	bouncer := testhelpers.NewTestRequestBouncer()
+
+	snapshotService := &mockSnapshotService{
+		snapshotEndpointShouldSucceed: atomic.Bool{},
+	}
+	snapshotService.snapshotEndpointShouldSucceed.Store(true)
+
+	h := NewHandler(bouncer)
+	h.DataStore = store
+	h.SnapshotService = snapshotService
+
+	doPostRequest := func() {
+		req := httptest.NewRequest(http.MethodPost, "/endpoints/snapshot", nil)
+		ctx := security.StoreTokenData(req, &portainer.TokenData{ID: 1, Username: "admin", Role: 1})
+		req = req.WithContext(ctx)
+		testhelpers.AddTestSecurityCookie(req, "Bearer dummytoken")
+
+		rr := httptest.NewRecorder()
+		h.ServeHTTP(rr, req)
+
+		require.Equal(t, http.StatusNoContent, rr.Code, "Status should be 204")
+
+		_, err := io.ReadAll(rr.Body)
+		require.NoError(t, err, "ReadAll should not return error")
+	}
+
+	doPostRequest()
+
+	// check that the endpoint has been immediately set to up
+	endpoint, err = store.Endpoint().Endpoint(endpointID)
+	require.NoError(t, err, "error getting endpoint")
+	assert.Equal(t, portainer.EndpointStatusUp, endpoint.Status, "endpoint should be up (1) since mock snapshot returned ok")
+
+	// set the mock to return an error
+	snapshotService.snapshotEndpointShouldSucceed.Store(false)
+	doPostRequest()
+
+	// check that the endpoint has been immediately set to down
+	endpoint, err = store.Endpoint().Endpoint(endpointID)
+	require.NoError(t, err, "error getting endpoint")
+	assert.Equal(t, portainer.EndpointStatusDown, endpoint.Status, "endpoint should be down (2) since mock snapshot returned error")
+}
+
+var _ portainer.SnapshotService = &mockSnapshotService{}
+
+type mockSnapshotService struct {
+	snapshotEndpointShouldSucceed atomic.Bool
+}
+
+func (s *mockSnapshotService) Start(_ context.Context) {
+}
+
+func (s *mockSnapshotService) SetSnapshotInterval(snapshotInterval string) error {
+	return nil
+}
+
+func (s *mockSnapshotService) SnapshotEndpoint(endpoint *portainer.Endpoint) error {
+	if s.snapshotEndpointShouldSucceed.Load() {
+		return nil
+	}
+
+	return errors.New("snapshot failed")
+}
+
+func (s *mockSnapshotService) FillSnapshotData(endpoint *portainer.Endpoint, includeRaw bool) error {
+	return nil
+}
diff --git a/api/http/handler/endpoints/endpoint_status_inspect.go b/api/http/handler/endpoints/endpoint_status_inspect.go
new file mode 100644
index 0000000..283556a
--- /dev/null
+++ b/api/http/handler/endpoints/endpoint_status_inspect.go
@@ -0,0 +1,21 @@
+package endpoints
+
+import (
+	"fmt"
+	"net/http"
+
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+)
+
+// DEPRECATED
+func (handler *Handler) endpointStatusInspect(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	endpointID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid environment identifier route variable", err)
+	}
+
+	url := fmt.Sprintf("/api/endpoints/%d/edge/status", endpointID)
+	http.Redirect(w, r, url, http.StatusPermanentRedirect)
+	return nil
+}
diff --git a/api/http/handler/endpoints/endpoint_summary_counts.go b/api/http/handler/endpoints/endpoint_summary_counts.go
new file mode 100644
index 0000000..271b1bc
--- /dev/null
+++ b/api/http/handler/endpoints/endpoint_summary_counts.go
@@ -0,0 +1,246 @@
+package endpoints
+
+import (
+	"net/http"
+	"sort"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/rs/zerolog/log"
+
+	"golang.org/x/mod/semver"
+)
+
+type groupCount struct {
+	GroupID   int    `json:"groupID"`
+	GroupName string `json:"groupName"`
+	Count     int    `json:"count"`
+}
+
+type platformCounts struct {
+	Docker     int `json:"docker"`
+	Kubernetes int `json:"kubernetes"`
+	Azure      int `json:"azure"`
+	Podman     int `json:"podman"`
+}
+
+type healthCounts struct {
+	Down      int `json:"down"`
+	Outdated  int `json:"outdated"`
+	Up        int `json:"up"`
+	Heartbeat int `json:"heartbeat"`
+}
+
+type EnvironmentSummaryCountsResponse struct {
+	Total          int            `json:"total"`
+	Up             int            `json:"up"`
+	Down           int            `json:"down"`
+	Outdated       int            `json:"outdated"`
+	Unassigned     int            `json:"unassigned"`
+	ByGroup        []groupCount   `json:"byGroup"`
+	ByPlatformType platformCounts `json:"byPlatformType"`
+	ByHealth       healthCounts   `json:"byHealth"`
+}
+
+const UnassignedGroupID = portainer.EndpointGroupID(1)
+
+// @id EndpointSummaryCounts
+// @summary Get environment summary counts
+// @description Returns counts of environments by status (up, down) and ungrouped environments (unassigned), plus breakdowns by group, type, and health.
+// @description **Access policy**: restricted
+// @tags endpoints
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @success 200 {object} EnvironmentSummaryCountsResponse "Environment summary counts"
+// @failure 500 "Server error"
+// @router /endpoints/summary [get]
+func (handler *Handler) endpointSummaryCounts(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	var endpointGroups []portainer.EndpointGroup
+	var endpoints []portainer.Endpoint
+	var settings *portainer.Settings
+
+	if err := handler.DataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
+		var err error
+
+		endpointGroups, err = tx.EndpointGroup().ReadAll()
+		if err != nil {
+			return httperror.InternalServerError("Unable to retrieve environment groups from the database", err)
+		}
+
+		endpoints, err = tx.Endpoint().Endpoints()
+		if err != nil {
+			return httperror.InternalServerError("Unable to retrieve environments from the database", err)
+		}
+
+		settings, err = tx.Settings().Settings()
+		if err != nil {
+			return httperror.InternalServerError("Unable to retrieve settings from the database", err)
+		}
+
+		return nil
+	}); err != nil {
+		return response.TxErrorResponse(err)
+	}
+
+	// Refresh LastCheckInDate from the in-memory heartbeats map. Edge agents
+	// use ETag-based response caching: cache hits update the map but do not
+	// write LastCheckInDate back to the database, so the tx value grows stale.
+	// The tx path cannot access the in-memory map; this non-tx access is
+	// intentional.
+	endpointSvc := handler.DataStore.Endpoint()
+	for i := range endpoints {
+		if t, ok := endpointSvc.Heartbeat(endpoints[i].ID); ok {
+			endpoints[i].LastCheckInDate = t
+		}
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	filteredEndpoints := security.FilterEndpoints(endpoints, endpointGroups, securityContext)
+
+	trustedEndpoints := make([]portainer.Endpoint, 0, len(filteredEndpoints))
+	for i := range filteredEndpoints {
+		ep := &filteredEndpoints[i]
+		if endpointutils.IsEdgeEndpoint(ep) && !ep.UserTrusted {
+			continue
+		}
+		trustedEndpoints = append(trustedEndpoints, filteredEndpoints[i])
+	}
+
+	counts := EnvironmentSummaryCountsResponse{
+		Total: len(trustedEndpoints),
+	}
+
+	groupCounts := make(map[portainer.EndpointGroupID]int)
+	platformCounts := platformCounts{}
+	healthCounts := healthCounts{}
+
+	for i := range trustedEndpoints {
+		endpoint := &trustedEndpoints[i]
+
+		switch endpointutils.EndpointPlatformType(endpoint) {
+		case portainer.DockerPlatformType:
+			platformCounts.Docker++
+		case portainer.KubernetesPlatformType:
+			platformCounts.Kubernetes++
+		case portainer.AzurePlatformType:
+			platformCounts.Azure++
+		case portainer.PodmanPlatformType:
+			platformCounts.Podman++
+		case portainer.UnknownPlatformType:
+			log.Error().Int("endpoint_id", int(endpoint.ID)).Msg("Unknown platform type")
+		}
+
+		groupCounts[endpoint.GroupID]++
+
+		if endpoint.GroupID == UnassignedGroupID {
+			counts.Unassigned++
+		}
+
+		outdated := isOutdated(endpoint)
+		status := resolveEndpointStatus(endpoint, settings)
+
+		if outdated {
+			counts.Outdated++
+			healthCounts.Outdated++
+		}
+
+		switch status {
+		case statusHeartbeat:
+			healthCounts.Heartbeat++
+			healthCounts.Up++
+			counts.Up++
+		case statusUp:
+			healthCounts.Up++
+			counts.Up++
+		case statusDown:
+			healthCounts.Down++
+			counts.Down++
+		}
+	}
+
+	counts.ByGroup = parseGroupCounts(groupCounts, endpointGroups)
+	counts.ByPlatformType = platformCounts
+	counts.ByHealth = healthCounts
+
+	return response.JSON(w, counts)
+}
+
+// iota order overlaps with portainer.EndpointStatus (Up=1, Down=2) so non-edge
+// endpoints can pass their Status straight through. statusHeartbeat (0) is
+// edge-only.
+const (
+	statusHeartbeat = iota
+	statusUp
+	statusDown
+)
+
+func resolveEndpointStatus(endpoint *portainer.Endpoint, settings *portainer.Settings) int {
+	if endpointutils.IsEdgeEndpoint(endpoint) {
+		if endpointutils.GetHeartbeatStatus(endpoint, settings) {
+			return statusHeartbeat
+		}
+		return statusDown
+	}
+	return int(endpoint.Status)
+}
+
+func parseGroupCounts(counts map[portainer.EndpointGroupID]int, endpointGroups []portainer.EndpointGroup) []groupCount {
+	parsedGroupCounts := []groupCount{}
+
+	// Build group name lookup
+	groupNameByID := make(map[portainer.EndpointGroupID]string, len(endpointGroups))
+	for _, g := range endpointGroups {
+		groupNameByID[g.ID] = g.Name
+	}
+
+	for groupID, count := range counts {
+
+		parsedGroupCounts = append(parsedGroupCounts,
+			groupCount{
+				GroupID:   int(groupID),
+				GroupName: groupNameByID[groupID],
+				Count:     count,
+			})
+	}
+
+	sort.Slice(parsedGroupCounts, func(i, j int) bool {
+		return parsedGroupCounts[i].GroupID < parsedGroupCounts[j].GroupID
+	})
+
+	return parsedGroupCounts
+}
+
+// canonicalizeSemver ensures v has a "v" prefix as required by golang.org/x/mod/semver.
+func canonicalizeSemver(v string) string {
+	v = strings.TrimSpace(v)
+	if v == "" || strings.HasPrefix(v, "v") {
+		return v
+	}
+	return "v" + v
+}
+
+func isOutdated(endpoint *portainer.Endpoint) bool {
+	if !endpointutils.IsAgentEndpoint(endpoint) {
+		return false
+	}
+
+	if endpoint.Agent.Version == "" {
+		edgeHasCheckedInWithoutVersion := endpointutils.IsEdgeEndpoint(endpoint) && endpoint.LastCheckInDate > 0
+		return edgeHasCheckedInWithoutVersion
+	}
+
+	latestVersion := canonicalizeSemver(portainer.APIVersion)
+	agentVersion := canonicalizeSemver(endpoint.Agent.Version)
+
+	return semver.Compare(agentVersion, latestVersion) < 0
+}
diff --git a/api/http/handler/endpoints/endpoint_summary_counts_test.go b/api/http/handler/endpoints/endpoint_summary_counts_test.go
new file mode 100644
index 0000000..d3ee39a
--- /dev/null
+++ b/api/http/handler/endpoints/endpoint_summary_counts_test.go
@@ -0,0 +1,497 @@
+package endpoints
+
+import (
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+	"github.com/segmentio/encoding/json"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSummaryCounts(t *testing.T) {
+	type testEndpoint struct {
+		endpointType    portainer.EndpointType
+		status          portainer.EndpointStatus
+		groupID         portainer.EndpointGroupID
+		agentVersion    string
+		containerEngine string
+		userTrusted     bool
+		lastCheckInDate int64
+	}
+
+	currentVersion := portainer.APIVersion
+
+	tests := []struct {
+		name           string
+		endpoints      []testEndpoint
+		expectedCounts EnvironmentSummaryCountsResponse
+	}{
+		{
+			name: "all docker endpoints up",
+			endpoints: []testEndpoint{
+				{endpointType: portainer.DockerEnvironment, status: portainer.EndpointStatusUp, groupID: 2, agentVersion: currentVersion},
+				{endpointType: portainer.DockerEnvironment, status: portainer.EndpointStatusUp, groupID: 2, agentVersion: currentVersion},
+			},
+			expectedCounts: EnvironmentSummaryCountsResponse{
+				Total: 2, Up: 2, Down: 0, Outdated: 0, Unassigned: 0,
+				// GroupID 2 has no matching EndpointGroup in the test store.
+				ByGroup:        []groupCount{{GroupID: 2, GroupName: "", Count: 2}},
+				ByPlatformType: platformCounts{Docker: 2},
+				ByHealth:       healthCounts{Up: 2},
+			},
+		},
+		{
+			name: "mix of up and down docker endpoints",
+			endpoints: []testEndpoint{
+				{endpointType: portainer.DockerEnvironment, status: portainer.EndpointStatusUp, groupID: 2, agentVersion: currentVersion},
+				{endpointType: portainer.DockerEnvironment, status: portainer.EndpointStatusDown, groupID: 2, agentVersion: currentVersion},
+				{endpointType: portainer.DockerEnvironment, status: portainer.EndpointStatusDown, groupID: 2, agentVersion: currentVersion},
+			},
+			expectedCounts: EnvironmentSummaryCountsResponse{
+				Total: 3, Up: 1, Down: 2, Outdated: 0, Unassigned: 0,
+				ByGroup:        []groupCount{{GroupID: 2, GroupName: "", Count: 3}},
+				ByPlatformType: platformCounts{Docker: 3},
+				ByHealth:       healthCounts{Down: 2, Up: 1},
+			},
+		},
+		{
+			name: "unassigned endpoints have groupID 1",
+			endpoints: []testEndpoint{
+				{endpointType: portainer.DockerEnvironment, status: portainer.EndpointStatusUp, groupID: 1, agentVersion: currentVersion},
+				{endpointType: portainer.DockerEnvironment, status: portainer.EndpointStatusUp, groupID: 2, agentVersion: currentVersion},
+			},
+			expectedCounts: EnvironmentSummaryCountsResponse{
+				Total: 2, Up: 2, Down: 0, Outdated: 0, Unassigned: 1,
+				// GroupID 1 is the default "Unassigned" group; GroupID 2 has no match.
+				ByGroup:        []groupCount{{GroupID: 1, GroupName: "Unassigned", Count: 1}, {GroupID: 2, GroupName: "", Count: 1}},
+				ByPlatformType: platformCounts{Docker: 2},
+				ByHealth:       healthCounts{Up: 2},
+			},
+		},
+		{
+			name: "mixed scenario with docker and kubernetes types",
+			endpoints: []testEndpoint{
+				{endpointType: portainer.DockerEnvironment, status: portainer.EndpointStatusUp, groupID: 2, agentVersion: currentVersion},
+				{endpointType: portainer.DockerEnvironment, status: portainer.EndpointStatusDown, groupID: 1, agentVersion: currentVersion},
+				{endpointType: portainer.KubernetesLocalEnvironment, status: portainer.EndpointStatusUp, groupID: 1, agentVersion: currentVersion},
+				{endpointType: portainer.AgentOnKubernetesEnvironment, status: portainer.EndpointStatusDown, groupID: 2, agentVersion: currentVersion},
+			},
+			expectedCounts: EnvironmentSummaryCountsResponse{
+				Total: 4, Up: 2, Down: 2, Outdated: 0, Unassigned: 2,
+				ByGroup:        []groupCount{{GroupID: 1, GroupName: "Unassigned", Count: 2}, {GroupID: 2, GroupName: "", Count: 2}},
+				ByPlatformType: platformCounts{Docker: 2, Kubernetes: 2},
+				ByHealth:       healthCounts{Down: 2, Up: 2},
+			},
+		},
+		{
+			name: "outdated endpoints count in both their connection bucket and Outdated",
+			endpoints: []testEndpoint{
+				{endpointType: portainer.AgentOnDockerEnvironment, status: portainer.EndpointStatusUp, groupID: 2, agentVersion: "2.0.0"},
+				{endpointType: portainer.AgentOnDockerEnvironment, status: portainer.EndpointStatusDown, groupID: 2, agentVersion: "2.0.0"},
+				{endpointType: portainer.AgentOnDockerEnvironment, status: portainer.EndpointStatusUp, groupID: 2, agentVersion: currentVersion},
+			},
+			expectedCounts: EnvironmentSummaryCountsResponse{
+				Total: 3, Up: 2, Down: 1, Outdated: 2, Unassigned: 0,
+				ByGroup:        []groupCount{{GroupID: 2, GroupName: "", Count: 3}},
+				ByPlatformType: platformCounts{Docker: 3},
+				ByHealth:       healthCounts{Outdated: 2, Up: 2, Down: 1},
+			},
+		},
+		{
+			name: "azure and podman endpoints counted in platform breakdown",
+			endpoints: []testEndpoint{
+				{endpointType: portainer.AzureEnvironment, status: portainer.EndpointStatusUp, groupID: 2, agentVersion: currentVersion},
+				{endpointType: portainer.DockerEnvironment, status: portainer.EndpointStatusUp, groupID: 2, agentVersion: currentVersion, containerEngine: portainer.ContainerEnginePodman},
+			},
+			expectedCounts: EnvironmentSummaryCountsResponse{
+				Total: 2, Up: 2, Down: 0, Outdated: 0, Unassigned: 0,
+				ByGroup:        []groupCount{{GroupID: 2, GroupName: "", Count: 2}},
+				ByPlatformType: platformCounts{Azure: 1, Podman: 1},
+				ByHealth:       healthCounts{Up: 2},
+			},
+		},
+		{
+			name: "untrusted edge endpoints are excluded from counts",
+			endpoints: []testEndpoint{
+				{endpointType: portainer.DockerEnvironment, status: portainer.EndpointStatusUp, groupID: 2, agentVersion: currentVersion},
+				{endpointType: portainer.EdgeAgentOnDockerEnvironment, status: portainer.EndpointStatusUp, groupID: 2, agentVersion: currentVersion, userTrusted: false},
+			},
+			expectedCounts: EnvironmentSummaryCountsResponse{
+				Total: 1, Up: 1, Down: 0, Outdated: 0, Unassigned: 0,
+				ByGroup:        []groupCount{{GroupID: 2, GroupName: "", Count: 1}},
+				ByPlatformType: platformCounts{Docker: 1},
+				ByHealth:       healthCounts{Up: 1},
+			},
+		},
+		{
+			name: "trusted edge endpoints classified by heartbeat, not stored status",
+			endpoints: []testEndpoint{
+				// Recent check-in: heartbeat alive → counted as Up + Heartbeat.
+				{endpointType: portainer.EdgeAgentOnDockerEnvironment, status: portainer.EndpointStatusUp, groupID: 2, agentVersion: currentVersion, userTrusted: true, lastCheckInDate: time.Now().Unix()},
+				// Stored Up but never checked in: counted as Down.
+				{endpointType: portainer.EdgeAgentOnDockerEnvironment, status: portainer.EndpointStatusUp, groupID: 2, agentVersion: currentVersion, userTrusted: true, lastCheckInDate: 0},
+			},
+			expectedCounts: EnvironmentSummaryCountsResponse{
+				Total: 2, Up: 1, Down: 1, Outdated: 0, Unassigned: 0,
+				ByGroup:        []groupCount{{GroupID: 2, GroupName: "", Count: 2}},
+				ByPlatformType: platformCounts{Docker: 2},
+				ByHealth:       healthCounts{Up: 1, Down: 1, Heartbeat: 1},
+			},
+		},
+		{
+			name: "edge endpoint with unknown version and no check-in is not outdated",
+			endpoints: []testEndpoint{
+				{endpointType: portainer.EdgeAgentOnDockerEnvironment, status: portainer.EndpointStatusDown, groupID: 2, agentVersion: "", userTrusted: true, lastCheckInDate: 0},
+			},
+			expectedCounts: EnvironmentSummaryCountsResponse{
+				Total: 1, Up: 0, Down: 1, Outdated: 0, Unassigned: 0,
+				ByGroup:        []groupCount{{GroupID: 2, GroupName: "", Count: 1}},
+				ByPlatformType: platformCounts{Docker: 1},
+				ByHealth:       healthCounts{Down: 1},
+			},
+		},
+		{
+			name: "edge endpoint with unknown version but prior check-in is outdated",
+			endpoints: []testEndpoint{
+				{endpointType: portainer.EdgeAgentOnDockerEnvironment, status: portainer.EndpointStatusDown, groupID: 2, agentVersion: "", userTrusted: true, lastCheckInDate: time.Now().Add(-1 * time.Hour).Unix()},
+			},
+			expectedCounts: EnvironmentSummaryCountsResponse{
+				Total: 1, Up: 0, Down: 1, Outdated: 1, Unassigned: 0,
+				ByGroup:        []groupCount{{GroupID: 2, GroupName: "", Count: 1}},
+				ByPlatformType: platformCounts{Docker: 1},
+				ByHealth:       healthCounts{Down: 1, Outdated: 1},
+			},
+		},
+		{
+			name:      "no endpoints returns all zeros",
+			endpoints: []testEndpoint{},
+			expectedCounts: EnvironmentSummaryCountsResponse{
+				Total: 0, Up: 0, Down: 0, Outdated: 0, Unassigned: 0,
+				ByGroup:        []groupCount{},
+				ByPlatformType: platformCounts{},
+				ByHealth:       healthCounts{},
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			_, store := datastore.MustNewTestStore(t, true, true)
+
+			for i, ep := range tt.endpoints {
+				endpoint := &portainer.Endpoint{
+					ID:              portainer.EndpointID(i + 1),
+					Name:            "env",
+					Type:            ep.endpointType,
+					Status:          ep.status,
+					GroupID:         ep.groupID,
+					ContainerEngine: ep.containerEngine,
+					UserTrusted:     ep.userTrusted,
+					LastCheckInDate: ep.lastCheckInDate,
+				}
+				endpoint.Agent.Version = ep.agentVersion
+
+				err := store.Endpoint().Create(endpoint)
+				require.NoError(t, err)
+			}
+
+			err := store.User().Create(&portainer.User{Username: "admin", Role: portainer.AdministratorRole})
+			require.NoError(t, err)
+
+			bouncer := testhelpers.NewTestRequestBouncer()
+			handler := NewHandler(bouncer)
+			handler.DataStore = store
+
+			req := httptest.NewRequest(http.MethodGet, "/endpoints/summary", nil)
+			ctx := security.StoreTokenData(req, &portainer.TokenData{ID: 1, Username: "admin", Role: 1})
+			req = req.WithContext(ctx)
+			restrictedCtx := security.StoreRestrictedRequestContext(req, &security.RestrictedRequestContext{UserID: 1, IsAdmin: true})
+			req = req.WithContext(restrictedCtx)
+			testhelpers.AddTestSecurityCookie(req, "Bearer dummytoken")
+
+			rr := httptest.NewRecorder()
+			handler.ServeHTTP(rr, req)
+
+			require.Equal(t, http.StatusOK, rr.Code, "expected 200 OK")
+
+			body, err := io.ReadAll(rr.Body)
+			require.NoError(t, err)
+
+			var counts EnvironmentSummaryCountsResponse
+			err = json.Unmarshal(body, &counts)
+			require.NoError(t, err)
+
+			assert.Equal(t, tt.expectedCounts.Total, counts.Total, "Total")
+			assert.Equal(t, tt.expectedCounts.Up, counts.Up, "Up")
+			assert.Equal(t, tt.expectedCounts.Down, counts.Down, "Down")
+			assert.Equal(t, tt.expectedCounts.Outdated, counts.Outdated, "Outdated")
+			assert.Equal(t, tt.expectedCounts.Unassigned, counts.Unassigned, "Unassigned")
+			assert.Equal(t, tt.expectedCounts.ByPlatformType, counts.ByPlatformType, "ByPlatformType")
+			assert.Equal(t, tt.expectedCounts.ByHealth, counts.ByHealth, "ByHealth")
+			// ByGroup is derived from map iteration so order is non-deterministic.
+			assert.ElementsMatch(t, tt.expectedCounts.ByGroup, counts.ByGroup, "ByGroup")
+		})
+	}
+}
+
+func TestSummaryCountsHealthBreakdown(t *testing.T) {
+	_, store := datastore.MustNewTestStore(t, true, true)
+
+	currentVersion := portainer.APIVersion
+
+	type ep struct {
+		id          portainer.EndpointID
+		name        string
+		epType      portainer.EndpointType
+		status      portainer.EndpointStatus
+		lastCheckIn int64
+		trusted     bool
+		agentVer    string
+	}
+
+	for _, e := range []ep{
+		{1, "outdated-up", portainer.EdgeAgentOnDockerEnvironment, 0, time.Now().Unix(), true, "2.0.0"},
+		{2, "outdated-down", portainer.EdgeAgentOnDockerEnvironment, 0, time.Now().Add(-1 * time.Hour).Unix(), true, "2.0.0"},
+		{3, "up-current", portainer.DockerEnvironment, portainer.EndpointStatusUp, 0, false, currentVersion},
+		{4, "down-current", portainer.DockerEnvironment, portainer.EndpointStatusDown, 0, false, currentVersion},
+	} {
+		endpoint := &portainer.Endpoint{
+			ID:              e.id,
+			Name:            e.name,
+			Type:            e.epType,
+			Status:          e.status,
+			LastCheckInDate: e.lastCheckIn,
+			GroupID:         2,
+			UserTrusted:     e.trusted,
+		}
+		endpoint.Agent.Version = e.agentVer
+		require.NoError(t, store.Endpoint().Create(endpoint))
+	}
+
+	err := store.User().Create(&portainer.User{Username: "admin", Role: portainer.AdministratorRole})
+	require.NoError(t, err)
+
+	bouncer := testhelpers.NewTestRequestBouncer()
+	handler := NewHandler(bouncer)
+	handler.DataStore = store
+
+	req := httptest.NewRequest(http.MethodGet, "/endpoints/summary", nil)
+	ctx := security.StoreTokenData(req, &portainer.TokenData{ID: 1, Username: "admin", Role: 1})
+	req = req.WithContext(ctx)
+	restrictedCtx := security.StoreRestrictedRequestContext(req, &security.RestrictedRequestContext{UserID: 1, IsAdmin: true})
+	req = req.WithContext(restrictedCtx)
+	testhelpers.AddTestSecurityCookie(req, "Bearer dummytoken")
+
+	rr := httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+	require.Equal(t, http.StatusOK, rr.Code)
+
+	body, err := io.ReadAll(rr.Body)
+	require.NoError(t, err)
+
+	var counts EnvironmentSummaryCountsResponse
+	require.NoError(t, json.Unmarshal(body, &counts))
+
+	assert.Equal(t, 4, counts.Total)
+	assert.Equal(t, 2, counts.Up, "outdated-up counts in both Up and Outdated")
+	assert.Equal(t, 2, counts.Down, "outdated-down counts in both Down and Outdated")
+	assert.Equal(t, 2, counts.Outdated)
+
+	assert.Equal(t, healthCounts{
+		Down:      2,
+		Outdated:  2,
+		Up:        2,
+		Heartbeat: 1,
+	}, counts.ByHealth)
+}
+
+func TestSummaryCountsHeartbeatRefreshedFromInMemoryMap(t *testing.T) {
+	_, store := datastore.MustNewTestStore(t, true, true)
+
+	endpoint := &portainer.Endpoint{
+		ID:              1,
+		Name:            "stale-edge",
+		Type:            portainer.EdgeAgentOnDockerEnvironment,
+		GroupID:         2,
+		UserTrusted:     true,
+		LastCheckInDate: time.Now().Add(-1 * time.Hour).Unix(),
+	}
+	endpoint.Agent.Version = portainer.APIVersion
+	require.NoError(t, store.Endpoint().Create(endpoint))
+
+	store.Endpoint().UpdateHeartbeat(1)
+
+	err := store.User().Create(&portainer.User{Username: "admin", Role: portainer.AdministratorRole})
+	require.NoError(t, err)
+
+	bouncer := testhelpers.NewTestRequestBouncer()
+	handler := NewHandler(bouncer)
+	handler.DataStore = store
+
+	req := httptest.NewRequest(http.MethodGet, "/endpoints/summary", nil)
+	ctx := security.StoreTokenData(req, &portainer.TokenData{ID: 1, Username: "admin", Role: 1})
+	req = req.WithContext(ctx)
+	restrictedCtx := security.StoreRestrictedRequestContext(req, &security.RestrictedRequestContext{UserID: 1, IsAdmin: true})
+	req = req.WithContext(restrictedCtx)
+	testhelpers.AddTestSecurityCookie(req, "Bearer dummytoken")
+
+	rr := httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+	require.Equal(t, http.StatusOK, rr.Code)
+
+	body, err := io.ReadAll(rr.Body)
+	require.NoError(t, err)
+
+	var counts EnvironmentSummaryCountsResponse
+	require.NoError(t, json.Unmarshal(body, &counts))
+
+	assert.Equal(t, 1, counts.Total)
+	assert.Equal(t, 1, counts.Up, "in-memory heartbeat should override stale DB LastCheckInDate")
+	assert.Equal(t, 0, counts.Down)
+	assert.Equal(t, healthCounts{Up: 1, Heartbeat: 1}, counts.ByHealth)
+}
+
+func TestResolveEndpointStatus(t *testing.T) {
+	settings := &portainer.Settings{EdgeAgentCheckinInterval: 60}
+
+	tests := []struct {
+		name           string
+		endpoint       *portainer.Endpoint
+		expectedStatus int
+	}{
+		{
+			name: "non-edge endpoint returns stored up status",
+			endpoint: &portainer.Endpoint{
+				Type:   portainer.DockerEnvironment,
+				Status: portainer.EndpointStatusUp,
+			},
+			expectedStatus: statusUp,
+		},
+		{
+			name: "non-edge endpoint returns stored down status",
+			endpoint: &portainer.Endpoint{
+				Type:   portainer.DockerEnvironment,
+				Status: portainer.EndpointStatusDown,
+			},
+			expectedStatus: statusDown,
+		},
+		{
+			name: "edge endpoint with recent check-in returns heartbeat",
+			endpoint: &portainer.Endpoint{
+				Type:            portainer.EdgeAgentOnDockerEnvironment,
+				Status:          portainer.EndpointStatusUp,
+				LastCheckInDate: time.Now().Unix(),
+			},
+			expectedStatus: statusHeartbeat,
+		},
+		{
+			name: "edge endpoint with stale check-in returns down regardless of stored status",
+			endpoint: &portainer.Endpoint{
+				Type:            portainer.EdgeAgentOnDockerEnvironment,
+				Status:          portainer.EndpointStatusUp,
+				LastCheckInDate: 0,
+			},
+			expectedStatus: statusDown,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.expectedStatus, resolveEndpointStatus(tt.endpoint, settings))
+		})
+	}
+}
+
+func TestIsOutdated(t *testing.T) {
+	currentVersion := portainer.APIVersion
+	tests := []struct {
+		name            string
+		version         string
+		lastCheckInDate int64
+		expected        bool
+	}{
+		{name: "empty version with prior check-in is outdated (old agent style)", version: "", lastCheckInDate: time.Now().Unix(), expected: true},
+		{name: "empty version with no check-in is not outdated (never connected)", version: "", lastCheckInDate: 0, expected: false},
+		{name: "old version is outdated", version: "2.0.0", expected: true},
+		{name: "v-prefixed old version is outdated", version: "v2.0.0", expected: true},
+		{name: "current version is not outdated", version: currentVersion, expected: false},
+		{name: "v-prefixed current version is not outdated", version: "v" + currentVersion, expected: false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Empty-version logic only applies to edge endpoints; use EdgeAgentOnDocker for those cases.
+			epType := portainer.AgentOnDockerEnvironment
+			if tt.version == "" {
+				epType = portainer.EdgeAgentOnDockerEnvironment
+			}
+			ep := &portainer.Endpoint{Type: epType, LastCheckInDate: tt.lastCheckInDate}
+			ep.Agent.Version = tt.version
+			assert.Equal(t, tt.expected, isOutdated(ep))
+		})
+	}
+}
+
+func TestParseGroupCounts(t *testing.T) {
+	groups := []portainer.EndpointGroup{
+		{ID: 1, Name: "Unassigned"},
+		{ID: 3, Name: "Production"},
+		{ID: 2, Name: "Staging"},
+	}
+
+	tests := []struct {
+		name     string
+		counts   map[portainer.EndpointGroupID]int
+		expected []groupCount
+	}{
+		{
+			name:     "empty counts returns empty slice",
+			counts:   map[portainer.EndpointGroupID]int{},
+			expected: []groupCount{},
+		},
+		{
+			name: "results are sorted by GroupID ascending",
+			counts: map[portainer.EndpointGroupID]int{
+				3: 5,
+				1: 2,
+				2: 8,
+			},
+			expected: []groupCount{
+				{GroupID: 1, GroupName: "Unassigned", Count: 2},
+				{GroupID: 2, GroupName: "Staging", Count: 8},
+				{GroupID: 3, GroupName: "Production", Count: 5},
+			},
+		},
+		{
+			name: "group with no matching name gets empty string",
+			counts: map[portainer.EndpointGroupID]int{
+				99: 1,
+			},
+			expected: []groupCount{
+				{GroupID: 99, GroupName: "", Count: 1},
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := parseGroupCounts(tt.counts, groups)
+			assert.Equal(t, tt.expected, got)
+		})
+	}
+}
+
+func TestCanonicalizeSemver(t *testing.T) {
+	assert.Equal(t, "v2.0.0", canonicalizeSemver("2.0.0"))
+	assert.Equal(t, "v2.0.0", canonicalizeSemver("v2.0.0"))
+	assert.Empty(t, canonicalizeSemver(""))
+	assert.Empty(t, canonicalizeSemver("  "))
+}
diff --git a/api/http/handler/endpoints/endpoint_update.go b/api/http/handler/endpoints/endpoint_update.go
new file mode 100644
index 0000000..a1cbb44
--- /dev/null
+++ b/api/http/handler/endpoints/endpoint_update.go
@@ -0,0 +1,317 @@
+package endpoints
+
+import (
+	"cmp"
+	"net/http"
+	"reflect"
+	"strconv"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/client"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+	"github.com/portainer/portainer/api/pendingactions/handlers"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+
+	"github.com/rs/zerolog/log"
+)
+
+type endpointUpdatePayload struct {
+	// Name that will be used to identify this environment(endpoint)
+	Name *string `example:"my-environment"`
+	// URL or IP address of a Docker host
+	URL *string `example:"docker.mydomain.tld:2375"`
+	// URL or IP address where exposed containers will be reachable.\
+	// Defaults to URL if not specified
+	PublicURL *string `example:"docker.mydomain.tld:2375"`
+	// GPUs information
+	Gpus []portainer.Pair
+	// Group identifier
+	GroupID *int `example:"1"`
+	// Require TLS to connect against this environment(endpoint)
+	TLS *bool `example:"true"`
+	// Skip server verification when using TLS
+	TLSSkipVerify *bool `example:"false"`
+	// Skip client verification when using TLS
+	TLSSkipClientVerify *bool `example:"false"`
+	// The status of the environment(endpoint) (1 - up, 2 - down)
+	Status *int `example:"1"`
+	// Azure application ID
+	AzureApplicationID *string `example:"eag7cdo9-o09l-9i83-9dO9-f0b23oe78db4"`
+	// Azure tenant ID
+	AzureTenantID *string `example:"34ddc78d-4fel-2358-8cc1-df84c8o839f5"`
+	// Azure authentication key
+	AzureAuthenticationKey *string `example:"cOrXoK/1D35w8YQ8nH1/8ZGwzz45JIYD5jxHKXEQknk="`
+	// List of tag identifiers to which this environment(endpoint) is associated
+	TagIDs             []portainer.TagID `example:"1,2"`
+	UserAccessPolicies portainer.UserAccessPolicies
+	TeamAccessPolicies portainer.TeamAccessPolicies
+	// The check in interval for edge agent (in seconds)
+	EdgeCheckinInterval *int `example:"5"`
+	// Associated Kubernetes data
+	Kubernetes *portainer.KubernetesData
+}
+
+func (payload *endpointUpdatePayload) Validate(r *http.Request) error {
+	return nil
+}
+
+// @id EndpointUpdate
+// @summary Update an environment(endpoint)
+// @description Update an environment(endpoint).
+// @description **Access policy**: authenticated
+// @security ApiKeyAuth
+// @security jwt
+// @tags endpoints
+// @accept json
+// @produce json
+// @param id path int true "Environment(Endpoint) identifier"
+// @param body body endpointUpdatePayload true "Environment(Endpoint) details"
+// @success 200 {object} portainer.Endpoint "Success"
+// @failure 400 "Invalid request"
+// @failure 404 "Environment(Endpoint) not found"
+// @failure 409 "Name is not unique"
+// @failure 500 "Server error"
+// @router /endpoints/{id} [put]
+func (handler *Handler) endpointUpdate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	endpointID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid environment identifier route variable", err)
+	}
+
+	var payload endpointUpdatePayload
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	endpoint, err := handler.DataStore.Endpoint().Endpoint(portainer.EndpointID(endpointID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find an environment with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find an environment with the specified identifier inside the database", err)
+	}
+
+	if payload.TLS != nil && *payload.TLS && endpointutils.IsEdgeEndpoint(endpoint) {
+		return httperror.BadRequest("TLS is not supported for Edge Agent environments", nil)
+	}
+
+	updateEndpointProxy := shouldReloadTLSConfiguration(endpoint, &payload)
+
+	if payload.Name != nil {
+		name := *payload.Name
+		if isUnique, err := handler.isNameUnique(name, endpoint.ID); err != nil {
+			return httperror.InternalServerError("Unable to check if name is unique", err)
+		} else if !isUnique {
+			return httperror.Conflict("Name is not unique", nil)
+		}
+
+		endpoint.Name = name
+	}
+
+	if payload.URL != nil && *payload.URL != endpoint.URL {
+		endpoint.URL = *payload.URL
+		updateEndpointProxy = true
+	}
+
+	if payload.Gpus != nil {
+		endpoint.Gpus = payload.Gpus
+	}
+
+	endpoint.PublicURL = *cmp.Or(payload.PublicURL, &endpoint.PublicURL)
+	endpoint.EdgeCheckinInterval = *cmp.Or(payload.EdgeCheckinInterval, &endpoint.EdgeCheckinInterval)
+
+	updateRelations := false
+
+	if payload.GroupID != nil {
+		groupID := portainer.EndpointGroupID(*payload.GroupID)
+
+		updateRelations = updateRelations || groupID != endpoint.GroupID
+		endpoint.GroupID = groupID
+	}
+
+	if payload.TagIDs != nil {
+		if err := handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+			tagsChanged, err := updateEnvironmentTags(tx, payload.TagIDs, endpoint.TagIDs, endpoint.ID)
+			if err != nil {
+				return err
+			}
+
+			endpoint.TagIDs = payload.TagIDs
+			updateRelations = updateRelations || tagsChanged
+
+			return nil
+		}); err != nil {
+			return httperror.InternalServerError("Unable to update environment tags", err)
+		}
+	}
+
+	updateAuthorizations := false
+
+	if payload.Kubernetes != nil {
+		if payload.Kubernetes.Configuration.RestrictDefaultNamespace !=
+			endpoint.Kubernetes.Configuration.RestrictDefaultNamespace {
+			updateAuthorizations = true
+		}
+
+		endpoint.Kubernetes = *payload.Kubernetes
+	}
+
+	if payload.UserAccessPolicies != nil && !reflect.DeepEqual(payload.UserAccessPolicies, endpoint.UserAccessPolicies) {
+		updateAuthorizations = true
+		endpoint.UserAccessPolicies = payload.UserAccessPolicies
+	}
+
+	if payload.TeamAccessPolicies != nil && !reflect.DeepEqual(payload.TeamAccessPolicies, endpoint.TeamAccessPolicies) {
+		updateAuthorizations = true
+		endpoint.TeamAccessPolicies = payload.TeamAccessPolicies
+	}
+
+	if payload.Status != nil {
+		switch *payload.Status {
+		case 1:
+			endpoint.Status = portainer.EndpointStatusUp
+		case 2:
+			endpoint.Status = portainer.EndpointStatusDown
+		}
+	}
+
+	if endpoint.Type == portainer.AzureEnvironment {
+		updateEndpointProxy = true
+
+		credentials := endpoint.AzureCredentials
+		if payload.AzureApplicationID != nil {
+			credentials.ApplicationID = *payload.AzureApplicationID
+		}
+
+		if payload.AzureTenantID != nil {
+			credentials.TenantID = *payload.AzureTenantID
+		}
+
+		if payload.AzureAuthenticationKey != nil {
+			credentials.AuthenticationKey = *payload.AzureAuthenticationKey
+		}
+
+		httpClient := client.NewHTTPClient()
+		if _, err := httpClient.ExecuteAzureAuthenticationRequest(&credentials); err != nil {
+			return httperror.InternalServerError("Unable to authenticate against Azure", err)
+		}
+		endpoint.AzureCredentials = credentials
+	}
+
+	if payload.TLS != nil {
+		folder := strconv.Itoa(endpointID)
+
+		if *payload.TLS {
+			endpoint.TLSConfig.TLS = true
+			if payload.TLSSkipVerify != nil {
+				endpoint.TLSConfig.TLSSkipVerify = *payload.TLSSkipVerify
+
+				if !*payload.TLSSkipVerify {
+					caCertPath, _ := handler.FileService.GetPathForTLSFile(folder, portainer.TLSFileCA)
+					endpoint.TLSConfig.TLSCACertPath = caCertPath
+				} else {
+					endpoint.TLSConfig.TLSCACertPath = ""
+
+					if err := handler.FileService.DeleteTLSFile(folder, portainer.TLSFileCA); err != nil {
+						log.Warn().Err(err).Msg("Unable to remove CA cert from disk")
+					}
+				}
+			}
+
+			if payload.TLSSkipClientVerify != nil {
+				if !*payload.TLSSkipClientVerify {
+					certPath, _ := handler.FileService.GetPathForTLSFile(folder, portainer.TLSFileCert)
+					endpoint.TLSConfig.TLSCertPath = certPath
+					keyPath, _ := handler.FileService.GetPathForTLSFile(folder, portainer.TLSFileKey)
+					endpoint.TLSConfig.TLSKeyPath = keyPath
+				} else {
+					endpoint.TLSConfig.TLSCertPath = ""
+					if err := handler.FileService.DeleteTLSFile(folder, portainer.TLSFileCert); err != nil {
+						log.Warn().Err(err).Msg("Unable to remove TLS cert from disk")
+					}
+
+					endpoint.TLSConfig.TLSKeyPath = ""
+					if err := handler.FileService.DeleteTLSFile(folder, portainer.TLSFileKey); err != nil {
+						log.Warn().Err(err).Msg("Unable to remove TLS key from disk")
+					}
+				}
+			}
+		} else {
+			endpoint.TLSConfig.TLS = false
+			endpoint.TLSConfig.TLSSkipVerify = false
+			endpoint.TLSConfig.TLSCACertPath = ""
+			endpoint.TLSConfig.TLSCertPath = ""
+			endpoint.TLSConfig.TLSKeyPath = ""
+
+			if err := handler.FileService.DeleteTLSFiles(folder); err != nil {
+				return httperror.InternalServerError("Unable to remove TLS files from disk", err)
+			}
+		}
+
+		isStandardKubeAgent := !endpointutils.IsLocalEndpoint(endpoint) && endpointutils.IsKubernetesEndpoint(endpoint) && !endpointutils.IsEdgeEndpoint(endpoint)
+		if isStandardKubeAgent {
+			endpoint.TLSConfig.TLS = true
+			endpoint.TLSConfig.TLSSkipVerify = true
+		}
+	}
+
+	if updateEndpointProxy {
+		handler.ProxyManager.DeleteEndpointProxy(endpoint.ID)
+
+		if _, err := handler.ProxyManager.CreateAndRegisterEndpointProxy(endpoint); err != nil {
+			return httperror.InternalServerError("Unable to register HTTP proxy for the environment", err)
+		}
+	}
+
+	if updateAuthorizations && endpointutils.IsKubernetesEndpoint(endpoint) {
+		if err := handler.AuthorizationService.CleanNAPWithOverridePolicies(handler.DataStore, endpoint, nil); err != nil {
+			log.Warn().Err(err).Msgf("Unable to clean NAP with override policies for endpoint (%d). Will try to update when endpoint is online.", endpoint.ID)
+
+			if err := handler.PendingActionsService.Create(handler.DataStore, handlers.NewCleanNAPWithOverridePolicies(endpoint.ID, nil)); err != nil {
+				log.Warn().Err(err).Msg("unable to schedule pending action to clean NAP with override policies")
+			}
+		}
+	}
+
+	if err := handler.DataStore.Endpoint().UpdateEndpoint(endpoint.ID, endpoint); err != nil {
+		return httperror.InternalServerError("Unable to persist environment changes inside the database", err)
+	}
+
+	if updateRelations {
+		if err := handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+			return handler.updateEdgeRelations(tx, endpoint)
+		}); err != nil {
+			return httperror.InternalServerError("Unable to update environment relations", err)
+		}
+	}
+
+	if err := handler.SnapshotService.FillSnapshotData(endpoint, true); err != nil {
+		return httperror.InternalServerError("Unable to add snapshot data", err)
+	}
+
+	return response.JSON(w, endpoint)
+}
+
+func shouldReloadTLSConfiguration(endpoint *portainer.Endpoint, payload *endpointUpdatePayload) bool {
+	// If we change anything in the tls config then we need to reload the proxy
+	if payload.TLS != nil && endpoint.TLSConfig.TLS != *payload.TLS {
+		return true
+	}
+
+	// When updating Docker API environment, as long as TLS is true and TLSSkipVerify is false,
+	// we assume that new TLS files have been uploaded and we need to reload the TLS configuration.
+	if endpoint.Type != portainer.DockerEnvironment ||
+		(payload.URL != nil && !strings.HasPrefix(*payload.URL, "tcp://")) ||
+		payload.TLS == nil || !*payload.TLS {
+		return false
+	}
+
+	if payload.TLSSkipVerify != nil && !*payload.TLSSkipVerify {
+		return true
+	}
+
+	return payload.TLSSkipClientVerify != nil && !*payload.TLSSkipClientVerify
+}
diff --git a/api/http/handler/endpoints/endpoint_update_relations.go b/api/http/handler/endpoints/endpoint_update_relations.go
new file mode 100644
index 0000000..fb2787f
--- /dev/null
+++ b/api/http/handler/endpoints/endpoint_update_relations.go
@@ -0,0 +1,109 @@
+package endpoints
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+
+	"github.com/pkg/errors"
+)
+
+type endpointUpdateRelationsPayload struct {
+	Relations map[portainer.EndpointID]struct {
+		EdgeGroups []portainer.EdgeGroupID
+		Tags       []portainer.TagID
+		Group      portainer.EndpointGroupID
+	}
+}
+
+func (payload *endpointUpdateRelationsPayload) Validate(r *http.Request) error {
+	for eID := range payload.Relations {
+		if eID == 0 {
+			return errors.New("Missing environment identifier")
+		}
+	}
+
+	return nil
+}
+
+// @id EndpointUpdateRelations
+// @summary Update relations for a list of environments
+// @description Update relations for a list of environments
+// @description Edge groups, tags and environment group can be updated.
+// @description
+// @description **Access policy**: administrator
+// @tags endpoints
+// @security jwt
+// @accept json
+// @param body body endpointUpdateRelationsPayload true "Environment relations data"
+// @success 204 "Success"
+// @failure 400 "Invalid request"
+// @failure 401 "Unauthorized"
+// @failure 404 "Not found"
+// @failure 500 "Server error"
+// @router /endpoints/relations [put]
+func (handler *Handler) updateRelations(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+
+	payload, err := request.GetPayload[endpointUpdateRelationsPayload](r)
+	if err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	err = handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		for environmentID, relationPayload := range payload.Relations {
+			endpoint, err := tx.Endpoint().Endpoint(environmentID)
+			if err != nil {
+				return errors.WithMessage(err, "Unable to find an environment with the specified identifier inside the database")
+			}
+
+			updateRelations := false
+
+			if relationPayload.Group != 0 {
+				groupIDChanged := endpoint.GroupID != relationPayload.Group
+				endpoint.GroupID = relationPayload.Group
+				updateRelations = updateRelations || groupIDChanged
+			}
+
+			if relationPayload.Tags != nil {
+				tagsChanged, err := updateEnvironmentTags(tx, relationPayload.Tags, endpoint.TagIDs, endpoint.ID)
+				if err != nil {
+					return errors.WithMessage(err, "Unable to update environment tags")
+				}
+
+				endpoint.TagIDs = relationPayload.Tags
+				updateRelations = updateRelations || tagsChanged
+			}
+
+			if relationPayload.EdgeGroups != nil {
+				edgeGroupsChanged, err := updateEnvironmentEdgeGroups(tx, relationPayload.EdgeGroups, endpoint.ID)
+				if err != nil {
+					return errors.WithMessage(err, "Unable to update environment edge groups")
+				}
+
+				updateRelations = updateRelations || edgeGroupsChanged
+			}
+
+			if updateRelations {
+				if err := tx.Endpoint().UpdateEndpoint(endpoint.ID, endpoint); err != nil {
+					return errors.WithMessage(err, "Unable to update environment")
+				}
+
+				if err := handler.updateEdgeRelations(tx, endpoint); err != nil {
+					return errors.WithMessage(err, "Unable to update environment relations")
+				}
+			}
+		}
+
+		return nil
+	})
+
+	if err != nil {
+		return httperror.InternalServerError("Unable to update environment relations", err)
+	}
+
+	return response.Empty(w)
+}
diff --git a/api/http/handler/endpoints/endpoint_update_test.go b/api/http/handler/endpoints/endpoint_update_test.go
new file mode 100644
index 0000000..e233faa
--- /dev/null
+++ b/api/http/handler/endpoints/endpoint_update_test.go
@@ -0,0 +1,67 @@
+package endpoints
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_endpointPut_TLSRejectedForEdgeEndpoint(t *testing.T) {
+	t.Parallel()
+
+	_, store := datastore.MustNewTestStore(t, true, true)
+
+	h := NewHandler(testhelpers.NewTestRequestBouncer())
+	h.DataStore = store
+
+	testCases := []struct {
+		name         string
+		endpointType portainer.EndpointType
+	}{
+		{
+			name:         "edge agent on docker rejects TLS",
+			endpointType: portainer.EdgeAgentOnDockerEnvironment,
+		},
+		{
+			name:         "edge agent on kubernetes rejects TLS",
+			endpointType: portainer.EdgeAgentOnKubernetesEnvironment,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			endpointID := portainer.EndpointID(store.Endpoint().GetNextIdentifier())
+			err := store.Endpoint().Create(&portainer.Endpoint{
+				ID:   endpointID,
+				Type: tc.endpointType,
+			})
+			require.NoError(t, err)
+
+			payload := &endpointUpdatePayload{TLS: new(true)}
+			bodyJSON, err := json.Marshal(payload)
+			require.NoError(t, err)
+
+			url := fmt.Sprintf("/endpoints/%d", endpointID)
+			req := httptest.NewRequest(http.MethodPut, url, bytes.NewBuffer(bodyJSON))
+			rctx := security.StoreTokenData(req, &portainer.TokenData{ID: 1, Username: "admin", Role: portainer.AdministratorRole})
+			req = req.WithContext(rctx)
+			req.Header.Set("Content-Type", "application/json")
+
+			rr := httptest.NewRecorder()
+			h.ServeHTTP(rr, req)
+
+			assert.Equal(t, http.StatusBadRequest, rr.Code)
+		})
+	}
+}
diff --git a/api/http/handler/endpoints/filter.go b/api/http/handler/endpoints/filter.go
new file mode 100644
index 0000000..2bacfe1
--- /dev/null
+++ b/api/http/handler/endpoints/filter.go
@@ -0,0 +1,748 @@
+package endpoints
+
+import (
+	"fmt"
+	"net/http"
+	"slices"
+	"strconv"
+	"strings"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/edge"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+	"github.com/portainer/portainer/api/roar"
+	"github.com/portainer/portainer/api/set"
+	"github.com/portainer/portainer/api/slicesx"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+
+	"github.com/pkg/errors"
+)
+
+type EnvironmentsQuery struct {
+	search           string
+	groupIds         []portainer.EndpointGroupID
+	status           []portainer.EndpointStatus
+	types            []portainer.EndpointType
+	platformTypes    []portainer.PlatformType
+	outdated         bool
+	excludeGroupIds  []portainer.EndpointGroupID
+	tagIds           []portainer.TagID
+	tagsPartialMatch bool
+	endpointIds      []portainer.EndpointID
+	excludeIds       []portainer.EndpointID
+	agentVersions    []string
+	// if edgeAsync not nil, will filter edge endpoints based on this value
+	edgeAsync                *bool
+	edgeDeviceUntrusted      bool
+	edgeCheckInPassedSeconds int
+	excludeSnapshots         bool
+	name                     string
+	edgeStackId              portainer.EdgeStackID
+	edgeStackStatus          *portainer.EdgeStackStatusType
+	edgeGroupIds             []portainer.EdgeGroupID
+	excludeEdgeGroupIds      []portainer.EdgeGroupID
+}
+
+func parseQuery(r *http.Request) (EnvironmentsQuery, error) {
+	search, _ := request.RetrieveQueryParameter(r, "search", true)
+	if search != "" {
+		search = strings.ToLower(search)
+	}
+
+	status, err := request.RetrieveNumberArrayQueryParameter[portainer.EndpointStatus](r, "status")
+	if err != nil {
+		return EnvironmentsQuery{}, err
+	}
+
+	groupIDs, err := request.RetrieveNumberArrayQueryParameter[portainer.EndpointGroupID](r, "groupIds")
+	if err != nil {
+		return EnvironmentsQuery{}, err
+	}
+
+	endpointTypes, err := request.RetrieveNumberArrayQueryParameter[portainer.EndpointType](r, "types")
+	if err != nil {
+		return EnvironmentsQuery{}, err
+	}
+
+	platformTypes, err := request.RetrieveNumberArrayQueryParameter[portainer.PlatformType](r, "platformTypes")
+	if err != nil {
+		return EnvironmentsQuery{}, err
+	}
+
+	tagIDs, err := request.RetrieveNumberArrayQueryParameter[portainer.TagID](r, "tagIds")
+	if err != nil {
+		return EnvironmentsQuery{}, err
+	}
+
+	tagsPartialMatch, _ := request.RetrieveBooleanQueryParameter(r, "tagsPartialMatch", true)
+
+	endpointIDs, err := request.RetrieveNumberArrayQueryParameter[portainer.EndpointID](r, "endpointIds")
+	if err != nil {
+		return EnvironmentsQuery{}, err
+	}
+
+	excludeIDs, err := request.RetrieveNumberArrayQueryParameter[portainer.EndpointID](r, "excludeIds")
+	if err != nil {
+		return EnvironmentsQuery{}, err
+	}
+
+	excludeGroupIDs, err := request.RetrieveNumberArrayQueryParameter[portainer.EndpointGroupID](r, "excludeGroupIds")
+	if err != nil {
+		return EnvironmentsQuery{}, err
+	}
+
+	edgeGroupIDs, err := request.RetrieveNumberArrayQueryParameter[portainer.EdgeGroupID](r, "edgeGroupIds")
+	if err != nil {
+		return EnvironmentsQuery{}, err
+	}
+
+	excludeEdgeGroupIds, err := request.RetrieveNumberArrayQueryParameter[portainer.EdgeGroupID](r, "excludeEdgeGroupIds")
+	if err != nil {
+		return EnvironmentsQuery{}, err
+	}
+
+	agentVersions := request.RetrieveArrayQueryParameter(r, "agentVersions")
+
+	outdated, _ := request.RetrieveBooleanQueryParameter(r, "outdated", true)
+
+	name, _ := request.RetrieveQueryParameter(r, "name", true)
+
+	var edgeAsync *bool
+	edgeAsyncParam, _ := request.RetrieveQueryParameter(r, "edgeAsync", true)
+	if edgeAsyncParam != "" {
+		edgeAsync = new(edgeAsyncParam == "true")
+	}
+
+	edgeDeviceUntrusted, _ := request.RetrieveBooleanQueryParameter(r, "edgeDeviceUntrusted", true)
+
+	excludeSnapshots, _ := request.RetrieveBooleanQueryParameter(r, "excludeSnapshots", true)
+
+	edgeCheckInPassedSeconds, _ := request.RetrieveNumericQueryParameter(r, "edgeCheckInPassedSeconds", true)
+
+	edgeStackId, _ := request.RetrieveNumericQueryParameter(r, "edgeStackId", true)
+
+	edgeStackStatus, err := getEdgeStackStatusParam(r)
+	if err != nil {
+		return EnvironmentsQuery{}, err
+	}
+
+	return EnvironmentsQuery{
+		search:                   search,
+		types:                    endpointTypes,
+		platformTypes:            platformTypes,
+		tagIds:                   tagIDs,
+		endpointIds:              endpointIDs,
+		excludeIds:               excludeIDs,
+		excludeGroupIds:          excludeGroupIDs,
+		tagsPartialMatch:         tagsPartialMatch,
+		groupIds:                 groupIDs,
+		status:                   status,
+		edgeAsync:                edgeAsync,
+		edgeDeviceUntrusted:      edgeDeviceUntrusted,
+		excludeSnapshots:         excludeSnapshots,
+		name:                     name,
+		agentVersions:            agentVersions,
+		outdated:                 outdated,
+		edgeCheckInPassedSeconds: edgeCheckInPassedSeconds,
+		edgeStackId:              portainer.EdgeStackID(edgeStackId),
+		edgeStackStatus:          edgeStackStatus,
+		edgeGroupIds:             edgeGroupIDs,
+		excludeEdgeGroupIds:      excludeEdgeGroupIds,
+	}, nil
+}
+
+func (handler *Handler) filterEndpointsByQuery(
+	filteredEndpoints []portainer.Endpoint,
+	query EnvironmentsQuery,
+	groups []portainer.EndpointGroup,
+	edgeGroups []portainer.EdgeGroup,
+	settings *portainer.Settings,
+	context *security.RestrictedRequestContext,
+) ([]portainer.Endpoint, int, error) {
+	totalAvailableEndpoints := len(filteredEndpoints)
+
+	if len(query.endpointIds) > 0 {
+		endpointIDs := roar.FromSlice(query.endpointIds)
+
+		filteredEndpoints = filteredEndpointsByIds(filteredEndpoints, endpointIDs)
+	}
+
+	if len(query.excludeIds) > 0 {
+		filteredEndpoints = filter(filteredEndpoints, func(endpoint portainer.Endpoint) bool {
+			return !slices.Contains(query.excludeIds, endpoint.ID)
+		})
+	}
+
+	if len(query.excludeGroupIds) > 0 {
+		filteredEndpoints = filter(filteredEndpoints, func(endpoint portainer.Endpoint) bool {
+			return !slices.Contains(query.excludeGroupIds, endpoint.GroupID)
+		})
+	}
+
+	if len(query.groupIds) > 0 {
+		filteredEndpoints = filterEndpointsByGroupIDs(filteredEndpoints, query.groupIds)
+	}
+
+	if len(query.edgeGroupIds) > 0 {
+		filteredEndpoints, edgeGroups = filterEndpointsByEdgeGroupIDs(filteredEndpoints, edgeGroups, query.edgeGroupIds)
+	}
+
+	if len(query.excludeEdgeGroupIds) > 0 {
+		filteredEndpoints, edgeGroups = filterEndpointsByExcludeEdgeGroupIDs(filteredEndpoints, edgeGroups, query.excludeEdgeGroupIds)
+	}
+
+	if query.name != "" {
+		filteredEndpoints = filterEndpointsByName(filteredEndpoints, query.name)
+	}
+
+	// filter async edge environments
+	if query.edgeAsync != nil {
+		filteredEndpoints = filter(filteredEndpoints, func(endpoint portainer.Endpoint) bool {
+			if !endpointutils.IsEdgeEndpoint(&endpoint) {
+				return true
+			}
+
+			return endpoint.Edge.AsyncMode == *query.edgeAsync
+		})
+	}
+
+	// filter edge environments by trusted/untrusted
+	// only portainer admins are allowed to see untrusted environments
+	filteredEndpoints = filter(filteredEndpoints, func(endpoint portainer.Endpoint) bool {
+		if !endpointutils.IsEdgeEndpoint(&endpoint) {
+			return true
+		}
+
+		if query.edgeDeviceUntrusted {
+			return !endpoint.UserTrusted && context.IsAdmin
+		}
+
+		return endpoint.UserTrusted == !query.edgeDeviceUntrusted
+	})
+
+	if query.edgeCheckInPassedSeconds > 0 {
+		filteredEndpoints = filter(filteredEndpoints, func(endpoint portainer.Endpoint) bool {
+			// ignore non-edge endpoints
+			if !endpointutils.IsEdgeEndpoint(&endpoint) {
+				return true
+			}
+
+			// filter out endpoints that have never checked in
+			if endpoint.LastCheckInDate == 0 {
+				return false
+			}
+
+			return time.Now().Unix()-endpoint.LastCheckInDate < int64(query.edgeCheckInPassedSeconds)
+		})
+	}
+
+	if len(query.status) > 0 {
+		filteredEndpoints = filterEndpointsByStatuses(filteredEndpoints, query.status, settings)
+	}
+
+	if query.search != "" {
+		tags, err := handler.DataStore.Tag().ReadAll()
+		if err != nil {
+			return nil, 0, errors.WithMessage(err, "Unable to retrieve tags from the database")
+		}
+
+		tagsMap := make(map[portainer.TagID]string, len(tags))
+		for _, tag := range tags {
+			tagsMap[tag.ID] = tag.Name
+		}
+
+		filteredEndpoints = filterEndpointsBySearchCriteria(filteredEndpoints, groups, edgeGroups, tagsMap, query.search)
+	}
+
+	if len(query.types) > 0 {
+		filteredEndpoints = filterEndpointsByTypes(filteredEndpoints, query.types)
+	}
+
+	if len(query.platformTypes) > 0 {
+		filteredEndpoints = filterEndpointsByPlatform(filteredEndpoints, query.platformTypes)
+	}
+
+	if len(query.tagIds) > 0 {
+		filteredEndpoints = filteredEndpointsByTags(filteredEndpoints, query.tagIds, groups, query.tagsPartialMatch)
+	}
+
+	if len(query.agentVersions) > 0 {
+		filteredEndpoints = filter(filteredEndpoints, func(endpoint portainer.Endpoint) bool {
+			return !endpointutils.IsAgentEndpoint(&endpoint) || slices.Contains(query.agentVersions, endpoint.Agent.Version)
+		})
+	}
+
+	if query.outdated {
+		filteredEndpoints = filter(filteredEndpoints, func(endpoint portainer.Endpoint) bool {
+			return isOutdated(&endpoint)
+		})
+	}
+
+	if query.edgeStackId != 0 {
+		f, err := filterEndpointsByEdgeStack(filteredEndpoints, query.edgeStackId, query.edgeStackStatus, handler.DataStore)
+		if err != nil {
+			return nil, 0, err
+		}
+		filteredEndpoints = f
+	}
+
+	return filteredEndpoints, totalAvailableEndpoints, nil
+}
+
+func endpointStatusInStackMatchesFilter(stackStatus *portainer.EdgeStackStatusForEnv, statusFilter portainer.EdgeStackStatusType) bool {
+	// consider that if the env has no status in the stack it is in Pending state
+	if statusFilter == portainer.EdgeStackStatusPending {
+		return stackStatus == nil || len(stackStatus.Status) == 0
+	}
+
+	if stackStatus == nil {
+		return false
+	}
+
+	return slices.ContainsFunc(stackStatus.Status, func(s portainer.EdgeStackDeploymentStatus) bool {
+		return s.Type == statusFilter
+	})
+}
+
+func filterEndpointsByEdgeStack(endpoints []portainer.Endpoint, edgeStackId portainer.EdgeStackID, statusFilter *portainer.EdgeStackStatusType, datastore dataservices.DataStore) ([]portainer.Endpoint, error) {
+	var filteredEndpoints []portainer.Endpoint
+	if err := datastore.ViewTx(func(tx dataservices.DataStoreTx) error {
+		stack, err := tx.EdgeStack().EdgeStack(edgeStackId)
+		if err != nil {
+			return errors.WithMessage(err, "Unable to retrieve edge stack from the database")
+		}
+
+		envIds := roar.Roar[portainer.EndpointID]{}
+		for _, edgeGroupId := range stack.EdgeGroups {
+			edgeGroup, err := tx.EdgeGroup().Read(edgeGroupId)
+			if err != nil {
+				return errors.WithMessage(err, "Unable to retrieve edge group from the database")
+			}
+
+			if edgeGroup.Dynamic {
+				endpointIDs, err := endpointutils.GetEndpointsByTags(tx, edgeGroup.TagIDs, edgeGroup.PartialMatch)
+				if err != nil {
+					return errors.WithMessage(err, "Unable to retrieve environments and environment groups for Edge group")
+				}
+				edgeGroup.EndpointIDs = roar.FromSlice(endpointIDs)
+			}
+
+			envIds.Union(edgeGroup.EndpointIDs)
+		}
+
+		filteredEnvIds := roar.Roar[portainer.EndpointID]{}
+		filteredEnvIds.Union(envIds)
+
+		if statusFilter != nil {
+			var innerErr error
+
+			envIds.Iterate(func(envId portainer.EndpointID) bool {
+				edgeStackStatus, err := tx.EdgeStackStatus().Read(edgeStackId, envId)
+				if err != nil && !dataservices.IsErrObjectNotFound(err) {
+					innerErr = errors.WithMessagef(err, "Unable to retrieve edge stack status for environment %d", envId)
+					return false
+				}
+
+				if !endpointStatusInStackMatchesFilter(edgeStackStatus, *statusFilter) {
+					filteredEnvIds.Remove(envId)
+				}
+
+				return true
+			})
+
+			if innerErr != nil {
+				return innerErr
+			}
+		}
+
+		filteredEndpoints = filteredEndpointsByIds(endpoints, filteredEnvIds)
+
+		return nil
+	}); err != nil {
+		return nil, err
+	}
+	return filteredEndpoints, nil
+}
+
+func filterEndpointsByGroupIDs(endpoints []portainer.Endpoint, endpointGroupIDs []portainer.EndpointGroupID) []portainer.Endpoint {
+	n := 0
+	for _, endpoint := range endpoints {
+		if slices.Contains(endpointGroupIDs, endpoint.GroupID) {
+			endpoints[n] = endpoint
+			n++
+		}
+	}
+
+	return endpoints[:n]
+}
+
+func filterEndpointsByEdgeGroupIDs(endpoints []portainer.Endpoint, edgeGroups []portainer.EdgeGroup, edgeGroupIDs []portainer.EdgeGroupID) ([]portainer.Endpoint, []portainer.EdgeGroup) {
+	edgeGroupIDFilterSet := make(map[portainer.EdgeGroupID]struct{}, len(edgeGroupIDs))
+	for _, id := range edgeGroupIDs {
+		edgeGroupIDFilterSet[id] = struct{}{}
+	}
+
+	n := 0
+	for _, edgeGroup := range edgeGroups {
+		if _, exists := edgeGroupIDFilterSet[edgeGroup.ID]; exists {
+			edgeGroups[n] = edgeGroup
+			n++
+		}
+	}
+	edgeGroups = edgeGroups[:n]
+
+	endpointIDSet := roar.Roar[portainer.EndpointID]{}
+	for _, edgeGroup := range edgeGroups {
+		endpointIDSet.Union(edgeGroup.EndpointIDs)
+	}
+
+	n = 0
+	for _, endpoint := range endpoints {
+		if endpointIDSet.Contains(endpoint.ID) {
+			endpoints[n] = endpoint
+			n++
+		}
+	}
+
+	return endpoints[:n], edgeGroups
+}
+
+func filterEndpointsByExcludeEdgeGroupIDs(endpoints []portainer.Endpoint, edgeGroups []portainer.EdgeGroup, excludeEdgeGroupIds []portainer.EdgeGroupID) ([]portainer.Endpoint, []portainer.EdgeGroup) {
+	excludeEdgeGroupIDSet := make(map[portainer.EdgeGroupID]struct{}, len(excludeEdgeGroupIds))
+	for _, id := range excludeEdgeGroupIds {
+		excludeEdgeGroupIDSet[id] = struct{}{}
+	}
+
+	n := 0
+	excludeEndpointIDSet := roar.Roar[portainer.EndpointID]{}
+
+	for _, edgeGroup := range edgeGroups {
+		if _, ok := excludeEdgeGroupIDSet[edgeGroup.ID]; ok {
+			excludeEndpointIDSet.Union(edgeGroup.EndpointIDs)
+		} else {
+			edgeGroups[n] = edgeGroup
+			n++
+		}
+	}
+	edgeGroups = edgeGroups[:n]
+
+	n = 0
+	for _, endpoint := range endpoints {
+		if !excludeEndpointIDSet.Contains(endpoint.ID) {
+			endpoints[n] = endpoint
+			n++
+		}
+	}
+
+	return endpoints[:n], edgeGroups
+}
+
+func filterEndpointsBySearchCriteria(
+	endpoints []portainer.Endpoint,
+	endpointGroups []portainer.EndpointGroup,
+	edgeGroups []portainer.EdgeGroup,
+	tagsMap map[portainer.TagID]string,
+	searchCriteria string,
+) []portainer.Endpoint {
+	n := 0
+	for _, endpoint := range endpoints {
+		if endpointMatchSearchCriteria(&endpoint, tagsMap, searchCriteria) {
+			endpoints[n] = endpoint
+			n++
+
+			continue
+		}
+
+		if endpointGroupMatchSearchCriteria(&endpoint, endpointGroups, tagsMap, searchCriteria) {
+			endpoints[n] = endpoint
+			n++
+
+			continue
+		}
+
+		if edgeGroupMatchSearchCriteria(&endpoint, edgeGroups, searchCriteria, endpointGroups) {
+			endpoints[n] = endpoint
+			n++
+
+			continue
+		}
+	}
+
+	return endpoints[:n]
+}
+
+func filterEndpointsByStatuses(endpoints []portainer.Endpoint, statuses []portainer.EndpointStatus, settings *portainer.Settings) []portainer.Endpoint {
+	n := 0
+	for _, endpoint := range endpoints {
+		status := endpoint.Status
+		if endpointutils.IsEdgeEndpoint(&endpoint) {
+			isCheckValid := false
+
+			edgeCheckinInterval := endpoint.EdgeCheckinInterval
+			if edgeCheckinInterval == 0 {
+				edgeCheckinInterval = settings.EdgeAgentCheckinInterval
+			}
+
+			if endpoint.Edge.AsyncMode {
+				edgeCheckinInterval = getShortestAsyncInterval(&endpoint, settings)
+			}
+
+			if edgeCheckinInterval != 0 && endpoint.LastCheckInDate != 0 {
+				isCheckValid = time.Now().Unix()-endpoint.LastCheckInDate <= int64(edgeCheckinInterval*EdgeDeviceIntervalMultiplier+EdgeDeviceIntervalAdd)
+			}
+
+			status = portainer.EndpointStatusDown // Offline
+			if isCheckValid {
+				status = portainer.EndpointStatusUp // Online
+			}
+		}
+
+		if slices.Contains(statuses, status) {
+			endpoints[n] = endpoint
+			n++
+		}
+	}
+
+	return endpoints[:n]
+}
+
+func endpointMatchSearchCriteria(endpoint *portainer.Endpoint, tagsMap map[portainer.TagID]string, searchCriteria string) bool {
+	if strings.Contains(strings.ToLower(endpoint.Name), searchCriteria) {
+		return true
+	}
+
+	if strings.Contains(strings.ToLower(endpoint.URL), searchCriteria) {
+		return true
+	}
+
+	if endpoint.Status == portainer.EndpointStatusUp && searchCriteria == "up" {
+		return true
+	} else if endpoint.Status == portainer.EndpointStatusDown && searchCriteria == "down" {
+		return true
+	}
+
+	for _, tagID := range endpoint.TagIDs {
+		if strings.Contains(strings.ToLower(tagsMap[tagID]), searchCriteria) {
+			return true
+		}
+	}
+
+	return false
+}
+
+func endpointGroupMatchSearchCriteria(endpoint *portainer.Endpoint, endpointGroups []portainer.EndpointGroup, tagsMap map[portainer.TagID]string, searchCriteria string) bool {
+	for _, group := range endpointGroups {
+		if group.ID != endpoint.GroupID {
+			continue
+		}
+
+		if strings.Contains(strings.ToLower(group.Name), searchCriteria) {
+			return true
+		}
+
+		for _, tagID := range group.TagIDs {
+			if strings.Contains(strings.ToLower(tagsMap[tagID]), searchCriteria) {
+				return true
+			}
+		}
+	}
+
+	return false
+}
+
+// search endpoint's related edgegroups
+func edgeGroupMatchSearchCriteria(
+	endpoint *portainer.Endpoint,
+	edgeGroups []portainer.EdgeGroup,
+	searchCriteria string,
+	endpointGroups []portainer.EndpointGroup,
+) bool {
+	for _, edgeGroup := range edgeGroups {
+		relatedEndpointIDs := edge.EdgeGroupRelatedEndpoints(&edgeGroup, []portainer.Endpoint{*endpoint}, endpointGroups)
+
+		for _, endpointID := range relatedEndpointIDs {
+			if endpointID == endpoint.ID {
+				if strings.Contains(strings.ToLower(edgeGroup.Name), searchCriteria) {
+					return true
+				}
+			}
+		}
+	}
+
+	return false
+}
+
+func filterEndpointsByTypes(endpoints []portainer.Endpoint, endpointTypes []portainer.EndpointType) []portainer.Endpoint {
+	typeSet := set.ToSet(endpointTypes)
+
+	return slicesx.Filter(endpoints, func(e portainer.Endpoint) bool {
+		return typeSet[e.Type]
+	})
+}
+
+func filterEndpointsByPlatform(endpoints []portainer.Endpoint, platformTypes []portainer.PlatformType) []portainer.Endpoint {
+	typeSet := set.ToSet(platformTypes)
+
+	return slicesx.Filter(endpoints, func(e portainer.Endpoint) bool {
+		return typeSet[endpointutils.EndpointPlatformType(&e)]
+	})
+}
+
+func filteredEndpointsByTags(endpoints []portainer.Endpoint, tagIDs []portainer.TagID, endpointGroups []portainer.EndpointGroup, partialMatch bool) []portainer.Endpoint {
+	n := 0
+	for _, endpoint := range endpoints {
+		endpointGroup := getEndpointGroup(endpoint.GroupID, endpointGroups)
+		endpointMatched := false
+
+		if partialMatch {
+			endpointMatched = endpointPartialMatchTags(endpoint, endpointGroup, tagIDs)
+		} else {
+			endpointMatched = endpointFullMatchTags(endpoint, endpointGroup, tagIDs)
+		}
+
+		if endpointMatched {
+			endpoints[n] = endpoint
+			n++
+		}
+	}
+
+	return endpoints[:n]
+}
+
+func endpointPartialMatchTags(endpoint portainer.Endpoint, endpointGroup portainer.EndpointGroup, tagIDs []portainer.TagID) bool {
+	tagSet := make(map[portainer.TagID]bool, len(tagIDs))
+
+	for _, tagID := range tagIDs {
+		tagSet[tagID] = true
+	}
+
+	for _, tagID := range endpoint.TagIDs {
+		if tagSet[tagID] {
+			return true
+		}
+	}
+
+	for _, tagID := range endpointGroup.TagIDs {
+		if tagSet[tagID] {
+			return true
+		}
+	}
+
+	return false
+}
+
+func endpointFullMatchTags(endpoint portainer.Endpoint, endpointGroup portainer.EndpointGroup, tagIDs []portainer.TagID) bool {
+	missingTags := make(map[portainer.TagID]bool)
+	for _, tagID := range tagIDs {
+		missingTags[tagID] = true
+	}
+
+	for _, tagID := range endpoint.TagIDs {
+		if missingTags[tagID] {
+			delete(missingTags, tagID)
+		}
+	}
+
+	for _, tagID := range endpointGroup.TagIDs {
+		if missingTags[tagID] {
+			delete(missingTags, tagID)
+		}
+	}
+
+	return len(missingTags) == 0
+}
+
+func filteredEndpointsByIds(endpoints []portainer.Endpoint, ids roar.Roar[portainer.EndpointID]) []portainer.Endpoint {
+	n := 0
+	for _, endpoint := range endpoints {
+		if ids.Contains(endpoint.ID) {
+			endpoints[n] = endpoint
+			n++
+		}
+	}
+
+	return endpoints[:n]
+}
+
+func filterEndpointsByName(endpoints []portainer.Endpoint, name string) []portainer.Endpoint {
+	if name == "" {
+		return endpoints
+	}
+
+	n := 0
+	for _, endpoint := range endpoints {
+		if endpoint.Name == name {
+			endpoints[n] = endpoint
+			n++
+		}
+	}
+
+	return endpoints[:n]
+}
+
+func filter(endpoints []portainer.Endpoint, predicate func(endpoint portainer.Endpoint) bool) []portainer.Endpoint {
+	n := 0
+	for _, endpoint := range endpoints {
+		if predicate(endpoint) {
+			endpoints[n] = endpoint
+			n++
+		}
+	}
+
+	return endpoints[:n]
+}
+
+func getEdgeStackStatusParam(r *http.Request) (*portainer.EdgeStackStatusType, error) {
+	edgeStackStatusQuery, _ := request.RetrieveQueryParameter(r, "edgeStackStatus", true)
+	if edgeStackStatusQuery == "" {
+		return nil, nil
+	}
+
+	edgeStackStatusNumber, err := strconv.Atoi(edgeStackStatusQuery)
+	edgeStackStatus := portainer.EdgeStackStatusType(edgeStackStatusNumber)
+	if err != nil {
+		return nil, fmt.Errorf("failed parsing edgeStackStatus: %w", err)
+	}
+
+	if !slices.Contains([]portainer.EdgeStackStatusType{
+		portainer.EdgeStackStatusPending,
+		portainer.EdgeStackStatusDeploymentReceived,
+		portainer.EdgeStackStatusError,
+		portainer.EdgeStackStatusAcknowledged,
+		portainer.EdgeStackStatusRemoved,
+		portainer.EdgeStackStatusRemoteUpdateSuccess,
+		portainer.EdgeStackStatusImagesPulled,
+		portainer.EdgeStackStatusRunning,
+		portainer.EdgeStackStatusDeploying,
+		portainer.EdgeStackStatusRemoving,
+		portainer.EdgeStackStatusCompleted,
+	}, edgeStackStatus) {
+		return nil, errors.New("invalid edgeStackStatus parameter")
+	}
+
+	return &edgeStackStatus, nil
+}
+
+func getShortestAsyncInterval(endpoint *portainer.Endpoint, settings *portainer.Settings) int {
+	const edgeIntervalUseDefault = -1
+
+	pingInterval := endpoint.Edge.PingInterval
+	if pingInterval == edgeIntervalUseDefault {
+		pingInterval = settings.Edge.PingInterval
+	}
+
+	snapshotInterval := endpoint.Edge.SnapshotInterval
+	if snapshotInterval == edgeIntervalUseDefault {
+		snapshotInterval = settings.Edge.SnapshotInterval
+	}
+
+	commandInterval := endpoint.Edge.CommandInterval
+	if commandInterval == edgeIntervalUseDefault {
+		commandInterval = settings.Edge.CommandInterval
+	}
+
+	return min(pingInterval, snapshotInterval, commandInterval)
+}
diff --git a/api/http/handler/endpoints/filter_test.go b/api/http/handler/endpoints/filter_test.go
new file mode 100644
index 0000000..7505c26
--- /dev/null
+++ b/api/http/handler/endpoints/filter_test.go
@@ -0,0 +1,754 @@
+package endpoints
+
+import (
+	"net/http"
+	"net/url"
+	"strconv"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+	"github.com/portainer/portainer/api/roar"
+	"github.com/portainer/portainer/api/slicesx"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type filterTest struct {
+	title    string
+	expected []portainer.EndpointID
+	query    EnvironmentsQuery
+}
+
+func Test_Filter_AgentVersion(t *testing.T) {
+	t.Parallel()
+	version1Endpoint := portainer.Endpoint{ID: 1, GroupID: 1,
+		Type:  portainer.AgentOnDockerEnvironment,
+		Agent: portainer.EnvironmentAgentData{Version: "1.0.0"}}
+	version2Endpoint := portainer.Endpoint{ID: 2, GroupID: 1,
+		Type:  portainer.AgentOnDockerEnvironment,
+		Agent: portainer.EnvironmentAgentData{Version: "2.0.0"}}
+	noVersionEndpoint := portainer.Endpoint{ID: 3, GroupID: 1,
+		Type: portainer.AgentOnDockerEnvironment,
+	}
+	notAgentEnvironments := portainer.Endpoint{ID: 4, Type: portainer.DockerEnvironment, GroupID: 1}
+
+	endpoints := []portainer.Endpoint{
+		version1Endpoint,
+		version2Endpoint,
+		noVersionEndpoint,
+		notAgentEnvironments,
+	}
+
+	handler := setupFilterTest(t, endpoints)
+
+	tests := []filterTest{
+		{
+			"should show version 1 endpoints",
+			[]portainer.EndpointID{version1Endpoint.ID},
+			EnvironmentsQuery{
+				agentVersions: []string{version1Endpoint.Agent.Version},
+				types:         []portainer.EndpointType{portainer.AgentOnDockerEnvironment},
+			},
+		},
+		{
+			"should show version 2 endpoints",
+			[]portainer.EndpointID{version2Endpoint.ID},
+			EnvironmentsQuery{
+				agentVersions: []string{version2Endpoint.Agent.Version},
+				types:         []portainer.EndpointType{portainer.AgentOnDockerEnvironment},
+			},
+		},
+		{
+			"should show version 1 and 2 endpoints",
+			[]portainer.EndpointID{version2Endpoint.ID, version1Endpoint.ID},
+			EnvironmentsQuery{
+				agentVersions: []string{version2Endpoint.Agent.Version, version1Endpoint.Agent.Version},
+				types:         []portainer.EndpointType{portainer.AgentOnDockerEnvironment},
+			},
+		},
+	}
+
+	runTests(tests, t, handler, endpoints)
+}
+
+func Test_Filter_edgeFilter(t *testing.T) {
+	t.Parallel()
+	trustedEdgeAsync := portainer.Endpoint{ID: 1, UserTrusted: true, Edge: portainer.EnvironmentEdgeSettings{AsyncMode: true}, GroupID: 1, Type: portainer.EdgeAgentOnDockerEnvironment}
+	untrustedEdgeAsync := portainer.Endpoint{ID: 2, UserTrusted: false, Edge: portainer.EnvironmentEdgeSettings{AsyncMode: true}, GroupID: 1, Type: portainer.EdgeAgentOnDockerEnvironment}
+	regularUntrustedEdgeStandard := portainer.Endpoint{ID: 3, UserTrusted: false, Edge: portainer.EnvironmentEdgeSettings{AsyncMode: false}, GroupID: 1, Type: portainer.EdgeAgentOnDockerEnvironment}
+	regularTrustedEdgeStandard := portainer.Endpoint{ID: 4, UserTrusted: true, Edge: portainer.EnvironmentEdgeSettings{AsyncMode: false}, GroupID: 1, Type: portainer.EdgeAgentOnDockerEnvironment}
+	regularEndpoint := portainer.Endpoint{ID: 5, GroupID: 1, Type: portainer.DockerEnvironment}
+
+	endpoints := []portainer.Endpoint{
+		trustedEdgeAsync,
+		untrustedEdgeAsync,
+		regularUntrustedEdgeStandard,
+		regularTrustedEdgeStandard,
+		regularEndpoint,
+	}
+
+	handler := setupFilterTest(t, endpoints)
+
+	tests := []filterTest{
+		{
+			"should show all edge endpoints except of the untrusted edge",
+			[]portainer.EndpointID{trustedEdgeAsync.ID, regularTrustedEdgeStandard.ID},
+			EnvironmentsQuery{
+				types: []portainer.EndpointType{portainer.EdgeAgentOnDockerEnvironment, portainer.EdgeAgentOnKubernetesEnvironment},
+			},
+		},
+		{
+			"should show only trusted edge devices and other regular endpoints",
+			[]portainer.EndpointID{trustedEdgeAsync.ID, regularEndpoint.ID},
+			EnvironmentsQuery{
+				edgeAsync: new(true),
+			},
+		},
+		{
+			"should show only untrusted edge devices and other regular endpoints",
+			[]portainer.EndpointID{untrustedEdgeAsync.ID, regularEndpoint.ID},
+			EnvironmentsQuery{
+				edgeAsync:           new(true),
+				edgeDeviceUntrusted: true,
+			},
+		},
+		{
+			"should show no edge devices",
+			[]portainer.EndpointID{regularEndpoint.ID, regularTrustedEdgeStandard.ID},
+			EnvironmentsQuery{
+				edgeAsync: new(false),
+			},
+		},
+	}
+
+	runTests(tests, t, handler, endpoints)
+}
+
+func Test_Filter_excludeIDs(t *testing.T) {
+	t.Parallel()
+	ids := []portainer.EndpointID{1, 2, 3, 4, 5, 6, 7, 8, 9}
+
+	environments := slicesx.Map(ids, func(id portainer.EndpointID) portainer.Endpoint {
+		return portainer.Endpoint{ID: id, GroupID: 1, Type: portainer.DockerEnvironment}
+	})
+
+	handler := setupFilterTest(t, environments)
+
+	tests := []filterTest{
+		{
+			title:    "should exclude IDs 2,5,8",
+			expected: []portainer.EndpointID{1, 3, 4, 6, 7, 9},
+			query: EnvironmentsQuery{
+				excludeIds: []portainer.EndpointID{2, 5, 8},
+			},
+		},
+	}
+
+	runTests(tests, t, handler, environments)
+}
+
+func Test_Filter_excludeGroupIDs(t *testing.T) {
+	t.Parallel()
+	groupA := portainer.EndpointGroupID(10)
+	groupB := portainer.EndpointGroupID(20)
+	groupC := portainer.EndpointGroupID(30)
+
+	endpoints := []portainer.Endpoint{
+		{ID: 1, GroupID: groupA, Type: portainer.DockerEnvironment},
+		{ID: 2, GroupID: groupA, Type: portainer.DockerEnvironment},
+		{ID: 3, GroupID: groupB, Type: portainer.DockerEnvironment},
+		{ID: 4, GroupID: groupB, Type: portainer.DockerEnvironment},
+		{ID: 5, GroupID: groupC, Type: portainer.DockerEnvironment},
+	}
+
+	handler := setupFilterTest(t, endpoints)
+
+	tests := []filterTest{
+		{
+			title:    "should exclude endpoints in groupA",
+			expected: []portainer.EndpointID{3, 4, 5},
+			query: EnvironmentsQuery{
+				excludeGroupIds: []portainer.EndpointGroupID{groupA},
+			},
+		},
+		{
+			title:    "should exclude endpoints in groupA and groupB",
+			expected: []portainer.EndpointID{5},
+			query: EnvironmentsQuery{
+				excludeGroupIds: []portainer.EndpointGroupID{groupA, groupB},
+			},
+		},
+		{
+			title:    "should return all endpoints when excludeGroupIds is empty",
+			expected: []portainer.EndpointID{1, 2, 3, 4, 5},
+			query:    EnvironmentsQuery{},
+		},
+	}
+
+	runTests(tests, t, handler, endpoints)
+}
+
+func BenchmarkFilterEndpointsBySearchCriteria_PartialMatch(b *testing.B) {
+	n := 10000
+
+	endpointIDs := []portainer.EndpointID{}
+
+	endpoints := []portainer.Endpoint{}
+	for i := range n {
+		endpoints = append(endpoints, portainer.Endpoint{
+			ID:      portainer.EndpointID(i + 1),
+			Name:    "endpoint-" + strconv.Itoa(i+1),
+			GroupID: 1,
+			TagIDs:  []portainer.TagID{1},
+			Type:    portainer.EdgeAgentOnDockerEnvironment,
+		})
+
+		endpointIDs = append(endpointIDs, portainer.EndpointID(i+1))
+	}
+
+	endpointGroups := []portainer.EndpointGroup{}
+
+	edgeGroups := []portainer.EdgeGroup{}
+	for i := range 1000 {
+		edgeGroups = append(edgeGroups, portainer.EdgeGroup{
+			ID:           portainer.EdgeGroupID(i + 1),
+			Name:         "edge-group-" + strconv.Itoa(i+1),
+			EndpointIDs:  roar.FromSlice(endpointIDs),
+			Dynamic:      true,
+			TagIDs:       []portainer.TagID{1, 2, 3},
+			PartialMatch: true,
+		})
+	}
+
+	tagsMap := map[portainer.TagID]string{}
+	for i := range 10 {
+		tagsMap[portainer.TagID(i+1)] = "tag-" + strconv.Itoa(i+1)
+	}
+
+	searchString := "edge-group"
+
+	for b.Loop() {
+		e := filterEndpointsBySearchCriteria(endpoints, endpointGroups, edgeGroups, tagsMap, searchString)
+		if len(e) != n {
+			b.FailNow()
+		}
+	}
+}
+
+func BenchmarkFilterEndpointsBySearchCriteria_FullMatch(b *testing.B) {
+	n := 10000
+
+	endpointIDs := []portainer.EndpointID{}
+
+	endpoints := []portainer.Endpoint{}
+	for i := range n {
+		endpoints = append(endpoints, portainer.Endpoint{
+			ID:      portainer.EndpointID(i + 1),
+			Name:    "endpoint-" + strconv.Itoa(i+1),
+			GroupID: 1,
+			TagIDs:  []portainer.TagID{1, 2, 3},
+			Type:    portainer.EdgeAgentOnDockerEnvironment,
+		})
+
+		endpointIDs = append(endpointIDs, portainer.EndpointID(i+1))
+	}
+
+	endpointGroups := []portainer.EndpointGroup{}
+
+	edgeGroups := []portainer.EdgeGroup{}
+	for i := range 1000 {
+		edgeGroups = append(edgeGroups, portainer.EdgeGroup{
+			ID:          portainer.EdgeGroupID(i + 1),
+			Name:        "edge-group-" + strconv.Itoa(i+1),
+			EndpointIDs: roar.FromSlice(endpointIDs),
+			Dynamic:     true,
+			TagIDs:      []portainer.TagID{1},
+		})
+	}
+
+	tagsMap := map[portainer.TagID]string{}
+	for i := range 10 {
+		tagsMap[portainer.TagID(i+1)] = "tag-" + strconv.Itoa(i+1)
+	}
+
+	searchString := "edge-group"
+
+	for b.Loop() {
+		e := filterEndpointsBySearchCriteria(endpoints, endpointGroups, edgeGroups, tagsMap, searchString)
+		require.Len(b, e, n)
+	}
+}
+
+func runTests(tests []filterTest, t *testing.T, handler *Handler, endpoints []portainer.Endpoint) {
+	for _, test := range tests {
+		t.Run(test.title, func(t *testing.T) {
+			runTest(t, test, handler, append([]portainer.Endpoint{}, endpoints...))
+		})
+	}
+}
+
+func runTest(t *testing.T, test filterTest, handler *Handler, endpoints []portainer.Endpoint) {
+	is := assert.New(t)
+
+	filteredEndpoints, _, err := handler.filterEndpointsByQuery(
+		endpoints,
+		test.query,
+		[]portainer.EndpointGroup{},
+		[]portainer.EdgeGroup{},
+		&portainer.Settings{},
+		&security.RestrictedRequestContext{IsAdmin: true},
+	)
+
+	require.NoError(t, err)
+
+	is.Len(filteredEndpoints, len(test.expected))
+
+	respIds := []portainer.EndpointID{}
+
+	for _, endpoint := range filteredEndpoints {
+		respIds = append(respIds, endpoint.ID)
+	}
+
+	is.ElementsMatch(test.expected, respIds)
+}
+
+func setupFilterTest(t *testing.T, endpoints []portainer.Endpoint) *Handler {
+	_, store := datastore.MustNewTestStore(t, true, true)
+
+	for _, endpoint := range endpoints {
+		err := store.Endpoint().Create(&endpoint)
+		require.NoError(t, err, "error creating environment")
+	}
+
+	err := store.User().Create(&portainer.User{Username: "admin", Role: portainer.AdministratorRole})
+	require.NoError(t, err, "error creating a user")
+
+	bouncer := testhelpers.NewTestRequestBouncer()
+	handler := NewHandler(bouncer)
+	handler.DataStore = store
+	handler.ComposeStackManager = testhelpers.NewComposeStackManager()
+
+	return handler
+}
+
+func TestFilterEndpointsByEdgeStack(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, false)
+
+	endpoints := []portainer.Endpoint{
+		{ID: 1, Name: "Endpoint 1", Type: portainer.EdgeAgentOnDockerEnvironment, UserTrusted: true},
+		{ID: 2, Name: "Endpoint 2", TagIDs: []portainer.TagID{1}, Type: portainer.EdgeAgentOnDockerEnvironment, UserTrusted: true},
+		{ID: 3, Name: "Endpoint 3", TagIDs: []portainer.TagID{1}, Type: portainer.EdgeAgentOnDockerEnvironment, UserTrusted: true},
+		{ID: 4, Name: "Endpoint 4"},
+	}
+
+	edgeStackId := portainer.EdgeStackID(1)
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		require.NoError(t, tx.Tag().Create(&portainer.Tag{ID: 1, Name: "tag", Endpoints: map[portainer.EndpointID]bool{2: true, 3: true}}))
+
+		for i := range endpoints {
+			require.NoError(t, tx.Endpoint().Create(&endpoints[i]))
+		}
+
+		require.NoError(t, tx.EdgeStack().Create(edgeStackId, &portainer.EdgeStack{
+			ID:         edgeStackId,
+			Name:       "Test Edge Stack",
+			EdgeGroups: []portainer.EdgeGroupID{1, 2},
+		}))
+
+		require.NoError(t, tx.EdgeGroup().Create(&portainer.EdgeGroup{
+			ID:          1,
+			Name:        "Edge Group 1",
+			EndpointIDs: roar.FromSlice([]portainer.EndpointID{1}),
+		}))
+
+		require.NoError(t, tx.EdgeGroup().Create(&portainer.EdgeGroup{
+			ID:      2,
+			Name:    "Edge Group 2",
+			Dynamic: true,
+			TagIDs:  []portainer.TagID{1},
+		}))
+
+		require.NoError(t, tx.EdgeStackStatus().Create(edgeStackId, endpoints[0].ID, &portainer.EdgeStackStatusForEnv{
+			Status: []portainer.EdgeStackDeploymentStatus{{Type: portainer.EdgeStackStatusAcknowledged}}}))
+
+		return nil
+	}))
+
+	test := func(status *portainer.EdgeStackStatusType, expected []portainer.Endpoint) {
+		tmp := make([]portainer.Endpoint, len(endpoints))
+		require.Equal(t, 4, copy(tmp, endpoints))
+		es, err := filterEndpointsByEdgeStack(tmp, edgeStackId, status, store)
+		require.NoError(t, err)
+		// validate that the len is the same
+		require.Len(t, es, len(expected))
+		// and that all items are the expected ones
+		for i := range expected {
+			require.Contains(t, es, expected[i])
+		}
+	}
+
+	test(nil, []portainer.Endpoint{endpoints[0], endpoints[1], endpoints[2]})
+
+	status := portainer.EdgeStackStatusPending
+	test(&status, []portainer.Endpoint{endpoints[1], endpoints[2]})
+
+	status = portainer.EdgeStackStatusCompleted
+	test(&status, []portainer.Endpoint{})
+
+	status = portainer.EdgeStackStatusAcknowledged
+	test(&status, []portainer.Endpoint{endpoints[0]}) // that's the only one with an edge stack status in DB
+}
+
+func TestErrorsFilterEndpointsByEdgeStack(t *testing.T) {
+	t.Parallel()
+	t.Run("must error by edge stack not found", func(t *testing.T) {
+		_, store := datastore.MustNewTestStore(t, false, false)
+		require.NotNil(t, store)
+
+		_, err := filterEndpointsByEdgeStack([]portainer.Endpoint{}, 1, nil, store)
+		require.Error(t, err)
+	})
+
+	t.Run("must error by edge group not found", func(t *testing.T) {
+		_, store := datastore.MustNewTestStore(t, false, false)
+		require.NotNil(t, store)
+
+		require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+			require.NoError(t, tx.EdgeStack().Create(1, &portainer.EdgeStack{ID: 1, Name: "1", EdgeGroups: []portainer.EdgeGroupID{1}}))
+			return nil
+		}))
+		_, err := filterEndpointsByEdgeStack([]portainer.Endpoint{}, 1, nil, store)
+		require.Error(t, err)
+	})
+
+	t.Run("must error by env tag not found", func(t *testing.T) {
+		_, store := datastore.MustNewTestStore(t, false, false)
+		require.NotNil(t, store)
+
+		require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+			require.NoError(t, tx.EdgeStack().Create(1, &portainer.EdgeStack{ID: 1, Name: "1", EdgeGroups: []portainer.EdgeGroupID{1}}))
+			require.NoError(t, tx.EdgeGroup().Create(&portainer.EdgeGroup{ID: 1, Name: "edge group", Dynamic: true, TagIDs: []portainer.TagID{1}}))
+			return nil
+		}))
+		_, err := filterEndpointsByEdgeStack([]portainer.Endpoint{}, 1, nil, store)
+		require.Error(t, err)
+	})
+}
+
+func TestFilterEndpointsByEdgeGroup(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, false)
+
+	endpoints := []portainer.Endpoint{
+		{ID: 1, Name: "Endpoint 1"},
+		{ID: 2, Name: "Endpoint 2"},
+		{ID: 3, Name: "Endpoint 3"},
+		{ID: 4, Name: "Endpoint 4"},
+	}
+
+	err := store.EdgeGroup().Create(&portainer.EdgeGroup{
+		ID:          1,
+		Name:        "Edge Group 1",
+		EndpointIDs: roar.FromSlice([]portainer.EndpointID{1}),
+	})
+	require.NoError(t, err)
+
+	err = store.EdgeGroup().Create(&portainer.EdgeGroup{
+		ID:          2,
+		Name:        "Edge Group 2",
+		EndpointIDs: roar.FromSlice([]portainer.EndpointID{2, 3}),
+	})
+	require.NoError(t, err)
+
+	edgeGroups, err := store.EdgeGroup().ReadAll()
+	require.NoError(t, err)
+
+	es, egs := filterEndpointsByEdgeGroupIDs(endpoints, edgeGroups, []portainer.EdgeGroupID{1, 2})
+	require.NoError(t, err)
+
+	require.Len(t, es, 3)
+	require.Contains(t, es, endpoints[0])    // Endpoint 1
+	require.Contains(t, es, endpoints[1])    // Endpoint 2
+	require.Contains(t, es, endpoints[2])    // Endpoint 3
+	require.NotContains(t, es, endpoints[3]) // Endpoint 4
+
+	require.Len(t, egs, 2)
+	require.Equal(t, egs[0].ID, portainer.EdgeGroupID(1))
+	require.Equal(t, egs[1].ID, portainer.EdgeGroupID(2))
+}
+
+func TestFilterEndpointsByExcludeEdgeGroupIDs(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, false)
+
+	endpoints := []portainer.Endpoint{
+		{ID: 1, Name: "Endpoint 1"},
+		{ID: 2, Name: "Endpoint 2"},
+		{ID: 3, Name: "Endpoint 3"},
+		{ID: 4, Name: "Endpoint 4"},
+	}
+
+	err := store.EdgeGroup().Create(&portainer.EdgeGroup{
+		ID:          1,
+		Name:        "Edge Group 1",
+		EndpointIDs: roar.FromSlice([]portainer.EndpointID{1}),
+	})
+	require.NoError(t, err)
+
+	err = store.EdgeGroup().Create(&portainer.EdgeGroup{
+		ID:          2,
+		Name:        "Edge Group 2",
+		EndpointIDs: roar.FromSlice([]portainer.EndpointID{2, 3}),
+	})
+	require.NoError(t, err)
+
+	edgeGroups, err := store.EdgeGroup().ReadAll()
+	require.NoError(t, err)
+
+	es, egs := filterEndpointsByExcludeEdgeGroupIDs(endpoints, edgeGroups, []portainer.EdgeGroupID{1})
+	require.NoError(t, err)
+
+	require.Len(t, es, 3)
+	require.Equal(t, []portainer.Endpoint{
+		{ID: 2, Name: "Endpoint 2"},
+		{ID: 3, Name: "Endpoint 3"},
+		{ID: 4, Name: "Endpoint 4"},
+	}, es)
+
+	require.Len(t, egs, 1)
+	require.Equal(t, egs[0].ID, portainer.EdgeGroupID(2))
+}
+
+func TestGetShortestAsyncInterval(t *testing.T) {
+	t.Parallel()
+	endpoint := &portainer.Endpoint{
+		ID:   1,
+		Name: "Test Endpoint",
+		Edge: portainer.EnvironmentEdgeSettings{
+			PingInterval:     -1,
+			SnapshotInterval: -1,
+			CommandInterval:  -1,
+		},
+	}
+
+	settings := &portainer.Settings{
+		Edge: portainer.Edge{
+			PingInterval:     10,
+			SnapshotInterval: 20,
+			CommandInterval:  30,
+		},
+	}
+
+	require.Equal(t, 10, getShortestAsyncInterval(endpoint, settings))
+}
+
+func Test_filterEndpointsByPlatform(t *testing.T) {
+	ep := func(id portainer.EndpointID, epType portainer.EndpointType, containerEngine string) portainer.Endpoint {
+		return portainer.Endpoint{
+			ID:              id,
+			Type:            epType,
+			ContainerEngine: containerEngine,
+		}
+	}
+
+	docker := ep(1, portainer.DockerEnvironment, portainer.ContainerEngineDocker)
+	agentDocker := ep(2, portainer.AgentOnDockerEnvironment, portainer.ContainerEngineDocker)
+	edgeAgentDocker := ep(3, portainer.EdgeAgentOnDockerEnvironment, portainer.ContainerEngineDocker)
+	podman := ep(4, portainer.DockerEnvironment, portainer.ContainerEnginePodman)
+	agentPodman := ep(5, portainer.AgentOnDockerEnvironment, portainer.ContainerEnginePodman)
+	edgeAgentPodman := ep(6, portainer.EdgeAgentOnDockerEnvironment, portainer.ContainerEnginePodman)
+	k8sLocal := ep(7, portainer.KubernetesLocalEnvironment, "")
+	agentK8s := ep(8, portainer.AgentOnKubernetesEnvironment, "")
+	edgeAgentK8s := ep(9, portainer.EdgeAgentOnKubernetesEnvironment, "")
+	azure := ep(10, portainer.AzureEnvironment, "")
+
+	type args struct {
+		endpoints     []portainer.Endpoint
+		platformTypes []portainer.PlatformType
+	}
+	tests := []struct {
+		name string
+		args args
+		want []portainer.Endpoint
+	}{
+		// Docker platform types
+		{
+			name: "DockerEnvironment is Docker platform",
+			args: args{endpoints: []portainer.Endpoint{docker}, platformTypes: []portainer.PlatformType{portainer.DockerPlatformType}},
+			want: []portainer.Endpoint{docker},
+		},
+		{
+			name: "AgentOnDockerEnvironment is Docker platform",
+			args: args{endpoints: []portainer.Endpoint{agentDocker}, platformTypes: []portainer.PlatformType{portainer.DockerPlatformType}},
+			want: []portainer.Endpoint{agentDocker},
+		},
+		{
+			name: "EdgeAgentOnDockerEnvironment is Docker platform",
+			args: args{endpoints: []portainer.Endpoint{edgeAgentDocker}, platformTypes: []portainer.PlatformType{portainer.DockerPlatformType}},
+			want: []portainer.Endpoint{edgeAgentDocker},
+		},
+		// Podman platform types
+		{
+			name: "DockerEnvironment with Podman engine is Podman platform",
+			args: args{endpoints: []portainer.Endpoint{podman}, platformTypes: []portainer.PlatformType{portainer.PodmanPlatformType}},
+			want: []portainer.Endpoint{podman},
+		},
+		{
+			name: "AgentOnDockerEnvironment with Podman engine is Podman platform",
+			args: args{endpoints: []portainer.Endpoint{agentPodman}, platformTypes: []portainer.PlatformType{portainer.PodmanPlatformType}},
+			want: []portainer.Endpoint{agentPodman},
+		},
+		{
+			name: "EdgeAgentOnDockerEnvironment with Podman engine is Podman platform",
+			args: args{endpoints: []portainer.Endpoint{edgeAgentPodman}, platformTypes: []portainer.PlatformType{portainer.PodmanPlatformType}},
+			want: []portainer.Endpoint{edgeAgentPodman},
+		},
+		// Kubernetes platform types
+		{
+			name: "KubernetesLocalEnvironment is Kubernetes platform",
+			args: args{endpoints: []portainer.Endpoint{k8sLocal}, platformTypes: []portainer.PlatformType{portainer.KubernetesPlatformType}},
+			want: []portainer.Endpoint{k8sLocal},
+		},
+		{
+			name: "AgentOnKubernetesEnvironment is Kubernetes platform",
+			args: args{endpoints: []portainer.Endpoint{agentK8s}, platformTypes: []portainer.PlatformType{portainer.KubernetesPlatformType}},
+			want: []portainer.Endpoint{agentK8s},
+		},
+		{
+			name: "EdgeAgentOnKubernetesEnvironment is Kubernetes platform",
+			args: args{endpoints: []portainer.Endpoint{edgeAgentK8s}, platformTypes: []portainer.PlatformType{portainer.KubernetesPlatformType}},
+			want: []portainer.Endpoint{edgeAgentK8s},
+		},
+		// Azure platform type
+		{
+			name: "AzureEnvironment is Azure platform",
+			args: args{endpoints: []portainer.Endpoint{azure}, platformTypes: []portainer.PlatformType{portainer.AzurePlatformType}},
+			want: []portainer.Endpoint{azure},
+		},
+		// Filter behaviour
+		{
+			name: "filters out non-matching platform types",
+			args: args{
+				endpoints:     []portainer.Endpoint{docker, k8sLocal, azure},
+				platformTypes: []portainer.PlatformType{portainer.DockerPlatformType},
+			},
+			want: []portainer.Endpoint{docker},
+		},
+		{
+			name: "multiple platform types returns all matches",
+			args: args{
+				endpoints:     []portainer.Endpoint{docker, agentDocker, edgeAgentDocker, podman, k8sLocal, agentK8s, edgeAgentK8s, azure},
+				platformTypes: []portainer.PlatformType{portainer.DockerPlatformType, portainer.KubernetesPlatformType},
+			},
+			want: []portainer.Endpoint{docker, agentDocker, edgeAgentDocker, k8sLocal, agentK8s, edgeAgentK8s},
+		},
+		{
+			name: "Podman endpoints not returned when filtering for Docker",
+			args: args{
+				endpoints:     []portainer.Endpoint{docker, podman, agentPodman},
+				platformTypes: []portainer.PlatformType{portainer.DockerPlatformType},
+			},
+			want: []portainer.Endpoint{docker},
+		},
+		{
+			name: "returns empty when no endpoints match filter",
+			args: args{
+				endpoints:     []portainer.Endpoint{k8sLocal, azure},
+				platformTypes: []portainer.PlatformType{portainer.DockerPlatformType},
+			},
+			want: []portainer.Endpoint{},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equalf(t, tt.want, filterEndpointsByPlatform(tt.args.endpoints, tt.args.platformTypes), "filterEndpointsByPlatform(%v, %v)", tt.args.endpoints, tt.args.platformTypes)
+		})
+	}
+}
+
+func Test_FilterQuery_PlatformTypes(t *testing.T) {
+	t.Parallel()
+	dockerEndpoint := portainer.Endpoint{ID: 1, GroupID: 1, Type: portainer.DockerEnvironment}
+	kubernetesEndpoint := portainer.Endpoint{ID: 2, GroupID: 1, Type: portainer.KubernetesLocalEnvironment}
+	azureEndpoint := portainer.Endpoint{ID: 3, GroupID: 1, Type: portainer.AzureEnvironment}
+
+	endpoints := []portainer.Endpoint{dockerEndpoint, kubernetesEndpoint, azureEndpoint}
+	handler := setupFilterTest(t, endpoints)
+
+	tests := []filterTest{
+		{
+			title:    "platformTypes filter returns only matching platform",
+			expected: []portainer.EndpointID{dockerEndpoint.ID},
+			query:    EnvironmentsQuery{platformTypes: []portainer.PlatformType{portainer.DockerPlatformType}},
+		},
+		{
+			title:    "multiple platformTypes returns all matching platforms",
+			expected: []portainer.EndpointID{dockerEndpoint.ID, kubernetesEndpoint.ID},
+			query:    EnvironmentsQuery{platformTypes: []portainer.PlatformType{portainer.DockerPlatformType, portainer.KubernetesPlatformType}},
+		},
+	}
+
+	runTests(tests, t, handler, endpoints)
+}
+
+func Test_FilterQuery_Outdated(t *testing.T) {
+	t.Parallel()
+	currentVersion := portainer.APIVersion
+	upToDateEndpoint := portainer.Endpoint{ID: 1, GroupID: 1, Type: portainer.AgentOnDockerEnvironment}
+	upToDateEndpoint.Agent.Version = currentVersion
+
+	outdatedEndpoint := portainer.Endpoint{ID: 2, GroupID: 1, Type: portainer.AgentOnDockerEnvironment}
+	outdatedEndpoint.Agent.Version = "2.0.0"
+
+	endpoints := []portainer.Endpoint{upToDateEndpoint, outdatedEndpoint}
+	handler := setupFilterTest(t, endpoints)
+
+	tests := []filterTest{
+		{
+			title:    "outdated filter returns only outdated endpoints",
+			expected: []portainer.EndpointID{outdatedEndpoint.ID},
+			query:    EnvironmentsQuery{outdated: true},
+		},
+		{
+			title:    "outdated=false returns all endpoints",
+			expected: []portainer.EndpointID{upToDateEndpoint.ID, outdatedEndpoint.ID},
+			query:    EnvironmentsQuery{outdated: false},
+		},
+	}
+
+	runTests(tests, t, handler, endpoints)
+}
+
+func Test_parseQuery_emptyArrayParams(t *testing.T) {
+	t.Parallel()
+
+	makeRequest := func(rawQuery string) *http.Request {
+		r := &http.Request{URL: &url.URL{RawQuery: rawQuery}}
+		require.NoError(t, r.ParseForm())
+		return r
+	}
+
+	tests := []struct {
+		name  string
+		query string
+	}{
+		{name: "empty status", query: "status="},
+		{name: "empty endpointIds", query: "endpointIds="},
+		{name: "empty groupIds", query: "groupIds="},
+		{name: "empty tagIds", query: "tagIds="},
+		{name: "multiple empty params", query: "status=&groupIds=&tagIds="},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			_, err := parseQuery(makeRequest(tt.query))
+			require.NoError(t, err)
+		})
+	}
+}
diff --git a/api/http/handler/endpoints/handler.go b/api/http/handler/endpoints/handler.go
new file mode 100644
index 0000000..8f61bfb
--- /dev/null
+++ b/api/http/handler/endpoints/handler.go
@@ -0,0 +1,94 @@
+package endpoints
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	dockerclient "github.com/portainer/portainer/api/docker/client"
+	"github.com/portainer/portainer/api/http/proxy"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/kubernetes/cli"
+	"github.com/portainer/portainer/api/pendingactions"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+
+	"github.com/gorilla/mux"
+)
+
+func hideFields(endpoint *portainer.Endpoint) {
+	endpoint.AzureCredentials = portainer.AzureCredentials{}
+	if len(endpoint.Snapshots) > 0 {
+		endpoint.Snapshots[0].SnapshotRaw = portainer.DockerSnapshotRaw{}
+	}
+}
+
+// Handler is the HTTP handler used to handle environment(endpoint) operations.
+type Handler struct {
+	*mux.Router
+	requestBouncer         security.BouncerService
+	DataStore              dataservices.DataStore
+	FileService            portainer.FileService
+	ProxyManager           *proxy.Manager
+	ReverseTunnelService   portainer.ReverseTunnelService
+	SnapshotService        portainer.SnapshotService
+	K8sClientFactory       *cli.ClientFactory
+	ComposeStackManager    portainer.ComposeStackManager
+	AuthorizationService   *authorization.Service
+	DockerClientFactory    *dockerclient.ClientFactory
+	BindAddress            string
+	BindAddressHTTPS       string
+	PendingActionsService  *pendingactions.PendingActionsService
+	PullLimitCheckDisabled bool
+}
+
+// NewHandler creates a handler to manage environment(endpoint) operations.
+func NewHandler(bouncer security.BouncerService) *Handler {
+	h := &Handler{
+		Router:         mux.NewRouter(),
+		requestBouncer: bouncer,
+	}
+
+	h.Handle("/endpoints",
+		bouncer.AdminAccess(httperror.LoggerHandler(h.endpointCreate))).Methods(http.MethodPost)
+	h.Handle("/endpoints/{id}/settings",
+		bouncer.AdminAccess(httperror.LoggerHandler(h.endpointSettingsUpdate))).Methods(http.MethodPut)
+	h.Handle("/endpoints/{id}/association",
+		bouncer.AdminAccess(httperror.LoggerHandler(h.endpointAssociationDelete))).Methods(http.MethodDelete)
+	h.Handle("/endpoints/snapshot",
+		bouncer.AdminAccess(httperror.LoggerHandler(h.endpointSnapshots))).Methods(http.MethodPost)
+	h.Handle("/endpoints",
+		bouncer.RestrictedAccess(httperror.LoggerHandler(h.endpointList))).Methods(http.MethodGet)
+	h.Handle("/endpoints/agent_versions",
+		bouncer.RestrictedAccess(httperror.LoggerHandler(h.agentVersions))).Methods(http.MethodGet)
+	h.Handle("/endpoints/summary",
+		bouncer.RestrictedAccess(httperror.LoggerHandler(h.endpointSummaryCounts))).Methods(http.MethodGet)
+	h.Handle("/endpoints/relations", bouncer.AdminAccess(httperror.LoggerHandler(h.updateRelations))).Methods(http.MethodPut)
+
+	h.Handle("/endpoints/{id}",
+		bouncer.RestrictedAccess(httperror.LoggerHandler(h.endpointInspect))).Methods(http.MethodGet)
+	h.Handle("/endpoints/{id}",
+		bouncer.AdminAccess(httperror.LoggerHandler(h.endpointUpdate))).Methods(http.MethodPut)
+	h.Handle("/endpoints/{id}",
+		bouncer.AdminAccess(httperror.LoggerHandler(h.endpointDelete))).Methods(http.MethodDelete)
+	h.Handle("/endpoints/delete",
+		bouncer.AdminAccess(httperror.LoggerHandler(h.endpointDeleteBatch))).Methods(http.MethodPost)
+	h.Handle("/endpoints/{id}/dockerhub/{registryId}",
+		bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.endpointDockerhubStatus))).Methods(http.MethodGet)
+	h.Handle("/endpoints/{id}/snapshot",
+		bouncer.AdminAccess(httperror.LoggerHandler(h.endpointSnapshot))).Methods(http.MethodPost)
+	h.Handle("/endpoints/{id}/registries",
+		bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.endpointRegistriesList))).Methods(http.MethodGet)
+	h.Handle("/endpoints/{id}/registries/{registryId}",
+		bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.endpointRegistryAccess))).Methods(http.MethodPut)
+
+	h.Handle("/endpoints/global-key", bouncer.PublicAccess(httperror.LoggerHandler(h.endpointCreateGlobalKey))).Methods(http.MethodPost)
+	h.Handle("/endpoints/{id}/forceupdateservice",
+		bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.endpointForceUpdateService))).Methods(http.MethodPut)
+
+	// DEPRECATED
+	h.Handle("/endpoints/{id}/status", bouncer.PublicAccess(httperror.LoggerHandler(h.endpointStatusInspect))).Methods(http.MethodGet)
+	h.Handle("/endpoints", bouncer.AdminAccess(httperror.LoggerHandler(h.endpointDeleteBatchDeprecated))).Methods(http.MethodDelete)
+
+	return h
+}
diff --git a/api/http/handler/endpoints/sort.go b/api/http/handler/endpoints/sort.go
new file mode 100644
index 0000000..55f60cd
--- /dev/null
+++ b/api/http/handler/endpoints/sort.go
@@ -0,0 +1,124 @@
+package endpoints
+
+import (
+	"slices"
+
+	"github.com/fvbommel/sortorder"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+)
+
+type comp[T any] func(a, b T) int
+
+func stringComp(a, b string) int {
+	if sortorder.NaturalLess(a, b) {
+		return -1
+	} else if sortorder.NaturalLess(b, a) {
+		return 1
+	} else {
+		return 0
+	}
+}
+
+func healthRank(endpoint *portainer.Endpoint, settings *portainer.Settings) int {
+	status := resolveEndpointStatus(endpoint, settings)
+	if status == statusDown {
+		return 0
+	}
+	if isOutdated(endpoint) {
+		return 1
+	}
+	if status == statusHeartbeat {
+		return 2
+	}
+	return 3
+}
+
+func sortEnvironmentsByField(environments []portainer.Endpoint, environmentGroups []portainer.EndpointGroup, sortField sortKey, isSortDesc bool, settings *portainer.Settings) {
+	if sortField == "" {
+		return
+	}
+
+	var less comp[portainer.Endpoint]
+	switch sortField {
+	case sortKeyName:
+		less = func(a, b portainer.Endpoint) int {
+			return stringComp(a.Name, b.Name)
+		}
+
+	case sortKeyGroup:
+		environmentGroupNames := make(map[portainer.EndpointGroupID]string, 0)
+		for _, group := range environmentGroups {
+			environmentGroupNames[group.ID] = group.Name
+		}
+
+		// set the "unassigned" group name to be empty string
+		environmentGroupNames[1] = ""
+
+		less = func(a, b portainer.Endpoint) int {
+			aGroup := environmentGroupNames[a.GroupID]
+			bGroup := environmentGroupNames[b.GroupID]
+
+			return stringComp(aGroup, bGroup)
+		}
+
+	case sortKeyStatus:
+		less = func(a, b portainer.Endpoint) int {
+			return int(a.Status - b.Status)
+		}
+
+	case sortKeyLastCheckInDate:
+		less = func(a, b portainer.Endpoint) int {
+			return int(a.LastCheckInDate - b.LastCheckInDate)
+		}
+	case sortKeyEdgeID:
+		less = func(a, b portainer.Endpoint) int {
+			return stringComp(a.EdgeID, b.EdgeID)
+		}
+
+	case sortKeyPlatformType:
+		less = func(a, b portainer.Endpoint) int {
+			return int(endpointutils.EndpointPlatformType(&a) - endpointutils.EndpointPlatformType(&b))
+		}
+	case sortKeyHealth:
+		less = func(a, b portainer.Endpoint) int {
+			return healthRank(&a, settings) - healthRank(&b, settings)
+		}
+	case sortKeyId:
+		less = func(a, b portainer.Endpoint) int {
+			return int(a.ID - b.ID)
+		}
+	}
+
+	slices.SortStableFunc(environments, func(a, b portainer.Endpoint) int {
+		mul := 1
+		if isSortDesc {
+			mul = -1
+		}
+
+		return less(a, b) * mul
+	})
+
+}
+
+type sortKey string
+
+const (
+	sortKeyName            sortKey = "Name"
+	sortKeyGroup           sortKey = "Group"
+	sortKeyStatus          sortKey = "Status"
+	sortKeyLastCheckInDate sortKey = "LastCheckIn"
+	sortKeyEdgeID          sortKey = "EdgeID"
+	sortKeyPlatformType    sortKey = "PlatformType"
+	sortKeyHealth          sortKey = "Health"
+	sortKeyId              sortKey = "Id"
+)
+
+func getSortKey(sortField string) sortKey {
+	fieldAsSortKey := sortKey(sortField)
+	if slices.Contains([]sortKey{sortKeyName, sortKeyGroup, sortKeyStatus, sortKeyLastCheckInDate, sortKeyEdgeID, sortKeyPlatformType, sortKeyHealth, sortKeyId}, fieldAsSortKey) {
+		return fieldAsSortKey
+	}
+
+	return ""
+}
diff --git a/api/http/handler/endpoints/sort_test.go b/api/http/handler/endpoints/sort_test.go
new file mode 100644
index 0000000..3adf4fa
--- /dev/null
+++ b/api/http/handler/endpoints/sort_test.go
@@ -0,0 +1,243 @@
+package endpoints
+
+import (
+	"testing"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/slicesx"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestSortEndpointsByField(t *testing.T) {
+	t.Parallel()
+	environments := []portainer.Endpoint{
+		{ID: 0, Name: "Environment 1", GroupID: 1, Status: 1, LastCheckInDate: 3, EdgeID: "edge32"},
+		{ID: 1, Name: "Environment 2", GroupID: 2, Status: 2, LastCheckInDate: 6, EdgeID: "edge57"},
+		{ID: 2, Name: "Environment 3", GroupID: 1, Status: 3, LastCheckInDate: 2, EdgeID: "test87"},
+		{ID: 3, Name: "Environment 4", GroupID: 2, Status: 4, LastCheckInDate: 1, EdgeID: "abc123"},
+	}
+
+	environmentGroups := []portainer.EndpointGroup{
+		{ID: 1, Name: "Group 1"},
+		{ID: 2, Name: "Group 2"},
+	}
+
+	tests := []struct {
+		name       string
+		sortField  sortKey
+		isSortDesc bool
+		expected   []portainer.EndpointID
+	}{
+		{
+			name:      "sort without value",
+			sortField: "",
+			expected: []portainer.EndpointID{
+				environments[0].ID,
+				environments[1].ID,
+				environments[2].ID,
+				environments[3].ID,
+			},
+		},
+		{
+			name:       "sort by name ascending",
+			sortField:  "Name",
+			isSortDesc: false,
+			expected: []portainer.EndpointID{
+				environments[0].ID,
+				environments[1].ID,
+				environments[2].ID,
+				environments[3].ID,
+			},
+		},
+		{
+			name:       "sort by name descending",
+			sortField:  "Name",
+			isSortDesc: true,
+			expected: []portainer.EndpointID{
+				environments[3].ID,
+				environments[2].ID,
+				environments[1].ID,
+				environments[0].ID,
+			},
+		},
+		{
+			name:       "sort by group name ascending",
+			sortField:  "Group",
+			isSortDesc: false,
+			expected: []portainer.EndpointID{
+				environments[0].ID,
+				environments[2].ID,
+				environments[1].ID,
+				environments[3].ID,
+			},
+		},
+		{
+			name:       "sort by group name descending",
+			sortField:  "Group",
+			isSortDesc: true,
+			expected: []portainer.EndpointID{
+				environments[1].ID,
+				environments[3].ID,
+				environments[0].ID,
+				environments[2].ID,
+			},
+		},
+
+		{
+			name:       "sort by status ascending",
+			sortField:  "Status",
+			isSortDesc: false,
+			expected: []portainer.EndpointID{
+				environments[0].ID,
+				environments[1].ID,
+				environments[2].ID,
+				environments[3].ID,
+			},
+		},
+		{
+			name:       "sort by status descending",
+			sortField:  "Status",
+			isSortDesc: true,
+			expected: []portainer.EndpointID{
+				environments[3].ID,
+				environments[2].ID,
+				environments[1].ID,
+				environments[0].ID,
+			},
+		},
+		{
+			name:       "sort by last check-in ascending",
+			sortField:  "LastCheckIn",
+			isSortDesc: false,
+			expected: []portainer.EndpointID{
+				environments[3].ID,
+				environments[2].ID,
+				environments[0].ID,
+				environments[1].ID,
+			},
+		},
+		{
+			name:       "sort by last check-in descending",
+			sortField:  "LastCheckIn",
+			isSortDesc: true,
+			expected: []portainer.EndpointID{
+				environments[1].ID,
+				environments[0].ID,
+				environments[2].ID,
+				environments[3].ID,
+			},
+		},
+		{
+			name:      "sort by edge ID ascending",
+			sortField: "EdgeID",
+			expected: []portainer.EndpointID{
+				environments[3].ID,
+				environments[0].ID,
+				environments[1].ID,
+				environments[2].ID,
+			},
+		},
+		{
+			name:       "sort by edge ID descending",
+			sortField:  "EdgeID",
+			isSortDesc: true,
+			expected: []portainer.EndpointID{
+				environments[2].ID,
+				environments[1].ID,
+				environments[0].ID,
+				environments[3].ID,
+			},
+		},
+		{
+			name:      "sort by platform type ascending groups same-platform types together",
+			sortField: "PlatformType",
+			expected: []portainer.EndpointID{
+				environments[0].ID,
+				environments[1].ID,
+				environments[2].ID,
+				environments[3].ID,
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			is := assert.New(t)
+			sortEnvironmentsByField(environments, environmentGroups, "Name", false, nil) // reset to default sort order
+
+			sortEnvironmentsByField(environments, environmentGroups, tt.sortField, tt.isSortDesc, nil)
+
+			is.Equal(tt.expected, getEndpointIDs(environments))
+		})
+	}
+}
+
+func getEndpointIDs(environments []portainer.Endpoint) []portainer.EndpointID {
+	return slicesx.Map(environments, func(environment portainer.Endpoint) portainer.EndpointID {
+		return environment.ID
+	})
+}
+
+func TestSortEndpointsByHealth(t *testing.T) {
+	t.Parallel()
+
+	settings := &portainer.Settings{EdgeAgentCheckinInterval: 30}
+
+	// Down: non-edge with Status=2
+	down := portainer.Endpoint{
+		ID:     0,
+		Name:   "down-env",
+		Type:   portainer.DockerEnvironment,
+		Status: portainer.EndpointStatusDown,
+	}
+	// Outdated: edge agent with empty version and a prior check-in (old agent style, no version reported)
+	outdated := portainer.Endpoint{
+		ID:              1,
+		Name:            "outdated-env",
+		Type:            portainer.EdgeAgentOnDockerEnvironment,
+		Status:          portainer.EndpointStatusUp,
+		LastCheckInDate: time.Now().Unix(),
+		// IsEdgeEndpoint + Agent.Version == "" + LastCheckInDate > 0 → isOutdated returns true
+	}
+	// Heartbeat: edge that checked in recently with a current agent version (not outdated)
+	heartbeat := portainer.Endpoint{
+		ID:              2,
+		Name:            "heartbeat-env",
+		Type:            portainer.EdgeAgentOnDockerEnvironment,
+		LastCheckInDate: time.Now().Unix(),
+	}
+	heartbeat.Agent.Version = portainer.APIVersion
+	// Up: non-edge with Status=1
+	up := portainer.Endpoint{
+		ID:     3,
+		Name:   "up-env",
+		Type:   portainer.DockerEnvironment,
+		Status: portainer.EndpointStatusUp,
+	}
+
+	t.Run("ascending: Down → Outdated → Heartbeat → Up", func(t *testing.T) {
+		environments := []portainer.Endpoint{up, heartbeat, outdated, down}
+		sortEnvironmentsByField(environments, nil, sortKeyHealth, false, settings)
+		assert.Equal(t,
+			[]portainer.EndpointID{down.ID, outdated.ID, heartbeat.ID, up.ID},
+			getEndpointIDs(environments),
+		)
+	})
+
+	t.Run("descending: Up → Heartbeat → Outdated → Down", func(t *testing.T) {
+		environments := []portainer.Endpoint{down, outdated, heartbeat, up}
+		sortEnvironmentsByField(environments, nil, sortKeyHealth, true, settings)
+		assert.Equal(t,
+			[]portainer.EndpointID{up.ID, heartbeat.ID, outdated.ID, down.ID},
+			getEndpointIDs(environments),
+		)
+	})
+}
+
+func TestGetSortKey(t *testing.T) {
+	assert.Equal(t, sortKey("Name"), getSortKey("Name"))
+	assert.Equal(t, sortKey("PlatformType"), getSortKey("PlatformType"))
+	assert.Equal(t, sortKey(""), getSortKey("unknown"))
+}
diff --git a/api/http/handler/endpoints/unique_name.go b/api/http/handler/endpoints/unique_name.go
new file mode 100644
index 0000000..bad167d
--- /dev/null
+++ b/api/http/handler/endpoints/unique_name.go
@@ -0,0 +1,18 @@
+package endpoints
+
+import portainer "github.com/portainer/portainer/api"
+
+func (handler *Handler) isNameUnique(name string, endpointID portainer.EndpointID) (bool, error) {
+	endpoints, err := handler.DataStore.Endpoint().Endpoints()
+	if err != nil {
+		return false, err
+	}
+
+	for _, endpoint := range endpoints {
+		if endpoint.Name == name && (endpointID == 0 || endpoint.ID != endpointID) {
+			return false, nil
+		}
+	}
+
+	return true, nil
+}
diff --git a/api/http/handler/endpoints/update_edge_relations.go b/api/http/handler/endpoints/update_edge_relations.go
new file mode 100644
index 0000000..c487519
--- /dev/null
+++ b/api/http/handler/endpoints/update_edge_relations.go
@@ -0,0 +1,48 @@
+package endpoints
+
+import (
+	"github.com/pkg/errors"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/internal/edge"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+	"github.com/portainer/portainer/api/set"
+)
+
+// updateEdgeRelations updates the edge stacks associated to an edge endpoint
+func (handler *Handler) updateEdgeRelations(tx dataservices.DataStoreTx, endpoint *portainer.Endpoint) error {
+	if !endpointutils.IsEdgeEndpoint(endpoint) {
+		return nil
+	}
+
+	relation, err := tx.EndpointRelation().EndpointRelation(endpoint.ID)
+	if err != nil {
+		return errors.WithMessage(err, "Unable to retrieve environment relation inside the database")
+	}
+
+	endpointGroup, err := tx.EndpointGroup().Read(endpoint.GroupID)
+	if err != nil {
+		return errors.WithMessage(err, "Unable to find environment group inside the database")
+	}
+
+	edgeGroups, err := tx.EdgeGroup().ReadAll()
+	if err != nil {
+		return errors.WithMessage(err, "Unable to retrieve edge groups from the database")
+	}
+
+	edgeStacks, err := tx.EdgeStack().EdgeStacks()
+	if err != nil {
+		return errors.WithMessage(err, "Unable to retrieve edge stacks from the database")
+	}
+
+	currentEdgeStackSet := set.ToSet(edge.EndpointRelatedEdgeStacks(endpoint, endpointGroup, edgeGroups, edgeStacks))
+
+	relation.EdgeStacks = currentEdgeStackSet
+
+	err = tx.EndpointRelation().UpdateEndpointRelation(endpoint.ID, relation)
+	if err != nil {
+		return errors.WithMessage(err, "Unable to persist environment relation changes inside the database")
+	}
+
+	return nil
+}
diff --git a/api/http/handler/endpoints/utils_update_edge_groups.go b/api/http/handler/endpoints/utils_update_edge_groups.go
new file mode 100644
index 0000000..6207acb
--- /dev/null
+++ b/api/http/handler/endpoints/utils_update_edge_groups.go
@@ -0,0 +1,66 @@
+package endpoints
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/set"
+
+	"github.com/pkg/errors"
+)
+
+func updateEnvironmentEdgeGroups(tx dataservices.DataStoreTx, newEdgeGroups []portainer.EdgeGroupID, environmentID portainer.EndpointID) (bool, error) {
+	edgeGroups, err := tx.EdgeGroup().ReadAll()
+	if err != nil {
+		return false, errors.WithMessage(err, "Unable to retrieve edge groups from the database")
+	}
+
+	newEdgeGroupsSet := set.ToSet(newEdgeGroups)
+
+	environmentEdgeGroupsSet := set.Set[portainer.EdgeGroupID]{}
+	for _, edgeGroup := range edgeGroups {
+		if edgeGroup.EndpointIDs.Contains(environmentID) {
+			environmentEdgeGroupsSet[edgeGroup.ID] = true
+		}
+	}
+
+	union := set.Union(newEdgeGroupsSet, environmentEdgeGroupsSet)
+	intersection := set.Intersection(newEdgeGroupsSet, environmentEdgeGroupsSet)
+
+	if len(union) <= len(intersection) {
+		return false, nil
+	}
+
+	updateSet := func(groupIDs set.Set[portainer.EdgeGroupID], updateItem func(*portainer.EdgeGroup)) error {
+		for groupID := range groupIDs {
+			group, err := tx.EdgeGroup().Read(groupID)
+			if err != nil {
+				return errors.WithMessage(err, "Unable to find a Edge group inside the database")
+			}
+
+			updateItem(group)
+
+			err = tx.EdgeGroup().Update(groupID, group)
+			if err != nil {
+				return errors.WithMessage(err, "Unable to persist Edge group changes inside the database")
+			}
+		}
+
+		return nil
+	}
+
+	removeEdgeGroups := environmentEdgeGroupsSet.Difference(newEdgeGroupsSet)
+	if err := updateSet(removeEdgeGroups, func(edgeGroup *portainer.EdgeGroup) {
+		edgeGroup.EndpointIDs.Remove(environmentID)
+	}); err != nil {
+		return false, err
+	}
+
+	addToEdgeGroups := newEdgeGroupsSet.Difference(environmentEdgeGroupsSet)
+	if err := updateSet(addToEdgeGroups, func(edgeGroup *portainer.EdgeGroup) {
+		edgeGroup.EndpointIDs.Add(environmentID)
+	}); err != nil {
+		return false, err
+	}
+
+	return true, nil
+}
diff --git a/api/http/handler/endpoints/utils_update_edge_groups_test.go b/api/http/handler/endpoints/utils_update_edge_groups_test.go
new file mode 100644
index 0000000..6812124
--- /dev/null
+++ b/api/http/handler/endpoints/utils_update_edge_groups_test.go
@@ -0,0 +1,152 @@
+package endpoints
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_updateEdgeGroups(t *testing.T) {
+	t.Parallel()
+	createGroups := func(store *datastore.Store, names []string) ([]portainer.EdgeGroup, error) {
+		groups := make([]portainer.EdgeGroup, len(names))
+		for index, name := range names {
+			group := &portainer.EdgeGroup{
+				Name:    name,
+				Dynamic: false,
+				TagIDs:  make([]portainer.TagID, 0),
+			}
+
+			if err := store.EdgeGroup().Create(group); err != nil {
+				return nil, err
+			}
+
+			groups[index] = *group
+		}
+
+		return groups, nil
+	}
+
+	checkGroups := func(store *datastore.Store, is *assert.Assertions, groupIDs []portainer.EdgeGroupID, endpointID portainer.EndpointID) {
+		for _, groupID := range groupIDs {
+			group, err := store.EdgeGroup().Read(groupID)
+			require.NoError(t, err)
+
+			is.True(group.EndpointIDs.Contains(endpointID),
+				"expected endpoint to be in group")
+		}
+	}
+
+	groupsByName := func(groups []portainer.EdgeGroup, groupNames []string) []portainer.EdgeGroup {
+		result := make([]portainer.EdgeGroup, len(groupNames))
+		for i, tagName := range groupNames {
+			for j, tag := range groups {
+				if tag.Name == tagName {
+					result[i] = groups[j]
+
+					break
+				}
+			}
+		}
+
+		return result
+	}
+
+	type testCase struct {
+		title              string
+		endpoint           *portainer.Endpoint
+		groupNames         []string
+		endpointGroupNames []string
+		groupsToApply      []string
+		shouldNotBeUpdated bool
+	}
+
+	testFn := func(t *testing.T, testCase testCase) {
+		is := assert.New(t)
+		_, store := datastore.MustNewTestStore(t, false, true)
+
+		err := store.Endpoint().Create(testCase.endpoint)
+		require.NoError(t, err)
+
+		groups, err := createGroups(store, testCase.groupNames)
+		require.NoError(t, err)
+
+		endpointGroups := groupsByName(groups, testCase.endpointGroupNames)
+		for _, group := range endpointGroups {
+			group.EndpointIDs.Add(testCase.endpoint.ID)
+
+			err = store.EdgeGroup().Update(group.ID, &group)
+			require.NoError(t, err)
+		}
+
+		expectedGroups := groupsByName(groups, testCase.groupsToApply)
+
+		expectedIDs := make([]portainer.EdgeGroupID, len(expectedGroups))
+		for i, tag := range expectedGroups {
+			expectedIDs[i] = tag.ID
+		}
+
+		err = store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+			updated, err := updateEnvironmentEdgeGroups(tx, expectedIDs, testCase.endpoint.ID)
+			require.NoError(t, err)
+
+			is.Equal(testCase.shouldNotBeUpdated, !updated)
+
+			return nil
+		})
+
+		require.NoError(t, err)
+
+		checkGroups(store, is, expectedIDs, testCase.endpoint.ID)
+	}
+
+	testCases := []testCase{
+		{
+			title:              "applying edge groups to an endpoint without edge groups",
+			endpoint:           &portainer.Endpoint{},
+			groupNames:         []string{"edge group1", "edge group2", "edge group3"},
+			endpointGroupNames: []string{},
+			groupsToApply:      []string{"edge group1", "edge group2", "edge group3"},
+		},
+		{
+			title:              "applying edge groups to an endpoint with edge groups",
+			endpoint:           &portainer.Endpoint{},
+			groupNames:         []string{"edge group1", "edge group2", "edge group3", "edge group4", "edge group5", "edge group6"},
+			endpointGroupNames: []string{"edge group1", "edge group2", "edge group3"},
+			groupsToApply:      []string{"edge group4", "edge group5", "edge group6"},
+		},
+		{
+			title:              "applying edge groups to an endpoint with edge groups that are already applied",
+			endpoint:           &portainer.Endpoint{},
+			groupNames:         []string{"edge group1", "edge group2", "edge group3"},
+			endpointGroupNames: []string{"edge group1", "edge group2", "edge group3"},
+			groupsToApply:      []string{"edge group1", "edge group2", "edge group3"},
+			shouldNotBeUpdated: true,
+		},
+		{
+			title:              "adding new edge groups to an endpoint with edge groups ",
+			endpoint:           &portainer.Endpoint{},
+			groupNames:         []string{"edge group1", "edge group2", "edge group3", "edge group4", "edge group5", "edge group6"},
+			endpointGroupNames: []string{"edge group1", "edge group2", "edge group3"},
+			groupsToApply:      []string{"edge group1", "edge group2", "edge group3", "edge group4", "edge group5", "edge group6"},
+		},
+		{
+			title:              "mixing edge groups that are already applied and new edge groups",
+			endpoint:           &portainer.Endpoint{},
+			groupNames:         []string{"edge group1", "edge group2", "edge group3", "edge group4", "edge group5", "edge group6"},
+			endpointGroupNames: []string{"edge group1", "edge group2", "edge group3"},
+			groupsToApply:      []string{"edge group2", "edge group4", "edge group5"},
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.title, func(t *testing.T) {
+			testFn(t, testCase)
+		})
+	}
+}
diff --git a/api/http/handler/endpoints/utils_update_tags.go b/api/http/handler/endpoints/utils_update_tags.go
new file mode 100644
index 0000000..b2d5b5d
--- /dev/null
+++ b/api/http/handler/endpoints/utils_update_tags.go
@@ -0,0 +1,56 @@
+package endpoints
+
+import (
+	"github.com/pkg/errors"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/set"
+)
+
+// updateEnvironmentTags updates the tags associated to an environment
+func updateEnvironmentTags(tx dataservices.DataStoreTx, newTags []portainer.TagID, oldTags []portainer.TagID, environmentID portainer.EndpointID) (bool, error) {
+	payloadTagSet := set.ToSet(newTags)
+	environmentTagSet := set.ToSet(oldTags)
+	union := set.Union(payloadTagSet, environmentTagSet)
+	intersection := set.Intersection(payloadTagSet, environmentTagSet)
+
+	if len(union) <= len(intersection) {
+		return false, nil
+	}
+
+	updateSet := func(tagIDs set.Set[portainer.TagID], updateItem func(*portainer.Tag)) error {
+		for tagID := range tagIDs {
+			tag, err := tx.Tag().Read(tagID)
+			if err != nil {
+				return errors.WithMessage(err, "Unable to find a tag inside the database")
+			}
+
+			updateItem(tag)
+
+			err = tx.Tag().Update(tagID, tag)
+			if err != nil {
+				return errors.WithMessage(err, "Unable to persist tag changes inside the database")
+			}
+		}
+
+		return nil
+	}
+
+	removeTags := environmentTagSet.Difference(payloadTagSet)
+	err := updateSet(removeTags, func(tag *portainer.Tag) {
+		delete(tag.Endpoints, environmentID)
+	})
+	if err != nil {
+		return false, err
+	}
+
+	addTags := payloadTagSet.Difference(environmentTagSet)
+	err = updateSet(addTags, func(tag *portainer.Tag) {
+		tag.Endpoints[environmentID] = true
+	})
+	if err != nil {
+		return false, err
+	}
+
+	return true, nil
+}
diff --git a/api/http/handler/endpoints/utils_update_tags_test.go b/api/http/handler/endpoints/utils_update_tags_test.go
new file mode 100644
index 0000000..7c045a0
--- /dev/null
+++ b/api/http/handler/endpoints/utils_update_tags_test.go
@@ -0,0 +1,165 @@
+package endpoints
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_updateTags(t *testing.T) {
+	t.Parallel()
+	createTags := func(store *datastore.Store, tagNames []string) ([]portainer.Tag, error) {
+		tags := make([]portainer.Tag, len(tagNames))
+		for index, tagName := range tagNames {
+			tag := &portainer.Tag{
+				Name:           tagName,
+				Endpoints:      make(map[portainer.EndpointID]bool),
+				EndpointGroups: make(map[portainer.EndpointGroupID]bool),
+			}
+
+			err := store.Tag().Create(tag)
+			if err != nil {
+				return nil, err
+			}
+
+			tags[index] = *tag
+		}
+
+		return tags, nil
+	}
+
+	checkTags := func(store *datastore.Store, is *assert.Assertions, tagIDs []portainer.TagID, endpointID portainer.EndpointID) {
+		for _, tagID := range tagIDs {
+			tag, err := store.Tag().Read(tagID)
+			require.NoError(t, err)
+
+			_, ok := tag.Endpoints[endpointID]
+			is.True(ok, "expected endpoint to be tagged")
+		}
+	}
+
+	tagsByName := func(tags []portainer.Tag, tagNames []string) []portainer.Tag {
+		result := make([]portainer.Tag, len(tagNames))
+		for i, tagName := range tagNames {
+			for j, tag := range tags {
+				if tag.Name == tagName {
+					result[i] = tags[j]
+					break
+				}
+			}
+		}
+
+		return result
+	}
+
+	getIDs := func(tags []portainer.Tag) []portainer.TagID {
+		ids := make([]portainer.TagID, len(tags))
+		for i, tag := range tags {
+			ids[i] = tag.ID
+		}
+
+		return ids
+	}
+
+	type testCase struct {
+		title              string
+		endpoint           *portainer.Endpoint
+		tagNames           []string
+		endpointTagNames   []string
+		tagsToApply        []string
+		shouldNotBeUpdated bool
+	}
+
+	testFn := func(t *testing.T, testCase testCase) {
+		is := assert.New(t)
+		_, store := datastore.MustNewTestStore(t, false, true)
+
+		err := store.Endpoint().Create(testCase.endpoint)
+		require.NoError(t, err)
+
+		tags, err := createTags(store, testCase.tagNames)
+		require.NoError(t, err)
+
+		endpointTags := tagsByName(tags, testCase.endpointTagNames)
+		for _, tag := range endpointTags {
+			tag.Endpoints[testCase.endpoint.ID] = true
+
+			err = store.Tag().Update(tag.ID, &tag)
+			require.NoError(t, err)
+		}
+
+		endpointTagIDs := getIDs(endpointTags)
+		testCase.endpoint.TagIDs = endpointTagIDs
+		err = store.Endpoint().UpdateEndpoint(testCase.endpoint.ID, testCase.endpoint)
+		require.NoError(t, err)
+
+		expectedTags := tagsByName(tags, testCase.tagsToApply)
+		expectedTagIDs := make([]portainer.TagID, len(expectedTags))
+		for i, tag := range expectedTags {
+			expectedTagIDs[i] = tag.ID
+		}
+
+		err = store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+			updated, err := updateEnvironmentTags(tx, expectedTagIDs, testCase.endpoint.TagIDs, testCase.endpoint.ID)
+			require.NoError(t, err)
+
+			is.Equal(testCase.shouldNotBeUpdated, !updated)
+
+			return nil
+		})
+
+		require.NoError(t, err)
+
+		checkTags(store, is, expectedTagIDs, testCase.endpoint.ID)
+	}
+
+	testCases := []testCase{
+		{
+			title:            "applying tags to an endpoint without tags",
+			endpoint:         &portainer.Endpoint{},
+			tagNames:         []string{"tag1", "tag2", "tag3"},
+			endpointTagNames: []string{},
+			tagsToApply:      []string{"tag1", "tag2", "tag3"},
+		},
+		{
+			title:            "applying tags to an endpoint with tags",
+			endpoint:         &portainer.Endpoint{},
+			tagNames:         []string{"tag1", "tag2", "tag3", "tag4", "tag5", "tag6"},
+			endpointTagNames: []string{"tag1", "tag2", "tag3"},
+			tagsToApply:      []string{"tag4", "tag5", "tag6"},
+		},
+		{
+			title:              "applying tags to an endpoint with tags that are already applied",
+			endpoint:           &portainer.Endpoint{},
+			tagNames:           []string{"tag1", "tag2", "tag3"},
+			endpointTagNames:   []string{"tag1", "tag2", "tag3"},
+			tagsToApply:        []string{"tag1", "tag2", "tag3"},
+			shouldNotBeUpdated: true,
+		},
+		{
+			title:            "adding new tags to an endpoint with tags ",
+			endpoint:         &portainer.Endpoint{},
+			tagNames:         []string{"tag1", "tag2", "tag3", "tag4", "tag5", "tag6"},
+			endpointTagNames: []string{"tag1", "tag2", "tag3"},
+			tagsToApply:      []string{"tag1", "tag2", "tag3", "tag4", "tag5", "tag6"},
+		},
+		{
+			title:            "mixing tags that are already applied and new tags",
+			endpoint:         &portainer.Endpoint{},
+			tagNames:         []string{"tag1", "tag2", "tag3", "tag4", "tag5", "tag6"},
+			endpointTagNames: []string{"tag1", "tag2", "tag3"},
+			tagsToApply:      []string{"tag2", "tag4", "tag5"},
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.title, func(t *testing.T) {
+			testFn(t, testCase)
+		})
+	}
+}
diff --git a/api/http/handler/file/handler.go b/api/http/handler/file/handler.go
new file mode 100644
index 0000000..f0e4435
--- /dev/null
+++ b/api/http/handler/file/handler.go
@@ -0,0 +1,69 @@
+package file
+
+import (
+	"net/http"
+	"strings"
+
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/pkg/featureflags"
+
+	"github.com/klauspost/compress/gzhttp"
+)
+
+// Handler represents an HTTP API handler for managing static files.
+type Handler struct {
+	http.Handler
+	wasInstanceDisabled func() bool
+}
+
+// NewHandler creates a handler to serve static files.
+func NewHandler(assetPublicPath string, csp bool, wasInstanceDisabled func() bool) *Handler {
+	h := &Handler{
+		Handler: security.MWSecureHeaders(
+			gzhttp.GzipHandler(http.FileServer(http.Dir(assetPublicPath))),
+			featureflags.IsEnabled("hsts"),
+			csp,
+		),
+		wasInstanceDisabled: wasInstanceDisabled,
+	}
+
+	return h
+}
+
+func isHTML(acceptContent []string) bool {
+	for _, accept := range acceptContent {
+		if strings.Contains(accept, "text/html") {
+			return true
+		}
+	}
+
+	return false
+}
+
+func (handler *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	if handler.wasInstanceDisabled() {
+		if r.RequestURI == "/" || r.RequestURI == "/index.html" {
+			http.Redirect(w, r, "/timeout.html", http.StatusTemporaryRedirect)
+
+			return
+		}
+	} else {
+		if strings.HasPrefix(r.RequestURI, "/timeout.html") {
+			http.Redirect(w, r, "/", http.StatusTemporaryRedirect)
+
+			return
+		}
+	}
+
+	if r.RequestURI == "/" || strings.HasSuffix(r.RequestURI, ".html") {
+		w.Header().Set("Permissions-Policy", strings.Join(permissions, ","))
+	}
+
+	if !isHTML(r.Header["Accept"]) {
+		w.Header().Set("Cache-Control", "max-age=31536000")
+	} else {
+		w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
+	}
+
+	handler.Handler.ServeHTTP(w, r)
+}
diff --git a/api/http/handler/file/handler_test.go b/api/http/handler/file/handler_test.go
new file mode 100644
index 0000000..3f3502f
--- /dev/null
+++ b/api/http/handler/file/handler_test.go
@@ -0,0 +1,73 @@
+package file_test
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/portainer/portainer/api/http/handler/file"
+	"github.com/stretchr/testify/require"
+)
+
+func TestNormalServe(t *testing.T) {
+	t.Parallel()
+	handler := file.NewHandler("", false, func() bool { return false })
+	require.NotNil(t, handler)
+
+	request := func(path string) (*http.Request, *httptest.ResponseRecorder) {
+		rr := httptest.NewRecorder()
+		req := httptest.NewRequest(http.MethodGet, path, nil)
+		handler.ServeHTTP(rr, req)
+		return req, rr
+	}
+
+	_, rr := request("/timeout.html")
+	require.Equal(t, http.StatusTemporaryRedirect, rr.Result().StatusCode)
+	loc, err := rr.Result().Location()
+	require.NoError(t, err)
+	require.NotNil(t, loc)
+	require.Equal(t, "/", loc.Path)
+
+	_, rr = request("/")
+	require.Equal(t, http.StatusOK, rr.Result().StatusCode)
+}
+
+func TestPermissionsPolicyHeader(t *testing.T) {
+	t.Parallel()
+	handler := file.NewHandler("", false, func() bool { return false })
+	require.NotNil(t, handler)
+
+	test := func(path string, exist bool) {
+		rr := httptest.NewRecorder()
+		req := httptest.NewRequest(http.MethodGet, path, nil)
+		handler.ServeHTTP(rr, req)
+
+		require.Equal(t, exist, rr.Result().Header.Get("Permissions-Policy") != "")
+	}
+
+	test("/", true)
+	test("/index.html", true)
+	test("/api", false)
+	test("/an/image.png", false)
+}
+
+func TestRedirectInstanceDisabled(t *testing.T) {
+	t.Parallel()
+	handler := file.NewHandler("", false, func() bool { return true })
+	require.NotNil(t, handler)
+
+	test := func(path string) {
+		rr := httptest.NewRecorder()
+		req := httptest.NewRequest(http.MethodGet, path, nil)
+		handler.ServeHTTP(rr, req)
+
+		require.Equal(t, http.StatusTemporaryRedirect, rr.Result().StatusCode)
+		loc, err := rr.Result().Location()
+		require.NoError(t, err)
+		require.NotNil(t, loc)
+		require.Equal(t, "/timeout.html", loc.Path)
+	}
+
+	test("/")
+	test("/index.html")
+}
diff --git a/api/http/handler/file/permissions_list.go b/api/http/handler/file/permissions_list.go
new file mode 100644
index 0000000..4355372
--- /dev/null
+++ b/api/http/handler/file/permissions_list.go
@@ -0,0 +1,91 @@
+package file
+
+var permissions = []string{
+	"accelerometer=()",
+	"ambient-light-sensor=()",
+	"attribution-reporting=()",
+	"autoplay=()",
+	"battery=()",
+	"browsing-topics=()",
+	"camera=()",
+	"captured-surface-control=()",
+	"ch-device-memory=()",
+	"ch-downlink=()",
+	"ch-dpr=()",
+	"ch-ect=()",
+	"ch-prefers-color-scheme=()",
+	"ch-prefers-reduced-motion=()",
+	"ch-prefers-reduced-transparency=()",
+	"ch-rtt=()",
+	"ch-save-data=()",
+	"ch-ua=()",
+	"ch-ua-arch=()",
+	"ch-ua-bitness=()",
+	"ch-ua-form-factors=()",
+	"ch-ua-full-version=()",
+	"ch-ua-full-version-list=()",
+	"ch-ua-mobile=()",
+	"ch-ua-model=()",
+	"ch-ua-platform=()",
+	"ch-ua-platform-version=()",
+	"ch-ua-wow64=()",
+	"ch-viewport-height=()",
+	"ch-viewport-width=()",
+	"ch-width=()",
+	"compute-pressure=()",
+	"conversion-measurement=()",
+	"cross-origin-isolated=()",
+	"deferred-fetch=()",
+	"deferred-fetch-minimal=()",
+	"display-capture=()",
+	"document-domain=()",
+	"encrypted-media=()",
+	"execution-while-not-rendered=()",
+	"execution-while-out-of-viewport=()",
+	"focus-without-user-activation=()",
+	"fullscreen=()",
+	"gamepad=()",
+	"geolocation=()",
+	"gyroscope=()",
+	"hid=()",
+	"identity-credentials-get=()",
+	"idle-detection=()",
+	"interest-cohort=()",
+	"join-ad-interest-group=()",
+	"keyboard-map=()",
+	"language-detector=()",
+	"local-fonts=()",
+	"magnetometer=()",
+	"microphone=()",
+	"midi=()",
+	"navigation-override=()",
+	"otp-credentials=()",
+	"payment=()",
+	"picture-in-picture=()",
+	"private-aggregation=()",
+	"private-state-token-issuance=()",
+	"private-state-token-redemption=()",
+	"publickey-credentials-create=()",
+	"publickey-credentials-get=()",
+	"rewriter=()",
+	"run-ad-auction=()",
+	"screen-wake-lock=()",
+	"serial=()",
+	"shared-storage=()",
+	"shared-storage-select-url=()",
+	"speaker-selection=()",
+	"storage-access=()",
+	"summarizer=()",
+	"sync-script=()",
+	"sync-xhr=()",
+	"translator=()",
+	"trust-token-redemption=()",
+	"unload=()",
+	"usb=()",
+	"vertical-scroll=()",
+	"web-share=()",
+	"window-management=()",
+	"window-placement=()",
+	"writer=()",
+	"xr-spatial-tracking=()",
+}
diff --git a/api/http/handler/gitops/git_repo_file_preview.go b/api/http/handler/gitops/git_repo_file_preview.go
new file mode 100644
index 0000000..dab2f3d
--- /dev/null
+++ b/api/http/handler/gitops/git_repo_file_preview.go
@@ -0,0 +1,151 @@
+package gitops
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices/source"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	"github.com/portainer/portainer/api/gitops/sources"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/portainer/portainer/pkg/libhttp/ssrf"
+	"github.com/portainer/portainer/pkg/validate"
+	"github.com/rs/zerolog/log"
+)
+
+type fileResponse struct {
+	FileContent string
+}
+
+type repositoryFilePreviewPayload struct {
+	// SourceID resolves URL and auth from the stored Source record.
+	// When set, the inline Repository/Username/Password/TLSSkipVerify fields are ignored.
+	SourceID  portainer.SourceID `json:"sourceID" example:"1"`
+	Reference string             `json:"reference" example:"refs/heads/master"`
+	// Path to file whose content will be read
+	TargetFile string `json:"targetFile" example:"docker-compose.yml"`
+
+	// URL of a Git repository to preview.
+	// Deprecated: use SourceID instead
+	Repository string `json:"repository" example:"https://github.com/openfaas/faas"`
+	// Username for git authentication.
+	// Deprecated: use SourceID instead
+	Username string `json:"username" example:"myGitUsername"`
+	// Password for git authentication.
+	// Deprecated: use SourceID instead
+	Password string `json:"password" example:"myGitPassword"`
+	// TLSSkipVerify skips SSL verification when cloning the Git repository.
+	// Deprecated: use SourceID instead
+	TLSSkipVerify bool `json:"tlsSkipVerify" example:"false"`
+}
+
+func (payload *repositoryFilePreviewPayload) Validate(r *http.Request) error {
+	if payload.SourceID == 0 {
+		if len(payload.Repository) == 0 || !validate.IsURL(payload.Repository) {
+			return errors.New("invalid repository URL. Must correspond to a valid URL format")
+		}
+	}
+
+	if len(payload.Reference) == 0 {
+		payload.Reference = "refs/heads/main"
+	}
+
+	if len(payload.TargetFile) == 0 {
+		return errors.New("invalid target filename")
+	}
+
+	return nil
+}
+
+// @id GitOperationRepoFilePreview
+// @summary preview the content of target file in the git repository
+// @description Retrieve the compose file content based on git repository configuration
+// @description **Access policy**: authenticated
+// @tags gitops
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param body body repositoryFilePreviewPayload true "Template details"
+// @success 200 {object} fileResponse "Success"
+// @failure 400 "Invalid request"
+// @failure 404 "Source not found"
+// @failure 500 "Server error"
+// @router /gitops/repo/file/preview [post]
+func (handler *Handler) gitOperationRepoFilePreview(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	var payload repositoryFilePreviewPayload
+	err := request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	repoURL := payload.Repository
+	username := payload.Username
+	password := payload.Password
+	tlsSkipVerify := payload.TLSSkipVerify
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve user info from request context", err)
+	}
+	userContext := source.NewUserContext(securityContext.User, securityContext.UserMemberships)
+
+	if payload.SourceID != 0 {
+		src, httpErr := sources.ValidateGitSourceAccess(handler.dataStore, userContext, payload.SourceID)
+		if httpErr != nil {
+			return httpErr
+		}
+
+		repoURL = src.Git.URL
+		if src.Git.Authentication != nil {
+			username = src.Git.Authentication.Username
+			password = src.Git.Authentication.Password
+		}
+		tlsSkipVerify = src.Git.TLSSkipVerify
+	}
+
+	if err := ssrf.CheckURL(r.Context(), repoURL); err != nil {
+		return httperror.BadRequest("Repository URL blocked by SSRF policy", err)
+	}
+
+	projectPath, err := handler.fileService.GetTemporaryPath()
+	if err != nil {
+		return httperror.InternalServerError("Unable to create temporary folder", err)
+	}
+
+	err = handler.gitService.CloneRepository(
+		context.TODO(),
+		projectPath,
+		repoURL,
+		payload.Reference,
+		username,
+		password,
+		tlsSkipVerify,
+	)
+	if err != nil {
+		if errors.Is(err, gittypes.ErrAuthenticationFailure) {
+			return httperror.BadRequest("Invalid git credential", err)
+		}
+
+		newErr := fmt.Errorf("unable to clone git repository, error: %w", err)
+		return httperror.InternalServerError(newErr.Error(), newErr)
+	}
+
+	defer func() {
+		if err := handler.fileService.RemoveDirectory(projectPath); err != nil {
+			log.Warn().Err(err).Msg("failed to remove temporary project folder")
+		}
+	}()
+
+	fileContent, err := handler.fileService.GetFileContent(projectPath, payload.TargetFile)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve custom template file from disk", err)
+	}
+
+	return response.JSON(w, &fileResponse{FileContent: string(fileContent)})
+}
diff --git a/api/http/handler/gitops/handler.go b/api/http/handler/gitops/handler.go
new file mode 100644
index 0000000..6e7a826
--- /dev/null
+++ b/api/http/handler/gitops/handler.go
@@ -0,0 +1,46 @@
+package gitops
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/kubernetes/cli"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+
+	"github.com/gorilla/mux"
+
+	"github.com/portainer/portainer/api/http/handler/gitops/sources"
+	"github.com/portainer/portainer/api/http/handler/gitops/workflows"
+)
+
+// Handler is the HTTP handler used to handle git repo operation
+type Handler struct {
+	*mux.Router
+	dataStore   dataservices.DataStore
+	gitService  portainer.GitService
+	fileService portainer.FileService
+}
+
+func NewHandler(bouncer security.BouncerService, dataStore dataservices.DataStore, gitService portainer.GitService, fileService portainer.FileService, k8sFactory *cli.ClientFactory) *Handler {
+	h := &Handler{
+		Router:      mux.NewRouter(),
+		dataStore:   dataStore,
+		gitService:  gitService,
+		fileService: fileService,
+	}
+
+	authenticatedRouter := h.NewRoute().Subrouter()
+	authenticatedRouter.Use(bouncer.AuthenticatedAccess)
+
+	authenticatedRouter.Handle("/gitops/repo/file/preview", httperror.LoggerHandler(h.gitOperationRepoFilePreview)).Methods(http.MethodPost)
+
+	workflowsHandler := workflows.NewHandler(dataStore, gitService, k8sFactory)
+	authenticatedRouter.PathPrefix("/gitops/workflows").Handler(workflowsHandler)
+
+	sourcesHandler := sources.NewHandler(bouncer, dataStore, gitService, k8sFactory)
+	authenticatedRouter.PathPrefix("/gitops/sources").Handler(sourcesHandler)
+
+	return h
+}
diff --git a/api/http/handler/gitops/sources/cache_test.go b/api/http/handler/gitops/sources/cache_test.go
new file mode 100644
index 0000000..2d30799
--- /dev/null
+++ b/api/http/handler/gitops/sources/cache_test.go
@@ -0,0 +1,172 @@
+package sources
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	gittypes "github.com/portainer/portainer/api/git/types"
+
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// Each test below primes the source cache with a read before mutating, then
+// reads again and asserts the change is reflected. The handler is built with a
+// non-expiring cache (newTestHandlerNoCacheExpiry), so a fresh result can only
+// come from invalidation on the write — not from the TTL elapsing.
+
+func TestGitSourceCreate_InvalidatesCache(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	user := &portainer.User{ID: 1, Role: portainer.AdministratorRole}
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.User().Create(user)
+	}))
+
+	h := newTestHandlerNoCacheExpiry(t, store)
+
+	// prime the cache with the (empty) list
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildListReq(t, user.ID, ""))
+	require.Empty(t, decodeSources(t, rr))
+
+	body, err := json.Marshal(GitSourceCreatePayload{
+		URL:  "https://github.com/org/repo.git",
+		Name: "my-source",
+	})
+	require.NoError(t, err)
+
+	rr = httptest.NewRecorder()
+	h.ServeHTTP(rr, buildCreateReq(t, user.ID, body))
+	require.Equal(t, http.StatusCreated, rr.Code)
+
+	// the new source must appear despite the primed empty cache
+	rr = httptest.NewRecorder()
+	h.ServeHTTP(rr, buildListReq(t, user.ID, ""))
+	got := decodeSources(t, rr)
+	require.Len(t, got, 1)
+	require.Equal(t, "my-source", got[0].Name)
+}
+
+func TestSourceDelete_InvalidatesCache(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var srcID portainer.SourceID
+	user := &portainer.User{ID: 1, Role: portainer.AdministratorRole}
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		src := &portainer.Source{Name: "to-delete", Type: portainer.SourceTypeGit, Git: &gittypes.GitSource{URL: "https://github.com/org/repo"}}
+		require.NoError(t, tx.Source().Create(adminUserContext, src))
+		srcID = src.ID
+
+		return tx.User().Create(user)
+	}))
+
+	h := newTestHandlerNoCacheExpiry(t, store)
+
+	// prime the cache with the source present
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildListReq(t, user.ID, ""))
+	require.Len(t, decodeSources(t, rr), 1)
+
+	rr = httptest.NewRecorder()
+	h.ServeHTTP(rr, buildDeleteReq(t, user.ID, int(srcID)))
+	require.Equal(t, http.StatusNoContent, rr.Code)
+
+	// the deleted source must be gone despite the primed cache
+	rr = httptest.NewRecorder()
+	h.ServeHTTP(rr, buildListReq(t, user.ID, ""))
+	require.Empty(t, decodeSources(t, rr))
+}
+
+func TestGitSourceUpdate_InvalidatesCache(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var srcID portainer.SourceID
+	user := &portainer.User{ID: 1, Role: portainer.AdministratorRole}
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		src := &portainer.Source{Name: "old-name", Type: portainer.SourceTypeGit, Git: &gittypes.GitSource{URL: "https://github.com/org/repo"}}
+		require.NoError(t, tx.Source().Create(adminUserContext, src))
+		srcID = src.ID
+
+		return tx.User().Create(user)
+	}))
+
+	h := newTestHandlerNoCacheExpiry(t, store)
+
+	// prime the cache with the original name
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildListReq(t, user.ID, ""))
+	primed := decodeSources(t, rr)
+	require.Len(t, primed, 1)
+	require.Equal(t, "old-name", primed[0].Name)
+
+	body, err := json.Marshal(GitSourceUpdatePayload{Name: new("new-name")})
+	require.NoError(t, err)
+
+	rr = httptest.NewRecorder()
+	h.ServeHTTP(rr, buildUpdateReq(t, user.ID, int(srcID), body))
+	require.Equal(t, http.StatusOK, rr.Code)
+
+	// the updated name must be reflected despite the primed cache
+	rr = httptest.NewRecorder()
+	h.ServeHTTP(rr, buildListReq(t, user.ID, ""))
+	got := decodeSources(t, rr)
+	require.Len(t, got, 1)
+	require.Equal(t, "new-name", got[0].Name)
+}
+
+// TestSourceMutation_InvalidatesSummaryCache verifies the summary endpoint, which
+// shares the cache entry with the list via getSources, also sees fresh data.
+func TestSourceMutation_InvalidatesSummaryCache(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	user := &portainer.User{ID: 1, Role: portainer.AdministratorRole}
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.User().Create(user)
+	}))
+
+	h := newTestHandlerNoCacheExpiry(t, store)
+
+	// prime the cache with the empty summary
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildSummaryReq(t, user.ID))
+	require.Equal(t, 0, summaryTotal(t, rr))
+
+	body, err := json.Marshal(GitSourceCreatePayload{
+		URL:  "https://github.com/org/repo.git",
+		Name: "my-source",
+	})
+	require.NoError(t, err)
+
+	rr = httptest.NewRecorder()
+	h.ServeHTTP(rr, buildCreateReq(t, user.ID, body))
+	require.Equal(t, http.StatusCreated, rr.Code)
+
+	// the summary count must reflect the new source despite the primed cache
+	rr = httptest.NewRecorder()
+	h.ServeHTTP(rr, buildSummaryReq(t, user.ID))
+	assert.Equal(t, 1, summaryTotal(t, rr))
+}
+
+func summaryTotal(t *testing.T, rr *httptest.ResponseRecorder) int {
+	t.Helper()
+	require.Equal(t, http.StatusOK, rr.Code, "unexpected status: %s", rr.Body.String())
+
+	var summary map[string]int
+	require.NoError(t, json.NewDecoder(rr.Body).Decode(&summary))
+
+	total := 0
+	for _, count := range summary {
+		total += count
+	}
+	return total
+}
diff --git a/api/http/handler/gitops/sources/create_git.go b/api/http/handler/gitops/sources/create_git.go
new file mode 100644
index 0000000..c7d84b4
--- /dev/null
+++ b/api/http/handler/gitops/sources/create_git.go
@@ -0,0 +1,144 @@
+package sources
+
+import (
+	"errors"
+	"net/http"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/dataservices/source"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/portainer/portainer/pkg/validate"
+)
+
+// GitAuthenticationPayload holds authentication parameters for a git source
+type GitAuthenticationPayload struct {
+	Username string `json:"username"`
+	Password string `json:"password"`
+}
+
+type SourceAccessControlPayload struct {
+	Public             bool               `json:"public" example:"true"`
+	AdministratorsOnly bool               `json:"administratorsOnly" example:"true"`
+	UserAccesses       []portainer.UserID `json:"userAccesses"`
+	TeamAccesses       []portainer.TeamID `json:"teamAccesses"`
+}
+
+// GitSourceCreatePayload holds the parameters for creating a git-backed source
+type GitSourceCreatePayload struct {
+	SourceAccessControlPayload
+	Name           string                    `json:"name"`
+	URL            string                    `json:"url" validate:"required"`
+	TLSSkipVerify  bool                      `json:"tlsSkipVerify"`
+	Authentication *GitAuthenticationPayload `json:"authentication"`
+}
+
+// Validate implements the portainer.Validatable interface
+func (payload *GitSourceCreatePayload) Validate(_ *http.Request) error {
+	if !validate.IsURL(payload.URL) {
+		return errors.New("invalid repository URL. Must correspond to a valid URL format")
+	}
+
+	return nil
+}
+
+// @id GitOpsSourcesCreateGit
+// @summary Create a Git source
+// @description Creates a new GitOps source backed by a Git repository.
+// @description **Access policy**: authenticated
+// @tags gitops
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @produce json
+// @param body body GitSourceCreatePayload true "Git source details"
+// @success 201 {object} portainer.Source
+// @failure 400 "Invalid request payload"
+// @failure 403 "Access denied"
+// @failure 409 "A source with this URL and credentials already exists"
+// @failure 500 "Server error"
+// @router /gitops/sources/git [post]
+func (h *Handler) gitSourceCreate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	var payload GitSourceCreatePayload
+
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	src, err := BuildGitSource(payload)
+	if err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	userContext := source.NewUserContext(securityContext.User, securityContext.UserMemberships)
+
+	if err := h.dataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.Source().Create(userContext, src)
+	}); errors.Is(err, source.ErrDuplicateSource) {
+		return httperror.Conflict("A source with this URL and credentials already exists", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to create source", err)
+	}
+
+	if src, err = h.testAndSaveSourceConnection(r.Context(), userContext, src); err != nil {
+		return httperror.InternalServerError("Unable to persist source status", err)
+	}
+
+	h.invalidateCache()
+
+	src.Git = gittypes.SanitizeGitSource(src.Git)
+
+	return response.JSONWithStatus(w, src, http.StatusCreated)
+}
+
+// BuildGitSource constructs a portainer.Source from a GitSourceCreatePayload
+func BuildGitSource(payload GitSourceCreatePayload) (*portainer.Source, error) {
+	src := BuildBaseGitSource(payload)
+	src.Git.Authentication = BuildAuth(payload.Authentication)
+
+	return src, nil
+}
+
+// BuildBaseGitSource constructs the source skeleton (name, URL, TLS, accesses) without authentication.
+func BuildBaseGitSource(payload GitSourceCreatePayload) *portainer.Source {
+	name := payload.Name
+	if strings.TrimSpace(name) == "" {
+		name = gittypes.RepoName(payload.URL)
+	}
+
+	return &portainer.Source{
+		Name: name,
+		Type: portainer.SourceTypeGit,
+		Git: &gittypes.GitSource{
+			URL:           payload.URL,
+			TLSSkipVerify: payload.TLSSkipVerify,
+		},
+		UserAccesses:       payload.UserAccesses,
+		TeamAccesses:       payload.TeamAccesses,
+		Public:             payload.Public,
+		AdministratorsOnly: payload.AdministratorsOnly,
+	}
+}
+
+// BuildAuth constructs basic git authentication from the payload, returning nil
+// when no authentication is provided.
+func BuildAuth(payload *GitAuthenticationPayload) *gittypes.GitAuthentication {
+	if payload == nil {
+		return nil
+	}
+
+	return &gittypes.GitAuthentication{
+		Username: payload.Username,
+		Password: payload.Password,
+	}
+}
diff --git a/api/http/handler/gitops/sources/create_git_test.go b/api/http/handler/gitops/sources/create_git_test.go
new file mode 100644
index 0000000..6f59d9e
--- /dev/null
+++ b/api/http/handler/gitops/sources/create_git_test.go
@@ -0,0 +1,291 @@
+package sources
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/require"
+)
+
+func TestBuildGitSource_DerivesNameFromURL(t *testing.T) {
+	t.Parallel()
+
+	src, err := BuildGitSource(GitSourceCreatePayload{
+		URL: "https://github.com/org/my-repo.git",
+	})
+	require.NoError(t, err)
+
+	require.Equal(t, "my-repo", src.Name)
+	require.Equal(t, portainer.SourceTypeGit, src.Type)
+	require.Nil(t, src.Git.Authentication)
+}
+
+func TestBuildGitSource_UsesExplicitName(t *testing.T) {
+	t.Parallel()
+
+	src, err := BuildGitSource(GitSourceCreatePayload{
+		Name: "custom-name",
+		URL:  "https://github.com/org/repo.git",
+	})
+	require.NoError(t, err)
+
+	require.Equal(t, "custom-name", src.Name)
+}
+
+func TestBuildGitSource_WithAuthentication(t *testing.T) {
+	t.Parallel()
+
+	src, err := BuildGitSource(GitSourceCreatePayload{
+		URL: "https://github.com/org/repo.git",
+		Authentication: &GitAuthenticationPayload{
+			Username: "alice",
+			Password: "secret",
+		},
+	})
+	require.NoError(t, err)
+
+	require.NotNil(t, src.Git.Authentication)
+	require.Equal(t, "alice", src.Git.Authentication.Username)
+	require.Equal(t, "secret", src.Git.Authentication.Password)
+}
+
+func TestGitSourceCreatePayload_Validate_EmptyURL(t *testing.T) {
+	t.Parallel()
+
+	err := (&GitSourceCreatePayload{}).Validate(nil)
+	require.Error(t, err)
+}
+
+func TestGitSourceCreatePayload_Validate_ValidURL(t *testing.T) {
+	t.Parallel()
+
+	err := (&GitSourceCreatePayload{URL: "https://github.com/org/repo.git"}).Validate(nil)
+	require.NoError(t, err)
+}
+
+func TestGitSourceCreate_Success(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	h := newTestHandler(t, store)
+
+	body, err := json.Marshal(GitSourceCreatePayload{
+		URL:  "https://github.com/org/repo.git",
+		Name: "my-source",
+	})
+	require.NoError(t, err)
+
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildCreateReq(t, 1, body))
+
+	require.Equal(t, http.StatusCreated, rr.Code)
+
+	var src portainer.Source
+	err = json.NewDecoder(rr.Body).Decode(&src)
+	require.NoError(t, err)
+	require.Equal(t, "my-source", src.Name)
+	require.Equal(t, portainer.SourceTypeGit, src.Type)
+	require.NotZero(t, src.ID)
+	require.NotNil(t, src.Git)
+	require.Equal(t, "https://github.com/org/repo", src.Git.URL)
+}
+
+func TestGitSourceCreate_SanitizesCredentials(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	h := newTestHandler(t, store)
+
+	body, err := json.Marshal(GitSourceCreatePayload{
+		URL: "https://github.com/org/repo.git",
+		Authentication: &GitAuthenticationPayload{
+			Username: "alice",
+			Password: "secret",
+		},
+	})
+	require.NoError(t, err)
+
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildCreateReq(t, 1, body))
+
+	require.Equal(t, http.StatusCreated, rr.Code)
+
+	var src portainer.Source
+	err = json.NewDecoder(rr.Body).Decode(&src)
+	require.NoError(t, err)
+	require.NotNil(t, src.Git)
+	require.NotNil(t, src.Git.Authentication)
+	require.Equal(t, "alice", src.Git.Authentication.Username)
+	require.Empty(t, src.Git.Authentication.Password)
+}
+
+func TestGitSourceCreate_MissingURL(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	h := newTestHandler(t, store)
+
+	body, err := json.Marshal(GitSourceCreatePayload{Name: "no-url"})
+	require.NoError(t, err)
+
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildCreateReq(t, 1, body))
+
+	require.Equal(t, http.StatusBadRequest, rr.Code)
+}
+
+func TestGitSourceCreate_ConflictOnDuplicateURLAndCredentials(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	h := newTestHandler(t, store)
+
+	body, err := json.Marshal(GitSourceCreatePayload{
+		URL: "https://github.com/org/repo.git",
+		Authentication: &GitAuthenticationPayload{
+			Username: "alice",
+			Password: "secret",
+		},
+	})
+	require.NoError(t, err)
+
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildCreateReq(t, 1, body))
+	require.Equal(t, http.StatusCreated, rr.Code)
+
+	rr = httptest.NewRecorder()
+	h.ServeHTTP(rr, buildCreateReq(t, 1, body))
+	require.Equal(t, http.StatusConflict, rr.Code)
+}
+
+func TestGitSourceCreate_AllowsDuplicateURLWithDifferentCredentials(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	h := newTestHandler(t, store)
+
+	first, err := json.Marshal(GitSourceCreatePayload{
+		URL: "https://github.com/org/repo.git",
+		Authentication: &GitAuthenticationPayload{
+			Username: "alice",
+			Password: "secret",
+		},
+	})
+	require.NoError(t, err)
+
+	second, err := json.Marshal(GitSourceCreatePayload{
+		URL: "https://github.com/org/repo.git",
+		Authentication: &GitAuthenticationPayload{
+			Username: "bob",
+			Password: "other",
+		},
+	})
+	require.NoError(t, err)
+
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildCreateReq(t, 1, first))
+	require.Equal(t, http.StatusCreated, rr.Code)
+
+	rr = httptest.NewRecorder()
+	h.ServeHTTP(rr, buildCreateReq(t, 1, second))
+	require.Equal(t, http.StatusCreated, rr.Code)
+}
+
+func TestGitSourceCreate_ConflictOnDuplicateAuthlessSource(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	h := newTestHandler(t, store)
+
+	body, err := json.Marshal(GitSourceCreatePayload{
+		URL: "https://github.com/org/repo.git",
+	})
+	require.NoError(t, err)
+
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildCreateReq(t, 1, body))
+	require.Equal(t, http.StatusCreated, rr.Code)
+
+	rr = httptest.NewRecorder()
+	h.ServeHTTP(rr, buildCreateReq(t, 1, body))
+	require.Equal(t, http.StatusConflict, rr.Code)
+}
+
+func TestGitSourceCreate_AllowsAuthlessAndAuthenticatedSameURL(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	h := newTestHandler(t, store)
+
+	authless, err := json.Marshal(GitSourceCreatePayload{
+		URL: "https://github.com/org/repo.git",
+	})
+	require.NoError(t, err)
+
+	authenticated, err := json.Marshal(GitSourceCreatePayload{
+		URL: "https://github.com/org/repo.git",
+		Authentication: &GitAuthenticationPayload{
+			Username: "alice",
+			Password: "secret",
+		},
+	})
+	require.NoError(t, err)
+
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildCreateReq(t, 1, authless))
+	require.Equal(t, http.StatusCreated, rr.Code)
+
+	rr = httptest.NewRecorder()
+	h.ServeHTTP(rr, buildCreateReq(t, 1, authenticated))
+	require.Equal(t, http.StatusCreated, rr.Code)
+}
+
+func TestGitSourceCreate_MalformedJSON(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	h := newTestHandler(t, store)
+
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildCreateReq(t, 1, []byte("not-valid-json{")))
+
+	require.Equal(t, http.StatusBadRequest, rr.Code)
+}
diff --git a/api/http/handler/gitops/sources/delete.go b/api/http/handler/gitops/sources/delete.go
new file mode 100644
index 0000000..5171d6d
--- /dev/null
+++ b/api/http/handler/gitops/sources/delete.go
@@ -0,0 +1,97 @@
+package sources
+
+import (
+	"errors"
+	"net/http"
+	"slices"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	dserrors "github.com/portainer/portainer/api/dataservices/errors"
+	"github.com/portainer/portainer/api/dataservices/source"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+var ErrSourceInUse = errors.New("source is used by one or more workflows or custom templates")
+
+// @id GitOpsSourcesDelete
+// @summary Delete a source
+// @description Deletes an existing GitOps source. Returns 409 if the source is referenced by any workflow or custom template.
+// @description **Access policy**: authenticated
+// @tags gitops
+// @security ApiKeyAuth
+// @security jwt
+// @param id path int true "Source identifier"
+// @success 204 "Source deleted"
+// @failure 400 "Invalid request"
+// @failure 403 "Access denied"
+// @failure 404 "Source not found"
+// @failure 409 "Source is in use by one or more workflows or custom templates"
+// @failure 500 "Server error"
+// @router /gitops/sources/{id} [delete]
+func (h *Handler) sourceDelete(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	sourceID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid source identifier route variable", err)
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	if err := h.dataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+
+		userContext := source.NewUserContext(securityContext.User, securityContext.UserMemberships)
+		if exists, err := tx.Source().Exists(userContext, portainer.SourceID(sourceID)); err != nil {
+			return err
+		} else if !exists {
+			return dserrors.ErrObjectNotFound
+		}
+
+		workflows, err := tx.Workflow().ReadAll()
+		if err != nil {
+			return err
+		}
+
+		for _, wf := range workflows {
+			if slices.ContainsFunc(wf.Artifacts, func(as portainer.Artifact) bool {
+				return slices.ContainsFunc(as.Files, func(f portainer.ArtifactFile) bool {
+					return f.SourceID == portainer.SourceID(sourceID)
+				})
+			}) {
+				return ErrSourceInUse
+			}
+		}
+
+		templates, err := tx.CustomTemplate().ReadAll(func(t portainer.CustomTemplate) bool {
+			return t.Artifact != nil && slices.ContainsFunc(t.Artifact.Files, func(f portainer.ArtifactFile) bool {
+				return f.SourceID == portainer.SourceID(sourceID)
+			})
+		})
+		if err != nil {
+			return err
+		}
+
+		if len(templates) > 0 {
+			return ErrSourceInUse
+		}
+
+		return tx.Source().Delete(userContext, portainer.SourceID(sourceID))
+	}); h.dataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find a source with the specified identifier", err)
+	} else if errors.Is(err, ErrSourceInUse) {
+		return httperror.Conflict("Source is used by one or more workflows or custom templates", err)
+	} else if errors.Is(err, source.ErrNotEnoughPermission) {
+		return httperror.Forbidden("Not enough permissions to delete source", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to delete source", err)
+	}
+
+	h.invalidateCache()
+
+	return response.Empty(w)
+}
diff --git a/api/http/handler/gitops/sources/delete_test.go b/api/http/handler/gitops/sources/delete_test.go
new file mode 100644
index 0000000..833c9ca
--- /dev/null
+++ b/api/http/handler/gitops/sources/delete_test.go
@@ -0,0 +1,125 @@
+package sources
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	gittypes "github.com/portainer/portainer/api/git/types"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestSourceDelete_Success(t *testing.T) {
+	t.Parallel()
+
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var srcID portainer.SourceID
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		src := &portainer.Source{Name: "to-delete", Type: portainer.SourceTypeGit, Git: &gittypes.GitSource{URL: "http://github.com/org/repo"}}
+		err := tx.Source().Create(adminUserContext, src)
+		require.NoError(t, err)
+		srcID = src.ID
+
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	h := newTestHandler(t, store)
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildDeleteReq(t, 1, int(srcID)))
+
+	require.Equal(t, http.StatusNoContent, rr.Code)
+}
+
+func TestSourceDelete_NotFound(t *testing.T) {
+	t.Parallel()
+
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	h := newTestHandler(t, store)
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildDeleteReq(t, 1, 99))
+
+	require.Equal(t, http.StatusNotFound, rr.Code)
+}
+
+func TestSourceDelete_InUse(t *testing.T) {
+	t.Parallel()
+
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var srcID portainer.SourceID
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		src := &portainer.Source{Name: "in-use", Type: portainer.SourceTypeGit, Git: &gittypes.GitSource{URL: "http://github.com/org/repo"}}
+		err := tx.Source().Create(adminUserContext, src)
+		require.NoError(t, err)
+		srcID = src.ID
+
+		wf := &portainer.Workflow{Artifacts: []portainer.Artifact{{Files: []portainer.ArtifactFile{{SourceID: src.ID}}}}}
+		err = tx.Workflow().Create(wf)
+		require.NoError(t, err)
+
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	h := newTestHandler(t, store)
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildDeleteReq(t, 1, int(srcID)))
+
+	require.Equal(t, http.StatusConflict, rr.Code)
+}
+
+func TestSourceDelete_NonNumericID(t *testing.T) {
+	t.Parallel()
+
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	h := newTestHandler(t, store)
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildDeleteReqWithRawID(t, 1, "not-a-number"))
+
+	require.Equal(t, http.StatusBadRequest, rr.Code)
+}
+
+func TestSourceDelete_InUseByCustomTemplate(t *testing.T) {
+	t.Parallel()
+
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var srcID portainer.SourceID
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		src := &portainer.Source{Name: "in-use-by-template", Type: portainer.SourceTypeGit, Git: &gittypes.GitSource{URL: "http://github.com/org/repo"}}
+		err := tx.Source().Create(adminUserContext, src)
+		require.NoError(t, err)
+		srcID = src.ID
+
+		ct := &portainer.CustomTemplate{
+			ID: 1,
+			Artifact: &portainer.Artifact{
+				Files: []portainer.ArtifactFile{{SourceID: src.ID}},
+			},
+		}
+		err = tx.CustomTemplate().Create(ct)
+		require.NoError(t, err)
+
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	h := newTestHandler(t, store)
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildDeleteReq(t, 1, int(srcID)))
+
+	require.Equal(t, http.StatusConflict, rr.Code)
+}
diff --git a/api/http/handler/gitops/sources/fetch.go b/api/http/handler/gitops/sources/fetch.go
new file mode 100644
index 0000000..b4de307
--- /dev/null
+++ b/api/http/handler/gitops/sources/fetch.go
@@ -0,0 +1,77 @@
+package sources
+
+import (
+	"slices"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	ce "github.com/portainer/portainer/api/gitops/workflows"
+	"github.com/portainer/portainer/api/set"
+	"github.com/portainer/portainer/api/slicesx"
+)
+
+// FetchSourceWorkflows returns the workflows and stats for a single source.
+func FetchSourceWorkflows(tx dataservices.DataStoreTx, src *portainer.Source) ([]ce.Workflow, ce.SourceStats, error) {
+	wfs, err := tx.Workflow().ReadAll(func(wf portainer.Workflow) bool {
+		return slices.ContainsFunc(wf.Artifacts, func(artifact portainer.Artifact) bool {
+			return slices.ContainsFunc(artifact.Files, func(f portainer.ArtifactFile) bool {
+				return f.SourceID == src.ID
+			})
+		})
+	})
+	if err != nil {
+		return nil, ce.SourceStats{}, err
+	}
+
+	if len(wfs) == 0 {
+		return nil, ce.SourceStats{}, nil
+	}
+
+	wfIDSet := set.ToSet(slicesx.Map(wfs, func(wf portainer.Workflow) portainer.WorkflowID { return wf.ID }))
+
+	stacks, err := tx.Stack().ReadAll(func(s portainer.Stack) bool {
+		_, ok := wfIDSet[s.WorkflowID]
+		return ok
+	})
+	if err != nil {
+		return nil, ce.SourceStats{}, err
+	}
+
+	artifactByStack := make(map[portainer.StackID]portainer.ArtifactFile)
+	for _, wf := range wfs {
+		for _, artifact := range wf.Artifacts {
+			if artifact.StackID == 0 {
+				continue
+			}
+			if _, exists := artifactByStack[artifact.StackID]; exists {
+				continue
+			}
+			for _, file := range artifact.Files {
+				if file.SourceID == src.ID {
+					artifactByStack[artifact.StackID] = file
+					break
+				}
+			}
+		}
+	}
+
+	unknown := ce.WorkflowPhaseStatus{Status: ce.StatusUnknown}
+	items := make([]ce.Workflow, 0, len(stacks))
+	stats := ce.SourceStats{EndpointIDs: set.Set[portainer.EndpointID]{}}
+
+	for _, stack := range stacks {
+		cfg := src.Git.ToRepoConfig()
+		if file, ok := artifactByStack[stack.ID]; ok {
+			cfg.ReferenceName = file.Ref
+			cfg.ConfigFilePath = file.Path
+			cfg.ConfigHash = file.Hash
+		}
+		items = append(items, ce.MapStackToWorkflow(stack, src.ID, cfg, unknown, unknown))
+		stats.WorkflowCount++
+		if stack.EndpointID != 0 {
+			stats.EndpointIDs.Add(stack.EndpointID)
+		}
+	}
+
+	return items, stats, nil
+}
diff --git a/api/http/handler/gitops/sources/get.go b/api/http/handler/gitops/sources/get.go
new file mode 100644
index 0000000..0014b54
--- /dev/null
+++ b/api/http/handler/gitops/sources/get.go
@@ -0,0 +1,179 @@
+package sources
+
+import (
+	"errors"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	sourceDS "github.com/portainer/portainer/api/dataservices/source"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	"github.com/portainer/portainer/api/gitops/workflows"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type gitAuthInfo struct {
+	Username string `json:"username"`
+}
+
+type connectionInfo struct {
+	TLSSkipVerify  bool         `json:"tlsSkipVerify"`
+	Authentication *gitAuthInfo `json:"authentication,omitempty"`
+}
+
+type AutoUpdateInfo struct {
+	Mechanism     string `json:"mechanism,omitempty"`
+	FetchInterval string `json:"fetchInterval,omitempty"`
+}
+
+type SourceAccess struct {
+	Public bool               `json:"public,omitempty"`
+	Users  []portainer.UserID `json:"users,omitempty"`
+	Teams  []portainer.TeamID `json:"teams,omitempty"`
+}
+
+// SourceDetail extends Source with connection settings and linked workflows.
+type SourceDetail struct {
+	Source
+	Connection connectionInfo       `json:"connection" validate:"required"`
+	AutoUpdate *AutoUpdateInfo      `json:"autoUpdate,omitempty"`
+	Workflows  []workflows.Workflow `json:"workflows"`
+	Access     SourceAccess         `json:"access"`
+}
+
+// @id GitOpsSourceGet
+// @summary Get a GitOps source by ID
+// @description Returns a single GitOps source with its connection settings and linked workflows.
+// @description **Access policy**: authenticated
+// @tags gitops
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param id path int true "Source identifier"
+// @success 200 {object} SourceDetail
+// @failure 400 "Invalid request"
+// @failure 403 "Access denied"
+// @failure 404 "Source not found"
+// @failure 500 "Server error"
+// @router /gitops/sources/{id} [get]
+func (h *Handler) getSource(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	srcID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid source identifier route variable", err)
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	sourceID := portainer.SourceID(srcID)
+
+	var source *portainer.Source
+	var sourceWfs []workflows.Workflow
+	var stats workflows.SourceStats
+
+	err = h.dataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
+		var err error
+		userContext := sourceDS.NewUserContext(securityContext.User, securityContext.UserMemberships)
+		source, err = tx.Source().Read(userContext, sourceID)
+		if err != nil {
+			return err
+		}
+
+		sourceWfs, stats, err = FetchSourceWorkflows(tx, source)
+		return err
+	})
+
+	if h.dataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Source not found", err)
+	} else if errors.Is(err, sourceDS.ErrNotEnoughPermission) {
+		return httperror.Forbidden("Not enough permissions to retrieve source", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to retrieve source", err)
+	}
+
+	access := BuildSourceAccess(source)
+
+	detail := BuildSourceDetail(h.buildSource(source, stats), source.Git, sourceWfs, access)
+	return response.JSON(w, detail)
+}
+
+func BuildSourceDetail(baseSource Source, cfg *gittypes.GitSource, sourceWfs []workflows.Workflow, access SourceAccess) SourceDetail {
+	var autoUpdate *AutoUpdateInfo
+	if len(sourceWfs) > 0 {
+		autoUpdate = BuildAutoUpdateInfo(sourceWfs[0].AutoUpdate)
+	}
+
+	return SourceDetail{
+		Source:     baseSource,
+		Connection: buildConnectionInfo(cfg),
+		AutoUpdate: autoUpdate,
+		Workflows:  redactWorkflowCredentials(sourceWfs),
+		Access:     access,
+	}
+}
+
+func BuildSourceAccess(source *portainer.Source) SourceAccess {
+	if source == nil {
+		return SourceAccess{}
+	}
+
+	if source.AdministratorsOnly {
+		return SourceAccess{}
+	}
+
+	if source.Public {
+		return SourceAccess{
+			Public: true,
+		}
+	}
+
+	return SourceAccess{
+		Public: source.Public,
+		Users:  source.UserAccesses,
+		Teams:  source.TeamAccesses,
+	}
+}
+
+func buildConnectionInfo(cfg *gittypes.GitSource) connectionInfo {
+	if cfg == nil {
+		return connectionInfo{}
+	}
+	return connectionInfo{
+		TLSSkipVerify:  cfg.TLSSkipVerify,
+		Authentication: buildGitAuthInfo(cfg.Authentication),
+	}
+}
+
+func buildGitAuthInfo(auth *gittypes.GitAuthentication) *gitAuthInfo {
+	if auth == nil {
+		return nil
+	}
+	return &gitAuthInfo{
+		Username: auth.Username,
+	}
+}
+
+func BuildAutoUpdateInfo(autoUpdate *portainer.AutoUpdateSettings) *AutoUpdateInfo {
+	if autoUpdate == nil {
+		return nil
+	}
+
+	switch {
+	case autoUpdate.Interval != "":
+		return &AutoUpdateInfo{
+			Mechanism:     "Interval",
+			FetchInterval: autoUpdate.Interval,
+		}
+	case autoUpdate.Webhook != "":
+		return &AutoUpdateInfo{
+			Mechanism: "Webhook",
+		}
+	default:
+		return nil
+	}
+}
diff --git a/api/http/handler/gitops/sources/get_test.go b/api/http/handler/gitops/sources/get_test.go
new file mode 100644
index 0000000..b9900e0
--- /dev/null
+++ b/api/http/handler/gitops/sources/get_test.go
@@ -0,0 +1,117 @@
+package sources
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	gittypes "github.com/portainer/portainer/api/git/types"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetSource_NotFound(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	h := newTestHandler(t, store)
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildGetReq(t, 1, "999"))
+	assert.Equal(t, http.StatusNotFound, rr.Code)
+}
+
+func TestGetSource_ReturnsDetail(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	cfg := &gittypes.GitSource{
+		URL:           "https://github.com/org/repo",
+		TLSSkipVerify: true,
+	}
+
+	var srcID portainer.SourceID
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		stack := &portainer.Stack{ID: 1, Name: "my-stack"}
+		srcID = createGitWorkflow(t, tx, stack, cfg)
+		require.NoError(t, tx.Stack().Create(stack))
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	h := newTestHandler(t, store)
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildGetReq(t, 1, strconv.Itoa(int(srcID))))
+
+	detail := decodeSourceDetail(t, rr)
+	assert.Equal(t, srcID, detail.ID)
+	assert.Equal(t, "repo", detail.Name)
+	assert.Equal(t, 1, detail.UsedBy)
+	assert.True(t, detail.Connection.TLSSkipVerify)
+	require.Len(t, detail.Workflows, 1)
+	assert.Equal(t, "my-stack", detail.Workflows[0].Name)
+}
+
+func TestGetSource_RedactsCredentials(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	cfg := &gittypes.GitSource{
+		URL:            "https://github.com/org/secure",
+		Authentication: &gittypes.GitAuthentication{Username: "user", Password: "s3cr3t"},
+	}
+
+	var srcID portainer.SourceID
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		stack := &portainer.Stack{ID: 1, Name: "secure-stack"}
+		srcID = createGitWorkflow(t, tx, stack, cfg)
+		require.NoError(t, tx.Stack().Create(stack))
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	h := newTestHandler(t, store)
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildGetReq(t, 1, strconv.Itoa(int(srcID))))
+
+	detail := decodeSourceDetail(t, rr)
+	require.Len(t, detail.Workflows, 1)
+	require.NotNil(t, detail.Workflows[0].GitConfig)
+	require.NotNil(t, detail.Workflows[0].GitConfig.Authentication)
+	assert.Equal(t, "user", detail.Workflows[0].GitConfig.Authentication.Username)
+	assert.Empty(t, detail.Workflows[0].GitConfig.Authentication.Password)
+}
+
+func TestGetSource_AutoUpdate(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	cfg := gitCfg("https://github.com/org/polled")
+
+	var srcID portainer.SourceID
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		stack := &portainer.Stack{
+			ID:         1,
+			Name:       "polled-stack",
+			AutoUpdate: &portainer.AutoUpdateSettings{Interval: "5m"},
+		}
+		srcID = createGitWorkflow(t, tx, stack, cfg)
+		require.NoError(t, tx.Stack().Create(stack))
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	h := newTestHandler(t, store)
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildGetReq(t, 1, strconv.Itoa(int(srcID))))
+
+	detail := decodeSourceDetail(t, rr)
+	require.NotNil(t, detail.AutoUpdate)
+	assert.Equal(t, "Interval", detail.AutoUpdate.Mechanism)
+	assert.Equal(t, "5m", detail.AutoUpdate.FetchInterval)
+}
diff --git a/api/http/handler/gitops/sources/handler.go b/api/http/handler/gitops/sources/handler.go
new file mode 100644
index 0000000..cefcfdd
--- /dev/null
+++ b/api/http/handler/gitops/sources/handler.go
@@ -0,0 +1,62 @@
+package sources
+
+import (
+	"net/http"
+	"time"
+
+	gocache "github.com/patrickmn/go-cache"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/kubernetes/cli"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+
+	"github.com/gorilla/mux"
+)
+
+const (
+	cacheTTL             = 30 * time.Second
+	cacheCleanupInterval = 10 * time.Minute
+)
+
+// Handler is the HTTP handler for the GitOps sources API.
+type Handler struct {
+	*mux.Router
+	dataStore  dataservices.DataStore
+	gitService portainer.GitService
+	cache      *gocache.Cache
+	k8sFactory *cli.ClientFactory
+}
+
+func NewHandler(bouncer security.BouncerService, dataStore dataservices.DataStore, gitService portainer.GitService, k8sFactory *cli.ClientFactory) *Handler {
+	h := &Handler{
+		Router:     mux.NewRouter(),
+		dataStore:  dataStore,
+		gitService: gitService,
+		cache:      gocache.New(cacheTTL, cacheCleanupInterval),
+		k8sFactory: k8sFactory,
+	}
+
+	authenticatedRouter := h.PathPrefix("/gitops/sources").Subrouter()
+	authenticatedRouter.Use(bouncer.AuthenticatedAccess)
+	authenticatedRouter.Handle("", httperror.LoggerHandler(h.list)).Methods(http.MethodGet)
+	authenticatedRouter.Handle("/summary", httperror.LoggerHandler(h.summary)).Methods(http.MethodGet)
+	authenticatedRouter.Handle("/{id}", httperror.LoggerHandler(h.getSource)).Methods(http.MethodGet)
+	authenticatedRouter.Handle("/git", httperror.LoggerHandler(h.gitSourceCreate)).Methods(http.MethodPost)
+	authenticatedRouter.Handle("/test", httperror.LoggerHandler(h.gitSourceTest)).Methods(http.MethodPost)
+	authenticatedRouter.Handle("/{id}", httperror.LoggerHandler(h.gitSourceUpdate)).Methods(http.MethodPut)
+	authenticatedRouter.Handle("/{id}", httperror.LoggerHandler(h.sourceDelete)).Methods(http.MethodDelete)
+	authenticatedRouter.Handle("/{id}/test", httperror.LoggerHandler(h.sourceTestConnection)).Methods(http.MethodPost)
+
+	adminRouter := h.PathPrefix("/gitops/sources").Subrouter()
+	adminRouter.Use(bouncer.AdminAccess)
+	adminRouter.Handle("/{id}/access", httperror.LoggerHandler(h.gitSourceUpdateAccess)).Methods(http.MethodPut)
+
+	return h
+}
+
+// invalidateCache clears the cached source lists so the next read reflects
+// the latest datastore state. Called after any mutating operation.
+func (h *Handler) invalidateCache() {
+	h.cache.Flush()
+}
diff --git a/api/http/handler/gitops/sources/helpers_test.go b/api/http/handler/gitops/sources/helpers_test.go
new file mode 100644
index 0000000..c724f92
--- /dev/null
+++ b/api/http/handler/gitops/sources/helpers_test.go
@@ -0,0 +1,150 @@
+package sources
+
+import (
+	"bytes"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/dataservices/source"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+
+	gocache "github.com/patrickmn/go-cache"
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/require"
+)
+
+var adminUserContext = source.InsecureNewAdminContext()
+
+// createGitWorkflow creates a Source and Workflow for the given config and
+// wires them up by setting stack.WorkflowID before creating the stack.
+func createGitWorkflow(t *testing.T, tx dataservices.DataStoreTx, stack *portainer.Stack, cfg *gittypes.GitSource) portainer.SourceID {
+	t.Helper()
+
+	src := &portainer.Source{
+		Name: gittypes.RepoName(cfg.URL),
+		Type: portainer.SourceTypeGit,
+		Git:  cfg,
+	}
+	require.NoError(t, tx.Source().Create(adminUserContext, src))
+
+	wf := &portainer.Workflow{
+		Artifacts: []portainer.Artifact{{
+			StackID: stack.ID,
+			Files:   []portainer.ArtifactFile{{SourceID: src.ID}},
+		}},
+	}
+	require.NoError(t, tx.Workflow().Create(wf))
+
+	stack.WorkflowID = wf.ID
+
+	return src.ID
+}
+
+func newTestHandler(t *testing.T, store dataservices.DataStore) *Handler {
+	t.Helper()
+	return NewHandler(testhelpers.NewTestRequestBouncer(), store, nil, nil)
+}
+
+// newTestHandlerNoCacheExpiry returns a handler whose source cache never expires,
+// so cache-invalidation tests can prove a write clears the cache rather than the
+// TTL simply elapsing between requests.
+func newTestHandlerNoCacheExpiry(t *testing.T, store dataservices.DataStore) *Handler {
+	t.Helper()
+	h := newTestHandler(t, store)
+	h.cache = gocache.New(gocache.NoExpiration, cacheCleanupInterval)
+	return h
+}
+
+func adminRestrictedContext(userID portainer.UserID) *security.RestrictedRequestContext {
+	return &security.RestrictedRequestContext{
+		UserID:  userID,
+		IsAdmin: true,
+		User:    &portainer.User{ID: userID, Role: portainer.AdministratorRole},
+	}
+}
+
+// withSecurityContext attaches the admin token data and restricted request
+// context for userID to req, mirroring what the auth middleware sets up in
+// production.
+func withSecurityContext(req *http.Request, userID portainer.UserID) *http.Request {
+	req = req.WithContext(security.StoreTokenData(req, &portainer.TokenData{ID: userID}))
+	req = req.WithContext(security.StoreRestrictedRequestContext(req, adminRestrictedContext(userID)))
+	return req
+}
+
+func buildListReq(t *testing.T, userID portainer.UserID, query string) *http.Request {
+	t.Helper()
+	req := httptest.NewRequest(http.MethodGet, "/gitops/sources?"+query, nil)
+	return withSecurityContext(req, userID)
+}
+
+func buildGetReq(t *testing.T, userID portainer.UserID, id string) *http.Request {
+	t.Helper()
+	req := httptest.NewRequest(http.MethodGet, "/gitops/sources/"+id, nil)
+	return withSecurityContext(req, userID)
+}
+
+func decodeSources(t *testing.T, rr *httptest.ResponseRecorder) []Source {
+	t.Helper()
+	require.Equal(t, http.StatusOK, rr.Code, "unexpected status: %s", rr.Body.String())
+	var items []Source
+	require.NoError(t, json.NewDecoder(rr.Body).Decode(&items))
+	return items
+}
+
+func decodeSourceDetail(t *testing.T, rr *httptest.ResponseRecorder) SourceDetail {
+	t.Helper()
+	require.Equal(t, http.StatusOK, rr.Code, "unexpected status: %s", rr.Body.String())
+	var item SourceDetail
+	require.NoError(t, json.NewDecoder(rr.Body).Decode(&item))
+	return item
+}
+
+func gitCfg(url string) *gittypes.GitSource {
+	return &gittypes.GitSource{URL: url}
+}
+
+func buildCreateReq(t *testing.T, userID portainer.UserID, body []byte) *http.Request {
+	t.Helper()
+	req := httptest.NewRequest(http.MethodPost, "/gitops/sources/git", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	return withSecurityContext(req, userID)
+}
+
+func buildUpdateReq(t *testing.T, userID portainer.UserID, id int, body []byte) *http.Request {
+	t.Helper()
+	req := httptest.NewRequest(http.MethodPut, fmt.Sprintf("/gitops/sources/%d", id), bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	return withSecurityContext(req, userID)
+}
+
+func buildDeleteReq(t *testing.T, userID portainer.UserID, id int) *http.Request {
+	t.Helper()
+	req := httptest.NewRequest(http.MethodDelete, fmt.Sprintf("/gitops/sources/%d", id), nil)
+	return withSecurityContext(req, userID)
+}
+
+func buildSummaryReq(t *testing.T, userID portainer.UserID) *http.Request {
+	t.Helper()
+	req := httptest.NewRequest(http.MethodGet, "/gitops/sources/summary", nil)
+	return withSecurityContext(req, userID)
+}
+
+func buildUpdateReqWithRawID(t *testing.T, userID portainer.UserID, id string, body []byte) *http.Request {
+	t.Helper()
+	req := httptest.NewRequest(http.MethodPut, "/gitops/sources/"+id, bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	return withSecurityContext(req, userID)
+}
+
+func buildDeleteReqWithRawID(t *testing.T, userID portainer.UserID, id string) *http.Request {
+	t.Helper()
+	req := httptest.NewRequest(http.MethodDelete, "/gitops/sources/"+id, nil)
+	return withSecurityContext(req, userID)
+}
diff --git a/api/http/handler/gitops/sources/list.go b/api/http/handler/gitops/sources/list.go
new file mode 100644
index 0000000..8a75dd3
--- /dev/null
+++ b/api/http/handler/gitops/sources/list.go
@@ -0,0 +1,135 @@
+package sources
+
+import (
+	"context"
+	"net/http"
+	"slices"
+	"strconv"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/gitops/workflows"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/http/utils/filters"
+	"github.com/portainer/portainer/api/slicesx"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+
+	gocache "github.com/patrickmn/go-cache"
+)
+
+// @id GitOpsSourcesList
+// @summary List all GitOps sources
+// @description Returns a deduplicated list of git repositories used across all GitOps workflows.
+// @description **Access policy**: authenticated
+// @tags gitops
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param search query string false "Search term (matches URL)"
+// @param sort   query string false "Sort field: name | status | type"
+// @param order  query string false "Sort order: asc or desc"
+// @param start  query int    false "Pagination start index"
+// @param limit  query int    false "Pagination limit (0 = unlimited)"
+// @param status query string false "Filter by status: healthy | syncing | error | paused | unknown"
+// @param type   query SourceType false "Filter by source type: git | oci | helm"
+// @success 200 {array} Source
+// @failure 400 "Invalid status parameter"
+// @failure 403 "Access denied"
+// @failure 500 "Server error"
+// @router /gitops/sources [get]
+func (h *Handler) list(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	params := filters.ExtractListModifiersQueryParams(r)
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	key := cacheKey(securityContext)
+
+	sources, err := h.getSources(r.Context(), key, securityContext)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve sources", err)
+	}
+
+	if status, _ := request.RetrieveQueryParameter(r, "status", true); status != "" {
+		s, err := workflows.ParseStatus(status)
+		if err != nil {
+			return httperror.BadRequest("Invalid status parameter", err)
+		}
+		sources = slicesx.FilterInPlace(sources, func(i Source) bool { return i.Status == s })
+	}
+
+	if sourceType, _ := request.RetrieveQueryParameter(r, "type", true); sourceType != "" {
+		t, err := parseSourceType(sourceType)
+		if err != nil {
+			return httperror.BadRequest("Invalid type parameter", err)
+		}
+		sources = slicesx.FilterInPlace(sources, func(i Source) bool { return i.Type == t })
+	}
+
+	results := filters.SearchOrderAndPaginate(sources, params, filters.Config[Source]{
+		SearchAccessors: []filters.SearchAccessor[Source]{
+			func(s Source) (string, error) { return s.URL, nil },
+		},
+		SortBindings: []filters.SortBinding[Source]{
+			{Key: "name", Fn: func(a, b Source) int { return strings.Compare(a.Name, b.Name) }},
+			{Key: "status", Fn: func(a, b Source) int { return strings.Compare(string(a.Status), string(b.Status)) }},
+			{Key: "type", Fn: func(a, b Source) int { return strings.Compare(string(a.Type), string(b.Type)) }},
+		},
+	})
+
+	filters.ApplyFilterResultsHeaders(&w, results)
+	return response.JSON(w, results.Items)
+}
+
+func (h *Handler) getSources(ctx context.Context, key string, sc *security.RestrictedRequestContext) ([]Source, error) {
+	if cached, ok := h.cache.Get(key); ok {
+		return slices.Clone(cached.([]Source)), nil
+	}
+
+	result, err := h.fetchSources(ctx, sc)
+	if err != nil {
+		return nil, err
+	}
+	h.cache.Set(key, result, gocache.DefaultExpiration)
+	return slices.Clone(result), nil
+}
+
+func cacheKey(sc *security.RestrictedRequestContext) string {
+	teamIDs := make([]string, len(sc.UserMemberships))
+	for i, membership := range sc.UserMemberships {
+		teamIDs[i] = strconv.Itoa(int(membership.TeamID))
+	}
+	slices.Sort(teamIDs)
+
+	return strconv.Itoa(int(sc.UserID)) + ":" + strconv.FormatBool(sc.IsAdmin) + ":" + strings.Join(teamIDs, ",")
+}
+
+func (h *Handler) fetchSources(ctx context.Context, sc *security.RestrictedRequestContext) ([]Source, error) {
+	var allSrcs []portainer.Source
+	var stats map[portainer.SourceID]workflows.SourceStats
+
+	if err := h.dataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
+		var err error
+		allSrcs, stats, err = workflows.FetchSourceStats(tx, h.k8sFactory, sc)
+		return err
+	}); err != nil {
+		return nil, err
+	}
+
+	result := make([]Source, 0, len(allSrcs))
+	for _, src := range allSrcs {
+		stat, ok := stats[src.ID]
+		if !ok {
+			stat = workflows.SourceStats{}
+		}
+
+		result = append(result, h.buildSource(&src, stat))
+	}
+
+	return result, nil
+}
diff --git a/api/http/handler/gitops/sources/list_test.go b/api/http/handler/gitops/sources/list_test.go
new file mode 100644
index 0000000..2d1bff4
--- /dev/null
+++ b/api/http/handler/gitops/sources/list_test.go
@@ -0,0 +1,127 @@
+package sources
+
+import (
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	gittypes "github.com/portainer/portainer/api/git/types"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSourcesList_GroupsByURLAndCredentials(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		cfg := gitCfg("https://github.com/org/repo")
+		src := &portainer.Source{Name: "repo", Type: portainer.SourceTypeGit, Git: cfg}
+		require.NoError(t, tx.Source().Create(adminUserContext, src))
+
+		wfA := &portainer.Workflow{Artifacts: []portainer.Artifact{{Files: []portainer.ArtifactFile{{SourceID: src.ID}}}}}
+		require.NoError(t, tx.Workflow().Create(wfA))
+
+		wfB := &portainer.Workflow{Artifacts: []portainer.Artifact{{Files: []portainer.ArtifactFile{{SourceID: src.ID}}}}}
+		require.NoError(t, tx.Workflow().Create(wfB))
+
+		require.NoError(t, tx.Stack().Create(&portainer.Stack{ID: 1, Name: "stack-a", WorkflowID: wfA.ID}))
+		require.NoError(t, tx.Stack().Create(&portainer.Stack{ID: 2, Name: "stack-b", WorkflowID: wfB.ID}))
+
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	h := newTestHandler(t, store)
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildListReq(t, 1, ""))
+
+	sources := decodeSources(t, rr)
+	require.Len(t, sources, 1)
+	assert.Equal(t, 2, sources[0].UsedBy)
+}
+
+func TestSourcesList_SeparatesCredentials(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		cfg1 := gitCfg("https://github.com/org/repo")
+		cfg1.Authentication = &gittypes.GitAuthentication{Username: "alice", Password: "pass1"}
+		cfg2 := gitCfg("https://github.com/org/repo")
+		cfg2.Authentication = &gittypes.GitAuthentication{Username: "bob", Password: "pass2"}
+
+		stackA := &portainer.Stack{ID: 1, Name: "stack-a"}
+		createGitWorkflow(t, tx, stackA, cfg1)
+		require.NoError(t, tx.Stack().Create(stackA))
+
+		stackB := &portainer.Stack{ID: 2, Name: "stack-b"}
+		createGitWorkflow(t, tx, stackB, cfg2)
+		require.NoError(t, tx.Stack().Create(stackB))
+
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	h := newTestHandler(t, store)
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildListReq(t, 1, ""))
+
+	sources := decodeSources(t, rr)
+	assert.Len(t, sources, 2)
+}
+
+func TestSourcesList_StatusFilter(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	// With nil gitService, source git-phase status is always StatusUnknown.
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		stack := &portainer.Stack{ID: 1}
+		createGitWorkflow(t, tx, stack, gitCfg("https://github.com/org/app"))
+		require.NoError(t, tx.Stack().Create(stack))
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	h := newTestHandler(t, store)
+
+	t.Run("status=unknown matches sources with unknown status", func(t *testing.T) {
+		rr := httptest.NewRecorder()
+		h.ServeHTTP(rr, buildListReq(t, 1, "status=unknown"))
+		sources := decodeSources(t, rr)
+		assert.Len(t, sources, 1)
+	})
+
+	t.Run("status=healthy excludes sources with unknown status", func(t *testing.T) {
+		rr := httptest.NewRecorder()
+		h.ServeHTTP(rr, buildListReq(t, 1, "status=healthy"))
+		sources := decodeSources(t, rr)
+		assert.Empty(t, sources)
+	})
+}
+
+func TestSourcesList_SearchByURL(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		stackA := &portainer.Stack{ID: 1}
+		createGitWorkflow(t, tx, stackA, gitCfg("https://github.com/org/app"))
+		require.NoError(t, tx.Stack().Create(stackA))
+
+		stackB := &portainer.Stack{ID: 2}
+		createGitWorkflow(t, tx, stackB, gitCfg("https://github.com/org/infra"))
+		require.NoError(t, tx.Stack().Create(stackB))
+
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	h := newTestHandler(t, store)
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildListReq(t, 1, "search=app"))
+
+	sources := decodeSources(t, rr)
+	require.Len(t, sources, 1)
+	assert.Equal(t, "app", sources[0].Name)
+}
diff --git a/api/http/handler/gitops/sources/source_connection.go b/api/http/handler/gitops/sources/source_connection.go
new file mode 100644
index 0000000..b9ec547
--- /dev/null
+++ b/api/http/handler/gitops/sources/source_connection.go
@@ -0,0 +1,162 @@
+package sources
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/dataservices/source"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	"github.com/portainer/portainer/api/gitops/workflows"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id GitOpsSourcesTestById
+// @summary Test the connection of a stored source
+// @description Tests connectivity for a GitOps source, applying optional overrides to the stored configuration.
+// @description **Access policy**: authenticated
+// @tags gitops
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @produce json
+// @param id path int true "Source identifier"
+// @param body body GitSourceUpdatePayload false "Optional connection overrides; omitted fields fall back to stored values"
+// @success 200 {object} ConnectionTestResult "Connection test result"
+// @failure 400 "Invalid request payload"
+// @failure 403 "Access denied"
+// @failure 404 "Source not found"
+// @failure 500 "Server error"
+// @router /gitops/sources/{id}/test [post]
+func (h *Handler) sourceTestConnection(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	sourceID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid source identifier route variable", err)
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	var payload GitSourceUpdatePayload
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil && !errors.Is(err, io.EOF) {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	var src *portainer.Source
+	if err := h.dataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
+		userContext := source.NewUserContext(securityContext.User, securityContext.UserMemberships)
+		src, err = tx.Source().Read(userContext, portainer.SourceID(sourceID))
+		return err
+	}); h.dataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find a source with the specified identifier", err)
+	} else if errors.Is(err, source.ErrNotEnoughPermission) {
+		return httperror.Forbidden("Not enough permissions to retrieve source", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find source", err)
+	}
+
+	if err := ApplyGitSourceChanges(src, payload); errors.Is(err, ErrNotGitSource) {
+		return httperror.BadRequest("Source is not a Git source", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to apply source changes", err)
+	}
+
+	if src.Git == nil {
+		return httperror.InternalServerError("Source has no git configuration", nil)
+	}
+
+	result := testSourceConnection(r.Context(), h.gitService, src.Git)
+
+	return response.JSON(w, result)
+}
+
+type ConnectionTestResult struct {
+	Success bool   `json:"success"`
+	Error   string `json:"error,omitempty"`
+}
+
+// @id GitOpsSourcesTest
+// @summary Test a Git source connection
+// @description Tests connectivity for Git connection details that have not been persisted yet.
+// @description **Access policy**: authenticated
+// @tags gitops
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @produce json
+// @param body body GitSourceCreatePayload true "Git connection details"
+// @success 200 {object} ConnectionTestResult "Connection test result"
+// @failure 400 "Invalid request payload"
+// @failure 403 "Access denied"
+// @failure 500 "Server error"
+// @router /gitops/sources/test [post]
+func (h *Handler) gitSourceTest(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	var payload GitSourceCreatePayload
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	src, err := BuildGitSource(payload)
+	if err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+	if src.Git == nil {
+		return httperror.InternalServerError("Source has no git configuration", nil)
+	}
+
+	result := testSourceConnection(r.Context(), h.gitService, src.Git)
+
+	return response.JSON(w, result)
+}
+
+// testSourceConnection verifies that a git repository is reachable with the given config.
+func testSourceConnection(ctx context.Context, gitService portainer.GitService, config *gittypes.GitSource) ConnectionTestResult {
+	var username, password string
+	if config.Authentication != nil {
+		username = config.Authentication.Username
+		password = config.Authentication.Password
+	}
+
+	_, err := gitService.ListRefs(ctx, config.URL, username, password, false, config.TLSSkipVerify)
+	if err != nil {
+		return ConnectionTestResult{Success: false, Error: err.Error()}
+	}
+
+	return ConnectionTestResult{Success: true}
+}
+func (h *Handler) testAndSaveSourceConnection(ctx context.Context, userContext source.UserContext, src *portainer.Source) (*portainer.Source, error) {
+	if h.gitService == nil || src.Git == nil {
+		return src, nil
+	}
+
+	result := testSourceConnection(ctx, h.gitService, src.Git)
+
+	var checkErr error
+	if !result.Success {
+		checkErr = errors.New(result.Error)
+	}
+
+	var updated *portainer.Source
+	if err := h.dataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		if err := workflows.SaveSourceStatus(tx, userContext, src.ID, checkErr); err != nil {
+			return err
+		}
+
+		var readErr error
+		updated, readErr = tx.Source().Read(userContext, src.ID)
+
+		return readErr
+	}); err != nil {
+		return nil, err
+	}
+
+	return updated, nil
+}
diff --git a/api/http/handler/gitops/sources/summary.go b/api/http/handler/gitops/sources/summary.go
new file mode 100644
index 0000000..c9b00db
--- /dev/null
+++ b/api/http/handler/gitops/sources/summary.go
@@ -0,0 +1,54 @@
+package sources
+
+import (
+	"net/http"
+
+	ce "github.com/portainer/portainer/api/gitops/workflows"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id GitOpsSourcesSummary
+// @summary Summarize GitOps source status counts
+// @description Returns a count of sources per status.
+// @description **Access policy**: authenticated
+// @tags gitops
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @success 200 {object} ce.StatusSummary
+// @failure 403 "Access denied"
+// @failure 500 "Server error"
+// @router /gitops/sources/summary [get]
+func (h *Handler) summary(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	key := cacheKey(securityContext)
+
+	sources, err := h.getSources(r.Context(), key, securityContext)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve sources", err)
+	}
+
+	summary := ce.StatusSummary{}
+	for _, s := range sources {
+		switch s.Status {
+		case ce.StatusHealthy:
+			summary.Healthy++
+		case ce.StatusSyncing:
+			summary.Syncing++
+		case ce.StatusError:
+			summary.Error++
+		case ce.StatusPaused:
+			summary.Paused++
+		default:
+			summary.Unknown++
+		}
+	}
+
+	return response.JSON(w, summary)
+}
diff --git a/api/http/handler/gitops/sources/summary_test.go b/api/http/handler/gitops/sources/summary_test.go
new file mode 100644
index 0000000..d643375
--- /dev/null
+++ b/api/http/handler/gitops/sources/summary_test.go
@@ -0,0 +1,66 @@
+package sources
+
+import (
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	ceWorkflows "github.com/portainer/portainer/api/gitops/workflows"
+
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSourcesSummary_Empty(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	h := newTestHandler(t, store)
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildSummaryReq(t, 1))
+
+	require.Equal(t, http.StatusOK, rr.Code)
+
+	var summary ceWorkflows.StatusSummary
+	err := json.NewDecoder(rr.Body).Decode(&summary)
+	require.NoError(t, err)
+	require.Equal(t, ceWorkflows.StatusSummary{}, summary)
+}
+
+func TestSourcesSummary_CountsByStatus(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		for idx, name := range []string{"source-a", "source-b", "source-c"} {
+			err := tx.Source().Create(adminUserContext, &portainer.Source{Name: name, Type: portainer.SourceTypeGit, Git: &gittypes.GitSource{URL: fmt.Sprintf("http://github.com/org/repo%d", idx)}})
+			require.NoError(t, err)
+		}
+
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	h := newTestHandler(t, store)
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildSummaryReq(t, 1))
+
+	require.Equal(t, http.StatusOK, rr.Code)
+
+	var summary ceWorkflows.StatusSummary
+	err := json.NewDecoder(rr.Body).Decode(&summary)
+	require.NoError(t, err)
+	require.Equal(t, 3, summary.Unknown)
+	require.Zero(t, summary.Healthy)
+	require.Zero(t, summary.Error)
+	require.Zero(t, summary.Syncing)
+	require.Zero(t, summary.Paused)
+}
diff --git a/api/http/handler/gitops/sources/types.go b/api/http/handler/gitops/sources/types.go
new file mode 100644
index 0000000..ec401bf
--- /dev/null
+++ b/api/http/handler/gitops/sources/types.go
@@ -0,0 +1,51 @@
+package sources
+
+import (
+	"fmt"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/gitops/workflows"
+)
+
+// Source represents a unique git repository used as a GitOps source across one or more workflows.
+type Source struct {
+	ID           portainer.SourceID `json:"id" validate:"required"`
+	Name         string             `json:"name" validate:"required"`
+	Type         SourceType         `json:"type" validate:"required"`
+	URL          string             `json:"url" validate:"required"`
+	Status       workflows.Status   `json:"status" validate:"required"`
+	Error        string             `json:"error,omitempty"`
+	UsedBy       int                `json:"usedBy"`
+	Environments int                `json:"environments"`
+	LastSync     int64              `json:"lastSync"`
+}
+
+type SourceType string
+
+const (
+	SourceTypeGit  SourceType = "git"
+	SourceTypeHelm SourceType = "helm"
+	SourceTypeOCI  SourceType = "oci"
+)
+
+func parseSourceType(s string) (SourceType, error) {
+	switch SourceType(s) {
+	case SourceTypeGit, SourceTypeHelm, SourceTypeOCI:
+		return SourceType(s), nil
+	default:
+		return "", fmt.Errorf("invalid source type %q: must be git, helm, or oci", s)
+	}
+}
+
+func sourceTypeString(t portainer.SourceType) SourceType {
+	switch t {
+	case portainer.SourceTypeGit:
+		return SourceTypeGit
+	case portainer.SourceTypeHelm:
+		return SourceTypeHelm
+	case portainer.SourceTypeRegistry:
+		return SourceTypeOCI
+	default:
+		return SourceTypeGit
+	}
+}
diff --git a/api/http/handler/gitops/sources/update_access.go b/api/http/handler/gitops/sources/update_access.go
new file mode 100644
index 0000000..cf59a73
--- /dev/null
+++ b/api/http/handler/gitops/sources/update_access.go
@@ -0,0 +1,103 @@
+package sources
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/dataservices/source"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type SourceAccessUpdatePayload struct {
+	Public bool               `json:"public"`
+	Users  []portainer.UserID `json:"users,omitempty"`
+	Teams  []portainer.TeamID `json:"teams,omitempty"`
+}
+
+// @id GitOpsSourcesUpdateAccess
+// @summary Update a GitOps source's access control
+// @description Updates the access control settings for an existing GitOps source.
+// @description **Access policy**: administrator
+// @tags gitops
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @produce json
+// @param id path int true "Source identifier"
+// @param body body SourceAccessUpdatePayload true "Source access control"
+// @success 200 {object} portainer.Source
+// @failure 400 "Invalid request payload"
+// @failure 403 "Access denied"
+// @failure 404 "Source not found"
+// @failure 500 "Server error"
+// @router /gitops/sources/{id}/access [put]
+func (h *Handler) gitSourceUpdateAccess(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	id, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid source identifier route variable", err)
+	}
+
+	var payload SourceAccessUpdatePayload
+
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	sourceID := portainer.SourceID(id)
+
+	var src *portainer.Source
+
+	if err := h.dataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		var err error
+
+		userContext := source.NewUserContext(securityContext.User, securityContext.UserMemberships)
+		if src, err = tx.Source().Read(userContext, sourceID); err != nil {
+			return err
+		}
+
+		ApplySourceAccessChanges(src, payload)
+
+		return tx.Source().Update(userContext, src.ID, src)
+	}); h.dataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find a source with the specified identifier", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to update source access", err)
+	}
+
+	h.invalidateCache()
+
+	return response.JSON(w, src)
+}
+
+// Validate implements the portainer.Validatable interface
+func (payload *SourceAccessUpdatePayload) Validate(_ *http.Request) error {
+	return nil
+}
+
+// ApplySourceAccessChanges applies the payload access changes to the source in place.
+func ApplySourceAccessChanges(src *portainer.Source, payload SourceAccessUpdatePayload) {
+	src.Public = payload.Public
+
+	if payload.Public {
+		src.AdministratorsOnly = false
+		src.UserAccesses = []portainer.UserID{}
+		src.TeamAccesses = []portainer.TeamID{}
+	} else if len(payload.Users) == 0 && len(payload.Teams) == 0 {
+		src.AdministratorsOnly = true
+		src.UserAccesses = []portainer.UserID{}
+		src.TeamAccesses = []portainer.TeamID{}
+	} else {
+		src.AdministratorsOnly = false
+		src.UserAccesses = payload.Users
+		src.TeamAccesses = payload.Teams
+	}
+}
diff --git a/api/http/handler/gitops/sources/update_git.go b/api/http/handler/gitops/sources/update_git.go
new file mode 100644
index 0000000..106a730
--- /dev/null
+++ b/api/http/handler/gitops/sources/update_git.go
@@ -0,0 +1,187 @@
+package sources
+
+import (
+	"errors"
+	"net/http"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/dataservices/source"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/portainer/portainer/pkg/validate"
+)
+
+var (
+	ErrNotGitSource = errors.New("source is not a Git source")
+)
+
+// GitSourceUpdatePayload holds the parameters for updating a git-backed source
+type GitSourceUpdatePayload struct {
+	Name           *string                         `json:"name"`
+	URL            *string                         `json:"url"`
+	TLSSkipVerify  *bool                           `json:"tlsSkipVerify"`
+	Authentication *GitAuthenticationUpdatePayload `json:"authentication"`
+}
+
+type GitAuthenticationUpdatePayload struct {
+	Username *string `json:"username"`
+	Password *string `json:"password"`
+}
+
+// Validate implements the portainer.Validatable interface
+func (payload *GitSourceUpdatePayload) Validate(_ *http.Request) error {
+	if payload.URL != nil && !validate.IsURL(*payload.URL) {
+		return errors.New("invalid repository URL. Must correspond to a valid URL format")
+	}
+
+	return nil
+}
+
+// @id GitOpsSourcesUpdateGit
+// @summary Update a Git source
+// @description Updates an existing GitOps source backed by a Git repository.
+// @description **Access policy**: authenticated
+// @tags gitops
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @produce json
+// @param id path int true "Source identifier"
+// @param body body GitSourceUpdatePayload true "Git source details"
+// @success 200 {object} portainer.Source
+// @failure 400 "Invalid request payload"
+// @failure 403 "Access denied"
+// @failure 404 "Source not found"
+// @failure 409 "A source with this URL and credentials already exists"
+// @failure 500 "Server error"
+// @router /gitops/sources/{id} [put]
+func (h *Handler) gitSourceUpdate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	id, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid source identifier route variable", err)
+	}
+
+	var payload GitSourceUpdatePayload
+
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	sourceID := portainer.SourceID(id)
+	userContext := source.NewUserContext(securityContext.User, securityContext.UserMemberships)
+
+	var src *portainer.Source
+
+	if err := h.dataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		var err error
+
+		if src, err = tx.Source().Read(userContext, sourceID); err != nil {
+			return err
+		}
+
+		if err := ApplyGitSourceChanges(src, payload); err != nil {
+			return err
+		}
+
+		src.Status = portainer.SourceStatusUnknown
+		src.StatusError = ""
+
+		return tx.Source().Update(userContext, src.ID, src)
+	}); h.dataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find a source with the specified identifier", err)
+	} else if errors.Is(err, ErrNotGitSource) {
+		return httperror.BadRequest("Source is not a Git source", err)
+	} else if errors.Is(err, source.ErrNotEnoughPermission) {
+		return httperror.Forbidden("Not enough permissions to update source", err)
+	} else if errors.Is(err, source.ErrDuplicateSource) {
+		return httperror.Conflict("A source with this URL and credentials already exists", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to update source", err)
+	}
+
+	if src, err = h.testAndSaveSourceConnection(r.Context(), userContext, src); err != nil {
+		return httperror.InternalServerError("Unable to persist source status", err)
+	}
+
+	h.invalidateCache()
+
+	src.Git = gittypes.SanitizeGitSource(src.Git)
+
+	return response.JSON(w, src)
+}
+
+// ApplyGitSourceChanges applies the payload changes to the source in place
+func ApplyGitSourceChanges(src *portainer.Source, payload GitSourceUpdatePayload) error {
+	if err := ApplyBaseGitSourceChanges(src, payload); err != nil {
+		return err
+	}
+
+	if payload.Authentication == nil {
+		return nil
+	}
+
+	if *payload.Authentication == (GitAuthenticationUpdatePayload{}) {
+		src.Git.Authentication = nil
+		return nil
+	}
+
+	src.Git.Authentication = ApplyAuthChanges(src.Git.Authentication, *payload.Authentication)
+
+	return nil
+}
+
+// ApplyBaseGitSourceChanges applies the non-authentication field changes (name,
+// URL, reference, TLS) to the source in place, ensuring src.Git is set
+func ApplyBaseGitSourceChanges(src *portainer.Source, payload GitSourceUpdatePayload) error {
+	if src.Type != portainer.SourceTypeGit {
+		return ErrNotGitSource
+	}
+
+	if payload.Name != nil && strings.TrimSpace(*payload.Name) != "" {
+		src.Name = *payload.Name
+	}
+
+	if src.Git == nil {
+		src.Git = &gittypes.GitSource{}
+	}
+
+	if payload.URL != nil {
+		src.Git.URL = *payload.URL
+	}
+
+	if payload.TLSSkipVerify != nil {
+		src.Git.TLSSkipVerify = *payload.TLSSkipVerify
+	}
+
+	return nil
+}
+
+// ApplyAuthChanges returns a copy of the existing authentication (or a fresh
+// one) with the basic credential changes applied.
+func ApplyAuthChanges(existing *gittypes.GitAuthentication, payload GitAuthenticationUpdatePayload) *gittypes.GitAuthentication {
+	auth := &gittypes.GitAuthentication{}
+	if existing != nil {
+		copied := *existing
+		auth = &copied
+	}
+
+	if payload.Username != nil {
+		auth.Username = *payload.Username
+	}
+
+	if payload.Password != nil {
+		auth.Password = *payload.Password
+	}
+
+	return auth
+}
diff --git a/api/http/handler/gitops/sources/update_git_test.go b/api/http/handler/gitops/sources/update_git_test.go
new file mode 100644
index 0000000..e22cadc
--- /dev/null
+++ b/api/http/handler/gitops/sources/update_git_test.go
@@ -0,0 +1,347 @@
+package sources
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	gittypes "github.com/portainer/portainer/api/git/types"
+
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGitSourceUpdate_Success(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var srcID portainer.SourceID
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		src := &portainer.Source{Name: "old-name", Type: portainer.SourceTypeGit, Git: &gittypes.GitSource{URL: "http://github.com/org/repo"}}
+		err := tx.Source().Create(adminUserContext, src)
+		require.NoError(t, err)
+		srcID = src.ID
+
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	h := newTestHandler(t, store)
+
+	body, err := json.Marshal(GitSourceUpdatePayload{
+		URL:  new("https://github.com/org/new.git"),
+		Name: new("new-name"),
+	})
+	require.NoError(t, err)
+
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildUpdateReq(t, 1, int(srcID), body))
+
+	require.Equal(t, http.StatusOK, rr.Code)
+
+	var src portainer.Source
+	err = json.NewDecoder(rr.Body).Decode(&src)
+	require.NoError(t, err)
+	require.Equal(t, "new-name", src.Name)
+	require.NotNil(t, src.Git)
+	require.Equal(t, "https://github.com/org/new", src.Git.URL)
+}
+
+func TestGitSourceUpdate_PreservesAuthWhenNotProvided(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var srcID portainer.SourceID
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		src := &portainer.Source{
+			Name: "auth-source",
+			Type: portainer.SourceTypeGit,
+			Git: &gittypes.GitSource{
+				URL: "https://github.com/org/repo.git",
+				Authentication: &gittypes.GitAuthentication{
+					Username: "alice",
+					Password: "secret",
+				},
+			},
+		}
+		err := tx.Source().Create(adminUserContext, src)
+		require.NoError(t, err)
+		srcID = src.ID
+
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	h := newTestHandler(t, store)
+
+	body, err := json.Marshal(GitSourceUpdatePayload{
+		URL:  new("https://github.com/org/repo.git"),
+		Name: new("renamed"),
+	})
+	require.NoError(t, err)
+
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildUpdateReq(t, 1, int(srcID), body))
+
+	require.Equal(t, http.StatusOK, rr.Code)
+
+	var stored *portainer.Source
+	require.NoError(t, store.ViewTx(func(tx dataservices.DataStoreTx) error {
+		var err error
+		stored, err = tx.Source().Read(adminUserContext, srcID)
+		return err
+	}))
+	require.NotNil(t, stored.Git)
+	require.NotNil(t, stored.Git.Authentication)
+	require.Equal(t, "alice", stored.Git.Authentication.Username)
+	require.Equal(t, "secret", stored.Git.Authentication.Password)
+}
+
+func TestGitSourceUpdate_ClearsAuthWhenRequested(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var srcID portainer.SourceID
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		src := &portainer.Source{
+			Name: "auth-source",
+			Type: portainer.SourceTypeGit,
+			Git: &gittypes.GitSource{
+				URL: "https://github.com/org/repo.git",
+				Authentication: &gittypes.GitAuthentication{
+					Username: "alice",
+					Password: "secret",
+				},
+			},
+		}
+		err := tx.Source().Create(adminUserContext, src)
+		require.NoError(t, err)
+		srcID = src.ID
+
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	h := newTestHandler(t, store)
+
+	body, err := json.Marshal(GitSourceUpdatePayload{
+		URL:            new("https://github.com/org/repo.git"),
+		Authentication: &GitAuthenticationUpdatePayload{},
+	})
+	require.NoError(t, err)
+
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildUpdateReq(t, 1, int(srcID), body))
+
+	require.Equal(t, http.StatusOK, rr.Code)
+
+	var stored *portainer.Source
+	require.NoError(t, store.ViewTx(func(tx dataservices.DataStoreTx) error {
+		var err error
+		stored, err = tx.Source().Read(adminUserContext, srcID)
+		return err
+	}))
+	require.NotNil(t, stored.Git)
+	require.Nil(t, stored.Git.Authentication)
+}
+
+func TestGitSourceUpdate_ReplacesAuthWhenProvided(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var srcID portainer.SourceID
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		src := &portainer.Source{
+			Name: "auth-source",
+			Type: portainer.SourceTypeGit,
+			Git: &gittypes.GitSource{
+				URL: "https://github.com/org/repo.git",
+				Authentication: &gittypes.GitAuthentication{
+					Username: "alice",
+					Password: "secret",
+				},
+			},
+		}
+		err := tx.Source().Create(adminUserContext, src)
+		require.NoError(t, err)
+		srcID = src.ID
+
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	h := newTestHandler(t, store)
+
+	body, err := json.Marshal(GitSourceUpdatePayload{
+		URL: new("https://github.com/org/repo.git"),
+		Authentication: &GitAuthenticationUpdatePayload{
+			Username: new("bob"),
+			Password: new("new-secret"),
+		},
+	})
+	require.NoError(t, err)
+
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildUpdateReq(t, 1, int(srcID), body))
+
+	require.Equal(t, http.StatusOK, rr.Code)
+
+	var stored *portainer.Source
+	require.NoError(t, store.ViewTx(func(tx dataservices.DataStoreTx) error {
+		var err error
+		stored, err = tx.Source().Read(adminUserContext, srcID)
+		return err
+	}))
+	require.NotNil(t, stored.Git)
+	require.NotNil(t, stored.Git.Authentication)
+	require.Equal(t, "bob", stored.Git.Authentication.Username)
+	require.Equal(t, "new-secret", stored.Git.Authentication.Password)
+}
+
+func TestGitSourceUpdate_NotFound(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	h := newTestHandler(t, store)
+
+	body, err := json.Marshal(GitSourceUpdatePayload{URL: new("https://github.com/org/repo.git")})
+	require.NoError(t, err)
+
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildUpdateReq(t, 1, 99, body))
+
+	require.Equal(t, http.StatusNotFound, rr.Code)
+}
+
+func TestGitSourceUpdate_ConflictOnDuplicateURL(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var srcID portainer.SourceID
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		existing := &portainer.Source{
+			Name: "existing",
+			Type: portainer.SourceTypeGit,
+			Git: &gittypes.GitSource{
+				URL: "https://github.com/org/existing.git",
+			},
+		}
+		err := tx.Source().Create(adminUserContext, existing)
+		require.NoError(t, err)
+
+		src := &portainer.Source{Name: "other", Type: portainer.SourceTypeGit, Git: &gittypes.GitSource{URL: "http://github.com/org/repo"}}
+		err = tx.Source().Create(adminUserContext, src)
+		require.NoError(t, err)
+		srcID = src.ID
+
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	h := newTestHandler(t, store)
+
+	body, err := json.Marshal(GitSourceUpdatePayload{
+		URL: new("https://github.com/org/existing.git"),
+	})
+	require.NoError(t, err)
+
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildUpdateReq(t, 1, int(srcID), body))
+
+	require.Equal(t, http.StatusConflict, rr.Code)
+}
+
+func TestGitSourceUpdate_MalformedJSON(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var srcID portainer.SourceID
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		src := &portainer.Source{Name: "src", Type: portainer.SourceTypeGit, Git: &gittypes.GitSource{URL: "http://github.com/org/repo"}}
+		err := tx.Source().Create(adminUserContext, src)
+		require.NoError(t, err)
+		srcID = src.ID
+
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	h := newTestHandler(t, store)
+
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildUpdateReq(t, 1, int(srcID), []byte("not-valid-json{")))
+
+	require.Equal(t, http.StatusBadRequest, rr.Code)
+}
+
+func TestGitSourceUpdate_ConflictWhenAuthChangesMatchAnotherSource(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var srcID portainer.SourceID
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		existing := &portainer.Source{
+			Name: "existing",
+			Type: portainer.SourceTypeGit,
+			Git: &gittypes.GitSource{
+				URL: "https://github.com/org/repo.git",
+				Authentication: &gittypes.GitAuthentication{
+					Username: "alice",
+					Password: "secret",
+				},
+			},
+		}
+		if err := tx.Source().Create(adminUserContext, existing); err != nil {
+			return err
+		}
+
+		other := &portainer.Source{
+			Name: "other",
+			Type: portainer.SourceTypeGit,
+			Git:  &gittypes.GitSource{URL: "https://github.com/org/repo.git"},
+		}
+		if err := tx.Source().Create(adminUserContext, other); err != nil {
+			return err
+		}
+		srcID = other.ID
+
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	h := newTestHandler(t, store)
+
+	alice := "alice"
+	secret := "secret"
+	body, err := json.Marshal(GitSourceUpdatePayload{
+		Authentication: &GitAuthenticationUpdatePayload{
+			Username: &alice,
+			Password: &secret,
+		},
+	})
+	require.NoError(t, err)
+
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildUpdateReq(t, 1, int(srcID), body))
+	require.Equal(t, http.StatusConflict, rr.Code)
+}
+
+func TestGitSourceUpdate_NonNumericID(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	h := newTestHandler(t, store)
+
+	body, err := json.Marshal(GitSourceUpdatePayload{URL: new("https://github.com/org/repo.git")})
+	require.NoError(t, err)
+
+	req := buildUpdateReqWithRawID(t, 1, "not-a-number", body)
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, req)
+
+	require.Equal(t, http.StatusBadRequest, rr.Code)
+}
diff --git a/api/http/handler/gitops/sources/utils.go b/api/http/handler/gitops/sources/utils.go
new file mode 100644
index 0000000..86aecd4
--- /dev/null
+++ b/api/http/handler/gitops/sources/utils.go
@@ -0,0 +1,43 @@
+package sources
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	ce "github.com/portainer/portainer/api/gitops/workflows"
+)
+
+func (h *Handler) buildSource(src *portainer.Source, stats ce.SourceStats) Source {
+	phase := ce.SourceStatusToPhase(src.Status, src.StatusError)
+
+	url := ""
+	if src.Git != nil {
+		url = gittypes.SanitizeURL(src.Git.URL)
+	}
+
+	return Source{
+		ID:           src.ID,
+		Name:         src.Name,
+		Type:         sourceTypeString(src.Type),
+		URL:          url,
+		Status:       phase.Status,
+		Error:        phase.Error,
+		UsedBy:       stats.WorkflowCount,
+		Environments: len(stats.EndpointIDs),
+		LastSync:     src.LastSync,
+	}
+}
+
+func redactWorkflowCredentials(wfs []ce.Workflow) []ce.Workflow {
+	redacted := make([]ce.Workflow, len(wfs))
+	for i, wf := range wfs {
+		redacted[i] = wf
+		if wf.GitConfig != nil && wf.GitConfig.Authentication != nil {
+			cfg := *wf.GitConfig
+			auth := *wf.GitConfig.Authentication
+			auth.Password = ""
+			cfg.Authentication = &auth
+			redacted[i].GitConfig = &cfg
+		}
+	}
+	return redacted
+}
diff --git a/api/http/handler/gitops/sources/utils_test.go b/api/http/handler/gitops/sources/utils_test.go
new file mode 100644
index 0000000..8bbfb17
--- /dev/null
+++ b/api/http/handler/gitops/sources/utils_test.go
@@ -0,0 +1,82 @@
+package sources
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	ce "github.com/portainer/portainer/api/gitops/workflows"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestRedactWorkflowCredentials(t *testing.T) {
+	t.Parallel()
+
+	t.Run("clears password and preserves username", func(t *testing.T) {
+		t.Parallel()
+		wfs := []ce.Workflow{{GitConfig: &gittypes.RepoConfig{
+			Authentication: &gittypes.GitAuthentication{Username: "user", Password: "s3cr3t"},
+		}}}
+		got := redactWorkflowCredentials(wfs)
+		require.NotNil(t, got[0].GitConfig.Authentication)
+		assert.Equal(t, "user", got[0].GitConfig.Authentication.Username)
+		assert.Empty(t, got[0].GitConfig.Authentication.Password)
+	})
+
+	t.Run("does not mutate the original slice", func(t *testing.T) {
+		t.Parallel()
+		wfs := []ce.Workflow{{GitConfig: &gittypes.RepoConfig{
+			Authentication: &gittypes.GitAuthentication{Password: "s3cr3t"},
+		}}}
+		_ = redactWorkflowCredentials(wfs)
+		assert.Equal(t, "s3cr3t", wfs[0].GitConfig.Authentication.Password)
+	})
+
+	t.Run("nil GitConfig is safe", func(t *testing.T) {
+		t.Parallel()
+		assert.NotPanics(t, func() { redactWorkflowCredentials([]ce.Workflow{{}}) })
+	})
+
+	t.Run("nil Authentication is safe", func(t *testing.T) {
+		t.Parallel()
+		wfs := []ce.Workflow{{GitConfig: &gittypes.RepoConfig{}}}
+		assert.NotPanics(t, func() { redactWorkflowCredentials(wfs) })
+	})
+}
+
+func TestBuildAutoUpdateInfo(t *testing.T) {
+	t.Parallel()
+
+	assert.Nil(t, BuildAutoUpdateInfo(nil))
+	assert.Nil(t, BuildAutoUpdateInfo(&portainer.AutoUpdateSettings{}))
+
+	got := BuildAutoUpdateInfo(&portainer.AutoUpdateSettings{Interval: "5m"})
+	require.NotNil(t, got)
+	assert.Equal(t, "Interval", got.Mechanism)
+	assert.Equal(t, "5m", got.FetchInterval)
+
+	got = BuildAutoUpdateInfo(&portainer.AutoUpdateSettings{Webhook: "abc123"})
+	require.NotNil(t, got)
+	assert.Equal(t, "Webhook", got.Mechanism)
+	assert.Empty(t, got.FetchInterval)
+}
+
+func TestBuildConnectionInfo(t *testing.T) {
+	t.Parallel()
+
+	assert.Equal(t, connectionInfo{}, buildConnectionInfo(nil))
+
+	cfg := &gittypes.GitSource{
+		TLSSkipVerify:  true,
+		Authentication: &gittypes.GitAuthentication{Username: "user"},
+	}
+	got := buildConnectionInfo(cfg)
+	assert.True(t, got.TLSSkipVerify)
+	require.NotNil(t, got.Authentication)
+	assert.Equal(t, "user", got.Authentication.Username)
+
+	got = buildConnectionInfo(&gittypes.GitSource{})
+	assert.Nil(t, got.Authentication)
+}
diff --git a/api/http/handler/gitops/workflows/fetch.go b/api/http/handler/gitops/workflows/fetch.go
new file mode 100644
index 0000000..a3c054f
--- /dev/null
+++ b/api/http/handler/gitops/workflows/fetch.go
@@ -0,0 +1,219 @@
+package workflows
+
+import (
+	"errors"
+	"fmt"
+	"slices"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/dataservices/source"
+	svc "github.com/portainer/portainer/api/gitops/workflows"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/kubernetes/cli"
+	"github.com/portainer/portainer/api/set"
+
+	"github.com/rs/zerolog/log"
+)
+
+// ErrNotFound indicates a workflow or one of its artifacts is not visible to the requesting user,
+// either because it does not exist or because access has been filtered out.
+var ErrNotFound = errors.New("not found")
+
+// ErrResourceNotAccessible indicates sc cannot access a resource that does exist. Callers
+// resolving a single artifact translate this to ErrNotFound to avoid leaking its existence.
+var ErrResourceNotAccessible = errors.New("resource not accessible")
+
+// fetchWorkflowByID returns the detail view of a single workflow, resolving each of its
+// Artifacts to its backing Stack or EdgeStack and filtering out any the user cannot access.
+// A workflow with zero artifacts to begin with is a valid, visible state and is returned as-is.
+// ErrNotFound is returned when the workflow itself does not exist, or when it had artifacts but
+// every one of them was filtered out (existence-hiding for the common single-artifact case).
+func fetchWorkflowByID(
+	tx dataservices.DataStoreTx,
+	k8sFactory *cli.ClientFactory,
+	sc *security.RestrictedRequestContext,
+	workflowID portainer.WorkflowID,
+) (*WorkflowDetail, error) {
+	wf, err := tx.Workflow().Read(workflowID)
+	if err != nil {
+		return nil, fmt.Errorf("%w: %w", ErrNotFound, err)
+	}
+
+	sourceMap := map[portainer.SourceID]portainer.Source{}
+	if len(wf.Artifacts) > 0 {
+		userContext := source.NewUserContext(sc.User, sc.UserMemberships)
+		sourceMap, err = svc.LoadWorkflowSources(tx, userContext, wf)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	artifacts := make([]svc.ArtifactDetail, 0, len(wf.Artifacts))
+	for _, a := range wf.Artifacts {
+		detail, err := fetchArtifactDetail(tx, k8sFactory, sc, a, sourceMap)
+		if errors.Is(err, ErrNotFound) || errors.Is(err, ErrResourceNotAccessible) {
+			continue
+		}
+		if err != nil {
+			return nil, err
+		}
+		artifacts = append(artifacts, *detail)
+	}
+
+	if len(wf.Artifacts) > 0 && len(artifacts) == 0 {
+		return nil, ErrNotFound
+	}
+
+	return &WorkflowDetail{
+		ID:        int(wf.ID),
+		Name:      wf.Name,
+		Artifacts: artifacts,
+	}, nil
+}
+
+// fetchArtifactDetail resolves a single Artifact to its backing Stack or EdgeStack.
+func fetchArtifactDetail(
+	tx dataservices.DataStoreTx,
+	k8sFactory *cli.ClientFactory,
+	sc *security.RestrictedRequestContext,
+	artifact portainer.Artifact,
+	sourceMap map[portainer.SourceID]portainer.Source,
+) (*svc.ArtifactDetail, error) {
+	switch {
+	case artifact.StackID != 0:
+		stack, err := tx.Stack().Read(artifact.StackID)
+		if tx.IsErrObjectNotFound(err) {
+			return nil, ErrNotFound
+		}
+		if err != nil {
+			return nil, err
+		}
+		return fetchStackArtifact(tx, k8sFactory, sc, *stack, artifact, sourceMap)
+
+	case artifact.EdgeStackID != 0:
+		if !sc.IsAdmin {
+			return nil, ErrResourceNotAccessible
+		}
+		edgeStack, err := tx.EdgeStack().EdgeStack(artifact.EdgeStackID)
+		if tx.IsErrObjectNotFound(err) {
+			return nil, ErrNotFound
+		}
+		if err != nil {
+			return nil, err
+		}
+		return fetchEdgeStackArtifact(tx, *edgeStack, artifact, sourceMap)
+
+	default:
+		return nil, ErrNotFound
+	}
+}
+
+// fetchStackArtifact resolves a stack-backed Artifact, applying the same endpoint/type-match and
+// access checks as FetchWorkflows, scoped to a single stack.
+func fetchStackArtifact(
+	tx dataservices.DataStoreTx,
+	k8sFactory *cli.ClientFactory,
+	sc *security.RestrictedRequestContext,
+	stack portainer.Stack,
+	artifact portainer.Artifact,
+	sourceMap map[portainer.SourceID]portainer.Source,
+) (*svc.ArtifactDetail, error) {
+	endpointMap, err := svc.BuildEndpointMap(tx, []portainer.Stack{stack})
+	if err != nil {
+		return nil, err
+	}
+
+	if err := checkStackAccessible(tx, k8sFactory, sc, stack, endpointMap, artifact, sourceMap); err != nil {
+		return nil, err
+	}
+
+	sourcePhase, artifactPhase := svc.ArtifactPhases(artifact.Files, sourceMap)
+
+	detail := svc.MapStackToArtifactDetail(stack, artifact.Files, sourcePhase, artifactPhase)
+	return &detail, nil
+}
+
+// checkStackAccessible returns ErrResourceNotAccessible if sc cannot access stack, either because
+// its endpoint's Kubernetes namespace/source access is insufficient or because Docker's
+// resource-control-based UAC filters it out.
+func checkStackAccessible(
+	tx dataservices.DataStoreTx,
+	k8sFactory *cli.ClientFactory,
+	sc *security.RestrictedRequestContext,
+	stack portainer.Stack,
+	endpointMap map[portainer.EndpointID]portainer.Endpoint,
+	artifact portainer.Artifact,
+	sourceMap map[portainer.SourceID]portainer.Source,
+) error {
+	if stack.Type != portainer.KubernetesStack {
+		accessible, err := svc.FilterDockerStacksByAccess(tx, []portainer.Stack{stack}, sc)
+		if err != nil {
+			return err
+		}
+
+		if len(accessible) == 0 {
+			return ErrResourceNotAccessible
+		}
+
+		return nil
+	}
+
+	ep, epOk := endpointMap[stack.EndpointID]
+	if !epOk {
+		return ErrResourceNotAccessible
+	}
+
+	access, err := svc.ResolveKubeAccess(k8sFactory, sc, &ep)
+	if err != nil {
+		log.Warn().Err(err).Str("context", "checkStackAccessible").Int("endpoint_id", int(ep.ID)).Msg("Failed to resolve kube access for endpoint, filtering artifact")
+		return ErrResourceNotAccessible
+	}
+
+	if (!access.IsKubeAdmin && !slices.Contains(access.NonAdminNamespaces, stack.Namespace)) || !HasAccessibleSource(artifact.Files, sourceMap) {
+		return ErrResourceNotAccessible
+	}
+
+	return nil
+}
+
+// fetchEdgeStackArtifact resolves an edge-stack-backed Artifact. The caller (fetchArtifactDetail)
+// has already gated access via sc.IsAdmin, so edge stacks are visible to admins only.
+func fetchEdgeStackArtifact(
+	tx dataservices.DataStoreTx,
+	edgeStack portainer.EdgeStack,
+	artifact portainer.Artifact,
+	sourceMap map[portainer.SourceID]portainer.Source,
+) (*svc.ArtifactDetail, error) {
+	statuses, err := tx.EdgeStackStatus().ReadAll(edgeStack.ID)
+	if err != nil {
+		return nil, err
+	}
+
+	groupIDSet := set.ToSet(edgeStack.EdgeGroups)
+	edgeGroups, err := tx.EdgeGroup().ReadAll(func(g portainer.EdgeGroup) bool {
+		return groupIDSet.Contains(g.ID)
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	groupEndpoints, err := svc.BuildGroupEndpoints(tx, edgeGroups)
+	if err != nil {
+		return nil, err
+	}
+
+	sourcePhase, artifactPhase := svc.ArtifactPhases(artifact.Files, sourceMap)
+
+	detail := svc.MapEdgeStackToArtifactDetail(edgeStack, artifact.Files, statuses, groupEndpoints, sourcePhase, artifactPhase)
+	return &detail, nil
+}
+
+// HasAccessibleSource reports whether any of the artifact's files has a source visible in
+// sourceMap.
+func HasAccessibleSource(files []portainer.ArtifactFile, sourceMap map[portainer.SourceID]portainer.Source) bool {
+	return slices.ContainsFunc(files, func(f portainer.ArtifactFile) bool {
+		_, ok := sourceMap[f.SourceID]
+		return ok
+	})
+}
diff --git a/api/http/handler/gitops/workflows/fetch_test.go b/api/http/handler/gitops/workflows/fetch_test.go
new file mode 100644
index 0000000..f4dca87
--- /dev/null
+++ b/api/http/handler/gitops/workflows/fetch_test.go
@@ -0,0 +1,279 @@
+package workflows
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/dataservices/source"
+	"github.com/portainer/portainer/api/datastore"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	ce "github.com/portainer/portainer/api/gitops/workflows"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+
+	"github.com/stretchr/testify/require"
+)
+
+func adminContext() *security.RestrictedRequestContext {
+	return &security.RestrictedRequestContext{
+		IsAdmin: true,
+		UserID:  1,
+		User:    &portainer.User{ID: 1, Role: portainer.AdministratorRole},
+	}
+}
+
+func nonAdminContext() *security.RestrictedRequestContext {
+	return &security.RestrictedRequestContext{
+		IsAdmin: false,
+		UserID:  2,
+		User:    &portainer.User{ID: 2, Role: portainer.StandardUserRole},
+	}
+}
+
+func mustCreateGitWorkflow(t *testing.T, tx dataservices.DataStoreTx, stack *portainer.Stack) {
+	t.Helper()
+
+	cfg := stack.GitConfig
+
+	src := &portainer.Source{Type: portainer.SourceTypeGit, Git: &gittypes.GitSource{URL: cfg.URL, Authentication: cfg.Authentication, TLSSkipVerify: cfg.TLSSkipVerify}}
+	require.NoError(t, tx.Source().Create(source.InsecureNewAdminContext(), src))
+
+	wf := &portainer.Workflow{Artifacts: []portainer.Artifact{{
+		StackID: stack.ID,
+		Files:   []portainer.ArtifactFile{{SourceID: src.ID}},
+	}}}
+	require.NoError(t, tx.Workflow().Create(wf))
+
+	stack.WorkflowID = wf.ID
+	stack.GitConfig = nil
+
+	require.NoError(t, tx.Stack().Create(stack))
+}
+
+func TestFetchWorkflowByID_SingleStackArtifact(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var wfID portainer.WorkflowID
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		stack := &portainer.Stack{ID: 1, Name: "gitops-stack", GitConfig: &gittypes.RepoConfig{URL: "https://github.com/x/repo", ConfigFilePath: "docker-compose.yml"}}
+		mustCreateGitWorkflow(t, tx, stack)
+		wfID = stack.WorkflowID
+
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	var detail *WorkflowDetail
+	require.NoError(t, store.ViewTx(func(tx dataservices.DataStoreTx) error {
+		var err error
+		detail, err = fetchWorkflowByID(tx, nil, adminContext(), wfID)
+		return err
+	}))
+
+	require.Len(t, detail.Artifacts, 1)
+	require.Equal(t, "gitops-stack", detail.Artifacts[0].Name)
+	require.Equal(t, ce.TypeStack, detail.Artifacts[0].Type)
+	require.Len(t, detail.Artifacts[0].Files, 1)
+}
+
+func TestFetchWorkflowByID_EdgeStackArtifact_Admin(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var wfID portainer.WorkflowID
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		wf := &portainer.Workflow{Artifacts: []portainer.Artifact{{EdgeStackID: 1}}}
+		require.NoError(t, tx.Workflow().Create(wf))
+		wfID = wf.ID
+
+		require.NoError(t, tx.EdgeStack().Create(1, &portainer.EdgeStack{ID: 1, Name: "edge-stack"}))
+
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	var detail *WorkflowDetail
+	require.NoError(t, store.ViewTx(func(tx dataservices.DataStoreTx) error {
+		var err error
+		detail, err = fetchWorkflowByID(tx, nil, adminContext(), wfID)
+		return err
+	}))
+
+	require.Len(t, detail.Artifacts, 1)
+	require.Equal(t, "edge-stack", detail.Artifacts[0].Name)
+	require.Equal(t, ce.TypeEdgeStack, detail.Artifacts[0].Type)
+}
+
+func TestFetchWorkflowByID_EdgeStackArtifactFilteredForNonAdmin_SiblingStackSurvives(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var wfID portainer.WorkflowID
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		wf := &portainer.Workflow{Artifacts: []portainer.Artifact{{StackID: 1}, {EdgeStackID: 1}}}
+		require.NoError(t, tx.Workflow().Create(wf))
+		wfID = wf.ID
+
+		require.NoError(t, tx.Stack().Create(&portainer.Stack{ID: 1, Name: "docker-stack", WorkflowID: wf.ID}))
+		require.NoError(t, tx.ResourceControl().Create(&portainer.ResourceControl{
+			ResourceID: stackutils.ResourceControlID(0, "docker-stack"),
+			Type:       portainer.StackResourceControl,
+			Public:     true,
+		}))
+		require.NoError(t, tx.EdgeStack().Create(1, &portainer.EdgeStack{ID: 1, Name: "edge-stack"}))
+
+		require.NoError(t, tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole}))
+		return tx.User().Create(&portainer.User{ID: 2, Role: portainer.StandardUserRole})
+	}))
+
+	var detail *WorkflowDetail
+	require.NoError(t, store.ViewTx(func(tx dataservices.DataStoreTx) error {
+		var err error
+		detail, err = fetchWorkflowByID(tx, nil, nonAdminContext(), wfID)
+		return err
+	}))
+
+	require.Len(t, detail.Artifacts, 1)
+	require.Equal(t, "docker-stack", detail.Artifacts[0].Name)
+}
+
+func TestFetchWorkflowByID_K8sStackWithNoAccessibleSourceIsFiltered(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var wfID portainer.WorkflowID
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		require.NoError(t, tx.Endpoint().Create(&portainer.Endpoint{ID: 1, Type: portainer.KubernetesLocalEnvironment}))
+
+		wf := &portainer.Workflow{Artifacts: []portainer.Artifact{{StackID: 1}}}
+		require.NoError(t, tx.Workflow().Create(wf))
+		wfID = wf.ID
+
+		require.NoError(t, tx.Stack().Create(&portainer.Stack{ID: 1, Name: "k8s-stack", Type: portainer.KubernetesStack, EndpointID: 1, WorkflowID: wf.ID}))
+
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	err := store.ViewTx(func(tx dataservices.DataStoreTx) error {
+		_, err := fetchWorkflowByID(tx, nil, adminContext(), wfID)
+		return err
+	})
+	require.ErrorIs(t, err, ErrNotFound)
+}
+
+func TestFetchWorkflowByID_K8sStackWithAccessibleSourceIsReturned(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var wfID portainer.WorkflowID
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		require.NoError(t, tx.Endpoint().Create(&portainer.Endpoint{ID: 1, Type: portainer.KubernetesLocalEnvironment}))
+
+		src := &portainer.Source{Type: portainer.SourceTypeGit, Git: &gittypes.GitSource{URL: "https://github.com/x/repo"}}
+		require.NoError(t, tx.Source().Create(source.InsecureNewAdminContext(), src))
+
+		wf := &portainer.Workflow{Artifacts: []portainer.Artifact{{
+			StackID: 1,
+			Files:   []portainer.ArtifactFile{{SourceID: src.ID}},
+		}}}
+		require.NoError(t, tx.Workflow().Create(wf))
+		wfID = wf.ID
+
+		require.NoError(t, tx.Stack().Create(&portainer.Stack{ID: 1, Name: "k8s-stack", Type: portainer.KubernetesStack, EndpointID: 1, WorkflowID: wf.ID}))
+
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	var detail *WorkflowDetail
+	require.NoError(t, store.ViewTx(func(tx dataservices.DataStoreTx) error {
+		var err error
+		detail, err = fetchWorkflowByID(tx, nil, adminContext(), wfID)
+		return err
+	}))
+
+	require.Len(t, detail.Artifacts, 1)
+	require.Equal(t, "k8s-stack", detail.Artifacts[0].Name)
+}
+
+func TestFetchWorkflowByID_ZeroArtifactsIsNotAnError(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var wfID portainer.WorkflowID
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		wf := &portainer.Workflow{Name: "empty-workflow"}
+		require.NoError(t, tx.Workflow().Create(wf))
+		wfID = wf.ID
+
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	var detail *WorkflowDetail
+	require.NoError(t, store.ViewTx(func(tx dataservices.DataStoreTx) error {
+		var err error
+		detail, err = fetchWorkflowByID(tx, nil, adminContext(), wfID)
+		return err
+	}))
+
+	require.Equal(t, "empty-workflow", detail.Name)
+	require.Empty(t, detail.Artifacts)
+}
+
+func TestFetchWorkflowByID_AllArtifactsFilteredOutReturnsNotFound(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var wfID portainer.WorkflowID
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		wf := &portainer.Workflow{Artifacts: []portainer.Artifact{{EdgeStackID: 1}}}
+		require.NoError(t, tx.Workflow().Create(wf))
+		wfID = wf.ID
+
+		require.NoError(t, tx.EdgeStack().Create(1, &portainer.EdgeStack{ID: 1, Name: "edge-stack"}))
+
+		return tx.User().Create(&portainer.User{ID: 2, Role: portainer.StandardUserRole})
+	}))
+
+	err := store.ViewTx(func(tx dataservices.DataStoreTx) error {
+		_, err := fetchWorkflowByID(tx, nil, nonAdminContext(), wfID)
+		return err
+	})
+	require.ErrorIs(t, err, ErrNotFound)
+}
+
+func TestFetchWorkflowByID_StaleArtifactReferenceIsFiltered(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var wfID portainer.WorkflowID
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		wf := &portainer.Workflow{Artifacts: []portainer.Artifact{{StackID: 999}}}
+		require.NoError(t, tx.Workflow().Create(wf))
+		wfID = wf.ID
+
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	err := store.ViewTx(func(tx dataservices.DataStoreTx) error {
+		_, err := fetchWorkflowByID(tx, nil, adminContext(), wfID)
+		return err
+	})
+	require.ErrorIs(t, err, ErrNotFound)
+}
+
+func TestFetchWorkflowByID_NotFoundWorkflowID(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	err := store.ViewTx(func(tx dataservices.DataStoreTx) error {
+		_, err := fetchWorkflowByID(tx, nil, adminContext(), 999)
+		return err
+	})
+	require.True(t, store.IsErrObjectNotFound(err))
+	require.ErrorIs(t, err, ErrNotFound)
+
+}
diff --git a/api/http/handler/gitops/workflows/filter_test.go b/api/http/handler/gitops/workflows/filter_test.go
new file mode 100644
index 0000000..544ae9d
--- /dev/null
+++ b/api/http/handler/gitops/workflows/filter_test.go
@@ -0,0 +1,80 @@
+package workflows
+
+import (
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestWorkflowsList_RBAC_NonAdminNoAccess(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	user := &portainer.User{
+		ID:                      1,
+		Username:                "standard",
+		Role:                    portainer.StandardUserRole,
+		PortainerAuthorizations: authorization.DefaultPortainerAuthorizations(),
+	}
+	require.NoError(t, store.User().Create(user))
+
+	require.NoError(t, store.Endpoint().Create(&portainer.Endpoint{ID: 1, Name: "test-env"}))
+
+	// Stack on endpoint 1 WITHOUT resource control — non-admin cannot see it
+	createGitStack(t, store, &portainer.Stack{
+		ID: 1, Name: "no-rc-stack", EndpointID: 1,
+		GitConfig: gitConfig("https://github.com/x/no-rc"),
+	})
+
+	h := NewHandler(store, nil, nil)
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildWorkflowsReq(t, 1, portainer.StandardUserRole, ""))
+
+	items := decodeWorkflows(t, rr)
+	assert.Empty(t, items, "non-admin without resource control access should see no stacks")
+}
+
+func TestWorkflowsList_RBAC_NonAdminWithAccess(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	user := &portainer.User{
+		ID:                      1,
+		Username:                "standard",
+		Role:                    portainer.StandardUserRole,
+		PortainerAuthorizations: authorization.DefaultPortainerAuthorizations(),
+	}
+	require.NoError(t, store.User().Create(user))
+
+	require.NoError(t, store.Endpoint().Create(&portainer.Endpoint{ID: 1, Name: "test-env"}))
+
+	const stackName = "rc-stack"
+	createGitStack(t, store, &portainer.Stack{
+		ID: 1, Name: stackName, EndpointID: 1,
+		GitConfig: gitConfig("https://github.com/x/rc"),
+	})
+
+	require.NoError(t, store.ResourceControl().Create(&portainer.ResourceControl{
+		ID:         1,
+		ResourceID: stackutils.ResourceControlID(1, stackName),
+		Type:       portainer.StackResourceControl,
+		UserAccesses: []portainer.UserResourceAccess{
+			{UserID: 1, AccessLevel: portainer.ReadWriteAccessLevel},
+		},
+	}))
+
+	h := NewHandler(store, nil, nil)
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildWorkflowsReq(t, 1, portainer.StandardUserRole, ""))
+
+	items := decodeWorkflows(t, rr)
+	require.Len(t, items, 1)
+	assert.Equal(t, stackName, items[0].Name)
+}
diff --git a/api/http/handler/gitops/workflows/get.go b/api/http/handler/gitops/workflows/get.go
new file mode 100644
index 0000000..ff05f05
--- /dev/null
+++ b/api/http/handler/gitops/workflows/get.go
@@ -0,0 +1,63 @@
+package workflows
+
+import (
+	"errors"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	svc "github.com/portainer/portainer/api/gitops/workflows"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// WorkflowDetail is the response for GET /gitops/workflows/{id}
+type WorkflowDetail struct {
+	ID        int                  `json:"id" validate:"required"`
+	Name      string               `json:"name" validate:"required"`
+	Artifacts []svc.ArtifactDetail `json:"artifacts,omitempty"`
+}
+
+// @id GitOpsWorkflowGet
+// @summary Get a GitOps workflow by ID
+// @description Returns the detail view of a single GitOps workflow, with one entry per backing
+// @description stack or edge stack artifact.
+// @description **Access policy**: authenticated
+// @tags gitops
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param id path int true "Workflow identifier"
+// @success 200 {object} WorkflowDetail
+// @failure 400 "Invalid request"
+// @failure 404 "Workflow not found"
+// @failure 500 "Server error"
+// @router /gitops/workflows/{id} [get]
+func (h *Handler) get(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	id, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid workflow identifier route variable", err)
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	var detail *WorkflowDetail
+	err = h.dataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
+		var err error
+		detail, err = fetchWorkflowByID(tx, h.k8sFactory, securityContext, portainer.WorkflowID(id))
+		return err
+	})
+
+	if h.dataStore.IsErrObjectNotFound(err) || errors.Is(err, ErrNotFound) {
+		return httperror.NotFound("Workflow not found", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to retrieve workflow", err)
+	}
+
+	return response.JSON(w, detail)
+}
diff --git a/api/http/handler/gitops/workflows/get_test.go b/api/http/handler/gitops/workflows/get_test.go
new file mode 100644
index 0000000..584108a
--- /dev/null
+++ b/api/http/handler/gitops/workflows/get_test.go
@@ -0,0 +1,147 @@
+package workflows
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/dataservices/source"
+	"github.com/portainer/portainer/api/datastore"
+	gittypes "github.com/portainer/portainer/api/git/types"
+
+	"github.com/portainer/portainer/api/http/security"
+
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// buildWorkflowGetReq creates an HTTP GET request for /gitops/workflows/{id} with a
+// security context pre-populated.
+func buildWorkflowGetReq(t *testing.T, userID portainer.UserID, role portainer.UserRole, id string) *http.Request {
+	t.Helper()
+	req := httptest.NewRequest(http.MethodGet, "/gitops/workflows/"+id, nil)
+	ctx := security.StoreTokenData(req, &portainer.TokenData{ID: userID})
+	req = req.WithContext(ctx)
+	ctx = security.StoreRestrictedRequestContext(req, &security.RestrictedRequestContext{
+		UserID:  userID,
+		IsAdmin: security.IsAdminRole(role),
+		User:    &portainer.User{ID: userID, Role: role},
+	})
+	return req.WithContext(ctx)
+}
+
+func decodeWorkflowDetail(t *testing.T, rr *httptest.ResponseRecorder) WorkflowDetail {
+	t.Helper()
+	require.Equal(t, http.StatusOK, rr.Code, "unexpected status: %s", rr.Body.String())
+	var detail WorkflowDetail
+	require.NoError(t, json.NewDecoder(rr.Body).Decode(&detail))
+	return detail
+}
+
+func TestWorkflowGet_MultiFileStackArtifact(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var wfID portainer.WorkflowID
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		src := &portainer.Source{Type: portainer.SourceTypeGit, Git: &gittypes.GitSource{URL: "https://github.com/x/repo"}}
+		require.NoError(t, tx.Source().Create(source.InsecureNewAdminContext(), src))
+
+		wf := &portainer.Workflow{Artifacts: []portainer.Artifact{{
+			StackID: 1,
+			Files: []portainer.ArtifactFile{
+				{SourceID: src.ID, Path: "docker-compose.yml"},
+				{SourceID: src.ID, Path: "override.yml"},
+			},
+		}}}
+		require.NoError(t, tx.Workflow().Create(wf))
+		wfID = wf.ID
+
+		require.NoError(t, tx.Stack().Create(&portainer.Stack{ID: 1, Name: "gitops-stack", WorkflowID: wf.ID}))
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	h := NewHandler(store, nil, nil)
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildWorkflowGetReq(t, 1, portainer.AdministratorRole, strconv.Itoa(int(wfID))))
+
+	detail := decodeWorkflowDetail(t, rr)
+	assert.Equal(t, int(wfID), detail.ID)
+	require.Len(t, detail.Artifacts, 1)
+	assert.Equal(t, "gitops-stack", detail.Artifacts[0].Name)
+	assert.Len(t, detail.Artifacts[0].Files, 2)
+}
+
+func TestWorkflowGet_ZeroArtifactWorkflowReturnsEmptyArray(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var wfID portainer.WorkflowID
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		wf := &portainer.Workflow{Name: "empty-workflow"}
+		require.NoError(t, tx.Workflow().Create(wf))
+		wfID = wf.ID
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	h := NewHandler(store, nil, nil)
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildWorkflowGetReq(t, 1, portainer.AdministratorRole, strconv.Itoa(int(wfID))))
+
+	detail := decodeWorkflowDetail(t, rr)
+	assert.Equal(t, "empty-workflow", detail.Name)
+	assert.Empty(t, detail.Artifacts)
+}
+
+func TestWorkflowGet_NonexistentWorkflowReturns404(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	h := NewHandler(store, nil, nil)
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildWorkflowGetReq(t, 1, portainer.AdministratorRole, "999"))
+	assert.Equal(t, http.StatusNotFound, rr.Code)
+}
+
+func TestWorkflowGet_AllArtifactsFilteredReturns404(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	var wfID portainer.WorkflowID
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		wf := &portainer.Workflow{Artifacts: []portainer.Artifact{{EdgeStackID: 1}}}
+		require.NoError(t, tx.Workflow().Create(wf))
+		wfID = wf.ID
+
+		require.NoError(t, tx.EdgeStack().Create(1, &portainer.EdgeStack{ID: 1, Name: "edge-stack"}))
+		require.NoError(t, tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole}))
+		return tx.User().Create(&portainer.User{ID: 2, Role: portainer.StandardUserRole})
+	}))
+
+	h := NewHandler(store, nil, nil)
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildWorkflowGetReq(t, 2, portainer.StandardUserRole, strconv.Itoa(int(wfID))))
+	assert.Equal(t, http.StatusNotFound, rr.Code)
+}
+
+func TestWorkflowGet_InvalidIDRouteVar(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	h := NewHandler(store, nil, nil)
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildWorkflowGetReq(t, 1, portainer.AdministratorRole, "not-a-number"))
+	assert.Equal(t, http.StatusBadRequest, rr.Code)
+}
diff --git a/api/http/handler/gitops/workflows/handler.go b/api/http/handler/gitops/workflows/handler.go
new file mode 100644
index 0000000..53adb7d
--- /dev/null
+++ b/api/http/handler/gitops/workflows/handler.go
@@ -0,0 +1,43 @@
+package workflows
+
+import (
+	"net/http"
+	"time"
+
+	gocache "github.com/patrickmn/go-cache"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/kubernetes/cli"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+
+	"github.com/gorilla/mux"
+)
+
+const (
+	cacheTTL             = 30 * time.Second
+	cacheCleanupInterval = 10 * time.Minute
+)
+
+type Handler struct {
+	*mux.Router
+	dataStore  dataservices.DataStore
+	gitService portainer.GitService
+	cache      *gocache.Cache
+	k8sFactory *cli.ClientFactory
+}
+
+func NewHandler(dataStore dataservices.DataStore, gitService portainer.GitService, k8sFactory *cli.ClientFactory) *Handler {
+	h := &Handler{
+		Router:     mux.NewRouter(),
+		dataStore:  dataStore,
+		gitService: gitService,
+		cache:      gocache.New(cacheTTL, cacheCleanupInterval),
+		k8sFactory: k8sFactory,
+	}
+
+	h.Handle("/gitops/workflows", httperror.LoggerHandler(h.list)).Methods(http.MethodGet)
+	h.Handle("/gitops/workflows/summary", httperror.LoggerHandler(h.summary)).Methods(http.MethodGet)
+	h.Handle("/gitops/workflows/{id}", httperror.LoggerHandler(h.get)).Methods(http.MethodGet)
+
+	return h
+}
diff --git a/api/http/handler/gitops/workflows/helpers_test.go b/api/http/handler/gitops/workflows/helpers_test.go
new file mode 100644
index 0000000..7631bfd
--- /dev/null
+++ b/api/http/handler/gitops/workflows/helpers_test.go
@@ -0,0 +1,75 @@
+package workflows
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/dataservices/source"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	ce "github.com/portainer/portainer/api/gitops/workflows"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/pkg/fips"
+
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/require"
+)
+
+func init() {
+	fips.InitFIPS(false)
+}
+
+// buildWorkflowsReq creates an HTTP GET request with security context pre-populated.
+func buildWorkflowsReq(t *testing.T, userID portainer.UserID, role portainer.UserRole, query string) *http.Request {
+	t.Helper()
+	req := httptest.NewRequest(http.MethodGet, "/gitops/workflows?"+query, nil)
+	ctx := security.StoreTokenData(req, &portainer.TokenData{ID: userID})
+	req = req.WithContext(ctx)
+	ctx = security.StoreRestrictedRequestContext(req, &security.RestrictedRequestContext{
+		UserID:  userID,
+		IsAdmin: security.IsAdminRole(role),
+		User:    &portainer.User{ID: userID, Role: role},
+	})
+	return req.WithContext(ctx)
+}
+
+// decodeWorkflows decodes a 200 JSON response into a slice of ce.Workflow.
+func decodeWorkflows(t *testing.T, rr *httptest.ResponseRecorder) []ce.Workflow {
+	t.Helper()
+	require.Equal(t, http.StatusOK, rr.Code, "unexpected status: %s", rr.Body.String())
+	var items []ce.Workflow
+	require.NoError(t, json.NewDecoder(rr.Body).Decode(&items))
+	return items
+}
+
+// gitConfig is a convenience constructor for test RepoConfigs.
+func gitConfig(url string) *gittypes.RepoConfig {
+	return &gittypes.RepoConfig{URL: url, ConfigFilePath: "docker-compose.yml"}
+}
+
+// createGitStack creates Source, Workflow, and Stack records with WorkflowID properly wired.
+func createGitStack(t *testing.T, tx dataservices.DataStoreTx, stack *portainer.Stack) {
+	t.Helper()
+
+	if stack.GitConfig != nil {
+		src := &portainer.Source{Git: &gittypes.GitSource{URL: stack.GitConfig.URL, Authentication: stack.GitConfig.Authentication, TLSSkipVerify: stack.GitConfig.TLSSkipVerify}, Type: portainer.SourceTypeGit}
+		require.NoError(t, tx.Source().Create(source.InsecureNewAdminContext(), src))
+
+		wf := &portainer.Workflow{Artifacts: []portainer.Artifact{{
+			StackID: stack.ID,
+			Files: []portainer.ArtifactFile{{
+				SourceID: src.ID,
+				Path:     stack.GitConfig.ConfigFilePath,
+				Ref:      stack.GitConfig.ReferenceName,
+				Hash:     stack.GitConfig.ConfigHash,
+			}},
+		}}}
+		require.NoError(t, tx.Workflow().Create(wf))
+
+		stack.WorkflowID = wf.ID
+	}
+
+	require.NoError(t, tx.Stack().Create(stack))
+}
diff --git a/api/http/handler/gitops/workflows/list.go b/api/http/handler/gitops/workflows/list.go
new file mode 100644
index 0000000..c425cec
--- /dev/null
+++ b/api/http/handler/gitops/workflows/list.go
@@ -0,0 +1,160 @@
+package workflows
+
+import (
+	"cmp"
+	"context"
+	"net/http"
+	"slices"
+	"strconv"
+	"strings"
+
+	gocache "github.com/patrickmn/go-cache"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	svc "github.com/portainer/portainer/api/gitops/workflows"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/http/utils/filters"
+	"github.com/portainer/portainer/api/set"
+	"github.com/portainer/portainer/api/slicesx"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id GitOpsWorkflowsList
+// @summary List all GitOps workflows
+// @description Returns a unified list of all stacks that have GitOps (GitConfig) configured.
+// @description **Access policy**: authenticated
+// @tags gitops
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param search      query string  false "Search term (matches name or repository URL)"
+// @param sort        query string  false "Sort field: name | type | status | creationDate | lastSyncDate"
+// @param order       query string  false "Sort order: asc or desc"
+// @param start       query int     false "Pagination start index"
+// @param limit       query int     false "Pagination limit (0 = unlimited)"
+// @param endpointIds query []int   false "Filter by environment IDs (e.g. endpointIds[]=1&endpointIds[]=2)"
+// @param status      query string  false "Filter by status: healthy | syncing | error | paused | unknown"
+// @param type        query string  false "Filter by type: stack"
+// @param platform    query string  false "Filter by platform: dockerStandalone | dockerSwarm | kubernetes"
+// @success 200 {array} svc.Workflow
+// @failure 500 "Server error"
+// @router /gitops/workflows [get]
+func (h *Handler) list(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	params := filters.ExtractListModifiersQueryParams(r)
+
+	endpointIDs, err := request.RetrieveNumberArrayQueryParameter[portainer.EndpointID](r, "endpointIds")
+	if err != nil {
+		return httperror.BadRequest("Invalid endpointIds parameter", err)
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	key := cacheKey(securityContext, endpointIDs)
+
+	items, err := h.getWorkflows(r.Context(), key, securityContext, endpointIDs)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve workflows", err)
+	}
+
+	if status, _ := request.RetrieveQueryParameter(r, "status", true); status != "" {
+		s, err := svc.ParseStatus(status)
+		if err != nil {
+			return httperror.BadRequest("Invalid status parameter", err)
+		}
+		items = slicesx.FilterInPlace(items, func(i svc.Workflow) bool { return svc.EffectiveStatus(i) == s })
+	}
+
+	if workflowType, _ := request.RetrieveQueryParameter(r, "type", true); workflowType != "" {
+		t, err := svc.ParseType(workflowType)
+		if err != nil {
+			return httperror.BadRequest("Invalid type parameter", err)
+		}
+		items = slicesx.FilterInPlace(items, func(i svc.Workflow) bool { return i.Type == t })
+	}
+
+	if platform, _ := request.RetrieveQueryParameter(r, "platform", true); platform != "" {
+		p, err := svc.ParsePlatform(platform)
+		if err != nil {
+			return httperror.BadRequest("Invalid platform parameter", err)
+		}
+		items = slicesx.FilterInPlace(items, func(i svc.Workflow) bool { return i.Platform == p })
+	}
+
+	results := filters.SearchOrderAndPaginate(items, params, filters.Config[svc.Workflow]{
+		SearchAccessors: []filters.SearchAccessor[svc.Workflow]{
+			func(i svc.Workflow) (string, error) { return i.Name, nil },
+			func(i svc.Workflow) (string, error) {
+				if i.GitConfig == nil {
+					return "", nil
+				}
+				return i.GitConfig.URL, nil
+			},
+		},
+		SortBindings: []filters.SortBinding[svc.Workflow]{
+			{Key: "name", Fn: func(a, b svc.Workflow) int { return strings.Compare(a.Name, b.Name) }},
+			{Key: "type", Fn: func(a, b svc.Workflow) int { return strings.Compare(string(a.Type), string(b.Type)) }},
+			{Key: "status", Fn: func(a, b svc.Workflow) int {
+				return strings.Compare(string(svc.EffectiveStatus(a)), string(svc.EffectiveStatus(b)))
+			}},
+			{Key: "creationDate", Fn: func(a, b svc.Workflow) int { return cmp.Compare(a.CreationDate, b.CreationDate) }},
+			{Key: "lastSyncDate", Fn: func(a, b svc.Workflow) int { return cmp.Compare(a.LastSyncDate, b.LastSyncDate) }, NullsLast: func(i svc.Workflow) bool { return i.LastSyncDate == 0 }},
+			{Key: "platform", Fn: func(a, b svc.Workflow) int { return strings.Compare(string(a.Platform), string(b.Platform)) }},
+		},
+	})
+
+	filters.ApplyFilterResultsHeaders(&w, results)
+	return response.JSON(w, redactWorkflowCredentials(results.Items))
+}
+
+func redactWorkflowCredentials(items []svc.Workflow) []svc.Workflow {
+	for i := range items {
+		if items[i].GitConfig != nil && items[i].GitConfig.Authentication != nil {
+			gc := *items[i].GitConfig
+			auth := *gc.Authentication
+			auth.Password = ""
+			gc.Authentication = &auth
+			items[i].GitConfig = &gc
+		}
+	}
+	return items
+}
+
+func (h *Handler) getWorkflows(ctx context.Context, key string, sc *security.RestrictedRequestContext, endpointIDs []portainer.EndpointID) ([]svc.Workflow, error) {
+	if cached, ok := h.cache.Get(key); ok {
+		return slices.Clone(cached.([]svc.Workflow)), nil
+	}
+
+	var result []svc.Workflow
+	err := h.dataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
+		var err error
+		result, err = svc.FetchWorkflows(tx, h.k8sFactory, sc, set.ToSet(endpointIDs))
+		return err
+	})
+	if err != nil {
+		return nil, err
+	}
+	h.cache.Set(key, result, gocache.DefaultExpiration)
+
+	return slices.Clone(result), nil
+}
+
+func cacheKey(sc *security.RestrictedRequestContext, endpointIDs []portainer.EndpointID) string {
+	ids := make([]string, len(endpointIDs))
+	for i, id := range endpointIDs {
+		ids[i] = strconv.Itoa(int(id))
+	}
+	slices.Sort(ids)
+
+	teamIDs := make([]string, len(sc.UserMemberships))
+	for i, membership := range sc.UserMemberships {
+		teamIDs[i] = strconv.Itoa(int(membership.TeamID))
+	}
+	slices.Sort(teamIDs)
+
+	return strconv.Itoa(int(sc.UserID)) + ":" + strconv.FormatBool(sc.IsAdmin) + ":" + strings.Join(ids, ",") + ":" + strings.Join(teamIDs, ",")
+}
diff --git a/api/http/handler/gitops/workflows/list_test.go b/api/http/handler/gitops/workflows/list_test.go
new file mode 100644
index 0000000..59bc530
--- /dev/null
+++ b/api/http/handler/gitops/workflows/list_test.go
@@ -0,0 +1,384 @@
+package workflows
+
+import (
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	ce "github.com/portainer/portainer/api/gitops/workflows"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestWorkflowsList_GitConfigFilter(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		createGitStack(t, tx, &portainer.Stack{
+			ID: 1, Name: "gitops-stack",
+			GitConfig: gitConfig("https://github.com/example/repo"),
+		})
+		require.NoError(t, tx.Stack().Create(&portainer.Stack{ID: 2, Name: "plain-stack"}))
+		require.NoError(t, tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole}))
+		return nil
+	}))
+
+	h := NewHandler(store, nil, nil)
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildWorkflowsReq(t, 1, portainer.AdministratorRole, ""))
+
+	items := decodeWorkflows(t, rr)
+	require.Len(t, items, 1)
+	assert.Equal(t, "gitops-stack", items[0].Name)
+	assert.Equal(t, ce.TypeStack, items[0].Type)
+	assert.Equal(t, "https://github.com/example/repo", items[0].GitConfig.URL)
+	assert.Equal(t, "docker-compose.yml", items[0].GitConfig.ConfigFilePath)
+}
+
+func TestWorkflowsList_EndpointIDsFilter(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		for i := 1; i <= 3; i++ {
+			createGitStack(t, tx, &portainer.Stack{
+				ID:         portainer.StackID(i),
+				Name:       fmt.Sprintf("env%d-stack", i),
+				EndpointID: portainer.EndpointID(i),
+				GitConfig:  gitConfig(fmt.Sprintf("https://github.com/x/%d", i)),
+			})
+		}
+		require.NoError(t, tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole}))
+		return nil
+	}))
+
+	h := NewHandler(store, nil, nil)
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildWorkflowsReq(t, 1, portainer.AdministratorRole, "endpointIds[]=1&endpointIds[]=2"))
+
+	items := decodeWorkflows(t, rr)
+	require.Len(t, items, 2)
+	names := []string{items[0].Name, items[1].Name}
+	assert.Contains(t, names, "env1-stack")
+	assert.Contains(t, names, "env2-stack")
+}
+
+func TestWorkflowsList_Pagination(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		for i := 1; i <= 5; i++ {
+			createGitStack(t, tx, &portainer.Stack{
+				ID:        portainer.StackID(i),
+				Name:      fmt.Sprintf("stack-%d", i),
+				GitConfig: gitConfig(fmt.Sprintf("https://github.com/x/y-%d", i)),
+			})
+		}
+
+		require.NoError(t, tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole}))
+		return nil
+	}))
+
+	h := NewHandler(store, nil, nil)
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildWorkflowsReq(t, 1, portainer.AdministratorRole, "start=0&limit=2"))
+
+	items := decodeWorkflows(t, rr)
+	assert.Len(t, items, 2)
+	assert.Equal(t, "5", rr.Header().Get("X-Total-Count"))
+}
+
+func TestWorkflowsList_Search(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		for _, s := range []*portainer.Stack{
+			{ID: 1, Name: "alpha", GitConfig: gitConfig("https://github.com/org/alpha")},
+			{ID: 2, Name: "beta", GitConfig: gitConfig("https://github.com/org/beta")},
+		} {
+			createGitStack(t, tx, s)
+		}
+
+		require.NoError(t, tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole}))
+		return nil
+	}))
+
+	h := NewHandler(store, nil, nil)
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildWorkflowsReq(t, 1, portainer.AdministratorRole, "search=alpha"))
+
+	items := decodeWorkflows(t, rr)
+	require.Len(t, items, 1)
+	assert.Equal(t, "alpha", items[0].Name)
+}
+
+func TestWorkflowsList_SearchByURL(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		createGitStack(t, tx, &portainer.Stack{
+			ID: 1, Name: "stack-org1",
+			GitConfig: gitConfig("https://github.com/org1/repo"),
+		})
+		createGitStack(t, tx, &portainer.Stack{
+			ID: 2, Name: "stack-org2",
+			GitConfig: gitConfig("https://github.com/org2/repo"),
+		})
+
+		require.NoError(t, tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole}))
+		return nil
+	}))
+
+	h := NewHandler(store, nil, nil)
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildWorkflowsReq(t, 1, portainer.AdministratorRole, "search=org1"))
+
+	items := decodeWorkflows(t, rr)
+	require.Len(t, items, 1)
+	assert.Equal(t, "stack-org1", items[0].Name)
+}
+
+func TestWorkflowsList_Sort(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		for i, name := range []string{"gamma", "alpha", "beta"} {
+			createGitStack(t, tx, &portainer.Stack{
+				ID:        portainer.StackID(i + 1),
+				Name:      name,
+				GitConfig: gitConfig("https://github.com/x/" + name),
+			})
+		}
+		require.NoError(t, tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole}))
+		return nil
+	}))
+
+	h := NewHandler(store, nil, nil)
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildWorkflowsReq(t, 1, portainer.AdministratorRole, "sort=name&order=desc"))
+
+	items := decodeWorkflows(t, rr)
+	require.Len(t, items, 3)
+	assert.Equal(t, "gamma", items[0].Name)
+	assert.Equal(t, "beta", items[1].Name)
+	assert.Equal(t, "alpha", items[2].Name)
+}
+
+// Uses testing/synctest to control time.Now() without real sleeps.
+// The Handler is created outside the bubble so its go-cache cleanup goroutine
+// does not join the bubble. Inside the bubble all time.Now() calls return
+// fake time, so cache.Set stores a fake expiry and cache.Get compares
+// against the same fake clock — consistent without touching real time.
+
+func TestWorkflowsList_Cache(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		createGitStack(t, tx, &portainer.Stack{
+			ID: 1, Name: "initial-stack",
+			GitConfig: gitConfig("https://github.com/x/initial"),
+		})
+
+		require.NoError(t, tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole}))
+		return nil
+	}))
+
+	// Create the handler outside the bubble so the go-cache cleanup goroutine
+	// is not part of the bubble and does not block synctest.Test from returning.
+	h := NewHandler(store, nil, nil)
+
+	synctest.Test(t, func(t *testing.T) {
+		// First request at fake T=0: populates cache.
+		rr := httptest.NewRecorder()
+		h.ServeHTTP(rr, buildWorkflowsReq(t, 1, portainer.AdministratorRole, ""))
+		require.Len(t, decodeWorkflows(t, rr), 1)
+
+		// Mutate the store while cache is still warm.
+		createGitStack(t, store, &portainer.Stack{
+			ID: 2, Name: "new-stack",
+			GitConfig: gitConfig("https://github.com/x/new"),
+		})
+
+		// Second request — same cache key, should return stale cached result.
+		rr = httptest.NewRecorder()
+		h.ServeHTTP(rr, buildWorkflowsReq(t, 1, portainer.AdministratorRole, ""))
+		assert.Len(t, decodeWorkflows(t, rr), 1, "cache hit: new stack should not appear yet")
+
+		// Advance fake clock past the cache TTL. synctest unblocks immediately
+		// since no other goroutines are in the bubble.
+		time.Sleep(cacheTTL + time.Second)
+
+		// Third request — cache expired, should now fetch fresh data.
+		rr = httptest.NewRecorder()
+		h.ServeHTTP(rr, buildWorkflowsReq(t, 1, portainer.AdministratorRole, ""))
+		assert.Len(t, decodeWorkflows(t, rr), 2, "after TTL expiry: both stacks should appear")
+	})
+}
+
+func TestWorkflowsList_CacheImmutableAfterSort(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	for i, name := range []string{"alpha", "beta", "gamma"} {
+		require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+			createGitStack(t, tx, &portainer.Stack{
+				ID:        portainer.StackID(i + 1),
+				Name:      name,
+				GitConfig: gitConfig("https://github.com/x/" + name),
+			})
+
+			require.NoError(t, tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole}))
+			return nil
+		}))
+	}
+
+	h := NewHandler(store, nil, nil)
+
+	// First request: no sort — cache miss, populates cache as [alpha, beta, gamma].
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildWorkflowsReq(t, 1, portainer.AdministratorRole, ""))
+	items := decodeWorkflows(t, rr)
+	require.Len(t, items, 3)
+	require.Equal(t, "alpha", items[0].Name)
+
+	// Second request: sort desc — cache hit, sorts the shared slice in-place to [gamma, beta, alpha].
+	rr = httptest.NewRecorder()
+	h.ServeHTTP(rr, buildWorkflowsReq(t, 1, portainer.AdministratorRole, "sort=name&order=desc"))
+	items = decodeWorkflows(t, rr)
+	require.Len(t, items, 3)
+	require.Equal(t, "gamma", items[0].Name)
+
+	// Third request: no sort — should still return insertion order [alpha, beta, gamma],
+	// but without a defensive clone the mutated cache returns [gamma, beta, alpha].
+	rr = httptest.NewRecorder()
+	h.ServeHTTP(rr, buildWorkflowsReq(t, 1, portainer.AdministratorRole, ""))
+	items = decodeWorkflows(t, rr)
+	require.Len(t, items, 3)
+	assert.Equal(t, "alpha", items[0].Name, "sort must not mutate the cached slice")
+}
+
+func TestWorkflowsList_CacheSeparateKeys(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		createGitStack(t, tx, &portainer.Stack{
+			ID: 1, Name: "env1-stack", EndpointID: 1,
+			GitConfig: gitConfig("https://github.com/x/1"),
+		})
+		createGitStack(t, tx, &portainer.Stack{
+			ID: 2, Name: "env2-stack", EndpointID: 2,
+			GitConfig: gitConfig("https://github.com/x/2"),
+		})
+		require.NoError(t, tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole}))
+		return nil
+	}))
+
+	h := NewHandler(store, nil, nil)
+
+	rr1 := httptest.NewRecorder()
+	h.ServeHTTP(rr1, buildWorkflowsReq(t, 1, portainer.AdministratorRole, "endpointIds[]=1"))
+	items1 := decodeWorkflows(t, rr1)
+	require.Len(t, items1, 1)
+	assert.Equal(t, "env1-stack", items1[0].Name)
+
+	rr2 := httptest.NewRecorder()
+	h.ServeHTTP(rr2, buildWorkflowsReq(t, 1, portainer.AdministratorRole, "endpointIds[]=2"))
+	items2 := decodeWorkflows(t, rr2)
+	require.Len(t, items2, 1)
+	assert.Equal(t, "env2-stack", items2[0].Name)
+}
+
+func TestWorkflowsList_StatusFilter(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		createGitStack(t, tx, &portainer.Stack{
+			ID: 1, Name: "healthy-stack",
+			GitConfig: gitConfig("https://github.com/x/1"),
+		})
+		createGitStack(t, tx, &portainer.Stack{
+			ID: 2, Name: "error-stack",
+			GitConfig:        gitConfig("https://github.com/x/2"),
+			DeploymentStatus: []portainer.StackDeploymentStatus{{Status: portainer.StackStatusError}},
+		})
+		require.NoError(t, tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole}))
+		return nil
+	}))
+
+	h := NewHandler(store, nil, nil)
+
+	t.Run("status=healthy returns only healthy workflows", func(t *testing.T) {
+		rr := httptest.NewRecorder()
+		h.ServeHTTP(rr, buildWorkflowsReq(t, 1, portainer.AdministratorRole, "status=healthy"))
+		items := decodeWorkflows(t, rr)
+		require.Len(t, items, 1)
+		assert.Equal(t, "healthy-stack", items[0].Name)
+	})
+
+	t.Run("status=error returns only error workflows", func(t *testing.T) {
+		rr := httptest.NewRecorder()
+		h.ServeHTTP(rr, buildWorkflowsReq(t, 1, portainer.AdministratorRole, "status=error"))
+		items := decodeWorkflows(t, rr)
+		require.Len(t, items, 1)
+		assert.Equal(t, "error-stack", items[0].Name)
+	})
+}
+
+func TestWorkflowsList_InvalidFilterParams(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+	require.NoError(t, store.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole}))
+	h := NewHandler(store, nil, nil)
+
+	for _, query := range []string{"status=garbage", "type=garbage", "platform=garbage"} {
+		t.Run(query, func(t *testing.T) {
+			t.Parallel()
+			rr := httptest.NewRecorder()
+			h.ServeHTTP(rr, buildWorkflowsReq(t, 1, portainer.AdministratorRole, query))
+			assert.Equal(t, http.StatusBadRequest, rr.Code)
+		})
+	}
+}
+
+func TestWorkflowsList_RedactsCredentials(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	cfg := gitConfig("https://github.com/x/secure")
+	cfg.Authentication = &gittypes.GitAuthentication{Username: "user", Password: "s3cr3t"}
+
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		createGitStack(t, tx, &portainer.Stack{
+			ID: 1, Name: "secure-stack", GitConfig: cfg,
+		})
+		require.NoError(t, tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole}))
+		return nil
+	}))
+
+	h := NewHandler(store, nil, nil)
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildWorkflowsReq(t, 1, portainer.AdministratorRole, ""))
+
+	items := decodeWorkflows(t, rr)
+	require.Len(t, items, 1)
+	require.NotNil(t, items[0].GitConfig)
+	require.NotNil(t, items[0].GitConfig.Authentication)
+	assert.Equal(t, "user", items[0].GitConfig.Authentication.Username)
+	assert.Empty(t, items[0].GitConfig.Authentication.Password)
+}
diff --git a/api/http/handler/gitops/workflows/status_test.go b/api/http/handler/gitops/workflows/status_test.go
new file mode 100644
index 0000000..b169c41
--- /dev/null
+++ b/api/http/handler/gitops/workflows/status_test.go
@@ -0,0 +1,84 @@
+package workflows
+
+import (
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	ce "github.com/portainer/portainer/api/gitops/workflows"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestWorkflowsList_StackStatusDerivation(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		name           string
+		deployStatus   []portainer.StackDeploymentStatus
+		expectedStatus ce.Status
+	}{
+		{
+			name:           "no deployment status gives healthy",
+			expectedStatus: ce.StatusHealthy,
+		},
+		{
+			name:           "active gives healthy",
+			deployStatus:   []portainer.StackDeploymentStatus{{Status: portainer.StackStatusActive}},
+			expectedStatus: ce.StatusHealthy,
+		},
+		{
+			name:           "error gives error",
+			deployStatus:   []portainer.StackDeploymentStatus{{Status: portainer.StackStatusError}},
+			expectedStatus: ce.StatusError,
+		},
+		{
+			name:           "deploying gives syncing",
+			deployStatus:   []portainer.StackDeploymentStatus{{Status: portainer.StackStatusDeploying}},
+			expectedStatus: ce.StatusSyncing,
+		},
+		{
+			name:           "inactive gives paused",
+			deployStatus:   []portainer.StackDeploymentStatus{{Status: portainer.StackStatusInactive}},
+			expectedStatus: ce.StatusPaused,
+		},
+		{
+			name: "last entry wins",
+			deployStatus: []portainer.StackDeploymentStatus{
+				{Status: portainer.StackStatusDeploying},
+				{Status: portainer.StackStatusActive},
+			},
+			expectedStatus: ce.StatusHealthy,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			_, store := datastore.MustNewTestStore(t, false, true)
+
+			require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+				createGitStack(t, tx, &portainer.Stack{
+					ID:               1,
+					Name:             "status-stack",
+					DeploymentStatus: tc.deployStatus,
+					GitConfig:        gitConfig("https://github.com/x/y"),
+				})
+
+				require.NoError(t, tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole}))
+				return nil
+			}))
+
+			h := NewHandler(store, nil, nil)
+			rr := httptest.NewRecorder()
+			h.ServeHTTP(rr, buildWorkflowsReq(t, 1, portainer.AdministratorRole, ""))
+
+			items := decodeWorkflows(t, rr)
+			require.Len(t, items, 1)
+			assert.Equal(t, tc.expectedStatus, items[0].Status.Target.Status, tc.name)
+		})
+	}
+}
diff --git a/api/http/handler/gitops/workflows/summary.go b/api/http/handler/gitops/workflows/summary.go
new file mode 100644
index 0000000..b46a77c
--- /dev/null
+++ b/api/http/handler/gitops/workflows/summary.go
@@ -0,0 +1,35 @@
+package workflows
+
+import (
+	"net/http"
+
+	svc "github.com/portainer/portainer/api/gitops/workflows"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id GitOpsWorkflowsSummary
+// @summary Summarize GitOps workflow status counts
+// @description Returns a count of workflows per status across all environments.
+// @description **Access policy**: authenticated
+// @tags gitops
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @success 200 {object} svc.StatusSummary
+// @failure 500 "Server error"
+// @router /gitops/workflows/summary [get]
+func (h *Handler) summary(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	items, err := h.getWorkflows(r.Context(), cacheKey(securityContext, nil), securityContext, nil)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve workflows", err)
+	}
+
+	return response.JSON(w, svc.CountByStatus(items))
+}
diff --git a/api/http/handler/gitops/workflows/summary_test.go b/api/http/handler/gitops/workflows/summary_test.go
new file mode 100644
index 0000000..8a9f0d7
--- /dev/null
+++ b/api/http/handler/gitops/workflows/summary_test.go
@@ -0,0 +1,93 @@
+package workflows
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	ce "github.com/portainer/portainer/api/gitops/workflows"
+	"github.com/portainer/portainer/api/http/security"
+
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/require"
+)
+
+func buildSummaryReq(t *testing.T, userID portainer.UserID, role portainer.UserRole) *http.Request {
+	t.Helper()
+	req := httptest.NewRequest(http.MethodGet, "/gitops/workflows/summary", nil)
+	ctx := security.StoreTokenData(req, &portainer.TokenData{ID: userID})
+	req = req.WithContext(ctx)
+	ctx = security.StoreRestrictedRequestContext(req, &security.RestrictedRequestContext{
+		UserID:  userID,
+		IsAdmin: security.IsAdminRole(role),
+		User:    &portainer.User{ID: userID, Role: role},
+	})
+	return req.WithContext(ctx)
+}
+
+func decodeSummary(t *testing.T, rr *httptest.ResponseRecorder) ce.StatusSummary {
+	t.Helper()
+	require.Equal(t, http.StatusOK, rr.Code, "unexpected status: %s", rr.Body.String())
+	var s ce.StatusSummary
+	require.NoError(t, json.NewDecoder(rr.Body).Decode(&s))
+	return s
+}
+
+func TestWorkflowsSummary_Empty(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	h := NewHandler(store, nil, nil)
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildSummaryReq(t, 1, portainer.AdministratorRole))
+
+	s := decodeSummary(t, rr)
+	require.Equal(t, ce.StatusSummary{}, s)
+}
+
+func TestWorkflowsSummary_CountsHealthyAndError(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	require.NoError(t, store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		// No deployment status, target healthy, effective status = healthy.
+		createGitStack(t, tx, &portainer.Stack{
+			ID: 1, Name: "healthy-stack",
+			GitConfig: gitConfig("https://github.com/x/1"),
+		})
+
+		// Error deployment status, target error, effective status = error.
+		createGitStack(t, tx, &portainer.Stack{
+			ID: 2, Name: "error-stack",
+			GitConfig:        gitConfig("https://github.com/x/2"),
+			DeploymentStatus: []portainer.StackDeploymentStatus{{Status: portainer.StackStatusError}},
+		})
+
+		// Deploying deployment status, target syncing, effective status = syncing.
+		createGitStack(t, tx, &portainer.Stack{
+			ID: 3, Name: "syncing-stack",
+			GitConfig:        gitConfig("https://github.com/x/3"),
+			DeploymentStatus: []portainer.StackDeploymentStatus{{Status: portainer.StackStatusDeploying}},
+		})
+
+		return tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole})
+	}))
+
+	h := NewHandler(store, nil, nil)
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, buildSummaryReq(t, 1, portainer.AdministratorRole))
+
+	s := decodeSummary(t, rr)
+	require.Equal(t, 1, s.Healthy)
+	require.Equal(t, 1, s.Error)
+	require.Equal(t, 1, s.Syncing)
+	require.Zero(t, s.Paused)
+	require.Zero(t, s.Unknown)
+}
diff --git a/api/http/handler/handler.go b/api/http/handler/handler.go
new file mode 100644
index 0000000..33d3417
--- /dev/null
+++ b/api/http/handler/handler.go
@@ -0,0 +1,292 @@
+package handler
+
+import (
+	"net/http"
+	"strings"
+
+	"github.com/portainer/portainer/api/http/handler/auth"
+	"github.com/portainer/portainer/api/http/handler/backup"
+	"github.com/portainer/portainer/api/http/handler/customtemplates"
+	"github.com/portainer/portainer/api/http/handler/docker"
+	"github.com/portainer/portainer/api/http/handler/edgegroups"
+	"github.com/portainer/portainer/api/http/handler/edgejobs"
+	"github.com/portainer/portainer/api/http/handler/edgestacks"
+	"github.com/portainer/portainer/api/http/handler/endpointedge"
+	"github.com/portainer/portainer/api/http/handler/endpointgroups"
+	"github.com/portainer/portainer/api/http/handler/endpointproxy"
+	"github.com/portainer/portainer/api/http/handler/endpoints"
+	"github.com/portainer/portainer/api/http/handler/file"
+	"github.com/portainer/portainer/api/http/handler/gitops"
+	"github.com/portainer/portainer/api/http/handler/helm"
+	"github.com/portainer/portainer/api/http/handler/kubernetes"
+	"github.com/portainer/portainer/api/http/handler/ldap"
+	"github.com/portainer/portainer/api/http/handler/motd"
+	"github.com/portainer/portainer/api/http/handler/registries"
+	"github.com/portainer/portainer/api/http/handler/resourcecontrols"
+	"github.com/portainer/portainer/api/http/handler/roles"
+	"github.com/portainer/portainer/api/http/handler/settings"
+	"github.com/portainer/portainer/api/http/handler/ssl"
+	"github.com/portainer/portainer/api/http/handler/stacks"
+	"github.com/portainer/portainer/api/http/handler/storybook"
+	"github.com/portainer/portainer/api/http/handler/system"
+	"github.com/portainer/portainer/api/http/handler/tags"
+	"github.com/portainer/portainer/api/http/handler/teammemberships"
+	"github.com/portainer/portainer/api/http/handler/teams"
+	"github.com/portainer/portainer/api/http/handler/templates"
+	"github.com/portainer/portainer/api/http/handler/upload"
+	"github.com/portainer/portainer/api/http/handler/users"
+	"github.com/portainer/portainer/api/http/handler/webhooks"
+	"github.com/portainer/portainer/api/http/handler/websocket"
+)
+
+// Handler is a collection of all the service handlers.
+type Handler struct {
+	AuthHandler            *auth.Handler
+	BackupHandler          *backup.Handler
+	CustomTemplatesHandler *customtemplates.Handler
+	DockerHandler          *docker.Handler
+	EdgeGroupsHandler      *edgegroups.Handler
+	EdgeJobsHandler        *edgejobs.Handler
+	EdgeStacksHandler      *edgestacks.Handler
+	EndpointEdgeHandler    *endpointedge.Handler
+	EndpointGroupHandler   *endpointgroups.Handler
+	EndpointHandler        *endpoints.Handler
+	EndpointHelmHandler    *helm.Handler
+	EndpointProxyHandler   *endpointproxy.Handler
+	GitOperationHandler    *gitops.Handler
+	HelmTemplatesHandler   *helm.Handler
+	KubernetesHandler      *kubernetes.Handler
+	FileHandler            *file.Handler
+	LDAPHandler            *ldap.Handler
+	MOTDHandler            *motd.Handler
+	RegistryHandler        *registries.Handler
+	ResourceControlHandler *resourcecontrols.Handler
+	RoleHandler            *roles.Handler
+	SettingsHandler        *settings.Handler
+	SSLHandler             *ssl.Handler
+	StackHandler           *stacks.Handler
+	StorybookHandler       *storybook.Handler
+	SystemHandler          *system.Handler
+	TagHandler             *tags.Handler
+	TeamMembershipHandler  *teammemberships.Handler
+	TeamHandler            *teams.Handler
+	TemplatesHandler       *templates.Handler
+	UploadHandler          *upload.Handler
+	UserHandler            *users.Handler
+	WebSocketHandler       *websocket.Handler
+	WebhookHandler         *webhooks.Handler
+	UserHelmHandler        *helm.Handler
+}
+
+// @title PortainerCE API
+// @version 2.43.0
+// @description.markdown
+// @x-tagGroups [{"name":"Access Control","tags":["auth","roles","team_memberships","teams","users"]},{"name":"Administration","tags":["backup","ldap","motd","settings","status","system","ssl","upload"]},{"name":"Docker","tags":["templates","custom_templates","docker","registries","resource_controls","stacks","webhooks","websocket"]},{"name":"Edge Compute","tags":["edge_agent","edge_groups","edge_jobs","edge","edge_stacks"]},{"name":"Environment Management","tags":["endpoint_groups","endpoints","tags"]},{"name":"GitOps","tags":["gitops"]},{"name":"Kubernetes","tags":["helm","kubernetes"]}]
+// @termsOfService
+
+// @contact.email info@portainer.io
+
+// @license.name zlib
+// @license.url https://github.com/portainer/portainer/blob/develop/LICENSE
+
+// @host
+// @BasePath /api
+// @schemes http https
+
+// @securitydefinitions.apikey ApiKeyAuth
+// @in header
+// @name X-API-KEY
+
+// @securitydefinitions.apikey jwt
+// @in header
+// @name Authorization
+
+// @tag.name auth
+// @tag.description Authenticate against Portainer HTTP API
+// @tag.x-displayName Authentication
+// @tag.name backup
+// @tag.description Manage backups
+// @tag.x-displayName Backup
+// @tag.name custom_templates
+// @tag.description Manage Custom Templates
+// @tag.x-displayName Custom templates
+// @tag.name docker
+// @tag.description Manage Docker resources
+// @tag.x-displayName Docker resources
+// @tag.name edge
+// @tag.description Manage Edge related settings
+// @tag.x-displayName Edge settings
+// @tag.name edge_agent
+// @tag.description Manage an Edge agent
+// @tag.x-displayName Edge agent
+// @tag.name edge_groups
+// @tag.description Manage Edge Groups
+// @tag.x-displayName Edge groups
+// @tag.name edge_jobs
+// @tag.description Manage Edge Jobs
+// @tag.x-displayName Edge jobs
+// @tag.name edge_stacks
+// @tag.description Manage Edge Stacks
+// @tag.x-displayName Edge stacks
+// @tag.name edge_templates
+// @tag.description Manage Edge Templates
+// @tag.x-displayName Edge templates
+// @tag.name endpoint_groups
+// @tag.description Manage environment groups
+// @tag.x-displayName Environment groups
+// @tag.name endpoints
+// @tag.description Manage environments
+// @tag.x-displayName Environments
+// @tag.name gitops
+// @tag.description Operate git repository
+// @tag.x-displayName GitOps
+// @tag.name helm
+// @tag.description Manage Helm charts
+// @tag.x-displayName Helm charts
+// @tag.name kubernetes
+// @tag.description Manage Kubernetes cluster
+// @tag.x-displayName Kubernetes
+// @tag.name ldap
+// @tag.description Manage LDAP settings
+// @tag.x-displayName LDAP
+// @tag.name motd
+// @tag.description Fetch the message of the day
+// @tag.x-displayName Message of the day
+// @tag.name registries
+// @tag.description Manage Docker registries
+// @tag.x-displayName Registries
+// @tag.name resource_controls
+// @tag.description Manage access control on Docker resources
+// @tag.x-displayName Resource controls
+// @tag.name roles
+// @tag.description Manage roles
+// @tag.x-displayName Roles
+// @tag.name settings
+// @tag.description Manage Portainer settings
+// @tag.x-displayName Portainer settings
+// @tag.name ssl
+// @tag.description Manage ssl settings
+// @tag.x-displayName SSL
+// @tag.name stacks
+// @tag.description Manage stacks
+// @tag.x-displayName Stacks
+// @tag.name status
+// @tag.description Information about the Portainer instance
+// @tag.x-displayName Portainer status
+// @tag.name system
+// @tag.description Manage Portainer system
+// @tag.x-displayName Portainer system
+// @tag.name tags
+// @tag.description Manage tags
+// @tag.x-displayName Tags
+// @tag.name team_memberships
+// @tag.description Manage team memberships
+// @tag.x-displayName Team memberships
+// @tag.name teams
+// @tag.description Manage teams
+// @tag.x-displayName Teams
+// @tag.name templates
+// @tag.description Manage App Templates
+// @tag.x-displayName App templates
+// @tag.name upload
+// @tag.description Upload files
+// @tag.x-displayName Upload files
+// @tag.name users
+// @tag.description Manage users
+// @tag.x-displayName Users
+// @tag.name webhooks
+// @tag.description Manage webhooks
+// @tag.x-displayName Webhooks
+// @tag.name websocket
+// @tag.description Create exec sessions using websockets
+// @tag.x-displayName Websocket
+
+// ServeHTTP delegates a request to the appropriate subhandler.
+func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	switch {
+	case strings.HasPrefix(r.URL.Path, "/api/endpoints") && strings.Contains(r.URL.Path, "/edge/"):
+		h.EndpointEdgeHandler.ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/auth"):
+		http.StripPrefix("/api", h.AuthHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/backup"):
+		http.StripPrefix("/api", h.BackupHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/restore"):
+		http.StripPrefix("/api", h.BackupHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/custom_templates"):
+		http.StripPrefix("/api", h.CustomTemplatesHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/edge_stacks"):
+		http.StripPrefix("/api", h.EdgeStacksHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/edge_groups"):
+		http.StripPrefix("/api", h.EdgeGroupsHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/edge_jobs"):
+		http.StripPrefix("/api", h.EdgeJobsHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/endpoint_groups"):
+		http.StripPrefix("/api", h.EndpointGroupHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/kubernetes"):
+		http.StripPrefix("/api", h.KubernetesHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/docker"):
+		http.StripPrefix("/api", h.DockerHandler).ServeHTTP(w, r)
+
+	// Helm subpath under kubernetes -> /api/endpoints/{id}/kubernetes/helm
+	case strings.HasPrefix(r.URL.Path, "/api/endpoints/") && strings.Contains(r.URL.Path, "/kubernetes/helm"):
+		http.StripPrefix("/api/endpoints", h.EndpointHelmHandler).ServeHTTP(w, r)
+
+	case strings.HasPrefix(r.URL.Path, "/api/endpoints"):
+		switch {
+		case strings.Contains(r.URL.Path, "/docker/"):
+			http.StripPrefix("/api/endpoints", h.EndpointProxyHandler).ServeHTTP(w, r)
+		case strings.Contains(r.URL.Path, "/kubernetes/"):
+			http.StripPrefix("/api/endpoints", h.EndpointProxyHandler).ServeHTTP(w, r)
+		case strings.Contains(r.URL.Path, "/azure/"):
+			http.StripPrefix("/api/endpoints", h.EndpointProxyHandler).ServeHTTP(w, r)
+		case strings.Contains(r.URL.Path, "/agent/"):
+			http.StripPrefix("/api/endpoints", h.EndpointProxyHandler).ServeHTTP(w, r)
+		default:
+			http.StripPrefix("/api", h.EndpointHandler).ServeHTTP(w, r)
+		}
+	case strings.HasPrefix(r.URL.Path, "/api/gitops"):
+		http.StripPrefix("/api", h.GitOperationHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/ldap"):
+		http.StripPrefix("/api", h.LDAPHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/motd"):
+		http.StripPrefix("/api", h.MOTDHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/registries"):
+		http.StripPrefix("/api", h.RegistryHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/resource_controls"):
+		http.StripPrefix("/api", h.ResourceControlHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/roles"):
+		http.StripPrefix("/api", h.RoleHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/settings"):
+		http.StripPrefix("/api", h.SettingsHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/stacks"):
+		http.StripPrefix("/api", h.StackHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/status"):
+		http.StripPrefix("/api", h.SystemHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/system"):
+		http.StripPrefix("/api", h.SystemHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/tags"):
+		http.StripPrefix("/api", h.TagHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/templates/helm"):
+		http.StripPrefix("/api", h.HelmTemplatesHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/templates"):
+		http.StripPrefix("/api", h.TemplatesHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/upload"):
+		http.StripPrefix("/api", h.UploadHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/users"):
+		http.StripPrefix("/api", h.UserHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/ssl"):
+		http.StripPrefix("/api", h.SSLHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/teams"):
+		http.StripPrefix("/api", h.TeamHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/team_memberships"):
+		http.StripPrefix("/api", h.TeamMembershipHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/websocket"):
+		http.StripPrefix("/api", h.WebSocketHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/webhooks"):
+		http.StripPrefix("/api", h.WebhookHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/storybook"):
+		http.StripPrefix("/storybook", h.StorybookHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/"):
+		h.FileHandler.ServeHTTP(w, r)
+	}
+}
diff --git a/api/http/handler/helm/handler.go b/api/http/handler/helm/handler.go
new file mode 100644
index 0000000..f7f14a1
--- /dev/null
+++ b/api/http/handler/helm/handler.go
@@ -0,0 +1,130 @@
+package helm
+
+import (
+	"fmt"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/middlewares"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/kubernetes"
+	"github.com/portainer/portainer/pkg/libhelm/options"
+	libhelmtypes "github.com/portainer/portainer/pkg/libhelm/types"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+
+	"github.com/gorilla/mux"
+)
+
+// Handler is the HTTP handler used to handle environment(endpoint) group operations.
+type Handler struct {
+	*mux.Router
+	requestBouncer           security.BouncerService
+	dataStore                dataservices.DataStore
+	jwtService               portainer.JWTService
+	kubeClusterAccessService kubernetes.KubeClusterAccessService
+	kubernetesDeployer       portainer.KubernetesDeployer
+	helmPackageManager       libhelmtypes.HelmPackageManager
+}
+
+// NewHandler creates a handler to manage endpoint group operations.
+func NewHandler(bouncer security.BouncerService, dataStore dataservices.DataStore, jwtService portainer.JWTService, kubernetesDeployer portainer.KubernetesDeployer, helmPackageManager libhelmtypes.HelmPackageManager, kubeClusterAccessService kubernetes.KubeClusterAccessService) *Handler {
+	h := &Handler{
+		Router:                   mux.NewRouter(),
+		requestBouncer:           bouncer,
+		dataStore:                dataStore,
+		jwtService:               jwtService,
+		kubernetesDeployer:       kubernetesDeployer,
+		helmPackageManager:       helmPackageManager,
+		kubeClusterAccessService: kubeClusterAccessService,
+	}
+
+	h.Use(middlewares.WithEndpoint(dataStore.Endpoint(), "id"),
+		bouncer.AuthenticatedAccess)
+
+	// `helm list -o json`
+	h.Handle("/{id}/kubernetes/helm",
+		httperror.LoggerHandler(h.helmList)).Methods(http.MethodGet)
+
+	// `helm delete RELEASE_NAME`
+	h.Handle("/{id}/kubernetes/helm/{release}",
+		httperror.LoggerHandler(h.helmDelete)).Methods(http.MethodDelete)
+
+	// `helm install [NAME] [CHART] flags`
+	h.Handle("/{id}/kubernetes/helm",
+		httperror.LoggerHandler(h.helmInstall)).Methods(http.MethodPost)
+
+	// `helm get all [RELEASE_NAME]`
+	h.Handle("/{id}/kubernetes/helm/{release}",
+		httperror.LoggerHandler(h.helmGet)).Methods(http.MethodGet)
+
+	// `helm history [RELEASE_NAME]`
+	h.Handle("/{id}/kubernetes/helm/{release}/history",
+		httperror.LoggerHandler(h.helmGetHistory)).Methods(http.MethodGet)
+
+	// `helm rollback [RELEASE_NAME] [REVISION]`
+	h.Handle("/{id}/kubernetes/helm/{release}/rollback",
+		httperror.LoggerHandler(h.helmRollback)).Methods(http.MethodPost)
+
+	return h
+}
+
+// NewTemplateHandler creates a template handler to manage environment(endpoint) group operations.
+func NewTemplateHandler(bouncer security.BouncerService, helmPackageManager libhelmtypes.HelmPackageManager) *Handler {
+	h := &Handler{
+		Router:             mux.NewRouter(),
+		helmPackageManager: helmPackageManager,
+		requestBouncer:     bouncer,
+	}
+
+	h.Use(bouncer.AuthenticatedAccess)
+
+	h.Handle("/templates/helm",
+		httperror.LoggerHandler(h.helmRepoSearch)).Methods(http.MethodGet)
+
+	// helm show [COMMAND] [CHART] [REPO] flags
+	h.Handle("/templates/helm/{command:chart|values|readme}",
+		httperror.LoggerHandler(h.helmShow)).Methods(http.MethodGet)
+
+	return h
+}
+
+// getHelmClusterAccess obtains the core k8s cluster access details from request.
+// The cluster access includes the cluster server url, the user's bearer token and the tls certificate.
+// The cluster access is passed in as kube config CLI params to helm.
+func (handler *Handler) getHelmClusterAccess(r *http.Request) (*options.KubernetesClusterAccess, *httperror.HandlerError) {
+	endpoint, err := middlewares.FetchEndpoint(r)
+	if err != nil {
+		return nil, httperror.NotFound("Unable to find an environment on request context", err)
+	}
+
+	tokenData, err := security.RetrieveTokenData(r)
+	if err != nil {
+		return nil, httperror.InternalServerError("Unable to retrieve user authentication token", err)
+	}
+
+	bearerToken, _, err := handler.jwtService.GenerateToken(tokenData)
+	if err != nil {
+		return nil, httperror.Unauthorized("Unauthorized", err)
+	}
+
+	sslSettings, err := handler.dataStore.SSLSettings().Settings()
+	if err != nil {
+		return nil, httperror.InternalServerError("Unable to retrieve settings from the database", err)
+	}
+
+	hostURL := "localhost"
+	if !sslSettings.SelfSigned {
+		hostURL = r.Host
+	}
+
+	kubeConfigInternal := handler.kubeClusterAccessService.GetClusterDetails(hostURL, endpoint.ID, true)
+	return &options.KubernetesClusterAccess{
+		ClusterName:              fmt.Sprintf("%s-%s", "portainer-cluster", endpoint.Name),
+		ContextName:              fmt.Sprintf("%s-%s", "portainer-ctx", endpoint.Name),
+		UserName:                 fmt.Sprintf("%s-%s", "portainer-sa-user", tokenData.Username),
+		ClusterServerURL:         kubeConfigInternal.ClusterServerURL,
+		CertificateAuthorityFile: kubeConfigInternal.CertificateAuthorityFile,
+		AuthToken:                bearerToken,
+	}, nil
+}
diff --git a/api/http/handler/helm/helm_delete.go b/api/http/handler/helm/helm_delete.go
new file mode 100644
index 0000000..f222243
--- /dev/null
+++ b/api/http/handler/helm/helm_delete.go
@@ -0,0 +1,55 @@
+package helm
+
+import (
+	"net/http"
+
+	"github.com/portainer/portainer/pkg/libhelm/options"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id HelmDelete
+// @summary Delete Helm Release
+// @description
+// @description **Access policy**: authenticated
+// @tags helm
+// @security ApiKeyAuth
+// @security jwt
+// @param id path int true "Environment(Endpoint) identifier"
+// @param release path string true "The name of the release/application to uninstall"
+// @param namespace query string false "An optional namespace"
+// @success 204 "Success"
+// @failure 400 "Invalid environment(endpoint) id or bad request"
+// @failure 401 "Unauthorized"
+// @failure 404 "Environment(Endpoint) or ServiceAccount not found"
+// @failure 500 "Server error or helm error"
+// @router /endpoints/{id}/kubernetes/helm/{release} [delete]
+func (handler *Handler) helmDelete(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	release, err := request.RetrieveRouteVariableValue(r, "release")
+	if err != nil {
+		return httperror.BadRequest("No release specified", err)
+	}
+
+	clusterAccess, httperr := handler.getHelmClusterAccess(r)
+	if httperr != nil {
+		return httperr
+	}
+
+	uninstallOpts := options.UninstallOptions{
+		Name:                    release,
+		KubernetesClusterAccess: clusterAccess,
+	}
+
+	q := r.URL.Query()
+	if namespace := q.Get("namespace"); namespace != "" {
+		uninstallOpts.Namespace = namespace
+	}
+
+	err = handler.helmPackageManager.Uninstall(uninstallOpts)
+	if err != nil {
+		return httperror.InternalServerError("Helm returned an error", err)
+	}
+
+	return response.Empty(w)
+}
diff --git a/api/http/handler/helm/helm_delete_test.go b/api/http/handler/helm/helm_delete_test.go
new file mode 100644
index 0000000..cf0e4e3
--- /dev/null
+++ b/api/http/handler/helm/helm_delete_test.go
@@ -0,0 +1,38 @@
+package helm
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+	"github.com/portainer/portainer/pkg/libhelm/options"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_helmDelete(t *testing.T) {
+	is := assert.New(t)
+	h := newTestHelmHandler(t)
+
+	// Install a single chart directly, to be deleted by the handler
+	options := options.InstallOptions{Name: "nginx-1", Chart: "nginx", Namespace: "default"}
+
+	_, err := h.helmPackageManager.Upgrade(options)
+	require.NoError(t, err)
+
+	t.Run("helmDelete succeeds with admin user", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodDelete, "/1/kubernetes/helm/"+options.Name, nil)
+		ctx := security.StoreTokenData(req, &portainer.TokenData{ID: 1, Username: "admin", Role: 1})
+		req = req.WithContext(ctx)
+		testhelpers.AddTestSecurityCookie(req, "Bearer dummytoken")
+
+		rr := httptest.NewRecorder()
+		h.ServeHTTP(rr, req)
+
+		is.Equal(http.StatusNoContent, rr.Code, "Status should be 204")
+	})
+}
diff --git a/api/http/handler/helm/helm_get.go b/api/http/handler/helm/helm_get.go
new file mode 100644
index 0000000..cb58694
--- /dev/null
+++ b/api/http/handler/helm/helm_get.go
@@ -0,0 +1,67 @@
+package helm
+
+import (
+	"net/http"
+
+	"github.com/portainer/portainer/pkg/libhelm/options"
+	_ "github.com/portainer/portainer/pkg/libhelm/release"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id HelmGet
+// @summary Get a helm release
+// @description Get details of a helm release by release name
+// @description **Access policy**: authenticated
+// @tags helm
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment(Endpoint) identifier"
+// @param release path string true "Helm release name"
+// @param namespace query string false "specify an optional namespace"
+// @param showResources query boolean false "show resources of the release"
+// @param revision query int false "specify an optional revision"
+// @success 200 {object} release.Release "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier."
+// @failure 500 "Server error occurred while attempting to retrieve the release."
+// @router /endpoints/{id}/kubernetes/helm/{release} [get]
+func (handler *Handler) helmGet(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	release, err := request.RetrieveRouteVariableValue(r, "release")
+	if err != nil {
+		return httperror.BadRequest("No release specified", err)
+	}
+
+	clusterAccess, httperr := handler.getHelmClusterAccess(r)
+	if httperr != nil {
+		return httperr
+	}
+
+	// build the get options
+	getOpts := options.GetOptions{
+		KubernetesClusterAccess: clusterAccess,
+		Name:                    release,
+	}
+	namespace, _ := request.RetrieveQueryParameter(r, "namespace", true)
+	// optional namespace.  The library defaults to "default"
+	if namespace != "" {
+		getOpts.Namespace = namespace
+	}
+	showResources, _ := request.RetrieveBooleanQueryParameter(r, "showResources", true)
+	getOpts.ShowResources = showResources
+	revision, _ := request.RetrieveNumericQueryParameter(r, "revision", true)
+	// optional revision.  The library defaults to the latest revision if not specified
+	if revision > 0 {
+		getOpts.Revision = revision
+	}
+
+	releases, err := handler.helmPackageManager.Get(getOpts)
+	if err != nil {
+		return httperror.InternalServerError("Helm returned an error", err)
+	}
+
+	return response.JSON(w, releases)
+}
diff --git a/api/http/handler/helm/helm_get_test.go b/api/http/handler/helm/helm_get_test.go
new file mode 100644
index 0000000..555275a
--- /dev/null
+++ b/api/http/handler/helm/helm_get_test.go
@@ -0,0 +1,48 @@
+package helm
+
+import (
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+	"github.com/portainer/portainer/pkg/libhelm/options"
+	"github.com/portainer/portainer/pkg/libhelm/release"
+
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_helmGet(t *testing.T) {
+	is := assert.New(t)
+	h := newTestHelmHandler(t)
+
+	// Install a single chart, to be retrieved by the handler
+	options := options.InstallOptions{Name: "nginx-1", Chart: "nginx", Namespace: "default"}
+
+	_, err := h.helmPackageManager.Upgrade(options)
+	require.NoError(t, err)
+
+	t.Run("helmGet sucessfuly retrieves helm release", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodGet, "/1/kubernetes/helm/"+options.Name+"?namespace="+options.Namespace, nil)
+		ctx := security.StoreTokenData(req, &portainer.TokenData{ID: 1, Username: "admin", Role: 1})
+		req = req.WithContext(ctx)
+		testhelpers.AddTestSecurityCookie(req, "Bearer dummytoken")
+
+		rr := httptest.NewRecorder()
+		h.ServeHTTP(rr, req)
+
+		data := release.Release{}
+		body, err := io.ReadAll(rr.Body)
+		require.NoError(t, err, "ReadAll should not return error")
+
+		err = json.Unmarshal(body, &data)
+		require.NoError(t, err)
+		is.Equal(http.StatusOK, rr.Code, "Status should be 200")
+		is.Equal("nginx-1", data.Name)
+	})
+}
diff --git a/api/http/handler/helm/helm_history.go b/api/http/handler/helm/helm_history.go
new file mode 100644
index 0000000..6a24648
--- /dev/null
+++ b/api/http/handler/helm/helm_history.go
@@ -0,0 +1,58 @@
+package helm
+
+import (
+	"net/http"
+
+	"github.com/portainer/portainer/pkg/libhelm/options"
+	_ "github.com/portainer/portainer/pkg/libhelm/release"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id HelmGetHistory
+// @summary Get a historical list of releases
+// @description Get a historical list of releases by release name
+// @description **Access policy**: authenticated
+// @tags helm
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment(Endpoint) identifier"
+// @param release path string true "Helm release name"
+// @param namespace query string false "specify an optional namespace"
+// @success 200 {array} release.Release "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier."
+// @failure 500 "Server error occurred while attempting to retrieve the historical list of releases."
+// @router /endpoints/{id}/kubernetes/helm/{release}/history [get]
+func (handler *Handler) helmGetHistory(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	release, err := request.RetrieveRouteVariableValue(r, "release")
+	if err != nil {
+		return httperror.BadRequest("No release specified", err)
+	}
+
+	clusterAccess, httperr := handler.getHelmClusterAccess(r)
+	if httperr != nil {
+		return httperr
+	}
+
+	historyOptions := options.HistoryOptions{
+		KubernetesClusterAccess: clusterAccess,
+		Name:                    release,
+	}
+
+	// optional namespace.  The library defaults to "default"
+	namespace, _ := request.RetrieveQueryParameter(r, "namespace", true)
+	if namespace != "" {
+		historyOptions.Namespace = namespace
+	}
+
+	releases, err := handler.helmPackageManager.GetHistory(historyOptions)
+	if err != nil {
+		return httperror.InternalServerError("Helm returned an error", err)
+	}
+
+	return response.JSON(w, releases)
+}
diff --git a/api/http/handler/helm/helm_history_test.go b/api/http/handler/helm/helm_history_test.go
new file mode 100644
index 0000000..f53a5f9
--- /dev/null
+++ b/api/http/handler/helm/helm_history_test.go
@@ -0,0 +1,49 @@
+package helm
+
+import (
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+	"github.com/portainer/portainer/pkg/libhelm/options"
+	"github.com/portainer/portainer/pkg/libhelm/release"
+
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_helmGetHistory(t *testing.T) {
+	is := assert.New(t)
+	h := newTestHelmHandler(t)
+
+	// Install a single chart, to be retrieved by the handler
+	options := options.InstallOptions{Name: "nginx-1", Chart: "nginx", Namespace: "default"}
+
+	_, err := h.helmPackageManager.Upgrade(options)
+	require.NoError(t, err)
+
+	t.Run("helmGetHistory sucessfuly retrieves helm release history", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodGet, "/1/kubernetes/helm/"+options.Name+"/history?namespace="+options.Namespace, nil)
+		ctx := security.StoreTokenData(req, &portainer.TokenData{ID: 1, Username: "admin", Role: 1})
+		req = req.WithContext(ctx)
+		testhelpers.AddTestSecurityCookie(req, "Bearer dummytoken")
+
+		rr := httptest.NewRecorder()
+		h.ServeHTTP(rr, req)
+
+		data := []release.Release{}
+		body, err := io.ReadAll(rr.Body)
+		require.NoError(t, err, "ReadAll should not return error")
+
+		err = json.Unmarshal(body, &data)
+		require.NoError(t, err)
+		is.Equal(http.StatusOK, rr.Code, "Status should be 200")
+		is.Len(data, 1)
+		is.Equal("nginx-1", data[0].Name)
+	})
+}
diff --git a/api/http/handler/helm/helm_install.go b/api/http/handler/helm/helm_install.go
new file mode 100644
index 0000000..1934fa9
--- /dev/null
+++ b/api/http/handler/helm/helm_install.go
@@ -0,0 +1,174 @@
+package helm
+
+import (
+	"fmt"
+	"net/http"
+	"os"
+	"strings"
+
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/kubernetes"
+	"github.com/portainer/portainer/api/kubernetes/validation"
+	"github.com/portainer/portainer/api/logs"
+	"github.com/portainer/portainer/pkg/libhelm/options"
+	"github.com/portainer/portainer/pkg/libhelm/release"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/portainer/portainer/pkg/libhttp/ssrf"
+	"github.com/rs/zerolog/log"
+
+	"github.com/pkg/errors"
+)
+
+type installChartPayload struct {
+	Namespace string `json:"namespace"`
+	Name      string `json:"name"`
+	Chart     string `json:"chart"`
+	Repo      string `json:"repo"`
+	Values    string `json:"values"`
+	Version   string `json:"version"`
+	Atomic    bool   `json:"atomic"`
+}
+
+var errChartNameInvalid = errors.New("invalid chart name. " +
+	"Chart name must consist of lower case alphanumeric characters, '-' or '.'," +
+	" and must start and end with an alphanumeric character",
+)
+
+// @id HelmInstall
+// @summary Install Helm Chart
+// @description
+// @description **Access policy**: authenticated
+// @tags helm
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @produce json
+// @param id path int true "Environment(Endpoint) identifier"
+// @param payload body installChartPayload true "Chart details"
+// @param dryRun query bool false "Dry run"
+// @success 201 {object} release.Release "Created"
+// @failure 400 "Invalid request payload"
+// @failure 401 "Unauthorized"
+// @failure 404 "Environment(Endpoint) or ServiceAccount not found"
+// @failure 500 "Server error"
+// @router /endpoints/{id}/kubernetes/helm [post]
+func (handler *Handler) helmInstall(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	dryRun, err := request.RetrieveBooleanQueryParameter(r, "dryRun", true)
+	if err != nil {
+		return httperror.BadRequest("Invalid dryRun query parameter", err)
+	}
+
+	var payload installChartPayload
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return httperror.BadRequest("Invalid Helm install payload", err)
+	}
+
+	if err := ssrf.CheckURL(r.Context(), payload.Repo); err != nil {
+		return httperror.BadRequest("Repository URL blocked by SSRF policy", err)
+	}
+
+	release, err := handler.installChart(r, payload, dryRun)
+	if err != nil {
+		return httperror.InternalServerError("Unable to install a chart", err)
+	}
+
+	return response.JSONWithStatus(w, release, http.StatusCreated)
+}
+
+func (p *installChartPayload) Validate(_ *http.Request) error {
+	var required []string
+	if p.Repo == "" {
+		required = append(required, "repo")
+	}
+
+	if p.Name == "" {
+		required = append(required, "name")
+	}
+
+	if p.Namespace == "" {
+		required = append(required, "namespace")
+	}
+
+	if p.Chart == "" {
+		required = append(required, "chart")
+	}
+
+	if len(required) > 0 {
+		return fmt.Errorf("required field(s) missing: %s", strings.Join(required, ", "))
+	}
+
+	if err := validation.IsDNS1123Subdomain(p.Name); err != nil {
+		return errChartNameInvalid
+	}
+
+	return nil
+}
+
+func (handler *Handler) installChart(r *http.Request, p installChartPayload, dryRun bool) (*release.Release, error) {
+	clusterAccess, httperr := handler.getHelmClusterAccess(r)
+	if httperr != nil {
+		return nil, httperr.Err
+	}
+
+	tokenData, err := security.RetrieveTokenData(r)
+	if err != nil {
+		return nil, errors.Wrap(err, "unable to retrieve user details from authentication token")
+	}
+
+	var username string
+	if err := handler.dataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
+		user, err := tx.User().Read(tokenData.ID)
+		if err != nil {
+			return errors.Wrap(err, "unable to load user information from the database")
+		}
+		username = user.Username
+		return nil
+	}); err != nil {
+		return nil, err
+	}
+
+	installOpts := options.InstallOptions{
+		Name:                    p.Name,
+		Chart:                   p.Chart,
+		Version:                 p.Version,
+		Namespace:               p.Namespace,
+		Repo:                    p.Repo,
+		Atomic:                  p.Atomic,
+		DryRun:                  dryRun,
+		KubernetesClusterAccess: clusterAccess,
+		HelmAppLabels:           kubernetes.GetHelmAppLabels(p.Name, username),
+	}
+
+	if p.Values != "" {
+		file, err := os.CreateTemp("", "helm-values")
+		if err != nil {
+			return nil, err
+		}
+		defer func() {
+			if err := os.Remove(file.Name()); err != nil {
+				log.Warn().Err(err).Msg("failed to remove temporary helm values file")
+			}
+		}()
+
+		if _, err := file.WriteString(p.Values); err != nil {
+			logs.CloseAndLogErr(file)
+			return nil, err
+		}
+
+		if err := file.Close(); err != nil {
+			return nil, err
+		}
+
+		installOpts.ValuesFile = file.Name()
+	}
+
+	release, err := handler.helmPackageManager.Upgrade(installOpts)
+	if err != nil {
+		return nil, err
+	}
+
+	return release, nil
+}
diff --git a/api/http/handler/helm/helm_install_test.go b/api/http/handler/helm/helm_install_test.go
new file mode 100644
index 0000000..2ce6fb0
--- /dev/null
+++ b/api/http/handler/helm/helm_install_test.go
@@ -0,0 +1,76 @@
+package helm
+
+import (
+	"bytes"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/exec/exectest"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+	"github.com/portainer/portainer/api/jwt"
+	"github.com/portainer/portainer/api/kubernetes"
+	"github.com/portainer/portainer/pkg/libhelm/options"
+	"github.com/portainer/portainer/pkg/libhelm/release"
+	helmtest "github.com/portainer/portainer/pkg/libhelm/test"
+
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func newTestHelmHandler(t *testing.T) *Handler {
+	t.Helper()
+
+	_, store := datastore.MustNewTestStore(t, true, true)
+
+	err := store.Endpoint().Create(&portainer.Endpoint{ID: 1})
+	require.NoError(t, err)
+
+	err = store.User().Create(&portainer.User{Username: "admin", Role: portainer.AdministratorRole})
+	require.NoError(t, err)
+
+	jwtService, err := jwt.NewService("1h", store)
+	require.NoError(t, err)
+
+	kubernetesDeployer := exectest.NewKubernetesDeployer()
+	helmPackageManager := helmtest.NewMockHelmPackageManager()
+	kubeClusterAccessService := kubernetes.NewKubeClusterAccessService("", "", "")
+
+	return NewHandler(testhelpers.NewTestRequestBouncer(), store, jwtService, kubernetesDeployer, helmPackageManager, kubeClusterAccessService)
+}
+
+func Test_helmInstall(t *testing.T) {
+	is := assert.New(t)
+	h := newTestHelmHandler(t)
+
+	// Install a single chart.  We expect to get these values back
+	options := options.InstallOptions{Name: "nginx-1", Chart: "nginx", Namespace: "default", Repo: "https://charts.bitnami.com/bitnami"}
+	optdata, err := json.Marshal(options)
+	require.NoError(t, err)
+
+	t.Run("helmInstall succeeds with admin user", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodPost, "/1/kubernetes/helm", bytes.NewBuffer(optdata))
+		ctx := security.StoreTokenData(req, &portainer.TokenData{ID: 1, Username: "admin", Role: 1})
+		req = req.WithContext(ctx)
+		testhelpers.AddTestSecurityCookie(req, "Bearer dummytoken")
+
+		rr := httptest.NewRecorder()
+		h.ServeHTTP(rr, req)
+
+		is.Equal(http.StatusCreated, rr.Code, "Status should be 201")
+
+		body, err := io.ReadAll(rr.Body)
+		require.NoError(t, err, "ReadAll should not return error")
+
+		resp := release.Release{}
+		err = json.Unmarshal(body, &resp)
+		require.NoError(t, err, "response should be json")
+		is.Equal(options.Name, resp.Name, "Name doesn't match")
+		is.Equal(options.Namespace, resp.Namespace, "Namespace doesn't match")
+	})
+}
diff --git a/api/http/handler/helm/helm_list.go b/api/http/handler/helm/helm_list.go
new file mode 100644
index 0000000..124d010
--- /dev/null
+++ b/api/http/handler/helm/helm_list.go
@@ -0,0 +1,63 @@
+package helm
+
+import (
+	"net/http"
+
+	"github.com/portainer/portainer/pkg/libhelm/options"
+	_ "github.com/portainer/portainer/pkg/libhelm/release"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id HelmList
+// @summary List Helm Releases
+// @description
+// @description **Access policy**: authenticated
+// @tags helm
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param id path int true "Environment(Endpoint) identifier"
+// @param namespace query string false "specify an optional namespace"
+// @param filter query string false "specify an optional filter"
+// @param selector query string false "specify an optional selector"
+// @success 200 {array} release.ReleaseElement "Success"
+// @failure 400 "Invalid environment(endpoint) identifier"
+// @failure 401 "Unauthorized"
+// @failure 404 "Environment(Endpoint) or ServiceAccount not found"
+// @failure 500 "Server error"
+// @router /endpoints/{id}/kubernetes/helm [get]
+func (handler *Handler) helmList(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	clusterAccess, httperr := handler.getHelmClusterAccess(r)
+	if httperr != nil {
+		return httperr
+	}
+
+	listOpts := options.ListOptions{
+		KubernetesClusterAccess: clusterAccess,
+	}
+
+	// optional namespace.  The library defaults to "default"
+	namespace, _ := request.RetrieveQueryParameter(r, "namespace", true)
+	if namespace != "" {
+		listOpts.Namespace = namespace
+	}
+
+	// optional filter
+	if filter, _ := request.RetrieveQueryParameter(r, "filter", true); filter != "" {
+		listOpts.Filter = filter
+	}
+
+	// optional selector
+	if selector, _ := request.RetrieveQueryParameter(r, "selector", true); selector != "" {
+		listOpts.Selector = selector
+	}
+
+	releases, err := handler.helmPackageManager.List(listOpts)
+	if err != nil {
+		return httperror.InternalServerError("Helm returned an error", err)
+	}
+
+	return response.JSON(w, releases)
+}
diff --git a/api/http/handler/helm/helm_list_test.go b/api/http/handler/helm/helm_list_test.go
new file mode 100644
index 0000000..a07b771
--- /dev/null
+++ b/api/http/handler/helm/helm_list_test.go
@@ -0,0 +1,52 @@
+package helm
+
+import (
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+	"github.com/portainer/portainer/pkg/libhelm/options"
+	"github.com/portainer/portainer/pkg/libhelm/release"
+
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_helmList(t *testing.T) {
+	is := assert.New(t)
+	h := newTestHelmHandler(t)
+
+	// Install a single chart.  We expect to get these values back
+	options := options.InstallOptions{Name: "nginx-1", Chart: "nginx", Namespace: "default"}
+
+	_, err := h.helmPackageManager.Upgrade(options)
+	require.NoError(t, err)
+
+	t.Run("helmList", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodGet, "/1/kubernetes/helm", nil)
+		ctx := security.StoreTokenData(req, &portainer.TokenData{ID: 1, Username: "admin", Role: 1})
+		req = req.WithContext(ctx)
+		testhelpers.AddTestSecurityCookie(req, "Bearer dummytoken")
+
+		rr := httptest.NewRecorder()
+		h.ServeHTTP(rr, req)
+
+		is.Equal(http.StatusOK, rr.Code, "Status should be 200 OK")
+
+		body, err := io.ReadAll(rr.Body)
+		require.NoError(t, err, "ReadAll should not return error")
+
+		data := []release.ReleaseElement{}
+		err = json.Unmarshal(body, &data)
+		require.NoError(t, err)
+		if is.Len(data, 1, "Expected one chart entry") {
+			is.Equal(options.Name, data[0].Name, "Name doesn't match")
+			is.Equal(options.Chart, data[0].Chart, "Chart doesn't match")
+		}
+	})
+}
diff --git a/api/http/handler/helm/helm_repo_search.go b/api/http/handler/helm/helm_repo_search.go
new file mode 100644
index 0000000..7f940b0
--- /dev/null
+++ b/api/http/handler/helm/helm_repo_search.go
@@ -0,0 +1,72 @@
+package helm
+
+import (
+	"fmt"
+	"net/http"
+	"net/url"
+
+	"github.com/portainer/portainer/pkg/libhelm/options"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/ssrf"
+	"github.com/rs/zerolog/log"
+
+	"github.com/pkg/errors"
+)
+
+// @id HelmRepoSearch
+// @summary Search Helm Charts
+// @description
+// @description **Access policy**: authenticated
+// @tags helm
+// @param repo query string true "Helm repository URL"
+// @param chart query string false "Helm chart name"
+// @param useCache query string false "If true will use cache to search"
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @success 200 {object} string "Success"
+// @failure 400 "Bad request"
+// @failure 401 "Unauthorized"
+// @failure 404 "Not found"
+// @failure 500 "Server error"
+// @router /templates/helm [get]
+func (handler *Handler) helmRepoSearch(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	repo := r.URL.Query().Get("repo")
+	if repo == "" {
+		return httperror.BadRequest("Bad request", errors.New("missing `repo` query parameter"))
+	}
+
+	chart, _ := request.RetrieveQueryParameter(r, "chart", false)
+	// If true will useCache to search, will always add to cache after
+	useCache, _ := request.RetrieveBooleanQueryParameter(r, "useCache", false)
+
+	_, err := url.ParseRequestURI(repo)
+	if err != nil {
+		return httperror.BadRequest("Bad request", errors.Wrap(err, fmt.Sprintf("provided URL %q is not valid", repo)))
+	}
+
+	if err := ssrf.CheckURL(r.Context(), repo); err != nil {
+		return httperror.BadRequest("Repository URL blocked by SSRF policy", err)
+	}
+
+	searchOpts := options.SearchRepoOptions{
+		Repo:     repo,
+		Chart:    chart,
+		UseCache: useCache,
+	}
+
+	result, err := handler.helmPackageManager.SearchRepo(searchOpts)
+	if err != nil {
+		log.Warn().Err(err).Str("repo", repo).Msg("helm repo search failed")
+		return httperror.InternalServerError("Search failed", errors.New("failed to search Helm repository"))
+	}
+
+	w.Header().Set("Content-Type", "text/plain")
+
+	if _, err := w.Write(result); err != nil {
+		log.Warn().Err(err).Msg("failed to write helm repo search response")
+	}
+
+	return nil
+}
diff --git a/api/http/handler/helm/helm_repo_search_test.go b/api/http/handler/helm/helm_repo_search_test.go
new file mode 100644
index 0000000..f5f653b
--- /dev/null
+++ b/api/http/handler/helm/helm_repo_search_test.go
@@ -0,0 +1,52 @@
+package helm
+
+import (
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+
+	"github.com/portainer/portainer/api/internal/testhelpers"
+	"github.com/portainer/portainer/pkg/libhelm/test"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_helmRepoSearch(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	helmPackageManager := test.NewMockHelmPackageManager()
+	h := NewTemplateHandler(testhelpers.NewTestRequestBouncer(), helmPackageManager)
+
+	assert.NotNil(t, h, "Handler should not fail")
+
+	repos := []string{"https://charts.bitnami.com/bitnami", "https://portainer.github.io/k8s"}
+
+	for _, repo := range repos {
+		t.Run(repo, func(t *testing.T) {
+			repoUrlEncoded := url.QueryEscape(repo)
+			req := httptest.NewRequest(http.MethodGet, "/templates/helm?repo="+repoUrlEncoded, nil)
+			rr := httptest.NewRecorder()
+			h.ServeHTTP(rr, req)
+
+			is.Equal(http.StatusOK, rr.Code, "Status should be 200 OK")
+
+			body, err := io.ReadAll(rr.Body)
+			require.NoError(t, err, "ReadAll should not return error")
+			is.NotEmpty(body, "Body should not be empty")
+		})
+	}
+
+	t.Run("fails on invalid URL", func(t *testing.T) {
+		repo := "abc.com"
+		repoUrlEncoded := url.QueryEscape(repo)
+		req := httptest.NewRequest(http.MethodGet, "/templates/helm?repo="+repoUrlEncoded, nil)
+		rr := httptest.NewRecorder()
+		h.ServeHTTP(rr, req)
+
+		is.Equal(http.StatusBadRequest, rr.Code, "Status should be 400 Bad request")
+	})
+}
diff --git a/api/http/handler/helm/helm_rollback.go b/api/http/handler/helm/helm_rollback.go
new file mode 100644
index 0000000..d98f7a4
--- /dev/null
+++ b/api/http/handler/helm/helm_rollback.go
@@ -0,0 +1,105 @@
+package helm
+
+import (
+	"net/http"
+	"time"
+
+	"github.com/portainer/portainer/pkg/libhelm/options"
+	_ "github.com/portainer/portainer/pkg/libhelm/release"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id HelmRollback
+// @summary Rollback a helm release
+// @description Rollback a helm release to a previous revision
+// @description **Access policy**: authenticated
+// @tags helm
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment(Endpoint) identifier"
+// @param release path string true "Helm release name"
+// @param namespace query string false "specify an optional namespace"
+// @param revision query int false "specify the revision to rollback to (defaults to previous revision if not specified)"
+// @param wait query boolean false "wait for resources to be ready (default: false)"
+// @param waitForJobs query boolean false "wait for jobs to complete before marking the release as successful (default: false)"
+// @param recreate query boolean false "performs pods restart for the resource if applicable (default: true)"
+// @param force query boolean false "force resource update through delete/recreate if needed (default: false)"
+// @param timeout query int false "time to wait for any individual Kubernetes operation in seconds (default: 300)"
+// @success 200 {object} release.Release "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier or release name."
+// @failure 500 "Server error occurred while attempting to rollback the release."
+// @router /endpoints/{id}/kubernetes/helm/{release}/rollback [post]
+func (handler *Handler) helmRollback(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	release, err := request.RetrieveRouteVariableValue(r, "release")
+	if err != nil {
+		return httperror.BadRequest("No release specified", err)
+	}
+
+	clusterAccess, httperr := handler.getHelmClusterAccess(r)
+	if httperr != nil {
+		return httperr
+	}
+
+	// build the rollback options
+	rollbackOpts := options.RollbackOptions{
+		KubernetesClusterAccess: clusterAccess,
+		Name:                    release,
+		// Set default values
+		Recreate: true,            // Default to recreate pods (restart)
+		Timeout:  5 * time.Minute, // Default timeout of 5 minutes
+	}
+
+	namespace, _ := request.RetrieveQueryParameter(r, "namespace", true)
+	// optional namespace. The library defaults to "default"
+	if namespace != "" {
+		rollbackOpts.Namespace = namespace
+	}
+
+	revision, _ := request.RetrieveNumericQueryParameter(r, "revision", true)
+	// optional revision. If not specified, it will rollback to the previous revision
+	if revision > 0 {
+		rollbackOpts.Version = revision
+	}
+
+	// Default for wait is false, only set to true if explicitly requested
+	wait, err := request.RetrieveBooleanQueryParameter(r, "wait", true)
+	if err == nil {
+		rollbackOpts.Wait = wait
+	}
+
+	// Default for waitForJobs is false, only set to true if explicitly requested
+	waitForJobs, err := request.RetrieveBooleanQueryParameter(r, "waitForJobs", true)
+	if err == nil {
+		rollbackOpts.WaitForJobs = waitForJobs
+	}
+
+	// Default for recreate is true (set above), override if specified
+	recreate, err := request.RetrieveBooleanQueryParameter(r, "recreate", true)
+	if err == nil {
+		rollbackOpts.Recreate = recreate
+	}
+
+	// Default for force is false, only set to true if explicitly requested
+	force, err := request.RetrieveBooleanQueryParameter(r, "force", true)
+	if err == nil {
+		rollbackOpts.Force = force
+	}
+
+	timeout, _ := request.RetrieveNumericQueryParameter(r, "timeout", true)
+	// Override default timeout if specified
+	if timeout > 0 {
+		rollbackOpts.Timeout = time.Duration(timeout) * time.Second
+	}
+
+	releaseInfo, err := handler.helmPackageManager.Rollback(rollbackOpts)
+	if err != nil {
+		return httperror.InternalServerError("Failed to rollback helm release", err)
+	}
+
+	return response.JSON(w, releaseInfo)
+}
diff --git a/api/http/handler/helm/helm_show.go b/api/http/handler/helm/helm_show.go
new file mode 100644
index 0000000..1c5860b
--- /dev/null
+++ b/api/http/handler/helm/helm_show.go
@@ -0,0 +1,84 @@
+package helm
+
+import (
+	"fmt"
+	"net/http"
+	"net/url"
+
+	"github.com/portainer/portainer/pkg/libhelm/options"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/ssrf"
+
+	"github.com/pkg/errors"
+	"github.com/rs/zerolog/log"
+)
+
+// @id HelmShow
+// @summary Show Helm Chart Information
+// @description
+// @description **Access policy**: authenticated
+// @tags helm
+// @param repo query string true "Helm repository URL"
+// @param chart query string true "Chart name"
+// @param version query string false "Chart version"
+// @param command path string true "chart/values/readme"
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @produce text/plain
+// @success 200 {object} string "Success"
+// @failure 401 "Unauthorized"
+// @failure 404 "Environment(Endpoint) or ServiceAccount not found"
+// @failure 500 "Server error"
+// @router /templates/helm/{command} [get]
+func (handler *Handler) helmShow(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	repo := r.URL.Query().Get("repo")
+	if repo == "" {
+		return httperror.BadRequest("Bad request", errors.New("missing `repo` query parameter"))
+	}
+	_, err := url.ParseRequestURI(repo)
+	if err != nil {
+		return httperror.BadRequest("Bad request", errors.Wrap(err, fmt.Sprintf("provided URL %q is not valid", repo)))
+	}
+
+	if err := ssrf.CheckURL(r.Context(), repo); err != nil {
+		return httperror.BadRequest("Repository URL blocked by SSRF policy", err)
+	}
+
+	chart := r.URL.Query().Get("chart")
+	if chart == "" {
+		return httperror.BadRequest("Bad request", errors.New("missing `chart` query parameter"))
+	}
+
+	version, err := request.RetrieveQueryParameter(r, "version", true)
+	if err != nil {
+		return httperror.BadRequest("Bad request", errors.Wrap(err, fmt.Sprintf("provided version %q is not valid", version)))
+	}
+
+	cmd, err := request.RetrieveRouteVariableValue(r, "command")
+	if err != nil {
+		cmd = "all"
+		log.Debug().Str("default_command", cmd).Msg("command not provided, using default")
+	}
+
+	showOptions := options.ShowOptions{
+		OutputFormat: options.ShowOutputFormat(cmd),
+		Chart:        chart,
+		Repo:         repo,
+		Version:      version,
+	}
+	result, err := handler.helmPackageManager.Show(showOptions)
+	if err != nil {
+		log.Warn().Err(err).Str("repo", repo).Str("chart", chart).Msg("helm show failed")
+		return httperror.InternalServerError("Unable to show chart", errors.New("failed to retrieve Helm chart information"))
+	}
+
+	w.Header().Set("Content-Type", "text/plain")
+
+	if _, err := w.Write(result); err != nil {
+		log.Warn().Err(err).Msg("failed to write helm show response")
+	}
+
+	return nil
+}
diff --git a/api/http/handler/helm/helm_show_test.go b/api/http/handler/helm/helm_show_test.go
new file mode 100644
index 0000000..bf18449
--- /dev/null
+++ b/api/http/handler/helm/helm_show_test.go
@@ -0,0 +1,50 @@
+package helm
+
+import (
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+
+	"github.com/portainer/portainer/api/internal/testhelpers"
+	"github.com/portainer/portainer/pkg/libhelm/test"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_helmShow(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	helmPackageManager := test.NewMockHelmPackageManager()
+	h := NewTemplateHandler(testhelpers.NewTestRequestBouncer(), helmPackageManager)
+
+	is.NotNil(h, "Handler should not fail")
+
+	commands := map[string]string{
+		"values": test.MockDataValues,
+		"chart":  test.MockDataChart,
+		"readme": test.MockDataReadme,
+	}
+
+	for cmd, expect := range commands {
+		t.Run(cmd, func(t *testing.T) {
+			is.NotNil(h, "Handler should not fail")
+
+			repoUrlEncoded := url.QueryEscape("https://charts.bitnami.com/bitnami")
+			chart := "nginx"
+			req := httptest.NewRequest("GET", fmt.Sprintf("/templates/helm/%s?repo=%s&chart=%s", cmd, repoUrlEncoded, chart), nil)
+			rr := httptest.NewRecorder()
+			h.ServeHTTP(rr, req)
+
+			is.Equal(http.StatusOK, rr.Code, "Status should be 200 OK")
+
+			body, err := io.ReadAll(rr.Body)
+			require.NoError(t, err, "ReadAll should not return error")
+			is.Equal(string(body), expect, "Unexpected search response")
+		})
+	}
+}
diff --git a/api/http/handler/kubernetes/application.go b/api/http/handler/kubernetes/application.go
new file mode 100644
index 0000000..cb67cd7
--- /dev/null
+++ b/api/http/handler/kubernetes/application.go
@@ -0,0 +1,143 @@
+package kubernetes
+
+import (
+	"net/http"
+
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/rs/zerolog/log"
+	k8serrors "k8s.io/apimachinery/pkg/api/errors"
+)
+
+// @id GetApplicationsResources
+// @summary Get the total resource requests and limits of all applications
+// @description Get the total CPU (cores) and memory (bytes) requests and limits of all applications across all namespaces.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment(Endpoint) identifier"
+// @param node query string true "Node name"
+// @success 200 {object} models.K8sApplicationResource "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier."
+// @failure 500 "Server error occurred while attempting to retrieve the total resource requests and limits for all applications from the cluster."
+// @router /kubernetes/{id}/metrics/applications_resources [get]
+func (handler *Handler) getApplicationsResources(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	node, err := request.RetrieveQueryParameter(r, "node", true)
+	if err != nil {
+		log.Error().Err(err).Str("context", "getApplicationsResources").Msg("Unable to parse the namespace query parameter")
+		return httperror.BadRequest("Unable to parse the node query parameter", err)
+	}
+
+	cli, httpErr := handler.prepareKubeClient(r)
+	if httpErr != nil {
+		log.Error().Err(httpErr).Str("context", "getApplicationsResources").Msg("Unable to prepare kube client")
+		return httperror.InternalServerError("Unable to prepare kube client", httpErr)
+	}
+
+	applicationsResources, err := cli.GetApplicationsResource("", node)
+	if err != nil {
+		if k8serrors.IsUnauthorized(err) {
+			log.Error().Err(err).Str("context", "getApplicationsResources").Msg("Unable to get the total resource requests and limits for all applications in the namespace")
+			return httperror.Unauthorized("Unable to get the total resource requests and limits for all applications in the namespace", err)
+		}
+
+		if k8serrors.IsForbidden(err) {
+			log.Error().Err(err).Str("context", "getApplicationsResources").Msg("Unable to get the total resource requests and limits for all applications in the namespace")
+			return httperror.Forbidden("Unable to get the total resource requests and limits for all applications in the namespace", err)
+		}
+
+		log.Error().Err(err).Str("context", "getApplicationsResources").Msg("Unable to calculate the total resource requests and limits for all applications in the namespace")
+		return httperror.InternalServerError("Unable to calculate the total resource requests and limits for all applications in the namespace", err)
+	}
+
+	return response.JSON(w, applicationsResources)
+}
+
+// @id GetAllKubernetesApplications
+// @summary Get a list of applications across all namespaces in the cluster. If the nodeName is provided, it will return the applications running on that node.
+// @description Get a list of applications across all namespaces in the cluster. If the nodeName is provided, it will return the applications running on that node.
+// @description **Access policy**: authenticated
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment(Endpoint) identifier"
+// @param namespace query string true "Namespace name"
+// @param nodeName query string true "Node name"
+// @success 200 {array} models.K8sApplication "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier."
+// @failure 500 "Server error occurred while attempting to retrieve the list of applications from the cluster."
+// @router /kubernetes/{id}/applications [get]
+func (handler *Handler) GetAllKubernetesApplications(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	applications, err := handler.getAllKubernetesApplications(r)
+	if err != nil {
+		return err
+	}
+
+	return response.JSON(w, applications)
+}
+
+// @id GetAllKubernetesApplicationsCount
+// @summary Get Applications count
+// @description Get the count of Applications across all namespaces in the cluster. If the nodeName is provided, it will return the count of applications running on that node.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @success 200 {integer} integer "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier."
+// @failure 500 "Server error occurred while attempting to retrieve the count of all applications from the cluster."
+// @router /kubernetes/{id}/applications/count [get]
+func (handler *Handler) getAllKubernetesApplicationsCount(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	applications, err := handler.getAllKubernetesApplications(r)
+	if err != nil {
+		return err
+	}
+
+	return response.JSON(w, len(applications))
+}
+
+func (handler *Handler) getAllKubernetesApplications(r *http.Request) ([]models.K8sApplication, *httperror.HandlerError) {
+	namespace, err := request.RetrieveQueryParameter(r, "namespace", true)
+	if err != nil {
+		log.Error().Err(err).Str("context", "getAllKubernetesApplications").Msg("Unable to parse the namespace query parameter")
+		return nil, httperror.BadRequest("Unable to parse the namespace query parameter", err)
+	}
+
+	nodeName, err := request.RetrieveQueryParameter(r, "nodeName", true)
+	if err != nil {
+		log.Error().Err(err).Str("context", "getAllKubernetesApplications").Msg("Unable to parse the nodeName query parameter")
+		return nil, httperror.BadRequest("Unable to parse the nodeName query parameter", err)
+	}
+
+	cli, httpErr := handler.prepareKubeClient(r)
+	if httpErr != nil {
+		log.Error().Err(httpErr).Str("context", "getAllKubernetesApplications").Str("namespace", namespace).Str("nodeName", nodeName).Msg("Unable to get a Kubernetes client for the user")
+		return nil, httperror.InternalServerError("Unable to get a Kubernetes client for the user", httpErr)
+	}
+
+	applications, err := cli.GetApplications(namespace, nodeName)
+	if err != nil {
+		if k8serrors.IsUnauthorized(err) {
+			log.Error().Err(err).Str("context", "getAllKubernetesApplications").Str("namespace", namespace).Str("nodeName", nodeName).Msg("Unable to get the list of applications")
+			return nil, httperror.Unauthorized("Unable to get the list of applications", err)
+		}
+
+		log.Error().Err(err).Str("context", "getAllKubernetesApplications").Str("namespace", namespace).Str("nodeName", nodeName).Msg("Unable to get the list of applications")
+		return nil, httperror.InternalServerError("Unable to get the list of applications", err)
+	}
+
+	return applications, nil
+}
diff --git a/api/http/handler/kubernetes/client.go b/api/http/handler/kubernetes/client.go
new file mode 100644
index 0000000..c570210
--- /dev/null
+++ b/api/http/handler/kubernetes/client.go
@@ -0,0 +1,44 @@
+package kubernetes
+
+import (
+	"net/http"
+
+	"github.com/portainer/portainer/api/http/middlewares"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/kubernetes/cli"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/rs/zerolog/log"
+)
+
+// prepareKubeClient is a helper function to prepare a Kubernetes client for the user
+// it first fetches getProxyKubeClient to grab the user's admin status and non admin namespaces
+// then these two values are parsed to create a privileged client
+func (handler *Handler) prepareKubeClient(r *http.Request) (*cli.KubeClient, *httperror.HandlerError) {
+	cli, httpErr := handler.getProxyKubeClient(r)
+	if httpErr != nil {
+		log.Error().Err(httpErr.Err).Str("context", "prepareKubeClient").Msg("Unable to get a Kubernetes client for the user.")
+		return nil, httperror.InternalServerError("Unable to get a Kubernetes client for the user.", httpErr)
+	}
+
+	endpoint, err := middlewares.FetchEndpoint(r)
+	if err != nil {
+		log.Error().Err(err).Str("context", "prepareKubeClient").Msg("Unable to find the Kubernetes endpoint associated to the request.")
+		return nil, httperror.NotFound("Unable to find the Kubernetes endpoint associated to the request.", err)
+	}
+
+	tokenData, err := security.RetrieveTokenData(r)
+	if err != nil {
+		log.Error().Err(err).Str("context", "prepareKubeClient").Msg("Unable to retrieve token data associated to the request.")
+		return nil, httperror.InternalServerError("Unable to retrieve token data associated to the request.", err)
+	}
+
+	pcli, err := handler.KubernetesClientFactory.GetPrivilegedUserKubeClient(endpoint, tokenData.ID)
+	if err != nil {
+		log.Error().Err(err).Str("context", "prepareKubeClient").Msg("Unable to get a privileged Kubernetes client for the user.")
+		return nil, httperror.InternalServerError("Unable to get a privileged Kubernetes client for the user.", err)
+	}
+	pcli.SetIsKubeAdmin(cli.GetIsKubeAdmin())
+	pcli.SetClientNonAdminNamespaces(cli.GetClientNonAdminNamespaces())
+
+	return pcli, nil
+}
diff --git a/api/http/handler/kubernetes/cluster_role_bindings.go b/api/http/handler/kubernetes/cluster_role_bindings.go
new file mode 100644
index 0000000..83621a9
--- /dev/null
+++ b/api/http/handler/kubernetes/cluster_role_bindings.go
@@ -0,0 +1,83 @@
+package kubernetes
+
+import (
+	"net/http"
+
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/rs/zerolog/log"
+)
+
+// @id GetAllKubernetesClusterRoleBindings
+// @summary Get a list of kubernetes cluster role bindings
+// @description Get a list of kubernetes cluster role bindings within the given environment at the cluster level.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @success 200 {array} kubernetes.K8sClusterRoleBinding "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier."
+// @failure 500 "Server error occurred while attempting to retrieve the list of cluster role bindings."
+// @router /kubernetes/{id}/clusterrolebindings [get]
+func (handler *Handler) getAllKubernetesClusterRoleBindings(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	cli, httpErr := handler.getProxyKubeClient(r)
+	if httpErr != nil {
+		log.Error().Err(httpErr.Err).Str("context", "getAllKubernetesClusterRoleBindings").Msg("user is not authorized to fetch cluster role bindings from the Kubernetes cluster.")
+		return httperror.Forbidden("User is not authorized to fetch cluster role bindings from the Kubernetes cluster.", httpErr)
+	}
+
+	if !cli.GetIsKubeAdmin() {
+		log.Error().Str("context", "getAllKubernetesClusterRoleBindings").Msg("user is not authorized to fetch cluster role bindings from the Kubernetes cluster.")
+		return httperror.Forbidden("User is not authorized to fetch cluster role bindings from the Kubernetes cluster.", nil)
+	}
+
+	clusterrolebindings, err := cli.GetClusterRoleBindings()
+	if err != nil {
+		log.Error().Err(err).Str("context", "getAllKubernetesClusterRoleBindings").Msg("Unable to fetch cluster role bindings.")
+		return httperror.InternalServerError("Unable to fetch cluster role bindings.", err)
+	}
+
+	return response.JSON(w, clusterrolebindings)
+}
+
+// @id DeleteClusterRoleBindings
+// @summary Delete cluster role bindings
+// @description Delete the provided list of cluster role bindings.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @accept json
+// @param id path int true "Environment identifier"
+// @param payload body models.K8sClusterRoleBindingDeleteRequests true "A list of cluster role bindings to delete"
+// @success 204 "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier or unable to find a specific cluster role binding."
+// @failure 500 "Server error occurred while attempting to delete cluster role bindings."
+// @router /kubernetes/{id}/cluster_role_bindings/delete [POST]
+func (handler *Handler) deleteClusterRoleBindings(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	var payload models.K8sClusterRoleBindingDeleteRequests
+	err := request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	cli, handlerErr := handler.getProxyKubeClient(r)
+	if handlerErr != nil {
+		return handlerErr
+	}
+
+	err = cli.DeleteClusterRoleBindings(payload)
+	if err != nil {
+		return httperror.InternalServerError("Failed to delete cluster role bindings", err)
+	}
+
+	return response.Empty(w)
+}
diff --git a/api/http/handler/kubernetes/cluster_roles.go b/api/http/handler/kubernetes/cluster_roles.go
new file mode 100644
index 0000000..6d5d028
--- /dev/null
+++ b/api/http/handler/kubernetes/cluster_roles.go
@@ -0,0 +1,83 @@
+package kubernetes
+
+import (
+	"net/http"
+
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/rs/zerolog/log"
+)
+
+// @id GetAllKubernetesClusterRoles
+// @summary Get a list of kubernetes cluster roles
+// @description Get a list of kubernetes cluster roles within the given environment at the cluster level.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @success 200 {array} kubernetes.K8sClusterRole "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier."
+// @failure 500 "Server error occurred while attempting to retrieve the list of cluster roles."
+// @router /kubernetes/{id}/clusterroles [get]
+func (handler *Handler) getAllKubernetesClusterRoles(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	cli, httpErr := handler.getProxyKubeClient(r)
+	if httpErr != nil {
+		log.Error().Err(httpErr.Err).Str("context", "getAllKubernetesClusterRoles").Msg("user is not authorized to fetch cluster roles from the Kubernetes cluster.")
+		return httperror.Forbidden("User is not authorized to fetch cluster roles from the Kubernetes cluster.", httpErr)
+	}
+
+	if !cli.GetIsKubeAdmin() {
+		log.Error().Str("context", "getAllKubernetesClusterRoles").Msg("user is not authorized to fetch cluster roles from the Kubernetes cluster.")
+		return httperror.Forbidden("User is not authorized to fetch cluster roles from the Kubernetes cluster.", nil)
+	}
+
+	clusterroles, err := cli.GetClusterRoles()
+	if err != nil {
+		log.Error().Err(err).Str("context", "getAllKubernetesClusterRoles").Msg("Unable to fetch clusterroles.")
+		return httperror.InternalServerError("Unable to fetch clusterroles.", err)
+	}
+
+	return response.JSON(w, clusterroles)
+}
+
+// @id DeleteClusterRoles
+// @summary Delete cluster roles
+// @description Delete the provided list of cluster roles.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @accept json
+// @param id path int true "Environment identifier"
+// @param payload body models.K8sClusterRoleDeleteRequests true "A list of cluster roles to delete"
+// @success 204 "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier or unable to find a specific cluster role."
+// @failure 500 "Server error occurred while attempting to delete cluster roles."
+// @router /kubernetes/{id}/cluster_roles/delete [POST]
+func (handler *Handler) deleteClusterRoles(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	var payload models.K8sClusterRoleDeleteRequests
+	err := request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	cli, handlerErr := handler.getProxyKubeClient(r)
+	if handlerErr != nil {
+		return handlerErr
+	}
+
+	err = cli.DeleteClusterRoles(payload)
+	if err != nil {
+		return httperror.InternalServerError("Failed to delete cluster roles", err)
+	}
+
+	return response.Empty(w)
+}
diff --git a/api/http/handler/kubernetes/config.go b/api/http/handler/kubernetes/config.go
new file mode 100644
index 0000000..cc8e544
--- /dev/null
+++ b/api/http/handler/kubernetes/config.go
@@ -0,0 +1,294 @@
+package kubernetes
+
+import (
+	"crypto/x509"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/url"
+	"os"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+	kcli "github.com/portainer/portainer/api/kubernetes/cli"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/rs/zerolog/log"
+
+	clientV1 "k8s.io/client-go/tools/clientcmd/api/v1"
+)
+
+// @id GetKubernetesConfig
+// @summary Generate a kubeconfig file
+// @description Generate a kubeconfig file that allows a client to communicate with the Kubernetes API server
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce application/json, application/yaml
+// @param ids query []int false "will include only these environments(endpoints)"
+// @param excludeIds query []int false "will exclude these environments(endpoints)"
+// @success 200 {object} interface{} "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier."
+// @failure 500 "Server error occurred while attempting to generate the kubeconfig file."
+// @router /kubernetes/config [get]
+func (handler *Handler) getKubernetesConfig(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	tokenData, err := security.RetrieveTokenData(r)
+	if err != nil {
+		log.Error().Err(err).Str("context", "getKubernetesConfig").Msg("Permission denied to access environment")
+		return httperror.Forbidden("Permission denied to access environment", err)
+	}
+
+	bearerToken, err := handler.JwtService.GenerateTokenForKubeconfig(tokenData)
+	if err != nil {
+		log.Error().Err(err).Str("context", "getKubernetesConfig").Msg("Unable to generate JWT token")
+		return httperror.InternalServerError("Unable to generate JWT token", err)
+	}
+
+	endpoints, handlerErr := handler.filterUserKubeEndpoints(r)
+	if handlerErr != nil {
+		log.Error().Err(handlerErr).Str("context", "getKubernetesConfig").Msg("Unable to filter user kube endpoints")
+		return handlerErr
+	}
+
+	if len(endpoints) == 0 {
+		log.Error().Str("context", "getKubernetesConfig").Msg("Empty endpoints list")
+		return httperror.BadRequest("empty endpoints list", errors.New("empty endpoints list"))
+	}
+
+	config := handler.buildConfig(r, tokenData, bearerToken, endpoints, false)
+
+	return writeFileContent(w, r, endpoints, tokenData, config)
+}
+
+func (handler *Handler) filterUserKubeEndpoints(r *http.Request) ([]portainer.Endpoint, *httperror.HandlerError) {
+	var endpointIDs []portainer.EndpointID
+	_ = request.RetrieveJSONQueryParameter(r, "ids", &endpointIDs, true)
+
+	var excludeEndpointIDs []portainer.EndpointID
+	_ = request.RetrieveJSONQueryParameter(r, "excludeIds", &excludeEndpointIDs, true)
+
+	if len(endpointIDs) > 0 && len(excludeEndpointIDs) > 0 {
+		log.Error().Str("context", "filterUserKubeEndpoints").Msg("Can't provide both 'ids' and 'excludeIds' parameters")
+		return nil, httperror.BadRequest("Can't provide both 'ids' and 'excludeIds' parameters", errors.New("invalid parameters"))
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		log.Error().Err(err).Str("context", "filterUserKubeEndpoints").Msg("Unable to retrieve info from request context")
+		return nil, httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	endpointGroups, err := handler.DataStore.EndpointGroup().ReadAll()
+	if err != nil {
+		log.Error().Err(err).Str("context", "filterUserKubeEndpoints").Msg("Unable to retrieve environment groups from the database")
+		return nil, httperror.InternalServerError("Unable to retrieve environment groups from the database", err)
+	}
+
+	if len(endpointIDs) > 0 {
+		var endpoints []portainer.Endpoint
+		for _, endpointID := range endpointIDs {
+			endpoint, err := handler.DataStore.Endpoint().Endpoint(endpointID)
+			if err != nil {
+				log.Error().Err(err).Str("context", "filterUserKubeEndpoints").Msg("Unable to retrieve environment from the database")
+				return nil, httperror.InternalServerError("Unable to retrieve environment from the database", err)
+			}
+			if !endpointutils.IsKubernetesEndpoint(endpoint) {
+				continue
+			}
+			endpoints = append(endpoints, *endpoint)
+		}
+
+		filteredEndpoints := security.FilterEndpoints(endpoints, endpointGroups, securityContext)
+
+		return filteredEndpoints, nil
+	}
+
+	var kubeEndpoints []portainer.Endpoint
+	endpoints, err := handler.DataStore.Endpoint().Endpoints()
+	if err != nil {
+		log.Error().Err(err).Str("context", "filterUserKubeEndpoints").Msg("Unable to retrieve environments from the database")
+		return nil, httperror.InternalServerError("Unable to retrieve environments from the database", err)
+	}
+
+	for _, endpoint := range endpoints {
+		if !endpointutils.IsKubernetesEndpoint(&endpoint) {
+			continue
+		}
+
+		kubeEndpoints = append(kubeEndpoints, endpoint)
+	}
+
+	filteredEndpoints := security.FilterEndpoints(kubeEndpoints, endpointGroups, securityContext)
+	if len(excludeEndpointIDs) > 0 {
+		filteredEndpoints = endpointutils.FilterByExcludeIDs(filteredEndpoints, excludeEndpointIDs)
+	}
+
+	return filteredEndpoints, nil
+}
+
+func (handler *Handler) buildConfig(r *http.Request, tokenData *portainer.TokenData, bearerToken string, endpoints []portainer.Endpoint, isInternal bool) *clientV1.Config {
+	var configAuthInfos []clientV1.NamedAuthInfo
+
+	configClusters := make([]clientV1.NamedCluster, len(endpoints))
+	configContexts := make([]clientV1.NamedContext, len(endpoints))
+	authInfosSet := make(map[string]bool)
+
+	for idx, endpoint := range endpoints {
+		instanceID := handler.KubernetesClientFactory.GetInstanceID()
+		serviceAccountName := kcli.UserServiceAccountName(int(tokenData.ID), instanceID)
+
+		configClusters[idx] = handler.buildCluster(r, endpoint, isInternal)
+		configContexts[idx] = buildContext(serviceAccountName, endpoint)
+
+		if !authInfosSet[serviceAccountName] {
+			configAuthInfos = append(configAuthInfos, buildAuthInfo(serviceAccountName, bearerToken))
+			authInfosSet[serviceAccountName] = true
+		}
+	}
+
+	return &clientV1.Config{
+		APIVersion:     "v1",
+		Kind:           "Config",
+		Clusters:       configClusters,
+		Contexts:       configContexts,
+		CurrentContext: configContexts[0].Name,
+		AuthInfos:      configAuthInfos,
+	}
+}
+
+// buildCluster builds a Kubernetes cluster configuration based on the endpoint and if it's used internally or externally.
+func (handler *Handler) buildCluster(r *http.Request, endpoint portainer.Endpoint, isInternal bool) clientV1.NamedCluster {
+	kubeConfigInternal := handler.kubeClusterAccessService.GetClusterDetails(r.Host, endpoint.ID, isInternal)
+
+	if isInternal {
+		return clientV1.NamedCluster{
+			Name: buildClusterName(endpoint.Name),
+			Cluster: clientV1.Cluster{
+				Server:                kubeConfigInternal.ClusterServerURL,
+				InsecureSkipTLSVerify: true,
+			},
+		}
+	}
+
+	selfSignedCert := false
+	serverUrl, err := url.Parse(kubeConfigInternal.ClusterServerURL)
+	if err != nil {
+		log.Warn().Err(err).Msg("Failed to parse server URL")
+	}
+
+	if strings.EqualFold(serverUrl.Scheme, "https") {
+		var certPem []byte
+		var err error
+
+		if kubeConfigInternal.CertificateAuthorityData != "" {
+			certPem = []byte(kubeConfigInternal.CertificateAuthorityData)
+		} else if kubeConfigInternal.CertificateAuthorityFile != "" {
+			certPem, err = os.ReadFile(kubeConfigInternal.CertificateAuthorityFile)
+			if err != nil {
+				log.Warn().Err(err).Msg("Failed to open certificate file")
+			}
+		}
+
+		if certPem != nil {
+			selfSignedCert, err = IsSelfSignedCertificate(certPem)
+			if err != nil {
+				log.Warn().Err(err).Msg("Failed to verify if certificate is self-signed")
+			}
+		}
+	}
+
+	return clientV1.NamedCluster{
+		Name: buildClusterName(endpoint.Name),
+		Cluster: clientV1.Cluster{
+			Server:                kubeConfigInternal.ClusterServerURL,
+			InsecureSkipTLSVerify: selfSignedCert,
+		},
+	}
+}
+
+func buildClusterName(endpointName string) string {
+	return "portainer-cluster-" + endpointName
+}
+
+func buildContext(serviceAccountName string, endpoint portainer.Endpoint) clientV1.NamedContext {
+	return clientV1.NamedContext{
+		Name: "portainer-ctx-" + endpoint.Name,
+		Context: clientV1.Context{
+			AuthInfo: serviceAccountName,
+			Cluster:  buildClusterName(endpoint.Name),
+		},
+	}
+}
+
+func buildAuthInfo(serviceAccountName string, bearerToken string) clientV1.NamedAuthInfo {
+	return clientV1.NamedAuthInfo{
+		Name: serviceAccountName,
+		AuthInfo: clientV1.AuthInfo{
+			Token: bearerToken,
+		},
+	}
+}
+
+func writeFileContent(w http.ResponseWriter, r *http.Request, endpoints []portainer.Endpoint, tokenData *portainer.TokenData, config *clientV1.Config) *httperror.HandlerError {
+	filenameSuffix := "kubeconfig"
+	if len(endpoints) == 1 {
+		filenameSuffix = endpoints[0].Name
+	}
+	filenameBase := fmt.Sprintf("%s-%s", tokenData.Username, filenameSuffix)
+
+	if r.Header.Get("Accept") == "text/yaml" {
+		yaml, err := kcli.GenerateYAML(config)
+		if err != nil {
+			log.Error().Err(err).Str("context", "writeFileContent").Msg("Failed to generate Kubeconfig")
+			return httperror.InternalServerError("Failed to generate Kubeconfig", err)
+		}
+
+		w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; %s.yaml", filenameBase))
+		return response.YAML(w, yaml)
+	}
+
+	w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; %s.json", filenameBase))
+	return response.JSON(w, config)
+}
+
+func IsSelfSignedCertificate(certPem []byte) (bool, error) {
+	if certPem == nil {
+		return false, errors.New("certificate data is empty")
+	}
+
+	if !strings.Contains(string(certPem), "BEGIN CERTIFICATE") {
+		certPem = fmt.Appendf(nil, "-----BEGIN CERTIFICATE-----\n%s\n-----END CERTIFICATE-----", string(certPem))
+	}
+
+	block, _ := pem.Decode(certPem)
+	if block == nil {
+		return false, errors.New("failed to decode certificate")
+	}
+
+	cert, err := x509.ParseCertificate(block.Bytes)
+	if err != nil {
+		return false, err
+	}
+
+	if cert.Issuer.String() != cert.Subject.String() {
+		return false, nil
+	}
+
+	roots := x509.NewCertPool()
+	roots.AddCert(cert)
+
+	opts := x509.VerifyOptions{
+		Roots:       roots,
+		CurrentTime: cert.NotBefore,
+	}
+
+	_, err = cert.Verify(opts)
+	return err == nil, err
+}
diff --git a/api/http/handler/kubernetes/config_test.go b/api/http/handler/kubernetes/config_test.go
new file mode 100644
index 0000000..e113a73
--- /dev/null
+++ b/api/http/handler/kubernetes/config_test.go
@@ -0,0 +1,188 @@
+package kubernetes
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestIsSelfSignedCertificate(t *testing.T) {
+	t.Parallel()
+
+	tc := []struct {
+		name     string
+		cert     string
+		expected bool
+	}{
+		{
+			name: "portainer self-signed",
+			cert: `-----BEGIN CERTIFICATE-----
+MIIBUTCB+KADAgECAhBB7psNiJlJd/nRCCKUPVenMAoGCCqGSM49BAMCMAAwHhcN
+MjUwMzEzMDQwODI0WhcNMzAwMzEzMDQwODI0WjAAMFkwEwYHKoZIzj0CAQYIKoZI
+zj0DAQcDQgAESdGCaXq0r1GDxF89yKjjLeCIixiPDdXAg+lw4NqAWeJq2AOo+8IH
+vcCq9bSlYlezK8RzTsbf9Z1m5jRqUEbSjqNUMFIwDgYDVR0PAQH/BAQDAgWgMBMG
+A1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHQYDVR0RAQH/BBMwEYIJ
+bG9jYWxob3N0hwQAAAAAMAoGCCqGSM49BAMCA0gAMEUCIApLliukFaCZHbc/2pkH
+0VDY+fBMb12jhmVpgKh1Cqg9AiEAwFrMQLUkzATUpiHuukdUg5VsUiMIkWTPLglz
+E4+1dRc=
+-----END CERTIFICATE-----
+`,
+			expected: true,
+		},
+		{
+			name:     "portainer self-signed without header",
+			cert:     `MIIBUzCB+aADAgECAhEAjsskPzuCS5BeHjXGwYqc2jAKBggqhkjOPQQDAjAAMB4XDTI1MDMxMzA0MzQyNloXDTMwMDMxMzA0MzQyNlowADBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABITD+dNDLYQbLYDE3UMlTzD61OYRSVkVZspdp1MvZITIG4VOxtfQUqcW3P7OHQdoi52GIQ/GM6iDgxwB1BOyi3mjVDBSMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdEQEB/wQTMBGCCWxvY2FsaG9zdIcEAAAAADAKBggqhkjOPQQDAgNJADBGAiEA8SmyeYLhrnrNLAFcxZp0dk6nMN70XVAfqGnbK/s8NR8CIQDgQdqhfge8QvN2TsH4gg98a9VHDv+RlcOlJ80SS+G/Ww==`,
+			expected: true,
+		},
+		{
+			name: "custom certificate generated by openssl",
+			cert: `-----BEGIN CERTIFICATE-----
+MIIB9TCCAZugAwIBAgIULTkNYfYHiqfOiX7mKOIGxRefx/YwCgYIKoZIzj0EAwIw
+SDELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRYwFAYDVQQHEw1TYW4gRnJhbmNp
+c2NvMRQwEgYDVQQDEwtleGFtcGxlLm5ldDAeFw0yNTAyMjgwNjI3MDBaFw0zNTAy
+MjYwNjI3MDBaMAAwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAT3WlLvbGw7wPkQ
+3LuHFJEaNrDv3n359JMV1CkjQi3U37u0fJrjd+8o7TxPBYgt9HDD9vsURhy41DNo
+g71F2AIto4GqMIGnMA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcD
+AQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQU+nMxx/VCE9fzrlHI
+FX9mF5SRPrkwHwYDVR0jBBgwFoAUOlUIToGwnBOqzZ1dBfOvdKbwNaAwKAYDVR0R
+AQH/BB4wHIIaZWRnZS4xNzIuMTcuMjIxLjIwOC5uaXAuaW8wCgYIKoZIzj0EAwID
+SAAwRQIgeYrkjY0z/ypMKXZbvbMi8qOK44qoISKkSErBUCBLuwoCIQDRaJA9r931
+utpXXnysVGecVXHHKOOl1YhWglmuPvcZhw==
+-----END CERTIFICATE-----`,
+			expected: false,
+		},
+		{
+			name: "google.com certificate",
+			cert: `-----BEGIN CERTIFICATE-----
+MIIOITCCDQmgAwIBAgIQKS0IQxknY8USDjt3IYchljANBgkqhkiG9w0BAQsFADA7
+MQswCQYDVQQGEwJVUzEeMBwGA1UEChMVR29vZ2xlIFRydXN0IFNlcnZpY2VzMQww
+CgYDVQQDEwNXUjIwHhcNMjUwMjI2MTUzMjU1WhcNMjUwNTIxMTUzMjU0WjAXMRUw
+EwYDVQQDDAwqLmdvb2dsZS5jb20wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARx
+nMOmIG3BuO7my/BbF/rGPAMH/JbxBDufbYFQHV+6l5pF5sdT/Zov3X+qsR3IYFl7
+F2a0gAUmK1Bq7//zTb3uo4IMDjCCDAowDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQM
+MAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFN+aEjBz3PaUtelz
+3g9rVTkGRgU0MB8GA1UdIwQYMBaAFN4bHu15FdQ+NyTDIbvsNDltQrIwMFgGCCsG
+AQUFBwEBBEwwSjAhBggrBgEFBQcwAYYVaHR0cDovL28ucGtpLmdvb2cvd3IyMCUG
+CCsGAQUFBzAChhlodHRwOi8vaS5wa2kuZ29vZy93cjIuY3J0MIIJ5AYDVR0RBIIJ
+2zCCCdeCDCouZ29vZ2xlLmNvbYIWKi5hcHBlbmdpbmUuZ29vZ2xlLmNvbYIJKi5i
+ZG4uZGV2ghUqLm9yaWdpbi10ZXN0LmJkbi5kZXaCEiouY2xvdWQuZ29vZ2xlLmNv
+bYIYKi5jcm93ZHNvdXJjZS5nb29nbGUuY29tghgqLmRhdGFjb21wdXRlLmdvb2ds
+ZS5jb22CCyouZ29vZ2xlLmNhggsqLmdvb2dsZS5jbIIOKi5nb29nbGUuY28uaW6C
+DiouZ29vZ2xlLmNvLmpwgg4qLmdvb2dsZS5jby51a4IPKi5nb29nbGUuY29tLmFy
+gg8qLmdvb2dsZS5jb20uYXWCDyouZ29vZ2xlLmNvbS5icoIPKi5nb29nbGUuY29t
+LmNvgg8qLmdvb2dsZS5jb20ubXiCDyouZ29vZ2xlLmNvbS50coIPKi5nb29nbGUu
+Y29tLnZuggsqLmdvb2dsZS5kZYILKi5nb29nbGUuZXOCCyouZ29vZ2xlLmZyggsq
+Lmdvb2dsZS5odYILKi5nb29nbGUuaXSCCyouZ29vZ2xlLm5sggsqLmdvb2dsZS5w
+bIILKi5nb29nbGUucHSCDyouZ29vZ2xlYXBpcy5jboIRKi5nb29nbGV2aWRlby5j
+b22CDCouZ3N0YXRpYy5jboIQKi5nc3RhdGljLWNuLmNvbYIPZ29vZ2xlY25hcHBz
+LmNughEqLmdvb2dsZWNuYXBwcy5jboIRZ29vZ2xlYXBwcy1jbi5jb22CEyouZ29v
+Z2xlYXBwcy1jbi5jb22CDGdrZWNuYXBwcy5jboIOKi5na2VjbmFwcHMuY26CEmdv
+b2dsZWRvd25sb2Fkcy5jboIUKi5nb29nbGVkb3dubG9hZHMuY26CEHJlY2FwdGNo
+YS5uZXQuY26CEioucmVjYXB0Y2hhLm5ldC5jboIQcmVjYXB0Y2hhLWNuLm5ldIIS
+Ki5yZWNhcHRjaGEtY24ubmV0ggt3aWRldmluZS5jboINKi53aWRldmluZS5jboIR
+YW1wcHJvamVjdC5vcmcuY26CEyouYW1wcHJvamVjdC5vcmcuY26CEWFtcHByb2pl
+Y3QubmV0LmNughMqLmFtcHByb2plY3QubmV0LmNughdnb29nbGUtYW5hbHl0aWNz
+LWNuLmNvbYIZKi5nb29nbGUtYW5hbHl0aWNzLWNuLmNvbYIXZ29vZ2xlYWRzZXJ2
+aWNlcy1jbi5jb22CGSouZ29vZ2xlYWRzZXJ2aWNlcy1jbi5jb22CEWdvb2dsZXZh
+ZHMtY24uY29tghMqLmdvb2dsZXZhZHMtY24uY29tghFnb29nbGVhcGlzLWNuLmNv
+bYITKi5nb29nbGVhcGlzLWNuLmNvbYIVZ29vZ2xlb3B0aW1pemUtY24uY29tghcq
+Lmdvb2dsZW9wdGltaXplLWNuLmNvbYISZG91YmxlY2xpY2stY24ubmV0ghQqLmRv
+dWJsZWNsaWNrLWNuLm5ldIIYKi5mbHMuZG91YmxlY2xpY2stY24ubmV0ghYqLmcu
+ZG91YmxlY2xpY2stY24ubmV0gg5kb3VibGVjbGljay5jboIQKi5kb3VibGVjbGlj
+ay5jboIUKi5mbHMuZG91YmxlY2xpY2suY26CEiouZy5kb3VibGVjbGljay5jboIR
+ZGFydHNlYXJjaC1jbi5uZXSCEyouZGFydHNlYXJjaC1jbi5uZXSCHWdvb2dsZXRy
+YXZlbGFkc2VydmljZXMtY24uY29tgh8qLmdvb2dsZXRyYXZlbGFkc2VydmljZXMt
+Y24uY29tghhnb29nbGV0YWdzZXJ2aWNlcy1jbi5jb22CGiouZ29vZ2xldGFnc2Vy
+dmljZXMtY24uY29tghdnb29nbGV0YWdtYW5hZ2VyLWNuLmNvbYIZKi5nb29nbGV0
+YWdtYW5hZ2VyLWNuLmNvbYIYZ29vZ2xlc3luZGljYXRpb24tY24uY29tghoqLmdv
+b2dsZXN5bmRpY2F0aW9uLWNuLmNvbYIkKi5zYWZlZnJhbWUuZ29vZ2xlc3luZGlj
+YXRpb24tY24uY29tghZhcHAtbWVhc3VyZW1lbnQtY24uY29tghgqLmFwcC1tZWFz
+dXJlbWVudC1jbi5jb22CC2d2dDEtY24uY29tgg0qLmd2dDEtY24uY29tggtndnQy
+LWNuLmNvbYINKi5ndnQyLWNuLmNvbYILMm1kbi1jbi5uZXSCDSouMm1kbi1jbi5u
+ZXSCFGdvb2dsZWZsaWdodHMtY24ubmV0ghYqLmdvb2dsZWZsaWdodHMtY24ubmV0
+ggxhZG1vYi1jbi5jb22CDiouYWRtb2ItY24uY29tghRnb29nbGVzYW5kYm94LWNu
+LmNvbYIWKi5nb29nbGVzYW5kYm94LWNuLmNvbYIeKi5zYWZlbnVwLmdvb2dsZXNh
+bmRib3gtY24uY29tgg0qLmdzdGF0aWMuY29tghQqLm1ldHJpYy5nc3RhdGljLmNv
+bYIKKi5ndnQxLmNvbYIRKi5nY3BjZG4uZ3Z0MS5jb22CCiouZ3Z0Mi5jb22CDiou
+Z2NwLmd2dDIuY29tghAqLnVybC5nb29nbGUuY29tghYqLnlvdXR1YmUtbm9jb29r
+aWUuY29tggsqLnl0aW1nLmNvbYILYW5kcm9pZC5jb22CDSouYW5kcm9pZC5jb22C
+EyouZmxhc2guYW5kcm9pZC5jb22CBGcuY26CBiouZy5jboIEZy5jb4IGKi5nLmNv
+ggZnb28uZ2yCCnd3dy5nb28uZ2yCFGdvb2dsZS1hbmFseXRpY3MuY29tghYqLmdv
+b2dsZS1hbmFseXRpY3MuY29tggpnb29nbGUuY29tghJnb29nbGVjb21tZXJjZS5j
+b22CFCouZ29vZ2xlY29tbWVyY2UuY29tgghnZ3BodC5jboIKKi5nZ3BodC5jboIK
+dXJjaGluLmNvbYIMKi51cmNoaW4uY29tggh5b3V0dS5iZYILeW91dHViZS5jb22C
+DSoueW91dHViZS5jb22CEW11c2ljLnlvdXR1YmUuY29tghMqLm11c2ljLnlvdXR1
+YmUuY29tghR5b3V0dWJlZWR1Y2F0aW9uLmNvbYIWKi55b3V0dWJlZWR1Y2F0aW9u
+LmNvbYIPeW91dHViZWtpZHMuY29tghEqLnlvdXR1YmVraWRzLmNvbYIFeXQuYmWC
+ByoueXQuYmWCGmFuZHJvaWQuY2xpZW50cy5nb29nbGUuY29tghMqLmFuZHJvaWQu
+Z29vZ2xlLmNughIqLmNocm9tZS5nb29nbGUuY26CFiouZGV2ZWxvcGVycy5nb29n
+bGUuY26CFSouYWlzdHVkaW8uZ29vZ2xlLmNvbTATBgNVHSAEDDAKMAgGBmeBDAEC
+ATA2BgNVHR8ELzAtMCugKaAnhiVodHRwOi8vYy5wa2kuZ29vZy93cjIvb0JGWVlh
+aHpnVkkuY3JsMIIBBAYKKwYBBAHWeQIEAgSB9QSB8gDwAHcAzxFW7tUufK/zh1vZ
+aS6b6RpxZ0qwF+ysAdJbd87MOwgAAAGVQxqxaQAABAMASDBGAiEAk6r74vfyJIaa
+hYTWqNRsjl/RpCWq/wyzzMi21zgGmfkCIQCZafyS/fl0tiutICL9aOSnDBRfPYqd
+CeNqKOy11EjvigB1AN6FgddQJHxrzcuvVjfF54HGTORu1hdjn480pybJ4r03AAAB
+lUMasUkAAAQDAEYwRAIgYfG2iyRnmn8MI86RFDxOQW1/IOBAjQxNfIQ8toZlZkoC
+IA1BHw7cqmlTP7Ks+ebX6hGfNlVsgTQS8iYyKL5/BSvTMA0GCSqGSIb3DQEBCwUA
+A4IBAQAYSNtoW72rqhPfjV5Ug1ENbbimfqmqiJS4JdzaEFRpftzachTuvx8relaY
++7FAz5y4YULu9LGNjpBRYW8yW9pgfWyc53CCHSkDODguUOMCRo3hdglxZ2d5pJ/8
+TQY4zRBd8OHzOAx2kH6jLEj9I0nDie3vowSYm7FCBRLjzfForRNQWmzPu+5hS3De
+QM0R2jWpmPcG3ffQ5qQwnAQnP9HCK9oEZ5cFqLvOQWfttj/rzKOz856iSEoRpf8S
+wVFRu3Uv2TXQ6UYF2cDfiWCe6/mO35CIynC6FVkunze/Q/2rtaCDttLRYZcLllj8
+PSl7nmLhtqDlO7da/S34BFiyyRjN
+-----END CERTIFICATE-----
+`,
+			expected: false,
+		},
+		{
+			name: "let's encrypt certificate",
+			cert: `-----BEGIN CERTIFICATE-----
+MIIGMjCCBRqgAwIBAgISBVHH05rEMkaCuDQvABDjiam0MA0GCSqGSIb3DQEBCwUA
+MDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQD
+EwNSMTAwHhcNMjUwMzEzMDIyMzE2WhcNMjUwNjExMDIyMzE1WjAkMSIwIAYDVQQD
+Exlvei1kZW1vLnBvcnRhaW5lcmNsb3VkLmlvMIICIjANBgkqhkiG9w0BAQEFAAOC
+Ag8AMIICCgKCAgEAwNCcr9azSaldEwgL54bQScuWBnmw3FMHgEATxDVp2MEawQkV
+I3VScUcJWBnlHlb7TUanRC/c/vJGbzc+KDuCRTZ2/Ob2yQ9G5mZjGttBAnBSQPpV
+arEEBFCClhVBn4LhLNmIsCjCy25+m0HY/dwWbKjTMT/KxpTa3L3mdmIFa7XNs6W2
+vEZGwYM+2JPMJ9DwemVrrrvRqd5vLWTZcWvWJQ7HMfw3PoELpeqyycmxDqd9PCMz
+yMp8q3UwLDur3+KfDXGtGOoubxcOuJrpemOe8JeM5cEYEhvOy8D16zmWwWYDT19D
+ElFfUbM0GGITpJ41Qie03DvmI0hDYDqTEZfKza967VsvD7K9bFgLHmHdv7gLNutB
+FConpziNqslapWwQ5j7bKircxKjRQVkOiXH48m2IUzylqWgJPVMvHukRu0YVnvbt
+Q53xNVZQEbjvZmIuz8jqo22Y/1Jr7Plnb1lUvvDznA58MHT0KA4LSZwk9tvMJJCw
+vh7AoWB6/Jnl8QVnApOdCa6M/An128rBwgrCmp0wSvhMecTkWC8/gsah0Q5wKFL3
+ziBth728Qy8RlNghRUw88e/y4pdGHN8egjK1NpdgsvTFdRNQ8qwu0lx9pO3b6TNQ
+qDG5pirXjS/DhPYvZtJRDK6SMTHJNm+0NGdWB8qpNssFrU6u2cRl0533LtECAwEA
+AaOCAk0wggJJMA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYI
+KwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUiQi/3pZamfPxRGPI8DTZ
+tej1494wHwYDVR0jBBgwFoAUu7zDR6XkvKnGw6RyDBCNojXhyOgwVwYIKwYBBQUH
+AQEESzBJMCIGCCsGAQUFBzABhhZodHRwOi8vcjEwLm8ubGVuY3Iub3JnMCMGCCsG
+AQUFBzAChhdodHRwOi8vcjEwLmkubGVuY3Iub3JnLzAkBgNVHREEHTAbghlvei1k
+ZW1vLnBvcnRhaW5lcmNsb3VkLmlvMBMGA1UdIAQMMAowCAYGZ4EMAQIBMC4GA1Ud
+HwQnMCUwI6AhoB+GHWh0dHA6Ly9yMTAuYy5sZW5jci5vcmcvNTMuY3JsMIIBBAYK
+KwYBBAHWeQIEAgSB9QSB8gDwAHcAzPsPaoVxCWX+lZtTzumyfCLphVwNl422qX5U
+wP5MDbAAAAGVjYW7/QAABAMASDBGAiEA8CjMOIj7wqQ60BX22A5pDkA23IxZPzwV
+1MF5+VSgdqgCIQCZhry5AK2VyZX/cIODEl6eHBCUWS4vHB+J8RxeclKCpAB1AKLj
+CuRF772tm3447Udnd1PXgluElNcrXhssxLlQpEfnAAABlY2Fu/QAAAQDAEYwRAIg
+bwjJgZJew/1LoL9yzDD1P4Xkd8ezFucxfU3AzlV1XEYCIH5RPyW1HP9GSr+aAx+I
+o3inVl1NagJFYiApAPvFmIEgMA0GCSqGSIb3DQEBCwUAA4IBAQATJWi1sJSBstO+
+hyH7DsrAtDhiQTOWzUZezBlgCn8hfmA3nX5uKsHyxPPPEQ/GFYOltRD/+34X9kFF
+YNzUjJOP0bGk45I1JbspxRRvtbDpk0+dj2VE2toM8vLRDz3+DB4YB2lFofYlex++
+16xFzOIE+ZW41qBs3G8InsyHADsaFY2CQ9re/kZvenptU/ax1U2a21JJ3TT2DmXW
+AHZYQ5/whVIowsebw1e28I12VhLl2BKn7v4MpCn3GUzBBQAEbJ6TIjHtFKWWnVfH
+FisaUX6N4hMzGZVJOsbH4QVBGuNwUshHiD8MSpbans2w+T4bCe11XayerqxFhTao
+w/pjiPVy
+-----END CERTIFICATE-----
+`,
+			expected: false,
+		},
+	}
+
+	for _, tt := range tc {
+		t.Run(tt.name, func(t *testing.T) {
+			actual, err := IsSelfSignedCertificate([]byte(tt.cert))
+			require.NoError(t, err)
+			assert.Equal(t, tt.expected, actual)
+		})
+	}
+}
diff --git a/api/http/handler/kubernetes/configmaps.go b/api/http/handler/kubernetes/configmaps.go
new file mode 100644
index 0000000..bd10ae1
--- /dev/null
+++ b/api/http/handler/kubernetes/configmaps.go
@@ -0,0 +1,157 @@
+package kubernetes
+
+import (
+	"net/http"
+
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/rs/zerolog/log"
+	k8serrors "k8s.io/apimachinery/pkg/api/errors"
+)
+
+// @id GetKubernetesConfigMap
+// @summary Get a ConfigMap
+// @description Get a ConfigMap by name for a given namespace.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @param namespace path string true "The namespace name where the configmap is located"
+// @param configmap path string true "The configmap name to get details for"
+// @success 200 {object} models.K8sConfigMap "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier or a configmap with the specified name in the given namespace."
+// @failure 500 "Server error occurred while attempting to retrieve a configmap by name within the specified namespace."
+// @router /kubernetes/{id}/namespaces/{namespace}/configmaps/{configmap} [get]
+func (handler *Handler) getKubernetesConfigMap(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	namespace, err := request.RetrieveRouteVariableValue(r, "namespace")
+	if err != nil {
+		log.Error().Err(err).Str("context", "getKubernetesConfigMap").Str("namespace", namespace).Msg("Unable to retrieve namespace identifier route variable")
+		return httperror.BadRequest("Unable to retrieve namespace identifier route variable", err)
+	}
+
+	configMapName, err := request.RetrieveRouteVariableValue(r, "configmap")
+	if err != nil {
+		log.Error().Err(err).Str("context", "getKubernetesConfigMap").Str("namespace", namespace).Msg("Unable to retrieve configMap identifier route variable")
+		return httperror.BadRequest("Unable to retrieve configMap identifier route variable", err)
+	}
+
+	cli, httpErr := handler.getProxyKubeClient(r)
+	if httpErr != nil {
+		log.Error().Err(httpErr).Str("context", "getKubernetesConfigMap").Str("namespace", namespace).Str("configMap", configMapName).Msg("Unable to get a Kubernetes client for the user")
+		return httperror.InternalServerError("Unable to get a Kubernetes client for the user", httpErr)
+	}
+
+	configMap, err := cli.GetConfigMap(namespace, configMapName)
+	if err != nil {
+		if k8serrors.IsUnauthorized(err) || k8serrors.IsForbidden(err) {
+			log.Error().Err(err).Str("context", "getKubernetesConfigMap").Str("namespace", namespace).Str("configMap", configMapName).Msg("Unauthorized access to the Kubernetes API")
+			return httperror.Forbidden("Unauthorized access to the Kubernetes API", err)
+		}
+
+		if k8serrors.IsNotFound(err) {
+			log.Error().Err(err).Str("context", "getKubernetesConfigMap").Str("namespace", namespace).Str("configMap", configMapName).Msg("Unable to retrieve configMap")
+			return httperror.NotFound("Unable to retrieve configMap", err)
+		}
+
+		log.Error().Err(err).Str("context", "getKubernetesConfigMap").Str("namespace", namespace).Str("configMap", configMapName).Msg("Unable to retrieve configMap")
+		return httperror.InternalServerError("Unable to retrieve configMap", err)
+	}
+
+	configMapWithApplications, err := cli.CombineConfigMapWithApplications(configMap)
+	if err != nil {
+		log.Error().Err(err).Str("context", "getKubernetesConfigMap").Str("namespace", namespace).Str("configMap", configMapName).Msg("Unable to combine configMap with applications")
+		return httperror.InternalServerError("Unable to combine configMap with applications", err)
+	}
+
+	return response.JSON(w, configMapWithApplications)
+}
+
+// @id GetAllKubernetesConfigMaps
+// @summary Get a list of ConfigMaps
+// @description Get a list of ConfigMaps across all namespaces in the cluster. For non-admin users, it will only return ConfigMaps based on the namespaces that they have access to.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @param isUsed query bool true "Set to true to include information about applications that use the ConfigMaps in the response"
+// @success 200 {array} models.K8sConfigMap "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier."
+// @failure 500 "Server error occurred while attempting to retrieve all configmaps from the cluster."
+// @router /kubernetes/{id}/configmaps [get]
+func (handler *Handler) GetAllKubernetesConfigMaps(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	configMaps, err := handler.getAllKubernetesConfigMaps(r)
+	if err != nil {
+		return err
+	}
+
+	return response.JSON(w, configMaps)
+}
+
+// @id GetAllKubernetesConfigMapsCount
+// @summary Get ConfigMaps count
+// @description Get the count of ConfigMaps across all namespaces in the cluster. For non-admin users, it will only return the count of ConfigMaps based on the namespaces that they have access to.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @success 200 {integer} integer "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier."
+// @failure 500 "Server error occurred while attempting to retrieve the count of all configmaps from the cluster."
+// @router /kubernetes/{id}/configmaps/count [get]
+func (handler *Handler) getAllKubernetesConfigMapsCount(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	configMaps, err := handler.getAllKubernetesConfigMaps(r)
+	if err != nil {
+		return err
+	}
+
+	return response.JSON(w, len(configMaps))
+}
+
+func (handler *Handler) getAllKubernetesConfigMaps(r *http.Request) ([]models.K8sConfigMap, *httperror.HandlerError) {
+	isUsed, err := request.RetrieveBooleanQueryParameter(r, "isUsed", true)
+	if err != nil {
+		log.Error().Err(err).Str("context", "getAllKubernetesConfigMaps").Msg("Unable to retrieve isUsed query parameter")
+		return nil, httperror.BadRequest("Unable to retrieve isUsed query parameter", err)
+	}
+
+	cli, httpErr := handler.prepareKubeClient(r)
+	if httpErr != nil {
+		log.Error().Err(httpErr).Str("context", "getAllKubernetesConfigMaps").Msg("Unable to prepare kube client")
+		return nil, httperror.InternalServerError("Unable to prepare kube client", httpErr)
+	}
+
+	configMaps, err := cli.GetConfigMaps("")
+	if err != nil {
+		if k8serrors.IsUnauthorized(err) || k8serrors.IsForbidden(err) {
+			log.Error().Err(err).Str("context", "getAllKubernetesConfigMaps").Msg("Unauthorized access to the Kubernetes API")
+			return nil, httperror.Forbidden("Unauthorized access to the Kubernetes API", err)
+		}
+
+		log.Error().Err(err).Str("context", "getAllKubernetesConfigMaps").Msg("Unable to get configMaps")
+		return nil, httperror.InternalServerError("Unable to get configMaps", err)
+	}
+
+	if isUsed {
+		err = cli.SetConfigMapsIsUsed(&configMaps)
+		if err != nil {
+			log.Error().Err(err).Str("context", "getAllKubernetesConfigMaps").Msg("Unable to combine configMaps with associated applications")
+			return nil, httperror.InternalServerError("Unable to combine configMaps with associated applications", err)
+		}
+	}
+
+	return configMaps, nil
+}
diff --git a/api/http/handler/kubernetes/cron_job.go b/api/http/handler/kubernetes/cron_job.go
new file mode 100644
index 0000000..cad65bf
--- /dev/null
+++ b/api/http/handler/kubernetes/cron_job.go
@@ -0,0 +1,78 @@
+package kubernetes
+
+import (
+	"net/http"
+
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/rs/zerolog/log"
+)
+
+// @id GetKubernetesCronJobs
+// @summary Get a list of kubernetes Cron Jobs
+// @description Get a list of kubernetes Cron Jobs that the user has access to.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @success 200 {array} models.K8sCronJob "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier."
+// @failure 500 "Server error occurred while attempting to retrieve the list of Cron Jobs."
+// @router /kubernetes/{id}/cron_jobs [get]
+func (handler *Handler) getAllKubernetesCronJobs(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	cli, httpErr := handler.prepareKubeClient(r)
+	if httpErr != nil {
+		log.Error().Err(httpErr).Str("context", "GetAllKubernetesCronJobs").Msg("Unable to prepare kube client")
+		return httperror.InternalServerError("unable to prepare kube client. Error: ", httpErr)
+	}
+
+	cronJobs, err := cli.GetCronJobs("")
+	if err != nil {
+		log.Error().Err(err).Str("context", "GetAllKubernetesCronJobs").Msg("Unable to fetch Cron Jobs across all namespaces")
+		return httperror.InternalServerError("unable to fetch Cron Jobs. Error: ", err)
+	}
+
+	return response.JSON(w, cronJobs)
+}
+
+// @id DeleteCronJobs
+// @summary Delete Cron Jobs
+// @description Delete the provided list of Cron Jobs.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @accept json
+// @param id path int true "Environment identifier"
+// @param payload body models.K8sCronJobDeleteRequests true "A map where the key is the namespace and the value is an array of Cron Jobs to delete"
+// @success 204 "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier or unable to find a specific service account."
+// @failure 500 "Server error occurred while attempting to delete Cron Jobs."
+// @router /kubernetes/{id}/cron_jobs/delete [POST]
+func (handler *Handler) deleteKubernetesCronJobs(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	var payload models.K8sCronJobDeleteRequests
+	err := request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	cli, handlerErr := handler.getProxyKubeClient(r)
+	if handlerErr != nil {
+		return handlerErr
+	}
+
+	err = cli.DeleteCronJobs(payload)
+	if err != nil {
+		return httperror.InternalServerError("Unable to delete Cron Jobs", err)
+	}
+
+	return response.Empty(w)
+}
diff --git a/api/http/handler/kubernetes/dashboard.go b/api/http/handler/kubernetes/dashboard.go
new file mode 100644
index 0000000..b27790f
--- /dev/null
+++ b/api/http/handler/kubernetes/dashboard.go
@@ -0,0 +1,36 @@
+package kubernetes
+
+import (
+	"net/http"
+
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id GetKubernetesDashboard
+// @summary Get the dashboard summary data
+// @description Get the dashboard summary data which is simply a count of a range of different commonly used kubernetes resources.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @accept json
+// @produce json
+// @param id path int true "Environment (Endpoint) identifier"
+// @success 200 {array} kubernetes.K8sDashboard "Success"
+// @failure 400 "Invalid request"
+// @failure 500 "Server error"
+// @router /kubernetes/{id}/dashboard [get]
+func (handler *Handler) getKubernetesDashboard(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+
+	cli, httpErr := handler.getProxyKubeClient(r)
+	if httpErr != nil {
+		return httpErr
+	}
+
+	dashboard, err := cli.GetDashboard()
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve dashboard data", err)
+	}
+
+	return response.JSON(w, dashboard)
+}
diff --git a/api/http/handler/kubernetes/deprecated_routes.go b/api/http/handler/kubernetes/deprecated_routes.go
new file mode 100644
index 0000000..e471c2e
--- /dev/null
+++ b/api/http/handler/kubernetes/deprecated_routes.go
@@ -0,0 +1,54 @@
+package kubernetes
+
+import (
+	"bytes"
+	"io"
+	"net/http"
+
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+)
+
+// @id UpdateKubernetesNamespaceDeprecated
+// @summary Update a namespace
+// @description Update a namespace within the given environment.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @accept json
+// @produce json
+// @param id path int true "Environment identifier"
+// @param namespace path string true "Namespace"
+// @param body body models.K8sNamespaceDetails true "Namespace details"
+// @success 200 {object} portainer.K8sNamespaceInfo "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier or unable to find a specific namespace."
+// @failure 500 "Server error occurred while attempting to update the namespace."
+// @router /kubernetes/{id}/namespaces [put]
+func deprecatedNamespaceParser(w http.ResponseWriter, r *http.Request) (string, *httperror.HandlerError) {
+	environmentId, err := request.RetrieveRouteVariableValue(r, "id")
+	if err != nil {
+		return "", httperror.BadRequest("Invalid query parameter: id", err)
+	}
+
+	// Restore the original body for further use
+	bodyBytes, err := io.ReadAll(r.Body)
+	if err != nil {
+		return "", httperror.InternalServerError("Unable to read request body", err)
+	}
+
+	r.Body = io.NopCloser(bytes.NewBuffer(bodyBytes))
+
+	payload := models.K8sNamespaceDetails{}
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return "", httperror.BadRequest("Invalid request. Unable to parse namespace payload", err)
+	}
+	namespaceName := payload.Name
+
+	r.Body = io.NopCloser(bytes.NewBuffer(bodyBytes))
+
+	return "/kubernetes/" + environmentId + "/namespaces/" + namespaceName, nil
+}
diff --git a/api/http/handler/kubernetes/describe.go b/api/http/handler/kubernetes/describe.go
new file mode 100644
index 0000000..ce8f174
--- /dev/null
+++ b/api/http/handler/kubernetes/describe.go
@@ -0,0 +1,73 @@
+package kubernetes
+
+import (
+	"net/http"
+
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/portainer/portainer/pkg/libkubectl"
+	"github.com/rs/zerolog/log"
+)
+
+type describeResourceResponse struct {
+	Describe string `json:"describe"`
+}
+
+// @id DescribeResource
+// @summary Get a description of a kubernetes resource
+// @description Get a description of a kubernetes resource.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @param name query string true "Resource name"
+// @param kind query string true "Resource kind"
+// @param namespace query string false "Namespace"
+// @success 200 {object} describeResourceResponse "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier."
+// @failure 500 "Server error occurred while attempting to retrieve resource description"
+// @router /kubernetes/{id}/describe [get]
+func (handler *Handler) describeResource(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	name, err := request.RetrieveQueryParameter(r, "name", false)
+	if err != nil {
+		log.Error().Err(err).Str("context", "describeResource").Msg("Invalid query parameter name")
+		return httperror.BadRequest("an error occurred during the describeResource operation, invalid query parameter name. Error: ", err)
+	}
+
+	kind, err := request.RetrieveQueryParameter(r, "kind", false)
+	if err != nil {
+		log.Error().Err(err).Str("context", "describeResource").Msg("Invalid query parameter kind")
+		return httperror.BadRequest("an error occurred during the describeResource operation, invalid query parameter kind. Error: ", err)
+	}
+
+	namespace, err := request.RetrieveQueryParameter(r, "namespace", true)
+	if err != nil {
+		log.Error().Err(err).Str("context", "describeResource").Msg("Invalid query parameter namespace")
+		return httperror.BadRequest("an error occurred during the describeResource operation, invalid query parameter namespace. Error: ", err)
+	}
+
+	// fetches the token and the correct server URL for the endpoint, similar to getHelmClusterAccess
+	libKubectlAccess, err := handler.getLibKubectlAccess(r)
+	if err != nil {
+		return httperror.InternalServerError("an error occurred during the describeResource operation, failed to get libKubectlAccess. Error: ", err)
+	}
+
+	client, err := libkubectl.NewClient(libKubectlAccess, namespace, "", true)
+	if err != nil {
+		log.Error().Err(err).Str("context", "describeResource").Msg("Failed to create kubernetes client")
+		return httperror.InternalServerError("an error occurred during the describeResource operation, failed to create kubernetes client. Error: ", err)
+	}
+
+	out, err := client.Describe(namespace, name, kind)
+	if err != nil {
+		log.Error().Err(err).Str("context", "describeResource").Msg("Failed to describe kubernetes resource")
+		return httperror.InternalServerError("an error occurred during the describeResource operation, failed to describe kubernetes resource. Error: ", err)
+	}
+
+	return response.JSON(w, describeResourceResponse{Describe: out})
+}
diff --git a/api/http/handler/kubernetes/endpoint_authorization_test.go b/api/http/handler/kubernetes/endpoint_authorization_test.go
new file mode 100644
index 0000000..77eb969
--- /dev/null
+++ b/api/http/handler/kubernetes/endpoint_authorization_test.go
@@ -0,0 +1,124 @@
+package kubernetes
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+	"github.com/portainer/portainer/api/jwt"
+	"github.com/portainer/portainer/api/kubernetes"
+	kubeclient "github.com/portainer/portainer/api/kubernetes/cli"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// denyingBouncer satisfies security.BouncerService but rejects AuthorizedEndpointOperation.
+type denyingBouncer struct{}
+
+func (denyingBouncer) PublicAccess(h http.Handler) http.Handler         { return h }
+func (denyingBouncer) AdminAccess(h http.Handler) http.Handler          { return h }
+func (denyingBouncer) RestrictedAccess(h http.Handler) http.Handler     { return h }
+func (denyingBouncer) TeamLeaderAccess(h http.Handler) http.Handler     { return h }
+func (denyingBouncer) AuthenticatedAccess(h http.Handler) http.Handler  { return h }
+func (denyingBouncer) EdgeComputeOperation(h http.Handler) http.Handler { return h }
+func (denyingBouncer) AuthorizedEndpointOperation(_ *http.Request, _ *portainer.Endpoint) error {
+	return security.ErrAuthorizationRequired
+}
+func (denyingBouncer) AuthorizedEdgeEndpointOperation(_ *http.Request, _ *portainer.Endpoint) error {
+	return nil
+}
+func (denyingBouncer) CookieAuthLookup(*http.Request) (*portainer.TokenData, error) { return nil, nil }
+func (denyingBouncer) JWTAuthLookup(*http.Request) (*portainer.TokenData, error)    { return nil, nil }
+func (denyingBouncer) TrustedEdgeEnvironmentAccess(dataservices.DataStoreTx, *portainer.Endpoint) error {
+	return nil
+}
+func (denyingBouncer) RevokeJWT(string) {}
+func (denyingBouncer) DisableCSP()      {}
+
+func newEndpointAuthTestHandler(t *testing.T, bouncer security.BouncerService) (*Handler, *portainer.User, string) {
+	t.Helper()
+
+	srv := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{}`))
+	}))
+	t.Cleanup(srv.Close)
+
+	_, store := datastore.MustNewTestStore(t, true, true)
+
+	err := store.Endpoint().Create(&portainer.Endpoint{
+		ID:   1,
+		Type: portainer.KubernetesLocalEnvironment,
+	})
+	require.NoError(t, err)
+
+	u := &portainer.User{Username: "user", Role: portainer.StandardUserRole}
+	err = store.User().Create(u)
+	require.NoError(t, err)
+
+	jwtService, err := jwt.NewService("1h", store)
+	require.NoError(t, err)
+
+	tk, _, err := jwtService.GenerateToken(&portainer.TokenData{ID: u.ID, Username: u.Username, Role: u.Role})
+	require.NoError(t, err)
+
+	kubeClusterAccessService := kubernetes.NewKubeClusterAccessService("", "", "")
+
+	srvURL, err := url.Parse(srv.URL)
+	require.NoError(t, err)
+
+	cli := testhelpers.NewKubernetesClient()
+	factory, err := kubeclient.NewClientFactory(nil, nil, store, "", ":"+srvURL.Port(), "")
+	require.NoError(t, err)
+
+	authorizationService := authorization.NewService(store)
+	handler := NewHandler(bouncer, authorizationService, store, jwtService, kubeClusterAccessService, factory, cli)
+
+	return handler, u, tk
+}
+
+func newEndpointAuthRequest(t *testing.T, method, path string, u *portainer.User, tk string) *http.Request {
+	t.Helper()
+
+	req := httptest.NewRequest(method, path, nil)
+	ctx := security.StoreTokenData(req, &portainer.TokenData{ID: u.ID, Username: u.Username, Role: u.Role})
+	req = req.WithContext(ctx)
+	ctx = security.StoreRestrictedRequestContext(req, &security.RestrictedRequestContext{IsAdmin: false, UserID: u.ID})
+	req = req.WithContext(ctx)
+	testhelpers.AddTestSecurityCookie(req, tk)
+	return req
+}
+
+func TestEndpointAuthorization_DeniedUser_Returns403(t *testing.T) {
+	t.Parallel()
+
+	routes := []struct {
+		method string
+		path   string
+	}{
+		{http.MethodGet, "/kubernetes/1/namespaces"},
+		{http.MethodGet, "/kubernetes/1/configmaps"},
+		{http.MethodGet, "/kubernetes/1/services"},
+		{http.MethodGet, "/kubernetes/1/secrets"},
+		{http.MethodGet, "/kubernetes/1/ingresses"},
+	}
+
+	handler, u, tk := newEndpointAuthTestHandler(t, denyingBouncer{})
+
+	for _, route := range routes {
+		t.Run(route.method+" "+route.path, func(t *testing.T) {
+			req := newEndpointAuthRequest(t, route.method, route.path, u, tk)
+			rr := httptest.NewRecorder()
+			handler.ServeHTTP(rr, req)
+
+			assert.Equal(t, http.StatusForbidden, rr.Code)
+		})
+	}
+}
diff --git a/api/http/handler/kubernetes/event.go b/api/http/handler/kubernetes/event.go
new file mode 100644
index 0000000..25f0243
--- /dev/null
+++ b/api/http/handler/kubernetes/event.go
@@ -0,0 +1,102 @@
+package kubernetes
+
+import (
+	"net/http"
+
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/rs/zerolog/log"
+	k8serrors "k8s.io/apimachinery/pkg/api/errors"
+)
+
+// @id getKubernetesEventsForNamespace
+// @summary Gets kubernetes events for namespace
+// @description Get events by optional query param resourceId for a given namespace.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @param namespace path string true "The namespace name the events are associated to"
+// @param resourceId query string false "The resource id of the involved kubernetes object" example:"e5b021b6-4bce-4c06-bd3b-6cca906797aa"
+// @success 200 {object} []kubernetes.K8sEvent "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 500 "Server error occurred while attempting to retrieve the events within the specified namespace."
+// @router /kubernetes/{id}/namespaces/{namespace}/events [get]
+func (handler *Handler) getKubernetesEventsForNamespace(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	namespace, err := request.RetrieveRouteVariableValue(r, "namespace")
+	if err != nil {
+		log.Error().Err(err).Str("context", "getKubernetesEvents").Str("namespace", namespace).Msg("Unable to retrieve namespace identifier route variable")
+		return httperror.BadRequest("Unable to retrieve namespace identifier route variable", err)
+	}
+
+	resourceId, err := request.RetrieveQueryParameter(r, "resourceId", true)
+	if err != nil {
+		log.Error().Err(err).Str("context", "getKubernetesEvents").Msg("Unable to retrieve resourceId query parameter")
+		return httperror.BadRequest("Unable to retrieve resourceId query parameter", err)
+	}
+
+	cli, httpErr := handler.getProxyKubeClient(r)
+	if httpErr != nil {
+		log.Error().Err(httpErr).Str("context", "getKubernetesEvents").Str("resourceId", resourceId).Msg("Unable to get a Kubernetes client for the user")
+		return httperror.InternalServerError("Unable to get a Kubernetes client for the user", httpErr)
+	}
+
+	events, err := cli.GetEvents(namespace, resourceId)
+	if err != nil {
+		if k8serrors.IsUnauthorized(err) || k8serrors.IsForbidden(err) {
+			log.Error().Err(err).Str("context", "getKubernetesEvents").Msg("Unauthorized access to the Kubernetes API")
+			return httperror.Forbidden("Unauthorized access to the Kubernetes API", err)
+		}
+
+		log.Error().Err(err).Str("context", "getKubernetesEvents").Msg("Unable to retrieve events")
+		return httperror.InternalServerError("Unable to retrieve events", err)
+	}
+
+	return response.JSON(w, events)
+}
+
+// @id getAllKubernetesEvents
+// @summary Gets kubernetes events
+// @description Get events by query param resourceId
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @param resourceId query string false "The resource id of the involved kubernetes object"  example:"e5b021b6-4bce-4c06-bd3b-6cca906797aa"
+// @success 200 {object} []kubernetes.K8sEvent "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 500 "Server error occurred while attempting to retrieve the events."
+// @router /kubernetes/{id}/events [get]
+func (handler *Handler) getAllKubernetesEvents(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	resourceId, err := request.RetrieveQueryParameter(r, "resourceId", true)
+	if err != nil {
+		log.Error().Err(err).Str("context", "getKubernetesEvents").Msg("Unable to retrieve resourceId query parameter")
+		return httperror.BadRequest("Unable to retrieve resourceId query parameter", err)
+	}
+
+	cli, httpErr := handler.getProxyKubeClient(r)
+	if httpErr != nil {
+		log.Error().Err(httpErr).Str("context", "getKubernetesEvents").Str("resourceId", resourceId).Msg("Unable to get a Kubernetes client for the user")
+		return httperror.InternalServerError("Unable to get a Kubernetes client for the user", httpErr)
+	}
+
+	events, err := cli.GetEvents("", resourceId)
+	if err != nil {
+		if k8serrors.IsUnauthorized(err) || k8serrors.IsForbidden(err) {
+			log.Error().Err(err).Str("context", "getKubernetesEvents").Msg("Unauthorized access to the Kubernetes API")
+			return httperror.Forbidden("Unauthorized access to the Kubernetes API", err)
+		}
+
+		log.Error().Err(err).Str("context", "getKubernetesEvents").Msg("Unable to retrieve events")
+		return httperror.InternalServerError("Unable to retrieve events", err)
+	}
+
+	return response.JSON(w, events)
+}
diff --git a/api/http/handler/kubernetes/event_test.go b/api/http/handler/kubernetes/event_test.go
new file mode 100644
index 0000000..2c46cd2
--- /dev/null
+++ b/api/http/handler/kubernetes/event_test.go
@@ -0,0 +1,75 @@
+package kubernetes
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+	"github.com/portainer/portainer/api/jwt"
+	"github.com/portainer/portainer/api/kubernetes"
+	kubeclient "github.com/portainer/portainer/api/kubernetes/cli"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// Currently this test just tests the HTTP Handler is setup correctly, in the future we should move the ClientFactory to a mock in order
+// test the logic in event.go
+func TestGetKubernetesEvents(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	srv := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{}`))
+	}))
+	defer srv.Close()
+
+	_, store := datastore.MustNewTestStore(t, true, true)
+
+	err := store.Endpoint().Create(&portainer.Endpoint{ID: 1, Type: portainer.AgentOnKubernetesEnvironment})
+	require.NoError(t, err, "error creating environment")
+
+	u := &portainer.User{Username: "admin", Role: portainer.AdministratorRole}
+	err = store.User().Create(u)
+	require.NoError(t, err, "error creating a user")
+
+	jwtService, err := jwt.NewService("1h", store)
+	require.NoError(t, err, "Error initiating jwt service")
+
+	tk, _, err := jwtService.GenerateToken(&portainer.TokenData{ID: u.ID, Username: u.Username, Role: u.Role})
+	require.NoError(t, err)
+
+	kubeClusterAccessService := kubernetes.NewKubeClusterAccessService("", "", "")
+
+	srvURL, err := url.Parse(srv.URL)
+	require.NoError(t, err)
+
+	cli := testhelpers.NewKubernetesClient()
+	factory, err := kubeclient.NewClientFactory(nil, nil, store, "", ":"+srvURL.Port(), "")
+	require.NoError(t, err)
+
+	authorizationService := authorization.NewService(store)
+	handler := NewHandler(testhelpers.NewTestRequestBouncer(), authorizationService, store, jwtService, kubeClusterAccessService, factory, cli)
+	is.NotNil(handler, "Handler should not fail")
+
+	req := httptest.NewRequest(http.MethodGet, "/kubernetes/1/events?resourceId=8", nil)
+	ctx := security.StoreTokenData(req, &portainer.TokenData{ID: u.ID, Username: u.Username, Role: u.Role})
+	req = req.WithContext(ctx)
+
+	ctx = security.StoreRestrictedRequestContext(req, &security.RestrictedRequestContext{UserID: u.ID, IsAdmin: true})
+	req = req.WithContext(ctx)
+
+	testhelpers.AddTestSecurityCookie(req, tk)
+
+	rr := httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+
+	is.Equal(http.StatusOK, rr.Code, "Status should be 200")
+}
diff --git a/api/http/handler/kubernetes/handler.go b/api/http/handler/kubernetes/handler.go
new file mode 100644
index 0000000..c8a429d
--- /dev/null
+++ b/api/http/handler/kubernetes/handler.go
@@ -0,0 +1,332 @@
+package kubernetes
+
+import (
+	"fmt"
+	"net/http"
+	"net/url"
+	"strconv"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/middlewares"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/kubernetes"
+	"github.com/portainer/portainer/api/kubernetes/cli"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libkubectl"
+	"github.com/rs/zerolog/log"
+
+	"github.com/gorilla/mux"
+)
+
+// Handler is the HTTP handler which will natively deal with to external environments(endpoints).
+type Handler struct {
+	*mux.Router
+	authorizationService     *authorization.Service
+	DataStore                dataservices.DataStore
+	KubernetesClientFactory  *cli.ClientFactory
+	JwtService               portainer.JWTService
+	kubeClusterAccessService kubernetes.KubeClusterAccessService
+}
+
+// NewHandler creates a handler to process pre-proxied requests to external APIs.
+func NewHandler(bouncer security.BouncerService, authorizationService *authorization.Service, dataStore dataservices.DataStore, jwtService portainer.JWTService, kubeClusterAccessService kubernetes.KubeClusterAccessService, kubernetesClientFactory *cli.ClientFactory, kubernetesClient portainer.KubeClient) *Handler {
+	h := &Handler{
+		Router:                   mux.NewRouter(),
+		authorizationService:     authorizationService,
+		DataStore:                dataStore,
+		JwtService:               jwtService,
+		kubeClusterAccessService: kubeClusterAccessService,
+		KubernetesClientFactory:  kubernetesClientFactory,
+	}
+
+	kubeRouter := h.PathPrefix("/kubernetes").Subrouter()
+	kubeRouter.Use(bouncer.AuthenticatedAccess)
+	kubeRouter.PathPrefix("/config").Handler(
+		bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.getKubernetesConfig))).Methods(http.MethodGet)
+
+	// endpoints
+	endpointRouter := kubeRouter.PathPrefix("/{id}").Subrouter()
+	endpointRouter.Use(middlewares.WithEndpoint(dataStore.Endpoint(), "id"))
+	endpointRouter.Use(middlewares.CheckEndpointAuthorization(bouncer))
+	endpointRouter.Use(h.kubeClientMiddleware)
+
+	endpointRouter.Handle("/applications", httperror.LoggerHandler(h.GetAllKubernetesApplications)).Methods(http.MethodGet)
+	endpointRouter.Handle("/applications/count", httperror.LoggerHandler(h.getAllKubernetesApplicationsCount)).Methods(http.MethodGet)
+	endpointRouter.Handle("/configmaps", httperror.LoggerHandler(h.GetAllKubernetesConfigMaps)).Methods(http.MethodGet)
+	endpointRouter.Handle("/configmaps/count", httperror.LoggerHandler(h.getAllKubernetesConfigMapsCount)).Methods(http.MethodGet)
+	endpointRouter.Handle("/cron_jobs", httperror.LoggerHandler(h.getAllKubernetesCronJobs)).Methods(http.MethodGet)
+	endpointRouter.Handle("/cron_jobs/delete", httperror.LoggerHandler(h.deleteKubernetesCronJobs)).Methods(http.MethodPost)
+	endpointRouter.Handle("/events", httperror.LoggerHandler(h.getAllKubernetesEvents)).Methods(http.MethodGet)
+	endpointRouter.Handle("/jobs", httperror.LoggerHandler(h.getAllKubernetesJobs)).Methods(http.MethodGet)
+	endpointRouter.Handle("/jobs/delete", httperror.LoggerHandler(h.deleteKubernetesJobs)).Methods(http.MethodPost)
+	endpointRouter.Handle("/cluster_roles", httperror.LoggerHandler(h.getAllKubernetesClusterRoles)).Methods(http.MethodGet)
+	endpointRouter.Handle("/cluster_roles/delete", httperror.LoggerHandler(h.deleteClusterRoles)).Methods(http.MethodPost)
+	endpointRouter.Handle("/cluster_role_bindings", httperror.LoggerHandler(h.getAllKubernetesClusterRoleBindings)).Methods(http.MethodGet)
+	endpointRouter.Handle("/cluster_role_bindings/delete", httperror.LoggerHandler(h.deleteClusterRoleBindings)).Methods(http.MethodPost)
+	endpointRouter.Handle("/configmaps", httperror.LoggerHandler(h.GetAllKubernetesConfigMaps)).Methods(http.MethodGet)
+	endpointRouter.Handle("/configmaps/count", httperror.LoggerHandler(h.getAllKubernetesConfigMapsCount)).Methods(http.MethodGet)
+	endpointRouter.Handle("/dashboard", httperror.LoggerHandler(h.getKubernetesDashboard)).Methods(http.MethodGet)
+	endpointRouter.Handle("/nodes_limits", httperror.LoggerHandler(h.getKubernetesNodesLimits)).Methods(http.MethodGet)
+	endpointRouter.Handle("/max_resource_limits", httperror.LoggerHandler(h.getKubernetesMaxResourceLimits)).Methods(http.MethodGet)
+	endpointRouter.Handle("/metrics/applications_resources", httperror.LoggerHandler(h.getApplicationsResources)).Methods(http.MethodGet)
+	endpointRouter.Handle("/metrics/nodes", httperror.LoggerHandler(h.getKubernetesMetricsForAllNodes)).Methods(http.MethodGet)
+	endpointRouter.Handle("/metrics/nodes/{name}", httperror.LoggerHandler(h.getKubernetesMetricsForNode)).Methods(http.MethodGet)
+	endpointRouter.Handle("/metrics/pods/namespace/{namespace}", httperror.LoggerHandler(h.getKubernetesMetricsForAllPods)).Methods(http.MethodGet)
+	endpointRouter.Handle("/metrics/pods/namespace/{namespace}/{name}", httperror.LoggerHandler(h.getKubernetesMetricsForPod)).Methods(http.MethodGet)
+	endpointRouter.Handle("/ingresscontrollers", httperror.LoggerHandler(h.getAllKubernetesIngressControllers)).Methods(http.MethodGet)
+	endpointRouter.Handle("/ingresscontrollers", httperror.LoggerHandler(h.updateKubernetesIngressControllers)).Methods(http.MethodPut)
+	endpointRouter.Handle("/ingresses/delete", httperror.LoggerHandler(h.deleteKubernetesIngresses)).Methods(http.MethodPost)
+	endpointRouter.Handle("/ingresses", httperror.LoggerHandler(h.GetAllKubernetesClusterIngresses)).Methods(http.MethodGet)
+	endpointRouter.Handle("/ingresses/count", httperror.LoggerHandler(h.getAllKubernetesClusterIngressesCount)).Methods(http.MethodGet)
+	endpointRouter.Handle("/services", httperror.LoggerHandler(h.GetAllKubernetesServices)).Methods(http.MethodGet)
+	endpointRouter.Handle("/services/count", httperror.LoggerHandler(h.getAllKubernetesServicesCount)).Methods(http.MethodGet)
+	endpointRouter.Handle("/secrets", httperror.LoggerHandler(h.GetAllKubernetesSecrets)).Methods(http.MethodGet)
+	endpointRouter.Handle("/secrets/count", httperror.LoggerHandler(h.getAllKubernetesSecretsCount)).Methods(http.MethodGet)
+	endpointRouter.Handle("/services/delete", httperror.LoggerHandler(h.deleteKubernetesServices)).Methods(http.MethodPost)
+	endpointRouter.Handle("/rbac_enabled", httperror.LoggerHandler(h.getKubernetesRBACStatus)).Methods(http.MethodGet)
+	endpointRouter.Handle("/namespaces", httperror.LoggerHandler(h.createKubernetesNamespace)).Methods(http.MethodPost)
+	endpointRouter.Handle("/namespaces", httperror.LoggerHandler(h.deleteKubernetesNamespace)).Methods(http.MethodDelete)
+	endpointRouter.Handle("/namespaces", httperror.LoggerHandler(h.getKubernetesNamespaces)).Methods(http.MethodGet)
+	endpointRouter.Handle("/namespaces/count", httperror.LoggerHandler(h.getKubernetesNamespacesCount)).Methods(http.MethodGet)
+	endpointRouter.Handle("/namespaces/{namespace}", httperror.LoggerHandler(h.getKubernetesNamespace)).Methods(http.MethodGet)
+	endpointRouter.Handle("/namespaces/{namespace}", httperror.LoggerHandler(h.updateKubernetesNamespace)).Methods(http.MethodPut)
+	endpointRouter.Handle("/volumes", httperror.LoggerHandler(h.GetAllKubernetesVolumes)).Methods(http.MethodGet)
+	endpointRouter.Handle("/volumes/count", httperror.LoggerHandler(h.getAllKubernetesVolumesCount)).Methods(http.MethodGet)
+	endpointRouter.Handle("/persistent_volumes", httperror.LoggerHandler(h.getAllKubernetesPersistentVolumes)).Methods(http.MethodGet)
+	endpointRouter.Handle("/persistent_volumes/delete", httperror.LoggerHandler(h.deleteKubernetesPersistentVolumes)).Methods(http.MethodPost)
+	endpointRouter.Handle("/persistent_volumes/reclaim_policy", httperror.LoggerHandler(h.updateKubernetesPVReclaimPolicy)).Methods(http.MethodPut)
+	endpointRouter.Handle("/persistent_volumes/{name}", httperror.LoggerHandler(h.getKubernetesPersistentVolume)).Methods(http.MethodGet)
+	endpointRouter.Handle("/persistent_volume_claims", httperror.LoggerHandler(h.getAllKubernetesPersistentVolumeClaims)).Methods(http.MethodGet)
+	endpointRouter.Handle("/persistent_volume_claims/delete", httperror.LoggerHandler(h.deleteKubernetesPersistentVolumeClaims)).Methods(http.MethodPost)
+	endpointRouter.Handle("/persistent_volume_claims/resize", httperror.LoggerHandler(h.resizeKubernetesPersistentVolumeClaim)).Methods(http.MethodPut)
+	endpointRouter.Handle("/storage_classes", httperror.LoggerHandler(h.getAllKubernetesStorageClasses)).Methods(http.MethodGet)
+	endpointRouter.Handle("/storage_classes/delete", httperror.LoggerHandler(h.deleteKubernetesStorageClasses)).Methods(http.MethodPost)
+	endpointRouter.Handle("/storage_classes/{name}", httperror.LoggerHandler(h.getKubernetesStorageClass)).Methods(http.MethodGet)
+	endpointRouter.Handle("/storage_classes/{name}/default", httperror.LoggerHandler(h.setDefaultKubernetesStorageClass)).Methods(http.MethodPut)
+	endpointRouter.Handle("/service_accounts", httperror.LoggerHandler(h.getAllKubernetesServiceAccounts)).Methods(http.MethodGet)
+	endpointRouter.Handle("/service_accounts/delete", httperror.LoggerHandler(h.deleteKubernetesServiceAccounts)).Methods(http.MethodPost)
+	endpointRouter.Handle("/roles", httperror.LoggerHandler(h.getAllKubernetesRoles)).Methods(http.MethodGet)
+	endpointRouter.Handle("/roles/delete", httperror.LoggerHandler(h.deleteRoles)).Methods(http.MethodPost)
+	endpointRouter.Handle("/role_bindings", httperror.LoggerHandler(h.getAllKubernetesRoleBindings)).Methods(http.MethodGet)
+	endpointRouter.Handle("/role_bindings/delete", httperror.LoggerHandler(h.deleteRoleBindings)).Methods(http.MethodPost)
+	endpointRouter.Handle("/cluster_roles", httperror.LoggerHandler(h.getAllKubernetesClusterRoles)).Methods(http.MethodGet)
+	endpointRouter.Handle("/cluster_roles/delete", httperror.LoggerHandler(h.deleteClusterRoles)).Methods(http.MethodPost)
+	endpointRouter.Handle("/cluster_role_bindings", httperror.LoggerHandler(h.getAllKubernetesClusterRoleBindings)).Methods(http.MethodGet)
+	endpointRouter.Handle("/cluster_role_bindings/delete", httperror.LoggerHandler(h.deleteClusterRoleBindings)).Methods(http.MethodPost)
+	endpointRouter.Handle("/describe", httperror.LoggerHandler(h.describeResource)).Methods(http.MethodGet)
+	endpointRouter.Handle("/nodes", httperror.LoggerHandler(h.getKubernetesNodes)).Methods(http.MethodGet)
+	endpointRouter.Handle("/nodes/{name}/drain", httperror.LoggerHandler(h.drainNode)).Methods(http.MethodPost)
+	endpointRouter.Handle("/version", httperror.LoggerHandler(h.getKubernetesVersion)).Methods(http.MethodGet)
+
+	// namespaces
+	// in the future this piece of code might be in another package (or a few different packages - namespaces/namespace?)
+	// to keep it simple, we've decided to leave it like this.
+	namespaceRouter := endpointRouter.PathPrefix("/namespaces/{namespace}").Subrouter()
+	namespaceRouter.Handle("/configmaps/{configmap}", httperror.LoggerHandler(h.getKubernetesConfigMap)).Methods(http.MethodGet)
+	namespaceRouter.Handle("/events", httperror.LoggerHandler(h.getKubernetesEventsForNamespace)).Methods(http.MethodGet)
+	namespaceRouter.Handle("/system", bouncer.AdminAccess(httperror.LoggerHandler(h.namespacesToggleSystem))).Methods(http.MethodPut)
+	namespaceRouter.Handle("/ingresscontrollers", httperror.LoggerHandler(h.getKubernetesIngressControllersByNamespace)).Methods(http.MethodGet)
+	namespaceRouter.Handle("/ingresscontrollers", httperror.LoggerHandler(h.updateKubernetesIngressControllersByNamespace)).Methods(http.MethodPut)
+	namespaceRouter.Handle("/ingresses/{ingress}", httperror.LoggerHandler(h.getKubernetesIngress)).Methods(http.MethodGet)
+	namespaceRouter.Handle("/ingresses", httperror.LoggerHandler(h.createKubernetesIngress)).Methods(http.MethodPost)
+	namespaceRouter.Handle("/ingresses", httperror.LoggerHandler(h.updateKubernetesIngress)).Methods(http.MethodPut)
+	namespaceRouter.Handle("/ingresses", httperror.LoggerHandler(h.getKubernetesIngresses)).Methods(http.MethodGet)
+	namespaceRouter.Handle("/secrets/{secret}", httperror.LoggerHandler(h.getKubernetesSecret)).Methods(http.MethodGet)
+	namespaceRouter.Handle("/services", httperror.LoggerHandler(h.createKubernetesService)).Methods(http.MethodPost)
+	namespaceRouter.Handle("/services", httperror.LoggerHandler(h.updateKubernetesService)).Methods(http.MethodPut)
+	namespaceRouter.Handle("/services", httperror.LoggerHandler(h.getKubernetesServicesByNamespace)).Methods(http.MethodGet)
+	namespaceRouter.Handle("/service_accounts/{name}", httperror.LoggerHandler(h.getKubernetesServiceAccount)).Methods(http.MethodGet)
+	namespaceRouter.Handle("/service_accounts/{name}/image_pull_secrets", httperror.LoggerHandler(h.updateKubernetesServiceAccountImagePullSecrets)).Methods(http.MethodPut)
+	namespaceRouter.Handle("/volumes", httperror.LoggerHandler(h.GetKubernetesVolumesInNamespace)).Methods(http.MethodGet)
+	namespaceRouter.Handle("/volumes/{volume}", httperror.LoggerHandler(h.getKubernetesVolume)).Methods(http.MethodGet)
+	namespaceRouter.Handle("/persistent_volume_claims", httperror.LoggerHandler(h.getKubernetesPVCsInNamespace)).Methods(http.MethodGet)
+	namespaceRouter.Handle("/persistent_volume_claims/{name}", httperror.LoggerHandler(h.getKubernetesPersistentVolumeClaim)).Methods(http.MethodGet)
+	namespaceRouter.Handle("/pods/{name}", httperror.LoggerHandler(h.deleteKubernetesPod)).Methods(http.MethodDelete)
+	namespaceRouter.Handle("/pods/{name}/restart", httperror.LoggerHandler(h.restartKubernetesPod)).Methods(http.MethodPost)
+
+	// Deprecated
+	endpointRouter.Handle("/namespaces", middlewares.Deprecated(endpointRouter, deprecatedNamespaceParser)).Methods(http.MethodPut)
+
+	return h
+}
+
+// getProxyKubeClient gets a kubeclient for the user.  It's generally what you want as it retrieves the kubeclient
+// from the Authorization token of the currently logged in user.  The kubeclient that is not from the proxy is actually using
+// admin permissions.  If you're unsure which one to use, use this.
+func (h *Handler) getProxyKubeClient(r *http.Request) (portainer.KubeClient, *httperror.HandlerError) {
+	endpointID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return nil, httperror.BadRequest(fmt.Sprintf("an error occurred during the getProxyKubeClient operation, the environment identifier route variable is invalid for /api/kubernetes/%d. Error: ", endpointID), err)
+	}
+
+	tokenData, err := security.RetrieveTokenData(r)
+	if err != nil {
+		return nil, httperror.Forbidden(fmt.Sprintf("an error occurred during the getProxyKubeClient operation, permission denied to access the environment /api/kubernetes/%d. Error: ", endpointID), err)
+	}
+
+	cli, ok := h.KubernetesClientFactory.GetProxyKubeClient(strconv.Itoa(endpointID), strconv.Itoa(int(tokenData.ID)))
+	if !ok {
+		return nil, httperror.InternalServerError("an error occurred during the getProxyKubeClient operation,failed to get proxy KubeClient", nil)
+	}
+
+	return cli, nil
+}
+
+// kubeClientMiddleware is a middleware that will create a kubeclient for the user if it doesn't exist
+// and store it in the factory for future use.
+// if there is a kubeclient against this auth token already, the existing one will be reused.
+// otherwise, generate a new one
+func (handler *Handler) kubeClientMiddleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set(portainer.PortainerCacheHeader, "true")
+
+		if handler.KubernetesClientFactory == nil {
+			next.ServeHTTP(w, r)
+			return
+		}
+
+		endpointID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+		if err != nil {
+			httperror.WriteError(w, http.StatusBadRequest, fmt.Sprintf("an error occurred during the KubeClientMiddleware operation, the environment identifier route variable is invalid for /api/kubernetes/%d. Error: ", endpointID), err)
+			return
+		}
+
+		tokenData, err := security.RetrieveTokenData(r)
+		if err != nil {
+			httperror.WriteError(w, http.StatusForbidden, "an error occurred during the KubeClientMiddleware operation, permission denied to access the environment. Error: ", err)
+			return
+		}
+
+		// Check if we have a kubeclient against this auth token already, otherwise generate a new one
+		_, ok := handler.KubernetesClientFactory.GetProxyKubeClient(strconv.Itoa(endpointID), strconv.Itoa(int(tokenData.ID)))
+		if ok {
+			next.ServeHTTP(w, r)
+			return
+		}
+
+		endpoint, err := handler.DataStore.Endpoint().Endpoint(portainer.EndpointID(endpointID))
+		if err != nil {
+			if handler.DataStore.IsErrObjectNotFound(err) {
+				httperror.WriteError(w, http.StatusNotFound,
+					"an error occurred during the KubeClientMiddleware operation, unable to find an environment with the specified environment identifier inside the database. Error: ", err)
+				return
+			}
+
+			httperror.WriteError(w, http.StatusInternalServerError, "an error occurred during the KubeClientMiddleware operation, error reading from the Portainer database. Error: ", err)
+			return
+		}
+
+		user, err := security.RetrieveUserFromRequest(r, handler.DataStore)
+		if err != nil {
+			httperror.WriteError(w, http.StatusInternalServerError, "an error occurred during the KubeClientMiddleware operation, unable to retrieve the user from request. Error: ", err)
+			return
+		}
+		log.
+			Debug().
+			Str("context", "KubeClientMiddleware").
+			Str("endpoint", endpoint.Name).
+			Str("user", user.Username).
+			Msg("Creating a Kubernetes client")
+
+		isKubeAdmin := true
+		nonAdminNamespaces := []string{}
+		if user.Role != portainer.AdministratorRole {
+			pcli, err := handler.KubernetesClientFactory.GetPrivilegedKubeClient(endpoint)
+			if err != nil {
+				httperror.WriteError(w, http.StatusInternalServerError, "an error occurred during the KubeClientMiddleware operation, unable to get privileged kube client to grab all namespaces. Error: ", err)
+				return
+			}
+
+			teamMemberships, err := handler.DataStore.TeamMembership().TeamMembershipsByUserID(user.ID)
+			if err != nil {
+				httperror.WriteError(w, http.StatusInternalServerError, "an error occurred during the KubeClientMiddleware operation, unable to get team memberships for user: ", err)
+				return
+			}
+			teamIDs := []int{}
+			for _, membership := range teamMemberships {
+				teamIDs = append(teamIDs, int(membership.TeamID))
+			}
+
+			nonAdminNamespaces, err = pcli.GetNonAdminNamespaces(int(user.ID), teamIDs, endpoint.Kubernetes.Configuration.RestrictDefaultNamespace)
+			if err != nil {
+				httperror.WriteError(w, http.StatusInternalServerError, "an error occurred during the KubeClientMiddleware operation, unable to retrieve non-admin namespaces. Error: ", err)
+				return
+			}
+			isKubeAdmin = false
+		}
+
+		bearerToken, err := handler.JwtService.GenerateTokenForKubeconfig(tokenData)
+		if err != nil {
+			httperror.WriteError(w, http.StatusInternalServerError, "an error occurred during the KubeClientMiddleware operation, unable to generate token for kubeconfig. Error: ", err)
+			return
+		}
+
+		config := handler.buildConfig(r, tokenData, bearerToken, []portainer.Endpoint{*endpoint}, true)
+		if len(config.Clusters) == 0 {
+			httperror.WriteError(w, http.StatusInternalServerError, "an error occurred during the KubeClientMiddleware operation, unable to build kubeconfig. Error: ", nil)
+			return
+		}
+
+		// Manually setting serverURL to localhost to route the request to proxy server
+		serverURL, err := url.Parse(config.Clusters[0].Cluster.Server)
+		if err != nil {
+			httperror.WriteError(w, http.StatusInternalServerError, "an error occurred during the KubeClientMiddleware operation, unable to parse server URL for building kubeconfig. Error: ", err)
+			return
+		}
+
+		serverURL.Scheme = "https"
+		serverURL.Host = "localhost" + handler.KubernetesClientFactory.GetAddrHTTPS()
+		config.Clusters[0].Cluster.Server = serverURL.String()
+
+		yaml, err := cli.GenerateYAML(config)
+		if err != nil {
+			httperror.WriteError(w, http.StatusInternalServerError, "an error occurred during the KubeClientMiddleware operation, unable to generate kubeconfig YAML. Error: ", err)
+			return
+		}
+
+		kubeCli, err := handler.KubernetesClientFactory.CreateKubeClientFromKubeConfig(endpoint.Name, []byte(yaml), isKubeAdmin, nonAdminNamespaces)
+		if err != nil {
+			httperror.WriteError(w, http.StatusInternalServerError, "an error occurred during the KubeClientMiddleware operation, unable to create kubernetes client from kubeconfig. Error: ", err)
+			return
+		}
+
+		handler.KubernetesClientFactory.SetProxyKubeClient(strconv.Itoa(int(endpoint.ID)), strconv.Itoa(int(tokenData.ID)), kubeCli)
+		next.ServeHTTP(w, r)
+	})
+}
+
+func (handler *Handler) getLibKubectlAccess(r *http.Request) (*libkubectl.ClientAccess, error) {
+	tokenData, err := security.RetrieveTokenData(r)
+	if err != nil {
+		return nil, httperror.InternalServerError("Unable to retrieve user authentication token", err)
+	}
+
+	bearerToken, _, err := handler.JwtService.GenerateToken(tokenData)
+	if err != nil {
+		return nil, httperror.Unauthorized("Unauthorized", err)
+	}
+
+	endpoint, err := middlewares.FetchEndpoint(r)
+	if err != nil {
+		return nil, httperror.InternalServerError("Unable to find the Kubernetes endpoint associated to the request.", err)
+	}
+
+	sslSettings, err := handler.DataStore.SSLSettings().Settings()
+	if err != nil {
+		return nil, httperror.InternalServerError("Unable to retrieve settings from the database", err)
+	}
+
+	hostURL := "localhost"
+	if !sslSettings.SelfSigned {
+		hostURL = r.Host
+	}
+
+	kubeConfigInternal := handler.kubeClusterAccessService.GetClusterDetails(hostURL, endpoint.ID, true)
+	return &libkubectl.ClientAccess{
+		Token:     bearerToken,
+		ServerUrl: kubeConfigInternal.ClusterServerURL,
+	}, nil
+}
diff --git a/api/http/handler/kubernetes/ingresses.go b/api/http/handler/kubernetes/ingresses.go
new file mode 100644
index 0000000..e46d807
--- /dev/null
+++ b/api/http/handler/kubernetes/ingresses.go
@@ -0,0 +1,843 @@
+package kubernetes
+
+import (
+	"net/http"
+	"slices"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/middlewares"
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/rs/zerolog/log"
+	k8serrors "k8s.io/apimachinery/pkg/api/errors"
+)
+
+// @id GetAllKubernetesIngressControllers
+// @summary Get a list of ingress controllers
+// @description Get a list of ingress controllers for the given environment. If the allowedOnly query parameter is set, only ingress controllers that are allowed by the environment's ingress configuration will be returned.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @param allowedOnly query boolean false "Only return allowed ingress controllers"
+// @success 200 {object} models.K8sIngressControllers "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier."
+// @failure 500 "Server error occurred while attempting to retrieve ingress controllers"
+// @router /kubernetes/{id}/ingresscontrollers [get]
+func (handler *Handler) getAllKubernetesIngressControllers(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	allowedOnly, err := request.RetrieveBooleanQueryParameter(r, "allowedOnly", true)
+	if err != nil {
+		log.Error().Err(err).Str("context", "getAllKubernetesIngressControllers").Msg("Invalid allowedOnly boolean query parameter")
+		return httperror.BadRequest("Invalid allowedOnly boolean query parameter", err)
+	}
+
+	// Get endpoint from context (may have policies applied in-memory)
+	endpoint, err := middlewares.FetchEndpoint(r)
+	if err != nil {
+		log.Error().Err(err).Str("context", "getAllKubernetesIngressControllers").Msg("Unable to fetch endpoint")
+		return httperror.InternalServerError(err.Error(), err)
+	}
+
+	cli, err := handler.KubernetesClientFactory.GetPrivilegedKubeClient(endpoint)
+	if err != nil {
+		log.Error().Err(err).Str("context", "getAllKubernetesIngressControllers").Msg("Unable to create Kubernetes client")
+		return httperror.InternalServerError("Unable to create Kubernetes client", err)
+	}
+
+	controllers, err := cli.GetIngressControllers()
+	if err != nil {
+		if k8serrors.IsUnauthorized(err) || k8serrors.IsForbidden(err) {
+			log.Error().Err(err).Str("context", "getAllKubernetesIngressControllers").Msg("Unauthorized access to the Kubernetes API")
+			return httperror.Forbidden("Unauthorized access to the Kubernetes API", err)
+		}
+
+		log.Error().Err(err).Str("context", "getAllKubernetesIngressControllers").Msg("Unable to retrieve ingress controllers from the Kubernetes")
+		return httperror.InternalServerError("Unable to retrieve ingress controllers from the Kubernetes", err)
+	}
+
+	// Add none controller if "AllowNone" is set for endpoint.
+	// Use the policy-applied endpoint for this check since it affects what's shown to the user.
+	if endpoint.Kubernetes.Configuration.AllowNoneIngressClass {
+		controllers = append(controllers, models.K8sIngressController{
+			Name:      "none",
+			ClassName: "none",
+			Type:      "custom",
+		})
+	}
+
+	// Fetch raw endpoint and update IngressClasses within a transaction.
+	// This prevents policy-applied values from being persisted to the database.
+	var updatedClasses []portainer.KubernetesIngressClassConfig
+	err = handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		rawEndpoint, err := tx.Endpoint().Endpoint(endpoint.ID)
+		if err != nil {
+			return err
+		}
+
+		// Use raw endpoint's IngressClasses for building updatedClasses to persist original DB values.
+		existingClasses := rawEndpoint.Kubernetes.Configuration.IngressClasses
+		updatedClasses = []portainer.KubernetesIngressClassConfig{}
+		for i := range controllers {
+			controllers[i].Availability = true
+			if controllers[i].ClassName != "none" {
+				controllers[i].New = true
+			}
+
+			updatedClass := portainer.KubernetesIngressClassConfig{
+				Name: controllers[i].ClassName,
+				Type: controllers[i].Type,
+			}
+
+			// Check if the controller is already known.
+			for _, existingClass := range existingClasses {
+				if controllers[i].ClassName != existingClass.Name {
+					continue
+				}
+				controllers[i].New = false
+				controllers[i].Availability = !existingClass.GloballyBlocked
+				updatedClass.GloballyBlocked = existingClass.GloballyBlocked
+				updatedClass.BlockedNamespaces = existingClass.BlockedNamespaces
+			}
+			updatedClasses = append(updatedClasses, updatedClass)
+		}
+
+		rawEndpoint.Kubernetes.Configuration.IngressClasses = updatedClasses
+		return tx.Endpoint().UpdateEndpoint(rawEndpoint.ID, rawEndpoint)
+	})
+	if err != nil {
+		log.Error().Err(err).Str("context", "getAllKubernetesIngressControllers").Msg("Unable to store found IngressClasses inside the database")
+		return httperror.InternalServerError("Unable to store found IngressClasses inside the database", err)
+	}
+
+	// If the allowedOnly query parameter was set. We need to prune out
+	// disallowed controllers from the response.
+	if allowedOnly {
+		allowedControllers := models.K8sIngressControllers{}
+		for _, controller := range controllers {
+			if controller.Availability {
+				allowedControllers = append(allowedControllers, controller)
+			}
+		}
+		controllers = allowedControllers
+	}
+
+	return response.JSON(w, controllers)
+}
+
+// @id GetKubernetesIngressControllersByNamespace
+// @summary Get a list ingress controllers by namespace
+// @description Get a list of ingress controllers for the given environment in the provided namespace.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @param namespace path string true "Namespace"
+// @success 200 {object} models.K8sIngressControllers "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier or a namespace with the specified name."
+// @failure 500 "Server error occurred while attempting to retrieve ingress controllers by a namespace"
+// @router /kubernetes/{id}/namespaces/{namespace}/ingresscontrollers [get]
+func (handler *Handler) getKubernetesIngressControllersByNamespace(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	namespace, err := request.RetrieveRouteVariableValue(r, "namespace")
+	if err != nil {
+		log.Error().Err(err).Str("context", "getKubernetesIngressControllersByNamespace").Msg("Unable to retrieve namespace identifier from request")
+		return httperror.BadRequest("Unable to retrieve namespace identifier from request", err)
+	}
+
+	endpoint, err := middlewares.FetchEndpoint(r)
+	if err != nil {
+		log.Error().Err(err).Str("context", "getKubernetesIngressControllersByNamespace").Msg("Unable to fetch endpoint")
+		return httperror.InternalServerError(err.Error(), err)
+	}
+
+	cli, err := handler.KubernetesClientFactory.GetPrivilegedKubeClient(endpoint)
+	if err != nil {
+		log.Error().Err(err).Str("context", "getAllKubernetesIngressControllers").Msg("Unable to create Kubernetes client")
+		return httperror.InternalServerError("Unable to create Kubernetes client", err)
+	}
+
+	currentControllers, err := cli.GetIngressControllers()
+	if err != nil {
+		if k8serrors.IsUnauthorized(err) || k8serrors.IsForbidden(err) {
+			log.Error().Err(err).Str("context", "getKubernetesIngressControllersByNamespace").Str("namespace", namespace).Msg("Unauthorized access to the Kubernetes API")
+			return httperror.Forbidden("Unauthorized access to the Kubernetes API", err)
+		}
+
+		log.Error().Err(err).Str("context", "getKubernetesIngressControllersByNamespace").Str("namespace", namespace).Msg("Unable to retrieve ingress controllers from the Kubernetes")
+		return httperror.InternalServerError("Unable to retrieve ingress controllers from the Kubernetes", err)
+	}
+
+	// Add none controller if "AllowNone" is set for endpoint.
+	// Use the policy-applied endpoint for this check since it affects what's shown to the user.
+	if endpoint.Kubernetes.Configuration.AllowNoneIngressClass {
+		currentControllers = append(currentControllers, models.K8sIngressController{
+			Name:      "none",
+			ClassName: "none",
+			Type:      "custom",
+		})
+	}
+
+	// Use policy-applied endpoint for ingressAvailabilityPerNamespace since it affects the response.
+	ingressAvailabilityPerNamespace := endpoint.Kubernetes.Configuration.IngressAvailabilityPerNamespace
+	controllers := models.K8sIngressControllers{}
+
+	// Fetch raw endpoint and update IngressClasses within a transaction.
+	// This prevents policy-applied values from being persisted to the database.
+	err = handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		rawEndpoint, err := tx.Endpoint().Endpoint(endpoint.ID)
+		if err != nil {
+			return err
+		}
+
+		// Use raw endpoint's IngressClasses for building updatedClasses to persist original DB values.
+		existingClasses := rawEndpoint.Kubernetes.Configuration.IngressClasses
+		updatedClasses := []portainer.KubernetesIngressClassConfig{}
+
+		for i := range currentControllers {
+			globallyblocked := false
+			currentControllers[i].Availability = true
+			if currentControllers[i].ClassName != "none" {
+				currentControllers[i].New = true
+			}
+
+			updatedClass := portainer.KubernetesIngressClassConfig{
+				Name: currentControllers[i].ClassName,
+				Type: currentControllers[i].Type,
+			}
+
+			// Check if the controller is blocked globally or in the current
+			// namespace.
+			for _, existingClass := range existingClasses {
+				if currentControllers[i].ClassName != existingClass.Name {
+					continue
+				}
+				currentControllers[i].New = false
+				updatedClass.GloballyBlocked = existingClass.GloballyBlocked
+				updatedClass.BlockedNamespaces = existingClass.BlockedNamespaces
+
+				globallyblocked = existingClass.GloballyBlocked
+
+				// Check if the current namespace is blocked if ingressAvailabilityPerNamespace is set to true
+				if ingressAvailabilityPerNamespace {
+					for _, ns := range existingClass.BlockedNamespaces {
+						if namespace == ns {
+							currentControllers[i].Availability = false
+						}
+					}
+				}
+			}
+			if !globallyblocked {
+				controllers = append(controllers, currentControllers[i])
+			}
+			updatedClasses = append(updatedClasses, updatedClass)
+		}
+
+		// Update the database to match the list of found controllers.
+		// This includes pruning out controllers which no longer exist.
+		rawEndpoint.Kubernetes.Configuration.IngressClasses = updatedClasses
+		return tx.Endpoint().UpdateEndpoint(rawEndpoint.ID, rawEndpoint)
+	})
+	if err != nil {
+		log.Error().Err(err).Str("context", "getKubernetesIngressControllersByNamespace").Msg("Unable to store found IngressClasses inside the database")
+		return httperror.InternalServerError("Unable to store found IngressClasses inside the database", err)
+	}
+	return response.JSON(w, controllers)
+}
+
+// @id UpdateKubernetesIngressControllers
+// @summary Update (block/unblock) ingress controllers
+// @description Update (block/unblock) ingress controllers for the provided environment.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @accept json
+// @produce json
+// @param id path int true "Environment identifier"
+// @param body body models.K8sIngressControllers true "Ingress controllers"
+// @success 204 "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier or unable to find the ingress controllers to update."
+// @failure 500 "Server error occurred while attempting to update ingress controllers."
+// @router /kubernetes/{id}/ingresscontrollers [put]
+func (handler *Handler) updateKubernetesIngressControllers(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	endpoint, err := middlewares.FetchEndpoint(r)
+	if err != nil {
+		log.Error().Err(err).Str("context", "updateKubernetesIngressControllers").Msg("Unable to retrieve environment")
+		return httperror.BadRequest("Unable to retrieve environment", err)
+	}
+
+	payload := models.K8sIngressControllers{}
+	err = request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
+		log.Error().Err(err).Str("context", "updateKubernetesIngressControllers").Msg("Unable to decode and validate the request payload")
+		return httperror.BadRequest("Unable to decode and validate the request payload", err)
+	}
+
+	cli, err := handler.KubernetesClientFactory.GetPrivilegedKubeClient(endpoint)
+	if err != nil {
+		log.Error().Err(err).Str("context", "updateKubernetesIngressControllers").Msg("Unable to get privileged kube client")
+		return httperror.InternalServerError("Unable to get privileged kube client", err)
+	}
+
+	controllers, err := cli.GetIngressControllers()
+	if err != nil {
+		if k8serrors.IsUnauthorized(err) || k8serrors.IsForbidden(err) {
+			log.Error().Err(err).Str("context", "updateKubernetesIngressControllers").Msg("Unauthorized access to the Kubernetes API")
+			return httperror.Forbidden("Unauthorized access to the Kubernetes API", err)
+		}
+
+		if k8serrors.IsNotFound(err) {
+			log.Error().Err(err).Str("context", "updateKubernetesIngressControllers").Msg("Unable to retrieve ingress controllers from the Kubernetes")
+			return httperror.NotFound("Unable to retrieve ingress controllers from the Kubernetes", err)
+		}
+
+		log.Error().Err(err).Str("context", "updateKubernetesIngressControllers").Msg("Unable to retrieve ingress controllers from the Kubernetes")
+		return httperror.InternalServerError("Unable to retrieve ingress controllers from the Kubernetes", err)
+	}
+
+	// Add none controller if "AllowNone" is set for endpoint.
+	// Use policy-applied endpoint for this check since it affects the response.
+	if endpoint.Kubernetes.Configuration.AllowNoneIngressClass {
+		controllers = append(controllers, models.K8sIngressController{
+			Name:      "none",
+			ClassName: "none",
+			Type:      "custom",
+		})
+	}
+
+	// Fetch raw endpoint and update IngressClasses within a transaction.
+	// This prevents policy-applied values from being persisted to the database.
+	err = handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		rawEndpoint, err := tx.Endpoint().Endpoint(endpoint.ID)
+		if err != nil {
+			return err
+		}
+
+		// Use raw endpoint's IngressClasses for building updatedClasses to persist original DB values.
+		existingClasses := rawEndpoint.Kubernetes.Configuration.IngressClasses
+		updatedClasses := []portainer.KubernetesIngressClassConfig{}
+		for i := range controllers {
+			controllers[i].Availability = true
+			controllers[i].New = true
+
+			updatedClass := portainer.KubernetesIngressClassConfig{
+				Name: controllers[i].ClassName,
+				Type: controllers[i].Type,
+			}
+
+			// Check if the controller is already known.
+			for _, existingClass := range existingClasses {
+				if controllers[i].ClassName != existingClass.Name {
+					continue
+				}
+				controllers[i].New = false
+				controllers[i].Availability = !existingClass.GloballyBlocked
+				updatedClass.GloballyBlocked = existingClass.GloballyBlocked
+				updatedClass.BlockedNamespaces = existingClass.BlockedNamespaces
+			}
+			updatedClasses = append(updatedClasses, updatedClass)
+		}
+
+		for _, p := range payload {
+			for i := range controllers {
+				// Now set new payload data
+				if updatedClasses[i].Name == p.ClassName {
+					updatedClasses[i].GloballyBlocked = !p.Availability
+				}
+			}
+		}
+
+		rawEndpoint.Kubernetes.Configuration.IngressClasses = updatedClasses
+		return tx.Endpoint().UpdateEndpoint(rawEndpoint.ID, rawEndpoint)
+	})
+	if err != nil {
+		log.Error().Err(err).Str("context", "updateKubernetesIngressControllers").Msg("Unable to store found IngressClasses inside the database")
+		return httperror.InternalServerError("Unable to store found IngressClasses inside the database", err)
+	}
+	return response.Empty(w)
+}
+
+// @id UpdateKubernetesIngressControllersByNamespace
+// @summary Update (block/unblock) ingress controllers by namespace
+// @description Update (block/unblock) ingress controllers by namespace for the provided environment.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @accept json
+// @produce json
+// @param id path int true "Environment identifier"
+// @param namespace path string true "Namespace name"
+// @param body body models.K8sIngressControllers true "Ingress controllers"
+// @success 204 "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier."
+// @failure 500 "Server error occurred while attempting to update ingress controllers by namespace."
+// @router /kubernetes/{id}/namespaces/{namespace}/ingresscontrollers [put]
+func (handler *Handler) updateKubernetesIngressControllersByNamespace(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	namespace, err := request.RetrieveRouteVariableValue(r, "namespace")
+	if err != nil {
+		log.Error().Err(err).Str("context", "updateKubernetesIngressControllersByNamespace").Msg("Unable to retrieve namespace from request")
+		return httperror.BadRequest("Unable to retrieve namespace from request", err)
+	}
+
+	payload := models.K8sIngressControllers{}
+	err = request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
+		log.Error().Err(err).Str("context", "updateKubernetesIngressControllersByNamespace").Str("namespace", namespace).Msg("Unable to decode and validate the request payload")
+		return httperror.BadRequest("Unable to decode and validate the request payload", err)
+	}
+
+	endpoint, err := middlewares.FetchEndpoint(r)
+	if err != nil {
+		log.Error().Err(err).Str("context", "updateKubernetesIngressControllersByNamespace").Msg("Unable to fetch endpoint")
+		return httperror.InternalServerError("Unable to fetch endpoint", err)
+	}
+
+	// Fetch raw endpoint and update IngressClasses within a transaction.
+	// This prevents policy-applied values from being persisted to the database.
+	err = handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		rawEndpoint, err := tx.Endpoint().Endpoint(endpoint.ID)
+		if err != nil {
+			return err
+		}
+
+		// Use raw endpoint's IngressClasses for building updatedClasses to persist original DB values.
+		existingClasses := rawEndpoint.Kubernetes.Configuration.IngressClasses
+		updatedClasses := []portainer.KubernetesIngressClassConfig{}
+
+		for _, p := range payload {
+			for _, existingClass := range existingClasses {
+				if p.ClassName != existingClass.Name {
+					continue
+				}
+				updatedClass := portainer.KubernetesIngressClassConfig{
+					Name:            existingClass.Name,
+					Type:            existingClass.Type,
+					GloballyBlocked: existingClass.GloballyBlocked,
+				}
+
+				// Handle "allow"
+				if p.Availability {
+					// remove the namespace from the list of blocked namespaces
+					// in the existingClass.
+					for _, blockedNS := range existingClass.BlockedNamespaces {
+						if blockedNS != namespace {
+							updatedClass.BlockedNamespaces = append(updatedClass.BlockedNamespaces, blockedNS)
+						}
+					}
+
+					updatedClasses = append(updatedClasses, updatedClass)
+					break
+				}
+
+				// Handle "disallow"
+				// If it's meant to be blocked we need to add the current
+				// namespace. First, check if it's already in the
+				// BlockedNamespaces and if not we append it.
+				updatedClass.BlockedNamespaces = existingClass.BlockedNamespaces
+				if !slices.Contains(updatedClass.BlockedNamespaces, namespace) {
+					updatedClass.BlockedNamespaces = append(updatedClass.BlockedNamespaces, namespace)
+				}
+				updatedClasses = append(updatedClasses, updatedClass)
+				break
+			}
+		}
+
+		// At this point it's possible we had an existing class which was globally
+		// blocked and thus not included in the payload. As a result it is not yet
+		// part of updatedClasses, but we MUST include it or we would remove the
+		// global block.
+		for _, existingClass := range existingClasses {
+			found := false
+
+			for _, updatedClass := range updatedClasses {
+				if existingClass.Name == updatedClass.Name {
+					found = true
+					break
+				}
+			}
+
+			if !found {
+				updatedClasses = append(updatedClasses, existingClass)
+			}
+		}
+
+		rawEndpoint.Kubernetes.Configuration.IngressClasses = updatedClasses
+		return tx.Endpoint().UpdateEndpoint(rawEndpoint.ID, rawEndpoint)
+	})
+	if err != nil {
+		log.Error().Err(err).Str("context", "updateKubernetesIngressControllersByNamespace").Str("namespace", namespace).Msg("Unable to store BlockedIngressClasses inside the database")
+		return httperror.InternalServerError("Unable to store BlockedIngressClasses inside the database", err)
+	}
+	return response.Empty(w)
+}
+
+// @id GetAllKubernetesClusterIngresses
+// @summary Get kubernetes ingresses at the cluster level
+// @description Get kubernetes ingresses at the cluster level for the provided environment.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @param withServices query boolean false "Lookup services associated with each ingress"
+// @success 200 {array} models.K8sIngressInfo "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier."
+// @failure 500 "Server error occurred while attempting to retrieve ingresses."
+// @router /kubernetes/{id}/ingresses [get]
+func (handler *Handler) GetAllKubernetesClusterIngresses(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	ingresses, err := handler.getKubernetesClusterIngresses(r)
+	if err != nil {
+		return err
+	}
+
+	return response.JSON(w, ingresses)
+}
+
+// @id GetAllKubernetesClusterIngressesCount
+// @summary Get Ingresses count
+// @description Get the number of kubernetes ingresses within the given environment.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @success 200 {integer} integer "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier."
+// @failure 500 "Server error occurred while attempting to retrieve ingresses count."
+// @router /kubernetes/{id}/ingresses/count [get]
+func (handler *Handler) getAllKubernetesClusterIngressesCount(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	ingresses, err := handler.getKubernetesClusterIngresses(r)
+	if err != nil {
+		return err
+	}
+
+	return response.JSON(w, len(ingresses))
+}
+
+func (handler *Handler) getKubernetesClusterIngresses(r *http.Request) ([]models.K8sIngressInfo, *httperror.HandlerError) {
+	withServices, err := request.RetrieveBooleanQueryParameter(r, "withServices", true)
+	if err != nil {
+		log.Error().Err(err).Str("context", "getKubernetesClusterIngresses").Msg("Unable to retrieve withApplications query parameter")
+		return nil, httperror.BadRequest("Unable to retrieve withApplications query parameter", err)
+	}
+
+	cli, httpErr := handler.prepareKubeClient(r)
+	if httpErr != nil {
+		log.Error().Err(httpErr).Str("context", "getKubernetesClusterIngresses").Msg("Unable to get a Kubernetes client for the user")
+		return nil, httperror.InternalServerError("Unable to get a Kubernetes client for the user", httpErr)
+	}
+
+	ingresses, err := cli.GetIngresses("")
+	if err != nil {
+		if k8serrors.IsUnauthorized(err) || k8serrors.IsForbidden(err) {
+			log.Error().Err(err).Str("context", "getKubernetesClusterIngresses").Msg("Unauthorized access to the Kubernetes API")
+			return nil, httperror.Forbidden("Unauthorized access to the Kubernetes API", err)
+		}
+
+		if k8serrors.IsNotFound(err) {
+			log.Error().Err(err).Str("context", "getKubernetesClusterIngresses").Msg("Unable to retrieve ingresses from the Kubernetes for a cluster level user")
+			return nil, httperror.NotFound("Unable to retrieve ingresses from the Kubernetes for a cluster level user", err)
+		}
+
+		log.Error().Err(err).Str("context", "getKubernetesClusterIngresses").Msg("Unable to retrieve ingresses from the Kubernetes for a cluster level user")
+		return nil, httperror.InternalServerError("Unable to retrieve ingresses from the Kubernetes for a cluster level user", err)
+	}
+
+	if withServices {
+		ingressesWithServices, err := cli.CombineIngressesWithServices(ingresses)
+		if err != nil {
+			log.Error().Err(err).Str("context", "getKubernetesClusterIngresses").Msg("Unable to combine ingresses with services")
+			return nil, httperror.InternalServerError("Unable to combine ingresses with services", err)
+		}
+
+		return ingressesWithServices, nil
+	}
+
+	return ingresses, nil
+}
+
+// @id GetAllKubernetesIngresses
+// @summary Get a list of Ingresses
+// @description Get a list of Ingresses. If namespace is provided, it will return the list of Ingresses in that namespace.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @param namespace path string true "Namespace name"
+// @success 200 {array} models.K8sIngressInfo "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier."
+// @failure 500 "Server error occurred while attempting to retrieve ingresses"
+// @router /kubernetes/{id}/namespaces/{namespace}/ingresses [get]
+func (handler *Handler) getKubernetesIngresses(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	namespace, err := request.RetrieveRouteVariableValue(r, "namespace")
+	if err != nil {
+		log.Error().Err(err).Str("context", "getKubernetesIngresses").Msg("Unable to retrieve namespace from request")
+		return httperror.BadRequest("Unable to retrieve namespace from request", err)
+	}
+
+	cli, handlerErr := handler.getProxyKubeClient(r)
+	if handlerErr != nil {
+		return handlerErr
+	}
+
+	ingresses, err := cli.GetIngresses(namespace)
+	if err != nil {
+		if k8serrors.IsUnauthorized(err) || k8serrors.IsForbidden(err) {
+			log.Error().Err(err).Str("context", "getKubernetesIngresses").Str("namespace", namespace).Msg("Unauthorized access to the Kubernetes API")
+			return httperror.Forbidden("Unauthorized access to the Kubernetes API", err)
+		}
+
+		log.Error().Err(err).Str("context", "getKubernetesIngresses").Str("namespace", namespace).Msg("Unable to retrieve ingresses from the Kubernetes for a namespace level user")
+		return httperror.InternalServerError("Unable to retrieve ingresses from the Kubernetes for a namespace level user", err)
+	}
+
+	return response.JSON(w, ingresses)
+}
+
+// @id GetKubernetesIngress
+// @summary Get an Ingress by name
+// @description Get an Ingress by name for the provided environment.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @param namespace path string true "Namespace name"
+// @param ingress path string true "Ingress name"
+// @success 200 {object} models.K8sIngressInfo "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier or unable to find an ingress with the specified name."
+// @failure 500 "Server error occurred while attempting to retrieve an ingress."
+// @router /kubernetes/{id}/namespaces/{namespace}/ingresses/{ingress} [get]
+func (handler *Handler) getKubernetesIngress(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	namespace, err := request.RetrieveRouteVariableValue(r, "namespace")
+	if err != nil {
+		log.Error().Err(err).Str("context", "getKubernetesIngress").Msg("Unable to retrieve namespace from request")
+		return httperror.BadRequest("Unable to retrieve namespace from request", err)
+	}
+
+	ingressName, err := request.RetrieveRouteVariableValue(r, "ingress")
+	if err != nil {
+		log.Error().Err(err).Str("context", "getKubernetesIngress").Msg("Unable to retrieve ingress from request")
+		return httperror.BadRequest("Unable to retrieve ingress from request", err)
+	}
+
+	cli, handlerErr := handler.getProxyKubeClient(r)
+	if handlerErr != nil {
+		return handlerErr
+	}
+
+	ingress, err := cli.GetIngress(namespace, ingressName)
+	if err != nil {
+		if k8serrors.IsUnauthorized(err) || k8serrors.IsForbidden(err) {
+			log.Error().Err(err).Str("context", "getKubernetesIngress").Str("namespace", namespace).Str("ingress", ingressName).Msg("Unauthorized access to the Kubernetes API")
+			return httperror.Forbidden("Unauthorized access to the Kubernetes API", err)
+		}
+
+		if k8serrors.IsNotFound(err) {
+			log.Error().Err(err).Str("context", "getKubernetesIngress").Str("namespace", namespace).Str("ingress", ingressName).Msg("Unable to retrieve ingress from the Kubernetes for a namespace level user")
+			return httperror.NotFound("Unable to retrieve ingress from the Kubernetes for a namespace level user", err)
+		}
+
+		log.Error().Err(err).Str("context", "getKubernetesIngress").Str("namespace", namespace).Str("ingress", ingressName).Msg("Unable to retrieve ingress from the Kubernetes for a namespace level user")
+		return httperror.InternalServerError("Unable to retrieve ingress from the Kubernetes for a namespace level user", err)
+	}
+
+	return response.JSON(w, ingress)
+}
+
+// @id CreateKubernetesIngress
+// @summary Create an Ingress
+// @description Create an Ingress for the provided environment.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @accept json
+// @produce json
+// @param id path int true "Environment identifier"
+// @param namespace path string true "Namespace name"
+// @param body body models.K8sIngressInfo true "Ingress details"
+// @success 204 "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier."
+// @failure 409 "Conflict - an ingress with the same name already exists in the specified namespace."
+// @failure 500 "Server error occurred while attempting to create an ingress."
+// @router /kubernetes/{id}/namespaces/{namespace}/ingresses [post]
+func (handler *Handler) createKubernetesIngress(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	namespace, err := request.RetrieveRouteVariableValue(r, "namespace")
+	if err != nil {
+		log.Error().Err(err).Str("context", "createKubernetesIngress").Msg("Unable to retrieve namespace from request")
+		return httperror.BadRequest("Unable to retrieve namespace from request", err)
+	}
+
+	payload := models.K8sIngressInfo{}
+	err = request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
+		log.Error().Err(err).Str("context", "createKubernetesIngress").Msg("Unable to decode and validate the request payload")
+		return httperror.BadRequest("Unable to decode and validate the request payload", err)
+	}
+
+	owner := "admin"
+	tokenData, err := security.RetrieveTokenData(r)
+	if err == nil && tokenData != nil {
+		owner = tokenData.Username
+	}
+
+	cli, handlerErr := handler.getProxyKubeClient(r)
+	if handlerErr != nil {
+		return handlerErr
+	}
+
+	err = cli.CreateIngress(namespace, payload, owner)
+	if err != nil {
+		if k8serrors.IsUnauthorized(err) || k8serrors.IsForbidden(err) {
+			log.Error().Err(err).Str("context", "createKubernetesIngress").Str("namespace", namespace).Msg("Unauthorized access to the Kubernetes API")
+			return httperror.Forbidden("Unauthorized access to the Kubernetes API", err)
+		}
+
+		if k8serrors.IsAlreadyExists(err) {
+			log.Error().Err(err).Str("context", "createKubernetesIngress").Str("namespace", namespace).Msg("Ingress already exists")
+			return httperror.Conflict("Ingress already exists", err)
+		}
+
+		log.Error().Err(err).Str("context", "createKubernetesIngress").Str("namespace", namespace).Msg("Unable to create an ingress")
+		return httperror.InternalServerError("Unable to create an ingress", err)
+	}
+
+	return response.Empty(w)
+}
+
+// @id DeleteKubernetesIngresses
+// @summary Delete one or more Ingresses
+// @description Delete one or more Ingresses in the provided environment.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @accept json
+// @produce json
+// @param id path int true "Environment identifier"
+// @param body body models.K8sIngressDeleteRequests true "Ingress details"
+// @success 204 "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier or unable to find a specific ingress."
+// @failure 500 "Server error occurred while attempting to delete specified ingresses."
+// @router /kubernetes/{id}/ingresses/delete [post]
+func (handler *Handler) deleteKubernetesIngresses(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	cli, handlerErr := handler.getProxyKubeClient(r)
+	if handlerErr != nil {
+		return handlerErr
+	}
+
+	payload := models.K8sIngressDeleteRequests{}
+	err := request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
+		log.Error().Err(err).Str("context", "deleteKubernetesIngresses").Msg("Unable to decode and validate the request payload")
+		return httperror.BadRequest("Unable to decode and validate the request payload", err)
+	}
+
+	err = cli.DeleteIngresses(payload)
+	if err != nil {
+		if k8serrors.IsUnauthorized(err) || k8serrors.IsForbidden(err) {
+			log.Error().Err(err).Str("context", "deleteKubernetesIngresses").Msg("Unauthorized access to the Kubernetes API")
+			return httperror.Forbidden("Unauthorized access to the Kubernetes API", err)
+		}
+
+		if k8serrors.IsNotFound(err) {
+			log.Error().Err(err).Str("context", "deleteKubernetesIngresses").Msg("Unable to retrieve ingresses from the Kubernetes for a namespace level user")
+			return httperror.NotFound("Unable to retrieve ingresses from the Kubernetes for a namespace level user", err)
+		}
+
+		log.Error().Err(err).Str("context", "deleteKubernetesIngresses").Msg("Unable to delete ingresses")
+		return httperror.InternalServerError("Unable to delete ingresses", err)
+	}
+
+	return response.Empty(w)
+}
+
+// @id UpdateKubernetesIngress
+// @summary Update an Ingress
+// @description Update an Ingress for the provided environment.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @accept json
+// @produce json
+// @param id path int true "Environment identifier"
+// @param namespace path string true "Namespace name"
+// @param body body models.K8sIngressInfo true "Ingress details"
+// @success 204 "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier or unable to find the specified ingress."
+// @failure 500 "Server error occurred while attempting to update the specified ingress."
+// @router /kubernetes/{id}/namespaces/{namespace}/ingresses [put]
+func (handler *Handler) updateKubernetesIngress(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	namespace, err := request.RetrieveRouteVariableValue(r, "namespace")
+	if err != nil {
+		log.Error().Err(err).Str("context", "updateKubernetesIngress").Msg("Unable to retrieve namespace from request")
+		return httperror.BadRequest("Unable to retrieve namespace from request", err)
+	}
+
+	payload := models.K8sIngressInfo{}
+	err = request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
+		log.Error().Err(err).Str("context", "updateKubernetesIngress").Msg("Unable to decode and validate the request payload")
+		return httperror.BadRequest("Unable to decode and validate the request payload", err)
+	}
+
+	cli, handlerErr := handler.getProxyKubeClient(r)
+	if handlerErr != nil {
+		return handlerErr
+	}
+
+	err = cli.UpdateIngress(namespace, payload)
+	if err != nil {
+		if k8serrors.IsUnauthorized(err) || k8serrors.IsForbidden(err) {
+			log.Error().Err(err).Str("context", "updateKubernetesIngress").Str("namespace", namespace).Msg("Unauthorized access to the Kubernetes API")
+			return httperror.Forbidden("Unauthorized access to the Kubernetes API", err)
+		}
+
+		if k8serrors.IsNotFound(err) {
+			log.Error().Err(err).Str("context", "updateKubernetesIngress").Str("namespace", namespace).Msg("Unable to retrieve ingresses from the K	ubernetes for a namespace level user")
+			return httperror.NotFound("Unable to retrieve ingresses from the Kubernetes for a namespace level user", err)
+		}
+
+		log.Error().Err(err).Str("context", "updateKubernetesIngress").Str("namespace", namespace).Msg("Unable to update ingress in a namespace")
+		return httperror.InternalServerError("Unable to update ingress in a namespace", err)
+	}
+
+	return response.Empty(w)
+}
diff --git a/api/http/handler/kubernetes/job.go b/api/http/handler/kubernetes/job.go
new file mode 100644
index 0000000..be1d67b
--- /dev/null
+++ b/api/http/handler/kubernetes/job.go
@@ -0,0 +1,85 @@
+package kubernetes
+
+import (
+	"net/http"
+
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/rs/zerolog/log"
+)
+
+// @id GetKubernetesJobs
+// @summary Get a list of kubernetes Jobs
+// @description Get a list of kubernetes Jobs that the user has access to.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @param includeCronJobChildren query bool false "Whether to include Jobs that have a cronjob owner"
+// @success 200 {array} models.K8sJob "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier."
+// @failure 500 "Server error occurred while attempting to retrieve the list of Jobs."
+// @router /kubernetes/{id}/jobs [get]
+func (handler *Handler) getAllKubernetesJobs(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	includeCronJobChildren, err := request.RetrieveBooleanQueryParameter(r, "includeCronJobChildren", true)
+	if err != nil {
+		log.Error().Err(err).Str("context", "GetAllKubernetesJobs").Msg("Invalid query parameter includeCronJobChildren")
+		return httperror.BadRequest("an error occurred during the GetAllKubernetesJobs operation, invalid query parameter includeCronJobChildren. Error: ", err)
+	}
+
+	cli, httpErr := handler.prepareKubeClient(r)
+	if httpErr != nil {
+		log.Error().Err(httpErr).Str("context", "GetAllKubernetesJobs").Msg("Unable to prepare kube client")
+		return httperror.InternalServerError("unable to prepare kube client. Error: ", httpErr)
+	}
+
+	jobs, err := cli.GetJobs("", includeCronJobChildren)
+	if err != nil {
+		log.Error().Err(err).Str("context", "GetAllKubernetesJobs").Msg("Unable to fetch Jobs across all namespaces")
+		return httperror.InternalServerError("unable to fetch Jobs. Error: ", err)
+	}
+
+	return response.JSON(w, jobs)
+}
+
+// @id DeleteJobs
+// @summary Delete Jobs
+// @description Delete the provided list of Jobs.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @accept json
+// @param id path int true "Environment identifier"
+// @param payload body models.K8sJobDeleteRequests true "A map where the key is the namespace and the value is an array of Jobs to delete"
+// @success 204 "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier or unable to find a specific service account."
+// @failure 500 "Server error occurred while attempting to delete Jobs."
+// @router /kubernetes/{id}/jobs/delete [POST]
+func (handler *Handler) deleteKubernetesJobs(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	var payload models.K8sJobDeleteRequests
+	err := request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	cli, handlerErr := handler.getProxyKubeClient(r)
+	if handlerErr != nil {
+		return handlerErr
+	}
+
+	err = cli.DeleteJobs(payload)
+	if err != nil {
+		return httperror.InternalServerError("Unable to delete Jobs", err)
+	}
+
+	return response.Empty(w)
+}
diff --git a/api/http/handler/kubernetes/metrics.go b/api/http/handler/kubernetes/metrics.go
new file mode 100644
index 0000000..aeee919
--- /dev/null
+++ b/api/http/handler/kubernetes/metrics.go
@@ -0,0 +1,183 @@
+package kubernetes
+
+import (
+	"net/http"
+
+	"github.com/portainer/portainer/api/http/middlewares"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/rs/zerolog/log"
+
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// @id GetKubernetesMetricsForAllNodes
+// @summary Get a list of nodes with their live metrics
+// @description Get a list of metrics associated with all nodes of a cluster.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @success 200 {object} v1beta1.NodeMetricsList "Success"
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 500 "Server error occurred while attempting to retrieve the list of nodes with their live metrics."
+// @router /kubernetes/{id}/metrics/nodes [get]
+func (handler *Handler) getKubernetesMetricsForAllNodes(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	endpoint, err := middlewares.FetchEndpoint(r)
+	if err != nil {
+		return httperror.InternalServerError(err.Error(), err)
+	}
+
+	cli, err := handler.KubernetesClientFactory.CreateRemoteMetricsClient(endpoint)
+	if err != nil {
+		log.Error().Err(err).Str("context", "getKubernetesMetricsForAllNodes").Msg("Failed to create metrics KubeClient")
+		return httperror.InternalServerError("failed to create metrics KubeClient", nil)
+	}
+
+	metrics, err := cli.MetricsV1beta1().NodeMetricses().List(r.Context(), v1.ListOptions{})
+	if err != nil {
+		log.Error().Err(err).Str("context", "getKubernetesMetricsForAllNodes").Msg("Failed to fetch metrics")
+		return httperror.InternalServerError("Failed to fetch metrics", err)
+	}
+
+	return response.JSON(w, metrics)
+}
+
+// @id GetKubernetesMetricsForNode
+// @summary Get live metrics for a node
+// @description Get live metrics for the specified node.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @param name path string true "Node identifier"
+// @success 200 {object} v1beta1.NodeMetrics "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 500 "Server error occurred while attempting to retrieve the live metrics for the specified node."
+// @router /kubernetes/{id}/metrics/nodes/{name} [get]
+func (handler *Handler) getKubernetesMetricsForNode(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	endpoint, err := middlewares.FetchEndpoint(r)
+	if err != nil {
+		log.Error().Err(err).Str("context", "getKubernetesMetricsForNode").Msg("Failed to fetch endpoint")
+		return httperror.InternalServerError(err.Error(), err)
+	}
+
+	cli, err := handler.KubernetesClientFactory.CreateRemoteMetricsClient(endpoint)
+	if err != nil {
+		log.Error().Err(err).Str("context", "getKubernetesMetricsForNode").Msg("Failed to create metrics KubeClient")
+		return httperror.InternalServerError("failed to create metrics KubeClient", nil)
+	}
+
+	nodeName, err := request.RetrieveRouteVariableValue(r, "name")
+	if err != nil {
+		log.Error().Err(err).Str("context", "getKubernetesMetricsForNode").Msg("Invalid node identifier route variable")
+		return httperror.BadRequest("Invalid node identifier route variable", err)
+	}
+
+	metrics, err := cli.MetricsV1beta1().NodeMetricses().Get(
+		r.Context(),
+		nodeName,
+		v1.GetOptions{},
+	)
+	if err != nil {
+		log.Error().Err(err).Str("context", "getKubernetesMetricsForNode").Msg("Failed to fetch metrics")
+		return httperror.InternalServerError("Failed to fetch metrics", err)
+	}
+
+	return response.JSON(w, metrics)
+}
+
+// @id GetKubernetesMetricsForAllPods
+// @summary Get a list of pods with their live metrics
+// @description Get a list of pods with their live metrics for the specified namespace.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @param namespace path string true "Namespace"
+// @success 200 {object} v1beta1.PodMetricsList "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 500 "Server error occurred while attempting to retrieve the list of pods with their live metrics."
+// @router /kubernetes/{id}/metrics/pods/{namespace} [get]
+func (handler *Handler) getKubernetesMetricsForAllPods(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	endpoint, err := middlewares.FetchEndpoint(r)
+	if err != nil {
+		log.Error().Err(err).Str("context", "getKubernetesMetricsForAllPods").Msg("Failed to fetch endpoint")
+		return httperror.InternalServerError(err.Error(), err)
+	}
+
+	cli, err := handler.KubernetesClientFactory.CreateRemoteMetricsClient(endpoint)
+	if err != nil {
+		log.Error().Err(err).Str("context", "getKubernetesMetricsForAllPods").Msg("Failed to create metrics KubeClient")
+		return httperror.InternalServerError("failed to create metrics KubeClient", nil)
+	}
+
+	namespace, err := request.RetrieveRouteVariableValue(r, "namespace")
+	if err != nil {
+		log.Error().Err(err).Str("context", "getKubernetesMetricsForAllPods").Msg("Invalid namespace identifier route variable")
+		return httperror.BadRequest("Invalid namespace identifier route variable", err)
+	}
+
+	metrics, err := cli.MetricsV1beta1().PodMetricses(namespace).List(r.Context(), v1.ListOptions{})
+	if err != nil {
+		log.Error().Err(err).Str("context", "getKubernetesMetricsForAllPods").Msg("Failed to fetch metrics")
+		return httperror.InternalServerError("Failed to fetch metrics", err)
+	}
+
+	return response.JSON(w, metrics)
+}
+
+// @id GetKubernetesMetricsForPod
+// @summary Get live metrics for a pod
+// @description Get live metrics for the specified pod.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @param namespace path string true "Namespace"
+// @param name path string true "Pod identifier"
+// @success 200 {object} v1beta1.PodMetrics "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 500 "Server error occurred while attempting to retrieve the live metrics for the specified pod."
+// @router /kubernetes/{id}/metrics/pods/{namespace}/{name} [get]
+func (handler *Handler) getKubernetesMetricsForPod(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	endpoint, err := middlewares.FetchEndpoint(r)
+	if err != nil {
+		log.Error().Err(err).Str("context", "getKubernetesMetricsForPod").Msg("Failed to fetch endpoint")
+		return httperror.InternalServerError(err.Error(), err)
+	}
+
+	cli, err := handler.KubernetesClientFactory.CreateRemoteMetricsClient(endpoint)
+	if err != nil {
+		log.Error().Err(err).Str("context", "getKubernetesMetricsForPod").Msg("Failed to create metrics KubeClient")
+		return httperror.InternalServerError("failed to create metrics KubeClient", nil)
+	}
+
+	namespace, err := request.RetrieveRouteVariableValue(r, "namespace")
+	if err != nil {
+		log.Error().Err(err).Str("context", "getKubernetesMetricsForPod").Msg("Invalid namespace identifier route variable")
+		return httperror.BadRequest("Invalid namespace identifier route variable", err)
+	}
+
+	podName, err := request.RetrieveRouteVariableValue(r, "name")
+	if err != nil {
+		log.Error().Err(err).Str("context", "getKubernetesMetricsForPod").Msg("Invalid pod identifier route variable")
+		return httperror.BadRequest("Invalid pod identifier route variable", err)
+	}
+
+	metrics, err := cli.MetricsV1beta1().PodMetricses(namespace).Get(r.Context(), podName, v1.GetOptions{})
+	if err != nil {
+		log.Error().Err(err).Str("context", "getKubernetesMetricsForPod").Str("namespace", namespace).Str("pod", podName).Msg("Failed to fetch metrics")
+		return httperror.InternalServerError("Failed to fetch metrics", err)
+	}
+
+	return response.JSON(w, metrics)
+}
diff --git a/api/http/handler/kubernetes/namespaces.go b/api/http/handler/kubernetes/namespaces.go
new file mode 100644
index 0000000..75dae9e
--- /dev/null
+++ b/api/http/handler/kubernetes/namespaces.go
@@ -0,0 +1,295 @@
+package kubernetes
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/rs/zerolog/log"
+	k8serrors "k8s.io/apimachinery/pkg/api/errors"
+)
+
+// @id GetKubernetesNamespaces
+// @summary Get a list of namespaces
+// @description Get a list of all namespaces within the given environment based on the user role and permissions. If the user is an admin, they can access all namespaces. If the user is not an admin, they can only access namespaces that they have access to.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @param withResourceQuota query boolean true "When set to true, include the resource quota information as part of the Namespace information. Default is false"
+// @param withUnhealthyEvents query boolean true "When set to true, include the unhealthy events information as part of the Namespace information. Default is false"
+// @success 200 {array} portainer.K8sNamespaceInfo "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier."
+// @failure 500 "Server error occurred while attempting to retrieve the list of namespaces."
+// @router /kubernetes/{id}/namespaces [get]
+func (handler *Handler) getKubernetesNamespaces(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	withResourceQuota, err := request.RetrieveBooleanQueryParameter(r, "withResourceQuota", true)
+	if err != nil {
+		log.Error().Err(err).Str("context", "GetKubernetesNamespaces").Msg("Invalid query parameter withResourceQuota")
+		return httperror.BadRequest("an error occurred during the GetKubernetesNamespaces operation, invalid query parameter withResourceQuota. Error: ", err)
+	}
+
+	withUnhealthyEvents, err := request.RetrieveBooleanQueryParameter(r, "withUnhealthyEvents", true)
+	if err != nil {
+		log.Error().Err(err).Str("context", "GetKubernetesNamespaces").Msg("Invalid query parameter withUnhealthyEvents")
+		return httperror.BadRequest("an error occurred during the GetKubernetesNamespaces operation, invalid query parameter withUnhealthyEvents. Error: ", err)
+	}
+
+	cli, httpErr := handler.prepareKubeClient(r)
+	if httpErr != nil {
+		log.Error().Err(httpErr).Str("context", "GetKubernetesNamespaces").Msg("Unable to get a Kubernetes client for the user")
+		return httperror.InternalServerError("an error occurred during the GetKubernetesNamespaces operation, unable to get a Kubernetes client for the user. Error: ", httpErr)
+	}
+
+	namespaces, err := cli.GetNamespaces()
+	if err != nil {
+		log.Error().Err(err).Str("context", "GetKubernetesNamespaces").Msg("Unable to retrieve namespaces from the Kubernetes cluster")
+		return httperror.InternalServerError("an error occurred during the GetKubernetesNamespaces operation, unable to retrieve namespaces from the Kubernetes cluster. Error: ", err)
+	}
+
+	if withUnhealthyEvents {
+		namespaces, err = cli.CombineNamespacesWithUnhealthyEvents(namespaces)
+		if err != nil {
+			log.Error().Err(err).Str("context", "GetKubernetesNamespaces").Msg("Unable to combine namespaces with unhealthy events")
+			return httperror.InternalServerError("an error occurred during the GetKubernetesNamespaces operation, unable to combine namespaces with unhealthy events. Error: ", err)
+		}
+	}
+
+	if withResourceQuota {
+		return cli.CombineNamespacesWithResourceQuotas(namespaces, w)
+	}
+
+	return response.JSON(w, cli.ConvertNamespaceMapToSlice(namespaces))
+}
+
+// @id GetKubernetesNamespacesCount
+// @summary Get the total number of kubernetes namespaces within the given Portainer environment.
+// @description Get the total number of kubernetes namespaces within the given environment, including the system namespaces. The total count depends on the user's role and permissions.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @success 200 {integer} integer "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier."
+// @failure 500 "Server error occurred while attempting to compute the namespace count."
+// @router /kubernetes/{id}/namespaces/count [get]
+func (handler *Handler) getKubernetesNamespacesCount(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	cli, httpErr := handler.prepareKubeClient(r)
+	if httpErr != nil {
+		log.Error().Err(httpErr).Str("context", "GetKubernetesNamespacesCount").Msg("Unable to get a Kubernetes client for the user")
+		return httperror.InternalServerError("an error occurred during the GetKubernetesNamespacesCount operation, unable to get a Kubernetes client for the user. Error: ", httpErr)
+	}
+
+	namespaces, err := cli.GetNamespaces()
+	if err != nil {
+		log.Error().Err(err).Str("context", "GetKubernetesNamespacesCount").Msg("Unable to retrieve namespaces from the Kubernetes cluster to count the total")
+		return httperror.InternalServerError("an error occurred during the GetKubernetesNamespacesCount operation, unable to retrieve namespaces from the Kubernetes cluster to count the total. Error: ", err)
+	}
+
+	return response.JSON(w, len(namespaces))
+}
+
+// @id GetKubernetesNamespace
+// @summary Get namespace details
+// @description Get namespace details for the provided namespace within the given environment.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @param namespace path string true "The namespace name to get details for"
+// @param withResourceQuota query boolean true "When set to true, include the resource quota information as part of the Namespace information. Default is false"
+// @success 200 {object} portainer.K8sNamespaceInfo "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier or unable to find a specific namespace."
+// @failure 500 "Server error occurred while attempting to retrieve specified namespace information."
+// @router /kubernetes/{id}/namespaces/{namespace} [get]
+func (handler *Handler) getKubernetesNamespace(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	namespaceName, err := request.RetrieveRouteVariableValue(r, "namespace")
+	if err != nil {
+		log.Error().Err(err).Str("context", "GetKubernetesNamespace").Msg("Invalid namespace parameter namespace")
+		return httperror.BadRequest("an error occurred during the GetKubernetesNamespace operation, invalid namespace parameter namespace. Error: ", err)
+	}
+
+	withResourceQuota, err := request.RetrieveBooleanQueryParameter(r, "withResourceQuota", true)
+	if err != nil {
+		log.Error().Err(err).Str("context", "GetKubernetesNamespace").Msg("Invalid query parameter withResourceQuota")
+		return httperror.BadRequest("an error occurred during the GetKubernetesNamespace operation for the namespace %s, invalid query parameter withResourceQuota. Error: ", err)
+	}
+
+	cli, httpErr := handler.getProxyKubeClient(r)
+	if httpErr != nil {
+		log.Error().Err(httpErr).Str("context", "GetKubernetesNamespace").Msg("Unable to get a Kubernetes client for the user")
+		return httperror.InternalServerError("an error occurred during the GetKubernetesNamespace operation for the namespace %s, unable to get a Kubernetes client for the user. Error: ", httpErr)
+	}
+
+	namespaceInfo, err := cli.GetNamespace(namespaceName)
+	if err != nil {
+		if k8serrors.IsNotFound(err) {
+			log.Error().Err(err).Str("context", "GetKubernetesNamespace").Msg("Unable to find the namespace")
+			return httperror.NotFound(fmt.Sprintf("an error occurred during the GetKubernetesNamespace operation for the namespace %s, unable to find the namespace. Error: ", namespaceName), err)
+		}
+
+		if k8serrors.IsUnauthorized(err) || k8serrors.IsForbidden(err) {
+			log.Error().Err(err).Str("context", "GetKubernetesNamespace").Msg("Unauthorized to access the namespace")
+			return httperror.Forbidden(fmt.Sprintf("an error occurred during the GetKubernetesNamespace operation, unauthorized to access the namespace: %s. Error: ", namespaceName), err)
+		}
+
+		log.Error().Err(err).Str("context", "GetKubernetesNamespace").Msg("Unable to get the namespace")
+		return httperror.InternalServerError(fmt.Sprintf("an error occurred during the GetKubernetesNamespace operation, unable to get the namespace: %s. Error: ", namespaceName), err)
+	}
+
+	if withResourceQuota {
+		return cli.CombineNamespaceWithResourceQuota(namespaceInfo, w)
+	}
+
+	return response.JSON(w, namespaceInfo)
+}
+
+// @id CreateKubernetesNamespace
+// @summary Create a namespace
+// @description Create a namespace within the given environment.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @accept json
+// @produce json
+// @param id path int true "Environment identifier"
+// @param body body models.K8sNamespaceDetails true "Namespace configuration details"
+// @success 200 {object} portainer.K8sNamespaceInfo "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 409 "Conflict - the namespace already exists."
+// @failure 500 "Server error occurred while attempting to create the namespace."
+// @router /kubernetes/{id}/namespaces [post]
+func (handler *Handler) createKubernetesNamespace(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	payload := models.K8sNamespaceDetails{}
+	err := request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
+		log.Error().Err(err).Str("context", "CreateKubernetesNamespace").Msg("Invalid request payload")
+		return httperror.BadRequest("an error occurred during the CreateKubernetesNamespace operation, invalid request payload. Error: ", err)
+	}
+
+	namespaceName := payload.Name
+	cli, httpErr := handler.getProxyKubeClient(r)
+	if httpErr != nil {
+		log.Error().Err(httpErr).Str("context", "CreateKubernetesNamespace").Str("namespace", namespaceName).Msg("Unable to get a Kubernetes client for the user")
+		return httperror.InternalServerError("an error occurred during the CreateKubernetesNamespace operation for the namespace %s, unable to get a Kubernetes client for the user. Error: ", httpErr)
+	}
+
+	namespace, err := cli.CreateNamespace(payload)
+	if err != nil {
+		if k8serrors.IsAlreadyExists(err) {
+			log.Error().Err(err).Str("context", "CreateKubernetesNamespace").Str("namespace", namespaceName).Msg("The namespace already exists")
+			return httperror.Conflict(fmt.Sprintf("an error occurred during the CreateKubernetesNamespace operation, the namespace %s already exists. Error: ", namespaceName), err)
+		}
+
+		log.Error().Err(err).Str("context", "CreateKubernetesNamespace").Str("namespace", namespaceName).Msg("Unable to create the namespace")
+		return httperror.InternalServerError("an error occurred during the CreateKubernetesNamespace operation, unable to create the namespace: "+namespaceName, err)
+	}
+
+	return response.JSON(w, namespace)
+}
+
+// @id DeleteKubernetesNamespace
+// @summary Delete a kubernetes namespace
+// @description Delete a kubernetes namespace within the given environment.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @param id path int true "Environment identifier"
+// @success 200 {string} string "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 403 "Unauthorized access or operation not allowed."
+// @failure 500 "Server error occurred while attempting to delete the namespace."
+// @router /kubernetes/{id}/namespaces [delete]
+func (handler *Handler) deleteKubernetesNamespace(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	namespaceNames, err := request.GetPayload[deleteKubernetesNamespacePayload](r)
+	if err != nil {
+		log.Error().Err(err).Str("context", "DeleteKubernetesNamespace").Msg("Invalid namespace identifier route variable")
+		return httperror.BadRequest("an error occurred during the DeleteKubernetesNamespace operation, invalid namespace identifier route variable. Error: ", err)
+	}
+
+	cli, httpErr := handler.getProxyKubeClient(r)
+	if httpErr != nil {
+		log.Error().Err(httpErr).Str("context", "DeleteKubernetesNamespace").Msg("Unable to get a Kubernetes client for the user")
+		return httperror.InternalServerError("an error occurred during the DeleteKubernetesNamespace operation for the namespace %s, unable to get a Kubernetes client for the user. Error: ", httpErr)
+	}
+
+	for _, namespaceName := range *namespaceNames {
+		if _, err := cli.DeleteNamespace(namespaceName); err != nil {
+			if k8serrors.IsNotFound(err) {
+				log.Error().Err(err).Str("context", "DeleteKubernetesNamespace").Str("namespace", namespaceName).Msg("Unable to find the namespace")
+				return httperror.NotFound("an error occurred during the DeleteKubernetesNamespace operation for the namespace "+namespaceName+", unable to find the namespace. Error: ", err)
+			}
+
+			log.Error().Err(err).Str("context", "DeleteKubernetesNamespace").Str("namespace", namespaceName).Msg("Unable to delete the namespace")
+			return httperror.InternalServerError("an error occurred during the DeleteKubernetesNamespace operation for the namespace "+namespaceName+", unable to delete the Kubernetes namespace. Error: ", err)
+		}
+	}
+
+	return response.JSON(w, namespaceNames)
+}
+
+type deleteKubernetesNamespacePayload []string
+
+func (payload deleteKubernetesNamespacePayload) Validate(r *http.Request) error {
+	if len(payload) == 0 {
+		return errors.New("namespace names are required")
+	}
+
+	return nil
+}
+
+// @id UpdateKubernetesNamespace
+// @summary Update a namespace
+// @description Update a namespace within the given environment.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @accept json
+// @produce json
+// @param id path int true "Environment identifier"
+// @param namespace path string true "Namespace"
+// @param body body models.K8sNamespaceDetails true "Namespace details"
+// @success 200 {object} portainer.K8sNamespaceInfo "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier or unable to find a specific namespace."
+// @failure 500 "Server error occurred while attempting to update the namespace."
+// @router /kubernetes/{id}/namespaces/{namespace} [put]
+func (handler *Handler) updateKubernetesNamespace(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	payload := models.K8sNamespaceDetails{}
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return httperror.BadRequest("an error occurred during the UpdateKubernetesNamespace operation, invalid request payload. Error: ", err)
+	}
+
+	namespaceName := payload.Name
+	cli, httpErr := handler.getProxyKubeClient(r)
+	if httpErr != nil {
+		return httperror.InternalServerError(fmt.Sprintf("an error occurred during the UpdateKubernetesNamespace operation for the namespace %s, unable to get a Kubernetes client for the user. Error: ", namespaceName), httpErr)
+	}
+
+	namespace, err := cli.UpdateNamespace(payload)
+	if err != nil {
+		return httperror.InternalServerError(fmt.Sprintf("an error occurred during the UpdateKubernetesNamespace operation for the namespace %s, unable to update the Kubernetes namespace. Error: ", namespaceName), err)
+	}
+
+	return response.JSON(w, namespace)
+}
diff --git a/api/http/handler/kubernetes/node.go b/api/http/handler/kubernetes/node.go
new file mode 100644
index 0000000..09ba02f
--- /dev/null
+++ b/api/http/handler/kubernetes/node.go
@@ -0,0 +1,105 @@
+package kubernetes
+
+import (
+	"net/http"
+
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/portainer/portainer/pkg/libkubectl"
+	"github.com/rs/zerolog/log"
+	corev1 "k8s.io/api/core/v1"
+	k8serrors "k8s.io/apimachinery/pkg/api/errors"
+)
+
+// KubernetesNodeResponse is the documented response model for cluster node endpoints.
+type KubernetesNodeResponse corev1.Node
+
+// @id GetKubernetesNodes
+// @summary Get Kubernetes cluster nodes
+// @description Returns the list of Kubernetes nodes for the selected environment.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment(Endpoint) identifier"
+// @success 200 {array} KubernetesNodeResponse "Success"
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource."
+// @failure 500 "Server error occurred while attempting to retrieve the list of nodes."
+// @router /kubernetes/{id}/nodes [get]
+func (handler *Handler) getKubernetesNodes(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	cli, httpErr := handler.getProxyKubeClient(r)
+	if httpErr != nil {
+		log.Error().
+			Err(httpErr).
+			Int("status_code", httpErr.StatusCode).
+			Str("message", httpErr.Message).
+			Str("context", "getKubernetesNodes").
+			Msg("Unable to prepare kube client")
+		return httpErr
+	}
+
+	nodes, err := cli.GetClusterNodes()
+	if err != nil {
+		if k8serrors.IsUnauthorized(err) {
+			log.Error().Err(err).Str("context", "getKubernetesNodes").Msg("Unable to retrieve nodes")
+			return httperror.Unauthorized("Unable to retrieve nodes", err)
+		}
+
+		if k8serrors.IsForbidden(err) {
+			log.Error().Err(err).Str("context", "getKubernetesNodes").Msg("Unable to retrieve nodes")
+			return httperror.Forbidden("Unable to retrieve nodes", err)
+		}
+
+		log.Error().Err(err).Str("context", "getKubernetesNodes").Msg("Unable to retrieve nodes")
+		return httperror.InternalServerError("Unable to retrieve nodes", err)
+	}
+
+	return response.JSON(w, nodes)
+}
+
+// @id drainNode
+// @summary Drain a Kubernetes node
+// @description Drain a Kubernetes node by safely evicting all pods from the node, preparing it for maintenance or removal
+// @description **Access policy**: authenticated
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @accept json
+// @param id path int true "Environment(Endpoint) identifier"
+// @param name path string true "Name of the node to drain"
+// @success 204 "Success"
+// @failure 400 "Invalid request, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier or unable to find the specified node."
+// @failure 500 "Server error occurred while attempting to drain node."
+// @router /kubernetes/{id}/nodes/{name}/drain [post]
+func (handler *Handler) drainNode(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	name, err := request.RetrieveRouteVariableValue(r, "name")
+	if err != nil {
+		log.Error().Err(err).Str("context", "drainNode").Msg("Invalid node name route variable")
+		return httperror.BadRequest("Invalid node name route variable", err)
+	}
+
+	kubeCtlAccess, err := handler.getLibKubectlAccess(r)
+	if err != nil {
+		log.Error().Err(err).Str("context", "drainNode").Str("node name", name).Msg("Unable to get a Kubernetes client for the user")
+		return httperror.InternalServerError("Unable to get a Kubernetes client for the user", err)
+	}
+
+	client, err := libkubectl.NewClient(kubeCtlAccess, "", "", true)
+	if err != nil {
+		log.Error().Err(err).Str("context", "drainNode").Msg("Failed to create kubernetes client")
+		return httperror.InternalServerError("an error occurred during the drainNode operation, failed to create kubernetes client. Error: ", err)
+	}
+
+	output, err := client.DrainNode(name)
+	if err != nil {
+		log.Error().Err(err).Str("context", "drainNode").Msg("Failed to drain node")
+		return httperror.InternalServerError("an error occurred during the drainNode operation, failed to drain node. Error: ", err)
+	}
+	log.Debug().Str("context", "drainNode").Str("node name", name).Str("output", output).Msg("Drained node")
+
+	return response.Empty(w)
+}
diff --git a/api/http/handler/kubernetes/node_test.go b/api/http/handler/kubernetes/node_test.go
new file mode 100644
index 0000000..768cf7f
--- /dev/null
+++ b/api/http/handler/kubernetes/node_test.go
@@ -0,0 +1,104 @@
+package kubernetes
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+	"github.com/portainer/portainer/api/jwt"
+	"github.com/portainer/portainer/api/kubernetes"
+	kubeclient "github.com/portainer/portainer/api/kubernetes/cli"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func newNodeTestHandler(t *testing.T) (*Handler, *portainer.User, string) {
+	t.Helper()
+
+	srv := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{}`))
+	}))
+	t.Cleanup(srv.Close)
+
+	_, store := datastore.MustNewTestStore(t, true, true)
+
+	// KubernetesLocalEnvironment avoids the nil signatureService panic that
+	// AgentOnKubernetesEnvironment triggers via buildAgentConfig.
+	err := store.Endpoint().Create(&portainer.Endpoint{
+		ID:   1,
+		Type: portainer.KubernetesLocalEnvironment,
+	})
+	require.NoError(t, err)
+
+	u := &portainer.User{Username: "admin", Role: portainer.AdministratorRole}
+	err = store.User().Create(u)
+	require.NoError(t, err)
+
+	jwtService, err := jwt.NewService("1h", store)
+	require.NoError(t, err)
+
+	tk, _, err := jwtService.GenerateToken(&portainer.TokenData{ID: u.ID, Username: u.Username, Role: u.Role})
+	require.NoError(t, err)
+
+	kubeClusterAccessService := kubernetes.NewKubeClusterAccessService("", "", "")
+
+	srvURL, err := url.Parse(srv.URL)
+	require.NoError(t, err)
+
+	cli := testhelpers.NewKubernetesClient()
+	factory, err := kubeclient.NewClientFactory(nil, nil, store, "", ":"+srvURL.Port(), "")
+	require.NoError(t, err)
+
+	authorizationService := authorization.NewService(store)
+	handler := NewHandler(testhelpers.NewTestRequestBouncer(), authorizationService, store, jwtService, kubeClusterAccessService, factory, cli)
+
+	return handler, u, tk
+}
+
+func newNodeRequest(t *testing.T, method, path string, u *portainer.User, tk string) *http.Request {
+	t.Helper()
+
+	req := httptest.NewRequest(method, path, nil)
+	ctx := security.StoreTokenData(req, &portainer.TokenData{ID: u.ID, Username: u.Username, Role: u.Role})
+	req = req.WithContext(ctx)
+	ctx = security.StoreRestrictedRequestContext(req, &security.RestrictedRequestContext{IsAdmin: true, UserID: u.ID})
+	req = req.WithContext(ctx)
+	testhelpers.AddTestSecurityCookie(req, tk)
+	return req
+}
+
+func TestGetKubernetesNodes_ReachesKubernetesLayer(t *testing.T) {
+	t.Parallel()
+	handler, u, tk := newNodeTestHandler(t)
+
+	req := newNodeRequest(t, http.MethodGet, "/kubernetes/1/nodes", u, tk)
+
+	rr := httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+
+	// The TLS test server returns "{}" which the k8s client decodes as an empty
+	// NodeList, so the handler returns 200 with an empty array.
+	assert.NotEqual(t, http.StatusBadRequest, rr.Code, "should not be rejected at the handler layer")
+	assert.NotEqual(t, http.StatusNotFound, rr.Code, "route must be registered")
+	assert.Equal(t, http.StatusOK, rr.Code)
+}
+
+func TestGetKubernetesNodes_WrongMethodReturns404(t *testing.T) {
+	t.Parallel()
+	handler, u, tk := newNodeTestHandler(t)
+
+	req := newNodeRequest(t, http.MethodPost, "/kubernetes/1/nodes", u, tk)
+
+	rr := httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+
+	// Gorilla mux returns 404 for unregistered methods when no MethodNotAllowedHandler is set.
+	assert.Equal(t, http.StatusNotFound, rr.Code)
+}
diff --git a/api/http/handler/kubernetes/nodes_limits.go b/api/http/handler/kubernetes/nodes_limits.go
new file mode 100644
index 0000000..c25b8bd
--- /dev/null
+++ b/api/http/handler/kubernetes/nodes_limits.go
@@ -0,0 +1,88 @@
+package kubernetes
+
+import (
+	"net/http"
+
+	"github.com/portainer/portainer/api/http/middlewares"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/rs/zerolog/log"
+)
+
+// @id GetKubernetesNodesLimits
+// @summary Get CPU and memory limits of all nodes within k8s cluster
+// @description Get CPU and memory limits of all nodes within k8s cluster.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment(Endpoint) identifier"
+// @success 200 {object} portainer.K8sNodesLimits "Success"
+// @failure 400 "Invalid request"
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier."
+// @failure 500 "Server error occurred while attempting to retrieve nodes limits."
+// @router /kubernetes/{id}/nodes_limits [get]
+func (handler *Handler) getKubernetesNodesLimits(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	endpoint, err := middlewares.FetchEndpoint(r)
+	if err != nil {
+		log.Error().Err(err).Str("context", "GetKubernetesNodesLimits").Msg("Unable to find an environment on request context")
+		return httperror.NotFound("Unable to find an environment on request context", err)
+	}
+
+	cli, err := handler.KubernetesClientFactory.GetPrivilegedKubeClient(endpoint)
+	if err != nil {
+		log.Error().Err(err).Str("context", "GetKubernetesNodesLimits").Msg("Unable to create Kubernetes client")
+		return httperror.InternalServerError("Unable to create Kubernetes client", err)
+	}
+
+	nodesLimits, err := cli.GetNodesLimits()
+	if err != nil {
+		log.Error().Err(err).Str("context", "GetKubernetesNodesLimits").Msg("Unable to retrieve nodes limits")
+		return httperror.InternalServerError("Unable to retrieve nodes limits", err)
+	}
+
+	return response.JSON(w, nodesLimits)
+}
+
+// @id GetKubernetesMaxResourceLimits
+// @summary Get max CPU and memory limits of all nodes within k8s cluster
+// @description Get max CPU and memory limits (unused resources) of all nodes within k8s cluster.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment(Endpoint) identifier"
+// @success 200 {object} portainer.K8sNodesLimits "Success"
+// @failure 400 "Invalid request"
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier."
+// @failure 500 "Server error occurred while attempting to retrieve nodes limits."
+// @router /kubernetes/{id}/max_resource_limits [get]
+func (handler *Handler) getKubernetesMaxResourceLimits(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	endpoint, err := middlewares.FetchEndpoint(r)
+	if err != nil {
+		log.Error().Err(err).Str("context", "GetKubernetesMaxResourceLimits").Msg("Unable to find an environment on request context")
+		return httperror.NotFound("Unable to find an environment on request context", err)
+	}
+
+	cli, err := handler.KubernetesClientFactory.GetPrivilegedKubeClient(endpoint)
+	if err != nil {
+		log.Error().Err(err).Str("context", "GetKubernetesMaxResourceLimits").Msg("Unable to create Kubernetes client")
+		return httperror.InternalServerError("Unable to create Kubernetes client", err)
+	}
+
+	overCommit := endpoint.Kubernetes.Configuration.EnableResourceOverCommit
+	overCommitPercent := endpoint.Kubernetes.Configuration.ResourceOverCommitPercentage
+
+	// name is set to "" so all namespaces resources are considered when calculating max resource limits
+	resourceLimit, err := cli.GetMaxResourceLimits("", overCommit, overCommitPercent)
+	if err != nil {
+		log.Error().Err(err).Str("context", "GetKubernetesMaxResourceLimits").Msg("Unable to retrieve max resource limit")
+		return httperror.InternalServerError("Unable to retrieve max resource limit", err)
+	}
+
+	return response.JSON(w, resourceLimit)
+}
diff --git a/api/http/handler/kubernetes/persistent_volume_claims.go b/api/http/handler/kubernetes/persistent_volume_claims.go
new file mode 100644
index 0000000..5f257d3
--- /dev/null
+++ b/api/http/handler/kubernetes/persistent_volume_claims.go
@@ -0,0 +1,237 @@
+package kubernetes
+
+import (
+	"errors"
+	"net/http"
+
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+	kcli "github.com/portainer/portainer/api/kubernetes/cli"
+	"github.com/rs/zerolog/log"
+	k8serrors "k8s.io/apimachinery/pkg/api/errors"
+
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id GetAllKubernetesPersistentVolumeClaims
+// @summary Get all PersistentVolumeClaims
+// @description Get a list of all PersistentVolumeClaims within the given environment. Scoped by namespace for non-admin users.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @success 200 {array} models.K8sPersistentVolumeClaim "Success"
+// @failure 400 "Invalid request payload."
+// @failure 403 "Unauthorized access or operation not allowed."
+// @failure 500 "Server error occurred while attempting to retrieve persistent volume claims."
+// @router /kubernetes/{id}/persistent_volume_claims [get]
+func (handler *Handler) getAllKubernetesPersistentVolumeClaims(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	cli, httpErr := handler.prepareKubeClient(r)
+	if httpErr != nil {
+		log.Error().Err(httpErr).Str("context", "GetAllKubernetesPersistentVolumeClaims").Msg("Unable to get Kubernetes client")
+		return httpErr
+	}
+
+	pvcs, err := cli.GetPersistentVolumeClaims("")
+	if err != nil {
+		if k8serrors.IsUnauthorized(err) || k8serrors.IsForbidden(err) {
+			return httperror.Forbidden("unauthorized access to persistent volume claims", err)
+		}
+
+		log.Error().Err(err).Str("context", "GetAllKubernetesPersistentVolumeClaims").Msg("Failed to retrieve persistent volume claims")
+		return httperror.InternalServerError("failed to retrieve persistent volume claims", err)
+	}
+
+	pvcs, err = cli.CombineClaimsWithApplications(pvcs)
+	if err != nil {
+		log.Warn().Err(err).Str("context", "GetAllKubernetesPersistentVolumeClaims").Msg("Failed to enrich PVCs with owning applications")
+	}
+
+	return response.JSON(w, pvcs)
+}
+
+// @id GetKubernetesPersistentVolumeClaimsInNamespace
+// @summary Get PersistentVolumeClaims in a namespace
+// @description Get a list of PersistentVolumeClaims in the specified namespace.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @param namespace path string true "Namespace name"
+// @success 200 {array} models.K8sPersistentVolumeClaim "Success"
+// @failure 400 "Invalid request payload."
+// @failure 403 "Unauthorized access or operation not allowed."
+// @failure 500 "Server error occurred while attempting to retrieve persistent volume claims."
+// @router /kubernetes/{id}/namespaces/{namespace}/persistent_volume_claims [get]
+func (handler *Handler) getKubernetesPVCsInNamespace(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	namespace, err := request.RetrieveRouteVariableValue(r, "namespace")
+	if err != nil {
+		return httperror.BadRequest("invalid namespace identifier", err)
+	}
+
+	cli, httpErr := handler.prepareKubeClient(r)
+	if httpErr != nil {
+		log.Error().Err(httpErr).Str("context", "GetKubernetesPVCsInNamespace").Msg("Unable to get Kubernetes client")
+		return httpErr
+	}
+
+	pvcs, err := cli.GetPersistentVolumeClaims(namespace)
+	if err != nil {
+		if k8serrors.IsUnauthorized(err) || k8serrors.IsForbidden(err) {
+			return httperror.Forbidden("unauthorized access to persistent volume claims", err)
+		}
+
+		log.Error().Err(err).Str("context", "GetKubernetesPVCsInNamespace").Str("namespace", namespace).Msg("Failed to retrieve persistent volume claims")
+		return httperror.InternalServerError("failed to retrieve persistent volume claims", err)
+	}
+
+	pvcs, err = cli.CombineClaimsWithApplications(pvcs)
+	if err != nil {
+		log.Warn().Err(err).Str("context", "GetKubernetesPVCsInNamespace").Str("namespace", namespace).Msg("Failed to enrich PVCs with owning applications")
+	}
+
+	return response.JSON(w, pvcs)
+}
+
+// @id GetKubernetesPersistentVolumeClaim
+// @summary Get a specific PersistentVolumeClaim
+// @description Get a PersistentVolumeClaim by name within a namespace.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @param namespace path string true "Namespace name"
+// @param name path string true "PVC name"
+// @success 200 {object} models.K8sPersistentVolumeClaim "Success"
+// @failure 400 "Invalid request payload."
+// @failure 403 "Unauthorized access or operation not allowed."
+// @failure 404 "PVC not found."
+// @failure 500 "Server error occurred while attempting to retrieve the persistent volume claim."
+// @router /kubernetes/{id}/namespaces/{namespace}/persistent_volume_claims/{name} [get]
+func (handler *Handler) getKubernetesPersistentVolumeClaim(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	namespace, err := request.RetrieveRouteVariableValue(r, "namespace")
+	if err != nil {
+		return httperror.BadRequest("invalid namespace identifier", err)
+	}
+
+	name, err := request.RetrieveRouteVariableValue(r, "name")
+	if err != nil {
+		return httperror.BadRequest("invalid PVC name", err)
+	}
+
+	cli, httpErr := handler.prepareKubeClient(r)
+	if httpErr != nil {
+		log.Error().Err(httpErr).Str("context", "GetKubernetesPersistentVolumeClaim").Msg("Unable to get Kubernetes client")
+		return httpErr
+	}
+
+	pvc, err := cli.GetPersistentVolumeClaim(namespace, name)
+	if err != nil {
+		if k8serrors.IsNotFound(err) {
+			return httperror.NotFound("persistent volume claim not found", err)
+		}
+
+		if errors.Is(err, kcli.ErrUnauthorized) || k8serrors.IsUnauthorized(err) || k8serrors.IsForbidden(err) {
+			return httperror.Forbidden("unauthorized access to the Kubernetes API", err)
+		}
+
+		log.Error().Err(err).Str("context", "GetKubernetesPersistentVolumeClaim").Str("namespace", namespace).Str("name", name).Msg("Failed to retrieve persistent volume claim")
+		return httperror.InternalServerError("failed to retrieve persistent volume claim", err)
+	}
+
+	return response.JSON(w, pvc)
+}
+
+// @id DeleteKubernetesPersistentVolumeClaims
+// @summary Delete PersistentVolumeClaims
+// @description Delete the provided list of PersistentVolumeClaims.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @accept json
+// @produce json
+// @param id path int true "Environment identifier"
+// @param body body []models.K8sVolumeDeleteRequest true "List of PVCs to delete (namespace + name)"
+// @success 204 "Success"
+// @failure 400 "Invalid request payload."
+// @failure 403 "Unauthorized access or operation not allowed."
+// @failure 500 "Server error occurred while attempting to delete persistent volume claims."
+// @router /kubernetes/{id}/persistent_volume_claims/delete [post]
+func (handler *Handler) deleteKubernetesPersistentVolumeClaims(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	var payload models.K8sVolumeDeleteRequests
+	err := request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
+		return httperror.BadRequest("unable to decode and validate the request payload", err)
+	}
+
+	cli, httpErr := handler.getProxyKubeClient(r)
+	if httpErr != nil {
+		return httpErr
+	}
+
+	err = cli.DeletePersistentVolumeClaims(payload)
+	if err != nil {
+		if k8serrors.IsUnauthorized(err) || k8serrors.IsForbidden(err) {
+			return httperror.Forbidden("unauthorized access to the Kubernetes API", err)
+		}
+
+		if k8serrors.IsNotFound(err) {
+			return httperror.NotFound("unable to find the persistent volume claims to delete", err)
+		}
+
+		log.Error().Err(err).Str("context", "DeleteKubernetesPersistentVolumeClaims").Msg("Unable to delete persistent volume claims")
+		return httperror.InternalServerError("unable to delete persistent volume claims", err)
+	}
+
+	return response.Empty(w)
+}
+
+// @id ResizeKubernetesPersistentVolumeClaim
+// @summary Resize a PersistentVolumeClaim
+// @description Resize a PVC to a new size. The StorageClass must support volume expansion.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @accept json
+// @produce json
+// @param id path int true "Environment identifier"
+// @param body body models.K8sPVCResizeRequest true "PVC resize request"
+// @success 204 "Success"
+// @failure 400 "Invalid request payload."
+// @failure 403 "Unauthorized access or operation not allowed."
+// @failure 500 "Server error occurred while attempting to resize the persistent volume claim."
+// @router /kubernetes/{id}/persistent_volume_claims/resize [put]
+func (handler *Handler) resizeKubernetesPersistentVolumeClaim(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	var payload models.K8sPVCResizeRequest
+	err := request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
+		return httperror.BadRequest("unable to decode and validate the request payload", err)
+	}
+
+	cli, httpErr := handler.getProxyKubeClient(r)
+	if httpErr != nil {
+		return httpErr
+	}
+
+	err = cli.ResizePersistentVolumeClaim(payload.Namespace, payload.Name, payload.NewSize)
+	if err != nil {
+		if k8serrors.IsUnauthorized(err) || k8serrors.IsForbidden(err) {
+			return httperror.Forbidden("unauthorized access to the Kubernetes API", err)
+		}
+
+		if k8serrors.IsNotFound(err) {
+			return httperror.NotFound("persistent volume claim not found", err)
+		}
+
+		log.Error().Err(err).Str("context", "ResizeKubernetesPersistentVolumeClaim").
+			Str("namespace", payload.Namespace).Str("name", payload.Name).
+			Msg("Unable to resize persistent volume claim")
+		return httperror.InternalServerError("unable to resize persistent volume claim", err)
+	}
+
+	return response.Empty(w)
+}
diff --git a/api/http/handler/kubernetes/persistent_volumes.go b/api/http/handler/kubernetes/persistent_volumes.go
new file mode 100644
index 0000000..e94de88
--- /dev/null
+++ b/api/http/handler/kubernetes/persistent_volumes.go
@@ -0,0 +1,180 @@
+package kubernetes
+
+import (
+	"errors"
+	"net/http"
+
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+	kcli "github.com/portainer/portainer/api/kubernetes/cli"
+	"github.com/rs/zerolog/log"
+	k8serrors "k8s.io/apimachinery/pkg/api/errors"
+
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id GetAllKubernetesPersistentVolumes
+// @summary Get all PersistentVolumes in the cluster
+// @description Get a list of all PersistentVolumes in the given environment.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @success 200 {array} models.K8sPersistentVolume "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 403 "Unauthorized access or operation not allowed."
+// @failure 500 "Server error occurred while attempting to retrieve persistent volumes."
+// @router /kubernetes/{id}/persistent_volumes [get]
+func (handler *Handler) getAllKubernetesPersistentVolumes(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	cli, httpErr := handler.prepareKubeClient(r)
+	if httpErr != nil {
+		log.Error().Err(httpErr).Str("context", "GetAllKubernetesPersistentVolumes").Msg("Unable to get Kubernetes client")
+		return httpErr
+	}
+
+	pvs, err := cli.GetPersistentVolumes()
+	if err != nil {
+		if k8serrors.IsUnauthorized(err) || k8serrors.IsForbidden(err) {
+			return httperror.Forbidden("unauthorized access to persistent volumes", err)
+		}
+
+		log.Error().Err(err).Str("context", "GetAllKubernetesPersistentVolumes").Msg("Failed to retrieve persistent volumes")
+		return httperror.InternalServerError("failed to retrieve persistent volumes", err)
+	}
+
+	return response.JSON(w, pvs)
+}
+
+// @id GetKubernetesPersistentVolume
+// @summary Get a specific PersistentVolume
+// @description Get a PersistentVolume by name in the given environment.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @param name path string true "PersistentVolume name"
+// @success 200 {object} models.K8sPersistentVolume "Success"
+// @failure 400 "Invalid request payload."
+// @failure 403 "Unauthorized access or operation not allowed."
+// @failure 404 "PersistentVolume not found."
+// @failure 500 "Server error occurred while attempting to retrieve the persistent volume."
+// @router /kubernetes/{id}/persistent_volumes/{name} [get]
+func (handler *Handler) getKubernetesPersistentVolume(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	name, err := request.RetrieveRouteVariableValue(r, "name")
+	if err != nil {
+		return httperror.BadRequest("invalid persistent volume name", err)
+	}
+
+	cli, httpErr := handler.prepareKubeClient(r)
+	if httpErr != nil {
+		log.Error().Err(httpErr).Str("context", "GetKubernetesPersistentVolume").Msg("Unable to get Kubernetes client")
+		return httpErr
+	}
+
+	pv, err := cli.GetPersistentVolume(name)
+	if err != nil {
+		if k8serrors.IsNotFound(err) {
+			return httperror.NotFound("persistent volume not found", err)
+		}
+
+		if errors.Is(err, kcli.ErrUnauthorized) || k8serrors.IsUnauthorized(err) || k8serrors.IsForbidden(err) {
+			return httperror.Forbidden("unauthorized access to the Kubernetes API", err)
+		}
+
+		log.Error().Err(err).Str("context", "GetKubernetesPersistentVolume").Str("name", name).Msg("Failed to retrieve persistent volume")
+		return httperror.InternalServerError("failed to retrieve persistent volume", err)
+	}
+
+	return response.JSON(w, pv)
+}
+
+// @id DeleteKubernetesPersistentVolumes
+// @summary Delete PersistentVolumes
+// @description Delete the provided list of PersistentVolumes.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @accept json
+// @produce json
+// @param id path int true "Environment identifier"
+// @param body body models.K8sPVDeleteRequest true "List of PV names to delete"
+// @success 204 "Success"
+// @failure 400 "Invalid request payload."
+// @failure 403 "Unauthorized access or operation not allowed."
+// @failure 500 "Server error occurred while attempting to delete persistent volumes."
+// @router /kubernetes/{id}/persistent_volumes/delete [post]
+func (handler *Handler) deleteKubernetesPersistentVolumes(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	var payload models.K8sPVDeleteRequest
+	err := request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
+		return httperror.BadRequest("unable to decode and validate the request payload", err)
+	}
+
+	cli, httpErr := handler.getProxyKubeClient(r)
+	if httpErr != nil {
+		return httpErr
+	}
+
+	err = cli.DeletePersistentVolumes(payload)
+	if err != nil {
+		if k8serrors.IsUnauthorized(err) || k8serrors.IsForbidden(err) {
+			return httperror.Forbidden("unauthorized access to the Kubernetes API", err)
+		}
+
+		if k8serrors.IsNotFound(err) {
+			return httperror.NotFound("unable to find the persistent volumes to delete", err)
+		}
+
+		log.Error().Err(err).Str("context", "DeleteKubernetesPersistentVolumes").Msg("Unable to delete persistent volumes")
+		return httperror.InternalServerError("unable to delete persistent volumes", err)
+	}
+
+	return response.Empty(w)
+}
+
+// @id UpdateKubernetesPersistentVolumeReclaimPolicy
+// @summary Update reclaim policy of a PersistentVolume
+// @description Update the reclaim policy of a PersistentVolume.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @accept json
+// @produce json
+// @param id path int true "Environment identifier"
+// @param body body models.K8sPVReclaimPolicyRequest true "Reclaim policy update request"
+// @success 204 "Success"
+// @failure 400 "Invalid request payload."
+// @failure 403 "Unauthorized access or operation not allowed."
+// @failure 500 "Server error occurred while attempting to update reclaim policy."
+// @router /kubernetes/{id}/persistent_volumes/reclaim_policy [put]
+func (handler *Handler) updateKubernetesPVReclaimPolicy(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	var payload models.K8sPVReclaimPolicyRequest
+	err := request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
+		return httperror.BadRequest("unable to decode and validate the request payload", err)
+	}
+
+	cli, httpErr := handler.getProxyKubeClient(r)
+	if httpErr != nil {
+		return httpErr
+	}
+
+	err = cli.UpdatePersistentVolumeReclaimPolicy(payload.Name, payload.ReclaimPolicy)
+	if err != nil {
+		if k8serrors.IsUnauthorized(err) || k8serrors.IsForbidden(err) {
+			return httperror.Forbidden("unauthorized access to the Kubernetes API", err)
+		}
+
+		if k8serrors.IsNotFound(err) {
+			return httperror.NotFound("persistent volume not found", err)
+		}
+
+		log.Error().Err(err).Str("context", "UpdateKubernetesPVReclaimPolicy").Str("name", payload.Name).Msg("Unable to update reclaim policy")
+		return httperror.InternalServerError("unable to update reclaim policy", err)
+	}
+
+	return response.Empty(w)
+}
diff --git a/api/http/handler/kubernetes/pod.go b/api/http/handler/kubernetes/pod.go
new file mode 100644
index 0000000..e6f5f6a
--- /dev/null
+++ b/api/http/handler/kubernetes/pod.go
@@ -0,0 +1,127 @@
+package kubernetes
+
+import (
+	"net/http"
+
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/rs/zerolog/log"
+	k8serrors "k8s.io/apimachinery/pkg/api/errors"
+)
+
+// @id DeleteKubernetesPod
+// @summary Delete a kubernetes pod
+// @description Delete a single Kubernetes pod in the given namespace. The owning
+// @description controller (Deployment, StatefulSet, DaemonSet, ...) is responsible
+// @description for recreating the pod. For naked pods the pod is removed permanently.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment(Endpoint) identifier"
+// @param namespace path string true "Namespace"
+// @param name path string true "Pod name"
+// @success 204 "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier or unable to find the specified pod."
+// @failure 500 "Server error occurred while attempting to delete the pod."
+// @router /kubernetes/{id}/namespaces/{namespace}/pods/{name} [delete]
+func (handler *Handler) deleteKubernetesPod(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	namespace, name, httpErr := parseNamespaceAndPodName(r)
+	if httpErr != nil {
+		return httpErr
+	}
+
+	cli, httpErr := handler.prepareKubeClient(r)
+	if httpErr != nil {
+		log.Error().Err(httpErr).Str("context", "DeleteKubernetesPod").Str("namespace", namespace).Str("name", name).Msg("Unable to get a Kubernetes client for the user")
+		return httperror.InternalServerError("Unable to get a Kubernetes client for the user", httpErr)
+	}
+
+	if err := cli.DeletePod(namespace, name); err != nil {
+		if k8serrors.IsNotFound(err) {
+			log.Error().Err(err).Str("context", "DeleteKubernetesPod").Str("namespace", namespace).Str("name", name).Msg("Pod not found")
+			return httperror.NotFound("Pod not found", err)
+		}
+		if k8serrors.IsForbidden(err) {
+			log.Error().Err(err).Str("context", "DeleteKubernetesPod").Str("namespace", namespace).Str("name", name).Msg("Permission denied to delete the pod")
+			return httperror.Forbidden("Permission denied to delete the pod", err)
+		}
+		log.Error().Err(err).Str("context", "DeleteKubernetesPod").Str("namespace", namespace).Str("name", name).Msg("Unable to delete the pod")
+		return httperror.InternalServerError("Unable to delete the pod", err)
+	}
+
+	return response.Empty(w)
+}
+
+// @id RestartKubernetesPod
+// @summary Restart all containers in a Kubernetes pod
+// @description Restart all containers in a single Kubernetes pod in place using
+// @description the Kubernetes 1.35 alpha pod-restart subresource. The pod itself
+// @description is preserved. Requires the cluster to expose the corresponding
+// @description subresource (and the matching feature gate to be enabled).
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment(Endpoint) identifier"
+// @param namespace path string true "Namespace"
+// @param name path string true "Pod name"
+// @success 204 "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment, the specified pod, or the cluster does not expose the pod-restart subresource (Kubernetes <1.35 or feature gate disabled)."
+// @failure 405 "The cluster does not support the pod-restart subresource (Kubernetes <1.35 or feature gate disabled)."
+// @failure 500 "Server error occurred while attempting to restart the pod."
+// @router /kubernetes/{id}/namespaces/{namespace}/pods/{name}/restart [post]
+func (handler *Handler) restartKubernetesPod(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	namespace, name, httpErr := parseNamespaceAndPodName(r)
+	if httpErr != nil {
+		return httpErr
+	}
+
+	cli, httpErr := handler.prepareKubeClient(r)
+	if httpErr != nil {
+		log.Error().Err(httpErr).Str("context", "RestartKubernetesPod").Str("namespace", namespace).Str("name", name).Msg("Unable to get a Kubernetes client for the user")
+		return httperror.InternalServerError("Unable to get a Kubernetes client for the user", httpErr)
+	}
+
+	if err := cli.RestartPod(namespace, name); err != nil {
+		if k8serrors.IsNotFound(err) {
+			log.Error().Err(err).Str("context", "RestartKubernetesPod").Str("namespace", namespace).Str("name", name).Msg("Pod or pod-restart subresource not found")
+			return httperror.NotFound("Pod or pod-restart subresource not found. The Kubernetes 1.35 alpha pod-restart subresource is required and may need its feature gate enabled.", err)
+		}
+		if k8serrors.IsMethodNotSupported(err) {
+			log.Error().Err(err).Str("context", "RestartKubernetesPod").Str("namespace", namespace).Str("name", name).Msg("Pod-restart subresource not supported")
+			return httperror.NewError(http.StatusMethodNotAllowed, "The cluster does not support the pod-restart subresource (Kubernetes <1.35 or feature gate disabled).", err)
+		}
+		if k8serrors.IsForbidden(err) {
+			log.Error().Err(err).Str("context", "RestartKubernetesPod").Str("namespace", namespace).Str("name", name).Msg("Permission denied to restart the pod")
+			return httperror.Forbidden("Permission denied to restart the pod", err)
+		}
+		log.Error().Err(err).Str("context", "RestartKubernetesPod").Str("namespace", namespace).Str("name", name).Msg("Unable to restart the pod")
+		return httperror.InternalServerError("Unable to restart the pod", err)
+	}
+
+	return response.Empty(w)
+}
+
+func parseNamespaceAndPodName(r *http.Request) (string, string, *httperror.HandlerError) {
+	namespace, err := request.RetrieveRouteVariableValue(r, "namespace")
+	if err != nil {
+		log.Error().Err(err).Str("context", "parseNamespaceAndPodName").Msg("Invalid namespace route variable")
+		return "", "", httperror.BadRequest("Invalid namespace route variable", err)
+	}
+
+	name, err := request.RetrieveRouteVariableValue(r, "name")
+	if err != nil {
+		log.Error().Err(err).Str("context", "parseNamespaceAndPodName").Msg("Invalid pod name route variable")
+		return "", "", httperror.BadRequest("Invalid pod name route variable", err)
+	}
+
+	return namespace, name, nil
+}
diff --git a/api/http/handler/kubernetes/pod_test.go b/api/http/handler/kubernetes/pod_test.go
new file mode 100644
index 0000000..3f2b311
--- /dev/null
+++ b/api/http/handler/kubernetes/pod_test.go
@@ -0,0 +1,131 @@
+package kubernetes
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+	"github.com/portainer/portainer/api/jwt"
+	"github.com/portainer/portainer/api/kubernetes"
+	kubeclient "github.com/portainer/portainer/api/kubernetes/cli"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func newPodTestHandler(t *testing.T) (*Handler, *portainer.User, string) {
+	t.Helper()
+
+	srv := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{}`))
+	}))
+	t.Cleanup(srv.Close)
+
+	_, store := datastore.MustNewTestStore(t, true, true)
+
+	// KubernetesLocalEnvironment avoids the nil signatureService panic that
+	// AgentOnKubernetesEnvironment triggers via buildAgentConfig.
+	err := store.Endpoint().Create(&portainer.Endpoint{
+		ID:   1,
+		Type: portainer.KubernetesLocalEnvironment,
+	})
+	require.NoError(t, err)
+
+	u := &portainer.User{Username: "admin", Role: portainer.AdministratorRole}
+	err = store.User().Create(u)
+	require.NoError(t, err)
+
+	jwtService, err := jwt.NewService("1h", store)
+	require.NoError(t, err)
+
+	tk, _, err := jwtService.GenerateToken(&portainer.TokenData{ID: u.ID, Username: u.Username, Role: u.Role})
+	require.NoError(t, err)
+
+	kubeClusterAccessService := kubernetes.NewKubeClusterAccessService("", "", "")
+
+	srvURL, err := url.Parse(srv.URL)
+	require.NoError(t, err)
+
+	cli := testhelpers.NewKubernetesClient()
+	factory, err := kubeclient.NewClientFactory(nil, nil, store, "", ":"+srvURL.Port(), "")
+	require.NoError(t, err)
+
+	authorizationService := authorization.NewService(store)
+	handler := NewHandler(testhelpers.NewTestRequestBouncer(), authorizationService, store, jwtService, kubeClusterAccessService, factory, cli)
+
+	return handler, u, tk
+}
+
+func newPodRequest(t *testing.T, method, path string, u *portainer.User, tk string) *http.Request {
+	t.Helper()
+
+	req := httptest.NewRequest(method, path, nil)
+	ctx := security.StoreTokenData(req, &portainer.TokenData{ID: u.ID, Username: u.Username, Role: u.Role})
+	req = req.WithContext(ctx)
+	ctx = security.StoreRestrictedRequestContext(req, &security.RestrictedRequestContext{IsAdmin: true, UserID: u.ID})
+	req = req.WithContext(ctx)
+	testhelpers.AddTestSecurityCookie(req, tk)
+	return req
+}
+
+func TestDeleteKubernetesPod_ReachesKubernetesLayer(t *testing.T) {
+	t.Parallel()
+	handler, u, tk := newPodTestHandler(t)
+
+	req := newPodRequest(t, http.MethodDelete, "/kubernetes/1/namespaces/default/pods/my-pod", u, tk)
+
+	rr := httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+
+	// A valid request must pass all handler-level checks. Without a live
+	// cluster the privileged kube client cannot be created, so we expect 500
+	// rather than a 4xx client error.
+	assert.NotEqual(t, http.StatusBadRequest, rr.Code, "should not be rejected at the handler layer")
+	assert.NotEqual(t, http.StatusNotFound, rr.Code, "route must be registered")
+	assert.Equal(t, http.StatusInternalServerError, rr.Code, "without a live cluster the kube client is unavailable")
+}
+
+func TestDeleteKubernetesPod_WrongMethodReturns404(t *testing.T) {
+	t.Parallel()
+	handler, u, tk := newPodTestHandler(t)
+
+	req := newPodRequest(t, http.MethodGet, "/kubernetes/1/namespaces/default/pods/my-pod", u, tk)
+
+	rr := httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+
+	// Gorilla mux returns 404 for unregistered methods when no MethodNotAllowedHandler is set.
+	assert.Equal(t, http.StatusNotFound, rr.Code)
+}
+
+func TestRestartKubernetesPod_ReachesKubernetesLayer(t *testing.T) {
+	t.Parallel()
+	handler, u, tk := newPodTestHandler(t)
+
+	req := newPodRequest(t, http.MethodPost, "/kubernetes/1/namespaces/default/pods/my-pod/restart", u, tk)
+
+	rr := httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+
+	assert.NotEqual(t, http.StatusBadRequest, rr.Code, "should not be rejected at the handler layer")
+	assert.NotEqual(t, http.StatusNotFound, rr.Code, "route must be registered")
+	assert.Equal(t, http.StatusInternalServerError, rr.Code, "without a live cluster the kube client is unavailable")
+}
+
+func TestRestartKubernetesPod_WrongMethodReturns404(t *testing.T) {
+	t.Parallel()
+	handler, u, tk := newPodTestHandler(t)
+
+	req := newPodRequest(t, http.MethodGet, "/kubernetes/1/namespaces/default/pods/my-pod/restart", u, tk)
+
+	rr := httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+
+	assert.Equal(t, http.StatusNotFound, rr.Code)
+}
diff --git a/api/http/handler/kubernetes/rbac.go b/api/http/handler/kubernetes/rbac.go
new file mode 100644
index 0000000..43f5c51
--- /dev/null
+++ b/api/http/handler/kubernetes/rbac.go
@@ -0,0 +1,39 @@
+package kubernetes
+
+import (
+	"net/http"
+
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/rs/zerolog/log"
+)
+
+// @id GetKubernetesRBACStatus
+// @summary Check if RBAC is enabled
+// @description Check if RBAC is enabled in the specified Kubernetes cluster.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment(Endpoint) identifier"
+// @success 200 {boolean} bool "RBAC status"
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier."
+// @failure 500 "Server error occurred while attempting to retrieve the RBAC status."
+// @router /kubernetes/{id}/rbac_enabled [get]
+func (handler *Handler) getKubernetesRBACStatus(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	cli, handlerErr := handler.getProxyKubeClient(r)
+	if handlerErr != nil {
+		log.Error().Err(handlerErr).Str("context", "GetKubernetesRBACStatus").Msg("Unable to get a Kubernetes client for the user")
+		return httperror.InternalServerError("Unable to get a Kubernetes client for the user. Error: ", handlerErr)
+	}
+
+	isRBACEnabled, err := cli.IsRBACEnabled()
+	if err != nil {
+		log.Error().Err(err).Str("context", "GetKubernetesRBACStatus").Msg("Failed to check RBAC status")
+		return httperror.InternalServerError("Failed to check RBAC status", err)
+	}
+
+	return response.JSON(w, isRBACEnabled)
+}
diff --git a/api/http/handler/kubernetes/role_bindings.go b/api/http/handler/kubernetes/role_bindings.go
new file mode 100644
index 0000000..0f5260b
--- /dev/null
+++ b/api/http/handler/kubernetes/role_bindings.go
@@ -0,0 +1,77 @@
+package kubernetes
+
+import (
+	"net/http"
+
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/rs/zerolog/log"
+)
+
+// @id GetKubernetesRoleBindings
+// @summary Get a list of kubernetes role bindings
+// @description Get a list of kubernetes role bindings that the user has access to.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @success 200 {array} kubernetes.K8sRoleBinding "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier."
+// @failure 500 "Server error occurred while attempting to retrieve the list of role bindings."
+// @router /kubernetes/{id}/rolebindings [get]
+func (handler *Handler) getAllKubernetesRoleBindings(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	cli, httpErr := handler.prepareKubeClient(r)
+	if httpErr != nil {
+		log.Error().Err(httpErr).Str("context", "GetAllKubernetesRoleBindings").Msg("Unable to prepare kube client")
+		return httperror.InternalServerError("unable to prepare kube client. Error: ", httpErr)
+	}
+
+	rolebindings, err := cli.GetRoleBindings("")
+	if err != nil {
+		log.Error().Err(err).Str("context", "GetAllKubernetesRoleBindings").Msg("Unable to fetch rolebindings")
+		return httperror.InternalServerError("unable to fetch rolebindings. Error: ", err)
+	}
+
+	return response.JSON(w, rolebindings)
+}
+
+// @id DeleteRoleBindings
+// @summary Delete role bindings
+// @description Delete the provided list of role bindings.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @accept json
+// @param id path int true "Environment identifier"
+// @param payload body models.K8sRoleBindingDeleteRequests true "A map where the key is the namespace and the value is an array of role bindings to delete"
+// @success 204 "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier or unable to find a specific role binding."
+// @failure 500 "Server error occurred while attempting to delete role bindings."
+// @router /kubernetes/{id}/role_bindings/delete [POST]
+func (h *Handler) deleteRoleBindings(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	var payload models.K8sRoleBindingDeleteRequests
+
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	cli, handlerErr := h.getProxyKubeClient(r)
+	if handlerErr != nil {
+		return handlerErr
+	}
+
+	if err := cli.DeleteRoleBindings(payload); err != nil {
+		return httperror.InternalServerError("Failed to delete role bindings", err)
+	}
+
+	return response.Empty(w)
+}
diff --git a/api/http/handler/kubernetes/roles.go b/api/http/handler/kubernetes/roles.go
new file mode 100644
index 0000000..65ae353
--- /dev/null
+++ b/api/http/handler/kubernetes/roles.go
@@ -0,0 +1,78 @@
+package kubernetes
+
+import (
+	"net/http"
+
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/rs/zerolog/log"
+)
+
+// @id GetKubernetesRoles
+// @summary Get a list of kubernetes roles
+// @description Get a list of kubernetes roles that the user has access to.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @success 200 {array} kubernetes.K8sRole "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier."
+// @failure 500 "Server error occurred while attempting to retrieve the list of roles."
+// @router /kubernetes/{id}/roles [get]
+func (handler *Handler) getAllKubernetesRoles(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	cli, httpErr := handler.prepareKubeClient(r)
+	if httpErr != nil {
+		log.Error().Err(httpErr).Str("context", "GetAllKubernetesRoles").Msg("Unable to prepare kube client")
+		return httperror.InternalServerError("unable to prepare kube client. Error: ", httpErr)
+	}
+
+	roles, err := cli.GetRoles("")
+	if err != nil {
+		log.Error().Err(err).Str("context", "GetAllKubernetesRoles").Msg("Unable to fetch roles across all namespaces")
+		return httperror.InternalServerError("unable to fetch roles across all namespaces. Error: ", err)
+	}
+
+	return response.JSON(w, roles)
+}
+
+// @id DeleteRoles
+// @summary Delete roles
+// @description Delete the provided list of roles.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @accept json
+// @param id path int true "Environment identifier"
+// @param payload body models.K8sRoleDeleteRequests true "A map where the key is the namespace and the value is an array of roles to delete"
+// @success 204 "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier or unable to find a specific role."
+// @failure 500 "Server error occurred while attempting to delete roles."
+// @router /kubernetes/{id}/roles/delete [POST]
+func (h *Handler) deleteRoles(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	var payload models.K8sRoleDeleteRequests
+	err := request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	cli, handlerErr := h.getProxyKubeClient(r)
+	if handlerErr != nil {
+		return handlerErr
+	}
+
+	err = cli.DeleteRoles(payload)
+	if err != nil {
+		return httperror.InternalServerError("Failed to delete roles", err)
+	}
+
+	return response.Empty(w)
+}
diff --git a/api/http/handler/kubernetes/secrets.go b/api/http/handler/kubernetes/secrets.go
new file mode 100644
index 0000000..782e610
--- /dev/null
+++ b/api/http/handler/kubernetes/secrets.go
@@ -0,0 +1,141 @@
+package kubernetes
+
+import (
+	"net/http"
+
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/rs/zerolog/log"
+)
+
+// @id GetKubernetesSecret
+// @summary Get a Secret
+// @description Get a Secret by name for a given namespace.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @param namespace path string true "The namespace name where the secret is located"
+// @param secret path string true "The secret name to get details for"
+// @success 200 {object} models.K8sSecret "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier."
+// @failure 500 "Server error occurred while attempting to retrieve a secret by name belong in a namespace."
+// @router /kubernetes/{id}/namespaces/{namespace}/secrets/{secret} [get]
+func (handler *Handler) getKubernetesSecret(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	namespace, err := request.RetrieveRouteVariableValue(r, "namespace")
+	if err != nil {
+		log.Error().Err(err).Str("context", "GetKubernetesSecret").Str("namespace", namespace).Msg("Unable to retrieve namespace identifier route variable")
+		return httperror.BadRequest("unable to retrieve namespace identifier route variable. Error: ", err)
+	}
+
+	secretName, err := request.RetrieveRouteVariableValue(r, "secret")
+	if err != nil {
+		log.Error().Err(err).Str("context", "GetKubernetesSecret").Str("namespace", namespace).Msg("Unable to retrieve secret identifier route variable")
+		return httperror.BadRequest("unable to retrieve secret identifier route variable. Error: ", err)
+	}
+
+	cli, httpErr := handler.getProxyKubeClient(r)
+	if httpErr != nil {
+		log.Error().Err(httpErr).Str("context", "GetKubernetesSecret").Str("namespace", namespace).Msg("Unable to get a Kubernetes client for the user")
+		return httperror.InternalServerError("unable to get a Kubernetes client for the user. Error: ", httpErr)
+	}
+
+	secret, err := cli.GetSecret(namespace, secretName)
+	if err != nil {
+		log.Error().Err(err).Str("context", "GetKubernetesSecret").Str("namespace", namespace).Str("secret", secretName).Msg("Unable to get secret")
+		return httperror.InternalServerError("unable to get secret. Error: ", err)
+	}
+
+	secretWithApplication, err := cli.CombineSecretWithApplications(secret)
+	if err != nil {
+		log.Error().Err(err).Str("context", "GetKubernetesSecret").Str("namespace", namespace).Str("secret", secretName).Msg("Unable to combine secret with associated applications")
+		return httperror.InternalServerError("unable to combine secret with associated applications. Error: ", err)
+	}
+
+	return response.JSON(w, secretWithApplication)
+}
+
+// @id GetKubernetesSecrets
+// @summary Get a list of Secrets
+// @description Get a list of Secrets for a given namespace. If isUsed is set to true, information about the applications that use the secrets is also returned.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @param isUsed query bool true "When set to true, associate the Secrets with the applications that use them"
+// @success 200 {array} models.K8sSecret "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier."
+// @failure 500 "Server error occurred while attempting to retrieve all secrets from the cluster."
+// @router /kubernetes/{id}/secrets [get]
+func (handler *Handler) GetAllKubernetesSecrets(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	secrets, err := handler.getAllKubernetesSecrets(r)
+	if err != nil {
+		return err
+	}
+
+	return response.JSON(w, secrets)
+}
+
+// @id GetKubernetesSecretsCount
+// @summary Get Secrets count
+// @description Get the count of Secrets across all namespaces that the user has access to.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @success 200 {integer} integer "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier."
+// @failure 500 "Server error occurred while attempting to retrieve the count of all secrets from the cluster."
+// @router /kubernetes/{id}/secrets/count [get]
+func (handler *Handler) getAllKubernetesSecretsCount(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	secrets, err := handler.getAllKubernetesSecrets(r)
+	if err != nil {
+		return err
+	}
+
+	return response.JSON(w, len(secrets))
+}
+
+func (handler *Handler) getAllKubernetesSecrets(r *http.Request) ([]models.K8sSecret, *httperror.HandlerError) {
+	isUsed, err := request.RetrieveBooleanQueryParameter(r, "isUsed", true)
+	if err != nil {
+		log.Error().Err(err).Str("context", "GetAllKubernetesSecrets").Msg("Unable to retrieve isUsed query parameter")
+		return nil, httperror.BadRequest("unable to retrieve isUsed query parameter. Error: ", err)
+	}
+
+	cli, httpErr := handler.prepareKubeClient(r)
+	if httpErr != nil {
+		log.Error().Err(httpErr).Str("context", "GetAllKubernetesSecrets").Msg("Unable to prepare kube client")
+		return nil, httperror.InternalServerError("unable to prepare kube client. Error: ", httpErr)
+	}
+
+	secrets, err := cli.GetSecrets("")
+	if err != nil {
+		log.Error().Err(err).Str("context", "GetAllKubernetesSecrets").Msg("Unable to get secrets")
+		return nil, httperror.InternalServerError("unable to get secrets. Error: ", err)
+	}
+
+	if isUsed {
+		err = cli.SetSecretsIsUsed(&secrets)
+		if err != nil {
+			log.Error().Err(err).Str("context", "GetAllKubernetesSecrets").Msg("Unable to combine secrets with associated applications")
+			return nil, httperror.InternalServerError("unable to combine secrets with associated applications. Error: ", err)
+		}
+	}
+
+	return secrets, nil
+}
diff --git a/api/http/handler/kubernetes/service_accounts.go b/api/http/handler/kubernetes/service_accounts.go
new file mode 100644
index 0000000..813d456
--- /dev/null
+++ b/api/http/handler/kubernetes/service_accounts.go
@@ -0,0 +1,172 @@
+package kubernetes
+
+import (
+	"net/http"
+
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/rs/zerolog/log"
+	k8serrors "k8s.io/apimachinery/pkg/api/errors"
+)
+
+// @id GetKubernetesServiceAccounts
+// @summary Get a list of kubernetes service accounts
+// @description Get a list of kubernetes service accounts that the user has access to.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @success 200 {array} kubernetes.K8sServiceAccount "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier."
+// @failure 500 "Server error occurred while attempting to retrieve the list of service accounts."
+// @router /kubernetes/{id}/serviceaccounts [get]
+func (handler *Handler) getAllKubernetesServiceAccounts(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	cli, httpErr := handler.prepareKubeClient(r)
+	if httpErr != nil {
+		log.Error().Err(httpErr).Str("context", "GetAllKubernetesServiceAccounts").Msg("Unable to prepare kube client")
+		return httperror.InternalServerError("unable to prepare kube client. Error: ", httpErr)
+	}
+
+	serviceAccounts, err := cli.GetServiceAccounts("")
+	if err != nil {
+		log.Error().Err(err).Str("context", "GetAllKubernetesServiceAccounts").Msg("Unable to fetch service accounts across all namespaces")
+		return httperror.InternalServerError("unable to fetch service accounts. Error: ", err)
+	}
+
+	return response.JSON(w, serviceAccounts)
+}
+
+// @id GetKubernetesServiceAccount
+// @summary Get a kubernetes service account
+// @description Get a kubernetes service account in the given namespace.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @param namespace path string true "Namespace"
+// @param name path string true "Service account name"
+// @success 200 {object} models.K8sServiceAccount "Success"
+// @failure 400 "Invalid request"
+// @failure 401 "Unauthorized"
+// @failure 403 "Permission denied"
+// @failure 404 "Service account not found"
+// @failure 500 "Server error"
+// @router /kubernetes/{id}/namespaces/{namespace}/service_accounts/{name} [get]
+func (handler *Handler) getKubernetesServiceAccount(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	namespace, err := request.RetrieveRouteVariableValue(r, "namespace")
+	if err != nil {
+		return httperror.BadRequest("Invalid namespace", err)
+	}
+
+	name, err := request.RetrieveRouteVariableValue(r, "name")
+	if err != nil {
+		return httperror.BadRequest("Invalid name", err)
+	}
+
+	cli, httpErr := handler.prepareKubeClient(r)
+	if httpErr != nil {
+		return httperror.InternalServerError("Unable to prepare kube client", httpErr)
+	}
+
+	sa, err := cli.GetServiceAccount(namespace, name)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve service account", err)
+	}
+
+	return response.JSON(w, sa)
+}
+
+// @id DeleteServiceAccounts
+// @summary Delete service accounts
+// @description Delete the provided list of service accounts.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @accept json
+// @param id path int true "Environment identifier"
+// @param payload body models.K8sServiceAccountDeleteRequests true "A map where the key is the namespace and the value is an array of service accounts to delete"
+// @success 204 "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier or unable to find a specific service account."
+// @failure 500 "Server error occurred while attempting to delete service accounts."
+// @router /kubernetes/{id}/service_accounts/delete [POST]
+func (handler *Handler) deleteKubernetesServiceAccounts(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	var payload models.K8sServiceAccountDeleteRequests
+	err := request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	cli, handlerErr := handler.getProxyKubeClient(r)
+	if handlerErr != nil {
+		return handlerErr
+	}
+
+	err = cli.DeleteServiceAccounts(payload)
+	if err != nil {
+		return httperror.InternalServerError("Unable to delete service accounts", err)
+	}
+
+	return response.Empty(w)
+}
+
+// @id UpdateKubernetesServiceAccountImagePullSecrets
+// @summary Update image pull secrets for a service account
+// @description Replace the imagePullSecrets list on a service account with the provided list.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @accept json
+// @param id path int true "Environment identifier"
+// @param namespace path string true "Namespace"
+// @param name path string true "Service account name"
+// @param payload body models.K8sServiceAccountImagePullSecretsUpdatePayload true "New imagePullSecrets list"
+// @success 204 "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier, namespace, or service account."
+// @failure 500 "Server error occurred while attempting to update image pull secrets for the service account."
+// @router /kubernetes/{id}/namespaces/{namespace}/service_accounts/{name}/image_pull_secrets [put]
+func (handler *Handler) updateKubernetesServiceAccountImagePullSecrets(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	namespace, err := request.RetrieveRouteVariableValue(r, "namespace")
+	if err != nil {
+		return httperror.BadRequest("Invalid namespace", err)
+	}
+
+	name, err := request.RetrieveRouteVariableValue(r, "name")
+	if err != nil {
+		return httperror.BadRequest("Invalid name", err)
+	}
+
+	var payload models.K8sServiceAccountImagePullSecretsUpdatePayload
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	cli, handlerErr := handler.getProxyKubeClient(r)
+	if handlerErr != nil {
+		return handlerErr
+	}
+
+	if err := cli.UpdateServiceAccountImagePullSecrets(namespace, name, payload.SecretNames); err != nil {
+		if k8serrors.IsNotFound(err) {
+			log.Error().Err(err).Str("context", "UpdateKubernetesServiceAccountImagePullSecrets").Msg("Unable to find service account")
+			return httperror.NotFound("Unable to find service account", err)
+		}
+
+		log.Error().Err(err).Str("context", "UpdateKubernetesServiceAccountImagePullSecrets").Msg("Unable to update image pull secrets")
+		return httperror.InternalServerError("Unable to update image pull secrets", err)
+	}
+
+	return response.Empty(w)
+}
diff --git a/api/http/handler/kubernetes/service_accounts_test.go b/api/http/handler/kubernetes/service_accounts_test.go
new file mode 100644
index 0000000..e08e78c
--- /dev/null
+++ b/api/http/handler/kubernetes/service_accounts_test.go
@@ -0,0 +1,220 @@
+package kubernetes
+
+import (
+	"bytes"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+	"github.com/portainer/portainer/api/jwt"
+	"github.com/portainer/portainer/api/kubernetes"
+	kubeclient "github.com/portainer/portainer/api/kubernetes/cli"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func newServiceAccountTestHandler(t *testing.T) (*Handler, *portainer.User, string) {
+	t.Helper()
+
+	srv := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{}`))
+	}))
+	t.Cleanup(srv.Close)
+
+	_, store := datastore.MustNewTestStore(t, true, true)
+
+	err := store.Endpoint().Create(&portainer.Endpoint{
+		ID:   1,
+		Type: portainer.AgentOnKubernetesEnvironment,
+	})
+	require.NoError(t, err, "error creating environment")
+
+	u := &portainer.User{Username: "admin", Role: portainer.AdministratorRole}
+	err = store.User().Create(u)
+	require.NoError(t, err, "error creating a user")
+
+	jwtService, err := jwt.NewService("1h", store)
+	require.NoError(t, err, "error initiating jwt service")
+
+	tk, _, err := jwtService.GenerateToken(&portainer.TokenData{ID: u.ID, Username: u.Username, Role: u.Role})
+	require.NoError(t, err)
+
+	kubeClusterAccessService := kubernetes.NewKubeClusterAccessService("", "", "")
+
+	srvURL, err := url.Parse(srv.URL)
+	require.NoError(t, err)
+
+	cli := testhelpers.NewKubernetesClient()
+	factory, err := kubeclient.NewClientFactory(nil, nil, store, "", ":"+srvURL.Port(), "")
+	require.NoError(t, err)
+
+	authorizationService := authorization.NewService(store)
+	handler := NewHandler(testhelpers.NewTestRequestBouncer(), authorizationService, store, jwtService, kubeClusterAccessService, factory, cli)
+
+	return handler, u, tk
+}
+
+func newServiceAccountRequest(t *testing.T, method, path string, body []byte, u *portainer.User, tk string) *http.Request {
+	t.Helper()
+
+	var req *http.Request
+	if body != nil {
+		req = httptest.NewRequest(method, path, bytes.NewBuffer(body))
+		req.Header.Set("Content-Type", "application/json")
+	} else {
+		req = httptest.NewRequest(method, path, nil)
+	}
+
+	ctx := security.StoreTokenData(req, &portainer.TokenData{ID: u.ID, Username: u.Username, Role: u.Role})
+	req = req.WithContext(ctx)
+	ctx = security.StoreRestrictedRequestContext(req, &security.RestrictedRequestContext{IsAdmin: true, UserID: u.ID})
+	req = req.WithContext(ctx)
+	testhelpers.AddTestSecurityCookie(req, tk)
+
+	return req
+}
+
+func TestDeleteKubernetesServiceAccounts_ValidPayload(t *testing.T) {
+	t.Parallel()
+	handler, u, tk := newServiceAccountTestHandler(t)
+
+	payload := models.K8sServiceAccountDeleteRequests{
+		"default": {"sa-1", "sa-2"},
+	}
+	body, err := json.Marshal(payload)
+	require.NoError(t, err)
+
+	req := newServiceAccountRequest(t, http.MethodPost, "/kubernetes/1/service_accounts/delete", body, u, tk)
+
+	rr := httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+
+	assert.NotEqual(t, http.StatusBadRequest, rr.Code, "should not return bad request for valid payload")
+}
+
+func TestDeleteKubernetesServiceAccounts_InvalidPayload(t *testing.T) {
+	t.Parallel()
+	handler, u, tk := newServiceAccountTestHandler(t)
+
+	payload := models.K8sServiceAccountDeleteRequests{}
+	body, err := json.Marshal(payload)
+	require.NoError(t, err)
+
+	req := newServiceAccountRequest(t, http.MethodPost, "/kubernetes/1/service_accounts/delete", body, u, tk)
+
+	rr := httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+
+	assert.Equal(t, http.StatusBadRequest, rr.Code, "should return bad request for invalid payload")
+	bodyData, err := io.ReadAll(rr.Result().Body)
+	require.NoError(t, err)
+	assert.NotEmpty(t, string(bodyData), "should have error response body")
+}
+
+func TestDeleteKubernetesServiceAccounts_EmptyNamespace(t *testing.T) {
+	t.Parallel()
+	handler, u, tk := newServiceAccountTestHandler(t)
+
+	payload := models.K8sServiceAccountDeleteRequests{
+		"": {"sa-1"},
+	}
+	body, err := json.Marshal(payload)
+	require.NoError(t, err)
+
+	req := newServiceAccountRequest(t, http.MethodPost, "/kubernetes/1/service_accounts/delete", body, u, tk)
+
+	rr := httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+
+	assert.Equal(t, http.StatusBadRequest, rr.Code, "should return bad request for empty namespace")
+	bodyData, err := io.ReadAll(rr.Result().Body)
+	require.NoError(t, err)
+	assert.NotEmpty(t, string(bodyData), "should have error response body")
+}
+
+func TestUpdateKubernetesServiceAccountImagePullSecrets_ValidPayload(t *testing.T) {
+	t.Parallel()
+	handler, u, tk := newServiceAccountTestHandler(t)
+
+	payload := map[string][]string{"secretNames": {"secret-1", "secret-2"}}
+	body, err := json.Marshal(payload)
+	require.NoError(t, err)
+
+	req := newServiceAccountRequest(t, http.MethodPut, "/kubernetes/1/namespaces/default/service_accounts/my-sa/image_pull_secrets", body, u, tk)
+
+	rr := httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+
+	assert.NotEqual(t, http.StatusBadRequest, rr.Code, "should not return bad request for valid payload")
+}
+
+func TestUpdateKubernetesServiceAccountImagePullSecrets_InvalidPayload(t *testing.T) {
+	t.Parallel()
+	handler, u, tk := newServiceAccountTestHandler(t)
+
+	req := newServiceAccountRequest(t, http.MethodPut, "/kubernetes/1/namespaces/default/service_accounts/my-sa/image_pull_secrets", []byte("not-json"), u, tk)
+
+	rr := httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+
+	assert.Equal(t, http.StatusBadRequest, rr.Code, "should return bad request for malformed JSON")
+}
+
+func TestUpdateKubernetesServiceAccountImagePullSecrets_EmptySecretNames(t *testing.T) {
+	t.Parallel()
+	handler, u, tk := newServiceAccountTestHandler(t)
+
+	payload := map[string][]string{"secretNames": {}}
+	body, err := json.Marshal(payload)
+	require.NoError(t, err)
+
+	req := newServiceAccountRequest(t, http.MethodPut, "/kubernetes/1/namespaces/default/service_accounts/my-sa/image_pull_secrets", body, u, tk)
+
+	rr := httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+
+	assert.NotEqual(t, http.StatusBadRequest, rr.Code, "empty secretNames should be valid (clears all imagePullSecrets)")
+}
+
+func TestUpdateKubernetesServiceAccountImagePullSecrets_ReachesKubernetesLayer(t *testing.T) {
+	t.Parallel()
+	// Verifies that valid JSON passes all handler-level checks and reaches the
+	// Kubernetes layer. Without a live cluster the proxy client is unavailable,
+	// so we get 500 — not a 4xx client error.
+	handler, u, tk := newServiceAccountTestHandler(t)
+
+	payload := map[string][]string{"secretNames": {"secret-1", "secret-2"}}
+	body, err := json.Marshal(payload)
+	require.NoError(t, err)
+
+	req := newServiceAccountRequest(t, http.MethodPut, "/kubernetes/1/namespaces/default/service_accounts/my-sa/image_pull_secrets", body, u, tk)
+
+	rr := httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+
+	assert.NotEqual(t, http.StatusBadRequest, rr.Code, "valid payload must not be rejected at the handler layer")
+	assert.Equal(t, http.StatusInternalServerError, rr.Code, "without a live cluster the proxy client is unavailable")
+}
+
+func TestUpdateKubernetesServiceAccountImagePullSecrets_WrongMethodReturns404(t *testing.T) {
+	t.Parallel()
+	handler, u, tk := newServiceAccountTestHandler(t)
+
+	req := newServiceAccountRequest(t, http.MethodGet, "/kubernetes/1/namespaces/default/service_accounts/my-sa/image_pull_secrets", nil, u, tk)
+
+	rr := httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+
+	// Gorilla mux returns 404 (not 405) for method mismatches when no MethodNotAllowedHandler is set
+	assert.Equal(t, http.StatusNotFound, rr.Code, "unregistered method on this route returns 404")
+}
diff --git a/api/http/handler/kubernetes/services.go b/api/http/handler/kubernetes/services.go
new file mode 100644
index 0000000..0274476
--- /dev/null
+++ b/api/http/handler/kubernetes/services.go
@@ -0,0 +1,305 @@
+package kubernetes
+
+import (
+	"net/http"
+
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/rs/zerolog/log"
+	k8serrors "k8s.io/apimachinery/pkg/api/errors"
+)
+
+// @id GetKubernetesServices
+// @summary Get a list of services
+// @description Get a list of services that the user has access to.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @param withApplications query boolean false "Lookup applications associated with each service"
+// @success 200 {array} models.K8sServiceInfo "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier."
+// @failure 500 "Server error occurred while attempting to retrieve all services."
+// @router /kubernetes/{id}/services [get]
+func (handler *Handler) GetAllKubernetesServices(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	services, err := handler.getAllKubernetesServices(r)
+	if err != nil {
+		return err
+	}
+
+	return response.JSON(w, services)
+}
+
+// @id GetAllKubernetesServicesCount
+// @summary Get services count
+// @description Get the count of services that the user has access to.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @success 200 {integer} integer "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier."
+// @failure 500 "Server error occurred while attempting to retrieve the total count of all services."
+// @router /kubernetes/{id}/services/count [get]
+func (handler *Handler) getAllKubernetesServicesCount(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	services, err := handler.getAllKubernetesServices(r)
+	if err != nil {
+		return err
+	}
+
+	return response.JSON(w, len(services))
+}
+
+func (handler *Handler) getAllKubernetesServices(r *http.Request) ([]models.K8sServiceInfo, *httperror.HandlerError) {
+	withApplications, err := request.RetrieveBooleanQueryParameter(r, "withApplications", true)
+	if err != nil {
+		log.Error().Err(err).Str("context", "GetAllKubernetesServices").Msg("Unable to retrieve withApplications identifier")
+		return nil, httperror.BadRequest("unable to retrieve withApplications query parameter. Error: ", err)
+	}
+
+	cli, httpErr := handler.prepareKubeClient(r)
+	if httpErr != nil {
+		log.Error().Err(httpErr).Str("context", "GetAllKubernetesServices").Msg("Unable to get a Kubernetes client for the user")
+		return nil, httperror.InternalServerError("unable to get a Kubernetes client for the user. Error: ", httpErr)
+	}
+
+	services, err := cli.GetServices("")
+	if err != nil {
+		if k8serrors.IsUnauthorized(err) || k8serrors.IsForbidden(err) {
+			log.Error().Err(err).Str("context", "GetAllKubernetesServices").Msg("Unauthorized access to the Kubernetes API")
+			return nil, httperror.Forbidden("unauthorized access to the Kubernetes API. Error: ", err)
+		}
+
+		log.Error().Err(err).Str("context", "GetAllKubernetesServices").Msg("Unable to retrieve services from the Kubernetes for a cluster level user")
+		return nil, httperror.InternalServerError("unable to retrieve services from the Kubernetes for a cluster level user. Error: ", err)
+	}
+
+	if withApplications && len(services) > 0 {
+		servicesWithApplications, err := cli.CombineServicesWithApplications(services)
+		if err != nil {
+			log.Error().Err(err).Str("context", "GetAllKubernetesServices").Msg("Unable to combine services with applications")
+			return nil, httperror.InternalServerError("unable to combine services with applications. Error: ", err)
+		}
+
+		return servicesWithApplications, nil
+	}
+
+	return services, nil
+}
+
+// @id GetKubernetesServicesByNamespace
+// @summary Get a list of services for a given namespace
+// @description Get a list of services for a given namespace.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @param namespace path string true "Namespace name"
+// @success 200 {array} models.K8sServiceInfo "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier."
+// @failure 500 "Server error occurred while attempting to retrieve all services for a namespace."
+// @router /kubernetes/{id}/namespaces/{namespace}/services [get]
+func (handler *Handler) getKubernetesServicesByNamespace(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	namespace, err := request.RetrieveRouteVariableValue(r, "namespace")
+	if err != nil {
+		log.Error().Err(err).Str("context", "GetKubernetesServicesByNamespace").Str("namespace", namespace).Msg("Unable to retrieve namespace identifier route variable")
+		return httperror.BadRequest("unable to retrieve namespace identifier route variable. Error: ", err)
+	}
+
+	cli, httpError := handler.getProxyKubeClient(r)
+	if httpError != nil {
+		return httpError
+	}
+
+	services, err := cli.GetServices(namespace)
+	if err != nil {
+		if k8serrors.IsUnauthorized(err) || k8serrors.IsForbidden(err) {
+			log.Error().Err(err).Str("context", "GetKubernetesServicesByNamespace").Str("namespace", namespace).Msg("Unauthorized access to the Kubernetes API")
+			return httperror.Forbidden("unauthorized access to the Kubernetes API. Error: ", err)
+		}
+
+		log.Error().Err(err).Str("context", "GetKubernetesServicesByNamespace").Str("namespace", namespace).Msg("Unable to retrieve services from the Kubernetes for a namespace level user")
+		return httperror.InternalServerError("unable to retrieve services from the Kubernetes for a namespace level user. Error: ", err)
+	}
+
+	return response.JSON(w, services)
+}
+
+// @id CreateKubernetesService
+// @summary Create a service
+// @description Create a service within a given namespace
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @accept json
+// @produce json
+// @param id path int true "Environment identifier"
+// @param namespace path string true "Namespace name"
+// @param body body models.K8sServiceInfo true "Service definition"
+// @success 204 "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier."
+// @failure 500 "Server error occurred while attempting to create a service."
+// @router /kubernetes/{id}/namespaces/{namespace}/services [post]
+func (handler *Handler) createKubernetesService(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	namespace, err := request.RetrieveRouteVariableValue(r, "namespace")
+	if err != nil {
+		log.Error().Err(err).Str("context", "CreateKubernetesService").Str("namespace", namespace).Msg("Unable to retrieve namespace identifier route variable")
+		return httperror.BadRequest("unable to retrieve namespace identifier route variable. Error: ", err)
+	}
+
+	var payload models.K8sServiceInfo
+	err = request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
+		log.Error().Err(err).Str("context", "CreateKubernetesService").Str("namespace", namespace).Msg("Unable to decode and validate the request payload")
+		return httperror.BadRequest("unable to decode and validate the request payload. Error: ", err)
+	}
+
+	serviceName := payload.Name
+	cli, httpError := handler.getProxyKubeClient(r)
+	if httpError != nil {
+		log.Error().Err(httpError).Str("context", "CreateKubernetesService").Str("namespace", namespace).Str("service", serviceName).Msg("Unable to get a Kubernetes client for the user")
+		return httperror.InternalServerError("unable to get a Kubernetes client for the user. Error: ", httpError)
+	}
+
+	err = cli.CreateService(namespace, payload)
+	if err != nil {
+		if k8serrors.IsUnauthorized(err) || k8serrors.IsForbidden(err) {
+			log.Error().Err(err).Str("context", "CreateKubernetesService").Str("namespace", namespace).Str("service", serviceName).Msg("Unauthorized access to the Kubernetes API")
+			return httperror.Forbidden("unauthorized access to the Kubernetes API. Error: ", err)
+		}
+
+		if k8serrors.IsAlreadyExists(err) {
+			log.Error().Err(err).Str("context", "CreateKubernetesService").Str("namespace", namespace).Str("service", serviceName).Msg("A service with the same name already exists in the namespace")
+			return httperror.Conflict("a service with the same name already exists in the namespace. Error: ", err)
+		}
+
+		log.Error().Err(err).Str("context", "CreateKubernetesService").Str("namespace", namespace).Str("service", serviceName).Msg("Unable to create a service")
+		return httperror.InternalServerError("unable to create a service. Error: ", err)
+	}
+
+	return response.Empty(w)
+}
+
+// @id DeleteKubernetesServices
+// @summary Delete services
+// @description Delete the provided list of services.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @accept json
+// @produce json
+// @param id path int true "Environment identifier"
+// @param body body models.K8sServiceDeleteRequests true "A map where the key is the namespace and the value is an array of services to delete"
+// @success 204 "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier or unable to find a specific service."
+// @failure 500 "Server error occurred while attempting to delete services."
+// @router /kubernetes/{id}/services/delete [post]
+func (handler *Handler) deleteKubernetesServices(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	payload := models.K8sServiceDeleteRequests{}
+	err := request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
+		log.Error().Err(err).Str("context", "DeleteKubernetesServices").Msg("Unable to decode and validate the request payload")
+		return httperror.BadRequest("unable to decode and validate the request payload. Error: ", err)
+	}
+
+	cli, httpError := handler.getProxyKubeClient(r)
+	if httpError != nil {
+		return httpError
+	}
+
+	err = cli.DeleteServices(payload)
+	if err != nil {
+		if k8serrors.IsUnauthorized(err) || k8serrors.IsForbidden(err) {
+			log.Error().Err(err).Str("context", "DeleteKubernetesServices").Msg("Unauthorized access to the Kubernetes API")
+			return httperror.Forbidden("unauthorized access to the Kubernetes API. Error: ", err)
+		}
+
+		if k8serrors.IsNotFound(err) {
+			log.Error().Err(err).Str("context", "DeleteKubernetesServices").Msg("Unable to find the services to delete")
+			return httperror.NotFound("unable to find the services to delete. Error: ", err)
+		}
+
+		log.Error().Err(err).Str("context", "DeleteKubernetesServices").Msg("Unable to delete services")
+		return httperror.InternalServerError("unable to delete services. Error: ", err)
+	}
+
+	return response.Empty(w)
+}
+
+// @id UpdateKubernetesService
+// @summary Update a service
+// @description Update a service within a given namespace.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @accept json
+// @produce json
+// @param id path int true "Environment identifier"
+// @param namespace path string true "Namespace name"
+// @param body body models.K8sServiceInfo true "Service definition"
+// @success 204 "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier or unable to find the service to update."
+// @failure 500 "Server error occurred while attempting to update a service."
+// @router /kubernetes/{id}/namespaces/{namespace}/services [put]
+func (handler *Handler) updateKubernetesService(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	namespace, err := request.RetrieveRouteVariableValue(r, "namespace")
+	if err != nil {
+		log.Error().Err(err).Str("context", "UpdateKubernetesService").Str("namespace", namespace).Msg("Unable to retrieve namespace identifier route variable")
+		return httperror.BadRequest("unable to retrieve namespace identifier route variable. Error: ", err)
+	}
+
+	var payload models.K8sServiceInfo
+	err = request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
+		log.Error().Err(err).Str("context", "UpdateKubernetesService").Str("namespace", namespace).Msg("Unable to decode and validate the request payload")
+		return httperror.BadRequest("unable to decode and validate the request payload. Error: ", err)
+	}
+
+	serviceName := payload.Name
+	cli, httpError := handler.getProxyKubeClient(r)
+	if httpError != nil {
+		log.Error().Err(httpError).Str("context", "UpdateKubernetesService").Str("namespace", namespace).Str("service", serviceName).Msg("Unable to get a Kubernetes client for the user")
+		return httperror.InternalServerError("unable to get a Kubernetes client for the user. Error: ", httpError)
+	}
+
+	err = cli.UpdateService(namespace, payload)
+	if err != nil {
+		if k8serrors.IsUnauthorized(err) || k8serrors.IsForbidden(err) {
+			log.Error().Err(err).Str("context", "UpdateKubernetesService").Str("namespace", namespace).Str("service", serviceName).Msg("Unauthorized access to the Kubernetes API")
+			return httperror.Forbidden("unauthorized access to the Kubernetes API. Error: ", err)
+		}
+
+		if k8serrors.IsNotFound(err) {
+			log.Error().Err(err).Str("context", "UpdateKubernetesService").Str("namespace", namespace).Str("service", serviceName).Msg("Unable to find the service to update")
+			return httperror.NotFound("unable to find the service to update. Error: ", err)
+		}
+
+		log.Error().Err(err).Str("context", "UpdateKubernetesService").Str("namespace", namespace).Str("service", serviceName).Msg("Unable to update a service")
+		return httperror.InternalServerError("unable to update a service. Error: ", err)
+	}
+
+	return nil
+}
diff --git a/api/http/handler/kubernetes/storage_classes.go b/api/http/handler/kubernetes/storage_classes.go
new file mode 100644
index 0000000..14ed920
--- /dev/null
+++ b/api/http/handler/kubernetes/storage_classes.go
@@ -0,0 +1,177 @@
+package kubernetes
+
+import (
+	"net/http"
+
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+	"github.com/rs/zerolog/log"
+	k8serrors "k8s.io/apimachinery/pkg/api/errors"
+
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id GetAllKubernetesStorageClasses
+// @summary Get all StorageClasses
+// @description Get a list of all StorageClasses in the given environment.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @success 200 {array} models.K8sStorageClass "Success"
+// @failure 400 "Invalid request payload."
+// @failure 403 "Unauthorized access or operation not allowed."
+// @failure 500 "Server error occurred while attempting to retrieve storage classes."
+// @router /kubernetes/{id}/storage_classes [get]
+func (handler *Handler) getAllKubernetesStorageClasses(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	cli, httpErr := handler.prepareKubeClient(r)
+	if httpErr != nil {
+		log.Error().Err(httpErr).Str("context", "GetAllKubernetesStorageClasses").Msg("Unable to get Kubernetes client")
+		return httpErr
+	}
+
+	storageClasses, err := cli.GetStorageClasses()
+	if err != nil {
+		if k8serrors.IsUnauthorized(err) || k8serrors.IsForbidden(err) {
+			return httperror.Forbidden("unauthorized access to storage classes", err)
+		}
+
+		log.Error().Err(err).Str("context", "GetAllKubernetesStorageClasses").Msg("Failed to retrieve storage classes")
+		return httperror.InternalServerError("failed to retrieve storage classes", err)
+	}
+
+	return response.JSON(w, storageClasses)
+}
+
+// @id GetKubernetesStorageClass
+// @summary Get a specific StorageClass
+// @description Get a StorageClass by name in the given environment.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @param name path string true "StorageClass name"
+// @success 200 {object} models.K8sStorageClass "Success"
+// @failure 400 "Invalid request payload."
+// @failure 403 "Unauthorized access or operation not allowed."
+// @failure 404 "StorageClass not found."
+// @failure 500 "Server error occurred while attempting to retrieve the storage class."
+// @router /kubernetes/{id}/storage_classes/{name} [get]
+func (handler *Handler) getKubernetesStorageClass(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	name, err := request.RetrieveRouteVariableValue(r, "name")
+	if err != nil {
+		return httperror.BadRequest("invalid storage class name", err)
+	}
+
+	cli, httpErr := handler.prepareKubeClient(r)
+	if httpErr != nil {
+		log.Error().Err(httpErr).Str("context", "GetKubernetesStorageClass").Msg("Unable to get Kubernetes client")
+		return httpErr
+	}
+
+	sc, err := cli.GetStorageClass(name)
+	if err != nil {
+		if k8serrors.IsNotFound(err) {
+			return httperror.NotFound("storage class not found", err)
+		}
+
+		if k8serrors.IsUnauthorized(err) || k8serrors.IsForbidden(err) {
+			return httperror.Forbidden("unauthorized access to the Kubernetes API", err)
+		}
+
+		log.Error().Err(err).Str("context", "GetKubernetesStorageClass").Str("name", name).Msg("Failed to retrieve storage class")
+		return httperror.InternalServerError("failed to retrieve storage class", err)
+	}
+
+	return response.JSON(w, sc)
+}
+
+// @id DeleteKubernetesStorageClasses
+// @summary Delete StorageClasses
+// @description Delete the provided list of StorageClasses.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @accept json
+// @produce json
+// @param id path int true "Environment identifier"
+// @param body body models.K8sStorageClassDeleteRequest true "List of StorageClass names to delete"
+// @success 204 "Success"
+// @failure 400 "Invalid request payload."
+// @failure 403 "Unauthorized access or operation not allowed."
+// @failure 500 "Server error occurred while attempting to delete storage classes."
+// @router /kubernetes/{id}/storage_classes/delete [post]
+func (handler *Handler) deleteKubernetesStorageClasses(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	var payload models.K8sStorageClassDeleteRequest
+	err := request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
+		return httperror.BadRequest("unable to decode and validate the request payload", err)
+	}
+
+	cli, httpErr := handler.getProxyKubeClient(r)
+	if httpErr != nil {
+		return httpErr
+	}
+
+	err = cli.DeleteStorageClasses(payload)
+	if err != nil {
+		if k8serrors.IsUnauthorized(err) || k8serrors.IsForbidden(err) {
+			return httperror.Forbidden("unauthorized access to the Kubernetes API", err)
+		}
+
+		if k8serrors.IsNotFound(err) {
+			return httperror.NotFound("unable to find the storage classes to delete", err)
+		}
+
+		log.Error().Err(err).Str("context", "DeleteKubernetesStorageClasses").Msg("Unable to delete storage classes")
+		return httperror.InternalServerError("unable to delete storage classes", err)
+	}
+
+	return response.Empty(w)
+}
+
+// @id SetDefaultKubernetesStorageClass
+// @summary Set a StorageClass as default
+// @description Set the specified StorageClass as the cluster default, removing default from any other.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @accept json
+// @produce json
+// @param id path int true "Environment identifier"
+// @param name path string true "StorageClass name"
+// @success 204 "Success"
+// @failure 400 "Invalid request payload."
+// @failure 403 "Unauthorized access or operation not allowed."
+// @failure 500 "Server error occurred while attempting to set default storage class."
+// @router /kubernetes/{id}/storage_classes/{name}/default [put]
+func (handler *Handler) setDefaultKubernetesStorageClass(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	name, err := request.RetrieveRouteVariableValue(r, "name")
+	if err != nil {
+		return httperror.BadRequest("invalid storage class name", err)
+	}
+
+	cli, httpErr := handler.getProxyKubeClient(r)
+	if httpErr != nil {
+		return httpErr
+	}
+
+	err = cli.SetDefaultStorageClass(name)
+	if err != nil {
+		if k8serrors.IsUnauthorized(err) || k8serrors.IsForbidden(err) {
+			return httperror.Forbidden("unauthorized access to the Kubernetes API", err)
+		}
+
+		if k8serrors.IsNotFound(err) {
+			return httperror.NotFound("storage class not found", err)
+		}
+
+		log.Error().Err(err).Str("context", "SetDefaultKubernetesStorageClass").Str("name", name).Msg("Unable to set default storage class")
+		return httperror.InternalServerError("unable to set default storage class", err)
+	}
+
+	return response.Empty(w)
+}
diff --git a/api/http/handler/kubernetes/toggle_system.go b/api/http/handler/kubernetes/toggle_system.go
new file mode 100644
index 0000000..ad7d19d
--- /dev/null
+++ b/api/http/handler/kubernetes/toggle_system.go
@@ -0,0 +1,67 @@
+package kubernetes
+
+import (
+	"net/http"
+
+	"github.com/portainer/portainer/api/http/middlewares"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type namespacesToggleSystemPayload struct {
+	// Toggle the system state of this namespace to true or false
+	System bool `example:"true"`
+}
+
+func (payload *namespacesToggleSystemPayload) Validate(r *http.Request) error {
+	return nil
+}
+
+// @id KubernetesNamespacesToggleSystem
+// @summary Toggle the system state for a namespace
+// @description Toggle the system state for a namespace
+// @description **Access policy**: Administrator or environment administrator.
+// @security ApiKeyAuth || jwt
+// @tags kubernetes
+// @accept json
+// @param id path int true "Environment identifier"
+// @param namespace path string true "Namespace name"
+// @param body body namespacesToggleSystemPayload true "Update details"
+// @success 204 "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
+// @failure 404 "Unable to find an environment with the specified identifier or unable to find the namespace to update."
+// @failure 500 "Server error occurred while attempting to update the system state of the namespace."
+// @router /kubernetes/{id}/namespaces/{namespace}/system [put]
+func (handler *Handler) namespacesToggleSystem(rw http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	endpoint, err := middlewares.FetchEndpoint(r)
+	if err != nil {
+		return httperror.NotFound("Unable to find an environment on request context", err)
+	}
+
+	namespaceName, err := request.RetrieveRouteVariableValue(r, "namespace")
+	if err != nil {
+		return httperror.BadRequest("Invalid namespace identifier route variable", err)
+	}
+
+	var payload namespacesToggleSystemPayload
+	err = request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	kubeClient, err := handler.KubernetesClientFactory.GetPrivilegedKubeClient(endpoint)
+	if err != nil {
+		return httperror.InternalServerError("Unable to create kubernetes client", err)
+	}
+
+	err = kubeClient.ToggleSystemState(namespaceName, payload.System)
+	if err != nil {
+		return httperror.InternalServerError("Unable to toggle system status", err)
+	}
+
+	return response.Empty(rw)
+
+}
diff --git a/api/http/handler/kubernetes/version.go b/api/http/handler/kubernetes/version.go
new file mode 100644
index 0000000..a619ac7
--- /dev/null
+++ b/api/http/handler/kubernetes/version.go
@@ -0,0 +1,74 @@
+package kubernetes
+
+import (
+	"net/http"
+
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/rs/zerolog/log"
+	k8serrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/version"
+)
+
+// kubernetesVersionResponse is the shape returned by GetKubernetesVersion.
+// It augments the standard Kubernetes /version payload with capability
+// flags computed by Portainer (e.g. whether the API server registers the
+// 1.35 alpha pod-restart subresource) so the UI can gate features without
+// a second round-trip.
+type kubernetesVersionResponse struct {
+	*version.Info
+	// SupportsPodRestart is true when the cluster exposes the `pods/restart`
+	// subresource via API discovery — i.e. the feature gate is enabled and
+	// the cluster version is recent enough. This is the authoritative
+	// signal for whether Portainer can call the pod-restart endpoint, and
+	// is preferred over a raw Kubernetes-version comparison.
+	SupportsPodRestart bool `json:"supportsPodRestart"`
+}
+
+// @id GetKubernetesVersion
+// @summary Get the Kubernetes cluster version and Portainer-relevant capabilities
+// @description Get the Kubernetes cluster version (major, minor, gitVersion, ...)
+// @description as reported by the cluster's discovery API, augmented with capability
+// @description flags Portainer uses to gate UI features (e.g. supportsPodRestart).
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment(Endpoint) identifier"
+// @success 200 {object} kubernetesVersionResponse "Success"
+// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions."
+// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation."
+// @failure 404 "Unable to find an environment with the specified identifier."
+// @failure 500 "Server error occurred while attempting to retrieve the cluster version."
+// @router /kubernetes/{id}/version [get]
+func (handler *Handler) getKubernetesVersion(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	cli, httpErr := handler.prepareKubeClient(r)
+	if httpErr != nil {
+		log.Error().Err(httpErr).Str("context", "GetKubernetesVersion").Msg("Unable to get a Kubernetes client for the user")
+		return httperror.InternalServerError("Unable to get a Kubernetes client for the user", httpErr)
+	}
+
+	info, err := cli.ServerVersion()
+	if err != nil {
+		if k8serrors.IsForbidden(err) {
+			log.Error().Err(err).Str("context", "GetKubernetesVersion").Msg("Permission denied to retrieve cluster version")
+			return httperror.Forbidden("Permission denied to retrieve cluster version", err)
+		}
+		log.Error().Err(err).Str("context", "GetKubernetesVersion").Msg("Unable to retrieve cluster version")
+		return httperror.InternalServerError("Unable to retrieve cluster version", err)
+	}
+
+	// A discovery failure shouldn't fail the whole request — the cluster
+	// version is still useful to the caller. We log it and treat the
+	// capability as unsupported (safe default that hides the action).
+	supportsPodRestart, err := cli.SupportsPodRestart(r.Context())
+	if err != nil {
+		log.Warn().Err(err).Str("context", "GetKubernetesVersion").Msg("Unable to probe pod-restart subresource via API discovery; assuming unsupported")
+		supportsPodRestart = false
+	}
+
+	return response.JSON(w, kubernetesVersionResponse{
+		Info:               info,
+		SupportsPodRestart: supportsPodRestart,
+	})
+}
diff --git a/api/http/handler/kubernetes/version_test.go b/api/http/handler/kubernetes/version_test.go
new file mode 100644
index 0000000..edb1d55
--- /dev/null
+++ b/api/http/handler/kubernetes/version_test.go
@@ -0,0 +1,115 @@
+package kubernetes
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+	"github.com/portainer/portainer/api/jwt"
+	"github.com/portainer/portainer/api/kubernetes"
+	kubeclient "github.com/portainer/portainer/api/kubernetes/cli"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func newVersionTestHandler(t *testing.T) (*Handler, *portainer.User, string) {
+	t.Helper()
+
+	srv := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{}`))
+	}))
+	t.Cleanup(srv.Close)
+
+	_, store := datastore.MustNewTestStore(t, true, true)
+
+	// KubernetesLocalEnvironment avoids the nil signatureService panic that
+	// AgentOnKubernetesEnvironment triggers via buildAgentConfig.
+	err := store.Endpoint().Create(&portainer.Endpoint{
+		ID:   1,
+		Type: portainer.KubernetesLocalEnvironment,
+	})
+	require.NoError(t, err)
+
+	u := &portainer.User{Username: "admin", Role: portainer.AdministratorRole}
+	err = store.User().Create(u)
+	require.NoError(t, err)
+
+	jwtService, err := jwt.NewService("1h", store)
+	require.NoError(t, err)
+
+	tk, _, err := jwtService.GenerateToken(&portainer.TokenData{ID: u.ID, Username: u.Username, Role: u.Role})
+	require.NoError(t, err)
+
+	kubeClusterAccessService := kubernetes.NewKubeClusterAccessService("", "", "")
+
+	srvURL, err := url.Parse(srv.URL)
+	require.NoError(t, err)
+
+	cli := testhelpers.NewKubernetesClient()
+	factory, err := kubeclient.NewClientFactory(nil, nil, store, "", ":"+srvURL.Port(), "")
+	require.NoError(t, err)
+
+	authorizationService := authorization.NewService(store)
+	handler := NewHandler(testhelpers.NewTestRequestBouncer(), authorizationService, store, jwtService, kubeClusterAccessService, factory, cli)
+
+	return handler, u, tk
+}
+
+func newVersionRequest(t *testing.T, method, path string, u *portainer.User, tk string) *http.Request {
+	t.Helper()
+
+	req := httptest.NewRequest(method, path, nil)
+	ctx := security.StoreTokenData(req, &portainer.TokenData{ID: u.ID, Username: u.Username, Role: u.Role})
+	req = req.WithContext(ctx)
+	ctx = security.StoreRestrictedRequestContext(req, &security.RestrictedRequestContext{IsAdmin: true, UserID: u.ID})
+	req = req.WithContext(ctx)
+	testhelpers.AddTestSecurityCookie(req, tk)
+	return req
+}
+
+func TestGetKubernetesVersion_ReachesKubernetesLayer(t *testing.T) {
+	t.Parallel()
+	handler, u, tk := newVersionTestHandler(t)
+
+	req := newVersionRequest(t, http.MethodGet, "/kubernetes/1/version", u, tk)
+
+	rr := httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+
+	// A valid GET must not be rejected at the handler layer. Without a live
+	// cluster the privileged kube client cannot be created (500), not a 4xx.
+	assert.NotEqual(t, http.StatusBadRequest, rr.Code, "should not be rejected at the handler layer")
+	assert.NotEqual(t, http.StatusNotFound, rr.Code, "route must be registered")
+	assert.Equal(t, http.StatusInternalServerError, rr.Code, "without a live cluster the kube client is unavailable")
+}
+
+func TestGetKubernetesVersion_WrongMethodReturns404(t *testing.T) {
+	t.Parallel()
+	handler, u, tk := newVersionTestHandler(t)
+
+	req := newVersionRequest(t, http.MethodPost, "/kubernetes/1/version", u, tk)
+
+	rr := httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+
+	assert.Equal(t, http.StatusNotFound, rr.Code)
+}
+
+func TestGetKubernetesVersion_DeleteMethodReturns404(t *testing.T) {
+	t.Parallel()
+	handler, u, tk := newVersionTestHandler(t)
+
+	req := newVersionRequest(t, http.MethodDelete, "/kubernetes/1/version", u, tk)
+
+	rr := httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+
+	assert.Equal(t, http.StatusNotFound, rr.Code)
+}
diff --git a/api/http/handler/kubernetes/volumes.go b/api/http/handler/kubernetes/volumes.go
new file mode 100644
index 0000000..70163f7
--- /dev/null
+++ b/api/http/handler/kubernetes/volumes.go
@@ -0,0 +1,177 @@
+package kubernetes
+
+import (
+	"net/http"
+
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+	"github.com/rs/zerolog/log"
+	k8serrors "k8s.io/apimachinery/pkg/api/errors"
+
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id GetAllKubernetesVolumes
+// @summary Get Kubernetes volumes within the given Portainer environment
+// @description Get a list of all kubernetes volumes within the given environment (Endpoint). The Endpoint ID must be a valid Portainer environment identifier.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @param withApplications query boolean false "When set to True, include the applications that are using the volumes. It is set to false by default"
+// @success 200 {object} map[string]kubernetes.K8sVolumeInfo "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 403 "Unauthorized access or operation not allowed."
+// @failure 500 "Server error occurred while attempting to retrieve kubernetes volumes."
+// @router /kubernetes/{id}/volumes [get]
+func (handler *Handler) GetAllKubernetesVolumes(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	volumes, err := handler.getKubernetesVolumes(r, "")
+	if err != nil {
+		return err
+	}
+
+	return response.JSON(w, volumes)
+}
+
+// @id getAllKubernetesVolumesCount
+// @summary Get the total number of kubernetes volumes within the given Portainer environment.
+// @description Get the total number of kubernetes volumes within the given environment (Endpoint). The total count depends on the user's role and permissions. The Endpoint ID must be a valid Portainer environment identifier.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @success 200 {integer} integer "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 403 "Unauthorized access or operation not allowed."
+// @failure 500 "Server error occurred while attempting to retrieve kubernetes volumes count."
+// @router /kubernetes/{id}/volumes/count [get]
+func (handler *Handler) getAllKubernetesVolumesCount(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	volumes, err := handler.getKubernetesVolumes(r, "")
+	if err != nil {
+		return err
+	}
+
+	return response.JSON(w, len(volumes))
+}
+
+// @id GetKubernetesVolumesInNamespace
+// @summary Get Kubernetes volumes within a namespace in the given Portainer environment
+// @description Get a list of kubernetes volumes within the specified namespace in the given environment (Endpoint). The Endpoint ID must be a valid Portainer environment identifier.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @param namespace path string true "Namespace identifier"
+// @param withApplications query boolean false "When set to True, include the applications that are using the volumes. It is set to false by default"
+// @success 200 {object} map[string]kubernetes.K8sVolumeInfo "Success"
+// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
+// @failure 403 "Unauthorized access or operation not allowed."
+// @failure 500 "Server error occurred while attempting to retrieve kubernetes volumes in the namespace."
+// @router /kubernetes/{id}/namespaces/{namespace}/volumes [get]
+func (handler *Handler) GetKubernetesVolumesInNamespace(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	namespace, err := request.RetrieveRouteVariableValue(r, "namespace")
+	if err != nil {
+		log.Error().Err(err).Str("context", "GetKubernetesVolumesInNamespace").Msg("Unable to retrieve namespace identifier")
+		return httperror.BadRequest("Invalid namespace identifier", err)
+	}
+
+	volumes, httpErr := handler.getKubernetesVolumes(r, namespace)
+	if httpErr != nil {
+		return httpErr
+	}
+
+	return response.JSON(w, volumes)
+}
+
+// @id GetKubernetesVolume
+// @summary Get a Kubernetes volume within the given Portainer environment
+// @description Get a Kubernetes volume within the given environment (Endpoint). The Endpoint ID must be a valid Portainer environment identifier.
+// @description **Access policy**: Authenticated user.
+// @tags kubernetes
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "Environment identifier"
+// @param namespace path string true "Namespace identifier"
+// @param volume path string true "Volume name"
+// @success 200 {object} kubernetes.K8sVolumeInfo "Success"
+// @failure 400 "Invalid request"
+// @failure 500 "Server error"
+// @router /kubernetes/{id}/volumes/{namespace}/{volume} [get]
+func (handler *Handler) getKubernetesVolume(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	namespace, err := request.RetrieveRouteVariableValue(r, "namespace")
+	if err != nil {
+		log.Error().Err(err).Str("context", "GetKubernetesVolume").Msg("Unable to retrieve namespace identifier")
+		return httperror.BadRequest("Invalid namespace identifier", err)
+	}
+
+	volumeName, err := request.RetrieveRouteVariableValue(r, "volume")
+	if err != nil {
+		log.Error().Err(err).Str("context", "GetKubernetesVolume").Msg("Unable to retrieve volume name")
+		return httperror.BadRequest("Invalid volume name", err)
+	}
+
+	cli, httpErr := handler.prepareKubeClient(r)
+	if httpErr != nil {
+		log.Error().Err(httpErr).Str("context", "GetKubernetesVolume").Msg("Unable to get Kubernetes client")
+		return httperror.InternalServerError("Failed to prepare Kubernetes client", httpErr)
+	}
+
+	volume, err := cli.GetVolume(namespace, volumeName)
+	if err != nil {
+		if k8serrors.IsUnauthorized(err) {
+			log.Error().Err(err).Str("context", "GetKubernetesVolume").Str("namespace", namespace).Str("volume", volumeName).Msg("Unauthorized access")
+			return httperror.Unauthorized("Unauthorized access to volume", err)
+		}
+
+		if k8serrors.IsNotFound(err) {
+			log.Error().Err(err).Str("context", "GetKubernetesVolume").Str("namespace", namespace).Str("volume", volumeName).Msg("Volume not found")
+			return httperror.NotFound("Volume not found", err)
+		}
+
+		log.Error().Err(err).Str("context", "GetKubernetesVolume").Str("namespace", namespace).Str("volume", volumeName).Msg("Failed to retrieve volume")
+		return httperror.InternalServerError("Failed to retrieve volume", err)
+	}
+
+	return response.JSON(w, volume)
+}
+
+func (handler *Handler) getKubernetesVolumes(r *http.Request, namespace string) ([]models.K8sVolumeInfo, *httperror.HandlerError) {
+	withApplications, err := request.RetrieveBooleanQueryParameter(r, "withApplications", true)
+	if err != nil {
+		log.Error().Err(err).Str("context", "GetKubernetesVolumes").Bool("withApplications", withApplications).Msg("Unable to parse query parameter")
+		return nil, httperror.BadRequest("Invalid 'withApplications' parameter", err)
+	}
+
+	cli, httpErr := handler.prepareKubeClient(r)
+	if httpErr != nil {
+		log.Error().Err(httpErr).Str("context", "GetKubernetesVolumes").Msg("Unable to get Kubernetes client")
+		return nil, httperror.InternalServerError("Failed to prepare Kubernetes client", httpErr)
+	}
+
+	volumes, err := cli.GetVolumes(namespace)
+	if err != nil {
+		if k8serrors.IsUnauthorized(err) {
+			log.Error().Err(err).Str("context", "GetKubernetesVolumes").Msg("Unauthorized access")
+			return nil, httperror.Unauthorized("Unauthorized access to volumes", err)
+		}
+
+		log.Error().Err(err).Str("context", "GetKubernetesVolumes").Msg("Failed to retrieve volumes")
+		return nil, httperror.InternalServerError("Failed to retrieve volumes", err)
+	}
+
+	if withApplications {
+		volumesWithApplications, err := cli.CombineVolumesWithApplications(&volumes)
+		if err != nil {
+			log.Error().Err(err).Str("context", "GetKubernetesVolumes").Msg("Failed to combine volumes with applications")
+			return nil, httperror.InternalServerError("Failed to combine volumes with applications", err)
+		}
+
+		return *volumesWithApplications, nil
+	}
+
+	return volumes, nil
+}
diff --git a/api/http/handler/ldap/handler.go b/api/http/handler/ldap/handler.go
new file mode 100644
index 0000000..6b40783
--- /dev/null
+++ b/api/http/handler/ldap/handler.go
@@ -0,0 +1,55 @@
+package ldap
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/filesystem"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+
+	"github.com/gorilla/mux"
+)
+
+// Handler is the HTTP handler used to handle LDAP search Operations
+type Handler struct {
+	*mux.Router
+	DataStore   dataservices.DataStore
+	FileService portainer.FileService
+	LDAPService portainer.LDAPService
+}
+
+// NewHandler returns a new Handler
+func NewHandler(bouncer security.BouncerService) *Handler {
+	h := &Handler{
+		Router: mux.NewRouter(),
+	}
+
+	h.Handle("/ldap/check",
+		bouncer.AdminAccess(httperror.LoggerHandler(h.ldapCheck))).Methods(http.MethodPost)
+
+	return h
+}
+
+func (handler *Handler) prefillSettings(ldapSettings *portainer.LDAPSettings) error {
+	if !ldapSettings.AnonymousMode && ldapSettings.Password == "" {
+		settings, err := handler.DataStore.Settings().Settings()
+		if err != nil {
+			return err
+		}
+
+		ldapSettings.Password = settings.LDAPSettings.Password
+	}
+
+	if (ldapSettings.TLSConfig.TLS || ldapSettings.StartTLS) && !ldapSettings.TLSConfig.TLSSkipVerify {
+		caCertPath, err := handler.FileService.GetPathForTLSFile(filesystem.LDAPStorePath, portainer.TLSFileCA)
+		if err != nil {
+			return err
+		}
+
+		ldapSettings.TLSConfig.TLSCACertPath = caCertPath
+	}
+
+	return nil
+}
diff --git a/api/http/handler/ldap/ldap_check.go b/api/http/handler/ldap/ldap_check.go
new file mode 100644
index 0000000..cbee185
--- /dev/null
+++ b/api/http/handler/ldap/ldap_check.go
@@ -0,0 +1,53 @@
+package ldap
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type checkPayload struct {
+	LDAPSettings portainer.LDAPSettings
+}
+
+func (payload *checkPayload) Validate(r *http.Request) error {
+	return nil
+}
+
+// @id LDAPCheck
+// @summary Test LDAP connectivity
+// @description Test LDAP connectivity using LDAP details
+// @description **Access policy**: administrator
+// @tags ldap
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @param body body checkPayload true "details"
+// @success 204 "Success"
+// @failure 400 "Invalid request"
+// @failure 500 "Server error"
+// @router /ldap/check [post]
+func (handler *Handler) ldapCheck(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	var payload checkPayload
+	err := request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	settings := &payload.LDAPSettings
+
+	err = handler.prefillSettings(settings)
+	if err != nil {
+		return httperror.InternalServerError("Unable to fetch default settings", err)
+	}
+
+	err = handler.LDAPService.TestConnectivity(settings)
+	if err != nil {
+		return httperror.InternalServerError("Unable to connect to LDAP server", err)
+	}
+
+	return response.Empty(w)
+}
diff --git a/api/http/handler/motd/handler.go b/api/http/handler/motd/handler.go
new file mode 100644
index 0000000..bf04306
--- /dev/null
+++ b/api/http/handler/motd/handler.go
@@ -0,0 +1,27 @@
+package motd
+
+import (
+	"net/http"
+
+	"github.com/gorilla/mux"
+	"github.com/portainer/portainer/api/http/security"
+	motdservice "github.com/portainer/portainer/api/motd"
+)
+
+// Handler is the HTTP handler used to handle MOTD operations.
+type Handler struct {
+	*mux.Router
+	motdService *motdservice.Service
+}
+
+// NewHandler returns a new Handler
+func NewHandler(bouncer security.BouncerService, svc *motdservice.Service) *Handler {
+	h := &Handler{
+		Router:      mux.NewRouter(),
+		motdService: svc,
+	}
+	h.Handle("/motd",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.motd))).Methods(http.MethodGet)
+
+	return h
+}
diff --git a/api/http/handler/motd/motd.go b/api/http/handler/motd/motd.go
new file mode 100644
index 0000000..a48dcdd
--- /dev/null
+++ b/api/http/handler/motd/motd.go
@@ -0,0 +1,26 @@
+package motd
+
+import (
+	"net/http"
+
+	_ "github.com/portainer/portainer/api/motd"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/rs/zerolog/log"
+)
+
+// @id MOTD
+// @summary fetches the message of the day
+// @description **Access policy**: restricted
+// @tags motd
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @success 200 {object} motd.Motd
+// @router /motd [get]
+func (handler *Handler) motd(w http.ResponseWriter, r *http.Request) {
+	motd := handler.motdService.GetCached()
+
+	if err := response.JSON(w, motd); err != nil {
+		log.Warn().Err(err).Msg("failed to send MOTD response")
+	}
+}
diff --git a/api/http/handler/registries/handler.go b/api/http/handler/registries/handler.go
new file mode 100644
index 0000000..5eb1966
--- /dev/null
+++ b/api/http/handler/registries/handler.go
@@ -0,0 +1,203 @@
+package registries
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	httperrors "github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/api/http/proxy"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/registryutils/access"
+	"github.com/portainer/portainer/api/kubernetes/cli"
+	"github.com/portainer/portainer/api/pendingactions"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+
+	"github.com/gorilla/mux"
+
+	"github.com/pkg/errors"
+	"github.com/rs/zerolog/log"
+)
+
+func hideFields(registry *portainer.Registry, hideAccesses bool) {
+	registry.Password = ""
+	if registry.ManagementConfiguration != nil {
+		// TLS and SkipTLSVerify should be retained since it's not sensitive information
+		minimalManagementConfig := &portainer.RegistryManagementConfiguration{}
+		minimalManagementConfig.TLSConfig = registry.ManagementConfiguration.TLSConfig
+		registry.ManagementConfiguration = minimalManagementConfig
+	}
+	if hideAccesses {
+		if registry.ManagementConfiguration != nil {
+			registry.ManagementConfiguration.TLSConfig.TLSCACertPath = ""
+			registry.ManagementConfiguration.TLSConfig.TLSCertPath = ""
+			registry.ManagementConfiguration.TLSConfig.TLSKeyPath = ""
+		}
+		registry.RegistryAccesses = nil
+	}
+}
+
+// Handler is the HTTP handler used to handle registry operations.
+type Handler struct {
+	*mux.Router
+	requestBouncer        security.BouncerService
+	DataStore             dataservices.DataStore
+	FileService           portainer.FileService
+	ProxyManager          *proxy.Manager
+	K8sClientFactory      *cli.ClientFactory
+	PendingActionsService *pendingactions.PendingActionsService
+}
+
+// NewHandler creates a handler to manage registry operations.
+func NewHandler(bouncer security.BouncerService) *Handler {
+	h := newHandler(bouncer)
+	h.initRouter(bouncer)
+
+	return h
+}
+
+func newHandler(bouncer security.BouncerService) *Handler {
+	return &Handler{
+		Router:         mux.NewRouter(),
+		requestBouncer: bouncer,
+	}
+}
+
+func (handler *Handler) initRouter(bouncer accessGuard) {
+	adminRouter := handler.NewRoute().Subrouter()
+	adminRouter.Use(bouncer.AdminAccess)
+	adminRouter.Handle("/registries", httperror.LoggerHandler(handler.registryList)).Methods(http.MethodGet)
+	adminRouter.Handle("/registries", httperror.LoggerHandler(handler.registryCreate)).Methods(http.MethodPost)
+	adminRouter.Handle("/registries/{id}", httperror.LoggerHandler(handler.registryUpdate)).Methods(http.MethodPut)
+	adminRouter.Handle("/registries/{id}/configure", httperror.LoggerHandler(handler.registryConfigure)).Methods(http.MethodPost)
+	adminRouter.Handle("/registries/{id}", httperror.LoggerHandler(handler.registryDelete)).Methods(http.MethodDelete)
+	adminRouter.PathPrefix("/registries/proxies/gitlab").Handler(httperror.LoggerHandler(handler.proxyRequestsToGitlabAPIWithoutRegistry))
+
+	// Use registry-specific access bouncer for inspect and repositories endpoints
+	registryAccessRouter := handler.NewRoute().Subrouter()
+	registryAccessRouter.Use(bouncer.AuthenticatedAccess, handler.RegistryAccess)
+	registryAccessRouter.Handle("/registries/{id}", httperror.LoggerHandler(handler.registryInspect)).Methods(http.MethodGet)
+
+	// Keep the gitlab proxy on the regular authenticated router as it doesn't require specific registry access
+	authenticatedRouter := handler.NewRoute().Subrouter()
+	authenticatedRouter.Use(bouncer.AuthenticatedAccess)
+	authenticatedRouter.Handle("/registries/ping", httperror.LoggerHandler(handler.pingRegistry)).Methods(http.MethodPost)
+}
+
+type accessGuard interface {
+	AdminAccess(h http.Handler) http.Handler
+	AuthenticatedAccess(h http.Handler) http.Handler
+	AuthorizedEndpointOperation(r *http.Request, endpoint *portainer.Endpoint) error
+}
+
+func (handler *Handler) registriesHaveSameURLAndCredentials(r1, r2 *portainer.Registry) bool {
+	hasSameUrl := r1.URL == r2.URL
+	hasSameCredentials := r1.Authentication == r2.Authentication && (!r1.Authentication || (r1.Authentication && r1.Username == r2.Username))
+
+	if r1.Type != portainer.GitlabRegistry || r2.Type != portainer.GitlabRegistry {
+		return hasSameUrl && hasSameCredentials
+	}
+
+	return hasSameUrl && hasSameCredentials && r1.Gitlab.ProjectPath == r2.Gitlab.ProjectPath
+}
+
+// this function validates that
+// 1. user has the appropriate authorizations to perform the request
+// 2. user has a direct or indirect access to the registry
+func (handler *Handler) userHasRegistryAccess(r *http.Request, registry *portainer.Registry) (hasAccess bool, isAdmin bool, err error) {
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return false, false, err
+	}
+
+	// Portainer admins always have access to everything
+	if securityContext.IsAdmin {
+		return true, true, nil
+	}
+
+	// mandatory query param that should become a path param
+	endpointIdStr, err := request.RetrieveNumericQueryParameter(r, "endpointId", false)
+	if err != nil {
+		return false, false, err
+	}
+
+	endpointId := portainer.EndpointID(endpointIdStr)
+
+	endpoint, err := handler.DataStore.Endpoint().Endpoint(endpointId)
+	if err != nil {
+		return false, false, err
+	}
+
+	// validate that the request is allowed for the user (READ/WRITE authorization on request path)
+	if err := handler.requestBouncer.AuthorizedEndpointOperation(r, endpoint); errors.Is(err, security.ErrAuthorizationRequired) {
+		return false, false, nil
+	} else if err != nil {
+		return false, false, err
+	}
+
+	// Use the enhanced registry access utility function that includes namespace validation
+	_, err = access.GetAccessibleRegistry(
+		handler.DataStore,
+		handler.K8sClientFactory,
+		securityContext.UserID,
+		endpointId,
+		registry.ID,
+	)
+	if err != nil {
+		return false, false, nil // No access
+	}
+
+	return true, false, nil
+}
+
+// RegistryAccess defines a security check for registry-specific API endpoints.
+// Authentication is required to access these endpoints.
+// The user must have direct or indirect access to the specific registry being requested.
+// This bouncer validates registry access using the userHasRegistryAccess logic.
+func (handler *Handler) RegistryAccess(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// First ensure the user is authenticated
+		tokenData, err := security.RetrieveTokenData(r)
+		if err != nil {
+			httperror.WriteError(w, http.StatusUnauthorized, "Authentication required", httperrors.ErrUnauthorized)
+			return
+		}
+
+		// Extract registry ID from the route
+		registryID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+		if err != nil {
+			httperror.WriteError(w, http.StatusBadRequest, "Invalid registry identifier route variable", err)
+			return
+		}
+
+		// Get the registry from the database
+		registry, err := handler.DataStore.Registry().Read(portainer.RegistryID(registryID))
+		if handler.DataStore.IsErrObjectNotFound(err) {
+			httperror.WriteError(w, http.StatusNotFound, "Unable to find a registry with the specified identifier inside the database", err)
+			return
+		} else if err != nil {
+			httperror.WriteError(w, http.StatusInternalServerError, "Unable to find a registry with the specified identifier inside the database", err)
+			return
+		}
+
+		// Check if user has access to this registry
+		hasAccess, _, err := handler.userHasRegistryAccess(r, registry)
+		if err != nil {
+			httperror.WriteError(w, http.StatusInternalServerError, "Unable to retrieve info from request context", err)
+			return
+		}
+		if !hasAccess {
+			log.Debug().
+				Int("registry_id", registryID).
+				Str("registry_name", registry.Name).
+				Int("user_id", int(tokenData.ID)).
+				Str("context", "RegistryAccessBouncer").
+				Msg("User access denied to registry")
+			httperror.WriteError(w, http.StatusForbidden, "Access denied to resource", httperrors.ErrResourceAccessDenied)
+			return
+		}
+
+		next.ServeHTTP(w, r)
+	})
+}
diff --git a/api/http/handler/registries/proxy_gitlab.go b/api/http/handler/registries/proxy_gitlab.go
new file mode 100644
index 0000000..0f13e4d
--- /dev/null
+++ b/api/http/handler/registries/proxy_gitlab.go
@@ -0,0 +1,23 @@
+package registries
+
+import (
+	"net/http"
+
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+)
+
+// request on /api/registries/proxies/gitlab
+func (handler *Handler) proxyRequestsToGitlabAPIWithoutRegistry(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	domain := r.Header.Get("X-Gitlab-Domain")
+	if domain == "" {
+		return httperror.BadRequest("No Gitlab domain provided", nil)
+	}
+
+	proxy, err := handler.ProxyManager.CreateGitlabProxy(domain)
+	if err != nil {
+		return httperror.InternalServerError("Unable to create gitlab proxy", err)
+	}
+
+	http.StripPrefix("/registries/proxies/gitlab", proxy).ServeHTTP(w, r)
+	return nil
+}
diff --git a/api/http/handler/registries/registry_access_test.go b/api/http/handler/registries/registry_access_test.go
new file mode 100644
index 0000000..4ccf714
--- /dev/null
+++ b/api/http/handler/registries/registry_access_test.go
@@ -0,0 +1,86 @@
+package registries
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+
+	"github.com/gorilla/mux"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_RegistryAccess_RequiresAuthentication(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+	registry := &portainer.Registry{
+		ID:   1,
+		Name: "test-registry",
+		URL:  "https://registry.test.com",
+	}
+
+	err := store.Registry().Create(registry)
+	require.NoError(t, err)
+
+	handler := &Handler{DataStore: store}
+	req := httptest.NewRequest(http.MethodGet, "/registries/1", nil)
+	req = mux.SetURLVars(req, map[string]string{"id": "1"})
+	rr := httptest.NewRecorder()
+	testHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {})
+	bouncer := handler.RegistryAccess(testHandler)
+	bouncer.ServeHTTP(rr, req)
+	assert.Equal(t, http.StatusUnauthorized, rr.Code)
+}
+
+func Test_RegistryAccess_InvalidRegistryID(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+	user := &portainer.User{ID: 1, Username: "test", Role: portainer.StandardUserRole}
+	err := store.User().Create(user)
+	require.NoError(t, err)
+
+	handler := &Handler{DataStore: store}
+	req := httptest.NewRequest(http.MethodGet, "/registries/invalid", nil)
+	req = mux.SetURLVars(req, map[string]string{"id": "invalid"})
+	tokenData := &portainer.TokenData{ID: 1, Role: portainer.StandardUserRole}
+	req = req.WithContext(security.StoreTokenData(req, tokenData))
+	rr := httptest.NewRecorder()
+
+	testHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {})
+
+	bouncer := handler.RegistryAccess(testHandler)
+	bouncer.ServeHTTP(rr, req)
+	assert.Equal(t, http.StatusBadRequest, rr.Code)
+}
+
+func Test_RegistryAccess_RegistryNotFound(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	user := &portainer.User{ID: 1, Username: "test", Role: portainer.StandardUserRole}
+	err := store.User().Create(user)
+	require.NoError(t, err)
+
+	handler := &Handler{
+		DataStore:      store,
+		requestBouncer: testhelpers.NewTestRequestBouncer(),
+	}
+
+	req := httptest.NewRequest(http.MethodGet, "/registries/999", nil)
+	req = mux.SetURLVars(req, map[string]string{"id": "999"})
+	tokenData := &portainer.TokenData{ID: 1, Role: portainer.StandardUserRole}
+	req = req.WithContext(security.StoreTokenData(req, tokenData))
+
+	rr := httptest.NewRecorder()
+
+	testHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {})
+
+	bouncer := handler.RegistryAccess(testHandler)
+	bouncer.ServeHTTP(rr, req)
+	assert.Equal(t, http.StatusNotFound, rr.Code)
+}
diff --git a/api/http/handler/registries/registry_configure.go b/api/http/handler/registries/registry_configure.go
new file mode 100644
index 0000000..15e4792
--- /dev/null
+++ b/api/http/handler/registries/registry_configure.go
@@ -0,0 +1,186 @@
+package registries
+
+import (
+	"errors"
+	"net/http"
+	"strconv"
+
+	portainer "github.com/portainer/portainer/api"
+	httperrors "github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type registryConfigurePayload struct {
+	// Is authentication against this registry enabled
+	Authentication bool `example:"false" validate:"required"`
+	// Username used to authenticate against this registry. Required when Authentication is true
+	Username string `example:"registry_user"`
+	// Password used to authenticate against this registry. required when Authentication is true
+	Password string `example:"registry_password"`
+	// ECR region
+	Region string
+	// Use TLS
+	TLS bool `example:"true"`
+	// Skip the verification of the server TLS certificate
+	TLSSkipVerify bool `example:"false"`
+	// The TLS CA certificate file
+	TLSCACertFile []byte
+	// The TLS client certificate file
+	TLSCertFile []byte
+	// The TLS client key file
+	TLSKeyFile []byte
+}
+
+func (payload *registryConfigurePayload) Validate(r *http.Request) error {
+	useAuthentication, _ := request.RetrieveBooleanMultiPartFormValue(r, "Authentication", true)
+	payload.Authentication = useAuthentication
+
+	if useAuthentication {
+		username, err := request.RetrieveMultiPartFormValue(r, "Username", false)
+		if err != nil {
+			return errors.New("invalid username")
+		}
+		payload.Username = username
+
+		password, _ := request.RetrieveMultiPartFormValue(r, "Password", true)
+		payload.Password = password
+
+		region, _ := request.RetrieveMultiPartFormValue(r, "Region", true)
+		payload.Region = region
+	}
+
+	useTLS, _ := request.RetrieveBooleanMultiPartFormValue(r, "TLS", true)
+	payload.TLS = useTLS
+
+	skipTLSVerify, _ := request.RetrieveBooleanMultiPartFormValue(r, "TLSSkipVerify", true)
+	payload.TLSSkipVerify = skipTLSVerify
+
+	if useTLS && !skipTLSVerify {
+		numCertsProvided := 0
+		cert, _, err := request.RetrieveMultiPartFormFile(r, "TLSCertFile")
+		if err == nil {
+			payload.TLSCertFile = cert
+			numCertsProvided++
+		}
+
+		key, _, err := request.RetrieveMultiPartFormFile(r, "TLSKeyFile")
+		if err == nil {
+			payload.TLSKeyFile = key
+			numCertsProvided++
+		}
+
+		ca, _, err := request.RetrieveMultiPartFormFile(r, "TLSCACertFile")
+		if err == nil {
+			payload.TLSCACertFile = ca
+			numCertsProvided++
+		}
+
+		if numCertsProvided != 0 && numCertsProvided != 3 {
+			return errors.New("invalid TLS configuration: provide TLS certificate, key, and CA together, or none")
+		}
+	}
+
+	return nil
+}
+
+// @id RegistryConfigure
+// @summary Configures a registry
+// @description Configures a registry.
+// @description **Access policy**: restricted
+// @tags registries
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @produce json
+// @param id path int true "Registry identifier"
+// @param body body registryConfigurePayload true "Registry configuration"
+// @success 204 "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied"
+// @failure 404 "Registry not found"
+// @failure 500 "Server error"
+// @router /registries/{id}/configure [post]
+func (handler *Handler) registryConfigure(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+	if !securityContext.IsAdmin {
+		return httperror.Forbidden("Permission denied to configure registry", httperrors.ErrResourceAccessDenied)
+	}
+
+	payload := &registryConfigurePayload{}
+	err = payload.Validate(r)
+	if err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	registryID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid registry identifier route variable", err)
+	}
+
+	registry, err := handler.DataStore.Registry().Read(portainer.RegistryID(registryID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find a registry with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find a registry with the specified identifier inside the database", err)
+	}
+
+	if payload.Authentication {
+		registry.Authentication = true
+
+		registry.Username = payload.Username
+
+		if payload.Password != "" {
+			registry.Password = payload.Password
+		}
+
+		if payload.Region != "" {
+			registry.Ecr.Region = payload.Region
+		}
+	}
+
+	var tlsConfig portainer.TLSConfiguration
+	if payload.TLS {
+		tlsConfig = portainer.TLSConfiguration{
+			TLS:           true,
+			TLSSkipVerify: payload.TLSSkipVerify,
+		}
+
+		if !payload.TLSSkipVerify {
+			folder := strconv.Itoa(int(registry.ID))
+
+			certPath, err := handler.FileService.StoreRegistryManagementFileFromBytes(folder, "cert.pem", payload.TLSCertFile)
+			if err != nil {
+				return httperror.InternalServerError("Unable to persist TLS certificate file on disk", err)
+			}
+			tlsConfig.TLSCertPath = certPath
+
+			keyPath, err := handler.FileService.StoreRegistryManagementFileFromBytes(folder, "key.pem", payload.TLSKeyFile)
+			if err != nil {
+				return httperror.InternalServerError("Unable to persist TLS key file on disk", err)
+			}
+			tlsConfig.TLSKeyPath = keyPath
+
+			cacertPath, err := handler.FileService.StoreRegistryManagementFileFromBytes(folder, "ca.pem", payload.TLSCACertFile)
+			if err != nil {
+				return httperror.InternalServerError("Unable to persist TLS CA certificate file on disk", err)
+			}
+			tlsConfig.TLSCACertPath = cacertPath
+		}
+	}
+
+	registry.ManagementConfiguration = syncConfig(registry)
+	registry.ManagementConfiguration.TLSConfig = tlsConfig
+
+	err = handler.DataStore.Registry().Update(registry.ID, registry)
+	if err != nil {
+		return httperror.InternalServerError("Unable to persist registry changes inside the database", err)
+	}
+
+	return response.Empty(w)
+}
diff --git a/api/http/handler/registries/registry_configure_test.go b/api/http/handler/registries/registry_configure_test.go
new file mode 100644
index 0000000..3b91604
--- /dev/null
+++ b/api/http/handler/registries/registry_configure_test.go
@@ -0,0 +1,102 @@
+package registries
+
+import (
+	"bytes"
+	"mime/multipart"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+// helper to build a multipart request for registry configure validation
+func newConfigureRequest(t *testing.T, tls bool, skipVerify bool, includeCert bool, includeKey bool, includeCA bool) *http.Request {
+	t.Helper()
+
+	body := &bytes.Buffer{}
+	writer := multipart.NewWriter(body)
+
+	// flags
+	_ = writer.WriteField("TLS", map[bool]string{true: "true", false: "false"}[tls])
+	_ = writer.WriteField("TLSSkipVerify", map[bool]string{true: "true", false: "false"}[skipVerify])
+
+	// files
+	if includeCert {
+		fw, err := writer.CreateFormFile("TLSCertFile", "cert.pem")
+		if err != nil {
+			t.Fatalf("failed to create cert file: %v", err)
+		}
+		_, _ = fw.Write([]byte("CERTDATA"))
+	}
+	if includeKey {
+		fw, err := writer.CreateFormFile("TLSKeyFile", "key.pem")
+		if err != nil {
+			t.Fatalf("failed to create key file: %v", err)
+		}
+		_, _ = fw.Write([]byte("KEYDATA"))
+	}
+	if includeCA {
+		fw, err := writer.CreateFormFile("TLSCACertFile", "ca.pem")
+		if err != nil {
+			t.Fatalf("failed to create ca file: %v", err)
+		}
+		_, _ = fw.Write([]byte("CADATA"))
+	}
+
+	_ = writer.Close()
+
+	req := httptest.NewRequest(http.MethodPost, "/registries/1/configure", body)
+	req.Header.Set("Content-Type", writer.FormDataContentType())
+	return req
+}
+
+func Test_registryConfigurePayload_Validate_TLSBundleRules(t *testing.T) {
+	t.Parallel()
+	// passes when all three are uploaded
+	{
+		req := newConfigureRequest(t, true, false, true, true, true)
+		p := &registryConfigurePayload{}
+		if err := p.Validate(req); err != nil {
+			t.Fatalf("expected validation to pass when all certs provided, got error: %v", err)
+		}
+		if len(p.TLSCertFile) == 0 || len(p.TLSKeyFile) == 0 || len(p.TLSCACertFile) == 0 {
+			t.Fatalf("expected payload to contain all cert bytes")
+		}
+	}
+
+	// passes when none are uploaded
+	{
+		req := newConfigureRequest(t, true, false, false, false, false)
+		p := &registryConfigurePayload{}
+		if err := p.Validate(req); err != nil {
+			t.Fatalf("expected validation to pass when no certs provided, got error: %v", err)
+		}
+		if len(p.TLSCertFile) != 0 || len(p.TLSKeyFile) != 0 || len(p.TLSCACertFile) != 0 {
+			t.Fatalf("expected payload to have no cert bytes when none provided")
+		}
+	}
+
+	// fails on partial uploads (1 or 2 of the files)
+	partialCases := []struct {
+		name string
+		cert bool
+		key  bool
+		ca   bool
+	}{
+		{"only-cert", true, false, false},
+		{"only-key", false, true, false},
+		{"only-ca", false, false, true},
+		{"cert-and-key", true, true, false},
+		{"cert-and-ca", true, false, true},
+		{"key-and-ca", false, true, true},
+	}
+
+	for _, tc := range partialCases {
+		t.Run(tc.name, func(t *testing.T) {
+			req := newConfigureRequest(t, true, false, tc.cert, tc.key, tc.ca)
+			p := &registryConfigurePayload{}
+			if err := p.Validate(req); err == nil {
+				t.Fatalf("expected validation to fail on partial cert upload")
+			}
+		})
+	}
+}
diff --git a/api/http/handler/registries/registry_create.go b/api/http/handler/registries/registry_create.go
new file mode 100644
index 0000000..1f4bd63
--- /dev/null
+++ b/api/http/handler/registries/registry_create.go
@@ -0,0 +1,147 @@
+package registries
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	httperrors "github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type registryCreatePayload struct {
+	// Name that will be used to identify this registry
+	Name string `example:"my-registry" validate:"required"`
+	// Registry Type. Valid values are:
+	//	1 (Quay.io),
+	//	2 (Azure container registry),
+	//	3 (custom registry),
+	//	4 (Gitlab registry),
+	//	5 (ProGet registry),
+	//	6 (DockerHub)
+	//	7 (ECR)
+	Type portainer.RegistryType `example:"1" validate:"required" enums:"1,2,3,4,5,6,7"`
+	// URL or IP address of the Docker registry
+	URL string `example:"registry.mydomain.tld:2375/feed" validate:"required"`
+	// BaseURL required for ProGet registry
+	BaseURL string `example:"registry.mydomain.tld:2375"`
+	// Is authentication against this registry enabled
+	Authentication bool `example:"false" validate:"required"`
+	// Username used to authenticate against this registry. Required when Authentication is true
+	Username string `example:"registry_user"`
+	// Password used to authenticate against this registry. required when Authentication is true
+	Password string `example:"registry_password"`
+	// Gitlab specific details, required when type = 4
+	Gitlab portainer.GitlabRegistryData
+	// Quay specific details, required when type = 1
+	Quay portainer.QuayRegistryData
+	// ECR specific details, required when type = 7
+	Ecr portainer.EcrData
+	// Use TLS
+	TLS bool `example:"true"`
+}
+
+func (payload *registryCreatePayload) Validate(_ *http.Request) error {
+	if len(payload.Name) == 0 {
+		return errors.New("invalid registry name")
+	}
+	if len(payload.URL) == 0 {
+		return errors.New("invalid registry URL")
+	}
+
+	if payload.Authentication {
+		if len(payload.Username) == 0 || len(payload.Password) == 0 {
+			return errors.New("invalid credentials. Username and password must be specified when authentication is enabled")
+		}
+		if payload.Type == portainer.EcrRegistry {
+			if len(payload.Ecr.Region) == 0 {
+				return errors.New("invalid credentials: access key ID, secret access key and region must be specified when authentication is enabled")
+			}
+		}
+	}
+
+	switch payload.Type {
+	case portainer.QuayRegistry, portainer.AzureRegistry, portainer.CustomRegistry, portainer.GitlabRegistry, portainer.ProGetRegistry, portainer.DockerHubRegistry, portainer.EcrRegistry:
+	default:
+		return errors.New("invalid registry type. Valid values are: 1 (Quay.io), 2 (Azure container registry), 3 (custom registry), 4 (Gitlab registry), 5 (ProGet registry), 6 (DockerHub), 7 (ECR)")
+	}
+
+	if payload.Type == portainer.ProGetRegistry && payload.BaseURL == "" {
+		return fmt.Errorf("BaseURL is required for registry type %d (ProGet)", portainer.ProGetRegistry)
+	}
+
+	return nil
+}
+
+// @id RegistryCreate
+// @summary Create a new registry
+// @description Create a new registry.
+// @description **Access policy**: restricted
+// @tags registries
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @produce json
+// @param body body registryCreatePayload true "Registry details"
+// @success 200 {object} portainer.Registry "Success"
+// @failure 400 "Invalid request"
+// @failure 409 "Another registry with the same name or same URL & credentials already exists"
+// @failure 500 "Server error"
+// @router /registries [post]
+func (handler *Handler) registryCreate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+	if !securityContext.IsAdmin {
+		return httperror.Forbidden("Permission denied to create registry", httperrors.ErrResourceAccessDenied)
+	}
+
+	var payload registryCreatePayload
+	err = request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	registry := &portainer.Registry{
+		Type:             payload.Type,
+		Name:             payload.Name,
+		URL:              payload.URL,
+		BaseURL:          payload.BaseURL,
+		Authentication:   payload.Authentication,
+		Username:         payload.Username,
+		Password:         payload.Password,
+		Gitlab:           payload.Gitlab,
+		Quay:             payload.Quay,
+		RegistryAccesses: portainer.RegistryAccesses{},
+		Ecr:              payload.Ecr,
+	}
+
+	registry.ManagementConfiguration = syncConfig(registry)
+	registry.ManagementConfiguration.TLSConfig.TLS = payload.TLS
+
+	registries, err := handler.DataStore.Registry().ReadAll()
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve registries from the database", err)
+	}
+	for _, r := range registries {
+		if r.Name == registry.Name {
+			return httperror.Conflict("Another registry with the same name already exists", errors.New("a registry is already defined with this name"))
+		}
+		if handler.registriesHaveSameURLAndCredentials(&r, registry) {
+			return httperror.Conflict("Another registry with the same URL and credentials already exists", errors.New("a registry is already defined for this URL and credentials"))
+		}
+	}
+
+	err = handler.DataStore.Registry().Create(registry)
+	if err != nil {
+		return httperror.InternalServerError("Unable to persist the registry inside the database", err)
+	}
+
+	hideFields(registry, true)
+	return response.JSON(w, registry)
+}
diff --git a/api/http/handler/registries/registry_create_test.go b/api/http/handler/registries/registry_create_test.go
new file mode 100644
index 0000000..c96c812
--- /dev/null
+++ b/api/http/handler/registries/registry_create_test.go
@@ -0,0 +1,95 @@
+package registries
+
+import (
+	"bytes"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/security"
+
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_registryCreatePayload_Validate(t *testing.T) {
+	t.Parallel()
+	basePayload := registryCreatePayload{Name: "Test registry", URL: "http://example.com"}
+	t.Run("Can't create a ProGet registry if BaseURL is empty", func(t *testing.T) {
+		payload := basePayload
+		payload.Type = portainer.ProGetRegistry
+		err := payload.Validate(nil)
+		require.Error(t, err)
+	})
+	t.Run("Can create a GitLab registry if BaseURL is empty", func(t *testing.T) {
+		payload := basePayload
+		payload.Type = portainer.GitlabRegistry
+		err := payload.Validate(nil)
+		require.NoError(t, err)
+	})
+	t.Run("Can create a ProGet registry if BaseURL is not empty", func(t *testing.T) {
+		payload := basePayload
+		payload.Type = portainer.ProGetRegistry
+		payload.BaseURL = "http://example.com"
+		err := payload.Validate(nil)
+		require.NoError(t, err)
+	})
+	t.Run("Can't create a AWS ECR registry if authentication required, but access key ID, secret access key or region is empty", func(t *testing.T) {
+		payload := basePayload
+		payload.Type = portainer.EcrRegistry
+		payload.Authentication = true
+		err := payload.Validate(nil)
+		require.Error(t, err)
+	})
+	t.Run("Do not require access key ID, secret access key, region for public AWS ECR registry", func(t *testing.T) {
+		payload := basePayload
+		payload.Type = portainer.EcrRegistry
+		payload.Authentication = false
+		err := payload.Validate(nil)
+		require.NoError(t, err)
+	})
+}
+
+func TestHandler_registryCreate(t *testing.T) {
+	t.Parallel()
+
+	handler, _ := newTestHandler(t)
+
+	payload := registryCreatePayload{
+		Name:           "Test registry",
+		Type:           portainer.ProGetRegistry,
+		URL:            "http://example.com",
+		BaseURL:        "http://example.com",
+		Authentication: false,
+		Username:       "username",
+		Password:       "password",
+		Gitlab:         portainer.GitlabRegistryData{},
+	}
+	payloadBytes, err := json.Marshal(payload)
+	require.NoError(t, err)
+
+	r := httptest.NewRequest(http.MethodPost, "/", bytes.NewReader(payloadBytes))
+	w := httptest.NewRecorder()
+
+	restrictedContext := &security.RestrictedRequestContext{IsAdmin: true, UserID: 1}
+
+	ctx := security.StoreRestrictedRequestContext(r, restrictedContext)
+	r = r.WithContext(ctx)
+
+	handlerError := handler.registryCreate(w, r)
+	require.Nil(t, handlerError)
+
+	registry := portainer.Registry{}
+	err = json.NewDecoder(w.Body).Decode(&registry)
+	require.NoError(t, err)
+
+	assert.Equal(t, payload.Name, registry.Name)
+	assert.Equal(t, payload.Type, registry.Type)
+	assert.Equal(t, payload.URL, registry.URL)
+	assert.Equal(t, payload.BaseURL, registry.BaseURL)
+	assert.Equal(t, payload.Authentication, registry.Authentication)
+	assert.Equal(t, payload.Username, registry.Username)
+	assert.Empty(t, registry.Password)
+}
diff --git a/api/http/handler/registries/registry_delete.go b/api/http/handler/registries/registry_delete.go
new file mode 100644
index 0000000..a6bf967
--- /dev/null
+++ b/api/http/handler/registries/registry_delete.go
@@ -0,0 +1,120 @@
+package registries
+
+import (
+	"fmt"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	httperrors "github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/registryutils"
+	"github.com/portainer/portainer/api/pendingactions/handlers"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+
+	"github.com/rs/zerolog/log"
+)
+
+// cleanupRegistryFromNamespaces removes the registry imagePullSecret from the
+// default service account and deletes the registry secret in each namespace.
+// It returns the list of namespaces that failed either operation so the caller
+// can schedule a pending action for retry.
+func cleanupRegistryFromNamespaces(cli portainer.KubeClient, registryID portainer.RegistryID, namespaces []string, endpointID portainer.EndpointID) []string {
+	secretName := registryutils.RegistrySecretName(registryID)
+	failed := make([]string, 0)
+
+	for _, ns := range namespaces {
+		if err := cli.RemoveImagePullSecretFromServiceAccount(ns, "default", secretName); err != nil {
+			failed = append(failed, ns)
+			log.Warn().Err(err).Msgf("Unable to remove registry secret from default service account in namespace %q for environment %d. Retrying offline", ns, endpointID)
+			continue
+		}
+
+		if err := cli.DeleteRegistrySecret(registryID, ns); err != nil {
+			failed = append(failed, ns)
+			log.Warn().Err(err).Msgf("Unable to delete registry secret %q from namespace %q for environment %d. Retrying offline", secretName, ns, endpointID)
+		}
+	}
+
+	return failed
+}
+
+// @id RegistryDelete
+// @summary Remove a registry
+// @description Remove a registry
+// @description **Access policy**: restricted
+// @tags registries
+// @security ApiKeyAuth
+// @security jwt
+// @param id path int true "Registry identifier"
+// @success 204 "Success"
+// @failure 400 "Invalid request"
+// @failure 404 "Registry not found"
+// @failure 500 "Server error"
+// @router /registries/{id} [delete]
+func (handler *Handler) registryDelete(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	} else if !securityContext.IsAdmin {
+		return httperror.Forbidden("Permission denied to delete registry", httperrors.ErrResourceAccessDenied)
+	}
+
+	registryID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid registry identifier route variable", err)
+	}
+
+	registry, err := handler.DataStore.Registry().Read(portainer.RegistryID(registryID))
+	if err != nil {
+		return httperror.InternalServerError(fmt.Sprintf("Unable to load registry %q from the database", registry.Name), err)
+	}
+
+	if err := handler.DataStore.Registry().Delete(portainer.RegistryID(registryID)); err != nil {
+		return httperror.InternalServerError("Unable to remove the registry from the database", err)
+	}
+
+	handler.deleteKubernetesSecrets(handler.DataStore, registry)
+
+	return response.Empty(w)
+}
+
+func (handler *Handler) deleteKubernetesSecrets(tx dataservices.DataStoreTx, registry *portainer.Registry) {
+	for endpointId, access := range registry.RegistryAccesses {
+		if access.Namespaces == nil {
+			continue
+		}
+
+		// Obtain a kubeclient for the endpoint
+		endpoint, err := tx.Endpoint().Endpoint(endpointId)
+		if err != nil {
+			// Skip environments that can't be loaded from the DB
+			log.Warn().Err(err).Msgf("Unable to load the environment with id %d from the database", endpointId)
+
+			continue
+		}
+
+		cli, err := handler.K8sClientFactory.GetPrivilegedKubeClient(endpoint)
+		if err != nil {
+			// Skip environments that can't get a kubeclient from
+			log.Warn().Err(err).Msgf("Unable to get kubernetes client for environment %d", endpointId)
+
+			continue
+		}
+
+		failedNamespaces := cleanupRegistryFromNamespaces(cli, registry.ID, access.Namespaces, endpointId)
+
+		if len(failedNamespaces) == 0 {
+			continue
+		}
+
+		if err := handler.PendingActionsService.Create(
+			tx,
+			handlers.NewDeleteK8sRegistrySecrets(endpointId, registry.ID, failedNamespaces),
+		); err != nil {
+			log.Warn().Err(err).Msg("unable to schedule pending action to delete kubernetes registry secrets")
+		}
+	}
+}
diff --git a/api/http/handler/registries/registry_delete_test.go b/api/http/handler/registries/registry_delete_test.go
new file mode 100644
index 0000000..86aa306
--- /dev/null
+++ b/api/http/handler/registries/registry_delete_test.go
@@ -0,0 +1,235 @@
+package registries
+
+import (
+	"errors"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+	kubecli "github.com/portainer/portainer/api/kubernetes/cli"
+	"github.com/portainer/portainer/api/pendingactions"
+	v1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	kfake "k8s.io/client-go/kubernetes/fake"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// spyKubeClient for registry delete tests - same pattern as endpoint_registry_access_test.go
+type deleteSpyKubeClient struct {
+	portainer.KubeClient
+
+	deleteSecretErrors     map[string]error
+	removePullSecretErrors map[string]error
+
+	deletedSecrets     []string
+	removedPullSecrets []string
+}
+
+func newDeleteSpy() *deleteSpyKubeClient {
+	return &deleteSpyKubeClient{
+		deleteSecretErrors:     make(map[string]error),
+		removePullSecretErrors: make(map[string]error),
+	}
+}
+
+func (s *deleteSpyKubeClient) DeleteRegistrySecret(_ portainer.RegistryID, namespace string) error {
+	s.deletedSecrets = append(s.deletedSecrets, namespace)
+	return s.deleteSecretErrors[namespace]
+}
+
+func (s *deleteSpyKubeClient) RemoveImagePullSecretFromServiceAccount(namespace, _, _ string) error {
+	s.removedPullSecrets = append(s.removedPullSecrets, namespace)
+	return s.removePullSecretErrors[namespace]
+}
+
+func newTestHandler(t *testing.T) (*Handler, dataservices.DataStore) {
+	t.Helper()
+
+	_, store := datastore.MustNewTestStore(t, false, false)
+	require.NotNil(t, store)
+
+	handler := NewHandler(testhelpers.NewTestRequestBouncer())
+	handler.DataStore = store
+
+	return handler, store
+}
+
+// --- cleanupRegistryFromNamespaces unit tests ---
+
+func TestCleanupRegistryFromNamespaces(t *testing.T) {
+	t.Parallel()
+	const registryID portainer.RegistryID = 3
+	const endpointID portainer.EndpointID = 1
+
+	t.Run("all namespaces succeed - returns empty failed list", func(t *testing.T) {
+		spy := newDeleteSpy()
+		failed := cleanupRegistryFromNamespaces(spy, registryID, []string{"ns-a", "ns-b"}, endpointID)
+		assert.Empty(t, failed)
+		assert.ElementsMatch(t, []string{"ns-a", "ns-b"}, spy.removedPullSecrets)
+		assert.ElementsMatch(t, []string{"ns-a", "ns-b"}, spy.deletedSecrets)
+	})
+
+	t.Run("SA removal fails - namespace in failed list and secret not deleted", func(t *testing.T) {
+		spy := newDeleteSpy()
+		spy.removePullSecretErrors["ns-a"] = errors.New("sa error")
+		failed := cleanupRegistryFromNamespaces(spy, registryID, []string{"ns-a", "ns-b"}, endpointID)
+		assert.Equal(t, []string{"ns-a"}, failed)
+		assert.ElementsMatch(t, []string{"ns-a", "ns-b"}, spy.removedPullSecrets)
+		assert.Equal(t, []string{"ns-b"}, spy.deletedSecrets, "ns-a secret must not be deleted when SA removal fails")
+	})
+
+	t.Run("secret deletion fails - namespace in failed list", func(t *testing.T) {
+		spy := newDeleteSpy()
+		spy.deleteSecretErrors["ns-a"] = errors.New("delete error")
+		failed := cleanupRegistryFromNamespaces(spy, registryID, []string{"ns-a", "ns-b"}, endpointID)
+		assert.Equal(t, []string{"ns-a"}, failed)
+		assert.ElementsMatch(t, []string{"ns-a", "ns-b"}, spy.removedPullSecrets)
+		assert.ElementsMatch(t, []string{"ns-a", "ns-b"}, spy.deletedSecrets)
+	})
+
+	t.Run("both operations fail for all namespaces - all in failed list", func(t *testing.T) {
+		spy := newDeleteSpy()
+		spy.removePullSecretErrors["ns-a"] = errors.New("err")
+		spy.removePullSecretErrors["ns-b"] = errors.New("err")
+		failed := cleanupRegistryFromNamespaces(spy, registryID, []string{"ns-a", "ns-b"}, endpointID)
+		assert.ElementsMatch(t, []string{"ns-a", "ns-b"}, failed)
+		assert.Empty(t, spy.deletedSecrets)
+	})
+
+	t.Run("empty namespace list - returns empty failed list", func(t *testing.T) {
+		spy := newDeleteSpy()
+		failed := cleanupRegistryFromNamespaces(spy, registryID, []string{}, endpointID)
+		assert.Empty(t, failed)
+		assert.Empty(t, spy.removedPullSecrets)
+		assert.Empty(t, spy.deletedSecrets)
+	})
+}
+
+// --- deleteKubernetesSecrets integration tests ---
+
+func TestDeleteKubernetesSecrets(t *testing.T) {
+	t.Parallel()
+	const registryID portainer.RegistryID = 3
+	const endpointID portainer.EndpointID = 1
+
+	newHandlerWithFakeK8s := func(t *testing.T, endpoint *portainer.Endpoint, registry *portainer.Registry) (*Handler, *datastore.Store) {
+		t.Helper()
+		_, store := datastore.MustNewTestStore(t, true, false)
+
+		require.NoError(t, store.Endpoint().Create(endpoint))
+		require.NoError(t, store.Registry().Create(registry))
+
+		defaultSA := &v1.ServiceAccount{
+			ObjectMeta: metav1.ObjectMeta{Name: "default", Namespace: "ns-a"},
+		}
+		fakeK8s := kfake.NewSimpleClientset(defaultSA)
+		factory := kubecli.NewTestClientFactory(endpointID, kubecli.NewTestKubeClient(fakeK8s))
+		pas := pendingactions.NewService(store, nil)
+
+		h := &Handler{
+			DataStore:             store,
+			K8sClientFactory:      factory,
+			PendingActionsService: pas,
+			requestBouncer:        testhelpers.NewTestRequestBouncer(),
+		}
+		return h, store
+	}
+
+	t.Run("GetPrivilegedKubeClient fails - no pending action created", func(t *testing.T) {
+		// KubernetesLocalEnvironment calls rest.InClusterConfig() which fails outside
+		// a real cluster, causing GetPrivilegedKubeClient to return an error gracefully.
+		endpoint := &portainer.Endpoint{
+			ID:   endpointID,
+			Name: "test-env",
+			Type: portainer.KubernetesLocalEnvironment,
+		}
+		registry := &portainer.Registry{
+			ID: registryID,
+			RegistryAccesses: portainer.RegistryAccesses{
+				endpointID: portainer.RegistryAccessPolicies{Namespaces: []string{"ns-a"}},
+			},
+		}
+		_, store := datastore.MustNewTestStore(t, true, false)
+		require.NoError(t, store.Endpoint().Create(endpoint))
+		require.NoError(t, store.Registry().Create(registry))
+
+		// Empty factory: endpoint not in cache, CreateConfig will fail → returns error, not panic
+		emptyFactory, err := kubecli.NewClientFactory(nil, nil, nil, "test", "", "")
+		require.NoError(t, err)
+
+		pas := pendingactions.NewService(store, nil)
+		h := &Handler{
+			DataStore:             store,
+			K8sClientFactory:      emptyFactory,
+			PendingActionsService: pas,
+			requestBouncer:        testhelpers.NewTestRequestBouncer(),
+		}
+
+		h.deleteKubernetesSecrets(store, registry)
+
+		actions, err := store.PendingActions().ReadAll(func(portainer.PendingAction) bool { return true })
+		require.NoError(t, err)
+		assert.Empty(t, actions, "no pending action should be created when kube client cannot be obtained")
+	})
+
+	t.Run("all namespaces succeed - no pending action created", func(t *testing.T) {
+		endpoint := &portainer.Endpoint{
+			ID:   endpointID,
+			Name: "test-env",
+			Type: portainer.AgentOnKubernetesEnvironment,
+		}
+		registry := &portainer.Registry{
+			ID: registryID,
+			RegistryAccesses: portainer.RegistryAccesses{
+				endpointID: portainer.RegistryAccessPolicies{Namespaces: []string{"ns-a"}},
+			},
+		}
+		_, store := datastore.MustNewTestStore(t, true, false)
+		require.NoError(t, store.Endpoint().Create(endpoint))
+		require.NoError(t, store.Registry().Create(registry))
+
+		defaultSA := &v1.ServiceAccount{
+			ObjectMeta: metav1.ObjectMeta{Name: "default", Namespace: "ns-a"},
+		}
+		fakeK8s := kfake.NewSimpleClientset(defaultSA)
+		factory := kubecli.NewTestClientFactory(endpointID, kubecli.NewTestKubeClient(fakeK8s))
+		pas := pendingactions.NewService(store, nil)
+		h := &Handler{
+			DataStore:             store,
+			K8sClientFactory:      factory,
+			PendingActionsService: pas,
+			requestBouncer:        testhelpers.NewTestRequestBouncer(),
+		}
+
+		h.deleteKubernetesSecrets(store, registry)
+
+		actions, err := store.PendingActions().ReadAll(func(portainer.PendingAction) bool { return true })
+		require.NoError(t, err)
+		assert.Empty(t, actions)
+	})
+
+	t.Run("registry with no Kubernetes namespaces - no operations attempted", func(t *testing.T) {
+		endpoint := &portainer.Endpoint{
+			ID:   endpointID,
+			Name: "test-env",
+			Type: portainer.AgentOnKubernetesEnvironment,
+		}
+		registry := &portainer.Registry{
+			ID: registryID,
+			RegistryAccesses: portainer.RegistryAccesses{
+				endpointID: portainer.RegistryAccessPolicies{Namespaces: nil},
+			},
+		}
+		h, store := newHandlerWithFakeK8s(t, endpoint, registry)
+
+		h.deleteKubernetesSecrets(store, registry)
+
+		actions, err := store.PendingActions().ReadAll(func(portainer.PendingAction) bool { return true })
+		require.NoError(t, err)
+		assert.Empty(t, actions)
+	})
+}
diff --git a/api/http/handler/registries/registry_inspect.go b/api/http/handler/registries/registry_inspect.go
new file mode 100644
index 0000000..f606a95
--- /dev/null
+++ b/api/http/handler/registries/registry_inspect.go
@@ -0,0 +1,56 @@
+package registries
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+
+	"github.com/rs/zerolog/log"
+)
+
+// @id RegistryInspect
+// @summary Inspect a registry
+// @description Retrieve details about a registry.
+// @description **Access policy**: restricted
+// @tags registries
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param id path int true "Registry identifier"
+// @success 200 {object} portainer.Registry "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied to access registry"
+// @failure 404 "Registry not found"
+// @failure 500 "Server error"
+// @router /registries/{id} [get]
+func (handler *Handler) registryInspect(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	registryID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid registry identifier route variable", err)
+	}
+
+	log.Debug().
+		Int("registry_id", registryID).
+		Str("context", "RegistryInspectHandler").
+		Msg("Starting registry inspection")
+
+	registry, err := handler.DataStore.Registry().Read(portainer.RegistryID(registryID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find a registry with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find a registry with the specified identifier inside the database", err)
+	}
+
+	// Check if user is admin to determine if we should hide sensitive fields
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	hideFields(registry, !securityContext.IsAdmin)
+	return response.JSON(w, registry)
+}
diff --git a/api/http/handler/registries/registry_list.go b/api/http/handler/registries/registry_list.go
new file mode 100644
index 0000000..eecb751
--- /dev/null
+++ b/api/http/handler/registries/registry_list.go
@@ -0,0 +1,44 @@
+package registries
+
+import (
+	"net/http"
+
+	httperrors "github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id RegistryList
+// @summary List Registries
+// @description List all registries based on the current user authorizations.
+// @description Will return all registries if using an administrator account otherwise it
+// @description will only return authorized registries.
+// @description **Access policy**: restricted
+// @tags registries
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @success 200 {array} portainer.Registry "Success"
+// @failure 500 "Server error"
+// @router /registries [get]
+func (handler *Handler) registryList(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+	if !securityContext.IsAdmin {
+		return httperror.Forbidden("Permission denied to list registries, use /endpoints/:endpointId/registries route instead", httperrors.ErrResourceAccessDenied)
+	}
+
+	registries, err := handler.DataStore.Registry().ReadAll()
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve registries from the database", err)
+	}
+
+	for idx := range registries {
+		hideFields(&registries[idx], false)
+	}
+
+	return response.JSON(w, registries)
+}
diff --git a/api/http/handler/registries/registry_ping.go b/api/http/handler/registries/registry_ping.go
new file mode 100644
index 0000000..d7b053e
--- /dev/null
+++ b/api/http/handler/registries/registry_ping.go
@@ -0,0 +1,180 @@
+package registries
+
+import (
+	"context"
+	"errors"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/pkg/fips"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/portainer/portainer/pkg/liboras"
+
+	"github.com/rs/zerolog/log"
+	"oras.land/oras-go/v2/registry/remote/errcode"
+)
+
+type registryPingPayload struct {
+	// Registry Type. Valid values are:
+	//	1 (Quay.io),
+	//	2 (Azure container registry),
+	//	3 (custom registry),
+	//	4 (Gitlab registry),
+	//	5 (ProGet registry),
+	//	6 (DockerHub)
+	//	7 (ECR)
+	//	8 (Github registry)
+	Type portainer.RegistryType `example:"6" validate:"required" enums:"1,2,3,4,5,6,7,8"`
+	// URL or IP address of the Docker registry
+	URL string `example:"registry-1.docker.io" validate:"required"`
+	// Username used to authenticate against this registry
+	Username string `example:"registry_user"`
+	// Password used to authenticate against this registry
+	Password string `example:"registry_password"`
+	// Use TLS
+	TLS bool `example:"true"`
+}
+
+type registryPingResponse struct {
+	// Success indicates if the registry connection was successful
+	Success bool `json:"success" example:"true"`
+	// Message provides details about the connection test result
+	Message string `json:"message" example:"Registry connection successful"`
+}
+
+func (payload *registryPingPayload) Validate(_ *http.Request) error {
+	if len(payload.Username) == 0 || len(payload.Password) == 0 {
+		return httperror.BadRequest("Username and password are required", nil)
+	}
+
+	switch payload.Type {
+	case portainer.QuayRegistry, portainer.AzureRegistry, portainer.CustomRegistry, portainer.GitlabRegistry, portainer.ProGetRegistry, portainer.DockerHubRegistry, portainer.EcrRegistry, portainer.GithubRegistry:
+	default:
+		return httperror.BadRequest("Invalid registry type. Valid values are: 1 (Quay.io), 2 (Azure container registry), 3 (custom registry), 4 (Gitlab registry), 5 (ProGet registry), 6 (DockerHub), 7 (ECR), 8 (Github registry)", nil)
+	}
+
+	return nil
+}
+
+// @id RegistryPing
+// @summary Test registry connection
+// @description Test connection to a registry with provided credentials
+// @description **Access policy**: authenticated
+// @tags registries
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @produce json
+// @param body body registryPingPayload true "Registry credentials to test"
+// @success 200 {object} registryPingResponse "Success"
+// @failure 400 "Invalid request"
+// @failure 500 "Server error"
+// @router /registries/ping [post]
+func (handler *Handler) pingRegistry(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	var payload registryPingPayload
+	err := request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	// Create a temporary registry configuration for testing
+	tempRegistry := &portainer.Registry{
+		Type:           payload.Type,
+		URL:            payload.URL,
+		Authentication: true,
+		Username:       payload.Username,
+		Password:       payload.Password,
+	}
+
+	// For DockerHub, ensure URL is set correctly
+	if payload.Type == portainer.DockerHubRegistry && payload.URL == "" {
+		tempRegistry.URL = "registry-1.docker.io"
+	}
+
+	// Set up TLS configuration
+	if payload.Type == portainer.CustomRegistry {
+		tempRegistry.ManagementConfiguration = &portainer.RegistryManagementConfiguration{
+			Type: payload.Type,
+			TLSConfig: portainer.TLSConfiguration{
+				TLS: payload.TLS || fips.FIPSMode(),
+			},
+		}
+	}
+
+	// Test the registry connection
+	success, message := handler.testRegistryConnection(tempRegistry)
+
+	responseData := registryPingResponse{
+		Success: success,
+		Message: message,
+	}
+
+	return response.JSON(w, responseData)
+}
+
+// testRegistryConnection tests if we can connect to the registry
+func (handler *Handler) testRegistryConnection(registry *portainer.Registry) (bool, string) {
+	registryClient, err := liboras.CreateClient(*registry)
+	if err != nil {
+		log.Error().Err(err).Str("registryURL", registry.URL).Msg("Failed to create registry client")
+		return false, "Connection error: Failed to create registry client - " + err.Error()
+	}
+
+	ctx := context.Background()
+	err = registryClient.Ping(ctx)
+	if err != nil {
+		errorMessage := categorizeRegistryError(err, registry.URL)
+		return false, errorMessage
+	}
+
+	log.Debug().Str("registryURL", registry.URL).Msg("Registry ping successful")
+	return true, "Registry connection successful"
+}
+
+// categorizeRegistryError analyzes the error and returns a user-friendly message
+// that distinguishes between connection errors and authentication errors
+func categorizeRegistryError(err error, registryURL string) string {
+	if err == nil {
+		return ""
+	}
+
+	var userMessage string
+
+	var errResp *errcode.ErrorResponse
+	if errors.As(err, &errResp) {
+
+		// 401 Unauthorized or 403 Forbidden = authentication/authorization issue
+		if errResp.StatusCode == http.StatusUnauthorized || errResp.StatusCode == http.StatusForbidden {
+			userMessage = "Access token invalid: Authentication failed - please verify your username and access token"
+		} else {
+			userMessage = "Connection error: " + err.Error()
+		}
+
+		logEvent := log.Error().
+			Err(err).
+			Str("registryURL", registryURL).
+			Int("statusCode", errResp.StatusCode).
+			Str("userMessage", userMessage)
+
+		if len(errResp.Errors) > 0 {
+			logEvent.Interface("errors", errResp.Errors)
+		}
+
+		logEvent.Msg("Registry ping failed")
+
+		return userMessage
+	}
+
+	// Default: treat everything else as connection error
+	userMessage = "Connection error: " + err.Error()
+
+	log.Error().
+		Err(err).
+		Str("registryURL", registryURL).
+		Str("userMessage", userMessage).
+		Msg("Registry ping failed")
+
+	return userMessage
+}
diff --git a/api/http/handler/registries/registry_ping_test.go b/api/http/handler/registries/registry_ping_test.go
new file mode 100644
index 0000000..6570804
--- /dev/null
+++ b/api/http/handler/registries/registry_ping_test.go
@@ -0,0 +1,332 @@
+package registries
+
+import (
+	"bytes"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/security"
+
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"oras.land/oras-go/v2/registry/remote/errcode"
+)
+
+func Test_categorizeRegistryError(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name        string
+		err         error
+		registryURL string
+		want        string
+	}{
+		{
+			name:        "nil error returns empty string",
+			err:         nil,
+			registryURL: "registry.example.com",
+			want:        "",
+		},
+		{
+			name: "401 Unauthorized returns access token invalid message",
+			err: &errcode.ErrorResponse{
+				StatusCode: http.StatusUnauthorized,
+			},
+			registryURL: "registry-1.docker.io",
+			want:        "Access token invalid: Authentication failed - please verify your username and access token",
+		},
+		{
+			name: "403 Forbidden returns access token invalid message",
+			err: &errcode.ErrorResponse{
+				StatusCode: http.StatusForbidden,
+			},
+			registryURL: "registry-1.docker.io",
+			want:        "Access token invalid: Authentication failed - please verify your username and access token",
+		},
+		{
+			name: "500 Internal Server Error returns connection error",
+			err: &errcode.ErrorResponse{
+				StatusCode: http.StatusInternalServerError,
+				Method:     "GET",
+				URL:        &url.URL{Scheme: "https", Host: "registry-1.docker.io", Path: "/v2/"},
+				Errors:     errcode.Errors{},
+			},
+			registryURL: "registry-1.docker.io",
+			want:        "Connection error: GET \"https://registry-1.docker.io/v2/\": response status code 500: Internal Server Error",
+		},
+		{
+			name: "404 Not Found returns connection error",
+			err: &errcode.ErrorResponse{
+				StatusCode: http.StatusNotFound,
+				Method:     "GET",
+				URL:        &url.URL{Scheme: "https", Host: "registry.example.com", Path: "/v2/"},
+				Errors:     errcode.Errors{},
+			},
+			registryURL: "registry.example.com",
+			want:        "Connection error: GET \"https://registry.example.com/v2/\": response status code 404: Not Found",
+		},
+		{
+			name: "400 Bad Request with error details returns connection error with details",
+			err: &errcode.ErrorResponse{
+				StatusCode: http.StatusBadRequest,
+				Method:     "GET",
+				URL:        &url.URL{Scheme: "https", Host: "registry.example.com", Path: "/v2/"},
+				Errors: errcode.Errors{
+					{
+						Code:    errcode.ErrorCodeNameInvalid,
+						Message: "invalid repository name",
+					},
+				},
+			},
+			registryURL: "registry.example.com",
+			want:        "Connection error: GET \"https://registry.example.com/v2/\": response status code 400: name invalid: invalid repository name",
+		},
+		{
+			name:        "non-errcode error returns connection error",
+			err:         errors.New("dial tcp: lookup registry.example.com: no such host"),
+			registryURL: "registry.example.com",
+			want:        "Connection error: dial tcp: lookup registry.example.com: no such host",
+		},
+		{
+			name:        "network timeout error returns connection error",
+			err:         errors.New("context deadline exceeded"),
+			registryURL: "registry.example.com",
+			want:        "Connection error: context deadline exceeded",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := categorizeRegistryError(tt.err, tt.registryURL)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
+
+func Test_registryPingPayload_Validate(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name    string
+		payload registryPingPayload
+		wantErr bool
+		errMsg  string
+	}{
+		{
+			name: "valid DockerHub payload",
+			payload: registryPingPayload{
+				Type:     6, // DockerHub
+				URL:      "registry-1.docker.io",
+				Username: "testuser",
+				Password: "testpass",
+			},
+			wantErr: false,
+		},
+		{
+			name: "valid custom registry payload",
+			payload: registryPingPayload{
+				Type:     3, // Custom
+				URL:      "registry.example.com",
+				Username: "admin",
+				Password: "secret",
+				TLS:      true,
+			},
+			wantErr: false,
+		},
+		{
+			name: "empty username returns error",
+			payload: registryPingPayload{
+				Type:     6,
+				URL:      "registry-1.docker.io",
+				Username: "",
+				Password: "testpass",
+			},
+			wantErr: true,
+			errMsg:  "Username and password are required",
+		},
+		{
+			name: "empty password returns error",
+			payload: registryPingPayload{
+				Type:     6,
+				URL:      "registry-1.docker.io",
+				Username: "testuser",
+				Password: "",
+			},
+			wantErr: true,
+			errMsg:  "Username and password are required",
+		},
+		{
+			name: "invalid registry type returns error",
+			payload: registryPingPayload{
+				Type:     99, // Invalid type
+				URL:      "registry-1.docker.io",
+				Username: "testuser",
+				Password: "testpass",
+			},
+			wantErr: true,
+			errMsg:  "Invalid registry type",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := tt.payload.Validate(nil)
+			if tt.wantErr {
+				require.Error(t, err)
+				if tt.errMsg != "" {
+					assert.Contains(t, err.Error(), tt.errMsg)
+				}
+			} else {
+				assert.NoError(t, err)
+			}
+		})
+	}
+}
+
+func TestHandler_pingRegistry(t *testing.T) {
+	t.Parallel()
+
+	handler, _ := newTestHandler(t)
+
+	tests := []struct {
+		name           string
+		payload        registryPingPayload
+		wantStatusCode int
+		wantSuccess    bool
+		checkResponse  func(t *testing.T, resp registryPingResponse)
+	}{
+		{
+			name: "invalid payload - empty username",
+			payload: registryPingPayload{
+				Type:     portainer.DockerHubRegistry,
+				URL:      "registry-1.docker.io",
+				Username: "",
+				Password: "testpass",
+			},
+			wantStatusCode: http.StatusBadRequest,
+		},
+		{
+			name: "invalid payload - empty password",
+			payload: registryPingPayload{
+				Type:     portainer.DockerHubRegistry,
+				URL:      "registry-1.docker.io",
+				Username: "testuser",
+				Password: "",
+			},
+			wantStatusCode: http.StatusBadRequest,
+		},
+		{
+			name: "invalid payload - invalid registry type",
+			payload: registryPingPayload{
+				Type:     99,
+				URL:      "registry-1.docker.io",
+				Username: "testuser",
+				Password: "testpass",
+			},
+			wantStatusCode: http.StatusBadRequest,
+		},
+		{
+			name: "valid payload with invalid credentials returns 200 with success=false",
+			payload: registryPingPayload{
+				Type:     portainer.DockerHubRegistry,
+				URL:      "registry-1.docker.io",
+				Username: "invalid-user",
+				Password: "invalid-pass",
+			},
+			wantStatusCode: http.StatusOK,
+			wantSuccess:    false,
+			checkResponse: func(t *testing.T, resp registryPingResponse) {
+				assert.False(t, resp.Success)
+				assert.Contains(t, resp.Message, "Access token invalid")
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			payloadBytes, err := json.Marshal(tt.payload)
+			require.NoError(t, err)
+
+			r := httptest.NewRequest(http.MethodPost, "/registries/ping", bytes.NewReader(payloadBytes))
+			w := httptest.NewRecorder()
+
+			// Set up security context
+			restrictedContext := &security.RestrictedRequestContext{
+				IsAdmin:         true,
+				UserID:          1,
+				UserMemberships: []portainer.TeamMembership{},
+			}
+			ctx := security.StoreRestrictedRequestContext(r, restrictedContext)
+			r = r.WithContext(ctx)
+
+			handlerErr := handler.pingRegistry(w, r)
+
+			if tt.wantStatusCode != http.StatusOK {
+				// For error cases, check the handler returns an error
+				require.NotNil(t, handlerErr)
+				assert.Equal(t, tt.wantStatusCode, handlerErr.StatusCode)
+			} else {
+				// For success cases (200), even if the ping failed
+				require.Nil(t, handlerErr)
+				assert.Equal(t, http.StatusOK, w.Code)
+
+				var resp registryPingResponse
+				err := json.Unmarshal(w.Body.Bytes(), &resp)
+				require.NoError(t, err)
+
+				assert.Equal(t, tt.wantSuccess, resp.Success)
+
+				if tt.checkResponse != nil {
+					tt.checkResponse(t, resp)
+				}
+			}
+		})
+	}
+}
+
+func TestHandler_pingRegistry_DockerHubURL(t *testing.T) {
+	t.Parallel()
+
+	handler, _ := newTestHandler(t)
+
+	t.Run("empty URL for DockerHub gets default URL", func(t *testing.T) {
+		payload := registryPingPayload{
+			Type:     portainer.DockerHubRegistry,
+			URL:      "", // Empty URL
+			Username: "testuser",
+			Password: "testpass",
+		}
+
+		payloadBytes, err := json.Marshal(payload)
+		require.NoError(t, err)
+
+		r := httptest.NewRequest(http.MethodPost, "/registries/ping", bytes.NewReader(payloadBytes))
+		w := httptest.NewRecorder()
+
+		restrictedContext := &security.RestrictedRequestContext{
+			IsAdmin:         true,
+			UserID:          1,
+			UserMemberships: []portainer.TeamMembership{},
+		}
+		ctx := security.StoreRestrictedRequestContext(r, restrictedContext)
+		r = r.WithContext(ctx)
+
+		handlerErr := handler.pingRegistry(w, r)
+
+		// Should succeed (handler returns nil), but the ping itself will fail with auth error
+		require.Nil(t, handlerErr)
+		assert.Equal(t, http.StatusOK, w.Code)
+
+		var resp registryPingResponse
+		err = json.Unmarshal(w.Body.Bytes(), &resp)
+		require.NoError(t, err)
+
+		// The ping will fail (invalid credentials), but that's expected
+		// We're just testing that the URL defaulting logic works
+		assert.False(t, resp.Success)
+		assert.Contains(t, resp.Message, "Access token invalid")
+	})
+}
diff --git a/api/http/handler/registries/registry_update.go b/api/http/handler/registries/registry_update.go
new file mode 100644
index 0000000..5b8b560
--- /dev/null
+++ b/api/http/handler/registries/registry_update.go
@@ -0,0 +1,214 @@
+package registries
+
+import (
+	"cmp"
+	"errors"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	httperrors "github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type registryUpdatePayload struct {
+	// Name that will be used to identify this registry
+	Name *string `validate:"required" example:"my-registry"`
+	// URL or IP address of the Docker registry
+	URL *string `validate:"required" example:"registry.mydomain.tld:2375"`
+	// BaseURL is used for quay registry
+	BaseURL *string `json:",omitempty" example:"registry.mydomain.tld:2375"`
+	// Is authentication against this registry enabled
+	Authentication *bool `example:"false" validate:"required"`
+	// Username used to authenticate against this registry. Required when Authentication is true
+	Username *string `example:"registry_user"`
+	// Password used to authenticate against this registry. required when Authentication is true
+	Password *string `example:"registry_password"`
+	// Quay data
+	Quay *portainer.QuayRegistryData
+	// Registry access control
+	RegistryAccesses *portainer.RegistryAccesses `json:",omitempty"`
+	// ECR data
+	Ecr *portainer.EcrData `json:",omitempty"`
+}
+
+func (payload *registryUpdatePayload) Validate(r *http.Request) error {
+	return nil
+}
+
+// @id RegistryUpdate
+// @summary Update a registry
+// @description Update a registry
+// @description **Access policy**: restricted
+// @tags registries
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @produce json
+// @param id path int true "Registry identifier"
+// @param body body registryUpdatePayload true "Registry details"
+// @success 200 {object} portainer.Registry "Success"
+// @failure 400 "Invalid request"
+// @failure 404 "Registry not found"
+// @failure 409 "Another registry with the same name or same URL & credentials already exists"
+// @failure 500 "Server error"
+// @router /registries/{id} [put]
+func (handler *Handler) registryUpdate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	if !securityContext.IsAdmin {
+		return httperror.Forbidden("Permission denied to update registry", httperrors.ErrResourceAccessDenied)
+	}
+
+	registryID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid registry identifier route variable", err)
+	}
+
+	registry, err := handler.DataStore.Registry().Read(portainer.RegistryID(registryID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find a registry with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find a registry with the specified identifier inside the database", err)
+	}
+
+	registries, err := handler.DataStore.Registry().ReadAll()
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve registries from the database", err)
+	}
+
+	var payload registryUpdatePayload
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	registry.Name = *cmp.Or(payload.Name, &registry.Name)
+
+	// Enforce name uniqueness across registries check is performed even if Name
+	// didn't change (Name not in payload) as we need to enforce this rule on
+	// updates not performed with frontend (e.g. on direct API requests)
+	// See https://portainer.atlassian.net/browse/EE-2706 for more details
+	for _, r := range registries {
+		if r.ID != registry.ID && r.Name == registry.Name {
+			return httperror.Conflict("Another registry with the same name already exists", errors.New("a registry is already defined with this name"))
+		}
+	}
+
+	if registry.Type == portainer.ProGetRegistry && payload.BaseURL != nil {
+		registry.BaseURL = *payload.BaseURL
+	}
+
+	shouldUpdateSecrets := false
+
+	if payload.Authentication != nil {
+		shouldUpdateSecrets = shouldUpdateSecrets || (registry.Authentication != *payload.Authentication)
+
+		if *payload.Authentication {
+			registry.Authentication = true
+
+			if payload.Username != nil {
+				shouldUpdateSecrets = shouldUpdateSecrets || (registry.Username != *payload.Username)
+				registry.Username = *payload.Username
+			}
+
+			if payload.Password != nil && *payload.Password != "" {
+				shouldUpdateSecrets = shouldUpdateSecrets || (registry.Password != *payload.Password)
+				registry.Password = *payload.Password
+			}
+
+			if registry.Type == portainer.EcrRegistry && payload.Ecr != nil && payload.Ecr.Region != "" {
+				shouldUpdateSecrets = shouldUpdateSecrets || (registry.Ecr.Region != payload.Ecr.Region)
+				registry.Ecr.Region = payload.Ecr.Region
+			}
+		} else {
+			registry.Authentication = false
+			registry.Username = ""
+			registry.Password = ""
+
+			registry.Ecr.Region = ""
+
+			registry.AccessToken = ""
+			registry.AccessTokenExpiry = 0
+		}
+	}
+
+	registry.ManagementConfiguration = syncConfig(registry)
+
+	if payload.URL != nil {
+		shouldUpdateSecrets = shouldUpdateSecrets || (*payload.URL != registry.URL)
+
+		registry.URL = *payload.URL
+
+		for _, r := range registries {
+			if r.ID != registry.ID && handler.registriesHaveSameURLAndCredentials(&r, registry) {
+				return httperror.Conflict("Another registry with the same URL and credentials already exists", errors.New("a registry is already defined for this URL and credentials"))
+			}
+		}
+	}
+
+	if shouldUpdateSecrets {
+		registry.AccessToken = ""
+		registry.AccessTokenExpiry = 0
+
+		for endpointID, endpointAccess := range registry.RegistryAccesses {
+			endpoint, err := handler.DataStore.Endpoint().Endpoint(endpointID)
+			if err != nil {
+				return httperror.InternalServerError("Unable to update access to registry", err)
+			}
+
+			if endpointutils.IsKubernetesEndpoint(endpoint) {
+				err = handler.updateEndpointRegistryAccess(endpoint, registry, endpointAccess)
+				if err != nil {
+					return httperror.InternalServerError("Unable to update access to registry", err)
+				}
+			}
+		}
+	}
+
+	registry.Quay = *cmp.Or(payload.Quay, &registry.Quay)
+
+	if err := handler.DataStore.Registry().Update(registry.ID, registry); err != nil {
+		return httperror.InternalServerError("Unable to persist registry changes inside the database", err)
+	}
+
+	hideFields(registry, true)
+
+	return response.JSON(w, registry)
+}
+
+func syncConfig(registry *portainer.Registry) *portainer.RegistryManagementConfiguration {
+	config := cmp.Or(registry.ManagementConfiguration, &portainer.RegistryManagementConfiguration{})
+
+	config.Authentication = registry.Authentication
+	config.Username = registry.Username
+	config.Password = registry.Password
+	config.Ecr = registry.Ecr
+	config.Type = registry.Type
+
+	return config
+}
+
+func (handler *Handler) updateEndpointRegistryAccess(endpoint *portainer.Endpoint, registry *portainer.Registry, endpointAccess portainer.RegistryAccessPolicies) error {
+	cli, err := handler.K8sClientFactory.GetPrivilegedKubeClient(endpoint)
+	if err != nil {
+		return err
+	}
+
+	for _, namespace := range endpointAccess.Namespaces {
+		if err := cli.DeleteRegistrySecret(registry.ID, namespace); err != nil {
+			return err
+		}
+
+		if err := cli.CreateRegistrySecret(registry, namespace); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
diff --git a/api/http/handler/registries/registry_update_test.go b/api/http/handler/registries/registry_update_test.go
new file mode 100644
index 0000000..033296e
--- /dev/null
+++ b/api/http/handler/registries/registry_update_test.go
@@ -0,0 +1,63 @@
+package registries
+
+import (
+	"bytes"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/security"
+
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestHandler_registryUpdate(t *testing.T) {
+	t.Parallel()
+
+	handler, store := newTestHandler(t)
+
+	registry := &portainer.Registry{Type: portainer.ProGetRegistry}
+
+	err := store.Registry().Create(registry)
+	require.NoError(t, err)
+
+	payload := registryUpdatePayload{
+		Name:           new("Updated test registry"),
+		URL:            new("http://example.org/feed"),
+		BaseURL:        new("http://example.org"),
+		Authentication: new(true),
+		Username:       new("username"),
+		Password:       new("password"),
+	}
+
+	payloadBytes, err := json.Marshal(payload)
+	require.NoError(t, err)
+
+	r := httptest.NewRequest(http.MethodPut, "/registries/1", bytes.NewReader(payloadBytes))
+	w := httptest.NewRecorder()
+
+	restrictedContext := &security.RestrictedRequestContext{IsAdmin: true, UserID: 1}
+
+	ctx := security.StoreRestrictedRequestContext(r, restrictedContext)
+	r = r.WithContext(ctx)
+
+	handler.ServeHTTP(w, r)
+	require.Equal(t, http.StatusOK, w.Code)
+
+	updatedRegistry := portainer.Registry{}
+	err = json.NewDecoder(w.Body).Decode(&updatedRegistry)
+	require.NoError(t, err)
+
+	// Registry type should remain intact
+	assert.Equal(t, registry.Type, updatedRegistry.Type)
+
+	assert.Equal(t, *payload.Name, updatedRegistry.Name)
+	assert.Equal(t, *payload.URL, updatedRegistry.URL)
+	assert.Equal(t, *payload.BaseURL, updatedRegistry.BaseURL)
+	assert.Equal(t, *payload.Authentication, updatedRegistry.Authentication)
+	assert.Equal(t, *payload.Username, updatedRegistry.Username)
+	assert.Empty(t, updatedRegistry.Password)
+}
diff --git a/api/http/handler/resourcecontrols/handler.go b/api/http/handler/resourcecontrols/handler.go
new file mode 100644
index 0000000..0529454
--- /dev/null
+++ b/api/http/handler/resourcecontrols/handler.go
@@ -0,0 +1,31 @@
+package resourcecontrols
+
+import (
+	"net/http"
+
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+
+	"github.com/gorilla/mux"
+)
+
+// Handler is the HTTP handler used to handle resource control operations.
+type Handler struct {
+	*mux.Router
+	DataStore dataservices.DataStore
+}
+
+// NewHandler creates a handler to manage resource control operations.
+func NewHandler(bouncer security.BouncerService) *Handler {
+	h := &Handler{
+		Router: mux.NewRouter(),
+	}
+	h.Handle("/resource_controls",
+		bouncer.AdminAccess(httperror.LoggerHandler(h.resourceControlCreate))).Methods(http.MethodPost)
+	h.Handle("/resource_controls/{id}",
+		bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.resourceControlUpdate))).Methods(http.MethodPut)
+	h.Handle("/resource_controls/{id}",
+		bouncer.AdminAccess(httperror.LoggerHandler(h.resourceControlDelete))).Methods(http.MethodDelete)
+	return h
+}
diff --git a/api/http/handler/resourcecontrols/resourcecontrol_create.go b/api/http/handler/resourcecontrols/resourcecontrol_create.go
new file mode 100644
index 0000000..f4e03a1
--- /dev/null
+++ b/api/http/handler/resourcecontrols/resourcecontrol_create.go
@@ -0,0 +1,116 @@
+package resourcecontrols
+
+import (
+	"errors"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type resourceControlCreatePayload struct {
+	//
+	ResourceID string `example:"617c5f22bb9b023d6daab7cba43a57576f83492867bc767d1c59416b065e5f08" validate:"required"`
+	// Type of Resource. Valid values are: 1 - container, 2 - service
+	// 3 - volume, 4 - network, 5 - secret, 6 - stack, 7 - config, 8 - custom template, 9 - azure-container-group
+	Type portainer.ResourceControlType `example:"1" validate:"required" enums:"1,2,3,4,5,6,7,8,9"`
+	// Permit access to the associated resource to any user
+	Public bool `example:"true"`
+	// Permit access to resource only to admins
+	AdministratorsOnly bool `example:"true"`
+	// List of user identifiers with access to the associated resource
+	Users []int `example:"1,4"`
+	// List of team identifiers with access to the associated resource
+	Teams []int `example:"56,7"`
+	// List of Docker resources that will inherit this access control
+	SubResourceIDs []string `example:"617c5f22bb9b023d6daab7cba43a57576f83492867bc767d1c59416b065e5f08"`
+}
+
+var errResourceControlAlreadyExists = errors.New("A resource control is already applied on this resource") //http/resourceControl
+
+func (payload *resourceControlCreatePayload) Validate(r *http.Request) error {
+	if len(payload.ResourceID) == 0 {
+		return errors.New("invalid payload: invalid resource identifier")
+	}
+
+	if payload.Type <= 0 || payload.Type >= 10 {
+		return errors.New("invalid payload: Invalid type value. Value must be one of: 1 - container, 2 - service, 3 - volume, 4 - network, 5 - secret, 6 - stack, 7 - config, 8 - custom template, 9 - azure-container-group")
+	}
+
+	if len(payload.Users) == 0 && len(payload.Teams) == 0 && !payload.Public && !payload.AdministratorsOnly {
+		return errors.New("invalid payload: must specify Users, Teams, Public or AdministratorsOnly")
+	}
+
+	if payload.Public && payload.AdministratorsOnly {
+		return errors.New("invalid payload: cannot set both public and administrators only flags to true")
+	}
+	return nil
+}
+
+// @id ResourceControlCreate
+// @summary Create a new resource control
+// @description Create a new resource control to restrict access to a Docker resource.
+// @description **Access policy**: administrator
+// @tags resource_controls
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @produce json
+// @param body body resourceControlCreatePayload true "Resource control details"
+// @success 200 {object} portainer.ResourceControl "Success"
+// @failure 400 "Invalid request"
+// @failure 409 "A resource control is already associated to this resource"
+// @failure 500 "Server error"
+// @router /resource_controls [post]
+func (handler *Handler) resourceControlCreate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	var payload resourceControlCreatePayload
+	err := request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	rc, err := handler.DataStore.ResourceControl().ResourceControlByResourceIDAndType(payload.ResourceID, payload.Type)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve resource controls from the database", err)
+	}
+	if rc != nil {
+		return httperror.Conflict("A resource control is already associated to this resource", errResourceControlAlreadyExists)
+	}
+
+	var userAccesses = make([]portainer.UserResourceAccess, 0)
+	for _, v := range payload.Users {
+		userAccess := portainer.UserResourceAccess{
+			UserID:      portainer.UserID(v),
+			AccessLevel: portainer.ReadWriteAccessLevel,
+		}
+		userAccesses = append(userAccesses, userAccess)
+	}
+
+	var teamAccesses = make([]portainer.TeamResourceAccess, 0)
+	for _, v := range payload.Teams {
+		teamAccess := portainer.TeamResourceAccess{
+			TeamID:      portainer.TeamID(v),
+			AccessLevel: portainer.ReadWriteAccessLevel,
+		}
+		teamAccesses = append(teamAccesses, teamAccess)
+	}
+
+	resourceControl := portainer.ResourceControl{
+		ResourceID:         payload.ResourceID,
+		SubResourceIDs:     payload.SubResourceIDs,
+		Type:               payload.Type,
+		Public:             payload.Public,
+		AdministratorsOnly: payload.AdministratorsOnly,
+		UserAccesses:       userAccesses,
+		TeamAccesses:       teamAccesses,
+	}
+
+	err = handler.DataStore.ResourceControl().Create(&resourceControl)
+	if err != nil {
+		return httperror.InternalServerError("Unable to persist the resource control inside the database", err)
+	}
+
+	return response.JSON(w, resourceControl)
+}
diff --git a/api/http/handler/resourcecontrols/resourcecontrol_delete.go b/api/http/handler/resourcecontrols/resourcecontrol_delete.go
new file mode 100644
index 0000000..1c8ae26
--- /dev/null
+++ b/api/http/handler/resourcecontrols/resourcecontrol_delete.go
@@ -0,0 +1,43 @@
+package resourcecontrols
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id ResourceControlDelete
+// @summary Remove a resource control
+// @description Remove a resource control.
+// @description **Access policy**: administrator
+// @tags resource_controls
+// @security ApiKeyAuth
+// @security jwt
+// @param id path int true "Resource control identifier"
+// @success 204 "Success"
+// @failure 400 "Invalid request"
+// @failure 404 "Resource control not found"
+// @failure 500 "Server error"
+// @router /resource_controls/{id} [delete]
+func (handler *Handler) resourceControlDelete(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	resourceControlID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid resource control identifier route variable", err)
+	}
+
+	_, err = handler.DataStore.ResourceControl().Read(portainer.ResourceControlID(resourceControlID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find a resource control with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find a resource control with the specified identifier inside the database", err)
+	}
+
+	if err := handler.DataStore.ResourceControl().Delete(portainer.ResourceControlID(resourceControlID)); err != nil {
+		return httperror.InternalServerError("Unable to remove the resource control from the database", err)
+	}
+
+	return response.Empty(w)
+}
diff --git a/api/http/handler/resourcecontrols/resourcecontrol_update.go b/api/http/handler/resourcecontrols/resourcecontrol_update.go
new file mode 100644
index 0000000..409ddb7
--- /dev/null
+++ b/api/http/handler/resourcecontrols/resourcecontrol_update.go
@@ -0,0 +1,114 @@
+package resourcecontrols
+
+import (
+	"errors"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	httperrors "github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type resourceControlUpdatePayload struct {
+	// Permit access to the associated resource to any user
+	Public bool `example:"true"`
+	// List of user identifiers with access to the associated resource
+	Users []int `example:"4"`
+	// List of team identifiers with access to the associated resource
+	Teams []int `example:"7"`
+	// Permit access to resource only to admins
+	AdministratorsOnly bool `example:"true"`
+}
+
+func (payload *resourceControlUpdatePayload) Validate(r *http.Request) error {
+	if len(payload.Users) == 0 && len(payload.Teams) == 0 && !payload.Public && !payload.AdministratorsOnly {
+		return errors.New("invalid payload: must specify Users, Teams, Public or AdministratorsOnly")
+	}
+
+	if payload.Public && payload.AdministratorsOnly {
+		return errors.New("invalid payload: cannot set public and administrators only")
+	}
+
+	return nil
+}
+
+// @id ResourceControlUpdate
+// @summary Update a resource control
+// @description Update a resource control
+// @description **Access policy**: authenticated
+// @tags resource_controls
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @produce json
+// @param id path int true "Resource control identifier"
+// @param body body resourceControlUpdatePayload true "Resource control details"
+// @success 200 {object} portainer.ResourceControl "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Unauthorized"
+// @failure 404 "Resource control not found"
+// @failure 500 "Server error"
+// @router /resource_controls/{id} [put]
+func (handler *Handler) resourceControlUpdate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	resourceControlID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid resource control identifier route variable", err)
+	}
+
+	var payload resourceControlUpdatePayload
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	resourceControl, err := handler.DataStore.ResourceControl().Read(portainer.ResourceControlID(resourceControlID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find a resource control with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find a resource control with the specified identifier inside the database", err)
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	if !security.AuthorizedResourceControlAccess(resourceControl, securityContext) {
+		return httperror.Forbidden("Permission denied to access the resource control", httperrors.ErrResourceAccessDenied)
+	}
+
+	resourceControl.Public = payload.Public
+	resourceControl.AdministratorsOnly = payload.AdministratorsOnly
+
+	var userAccesses = make([]portainer.UserResourceAccess, 0)
+	for _, v := range payload.Users {
+		userAccess := portainer.UserResourceAccess{
+			UserID:      portainer.UserID(v),
+			AccessLevel: portainer.ReadWriteAccessLevel,
+		}
+		userAccesses = append(userAccesses, userAccess)
+	}
+	resourceControl.UserAccesses = userAccesses
+
+	var teamAccesses = make([]portainer.TeamResourceAccess, 0)
+	for _, v := range payload.Teams {
+		teamAccess := portainer.TeamResourceAccess{
+			TeamID:      portainer.TeamID(v),
+			AccessLevel: portainer.ReadWriteAccessLevel,
+		}
+		teamAccesses = append(teamAccesses, teamAccess)
+	}
+	resourceControl.TeamAccesses = teamAccesses
+
+	if !security.AuthorizedResourceControlUpdate(resourceControl, securityContext) {
+		return httperror.Forbidden("Permission denied to update the resource control", httperrors.ErrResourceAccessDenied)
+	}
+
+	if err := handler.DataStore.ResourceControl().Update(resourceControl.ID, resourceControl); err != nil {
+		return httperror.InternalServerError("Unable to persist resource control changes inside the database", err)
+	}
+
+	return response.JSON(w, resourceControl)
+}
diff --git a/api/http/handler/roles/handler.go b/api/http/handler/roles/handler.go
new file mode 100644
index 0000000..5ff59dd
--- /dev/null
+++ b/api/http/handler/roles/handler.go
@@ -0,0 +1,28 @@
+package roles
+
+import (
+	"net/http"
+
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+
+	"github.com/gorilla/mux"
+)
+
+// Handler is the HTTP handler used to handle role operations.
+type Handler struct {
+	*mux.Router
+	DataStore dataservices.DataStore
+}
+
+// NewHandler creates a handler to manage role operations.
+func NewHandler(bouncer security.BouncerService) *Handler {
+	h := &Handler{
+		Router: mux.NewRouter(),
+	}
+	h.Handle("/roles",
+		bouncer.AdminAccess(httperror.LoggerHandler(h.roleList))).Methods(http.MethodGet)
+
+	return h
+}
diff --git a/api/http/handler/roles/role_list.go b/api/http/handler/roles/role_list.go
new file mode 100644
index 0000000..425e1e7
--- /dev/null
+++ b/api/http/handler/roles/role_list.go
@@ -0,0 +1,28 @@
+package roles
+
+import (
+	"net/http"
+
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id RoleList
+// @summary List roles
+// @description List all roles available for use
+// @description **Access policy**: administrator
+// @tags roles
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @success 200 {array} portainer.Role "Success"
+// @failure 500 "Server error"
+// @router /roles [get]
+func (handler *Handler) roleList(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	roles, err := handler.DataStore.Role().ReadAll()
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve authorization sets from the database", err)
+	}
+
+	return response.JSON(w, roles)
+}
diff --git a/api/http/handler/settings/handler.go b/api/http/handler/settings/handler.go
new file mode 100644
index 0000000..81a9f58
--- /dev/null
+++ b/api/http/handler/settings/handler.go
@@ -0,0 +1,45 @@
+package settings
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+
+	"github.com/gorilla/mux"
+)
+
+func hideFields(settings *portainer.Settings) {
+	settings.LDAPSettings.Password = ""
+	settings.OAuthSettings.ClientSecret = ""
+	settings.OAuthSettings.KubeSecretKey = nil
+}
+
+// Handler is the HTTP handler used to handle settings operations.
+type Handler struct {
+	*mux.Router
+	DataStore          dataservices.DataStore
+	FileService        portainer.FileService
+	JWTService         portainer.JWTService
+	LDAPService        portainer.LDAPService
+	SnapshotService    portainer.SnapshotService
+	SetupTokenRequired bool
+}
+
+// NewHandler creates a handler to manage settings operations.
+func NewHandler(bouncer security.BouncerService) *Handler {
+	h := &Handler{
+		Router: mux.NewRouter(),
+	}
+
+	h.Handle("/settings",
+		bouncer.AdminAccess(httperror.LoggerHandler(h.settingsInspect))).Methods(http.MethodGet)
+	h.Handle("/settings",
+		bouncer.AdminAccess(httperror.LoggerHandler(h.settingsUpdate))).Methods(http.MethodPut)
+	h.Handle("/settings/public",
+		bouncer.PublicAccess(httperror.LoggerHandler(h.settingsPublic))).Methods(http.MethodGet)
+
+	return h
+}
diff --git a/api/http/handler/settings/settings_inspect.go b/api/http/handler/settings/settings_inspect.go
new file mode 100644
index 0000000..ccee2cc
--- /dev/null
+++ b/api/http/handler/settings/settings_inspect.go
@@ -0,0 +1,29 @@
+package settings
+
+import (
+	"net/http"
+
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id SettingsInspect
+// @summary Retrieve Portainer settings
+// @description Retrieve Portainer settings.
+// @description **Access policy**: administrator
+// @tags settings
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @success 200 {object} portainer.Settings "Success"
+// @failure 500 "Server error"
+// @router /settings [get]
+func (handler *Handler) settingsInspect(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	settings, err := handler.DataStore.Settings().Settings()
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve the settings from the database", err)
+	}
+
+	hideFields(settings)
+	return response.JSON(w, settings)
+}
diff --git a/api/http/handler/settings/settings_public.go b/api/http/handler/settings/settings_public.go
new file mode 100644
index 0000000..3943961
--- /dev/null
+++ b/api/http/handler/settings/settings_public.go
@@ -0,0 +1,112 @@
+package settings
+
+import (
+	"fmt"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/pkg/featureflags"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type publicSettingsResponse struct {
+	// URL to a logo that will be displayed on the login page as well as on top of the sidebar. Will use default Portainer logo when value is empty string
+	LogoURL string `json:"LogoURL" example:"https://mycompany.mydomain.tld/logo.png"`
+	// Active authentication method for the Portainer instance. Valid values are: 1 for internal, 2 for LDAP, or 3 for oauth
+	AuthenticationMethod portainer.AuthenticationMethod `json:"AuthenticationMethod" example:"1"`
+	// The minimum required length for a password of any user when using internal auth mode
+	RequiredPasswordLength int `json:"RequiredPasswordLength" example:"1"`
+	// Deployment options for encouraging deployment as code
+	GlobalDeploymentOptions portainer.GlobalDeploymentOptions `json:"GlobalDeploymentOptions"`
+	// Whether edge compute features are enabled
+	EnableEdgeComputeFeatures bool `json:"EnableEdgeComputeFeatures" example:"true"`
+	// Supported feature flags
+	Features map[featureflags.Feature]bool `json:"Features"`
+	// The URL used for oauth login
+	OAuthLoginURI string `json:"OAuthLoginURI" example:"https://gitlab.com/oauth"`
+	// The URL used for oauth logout
+	OAuthLogoutURI string `json:"OAuthLogoutURI" example:"https://gitlab.com/oauth/logout"`
+	// The expiry of a Kubeconfig
+	KubeconfigExpiry string `example:"24h" default:"0"`
+	// Whether team sync is enabled
+	TeamSync bool `json:"TeamSync" example:"true"`
+
+	Edge struct {
+		// The ping interval for edge agent - used in edge async mode [seconds]
+		PingInterval int `json:"PingInterval" example:"60"`
+		// The snapshot interval for edge agent - used in edge async mode [seconds]
+		SnapshotInterval int `json:"SnapshotInterval" example:"60"`
+		// The command list interval for edge agent - used in edge async mode [seconds]
+		CommandInterval int `json:"CommandInterval" example:"60"`
+		// The check in interval for edge agent (in seconds) - used in non async mode [seconds]
+		CheckinInterval int `example:"60"`
+	}
+
+	IsDockerDesktopExtension bool `json:"IsDockerDesktopExtension" example:"false"`
+	// Whether the setup wizard must send the X-Setup-Token header for admin init / restore
+	RequiresSetupToken bool `json:"RequiresSetupToken" example:"false"`
+}
+
+// @id SettingsPublic
+// @summary Retrieve Portainer public settings
+// @description Retrieve public settings. Returns a small set of settings that are not reserved to administrators only.
+// @description **Access policy**: public
+// @tags settings
+// @produce json
+// @success 200 {object} publicSettingsResponse "Success"
+// @failure 500 "Server error"
+// @router /settings/public [get]
+func (handler *Handler) settingsPublic(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	settings, err := handler.DataStore.Settings().Settings()
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve the settings from the database", err)
+	}
+
+	publicSettings := generatePublicSettings(settings)
+	publicSettings.RequiresSetupToken = handler.SetupTokenRequired
+
+	return response.JSON(w, publicSettings)
+}
+
+func generatePublicSettings(appSettings *portainer.Settings) *publicSettingsResponse {
+	publicSettings := &publicSettingsResponse{
+		LogoURL:                   appSettings.LogoURL,
+		AuthenticationMethod:      appSettings.AuthenticationMethod,
+		RequiredPasswordLength:    appSettings.InternalAuthSettings.RequiredPasswordLength,
+		EnableEdgeComputeFeatures: appSettings.EnableEdgeComputeFeatures,
+		GlobalDeploymentOptions:   appSettings.GlobalDeploymentOptions,
+		KubeconfigExpiry:          appSettings.KubeconfigExpiry,
+		Features:                  featureflags.FeatureFlags(),
+	}
+
+	publicSettings.Edge.PingInterval = appSettings.Edge.PingInterval
+	publicSettings.Edge.SnapshotInterval = appSettings.Edge.SnapshotInterval
+	publicSettings.Edge.CommandInterval = appSettings.Edge.CommandInterval
+	publicSettings.Edge.CheckinInterval = appSettings.EdgeAgentCheckinInterval
+
+	publicSettings.IsDockerDesktopExtension = appSettings.IsDockerDesktopExtension
+
+	// If OAuth authentication is on, compose the related fields from application settings
+	if publicSettings.AuthenticationMethod == portainer.AuthenticationOAuth {
+		publicSettings.OAuthLogoutURI = appSettings.OAuthSettings.LogoutURI
+		publicSettings.OAuthLoginURI = fmt.Sprintf("%s?response_type=code&client_id=%s&redirect_uri=%s&scope=%s",
+			appSettings.OAuthSettings.AuthorizationURI,
+			appSettings.OAuthSettings.ClientID,
+			appSettings.OAuthSettings.RedirectURI,
+			appSettings.OAuthSettings.Scopes)
+
+		// Control prompt=login param according to the SSO setting
+		if !appSettings.OAuthSettings.SSO {
+			publicSettings.OAuthLoginURI += "&prompt=login"
+		}
+	}
+	// If LDAP authentication is on, compose the related fields from application settings
+	if publicSettings.AuthenticationMethod == portainer.AuthenticationLDAP && appSettings.LDAPSettings.GroupSearchSettings != nil {
+		if len(appSettings.LDAPSettings.GroupSearchSettings) > 0 {
+			publicSettings.TeamSync = len(appSettings.LDAPSettings.GroupSearchSettings[0].GroupBaseDN) > 0
+		}
+	}
+
+	return publicSettings
+}
diff --git a/api/http/handler/settings/settings_public_test.go b/api/http/handler/settings/settings_public_test.go
new file mode 100644
index 0000000..b052e61
--- /dev/null
+++ b/api/http/handler/settings/settings_public_test.go
@@ -0,0 +1,74 @@
+package settings
+
+import (
+	"fmt"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+)
+
+const (
+	dummyOAuthClientID          = "1a2b3c4d"
+	dummyOAuthScopes            = "scopes"
+	dummyOAuthAuthenticationURI = "example.com/auth"
+	dummyOAuthRedirectURI       = "example.com/redirect"
+	dummyOAuthLogoutURI         = "example.com/logout"
+)
+
+func newTestSettings() (loginURI string, settings *portainer.Settings) {
+	loginURI = fmt.Sprintf("%s?response_type=code&client_id=%s&redirect_uri=%s&scope=%s",
+		dummyOAuthAuthenticationURI,
+		dummyOAuthClientID,
+		dummyOAuthRedirectURI,
+		dummyOAuthScopes)
+	settings = &portainer.Settings{
+		AuthenticationMethod: portainer.AuthenticationOAuth,
+		OAuthSettings: portainer.OAuthSettings{
+			AuthorizationURI: dummyOAuthAuthenticationURI,
+			ClientID:         dummyOAuthClientID,
+			Scopes:           dummyOAuthScopes,
+			RedirectURI:      dummyOAuthRedirectURI,
+			LogoutURI:        dummyOAuthLogoutURI,
+		},
+	}
+	return
+}
+
+func TestGeneratePublicSettingsWithSSO(t *testing.T) {
+	t.Parallel()
+	dummyOAuthLoginURI, mockAppSettings := newTestSettings()
+
+	mockAppSettings.OAuthSettings.SSO = true
+	publicSettings := generatePublicSettings(mockAppSettings)
+	if publicSettings.AuthenticationMethod != portainer.AuthenticationOAuth {
+		t.Errorf("wrong AuthenticationMethod, want: %d, got: %d", portainer.AuthenticationOAuth, publicSettings.AuthenticationMethod)
+	}
+
+	if publicSettings.OAuthLoginURI != dummyOAuthLoginURI {
+		t.Errorf("wrong OAuthLoginURI when SSO is switched on, want: %s, got: %s", dummyOAuthLoginURI, publicSettings.OAuthLoginURI)
+	}
+
+	if publicSettings.OAuthLogoutURI != dummyOAuthLogoutURI {
+		t.Errorf("wrong OAuthLogoutURI, want: %s, got: %s", dummyOAuthLogoutURI, publicSettings.OAuthLogoutURI)
+	}
+}
+
+func TestGeneratePublicSettingsWithoutSSO(t *testing.T) {
+	t.Parallel()
+	dummyOAuthLoginURI, mockAppSettings := newTestSettings()
+
+	mockAppSettings.OAuthSettings.SSO = false
+	publicSettings := generatePublicSettings(mockAppSettings)
+	if publicSettings.AuthenticationMethod != portainer.AuthenticationOAuth {
+		t.Errorf("wrong AuthenticationMethod, want: %d, got: %d", portainer.AuthenticationOAuth, publicSettings.AuthenticationMethod)
+	}
+
+	expectedOAuthLoginURI := dummyOAuthLoginURI + "&prompt=login"
+	if publicSettings.OAuthLoginURI != expectedOAuthLoginURI {
+		t.Errorf("wrong OAuthLoginURI when SSO is switched off, want: %s, got: %s", expectedOAuthLoginURI, publicSettings.OAuthLoginURI)
+	}
+
+	if publicSettings.OAuthLogoutURI != dummyOAuthLogoutURI {
+		t.Errorf("wrong OAuthLogoutURI, want: %s, got: %s", dummyOAuthLogoutURI, publicSettings.OAuthLogoutURI)
+	}
+}
diff --git a/api/http/handler/settings/settings_update.go b/api/http/handler/settings/settings_update.go
new file mode 100644
index 0000000..4a24bf9
--- /dev/null
+++ b/api/http/handler/settings/settings_update.go
@@ -0,0 +1,267 @@
+package settings
+
+import (
+	"cmp"
+	"net/http"
+	"strings"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/filesystem"
+	"github.com/portainer/portainer/api/internal/edge"
+	"github.com/portainer/portainer/pkg/libhelm"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/portainer/portainer/pkg/libhttp/ssrf"
+	"github.com/portainer/portainer/pkg/validate"
+
+	"github.com/pkg/errors"
+	"golang.org/x/oauth2"
+)
+
+type settingsUpdatePayload struct {
+	// URL to a logo that will be displayed on the login page as well as on top of the sidebar. Will use default Portainer logo when value is empty string
+	LogoURL *string `example:"https://mycompany.mydomain.tld/logo.png"`
+	// A list of label name & value that will be used to hide containers when querying containers
+	BlackListedLabels []portainer.Pair
+	// Active authentication method for the Portainer instance. Valid values are: 1 for internal, 2 for LDAP, or 3 for oauth
+	AuthenticationMethod *int `example:"1"`
+	InternalAuthSettings *portainer.InternalAuthSettings
+	LDAPSettings         *portainer.LDAPSettings
+	OAuthSettings        *portainer.OAuthSettings
+	// The interval in which environment(endpoint) snapshots are created
+	SnapshotInterval *string `example:"5m"`
+	// URL to the templates that will be displayed in the UI when navigating to App Templates
+	TemplatesURL *string `example:"https://raw.githubusercontent.com/portainer/templates/master/templates.json"`
+	// Deployment options for encouraging deployment as code
+	GlobalDeploymentOptions  *portainer.GlobalDeploymentOptions // The default check in interval for edge agent (in seconds)
+	EdgeAgentCheckinInterval *int                               `example:"5"`
+	// Whether edge compute features are enabled
+	EnableEdgeComputeFeatures *bool `example:"true"`
+	// The duration of a user session
+	UserSessionTimeout *string `example:"5m"`
+	// The expiry of a Kubeconfig
+	KubeconfigExpiry *string `example:"24h" default:"0"`
+	// Helm repository URL
+	HelmRepositoryURL *string `example:"https://charts.bitnami.com/bitnami"`
+	// Kubectl Shell Image
+	KubectlShellImage *string `example:"portainer/kubectl-shell:latest"`
+	// TrustOnFirstConnect makes Portainer accepting edge agent connection by default
+	TrustOnFirstConnect *bool `example:"false"`
+	// EnforceEdgeID makes Portainer store the Edge ID instead of accepting anyone
+	EnforceEdgeID *bool `example:"false"`
+	// EdgePortainerURL is the URL that is exposed to edge agents
+	EdgePortainerURL *string `json:"EdgePortainerURL"`
+	// ForceSecureCookies forces the Secure attribute on auth cookies regardless of the detected scheme
+	ForceSecureCookies *bool `example:"false"`
+}
+
+func (payload *settingsUpdatePayload) Validate(r *http.Request) error {
+	if payload.AuthenticationMethod != nil && *payload.AuthenticationMethod != 1 && *payload.AuthenticationMethod != 2 && *payload.AuthenticationMethod != 3 {
+		return errors.New("Invalid authentication method value. Value must be one of: 1 (internal), 2 (LDAP/AD) or 3 (OAuth)")
+	}
+
+	if payload.LogoURL != nil && *payload.LogoURL != "" && !validate.IsURL(*payload.LogoURL) {
+		return errors.New("Invalid logo URL. Must correspond to a valid URL format")
+	}
+
+	if payload.TemplatesURL != nil && *payload.TemplatesURL != "" && !validate.IsURL(*payload.TemplatesURL) {
+		return errors.New("Invalid external templates URL. Must correspond to a valid URL format")
+	}
+
+	if payload.HelmRepositoryURL != nil && *payload.HelmRepositoryURL != "" && !validate.IsURL(*payload.HelmRepositoryURL) {
+		return errors.New("Invalid Helm repository URL. Must correspond to a valid URL format")
+	}
+
+	if payload.HelmRepositoryURL != nil && *payload.HelmRepositoryURL != "" {
+		if err := ssrf.CheckURL(r.Context(), *payload.HelmRepositoryURL); err != nil {
+			return errors.New("Invalid Helm repository URL. Must correspond to a valid URL format")
+		}
+	}
+
+	if payload.UserSessionTimeout != nil {
+		if _, err := time.ParseDuration(*payload.UserSessionTimeout); err != nil {
+			return errors.New("Invalid user session timeout")
+		}
+	}
+
+	if payload.KubeconfigExpiry != nil {
+		if _, err := time.ParseDuration(*payload.KubeconfigExpiry); err != nil {
+			return errors.New("Invalid Kubeconfig Expiry")
+		}
+	}
+
+	if payload.EdgePortainerURL != nil && *payload.EdgePortainerURL != "" {
+		if _, err := edge.ParseHostForEdge(*payload.EdgePortainerURL); err != nil {
+			return err
+		}
+	}
+
+	if payload.OAuthSettings != nil {
+		if payload.OAuthSettings.AuthStyle < oauth2.AuthStyleAutoDetect || payload.OAuthSettings.AuthStyle > oauth2.AuthStyleInHeader {
+			return errors.New("Invalid OAuth AuthStyle")
+		}
+	}
+
+	return nil
+}
+
+// @id SettingsUpdate
+// @summary Update Portainer settings
+// @description Update Portainer settings.
+// @description **Access policy**: administrator
+// @tags settings
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @produce json
+// @param body body settingsUpdatePayload true "New settings"
+// @success 200 {object} portainer.Settings "Success"
+// @failure 400 "Invalid request"
+// @failure 500 "Server error"
+// @router /settings [put]
+func (handler *Handler) settingsUpdate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	var payload settingsUpdatePayload
+	err := request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	var settings *portainer.Settings
+	if err = handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		settings, err = handler.updateSettings(tx, payload)
+
+		return err
+	}); err != nil {
+		return response.TxErrorResponse(err)
+	}
+
+	hideFields(settings)
+	return response.JSON(w, settings)
+}
+
+func (handler *Handler) updateSettings(tx dataservices.DataStoreTx, payload settingsUpdatePayload) (*portainer.Settings, error) {
+	settings, err := tx.Settings().Settings()
+	if err != nil {
+		return nil, httperror.InternalServerError("Unable to retrieve the settings from the database", err)
+	}
+
+	if payload.AuthenticationMethod != nil {
+		settings.AuthenticationMethod = portainer.AuthenticationMethod(*payload.AuthenticationMethod)
+	}
+
+	settings.LogoURL = *cmp.Or(payload.LogoURL, &settings.LogoURL)
+	settings.TemplatesURL = *cmp.Or(payload.TemplatesURL, &settings.TemplatesURL)
+
+	// Update the global deployment options, and the environment deployment options if they have changed
+	settings.GlobalDeploymentOptions = *cmp.Or(payload.GlobalDeploymentOptions, &settings.GlobalDeploymentOptions)
+
+	if payload.HelmRepositoryURL != nil {
+		settings.HelmRepositoryURL = ""
+		if *payload.HelmRepositoryURL != "" {
+			newHelmRepo := strings.TrimSuffix(strings.ToLower(*payload.HelmRepositoryURL), "/")
+
+			if newHelmRepo != settings.HelmRepositoryURL && newHelmRepo != portainer.DefaultHelmRepositoryURL {
+				if err := libhelm.ValidateHelmRepositoryURL(*payload.HelmRepositoryURL, nil); err != nil {
+					return nil, httperror.BadRequest("Invalid Helm repository URL. Must correspond to a valid URL format", err)
+				}
+			}
+
+			settings.HelmRepositoryURL = newHelmRepo
+		}
+	}
+
+	if payload.BlackListedLabels != nil {
+		settings.BlackListedLabels = payload.BlackListedLabels
+	}
+
+	if payload.InternalAuthSettings != nil {
+		settings.InternalAuthSettings.RequiredPasswordLength = payload.InternalAuthSettings.RequiredPasswordLength
+	}
+
+	if payload.LDAPSettings != nil {
+		ldapReaderDN := cmp.Or(payload.LDAPSettings.ReaderDN, settings.LDAPSettings.ReaderDN)
+		ldapPassword := cmp.Or(payload.LDAPSettings.Password, settings.LDAPSettings.Password)
+
+		settings.LDAPSettings = *payload.LDAPSettings
+		settings.LDAPSettings.ReaderDN = ldapReaderDN
+		settings.LDAPSettings.Password = ldapPassword
+	}
+
+	if payload.OAuthSettings != nil {
+		clientSecret := payload.OAuthSettings.ClientSecret
+		if clientSecret == "" {
+			clientSecret = settings.OAuthSettings.ClientSecret
+		}
+
+		kubeSecret := payload.OAuthSettings.KubeSecretKey
+		if kubeSecret == nil {
+			kubeSecret = settings.OAuthSettings.KubeSecretKey
+		}
+
+		settings.OAuthSettings = *payload.OAuthSettings
+		settings.OAuthSettings.ClientSecret = clientSecret
+		settings.OAuthSettings.KubeSecretKey = kubeSecret
+		settings.OAuthSettings.AuthStyle = payload.OAuthSettings.AuthStyle
+	}
+
+	settings.EnableEdgeComputeFeatures = *cmp.Or(payload.EnableEdgeComputeFeatures, &settings.EnableEdgeComputeFeatures)
+	settings.TrustOnFirstConnect = *cmp.Or(payload.TrustOnFirstConnect, &settings.TrustOnFirstConnect)
+	settings.EnforceEdgeID = *cmp.Or(payload.EnforceEdgeID, &settings.EnforceEdgeID)
+	settings.EdgePortainerURL = *cmp.Or(payload.EdgePortainerURL, &settings.EdgePortainerURL)
+	settings.ForceSecureCookies = *cmp.Or(payload.ForceSecureCookies, &settings.ForceSecureCookies)
+
+	if payload.SnapshotInterval != nil && *payload.SnapshotInterval != settings.SnapshotInterval {
+		if err := handler.updateSnapshotInterval(settings, *payload.SnapshotInterval); err != nil {
+			return nil, httperror.InternalServerError("Unable to update snapshot interval", err)
+		}
+	}
+
+	settings.EdgeAgentCheckinInterval = *cmp.Or(payload.EdgeAgentCheckinInterval, &settings.EdgeAgentCheckinInterval)
+	settings.KubeconfigExpiry = *cmp.Or(payload.KubeconfigExpiry, &settings.KubeconfigExpiry)
+
+	if payload.UserSessionTimeout != nil {
+		settings.UserSessionTimeout = *payload.UserSessionTimeout
+
+		userSessionDuration, _ := time.ParseDuration(*payload.UserSessionTimeout)
+
+		handler.JWTService.SetUserSessionDuration(userSessionDuration)
+	}
+
+	if err := handler.updateTLS(settings); err != nil {
+		return nil, err
+	}
+
+	settings.KubectlShellImage = *cmp.Or(payload.KubectlShellImage, &settings.KubectlShellImage)
+
+	if err := tx.Settings().UpdateSettings(settings); err != nil {
+		return nil, httperror.InternalServerError("Unable to persist settings changes inside the database", err)
+	}
+
+	return settings, nil
+}
+
+func (handler *Handler) updateSnapshotInterval(settings *portainer.Settings, snapshotInterval string) error {
+	settings.SnapshotInterval = snapshotInterval
+
+	return handler.SnapshotService.SetSnapshotInterval(snapshotInterval)
+}
+
+func (handler *Handler) updateTLS(settings *portainer.Settings) error {
+	if (settings.LDAPSettings.TLSConfig.TLS || settings.LDAPSettings.StartTLS) && !settings.LDAPSettings.TLSConfig.TLSSkipVerify {
+		caCertPath, _ := handler.FileService.GetPathForTLSFile(filesystem.LDAPStorePath, portainer.TLSFileCA)
+		settings.LDAPSettings.TLSConfig.TLSCACertPath = caCertPath
+
+		return nil
+	}
+
+	settings.LDAPSettings.TLSConfig.TLSCACertPath = ""
+
+	if err := handler.FileService.DeleteTLSFiles(filesystem.LDAPStorePath); err != nil {
+		return httperror.InternalServerError("Unable to remove TLS files from disk", err)
+	}
+
+	return nil
+}
diff --git a/api/http/handler/ssl/handler.go b/api/http/handler/ssl/handler.go
new file mode 100644
index 0000000..c78b2e1
--- /dev/null
+++ b/api/http/handler/ssl/handler.go
@@ -0,0 +1,30 @@
+package ssl
+
+import (
+	"net/http"
+
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/ssl"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+
+	"github.com/gorilla/mux"
+)
+
+// Handler is the HTTP handler used to handle MOTD operations.
+type Handler struct {
+	*mux.Router
+	SSLService *ssl.Service
+}
+
+// NewHandler returns a new Handler
+func NewHandler(bouncer security.BouncerService) *Handler {
+	h := &Handler{
+		Router: mux.NewRouter(),
+	}
+	h.Handle("/ssl",
+		bouncer.AdminAccess(httperror.LoggerHandler(h.sslInspect))).Methods(http.MethodGet)
+	h.Handle("/ssl",
+		bouncer.AdminAccess(httperror.LoggerHandler(h.sslUpdate))).Methods(http.MethodPut)
+
+	return h
+}
diff --git a/api/http/handler/ssl/ssl_inspect.go b/api/http/handler/ssl/ssl_inspect.go
new file mode 100644
index 0000000..2a36494
--- /dev/null
+++ b/api/http/handler/ssl/ssl_inspect.go
@@ -0,0 +1,30 @@
+package ssl
+
+import (
+	"net/http"
+
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id SSLInspect
+// @summary Inspect the ssl settings
+// @description Retrieve the ssl settings.
+// @description **Access policy**: administrator
+// @tags ssl
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @success 200 {object} portainer.SSLSettings "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied to access settings"
+// @failure 500 "Server error"
+// @router /ssl [get]
+func (handler *Handler) sslInspect(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	settings, err := handler.SSLService.GetSSLSettings()
+	if err != nil {
+		return httperror.InternalServerError("Failed to fetch certificate info", err)
+	}
+
+	return response.JSON(w, settings)
+}
diff --git a/api/http/handler/ssl/ssl_update.go b/api/http/handler/ssl/ssl_update.go
new file mode 100644
index 0000000..71aa303
--- /dev/null
+++ b/api/http/handler/ssl/ssl_update.go
@@ -0,0 +1,61 @@
+package ssl
+
+import (
+	"errors"
+	"net/http"
+
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type sslUpdatePayload struct {
+	// SSL Certificates
+	Cert        *string
+	Key         *string
+	HTTPEnabled *bool
+}
+
+func (payload *sslUpdatePayload) Validate(r *http.Request) error {
+	if (payload.Cert == nil || payload.Key == nil) && payload.Cert != payload.Key {
+		return errors.New("both certificate and key files should be provided")
+	}
+
+	return nil
+}
+
+// @id SSLUpdate
+// @summary Update the ssl settings
+// @description Update the ssl settings.
+// @description **Access policy**: administrator
+// @tags ssl
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @produce json
+// @param body body sslUpdatePayload true "SSL Settings"
+// @success 204 "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied to access settings"
+// @failure 500 "Server error"
+// @router /ssl [put]
+func (handler *Handler) sslUpdate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	var payload sslUpdatePayload
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	if payload.Cert != nil {
+		if err := handler.SSLService.SetCertificates([]byte(*payload.Cert), []byte(*payload.Key)); err != nil {
+			return httperror.InternalServerError("Failed to save certificate", err)
+		}
+	}
+
+	if payload.HTTPEnabled != nil {
+		if err := handler.SSLService.SetHTTPEnabled(*payload.HTTPEnabled); err != nil {
+			return httperror.InternalServerError("Failed to force https", err)
+		}
+	}
+
+	return response.Empty(w)
+}
diff --git a/api/http/handler/stacks/create_compose_stack.go b/api/http/handler/stacks/create_compose_stack.go
new file mode 100644
index 0000000..46d5153
--- /dev/null
+++ b/api/http/handler/stacks/create_compose_stack.go
@@ -0,0 +1,409 @@
+package stacks
+
+import (
+	"fmt"
+	"net/http"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices/source"
+	"github.com/portainer/portainer/api/filesystem"
+	"github.com/portainer/portainer/api/git/update"
+	"github.com/portainer/portainer/api/gitops/sources"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/stacks/deployments"
+	"github.com/portainer/portainer/api/stacks/stackbuilders"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/validate"
+
+	"github.com/pkg/errors"
+	"github.com/rs/zerolog/log"
+)
+
+type composeStackFromFileContentPayload struct {
+	// Name of the stack
+	Name string `example:"myStack" validate:"required"`
+	// Content of the Stack file
+	StackFileContent string `example:"version: 3\n services:\n web:\n image:nginx" validate:"required"`
+	// A list of environment variables used during stack deployment
+	Env []portainer.Pair
+	// Whether the stack is from a app template
+	FromAppTemplate bool `example:"false"`
+}
+
+func (payload *composeStackFromFileContentPayload) Validate(r *http.Request) error {
+	if len(payload.Name) == 0 {
+		return errors.New("Invalid stack name")
+	}
+
+	if len(payload.StackFileContent) == 0 {
+		return errors.New("Invalid stack file content")
+	}
+	return nil
+}
+
+func createStackPayloadFromComposeFileContentPayload(name string, fileContent string, env []portainer.Pair, fromAppTemplate bool) stackbuilders.StackPayload {
+	return stackbuilders.StackPayload{
+		Name:             name,
+		StackFileContent: []byte(fileContent),
+		Env:              env,
+		FromAppTemplate:  fromAppTemplate,
+	}
+}
+
+func (handler *Handler) checkAndCleanStackDupFromSwarm(_ http.ResponseWriter, _ *http.Request, _ *portainer.Endpoint, _ portainer.UserID, stack *portainer.Stack) error {
+	resourceControl, err := handler.DataStore.ResourceControl().ResourceControlByResourceIDAndType(stackutils.ResourceControlID(stack.EndpointID, stack.Name), portainer.StackResourceControl)
+	if err != nil {
+		return err
+	}
+
+	// stop scheduler updates of the stack before removal
+	if stack.AutoUpdate != nil {
+		deployments.StopAutoupdate(stack.ID, stack.AutoUpdate.JobID, handler.Scheduler)
+	}
+
+	err = handler.DataStore.Stack().Delete(stack.ID)
+	if err != nil {
+		return err
+	}
+
+	if resourceControl != nil {
+		err = handler.DataStore.ResourceControl().Delete(resourceControl.ID)
+		if err != nil {
+			log.Error().
+				Str("stack", fmt.Sprintf("%+v", stack)).
+				Msg("unable to remove the associated resource control from the database for stack")
+		}
+	}
+
+	if exists, _ := handler.FileService.FileExists(stack.ProjectPath); exists {
+		err = handler.FileService.RemoveDirectory(stack.ProjectPath)
+		if err != nil {
+			log.Warn().
+				Str("stack", fmt.Sprintf("%+v", stack)).
+				Msg("unable to remove stack files from disk for stack")
+		}
+	}
+
+	return nil
+}
+
+func (handler *Handler) ensureUniqueComposeStackName(w http.ResponseWriter, r *http.Request, endpoint *portainer.Endpoint, userID portainer.UserID, name string) *httperror.HandlerError {
+	isUnique, err := handler.checkUniqueStackNameInDocker(endpoint, name, 0, false)
+	if err != nil {
+		return httperror.InternalServerError("Unable to check for name collision", err)
+	} else if isUnique {
+		return nil
+	}
+
+	stacks, err := handler.DataStore.Stack().StacksByName(name)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve the stack from the database", err)
+	}
+
+	for _, stack := range stacks {
+		if stack.EndpointID != endpoint.ID {
+			continue
+		}
+
+		if stack.Type != portainer.DockerComposeStack {
+			if err := handler.checkAndCleanStackDupFromSwarm(w, r, endpoint, userID, &stack); err != nil {
+				return httperror.BadRequest("Invalid request payload", err)
+			}
+
+			continue
+		}
+
+		return stackExistsError(name)
+	}
+
+	return nil
+}
+
+// @id StackCreateDockerStandaloneString
+// @summary Deploy a new compose stack from a text
+// @description Deploy a new stack into a Docker environment specified via the environment identifier.
+// @description **Access policy**: authenticated
+// @tags stacks
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @produce json
+// @param body body composeStackFromFileContentPayload true "stack config"
+// @param endpointId query int true "Identifier of the environment that will be used to deploy the stack"
+// @success 200 {object} portainer.Stack
+// @failure 400 "Invalid request"
+// @failure 500 "Server error"
+// @router /stacks/create/standalone/string [post]
+func (handler *Handler) createComposeStackFromFileContent(w http.ResponseWriter, r *http.Request, endpoint *portainer.Endpoint, userID portainer.UserID) *httperror.HandlerError {
+	var payload composeStackFromFileContentPayload
+	err := request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	payload.Name = handler.ComposeStackManager.NormalizeStackName(payload.Name)
+
+	if err := handler.ensureUniqueComposeStackName(w, r, endpoint, userID, payload.Name); err != nil {
+		return err
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	stackPayload := createStackPayloadFromComposeFileContentPayload(payload.Name, payload.StackFileContent, payload.Env, payload.FromAppTemplate)
+
+	composeStackBuilder := stackbuilders.CreateComposeStackFileBuilder(securityContext,
+		handler.DataStore,
+		handler.FileService,
+		handler.StackDeployer)
+
+	stack, httpErr := stackbuilders.Build(r.Context(), handler.DataStore, composeStackBuilder, &stackPayload, endpoint, userID)
+	if httpErr != nil {
+		return httpErr
+	}
+
+	return handler.decorateStackResponse(w, stack, userID)
+}
+
+type composeStackFromGitRepositoryPayload struct {
+	// Name of the stack
+	Name string `example:"myStack" validate:"required"`
+	// SourceID references an existing Source for git credentials/URL.
+	// When set, the inline URL and authentication fields are ignored.
+	SourceID portainer.SourceID `example:"1"`
+	// Deprecated: use SourceID instead. URL of a Git repository hosting the Stack file.
+	RepositoryURL string `example:"https://github.com/openfaas/faas"`
+	// Reference name of a Git repository hosting the Stack file
+	RepositoryReferenceName string `example:"refs/heads/master"`
+	// Deprecated: use SourceID instead. Use basic authentication to clone the Git repository.
+	RepositoryAuthentication bool `example:"true"`
+	// Deprecated: use SourceID instead. Username used in basic authentication.
+	RepositoryUsername string `example:"myGitUsername"`
+	// Deprecated: use SourceID instead. Password used in basic authentication.
+	RepositoryPassword string `example:"myGitPassword"`
+	// Path to the Stack file inside the Git repository
+	ComposeFile string `example:"docker-compose.yml" default:"docker-compose.yml"`
+	// Applicable when deploying with multiple stack files
+	AdditionalFiles []string `example:"[nz.compose.yml, uat.compose.yml]"`
+	// Optional GitOps update configuration
+	AutoUpdate *portainer.AutoUpdateSettings
+	// A list of environment variables used during stack deployment
+	Env []portainer.Pair
+	// Whether the stack is from a app template
+	FromAppTemplate bool `example:"false"`
+	// Deprecated: use SourceID instead. TLSSkipVerify skips SSL verification when cloning the Git repository.
+	TLSSkipVerify bool `example:"false"`
+}
+
+func createStackPayloadFromComposeGitPayload(name, repoUrl, repoReference, repoUsername, repoPassword string, repoAuthentication bool, composeFile string, additionalFiles []string, autoUpdate *portainer.AutoUpdateSettings, env []portainer.Pair, fromAppTemplate bool, repoSkipSSLVerify bool, sourceID portainer.SourceID) stackbuilders.StackPayload {
+	return stackbuilders.StackPayload{
+		Name: name,
+		RepositoryConfigPayload: stackbuilders.RepositoryConfigPayload{
+			SourceID:       sourceID,
+			URL:            repoUrl,
+			ReferenceName:  repoReference,
+			Authentication: repoAuthentication,
+			Username:       repoUsername,
+			Password:       repoPassword,
+			TLSSkipVerify:  repoSkipSSLVerify,
+		},
+		ComposeFile:     composeFile,
+		AdditionalFiles: additionalFiles,
+		AutoUpdate:      autoUpdate,
+		Env:             env,
+		FromAppTemplate: fromAppTemplate,
+	}
+}
+
+func (payload *composeStackFromGitRepositoryPayload) Validate(r *http.Request) error {
+	if len(payload.Name) == 0 {
+		return errors.New("Invalid stack name")
+	}
+
+	if payload.SourceID == 0 {
+		if len(payload.RepositoryURL) == 0 || !validate.IsURL(payload.RepositoryURL) {
+			return errors.New("Invalid repository URL. Must correspond to a valid URL format")
+		}
+		if payload.RepositoryAuthentication && len(payload.RepositoryPassword) == 0 {
+			return errors.New("Invalid repository credentials. Password must be specified when authentication is enabled")
+		}
+	}
+
+	return update.ValidateAutoUpdateSettings(payload.AutoUpdate)
+}
+
+// @id StackCreateDockerStandaloneRepository
+// @summary Deploy a new compose stack from repository
+// @description Deploy a new stack into a Docker environment specified via the environment identifier.
+// @description **Access policy**: authenticated
+// @tags stacks
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @accept json
+// @param endpointId query int true "Identifier of the environment that will be used to deploy the stack"
+// @param body body composeStackFromGitRepositoryPayload true "stack config"
+// @success 200 {object} portainer.Stack
+// @failure 400 "Invalid request"
+// @failure 409 "Stack name or webhook ID already exists"
+// @failure 500 "Server error"
+// @router /stacks/create/standalone/repository [post]
+func (handler *Handler) createComposeStackFromGitRepository(w http.ResponseWriter, r *http.Request, endpoint *portainer.Endpoint, userID portainer.UserID) *httperror.HandlerError {
+	var payload composeStackFromGitRepositoryPayload
+	err := request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	payload.Name = handler.ComposeStackManager.NormalizeStackName(payload.Name)
+	if payload.ComposeFile == "" {
+		payload.ComposeFile = filesystem.ComposeFileDefaultName
+	}
+
+	if err := handler.ensureUniqueComposeStackName(w, r, endpoint, userID, payload.Name); err != nil {
+		return err
+	}
+
+	//make sure the webhook ID is unique
+	if payload.AutoUpdate != nil && payload.AutoUpdate.Webhook != "" {
+		isUnique, err := handler.checkUniqueWebhookID(handler.DataStore, payload.AutoUpdate.Webhook)
+		if err != nil {
+			return httperror.InternalServerError("Unable to check for webhook ID collision", err)
+		}
+		if !isUnique {
+			return httperror.Conflict(fmt.Sprintf("Webhook ID: %s already exists", payload.AutoUpdate.Webhook), stackutils.ErrWebhookIDAlreadyExists)
+		}
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve user info from request context", err)
+	}
+	userContext := source.NewUserContext(securityContext.User, securityContext.UserMemberships)
+
+	if payload.SourceID != 0 {
+		if _, httpErr := sources.ValidateGitSourceAccess(handler.DataStore, userContext, payload.SourceID); httpErr != nil {
+			return httpErr
+		}
+	}
+
+	stackPayload := createStackPayloadFromComposeGitPayload(payload.Name,
+		strings.TrimSuffix(payload.RepositoryURL, "/"),
+		payload.RepositoryReferenceName,
+		payload.RepositoryUsername,
+		payload.RepositoryPassword,
+		payload.RepositoryAuthentication,
+		payload.ComposeFile,
+		payload.AdditionalFiles,
+		payload.AutoUpdate,
+		payload.Env,
+		payload.FromAppTemplate,
+		payload.TLSSkipVerify,
+		payload.SourceID,
+	)
+
+	composeStackBuilder := stackbuilders.CreateComposeStackGitBuilder(securityContext,
+		handler.DataStore,
+		handler.FileService,
+		handler.GitService,
+		handler.Scheduler,
+		handler.StackDeployer)
+
+	stack, httpErr := stackbuilders.Build(r.Context(), handler.DataStore, composeStackBuilder, &stackPayload, endpoint, userID)
+	if httpErr != nil {
+		return httpErr
+	}
+
+	return handler.decorateStackResponse(w, stack, userID)
+}
+
+type composeStackFromFileUploadPayload struct {
+	Name             string
+	StackFileContent []byte
+	Env              []portainer.Pair
+}
+
+func createStackPayloadFromComposeFileUploadPayload(name string, fileContentBytes []byte, env []portainer.Pair) stackbuilders.StackPayload {
+	return stackbuilders.StackPayload{
+		Name:             name,
+		StackFileContent: fileContentBytes,
+		Env:              env,
+	}
+}
+
+func decodeRequestForm(r *http.Request) (*composeStackFromFileUploadPayload, error) {
+	payload := &composeStackFromFileUploadPayload{}
+	name, err := request.RetrieveMultiPartFormValue(r, "Name", false)
+	if err != nil {
+		return nil, errors.New("Invalid stack name")
+	}
+	payload.Name = name
+
+	composeFileContent, _, err := request.RetrieveMultiPartFormFile(r, "file")
+	if err != nil {
+		return nil, errors.New("Invalid Compose file. Ensure that the Compose file is uploaded correctly")
+	}
+	payload.StackFileContent = composeFileContent
+
+	var env []portainer.Pair
+	err = request.RetrieveMultiPartFormJSONValue(r, "Env", &env, true)
+	if err != nil {
+		return nil, errors.New("Invalid Env parameter")
+	}
+	payload.Env = env
+	return payload, nil
+}
+
+// @id StackCreateDockerStandaloneFile
+// @summary Deploy a new compose stack from a file
+// @description Deploy a new stack into a Docker environment specified via the environment identifier.
+// @description **Access policy**: authenticated
+// @tags stacks
+// @security ApiKeyAuth
+// @security jwt
+// @accept multipart/form-data
+// @produce json
+// @param Name formData string true "Name of the stack"
+// @param Env formData string false "Environment variables passed during deployment, represented as a JSON array [{'name': 'name', 'value': 'value'}]."
+// @param file formData file false "Stack file"
+// @param endpointId query int true "Identifier of the environment that will be used to deploy the stack"
+// @success 200 {object} portainer.Stack
+// @failure 400 "Invalid request"
+// @failure 500 "Server error"
+// @router /stacks/create/standalone/file [post]
+func (handler *Handler) createComposeStackFromFileUpload(w http.ResponseWriter, r *http.Request, endpoint *portainer.Endpoint, userID portainer.UserID) *httperror.HandlerError {
+	payload, err := decodeRequestForm(r)
+	if err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	payload.Name = handler.ComposeStackManager.NormalizeStackName(payload.Name)
+
+	if err := handler.ensureUniqueComposeStackName(w, r, endpoint, userID, payload.Name); err != nil {
+		return err
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	stackPayload := createStackPayloadFromComposeFileUploadPayload(payload.Name, payload.StackFileContent, payload.Env)
+
+	composeStackBuilder := stackbuilders.CreateComposeStackFileBuilder(securityContext,
+		handler.DataStore,
+		handler.FileService,
+		handler.StackDeployer)
+
+	stack, httpErr := stackbuilders.Build(r.Context(), handler.DataStore, composeStackBuilder, &stackPayload, endpoint, userID)
+	if httpErr != nil {
+		return httpErr
+	}
+
+	return handler.decorateStackResponse(w, stack, userID)
+}
diff --git a/api/http/handler/stacks/create_compose_stack_test.go b/api/http/handler/stacks/create_compose_stack_test.go
new file mode 100644
index 0000000..89b6591
--- /dev/null
+++ b/api/http/handler/stacks/create_compose_stack_test.go
@@ -0,0 +1,31 @@
+package stacks
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestComposeGitPayload_ValidateWithSourceID_URLNotRequired(t *testing.T) {
+	t.Parallel()
+	payload := &composeStackFromGitRepositoryPayload{
+		Name:     "mystack",
+		SourceID: portainer.SourceID(1),
+		// RepositoryURL intentionally omitted
+	}
+
+	err := payload.Validate(nil)
+	assert.NoError(t, err)
+}
+
+func TestComposeGitPayload_ValidateWithoutSourceID_URLRequired(t *testing.T) {
+	t.Parallel()
+	payload := &composeStackFromGitRepositoryPayload{
+		Name: "mystack",
+		// SourceID and RepositoryURL both omitted
+	}
+
+	err := payload.Validate(nil)
+	assert.Error(t, err)
+}
diff --git a/api/http/handler/stacks/create_kubernetes_stack.go b/api/http/handler/stacks/create_kubernetes_stack.go
new file mode 100644
index 0000000..48766e8
--- /dev/null
+++ b/api/http/handler/stacks/create_kubernetes_stack.go
@@ -0,0 +1,325 @@
+package stacks
+
+import (
+	"fmt"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices/source"
+	"github.com/portainer/portainer/api/git/update"
+	"github.com/portainer/portainer/api/gitops/sources"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+	"github.com/portainer/portainer/api/internal/registryutils"
+	"github.com/portainer/portainer/api/stacks/stackbuilders"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/portainer/portainer/pkg/libhttp/ssrf"
+	"github.com/portainer/portainer/pkg/validate"
+
+	"github.com/pkg/errors"
+)
+
+type kubernetesStringDeploymentPayload struct {
+	StackName        string
+	ComposeFormat    bool
+	Namespace        string
+	StackFileContent string
+	// Whether the stack is from a app template
+	FromAppTemplate bool `example:"false"`
+}
+
+func createStackPayloadFromK8sFileContentPayload(name, namespace, fileContent string, composeFormat, fromAppTemplate bool) stackbuilders.StackPayload {
+	return stackbuilders.StackPayload{
+		StackName:        name,
+		Namespace:        namespace,
+		StackFileContent: []byte(fileContent),
+		FromAppTemplate:  fromAppTemplate,
+	}
+}
+
+type kubernetesGitDeploymentPayload struct {
+	StackName     string
+	ComposeFormat bool
+	Namespace     string
+	// SourceID references an existing Source for git credentials/URL.
+	// When set, the inline URL and authentication fields are ignored.
+	SourceID portainer.SourceID `example:"1"`
+	// Deprecated: use SourceID instead. URL of a Git repository hosting the Stack file.
+	RepositoryURL string
+	// Deprecated: use SourceID instead. Reference name of a Git repository hosting the Stack file.
+	RepositoryReferenceName string
+	// Deprecated: use SourceID instead. Use basic authentication to clone the Git repository.
+	RepositoryAuthentication bool
+	// Deprecated: use SourceID instead. Username used in basic authentication.
+	RepositoryUsername string
+	// Deprecated: use SourceID instead. Password used in basic authentication.
+	RepositoryPassword string
+	ManifestFile       string
+	AdditionalFiles    []string
+	AutoUpdate         *portainer.AutoUpdateSettings
+	// Deprecated: use SourceID instead. TLSSkipVerify skips SSL verification when cloning the Git repository.
+	TLSSkipVerify bool `example:"false"`
+}
+
+func createStackPayloadFromK8sGitPayload(name, repoUrl, repoReference, repoUsername, repoPassword string, repoAuthentication, composeFormat bool, namespace, manifest string, additionalFiles []string, autoUpdate *portainer.AutoUpdateSettings, repoSkipSSLVerify bool, sourceID portainer.SourceID) stackbuilders.StackPayload {
+	return stackbuilders.StackPayload{
+		StackName: name,
+		RepositoryConfigPayload: stackbuilders.RepositoryConfigPayload{
+			SourceID:       sourceID,
+			URL:            repoUrl,
+			ReferenceName:  repoReference,
+			Authentication: repoAuthentication,
+			Username:       repoUsername,
+			Password:       repoPassword,
+			TLSSkipVerify:  repoSkipSSLVerify,
+		},
+		Namespace:       namespace,
+		ManifestFile:    manifest,
+		AdditionalFiles: additionalFiles,
+		AutoUpdate:      autoUpdate,
+	}
+}
+
+type kubernetesManifestURLDeploymentPayload struct {
+	StackName     string
+	Namespace     string
+	ComposeFormat bool
+	ManifestURL   string
+}
+
+func createStackPayloadFromK8sUrlPayload(name, namespace, manifestUrl string, composeFormat bool) stackbuilders.StackPayload {
+	return stackbuilders.StackPayload{
+		StackName:   name,
+		Namespace:   namespace,
+		ManifestURL: manifestUrl,
+	}
+}
+
+func (payload *kubernetesStringDeploymentPayload) Validate(r *http.Request) error {
+	if len(payload.StackFileContent) == 0 {
+		return errors.New("Invalid stack file content")
+	}
+
+	return nil
+}
+
+func (payload *kubernetesGitDeploymentPayload) Validate(r *http.Request) error {
+	if payload.SourceID == 0 {
+		if len(payload.RepositoryURL) == 0 || !validate.IsURL(payload.RepositoryURL) {
+			return errors.New("Invalid repository URL. Must correspond to a valid URL format")
+		}
+		if payload.RepositoryAuthentication && len(payload.RepositoryPassword) == 0 {
+			return errors.New("Invalid repository credentials. Password must be specified when authentication is enabled")
+		}
+	}
+
+	if len(payload.ManifestFile) == 0 {
+		return errors.New("Invalid manifest file in repository")
+	}
+
+	return update.ValidateAutoUpdateSettings(payload.AutoUpdate)
+}
+
+func (payload *kubernetesManifestURLDeploymentPayload) Validate(r *http.Request) error {
+	if len(payload.ManifestURL) == 0 || !validate.IsURL(payload.ManifestURL) {
+		return errors.New("Invalid manifest URL")
+	}
+
+	if err := ssrf.CheckURL(r.Context(), payload.ManifestURL); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+type createKubernetesStackResponse struct {
+	Output string `json:"Output"`
+}
+
+// @id StackCreateKubernetesFile
+// @summary Deploy a new kubernetes stack from a file
+// @description Deploy a new stack into a Docker environment specified via the environment identifier.
+// @description **Access policy**: authenticated
+// @tags stacks
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param body body kubernetesStringDeploymentPayload true "stack config"
+// @param endpointId query int true "Identifier of the environment that will be used to deploy the stack"
+// @success 200 {object} portainer.Stack
+// @failure 400 "Invalid request"
+// @failure 500 "Server error"
+// @router /stacks/create/kubernetes/string [post]
+func (handler *Handler) createKubernetesStackFromFileContent(w http.ResponseWriter, r *http.Request, endpoint *portainer.Endpoint, userID portainer.UserID) *httperror.HandlerError {
+	if !endpointutils.IsKubernetesEndpoint(endpoint) {
+		return httperror.BadRequest("Environment type does not match", errors.New("Environment type does not match"))
+	}
+
+	var payload kubernetesStringDeploymentPayload
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	user, err := handler.DataStore.User().Read(userID)
+	if err != nil {
+		return httperror.InternalServerError("Unable to load user information from the database", err)
+	}
+
+	stackPayload := createStackPayloadFromK8sFileContentPayload(payload.StackName, payload.Namespace, payload.StackFileContent, payload.ComposeFormat, payload.FromAppTemplate)
+
+	k8sStackBuilder := stackbuilders.CreateK8sStackFileContentBuilder(handler.DataStore,
+		handler.FileService,
+		handler.StackDeployer,
+		handler.KubernetesDeployer,
+		user)
+
+	// Refresh ECR registry secret if needed
+	// RefreshEcrSecret method checks if the namespace has any ECR registry
+	// otherwise return nil
+	cli, err := handler.KubernetesClientFactory.GetPrivilegedKubeClient(endpoint)
+	if err == nil {
+		if err := registryutils.RefreshEcrSecret(cli, endpoint, handler.DataStore, payload.Namespace); err != nil {
+			return httperror.InternalServerError("Unable to refresh ECR registry secret", err)
+		}
+	}
+
+	if _, err := stackbuilders.Build(r.Context(), handler.DataStore, k8sStackBuilder, &stackPayload, endpoint, userID); err != nil {
+		return err
+	}
+
+	resp := &createKubernetesStackResponse{
+		Output: k8sStackBuilder.GetResponse(),
+	}
+
+	return response.JSON(w, resp)
+}
+
+// @id StackCreateKubernetesGit
+// @summary Deploy a new kubernetes stack from a git repository
+// @description Deploy a new stack into a Docker environment specified via the environment identifier.
+// @description **Access policy**: authenticated
+// @tags stacks
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param body body kubernetesGitDeploymentPayload true "stack config"
+// @param endpointId query int true "Identifier of the environment that will be used to deploy the stack"
+// @success 200 {object} portainer.Stack
+// @failure 400 "Invalid request"
+// @failure 409 "Stack name or webhook ID already exists"
+// @failure 500 "Server error"
+// @router /stacks/create/kubernetes/repository [post]
+func (handler *Handler) createKubernetesStackFromGitRepository(w http.ResponseWriter, r *http.Request, endpoint *portainer.Endpoint, userID portainer.UserID) *httperror.HandlerError {
+	if !endpointutils.IsKubernetesEndpoint(endpoint) {
+		return httperror.BadRequest("Environment type does not match", errors.New("Environment type does not match"))
+	}
+
+	var payload kubernetesGitDeploymentPayload
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	user, err := handler.DataStore.User().Read(userID)
+	if err != nil {
+		return httperror.InternalServerError("Unable to load user information from the database", err)
+	}
+
+	// Make sure the webhook ID is unique
+	if payload.AutoUpdate != nil && payload.AutoUpdate.Webhook != "" {
+		if isUnique, err := handler.checkUniqueWebhookID(handler.DataStore, payload.AutoUpdate.Webhook); err != nil {
+			return httperror.InternalServerError("Unable to check for webhook ID collision", err)
+		} else if !isUnique {
+			return httperror.Conflict(fmt.Sprintf("Webhook ID: %s already exists", payload.AutoUpdate.Webhook), stackutils.ErrWebhookIDAlreadyExists)
+		}
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve user info from request context", err)
+	}
+	userContext := source.NewUserContext(securityContext.User, securityContext.UserMemberships)
+	if payload.SourceID != 0 {
+		if _, httpErr := sources.ValidateGitSourceAccess(handler.DataStore, userContext, payload.SourceID); httpErr != nil {
+			return httpErr
+		}
+	}
+
+	stackPayload := createStackPayloadFromK8sGitPayload(payload.StackName,
+		payload.RepositoryURL,
+		payload.RepositoryReferenceName,
+		payload.RepositoryUsername,
+		payload.RepositoryPassword,
+		payload.RepositoryAuthentication,
+		payload.ComposeFormat,
+		payload.Namespace,
+		payload.ManifestFile,
+		payload.AdditionalFiles,
+		payload.AutoUpdate,
+		payload.TLSSkipVerify,
+		payload.SourceID,
+	)
+
+	k8sStackBuilder := stackbuilders.CreateKubernetesStackGitBuilder(handler.DataStore,
+		handler.FileService,
+		handler.GitService,
+		handler.Scheduler,
+		handler.StackDeployer,
+		handler.KubernetesDeployer,
+		user)
+
+	if _, err := stackbuilders.Build(r.Context(), handler.DataStore, k8sStackBuilder, &stackPayload, endpoint, userID); err != nil {
+		return err
+	}
+
+	return response.JSON(w, &createKubernetesStackResponse{
+		Output: k8sStackBuilder.GetResponse(),
+	})
+}
+
+// @id StackCreateKubernetesUrl
+// @summary Deploy a new kubernetes stack from a url
+// @description Deploy a new stack into a Docker environment specified via the environment identifier.
+// @description **Access policy**: authenticated
+// @tags stacks
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param body body kubernetesManifestURLDeploymentPayload true "stack config"
+// @param endpointId query int true "Identifier of the environment that will be used to deploy the stack"
+// @success 200 {object} portainer.Stack
+// @failure 400 "Invalid request"
+// @failure 500 "Server error"
+// @router /stacks/create/kubernetes/url [post]
+func (handler *Handler) createKubernetesStackFromManifestURL(w http.ResponseWriter, r *http.Request, endpoint *portainer.Endpoint, userID portainer.UserID) *httperror.HandlerError {
+	var payload kubernetesManifestURLDeploymentPayload
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	user, err := handler.DataStore.User().Read(userID)
+	if err != nil {
+		return httperror.InternalServerError("Unable to load user information from the database", err)
+	}
+
+	stackPayload := createStackPayloadFromK8sUrlPayload(payload.StackName,
+		payload.Namespace,
+		payload.ManifestURL,
+		payload.ComposeFormat)
+
+	k8sStackBuilder := stackbuilders.CreateKubernetesStackUrlBuilder(handler.DataStore,
+		handler.FileService,
+		handler.StackDeployer,
+		handler.KubernetesDeployer,
+		user)
+
+	if _, err := stackbuilders.Build(r.Context(), handler.DataStore, k8sStackBuilder, &stackPayload, endpoint, userID); err != nil {
+		return err
+	}
+
+	return response.JSON(w, &createKubernetesStackResponse{
+		Output: k8sStackBuilder.GetResponse(),
+	})
+}
diff --git a/api/http/handler/stacks/create_kubernetes_stack_test.go b/api/http/handler/stacks/create_kubernetes_stack_test.go
new file mode 100644
index 0000000..82f4729
--- /dev/null
+++ b/api/http/handler/stacks/create_kubernetes_stack_test.go
@@ -0,0 +1,67 @@
+package stacks
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestKubernetesGitDeploymentPayloadValidate_WithSourceID_URLNotRequired(t *testing.T) {
+	t.Parallel()
+
+	p := kubernetesGitDeploymentPayload{
+		SourceID:     portainer.SourceID(1),
+		ManifestFile: "manifest.yaml",
+	}
+	err := p.Validate(nil)
+	require.NoError(t, err)
+}
+
+func TestKubernetesGitDeploymentPayloadValidate_WithSourceID_AuthNotRequired(t *testing.T) {
+	t.Parallel()
+
+	p := kubernetesGitDeploymentPayload{
+		SourceID:                 portainer.SourceID(1),
+		RepositoryAuthentication: true,
+		// Password intentionally omitted — should not fail when SourceID is set
+		ManifestFile: "manifest.yaml",
+	}
+	err := p.Validate(nil)
+	require.NoError(t, err)
+}
+
+func TestKubernetesGitDeploymentPayloadValidate_WithoutSourceID_URLRequired(t *testing.T) {
+	t.Parallel()
+
+	p := kubernetesGitDeploymentPayload{
+		ManifestFile: "manifest.yaml",
+		// SourceID and RepositoryURL both omitted
+	}
+	err := p.Validate(nil)
+	require.Error(t, err)
+}
+
+func TestCreateStackPayloadFromK8sGitPayload_WithSourceID(t *testing.T) {
+	t.Parallel()
+
+	p := createStackPayloadFromK8sGitPayload(
+		"k8s-stack",
+		"",
+		"",
+		"",
+		"",
+		false,
+		false,
+		"default",
+		"manifest.yaml",
+		nil,
+		nil,
+		false,
+		portainer.SourceID(7),
+	)
+
+	require.Equal(t, portainer.SourceID(7), p.SourceID)
+	require.Equal(t, "manifest.yaml", p.ManifestFile)
+}
diff --git a/api/http/handler/stacks/create_swarm_stack.go b/api/http/handler/stacks/create_swarm_stack.go
new file mode 100644
index 0000000..127e637
--- /dev/null
+++ b/api/http/handler/stacks/create_swarm_stack.go
@@ -0,0 +1,362 @@
+package stacks
+
+import (
+	"fmt"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices/source"
+	"github.com/portainer/portainer/api/git/update"
+	"github.com/portainer/portainer/api/gitops/sources"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/stacks/stackbuilders"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	valid "github.com/portainer/portainer/pkg/validate"
+
+	"github.com/pkg/errors"
+)
+
+type swarmStackFromFileContentPayload struct {
+	// Name of the stack
+	Name string `example:"myStack" validate:"required"`
+	// Swarm cluster identifier
+	SwarmID string `example:"jpofkc0i9uo9wtx1zesuk649w" validate:"required"`
+	// Content of the Stack file
+	StackFileContent string `example:"version: 3\n services:\n web:\n image:nginx" validate:"required"`
+	// A list of environment variables used during stack deployment
+	Env []portainer.Pair
+	// Whether the stack is from a app template
+	FromAppTemplate bool `example:"false"`
+}
+
+func (payload *swarmStackFromFileContentPayload) Validate(r *http.Request) error {
+	if len(payload.Name) == 0 {
+		return errors.New("Invalid stack name")
+	}
+	if len(payload.SwarmID) == 0 {
+		return errors.New("Invalid Swarm ID")
+	}
+	if len(payload.StackFileContent) == 0 {
+		return errors.New("Invalid stack file content")
+	}
+	return nil
+}
+
+func createStackPayloadFromSwarmFileContentPayload(name string, swarmID string, fileContent string, env []portainer.Pair, fromAppTemplate bool) stackbuilders.StackPayload {
+	return stackbuilders.StackPayload{
+		Name:             name,
+		SwarmID:          swarmID,
+		StackFileContent: []byte(fileContent),
+		Env:              env,
+		FromAppTemplate:  fromAppTemplate,
+	}
+}
+
+// @id StackCreateDockerSwarmString
+// @summary Deploy a new swarm stack from a text
+// @description Deploy a new stack into a Docker environment specified via the environment identifier.
+// @description **Access policy**: authenticated
+// @tags stacks
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @produce json
+// @param body body swarmStackFromFileContentPayload true "stack config"
+// @param endpointId query int true "Identifier of the environment that will be used to deploy the stack"
+// @success 200 {object} portainer.Stack
+// @failure 400 "Invalid request"
+// @failure 500 "Server error"
+// @router /stacks/create/swarm/string [post]
+func (handler *Handler) createSwarmStackFromFileContent(w http.ResponseWriter, r *http.Request, endpoint *portainer.Endpoint, userID portainer.UserID) *httperror.HandlerError {
+	var payload swarmStackFromFileContentPayload
+	err := request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	payload.Name = handler.SwarmStackManager.NormalizeStackName(payload.Name)
+
+	isUnique, err := handler.checkUniqueStackNameInDocker(endpoint, payload.Name, 0, true)
+	if err != nil {
+		return httperror.InternalServerError("Unable to check for name collision", err)
+	}
+	if !isUnique {
+		return stackExistsError(payload.Name)
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	stackPayload := createStackPayloadFromSwarmFileContentPayload(payload.Name, payload.SwarmID, payload.StackFileContent, payload.Env, payload.FromAppTemplate)
+
+	swarmStackBuilder := stackbuilders.CreateSwarmStackFileBuilder(securityContext,
+		handler.DataStore,
+		handler.FileService,
+		handler.StackDeployer)
+
+	stack, httpErr := stackbuilders.Build(r.Context(), handler.DataStore, swarmStackBuilder, &stackPayload, endpoint, userID)
+	if httpErr != nil {
+		return httpErr
+	}
+
+	return handler.decorateStackResponse(w, stack, userID)
+}
+
+type swarmStackFromGitRepositoryPayload struct {
+	// Name of the stack
+	Name string `example:"myStack" validate:"required"`
+	// Swarm cluster identifier
+	SwarmID string `example:"jpofkc0i9uo9wtx1zesuk649w" validate:"required"`
+	// A list of environment variables used during stack deployment
+	Env []portainer.Pair
+
+	// SourceID references an existing Source for git credentials/URL.
+	// When set, the inline URL and authentication fields are ignored.
+	SourceID portainer.SourceID `example:"1"`
+	// Deprecated: use SourceID instead. URL of a Git repository hosting the Stack file.
+	RepositoryURL string `example:"https://github.com/openfaas/faas"`
+	// Reference name of a Git repository hosting the Stack file
+	RepositoryReferenceName string `example:"refs/heads/master"`
+	// Deprecated: use SourceID instead. Use basic authentication to clone the Git repository.
+	RepositoryAuthentication bool `example:"true"`
+	// Deprecated: use SourceID instead. Username used in basic authentication.
+	RepositoryUsername string `example:"myGitUsername"`
+	// Deprecated: use SourceID instead. Password used in basic authentication.
+	RepositoryPassword string `example:"myGitPassword"`
+	// Whether the stack is from a app template
+	FromAppTemplate bool `example:"false"`
+	// Path to the Stack file inside the Git repository
+	ComposeFile string `example:"docker-compose.yml" default:"docker-compose.yml"`
+	// Applicable when deploying with multiple stack files
+	AdditionalFiles []string `example:"[nz.compose.yml, uat.compose.yml]"`
+	// Optional GitOps update configuration
+	AutoUpdate *portainer.AutoUpdateSettings
+	// Deprecated: use SourceID instead. TLSSkipVerify skips SSL verification when cloning the Git repository.
+	TLSSkipVerify bool `example:"false"`
+}
+
+func (payload *swarmStackFromGitRepositoryPayload) Validate(r *http.Request) error {
+	if len(payload.Name) == 0 {
+		return errors.New("Invalid stack name")
+	}
+	if len(payload.SwarmID) == 0 {
+		return errors.New("Invalid Swarm ID")
+	}
+
+	if payload.SourceID == 0 {
+		if len(payload.RepositoryURL) == 0 || !valid.IsURL(payload.RepositoryURL) {
+			return errors.New("Invalid repository URL. Must correspond to a valid URL format")
+		}
+		if payload.RepositoryAuthentication && len(payload.RepositoryPassword) == 0 {
+			return errors.New("Invalid repository credentials. Password must be specified when authentication is enabled")
+		}
+	}
+
+	return update.ValidateAutoUpdateSettings(payload.AutoUpdate)
+}
+
+func createStackPayloadFromSwarmGitPayload(name, swarmID, repoUrl, repoReference, repoUsername, repoPassword string, repoAuthentication bool, composeFile string, additionalFiles []string, autoUpdate *portainer.AutoUpdateSettings, env []portainer.Pair, fromAppTemplate bool, repoSkipSSLVerify bool, sourceID portainer.SourceID) stackbuilders.StackPayload {
+	return stackbuilders.StackPayload{
+		Name:    name,
+		SwarmID: swarmID,
+		RepositoryConfigPayload: stackbuilders.RepositoryConfigPayload{
+			SourceID:       sourceID,
+			URL:            repoUrl,
+			ReferenceName:  repoReference,
+			Authentication: repoAuthentication,
+			Username:       repoUsername,
+			Password:       repoPassword,
+			TLSSkipVerify:  repoSkipSSLVerify,
+		},
+		ComposeFile:     composeFile,
+		AdditionalFiles: additionalFiles,
+		AutoUpdate:      autoUpdate,
+		Env:             env,
+		FromAppTemplate: fromAppTemplate,
+	}
+}
+
+// @id StackCreateDockerSwarmRepository
+// @summary Deploy a new swarm stack from a git repository
+// @description Deploy a new stack into a Docker environment specified via the environment identifier.
+// @description **Access policy**: authenticated
+// @tags stacks
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @accept json
+// @param endpointId query int true "Identifier of the environment that will be used to deploy the stack"
+// @param body body swarmStackFromGitRepositoryPayload true "stack config"
+// @success 200 {object} portainer.Stack
+// @failure 400 "Invalid request"
+// @failure 409 "Stack name or webhook ID already exists"
+// @failure 500 "Server error"
+// @router /stacks/create/swarm/repository [post]
+func (handler *Handler) createSwarmStackFromGitRepository(w http.ResponseWriter, r *http.Request, endpoint *portainer.Endpoint, userID portainer.UserID) *httperror.HandlerError {
+	var payload swarmStackFromGitRepositoryPayload
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	payload.Name = handler.SwarmStackManager.NormalizeStackName(payload.Name)
+
+	if isUnique, err := handler.checkUniqueStackNameInDocker(endpoint, payload.Name, 0, true); err != nil {
+		return httperror.InternalServerError("Unable to check for name collision", err)
+	} else if !isUnique {
+		return stackExistsError(payload.Name)
+	}
+
+	//make sure the webhook ID is unique
+	if payload.AutoUpdate != nil && payload.AutoUpdate.Webhook != "" {
+		if isUnique, err := handler.checkUniqueWebhookID(handler.DataStore, payload.AutoUpdate.Webhook); err != nil {
+			return httperror.InternalServerError("Unable to check for webhook ID collision", err)
+		} else if !isUnique {
+			return httperror.Conflict(fmt.Sprintf("Webhook ID: %s already exists", payload.AutoUpdate.Webhook), stackutils.ErrWebhookIDAlreadyExists)
+		}
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve user info from request context", err)
+	}
+	userContext := source.NewUserContext(securityContext.User, securityContext.UserMemberships)
+	if payload.SourceID != 0 {
+		if _, httpErr := sources.ValidateGitSourceAccess(handler.DataStore, userContext, payload.SourceID); httpErr != nil {
+			return httpErr
+		}
+	}
+
+	stackPayload := createStackPayloadFromSwarmGitPayload(payload.Name,
+		payload.SwarmID,
+		payload.RepositoryURL,
+		payload.RepositoryReferenceName,
+		payload.RepositoryUsername,
+		payload.RepositoryPassword,
+		payload.RepositoryAuthentication,
+		payload.ComposeFile,
+		payload.AdditionalFiles,
+		payload.AutoUpdate,
+		payload.Env,
+		payload.FromAppTemplate,
+		payload.TLSSkipVerify,
+		payload.SourceID,
+	)
+
+	swarmStackBuilder := stackbuilders.CreateSwarmStackGitBuilder(securityContext,
+		handler.DataStore,
+		handler.FileService,
+		handler.GitService,
+		handler.Scheduler,
+		handler.StackDeployer)
+
+	stack, httpErr := stackbuilders.Build(r.Context(), handler.DataStore, swarmStackBuilder, &stackPayload, endpoint, userID)
+	if httpErr != nil {
+		return httpErr
+	}
+
+	return handler.decorateStackResponse(w, stack, userID)
+}
+
+type swarmStackFromFileUploadPayload struct {
+	Name             string
+	SwarmID          string
+	StackFileContent []byte
+	Env              []portainer.Pair
+}
+
+func createStackPayloadFromSwarmFileUploadPayload(name, swarmID string, fileContentBytes []byte, env []portainer.Pair) stackbuilders.StackPayload {
+	return stackbuilders.StackPayload{
+		Name:             name,
+		SwarmID:          swarmID,
+		StackFileContent: fileContentBytes,
+		Env:              env,
+	}
+}
+
+func (payload *swarmStackFromFileUploadPayload) Validate(r *http.Request) error {
+	name, err := request.RetrieveMultiPartFormValue(r, "Name", false)
+	if err != nil {
+		return errors.New("Invalid stack name")
+	}
+	payload.Name = name
+
+	swarmID, err := request.RetrieveMultiPartFormValue(r, "SwarmID", false)
+	if err != nil {
+		return errors.New("Invalid Swarm ID")
+	}
+	payload.SwarmID = swarmID
+
+	composeFileContent, _, err := request.RetrieveMultiPartFormFile(r, "file")
+	if err != nil {
+		return errors.New("Invalid Compose file. Ensure that the Compose file is uploaded correctly")
+	}
+	payload.StackFileContent = composeFileContent
+
+	var env []portainer.Pair
+	err = request.RetrieveMultiPartFormJSONValue(r, "Env", &env, true)
+	if err != nil {
+		return errors.New("Invalid Env parameter")
+	}
+	payload.Env = env
+	return nil
+}
+
+// @id StackCreateDockerSwarmFile
+// @summary Deploy a new swarm stack from a file
+// @description Deploy a new stack into a Docker environment specified via the environment identifier.
+// @description **Access policy**: authenticated
+// @tags stacks
+// @security ApiKeyAuth
+// @security jwt
+// @accept multipart/form-data
+// @produce json
+// @param Name formData string false "Name of the stack"
+// @param SwarmID formData string false "Swarm cluster identifier."
+// @param Env formData string false "Environment variables passed during deployment, represented as a JSON array [{'name': 'name', 'value': 'value'}]. Optional"
+// @param file formData file false "Stack file"
+// @param endpointId query int true "Identifier of the environment that will be used to deploy the stack"
+// @success 200 {object} portainer.Stack
+// @failure 400 "Invalid request"
+// @failure 500 "Server error"
+// @router /stacks/create/swarm/file [post]
+func (handler *Handler) createSwarmStackFromFileUpload(w http.ResponseWriter, r *http.Request, endpoint *portainer.Endpoint, userID portainer.UserID) *httperror.HandlerError {
+	var payload swarmStackFromFileUploadPayload
+	err := payload.Validate(r)
+	if err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	payload.Name = handler.SwarmStackManager.NormalizeStackName(payload.Name)
+
+	isUnique, err := handler.checkUniqueStackNameInDocker(endpoint, payload.Name, 0, true)
+
+	if err != nil {
+		return httperror.InternalServerError("Unable to check for name collision", err)
+	}
+	if !isUnique {
+		return stackExistsError(payload.Name)
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	stackPayload := createStackPayloadFromSwarmFileUploadPayload(payload.Name, payload.SwarmID, payload.StackFileContent, payload.Env)
+
+	swarmStackBuilder := stackbuilders.CreateSwarmStackFileBuilder(securityContext,
+		handler.DataStore,
+		handler.FileService,
+		handler.StackDeployer)
+
+	stack, httpErr := stackbuilders.Build(r.Context(), handler.DataStore, swarmStackBuilder, &stackPayload, endpoint, userID)
+	if httpErr != nil {
+		return httpErr
+	}
+
+	return handler.decorateStackResponse(w, stack, userID)
+}
diff --git a/api/http/handler/stacks/create_swarm_stack_test.go b/api/http/handler/stacks/create_swarm_stack_test.go
new file mode 100644
index 0000000..7efb832
--- /dev/null
+++ b/api/http/handler/stacks/create_swarm_stack_test.go
@@ -0,0 +1,31 @@
+package stacks
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestSwarmGitPayload_ValidateWithSourceID_URLNotRequired(t *testing.T) {
+	t.Parallel()
+	payload := &swarmStackFromGitRepositoryPayload{
+		Name:     "myswarm",
+		SwarmID:  "swarm-abc",
+		SourceID: portainer.SourceID(1),
+	}
+
+	err := payload.Validate(nil)
+	assert.NoError(t, err)
+}
+
+func TestSwarmGitPayload_ValidateWithoutSourceID_URLRequired(t *testing.T) {
+	t.Parallel()
+	payload := &swarmStackFromGitRepositoryPayload{
+		Name:    "myswarm",
+		SwarmID: "swarm-abc",
+	}
+
+	err := payload.Validate(nil)
+	assert.Error(t, err)
+}
diff --git a/api/http/handler/stacks/deploy_gate.go b/api/http/handler/stacks/deploy_gate.go
new file mode 100644
index 0000000..88c1f16
--- /dev/null
+++ b/api/http/handler/stacks/deploy_gate.go
@@ -0,0 +1,30 @@
+package stacks
+
+type deployGate struct {
+	start chan struct{}
+	abort chan struct{}
+}
+
+func newDeployGate() *deployGate {
+	return &deployGate{
+		start: make(chan struct{}),
+		abort: make(chan struct{}),
+	}
+}
+
+func (gate deployGate) wait() bool {
+	select {
+	case <-gate.start:
+		return true
+	case <-gate.abort:
+		return false
+	}
+}
+
+func (gate deployGate) startDeploy() {
+	close(gate.start)
+}
+
+func (gate deployGate) abortDeploy() {
+	close(gate.abort)
+}
diff --git a/api/http/handler/stacks/handler.go b/api/http/handler/stacks/handler.go
new file mode 100644
index 0000000..352f640
--- /dev/null
+++ b/api/http/handler/stacks/handler.go
@@ -0,0 +1,216 @@
+package stacks
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"strings"
+	"sync"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	dockerclient "github.com/portainer/portainer/api/docker/client"
+	"github.com/portainer/portainer/api/docker/consts"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+	"github.com/portainer/portainer/api/kubernetes/cli"
+	"github.com/portainer/portainer/api/logs"
+	"github.com/portainer/portainer/api/scheduler"
+	"github.com/portainer/portainer/api/stacks/deployments"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+
+	"github.com/docker/docker/api/types"
+	"github.com/docker/docker/api/types/container"
+	"github.com/gorilla/mux"
+	"github.com/pkg/errors"
+)
+
+// Handler is the HTTP handler used to handle stack operations.
+type Handler struct {
+	stackCreationMutex *sync.Mutex
+	stackDeletionMutex *sync.Mutex
+	requestBouncer     security.BouncerService
+	*mux.Router
+	DataStore               dataservices.DataStore
+	DockerClientFactory     *dockerclient.ClientFactory
+	FileService             portainer.FileService
+	GitService              portainer.GitService
+	SwarmStackManager       portainer.SwarmStackManager
+	ComposeStackManager     portainer.ComposeStackManager
+	KubernetesDeployer      portainer.KubernetesDeployer
+	KubernetesClientFactory *cli.ClientFactory
+	Scheduler               *scheduler.Scheduler
+	StackDeployer           deployments.StackDeployer
+}
+
+func stackExistsError(name string) *httperror.HandlerError {
+	msg := fmt.Sprintf("A stack with the normalized name '%s' already exists", name)
+	err := errors.New(msg)
+	return httperror.Conflict(msg, err)
+}
+
+// NewHandler creates a handler to manage stack operations.
+func NewHandler(bouncer security.BouncerService) *Handler {
+	h := &Handler{
+		Router:             mux.NewRouter(),
+		stackCreationMutex: &sync.Mutex{},
+		stackDeletionMutex: &sync.Mutex{},
+		requestBouncer:     bouncer,
+	}
+
+	h.Handle("/stacks/create/{type}/{method}",
+		bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.stackCreate))).Methods(http.MethodPost)
+	h.Handle("/stacks",
+		bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.stackList))).Methods(http.MethodGet)
+	h.Handle("/stacks/{id}",
+		bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.stackInspect))).Methods(http.MethodGet)
+	h.Handle("/stacks/{id}",
+		bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.stackDelete))).Methods(http.MethodDelete)
+	h.Handle("/stacks/{id}/associate",
+		bouncer.AdminAccess(httperror.LoggerHandler(h.stackAssociate))).Methods(http.MethodPut)
+	h.Handle("/stacks/name/{name}",
+		bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.stackDeleteKubernetesByName))).Methods(http.MethodDelete)
+	h.Handle("/stacks/{id}",
+		bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.stackUpdate))).Methods(http.MethodPut)
+	h.Handle("/stacks/{id}/git",
+		bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.stackUpdateGit))).Methods(http.MethodPost)
+	h.Handle("/stacks/{id}/git/redeploy",
+		bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.stackGitRedeploy))).Methods(http.MethodPut)
+	h.Handle("/stacks/{id}/file",
+		bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.stackFile))).Methods(http.MethodGet)
+	h.Handle("/stacks/{id}/migrate",
+		bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.stackMigrate))).Methods(http.MethodPost)
+	h.Handle("/stacks/{id}/start",
+		bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.stackStart))).Methods(http.MethodPost)
+	h.Handle("/stacks/{id}/stop",
+		bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.stackStop))).Methods(http.MethodPost)
+	h.Handle("/stacks/webhooks/{webhookID}",
+		bouncer.PublicAccess(httperror.LoggerHandler(h.webhookInvoke))).Methods(http.MethodPost)
+
+	return h
+}
+
+func (handler *Handler) userCanAccessStack(securityContext *security.RestrictedRequestContext, resourceControl *portainer.ResourceControl) (bool, error) {
+	user, err := handler.DataStore.User().Read(securityContext.UserID)
+	if err != nil {
+		return false, err
+	}
+
+	userTeamIDs := authorization.TeamIDs(securityContext.UserMemberships)
+
+	if resourceControl != nil && authorization.UserCanAccessResource(securityContext.UserID, userTeamIDs, resourceControl) {
+		return true, nil
+	}
+
+	return stackutils.UserIsAdminOrEndpointAdmin(user), nil
+}
+
+func (handler *Handler) userIsAdmin(userID portainer.UserID) (bool, error) {
+	user, err := handler.DataStore.User().Read(userID)
+	if err != nil {
+		return false, err
+	}
+
+	isAdmin := user.Role == portainer.AdministratorRole
+
+	return isAdmin, nil
+}
+
+func (handler *Handler) userCanCreateStack(securityContext *security.RestrictedRequestContext) (bool, error) {
+	user, err := handler.DataStore.User().Read(securityContext.UserID)
+	if err != nil {
+		return false, err
+	}
+
+	return stackutils.UserIsAdminOrEndpointAdmin(user), nil
+}
+
+// if stack management is disabled for non admins and the user isn't an admin, then return false. Otherwise return true
+func (handler *Handler) userCanManageStacks(securityContext *security.RestrictedRequestContext, endpoint *portainer.Endpoint) (bool, error) {
+	// When the endpoint is deleted, stacks that the deleted endpoint created will be tagged as an orphan stack
+	// An orphan stack can be adopted by admins
+	if endpoint == nil {
+		return true, nil
+	}
+
+	if endpointutils.IsDockerEndpoint(endpoint) && !endpoint.SecuritySettings.AllowStackManagementForRegularUsers {
+		canCreate, err := handler.userCanCreateStack(securityContext)
+
+		if err != nil {
+			return false, fmt.Errorf("failed to get user from the database: %w", err)
+		}
+
+		return canCreate, nil
+	}
+	return true, nil
+}
+
+func (handler *Handler) checkUniqueStackName(endpoint *portainer.Endpoint, name string, stackID portainer.StackID) (bool, error) {
+	stacks, err := handler.DataStore.Stack().ReadAll()
+	if err != nil {
+		return false, err
+	}
+
+	for _, stack := range stacks {
+		if strings.EqualFold(stack.Name, name) && (stackID == 0 || stackID != stack.ID) && stack.EndpointID == endpoint.ID {
+			return false, nil
+		}
+	}
+
+	return true, nil
+}
+
+func (handler *Handler) checkUniqueStackNameInDocker(endpoint *portainer.Endpoint, name string, stackID portainer.StackID, swarmMode bool) (bool, error) {
+	isUniqueStackName, err := handler.checkUniqueStackName(endpoint, name, stackID)
+	if err != nil {
+		return false, err
+	}
+
+	if handler.DockerClientFactory == nil {
+		return isUniqueStackName, nil
+	}
+
+	dockerClient, err := handler.DockerClientFactory.CreateClient(endpoint, "", nil)
+	if err != nil {
+		return false, err
+	}
+	defer logs.CloseAndLogErr(dockerClient)
+	if swarmMode {
+		services, err := dockerClient.ServiceList(context.Background(), types.ServiceListOptions{})
+		if err != nil {
+			return false, err
+		}
+
+		for _, service := range services {
+			serviceNS, ok := service.Spec.Labels["com.docker.stack.namespace"]
+			if ok && serviceNS == name {
+				return false, nil
+			}
+		}
+	}
+
+	containers, err := dockerClient.ContainerList(context.Background(), container.ListOptions{All: true})
+	if err != nil {
+		return false, err
+	}
+
+	for _, container := range containers {
+		containerNS, ok := container.Labels[consts.ComposeStackNameLabel]
+
+		if ok && containerNS == name {
+			return false, nil
+		}
+	}
+
+	return isUniqueStackName, nil
+}
+
+func (handler *Handler) checkUniqueWebhookID(tx dataservices.DataStoreTx, webhookID string) (bool, error) {
+	_, err := tx.Stack().StackByWebhookID(webhookID)
+	if tx.IsErrObjectNotFound(err) {
+		return true, nil
+	}
+	return false, err
+}
diff --git a/api/http/handler/stacks/response.go b/api/http/handler/stacks/response.go
new file mode 100644
index 0000000..d1de852
--- /dev/null
+++ b/api/http/handler/stacks/response.go
@@ -0,0 +1,85 @@
+package stacks
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/dataservices/source"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	"github.com/portainer/portainer/api/gitops/workflows"
+	"github.com/portainer/portainer/api/http/security"
+)
+
+// stackResponse extends a Stack response with the git source identifier.
+type stackResponse struct {
+	portainer.Stack
+	GitSourceId portainer.SourceID `json:"GitSourceId,omitempty"`
+}
+
+// loadGitConfigForStack reads the merged GitConfig (Source URL/auth/TLS + Artifact ref/path/hash)
+// and the SourceID for the given stack.
+func loadGitConfigForStack(tx dataservices.DataStoreTx, userContext source.UserContext, workflowID portainer.WorkflowID, stackID portainer.StackID) (*gittypes.RepoConfig, portainer.SourceID, error) {
+	src, file, err := workflows.GitSourceAndArtifactForStack(tx, userContext, workflowID, stackID)
+	if err != nil || src == nil {
+		return nil, 0, err
+	}
+
+	return workflows.MergeSourceAndFile(src, file), src.ID, nil
+}
+
+// saveStackGitConfig persists the stack's git settings. When newSourceID is non-zero the stack's
+// artifact is repointed to that existing Source (selected by the caller) without modifying any
+// Source's git config; otherwise the target Source is derived from cfg.URL.
+func saveStackGitConfig(tx dataservices.DataStoreTx, userContext source.UserContext, workflowID portainer.WorkflowID, stackID portainer.StackID, oldSourceID, newSourceID portainer.SourceID, cfg *gittypes.RepoConfig) error {
+	matchArtifact := func(a portainer.Artifact) bool {
+		return a.StackID == stackID
+	}
+
+	if newSourceID != 0 {
+		return workflows.SaveWorkflowArtifact(tx, workflowID, matchArtifact, oldSourceID, portainer.ArtifactFile{
+			SourceID: newSourceID,
+			Ref:      cfg.ReferenceName,
+			Path:     cfg.ConfigFilePath,
+			Hash:     cfg.ConfigHash,
+		})
+	}
+
+	return workflows.SaveWorkflowGitConfig(tx, userContext, workflowID, matchArtifact, oldSourceID, cfg)
+}
+
+func persistSourceSyncError(tx dataservices.DataStoreTx, securityContext *security.RestrictedRequestContext, sourceID portainer.SourceID, syncErr error) error {
+	userContext := source.NewUserContext(securityContext.User, securityContext.UserMemberships)
+
+	return workflows.SaveSourceStatus(tx, userContext, sourceID, syncErr)
+}
+
+// newStackResponse fills stack.GitConfig and returns a response that also includes GitSourceId.
+func newStackResponse(tx dataservices.DataStoreTx, userContext source.UserContext, stack *portainer.Stack) (*stackResponse, error) {
+	if stack.WorkflowID == 0 {
+		return &stackResponse{Stack: *stack}, nil
+	}
+
+	gitConfig, gitSourceID, err := loadGitConfigForStack(tx, userContext, stack.WorkflowID, stack.ID)
+	if err != nil {
+		return nil, err
+	}
+
+	stack.GitConfig = gittypes.SanitizeRepoConfig(gitConfig)
+
+	return &stackResponse{Stack: *stack, GitSourceId: gitSourceID}, nil
+}
+
+// fillStackGitConfig populates stack.GitConfig from the merged Source+Artifact for backwards-compatible responses.
+func fillStackGitConfig(tx dataservices.DataStoreTx, userContext source.UserContext, stack *portainer.Stack) error {
+	if stack.WorkflowID == 0 {
+		return nil
+	}
+
+	gitConfig, _, err := loadGitConfigForStack(tx, userContext, stack.WorkflowID, stack.ID)
+	if err != nil {
+		return err
+	}
+
+	stack.GitConfig = gittypes.SanitizeRepoConfig(gitConfig)
+
+	return nil
+}
diff --git a/api/http/handler/stacks/stack_associate.go b/api/http/handler/stacks/stack_associate.go
new file mode 100644
index 0000000..c9f7393
--- /dev/null
+++ b/api/http/handler/stacks/stack_associate.go
@@ -0,0 +1,134 @@
+package stacks
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/dataservices/source"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id StackAssociate
+// @summary Associate an orphaned stack to a new environment(endpoint)
+// @description **Access policy**: administrator
+// @tags stacks
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param id path int true "Stack identifier"
+// @param endpointId query int true "Environment identifier"
+// @param swarmId query int true "Swarm identifier"
+// @param orphanedRunning query boolean true "Indicates whether the stack is orphaned"
+// @success 200 {object} portainer.Stack "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied"
+// @failure 404 "Stack not found"
+// @failure 500 "Server error"
+// @router /stacks/{id}/associate [put]
+func (handler *Handler) stackAssociate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	stackID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid stack identifier route variable", err)
+	}
+
+	endpointID, err := request.RetrieveNumericQueryParameter(r, "endpointId", false)
+	if err != nil {
+		return httperror.BadRequest("Invalid query parameter: endpointId", err)
+	}
+
+	swarmId, err := request.RetrieveQueryParameter(r, "swarmId", true)
+	if err != nil {
+		return httperror.BadRequest("Invalid query parameter: swarmId", err)
+	}
+
+	orphanedRunning, err := request.RetrieveBooleanQueryParameter(r, "orphanedRunning", false)
+	if err != nil {
+		return httperror.BadRequest("Invalid query parameter: orphanedRunning", err)
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	user, err := handler.DataStore.User().Read(securityContext.UserID)
+	if err != nil {
+		return httperror.InternalServerError("Unable to load user information from the database", err)
+	}
+
+	stack, err := handler.DataStore.Stack().Read(portainer.StackID(stackID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find a stack with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find a stack with the specified identifier inside the database", err)
+	}
+
+	resourceControl, err := handler.DataStore.ResourceControl().ResourceControlByResourceIDAndType(stackutils.ResourceControlID(stack.EndpointID, stack.Name), portainer.StackResourceControl)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve a resource control associated to the stack", err)
+	}
+
+	if resourceControl != nil {
+		resourceControl.ResourceID = fmt.Sprintf("%d_%s", endpointID, stack.Name)
+
+		err = handler.DataStore.ResourceControl().Update(resourceControl.ID, resourceControl)
+		if err != nil {
+			return httperror.InternalServerError("Unable to persist resource control changes inside the database", err)
+		}
+	}
+
+	endpoint, err := handler.DataStore.Endpoint().Endpoint(portainer.EndpointID(endpointID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find an environment with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find an environment with the specified identifier inside the database", err)
+	}
+
+	canManage, err := handler.userCanManageStacks(securityContext, endpoint)
+	if err != nil {
+		return httperror.InternalServerError("Unable to verify user authorizations to validate stack deletion", err)
+	}
+	if !canManage {
+		errMsg := "Stack management is disabled for non-admin users"
+		return httperror.Forbidden(errMsg, errors.New(errMsg))
+	}
+
+	stack.EndpointID = portainer.EndpointID(endpointID)
+	stack.SwarmID = swarmId
+
+	if orphanedRunning {
+		stack.Status = portainer.StackStatusActive
+	} else {
+		stack.Status = portainer.StackStatusInactive
+	}
+
+	stack.CreationDate = time.Now().Unix()
+	stack.CreatedBy = user.Username
+	stack.UpdateDate = 0
+	stack.UpdatedBy = ""
+
+	err = handler.DataStore.Stack().Update(stack.ID, stack)
+	if err != nil {
+		return httperror.InternalServerError("Unable to persist the stack changes inside the database", err)
+	}
+
+	stack.ResourceControl = resourceControl
+
+	err = handler.DataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
+		userContext := source.NewUserContext(securityContext.User, securityContext.UserMemberships)
+		if err := fillStackGitConfig(tx, userContext, stack); err != nil {
+			return httperror.InternalServerError("Unable to load git config for stack", err)
+		}
+		return nil
+	})
+
+	return response.TxResponse(w, stack, err)
+}
diff --git a/api/http/handler/stacks/stack_create.go b/api/http/handler/stacks/stack_create.go
new file mode 100644
index 0000000..fdc9e45
--- /dev/null
+++ b/api/http/handler/stacks/stack_create.go
@@ -0,0 +1,156 @@
+package stacks
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/dataservices/source"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+
+	"github.com/pkg/errors"
+)
+
+func (handler *Handler) stackCreate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	stackType, err := request.RetrieveRouteVariableValue(r, "type")
+	if err != nil {
+		return httperror.BadRequest("Invalid path parameter: type", err)
+	}
+
+	method, err := request.RetrieveRouteVariableValue(r, "method")
+	if err != nil {
+		return httperror.BadRequest("Invalid path parameter: method", err)
+	}
+
+	endpointID, err := request.RetrieveNumericQueryParameter(r, "endpointId", false)
+	if err != nil {
+		return httperror.BadRequest("Invalid query parameter: endpointId", err)
+	}
+
+	endpoint, err := handler.DataStore.Endpoint().Endpoint(portainer.EndpointID(endpointID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find an environment with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find an environment with the specified identifier inside the database", err)
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve user info from request context", err)
+	}
+
+	canManage, err := handler.userCanManageStacks(securityContext, endpoint)
+	if err != nil {
+		return httperror.InternalServerError("Unable to verify user authorizations to validate stack deletion", err)
+	}
+	if !canManage {
+		errMsg := "Stack creation is disabled for non-admin users"
+		return httperror.Forbidden(errMsg, errors.New(errMsg))
+	}
+
+	err = handler.requestBouncer.AuthorizedEndpointOperation(r, endpoint)
+	if err != nil {
+		return httperror.Forbidden("Permission denied to access environment", err)
+	}
+
+	tokenData, err := security.RetrieveTokenData(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve user details from authentication token", err)
+	}
+
+	switch stackType {
+	case "swarm":
+		return handler.createSwarmStack(w, r, method, endpoint, tokenData.ID)
+	case "standalone":
+		return handler.createComposeStack(w, r, method, endpoint, tokenData.ID)
+	case "kubernetes":
+		return handler.createKubernetesStack(w, r, method, endpoint, tokenData.ID)
+	}
+
+	return httperror.BadRequest("Invalid value for query parameter: type. Value must be one of: 1 (Swarm stack) or 2 (Compose stack)", errors.New(request.ErrInvalidQueryParameter))
+}
+
+func (handler *Handler) createComposeStack(w http.ResponseWriter, r *http.Request, method string, endpoint *portainer.Endpoint, userID portainer.UserID) *httperror.HandlerError {
+	switch method {
+	case "string":
+		return handler.createComposeStackFromFileContent(w, r, endpoint, userID)
+	case "repository":
+		return handler.createComposeStackFromGitRepository(w, r, endpoint, userID)
+	case "file":
+		return handler.createComposeStackFromFileUpload(w, r, endpoint, userID)
+	}
+
+	return httperror.BadRequest("Invalid value for query parameter: method. Value must be one of: string, repository or file", errors.New(request.ErrInvalidQueryParameter))
+}
+
+func (handler *Handler) createSwarmStack(w http.ResponseWriter, r *http.Request, method string, endpoint *portainer.Endpoint, userID portainer.UserID) *httperror.HandlerError {
+	switch method {
+	case "string":
+		return handler.createSwarmStackFromFileContent(w, r, endpoint, userID)
+	case "repository":
+		return handler.createSwarmStackFromGitRepository(w, r, endpoint, userID)
+	case "file":
+		return handler.createSwarmStackFromFileUpload(w, r, endpoint, userID)
+	}
+
+	return httperror.BadRequest("Invalid value for query parameter: method. Value must be one of: string, repository or file", errors.New(request.ErrInvalidQueryParameter))
+}
+
+func (handler *Handler) createKubernetesStack(w http.ResponseWriter, r *http.Request, method string, endpoint *portainer.Endpoint, userID portainer.UserID) *httperror.HandlerError {
+	switch method {
+	case "string":
+		return handler.createKubernetesStackFromFileContent(w, r, endpoint, userID)
+	case "repository":
+		return handler.createKubernetesStackFromGitRepository(w, r, endpoint, userID)
+	case "url":
+		return handler.createKubernetesStackFromManifestURL(w, r, endpoint, userID)
+	}
+
+	return httperror.BadRequest("Invalid value for query parameter: method. Value must be one of: string or repository", errors.New(request.ErrInvalidQueryParameter))
+}
+
+func (handler *Handler) decorateStackResponse(w http.ResponseWriter, stack *portainer.Stack, userID portainer.UserID) *httperror.HandlerError {
+	var resourceControl *portainer.ResourceControl
+
+	isAdmin, err := handler.userIsAdmin(userID)
+	if err != nil {
+		return httperror.InternalServerError("Unable to load user information from the database", err)
+	}
+
+	if isAdmin {
+		resourceControl = authorization.NewAdministratorsOnlyResourceControl(stackutils.ResourceControlID(stack.EndpointID, stack.Name), portainer.StackResourceControl)
+	} else {
+		resourceControl = authorization.NewPrivateResourceControl(stackutils.ResourceControlID(stack.EndpointID, stack.Name), portainer.StackResourceControl, userID)
+	}
+
+	err = handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		err = tx.ResourceControl().Create(resourceControl)
+		if err != nil {
+			return httperror.InternalServerError("Unable to persist resource control inside the database", err)
+		}
+		stack.ResourceControl = resourceControl
+
+		user, err := tx.User().Read(userID)
+		if err != nil {
+			return httperror.InternalServerError("Unable to read user", err)
+		}
+
+		userMemberships, err := tx.TeamMembership().TeamMembershipsByUserID(userID)
+		if err != nil {
+			return httperror.InternalServerError("Unable to read user's team memberships", err)
+		}
+
+		userContext := source.NewUserContext(user, userMemberships)
+		if err := fillStackGitConfig(tx, userContext, stack); err != nil {
+			return httperror.InternalServerError("Unable to load git config for stack", err)
+		}
+		return nil
+	})
+
+	return response.TxResponse(w, stack, err)
+}
diff --git a/api/http/handler/stacks/stack_delete.go b/api/http/handler/stacks/stack_delete.go
new file mode 100644
index 0000000..9af95d1
--- /dev/null
+++ b/api/http/handler/stacks/stack_delete.go
@@ -0,0 +1,371 @@
+package stacks
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"strconv"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/filesystem"
+	httperrors "github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/stacks/deployments"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+
+	"github.com/rs/zerolog/log"
+)
+
+// @id StackDelete
+// @summary Remove a stack
+// @description Remove a stack.
+// @description **Access policy**: restricted
+// @tags stacks
+// @security ApiKeyAuth
+// @security jwt
+// @param id path int true "Stack identifier"
+// @param external query boolean false "Set to true to delete an external stack. Only external Swarm stacks are supported"
+// @param endpointId query int true "Environment identifier"
+// @success 204 "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied"
+// @failure 404 "Not found"
+// @failure 500 "Server error"
+// @router /stacks/{id} [delete]
+func (handler *Handler) stackDelete(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	stackID, err := request.RetrieveRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid stack identifier route variable", err)
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	externalStack, _ := request.RetrieveBooleanQueryParameter(r, "external", true)
+	if externalStack {
+		return handler.deleteExternalStack(r, w, stackID, securityContext)
+	}
+
+	id, err := strconv.Atoi(stackID)
+	if err != nil {
+		return httperror.BadRequest("Invalid stack identifier route variable", err)
+	}
+
+	stack, err := handler.DataStore.Stack().Read(portainer.StackID(id))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find a stack with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find a stack with the specified identifier inside the database", err)
+	}
+
+	endpointID, err := request.RetrieveNumericQueryParameter(r, "endpointId", true)
+	if err != nil {
+		return httperror.BadRequest("Invalid query parameter: endpointId", err)
+	}
+
+	isOrphaned := portainer.EndpointID(endpointID) != stack.EndpointID
+
+	if isOrphaned && !securityContext.IsAdmin {
+		return httperror.Forbidden("Permission denied to remove orphaned stack", errors.New("Permission denied to remove orphaned stack"))
+	}
+
+	endpoint, err := handler.DataStore.Endpoint().Endpoint(portainer.EndpointID(endpointID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find the endpoint associated to the stack inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find the endpoint associated to the stack inside the database", err)
+	}
+
+	resourceControl, err := handler.DataStore.ResourceControl().ResourceControlByResourceIDAndType(stackutils.ResourceControlID(stack.EndpointID, stack.Name), portainer.StackResourceControl)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve a resource control associated to the stack", err)
+	}
+
+	if !isOrphaned {
+		if err := handler.requestBouncer.AuthorizedEndpointOperation(r, endpoint); err != nil {
+			return httperror.Forbidden("Permission denied to access endpoint", err)
+		}
+
+		if stack.Type == portainer.DockerSwarmStack || stack.Type == portainer.DockerComposeStack {
+			access, err := handler.userCanAccessStack(securityContext, resourceControl)
+			if err != nil {
+				return httperror.InternalServerError("Unable to verify user authorizations to validate stack access", err)
+			}
+			if !access {
+				return httperror.Forbidden("Access denied to resource", httperrors.ErrResourceAccessDenied)
+			}
+		}
+	}
+
+	canManage, err := handler.userCanManageStacks(securityContext, endpoint)
+	if err != nil {
+		return httperror.InternalServerError("Unable to verify user authorizations to validate stack deletion", err)
+	}
+	if !canManage {
+		errMsg := "stack deletion is disabled for non-admin users"
+		return httperror.Forbidden(errMsg, errors.New(errMsg))
+	}
+
+	// stop scheduler updates of the stack before removal
+	if stack.AutoUpdate != nil {
+		deployments.StopAutoupdate(stack.ID, stack.AutoUpdate.JobID, handler.Scheduler)
+	}
+
+	if err := handler.deleteStack(r.Context(), securityContext.UserID, stack, endpoint); err != nil {
+		return httperror.InternalServerError(err.Error(), err)
+	}
+
+	if err := handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		if stack.WorkflowID != 0 {
+			if err := tx.Workflow().Delete(stack.WorkflowID); err != nil {
+				return err
+			}
+		}
+		return tx.Stack().Delete(portainer.StackID(id))
+	}); err != nil {
+		return httperror.InternalServerError("Unable to remove the stack from the database", err)
+	}
+
+	if resourceControl != nil {
+		if err := handler.DataStore.ResourceControl().Delete(resourceControl.ID); err != nil {
+			return httperror.InternalServerError("Unable to remove the associated resource control from the database", err)
+		}
+	}
+
+	if err := handler.FileService.RemoveDirectory(stack.ProjectPath); err != nil {
+		log.Warn().Err(err).Msg("Unable to remove stack files from disk")
+	}
+
+	return response.Empty(w)
+}
+
+func (handler *Handler) deleteExternalStack(r *http.Request, w http.ResponseWriter, stackName string, securityContext *security.RestrictedRequestContext) *httperror.HandlerError {
+	endpointID, err := request.RetrieveNumericQueryParameter(r, "endpointId", false)
+	if err != nil {
+		return httperror.BadRequest("Invalid query parameter: endpointId", err)
+	}
+
+	if !securityContext.IsAdmin {
+		return httperror.Unauthorized("Permission denied to delete the stack", httperrors.ErrUnauthorized)
+	}
+
+	stack, err := handler.DataStore.Stack().StackByName(stackName)
+	if err != nil && !handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.InternalServerError("Unable to check for stack existence inside the database", err)
+	}
+	if stack != nil {
+		return httperror.BadRequest("A stack with this name exists inside the database. Cannot use external delete method", errors.New("A tag already exists with this name"))
+	}
+
+	endpoint, err := handler.DataStore.Endpoint().Endpoint(portainer.EndpointID(endpointID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find the endpoint associated to the stack inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find the endpoint associated to the stack inside the database", err)
+	}
+
+	if err := handler.requestBouncer.AuthorizedEndpointOperation(r, endpoint); err != nil {
+		return httperror.Forbidden("Permission denied to access endpoint", err)
+	}
+
+	stack = &portainer.Stack{
+		Name: stackName,
+		Type: portainer.DockerSwarmStack,
+	}
+
+	if err := handler.deleteStack(context.TODO(), securityContext.UserID, stack, endpoint); err != nil {
+		return httperror.InternalServerError("Unable to delete stack", err)
+	}
+
+	return response.Empty(w)
+}
+
+func (handler *Handler) deleteStack(ctx context.Context, userID portainer.UserID, stack *portainer.Stack, endpoint *portainer.Endpoint) error {
+	if stack.Type == portainer.DockerSwarmStack {
+		stack.Name = handler.SwarmStackManager.NormalizeStackName(stack.Name)
+
+		if stackutils.IsRelativePathStack(stack) {
+			return handler.StackDeployer.UndeployRemoteSwarmStack(ctx, userID, stack, endpoint)
+		}
+
+		return handler.SwarmStackManager.Remove(ctx, stack, endpoint)
+	}
+
+	if stack.Type == portainer.DockerComposeStack {
+		stack.Name = handler.ComposeStackManager.NormalizeStackName(stack.Name)
+
+		if stackutils.IsRelativePathStack(stack) {
+			return handler.StackDeployer.UndeployRemoteComposeStack(ctx, userID, stack, endpoint)
+		}
+
+		return handler.StackDeployer.UndeployComposeStack(ctx, stack, endpoint)
+	}
+
+	if stack.Type == portainer.KubernetesStack {
+		manifestFiles := stackutils.GetStackFilePaths(stack, true)
+
+		out, err := handler.KubernetesDeployer.Remove(ctx, userID, endpoint, manifestFiles, stack.Namespace)
+		if err != nil {
+			for _, manifest := range manifestFiles {
+				if exists, fileExistsErr := filesystem.FileExists(manifest); fileExistsErr != nil || !exists {
+					// If removal has failed and one of the manifest files is missing,
+					// we can consider this stack as removed
+					log.Warn().Err(fileExistsErr).Msgf("failed to find manifest %s, but stack deletion will continue", manifest)
+					return nil
+				}
+			}
+			return fmt.Errorf("failed to remove kubernetes resources: %q. Error: %w", out, err)
+		}
+		return nil
+	}
+
+	return fmt.Errorf("unsupported stack type: %v", stack.Type)
+}
+
+// @id StackDeleteKubernetesByName
+// @summary Remove Kubernetes stacks by name
+// @description Remove a stack.
+// @description **Access policy**: restricted
+// @tags stacks
+// @security ApiKeyAuth
+// @security jwt
+// @param name path string true "Stack name"
+// @param external query boolean false "Set to true to delete an external stack. Only external Swarm stacks are supported"
+// @param endpointId query int true "Environment identifier"
+// @success 204 "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied"
+// @failure 404 "Not found"
+// @failure 500 "Server error"
+// @router /stacks/name/{name} [delete]
+func (handler *Handler) stackDeleteKubernetesByName(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	stackName, err := request.RetrieveRouteVariableValue(r, "name")
+	if err != nil {
+		return httperror.BadRequest("Invalid stack identifier route variable", err)
+	}
+
+	log.Debug().Msgf("Trying to delete Kubernetes stack %q", stackName)
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	endpointID, err := request.RetrieveNumericQueryParameter(r, "endpointId", true)
+	if err != nil {
+		return httperror.BadRequest("Invalid query parameter: endpointId", err)
+	}
+
+	namespace, err := request.RetrieveQueryParameter(r, "namespace", false)
+	if err != nil {
+		return httperror.BadRequest("Invalid query parameter: namespace", err)
+	}
+
+	stacks, err := handler.DataStore.Stack().StacksByName(stackName)
+	if err != nil && !handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.InternalServerError("Unable to check for stack existence inside the database", err)
+	}
+	if stacks == nil {
+		return httperror.InternalServerError("Unable to find a stacks with the specified identifier name the database", err)
+	}
+
+	endpoint, err := handler.DataStore.Endpoint().Endpoint(portainer.EndpointID(endpointID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find the endpoint associated to the stack inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find the endpoint associated to the stack inside the database", err)
+	}
+
+	log.Debug().Msgf("Trying to delete Kubernetes stack %q for endpoint `%d`", stackName, endpointID)
+
+	// check authorizations on all the stacks one by one
+	stacksToDelete := make([]portainer.Stack, 0)
+	for _, stack := range stacks {
+		// only delete stacks for the specified namespace
+		if stack.Namespace != namespace {
+			continue
+		}
+
+		isOrphaned := portainer.EndpointID(endpointID) != stack.EndpointID
+		if stack.Type != portainer.KubernetesStack {
+			return httperror.BadRequest("Only Kubernetes stacks can be deleted by name", errors.New("Only Kubernetes stacks can be deleted by name"))
+		}
+
+		if isOrphaned && !securityContext.IsAdmin {
+			return httperror.Forbidden("Permission denied to remove orphaned stack", errors.New("Permission denied to remove orphaned stack"))
+		}
+
+		if !isOrphaned {
+			err = handler.requestBouncer.AuthorizedEndpointOperation(r, endpoint)
+			if err != nil {
+				return httperror.Forbidden("Permission denied to access endpoint", err)
+			}
+		}
+
+		canManage, err := handler.userCanManageStacks(securityContext, endpoint)
+		if err != nil {
+			return httperror.InternalServerError("Unable to verify user authorizations to validate stack deletion", err)
+		}
+		if !canManage {
+			errMsg := "stack deletion is disabled for non-admin users"
+			return httperror.Forbidden(errMsg, errors.New(errMsg))
+		}
+
+		stacksToDelete = append(stacksToDelete, stack)
+	}
+
+	log.Debug().Msgf("Trying to delete Kubernetes stacks `%v` for endpoint `%d`", stacksToDelete, endpointID)
+
+	var errs error
+	// Delete all the stacks one by one
+	for _, stack := range stacksToDelete {
+		log.Debug().Msgf("Trying to delete Kubernetes stack id `%d`", stack.ID)
+
+		// stop scheduler updates of the stack before removal
+		if stack.AutoUpdate != nil {
+			deployments.StopAutoupdate(stack.ID, stack.AutoUpdate.JobID, handler.Scheduler)
+		}
+
+		err = handler.deleteStack(context.TODO(), securityContext.UserID, &stack, endpoint)
+		if err != nil {
+			log.Err(err).Msgf("Unable to delete Kubernetes stack `%d`", stack.ID)
+			errs = errors.Join(errs, err)
+
+			continue
+		}
+
+		if err := handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+			if stack.WorkflowID != 0 {
+				if err := tx.Workflow().Delete(stack.WorkflowID); err != nil {
+					return err
+				}
+			}
+			return tx.Stack().Delete(stack.ID)
+		}); err != nil {
+			errs = errors.Join(errs, err)
+			log.Err(err).Int("stack_id", int(stack.ID)).Msg("unable to remove the stack from the database")
+
+			continue
+		}
+
+		if err := handler.FileService.RemoveDirectory(stack.ProjectPath); err != nil {
+			errs = errors.Join(errs, err)
+			log.Warn().Err(err).Msg("Unable to remove stack files from disk")
+		}
+
+		log.Debug().Msgf("Kubernetes stack `%d` deleted", stack.ID)
+	}
+
+	if errs != nil {
+		return httperror.InternalServerError("Unable to delete some Kubernetes stack(s). Check Portainer logs for more details", nil)
+	}
+
+	return response.Empty(w)
+}
diff --git a/api/http/handler/stacks/stack_file.go b/api/http/handler/stacks/stack_file.go
new file mode 100644
index 0000000..4c59481
--- /dev/null
+++ b/api/http/handler/stacks/stack_file.go
@@ -0,0 +1,136 @@
+package stacks
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/dataservices/source"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	httperrors "github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+
+	"github.com/pkg/errors"
+)
+
+type stackFileResponse struct {
+	// Content of the Stack file
+	StackFileContent string `json:"StackFileContent" example:"version: 3\n services:\n web:\n image:nginx"`
+}
+
+// @id StackFileInspect
+// @summary Retrieve the content of the Stack file for the specified stack
+// @description Get Stack file content.
+// @description **Access policy**: restricted
+// @tags stacks
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param id path int true "Stack identifier"
+// @success 200 {object} stackFileResponse "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied"
+// @failure 404 "Stack not found"
+// @failure 409 "Git settings changed, redeploy required"
+// @failure 500 "Server error"
+// @router /stacks/{id}/file [get]
+func (handler *Handler) stackFile(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	stackID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid stack identifier route variable", err)
+	}
+
+	stack, err := handler.DataStore.Stack().Read(portainer.StackID(stackID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find a stack with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find a stack with the specified identifier inside the database", err)
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	endpoint, err := handler.DataStore.Endpoint().Endpoint(stack.EndpointID)
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		if !securityContext.IsAdmin {
+			return httperror.NotFound("Unable to find an environment with the specified identifier inside the database", err)
+		}
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find an environment with the specified identifier inside the database", err)
+	}
+
+	canManage, err := handler.userCanManageStacks(securityContext, endpoint)
+	if err != nil {
+		return httperror.InternalServerError("Unable to verify user authorizations to validate stack deletion", err)
+	}
+	if !canManage {
+		errMsg := "Stack management is disabled for non-admin users"
+		return httperror.Forbidden(errMsg, errors.New(errMsg))
+	}
+
+	if endpoint != nil {
+		err = handler.requestBouncer.AuthorizedEndpointOperation(r, endpoint)
+		if err != nil {
+			return httperror.Forbidden("Permission denied to access environment", err)
+		}
+
+		if stack.Type == portainer.DockerSwarmStack || stack.Type == portainer.DockerComposeStack {
+			resourceControl, err := handler.DataStore.ResourceControl().ResourceControlByResourceIDAndType(stackutils.ResourceControlID(stack.EndpointID, stack.Name), portainer.StackResourceControl)
+			if err != nil {
+				return httperror.InternalServerError("Unable to retrieve a resource control associated to the stack", err)
+			}
+
+			access, err := handler.userCanAccessStack(securityContext, resourceControl)
+			if err != nil {
+				return httperror.InternalServerError("Unable to verify user authorizations to validate stack access", err)
+			}
+			if !access {
+				return httperror.Forbidden("Access denied to resource", httperrors.ErrResourceAccessDenied)
+			}
+		}
+	}
+
+	var gitConfig *gittypes.RepoConfig
+	if stack.WorkflowID != 0 {
+		if err := handler.DataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
+			var err error
+			userContext := source.NewUserContext(securityContext.User, securityContext.UserMemberships)
+			gitConfig, _, err = loadGitConfigForStack(tx, userContext, stack.WorkflowID, stack.ID)
+			if err != nil {
+				return httperror.InternalServerError("Unable to load git config for stack", err)
+			}
+			return nil
+		}); err != nil {
+			return response.TxErrorResponse(err)
+		}
+	}
+
+	if gitStackPendingRedeploy(stack, gitConfig) {
+		return httperror.Conflict("Stack git settings have changed. Redeploy the stack to apply the new configuration.", errors.New("git settings updated without redeploy"))
+	}
+
+	stackFileContent, err := handler.FileService.GetFileContent(stack.ProjectPath, stack.EntryPoint)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve Compose file from disk", err)
+	}
+
+	return response.JSON(w, &stackFileResponse{StackFileContent: string(stackFileContent)})
+}
+
+// gitStackPendingRedeploy returns true when the stack's git settings (URL or config file path)
+// have been updated via "save settings" but the stack has not yet been redeployed to apply them.
+// In that state the local clone is stale and the stack file cannot be read from disk.
+func gitStackPendingRedeploy(stack *portainer.Stack, gitConfig *gittypes.RepoConfig) bool {
+	if gitConfig == nil || stack.CurrentDeploymentInfo == nil {
+		return false
+	}
+
+	return gitConfig.URL != stack.CurrentDeploymentInfo.RepositoryURL ||
+		gitConfig.ConfigFilePath != stack.CurrentDeploymentInfo.ConfigFilePath
+}
diff --git a/api/http/handler/stacks/stack_file_test.go b/api/http/handler/stacks/stack_file_test.go
new file mode 100644
index 0000000..f1b7817
--- /dev/null
+++ b/api/http/handler/stacks/stack_file_test.go
@@ -0,0 +1,133 @@
+package stacks
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"strconv"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices/source"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/filesystem"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+
+	"encoding/json"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestStackFile_GitPendingRedeploy_Returns409(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	_, err := mockCreateUser(store)
+	require.NoError(t, err)
+
+	endpoint, err := mockCreateEndpoint(store)
+	require.NoError(t, err)
+
+	tempDir := t.TempDir()
+	fileService, err := filesystem.NewService(tempDir, "")
+	require.NoError(t, err)
+
+	handler := NewHandler(testhelpers.NewTestRequestBouncer())
+	handler.FileService = fileService
+	handler.DataStore = store
+
+	const stackID = portainer.StackID(1)
+
+	src := &portainer.Source{
+		Type: portainer.SourceTypeGit,
+		Git: &gittypes.GitSource{
+			URL: "https://github.com/portainer/portainer.git",
+		},
+	}
+	require.NoError(t, store.Source().Create(source.InsecureNewAdminContext(), src))
+
+	wf := &portainer.Workflow{Artifacts: []portainer.Artifact{{
+		StackID: stackID,
+		Files:   []portainer.ArtifactFile{{SourceID: src.ID}},
+	}}}
+	require.NoError(t, store.Workflow().Create(wf))
+
+	stack := &portainer.Stack{
+		ID:         stackID,
+		EndpointID: endpoint.ID,
+		Type:       portainer.DockerComposeStack,
+		WorkflowID: wf.ID,
+		CurrentDeploymentInfo: &portainer.StackDeploymentInfo{
+			RepositoryURL:  "https://github.com/portainer/old-repo.git",
+			ConfigFilePath: "docker-compose.yml",
+		},
+	}
+	require.NoError(t, store.Stack().Create(stack))
+
+	req := mockCreateStackRequestWithSecurityContext(
+		http.MethodGet,
+		"/stacks/"+strconv.Itoa(int(stack.ID))+"/file",
+		nil,
+	)
+	rr := httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+
+	require.Equal(t, http.StatusConflict, rr.Code)
+}
+
+func TestStackFile_MatchingGitSettings_ReturnsFileContent(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	_, err := mockCreateUser(store)
+	require.NoError(t, err)
+
+	endpoint, err := mockCreateEndpoint(store)
+	require.NoError(t, err)
+
+	tempDir := t.TempDir()
+	fileService, err := filesystem.NewService(tempDir, "")
+	require.NoError(t, err)
+
+	handler := NewHandler(testhelpers.NewTestRequestBouncer())
+	handler.FileService = fileService
+	handler.DataStore = store
+
+	const repoURL = "https://github.com/portainer/portainer.git"
+	const configPath = "docker-compose.yml"
+	const fileContent = "version: '3'\nservices:\n  web:\n    image: nginx\n"
+
+	require.NoError(t, os.WriteFile(filesystem.JoinPaths(tempDir, configPath), []byte(fileContent), 0o644))
+
+	stack := &portainer.Stack{
+		ID:          2,
+		EndpointID:  endpoint.ID,
+		Type:        portainer.DockerComposeStack,
+		ProjectPath: tempDir,
+		EntryPoint:  configPath,
+		CurrentDeploymentInfo: &portainer.StackDeploymentInfo{
+			RepositoryURL:  repoURL,
+			ConfigFilePath: configPath,
+		},
+		GitConfig: &gittypes.RepoConfig{
+			URL:            repoURL,
+			ConfigFilePath: configPath,
+		},
+	}
+	require.NoError(t, store.Stack().Create(stack))
+
+	req := mockCreateStackRequestWithSecurityContext(
+		http.MethodGet,
+		"/stacks/"+strconv.Itoa(int(stack.ID))+"/file",
+		nil,
+	)
+	rr := httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+
+	require.Equal(t, http.StatusOK, rr.Code)
+
+	var resp stackFileResponse
+	require.NoError(t, json.Unmarshal(rr.Body.Bytes(), &resp))
+	require.Equal(t, fileContent, resp.StackFileContent)
+}
diff --git a/api/http/handler/stacks/stack_inspect.go b/api/http/handler/stacks/stack_inspect.go
new file mode 100644
index 0000000..4217d3e
--- /dev/null
+++ b/api/http/handler/stacks/stack_inspect.go
@@ -0,0 +1,102 @@
+package stacks
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices/source"
+	httperrors "github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+
+	"github.com/pkg/errors"
+)
+
+// @id StackInspect
+// @summary Inspect a stack
+// @description Retrieve details about a stack.
+// @description **Access policy**: restricted
+// @tags stacks
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param id path int true "Stack identifier"
+// @success 200 {object} stackResponse "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied"
+// @failure 404 "Stack not found"
+// @failure 500 "Server error"
+// @router /stacks/{id} [get]
+func (handler *Handler) stackInspect(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	stackID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid stack identifier route variable", err)
+	}
+
+	stack, err := handler.DataStore.Stack().Read(portainer.StackID(stackID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find a stack with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find a stack with the specified identifier inside the database", err)
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	endpoint, err := handler.DataStore.Endpoint().Endpoint(stack.EndpointID)
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		if !securityContext.IsAdmin {
+			return httperror.NotFound("Unable to find an environment with the specified identifier inside the database", err)
+		}
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find an environment with the specified identifier inside the database", err)
+	}
+
+	canManage, err := handler.userCanManageStacks(securityContext, endpoint)
+	if err != nil {
+		return httperror.InternalServerError("Unable to verify user authorizations to validate stack deletion", err)
+	}
+	if !canManage {
+		errMsg := "Stack management is disabled for non-admin users"
+		return httperror.Forbidden(errMsg, errors.New(errMsg))
+	}
+
+	if endpoint != nil {
+		err = handler.requestBouncer.AuthorizedEndpointOperation(r, endpoint)
+		if err != nil {
+			return httperror.Forbidden("Permission denied to access environment", err)
+		}
+
+		if stack.Type == portainer.DockerSwarmStack || stack.Type == portainer.DockerComposeStack {
+			resourceControl, err := handler.DataStore.ResourceControl().ResourceControlByResourceIDAndType(stackutils.ResourceControlID(stack.EndpointID, stack.Name), portainer.StackResourceControl)
+			if err != nil {
+				return httperror.InternalServerError("Unable to retrieve a resource control associated to the stack", err)
+			}
+
+			access, err := handler.userCanAccessStack(securityContext, resourceControl)
+			if err != nil {
+				return httperror.InternalServerError("Unable to verify user authorizations to validate stack access", err)
+			}
+			if !access {
+				return httperror.Forbidden("Access denied to resource", httperrors.ErrResourceAccessDenied)
+			}
+
+			if resourceControl != nil {
+				stack.ResourceControl = resourceControl
+			}
+		}
+	}
+
+	userContext := source.NewUserContext(securityContext.User, securityContext.UserMemberships)
+	resp, err := newStackResponse(handler.DataStore, userContext, stack)
+	if err != nil {
+		return httperror.InternalServerError("Unable to load git config for stack", err)
+	}
+
+	return response.JSON(w, resp)
+}
diff --git a/api/http/handler/stacks/stack_list.go b/api/http/handler/stacks/stack_list.go
new file mode 100644
index 0000000..0b8ecce
--- /dev/null
+++ b/api/http/handler/stacks/stack_list.go
@@ -0,0 +1,160 @@
+package stacks
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/dataservices/source"
+	httperrors "github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/authorization"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type stackListOperationFilters struct {
+	SwarmID               string `json:"SwarmID"`
+	EndpointID            int    `json:"EndpointID"`
+	IncludeOrphanedStacks bool   `json:"IncludeOrphanedStacks"`
+}
+
+// @id StackList
+// @summary List stacks
+// @description List all stacks based on the current user authorizations.
+// @description Will return all stacks if using an administrator account otherwise it
+// @description will only return the list of stacks the user have access to.
+// @description Limited stacks will not be returned by this endpoint.
+// @description **Access policy**: authenticated
+// @tags stacks
+// @security ApiKeyAuth
+// @security jwt
+// @param filters query string false "Filters to process on the stack list. Encoded as JSON (a map[string]string). For example, {'SwarmID': 'jpofkc0i9uo9wtx1zesuk649w'} will only return stacks that are part of the specified Swarm cluster. Available filters: EndpointID, SwarmID."
+// @success 200 {array} portainer.Stack "Success"
+// @success 204 "Success"
+// @failure 400 "Invalid request"
+// @failure 500 "Server error"
+// @router /stacks [get]
+func (handler *Handler) stackList(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	var filters stackListOperationFilters
+	err := request.RetrieveJSONQueryParameter(r, "filters", &filters, true)
+	if err != nil {
+		return httperror.BadRequest("Invalid query parameter: filters", err)
+	}
+
+	endpoints, err := handler.DataStore.Endpoint().Endpoints()
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve environments from database", err)
+	}
+
+	stacks, err := handler.DataStore.Stack().ReadAll()
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve stacks from the database", err)
+	}
+	stacks = filterStacks(stacks, &filters, endpoints)
+
+	resourceControls, err := handler.DataStore.ResourceControl().ReadAll()
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve resource controls from the database", err)
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	stacks = authorization.DecorateStacks(stacks, resourceControls)
+
+	if !securityContext.IsAdmin {
+		if filters.IncludeOrphanedStacks {
+			return httperror.Forbidden("Permission denied to access orphaned stacks", httperrors.ErrUnauthorized)
+		}
+
+		user, err := handler.DataStore.User().Read(securityContext.UserID)
+		if err != nil {
+			return httperror.InternalServerError("Unable to retrieve user information from the database", err)
+		}
+
+		userTeamIDs := authorization.TeamIDs(securityContext.UserMemberships)
+
+		stacks = authorization.FilterAuthorizedStacks(stacks, user.ID, userTeamIDs)
+	}
+
+	err = handler.DataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
+		userContext := source.NewUserContext(securityContext.User, securityContext.UserMemberships)
+		for i := range stacks {
+			if err := fillStackGitConfig(tx, userContext, &stacks[i]); err != nil {
+				return httperror.InternalServerError("Unable to load git config for stack", err)
+			}
+		}
+		return nil
+	})
+
+	return response.TxResponse(w, stacks, err)
+}
+
+// filterStacks refines a collection of Stack instances using specified criteria.
+// This function examines the provided filters: EndpointID, SwarmID, and IncludeOrphanedStacks.
+// - If both EndpointID is zero and SwarmID is an empty string, the function directly returns the original stack list without any modifications.
+// - If either filter is specified, it proceeds to selectively include stacks that match the criteria.
+
+// Key Points on Business Logic:
+// 1. Determining Inclusion of Orphaned Stacks:
+//    - The decision to include orphaned stacks is influenced by the user's role and usually set by the client (UI).
+//    - Administrators or environment administrators can include orphaned stacks by setting IncludeOrphanedStacks to true, reflecting their broader access rights.
+//    - For non-administrative users, this is typically set to false, limiting their visibility to only stacks within their purview.
+
+// 2. Inclusion Criteria for Orphaned Stacks:
+//    - When IncludeOrphanedStacks is true and an EndpointID is specified (not zero), the function selects:
+//      a) Stacks linked to the specified EndpointID.
+//      b) Orphaned stacks that don't have a naming conflict with any stack associated with the EndpointID.
+//    - This approach is designed to avoid name conflicts within Docker Compose, which restricts the creation of multiple stacks with the same name.
+
+// 3. Type Matching for Orphaned Stacks:
+//    - The function ensures that orphaned stacks are compatible with the environment's stack type (compose or swarm).
+//    - It filters out orphaned swarm stacks in Docker standalone environments
+//    - It filters out orphaned standalone stack in Docker swarm environments
+//    - This ensures that re-association respects the constraints of the environment and stack type.
+
+// The outcome is a new list of stacks that align with these filtering and business logic criteria.
+func filterStacks(stacks []portainer.Stack, filters *stackListOperationFilters, endpoints []portainer.Endpoint) []portainer.Stack {
+	if filters.EndpointID == 0 && filters.SwarmID == "" {
+		return stacks
+	}
+
+	filteredStacks := make([]portainer.Stack, 0, len(stacks))
+	uniqueStackNames := make(map[string]struct{})
+	for _, stack := range stacks {
+		if stack.Type == portainer.DockerComposeStack && stack.EndpointID == portainer.EndpointID(filters.EndpointID) {
+			filteredStacks = append(filteredStacks, stack)
+			uniqueStackNames[stack.Name] = struct{}{}
+		}
+		if stack.Type == portainer.DockerSwarmStack && stack.SwarmID == filters.SwarmID {
+			filteredStacks = append(filteredStacks, stack)
+			uniqueStackNames[stack.Name] = struct{}{}
+		}
+	}
+
+	for _, stack := range stacks {
+		if filters.IncludeOrphanedStacks && isOrphanedStack(stack, endpoints) {
+			if (stack.Type == portainer.DockerComposeStack && filters.SwarmID == "") || (stack.Type == portainer.DockerSwarmStack && filters.SwarmID != "") {
+				if _, exists := uniqueStackNames[stack.Name]; !exists {
+					filteredStacks = append(filteredStacks, stack)
+				}
+			}
+		}
+	}
+
+	return filteredStacks
+}
+
+func isOrphanedStack(stack portainer.Stack, endpoints []portainer.Endpoint) bool {
+	for _, endpoint := range endpoints {
+		if stack.EndpointID == endpoint.ID {
+			return false
+		}
+	}
+
+	return true
+}
diff --git a/api/http/handler/stacks/stack_list_test.go b/api/http/handler/stacks/stack_list_test.go
new file mode 100644
index 0000000..86e6a87
--- /dev/null
+++ b/api/http/handler/stacks/stack_list_test.go
@@ -0,0 +1,75 @@
+package stacks
+
+import (
+	"sort"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestFilterStacks(t *testing.T) {
+	t.Parallel()
+	t.Run("filter stacks against particular endpoint and all orphaned stacks", func(t *testing.T) {
+		stacks := []portainer.Stack{
+			{ID: 1, EndpointID: 3, Name: "normal_stack", Type: portainer.DockerComposeStack},
+			{ID: 2, EndpointID: 4, Name: "orphaned_stack", Type: portainer.DockerComposeStack},
+			{ID: 3, EndpointID: 5, Name: "other_stack", Type: portainer.DockerComposeStack},
+		}
+		filters := &stackListOperationFilters{EndpointID: 3, IncludeOrphanedStacks: true}
+		endpoints := []portainer.Endpoint{{ID: 3}, {ID: 5}}
+
+		expectStacks := []portainer.Stack{{ID: 1}, {ID: 2}}
+		actualStacks := filterStacks(stacks, filters, endpoints)
+
+		isEqualStacks(t, expectStacks, actualStacks)
+	})
+
+	t.Run("filter unique stacks against particular endpoint and all orphaned stacks and an orphaned stack has the same name with normal stack", func(t *testing.T) {
+		stacks := []portainer.Stack{
+			{ID: 1, EndpointID: 3, Name: "normal_stack", Type: portainer.DockerComposeStack},
+			{ID: 2, EndpointID: 4, Name: "orphaned_stack", Type: portainer.DockerComposeStack},
+			{ID: 3, EndpointID: 5, Name: "other_stack", Type: portainer.DockerComposeStack},
+			{ID: 4, EndpointID: 4, Name: "normal_stack", Type: portainer.DockerComposeStack},
+		}
+		filters := &stackListOperationFilters{EndpointID: 3, IncludeOrphanedStacks: true}
+		endpoints := []portainer.Endpoint{{ID: 3}, {ID: 5}}
+
+		expectStacks := []portainer.Stack{{ID: 1}, {ID: 2}}
+		actualStacks := filterStacks(stacks, filters, endpoints)
+
+		isEqualStacks(t, expectStacks, actualStacks)
+	})
+
+	t.Run("only filter stacks against particular endpoint and no orphaned stacks", func(t *testing.T) {
+		stacks := []portainer.Stack{
+			{ID: 1, EndpointID: 3, Name: "normal_stack", Type: portainer.DockerComposeStack},
+			{ID: 2, EndpointID: 4, Name: "orphaned_stack", Type: portainer.DockerComposeStack},
+			{ID: 3, EndpointID: 5, Name: "other_stack", Type: portainer.DockerComposeStack},
+			{ID: 4, EndpointID: 4, Name: "normal_stack", Type: portainer.DockerComposeStack},
+		}
+		filters := &stackListOperationFilters{EndpointID: 3, IncludeOrphanedStacks: false}
+		endpoints := []portainer.Endpoint{{ID: 3}, {ID: 5}}
+
+		expectStacks := []portainer.Stack{{ID: 1}}
+		actualStacks := filterStacks(stacks, filters, endpoints)
+
+		isEqualStacks(t, expectStacks, actualStacks)
+	})
+}
+
+func isEqualStacks(t *testing.T, expectStacks, actualStacks []portainer.Stack) {
+	expectStackIDs := make([]int, len(expectStacks))
+	for i, stack := range expectStacks {
+		expectStackIDs[i] = int(stack.ID)
+	}
+	sort.Ints(expectStackIDs)
+
+	actualStackIDs := make([]int, len(actualStacks))
+	for i, stack := range actualStacks {
+		actualStackIDs[i] = int(stack.ID)
+	}
+	sort.Ints(actualStackIDs)
+
+	assert.Equal(t, expectStackIDs, actualStackIDs)
+}
diff --git a/api/http/handler/stacks/stack_migrate.go b/api/http/handler/stacks/stack_migrate.go
new file mode 100644
index 0000000..cccb24f
--- /dev/null
+++ b/api/http/handler/stacks/stack_migrate.go
@@ -0,0 +1,250 @@
+package stacks
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/dataservices/source"
+	httperrors "github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/stacks/deployments"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type stackMigratePayload struct {
+	// Environment(Endpoint) identifier of the target environment(endpoint) where the stack will be relocated
+	EndpointID int `example:"2" validate:"required"`
+	// Swarm cluster identifier, must match the identifier of the cluster where the stack will be relocated
+	SwarmID string `example:"jpofkc0i9uo9wtx1zesuk649w"`
+	// If provided will rename the migrated stack
+	Name string `example:"new-stack"`
+}
+
+func (payload *stackMigratePayload) Validate(r *http.Request) error {
+	if payload.EndpointID == 0 {
+		return errors.New("Invalid environment identifier. Must be a positive number")
+	}
+	return nil
+}
+
+// @id StackMigrate
+// @summary Migrate a stack to another environment(endpoint)
+// @description  Migrate a stack from an environment(endpoint) to another environment(endpoint). It will re-create the stack inside the target environment(endpoint) before removing the original stack.
+// @description **Access policy**: authenticated
+// @tags stacks
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param id path int true "Stack identifier"
+// @param endpointId query int false "Stacks created before version 1.18.0 might not have an associated environment(endpoint) identifier. Use this optional parameter to set the environment(endpoint) identifier used by the stack."
+// @param body body stackMigratePayload true "Stack migration details"
+// @success 200 {object} portainer.Stack "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied"
+// @failure 404 "Stack not found"
+// @failure 409 "A stack with the same name is already running on the target environment(endpoint)"
+// @failure 500 "Server error"
+// @router /stacks/{id}/migrate [post]
+func (handler *Handler) stackMigrate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	stackID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid stack identifier route variable", err)
+	}
+
+	var payload stackMigratePayload
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	stack, err := handler.DataStore.Stack().Read(portainer.StackID(stackID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find a stack with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find a stack with the specified identifier inside the database", err)
+	}
+
+	if stack.Type == portainer.KubernetesStack {
+		return httperror.BadRequest("Migrating a kubernetes stack is not supported", err)
+	}
+
+	endpoint, err := handler.DataStore.Endpoint().Endpoint(stack.EndpointID)
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find an endpoint with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find an endpoint with the specified identifier inside the database", err)
+	}
+
+	if err := handler.requestBouncer.AuthorizedEndpointOperation(r, endpoint); err != nil {
+		return httperror.Forbidden("Permission denied to access endpoint", err)
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	canManage, err := handler.userCanManageStacks(securityContext, endpoint)
+	if err != nil {
+		return httperror.InternalServerError("Unable to verify user authorizations to validate stack deletion", err)
+	}
+	if !canManage {
+		errMsg := "Stack migration is disabled for non-admin users"
+		return httperror.Forbidden(errMsg, errors.New(errMsg))
+	}
+
+	resourceControl, err := handler.DataStore.ResourceControl().ResourceControlByResourceIDAndType(stackutils.ResourceControlID(stack.EndpointID, stack.Name), portainer.StackResourceControl)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve a resource control associated to the stack", err)
+	}
+
+	access, err := handler.userCanAccessStack(securityContext, resourceControl)
+	if err != nil {
+		return httperror.InternalServerError("Unable to verify user authorizations to validate stack access", err)
+	}
+	if !access {
+		return httperror.Forbidden("Access denied to resource", httperrors.ErrResourceAccessDenied)
+	}
+
+	// TODO: this is a work-around for stacks created with Portainer version >= 1.17.1
+	// The EndpointID property is not available for these stacks, this API environment(endpoint)
+	// can use the optional EndpointID query parameter to associate a valid environment(endpoint) identifier to the stack.
+	endpointID, err := request.RetrieveNumericQueryParameter(r, "endpointId", true)
+	if err != nil {
+		return httperror.BadRequest("Invalid query parameter: endpointId", err)
+	}
+	if endpointID != int(stack.EndpointID) {
+		stack.EndpointID = portainer.EndpointID(endpointID)
+	}
+
+	targetEndpoint, err := handler.DataStore.Endpoint().Endpoint(portainer.EndpointID(payload.EndpointID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find an endpoint with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find an endpoint with the specified identifier inside the database", err)
+	}
+
+	stack.EndpointID = portainer.EndpointID(payload.EndpointID)
+	if payload.SwarmID != "" {
+		stack.SwarmID = payload.SwarmID
+	}
+
+	oldName := stack.Name
+	if payload.Name != "" {
+		stack.Name = payload.Name
+	}
+
+	isUnique, err := handler.checkUniqueStackNameInDocker(targetEndpoint, stack.Name, stack.ID, stack.SwarmID != "")
+	if err != nil {
+		return httperror.InternalServerError("Unable to check for name collision", err)
+	}
+
+	if !isUnique {
+		errorMessage := fmt.Sprintf("A stack with the name '%s' is already running on endpoint '%s'", stack.Name, targetEndpoint.Name)
+		return httperror.Conflict(errorMessage, errors.New(errorMessage))
+	}
+
+	migrationError := handler.migrateStack(r, stack, targetEndpoint)
+	if migrationError != nil {
+		return migrationError
+	}
+
+	newName := stack.Name
+	stack.Name = oldName
+	if err := handler.deleteStack(context.TODO(), securityContext.UserID, stack, endpoint); err != nil {
+		return httperror.InternalServerError(err.Error(), err)
+	}
+
+	stack.Name = newName
+	if err := handler.DataStore.Stack().Update(stack.ID, stack); err != nil {
+		return httperror.InternalServerError("Unable to persist the stack changes inside the database", err)
+	}
+
+	if resourceControl != nil {
+		resourceControl.ResourceID = stackutils.ResourceControlID(stack.EndpointID, stack.Name)
+		err := handler.DataStore.ResourceControl().Update(resourceControl.ID, resourceControl)
+		if err != nil {
+			return httperror.InternalServerError("Unable to persist the resource control changes", err)
+		}
+	}
+
+	err = handler.DataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
+		userContext := source.NewUserContext(securityContext.User, securityContext.UserMemberships)
+
+		if err := fillStackGitConfig(tx, userContext, stack); err != nil {
+			return httperror.InternalServerError("Unable to load git config for stack", err)
+		}
+
+		return nil
+	})
+
+	return response.TxResponse(w, stack, err)
+}
+
+func (handler *Handler) migrateStack(r *http.Request, stack *portainer.Stack, next *portainer.Endpoint) *httperror.HandlerError {
+	if stack.Type == portainer.DockerSwarmStack {
+		return handler.migrateSwarmStack(r, stack, next)
+	}
+	return handler.migrateComposeStack(r, stack, next)
+}
+
+func (handler *Handler) migrateComposeStack(r *http.Request, stack *portainer.Stack, next *portainer.Endpoint) *httperror.HandlerError {
+	// Create compose deployment config
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	composeDeploymentConfig, err := deployments.CreateComposeStackDeploymentConfigTx(handler.DataStore,
+		securityContext,
+		stack,
+		next,
+		handler.FileService,
+		handler.StackDeployer,
+		true,
+		false,
+		false)
+	if err != nil {
+		return httperror.InternalServerError(err.Error(), err)
+	}
+
+	// Deploy the stack
+	if err := composeDeploymentConfig.Deploy(context.TODO()); err != nil {
+		return httperror.InternalServerError(err.Error(), err)
+	}
+
+	return nil
+}
+
+func (handler *Handler) migrateSwarmStack(r *http.Request, stack *portainer.Stack, next *portainer.Endpoint) *httperror.HandlerError {
+	// Create swarm deployment config
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	swarmDeploymentConfig, err := deployments.CreateSwarmStackDeploymentConfigTx(handler.DataStore,
+		securityContext,
+		stack,
+		next,
+		handler.FileService,
+		handler.StackDeployer,
+		true,
+		true)
+	if err != nil {
+		return httperror.InternalServerError(err.Error(), err)
+	}
+
+	// Deploy the stack
+	if err := swarmDeploymentConfig.Deploy(context.TODO()); err != nil {
+		return httperror.InternalServerError(err.Error(), err)
+	}
+
+	return nil
+}
diff --git a/api/http/handler/stacks/stack_start.go b/api/http/handler/stacks/stack_start.go
new file mode 100644
index 0000000..ba26683
--- /dev/null
+++ b/api/http/handler/stacks/stack_start.go
@@ -0,0 +1,215 @@
+package stacks
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/dataservices/source"
+	httperrors "github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/stacks/deployments"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+
+	"github.com/rs/zerolog/log"
+)
+
+// @id StackStart
+// @summary Starts a stopped Stack
+// @description Starts a stopped Stack.
+// @description **Access policy**: authenticated
+// @tags stacks
+// @security ApiKeyAuth
+// @security jwt
+// @param id path int true "Stack identifier"
+// @param endpointId query int true "Environment identifier"
+// @success 200 {object} portainer.Stack "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied"
+// @failure 404 "Not found"
+// @failure 409 "Stack is already active, deploying, or in error state"
+// @failure 500 "Server error"
+// @router /stacks/{id}/start [post]
+func (handler *Handler) stackStart(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	stackID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid stack identifier route variable", err)
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	stack, err := handler.DataStore.Stack().Read(portainer.StackID(stackID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find a stack with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find a stack with the specified identifier inside the database", err)
+	}
+
+	if stack.Type == portainer.KubernetesStack {
+		return httperror.BadRequest("Starting a kubernetes stack is not supported", err)
+	}
+
+	// Check stack status before checking endpoint access to avoid unnecessary database
+	// calls in case of invalid stack status
+	switch stack.Status {
+	case portainer.StackStatusActive:
+		return httperror.Conflict("Unable to start stack", errors.New("Stack is already active"))
+	case portainer.StackStatusDeploying:
+		return httperror.Conflict("Unable to start stack", errors.New("Stack deployment is already in progress"))
+	case portainer.StackStatusError:
+		errMessage := "Stack is in error state"
+		if len(stack.DeploymentStatus) > 0 {
+			lastDeploymentStatus := stack.DeploymentStatus[len(stack.DeploymentStatus)-1]
+			if lastDeploymentStatus.Status == portainer.StackStatusError && lastDeploymentStatus.Message != "" {
+				errMessage = lastDeploymentStatus.Message
+			}
+		}
+
+		return httperror.Conflict("Unable to start stack", errors.New(errMessage))
+	}
+
+	endpointID, err := request.RetrieveNumericQueryParameter(r, "endpointId", false)
+	if err != nil {
+		return httperror.BadRequest("Invalid query parameter: endpointId", err)
+	}
+
+	endpoint, err := handler.DataStore.Endpoint().Endpoint(portainer.EndpointID(endpointID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find an endpoint with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find an endpoint with the specified identifier inside the database", err)
+	}
+
+	err = handler.requestBouncer.AuthorizedEndpointOperation(r, endpoint)
+	if err != nil {
+		return httperror.Forbidden("Permission denied to access endpoint", err)
+	}
+
+	canManage, err := handler.userCanManageStacks(securityContext, endpoint)
+	if err != nil {
+		return httperror.InternalServerError("Unable to verify user authorizations to validate stack deletion", err)
+	}
+	if !canManage {
+		errMsg := "stack management is disabled for non-admin users"
+		return httperror.Forbidden(errMsg, errors.New(errMsg))
+	}
+
+	isUnique, err := handler.checkUniqueStackNameInDocker(endpoint, stack.Name, stack.ID, stack.SwarmID != "")
+	if err != nil {
+		return httperror.InternalServerError("Unable to check for name collision", err)
+	}
+	if !isUnique {
+		errorMessage := fmt.Sprintf("A stack with the name '%s' is already running", stack.Name)
+		return httperror.Conflict(errorMessage, errors.New(errorMessage))
+	}
+
+	resourceControl, err := handler.DataStore.ResourceControl().ResourceControlByResourceIDAndType(stackutils.ResourceControlID(stack.EndpointID, stack.Name), portainer.StackResourceControl)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve a resource control associated to the stack", err)
+	}
+
+	access, err := handler.userCanAccessStack(securityContext, resourceControl)
+	if err != nil {
+		return httperror.InternalServerError("Unable to verify user authorizations to validate stack access", err)
+	}
+	if !access {
+		return httperror.Forbidden("Access denied to resource", httperrors.ErrResourceAccessDenied)
+	}
+
+	if stack.AutoUpdate != nil && stack.AutoUpdate.Interval != "" {
+		deployments.StopAutoupdate(stack.ID, stack.AutoUpdate.JobID, handler.Scheduler)
+
+		jobID, e := deployments.StartAutoupdate(context.TODO(), stack.ID, stack.AutoUpdate.Interval, handler.Scheduler, handler.StackDeployer, handler.DataStore, handler.GitService)
+		if e != nil {
+			return e
+		}
+
+		stack.AutoUpdate.JobID = jobID
+	}
+
+	if err := handler.startStack(context.TODO(), securityContext.UserID, stack, endpoint, securityContext); err != nil {
+		stack.Status = portainer.StackStatusError
+		stack.DeploymentStatus = append(stack.DeploymentStatus, portainer.StackDeploymentStatus{
+			Status:  portainer.StackStatusError,
+			Time:    time.Now().Unix(),
+			Message: err.Error(),
+		})
+		if err := handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+			return tx.Stack().Update(stack.ID, stack)
+		}); err != nil {
+			log.Warn().Err(err).Str("context", "StackStart").Msg("Unable to update stack status after failed start attempt")
+		}
+
+		return httperror.InternalServerError("Unable to start stack", err)
+	}
+
+	stack.Status = portainer.StackStatusActive
+	stack.DeploymentStatus = []portainer.StackDeploymentStatus{
+		{Status: portainer.StackStatusActive, Time: time.Now().Unix()},
+	}
+	err = handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		if err := tx.Stack().Update(stack.ID, stack); err != nil {
+			return httperror.InternalServerError("Unable to update stack status", err)
+		}
+
+		userContext := source.NewUserContext(securityContext.User, securityContext.UserMemberships)
+
+		if err := fillStackGitConfig(tx, userContext, stack); err != nil {
+			return httperror.InternalServerError("Unable to load git config for stack", err)
+		}
+		return nil
+	})
+
+	return response.TxResponse(w, stack, err)
+}
+
+func (handler *Handler) startStack(
+	ctx context.Context,
+	userID portainer.UserID,
+	stack *portainer.Stack,
+	endpoint *portainer.Endpoint,
+	securityContext *security.RestrictedRequestContext,
+) error {
+	user, err := handler.DataStore.User().Read(securityContext.UserID)
+	if err != nil {
+		return fmt.Errorf("unable to load user information from the database: %w", err)
+	}
+
+	registries, err := handler.DataStore.Registry().ReadAll()
+	if err != nil {
+		return fmt.Errorf("unable to retrieve registries from the database: %w", err)
+	}
+
+	filteredRegistries := security.FilterRegistries(registries, user, securityContext.UserMemberships, endpoint.ID)
+
+	switch stack.Type {
+	case portainer.DockerComposeStack:
+		stack.Name = handler.ComposeStackManager.NormalizeStackName(stack.Name)
+
+		if stackutils.IsRelativePathStack(stack) {
+			return handler.StackDeployer.StartRemoteComposeStack(ctx, userID, stack, endpoint, filteredRegistries)
+		}
+
+		return handler.StackDeployer.DeployComposeStack(ctx, stack, endpoint, filteredRegistries, false, false, false)
+	case portainer.DockerSwarmStack:
+		stack.Name = handler.SwarmStackManager.NormalizeStackName(stack.Name)
+
+		if stackutils.IsRelativePathStack(stack) {
+			return handler.StackDeployer.StartRemoteSwarmStack(ctx, userID, stack, endpoint, filteredRegistries)
+		}
+
+		return handler.StackDeployer.DeploySwarmStack(ctx, stack, endpoint, filteredRegistries, true, true)
+	}
+
+	return nil
+}
diff --git a/api/http/handler/stacks/stack_start_test.go b/api/http/handler/stacks/stack_start_test.go
new file mode 100644
index 0000000..ce6cf24
--- /dev/null
+++ b/api/http/handler/stacks/stack_start_test.go
@@ -0,0 +1,140 @@
+package stacks
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"testing"
+
+	"github.com/pkg/errors"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+	"github.com/portainer/portainer/api/stacks/deployments"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// Stubs
+type stubComposeStackManager struct {
+	portainer.ComposeStackManager
+}
+
+func (s *stubComposeStackManager) NormalizeStackName(name string) string { return name }
+
+type stubStackDeployer struct {
+	deployments.StackDeployer
+	deployErr error
+}
+
+func (s *stubStackDeployer) DeployComposeStack(_ context.Context, _ *portainer.Stack, _ *portainer.Endpoint, _ []portainer.Registry, _, _, _ bool) error {
+	return s.deployErr
+}
+
+func stackStartRequest(stackID portainer.StackID, endpointID portainer.EndpointID) *http.Request {
+	url := "/stacks/" + strconv.Itoa(int(stackID)) + "/start?endpointId=" + strconv.Itoa(int(endpointID))
+	return mockCreateStackRequestWithSecurityContext(http.MethodPost, url, nil)
+}
+
+func newStackStartHandler(t *testing.T) (*Handler, *datastore.Store) {
+	t.Helper()
+	_, store := datastore.MustNewTestStore(t, true, false)
+	h := NewHandler(testhelpers.NewTestRequestBouncer())
+	h.DataStore = store
+	return h, store
+}
+
+func TestStackStart_ActiveStack_ReturnsConflict(t *testing.T) {
+	t.Parallel()
+	h, store := newStackStartHandler(t)
+	stack := &portainer.Stack{ID: 1, Status: portainer.StackStatusActive}
+	require.NoError(t, store.Stack().Create(stack))
+
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, stackStartRequest(stack.ID, 1))
+
+	assert.Equal(t, http.StatusConflict, w.Code)
+}
+
+func TestStackStart_DeployingStack_ReturnsConflict(t *testing.T) {
+	t.Parallel()
+	h, store := newStackStartHandler(t)
+	stack := &portainer.Stack{ID: 1, Status: portainer.StackStatusDeploying}
+	require.NoError(t, store.Stack().Create(stack))
+
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, stackStartRequest(stack.ID, 1))
+
+	assert.Equal(t, http.StatusConflict, w.Code)
+}
+
+func TestStackStart_ErrorStack_ReturnsConflict(t *testing.T) {
+	t.Parallel()
+	h, store := newStackStartHandler(t)
+	stack := &portainer.Stack{ID: 1, Status: portainer.StackStatusError}
+	require.NoError(t, store.Stack().Create(stack))
+
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, stackStartRequest(stack.ID, 1))
+
+	assert.Equal(t, http.StatusConflict, w.Code)
+}
+
+func newStartableStack(endpointID portainer.EndpointID) *portainer.Stack {
+	return &portainer.Stack{
+		ID:         1,
+		EndpointID: endpointID,
+		Type:       portainer.DockerComposeStack,
+		Name:       "test-stack",
+	}
+}
+
+func TestStackStart_StartSuccess_StackStatusSetToActive(t *testing.T) {
+	t.Parallel()
+	h, store := newStackStartHandler(t)
+	_, err := mockCreateUser(store)
+	require.NoError(t, err)
+	endpoint, err := mockCreateEndpoint(store)
+	require.NoError(t, err)
+	stack := newStartableStack(endpoint.ID)
+	require.NoError(t, store.Stack().Create(stack))
+	h.ComposeStackManager = &stubComposeStackManager{}
+	h.StackDeployer = &stubStackDeployer{}
+
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, stackStartRequest(stack.ID, endpoint.ID))
+
+	require.Equal(t, http.StatusOK, w.Code)
+	updated, err := store.Stack().Read(stack.ID)
+	require.NoError(t, err)
+	assert.Equal(t, portainer.StackStatusActive, updated.Status)
+	require.Len(t, updated.DeploymentStatus, 1)
+	assert.Equal(t, portainer.StackStatusActive, updated.DeploymentStatus[0].Status)
+}
+
+func TestStackStart_StartFailure_StackStatusSetToError(t *testing.T) {
+	t.Parallel()
+	deployErr := errors.New("failed to pull image nginx:999")
+	h, store := newStackStartHandler(t)
+	_, err := mockCreateUser(store)
+	require.NoError(t, err)
+	endpoint, err := mockCreateEndpoint(store)
+	require.NoError(t, err)
+	stack := newStartableStack(endpoint.ID)
+	require.NoError(t, store.Stack().Create(stack))
+	h.ComposeStackManager = &stubComposeStackManager{}
+	h.StackDeployer = &stubStackDeployer{deployErr: deployErr}
+
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, stackStartRequest(stack.ID, endpoint.ID))
+
+	require.Equal(t, http.StatusInternalServerError, w.Code)
+	updated, err := store.Stack().Read(stack.ID)
+	require.NoError(t, err)
+	assert.Equal(t, portainer.StackStatusError, updated.Status)
+	require.Len(t, updated.DeploymentStatus, 1)
+	lastEntry := updated.DeploymentStatus[0]
+	assert.Equal(t, portainer.StackStatusError, lastEntry.Status)
+	assert.Equal(t, deployErr.Error(), lastEntry.Message)
+}
diff --git a/api/http/handler/stacks/stack_stop.go b/api/http/handler/stacks/stack_stop.go
new file mode 100644
index 0000000..2ef1258
--- /dev/null
+++ b/api/http/handler/stacks/stack_stop.go
@@ -0,0 +1,161 @@
+package stacks
+
+import (
+	"context"
+	"errors"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/dataservices/source"
+	httperrors "github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/stacks/deployments"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/rs/zerolog/log"
+)
+
+// @id StackStop
+// @summary Stop a running Stack
+// @description Stop a running Stack.
+// @description **Access policy**: authenticated
+// @tags stacks
+// @security ApiKeyAuth
+// @security jwt
+// @param id path int true "Stack identifier"
+// @param endpointId query int true "Environment identifier"
+// @success 200 {object} portainer.Stack "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied"
+// @failure 404 "Not found"
+// @failure 409 "Conflict"
+// @failure 500 "Server error"
+// @router /stacks/{id}/stop [post]
+func (handler *Handler) stackStop(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	stackID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid stack identifier route variable", err)
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	stack, err := handler.DataStore.Stack().Read(portainer.StackID(stackID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find a stack with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find a stack with the specified identifier inside the database", err)
+	}
+
+	if stack.Type == portainer.KubernetesStack {
+		return httperror.BadRequest("Stopping a kubernetes stack is not supported", err)
+	}
+
+	endpointID, err := request.RetrieveNumericQueryParameter(r, "endpointId", false)
+	if err != nil {
+		return httperror.BadRequest("Invalid query parameter: endpointId", err)
+	}
+
+	endpoint, err := handler.DataStore.Endpoint().Endpoint(portainer.EndpointID(endpointID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find an environment with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find an environment with the specified identifier inside the database", err)
+	}
+
+	err = handler.requestBouncer.AuthorizedEndpointOperation(r, endpoint)
+	if err != nil {
+		return httperror.Forbidden("Permission denied to access environment", err)
+	}
+
+	resourceControl, err := handler.DataStore.ResourceControl().ResourceControlByResourceIDAndType(stackutils.ResourceControlID(stack.EndpointID, stack.Name), portainer.StackResourceControl)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve a resource control associated to the stack", err)
+	}
+
+	access, err := handler.userCanAccessStack(securityContext, resourceControl)
+	if err != nil {
+		return httperror.InternalServerError("Unable to verify user authorizations to validate stack access", err)
+	}
+	if !access {
+		return httperror.Forbidden("Access denied to resource", httperrors.ErrResourceAccessDenied)
+	}
+
+	canManage, err := handler.userCanManageStacks(securityContext, endpoint)
+	if err != nil {
+		return httperror.InternalServerError("Unable to verify user authorizations to validate stack deletion", err)
+	}
+	if !canManage {
+		errMsg := "stack management is disabled for non-admin users"
+		return httperror.Forbidden(errMsg, errors.New(errMsg))
+	}
+
+	if stack.Status == portainer.StackStatusInactive {
+		return httperror.BadRequest("Stack is already inactive", errors.New("Stack is already inactive"))
+	}
+
+	if stack.Status == portainer.StackStatusDeploying {
+		return httperror.Conflict("Stack deployment is in progress", errors.New("stack deployment is in progress"))
+	}
+
+	// stop scheduler updates of the stack before stopping
+	if stack.AutoUpdate != nil && stack.AutoUpdate.JobID != "" {
+		deployments.StopAutoupdate(stack.ID, stack.AutoUpdate.JobID, handler.Scheduler)
+		stack.AutoUpdate.JobID = ""
+	}
+
+	stopErr := handler.stopStack(r.Context(), securityContext.UserID, stack, endpoint)
+	if stopErr != nil {
+		if err := handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+			stackutils.UpdateStackStatusFromUndeploymentResult(stack, stopErr)
+			return tx.Stack().Update(stack.ID, stack)
+		}); err != nil {
+			log.Warn().Err(err).Str("context", "StackStop").Msg("Unable to update stack status after failed stop attempt")
+		}
+
+		return httperror.InternalServerError("Unable to stop stack", stopErr)
+	}
+
+	err = handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		stackutils.UpdateStackStatusFromUndeploymentResult(stack, nil)
+		if err := tx.Stack().Update(stack.ID, stack); err != nil {
+			return httperror.InternalServerError("Unable to update stack status", err)
+		}
+
+		userContext := source.NewUserContext(securityContext.User, securityContext.UserMemberships)
+		if err := fillStackGitConfig(tx, userContext, stack); err != nil {
+			return httperror.InternalServerError("Unable to load git config for stack", err)
+		}
+		return nil
+	})
+
+	return response.TxResponse(w, stack, err)
+}
+
+func (handler *Handler) stopStack(ctx context.Context, userId portainer.UserID, stack *portainer.Stack, endpoint *portainer.Endpoint) error {
+	switch stack.Type {
+	case portainer.DockerComposeStack:
+		stack.Name = handler.ComposeStackManager.NormalizeStackName(stack.Name)
+
+		if stackutils.IsRelativePathStack(stack) {
+			return handler.StackDeployer.StopRemoteComposeStack(ctx, userId, stack, endpoint)
+		}
+
+		return handler.StackDeployer.UndeployComposeStack(ctx, stack, endpoint)
+	case portainer.DockerSwarmStack:
+		stack.Name = handler.SwarmStackManager.NormalizeStackName(stack.Name)
+
+		if stackutils.IsRelativePathStack(stack) {
+			return handler.StackDeployer.StopRemoteSwarmStack(ctx, userId, stack, endpoint)
+		}
+
+		return handler.SwarmStackManager.Remove(ctx, stack, endpoint)
+	}
+
+	return nil
+}
diff --git a/api/http/handler/stacks/stack_test_helper.go b/api/http/handler/stacks/stack_test_helper.go
new file mode 100644
index 0000000..4dd3315
--- /dev/null
+++ b/api/http/handler/stacks/stack_test_helper.go
@@ -0,0 +1,54 @@
+package stacks
+
+import (
+	"io"
+	"net/http"
+	"net/http/httptest"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/authorization"
+)
+
+func mockCreateUser(store *datastore.Store) (*portainer.User, error) {
+	user := &portainer.User{ID: 1, Username: "testUser", Role: portainer.AdministratorRole, PortainerAuthorizations: authorization.DefaultPortainerAuthorizations()}
+	err := store.User().Create(user)
+	return user, err
+}
+
+func mockCreateEndpoint(store *datastore.Store) (*portainer.Endpoint, error) {
+	endpoint := &portainer.Endpoint{
+		ID:   1,
+		Name: "testEndpoint",
+		SecuritySettings: portainer.EndpointSecuritySettings{
+			AllowBindMountsForRegularUsers:            true,
+			AllowPrivilegedModeForRegularUsers:        true,
+			AllowVolumeBrowserForRegularUsers:         true,
+			AllowHostNamespaceForRegularUsers:         true,
+			AllowDeviceMappingForRegularUsers:         true,
+			AllowStackManagementForRegularUsers:       true,
+			AllowContainerCapabilitiesForRegularUsers: true,
+			AllowSysctlSettingForRegularUsers:         true,
+			EnableHostManagementFeatures:              true,
+		},
+	}
+
+	err := store.Endpoint().Create(endpoint)
+
+	return endpoint, err
+}
+
+func mockCreateStackRequestWithSecurityContext(method, target string, body io.Reader) *http.Request {
+	req := httptest.NewRequest(method,
+		target,
+		body)
+
+	ctx := security.StoreRestrictedRequestContext(req, &security.RestrictedRequestContext{
+		IsAdmin: true,
+		UserID:  portainer.UserID(1),
+		User:    &portainer.User{ID: 1, Role: portainer.AdministratorRole},
+	})
+
+	return req.WithContext(ctx)
+}
diff --git a/api/http/handler/stacks/stack_update.go b/api/http/handler/stacks/stack_update.go
new file mode 100644
index 0000000..f255a30
--- /dev/null
+++ b/api/http/handler/stacks/stack_update.go
@@ -0,0 +1,450 @@
+package stacks
+
+import (
+	"context"
+	"net/http"
+	"strconv"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/dataservices/source"
+	httperrors "github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/stacks/deployments"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+
+	"github.com/pkg/errors"
+	"github.com/rs/zerolog/log"
+)
+
+type postDeployFunc func(ctx context.Context, err error)
+
+type updateComposeStackPayload struct {
+	// New content of the Stack file
+	StackFileContent string `example:"version: 3\n services:\n web:\n image:nginx"`
+	// A list of environment(endpoint) variables used during stack deployment
+	Env []portainer.Pair
+	// RepullImageAndRedeploy indicates whether to force repulling images and redeploying the stack
+	RepullImageAndRedeploy bool
+	// Prune services that are no longer referenced
+	Prune bool `example:"true"`
+
+	// Deprecated(2.36): use RepullImageAndRedeploy instead for cleaner responsibility
+	// Force a pulling to current image with the original tag though the image is already the latest
+	PullImage bool `example:"false"`
+}
+
+func (payload *updateComposeStackPayload) Validate(r *http.Request) error {
+	if len(payload.StackFileContent) == 0 {
+		return errors.New("Invalid stack file content")
+	}
+
+	return nil
+}
+
+type updateSwarmStackPayload struct {
+	// New content of the Stack file
+	StackFileContent string `example:"version: 3\n services:\n web:\n image:nginx"`
+	// A list of environment(endpoint) variables used during stack deployment
+	Env []portainer.Pair
+	// Prune services that are no longer referenced
+	Prune bool `example:"true"`
+	// RepullImageAndRedeploy indicates whether to force repulling images and redeploying the stack
+	RepullImageAndRedeploy bool
+
+	// Deprecated(2.36): use RepullImageAndRedeploy instead for cleaner responsibility
+	// Force a pulling to current image with the original tag though the image is already the latest
+	PullImage bool `example:"false"`
+}
+
+func (payload *updateSwarmStackPayload) Validate(r *http.Request) error {
+	if len(payload.StackFileContent) == 0 {
+		return errors.New("Invalid stack file content")
+	}
+
+	return nil
+}
+
+// @id StackUpdate
+// @summary Update a stack
+// @description Update a stack, only for file based stacks.
+// @description **Access policy**: authenticated
+// @tags stacks
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @produce json
+// @param id path int true "Stack identifier"
+// @param endpointId query int true "Environment identifier"
+// @param body body updateSwarmStackPayload true "Stack details"
+// @success 200 {object} portainer.Stack "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied"
+// @failure 404 "Not found"
+// @failure 409 "Conflict"
+// @failure 500 "Server error"
+// @router /stacks/{id} [put]
+func (handler *Handler) stackUpdate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	stackID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid stack identifier route variable", err)
+	}
+
+	// TODO: this is a work-around for stacks created with Portainer version >= 1.17.1
+	// The EndpointID property is not available for these stacks, this API endpoint
+	// can use the optional EndpointID query parameter to associate a valid environment(endpoint) identifier to the stack.
+	endpointID, err := request.RetrieveNumericQueryParameter(r, "endpointId", false)
+	if err != nil {
+		return httperror.BadRequest("Invalid query parameter: endpointId", err)
+	}
+
+	var stack *portainer.Stack
+	err = handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		var httpErr *httperror.HandlerError
+		stack, httpErr = handler.updateStackInTx(tx, r, portainer.StackID(stackID), portainer.EndpointID(endpointID))
+		if httpErr != nil {
+			return httpErr
+		}
+		return nil
+	})
+	return response.TxResponse(w, stack, err)
+}
+
+func (handler *Handler) updateStackInTx(tx dataservices.DataStoreTx, r *http.Request, stackID portainer.StackID, endpointID portainer.EndpointID) (*portainer.Stack, *httperror.HandlerError) {
+	stack, err := tx.Stack().Read(stackID)
+	if tx.IsErrObjectNotFound(err) {
+		return nil, httperror.NotFound("Unable to find a stack with the specified identifier inside the database", err)
+	} else if err != nil {
+		return nil, httperror.InternalServerError("Unable to find a stack with the specified identifier inside the database", err)
+	}
+
+	if stack.Status == portainer.StackStatusDeploying {
+		return nil, httperror.Conflict("Unable to update stack", errors.New("Stack deployment is already in progress"))
+	}
+
+	if endpointID != 0 && endpointID != stack.EndpointID {
+		stack.EndpointID = endpointID
+	}
+
+	endpoint, err := tx.Endpoint().Endpoint(stack.EndpointID)
+	if tx.IsErrObjectNotFound(err) {
+		return nil, httperror.NotFound("Unable to find the environment associated to the stack inside the database", err)
+	} else if err != nil {
+		return nil, httperror.InternalServerError("Unable to find the environment associated to the stack inside the database", err)
+	}
+
+	if err := handler.requestBouncer.AuthorizedEndpointOperation(r, endpoint); err != nil {
+		return nil, httperror.Forbidden("Permission denied to access environment", err)
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return nil, httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	//only check resource control when it is a DockerSwarmStack or a DockerComposeStack
+	if stack.Type == portainer.DockerSwarmStack || stack.Type == portainer.DockerComposeStack {
+		resourceControl, err := tx.ResourceControl().ResourceControlByResourceIDAndType(stackutils.ResourceControlID(stack.EndpointID, stack.Name), portainer.StackResourceControl)
+		if err != nil {
+			return nil, httperror.InternalServerError("Unable to retrieve a resource control associated to the stack", err)
+		}
+
+		if access, err := handler.userCanAccessStack(securityContext, resourceControl); err != nil {
+			return nil, httperror.InternalServerError("Unable to verify user authorizations to validate stack access", err)
+		} else if !access {
+			return nil, httperror.Forbidden("Access denied to resource", httperrors.ErrResourceAccessDenied)
+		}
+	}
+
+	if canManage, err := handler.userCanManageStacks(securityContext, endpoint); err != nil {
+		return nil, httperror.InternalServerError("Unable to verify user authorizations to validate stack deletion", err)
+	} else if !canManage {
+		errMsg := "Stack editing is disabled for non-admin users"
+
+		return nil, httperror.Forbidden(errMsg, errors.New(errMsg))
+	}
+
+	deployGate := newDeployGate()
+	if err := handler.updateAndDeployStack(tx, r, stack, endpoint, deployGate); err != nil {
+		return nil, err
+	}
+
+	user, err := tx.User().Read(securityContext.UserID)
+	if err != nil {
+		return nil, httperror.BadRequest("Cannot find context user", errors.Wrap(err, "failed to fetch the user"))
+	}
+
+	stack.UpdatedBy = user.Username
+	stack.UpdateDate = time.Now().Unix()
+	stackutils.PrepareStackStatusForDeployment(stack)
+
+	if err := tx.Stack().Update(stack.ID, stack); err != nil {
+		deployGate.abortDeploy()
+		return nil, httperror.InternalServerError("Unable to persist the stack changes inside the database", err)
+	}
+
+	deployGate.startDeploy()
+
+	userContext := source.NewUserContext(securityContext.User, securityContext.UserMemberships)
+	if err := fillStackGitConfig(tx, userContext, stack); err != nil {
+		return nil, httperror.InternalServerError("Unable to load git config for stack", err)
+	}
+
+	return stack, nil
+}
+
+func (handler *Handler) updateAndDeployStack(tx dataservices.DataStoreTx, r *http.Request, stack *portainer.Stack, endpoint *portainer.Endpoint, gate *deployGate) *httperror.HandlerError {
+	switch stack.Type {
+	case portainer.DockerSwarmStack:
+		stack.Name = handler.SwarmStackManager.NormalizeStackName(stack.Name)
+
+		return handler.updateSwarmStack(tx, r, stack, endpoint, gate)
+	case portainer.DockerComposeStack:
+		stack.Name = handler.ComposeStackManager.NormalizeStackName(stack.Name)
+
+		return handler.updateComposeStack(tx, r, stack, endpoint, gate)
+	case portainer.KubernetesStack:
+		return handler.updateKubernetesStack(tx, r, stack, endpoint, gate)
+	}
+
+	return httperror.InternalServerError("Unsupported stack", errors.Errorf("unsupported stack type: %v", stack.Type))
+}
+
+func (handler *Handler) updateComposeStack(tx dataservices.DataStoreTx, r *http.Request, stack *portainer.Stack, endpoint *portainer.Endpoint, gate *deployGate) *httperror.HandlerError {
+	// Must not be git based stack. stop the auto update job if there is any
+	if stack.AutoUpdate != nil {
+		deployments.StopAutoupdate(stack.ID, stack.AutoUpdate.JobID, handler.Scheduler)
+		stack.AutoUpdate = nil
+	}
+	if stack.WorkflowID != 0 {
+		stack.FromAppTemplate = true
+	}
+
+	var payload updateComposeStackPayload
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	payload.RepullImageAndRedeploy = payload.RepullImageAndRedeploy || payload.PullImage
+	stack.Env = payload.Env
+
+	if stack.WorkflowID != 0 {
+		oldWorkflowID := stack.WorkflowID
+		stack.WorkflowID = 0
+		if err := tx.Workflow().Delete(oldWorkflowID); err != nil {
+			return httperror.InternalServerError("Unable to remove git workflow records from database", err)
+		}
+	}
+
+	stackFolder := strconv.Itoa(int(stack.ID))
+	if _, err := handler.FileService.UpdateStoreStackFileFromBytes(stackFolder, stack.EntryPoint, []byte(payload.StackFileContent)); err != nil {
+		if rollbackErr := handler.FileService.RollbackStackFile(stackFolder, stack.EntryPoint); rollbackErr != nil {
+			log.Warn().Err(rollbackErr).Msg("rollback stack file error")
+		}
+
+		return httperror.InternalServerError("Unable to persist updated Compose file on disk", err)
+	}
+
+	// Create compose deployment config
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	composeDeploymentConfig, err := deployments.CreateComposeStackDeploymentConfigTx(tx, securityContext,
+		stack,
+		endpoint,
+		handler.FileService,
+		handler.StackDeployer,
+		payload.Prune,
+		payload.RepullImageAndRedeploy,
+		payload.RepullImageAndRedeploy)
+	if err != nil {
+		if rollbackErr := handler.FileService.RollbackStackFile(stackFolder, stack.EntryPoint); rollbackErr != nil {
+			log.Warn().Err(rollbackErr).Msg("rollback stack file error")
+		}
+
+		return httperror.InternalServerError(err.Error(), err)
+	}
+
+	if stack.Option != nil {
+		stack.Option.Prune = payload.Prune
+	} else {
+		stack.Option = &portainer.StackOption{
+			Prune: payload.Prune,
+		}
+	}
+
+	postDeploy := func(ctx context.Context, deployErr error) {
+		if deployErr != nil {
+			if rollbackErr := handler.FileService.RollbackStackFile(stackFolder, stack.EntryPoint); rollbackErr != nil {
+				log.Warn().Err(rollbackErr).Msg("rollback stack file error")
+			}
+			return
+		}
+
+		if err := handler.FileService.RemoveStackFileBackup(stackFolder, stack.EntryPoint); err != nil {
+			log.Warn().Err(err).Msg("remove stack file backup error")
+		}
+	}
+
+	go stackDeploy(handler.DataStore, stack.ID, composeDeploymentConfig, gate, postDeploy)
+
+	return nil
+}
+
+func (handler *Handler) updateSwarmStack(tx dataservices.DataStoreTx, r *http.Request, stack *portainer.Stack, endpoint *portainer.Endpoint, gate *deployGate) *httperror.HandlerError {
+	// Must not be git based stack. stop the auto update job if there is any
+	if stack.AutoUpdate != nil {
+		deployments.StopAutoupdate(stack.ID, stack.AutoUpdate.JobID, handler.Scheduler)
+		stack.AutoUpdate = nil
+	}
+	if stack.WorkflowID != 0 {
+		stack.FromAppTemplate = true
+	}
+
+	var payload updateSwarmStackPayload
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+	payload.RepullImageAndRedeploy = payload.RepullImageAndRedeploy || payload.PullImage
+	stack.Env = payload.Env
+
+	if stack.WorkflowID != 0 {
+		oldWorkflowID := stack.WorkflowID
+		stack.WorkflowID = 0
+		if err := tx.Workflow().Delete(oldWorkflowID); err != nil {
+			return httperror.InternalServerError("Unable to remove git workflow records from database", err)
+		}
+	}
+
+	stackFolder := strconv.Itoa(int(stack.ID))
+	if _, err := handler.FileService.UpdateStoreStackFileFromBytes(stackFolder, stack.EntryPoint, []byte(payload.StackFileContent)); err != nil {
+		if rollbackErr := handler.FileService.RollbackStackFile(stackFolder, stack.EntryPoint); rollbackErr != nil {
+			log.Warn().Err(rollbackErr).Msg("rollback stack file error")
+		}
+
+		return httperror.InternalServerError("Unable to persist updated Compose file on disk", err)
+	}
+
+	// Create swarm deployment config
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	swarmDeploymentConfig, err := deployments.CreateSwarmStackDeploymentConfigTx(tx, securityContext,
+		stack,
+		endpoint,
+		handler.FileService,
+		handler.StackDeployer,
+		payload.Prune,
+		payload.RepullImageAndRedeploy)
+	if err != nil {
+		if rollbackErr := handler.FileService.RollbackStackFile(stackFolder, stack.EntryPoint); rollbackErr != nil {
+			log.Warn().Err(rollbackErr).Msg("rollback stack file error")
+		}
+
+		return httperror.InternalServerError(err.Error(), err)
+	}
+
+	if stack.Option != nil {
+		stack.Option.Prune = payload.Prune
+	} else {
+		stack.Option = &portainer.StackOption{
+			Prune: payload.Prune,
+		}
+	}
+
+	postDeploy := func(ctx context.Context, deployErr error) {
+		if deployErr != nil {
+			if rollbackErr := handler.FileService.RollbackStackFile(stackFolder, stack.EntryPoint); rollbackErr != nil {
+				log.Warn().Err(rollbackErr).Msg("rollback stack file error")
+			}
+			return
+		}
+
+		if err := handler.FileService.RemoveStackFileBackup(stackFolder, stack.EntryPoint); err != nil {
+			log.Warn().Err(err).Msg("remove stack file backup error")
+		}
+	}
+
+	go stackDeploy(handler.DataStore, stack.ID, swarmDeploymentConfig, gate, postDeploy)
+
+	return nil
+}
+
+func stackDeploy(dataStore dataservices.DataStore, stackID portainer.StackID, stackDeploymentConfig deployments.StackDeploymentConfiger, gate *deployGate, postDeploy postDeployFunc) {
+	// Wait until stack update payload is persisted
+	if !gate.wait() {
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
+	defer cancel()
+
+	shouldUndeploy := false
+	if err := dataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
+		stack, err := tx.Stack().Read(stackID)
+		if err != nil {
+			return err
+		}
+
+		shouldUndeploy = stack.Status == portainer.StackStatusDeploying && stack.DeploymentStartStatus == portainer.StackStatusError
+		return nil
+	}); err != nil {
+		log.Error().Err(err).
+			Int("stack_id", int(stackID)).
+			Str("context", "stackDeploy").
+			Msg("Failed to determine stack status before async deployment")
+		return
+	}
+
+	if shouldUndeploy {
+		if undeployErr := stackDeploymentConfig.Undeploy(ctx); undeployErr != nil {
+			if err := dataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+				stack, err := tx.Stack().Read(stackID)
+				if err != nil {
+					return err
+				}
+
+				stackutils.UpdateStackStatusFromUndeploymentResult(stack, undeployErr)
+				return tx.Stack().Update(stack.ID, stack)
+			}); err != nil {
+				log.Error().Err(err).
+					AnErr("undeploy_error", undeployErr).
+					Int("stack_id", int(stackID)).
+					Str("context", "stackDeploy").
+					Msg("Failed to update stack status before async deployment")
+				return
+			}
+		}
+	}
+
+	deployErr := stackDeploymentConfig.Deploy(ctx)
+
+	if err := dataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		stack, err := tx.Stack().Read(stackID)
+		if err != nil {
+			return err
+		}
+
+		stackutils.UpdateStackStatusFromDeploymentResult(stack, deployErr)
+		return tx.Stack().Update(stack.ID, stack)
+	}); err != nil {
+		log.Error().Err(err).
+			AnErr("deploy_error", deployErr).
+			Int("stack_id", int(stackID)).
+			Str("context", "stackDeploy").
+			Msg("Failed to update stack status after async deployment")
+		return
+	}
+
+	if postDeploy != nil {
+		postDeploy(ctx, deployErr)
+	}
+}
diff --git a/api/http/handler/stacks/stack_update_git.go b/api/http/handler/stacks/stack_update_git.go
new file mode 100644
index 0000000..eaf74ed
--- /dev/null
+++ b/api/http/handler/stacks/stack_update_git.go
@@ -0,0 +1,278 @@
+package stacks
+
+import (
+	"cmp"
+	"context"
+	"net/http"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/dataservices/source"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	"github.com/portainer/portainer/api/git/update"
+	"github.com/portainer/portainer/api/gitops/sources"
+	httperrors "github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/stacks/deployments"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+
+	"github.com/pkg/errors"
+)
+
+type stackGitUpdatePayload struct {
+	AutoUpdate              *portainer.AutoUpdateSettings
+	Env                     []portainer.Pair
+	Prune                   bool
+	ConfigFilePath          string
+	AdditionalFiles         []string
+	RepositoryReferenceName string
+	// SourceID references an existing Source for git credentials/URL.
+	// When set, the inline URL and authentication fields are ignored.
+	SourceID portainer.SourceID
+	// Deprecated: use SourceID instead. URL of a Git repository hosting the Stack file.
+	RepositoryURL string
+	// Deprecated: use SourceID instead. Use basic authentication to clone the Git repository.
+	RepositoryAuthentication bool
+	// Deprecated: use SourceID instead. Username used in basic authentication.
+	RepositoryUsername string
+	// Deprecated: use SourceID instead. Password used in basic authentication.
+	RepositoryPassword string
+	// Deprecated: use SourceID instead. Skip TLS verification when cloning the Git repository.
+	TLSSkipVerify bool
+}
+
+func (payload *stackGitUpdatePayload) Validate(r *http.Request) error {
+	return update.ValidateAutoUpdateSettings(payload.AutoUpdate)
+}
+
+// @id StackUpdateGit
+// @summary Update a stack's Git configs
+// @description Update the Git settings in a stack, e.g., RepositoryReferenceName and AutoUpdate. When SourceID is set, URL/auth/TLS are taken from the referenced Source.
+// @description **Access policy**: authenticated
+// @tags stacks
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @produce json
+// @param id path int true "Stack identifier"
+// @param endpointId query int false "Stacks created before version 1.18.0 might not have an associated environment(endpoint) identifier. Use this optional parameter to set the environment(endpoint) identifier used by the stack."
+// @param body body stackGitUpdatePayload true "Git configs for pull and redeploy a stack"
+// @success 200 {object} stackResponse "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied"
+// @failure 404 "Not found"
+// @failure 500 "Server error"
+// @router /stacks/{id}/git [post]
+func (handler *Handler) stackUpdateGit(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	stackID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid stack identifier route variable", err)
+	}
+
+	var payload stackGitUpdatePayload
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	stack, err := handler.DataStore.Stack().Read(portainer.StackID(stackID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find a stack with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find a stack with the specified identifier inside the database", err)
+	} else if stack.WorkflowID == 0 {
+		msg := "No Git config in the found stack"
+		return httperror.InternalServerError(msg, errors.New(msg))
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	var gitConfig *gittypes.RepoConfig
+	var sourceID portainer.SourceID
+	if err := handler.DataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
+		userContext := source.NewUserContext(securityContext.User, securityContext.UserMemberships)
+		gitConfig, sourceID, err = loadGitConfigForStack(tx, userContext, stack.WorkflowID, stack.ID)
+		if err != nil {
+			return httperror.InternalServerError("Unable to load git config for stack", err)
+		}
+
+		if gitConfig == nil {
+			msg := "No Git config in the found stack source"
+			return httperror.InternalServerError(msg, errors.New(msg))
+		}
+
+		return nil
+	}); err != nil {
+		return response.TxErrorResponse(err)
+	}
+
+	if payload.AutoUpdate != nil && payload.AutoUpdate.Webhook != "" &&
+		(stack.AutoUpdate == nil ||
+			(stack.AutoUpdate != nil && stack.AutoUpdate.Webhook != payload.AutoUpdate.Webhook)) {
+		if isUnique, err := handler.checkUniqueWebhookID(handler.DataStore, payload.AutoUpdate.Webhook); !isUnique || err != nil {
+			return httperror.Conflict("Webhook ID already exists", errors.New("webhook ID already exists"))
+		}
+	}
+
+	// TODO: this is a work-around for stacks created with Portainer version >= 1.17.1
+	// The EndpointID property is not available for these stacks, this API environment(endpoint)
+	// can use the optional EndpointID query parameter to associate a valid environment(endpoint) identifier to the stack.
+	endpointID, err := request.RetrieveNumericQueryParameter(r, "endpointId", true)
+	if err != nil {
+		return httperror.BadRequest("Invalid query parameter: endpointId", err)
+	}
+	if endpointID != int(stack.EndpointID) {
+		stack.EndpointID = portainer.EndpointID(endpointID)
+	}
+
+	endpoint, err := handler.DataStore.Endpoint().Endpoint(stack.EndpointID)
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find the environment associated to the stack inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find the environment associated to the stack inside the database", err)
+	}
+
+	if err := handler.requestBouncer.AuthorizedEndpointOperation(r, endpoint); err != nil {
+		return httperror.Forbidden("Permission denied to access environment", err)
+	}
+
+	user, err := handler.DataStore.User().Read(securityContext.UserID)
+	if err != nil {
+		return httperror.BadRequest("Cannot find context user", errors.Wrap(err, "failed to fetch the user"))
+	}
+
+	if stack.Type == portainer.DockerSwarmStack || stack.Type == portainer.DockerComposeStack {
+		resourceControl, err := handler.DataStore.ResourceControl().ResourceControlByResourceIDAndType(stackutils.ResourceControlID(stack.EndpointID, stack.Name), portainer.StackResourceControl)
+		if err != nil {
+			return httperror.InternalServerError("Unable to retrieve a resource control associated to the stack", err)
+		}
+
+		if access, err := handler.userCanAccessStack(securityContext, resourceControl); err != nil {
+			return httperror.InternalServerError("Unable to verify user authorizations to validate stack access", err)
+		} else if !access {
+			return httperror.Forbidden("Access denied to resource", httperrors.ErrResourceAccessDenied)
+		}
+	}
+
+	if canManage, err := handler.userCanManageStacks(securityContext, endpoint); err != nil {
+		return httperror.InternalServerError("Unable to verify user authorizations to validate stack deletion", err)
+	} else if !canManage {
+		errMsg := "Stack editing is disabled for non-admin users"
+		return httperror.Forbidden(errMsg, errors.New(errMsg))
+	}
+
+	//stop the autoupdate job if there is any
+	if stack.AutoUpdate != nil {
+		deployments.StopAutoupdate(stack.ID, stack.AutoUpdate.JobID, handler.Scheduler)
+	}
+
+	// Record the current git config as the deployment baseline if it was never set (legacy stacks).
+	if stack.CurrentDeploymentInfo == nil {
+		stack.CurrentDeploymentInfo = &portainer.StackDeploymentInfo{
+			RepositoryURL:   gitConfig.URL,
+			ReferenceName:   gitConfig.ReferenceName,
+			ConfigFilePath:  gitConfig.ConfigFilePath,
+			AdditionalFiles: stack.AdditionalFiles,
+			ConfigHash:      gitConfig.ConfigHash,
+			SourceID:        sourceID,
+		}
+	}
+
+	// Update gitConfig based on payload; the updated config is saved to Source (not stack.GitConfig).
+	gitConfig.ReferenceName = payload.RepositoryReferenceName
+	if payload.ConfigFilePath != "" {
+		gitConfig.ConfigFilePath = payload.ConfigFilePath
+	}
+	if payload.AdditionalFiles != nil {
+		stack.AdditionalFiles = payload.AdditionalFiles
+	}
+
+	stack.EntryPoint = cmp.Or(payload.ConfigFilePath, stack.EntryPoint)
+
+	stack.AutoUpdate = payload.AutoUpdate
+	stack.Env = payload.Env
+	stack.UpdatedBy = user.Username
+	stack.UpdateDate = time.Now().Unix()
+
+	if stack.Type == portainer.DockerSwarmStack {
+		stack.Option = &portainer.StackOption{Prune: payload.Prune}
+	}
+
+	userContext := source.NewUserContext(securityContext.User, securityContext.UserMemberships)
+
+	if payload.SourceID != 0 {
+		src, httpErr := sources.ValidateGitSourceAccess(handler.DataStore, userContext, payload.SourceID)
+		if httpErr != nil {
+			return httpErr
+		}
+
+		if src.Git == nil {
+			return httperror.BadRequest("Source has no git configuration", errors.New("source has no git config"))
+		}
+	} else {
+		gitConfig.TLSSkipVerify = payload.TLSSkipVerify
+		if payload.RepositoryURL != "" {
+			gitConfig.URL = payload.RepositoryURL
+		}
+
+		if payload.RepositoryAuthentication {
+			password := payload.RepositoryPassword
+
+			// When the existing stack is using the custom username/password and the password is not updated,
+			// the stack should keep using the saved username/password
+			if password == "" && gitConfig.Authentication != nil {
+				password = gitConfig.Authentication.Password
+			}
+
+			gitConfig.Authentication = &gittypes.GitAuthentication{
+				Username: payload.RepositoryUsername,
+				Password: password,
+			}
+
+			if _, err := handler.GitService.LatestCommitID(
+				context.TODO(),
+				gitConfig.URL,
+				gitConfig.ReferenceName,
+				gitConfig.Authentication.Username,
+				gitConfig.Authentication.Password,
+				gitConfig.TLSSkipVerify,
+			); err != nil {
+				return httperror.InternalServerError("Unable to fetch git repository", err)
+			}
+		} else {
+			gitConfig.Authentication = nil
+		}
+	}
+
+	if payload.AutoUpdate != nil && payload.AutoUpdate.Interval != "" {
+		if jobID, err := deployments.StartAutoupdate(context.TODO(), stack.ID, stack.AutoUpdate.Interval, handler.Scheduler, handler.StackDeployer, handler.DataStore, handler.GitService); err != nil {
+			return err
+		} else {
+			stack.AutoUpdate.JobID = jobID
+		}
+	}
+
+	var resp *stackResponse
+	if err := handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		if err := tx.Stack().Update(stack.ID, stack); err != nil {
+			return err
+		}
+		userContext := source.NewUserContext(securityContext.User, securityContext.UserMemberships)
+		if err := saveStackGitConfig(tx, userContext, stack.WorkflowID, stack.ID, sourceID, payload.SourceID, gitConfig); err != nil {
+			return err
+		}
+		var err error
+		resp, err = newStackResponse(tx, userContext, stack)
+		return err
+	}); err != nil {
+		return httperror.InternalServerError("Unable to persist the stack changes inside the database", err)
+	}
+
+	return response.JSON(w, resp)
+}
diff --git a/api/http/handler/stacks/stack_update_git_redeploy.go b/api/http/handler/stacks/stack_update_git_redeploy.go
new file mode 100644
index 0000000..1098d11
--- /dev/null
+++ b/api/http/handler/stacks/stack_update_git_redeploy.go
@@ -0,0 +1,369 @@
+package stacks
+
+import (
+	"cmp"
+	"context"
+	"fmt"
+	"net/http"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/dataservices/source"
+	"github.com/portainer/portainer/api/git"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	"github.com/portainer/portainer/api/gitops/workflows"
+	httperrors "github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/api/http/security"
+	k "github.com/portainer/portainer/api/kubernetes"
+	"github.com/portainer/portainer/api/stacks/deployments"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+
+	"github.com/pkg/errors"
+	"github.com/rs/zerolog/log"
+)
+
+type stackGitRedeployPayload struct {
+	RepositoryReferenceName string
+	// When true and RepositoryPassword is non-empty, stored credentials are replaced.
+	RepositoryAuthentication bool
+	RepositoryUsername       string
+	// Non-empty value (with RepositoryAuthentication=true) replaces stored credentials; leave blank to keep them.
+	RepositoryPassword string
+	Env                []portainer.Pair
+	Prune              *bool
+	// RepullImageAndRedeploy indicates whether to force repulling images and redeploying the stack
+	RepullImageAndRedeploy bool
+
+	StackName string
+	// Deprecated(2.36): use RepullImageAndRedeploy instead for cleaner responsibility
+	// Force a pulling to current image with the original tag though the image is already the latest
+	PullImage bool `example:"false"`
+}
+
+func (payload *stackGitRedeployPayload) Validate(r *http.Request) error {
+	return nil
+}
+
+// @id StackGitRedeploy
+// @summary Redeploy a stack
+// @description Pull and redeploy a stack via Git
+// @description **Access policy**: authenticated
+// @tags stacks
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @produce json
+// @param id path int true "Stack identifier"
+// @param endpointId query int false "Stacks created before version 1.18.0 might not have an associated environment(endpoint) identifier. Use this optional parameter to set the environment(endpoint) identifier used by the stack."
+// @param body body stackGitRedeployPayload true "Git configs for pull and redeploy of a stack. **StackName** may only be populated for Kuberenetes stacks, and if specified with a blank string, it will be set to blank"
+// @success 200 {object} portainer.Stack "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied"
+// @failure 404 "Not found"
+// @failure 409 "Conflict"
+// @failure 500 "Server error"
+// @router /stacks/{id}/git/redeploy [put]
+func (handler *Handler) stackGitRedeploy(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	stackID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid stack identifier route variable", err)
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	var stack *portainer.Stack
+	var gitConfig *gittypes.RepoConfig
+	var sourceID portainer.SourceID
+	if err := handler.DataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
+		stack, err = tx.Stack().Read(portainer.StackID(stackID))
+		if tx.IsErrObjectNotFound(err) {
+			return httperror.NotFound("Unable to find a stack with the specified identifier inside the database", err)
+		} else if err != nil {
+			return httperror.InternalServerError("Unable to find a stack with the specified identifier inside the database", err)
+		}
+
+		if stack.WorkflowID == 0 {
+			return httperror.BadRequest("Stack is not created from git", errors.New("stack has no git workflow"))
+		}
+
+		userContext := source.NewUserContext(securityContext.User, securityContext.UserMemberships)
+		gitConfig, sourceID, err = loadGitConfigForStack(tx, userContext, stack.WorkflowID, stack.ID)
+		if err != nil {
+			return httperror.InternalServerError("Unable to load git config for stack", err)
+		}
+		if gitConfig == nil {
+			return httperror.BadRequest("Stack is not created from git", errors.New("stack source has no git config"))
+		}
+
+		if stack.Status == portainer.StackStatusDeploying {
+			return httperror.Conflict("Unable to update stack", errors.New("Stack deployment is already in progress"))
+		}
+		return nil
+	}); err != nil {
+		return response.TxErrorResponse(err)
+	}
+
+	// TODO: this is a work-around for stacks created with Portainer version >= 1.17.1
+	// The EndpointID property is not available for these stacks, this API environment(endpoint)
+	// can use the optional EndpointID query parameter to associate a valid environment(endpoint) identifier to the stack.
+	endpointID, err := request.RetrieveNumericQueryParameter(r, "endpointId", true)
+	if err != nil {
+		return httperror.BadRequest("Invalid query parameter: endpointId", err)
+	}
+	if endpointID != int(stack.EndpointID) {
+		stack.EndpointID = portainer.EndpointID(endpointID)
+	}
+
+	endpoint, err := handler.DataStore.Endpoint().Endpoint(stack.EndpointID)
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find the environment associated to the stack inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find the environment associated to the stack inside the database", err)
+	}
+
+	if err := handler.requestBouncer.AuthorizedEndpointOperation(r, endpoint); err != nil {
+		return httperror.Forbidden("Permission denied to access environment", err)
+	}
+
+	// Only check resource control when it is a DockerSwarmStack or a DockerComposeStack
+	if stack.Type == portainer.DockerSwarmStack || stack.Type == portainer.DockerComposeStack {
+		resourceControl, err := handler.DataStore.ResourceControl().ResourceControlByResourceIDAndType(stackutils.ResourceControlID(stack.EndpointID, stack.Name), portainer.StackResourceControl)
+		if err != nil {
+			return httperror.InternalServerError("Unable to retrieve a resource control associated to the stack", err)
+		}
+
+		if access, err := handler.userCanAccessStack(securityContext, resourceControl); err != nil {
+			return httperror.InternalServerError("Unable to verify user authorizations to validate stack access", err)
+		} else if !access {
+			return httperror.Forbidden("Access denied to resource", httperrors.ErrResourceAccessDenied)
+		}
+	}
+
+	if canManage, err := handler.userCanManageStacks(securityContext, endpoint); err != nil {
+		return httperror.InternalServerError("Unable to verify user authorizations to validate stack deletion", err)
+	} else if !canManage {
+		errMsg := "Stack management is disabled for non-admin users"
+		return httperror.Forbidden(errMsg, errors.New(errMsg))
+	}
+
+	var payload stackGitRedeployPayload
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+	payload.RepullImageAndRedeploy = payload.RepullImageAndRedeploy || payload.PullImage
+
+	gitConfig.ReferenceName = cmp.Or(payload.RepositoryReferenceName, gitConfig.ReferenceName)
+
+	if payload.Env != nil {
+		stack.Env = payload.Env
+	}
+
+	if payload.Prune != nil {
+		if stack.Type == portainer.DockerSwarmStack || stack.Type == portainer.DockerComposeStack {
+			if stack.Option == nil {
+				stack.Option = &portainer.StackOption{}
+			}
+			stack.Option.Prune = *payload.Prune
+		}
+	}
+
+	if stack.Type == portainer.KubernetesStack && payload.StackName != "" {
+		stack.Name = payload.StackName
+	}
+
+	auth := resolveGitAuthFromRedeployPayload(gitConfig, payload)
+
+	cloneOptions := git.CloneOptions{
+		ProjectPath:   stack.ProjectPath,
+		URL:           gitConfig.URL,
+		ReferenceName: gitConfig.ReferenceName,
+		Username:      auth.Username,
+		Password:      auth.Password,
+		TLSSkipVerify: gitConfig.TLSSkipVerify,
+	}
+
+	clean, err := git.CloneWithBackup(context.TODO(), handler.GitService, handler.FileService, cloneOptions)
+	if err != nil {
+		if persistErr := handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+			return persistSourceSyncError(tx, securityContext, sourceID, err)
+		}); persistErr != nil {
+			return httperror.InternalServerError("Unable to clone git repository directory", fmt.Errorf("%w (and failed to persist status: %w)", err, persistErr))
+		}
+
+		return httperror.InternalServerError("Unable to clone git repository directory", err)
+	}
+
+	defer clean()
+
+	newHash, err := handler.GitService.LatestCommitID(context.TODO(), gitConfig.URL, gitConfig.ReferenceName, auth.Username, auth.Password, gitConfig.TLSSkipVerify)
+	if err != nil {
+		if persistErr := handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+			return persistSourceSyncError(tx, securityContext, sourceID, err)
+		}); persistErr != nil {
+			return httperror.InternalServerError("Unable get latest commit id", fmt.Errorf("%w (and failed to persist status: %w)", errors.WithMessagef(err, "failed to fetch latest commit id of the stack %v", stack.ID), persistErr))
+		}
+
+		return httperror.InternalServerError("Unable get latest commit id", errors.WithMessagef(err, "failed to fetch latest commit id of the stack %v", stack.ID))
+	}
+
+	oldConfigHash := gitConfig.ConfigHash
+	gitConfig.ConfigHash = newHash
+
+	user, err := handler.DataStore.User().Read(securityContext.UserID)
+	if err != nil {
+		return httperror.BadRequest("Cannot find context user", errors.Wrap(err, "failed to fetch the user"))
+	}
+	stack.CurrentDeploymentInfo = &portainer.StackDeploymentInfo{
+		RepositoryURL:   gitConfig.URL,
+		ReferenceName:   gitConfig.ReferenceName,
+		ConfigFilePath:  gitConfig.ConfigFilePath,
+		AdditionalFiles: stack.AdditionalFiles,
+		ConfigHash:      newHash,
+		SourceID:        sourceID,
+	}
+
+	stack.UpdatedBy = user.Username
+	stack.UpdateDate = time.Now().Unix()
+	stackutils.PrepareStackStatusForDeployment(stack)
+
+	postDeploy := func(ctx context.Context, deployErr error) {
+		if deployErr == nil {
+			return
+		}
+
+		if err := handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+			liveStack, err := tx.Stack().Read(stack.ID)
+			if err != nil {
+				return err
+			}
+
+			if liveStack.CurrentDeploymentInfo != nil {
+				liveStack.CurrentDeploymentInfo.ConfigHash = oldConfigHash
+			}
+
+			if err := tx.Stack().Update(liveStack.ID, liveStack); err != nil {
+				return err
+			}
+
+			return workflows.UpdateArtifactFileForStack(tx, stack.WorkflowID, stack.ID, sourceID, func(a *portainer.ArtifactFile) {
+				a.Hash = oldConfigHash
+			})
+		}); err != nil {
+			log.Error().Err(err).Int("stack_id", int(stack.ID)).Msg("failed to revert config hash after failed redeploy")
+		}
+	}
+
+	deployGate := newDeployGate()
+	if err := handler.deployStack(r, stack, payload.RepullImageAndRedeploy, endpoint, deployGate, postDeploy); err != nil {
+		return err
+	}
+
+	if err := handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		if err := tx.Stack().Update(stack.ID, stack); err != nil {
+			return err
+		}
+		userContext := source.NewUserContext(securityContext.User, securityContext.UserMemberships)
+		if err := saveStackGitConfig(tx, userContext, stack.WorkflowID, stack.ID, sourceID, 0, gitConfig); err != nil {
+			return err
+		}
+
+		if err := workflows.SaveSourceStatus(tx, userContext, sourceID, nil); err != nil {
+			return err
+		}
+
+		return fillStackGitConfig(tx, userContext, stack)
+	}); err != nil {
+		deployGate.abortDeploy()
+
+		return httperror.InternalServerError("Unable to persist the stack changes inside the database", errors.Wrap(err, "failed to update the stack"))
+	}
+
+	deployGate.startDeploy()
+
+	return response.JSON(w, stack)
+}
+
+func resolveGitAuthFromRedeployPayload(gitConfig *gittypes.RepoConfig, payload stackGitRedeployPayload) gittypes.GitAuthentication {
+	auth := gittypes.GitAuthentication{}
+	if gitConfig.Authentication != nil {
+		auth = *gitConfig.Authentication
+	}
+
+	// only overload source auth if provided
+	if payload.RepositoryAuthentication && payload.RepositoryPassword != "" {
+		auth.Username = payload.RepositoryUsername
+		auth.Password = payload.RepositoryPassword
+	}
+	return auth
+}
+
+func (handler *Handler) deployStack(r *http.Request, stack *portainer.Stack, pullImage bool, endpoint *portainer.Endpoint, gate *deployGate, postDeploy postDeployFunc) *httperror.HandlerError {
+	var deploymentConfiger deployments.StackDeploymentConfiger
+
+	switch stack.Type {
+	case portainer.DockerSwarmStack:
+		// Create swarm deployment config
+		securityContext, err := security.RetrieveRestrictedRequestContext(r)
+		if err != nil {
+			return httperror.InternalServerError("Unable to retrieve info from request context", err)
+		}
+
+		prune := stack.Option != nil && stack.Option.Prune
+
+		deploymentConfiger, err = deployments.CreateSwarmStackDeploymentConfigTx(handler.DataStore, securityContext, stack, endpoint, handler.FileService, handler.StackDeployer, prune, pullImage)
+		if err != nil {
+			return httperror.InternalServerError(err.Error(), err)
+		}
+
+	case portainer.DockerComposeStack:
+		// Create compose deployment config
+		securityContext, err := security.RetrieveRestrictedRequestContext(r)
+		if err != nil {
+			return httperror.InternalServerError("Unable to retrieve info from request context", err)
+		}
+
+		prune := stack.Option != nil && stack.Option.Prune
+
+		deploymentConfiger, err = deployments.CreateComposeStackDeploymentConfigTx(handler.DataStore, securityContext, stack, endpoint, handler.FileService, handler.StackDeployer, prune, pullImage, true)
+		if err != nil {
+			return httperror.InternalServerError(err.Error(), err)
+		}
+
+	case portainer.KubernetesStack:
+		handler.stackCreationMutex.Lock()
+		defer handler.stackCreationMutex.Unlock()
+
+		tokenData, err := security.RetrieveTokenData(r)
+		if err != nil {
+			return httperror.BadRequest("Failed to retrieve user token data", err)
+		}
+
+		user := &portainer.User{
+			ID:       tokenData.ID,
+			Username: tokenData.Username,
+		}
+
+		appLabel := k.KubeAppLabels{
+			StackID:   int(stack.ID),
+			StackName: stack.Name,
+			Owner:     tokenData.Username,
+			Kind:      "git",
+		}
+
+		deploymentConfiger = deployments.CreateKubernetesStackDeploymentConfig(stack, handler.KubernetesDeployer, appLabel, user, endpoint)
+
+	default:
+		return httperror.InternalServerError("Unsupported stack", errors.Errorf("unsupported stack type: %v", stack.Type))
+	}
+
+	go stackDeploy(handler.DataStore, stack.ID, deploymentConfiger, gate, postDeploy)
+
+	return nil
+}
diff --git a/api/http/handler/stacks/stack_update_git_redeploy_test.go b/api/http/handler/stacks/stack_update_git_redeploy_test.go
new file mode 100644
index 0000000..1bcf8a0
--- /dev/null
+++ b/api/http/handler/stacks/stack_update_git_redeploy_test.go
@@ -0,0 +1,82 @@
+package stacks
+
+import (
+	"testing"
+
+	gittypes "github.com/portainer/portainer/api/git/types"
+	"github.com/stretchr/testify/require"
+)
+
+func TestResolveGitAuthFromRedeployPayload(t *testing.T) {
+	t.Parallel()
+
+	existing := &gittypes.GitAuthentication{
+		Username: "existing-user",
+		Password: "existing-pass",
+	}
+
+	tests := []struct {
+		name    string
+		auth    *gittypes.GitAuthentication
+		payload stackGitRedeployPayload
+		want    gittypes.GitAuthentication
+	}{
+		{
+			name:    "no existing auth, flag off, no creds",
+			auth:    nil,
+			payload: stackGitRedeployPayload{RepositoryAuthentication: false},
+			want:    gittypes.GitAuthentication{},
+		},
+		{
+			name:    "no existing auth, flag off, creds provided",
+			auth:    nil,
+			payload: stackGitRedeployPayload{RepositoryAuthentication: false, RepositoryPassword: "pass"},
+			want:    gittypes.GitAuthentication{},
+		},
+		{
+			name:    "no existing auth, flag on, empty password",
+			auth:    nil,
+			payload: stackGitRedeployPayload{RepositoryAuthentication: true, RepositoryUsername: "user"},
+			want:    gittypes.GitAuthentication{},
+		},
+		{
+			name:    "no existing auth, flag on, password set",
+			auth:    nil,
+			payload: stackGitRedeployPayload{RepositoryAuthentication: true, RepositoryUsername: "user", RepositoryPassword: "pass"},
+			want:    gittypes.GitAuthentication{Username: "user", Password: "pass"},
+		},
+		{
+			name:    "no existing auth, flag on, password set but no username",
+			auth:    nil,
+			payload: stackGitRedeployPayload{RepositoryAuthentication: true, RepositoryPassword: "pass"},
+			want:    gittypes.GitAuthentication{Username: "", Password: "pass"},
+		},
+		{
+			name:    "existing auth, flag off",
+			auth:    existing,
+			payload: stackGitRedeployPayload{RepositoryAuthentication: false},
+			want:    *existing,
+		},
+		{
+			name:    "existing auth, flag on, empty password",
+			auth:    existing,
+			payload: stackGitRedeployPayload{RepositoryAuthentication: true, RepositoryUsername: "new-user"},
+			want:    *existing,
+		},
+		{
+			name:    "existing auth, flag on, password set",
+			auth:    existing,
+			payload: stackGitRedeployPayload{RepositoryAuthentication: true, RepositoryUsername: "new-user", RepositoryPassword: "new-pass"},
+			want:    gittypes.GitAuthentication{Username: "new-user", Password: "new-pass"},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			cfg := &gittypes.RepoConfig{Authentication: tc.auth}
+			got := resolveGitAuthFromRedeployPayload(cfg, tc.payload)
+			require.Equal(t, tc.want, got)
+		})
+	}
+}
diff --git a/api/http/handler/stacks/stack_update_git_test.go b/api/http/handler/stacks/stack_update_git_test.go
new file mode 100644
index 0000000..e5c4a2e
--- /dev/null
+++ b/api/http/handler/stacks/stack_update_git_test.go
@@ -0,0 +1,107 @@
+package stacks
+
+import (
+	"bytes"
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices/source"
+	"github.com/portainer/portainer/api/datastore"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+
+	"github.com/google/uuid"
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/require"
+)
+
+func TestStackUpdateGitWebhookUniqueness(t *testing.T) {
+	t.Parallel()
+	webhook, err := uuid.NewRandom()
+	require.NoError(t, err)
+
+	_, store := datastore.MustNewTestStore(t, false, false)
+
+	endpoint := &portainer.Endpoint{
+		ID:   123,
+		Name: "endpoint1",
+		Type: portainer.DockerEnvironment,
+	}
+	err = store.Endpoint().Create(endpoint)
+	require.NoError(t, err)
+
+	const stack1ID = portainer.StackID(456)
+	const stack2ID = portainer.StackID(457)
+
+	sharedSrc := &portainer.Source{
+		Type: portainer.SourceTypeGit,
+		Git:  &gittypes.GitSource{URL: "https://github.com/portainer/portainer.git"},
+	}
+	err = store.Source().Create(source.InsecureNewAdminContext(), sharedSrc)
+	require.NoError(t, err)
+
+	wf1 := &portainer.Workflow{Artifacts: []portainer.Artifact{{
+		StackID: stack1ID,
+		Files:   []portainer.ArtifactFile{{SourceID: sharedSrc.ID}},
+	}}}
+	err = store.Workflow().Create(wf1)
+	require.NoError(t, err)
+
+	wf2 := &portainer.Workflow{Artifacts: []portainer.Artifact{{
+		StackID: stack2ID,
+		Files:   []portainer.ArtifactFile{{SourceID: sharedSrc.ID}},
+	}}}
+	err = store.Workflow().Create(wf2)
+	require.NoError(t, err)
+
+	stack1 := portainer.Stack{
+		ID:         stack1ID,
+		EndpointID: endpoint.ID,
+		WorkflowID: wf1.ID,
+		AutoUpdate: &portainer.AutoUpdateSettings{
+			Webhook: webhook.String(),
+		},
+	}
+
+	err = store.Stack().Create(&stack1)
+	require.NoError(t, err)
+
+	stack2 := stack1
+	stack2.ID = stack2ID
+	stack2.AutoUpdate = nil
+	stack2.WorkflowID = wf2.ID
+
+	err = store.Stack().Create(&stack2)
+	require.NoError(t, err)
+
+	handler := NewHandler(testhelpers.NewTestRequestBouncer())
+	handler.DataStore = store
+
+	payload := &stackGitUpdatePayload{
+		AutoUpdate: &portainer.AutoUpdateSettings{
+			Webhook: webhook.String(),
+		},
+	}
+
+	jsonPayload, err := json.Marshal(payload)
+	require.NoError(t, err)
+
+	url := "/stacks/" + strconv.Itoa(int(stack2.ID)) + "/git?endpointId=" + strconv.Itoa(int(endpoint.ID))
+	req := httptest.NewRequest(http.MethodPost, url, bytes.NewReader(jsonPayload))
+
+	rrc := &security.RestrictedRequestContext{
+		IsAdmin: true,
+		UserID:  1,
+		User:    &portainer.User{ID: 1, Role: portainer.AdministratorRole},
+	}
+	req = req.WithContext(security.StoreRestrictedRequestContext(req, rrc))
+
+	rr := httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+
+	require.Equal(t, http.StatusConflict, rr.Code)
+}
diff --git a/api/http/handler/stacks/stack_update_test.go b/api/http/handler/stacks/stack_update_test.go
new file mode 100644
index 0000000..15e8f04
--- /dev/null
+++ b/api/http/handler/stacks/stack_update_test.go
@@ -0,0 +1,483 @@
+package stacks
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/pkg/errors"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/filesystem"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+	"github.com/portainer/portainer/pkg/fips"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_updateStackInTx(t *testing.T) {
+	t.Parallel()
+	t.Run("Transaction commits successfully - changes are persisted", func(t *testing.T) {
+		payload := &updateComposeStackPayload{
+			StackFileContent: "version: '3'\nservices:\n  web:\n    image: nginx:latest",
+			Env:              []portainer.Pair{{Name: "FOO", Value: "BAR"}},
+		}
+		stack := &portainer.Stack{
+			ID:         1,
+			Name:       "test-stack-1",
+			EntryPoint: "docker-compose.yml",
+			Type:       portainer.DockerComposeStack,
+		}
+		setup := setupUpdateStackInTxTest(t, stack, payload)
+
+		// Execute updateStackInTx within a successful transaction
+		err := setup.store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+			_, handlerErr := setup.handler.updateStackInTx(tx, setup.req, setup.stack.ID, setup.endpoint.ID)
+			if handlerErr != nil {
+				return handlerErr
+			}
+			return nil
+		})
+		require.NoError(t, err, "transction should succeed")
+
+		// Verify the stack was updated in the database (transaction committed)
+		stackAfterCommit, err := setup.store.Stack().Read(setup.stack.ID)
+		require.NoError(t, err, "should be able to read stack after commit")
+		require.NotNil(t, stackAfterCommit)
+		require.Equal(t, "BAR", stackAfterCommit.Env[0].Value, "stack env variable should be updated")
+	})
+
+	t.Run("Transaction rollback on error - changes not persisted", func(t *testing.T) {
+		payload := &updateComposeStackPayload{
+			StackFileContent: "version: '3'\nservices:\n  web:\n    image: nginx:latest",
+			Env:              []portainer.Pair{{Name: "FOO", Value: "BAR"}},
+		}
+		stack := &portainer.Stack{
+			ID:         1,
+			Name:       "test-stack-1",
+			EntryPoint: "docker-compose.yml",
+			Type:       portainer.DockerComposeStack,
+		}
+		setup := setupUpdateStackInTxTest(t, stack, payload)
+
+		// Execute updateStackInTx within a transaction that we force to fail
+		err := setup.store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+			updatedStack, handlerErr := setup.handler.updateStackInTx(tx, setup.req, setup.stack.ID, setup.endpoint.ID)
+			if handlerErr != nil {
+				return handlerErr
+			}
+
+			// Verify changes are visible within the transaction
+			assert.NotNil(t, updatedStack)
+			assert.Equal(t, setup.user.Username, updatedStack.UpdatedBy)
+			assert.NotZero(t, updatedStack.UpdateDate)
+
+			// Force the transaction to fail by returning an error
+			return errors.New("forced transaction failure")
+		})
+
+		// Verify the transaction failed
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "forced transaction failure")
+
+		// Verify the stack was NOT updated in the database (transaction rolled back)
+		stackAfterRollback, err := setup.store.Stack().Read(setup.stack.ID)
+		require.NoError(t, err)
+		require.Zero(t, stackAfterRollback.Env, "stack env variable should remain unchanged after rollback")
+	})
+
+	t.Run("Error: Stack not found returns NotFound httperror", func(t *testing.T) {
+		payload := &updateComposeStackPayload{
+			StackFileContent: "version: '3'\nservices:\n  web:\n    image: nginx:latest",
+		}
+		stack := &portainer.Stack{
+			ID:         1,
+			Name:       "test-stack-1",
+			EntryPoint: "docker-compose.yml",
+			Type:       portainer.DockerComposeStack,
+		}
+		setup := setupUpdateStackInTxTest(t, stack, payload)
+		setup.req.URL.Path = "/stacks/9999" // Non-existent stack ID
+
+		var handlerErr *httperror.HandlerError
+		_ = setup.store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+			_, handlerErr = setup.handler.updateStackInTx(tx, setup.req, 9999, setup.endpoint.ID)
+			return handlerErr
+		})
+
+		require.NotNil(t, handlerErr, "handler error should be set")
+		assert.Equal(t, http.StatusNotFound, handlerErr.StatusCode, "should return 404 NotFound")
+		assert.Contains(t, handlerErr.Message, "Unable to find a stack", "error message should mention stack")
+	})
+
+	t.Run("Error: Endpoint not found returns NotFound httperror", func(t *testing.T) {
+		payload := &updateComposeStackPayload{
+			StackFileContent: "version: '3'\nservices:\n  web:\n    image: nginx:latest",
+		}
+		stack := &portainer.Stack{
+			ID:         1,
+			Name:       "test-stack-1",
+			EntryPoint: "docker-compose.yml",
+			Type:       portainer.DockerComposeStack,
+		}
+		setup := setupUpdateStackInTxTest(t, stack, payload)
+
+		var handlerErr *httperror.HandlerError
+		_ = setup.store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+			_, handlerErr = setup.handler.updateStackInTx(tx, setup.req, stack.ID, 2999) // Non-existent endpoint ID
+			return nil
+		})
+
+		require.NotNil(t, handlerErr, "handler error should be set")
+		assert.Equal(t, http.StatusNotFound, handlerErr.StatusCode, "should return 404 NotFound")
+		assert.Contains(t, handlerErr.Message, "Unable to find the environment", "error message should mention environment")
+	})
+
+	t.Run("Error: user cannot access the stack", func(t *testing.T) {
+		payload := &updateComposeStackPayload{
+			StackFileContent: "version: '3'\nservices:\n  web:\n    image: nginx:latest",
+		}
+		stack := &portainer.Stack{
+			ID:         1,
+			Name:       "test-stack-1",
+			EntryPoint: "docker-compose.yml",
+			Type:       portainer.DockerComposeStack,
+		}
+		setup := setupUpdateStackInTxTest(t, stack, payload)
+		originalUser, err := setup.store.User().Read(setup.user.ID)
+		require.NoError(t, err, "error reading user")
+
+		// Modify the user's role to restrict access
+		originalUser.Role = portainer.StandardUserRole
+		err = setup.store.User().Update(originalUser.ID, originalUser)
+		require.NoError(t, err, "error updating user role")
+
+		var handlerErr *httperror.HandlerError
+		_ = setup.store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+			_, handlerErr = setup.handler.updateStackInTx(tx, setup.req, stack.ID, stack.EndpointID)
+			return nil
+		})
+
+		require.NotNil(t, handlerErr, "handler error should be set")
+		assert.Equal(t, http.StatusForbidden, handlerErr.StatusCode, "should return 403 Forbidden")
+		assert.Contains(t, handlerErr.Message, "Access denied", "error message should mention access")
+	})
+
+	t.Run("Error: user not found", func(t *testing.T) {
+		payload := &updateComposeStackPayload{
+			StackFileContent: "version: '3'\nservices:\n  web:\n    image: nginx:latest",
+		}
+		stack := &portainer.Stack{
+			ID:         1,
+			Name:       "test-stack-1",
+			EntryPoint: "docker-compose.yml",
+			Type:       portainer.DockerComposeStack,
+		}
+		setup := setupUpdateStackInTxTest(t, stack, payload)
+		err := setup.store.User().Delete(setup.user.ID) // Delete the user to simulate "user not found"
+		require.NoError(t, err, "error deleting user")
+
+		var handlerErr *httperror.HandlerError
+		_ = setup.store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+			_, handlerErr = setup.handler.updateStackInTx(tx, setup.req, stack.ID, stack.EndpointID)
+			return nil
+		})
+
+		require.NotNil(t, handlerErr, "handler error should be set")
+		assert.Equal(t, http.StatusInternalServerError, handlerErr.StatusCode, "should return 500 Internal Server Error")
+		assert.Contains(t, handlerErr.Message, "Unable to verify user authorizations to validate stack access", "error message should mention user authorizations")
+	})
+}
+
+func TestStackUpdate(t *testing.T) {
+	t.Parallel()
+	t.Helper()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	testDataPath := filesystem.JoinPaths(t.TempDir())
+	fileService, err := filesystem.NewService(testDataPath, "")
+	require.NoError(t, err, "error init file service")
+
+	// Create test user
+	_, err = mockCreateUser(store)
+	require.NoError(t, err, "error creating user")
+
+	// Create test endpoint
+	endpoint, err := mockCreateEndpoint(store)
+	require.NoError(t, err, "error creating endpoint")
+
+	// Create test stack
+	stack := &portainer.Stack{
+		ID:          1,
+		Name:        "test-stack-1",
+		EntryPoint:  "docker-compose.yml",
+		EndpointID:  endpoint.ID,
+		ProjectPath: fileService.GetDatastorePath() + fmt.Sprintf("/compose/%d", 1),
+		Type:        portainer.DockerSwarmStack,
+	}
+
+	err = store.Stack().Create(stack)
+	require.NoError(t, err, "error creating stack")
+
+	// Create resource control for the stack
+	resourceControl := &portainer.ResourceControl{
+		ID:                 portainer.ResourceControlID(stack.ID),
+		ResourceID:         stackutils.ResourceControlID(stack.EndpointID, stack.Name),
+		Type:               portainer.StackResourceControl,
+		AdministratorsOnly: false,
+	}
+	err = store.ResourceControl().Create(resourceControl)
+	require.NoError(t, err, "error creating resource control")
+
+	// Store initial stack file
+	_, err = fileService.StoreStackFileFromBytes(
+		strconv.Itoa(int(stack.ID)),
+		stack.EntryPoint,
+		[]byte("version: '3'\nservices:\n  web:\n    image: nginx:v1"),
+	)
+	require.NoError(t, err, "error storing stack file")
+
+	// Create handler
+	handler := NewHandler(testhelpers.NewTestRequestBouncer())
+	handler.DataStore = store
+	handler.FileService = fileService
+	handler.StackDeployer = testhelpers.NewTestStackDeployer()
+	handler.ComposeStackManager = testhelpers.NewComposeStackManager()
+	handler.SwarmStackManager = swarmStackManager{}
+
+	payload := &updateComposeStackPayload{
+		StackFileContent: "version: '3'\nservices:\n  web:\n    image: nginx:latest",
+	}
+	// Create mock request with security context
+	jsonPayload, err := json.Marshal(payload)
+	require.NoError(t, err)
+
+	t.Run("Endpoint is not provided in query param nor header", func(t *testing.T) {
+		req := mockCreateStackRequestWithSecurityContext(
+			http.MethodPut,
+			fmt.Sprintf("/stacks/%d", stack.ID),
+			bytes.NewBuffer(jsonPayload),
+		)
+
+		rec := httptest.NewRecorder()
+		handler.ServeHTTP(rec, req)
+
+		require.Equal(t, http.StatusBadRequest, rec.Code, "expected status BadRequest when endpoint is not provided")
+	})
+
+	t.Run("Stack doesn't exist", func(t *testing.T) {
+		req := mockCreateStackRequestWithSecurityContext(
+			http.MethodPut,
+			fmt.Sprintf("/stacks/test-stack-1?endpointId=%d", endpoint.ID),
+			bytes.NewBuffer(jsonPayload),
+		)
+
+		rec := httptest.NewRecorder()
+		handler.ServeHTTP(rec, req)
+
+		require.Equal(t, http.StatusBadRequest, rec.Code, "expected status NotFound when stack doesn't exist")
+	})
+
+	t.Run("Update stack successfully", func(t *testing.T) {
+		fips.InitFIPS(false)
+
+		req := mockCreateStackRequestWithSecurityContext(
+			http.MethodPut,
+			fmt.Sprintf("/stacks/%d?endpointId=%d", stack.ID, endpoint.ID),
+			bytes.NewBuffer(jsonPayload),
+		)
+
+		rec := httptest.NewRecorder()
+		handler.ServeHTTP(rec, req)
+
+		require.Equal(t, http.StatusOK, rec.Code, "expected status OK when stack is updated successfully")
+		var stackResponse portainer.Stack
+		err = json.NewDecoder(rec.Body).Decode(&stackResponse)
+		require.NoError(t, err, "error decoding response body")
+		require.NotZero(t, stackResponse.UpdateDate, "stack update date should be set")
+	})
+}
+
+// setupUpdateStackInTxTest creates a fresh test environment for each subtest
+type updateStackInTxTestSetup struct {
+	store           *datastore.Store
+	fileService     portainer.FileService
+	handler         *Handler
+	user            *portainer.User
+	endpoint        *portainer.Endpoint
+	stack           *portainer.Stack
+	resourceControl *portainer.ResourceControl
+	jsonPayload     []byte
+	req             *http.Request
+}
+
+type testUpdateStackPayload interface {
+	*updateComposeStackPayload | *updateSwarmStackPayload
+}
+
+func setupUpdateStackInTxTest[T testUpdateStackPayload](t *testing.T, stack *portainer.Stack, payload T) *updateStackInTxTestSetup {
+	t.Helper()
+
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	testDataPath := filesystem.JoinPaths(t.TempDir())
+	fileService, err := filesystem.NewService(testDataPath, "")
+	require.NoError(t, err, "error init file service")
+
+	// Create test user
+	user, err := mockCreateUser(store)
+	require.NoError(t, err, "error creating user")
+
+	// Create test endpoint
+	endpoint, err := mockCreateEndpoint(store)
+	require.NoError(t, err, "error creating endpoint")
+
+	// Create test stack
+	stack.EndpointID = endpoint.ID
+	stack.ProjectPath = fileService.GetDatastorePath() + fmt.Sprintf("/compose/%d", stack.ID)
+
+	err = store.Stack().Create(stack)
+	require.NoError(t, err, "error creating stack")
+
+	// Create resource control for the stack
+	resourceControl := &portainer.ResourceControl{
+		ID:                 portainer.ResourceControlID(stack.ID),
+		ResourceID:         stackutils.ResourceControlID(stack.EndpointID, stack.Name),
+		Type:               portainer.StackResourceControl,
+		AdministratorsOnly: false,
+	}
+	err = store.ResourceControl().Create(resourceControl)
+	require.NoError(t, err, "error creating resource control")
+
+	// Store initial stack file
+	_, err = fileService.StoreStackFileFromBytes(
+		strconv.Itoa(int(stack.ID)),
+		stack.EntryPoint,
+		[]byte("version: '3'\nservices:\n  web:\n    image: nginx:v1"),
+	)
+	require.NoError(t, err, "error storing stack file")
+
+	// Create handler
+	handler := NewHandler(testhelpers.NewTestRequestBouncer())
+	handler.DataStore = store
+	handler.FileService = fileService
+	handler.StackDeployer = testhelpers.NewTestStackDeployer()
+	handler.ComposeStackManager = testhelpers.NewComposeStackManager()
+
+	// Create mock request with security context
+	jsonPayload, err := json.Marshal(payload)
+	require.NoError(t, err)
+
+	req := mockCreateStackRequestWithSecurityContext(
+		http.MethodPut,
+		fmt.Sprintf("/stacks/%d?endpointId=%d", stack.ID, endpoint.ID),
+		bytes.NewBuffer(jsonPayload),
+	)
+
+	return &updateStackInTxTestSetup{
+		store:           store,
+		fileService:     fileService,
+		handler:         handler,
+		user:            user,
+		endpoint:        endpoint,
+		stack:           stack,
+		resourceControl: resourceControl,
+		jsonPayload:     jsonPayload,
+		req:             req,
+	}
+}
+
+type swarmStackManager struct {
+	portainer.SwarmStackManager
+}
+
+func (manager swarmStackManager) NormalizeStackName(name string) string {
+	return name
+}
+
+func Test_updateSwarmStack_Prune(t *testing.T) {
+	t.Parallel()
+	fips.InitFIPS(false)
+
+	payload := &updateSwarmStackPayload{
+		StackFileContent: "version: '3'\nservices:\n  web:\n    image: nginx:latest",
+		Prune:            true,
+	}
+	stack := &portainer.Stack{
+		ID:         1,
+		Name:       "test-stack-prune",
+		EntryPoint: "docker-compose.yml",
+		Type:       portainer.DockerSwarmStack,
+	}
+	setup := setupUpdateStackInTxTest(t, stack, payload)
+	setup.handler.SwarmStackManager = swarmStackManager{}
+	deployer := testhelpers.NewTestStackDeployer()
+	setup.handler.StackDeployer = deployer
+
+	err := setup.store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		_, handlerErr := setup.handler.updateStackInTx(tx, setup.req, setup.stack.ID, setup.endpoint.ID)
+		if handlerErr != nil {
+			return handlerErr
+		}
+		return nil
+	})
+	require.NoError(t, err, "handler should accept Prune=true and succeed")
+
+	stored, err := setup.store.Stack().Read(setup.stack.ID)
+	require.NoError(t, err)
+	require.NotNil(t, stored.Option, "stack.Option should not be nil")
+	assert.True(t, stored.Option.Prune, "stack.Option.Prune should be persisted as true")
+
+	// Deploy runs asynchronously; wait for the goroutine to call the deployer
+	require.Eventually(t, func() bool {
+		return deployer.DeploySwarmCallCount == 1
+	}, 5*time.Second, 10*time.Millisecond, "DeploySwarmStack should be called exactly once")
+	assert.True(t, deployer.LastPrune, "deployer should be invoked with prune=true")
+}
+
+func Test_updateComposeStack_Prune(t *testing.T) {
+	t.Parallel()
+	fips.InitFIPS(false)
+
+	payload := &updateComposeStackPayload{
+		StackFileContent: "version: '3'\nservices:\n  web:\n    image: nginx:latest",
+		Prune:            true,
+	}
+	stack := &portainer.Stack{
+		ID:         1,
+		Name:       "test-stack-prune",
+		EntryPoint: "docker-compose.yml",
+		Type:       portainer.DockerComposeStack,
+	}
+	setup := setupUpdateStackInTxTest(t, stack, payload)
+	deployer := testhelpers.NewTestStackDeployer()
+	setup.handler.StackDeployer = deployer
+
+	err := setup.store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		_, handlerErr := setup.handler.updateStackInTx(tx, setup.req, setup.stack.ID, setup.endpoint.ID)
+		if handlerErr != nil {
+			return handlerErr
+		}
+		return nil
+	})
+	require.NoError(t, err, "handler should accept Prune=true and succeed")
+
+	stored, err := setup.store.Stack().Read(setup.stack.ID)
+	require.NoError(t, err)
+	require.NotNil(t, stored.Option, "stack.Option should not be nil")
+	assert.True(t, stored.Option.Prune, "stack.Option.Prune should be persisted as true")
+
+	// Deploy runs asynchronously; wait for the goroutine to call the deployer
+	require.Eventually(t, func() bool {
+		return deployer.DeployComposeCallCount == 1
+	}, 5*time.Second, 10*time.Millisecond, "DeployComposeStack should be called exactly once")
+	assert.True(t, deployer.LastPrune, "deployer should be invoked with prune=true")
+}
diff --git a/api/http/handler/stacks/update_kubernetes_stack.go b/api/http/handler/stacks/update_kubernetes_stack.go
new file mode 100644
index 0000000..6270eaf
--- /dev/null
+++ b/api/http/handler/stacks/update_kubernetes_stack.go
@@ -0,0 +1,206 @@
+package stacks
+
+import (
+	"context"
+	"net/http"
+	"os"
+	"strconv"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/dataservices/source"
+	"github.com/portainer/portainer/api/filesystem"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	"github.com/portainer/portainer/api/git/update"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/registryutils"
+	k "github.com/portainer/portainer/api/kubernetes"
+	"github.com/portainer/portainer/api/stacks/deployments"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+
+	"github.com/pkg/errors"
+	"github.com/rs/zerolog/log"
+)
+
+type kubernetesFileStackUpdatePayload struct {
+	StackFileContent string
+	// Name of the stack
+	StackName string
+}
+
+type kubernetesGitStackUpdatePayload struct {
+	RepositoryReferenceName  string
+	RepositoryAuthentication bool
+	RepositoryUsername       string
+	RepositoryPassword       string
+	AutoUpdate               *portainer.AutoUpdateSettings
+	TLSSkipVerify            bool
+}
+
+func (payload *kubernetesFileStackUpdatePayload) Validate(r *http.Request) error {
+	if len(payload.StackFileContent) == 0 {
+		return errors.New("Invalid stack file content")
+	}
+
+	return nil
+}
+
+func (payload *kubernetesGitStackUpdatePayload) Validate(r *http.Request) error {
+	if err := update.ValidateAutoUpdateSettings(payload.AutoUpdate); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (handler *Handler) updateKubernetesStack(tx dataservices.DataStoreTx, r *http.Request, stack *portainer.Stack, endpoint *portainer.Endpoint, gate *deployGate) *httperror.HandlerError {
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	userContext := source.NewUserContext(securityContext.User, securityContext.UserMemberships)
+	if stack.WorkflowID != 0 {
+		gitConfig, sourceID, err := loadGitConfigForStack(tx, userContext, stack.WorkflowID, stack.ID)
+		if err != nil {
+			return httperror.InternalServerError("Unable to load git config for stack", err)
+		}
+		if gitConfig == nil {
+			return httperror.InternalServerError("Stack has no git config in source", errors.New("source has no git config"))
+		}
+
+		// Stop the autoupdate job if there is any
+		if stack.AutoUpdate != nil {
+			deployments.StopAutoupdate(stack.ID, stack.AutoUpdate.JobID, handler.Scheduler)
+		}
+
+		var payload kubernetesGitStackUpdatePayload
+
+		if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+			return httperror.BadRequest("Invalid request payload", err)
+		}
+
+		gitConfig.ReferenceName = payload.RepositoryReferenceName
+		gitConfig.TLSSkipVerify = payload.TLSSkipVerify
+		stack.AutoUpdate = payload.AutoUpdate
+
+		if payload.RepositoryAuthentication {
+			password := payload.RepositoryPassword
+			if password == "" && gitConfig.Authentication != nil {
+				password = gitConfig.Authentication.Password
+			}
+
+			gitConfig.Authentication = &gittypes.GitAuthentication{
+				Username: payload.RepositoryUsername,
+				Password: password,
+			}
+
+			if _, err := handler.GitService.LatestCommitID(
+				context.TODO(),
+				gitConfig.URL,
+				gitConfig.ReferenceName,
+				gitConfig.Authentication.Username,
+				gitConfig.Authentication.Password,
+				gitConfig.TLSSkipVerify,
+			); err != nil {
+				return httperror.InternalServerError("Unable to fetch git repository", err)
+			}
+		} else {
+			gitConfig.Authentication = nil
+		}
+
+		if payload.AutoUpdate != nil && payload.AutoUpdate.Interval != "" {
+			jobID, e := deployments.StartAutoupdate(context.TODO(), stack.ID, stack.AutoUpdate.Interval, handler.Scheduler, handler.StackDeployer, handler.DataStore, handler.GitService)
+			if e != nil {
+				return e
+			}
+			stack.AutoUpdate.JobID = jobID
+		}
+
+		if err := saveStackGitConfig(tx, userContext, stack.WorkflowID, stack.ID, sourceID, 0, gitConfig); err != nil {
+			return httperror.InternalServerError("Unable to update source git config", err)
+		}
+
+		return nil
+	}
+
+	var payload kubernetesFileStackUpdatePayload
+
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	tokenData, err := security.RetrieveTokenData(r)
+	if err != nil {
+		return httperror.BadRequest("Failed to retrieve user token data", err)
+	}
+
+	tempFileDir, _ := os.MkdirTemp("", "kub_file_content")
+
+	if err := filesystem.WriteToFile(filesystem.JoinPaths(tempFileDir, stack.EntryPoint), []byte(payload.StackFileContent)); err != nil {
+		return httperror.InternalServerError("Failed to persist deployment file in a temp directory", err)
+	}
+
+	if payload.StackName != stack.Name {
+		stack.Name = payload.StackName
+		if err := handler.DataStore.Stack().Update(stack.ID, stack); err != nil {
+			return httperror.InternalServerError("Failed to update stack name", err)
+		}
+	}
+
+	// Refresh ECR registry secret if needed
+	// RefreshEcrSecret method checks if the namespace has any ECR registry
+	// otherwise return nil
+	cli, err := handler.KubernetesClientFactory.GetPrivilegedKubeClient(endpoint)
+	if err == nil {
+		if err := registryutils.RefreshEcrSecret(cli, endpoint, handler.DataStore, stack.Namespace); err != nil {
+			log.Warn().Err(err).Msg("failed to refresh ECR registry secret")
+		}
+	}
+
+	// Use temp dir as the stack project path for deployment
+	// so if the deployment failed, the original file won't be over-written
+	stack.ProjectPath = tempFileDir
+
+	appLabels := k.KubeAppLabels{
+		StackID:   int(stack.ID),
+		StackName: stack.Name,
+		Owner:     stack.CreatedBy,
+		Kind:      "content",
+	}
+
+	copyStack := *stack
+	user := &portainer.User{ID: tokenData.ID}
+	k8sDeploymentConfig := deployments.CreateKubernetesStackDeploymentConfig(&copyStack, handler.KubernetesDeployer, appLabels, user, endpoint)
+
+	stackFolder := strconv.Itoa(int(stack.ID))
+	projectPath, err := handler.FileService.UpdateStoreStackFileFromBytes(stackFolder, stack.EntryPoint, []byte(payload.StackFileContent))
+	if err != nil {
+		if rollbackErr := handler.FileService.RollbackStackFile(stackFolder, stack.EntryPoint); rollbackErr != nil {
+			log.Warn().Err(rollbackErr).Msg("rollback stack file error")
+		}
+
+		return httperror.InternalServerError("Unable to persist Kubernetes Manifest file on disk", err)
+	}
+	stack.ProjectPath = projectPath
+
+	postDeploy := func(ctx context.Context, deployErr error) {
+		defer func() {
+			if err := os.RemoveAll(tempFileDir); err != nil {
+				log.Warn().Err(err).Msg("failed to remove temporary stack deployment directory")
+			}
+		}()
+
+		if deployErr == nil {
+			if err := handler.FileService.RemoveStackFileBackup(stackFolder, stack.EntryPoint); err != nil {
+				log.Warn().Err(err).Msg("remove stack file backup error")
+			}
+		}
+	}
+
+	go stackDeploy(handler.DataStore, copyStack.ID, k8sDeploymentConfig, gate, postDeploy)
+
+	return nil
+}
diff --git a/api/http/handler/stacks/webhook_invoke.go b/api/http/handler/stacks/webhook_invoke.go
new file mode 100644
index 0000000..b3ec5d0
--- /dev/null
+++ b/api/http/handler/stacks/webhook_invoke.go
@@ -0,0 +1,71 @@
+package stacks
+
+import (
+	"context"
+	"errors"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/stacks/deployments"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+
+	"github.com/google/uuid"
+)
+
+// @id WebhookInvoke
+// @summary Webhook for triggering stack updates from git
+// @description **Access policy**: public
+// @tags stacks
+// @param webhookID path string true "Stack identifier"
+// @success 200 "Success"
+// @failure 400 "Invalid request"
+// @failure 409 "Autoupdate for the stack isn't available" or "Stack deployment is already in progress"
+// @failure 500 "Server error"
+// @router /stacks/webhooks/{webhookID} [post]
+func (handler *Handler) webhookInvoke(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	webhookID, err := retrieveUUIDRouteVariableValue(r, "webhookID")
+	if err != nil {
+		return httperror.BadRequest("Invalid webhook identifier route variable", err)
+	}
+
+	stack, err := handler.DataStore.Stack().StackByWebhookID(webhookID.String())
+	if err != nil {
+		statusCode := http.StatusInternalServerError
+		if handler.DataStore.IsErrObjectNotFound(err) {
+			statusCode = http.StatusNotFound
+		}
+
+		return httperror.NewError(statusCode, "Unable to find the stack by webhook ID", err)
+	}
+
+	if stack.Status == portainer.StackStatusDeploying {
+		return httperror.Conflict("Unable to update stack", errors.New("Stack deployment is already in progress"))
+	}
+
+	if err = deployments.RedeployWhenChanged(context.TODO(), stack.ID, handler.StackDeployer, handler.DataStore, handler.GitService); err != nil {
+		var StackAuthorMissingErr *deployments.StackAuthorMissingErr
+		if errors.As(err, &StackAuthorMissingErr) {
+			return httperror.Conflict("Autoupdate for the stack isn't available", err)
+		}
+
+		return httperror.InternalServerError("Failed to update the stack", err)
+	}
+
+	return response.Empty(w)
+}
+
+func retrieveUUIDRouteVariableValue(r *http.Request, name string) (uuid.UUID, error) {
+	webhookID, err := request.RetrieveRouteVariableValue(r, name)
+	if err != nil {
+		return uuid.Nil, err
+	}
+
+	uid, err := uuid.Parse(webhookID)
+	if err != nil {
+		return uuid.Nil, err
+	}
+
+	return uid, nil
+}
diff --git a/api/http/handler/stacks/webhook_invoke_test.go b/api/http/handler/stacks/webhook_invoke_test.go
new file mode 100644
index 0000000..49a8eec
--- /dev/null
+++ b/api/http/handler/stacks/webhook_invoke_test.go
@@ -0,0 +1,64 @@
+package stacks
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestHandler_webhookInvoke(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	webhookID := newGuidString(t)
+	err := store.StackService.Create(&portainer.Stack{
+		ID: 1,
+		AutoUpdate: &portainer.AutoUpdateSettings{
+			Webhook: webhookID,
+		},
+	})
+	require.NoError(t, err)
+
+	h := NewHandler(testhelpers.NewTestRequestBouncer())
+	h.DataStore = store
+
+	t.Run("invalid uuid results in http.StatusBadRequest", func(t *testing.T) {
+		w := httptest.NewRecorder()
+		req := newRequest("notuuid")
+		h.ServeHTTP(w, req)
+		assert.Equal(t, http.StatusBadRequest, w.Code)
+	})
+
+	t.Run("registered webhook ID in http.StatusNoContent", func(t *testing.T) {
+		w := httptest.NewRecorder()
+		req := newRequest(webhookID)
+		h.ServeHTTP(w, req)
+		assert.Equal(t, http.StatusNoContent, w.Code)
+	})
+
+	t.Run("unregistered webhook ID in http.StatusNotFound", func(t *testing.T) {
+		w := httptest.NewRecorder()
+		req := newRequest(newGuidString(t))
+		h.ServeHTTP(w, req)
+		assert.Equal(t, http.StatusNotFound, w.Code)
+	})
+}
+
+func newGuidString(t *testing.T) string {
+	uuid, err := uuid.NewRandom()
+	require.NoError(t, err)
+
+	return uuid.String()
+}
+
+func newRequest(webhookID string) *http.Request {
+	return httptest.NewRequest(http.MethodPost, "/stacks/webhooks/"+webhookID, nil)
+}
diff --git a/api/http/handler/storybook/handler.go b/api/http/handler/storybook/handler.go
new file mode 100644
index 0000000..55bd28a
--- /dev/null
+++ b/api/http/handler/storybook/handler.go
@@ -0,0 +1,23 @@
+package storybook
+
+import (
+	"net/http"
+	"path"
+)
+
+// Handler represents an HTTP API handler for managing static files.
+type Handler struct {
+	http.Handler
+}
+
+// NewHandler creates a handler to serve static files.
+func NewHandler(assetsPath string) *Handler {
+	h := &Handler{
+		http.FileServer(http.Dir(path.Join(assetsPath, "storybook"))),
+	}
+	return h
+}
+
+func (handler *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	handler.Handler.ServeHTTP(w, r)
+}
diff --git a/api/http/handler/system/handler.go b/api/http/handler/system/handler.go
new file mode 100644
index 0000000..4cab433
--- /dev/null
+++ b/api/http/handler/system/handler.go
@@ -0,0 +1,64 @@
+package system
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/upgrade"
+	"github.com/portainer/portainer/api/platform"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+
+	"github.com/gorilla/mux"
+)
+
+// Handler is the HTTP handler used to handle status operations.
+type Handler struct {
+	*mux.Router
+	status          *portainer.Status
+	dataStore       dataservices.DataStore
+	upgradeService  upgrade.Service
+	platformService platform.Service
+}
+
+// NewHandler creates a handler to manage status operations.
+func NewHandler(bouncer security.BouncerService,
+	status *portainer.Status,
+	dataStore dataservices.DataStore,
+	platformService platform.Service,
+	upgradeService upgrade.Service) *Handler {
+
+	h := &Handler{
+		Router:          mux.NewRouter(),
+		dataStore:       dataStore,
+		status:          status,
+		upgradeService:  upgradeService,
+		platformService: platformService,
+	}
+
+	router := h.PathPrefix("/system").Subrouter()
+
+	adminRouter := router.PathPrefix("/").Subrouter()
+	adminRouter.Use(bouncer.AdminAccess)
+
+	adminRouter.Handle("/upgrade", httperror.LoggerHandler(h.systemUpgrade)).Methods(http.MethodPost)
+
+	authenticatedRouter := router.PathPrefix("/").Subrouter()
+	authenticatedRouter.Use(bouncer.AuthenticatedAccess)
+
+	authenticatedRouter.Handle("/version", httperror.LoggerHandler(h.version)).Methods(http.MethodGet)
+	authenticatedRouter.Handle("/nodes", httperror.LoggerHandler(h.systemNodesCount)).Methods(http.MethodGet)
+	authenticatedRouter.Handle("/info", httperror.LoggerHandler(h.systemInfo)).Methods(http.MethodGet)
+
+	publicRouter := router.PathPrefix("/").Subrouter()
+	publicRouter.Use(bouncer.PublicAccess)
+
+	publicRouter.Handle("/status", httperror.LoggerHandler(h.systemStatus)).Methods(http.MethodGet)
+
+	// Deprecated /status endpoint, will be removed in the future.
+	h.Handle("/status",
+		bouncer.PublicAccess(httperror.LoggerHandler(h.statusInspectDeprecated))).Methods(http.MethodGet)
+
+	return h
+}
diff --git a/api/http/handler/system/nodes_count.go b/api/http/handler/system/nodes_count.go
new file mode 100644
index 0000000..7d150d9
--- /dev/null
+++ b/api/http/handler/system/nodes_count.go
@@ -0,0 +1,44 @@
+package system
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	statusutil "github.com/portainer/portainer/api/internal/nodes"
+	"github.com/portainer/portainer/api/internal/snapshot"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type nodesCountResponse struct {
+	Nodes int `json:"nodes"`
+}
+
+// @id systemNodesCount
+// @summary Retrieve the count of nodes
+// @description **Access policy**: authenticated
+// @security ApiKeyAuth
+// @security jwt
+// @tags system
+// @produce json
+// @success 200 {object} nodesCountResponse "Success"
+// @failure 500 "Server error"
+// @router /system/nodes [get]
+func (handler *Handler) systemNodesCount(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	endpoints, err := handler.dataStore.Endpoint().Endpoints()
+	if err != nil {
+		return httperror.InternalServerError("Failed to get environment list", err)
+	}
+
+	var nodes int
+
+	for _, endpoint := range endpoints {
+		if err := snapshot.FillSnapshotData(handler.dataStore, &endpoint, false); err != nil {
+			return httperror.InternalServerError("Unable to add snapshot data", err)
+		}
+
+		nodes += statusutil.NodesCount([]portainer.Endpoint{endpoint})
+	}
+
+	return response.JSON(w, &nodesCountResponse{Nodes: nodes})
+}
diff --git a/api/http/handler/system/status.go b/api/http/handler/system/status.go
new file mode 100644
index 0000000..ff42518
--- /dev/null
+++ b/api/http/handler/system/status.go
@@ -0,0 +1,46 @@
+package system
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+
+	"github.com/rs/zerolog/log"
+)
+
+type status struct {
+	*portainer.Status
+}
+
+// @id systemStatus
+// @summary Check Portainer status
+// @description Retrieve Portainer status
+// @description **Access policy**: public
+// @tags system
+// @produce json
+// @success 200 {object} status "Success"
+// @router /system/status [get]
+func (handler *Handler) systemStatus(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	return response.JSON(w, &status{
+		Status: handler.status,
+	})
+}
+
+// swagger docs for deprecated route:
+// @id StatusInspect
+// @summary Check Portainer status
+// @deprecated
+// @description Deprecated: use the `/system/status` endpoint instead.
+// @description Retrieve Portainer status
+// @description **Access policy**: public
+// @tags status
+// @produce json
+// @success 200 {object} status "Success"
+// @router /status [get]
+func (handler *Handler) statusInspectDeprecated(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	log.Warn().Msg("The /status endpoint is deprecated and will be removed in a future version of Portainer. Please use the /system/status endpoint instead.")
+
+	return handler.systemStatus(w, r)
+}
diff --git a/api/http/handler/system/system_info.go b/api/http/handler/system/system_info.go
new file mode 100644
index 0000000..64a9153
--- /dev/null
+++ b/api/http/handler/system/system_info.go
@@ -0,0 +1,63 @@
+package system
+
+import (
+	"net/http"
+
+	"github.com/pkg/errors"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+	plf "github.com/portainer/portainer/api/platform"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type systemInfoResponse struct {
+	Platform   plf.ContainerPlatform `json:"platform"`
+	EdgeAgents int                   `json:"edgeAgents"`
+	Agents     int                   `json:"agents"`
+}
+
+// @id systemInfo
+// @summary Retrieve system info
+// @description **Access policy**: authenticated
+// @security ApiKeyAuth
+// @security jwt
+// @tags system
+// @produce json
+// @success 200 {object} systemInfoResponse "Success"
+// @failure 500 "Server error"
+// @router /system/info [get]
+func (handler *Handler) systemInfo(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	environments, err := handler.dataStore.Endpoint().Endpoints()
+	if err != nil {
+		return httperror.InternalServerError("Failed to get environment list", err)
+	}
+
+	agents := 0
+	edgeAgents := 0
+
+	for _, environment := range environments {
+		if endpointutils.IsAgentEndpoint(&environment) {
+			agents++
+		}
+
+		if endpointutils.IsEdgeEndpoint(&environment) {
+			edgeAgents++
+		}
+	}
+
+	platform, err := handler.platformService.GetPlatform()
+	if err != nil {
+		if !errors.Is(err, plf.ErrNoLocalEnvironment) {
+			return httperror.InternalServerError("Failed to get platform", err)
+		}
+		// If no local environment is detected, we assume the platform is Docker
+		// UI will stop showing the upgrade banner
+		platform = plf.PlatformDocker
+	}
+
+	return response.JSON(w, &systemInfoResponse{
+		EdgeAgents: edgeAgents,
+		Agents:     agents,
+		Platform:   platform,
+	})
+}
diff --git a/api/http/handler/system/system_upgrade.go b/api/http/handler/system/system_upgrade.go
new file mode 100644
index 0000000..8eb4141
--- /dev/null
+++ b/api/http/handler/system/system_upgrade.go
@@ -0,0 +1,65 @@
+package system
+
+import (
+	"net/http"
+	"regexp"
+
+	ceplf "github.com/portainer/portainer/api/platform"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+
+	"github.com/pkg/errors"
+)
+
+type systemUpgradePayload struct {
+	License string
+}
+
+var re = regexp.MustCompile(`^\d-.+`)
+
+func (payload *systemUpgradePayload) Validate(r *http.Request) error {
+	if payload.License == "" {
+		return errors.New("license is missing")
+	}
+
+	if !re.MatchString(payload.License) {
+		return errors.New("license is invalid")
+	}
+
+	return nil
+}
+
+// @id systemUpgrade
+// @summary Upgrade Portainer to BE
+// @description Upgrade Portainer to BE
+// @description **Access policy**: administrator
+// @tags system
+// @produce json
+// @success 204 {object} status "Success"
+// @router /system/upgrade [post]
+func (handler *Handler) systemUpgrade(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	payload, err := request.GetPayload[systemUpgradePayload](r)
+	if err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	environment, err := handler.platformService.GetLocalEnvironment()
+	if err != nil {
+		if errors.Is(err, ceplf.ErrNoLocalEnvironment) {
+			return httperror.NotFound("The system upgrade feature is disabled because no local environment was detected.", err)
+		}
+		return httperror.InternalServerError("Failed to get local environment", err)
+	}
+
+	platform, err := handler.platformService.GetPlatform()
+	if err != nil {
+		return httperror.InternalServerError("Failed to get platform", err)
+	}
+
+	if err := handler.upgradeService.Upgrade(platform, environment, payload.License); err != nil {
+		return httperror.InternalServerError("Failed to upgrade Portainer", err)
+	}
+
+	return response.Empty(w)
+}
diff --git a/api/http/handler/system/version.go b/api/http/handler/system/version.go
new file mode 100644
index 0000000..ca9f193
--- /dev/null
+++ b/api/http/handler/system/version.go
@@ -0,0 +1,113 @@
+package system
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/client"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/pkg/build"
+	libclient "github.com/portainer/portainer/pkg/libhttp/client"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+
+	"github.com/Masterminds/semver/v3"
+	"github.com/rs/zerolog/log"
+	"github.com/segmentio/encoding/json"
+)
+
+type versionResponse struct {
+	// Whether portainer has an update available
+	UpdateAvailable bool `json:"UpdateAvailable" example:"false"`
+	// The latest version available
+	LatestVersion string `json:"LatestVersion" example:"2.0.0"`
+
+	ServerVersion   string
+	VersionSupport  string `json:"VersionSupport" example:"STS/LTS"`
+	ServerEdition   string `json:"ServerEdition" example:"CE/EE"`
+	DatabaseVersion string
+	Build           build.BuildInfo
+	Dependencies    build.DependenciesInfo
+	Runtime         build.RuntimeInfo
+}
+
+// @id systemVersion
+// @summary Check for portainer updates
+// @description Check if portainer has an update available
+// @description **Access policy**: authenticated
+// @security ApiKeyAuth
+// @security jwt
+// @tags system
+// @produce json
+// @success 200 {object} versionResponse "Success"
+// @router /system/version [get]
+func (handler *Handler) version(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	isAdmin, err := security.IsAdmin(r)
+	if err != nil {
+		return httperror.Forbidden("Permission denied to access Portainer", err)
+	}
+
+	result := &versionResponse{
+		ServerVersion:   portainer.APIVersion,
+		VersionSupport:  portainer.APIVersionSupport,
+		DatabaseVersion: portainer.APIVersion,
+		ServerEdition:   portainer.Edition.GetEditionLabel(),
+		Build:           build.GetBuildInfo(),
+		Dependencies:    build.GetDependenciesInfo(),
+	}
+
+	if isAdmin {
+		result.Runtime = build.GetRuntimeInfo()
+	}
+
+	latestVersion := GetLatestVersion()
+	if HasNewerVersion(portainer.APIVersion, latestVersion) {
+		result.UpdateAvailable = true
+		result.LatestVersion = latestVersion
+	}
+
+	return response.JSON(w, &result)
+}
+
+func GetLatestVersion() string {
+	if err := libclient.ExternalRequestDisabled(portainer.VersionCheckURL); err != nil {
+		log.Debug().Err(err).Msg("External request disabled: Version check")
+		return ""
+	}
+
+	motd, err := client.Get(portainer.VersionCheckURL, 5)
+	if err != nil {
+		log.Debug().Err(err).Msg("couldn't fetch latest Portainer release version")
+		return ""
+	}
+
+	var data struct {
+		TagName string `json:"tag_name"`
+	}
+
+	if err := json.Unmarshal(motd, &data); err != nil {
+		log.Debug().Err(err).Msg("couldn't parse latest Portainer version")
+
+		return ""
+	}
+
+	return data.TagName
+}
+
+func HasNewerVersion(currentVersion, latestVersion string) bool {
+	currentVersionSemver, err := semver.NewVersion(currentVersion)
+	if err != nil {
+		log.Debug().Str("version", currentVersion).Msg("current Portainer version isn't a semver")
+
+		return false
+	}
+
+	latestVersionSemver, err := semver.NewVersion(latestVersion)
+	if err != nil {
+		log.Debug().Str("version", latestVersion).Msg("latest Portainer version isn't a semver")
+
+		return false
+	}
+
+	return currentVersionSemver.LessThan(latestVersionSemver)
+}
diff --git a/api/http/handler/system/version_test.go b/api/http/handler/system/version_test.go
new file mode 100644
index 0000000..383b952
--- /dev/null
+++ b/api/http/handler/system/version_test.go
@@ -0,0 +1,68 @@
+package system
+
+import (
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/apikey"
+	"github.com/portainer/portainer/api/database/models"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+	"github.com/portainer/portainer/api/jwt"
+
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_getSystemVersion(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	_, store := datastore.MustNewTestStore(t, true, true)
+
+	// create version data
+	version := &models.Version{SchemaVersion: "2.20.0", Edition: 1}
+	err := store.Version().UpdateVersion(version)
+	require.NoError(t, err, "error creating version data")
+
+	// create admin and standard user(s)
+	adminUser := &portainer.User{ID: 1, Username: "admin", Role: portainer.AdministratorRole}
+	err = store.User().Create(adminUser)
+	require.NoError(t, err, "error creating admin user")
+
+	// setup services
+	jwtService, err := jwt.NewService("1h", store)
+	require.NoError(t, err, "Error initiating jwt service")
+
+	apiKeyService := apikey.NewAPIKeyService(store.APIKeyRepository(), store.User())
+	requestBouncer := security.NewRequestBouncer(t.Context(), store, jwtService, apiKeyService)
+
+	h := NewHandler(requestBouncer, &portainer.Status{}, store, nil, nil)
+
+	// generate standard and admin user tokens
+	jwt, _, _ := jwtService.GenerateToken(&portainer.TokenData{ID: adminUser.ID, Username: adminUser.Username, Role: adminUser.Role})
+
+	t.Run("Display Edition", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodGet, "/system/version", nil)
+		testhelpers.AddTestSecurityCookie(req, jwt)
+
+		rr := httptest.NewRecorder()
+		h.ServeHTTP(rr, req)
+
+		is.Equal(http.StatusOK, rr.Code)
+
+		body, err := io.ReadAll(rr.Body)
+		require.NoError(t, err, "ReadAll should not return error")
+
+		var resp versionResponse
+		err = json.Unmarshal(body, &resp)
+		require.NoError(t, err, "response should be list json")
+
+		is.Equal("CE", resp.ServerEdition, "Edition is not expected")
+	})
+}
diff --git a/api/http/handler/tags/handler.go b/api/http/handler/tags/handler.go
new file mode 100644
index 0000000..3dbac0c
--- /dev/null
+++ b/api/http/handler/tags/handler.go
@@ -0,0 +1,32 @@
+package tags
+
+import (
+	"net/http"
+
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+
+	"github.com/gorilla/mux"
+)
+
+// Handler is the HTTP handler used to handle tag operations.
+type Handler struct {
+	*mux.Router
+	DataStore dataservices.DataStore
+}
+
+// NewHandler creates a handler to manage tag operations.
+func NewHandler(bouncer security.BouncerService) *Handler {
+	h := &Handler{
+		Router: mux.NewRouter(),
+	}
+	h.Handle("/tags",
+		bouncer.AdminAccess(httperror.LoggerHandler(h.tagCreate))).Methods(http.MethodPost)
+	h.Handle("/tags",
+		bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.tagList))).Methods(http.MethodGet)
+	h.Handle("/tags/{id}",
+		bouncer.AdminAccess(httperror.LoggerHandler(h.tagDelete))).Methods(http.MethodDelete)
+
+	return h
+}
diff --git a/api/http/handler/tags/tag_create.go b/api/http/handler/tags/tag_create.go
new file mode 100644
index 0000000..60d72fc
--- /dev/null
+++ b/api/http/handler/tags/tag_create.go
@@ -0,0 +1,80 @@
+package tags
+
+import (
+	"errors"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type tagCreatePayload struct {
+	Name string `validate:"required" example:"org/acme"`
+}
+
+func (payload *tagCreatePayload) Validate(r *http.Request) error {
+	if len(payload.Name) == 0 {
+		return errors.New("invalid tag name")
+	}
+
+	return nil
+}
+
+// @id TagCreate
+// @summary Create a new tag
+// @description Create a new tag.
+// @description **Access policy**: administrator
+// @tags tags
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @produce json
+// @param body body tagCreatePayload true "Tag details"
+// @success 200 {object} portainer.Tag "Success"
+// @failure 409 "This name is already associated to a tag"
+// @failure 500 "Server error"
+// @router /tags [post]
+func (handler *Handler) tagCreate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	var payload tagCreatePayload
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	var tag *portainer.Tag
+	var err error
+	err = handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		tag, err = createTag(tx, payload)
+		return err
+	})
+
+	return response.TxResponse(w, tag, err)
+}
+
+func createTag(tx dataservices.DataStoreTx, payload tagCreatePayload) (*portainer.Tag, error) {
+	tags, err := tx.Tag().ReadAll()
+	if err != nil {
+		return nil, httperror.InternalServerError("Unable to retrieve tags from the database", err)
+	}
+
+	for _, tag := range tags {
+		if tag.Name == payload.Name {
+			return nil, httperror.Conflict("This name is already associated to a tag", errors.New("a tag already exists with this name"))
+		}
+	}
+
+	tag := &portainer.Tag{
+		Name:           payload.Name,
+		EndpointGroups: map[portainer.EndpointGroupID]bool{},
+		Endpoints:      map[portainer.EndpointID]bool{},
+	}
+
+	err = tx.Tag().Create(tag)
+	if err != nil {
+		return nil, httperror.InternalServerError("Unable to persist the tag inside the database", err)
+	}
+
+	return tag, nil
+}
diff --git a/api/http/handler/tags/tag_delete.go b/api/http/handler/tags/tag_delete.go
new file mode 100644
index 0000000..afc6127
--- /dev/null
+++ b/api/http/handler/tags/tag_delete.go
@@ -0,0 +1,174 @@
+package tags
+
+import (
+	"net/http"
+	"slices"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/internal/edge"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id TagDelete
+// @summary Remove a tag
+// @description Remove a tag.
+// @description **Access policy**: administrator
+// @tags tags
+// @security ApiKeyAuth
+// @security jwt
+// @param id path int true "Tag identifier"
+// @success 204 "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied"
+// @failure 404 "Tag not found"
+// @failure 500 "Server error"
+// @router /tags/{id} [delete]
+func (handler *Handler) tagDelete(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	id, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid tag identifier route variable", err)
+	}
+
+	err = handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return deleteTag(tx, portainer.TagID(id))
+	})
+
+	return response.TxEmptyResponse(w, err)
+}
+
+func deleteTag(tx dataservices.DataStoreTx, tagID portainer.TagID) error {
+	tag, err := tx.Tag().Read(tagID)
+	if tx.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find a tag with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find a tag with the specified identifier inside the database", err)
+	}
+
+	for endpointID := range tag.Endpoints {
+		endpoint, err := tx.Endpoint().Endpoint(endpointID)
+		if tx.IsErrObjectNotFound(err) {
+			continue
+		}
+		if err != nil {
+			return httperror.InternalServerError("Unable to retrieve environment from the database", err)
+		}
+
+		endpoint.TagIDs = slices.DeleteFunc(endpoint.TagIDs, func(t portainer.TagID) bool {
+			return t == tagID
+		})
+
+		err = tx.Endpoint().UpdateEndpoint(endpoint.ID, endpoint)
+		if err != nil {
+			return httperror.InternalServerError("Unable to update environment", err)
+		}
+	}
+
+	for endpointGroupID := range tag.EndpointGroups {
+		endpointGroup, err := tx.EndpointGroup().Read(endpointGroupID)
+		if err != nil {
+			return httperror.InternalServerError("Unable to retrieve environment group from the database", err)
+		}
+
+		endpointGroup.TagIDs = slices.DeleteFunc(endpointGroup.TagIDs, func(t portainer.TagID) bool {
+			return t == tagID
+		})
+
+		err = tx.EndpointGroup().Update(endpointGroup.ID, endpointGroup)
+		if err != nil {
+			return httperror.InternalServerError("Unable to update environment group", err)
+		}
+	}
+
+	endpoints, err := tx.Endpoint().Endpoints()
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve environments from the database", err)
+	}
+
+	edgeGroups, err := tx.EdgeGroup().ReadAll()
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve edge groups from the database", err)
+	}
+
+	edgeStacks, err := tx.EdgeStack().EdgeStacks()
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve edge stacks from the database", err)
+	}
+
+	edgeJobs, err := tx.EdgeJob().ReadAll()
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve edge job configurations from the database", err)
+	}
+	for _, edgeGroup := range edgeGroups {
+		edgeGroup.TagIDs = slices.DeleteFunc(edgeGroup.TagIDs, func(t portainer.TagID) bool {
+			return t == tagID
+		})
+
+		err = tx.EdgeGroup().Update(edgeGroup.ID, &edgeGroup)
+		if err != nil {
+			return httperror.InternalServerError("Unable to update edge group", err)
+		}
+	}
+
+	for _, endpoint := range endpoints {
+		if (!tag.Endpoints[endpoint.ID] && !tag.EndpointGroups[endpoint.GroupID]) || !endpointutils.IsEdgeEndpoint(&endpoint) {
+			continue
+		}
+
+		if err := updateEndpointRelations(tx, endpoint, edgeGroups, edgeStacks, edgeJobs); err != nil {
+			return httperror.InternalServerError("Unable to update environment relations in the database", err)
+		}
+	}
+
+	err = tx.Tag().Delete(tagID)
+	if err != nil {
+		return httperror.InternalServerError("Unable to remove the tag from the database", err)
+	}
+
+	return nil
+}
+
+func updateEndpointRelations(tx dataservices.DataStoreTx, endpoint portainer.Endpoint, edgeGroups []portainer.EdgeGroup, edgeStacks []portainer.EdgeStack, edgeJobs []portainer.EdgeJob) error {
+	endpointRelation, err := tx.EndpointRelation().EndpointRelation(endpoint.ID)
+	if err != nil {
+		return err
+	}
+
+	endpointGroup, err := tx.EndpointGroup().Read(endpoint.GroupID)
+	if err != nil {
+		return err
+	}
+
+	endpointStacks := edge.EndpointRelatedEdgeStacks(&endpoint, endpointGroup, edgeGroups, edgeStacks)
+	stacksSet := map[portainer.EdgeStackID]bool{}
+	for _, edgeStackID := range endpointStacks {
+		stacksSet[edgeStackID] = true
+	}
+
+	endpointRelation.EdgeStacks = stacksSet
+
+	if err := tx.EndpointRelation().UpdateEndpointRelation(endpoint.ID, endpointRelation); err != nil {
+		return err
+	}
+
+	for _, edgeJob := range edgeJobs {
+		endpoints, err := edge.GetEndpointsFromEdgeGroups(edgeJob.EdgeGroups, tx)
+		if err != nil {
+			return err
+		}
+		if slices.Contains(endpoints, endpoint.ID) {
+			continue
+		}
+
+		delete(edgeJob.GroupLogsCollection, endpoint.ID)
+
+		if err := tx.EdgeJob().Update(edgeJob.ID, &edgeJob); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
diff --git a/api/http/handler/tags/tag_delete_test.go b/api/http/handler/tags/tag_delete_test.go
new file mode 100644
index 0000000..bb8fb61
--- /dev/null
+++ b/api/http/handler/tags/tag_delete_test.go
@@ -0,0 +1,210 @@
+package tags
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"sync"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	portainerDsErrors "github.com/portainer/portainer/api/dataservices/errors"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+	"github.com/portainer/portainer/api/roar"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestTagDeleteEdgeGroupsConcurrently(t *testing.T) {
+	t.Parallel()
+	const tagsCount = 100
+
+	handler, store := setUpHandler(t)
+	// Create all the tags and add them to the same edge group
+
+	var tagIDs []portainer.TagID
+
+	for i := range tagsCount {
+		tagID := portainer.TagID(i) + 1
+
+		if err := store.Tag().Create(&portainer.Tag{
+			ID:   tagID,
+			Name: "tag-" + strconv.Itoa(int(tagID)),
+		}); err != nil {
+			t.Fatal("could not create tag:", err)
+		}
+
+		tagIDs = append(tagIDs, tagID)
+	}
+
+	if err := store.EdgeGroup().Create(&portainer.EdgeGroup{
+		ID:     1,
+		Name:   "edgegroup-1",
+		TagIDs: tagIDs,
+	}); err != nil {
+		t.Fatal("could not create edge group:", err)
+	}
+
+	// Remove the tags concurrently
+
+	var wg sync.WaitGroup
+
+	wg.Add(len(tagIDs))
+
+	for _, tagID := range tagIDs {
+		go func(ID portainer.TagID) {
+			defer wg.Done()
+
+			req, err := http.NewRequest(http.MethodDelete, "/tags/"+strconv.Itoa(int(ID)), nil)
+			if err != nil {
+				t.Fail()
+				return
+			}
+
+			rec := httptest.NewRecorder()
+			handler.ServeHTTP(rec, req)
+		}(tagID)
+	}
+
+	wg.Wait()
+
+	// Check that the edge group is consistent
+
+	edgeGroup, err := handler.DataStore.EdgeGroup().Read(1)
+	if err != nil {
+		t.Fatal("could not retrieve the edge group:", err)
+	}
+
+	if len(edgeGroup.TagIDs) > 0 {
+		t.Fatal("the edge group is not consistent")
+	}
+}
+
+func TestHandler_tagDelete(t *testing.T) {
+	t.Parallel()
+	t.Run("should delete tag and update related endpoints and edge groups", func(t *testing.T) {
+		handler, store := setUpHandler(t)
+
+		tag := &portainer.Tag{
+			ID:             1,
+			Name:           "tag-1",
+			Endpoints:      make(map[portainer.EndpointID]bool),
+			EndpointGroups: make(map[portainer.EndpointGroupID]bool),
+		}
+		require.NoError(t, store.Tag().Create(tag))
+
+		endpointGroup := &portainer.EndpointGroup{
+			ID:     2,
+			Name:   "endpoint-group-1",
+			TagIDs: []portainer.TagID{tag.ID},
+		}
+		require.NoError(t, store.EndpointGroup().Create(endpointGroup))
+
+		endpoint1 := &portainer.Endpoint{
+			ID:      1,
+			Name:    "endpoint-1",
+			GroupID: endpointGroup.ID,
+		}
+		require.NoError(t, store.Endpoint().Create(endpoint1))
+
+		endpoint2 := &portainer.Endpoint{
+			ID:     2,
+			Name:   "endpoint-2",
+			TagIDs: []portainer.TagID{tag.ID},
+		}
+		require.NoError(t, store.Endpoint().Create(endpoint2))
+
+		tag.Endpoints[endpoint2.ID] = true
+		tag.EndpointGroups[endpointGroup.ID] = true
+		require.NoError(t, store.Tag().Update(tag.ID, tag))
+
+		dynamicEdgeGroup := &portainer.EdgeGroup{
+			ID:      1,
+			Name:    "edgegroup-1",
+			TagIDs:  []portainer.TagID{tag.ID},
+			Dynamic: true,
+		}
+		require.NoError(t, store.EdgeGroup().Create(dynamicEdgeGroup))
+
+		staticEdgeGroup := &portainer.EdgeGroup{
+			ID:          2,
+			Name:        "edgegroup-2",
+			EndpointIDs: roar.FromSlice([]portainer.EndpointID{endpoint2.ID}),
+		}
+		require.NoError(t, store.EdgeGroup().Create(staticEdgeGroup))
+
+		req, err := http.NewRequest(http.MethodDelete, "/tags/"+strconv.Itoa(int(tag.ID)), nil)
+		if err != nil {
+			t.Fail()
+
+			return
+		}
+
+		rec := httptest.NewRecorder()
+		handler.ServeHTTP(rec, req)
+
+		require.Equal(t, http.StatusNoContent, rec.Code)
+
+		// Check that the tag is deleted
+		_, err = store.Tag().Read(tag.ID)
+		require.ErrorIs(t, err, portainerDsErrors.ErrObjectNotFound)
+
+		// Check that the endpoints are updated
+		endpoint1, err = store.Endpoint().Endpoint(endpoint1.ID)
+		require.NoError(t, err)
+		assert.Empty(t, endpoint1.TagIDs, "endpoint-1 should not have any tags")
+		assert.Equal(t, endpoint1.GroupID, endpointGroup.ID, "endpoint-1 should still belong to the endpoint group")
+
+		endpoint2, err = store.Endpoint().Endpoint(endpoint2.ID)
+		require.NoError(t, err)
+		assert.Empty(t, endpoint2.TagIDs, "endpoint-2 should not have any tags")
+
+		// Check that the dynamic edge group is updated
+		dynamicEdgeGroup, err = store.EdgeGroup().Read(dynamicEdgeGroup.ID)
+		require.NoError(t, err)
+		assert.Empty(t, dynamicEdgeGroup.TagIDs, "dynamic edge group should not have any tags")
+		assert.Equal(t, 0, dynamicEdgeGroup.EndpointIDs.Len(), "dynamic edge group should not have any endpoints")
+
+		// Check that the static edge group is not updated
+		staticEdgeGroup, err = store.EdgeGroup().Read(staticEdgeGroup.ID)
+		require.NoError(t, err)
+		assert.Empty(t, staticEdgeGroup.TagIDs, "static edge group should not have any tags")
+		assert.Equal(t, 1, staticEdgeGroup.EndpointIDs.Len(), "static edge group should have one endpoint")
+		assert.True(t, staticEdgeGroup.EndpointIDs.Contains(endpoint2.ID), "static edge group should have the endpoint-2")
+	})
+
+	// Test the tx.IsErrObjectNotFound logic when endpoint is not found during cleanup
+	t.Run("should continue gracefully when endpoint not found during cleanup", func(t *testing.T) {
+		_, store := setUpHandler(t)
+		// Create a tag with a reference to a non-existent endpoint
+		tag := &portainer.Tag{
+			ID:             1,
+			Name:           "test-tag",
+			Endpoints:      map[portainer.EndpointID]bool{999: true}, // Non-existent endpoint
+			EndpointGroups: make(map[portainer.EndpointGroupID]bool),
+		}
+
+		err := store.Tag().Create(tag)
+		require.NoError(t, err)
+
+		err = deleteTag(store, 1)
+		require.NoError(t, err)
+	})
+}
+
+func setUpHandler(t *testing.T) (*Handler, dataservices.DataStore) {
+	_, store := datastore.MustNewTestStore(t, true, false)
+
+	user := &portainer.User{ID: 2, Username: "admin", Role: portainer.AdministratorRole}
+	if err := store.User().Create(user); err != nil {
+		t.Fatal("could not create admin user:", err)
+	}
+
+	handler := NewHandler(testhelpers.NewTestRequestBouncer())
+	handler.DataStore = store
+
+	return handler, store
+}
diff --git a/api/http/handler/tags/tag_list.go b/api/http/handler/tags/tag_list.go
new file mode 100644
index 0000000..a0d7a8b
--- /dev/null
+++ b/api/http/handler/tags/tag_list.go
@@ -0,0 +1,28 @@
+package tags
+
+import (
+	"net/http"
+
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id TagList
+// @summary List tags
+// @description List tags.
+// @description **Access policy**: authenticated
+// @tags tags
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @success 200 {array} portainer.Tag "Success"
+// @failure 500 "Server error"
+// @router /tags [get]
+func (handler *Handler) tagList(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	tags, err := handler.DataStore.Tag().ReadAll()
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve tags from the database", err)
+	}
+
+	return response.JSON(w, tags)
+}
diff --git a/api/http/handler/teammemberships/handler.go b/api/http/handler/teammemberships/handler.go
new file mode 100644
index 0000000..aa4a219
--- /dev/null
+++ b/api/http/handler/teammemberships/handler.go
@@ -0,0 +1,62 @@
+package teammemberships
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+	"github.com/portainer/portainer/api/kubernetes/cli"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/rs/zerolog/log"
+
+	"github.com/gorilla/mux"
+)
+
+// Handler is the HTTP handler used to handle team membership operations.
+type Handler struct {
+	*mux.Router
+	DataStore        dataservices.DataStore
+	K8sClientFactory *cli.ClientFactory
+}
+
+// NewHandler creates a handler to manage team membership operations.
+func NewHandler(bouncer security.BouncerService) *Handler {
+	h := &Handler{
+		Router: mux.NewRouter(),
+	}
+
+	h.Use(bouncer.TeamLeaderAccess)
+
+	h.Handle("/team_memberships", httperror.LoggerHandler(h.teamMembershipCreate)).Methods(http.MethodPost)
+	h.Handle("/team_memberships", httperror.LoggerHandler(h.teamMembershipList)).Methods(http.MethodGet)
+	h.Handle("/team_memberships/{id}", httperror.LoggerHandler(h.teamMembershipUpdate)).Methods(http.MethodPut)
+	h.Handle("/team_memberships/{id}", httperror.LoggerHandler(h.teamMembershipDelete)).Methods(http.MethodDelete)
+
+	return h
+}
+
+func (handler *Handler) updateUserServiceAccounts(membership *portainer.TeamMembership) {
+	endpoints, err := handler.DataStore.Endpoint().EndpointsByTeamID(membership.TeamID)
+	if err != nil {
+		log.Error().Err(err).Msgf("failed fetching environments for team %d", membership.TeamID)
+		return
+	}
+	for _, endpoint := range endpoints {
+		restrictDefaultNamespace := endpoint.Kubernetes.Configuration.RestrictDefaultNamespace
+		// update kubernenets service accounts if the team is associated with a kubernetes environment
+		if endpointutils.IsKubernetesEndpoint(&endpoint) {
+			kubecli, err := handler.K8sClientFactory.GetPrivilegedKubeClient(&endpoint)
+			if err != nil {
+				log.Error().Err(err).Msgf("failed getting kube client for environment %d", endpoint.ID)
+				continue
+			}
+			teamIDs := []int{int(membership.TeamID)}
+			err = kubecli.SetupUserServiceAccount(int(membership.UserID), teamIDs, restrictDefaultNamespace)
+			if err != nil {
+				log.Error().Err(err).Msgf("failed setting-up service account for user %d", membership.UserID)
+			}
+		}
+	}
+}
diff --git a/api/http/handler/teammemberships/teammembership_create.go b/api/http/handler/teammemberships/teammembership_create.go
new file mode 100644
index 0000000..d9acb9b
--- /dev/null
+++ b/api/http/handler/teammemberships/teammembership_create.go
@@ -0,0 +1,96 @@
+package teammemberships
+
+import (
+	"errors"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	httperrors "github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type teamMembershipCreatePayload struct {
+	// User identifier
+	UserID int `validate:"required" example:"1"`
+	// Team identifier
+	TeamID int `validate:"required" example:"1"`
+	// Role for the user inside the team (1 for leader and 2 for regular member)
+	Role int `validate:"required" example:"1" enums:"1,2"`
+}
+
+func (payload *teamMembershipCreatePayload) Validate(r *http.Request) error {
+	if payload.UserID == 0 {
+		return errors.New("Invalid UserID")
+	}
+	if payload.TeamID == 0 {
+		return errors.New("Invalid TeamID")
+	}
+	if payload.Role != 1 && payload.Role != 2 {
+		return errors.New("Invalid role value. Value must be one of: 1 (leader) or 2 (member)")
+	}
+	return nil
+}
+
+// @id TeamMembershipCreate
+// @summary Create a new team membership
+// @description Create a new team memberships. Access is only available to administrators leaders of the associated team.
+// @description **Access policy**: administrator
+// @tags team_memberships
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @produce json
+// @param body body teamMembershipCreatePayload true "Team membership details"
+// @success 200 {object} portainer.TeamMembership "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied to manage memberships"
+// @failure 409 "Team membership already registered"
+// @failure 500 "Server error"
+// @router /team_memberships [post]
+func (handler *Handler) teamMembershipCreate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	var payload teamMembershipCreatePayload
+	err := request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	if !security.AuthorizedTeamManagement(portainer.TeamID(payload.TeamID), securityContext) {
+		return httperror.Forbidden("Permission denied to manage team memberships", httperrors.ErrResourceAccessDenied)
+	}
+
+	memberships, err := handler.DataStore.TeamMembership().TeamMembershipsByUserID(portainer.UserID(payload.UserID))
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve team memberships from the database", err)
+	}
+
+	if len(memberships) > 0 {
+		for _, membership := range memberships {
+			if membership.UserID == portainer.UserID(payload.UserID) && membership.TeamID == portainer.TeamID(payload.TeamID) {
+				return httperror.Conflict("Team membership already registered", errors.New("Team membership already exists for this user and team"))
+			}
+		}
+	}
+
+	membership := &portainer.TeamMembership{
+		UserID: portainer.UserID(payload.UserID),
+		TeamID: portainer.TeamID(payload.TeamID),
+		Role:   portainer.MembershipRole(payload.Role),
+	}
+
+	err = handler.DataStore.TeamMembership().Create(membership)
+	if err != nil {
+		return httperror.InternalServerError("Unable to persist team memberships inside the database", err)
+	}
+
+	defer handler.updateUserServiceAccounts(membership)
+
+	return response.JSON(w, membership)
+}
diff --git a/api/http/handler/teammemberships/teammembership_delete.go b/api/http/handler/teammemberships/teammembership_delete.go
new file mode 100644
index 0000000..e9b8ec4
--- /dev/null
+++ b/api/http/handler/teammemberships/teammembership_delete.go
@@ -0,0 +1,58 @@
+package teammemberships
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id TeamMembershipDelete
+// @summary Remove a team membership
+// @description Remove a team membership. Access is only available to administrators leaders of the associated team.
+// @description **Access policy**: administrator
+// @tags team_memberships
+// @security ApiKeyAuth
+// @security jwt
+// @param id path int true "TeamMembership identifier"
+// @success 204 "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied"
+// @failure 404 "TeamMembership not found"
+// @failure 500 "Server error"
+// @router /team_memberships/{id} [delete]
+func (handler *Handler) teamMembershipDelete(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	membershipID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid membership identifier route variable", err)
+	}
+
+	membership, err := handler.DataStore.TeamMembership().Read(portainer.TeamMembershipID(membershipID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find a team membership with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find a team membership with the specified identifier inside the database", err)
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	if !security.AuthorizedTeamManagement(membership.TeamID, securityContext) {
+		return httperror.Forbidden("Permission denied to delete the membership", errors.ErrResourceAccessDenied)
+	}
+
+	err = handler.DataStore.TeamMembership().Delete(portainer.TeamMembershipID(membershipID))
+	if err != nil {
+		return httperror.InternalServerError("Unable to remove the team membership from the database", err)
+	}
+
+	defer handler.updateUserServiceAccounts(membership)
+
+	return response.Empty(w)
+}
diff --git a/api/http/handler/teammemberships/teammembership_list.go b/api/http/handler/teammemberships/teammembership_list.go
new file mode 100644
index 0000000..508f5db
--- /dev/null
+++ b/api/http/handler/teammemberships/teammembership_list.go
@@ -0,0 +1,30 @@
+package teammemberships
+
+import (
+	"net/http"
+
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id TeamMembershipList
+// @summary List team memberships
+// @description  List team memberships. Access is only available to administrators and team leaders.
+// @description **Access policy**: administrator
+// @tags team_memberships
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @success 200 {array} portainer.TeamMembership "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied"
+// @failure 500 "Server error"
+// @router /team_memberships [get]
+func (handler *Handler) teamMembershipList(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	memberships, err := handler.DataStore.TeamMembership().ReadAll()
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve team memberships from the database", err)
+	}
+
+	return response.JSON(w, memberships)
+}
diff --git a/api/http/handler/teammemberships/teammembership_update.go b/api/http/handler/teammemberships/teammembership_update.go
new file mode 100644
index 0000000..0c70759
--- /dev/null
+++ b/api/http/handler/teammemberships/teammembership_update.go
@@ -0,0 +1,94 @@
+package teammemberships
+
+import (
+	"errors"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	httperrors "github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type teamMembershipUpdatePayload struct {
+	// User identifier
+	UserID int `validate:"required" example:"1"`
+	// Team identifier
+	TeamID int `validate:"required" example:"1"`
+	// Role for the user inside the team (1 for leader and 2 for regular member)
+	Role int `validate:"required" example:"1" enums:"1,2"`
+}
+
+func (payload *teamMembershipUpdatePayload) Validate(r *http.Request) error {
+	if payload.UserID == 0 {
+		return errors.New("Invalid UserID")
+	}
+	if payload.TeamID == 0 {
+		return errors.New("Invalid TeamID")
+	}
+	if payload.Role != 1 && payload.Role != 2 {
+		return errors.New("Invalid role value. Value must be one of: 1 (leader) or 2 (member)")
+	}
+	return nil
+}
+
+// @id TeamMembershipUpdate
+// @summary Update a team membership
+// @description Update a team membership. Access is only available to administrators or leaders of the associated team.
+// @description **Access policy**: administrator or leaders of the associated team
+// @tags team_memberships
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @produce json
+// @param id path int true "Team membership identifier"
+// @param body body teamMembershipUpdatePayload true "Team membership details"
+// @success 200 {object} portainer.TeamMembership "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied"
+// @failure 404 "TeamMembership not found"
+// @failure 500 "Server error"
+// @router /team_memberships/{id} [put]
+func (handler *Handler) teamMembershipUpdate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	membershipID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid membership identifier route variable", err)
+	}
+
+	var payload teamMembershipUpdatePayload
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	membership, err := handler.DataStore.TeamMembership().Read(portainer.TeamMembershipID(membershipID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find a team membership with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find a team membership with the specified identifier inside the database", err)
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	isLeadingBothTeam := security.AuthorizedTeamManagement(portainer.TeamID(payload.TeamID), securityContext) &&
+		security.AuthorizedTeamManagement(membership.TeamID, securityContext)
+	if !securityContext.IsAdmin && !isLeadingBothTeam {
+		return httperror.Forbidden("Permission denied to update the membership", httperrors.ErrResourceAccessDenied)
+	}
+
+	membership.UserID = portainer.UserID(payload.UserID)
+	membership.TeamID = portainer.TeamID(payload.TeamID)
+	membership.Role = portainer.MembershipRole(payload.Role)
+
+	if err := handler.DataStore.TeamMembership().Update(membership.ID, membership); err != nil {
+		return httperror.InternalServerError("Unable to persist membership changes inside the database", err)
+	}
+
+	defer handler.updateUserServiceAccounts(membership)
+
+	return response.JSON(w, membership)
+}
diff --git a/api/http/handler/teammemberships/teammembership_update_test.go b/api/http/handler/teammemberships/teammembership_update_test.go
new file mode 100644
index 0000000..2ad6663
--- /dev/null
+++ b/api/http/handler/teammemberships/teammembership_update_test.go
@@ -0,0 +1,51 @@
+package teammemberships
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/require"
+)
+
+func TestUpdate(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, false)
+
+	err := store.TeamMembershipService.Create(&portainer.TeamMembership{
+		UserID: 3,
+		TeamID: 3,
+		Role:   1,
+	})
+	require.NoError(t, err)
+
+	h := NewHandler(testhelpers.NewTestRequestBouncer())
+	h.DataStore = store
+
+	payload := `{"UserID": 3, "TeamID": 2, "Role": 1}`
+
+	rr := httptest.NewRecorder()
+	r := httptest.NewRequest(http.MethodPut, "/team_memberships/1", strings.NewReader(payload))
+
+	restrictedCtx := &security.RestrictedRequestContext{IsAdmin: true}
+	r = r.WithContext(security.StoreRestrictedRequestContext(r, restrictedCtx))
+
+	h.ServeHTTP(rr, r)
+
+	require.Equal(t, http.StatusOK, rr.Code)
+
+	var updatedMembership portainer.TeamMembership
+	err = json.Unmarshal(rr.Body.Bytes(), &updatedMembership)
+	require.NoError(t, err)
+
+	require.Equal(t, portainer.UserID(3), updatedMembership.UserID)
+	require.Equal(t, portainer.TeamID(2), updatedMembership.TeamID)
+	require.Equal(t, portainer.MembershipRole(1), updatedMembership.Role)
+}
diff --git a/api/http/handler/teams/handler.go b/api/http/handler/teams/handler.go
new file mode 100644
index 0000000..2718878
--- /dev/null
+++ b/api/http/handler/teams/handler.go
@@ -0,0 +1,42 @@
+package teams
+
+import (
+	"net/http"
+
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+
+	"github.com/gorilla/mux"
+)
+
+// Handler is the HTTP handler used to handle team operations.
+type Handler struct {
+	*mux.Router
+	DataStore dataservices.DataStore
+}
+
+// NewHandler creates a handler to manage team operations.
+func NewHandler(bouncer security.BouncerService) *Handler {
+	h := &Handler{
+		Router: mux.NewRouter(),
+	}
+
+	adminRouter := h.NewRoute().Subrouter()
+	adminRouter.Use(bouncer.AdminAccess)
+
+	restrictedRouter := h.NewRoute().Subrouter()
+	restrictedRouter.Use(bouncer.RestrictedAccess)
+
+	teamLeaderRouter := h.NewRoute().Subrouter()
+	teamLeaderRouter.Use(bouncer.TeamLeaderAccess)
+
+	adminRouter.Handle("/teams", httperror.LoggerHandler(h.teamCreate)).Methods(http.MethodPost)
+	restrictedRouter.Handle("/teams", httperror.LoggerHandler(h.teamList)).Methods(http.MethodGet)
+	teamLeaderRouter.Handle("/teams/{id}", httperror.LoggerHandler(h.teamInspect)).Methods(http.MethodGet)
+	adminRouter.Handle("/teams/{id}", httperror.LoggerHandler(h.teamUpdate)).Methods(http.MethodPut)
+	adminRouter.Handle("/teams/{id}", httperror.LoggerHandler(h.teamDelete)).Methods(http.MethodDelete)
+	teamLeaderRouter.Handle("/teams/{id}/memberships", httperror.LoggerHandler(h.teamMemberships)).Methods(http.MethodGet)
+
+	return h
+}
diff --git a/api/http/handler/teams/team_create.go b/api/http/handler/teams/team_create.go
new file mode 100644
index 0000000..f073196
--- /dev/null
+++ b/api/http/handler/teams/team_create.go
@@ -0,0 +1,88 @@
+package teams
+
+import (
+	"errors"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type teamCreatePayload struct {
+	// Name
+	Name string `example:"developers" validate:"required"`
+	// TeamLeaders
+	TeamLeaders []portainer.UserID `example:"3,5"`
+}
+
+func (payload *teamCreatePayload) Validate(r *http.Request) error {
+	if len(payload.Name) == 0 {
+		return errors.New("Invalid team name")
+	}
+
+	return nil
+}
+
+// @id TeamCreate
+// @summary Create a new team
+// @description Create a new team.
+// @description **Access policy**: administrator
+// @tags teams
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @produce json
+// @param body body teamCreatePayload true "details"
+// @success 200 {object} portainer.Team "Success"
+// @failure 400 "Invalid request"
+// @failure 409 "A team with the same name already exists"
+// @failure 500 "Server error"
+// @router /teams [post]
+func (handler *Handler) teamCreate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	var payload teamCreatePayload
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	var team *portainer.Team
+	var err error
+	err = handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		team, err = createTeam(tx, payload)
+		return err
+	})
+
+	return response.TxResponse(w, team, err)
+}
+
+func createTeam(tx dataservices.DataStoreTx, payload teamCreatePayload) (*portainer.Team, error) {
+	team, err := tx.Team().TeamByName(payload.Name)
+	if err != nil && !tx.IsErrObjectNotFound(err) {
+		return nil, httperror.InternalServerError("Unable to retrieve teams from the database", err)
+	}
+	if team != nil {
+		return nil, httperror.Conflict("A team with the same name already exists", errors.New("Team already exists"))
+	}
+
+	team = &portainer.Team{Name: payload.Name}
+
+	if err := tx.Team().Create(team); err != nil {
+		return nil, httperror.InternalServerError("Unable to persist the team inside the database", err)
+	}
+
+	for _, teamLeader := range payload.TeamLeaders {
+		membership := &portainer.TeamMembership{
+			UserID: teamLeader,
+			TeamID: team.ID,
+			Role:   portainer.TeamLeader,
+		}
+
+		if err := tx.TeamMembership().Create(membership); err != nil {
+			return nil, httperror.InternalServerError("Unable to persist team leadership inside the database", err)
+		}
+	}
+
+	return team, nil
+}
diff --git a/api/http/handler/teams/team_create_test.go b/api/http/handler/teams/team_create_test.go
new file mode 100644
index 0000000..003c22e
--- /dev/null
+++ b/api/http/handler/teams/team_create_test.go
@@ -0,0 +1,66 @@
+package teams
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/portainer/portainer/api/datastore"
+
+	"github.com/stretchr/testify/require"
+	"golang.org/x/sync/errgroup"
+)
+
+func TestConcurrentTeamCreation(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, true, false)
+
+	h := &Handler{
+		DataStore: store,
+	}
+
+	tcp := teamCreatePayload{
+		Name: "portainer",
+	}
+
+	m, err := json.Marshal(tcp)
+	require.NoError(t, err)
+
+	errGroup := &errgroup.Group{}
+
+	n := 100
+
+	for range n {
+		errGroup.Go(func() error {
+			req, err := http.NewRequest(http.MethodPost, "/teams", bytes.NewReader(m))
+			if err != nil {
+				return err
+			}
+
+			if err := h.teamCreate(httptest.NewRecorder(), req); err != nil {
+				return err
+			}
+
+			return nil
+		})
+	}
+
+	err = errGroup.Wait()
+	require.Error(t, err)
+
+	teams, err := store.Team().ReadAll()
+	require.NotEmpty(t, teams)
+	require.NoError(t, err)
+
+	teamCreated := false
+	for _, team := range teams {
+		if team.Name == tcp.Name {
+			require.False(t, teamCreated)
+			teamCreated = true
+		}
+	}
+
+	require.True(t, teamCreated)
+}
diff --git a/api/http/handler/teams/team_delete.go b/api/http/handler/teams/team_delete.go
new file mode 100644
index 0000000..93cd43f
--- /dev/null
+++ b/api/http/handler/teams/team_delete.go
@@ -0,0 +1,74 @@
+package teams
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+
+	"github.com/pkg/errors"
+)
+
+// @id TeamDelete
+// @summary Remove a team
+// @description Remove a team.
+// @description **Access policy**: administrator
+// @tags teams
+// @security ApiKeyAuth
+// @security jwt
+// @param id path int true "Team Id"
+// @success 204 "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied"
+// @failure 404 "Team not found"
+// @failure 500 "Server error"
+// @router /teams/{id} [delete]
+func (handler *Handler) teamDelete(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	teamID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid team identifier route variable", err)
+	}
+
+	_, err = handler.DataStore.Team().Read(portainer.TeamID(teamID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find a team with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find a team with the specified identifier inside the database", err)
+	}
+
+	err = handler.DataStore.Team().Delete(portainer.TeamID(teamID))
+	if err != nil {
+		return httperror.InternalServerError("Unable to delete the team from the database", err)
+	}
+
+	err = handler.DataStore.TeamMembership().DeleteTeamMembershipByTeamID(portainer.TeamID(teamID))
+	if err != nil {
+		return httperror.InternalServerError("Unable to delete associated team memberships from the database", err)
+	}
+
+	// update default team if deleted team was default
+	err = handler.updateDefaultTeamIfDeleted(portainer.TeamID(teamID))
+	if err != nil {
+		return httperror.InternalServerError("Unable to reset default team", err)
+	}
+
+	return response.Empty(w)
+}
+
+// updateDefaultTeamIfDeleted resets the default team to nil if default team was the deleted team
+func (handler *Handler) updateDefaultTeamIfDeleted(teamID portainer.TeamID) error {
+	settings, err := handler.DataStore.Settings().Settings()
+	if err != nil {
+		return errors.Wrap(err, "failed to fetch settings")
+	}
+
+	if teamID != settings.OAuthSettings.DefaultTeamID {
+		return nil
+	}
+
+	settings.OAuthSettings.DefaultTeamID = 0
+	err = handler.DataStore.Settings().UpdateSettings(settings)
+	return errors.Wrap(err, "failed to update settings")
+}
diff --git a/api/http/handler/teams/team_inspect.go b/api/http/handler/teams/team_inspect.go
new file mode 100644
index 0000000..8576365
--- /dev/null
+++ b/api/http/handler/teams/team_inspect.go
@@ -0,0 +1,52 @@
+package teams
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id TeamInspect
+// @summary Inspect a team
+// @description Retrieve details about a team. Access is only available for administrator and leaders of that team.
+// @description **Access policy**: administrator
+// @tags teams
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param id path int true "Team identifier"
+// @success 200 {object} portainer.Team "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied"
+// @failure 404 "Team not found"
+// @failure 500 "Server error"
+// @router /teams/{id} [get]
+func (handler *Handler) teamInspect(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	teamID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid team identifier route variable", err)
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	if !security.AuthorizedTeamManagement(portainer.TeamID(teamID), securityContext) {
+		return httperror.Forbidden("Access denied to team", errors.ErrResourceAccessDenied)
+	}
+
+	team, err := handler.DataStore.Team().Read(portainer.TeamID(teamID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find a team with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find a team with the specified identifier inside the database", err)
+	}
+
+	return response.JSON(w, team)
+}
diff --git a/api/http/handler/teams/team_list.go b/api/http/handler/teams/team_list.go
new file mode 100644
index 0000000..35821de
--- /dev/null
+++ b/api/http/handler/teams/team_list.go
@@ -0,0 +1,77 @@
+package teams
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id TeamList
+// @summary List teams
+// @description List teams. For non-administrator users, will only list the teams they are member of.
+// @description **Access policy**: restricted
+// @tags teams
+// @param onlyLedTeams query boolean false "Only list teams that the user is leader of"
+// @param environmentId query int false "Identifier of the environment(endpoint) that will be used to filter the authorized teams"
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @success 200 {array} portainer.Team "Success"
+// @failure 500 "Server error"
+// @router /teams [get]
+func (handler *Handler) teamList(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	teams, err := handler.DataStore.Team().ReadAll()
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve teams from the database", err)
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	onlyLedTeams, _ := request.RetrieveBooleanQueryParameter(r, "onlyLedTeams", true)
+
+	var userTeams []portainer.Team
+	if onlyLedTeams {
+		userTeams = security.FilterLeaderTeams(teams, securityContext)
+	} else {
+		userTeams = security.FilterUserTeams(teams, securityContext)
+	}
+
+	endpointID, _ := request.RetrieveNumericQueryParameter(r, "environmentId", true)
+	if endpointID == 0 {
+		return response.JSON(w, userTeams)
+	}
+
+	// filter out teams who do not have access to the specific endpoint
+	endpoint, err := handler.DataStore.Endpoint().Endpoint(portainer.EndpointID(endpointID))
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve endpoint from the database", err)
+	}
+
+	endpointGroup, err := handler.DataStore.EndpointGroup().Read(endpoint.GroupID)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve environment groups from the database", err)
+	}
+
+	allowedTeams := make(map[portainer.TeamID]struct{})
+	for teamID := range endpointGroup.TeamAccessPolicies {
+		allowedTeams[teamID] = struct{}{}
+	}
+	for teamID := range endpoint.TeamAccessPolicies {
+		allowedTeams[teamID] = struct{}{}
+	}
+
+	listableTeams := make([]portainer.Team, 0)
+	for _, team := range userTeams {
+		if _, ok := allowedTeams[team.ID]; ok {
+			listableTeams = append(listableTeams, team)
+		}
+	}
+	return response.JSON(w, listableTeams)
+}
diff --git a/api/http/handler/teams/team_list_test.go b/api/http/handler/teams/team_list_test.go
new file mode 100644
index 0000000..6dbf1b7
--- /dev/null
+++ b/api/http/handler/teams/team_list_test.go
@@ -0,0 +1,193 @@
+package teams
+
+import (
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/apikey"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+	"github.com/portainer/portainer/api/jwt"
+
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_teamList(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	_, store := datastore.MustNewTestStore(t, true, true)
+
+	// create admin
+	adminUser := &portainer.User{ID: 1, Username: "admin", Role: portainer.AdministratorRole}
+	err := store.User().Create(adminUser)
+	require.NoError(t, err, "error creating admin user")
+
+	// setup services
+	jwtService, err := jwt.NewService("1h", store)
+	require.NoError(t, err, "Error initiating jwt service")
+	apiKeyService := apikey.NewAPIKeyService(store.APIKeyRepository(), store.User())
+	requestBouncer := security.NewRequestBouncer(t.Context(), store, jwtService, apiKeyService)
+
+	h := NewHandler(requestBouncer)
+	h.DataStore = store
+
+	// generate admin user tokens
+	adminJWT, _, _ := jwtService.GenerateToken(&portainer.TokenData{ID: adminUser.ID, Username: adminUser.Username, Role: adminUser.Role})
+
+	// Case 1: the team is given the endpoint access directly
+	// create teams
+	teamWithEndpointAccess := &portainer.Team{ID: 1, Name: "team-with-endpoint-access"}
+	err = store.Team().Create(teamWithEndpointAccess)
+	require.NoError(t, err, "error creating team")
+
+	teamWithoutEndpointAccess := &portainer.Team{ID: 2, Name: "team-without-endpoint-access"}
+	err = store.Team().Create(teamWithoutEndpointAccess)
+	require.NoError(t, err, "error creating team")
+
+	// create users
+	userWithEndpointAccessByTeam := &portainer.User{ID: 2, Username: "standard-user-inherit-endpoint-access-from-team", Role: portainer.StandardUserRole, PortainerAuthorizations: authorization.DefaultPortainerAuthorizations()}
+	err = store.User().Create(userWithEndpointAccessByTeam)
+	require.NoError(t, err, "error creating user")
+
+	userWithoutEndpointAccess := &portainer.User{ID: 3, Username: "standard-user-without-endpoint-access", Role: portainer.StandardUserRole, PortainerAuthorizations: authorization.DefaultPortainerAuthorizations()}
+	err = store.User().Create(userWithoutEndpointAccess)
+	require.NoError(t, err, "error creating user")
+
+	// create team membership
+	teamMembership := &portainer.TeamMembership{ID: 1, UserID: userWithEndpointAccessByTeam.ID, TeamID: teamWithEndpointAccess.ID}
+	err = store.TeamMembership().Create(teamMembership)
+	require.NoError(t, err, "error creating team membership")
+
+	// create endpoint and team access policies
+	teamAccessPolicies := make(portainer.TeamAccessPolicies, 0)
+	teamAccessPolicies[teamWithEndpointAccess.ID] = portainer.AccessPolicy{RoleID: portainer.RoleID(userWithEndpointAccessByTeam.Role)}
+
+	endpointGroupOnly := &portainer.EndpointGroup{ID: 5, Name: "endpoint-group"}
+	err = store.EndpointGroup().Create(endpointGroupOnly)
+	require.NoError(t, err, "error creating endpoint group")
+
+	endpointWithTeamAccessPolicy := &portainer.Endpoint{ID: 1, GroupID: endpointGroupOnly.ID, TeamAccessPolicies: teamAccessPolicies}
+	err = store.Endpoint().Create(endpointWithTeamAccessPolicy)
+	require.NoError(t, err, "error creating endpoint")
+
+	jwt, _, _ := jwtService.GenerateToken(&portainer.TokenData{ID: userWithEndpointAccessByTeam.ID, Username: userWithEndpointAccessByTeam.Username, Role: userWithEndpointAccessByTeam.Role})
+
+	t.Run("admin user can successfully list all teams", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodGet, "/teams", nil)
+		testhelpers.AddTestSecurityCookie(req, adminJWT)
+
+		rr := httptest.NewRecorder()
+		h.ServeHTTP(rr, req)
+
+		is.Equal(http.StatusOK, rr.Code)
+
+		body, err := io.ReadAll(rr.Body)
+		require.NoError(t, err, "ReadAll should not return error")
+
+		var resp []portainer.Team
+		err = json.Unmarshal(body, &resp)
+		require.NoError(t, err, "response should be list json")
+
+		is.Len(resp, 2)
+	})
+
+	t.Run("admin user can list team who is given access to the specific endpoint", func(t *testing.T) {
+		params := url.Values{}
+		params.Add("environmentId", fmt.Sprintf("%d", endpointWithTeamAccessPolicy.ID))
+		req := httptest.NewRequest(http.MethodGet, "/teams?"+params.Encode(), nil)
+		testhelpers.AddTestSecurityCookie(req, adminJWT)
+
+		rr := httptest.NewRecorder()
+		h.ServeHTTP(rr, req)
+
+		is.Equal(http.StatusOK, rr.Code)
+
+		body, err := io.ReadAll(rr.Body)
+		require.NoError(t, err, "ReadAll should not return error")
+
+		var resp []portainer.Team
+		err = json.Unmarshal(body, &resp)
+		require.NoError(t, err, "response should be list json")
+
+		is.Len(resp, 1)
+		if len(resp) == 1 {
+			is.Equal(teamWithEndpointAccess.ID, resp[0].ID)
+		}
+	})
+
+	t.Run("standard user only can list team where he belongs to", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodGet, "/teams", nil)
+		testhelpers.AddTestSecurityCookie(req, jwt)
+
+		rr := httptest.NewRecorder()
+		h.ServeHTTP(rr, req)
+
+		is.Equal(http.StatusOK, rr.Code)
+
+		body, err := io.ReadAll(rr.Body)
+		require.NoError(t, err, "ReadAll should not return error")
+
+		var resp []portainer.Team
+		err = json.Unmarshal(body, &resp)
+		require.NoError(t, err, "response should be list json")
+
+		is.Len(resp, 1)
+		if len(resp) == 1 {
+			is.Equal(teamWithEndpointAccess.ID, resp[0].ID)
+		}
+	})
+
+	// Case 2: the team is under an environment group and the endpoint group has endpoint access.
+	//         the user inherits the endpoint access from the environment group
+	// create team
+	teamUnderGroup := &portainer.Team{ID: 3, Name: "team-under-environment-group"}
+	err = store.Team().Create(teamUnderGroup)
+	require.NoError(t, err, "error creating user")
+
+	// create environment group including a team
+	teamAccessPoliciesUnderGroup := make(portainer.TeamAccessPolicies, 0)
+	teamAccessPoliciesUnderGroup[teamUnderGroup.ID] = portainer.AccessPolicy{}
+
+	endpointGroupWithTeam := &portainer.EndpointGroup{ID: 2, Name: "endpoint-group-with-team", TeamAccessPolicies: teamAccessPoliciesUnderGroup}
+	err = store.EndpointGroup().Create(endpointGroupWithTeam)
+	require.NoError(t, err, "error creating endpoint group")
+
+	// create endpoint
+	endpointUnderGroupWithTeam := &portainer.Endpoint{ID: 2, GroupID: endpointGroupWithTeam.ID}
+	err = store.Endpoint().Create(endpointUnderGroupWithTeam)
+	require.NoError(t, err, "error creating endpoint")
+
+	t.Run("admin user can list teams who inherit endpoint access from an environment group", func(t *testing.T) {
+		params := url.Values{}
+		params.Add("environmentId", fmt.Sprintf("%d", endpointUnderGroupWithTeam.ID))
+		req := httptest.NewRequest(http.MethodGet, "/teams?"+params.Encode(), nil)
+		testhelpers.AddTestSecurityCookie(req, adminJWT)
+
+		rr := httptest.NewRecorder()
+		h.ServeHTTP(rr, req)
+
+		is.Equal(http.StatusOK, rr.Code)
+
+		body, err := io.ReadAll(rr.Body)
+		require.NoError(t, err, "ReadAll should not return error")
+
+		var resp []portainer.Team
+		err = json.Unmarshal(body, &resp)
+		require.NoError(t, err, "response should be list json")
+
+		is.Len(resp, 1)
+		if len(resp) == 1 {
+			is.Equal(teamUnderGroup.ID, resp[0].ID)
+		}
+	})
+}
diff --git a/api/http/handler/teams/team_memberships.go b/api/http/handler/teams/team_memberships.go
new file mode 100644
index 0000000..5f577e9
--- /dev/null
+++ b/api/http/handler/teams/team_memberships.go
@@ -0,0 +1,49 @@
+package teams
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id TeamMemberships
+// @summary List team memberships
+// @description List team memberships. Access is only available to administrators and team leaders.
+// @description **Access policy**: restricted
+// @tags team_memberships
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param id path int true "Team Id"
+// @success 200 {array} portainer.TeamMembership "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied"
+// @failure 500 "Server error"
+// @router /teams/{id}/memberships [get]
+func (handler *Handler) teamMemberships(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	teamID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid team identifier route variable", err)
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	if !security.AuthorizedTeamManagement(portainer.TeamID(teamID), securityContext) {
+		return httperror.Forbidden("Access denied to team", errors.ErrResourceAccessDenied)
+	}
+
+	memberships, err := handler.DataStore.TeamMembership().TeamMembershipsByTeamID(portainer.TeamID(teamID))
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve associated team memberships from the database", err)
+	}
+
+	return response.JSON(w, memberships)
+}
diff --git a/api/http/handler/teams/team_update.go b/api/http/handler/teams/team_update.go
new file mode 100644
index 0000000..5731f29
--- /dev/null
+++ b/api/http/handler/teams/team_update.go
@@ -0,0 +1,65 @@
+package teams
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type teamUpdatePayload struct {
+	// Name
+	Name string `example:"developers"`
+}
+
+func (payload *teamUpdatePayload) Validate(r *http.Request) error {
+	return nil
+}
+
+// @id TeamUpdate
+// @summary Update a team
+// @description Update a team.
+// @description **Access policy**: administrator
+// @tags teams
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @produce json
+// @param id path int true "Team identifier"
+// @param body body teamUpdatePayload true "Team details"
+// @success 200 {object} portainer.Team "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied"
+// @failure 404 "Team not found"
+// @failure 500 "Server error"
+// @router /teams/{id} [put]
+func (handler *Handler) teamUpdate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	teamID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid team identifier route variable", err)
+	}
+
+	var payload teamUpdatePayload
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	team, err := handler.DataStore.Team().Read(portainer.TeamID(teamID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find a team with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find a team with the specified identifier inside the database", err)
+	}
+
+	if payload.Name != "" {
+		team.Name = payload.Name
+	}
+
+	if err := handler.DataStore.Team().Update(team.ID, team); err != nil {
+		return httperror.NotFound("Unable to persist team changes inside the database", err)
+	}
+
+	return response.JSON(w, team)
+}
diff --git a/api/http/handler/templates/handler.go b/api/http/handler/templates/handler.go
new file mode 100644
index 0000000..1e7b7f0
--- /dev/null
+++ b/api/http/handler/templates/handler.go
@@ -0,0 +1,33 @@
+package templates
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+
+	"github.com/gorilla/mux"
+)
+
+// Handler represents an HTTP API handler for managing templates.
+type Handler struct {
+	*mux.Router
+	DataStore   dataservices.DataStore
+	GitService  portainer.GitService
+	FileService portainer.FileService
+}
+
+// NewHandler returns a new instance of Handler.
+func NewHandler(bouncer security.BouncerService) *Handler {
+	h := &Handler{
+		Router: mux.NewRouter(),
+	}
+
+	h.Handle("/templates",
+		bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.templateList))).Methods(http.MethodGet)
+	h.Handle("/templates/{id}/file",
+		bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.templateFile))).Methods(http.MethodPost)
+	return h
+}
diff --git a/api/http/handler/templates/template_file.go b/api/http/handler/templates/template_file.go
new file mode 100644
index 0000000..ab7c4a3
--- /dev/null
+++ b/api/http/handler/templates/template_file.go
@@ -0,0 +1,99 @@
+package templates
+
+import (
+	"context"
+	"net/http"
+	"slices"
+
+	portainer "github.com/portainer/portainer/api"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+
+	"github.com/rs/zerolog/log"
+)
+
+type fileResponse struct {
+	// The requested file content
+	FileContent string `example:"version:2"`
+}
+
+// @id TemplateFile
+// @summary Get a template's file
+// @description Get a template's file
+// @description **Access policy**: authenticated
+// @tags templates
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @produce json
+// @param id path int true "Template identifier"
+// @success 200 {object} fileResponse "Success"
+// @failure 400 "Invalid request"
+// @failure 500 "Server error"
+// @router /templates/{id}/file [post]
+func (handler *Handler) templateFile(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	id, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid template identifier", err)
+	}
+
+	templatesResponse, httpErr := handler.fetchTemplates()
+	if httpErr != nil {
+		return httpErr
+	}
+
+	templateIdx := slices.IndexFunc(templatesResponse.Templates, func(template portainer.Template) bool {
+		return template.ID == portainer.TemplateID(id)
+	})
+
+	if templateIdx == -1 {
+		return httperror.NotFound("Unable to find a template with the specified identifier", nil)
+	}
+
+	template := templatesResponse.Templates[templateIdx]
+
+	if template.Type == portainer.ContainerTemplate {
+		return httperror.BadRequest("Invalid template type", nil)
+	}
+
+	if template.StackFile != "" {
+		return response.JSON(w, fileResponse{FileContent: template.StackFile})
+	}
+
+	if template.Repository.StackFile == "" || template.Repository.URL == "" {
+		return httperror.BadRequest("Invalid template configuration", nil)
+	}
+
+	projectPath, err := handler.FileService.GetTemporaryPath()
+	if err != nil {
+		return httperror.InternalServerError("Unable to create temporary folder", err)
+	}
+
+	defer handler.cleanUp(projectPath)
+
+	if err := handler.GitService.CloneRepository(
+		context.TODO(),
+		projectPath,
+		template.Repository.URL,
+		"",
+		"",
+		"",
+		false,
+	); err != nil {
+		return httperror.InternalServerError("Unable to clone git repository", err)
+	}
+
+	fileContent, err := handler.FileService.GetFileContent(projectPath, template.Repository.StackFile)
+	if err != nil {
+		return httperror.InternalServerError("Failed loading file content", err)
+	}
+
+	return response.JSON(w, fileResponse{FileContent: string(fileContent)})
+}
+
+func (handler *Handler) cleanUp(projectPath string) {
+	if err := handler.FileService.RemoveDirectory(projectPath); err != nil {
+		log.Debug().Err(err).Msg("HTTP error: unable to cleanup stack creation")
+	}
+}
diff --git a/api/http/handler/templates/template_list.go b/api/http/handler/templates/template_list.go
new file mode 100644
index 0000000..472cb61
--- /dev/null
+++ b/api/http/handler/templates/template_list.go
@@ -0,0 +1,28 @@
+package templates
+
+import (
+	"net/http"
+
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id TemplateList
+// @summary List available templates
+// @description List available templates.
+// @description **Access policy**: authenticated
+// @tags templates
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @success 200 {object} listResponse "Success"
+// @failure 500 "Server error"
+// @router /templates [get]
+func (handler *Handler) templateList(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	templates, httpErr := handler.fetchTemplates()
+	if httpErr != nil {
+		return httpErr
+	}
+
+	return response.JSON(w, templates)
+}
diff --git a/api/http/handler/templates/utils_fetch_templates.go b/api/http/handler/templates/utils_fetch_templates.go
new file mode 100644
index 0000000..e9802d4
--- /dev/null
+++ b/api/http/handler/templates/utils_fetch_templates.go
@@ -0,0 +1,56 @@
+package templates
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	libclient "github.com/portainer/portainer/pkg/libhttp/client"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/rs/zerolog/log"
+	"github.com/segmentio/encoding/json"
+)
+
+type listResponse struct {
+	Version   string               `json:"version"`
+	Templates []portainer.Template `json:"templates"`
+}
+
+func (handler *Handler) fetchTemplates() (*listResponse, *httperror.HandlerError) {
+	settings, err := handler.DataStore.Settings().Settings()
+	if err != nil {
+		return nil, httperror.InternalServerError("Unable to retrieve settings from the database", err)
+	}
+
+	templatesURL := settings.TemplatesURL
+	if templatesURL == "" {
+		templatesURL = portainer.DefaultTemplatesURL
+	}
+
+	var body *listResponse
+	if err := libclient.ExternalRequestDisabled(templatesURL); err != nil {
+		if templatesURL == portainer.DefaultTemplatesURL {
+			log.Debug().Err(err).Msg("External request disabled: Default templates")
+			return body, nil
+		}
+	}
+
+	resp, err := http.Get(templatesURL)
+	if err != nil {
+		return nil, httperror.InternalServerError("Unable to retrieve templates via the network", err)
+	}
+	defer func() {
+		if err := resp.Body.Close(); err != nil {
+			log.Warn().Err(err).Msg("Failed to close templates response body")
+		}
+	}()
+
+	if err := json.NewDecoder(resp.Body).Decode(&body); err != nil {
+		return nil, httperror.InternalServerError("Unable to parse template file", err)
+	}
+
+	for i := range body.Templates {
+		body.Templates[i].ID = portainer.TemplateID(i + 1)
+	}
+	return body, nil
+
+}
diff --git a/api/http/handler/upload/handler.go b/api/http/handler/upload/handler.go
new file mode 100644
index 0000000..d23e58a
--- /dev/null
+++ b/api/http/handler/upload/handler.go
@@ -0,0 +1,27 @@
+package upload
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+
+	"github.com/gorilla/mux"
+)
+
+// Handler is the HTTP handler used to handle upload operations.
+type Handler struct {
+	*mux.Router
+	FileService portainer.FileService
+}
+
+// NewHandler creates a handler to manage upload operations.
+func NewHandler(bouncer security.BouncerService) *Handler {
+	h := &Handler{
+		Router: mux.NewRouter(),
+	}
+	h.Handle("/upload/tls/{certificate:(?:ca|cert|key)}",
+		bouncer.AdminAccess(httperror.LoggerHandler(h.uploadTLS))).Methods(http.MethodPost)
+	return h
+}
diff --git a/api/http/handler/upload/upload_tls.go b/api/http/handler/upload/upload_tls.go
new file mode 100644
index 0000000..b25f2d5
--- /dev/null
+++ b/api/http/handler/upload/upload_tls.go
@@ -0,0 +1,63 @@
+package upload
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/filesystem"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id UploadTLS
+// @summary Upload TLS files
+// @description Use this environment(endpoint) to upload TLS files.
+// @description **Access policy**: administrator
+// @tags upload
+// @security ApiKeyAuth
+// @security jwt
+// @accept multipart/form-data
+// @produce json
+// @param certificate path string true "TLS file type. Valid values are 'ca', 'cert' or 'key'." Enums(ca,cert,key)
+// @param folder formData string true "Folder where the TLS file will be stored. Will be created if not existing"
+// @param file formData file true "The file to upload"
+// @success 204 "Success"
+// @failure 400 "Invalid request"
+// @failure 500 "Server error"
+// @router /upload/tls/{certificate} [post]
+func (handler *Handler) uploadTLS(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	certificate, err := request.RetrieveRouteVariableValue(r, "certificate")
+	if err != nil {
+		return httperror.BadRequest("Invalid certificate route variable", err)
+	}
+
+	folder, err := request.RetrieveMultiPartFormValue(r, "folder", false)
+	if err != nil {
+		return httperror.BadRequest("Invalid query parameter: folder", err)
+	}
+
+	file, _, err := request.RetrieveMultiPartFormFile(r, "file")
+	if err != nil {
+		return httperror.BadRequest("Invalid certificate file. Ensure that the certificate file is uploaded correctly", err)
+	}
+
+	var fileType portainer.TLSFileType
+	switch certificate {
+	case "ca":
+		fileType = portainer.TLSFileCA
+	case "cert":
+		fileType = portainer.TLSFileCert
+	case "key":
+		fileType = portainer.TLSFileKey
+	default:
+		return httperror.BadRequest("Invalid certificate route value. Value must be one of: ca, cert or key", filesystem.ErrUndefinedTLSFileType)
+	}
+
+	_, err = handler.FileService.StoreTLSFileFromBytes(folder, fileType, file)
+	if err != nil {
+		return httperror.InternalServerError("Unable to persist certificate file on disk", err)
+	}
+
+	return response.Empty(w)
+}
diff --git a/api/http/handler/users/admin_check.go b/api/http/handler/users/admin_check.go
new file mode 100644
index 0000000..01d7b91
--- /dev/null
+++ b/api/http/handler/users/admin_check.go
@@ -0,0 +1,31 @@
+package users
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices/errors"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id UserAdminCheck
+// @summary Check administrator account existence
+// @description Check if an administrator account exists in the database.
+// @description **Access policy**: public
+// @tags users
+// @success 204 "Success"
+// @failure 404 "User not found"
+// @router /users/admin/check [get]
+func (handler *Handler) adminCheck(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	users, err := handler.DataStore.User().UsersByRole(portainer.AdministratorRole)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve users from the database", err)
+	}
+
+	if len(users) == 0 {
+		return httperror.NotFound("No administrator account found inside the database", errors.ErrObjectNotFound)
+	}
+
+	return response.Empty(w)
+}
diff --git a/api/http/handler/users/admin_init.go b/api/http/handler/users/admin_init.go
new file mode 100644
index 0000000..dd31f74
--- /dev/null
+++ b/api/http/handler/users/admin_init.go
@@ -0,0 +1,90 @@
+package users
+
+import (
+	"errors"
+	"net/http"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/security/setuptoken"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type adminInitPayload struct {
+	// Username for the admin user
+	Username string `validate:"required" example:"admin"`
+	// Password for the admin user
+	Password string `validate:"required" example:"admin-password"`
+}
+
+func (payload *adminInitPayload) Validate(r *http.Request) error {
+	if len(payload.Username) == 0 || strings.Contains(payload.Username, " ") {
+		return errors.New("Invalid username. Must not contain any whitespace")
+	}
+	if len(payload.Password) == 0 {
+		return errors.New("Invalid password")
+	}
+	return nil
+}
+
+// @id UserAdminInit
+// @summary Initialize administrator account
+// @description Initialize the 'admin' user account.
+// @description **Access policy**: public (requires the X-Setup-Token header on an uninitialized instance unless --no-setup-token is set)
+// @tags users
+// @accept json
+// @produce json
+// @param X-Setup-Token header string false "Setup token (required when instance is uninitialized and --no-setup-token is not set)"
+// @param body body adminInitPayload true "User details"
+// @success 200 {object} portainer.User "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Access denied - invalid or missing setup token"
+// @failure 409 "Admin user already initialized"
+// @failure 500 "Server error"
+// @router /users/admin/init [post]
+func (handler *Handler) adminInit(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	if err := setuptoken.Validate(r, handler.SetupToken); err != nil {
+		return err
+	}
+
+	var payload adminInitPayload
+	err := request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	users, err := handler.DataStore.User().UsersByRole(portainer.AdministratorRole)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve users from the database", err)
+	}
+
+	if len(users) != 0 {
+		return httperror.Conflict("Unable to create administrator user", errAdminAlreadyInitialized)
+	}
+
+	if !handler.passwordStrengthChecker.Check(payload.Password) {
+		return httperror.BadRequest("Password does not meet the requirements", nil)
+	}
+
+	user := &portainer.User{
+		Username: payload.Username,
+		Role:     portainer.AdministratorRole,
+	}
+
+	user.Password, err = handler.CryptoService.Hash(payload.Password)
+	if err != nil {
+		return httperror.InternalServerError("Unable to hash user password", errCryptoHashFailure)
+	}
+
+	err = handler.DataStore.User().Create(user)
+	if err != nil {
+		return httperror.InternalServerError("Unable to persist user inside the database", err)
+	}
+
+	// After the admin user is created, we can notify the endpoint initialization process
+	handler.AdminCreationDone <- struct{}{}
+
+	return response.JSON(w, user)
+}
diff --git a/api/http/handler/users/admin_init_test.go b/api/http/handler/users/admin_init_test.go
new file mode 100644
index 0000000..6269149
--- /dev/null
+++ b/api/http/handler/users/admin_init_test.go
@@ -0,0 +1,65 @@
+package users
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/portainer/portainer/api/apikey"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/http/security/setuptoken"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func newAdminInitHandler(t *testing.T) *Handler {
+	t.Helper()
+	_, store := datastore.MustNewTestStore(t, true, false)
+	rateLimiter := security.NewRateLimiter(10, 1*time.Second, 1*time.Hour)
+	apiKeyService := apikey.NewAPIKeyService(store.APIKeyRepository(), store.User())
+	h := NewHandler(testhelpers.NewTestRequestBouncer(), rateLimiter, apiKeyService, mockPasswordStrengthChecker{})
+	h.DataStore = store
+	h.CryptoService = testhelpers.NewCryptoService()
+	h.AdminCreationDone = make(chan struct{}, 1)
+	return h
+}
+
+func Test_adminInit_setupTokenGate(t *testing.T) {
+	t.Parallel()
+
+	t.Run("403 without token header", func(t *testing.T) {
+		handler := newAdminInitHandler(t)
+		handler.SetupToken = "secret-token"
+		body := strings.NewReader(`{"Username":"admin","Password":"abcdefgh12"}`)
+		r := httptest.NewRequest(http.MethodPost, "/users/admin/init", body)
+		err := handler.adminInit(httptest.NewRecorder(), r)
+		require.NotNil(t, err)
+		assert.Equal(t, http.StatusForbidden, err.StatusCode)
+	})
+
+	t.Run("403 with wrong token", func(t *testing.T) {
+		handler := newAdminInitHandler(t)
+		handler.SetupToken = "secret-token"
+		body := strings.NewReader(`{"Username":"admin","Password":"abcdefgh12"}`)
+		r := httptest.NewRequest(http.MethodPost, "/users/admin/init", body)
+		r.Header.Set(setuptoken.HeaderName, "wrong")
+		err := handler.adminInit(httptest.NewRecorder(), r)
+		require.NotNil(t, err)
+		assert.Equal(t, http.StatusForbidden, err.StatusCode)
+	})
+
+	t.Run("succeeds with correct token", func(t *testing.T) {
+		handler := newAdminInitHandler(t)
+		handler.SetupToken = "secret-token"
+		body := strings.NewReader(`{"Username":"admin","Password":"abcdefgh12"}`)
+		r := httptest.NewRequest(http.MethodPost, "/users/admin/init", body)
+		r.Header.Set(setuptoken.HeaderName, "secret-token")
+		err := handler.adminInit(httptest.NewRecorder(), r)
+		assert.Nil(t, err)
+	})
+}
diff --git a/api/http/handler/users/handler.go b/api/http/handler/users/handler.go
new file mode 100644
index 0000000..1c2d6eb
--- /dev/null
+++ b/api/http/handler/users/handler.go
@@ -0,0 +1,88 @@
+package users
+
+import (
+	"errors"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/apikey"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+
+	"github.com/gorilla/mux"
+)
+
+var (
+	errUserAlreadyExists          = errors.New("User already exists")
+	errAdminAlreadyInitialized    = errors.New("An administrator user already exists")
+	errAdminCannotRemoveSelf      = errors.New("Cannot remove your own user account. Contact another administrator")
+	errCannotRemoveLastLocalAdmin = errors.New("Cannot remove the last local administrator account")
+	errCryptoHashFailure          = errors.New("Unable to hash data")
+)
+
+func hideFields(user *portainer.User) {
+	user.Password = ""
+}
+
+// Handler is the HTTP handler used to handle user operations.
+type Handler struct {
+	*mux.Router
+	bouncer                 security.BouncerService
+	apiKeyService           apikey.APIKeyService
+	DataStore               dataservices.DataStore
+	CryptoService           portainer.CryptoService
+	passwordStrengthChecker security.PasswordStrengthChecker
+	AdminCreationDone       chan<- struct{}
+	FileService             portainer.FileService
+	SetupToken              string
+}
+
+// NewHandler creates a handler to manage user operations.
+func NewHandler(bouncer security.BouncerService, rateLimiter *security.RateLimiter, apiKeyService apikey.APIKeyService, passwordStrengthChecker security.PasswordStrengthChecker) *Handler {
+	h := &Handler{
+		Router:                  mux.NewRouter(),
+		bouncer:                 bouncer,
+		apiKeyService:           apiKeyService,
+		passwordStrengthChecker: passwordStrengthChecker,
+	}
+
+	adminRouter := h.NewRoute().Subrouter()
+	adminRouter.Use(bouncer.AdminAccess)
+
+	teamLeaderRouter := h.NewRoute().Subrouter()
+	teamLeaderRouter.Use(bouncer.TeamLeaderAccess)
+
+	authenticatedRouter := h.NewRoute().Subrouter()
+	authenticatedRouter.Use(bouncer.AuthenticatedAccess)
+
+	restrictedRouter := h.NewRoute().Subrouter()
+	restrictedRouter.Use(bouncer.RestrictedAccess)
+
+	publicRouter := h.NewRoute().Subrouter()
+	publicRouter.Use(bouncer.PublicAccess)
+
+	adminRouter.Handle("/users", httperror.LoggerHandler(h.userCreate)).Methods(http.MethodPost)
+	restrictedRouter.Handle("/users", httperror.LoggerHandler(h.userList)).Methods(http.MethodGet)
+
+	authenticatedRouter.Handle("/users/me", httperror.LoggerHandler(h.userInspectMe)).Methods(http.MethodGet)
+	restrictedRouter.Handle("/users/{id}", httperror.LoggerHandler(h.userInspect)).Methods(http.MethodGet)
+	authenticatedRouter.Handle("/users/{id}", httperror.LoggerHandler(h.userUpdate)).Methods(http.MethodPut)
+	adminRouter.Handle("/users/{id}", httperror.LoggerHandler(h.userDelete)).Methods(http.MethodDelete)
+	restrictedRouter.Handle("/users/{id}/tokens", httperror.LoggerHandler(h.userGetAccessTokens)).Methods(http.MethodGet)
+	restrictedRouter.Handle("/users/{id}/tokens", rateLimiter.LimitAccess(httperror.LoggerHandler(h.userCreateAccessToken))).Methods(http.MethodPost)
+	restrictedRouter.Handle("/users/{id}/tokens/{keyID}", httperror.LoggerHandler(h.userRemoveAccessToken)).Methods(http.MethodDelete)
+	restrictedRouter.Handle("/users/{id}/memberships", httperror.LoggerHandler(h.userMemberships)).Methods(http.MethodGet)
+	restrictedRouter.Handle("/users/{id}/effective-access", httperror.LoggerHandler(h.userEffectiveAccess)).Methods(http.MethodGet)
+	authenticatedRouter.Handle("/users/{id}/passwd", rateLimiter.LimitAccess(httperror.LoggerHandler(h.userUpdatePassword))).Methods(http.MethodPut)
+
+	publicRouter.Handle("/users/admin/check", httperror.LoggerHandler(h.adminCheck)).Methods(http.MethodGet)
+	publicRouter.Handle("/users/admin/init", httperror.LoggerHandler(h.adminInit)).Methods(http.MethodPost)
+
+	// Helm repositories
+	authenticatedRouter.Handle("/users/{id}/helm/repositories", httperror.LoggerHandler(h.userGetHelmRepos)).Methods(http.MethodGet)
+	authenticatedRouter.Handle("/users/{id}/helm/repositories", httperror.LoggerHandler(h.userCreateHelmRepo)).Methods(http.MethodPost)
+	authenticatedRouter.Handle("/users/{id}/helm/repositories/{repositoryID}", httperror.LoggerHandler(h.userDeleteHelmRepo)).Methods(http.MethodDelete)
+
+	return h
+}
diff --git a/api/http/handler/users/user_create.go b/api/http/handler/users/user_create.go
new file mode 100644
index 0000000..daa2f6c
--- /dev/null
+++ b/api/http/handler/users/user_create.go
@@ -0,0 +1,111 @@
+package users
+
+import (
+	"errors"
+	"net/http"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type userCreatePayload struct {
+	Username string `validate:"required" example:"bob"`
+	Password string `validate:"required" example:"cg9Wgky3"`
+	// User role (1 for administrator account and 2 for regular account)
+	Role int `validate:"required" enums:"1,2" example:"2"`
+}
+
+func (payload *userCreatePayload) Validate(r *http.Request) error {
+	if len(payload.Username) == 0 || strings.Contains(payload.Username, " ") {
+		return errors.New("Invalid username. Must not contain any whitespace")
+	}
+
+	if payload.Role != 1 && payload.Role != 2 {
+		return errors.New("Invalid role value. Value must be one of: 1 (administrator) or 2 (regular user)")
+	}
+
+	return nil
+}
+
+// @id UserCreate
+// @summary Create a new user
+// @description Create a new Portainer user.
+// @description Only administrators can create users.
+// @description **Access policy**: restricted
+// @tags users
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @produce json
+// @param body body userCreatePayload true "User details"
+// @success 200 {object} portainer.User "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied"
+// @failure 409 "User already exists"
+// @failure 500 "Server error"
+// @router /users [post]
+func (handler *Handler) userCreate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	var payload userCreatePayload
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	var user *portainer.User
+	var err error
+	err = handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		user, err = handler.createUser(tx, payload)
+		return err
+	})
+
+	return response.TxResponse(w, user, err)
+}
+
+func (handler *Handler) createUser(tx dataservices.DataStoreTx, payload userCreatePayload) (*portainer.User, error) {
+	user, err := tx.User().UserByUsername(payload.Username)
+	if err != nil && !tx.IsErrObjectNotFound(err) {
+		return nil, httperror.InternalServerError("Unable to retrieve users from the database", err)
+	}
+
+	if user != nil {
+		return nil, httperror.Conflict("Another user with the same username already exists", errUserAlreadyExists)
+	}
+
+	user = &portainer.User{
+		Username: payload.Username,
+		Role:     portainer.UserRole(payload.Role),
+	}
+
+	settings, err := tx.Settings().Settings()
+	if err != nil {
+		return nil, httperror.InternalServerError("Unable to retrieve settings from the database", err)
+	}
+
+	// When LDAP/OAuth is on, can only add users without password
+	if (settings.AuthenticationMethod == portainer.AuthenticationLDAP || settings.AuthenticationMethod == portainer.AuthenticationOAuth) && payload.Password != "" {
+		errMsg := "a user with password can not be created when authentication method is Oauth or LDAP"
+		return nil, httperror.BadRequest(errMsg, errors.New(errMsg))
+	}
+
+	if settings.AuthenticationMethod == portainer.AuthenticationInternal {
+		if !handler.passwordStrengthChecker.Check(payload.Password) {
+			return nil, httperror.BadRequest("Password does not meet the requirements", nil)
+		}
+
+		user.Password, err = handler.CryptoService.Hash(payload.Password)
+		if err != nil {
+			return nil, httperror.InternalServerError("Unable to hash user password", errCryptoHashFailure)
+		}
+	}
+
+	if err := tx.User().Create(user); err != nil {
+		return nil, httperror.InternalServerError("Unable to persist user inside the database", err)
+	}
+
+	hideFields(user)
+
+	return user, nil
+}
diff --git a/api/http/handler/users/user_create_access_token.go b/api/http/handler/users/user_create_access_token.go
new file mode 100644
index 0000000..aa10f6f
--- /dev/null
+++ b/api/http/handler/users/user_create_access_token.go
@@ -0,0 +1,133 @@
+package users
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	httperrors "github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/portainer/portainer/pkg/validate"
+)
+
+type userAccessTokenCreatePayload struct {
+	Password    string `validate:"required" example:"password" json:"password"`
+	Description string `validate:"required" example:"github-api-key" json:"description"`
+}
+
+func (payload *userAccessTokenCreatePayload) Validate(r *http.Request) error {
+	if len(payload.Description) == 0 {
+		return errors.New("invalid description: cannot be empty")
+	}
+	if validate.HasWhitespaceOnly(payload.Description) {
+		return errors.New("invalid description: cannot contain only whitespaces")
+	}
+	if validate.MinStringLength(payload.Description, 128) {
+		return errors.New("invalid description: cannot be longer than 128 characters")
+	}
+	return nil
+}
+
+type accessTokenResponse struct {
+	RawAPIKey string           `json:"rawAPIKey"`
+	APIKey    portainer.APIKey `json:"apiKey"`
+}
+
+// @id UserGenerateAPIKey
+// @summary Generate an API key for a user
+// @description Generates an API key for a user.
+// @description Only the calling user can generate a token for themselves.
+// @description Password is required only for internal authentication.
+// @description **Access policy**: restricted
+// @tags users
+// @security jwt
+// @accept json
+// @produce json
+// @param id path int true "User identifier"
+// @param body body userAccessTokenCreatePayload true "details"
+// @success 200 {object} accessTokenResponse "Success"
+// @failure 400 "Invalid request"
+// @failure 401 "Unauthorized"
+// @failure 403 "Permission denied"
+// @failure 404 "User not found"
+// @failure 500 "Server error"
+// @router /users/{id}/tokens [post]
+func (handler *Handler) userCreateAccessToken(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	// specifically require Cookie auth for this endpoint since API-Key based auth is not supported
+	jwt, _ := handler.bouncer.CookieAuthLookup(r)
+	if jwt == nil {
+		jwt, _ = handler.bouncer.JWTAuthLookup(r)
+	}
+
+	if jwt == nil {
+		return httperror.Unauthorized("Auth not supported", errors.New("Authentication required"))
+	}
+
+	var payload userAccessTokenCreatePayload
+	err := request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	userID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid user identifier route variable", err)
+	}
+
+	tokenData, err := security.RetrieveTokenData(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve user authentication token", err)
+	}
+
+	if tokenData.ID != portainer.UserID(userID) {
+		return httperror.Forbidden("Permission denied to create user access token", httperrors.ErrUnauthorized)
+	}
+
+	user, err := handler.DataStore.User().Read(portainer.UserID(userID))
+	if err != nil {
+		return httperror.InternalServerError("Unable to find a user with the specified identifier inside the database", err)
+	}
+
+	internalAuth, err := handler.usesInternalAuthentication(portainer.UserID(userID))
+	if err != nil {
+		return httperror.InternalServerError("Unable to determine the authentication method", err)
+	}
+
+	if internalAuth {
+		// Internal auth requires the password field and must not be empty
+		if len(payload.Password) == 0 {
+			return httperror.BadRequest("Invalid request payload", errors.New("invalid password: cannot be empty"))
+		}
+
+		err = handler.CryptoService.CompareHashAndData(user.Password, payload.Password)
+		if err != nil {
+			return httperror.Forbidden("Current password doesn't match", errors.New("Current password does not match the password provided. Please try again"))
+		}
+	}
+
+	rawAPIKey, apiKey, err := handler.apiKeyService.GenerateApiKey(*user, payload.Description)
+	if err != nil {
+		return httperror.InternalServerError("Internal Server Error", err)
+	}
+
+	return response.JSONWithStatus(w, accessTokenResponse{rawAPIKey, *apiKey}, http.StatusOK)
+}
+
+func (handler *Handler) usesInternalAuthentication(userid portainer.UserID) (bool, error) {
+	// userid 1 is the admin user and always uses internal auth
+	if userid == 1 {
+		return true, nil
+	}
+
+	// otherwise determine the auth method from the settings
+	settings, err := handler.DataStore.Settings().Settings()
+	if err != nil {
+		return false, fmt.Errorf("unable to retrieve the settings from the database: %w", err)
+	}
+
+	return settings.AuthenticationMethod == portainer.AuthenticationInternal, nil
+}
diff --git a/api/http/handler/users/user_create_access_token_test.go b/api/http/handler/users/user_create_access_token_test.go
new file mode 100644
index 0000000..56b1121
--- /dev/null
+++ b/api/http/handler/users/user_create_access_token_test.go
@@ -0,0 +1,146 @@
+package users
+
+import (
+	"bytes"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_userCreateAccessToken(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	_, store := datastore.MustNewTestStore(t, true, true)
+
+	// create admin and standard user(s)
+	adminUser := &portainer.User{ID: 1, Password: "password", Username: "admin", Role: portainer.AdministratorRole}
+	err := store.User().Create(adminUser)
+	require.NoError(t, err, "error creating admin user")
+
+	user := &portainer.User{ID: 2, Username: "standard", Role: portainer.StandardUserRole}
+	err = store.User().Create(user)
+	require.NoError(t, err, "error creating user")
+
+	h, jwtService, apiKeyService := newTestHandler(t, store)
+	h.CryptoService = testhelpers.NewCryptoService()
+
+	// generate standard and admin user tokens
+	adminJWT, _, _ := jwtService.GenerateToken(&portainer.TokenData{ID: adminUser.ID, Username: adminUser.Username, Role: adminUser.Role})
+	jwt, _, _ := jwtService.GenerateToken(&portainer.TokenData{ID: user.ID, Username: user.Username, Role: user.Role})
+
+	t.Run("standard user successfully generates API key", func(t *testing.T) {
+		data := userAccessTokenCreatePayload{Password: "password", Description: "test-token"}
+		payload, err := json.Marshal(data)
+		require.NoError(t, err)
+
+		req := httptest.NewRequest(http.MethodPost, "/users/2/tokens", bytes.NewBuffer(payload))
+		testhelpers.AddTestSecurityCookie(req, jwt)
+
+		rr := httptest.NewRecorder()
+		h.ServeHTTP(rr, req)
+
+		is.Equal(http.StatusOK, rr.Code)
+
+		body, err := io.ReadAll(rr.Body)
+		require.NoError(t, err, "ReadAll should not return error")
+
+		var resp accessTokenResponse
+		err = json.Unmarshal(body, &resp)
+		require.NoError(t, err, "response should be json")
+		is.Equal(data.Description, resp.APIKey.Description)
+		is.NotEmpty(resp.RawAPIKey)
+	})
+
+	t.Run("admin cannot generate API key for standard user", func(t *testing.T) {
+		data := userAccessTokenCreatePayload{Password: "password", Description: "test-token-admin"}
+		payload, err := json.Marshal(data)
+		require.NoError(t, err)
+
+		req := httptest.NewRequest(http.MethodPost, "/users/2/tokens", bytes.NewBuffer(payload))
+		testhelpers.AddTestSecurityCookie(req, adminJWT)
+
+		rr := httptest.NewRecorder()
+		h.ServeHTTP(rr, req)
+
+		is.Equal(http.StatusForbidden, rr.Code)
+
+		_, err = io.ReadAll(rr.Body)
+		require.NoError(t, err, "ReadAll should not return error")
+	})
+
+	t.Run("endpoint cannot generate api-key using api-key auth", func(t *testing.T) {
+		rawAPIKey, _, err := apiKeyService.GenerateApiKey(*user, "test-api-key")
+		require.NoError(t, err)
+
+		data := userAccessTokenCreatePayload{Password: "password", Description: "test-token-fails"}
+		payload, err := json.Marshal(data)
+		require.NoError(t, err)
+
+		req := httptest.NewRequest(http.MethodPost, "/users/2/tokens", bytes.NewBuffer(payload))
+		req.Header.Add("x-api-key", rawAPIKey)
+
+		rr := httptest.NewRecorder()
+		h.ServeHTTP(rr, req)
+
+		is.Equal(http.StatusUnauthorized, rr.Code)
+
+		body, err := io.ReadAll(rr.Body)
+		require.NoError(t, err, "ReadAll should not return error")
+		is.JSONEq(`{"message":"Auth not supported","details":"Authentication required"}`, string(body))
+	})
+}
+
+func Test_userAccessTokenCreatePayload(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		payload    userAccessTokenCreatePayload
+		shouldFail bool
+	}{
+		{
+			payload:    userAccessTokenCreatePayload{Password: "password", Description: "test-token"},
+			shouldFail: false,
+		},
+		{
+			payload:    userAccessTokenCreatePayload{Password: "password", Description: ""},
+			shouldFail: true,
+		},
+		{
+			payload:    userAccessTokenCreatePayload{Password: "password", Description: "test token"},
+			shouldFail: false,
+		},
+		{
+			payload:    userAccessTokenCreatePayload{Password: "password", Description: "test-token "},
+			shouldFail: false,
+		},
+		{
+			payload: userAccessTokenCreatePayload{Password: "password", Description: `
+this string is longer than 128 characters and hence this will fail.
+this string is longer than 128 characters and hence this will fail.
+this string is longer than 128 characters and hence this will fail.
+this string is longer than 128 characters and hence this will fail.
+this string is longer than 128 characters and hence this will fail.
+this string is longer than 128 characters and hence this will fail.
+`},
+			shouldFail: true,
+		},
+	}
+
+	for _, test := range tests {
+		err := test.payload.Validate(nil)
+		if test.shouldFail {
+			require.Error(t, err)
+		} else {
+			require.NoError(t, err)
+		}
+	}
+}
diff --git a/api/http/handler/users/user_create_test.go b/api/http/handler/users/user_create_test.go
new file mode 100644
index 0000000..31c1809
--- /dev/null
+++ b/api/http/handler/users/user_create_test.go
@@ -0,0 +1,99 @@
+package users
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/apikey"
+	"github.com/portainer/portainer/api/crypto"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/jwt"
+
+	"github.com/stretchr/testify/require"
+	"golang.org/x/sync/errgroup"
+)
+
+type mockPasswordStrengthChecker struct{}
+
+func (m mockPasswordStrengthChecker) Check(string) bool {
+	return true
+}
+
+func newTestHandler(t *testing.T, store *datastore.Store) (*Handler, *jwt.Service, apikey.APIKeyService) {
+	t.Helper()
+
+	jwtService, err := jwt.NewService("1h", store)
+	require.NoError(t, err)
+
+	apiKeyService := apikey.NewAPIKeyService(store.APIKeyRepository(), store.User())
+	requestBouncer := security.NewRequestBouncer(t.Context(), store, jwtService, apiKeyService)
+	rateLimiter := security.NewRateLimiter(10, 1*time.Second, 1*time.Hour)
+	passwordChecker := security.NewPasswordStrengthChecker(store.SettingsService)
+
+	h := NewHandler(requestBouncer, rateLimiter, apiKeyService, passwordChecker)
+	h.DataStore = store
+
+	return h, jwtService, apiKeyService
+}
+
+func TestConcurrentUserCreation(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, true, false)
+
+	h := &Handler{
+		passwordStrengthChecker: mockPasswordStrengthChecker{},
+		CryptoService:           crypto.Service{},
+		DataStore:               store,
+	}
+
+	ucp := userCreatePayload{
+		Username: "portainer",
+		Password: "password",
+		Role:     int(portainer.AdministratorRole),
+	}
+
+	m, err := json.Marshal(ucp)
+	require.NoError(t, err)
+
+	errGroup := &errgroup.Group{}
+
+	n := 100
+
+	for range n {
+		errGroup.Go(func() error {
+			req, err := http.NewRequest(http.MethodPost, "/users", bytes.NewReader(m))
+			if err != nil {
+				return err
+			}
+
+			if err := h.userCreate(httptest.NewRecorder(), req); err != nil {
+				return err
+			}
+
+			return nil
+		})
+	}
+
+	err = errGroup.Wait()
+	require.Error(t, err)
+
+	users, err := store.User().ReadAll()
+	require.NotEmpty(t, users)
+	require.NoError(t, err)
+
+	userCreated := false
+	for _, u := range users {
+		if u.Username == ucp.Username {
+			require.False(t, userCreated)
+			userCreated = true
+		}
+	}
+
+	require.True(t, userCreated)
+}
diff --git a/api/http/handler/users/user_delete.go b/api/http/handler/users/user_delete.go
new file mode 100644
index 0000000..25c588d
--- /dev/null
+++ b/api/http/handler/users/user_delete.go
@@ -0,0 +1,110 @@
+package users
+
+import (
+	"errors"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id UserDelete
+// @summary Remove a user
+// @description Remove a user.
+// @description **Access policy**: administrator
+// @tags users
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param id path int true "User identifier"
+// @success 204 "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied"
+// @failure 404 "User not found"
+// @failure 500 "Server error"
+// @router /users/{id} [delete]
+func (handler *Handler) userDelete(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	userID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid user identifier route variable", err)
+	}
+
+	if userID == 1 {
+		return httperror.Forbidden("Cannot remove the initial admin account", errors.New("Cannot remove the initial admin account"))
+	}
+
+	tokenData, err := security.RetrieveTokenData(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve user authentication token", err)
+	}
+
+	if tokenData.ID == portainer.UserID(userID) {
+		return httperror.Forbidden("Cannot remove your own user account. Contact another administrator", errAdminCannotRemoveSelf)
+	}
+
+	user, err := handler.DataStore.User().Read(portainer.UserID(userID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find a user with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find a user with the specified identifier inside the database", err)
+	}
+
+	if user.Role == portainer.AdministratorRole {
+		return handler.deleteAdminUser(w, user)
+	}
+
+	return handler.deleteUser(w, user)
+}
+
+func (handler *Handler) deleteAdminUser(w http.ResponseWriter, user *portainer.User) *httperror.HandlerError {
+	if user.Password == "" {
+		return handler.deleteUser(w, user)
+	}
+
+	users, err := handler.DataStore.User().ReadAll()
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve users from the database", err)
+	}
+
+	localAdminCount := 0
+	for _, u := range users {
+		if u.Role == portainer.AdministratorRole && u.Password != "" {
+			localAdminCount++
+		}
+	}
+
+	if localAdminCount < 2 {
+		return httperror.InternalServerError("Cannot remove local administrator user", errCannotRemoveLastLocalAdmin)
+	}
+
+	return handler.deleteUser(w, user)
+}
+
+func (handler *Handler) deleteUser(w http.ResponseWriter, user *portainer.User) *httperror.HandlerError {
+	err := handler.DataStore.User().Delete(user.ID)
+	if err != nil {
+		return httperror.InternalServerError("Unable to remove user from the database", err)
+	}
+
+	err = handler.DataStore.TeamMembership().DeleteTeamMembershipByUserID(user.ID)
+	if err != nil {
+		return httperror.InternalServerError("Unable to remove user memberships from the database", err)
+	}
+
+	// Remove all of the users persisted API keys
+	apiKeys, err := handler.apiKeyService.GetAPIKeys(user.ID)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve user API keys from the database", err)
+	}
+	for _, k := range apiKeys {
+		err = handler.apiKeyService.DeleteAPIKey(k.ID)
+		if err != nil {
+			return httperror.InternalServerError("Unable to remove user API key from the database", err)
+		}
+	}
+
+	return response.Empty(w)
+}
diff --git a/api/http/handler/users/user_delete_test.go b/api/http/handler/users/user_delete_test.go
new file mode 100644
index 0000000..28adc11
--- /dev/null
+++ b/api/http/handler/users/user_delete_test.go
@@ -0,0 +1,47 @@
+package users
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_deleteUserRemovesAccessTokens(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	_, store := datastore.MustNewTestStore(t, true, true)
+
+	// create standard user
+	user := &portainer.User{ID: 2, Username: "standard", Role: portainer.StandardUserRole}
+	err := store.User().Create(user)
+	require.NoError(t, err, "error creating user")
+
+	h, _, apiKeyService := newTestHandler(t, store)
+
+	t.Run("standard user deletion removes all associated access tokens", func(t *testing.T) {
+		_, _, err := apiKeyService.GenerateApiKey(*user, "test-user-token")
+		require.NoError(t, err)
+
+		keys, err := apiKeyService.GetAPIKeys(user.ID)
+		require.NoError(t, err)
+		is.Len(keys, 1)
+
+		rr := httptest.NewRecorder()
+
+		handleErr := h.deleteUser(rr, user)
+		require.Nil(t, handleErr)
+
+		is.Equal(http.StatusNoContent, rr.Code)
+
+		keys, err = apiKeyService.GetAPIKeys(user.ID)
+		require.NoError(t, err)
+		is.Empty(keys)
+	})
+}
diff --git a/api/http/handler/users/user_effective_access.go b/api/http/handler/users/user_effective_access.go
new file mode 100644
index 0000000..2bf43b5
--- /dev/null
+++ b/api/http/handler/users/user_effective_access.go
@@ -0,0 +1,169 @@
+package users
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/pkg/authorization"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// AccessLocation describes which part of the access model granted the user
+// their effective role on an environment. The frontend maps these enum values
+// to display strings.
+type AccessLocation string
+
+const (
+	AccessLocationEnvironment      AccessLocation = "environment"
+	AccessLocationEnvironmentGroup AccessLocation = "environmentGroup"
+)
+
+// @id UserEffectiveAccessInspect
+// @summary Inspect a user's effective access on every environment
+// @description Returns the resolved role for each environment the user can access,
+// @description following the policy precedence used by the access viewer
+// @description (user-endpoint, user-group, team-endpoint, team-group).
+// @description Environments where the user has no role are omitted.
+// @description **Access policy**: restricted
+// @tags users
+// @security ApiKeyAuth || jwt
+// @produce json
+// @param id path int true "User identifier"
+// @success 200 {array} EffectiveAccessEntry "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied"
+// @failure 404 "User not found"
+// @failure 500 "Server error"
+// @router /users/{id}/effective-access [get]
+func (handler *Handler) userEffectiveAccess(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	userID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid user identifier route variable", err)
+	}
+
+	tokenData, err := security.RetrieveTokenData(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve user authentication token", err)
+	}
+	if tokenData.Role != portainer.AdministratorRole && tokenData.ID != portainer.UserID(userID) {
+		return httperror.Forbidden("Permission denied to inspect another user's effective access", errors.ErrUnauthorized)
+	}
+
+	entries := make([]EffectiveAccessEntry, 0)
+	if err := handler.DataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
+		user, err := tx.User().Read(portainer.UserID(userID))
+		if handler.DataStore.IsErrObjectNotFound(err) {
+			return httperror.NotFound("Unable to find a user with the specified identifier inside the database", err)
+		} else if err != nil {
+			return httperror.InternalServerError("Unable to find a user with the specified identifier inside the database", err)
+		}
+
+		endpoints, err := tx.Endpoint().ReadAll()
+		if err != nil {
+			return httperror.InternalServerError("Unable to retrieve environments from the database", err)
+		}
+
+		groups, err := tx.EndpointGroup().ReadAll()
+		if err != nil {
+			return httperror.InternalServerError("Unable to retrieve environment groups from the database", err)
+		}
+
+		roles, err := tx.Role().ReadAll()
+		if err != nil {
+			return httperror.InternalServerError("Unable to retrieve roles from the database", err)
+		}
+
+		teams, err := tx.Team().ReadAll()
+		if err != nil {
+			return httperror.InternalServerError("Unable to retrieve teams from the database", err)
+		}
+
+		memberships, err := tx.TeamMembership().TeamMembershipsByUserID(user.ID)
+		if err != nil {
+			return httperror.InternalServerError("Unable to retrieve team memberships from the database", err)
+		}
+
+		groupsByID := make(map[portainer.EndpointGroupID]portainer.EndpointGroup, len(groups))
+		for _, g := range groups {
+			groupsByID[g.ID] = g
+		}
+
+		teamsByID := make(map[portainer.TeamID]portainer.Team, len(teams))
+		for _, t := range teams {
+			teamsByID[t.ID] = t
+		}
+
+		for i := range endpoints {
+			endpoint := &endpoints[i]
+
+			access := authorization.ResolveUserEndpointAccess(authorization.ResolverInput{
+				User:            user,
+				Endpoint:        endpoint,
+				EndpointGroup:   groupsByID[endpoint.GroupID],
+				Roles:           roles,
+				UserMemberships: memberships,
+			})
+			if access == nil {
+				continue
+			}
+
+			entries = append(entries, buildEffectiveAccessEntry(access, endpoint, groupsByID, teamsByID))
+		}
+		return nil
+	}); err != nil {
+		return response.TxErrorResponse(err)
+	}
+
+	return response.JSON(w, entries)
+}
+
+func buildEffectiveAccessEntry(
+	access *authorization.ResolvedAccess,
+	endpoint *portainer.Endpoint,
+	groupsByID map[portainer.EndpointGroupID]portainer.EndpointGroup,
+	teamsByID map[portainer.TeamID]portainer.Team,
+) EffectiveAccessEntry {
+	entry := EffectiveAccessEntry{
+		EndpointID:     endpoint.ID,
+		EndpointName:   endpoint.Name,
+		RoleID:         access.Role.ID,
+		RoleName:       access.Role.Name,
+		RolePriority:   access.Role.Priority,
+		AccessLocation: AccessLocationEnvironment,
+	}
+
+	if access.Source.GroupID != 0 {
+		entry.GroupID = access.Source.GroupID
+		entry.AccessLocation = AccessLocationEnvironmentGroup
+		if g, ok := groupsByID[access.Source.GroupID]; ok {
+			entry.GroupName = g.Name
+		}
+	}
+
+	if access.Source.TeamID != 0 {
+		entry.TeamID = access.Source.TeamID
+		if t, ok := teamsByID[access.Source.TeamID]; ok {
+			entry.TeamName = t.Name
+		}
+	}
+
+	return entry
+}
+
+type EffectiveAccessEntry struct {
+	EndpointID     portainer.EndpointID      `json:"endpointId"`
+	EndpointName   string                    `json:"endpointName"`
+	RoleID         portainer.RoleID          `json:"roleId"`
+	RoleName       string                    `json:"roleName"`
+	RolePriority   int                       `json:"rolePriority"`
+	GroupID        portainer.EndpointGroupID `json:"groupId,omitempty"`
+	GroupName      string                    `json:"groupName,omitempty"`
+	TeamID         portainer.TeamID          `json:"teamId,omitempty"`
+	TeamName       string                    `json:"teamName,omitempty"`
+	AccessLocation AccessLocation            `json:"accessLocation"`
+}
diff --git a/api/http/handler/users/user_effective_access_test.go b/api/http/handler/users/user_effective_access_test.go
new file mode 100644
index 0000000..63dc60e
--- /dev/null
+++ b/api/http/handler/users/user_effective_access_test.go
@@ -0,0 +1,105 @@
+package users
+
+import (
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_userEffectiveAccess(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	_, store := datastore.MustNewTestStore(t, true, true)
+
+	const (
+		standardRoleID portainer.RoleID = 1
+		helpdeskRoleID portainer.RoleID = 2
+		teamID         portainer.TeamID = 100
+		groupID                         = portainer.EndpointGroupID(10)
+		envID                           = portainer.EndpointID(200)
+	)
+
+	require.NoError(t, store.Role().Create(&portainer.Role{ID: standardRoleID, Name: "Standard user", Priority: 1}))
+	require.NoError(t, store.Role().Create(&portainer.Role{ID: helpdeskRoleID, Name: "Helpdesk", Priority: 5}))
+
+	require.NoError(t, store.EndpointGroup().Create(&portainer.EndpointGroup{ID: groupID, Name: "production"}))
+	require.NoError(t, store.Team().Create(&portainer.Team{ID: teamID, Name: "devs"}))
+
+	adminUser := &portainer.User{ID: 1, Username: "admin", Role: portainer.AdministratorRole}
+	require.NoError(t, store.User().Create(adminUser))
+
+	targetUser := &portainer.User{ID: 2, Username: "alice", Role: portainer.StandardUserRole}
+	require.NoError(t, store.User().Create(targetUser))
+
+	otherUser := &portainer.User{ID: 3, Username: "bob", Role: portainer.StandardUserRole}
+	require.NoError(t, store.User().Create(otherUser))
+
+	require.NoError(t, store.TeamMembership().Create(&portainer.TeamMembership{ID: 1, UserID: targetUser.ID, TeamID: teamID, Role: portainer.TeamMember}))
+
+	require.NoError(t, store.Endpoint().Create(&portainer.Endpoint{
+		ID:                 envID,
+		Name:               "env-1",
+		GroupID:            groupID,
+		UserAccessPolicies: portainer.UserAccessPolicies{targetUser.ID: {RoleID: standardRoleID}},
+		TeamAccessPolicies: portainer.TeamAccessPolicies{teamID: {RoleID: helpdeskRoleID}},
+	}))
+
+	h, jwtService, _ := newTestHandler(t, store)
+
+	adminJWT, _, _ := jwtService.GenerateToken(&portainer.TokenData{ID: adminUser.ID, Username: adminUser.Username, Role: adminUser.Role})
+	targetJWT, _, _ := jwtService.GenerateToken(&portainer.TokenData{ID: targetUser.ID, Username: targetUser.Username, Role: targetUser.Role})
+	otherJWT, _, _ := jwtService.GenerateToken(&portainer.TokenData{ID: otherUser.ID, Username: otherUser.Username, Role: otherUser.Role})
+
+	doRequest := func(t *testing.T, jwt string, path string) *httptest.ResponseRecorder {
+		t.Helper()
+		req := httptest.NewRequest(http.MethodGet, path, nil)
+		testhelpers.AddTestSecurityCookie(req, jwt)
+		rr := httptest.NewRecorder()
+		h.ServeHTTP(rr, req)
+		return rr
+	}
+
+	t.Run("admin can inspect another user", func(t *testing.T) {
+		rr := doRequest(t, adminJWT, "/users/2/effective-access")
+		is.Equal(http.StatusOK, rr.Code)
+
+		body, err := io.ReadAll(rr.Body)
+		require.NoError(t, err)
+
+		var resp []EffectiveAccessEntry
+		require.NoError(t, json.Unmarshal(body, &resp))
+		is.Len(resp, 1)
+		is.Equal(envID, resp[0].EndpointID)
+		is.Equal(standardRoleID, resp[0].RoleID)
+	})
+
+	t.Run("user can inspect themselves", func(t *testing.T) {
+		rr := doRequest(t, targetJWT, "/users/2/effective-access")
+		is.Equal(http.StatusOK, rr.Code)
+	})
+
+	t.Run("non-admin cannot inspect another user", func(t *testing.T) {
+		rr := doRequest(t, otherJWT, "/users/2/effective-access")
+		is.Equal(http.StatusForbidden, rr.Code)
+	})
+
+	t.Run("returns 404 when target user does not exist", func(t *testing.T) {
+		rr := doRequest(t, adminJWT, "/users/9999/effective-access")
+		is.Equal(http.StatusNotFound, rr.Code)
+	})
+
+	t.Run("returns 400 when id is not numeric", func(t *testing.T) {
+		rr := doRequest(t, adminJWT, "/users/not-a-number/effective-access")
+		is.Equal(http.StatusBadRequest, rr.Code)
+	})
+}
diff --git a/api/http/handler/users/user_get_access_tokens.go b/api/http/handler/users/user_get_access_tokens.go
new file mode 100644
index 0000000..45a26a6
--- /dev/null
+++ b/api/http/handler/users/user_get_access_tokens.go
@@ -0,0 +1,68 @@
+package users
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	httperrors "github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id UserGetAPIKeys
+// @summary Get all API keys for a user
+// @description Gets all API keys for a user.
+// @description Only the calling user or admin can retrieve api-keys.
+// @description **Access policy**: authenticated
+// @tags users
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param id path int true "User identifier"
+// @success 200 {array} portainer.APIKey "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied"
+// @failure 404 "User not found"
+// @failure 500 "Server error"
+// @router /users/{id}/tokens [get]
+func (handler *Handler) userGetAccessTokens(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	userID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid user identifier route variable", err)
+	}
+
+	user, err := handler.DataStore.User().Read(portainer.UserID(userID))
+	if err != nil {
+		if handler.DataStore.IsErrObjectNotFound(err) {
+			return httperror.NotFound("Unable to find a user with the specified identifier inside the database", err)
+		}
+		return httperror.InternalServerError("Unable to find a user with the specified identifier inside the database", err)
+	}
+
+	tokenData, err := security.RetrieveTokenData(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve user authentication token", err)
+	}
+
+	if tokenData.ID != portainer.UserID(userID) && (tokenData.Role != portainer.AdministratorRole || user.Role == portainer.AdministratorRole) {
+		return httperror.Forbidden("Permission denied to get user access tokens", httperrors.ErrUnauthorized)
+	}
+
+	apiKeys, err := handler.apiKeyService.GetAPIKeys(portainer.UserID(userID))
+	if err != nil {
+		return httperror.InternalServerError("Internal Server Error", err)
+	}
+
+	for idx := range apiKeys {
+		hideAPIKeyFields(&apiKeys[idx])
+	}
+
+	return response.JSON(w, apiKeys)
+}
+
+// hideAPIKeyFields remove the digest from the API key (it is not needed in the response)
+func hideAPIKeyFields(apiKey *portainer.APIKey) {
+	apiKey.Digest = ""
+}
diff --git a/api/http/handler/users/user_get_access_tokens_test.go b/api/http/handler/users/user_get_access_tokens_test.go
new file mode 100644
index 0000000..6ceb8c7
--- /dev/null
+++ b/api/http/handler/users/user_get_access_tokens_test.go
@@ -0,0 +1,126 @@
+package users
+
+import (
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_userGetAccessTokens(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	_, store := datastore.MustNewTestStore(t, true, true)
+
+	// create admin and standard user(s)
+	adminUser := &portainer.User{ID: 1, Username: "admin", Role: portainer.AdministratorRole}
+	err := store.User().Create(adminUser)
+	require.NoError(t, err, "error creating admin user")
+
+	user := &portainer.User{ID: 2, Username: "standard", Role: portainer.StandardUserRole}
+	err = store.User().Create(user)
+	require.NoError(t, err, "error creating user")
+
+	h, jwtService, apiKeyService := newTestHandler(t, store)
+
+	// generate standard and admin user tokens
+	adminJWT, _, _ := jwtService.GenerateToken(&portainer.TokenData{ID: adminUser.ID, Username: adminUser.Username, Role: adminUser.Role})
+	jwt, _, _ := jwtService.GenerateToken(&portainer.TokenData{ID: user.ID, Username: user.Username, Role: user.Role})
+
+	t.Run("standard user can successfully retrieve API key", func(t *testing.T) {
+		_, apiKey, err := apiKeyService.GenerateApiKey(*user, "test-get-token")
+		require.NoError(t, err)
+
+		req := httptest.NewRequest(http.MethodGet, "/users/2/tokens", nil)
+		testhelpers.AddTestSecurityCookie(req, jwt)
+
+		rr := httptest.NewRecorder()
+		h.ServeHTTP(rr, req)
+
+		is.Equal(http.StatusOK, rr.Code)
+
+		body, err := io.ReadAll(rr.Body)
+		require.NoError(t, err, "ReadAll should not return error")
+
+		var resp []portainer.APIKey
+		err = json.Unmarshal(body, &resp)
+		require.NoError(t, err, "response should be list json")
+
+		is.Len(resp, 1)
+		if len(resp) == 1 {
+			is.Empty(resp[0].Digest)
+			is.Equal(apiKey.ID, resp[0].ID)
+			is.Equal(apiKey.UserID, resp[0].UserID)
+			is.Equal(apiKey.Prefix, resp[0].Prefix)
+			is.Equal(apiKey.Description, resp[0].Description)
+		}
+	})
+
+	t.Run("admin can retrieve standard user API Key", func(t *testing.T) {
+		_, _, err := apiKeyService.GenerateApiKey(*user, "test-get-admin-token")
+		require.NoError(t, err)
+
+		req := httptest.NewRequest(http.MethodGet, "/users/2/tokens", nil)
+		testhelpers.AddTestSecurityCookie(req, adminJWT)
+
+		rr := httptest.NewRecorder()
+		h.ServeHTTP(rr, req)
+
+		is.Equal(http.StatusOK, rr.Code)
+
+		body, err := io.ReadAll(rr.Body)
+		require.NoError(t, err, "ReadAll should not return error")
+
+		var resp []portainer.APIKey
+		err = json.Unmarshal(body, &resp)
+		require.NoError(t, err, "response should be list json")
+
+		is.NotEmpty(resp)
+	})
+
+	t.Run("user can retrieve API Key using api-key auth", func(t *testing.T) {
+		rawAPIKey, _, err := apiKeyService.GenerateApiKey(*user, "test-api-key")
+		require.NoError(t, err)
+
+		req := httptest.NewRequest(http.MethodGet, "/users/2/tokens", nil)
+		req.Header.Add("x-api-key", rawAPIKey)
+
+		rr := httptest.NewRecorder()
+		h.ServeHTTP(rr, req)
+
+		is.Equal(http.StatusOK, rr.Code)
+
+		body, err := io.ReadAll(rr.Body)
+		require.NoError(t, err, "ReadAll should not return error")
+
+		var resp []portainer.APIKey
+		err = json.Unmarshal(body, &resp)
+		require.NoError(t, err, "response should be list json")
+
+		is.NotEmpty(resp)
+	})
+}
+
+func Test_hideAPIKeyFields(t *testing.T) {
+	t.Parallel()
+	apiKey := &portainer.APIKey{
+		ID:          1,
+		UserID:      2,
+		Prefix:      "abc",
+		Description: "test",
+		Digest:      "",
+	}
+
+	hideAPIKeyFields(apiKey)
+
+	require.Empty(t, apiKey.Digest, "digest should be cleared when hiding api key fields")
+}
diff --git a/api/http/handler/users/user_helm_repos.go b/api/http/handler/users/user_helm_repos.go
new file mode 100644
index 0000000..0bb37d0
--- /dev/null
+++ b/api/http/handler/users/user_helm_repos.go
@@ -0,0 +1,201 @@
+package users
+
+import (
+	"net/http"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	httperrors "github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/pkg/libhelm"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/portainer/portainer/pkg/libhttp/ssrf"
+
+	"github.com/pkg/errors"
+)
+
+type helmUserRepositoryResponse struct {
+	GlobalRepository string                         `json:"GlobalRepository"`
+	UserRepositories []portainer.HelmUserRepository `json:"UserRepositories"`
+}
+
+type addHelmRepoUrlPayload struct {
+	URL string `json:"url"`
+}
+
+func (p *addHelmRepoUrlPayload) Validate(r *http.Request) error {
+	if err := ssrf.CheckURL(r.Context(), p.URL); err != nil {
+		return err
+	}
+
+	return libhelm.ValidateHelmRepositoryURL(p.URL, nil)
+}
+
+// @id HelmUserRepositoryCreate
+// @summary Create a user helm repository
+// @description Create a user helm repository.
+// @description **Access policy**: authenticated
+// @tags helm
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @produce json
+// @param id path int true "User identifier"
+// @param payload body addHelmRepoUrlPayload true "Helm Repository"
+// @success 200 {object} portainer.HelmUserRepository "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied"
+// @failure 500 "Server error"
+// @router /users/{id}/helm/repositories [post]
+func (handler *Handler) userCreateHelmRepo(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	userIDEndpoint, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid user identifier route variable", err)
+	}
+
+	tokenData, err := security.RetrieveTokenData(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve user authentication token", err)
+	}
+
+	userID := portainer.UserID(userIDEndpoint)
+	if tokenData.ID != userID {
+		return httperror.Forbidden("Couldn't create Helm repositories for another user", httperrors.ErrUnauthorized)
+	}
+
+	p := new(addHelmRepoUrlPayload)
+	err = request.DecodeAndValidateJSONPayload(r, p)
+	if err != nil {
+		return httperror.BadRequest("Invalid Helm repository URL", err)
+	}
+
+	// lowercase, remove trailing slash
+	p.URL = strings.TrimSuffix(strings.ToLower(p.URL), "/")
+
+	records, err := handler.DataStore.HelmUserRepository().HelmUserRepositoryByUserID(userID)
+	if err != nil {
+		return httperror.InternalServerError("Unable to access the DataStore", err)
+	}
+
+	// check if repo already exists - by doing case insensitive comparison
+	for _, record := range records {
+		if strings.EqualFold(record.URL, p.URL) {
+			errMsg := "Helm repo already registered for user"
+			return httperror.BadRequest(errMsg, errors.New(errMsg))
+		}
+	}
+
+	record := portainer.HelmUserRepository{
+		UserID: userID,
+		URL:    p.URL,
+	}
+
+	err = handler.DataStore.HelmUserRepository().Create(&record)
+	if err != nil {
+		return httperror.InternalServerError("Unable to save a user Helm repository URL", err)
+	}
+
+	return response.JSON(w, record)
+}
+
+// @id HelmUserRepositoriesList
+// @summary List a users helm repositories
+// @description Inspect a user helm repositories.
+// @description **Access policy**: authenticated
+// @tags helm
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param id path int true "User identifier"
+// @success 200 {object} helmUserRepositoryResponse "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied"
+// @failure 500 "Server error"
+// @router /users/{id}/helm/repositories [get]
+func (handler *Handler) userGetHelmRepos(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	userIDEndpoint, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid user identifier route variable", err)
+	}
+
+	tokenData, err := security.RetrieveTokenData(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve user authentication token", err)
+	}
+
+	userID := portainer.UserID(userIDEndpoint)
+	if tokenData.ID != userID {
+		return httperror.Forbidden("Couldn't create Helm repositories for another user", httperrors.ErrUnauthorized)
+	}
+
+	settings, err := handler.DataStore.Settings().Settings()
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve settings from the database", err)
+	}
+
+	userRepos, err := handler.DataStore.HelmUserRepository().HelmUserRepositoryByUserID(userID)
+	if err != nil {
+		return httperror.InternalServerError("Unable to get user Helm repositories", err)
+	}
+
+	resp := helmUserRepositoryResponse{
+		GlobalRepository: settings.HelmRepositoryURL,
+		UserRepositories: userRepos,
+	}
+
+	return response.JSON(w, resp)
+}
+
+// @id HelmUserRepositoryDelete
+// @summary Delete a users helm repositoryies
+// @description **Access policy**: authenticated
+// @tags helm
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param id path int true "User identifier"
+// @param repositoryID path int true "Repository identifier"
+// @success 204 "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied"
+// @failure 500 "Server error"
+// @router /users/{id}/helm/repositories/{repositoryID} [delete]
+func (handler *Handler) userDeleteHelmRepo(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	userIDEndpoint, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid user identifier route variable", err)
+	}
+
+	tokenData, err := security.RetrieveTokenData(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve user authentication token", err)
+	}
+
+	userID := portainer.UserID(userIDEndpoint)
+	if tokenData.ID != userID {
+		return httperror.Forbidden("Couldn't create Helm repositories for another user", httperrors.ErrUnauthorized)
+	}
+
+	repositoryID, err := request.RetrieveNumericRouteVariableValue(r, "repositoryID")
+	if err != nil {
+		return httperror.BadRequest("Invalid user identifier route variable", err)
+	}
+
+	userRepos, err := handler.DataStore.HelmUserRepository().HelmUserRepositoryByUserID(userID)
+	if err != nil {
+		return httperror.InternalServerError("Unable to get user Helm repositories", err)
+	}
+
+	for _, repo := range userRepos {
+		if repo.ID == portainer.HelmUserRepositoryID(repositoryID) && repo.UserID == userID {
+			err = handler.DataStore.HelmUserRepository().Delete(portainer.HelmUserRepositoryID(repositoryID))
+			if err != nil {
+				return httperror.InternalServerError("Unable to delete user Helm repository", err)
+			}
+		}
+	}
+
+	return response.JSON(w, nil)
+}
diff --git a/api/http/handler/users/user_inspect.go b/api/http/handler/users/user_inspect.go
new file mode 100644
index 0000000..f3308b6
--- /dev/null
+++ b/api/http/handler/users/user_inspect.go
@@ -0,0 +1,54 @@
+package users
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id UserInspect
+// @summary Inspect a user
+// @description Retrieve details about a user.
+// @description User passwords are filtered out, and should never be accessible.
+// @description **Access policy**: authenticated
+// @tags users
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param id path int true "User identifier"
+// @success 200 {object} portainer.User "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied"
+// @failure 404 "User not found"
+// @failure 500 "Server error"
+// @router /users/{id} [get]
+func (handler *Handler) userInspect(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	userID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid user identifier route variable", err)
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	if !securityContext.IsAdmin && securityContext.UserID != portainer.UserID(userID) {
+		return httperror.Forbidden("Permission denied inspect user", errors.ErrResourceAccessDenied)
+	}
+
+	user, err := handler.DataStore.User().Read(portainer.UserID(userID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find a user with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find a user with the specified identifier inside the database", err)
+	}
+
+	hideFields(user)
+	return response.JSON(w, user)
+}
diff --git a/api/http/handler/users/user_inspect_me.go b/api/http/handler/users/user_inspect_me.go
new file mode 100644
index 0000000..a199fda
--- /dev/null
+++ b/api/http/handler/users/user_inspect_me.go
@@ -0,0 +1,58 @@
+package users
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type CurrentUserInspectResponse struct {
+	*portainer.User
+	ForceChangePassword bool `json:"forceChangePassword"`
+}
+
+// @id CurrentUserInspect
+// @summary Inspect the current user user
+// @description Retrieve details about the current  user.
+// @description User passwords are filtered out, and should never be accessible.
+// @description **Access policy**: authenticated
+// @tags users
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @success 200 {object} portainer.User "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied"
+// @failure 404 "User not found"
+// @failure 500 "Server error"
+// @router /users/me [get]
+func (handler *Handler) userInspectMe(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	tokenData, err := security.RetrieveTokenData(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve user authentication token", err)
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	user, err := handler.DataStore.User().Read(securityContext.UserID)
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find a user with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find a user with the specified identifier inside the database", err)
+	}
+
+	hideFields(user)
+	return response.JSON(
+		w,
+		&CurrentUserInspectResponse{
+			User:                user,
+			ForceChangePassword: tokenData.ForceChangePassword,
+		},
+	)
+}
diff --git a/api/http/handler/users/user_list.go b/api/http/handler/users/user_list.go
new file mode 100644
index 0000000..696a138
--- /dev/null
+++ b/api/http/handler/users/user_list.go
@@ -0,0 +1,105 @@
+package users
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type User struct {
+	ID       portainer.UserID `json:"Id" example:"1"`
+	Username string           `json:"Username" example:"bob"`
+	// User role (1 for administrator account and 2 for regular account)
+	Role portainer.UserRole `json:"Role" example:"1"`
+}
+
+// @id UserList
+// @summary List users
+// @description List Portainer users.
+// @description Non-administrator users will only be able to list other non-administrator user accounts.
+// @description User passwords are filtered out, and should never be accessible.
+// @description **Access policy**: restricted
+// @tags users
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param environmentId query int false "Identifier of the environment(endpoint) that will be used to filter the authorized users"
+// @success 200 {array} portainer.User "Success"
+// @failure 400 "Invalid request"
+// @failure 500 "Server error"
+// @router /users [get]
+func (handler *Handler) userList(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
+	if !securityContext.IsAdmin && !securityContext.IsTeamLeader {
+		return httperror.Forbidden("Permission denied to access users list", err)
+	}
+
+	users, err := handler.DataStore.User().ReadAll()
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve users from the database", err)
+	}
+
+	availableUsers := security.FilterUsers(users, securityContext)
+
+	endpointID, _ := request.RetrieveNumericQueryParameter(r, "environmentId", true)
+	if endpointID == 0 {
+		users := sanitizeUsers(availableUsers)
+		return response.JSON(w, users)
+	}
+
+	// filter out users who do not have access to the specific endpoint
+	endpoint, err := handler.DataStore.Endpoint().Endpoint(portainer.EndpointID(endpointID))
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve endpoint from the database", err)
+	}
+
+	endpointGroup, err := handler.DataStore.EndpointGroup().Read(endpoint.GroupID)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve environment groups from the database", err)
+	}
+
+	canAccessEndpoint := make([]User, 0)
+	for _, user := range availableUsers {
+		// the users who have the endpoint authorization
+		if _, ok := user.EndpointAuthorizations[endpoint.ID]; ok {
+			canAccessEndpoint = append(canAccessEndpoint, sanitizeUser(user))
+			continue
+		}
+
+		// the user inherits the endpoint access from team or environment group
+		teamMemberships, err := handler.DataStore.TeamMembership().TeamMembershipsByUserID(user.ID)
+		if err != nil {
+			return httperror.InternalServerError("Unable to retrieve team membership from the database", err)
+		}
+
+		if security.AuthorizedEndpointAccess(endpoint, endpointGroup, user.ID, teamMemberships) {
+			canAccessEndpoint = append(canAccessEndpoint, sanitizeUser(user))
+		}
+	}
+
+	return response.JSON(w, canAccessEndpoint)
+}
+
+func sanitizeUser(user portainer.User) User {
+	return User{
+		ID:       user.ID,
+		Username: user.Username,
+		Role:     user.Role,
+	}
+}
+
+func sanitizeUsers(users []portainer.User) []User {
+	u := make([]User, len(users))
+	for i := range users {
+		u[i] = sanitizeUser(users[i])
+	}
+	return u
+}
diff --git a/api/http/handler/users/user_list_test.go b/api/http/handler/users/user_list_test.go
new file mode 100644
index 0000000..a8e2957
--- /dev/null
+++ b/api/http/handler/users/user_list_test.go
@@ -0,0 +1,260 @@
+package users
+
+import (
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_userList(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	_, store := datastore.MustNewTestStore(t, true, true)
+
+	// Create admin and standard user(s)
+	adminUser := &portainer.User{ID: 1, Username: "admin", Role: portainer.AdministratorRole}
+	err := store.User().Create(adminUser)
+	require.NoError(t, err, "error creating admin user")
+
+	h, jwtService, _ := newTestHandler(t, store)
+
+	// Generate admin user tokens
+	adminJWT, _, _ := jwtService.GenerateToken(&portainer.TokenData{ID: adminUser.ID, Username: adminUser.Username, Role: adminUser.Role})
+
+	// Case 1: the user is given the endpoint access directly
+	userWithEndpointAccess := &portainer.User{ID: 2, Username: "standard-user-with-endpoint-access", Role: portainer.StandardUserRole, PortainerAuthorizations: authorization.DefaultPortainerAuthorizations()}
+	err = store.User().Create(userWithEndpointAccess)
+	require.NoError(t, err, "error creating user")
+
+	userWithoutEndpointAccess := &portainer.User{ID: 3, Username: "standard-user-without-endpoint-access", Role: portainer.StandardUserRole, PortainerAuthorizations: authorization.DefaultPortainerAuthorizations()}
+	err = store.User().Create(userWithoutEndpointAccess)
+	require.NoError(t, err, "error creating user")
+
+	// Create environment group
+	endpointGroup := &portainer.EndpointGroup{ID: 1, Name: "default-endpoint-group"}
+	err = store.EndpointGroup().Create(endpointGroup)
+	require.NoError(t, err, "error creating endpoint group")
+
+	// Create endpoint and user access policies
+	userAccessPolicies := make(portainer.UserAccessPolicies, 0)
+	userAccessPolicies[userWithEndpointAccess.ID] = portainer.AccessPolicy{RoleID: portainer.RoleID(userWithEndpointAccess.Role)}
+
+	endpointWithUserAccessPolicy := &portainer.Endpoint{ID: 1, UserAccessPolicies: userAccessPolicies, GroupID: endpointGroup.ID}
+	err = store.Endpoint().Create(endpointWithUserAccessPolicy)
+	require.NoError(t, err, "error creating endpoint")
+
+	jwt, _, _ := jwtService.GenerateToken(&portainer.TokenData{ID: userWithEndpointAccess.ID, Username: userWithEndpointAccess.Username, Role: userWithEndpointAccess.Role})
+
+	t.Run("admin user can successfully list all users", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodGet, "/users", nil)
+		testhelpers.AddTestSecurityCookie(req, adminJWT)
+
+		rr := httptest.NewRecorder()
+		h.ServeHTTP(rr, req)
+
+		is.Equal(http.StatusOK, rr.Code)
+
+		body, err := io.ReadAll(rr.Body)
+		require.NoError(t, err, "ReadAll should not return error")
+
+		var resp []portainer.User
+		err = json.Unmarshal(body, &resp)
+		require.NoError(t, err, "response should be list json")
+
+		is.Len(resp, 3)
+	})
+
+	t.Run("admin user can list users who are given the endpoint access directly", func(t *testing.T) {
+		params := url.Values{}
+		params.Add("environmentId", fmt.Sprintf("%d", endpointWithUserAccessPolicy.ID))
+		req := httptest.NewRequest(http.MethodGet, "/users?"+params.Encode(), nil)
+		testhelpers.AddTestSecurityCookie(req, adminJWT)
+
+		rr := httptest.NewRecorder()
+		h.ServeHTTP(rr, req)
+
+		is.Equal(http.StatusOK, rr.Code)
+
+		body, err := io.ReadAll(rr.Body)
+		require.NoError(t, err, "ReadAll should not return error")
+
+		var resp []portainer.User
+		err = json.Unmarshal(body, &resp)
+		require.NoError(t, err, "response should be list json")
+
+		is.Len(resp, 1)
+		if len(resp) == 1 {
+			is.Equal(userWithEndpointAccess.ID, resp[0].ID)
+		}
+	})
+
+	t.Run("standard user cannot list users", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodGet, "/users", nil)
+		testhelpers.AddTestSecurityCookie(req, jwt)
+
+		rr := httptest.NewRecorder()
+		h.ServeHTTP(rr, req)
+
+		is.Equal(http.StatusForbidden, rr.Code)
+	})
+
+	// Case 2: the user is under an environment group and the environment group has endpoint access.
+	//         the user inherits the endpoint access from the environment group
+	// create user
+	userUnderGroup := &portainer.User{ID: 4, Username: "standard-user-under-environment-group", Role: portainer.StandardUserRole, PortainerAuthorizations: authorization.DefaultPortainerAuthorizations()}
+	err = store.User().Create(userUnderGroup)
+	require.NoError(t, err, "error creating user")
+
+	// Create environment group including a user
+	userAccessPoliciesUnderGroup := make(portainer.UserAccessPolicies, 0)
+	userAccessPoliciesUnderGroup[userUnderGroup.ID] = portainer.AccessPolicy{RoleID: portainer.RoleID(userUnderGroup.Role)}
+
+	endpointGroupWithUser := &portainer.EndpointGroup{ID: 2, Name: "endpoint-group-with-user", UserAccessPolicies: userAccessPoliciesUnderGroup}
+	err = store.EndpointGroup().Create(endpointGroupWithUser)
+	require.NoError(t, err, "error creating endpoint group")
+
+	// Create endpoint
+	endpointUnderGroupWithUser := &portainer.Endpoint{ID: 2, GroupID: endpointGroupWithUser.ID}
+	err = store.Endpoint().Create(endpointUnderGroupWithUser)
+	require.NoError(t, err, "error creating endpoint")
+
+	t.Run("admin user can list users who inherit endpoint access from an environment group", func(t *testing.T) {
+		params := url.Values{}
+		params.Add("environmentId", fmt.Sprintf("%d", endpointUnderGroupWithUser.ID))
+		req := httptest.NewRequest(http.MethodGet, "/users?"+params.Encode(), nil)
+		testhelpers.AddTestSecurityCookie(req, adminJWT)
+
+		rr := httptest.NewRecorder()
+		h.ServeHTTP(rr, req)
+
+		is.Equal(http.StatusOK, rr.Code)
+
+		body, err := io.ReadAll(rr.Body)
+		require.NoError(t, err, "ReadAll should not return error")
+
+		var resp []portainer.User
+		err = json.Unmarshal(body, &resp)
+		require.NoError(t, err, "response should be list json")
+
+		is.Len(resp, 1)
+		if len(resp) == 1 {
+			is.Equal(userUnderGroup.ID, resp[0].ID)
+		}
+	})
+
+	// Case 3: the user is under a team and the team is under an environment group.
+	//		   the environment group is given the endpoint access.
+	//		   both user and team should inherits the endpoint access from the environment group
+	// create a team including a user
+	teamUnderGroup := &portainer.Team{ID: 1, Name: "team-under-environment-group"}
+	err = store.Team().Create(teamUnderGroup)
+	require.NoError(t, err, "error creating team")
+
+	userUnderTeam := &portainer.User{ID: 4, Username: "standard-user-under-team", Role: portainer.StandardUserRole, PortainerAuthorizations: authorization.DefaultPortainerAuthorizations()}
+	err = store.User().Create(userUnderTeam)
+	require.NoError(t, err, "error creating user")
+
+	teamMembership := &portainer.TeamMembership{ID: 1, UserID: userUnderTeam.ID, TeamID: teamUnderGroup.ID}
+	err = store.TeamMembership().Create(teamMembership)
+	require.NoError(t, err, "error creating team membership")
+
+	// Create environment group including a team
+	teamAccessPoliciesUnderGroup := make(portainer.TeamAccessPolicies, 0)
+	teamAccessPoliciesUnderGroup[teamUnderGroup.ID] = portainer.AccessPolicy{RoleID: portainer.RoleID(userUnderTeam.Role)}
+
+	endpointGroupWithTeam := &portainer.EndpointGroup{ID: 3, Name: "endpoint-group-with-team", TeamAccessPolicies: teamAccessPoliciesUnderGroup}
+	err = store.EndpointGroup().Create(endpointGroupWithTeam)
+	require.NoError(t, err, "error creating endpoint group")
+
+	// Create endpoint
+	endpointUnderGroupWithTeam := &portainer.Endpoint{ID: 3, GroupID: endpointGroupWithTeam.ID}
+	err = store.Endpoint().Create(endpointUnderGroupWithTeam)
+	require.NoError(t, err, "error creating endpoint")
+	t.Run("admin user can list users who inherit endpoint access from a team that inherit from an environment group", func(t *testing.T) {
+		params := url.Values{}
+		params.Add("environmentId", fmt.Sprintf("%d", endpointUnderGroupWithTeam.ID))
+		req := httptest.NewRequest(http.MethodGet, "/users?"+params.Encode(), nil)
+		testhelpers.AddTestSecurityCookie(req, adminJWT)
+
+		rr := httptest.NewRecorder()
+		h.ServeHTTP(rr, req)
+
+		is.Equal(http.StatusOK, rr.Code)
+
+		body, err := io.ReadAll(rr.Body)
+		require.NoError(t, err, "ReadAll should not return error")
+
+		var resp []portainer.User
+		err = json.Unmarshal(body, &resp)
+		require.NoError(t, err, "response should be list json")
+
+		is.Len(resp, 1)
+		if len(resp) == 1 {
+			is.Equal(userUnderTeam.ID, resp[0].ID)
+		}
+	})
+
+	// Case 4: the user is under a team and the team is given the endpoint access
+	//         the user inherits the endpoint access from the team
+	// create a team including a user
+	teamWithEndpointAccess := &portainer.Team{ID: 2, Name: "team-with-endpoint-access"}
+	err = store.Team().Create(teamWithEndpointAccess)
+	require.NoError(t, err, "error creating team")
+
+	userUnderTeamWithEndpointAccess := &portainer.User{ID: 5, Username: "standard-user-under-team-with-endpoint-access", Role: portainer.StandardUserRole, PortainerAuthorizations: authorization.DefaultPortainerAuthorizations()}
+	err = store.User().Create(userUnderTeamWithEndpointAccess)
+	require.NoError(t, err, "error creating user")
+
+	teamMembershipWithEndpointAccess := &portainer.TeamMembership{ID: 2, UserID: userUnderTeamWithEndpointAccess.ID, TeamID: teamWithEndpointAccess.ID}
+	err = store.TeamMembership().Create(teamMembershipWithEndpointAccess)
+	require.NoError(t, err, "error creating team membership")
+
+	// Create environment group
+	endpointGroupWithoutTeam := &portainer.EndpointGroup{ID: 4, Name: "endpoint-group-without-team"}
+	err = store.EndpointGroup().Create(endpointGroupWithoutTeam)
+	require.NoError(t, err, "error creating endpoint group")
+
+	// Create endpoint and team access policies
+	teamAccessPolicies := make(portainer.TeamAccessPolicies, 0)
+	teamAccessPolicies[teamWithEndpointAccess.ID] = portainer.AccessPolicy{RoleID: portainer.RoleID(userUnderTeamWithEndpointAccess.Role)}
+
+	endpointWithTeamAccessPolicy := &portainer.Endpoint{ID: 4, TeamAccessPolicies: teamAccessPolicies, GroupID: endpointGroupWithoutTeam.ID}
+	err = store.Endpoint().Create(endpointWithTeamAccessPolicy)
+	require.NoError(t, err, "error creating endpoint")
+	t.Run("admin user can list users who inherit endpoint access from a team", func(t *testing.T) {
+		params := url.Values{}
+		params.Add("environmentId", fmt.Sprintf("%d", endpointWithTeamAccessPolicy.ID))
+		req := httptest.NewRequest(http.MethodGet, "/users?"+params.Encode(), nil)
+		testhelpers.AddTestSecurityCookie(req, adminJWT)
+
+		rr := httptest.NewRecorder()
+		h.ServeHTTP(rr, req)
+
+		is.Equal(http.StatusOK, rr.Code)
+
+		body, err := io.ReadAll(rr.Body)
+		require.NoError(t, err, "ReadAll should not return error")
+
+		var resp []portainer.User
+		err = json.Unmarshal(body, &resp)
+		require.NoError(t, err, "response should be list json")
+
+		is.Len(resp, 1)
+		if len(resp) == 1 {
+			is.Equal(userUnderTeamWithEndpointAccess.ID, resp[0].ID)
+		}
+	})
+}
diff --git a/api/http/handler/users/user_memberships.go b/api/http/handler/users/user_memberships.go
new file mode 100644
index 0000000..5f77afd
--- /dev/null
+++ b/api/http/handler/users/user_memberships.go
@@ -0,0 +1,49 @@
+package users
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id UserMembershipsInspect
+// @summary Inspect a user memberships
+// @description Inspect a user memberships.
+// @description **Access policy**: restricted
+// @tags users
+// @security ApiKeyAuth
+// @security jwt
+// @produce json
+// @param id path int true "User identifier"
+// @success 200 {object} portainer.TeamMembership "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied"
+// @failure 500 "Server error"
+// @router /users/{id}/memberships [get]
+func (handler *Handler) userMemberships(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	userID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid user identifier route variable", err)
+	}
+
+	tokenData, err := security.RetrieveTokenData(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve user authentication token", err)
+	}
+
+	if tokenData.Role != portainer.AdministratorRole && tokenData.ID != portainer.UserID(userID) {
+		return httperror.Forbidden("Permission denied to update user memberships", errors.ErrUnauthorized)
+	}
+
+	memberships, err := handler.DataStore.TeamMembership().TeamMembershipsByUserID(portainer.UserID(userID))
+	if err != nil {
+		return httperror.InternalServerError("Unable to persist membership changes inside the database", err)
+	}
+
+	return response.JSON(w, memberships)
+}
diff --git a/api/http/handler/users/user_remove_access_token.go b/api/http/handler/users/user_remove_access_token.go
new file mode 100644
index 0000000..8ab6ca5
--- /dev/null
+++ b/api/http/handler/users/user_remove_access_token.go
@@ -0,0 +1,77 @@
+package users
+
+import (
+	"errors"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/apikey"
+	httperrors "github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @id UserRemoveAPIKey
+// @summary Remove an api-key associated to a user
+// @description Remove an api-key associated to a user..
+// @description Only the calling user or admin can remove api-key.
+// @description **Access policy**: authenticated
+// @tags users
+// @security ApiKeyAuth
+// @security jwt
+// @param id path int true "User identifier"
+// @param keyID path int true "Api Key identifier"
+// @success 204 "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied"
+// @failure 404 "Not found"
+// @failure 500 "Server error"
+// @router /users/{id}/tokens/{keyID} [delete]
+func (handler *Handler) userRemoveAccessToken(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	userID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid user identifier route variable", err)
+	}
+
+	apiKeyID, err := request.RetrieveNumericRouteVariableValue(r, "keyID")
+	if err != nil {
+		return httperror.BadRequest("Invalid api-key identifier route variable", err)
+	}
+
+	tokenData, err := security.RetrieveTokenData(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve user authentication token", err)
+	}
+	if tokenData.Role != portainer.AdministratorRole && tokenData.ID != portainer.UserID(userID) {
+		return httperror.Forbidden("Permission denied to get user access tokens", httperrors.ErrUnauthorized)
+	}
+
+	_, err = handler.DataStore.User().Read(portainer.UserID(userID))
+	if err != nil {
+		if handler.DataStore.IsErrObjectNotFound(err) {
+			return httperror.NotFound("Unable to find a user with the specified identifier inside the database", err)
+		}
+		return httperror.InternalServerError("Unable to find a user with the specified identifier inside the database", err)
+	}
+
+	// check if the key exists and the key belongs to the user
+	apiKey, err := handler.apiKeyService.GetAPIKey(portainer.APIKeyID(apiKeyID))
+	if err != nil {
+		return httperror.InternalServerError("API Key not found", err)
+	}
+	if apiKey.UserID != portainer.UserID(userID) {
+		return httperror.Forbidden("Permission denied to remove api-key", httperrors.ErrUnauthorized)
+	}
+
+	err = handler.apiKeyService.DeleteAPIKey(portainer.APIKeyID(apiKeyID))
+	if err != nil {
+		if errors.Is(err, apikey.ErrInvalidAPIKey) {
+			return httperror.NotFound("Unable to find an api-key with the specified identifier inside the database", err)
+		}
+		return httperror.InternalServerError("Unable to remove the api-key from the user", err)
+	}
+
+	return response.Empty(w)
+}
diff --git a/api/http/handler/users/user_remove_access_token_test.go b/api/http/handler/users/user_remove_access_token_test.go
new file mode 100644
index 0000000..c23ae1c
--- /dev/null
+++ b/api/http/handler/users/user_remove_access_token_test.go
@@ -0,0 +1,115 @@
+package users
+
+import (
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_userRemoveAccessToken(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	_, store := datastore.MustNewTestStore(t, true, true)
+
+	// create admin and standard user(s)
+	adminUser := &portainer.User{ID: 1, Username: "admin", Role: portainer.AdministratorRole}
+	err := store.User().Create(adminUser)
+	require.NoError(t, err, "error creating admin user")
+
+	user := &portainer.User{ID: 2, Username: "standard", Role: portainer.StandardUserRole}
+	err = store.User().Create(user)
+	require.NoError(t, err, "error creating user")
+
+	h, jwtService, apiKeyService := newTestHandler(t, store)
+
+	// generate standard and admin user tokens
+	adminJWT, _, _ := jwtService.GenerateToken(&portainer.TokenData{ID: adminUser.ID, Username: adminUser.Username, Role: adminUser.Role})
+	jwt, _, _ := jwtService.GenerateToken(&portainer.TokenData{ID: user.ID, Username: user.Username, Role: user.Role})
+
+	t.Run("standard user can successfully delete API key", func(t *testing.T) {
+		is := assert.New(t)
+		_, apiKey, err := apiKeyService.GenerateApiKey(*user, "test-delete-token")
+		require.NoError(t, err)
+
+		req := httptest.NewRequest(http.MethodDelete, fmt.Sprintf("%s/%d", "/users/2/tokens", apiKey.ID), nil)
+		testhelpers.AddTestSecurityCookie(req, jwt)
+
+		rr := httptest.NewRecorder()
+		h.ServeHTTP(rr, req)
+
+		is.Equal(http.StatusNoContent, rr.Code)
+
+		keys, err := apiKeyService.GetAPIKeys(user.ID)
+		require.NoError(t, err)
+
+		require.Empty(t, keys)
+	})
+
+	t.Run("admin can delete a standard user API Key", func(t *testing.T) {
+		is := assert.New(t)
+		_, apiKey, err := apiKeyService.GenerateApiKey(*user, "test-admin-delete-token")
+		require.NoError(t, err)
+
+		req := httptest.NewRequest(http.MethodDelete, fmt.Sprintf("%s/%d", "/users/2/tokens", apiKey.ID), nil)
+		testhelpers.AddTestSecurityCookie(req, adminJWT)
+
+		rr := httptest.NewRecorder()
+		h.ServeHTTP(rr, req)
+
+		is.Equal(http.StatusNoContent, rr.Code)
+
+		keys, err := apiKeyService.GetAPIKeys(user.ID)
+		require.NoError(t, err)
+
+		is.Empty(keys)
+	})
+
+	t.Run("user can delete API Key using api-key auth", func(t *testing.T) {
+		is := assert.New(t)
+		rawAPIKey, apiKey, err := apiKeyService.GenerateApiKey(*user, "test-api-key-auth-deletion")
+		require.NoError(t, err)
+
+		req := httptest.NewRequest(http.MethodDelete, fmt.Sprintf("%s/%d", "/users/2/tokens", apiKey.ID), nil)
+		req.Header.Add("x-api-key", rawAPIKey)
+
+		rr := httptest.NewRecorder()
+		h.ServeHTTP(rr, req)
+
+		is.Equal(http.StatusNoContent, rr.Code)
+
+		keys, err := apiKeyService.GetAPIKeys(user.ID)
+		require.NoError(t, err)
+
+		is.Empty(keys)
+	})
+
+	t.Run("user cannot delete another users API Keys using api-key auth", func(t *testing.T) {
+		_, adminAPIKey, err := apiKeyService.GenerateApiKey(*adminUser, "admin-key")
+		require.NoError(t, err)
+
+		rawAPIKey, _, err := apiKeyService.GenerateApiKey(*user, "user-key")
+		require.NoError(t, err)
+
+		req := httptest.NewRequest(http.MethodDelete, fmt.Sprintf("/users/%d/tokens/%d", user.ID, adminAPIKey.ID), nil)
+		req.Header.Add("x-api-key", rawAPIKey)
+
+		rr := httptest.NewRecorder()
+		h.ServeHTTP(rr, req)
+
+		is.Equal(http.StatusForbidden, rr.Code)
+
+		adminKeyGot, err := apiKeyService.GetAPIKey(adminAPIKey.ID)
+		require.NoError(t, err)
+
+		is.Equal(adminAPIKey, adminKeyGot)
+	})
+}
diff --git a/api/http/handler/users/user_update.go b/api/http/handler/users/user_update.go
new file mode 100644
index 0000000..cc290dd
--- /dev/null
+++ b/api/http/handler/users/user_update.go
@@ -0,0 +1,159 @@
+package users
+
+import (
+	"cmp"
+	"errors"
+	"net/http"
+	"strings"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	httperrors "github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type themePayload struct {
+	// Color represents the color theme of the UI
+	Color *string `json:"color" example:"dark" enums:"dark,light,highcontrast,auto"`
+}
+
+type userUpdatePayload struct {
+	Username    string `validate:"required" example:"bob"`
+	Password    string `validate:"required" example:"cg9Wgky3"`
+	NewPassword string `validate:"required" example:"asfj2emv"`
+	UseCache    *bool  `validate:"required" example:"true"`
+	Theme       *themePayload
+
+	// User role (1 for administrator account and 2 for regular account)
+	Role int `validate:"required" enums:"1,2" example:"2"`
+}
+
+func (payload *userUpdatePayload) Validate(r *http.Request) error {
+	if strings.Contains(payload.Username, " ") {
+		return errors.New("invalid username. Must not contain any whitespace")
+	}
+
+	if payload.Role != 0 && payload.Role != 1 && payload.Role != 2 {
+		return errors.New("invalid role value. Value must be one of: 1 (administrator) or 2 (regular user)")
+	}
+
+	return nil
+}
+
+// @id UserUpdate
+// @summary Update a user
+// @description Update user details. A regular user account can only update his details.
+// @description A regular user account cannot change their username or role.
+// @description **Access policy**: authenticated
+// @tags users
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @produce json
+// @param id path int true "User identifier"
+// @param body body userUpdatePayload true "User details"
+// @success 200 {object} portainer.User "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied"
+// @failure 404 "User not found"
+// @failure 409 "Username already exist"
+// @failure 500 "Server error"
+// @router /users/{id} [put]
+func (handler *Handler) userUpdate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	userID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid user identifier route variable", err)
+	}
+
+	tokenData, err := security.RetrieveTokenData(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve user authentication token", err)
+	}
+
+	if tokenData.Role != portainer.AdministratorRole && tokenData.ID != portainer.UserID(userID) {
+		return httperror.Forbidden("Permission denied to update user", httperrors.ErrUnauthorized)
+	}
+
+	var payload userUpdatePayload
+	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	if tokenData.Role != portainer.AdministratorRole && payload.Role != 0 {
+		return httperror.Forbidden("Permission denied to update user to administrator role", httperrors.ErrResourceAccessDenied)
+	}
+
+	user, err := handler.DataStore.User().Read(portainer.UserID(userID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find a user with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find a user with the specified identifier inside the database", err)
+	}
+
+	if payload.Username != "" && payload.Username != user.Username {
+		if tokenData.Role != portainer.AdministratorRole {
+			return httperror.Forbidden("Permission denied. Unable to update username", httperrors.ErrResourceAccessDenied)
+		}
+
+		if sameNameUser, err := handler.DataStore.User().UserByUsername(payload.Username); err != nil && !handler.DataStore.IsErrObjectNotFound(err) {
+			return httperror.InternalServerError("Unable to retrieve users from the database", err)
+		} else if sameNameUser != nil && sameNameUser.ID != portainer.UserID(userID) {
+			return httperror.Conflict("Another user with the same username already exists", errUserAlreadyExists)
+		}
+
+		user.Username = payload.Username
+	}
+
+	if payload.Password != "" && payload.NewPassword == "" {
+		if tokenData.Role == portainer.AdministratorRole {
+			return httperror.BadRequest("Existing password field specified without new password field.", errors.New("To change the password as an admin, you only need 'newPassword' in your request"))
+		}
+
+		return httperror.BadRequest("Existing password field specified without new password field.", errors.New("To change the password, you must include both 'password' and 'newPassword' in your request"))
+	}
+
+	if payload.NewPassword != "" {
+		// Non-admins need to supply the previous password
+		if tokenData.Role != portainer.AdministratorRole {
+			if err := handler.CryptoService.CompareHashAndData(user.Password, payload.Password); err != nil {
+				return httperror.Forbidden("Current password doesn't match. Password left unchanged", errors.New("Current password does not match the password provided. Please try again"))
+			}
+		}
+
+		if !handler.passwordStrengthChecker.Check(payload.NewPassword) {
+			return httperror.BadRequest("Password does not meet the minimum strength requirements", nil)
+		}
+
+		user.Password, err = handler.CryptoService.Hash(payload.NewPassword)
+		if err != nil {
+			return httperror.InternalServerError("Unable to hash user password", errCryptoHashFailure)
+		}
+		user.TokenIssueAt = time.Now().Unix()
+	}
+
+	if payload.Theme != nil {
+		user.ThemeSettings.Color = *cmp.Or(payload.Theme.Color, &user.ThemeSettings.Color)
+	}
+
+	user.UseCache = *cmp.Or(payload.UseCache, &user.UseCache)
+
+	if payload.Role != 0 {
+		user.Role = portainer.UserRole(payload.Role)
+		user.TokenIssueAt = time.Now().Unix()
+	}
+
+	if err := handler.DataStore.User().Update(user.ID, user); err != nil {
+		return httperror.InternalServerError("Unable to persist user changes inside the database", err)
+	}
+
+	// remove all of the users persisted API keys
+	handler.apiKeyService.InvalidateUserKeyCache(user.ID)
+
+	// hide the password field in the response payload
+	user.Password = ""
+
+	return response.JSON(w, user)
+}
diff --git a/api/http/handler/users/user_update_password.go b/api/http/handler/users/user_update_password.go
new file mode 100644
index 0000000..6ca3905
--- /dev/null
+++ b/api/http/handler/users/user_update_password.go
@@ -0,0 +1,100 @@
+package users
+
+import (
+	"errors"
+	"net/http"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	httperrors "github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type userUpdatePasswordPayload struct {
+	// Current Password
+	Password string `example:"passwd" validate:"required"`
+	// New Password
+	NewPassword string `example:"new_passwd" validate:"required"`
+}
+
+func (payload *userUpdatePasswordPayload) Validate(r *http.Request) error {
+	if len(payload.Password) == 0 {
+		return errors.New("Invalid current password")
+	}
+	if len(payload.NewPassword) == 0 {
+		return errors.New("Invalid new password")
+	}
+	return nil
+}
+
+// @id UserUpdatePassword
+// @summary Update password for a user
+// @description Update password for the specified user.
+// @description **Access policy**: authenticated
+// @tags users
+// @security ApiKeyAuth
+// @security jwt
+// @accept json
+// @produce json
+// @param id path int true "identifier"
+// @param body body userUpdatePasswordPayload true "details"
+// @success 204 "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied"
+// @failure 404 "User not found"
+// @failure 500 "Server error"
+// @router /users/{id}/passwd [put]
+func (handler *Handler) userUpdatePassword(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	userID, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid user identifier route variable", err)
+	}
+
+	tokenData, err := security.RetrieveTokenData(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve user authentication token", err)
+	}
+
+	if tokenData.Role != portainer.AdministratorRole && tokenData.ID != portainer.UserID(userID) {
+		return httperror.Forbidden("Permission denied to update user", httperrors.ErrUnauthorized)
+	}
+
+	var payload userUpdatePasswordPayload
+	err = request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	user, err := handler.DataStore.User().Read(portainer.UserID(userID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find a user with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find a user with the specified identifier inside the database", err)
+	}
+
+	err = handler.CryptoService.CompareHashAndData(user.Password, payload.Password)
+	if err != nil {
+		return httperror.Forbidden("Current password doesn't match", errors.New("Current password does not match the password provided. Please try again"))
+	}
+
+	if !handler.passwordStrengthChecker.Check(payload.NewPassword) {
+		return httperror.BadRequest("Password does not meet the minimum strength requirements", nil)
+	}
+
+	user.Password, err = handler.CryptoService.Hash(payload.NewPassword)
+	if err != nil {
+		return httperror.InternalServerError("Unable to hash user password", errCryptoHashFailure)
+	}
+
+	user.TokenIssueAt = time.Now().Unix()
+
+	err = handler.DataStore.User().Update(user.ID, user)
+	if err != nil {
+		return httperror.InternalServerError("Unable to persist user changes inside the database", err)
+	}
+
+	return response.Empty(w)
+}
diff --git a/api/http/handler/users/user_update_test.go b/api/http/handler/users/user_update_test.go
new file mode 100644
index 0000000..c1bca9c
--- /dev/null
+++ b/api/http/handler/users/user_update_test.go
@@ -0,0 +1,47 @@
+package users
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_updateUserRemovesAccessTokens(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	_, store := datastore.MustNewTestStore(t, true, true)
+
+	// Create standard user
+	user := &portainer.User{ID: 2, Username: "standard", Role: portainer.StandardUserRole}
+	err := store.User().Create(user)
+	require.NoError(t, err, "error creating user")
+
+	h, _, apiKeyService := newTestHandler(t, store)
+
+	t.Run("standard user deletion removes all associated access tokens", func(t *testing.T) {
+		_, _, err := apiKeyService.GenerateApiKey(*user, "test-user-token")
+		require.NoError(t, err)
+
+		keys, err := apiKeyService.GetAPIKeys(user.ID)
+		require.NoError(t, err)
+		is.Len(keys, 1)
+
+		rr := httptest.NewRecorder()
+
+		handlerErr := h.deleteUser(rr, user)
+		require.Nil(t, handlerErr)
+
+		is.Equal(http.StatusNoContent, rr.Code)
+
+		keys, err = apiKeyService.GetAPIKeys(user.ID)
+		require.NoError(t, err)
+		is.Empty(keys)
+	})
+}
diff --git a/api/http/handler/webhooks/handler.go b/api/http/handler/webhooks/handler.go
new file mode 100644
index 0000000..b981da8
--- /dev/null
+++ b/api/http/handler/webhooks/handler.go
@@ -0,0 +1,40 @@
+package webhooks
+
+import (
+	"net/http"
+
+	"github.com/portainer/portainer/api/dataservices"
+	dockerclient "github.com/portainer/portainer/api/docker/client"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+
+	"github.com/gorilla/mux"
+)
+
+// Handler is the HTTP handler used to handle webhook operations.
+type Handler struct {
+	*mux.Router
+	requestBouncer      security.BouncerService
+	DataStore           dataservices.DataStore
+	DockerClientFactory *dockerclient.ClientFactory
+}
+
+// NewHandler creates a handler to manage webhooks operations.
+func NewHandler(bouncer security.BouncerService) *Handler {
+	h := &Handler{
+		Router:         mux.NewRouter(),
+		requestBouncer: bouncer,
+	}
+	h.Handle("/webhooks",
+		bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.webhookCreate))).Methods(http.MethodPost)
+	h.Handle("/webhooks/{id}",
+		bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.webhookUpdate))).Methods(http.MethodPut)
+	h.Handle("/webhooks",
+		bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.webhookList))).Methods(http.MethodGet)
+	h.Handle("/webhooks/{id}",
+		bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.webhookDelete))).Methods(http.MethodDelete)
+	h.Handle("/webhooks/{token}",
+		bouncer.PublicAccess(httperror.LoggerHandler(h.webhookExecute))).Methods(http.MethodPost)
+
+	return h
+}
diff --git a/api/http/handler/webhooks/webhook_create.go b/api/http/handler/webhooks/webhook_create.go
new file mode 100644
index 0000000..86f4884
--- /dev/null
+++ b/api/http/handler/webhooks/webhook_create.go
@@ -0,0 +1,108 @@
+package webhooks
+
+import (
+	"errors"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/registryutils/access"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+
+	"github.com/google/uuid"
+)
+
+type webhookCreatePayload struct {
+	ResourceID string
+	EndpointID portainer.EndpointID
+	RegistryID portainer.RegistryID
+	// Type of webhook (1 - service)
+	WebhookType portainer.WebhookType
+}
+
+func (payload *webhookCreatePayload) Validate(r *http.Request) error {
+	if len(payload.ResourceID) == 0 {
+		return errors.New("Invalid ResourceID")
+	}
+	if payload.EndpointID == 0 {
+		return errors.New("Invalid EndpointID")
+	}
+	if payload.WebhookType != portainer.ServiceWebhook {
+		return errors.New("Invalid WebhookType")
+	}
+	return nil
+}
+
+// @summary Create a webhook
+// @description **Access policy**: authenticated
+// @security ApiKeyAuth
+// @security jwt
+// @tags webhooks
+// @accept json
+// @produce json
+// @param body body webhookCreatePayload true "Webhook data"
+// @success 200 {object} portainer.Webhook
+// @failure 400 "Invalid request"
+// @failure 409 "A webhook for this resource already exists"
+// @failure 500 "Server error"
+// @router /webhooks [post]
+func (handler *Handler) webhookCreate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	var payload webhookCreatePayload
+	err := request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	webhook, err := handler.DataStore.Webhook().WebhookByResourceID(payload.ResourceID)
+	if err != nil && !handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.InternalServerError("An error occurred retrieving webhooks from the database", err)
+	}
+	if webhook != nil {
+		return httperror.Conflict("A webhook for this resource already exists", errors.New("A webhook for this resource already exists"))
+	}
+
+	endpointID := payload.EndpointID
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve user info from request context", err)
+	}
+
+	if !securityContext.IsAdmin {
+		return httperror.Forbidden("Not authorized to create a webhook", errors.New("not authorized to create a webhook"))
+	}
+
+	if payload.RegistryID != 0 {
+		tokenData, err := security.RetrieveTokenData(r)
+		if err != nil {
+			return httperror.InternalServerError("Unable to retrieve user authentication token", err)
+		}
+
+		_, err = access.GetAccessibleRegistry(handler.DataStore, nil, tokenData.ID, endpointID, payload.RegistryID)
+		if err != nil {
+			return httperror.Forbidden("Permission deny to access registry", err)
+		}
+	}
+
+	token, err := uuid.NewRandom()
+	if err != nil {
+		return httperror.InternalServerError("Error creating unique token", err)
+	}
+
+	webhook = &portainer.Webhook{
+		Token:       token.String(),
+		ResourceID:  payload.ResourceID,
+		EndpointID:  endpointID,
+		RegistryID:  payload.RegistryID,
+		WebhookType: payload.WebhookType,
+	}
+
+	err = handler.DataStore.Webhook().Create(webhook)
+	if err != nil {
+		return httperror.InternalServerError("Unable to persist the webhook inside the database", err)
+	}
+
+	return response.JSON(w, webhook)
+}
diff --git a/api/http/handler/webhooks/webhook_delete.go b/api/http/handler/webhooks/webhook_delete.go
new file mode 100644
index 0000000..a16a886
--- /dev/null
+++ b/api/http/handler/webhooks/webhook_delete.go
@@ -0,0 +1,45 @@
+package webhooks
+
+import (
+	"errors"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+// @summary Delete a webhook
+// @description **Access policy**: authenticated
+// @security ApiKeyAuth
+// @security jwt
+// @tags webhooks
+// @param id path int true "Webhook id"
+// @success 202 "Webhook deleted"
+// @failure 400
+// @failure 500
+// @router /webhooks/{id} [delete]
+func (handler *Handler) webhookDelete(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	id, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid webhook id", err)
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve user info from request context", err)
+	}
+
+	if !securityContext.IsAdmin {
+		return httperror.Forbidden("Not authorized to delete a webhook", errors.New("not authorized to delete a webhook"))
+	}
+
+	err = handler.DataStore.Webhook().Delete(portainer.WebhookID(id))
+	if err != nil {
+		return httperror.InternalServerError("Unable to remove the webhook from the database", err)
+	}
+
+	return response.Empty(w)
+}
diff --git a/api/http/handler/webhooks/webhook_execute.go b/api/http/handler/webhooks/webhook_execute.go
new file mode 100644
index 0000000..ab948de
--- /dev/null
+++ b/api/http/handler/webhooks/webhook_execute.go
@@ -0,0 +1,132 @@
+package webhooks
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/internal/registryutils"
+	"github.com/portainer/portainer/api/logs"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/rs/zerolog/log"
+
+	dockertypes "github.com/docker/docker/api/types"
+	"github.com/docker/docker/api/types/image"
+)
+
+// @summary Execute a webhook
+// @description Acts on a passed in token UUID to restart the docker service
+// @description **Access policy**: public
+// @tags webhooks
+// @param id path string true "Webhook token"
+// @success 202 "Webhook executed"
+// @failure 400
+// @failure 500
+// @router /webhooks/{id} [post]
+func (handler *Handler) webhookExecute(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	webhookToken, err := request.RetrieveRouteVariableValue(r, "token")
+	if err != nil {
+		return httperror.InternalServerError("Invalid service id parameter", err)
+	}
+
+	webhook, err := handler.DataStore.Webhook().WebhookByToken(webhookToken)
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find a webhook with this token", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to retrieve webhook from the database", err)
+	}
+
+	resourceID := webhook.ResourceID
+	endpointID := webhook.EndpointID
+	registryID := webhook.RegistryID
+	webhookType := webhook.WebhookType
+
+	endpoint, err := handler.DataStore.Endpoint().Endpoint(endpointID)
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find an environment with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find an environment with the specified identifier inside the database", err)
+	}
+
+	imageTag, _ := request.RetrieveQueryParameter(r, "tag", true)
+
+	switch webhookType {
+	case portainer.ServiceWebhook:
+		return handler.executeServiceWebhook(w, endpoint, resourceID, registryID, imageTag)
+	default:
+		return httperror.InternalServerError("Unsupported webhook type", errors.New("Webhooks for this resource are not currently supported"))
+	}
+}
+
+func (handler *Handler) executeServiceWebhook(
+	w http.ResponseWriter,
+	endpoint *portainer.Endpoint,
+	resourceID string,
+	registryID portainer.RegistryID,
+	imageTag string,
+) *httperror.HandlerError {
+	dockerClient, err := handler.DockerClientFactory.CreateClient(endpoint, "", nil)
+	if err != nil {
+		return httperror.InternalServerError("Error creating docker client", err)
+	}
+	defer logs.CloseAndLogErr(dockerClient)
+
+	service, _, err := dockerClient.ServiceInspectWithRaw(context.Background(), resourceID, dockertypes.ServiceInspectOptions{InsertDefaults: true})
+	if err != nil {
+		return httperror.InternalServerError("Error looking up service", err)
+	}
+
+	service.Spec.TaskTemplate.ForceUpdate++
+
+	imageName := strings.Split(service.Spec.TaskTemplate.ContainerSpec.Image, "@sha")[0]
+	service.Spec.TaskTemplate.ContainerSpec.Image = imageName
+
+	if imageTag != "" {
+		tagIndex := strings.LastIndex(imageName, ":")
+		if tagIndex == -1 {
+			tagIndex = len(imageName)
+		}
+
+		service.Spec.TaskTemplate.ContainerSpec.Image = imageName[:tagIndex] + ":" + imageTag
+	}
+
+	serviceUpdateOptions := dockertypes.ServiceUpdateOptions{
+		QueryRegistry: true,
+	}
+
+	if registryID != 0 {
+		registry, err := handler.DataStore.Registry().Read(registryID)
+		if err != nil {
+			return httperror.InternalServerError("Error getting registry", err)
+		}
+
+		if registry.Authentication {
+			if err := registryutils.EnsureRegTokenValid(handler.DataStore, registry); err != nil {
+				log.Warn().Err(err).Msgf("registry auth token renewal failed for registry %d", registry.ID)
+			}
+
+			serviceUpdateOptions.EncodedRegistryAuth, err = registryutils.GetRegistryAuthHeader(registry)
+			if err != nil {
+				return httperror.InternalServerError("Error getting registry auth header", err)
+			}
+		}
+	}
+
+	if imageTag != "" {
+		rc, err := dockerClient.ImagePull(context.Background(), service.Spec.TaskTemplate.ContainerSpec.Image, image.PullOptions{RegistryAuth: serviceUpdateOptions.EncodedRegistryAuth})
+		if err != nil {
+			return httperror.NotFound("Error pulling image with the specified tag", err)
+		}
+		defer logs.CloseAndLogErr(rc)
+	}
+
+	if _, err := dockerClient.ServiceUpdate(context.Background(), resourceID, service.Version, service.Spec, serviceUpdateOptions); err != nil {
+		return httperror.InternalServerError("Error updating service", err)
+	}
+
+	return response.Empty(w)
+}
diff --git a/api/http/handler/webhooks/webhook_list.go b/api/http/handler/webhooks/webhook_list.go
new file mode 100644
index 0000000..00269a2
--- /dev/null
+++ b/api/http/handler/webhooks/webhook_list.go
@@ -0,0 +1,68 @@
+package webhooks
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type webhookListOperationFilters struct {
+	ResourceID string `json:"ResourceID"`
+	EndpointID int    `json:"EndpointID"`
+}
+
+// @summary List webhooks
+// @description **Access policy**: authenticated
+// @security ApiKeyAuth
+// @security jwt
+// @tags webhooks
+// @accept json
+// @produce json
+// @param filters query string false "Filters (json-string)" example({"EndpointID":1,"ResourceID":"abc12345-abcd-2345-ab12-58005b4a0260"})
+// @success 200 {array} portainer.Webhook
+// @failure 400
+// @failure 500
+// @router /webhooks [get]
+func (handler *Handler) webhookList(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	var filters webhookListOperationFilters
+	err := request.RetrieveJSONQueryParameter(r, "filters", &filters, true)
+	if err != nil {
+		return httperror.BadRequest("Invalid query parameter: filters", err)
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve user info from request context", err)
+	}
+	if !securityContext.IsAdmin {
+		return response.JSON(w, []portainer.Webhook{})
+	}
+
+	webhooks, err := handler.DataStore.Webhook().ReadAll()
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve webhooks from the database", err)
+	}
+
+	webhooks = filterWebhooks(webhooks, &filters)
+
+	return response.JSON(w, webhooks)
+}
+
+func filterWebhooks(webhooks []portainer.Webhook, filters *webhookListOperationFilters) []portainer.Webhook {
+	if filters.EndpointID == 0 && filters.ResourceID == "" {
+		return webhooks
+	}
+
+	filteredWebhooks := make([]portainer.Webhook, 0, len(webhooks))
+	for _, webhook := range webhooks {
+		if webhook.EndpointID == portainer.EndpointID(filters.EndpointID) && webhook.ResourceID == filters.ResourceID {
+			filteredWebhooks = append(filteredWebhooks, webhook)
+		}
+	}
+
+	return filteredWebhooks
+}
diff --git a/api/http/handler/webhooks/webhook_update.go b/api/http/handler/webhooks/webhook_update.go
new file mode 100644
index 0000000..94133c4
--- /dev/null
+++ b/api/http/handler/webhooks/webhook_update.go
@@ -0,0 +1,86 @@
+package webhooks
+
+import (
+	"errors"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/registryutils/access"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+)
+
+type webhookUpdatePayload struct {
+	RegistryID portainer.RegistryID
+}
+
+func (payload *webhookUpdatePayload) Validate(r *http.Request) error {
+	return nil
+}
+
+// @summary Update a webhook
+// @description **Access policy**: authenticated
+// @security ApiKeyAuth
+// @security jwt
+// @tags webhooks
+// @accept json
+// @produce json
+// @param id path int true "Webhook id"
+// @param body body webhookUpdatePayload true "Webhook data"
+// @success 200 {object} portainer.Webhook
+// @failure 400
+// @failure 409
+// @failure 500
+// @router /webhooks/{id} [put]
+func (handler *Handler) webhookUpdate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	id, err := request.RetrieveNumericRouteVariableValue(r, "id")
+	if err != nil {
+		return httperror.BadRequest("Invalid webhook id", err)
+	}
+	webhookID := portainer.WebhookID(id)
+
+	var payload webhookUpdatePayload
+	err = request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
+	}
+
+	webhook, err := handler.DataStore.Webhook().Read(webhookID)
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find a webhooks with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find a webhooks with the specified identifier inside the database", err)
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve user info from request context", err)
+	}
+
+	if !securityContext.IsAdmin {
+		return httperror.Forbidden("Not authorized to update a webhook", errors.New("not authorized to update a webhook"))
+	}
+
+	if payload.RegistryID != 0 {
+		tokenData, err := security.RetrieveTokenData(r)
+		if err != nil {
+			return httperror.InternalServerError("Unable to retrieve user authentication token", err)
+		}
+
+		_, err = access.GetAccessibleRegistry(handler.DataStore, nil, tokenData.ID, webhook.EndpointID, payload.RegistryID)
+		if err != nil {
+			return httperror.Forbidden("Permission deny to access registry", err)
+		}
+	}
+
+	webhook.RegistryID = payload.RegistryID
+
+	err = handler.DataStore.Webhook().Update(portainer.WebhookID(id), webhook)
+	if err != nil {
+		return httperror.InternalServerError("Unable to persist the webhook inside the database", err)
+	}
+
+	return response.JSON(w, webhook)
+}
diff --git a/api/http/handler/websocket/attach.go b/api/http/handler/websocket/attach.go
new file mode 100644
index 0000000..999dba6
--- /dev/null
+++ b/api/http/handler/websocket/attach.go
@@ -0,0 +1,139 @@
+package websocket
+
+import (
+	"net"
+	"net/http"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/logs"
+	"github.com/portainer/portainer/api/ws"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/validate"
+	"github.com/rs/zerolog/log"
+
+	"github.com/gorilla/websocket"
+)
+
+// @summary Attach a websocket
+// @description If the nodeName query parameter is present, the request will be proxied to the underlying agent environment(endpoint).
+// @description If the nodeName query parameter is not specified, the request will be upgraded to the websocket protocol and
+// @description an AttachStart operation HTTP request will be created and hijacked.
+// @description **Access policy**: authenticated
+// @security ApiKeyAuth
+// @security jwt
+// @tags websocket
+// @accept json
+// @produce json
+// @param endpointId query int true "environment(endpoint) ID of the environment(endpoint) where the resource is located"
+// @param nodeName query string false "node name"
+// @success 200
+// @failure 400
+// @failure 403
+// @failure 404
+// @failure 500
+// @router /websocket/attach [get]
+func (handler *Handler) websocketAttach(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	attachID, err := request.RetrieveQueryParameter(r, "id", false)
+	if err != nil {
+		return httperror.BadRequest("Invalid query parameter: id", err)
+	}
+	if !validate.IsHexadecimal(attachID) {
+		return httperror.BadRequest("Invalid query parameter: id (must be hexadecimal identifier)", err)
+	}
+
+	endpointID, err := request.RetrieveNumericQueryParameter(r, "endpointId", false)
+	if err != nil {
+		return httperror.BadRequest("Invalid query parameter: endpointId", err)
+	}
+
+	endpoint, err := handler.DataStore.Endpoint().Endpoint(portainer.EndpointID(endpointID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find the environment associated to the stack inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find the environment associated to the stack inside the database", err)
+	}
+
+	err = handler.requestBouncer.AuthorizedEndpointOperation(r, endpoint)
+	if err != nil {
+		return httperror.Forbidden("Permission denied to access environment", err)
+	}
+
+	params := &webSocketRequestParams{
+		endpoint: endpoint,
+		ID:       attachID,
+		nodeName: r.FormValue("nodeName"),
+	}
+
+	err = handler.handleAttachRequest(w, r, params)
+	if err != nil {
+		return httperror.InternalServerError("An error occurred during websocket attach operation", err)
+	}
+
+	return nil
+}
+
+func (handler *Handler) handleAttachRequest(w http.ResponseWriter, r *http.Request, params *webSocketRequestParams) error {
+	r.Header.Del("Origin")
+
+	if params.endpoint.Type == portainer.AgentOnDockerEnvironment {
+		return handler.proxyAgentWebsocketRequest(w, r, params)
+	} else if params.endpoint.Type == portainer.EdgeAgentOnDockerEnvironment {
+		return handler.proxyEdgeAgentWebsocketRequest(w, r, params)
+	}
+
+	websocketConn, err := handler.connectionUpgrader.Upgrade(w, r, nil)
+	if err != nil {
+		return err
+	}
+	defer logs.CloseAndLogErr(websocketConn)
+
+	return hijackAttachStartOperation(websocketConn, params.endpoint, params.ID)
+}
+
+func hijackAttachStartOperation(
+	websocketConn *websocket.Conn,
+	endpoint *portainer.Endpoint,
+	attachID string,
+) error {
+	conn, err := initDial(endpoint)
+	if err != nil {
+		return err
+	}
+
+	// When we set up a TCP connection for hijack, there could be long periods
+	// of inactivity (a long running command with no output) that in certain
+	// network setups may cause ECONNTIMEOUT, leaving the client in an unknown
+	// state. Setting TCP KeepAlive on the socket connection will prohibit
+	// ECONNTIMEOUT unless the socket connection truly is broken
+	if tcpConn, ok := conn.(*net.TCPConn); ok {
+		if err := tcpConn.SetKeepAlive(true); err != nil {
+			log.Warn().Err(err).Msg("failed to set TCP keep-alive on connection")
+		}
+
+		if err := tcpConn.SetKeepAlivePeriod(30 * time.Second); err != nil {
+			log.Warn().Err(err).Msg("failed to set TCP keep-alive period on connection")
+		}
+	}
+
+	attachStartRequest, err := createAttachStartRequest(attachID)
+	if err != nil {
+		return err
+	}
+
+	return ws.HijackRequest(websocketConn, conn, attachStartRequest)
+}
+
+func createAttachStartRequest(attachID string) (*http.Request, error) {
+	request, err := http.NewRequest("POST", "/containers/"+attachID+"/attach?stdin=1&stdout=1&stderr=1&stream=1", nil)
+	if err != nil {
+		return nil, err
+	}
+
+	request.Header.Set("Content-Type", "application/json")
+	request.Header.Set("Connection", "Upgrade")
+	request.Header.Set("Upgrade", "tcp")
+
+	return request, nil
+}
diff --git a/api/http/handler/websocket/attach_test.go b/api/http/handler/websocket/attach_test.go
new file mode 100644
index 0000000..b9e27cd
--- /dev/null
+++ b/api/http/handler/websocket/attach_test.go
@@ -0,0 +1,34 @@
+package websocket
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestWebsocketAttach_deniesUnauthorizedEndpoint asserts a non-admin with no access policy on
+// the environment is rejected with 403 — the environment-access (L2) gate (BE-13027).
+func TestWebsocketAttach_deniesUnauthorizedEndpoint(t *testing.T) {
+	handler, _ := newWebsocketTestHandler(t)
+
+	user := &portainer.User{Username: "restricted", Role: portainer.StandardUserRole}
+	err := handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.User().Create(user)
+	})
+	require.NoError(t, err)
+
+	// attach requires a hexadecimal `id` query parameter to reach the authorization check.
+	req := httptest.NewRequest(http.MethodGet, "/websocket/attach?id=abcdef&endpointId=2", nil)
+	req = req.WithContext(security.StoreTokenData(req, &portainer.TokenData{ID: user.ID, Role: portainer.StandardUserRole}))
+
+	handlerErr := handler.websocketAttach(httptest.NewRecorder(), req)
+
+	require.NotNil(t, handlerErr, "expected an authorization error for a denied environment")
+	assert.Equal(t, http.StatusForbidden, handlerErr.StatusCode)
+}
diff --git a/api/http/handler/websocket/dial.go b/api/http/handler/websocket/dial.go
new file mode 100644
index 0000000..cab749a
--- /dev/null
+++ b/api/http/handler/websocket/dial.go
@@ -0,0 +1,11 @@
+//go:build !windows
+
+package websocket
+
+import (
+	"net"
+)
+
+func createDial(scheme, host string) (net.Conn, error) {
+	return net.Dial(scheme, host)
+}
diff --git a/api/http/handler/websocket/dial_windows.go b/api/http/handler/websocket/dial_windows.go
new file mode 100644
index 0000000..6e8c5cf
--- /dev/null
+++ b/api/http/handler/websocket/dial_windows.go
@@ -0,0 +1,16 @@
+//go:build windows
+
+package websocket
+
+import (
+	"net"
+
+	"github.com/Microsoft/go-winio"
+)
+
+func createDial(scheme, host string) (net.Conn, error) {
+	if scheme == "npipe" {
+		return winio.DialPipe(host, nil)
+	}
+	return net.Dial(scheme, host)
+}
diff --git a/api/http/handler/websocket/exec.go b/api/http/handler/websocket/exec.go
new file mode 100644
index 0000000..2ce09ac
--- /dev/null
+++ b/api/http/handler/websocket/exec.go
@@ -0,0 +1,139 @@
+package websocket
+
+import (
+	"bytes"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/logs"
+	"github.com/portainer/portainer/api/ws"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+	"github.com/portainer/portainer/pkg/validate"
+
+	"github.com/gorilla/websocket"
+	"github.com/segmentio/encoding/json"
+)
+
+type execStartOperationPayload struct {
+	Tty    bool
+	Detach bool
+}
+
+// @summary Execute a websocket
+// @description If the nodeName query parameter is present, the request will be proxied to the underlying agent environment(endpoint).
+// @description If the nodeName query parameter is not specified, the request will be upgraded to the websocket protocol and
+// @description an ExecStart operation HTTP request will be created and hijacked.
+// @**Access policy**: authenticated
+// @security ApiKeyAuth
+// @security jwt
+// @tags websocket
+// @accept json
+// @produce json
+// @param endpointId query int true "environment(endpoint) ID of the environment(endpoint) where the resource is located"
+// @param nodeName query string false "node name"
+// @success 200
+// @failure 400
+// @failure 409
+// @failure 500
+// @router /websocket/exec [get]
+func (handler *Handler) websocketExec(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	execID, err := request.RetrieveQueryParameter(r, "id", false)
+	if err != nil {
+		return httperror.BadRequest("Invalid query parameter: id", err)
+	}
+	if !validate.IsHexadecimal(execID) {
+		return httperror.BadRequest("Invalid query parameter: id (must be hexadecimal identifier)", err)
+	}
+
+	endpointID, err := request.RetrieveNumericQueryParameter(r, "endpointId", false)
+	if err != nil {
+		return httperror.BadRequest("Invalid query parameter: endpointId", err)
+	}
+
+	endpoint, err := handler.DataStore.Endpoint().Endpoint(portainer.EndpointID(endpointID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find the environment associated to the stack inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find the environment associated to the stack inside the database", err)
+	}
+
+	err = handler.requestBouncer.AuthorizedEndpointOperation(r, endpoint)
+	if err != nil {
+		return httperror.Forbidden("Permission denied to access environment", err)
+	}
+
+	params := &webSocketRequestParams{
+		endpoint: endpoint,
+		ID:       execID,
+		nodeName: r.FormValue("nodeName"),
+	}
+
+	err = handler.handleExecRequest(w, r, params)
+	if err != nil {
+		return httperror.InternalServerError("An error occurred during websocket exec operation", err)
+	}
+
+	return nil
+}
+
+func (handler *Handler) handleExecRequest(w http.ResponseWriter, r *http.Request, params *webSocketRequestParams) error {
+	r.Header.Del("Origin")
+
+	if params.endpoint.Type == portainer.AgentOnDockerEnvironment {
+		return handler.proxyAgentWebsocketRequest(w, r, params)
+	} else if params.endpoint.Type == portainer.EdgeAgentOnDockerEnvironment {
+		return handler.proxyEdgeAgentWebsocketRequest(w, r, params)
+	}
+
+	websocketConn, err := handler.connectionUpgrader.Upgrade(w, r, nil)
+	if err != nil {
+		return err
+	}
+
+	defer logs.CloseAndLogErr(websocketConn)
+
+	return hijackExecStartOperation(websocketConn, params.endpoint, params.ID)
+}
+
+func hijackExecStartOperation(
+	websocketConn *websocket.Conn,
+	endpoint *portainer.Endpoint,
+	execID string,
+) error {
+	conn, err := initDial(endpoint)
+	if err != nil {
+		return err
+	}
+
+	execStartRequest, err := createExecStartRequest(execID)
+	if err != nil {
+		return err
+	}
+
+	return ws.HijackRequest(websocketConn, conn, execStartRequest)
+}
+
+func createExecStartRequest(execID string) (*http.Request, error) {
+	execStartOperationPayload := &execStartOperationPayload{
+		Tty:    true,
+		Detach: false,
+	}
+
+	encodedBody := bytes.NewBuffer(nil)
+	err := json.NewEncoder(encodedBody).Encode(execStartOperationPayload)
+	if err != nil {
+		return nil, err
+	}
+
+	request, err := http.NewRequest("POST", "/exec/"+execID+"/start", encodedBody)
+	if err != nil {
+		return nil, err
+	}
+
+	request.Header.Set("Content-Type", "application/json")
+	request.Header.Set("Connection", "Upgrade")
+	request.Header.Set("Upgrade", "tcp")
+
+	return request, nil
+}
diff --git a/api/http/handler/websocket/exec_test.go b/api/http/handler/websocket/exec_test.go
new file mode 100644
index 0000000..fedfbb5
--- /dev/null
+++ b/api/http/handler/websocket/exec_test.go
@@ -0,0 +1,34 @@
+package websocket
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestWebsocketExec_deniesUnauthorizedEndpoint asserts a non-admin with no access policy on
+// the environment is rejected with 403 — the environment-access (L2) gate (BE-13027).
+func TestWebsocketExec_deniesUnauthorizedEndpoint(t *testing.T) {
+	handler, _ := newWebsocketTestHandler(t)
+
+	user := &portainer.User{Username: "restricted", Role: portainer.StandardUserRole}
+	err := handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.User().Create(user)
+	})
+	require.NoError(t, err)
+
+	// exec requires a hexadecimal `id` query parameter to reach the authorization check.
+	req := httptest.NewRequest(http.MethodGet, "/websocket/exec?id=abcdef&endpointId=2", nil)
+	req = req.WithContext(security.StoreTokenData(req, &portainer.TokenData{ID: user.ID, Role: portainer.StandardUserRole}))
+
+	handlerErr := handler.websocketExec(httptest.NewRecorder(), req)
+
+	require.NotNil(t, handlerErr, "expected an authorization error for a denied environment")
+	assert.Equal(t, http.StatusForbidden, handlerErr.StatusCode)
+}
diff --git a/api/http/handler/websocket/handler.go b/api/http/handler/websocket/handler.go
new file mode 100644
index 0000000..2d15891
--- /dev/null
+++ b/api/http/handler/websocket/handler.go
@@ -0,0 +1,44 @@
+package websocket
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/proxy/factory/kubernetes"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/kubernetes/cli"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+
+	"github.com/gorilla/mux"
+	"github.com/gorilla/websocket"
+)
+
+// Handler is the HTTP handler used to handle websocket operations.
+type Handler struct {
+	*mux.Router
+	DataStore                   dataservices.DataStore
+	SignatureService            portainer.DigitalSignatureService
+	ReverseTunnelService        portainer.ReverseTunnelService
+	KubernetesClientFactory     *cli.ClientFactory
+	requestBouncer              security.BouncerService
+	connectionUpgrader          websocket.Upgrader
+	kubernetesTokenCacheManager *kubernetes.TokenCacheManager
+}
+
+// NewHandler creates a handler to manage websocket operations.
+func NewHandler(kubernetesTokenCacheManager *kubernetes.TokenCacheManager, bouncer security.BouncerService) *Handler {
+	h := &Handler{
+		Router:                      mux.NewRouter(),
+		connectionUpgrader:          websocket.Upgrader{},
+		requestBouncer:              bouncer,
+		kubernetesTokenCacheManager: kubernetesTokenCacheManager,
+	}
+	h.PathPrefix("/websocket/exec").Handler(
+		bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.websocketExec)))
+	h.PathPrefix("/websocket/attach").Handler(
+		bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.websocketAttach)))
+	h.PathPrefix("/websocket/pod").Handler(
+		bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.websocketPodExec)))
+	h.PathPrefix("/websocket/kubernetes-shell").Handler(
+		bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.websocketShellPodExec)))
+	return h
+}
diff --git a/api/http/handler/websocket/initdial.go b/api/http/handler/websocket/initdial.go
new file mode 100644
index 0000000..1be0e49
--- /dev/null
+++ b/api/http/handler/websocket/initdial.go
@@ -0,0 +1,34 @@
+package websocket
+
+import (
+	"crypto/tls"
+	"net"
+	"net/url"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/crypto"
+)
+
+func initDial(endpoint *portainer.Endpoint) (net.Conn, error) {
+	url, err := url.Parse(endpoint.URL)
+	if err != nil {
+		return nil, err
+	}
+
+	host := url.Host
+
+	if url.Scheme == "unix" || url.Scheme == "npipe" {
+		host = url.Path
+	}
+
+	if !endpoint.TLSConfig.TLS {
+		return createDial(url.Scheme, host)
+	}
+
+	tlsConfig, err := crypto.CreateTLSConfigurationFromDisk(endpoint.TLSConfig)
+	if err != nil {
+		return nil, err
+	}
+
+	return tls.Dial(url.Scheme, host, tlsConfig)
+}
diff --git a/api/http/handler/websocket/initdial_test.go b/api/http/handler/websocket/initdial_test.go
new file mode 100644
index 0000000..24cee95
--- /dev/null
+++ b/api/http/handler/websocket/initdial_test.go
@@ -0,0 +1,64 @@
+package websocket
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/pkg/fips"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestInitDial(t *testing.T) {
+	t.Parallel()
+	fips.InitFIPS(false)
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {}))
+	defer srv.Close()
+
+	tlsSrv := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {}))
+	defer tlsSrv.Close()
+
+	f := func(srvURL string) {
+		u, err := url.Parse(srvURL)
+		require.NoError(t, err)
+
+		isTLS := u.Scheme == "https"
+
+		u.Scheme = "tcp"
+
+		endpoint := &portainer.Endpoint{
+			URL: u.String(),
+			TLSConfig: portainer.TLSConfiguration{
+				TLS:           isTLS,
+				TLSSkipVerify: true,
+			},
+		}
+
+		// Valid configuration
+		conn, err := initDial(endpoint)
+		require.NoError(t, err)
+		require.NotNil(t, conn)
+
+		err = conn.Close()
+		require.NoError(t, err)
+
+		if !isTLS {
+			return
+		}
+
+		// Invalid TLS configuration
+		endpoint.TLSConfig.TLSCertPath = "/invalid/path/client.crt"
+		endpoint.TLSConfig.TLSKeyPath = "/invalid/path/client.key"
+
+		conn, err = initDial(endpoint)
+		require.Error(t, err)
+		require.Nil(t, conn)
+	}
+
+	f(srv.URL)
+	f(tlsSrv.URL)
+}
diff --git a/api/http/handler/websocket/pod.go b/api/http/handler/websocket/pod.go
new file mode 100644
index 0000000..f57abf4
--- /dev/null
+++ b/api/http/handler/websocket/pod.go
@@ -0,0 +1,214 @@
+package websocket
+
+import (
+	"errors"
+	"io"
+	"net/http"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/proxy/factory/kubernetes"
+	"github.com/portainer/portainer/api/http/security"
+	kubecli "github.com/portainer/portainer/api/kubernetes/cli"
+	"github.com/portainer/portainer/api/logs"
+	"github.com/portainer/portainer/api/ws"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+
+	"github.com/gorilla/websocket"
+	"github.com/rs/zerolog/log"
+)
+
+// @summary Execute a websocket on pod
+// @description The request will be upgraded to the websocket protocol.
+// @description **Access policy**: authenticated
+// @security ApiKeyAuth
+// @security jwt
+// @tags websocket
+// @accept json
+// @produce json
+// @param endpointId query int true "environment(endpoint) ID of the environment(endpoint) where the resource is located"
+// @param namespace query string true "namespace where the container is located"
+// @param podName query string true "name of the pod containing the container"
+// @param containerName query string true "name of the container"
+// @param command query string true "command to execute in the container"
+// @success 200
+// @failure 400
+// @failure 403
+// @failure 404
+// @failure 500
+// @router /websocket/pod [get]
+func (handler *Handler) websocketPodExec(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	endpointID, err := request.RetrieveNumericQueryParameter(r, "endpointId", false)
+	if err != nil {
+		return httperror.BadRequest("Invalid query parameter: endpointId", err)
+	}
+
+	namespace, err := request.RetrieveQueryParameter(r, "namespace", false)
+	if err != nil {
+		return httperror.BadRequest("Invalid query parameter: namespace", err)
+	}
+
+	podName, err := request.RetrieveQueryParameter(r, "podName", false)
+	if err != nil {
+		return httperror.BadRequest("Invalid query parameter: podName", err)
+	}
+
+	containerName, err := request.RetrieveQueryParameter(r, "containerName", false)
+	if err != nil {
+		return httperror.BadRequest("Invalid query parameter: containerName", err)
+	}
+
+	command, err := request.RetrieveQueryParameter(r, "command", false)
+	if err != nil {
+		return httperror.BadRequest("Invalid query parameter: command", err)
+	}
+
+	endpoint, err := handler.DataStore.Endpoint().Endpoint(portainer.EndpointID(endpointID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find the environment associated to the stack inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find the environment associated to the stack inside the database", err)
+	}
+
+	if err := handler.requestBouncer.AuthorizedEndpointOperation(r, endpoint); err != nil {
+		return httperror.Forbidden("Permission denied to access environment", err)
+	}
+
+	serviceAccountToken, isAdminToken, err := handler.getToken(r, endpoint, false)
+	if err != nil {
+		return httperror.InternalServerError("Unable to get user service account token", err)
+	}
+
+	params := &webSocketRequestParams{
+		endpoint: endpoint,
+		token:    serviceAccountToken,
+	}
+
+	r.Header.Del("Origin")
+
+	if endpoint.Type == portainer.AgentOnKubernetesEnvironment {
+		if err := handler.proxyAgentWebsocketRequest(w, r, params); err != nil {
+			return httperror.InternalServerError("Unable to proxy websocket request to agent", err)
+		}
+
+		return nil
+	} else if endpoint.Type == portainer.EdgeAgentOnKubernetesEnvironment {
+		if err := handler.proxyEdgeAgentWebsocketRequest(w, r, params); err != nil {
+			return httperror.InternalServerError("Unable to proxy websocket request to Edge agent", err)
+		}
+
+		return nil
+	}
+
+	cli, err := handler.KubernetesClientFactory.GetPrivilegedKubeClient(endpoint)
+	if err != nil {
+		return httperror.InternalServerError("Unable to create Kubernetes client", err)
+	}
+
+	handlerErr := handler.hijackPodExecStartOperation(w, r, cli, serviceAccountToken, isAdminToken, endpoint, namespace, podName, containerName, command)
+	if handlerErr != nil {
+		return handlerErr
+	}
+
+	return nil
+}
+
+func (handler *Handler) hijackPodExecStartOperation(
+	w http.ResponseWriter,
+	r *http.Request,
+	cli portainer.KubeClient,
+	serviceAccountToken string,
+	isAdminToken bool,
+	endpoint *portainer.Endpoint,
+	namespace, podName, containerName, command string,
+) *httperror.HandlerError {
+	commandArray := strings.Split(command, " ")
+
+	websocketConn, err := handler.connectionUpgrader.Upgrade(w, r, nil)
+	if err != nil {
+		return httperror.InternalServerError("Unable to upgrade the connection", err)
+	}
+	defer logs.CloseAndLogErr(websocketConn)
+
+	stdinReader, stdinWriter := io.Pipe()
+	defer logs.CloseAndLogErr(stdinWriter)
+	stdoutReader, stdoutWriter := io.Pipe()
+	defer logs.CloseAndLogErr(stdoutWriter)
+
+	// errorChan is used to propagate errors from the go routines to the caller.
+	errorChan := make(chan error, 3)
+
+	sizeQueue := kubecli.NewTerminalSizeQueue()
+	defer sizeQueue.Close()
+	go ws.StreamFromWebsocketToWriter(websocketConn, stdinWriter, errorChan, ws.ResizeHandler(sizeQueue))
+	go ws.StreamFromReaderToWebsocket(websocketConn, stdoutReader, errorChan)
+
+	// StartExecProcess is a blocking operation which streams IO to/from pod;
+	// this must execute in asynchronously, since the websocketConn could return errors (e.g. client disconnects) before
+	// the blocking operation is completed.
+	go cli.StartExecProcess(portainer.KubeExecParams{
+		Token:         serviceAccountToken,
+		UseAdminToken: isAdminToken,
+		Namespace:     namespace,
+		PodName:       podName,
+		ContainerName: containerName,
+		Command:       commandArray,
+		Stdin:         stdinReader,
+		Stdout:        stdoutWriter,
+		ResizeQueue:   sizeQueue,
+		ErrChan:       errorChan,
+	})
+
+	err = <-errorChan
+
+	if err == nil || errors.Is(err, io.EOF) {
+		// exec process ended normally (shell exited) - send a clean close frame to the browser
+		_ = websocketConn.WriteMessage(websocket.CloseMessage, websocket.FormatCloseMessage(websocket.CloseNormalClosure, ""))
+
+		return nil
+	}
+
+	// websocket client successfully disconnected
+	if websocket.IsUnexpectedCloseError(err, websocket.CloseNormalClosure, websocket.CloseGoingAway, websocket.CloseNoStatusReceived) {
+		log.Debug().Err(err).Msg("websocket error")
+
+		return nil
+	}
+
+	return httperror.InternalServerError("Unable to start exec process inside container", err)
+}
+
+func (handler *Handler) getToken(request *http.Request, endpoint *portainer.Endpoint, setLocalAdminToken bool) (string, bool, error) {
+	tokenData, err := security.RetrieveTokenData(request)
+	if err != nil {
+		return "", false, err
+	}
+
+	kubecli, err := handler.KubernetesClientFactory.GetPrivilegedKubeClient(endpoint)
+	if err != nil {
+		return "", false, err
+	}
+
+	tokenCache := handler.kubernetesTokenCacheManager.GetOrCreateTokenCache(endpoint.ID)
+
+	tokenManager, err := kubernetes.NewTokenManager(kubecli, handler.DataStore, tokenCache, setLocalAdminToken)
+	if err != nil {
+		return "", false, err
+	}
+
+	if tokenData.Role == portainer.AdministratorRole {
+		return tokenManager.GetAdminServiceAccountToken(), true, nil
+	}
+
+	token, err := tokenManager.GetUserServiceAccountToken(int(tokenData.ID), endpoint.ID)
+	if err != nil {
+		return "", false, err
+	}
+
+	if token == "" {
+		return "", false, errors.New("can not get a valid user service account token")
+	}
+
+	return token, false, nil
+}
diff --git a/api/http/handler/websocket/pod_test.go b/api/http/handler/websocket/pod_test.go
new file mode 100644
index 0000000..c8c6c29
--- /dev/null
+++ b/api/http/handler/websocket/pod_test.go
@@ -0,0 +1,62 @@
+package websocket
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// podExecQuery is the minimal set of query parameters required to reach the authorization
+// check in websocketPodExec.
+const podExecQuery = "/websocket/pod?endpointId=2&namespace=default&podName=p&containerName=c&command=sh"
+
+// TestWebsocketPodExec_deniesUnauthorizedEndpoint asserts a non-admin with no access policy on
+// the environment is rejected with 403 — the environment-access (L2) gate (BE-13027).
+func TestWebsocketPodExec_deniesUnauthorizedEndpoint(t *testing.T) {
+	handler, _ := newWebsocketTestHandler(t)
+
+	user := &portainer.User{Username: "restricted", Role: portainer.StandardUserRole}
+	err := handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.User().Create(user)
+	})
+	require.NoError(t, err)
+
+	req := httptest.NewRequest(http.MethodGet, podExecQuery, nil)
+	req = req.WithContext(security.StoreTokenData(req, &portainer.TokenData{ID: user.ID, Role: portainer.StandardUserRole}))
+
+	handlerErr := handler.websocketPodExec(httptest.NewRecorder(), req)
+
+	require.NotNil(t, handlerErr, "expected an authorization error for a denied environment")
+	assert.Equal(t, http.StatusForbidden, handlerErr.StatusCode)
+}
+
+// TestWebsocketPodExec_allowsAuthorizedNonAdmin asserts a non-admin granted environment access
+// passes authorization (reaching the nil client via getToken and panicking). CE has no
+// operation-level (L3) layer, so environment access is the only gate (BE-13027).
+func TestWebsocketPodExec_allowsAuthorizedNonAdmin(t *testing.T) {
+	handler, endpoint := newWebsocketTestHandler(t)
+
+	user := &portainer.User{Username: "standard", Role: portainer.StandardUserRole}
+	err := handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		if err := tx.User().Create(user); err != nil {
+			return err
+		}
+		// Access is by membership; the access policy's role is irrelevant to the CE access decision.
+		endpoint.UserAccessPolicies = portainer.UserAccessPolicies{user.ID: {}}
+		return tx.Endpoint().UpdateEndpoint(endpoint.ID, endpoint)
+	})
+	require.NoError(t, err)
+
+	req := httptest.NewRequest(http.MethodGet, podExecQuery, nil)
+	req = req.WithContext(security.StoreTokenData(req, &portainer.TokenData{ID: user.ID, Role: portainer.StandardUserRole}))
+
+	assert.Panics(t, func() {
+		_ = handler.websocketPodExec(httptest.NewRecorder(), req)
+	})
+}
diff --git a/api/http/handler/websocket/proxy.go b/api/http/handler/websocket/proxy.go
new file mode 100644
index 0000000..da68489
--- /dev/null
+++ b/api/http/handler/websocket/proxy.go
@@ -0,0 +1,107 @@
+package websocket
+
+import (
+	"net"
+	"net/http"
+	"net/url"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/crypto"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/logoutcontext"
+
+	"github.com/gorilla/websocket"
+	"github.com/koding/websocketproxy"
+	"github.com/rs/zerolog/log"
+)
+
+func (handler *Handler) proxyEdgeAgentWebsocketRequest(w http.ResponseWriter, r *http.Request, params *webSocketRequestParams) error {
+	tunnelAddr, err := handler.ReverseTunnelService.TunnelAddr(params.endpoint)
+	if err != nil {
+		return err
+	}
+
+	agentURL, err := url.Parse("http://" + tunnelAddr)
+	if err != nil {
+		return err
+	}
+
+	return handler.doProxyWebsocketRequest(w, r, params, agentURL, true)
+}
+
+func (handler *Handler) proxyAgentWebsocketRequest(w http.ResponseWriter, r *http.Request, params *webSocketRequestParams) error {
+	endpointURL := params.endpoint.URL
+	if params.endpoint.Type == portainer.AgentOnKubernetesEnvironment {
+		endpointURL = "http://" + params.endpoint.URL
+	}
+
+	agentURL, err := url.Parse(endpointURL)
+	if err != nil {
+		return err
+	}
+
+	return handler.doProxyWebsocketRequest(w, r, params, agentURL, false)
+}
+
+func (handler *Handler) doProxyWebsocketRequest(
+	w http.ResponseWriter,
+	r *http.Request,
+	params *webSocketRequestParams,
+	agentURL *url.URL,
+	isEdge bool,
+) error {
+	tokenData, err := security.RetrieveTokenData(r)
+	if err != nil {
+		log.
+			Warn().
+			Err(err).
+			Msg("unable to retrieve user details from authentication token")
+		return err
+	}
+
+	enableTLS := !isEdge && (params.endpoint.TLSConfig.TLS || params.endpoint.TLSConfig.TLSSkipVerify)
+
+	agentURL.Scheme = "ws"
+	if enableTLS {
+		agentURL.Scheme = "wss"
+	}
+
+	proxy := websocketproxy.NewProxy(agentURL)
+	proxyDialer := *websocket.DefaultDialer
+	proxy.Dialer = &proxyDialer
+
+	if enableTLS {
+		proxyDialer.TLSClientConfig = crypto.CreateTLSConfiguration(params.endpoint.TLSConfig.TLSSkipVerify)
+	}
+
+	signature, err := handler.SignatureService.CreateSignature(portainer.PortainerAgentSignatureMessage)
+	if err != nil {
+		return err
+	}
+
+	proxy.Director = func(incoming *http.Request, out http.Header) {
+		out.Set(portainer.PortainerAgentPublicKeyHeader, handler.SignatureService.EncodedPublicKey())
+		out.Set(portainer.PortainerAgentSignatureHeader, signature)
+		out.Set(portainer.PortainerAgentTargetHeader, params.nodeName)
+		out.Set(portainer.PortainerAgentKubernetesSATokenHeader, params.token)
+	}
+
+	if isEdge {
+		handler.ReverseTunnelService.UpdateLastActivity(params.endpoint.ID)
+		handler.ReverseTunnelService.KeepTunnelAlive(params.endpoint.ID, r.Context(), portainer.WebSocketKeepAlive)
+	}
+
+	proxy.Dialer.NetDial = func(network, addr string) (net.Conn, error) {
+		netDialer := &net.Dialer{}
+
+		logoutCtx := logoutcontext.GetContext(tokenData.Token)
+
+		conn, err := netDialer.DialContext(logoutCtx, network, addr)
+
+		return conn, err
+	}
+
+	proxy.ServeHTTP(w, r)
+
+	return nil
+}
diff --git a/api/http/handler/websocket/shell_pod.go b/api/http/handler/websocket/shell_pod.go
new file mode 100644
index 0000000..a5e0093
--- /dev/null
+++ b/api/http/handler/websocket/shell_pod.go
@@ -0,0 +1,122 @@
+package websocket
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+)
+
+// @summary Execute a websocket on kubectl shell pod
+// @description The request will be upgraded to the websocket protocol. The request will proxy input from the client to the pod via long-lived websocket connection.
+// @description **Access policy**: authenticated
+// @security ApiKeyAuth
+// @security jwt
+// @tags websocket
+// @accept json
+// @produce json
+// @param endpointId query int true "environment(endpoint) ID of the environment(endpoint) where the resource is located"
+// @success 200 "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied"
+// @failure 404 "Environment not found"
+// @failure 500 "Server error"
+// @router /websocket/kubernetes-shell [get]
+func (handler *Handler) websocketShellPodExec(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	endpointID, err := request.RetrieveNumericQueryParameter(r, "endpointId", false)
+	if err != nil {
+		return httperror.BadRequest("Invalid query parameter: endpointId", err)
+	}
+
+	endpoint, err := handler.DataStore.Endpoint().Endpoint(portainer.EndpointID(endpointID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find the environment associated to the stack inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find the environment associated to the stack inside the database", err)
+	}
+
+	if err := handler.requestBouncer.AuthorizedEndpointOperation(r, endpoint); err != nil {
+		return httperror.Forbidden("Permission denied to access environment", err)
+	}
+
+	tokenData, err := security.RetrieveTokenData(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve user authentication token", err)
+	}
+
+	cli, err := handler.KubernetesClientFactory.GetPrivilegedKubeClient(endpoint)
+	if err != nil {
+		return httperror.InternalServerError("Unable to create Kubernetes client", err)
+	}
+
+	serviceAccount, err := cli.GetPortainerUserServiceAccount(tokenData)
+	if err != nil {
+		return httperror.InternalServerError("Unable to find serviceaccount associated with user", err)
+	}
+
+	settings, err := handler.DataStore.Settings().Settings()
+	if err != nil {
+		return httperror.InternalServerError("Unable read settings", err)
+	}
+
+	shellPod, err := cli.CreateUserShellPod(r.Context(), serviceAccount.Name, settings.KubectlShellImage)
+	if err != nil {
+		return httperror.InternalServerError("Unable to create user shell", err)
+	}
+
+	// Modifying request params mid-flight before forewarding to K8s API server (websocket)
+	q := r.URL.Query()
+
+	q.Add("namespace", shellPod.Namespace)
+	q.Add("podName", shellPod.PodName)
+	q.Add("containerName", shellPod.ContainerName)
+	q.Add("command", shellPod.ShellExecCommand)
+
+	r.URL.RawQuery = q.Encode()
+
+	// Modify url path mid-flight before forewarding to k8s API server (websocket)
+	r.URL.Path = "/websocket/pod"
+
+	/*
+		Note: The following websocket proxying logic is duplicated from `api/http/handler/websocket/pod.go`
+	*/
+	params := &webSocketRequestParams{
+		endpoint: endpoint,
+	}
+
+	r.Header.Del("Origin")
+
+	if endpoint.Type == portainer.AgentOnKubernetesEnvironment {
+		err := handler.proxyAgentWebsocketRequest(w, r, params)
+		if err != nil {
+			return httperror.InternalServerError("Unable to proxy websocket request to agent", err)
+		}
+		return nil
+	} else if endpoint.Type == portainer.EdgeAgentOnKubernetesEnvironment {
+		err := handler.proxyEdgeAgentWebsocketRequest(w, r, params)
+		if err != nil {
+			return httperror.InternalServerError("Unable to proxy websocket request to Edge agent", err)
+		}
+		return nil
+	}
+
+	handlerErr := handler.hijackPodExecStartOperation(
+		w,
+		r,
+		cli,
+		"",
+		true,
+		endpoint,
+		shellPod.Namespace,
+		shellPod.PodName,
+		shellPod.ContainerName,
+		shellPod.ShellExecCommand,
+	)
+	if handlerErr != nil {
+		return handlerErr
+	}
+
+	return nil
+}
diff --git a/api/http/handler/websocket/shell_pod_test.go b/api/http/handler/websocket/shell_pod_test.go
new file mode 100644
index 0000000..d244374
--- /dev/null
+++ b/api/http/handler/websocket/shell_pod_test.go
@@ -0,0 +1,101 @@
+package websocket
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// newWebsocketTestHandler builds a websocket Handler backed by a test store with a single
+// Kubernetes environment (ID 2) and a real bouncer, returning both the handler and that
+// endpoint so callers can grant access via its UserAccessPolicies. KubernetesClientFactory is
+// left nil so any handler that proceeds past authorization trips a clear panic. Shared by the
+// exec/attach/pod/kubernetes-shell L2 tests (BE-13027).
+func newWebsocketTestHandler(t *testing.T) (*Handler, *portainer.Endpoint) {
+	t.Helper()
+
+	_, store := datastore.MustNewTestStore(t, true, false)
+
+	endpoint := &portainer.Endpoint{
+		ID:      2,
+		Name:    "target-env",
+		Type:    portainer.AgentOnKubernetesEnvironment,
+		GroupID: 1,
+	}
+	require.NoError(t, store.Endpoint().Create(endpoint))
+
+	bouncer := security.NewRequestBouncer(t.Context(), store, nil, nil)
+
+	handler := &Handler{
+		DataStore:      store,
+		requestBouncer: bouncer,
+		// KubernetesClientFactory intentionally left nil.
+	}
+
+	return handler, endpoint
+}
+
+// TestWebsocketShellPodExec_deniesUnauthorizedEndpoint asserts a non-admin with no access
+// policy on the environment is rejected with 403 — the environment-access (L2) gate (BE-13027).
+func TestWebsocketShellPodExec_deniesUnauthorizedEndpoint(t *testing.T) {
+	handler, _ := newWebsocketTestHandler(t)
+
+	user := &portainer.User{Username: "restricted", Role: portainer.StandardUserRole}
+	err := handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.User().Create(user)
+	})
+	require.NoError(t, err)
+
+	req := httptest.NewRequest(http.MethodGet, "/websocket/kubernetes-shell?endpointId=2", nil)
+	req = req.WithContext(security.StoreTokenData(req, &portainer.TokenData{ID: user.ID, Role: portainer.StandardUserRole}))
+
+	handlerErr := handler.websocketShellPodExec(httptest.NewRecorder(), req)
+
+	require.NotNil(t, handlerErr, "expected an authorization error for a denied environment")
+	assert.Equal(t, http.StatusForbidden, handlerErr.StatusCode)
+}
+
+// TestWebsocketShellPodExec_allowsAuthorizedEndpoint asserts an admin passes authorization and
+// reaches the nil KubernetesClientFactory (panic proves auth did not block the request) (BE-13027).
+func TestWebsocketShellPodExec_allowsAuthorizedEndpoint(t *testing.T) {
+	handler, _ := newWebsocketTestHandler(t)
+
+	req := httptest.NewRequest(http.MethodGet, "/websocket/kubernetes-shell?endpointId=2", nil)
+	req = req.WithContext(security.StoreTokenData(req, &portainer.TokenData{ID: 1, Role: portainer.AdministratorRole}))
+
+	assert.Panics(t, func() {
+		_ = handler.websocketShellPodExec(httptest.NewRecorder(), req)
+	})
+}
+
+// TestWebsocketShellPodExec_allowsAuthorizedNonAdmin asserts a non-admin granted environment
+// access passes authorization (reaching the nil client and panicking). CE has no operation-level
+// (L3) layer, so environment access is the only gate (BE-13027).
+func TestWebsocketShellPodExec_allowsAuthorizedNonAdmin(t *testing.T) {
+	handler, endpoint := newWebsocketTestHandler(t)
+
+	user := &portainer.User{Username: "standard", Role: portainer.StandardUserRole}
+	err := handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		if err := tx.User().Create(user); err != nil {
+			return err
+		}
+		// Access is by membership; the access policy's role is irrelevant to the CE access decision.
+		endpoint.UserAccessPolicies = portainer.UserAccessPolicies{user.ID: {}}
+		return tx.Endpoint().UpdateEndpoint(endpoint.ID, endpoint)
+	})
+	require.NoError(t, err)
+
+	req := httptest.NewRequest(http.MethodGet, "/websocket/kubernetes-shell?endpointId=2", nil)
+	req = req.WithContext(security.StoreTokenData(req, &portainer.TokenData{ID: user.ID, Role: portainer.StandardUserRole}))
+
+	assert.Panics(t, func() {
+		_ = handler.websocketShellPodExec(httptest.NewRecorder(), req)
+	})
+}
diff --git a/api/http/handler/websocket/types.go b/api/http/handler/websocket/types.go
new file mode 100644
index 0000000..97b3334
--- /dev/null
+++ b/api/http/handler/websocket/types.go
@@ -0,0 +1,10 @@
+package websocket
+
+import portainer "github.com/portainer/portainer/api"
+
+type webSocketRequestParams struct {
+	ID       string
+	nodeName string
+	endpoint *portainer.Endpoint
+	token    string
+}
diff --git a/api/http/logger.go b/api/http/logger.go
new file mode 100644
index 0000000..637d253
--- /dev/null
+++ b/api/http/logger.go
@@ -0,0 +1,19 @@
+package http
+
+import (
+	"log"
+
+	zlog "github.com/rs/zerolog/log"
+)
+
+type httpLogger struct{}
+
+func NewHTTPLogger() *log.Logger {
+	return log.New(httpLogger{}, "", 0)
+}
+
+func (l httpLogger) Write(data []byte) (int, error) {
+	zlog.Debug().CallerSkipFrame(3).Msg(string(data))
+
+	return len(data), nil
+}
diff --git a/api/http/logger_test.go b/api/http/logger_test.go
new file mode 100644
index 0000000..7828b48
--- /dev/null
+++ b/api/http/logger_test.go
@@ -0,0 +1,22 @@
+package http
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/rs/zerolog"
+	"github.com/rs/zerolog/log"
+	"github.com/stretchr/testify/require"
+)
+
+func TestLogger(t *testing.T) {
+	t.Parallel()
+	msg := "Testing HTTP logger"
+	buf := &bytes.Buffer{}
+
+	log.Logger = zerolog.New(buf)
+
+	NewHTTPLogger().Print(msg)
+
+	require.Contains(t, buf.String(), msg)
+}
diff --git a/api/http/middlewares/deprecated.go b/api/http/middlewares/deprecated.go
new file mode 100644
index 0000000..945eaa8
--- /dev/null
+++ b/api/http/middlewares/deprecated.go
@@ -0,0 +1,40 @@
+package middlewares
+
+import (
+	"net/http"
+
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/rs/zerolog/log"
+)
+
+// deprecate api route
+func Deprecated(router http.Handler, urlBuilder func(w http.ResponseWriter, r *http.Request) (string, *httperror.HandlerError)) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		newUrl, err := urlBuilder(w, r)
+		if err != nil {
+			httperror.WriteError(w, err.StatusCode, err.Error(), err)
+			return
+		}
+
+		if newUrl == "" {
+			log.Warn().Msg("This api is deprecated.")
+			router.ServeHTTP(w, r)
+			return
+		}
+
+		log.Warn().Str("new_url", newUrl).Msg("this API endpoint is deprecated")
+
+		redirectedRequest := r.Clone(r.Context())
+		redirectedRequest.URL.Path = newUrl
+		router.ServeHTTP(w, redirectedRequest)
+	})
+}
+
+// DeprecatedSimple is a middleware that marks an API route as deprecated
+//
+// if needed, use Deprecated with a custom urlBuilder
+func DeprecatedSimple(h http.Handler) http.Handler {
+	return Deprecated(h, func(w http.ResponseWriter, r *http.Request) (string, *httperror.HandlerError) {
+		return "", nil
+	})
+}
diff --git a/api/http/middlewares/deprecated_test.go b/api/http/middlewares/deprecated_test.go
new file mode 100644
index 0000000..b074925
--- /dev/null
+++ b/api/http/middlewares/deprecated_test.go
@@ -0,0 +1,325 @@
+package middlewares
+
+import (
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestDeprecated(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name               string
+		urlBuilder         func(w http.ResponseWriter, r *http.Request) (string, *httperror.HandlerError)
+		requestPath        string
+		expectedStatusCode int
+		expectedPath       string
+		expectRedirect     bool
+	}{
+		{
+			name: "empty URL - no redirect",
+			urlBuilder: func(w http.ResponseWriter, r *http.Request) (string, *httperror.HandlerError) {
+				return "", nil
+			},
+			requestPath:        "/api/old",
+			expectedStatusCode: http.StatusOK,
+			expectedPath:       "/api/old",
+			expectRedirect:     false,
+		},
+		{
+			name: "new URL provided - redirects",
+			urlBuilder: func(w http.ResponseWriter, r *http.Request) (string, *httperror.HandlerError) {
+				return "/api/new", nil
+			},
+			requestPath:        "/api/old",
+			expectedStatusCode: http.StatusOK,
+			expectedPath:       "/api/new",
+			expectRedirect:     true,
+		},
+		{
+			name: "urlBuilder returns error - returns error response",
+			urlBuilder: func(w http.ResponseWriter, r *http.Request) (string, *httperror.HandlerError) {
+				return "", httperror.BadRequest("invalid request", nil)
+			},
+			requestPath:        "/api/old",
+			expectedStatusCode: http.StatusBadRequest,
+			expectedPath:       "",
+			expectRedirect:     false,
+		},
+		{
+			name: "urlBuilder returns server error",
+			urlBuilder: func(w http.ResponseWriter, r *http.Request) (string, *httperror.HandlerError) {
+				return "", httperror.InternalServerError("server error", nil)
+			},
+			requestPath:        "/api/old",
+			expectedStatusCode: http.StatusInternalServerError,
+			expectedPath:       "",
+			expectRedirect:     false,
+		},
+		{
+			name: "dynamic URL based on request path",
+			urlBuilder: func(w http.ResponseWriter, r *http.Request) (string, *httperror.HandlerError) {
+				return "/v2" + r.URL.Path, nil
+			},
+			requestPath:        "/api/resource/123",
+			expectedStatusCode: http.StatusOK,
+			expectedPath:       "/v2/api/resource/123",
+			expectRedirect:     true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Create a test handler that records the request path
+			var handledPath string
+			testHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				handledPath = r.URL.Path
+				w.WriteHeader(http.StatusOK)
+				_, _ = w.Write([]byte("success"))
+			})
+
+			// Wrap with Deprecated middleware
+			wrappedHandler := Deprecated(testHandler, tt.urlBuilder)
+
+			// Create test request
+			req := httptest.NewRequest(http.MethodGet, tt.requestPath, nil)
+			rec := httptest.NewRecorder()
+
+			// Execute request
+			wrappedHandler.ServeHTTP(rec, req)
+
+			// Check status code
+			assert.Equal(t, tt.expectedStatusCode, rec.Code, "unexpected status code")
+
+			// For error cases, don't check the path
+			if tt.expectedStatusCode >= 400 {
+				return
+			}
+
+			// Check that the correct path was handled
+			if tt.expectRedirect {
+				assert.Equal(t, tt.expectedPath, handledPath, "path was not redirected correctly")
+			} else {
+				assert.Equal(t, tt.requestPath, handledPath, "original path was not preserved")
+			}
+
+			// Check response body for success cases
+			body, err := io.ReadAll(rec.Body)
+			require.NoError(t, err)
+			assert.Equal(t, "success", string(body), "unexpected response body")
+		})
+	}
+}
+
+func TestDeprecatedSimple(t *testing.T) {
+	t.Parallel()
+	// Create a test handler
+	testHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte("test response"))
+	})
+
+	// Wrap with DeprecatedSimple middleware
+	wrappedHandler := DeprecatedSimple(testHandler)
+
+	// Create test request
+	req := httptest.NewRequest(http.MethodGet, "/api/test", nil)
+	rec := httptest.NewRecorder()
+
+	// Execute request
+	wrappedHandler.ServeHTTP(rec, req)
+
+	// Check that request was successful
+	assert.Equal(t, http.StatusOK, rec.Code, "unexpected status code")
+
+	// Check response body
+	body, err := io.ReadAll(rec.Body)
+	require.NoError(t, err)
+	assert.Equal(t, "test response", string(body), "unexpected response body")
+}
+
+func TestDeprecated_PreservesRequestContext(t *testing.T) {
+	t.Parallel()
+	// Test that the middleware preserves request context when redirecting
+	urlBuilder := func(w http.ResponseWriter, r *http.Request) (string, *httperror.HandlerError) {
+		return "/new-path", nil
+	}
+
+	var receivedRequest *http.Request
+	testHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		receivedRequest = r
+		w.WriteHeader(http.StatusOK)
+	})
+
+	wrappedHandler := Deprecated(testHandler, urlBuilder)
+
+	req := httptest.NewRequest(http.MethodGet, "/old-path", nil)
+	rec := httptest.NewRecorder()
+
+	wrappedHandler.ServeHTTP(rec, req)
+
+	require.NotNil(t, receivedRequest, "request was not passed to handler")
+	assert.Equal(t, req.Context(), receivedRequest.Context(), "request context was not preserved")
+}
+
+func TestDeprecated_PreservesRequestMethod(t *testing.T) {
+	t.Parallel()
+	methods := []string{http.MethodGet, http.MethodPost, http.MethodPut, http.MethodDelete, http.MethodPatch}
+
+	urlBuilder := func(w http.ResponseWriter, r *http.Request) (string, *httperror.HandlerError) {
+		return "/new-path", nil
+	}
+
+	for _, method := range methods {
+		t.Run(method, func(t *testing.T) {
+			var receivedMethod string
+			testHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				receivedMethod = r.Method
+				w.WriteHeader(http.StatusOK)
+			})
+
+			wrappedHandler := Deprecated(testHandler, urlBuilder)
+
+			req := httptest.NewRequest(method, "/old-path", nil)
+			rec := httptest.NewRecorder()
+
+			wrappedHandler.ServeHTTP(rec, req)
+
+			assert.Equal(t, method, receivedMethod, "HTTP method was not preserved")
+		})
+	}
+}
+
+func TestDeprecated_PreservesRequestHeaders(t *testing.T) {
+	t.Parallel()
+	urlBuilder := func(w http.ResponseWriter, r *http.Request) (string, *httperror.HandlerError) {
+		return "/new-path", nil
+	}
+
+	var receivedHeaders http.Header
+	testHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		receivedHeaders = r.Header
+		w.WriteHeader(http.StatusOK)
+	})
+
+	wrappedHandler := Deprecated(testHandler, urlBuilder)
+
+	req := httptest.NewRequest(http.MethodGet, "/old-path", nil)
+	req.Header.Set("Authorization", "Bearer token123")
+	req.Header.Set("Content-Type", "application/json")
+	rec := httptest.NewRecorder()
+
+	wrappedHandler.ServeHTTP(rec, req)
+
+	assert.Equal(t, "Bearer token123", receivedHeaders.Get("Authorization"), "Authorization header was not preserved")
+	assert.Equal(t, "application/json", receivedHeaders.Get("Content-Type"), "Content-Type header was not preserved")
+}
+
+func TestDeprecated_PreservesRequestBody(t *testing.T) {
+	t.Parallel()
+	urlBuilder := func(w http.ResponseWriter, r *http.Request) (string, *httperror.HandlerError) {
+		return "/new-path", nil
+	}
+
+	var receivedBody string
+	testHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		body, _ := io.ReadAll(r.Body)
+		receivedBody = string(body)
+		w.WriteHeader(http.StatusOK)
+	})
+
+	wrappedHandler := Deprecated(testHandler, urlBuilder)
+
+	req := httptest.NewRequest(http.MethodPost, "/old-path", http.NoBody)
+	rec := httptest.NewRecorder()
+
+	wrappedHandler.ServeHTTP(rec, req)
+
+	// Body should be preserved (empty in this case since we used http.NoBody)
+	assert.Empty(t, receivedBody, "expected empty body")
+}
+
+func TestDeprecated_ErrorResponseFormat(t *testing.T) {
+	t.Parallel()
+	urlBuilder := func(w http.ResponseWriter, r *http.Request) (string, *httperror.HandlerError) {
+		return "", httperror.BadRequest("test error message", nil)
+	}
+
+	handlerCalled := false
+	testHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		handlerCalled = true
+		w.WriteHeader(http.StatusOK)
+	})
+
+	wrappedHandler := Deprecated(testHandler, urlBuilder)
+
+	req := httptest.NewRequest(http.MethodGet, "/api/test", nil)
+	rec := httptest.NewRecorder()
+
+	wrappedHandler.ServeHTTP(rec, req)
+
+	assert.False(t, handlerCalled, "handler should not be called when urlBuilder returns error")
+	assert.Equal(t, http.StatusBadRequest, rec.Code, "unexpected status code")
+
+	// The httperror.WriteError function should have written the error response
+	body, err := io.ReadAll(rec.Body)
+	require.NoError(t, err)
+	assert.NotEmpty(t, body, "expected error response body")
+}
+
+func TestDeprecated_WithQueryParameters(t *testing.T) {
+	t.Parallel()
+	urlBuilder := func(w http.ResponseWriter, r *http.Request) (string, *httperror.HandlerError) {
+		return "/api/v2/resource", nil
+	}
+
+	var receivedQuery string
+	testHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		receivedQuery = r.URL.RawQuery
+		w.WriteHeader(http.StatusOK)
+	})
+
+	wrappedHandler := Deprecated(testHandler, urlBuilder)
+
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/resource?filter=active&sort=name", nil)
+	rec := httptest.NewRecorder()
+
+	wrappedHandler.ServeHTTP(rec, req)
+
+	assert.Equal(t, "filter=active&sort=name", receivedQuery, "query parameters were not preserved")
+}
+
+func TestDeprecated_WithMultipleRedirects(t *testing.T) {
+	t.Parallel()
+	// Test that multiple deprecated middleware can be chained
+	urlBuilder1 := func(w http.ResponseWriter, r *http.Request) (string, *httperror.HandlerError) {
+		return "/v2" + r.URL.Path, nil
+	}
+
+	urlBuilder2 := func(w http.ResponseWriter, r *http.Request) (string, *httperror.HandlerError) {
+		return "/api" + r.URL.Path, nil
+	}
+
+	var finalPath string
+	testHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		finalPath = r.URL.Path
+		w.WriteHeader(http.StatusOK)
+	})
+
+	// Chain two deprecated middlewares
+	wrappedHandler := Deprecated(Deprecated(testHandler, urlBuilder2), urlBuilder1)
+
+	req := httptest.NewRequest(http.MethodGet, "/old", nil)
+	rec := httptest.NewRecorder()
+
+	wrappedHandler.ServeHTTP(rec, req)
+
+	// First middleware redirects to /v2/old
+	// Second middleware redirects to /api/v2/old
+	assert.Equal(t, "/api/v2/old", finalPath, "chained redirects did not work correctly")
+}
diff --git a/api/http/middlewares/endpoint.go b/api/http/middlewares/endpoint.go
new file mode 100644
index 0000000..0050e43
--- /dev/null
+++ b/api/http/middlewares/endpoint.go
@@ -0,0 +1,84 @@
+package middlewares
+
+import (
+	"context"
+	"errors"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	requesthelpers "github.com/portainer/portainer/pkg/libhttp/request"
+
+	"github.com/gorilla/mux"
+)
+
+// Note: context keys must be distinct types to prevent collisions. They are NOT key/value map's internally
+// See: https://go.dev/blog/context#TOC_3.2.
+
+// This avoids staticcheck error:
+// SA1029: should not use built-in type string as key for value; define your own type to avoid collisions (staticcheck)
+// https://stackoverflow.com/questions/40891345/fix-should-not-use-basic-type-string-as-key-in-context-withvalue-golint
+type key int
+
+const contextEndpoint key = 0
+
+func WithEndpoint(endpointService dataservices.EndpointService, endpointIDParam string) mux.MiddlewareFunc {
+	if endpointIDParam == "" {
+		endpointIDParam = "id"
+	}
+
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(rw http.ResponseWriter, request *http.Request) {
+			endpointID, err := requesthelpers.RetrieveNumericRouteVariableValue(request, endpointIDParam)
+			if err != nil {
+				httperror.WriteError(rw, http.StatusBadRequest, "Invalid environment identifier route variable", err)
+				return
+			}
+
+			endpoint, err := endpointService.Endpoint(portainer.EndpointID(endpointID))
+			if err != nil {
+				statusCode := http.StatusInternalServerError
+
+				if dataservices.IsErrObjectNotFound(err) {
+					statusCode = http.StatusNotFound
+				}
+				httperror.WriteError(rw, statusCode, "Unable to find an environment with the specified identifier inside the database", err)
+				return
+			}
+
+			ctx := context.WithValue(request.Context(), contextEndpoint, endpoint)
+
+			next.ServeHTTP(rw, request.WithContext(ctx))
+		})
+	}
+}
+
+func FetchEndpoint(request *http.Request) (*portainer.Endpoint, error) {
+	contextData := request.Context().Value(contextEndpoint)
+	if contextData == nil {
+		return nil, errors.New("Unable to find environment data in request context")
+	}
+
+	return contextData.(*portainer.Endpoint), nil
+}
+
+func CheckEndpointAuthorization(bouncer security.BouncerService) mux.MiddlewareFunc {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			endpoint, err := FetchEndpoint(r)
+			if err != nil {
+				httperror.WriteError(w, http.StatusNotFound, "Unable to find an environment on request context", err)
+				return
+			}
+
+			if err = bouncer.AuthorizedEndpointOperation(r, endpoint); err != nil {
+				httperror.WriteError(w, http.StatusForbidden, "Permission denied to access environment", err)
+				return
+			}
+
+			next.ServeHTTP(w, r)
+		})
+	}
+}
diff --git a/api/http/middlewares/featureflag.go b/api/http/middlewares/featureflag.go
new file mode 100644
index 0000000..7498b11
--- /dev/null
+++ b/api/http/middlewares/featureflag.go
@@ -0,0 +1,26 @@
+package middlewares
+
+import (
+	"net/http"
+
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/pkg/featureflags"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+
+	"github.com/gorilla/mux"
+)
+
+func FeatureFlag(settingsService dataservices.SettingsService, feature featureflags.Feature) mux.MiddlewareFunc {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(rw http.ResponseWriter, request *http.Request) {
+			enabled := featureflags.IsEnabled(feature)
+
+			if !enabled {
+				httperror.WriteError(rw, http.StatusForbidden, "This feature is not enabled", nil)
+				return
+			}
+
+			next.ServeHTTP(rw, request)
+		})
+	}
+}
diff --git a/api/http/middlewares/panic_logger.go b/api/http/middlewares/panic_logger.go
new file mode 100644
index 0000000..6f3b207
--- /dev/null
+++ b/api/http/middlewares/panic_logger.go
@@ -0,0 +1,25 @@
+package middlewares
+
+import (
+	"net/http"
+	"runtime/debug"
+
+	"github.com/rs/zerolog/log"
+)
+
+func WithPanicLogger(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		defer func() {
+			if err := recover(); err != nil {
+				log.Error().
+					Any("panic", err).
+					Str("method", req.Method).
+					Str("url", req.URL.String()).
+					Str("stack", string(debug.Stack())).
+					Msg("Panic in request handler")
+			}
+		}()
+
+		next.ServeHTTP(w, req)
+	})
+}
diff --git a/api/http/middlewares/proxy_headers.go b/api/http/middlewares/proxy_headers.go
new file mode 100644
index 0000000..cd617fa
--- /dev/null
+++ b/api/http/middlewares/proxy_headers.go
@@ -0,0 +1,44 @@
+package middlewares
+
+import (
+	"net/http"
+	"strings"
+)
+
+// parseForwardedHeaderProto parses the Forwarded header and extracts the protocol.
+// The Forwarded header format supports:
+// - Single proxy: Forwarded: by=<identifier>;for=<identifier>;host=<host>;proto=<http|https>
+// - Multiple proxies: Forwarded: for=192.0.2.43, for=198.51.100.17
+// We take the first (leftmost) entry as it represents the original client
+func parseForwardedHeaderProto(forwarded string) string {
+	if forwarded == "" {
+		return ""
+	}
+
+	// Parse the first part (leftmost proxy, closest to original client)
+	firstPart, _, _ := strings.Cut(forwarded, ",")
+	firstPart = strings.TrimSpace(firstPart)
+
+	// Split by semicolon to get key-value pairs within this proxy entry
+	// Format: key=value;key=value;key=value
+	for pair := range strings.SplitSeq(firstPart, ";") {
+		// Split by equals sign to separate key and value
+		key, value, found := strings.Cut(pair, "=")
+		if !found {
+			continue
+		}
+
+		if strings.EqualFold(strings.TrimSpace(key), "proto") {
+			return strings.Trim(strings.TrimSpace(value), `"'`)
+		}
+	}
+
+	return ""
+}
+
+// IsHTTPSRequest checks if the original request was made over HTTPS
+// by examining both X-Forwarded-Proto and Forwarded headers
+func IsHTTPSRequest(r *http.Request) bool {
+	return strings.EqualFold(r.Header.Get("X-Forwarded-Proto"), "https") ||
+		strings.EqualFold(parseForwardedHeaderProto(r.Header.Get("Forwarded")), "https")
+}
diff --git a/api/http/middlewares/proxy_headers_test.go b/api/http/middlewares/proxy_headers_test.go
new file mode 100644
index 0000000..58650ff
--- /dev/null
+++ b/api/http/middlewares/proxy_headers_test.go
@@ -0,0 +1,174 @@
+package middlewares
+
+import (
+	"testing"
+)
+
+var tests = []struct {
+	name      string
+	forwarded string
+	expected  string
+}{
+	{
+		name:      "empty header",
+		forwarded: "",
+		expected:  "",
+	},
+	{
+		name:      "single proxy with proto=https",
+		forwarded: "proto=https",
+		expected:  "https",
+	},
+	{
+		name:      "single proxy with proto=http",
+		forwarded: "proto=http",
+		expected:  "http",
+	},
+	{
+		name:      "single proxy with multiple directives",
+		forwarded: "for=192.0.2.60;proto=https;by=203.0.113.43",
+		expected:  "https",
+	},
+	{
+		name:      "single proxy with proto in middle",
+		forwarded: "for=192.0.2.60;proto=https;host=example.com",
+		expected:  "https",
+	},
+	{
+		name:      "single proxy with proto at end",
+		forwarded: "for=192.0.2.60;host=example.com;proto=https",
+		expected:  "https",
+	},
+	{
+		name:      "multiple proxies - takes first",
+		forwarded: "proto=https, proto=http",
+		expected:  "https",
+	},
+	{
+		name:      "multiple proxies with complex format",
+		forwarded: "for=192.0.2.43;proto=https, for=198.51.100.17;proto=http",
+		expected:  "https",
+	},
+	{
+		name:      "multiple proxies with for directive only",
+		forwarded: "for=192.0.2.43, for=198.51.100.17",
+		expected:  "",
+	},
+	{
+		name:      "multiple proxies with proto only in second",
+		forwarded: "for=192.0.2.43, proto=https",
+		expected:  "",
+	},
+	{
+		name:      "multiple proxies with proto only in first",
+		forwarded: "proto=https, for=198.51.100.17",
+		expected:  "https",
+	},
+	{
+		name:      "quoted protocol value",
+		forwarded: "proto=\"https\"",
+		expected:  "https",
+	},
+	{
+		name:      "single quoted protocol value",
+		forwarded: "proto='https'",
+		expected:  "https",
+	},
+	{
+		name:      "mixed case protocol",
+		forwarded: "proto=HTTPS",
+		expected:  "HTTPS",
+	},
+	{
+		name:      "no proto directive",
+		forwarded: "for=192.0.2.60;by=203.0.113.43",
+		expected:  "",
+	},
+	{
+		name:      "empty proto value",
+		forwarded: "proto=",
+		expected:  "",
+	},
+	{
+		name:      "whitespace around values",
+		forwarded: " proto = https ",
+		expected:  "https",
+	},
+	{
+		name:      "whitespace around semicolons",
+		forwarded: "for=192.0.2.60 ; proto=https ; by=203.0.113.43",
+		expected:  "https",
+	},
+	{
+		name:      "whitespace around commas",
+		forwarded: "proto=https , proto=http",
+		expected:  "https",
+	},
+	{
+		name:      "IPv6 address in for directive",
+		forwarded: "for=\"[2001:db8:cafe::17]:4711\";proto=https",
+		expected:  "https",
+	},
+	{
+		name:      "complex multiple proxies with IPv6",
+		forwarded: "for=192.0.2.43;proto=https, for=\"[2001:db8:cafe::17]\";proto=http",
+		expected:  "https",
+	},
+	{
+		name:      "obfuscated identifiers",
+		forwarded: "for=_mdn;proto=https",
+		expected:  "https",
+	},
+	{
+		name:      "unknown identifier",
+		forwarded: "for=unknown;proto=https",
+		expected:  "https",
+	},
+	{
+		name:      "malformed key-value pair",
+		forwarded: "proto",
+		expected:  "",
+	},
+	{
+		name:      "malformed key-value pair with equals",
+		forwarded: "proto=",
+		expected:  "",
+	},
+	{
+		name:      "multiple equals signs",
+		forwarded: "proto=https=extra",
+		expected:  "https=extra",
+	},
+	{
+		name:      "mixed case directive name",
+		forwarded: "PROTO=https",
+		expected:  "https",
+	},
+	{
+		name:      "mixed case directive name with spaces",
+		forwarded: " Proto = https ",
+		expected:  "https",
+	},
+}
+
+func TestParseForwardedHeaderProto(t *testing.T) {
+	t.Parallel()
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := parseForwardedHeaderProto(tt.forwarded)
+			if result != tt.expected {
+				t.Errorf("parseForwardedHeader(%q) = %q, want %q", tt.forwarded, result, tt.expected)
+			}
+		})
+	}
+}
+
+func FuzzParseForwardedHeaderProto(f *testing.F) {
+	for _, t := range tests {
+		f.Add(t.forwarded)
+	}
+
+	f.Fuzz(func(t *testing.T, forwarded string) {
+		parseForwardedHeaderProto(forwarded)
+	})
+}
diff --git a/api/http/middlewares/slow_request_logger.go b/api/http/middlewares/slow_request_logger.go
new file mode 100644
index 0000000..4bc2ae3
--- /dev/null
+++ b/api/http/middlewares/slow_request_logger.go
@@ -0,0 +1,36 @@
+package middlewares
+
+import (
+	"net/http"
+	"time"
+
+	"github.com/rs/zerolog"
+	"github.com/rs/zerolog/log"
+)
+
+func WithSlowRequestsLogger(next http.Handler) http.Handler {
+	if zerolog.GlobalLevel() > zerolog.DebugLevel {
+		return next
+	}
+
+	burstSampler := &zerolog.BurstSampler{
+		Burst:  1,
+		Period: time.Minute,
+	}
+
+	log := log.With().Logger().Sample(burstSampler)
+
+	return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		t0 := time.Now()
+
+		next.ServeHTTP(w, req)
+
+		if d := time.Since(t0); d > 100*time.Millisecond {
+			log.Debug().
+				Dur("elapsed_ms", d).
+				Str("method", req.Method).
+				Str("url", req.URL.String()).
+				Msg("slow request")
+		}
+	})
+}
diff --git a/api/http/middlewares/withitem.go b/api/http/middlewares/withitem.go
new file mode 100644
index 0000000..fce95e8
--- /dev/null
+++ b/api/http/middlewares/withitem.go
@@ -0,0 +1,60 @@
+package middlewares
+
+import (
+	"context"
+	"errors"
+	"net/http"
+
+	"github.com/portainer/portainer/api/dataservices"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/request"
+
+	"github.com/gorilla/mux"
+)
+
+type ItemContextKey string
+
+type ItemGetter[TId ~int, TObject any] func(id TId) (*TObject, error)
+
+func WithItem[TId ~int, TObject any](getter ItemGetter[TId, TObject], idParam string, contextKey ItemContextKey) mux.MiddlewareFunc {
+	if idParam == "" {
+		idParam = "id"
+	}
+
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+			itemId, err := request.RetrieveNumericRouteVariableValue(req, idParam)
+			if err != nil {
+				httperror.WriteError(rw, http.StatusBadRequest, "Invalid  identifier route variable", err)
+				return
+			}
+
+			item, err := getter(TId(itemId))
+			if err != nil {
+				statusCode := http.StatusInternalServerError
+				if dataservices.IsErrObjectNotFound(err) {
+					statusCode = http.StatusNotFound
+				}
+				httperror.WriteError(rw, statusCode, "Unable to find a object with the specified identifier inside the database", err)
+
+				return
+			}
+			ctx := context.WithValue(req.Context(), contextKey, item)
+			next.ServeHTTP(rw, req.WithContext(ctx))
+		})
+	}
+}
+
+func FetchItem[T any](request *http.Request, contextKey ItemContextKey) (*T, error) {
+	contextData := request.Context().Value(contextKey)
+	if contextData == nil {
+		return nil, errors.New("unable to find item in request context")
+	}
+
+	item, ok := contextData.(*T)
+	if !ok {
+		return nil, errors.New("unable to cast context item")
+	}
+
+	return item, nil
+}
diff --git a/api/http/models/kubernetes/application.go b/api/http/models/kubernetes/application.go
new file mode 100644
index 0000000..231f6b5
--- /dev/null
+++ b/api/http/models/kubernetes/application.go
@@ -0,0 +1,100 @@
+package kubernetes
+
+import (
+	"time"
+
+	autoscalingv2 "k8s.io/api/autoscaling/v2"
+	corev1 "k8s.io/api/core/v1"
+)
+
+type K8sApplication struct {
+	ID                      string                                 `json:"Id"`
+	Name                    string                                 `json:"Name"`
+	Image                   string                                 `json:"Image"`
+	Containers              []any                                  `json:"Containers,omitempty"`
+	Services                []corev1.Service                       `json:"Services" swaggerignore:"true"`
+	CreationDate            time.Time                              `json:"CreationDate"`
+	ApplicationOwner        string                                 `json:"ApplicationOwner,omitempty"`
+	StackName               string                                 `json:"StackName,omitempty"`
+	ResourcePool            string                                 `json:"ResourcePool"`
+	ApplicationType         string                                 `json:"ApplicationType"`
+	Metadata                *Metadata                              `json:"Metadata,omitempty"`
+	Status                  string                                 `json:"Status"`
+	TotalPodsCount          int                                    `json:"TotalPodsCount"`
+	RunningPodsCount        int                                    `json:"RunningPodsCount"`
+	DeploymentType          string                                 `json:"DeploymentType"`
+	Pods                    []Pod                                  `json:"Pods,omitempty"`
+	Configurations          []Configuration                        `json:"Configurations,omitempty"`
+	LoadBalancerIPAddress   string                                 `json:"LoadBalancerIPAddress,omitempty"`
+	PublishedPorts          []PublishedPort                        `json:"PublishedPorts,omitempty"`
+	Namespace               string                                 `json:"Namespace,omitempty"`
+	UID                     string                                 `json:"Uid,omitempty"`
+	StackID                 string                                 `json:"StackId,omitempty"`
+	ServiceID               string                                 `json:"ServiceId,omitempty"`
+	ServiceName             string                                 `json:"ServiceName,omitempty"`
+	ServiceType             string                                 `json:"ServiceType,omitempty"`
+	Kind                    string                                 `json:"Kind,omitempty"`
+	MatchLabels             map[string]string                      `json:"MatchLabels,omitempty"`
+	Labels                  map[string]string                      `json:"Labels,omitempty"`
+	Annotations             map[string]string                      `json:"Annotations,omitempty"`
+	Resource                K8sApplicationResource                 `json:"Resource,omitzero"`
+	HorizontalPodAutoscaler *autoscalingv2.HorizontalPodAutoscaler `json:"HorizontalPodAutoscaler,omitempty" swaggerignore:"true"`
+	CustomResourceMetadata  CustomResourceMetadata                 `json:"CustomResourceMetadata,omitzero"`
+	StackKind               string                                 `json:"StackKind,omitempty"`
+}
+
+type Metadata struct {
+	Labels      map[string]string `json:"labels"`
+	Annotations map[string]string `json:"annotations"`
+}
+
+type CustomResourceMetadata struct {
+	Name       string `json:"name"`
+	Kind       string `json:"kind"`
+	Scope      string `json:"scope"`
+	APIVersion string `json:"apiVersion"`
+	Plural     string `json:"plural"`
+}
+
+type Pod struct {
+	Name            string                 `json:"Name"`
+	ContainerName   string                 `json:"ContainerName"`
+	Image           string                 `json:"Image"`
+	ImagePullPolicy string                 `json:"ImagePullPolicy"`
+	Status          string                 `json:"Status"`
+	NodeName        string                 `json:"NodeName"`
+	PodIP           string                 `json:"PodIP"`
+	UID             string                 `json:"Uid"`
+	Resource        K8sApplicationResource `json:"Resource,omitzero"`
+	CreationDate    time.Time              `json:"CreationDate"`
+}
+
+type Configuration struct {
+	Data               map[string]any `json:"Data,omitempty"`
+	Kind               string         `json:"Kind"`
+	ConfigurationOwner string         `json:"ConfigurationOwner"`
+}
+
+type PublishedPort struct {
+	IngressRules []IngressRule `json:"IngressRules"`
+	Port         int           `json:"Port"`
+}
+
+type IngressRule struct {
+	Host string    `json:"Host"`
+	IP   string    `json:"IP"`
+	Path string    `json:"Path"`
+	TLS  []TLSInfo `json:"TLS"`
+}
+
+type TLSInfo struct {
+	Hosts []string `json:"hosts"`
+}
+
+// Existing types
+type K8sApplicationResource struct {
+	CPURequest    float64 `json:"CpuRequest,omitempty"`
+	CPULimit      float64 `json:"CpuLimit,omitempty"`
+	MemoryRequest int64   `json:"MemoryRequest,omitempty"`
+	MemoryLimit   int64   `json:"MemoryLimit,omitempty"`
+}
diff --git a/api/http/models/kubernetes/cluster_role_bindings.go b/api/http/models/kubernetes/cluster_role_bindings.go
new file mode 100644
index 0000000..5469739
--- /dev/null
+++ b/api/http/models/kubernetes/cluster_role_bindings.go
@@ -0,0 +1,33 @@
+package kubernetes
+
+import (
+	"errors"
+	"net/http"
+	"time"
+
+	rbacv1 "k8s.io/api/rbac/v1"
+	"k8s.io/apimachinery/pkg/types"
+)
+
+type (
+	K8sClusterRoleBinding struct {
+		Name         string           `json:"name"`
+		UID          types.UID        `json:"uid"`
+		Namespace    string           `json:"namespace"`
+		RoleRef      rbacv1.RoleRef   `json:"roleRef"`
+		Subjects     []rbacv1.Subject `json:"subjects"`
+		CreationDate time.Time        `json:"creationDate"`
+		IsSystem     bool             `json:"isSystem"`
+	}
+
+	// K8sRoleBindingDeleteRequests slice of cluster role cluster bindings.
+	K8sClusterRoleBindingDeleteRequests []string
+)
+
+func (r K8sClusterRoleBindingDeleteRequests) Validate(request *http.Request) error {
+	if len(r) == 0 {
+		return errors.New("missing deletion request list in payload")
+	}
+
+	return nil
+}
diff --git a/api/http/models/kubernetes/cluster_roles.go b/api/http/models/kubernetes/cluster_roles.go
new file mode 100644
index 0000000..a42b194
--- /dev/null
+++ b/api/http/models/kubernetes/cluster_roles.go
@@ -0,0 +1,28 @@
+package kubernetes
+
+import (
+	"errors"
+	"net/http"
+	"time"
+
+	"k8s.io/apimachinery/pkg/types"
+)
+
+type (
+	K8sClusterRole struct {
+		Name         string    `json:"name"`
+		UID          types.UID `json:"uid"`
+		CreationDate time.Time `json:"creationDate"`
+		IsSystem     bool      `json:"isSystem"`
+	}
+
+	K8sClusterRoleDeleteRequests []string
+)
+
+func (r K8sClusterRoleDeleteRequests) Validate(request *http.Request) error {
+	if len(r) == 0 {
+		return errors.New("missing deletion request list in payload")
+	}
+
+	return nil
+}
diff --git a/api/http/models/kubernetes/configuration.go b/api/http/models/kubernetes/configuration.go
new file mode 100644
index 0000000..2cdbd8f
--- /dev/null
+++ b/api/http/models/kubernetes/configuration.go
@@ -0,0 +1,32 @@
+package kubernetes
+
+type (
+	K8sConfigMap struct {
+		K8sConfiguration
+	}
+
+	K8sSecret struct {
+		K8sConfiguration
+		SecretType string `json:"SecretType"`
+	}
+
+	K8sConfiguration struct {
+		UID                         string                          `json:"UID"`
+		Name                        string                          `json:"Name"`
+		Namespace                   string                          `json:"Namespace"`
+		CreationDate                string                          `json:"CreationDate"`
+		Annotations                 map[string]string               `json:"Annotations"`
+		Data                        map[string]string               `json:"Data"`
+		IsUsed                      bool                            `json:"IsUsed"`
+		Labels                      map[string]string               `json:"Labels"`
+		ConfigurationOwnerResources []K8sConfigurationOwnerResource `json:"ConfigurationOwners"`
+		ConfigurationOwner          string                          `json:"ConfigurationOwner"`
+		ConfigurationOwnerId        string                          `json:"ConfigurationOwnerId"`
+	}
+
+	K8sConfigurationOwnerResource struct {
+		Id           string `json:"Id"`
+		Name         string `json:"Name"`
+		ResourceKind string `json:"ResourceKind"`
+	}
+)
diff --git a/api/http/models/kubernetes/cron_jobs.go b/api/http/models/kubernetes/cron_jobs.go
new file mode 100644
index 0000000..3923e1a
--- /dev/null
+++ b/api/http/models/kubernetes/cron_jobs.go
@@ -0,0 +1,36 @@
+package kubernetes
+
+import (
+	"errors"
+	"net/http"
+)
+
+type K8sCronJob struct {
+	Id        string   `json:"Id"`
+	Name      string   `json:"Name"`
+	Namespace string   `json:"Namespace"`
+	Command   string   `json:"Command"`
+	Schedule  string   `json:"Schedule"`
+	Timezone  string   `json:"Timezone"`
+	Suspend   bool     `json:"Suspend"`
+	Jobs      []K8sJob `json:"Jobs"`
+	IsSystem  bool     `json:"IsSystem"`
+}
+
+type (
+	K8sCronJobDeleteRequests map[string][]string
+)
+
+func (r K8sCronJobDeleteRequests) Validate(request *http.Request) error {
+	if len(r) == 0 {
+		return errors.New("missing deletion request list in payload")
+	}
+
+	for ns := range r {
+		if len(ns) == 0 {
+			return errors.New("deletion given with empty namespace")
+		}
+	}
+
+	return nil
+}
diff --git a/api/http/models/kubernetes/dashboard.go b/api/http/models/kubernetes/dashboard.go
new file mode 100644
index 0000000..544bac2
--- /dev/null
+++ b/api/http/models/kubernetes/dashboard.go
@@ -0,0 +1,13 @@
+package kubernetes
+
+type (
+	K8sDashboard struct {
+		NamespacesCount   int64 `json:"namespacesCount"`
+		ApplicationsCount int64 `json:"applicationsCount"`
+		ServicesCount     int64 `json:"servicesCount"`
+		IngressesCount    int64 `json:"ingressesCount"`
+		ConfigMapsCount   int64 `json:"configMapsCount"`
+		SecretsCount      int64 `json:"secretsCount"`
+		VolumesCount      int64 `json:"volumesCount"`
+	}
+)
diff --git a/api/http/models/kubernetes/event.go b/api/http/models/kubernetes/event.go
new file mode 100644
index 0000000..be447b5
--- /dev/null
+++ b/api/http/models/kubernetes/event.go
@@ -0,0 +1,25 @@
+package kubernetes
+
+import "time"
+
+type K8sEvent struct {
+	Type               string                 `json:"type"`
+	Name               string                 `json:"name"`
+	Reason             string                 `json:"reason"`
+	Message            string                 `json:"message"`
+	Namespace          string                 `json:"namespace"`
+	EventTime          time.Time              `json:"eventTime"`
+	Kind               string                 `json:"kind,omitempty"`
+	Count              int32                  `json:"count"`
+	FirstTimestamp     *time.Time             `json:"firstTimestamp,omitempty"`
+	LastTimestamp      *time.Time             `json:"lastTimestamp,omitempty"`
+	UID                string                 `json:"uid"`
+	InvolvedObjectKind K8sEventInvolvedObject `json:"involvedObject"`
+}
+
+type K8sEventInvolvedObject struct {
+	Kind      string `json:"kind,omitempty"`
+	UID       string `json:"uid"`
+	Name      string `json:"name"`
+	Namespace string `json:"namespace"`
+}
diff --git a/api/http/models/kubernetes/ingress.go b/api/http/models/kubernetes/ingress.go
new file mode 100644
index 0000000..f8e900e
--- /dev/null
+++ b/api/http/models/kubernetes/ingress.go
@@ -0,0 +1,83 @@
+package kubernetes
+
+import (
+	"errors"
+	"net/http"
+	"time"
+)
+
+type (
+	K8sIngressController struct {
+		Name         string `json:"Name"`
+		ClassName    string `json:"ClassName"`
+		Type         string `json:"Type"`
+		Availability bool   `json:"Availability"`
+		New          bool   `json:"New"`
+		Used         bool   `json:"Used"`
+	}
+
+	K8sIngressControllers []K8sIngressController
+
+	K8sIngressInfo struct {
+		Name         string            `json:"Name"`
+		UID          string            `json:"UID"`
+		Type         string            `json:"Type"`
+		Namespace    string            `json:"Namespace"`
+		ClassName    string            `json:"ClassName"`
+		Annotations  map[string]string `json:"Annotations"`
+		Hosts        []string          `json:"Hosts"`
+		Paths        []K8sIngressPath  `json:"Paths"`
+		TLS          []K8sIngressTLS   `json:"TLS"`
+		Labels       map[string]string `json:"Labels,omitempty"`
+		CreationDate time.Time         `json:"CreationDate"`
+	}
+
+	K8sIngressTLS struct {
+		Hosts      []string `json:"Hosts"`
+		SecretName string   `json:"SecretName"`
+	}
+
+	K8sIngressPath struct {
+		IngressName string `json:"IngressName"`
+		Host        string `json:"Host"`
+		ServiceName string `json:"ServiceName"`
+		Port        int    `json:"Port"`
+		Path        string `json:"Path"`
+		PathType    string `json:"PathType"`
+		HasService  bool   `json:"HasService"`
+	}
+
+	// K8sIngressDeleteRequests is a mapping of namespace names to a slice of
+	// ingress names.
+	K8sIngressDeleteRequests map[string][]string
+)
+
+func (r K8sIngressControllers) Validate(request *http.Request) error {
+	return nil
+}
+
+func (r K8sIngressInfo) Validate(request *http.Request) error {
+	if r.Name == "" {
+		return errors.New("missing ingress name from the request payload")
+	}
+
+	if r.Namespace == "" {
+		return errors.New("missing ingress Namespace from the request payload")
+	}
+
+	return nil
+}
+
+func (r K8sIngressDeleteRequests) Validate(request *http.Request) error {
+	if len(r) == 0 {
+		return errors.New("missing deletion request list in payload")
+	}
+
+	for ns := range r {
+		if len(ns) == 0 {
+			return errors.New("deletion given with empty namespace")
+		}
+	}
+
+	return nil
+}
diff --git a/api/http/models/kubernetes/jobs.go b/api/http/models/kubernetes/jobs.go
new file mode 100644
index 0000000..04bed09
--- /dev/null
+++ b/api/http/models/kubernetes/jobs.go
@@ -0,0 +1,44 @@
+package kubernetes
+
+import (
+	"errors"
+	"net/http"
+
+	corev1 "k8s.io/api/core/v1"
+)
+
+// K8sJob struct
+type K8sJob struct {
+	ID           string           `json:"Id"`
+	Namespace    string           `json:"Namespace"`
+	Name         string           `json:"Name"`
+	PodName      string           `json:"PodName"`
+	Container    corev1.Container `json:"Container,omitzero"`
+	Command      string           `json:"Command,omitempty"`
+	BackoffLimit int32            `json:"BackoffLimit,omitempty"`
+	Completions  int32            `json:"Completions,omitempty"`
+	StartTime    string           `json:"StartTime"`
+	FinishTime   string           `json:"FinishTime"`
+	Duration     string           `json:"Duration"`
+	Status       string           `json:"Status"`
+	FailedReason string           `json:"FailedReason"`
+	IsSystem     bool             `json:"IsSystem"`
+}
+
+type (
+	K8sJobDeleteRequests map[string][]string
+)
+
+func (r K8sJobDeleteRequests) Validate(request *http.Request) error {
+	if len(r) == 0 {
+		return errors.New("missing deletion request list in payload")
+	}
+
+	for ns := range r {
+		if len(ns) == 0 {
+			return errors.New("deletion given with empty namespace")
+		}
+	}
+
+	return nil
+}
diff --git a/api/http/models/kubernetes/metrics.go b/api/http/models/kubernetes/metrics.go
new file mode 100644
index 0000000..5d095cf
--- /dev/null
+++ b/api/http/models/kubernetes/metrics.go
@@ -0,0 +1,13 @@
+package kubernetes
+
+type K8sMetrics struct {
+	Resources []K8sMetricsResources `json:"resources"`
+}
+
+type K8sMetricsResources struct {
+	Kind         string   `json:"Kind,omitempty"`
+	Name         string   `json:"Name,omitempty"`
+	Namespaced   bool     `json:"Namespaced,omitempty"`
+	SingularName string   `json:"SingularName,omitempty"`
+	Verbs        []string `json:"Verbs,omitempty"`
+}
diff --git a/api/http/models/kubernetes/namespaces.go b/api/http/models/kubernetes/namespaces.go
new file mode 100644
index 0000000..355d6f3
--- /dev/null
+++ b/api/http/models/kubernetes/namespaces.go
@@ -0,0 +1,35 @@
+package kubernetes
+
+import (
+	"fmt"
+	"net/http"
+
+	"k8s.io/apimachinery/pkg/api/resource"
+)
+
+type K8sNamespaceDetails struct {
+	Name          string            `json:"Name"`
+	Annotations   map[string]string `json:"Annotations"`
+	ResourceQuota *K8sResourceQuota `json:"ResourceQuota"`
+	Owner         string            `json:"Owner"`
+}
+
+type K8sResourceQuota struct {
+	Enabled bool   `json:"enabled"`
+	Memory  string `json:"memory"`
+	CPU     string `json:"cpu"`
+}
+
+func (r *K8sNamespaceDetails) Validate(request *http.Request) error {
+	if r.ResourceQuota != nil && r.ResourceQuota.Enabled {
+		if _, err := resource.ParseQuantity(r.ResourceQuota.Memory); err != nil {
+			return fmt.Errorf("error parsing memory quota value: %w", err)
+		}
+
+		if _, err := resource.ParseQuantity(r.ResourceQuota.CPU); err != nil {
+			return fmt.Errorf("error parsing cpu quota value: %w", err)
+		}
+	}
+
+	return nil
+}
diff --git a/api/http/models/kubernetes/role_bindings.go b/api/http/models/kubernetes/role_bindings.go
new file mode 100644
index 0000000..2078244
--- /dev/null
+++ b/api/http/models/kubernetes/role_bindings.go
@@ -0,0 +1,38 @@
+package kubernetes
+
+import (
+	"errors"
+	"net/http"
+	"time"
+
+	rbacv1 "k8s.io/api/rbac/v1"
+	"k8s.io/apimachinery/pkg/types"
+)
+
+type (
+	K8sRoleBinding struct {
+		Name         string           `json:"name"`
+		UID          types.UID        `json:"uid"`
+		Namespace    string           `json:"namespace"`
+		RoleRef      rbacv1.RoleRef   `json:"roleRef"`
+		Subjects     []rbacv1.Subject `json:"subjects"`
+		CreationDate time.Time        `json:"creationDate"`
+		IsSystem     bool             `json:"isSystem"`
+	}
+
+	// K8sRoleBindingDeleteRequests is a mapping of namespace names to a slice of role bindings.
+	K8sRoleBindingDeleteRequests map[string][]string
+)
+
+func (r K8sRoleBindingDeleteRequests) Validate(request *http.Request) error {
+	if len(r) == 0 {
+		return errors.New("missing deletion request list in payload")
+	}
+
+	for ns := range r {
+		if len(ns) == 0 {
+			return errors.New("deletion given with empty namespace")
+		}
+	}
+	return nil
+}
diff --git a/api/http/models/kubernetes/roles.go b/api/http/models/kubernetes/roles.go
new file mode 100644
index 0000000..aba205b
--- /dev/null
+++ b/api/http/models/kubernetes/roles.go
@@ -0,0 +1,36 @@
+package kubernetes
+
+import (
+	"errors"
+	"net/http"
+	"time"
+
+	"k8s.io/apimachinery/pkg/types"
+)
+
+type (
+	K8sRole struct {
+		Name         string    `json:"name"`
+		UID          types.UID `json:"uid"`
+		Namespace    string    `json:"namespace"`
+		CreationDate time.Time `json:"creationDate"`
+		// isSystem is true if prefixed with "system:" or exists in the kube-system namespace
+		// or is one of the portainer roles
+		IsSystem bool `json:"isSystem"`
+	}
+
+	// K8sRoleDeleteRequests is a mapping of namespace names to a slice of roles.
+	K8sRoleDeleteRequests map[string][]string
+)
+
+func (r K8sRoleDeleteRequests) Validate(request *http.Request) error {
+	if len(r) == 0 {
+		return errors.New("missing deletion request list in payload")
+	}
+	for ns := range r {
+		if len(ns) == 0 {
+			return errors.New("deletion given with empty namespace")
+		}
+	}
+	return nil
+}
diff --git a/api/http/models/kubernetes/service_accounts.go b/api/http/models/kubernetes/service_accounts.go
new file mode 100644
index 0000000..527abaf
--- /dev/null
+++ b/api/http/models/kubernetes/service_accounts.go
@@ -0,0 +1,47 @@
+package kubernetes
+
+import (
+	"errors"
+	"net/http"
+	"time"
+
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/types"
+)
+
+type (
+	K8sServiceAccount struct {
+		Name                         string                        `json:"name"`
+		UID                          types.UID                     `json:"uid"`
+		Namespace                    string                        `json:"namespace"`
+		CreationDate                 time.Time                     `json:"creationDate"`
+		IsSystem                     bool                          `json:"isSystem"`
+		ImagePullSecrets             []corev1.LocalObjectReference `json:"imagePullSecrets,omitempty"`
+		AutomountServiceAccountToken *bool                         `json:"automountServiceAccountToken,omitempty"`
+		Labels                       map[string]string             `json:"labels,omitempty"`
+		Annotations                  map[string]string             `json:"annotations,omitempty"`
+	}
+
+	// K8sServiceAcountDeleteRequests is a mapping of namespace names to a slice of service account names.
+	K8sServiceAccountDeleteRequests map[string][]string
+)
+
+type K8sServiceAccountImagePullSecretsUpdatePayload struct {
+	SecretNames []string `json:"secretNames"`
+}
+
+func (r *K8sServiceAccountImagePullSecretsUpdatePayload) Validate(_ *http.Request) error {
+	return nil
+}
+
+func (r K8sServiceAccountDeleteRequests) Validate(request *http.Request) error {
+	if len(r) == 0 {
+		return errors.New("missing deletion request list in payload")
+	}
+	for ns := range r {
+		if len(ns) == 0 {
+			return errors.New("deletion given with empty namespace")
+		}
+	}
+	return nil
+}
diff --git a/api/http/models/kubernetes/service_accounts_test.go b/api/http/models/kubernetes/service_accounts_test.go
new file mode 100644
index 0000000..6e27cca
--- /dev/null
+++ b/api/http/models/kubernetes/service_accounts_test.go
@@ -0,0 +1,125 @@
+package kubernetes
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestK8sServiceAccountDeleteRequests_Validate(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name    string
+		payload K8sServiceAccountDeleteRequests
+		wantErr bool
+		errMsg  string
+	}{
+		{
+			name:    "empty payload returns error",
+			payload: K8sServiceAccountDeleteRequests{},
+			wantErr: true,
+			errMsg:  "missing deletion request list in payload",
+		},
+		{
+			name: "valid single namespace with service accounts",
+			payload: K8sServiceAccountDeleteRequests{
+				"default": {"sa-1", "sa-2"},
+			},
+			wantErr: false,
+		},
+		{
+			name: "valid multiple namespaces",
+			payload: K8sServiceAccountDeleteRequests{
+				"default":     {"sa-1"},
+				"kube-system": {"sa-2"},
+				"custom-ns":   {"sa-3"},
+			},
+			wantErr: false,
+		},
+		{
+			name: "empty namespace key returns error",
+			payload: K8sServiceAccountDeleteRequests{
+				"": {"sa-1"},
+			},
+			wantErr: true,
+			errMsg:  "deletion given with empty namespace",
+		},
+		{
+			name: "valid with empty service account list",
+			payload: K8sServiceAccountDeleteRequests{
+				"default": {},
+			},
+			wantErr: false,
+		},
+		{
+			name: "multiple namespaces with one empty returns error",
+			payload: K8sServiceAccountDeleteRequests{
+				"default": {"sa-1"},
+				"":        {"sa-2"},
+			},
+			wantErr: true,
+			errMsg:  "deletion given with empty namespace",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			req := httptest.NewRequest(http.MethodPost, "/", nil)
+			err := tt.payload.Validate(req)
+
+			if tt.wantErr {
+				require.Error(t, err)
+				assert.Contains(t, err.Error(), tt.errMsg)
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
+
+func TestK8sServiceAccount_Structure(t *testing.T) {
+	t.Parallel()
+	sa := K8sServiceAccount{
+		Name:      "test-sa",
+		Namespace: "default",
+		IsSystem:  false,
+	}
+
+	assert.Equal(t, "test-sa", sa.Name)
+	assert.Equal(t, "default", sa.Namespace)
+	assert.False(t, sa.IsSystem)
+	assert.Nil(t, sa.AutomountServiceAccountToken)
+	assert.Empty(t, sa.Labels)
+	assert.Empty(t, sa.Annotations)
+}
+
+func TestK8sServiceAccount_WithAllFields(t *testing.T) {
+	t.Parallel()
+	automountToken := true
+	sa := K8sServiceAccount{
+		Name:      "full-sa",
+		Namespace: "production",
+		IsSystem:  true,
+		Labels: map[string]string{
+			"app": "web",
+			"env": "prod",
+		},
+		Annotations: map[string]string{
+			"description": "service account for web",
+		},
+		AutomountServiceAccountToken: &automountToken,
+	}
+
+	assert.Equal(t, "full-sa", sa.Name)
+	assert.Equal(t, "production", sa.Namespace)
+	assert.True(t, sa.IsSystem)
+	assert.NotNil(t, sa.AutomountServiceAccountToken)
+	assert.True(t, *sa.AutomountServiceAccountToken)
+	assert.Len(t, sa.Labels, 2)
+	assert.Equal(t, "web", sa.Labels["app"])
+	assert.Len(t, sa.Annotations, 1)
+	assert.Equal(t, "service account for web", sa.Annotations["description"])
+}
diff --git a/api/http/models/kubernetes/services.go b/api/http/models/kubernetes/services.go
new file mode 100644
index 0000000..bcbddf3
--- /dev/null
+++ b/api/http/models/kubernetes/services.go
@@ -0,0 +1,75 @@
+package kubernetes
+
+import (
+	"errors"
+	"net/http"
+)
+
+type (
+	K8sServiceInfo struct {
+		Name                          string              `json:",omitempty"`
+		UID                           string              `json:",omitempty"`
+		Type                          string              `json:",omitempty"`
+		Namespace                     string              `json:",omitempty"`
+		Annotations                   map[string]string   `json:",omitempty"`
+		CreationDate                  string              `json:",omitempty"`
+		Labels                        map[string]string   `json:",omitempty"`
+		AllocateLoadBalancerNodePorts *bool               `json:",omitempty"`
+		Ports                         []K8sServicePort    `json:",omitempty"`
+		Selector                      map[string]string   `json:",omitempty"`
+		IngressStatus                 []K8sServiceIngress `json:",omitempty"`
+
+		// serviceList screen
+		Applications []K8sApplication `json:",omitempty"`
+		ClusterIPs   []string         `json:",omitempty"`
+		ExternalName string           `json:",omitempty"`
+		ExternalIPs  []string         `json:",omitempty"`
+	}
+
+	K8sServicePort struct {
+		Name       string `json:"Name"`
+		NodePort   int    `json:"NodePort"`
+		Port       int    `json:"Port"`
+		Protocol   string `json:"Protocol"`
+		TargetPort string `json:"TargetPort"`
+	}
+
+	K8sServiceIngress struct {
+		IP       string `json:"IP"`
+		Hostname string `json:"Hostname"`
+	}
+
+	// K8sServiceDeleteRequests is a mapping of namespace names to a slice of
+	// service names.
+	K8sServiceDeleteRequests map[string][]string
+)
+
+func (s *K8sServiceInfo) Validate(request *http.Request) error {
+	if s.Name == "" {
+		return errors.New("missing service name from the request payload")
+	}
+
+	if s.Namespace == "" {
+		return errors.New("missing service namespace from the request payload")
+	}
+
+	if s.Ports == nil {
+		return errors.New("missing service ports from the request payload")
+	}
+
+	return nil
+}
+
+func (r K8sServiceDeleteRequests) Validate(request *http.Request) error {
+	if len(r) == 0 {
+		return errors.New("missing deletion request list in payload")
+	}
+
+	for ns := range r {
+		if len(ns) == 0 {
+			return errors.New("deletion given with empty namespace")
+		}
+	}
+
+	return nil
+}
diff --git a/api/http/models/kubernetes/volumes.go b/api/http/models/kubernetes/volumes.go
new file mode 100644
index 0000000..69e9d1a
--- /dev/null
+++ b/api/http/models/kubernetes/volumes.go
@@ -0,0 +1,145 @@
+package kubernetes
+
+import (
+	"errors"
+	"net/http"
+	"time"
+
+	corev1 "k8s.io/api/core/v1"
+)
+
+type (
+	K8sVolumeInfo struct {
+		PersistentVolume      K8sPersistentVolume      `json:"persistentVolume"`
+		PersistentVolumeClaim K8sPersistentVolumeClaim `json:"persistentVolumeClaim"`
+		StorageClass          K8sStorageClass          `json:"storageClass"`
+	}
+
+	K8sPersistentVolume struct {
+		Name                          string                               `json:"name,omitempty"`
+		Annotations                   map[string]string                    `json:"annotations,omitempty"`
+		Labels                        map[string]string                    `json:"labels,omitempty"`
+		AccessModes                   []string                             `json:"accessModes,omitempty"`
+		HumanReadableAccessModes      []corev1.PersistentVolumeAccessMode  `json:"humanReadableAccessModes,omitempty"`
+		Capacity                      corev1.ResourceList                  `json:"capacity"`
+		ClaimRef                      *corev1.ObjectReference              `json:"claimRef"`
+		StorageClassName              string                               `json:"storageClassName,omitempty"`
+		PersistentVolumeReclaimPolicy corev1.PersistentVolumeReclaimPolicy `json:"persistentVolumeReclaimPolicy"`
+		VolumeMode                    *corev1.PersistentVolumeMode         `json:"volumeMode"`
+		CSI                           *corev1.CSIPersistentVolumeSource    `json:"csi,omitempty"`
+		Status                        corev1.PersistentVolumePhase         `json:"status"`
+		CreationDate                  time.Time                            `json:"creationDate"`
+	}
+
+	K8sPersistentVolumeClaim struct {
+		ID                       string                              `json:"id"`
+		Name                     string                              `json:"name"`
+		Namespace                string                              `json:"namespace"`
+		Storage                  int64                               `json:"storage"`
+		StorageRequest           string                              `json:"storageRequest"`
+		CreationDate             time.Time                           `json:"creationDate"`
+		AccessModes              []string                            `json:"accessModes,omitempty"`
+		HumanReadableAccessModes []corev1.PersistentVolumeAccessMode `json:"humanReadableAccessModes,omitempty"`
+		VolumeName               string                              `json:"volumeName"`
+		ResourcesRequests        *corev1.ResourceList                `json:"resourcesRequests"`
+		StorageClass             *string                             `json:"storageClass"`
+		AllowVolumeExpansion     bool                                `json:"allowVolumeExpansion"`
+		VolumeMode               *corev1.PersistentVolumeMode        `json:"volumeMode"`
+		OwningApplications       []K8sApplication                    `json:"owningApplications,omitempty"`
+		Phase                    corev1.PersistentVolumeClaimPhase   `json:"phase"`
+		Labels                   map[string]string                   `json:"labels,omitempty"`
+	}
+
+	K8sStorageClass struct {
+		Name                 string                                `json:"name"`
+		Provisioner          string                                `json:"provisioner"`
+		ReclaimPolicy        *corev1.PersistentVolumeReclaimPolicy `json:"reclaimPolicy"`
+		AllowVolumeExpansion *bool                                 `json:"allowVolumeExpansion"`
+		IsDefault            bool                                  `json:"isDefault"`
+		Annotations          map[string]string                     `json:"annotations,omitempty"`
+		Labels               map[string]string                     `json:"labels,omitempty"`
+		CreationDate         time.Time                             `json:"creationDate"`
+		Parameters           map[string]string                     `json:"parameters,omitempty"`
+		MountOptions         []string                              `json:"mountOptions,omitempty"`
+	}
+
+	// K8sVolumeDeleteRequest represents a request to delete a PVC.
+	K8sVolumeDeleteRequest struct {
+		Namespace string `json:"namespace"`
+		Name      string `json:"name"`
+	}
+
+	// K8sVolumeDeleteRequests is a list of PVC delete requests.
+	K8sVolumeDeleteRequests []K8sVolumeDeleteRequest
+
+	// K8sPVDeleteRequest represents a request to delete PVs.
+	K8sPVDeleteRequest []string
+
+	// K8sStorageClassDeleteRequest represents a request to delete storage classes.
+	K8sStorageClassDeleteRequest []string
+
+	// K8sPVCResizeRequest represents a request to resize a PVC.
+	K8sPVCResizeRequest struct {
+		Namespace string `json:"namespace"`
+		Name      string `json:"name"`
+		NewSize   string `json:"newSize"`
+	}
+
+	// K8sPVReclaimPolicyRequest represents a request to change PV reclaim policy.
+	K8sPVReclaimPolicyRequest struct {
+		Name          string                               `json:"name"`
+		ReclaimPolicy corev1.PersistentVolumeReclaimPolicy `json:"reclaimPolicy"`
+	}
+)
+
+func (r K8sPVDeleteRequest) Validate(_ *http.Request) error {
+	if len(r) == 0 {
+		return errors.New("missing persistent volume names from the request payload")
+	}
+
+	return nil
+}
+
+func (r K8sStorageClassDeleteRequest) Validate(_ *http.Request) error {
+	if len(r) == 0 {
+		return errors.New("missing storage class names from the request payload")
+	}
+
+	return nil
+}
+
+func (r K8sVolumeDeleteRequests) Validate(_ *http.Request) error {
+	if len(r) == 0 {
+		return errors.New("missing PVC delete requests from the request payload")
+	}
+
+	return nil
+}
+
+func (r *K8sPVCResizeRequest) Validate(_ *http.Request) error {
+	if r.Namespace == "" {
+		return errors.New("missing namespace from the request payload")
+	}
+
+	if r.Name == "" {
+		return errors.New("missing PVC name from the request payload")
+	}
+
+	if r.NewSize == "" {
+		return errors.New("missing new size from the request payload")
+	}
+
+	return nil
+}
+
+func (r *K8sPVReclaimPolicyRequest) Validate(_ *http.Request) error {
+	if r.Name == "" {
+		return errors.New("missing persistent volume name from the request payload")
+	}
+
+	if r.ReclaimPolicy == "" {
+		return errors.New("missing reclaim policy from the request payload")
+	}
+
+	return nil
+}
diff --git a/api/http/offlinegate/offlinegate.go b/api/http/offlinegate/offlinegate.go
new file mode 100644
index 0000000..58fb29e
--- /dev/null
+++ b/api/http/offlinegate/offlinegate.go
@@ -0,0 +1,53 @@
+package offlinegate
+
+import (
+	"net/http"
+	"strings"
+	"time"
+
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+
+	"github.com/rs/zerolog/log"
+	lock "github.com/viney-shih/go-lock"
+)
+
+// OfflineGate is an entity that works similar to a mutex with signaling
+// Only the caller that has Locked a gate can unlock it, otherwise it will be blocked with a call to Lock.
+// Gate provides a passthrough http middleware that will wait for a locked gate to be unlocked.
+// For safety reasons, the middleware will timeout
+type OfflineGate struct {
+	lock *lock.CASMutex
+}
+
+// NewOfflineGate creates a new gate
+func NewOfflineGate() *OfflineGate {
+	return &OfflineGate{
+		lock: lock.NewCASMutex(),
+	}
+}
+
+// Lock locks readonly gate and returns a function to unlock
+func (o *OfflineGate) Lock() func() {
+	o.lock.Lock()
+	return o.lock.Unlock
+}
+
+// WaitingMiddleware returns an http handler that waits for the gate to be unlocked before continuing
+func (o *OfflineGate) WaitingMiddleware(timeout time.Duration, next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == "GET" || r.Method == "HEAD" || r.Method == "OPTIONS" || strings.HasPrefix(r.URL.Path, "/api/backup") || strings.HasPrefix(r.URL.Path, "/api/restore") {
+			next.ServeHTTP(w, r)
+			return
+		}
+
+		if !o.lock.RTryLockWithTimeout(timeout) {
+			log.Error().Str("url", r.URL.Path).Msg("request timed out while waiting for the backup process to finish")
+			httperror.WriteError(w, http.StatusRequestTimeout, "Request timed out while waiting for the backup process to finish", http.ErrHandlerTimeout)
+			return
+		}
+
+		defer o.lock.RUnlock()
+
+		next.ServeHTTP(w, r)
+	})
+}
diff --git a/api/http/offlinegate/offlinegate_test.go b/api/http/offlinegate/offlinegate_test.go
new file mode 100644
index 0000000..daf7b05
--- /dev/null
+++ b/api/http/offlinegate/offlinegate_test.go
@@ -0,0 +1,190 @@
+package offlinegate
+
+import (
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"sync"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/rs/zerolog/log"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_canLockAndUnlock(t *testing.T) {
+	t.Parallel()
+	o := NewOfflineGate()
+
+	unlock := o.Lock()
+	unlock()
+}
+
+func Test_hasToBeUnlockedToLockAgain(t *testing.T) {
+	t.Parallel()
+	// scenario:
+	// 1. first routine starts and locks the gate
+	// 2. first routine starts a second and wait for the second to start
+	// 3. second start but waits for the gate to be released
+	// 4. first continues and unlocks the gate, when done
+	// 5. second be able to continue
+	// 6. second lock the gate, does the job and unlocks it
+
+	o := NewOfflineGate()
+
+	wg := sync.WaitGroup{}
+	wg.Add(2)
+
+	result := make([]string, 0, 2)
+	go func() {
+		unlock := o.Lock()
+		defer unlock()
+		waitForSecondToStart := sync.WaitGroup{}
+		waitForSecondToStart.Add(1)
+		go func() {
+			waitForSecondToStart.Done()
+			unlock := o.Lock()
+			defer unlock()
+			result = append(result, "second")
+			wg.Done()
+		}()
+		waitForSecondToStart.Wait()
+		result = append(result, "first")
+		wg.Done()
+	}()
+
+	wg.Wait()
+
+	if len(result) != 2 || result[0] != "first" || result[1] != "second" {
+		t.Error("Second call have disresregarded a raised lock")
+	}
+
+}
+
+func Test_waitingMiddleware_executesImmediately_whenNotLocked(t *testing.T) {
+	t.Parallel()
+	// scenario:
+	// 1. create an gate
+	// 2. kick off a waiting middleware that will release immediately as gate wasn't locked
+	// 3. middleware shouldn't timeout
+
+	o := NewOfflineGate()
+
+	request := httptest.NewRequest(http.MethodPost, "/", nil)
+	response := httptest.NewRecorder()
+
+	timeout := 2 * time.Second
+	start := time.Now()
+
+	o.WaitingMiddleware(timeout, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		elapsed := time.Since(start)
+		if elapsed >= timeout {
+			t.Error("WaitingMiddleware had likely timeout, when it shouldn't")
+		}
+		_, _ = w.Write([]byte("success"))
+	})).ServeHTTP(response, request)
+
+	body, _ := io.ReadAll(response.Body)
+	if string(body) != "success" {
+		t.Error("Didn't receive expected result from the handler")
+	}
+}
+
+func Test_waitingMiddleware_waitsForTheLockToBeReleased(t *testing.T) {
+	t.Parallel()
+	synctest.Test(t, test_waitingMiddleware_waitsForTheLockToBeReleased)
+}
+
+func test_waitingMiddleware_waitsForTheLockToBeReleased(t *testing.T) {
+	// scenario:
+	// 1. create an gate and lock it
+	// 2. kick off a routing that will unlock the gate after 1 second
+	// 3. kick off a waiting middleware that will wait for lock to be eventually released
+	// 4. middleware shouldn't timeout
+
+	o := NewOfflineGate()
+	unlock := o.Lock()
+
+	request := httptest.NewRequest(http.MethodPost, "/", nil)
+	response := httptest.NewRecorder()
+
+	go func() {
+		time.Sleep(1 * time.Second)
+		unlock()
+	}()
+
+	timeout := 10 * time.Second
+	start := time.Now()
+
+	o.WaitingMiddleware(timeout, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		elapsed := time.Since(start)
+		if elapsed >= timeout {
+			t.Error("WaitingMiddleware had likely timeout, when it shouldn't")
+		}
+		_, _ = w.Write([]byte("success"))
+	})).ServeHTTP(response, request)
+
+	body, _ := io.ReadAll(response.Body)
+	if string(body) != "success" {
+		t.Error("Didn't receive expected result from the handler")
+	}
+}
+
+func Test_waitingMiddleware_mayTimeout_whenLockedForTooLong(t *testing.T) {
+	t.Parallel()
+	/*
+		scenario:
+		1. create an gate and lock it
+		2. kick off a waiting middleware that will wait for lock to be eventually released
+		3. because we never unlocked the gate, middleware suppose to timeout
+	*/
+	o := NewOfflineGate()
+	o.Lock()
+
+	request := httptest.NewRequest(http.MethodPost, "/", nil)
+	response := httptest.NewRecorder()
+
+	timeout := 1 * time.Second
+	start := time.Now()
+	o.WaitingMiddleware(timeout, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		elapsed := time.Since(start)
+		if elapsed < timeout {
+			t.Error("WaitingMiddleware suppose to timeout, but it didnt")
+		}
+		_, _ = w.Write([]byte("success"))
+	})).ServeHTTP(response, request)
+
+	assert.Equal(t, http.StatusRequestTimeout, response.Result().StatusCode, "Request support to timeout waiting for the gate")
+}
+
+func Test_waitingMiddleware_handlerPanics(t *testing.T) {
+	t.Parallel()
+	o := NewOfflineGate()
+
+	request := httptest.NewRequest(http.MethodPost, "/", nil)
+	response := httptest.NewRecorder()
+
+	wg := sync.WaitGroup{}
+	wg.Add(1)
+
+	go func() {
+		defer func() {
+			if r := recover(); r != nil {
+				log.Warn().Msgf("Recovered in test: %v", r)
+			}
+
+			wg.Done()
+		}()
+
+		o.WaitingMiddleware(time.Second, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			panic("panic")
+		})).ServeHTTP(response, request)
+	}()
+
+	wg.Wait()
+
+	require.True(t, o.lock.TryLock())
+	o.lock.Unlock()
+}
diff --git a/api/http/proxy/factory/agent.go b/api/http/proxy/factory/agent.go
new file mode 100644
index 0000000..46e0033
--- /dev/null
+++ b/api/http/proxy/factory/agent.go
@@ -0,0 +1,114 @@
+package factory
+
+import (
+	"fmt"
+	"net"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/crypto"
+	"github.com/portainer/portainer/api/http/proxy/factory/agent"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+	"github.com/portainer/portainer/api/url"
+	"github.com/portainer/portainer/pkg/libhttp/ssrf"
+
+	"github.com/pkg/errors"
+	"github.com/rs/zerolog/log"
+)
+
+// ProxyServer provide an extended proxy with a local server to forward requests
+type ProxyServer struct {
+	server *http.Server
+	Port   int
+}
+
+// NewAgentProxy creates a new instance of ProxyServer that wrap http requests with agent headers
+func (factory *ProxyFactory) NewAgentProxy(endpoint *portainer.Endpoint) (*ProxyServer, error) {
+	urlString := endpoint.URL
+
+	if endpointutils.IsEdgeEndpoint(endpoint) {
+		tunnelAddr, err := factory.reverseTunnelService.TunnelAddr(endpoint)
+		if err != nil {
+			return nil, errors.Wrap(err, "failed starting tunnel")
+		}
+
+		urlString = "http://" + tunnelAddr
+	}
+
+	endpointURL, err := url.ParseURL(urlString)
+	if err != nil {
+		return nil, errors.Wrapf(err, "failed parsing url %s", endpoint.URL)
+	}
+
+	endpointURL.Scheme = "http"
+
+	var innerTransport *http.Transport
+	if endpoint.TLSConfig.TLS || endpoint.TLSConfig.TLSSkipVerify {
+		tlsConfig, err := crypto.CreateTLSConfigurationFromDisk(endpoint.TLSConfig)
+		if err != nil {
+			return nil, errors.WithMessage(err, "failed generating tls configuration")
+		}
+
+		endpointURL.Scheme = "https"
+
+		if endpointutils.IsEdgeEndpoint(endpoint) {
+			innerTransport = ssrf.NewInternalTransport(tlsConfig)
+		} else {
+			innerTransport = ssrf.NewTransport(tlsConfig)
+			innerTransport.Protocols = ssrf.HTTP1Only()
+		}
+	} else if endpointutils.IsEdgeEndpoint(endpoint) {
+		innerTransport = ssrf.NewInternalTransport(nil)
+	} else {
+		innerTransport = ssrf.NewTransport(nil)
+	}
+
+	proxy := NewSingleHostReverseProxyWithHostHeader(endpointURL)
+
+	proxy.Transport = agent.NewTransport(factory.signatureService, innerTransport)
+
+	proxyServer := &ProxyServer{
+		server: &http.Server{
+			Handler: proxy,
+		},
+		Port: 0,
+	}
+
+	if err := proxyServer.start(); err != nil {
+		return nil, errors.Wrap(err, "failed starting proxy server")
+	}
+
+	return proxyServer, nil
+}
+
+func (proxy *ProxyServer) start() error {
+	listener, err := net.Listen("tcp", ":0")
+	if err != nil {
+		return err
+	}
+
+	proxy.Port = listener.Addr().(*net.TCPAddr).Port
+
+	go func() {
+		proxyHost := fmt.Sprintf("127.0.0.1:%d", proxy.Port)
+		log.Debug().Str("host", proxyHost).Msg("starting proxy server")
+
+		err := proxy.server.Serve(listener)
+		log.Debug().Str("host", proxyHost).Msg("exiting proxy server")
+
+		if err != nil && !errors.Is(err, http.ErrServerClosed) {
+			log.Debug().Str("host", proxyHost).Err(err).Msg("proxy server exited with an error")
+		}
+	}()
+
+	return nil
+}
+
+// Close shuts down the server
+func (proxy *ProxyServer) Close() {
+	if proxy.server != nil {
+		if err := proxy.server.Close(); err != nil {
+			log.Warn().Err(err).Msg("failed to close proxy server")
+		}
+	}
+}
diff --git a/api/http/proxy/factory/agent/transport.go b/api/http/proxy/factory/agent/transport.go
new file mode 100644
index 0000000..076a6d1
--- /dev/null
+++ b/api/http/proxy/factory/agent/transport.go
@@ -0,0 +1,36 @@
+package agent
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+)
+
+// Transport is an http.Transport wrapper that adds custom http headers to communicate to an Agent
+type Transport struct {
+	httpTransport    *http.Transport
+	signatureService portainer.DigitalSignatureService
+}
+
+// NewTransport returns a new transport that can be used to send signed requests to a Portainer agent
+func NewTransport(signatureService portainer.DigitalSignatureService, httpTransport *http.Transport) *Transport {
+	transport := &Transport{
+		httpTransport:    httpTransport,
+		signatureService: signatureService,
+	}
+
+	return transport
+}
+
+// RoundTrip is the implementation of the http.RoundTripper interface
+func (transport *Transport) RoundTrip(request *http.Request) (*http.Response, error) {
+	signature, err := transport.signatureService.CreateSignature(portainer.PortainerAgentSignatureMessage)
+	if err != nil {
+		return nil, err
+	}
+
+	request.Header.Set(portainer.PortainerAgentPublicKeyHeader, transport.signatureService.EncodedPublicKey())
+	request.Header.Set(portainer.PortainerAgentSignatureHeader, signature)
+
+	return transport.httpTransport.RoundTrip(request)
+}
diff --git a/api/http/proxy/factory/azure.go b/api/http/proxy/factory/azure.go
new file mode 100644
index 0000000..e210dec
--- /dev/null
+++ b/api/http/proxy/factory/azure.go
@@ -0,0 +1,21 @@
+package factory
+
+import (
+	"net/http"
+	"net/url"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/proxy/factory/azure"
+)
+
+func newAzureProxy(endpoint *portainer.Endpoint, dataStore dataservices.DataStore) (http.Handler, error) {
+	remoteURL, err := url.Parse(azureAPIBaseURL)
+	if err != nil {
+		return nil, err
+	}
+
+	proxy := NewSingleHostReverseProxyWithHostHeader(remoteURL)
+	proxy.Transport = azure.NewTransport(&endpoint.AzureCredentials, dataStore, endpoint)
+	return proxy, nil
+}
diff --git a/api/http/proxy/factory/azure/access_control.go b/api/http/proxy/factory/azure/access_control.go
new file mode 100644
index 0000000..be17b60
--- /dev/null
+++ b/api/http/proxy/factory/azure/access_control.go
@@ -0,0 +1,151 @@
+package azure
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/authorization"
+
+	"github.com/rs/zerolog/log"
+)
+
+func (transport *Transport) createAzureRequestContext(request *http.Request) (*azureRequestContext, error) {
+	var err error
+
+	tokenData, err := security.RetrieveTokenData(request)
+	if err != nil {
+		return nil, err
+	}
+
+	resourceControls, err := transport.dataStore.ResourceControl().ReadAll()
+	if err != nil {
+		return nil, err
+	}
+
+	context := &azureRequestContext{
+		isAdmin:          true,
+		userID:           tokenData.ID,
+		resourceControls: resourceControls,
+	}
+
+	if tokenData.Role != portainer.AdministratorRole {
+		context.isAdmin = false
+
+		teamMemberships, err := transport.dataStore.TeamMembership().TeamMembershipsByUserID(tokenData.ID)
+		if err != nil {
+			return nil, err
+		}
+
+		context.userTeamIDs = authorization.TeamIDs(teamMemberships)
+	}
+
+	return context, nil
+}
+
+func decorateObject(object map[string]any, resourceControl *portainer.ResourceControl) map[string]any {
+	if object["Portainer"] == nil {
+		object["Portainer"] = make(map[string]any)
+	}
+
+	portainerMetadata := object["Portainer"].(map[string]any)
+	portainerMetadata["ResourceControl"] = resourceControl
+
+	return object
+}
+
+func (transport *Transport) createPrivateResourceControl(
+	resourceIdentifier string,
+	resourceType portainer.ResourceControlType,
+	userID portainer.UserID) (*portainer.ResourceControl, error) {
+
+	resourceControl := authorization.NewPrivateResourceControl(resourceIdentifier, resourceType, userID)
+
+	if err := transport.dataStore.ResourceControl().Create(resourceControl); err != nil {
+		log.Error().
+			Str("resource", resourceIdentifier).
+			Err(err).
+			Msg("unable to persist resource control")
+
+		return nil, err
+	}
+
+	return resourceControl, nil
+}
+
+func (transport *Transport) userCanDeleteContainerGroup(request *http.Request, context *azureRequestContext) bool {
+	if context.isAdmin {
+		return true
+	}
+
+	resourceIdentifier := request.URL.Path
+	resourceControl := transport.findResourceControl(resourceIdentifier, context)
+
+	return authorization.UserCanAccessResource(context.userID, context.userTeamIDs, resourceControl)
+}
+
+func (transport *Transport) decorateContainerGroups(containerGroups []any, context *azureRequestContext) []any {
+	decoratedContainerGroups := make([]any, 0)
+
+	for _, containerGroup := range containerGroups {
+		containerGroup = transport.decorateContainerGroup(containerGroup.(map[string]any), context)
+		decoratedContainerGroups = append(decoratedContainerGroups, containerGroup)
+	}
+
+	return decoratedContainerGroups
+}
+
+func (transport *Transport) decorateContainerGroup(containerGroup map[string]any, context *azureRequestContext) map[string]any {
+	containerGroupId, ok := containerGroup["id"].(string)
+	if ok {
+		resourceControl := transport.findResourceControl(containerGroupId, context)
+		if resourceControl != nil {
+			containerGroup = decorateObject(containerGroup, resourceControl)
+		}
+	} else {
+		log.Warn().Msg("unable to find resource id property in container group")
+	}
+
+	return containerGroup
+}
+
+func (transport *Transport) filterContainerGroups(containerGroups []any, context *azureRequestContext) []any {
+	filteredContainerGroups := make([]any, 0)
+
+	for _, containerGroup := range containerGroups {
+		userCanAccessResource := false
+		containerGroup := containerGroup.(map[string]any)
+		portainerObject, ok := containerGroup["Portainer"].(map[string]any)
+		if ok {
+			resourceControl, ok := portainerObject["ResourceControl"].(*portainer.ResourceControl)
+			if ok {
+				userCanAccessResource = authorization.UserCanAccessResource(context.userID, context.userTeamIDs, resourceControl)
+			}
+		}
+
+		if context.isAdmin || userCanAccessResource {
+			filteredContainerGroups = append(filteredContainerGroups, containerGroup)
+		}
+	}
+
+	return filteredContainerGroups
+}
+
+func (transport *Transport) removeResourceControl(containerGroup map[string]any, context *azureRequestContext) error {
+	containerGroupID, ok := containerGroup["id"].(string)
+	if !ok {
+		log.Debug().Msg("missing ID in container group")
+
+		return nil
+	}
+
+	if resourceControl := transport.findResourceControl(containerGroupID, context); resourceControl != nil {
+		return transport.dataStore.ResourceControl().Delete(resourceControl.ID)
+	}
+
+	return nil
+}
+
+func (transport *Transport) findResourceControl(containerGroupId string, context *azureRequestContext) *portainer.ResourceControl {
+	return authorization.GetResourceControlByResourceIDAndType(containerGroupId, portainer.ContainerGroupResourceControl, context.resourceControls)
+}
diff --git a/api/http/proxy/factory/azure/containergroup.go b/api/http/proxy/factory/azure/containergroup.go
new file mode 100644
index 0000000..c5a8309
--- /dev/null
+++ b/api/http/proxy/factory/azure/containergroup.go
@@ -0,0 +1,155 @@
+package azure
+
+import (
+	"errors"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/proxy/factory/utils"
+	"github.com/portainer/portainer/api/http/security"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/rs/zerolog/log"
+)
+
+// proxy for /subscriptions/*/resourceGroups/*/providers/Microsoft.ContainerInstance/containerGroups/*
+func (transport *Transport) proxyContainerGroupRequest(request *http.Request) (*http.Response, error) {
+	switch request.Method {
+	case http.MethodPut:
+		return transport.proxyContainerGroupPutRequest(request)
+	case http.MethodGet:
+		return transport.proxyContainerGroupGetRequest(request)
+	case http.MethodDelete:
+		return transport.proxyContainerGroupDeleteRequest(request)
+	default:
+		return http.DefaultTransport.RoundTrip(request)
+	}
+}
+
+func (transport *Transport) proxyContainerGroupPutRequest(request *http.Request) (*http.Response, error) {
+	tokenData, err := security.RetrieveTokenData(request)
+	if err != nil {
+		return nil, httperror.Forbidden("Permission denied to access environment", err)
+	}
+
+	// Add a lock before processing existence check
+	transport.mutex.Lock()
+	defer transport.mutex.Unlock()
+
+	// Generate a temp http GET request based on the current PUT request
+	validationRequest := &http.Request{
+		Method: http.MethodGet,
+		URL:    request.URL,
+		Header: http.Header{
+			"Authorization": []string{"Bearer " + tokenData.Token},
+		},
+	}
+
+	// Fire the request to Azure API to validate if there is an existing container instance with the same name
+	// positive - reject the request
+	// negative - continue the process
+	validationResponse, err := http.DefaultTransport.RoundTrip(validationRequest)
+	if err != nil {
+		return validationResponse, err
+	}
+
+	if validationResponse.StatusCode >= 200 && validationResponse.StatusCode < 300 {
+		resp := &http.Response{
+			Header: http.Header{
+				http.CanonicalHeaderKey("content-type"): []string{"application/json"},
+			},
+		}
+		errObj := map[string]string{
+			"message": "A container instance with the same name already exists inside the selected resource group",
+		}
+		err = utils.RewriteResponse(resp, errObj, http.StatusConflict)
+
+		return resp, err
+	}
+
+	response, err := http.DefaultTransport.RoundTrip(request)
+	if err != nil {
+		return response, err
+	}
+
+	responseObject, err := utils.GetResponseAsJSONObject(response)
+	if err != nil {
+		return response, err
+	}
+
+	containerGroupID, ok := responseObject["id"].(string)
+	if !ok {
+		return response, errors.New("Missing container group ID")
+	}
+
+	context, err := transport.createAzureRequestContext(request)
+	if err != nil {
+		return response, err
+	}
+
+	resourceControl, err := transport.createPrivateResourceControl(containerGroupID, portainer.ContainerGroupResourceControl, context.userID)
+	if err != nil {
+		return response, err
+	}
+
+	responseObject = decorateObject(responseObject, resourceControl)
+
+	err = utils.RewriteResponse(response, responseObject, http.StatusOK)
+
+	return response, err
+}
+
+func (transport *Transport) proxyContainerGroupGetRequest(request *http.Request) (*http.Response, error) {
+	response, err := http.DefaultTransport.RoundTrip(request)
+	if err != nil {
+		return response, err
+	}
+
+	responseObject, err := utils.GetResponseAsJSONObject(response)
+	if err != nil {
+		return nil, err
+	}
+
+	context, err := transport.createAzureRequestContext(request)
+	if err != nil {
+		return nil, err
+	}
+
+	responseObject = transport.decorateContainerGroup(responseObject, context)
+
+	if err := utils.RewriteResponse(response, responseObject, http.StatusOK); err != nil {
+		log.Warn().Err(err).Msg("failed to rewrite response")
+	}
+
+	return response, nil
+}
+
+func (transport *Transport) proxyContainerGroupDeleteRequest(request *http.Request) (*http.Response, error) {
+	context, err := transport.createAzureRequestContext(request)
+	if err != nil {
+		return nil, err
+	}
+
+	if !transport.userCanDeleteContainerGroup(request, context) {
+		return utils.WriteAccessDeniedResponse()
+	}
+
+	response, err := http.DefaultTransport.RoundTrip(request)
+	if err != nil {
+		return response, err
+	}
+
+	responseObject, err := utils.GetResponseAsJSONObject(response)
+	if err != nil {
+		return nil, err
+	}
+
+	if err := transport.removeResourceControl(responseObject, context); err != nil {
+		log.Warn().Err(err).Msg("failed to remove resource control")
+	}
+
+	if err := utils.RewriteResponse(response, responseObject, http.StatusOK); err != nil {
+		log.Warn().Err(err).Msg("failed to rewrite response")
+	}
+
+	return response, nil
+}
diff --git a/api/http/proxy/factory/azure/containergroups.go b/api/http/proxy/factory/azure/containergroups.go
new file mode 100644
index 0000000..5d4516a
--- /dev/null
+++ b/api/http/proxy/factory/azure/containergroups.go
@@ -0,0 +1,50 @@
+package azure
+
+import (
+	"errors"
+	"net/http"
+
+	"github.com/portainer/portainer/api/http/proxy/factory/utils"
+)
+
+// proxy for /subscriptions/*/providers/Microsoft.ContainerInstance/containerGroups
+func (transport *Transport) proxyContainerGroupsRequest(request *http.Request) (*http.Response, error) {
+	switch request.Method {
+	case http.MethodGet:
+		return transport.proxyContainerGroupsGetRequest(request)
+	default:
+		return http.DefaultTransport.RoundTrip(request)
+	}
+}
+
+func (transport *Transport) proxyContainerGroupsGetRequest(request *http.Request) (*http.Response, error) {
+	response, err := http.DefaultTransport.RoundTrip(request)
+	if err != nil {
+		return nil, err
+	}
+
+	responseObject, err := utils.GetResponseAsJSONObject(response)
+	if err != nil {
+		return nil, err
+	}
+
+	value, ok := responseObject["value"].([]any)
+	if ok {
+		context, err := transport.createAzureRequestContext(request)
+		if err != nil {
+			return response, err
+		}
+
+		decoratedValue := transport.decorateContainerGroups(value, context)
+		filteredValue := transport.filterContainerGroups(decoratedValue, context)
+		responseObject["value"] = filteredValue
+
+		if err := utils.RewriteResponse(response, responseObject, http.StatusOK); err != nil {
+			return nil, err
+		}
+	} else {
+		return nil, errors.New("The container groups response has no value property")
+	}
+
+	return response, nil
+}
diff --git a/api/http/proxy/factory/azure/transport.go b/api/http/proxy/factory/azure/transport.go
new file mode 100644
index 0000000..37fda30
--- /dev/null
+++ b/api/http/proxy/factory/azure/transport.go
@@ -0,0 +1,106 @@
+package azure
+
+import (
+	"net/http"
+	"path"
+	"strconv"
+	"sync"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/client"
+)
+
+type (
+	azureAPIToken struct {
+		value          string
+		expirationTime time.Time
+	}
+
+	Transport struct {
+		credentials *portainer.AzureCredentials
+		client      *client.HTTPClient
+		token       *azureAPIToken
+		mutex       sync.Mutex
+		dataStore   dataservices.DataStore
+		endpoint    *portainer.Endpoint
+	}
+
+	azureRequestContext struct {
+		isAdmin          bool
+		userID           portainer.UserID
+		userTeamIDs      []portainer.TeamID
+		resourceControls []portainer.ResourceControl
+	}
+)
+
+// NewTransport returns a pointer to a new instance of Transport that implements the HTTP Transport
+// interface for proxying requests to the Azure API.
+func NewTransport(credentials *portainer.AzureCredentials, dataStore dataservices.DataStore, endpoint *portainer.Endpoint) *Transport {
+	return &Transport{
+		credentials: credentials,
+		client:      client.NewHTTPClient(),
+		dataStore:   dataStore,
+		endpoint:    endpoint,
+	}
+}
+
+// RoundTrip is the implementation of the http.RoundTripper interface
+func (transport *Transport) RoundTrip(request *http.Request) (*http.Response, error) {
+	return transport.proxyAzureRequest(request)
+}
+
+func (transport *Transport) proxyAzureRequest(request *http.Request) (*http.Response, error) {
+	requestPath := request.URL.Path
+
+	err := transport.retrieveAuthenticationToken()
+	if err != nil {
+		return nil, err
+	}
+
+	request.Header.Set("Authorization", "Bearer "+transport.token.value)
+
+	if match, _ := path.Match(portainer.AzurePathContainerGroups, requestPath); match {
+		return transport.proxyContainerGroupsRequest(request)
+	} else if match, _ := path.Match(portainer.AzurePathContainerGroup, requestPath); match {
+		return transport.proxyContainerGroupRequest(request)
+	}
+
+	return http.DefaultTransport.RoundTrip(request)
+}
+
+func (transport *Transport) authenticate() error {
+	token, err := transport.client.ExecuteAzureAuthenticationRequest(transport.credentials)
+	if err != nil {
+		return err
+	}
+
+	expiresOn, err := strconv.ParseInt(token.ExpiresOn, 10, 64)
+	if err != nil {
+		return err
+	}
+
+	transport.token = &azureAPIToken{
+		value:          token.AccessToken,
+		expirationTime: time.Unix(expiresOn, 0),
+	}
+
+	return nil
+}
+
+func (transport *Transport) retrieveAuthenticationToken() error {
+	transport.mutex.Lock()
+	defer transport.mutex.Unlock()
+
+	if transport.token == nil {
+		return transport.authenticate()
+	}
+
+	timeLimit := time.Now().Add(-5 * time.Minute)
+	if timeLimit.After(transport.token.expirationTime) {
+		return transport.authenticate()
+	}
+
+	return nil
+}
diff --git a/api/http/proxy/factory/docker.go b/api/http/proxy/factory/docker.go
new file mode 100644
index 0000000..b5d92df
--- /dev/null
+++ b/api/http/proxy/factory/docker.go
@@ -0,0 +1,130 @@
+package factory
+
+import (
+	"io"
+	"net/http"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/crypto"
+	"github.com/portainer/portainer/api/http/proxy/factory/docker"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+	"github.com/portainer/portainer/api/url"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/ssrf"
+
+	"github.com/rs/zerolog/log"
+)
+
+func (factory *ProxyFactory) newDockerProxy(endpoint *portainer.Endpoint) (http.Handler, error) {
+	if strings.HasPrefix(endpoint.URL, "unix://") || strings.HasPrefix(endpoint.URL, "npipe://") {
+		return factory.newDockerLocalProxy(endpoint)
+	}
+
+	return factory.newDockerHTTPProxy(endpoint)
+}
+
+func (factory *ProxyFactory) newDockerLocalProxy(endpoint *portainer.Endpoint) (http.Handler, error) {
+	endpointURL, err := url.ParseURL(endpoint.URL)
+	if err != nil {
+		return nil, err
+	}
+
+	return factory.newOSBasedLocalProxy(endpointURL.Path, endpoint)
+}
+
+func (factory *ProxyFactory) newDockerHTTPProxy(endpoint *portainer.Endpoint) (http.Handler, error) {
+	rawURL := endpoint.URL
+	if endpoint.Type == portainer.EdgeAgentOnDockerEnvironment {
+		tunnelAddr, err := factory.reverseTunnelService.TunnelAddr(endpoint)
+		if err != nil {
+			return nil, err
+		}
+		rawURL = "http://" + tunnelAddr
+	}
+
+	endpointURL, err := url.ParseURL(rawURL)
+	if err != nil {
+		return nil, err
+	}
+
+	endpointURL.Scheme = "http"
+
+	transportParameters := &docker.TransportParameters{
+		Endpoint:             endpoint,
+		DataStore:            factory.dataStore,
+		ReverseTunnelService: factory.reverseTunnelService,
+		SignatureService:     factory.signatureService,
+		DockerClientFactory:  factory.dockerClientFactory,
+	}
+
+	var innerTransport *http.Transport
+	if endpoint.TLSConfig.TLS || endpoint.TLSConfig.TLSSkipVerify {
+		tlsConfig, err := crypto.CreateTLSConfigurationFromDisk(endpoint.TLSConfig)
+		if err != nil {
+			return nil, err
+		}
+
+		endpointURL.Scheme = "https"
+
+		if endpointutils.IsEdgeEndpoint(endpoint) {
+			innerTransport = ssrf.NewInternalTransport(tlsConfig)
+		} else {
+			innerTransport = ssrf.NewTransport(tlsConfig)
+		}
+	} else if endpointutils.IsEdgeEndpoint(endpoint) {
+		innerTransport = ssrf.NewInternalTransport(nil)
+	} else {
+		innerTransport = ssrf.NewTransport(nil)
+	}
+
+	dockerTransport, err := docker.NewTransport(transportParameters, innerTransport, factory.gitService, factory.snapshotService)
+	if err != nil {
+		return nil, err
+	}
+
+	proxy := NewSingleHostReverseProxyWithHostHeader(endpointURL)
+	proxy.Transport = dockerTransport
+	return proxy, nil
+}
+
+type dockerLocalProxy struct {
+	transport *docker.Transport
+}
+
+// ServeHTTP is the http.Handler interface implementation
+// for a local (Unix socket or Windows named pipe) Docker proxy.
+func (proxy *dockerLocalProxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	// Force URL/domain to http/unixsocket to be able to
+	// use http.transport RoundTrip to do the requests via the socket
+	r.URL.Scheme = "http"
+	r.URL.Host = "unixsocket"
+
+	res, err := proxy.transport.ProxyDockerRequest(r)
+	if err != nil {
+		code := http.StatusInternalServerError
+		if res != nil && res.StatusCode != 0 {
+			code = res.StatusCode
+		}
+
+		httperror.WriteError(w, code, "Unable to proxy the request via the Docker socket", err)
+		return
+	}
+	defer func() {
+		if err := res.Body.Close(); err != nil {
+			log.Warn().Err(err).Msg("proxy error: failed to close response body")
+		}
+	}()
+
+	for k, vv := range res.Header {
+		for _, v := range vv {
+			w.Header().Add(k, v)
+		}
+	}
+
+	w.WriteHeader(res.StatusCode)
+
+	if _, err := io.Copy(w, res.Body); err != nil {
+		log.Debug().Err(err).Msg("proxy error")
+	}
+}
diff --git a/api/http/proxy/factory/docker/access_control.go b/api/http/proxy/factory/docker/access_control.go
new file mode 100644
index 0000000..69dc5c6
--- /dev/null
+++ b/api/http/proxy/factory/docker/access_control.go
@@ -0,0 +1,348 @@
+package docker
+
+import (
+	"net/http"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/docker/consts"
+	"github.com/portainer/portainer/api/http/proxy/factory/utils"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/slicesx"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+
+	"github.com/docker/docker/client"
+	"github.com/rs/zerolog/log"
+)
+
+const (
+	resourceLabelForPortainerTeamResourceControl   = "io.portainer.accesscontrol.teams"
+	resourceLabelForPortainerUserResourceControl   = "io.portainer.accesscontrol.users"
+	resourceLabelForPortainerPublicResourceControl = "io.portainer.accesscontrol.public"
+)
+
+type (
+	resourceLabelsObjectSelector func(map[string]any) map[string]any
+
+	resourceOperationParameters struct {
+		resourceIdentifierAttribute string
+		resourceType                portainer.ResourceControlType
+		labelsObjectSelector        resourceLabelsObjectSelector
+	}
+)
+
+func getUniqueElements(items string) []string {
+	xs := strings.Split(items, ",")
+	xs = slicesx.Map(xs, strings.TrimSpace)
+	xs = slicesx.FilterInPlace(xs, func(x string) bool { return len(x) > 0 })
+
+	return slicesx.Unique(xs)
+}
+
+func (transport *Transport) newResourceControlFromPortainerLabels(labelsObject map[string]any, resourceID string, resourceType portainer.ResourceControlType) (*portainer.ResourceControl, error) {
+	if labelsObject[resourceLabelForPortainerPublicResourceControl] != nil {
+		resourceControl := authorization.NewPublicResourceControl(resourceID, resourceType)
+
+		if err := transport.dataStore.ResourceControl().Create(resourceControl); err != nil {
+			return nil, err
+		}
+
+		return resourceControl, nil
+	}
+
+	teamNames := make([]string, 0)
+	userNames := make([]string, 0)
+
+	if labelsObject[resourceLabelForPortainerTeamResourceControl] != nil {
+		concatenatedTeamNames := labelsObject[resourceLabelForPortainerTeamResourceControl].(string)
+		teamNames = getUniqueElements(concatenatedTeamNames)
+	}
+
+	if labelsObject[resourceLabelForPortainerUserResourceControl] != nil {
+		concatenatedUserNames := labelsObject[resourceLabelForPortainerUserResourceControl].(string)
+		userNames = getUniqueElements(concatenatedUserNames)
+	}
+
+	if len(teamNames) == 0 && len(userNames) == 0 {
+		return nil, nil
+	}
+
+	teamIDs := make([]portainer.TeamID, 0)
+	userIDs := make([]portainer.UserID, 0)
+
+	for _, name := range teamNames {
+		team, err := transport.dataStore.Team().TeamByName(name)
+		if err != nil {
+			log.Warn().
+				Str("name", name).
+				Str("resource_id", resourceID).
+				Msg("unknown team name in access control label, ignoring access control rule for this team")
+
+			continue
+		}
+
+		teamIDs = append(teamIDs, team.ID)
+	}
+
+	for _, name := range userNames {
+		user, err := transport.dataStore.User().UserByUsername(name)
+		if err != nil {
+			log.Warn().
+				Str("name", name).
+				Str("resource_id", resourceID).
+				Msg("unknown user name in access control label, ignoring access control rule for this user")
+
+			continue
+		}
+
+		userIDs = append(userIDs, user.ID)
+	}
+
+	resourceControl := authorization.NewRestrictedResourceControl(resourceID, resourceType, userIDs, teamIDs)
+
+	if err := transport.dataStore.ResourceControl().Create(resourceControl); err != nil {
+		return nil, err
+	}
+
+	return resourceControl, nil
+}
+
+func (transport *Transport) createPrivateResourceControl(resourceIdentifier string, resourceType portainer.ResourceControlType, userID portainer.UserID) (*portainer.ResourceControl, error) {
+	resourceControl := authorization.NewPrivateResourceControl(resourceIdentifier, resourceType, userID)
+
+	if err := transport.dataStore.ResourceControl().Create(resourceControl); err != nil {
+		log.Error().
+			Str("resource", resourceIdentifier).
+			Err(err).
+			Msg("unable to persist resource control")
+
+		return nil, err
+	}
+
+	return resourceControl, nil
+}
+
+func (transport *Transport) getInheritedResourceControlFromServiceOrStack(client *client.Client, resourceIdentifier string, resourceType portainer.ResourceControlType, resourceControls []portainer.ResourceControl) (*portainer.ResourceControl, error) {
+	switch resourceType {
+	case portainer.ContainerResourceControl:
+		return getInheritedResourceControlFromContainerLabels(client, transport.endpoint.ID, resourceIdentifier, resourceControls)
+	case portainer.NetworkResourceControl:
+		return getInheritedResourceControlFromNetworkLabels(client, transport.endpoint.ID, resourceIdentifier, resourceControls)
+	case portainer.VolumeResourceControl:
+		return getInheritedResourceControlFromVolumeLabels(client, transport.endpoint.ID, resourceIdentifier, resourceControls)
+	case portainer.ServiceResourceControl:
+		return getInheritedResourceControlFromServiceLabels(client, transport.endpoint.ID, resourceIdentifier, resourceControls)
+	case portainer.ConfigResourceControl:
+		return getInheritedResourceControlFromConfigLabels(client, transport.endpoint.ID, resourceIdentifier, resourceControls)
+	case portainer.SecretResourceControl:
+		return getInheritedResourceControlFromSecretLabels(client, transport.endpoint.ID, resourceIdentifier, resourceControls)
+	}
+
+	return nil, nil
+}
+
+func (transport *Transport) applyAccessControlOnResource(parameters *resourceOperationParameters, responseObject map[string]any, response *http.Response, executor *operationExecutor) error {
+	if responseObject[parameters.resourceIdentifierAttribute] == nil {
+		log.Warn().
+			Str("identifier_attribute", parameters.resourceIdentifierAttribute).
+			Msg("unable to find resource identifier property in resource object")
+
+		return nil
+	}
+
+	if parameters.resourceType == portainer.NetworkResourceControl {
+		systemResourceControl := findSystemNetworkResourceControl(responseObject)
+		if systemResourceControl != nil {
+			responseObject = decorateObject(responseObject, systemResourceControl)
+
+			return utils.RewriteResponse(response, responseObject, http.StatusOK)
+		}
+	}
+
+	resourceIdentifier := responseObject[parameters.resourceIdentifierAttribute].(string)
+	resourceLabelsObject := parameters.labelsObjectSelector(responseObject)
+
+	resourceControl, err := transport.findResourceControl(resourceIdentifier, parameters.resourceType, resourceLabelsObject, executor.operationContext.resourceControls)
+	if err != nil {
+		return err
+	}
+
+	if resourceControl == nil && (executor.operationContext.isAdmin) {
+		return utils.RewriteResponse(response, responseObject, http.StatusOK)
+	}
+
+	if executor.operationContext.isAdmin || (resourceControl != nil && authorization.UserCanAccessResource(executor.operationContext.userID, executor.operationContext.userTeamIDs, resourceControl)) {
+		responseObject = decorateObject(responseObject, resourceControl)
+
+		return utils.RewriteResponse(response, responseObject, http.StatusOK)
+	}
+
+	return utils.RewriteAccessDeniedResponse(response)
+}
+
+func (transport *Transport) applyAccessControlOnResourceList(parameters *resourceOperationParameters, resourceData []any, executor *operationExecutor) ([]any, error) {
+	if executor.operationContext.isAdmin {
+		return transport.decorateResourceList(parameters, resourceData, executor.operationContext.resourceControls)
+	}
+
+	return transport.filterResourceList(parameters, resourceData, executor.operationContext)
+}
+
+func (transport *Transport) decorateResourceList(parameters *resourceOperationParameters, resourceData []any, resourceControls []portainer.ResourceControl) ([]any, error) {
+	decoratedResourceData := make([]any, 0)
+
+	for _, resource := range resourceData {
+		resourceObject := resource.(map[string]any)
+
+		if resourceObject[parameters.resourceIdentifierAttribute] == nil {
+			log.Warn().
+				Str("identifier_attribute", parameters.resourceIdentifierAttribute).
+				Msg("unable to find resource identifier property in resource list element")
+
+			continue
+		}
+
+		if parameters.resourceType == portainer.NetworkResourceControl {
+			systemResourceControl := findSystemNetworkResourceControl(resourceObject)
+			if systemResourceControl != nil {
+				resourceObject = decorateObject(resourceObject, systemResourceControl)
+				decoratedResourceData = append(decoratedResourceData, resourceObject)
+
+				continue
+			}
+		}
+
+		resourceIdentifier := resourceObject[parameters.resourceIdentifierAttribute].(string)
+		resourceLabelsObject := parameters.labelsObjectSelector(resourceObject)
+
+		resourceControl, err := transport.findResourceControl(resourceIdentifier, parameters.resourceType, resourceLabelsObject, resourceControls)
+		if err != nil {
+			return nil, err
+		}
+
+		if resourceControl != nil {
+			resourceObject = decorateObject(resourceObject, resourceControl)
+		}
+
+		decoratedResourceData = append(decoratedResourceData, resourceObject)
+	}
+
+	return decoratedResourceData, nil
+}
+
+func (transport *Transport) filterResourceList(parameters *resourceOperationParameters, resourceData []any, context *restrictedDockerOperationContext) ([]any, error) {
+	filteredResourceData := make([]any, 0)
+
+	for _, resource := range resourceData {
+		resourceObject := resource.(map[string]any)
+		if resourceObject[parameters.resourceIdentifierAttribute] == nil {
+			log.Warn().
+				Str("identifier_attribute", parameters.resourceIdentifierAttribute).
+				Msg("unable to find resource identifier property in resource list element")
+
+			continue
+		}
+
+		resourceIdentifier := resourceObject[parameters.resourceIdentifierAttribute].(string)
+		resourceLabelsObject := parameters.labelsObjectSelector(resourceObject)
+
+		if parameters.resourceType == portainer.NetworkResourceControl {
+			systemResourceControl := findSystemNetworkResourceControl(resourceObject)
+			if systemResourceControl != nil {
+				resourceObject = decorateObject(resourceObject, systemResourceControl)
+				filteredResourceData = append(filteredResourceData, resourceObject)
+
+				continue
+			}
+		}
+
+		resourceControl, err := transport.findResourceControl(resourceIdentifier, parameters.resourceType, resourceLabelsObject, context.resourceControls)
+		if err != nil {
+			return nil, err
+		}
+
+		if resourceControl == nil {
+			if context.isAdmin {
+				filteredResourceData = append(filteredResourceData, resourceObject)
+			}
+
+			continue
+		}
+
+		if context.isAdmin || authorization.UserCanAccessResource(context.userID, context.userTeamIDs, resourceControl) {
+			resourceObject = decorateObject(resourceObject, resourceControl)
+			filteredResourceData = append(filteredResourceData, resourceObject)
+		}
+	}
+
+	return filteredResourceData, nil
+}
+
+func (transport *Transport) findResourceControl(resourceIdentifier string, resourceType portainer.ResourceControlType, resourceLabelsObject map[string]any, resourceControls []portainer.ResourceControl) (*portainer.ResourceControl, error) {
+	resourceControl := authorization.GetResourceControlByResourceIDAndType(resourceIdentifier, resourceType, resourceControls)
+	if resourceControl != nil {
+		return resourceControl, nil
+	}
+
+	if resourceLabelsObject == nil {
+		return nil, nil
+	}
+
+	if resourceLabelsObject[consts.SwarmServiceIDLabel] != nil {
+		inheritedServiceIdentifier := resourceLabelsObject[consts.SwarmServiceIDLabel].(string)
+		resourceControl = authorization.GetResourceControlByResourceIDAndType(inheritedServiceIdentifier, portainer.ServiceResourceControl, resourceControls)
+
+		if resourceControl != nil {
+			return resourceControl, nil
+		}
+	}
+
+	if resourceLabelsObject[consts.SwarmStackNameLabel] != nil {
+		stackName := resourceLabelsObject[consts.SwarmStackNameLabel].(string)
+		stackResourceID := stackutils.ResourceControlID(transport.endpoint.ID, stackName)
+		resourceControl = authorization.GetResourceControlByResourceIDAndType(stackResourceID, portainer.StackResourceControl, resourceControls)
+
+		if resourceControl != nil {
+			return resourceControl, nil
+		}
+	}
+
+	if resourceLabelsObject[consts.ComposeStackNameLabel] != nil {
+		stackName := resourceLabelsObject[consts.ComposeStackNameLabel].(string)
+		stackResourceID := stackutils.ResourceControlID(transport.endpoint.ID, stackName)
+		resourceControl = authorization.GetResourceControlByResourceIDAndType(stackResourceID, portainer.StackResourceControl, resourceControls)
+
+		if resourceControl != nil {
+			return resourceControl, nil
+		}
+	}
+
+	return transport.newResourceControlFromPortainerLabels(resourceLabelsObject, resourceIdentifier, resourceType)
+}
+
+func getStackResourceIDFromLabels(resourceLabelsObject map[string]string, endpointID portainer.EndpointID) string {
+	if resourceLabelsObject[consts.SwarmStackNameLabel] != "" {
+		stackName := resourceLabelsObject[consts.SwarmStackNameLabel]
+
+		return stackutils.ResourceControlID(endpointID, stackName)
+	}
+
+	if resourceLabelsObject[consts.ComposeStackNameLabel] != "" {
+		stackName := resourceLabelsObject[consts.ComposeStackNameLabel]
+
+		return stackutils.ResourceControlID(endpointID, stackName)
+	}
+
+	return ""
+}
+
+func decorateObject(object map[string]any, resourceControl *portainer.ResourceControl) map[string]any {
+	if object["Portainer"] == nil {
+		object["Portainer"] = make(map[string]any)
+	}
+
+	portainerMetadata := object["Portainer"].(map[string]any)
+	portainerMetadata["ResourceControl"] = resourceControl
+
+	return object
+}
diff --git a/api/http/proxy/factory/docker/access_control_test.go b/api/http/proxy/factory/docker/access_control_test.go
new file mode 100644
index 0000000..038ba9a
--- /dev/null
+++ b/api/http/proxy/factory/docker/access_control_test.go
@@ -0,0 +1,64 @@
+package docker
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_getUniqueElements(t *testing.T) {
+	t.Parallel()
+	cases := []struct {
+		description string
+		input       string
+		expected    []string
+	}{
+		{
+			description: "no items padded",
+			input:       "    ",
+			expected:    []string{},
+		},
+		{
+			description: "single item",
+			input:       "a",
+			expected:    []string{"a"},
+		},
+		{
+			description: "single item padded",
+			input:       " a   ",
+			expected:    []string{"a"},
+		},
+		{
+			description: "multiple items",
+			input:       "a,b",
+			expected:    []string{"a", "b"},
+		},
+		{
+			description: "multiple items padded",
+			input:       " a , b  ",
+			expected:    []string{"a", "b"},
+		},
+		{
+			description: "multiple items with empty values",
+			input:       " a , ,b  ",
+			expected:    []string{"a", "b"},
+		},
+		{
+			description: "duplicates",
+			input:       " a , a  ",
+			expected:    []string{"a"},
+		},
+		{
+			description: "mix with duplicates",
+			input:       " a ,b, a  ",
+			expected:    []string{"a", "b"},
+		},
+	}
+
+	for _, tt := range cases {
+		t.Run(tt.description, func(t *testing.T) {
+			result := getUniqueElements(tt.input)
+			assert.ElementsMatch(t, result, tt.expected)
+		})
+	}
+}
diff --git a/api/http/proxy/factory/docker/build.go b/api/http/proxy/factory/docker/build.go
new file mode 100644
index 0000000..6e85cd3
--- /dev/null
+++ b/api/http/proxy/factory/docker/build.go
@@ -0,0 +1,129 @@
+package docker
+
+import (
+	"bytes"
+	"errors"
+	"io"
+	"mime"
+	"net/http"
+
+	"github.com/portainer/portainer/api/archive"
+	"github.com/portainer/portainer/api/logs"
+
+	"github.com/rs/zerolog/log"
+	"github.com/segmentio/encoding/json"
+)
+
+const OneMegabyte = 1024768
+
+type postDockerfileRequest struct {
+	Content string
+}
+
+var ErrUploadedFilesNotFound = errors.New("uploaded files not found to build image")
+
+// buildOperation inspects the "Content-Type" header to determine if it needs to alter the request.
+//
+// If the value of the header is empty, it means that a Dockerfile is posted via upload, the function
+// will extract the file content from the request body, tar it, and rewrite the body.
+// !! THIS IS ONLY TRUE WHEN THE UPLOADED DOCKERFILE FILE HAS NO EXTENSION (the generated file.type in the frontend will be empty)
+// If the Dockerfile is named like Dockerfile.yaml or has an internal type, a non-empty Content-Type header will be generated
+//
+// If the value of the header contains "application/json", it means that the content of a Dockerfile is posted
+// in the request payload as JSON, the function will create a new file called Dockerfile inside a tar archive and
+// rewrite the body of the request.
+//
+// In any other case, it will leave the request unaltered.
+func buildOperation(request *http.Request) error {
+	contentTypeHeader := request.Header.Get("Content-Type")
+
+	mediaType := ""
+	if contentTypeHeader != "" {
+		var err error
+		mediaType, _, err = mime.ParseMediaType(contentTypeHeader)
+		if err != nil {
+			return err
+		}
+	}
+
+	var buffer []byte
+	switch mediaType {
+	case "":
+		body, err := io.ReadAll(request.Body)
+		if err != nil {
+			return err
+		}
+
+		buffer, err = archive.TarFileInBuffer(body, "Dockerfile", 0600)
+		if err != nil {
+			return err
+		}
+
+	case "application/json":
+		var req postDockerfileRequest
+		err := json.NewDecoder(request.Body).Decode(&req)
+		if err != nil {
+			return err
+		}
+
+		buffer, err = archive.TarFileInBuffer([]byte(req.Content), "Dockerfile", 0600)
+		if err != nil {
+			return err
+		}
+
+	case "multipart/form-data":
+		if err := request.ParseMultipartForm(32 * OneMegabyte); err != nil {
+			return err
+		}
+
+		if request.MultipartForm == nil || request.MultipartForm.File == nil {
+			return ErrUploadedFilesNotFound
+		}
+
+		tfb := archive.NewTarFileInBuffer()
+		defer func() {
+			if err := tfb.Close(); err != nil {
+				log.Warn().Err(err).Msg("failed to close tar buffer")
+			}
+		}()
+
+		for k := range request.MultipartForm.File {
+			f, hdr, err := request.FormFile(k)
+			if err != nil {
+				return err
+			}
+
+			defer logs.CloseAndLogErr(f)
+
+			log.Info().Str("filename", hdr.Filename).Int64("size", hdr.Size).Msg("upload the file to build image")
+
+			content, err := io.ReadAll(f)
+			if err != nil {
+				return err
+			}
+
+			filename := hdr.Filename
+			if hdr.Filename == "blob" {
+				filename = "Dockerfile"
+			}
+
+			if err := tfb.Put(content, filename, 0600); err != nil {
+				return err
+			}
+		}
+
+		buffer = tfb.Bytes()
+		request.Form = nil
+		request.PostForm = nil
+		request.MultipartForm = nil
+
+	default:
+		return nil
+	}
+
+	request.Body = io.NopCloser(bytes.NewReader(buffer))
+	request.ContentLength = int64(len(buffer))
+	request.Header.Set("Content-Type", "application/x-tar")
+
+	return nil
+}
diff --git a/api/http/proxy/factory/docker/configs.go b/api/http/proxy/factory/docker/configs.go
new file mode 100644
index 0000000..dc01287
--- /dev/null
+++ b/api/http/proxy/factory/docker/configs.go
@@ -0,0 +1,84 @@
+package docker
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/docker/docker/client"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/proxy/factory/utils"
+	"github.com/portainer/portainer/api/internal/authorization"
+)
+
+const configObjectIdentifier = "ID"
+
+func getInheritedResourceControlFromConfigLabels(dockerClient *client.Client, endpointID portainer.EndpointID, configID string, resourceControls []portainer.ResourceControl) (*portainer.ResourceControl, error) {
+	config, _, err := dockerClient.ConfigInspectWithRaw(context.Background(), configID)
+	if err != nil {
+		return nil, err
+	}
+
+	stackResourceID := getStackResourceIDFromLabels(config.Spec.Labels, endpointID)
+	if stackResourceID != "" {
+		return authorization.GetResourceControlByResourceIDAndType(stackResourceID, portainer.StackResourceControl, resourceControls), nil
+	}
+
+	return nil, nil
+}
+
+// configListOperation extracts the response as a JSON object, loop through the configs array
+// decorate and/or filter the configs based on resource controls before rewriting the response.
+func (transport *Transport) configListOperation(response *http.Response, executor *operationExecutor) error {
+	// ConfigList response is a JSON array
+	// https://docs.docker.com/engine/api/v1.30/#operation/ConfigList
+	responseArray, err := utils.GetResponseAsJSONArray(response)
+	if err != nil {
+		return err
+	}
+
+	resourceOperationParameters := &resourceOperationParameters{
+		resourceIdentifierAttribute: configObjectIdentifier,
+		resourceType:                portainer.ConfigResourceControl,
+		labelsObjectSelector:        selectorConfigLabels,
+	}
+
+	responseArray, err = transport.applyAccessControlOnResourceList(resourceOperationParameters, responseArray, executor)
+	if err != nil {
+		return err
+	}
+
+	return utils.RewriteResponse(response, responseArray, http.StatusOK)
+}
+
+// configInspectOperation extracts the response as a JSON object, verify that the user
+// has access to the config based on resource control and either rewrite an access denied response or a decorated config.
+func (transport *Transport) configInspectOperation(response *http.Response, executor *operationExecutor) error {
+	// ConfigInspect response is a JSON object
+	// https://docs.docker.com/engine/api/v1.30/#operation/ConfigInspect
+	responseObject, err := utils.GetResponseAsJSONObject(response)
+	if err != nil {
+		return err
+	}
+
+	resourceOperationParameters := &resourceOperationParameters{
+		resourceIdentifierAttribute: configObjectIdentifier,
+		resourceType:                portainer.ConfigResourceControl,
+		labelsObjectSelector:        selectorConfigLabels,
+	}
+
+	return transport.applyAccessControlOnResource(resourceOperationParameters, responseObject, response, executor)
+}
+
+// selectorConfigLabels retrieve the labels object associated to the config object.
+// Labels are available under the "Spec.Labels" property.
+// API schema references:
+// https://docs.docker.com/engine/api/v1.37/#operation/ConfigList
+// https://docs.docker.com/engine/api/v1.37/#operation/ConfigInspect
+func selectorConfigLabels(responseObject map[string]any) map[string]any {
+	if secretSpec := utils.GetJSONObject(responseObject, "Spec"); secretSpec != nil {
+		return utils.GetJSONObject(secretSpec, "Labels")
+	}
+
+	return nil
+}
diff --git a/api/http/proxy/factory/docker/containers.go b/api/http/proxy/factory/docker/containers.go
new file mode 100644
index 0000000..83166ab
--- /dev/null
+++ b/api/http/proxy/factory/docker/containers.go
@@ -0,0 +1,315 @@
+package docker
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"io"
+	"net/http"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/docker/consts"
+	"github.com/portainer/portainer/api/http/proxy/factory/utils"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/authorization"
+
+	"github.com/docker/docker/client"
+	"github.com/segmentio/encoding/json"
+)
+
+const containerObjectIdentifier = "Id"
+
+var (
+	ErrPrivilegedModeForbidden        = errors.New("forbidden to use privileged mode")
+	ErrPIDHostNamespaceForbidden      = errors.New("forbidden to use pid host namespace")
+	ErrDeviceMappingForbidden         = errors.New("forbidden to use device mapping")
+	ErrSysCtlSettingsForbidden        = errors.New("forbidden to use sysctl settings")
+	ErrSecurityOptSettingsForbidden   = errors.New("forbidden to use security-opt settings")
+	ErrContainerCapabilitiesForbidden = errors.New("forbidden to use container capabilities")
+	ErrBindMountsForbidden            = errors.New("forbidden to use bind mounts")
+)
+
+func getInheritedResourceControlFromContainerLabels(dockerClient *client.Client, endpointID portainer.EndpointID, containerID string, resourceControls []portainer.ResourceControl) (*portainer.ResourceControl, error) {
+	container, err := dockerClient.ContainerInspect(context.Background(), containerID)
+	if err != nil {
+		return nil, err
+	}
+
+	serviceName := container.Config.Labels[consts.SwarmServiceIDLabel]
+	if serviceName != "" {
+		serviceResourceControl := authorization.GetResourceControlByResourceIDAndType(serviceName, portainer.ServiceResourceControl, resourceControls)
+		if serviceResourceControl != nil {
+			return serviceResourceControl, nil
+		}
+	}
+
+	stackResourceID := getStackResourceIDFromLabels(container.Config.Labels, endpointID)
+	if stackResourceID != "" {
+		return authorization.GetResourceControlByResourceIDAndType(stackResourceID, portainer.StackResourceControl, resourceControls), nil
+	}
+
+	return nil, nil
+}
+
+// containerListOperation extracts the response as a JSON array, loop through the containers array
+// decorate and/or filter the containers based on resource controls before rewriting the response.
+func (transport *Transport) containerListOperation(response *http.Response, executor *operationExecutor) error {
+	// ContainerList response is a JSON array
+	// https://docs.docker.com/engine/api/v1.28/#operation/ContainerList
+	responseArray, err := utils.GetResponseAsJSONArray(response)
+	if err != nil {
+		return err
+	}
+
+	resourceOperationParameters := &resourceOperationParameters{
+		resourceIdentifierAttribute: containerObjectIdentifier,
+		resourceType:                portainer.ContainerResourceControl,
+		labelsObjectSelector:        selectorContainerLabelsFromContainerListOperation,
+	}
+
+	responseArray, err = transport.applyAccessControlOnResourceList(resourceOperationParameters, responseArray, executor)
+	if err != nil {
+		return err
+	}
+
+	if executor.labelBlackList != nil {
+		responseArray, err = filterContainersWithBlackListedLabels(responseArray, executor.labelBlackList)
+		if err != nil {
+			return err
+		}
+	}
+
+	responseArray, err = transport.applyPortainerContainers(responseArray)
+	if err != nil {
+		return err
+	}
+
+	return utils.RewriteResponse(response, responseArray, http.StatusOK)
+}
+
+// containerInspectOperation extracts the response as a JSON object, verify that the user
+// has access to the container based on resource control and either rewrite an access denied response or a decorated container.
+func (transport *Transport) containerInspectOperation(response *http.Response, executor *operationExecutor) error {
+	// ContainerInspect response is a JSON object
+	// https://docs.docker.com/engine/api/v1.28/#operation/ContainerInspect
+	responseObject, err := utils.GetResponseAsJSONObject(response)
+	if err != nil {
+		return err
+	}
+
+	resourceOperationParameters := &resourceOperationParameters{
+		resourceIdentifierAttribute: containerObjectIdentifier,
+		resourceType:                portainer.ContainerResourceControl,
+		labelsObjectSelector:        selectorContainerLabelsFromContainerInspectOperation,
+	}
+
+	responseObject, _ = transport.applyPortainerContainer(responseObject)
+
+	return transport.applyAccessControlOnResource(resourceOperationParameters, responseObject, response, executor)
+}
+
+// selectorContainerLabelsFromContainerInspectOperation retrieve the labels object associated to the container object.
+// This selector is specific to the containerInspect Docker operation.
+// Labels are available under the "Config.Labels" property.
+// API schema reference: https://docs.docker.com/engine/api/v1.28/#operation/ContainerInspect
+func selectorContainerLabelsFromContainerInspectOperation(responseObject map[string]any) map[string]any {
+	containerConfigObject := utils.GetJSONObject(responseObject, "Config")
+	if containerConfigObject != nil {
+		containerLabelsObject := utils.GetJSONObject(containerConfigObject, "Labels")
+
+		return containerLabelsObject
+	}
+
+	return nil
+}
+
+// selectorContainerLabelsFromContainerListOperation retrieve the labels object associated to the container object.
+// This selector is specific to the containerList Docker operation.
+// Labels are available under the "Labels" property.
+// API schema reference: https://docs.docker.com/engine/api/v1.28/#operation/ContainerList
+func selectorContainerLabelsFromContainerListOperation(responseObject map[string]any) map[string]any {
+	containerLabelsObject := utils.GetJSONObject(responseObject, "Labels")
+
+	return containerLabelsObject
+}
+
+// filterContainersWithLabels loops through a list of containers, and filters containers that do not contains
+// any labels in the labels black list.
+func filterContainersWithBlackListedLabels(containerData []any, labelBlackList []portainer.Pair) ([]any, error) {
+	filteredContainerData := make([]any, 0)
+
+	for _, container := range containerData {
+		containerObject := container.(map[string]any)
+
+		containerLabels := selectorContainerLabelsFromContainerListOperation(containerObject)
+
+		if containerHasBlackListedLabel(containerLabels, labelBlackList) {
+			continue
+		}
+
+		filteredContainerData = append(filteredContainerData, containerObject)
+	}
+
+	return filteredContainerData, nil
+}
+
+func containerHasBlackListedLabel(containerLabels map[string]any, labelBlackList []portainer.Pair) bool {
+	for key, value := range containerLabels {
+		labelName := key
+		labelValue := value.(string)
+
+		for _, blackListedLabel := range labelBlackList {
+			if blackListedLabel.Name == labelName && blackListedLabel.Value == labelValue {
+				return true
+			}
+		}
+	}
+
+	return false
+}
+
+func (transport *Transport) decorateContainerCreationOperation(request *http.Request, resourceIdentifierAttribute string, resourceType portainer.ResourceControlType) (*http.Response, error) {
+	type PartialContainer struct {
+		HostConfig struct {
+			Privileged  bool           `json:"Privileged"`
+			PidMode     string         `json:"PidMode"`
+			Devices     []any          `json:"Devices"`
+			Sysctls     map[string]any `json:"Sysctls"`
+			SecurityOpt []string       `json:"SecurityOpt"`
+			CapAdd      []string       `json:"CapAdd"`
+			CapDrop     []string       `json:"CapDrop"`
+			Binds       []string       `json:"Binds"`
+			Mounts      []struct {
+				Type string `json:"Type"`
+			} `json:"Mounts"`
+		} `json:"HostConfig"`
+	}
+
+	forbiddenResponse := &http.Response{
+		StatusCode: http.StatusForbidden,
+		Body:       http.NoBody,
+	}
+
+	tokenData, err := security.RetrieveTokenData(request)
+	if err != nil {
+		return nil, err
+	}
+
+	isAdminOrEndpointAdmin, err := transport.isAdminOrEndpointAdmin(request)
+	if err != nil {
+		return nil, err
+	}
+
+	if !isAdminOrEndpointAdmin {
+		securitySettings, err := transport.fetchEndpointSecuritySettings()
+		if err != nil {
+			return nil, err
+		}
+
+		body, err := io.ReadAll(request.Body)
+		if err != nil {
+			return nil, err
+		}
+
+		partialContainer := &PartialContainer{}
+		if err := json.Unmarshal(body, partialContainer); err != nil {
+			return nil, err
+		}
+
+		if !securitySettings.AllowPrivilegedModeForRegularUsers && partialContainer.HostConfig.Privileged {
+			return forbiddenResponse, ErrPrivilegedModeForbidden
+		}
+
+		if !securitySettings.AllowHostNamespaceForRegularUsers && partialContainer.HostConfig.PidMode == "host" {
+			return forbiddenResponse, ErrPIDHostNamespaceForbidden
+		}
+
+		if !securitySettings.AllowDeviceMappingForRegularUsers && len(partialContainer.HostConfig.Devices) > 0 {
+			return forbiddenResponse, ErrDeviceMappingForbidden
+		}
+
+		if !securitySettings.AllowSysctlSettingForRegularUsers && len(partialContainer.HostConfig.Sysctls) > 0 {
+			return forbiddenResponse, ErrSysCtlSettingsForbidden
+		}
+
+		if !securitySettings.AllowSecurityOptForRegularUsers && len(partialContainer.HostConfig.SecurityOpt) > 0 {
+			return forbiddenResponse, ErrSecurityOptSettingsForbidden
+		}
+
+		if !securitySettings.AllowContainerCapabilitiesForRegularUsers && (len(partialContainer.HostConfig.CapAdd) > 0 || len(partialContainer.HostConfig.CapDrop) > 0) {
+			return nil, ErrContainerCapabilitiesForbidden
+		}
+
+		if !securitySettings.AllowBindMountsForRegularUsers && len(partialContainer.HostConfig.Binds) > 0 {
+			for _, bind := range partialContainer.HostConfig.Binds {
+				if strings.HasPrefix(bind, "/") {
+					return forbiddenResponse, ErrBindMountsForbidden
+				}
+			}
+		}
+
+		if !securitySettings.AllowBindMountsForRegularUsers && len(partialContainer.HostConfig.Mounts) > 0 {
+			for _, mount := range partialContainer.HostConfig.Mounts {
+				if mount.Type == "bind" {
+					return forbiddenResponse, ErrBindMountsForbidden
+				}
+			}
+		}
+
+		request.Body = io.NopCloser(bytes.NewBuffer(body))
+	}
+
+	response, err := transport.executeDockerRequest(request)
+	if err != nil {
+		return response, err
+	}
+
+	if response.StatusCode == http.StatusCreated {
+		err = transport.decorateGenericResourceCreationResponse(response, resourceIdentifierAttribute, resourceType, tokenData.ID)
+	}
+
+	return response, err
+}
+
+func (transport *Transport) decorateContainerUpdateOperation(request *http.Request, containerID string) (*http.Response, error) {
+	type PartialContainerUpdate struct {
+		Devices []any `json:"Devices"`
+	}
+
+	forbiddenResponse := &http.Response{
+		StatusCode: http.StatusForbidden,
+	}
+
+	isAdminOrEndpointAdmin, err := transport.isAdminOrEndpointAdmin(request)
+	if err != nil {
+		return nil, err
+	}
+
+	if isAdminOrEndpointAdmin {
+		return transport.restrictedResourceOperation(request, containerID, containerID, portainer.ContainerResourceControl, false)
+	}
+
+	securitySettings, err := transport.fetchEndpointSecuritySettings()
+	if err != nil {
+		return nil, err
+	}
+
+	body, err := io.ReadAll(request.Body)
+	if err != nil {
+		return nil, err
+	}
+
+	partialUpdate := &PartialContainerUpdate{}
+	if err := json.Unmarshal(body, partialUpdate); err != nil {
+		return nil, err
+	}
+
+	if !securitySettings.AllowDeviceMappingForRegularUsers && len(partialUpdate.Devices) > 0 {
+		return forbiddenResponse, ErrDeviceMappingForbidden
+	}
+
+	request.Body = io.NopCloser(bytes.NewBuffer(body))
+
+	return transport.restrictedResourceOperation(request, containerID, containerID, portainer.ContainerResourceControl, false)
+}
diff --git a/api/http/proxy/factory/docker/containers_test.go b/api/http/proxy/factory/docker/containers_test.go
new file mode 100644
index 0000000..eba7afc
--- /dev/null
+++ b/api/http/proxy/factory/docker/containers_test.go
@@ -0,0 +1,123 @@
+package docker
+
+import (
+	"bytes"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/http/security"
+
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/require"
+)
+
+func TestDecorateContainerCreationOperation_BindMounts(t *testing.T) {
+	t.Parallel()
+
+	admin := portainer.User{ID: 1, Username: "admin", Role: portainer.AdministratorRole}
+	regularUser := portainer.User{ID: 2, Username: "user", Role: portainer.StandardUserRole}
+
+	_, ds := datastore.MustNewTestStore(t, true, false)
+
+	err := ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		err := tx.User().Create(&admin)
+		require.NoError(t, err)
+
+		err = tx.User().Create(&regularUser)
+		require.NoError(t, err)
+
+		err = tx.Endpoint().Create(&portainer.Endpoint{
+			ID:   1,
+			Name: "test",
+			SecuritySettings: portainer.EndpointSecuritySettings{
+				AllowBindMountsForRegularUsers: false,
+			},
+		})
+		require.NoError(t, err)
+
+		return nil
+	})
+	require.NoError(t, err)
+
+	srv, version := mockDockerAPIServer(t, RoutesDefinition{
+		{http.MethodPost, "/containers/create"}: map[string]any{"Id": "abc123", "Warnings": []any{}},
+	})
+	defer srv.Close()
+
+	transport := &Transport{
+		endpoint:      &portainer.Endpoint{ID: 1, URL: srv.URL},
+		dataStore:     ds,
+		HTTPTransport: &http.Transport{},
+	}
+
+	adminToken := portainer.TokenData{ID: admin.ID, Username: admin.Username, Role: admin.Role}
+	userToken := portainer.TokenData{ID: regularUser.ID, Username: regularUser.Username, Role: regularUser.Role}
+
+	makeRequest := func(token portainer.TokenData, body any) *http.Request {
+		bodyBytes, err := json.Marshal(body)
+		require.NoError(t, err)
+
+		req := httptest.NewRequest(http.MethodPost, srv.URL+"/v"+version+"/containers/create", bytes.NewReader(bodyBytes))
+		req = req.WithContext(security.StoreTokenData(req, &token))
+
+		return req
+	}
+
+	// Admin bypasses security checks
+	req := makeRequest(adminToken, map[string]any{
+		"HostConfig": map[string]any{
+			"Mounts": []map[string]any{{"Type": "bind", "Source": "/", "Target": "/host"}},
+		},
+	})
+	resp, err := transport.decorateContainerCreationOperation(req, containerObjectIdentifier, portainer.ContainerResourceControl)
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+
+	err = resp.Body.Close()
+	require.NoError(t, err)
+
+	// HostConfig.Binds with an absolute path is blocked for regular users
+	req = makeRequest(userToken, map[string]any{
+		"HostConfig": map[string]any{
+			"Binds": []string{"/:/host:ro"},
+		},
+	})
+	resp, err = transport.decorateContainerCreationOperation(req, containerObjectIdentifier, portainer.ContainerResourceControl)
+	require.ErrorIs(t, err, ErrBindMountsForbidden)
+	require.NotNil(t, resp)
+	require.Equal(t, http.StatusForbidden, resp.StatusCode)
+
+	err = resp.Body.Close()
+	require.NoError(t, err)
+
+	// HostConfig.Mounts with type bind is blocked for regular users
+	req = makeRequest(userToken, map[string]any{
+		"HostConfig": map[string]any{
+			"Mounts": []map[string]any{{"Type": "bind", "Source": "/", "Target": "/host"}},
+		},
+	})
+	resp, err = transport.decorateContainerCreationOperation(req, containerObjectIdentifier, portainer.ContainerResourceControl)
+	require.ErrorIs(t, err, ErrBindMountsForbidden)
+	require.NotNil(t, resp)
+	require.Equal(t, http.StatusForbidden, resp.StatusCode)
+
+	err = resp.Body.Close()
+	require.NoError(t, err)
+
+	// HostConfig.Mounts with a non-bind type is allowed for regular users
+	req = makeRequest(userToken, map[string]any{
+		"HostConfig": map[string]any{
+			"Mounts": []map[string]any{{"Type": "volume", "Source": "myvolume", "Target": "/data"}},
+		},
+	})
+	resp, err = transport.decorateContainerCreationOperation(req, containerObjectIdentifier, portainer.ContainerResourceControl)
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}
diff --git a/api/http/proxy/factory/docker/networks.go b/api/http/proxy/factory/docker/networks.go
new file mode 100644
index 0000000..cd94478
--- /dev/null
+++ b/api/http/proxy/factory/docker/networks.go
@@ -0,0 +1,103 @@
+package docker
+
+import (
+	"context"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+
+	"github.com/docker/docker/api/types/network"
+
+	"github.com/docker/docker/client"
+
+	"github.com/portainer/portainer/api/http/proxy/factory/utils"
+	"github.com/portainer/portainer/api/internal/authorization"
+)
+
+const (
+	networkObjectIdentifier = "Id"
+	networkObjectName       = "Name"
+)
+
+func getInheritedResourceControlFromNetworkLabels(dockerClient *client.Client, endpointID portainer.EndpointID, networkID string, resourceControls []portainer.ResourceControl) (*portainer.ResourceControl, error) {
+	network, err := dockerClient.NetworkInspect(context.Background(), networkID, network.InspectOptions{})
+	if err != nil {
+		return nil, err
+	}
+
+	stackResourceID := getStackResourceIDFromLabels(network.Labels, endpointID)
+	if stackResourceID != "" {
+		return authorization.GetResourceControlByResourceIDAndType(stackResourceID, portainer.StackResourceControl, resourceControls), nil
+	}
+
+	return nil, nil
+}
+
+// networkListOperation extracts the response as a JSON object, loop through the networks array
+// decorate and/or filter the networks based on resource controls before rewriting the response.
+func (transport *Transport) networkListOperation(response *http.Response, executor *operationExecutor) error {
+	// NetworkList response is a JSON array
+	// https://docs.docker.com/engine/api/v1.28/#operation/NetworkList
+	responseArray, err := utils.GetResponseAsJSONArray(response)
+	if err != nil {
+		return err
+	}
+
+	resourceOperationParameters := &resourceOperationParameters{
+		resourceIdentifierAttribute: networkObjectIdentifier,
+		resourceType:                portainer.NetworkResourceControl,
+		labelsObjectSelector:        selectorNetworkLabels,
+	}
+
+	responseArray, err = transport.applyAccessControlOnResourceList(resourceOperationParameters, responseArray, executor)
+	if err != nil {
+		return err
+	}
+
+	return utils.RewriteResponse(response, responseArray, http.StatusOK)
+}
+
+// networkInspectOperation extracts the response as a JSON object, verify that the user
+// has access to the network based on resource control and either rewrite an access denied response or a decorated network.
+func (transport *Transport) networkInspectOperation(response *http.Response, executor *operationExecutor) error {
+	// NetworkInspect response is a JSON object
+	// https://docs.docker.com/engine/api/v1.28/#operation/NetworkInspect
+	responseObject, err := utils.GetResponseAsJSONObject(response)
+	if err != nil {
+		return err
+	}
+
+	resourceOperationParameters := &resourceOperationParameters{
+		resourceIdentifierAttribute: networkObjectIdentifier,
+		resourceType:                portainer.NetworkResourceControl,
+		labelsObjectSelector:        selectorNetworkLabels,
+	}
+
+	return transport.applyAccessControlOnResource(resourceOperationParameters, responseObject, response, executor)
+}
+
+// findSystemNetworkResourceControl will check if the network object is a system network
+// and will return a system resource control if that's the case.
+func findSystemNetworkResourceControl(networkObject map[string]any) *portainer.ResourceControl {
+	if networkObject[networkObjectName] == nil {
+		return nil
+	}
+
+	networkID := networkObject[networkObjectIdentifier].(string)
+	networkName := networkObject[networkObjectName].(string)
+
+	if networkName == "bridge" || networkName == "host" || networkName == "ingress" || networkName == "nat" || networkName == "none" {
+		return authorization.NewSystemResourceControl(networkID, portainer.NetworkResourceControl)
+	}
+
+	return nil
+}
+
+// selectorNetworkLabels retrieve the labels object associated to the network object.
+// Labels are available under the "Labels" property.
+// API schema references:
+// https://docs.docker.com/engine/api/v1.28/#operation/NetworkInspect
+// https://docs.docker.com/engine/api/v1.28/#operation/NetworkList
+func selectorNetworkLabels(responseObject map[string]any) map[string]any {
+	return utils.GetJSONObject(responseObject, "Labels")
+}
diff --git a/api/http/proxy/factory/docker/portainer.go b/api/http/proxy/factory/docker/portainer.go
new file mode 100644
index 0000000..2868d21
--- /dev/null
+++ b/api/http/proxy/factory/docker/portainer.go
@@ -0,0 +1,47 @@
+package docker
+
+import (
+	"os"
+)
+
+var portainerContainerId string
+
+func init() {
+	// use hostname as the current  portainer id
+	// Reference issue: JIRA EE-917
+	// https://social.msdn.microsoft.com/Forums/en-US/5e5bff27-7511-4fb2-9ffa-207520d0ffb8/how-to-gain-windows-container-id-in-windows-container?forum=windowscontainers
+	// Because Windows container cannot obtain container ID from /proc/self/cgroups like linux container,
+	// as a workaround, we currently use hostname as container ID.
+	portainerContainerId, _ = os.Hostname()
+}
+
+func (transport *Transport) applyPortainerContainers(resources []any) ([]any, error) {
+	decoratedResourceData := make([]any, 0)
+
+	for _, resource := range resources {
+		responseObject, ok := resource.(map[string]any)
+		if !ok {
+			decoratedResourceData = append(decoratedResourceData, resource)
+
+			continue
+		}
+
+		responseObject, _ = transport.applyPortainerContainer(responseObject)
+		decoratedResourceData = append(decoratedResourceData, responseObject)
+	}
+
+	return decoratedResourceData, nil
+}
+
+func (transport *Transport) applyPortainerContainer(resourceObject map[string]any) (map[string]any, error) {
+	resourceId, ok := resourceObject["Id"].(string)
+	if !ok {
+		return resourceObject, nil
+	}
+
+	if len(resourceId) >= 12 && resourceId[0:12] == portainerContainerId {
+		resourceObject["IsPortainer"] = true
+	}
+
+	return resourceObject, nil
+}
diff --git a/api/http/proxy/factory/docker/registry.go b/api/http/proxy/factory/docker/registry.go
new file mode 100644
index 0000000..7036853
--- /dev/null
+++ b/api/http/proxy/factory/docker/registry.go
@@ -0,0 +1,67 @@
+package docker
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/registryutils"
+)
+
+type (
+	registryAccessContext struct {
+		isAdmin         bool
+		user            *portainer.User
+		endpointID      portainer.EndpointID
+		teamMemberships []portainer.TeamMembership
+		registries      []portainer.Registry
+	}
+
+	registryAuthenticationHeader struct {
+		Username      string `json:"username"`
+		Password      string `json:"password"`
+		Serveraddress string `json:"serveraddress"`
+	}
+
+	portainerRegistryAuthenticationHeader struct {
+		RegistryId *portainer.RegistryID `json:"registryId"`
+	}
+)
+
+func createRegistryAuthenticationHeader(
+	dataStore dataservices.DataStore,
+	registryID portainer.RegistryID,
+	accessContext *registryAccessContext,
+) (authenticationHeader registryAuthenticationHeader, err error) {
+	if registryID == 0 { // dockerhub (anonymous)
+		authenticationHeader.Serveraddress = "docker.io"
+
+		return
+	}
+
+	// Any "custom" registry
+	var matchingRegistry *portainer.Registry
+
+	for _, registry := range accessContext.registries {
+		if registry.ID == registryID &&
+			(accessContext.isAdmin ||
+				security.AuthorizedRegistryAccess(&registry, accessContext.user, accessContext.teamMemberships, accessContext.endpointID)) {
+			matchingRegistry = &registry
+
+			break
+		}
+	}
+
+	if matchingRegistry == nil {
+		return
+	}
+
+	if err = registryutils.PrepareRegistryCredentials(dataStore, matchingRegistry); err != nil {
+		return
+	}
+
+	authenticationHeader.Serveraddress = matchingRegistry.URL
+	authenticationHeader.Username = matchingRegistry.Username
+	authenticationHeader.Password = matchingRegistry.Password
+
+	return
+}
diff --git a/api/http/proxy/factory/docker/secrets.go b/api/http/proxy/factory/docker/secrets.go
new file mode 100644
index 0000000..dc35502
--- /dev/null
+++ b/api/http/proxy/factory/docker/secrets.go
@@ -0,0 +1,87 @@
+package docker
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/docker/docker/client"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/proxy/factory/utils"
+	"github.com/portainer/portainer/api/internal/authorization"
+)
+
+const (
+	secretObjectIdentifier = "ID"
+)
+
+func getInheritedResourceControlFromSecretLabels(dockerClient *client.Client, endpointID portainer.EndpointID, secretID string, resourceControls []portainer.ResourceControl) (*portainer.ResourceControl, error) {
+	secret, _, err := dockerClient.SecretInspectWithRaw(context.Background(), secretID)
+	if err != nil {
+		return nil, err
+	}
+
+	stackResourceID := getStackResourceIDFromLabels(secret.Spec.Labels, endpointID)
+	if stackResourceID != "" {
+		return authorization.GetResourceControlByResourceIDAndType(stackResourceID, portainer.StackResourceControl, resourceControls), nil
+	}
+
+	return nil, nil
+}
+
+// secretListOperation extracts the response as a JSON object, loop through the secrets array
+// decorate and/or filter the secrets based on resource controls before rewriting the response.
+func (transport *Transport) secretListOperation(response *http.Response, executor *operationExecutor) error {
+	// SecretList response is a JSON array
+	// https://docs.docker.com/engine/api/v1.28/#operation/SecretList
+	responseArray, err := utils.GetResponseAsJSONArray(response)
+	if err != nil {
+		return err
+	}
+
+	resourceOperationParameters := &resourceOperationParameters{
+		resourceIdentifierAttribute: secretObjectIdentifier,
+		resourceType:                portainer.SecretResourceControl,
+		labelsObjectSelector:        selectorSecretLabels,
+	}
+
+	responseArray, err = transport.applyAccessControlOnResourceList(resourceOperationParameters, responseArray, executor)
+	if err != nil {
+		return err
+	}
+
+	return utils.RewriteResponse(response, responseArray, http.StatusOK)
+}
+
+// secretInspectOperation extracts the response as a JSON object, verify that the user
+// has access to the secret based on resource control and either rewrite an access denied response or a decorated secret.
+func (transport *Transport) secretInspectOperation(response *http.Response, executor *operationExecutor) error {
+	// SecretInspect response is a JSON object
+	// https://docs.docker.com/engine/api/v1.28/#operation/SecretInspect
+	responseObject, err := utils.GetResponseAsJSONObject(response)
+	if err != nil {
+		return err
+	}
+
+	resourceOperationParameters := &resourceOperationParameters{
+		resourceIdentifierAttribute: secretObjectIdentifier,
+		resourceType:                portainer.SecretResourceControl,
+		labelsObjectSelector:        selectorSecretLabels,
+	}
+
+	return transport.applyAccessControlOnResource(resourceOperationParameters, responseObject, response, executor)
+}
+
+// selectorSecretLabels retrieve the labels object associated to the secret object.
+// Labels are available under the "Spec.Labels" property.
+// API schema references:
+// https://docs.docker.com/engine/api/v1.37/#operation/SecretList
+// https://docs.docker.com/engine/api/v1.37/#operation/SecretInspect
+func selectorSecretLabels(responseObject map[string]any) map[string]any {
+	secretSpec := utils.GetJSONObject(responseObject, "Spec")
+	if secretSpec != nil {
+		secretLabelsObject := utils.GetJSONObject(secretSpec, "Labels")
+		return secretLabelsObject
+	}
+	return nil
+}
diff --git a/api/http/proxy/factory/docker/services.go b/api/http/proxy/factory/docker/services.go
new file mode 100644
index 0000000..5949651
--- /dev/null
+++ b/api/http/proxy/factory/docker/services.go
@@ -0,0 +1,218 @@
+package docker
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/proxy/factory/utils"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/logs"
+
+	"github.com/docker/docker/api/types/swarm"
+	"github.com/docker/docker/client"
+	"github.com/segmentio/encoding/json"
+)
+
+const serviceObjectIdentifier = "ID"
+
+type partialServiceSpec struct {
+	TaskTemplate struct {
+		ContainerSpec struct {
+			CapabilityAdd  []string       `json:"CapabilityAdd"`
+			CapabilityDrop []string       `json:"CapabilityDrop"`
+			Sysctls        map[string]any `json:"Sysctls"`
+			Privileges     *struct {
+				Seccomp  *struct{ Mode string } `json:"Seccomp"`
+				AppArmor *struct{ Mode string } `json:"AppArmor"`
+			} `json:"Privileges"`
+			Mounts []struct {
+				Type          string `json:"Type"`
+				VolumeOptions *struct {
+					DriverConfig *struct {
+						Options map[string]string `json:"Options"`
+					} `json:"DriverConfig"`
+				} `json:"VolumeOptions"`
+			} `json:"Mounts"`
+		} `json:"ContainerSpec"`
+	} `json:"TaskTemplate"`
+}
+
+func CheckServiceBodyRestrictions(request *http.Request, securitySettings *portainer.EndpointSecuritySettings) error {
+	defer logs.CloseAndLogErr(request.Body)
+
+	body, err := io.ReadAll(request.Body)
+	if err != nil {
+		return err
+	}
+
+	spec := &partialServiceSpec{}
+	if err := json.Unmarshal(body, spec); err != nil {
+		return err
+	}
+
+	containerSpec := spec.TaskTemplate.ContainerSpec
+
+	if !securitySettings.AllowContainerCapabilitiesForRegularUsers && (len(containerSpec.CapabilityAdd) > 0 || len(containerSpec.CapabilityDrop) > 0) {
+		return ErrContainerCapabilitiesForbidden
+	}
+
+	if !securitySettings.AllowSysctlSettingForRegularUsers && len(containerSpec.Sysctls) > 0 {
+		return ErrSysCtlSettingsForbidden
+	}
+
+	if !securitySettings.AllowSecurityOptForRegularUsers && containerSpec.Privileges != nil {
+		if containerSpec.Privileges.Seccomp != nil || containerSpec.Privileges.AppArmor != nil {
+			return ErrSecurityOptSettingsForbidden
+		}
+	}
+
+	if !securitySettings.AllowBindMountsForRegularUsers {
+		for _, mount := range containerSpec.Mounts {
+			if mount.Type == "bind" {
+				return ErrBindMountsForbidden
+			}
+
+			if mount.VolumeOptions != nil && mount.VolumeOptions.DriverConfig != nil {
+				if mount.VolumeOptions.DriverConfig.Options["type"] == "bind" {
+					return ErrBindMountsForbidden
+				}
+			}
+		}
+	}
+
+	request.Body = io.NopCloser(bytes.NewBuffer(body))
+
+	return nil
+}
+
+func getInheritedResourceControlFromServiceLabels(dockerClient *client.Client, endpointID portainer.EndpointID, serviceID string, resourceControls []portainer.ResourceControl) (*portainer.ResourceControl, error) {
+	service, _, err := dockerClient.ServiceInspectWithRaw(context.Background(), serviceID, swarm.ServiceInspectOptions{})
+	if err != nil {
+		return nil, err
+	}
+
+	stackResourceID := getStackResourceIDFromLabels(service.Spec.Labels, endpointID)
+	if stackResourceID != "" {
+		return authorization.GetResourceControlByResourceIDAndType(stackResourceID, portainer.StackResourceControl, resourceControls), nil
+	}
+
+	return nil, nil
+}
+
+// serviceListOperation extracts the response as a JSON array, loop through the service array
+// decorate and/or filter the services based on resource controls before rewriting the response.
+func (transport *Transport) serviceListOperation(response *http.Response, executor *operationExecutor) error {
+	// ServiceList response is a JSON array
+	// https://docs.docker.com/engine/api/v1.28/#operation/ServiceList
+	responseArray, err := utils.GetResponseAsJSONArray(response)
+	if err != nil {
+		return err
+	}
+
+	resourceOperationParameters := &resourceOperationParameters{
+		resourceIdentifierAttribute: serviceObjectIdentifier,
+		resourceType:                portainer.ServiceResourceControl,
+		labelsObjectSelector:        selectorServiceLabels,
+	}
+
+	responseArray, err = transport.applyAccessControlOnResourceList(resourceOperationParameters, responseArray, executor)
+	if err != nil {
+		return err
+	}
+
+	return utils.RewriteResponse(response, responseArray, http.StatusOK)
+}
+
+// serviceInspectOperation extracts the response as a JSON object, verify that the user
+// has access to the service based on resource control and either rewrite an access denied response or a decorated service.
+func (transport *Transport) serviceInspectOperation(response *http.Response, executor *operationExecutor) error {
+	// ServiceInspect response is a JSON object
+	// https://docs.docker.com/engine/api/v1.28/#operation/ServiceInspect
+	responseObject, err := utils.GetResponseAsJSONObject(response)
+	if err != nil {
+		return err
+	}
+
+	resourceOperationParameters := &resourceOperationParameters{
+		resourceIdentifierAttribute: serviceObjectIdentifier,
+		resourceType:                portainer.ServiceResourceControl,
+		labelsObjectSelector:        selectorServiceLabels,
+	}
+
+	return transport.applyAccessControlOnResource(resourceOperationParameters, responseObject, response, executor)
+}
+
+// selectorServiceLabels retrieve the labels object associated to the service object.
+// Labels are available under the "Spec.Labels" property.
+// API schema references:
+// https://docs.docker.com/engine/api/v1.28/#operation/ServiceInspect
+// https://docs.docker.com/engine/api/v1.28/#operation/ServiceList
+func selectorServiceLabels(responseObject map[string]any) map[string]any {
+	serviceSpecObject := utils.GetJSONObject(responseObject, "Spec")
+	if serviceSpecObject != nil {
+		return utils.GetJSONObject(serviceSpecObject, "Labels")
+	}
+
+	return nil
+}
+
+func (transport *Transport) decorateServiceCreationOperation(request *http.Request) (*http.Response, error) {
+	isAdminOrEndpointAdmin, err := transport.isAdminOrEndpointAdmin(request)
+	if err != nil {
+		return nil, err
+	}
+
+	if isAdminOrEndpointAdmin {
+		return transport.replaceRegistryAuthenticationHeader(request)
+	}
+
+	securitySettings, err := transport.fetchEndpointSecuritySettings()
+	if err != nil {
+		return nil, err
+	}
+
+	if err := CheckServiceBodyRestrictions(request, securitySettings); err != nil {
+		return &http.Response{
+			StatusCode: http.StatusForbidden,
+			Body:       io.NopCloser(bytes.NewBufferString("Access denied: insufficient permissions to create service with specified configuration")),
+		}, err
+	}
+
+	return transport.replaceRegistryAuthenticationHeader(request)
+}
+
+func (transport *Transport) decorateServiceUpdateOperation(request *http.Request, serviceID string) (*http.Response, error) {
+	isAdminOrEndpointAdmin, err := transport.isAdminOrEndpointAdmin(request)
+	if err != nil {
+		return nil, err
+	}
+
+	if isAdminOrEndpointAdmin {
+		if err := transport.decorateRegistryAuthenticationHeader(request); err != nil {
+			return nil, err
+		}
+
+		return transport.executeDockerRequest(request)
+	}
+
+	securitySettings, err := transport.fetchEndpointSecuritySettings()
+	if err != nil {
+		return nil, err
+	}
+
+	if err := CheckServiceBodyRestrictions(request, securitySettings); err != nil {
+		return &http.Response{
+			StatusCode: http.StatusForbidden,
+			Body:       io.NopCloser(bytes.NewBufferString("Access denied: insufficient permissions to update service with specified configuration")),
+		}, err
+	}
+
+	if err := transport.decorateRegistryAuthenticationHeader(request); err != nil {
+		return nil, err
+	}
+
+	return transport.restrictedResourceOperation(request, serviceID, serviceID, portainer.ServiceResourceControl, false)
+}
diff --git a/api/http/proxy/factory/docker/services_test.go b/api/http/proxy/factory/docker/services_test.go
new file mode 100644
index 0000000..53ca4f8
--- /dev/null
+++ b/api/http/proxy/factory/docker/services_test.go
@@ -0,0 +1,644 @@
+package docker
+
+import (
+	"bytes"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/http/security"
+
+	"github.com/docker/docker/api/types/mount"
+	"github.com/docker/docker/api/types/swarm"
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/require"
+)
+
+const serviceCreationAPIVersion = "1.51"
+
+type serviceCreationFixtures struct {
+	dockerSrv  *httptest.Server
+	ds         dataservices.DataStore
+	stdUser    portainer.User
+	adminUser  portainer.User
+	endpointID portainer.EndpointID
+}
+
+func newServiceCreationFixtures(t *testing.T) *serviceCreationFixtures {
+	t.Helper()
+
+	const serviceID = "some-service-id"
+
+	dockerSrv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == http.MethodHead && r.URL.Path == "/_ping" {
+			w.Header().Add("Api-Version", serviceCreationAPIVersion)
+			_, _ = w.Write([]byte{})
+
+			return
+		}
+
+		if r.Method == http.MethodPost {
+			data, err := json.Marshal(map[string]string{"ID": serviceID})
+			if err != nil {
+				http.Error(w, err.Error(), http.StatusInternalServerError)
+
+				return
+			}
+
+			w.Header().Set("Content-Type", "application/json")
+			w.WriteHeader(http.StatusCreated)
+			_, _ = w.Write(data)
+
+			return
+		}
+
+		http.NotFound(w, r)
+	}))
+	t.Cleanup(dockerSrv.Close)
+
+	_, store := datastore.MustNewTestStore(t, true, false)
+
+	f := &serviceCreationFixtures{
+		dockerSrv:  dockerSrv,
+		ds:         store,
+		stdUser:    portainer.User{ID: 1, Username: "std", Role: portainer.StandardUserRole},
+		adminUser:  portainer.User{ID: 2, Username: "admin", Role: portainer.AdministratorRole},
+		endpointID: portainer.EndpointID(1),
+	}
+
+	err := store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		err := tx.User().Create(&f.stdUser)
+		require.NoError(t, err)
+
+		err = tx.User().Create(&f.adminUser)
+		require.NoError(t, err)
+
+		err = tx.Endpoint().Create(&portainer.Endpoint{ID: f.endpointID, Name: "test-env"})
+		require.NoError(t, err)
+
+		return nil
+	})
+	require.NoError(t, err)
+
+	return f
+}
+
+func (f *serviceCreationFixtures) setSecuritySettings(t *testing.T, settings portainer.EndpointSecuritySettings) {
+	t.Helper()
+
+	err := f.ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.Endpoint().UpdateEndpoint(f.endpointID, &portainer.Endpoint{
+			ID:               f.endpointID,
+			Name:             "test-env",
+			SecuritySettings: settings,
+		})
+	})
+	require.NoError(t, err)
+}
+
+func (f *serviceCreationFixtures) newTransport() *Transport {
+	return &Transport{
+		endpoint:      &portainer.Endpoint{ID: f.endpointID},
+		dataStore:     f.ds,
+		HTTPTransport: &http.Transport{},
+	}
+}
+
+func (f *serviceCreationFixtures) newRequest(t *testing.T, spec swarm.ServiceSpec, user portainer.User) *http.Request {
+	t.Helper()
+
+	data, err := json.Marshal(spec)
+	require.NoError(t, err)
+
+	req, err := http.NewRequestWithContext(
+		t.Context(),
+		http.MethodPost,
+		f.dockerSrv.URL+"/v"+serviceCreationAPIVersion+"/services/create",
+		bytes.NewReader(data),
+	)
+	require.NoError(t, err)
+
+	return req.WithContext(security.StoreTokenData(req, &portainer.TokenData{
+		ID:       user.ID,
+		Username: user.Username,
+		Role:     user.Role,
+	}))
+}
+
+var (
+	restrictiveSettings = portainer.EndpointSecuritySettings{
+		AllowContainerCapabilitiesForRegularUsers: false,
+		AllowSysctlSettingForRegularUsers:         false,
+		AllowSecurityOptForRegularUsers:           false,
+		AllowBindMountsForRegularUsers:            false,
+	}
+
+	permissiveSettings = portainer.EndpointSecuritySettings{
+		AllowContainerCapabilitiesForRegularUsers: true,
+		AllowSysctlSettingForRegularUsers:         true,
+		AllowSecurityOptForRegularUsers:           true,
+		AllowBindMountsForRegularUsers:            true,
+	}
+)
+
+func TestDecorateServiceCreationOperation_CapabilityAddForbidden(t *testing.T) {
+	t.Parallel()
+
+	f := newServiceCreationFixtures(t)
+	f.setSecuritySettings(t, restrictiveSettings)
+
+	spec := swarm.ServiceSpec{
+		TaskTemplate: swarm.TaskSpec{
+			ContainerSpec: &swarm.ContainerSpec{
+				CapabilityAdd: []string{"NET_ADMIN"},
+			},
+		},
+	}
+
+	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.stdUser))
+	require.ErrorIs(t, err, ErrContainerCapabilitiesForbidden)
+	require.NotNil(t, resp)
+	require.Equal(t, http.StatusForbidden, resp.StatusCode)
+
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}
+
+func TestDecorateServiceCreationOperation_CapabilityDropForbidden(t *testing.T) {
+	t.Parallel()
+
+	f := newServiceCreationFixtures(t)
+	f.setSecuritySettings(t, restrictiveSettings)
+
+	spec := swarm.ServiceSpec{
+		TaskTemplate: swarm.TaskSpec{
+			ContainerSpec: &swarm.ContainerSpec{
+				CapabilityDrop: []string{"MKNOD"},
+			},
+		},
+	}
+
+	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.stdUser))
+	require.ErrorIs(t, err, ErrContainerCapabilitiesForbidden)
+	require.NotNil(t, resp)
+	require.Equal(t, http.StatusForbidden, resp.StatusCode)
+
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}
+
+func TestDecorateServiceCreationOperation_CapabilitiesAllowed(t *testing.T) {
+	t.Parallel()
+
+	f := newServiceCreationFixtures(t)
+	f.setSecuritySettings(t, permissiveSettings)
+
+	spec := swarm.ServiceSpec{
+		TaskTemplate: swarm.TaskSpec{
+			ContainerSpec: &swarm.ContainerSpec{
+				CapabilityAdd: []string{"NET_ADMIN"},
+			},
+		},
+	}
+
+	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.stdUser))
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+	require.NotEqual(t, http.StatusForbidden, resp.StatusCode)
+
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}
+
+func TestDecorateServiceCreationOperation_NoCapabilitiesAllowed(t *testing.T) {
+	t.Parallel()
+
+	f := newServiceCreationFixtures(t)
+	f.setSecuritySettings(t, restrictiveSettings)
+
+	var spec swarm.ServiceSpec
+
+	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.stdUser))
+	require.NotErrorIs(t, err, ErrContainerCapabilitiesForbidden)
+	require.NotNil(t, resp)
+	require.NotEqual(t, http.StatusForbidden, resp.StatusCode)
+
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}
+
+func TestDecorateServiceCreationOperation_SysctlForbidden(t *testing.T) {
+	t.Parallel()
+
+	f := newServiceCreationFixtures(t)
+	f.setSecuritySettings(t, restrictiveSettings)
+
+	spec := swarm.ServiceSpec{
+		TaskTemplate: swarm.TaskSpec{
+			ContainerSpec: &swarm.ContainerSpec{
+				Sysctls: map[string]string{"net.ipv4.ip_forward": "1"},
+			},
+		},
+	}
+
+	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.stdUser))
+	require.ErrorIs(t, err, ErrSysCtlSettingsForbidden)
+	require.NotNil(t, resp)
+	require.Equal(t, http.StatusForbidden, resp.StatusCode)
+
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}
+
+func TestDecorateServiceCreationOperation_SysctlAllowed(t *testing.T) {
+	t.Parallel()
+
+	f := newServiceCreationFixtures(t)
+	f.setSecuritySettings(t, permissiveSettings)
+
+	spec := swarm.ServiceSpec{
+		TaskTemplate: swarm.TaskSpec{
+			ContainerSpec: &swarm.ContainerSpec{
+				Sysctls: map[string]string{"net.ipv4.ip_forward": "1"},
+			},
+		},
+	}
+
+	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.stdUser))
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+	require.NotEqual(t, http.StatusForbidden, resp.StatusCode)
+
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}
+
+func TestDecorateServiceCreationOperation_SeccompForbidden(t *testing.T) {
+	t.Parallel()
+
+	f := newServiceCreationFixtures(t)
+	f.setSecuritySettings(t, restrictiveSettings)
+
+	spec := swarm.ServiceSpec{
+		TaskTemplate: swarm.TaskSpec{
+			ContainerSpec: &swarm.ContainerSpec{
+				Privileges: &swarm.Privileges{
+					Seccomp: &swarm.SeccompOpts{Mode: swarm.SeccompModeCustom},
+				},
+			},
+		},
+	}
+
+	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.stdUser))
+	require.ErrorIs(t, err, ErrSecurityOptSettingsForbidden)
+	require.NotNil(t, resp)
+	require.Equal(t, http.StatusForbidden, resp.StatusCode)
+
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}
+
+func TestDecorateServiceCreationOperation_AppArmorForbidden(t *testing.T) {
+	t.Parallel()
+
+	f := newServiceCreationFixtures(t)
+	f.setSecuritySettings(t, restrictiveSettings)
+
+	spec := swarm.ServiceSpec{
+		TaskTemplate: swarm.TaskSpec{
+			ContainerSpec: &swarm.ContainerSpec{
+				Privileges: &swarm.Privileges{
+					AppArmor: &swarm.AppArmorOpts{Mode: swarm.AppArmorModeDefault},
+				},
+			},
+		},
+	}
+
+	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.stdUser))
+	require.ErrorIs(t, err, ErrSecurityOptSettingsForbidden)
+	require.NotNil(t, resp)
+	require.Equal(t, http.StatusForbidden, resp.StatusCode)
+
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}
+
+func TestDecorateServiceCreationOperation_NilPrivilegesNotForbidden(t *testing.T) {
+	t.Parallel()
+
+	f := newServiceCreationFixtures(t)
+	f.setSecuritySettings(t, restrictiveSettings)
+
+	var spec swarm.ServiceSpec
+
+	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.stdUser))
+	require.NotErrorIs(t, err, ErrSecurityOptSettingsForbidden)
+	require.NotNil(t, resp)
+	require.NotEqual(t, http.StatusForbidden, resp.StatusCode)
+
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}
+
+func TestDecorateServiceCreationOperation_PrivilegesWithNilSeccompAndAppArmorNotForbidden(t *testing.T) {
+	t.Parallel()
+
+	f := newServiceCreationFixtures(t)
+	f.setSecuritySettings(t, restrictiveSettings)
+
+	spec := swarm.ServiceSpec{
+		TaskTemplate: swarm.TaskSpec{
+			ContainerSpec: &swarm.ContainerSpec{
+				Privileges: &swarm.Privileges{},
+			},
+		},
+	}
+
+	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.stdUser))
+	require.NotErrorIs(t, err, ErrSecurityOptSettingsForbidden)
+	require.NotNil(t, resp)
+	require.NotEqual(t, http.StatusForbidden, resp.StatusCode)
+
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}
+
+func TestDecorateServiceCreationOperation_PrivilegesAllowed(t *testing.T) {
+	t.Parallel()
+
+	f := newServiceCreationFixtures(t)
+	f.setSecuritySettings(t, permissiveSettings)
+
+	spec := swarm.ServiceSpec{
+		TaskTemplate: swarm.TaskSpec{
+			ContainerSpec: &swarm.ContainerSpec{
+				Privileges: &swarm.Privileges{
+					Seccomp: &swarm.SeccompOpts{Mode: swarm.SeccompModeCustom},
+				},
+			},
+		},
+	}
+
+	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.stdUser))
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+	require.NotEqual(t, http.StatusForbidden, resp.StatusCode)
+
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}
+
+func TestDecorateServiceCreationOperation_BindMountForbidden(t *testing.T) {
+	t.Parallel()
+
+	f := newServiceCreationFixtures(t)
+	f.setSecuritySettings(t, restrictiveSettings)
+
+	spec := swarm.ServiceSpec{
+		TaskTemplate: swarm.TaskSpec{
+			ContainerSpec: &swarm.ContainerSpec{
+				Mounts: []mount.Mount{{Type: mount.TypeBind}},
+			},
+		},
+	}
+
+	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.stdUser))
+	require.ErrorIs(t, err, ErrBindMountsForbidden)
+	require.NotNil(t, resp)
+	require.Equal(t, http.StatusForbidden, resp.StatusCode)
+
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}
+
+func TestDecorateServiceCreationOperation_NonBindMountNotForbidden(t *testing.T) {
+	t.Parallel()
+
+	f := newServiceCreationFixtures(t)
+
+	f.setSecuritySettings(t, portainer.EndpointSecuritySettings{
+		AllowContainerCapabilitiesForRegularUsers: true,
+		AllowSysctlSettingForRegularUsers:         true,
+		AllowSecurityOptForRegularUsers:           true,
+		AllowBindMountsForRegularUsers:            false,
+	})
+
+	spec := swarm.ServiceSpec{
+		TaskTemplate: swarm.TaskSpec{
+			ContainerSpec: &swarm.ContainerSpec{
+				Mounts: []mount.Mount{{Type: mount.TypeVolume}},
+			},
+		},
+	}
+
+	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.stdUser))
+	require.NotErrorIs(t, err, ErrBindMountsForbidden)
+	require.NotNil(t, resp)
+	require.NotEqual(t, http.StatusForbidden, resp.StatusCode)
+
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}
+
+func TestDecorateServiceCreationOperation_BindMountAllowed(t *testing.T) {
+	t.Parallel()
+
+	f := newServiceCreationFixtures(t)
+	f.setSecuritySettings(t, permissiveSettings)
+
+	spec := swarm.ServiceSpec{
+		TaskTemplate: swarm.TaskSpec{
+			ContainerSpec: &swarm.ContainerSpec{
+				Mounts: []mount.Mount{{Type: mount.TypeBind}},
+			},
+		},
+	}
+
+	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.stdUser))
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+	require.NotEqual(t, http.StatusForbidden, resp.StatusCode)
+
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}
+
+func TestDecorateServiceCreationOperation_AdminBypassesAllSecurityChecks(t *testing.T) {
+	t.Parallel()
+
+	f := newServiceCreationFixtures(t)
+	f.setSecuritySettings(t, restrictiveSettings)
+
+	spec := swarm.ServiceSpec{
+		TaskTemplate: swarm.TaskSpec{
+			ContainerSpec: &swarm.ContainerSpec{
+				CapabilityAdd:  []string{"NET_ADMIN"},
+				CapabilityDrop: []string{"MKNOD"},
+				Sysctls:        map[string]string{"net.ipv4.ip_forward": "1"},
+				Privileges: &swarm.Privileges{
+					Seccomp: &swarm.SeccompOpts{Mode: swarm.SeccompModeCustom},
+				},
+				Mounts: []mount.Mount{{Type: mount.TypeBind}},
+			},
+		},
+	}
+
+	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.adminUser))
+	require.NotErrorIs(t, err, ErrContainerCapabilitiesForbidden)
+	require.NotErrorIs(t, err, ErrSysCtlSettingsForbidden)
+	require.NotErrorIs(t, err, ErrSecurityOptSettingsForbidden)
+	require.NotErrorIs(t, err, ErrBindMountsForbidden)
+	require.NotNil(t, resp)
+	require.NotEqual(t, http.StatusForbidden, resp.StatusCode)
+
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}
+
+func TestDecorateServiceCreationOperation_StandardUserPermissiveSettingsSucceeds(t *testing.T) {
+	t.Parallel()
+
+	f := newServiceCreationFixtures(t)
+	f.setSecuritySettings(t, permissiveSettings)
+
+	spec := swarm.ServiceSpec{
+		TaskTemplate: swarm.TaskSpec{
+			ContainerSpec: &swarm.ContainerSpec{
+				CapabilityAdd: []string{"NET_ADMIN"},
+				Sysctls:       map[string]string{"net.core.somaxconn": "128"},
+				Mounts:        []mount.Mount{{Type: mount.TypeBind}},
+			},
+		},
+	}
+
+	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.stdUser))
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+	require.Equal(t, http.StatusCreated, resp.StatusCode)
+
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}
+
+func TestDecorateServiceCreationOperation_VolumeWithBindDriverOptionForbidden(t *testing.T) {
+	t.Parallel()
+
+	f := newServiceCreationFixtures(t)
+	f.setSecuritySettings(t, restrictiveSettings)
+
+	spec := swarm.ServiceSpec{
+		TaskTemplate: swarm.TaskSpec{
+			ContainerSpec: &swarm.ContainerSpec{
+				Mounts: []mount.Mount{{
+					Type: mount.TypeVolume,
+					VolumeOptions: &mount.VolumeOptions{
+						DriverConfig: &mount.Driver{
+							Options: map[string]string{"type": "bind", "device": "/etc"},
+						},
+					},
+				}},
+			},
+		},
+	}
+
+	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.stdUser))
+	require.ErrorIs(t, err, ErrBindMountsForbidden)
+	require.NotNil(t, resp)
+	require.Equal(t, http.StatusForbidden, resp.StatusCode)
+
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}
+
+func TestDecorateServiceCreationOperation_VolumeWithBindDriverOptionAllowed(t *testing.T) {
+	t.Parallel()
+
+	f := newServiceCreationFixtures(t)
+	f.setSecuritySettings(t, permissiveSettings)
+
+	spec := swarm.ServiceSpec{
+		TaskTemplate: swarm.TaskSpec{
+			ContainerSpec: &swarm.ContainerSpec{
+				Mounts: []mount.Mount{{
+					Type: mount.TypeVolume,
+					VolumeOptions: &mount.VolumeOptions{
+						DriverConfig: &mount.Driver{
+							Options: map[string]string{"type": "bind", "device": "/etc"},
+						},
+					},
+				}},
+			},
+		},
+	}
+
+	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.stdUser))
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+	require.NotEqual(t, http.StatusForbidden, resp.StatusCode)
+
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}
+
+func TestDecorateServiceCreationOperation_VolumeWithNonBindDriverOptionNotForbidden(t *testing.T) {
+	t.Parallel()
+
+	f := newServiceCreationFixtures(t)
+	f.setSecuritySettings(t, restrictiveSettings)
+
+	spec := swarm.ServiceSpec{
+		TaskTemplate: swarm.TaskSpec{
+			ContainerSpec: &swarm.ContainerSpec{
+				Mounts: []mount.Mount{{
+					Type: mount.TypeVolume,
+					VolumeOptions: &mount.VolumeOptions{
+						DriverConfig: &mount.Driver{
+							Options: map[string]string{"type": "tmpfs"},
+						},
+					},
+				}},
+			},
+		},
+	}
+
+	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.stdUser))
+	require.NotErrorIs(t, err, ErrBindMountsForbidden)
+	require.NotNil(t, resp)
+	require.NotEqual(t, http.StatusForbidden, resp.StatusCode)
+
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}
+
+func TestDecorateServiceUpdateOperation_VolumeWithBindDriverOptionForbidden(t *testing.T) {
+	t.Parallel()
+
+	f := newServiceCreationFixtures(t)
+	f.setSecuritySettings(t, restrictiveSettings)
+
+	spec := swarm.ServiceSpec{
+		TaskTemplate: swarm.TaskSpec{
+			ContainerSpec: &swarm.ContainerSpec{
+				Mounts: []mount.Mount{{
+					Type: mount.TypeVolume,
+					VolumeOptions: &mount.VolumeOptions{
+						DriverConfig: &mount.Driver{
+							Options: map[string]string{"type": "bind", "device": "/etc"},
+						},
+					},
+				}},
+			},
+		},
+	}
+
+	resp, err := f.newTransport().decorateServiceUpdateOperation(f.newRequest(t, spec, f.stdUser), "test-service-id")
+	require.ErrorIs(t, err, ErrBindMountsForbidden)
+	require.NotNil(t, resp)
+	require.Equal(t, http.StatusForbidden, resp.StatusCode)
+
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}
diff --git a/api/http/proxy/factory/docker/swarm.go b/api/http/proxy/factory/docker/swarm.go
new file mode 100644
index 0000000..be39a4b
--- /dev/null
+++ b/api/http/proxy/factory/docker/swarm.go
@@ -0,0 +1,25 @@
+package docker
+
+import (
+	"net/http"
+
+	"github.com/portainer/portainer/api/http/proxy/factory/utils"
+)
+
+// swarmInspectOperation extracts the response as a JSON object and rewrites the response based
+// on the current user role. Sensitive fields are deleted from the response for non-administrator users.
+func swarmInspectOperation(response *http.Response, executor *operationExecutor) error {
+	// SwarmInspect response is a JSON object
+	// https://docs.docker.com/engine/api/v1.30/#operation/SwarmInspect
+	responseObject, err := utils.GetResponseAsJSONObject(response)
+	if err != nil {
+		return err
+	}
+
+	if !executor.operationContext.isAdmin {
+		delete(responseObject, "JoinTokens")
+		delete(responseObject, "TLSInfo")
+	}
+
+	return utils.RewriteResponse(response, responseObject, http.StatusOK)
+}
diff --git a/api/http/proxy/factory/docker/tasks.go b/api/http/proxy/factory/docker/tasks.go
new file mode 100644
index 0000000..d52dfe9
--- /dev/null
+++ b/api/http/proxy/factory/docker/tasks.go
@@ -0,0 +1,49 @@
+package docker
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/proxy/factory/utils"
+)
+
+const taskServiceObjectIdentifier = "ServiceID"
+
+// taskListOperation extracts the response as a JSON array, loop through the tasks array
+// and filter the containers based on resource controls before rewriting the response.
+func (transport *Transport) taskListOperation(response *http.Response, executor *operationExecutor) error {
+	// TaskList response is a JSON array
+	// https://docs.docker.com/engine/api/v1.28/#operation/TaskList
+	responseArray, err := utils.GetResponseAsJSONArray(response)
+	if err != nil {
+		return err
+	}
+
+	resourceOperationParameters := &resourceOperationParameters{
+		resourceIdentifierAttribute: taskServiceObjectIdentifier,
+		resourceType:                portainer.ServiceResourceControl,
+		labelsObjectSelector:        selectorTaskLabels,
+	}
+
+	responseArray, err = transport.applyAccessControlOnResourceList(resourceOperationParameters, responseArray, executor)
+	if err != nil {
+		return err
+	}
+
+	return utils.RewriteResponse(response, responseArray, http.StatusOK)
+}
+
+// selectorServiceLabels retrieve the labels object associated to the task object.
+// Labels are available under the "Spec.ContainerSpec.Labels" property.
+// API schema reference: https://docs.docker.com/engine/api/v1.28/#operation/TaskList
+func selectorTaskLabels(responseObject map[string]any) map[string]any {
+	taskSpecObject := utils.GetJSONObject(responseObject, "Spec")
+	if taskSpecObject != nil {
+		containerSpecObject := utils.GetJSONObject(taskSpecObject, "ContainerSpec")
+		if containerSpecObject != nil {
+			return utils.GetJSONObject(containerSpecObject, "Labels")
+		}
+	}
+
+	return nil
+}
diff --git a/api/http/proxy/factory/docker/transport.go b/api/http/proxy/factory/docker/transport.go
new file mode 100644
index 0000000..bef0ac7
--- /dev/null
+++ b/api/http/proxy/factory/docker/transport.go
@@ -0,0 +1,979 @@
+package docker
+
+import (
+	"bytes"
+	"context"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"path"
+	"regexp"
+	"strconv"
+	"strings"
+	"sync"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/docker/client"
+	"github.com/portainer/portainer/api/http/proxy/factory/utils"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/logs"
+	"github.com/portainer/portainer/api/slicesx"
+	"github.com/portainer/portainer/pkg/libhttp/ssrf"
+
+	"github.com/docker/docker/api/types/network"
+	"github.com/docker/docker/api/types/swarm"
+	dockerclient "github.com/docker/docker/client"
+	"github.com/rs/zerolog/log"
+	"github.com/segmentio/encoding/json"
+)
+
+var apiVersionRe = regexp.MustCompile(`(/v[0-9]\.[0-9]*)?`)
+
+type (
+	// Transport is a custom transport for Docker API reverse proxy. It allows
+	// interception of requests and rewriting of responses.
+	Transport struct {
+		HTTPTransport        *http.Transport
+		endpoint             *portainer.Endpoint
+		dataStore            dataservices.DataStore
+		signatureService     portainer.DigitalSignatureService
+		reverseTunnelService portainer.ReverseTunnelService
+		dockerClientFactory  *client.ClientFactory
+		gitService           portainer.GitService
+		snapshotService      portainer.SnapshotService
+		dockerID             string
+		mu                   sync.Mutex
+	}
+
+	// TransportParameters is used to create a new Transport
+	TransportParameters struct {
+		Endpoint             *portainer.Endpoint
+		DataStore            dataservices.DataStore
+		SignatureService     portainer.DigitalSignatureService
+		ReverseTunnelService portainer.ReverseTunnelService
+		DockerClientFactory  *client.ClientFactory
+	}
+
+	restrictedDockerOperationContext struct {
+		isAdmin          bool
+		userID           portainer.UserID
+		userTeamIDs      []portainer.TeamID
+		resourceControls []portainer.ResourceControl
+	}
+
+	operationExecutor struct {
+		operationContext *restrictedDockerOperationContext
+		labelBlackList   []portainer.Pair
+	}
+
+	restrictedOperationRequest func(*http.Response, *operationExecutor) error
+	operationRequest           func(*http.Request) error
+)
+
+// NewTransport returns a pointer to a new Transport instance.
+func NewTransport(parameters *TransportParameters, httpTransport *http.Transport, gitService portainer.GitService, snapshotService portainer.SnapshotService) (*Transport, error) {
+	transport := &Transport{
+		endpoint:             parameters.Endpoint,
+		dataStore:            parameters.DataStore,
+		signatureService:     parameters.SignatureService,
+		reverseTunnelService: parameters.ReverseTunnelService,
+		dockerClientFactory:  parameters.DockerClientFactory,
+		HTTPTransport:        httpTransport,
+		gitService:           gitService,
+		snapshotService:      snapshotService,
+	}
+
+	return transport, nil
+}
+
+// RoundTrip is the implementation of the http.RoundTripper interface
+func (transport *Transport) RoundTrip(request *http.Request) (*http.Response, error) {
+	return transport.ProxyDockerRequest(request)
+}
+
+var prefixProxyFuncMap = map[string]func(*Transport, *http.Request, string) (*http.Response, error){
+	"build":      (*Transport).proxyBuildRequest,
+	"configs":    (*Transport).proxyConfigRequest,
+	"containers": (*Transport).proxyContainerRequest,
+	"exec":       (*Transport).proxyExecRequest,
+	"images":     (*Transport).proxyImageRequest,
+	"networks":   (*Transport).proxyNetworkRequest,
+	"nodes":      (*Transport).proxyNodeRequest,
+	"secrets":    (*Transport).proxySecretRequest,
+	"services":   (*Transport).proxyServiceRequest,
+	"swarm":      (*Transport).proxySwarmRequest,
+	"tasks":      (*Transport).proxyTaskRequest,
+	"v2":         (*Transport).proxyAgentRequest,
+	"volumes":    (*Transport).proxyVolumeRequest,
+}
+
+type route struct {
+	method  string
+	pattern *regexp.Regexp
+}
+
+var adminOnlyRoutes = []route{
+	{http.MethodPost, regexp.MustCompile(`^/plugins/.+/enable$`)},
+	{http.MethodPost, regexp.MustCompile(`^/plugins/.+/disable$`)},
+	{http.MethodPost, regexp.MustCompile(`^/plugins/pull$`)},
+	{http.MethodPost, regexp.MustCompile(`^/plugins/.+/push$`)},
+	{http.MethodPost, regexp.MustCompile(`^/plugins/.+/upgrade$`)},
+	{http.MethodPost, regexp.MustCompile(`^/plugins/.+/set$`)},
+	{http.MethodPost, regexp.MustCompile(`^/plugins/create$`)},
+	{http.MethodDelete, regexp.MustCompile(`^/plugins/.+$`)},
+}
+
+func isAdminOnlyRoute(method string, path string) bool {
+	return slicesx.Some(adminOnlyRoutes, func(r route) bool {
+		return method == r.method && r.pattern.MatchString(path)
+	})
+}
+
+// ProxyDockerRequest intercepts a Docker API request and apply logic based
+// on the requested operation.
+func (transport *Transport) ProxyDockerRequest(request *http.Request) (*http.Response, error) {
+	// from : /v1.47/containers/{id}/json
+	// or   : /containers/{id}/json
+	// to   : /containers/{id}/json
+	unversionedPath := apiVersionRe.ReplaceAllString(request.URL.Path, "")
+
+	if transport.endpoint.Type == portainer.AgentOnDockerEnvironment || transport.endpoint.Type == portainer.EdgeAgentOnDockerEnvironment {
+		signature, err := transport.signatureService.CreateSignature(portainer.PortainerAgentSignatureMessage)
+		if err != nil {
+			return nil, err
+		}
+
+		request.Header.Set(portainer.PortainerAgentPublicKeyHeader, transport.signatureService.EncodedPublicKey())
+		request.Header.Set(portainer.PortainerAgentSignatureHeader, signature)
+	}
+
+	// from    : /containers/{id}/json
+	// trim to : containers/{id}/json
+	// pick    : [ containers, {id}, json ][0]
+	// prefix  : containers
+	prefix := strings.Split(strings.TrimPrefix(unversionedPath, "/"), "/")[0]
+
+	if proxyFunc := prefixProxyFuncMap[prefix]; proxyFunc != nil {
+		return proxyFunc(transport, request, unversionedPath)
+	}
+
+	if isAdminOnlyRoute(request.Method, unversionedPath) {
+		return transport.administratorOperation(request)
+	}
+
+	return transport.executeDockerRequest(request)
+}
+
+func (transport *Transport) executeDockerRequest(request *http.Request) (*http.Response, error) {
+	response, err := transport.HTTPTransport.RoundTrip(request)
+
+	if transport.endpoint.Type != portainer.EdgeAgentOnDockerEnvironment {
+		return response, err
+	}
+
+	if err == nil {
+		transport.reverseTunnelService.UpdateLastActivity(transport.endpoint.ID)
+	}
+
+	return response, err
+}
+
+func (transport *Transport) proxyAgentRequest(r *http.Request, unversionedPath string) (*http.Response, error) {
+	requestPath := strings.TrimPrefix(unversionedPath, "/v2")
+
+	switch {
+	case strings.HasPrefix(requestPath, "/browse"):
+		// Host file browser request
+		volumeIDParameter, found := r.URL.Query()["volumeID"]
+		if !found || len(volumeIDParameter) < 1 {
+			return transport.administratorOperation(r)
+		}
+
+		volumeName := volumeIDParameter[0]
+
+		resourceID, err := transport.getVolumeResourceID(volumeName)
+		if err != nil {
+			return nil, err
+		}
+
+		// Volume browser request
+		return transport.restrictedResourceOperation(r, resourceID, volumeName, portainer.VolumeResourceControl, true)
+	case strings.HasPrefix(requestPath, "/dockerhub"):
+		requestPath, registryIdString := path.Split(r.URL.Path)
+
+		registryID, err := strconv.Atoi(registryIdString)
+		if err != nil {
+			return nil, fmt.Errorf("missing registry id: %w", err)
+		}
+
+		r.URL.Path = strings.TrimSuffix(requestPath, "/")
+
+		registry := &portainer.Registry{
+			Type: portainer.DockerHubRegistry,
+		}
+
+		if registryID != 0 {
+			registry, err = transport.dataStore.Registry().Read(portainer.RegistryID(registryID))
+			if err != nil {
+				return nil, fmt.Errorf("failed fetching registry: %w", err)
+			}
+		}
+
+		if registry.Type != portainer.DockerHubRegistry {
+			return nil, errors.New("Invalid registry type")
+		}
+
+		newBody, err := json.Marshal(registry)
+		if err != nil {
+			return nil, err
+		}
+
+		r.Method = http.MethodPost
+
+		r.Body = io.NopCloser(bytes.NewReader(newBody))
+		r.ContentLength = int64(len(newBody))
+	}
+
+	return transport.executeDockerRequest(r)
+}
+
+func (transport *Transport) proxyConfigRequest(request *http.Request, unversionedPath string) (*http.Response, error) {
+	requestPath := unversionedPath
+
+	switch requestPath {
+	case "/configs/create":
+		return transport.decorateGenericResourceCreationOperation(request, configObjectIdentifier, portainer.ConfigResourceControl)
+
+	case "/configs":
+		return transport.rewriteOperation(request, transport.configListOperation)
+
+	default:
+		// Assume /configs/{id}
+		configID := path.Base(requestPath)
+
+		switch request.Method {
+		case http.MethodGet:
+			return transport.rewriteOperation(request, transport.configInspectOperation)
+		case http.MethodDelete:
+			return transport.executeGenericResourceDeletionOperation(request, configID, configID, portainer.ConfigResourceControl)
+		}
+
+		return transport.restrictedResourceOperation(request, configID, configID, portainer.ConfigResourceControl, false)
+	}
+}
+
+func (transport *Transport) proxyContainerRequest(request *http.Request, unversionedPath string) (*http.Response, error) {
+	requestPath := unversionedPath
+
+	switch requestPath {
+	case "/containers/create":
+		return transport.decorateContainerCreationOperation(request, containerObjectIdentifier, portainer.ContainerResourceControl)
+
+	case "/containers/prune":
+		return transport.administratorOperation(request)
+
+	case "/containers/json":
+		return transport.rewriteOperationWithLabelFiltering(request, transport.containerListOperation)
+
+	default:
+		// This section assumes /containers/**
+		if match, _ := path.Match("/containers/*/*", requestPath); match {
+			// Handle /containers/{id}/{action} requests
+			containerID := path.Base(path.Dir(requestPath))
+			action := path.Base(requestPath)
+
+			if action == "json" {
+				return transport.rewriteOperation(request, transport.containerInspectOperation)
+			}
+
+			if action == "update" {
+				return transport.decorateContainerUpdateOperation(request, containerID)
+			}
+
+			return transport.restrictedResourceOperation(request, containerID, containerID, portainer.ContainerResourceControl, false)
+		} else if match, _ := path.Match("/containers/*", requestPath); match {
+			// Handle /containers/{id} requests
+			containerID := path.Base(requestPath)
+
+			if request.Method == http.MethodDelete {
+				return transport.executeGenericResourceDeletionOperation(request, containerID, containerID, portainer.ContainerResourceControl)
+			}
+
+			return transport.restrictedResourceOperation(request, containerID, containerID, portainer.ContainerResourceControl, false)
+		} else if match, _ := path.Match("/containers/*/attach/ws", requestPath); match {
+			containerID := path.Base(path.Dir(path.Dir(requestPath)))
+
+			return transport.restrictedResourceOperation(request, containerID, containerID, portainer.ContainerResourceControl, false)
+		}
+
+		return transport.executeDockerRequest(request)
+	}
+}
+
+func (transport *Transport) proxyExecRequest(request *http.Request, unversionedPath string) (*http.Response, error) {
+	execID := path.Base(path.Dir(unversionedPath))
+
+	client, err := transport.dockerClientFactory.CreateClient(transport.endpoint, request.Header.Get(portainer.PortainerAgentTargetHeader), nil)
+	if err != nil {
+		return nil, err
+	}
+	defer logs.CloseAndLogErr(client)
+
+	execInspect, err := client.ContainerExecInspect(request.Context(), execID)
+	if err != nil {
+		return nil, err
+	}
+
+	return transport.restrictedResourceOperation(request, execInspect.ContainerID, execInspect.ContainerID, portainer.ContainerResourceControl, false)
+}
+
+func (transport *Transport) proxyServiceRequest(request *http.Request, unversionedPath string) (*http.Response, error) {
+	requestPath := unversionedPath
+
+	switch requestPath {
+	case "/services/create":
+		return transport.decorateServiceCreationOperation(request)
+
+	case "/services":
+		return transport.rewriteOperation(request, transport.serviceListOperation)
+
+	default:
+		// This section assumes /services/**
+		if match, _ := path.Match("/services/*/*", requestPath); match {
+			// Handle /services/{id}/{action} requests
+			serviceID := path.Base(path.Dir(requestPath))
+			action := path.Base(requestPath)
+
+			if action == "update" {
+				return transport.decorateServiceUpdateOperation(request, serviceID)
+			}
+
+			if err := transport.decorateRegistryAuthenticationHeader(request); err != nil {
+				return nil, err
+			}
+
+			return transport.restrictedResourceOperation(request, serviceID, serviceID, portainer.ServiceResourceControl, false)
+		} else if match, _ := path.Match("/services/*", requestPath); match {
+			// Handle /services/{id} requests
+			serviceID := path.Base(requestPath)
+
+			switch request.Method {
+			case http.MethodGet:
+				return transport.rewriteOperation(request, transport.serviceInspectOperation)
+			case http.MethodDelete:
+				return transport.executeGenericResourceDeletionOperation(request, serviceID, serviceID, portainer.ServiceResourceControl)
+			}
+
+			return transport.restrictedResourceOperation(request, serviceID, serviceID, portainer.ServiceResourceControl, false)
+		}
+
+		return transport.executeDockerRequest(request)
+	}
+}
+
+func (transport *Transport) proxyVolumeRequest(request *http.Request, unversionedPath string) (*http.Response, error) {
+	requestPath := unversionedPath
+
+	switch requestPath {
+	case "/volumes/create":
+		return transport.decorateVolumeResourceCreationOperation(request, portainer.VolumeResourceControl)
+
+	case "/volumes/prune":
+		return transport.administratorOperation(request)
+
+	case "/volumes":
+		return transport.rewriteOperation(request, transport.volumeListOperation)
+
+	default:
+		// Assume /volumes/{name}
+		return transport.restrictedVolumeOperation(requestPath, request)
+	}
+}
+
+func match(requestPath string, pattern string) bool {
+	ok, err := path.Match(pattern, requestPath)
+	return err == nil && ok
+}
+
+func (transport *Transport) proxyNetworkRequest(request *http.Request, unversionedPath string) (*http.Response, error) {
+	requestPath := unversionedPath
+
+	switch {
+	case requestPath == "/networks/create":
+		return transport.decorateGenericResourceCreationOperation(request, networkObjectIdentifier, portainer.NetworkResourceControl)
+
+	case requestPath == "/networks":
+		return transport.rewriteOperation(request, transport.networkListOperation)
+
+	case request.Method == http.MethodPost && match(requestPath, "/networks/*/connect"),
+		request.Method == http.MethodPost && match(requestPath, "/networks/*/disconnect"):
+
+		networkID := path.Base(path.Dir(requestPath))
+		return transport.restrictedResourceOperation(request, networkID, networkID, portainer.NetworkResourceControl, false)
+
+	case request.Method == http.MethodGet && match(requestPath, "/networks/*"):
+		return transport.rewriteOperation(request, transport.networkInspectOperation)
+
+	case request.Method == http.MethodDelete && match(requestPath, "/networks/*"):
+		networkID := path.Base(requestPath)
+		return transport.executeGenericResourceDeletionOperation(request, networkID, networkID, portainer.NetworkResourceControl)
+	}
+
+	// Assume /networks/{id}
+	networkID := path.Base(requestPath)
+	return transport.restrictedResourceOperation(request, networkID, networkID, portainer.NetworkResourceControl, false)
+}
+
+func (transport *Transport) proxySecretRequest(request *http.Request, unversionedPath string) (*http.Response, error) {
+	requestPath := unversionedPath
+
+	switch requestPath {
+	case "/secrets/create":
+		return transport.decorateGenericResourceCreationOperation(request, secretObjectIdentifier, portainer.SecretResourceControl)
+
+	case "/secrets":
+		return transport.rewriteOperation(request, transport.secretListOperation)
+
+	default:
+		// Assume /secrets/{id}
+		secretID := path.Base(requestPath)
+
+		switch request.Method {
+		case http.MethodGet:
+			return transport.rewriteOperation(request, transport.secretInspectOperation)
+		case http.MethodDelete:
+			return transport.executeGenericResourceDeletionOperation(request, secretID, secretID, portainer.SecretResourceControl)
+		}
+
+		return transport.restrictedResourceOperation(request, secretID, secretID, portainer.SecretResourceControl, false)
+	}
+}
+
+func (transport *Transport) proxyNodeRequest(request *http.Request, unversionedPath string) (*http.Response, error) {
+	requestPath := unversionedPath
+
+	// Assume /nodes/{id}
+	if path.Base(requestPath) != "nodes" {
+		return transport.administratorOperation(request)
+	}
+
+	return transport.executeDockerRequest(request)
+}
+
+func (transport *Transport) proxySwarmRequest(request *http.Request, unversionedPath string) (*http.Response, error) {
+	requestPath := unversionedPath
+
+	switch requestPath {
+	case "/swarm":
+		return transport.rewriteOperation(request, swarmInspectOperation)
+	default:
+		// Assume /swarm/{action}
+		return transport.administratorOperation(request)
+	}
+}
+
+func (transport *Transport) proxyTaskRequest(request *http.Request, unversionedPath string) (*http.Response, error) {
+	requestPath := unversionedPath
+
+	switch requestPath {
+	case "/tasks":
+		return transport.rewriteOperation(request, transport.taskListOperation)
+	default:
+		// Assume /tasks/{id}
+		return transport.executeDockerRequest(request)
+	}
+}
+
+func (transport *Transport) proxyBuildRequest(request *http.Request, unversionedPath string) (*http.Response, error) {
+	if unversionedPath == "/build/prune" {
+		return transport.administratorOperation(request)
+	}
+
+	if err := transport.updateDefaultGitBranch(request); err != nil {
+		return nil, err
+	}
+
+	return transport.interceptAndRewriteRequest(request, buildOperation)
+}
+
+func (transport *Transport) updateDefaultGitBranch(request *http.Request) error {
+	remote := request.URL.Query().Get("remote")
+	if !strings.HasSuffix(remote, ".git") {
+		return nil
+	}
+
+	repositoryURL := remote[:len(remote)-4]
+
+	if err := ssrf.CheckURL(request.Context(), repositoryURL); err != nil {
+		return err
+	}
+
+	latestCommitID, err := transport.gitService.LatestCommitID(
+		request.Context(),
+		repositoryURL,
+		"",
+		"",
+		"",
+		false,
+	)
+	if err != nil {
+		return err
+	}
+
+	newRemote := fmt.Sprintf("%s#%s", remote, latestCommitID)
+
+	q := request.URL.Query()
+	q.Set("remote", newRemote)
+	request.URL.RawQuery = q.Encode()
+
+	return nil
+}
+
+func (transport *Transport) proxyImageRequest(request *http.Request, unversionedPath string) (*http.Response, error) {
+	requestPath := unversionedPath
+
+	switch requestPath {
+	case "/images/create":
+		return transport.replaceRegistryAuthenticationHeader(request)
+	case "/images/prune":
+		return transport.administratorOperation(request)
+	default:
+		if path.Base(requestPath) == "push" && request.Method == http.MethodPost {
+			return transport.replaceRegistryAuthenticationHeader(request)
+		}
+
+		return transport.executeDockerRequest(request)
+	}
+}
+
+func (transport *Transport) replaceRegistryAuthenticationHeader(request *http.Request) (*http.Response, error) {
+	if err := transport.decorateRegistryAuthenticationHeader(request); err != nil {
+		return nil, err
+	}
+
+	return transport.decorateGenericResourceCreationOperation(request, serviceObjectIdentifier, portainer.ServiceResourceControl)
+}
+
+func (transport *Transport) decorateRegistryAuthenticationHeader(request *http.Request) error {
+	accessContext, err := transport.createRegistryAccessContext(request)
+	if err != nil {
+		return err
+	}
+
+	originalHeader := request.Header.Get("X-Registry-Auth")
+
+	if originalHeader == "" {
+		return nil
+	}
+
+	decodedHeaderData, err := base64.StdEncoding.DecodeString(originalHeader)
+	if err != nil {
+		return err
+	}
+
+	var originalHeaderData portainerRegistryAuthenticationHeader
+	if err := json.Unmarshal(decodedHeaderData, &originalHeaderData); err != nil {
+		return err
+	}
+
+	// Delete header and exist function without error if Front End
+	// passes empty json. This is to restore original behavior which
+	// never originally passed this header
+	if string(decodedHeaderData) == "{}" {
+		request.Header.Del("X-Registry-Auth")
+
+		return nil
+	}
+
+	// Only set X-Registry-Auth if registryId is defined
+	if originalHeaderData.RegistryId == nil {
+		return nil
+	}
+
+	authenticationHeader, err := createRegistryAuthenticationHeader(transport.dataStore, *originalHeaderData.RegistryId, accessContext)
+	if err != nil {
+		return err
+	}
+
+	headerData, err := json.Marshal(authenticationHeader)
+	if err != nil {
+		return err
+	}
+
+	request.Header.Set("X-Registry-Auth", base64.URLEncoding.EncodeToString(headerData))
+
+	return nil
+}
+
+func (transport *Transport) restrictedResourceOperation(request *http.Request, resourceID string, dockerResourceID string, resourceType portainer.ResourceControlType, volumeBrowseRestrictionCheck bool) (*http.Response, error) {
+	tokenData, err := security.RetrieveTokenData(request)
+	if err != nil {
+		return nil, err
+	}
+
+	if tokenData.Role == portainer.AdministratorRole {
+		return transport.executeDockerRequest(request)
+	}
+
+	if volumeBrowseRestrictionCheck {
+		securitySettings, err := transport.fetchEndpointSecuritySettings()
+		if err != nil {
+			return nil, err
+		}
+
+		if !securitySettings.AllowVolumeBrowserForRegularUsers {
+			return utils.WriteAccessDeniedResponse()
+		}
+	}
+
+	teamMemberships, err := transport.dataStore.TeamMembership().TeamMembershipsByUserID(tokenData.ID)
+	if err != nil {
+		return nil, err
+	}
+
+	userTeamIDs := authorization.TeamIDs(teamMemberships)
+
+	resourceControls, err := transport.dataStore.ResourceControl().ReadAll()
+	if err != nil {
+		return nil, err
+	}
+
+	resourceControl := authorization.GetResourceControlByResourceIDAndType(resourceID, resourceType, resourceControls)
+	if resourceControl != nil {
+		if !authorization.UserCanAccessResource(tokenData.ID, userTeamIDs, resourceControl) {
+			return utils.WriteAccessDeniedResponse()
+		}
+		return transport.executeDockerRequest(request)
+	}
+
+	client, err := transport.dockerClientFactory.CreateClient(transport.endpoint, request.Header.Get(portainer.PortainerAgentTargetHeader), nil)
+	if err != nil {
+		return nil, err
+	}
+	defer logs.CloseAndLogErr(client)
+
+	// the resourceID may be the resource name (as it's a valid proxy call to use the name and not the UUID)
+	// so get the real resource ID and retry with it
+	resourceID, err = getDockerResourceUUID(client, resourceType, resourceID)
+	if err != nil {
+		return nil, err
+	}
+
+	resourceControl = authorization.GetResourceControlByResourceIDAndType(resourceID, resourceType, resourceControls)
+	if resourceControl != nil {
+		if !authorization.UserCanAccessResource(tokenData.ID, userTeamIDs, resourceControl) {
+			return utils.WriteAccessDeniedResponse()
+		}
+		return transport.executeDockerRequest(request)
+	}
+
+	// If we still can't find the RC by provided ID or "real" (docker-extracted) ID
+	// it means this resource was created outside of portainer,
+	// is part of a Docker service or part of a Docker Swarm/Compose stack.
+	if dockerResourceID == "" {
+		dockerResourceID = resourceID
+	}
+	inheritedResourceControl, err := transport.getInheritedResourceControlFromServiceOrStack(client, dockerResourceID, resourceType, resourceControls)
+	if err != nil {
+		return nil, err
+	}
+
+	if inheritedResourceControl == nil || !authorization.UserCanAccessResource(tokenData.ID, userTeamIDs, inheritedResourceControl) {
+		return utils.WriteAccessDeniedResponse()
+	}
+
+	return transport.executeDockerRequest(request)
+}
+
+func getDockerResourceUUID(client *dockerclient.Client, resourceType portainer.ResourceControlType, resourceId string) (string, error) {
+	switch resourceType {
+	case portainer.NetworkResourceControl:
+		network, err := client.NetworkInspect(context.Background(), resourceId, network.InspectOptions{})
+		if err != nil {
+			return "", err
+		}
+		return network.ID, nil
+
+	case portainer.ContainerResourceControl:
+		container, err := client.ContainerInspect(context.Background(), resourceId)
+		if err != nil {
+			return "", err
+		}
+		return container.ID, nil
+
+	case portainer.VolumeResourceControl:
+		// volumes don't have an UUID and their UACresourceID has a particular construct that makes them unique
+		// e.g. fmt.Sprintf("%s_%s", volumeName, dockerID)
+		// see transport.getVolumeResourceID() / FetchDockerID()
+		// FetchDockerID fetches info.Swarm.Cluster.ID if environment(endpoint) is swarm and info.ID otherwise
+		// So: return empty ID but without error
+		return "", nil
+
+	case portainer.ServiceResourceControl:
+		service, _, err := client.ServiceInspectWithRaw(context.Background(), resourceId, swarm.ServiceInspectOptions{})
+		if err != nil {
+			return "", err
+		}
+		return service.ID, nil
+
+	case portainer.ConfigResourceControl:
+		config, _, err := client.ConfigInspectWithRaw(context.Background(), resourceId)
+		if err != nil {
+			return "", err
+		}
+		return config.ID, nil
+
+	case portainer.SecretResourceControl:
+		secret, _, err := client.SecretInspectWithRaw(context.Background(), resourceId)
+		if err != nil {
+			return "", err
+		}
+		return secret.ID, nil
+
+	}
+	return "", fmt.Errorf("Unknown resource type %v", resourceType)
+}
+
+// rewriteOperationWithLabelFiltering will create a new operation context with data that will be used
+// to decorate the original request's response as well as retrieve all the black listed labels
+// to filter the resources.
+func (transport *Transport) rewriteOperationWithLabelFiltering(request *http.Request, operation restrictedOperationRequest) (*http.Response, error) {
+	operationContext, err := transport.createOperationContext(request)
+	if err != nil {
+		return nil, err
+	}
+
+	settings, err := transport.dataStore.Settings().Settings()
+	if err != nil {
+		return nil, err
+	}
+
+	executor := &operationExecutor{
+		operationContext: operationContext,
+		labelBlackList:   settings.BlackListedLabels,
+	}
+
+	return transport.executeRequestAndRewriteResponse(request, operation, executor)
+}
+
+// rewriteOperation will create a new operation context with data that will be used
+// to decorate the original request's response.
+func (transport *Transport) rewriteOperation(request *http.Request, operation restrictedOperationRequest) (*http.Response, error) {
+	operationContext, err := transport.createOperationContext(request)
+	if err != nil {
+		return nil, err
+	}
+
+	executor := &operationExecutor{
+		operationContext: operationContext,
+	}
+
+	return transport.executeRequestAndRewriteResponse(request, operation, executor)
+}
+
+func (transport *Transport) interceptAndRewriteRequest(request *http.Request, operation operationRequest) (*http.Response, error) {
+	if err := operation(request); err != nil {
+		return nil, err
+	}
+
+	return transport.executeDockerRequest(request)
+}
+
+// decorateGenericResourceCreationResponse extracts the response as a JSON object, extracts the resource identifier from that object based
+// on the resourceIdentifierAttribute parameter then generate a new resource control associated to that resource
+// with a random token and rewrites the response by decorating the original response with a ResourceControl object.
+// The generic Docker API response format is JSON object:
+// https://docs.docker.com/engine/api/v1.37/#operation/ContainerCreate
+// https://docs.docker.com/engine/api/v1.37/#operation/NetworkCreate
+// https://docs.docker.com/engine/api/v1.37/#operation/VolumeCreate
+// https://docs.docker.com/engine/api/v1.37/#operation/ServiceCreate
+// https://docs.docker.com/engine/api/v1.37/#operation/SecretCreate
+// https://docs.docker.com/engine/api/v1.37/#operation/ConfigCreate
+func (transport *Transport) decorateGenericResourceCreationResponse(response *http.Response, resourceIdentifierAttribute string, resourceType portainer.ResourceControlType, userID portainer.UserID) error {
+	responseObject, err := utils.GetResponseAsJSONObject(response)
+	if err != nil {
+		return err
+	}
+
+	if responseObject[resourceIdentifierAttribute] == nil {
+		log.Error().Msg("missing identifier in Docker resource creation response")
+
+		return errors.New("missing identifier in Docker resource creation response")
+	}
+
+	resourceID := responseObject[resourceIdentifierAttribute].(string)
+
+	resourceControl, err := transport.createPrivateResourceControl(resourceID, resourceType, userID)
+	if err != nil {
+		return err
+	}
+
+	responseObject = decorateObject(responseObject, resourceControl)
+
+	return utils.RewriteResponse(response, responseObject, response.StatusCode)
+}
+
+func (transport *Transport) decorateGenericResourceCreationOperation(request *http.Request, resourceIdentifierAttribute string, resourceType portainer.ResourceControlType) (*http.Response, error) {
+	tokenData, err := security.RetrieveTokenData(request)
+	if err != nil {
+		return nil, err
+	}
+
+	response, err := transport.executeDockerRequest(request)
+	if err != nil {
+		return response, err
+	}
+
+	if response.StatusCode == http.StatusCreated {
+		err = transport.decorateGenericResourceCreationResponse(response, resourceIdentifierAttribute, resourceType, tokenData.ID)
+	}
+
+	return response, err
+}
+
+func (transport *Transport) executeGenericResourceDeletionOperation(request *http.Request, resourceIdentifierAttribute string, volumeName string, resourceType portainer.ResourceControlType) (*http.Response, error) {
+	response, err := transport.restrictedResourceOperation(request, resourceIdentifierAttribute, volumeName, resourceType, false)
+	if err != nil {
+		return response, err
+	}
+
+	if response.StatusCode != http.StatusNoContent && response.StatusCode != http.StatusOK {
+		return response, nil
+	}
+
+	resourceControl, err := transport.dataStore.ResourceControl().ResourceControlByResourceIDAndType(resourceIdentifierAttribute, resourceType)
+	if dataservices.IsErrObjectNotFound(err) {
+		return response, nil
+	} else if err != nil {
+		return response, err
+	}
+
+	if resourceControl != nil {
+		err = transport.dataStore.ResourceControl().Delete(resourceControl.ID)
+	}
+
+	return response, err
+}
+
+func (transport *Transport) executeRequestAndRewriteResponse(request *http.Request, operation restrictedOperationRequest, executor *operationExecutor) (*http.Response, error) {
+	response, err := transport.executeDockerRequest(request)
+	if err != nil {
+		return response, err
+	}
+
+	if response.StatusCode == http.StatusOK {
+		err = operation(response, executor)
+	}
+
+	return response, err
+}
+
+// administratorOperation ensures that the user has administrator privileges
+// before executing the original request.
+func (transport *Transport) administratorOperation(request *http.Request) (*http.Response, error) {
+	tokenData, err := security.RetrieveTokenData(request)
+	if err != nil {
+		return nil, err
+	}
+
+	if tokenData.Role != portainer.AdministratorRole {
+		return utils.WriteAccessDeniedResponse()
+	}
+
+	return transport.executeDockerRequest(request)
+}
+
+func (transport *Transport) createRegistryAccessContext(request *http.Request) (*registryAccessContext, error) {
+	tokenData, err := security.RetrieveTokenData(request)
+	if err != nil {
+		return nil, err
+	}
+
+	accessContext := &registryAccessContext{
+		isAdmin:    true,
+		endpointID: transport.endpoint.ID,
+	}
+
+	user, err := transport.dataStore.User().Read(tokenData.ID)
+	if err != nil {
+		return nil, err
+	}
+	accessContext.user = user
+
+	registries, err := transport.dataStore.Registry().ReadAll()
+	if err != nil {
+		return nil, err
+	}
+	accessContext.registries = registries
+
+	if user.Role == portainer.AdministratorRole {
+		return accessContext, nil
+	}
+
+	accessContext.isAdmin = false
+
+	teamMemberships, err := transport.dataStore.TeamMembership().TeamMembershipsByUserID(tokenData.ID)
+	if err != nil {
+		return nil, err
+	}
+
+	accessContext.teamMemberships = teamMemberships
+
+	return accessContext, nil
+}
+
+func (transport *Transport) createOperationContext(request *http.Request) (*restrictedDockerOperationContext, error) {
+	var err error
+	tokenData, err := security.RetrieveTokenData(request)
+	if err != nil {
+		return nil, err
+	}
+
+	resourceControls, err := transport.dataStore.ResourceControl().ReadAll()
+	if err != nil {
+		return nil, err
+	}
+
+	operationContext := &restrictedDockerOperationContext{
+		isAdmin:          true,
+		userID:           tokenData.ID,
+		resourceControls: resourceControls,
+	}
+
+	if tokenData.Role == portainer.AdministratorRole {
+		return operationContext, nil
+	}
+
+	operationContext.isAdmin = false
+
+	teamMemberships, err := transport.dataStore.TeamMembership().TeamMembershipsByUserID(tokenData.ID)
+	if err != nil {
+		return nil, err
+	}
+
+	operationContext.userTeamIDs = authorization.TeamIDs(teamMemberships)
+
+	return operationContext, nil
+}
+
+func (transport *Transport) isAdminOrEndpointAdmin(request *http.Request) (bool, error) {
+	tokenData, err := security.RetrieveTokenData(request)
+	if err != nil {
+		return false, err
+	}
+
+	return tokenData.Role == portainer.AdministratorRole, nil
+}
+
+func (transport *Transport) fetchEndpointSecuritySettings() (*portainer.EndpointSecuritySettings, error) {
+	endpoint, err := transport.dataStore.Endpoint().Endpoint(transport.endpoint.ID)
+	if err != nil {
+		return nil, err
+	}
+
+	return &endpoint.SecuritySettings, nil
+}
diff --git a/api/http/proxy/factory/docker/transport_test.go b/api/http/proxy/factory/docker/transport_test.go
new file mode 100644
index 0000000..9475a00
--- /dev/null
+++ b/api/http/proxy/factory/docker/transport_test.go
@@ -0,0 +1,910 @@
+package docker
+
+import (
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/api/types/network"
+	"github.com/docker/docker/api/types/swarm"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestTransport_updateDefaultGitBranch(t *testing.T) {
+	t.Parallel()
+	type fields struct {
+		gitService portainer.GitService
+	}
+
+	type args struct {
+		request *http.Request
+	}
+
+	commitId := "my-latest-commit-id"
+	defaultFields := fields{
+		gitService: testhelpers.NewGitService(nil, commitId),
+	}
+
+	tests := []struct {
+		name          string
+		fields        fields
+		args          args
+		wantErr       bool
+		expectedQuery string
+	}{
+		{
+			name:   "append commit ID",
+			fields: defaultFields,
+			args: args{
+				request: httptest.NewRequest(http.MethodPost, "http://unixsocket/build?dockerfile=Dockerfile&remote=https://my-host.com/my-user/my-repo.git&t=my-image", nil),
+			},
+			wantErr:       false,
+			expectedQuery: fmt.Sprintf("dockerfile=Dockerfile&remote=https%%3A%%2F%%2Fmy-host.com%%2Fmy-user%%2Fmy-repo.git%%23%s&t=my-image", commitId),
+		},
+		{
+			name:   "not append commit ID",
+			fields: defaultFields,
+			args: args{
+				request: httptest.NewRequest(http.MethodPost, "http://unixsocket/build?dockerfile=Dockerfile&remote=https://my-host.com/my-user/my-repo/my-file&t=my-image", nil),
+			},
+			wantErr:       false,
+			expectedQuery: "dockerfile=Dockerfile&remote=https://my-host.com/my-user/my-repo/my-file&t=my-image",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			transport := &Transport{
+				gitService: tt.fields.gitService,
+			}
+			err := transport.updateDefaultGitBranch(tt.args.request)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("updateDefaultGitBranch() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+
+			assert.Equal(t, tt.expectedQuery, tt.args.request.URL.RawQuery)
+		})
+	}
+}
+
+type RoutesDefinition map[[2]string]any
+
+func mockDockerAPIServer(t *testing.T, routes RoutesDefinition) (*httptest.Server, string) {
+	version := "1.51"
+
+	v := func(path string) string {
+		return "/v" + version + path
+	}
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == http.MethodHead && r.URL.Path == "/_ping" {
+			w.Header().Add("Api-Version", version)
+			_, _ = w.Write([]byte{})
+			return
+		}
+
+		for defs, rValue := range routes {
+			method, path := defs[0], defs[1]
+			if r.Method == method && r.URL.Path == v(path) {
+				_ = response.JSON(w, rValue)
+				return
+			}
+		}
+
+		http.NotFound(w, r)
+	}))
+	require.NotNil(t, srv)
+
+	return srv, version
+}
+
+func TestTransport_adminProxy(t *testing.T) {
+	t.Parallel()
+	admin := portainer.User{ID: 1, Username: "admin", Role: portainer.AdministratorRole}
+	std1 := portainer.User{ID: 2, Username: "std1", Role: portainer.StandardUserRole}
+	std2 := portainer.User{ID: 3, Username: "std2", Role: portainer.StandardUserRole}
+
+	_, ds := datastore.MustNewTestStore(t, true, false)
+
+	require.NoError(t, ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		require.NoError(t, tx.User().Create(&admin))
+		require.NoError(t, tx.User().Create(&std1))
+		require.NoError(t, tx.User().Create(&std2))
+		require.NoError(t, tx.Endpoint().Create(&portainer.Endpoint{ID: 1, Name: "env",
+			UserAccessPolicies: portainer.UserAccessPolicies{std1.ID: portainer.AccessPolicy{RoleID: 1}},
+		}))
+
+		return nil
+	}))
+	srv, version := mockDockerAPIServer(t, RoutesDefinition{
+		// allowed routes
+		{http.MethodGet, "/plugins"}:            nil,
+		{http.MethodGet, "/plugins/xxx/json"}:   nil,
+		{http.MethodGet, "/plugins/privileges"}: nil,
+		// admin routes ; see `adminOnlyRoutes`
+		{http.MethodDelete, "/plugins/xxx"}:              nil,
+		{http.MethodPost, "/plugins/sshfs/enable"}:       nil, // simulate plugin "sshfs"
+		{http.MethodPost, "/plugins/vieux/sshfs/enable"}: nil, // simulate "vieux/sshfs"
+		{http.MethodPost, "/plugins/xxx/disable"}:        nil,
+		{http.MethodPost, "/plugins/pull"}:               nil,
+		{http.MethodPost, "/plugins/xxx/push"}:           nil,
+		{http.MethodPost, "/plugins/xxx/upgrade"}:        nil,
+		{http.MethodPost, "/plugins/xxx/set"}:            nil,
+		{http.MethodPost, "/plugins/create"}:             nil,
+	})
+	defer srv.Close()
+
+	transport := &Transport{
+		endpoint:      &portainer.Endpoint{URL: srv.URL},
+		dataStore:     ds,
+		HTTPTransport: &http.Transport{},
+	}
+
+	test := func(method string, url string, token portainer.TokenData) (*http.Response, error) {
+		req := httptest.NewRequest(method, srv.URL+"/v"+version+url, nil)
+		req = req.WithContext(security.StoreTokenData(req, &token))
+		require.NotNil(t, req)
+
+		return transport.ProxyDockerRequest(req)
+	}
+
+	adminToken := portainer.TokenData{ID: admin.ID, Username: admin.Username, Role: admin.Role}
+	std1Token := portainer.TokenData{ID: std1.ID, Username: std1.Username, Role: std1.Role}
+	std2Token := portainer.TokenData{ID: std2.ID, Username: std2.Username, Role: std2.Role}
+
+	{
+		r, err := test(http.MethodGet, "/plugins", adminToken)
+		require.NoError(t, err)
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusOK, r.StatusCode)
+		require.NoError(t, r.Body.Close())
+	}
+
+	{
+		r, err := test(http.MethodGet, "/plugins", std1Token)
+		require.NoError(t, err)
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusOK, r.StatusCode)
+		require.NoError(t, r.Body.Close())
+	}
+
+	{
+		r, err := test(http.MethodGet, "/plugins", std2Token)
+		require.NoError(t, err)
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusOK, r.StatusCode)
+		require.NoError(t, r.Body.Close())
+	}
+
+	{
+		r, err := test(http.MethodPost, "/plugins/pull", adminToken)
+		require.NoError(t, err)
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusOK, r.StatusCode)
+		require.NoError(t, r.Body.Close())
+	}
+
+	{
+		r, err := test(http.MethodPost, "/plugins/pull", std1Token)
+		require.NoError(t, err)
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusForbidden, r.StatusCode)
+		require.NoError(t, r.Body.Close())
+	}
+
+	{
+		r, err := test(http.MethodPost, "/plugins/pull", std2Token)
+		require.NoError(t, err)
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusForbidden, r.StatusCode)
+		require.NoError(t, r.Body.Close())
+	}
+
+	{
+		r, err := test(http.MethodPost, "/plugins/sshfs/enable", adminToken)
+		require.NoError(t, err)
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusOK, r.StatusCode)
+		require.NoError(t, r.Body.Close())
+	}
+
+	{
+		r, err := test(http.MethodPost, "/plugins/sshfs/enable", std2Token)
+		require.NoError(t, err)
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusForbidden, r.StatusCode)
+		require.NoError(t, r.Body.Close())
+	}
+
+	{
+		r, err := test(http.MethodPost, "/plugins/vieux/sshfs/enable", adminToken)
+		require.NoError(t, err)
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusOK, r.StatusCode)
+		require.NoError(t, r.Body.Close())
+	}
+
+	{
+		r, err := test(http.MethodPost, "/plugins/vieux/sshfs/enable", std2Token)
+		require.NoError(t, err)
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusForbidden, r.StatusCode)
+		require.NoError(t, r.Body.Close())
+	}
+}
+
+func TestTransport_getRealResourceID(t *testing.T) {
+	t.Parallel()
+	srv, _ := mockDockerAPIServer(t, RoutesDefinition{
+		{http.MethodGet, "/networks"}:           []network.Summary{{ID: "16e37c629e88694663791dc738fd37affb908d7b85ce00a20680675d10554fd4", Name: "mynetwork"}},
+		{http.MethodGet, "/networks/mynetwork"}: network.Inspect{ID: "16e37c629e88694663791dc738fd37affb908d7b85ce00a20680675d10554fd4", Name: "mynetwork"},
+		{http.MethodGet, "/networks/16e37c629e88694663791dc738fd37affb908d7b85ce00a20680675d10554fd4"}:        network.Inspect{ID: "16e37c629e88694663791dc738fd37affb908d7b85ce00a20680675d10554fd4", Name: "mynetwork"},
+		{http.MethodGet, "/containers/mycontainer/json"}:                                                      container.InspectResponse{ContainerJSONBase: &container.ContainerJSONBase{ID: "545fc03ed1fd5008c3bfa2441209ff024e21e396acbeb58b2355930ad1295aa6", Name: "mycontainer"}},
+		{http.MethodGet, "/containers/545fc03ed1fd5008c3bfa2441209ff024e21e396acbeb58b2355930ad1295aa6/json"}: container.InspectResponse{ContainerJSONBase: &container.ContainerJSONBase{ID: "545fc03ed1fd5008c3bfa2441209ff024e21e396acbeb58b2355930ad1295aa6", Name: "mycontainer"}},
+		{http.MethodGet, "/services/myservice"}:                                                               swarm.Service{ID: "ibt43uf5awhg06bxp8rkd7bhi", Spec: swarm.ServiceSpec{Annotations: swarm.Annotations{Name: "myservice"}}},
+		{http.MethodGet, "/services/ibt43uf5awhg06bxp8rkd7bhi"}:                                               swarm.Service{ID: "ibt43uf5awhg06bxp8rkd7bhi", Spec: swarm.ServiceSpec{Annotations: swarm.Annotations{Name: "myservice"}}},
+		{http.MethodGet, "/configs/myconfig"}:                                                                 swarm.Config{ID: "3mlqqza0k413ecebk0mfa11em", Spec: swarm.ConfigSpec{Annotations: swarm.Annotations{Name: "myconfig"}}},
+		{http.MethodGet, "/configs/3mlqqza0k413ecebk0mfa11em"}:                                                swarm.Config{ID: "3mlqqza0k413ecebk0mfa11em", Spec: swarm.ConfigSpec{Annotations: swarm.Annotations{Name: "myconfig"}}},
+		{http.MethodGet, "/secrets/mysecret"}:                                                                 swarm.Secret{ID: "v9i7o4ivg33u4z3jfyxto162d", Spec: swarm.SecretSpec{Annotations: swarm.Annotations{Name: "mysecret"}}},
+		{http.MethodGet, "/secrets/v9i7o4ivg33u4z3jfyxto162d"}:                                                swarm.Secret{ID: "v9i7o4ivg33u4z3jfyxto162d", Spec: swarm.SecretSpec{Annotations: swarm.Annotations{Name: "mysecret"}}},
+	})
+	defer srv.Close()
+
+	transport := &Transport{
+		endpoint: &portainer.Endpoint{URL: srv.URL},
+	}
+
+	client, err := transport.dockerClientFactory.CreateClient(transport.endpoint, "", nil)
+	require.NoError(t, err)
+	require.NotNil(t, client)
+
+	test := func(rctype portainer.ResourceControlType, name string, id string, errOnUnknown bool) {
+		// by id
+		got, err := getDockerResourceUUID(client, rctype, id)
+		require.NoError(t, err)
+		require.Equal(t, id, got)
+
+		// by name
+		got, err = getDockerResourceUUID(client, rctype, name)
+		require.NoError(t, err)
+		require.Equal(t, id, got)
+
+		// unknown for this type
+		_, err = getDockerResourceUUID(client, rctype, "unknown")
+		if errOnUnknown {
+			require.Error(t, err)
+		} else {
+			require.NoError(t, err)
+		}
+	}
+
+	test(portainer.NetworkResourceControl, "mynetwork", "16e37c629e88694663791dc738fd37affb908d7b85ce00a20680675d10554fd4", true)
+	test(portainer.ContainerResourceControl, "mycontainer", "545fc03ed1fd5008c3bfa2441209ff024e21e396acbeb58b2355930ad1295aa6", true)
+	test(portainer.VolumeResourceControl, "anything", "", false)
+	test(portainer.ServiceResourceControl, "myservice", "ibt43uf5awhg06bxp8rkd7bhi", true)
+	test(portainer.ConfigResourceControl, "myconfig", "3mlqqza0k413ecebk0mfa11em", true)
+	test(portainer.SecretResourceControl, "mysecret", "v9i7o4ivg33u4z3jfyxto162d", true)
+
+	// validate that other types are not supported
+	_, err = getDockerResourceUUID(client, portainer.ContainerGroupResourceControl, "")
+	require.Error(t, err)
+}
+
+func TestTransport_proxyNetworkRequest(t *testing.T) {
+	t.Parallel()
+	admin := portainer.User{ID: 1, Username: "admin", Role: portainer.AdministratorRole}
+	std1 := portainer.User{ID: 2, Username: "std1", Role: portainer.StandardUserRole}
+	std2 := portainer.User{ID: 3, Username: "std2", Role: portainer.StandardUserRole}
+
+	_, ds := datastore.MustNewTestStore(t, true, false)
+
+	require.NoError(t, ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		require.NoError(t, tx.User().Create(&admin))
+		require.NoError(t, tx.User().Create(&std1))
+		require.NoError(t, tx.User().Create(&std2))
+		require.NoError(t, tx.Endpoint().Create(&portainer.Endpoint{ID: 1, Name: "env",
+			UserAccessPolicies: portainer.UserAccessPolicies{std1.ID: portainer.AccessPolicy{RoleID: 1}},
+		}))
+
+		require.NoError(t, tx.ResourceControl().Create(authorization.NewPrivateResourceControl("16e37c629e88694663791dc738fd37affb908d7b85ce00a20680675d10554fd4", portainer.NetworkResourceControl, std1.ID)))
+
+		return nil
+	}))
+
+	srv, version := mockDockerAPIServer(t, RoutesDefinition{
+		{http.MethodGet, "/networks"}:           []network.Summary{{ID: "16e37c629e88694663791dc738fd37affb908d7b85ce00a20680675d10554fd4", Name: "mynetwork"}},
+		{http.MethodGet, "/networks/mynetwork"}: network.Inspect{ID: "16e37c629e88694663791dc738fd37affb908d7b85ce00a20680675d10554fd4", Name: "mynetwork"},
+		{http.MethodGet, "/networks/16e37c629e88694663791dc738fd37affb908d7b85ce00a20680675d10554fd4"}:             network.Inspect{ID: "16e37c629e88694663791dc738fd37affb908d7b85ce00a20680675d10554fd4", Name: "mynetwork"},
+		{http.MethodPost, "/networks/mynetwork/connect"}:                                                           struct{}{},
+		{http.MethodPost, "/networks/16e37c629e88694663791dc738fd37affb908d7b85ce00a20680675d10554fd4/connect"}:    struct{}{},
+		{http.MethodPost, "/networks/mynetwork/disconnect"}:                                                        struct{}{},
+		{http.MethodPost, "/networks/16e37c629e88694663791dc738fd37affb908d7b85ce00a20680675d10554fd4/disconnect"}: struct{}{},
+		{http.MethodDelete, "/networks/mynetwork"}:                                                                 struct{}{},
+		{http.MethodDelete, "/networks/16e37c629e88694663791dc738fd37affb908d7b85ce00a20680675d10554fd4"}:          struct{}{},
+		{http.MethodPost, "/networks/create"}:                                                                      network.CreateResponse{ID: "16e37c629e88694663791dc738fd37affb908d7b85ce00a20680675d10554fd4"},
+		{http.MethodPost, "/networks/prune"}:                                                                       struct{}{},
+	})
+	defer srv.Close()
+
+	transport := &Transport{
+		endpoint:      &portainer.Endpoint{URL: srv.URL},
+		dataStore:     ds,
+		HTTPTransport: &http.Transport{},
+	}
+
+	test := func(method string, url string, token portainer.TokenData) (*http.Response, error) {
+		req := httptest.NewRequest(method, srv.URL+"/v"+version+url, nil)
+		req = req.WithContext(security.StoreTokenData(req, &token))
+		require.NotNil(t, req)
+
+		return transport.proxyNetworkRequest(req, url)
+	}
+
+	adminToken := portainer.TokenData{ID: admin.ID, Username: admin.Username, Role: admin.Role}
+	std1Token := portainer.TokenData{ID: std1.ID, Username: std1.Username, Role: std1.Role}
+	std2Token := portainer.TokenData{ID: std2.ID, Username: std2.Username, Role: std2.Role}
+
+	{
+		r, err := test(http.MethodGet, "/networks", adminToken)
+		require.NoError(t, err)
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusOK, r.StatusCode)
+		var resp []network.Summary
+		require.NoError(t, json.NewDecoder(r.Body).Decode(&resp))
+		require.Len(t, resp, 1)
+		require.NoError(t, r.Body.Close())
+	}
+
+	{
+		r, err := test(http.MethodGet, "/networks", std1Token)
+		require.NoError(t, err)
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusOK, r.StatusCode)
+		var resp []network.Summary
+		require.NoError(t, json.NewDecoder(r.Body).Decode(&resp))
+		require.Len(t, resp, 1)
+		require.NoError(t, r.Body.Close())
+	}
+
+	{
+		r, err := test(http.MethodGet, "/networks", std2Token)
+		require.NoError(t, err)
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusOK, r.StatusCode)
+		var resp []network.Summary
+		require.NoError(t, json.NewDecoder(r.Body).Decode(&resp))
+		require.Empty(t, resp)
+		require.NoError(t, r.Body.Close())
+	}
+
+	{
+		r, err := test(http.MethodGet, "/networks/mynetwork", adminToken)
+		require.NoError(t, err)
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusOK, r.StatusCode)
+		require.NoError(t, r.Body.Close())
+	}
+
+	{
+		r, err := test(http.MethodGet, "/networks/mynetwork", std1Token)
+		require.NoError(t, err)
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusOK, r.StatusCode)
+		require.NoError(t, r.Body.Close())
+	}
+
+	{
+		r, err := test(http.MethodGet, "/networks/mynetwork", std2Token)
+		require.NoError(t, err)
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusForbidden, r.StatusCode)
+		require.NoError(t, r.Body.Close())
+	}
+
+	{
+		r, err := test(http.MethodGet, "/networks/unknown", adminToken)
+		require.NoError(t, err)
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusNotFound, r.StatusCode)
+		require.NoError(t, r.Body.Close())
+	}
+
+	{
+		r, err := test(http.MethodPost, "/networks/mynetwork/connect", adminToken)
+		require.NoError(t, err)
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusOK, r.StatusCode)
+		require.NoError(t, r.Body.Close())
+	}
+
+	{
+		r, err := test(http.MethodPost, "/networks/mynetwork/connect", std1Token)
+		require.NoError(t, err)
+		require.NotNil(t, r)
+		require.NoError(t, r.Body.Close())
+		require.Equal(t, http.StatusOK, r.StatusCode)
+	}
+
+	{
+		r, err := test(http.MethodPost, "/networks/mynetwork/connect", std2Token)
+		require.NoError(t, err)
+		require.NotNil(t, r)
+		require.NoError(t, r.Body.Close())
+		require.Equal(t, http.StatusForbidden, r.StatusCode)
+	}
+
+	{
+		r, err := test(http.MethodPost, "/networks/mynetwork/disconnect", adminToken)
+		require.NoError(t, err)
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusOK, r.StatusCode)
+		require.NoError(t, r.Body.Close())
+	}
+
+	{
+		r, err := test(http.MethodPost, "/networks/mynetwork/disconnect", std1Token)
+		require.NoError(t, err)
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusOK, r.StatusCode)
+		require.NoError(t, r.Body.Close())
+	}
+
+	{
+		r, err := test(http.MethodPost, "/networks/mynetwork/disconnect", std2Token)
+		require.NoError(t, err)
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusForbidden, r.StatusCode)
+		require.NoError(t, r.Body.Close())
+	}
+
+	{
+		r, err := test(http.MethodDelete, "/networks/mynetwork", adminToken)
+		require.NoError(t, err)
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusOK, r.StatusCode)
+		require.NoError(t, r.Body.Close())
+	}
+
+	{
+		r, err := test(http.MethodDelete, "/networks/mynetwork", std1Token)
+		require.NoError(t, err)
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusOK, r.StatusCode)
+		require.NoError(t, r.Body.Close())
+	}
+
+	{
+		r, err := test(http.MethodDelete, "/networks/mynetwork", std2Token)
+		require.NoError(t, err)
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusForbidden, r.StatusCode)
+		require.NoError(t, r.Body.Close())
+	}
+
+	{
+		r, err := test(http.MethodPost, "/networks/create", adminToken)
+		require.NoError(t, err)
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusOK, r.StatusCode)
+		require.NoError(t, r.Body.Close())
+	}
+
+	{
+		r, err := test(http.MethodPost, "/networks/create", std1Token)
+		require.NoError(t, err)
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusOK, r.StatusCode)
+		require.NoError(t, r.Body.Close())
+	}
+
+	{
+		r, err := test(http.MethodPost, "/networks/create", std2Token)
+		require.NoError(t, err)
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusOK, r.StatusCode)
+		require.NoError(t, r.Body.Close())
+	}
+
+	{
+		r, err := test(http.MethodPost, "/networks/prune", adminToken)
+		require.NoError(t, err)
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusOK, r.StatusCode)
+		require.NoError(t, r.Body.Close())
+	}
+
+	{
+		r, err := test(http.MethodPost, "/networks/prune", std1Token)
+		require.Error(t, err)
+		require.Nil(t, r)
+		if r != nil {
+			require.NoError(t, r.Body.Close())
+		}
+	}
+
+	{
+		r, err := test(http.MethodPost, "/networks/prune", std2Token)
+		require.Error(t, err)
+		require.Nil(t, r)
+		if r != nil {
+			require.NoError(t, r.Body.Close())
+		}
+	}
+}
+
+func TestTransport_proxyExecRequest_accessControl(t *testing.T) {
+	t.Parallel()
+
+	admin := portainer.User{ID: 1, Username: "admin", Role: portainer.AdministratorRole}
+	std1 := portainer.User{ID: 2, Username: "std1", Role: portainer.StandardUserRole}
+	std2 := portainer.User{ID: 3, Username: "std2", Role: portainer.StandardUserRole}
+
+	containerID := "1111"
+	execID := "2222"
+
+	_, ds := datastore.MustNewTestStore(t, true, false)
+
+	err := ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		require.NoError(t, tx.User().Create(&admin))
+		require.NoError(t, tx.User().Create(&std1))
+		require.NoError(t, tx.User().Create(&std2))
+		require.NoError(t, tx.Endpoint().Create(&portainer.Endpoint{
+			ID:   1,
+			Name: "env",
+			UserAccessPolicies: portainer.UserAccessPolicies{
+				std1.ID: portainer.AccessPolicy{RoleID: 1},
+				std2.ID: portainer.AccessPolicy{RoleID: 1},
+			},
+		}))
+
+		// Only std1 owns the container, std2 has no resource control for it
+		require.NoError(t, tx.ResourceControl().Create(
+			authorization.NewPrivateResourceControl(containerID, portainer.ContainerResourceControl, std1.ID),
+		))
+
+		return nil
+	})
+	require.NoError(t, err)
+
+	srv, version := mockDockerAPIServer(t, RoutesDefinition{
+		{http.MethodGet, "/exec/" + execID + "/json"}:    container.ExecInspect{ExecID: execID, ContainerID: containerID},
+		{http.MethodPost, "/exec/" + execID + "/start"}:  struct{}{},
+		{http.MethodPost, "/exec/" + execID + "/resize"}: struct{}{},
+	})
+	defer srv.Close()
+
+	transport := &Transport{
+		endpoint:      &portainer.Endpoint{URL: srv.URL},
+		dataStore:     ds,
+		HTTPTransport: &http.Transport{},
+	}
+
+	test := func(method, url string, token portainer.TokenData) (*http.Response, error) {
+		req := httptest.NewRequest(method, srv.URL+"/v"+version+url, nil)
+		req = req.WithContext(security.StoreTokenData(req, &token))
+		return transport.ProxyDockerRequest(req)
+	}
+
+	adminToken := portainer.TokenData{ID: admin.ID, Username: admin.Username, Role: admin.Role}
+	std1Token := portainer.TokenData{ID: std1.ID, Username: std1.Username, Role: std1.Role}
+	std2Token := portainer.TokenData{ID: std2.ID, Username: std2.Username, Role: std2.Role}
+
+	// admin can exec into any container
+	r, err := test(http.MethodPost, "/exec/"+execID+"/start", adminToken)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, r.StatusCode)
+	require.NoError(t, r.Body.Close())
+
+	// std1 owns the container, all exec operations allowed
+	r, err = test(http.MethodPost, "/exec/"+execID+"/start", std1Token)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, r.StatusCode)
+	require.NoError(t, r.Body.Close())
+
+	r, err = test(http.MethodGet, "/exec/"+execID+"/json", std1Token)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, r.StatusCode)
+	require.NoError(t, r.Body.Close())
+
+	r, err = test(http.MethodPost, "/exec/"+execID+"/resize", std1Token)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, r.StatusCode)
+	require.NoError(t, r.Body.Close())
+
+	// std2 does NOT own the container, all exec operations must be blocked
+	r, err = test(http.MethodPost, "/exec/"+execID+"/start", std2Token)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusForbidden, r.StatusCode)
+	require.NoError(t, r.Body.Close())
+
+	r, err = test(http.MethodGet, "/exec/"+execID+"/json", std2Token)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusForbidden, r.StatusCode)
+	require.NoError(t, r.Body.Close())
+
+	r, err = test(http.MethodPost, "/exec/"+execID+"/resize", std2Token)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusForbidden, r.StatusCode)
+	require.NoError(t, r.Body.Close())
+}
+
+func TestTransport_proxyExecRequest_createClientError(t *testing.T) {
+	t.Parallel()
+
+	// AzureEnvironment type causes CreateClient to return an error immediately
+	transport := &Transport{
+		endpoint:      &portainer.Endpoint{Type: portainer.AzureEnvironment},
+		HTTPTransport: &http.Transport{},
+	}
+
+	req := httptest.NewRequest(http.MethodPost, "http://localhost/v1.51/exec/2222/start", nil)
+	resp, err := transport.ProxyDockerRequest(req)
+	require.Error(t, err)
+	require.Nil(t, resp)
+	if resp != nil {
+		require.NoError(t, resp.Body.Close())
+	}
+}
+
+func TestTransport_proxyExecRequest_inspectError(t *testing.T) {
+	t.Parallel()
+
+	// Mock server that handles /_ping (for Docker client negotiation) but no exec routes
+	srv, version := mockDockerAPIServer(t, RoutesDefinition{})
+	defer srv.Close()
+
+	transport := &Transport{
+		endpoint:      &portainer.Endpoint{URL: srv.URL},
+		HTTPTransport: &http.Transport{},
+	}
+
+	req := httptest.NewRequest(http.MethodPost, srv.URL+"/v"+version+"/exec/2222/start", nil)
+	resp, err := transport.ProxyDockerRequest(req)
+	require.Error(t, err)
+	require.Nil(t, resp)
+	if resp != nil {
+		require.NoError(t, resp.Body.Close())
+	}
+}
+
+func TestTransport_proxyImageRequest_Prune(t *testing.T) {
+	t.Parallel()
+	admin := portainer.User{ID: 1, Username: "admin", Role: portainer.AdministratorRole}
+	std1 := portainer.User{ID: 2, Username: "std1", Role: portainer.StandardUserRole}
+
+	_, ds := datastore.MustNewTestStore(t, true, false)
+
+	require.NoError(t, ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		require.NoError(t, tx.User().Create(&admin))
+		require.NoError(t, tx.User().Create(&std1))
+		require.NoError(t, tx.Endpoint().Create(&portainer.Endpoint{ID: 1, Name: "env",
+			UserAccessPolicies: portainer.UserAccessPolicies{std1.ID: portainer.AccessPolicy{RoleID: 1}},
+		}))
+
+		return nil
+	}))
+
+	srv, version := mockDockerAPIServer(t, RoutesDefinition{
+		{http.MethodPost, "/images/prune"}: struct {
+			ImagesDeleted  []any `json:"ImagesDeleted"`
+			SpaceReclaimed int   `json:"SpaceReclaimed"`
+		}{
+			ImagesDeleted:  []any{},
+			SpaceReclaimed: 0,
+		},
+	})
+	defer srv.Close()
+
+	transport := &Transport{
+		endpoint:      &portainer.Endpoint{URL: srv.URL},
+		dataStore:     ds,
+		HTTPTransport: &http.Transport{},
+	}
+
+	test := func(method string, url string, token portainer.TokenData) (*http.Response, error) {
+		req := httptest.NewRequest(method, srv.URL+"/v"+version+url, nil)
+		req = req.WithContext(security.StoreTokenData(req, &token))
+		require.NotNil(t, req)
+
+		return transport.proxyImageRequest(req, url)
+	}
+
+	adminToken := portainer.TokenData{ID: admin.ID, Username: admin.Username, Role: admin.Role}
+	std1Token := portainer.TokenData{ID: std1.ID, Username: std1.Username, Role: std1.Role}
+
+	// Admin should be able to prune images
+	{
+		r, err := test(http.MethodPost, "/images/prune", adminToken)
+		require.NoError(t, err)
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusOK, r.StatusCode)
+		require.NoError(t, r.Body.Close())
+	}
+
+	// Standard user should NOT be able to prune images (administrator operation)
+	{
+		r, err := test(http.MethodPost, "/images/prune", std1Token)
+		require.NoError(t, err)
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusForbidden, r.StatusCode)
+		require.NoError(t, r.Body.Close())
+	}
+}
+
+func TestTransport_proxyBuildRequest_Prune(t *testing.T) {
+	t.Parallel()
+	admin := portainer.User{ID: 1, Username: "admin", Role: portainer.AdministratorRole}
+	std1 := portainer.User{ID: 2, Username: "std1", Role: portainer.StandardUserRole}
+
+	_, ds := datastore.MustNewTestStore(t, true, false)
+
+	require.NoError(t, ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		require.NoError(t, tx.User().Create(&admin))
+		require.NoError(t, tx.User().Create(&std1))
+		require.NoError(t, tx.Endpoint().Create(&portainer.Endpoint{ID: 1, Name: "env",
+			UserAccessPolicies: portainer.UserAccessPolicies{std1.ID: portainer.AccessPolicy{RoleID: 1}},
+		}))
+
+		return nil
+	}))
+
+	srv, version := mockDockerAPIServer(t, RoutesDefinition{
+		{http.MethodPost, "/build/prune"}: struct {
+			CachesDeleted  []string `json:"CachesDeleted"`
+			SpaceReclaimed int      `json:"SpaceReclaimed"`
+		}{
+			CachesDeleted:  []string{},
+			SpaceReclaimed: 0,
+		},
+	})
+	defer srv.Close()
+
+	transport := &Transport{
+		endpoint:      &portainer.Endpoint{URL: srv.URL},
+		dataStore:     ds,
+		HTTPTransport: &http.Transport{},
+	}
+
+	test := func(method string, url string, token portainer.TokenData) (*http.Response, error) {
+		req := httptest.NewRequest(method, srv.URL+"/v"+version+url, nil)
+		req = req.WithContext(security.StoreTokenData(req, &token))
+		require.NotNil(t, req)
+
+		return transport.proxyBuildRequest(req, url)
+	}
+
+	adminToken := portainer.TokenData{ID: admin.ID, Username: admin.Username, Role: admin.Role}
+	std1Token := portainer.TokenData{ID: std1.ID, Username: std1.Username, Role: std1.Role}
+
+	// Admin should be able to prune build cache
+	{
+		r, err := test(http.MethodPost, "/build/prune", adminToken)
+		require.NoError(t, err)
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusOK, r.StatusCode)
+		require.NoError(t, r.Body.Close())
+	}
+
+	// Standard user should NOT be able to prune build cache (administrator operation)
+	{
+		r, err := test(http.MethodPost, "/build/prune", std1Token)
+		require.NoError(t, err)
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusForbidden, r.StatusCode)
+		require.NoError(t, r.Body.Close())
+	}
+}
+
+func TestTransport_proxyContainerRequest(t *testing.T) {
+	t.Parallel()
+
+	const containerID = "1111"
+
+	admin := portainer.User{ID: 1, Username: "admin", Role: portainer.AdministratorRole}
+	std1 := portainer.User{ID: 2, Username: "std1", Role: portainer.StandardUserRole}
+	std2 := portainer.User{ID: 3, Username: "std2", Role: portainer.StandardUserRole}
+
+	_, ds := datastore.MustNewTestStore(t, true, false)
+
+	require.NoError(t, ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		require.NoError(t, tx.User().Create(&admin))
+		require.NoError(t, tx.User().Create(&std1))
+		require.NoError(t, tx.User().Create(&std2))
+		require.NoError(t, tx.Endpoint().Create(&portainer.Endpoint{ID: 1, Name: "env",
+			UserAccessPolicies: portainer.UserAccessPolicies{std1.ID: portainer.AccessPolicy{RoleID: 1}},
+		}))
+		require.NoError(t, tx.ResourceControl().Create(authorization.NewPrivateResourceControl(containerID, portainer.ContainerResourceControl, std1.ID)))
+
+		return nil
+	}))
+
+	srv, version := mockDockerAPIServer(t, RoutesDefinition{
+		{http.MethodPost, "/containers/" + containerID + "/start"}:    struct{}{},
+		{http.MethodGet, "/containers/" + containerID + "/attach/ws"}: struct{}{},
+		{http.MethodDelete, "/containers/" + containerID}:             struct{}{},
+		{http.MethodPost, "/containers/prune"}:                        struct{}{},
+	})
+	defer srv.Close()
+
+	transport := &Transport{
+		endpoint:      &portainer.Endpoint{ID: 1, URL: srv.URL},
+		dataStore:     ds,
+		HTTPTransport: &http.Transport{},
+	}
+
+	test := func(method, url string, token portainer.TokenData) (*http.Response, error) {
+		req := httptest.NewRequest(method, srv.URL+"/v"+version+url, nil)
+		req = req.WithContext(security.StoreTokenData(req, &token))
+		return transport.proxyContainerRequest(req, url)
+	}
+
+	adminToken := portainer.TokenData{ID: admin.ID, Username: admin.Username, Role: admin.Role}
+	std1Token := portainer.TokenData{ID: std1.ID, Username: std1.Username, Role: std1.Role}
+	std2Token := portainer.TokenData{ID: std2.ID, Username: std2.Username, Role: std2.Role}
+
+	// /containers/{id}/start (2-segment): admin and owner allowed, non-owner denied
+	r, err := test(http.MethodPost, "/containers/"+containerID+"/start", adminToken)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, r.StatusCode)
+	require.NoError(t, r.Body.Close())
+
+	r, err = test(http.MethodPost, "/containers/"+containerID+"/start", std1Token)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, r.StatusCode)
+	require.NoError(t, r.Body.Close())
+
+	r, err = test(http.MethodPost, "/containers/"+containerID+"/start", std2Token)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusForbidden, r.StatusCode)
+	require.NoError(t, r.Body.Close())
+
+	// /containers/{id}/attach/ws (3-segment): admin and owner allowed, non-owner denied
+	r, err = test(http.MethodGet, "/containers/"+containerID+"/attach/ws", adminToken)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, r.StatusCode)
+	require.NoError(t, r.Body.Close())
+
+	r, err = test(http.MethodGet, "/containers/"+containerID+"/attach/ws", std1Token)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, r.StatusCode)
+	require.NoError(t, r.Body.Close())
+
+	r, err = test(http.MethodGet, "/containers/"+containerID+"/attach/ws", std2Token)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusForbidden, r.StatusCode)
+	require.NoError(t, r.Body.Close())
+
+	// DELETE /containers/{id}: non-owner denied, admin allowed
+	// std2 must be tested before admin: a successful delete removes the resource control from the datastore
+	r, err = test(http.MethodDelete, "/containers/"+containerID, std2Token)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusForbidden, r.StatusCode)
+	require.NoError(t, r.Body.Close())
+
+	r, err = test(http.MethodDelete, "/containers/"+containerID, adminToken)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, r.StatusCode)
+	require.NoError(t, r.Body.Close())
+
+	// /containers/prune: admin-only
+	r, err = test(http.MethodPost, "/containers/prune", adminToken)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, r.StatusCode)
+	require.NoError(t, r.Body.Close())
+
+	r, err = test(http.MethodPost, "/containers/prune", std1Token)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusForbidden, r.StatusCode)
+	require.NoError(t, r.Body.Close())
+}
diff --git a/api/http/proxy/factory/docker/volumes.go b/api/http/proxy/factory/docker/volumes.go
new file mode 100644
index 0000000..dc51700
--- /dev/null
+++ b/api/http/proxy/factory/docker/volumes.go
@@ -0,0 +1,305 @@
+package docker
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"path"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/proxy/factory/utils"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/internal/snapshot"
+	"github.com/portainer/portainer/api/logs"
+
+	"github.com/docker/docker/client"
+	"github.com/segmentio/encoding/json"
+)
+
+const volumeObjectIdentifier = "ResourceID"
+
+func getInheritedResourceControlFromVolumeLabels(dockerClient *client.Client, endpointID portainer.EndpointID, volumeID string, resourceControls []portainer.ResourceControl) (*portainer.ResourceControl, error) {
+	volume, err := dockerClient.VolumeInspect(context.Background(), volumeID)
+	if err != nil {
+		return nil, err
+	}
+
+	stackResourceID := getStackResourceIDFromLabels(volume.Labels, endpointID)
+	if stackResourceID != "" {
+		return authorization.GetResourceControlByResourceIDAndType(stackResourceID, portainer.StackResourceControl, resourceControls), nil
+	}
+
+	return nil, nil
+}
+
+// volumeListOperation extracts the response as a JSON object, loop through the volume array
+// decorate and/or filter the volumes based on resource controls before rewriting the response.
+func (transport *Transport) volumeListOperation(response *http.Response, executor *operationExecutor) error {
+	// VolumeList response is a JSON object
+	// https://docs.docker.com/engine/api/v1.28/#operation/VolumeList
+	responseObject, err := utils.GetResponseAsJSONObject(response)
+	if err != nil {
+		return err
+	}
+
+	// The "Volumes" field contains the list of volumes as an array of JSON objects
+	if responseObject["Volumes"] == nil {
+		return utils.RewriteResponse(response, responseObject, http.StatusOK)
+	}
+
+	volumeData := responseObject["Volumes"].([]any)
+
+	for _, volumeObject := range volumeData {
+		volume := volumeObject.(map[string]any)
+
+		if err := transport.decorateVolumeResponseWithResourceID(volume); err != nil {
+			return fmt.Errorf("failed decorating volume response: %w", err)
+		}
+	}
+
+	resourceOperationParameters := &resourceOperationParameters{
+		resourceIdentifierAttribute: volumeObjectIdentifier,
+		resourceType:                portainer.VolumeResourceControl,
+		labelsObjectSelector:        selectorVolumeLabels,
+	}
+
+	volumeData, err = transport.applyAccessControlOnResourceList(resourceOperationParameters, volumeData, executor)
+	if err != nil {
+		return err
+	}
+
+	// Overwrite the original volume list
+	responseObject["Volumes"] = volumeData
+
+	return utils.RewriteResponse(response, responseObject, http.StatusOK)
+}
+
+// volumeInspectOperation extracts the response as a JSON object, verify that the user
+// has access to the volume based on any existing resource control and either rewrite an access denied response or a decorated volume.
+func (transport *Transport) volumeInspectOperation(response *http.Response, executor *operationExecutor) error {
+	// VolumeInspect response is a JSON object
+	// https://docs.docker.com/engine/api/v1.28/#operation/VolumeInspect
+	responseObject, err := utils.GetResponseAsJSONObject(response)
+	if err != nil {
+		return err
+	}
+
+	if err := transport.decorateVolumeResponseWithResourceID(responseObject); err != nil {
+		return fmt.Errorf("failed decorating volume response: %w", err)
+	}
+
+	resourceOperationParameters := &resourceOperationParameters{
+		resourceIdentifierAttribute: volumeObjectIdentifier,
+		resourceType:                portainer.VolumeResourceControl,
+		labelsObjectSelector:        selectorVolumeLabels,
+	}
+
+	return transport.applyAccessControlOnResource(resourceOperationParameters, responseObject, response, executor)
+}
+
+func (transport *Transport) decorateVolumeResponseWithResourceID(responseObject map[string]any) error {
+	if responseObject["Name"] == nil {
+		return errors.New("missing identifier in Docker resource detail response")
+	}
+
+	resourceID, err := transport.getVolumeResourceID(responseObject["Name"].(string))
+	if err != nil {
+		return fmt.Errorf("failed fetching resource id: %w", err)
+	}
+
+	responseObject[volumeObjectIdentifier] = resourceID
+
+	return nil
+}
+
+// selectorVolumeLabels retrieve the labels object associated to the volume object.
+// Labels are available under the "Labels" property.
+// API schema references:
+// https://docs.docker.com/engine/api/v1.28/#operation/VolumeInspect
+// https://docs.docker.com/engine/api/v1.28/#operation/VolumeList
+func selectorVolumeLabels(responseObject map[string]any) map[string]any {
+	return utils.GetJSONObject(responseObject, "Labels")
+}
+
+func CheckVolumeBodyRestrictions(request *http.Request) error {
+	defer logs.CloseAndLogErr(request.Body)
+
+	body, err := io.ReadAll(request.Body)
+	if err != nil {
+		return err
+	}
+
+	var volumeCreateBody struct {
+		DriverOpts map[string]string `json:"DriverOpts"`
+	}
+
+	if err := json.Unmarshal(body, &volumeCreateBody); err != nil {
+		return err
+	}
+
+	if volumeCreateBody.DriverOpts["type"] == "bind" {
+		return ErrBindMountsForbidden
+	}
+
+	request.Body = io.NopCloser(bytes.NewBuffer(body))
+
+	return nil
+}
+
+func (transport *Transport) decorateVolumeResourceCreationOperation(request *http.Request, resourceType portainer.ResourceControlType) (*http.Response, error) {
+	tokenData, err := security.RetrieveTokenData(request)
+	if err != nil {
+		return nil, err
+	}
+
+	isAdminOrEndpointAdmin, err := transport.isAdminOrEndpointAdmin(request)
+	if err != nil {
+		return nil, err
+	}
+
+	if !isAdminOrEndpointAdmin {
+		securitySettings, err := transport.fetchEndpointSecuritySettings()
+		if err != nil {
+			return nil, err
+		}
+
+		if !securitySettings.AllowBindMountsForRegularUsers {
+			if err := CheckVolumeBodyRestrictions(request); err != nil {
+				return &http.Response{
+					StatusCode: http.StatusForbidden,
+					Body:       io.NopCloser(bytes.NewBufferString("Access denied: insufficient permissions to create volume with specified configuration")),
+				}, err
+			}
+		}
+	}
+
+	volumeID := request.Header.Get("X-Portainer-VolumeName")
+
+	if volumeID != "" {
+		agentTargetHeader := request.Header.Get(portainer.PortainerAgentTargetHeader)
+		cli, err := transport.dockerClientFactory.CreateClient(transport.endpoint, agentTargetHeader, nil)
+		if err != nil {
+			return nil, err
+		}
+		defer logs.CloseAndLogErr(cli)
+
+		if _, err := cli.VolumeInspect(context.Background(), volumeID); err == nil {
+			return &http.Response{
+				StatusCode: http.StatusConflict,
+			}, errors.New("a volume with the same name already exists")
+		}
+	}
+
+	response, err := transport.executeDockerRequest(request)
+	if err != nil {
+		return response, err
+	}
+
+	if response.StatusCode == http.StatusCreated {
+		err = transport.decorateVolumeCreationResponse(response, resourceType, tokenData.ID)
+	}
+
+	return response, err
+}
+
+func (transport *Transport) decorateVolumeCreationResponse(response *http.Response, resourceType portainer.ResourceControlType, userID portainer.UserID) error {
+	responseObject, err := utils.GetResponseAsJSONObject(response)
+	if err != nil {
+		return err
+	}
+
+	if responseObject["Name"] == nil {
+		return errors.New("missing identifier in Docker resource creation response")
+	}
+
+	resourceID, err := transport.getVolumeResourceID(responseObject["Name"].(string))
+	if err != nil {
+		return fmt.Errorf("failed fetching resource id: %w", err)
+	}
+
+	resourceControl, err := transport.createPrivateResourceControl(resourceID, resourceType, userID)
+	if err != nil {
+		return err
+	}
+
+	responseObject[volumeObjectIdentifier] = resourceID
+
+	responseObject = decorateObject(responseObject, resourceControl)
+
+	return utils.RewriteResponse(response, responseObject, http.StatusOK)
+}
+
+func (transport *Transport) restrictedVolumeOperation(requestPath string, request *http.Request) (*http.Response, error) {
+	if request.Method == http.MethodGet {
+		return transport.rewriteOperation(request, transport.volumeInspectOperation)
+	}
+
+	volumeName := path.Base(requestPath)
+
+	resourceID, err := transport.getVolumeResourceID(volumeName)
+	if err != nil {
+		return nil, err
+	}
+
+	if request.Method == http.MethodDelete {
+		return transport.executeGenericResourceDeletionOperation(request, resourceID, volumeName, portainer.VolumeResourceControl)
+	}
+
+	return transport.restrictedResourceOperation(request, resourceID, volumeName, portainer.VolumeResourceControl, false)
+}
+
+func (transport *Transport) getVolumeResourceID(volumeName string) (string, error) {
+	dockerID, err := transport.getDockerID()
+	if err != nil {
+		return "", fmt.Errorf("failed fetching docker id: %w", err)
+	}
+
+	return fmt.Sprintf("%s_%s", volumeName, dockerID), nil
+}
+
+func (transport *Transport) getDockerID() (string, error) {
+	transport.mu.Lock()
+	defer transport.mu.Unlock()
+
+	// Local cache
+	if transport.dockerID != "" {
+		return transport.dockerID, nil
+	}
+
+	// Snapshot cache
+	if transport.snapshotService != nil {
+		endpoint := portainer.Endpoint{ID: transport.endpoint.ID}
+
+		if err := transport.snapshotService.FillSnapshotData(&endpoint, true); err == nil && len(endpoint.Snapshots) > 0 {
+			if dockerID, err := snapshot.FetchDockerID(endpoint.Snapshots[0]); err == nil {
+				transport.dockerID = dockerID
+				return dockerID, nil
+			}
+		}
+	}
+
+	// Remote value
+	client, err := transport.dockerClientFactory.CreateClient(transport.endpoint, "", nil)
+	if err != nil {
+		return "", err
+	}
+	defer logs.CloseAndLogErr(client)
+
+	info, err := client.Info(context.Background())
+	if err != nil {
+		return "", err
+	}
+
+	if info.Swarm.Cluster != nil {
+		transport.dockerID = info.Swarm.Cluster.ID
+		return transport.dockerID, nil
+	}
+
+	transport.dockerID = info.ID
+
+	return transport.dockerID, nil
+}
diff --git a/api/http/proxy/factory/docker/volumes_test.go b/api/http/proxy/factory/docker/volumes_test.go
new file mode 100644
index 0000000..8e255d2
--- /dev/null
+++ b/api/http/proxy/factory/docker/volumes_test.go
@@ -0,0 +1,226 @@
+package docker
+
+import (
+	"bytes"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/http/security"
+
+	"github.com/docker/docker/api/types/volume"
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/require"
+)
+
+const volumeCreationAPIVersion = "1.51"
+
+type volumeCreationFixtures struct {
+	dockerSrv  *httptest.Server
+	ds         dataservices.DataStore
+	stdUser    portainer.User
+	adminUser  portainer.User
+	endpointID portainer.EndpointID
+}
+
+func newVolumeCreationFixtures(t *testing.T) *volumeCreationFixtures {
+	t.Helper()
+
+	dockerSrv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == http.MethodHead && r.URL.Path == "/_ping" {
+			w.Header().Add("Api-Version", volumeCreationAPIVersion)
+			_, _ = w.Write([]byte{})
+
+			return
+		}
+
+		if r.Method == http.MethodPost {
+			data, err := json.Marshal(map[string]string{"Name": "test-volume"})
+			if err != nil {
+				http.Error(w, err.Error(), http.StatusInternalServerError)
+
+				return
+			}
+
+			w.Header().Set("Content-Type", "application/json")
+			w.WriteHeader(http.StatusCreated)
+			_, _ = w.Write(data)
+
+			return
+		}
+
+		http.NotFound(w, r)
+	}))
+	t.Cleanup(dockerSrv.Close)
+
+	_, store := datastore.MustNewTestStore(t, true, false)
+
+	f := &volumeCreationFixtures{
+		dockerSrv:  dockerSrv,
+		ds:         store,
+		stdUser:    portainer.User{ID: 1, Username: "std", Role: portainer.StandardUserRole},
+		adminUser:  portainer.User{ID: 2, Username: "admin", Role: portainer.AdministratorRole},
+		endpointID: portainer.EndpointID(1),
+	}
+
+	err := store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		err := tx.User().Create(&f.stdUser)
+		require.NoError(t, err)
+
+		err = tx.User().Create(&f.adminUser)
+		require.NoError(t, err)
+
+		err = tx.Endpoint().Create(&portainer.Endpoint{ID: f.endpointID, Name: "test-env"})
+		require.NoError(t, err)
+
+		return nil
+	})
+	require.NoError(t, err)
+
+	return f
+}
+
+func (f *volumeCreationFixtures) setSecuritySettings(t *testing.T, settings portainer.EndpointSecuritySettings) {
+	t.Helper()
+
+	err := f.ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.Endpoint().UpdateEndpoint(f.endpointID, &portainer.Endpoint{
+			ID:               f.endpointID,
+			Name:             "test-env",
+			SecuritySettings: settings,
+		})
+	})
+	require.NoError(t, err)
+}
+
+func (f *volumeCreationFixtures) newTransport() *Transport {
+	return &Transport{
+		endpoint:      &portainer.Endpoint{ID: f.endpointID},
+		dataStore:     f.ds,
+		HTTPTransport: &http.Transport{},
+	}
+}
+
+func (f *volumeCreationFixtures) newRequest(t *testing.T, body volume.CreateOptions, user portainer.User) *http.Request {
+	t.Helper()
+
+	data, err := json.Marshal(body)
+	require.NoError(t, err)
+
+	req, err := http.NewRequestWithContext(
+		t.Context(),
+		http.MethodPost,
+		f.dockerSrv.URL+"/v"+volumeCreationAPIVersion+"/volumes/create",
+		bytes.NewReader(data),
+	)
+	require.NoError(t, err)
+
+	return req.WithContext(security.StoreTokenData(req, &portainer.TokenData{
+		ID:       user.ID,
+		Username: user.Username,
+		Role:     user.Role,
+	}))
+}
+
+func TestDecorateVolumeResourceCreationOperation_BindDriverOptForbidden(t *testing.T) {
+	t.Parallel()
+
+	f := newVolumeCreationFixtures(t)
+	f.setSecuritySettings(t, portainer.EndpointSecuritySettings{
+		AllowBindMountsForRegularUsers: false,
+	})
+
+	body := volume.CreateOptions{
+		Name:   "evil-volume",
+		Driver: "local",
+		DriverOpts: map[string]string{
+			"type":   "bind",
+			"device": "/etc",
+			"o":      "bind",
+		},
+	}
+
+	resp, err := f.newTransport().decorateVolumeResourceCreationOperation(f.newRequest(t, body, f.stdUser), portainer.VolumeResourceControl)
+	require.ErrorIs(t, err, ErrBindMountsForbidden)
+	require.NotNil(t, resp)
+	require.Equal(t, http.StatusForbidden, resp.StatusCode)
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}
+
+func TestDecorateVolumeResourceCreationOperation_BindDriverOptAllowedForAdmin(t *testing.T) {
+	t.Parallel()
+
+	f := newVolumeCreationFixtures(t)
+	f.setSecuritySettings(t, portainer.EndpointSecuritySettings{
+		AllowBindMountsForRegularUsers: false,
+	})
+
+	body := volume.CreateOptions{
+		Name:   "admin-volume",
+		Driver: "local",
+		DriverOpts: map[string]string{
+			"type":   "bind",
+			"device": "/etc",
+		},
+	}
+
+	resp, err := f.newTransport().decorateVolumeResourceCreationOperation(f.newRequest(t, body, f.adminUser), portainer.VolumeResourceControl)
+	require.NotErrorIs(t, err, ErrBindMountsForbidden)
+	require.NotNil(t, resp)
+	require.NotEqual(t, http.StatusForbidden, resp.StatusCode)
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}
+
+func TestDecorateVolumeResourceCreationOperation_BindDriverOptAllowedWhenSettingPermissive(t *testing.T) {
+	t.Parallel()
+
+	f := newVolumeCreationFixtures(t)
+	f.setSecuritySettings(t, portainer.EndpointSecuritySettings{
+		AllowBindMountsForRegularUsers: true,
+	})
+
+	body := volume.CreateOptions{
+		Name:   "allowed-volume",
+		Driver: "local",
+		DriverOpts: map[string]string{
+			"type":   "bind",
+			"device": "/data",
+		},
+	}
+
+	resp, err := f.newTransport().decorateVolumeResourceCreationOperation(f.newRequest(t, body, f.stdUser), portainer.VolumeResourceControl)
+	require.NotErrorIs(t, err, ErrBindMountsForbidden)
+	require.NotNil(t, resp)
+	require.NotEqual(t, http.StatusForbidden, resp.StatusCode)
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}
+
+func TestDecorateVolumeResourceCreationOperation_NonBindDriverOptNotForbidden(t *testing.T) {
+	t.Parallel()
+
+	f := newVolumeCreationFixtures(t)
+	f.setSecuritySettings(t, portainer.EndpointSecuritySettings{
+		AllowBindMountsForRegularUsers: false,
+	})
+
+	body := volume.CreateOptions{
+		Name:   "normal-volume",
+		Driver: "local",
+		DriverOpts: map[string]string{
+			"type": "tmpfs",
+		},
+	}
+
+	resp, err := f.newTransport().decorateVolumeResourceCreationOperation(f.newRequest(t, body, f.stdUser), portainer.VolumeResourceControl)
+	require.NotErrorIs(t, err, ErrBindMountsForbidden)
+	require.NotNil(t, resp)
+	require.NotEqual(t, http.StatusForbidden, resp.StatusCode)
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}
diff --git a/api/http/proxy/factory/docker_unix.go b/api/http/proxy/factory/docker_unix.go
new file mode 100644
index 0000000..5cc9621
--- /dev/null
+++ b/api/http/proxy/factory/docker_unix.go
@@ -0,0 +1,43 @@
+//go:build aix || darwin || dragonfly || freebsd || linux || netbsd || openbsd || solaris
+
+package factory
+
+import (
+	"context"
+	"net"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/proxy/factory/docker"
+	"github.com/portainer/portainer/pkg/libhttp/ssrf"
+)
+
+func (factory ProxyFactory) newOSBasedLocalProxy(path string, endpoint *portainer.Endpoint) (http.Handler, error) {
+	transportParameters := &docker.TransportParameters{
+		Endpoint:             endpoint,
+		DataStore:            factory.dataStore,
+		ReverseTunnelService: factory.reverseTunnelService,
+		SignatureService:     factory.signatureService,
+		DockerClientFactory:  factory.dockerClientFactory,
+	}
+
+	proxy := &dockerLocalProxy{}
+
+	dockerTransport, err := docker.NewTransport(transportParameters, newSocketTransport(path), factory.gitService, factory.snapshotService)
+	if err != nil {
+		return nil, err
+	}
+
+	proxy.transport = dockerTransport
+	return proxy, nil
+}
+
+func newSocketTransport(socketPath string) *http.Transport {
+	d := &net.Dialer{}
+	t := ssrf.NewInternalTransport(nil)
+	t.DialContext = func(ctx context.Context, _, _ string) (net.Conn, error) {
+		return d.DialContext(ctx, "unix", socketPath)
+	}
+
+	return t
+}
diff --git a/api/http/proxy/factory/docker_windows.go b/api/http/proxy/factory/docker_windows.go
new file mode 100644
index 0000000..08feaf2
--- /dev/null
+++ b/api/http/proxy/factory/docker_windows.go
@@ -0,0 +1,43 @@
+//go:build windows
+
+package factory
+
+import (
+	"context"
+	"net"
+	"net/http"
+
+	"github.com/Microsoft/go-winio"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/proxy/factory/docker"
+	"github.com/portainer/portainer/pkg/libhttp/ssrf"
+)
+
+func (factory ProxyFactory) newOSBasedLocalProxy(path string, endpoint *portainer.Endpoint) (http.Handler, error) {
+	transportParameters := &docker.TransportParameters{
+		Endpoint:             endpoint,
+		DataStore:            factory.dataStore,
+		ReverseTunnelService: factory.reverseTunnelService,
+		SignatureService:     factory.signatureService,
+		DockerClientFactory:  factory.dockerClientFactory,
+	}
+
+	proxy := &dockerLocalProxy{}
+
+	dockerTransport, err := docker.NewTransport(transportParameters, newNamedPipeTransport(path), factory.gitService, factory.snapshotService)
+	if err != nil {
+		return nil, err
+	}
+
+	proxy.transport = dockerTransport
+	return proxy, nil
+}
+
+func newNamedPipeTransport(namedPipePath string) *http.Transport {
+	t := ssrf.NewInternalTransport(nil)
+	t.DialContext = func(_ context.Context, _, _ string) (net.Conn, error) {
+		return winio.DialPipe(namedPipePath, nil)
+	}
+
+	return t
+}
diff --git a/api/http/proxy/factory/factory.go b/api/http/proxy/factory/factory.go
new file mode 100644
index 0000000..b456296
--- /dev/null
+++ b/api/http/proxy/factory/factory.go
@@ -0,0 +1,61 @@
+package factory
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	dockerclient "github.com/portainer/portainer/api/docker/client"
+	"github.com/portainer/portainer/api/http/proxy/factory/kubernetes"
+
+	"github.com/portainer/portainer/api/kubernetes/cli"
+)
+
+const azureAPIBaseURL = "https://management.azure.com"
+
+type (
+	// ProxyFactory is a factory to create reverse proxies
+	ProxyFactory struct {
+		dataStore                   dataservices.DataStore
+		signatureService            portainer.DigitalSignatureService
+		reverseTunnelService        portainer.ReverseTunnelService
+		dockerClientFactory         *dockerclient.ClientFactory
+		kubernetesClientFactory     *cli.ClientFactory
+		kubernetesTokenCacheManager *kubernetes.TokenCacheManager
+		gitService                  portainer.GitService
+		snapshotService             portainer.SnapshotService
+		jwtService                  portainer.JWTService
+	}
+)
+
+// NewProxyFactory returns a pointer to a new instance of a ProxyFactory
+func NewProxyFactory(dataStore dataservices.DataStore, signatureService portainer.DigitalSignatureService, tunnelService portainer.ReverseTunnelService, clientFactory *dockerclient.ClientFactory, kubernetesClientFactory *cli.ClientFactory, kubernetesTokenCacheManager *kubernetes.TokenCacheManager, gitService portainer.GitService, snapshotService portainer.SnapshotService, jwtService portainer.JWTService) *ProxyFactory {
+	return &ProxyFactory{
+		dataStore:                   dataStore,
+		signatureService:            signatureService,
+		reverseTunnelService:        tunnelService,
+		dockerClientFactory:         clientFactory,
+		kubernetesClientFactory:     kubernetesClientFactory,
+		kubernetesTokenCacheManager: kubernetesTokenCacheManager,
+		gitService:                  gitService,
+		snapshotService:             snapshotService,
+		jwtService:                  jwtService,
+	}
+}
+
+// NewEndpointProxy returns a new reverse proxy (filesystem based or HTTP) to an environment(endpoint) API server
+func (factory *ProxyFactory) NewEndpointProxy(endpoint *portainer.Endpoint) (http.Handler, error) {
+	switch endpoint.Type {
+	case portainer.AzureEnvironment:
+		return newAzureProxy(endpoint, factory.dataStore)
+	case portainer.EdgeAgentOnKubernetesEnvironment, portainer.AgentOnKubernetesEnvironment, portainer.KubernetesLocalEnvironment:
+		return factory.newKubernetesProxy(endpoint)
+	}
+
+	return factory.newDockerProxy(endpoint)
+}
+
+// NewGitlabProxy returns a new HTTP proxy to a Gitlab API server
+func (factory *ProxyFactory) NewGitlabProxy(gitlabAPIUri string) (http.Handler, error) {
+	return newGitlabProxy(gitlabAPIUri)
+}
diff --git a/api/http/proxy/factory/github/client.go b/api/http/proxy/factory/github/client.go
new file mode 100644
index 0000000..84291fb
--- /dev/null
+++ b/api/http/proxy/factory/github/client.go
@@ -0,0 +1,115 @@
+package github
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/portainer/portainer/pkg/libhttp/ssrf"
+
+	"github.com/rs/zerolog/log"
+	"github.com/segmentio/encoding/json"
+	"oras.land/oras-go/v2/registry/remote/retry"
+)
+
+const GitHubAPIHost = "https://api.github.com"
+
+// Package represents a GitHub container package
+type Package struct {
+	Name  string `json:"name"`
+	Owner struct {
+		Login string `json:"login"`
+	} `json:"owner"`
+}
+
+// Client represents a GitHub API client
+type Client struct {
+	httpClient *http.Client
+	baseURL    string
+}
+
+// NewClient creates a new GitHub API client
+func NewClient(token string) *Client {
+	return &Client{
+		httpClient: NewHTTPClient(token),
+		baseURL:    GitHubAPIHost,
+	}
+}
+
+// GetContainerPackages fetches container packages for the configured namespace
+// It's a small http client wrapper instead of using the github client because listing repositories is the only known operation that isn't directly supported by oras
+func (c *Client) GetContainerPackages(ctx context.Context, useOrganisation bool, organisationName string) ([]string, error) {
+	// Determine the namespace (user or organisation) for the request
+	namespace := "user"
+	if useOrganisation {
+		namespace = "orgs/" + organisationName
+	}
+
+	// Build the full URL for listing container packages
+	url := fmt.Sprintf("%s/%s/packages?package_type=container", c.baseURL, namespace)
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create request: %w", err)
+	}
+
+	resp, err := c.httpClient.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("failed to execute request: %w", err)
+	}
+	defer func() {
+		if err := resp.Body.Close(); err != nil {
+			log.Warn().Err(err).Msg("failed to close response body")
+		}
+	}()
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("GitHub API returned status %d: %s", resp.StatusCode, resp.Status)
+	}
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read response body: %w", err)
+	}
+
+	var packages []Package
+	if err := json.Unmarshal(body, &packages); err != nil {
+		return nil, fmt.Errorf("failed to parse response: %w", err)
+	}
+
+	// Extract repository names in the form "owner/name"
+	repositories := make([]string, len(packages))
+	for i, pkg := range packages {
+		repositories[i] = fmt.Sprintf("%s/%s", strings.ToLower(pkg.Owner.Login), strings.ToLower(pkg.Name))
+	}
+
+	return repositories, nil
+}
+
+// NewHTTPClient creates a new HTTP client configured for GitHub API requests
+func NewHTTPClient(token string) *http.Client {
+	return &http.Client{
+		Transport: &tokenTransport{
+			token:     token,
+			transport: retry.NewTransport(ssrf.NewTransport(nil)), // Use ORAS retry transport for consistent rate limiting and error handling
+		},
+		Timeout: 1 * time.Minute,
+	}
+}
+
+// tokenTransport automatically adds the Bearer token header to requests
+type tokenTransport struct {
+	token     string
+	transport http.RoundTripper
+}
+
+func (t *tokenTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	if t.token != "" {
+		req.Header.Set("Authorization", "Bearer "+t.token)
+		req.Header.Set("Accept", "application/vnd.github+json")
+	}
+	return t.transport.RoundTrip(req)
+}
diff --git a/api/http/proxy/factory/gitlab.go b/api/http/proxy/factory/gitlab.go
new file mode 100644
index 0000000..7c1ae96
--- /dev/null
+++ b/api/http/proxy/factory/gitlab.go
@@ -0,0 +1,19 @@
+package factory
+
+import (
+	"net/http"
+	"net/url"
+
+	"github.com/portainer/portainer/api/http/proxy/factory/gitlab"
+)
+
+func newGitlabProxy(uri string) (http.Handler, error) {
+	url, err := url.Parse(uri)
+	if err != nil {
+		return nil, err
+	}
+
+	proxy := NewSingleHostReverseProxyWithHostHeader(url)
+	proxy.Transport = gitlab.NewTransport()
+	return proxy, nil
+}
diff --git a/api/http/proxy/factory/gitlab/client.go b/api/http/proxy/factory/gitlab/client.go
new file mode 100644
index 0000000..e3b5b2e
--- /dev/null
+++ b/api/http/proxy/factory/gitlab/client.go
@@ -0,0 +1,137 @@
+package gitlab
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"time"
+
+	"github.com/portainer/portainer/pkg/libhttp/ssrf"
+
+	"github.com/rs/zerolog/log"
+	"github.com/segmentio/encoding/json"
+	"oras.land/oras-go/v2/registry/remote/retry"
+)
+
+// Repository represents a GitLab registry repository
+type Repository struct {
+	ID        int    `json:"id"`
+	Name      string `json:"name"`
+	Path      string `json:"path"`
+	ProjectID int    `json:"project_id"`
+	Location  string `json:"location"`
+	CreatedAt string `json:"created_at"`
+	Status    string `json:"status"`
+}
+
+// Client represents a GitLab API client
+type Client struct {
+	httpClient *http.Client
+	baseURL    string
+}
+
+// NewClient creates a new GitLab API client
+// it currently is an http client because only GetRegistryRepositoryNames is needed (oras supports other commands).
+// if we need to support other commands, consider using the gitlab client library.
+func NewClient(baseURL, token string) *Client {
+	return &Client{
+		httpClient: NewHTTPClient(token),
+		baseURL:    baseURL,
+	}
+}
+
+// GetRegistryRepositoryNames fetches registry repository names for a given project.
+// It's a small http client wrapper instead of using the gitlab client library because listing repositories is the only known operation that isn't directly supported by oras
+func (c *Client) GetRegistryRepositoryNames(ctx context.Context, projectID int) ([]string, error) {
+	url := fmt.Sprintf("%s/api/v4/projects/%d/registry/repositories", c.baseURL, projectID)
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create request: %w", err)
+	}
+
+	resp, err := c.httpClient.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("failed to execute request: %w", err)
+	}
+	defer func() {
+		if err := resp.Body.Close(); err != nil {
+			log.Warn().Err(err).Msg("failed to close response body")
+		}
+	}()
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("GitLab API returned status %d: %s", resp.StatusCode, resp.Status)
+	}
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read response body: %w", err)
+	}
+
+	var repositories []Repository
+	if err := json.Unmarshal(body, &repositories); err != nil {
+		return nil, fmt.Errorf("failed to parse response: %w", err)
+	}
+
+	// Extract repository names
+	names := make([]string, len(repositories))
+	for i, repo := range repositories {
+		// the full path is required for further repo operations
+		names[i] = repo.Path
+	}
+
+	return names, nil
+}
+
+type Transport struct {
+	httpTransport *http.Transport
+}
+
+// NewTransport returns a pointer to a new instance of Transport that implements the HTTP Transport
+// interface for proxying requests to the Gitlab API.
+func NewTransport() *Transport {
+	return &Transport{
+		httpTransport: ssrf.NewTransport(nil),
+	}
+}
+
+// RoundTrip is the implementation of the http.RoundTripper interface
+func (transport *Transport) RoundTrip(request *http.Request) (*http.Response, error) {
+	token := request.Header.Get("Private-Token")
+	if token == "" {
+		return nil, errors.New("no gitlab token provided")
+	}
+
+	r, err := http.NewRequest(request.Method, request.URL.String(), request.Body)
+	if err != nil {
+		return nil, err
+	}
+
+	r.Header.Set("Private-Token", token)
+	return transport.httpTransport.RoundTrip(r)
+}
+
+// NewHTTPClient creates a new HTTP client configured for GitLab API requests
+func NewHTTPClient(token string) *http.Client {
+	return &http.Client{
+		Transport: &tokenTransport{
+			token:     token,
+			transport: retry.NewTransport(ssrf.NewTransport(nil)), // Use ORAS retry transport for consistent rate limiting and error handling
+		},
+		Timeout: 1 * time.Minute,
+	}
+}
+
+// tokenTransport automatically adds the Private-Token header to requests
+type tokenTransport struct {
+	token     string
+	transport http.RoundTripper
+}
+
+func (t *tokenTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	req.Header.Set("Private-Token", t.token)
+	return t.transport.RoundTrip(req)
+}
diff --git a/api/http/proxy/factory/kubernetes.go b/api/http/proxy/factory/kubernetes.go
new file mode 100644
index 0000000..43ed7d5
--- /dev/null
+++ b/api/http/proxy/factory/kubernetes.go
@@ -0,0 +1,110 @@
+package factory
+
+import (
+	"net/http"
+	"net/url"
+
+	"github.com/portainer/portainer/api/http/proxy/factory/kubernetes"
+
+	portainer "github.com/portainer/portainer/api"
+)
+
+func (factory *ProxyFactory) newKubernetesProxy(endpoint *portainer.Endpoint) (http.Handler, error) {
+	switch endpoint.Type {
+	case portainer.KubernetesLocalEnvironment:
+		return factory.newKubernetesLocalProxy(endpoint)
+	case portainer.EdgeAgentOnKubernetesEnvironment:
+		return factory.newKubernetesEdgeHTTPProxy(endpoint)
+	}
+
+	return factory.newKubernetesAgentHTTPSProxy(endpoint)
+}
+
+func (factory *ProxyFactory) newKubernetesLocalProxy(endpoint *portainer.Endpoint) (http.Handler, error) {
+	remoteURL, err := url.Parse(endpoint.URL)
+	if err != nil {
+		return nil, err
+	}
+
+	kubecli, err := factory.kubernetesClientFactory.GetPrivilegedKubeClient(endpoint)
+	if err != nil {
+		return nil, err
+	}
+
+	tokenCache := factory.kubernetesTokenCacheManager.GetOrCreateTokenCache(endpoint.ID)
+	tokenManager, err := kubernetes.NewTokenManager(kubecli, factory.dataStore, tokenCache, true)
+	if err != nil {
+		return nil, err
+	}
+
+	transport, err := kubernetes.NewLocalTransport(tokenManager, endpoint, factory.kubernetesClientFactory, factory.dataStore, factory.jwtService)
+	if err != nil {
+		return nil, err
+	}
+
+	proxy := NewSingleHostReverseProxyWithHostHeader(remoteURL)
+	proxy.Transport = transport
+
+	return proxy, nil
+}
+
+func (factory *ProxyFactory) newKubernetesEdgeHTTPProxy(endpoint *portainer.Endpoint) (http.Handler, error) {
+	tunnelAddr, err := factory.reverseTunnelService.TunnelAddr(endpoint)
+	if err != nil {
+		return nil, err
+	}
+	rawURL := "http://" + tunnelAddr
+
+	endpointURL, err := url.Parse(rawURL)
+	if err != nil {
+		return nil, err
+	}
+
+	kubecli, err := factory.kubernetesClientFactory.GetPrivilegedKubeClient(endpoint)
+	if err != nil {
+		return nil, err
+	}
+
+	tokenCache := factory.kubernetesTokenCacheManager.GetOrCreateTokenCache(endpoint.ID)
+	tokenManager, err := kubernetes.NewTokenManager(kubecli, factory.dataStore, tokenCache, false)
+	if err != nil {
+		return nil, err
+	}
+
+	endpointURL.Scheme = "http"
+	proxy := NewSingleHostReverseProxyWithHostHeader(endpointURL)
+	proxy.Transport = kubernetes.NewEdgeTransport(factory.dataStore, factory.signatureService, factory.reverseTunnelService, endpoint, tokenManager, factory.kubernetesClientFactory, factory.jwtService)
+
+	return proxy, nil
+}
+
+func (factory *ProxyFactory) newKubernetesAgentHTTPSProxy(endpoint *portainer.Endpoint) (http.Handler, error) {
+	endpointURL := "https://" + endpoint.URL
+	remoteURL, err := url.Parse(endpointURL)
+	if err != nil {
+		return nil, err
+	}
+
+	remoteURL.Scheme = "https"
+
+	kubecli, err := factory.kubernetesClientFactory.GetPrivilegedKubeClient(endpoint)
+	if err != nil {
+		return nil, err
+	}
+
+	tokenCache := factory.kubernetesTokenCacheManager.GetOrCreateTokenCache(endpoint.ID)
+	tokenManager, err := kubernetes.NewTokenManager(kubecli, factory.dataStore, tokenCache, false)
+	if err != nil {
+		return nil, err
+	}
+
+	transport, err := kubernetes.NewAgentTransport(factory.signatureService, tokenManager, endpoint, factory.kubernetesClientFactory, factory.dataStore, factory.jwtService)
+	if err != nil {
+		return nil, err
+	}
+
+	proxy := NewSingleHostReverseProxyWithHostHeader(remoteURL)
+	proxy.Transport = transport
+
+	return proxy, nil
+}
diff --git a/api/http/proxy/factory/kubernetes/agent_transport.go b/api/http/proxy/factory/kubernetes/agent_transport.go
new file mode 100644
index 0000000..42266c0
--- /dev/null
+++ b/api/http/proxy/factory/kubernetes/agent_transport.go
@@ -0,0 +1,75 @@
+package kubernetes
+
+import (
+	"net/http"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/crypto"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/kubernetes/cli"
+	"github.com/portainer/portainer/pkg/libhttp/ssrf"
+)
+
+type agentTransport struct {
+	*baseTransport
+	signatureService portainer.DigitalSignatureService
+}
+
+// NewAgentTransport returns a new transport that can be used to send signed requests to a Portainer agent
+func NewAgentTransport(signatureService portainer.DigitalSignatureService, tokenManager *tokenManager, endpoint *portainer.Endpoint, k8sClientFactory *cli.ClientFactory, dataStore dataservices.DataStore, jwtService portainer.JWTService) (*agentTransport, error) {
+	tlsConfig, err := crypto.CreateTLSConfigurationFromDisk(endpoint.TLSConfig)
+	if err != nil {
+		return nil, err
+	}
+
+	httpTransport := ssrf.NewTransport(tlsConfig)
+	httpTransport.Protocols = ssrf.HTTP1Only()
+
+	transport := &agentTransport{
+		baseTransport: newBaseTransport(
+			httpTransport,
+			tokenManager,
+			endpoint,
+			k8sClientFactory,
+			dataStore,
+			jwtService,
+		),
+		signatureService: signatureService,
+	}
+
+	return transport, nil
+}
+
+// RoundTrip is the implementation of the the http.RoundTripper interface
+func (transport *agentTransport) RoundTrip(request *http.Request) (*http.Response, error) {
+	token, err := transport.getRoundTripToken(request, transport.tokenManager)
+	if err != nil {
+		return nil, err
+	}
+
+	request.Header.Set(portainer.PortainerAgentKubernetesSATokenHeader, token)
+
+	if strings.HasPrefix(request.URL.Path, "/v2") {
+		err := decorateAgentRequest(request, transport.dataStore)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	signature, err := transport.signatureService.CreateSignature(portainer.PortainerAgentSignatureMessage)
+	if err != nil {
+		return nil, err
+	}
+
+	request.Header.Set(portainer.PortainerAgentPublicKeyHeader, transport.signatureService.EncodedPublicKey())
+	request.Header.Set(portainer.PortainerAgentSignatureHeader, signature)
+
+	response, err := transport.baseTransport.RoundTrip(request)
+	if err != nil {
+		return response, err
+	}
+	response.Header.Set(portainer.PortainerCacheHeader, "true")
+
+	return response, err
+}
diff --git a/api/http/proxy/factory/kubernetes/deployments.go b/api/http/proxy/factory/kubernetes/deployments.go
new file mode 100644
index 0000000..a5bcc72
--- /dev/null
+++ b/api/http/proxy/factory/kubernetes/deployments.go
@@ -0,0 +1,18 @@
+package kubernetes
+
+import (
+	"net/http"
+
+	"github.com/rs/zerolog/log"
+)
+
+func (transport *baseTransport) proxyDeploymentsRequest(request *http.Request, namespace, requestPath string) (*http.Response, error) {
+	switch request.Method {
+	case http.MethodPost, http.MethodPatch, http.MethodPut:
+		if err := transport.refreshRegistry(request, namespace); err != nil {
+			log.Warn().Err(err).Msg("failed to refresh registry credentials")
+		}
+	}
+
+	return transport.executeKubernetesRequest(request)
+}
diff --git a/api/http/proxy/factory/kubernetes/edge_transport.go b/api/http/proxy/factory/kubernetes/edge_transport.go
new file mode 100644
index 0000000..3d07df6
--- /dev/null
+++ b/api/http/proxy/factory/kubernetes/edge_transport.go
@@ -0,0 +1,68 @@
+package kubernetes
+
+import (
+	"net/http"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/kubernetes/cli"
+	"github.com/portainer/portainer/pkg/libhttp/ssrf"
+)
+
+type edgeTransport struct {
+	*baseTransport
+	signatureService     portainer.DigitalSignatureService
+	reverseTunnelService portainer.ReverseTunnelService
+}
+
+// NewAgentTransport returns a new transport that can be used to send signed requests to a Portainer Edge agent
+func NewEdgeTransport(dataStore dataservices.DataStore, signatureService portainer.DigitalSignatureService, reverseTunnelService portainer.ReverseTunnelService, endpoint *portainer.Endpoint, tokenManager *tokenManager, k8sClientFactory *cli.ClientFactory, jwtService portainer.JWTService) *edgeTransport {
+	transport := &edgeTransport{
+		reverseTunnelService: reverseTunnelService,
+		signatureService:     signatureService,
+		baseTransport: newBaseTransport(
+			ssrf.NewInternalTransport(nil),
+			tokenManager,
+			endpoint,
+			k8sClientFactory,
+			dataStore,
+			jwtService,
+		),
+	}
+
+	return transport
+}
+
+// RoundTrip is the implementation of the the http.RoundTripper interface
+func (transport *edgeTransport) RoundTrip(request *http.Request) (*http.Response, error) {
+	token, err := transport.getRoundTripToken(request, transport.tokenManager)
+	if err != nil {
+		return nil, err
+	}
+
+	request.Header.Set(portainer.PortainerAgentKubernetesSATokenHeader, token)
+
+	if strings.HasPrefix(request.URL.Path, "/v2") {
+		err := decorateAgentRequest(request, transport.dataStore)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	signature, err := transport.signatureService.CreateSignature(portainer.PortainerAgentSignatureMessage)
+	if err != nil {
+		return nil, err
+	}
+
+	request.Header.Set(portainer.PortainerAgentPublicKeyHeader, transport.signatureService.EncodedPublicKey())
+	request.Header.Set(portainer.PortainerAgentSignatureHeader, signature)
+
+	response, err := transport.baseTransport.RoundTrip(request)
+
+	if err == nil {
+		transport.reverseTunnelService.UpdateLastActivity(transport.endpoint.ID)
+	}
+
+	return response, err
+}
diff --git a/api/http/proxy/factory/kubernetes/edge_transport_test.go b/api/http/proxy/factory/kubernetes/edge_transport_test.go
new file mode 100644
index 0000000..ddf40d8
--- /dev/null
+++ b/api/http/proxy/factory/kubernetes/edge_transport_test.go
@@ -0,0 +1,14 @@
+package kubernetes
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestNewEdgeTransport(t *testing.T) {
+	t.Parallel()
+
+	transport := NewEdgeTransport(nil, nil, nil, nil, nil, nil, nil)
+	require.NotNil(t, transport)
+}
diff --git a/api/http/proxy/factory/kubernetes/local_transport.go b/api/http/proxy/factory/kubernetes/local_transport.go
new file mode 100644
index 0000000..bd177df
--- /dev/null
+++ b/api/http/proxy/factory/kubernetes/local_transport.go
@@ -0,0 +1,46 @@
+package kubernetes
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/crypto"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/kubernetes/cli"
+	"github.com/portainer/portainer/pkg/libhttp/ssrf"
+)
+
+type localTransport struct {
+	*baseTransport
+}
+
+// NewLocalTransport returns a new transport that can be used to send requests to the local Kubernetes API
+func NewLocalTransport(tokenManager *tokenManager, endpoint *portainer.Endpoint, k8sClientFactory *cli.ClientFactory, dataStore dataservices.DataStore, jwtService portainer.JWTService) (*localTransport, error) {
+	config, err := crypto.CreateTLSConfigurationFromBytes(true, nil, nil, nil, true, true)
+	if err != nil {
+		return nil, err
+	}
+
+	transport := &localTransport{
+		baseTransport: newBaseTransport(
+			ssrf.NewInternalTransport(config),
+			tokenManager,
+			endpoint,
+			k8sClientFactory,
+			dataStore,
+			jwtService,
+		),
+	}
+
+	return transport, nil
+}
+
+// RoundTrip is the implementation of the the http.RoundTripper interface
+func (transport *localTransport) RoundTrip(request *http.Request) (*http.Response, error) {
+	_, err := transport.prepareRoundTrip(request)
+	if err != nil {
+		return nil, err
+	}
+
+	return transport.baseTransport.RoundTrip(request)
+}
diff --git a/api/http/proxy/factory/kubernetes/local_transport_test.go b/api/http/proxy/factory/kubernetes/local_transport_test.go
new file mode 100644
index 0000000..88726dd
--- /dev/null
+++ b/api/http/proxy/factory/kubernetes/local_transport_test.go
@@ -0,0 +1,18 @@
+package kubernetes
+
+import (
+	"testing"
+
+	"github.com/portainer/portainer/pkg/fips"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestNewLocalTransport(t *testing.T) {
+	t.Parallel()
+	fips.InitFIPS(false)
+
+	transport, err := NewLocalTransport(nil, nil, nil, nil, nil)
+	require.NoError(t, err)
+	require.True(t, transport.httpTransport.TLSClientConfig.InsecureSkipVerify) //nolint:forbidigo
+}
diff --git a/api/http/proxy/factory/kubernetes/namespaces.go b/api/http/proxy/factory/kubernetes/namespaces.go
new file mode 100644
index 0000000..586bc8f
--- /dev/null
+++ b/api/http/proxy/factory/kubernetes/namespaces.go
@@ -0,0 +1,64 @@
+package kubernetes
+
+import (
+	"net/http"
+
+	"github.com/pkg/errors"
+	portainer "github.com/portainer/portainer/api"
+)
+
+func (transport *baseTransport) proxyNamespaceDeleteOperation(request *http.Request, namespace string) (*http.Response, error) {
+	if err := transport.tokenManager.kubecli.NamespaceAccessPoliciesDeleteNamespace(namespace); err != nil {
+		return nil, errors.WithMessagef(err, "failed to delete a namespace [%s] from portainer config", namespace)
+	}
+
+	registries, err := transport.dataStore.Registry().ReadAll()
+	if err != nil {
+		return nil, err
+	}
+
+	for _, registry := range registries {
+		for endpointID, registryAccessPolicies := range registry.RegistryAccesses {
+			if endpointID != transport.endpoint.ID {
+				continue
+			}
+
+			namespaces := []string{}
+			for _, ns := range registryAccessPolicies.Namespaces {
+				if ns == namespace {
+					continue
+				}
+				namespaces = append(namespaces, ns)
+			}
+
+			if len(namespaces) != len(registryAccessPolicies.Namespaces) {
+				updatedAccessPolicies := portainer.RegistryAccessPolicies{
+					Namespaces:         namespaces,
+					UserAccessPolicies: registryAccessPolicies.UserAccessPolicies,
+					TeamAccessPolicies: registryAccessPolicies.TeamAccessPolicies,
+				}
+
+				registry.RegistryAccesses[endpointID] = updatedAccessPolicies
+				err := transport.dataStore.Registry().Update(registry.ID, &registry)
+				if err != nil {
+					return nil, err
+				}
+			}
+		}
+	}
+
+	stacks, err := transport.dataStore.Stack().ReadAll()
+	if err != nil {
+		return nil, err
+	}
+
+	for _, s := range stacks {
+		if s.Namespace == namespace && s.EndpointID == transport.endpoint.ID {
+			if err := transport.dataStore.Stack().Delete(s.ID); err != nil {
+				return nil, err
+			}
+		}
+	}
+
+	return transport.executeKubernetesRequest(request)
+}
diff --git a/api/http/proxy/factory/kubernetes/pods.go b/api/http/proxy/factory/kubernetes/pods.go
new file mode 100644
index 0000000..e10f1fc
--- /dev/null
+++ b/api/http/proxy/factory/kubernetes/pods.go
@@ -0,0 +1,23 @@
+package kubernetes
+
+import (
+	"net/http"
+	"strings"
+
+	"github.com/rs/zerolog/log"
+)
+
+func (transport *baseTransport) proxyPodsRequest(request *http.Request, namespace string) (*http.Response, error) {
+	if request.Method == http.MethodDelete {
+		if err := transport.refreshRegistry(request, namespace); err != nil {
+			log.Warn().Err(err).Msg("failed to refresh registry credentials")
+		}
+	}
+
+	if request.Method == http.MethodPost && strings.Contains(request.URL.Path, "/exec") {
+		if err := transport.addTokenForExec(request); err != nil {
+			return nil, err
+		}
+	}
+	return transport.executeKubernetesRequest(request)
+}
diff --git a/api/http/proxy/factory/kubernetes/refresh_registry.go b/api/http/proxy/factory/kubernetes/refresh_registry.go
new file mode 100644
index 0000000..f70a908
--- /dev/null
+++ b/api/http/proxy/factory/kubernetes/refresh_registry.go
@@ -0,0 +1,18 @@
+package kubernetes
+
+import (
+	"net/http"
+
+	"github.com/portainer/portainer/api/internal/registryutils"
+)
+
+func (transport *baseTransport) refreshRegistry(request *http.Request, namespace string) (err error) {
+	cli, err := transport.k8sClientFactory.GetPrivilegedKubeClient(transport.endpoint)
+	if err != nil {
+		return
+	}
+
+	err = registryutils.RefreshEcrSecret(cli, transport.endpoint, transport.dataStore, namespace)
+
+	return
+}
diff --git a/api/http/proxy/factory/kubernetes/token.go b/api/http/proxy/factory/kubernetes/token.go
new file mode 100644
index 0000000..e8c09c4
--- /dev/null
+++ b/api/http/proxy/factory/kubernetes/token.go
@@ -0,0 +1,110 @@
+package kubernetes
+
+import (
+	"fmt"
+	"os"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/rs/zerolog/log"
+)
+
+const defaultServiceAccountTokenFile = "/var/run/secrets/kubernetes.io/serviceaccount/token"
+
+type tokenManager struct {
+	tokenCache *tokenCache
+	kubecli    portainer.KubeClient
+	dataStore  dataservices.DataStore
+	adminToken string
+}
+
+// NewTokenManager returns a pointer to a new instance of tokenManager.
+// If the useLocalAdminToken parameter is set to true, it will search for the local admin service account
+// and associate it to the manager.
+func NewTokenManager(kubecli portainer.KubeClient, dataStore dataservices.DataStore, cache *tokenCache, setLocalAdminToken bool) (*tokenManager, error) {
+	tokenManager := &tokenManager{
+		tokenCache: cache,
+		kubecli:    kubecli,
+		dataStore:  dataStore,
+		adminToken: "",
+	}
+
+	if setLocalAdminToken {
+		token, err := os.ReadFile(defaultServiceAccountTokenFile)
+		if err != nil {
+			return nil, err
+		}
+
+		tokenManager.adminToken = string(token)
+	}
+
+	return tokenManager, nil
+}
+
+func (manager *tokenManager) GetAdminServiceAccountToken() string {
+	return manager.adminToken
+}
+
+func (manager *tokenManager) setupUserServiceAccounts(userID portainer.UserID, endpoint *portainer.Endpoint) error {
+	memberships, err := manager.dataStore.TeamMembership().TeamMembershipsByUserID(userID)
+	if err != nil {
+		return err
+	}
+
+	teamIds := make([]int, 0, len(memberships))
+	for _, membership := range memberships {
+		teamIds = append(teamIds, int(membership.TeamID))
+	}
+
+	restrictDefaultNamespace := endpoint.Kubernetes.Configuration.RestrictDefaultNamespace
+	err = manager.kubecli.SetupUserServiceAccount(int(userID), teamIds, restrictDefaultNamespace)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (manager *tokenManager) UpdateUserServiceAccountsForEndpoint(endpointID portainer.EndpointID) {
+	endpoint, err := manager.dataStore.Endpoint().Endpoint(endpointID)
+	if err != nil {
+		log.Error().Err(err).Msgf("failed fetching environments %d", endpointID)
+		return
+	}
+
+	userIDs := make([]portainer.UserID, 0)
+	for u := range endpoint.UserAccessPolicies {
+		userIDs = append(userIDs, u)
+	}
+	for t := range endpoint.TeamAccessPolicies {
+		memberships, _ := manager.dataStore.TeamMembership().TeamMembershipsByTeamID(t)
+		for _, membership := range memberships {
+			userIDs = append(userIDs, membership.UserID)
+		}
+	}
+
+	for _, userID := range userIDs {
+		if err := manager.setupUserServiceAccounts(userID, endpoint); err != nil {
+			log.Error().Err(err).Msgf("failed setting-up service account for user %d", userID)
+		}
+	}
+}
+
+// GetUserServiceAccountToken setup a user's service account if it does not exist, then retrieve its token
+func (manager *tokenManager) GetUserServiceAccountToken(userID int, endpointID portainer.EndpointID) (string, error) {
+	tokenFunc := func() (string, error) {
+		endpoint, err := manager.dataStore.Endpoint().Endpoint(endpointID)
+		if err != nil {
+			log.Error().Err(err).Msgf("failed fetching environment %d", endpointID)
+			return "", err
+		}
+
+		if err := manager.setupUserServiceAccounts(portainer.UserID(userID), endpoint); err != nil {
+			return "", fmt.Errorf("failed setting-up service account for user %d: %w", userID, err)
+		}
+
+		return manager.kubecli.GetServiceAccountBearerToken(userID)
+	}
+
+	return manager.tokenCache.getOrAddToken(portainer.UserID(userID), tokenFunc)
+}
diff --git a/api/http/proxy/factory/kubernetes/token_cache.go b/api/http/proxy/factory/kubernetes/token_cache.go
new file mode 100644
index 0000000..f00d5be
--- /dev/null
+++ b/api/http/proxy/factory/kubernetes/token_cache.go
@@ -0,0 +1,78 @@
+package kubernetes
+
+import (
+	"sync"
+
+	portainer "github.com/portainer/portainer/api"
+)
+
+// TokenCacheManager represents a service used to manage multiple tokenCache objects.
+type TokenCacheManager struct {
+	tokenCaches map[portainer.EndpointID]*tokenCache
+	mu          sync.Mutex
+}
+
+type tokenCache struct {
+	userTokenCache map[portainer.UserID]string
+	mu             sync.Mutex
+}
+
+// NewTokenCacheManager returns a pointer to a new instance of TokenCacheManager
+func NewTokenCacheManager() *TokenCacheManager {
+	return &TokenCacheManager{
+		tokenCaches: make(map[portainer.EndpointID]*tokenCache),
+	}
+}
+
+// GetOrCreateTokenCache will get the tokenCache from the manager map of caches if it exists,
+// otherwise it will create a new tokenCache object, associate it to the manager map of caches
+// and return a pointer to that tokenCache instance.
+func (manager *TokenCacheManager) GetOrCreateTokenCache(endpointID portainer.EndpointID) *tokenCache {
+	manager.mu.Lock()
+	defer manager.mu.Unlock()
+
+	if tc, ok := manager.tokenCaches[endpointID]; ok {
+		return tc
+	}
+
+	tc := &tokenCache{
+		userTokenCache: make(map[portainer.UserID]string),
+	}
+
+	manager.tokenCaches[endpointID] = tc
+
+	return tc
+}
+
+// RemoveUserFromCache will ensure that the specific userID is removed from all registered caches.
+func (manager *TokenCacheManager) RemoveUserFromCache(userID portainer.UserID) {
+	manager.mu.Lock()
+	for _, tc := range manager.tokenCaches {
+		tc.removeToken(userID)
+	}
+	manager.mu.Unlock()
+}
+
+func (cache *tokenCache) getOrAddToken(userID portainer.UserID, tokenGetFunc func() (string, error)) (string, error) {
+	cache.mu.Lock()
+	defer cache.mu.Unlock()
+
+	if tok, ok := cache.userTokenCache[userID]; ok {
+		return tok, nil
+	}
+
+	tok, err := tokenGetFunc()
+	if err != nil {
+		return "", err
+	}
+
+	cache.userTokenCache[userID] = tok
+
+	return tok, nil
+}
+
+func (cache *tokenCache) removeToken(userID portainer.UserID) {
+	cache.mu.Lock()
+	delete(cache.userTokenCache, userID)
+	cache.mu.Unlock()
+}
diff --git a/api/http/proxy/factory/kubernetes/token_cache_test.go b/api/http/proxy/factory/kubernetes/token_cache_test.go
new file mode 100644
index 0000000..23231b2
--- /dev/null
+++ b/api/http/proxy/factory/kubernetes/token_cache_test.go
@@ -0,0 +1,104 @@
+package kubernetes
+
+import (
+	"errors"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+)
+
+func noTokFunc() (string, error) {
+	return "", errors.New("no token found")
+}
+
+func stringTok(tok string) func() (string, error) {
+	return func() (string, error) {
+		return tok, nil
+	}
+}
+
+func failFunc(t *testing.T) func() (string, error) {
+	return func() (string, error) {
+		t.FailNow()
+		return noTokFunc()
+	}
+}
+
+func TestTokenCacheDataRace(t *testing.T) {
+	t.Parallel()
+	ch := make(chan struct{})
+
+	for range 1000 {
+		var tokenCache1, tokenCache2 *tokenCache
+
+		mgr := NewTokenCacheManager()
+
+		go func() {
+			tokenCache1 = mgr.GetOrCreateTokenCache(1)
+			ch <- struct{}{}
+		}()
+
+		go func() {
+			tokenCache2 = mgr.GetOrCreateTokenCache(1)
+			ch <- struct{}{}
+		}()
+
+		<-ch
+		<-ch
+
+		if tokenCache1 != tokenCache2 {
+			t.FailNow()
+		}
+	}
+}
+
+func TestTokenCache(t *testing.T) {
+	t.Parallel()
+	mgr := NewTokenCacheManager()
+	tc1 := mgr.GetOrCreateTokenCache(1)
+	tc2 := mgr.GetOrCreateTokenCache(2)
+	tc3 := mgr.GetOrCreateTokenCache(3)
+
+	uid := portainer.UserID(2)
+	tokenString1 := "token-string-1"
+	tokenString2 := "token-string-2"
+
+	tok, err := tc1.getOrAddToken(uid, stringTok(tokenString1))
+	if err != nil || tok != tokenString1 {
+		t.FailNow()
+	}
+
+	tok, err = tc1.getOrAddToken(uid, failFunc(t))
+	if err != nil || tok != tokenString1 {
+		t.FailNow()
+	}
+
+	tok, err = tc2.getOrAddToken(uid, stringTok(tokenString2))
+	if err != nil || tok != tokenString2 {
+		t.FailNow()
+	}
+
+	_, err = tc3.getOrAddToken(uid, noTokFunc)
+	if err == nil {
+		t.FailNow()
+	}
+
+	// Remove one user from all the caches
+
+	mgr.RemoveUserFromCache(uid)
+
+	_, err = tc1.getOrAddToken(uid, noTokFunc)
+	if err == nil {
+		t.FailNow()
+	}
+
+	_, err = tc2.getOrAddToken(uid, noTokFunc)
+	if err == nil {
+		t.FailNow()
+	}
+
+	_, err = tc3.getOrAddToken(uid, noTokFunc)
+	if err == nil {
+		t.FailNow()
+	}
+}
diff --git a/api/http/proxy/factory/kubernetes/transport.go b/api/http/proxy/factory/kubernetes/transport.go
new file mode 100644
index 0000000..b4d06bc
--- /dev/null
+++ b/api/http/proxy/factory/kubernetes/transport.go
@@ -0,0 +1,227 @@
+package kubernetes
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"net/http"
+	"path"
+	"regexp"
+	"strconv"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/kubernetes/cli"
+
+	"github.com/pkg/errors"
+	"github.com/rs/zerolog/log"
+	"github.com/segmentio/encoding/json"
+)
+
+type baseTransport struct {
+	httpTransport    *http.Transport
+	tokenManager     *tokenManager
+	endpoint         *portainer.Endpoint
+	k8sClientFactory *cli.ClientFactory
+	dataStore        dataservices.DataStore
+	jwtService       portainer.JWTService
+}
+
+func newBaseTransport(httpTransport *http.Transport, tokenManager *tokenManager, endpoint *portainer.Endpoint, k8sClientFactory *cli.ClientFactory, dataStore dataservices.DataStore, jwtService portainer.JWTService) *baseTransport {
+	return &baseTransport{
+		httpTransport:    httpTransport,
+		tokenManager:     tokenManager,
+		endpoint:         endpoint,
+		k8sClientFactory: k8sClientFactory,
+		dataStore:        dataStore,
+		jwtService:       jwtService,
+	}
+}
+
+// #region KUBERNETES PROXY
+
+// proxyKubernetesRequest intercepts a Kubernetes API request and apply logic based
+// on the requested operation.
+func (transport *baseTransport) proxyKubernetesRequest(request *http.Request) (*http.Response, error) {
+	// URL path examples:
+	// http://localhost:9000/api/endpoints/3/kubernetes/api/v1/namespaces
+	// http://localhost:9000/api/endpoints/3/kubernetes/apis/apps/v1/namespaces/default/deployments
+	apiVersionRe := regexp.MustCompile(`^(/kubernetes)?/(api|apis/apps)/v[0-9](\.[0-9])?`)
+	requestPath := apiVersionRe.ReplaceAllString(request.URL.Path, "")
+
+	endpointRe := regexp.MustCompile(`([0-9]+)`)
+	endpointIDMatch := endpointRe.FindAllString(request.RequestURI, 1)
+	endpointID := 0
+	if len(endpointIDMatch) > 0 {
+		endpointID, _ = strconv.Atoi(endpointIDMatch[0])
+	}
+
+	switch {
+	case strings.EqualFold(requestPath, "/namespaces/portainer/configmaps/portainer-config") && (request.Method == "PUT" || request.Method == "POST"):
+		transport.k8sClientFactory.ClearClientCache()
+		defer transport.tokenManager.UpdateUserServiceAccountsForEndpoint(portainer.EndpointID(endpointID))
+		return transport.executeKubernetesRequest(request)
+	case strings.EqualFold(requestPath, "/namespaces"):
+		return transport.executeKubernetesRequest(request)
+	case strings.HasPrefix(requestPath, "/namespaces"):
+		return transport.proxyNamespacedRequest(request, requestPath)
+	default:
+		return transport.executeKubernetesRequest(request)
+	}
+}
+
+func (transport *baseTransport) proxyNamespacedRequest(request *http.Request, fullRequestPath string) (*http.Response, error) {
+	requestPath := strings.TrimPrefix(fullRequestPath, "/namespaces/")
+	split := strings.SplitN(requestPath, "/", 2)
+	namespace := split[0]
+
+	requestPath = ""
+	if len(split) > 1 {
+		requestPath = split[1]
+	}
+
+	switch {
+	case strings.HasPrefix(requestPath, "pods"):
+		return transport.proxyPodsRequest(request, namespace)
+	case strings.HasPrefix(requestPath, "deployments"):
+		return transport.proxyDeploymentsRequest(request, namespace, requestPath)
+	case requestPath == "" && request.Method == "DELETE":
+		return transport.proxyNamespaceDeleteOperation(request, namespace)
+	default:
+		return transport.executeKubernetesRequest(request)
+	}
+}
+
+// addTokenForExec injects a kubeconfig token into the request header
+// this is only used with kubeconfig for kubectl exec requests
+func (transport *baseTransport) addTokenForExec(request *http.Request) error {
+	tokenData, err := security.RetrieveTokenData(request)
+	if err != nil {
+		return err
+	}
+
+	token, err := transport.jwtService.GenerateTokenForKubeconfig(tokenData)
+	if err != nil {
+		return err
+	}
+
+	request.Header.Set("Authorization", "Bearer "+token)
+	return nil
+}
+
+func (transport *baseTransport) executeKubernetesRequest(request *http.Request) (*http.Response, error) {
+
+	resp, err := transport.httpTransport.RoundTrip(request)
+
+	// This fix was made to resolve a k8s e2e test, more detailed investigation should be done later.
+	if err == nil && resp.StatusCode == http.StatusMovedPermanently {
+		oldLocation := resp.Header.Get("Location")
+		if oldLocation != "" {
+			stripedPrefix := strings.TrimSuffix(request.RequestURI, request.URL.Path)
+			// local proxy strips "/kubernetes" but agent proxy and edge agent proxy do not
+			stripedPrefix = strings.TrimSuffix(stripedPrefix, "/kubernetes")
+			newLocation := stripedPrefix + "/kubernetes" + oldLocation
+			resp.Header.Set("Location", newLocation)
+		}
+	}
+
+	return resp, err
+}
+
+// #endregion
+
+// #region ROUND TRIP
+
+func (transport *baseTransport) prepareRoundTrip(request *http.Request) (string, error) {
+	token, err := transport.getRoundTripToken(request, transport.tokenManager)
+	if err != nil {
+		return "", err
+	}
+
+	request.Header.Set("Authorization", "Bearer "+token)
+
+	return token, nil
+}
+
+// RoundTrip is the implementation of the the http.RoundTripper interface
+func (transport *baseTransport) RoundTrip(request *http.Request) (*http.Response, error) {
+	return transport.proxyKubernetesRequest(request)
+}
+
+func (transport *baseTransport) getRoundTripToken(request *http.Request, tokenManager *tokenManager) (string, error) {
+	tokenData, err := security.RetrieveTokenData(request)
+	if err != nil {
+		return "", err
+	}
+
+	var token string
+	if tokenData.Role == portainer.AdministratorRole {
+		token = tokenManager.GetAdminServiceAccountToken()
+	} else {
+		token, err = tokenManager.GetUserServiceAccountToken(int(tokenData.ID), transport.endpoint.ID)
+		if err != nil {
+			log.Error().
+				Err(err).
+				Msg("failed retrieving service account token")
+
+			return "", err
+		}
+	}
+
+	return token, nil
+}
+
+// #endregion
+
+// #region DECORATE FUNCTIONS
+
+func decorateAgentRequest(r *http.Request, dataStore dataservices.DataStore) error {
+	requestPath := strings.TrimPrefix(r.URL.Path, "/v2")
+
+	if strings.HasPrefix(requestPath, "/dockerhub") {
+		return decorateAgentDockerHubRequest(r, dataStore)
+	}
+
+	return nil
+}
+
+func decorateAgentDockerHubRequest(r *http.Request, dataStore dataservices.DataStore) error {
+	requestPath, registryIdString := path.Split(r.URL.Path)
+
+	registryID, err := strconv.Atoi(registryIdString)
+	if err != nil {
+		return fmt.Errorf("missing registry id: %w", err)
+	}
+
+	r.URL.Path = strings.TrimSuffix(requestPath, "/")
+
+	registry := &portainer.Registry{
+		Type: portainer.DockerHubRegistry,
+	}
+
+	if registryID != 0 {
+		registry, err = dataStore.Registry().Read(portainer.RegistryID(registryID))
+		if err != nil {
+			return fmt.Errorf("failed fetching registry: %w", err)
+		}
+	}
+
+	if registry.Type != portainer.DockerHubRegistry {
+		return errors.New("invalid registry type")
+	}
+
+	newBody, err := json.Marshal(registry)
+	if err != nil {
+		return fmt.Errorf("failed marshaling registry: %w", err)
+	}
+
+	r.Method = http.MethodPost
+	r.Body = io.NopCloser(bytes.NewReader(newBody))
+	r.ContentLength = int64(len(newBody))
+
+	return nil
+}
+
+// #endregion
diff --git a/api/http/proxy/factory/kubernetes/transport_test.go b/api/http/proxy/factory/kubernetes/transport_test.go
new file mode 100644
index 0000000..9eb32f8
--- /dev/null
+++ b/api/http/proxy/factory/kubernetes/transport_test.go
@@ -0,0 +1,367 @@
+package kubernetes
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/jwt"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// MockJWTService implements portainer.JWTService for testing
+type MockJWTService struct {
+	generateTokenFunc func(data *portainer.TokenData) (string, error)
+}
+
+func (m *MockJWTService) GenerateToken(data *portainer.TokenData) (string, time.Time, error) {
+	if m.generateTokenFunc != nil {
+		token, err := m.generateTokenFunc(data)
+
+		return token, time.Now().Add(24 * time.Hour), err
+	}
+
+	return "mock-token", time.Now().Add(24 * time.Hour), nil
+}
+
+func (m *MockJWTService) GenerateTokenForKubeconfig(data *portainer.TokenData) (string, error) {
+	if m.generateTokenFunc != nil {
+		return m.generateTokenFunc(data)
+	}
+
+	return "mock-kubeconfig-token", nil
+}
+
+func (m *MockJWTService) ParseAndVerifyToken(token string) (*portainer.TokenData, string, time.Time, error) {
+	return &portainer.TokenData{ID: 1, Username: "mock", Role: portainer.AdministratorRole}, "mock-id", time.Now().Add(24 * time.Hour), nil
+}
+
+func (m *MockJWTService) SetUserSessionDuration(userSessionDuration time.Duration) {
+	// Mock implementation - not used in tests
+}
+
+func TestBaseTransport_AddTokenForExec(t *testing.T) {
+	t.Parallel()
+	// Setup test store and JWT service
+	_, store := datastore.MustNewTestStore(t, true, false)
+
+	// Create test users
+	adminUser := &portainer.User{
+		ID:       1,
+		Username: "admin",
+		Role:     portainer.AdministratorRole,
+	}
+	err := store.User().Create(adminUser)
+	require.NoError(t, err)
+
+	standardUser := &portainer.User{
+		ID:       2,
+		Username: "standard",
+		Role:     portainer.StandardUserRole,
+	}
+	err = store.User().Create(standardUser)
+	require.NoError(t, err)
+
+	// Create JWT service
+	jwtService, err := jwt.NewService("24h", store)
+	require.NoError(t, err)
+
+	// Create base transport
+	transport := &baseTransport{
+		jwtService: jwtService,
+	}
+
+	tests := []struct {
+		name           string
+		tokenData      *portainer.TokenData
+		setupRequest   func(*http.Request) *http.Request
+		expectError    bool
+		errorMsg       string
+		expectPanic    bool
+		verifyResponse func(*testing.T, *http.Request, *portainer.TokenData)
+	}{
+		{
+			name: "admin user - successful token generation",
+			tokenData: &portainer.TokenData{
+				ID:       adminUser.ID,
+				Username: adminUser.Username,
+				Role:     adminUser.Role,
+			},
+			setupRequest: func(req *http.Request) *http.Request {
+				return req.WithContext(security.StoreTokenData(req, &portainer.TokenData{
+					ID:       adminUser.ID,
+					Username: adminUser.Username,
+					Role:     adminUser.Role,
+				}))
+			},
+			expectError: false,
+			verifyResponse: func(t *testing.T, req *http.Request, tokenData *portainer.TokenData) {
+				authHeader := req.Header.Get("Authorization")
+				assert.NotEmpty(t, authHeader)
+				assert.True(t, strings.HasPrefix(authHeader, "Bearer "))
+
+				token := authHeader[7:] // Remove "Bearer " prefix
+				parsedTokenData, _, _, err := jwtService.ParseAndVerifyToken(token)
+				require.NoError(t, err)
+				assert.Equal(t, tokenData.ID, parsedTokenData.ID)
+				assert.Equal(t, tokenData.Username, parsedTokenData.Username)
+				assert.Equal(t, tokenData.Role, parsedTokenData.Role)
+			},
+		},
+		{
+			name: "standard user - successful token generation",
+			tokenData: &portainer.TokenData{
+				ID:       standardUser.ID,
+				Username: standardUser.Username,
+				Role:     standardUser.Role,
+			},
+			setupRequest: func(req *http.Request) *http.Request {
+				return req.WithContext(security.StoreTokenData(req, &portainer.TokenData{
+					ID:       standardUser.ID,
+					Username: standardUser.Username,
+					Role:     standardUser.Role,
+				}))
+			},
+			expectError: false,
+			verifyResponse: func(t *testing.T, req *http.Request, tokenData *portainer.TokenData) {
+				authHeader := req.Header.Get("Authorization")
+				assert.NotEmpty(t, authHeader)
+				assert.True(t, strings.HasPrefix(authHeader, "Bearer "))
+
+				token := authHeader[7:] // Remove "Bearer " prefix
+				parsedTokenData, _, _, err := jwtService.ParseAndVerifyToken(token)
+				require.NoError(t, err)
+				assert.Equal(t, tokenData.ID, parsedTokenData.ID)
+				assert.Equal(t, tokenData.Username, parsedTokenData.Username)
+				assert.Equal(t, tokenData.Role, parsedTokenData.Role)
+			},
+		},
+		{
+			name:      "request without token data in context",
+			tokenData: nil,
+			setupRequest: func(req *http.Request) *http.Request {
+				return req // Don't add token data to context
+			},
+			expectError: true,
+			errorMsg:    "Unable to find JWT data in request context",
+		},
+		{
+			name:      "request with nil token data",
+			tokenData: nil,
+			setupRequest: func(req *http.Request) *http.Request {
+				return req.WithContext(security.StoreTokenData(req, nil))
+			},
+			expectPanic: true,
+		},
+		{
+			name: "JWT service failure",
+			tokenData: &portainer.TokenData{
+				ID:       1,
+				Username: "test",
+				Role:     portainer.AdministratorRole,
+			},
+			setupRequest: func(req *http.Request) *http.Request {
+				return req.WithContext(security.StoreTokenData(req, &portainer.TokenData{
+					ID:       1,
+					Username: "test",
+					Role:     portainer.AdministratorRole,
+				}))
+			},
+			expectPanic: true,
+		},
+		{
+			name: "verify authorization header format",
+			tokenData: &portainer.TokenData{
+				ID:       adminUser.ID,
+				Username: adminUser.Username,
+				Role:     adminUser.Role,
+			},
+			setupRequest: func(req *http.Request) *http.Request {
+				return req.WithContext(security.StoreTokenData(req, &portainer.TokenData{
+					ID:       adminUser.ID,
+					Username: adminUser.Username,
+					Role:     adminUser.Role,
+				}))
+			},
+			expectError: false,
+			verifyResponse: func(t *testing.T, req *http.Request, tokenData *portainer.TokenData) {
+				authHeader := req.Header.Get("Authorization")
+				assert.NotEmpty(t, authHeader)
+				assert.True(t, strings.HasPrefix(authHeader, "Bearer "))
+
+				token := authHeader[7:] // Remove "Bearer " prefix
+				assert.NotEmpty(t, token)
+			},
+		},
+		{
+			name: "verify header is overwritten on subsequent calls",
+			tokenData: &portainer.TokenData{
+				ID:       adminUser.ID,
+				Username: adminUser.Username,
+				Role:     adminUser.Role,
+			},
+			setupRequest: func(req *http.Request) *http.Request {
+				req = req.WithContext(security.StoreTokenData(req, &portainer.TokenData{
+					ID:       adminUser.ID,
+					Username: adminUser.Username,
+					Role:     adminUser.Role,
+				}))
+				// Set an existing Authorization header
+				req.Header.Set("Authorization", "Bearer old-token")
+
+				return req
+			},
+			expectError: false,
+			verifyResponse: func(t *testing.T, req *http.Request, tokenData *portainer.TokenData) {
+				authHeader := req.Header.Get("Authorization")
+				assert.NotEqual(t, "Bearer old-token", authHeader)
+				assert.True(t, strings.HasPrefix(authHeader, "Bearer "))
+
+				token := authHeader[7:] // Remove "Bearer " prefix
+				parsedTokenData, _, _, err := jwtService.ParseAndVerifyToken(token)
+				require.NoError(t, err)
+				assert.Equal(t, tokenData.ID, parsedTokenData.ID)
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Create request
+			request := httptest.NewRequest("GET", "/", nil)
+			request = tt.setupRequest(request)
+
+			// Determine which transport to use based on test case
+			var testTransport *baseTransport
+			if tt.name == "JWT service failure" {
+				testTransport = &baseTransport{
+					jwtService: nil,
+				}
+			} else {
+				testTransport = transport
+			}
+
+			// Call the function
+			if tt.expectPanic {
+				assert.Panics(t, func() {
+					_ = testTransport.addTokenForExec(request)
+				})
+				return
+			}
+
+			err := testTransport.addTokenForExec(request)
+
+			// Check results
+			if tt.expectError {
+				require.Error(t, err)
+				if tt.errorMsg != "" {
+					assert.Contains(t, err.Error(), tt.errorMsg)
+				}
+			} else {
+				require.NoError(t, err)
+				if tt.verifyResponse != nil {
+					tt.verifyResponse(t, request, tt.tokenData)
+				}
+			}
+		})
+	}
+}
+
+func TestBaseTransport_AddTokenForExec_Integration(t *testing.T) {
+	t.Parallel()
+	// Create a test HTTP server to capture requests
+	var capturedRequest *http.Request
+	var capturedHeaders http.Header
+
+	testServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		capturedRequest = r
+		capturedHeaders = r.Header.Clone()
+		_, _ = w.Write([]byte("success"))
+	}))
+	defer testServer.Close()
+
+	// Create mock JWT service
+	mockJWTService := &MockJWTService{
+		generateTokenFunc: func(data *portainer.TokenData) (string, error) {
+			return "mock-token-" + data.Username, nil
+		},
+	}
+
+	// Create base transport
+	transport := &baseTransport{
+		httpTransport: &http.Transport{},
+		jwtService:    mockJWTService,
+	}
+
+	tests := []struct {
+		name          string
+		tokenData     *portainer.TokenData
+		requestPath   string
+		expectedToken string
+	}{
+		{
+			name: "admin user exec request",
+			tokenData: &portainer.TokenData{
+				ID:       1,
+				Username: "admin",
+				Role:     portainer.AdministratorRole,
+			},
+			requestPath:   "/api/endpoints/1/kubernetes/api/v1/namespaces/default/pods/test-pod/exec",
+			expectedToken: "mock-token-admin",
+		},
+		{
+			name: "standard user exec request",
+			tokenData: &portainer.TokenData{
+				ID:       2,
+				Username: "standard",
+				Role:     portainer.StandardUserRole,
+			},
+			requestPath:   "/api/endpoints/1/kubernetes/api/v1/namespaces/default/pods/test-pod/exec",
+			expectedToken: "mock-token-standard",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Reset captured data
+			capturedRequest = nil
+			capturedHeaders = nil
+
+			// Create request to the test server
+			request, err := http.NewRequest("POST", testServer.URL+tt.requestPath, strings.NewReader(""))
+			require.NoError(t, err)
+
+			// Add token data to request context
+			request = request.WithContext(security.StoreTokenData(request, tt.tokenData))
+
+			// Call proxyPodsRequest which triggers addTokenForExec for POST /exec requests
+			resp, err := transport.proxyPodsRequest(request, "default")
+			require.NoError(t, err)
+			defer func() {
+				err := resp.Body.Close()
+				require.NoError(t, err)
+			}()
+
+			// Verify the response
+			assert.Equal(t, http.StatusOK, resp.StatusCode)
+
+			// Verify the request was captured
+			assert.NotNil(t, capturedRequest)
+			assert.Equal(t, "POST", capturedRequest.Method)
+			assert.Equal(t, tt.requestPath, capturedRequest.URL.Path)
+
+			// Verify the authorization header was set correctly
+			capturedAuthHeader := capturedHeaders.Get("Authorization")
+			assert.NotEmpty(t, capturedAuthHeader)
+			assert.True(t, strings.HasPrefix(capturedAuthHeader, "Bearer "))
+			assert.Equal(t, "Bearer "+tt.expectedToken, capturedAuthHeader)
+		})
+	}
+}
diff --git a/api/http/proxy/factory/reverse_proxy.go b/api/http/proxy/factory/reverse_proxy.go
new file mode 100644
index 0000000..3c4340b
--- /dev/null
+++ b/api/http/proxy/factory/reverse_proxy.go
@@ -0,0 +1,88 @@
+package factory
+
+import (
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+	"strings"
+
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+)
+
+// Note that we discard any non-canonical headers by design
+var allowedHeaders = map[string]struct{}{
+	"Accept":                    {},
+	"Accept-Encoding":           {},
+	"Accept-Language":           {},
+	"Cache-Control":             {},
+	"Connection":                {},
+	"Content-Length":            {},
+	"Content-Type":              {},
+	"Private-Token":             {},
+	"Upgrade":                   {},
+	"User-Agent":                {},
+	"X-Portaineragent-Target":   {},
+	"X-Portainer-Volumename":    {},
+	"X-Registry-Auth":           {},
+	"X-Stream-Protocol-Version": {},
+	// WebSocket headers those are required for kubectl exec/attach/port-forward operations
+	"Sec-Websocket-Key":        {},
+	"Sec-Websocket-Version":    {},
+	"Sec-Websocket-Protocol":   {},
+	"Sec-Websocket-Extensions": {},
+}
+
+// newSingleHostReverseProxyWithHostHeader is based on NewSingleHostReverseProxy
+// from golang.org/src/net/http/httputil/reverseproxy.go and merely sets the Host
+// HTTP header, which NewSingleHostReverseProxy deliberately preserves.
+func NewSingleHostReverseProxyWithHostHeader(target *url.URL) *httputil.ReverseProxy {
+	proxy := &httputil.ReverseProxy{Rewrite: createRewriteFn(target)}
+
+	proxy.ErrorHandler = func(w http.ResponseWriter, r *http.Request, err error) {
+		httperror.WriteError(w, http.StatusBadGateway, "Proxy failure", err)
+	}
+
+	return proxy
+}
+
+func createRewriteFn(target *url.URL) func(*httputil.ProxyRequest) {
+	targetQuery := target.RawQuery
+	return func(proxyReq *httputil.ProxyRequest) {
+		proxyReq.Out.URL.Scheme = target.Scheme
+		proxyReq.Out.URL.Host = target.Host
+		proxyReq.Out.URL.Path = singleJoiningSlash(target.Path, proxyReq.In.URL.Path)
+		proxyReq.Out.URL.RawPath = ""
+		proxyReq.Out.Host = proxyReq.Out.URL.Host
+		if targetQuery == "" || proxyReq.Out.URL.RawQuery == "" {
+			proxyReq.Out.URL.RawQuery = targetQuery + proxyReq.Out.URL.RawQuery
+		} else {
+			proxyReq.Out.URL.RawQuery = targetQuery + "&" + proxyReq.Out.URL.RawQuery
+		}
+		if _, ok := proxyReq.Out.Header["User-Agent"]; !ok {
+			// explicitly disable User-Agent so it's not set to default value
+			proxyReq.Out.Header.Set("User-Agent", "")
+		}
+
+		for k := range proxyReq.Out.Header {
+			if _, ok := allowedHeaders[k]; !ok {
+				// We use delete here instead of req.Header.Del because we want to delete non canonical headers.
+				delete(proxyReq.Out.Header, k)
+			}
+		}
+	}
+}
+
+// singleJoiningSlash from golang.org/src/net/http/httputil/reverseproxy.go
+// included here for use in NewSingleHostReverseProxyWithHostHeader
+// because its used in NewSingleHostReverseProxy from golang.org/src/net/http/httputil/reverseproxy.go
+func singleJoiningSlash(a, b string) string {
+	aslash := strings.HasSuffix(a, "/")
+	bslash := strings.HasPrefix(b, "/")
+	switch {
+	case aslash && bslash:
+		return a + b[1:]
+	case !aslash && !bslash:
+		return a + "/" + b
+	}
+	return a + b
+}
diff --git a/api/http/proxy/factory/reverse_proxy_test.go b/api/http/proxy/factory/reverse_proxy_test.go
new file mode 100644
index 0000000..7fc9825
--- /dev/null
+++ b/api/http/proxy/factory/reverse_proxy_test.go
@@ -0,0 +1,227 @@
+package factory
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"net/http/httputil"
+	"net/url"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_createRewriteFn(t *testing.T) {
+	t.Parallel()
+	testCases := []struct {
+		name        string
+		target      *url.URL
+		req         *http.Request
+		expectedReq *http.Request
+	}{
+		{
+			name:   "base case",
+			target: createURL(t, "https://portainer.io/api/docker?a=5&b=6"),
+			req: createRequest(
+				t,
+				"GET",
+				"https://agent-portainer.io/test?c=7",
+				map[string]string{"Accept-Encoding": "gzip", "Accept": "application/json", "User-Agent": "something"},
+				true,
+			),
+			expectedReq: createRequest(
+				t,
+				"GET",
+				"https://portainer.io/api/docker/test?a=5&b=6&c=7",
+				map[string]string{"Accept-Encoding": "gzip", "Accept": "application/json", "User-Agent": "something"},
+				true,
+			),
+		},
+		{
+			name:   "no User-Agent",
+			target: createURL(t, "https://portainer.io/api/docker?a=5&b=6"),
+			req: createRequest(
+				t,
+				"GET",
+				"https://agent-portainer.io/test?c=7",
+				map[string]string{"Accept-Encoding": "gzip", "Accept": "application/json"},
+				true,
+			),
+			expectedReq: createRequest(
+				t,
+				"GET",
+				"https://portainer.io/api/docker/test?a=5&b=6&c=7",
+				map[string]string{"Accept-Encoding": "gzip", "Accept": "application/json", "User-Agent": ""},
+				true,
+			),
+		},
+		{
+			name:   "Sensitive Headers",
+			target: createURL(t, "https://portainer.io/api/docker?a=5&b=6"),
+			req: createRequest(
+				t,
+				"GET",
+				"https://agent-portainer.io/test?c=7",
+				map[string]string{
+					"Authorization":           "secret",
+					"Proxy-Authorization":     "secret",
+					"Cookie":                  "secret",
+					"X-Csrf-Token":            "secret",
+					"X-Api-Key":               "secret",
+					"Accept":                  "application/json",
+					"Accept-Encoding":         "gzip",
+					"Accept-Language":         "en-GB",
+					"Cache-Control":           "None",
+					"Content-Length":          "100",
+					"Content-Type":            "application/json",
+					"Private-Token":           "test-private-token",
+					"User-Agent":              "test-user-agent",
+					"X-Portaineragent-Target": "test-agent-1",
+					"X-Portainer-Volumename":  "test-volume-1",
+					"X-Registry-Auth":         "test-registry-auth",
+				},
+				true,
+			),
+			expectedReq: createRequest(
+				t,
+				"GET",
+				"https://portainer.io/api/docker/test?a=5&b=6&c=7",
+				map[string]string{
+					"Accept":                  "application/json",
+					"Accept-Encoding":         "gzip",
+					"Accept-Language":         "en-GB",
+					"Cache-Control":           "None",
+					"Content-Length":          "100",
+					"Content-Type":            "application/json",
+					"Private-Token":           "test-private-token",
+					"User-Agent":              "test-user-agent",
+					"X-Portaineragent-Target": "test-agent-1",
+					"X-Portainer-Volumename":  "test-volume-1",
+					"X-Registry-Auth":         "test-registry-auth",
+				},
+				true,
+			),
+		},
+		{
+			name:   "Non canonical Headers",
+			target: createURL(t, "https://portainer.io/api/docker?a=5&b=6"),
+			req: createRequest(
+				t,
+				"GET",
+				"https://agent-portainer.io/test?c=7",
+				map[string]string{
+					"Accept":                             "application/json",
+					"Accept-Encoding":                    "gzip",
+					"Accept-Language":                    "en-GB",
+					"Cache-Control":                      "None",
+					"Content-Length":                     "100",
+					"Content-Type":                       "application/json",
+					"Private-Token":                      "test-private-token",
+					"User-Agent":                         "test-user-agent",
+					portainer.PortainerAgentTargetHeader: "test-agent-1",
+					"X-Portainer-VolumeName":             "test-volume-1",
+					"X-Registry-Auth":                    "test-registry-auth",
+				},
+				false,
+			),
+			expectedReq: createRequest(
+				t,
+				"GET",
+				"https://portainer.io/api/docker/test?a=5&b=6&c=7",
+				map[string]string{
+					"Accept":          "application/json",
+					"Accept-Encoding": "gzip",
+					"Accept-Language": "en-GB",
+					"Cache-Control":   "None",
+					"Content-Length":  "100",
+					"Content-Type":    "application/json",
+					"Private-Token":   "test-private-token",
+					"User-Agent":      "test-user-agent",
+					"X-Registry-Auth": "test-registry-auth",
+				},
+				true,
+			),
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			rewriteFn := createRewriteFn(tc.target)
+			proxyRequest := httputil.ProxyRequest{
+				In:  tc.req.Clone(t.Context()),
+				Out: tc.req.Clone(t.Context()),
+			}
+			rewriteFn(&proxyRequest)
+
+			if diff := cmp.Diff(proxyRequest.In, tc.req, cmp.Comparer(compareRequests)); diff != "" {
+				t.Fatalf("rewriteFn modified in request: \n%s", diff)
+			}
+
+			if diff := cmp.Diff(proxyRequest.Out, tc.expectedReq, cmp.Comparer(compareRequests)); diff != "" {
+				t.Fatalf("requests are different: \n%s", diff)
+			}
+		})
+	}
+}
+
+func createURL(t *testing.T, urlString string) *url.URL {
+	parsedURL, err := url.Parse(urlString)
+	if err != nil {
+		t.Fatalf("Failed to create url: %s", err)
+	}
+
+	return parsedURL
+}
+
+func createRequest(t *testing.T, method, url string, headers map[string]string, canonicalHeaders bool) *http.Request {
+	req, err := http.NewRequest(method, url, nil)
+	if err != nil {
+		t.Fatalf("Failed to create http request: %s", err)
+	} else {
+		for k, v := range headers {
+			if canonicalHeaders {
+				req.Header.Add(k, v)
+			} else {
+				req.Header[k] = []string{v}
+			}
+		}
+	}
+
+	return req
+}
+
+func compareRequests(a, b *http.Request) bool {
+	methodEqual := a.Method == b.Method
+	urlEqual := cmp.Diff(a.URL, b.URL) == ""
+	hostEqual := a.Host == b.Host
+	protoEqual := a.Proto == b.Proto && a.ProtoMajor == b.ProtoMajor && a.ProtoMinor == b.ProtoMinor
+	headersEqual := cmp.Diff(a.Header, b.Header) == ""
+
+	return methodEqual && urlEqual && hostEqual && protoEqual && headersEqual
+}
+
+func Test_createRewriteFn_staleRawPath(t *testing.T) {
+	t.Parallel()
+
+	var receivedURI string
+	backend := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		receivedURI = r.RequestURI
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer backend.Close()
+
+	target, err := url.Parse(backend.URL)
+	require.NoError(t, err)
+
+	proxy := &httputil.ReverseProxy{Rewrite: createRewriteFn(target)}
+	frontend := httptest.NewServer(proxy)
+	defer frontend.Close()
+
+	resp, err := http.Get(frontend.URL + "/%63ontainers/json")
+	require.NoError(t, err)
+	require.NoError(t, resp.Body.Close())
+
+	require.Equal(t, "/containers/json", receivedURI)
+}
diff --git a/api/http/proxy/factory/transport_test.go b/api/http/proxy/factory/transport_test.go
new file mode 100644
index 0000000..ff5b38b
--- /dev/null
+++ b/api/http/proxy/factory/transport_test.go
@@ -0,0 +1,224 @@
+package factory
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"net/http/httputil"
+	"testing"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/proxy/factory/docker"
+	"github.com/portainer/portainer/pkg/fips"
+	"github.com/portainer/portainer/pkg/libhttp/ssrf"
+
+	"github.com/stretchr/testify/require"
+)
+
+func init() {
+	fips.InitFIPS(false)
+}
+
+type stubTunnelService struct{}
+
+func (s *stubTunnelService) StartTunnelServer(addr, port string, snapshotService portainer.SnapshotService) error {
+	return nil
+}
+
+func (s *stubTunnelService) StopTunnelServer() error { return nil }
+
+func (s *stubTunnelService) GenerateEdgeKey(apiURL, tunnelAddr string, endpointIdentifier int) string {
+	return ""
+}
+
+func (s *stubTunnelService) Open(endpoint *portainer.Endpoint) error { return nil }
+
+func (s *stubTunnelService) Config(endpointID portainer.EndpointID) portainer.TunnelDetails {
+	return portainer.TunnelDetails{}
+}
+
+func (s *stubTunnelService) TunnelAddr(endpoint *portainer.Endpoint) (string, error) {
+	return "127.0.0.1:9999", nil
+}
+
+func (s *stubTunnelService) UpdateLastActivity(endpointID portainer.EndpointID) {}
+
+func (s *stubTunnelService) KeepTunnelAlive(endpointID portainer.EndpointID, ctx context.Context, maxKeepAlive time.Duration) {
+}
+
+type staticAllowListService struct {
+	parsed portainer.ParsedAllowList
+}
+
+func (s *staticAllowListService) ReadParsed(id portainer.AllowListKey) (*portainer.ParsedAllowList, error) {
+	return &s.parsed, nil
+}
+
+func enableSSRF(t *testing.T) {
+	t.Helper()
+	parsed := ssrf.ParseAllowedHosts([]string{"example.com"})
+	parsed.Mode = portainer.SSRFModeEnforce
+	err := ssrf.Configure(&staticAllowListService{parsed: parsed})
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		err := ssrf.Configure(&staticAllowListService{})
+		require.NoError(t, err)
+	})
+}
+
+func TestNewDockerHTTPProxy_NonEdgeNoTLS(t *testing.T) {
+	enableSSRF(t)
+
+	f := &ProxyFactory{reverseTunnelService: &stubTunnelService{}}
+	endpoint := &portainer.Endpoint{
+		Type: portainer.DockerEnvironment,
+		URL:  "tcp://192.168.1.100:2376",
+	}
+
+	handler, err := f.newDockerHTTPProxy(endpoint)
+	require.NoError(t, err)
+
+	proxy := handler.(*httputil.ReverseProxy)
+	dt := proxy.Transport.(*docker.Transport)
+	require.NotNil(t, dt.HTTPTransport.DialContext)
+}
+
+func TestNewDockerHTTPProxy_NonEdgeTLS(t *testing.T) {
+	enableSSRF(t)
+
+	f := &ProxyFactory{reverseTunnelService: &stubTunnelService{}}
+	endpoint := &portainer.Endpoint{
+		Type: portainer.DockerEnvironment,
+		URL:  "tcp://192.168.1.100:2376",
+		TLSConfig: portainer.TLSConfiguration{
+			TLS:           true,
+			TLSSkipVerify: true,
+		},
+	}
+
+	handler, err := f.newDockerHTTPProxy(endpoint)
+	require.NoError(t, err)
+
+	proxy := handler.(*httputil.ReverseProxy)
+	dt := proxy.Transport.(*docker.Transport)
+	require.NotNil(t, dt.HTTPTransport.DialContext)
+}
+
+func TestNewDockerHTTPProxy_EdgeNoTLS(t *testing.T) {
+	enableSSRF(t)
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	f := &ProxyFactory{reverseTunnelService: &stubTunnelService{}}
+	endpoint := &portainer.Endpoint{
+		Type: portainer.EdgeAgentOnDockerEnvironment,
+		URL:  "tcp://192.168.1.100:2376",
+	}
+
+	handler, err := f.newDockerHTTPProxy(endpoint)
+	require.NoError(t, err)
+
+	proxy := handler.(*httputil.ReverseProxy)
+	dt := proxy.Transport.(*docker.Transport)
+
+	resp, err := (&http.Client{Transport: dt.HTTPTransport}).Get(srv.URL)
+	require.NoError(t, err)
+	require.NoError(t, resp.Body.Close())
+}
+
+func TestNewDockerHTTPProxy_EdgeTLS(t *testing.T) {
+	enableSSRF(t)
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	f := &ProxyFactory{reverseTunnelService: &stubTunnelService{}}
+	endpoint := &portainer.Endpoint{
+		Type: portainer.EdgeAgentOnDockerEnvironment,
+		URL:  "tcp://192.168.1.100:2376",
+		TLSConfig: portainer.TLSConfiguration{
+			TLS:           true,
+			TLSSkipVerify: true,
+		},
+	}
+
+	handler, err := f.newDockerHTTPProxy(endpoint)
+	require.NoError(t, err)
+
+	proxy := handler.(*httputil.ReverseProxy)
+	dt := proxy.Transport.(*docker.Transport)
+
+	resp, err := (&http.Client{Transport: dt.HTTPTransport}).Get(srv.URL)
+	require.NoError(t, err)
+	require.NoError(t, resp.Body.Close())
+}
+
+func TestNewAgentProxy_NonEdgeNoTLS(t *testing.T) {
+	f := &ProxyFactory{reverseTunnelService: &stubTunnelService{}}
+	endpoint := &portainer.Endpoint{
+		Type: portainer.AgentOnDockerEnvironment,
+		URL:  "tcp://192.168.1.100:9001",
+	}
+
+	proxyServer, err := f.NewAgentProxy(endpoint)
+	require.NoError(t, err)
+	defer proxyServer.Close()
+
+	require.Positive(t, proxyServer.Port)
+}
+
+func TestNewAgentProxy_NonEdgeTLS(t *testing.T) {
+	f := &ProxyFactory{reverseTunnelService: &stubTunnelService{}}
+	endpoint := &portainer.Endpoint{
+		Type: portainer.AgentOnDockerEnvironment,
+		URL:  "tcp://192.168.1.100:9001",
+		TLSConfig: portainer.TLSConfiguration{
+			TLS:           true,
+			TLSSkipVerify: true,
+		},
+	}
+
+	proxyServer, err := f.NewAgentProxy(endpoint)
+	require.NoError(t, err)
+	defer proxyServer.Close()
+
+	require.Positive(t, proxyServer.Port)
+}
+
+func TestNewAgentProxy_EdgeNoTLS(t *testing.T) {
+	f := &ProxyFactory{reverseTunnelService: &stubTunnelService{}}
+	endpoint := &portainer.Endpoint{
+		Type: portainer.EdgeAgentOnDockerEnvironment,
+		URL:  "tcp://192.168.1.100:9001",
+	}
+
+	proxyServer, err := f.NewAgentProxy(endpoint)
+	require.NoError(t, err)
+	defer proxyServer.Close()
+
+	require.Positive(t, proxyServer.Port)
+}
+
+func TestNewAgentProxy_EdgeTLS(t *testing.T) {
+	f := &ProxyFactory{reverseTunnelService: &stubTunnelService{}}
+	endpoint := &portainer.Endpoint{
+		Type: portainer.EdgeAgentOnDockerEnvironment,
+		URL:  "tcp://192.168.1.100:9001",
+		TLSConfig: portainer.TLSConfiguration{
+			TLS:           true,
+			TLSSkipVerify: true,
+		},
+	}
+
+	proxyServer, err := f.NewAgentProxy(endpoint)
+	require.NoError(t, err)
+	defer proxyServer.Close()
+
+	require.Positive(t, proxyServer.Port)
+}
diff --git a/api/http/proxy/factory/utils/json.go b/api/http/proxy/factory/utils/json.go
new file mode 100644
index 0000000..9aa37fd
--- /dev/null
+++ b/api/http/proxy/factory/utils/json.go
@@ -0,0 +1,94 @@
+package utils
+
+import (
+	"compress/gzip"
+	"errors"
+	"fmt"
+	"io"
+	"mime"
+
+	"github.com/portainer/portainer/api/logs"
+	"github.com/segmentio/encoding/json"
+	"go.yaml.in/yaml/v3"
+)
+
+// GetJSONObject will extract an object from a specific property of another JSON object.
+// Returns nil if nothing is associated to the specified key.
+func GetJSONObject(jsonObject map[string]any, property string) map[string]any {
+	object := jsonObject[property]
+	if object != nil {
+		return object.(map[string]any)
+	}
+	return nil
+}
+
+// GetArrayObject will extract an array from a specific property of another JSON object.
+// Returns nil if nothing is associated to the specified key.
+func GetArrayObject(jsonObject map[string]any, property string) []any {
+	object := jsonObject[property]
+	if object != nil {
+		return object.([]any)
+	}
+	return nil
+}
+
+func getBody(body io.ReadCloser, contentType string, isGzip bool) (any, error) {
+	if body == nil {
+		return nil, errors.New("unable to parse response: empty response body")
+	}
+
+	reader := body
+
+	if isGzip {
+		gzipReader, err := gzip.NewReader(reader)
+		if err != nil {
+			return nil, err
+		}
+
+		reader = gzipReader
+	}
+
+	defer logs.CloseAndLogErr(reader)
+
+	var data any
+	err := unmarshal(contentType, reader, &data)
+	if err != nil {
+		return nil, err
+	}
+
+	return data, nil
+}
+
+func marshal(contentType string, data any) ([]byte, error) {
+	// Note: contentType can look like: "application/json" or "application/json; charset=utf-8"
+	mediaType, _, err := mime.ParseMediaType(contentType)
+	if err != nil {
+		return nil, err
+	}
+
+	switch mediaType {
+	case "application/yaml":
+		return yaml.Marshal(data)
+	case "application/json", "":
+		return json.Marshal(data)
+	}
+
+	return nil, fmt.Errorf("content type is not supported for marshaling: %s", contentType)
+}
+
+func unmarshal(contentType string, body io.Reader, returnBody any) error {
+	// Note: contentType can look like: "application/json" or "application/json; charset=utf-8"
+	mediaType, _, err := mime.ParseMediaType(contentType)
+	if err != nil {
+		return err
+	}
+
+	switch mediaType {
+	case "application/yaml":
+		return yaml.NewDecoder(body).Decode(returnBody)
+	case "application/json", "":
+		return json.NewDecoder(body).Decode(returnBody)
+	}
+
+	return fmt.Errorf("content type is not supported for unmarshaling: %s", contentType)
+}
diff --git a/api/http/proxy/factory/utils/response.go b/api/http/proxy/factory/utils/response.go
new file mode 100644
index 0000000..4e8aac8
--- /dev/null
+++ b/api/http/proxy/factory/utils/response.go
@@ -0,0 +1,113 @@
+package utils
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"net/http"
+	"strconv"
+
+	"github.com/pkg/errors"
+	"github.com/rs/zerolog/log"
+)
+
+// GetResponseAsJSONObject returns the response content as a generic JSON object
+func GetResponseAsJSONObject(response *http.Response) (map[string]any, error) {
+	responseData, err := getResponseBody(response)
+	if err != nil {
+		return nil, err
+	}
+
+	responseObject, ok := responseData.(map[string]any)
+	if !ok {
+		return nil, nil
+	}
+	return responseObject, nil
+}
+
+// GetResponseAsJSONArray returns the response content as an array of generic JSON object
+func GetResponseAsJSONArray(response *http.Response) ([]any, error) {
+	responseData, err := getResponseBody(response)
+	if err != nil {
+		return nil, err
+	}
+	if responseData == nil {
+		return nil, nil
+	}
+
+	switch responseObject := responseData.(type) {
+	case []any:
+		return responseObject, nil
+	case map[string]any:
+		if responseObject["message"] != nil {
+			return nil, errors.New(responseObject["message"].(string))
+		}
+
+		log.Error().
+			Str("response", fmt.Sprintf("%+v", responseObject)).
+			Msg("invalid response format, expecting JSON array")
+
+		return nil, errors.New("unable to parse response: expected JSON array, got JSON object")
+	default:
+		log.Error().
+			Str("response", fmt.Sprintf("%+v", responseObject)).
+			Msg("invalid response format, expecting JSON array")
+
+		return nil, errors.New("unable to parse response: expected JSON array")
+	}
+}
+
+type errorResponse struct {
+	Message string `json:"message,omitempty"`
+}
+
+// WriteAccessDeniedResponse will create a new access denied response
+func WriteAccessDeniedResponse() (*http.Response, error) {
+	header := http.Header{}
+	header.Add("Content-Type", "application/json")
+
+	response := &http.Response{Header: header}
+	err := RewriteResponse(response, errorResponse{Message: "access denied to resource"}, http.StatusForbidden)
+
+	return response, err
+}
+
+// RewriteAccessDeniedResponse will overwrite the existing response with an access denied response
+func RewriteAccessDeniedResponse(response *http.Response) error {
+	return RewriteResponse(response, errorResponse{Message: "access denied to resource"}, http.StatusForbidden)
+}
+
+// RewriteResponse will replace the existing response body and status code with the one specified
+// in parameters
+func RewriteResponse(response *http.Response, newResponseData any, statusCode int) error {
+	data, err := marshal(getContentType(response), newResponseData)
+	if err != nil {
+		return err
+	}
+
+	body := io.NopCloser(bytes.NewReader(data))
+
+	response.StatusCode = statusCode
+	response.Body = body
+	response.ContentLength = int64(len(data))
+
+	if response.Header == nil {
+		response.Header = make(http.Header)
+	}
+	response.Header.Set("Content-Length", strconv.Itoa(len(data)))
+
+	return nil
+}
+
+func getResponseBody(response *http.Response) (any, error) {
+	isGzip := response.Header.Get("Content-Encoding") == "gzip"
+	if isGzip {
+		response.Header.Del("Content-Encoding")
+	}
+
+	return getBody(response.Body, getContentType(response), isGzip)
+}
+
+func getContentType(response *http.Response) string {
+	return response.Header.Get("Content-type")
+}
diff --git a/api/http/proxy/factory/utils/response_test.go b/api/http/proxy/factory/utils/response_test.go
new file mode 100644
index 0000000..6b82b1f
--- /dev/null
+++ b/api/http/proxy/factory/utils/response_test.go
@@ -0,0 +1,22 @@
+package utils
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestWriteAccessDeniedResponse(t *testing.T) {
+	t.Parallel()
+	r, err := WriteAccessDeniedResponse()
+	require.NoError(t, err)
+	defer func() {
+		err = r.Body.Close()
+		require.NoError(t, err)
+	}()
+
+	require.NotNil(t, r)
+	require.Equal(t, "application/json", r.Header.Get("content-type"))
+	require.Equal(t, http.StatusForbidden, r.StatusCode)
+}
diff --git a/api/http/proxy/manager.go b/api/http/proxy/manager.go
new file mode 100644
index 0000000..477bc54
--- /dev/null
+++ b/api/http/proxy/manager.go
@@ -0,0 +1,94 @@
+package proxy
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	dockerclient "github.com/portainer/portainer/api/docker/client"
+	"github.com/portainer/portainer/api/http/proxy/factory"
+	"github.com/portainer/portainer/api/http/proxy/factory/kubernetes"
+	"github.com/portainer/portainer/api/kubernetes/cli"
+
+	cmap "github.com/orcaman/concurrent-map"
+)
+
+var ErrProxyFactoryNotInitialized = errors.New("proxy factory not initialized")
+
+// Manager represents a service used to manage proxies to environments (endpoints) and extensions.
+type Manager struct {
+	proxyFactory     *factory.ProxyFactory
+	endpointProxies  cmap.ConcurrentMap
+	k8sClientFactory *cli.ClientFactory
+}
+
+// NewManager initializes a new proxy Service
+func NewManager(kubernetesClientFactory *cli.ClientFactory) *Manager {
+	return &Manager{
+		endpointProxies:  cmap.New(),
+		k8sClientFactory: kubernetesClientFactory,
+	}
+}
+
+func (manager *Manager) NewProxyFactory(dataStore dataservices.DataStore, signatureService portainer.DigitalSignatureService, tunnelService portainer.ReverseTunnelService, clientFactory *dockerclient.ClientFactory, kubernetesClientFactory *cli.ClientFactory, kubernetesTokenCacheManager *kubernetes.TokenCacheManager, gitService portainer.GitService, snapshotService portainer.SnapshotService, jwtService portainer.JWTService) {
+	manager.proxyFactory = factory.NewProxyFactory(dataStore, signatureService, tunnelService, clientFactory, kubernetesClientFactory, kubernetesTokenCacheManager, gitService, snapshotService, jwtService)
+}
+
+// CreateAndRegisterEndpointProxy creates a new HTTP reverse proxy based on environment(endpoint) properties and adds it to the registered proxies.
+// It can also be used to create a new HTTP reverse proxy and replace an already registered proxy.
+func (manager *Manager) CreateAndRegisterEndpointProxy(endpoint *portainer.Endpoint) (http.Handler, error) {
+	if manager.proxyFactory == nil {
+		return nil, ErrProxyFactoryNotInitialized
+	}
+
+	proxy, err := manager.proxyFactory.NewEndpointProxy(endpoint)
+	if err != nil {
+		return nil, err
+	}
+
+	manager.endpointProxies.Set(fmt.Sprint(endpoint.ID), proxy)
+
+	return proxy, nil
+}
+
+// CreateAgentProxyServer creates a new HTTP reverse proxy based on environment(endpoint) properties and and adds it to the registered proxies.
+// It can also be used to create a new HTTP reverse proxy and replace an already registered proxy.
+func (manager *Manager) CreateAgentProxyServer(endpoint *portainer.Endpoint) (*factory.ProxyServer, error) {
+	if manager.proxyFactory == nil {
+		return nil, ErrProxyFactoryNotInitialized
+	}
+
+	return manager.proxyFactory.NewAgentProxy(endpoint)
+}
+
+// GetEndpointProxy returns the proxy associated to a key
+func (manager *Manager) GetEndpointProxy(endpoint *portainer.Endpoint) http.Handler {
+	proxy, ok := manager.endpointProxies.Get(fmt.Sprint(endpoint.ID))
+	if !ok {
+		return nil
+	}
+
+	return proxy.(http.Handler)
+}
+
+// DeleteEndpointProxy deletes the proxy associated to a key
+// and cleans the k8s environment(endpoint) client cache. DeleteEndpointProxy
+// is currently only called for edge connection clean up and when endpoint is updated
+func (manager *Manager) DeleteEndpointProxy(endpointID portainer.EndpointID) {
+	manager.endpointProxies.Remove(fmt.Sprint(endpointID))
+
+	if manager.k8sClientFactory != nil {
+		manager.k8sClientFactory.RemoveKubeClient(endpointID)
+	}
+}
+
+// CreateGitlabProxy creates a new HTTP reverse proxy that can be used to send requests to the Gitlab API
+func (manager *Manager) CreateGitlabProxy(url string) (http.Handler, error) {
+	if manager.proxyFactory == nil {
+		return nil, ErrProxyFactoryNotInitialized
+	}
+
+	return manager.proxyFactory.NewGitlabProxy(url)
+}
diff --git a/api/http/security/authorization.go b/api/http/security/authorization.go
new file mode 100644
index 0000000..4f106b7
--- /dev/null
+++ b/api/http/security/authorization.go
@@ -0,0 +1,169 @@
+package security
+
+import (
+	"net/http"
+	"slices"
+
+	portainer "github.com/portainer/portainer/api"
+)
+
+// IsAdmin returns true if the logged-in user is an admin
+func IsAdmin(request *http.Request) (bool, error) {
+	tokenData, err := RetrieveTokenData(request)
+	if err != nil {
+		return false, err
+	}
+
+	return IsAdminRole(tokenData.Role), nil
+}
+
+func IsAdminRole(role portainer.UserRole) bool {
+	return role == portainer.AdministratorRole
+}
+
+// AuthorizedResourceControlAccess checks whether the user can alter an existing resource control.
+func AuthorizedResourceControlAccess(resourceControl *portainer.ResourceControl, context *RestrictedRequestContext) bool {
+	if context.IsAdmin || resourceControl.Public {
+		return true
+	}
+
+	for _, access := range resourceControl.TeamAccesses {
+		for _, membership := range context.UserMemberships {
+			if membership.TeamID == access.TeamID {
+				return true
+			}
+		}
+	}
+
+	for _, access := range resourceControl.UserAccesses {
+		if context.UserID == access.UserID {
+			return true
+		}
+	}
+
+	return false
+}
+
+// AuthorizedResourceControlUpdate ensure that the user can update a resource control object.
+// A non-administrator user cannot create a resource control where:
+// * the Public flag is set false
+// * the AdministratorsOnly flag is set to true
+// * he wants to create a resource control without any user/team accesses
+// * he wants to add more than one user in the user accesses
+// * he wants to add a user in the user accesses that is not corresponding to its id
+// * he wants to add a team he is not a member of
+func AuthorizedResourceControlUpdate(resourceControl *portainer.ResourceControl, context *RestrictedRequestContext) bool {
+	if context.IsAdmin || resourceControl.Public {
+		return true
+	}
+
+	if resourceControl.AdministratorsOnly {
+		return false
+	}
+
+	userAccessesCount := len(resourceControl.UserAccesses)
+	teamAccessesCount := len(resourceControl.TeamAccesses)
+
+	if userAccessesCount == 0 && teamAccessesCount == 0 {
+		return false
+	}
+
+	if userAccessesCount > 1 || (userAccessesCount == 1 && teamAccessesCount == 1) {
+		return false
+	}
+
+	if userAccessesCount == 1 {
+		access := resourceControl.UserAccesses[0]
+		if access.UserID == context.UserID {
+			return true
+		}
+	}
+
+	if teamAccessesCount > 0 {
+		for _, access := range resourceControl.TeamAccesses {
+			if !slices.ContainsFunc(context.UserMemberships, func(m portainer.TeamMembership) bool {
+				return m.TeamID == access.TeamID
+			}) {
+				return false
+			}
+		}
+
+		return true
+	}
+
+	return false
+}
+
+// AuthorizedTeamManagement ensure that access to the management of the specified team is granted.
+// It will check if the user is either administrator or leader of that team.
+func AuthorizedTeamManagement(teamID portainer.TeamID, context *RestrictedRequestContext) bool {
+	if context.IsAdmin {
+		return true
+	}
+
+	for _, membership := range context.UserMemberships {
+		if membership.TeamID == teamID && membership.Role == portainer.TeamLeader {
+			return true
+		}
+	}
+
+	return false
+}
+
+// AuthorizedIsTeamLeader ensure that the user is an admin or a team leader
+func AuthorizedIsTeamLeader(context *RestrictedRequestContext) bool {
+	return context.IsAdmin || context.IsTeamLeader
+}
+
+// AuthorizedIsAdmin ensure that the user is an admin
+func AuthorizedIsAdmin(context *RestrictedRequestContext) bool {
+	return context.IsAdmin
+}
+
+// AuthorizedEndpointAccess ensure that the user can access the specified environment(endpoint).
+// It will check if the user is part of the authorized users or part of a team that is
+// listed in the authorized teams of the environment(endpoint) and the associated group.
+func AuthorizedEndpointAccess(endpoint *portainer.Endpoint, endpointGroup *portainer.EndpointGroup, userID portainer.UserID, memberships []portainer.TeamMembership) bool {
+	groupAccess := AuthorizedAccess(userID, memberships, endpointGroup.UserAccessPolicies, endpointGroup.TeamAccessPolicies)
+	if !groupAccess {
+		return AuthorizedAccess(userID, memberships, endpoint.UserAccessPolicies, endpoint.TeamAccessPolicies)
+	}
+	return true
+}
+
+// authorizedEndpointGroupAccess ensure that the user can access the specified environment(endpoint) group.
+// It will check if the user is part of the authorized users or part of a team that is
+// listed in the authorized teams.
+func authorizedEndpointGroupAccess(endpointGroup *portainer.EndpointGroup, userID portainer.UserID, memberships []portainer.TeamMembership) bool {
+	return AuthorizedAccess(userID, memberships, endpointGroup.UserAccessPolicies, endpointGroup.TeamAccessPolicies)
+}
+
+// AuthorizedRegistryAccess ensure that the user can access the specified registry.
+// It will check if the user is part of the authorized users or part of a team that is
+// listed in the authorized teams for a specified environment(endpoint),
+func AuthorizedRegistryAccess(registry *portainer.Registry, user *portainer.User, teamMemberships []portainer.TeamMembership, endpointID portainer.EndpointID) bool {
+	if user.Role == portainer.AdministratorRole {
+		return true
+	}
+
+	registryEndpointAccesses := registry.RegistryAccesses[endpointID]
+
+	return AuthorizedAccess(user.ID, teamMemberships, registryEndpointAccesses.UserAccessPolicies, registryEndpointAccesses.TeamAccessPolicies)
+}
+
+// AuthorizedAccess verifies the userID or memberships are authorized to use an object per the supplied access policies
+func AuthorizedAccess(userID portainer.UserID, memberships []portainer.TeamMembership, userAccessPolicies portainer.UserAccessPolicies, teamAccessPolicies portainer.TeamAccessPolicies) bool {
+	_, userAccess := userAccessPolicies[userID]
+	if userAccess {
+		return true
+	}
+
+	for _, membership := range memberships {
+		_, teamAccess := teamAccessPolicies[membership.TeamID]
+		if teamAccess {
+			return true
+		}
+	}
+
+	return false
+}
diff --git a/api/http/security/authorization_test.go b/api/http/security/authorization_test.go
new file mode 100644
index 0000000..1b0dd9f
--- /dev/null
+++ b/api/http/security/authorization_test.go
@@ -0,0 +1,173 @@
+package security
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/stretchr/testify/require"
+)
+
+func TestAuthorizedResourceControlUpdate_AdminAlwaysAllowed(t *testing.T) {
+	t.Parallel()
+
+	rc := &portainer.ResourceControl{
+		AdministratorsOnly: true,
+	}
+	ctx := &RestrictedRequestContext{IsAdmin: true}
+
+	require.True(t, AuthorizedResourceControlUpdate(rc, ctx))
+}
+
+func TestAuthorizedResourceControlUpdate_PublicAlwaysAllowed(t *testing.T) {
+	t.Parallel()
+
+	rc := &portainer.ResourceControl{
+		Public: true,
+	}
+	ctx := &RestrictedRequestContext{IsAdmin: false}
+
+	require.True(t, AuthorizedResourceControlUpdate(rc, ctx))
+}
+
+func TestAuthorizedResourceControlUpdate_AdministratorsOnlyDenied(t *testing.T) {
+	t.Parallel()
+
+	rc := &portainer.ResourceControl{
+		AdministratorsOnly: true,
+		UserAccesses: []portainer.UserResourceAccess{
+			{UserID: 1, AccessLevel: portainer.ReadWriteAccessLevel},
+		},
+	}
+	ctx := &RestrictedRequestContext{IsAdmin: false, UserID: 1}
+
+	require.False(t, AuthorizedResourceControlUpdate(rc, ctx))
+}
+
+func TestAuthorizedResourceControlUpdate_EmptyAccessesDenied(t *testing.T) {
+	t.Parallel()
+
+	rc := &portainer.ResourceControl{}
+	ctx := &RestrictedRequestContext{IsAdmin: false, UserID: 1}
+
+	require.False(t, AuthorizedResourceControlUpdate(rc, ctx))
+}
+
+func TestAuthorizedResourceControlUpdate_UserAccessMatchingCurrentUser(t *testing.T) {
+	t.Parallel()
+
+	rc := &portainer.ResourceControl{
+		UserAccesses: []portainer.UserResourceAccess{
+			{UserID: 1, AccessLevel: portainer.ReadWriteAccessLevel},
+		},
+	}
+	ctx := &RestrictedRequestContext{IsAdmin: false, UserID: 1}
+
+	require.True(t, AuthorizedResourceControlUpdate(rc, ctx))
+}
+
+func TestAuthorizedResourceControlUpdate_UserAccessNotMatchingCurrentUser(t *testing.T) {
+	t.Parallel()
+
+	rc := &portainer.ResourceControl{
+		UserAccesses: []portainer.UserResourceAccess{
+			{UserID: 2, AccessLevel: portainer.ReadWriteAccessLevel},
+		},
+	}
+	ctx := &RestrictedRequestContext{IsAdmin: false, UserID: 1}
+
+	require.False(t, AuthorizedResourceControlUpdate(rc, ctx))
+}
+
+func TestAuthorizedResourceControlUpdate_TeamAccessUserMemberOfAllTeams(t *testing.T) {
+	t.Parallel()
+
+	rc := &portainer.ResourceControl{
+		TeamAccesses: []portainer.TeamResourceAccess{
+			{TeamID: 1, AccessLevel: portainer.ReadWriteAccessLevel},
+			{TeamID: 2, AccessLevel: portainer.ReadWriteAccessLevel},
+		},
+	}
+	ctx := &RestrictedRequestContext{
+		IsAdmin: false,
+		UserMemberships: []portainer.TeamMembership{
+			{TeamID: 1},
+			{TeamID: 2},
+		},
+	}
+
+	require.True(t, AuthorizedResourceControlUpdate(rc, ctx))
+}
+
+func TestAuthorizedResourceControlUpdate_TeamAccessUserNotMemberOfAllTeams(t *testing.T) {
+	t.Parallel()
+
+	rc := &portainer.ResourceControl{
+		TeamAccesses: []portainer.TeamResourceAccess{
+			{TeamID: 1, AccessLevel: portainer.ReadWriteAccessLevel},
+			{TeamID: 3, AccessLevel: portainer.ReadWriteAccessLevel},
+		},
+	}
+	ctx := &RestrictedRequestContext{
+		IsAdmin: false,
+		UserMemberships: []portainer.TeamMembership{
+			{TeamID: 1},
+			{TeamID: 2},
+		},
+	}
+
+	require.False(t, AuthorizedResourceControlUpdate(rc, ctx))
+}
+
+func TestAuthorizedResourceControlUpdate_TeamAccessUserNotMemberOfAnyTeam(t *testing.T) {
+	t.Parallel()
+
+	rc := &portainer.ResourceControl{
+		TeamAccesses: []portainer.TeamResourceAccess{
+			{TeamID: 5, AccessLevel: portainer.ReadWriteAccessLevel},
+		},
+	}
+	ctx := &RestrictedRequestContext{
+		IsAdmin: false,
+		UserMemberships: []portainer.TeamMembership{
+			{TeamID: 1},
+		},
+	}
+
+	require.False(t, AuthorizedResourceControlUpdate(rc, ctx))
+}
+
+func TestAuthorizedResourceControlUpdate_MultipleUserAccessesDenied(t *testing.T) {
+	t.Parallel()
+
+	rc := &portainer.ResourceControl{
+		UserAccesses: []portainer.UserResourceAccess{
+			{UserID: 1, AccessLevel: portainer.ReadWriteAccessLevel},
+			{UserID: 2, AccessLevel: portainer.ReadWriteAccessLevel},
+		},
+	}
+	ctx := &RestrictedRequestContext{IsAdmin: false, UserID: 1}
+
+	require.False(t, AuthorizedResourceControlUpdate(rc, ctx))
+}
+
+func TestAuthorizedResourceControlUpdate_UserAndTeamAccessCombinationDenied(t *testing.T) {
+	t.Parallel()
+
+	rc := &portainer.ResourceControl{
+		UserAccesses: []portainer.UserResourceAccess{
+			{UserID: 1, AccessLevel: portainer.ReadWriteAccessLevel},
+		},
+		TeamAccesses: []portainer.TeamResourceAccess{
+			{TeamID: 1, AccessLevel: portainer.ReadWriteAccessLevel},
+		},
+	}
+	ctx := &RestrictedRequestContext{
+		IsAdmin: false,
+		UserID:  1,
+		UserMemberships: []portainer.TeamMembership{
+			{TeamID: 1},
+		},
+	}
+
+	require.False(t, AuthorizedResourceControlUpdate(rc, ctx))
+}
diff --git a/api/http/security/bouncer.go b/api/http/security/bouncer.go
new file mode 100644
index 0000000..6def9a9
--- /dev/null
+++ b/api/http/security/bouncer.go
@@ -0,0 +1,580 @@
+package security
+
+import (
+	"context"
+	"net/http"
+	"slices"
+	"strings"
+	"sync"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/apikey"
+	"github.com/portainer/portainer/api/dataservices"
+	httperrors "github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/pkg/featureflags"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/schedule"
+
+	"github.com/pkg/errors"
+	"github.com/rs/zerolog/log"
+)
+
+const apiKeyHeader = "X-API-KEY"
+const jwtTokenHeader = "Authorization"
+
+type (
+	BouncerService interface {
+		PublicAccess(http.Handler) http.Handler
+		AdminAccess(http.Handler) http.Handler
+		RestrictedAccess(http.Handler) http.Handler
+		TeamLeaderAccess(http.Handler) http.Handler
+		AuthenticatedAccess(http.Handler) http.Handler
+		EdgeComputeOperation(http.Handler) http.Handler
+
+		AuthorizedEndpointOperation(*http.Request, *portainer.Endpoint) error
+		AuthorizedEdgeEndpointOperation(*http.Request, *portainer.Endpoint) error
+		CookieAuthLookup(*http.Request) (*portainer.TokenData, error)
+		JWTAuthLookup(*http.Request) (*portainer.TokenData, error)
+		TrustedEdgeEnvironmentAccess(dataservices.DataStoreTx, *portainer.Endpoint) error
+		RevokeJWT(string)
+		DisableCSP()
+	}
+
+	// RequestBouncer represents an entity that manages API request accesses
+	RequestBouncer struct {
+		dataStore     dataservices.DataStore
+		jwtService    portainer.JWTService
+		apiKeyService apikey.APIKeyService
+		revokedJWT    sync.Map
+		hsts          bool
+		csp           bool
+	}
+
+	// RestrictedRequestContext is a data structure containing information
+	// used in AuthenticatedAccess
+	RestrictedRequestContext struct {
+		IsAdmin         bool
+		IsTeamLeader    bool
+		UserID          portainer.UserID
+		UserMemberships []portainer.TeamMembership
+		User            *portainer.User
+	}
+
+	// tokenLookup looks up a token in the request
+	tokenLookup func(*http.Request) (*portainer.TokenData, error)
+)
+
+var (
+	ErrInvalidKey = errors.New("Invalid API key")
+	ErrRevokedJWT = errors.New("the JWT has been revoked")
+)
+
+// NewRequestBouncer initializes a new RequestBouncer
+func NewRequestBouncer(ctx context.Context, dataStore dataservices.DataStore, jwtService portainer.JWTService, apiKeyService apikey.APIKeyService) *RequestBouncer {
+	b := &RequestBouncer{
+		dataStore:     dataStore,
+		jwtService:    jwtService,
+		apiKeyService: apiKeyService,
+		hsts:          featureflags.IsEnabled("hsts"),
+		csp:           true,
+	}
+
+	go schedule.RunOnInterval(ctx, time.Hour, b.cleanUpExpiredJWTPass, nil)
+
+	return b
+}
+
+// DisableCSP disables Content Security Policy
+func (bouncer *RequestBouncer) DisableCSP() {
+	bouncer.csp = false
+}
+
+// PublicAccess defines a security check for public API endpoints.
+// No authentication is required to access these endpoints.
+func (bouncer *RequestBouncer) PublicAccess(h http.Handler) http.Handler {
+	return MWSecureHeaders(h, bouncer.hsts, bouncer.csp)
+}
+
+// AdminAccess defines a security check for API endpoints that require an authorization check.
+// Authentication is required to access these endpoints.
+// The administrator role is required to use these endpoints.
+// The request context will be enhanced with a RestrictedRequestContext object
+// that might be used later to inside the API operation for extra authorization validation
+// and resource filtering.
+func (bouncer *RequestBouncer) AdminAccess(h http.Handler) http.Handler {
+	h = bouncer.mwUpgradeToRestrictedRequest(h)
+	h = bouncer.mwCheckPortainerAuthorizations(h, true)
+	h = bouncer.mwAuthenticatedUser(h)
+
+	return h
+}
+
+// RestrictedAccess defines a security check for restricted API endpoints.
+// Authentication is required to access these endpoints.
+// The request context will be enhanced with a RestrictedRequestContext object
+// that might be used later to inside the API operation for extra authorization validation
+// and resource filtering.
+func (bouncer *RequestBouncer) RestrictedAccess(h http.Handler) http.Handler {
+	h = bouncer.mwUpgradeToRestrictedRequest(h)
+	h = bouncer.mwCheckPortainerAuthorizations(h, false)
+	h = bouncer.mwAuthenticatedUser(h)
+
+	return h
+}
+
+// TeamLeaderAccess defines a security check for APIs require team leader privilege
+//
+// Bouncer operations are applied backwards:
+//   - Parse the JWT from the request and stored in context, user has to be authenticated
+//   - Upgrade to the restricted request
+//   - User is admin or team leader
+func (bouncer *RequestBouncer) TeamLeaderAccess(h http.Handler) http.Handler {
+	h = bouncer.mwIsTeamLeader(h)
+	h = bouncer.mwUpgradeToRestrictedRequest(h)
+	h = bouncer.mwAuthenticatedUser(h)
+
+	return h
+}
+
+// AuthenticatedAccess defines a security check for restricted API endpoints.
+// Authentication is required to access these endpoints.
+// The request context will be enhanced with a RestrictedRequestContext object
+// that might be used later to inside the API operation for extra authorization validation
+// and resource filtering.
+func (bouncer *RequestBouncer) AuthenticatedAccess(h http.Handler) http.Handler {
+	h = bouncer.mwUpgradeToRestrictedRequest(h)
+	h = bouncer.mwAuthenticatedUser(h)
+
+	return h
+}
+
+// AuthorizedEndpointOperation retrieves the JWT token from the request context and verifies
+// that the user can access the specified environment(endpoint).
+// An error is returned when access to the environments(endpoints) is denied or if the user do not have the required
+// authorization to execute the operation.
+func (bouncer *RequestBouncer) AuthorizedEndpointOperation(r *http.Request, endpoint *portainer.Endpoint) error {
+	tokenData, err := RetrieveTokenData(r)
+	if err != nil {
+		return err
+	}
+
+	if tokenData.Role == portainer.AdministratorRole {
+		return nil
+	}
+
+	memberships, err := bouncer.dataStore.TeamMembership().TeamMembershipsByUserID(tokenData.ID)
+	if err != nil {
+		return err
+	}
+
+	group, err := bouncer.dataStore.EndpointGroup().Read(endpoint.GroupID)
+	if err != nil {
+		return err
+	}
+
+	if !AuthorizedEndpointAccess(endpoint, group, tokenData.ID, memberships) {
+		return httperrors.ErrEndpointAccessDenied
+	}
+
+	return nil
+}
+
+// AuthorizedEdgeEndpointOperation verifies that the request was received from a valid Edge environment(endpoint)
+func (bouncer *RequestBouncer) AuthorizedEdgeEndpointOperation(r *http.Request, endpoint *portainer.Endpoint) error {
+	if endpoint.Type != portainer.EdgeAgentOnKubernetesEnvironment && endpoint.Type != portainer.EdgeAgentOnDockerEnvironment {
+		return errors.New("Invalid environment type")
+	}
+
+	edgeIdentifier := r.Header.Get(portainer.PortainerAgentEdgeIDHeader)
+	if edgeIdentifier == "" {
+		return errors.New("missing Edge identifier")
+	}
+
+	if endpoint.EdgeID != "" && endpoint.EdgeID != edgeIdentifier {
+		return errors.New("invalid Edge identifier")
+	}
+
+	return nil
+}
+
+// TrustedEdgeEnvironmentAccess defines a security check for Edge environments, checks if
+// the request is coming from a trusted Edge environment
+func (bouncer *RequestBouncer) TrustedEdgeEnvironmentAccess(tx dataservices.DataStoreTx, endpoint *portainer.Endpoint) error {
+	if endpoint.UserTrusted {
+		return nil
+	}
+
+	settings, err := tx.Settings().Settings()
+	if err != nil {
+		return errors.WithMessage(err, "could not retrieve the settings")
+	}
+
+	if !settings.TrustOnFirstConnect {
+		return errors.New("the device has not been trusted yet")
+	}
+
+	return nil
+}
+
+// mwAuthenticatedUser authenticates a request by
+// - adding a secure handlers to the response
+// - authenticating the request with a valid token
+func (bouncer *RequestBouncer) mwAuthenticatedUser(h http.Handler) http.Handler {
+	h = bouncer.mwAuthenticateFirst([]tokenLookup{
+		bouncer.apiKeyLookup,
+		bouncer.CookieAuthLookup,
+		bouncer.JWTAuthLookup,
+	}, h)
+	h = MWSecureHeaders(h, bouncer.hsts, bouncer.csp)
+
+	return h
+}
+
+// mwCheckPortainerAuthorizations will verify that the user has the required authorization to access
+// a specific API environment(endpoint).
+// If the administratorOnly flag is specified, this will prevent non-admin
+// users from accessing the environment(endpoint).
+func (bouncer *RequestBouncer) mwCheckPortainerAuthorizations(next http.Handler, administratorOnly bool) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		tokenData, err := RetrieveTokenData(r)
+		if err != nil {
+			httperror.WriteError(w, http.StatusForbidden, "Access denied", httperrors.ErrUnauthorized)
+			return
+		}
+
+		if tokenData.Role == portainer.AdministratorRole {
+			next.ServeHTTP(w, r)
+			return
+		}
+
+		if administratorOnly {
+			httperror.WriteError(w, http.StatusForbidden, "Access denied", httperrors.ErrUnauthorized)
+			return
+		}
+
+		if ok, err := bouncer.dataStore.User().Exists(tokenData.ID); !ok {
+			httperror.WriteError(w, http.StatusUnauthorized, "Unauthorized", httperrors.ErrUnauthorized)
+			return
+		} else if err != nil {
+			httperror.WriteError(w, http.StatusInternalServerError, "Unable to retrieve user details from the database", err)
+			return
+		}
+
+		next.ServeHTTP(w, r)
+	})
+}
+
+// mwUpgradeToRestrictedRequest will enhance the current request with
+// a new RestrictedRequestContext object.
+func (bouncer *RequestBouncer) mwUpgradeToRestrictedRequest(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		tokenData, err := RetrieveTokenData(r)
+		if err != nil {
+			httperror.WriteError(w, http.StatusForbidden, "Access denied", httperrors.ErrResourceAccessDenied)
+			return
+		}
+
+		requestContext, err := newRestrictedContextRequest(bouncer.dataStore, tokenData.ID, tokenData.Role)
+		if err != nil {
+			httperror.WriteError(w, http.StatusInternalServerError, "Unable to create restricted request context ", err)
+			return
+		}
+
+		ctx := StoreRestrictedRequestContext(r, requestContext)
+		next.ServeHTTP(w, r.WithContext(ctx))
+	})
+}
+
+// mwIsTeamLeader will verify that the user is an admin or a team leader
+func (bouncer *RequestBouncer) mwIsTeamLeader(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		securityContext, err := RetrieveRestrictedRequestContext(r)
+		if err != nil {
+			httperror.WriteError(w, http.StatusInternalServerError, "Unable to retrieve restricted request context ", err)
+			return
+		}
+
+		if !securityContext.IsAdmin && !securityContext.IsTeamLeader {
+			httperror.WriteError(w, http.StatusForbidden, "Access denied", httperrors.ErrUnauthorized)
+			return
+		}
+
+		next.ServeHTTP(w, r)
+	})
+}
+
+// mwAuthenticateFirst authenticates a request an auth token.
+// A result of a first succeeded token lookup would be used for the authentication.
+func (bouncer *RequestBouncer) mwAuthenticateFirst(tokenLookups []tokenLookup, next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, hasAPIKey := extractAPIKey(r)
+		_, hasBearerToken := extractBearerToken(r)
+		if hasAPIKey && hasBearerToken {
+			httperror.WriteError(w, http.StatusUnauthorized, "API key and auth header are not allowed at the same time", httperrors.ErrUnauthorized)
+
+			return
+		}
+
+		var token *portainer.TokenData
+
+		for _, lookup := range tokenLookups {
+			resultToken, err := lookup(r)
+			if err != nil {
+				httperror.WriteError(w, http.StatusUnauthorized, "Invalid JWT token", httperrors.ErrUnauthorized)
+
+				return
+			}
+
+			if resultToken != nil {
+				token = resultToken
+
+				break
+			}
+		}
+
+		if token == nil {
+			httperror.WriteError(w, http.StatusUnauthorized, "A valid authorization token is missing", httperrors.ErrUnauthorized)
+
+			return
+		}
+
+		if ok, _ := bouncer.dataStore.User().Exists(token.ID); !ok {
+			httperror.WriteError(w, http.StatusUnauthorized, "The authorization token is invalid", httperrors.ErrUnauthorized)
+
+			return
+		}
+
+		ctx := StoreTokenData(r, token)
+		next.ServeHTTP(w, r.WithContext(ctx))
+	})
+}
+
+// JWTAuthLookup looks up a valid bearer in the request.
+func (bouncer *RequestBouncer) CookieAuthLookup(r *http.Request) (*portainer.TokenData, error) {
+	// get token from the Authorization header or query parameter
+	token, err := extractKeyFromCookie(r)
+	if err != nil {
+		return nil, nil
+	}
+
+	tokenData, jti, _, err := bouncer.jwtService.ParseAndVerifyToken(token)
+	if err != nil {
+		return nil, err
+	}
+
+	if _, ok := bouncer.revokedJWT.Load(jti); ok {
+		return nil, ErrRevokedJWT
+	}
+
+	return tokenData, nil
+}
+
+// JWTAuthLookup looks up a valid bearer in the request.
+func (bouncer *RequestBouncer) JWTAuthLookup(r *http.Request) (*portainer.TokenData, error) {
+	// get token from the Authorization header or query parameter
+	token, ok := extractBearerToken(r)
+	if !ok {
+		return nil, nil
+	}
+
+	tokenData, jti, _, err := bouncer.jwtService.ParseAndVerifyToken(token)
+	if err != nil {
+		return nil, err
+	}
+
+	if _, ok := bouncer.revokedJWT.Load(jti); ok {
+		return nil, ErrRevokedJWT
+	}
+
+	return tokenData, nil
+}
+
+func (bouncer *RequestBouncer) RevokeJWT(token string) {
+	_, jti, exp, err := bouncer.jwtService.ParseAndVerifyToken(token)
+	if err != nil {
+		return
+	}
+
+	bouncer.revokedJWT.Store(jti, exp)
+}
+
+func (bouncer *RequestBouncer) cleanUpExpiredJWTPass() {
+	bouncer.revokedJWT.Range(func(key, value any) bool {
+		if t := value.(time.Time); t.IsZero() {
+			return true
+		} else if time.Now().After(t) {
+			bouncer.revokedJWT.Delete(key)
+		}
+
+		return true
+	})
+}
+
+// apiKeyLookup looks up an verifies an api-key by:
+// - computing the digest of the raw api-key
+// - verifying it exists in cache/database
+// - matching the key to a user (ID, Role)
+// If the key is valid/verified, the last updated time of the key is updated.
+// Successful verification of the key will return a TokenData object - since the downstream handlers
+// utilise the token injected in the request context.
+func (bouncer *RequestBouncer) apiKeyLookup(r *http.Request) (*portainer.TokenData, error) {
+	rawAPIKey, ok := extractAPIKey(r)
+	if !ok {
+		return nil, nil
+	}
+
+	digest := bouncer.apiKeyService.HashRaw(rawAPIKey)
+
+	user, apiKey, err := bouncer.apiKeyService.GetDigestUserAndKey(digest)
+	if err != nil {
+		return nil, ErrInvalidKey
+	}
+
+	tokenData := &portainer.TokenData{
+		ID:       user.ID,
+		Username: user.Username,
+		Role:     user.Role,
+	}
+	if _, _, err := bouncer.jwtService.GenerateToken(tokenData); err != nil {
+		log.Debug().Err(err).Msg("Failed to generate token")
+		return nil, errors.New("failed to generate token")
+	}
+
+	if now := time.Now().UTC().Unix(); now-apiKey.LastUsed > 60 { // [seconds]
+		// update the last used time of the key
+		apiKey.LastUsed = now
+		_ = bouncer.apiKeyService.UpdateAPIKey(&apiKey)
+	}
+
+	return tokenData, nil
+}
+
+// extractBearerToken extracts the Bearer token from the Authorization header and returns the token.
+func extractBearerToken(r *http.Request) (string, bool) {
+	tokens, ok := r.Header[jwtTokenHeader]
+	if !ok || len(tokens) == 0 {
+		return "", false
+	}
+
+	token := tokens[0]
+	token = strings.TrimPrefix(token, "Bearer ")
+
+	return token, true
+}
+
+// AddAuthCookie adds the jwt token to the response cookie.
+func AddAuthCookie(w http.ResponseWriter, token string, expirationTime time.Time, secure bool) {
+	http.SetCookie(w, &http.Cookie{
+		Name:     portainer.AuthCookieKey,
+		Value:    token,
+		Path:     "/",
+		Expires:  expirationTime,
+		HttpOnly: true,
+		Secure:   secure,
+		SameSite: http.SameSiteStrictMode,
+	})
+}
+
+// RemoveAuthCookie removes the jwt token from the response cookie.
+func RemoveAuthCookie(w http.ResponseWriter, secure bool) {
+	http.SetCookie(w, &http.Cookie{
+		Name:     portainer.AuthCookieKey,
+		Value:    "",
+		Path:     "/",
+		Expires:  time.Unix(0, 0),
+		HttpOnly: true,
+		MaxAge:   -1,
+		Secure:   secure,
+		SameSite: http.SameSiteStrictMode,
+	})
+}
+
+// extractKeyFromCookie extracts the jwt token from the cookie.
+func extractKeyFromCookie(r *http.Request) (string, error) {
+	cookie, err := r.Cookie(portainer.AuthCookieKey)
+	if err != nil {
+		return "", err
+	}
+
+	return cookie.Value, nil
+}
+
+// extractAPIKey extracts the api key from the X-API-KEY request header.
+func extractAPIKey(r *http.Request) (string, bool) {
+	apiKey := r.Header.Get(apiKeyHeader)
+	if apiKey != "" {
+		return apiKey, true
+	}
+
+	return "", false
+}
+
+// MWSecureHeaders provides secure headers middleware for handlers.
+func MWSecureHeaders(next http.Handler, hsts, csp bool) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if hsts {
+			w.Header().Set("Strict-Transport-Security", "max-age=31536000") // 365 days
+		}
+
+		if csp {
+			w.Header().Set("Content-Security-Policy", "script-src 'self' https://js.hsforms.net https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/; object-src 'none'; frame-ancestors 'none'; frame-src https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/")
+		}
+
+		w.Header().Set("X-Content-Type-Options", "nosniff")
+		next.ServeHTTP(w, r)
+	})
+}
+
+func newRestrictedContextRequest(tx dataservices.DataStoreTx, userID portainer.UserID, userRole portainer.UserRole) (*RestrictedRequestContext, error) {
+	user, err := tx.User().Read(userID)
+	if err != nil {
+		return nil, err
+	}
+
+	if userRole == portainer.AdministratorRole {
+		return &RestrictedRequestContext{
+			IsAdmin: true,
+			UserID:  userID,
+			User:    user,
+		}, nil
+	}
+
+	memberships, err := tx.TeamMembership().TeamMembershipsByUserID(userID)
+	if err != nil {
+		return nil, err
+	}
+
+	isTeamLeader := slices.ContainsFunc(memberships, func(m portainer.TeamMembership) bool {
+		return m.Role == portainer.TeamLeader
+	})
+
+	return &RestrictedRequestContext{
+		IsAdmin:         false,
+		UserID:          userID,
+		IsTeamLeader:    isTeamLeader,
+		UserMemberships: memberships,
+		User:            user,
+	}, nil
+}
+
+// EdgeComputeOperation defines a restricted edge compute operation.
+// Use of this operation will only be authorized if edgeCompute is enabled in settings
+func (bouncer *RequestBouncer) EdgeComputeOperation(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		settings, err := bouncer.dataStore.Settings().Settings()
+		if err != nil {
+			httperror.WriteError(w, http.StatusServiceUnavailable, "Unable to retrieve settings", err)
+
+			return
+		}
+
+		if !settings.EnableEdgeComputeFeatures {
+			httperror.WriteError(w, http.StatusServiceUnavailable, "Edge compute features are disabled", errors.New("Edge compute features are disabled"))
+
+			return
+		}
+
+		next.ServeHTTP(w, r)
+	})
+}
diff --git a/api/http/security/bouncer_test.go b/api/http/security/bouncer_test.go
new file mode 100644
index 0000000..6f9b69a
--- /dev/null
+++ b/api/http/security/bouncer_test.go
@@ -0,0 +1,477 @@
+package security
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/apikey"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+	"github.com/portainer/portainer/api/jwt"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// testHandler200 is a simple handler which returns HTTP status 200 OK
+var testHandler200 = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {})
+
+func tokenLookupSucceed(dataStore dataservices.DataStore, jwtService portainer.JWTService) tokenLookup {
+	return func(r *http.Request) (*portainer.TokenData, error) {
+		uid := portainer.UserID(1)
+		if err := dataStore.User().Create(&portainer.User{ID: uid}); err != nil {
+			return nil, err
+		}
+
+		_, _, err := jwtService.GenerateToken(&portainer.TokenData{ID: uid})
+		return &portainer.TokenData{ID: 1}, err
+	}
+}
+
+func tokenLookupFail(r *http.Request) (*portainer.TokenData, error) {
+	return nil, ErrInvalidKey
+}
+
+func tokenLookupEmpty(r *http.Request) (*portainer.TokenData, error) {
+	return nil, nil
+}
+
+func Test_mwAuthenticateFirst(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, true, true)
+
+	jwtService, err := jwt.NewService("1h", store)
+	require.NoError(t, err, "failed to create a copy of service")
+
+	apiKeyService := apikey.NewAPIKeyService(nil, nil)
+
+	bouncer := NewRequestBouncer(t.Context(), store, jwtService, apiKeyService)
+
+	tests := []struct {
+		name                   string
+		verificationMiddlwares []tokenLookup
+		wantStatusCode         int
+	}{
+		{
+			name:                   "mwAuthenticateFirst middleware passes with no middleware",
+			verificationMiddlwares: nil,
+			wantStatusCode:         http.StatusUnauthorized,
+		},
+		{
+			name: "mwAuthenticateFirst middleware succeeds with passing middleware",
+			verificationMiddlwares: []tokenLookup{
+				tokenLookupSucceed(store, jwtService),
+			},
+			wantStatusCode: http.StatusOK,
+		},
+		{
+			name: "mwAuthenticateFirst fails with failing middleware",
+			verificationMiddlwares: []tokenLookup{
+				tokenLookupFail,
+			},
+			wantStatusCode: http.StatusUnauthorized,
+		},
+		{
+			name: "mwAuthenticateFirst succeeds if first middleware successfully handles request",
+			verificationMiddlwares: []tokenLookup{
+				tokenLookupSucceed(store, jwtService),
+				tokenLookupFail,
+			},
+			wantStatusCode: http.StatusOK,
+		},
+		{
+			name: "mwAuthenticateFirst fails if first middleware fails",
+			verificationMiddlwares: []tokenLookup{
+				tokenLookupFail,
+				tokenLookupSucceed(store, jwtService),
+			},
+			wantStatusCode: http.StatusUnauthorized,
+		},
+		{
+			name: "mwAuthenticateFirst fails if first middleware has no token, but second middleware fails",
+			verificationMiddlwares: []tokenLookup{
+				tokenLookupEmpty,
+				tokenLookupFail,
+
+				tokenLookupSucceed(store, jwtService),
+			},
+			wantStatusCode: http.StatusUnauthorized,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			is := assert.New(t)
+			req := httptest.NewRequest(http.MethodGet, "/", nil)
+			rr := httptest.NewRecorder()
+
+			h := bouncer.mwAuthenticateFirst(tt.verificationMiddlwares, testHandler200)
+			h.ServeHTTP(rr, req)
+
+			is.Equal(tt.wantStatusCode, rr.Code, "Status should be %d", tt.wantStatusCode)
+		})
+	}
+}
+
+func Test_extractKeyFromCookie(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	tt := []struct {
+		name     string
+		token    string
+		succeeds bool
+	}{
+		{
+			name:     "missing cookie",
+			token:    "",
+			succeeds: false,
+		},
+
+		{
+			name:     "valid cookie",
+			token:    "abc",
+			succeeds: true,
+		},
+	}
+
+	for _, test := range tt {
+		req := httptest.NewRequest(http.MethodGet, "/", nil)
+		if test.token != "" {
+			testhelpers.AddTestSecurityCookie(req, test.token)
+		}
+
+		apiKey, err := extractKeyFromCookie(req)
+		is.Equal(test.token, apiKey)
+		if !test.succeeds {
+			require.Error(t, err, "Should return error")
+			is.ErrorIs(err, http.ErrNoCookie)
+		} else {
+			require.NoError(t, err)
+		}
+	}
+}
+
+func Test_extractBearerToken(t *testing.T) {
+	t.Parallel()
+	tt := []struct {
+		name               string
+		requestHeader      string
+		requestHeaderValue string
+		wantToken          string
+		succeeds           bool
+	}{
+		{
+			name:               "missing request header",
+			requestHeader:      "",
+			requestHeaderValue: "",
+			wantToken:          "",
+			succeeds:           false,
+		},
+		{
+			name:               "invalid authorization request header",
+			requestHeader:      "authorisation", // note: `s`
+			requestHeaderValue: "abc",
+			wantToken:          "",
+			succeeds:           false,
+		},
+		{
+			name:               "valid authorization request header",
+			requestHeader:      "AUTHORIZATION",
+			requestHeaderValue: "abc",
+			wantToken:          "abc",
+			succeeds:           true,
+		},
+		{
+			name:               "valid authorization request header case-insensitive canonical check",
+			requestHeader:      "authorization",
+			requestHeaderValue: "def",
+			wantToken:          "def",
+			succeeds:           true,
+		},
+	}
+
+	for _, test := range tt {
+		t.Run(test.name, func(t *testing.T) {
+			is := assert.New(t)
+			req := httptest.NewRequest(http.MethodGet, "/", nil)
+			req.Header.Set(test.requestHeader, test.requestHeaderValue)
+			apiKey, ok := extractBearerToken(req)
+			is.Equal(test.wantToken, apiKey)
+			is.Equal(test.succeeds, ok)
+		})
+	}
+}
+
+func Test_extractAPIKeyHeader(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	tt := []struct {
+		name               string
+		requestHeader      string
+		requestHeaderValue string
+		wantApiKey         string
+		succeeds           bool
+	}{
+		{
+			name:               "missing request header",
+			requestHeader:      "",
+			requestHeaderValue: "",
+			wantApiKey:         "",
+			succeeds:           false,
+		},
+		{
+			name:               "invalid api-key request header",
+			requestHeader:      "api-key",
+			requestHeaderValue: "abc",
+			wantApiKey:         "",
+			succeeds:           false,
+		},
+		{
+			name:               "valid api-key request header",
+			requestHeader:      apiKeyHeader,
+			requestHeaderValue: "abc",
+			wantApiKey:         "abc",
+			succeeds:           true,
+		},
+		{
+			name:               "valid api-key request header case-insensitive canonical check",
+			requestHeader:      "x-api-key",
+			requestHeaderValue: "def",
+			wantApiKey:         "def",
+			succeeds:           true,
+		},
+	}
+
+	for _, test := range tt {
+		req := httptest.NewRequest(http.MethodGet, "/", nil)
+		req.Header.Set(test.requestHeader, test.requestHeaderValue)
+		apiKey, ok := extractAPIKey(req)
+		is.Equal(test.wantApiKey, apiKey)
+		is.Equal(test.succeeds, ok)
+	}
+}
+
+func Test_apiKeyLookup(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	_, store := datastore.MustNewTestStore(t, true, true)
+
+	// create standard user
+	user := &portainer.User{ID: 2, Username: "standard", Role: portainer.StandardUserRole}
+	err := store.User().Create(user)
+	require.NoError(t, err, "error creating user")
+
+	// setup services
+	jwtService, err := jwt.NewService("1h", store)
+	require.NoError(t, err, "Error initiating jwt service")
+	apiKeyService := apikey.NewAPIKeyService(store.APIKeyRepository(), store.User())
+	bouncer := NewRequestBouncer(t.Context(), store, jwtService, apiKeyService)
+
+	t.Run("missing x-api-key header fails api-key lookup", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodGet, "/", nil)
+		// testhelpers.AddTestSecurityCookie(req, jwt)
+		token, err := bouncer.apiKeyLookup(req)
+		require.NoError(t, err)
+		is.Nil(token)
+	})
+
+	t.Run("invalid x-api-key header fails api-key lookup", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodGet, "/", nil)
+		req.Header.Add("x-api-key", "random-failing-api-key")
+		token, err := bouncer.apiKeyLookup(req)
+		is.Nil(token)
+		require.Error(t, err)
+	})
+
+	t.Run("valid x-api-key header succeeds api-key lookup", func(t *testing.T) {
+		rawAPIKey, _, err := apiKeyService.GenerateApiKey(*user, "test")
+		require.NoError(t, err)
+
+		req := httptest.NewRequest(http.MethodGet, "/", nil)
+		req.Header.Add("x-api-key", rawAPIKey)
+
+		token, err := bouncer.apiKeyLookup(req)
+		require.NoError(t, err)
+
+		expectedToken := &portainer.TokenData{ID: user.ID, Username: user.Username, Role: portainer.StandardUserRole}
+		is.Equal(expectedToken, token)
+	})
+
+	t.Run("valid x-api-key header succeeds api-key lookup", func(t *testing.T) {
+		rawAPIKey, apiKey, err := apiKeyService.GenerateApiKey(*user, "test")
+		require.NoError(t, err)
+		defer func() {
+			err := apiKeyService.DeleteAPIKey(apiKey.ID)
+			require.NoError(t, err)
+		}()
+
+		req := httptest.NewRequest(http.MethodGet, "/", nil)
+		req.Header.Add("x-api-key", rawAPIKey)
+
+		token, err := bouncer.apiKeyLookup(req)
+		require.NoError(t, err)
+
+		expectedToken := &portainer.TokenData{ID: user.ID, Username: user.Username, Role: portainer.StandardUserRole}
+		is.Equal(expectedToken, token)
+	})
+
+	t.Run("successful api-key lookup updates token last used time", func(t *testing.T) {
+		rawAPIKey, apiKey, err := apiKeyService.GenerateApiKey(*user, "test")
+		require.NoError(t, err)
+		defer func() {
+			err := apiKeyService.DeleteAPIKey(apiKey.ID)
+			require.NoError(t, err)
+		}()
+
+		req := httptest.NewRequest(http.MethodGet, "/", nil)
+		req.Header.Add("x-api-key", rawAPIKey)
+
+		token, err := bouncer.apiKeyLookup(req)
+		require.NoError(t, err)
+
+		expectedToken := &portainer.TokenData{ID: user.ID, Username: user.Username, Role: portainer.StandardUserRole}
+		is.Equal(expectedToken, token)
+
+		_, apiKeyUpdated, err := apiKeyService.GetDigestUserAndKey(apiKey.Digest)
+		require.NoError(t, err)
+
+		is.Greater(apiKeyUpdated.LastUsed, apiKey.LastUsed)
+	})
+}
+
+func Test_mwAuthenticateFirst_rejectsBothAPIKeyAndBearerToken(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, true, true)
+
+	jwtService, err := jwt.NewService("1h", store)
+	require.NoError(t, err)
+
+	apiKeyService := apikey.NewAPIKeyService(nil, nil)
+	bouncer := NewRequestBouncer(t.Context(), store, jwtService, apiKeyService)
+
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	req.Header.Set(apiKeyHeader, "test-api-key")
+	req.Header.Set(jwtTokenHeader, "Bearer test-token")
+
+	rr := httptest.NewRecorder()
+	h := bouncer.mwAuthenticateFirst(nil, testHandler200)
+	h.ServeHTTP(rr, req)
+
+	require.Equal(t, http.StatusUnauthorized, rr.Code)
+}
+
+func TestJWTRevocation(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, true, true)
+
+	jwtService, err := jwt.NewService("1h", store)
+	require.NoError(t, err)
+
+	err = store.User().Create(&portainer.User{ID: 1})
+	require.NoError(t, err)
+
+	jwtService.SetUserSessionDuration(time.Second)
+
+	token, _, err := jwtService.GenerateToken(&portainer.TokenData{ID: 1})
+	require.NoError(t, err)
+
+	settings, err := store.Settings().Settings()
+	require.NoError(t, err)
+
+	settings.KubeconfigExpiry = "0"
+
+	err = store.Settings().UpdateSettings(settings)
+	require.NoError(t, err)
+
+	kubeToken, err := jwtService.GenerateTokenForKubeconfig(&portainer.TokenData{ID: 1})
+	require.NoError(t, err)
+
+	apiKeyService := apikey.NewAPIKeyService(nil, nil)
+
+	bouncer := NewRequestBouncer(t.Context(), store, jwtService, apiKeyService)
+
+	r, err := http.NewRequest(http.MethodGet, "url", nil)
+	require.NoError(t, err)
+
+	r.Header.Add(jwtTokenHeader, "Bearer "+token)
+
+	r.AddCookie(&http.Cookie{Name: portainer.AuthCookieKey, Value: token})
+
+	_, err = bouncer.JWTAuthLookup(r)
+	require.NoError(t, err)
+
+	_, err = bouncer.CookieAuthLookup(r)
+	require.NoError(t, err)
+
+	bouncer.RevokeJWT(token)
+	bouncer.RevokeJWT(kubeToken)
+
+	revokeLen := func() (l int) {
+		bouncer.revokedJWT.Range(func(key, value any) bool {
+			l++
+
+			return true
+		})
+
+		return l
+	}
+	require.Equal(t, 2, revokeLen())
+
+	_, err = bouncer.JWTAuthLookup(r)
+	require.Error(t, err)
+
+	_, err = bouncer.CookieAuthLookup(r)
+	require.Error(t, err)
+
+	time.Sleep(time.Second)
+
+	bouncer.cleanUpExpiredJWTPass()
+
+	require.Equal(t, 1, revokeLen())
+}
+
+func TestCSPHeaderDefault(t *testing.T) {
+	t.Parallel()
+	b := NewRequestBouncer(t.Context(), nil, nil, nil)
+
+	srv := httptest.NewServer(
+		b.PublicAccess(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {})),
+	)
+	defer srv.Close()
+
+	resp, err := http.Get(srv.URL + "/")
+	require.NoError(t, err)
+	defer func() {
+		err := resp.Body.Close()
+		require.NoError(t, err)
+	}()
+
+	require.Contains(t, resp.Header, "Content-Security-Policy")
+}
+
+func TestCSPHeaderDisabled(t *testing.T) {
+	t.Parallel()
+	b := NewRequestBouncer(t.Context(), nil, nil, nil)
+	b.DisableCSP()
+
+	srv := httptest.NewServer(
+		b.PublicAccess(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {})),
+	)
+	defer srv.Close()
+
+	resp, err := http.Get(srv.URL + "/")
+	require.NoError(t, err)
+	defer func() {
+		err := resp.Body.Close()
+		require.NoError(t, err)
+	}()
+
+	require.NotContains(t, resp.Header, "Content-Security-Policy")
+}
diff --git a/api/http/security/context.go b/api/http/security/context.go
new file mode 100644
index 0000000..2cf6cb0
--- /dev/null
+++ b/api/http/security/context.go
@@ -0,0 +1,64 @@
+package security
+
+import (
+	"context"
+	"errors"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+)
+
+type contextKey int
+
+const (
+	contextAuthenticationKey contextKey = iota
+	contextRestrictedRequest
+)
+
+// StoreTokenData stores a TokenData object inside the request context and returns the enhanced context.
+func StoreTokenData(request *http.Request, tokenData *portainer.TokenData) context.Context {
+	return context.WithValue(request.Context(), contextAuthenticationKey, tokenData)
+}
+
+// RetrieveTokenData returns the TokenData object stored in the request context.
+func RetrieveTokenData(request *http.Request) (*portainer.TokenData, error) {
+	contextData := request.Context().Value(contextAuthenticationKey)
+	if contextData == nil {
+		return nil, errors.New("Unable to find JWT data in request context")
+	}
+
+	tokenData := contextData.(*portainer.TokenData)
+	return tokenData, nil
+}
+
+// StoreRestrictedRequestContext stores a RestrictedRequestContext object inside the request context
+// and returns the enhanced context.
+func StoreRestrictedRequestContext(request *http.Request, requestContext *RestrictedRequestContext) context.Context {
+	return context.WithValue(request.Context(), contextRestrictedRequest, requestContext)
+}
+
+// RetrieveRestrictedRequestContext returns the RestrictedRequestContext object stored in the request context.
+func RetrieveRestrictedRequestContext(request *http.Request) (*RestrictedRequestContext, error) {
+	contextData := request.Context().Value(contextRestrictedRequest)
+	if contextData == nil {
+		return nil, errors.New("Unable to find security details in request context")
+	}
+
+	requestContext := contextData.(*RestrictedRequestContext)
+	return requestContext, nil
+}
+
+func RetrieveUserFromRequest(r *http.Request, tx dataservices.DataStoreTx) (*portainer.User, error) {
+	rrc, err := RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return nil, err
+	}
+
+	user, err := tx.User().Read(rrc.UserID)
+	if err != nil {
+		return nil, err
+	}
+
+	return user, nil
+}
diff --git a/api/http/security/errors.go b/api/http/security/errors.go
new file mode 100644
index 0000000..40193b3
--- /dev/null
+++ b/api/http/security/errors.go
@@ -0,0 +1,7 @@
+package security
+
+import "errors"
+
+var (
+	ErrAuthorizationRequired = errors.New("Authorization required for this operation")
+)
diff --git a/api/http/security/filter.go b/api/http/security/filter.go
new file mode 100644
index 0000000..d01f934
--- /dev/null
+++ b/api/http/security/filter.go
@@ -0,0 +1,112 @@
+package security
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/slicesx"
+)
+
+// FilterUserTeams filters teams based on user role.
+// non-administrator users only have access to team they are member of.
+func FilterUserTeams(teams []portainer.Team, context *RestrictedRequestContext) []portainer.Team {
+	if context.IsAdmin {
+		return teams
+	}
+
+	memberOf := map[portainer.TeamID]bool{}
+	for _, membership := range context.UserMemberships {
+		memberOf[membership.TeamID] = true
+	}
+
+	return slicesx.FilterInPlace(teams, func(team portainer.Team) bool {
+		return memberOf[team.ID]
+	})
+}
+
+// FilterLeaderTeams filters teams based on user role.
+// Team leaders only have access to team they lead.
+func FilterLeaderTeams(teams []portainer.Team, context *RestrictedRequestContext) []portainer.Team {
+	if !context.IsTeamLeader {
+		return teams[:0]
+	}
+
+	leaderSet := map[portainer.TeamID]bool{}
+	for _, membership := range context.UserMemberships {
+		if membership.Role == portainer.TeamLeader && membership.UserID == context.UserID {
+			leaderSet[membership.TeamID] = true
+		}
+	}
+
+	return slicesx.FilterInPlace(teams, func(team portainer.Team) bool {
+		return leaderSet[team.ID]
+	})
+}
+
+// FilterUsers filters users based on user role.
+// Non-administrator users only have access to non-administrator users.
+func FilterUsers(users []portainer.User, context *RestrictedRequestContext) []portainer.User {
+	if context.IsAdmin {
+		return users
+	}
+
+	return slicesx.FilterInPlace(users, func(u portainer.User) bool {
+		return u.Role != portainer.AdministratorRole
+	})
+}
+
+// FilterRegistries filters registries based on user role and team memberships.
+// Non administrator users only have access to authorized registries.
+func FilterRegistries(registries []portainer.Registry, user *portainer.User, teamMemberships []portainer.TeamMembership, endpointID portainer.EndpointID) []portainer.Registry {
+	if user.Role == portainer.AdministratorRole {
+		return registries
+	}
+
+	return slicesx.FilterInPlace(registries, func(r portainer.Registry) bool {
+		return AuthorizedRegistryAccess(&r, user, teamMemberships, endpointID)
+	})
+}
+
+// FilterEndpoints filters environments(endpoints) based on user role and team memberships.
+// Non administrator only have access to authorized environments(endpoints) (can be inherited via endpoint groups).
+func FilterEndpoints(endpoints []portainer.Endpoint, groups []portainer.EndpointGroup, context *RestrictedRequestContext) []portainer.Endpoint {
+	if context.IsAdmin {
+		return endpoints
+	}
+
+	n := 0
+	for _, endpoint := range endpoints {
+		endpointGroup := getAssociatedGroup(&endpoint, groups)
+		if endpointGroup == nil {
+			continue
+		}
+
+		if AuthorizedEndpointAccess(&endpoint, endpointGroup, context.UserID, context.UserMemberships) {
+			endpoint.UserAccessPolicies = nil
+			endpoints[n] = endpoint
+			n++
+		}
+	}
+
+	return endpoints[:n]
+}
+
+// FilterEndpointGroups filters environment(endpoint) groups based on user role and team memberships.
+// Non administrator users only have access to authorized environment(endpoint) groups.
+func FilterEndpointGroups(endpointGroups []portainer.EndpointGroup, context *RestrictedRequestContext) []portainer.EndpointGroup {
+	if context.IsAdmin {
+		return endpointGroups
+	}
+
+	return slicesx.FilterInPlace(endpointGroups, func(group portainer.EndpointGroup) bool {
+		return authorizedEndpointGroupAccess(&group, context.UserID, context.UserMemberships)
+	})
+}
+
+func getAssociatedGroup(endpoint *portainer.Endpoint, groups []portainer.EndpointGroup) *portainer.EndpointGroup {
+	for _, group := range groups {
+		if group.ID == endpoint.GroupID {
+			return &group
+		}
+	}
+
+	return nil
+}
diff --git a/api/http/security/filter_test.go b/api/http/security/filter_test.go
new file mode 100644
index 0000000..7501b83
--- /dev/null
+++ b/api/http/security/filter_test.go
@@ -0,0 +1,36 @@
+package security
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestFilterEndpointsPanic(t *testing.T) {
+	t.Parallel()
+	endpoints := []portainer.Endpoint{{ID: 1}}
+	groups := []portainer.EndpointGroup{}
+	context := &RestrictedRequestContext{}
+
+	FilterEndpoints(endpoints, groups, context)
+}
+
+func TestFilterUserTeams_MembershipOrderDiffersFromTeamOrder(t *testing.T) {
+	t.Parallel()
+
+	teams := []portainer.Team{{ID: 1, Name: "team1"}, {ID: 5, Name: "team5"}, {ID: 26, Name: "team26"}}
+	context := &RestrictedRequestContext{
+		UserID: 22,
+		UserMemberships: []portainer.TeamMembership{
+			{ID: 60, UserID: 22, TeamID: 26},
+			{ID: 1, UserID: 22, TeamID: 1},
+		},
+	}
+
+	filtered := FilterUserTeams(teams, context)
+
+	require.Len(t, filtered, 2)
+	require.ElementsMatch(t, []portainer.TeamID{1, 26}, []portainer.TeamID{filtered[0].ID, filtered[1].ID})
+}
diff --git a/api/http/security/passwordStrengthCheck.go b/api/http/security/passwordStrengthCheck.go
new file mode 100644
index 0000000..d216688
--- /dev/null
+++ b/api/http/security/passwordStrengthCheck.go
@@ -0,0 +1,37 @@
+package security
+
+import (
+	portainer "github.com/portainer/portainer/api"
+
+	"github.com/rs/zerolog/log"
+)
+
+type PasswordStrengthChecker interface {
+	Check(password string) bool
+}
+
+type passwordStrengthChecker struct {
+	settings settingsService
+}
+
+func NewPasswordStrengthChecker(settings settingsService) *passwordStrengthChecker {
+	return &passwordStrengthChecker{
+		settings: settings,
+	}
+}
+
+// Check returns true if the password is strong enough
+func (c *passwordStrengthChecker) Check(password string) bool {
+	s, err := c.settings.Settings()
+	if err != nil {
+		log.Warn().Err(err).Msg("failed to fetch Portainer settings to validate user password")
+
+		return true
+	}
+
+	return len(password) >= s.InternalAuthSettings.RequiredPasswordLength
+}
+
+type settingsService interface {
+	Settings() (*portainer.Settings, error)
+}
diff --git a/api/http/security/passwordStrengthCheck_test.go b/api/http/security/passwordStrengthCheck_test.go
new file mode 100644
index 0000000..53e7356
--- /dev/null
+++ b/api/http/security/passwordStrengthCheck_test.go
@@ -0,0 +1,50 @@
+package security
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+)
+
+func TestStrengthCheck(t *testing.T) {
+	t.Parallel()
+	checker := NewPasswordStrengthChecker(settingsStub{minLength: 12})
+
+	type args struct {
+		password string
+	}
+	tests := []struct {
+		name       string
+		args       args
+		wantStrong bool
+	}{
+		{"Empty password", args{""}, false},
+		{"Short password", args{"portainer"}, false},
+		{"Short password", args{"portaienr!@#"}, true},
+		{"Week password", args{"12345678!@#"}, false},
+		{"Week password", args{"portaienr123"}, true},
+		{"Good password", args{"Portainer123"}, true},
+		{"Good password", args{"Portainer___"}, true},
+		{"Good password", args{"^portainer12"}, true},
+		{"Good password", args{"12%PORTAINER"}, true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if gotStrong := checker.Check(tt.args.password); gotStrong != tt.wantStrong {
+				t.Errorf("StrengthCheck() = %v, want %v", gotStrong, tt.wantStrong)
+			}
+		})
+	}
+}
+
+type settingsStub struct {
+	minLength int
+}
+
+func (s settingsStub) Settings() (*portainer.Settings, error) {
+	return &portainer.Settings{
+		InternalAuthSettings: portainer.InternalAuthSettings{
+			RequiredPasswordLength: s.minLength,
+		},
+	}, nil
+}
diff --git a/api/http/security/rate_limiter.go b/api/http/security/rate_limiter.go
new file mode 100644
index 0000000..5b0e60f
--- /dev/null
+++ b/api/http/security/rate_limiter.go
@@ -0,0 +1,48 @@
+package security
+
+import (
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/portainer/portainer/api/http/errors"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+
+	"github.com/g07cha/defender"
+)
+
+// RateLimiter represents an entity that manages request rate limiting
+type RateLimiter struct {
+	*defender.Defender
+}
+
+// NewRateLimiter initializes a new RateLimiter
+func NewRateLimiter(maxRequests int, duration time.Duration, banDuration time.Duration) *RateLimiter {
+	messages := make(chan struct{})
+	limiter := defender.New(maxRequests, duration, banDuration)
+	go limiter.CleanupTask(messages)
+	return &RateLimiter{
+		limiter,
+	}
+}
+
+// LimitAccess wraps current request with check if remote address does not goes above the defined limits
+func (limiter *RateLimiter) LimitAccess(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		ip := StripAddrPort(r.RemoteAddr)
+		if banned := limiter.Inc(ip); banned {
+			httperror.WriteError(w, http.StatusForbidden, "Access denied", errors.ErrResourceAccessDenied)
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
+// StripAddrPort removes port from IP address
+func StripAddrPort(addr string) string {
+	portIndex := strings.LastIndex(addr, ":")
+	if portIndex != -1 {
+		addr = addr[:portIndex]
+	}
+	return addr
+}
diff --git a/api/http/security/rate_limiter_test.go b/api/http/security/rate_limiter_test.go
new file mode 100644
index 0000000..9a2817f
--- /dev/null
+++ b/api/http/security/rate_limiter_test.go
@@ -0,0 +1,82 @@
+package security
+
+import (
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestLimitAccess(t *testing.T) {
+	t.Parallel()
+	testHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {})
+
+	t.Run("Request below the limit", func(t *testing.T) {
+		req := httptest.NewRequest("GET", "/", nil)
+		rr := httptest.NewRecorder()
+		rateLimiter := NewRateLimiter(10, 1*time.Second, 1*time.Hour)
+		handler := rateLimiter.LimitAccess(testHandler)
+
+		handler.ServeHTTP(rr, req)
+
+		if status := rr.Code; status != http.StatusOK {
+			t.Errorf("handler returned wrong status code: got %v want %v",
+				status, http.StatusOK)
+		}
+	})
+
+	t.Run("Request above the limit", func(t *testing.T) {
+		rateLimiter := NewRateLimiter(1, 1*time.Second, 1*time.Hour)
+		handler := rateLimiter.LimitAccess(testHandler)
+
+		ts := httptest.NewServer(handler)
+		defer ts.Close()
+
+		resp, err := http.Get(ts.URL)
+		if err == nil {
+			err = resp.Body.Close()
+			require.NoError(t, err)
+		}
+
+		resp, err = http.Get(ts.URL)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		_, _ = io.Copy(io.Discard, resp.Body)
+		err = resp.Body.Close()
+		require.NoError(t, err)
+
+		if status := resp.StatusCode; status != http.StatusForbidden {
+			t.Errorf("handler returned wrong status code: got %v want %v",
+				status, http.StatusForbidden)
+		}
+	})
+}
+
+func TestStripAddrPort(t *testing.T) {
+	t.Parallel()
+	t.Run("IP with port", func(t *testing.T) {
+		result := StripAddrPort("127.0.0.1:1000")
+		if result != "127.0.0.1" {
+			t.Errorf("Expected IP with address to be '127.0.0.1', but it was %s instead", result)
+		}
+	})
+
+	t.Run("IP without port", func(t *testing.T) {
+		result := StripAddrPort("127.0.0.1")
+		if result != "127.0.0.1" {
+			t.Errorf("Expected IP with address to be '127.0.0.1', but it was %s instead", result)
+		}
+	})
+
+	t.Run("Local IP", func(t *testing.T) {
+		result := StripAddrPort("[::1]:1000")
+		if result != "[::1]" {
+			t.Errorf("Expected IP with address to be '[::1]', but it was %s instead", result)
+		}
+	})
+}
diff --git a/api/http/security/setuptoken/setuptoken.go b/api/http/security/setuptoken/setuptoken.go
new file mode 100644
index 0000000..ec1af99
--- /dev/null
+++ b/api/http/security/setuptoken/setuptoken.go
@@ -0,0 +1,48 @@
+// Package setuptoken provides a one-time setup token used to protect the
+// public initialization endpoints (admin account creation and backup restore)
+// on an uninitialized Portainer instance.
+package setuptoken
+
+import (
+	"crypto/rand"
+	"crypto/subtle"
+	"encoding/hex"
+	"errors"
+	"net/http"
+
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+)
+
+// HeaderName is the HTTP header that carries the setup token.
+const HeaderName = "X-Setup-Token"
+
+// tokenByteLength is the number of random bytes before hex-encoding (256 bits).
+const tokenByteLength = 32
+
+var errInvalidSetupToken = errors.New("invalid or missing setup token")
+
+// Generate returns a cryptographically random, hex-encoded setup token.
+func Generate() (string, error) {
+	b := make([]byte, tokenByteLength)
+	if _, err := rand.Read(b); err != nil {
+		return "", err
+	}
+
+	return hex.EncodeToString(b), nil
+}
+
+// Validate checks that the request carries the expected setup token in the
+// X-Setup-Token header. When expected is empty the gate is disabled and the
+// request is always allowed. Comparison is constant-time.
+func Validate(r *http.Request, expected string) *httperror.HandlerError {
+	if expected == "" {
+		return nil
+	}
+
+	provided := r.Header.Get(HeaderName)
+	if subtle.ConstantTimeCompare([]byte(provided), []byte(expected)) != 1 {
+		return httperror.Forbidden("Invalid or missing setup token. Provide the X-Setup-Token header with the token printed in the server logs at startup.", errInvalidSetupToken)
+	}
+
+	return nil
+}
diff --git a/api/http/security/setuptoken/setuptoken_test.go b/api/http/security/setuptoken/setuptoken_test.go
new file mode 100644
index 0000000..589fa32
--- /dev/null
+++ b/api/http/security/setuptoken/setuptoken_test.go
@@ -0,0 +1,46 @@
+package setuptoken
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_Generate(t *testing.T) {
+	token, err := Generate()
+	require.NoError(t, err)
+	assert.Len(t, token, 64, "hex-encoded 32 bytes should be 64 characters")
+
+	token2, err := Generate()
+	require.NoError(t, err)
+	assert.NotEqual(t, token, token2, "two generated tokens should differ")
+}
+
+func Test_Validate_alwaysPassesWhenExpectedEmpty(t *testing.T) {
+	r := httptest.NewRequest(http.MethodPost, "/", nil)
+	assert.Nil(t, Validate(r, ""))
+}
+
+func Test_Validate_missingHeader(t *testing.T) {
+	r := httptest.NewRequest(http.MethodPost, "/", nil)
+	herr := Validate(r, "secret")
+	require.NotNil(t, herr)
+	assert.Equal(t, http.StatusForbidden, herr.StatusCode)
+}
+
+func Test_Validate_wrongToken(t *testing.T) {
+	r := httptest.NewRequest(http.MethodPost, "/", nil)
+	r.Header.Set(HeaderName, "wrong")
+	herr := Validate(r, "secret")
+	require.NotNil(t, herr)
+	assert.Equal(t, http.StatusForbidden, herr.StatusCode)
+}
+
+func Test_Validate_correctToken(t *testing.T) {
+	r := httptest.NewRequest(http.MethodPost, "/", nil)
+	r.Header.Set(HeaderName, "secret")
+	assert.Nil(t, Validate(r, "secret"))
+}
diff --git a/api/http/server.go b/api/http/server.go
new file mode 100644
index 0000000..c56d1cd
--- /dev/null
+++ b/api/http/server.go
@@ -0,0 +1,398 @@
+package http
+
+import (
+	"context"
+	"crypto/tls"
+	"net/http"
+	"path/filepath"
+	"time"
+
+	"github.com/pkg/errors"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/adminmonitor"
+	"github.com/portainer/portainer/api/apikey"
+	"github.com/portainer/portainer/api/crypto"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/docker"
+	dockerclient "github.com/portainer/portainer/api/docker/client"
+	"github.com/portainer/portainer/api/http/csrf"
+	"github.com/portainer/portainer/api/http/handler"
+	"github.com/portainer/portainer/api/http/handler/auth"
+	"github.com/portainer/portainer/api/http/handler/backup"
+	"github.com/portainer/portainer/api/http/handler/customtemplates"
+	dockerhandler "github.com/portainer/portainer/api/http/handler/docker"
+	"github.com/portainer/portainer/api/http/handler/edgegroups"
+	"github.com/portainer/portainer/api/http/handler/edgejobs"
+	"github.com/portainer/portainer/api/http/handler/edgestacks"
+	"github.com/portainer/portainer/api/http/handler/endpointedge"
+	"github.com/portainer/portainer/api/http/handler/endpointgroups"
+	"github.com/portainer/portainer/api/http/handler/endpointproxy"
+	"github.com/portainer/portainer/api/http/handler/endpoints"
+	"github.com/portainer/portainer/api/http/handler/file"
+	"github.com/portainer/portainer/api/http/handler/gitops"
+	"github.com/portainer/portainer/api/http/handler/helm"
+	kubehandler "github.com/portainer/portainer/api/http/handler/kubernetes"
+	"github.com/portainer/portainer/api/http/handler/ldap"
+	"github.com/portainer/portainer/api/http/handler/motd"
+	"github.com/portainer/portainer/api/http/handler/registries"
+	"github.com/portainer/portainer/api/http/handler/resourcecontrols"
+	"github.com/portainer/portainer/api/http/handler/roles"
+	"github.com/portainer/portainer/api/http/handler/settings"
+	sslhandler "github.com/portainer/portainer/api/http/handler/ssl"
+	"github.com/portainer/portainer/api/http/handler/stacks"
+	"github.com/portainer/portainer/api/http/handler/storybook"
+	"github.com/portainer/portainer/api/http/handler/system"
+	"github.com/portainer/portainer/api/http/handler/tags"
+	"github.com/portainer/portainer/api/http/handler/teammemberships"
+	"github.com/portainer/portainer/api/http/handler/teams"
+	"github.com/portainer/portainer/api/http/handler/templates"
+	"github.com/portainer/portainer/api/http/handler/upload"
+	"github.com/portainer/portainer/api/http/handler/users"
+	"github.com/portainer/portainer/api/http/handler/webhooks"
+	"github.com/portainer/portainer/api/http/handler/websocket"
+	"github.com/portainer/portainer/api/http/middlewares"
+	"github.com/portainer/portainer/api/http/offlinegate"
+	"github.com/portainer/portainer/api/http/proxy"
+	"github.com/portainer/portainer/api/http/proxy/factory/kubernetes"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/authorization"
+	edgestackservice "github.com/portainer/portainer/api/internal/edge/edgestacks"
+	"github.com/portainer/portainer/api/internal/snapshot"
+	"github.com/portainer/portainer/api/internal/ssl"
+	"github.com/portainer/portainer/api/internal/upgrade"
+	k8s "github.com/portainer/portainer/api/kubernetes"
+	"github.com/portainer/portainer/api/kubernetes/cli"
+	motdservice "github.com/portainer/portainer/api/motd"
+	"github.com/portainer/portainer/api/pendingactions"
+	"github.com/portainer/portainer/api/platform"
+	"github.com/portainer/portainer/api/scheduler"
+	"github.com/portainer/portainer/api/stacks/deployments"
+	libhelmtypes "github.com/portainer/portainer/pkg/libhelm/types"
+
+	"github.com/rs/zerolog/log"
+)
+
+// Server implements the portainer.Server interface
+type Server struct {
+	AuthorizationService        *authorization.Service
+	BindAddress                 string
+	BindAddressHTTPS            string
+	CSP                         bool
+	HTTPEnabled                 bool
+	AssetsPath                  string
+	Status                      *portainer.Status
+	ReverseTunnelService        portainer.ReverseTunnelService
+	ComposeStackManager         portainer.ComposeStackManager
+	CryptoService               portainer.CryptoService
+	EdgeStacksService           *edgestackservice.Service
+	SignatureService            portainer.DigitalSignatureService
+	SnapshotService             portainer.SnapshotService
+	FileService                 portainer.FileService
+	DataStore                   dataservices.DataStore
+	GitService                  portainer.GitService
+	APIKeyService               apikey.APIKeyService
+	JWTService                  portainer.JWTService
+	LDAPService                 portainer.LDAPService
+	OAuthService                portainer.OAuthService
+	SwarmStackManager           portainer.SwarmStackManager
+	ProxyManager                *proxy.Manager
+	KubernetesTokenCacheManager *kubernetes.TokenCacheManager
+	KubeClusterAccessService    k8s.KubeClusterAccessService
+	Handler                     *handler.Handler
+	SSLService                  *ssl.Service
+	DockerClientFactory         *dockerclient.ClientFactory
+	KubernetesClientFactory     *cli.ClientFactory
+	KubernetesDeployer          portainer.KubernetesDeployer
+	HelmPackageManager          libhelmtypes.HelmPackageManager
+	Scheduler                   *scheduler.Scheduler
+	ShutdownTrigger             context.CancelFunc
+	StackDeployer               deployments.StackDeployer
+	UpgradeService              upgrade.Service
+	AdminCreationDone           chan struct{}
+	PendingActionsService       *pendingactions.PendingActionsService
+	PlatformService             platform.Service
+	PullLimitCheckDisabled      bool
+	TrustedOrigins              []string
+	SetupToken                  string
+}
+
+// Start starts the HTTP server
+func (server *Server) Start(ctx context.Context) error {
+	kubernetesTokenCacheManager := server.KubernetesTokenCacheManager
+
+	requestBouncer := security.NewRequestBouncer(ctx, server.DataStore, server.JWTService, server.APIKeyService)
+	if !server.CSP {
+		requestBouncer.DisableCSP()
+	}
+
+	rateLimiter := security.NewRateLimiter(10, 1*time.Second, 1*time.Hour)
+	offlineGate := offlinegate.NewOfflineGate()
+
+	passwordStrengthChecker := security.NewPasswordStrengthChecker(server.DataStore.Settings())
+
+	var authHandler = auth.NewHandler(requestBouncer, rateLimiter, passwordStrengthChecker, server.KubernetesClientFactory)
+	authHandler.DataStore = server.DataStore
+	authHandler.CryptoService = server.CryptoService
+	authHandler.JWTService = server.JWTService
+	authHandler.LDAPService = server.LDAPService
+	authHandler.ProxyManager = server.ProxyManager
+	authHandler.KubernetesTokenCacheManager = kubernetesTokenCacheManager
+	authHandler.OAuthService = server.OAuthService
+
+	adminMonitor := adminmonitor.New(5*time.Minute, server.DataStore)
+	adminMonitor.Start(ctx)
+
+	var backupHandler = backup.NewHandler(
+		requestBouncer,
+		server.DataStore,
+		offlineGate,
+		server.FileService.GetDatastorePath(),
+		server.ShutdownTrigger,
+		adminMonitor,
+	)
+	backupHandler.SetupToken = server.SetupToken
+
+	var roleHandler = roles.NewHandler(requestBouncer)
+	roleHandler.DataStore = server.DataStore
+
+	var customTemplatesHandler = customtemplates.NewHandler(requestBouncer, server.DataStore, server.FileService, server.GitService)
+
+	var edgeGroupsHandler = edgegroups.NewHandler(requestBouncer)
+	edgeGroupsHandler.DataStore = server.DataStore
+	edgeGroupsHandler.ReverseTunnelService = server.ReverseTunnelService
+
+	var edgeJobsHandler = edgejobs.NewHandler(requestBouncer)
+	edgeJobsHandler.DataStore = server.DataStore
+	edgeJobsHandler.FileService = server.FileService
+	edgeJobsHandler.ReverseTunnelService = server.ReverseTunnelService
+
+	var edgeStacksHandler = edgestacks.NewHandler(requestBouncer, server.DataStore, server.EdgeStacksService)
+	edgeStacksHandler.FileService = server.FileService
+	edgeStacksHandler.GitService = server.GitService
+	edgeStacksHandler.KubernetesDeployer = server.KubernetesDeployer
+
+	var endpointHandler = endpoints.NewHandler(requestBouncer)
+	endpointHandler.DataStore = server.DataStore
+	endpointHandler.FileService = server.FileService
+	endpointHandler.ProxyManager = server.ProxyManager
+	endpointHandler.SnapshotService = server.SnapshotService
+	endpointHandler.K8sClientFactory = server.KubernetesClientFactory
+	endpointHandler.DockerClientFactory = server.DockerClientFactory
+	endpointHandler.ReverseTunnelService = server.ReverseTunnelService
+	endpointHandler.ComposeStackManager = server.ComposeStackManager
+	endpointHandler.AuthorizationService = server.AuthorizationService
+	endpointHandler.BindAddress = server.BindAddress
+	endpointHandler.BindAddressHTTPS = server.BindAddressHTTPS
+	endpointHandler.PendingActionsService = server.PendingActionsService
+	endpointHandler.PullLimitCheckDisabled = server.PullLimitCheckDisabled
+
+	var endpointEdgeHandler = endpointedge.NewHandler(requestBouncer, server.DataStore, server.FileService, server.ReverseTunnelService)
+
+	var endpointGroupHandler = endpointgroups.NewHandler(requestBouncer)
+	endpointGroupHandler.AuthorizationService = server.AuthorizationService
+	endpointGroupHandler.DataStore = server.DataStore
+	endpointGroupHandler.PendingActionsService = server.PendingActionsService
+
+	var endpointProxyHandler = endpointproxy.NewHandler(requestBouncer)
+	endpointProxyHandler.DataStore = server.DataStore
+	endpointProxyHandler.ProxyManager = server.ProxyManager
+	endpointProxyHandler.ReverseTunnelService = server.ReverseTunnelService
+
+	var kubernetesHandler = kubehandler.NewHandler(requestBouncer, server.AuthorizationService, server.DataStore, server.JWTService, server.KubeClusterAccessService, server.KubernetesClientFactory, nil)
+
+	containerService := docker.NewContainerService(server.DockerClientFactory, server.DataStore)
+
+	var dockerHandler = dockerhandler.NewHandler(requestBouncer, server.AuthorizationService, server.DataStore, server.DockerClientFactory, containerService)
+
+	var fileHandler = file.NewHandler(filepath.Join(server.AssetsPath, "public"), server.CSP, adminMonitor.WasInstanceDisabled)
+
+	var endpointHelmHandler = helm.NewHandler(requestBouncer, server.DataStore, server.JWTService, server.KubernetesDeployer, server.HelmPackageManager, server.KubeClusterAccessService)
+
+	var gitOperationHandler = gitops.NewHandler(requestBouncer, server.DataStore, server.GitService, server.FileService, server.KubernetesClientFactory)
+
+	var helmTemplatesHandler = helm.NewTemplateHandler(requestBouncer, server.HelmPackageManager)
+
+	var ldapHandler = ldap.NewHandler(requestBouncer)
+	ldapHandler.DataStore = server.DataStore
+	ldapHandler.FileService = server.FileService
+	ldapHandler.LDAPService = server.LDAPService
+
+	motdSvc := motdservice.NewService(portainer.MessageOfTheDayURL)
+	motdSvc.Start(ctx)
+
+	var motdHandler = motd.NewHandler(requestBouncer, motdSvc)
+
+	var registryHandler = registries.NewHandler(requestBouncer)
+	registryHandler.DataStore = server.DataStore
+	registryHandler.FileService = server.FileService
+	registryHandler.ProxyManager = server.ProxyManager
+	registryHandler.K8sClientFactory = server.KubernetesClientFactory
+
+	var resourceControlHandler = resourcecontrols.NewHandler(requestBouncer)
+	resourceControlHandler.DataStore = server.DataStore
+
+	var settingsHandler = settings.NewHandler(requestBouncer)
+	settingsHandler.DataStore = server.DataStore
+	settingsHandler.FileService = server.FileService
+	settingsHandler.JWTService = server.JWTService
+	settingsHandler.LDAPService = server.LDAPService
+	settingsHandler.SnapshotService = server.SnapshotService
+	settingsHandler.SetupTokenRequired = server.SetupToken != ""
+
+	var sslHandler = sslhandler.NewHandler(requestBouncer)
+	sslHandler.SSLService = server.SSLService
+
+	var stackHandler = stacks.NewHandler(requestBouncer)
+	stackHandler.DataStore = server.DataStore
+	stackHandler.DockerClientFactory = server.DockerClientFactory
+	stackHandler.FileService = server.FileService
+	stackHandler.KubernetesClientFactory = server.KubernetesClientFactory
+	stackHandler.KubernetesDeployer = server.KubernetesDeployer
+	stackHandler.GitService = server.GitService
+	stackHandler.Scheduler = server.Scheduler
+	stackHandler.SwarmStackManager = server.SwarmStackManager
+	stackHandler.ComposeStackManager = server.ComposeStackManager
+	stackHandler.StackDeployer = server.StackDeployer
+
+	var storybookHandler = storybook.NewHandler(server.AssetsPath)
+
+	var tagHandler = tags.NewHandler(requestBouncer)
+	tagHandler.DataStore = server.DataStore
+
+	var teamHandler = teams.NewHandler(requestBouncer)
+	teamHandler.DataStore = server.DataStore
+
+	var teamMembershipHandler = teammemberships.NewHandler(requestBouncer)
+	teamMembershipHandler.DataStore = server.DataStore
+	teamMembershipHandler.K8sClientFactory = server.KubernetesClientFactory
+
+	var systemHandler = system.NewHandler(requestBouncer,
+		server.Status,
+		server.DataStore,
+		server.PlatformService,
+		server.UpgradeService)
+
+	var templatesHandler = templates.NewHandler(requestBouncer)
+	templatesHandler.DataStore = server.DataStore
+	templatesHandler.FileService = server.FileService
+	templatesHandler.GitService = server.GitService
+
+	var uploadHandler = upload.NewHandler(requestBouncer)
+	uploadHandler.FileService = server.FileService
+
+	var userHandler = users.NewHandler(requestBouncer, rateLimiter, server.APIKeyService, passwordStrengthChecker)
+	userHandler.DataStore = server.DataStore
+	userHandler.CryptoService = server.CryptoService
+	userHandler.AdminCreationDone = server.AdminCreationDone
+	userHandler.FileService = server.FileService
+	userHandler.SetupToken = server.SetupToken
+
+	var websocketHandler = websocket.NewHandler(server.KubernetesTokenCacheManager, requestBouncer)
+	websocketHandler.DataStore = server.DataStore
+	websocketHandler.SignatureService = server.SignatureService
+	websocketHandler.ReverseTunnelService = server.ReverseTunnelService
+	websocketHandler.KubernetesClientFactory = server.KubernetesClientFactory
+
+	var webhookHandler = webhooks.NewHandler(requestBouncer)
+	webhookHandler.DataStore = server.DataStore
+	webhookHandler.DockerClientFactory = server.DockerClientFactory
+
+	server.Handler = &handler.Handler{
+		RoleHandler:            roleHandler,
+		AuthHandler:            authHandler,
+		BackupHandler:          backupHandler,
+		CustomTemplatesHandler: customTemplatesHandler,
+		DockerHandler:          dockerHandler,
+		EdgeGroupsHandler:      edgeGroupsHandler,
+		EdgeJobsHandler:        edgeJobsHandler,
+		EdgeStacksHandler:      edgeStacksHandler,
+		EndpointGroupHandler:   endpointGroupHandler,
+		EndpointHandler:        endpointHandler,
+		EndpointHelmHandler:    endpointHelmHandler,
+		EndpointEdgeHandler:    endpointEdgeHandler,
+		EndpointProxyHandler:   endpointProxyHandler,
+		GitOperationHandler:    gitOperationHandler,
+		FileHandler:            fileHandler,
+		LDAPHandler:            ldapHandler,
+		HelmTemplatesHandler:   helmTemplatesHandler,
+		KubernetesHandler:      kubernetesHandler,
+		MOTDHandler:            motdHandler,
+		RegistryHandler:        registryHandler,
+		ResourceControlHandler: resourceControlHandler,
+		SettingsHandler:        settingsHandler,
+		SSLHandler:             sslHandler,
+		StackHandler:           stackHandler,
+		StorybookHandler:       storybookHandler,
+		SystemHandler:          systemHandler,
+		TagHandler:             tagHandler,
+		TeamHandler:            teamHandler,
+		TeamMembershipHandler:  teamMembershipHandler,
+		TemplatesHandler:       templatesHandler,
+		UploadHandler:          uploadHandler,
+		UserHandler:            userHandler,
+		WebSocketHandler:       websocketHandler,
+		WebhookHandler:         webhookHandler,
+	}
+
+	errorLogger := NewHTTPLogger()
+
+	handler := adminMonitor.WithRedirect(offlineGate.WaitingMiddleware(time.Minute, server.Handler))
+
+	handler = middlewares.WithPanicLogger(middlewares.WithSlowRequestsLogger(handler))
+
+	handler, err := csrf.WithProtect(handler, server.TrustedOrigins)
+	if err != nil {
+		return errors.Wrap(err, "failed to create CSRF middleware")
+	}
+
+	if server.HTTPEnabled {
+		go func() {
+			log.Info().Str("bind_address", server.BindAddress).Msg("starting HTTP server")
+			httpServer := &http.Server{
+				Addr:     server.BindAddress,
+				Handler:  handler,
+				ErrorLog: errorLogger,
+			}
+
+			go shutdown(ctx, httpServer)
+
+			err := httpServer.ListenAndServe()
+			if err != nil && err != http.ErrServerClosed {
+				log.Error().Err(err).Msg("HTTP server failed to start")
+			}
+		}()
+	}
+
+	log.Info().Str("bind_address", server.BindAddressHTTPS).Msg("starting HTTPS server")
+	httpsServer := &http.Server{
+		Addr:         server.BindAddressHTTPS,
+		Handler:      handler,
+		ErrorLog:     errorLogger,
+		TLSNextProto: make(map[string]func(*http.Server, *tls.Conn, http.Handler)), // Disable HTTP/2
+	}
+
+	httpsServer.TLSConfig = crypto.CreateTLSConfiguration(false)
+	httpsServer.TLSConfig.GetCertificate = func(*tls.ClientHelloInfo) (*tls.Certificate, error) {
+		return server.SSLService.GetRawCertificate(), nil
+	}
+
+	go shutdown(ctx, httpsServer)
+	go snapshot.NewBackgroundSnapshotter(server.DataStore, server.ReverseTunnelService)
+
+	return httpsServer.ListenAndServeTLS("", "")
+}
+
+func shutdown(shutdownCtx context.Context, httpServer *http.Server) {
+	<-shutdownCtx.Done()
+
+	log.Debug().Msg("shutting down the HTTP server")
+	shutdownTimeout, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	err := httpServer.Shutdown(shutdownTimeout)
+	if err != nil {
+		log.Error().
+			Err(err).
+			Msg("failed to shut down the HTTP server")
+	}
+}
diff --git a/api/http/utils/filters/filters.go b/api/http/utils/filters/filters.go
new file mode 100644
index 0000000..2e22d19
--- /dev/null
+++ b/api/http/utils/filters/filters.go
@@ -0,0 +1,38 @@
+package filters
+
+import (
+	"net/http"
+	"strconv"
+)
+
+type FilterResult[T any] struct {
+	Items          []T
+	TotalCount     int
+	TotalAvailable int
+}
+
+type Config[T any] struct {
+	SearchAccessors []SearchAccessor[T]
+	SortBindings    []SortBinding[T]
+}
+
+func SearchOrderAndPaginate[T any](items []T, params QueryParams, searchConfig Config[T]) FilterResult[T] {
+	totalAvailable := len(items)
+
+	items = searchFn(items, params.SearchQueryParams, searchConfig.SearchAccessors)
+	items = sortFn(items, params.SortQueryParams, searchConfig.SortBindings)
+
+	totalCount := len(items)
+	items = paginateFn(items, params.PaginationQueryParams)
+
+	return FilterResult[T]{
+		Items:          items,
+		TotalCount:     totalCount,
+		TotalAvailable: totalAvailable,
+	}
+}
+
+func ApplyFilterResultsHeaders[T any](w *http.ResponseWriter, result FilterResult[T]) {
+	(*w).Header().Set("X-Total-Count", strconv.Itoa(result.TotalCount))
+	(*w).Header().Set("X-Total-Available", strconv.Itoa(result.TotalAvailable))
+}
diff --git a/api/http/utils/filters/filters_test.go b/api/http/utils/filters/filters_test.go
new file mode 100644
index 0000000..5f74582
--- /dev/null
+++ b/api/http/utils/filters/filters_test.go
@@ -0,0 +1,468 @@
+package filters
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// Helper functions for creating test data
+func createUsers() []User {
+	return []User{
+		{ID: 1, Name: "Alice Johnson", Email: "alice@example.com", Age: 25},
+		{ID: 2, Name: "Bob Smith", Email: "bob@example.com", Age: 30},
+		{ID: 3, Name: "Charlie Brown", Email: "charlie@example.com", Age: 35},
+		{ID: 4, Name: "Diana Prince", Email: "diana@example.com", Age: 28},
+		{ID: 5, Name: "Eve Adams", Email: "eve@example.com", Age: 22},
+	}
+}
+
+func createProducts() []Product {
+	return []Product{
+		{ID: 1, Name: "Laptop", Description: "High-performance laptop", Price: 999, Category: "Electronics"},
+		{ID: 2, Name: "Mouse", Description: "Wireless mouse", Price: 29, Category: "Electronics"},
+		{ID: 3, Name: "Book", Description: "Programming book", Price: 49, Category: "Books"},
+		{ID: 4, Name: "Keyboard", Description: "Mechanical keyboard", Price: 129, Category: "Electronics"},
+		{ID: 5, Name: "Chair", Description: "Office chair", Price: 199, Category: "Furniture"},
+	}
+}
+
+// Sort functions
+func userNameSort(a, b User) int {
+	return strings.Compare(a.Name, b.Name)
+}
+
+func userAgeSort(a, b User) int {
+	return a.Age - b.Age
+}
+
+func productPriceSort(a, b Product) int {
+	if a.Price < b.Price {
+		return -1
+	}
+	if a.Price > b.Price {
+		return 1
+	}
+	return 0
+}
+
+func productNameSort(a, b Product) int {
+	return strings.Compare(a.Name, b.Name)
+}
+
+func TestSearchOrderAndPaginate(t *testing.T) {
+	t.Parallel()
+	users := createUsers()
+	products := createProducts()
+
+	userConfig := Config[User]{
+		SearchAccessors: []SearchAccessor[User]{userNameAccessor, userEmailAccessor},
+		SortBindings: []SortBinding[User]{
+			{Key: "name", Fn: userNameSort},
+			{Key: "age", Fn: userAgeSort},
+		},
+	}
+
+	productConfig := Config[Product]{
+		SearchAccessors: []SearchAccessor[Product]{productNameAccessor, productDescriptionAccessor, productCategoryAccessor},
+		SortBindings: []SortBinding[Product]{
+			{Key: "price", Fn: productPriceSort},
+			{Key: "name", Fn: productNameSort},
+		},
+	}
+
+	t.Run("no filters applied", func(t *testing.T) {
+		params := QueryParams{
+			SearchQueryParams:     SearchQueryParams{search: ""},
+			SortQueryParams:       SortQueryParams{sort: "", order: ""},
+			PaginationQueryParams: PaginationQueryParams{start: 0, limit: 0},
+		}
+
+		result := SearchOrderAndPaginate(users, params, userConfig)
+
+		require.Len(t, result.Items, 5, "Should return all items when no filters applied")
+		require.Equal(t, 5, result.TotalCount, "TotalCount should equal filtered items")
+		require.Equal(t, 5, result.TotalAvailable, "TotalAvailable should equal original items")
+		require.Equal(t, users, result.Items, "Items should be unchanged")
+	})
+
+	t.Run("search only", func(t *testing.T) {
+		params := QueryParams{
+			SearchQueryParams:     SearchQueryParams{search: "alice"},
+			SortQueryParams:       SortQueryParams{sort: "", order: ""},
+			PaginationQueryParams: PaginationQueryParams{start: 0, limit: 0},
+		}
+
+		result := SearchOrderAndPaginate(users, params, userConfig)
+
+		require.Len(t, result.Items, 1, "Should find one user matching 'alice'")
+		require.Equal(t, 1, result.TotalCount, "TotalCount should reflect filtered items")
+		require.Equal(t, 5, result.TotalAvailable, "TotalAvailable should be original count")
+		require.Equal(t, "Alice Johnson", result.Items[0].Name, "Should return Alice")
+	})
+
+	t.Run("search case insensitive", func(t *testing.T) {
+		params := QueryParams{
+			SearchQueryParams:     SearchQueryParams{search: "ALICE"},
+			SortQueryParams:       SortQueryParams{sort: "", order: ""},
+			PaginationQueryParams: PaginationQueryParams{start: 0, limit: 0},
+		}
+
+		result := SearchOrderAndPaginate(users, params, userConfig)
+
+		require.Len(t, result.Items, 1, "Search should be case insensitive")
+		require.Equal(t, "Alice Johnson", result.Items[0].Name, "Should return Alice")
+	})
+
+	t.Run("search by email", func(t *testing.T) {
+		params := QueryParams{
+			SearchQueryParams:     SearchQueryParams{search: "bob@example"},
+			SortQueryParams:       SortQueryParams{sort: "", order: ""},
+			PaginationQueryParams: PaginationQueryParams{start: 0, limit: 0},
+		}
+
+		result := SearchOrderAndPaginate(users, params, userConfig)
+
+		require.Len(t, result.Items, 1, "Should find user by email")
+		require.Equal(t, "Bob Smith", result.Items[0].Name, "Should return Bob")
+	})
+
+	t.Run("search no matches", func(t *testing.T) {
+		params := QueryParams{
+			SearchQueryParams:     SearchQueryParams{search: "nonexistent"},
+			SortQueryParams:       SortQueryParams{sort: "", order: ""},
+			PaginationQueryParams: PaginationQueryParams{start: 0, limit: 0},
+		}
+
+		result := SearchOrderAndPaginate(users, params, userConfig)
+
+		require.Empty(t, result.Items, "Should return empty when no matches")
+		require.Equal(t, 0, result.TotalCount, "TotalCount should be 0")
+		require.Equal(t, 5, result.TotalAvailable, "TotalAvailable should remain original count")
+	})
+
+	t.Run("search with whitespace", func(t *testing.T) {
+		params := QueryParams{
+			SearchQueryParams:     SearchQueryParams{search: "  alice  "},
+			SortQueryParams:       SortQueryParams{sort: "", order: ""},
+			PaginationQueryParams: PaginationQueryParams{start: 0, limit: 0},
+		}
+
+		result := SearchOrderAndPaginate(users, params, userConfig)
+
+		require.Len(t, result.Items, 1, "Should trim whitespace from search")
+		require.Equal(t, "Alice Johnson", result.Items[0].Name, "Should return Alice")
+	})
+
+	t.Run("sort ascending", func(t *testing.T) {
+		params := QueryParams{
+			SearchQueryParams:     SearchQueryParams{search: ""},
+			SortQueryParams:       SortQueryParams{sort: "name", order: SortAsc},
+			PaginationQueryParams: PaginationQueryParams{start: 0, limit: 0},
+		}
+
+		result := SearchOrderAndPaginate(users, params, userConfig)
+
+		require.Len(t, result.Items, 5, "Should return all items")
+		require.Equal(t, "Alice Johnson", result.Items[0].Name, "First should be Alice")
+		require.Equal(t, "Eve Adams", result.Items[4].Name, "Last should be Eve")
+	})
+
+	t.Run("sort descending", func(t *testing.T) {
+		params := QueryParams{
+			SearchQueryParams:     SearchQueryParams{search: ""},
+			SortQueryParams:       SortQueryParams{sort: "name", order: SortDesc},
+			PaginationQueryParams: PaginationQueryParams{start: 0, limit: 0},
+		}
+
+		result := SearchOrderAndPaginate(users, params, userConfig)
+
+		require.Len(t, result.Items, 5, "Should return all items")
+		require.Equal(t, "Eve Adams", result.Items[0].Name, "First should be Eve (desc order)")
+		require.Equal(t, "Alice Johnson", result.Items[4].Name, "Last should be Alice (desc order)")
+	})
+
+	t.Run("sort by age", func(t *testing.T) {
+		params := QueryParams{
+			SearchQueryParams:     SearchQueryParams{search: ""},
+			SortQueryParams:       SortQueryParams{sort: "age", order: SortAsc},
+			PaginationQueryParams: PaginationQueryParams{start: 0, limit: 0},
+		}
+
+		result := SearchOrderAndPaginate(users, params, userConfig)
+
+		require.Len(t, result.Items, 5, "Should return all items")
+		require.Equal(t, 22, result.Items[0].Age, "First should be youngest (22)")
+		require.Equal(t, 35, result.Items[4].Age, "Last should be oldest (35)")
+	})
+
+	t.Run("sort invalid key", func(t *testing.T) {
+		params := QueryParams{
+			SearchQueryParams:     SearchQueryParams{search: ""},
+			SortQueryParams:       SortQueryParams{sort: "invalid", order: SortAsc},
+			PaginationQueryParams: PaginationQueryParams{start: 0, limit: 0},
+		}
+
+		result := SearchOrderAndPaginate(users, params, userConfig)
+
+		require.Len(t, result.Items, 5, "Should return all items")
+		// Items should remain in original order since no valid sort key
+		require.Equal(t, users, result.Items, "Should maintain original order with invalid sort key")
+	})
+
+	t.Run("pagination basic", func(t *testing.T) {
+		params := QueryParams{
+			SearchQueryParams:     SearchQueryParams{search: ""},
+			SortQueryParams:       SortQueryParams{sort: "", order: ""},
+			PaginationQueryParams: PaginationQueryParams{start: 1, limit: 2},
+		}
+
+		result := SearchOrderAndPaginate(users, params, userConfig)
+
+		require.Len(t, result.Items, 2, "Should return 2 items")
+		require.Equal(t, 5, result.TotalCount, "TotalCount should be all items")
+		require.Equal(t, 5, result.TotalAvailable, "TotalAvailable should be original count")
+		require.Equal(t, users[1], result.Items[0], "Should start from index 1")
+		require.Equal(t, users[2], result.Items[1], "Should include index 2")
+	})
+
+	t.Run("pagination zero limit", func(t *testing.T) {
+		params := QueryParams{
+			SearchQueryParams:     SearchQueryParams{search: ""},
+			SortQueryParams:       SortQueryParams{sort: "", order: ""},
+			PaginationQueryParams: PaginationQueryParams{start: 1, limit: 0},
+		}
+
+		result := SearchOrderAndPaginate(users, params, userConfig)
+
+		require.Len(t, result.Items, 5, "Should return all items when limit is 0")
+		require.Equal(t, users, result.Items, "Should return all original items")
+	})
+
+	t.Run("pagination negative limit", func(t *testing.T) {
+		params := QueryParams{
+			SearchQueryParams:     SearchQueryParams{search: ""},
+			SortQueryParams:       SortQueryParams{sort: "", order: ""},
+			PaginationQueryParams: PaginationQueryParams{start: 1, limit: -1},
+		}
+
+		result := SearchOrderAndPaginate(users, params, userConfig)
+
+		require.Len(t, result.Items, 5, "Should return all items when limit is negative")
+	})
+
+	t.Run("pagination start beyond length", func(t *testing.T) {
+		params := QueryParams{
+			SearchQueryParams:     SearchQueryParams{search: ""},
+			SortQueryParams:       SortQueryParams{sort: "", order: ""},
+			PaginationQueryParams: PaginationQueryParams{start: 10, limit: 2},
+		}
+
+		result := SearchOrderAndPaginate(users, params, userConfig)
+
+		require.Empty(t, result.Items, "Should return empty slice when start is beyond length")
+		require.Equal(t, 5, result.TotalCount, "TotalCount should still be original count")
+	})
+
+	t.Run("pagination negative start", func(t *testing.T) {
+		params := QueryParams{
+			SearchQueryParams:     SearchQueryParams{search: ""},
+			SortQueryParams:       SortQueryParams{sort: "", order: ""},
+			PaginationQueryParams: PaginationQueryParams{start: -1, limit: 2},
+		}
+
+		result := SearchOrderAndPaginate(users, params, userConfig)
+
+		require.Len(t, result.Items, 2, "Should return 2 items starting from 0")
+		require.Equal(t, users[0], result.Items[0], "Should start from index 0")
+		require.Equal(t, users[1], result.Items[1], "Should include index 1")
+	})
+
+	t.Run("combined search sort and pagination", func(t *testing.T) {
+		params := QueryParams{
+			SearchQueryParams:     SearchQueryParams{search: "example.com"},
+			SortQueryParams:       SortQueryParams{sort: "age", order: SortAsc},
+			PaginationQueryParams: PaginationQueryParams{start: 1, limit: 2},
+		}
+
+		result := SearchOrderAndPaginate(users, params, userConfig)
+
+		// All users have "example.com" in email, so all 5 should match search
+		// Then sorted by age: Eve(22), Alice(25), Diana(28), Bob(30), Charlie(35)
+		// Then paginated: start=1, limit=2 should give Alice(25), Diana(28)
+		require.Len(t, result.Items, 2, "Should return 2 items after pagination")
+		require.Equal(t, 5, result.TotalCount, "TotalCount should be all filtered items")
+		require.Equal(t, 5, result.TotalAvailable, "TotalAvailable should be original count")
+		require.Equal(t, 25, result.Items[0].Age, "First item should be Alice (age 25)")
+		require.Equal(t, 28, result.Items[1].Age, "Second item should be Diana (age 28)")
+	})
+
+	t.Run("products test", func(t *testing.T) {
+		params := QueryParams{
+			SearchQueryParams:     SearchQueryParams{search: "electronics"},
+			SortQueryParams:       SortQueryParams{sort: "price", order: SortAsc},
+			PaginationQueryParams: PaginationQueryParams{start: 0, limit: 2},
+		}
+
+		result := SearchOrderAndPaginate(products, params, productConfig)
+
+		// Should find 3 electronics, sorted by price: Mouse(29.99), Keyboard(129.99), Laptop(999.99)
+		// Paginated to first 2: Mouse, Keyboard
+		require.Len(t, result.Items, 2, "Should return 2 items")
+		require.Equal(t, 3, result.TotalCount, "Should find 3 electronics items")
+		require.Equal(t, 5, result.TotalAvailable, "Should have 5 total products")
+		require.Equal(t, "Mouse", result.Items[0].Name, "First should be Mouse (cheapest)")
+		require.Equal(t, "Keyboard", result.Items[1].Name, "Second should be Keyboard")
+	})
+
+	t.Run("empty input slice", func(t *testing.T) {
+		emptyUsers := []User{}
+		params := QueryParams{
+			SearchQueryParams:     SearchQueryParams{search: "test"},
+			SortQueryParams:       SortQueryParams{sort: "name", order: SortAsc},
+			PaginationQueryParams: PaginationQueryParams{start: 0, limit: 10},
+		}
+
+		result := SearchOrderAndPaginate(emptyUsers, params, userConfig)
+
+		require.Empty(t, result.Items, "Should return empty slice")
+		require.Equal(t, 0, result.TotalCount, "TotalCount should be 0")
+		require.Equal(t, 0, result.TotalAvailable, "TotalAvailable should be 0")
+	})
+}
+
+func TestSearchOrderAndPaginateWithErrors(t *testing.T) {
+	t.Parallel()
+	users := createUsers()
+
+	// Config with error-prone accessor
+	errorConfig := Config[User]{
+		SearchAccessors: []SearchAccessor[User]{errorAccessor[User], userNameAccessor},
+		SortBindings: []SortBinding[User]{
+			{Key: "name", Fn: userNameSort},
+		},
+	}
+
+	t.Run("search with accessor errors", func(t *testing.T) {
+		params := QueryParams{
+			SearchQueryParams:     SearchQueryParams{search: "alice"},
+			SortQueryParams:       SortQueryParams{sort: "", order: ""},
+			PaginationQueryParams: PaginationQueryParams{start: 0, limit: 0},
+		}
+
+		result := SearchOrderAndPaginate(users, params, errorConfig)
+
+		// Should still find Alice through the working accessor
+		require.Len(t, result.Items, 1, "Should find user despite error in first accessor")
+		require.Equal(t, "Alice Johnson", result.Items[0].Name, "Should return Alice")
+	})
+}
+
+func TestApplyFilterResultsHeaders(t *testing.T) {
+	t.Parallel()
+	t.Run("sets headers correctly", func(t *testing.T) {
+		w := httptest.NewRecorder()
+		var responseWriter http.ResponseWriter = w
+		result := FilterResult[User]{
+			Items:          createUsers()[:3],
+			TotalCount:     10,
+			TotalAvailable: 25,
+		}
+
+		ApplyFilterResultsHeaders(&responseWriter, result)
+
+		require.Equal(t, "10", w.Header().Get("X-Total-Count"), "Should set X-Total-Count header")
+		require.Equal(t, "25", w.Header().Get("X-Total-Available"), "Should set X-Total-Available header")
+	})
+
+	t.Run("sets headers with zero values", func(t *testing.T) {
+		w := httptest.NewRecorder()
+		var responseWriter http.ResponseWriter = w
+		result := FilterResult[User]{
+			Items:          []User{},
+			TotalCount:     0,
+			TotalAvailable: 0,
+		}
+
+		ApplyFilterResultsHeaders(&responseWriter, result)
+
+		require.Equal(t, "0", w.Header().Get("X-Total-Count"), "Should set X-Total-Count to 0")
+		require.Equal(t, "0", w.Header().Get("X-Total-Available"), "Should set X-Total-Available to 0")
+	})
+
+	t.Run("overwrites existing headers", func(t *testing.T) {
+		w := httptest.NewRecorder()
+		var responseWriter http.ResponseWriter = w
+		w.Header().Set("X-Total-Count", "999")
+		w.Header().Set("X-Total-Available", "999")
+
+		result := FilterResult[User]{
+			Items:          createUsers()[:2],
+			TotalCount:     5,
+			TotalAvailable: 15,
+		}
+
+		ApplyFilterResultsHeaders(&responseWriter, result)
+
+		require.Equal(t, "5", w.Header().Get("X-Total-Count"), "Should overwrite existing X-Total-Count")
+		require.Equal(t, "15", w.Header().Get("X-Total-Available"), "Should overwrite existing X-Total-Available")
+	})
+
+	t.Run("simulates real handler usage", func(t *testing.T) {
+		// Simulate how it's actually used in handlers
+		handler := func(w http.ResponseWriter, r *http.Request) {
+			result := FilterResult[Product]{
+				Items:          createProducts(),
+				TotalCount:     5,
+				TotalAvailable: 10,
+			}
+			ApplyFilterResultsHeaders(&w, result)
+		}
+
+		w := httptest.NewRecorder()
+		req := httptest.NewRequest("GET", "/test", nil)
+
+		handler(w, req)
+
+		require.Equal(t, "5", w.Header().Get("X-Total-Count"), "Should work in handler context")
+		require.Equal(t, "10", w.Header().Get("X-Total-Available"), "Should work in handler context")
+	})
+}
+
+// Benchmark tests
+func BenchmarkSearchOrderAndPaginate(b *testing.B) {
+	users := createUsers()
+	config := Config[User]{
+		SearchAccessors: []SearchAccessor[User]{userNameAccessor, userEmailAccessor},
+		SortBindings: []SortBinding[User]{
+			{Key: "name", Fn: userNameSort},
+			{Key: "age", Fn: userAgeSort},
+		},
+	}
+	params := QueryParams{
+		SearchQueryParams:     SearchQueryParams{search: "example"},
+		SortQueryParams:       SortQueryParams{sort: "name", order: SortAsc},
+		PaginationQueryParams: PaginationQueryParams{start: 0, limit: 10},
+	}
+
+	for b.Loop() {
+		SearchOrderAndPaginate(users, params, config)
+	}
+}
+
+func BenchmarkApplyFilterResultsHeaders(b *testing.B) {
+	w := httptest.NewRecorder()
+	var responseWriter http.ResponseWriter = w
+	result := FilterResult[User]{
+		Items:          createUsers(),
+		TotalCount:     100,
+		TotalAvailable: 500,
+	}
+
+	for b.Loop() {
+		ApplyFilterResultsHeaders(&responseWriter, result)
+	}
+}
diff --git a/api/http/utils/filters/pagination.go b/api/http/utils/filters/pagination.go
new file mode 100644
index 0000000..fd01eb8
--- /dev/null
+++ b/api/http/utils/filters/pagination.go
@@ -0,0 +1,22 @@
+package filters
+
+type PaginationQueryParams struct {
+	start int
+	limit int
+}
+
+func paginateFn[T any](items []T, params PaginationQueryParams) []T {
+	if params.limit <= 0 {
+		return items
+	}
+
+	itemsCount := len(items)
+
+	// enforce start in [0, len(items)]
+	start := min(max(params.start, 0), itemsCount)
+
+	// enforce end <= len(items) (max is unnecessary since limit > 0 and start >= 0)
+	end := min(start+params.limit, itemsCount)
+
+	return items[start:end]
+}
diff --git a/api/http/utils/filters/pagination_test.go b/api/http/utils/filters/pagination_test.go
new file mode 100644
index 0000000..e8cb2e7
--- /dev/null
+++ b/api/http/utils/filters/pagination_test.go
@@ -0,0 +1,261 @@
+package filters
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestPaginateFn_BasicPagination(t *testing.T) {
+	t.Parallel()
+	items := []int{1, 2, 3, 4, 5, 6, 7, 8, 9, 10}
+
+	// First page
+	params := PaginationQueryParams{start: 0, limit: 3}
+	result := paginateFn(items, params)
+	require.Equal(t, []int{1, 2, 3}, result)
+
+	// Second page
+	params = PaginationQueryParams{start: 3, limit: 3}
+	result = paginateFn(items, params)
+	require.Equal(t, []int{4, 5, 6}, result)
+
+	// Third page
+	params = PaginationQueryParams{start: 6, limit: 3}
+	result = paginateFn(items, params)
+	require.Equal(t, []int{7, 8, 9}, result)
+
+	// Last partial page
+	params = PaginationQueryParams{start: 9, limit: 3}
+	result = paginateFn(items, params)
+	require.Equal(t, []int{10}, result)
+}
+
+func TestPaginateFn_ZeroLimit(t *testing.T) {
+	t.Parallel()
+	items := []int{1, 2, 3, 4, 5}
+
+	params := PaginationQueryParams{start: 2, limit: 0}
+	result := paginateFn(items, params)
+
+	// Should return all items when limit is 0
+	require.Equal(t, items, result)
+}
+
+func TestPaginateFn_NegativeLimit(t *testing.T) {
+	t.Parallel()
+	items := []int{1, 2, 3, 4, 5}
+
+	params := PaginationQueryParams{start: 2, limit: -5}
+	result := paginateFn(items, params)
+
+	// Should return all items when limit is negative
+	require.Equal(t, items, result)
+}
+
+func TestPaginateFn_NegativeStart(t *testing.T) {
+	t.Parallel()
+	items := []int{1, 2, 3, 4, 5}
+
+	params := PaginationQueryParams{start: -3, limit: 2}
+	result := paginateFn(items, params)
+
+	// Should start from index 0 when start is negative
+	require.Equal(t, []int{1, 2}, result)
+}
+
+func TestPaginateFn_StartBeyondLength(t *testing.T) {
+	t.Parallel()
+	items := []int{1, 2, 3, 4, 5}
+
+	params := PaginationQueryParams{start: 10, limit: 3}
+	result := paginateFn(items, params)
+
+	// Should return empty slice when start is beyond length
+	require.Empty(t, result)
+}
+
+func TestPaginateFn_StartAtLength(t *testing.T) {
+	t.Parallel()
+	items := []int{1, 2, 3, 4, 5}
+
+	params := PaginationQueryParams{start: 5, limit: 3}
+	result := paginateFn(items, params)
+
+	// Should return empty slice when start equals length
+	require.Empty(t, result)
+}
+
+func TestPaginateFn_LimitLargerThanRemaining(t *testing.T) {
+	t.Parallel()
+	items := []int{1, 2, 3, 4, 5}
+
+	params := PaginationQueryParams{start: 3, limit: 10}
+	result := paginateFn(items, params)
+
+	// Should return remaining items when limit exceeds available items
+	require.Equal(t, []int{4, 5}, result)
+}
+
+func TestPaginateFn_EmptySlice(t *testing.T) {
+	t.Parallel()
+	items := []int{}
+
+	params := PaginationQueryParams{start: 0, limit: 5}
+	result := paginateFn(items, params)
+
+	// Should return empty slice
+	require.Empty(t, result)
+}
+
+func TestPaginateFn_EmptySliceWithNegativeStart(t *testing.T) {
+	t.Parallel()
+	items := []int{}
+
+	params := PaginationQueryParams{start: -5, limit: 3}
+	result := paginateFn(items, params)
+
+	// Should return empty slice
+	require.Empty(t, result)
+}
+
+func TestPaginateFn_SingleElement(t *testing.T) {
+	t.Parallel()
+	items := []int{42}
+
+	// Take the single element
+	params := PaginationQueryParams{start: 0, limit: 1}
+	result := paginateFn(items, params)
+	require.Equal(t, []int{42}, result)
+
+	// Start beyond the single element
+	params = PaginationQueryParams{start: 1, limit: 1}
+	result = paginateFn(items, params)
+	require.Empty(t, result)
+}
+
+func TestPaginateFn_LimitOfOne(t *testing.T) {
+	t.Parallel()
+	items := []int{1, 2, 3, 4, 5}
+
+	results := [][]int{}
+	for i := range items {
+		params := PaginationQueryParams{start: i, limit: 1}
+		result := paginateFn(items, params)
+		results = append(results, result)
+	}
+
+	expected := [][]int{
+		{1}, {2}, {3}, {4}, {5},
+	}
+	require.Equal(t, expected, results)
+}
+
+func TestPaginateFn_StringSlice(t *testing.T) {
+	t.Parallel()
+	items := []string{"apple", "banana", "cherry", "date", "elderberry"}
+
+	params := PaginationQueryParams{start: 1, limit: 3}
+	result := paginateFn(items, params)
+
+	require.Equal(t, []string{"banana", "cherry", "date"}, result)
+}
+
+func TestPaginateFn_StructSlice(t *testing.T) {
+	t.Parallel()
+	type User struct {
+		ID   int
+		Name string
+	}
+
+	users := []User{
+		{ID: 1, Name: "Alice"},
+		{ID: 2, Name: "Bob"},
+		{ID: 3, Name: "Charlie"},
+		{ID: 4, Name: "David"},
+	}
+
+	params := PaginationQueryParams{start: 1, limit: 2}
+	result := paginateFn(users, params)
+
+	expected := []User{
+		{ID: 2, Name: "Bob"},
+		{ID: 3, Name: "Charlie"},
+	}
+	require.Equal(t, expected, result)
+}
+
+func TestPaginateFn_BoundaryConditions(t *testing.T) {
+	t.Parallel()
+	items := []int{1, 2, 3, 4, 5}
+
+	testCases := []struct {
+		name     string
+		start    int
+		limit    int
+		expected []int
+	}{
+		{"start=0, limit=0", 0, 0, []int{1, 2, 3, 4, 5}},
+		{"start=0, limit=5", 0, 5, []int{1, 2, 3, 4, 5}},
+		{"start=0, limit=6", 0, 6, []int{1, 2, 3, 4, 5}},
+		{"start=4, limit=1", 4, 1, []int{5}},
+		{"start=4, limit=2", 4, 2, []int{5}},
+		{"start=5, limit=1", 5, 1, []int{}},
+		{"start=-1, limit=1", -1, 1, []int{1}},
+		{"start=-10, limit=3", -10, 3, []int{1, 2, 3}},
+		{"start=100, limit=1", 100, 1, []int{}},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			params := PaginationQueryParams{start: tc.start, limit: tc.limit}
+			result := paginateFn(items, params)
+			require.Equal(t, tc.expected, result)
+		})
+	}
+}
+
+func TestPaginateFn_ReturnsSliceView(t *testing.T) {
+	t.Parallel()
+	items := []int{1, 2, 3, 4, 5}
+
+	params := PaginationQueryParams{start: 1, limit: 3}
+	result := paginateFn(items, params)
+
+	// Result should be a slice view of the original
+	require.Equal(t, []int{2, 3, 4}, result)
+
+	// Modifying result WILL affect the original slice (shares underlying array)
+	if len(result) > 0 {
+		result[0] = 999
+		require.Equal(t, 999, items[1]) // Original is modified because they share memory
+	}
+}
+
+func TestPaginateFn_TypicalAPIUseCases(t *testing.T) {
+	t.Parallel()
+	// Simulate API responses with different page sizes
+	items := make([]int, 100)
+	for i := range items {
+		items[i] = i + 1
+	}
+
+	// Page size 10
+	params := PaginationQueryParams{start: 0, limit: 10}
+	page1 := paginateFn(items, params)
+	require.Len(t, page1, 10)
+	require.Equal(t, []int{1, 2, 3, 4, 5, 6, 7, 8, 9, 10}, page1)
+
+	// Page size 20, offset 20
+	params = PaginationQueryParams{start: 20, limit: 20}
+	page2 := paginateFn(items, params)
+	require.Len(t, page2, 20)
+	require.Equal(t, 21, page2[0])
+	require.Equal(t, 40, page2[19])
+
+	// Last page (partial)
+	params = PaginationQueryParams{start: 95, limit: 10}
+	lastPage := paginateFn(items, params)
+	require.Len(t, lastPage, 5)
+	require.Equal(t, []int{96, 97, 98, 99, 100}, lastPage)
+}
diff --git a/api/http/utils/filters/query_params.go b/api/http/utils/filters/query_params.go
new file mode 100644
index 0000000..7dec803
--- /dev/null
+++ b/api/http/utils/filters/query_params.go
@@ -0,0 +1,38 @@
+package filters
+
+import (
+	"net/http"
+
+	"github.com/portainer/portainer/pkg/libhttp/request"
+)
+
+type QueryParams struct {
+	SearchQueryParams
+	SortQueryParams
+	PaginationQueryParams
+}
+
+func ExtractListModifiersQueryParams(r *http.Request) QueryParams {
+	// search
+	search, _ := request.RetrieveQueryParameter(r, "search", true)
+	// sorting
+	sortField, _ := request.RetrieveQueryParameter(r, "sort", true)
+	sortOrder, _ := request.RetrieveQueryParameter(r, "order", true)
+	// pagination
+	start, _ := request.RetrieveNumericQueryParameter(r, "start", true)
+	limit, _ := request.RetrieveNumericQueryParameter(r, "limit", true)
+
+	return QueryParams{
+		SearchQueryParams{
+			search: search,
+		},
+		SortQueryParams{
+			sort:  sortField,
+			order: SortOrder(sortOrder),
+		},
+		PaginationQueryParams{
+			start: start,
+			limit: limit,
+		},
+	}
+}
diff --git a/api/http/utils/filters/query_params_test.go b/api/http/utils/filters/query_params_test.go
new file mode 100644
index 0000000..c152862
--- /dev/null
+++ b/api/http/utils/filters/query_params_test.go
@@ -0,0 +1,300 @@
+package filters
+
+import (
+	"net/http"
+	"net/url"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestExtractListModifiersQueryParams(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name           string
+		queryParams    map[string]string
+		expectedResult QueryParams
+		description    string
+	}{
+		{
+			name: "all parameters provided",
+			queryParams: map[string]string{
+				"search": "test query",
+				"sort":   "name",
+				"order":  "asc",
+				"start":  "10",
+				"limit":  "25",
+			},
+			expectedResult: QueryParams{
+				SearchQueryParams: SearchQueryParams{
+					search: "test query",
+				},
+				SortQueryParams: SortQueryParams{
+					sort:  "name",
+					order: SortAsc,
+				},
+				PaginationQueryParams: PaginationQueryParams{
+					start: 10,
+					limit: 25,
+				},
+			},
+			description: "Should correctly parse all query parameters when provided",
+		},
+		{
+			name: "descending sort order",
+			queryParams: map[string]string{
+				"search": "another test",
+				"sort":   "date",
+				"order":  "desc",
+				"start":  "0",
+				"limit":  "50",
+			},
+			expectedResult: QueryParams{
+				SearchQueryParams: SearchQueryParams{
+					search: "another test",
+				},
+				SortQueryParams: SortQueryParams{
+					sort:  "date",
+					order: SortDesc,
+				},
+				PaginationQueryParams: PaginationQueryParams{
+					start: 0,
+					limit: 50,
+				},
+			},
+			description: "Should correctly handle descending sort order",
+		},
+		{
+			name:        "no parameters provided",
+			queryParams: map[string]string{},
+			expectedResult: QueryParams{
+				SearchQueryParams: SearchQueryParams{
+					search: "",
+				},
+				SortQueryParams: SortQueryParams{
+					sort:  "",
+					order: SortOrder(""),
+				},
+				PaginationQueryParams: PaginationQueryParams{
+					start: 0,
+					limit: 0,
+				},
+			},
+			description: "Should return zero values when no parameters are provided",
+		},
+		{
+			name: "partial parameters - search only",
+			queryParams: map[string]string{
+				"search": "partial test",
+			},
+			expectedResult: QueryParams{
+				SearchQueryParams: SearchQueryParams{
+					search: "partial test",
+				},
+				SortQueryParams: SortQueryParams{
+					sort:  "",
+					order: SortOrder(""),
+				},
+				PaginationQueryParams: PaginationQueryParams{
+					start: 0,
+					limit: 0,
+				},
+			},
+			description: "Should handle partial parameters correctly",
+		},
+		{
+			name: "partial parameters - pagination only",
+			queryParams: map[string]string{
+				"start": "5",
+				"limit": "15",
+			},
+			expectedResult: QueryParams{
+				SearchQueryParams: SearchQueryParams{
+					search: "",
+				},
+				SortQueryParams: SortQueryParams{
+					sort:  "",
+					order: SortOrder(""),
+				},
+				PaginationQueryParams: PaginationQueryParams{
+					start: 5,
+					limit: 15,
+				},
+			},
+			description: "Should handle pagination parameters when other params are missing",
+		},
+		{
+			name: "invalid sort order",
+			queryParams: map[string]string{
+				"search": "test",
+				"sort":   "name",
+				"order":  "invalid",
+				"start":  "0",
+				"limit":  "10",
+			},
+			expectedResult: QueryParams{
+				SearchQueryParams: SearchQueryParams{
+					search: "test",
+				},
+				SortQueryParams: SortQueryParams{
+					sort:  "name",
+					order: SortOrder("invalid"),
+				},
+				PaginationQueryParams: PaginationQueryParams{
+					start: 0,
+					limit: 10,
+				},
+			},
+			description: "Should accept invalid sort order as SortOrder type",
+		},
+		{
+			name: "empty string values",
+			queryParams: map[string]string{
+				"search": "",
+				"sort":   "",
+				"order":  "",
+				"start":  "0",
+				"limit":  "0",
+			},
+			expectedResult: QueryParams{
+				SearchQueryParams: SearchQueryParams{
+					search: "",
+				},
+				SortQueryParams: SortQueryParams{
+					sort:  "",
+					order: SortOrder(""),
+				},
+				PaginationQueryParams: PaginationQueryParams{
+					start: 0,
+					limit: 0,
+				},
+			},
+			description: "Should handle empty string values correctly",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Create HTTP request with query parameters
+			req := createRequestWithParams(tt.queryParams)
+
+			// Execute the function
+			result := ExtractListModifiersQueryParams(req)
+
+			// Assertions
+			require.Equal(t, tt.expectedResult.search, result.search,
+				"Search parameter should match expected value")
+			require.Equal(t, tt.expectedResult.sort, result.sort,
+				"Sort parameter should match expected value")
+			require.Equal(t, tt.expectedResult.order, result.order,
+				"Order parameter should match expected value")
+			require.Equal(t, tt.expectedResult.start, result.start,
+				"Start parameter should match expected value")
+			require.Equal(t, tt.expectedResult.limit, result.limit,
+				"Limit parameter should match expected value")
+
+			// Verify the complete struct
+			require.Equal(t, tt.expectedResult, result, tt.description)
+		})
+	}
+}
+
+func TestSortOrderConstants(t *testing.T) {
+	t.Parallel()
+	require.Equal(t, SortAsc, SortOrder("asc"), "SortAsc constant should equal 'asc'")
+	require.Equal(t, SortDesc, SortOrder("desc"), "SortDesc constant should equal 'desc'")
+}
+
+func TestQueryParamsStructEmbedding(t *testing.T) {
+	t.Parallel()
+	qp := QueryParams{
+		SearchQueryParams:     SearchQueryParams{search: "test"},
+		SortQueryParams:       SortQueryParams{sort: "name", order: SortAsc},
+		PaginationQueryParams: PaginationQueryParams{start: 10, limit: 20},
+	}
+
+	// Test that embedded fields are accessible
+	require.Equal(t, "test", qp.search, "Embedded search field should be accessible")
+	require.Equal(t, "name", qp.sort, "Embedded sort field should be accessible")
+	require.Equal(t, SortAsc, qp.order, "Embedded order field should be accessible")
+	require.Equal(t, 10, qp.start, "Embedded start field should be accessible")
+	require.Equal(t, 20, qp.limit, "Embedded limit field should be accessible")
+}
+
+func TestExtractListModifiersQueryParamsEdgeCases(t *testing.T) {
+	t.Parallel()
+	t.Run("special characters in search", func(t *testing.T) {
+		req := createRequestWithParams(map[string]string{
+			"search": "test & special chars %20",
+		})
+
+		result := ExtractListModifiersQueryParams(req)
+		require.Equal(t, "test & special chars %20", result.search,
+			"Should handle special characters in search parameter")
+	})
+
+	t.Run("unicode characters", func(t *testing.T) {
+		req := createRequestWithParams(map[string]string{
+			"search": "test 测试 🔍",
+			"sort":   "título",
+		})
+
+		result := ExtractListModifiersQueryParams(req)
+		require.Equal(t, "test 测试 🔍", result.search, "Should handle unicode in search")
+		require.Equal(t, "título", result.sort, "Should handle unicode in sort field")
+	})
+
+	t.Run("very long values", func(t *testing.T) {
+		longSearch := "a very long search query that contains many words and goes on for quite some time to test handling of long strings"
+		req := createRequestWithParams(map[string]string{
+			"search": longSearch,
+		})
+
+		result := ExtractListModifiersQueryParams(req)
+		require.Equal(t, longSearch, result.search, "Should handle long search strings")
+	})
+}
+
+// Helper function to create HTTP request with query parameters
+func createRequestWithParams(params map[string]string) *http.Request {
+	// Create URL with query parameters
+	u := &url.URL{
+		Scheme: "https",
+		Host:   "example.com",
+		Path:   "/test",
+	}
+
+	// Add query parameters
+	q := u.Query()
+	for key, value := range params {
+		q.Set(key, value)
+	}
+	u.RawQuery = q.Encode()
+
+	// Create request
+	req, _ := http.NewRequest("GET", u.String(), nil)
+	return req
+}
+
+// Benchmark tests
+func BenchmarkExtractListModifiersQueryParams(b *testing.B) {
+	req := createRequestWithParams(map[string]string{
+		"search": "benchmark test",
+		"sort":   "name",
+		"order":  "asc",
+		"start":  "10",
+		"limit":  "25",
+	})
+
+	for b.Loop() {
+		ExtractListModifiersQueryParams(req)
+	}
+}
+
+func BenchmarkExtractListModifiersQueryParamsEmpty(b *testing.B) {
+	req := createRequestWithParams(map[string]string{})
+
+	for b.Loop() {
+		ExtractListModifiersQueryParams(req)
+	}
+}
diff --git a/api/http/utils/filters/search.go b/api/http/utils/filters/search.go
new file mode 100644
index 0000000..b88422d
--- /dev/null
+++ b/api/http/utils/filters/search.go
@@ -0,0 +1,36 @@
+package filters
+
+import (
+	"strings"
+)
+
+// Return any error to skip the field (for  when matching an unknown state on an enum)
+//
+// Note: returning ("", nil) will match!
+type SearchAccessor[T any] = func(T) (string, error)
+
+type SearchQueryParams struct {
+	search string
+}
+
+func searchFn[T any](items []T, params SearchQueryParams, accessors []SearchAccessor[T]) []T {
+	search := strings.TrimSpace(params.search)
+
+	if search == "" {
+		return items
+	}
+
+	results := []T{}
+
+	for iIdx := range items {
+		for aIdx := range accessors {
+			value, err := accessors[aIdx](items[iIdx])
+			if err == nil && strings.Contains(strings.ToLower(value), strings.ToLower(search)) {
+				results = append(results, items[iIdx])
+				break
+			}
+		}
+	}
+
+	return results
+}
diff --git a/api/http/utils/filters/search_test.go b/api/http/utils/filters/search_test.go
new file mode 100644
index 0000000..695a091
--- /dev/null
+++ b/api/http/utils/filters/search_test.go
@@ -0,0 +1,299 @@
+package filters
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestSearchFn_BasicSearch(t *testing.T) {
+	t.Parallel()
+	users := []User{
+		{ID: 1, Name: "Alice Smith", Email: "alice@example.com", Age: 25},
+		{ID: 2, Name: "Bob Johnson", Email: "bob@company.com", Age: 30},
+		{ID: 3, Name: "Charlie Brown", Email: "charlie@test.org", Age: 35},
+	}
+
+	accessors := []SearchAccessor[User]{userNameAccessor, userEmailAccessor}
+	params := SearchQueryParams{search: "Alice"}
+
+	result := searchFn(users, params, accessors)
+
+	require.Len(t, result, 1)
+	require.Equal(t, "Alice Smith", result[0].Name)
+}
+
+func TestSearchFn_EmptySearch(t *testing.T) {
+	t.Parallel()
+	users := []User{
+		{ID: 1, Name: "Alice Smith", Email: "alice@example.com", Age: 25},
+		{ID: 2, Name: "Bob Johnson", Email: "bob@company.com", Age: 30},
+	}
+
+	accessors := []SearchAccessor[User]{userNameAccessor, userEmailAccessor}
+	params := SearchQueryParams{search: ""}
+
+	result := searchFn(users, params, accessors)
+
+	// Should return all items when search is empty
+	require.Equal(t, users, result)
+}
+
+func TestSearchFn_NoMatches(t *testing.T) {
+	t.Parallel()
+	users := []User{
+		{ID: 1, Name: "Alice Smith", Email: "alice@example.com", Age: 25},
+		{ID: 2, Name: "Bob Johnson", Email: "bob@company.com", Age: 30},
+	}
+
+	accessors := []SearchAccessor[User]{userNameAccessor, userEmailAccessor}
+	params := SearchQueryParams{search: "nonexistent"}
+
+	result := searchFn(users, params, accessors)
+
+	require.Empty(t, result)
+}
+
+func TestSearchFn_MultipleMatches(t *testing.T) {
+	t.Parallel()
+	users := []User{
+		{ID: 1, Name: "Alice Smith", Email: "alice@example.com", Age: 25},
+		{ID: 2, Name: "Bob Smith", Email: "bob@company.com", Age: 30},
+		{ID: 3, Name: "Charlie Brown", Email: "charlie@smith.org", Age: 35},
+	}
+
+	accessors := []SearchAccessor[User]{userNameAccessor, userEmailAccessor}
+	params := SearchQueryParams{search: "Smith"}
+
+	result := searchFn(users, params, accessors)
+
+	require.Len(t, result, 3)
+	require.Equal(t, "Alice Smith", result[0].Name)
+	require.Equal(t, "Bob Smith", result[1].Name)
+	require.Equal(t, "Charlie Brown", result[2].Name) // Matches via email
+}
+
+func TestSearchFn_MultipleAccessors(t *testing.T) {
+	t.Parallel()
+	users := []User{
+		{ID: 1, Name: "Alice Smith", Email: "alice@example.com", Age: 25},
+		{ID: 2, Name: "Bob Johnson", Email: "bob@company.com", Age: 30},
+		{ID: 3, Name: "Charlie Brown", Email: "charlie@test.org", Age: 35},
+	}
+
+	// Search across name, email, and ID
+	accessors := []SearchAccessor[User]{userNameAccessor, userEmailAccessor, userIDAccessor}
+
+	// Search by ID
+	params := SearchQueryParams{search: "2"}
+	result := searchFn(users, params, accessors)
+	require.Len(t, result, 1)
+	require.Equal(t, 2, result[0].ID)
+
+	// Search by email domain
+	params = SearchQueryParams{search: "company.com"}
+	result = searchFn(users, params, accessors)
+	require.Len(t, result, 1)
+	require.Equal(t, "Bob Johnson", result[0].Name)
+}
+
+func TestSearchFn_CaseSensitive(t *testing.T) {
+	t.Parallel()
+	users := []User{
+		{ID: 1, Name: "Alice Smith", Email: "alice@example.com", Age: 25},
+		{ID: 2, Name: "Bob Johnson", Email: "bob@company.com", Age: 30},
+	}
+
+	accessors := []SearchAccessor[User]{userNameAccessor, userEmailAccessor}
+
+	// Case sensitive search - should not match
+	params := SearchQueryParams{search: "alice"}
+	result := searchFn(users, params, accessors)
+	require.Len(t, result, 1) // Matches email which is lowercase
+
+	// Exact case match
+	params = SearchQueryParams{search: "Alice"}
+	result = searchFn(users, params, accessors)
+	require.Len(t, result, 1)
+	require.Equal(t, "Alice Smith", result[0].Name)
+}
+
+func TestSearchFn_PartialMatches(t *testing.T) {
+	t.Parallel()
+	products := []Product{
+		{ID: 1, Name: "Wireless Mouse", Description: "Ergonomic wireless mouse", Price: 25, Category: "Electronics"},
+		{ID: 2, Name: "Mechanical Keyboard", Description: "RGB gaming keyboard", Price: 150, Category: "Electronics"},
+		{ID: 3, Name: "Coffee Mug", Description: "Ceramic coffee mug", Price: 15, Category: "Kitchen"},
+	}
+
+	accessors := []SearchAccessor[Product]{productNameAccessor, productDescriptionAccessor}
+
+	// Partial word match
+	params := SearchQueryParams{search: "wire"}
+	result := searchFn(products, params, accessors)
+	require.Len(t, result, 1)
+	require.Equal(t, "Wireless Mouse", result[0].Name)
+
+	// Match in description
+	params = SearchQueryParams{search: "RGB"}
+	result = searchFn(products, params, accessors)
+	require.Len(t, result, 1)
+	require.Equal(t, "Mechanical Keyboard", result[0].Name)
+}
+
+func TestSearchFn_EmptySlice(t *testing.T) {
+	t.Parallel()
+	users := []User{}
+	accessors := []SearchAccessor[User]{userNameAccessor, userEmailAccessor}
+	params := SearchQueryParams{search: "anything"}
+
+	result := searchFn(users, params, accessors)
+
+	require.Empty(t, result)
+}
+
+func TestSearchFn_EmptyAccessors(t *testing.T) {
+	t.Parallel()
+	users := []User{
+		{ID: 1, Name: "Alice Smith", Email: "alice@example.com", Age: 25},
+	}
+
+	accessors := []SearchAccessor[User]{} // No accessors
+	params := SearchQueryParams{search: "Alice"}
+
+	result := searchFn(users, params, accessors)
+
+	// Should return empty since no accessors to search through
+	require.Empty(t, result)
+}
+
+func TestSearchFn_SingleAccessor(t *testing.T) {
+	t.Parallel()
+	users := []User{
+		{ID: 1, Name: "Alice Smith", Email: "alice@example.com", Age: 25},
+		{ID: 2, Name: "Bob Johnson", Email: "bob@company.com", Age: 30},
+	}
+
+	// Only search by name
+	accessors := []SearchAccessor[User]{userNameAccessor}
+	params := SearchQueryParams{search: "company.com"}
+
+	result := searchFn(users, params, accessors)
+
+	// Should not match since we're only searching names, not emails
+	require.Empty(t, result)
+}
+
+func TestSearchFn_NumericSearch(t *testing.T) {
+	t.Parallel()
+	users := []User{
+		{ID: 1, Name: "Alice Smith", Email: "alice@example.com", Age: 25},
+		{ID: 2, Name: "Bob Johnson", Email: "bob@company.com", Age: 30},
+		{ID: 3, Name: "Charlie Brown", Email: "charlie@test.org", Age: 35},
+	}
+
+	// Search by age (converted to string)
+	accessors := []SearchAccessor[User]{userAgeAccessor}
+	params := SearchQueryParams{search: "30"}
+
+	result := searchFn(users, params, accessors)
+
+	require.Len(t, result, 1)
+	require.Equal(t, 30, result[0].Age)
+}
+
+func TestSearchFn_FormattedAccessor(t *testing.T) {
+	t.Parallel()
+	products := []Product{
+		{ID: 1, Name: "Mouse", Description: "Wireless mouse", Price: 25, Category: "Electronics"},
+		{ID: 2, Name: "Keyboard", Description: "Gaming keyboard", Price: 150, Category: "Electronics"},
+	}
+
+	// Search by formatted price (e.g., "$25")
+	accessors := []SearchAccessor[Product]{productPriceAccessor}
+	params := SearchQueryParams{search: "$25"}
+
+	result := searchFn(products, params, accessors)
+
+	require.Len(t, result, 1)
+	require.Equal(t, "Mouse", result[0].Name)
+}
+
+func TestSearchFn_FirstMatchOnly(t *testing.T) {
+	t.Parallel()
+	users := []User{
+		{ID: 1, Name: "test user", Email: "test@example.com", Age: 25},
+	}
+
+	// Both accessors would match the search term
+	accessors := []SearchAccessor[User]{userNameAccessor, userEmailAccessor}
+	params := SearchQueryParams{search: "test"}
+
+	result := searchFn(users, params, accessors)
+
+	// Should only include the item once, even though multiple accessors match
+	require.Len(t, result, 1)
+	require.Equal(t, "test user", result[0].Name)
+}
+
+func TestSearchFn_PreservesOrder(t *testing.T) {
+	t.Parallel()
+	users := []User{
+		{ID: 1, Name: "Alice Test", Email: "alice@example.com", Age: 25},
+		{ID: 2, Name: "Bob Johnson", Email: "bob@test.com", Age: 30},
+		{ID: 3, Name: "Charlie Test", Email: "charlie@example.com", Age: 35},
+	}
+
+	accessors := []SearchAccessor[User]{userNameAccessor, userEmailAccessor}
+	params := SearchQueryParams{search: "Test"}
+
+	result := searchFn(users, params, accessors)
+
+	require.Len(t, result, 3)
+	// Should preserve original order
+	require.Equal(t, 1, result[0].ID)
+	require.Equal(t, 2, result[1].ID)
+	require.Equal(t, 3, result[2].ID)
+}
+
+func TestSearchFn_ComplexSearch(t *testing.T) {
+	t.Parallel()
+	products := []Product{
+		{ID: 1, Name: "Gaming Mouse", Description: "High-DPI gaming mouse", Price: 75, Category: "Gaming"},
+		{ID: 2, Name: "Office Mouse", Description: "Ergonomic office mouse", Price: 25, Category: "Office"},
+		{ID: 3, Name: "Gaming Keyboard", Description: "Mechanical gaming keyboard", Price: 150, Category: "Gaming"},
+		{ID: 4, Name: "Wireless Headset", Description: "Gaming headset with mic", Price: 100, Category: "Gaming"},
+	}
+
+	// Search across multiple fields
+	accessors := []SearchAccessor[Product]{
+		productNameAccessor,
+		productDescriptionAccessor,
+		productCategoryAccessor,
+	}
+
+	params := SearchQueryParams{search: "Gaming"}
+
+	result := searchFn(products, params, accessors)
+
+	require.Len(t, result, 3)
+	require.Equal(t, "Gaming Mouse", result[0].Name)
+	require.Equal(t, "Gaming Keyboard", result[1].Name)
+	require.Equal(t, "Wireless Headset", result[2].Name)
+}
+
+func TestSearchFn_WhitespaceSearch(t *testing.T) {
+	t.Parallel()
+	users := []User{
+		{ID: 1, Name: "Alice Smith", Email: "alice@example.com", Age: 25},
+		{ID: 2, Name: "Bob Johnson", Email: "bob@company.com", Age: 30},
+	}
+
+	accessors := []SearchAccessor[User]{userNameAccessor, userEmailAccessor}
+
+	// Search with just whitespace should be treated as empty
+	params := SearchQueryParams{search: "   "}
+	result := searchFn(users, params, accessors)
+
+	require.Len(t, result, 2)
+}
diff --git a/api/http/utils/filters/sort.go b/api/http/utils/filters/sort.go
new file mode 100644
index 0000000..354a4a6
--- /dev/null
+++ b/api/http/utils/filters/sort.go
@@ -0,0 +1,62 @@
+package filters
+
+import "slices"
+
+type SortOrder string
+
+const (
+	SortAsc  SortOrder = "asc"
+	SortDesc SortOrder = "desc"
+)
+
+type SortQueryParams struct {
+	sort  string
+	order SortOrder
+}
+
+type SortOption[T any] func(a, b T) int
+type SortBinding[T any] struct {
+	Key       string
+	Fn        SortOption[T]
+	NullsLast func(T) bool // if set, items where this returns true always sort after all others
+}
+
+func sortFn[T any](items []T, params SortQueryParams, sorts []SortBinding[T]) []T {
+	for _, sort := range sorts {
+		if sort.Key == params.sort {
+			fn := sort.Fn
+			if params.order == SortDesc {
+				fn = reverSortFn(fn)
+			}
+			if sort.NullsLast != nil {
+				fn = nullsLastWrap(fn, sort.NullsLast)
+			}
+			slices.SortStableFunc(items, fn)
+		}
+	}
+	return items
+}
+
+func reverSortFn[T any](fn SortOption[T]) SortOption[T] {
+	return func(a, b T) int {
+		return -1 * fn(a, b)
+	}
+}
+
+// nullsLastWrap wraps a comparator so that items where isNull returns true
+// always sort after all others, regardless of sort direction.
+func nullsLastWrap[T any](fn SortOption[T], isNull func(T) bool) SortOption[T] {
+	return func(a, b T) int {
+		aN, bN := isNull(a), isNull(b)
+		if aN && bN {
+			return 0
+		}
+		if aN {
+			return 1
+		}
+		if bN {
+			return -1
+		}
+		return fn(a, b)
+	}
+}
diff --git a/api/http/utils/filters/sort_test.go b/api/http/utils/filters/sort_test.go
new file mode 100644
index 0000000..97bf865
--- /dev/null
+++ b/api/http/utils/filters/sort_test.go
@@ -0,0 +1,299 @@
+package filters
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// Helper sort functions
+func compareUserByName(a, b User) int {
+	return strings.Compare(a.Name, b.Name)
+}
+
+func compareUserByAge(a, b User) int {
+	return a.Age - b.Age
+}
+
+func compareProductByName(a, b Product) int {
+	return strings.Compare(a.Name, b.Name)
+}
+
+func compareProductByPrice(a, b Product) int {
+	return a.Price - b.Price
+}
+
+func TestSortFn_BasicAscending(t *testing.T) {
+	t.Parallel()
+	users := []User{
+		{Name: "Charlie", Age: 25},
+		{Name: "Alice", Age: 30},
+		{Name: "Bob", Age: 20},
+	}
+
+	sorts := []SortBinding[User]{
+		{Key: "name", Fn: compareUserByName},
+		{Key: "age", Fn: compareUserByAge},
+	}
+
+	params := SortQueryParams{sort: "name", order: SortAsc}
+	result := sortFn(users, params, sorts)
+
+	require.Equal(t, []User{
+		{Name: "Alice", Age: 30},
+		{Name: "Bob", Age: 20},
+		{Name: "Charlie", Age: 25},
+	}, result)
+}
+
+func TestSortFn_BasicDescending(t *testing.T) {
+	t.Parallel()
+	users := []User{
+		{Name: "Charlie", Age: 25},
+		{Name: "Alice", Age: 30},
+		{Name: "Bob", Age: 20},
+	}
+
+	sorts := []SortBinding[User]{
+		{Key: "name", Fn: compareUserByName},
+		{Key: "age", Fn: compareUserByAge},
+	}
+
+	params := SortQueryParams{sort: "name", order: SortDesc}
+	result := sortFn(users, params, sorts)
+
+	require.Equal(t, []User{
+		{Name: "Charlie", Age: 25},
+		{Name: "Bob", Age: 20},
+		{Name: "Alice", Age: 30},
+	}, result)
+}
+
+func TestSortFn_SortByAge(t *testing.T) {
+	t.Parallel()
+	users := []User{
+		{Name: "Charlie", Age: 25},
+		{Name: "Alice", Age: 30},
+		{Name: "Bob", Age: 20},
+	}
+
+	sorts := []SortBinding[User]{
+		{Key: "name", Fn: compareUserByName},
+		{Key: "age", Fn: compareUserByAge},
+	}
+
+	// Test ascending by age
+	params := SortQueryParams{sort: "age", order: SortAsc}
+	result := sortFn(users, params, sorts)
+
+	require.Equal(t, []User{
+		{Name: "Bob", Age: 20},
+		{Name: "Charlie", Age: 25},
+		{Name: "Alice", Age: 30},
+	}, result)
+
+	// Test descending by age
+	params = SortQueryParams{sort: "age", order: SortDesc}
+	result = sortFn(users, params, sorts)
+
+	require.Equal(t, []User{
+		{Name: "Alice", Age: 30},
+		{Name: "Charlie", Age: 25},
+		{Name: "Bob", Age: 20},
+	}, result)
+}
+
+func TestSortFn_UnknownSortKey(t *testing.T) {
+	t.Parallel()
+	users := []User{
+		{Name: "Charlie", Age: 25},
+		{Name: "Alice", Age: 30},
+		{Name: "Bob", Age: 20},
+	}
+
+	sorts := []SortBinding[User]{
+		{Key: "name", Fn: compareUserByName},
+	}
+
+	params := SortQueryParams{sort: "unknown", order: SortAsc}
+	result := sortFn(users, params, sorts)
+
+	// Should return original slice unchanged
+	require.Equal(t, []User{
+		{Name: "Charlie", Age: 25},
+		{Name: "Alice", Age: 30},
+		{Name: "Bob", Age: 20},
+	}, result)
+}
+
+func TestSortFn_EmptySlice(t *testing.T) {
+	t.Parallel()
+	users := []User{}
+
+	sorts := []SortBinding[User]{
+		{Key: "name", Fn: compareUserByName},
+	}
+
+	params := SortQueryParams{sort: "name", order: SortAsc}
+	result := sortFn(users, params, sorts)
+
+	require.Empty(t, result)
+}
+
+func TestSortFn_SingleElement(t *testing.T) {
+	t.Parallel()
+	users := []User{{Name: "Alice", Age: 30}}
+
+	sorts := []SortBinding[User]{
+		{Key: "name", Fn: compareUserByName},
+	}
+
+	params := SortQueryParams{sort: "name", order: SortAsc}
+	result := sortFn(users, params, sorts)
+
+	require.Equal(t, []User{{Name: "Alice", Age: 30}}, result)
+}
+
+func TestSortFn_EmptySortBindings(t *testing.T) {
+	t.Parallel()
+	users := []User{
+		{Name: "Charlie", Age: 25},
+		{Name: "Alice", Age: 30},
+	}
+
+	sorts := []SortBinding[User]{} // Empty sorts
+
+	params := SortQueryParams{sort: "name", order: SortAsc}
+	result := sortFn(users, params, sorts)
+
+	// Should return original slice unchanged
+	require.Equal(t, []User{
+		{Name: "Charlie", Age: 25},
+		{Name: "Alice", Age: 30},
+	}, result)
+}
+
+func TestSortFn_DifferentType(t *testing.T) {
+	t.Parallel()
+	products := []Product{
+		{Name: "Laptop", Price: 1000},
+		{Name: "Mouse", Price: 25},
+		{Name: "Keyboard", Price: 100},
+	}
+
+	sorts := []SortBinding[Product]{
+		{Key: "name", Fn: compareProductByName},
+		{Key: "price", Fn: compareProductByPrice},
+	}
+
+	// Test by price ascending
+	params := SortQueryParams{sort: "price", order: SortAsc}
+	result := sortFn(products, params, sorts)
+
+	require.Equal(t, []Product{
+		{Name: "Mouse", Price: 25},
+		{Name: "Keyboard", Price: 100},
+		{Name: "Laptop", Price: 1000},
+	}, result)
+
+	// Test by name descending
+	params = SortQueryParams{sort: "name", order: SortDesc}
+	result = sortFn(products, params, sorts)
+
+	require.Equal(t, []Product{
+		{Name: "Mouse", Price: 25},
+		{Name: "Laptop", Price: 1000},
+		{Name: "Keyboard", Price: 100},
+	}, result)
+}
+
+func TestSortFn_StableSort(t *testing.T) {
+	t.Parallel()
+	// Test that sorting is stable (maintains relative order of equal elements)
+	users := []User{
+		{Name: "Alice", Age: 25},
+		{Name: "Bob", Age: 25},
+		{Name: "Charlie", Age: 25},
+		{Name: "David", Age: 30},
+	}
+
+	sorts := []SortBinding[User]{
+		{Key: "age", Fn: compareUserByAge},
+	}
+
+	params := SortQueryParams{sort: "age", order: SortAsc}
+	result := sortFn(users, params, sorts)
+
+	// All users with age 25 should maintain their original relative order
+	require.Equal(t, []User{
+		{Name: "Alice", Age: 25},
+		{Name: "Bob", Age: 25},
+		{Name: "Charlie", Age: 25},
+		{Name: "David", Age: 30},
+	}, result)
+}
+
+func TestReverseSortFn(t *testing.T) {
+	t.Parallel()
+	originalFn := compareUserByAge
+	reversedFn := reverSortFn(originalFn)
+
+	userA := User{Name: "Alice", Age: 20}
+	userB := User{Name: "Bob", Age: 30}
+
+	// Original function: A < B (returns negative)
+	require.Negative(t, originalFn(userA, userB))
+
+	// Reversed function: A > B (returns positive)
+	require.Positive(t, reversedFn(userA, userB))
+
+	// Test symmetry
+	require.Equal(t, -originalFn(userA, userB), reversedFn(userA, userB))
+	require.Equal(t, -originalFn(userB, userA), reversedFn(userB, userA))
+}
+
+func TestSortFn_CaseSensitive(t *testing.T) {
+	t.Parallel()
+	users := []User{
+		{Name: "alice", Age: 25},
+		{Name: "Bob", Age: 30},
+		{Name: "Charlie", Age: 20},
+	}
+
+	sorts := []SortBinding[User]{
+		{Key: "name", Fn: compareUserByName},
+	}
+
+	params := SortQueryParams{sort: "name", order: SortAsc}
+	result := sortFn(users, params, sorts)
+
+	// strings.Compare is case-sensitive, uppercase comes before lowercase
+	require.Equal(t, []User{
+		{Name: "Bob", Age: 30},
+		{Name: "Charlie", Age: 20},
+		{Name: "alice", Age: 25},
+	}, result)
+}
+
+func TestSortFn_ModifiesOriginalSlice(t *testing.T) {
+	t.Parallel()
+	users := []User{
+		{Name: "Charlie", Age: 25},
+		{Name: "Alice", Age: 30},
+		{Name: "Bob", Age: 20},
+	}
+	original := make([]User, len(users))
+	copy(original, users)
+
+	sorts := []SortBinding[User]{
+		{Key: "name", Fn: compareUserByName},
+	}
+
+	params := SortQueryParams{sort: "name", order: SortAsc}
+	result := sortFn(users, params, sorts)
+
+	// The function modifies the original slice
+	require.Equal(t, result, users)
+	require.NotEqual(t, original, users)
+}
diff --git a/api/http/utils/filters/types_test.go b/api/http/utils/filters/types_test.go
new file mode 100644
index 0000000..2dc9b9a
--- /dev/null
+++ b/api/http/utils/filters/types_test.go
@@ -0,0 +1,63 @@
+package filters
+
+import (
+	"errors"
+	"fmt"
+	"strconv"
+)
+
+// Test data structures
+type User struct {
+	ID    int
+	Name  string
+	Email string
+	Age   int
+}
+
+type Product struct {
+	ID          int
+	Name        string
+	Description string
+	Price       int
+	Category    string
+}
+
+// User accessors
+func userIDAccessor(u User) (string, error) {
+	return strconv.Itoa(u.ID), nil
+}
+
+func userNameAccessor(u User) (string, error) {
+	return u.Name, nil
+}
+
+func userEmailAccessor(u User) (string, error) {
+	return u.Email, nil
+}
+
+func userAgeAccessor(u User) (string, error) {
+	return strconv.Itoa(u.Age), nil
+}
+
+// Product accessors
+
+func productNameAccessor(p Product) (string, error) {
+	return p.Name, nil
+}
+
+func productDescriptionAccessor(p Product) (string, error) {
+	return p.Description, nil
+}
+
+func productPriceAccessor(p Product) (string, error) {
+	return fmt.Sprintf("$%d", p.Price), nil
+}
+
+func productCategoryAccessor(p Product) (string, error) {
+	return p.Category, nil
+}
+
+// Other accessors
+func errorAccessor[T any](t T) (string, error) {
+	return "", errors.New("accessor error")
+}
diff --git a/api/internal/authorization/access_control.go b/api/internal/authorization/access_control.go
new file mode 100644
index 0000000..0ff3a2e
--- /dev/null
+++ b/api/internal/authorization/access_control.go
@@ -0,0 +1,76 @@
+package authorization
+
+import (
+	"strconv"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+	"github.com/portainer/portainer/pkg/authorization"
+)
+
+var (
+	NewAdministratorsOnlyResourceControl  = authorization.NewAdministratorsOnlyResourceControl
+	NewPrivateResourceControl             = authorization.NewPrivateResourceControl
+	NewSystemResourceControl              = authorization.NewSystemResourceControl
+	NewPublicResourceControl              = authorization.NewPublicResourceControl
+	NewRestrictedResourceControl          = authorization.NewRestrictedResourceControl
+	UserCanAccessResource                 = authorization.UserCanAccessResource
+	GetResourceControlByResourceIDAndType = authorization.GetResourceControlByResourceIDAndType
+	TeamIDs                               = authorization.TeamIDs
+)
+
+func NewEmptyRestrictedResourceControl(resourceIdentifier string, resourceType portainer.ResourceControlType) *portainer.ResourceControl {
+	return NewRestrictedResourceControl(resourceIdentifier, resourceType, []portainer.UserID{}, []portainer.TeamID{})
+}
+
+// DecorateStacks will iterate through a list of stacks, check for an associated resource control for each
+// stack and decorate the stack element if a resource control is found.
+func DecorateStacks(stacks []portainer.Stack, resourceControls []portainer.ResourceControl) []portainer.Stack {
+	for idx, stack := range stacks {
+		resourceControl := GetResourceControlByResourceIDAndType(stackutils.ResourceControlID(stack.EndpointID, stack.Name), portainer.StackResourceControl, resourceControls)
+		if resourceControl != nil {
+			stacks[idx].ResourceControl = resourceControl
+		}
+	}
+
+	return stacks
+}
+
+// DecorateCustomTemplates will iterate through a list of custom templates, check for an associated resource control for each
+// template and decorate the template element if a resource control is found.
+func DecorateCustomTemplates(templates []portainer.CustomTemplate, resourceControls []portainer.ResourceControl) []portainer.CustomTemplate {
+	for idx, template := range templates {
+		resourceControl := GetResourceControlByResourceIDAndType(strconv.Itoa(int(template.ID)), portainer.CustomTemplateResourceControl, resourceControls)
+		if resourceControl != nil {
+			templates[idx].ResourceControl = resourceControl
+		}
+	}
+
+	return templates
+}
+
+// FilterAuthorizedStacks returns a list of decorated stacks filtered through resource control access checks.
+func FilterAuthorizedStacks(stacks []portainer.Stack, userID portainer.UserID, userTeamIDs []portainer.TeamID) []portainer.Stack {
+	authorizedStacks := make([]portainer.Stack, 0)
+
+	for _, stack := range stacks {
+		if stack.ResourceControl != nil && UserCanAccessResource(userID, userTeamIDs, stack.ResourceControl) {
+			authorizedStacks = append(authorizedStacks, stack)
+		}
+	}
+
+	return authorizedStacks
+}
+
+// FilterAuthorizedCustomTemplates returns a list of decorated custom templates filtered through resource control access checks.
+func FilterAuthorizedCustomTemplates(customTemplates []portainer.CustomTemplate, user *portainer.User, userTeamIDs []portainer.TeamID) []portainer.CustomTemplate {
+	authorizedTemplates := make([]portainer.CustomTemplate, 0)
+
+	for _, customTemplate := range customTemplates {
+		if customTemplate.CreatedByUserID == user.ID || (customTemplate.ResourceControl != nil && UserCanAccessResource(user.ID, userTeamIDs, customTemplate.ResourceControl)) {
+			authorizedTemplates = append(authorizedTemplates, customTemplate)
+		}
+	}
+
+	return authorizedTemplates
+}
diff --git a/api/internal/authorization/authorizations.go b/api/internal/authorization/authorizations.go
new file mode 100644
index 0000000..590bc75
--- /dev/null
+++ b/api/internal/authorization/authorizations.go
@@ -0,0 +1,598 @@
+package authorization
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/kubernetes/cli"
+)
+
+// Service represents a service used to
+// update authorizations associated to a user or team.
+type Service struct {
+	dataStore        dataservices.DataStoreTx
+	K8sClientFactory *cli.ClientFactory
+}
+
+// NewService returns a point to a new Service instance.
+func NewService(dataStore dataservices.DataStoreTx) *Service {
+	return &Service{
+		dataStore: dataStore,
+	}
+}
+
+// DefaultEndpointAuthorizationsForEndpointAdministratorRole returns the default environment(endpoint) authorizations
+// associated to the environment(endpoint) administrator role.
+func DefaultEndpointAuthorizationsForEndpointAdministratorRole() portainer.Authorizations {
+	return map[portainer.Authorization]bool{
+		portainer.OperationDockerContainerArchiveInfo:         true,
+		portainer.OperationDockerContainerList:                true,
+		portainer.OperationDockerContainerExport:              true,
+		portainer.OperationDockerContainerChanges:             true,
+		portainer.OperationDockerContainerInspect:             true,
+		portainer.OperationDockerContainerTop:                 true,
+		portainer.OperationDockerContainerLogs:                true,
+		portainer.OperationDockerContainerStats:               true,
+		portainer.OperationDockerContainerAttachWebsocket:     true,
+		portainer.OperationDockerContainerArchive:             true,
+		portainer.OperationDockerContainerCreate:              true,
+		portainer.OperationDockerContainerPrune:               true,
+		portainer.OperationDockerContainerKill:                true,
+		portainer.OperationDockerContainerPause:               true,
+		portainer.OperationDockerContainerUnpause:             true,
+		portainer.OperationDockerContainerRestart:             true,
+		portainer.OperationDockerContainerStart:               true,
+		portainer.OperationDockerContainerStop:                true,
+		portainer.OperationDockerContainerWait:                true,
+		portainer.OperationDockerContainerResize:              true,
+		portainer.OperationDockerContainerAttach:              true,
+		portainer.OperationDockerContainerExec:                true,
+		portainer.OperationDockerContainerRename:              true,
+		portainer.OperationDockerContainerUpdate:              true,
+		portainer.OperationDockerContainerPutContainerArchive: true,
+		portainer.OperationDockerContainerDelete:              true,
+		portainer.OperationDockerImageList:                    true,
+		portainer.OperationDockerImageSearch:                  true,
+		portainer.OperationDockerImageGetAll:                  true,
+		portainer.OperationDockerImageGet:                     true,
+		portainer.OperationDockerImageHistory:                 true,
+		portainer.OperationDockerImageInspect:                 true,
+		portainer.OperationDockerImageLoad:                    true,
+		portainer.OperationDockerImageCreate:                  true,
+		portainer.OperationDockerImagePrune:                   true,
+		portainer.OperationDockerImagePush:                    true,
+		portainer.OperationDockerImageTag:                     true,
+		portainer.OperationDockerImageDelete:                  true,
+		portainer.OperationDockerImageCommit:                  true,
+		portainer.OperationDockerImageBuild:                   true,
+		portainer.OperationDockerNetworkList:                  true,
+		portainer.OperationDockerNetworkInspect:               true,
+		portainer.OperationDockerNetworkCreate:                true,
+		portainer.OperationDockerNetworkConnect:               true,
+		portainer.OperationDockerNetworkDisconnect:            true,
+		portainer.OperationDockerNetworkPrune:                 true,
+		portainer.OperationDockerNetworkDelete:                true,
+		portainer.OperationDockerVolumeList:                   true,
+		portainer.OperationDockerVolumeInspect:                true,
+		portainer.OperationDockerVolumeCreate:                 true,
+		portainer.OperationDockerVolumePrune:                  true,
+		portainer.OperationDockerVolumeDelete:                 true,
+		portainer.OperationDockerExecInspect:                  true,
+		portainer.OperationDockerExecStart:                    true,
+		portainer.OperationDockerExecResize:                   true,
+		portainer.OperationDockerSwarmInspect:                 true,
+		portainer.OperationDockerSwarmUnlockKey:               true,
+		portainer.OperationDockerSwarmInit:                    true,
+		portainer.OperationDockerSwarmJoin:                    true,
+		portainer.OperationDockerSwarmLeave:                   true,
+		portainer.OperationDockerSwarmUpdate:                  true,
+		portainer.OperationDockerSwarmUnlock:                  true,
+		portainer.OperationDockerNodeList:                     true,
+		portainer.OperationDockerNodeInspect:                  true,
+		portainer.OperationDockerNodeUpdate:                   true,
+		portainer.OperationDockerNodeDelete:                   true,
+		portainer.OperationDockerServiceList:                  true,
+		portainer.OperationDockerServiceInspect:               true,
+		portainer.OperationDockerServiceLogs:                  true,
+		portainer.OperationDockerServiceCreate:                true,
+		portainer.OperationDockerServiceUpdate:                true,
+		portainer.OperationDockerServiceDelete:                true,
+		portainer.OperationDockerSecretList:                   true,
+		portainer.OperationDockerSecretInspect:                true,
+		portainer.OperationDockerSecretCreate:                 true,
+		portainer.OperationDockerSecretUpdate:                 true,
+		portainer.OperationDockerSecretDelete:                 true,
+		portainer.OperationDockerConfigList:                   true,
+		portainer.OperationDockerConfigInspect:                true,
+		portainer.OperationDockerConfigCreate:                 true,
+		portainer.OperationDockerConfigUpdate:                 true,
+		portainer.OperationDockerConfigDelete:                 true,
+		portainer.OperationDockerTaskList:                     true,
+		portainer.OperationDockerTaskInspect:                  true,
+		portainer.OperationDockerTaskLogs:                     true,
+		portainer.OperationDockerPluginList:                   true,
+		portainer.OperationDockerPluginPrivileges:             true,
+		portainer.OperationDockerPluginInspect:                true,
+		portainer.OperationDockerPluginPull:                   true,
+		portainer.OperationDockerPluginCreate:                 true,
+		portainer.OperationDockerPluginEnable:                 true,
+		portainer.OperationDockerPluginDisable:                true,
+		portainer.OperationDockerPluginPush:                   true,
+		portainer.OperationDockerPluginUpgrade:                true,
+		portainer.OperationDockerPluginSet:                    true,
+		portainer.OperationDockerPluginDelete:                 true,
+		portainer.OperationDockerSessionStart:                 true,
+		portainer.OperationDockerDistributionInspect:          true,
+		portainer.OperationDockerBuildPrune:                   true,
+		portainer.OperationDockerBuildCancel:                  true,
+		portainer.OperationDockerPing:                         true,
+		portainer.OperationDockerInfo:                         true,
+		portainer.OperationDockerVersion:                      true,
+		portainer.OperationDockerEvents:                       true,
+		portainer.OperationDockerSystem:                       true,
+		portainer.OperationDockerUndefined:                    true,
+		portainer.OperationDockerAgentPing:                    true,
+		portainer.OperationDockerAgentList:                    true,
+		portainer.OperationDockerAgentHostInfo:                true,
+		portainer.OperationDockerAgentBrowseDelete:            true,
+		portainer.OperationDockerAgentBrowseGet:               true,
+		portainer.OperationDockerAgentBrowseList:              true,
+		portainer.OperationDockerAgentBrowsePut:               true,
+		portainer.OperationDockerAgentBrowseRename:            true,
+		portainer.OperationDockerAgentUndefined:               true,
+		portainer.OperationPortainerResourceControlCreate:     true,
+		portainer.OperationPortainerResourceControlUpdate:     true,
+		portainer.OperationPortainerRegistryUpdateAccess:      true,
+		portainer.OperationPortainerStackList:                 true,
+		portainer.OperationPortainerStackInspect:              true,
+		portainer.OperationPortainerStackFile:                 true,
+		portainer.OperationPortainerStackCreate:               true,
+		portainer.OperationPortainerStackMigrate:              true,
+		portainer.OperationPortainerStackUpdate:               true,
+		portainer.OperationPortainerStackDelete:               true,
+		portainer.OperationPortainerWebsocketExec:             true,
+		portainer.OperationPortainerWebhookList:               true,
+		portainer.OperationPortainerWebhookCreate:             true,
+		portainer.OperationPortainerWebhookDelete:             true,
+		portainer.EndpointResourcesAccess:                     true,
+	}
+}
+
+// DefaultEndpointAuthorizationsForHelpDeskRole returns the default environment(endpoint) authorizations
+// associated to the helpdesk role.
+func DefaultEndpointAuthorizationsForHelpDeskRole(volumeBrowsingAuthorizations bool) portainer.Authorizations {
+	authorizations := map[portainer.Authorization]bool{
+		portainer.OperationDockerContainerArchiveInfo: true,
+		portainer.OperationDockerContainerList:        true,
+		portainer.OperationDockerContainerChanges:     true,
+		portainer.OperationDockerContainerInspect:     true,
+		portainer.OperationDockerContainerTop:         true,
+		portainer.OperationDockerContainerLogs:        true,
+		portainer.OperationDockerContainerStats:       true,
+		portainer.OperationDockerImageList:            true,
+		portainer.OperationDockerImageSearch:          true,
+		portainer.OperationDockerImageGetAll:          true,
+		portainer.OperationDockerImageGet:             true,
+		portainer.OperationDockerImageHistory:         true,
+		portainer.OperationDockerImageInspect:         true,
+		portainer.OperationDockerNetworkList:          true,
+		portainer.OperationDockerNetworkInspect:       true,
+		portainer.OperationDockerVolumeList:           true,
+		portainer.OperationDockerVolumeInspect:        true,
+		portainer.OperationDockerSwarmInspect:         true,
+		portainer.OperationDockerNodeList:             true,
+		portainer.OperationDockerNodeInspect:          true,
+		portainer.OperationDockerServiceList:          true,
+		portainer.OperationDockerServiceInspect:       true,
+		portainer.OperationDockerServiceLogs:          true,
+		portainer.OperationDockerSecretList:           true,
+		portainer.OperationDockerSecretInspect:        true,
+		portainer.OperationDockerConfigList:           true,
+		portainer.OperationDockerConfigInspect:        true,
+		portainer.OperationDockerTaskList:             true,
+		portainer.OperationDockerTaskInspect:          true,
+		portainer.OperationDockerTaskLogs:             true,
+		portainer.OperationDockerPluginList:           true,
+		portainer.OperationDockerDistributionInspect:  true,
+		portainer.OperationDockerPing:                 true,
+		portainer.OperationDockerInfo:                 true,
+		portainer.OperationDockerVersion:              true,
+		portainer.OperationDockerEvents:               true,
+		portainer.OperationDockerSystem:               true,
+		portainer.OperationDockerAgentPing:            true,
+		portainer.OperationDockerAgentList:            true,
+		portainer.OperationDockerAgentHostInfo:        true,
+		portainer.OperationPortainerStackList:         true,
+		portainer.OperationPortainerStackInspect:      true,
+		portainer.OperationPortainerStackFile:         true,
+		portainer.OperationPortainerWebhookList:       true,
+		portainer.EndpointResourcesAccess:             true,
+	}
+
+	if volumeBrowsingAuthorizations {
+		authorizations[portainer.OperationDockerAgentBrowseGet] = true
+		authorizations[portainer.OperationDockerAgentBrowseList] = true
+	}
+
+	return authorizations
+}
+
+// DefaultEndpointAuthorizationsForStandardUserRole returns the default environment(endpoint) authorizations
+// associated to the standard user role.
+func DefaultEndpointAuthorizationsForStandardUserRole(volumeBrowsingAuthorizations bool) portainer.Authorizations {
+	authorizations := map[portainer.Authorization]bool{
+		portainer.OperationDockerContainerArchiveInfo:         true,
+		portainer.OperationDockerContainerList:                true,
+		portainer.OperationDockerContainerExport:              true,
+		portainer.OperationDockerContainerChanges:             true,
+		portainer.OperationDockerContainerInspect:             true,
+		portainer.OperationDockerContainerTop:                 true,
+		portainer.OperationDockerContainerLogs:                true,
+		portainer.OperationDockerContainerStats:               true,
+		portainer.OperationDockerContainerAttachWebsocket:     true,
+		portainer.OperationDockerContainerArchive:             true,
+		portainer.OperationDockerContainerCreate:              true,
+		portainer.OperationDockerContainerKill:                true,
+		portainer.OperationDockerContainerPause:               true,
+		portainer.OperationDockerContainerUnpause:             true,
+		portainer.OperationDockerContainerRestart:             true,
+		portainer.OperationDockerContainerStart:               true,
+		portainer.OperationDockerContainerStop:                true,
+		portainer.OperationDockerContainerWait:                true,
+		portainer.OperationDockerContainerResize:              true,
+		portainer.OperationDockerContainerAttach:              true,
+		portainer.OperationDockerContainerExec:                true,
+		portainer.OperationDockerContainerRename:              true,
+		portainer.OperationDockerContainerUpdate:              true,
+		portainer.OperationDockerContainerPutContainerArchive: true,
+		portainer.OperationDockerContainerDelete:              true,
+		portainer.OperationDockerImageList:                    true,
+		portainer.OperationDockerImageSearch:                  true,
+		portainer.OperationDockerImageGetAll:                  true,
+		portainer.OperationDockerImageGet:                     true,
+		portainer.OperationDockerImageHistory:                 true,
+		portainer.OperationDockerImageInspect:                 true,
+		portainer.OperationDockerImageLoad:                    true,
+		portainer.OperationDockerImageCreate:                  true,
+		portainer.OperationDockerImagePush:                    true,
+		portainer.OperationDockerImageTag:                     true,
+		portainer.OperationDockerImageDelete:                  true,
+		portainer.OperationDockerImageCommit:                  true,
+		portainer.OperationDockerImageBuild:                   true,
+		portainer.OperationDockerNetworkList:                  true,
+		portainer.OperationDockerNetworkInspect:               true,
+		portainer.OperationDockerNetworkCreate:                true,
+		portainer.OperationDockerNetworkConnect:               true,
+		portainer.OperationDockerNetworkDisconnect:            true,
+		portainer.OperationDockerNetworkDelete:                true,
+		portainer.OperationDockerVolumeList:                   true,
+		portainer.OperationDockerVolumeInspect:                true,
+		portainer.OperationDockerVolumeCreate:                 true,
+		portainer.OperationDockerVolumeDelete:                 true,
+		portainer.OperationDockerExecInspect:                  true,
+		portainer.OperationDockerExecStart:                    true,
+		portainer.OperationDockerExecResize:                   true,
+		portainer.OperationDockerSwarmInspect:                 true,
+		portainer.OperationDockerSwarmUnlockKey:               true,
+		portainer.OperationDockerSwarmInit:                    true,
+		portainer.OperationDockerSwarmJoin:                    true,
+		portainer.OperationDockerSwarmLeave:                   true,
+		portainer.OperationDockerSwarmUpdate:                  true,
+		portainer.OperationDockerSwarmUnlock:                  true,
+		portainer.OperationDockerNodeList:                     true,
+		portainer.OperationDockerNodeInspect:                  true,
+		portainer.OperationDockerNodeUpdate:                   true,
+		portainer.OperationDockerNodeDelete:                   true,
+		portainer.OperationDockerServiceList:                  true,
+		portainer.OperationDockerServiceInspect:               true,
+		portainer.OperationDockerServiceLogs:                  true,
+		portainer.OperationDockerServiceCreate:                true,
+		portainer.OperationDockerServiceUpdate:                true,
+		portainer.OperationDockerServiceDelete:                true,
+		portainer.OperationDockerSecretList:                   true,
+		portainer.OperationDockerSecretInspect:                true,
+		portainer.OperationDockerSecretCreate:                 true,
+		portainer.OperationDockerSecretUpdate:                 true,
+		portainer.OperationDockerSecretDelete:                 true,
+		portainer.OperationDockerConfigList:                   true,
+		portainer.OperationDockerConfigInspect:                true,
+		portainer.OperationDockerConfigCreate:                 true,
+		portainer.OperationDockerConfigUpdate:                 true,
+		portainer.OperationDockerConfigDelete:                 true,
+		portainer.OperationDockerTaskList:                     true,
+		portainer.OperationDockerTaskInspect:                  true,
+		portainer.OperationDockerTaskLogs:                     true,
+		portainer.OperationDockerPluginList:                   true,
+		portainer.OperationDockerPluginPrivileges:             true,
+		portainer.OperationDockerPluginInspect:                true,
+		portainer.OperationDockerPluginPull:                   true,
+		portainer.OperationDockerPluginCreate:                 true,
+		portainer.OperationDockerPluginEnable:                 true,
+		portainer.OperationDockerPluginDisable:                true,
+		portainer.OperationDockerPluginPush:                   true,
+		portainer.OperationDockerPluginUpgrade:                true,
+		portainer.OperationDockerPluginSet:                    true,
+		portainer.OperationDockerPluginDelete:                 true,
+		portainer.OperationDockerSessionStart:                 true,
+		portainer.OperationDockerDistributionInspect:          true,
+		portainer.OperationDockerBuildPrune:                   true,
+		portainer.OperationDockerBuildCancel:                  true,
+		portainer.OperationDockerPing:                         true,
+		portainer.OperationDockerInfo:                         true,
+		portainer.OperationDockerVersion:                      true,
+		portainer.OperationDockerEvents:                       true,
+		portainer.OperationDockerSystem:                       true,
+		portainer.OperationDockerUndefined:                    true,
+		portainer.OperationDockerAgentPing:                    true,
+		portainer.OperationDockerAgentList:                    true,
+		portainer.OperationDockerAgentHostInfo:                true,
+		portainer.OperationDockerAgentUndefined:               true,
+		portainer.OperationPortainerResourceControlUpdate:     true,
+		portainer.OperationPortainerStackList:                 true,
+		portainer.OperationPortainerStackInspect:              true,
+		portainer.OperationPortainerStackFile:                 true,
+		portainer.OperationPortainerStackCreate:               true,
+		portainer.OperationPortainerStackMigrate:              true,
+		portainer.OperationPortainerStackUpdate:               true,
+		portainer.OperationPortainerStackDelete:               true,
+		portainer.OperationPortainerWebsocketExec:             true,
+		portainer.OperationPortainerWebhookList:               true,
+		portainer.OperationPortainerWebhookCreate:             true,
+	}
+
+	if volumeBrowsingAuthorizations {
+		authorizations[portainer.OperationDockerAgentBrowseGet] = true
+		authorizations[portainer.OperationDockerAgentBrowseList] = true
+		authorizations[portainer.OperationDockerAgentBrowseDelete] = true
+		authorizations[portainer.OperationDockerAgentBrowsePut] = true
+		authorizations[portainer.OperationDockerAgentBrowseRename] = true
+	}
+
+	return authorizations
+}
+
+// DefaultEndpointAuthorizationsForReadOnlyUserRole returns the default environment(endpoint) authorizations
+// associated to the readonly user role.
+func DefaultEndpointAuthorizationsForReadOnlyUserRole(volumeBrowsingAuthorizations bool) portainer.Authorizations {
+	authorizations := map[portainer.Authorization]bool{
+		portainer.OperationDockerContainerArchiveInfo: true,
+		portainer.OperationDockerContainerList:        true,
+		portainer.OperationDockerContainerChanges:     true,
+		portainer.OperationDockerContainerInspect:     true,
+		portainer.OperationDockerContainerTop:         true,
+		portainer.OperationDockerContainerLogs:        true,
+		portainer.OperationDockerContainerStats:       true,
+		portainer.OperationDockerImageList:            true,
+		portainer.OperationDockerImageSearch:          true,
+		portainer.OperationDockerImageGetAll:          true,
+		portainer.OperationDockerImageGet:             true,
+		portainer.OperationDockerImageHistory:         true,
+		portainer.OperationDockerImageInspect:         true,
+		portainer.OperationDockerNetworkList:          true,
+		portainer.OperationDockerNetworkInspect:       true,
+		portainer.OperationDockerVolumeList:           true,
+		portainer.OperationDockerVolumeInspect:        true,
+		portainer.OperationDockerSwarmInspect:         true,
+		portainer.OperationDockerNodeList:             true,
+		portainer.OperationDockerNodeInspect:          true,
+		portainer.OperationDockerServiceList:          true,
+		portainer.OperationDockerServiceInspect:       true,
+		portainer.OperationDockerServiceLogs:          true,
+		portainer.OperationDockerSecretList:           true,
+		portainer.OperationDockerSecretInspect:        true,
+		portainer.OperationDockerConfigList:           true,
+		portainer.OperationDockerConfigInspect:        true,
+		portainer.OperationDockerTaskList:             true,
+		portainer.OperationDockerTaskInspect:          true,
+		portainer.OperationDockerTaskLogs:             true,
+		portainer.OperationDockerPluginList:           true,
+		portainer.OperationDockerDistributionInspect:  true,
+		portainer.OperationDockerPing:                 true,
+		portainer.OperationDockerInfo:                 true,
+		portainer.OperationDockerVersion:              true,
+		portainer.OperationDockerEvents:               true,
+		portainer.OperationDockerSystem:               true,
+		portainer.OperationDockerAgentPing:            true,
+		portainer.OperationDockerAgentList:            true,
+		portainer.OperationDockerAgentHostInfo:        true,
+		portainer.OperationPortainerStackList:         true,
+		portainer.OperationPortainerStackInspect:      true,
+		portainer.OperationPortainerStackFile:         true,
+		portainer.OperationPortainerWebhookList:       true,
+	}
+
+	if volumeBrowsingAuthorizations {
+		authorizations[portainer.OperationDockerAgentBrowseGet] = true
+		authorizations[portainer.OperationDockerAgentBrowseList] = true
+	}
+
+	return authorizations
+}
+
+// DefaultPortainerAuthorizations returns the default Portainer authorizations used by non-admin users.
+func DefaultPortainerAuthorizations() portainer.Authorizations {
+	return map[portainer.Authorization]bool{
+		portainer.OperationPortainerDockerHubInspect:  true,
+		portainer.OperationPortainerEndpointGroupList: true,
+		portainer.OperationPortainerEndpointList:      true,
+		portainer.OperationPortainerEndpointInspect:   true,
+		portainer.OperationPortainerMOTD:              true,
+		portainer.OperationPortainerRegistryList:      true,
+		portainer.OperationPortainerRegistryInspect:   true,
+		portainer.OperationPortainerTeamList:          true,
+		portainer.OperationPortainerTemplateList:      true,
+		portainer.OperationPortainerTemplateInspect:   true,
+		portainer.OperationPortainerUserList:          true,
+		portainer.OperationPortainerUserInspect:       true,
+		portainer.OperationPortainerUserMemberships:   true,
+		portainer.OperationPortainerUserListToken:     true,
+		portainer.OperationPortainerUserCreateToken:   true,
+		portainer.OperationPortainerUserRevokeToken:   true,
+	}
+}
+
+// RemoveTeamAccessPolicies will remove all existing access policies associated to the specified team
+func (service *Service) RemoveTeamAccessPolicies(tx dataservices.DataStoreTx, teamID portainer.TeamID) error {
+	endpoints, err := tx.Endpoint().Endpoints()
+	if err != nil {
+		return err
+	}
+	for _, endpoint := range endpoints {
+		for policyTeamID := range endpoint.TeamAccessPolicies {
+			if policyTeamID == teamID {
+				delete(endpoint.TeamAccessPolicies, policyTeamID)
+
+				err := tx.Endpoint().UpdateEndpoint(endpoint.ID, &endpoint)
+				if err != nil {
+					return err
+				}
+
+				break
+			}
+		}
+	}
+
+	endpointGroups, err := tx.EndpointGroup().ReadAll()
+	if err != nil {
+		return err
+	}
+
+	for _, endpointGroup := range endpointGroups {
+		for policyTeamID := range endpointGroup.TeamAccessPolicies {
+			if policyTeamID == teamID {
+				delete(endpointGroup.TeamAccessPolicies, policyTeamID)
+
+				err := tx.EndpointGroup().Update(endpointGroup.ID, &endpointGroup)
+				if err != nil {
+					return err
+				}
+
+				break
+			}
+		}
+	}
+
+	registries, err := tx.Registry().ReadAll()
+	if err != nil {
+		return err
+	}
+
+	// iterate over all environments for all registries
+	// and evict all direct accesses to the registries the team had
+	// we could have built a range of the teams's environments accesses while removing them above
+	// but ranging over all environments (registryAccessPolicy is indexed by environmentId)
+	// makes sure we cleanup all resources in case an access was not removed when a team was removed from an env
+	for _, registry := range registries {
+		updateRegistry := false
+		for _, registryAccessPolicy := range registry.RegistryAccesses {
+			if _, ok := registryAccessPolicy.TeamAccessPolicies[teamID]; ok {
+				delete(registryAccessPolicy.TeamAccessPolicies, teamID)
+				updateRegistry = true
+			}
+		}
+		if updateRegistry {
+			if err := tx.Registry().Update(registry.ID, &registry); err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
+
+// RemoveUserAccessPolicies will remove all existing access policies associated to the specified user
+func (service *Service) RemoveUserAccessPolicies(tx dataservices.DataStoreTx, userID portainer.UserID) error {
+	endpoints, err := tx.Endpoint().Endpoints()
+	if err != nil {
+		return err
+	}
+
+	for _, endpoint := range endpoints {
+		for policyUserID := range endpoint.UserAccessPolicies {
+			if policyUserID == userID {
+				delete(endpoint.UserAccessPolicies, policyUserID)
+
+				err := tx.Endpoint().UpdateEndpoint(endpoint.ID, &endpoint)
+				if err != nil {
+					return err
+				}
+
+				break
+			}
+		}
+	}
+
+	endpointGroups, err := tx.EndpointGroup().ReadAll()
+	if err != nil {
+		return err
+	}
+
+	for _, endpointGroup := range endpointGroups {
+		for policyUserID := range endpointGroup.UserAccessPolicies {
+			if policyUserID == userID {
+				delete(endpointGroup.UserAccessPolicies, policyUserID)
+
+				err := tx.EndpointGroup().Update(endpointGroup.ID, &endpointGroup)
+				if err != nil {
+					return err
+				}
+
+				break
+			}
+		}
+	}
+
+	registries, err := tx.Registry().ReadAll()
+	if err != nil {
+		return err
+	}
+
+	// iterate over all environments for all registries
+	// and evict all direct accesses to the registries the user had
+	// we could have built a range of the user's environments accesses while removing them above
+	// but ranging over all environments (registryAccessPolicy is indexed by environmentId)
+	// makes sure we cleanup all resources in case an access was not removed when a user was removed from an env
+	for _, registry := range registries {
+		updateRegistry := false
+		for _, registryAccessPolicy := range registry.RegistryAccesses {
+			if _, ok := registryAccessPolicy.UserAccessPolicies[userID]; ok {
+				delete(registryAccessPolicy.UserAccessPolicies, userID)
+				updateRegistry = true
+			}
+		}
+		if updateRegistry {
+			if err := tx.Registry().Update(registry.ID, &registry); err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
+
+// UpdateUsersAuthorizations is a no-op kept for backward compatibility with database migrations.
+//
+// Deprecated: This function previously populated the User.EndpointAuthorizations field which is
+// no longer used. Authorization is now computed dynamically via ResolveUserEndpointAccess.
+func (service *Service) UpdateUsersAuthorizations() error {
+	return nil
+}
+
+func (service *Service) UserIsAdminOrAuthorized(tx dataservices.DataStoreTx, userID portainer.UserID, endpointID portainer.EndpointID, authorizations []portainer.Authorization) (bool, error) {
+	user, err := tx.User().Read(userID)
+	if err != nil {
+		return false, err
+	}
+
+	if user.Role == portainer.AdministratorRole {
+		return true, nil
+	}
+
+	for _, authorization := range authorizations {
+		_, authorized := user.EndpointAuthorizations[endpointID][authorization]
+		if authorized {
+			return true, nil
+		}
+	}
+
+	return false, nil
+}
diff --git a/api/internal/authorization/endpoint_role_with_override.go b/api/internal/authorization/endpoint_role_with_override.go
new file mode 100644
index 0000000..750c5f4
--- /dev/null
+++ b/api/internal/authorization/endpoint_role_with_override.go
@@ -0,0 +1,131 @@
+package authorization
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+)
+
+// CleanNAPWithOverridePolicies Clean Namespace Access Policies with override policies
+func (service *Service) CleanNAPWithOverridePolicies(
+	tx dataservices.DataStoreTx,
+	endpoint *portainer.Endpoint,
+	endpointGroup *portainer.EndpointGroup,
+) error {
+	kubecli, err := service.K8sClientFactory.GetPrivilegedKubeClient(endpoint)
+	if err != nil {
+		return err
+	}
+
+	accessPolicies, err := kubecli.GetNamespaceAccessPolicies()
+	if err != nil {
+		return err
+	}
+
+	hasChange := false
+
+	for namespace, policy := range accessPolicies {
+		for teamID := range policy.TeamAccessPolicies {
+			access, err := service.getTeamEndpointAccessWithPolicies(tx, teamID, endpoint, endpointGroup)
+			if err != nil {
+				return err
+			}
+
+			if !access {
+				delete(accessPolicies[namespace].TeamAccessPolicies, teamID)
+				hasChange = true
+			}
+		}
+
+		for userID := range policy.UserAccessPolicies {
+			access, err := service.getUserEndpointAccessWithPolicies(tx, userID, endpoint, endpointGroup)
+			if err != nil {
+				return err
+			}
+
+			if !access {
+				delete(accessPolicies[namespace].UserAccessPolicies, userID)
+				hasChange = true
+			}
+		}
+	}
+
+	if hasChange {
+		return kubecli.UpdateNamespaceAccessPolicies(accessPolicies)
+	}
+
+	return nil
+}
+
+func (service *Service) getUserEndpointAccessWithPolicies(
+	tx dataservices.DataStoreTx,
+	userID portainer.UserID,
+	endpoint *portainer.Endpoint,
+	endpointGroup *portainer.EndpointGroup,
+) (bool, error) {
+	memberships, err := tx.TeamMembership().TeamMembershipsByUserID(userID)
+	if err != nil {
+		return false, err
+	}
+
+	if endpointGroup == nil {
+		endpointGroup, err = tx.EndpointGroup().Read(endpoint.GroupID)
+		if err != nil {
+			return false, err
+		}
+	}
+
+	return userAccess(userID, endpoint.UserAccessPolicies, endpoint.TeamAccessPolicies, memberships) ||
+		userAccess(userID, endpointGroup.UserAccessPolicies, endpointGroup.TeamAccessPolicies, memberships), nil
+}
+
+func userAccess(
+	userID portainer.UserID,
+	userAccessPolicies portainer.UserAccessPolicies,
+	teamAccessPolicies portainer.TeamAccessPolicies,
+	memberships []portainer.TeamMembership,
+) bool {
+	if _, ok := userAccessPolicies[userID]; ok {
+		return true
+	}
+
+	for _, membership := range memberships {
+		if _, ok := teamAccessPolicies[membership.TeamID]; ok {
+			return true
+		}
+	}
+
+	return false
+}
+
+func (service *Service) getTeamEndpointAccessWithPolicies(
+	tx dataservices.DataStoreTx,
+	teamID portainer.TeamID,
+	endpoint *portainer.Endpoint,
+	endpointGroup *portainer.EndpointGroup,
+) (bool, error) {
+	if endpointGroup == nil {
+		var err error
+		endpointGroup, err = tx.EndpointGroup().Read(endpoint.GroupID)
+		if err != nil {
+			return false, err
+		}
+	}
+
+	if teamAccess(teamID, endpoint.TeamAccessPolicies) {
+		return true, nil
+	}
+
+	if teamAccess(teamID, endpointGroup.TeamAccessPolicies) {
+		return true, nil
+	}
+
+	return false, nil
+}
+
+func teamAccess(
+	teamID portainer.TeamID,
+	teamAccessPolicies portainer.TeamAccessPolicies,
+) bool {
+	_, ok := teamAccessPolicies[teamID]
+	return ok
+}
diff --git a/api/internal/edge/cache/cache.go b/api/internal/edge/cache/cache.go
new file mode 100644
index 0000000..26b99eb
--- /dev/null
+++ b/api/internal/edge/cache/cache.go
@@ -0,0 +1,26 @@
+package cache
+
+import (
+	"strconv"
+
+	"github.com/VictoriaMetrics/fastcache"
+	portainer "github.com/portainer/portainer/api"
+)
+
+var c = fastcache.New(1)
+
+func key(k portainer.EndpointID) []byte {
+	return []byte(strconv.Itoa(int(k)))
+}
+
+func Set(k portainer.EndpointID, v []byte) {
+	c.Set(key(k), v)
+}
+
+func Get(k portainer.EndpointID) ([]byte, bool) {
+	return c.HasGet(nil, key(k))
+}
+
+func Del(k portainer.EndpointID) {
+	c.Del(key(k))
+}
diff --git a/api/internal/edge/edgegroup.go b/api/internal/edge/edgegroup.go
new file mode 100644
index 0000000..b9a1b89
--- /dev/null
+++ b/api/internal/edge/edgegroup.go
@@ -0,0 +1,95 @@
+package edge
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+	"github.com/portainer/portainer/api/roar"
+	"github.com/portainer/portainer/api/tag"
+)
+
+// EdgeGroupRelatedEndpoints returns a list of environments(endpoints) related to this Edge group
+func EdgeGroupRelatedEndpoints(edgeGroup *portainer.EdgeGroup, endpoints []portainer.Endpoint, endpointGroups []portainer.EndpointGroup) []portainer.EndpointID {
+	if !edgeGroup.Dynamic {
+		var r roar.Roar[portainer.EndpointID]
+
+		for _, endpoint := range endpoints {
+			if edgeGroup.EndpointIDs.Contains(endpoint.ID) {
+				r.Add(endpoint.ID)
+			}
+		}
+
+		return r.ToSlice()
+	}
+
+	endpointGroupsMap := map[portainer.EndpointGroupID]*portainer.EndpointGroup{}
+	for i, group := range endpointGroups {
+		endpointGroupsMap[group.ID] = &endpointGroups[i]
+	}
+
+	endpointIDs := []portainer.EndpointID{}
+	for _, endpoint := range endpoints {
+		if !endpointutils.IsEdgeEndpoint(&endpoint) {
+			continue
+		}
+
+		endpointGroup := endpointGroupsMap[endpoint.GroupID]
+		if edgeGroupRelatedToEndpoint(edgeGroup, &endpoint, endpointGroup) {
+			endpointIDs = append(endpointIDs, endpoint.ID)
+		}
+	}
+
+	return endpointIDs
+}
+
+func EdgeGroupSet(edgeGroupIDs []portainer.EdgeGroupID) map[portainer.EdgeGroupID]bool {
+	set := map[portainer.EdgeGroupID]bool{}
+
+	for _, edgeGroupID := range edgeGroupIDs {
+		set[edgeGroupID] = true
+	}
+
+	return set
+}
+
+func GetEndpointsFromEdgeGroups(edgeGroupIDs []portainer.EdgeGroupID, datastore dataservices.DataStoreTx) ([]portainer.EndpointID, error) {
+	endpoints, err := datastore.Endpoint().Endpoints()
+	if err != nil {
+		return nil, err
+	}
+
+	endpointGroups, err := datastore.EndpointGroup().ReadAll()
+	if err != nil {
+		return nil, err
+	}
+
+	var response []portainer.EndpointID
+	for _, edgeGroupID := range edgeGroupIDs {
+		edgeGroup, err := datastore.EdgeGroup().Read(edgeGroupID)
+		if err != nil {
+			return nil, err
+		}
+
+		response = append(response, EdgeGroupRelatedEndpoints(edgeGroup, endpoints, endpointGroups)...)
+	}
+
+	return response, nil
+}
+
+// edgeGroupRelatedToEndpoint returns true if edgeGroup is associated with environment(endpoint)
+func edgeGroupRelatedToEndpoint(edgeGroup *portainer.EdgeGroup, endpoint *portainer.Endpoint, endpointGroup *portainer.EndpointGroup) bool {
+	if !edgeGroup.Dynamic {
+		return edgeGroup.EndpointIDs.Contains(endpoint.ID)
+	}
+
+	endpointTags := tag.Set(endpoint.TagIDs)
+	if endpointGroup != nil && endpointGroup.TagIDs != nil {
+		endpointTags = tag.Union(endpointTags, tag.Set(endpointGroup.TagIDs))
+	}
+
+	if edgeGroup.PartialMatch {
+		return tag.PartialMatch(edgeGroup.TagIDs, endpointTags)
+	}
+
+	return tag.FullMatch(edgeGroup.TagIDs, endpointTags)
+}
diff --git a/api/internal/edge/edgegroup_benchmark_test.go b/api/internal/edge/edgegroup_benchmark_test.go
new file mode 100644
index 0000000..861db09
--- /dev/null
+++ b/api/internal/edge/edgegroup_benchmark_test.go
@@ -0,0 +1,104 @@
+package edge
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/roar"
+
+	"github.com/rs/zerolog"
+	"github.com/stretchr/testify/require"
+)
+
+const n = 1_000_000
+
+func BenchmarkWriteEdgeGroupOld(b *testing.B) {
+	zerolog.SetGlobalLevel(zerolog.ErrorLevel)
+
+	_, store := datastore.MustNewTestStore(b, false, false)
+
+	var endpointIDs []portainer.EndpointID
+
+	for i := range n {
+		endpointIDs = append(endpointIDs, portainer.EndpointID(i+1))
+	}
+
+	for b.Loop() {
+		err := store.EdgeGroup().Create(&portainer.EdgeGroup{
+			Name:      "Test Edge Group",
+			Endpoints: endpointIDs,
+		})
+		require.NoError(b, err)
+	}
+}
+
+func BenchmarkWriteEdgeGroupNew(b *testing.B) {
+	zerolog.SetGlobalLevel(zerolog.ErrorLevel)
+
+	_, store := datastore.MustNewTestStore(b, false, false)
+
+	var ts []portainer.EndpointID
+
+	for i := range n {
+		ts = append(ts, portainer.EndpointID(i+1))
+	}
+
+	endpointIDs := roar.FromSlice(ts)
+
+	for b.Loop() {
+		err := store.EdgeGroup().Create(&portainer.EdgeGroup{
+			Name:        "Test Edge Group",
+			EndpointIDs: endpointIDs,
+		})
+		require.NoError(b, err)
+	}
+}
+
+func BenchmarkReadEdgeGroupOld(b *testing.B) {
+	zerolog.SetGlobalLevel(zerolog.ErrorLevel)
+
+	_, store := datastore.MustNewTestStore(b, false, false)
+
+	var endpointIDs []portainer.EndpointID
+
+	for i := range n {
+		endpointIDs = append(endpointIDs, portainer.EndpointID(i+1))
+	}
+
+	err := store.EdgeGroup().Create(&portainer.EdgeGroup{
+		Name:      "Test Edge Group",
+		Endpoints: endpointIDs,
+	})
+	require.NoError(b, err)
+
+	for b.Loop() {
+		_, err := store.EdgeGroup().ReadAll()
+		require.NoError(b, err)
+	}
+}
+
+func BenchmarkReadEdgeGroupNew(b *testing.B) {
+	zerolog.SetGlobalLevel(zerolog.ErrorLevel)
+
+	_, store := datastore.MustNewTestStore(b, false, false)
+
+	var ts []portainer.EndpointID
+
+	for i := range n {
+		ts = append(ts, portainer.EndpointID(i+1))
+	}
+
+	endpointIDs := roar.FromSlice(ts)
+
+	err := store.EdgeGroup().Create(&portainer.EdgeGroup{
+		Name:        "Test Edge Group",
+		EndpointIDs: endpointIDs,
+	})
+	require.NoError(b, err)
+
+	for b.Loop() {
+		_, err := store.EdgeGroup().ReadAll()
+		require.NoError(b, err)
+	}
+}
diff --git a/api/internal/edge/edgestack.go b/api/internal/edge/edgestack.go
new file mode 100644
index 0000000..2e97066
--- /dev/null
+++ b/api/internal/edge/edgestack.go
@@ -0,0 +1,67 @@
+package edge
+
+import (
+	"errors"
+	"fmt"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/slicesx"
+)
+
+var ErrEdgeGroupNotFound = errors.New("edge group was not found")
+
+// EdgeStackRelatedEndpoints returns a list of environments(endpoints) related to this Edge stack
+func EdgeStackRelatedEndpoints(edgeGroupIDs []portainer.EdgeGroupID, endpoints []portainer.Endpoint, endpointGroups []portainer.EndpointGroup, edgeGroups []portainer.EdgeGroup) ([]portainer.EndpointID, error) {
+	edgeStackEndpoints := []portainer.EndpointID{}
+
+	for _, edgeGroupID := range edgeGroupIDs {
+		var edgeGroup *portainer.EdgeGroup
+
+		for _, group := range edgeGroups {
+			if group.ID == edgeGroupID {
+				edgeGroup = &group
+
+				break
+			}
+		}
+
+		if edgeGroup == nil {
+			return nil, ErrEdgeGroupNotFound
+		}
+
+		edgeStackEndpoints = append(edgeStackEndpoints, EdgeGroupRelatedEndpoints(edgeGroup, endpoints, endpointGroups)...)
+	}
+
+	return slicesx.Unique(edgeStackEndpoints), nil
+}
+
+type EndpointRelationsConfig struct {
+	Endpoints      []portainer.Endpoint
+	EndpointGroups []portainer.EndpointGroup
+	EdgeGroups     []portainer.EdgeGroup
+}
+
+// FetchEndpointRelationsConfig fetches config needed for Edge Stack related endpoints
+func FetchEndpointRelationsConfig(tx dataservices.DataStoreTx) (*EndpointRelationsConfig, error) {
+	endpoints, err := tx.Endpoint().Endpoints()
+	if err != nil {
+		return nil, fmt.Errorf("unable to retrieve environments from database: %w", err)
+	}
+
+	endpointGroups, err := tx.EndpointGroup().ReadAll()
+	if err != nil {
+		return nil, fmt.Errorf("unable to retrieve environment groups from database: %w", err)
+	}
+
+	edgeGroups, err := tx.EdgeGroup().ReadAll()
+	if err != nil {
+		return nil, fmt.Errorf("unable to retrieve edge groups from database: %w", err)
+	}
+
+	return &EndpointRelationsConfig{
+		Endpoints:      endpoints,
+		EndpointGroups: endpointGroups,
+		EdgeGroups:     edgeGroups,
+	}, nil
+}
diff --git a/api/internal/edge/edgestacks/service.go b/api/internal/edge/edgestacks/service.go
new file mode 100644
index 0000000..35215aa
--- /dev/null
+++ b/api/internal/edge/edgestacks/service.go
@@ -0,0 +1,170 @@
+package edgestacks
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	httperrors "github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/api/internal/edge"
+	edgetypes "github.com/portainer/portainer/api/internal/edge/types"
+
+	"github.com/pkg/errors"
+)
+
+// Service represents a service for managing edge stacks.
+type Service struct {
+	dataStore dataservices.DataStore
+}
+
+// NewService returns a new instance of a service.
+func NewService(dataStore dataservices.DataStore) *Service {
+	return &Service{
+		dataStore: dataStore,
+	}
+}
+
+// BuildEdgeStack builds the initial edge stack object
+// PersistEdgeStack is required to be called after this to persist the edge stack
+func (service *Service) BuildEdgeStack(
+	tx dataservices.DataStoreTx,
+	name string,
+	deploymentType portainer.EdgeStackDeploymentType,
+	edgeGroups []portainer.EdgeGroupID,
+	registries []portainer.RegistryID,
+	useManifestNamespaces bool,
+) (*portainer.EdgeStack, error) {
+	if err := validateUniqueName(tx.EdgeStack().EdgeStacks, name); err != nil {
+		return nil, err
+	}
+
+	stackID := tx.EdgeStack().GetNextIdentifier()
+
+	return &portainer.EdgeStack{
+		ID:                    portainer.EdgeStackID(stackID),
+		Name:                  name,
+		DeploymentType:        deploymentType,
+		CreationDate:          time.Now().Unix(),
+		EdgeGroups:            edgeGroups,
+		Version:               1,
+		UseManifestNamespaces: useManifestNamespaces,
+	}, nil
+}
+
+func validateUniqueName(edgeStacksGetter func() ([]portainer.EdgeStack, error), name string) error {
+	edgeStacks, err := edgeStacksGetter()
+	if err != nil {
+		return err
+	}
+
+	for _, stack := range edgeStacks {
+		if strings.EqualFold(stack.Name, name) {
+			return httperrors.NewConflictError("Edge stack name must be unique")
+		}
+	}
+
+	return nil
+}
+
+// PersistEdgeStack persists the edge stack in the database and its relations
+func (service *Service) PersistEdgeStack(
+	tx dataservices.DataStoreTx,
+	stack *portainer.EdgeStack,
+	storeManifest edgetypes.StoreManifestFunc) (*portainer.EdgeStack, error) {
+
+	relationConfig, err := edge.FetchEndpointRelationsConfig(tx)
+	if err != nil {
+		return nil, fmt.Errorf("unable to find environment relations in database: %w", err)
+	}
+
+	relatedEndpointIds, err := edge.EdgeStackRelatedEndpoints(stack.EdgeGroups, relationConfig.Endpoints, relationConfig.EndpointGroups, relationConfig.EdgeGroups)
+	if err != nil {
+		if errors.Is(err, edge.ErrEdgeGroupNotFound) {
+			return nil, httperrors.NewInvalidPayloadError(err.Error())
+		}
+
+		return nil, fmt.Errorf("unable to persist environment relation in database: %w", err)
+	}
+
+	stackFolder := strconv.Itoa(int(stack.ID))
+	composePath, manifestPath, projectPath, err := storeManifest(stackFolder, relatedEndpointIds)
+	if err != nil {
+		return nil, fmt.Errorf("unable to store manifest: %w", err)
+	}
+
+	stack.ManifestPath = manifestPath
+	stack.ProjectPath = projectPath
+	stack.EntryPoint = composePath
+
+	if err := tx.EdgeStack().Create(stack.ID, stack); err != nil {
+		return nil, err
+	}
+
+	for _, endpointID := range relatedEndpointIds {
+		status := &portainer.EdgeStackStatusForEnv{EndpointID: endpointID}
+
+		if err := tx.EdgeStackStatus().Create(stack.ID, endpointID, status); err != nil {
+			return nil, err
+		}
+	}
+
+	if err := tx.EndpointRelation().AddEndpointRelationsForEdgeStack(relatedEndpointIds, stack); err != nil {
+		return nil, fmt.Errorf("unable to add endpoint relations: %w", err)
+	}
+
+	if err := service.updateEndpointRelations(tx, stack.ID, relatedEndpointIds); err != nil {
+		return nil, fmt.Errorf("unable to update endpoint relations: %w", err)
+	}
+
+	return stack, nil
+}
+
+// updateEndpointRelations adds a relation between the Edge Stack to the related environments(endpoints)
+func (service *Service) updateEndpointRelations(tx dataservices.DataStoreTx, edgeStackID portainer.EdgeStackID, relatedEndpointIds []portainer.EndpointID) error {
+	endpointRelationService := tx.EndpointRelation()
+
+	for _, endpointID := range relatedEndpointIds {
+		relation, err := endpointRelationService.EndpointRelation(endpointID)
+		if err != nil {
+			return fmt.Errorf("unable to find endpoint relation in database: %w", err)
+		}
+
+		relation.EdgeStacks[edgeStackID] = true
+
+		if err := endpointRelationService.UpdateEndpointRelation(endpointID, relation); err != nil {
+			return fmt.Errorf("unable to persist endpoint relation in database: %w", err)
+		}
+	}
+
+	return nil
+}
+
+// DeleteEdgeStack deletes the edge stack from the database and its relations
+func (service *Service) DeleteEdgeStack(tx dataservices.DataStoreTx, edgeStackID portainer.EdgeStackID, relatedEdgeGroupsIds []portainer.EdgeGroupID) error {
+	relationConfig, err := edge.FetchEndpointRelationsConfig(tx)
+	if err != nil {
+		return errors.WithMessage(err, "Unable to retrieve environments relations config from database")
+	}
+
+	relatedEndpointIds, err := edge.EdgeStackRelatedEndpoints(relatedEdgeGroupsIds, relationConfig.Endpoints, relationConfig.EndpointGroups, relationConfig.EdgeGroups)
+	if err != nil {
+		return errors.WithMessage(err, "Unable to retrieve edge stack related environments from database")
+	}
+
+	if err := tx.EndpointRelation().RemoveEndpointRelationsForEdgeStack(relatedEndpointIds, edgeStackID); err != nil {
+		return errors.WithMessage(err, "unable to remove environment relation in database")
+	}
+
+	if err := tx.EdgeStack().DeleteEdgeStack(edgeStackID); err != nil {
+		return errors.WithMessage(err, "Unable to remove the edge stack from the database")
+	}
+
+	if err := tx.EdgeStackStatus().DeleteAll(edgeStackID); err != nil {
+		return errors.WithMessage(err, "unable to remove edge stack statuses from the database")
+	}
+
+	return nil
+}
diff --git a/api/internal/edge/edgestacks/service_test.go b/api/internal/edge/edgestacks/service_test.go
new file mode 100644
index 0000000..8978c54
--- /dev/null
+++ b/api/internal/edge/edgestacks/service_test.go
@@ -0,0 +1,42 @@
+package edgestacks
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_updateEndpointRelation_successfulRuns(t *testing.T) {
+	t.Parallel()
+	edgeStackID := portainer.EdgeStackID(5)
+	endpointRelations := []portainer.EndpointRelation{
+		{EndpointID: 1, EdgeStacks: map[portainer.EdgeStackID]bool{}},
+		{EndpointID: 2, EdgeStacks: map[portainer.EdgeStackID]bool{}},
+		{EndpointID: 3, EdgeStacks: map[portainer.EdgeStackID]bool{}},
+		{EndpointID: 4, EdgeStacks: map[portainer.EdgeStackID]bool{}},
+		{EndpointID: 5, EdgeStacks: map[portainer.EdgeStackID]bool{}},
+	}
+
+	relatedIds := []portainer.EndpointID{2, 3}
+
+	dataStore := testhelpers.NewDatastore(testhelpers.WithEndpointRelations(endpointRelations))
+
+	service := NewService(dataStore)
+
+	err := service.updateEndpointRelations(dataStore, edgeStackID, relatedIds)
+	require.NoError(t, err, "updateEndpointRelations should not fail")
+
+	relatedSet := map[portainer.EndpointID]bool{}
+	for _, relationID := range relatedIds {
+		relatedSet[relationID] = true
+	}
+
+	for _, relation := range endpointRelations {
+		shouldBeRelated := relatedSet[relation.EndpointID]
+		assert.Equal(t, shouldBeRelated, relation.EdgeStacks[edgeStackID])
+	}
+}
diff --git a/api/internal/edge/endpoint.go b/api/internal/edge/endpoint.go
new file mode 100644
index 0000000..7901b0e
--- /dev/null
+++ b/api/internal/edge/endpoint.go
@@ -0,0 +1,67 @@
+package edge
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+)
+
+// EndpointRelatedEdgeStacks returns a list of Edge stacks related to this Environment(Endpoint)
+func EndpointRelatedEdgeStacks(endpoint *portainer.Endpoint, endpointGroup *portainer.EndpointGroup, edgeGroups []portainer.EdgeGroup, edgeStacks []portainer.EdgeStack) []portainer.EdgeStackID {
+	relatedEdgeGroupsSet := map[portainer.EdgeGroupID]bool{}
+
+	for _, edgeGroup := range edgeGroups {
+		if edgeGroupRelatedToEndpoint(&edgeGroup, endpoint, endpointGroup) {
+			relatedEdgeGroupsSet[edgeGroup.ID] = true
+		}
+	}
+
+	relatedEdgeStacks := []portainer.EdgeStackID{}
+	for _, edgeStack := range edgeStacks {
+		for _, edgeGroupID := range edgeStack.EdgeGroups {
+			if relatedEdgeGroupsSet[edgeGroupID] {
+				relatedEdgeStacks = append(relatedEdgeStacks, edgeStack.ID)
+				break
+			}
+		}
+	}
+
+	return relatedEdgeStacks
+}
+
+func EffectiveCheckinInterval(tx dataservices.DataStoreTx, endpoint *portainer.Endpoint) int {
+	if endpoint.EdgeCheckinInterval != 0 {
+		return endpoint.EdgeCheckinInterval
+	}
+
+	if settings, err := tx.Settings().Settings(); err == nil {
+		return settings.EdgeAgentCheckinInterval
+	}
+
+	return portainer.DefaultEdgeAgentCheckinIntervalInSeconds
+}
+
+// EndpointInEdgeGroup returns true and the edge group name if the endpoint is in the edge group
+func EndpointInEdgeGroup(
+	tx dataservices.DataStoreTx,
+	endpoint *portainer.Endpoint,
+	edgeGroupID portainer.EdgeGroupID,
+	endpointGroups []portainer.EndpointGroup,
+) (bool, string, error) {
+	if !endpointutils.IsEdgeEndpoint(endpoint) || !endpoint.UserTrusted {
+		return false, "", nil
+	}
+
+	edgeGroup, err := tx.EdgeGroup().Read(edgeGroupID)
+	if err != nil {
+		return false, "", err
+	}
+
+	r := EdgeGroupRelatedEndpoints(edgeGroup, []portainer.Endpoint{*endpoint}, endpointGroups)
+
+	if len(r) > 0 {
+		return true, edgeGroup.Name, nil
+	}
+
+	return false, "", nil
+}
diff --git a/api/internal/edge/endpoint_test.go b/api/internal/edge/endpoint_test.go
new file mode 100644
index 0000000..3891c58
--- /dev/null
+++ b/api/internal/edge/endpoint_test.go
@@ -0,0 +1,83 @@
+package edge
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/roar"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestEndpointInEdgeGroup(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, true, false)
+
+	endpointGroups := []portainer.EndpointGroup{{ID: 1, Name: "test-group"}}
+
+	endpoint := &portainer.Endpoint{
+		ID:          1,
+		Name:        "test-endpoint",
+		Type:        portainer.EdgeAgentOnDockerEnvironment,
+		UserTrusted: true,
+		GroupID:     endpointGroups[0].ID,
+	}
+	edgeGroupID := portainer.EdgeGroupID(1)
+
+	untrustedEndpoint := &portainer.Endpoint{
+		ID:          2,
+		Name:        "untrusted-endpoint",
+		Type:        portainer.EdgeAgentOnDockerEnvironment,
+		UserTrusted: false,
+		GroupID:     endpointGroups[0].ID,
+	}
+
+	nonEdgeEndpoint := &portainer.Endpoint{
+		ID:          2,
+		Name:        "untrusted-endpoint",
+		Type:        portainer.AgentOnDockerEnvironment,
+		UserTrusted: true,
+		GroupID:     endpointGroups[0].ID,
+	}
+
+	err := store.EdgeGroup().Create(&portainer.EdgeGroup{
+		ID:          edgeGroupID,
+		Name:        "test-edge-group",
+		Dynamic:     false,
+		EndpointIDs: roar.FromSlice([]portainer.EndpointID{endpoint.ID, untrustedEndpoint.ID}),
+	})
+	require.NoError(t, err)
+
+	// Related endpoint in a static edge group
+
+	inEdgeGroup, _, err := EndpointInEdgeGroup(store, endpoint, edgeGroupID, endpointGroups)
+	require.NoError(t, err)
+	require.True(t, inEdgeGroup)
+
+	// Unrelated endpoint in a static edge group
+
+	unrelatedEndpoint := &portainer.Endpoint{
+		ID:          3,
+		Name:        "unrelated-endpoint",
+		Type:        portainer.EdgeAgentOnDockerEnvironment,
+		UserTrusted: true,
+		GroupID:     0,
+	}
+
+	inEdgeGroup, _, err = EndpointInEdgeGroup(store, unrelatedEndpoint, edgeGroupID, endpointGroups)
+	require.NoError(t, err)
+	require.False(t, inEdgeGroup)
+
+	// Untrusted endpoint
+
+	inEdgeGroup, _, err = EndpointInEdgeGroup(store, untrustedEndpoint, edgeGroupID, endpointGroups)
+	require.NoError(t, err)
+	require.False(t, inEdgeGroup)
+
+	// Non-edge endpoint
+
+	inEdgeGroup, _, err = EndpointInEdgeGroup(store, nonEdgeEndpoint, edgeGroupID, endpointGroups)
+	require.NoError(t, err)
+	require.False(t, inEdgeGroup)
+}
diff --git a/api/internal/edge/types/stacks.go b/api/internal/edge/types/stacks.go
new file mode 100644
index 0000000..e4b50ef
--- /dev/null
+++ b/api/internal/edge/types/stacks.go
@@ -0,0 +1,5 @@
+package types
+
+import portainer "github.com/portainer/portainer/api"
+
+type StoreManifestFunc func(stackFolder string, relatedEndpointIds []portainer.EndpointID) (composePath, manifestPath, projectPath string, err error)
diff --git a/api/internal/edge/url.go b/api/internal/edge/url.go
new file mode 100644
index 0000000..50ff44f
--- /dev/null
+++ b/api/internal/edge/url.go
@@ -0,0 +1,32 @@
+package edge
+
+import (
+	"net"
+	"net/url"
+
+	"github.com/pkg/errors"
+)
+
+// ParseHostForEdge returns the hostname of the given URL, will fail if host is localhost
+func ParseHostForEdge(portainerURL string) (string, error) {
+	parsedURL, err := url.Parse(portainerURL)
+	if err != nil {
+		return "", errors.Wrap(err, "Unable to parse Portainer URL")
+	}
+
+	portainerHost, _, err := net.SplitHostPort(parsedURL.Host)
+	if err != nil {
+		portainerHost = parsedURL.Host
+	}
+
+	if portainerHost == "" {
+		return "", errors.New("hostname cannot be empty")
+	}
+
+	if portainerHost == "localhost" {
+		return "", errors.New("cannot use localhost as environment URL")
+	}
+
+	return portainerHost, nil
+
+}
diff --git a/api/internal/endpointutils/endpoint_setup.go b/api/internal/endpointutils/endpoint_setup.go
new file mode 100644
index 0000000..13a3413
--- /dev/null
+++ b/api/internal/endpointutils/endpoint_setup.go
@@ -0,0 +1,151 @@
+package endpointutils
+
+import (
+	"context"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/client"
+
+	"github.com/rs/zerolog/log"
+)
+
+// InitEndpoint controls the workflow to initialize the primary endpoint.
+// When installing Portainer in a Docker Cluster using the yaml file provided in the official
+// documentation (https://docs.portainer.io/start/install/server/swarm/linux), the "primary"
+// endpoint is initialized before the admin user is created. This triggers the creation of a
+// snapshot of the environment in the background, which includes the agent saving the signature
+// from the first request made by the server. However, if a user restores Portainer from a backup
+// instead of creating a new admin user, the server will not be able to connect to the agent because
+// the saved signature will not match. To solve this issue, this solution proposes to wait for
+// the admin user to be created before initializing the primary endpoint. This way, the agent
+// will save the signature from the first request after the admin user is created, ensuring that
+// it matches in the event of a backup restoration.
+func InitEndpoint(shutdownCtx context.Context, adminCreationDone <-chan struct{}, flags *portainer.CLIFlags, dataStore dataservices.DataStore, snapshotService portainer.SnapshotService) {
+	select {
+	case <-shutdownCtx.Done():
+		log.Debug().Msg("shutdown endpoint initialization")
+
+	case <-adminCreationDone:
+		// Wait for the admin user to be created before initializing the primary endpoint
+		// The admin user can be created in two ways:
+		// 1. Using the CLI with the --admin-password flag
+		// 2. Using the API with the /api/users/admin/init endpoint
+		log.Debug().Msg("init primary endpoint")
+
+		if err := initEndpoint(flags, dataStore, snapshotService); err != nil {
+			log.Fatal().Err(err).Msg("failed initializing environment")
+		}
+	}
+}
+
+func initEndpoint(flags *portainer.CLIFlags, dataStore dataservices.DataStore, snapshotService portainer.SnapshotService) error {
+	if *flags.EndpointURL == "" {
+		return nil
+	}
+
+	endpoints, err := dataStore.Endpoint().Endpoints()
+	if err != nil {
+		return err
+	}
+
+	if len(endpoints) > 0 {
+		log.Info().Msg("instance already has defined environments, skipping the environment defined via CLI")
+
+		return nil
+	}
+
+	if *flags.TLS || *flags.TLSSkipVerify {
+		return createTLSSecuredEndpoint(flags, dataStore, snapshotService)
+	}
+
+	return createUnsecuredEndpoint(*flags.EndpointURL, dataStore, snapshotService)
+}
+
+func createTLSSecuredEndpoint(flags *portainer.CLIFlags, dataStore dataservices.DataStore, snapshotService portainer.SnapshotService) error {
+	tlsConfiguration := portainer.TLSConfiguration{
+		TLS:           *flags.TLS,
+		TLSSkipVerify: *flags.TLSSkipVerify,
+	}
+
+	if *flags.TLS {
+		tlsConfiguration.TLSCACertPath = *flags.TLSCacert
+		tlsConfiguration.TLSCertPath = *flags.TLSCert
+		tlsConfiguration.TLSKeyPath = *flags.TLSKey
+	} else if !*flags.TLS && *flags.TLSSkipVerify {
+		tlsConfiguration.TLS = true
+	}
+
+	endpointID := dataStore.Endpoint().GetNextIdentifier()
+	endpoint := &portainer.Endpoint{
+		ID:                 portainer.EndpointID(endpointID),
+		Name:               "primary",
+		URL:                *flags.EndpointURL,
+		GroupID:            portainer.EndpointGroupID(1),
+		Type:               portainer.DockerEnvironment,
+		TLSConfig:          tlsConfiguration,
+		UserAccessPolicies: portainer.UserAccessPolicies{},
+		TeamAccessPolicies: portainer.TeamAccessPolicies{},
+		TagIDs:             []portainer.TagID{},
+		Status:             portainer.EndpointStatusUp,
+		Snapshots:          []portainer.DockerSnapshot{},
+		Kubernetes:         portainer.KubernetesDefault(),
+		SecuritySettings:   portainer.DefaultEndpointSecuritySettings(),
+	}
+
+	if strings.HasPrefix(endpoint.URL, "tcp://") {
+		agentOnDockerEnvironment, err := client.ExecutePingOperation(endpoint.URL, tlsConfiguration)
+		if err != nil {
+			return err
+		}
+
+		if agentOnDockerEnvironment {
+			endpoint.Type = portainer.AgentOnDockerEnvironment
+		}
+	}
+
+	if err := snapshotService.SnapshotEndpoint(endpoint); err != nil {
+		log.Error().
+			Str("endpoint", endpoint.Name).
+			Str("URL", endpoint.URL).
+			Err(err).
+			Msg("environment snapshot error")
+	}
+
+	return dataStore.Endpoint().Create(endpoint)
+}
+
+func createUnsecuredEndpoint(endpointURL string, dataStore dataservices.DataStore, snapshotService portainer.SnapshotService) error {
+	if strings.HasPrefix(endpointURL, "tcp://") {
+		if _, err := client.ExecutePingOperation(endpointURL, portainer.TLSConfiguration{}); err != nil {
+			return err
+		}
+	}
+
+	endpointID := dataStore.Endpoint().GetNextIdentifier()
+	endpoint := &portainer.Endpoint{
+		ID:                 portainer.EndpointID(endpointID),
+		Name:               "primary",
+		URL:                endpointURL,
+		GroupID:            portainer.EndpointGroupID(1),
+		Type:               portainer.DockerEnvironment,
+		TLSConfig:          portainer.TLSConfiguration{},
+		UserAccessPolicies: portainer.UserAccessPolicies{},
+		TeamAccessPolicies: portainer.TeamAccessPolicies{},
+		TagIDs:             []portainer.TagID{},
+		Status:             portainer.EndpointStatusUp,
+		Snapshots:          []portainer.DockerSnapshot{},
+		Kubernetes:         portainer.KubernetesDefault(),
+		SecuritySettings:   portainer.DefaultEndpointSecuritySettings(),
+	}
+
+	if err := snapshotService.SnapshotEndpoint(endpoint); err != nil {
+		log.Error().
+			Str("endpoint", endpoint.Name).
+			Str("URL", endpoint.URL).Err(err).
+			Msg("environment snapshot error")
+	}
+
+	return dataStore.Endpoint().Create(endpoint)
+}
diff --git a/api/internal/endpointutils/endpoint_setup_test.go b/api/internal/endpointutils/endpoint_setup_test.go
new file mode 100644
index 0000000..5848a34
--- /dev/null
+++ b/api/internal/endpointutils/endpoint_setup_test.go
@@ -0,0 +1,13 @@
+package endpointutils
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestCreateOfflineUnsecuredEndpoint(t *testing.T) {
+	t.Parallel()
+	err := createUnsecuredEndpoint("tcp://localhost:1", nil, nil)
+	require.Error(t, err)
+}
diff --git a/api/internal/endpointutils/endpoint_tags.go b/api/internal/endpointutils/endpoint_tags.go
new file mode 100644
index 0000000..ab7e860
--- /dev/null
+++ b/api/internal/endpointutils/endpoint_tags.go
@@ -0,0 +1,83 @@
+package endpointutils
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/set"
+)
+
+// GetEndpointsByTags returns the trusted edge endpoints matching tagIDs, unioned if partialMatch
+// is set or intersected otherwise.
+func GetEndpointsByTags(tx dataservices.DataStoreTx, tagIDs []portainer.TagID, partialMatch bool) ([]portainer.EndpointID, error) {
+	if len(tagIDs) == 0 {
+		return []portainer.EndpointID{}, nil
+	}
+
+	endpoints, err := tx.Endpoint().Endpoints()
+	if err != nil {
+		return nil, err
+	}
+
+	groupEndpoints := mapEndpointGroupToEndpoints(endpoints)
+
+	tags := []portainer.Tag{}
+	for _, tagID := range tagIDs {
+		tag, err := tx.Tag().Read(tagID)
+		if err != nil {
+			return nil, err
+		}
+
+		tags = append(tags, *tag)
+	}
+
+	setsOfEndpoints := mapTagsToEndpoints(tags, groupEndpoints)
+
+	var endpointSet set.Set[portainer.EndpointID]
+	if partialMatch {
+		endpointSet = set.Union(setsOfEndpoints...)
+	} else {
+		endpointSet = set.Intersection(setsOfEndpoints...)
+	}
+
+	results := []portainer.EndpointID{}
+	for _, endpoint := range endpoints {
+		if endpointSet.Contains(endpoint.ID) && IsEdgeEndpoint(&endpoint) && endpoint.UserTrusted {
+			results = append(results, endpoint.ID)
+		}
+	}
+
+	return results, nil
+}
+
+func mapEndpointGroupToEndpoints(endpoints []portainer.Endpoint) map[portainer.EndpointGroupID]set.Set[portainer.EndpointID] {
+	groupEndpoints := map[portainer.EndpointGroupID]set.Set[portainer.EndpointID]{}
+
+	for _, endpoint := range endpoints {
+		groupID := endpoint.GroupID
+		if groupEndpoints[groupID] == nil {
+			groupEndpoints[groupID] = set.Set[portainer.EndpointID]{}
+		}
+
+		groupEndpoints[groupID].Add(endpoint.ID)
+	}
+
+	return groupEndpoints
+}
+
+func mapTagsToEndpoints(tags []portainer.Tag, groupEndpoints map[portainer.EndpointGroupID]set.Set[portainer.EndpointID]) []set.Set[portainer.EndpointID] {
+	sets := make([]set.Set[portainer.EndpointID], 0, len(tags))
+
+	for _, tag := range tags {
+		s := set.Set[portainer.EndpointID](tag.Endpoints)
+
+		for groupID := range tag.EndpointGroups {
+			for endpointID := range groupEndpoints[groupID] {
+				s.Add(endpointID)
+			}
+		}
+
+		sets = append(sets, s)
+	}
+
+	return sets
+}
diff --git a/api/internal/endpointutils/endpoint_test.go b/api/internal/endpointutils/endpoint_test.go
new file mode 100644
index 0000000..53ddc54
--- /dev/null
+++ b/api/internal/endpointutils/endpoint_test.go
@@ -0,0 +1,144 @@
+package endpointutils
+
+import (
+	"testing"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type isEndpointTypeTest struct {
+	endpointType portainer.EndpointType
+	expected     bool
+}
+
+func Test_IsDockerEndpoint(t *testing.T) {
+	t.Parallel()
+	tests := []isEndpointTypeTest{
+		{endpointType: portainer.DockerEnvironment, expected: true},
+		{endpointType: portainer.AgentOnDockerEnvironment, expected: true},
+		{endpointType: portainer.AzureEnvironment, expected: false},
+		{endpointType: portainer.EdgeAgentOnDockerEnvironment, expected: true},
+		{endpointType: portainer.KubernetesLocalEnvironment, expected: false},
+		{endpointType: portainer.AgentOnKubernetesEnvironment, expected: false},
+		{endpointType: portainer.EdgeAgentOnKubernetesEnvironment, expected: false},
+	}
+
+	for _, test := range tests {
+		ans := IsDockerEndpoint(&portainer.Endpoint{Type: test.endpointType})
+		assert.Equal(t, test.expected, ans)
+	}
+}
+
+func Test_IsKubernetesEndpoint(t *testing.T) {
+	t.Parallel()
+	tests := []isEndpointTypeTest{
+		{endpointType: portainer.DockerEnvironment, expected: false},
+		{endpointType: portainer.AgentOnDockerEnvironment, expected: false},
+		{endpointType: portainer.AzureEnvironment, expected: false},
+		{endpointType: portainer.EdgeAgentOnDockerEnvironment, expected: false},
+		{endpointType: portainer.KubernetesLocalEnvironment, expected: true},
+		{endpointType: portainer.AgentOnKubernetesEnvironment, expected: true},
+		{endpointType: portainer.EdgeAgentOnKubernetesEnvironment, expected: true},
+	}
+
+	for _, test := range tests {
+		ans := IsKubernetesEndpoint(&portainer.Endpoint{Type: test.endpointType})
+		assert.Equal(t, test.expected, ans)
+	}
+}
+
+func Test_IsAgentEndpoint(t *testing.T) {
+	t.Parallel()
+	tests := []isEndpointTypeTest{
+		{endpointType: portainer.DockerEnvironment, expected: false},
+		{endpointType: portainer.AgentOnDockerEnvironment, expected: true},
+		{endpointType: portainer.AzureEnvironment, expected: false},
+		{endpointType: portainer.EdgeAgentOnDockerEnvironment, expected: true},
+		{endpointType: portainer.KubernetesLocalEnvironment, expected: false},
+		{endpointType: portainer.AgentOnKubernetesEnvironment, expected: true},
+		{endpointType: portainer.EdgeAgentOnKubernetesEnvironment, expected: true},
+	}
+
+	for _, test := range tests {
+		ans := IsAgentEndpoint(&portainer.Endpoint{Type: test.endpointType})
+		assert.Equal(t, test.expected, ans)
+	}
+}
+
+func Test_FilterByExcludeIDs(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name            string
+		inputArray      []portainer.Endpoint
+		inputExcludeIDs []portainer.EndpointID
+		asserts         func(*testing.T, []portainer.Endpoint)
+	}{
+		{
+			name: "filter endpoints",
+			inputArray: []portainer.Endpoint{
+				{ID: portainer.EndpointID(1)},
+				{ID: portainer.EndpointID(2)},
+				{ID: portainer.EndpointID(3)},
+				{ID: portainer.EndpointID(4)},
+			},
+			inputExcludeIDs: []portainer.EndpointID{
+				portainer.EndpointID(2),
+				portainer.EndpointID(3),
+			},
+			asserts: func(t *testing.T, output []portainer.Endpoint) {
+				assert.Contains(t, output, portainer.Endpoint{ID: portainer.EndpointID(1)})
+				assert.NotContains(t, output, portainer.Endpoint{ID: portainer.EndpointID(2)})
+				assert.NotContains(t, output, portainer.Endpoint{ID: portainer.EndpointID(3)})
+				assert.Contains(t, output, portainer.Endpoint{ID: portainer.EndpointID(4)})
+			},
+		},
+		{
+			name:       "empty input",
+			inputArray: []portainer.Endpoint{},
+			inputExcludeIDs: []portainer.EndpointID{
+				portainer.EndpointID(2),
+			},
+			asserts: func(t *testing.T, output []portainer.Endpoint) {
+				assert.Empty(t, output)
+			},
+		},
+		{
+			name: "no filter",
+			inputArray: []portainer.Endpoint{
+				{ID: portainer.EndpointID(1)},
+				{ID: portainer.EndpointID(2)},
+			},
+			inputExcludeIDs: []portainer.EndpointID{},
+			asserts: func(t *testing.T, output []portainer.Endpoint) {
+				assert.Len(t, output, 2)
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			output := FilterByExcludeIDs(tt.inputArray, tt.inputExcludeIDs)
+			tt.asserts(t, output)
+		})
+	}
+}
+
+func TestUpdateEdgeEndpointHeartbeat(t *testing.T) {
+	t.Parallel()
+	endpoint := &portainer.Endpoint{
+		Type:                portainer.EdgeAgentOnDockerEnvironment,
+		LastCheckInDate:     time.Now().Unix(),
+		EdgeCheckinInterval: 5,
+	}
+
+	UpdateEdgeEndpointHeartbeat(endpoint, &portainer.Settings{})
+	require.True(t, endpoint.Heartbeat)
+
+	endpoint.LastCheckInDate = time.Now().Add(-time.Minute).Unix()
+	UpdateEdgeEndpointHeartbeat(endpoint, &portainer.Settings{})
+	require.False(t, endpoint.Heartbeat)
+}
diff --git a/api/internal/endpointutils/endpointutils.go b/api/internal/endpointutils/endpointutils.go
new file mode 100644
index 0000000..1fa1aa1
--- /dev/null
+++ b/api/internal/endpointutils/endpointutils.go
@@ -0,0 +1,243 @@
+package endpointutils
+
+import (
+	"errors"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/kubernetes/cli"
+	"github.com/portainer/portainer/pkg/endpoints"
+
+	log "github.com/rs/zerolog/log"
+)
+
+var (
+	IsLocalEndpoint      = endpoints.IsLocalEndpoint
+	IsKubernetesEndpoint = endpoints.IsKubernetesEndpoint
+	IsDockerEndpoint     = endpoints.IsDockerEndpoint
+	IsEdgeEndpoint       = endpoints.IsEdgeEndpoint
+	IsAgentEndpoint      = endpoints.IsAgentEndpoint
+	EndpointSet          = endpoints.EndpointSet
+)
+
+// EndpointPlatformType returns the type of the endpoint based on the environment and container engine
+func EndpointPlatformType(endpoint *portainer.Endpoint) portainer.PlatformType {
+	switch endpoint.Type {
+	case portainer.DockerEnvironment, portainer.AgentOnDockerEnvironment, portainer.EdgeAgentOnDockerEnvironment:
+		if endpoint.ContainerEngine == portainer.ContainerEnginePodman {
+			return portainer.PodmanPlatformType
+		}
+		return portainer.DockerPlatformType
+	case portainer.KubernetesLocalEnvironment, portainer.AgentOnKubernetesEnvironment, portainer.EdgeAgentOnKubernetesEnvironment:
+		return portainer.KubernetesPlatformType
+	case portainer.AzureEnvironment:
+		return portainer.AzurePlatformType
+	}
+	return portainer.UnknownPlatformType
+}
+
+// FilterByExcludeIDs receives an environment(endpoint) array and returns a filtered array using an excludeIds param
+func FilterByExcludeIDs(endpoints []portainer.Endpoint, excludeIds []portainer.EndpointID) []portainer.Endpoint {
+	if len(excludeIds) == 0 {
+		return endpoints
+	}
+
+	filteredEndpoints := make([]portainer.Endpoint, 0)
+
+	idsSet := make(map[portainer.EndpointID]bool)
+	for _, id := range excludeIds {
+		idsSet[id] = true
+	}
+
+	for _, endpoint := range endpoints {
+		if !idsSet[endpoint.ID] {
+			filteredEndpoints = append(filteredEndpoints, endpoint)
+		}
+	}
+
+	return filteredEndpoints
+}
+
+func InitialIngressClassDetection(tx dataservices.DataStoreTx, endpoint *portainer.Endpoint, factory *cli.ClientFactory) {
+	if endpoint.Kubernetes.Flags.IsServerIngressClassDetected {
+		return
+	}
+
+	defer func() {
+		endpoint.Kubernetes.Flags.IsServerIngressClassDetected = true
+
+		if err := tx.Endpoint().UpdateEndpoint(endpoint.ID, endpoint); err != nil {
+			log.Debug().Err(err).Msg("unable to store found IngressClasses inside the database")
+		}
+	}()
+
+	cli, err := factory.GetPrivilegedKubeClient(endpoint)
+	if err != nil {
+		log.Debug().Err(err).Msg("unable to create kubernetes client for ingress class detection")
+
+		return
+	}
+
+	controllers, err := cli.GetIngressControllers()
+	if err != nil {
+		log.Debug().Err(err).Msg("failed to fetch ingressclasses")
+
+		return
+	}
+
+	var updatedClasses []portainer.KubernetesIngressClassConfig
+	for i := range controllers {
+		var updatedClass portainer.KubernetesIngressClassConfig
+		updatedClass.Name = controllers[i].ClassName
+		updatedClass.Type = controllers[i].Type
+		updatedClasses = append(updatedClasses, updatedClass)
+	}
+
+	endpoint.Kubernetes.Configuration.IngressClasses = updatedClasses
+}
+
+func InitialMetricsDetection(tx dataservices.DataStoreTx, endpoint *portainer.Endpoint, factory *cli.ClientFactory) {
+	if endpoint.Kubernetes.Flags.IsServerMetricsDetected {
+		return
+	}
+
+	defer func() {
+		endpoint.Kubernetes.Flags.IsServerMetricsDetected = true
+		if err := tx.Endpoint().UpdateEndpoint(endpoint.ID, endpoint); err != nil {
+			log.Debug().Err(err).Msg("unable to enable UseServerMetrics inside the database")
+		}
+	}()
+
+	cli, err := factory.GetPrivilegedKubeClient(endpoint)
+	if err != nil {
+		log.Debug().Err(err).Msg("unable to create kubernetes client for initial metrics detection")
+
+		return
+	}
+
+	if _, err := cli.GetMetrics(); err != nil {
+		log.Debug().Err(err).Msg("unable to fetch metrics: leaving metrics collection disabled.")
+
+		return
+	}
+
+	endpoint.Kubernetes.Configuration.UseServerMetrics = true
+}
+
+func storageDetect(tx dataservices.DataStoreTx, endpoint *portainer.Endpoint, factory *cli.ClientFactory) error {
+	if endpoint.Kubernetes.Flags.IsServerStorageDetected {
+		return nil
+	}
+
+	defer func() {
+		endpoint.Kubernetes.Flags.IsServerStorageDetected = true
+		if err := tx.Endpoint().UpdateEndpoint(endpoint.ID, endpoint); err != nil {
+			log.Info().Err(err).Msg("unable to enable storage class inside the database")
+		}
+	}()
+
+	cli, err := factory.GetPrivilegedKubeClient(endpoint)
+	if err != nil {
+		log.Debug().Err(err).Msg("unable to create Kubernetes client for initial storage detection")
+
+		return err
+	}
+
+	storage, err := cli.GetStorage()
+	if err != nil {
+		log.Debug().Err(err).Msg("unable to fetch storage classes: leaving storage classes disabled")
+
+		return err
+	} else if len(storage) == 0 {
+		log.Info().Err(err).Msg("zero storage classes found: they may be still building, retrying in 30 seconds")
+
+		return errors.New("zero storage classes found: they may be still building, retrying in 30 seconds")
+	}
+
+	endpoint.Kubernetes.Configuration.StorageClasses = storage
+
+	return nil
+}
+
+func InitialStorageDetection(tx dataservices.DataStoreTx, dataStore dataservices.DataStore, endpoint *portainer.Endpoint, factory *cli.ClientFactory) {
+	log.Info().Msg("attempting to detect storage classes in the cluster")
+	err := storageDetect(tx, endpoint, factory)
+	if err == nil {
+		return
+	}
+	log.Err(err).Msg("error while detecting storage classes")
+
+	endpointID := endpoint.ID
+	go func() {
+		// Retry after 30 seconds if the initial detection failed.
+		log.Info().Msg("retrying storage detection in 30 seconds")
+		time.Sleep(30 * time.Second)
+
+		err := dataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+			endpoint, err := tx.Endpoint().Endpoint(endpointID)
+			if err != nil {
+				return err
+			}
+
+			return storageDetect(tx, endpoint, factory)
+		})
+		log.Err(err).Msg("final error while detecting storage classes")
+	}()
+}
+
+func UpdateEdgeEndpointHeartbeat(endpoint *portainer.Endpoint, settings *portainer.Settings) {
+	if !IsEdgeEndpoint(endpoint) {
+		return
+	}
+
+	endpoint.Heartbeat = GetHeartbeatStatus(endpoint, settings)
+}
+
+func GetHeartbeatStatus(endpoint *portainer.Endpoint, settings *portainer.Settings) bool {
+	checkInInterval := getEndpointCheckinInterval(endpoint, settings)
+	return time.Now().Unix()-endpoint.LastCheckInDate <= int64(checkInInterval*2+20)
+}
+
+func getEndpointCheckinInterval(endpoint *portainer.Endpoint, settings *portainer.Settings) int {
+	if !endpoint.Edge.AsyncMode {
+		if endpoint.EdgeCheckinInterval > 0 {
+			return endpoint.EdgeCheckinInterval
+		}
+
+		return settings.EdgeAgentCheckinInterval
+	}
+
+	defaultInterval := 60
+	intervals := [][]int{
+		{endpoint.Edge.PingInterval, settings.Edge.PingInterval},
+		{endpoint.Edge.CommandInterval, settings.Edge.CommandInterval},
+		{endpoint.Edge.SnapshotInterval, settings.Edge.SnapshotInterval},
+	}
+
+	for i := range intervals {
+		effectiveInterval := intervals[i][0]
+		if effectiveInterval <= 0 {
+			effectiveInterval = intervals[i][1]
+		}
+
+		if effectiveInterval > 0 && effectiveInterval < defaultInterval {
+			defaultInterval = effectiveInterval
+		}
+	}
+
+	return defaultInterval
+}
+
+func InitializeEdgeEndpointRelation(endpoint *portainer.Endpoint, tx dataservices.DataStoreTx) error {
+	if !IsEdgeEndpoint(endpoint) {
+		return nil
+	}
+
+	relation := &portainer.EndpointRelation{
+		EndpointID: endpoint.ID,
+		EdgeStacks: make(map[portainer.EdgeStackID]bool),
+	}
+
+	return tx.EndpointRelation().Create(relation)
+}
diff --git a/api/internal/nodes/nodes.go b/api/internal/nodes/nodes.go
new file mode 100644
index 0000000..9e8168c
--- /dev/null
+++ b/api/internal/nodes/nodes.go
@@ -0,0 +1,31 @@
+package status
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+)
+
+// NodesCount returns the total node number of all environments
+func NodesCount(endpoints []portainer.Endpoint) int {
+	nodes := 0
+
+	for _, env := range endpoints {
+		if !endpointutils.IsEdgeEndpoint(&env) || env.UserTrusted {
+			nodes += countNodes(&env)
+		}
+	}
+
+	return nodes
+}
+
+func countNodes(endpoint *portainer.Endpoint) int {
+	if len(endpoint.Snapshots) == 1 {
+		return max(endpoint.Snapshots[0].NodeCount, 1)
+	}
+
+	if len(endpoint.Kubernetes.Snapshots) == 1 {
+		return max(endpoint.Kubernetes.Snapshots[0].NodeCount, 1)
+	}
+
+	return 1
+}
diff --git a/api/internal/randomstring/random_string.go b/api/internal/randomstring/random_string.go
new file mode 100644
index 0000000..44d4336
--- /dev/null
+++ b/api/internal/randomstring/random_string.go
@@ -0,0 +1,14 @@
+package randomstring
+
+import "github.com/portainer/portainer/pkg/librand"
+
+const letterBytes = "abcdefghijklmnopqrstuvwxyz0123456789"
+
+// RandomString returns a random lowercase alphanumeric string of length n
+func RandomString(n int) string {
+	b := make([]byte, n)
+	for i := range b {
+		b[i] = letterBytes[librand.Intn(len(letterBytes))]
+	}
+	return string(b)
+}
diff --git a/api/internal/randomstring/random_string_test.go b/api/internal/randomstring/random_string_test.go
new file mode 100644
index 0000000..6837070
--- /dev/null
+++ b/api/internal/randomstring/random_string_test.go
@@ -0,0 +1,67 @@
+package randomstring
+
+import (
+	"testing"
+
+	"github.com/portainer/portainer/pkg/fips"
+	"github.com/stretchr/testify/require"
+)
+
+func init() {
+	fips.InitFIPS(false)
+}
+
+func TestRandomString(t *testing.T) {
+	t.Parallel()
+	testCases := []struct {
+		name     string
+		length   int
+		expected int
+	}{
+		{
+			name:     "zero length",
+			length:   0,
+			expected: 0,
+		},
+		{
+			name:     "short string",
+			length:   5,
+			expected: 5,
+		},
+		{
+			name:     "longer string",
+			length:   20,
+			expected: 20,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			result := RandomString(tc.length)
+			require.Len(t, result, tc.expected)
+
+			// Verify all characters are from the expected alphabet
+			for _, char := range result {
+				require.Contains(t, letterBytes, string(char))
+			}
+		})
+	}
+}
+
+func TestRandomStringUniqueness(t *testing.T) {
+	t.Parallel()
+	// Generate multiple random strings and verify they are different
+	const numStrings = 100
+	const stringLength = 10
+
+	generated := make(map[string]bool)
+
+	for range numStrings {
+		str := RandomString(stringLength)
+		require.Len(t, str, stringLength)
+
+		// Check if we've seen this string before (very unlikely for random strings)
+		require.False(t, generated[str], "Generated duplicate random string: %s", str)
+		generated[str] = true
+	}
+}
diff --git a/api/internal/registryutils/access/access.go b/api/internal/registryutils/access/access.go
new file mode 100644
index 0000000..bfa5181
--- /dev/null
+++ b/api/internal/registryutils/access/access.go
@@ -0,0 +1,102 @@
+package access
+
+import (
+	"errors"
+	"fmt"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+	"github.com/portainer/portainer/api/kubernetes"
+	"github.com/portainer/portainer/api/kubernetes/cli"
+)
+
+func hasPermission(
+	dataStore dataservices.DataStore,
+	k8sClientFactory *cli.ClientFactory,
+	userID portainer.UserID,
+	endpointID portainer.EndpointID,
+	registry *portainer.Registry,
+) (hasPermission bool, err error) {
+	user, err := dataStore.User().Read(userID)
+	if err != nil {
+		return false, err
+	}
+
+	if user.Role == portainer.AdministratorRole {
+		return true, nil
+	}
+
+	endpoint, err := dataStore.Endpoint().Endpoint(endpointID)
+	if err != nil {
+		return false, err
+	}
+
+	teamMemberships, err := dataStore.TeamMembership().TeamMembershipsByUserID(userID)
+	if err != nil {
+		return false, err
+	}
+
+	// validate access for kubernetes namespaces (leverage registry.RegistryAccesses[endpointId].Namespaces)
+	if endpointutils.IsKubernetesEndpoint(endpoint) && k8sClientFactory != nil {
+		kcl, err := k8sClientFactory.GetPrivilegedKubeClient(endpoint)
+		if err != nil {
+			return false, fmt.Errorf("unable to retrieve kubernetes client to validate registry access: %w", err)
+		}
+		accessPolicies, err := kcl.GetNamespaceAccessPolicies()
+		if err != nil {
+			return false, fmt.Errorf("unable to retrieve environment's namespaces policies to validate registry access: %w", err)
+		}
+
+		authorizedNamespaces := registry.RegistryAccesses[endpointID].Namespaces
+
+		for _, namespace := range authorizedNamespaces {
+			// when the default namespace is authorized to use a registry, all users have the ability to use it
+			// unless the default namespace is restricted: in this case continue to search for other potential accesses authorizations
+			if namespace == kubernetes.DefaultNamespace && !endpoint.Kubernetes.Configuration.RestrictDefaultNamespace {
+				return true, nil
+			}
+
+			namespacePolicy := accessPolicies[namespace]
+			if security.AuthorizedAccess(user.ID, teamMemberships, namespacePolicy.UserAccessPolicies, namespacePolicy.TeamAccessPolicies) {
+				return true, nil
+			}
+		}
+		return false, nil
+	}
+
+	// validate access for docker environments
+	// leverage registry.RegistryAccesses[endpointId].UserAccessPolicies (direct access)
+	// and registry.RegistryAccesses[endpointId].TeamAccessPolicies (indirect access via his teams)
+	hasPermission = security.AuthorizedRegistryAccess(registry, user, teamMemberships, endpointID)
+
+	return hasPermission, nil
+}
+
+// GetAccessibleRegistry get the registry if the user has permission
+func GetAccessibleRegistry(
+	dataStore dataservices.DataStore,
+	k8sClientFactory *cli.ClientFactory,
+	userID portainer.UserID,
+	endpointID portainer.EndpointID,
+	registryID portainer.RegistryID,
+) (registry *portainer.Registry, err error) {
+
+	registry, err = dataStore.Registry().Read(registryID)
+	if err != nil {
+		return
+	}
+
+	hasPermission, err := hasPermission(dataStore, k8sClientFactory, userID, endpointID, registry)
+	if err != nil {
+		return
+	}
+
+	if !hasPermission {
+		err = errors.New("user does not has permission to get the registry")
+		return nil, err
+	}
+
+	return
+}
diff --git a/api/internal/registryutils/auth_header.go b/api/internal/registryutils/auth_header.go
new file mode 100644
index 0000000..ce09f1e
--- /dev/null
+++ b/api/internal/registryutils/auth_header.go
@@ -0,0 +1,36 @@
+package registryutils
+
+import (
+	"encoding/base64"
+
+	portainer "github.com/portainer/portainer/api"
+
+	"github.com/segmentio/encoding/json"
+)
+
+type authHeader struct {
+	Username      string `json:"username"`
+	Password      string `json:"password"`
+	ServerAddress string `json:"serveraddress"`
+}
+
+// GetRegistryAuthHeader generate the X-Registry-Auth header from registry
+func GetRegistryAuthHeader(registry *portainer.Registry) (header string, err error) {
+	authHeader := authHeader{
+		ServerAddress: registry.URL,
+	}
+
+	authHeader.Username, authHeader.Password, err = GetRegEffectiveCredential(registry)
+	if err != nil {
+		return
+	}
+
+	headerData, err := json.Marshal(authHeader)
+	if err != nil {
+		return
+	}
+
+	header = base64.StdEncoding.EncodeToString(headerData)
+
+	return
+}
diff --git a/api/internal/registryutils/ecr_kube_secret.go b/api/internal/registryutils/ecr_kube_secret.go
new file mode 100644
index 0000000..a82ea97
--- /dev/null
+++ b/api/internal/registryutils/ecr_kube_secret.go
@@ -0,0 +1,43 @@
+package registryutils
+
+import (
+	"slices"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+)
+
+func isRegistryAssignedToNamespace(registry portainer.Registry, endpointID portainer.EndpointID, namespace string) bool {
+	return slices.Contains(registry.RegistryAccesses[endpointID].Namespaces, namespace)
+}
+
+func RefreshEcrSecret(cli portainer.KubeClient, endpoint *portainer.Endpoint, dataStore dataservices.DataStore, namespace string) error {
+	registries, err := dataStore.Registry().ReadAll()
+	if err != nil {
+		return err
+	}
+
+	for _, registry := range registries {
+		if registry.Type != portainer.EcrRegistry {
+			continue
+		}
+
+		if !isRegistryAssignedToNamespace(registry, endpoint.ID, namespace) {
+			continue
+		}
+
+		if err := EnsureRegTokenValid(dataStore, &registry); err != nil {
+			return err
+		}
+
+		if err := cli.DeleteRegistrySecret(registry.ID, namespace); err != nil {
+			return err
+		}
+
+		if err := cli.CreateRegistrySecret(&registry, namespace); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
diff --git a/api/internal/registryutils/ecr_reg_token.go b/api/internal/registryutils/ecr_reg_token.go
new file mode 100644
index 0000000..a4387a8
--- /dev/null
+++ b/api/internal/registryutils/ecr_reg_token.go
@@ -0,0 +1,121 @@
+package registryutils
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/aws/ecr"
+	"github.com/portainer/portainer/api/dataservices"
+
+	"github.com/rs/zerolog/log"
+)
+
+func isRegTokenValid(registry *portainer.Registry) (valid bool) {
+	return registry.AccessToken != "" && registry.AccessTokenExpiry > time.Now().Unix()
+}
+
+func fetchRegToken(registry *portainer.Registry) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	ecrClient := ecr.NewService(registry.Username, registry.Password, registry.Ecr.Region)
+	accessToken, expiryAt, err := ecrClient.GetAuthorizationToken(ctx)
+	if err != nil {
+		return err
+	}
+	registry.AccessToken = *accessToken
+	registry.AccessTokenExpiry = expiryAt.Unix()
+
+	return nil
+}
+
+func doGetRegToken(tx dataservices.DataStoreTx, registry *portainer.Registry) error {
+	if err := fetchRegToken(registry); err != nil {
+		return err
+	}
+
+	return tx.Registry().Update(registry.ID, registry)
+}
+
+// RefreshAndPersistECRTokens refreshes and persists ECR tokens for all registries that need it.
+// Must be called with a real DataStoreTx (not a top-level DataStore) to avoid write-lock contention.
+func RefreshAndPersistECRTokens(tx dataservices.DataStoreTx, registries []portainer.Registry) {
+	for i := range registries {
+		reg := &registries[i]
+		if reg.Type != portainer.EcrRegistry {
+			continue
+		}
+		if isRegTokenValid(reg) {
+			continue
+		}
+		if err := doGetRegToken(tx, reg); err != nil {
+			log.Warn().
+				Err(err).
+				Str("RegistryName", reg.Name).
+				Msg("Failed to get valid ECR registry token. Skip logging with this registry.")
+		}
+	}
+}
+
+func EnsureRegTokenValid(tx dataservices.DataStoreTx, registry *portainer.Registry) error {
+	if registry.Type != portainer.EcrRegistry {
+		return nil
+	}
+
+	if isRegTokenValid(registry) {
+		log.Debug().Msg("current ECR token is still valid")
+
+		return nil
+	}
+
+	if err := doGetRegToken(tx, registry); err != nil {
+		log.Debug().Msg("refresh ECR token")
+
+		return err
+	}
+
+	return nil
+}
+
+func GetRegEffectiveCredential(registry *portainer.Registry) (username, password string, err error) {
+	username = registry.Username
+	password = registry.Password
+
+	if registry.Type == portainer.EcrRegistry {
+		// Fallback token refresh in case the upstream caller did not pre-validate the token.
+		if !isRegTokenValid(registry) {
+			if err := fetchRegToken(registry); err != nil {
+				return "", "", fmt.Errorf("ECR registry %q credentials are invalid or expired. Error: %w", registry.Name, err)
+			}
+		}
+
+		username, password, err = ecr.NewService(registry.Username, registry.Password, registry.Ecr.Region).
+			ParseAuthorizationToken(registry.AccessToken)
+	}
+
+	return
+}
+
+// PrepareRegistryCredentials consolidates the common pattern of ensuring valid ECR token
+// and setting effective credentials on the registry when authentication is enabled.
+// This function modifies the registry in-place by setting Username and Password to the effective values.
+func PrepareRegistryCredentials(tx dataservices.DataStoreTx, registry *portainer.Registry) error {
+	if !registry.Authentication {
+		return nil
+	}
+
+	if err := EnsureRegTokenValid(tx, registry); err != nil {
+		return err
+	}
+
+	username, password, err := GetRegEffectiveCredential(registry)
+	if err != nil {
+		return err
+	}
+
+	registry.Username = username
+	registry.Password = password
+
+	return nil
+}
diff --git a/api/internal/registryutils/ecr_reg_token_test.go b/api/internal/registryutils/ecr_reg_token_test.go
new file mode 100644
index 0000000..2c9b9a3
--- /dev/null
+++ b/api/internal/registryutils/ecr_reg_token_test.go
@@ -0,0 +1,99 @@
+package registryutils_test
+
+import (
+	"io"
+	"strings"
+	"testing"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/internal/registryutils"
+	zerolog "github.com/rs/zerolog/log"
+	"github.com/stretchr/testify/require"
+)
+
+func newECRRegistry(id portainer.RegistryID, accessToken string, expiry int64) portainer.Registry {
+	return portainer.Registry{
+		ID:                id,
+		Type:              portainer.EcrRegistry,
+		Name:              "test-ecr",
+		Username:          "AKIAIOSFODNN7EXAMPLE",
+		Password:          "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
+		Ecr:               portainer.EcrData{Region: "us-east-1"},
+		AccessToken:       accessToken,
+		AccessTokenExpiry: expiry,
+	}
+}
+
+func TestRefreshAndPersistECRTokens(t *testing.T) {
+	t.Run("does not modify token for ECR registry with valid token", func(t *testing.T) {
+		_, ds := datastore.MustNewTestStore(t, true, false)
+		reg := newECRRegistry(1, "valid-token", time.Now().Add(time.Hour).Unix())
+		require.NoError(t, ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
+			registryutils.RefreshAndPersistECRTokens(tx, []portainer.Registry{reg})
+			return nil
+		}))
+		require.Equal(t, "valid-token", reg.AccessToken)
+	})
+
+	t.Run("does not block and leaves token empty when ECR token refresh fails", func(t *testing.T) {
+		var logOutput strings.Builder
+		setupLogOutput(t, &logOutput)
+
+		_, ds := datastore.MustNewTestStore(t, true, false)
+		reg := newECRRegistry(1, "", 0)
+		require.NoError(t, ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
+			registryutils.RefreshAndPersistECRTokens(tx, []portainer.Registry{reg})
+			return nil
+		}))
+		require.Empty(t, reg.AccessToken)
+		require.Contains(t, logOutput.String(), "test-ecr")
+		require.Contains(t, logOutput.String(), "Failed to get valid ECR registry token")
+	})
+}
+
+func setupLogOutput(t *testing.T, w io.Writer) {
+	t.Helper()
+
+	oldLogger := zerolog.Logger
+	zerolog.Logger = zerolog.Output(w)
+	t.Cleanup(func() {
+		zerolog.Logger = oldLogger
+	})
+}
+
+func TestGetRegEffectiveCredential(t *testing.T) {
+	t.Parallel()
+
+	t.Run("returns username and password directly for non-ECR registry", func(t *testing.T) {
+		t.Parallel()
+		reg := &portainer.Registry{
+			Type:     portainer.DockerHubRegistry,
+			Username: "user",
+			Password: "pass",
+		}
+		username, password, err := registryutils.GetRegEffectiveCredential(reg)
+		require.NoError(t, err)
+		require.Equal(t, "user", username)
+		require.Equal(t, "pass", password)
+	})
+
+	t.Run("parses ECR access token when token is valid", func(t *testing.T) {
+		t.Parallel()
+		reg := newECRRegistry(1, "AWS:ecr-password", time.Now().Add(time.Hour).Unix())
+		username, password, err := registryutils.GetRegEffectiveCredential(&reg)
+		require.NoError(t, err)
+		require.Equal(t, "AWS", username)
+		require.Equal(t, "ecr-password", password)
+	})
+
+	t.Run("returns error for ECR registry with missing token and invalid credentials", func(t *testing.T) {
+		t.Parallel()
+		reg := newECRRegistry(1, "", 0)
+		_, _, err := registryutils.GetRegEffectiveCredential(&reg)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "test-ecr")
+	})
+}
diff --git a/api/internal/registryutils/get_registry_name.go b/api/internal/registryutils/get_registry_name.go
new file mode 100644
index 0000000..fb0c27d
--- /dev/null
+++ b/api/internal/registryutils/get_registry_name.go
@@ -0,0 +1,11 @@
+package registryutils
+
+import (
+	"strconv"
+
+	portainer "github.com/portainer/portainer/api"
+)
+
+func RegistrySecretName(registryID portainer.RegistryID) string {
+	return "registry-" + strconv.Itoa(int(registryID))
+}
diff --git a/api/internal/snapshot/snapshot.go b/api/internal/snapshot/snapshot.go
new file mode 100644
index 0000000..686ed58
--- /dev/null
+++ b/api/internal/snapshot/snapshot.go
@@ -0,0 +1,346 @@
+package snapshot
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/agent"
+	"github.com/portainer/portainer/api/crypto"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/pendingactions"
+	endpointsutils "github.com/portainer/portainer/pkg/endpoints"
+
+	"github.com/rs/zerolog/log"
+)
+
+// Service represents a service to manage environment(endpoint) snapshots.
+// It provides an interface to start background snapshots as well as
+// specific Docker/Kubernetes environment(endpoint) snapshot methods.
+type Service struct {
+	dataStore                 dataservices.DataStore
+	snapshotIntervalCh        chan time.Duration
+	snapshotIntervalInSeconds float64
+	dockerSnapshotter         portainer.DockerSnapshotter
+	kubernetesSnapshotter     portainer.KubernetesSnapshotter
+	pendingActionsService     *pendingactions.PendingActionsService
+}
+
+// NewService creates a new instance of a service
+func NewService(
+	snapshotIntervalFromFlag string,
+	dataStore dataservices.DataStore,
+	dockerSnapshotter portainer.DockerSnapshotter,
+	kubernetesSnapshotter portainer.KubernetesSnapshotter,
+	pendingActionsService *pendingactions.PendingActionsService,
+) (*Service, error) {
+	interval, err := parseSnapshotFrequency(snapshotIntervalFromFlag, dataStore)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Service{
+		dataStore:                 dataStore,
+		snapshotIntervalCh:        make(chan time.Duration),
+		snapshotIntervalInSeconds: interval,
+		dockerSnapshotter:         dockerSnapshotter,
+		kubernetesSnapshotter:     kubernetesSnapshotter,
+		pendingActionsService:     pendingActionsService,
+	}, nil
+}
+
+// NewBackgroundSnapshotter queues snapshots of existing edge environments that
+// do not have one already
+func NewBackgroundSnapshotter(dataStore dataservices.DataStore, tunnelService portainer.ReverseTunnelService) {
+	if err := dataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
+		endpoints, err := tx.Endpoint().Endpoints()
+		if err != nil {
+			return err
+		}
+
+		for _, e := range endpoints {
+			if !endpointsutils.HasDirectConnectivity(&e) {
+				continue
+			}
+
+			s, err := tx.Snapshot().Read(e.ID)
+			if dataservices.IsErrObjectNotFound(err) ||
+				(err == nil && s.Docker == nil && s.Kubernetes == nil) {
+				if err := tunnelService.Open(&e); err != nil {
+					log.Error().Err(err).Msg("could not open the tunnel")
+				}
+			}
+		}
+
+		return nil
+	}); err != nil {
+		log.Error().Err(err).Msg("background snapshotter failure")
+
+		return
+	}
+}
+
+func parseSnapshotFrequency(snapshotInterval string, dataStore dataservices.DataStore) (float64, error) {
+	if snapshotInterval == "" {
+		settings, err := dataStore.Settings().Settings()
+		if err != nil {
+			return 0, err
+		}
+
+		snapshotInterval = settings.SnapshotInterval
+		if snapshotInterval == "" {
+			snapshotInterval = portainer.DefaultSnapshotInterval
+		}
+	}
+
+	snapshotFrequency, err := time.ParseDuration(snapshotInterval)
+	if err != nil {
+		return 0, err
+	}
+
+	return snapshotFrequency.Seconds(), nil
+}
+
+// Start will start a background routine to execute periodic snapshots of environments(endpoints)
+func (service *Service) Start(ctx context.Context) {
+	go service.startSnapshotLoop(ctx)
+}
+
+// SetSnapshotInterval sets the snapshot interval and resets the service
+func (service *Service) SetSnapshotInterval(snapshotInterval string) error {
+	interval, err := time.ParseDuration(snapshotInterval)
+	if err != nil {
+		return err
+	}
+
+	service.snapshotIntervalCh <- interval
+
+	return nil
+}
+
+// SupportDirectSnapshot checks whether an environment(endpoint) can be used to trigger a direct a snapshot.
+// It is mostly true for all environments(endpoints) except Edge and Azure environments(endpoints).
+func SupportDirectSnapshot(endpoint *portainer.Endpoint) bool {
+	switch endpoint.Type {
+	case portainer.EdgeAgentOnDockerEnvironment, portainer.EdgeAgentOnKubernetesEnvironment, portainer.AzureEnvironment:
+		return false
+	}
+
+	return true
+}
+
+// SnapshotEndpoint will create a snapshot of the environment(endpoint) based on the environment(endpoint) type.
+// If the snapshot is a success, it will be associated to the environment(endpoint).
+func (service *Service) SnapshotEndpoint(endpoint *portainer.Endpoint) error {
+	if endpoint.Type == portainer.AgentOnDockerEnvironment || endpoint.Type == portainer.AgentOnKubernetesEnvironment {
+		tlsConfig, err := crypto.CreateTLSConfigurationFromDisk(endpoint.TLSConfig)
+		if err != nil {
+			return err
+		}
+
+		_, version, err := agent.GetAgentVersionAndPlatform(endpoint.URL, tlsConfig)
+		if err != nil {
+			return err
+		}
+
+		endpoint.Agent.Version = version
+	}
+
+	switch endpoint.Type {
+	case portainer.AzureEnvironment:
+		return nil
+	case portainer.KubernetesLocalEnvironment, portainer.AgentOnKubernetesEnvironment, portainer.EdgeAgentOnKubernetesEnvironment:
+		return service.snapshotKubernetesEndpoint(endpoint)
+	}
+
+	return service.snapshotDockerEndpoint(endpoint)
+}
+
+func (service *Service) Create(snapshot portainer.Snapshot) error {
+	return service.dataStore.Snapshot().Create(&snapshot)
+}
+
+func (service *Service) FillSnapshotData(endpoint *portainer.Endpoint, includeRaw bool) error {
+	return FillSnapshotData(service.dataStore, endpoint, includeRaw)
+}
+
+func (service *Service) snapshotKubernetesEndpoint(endpoint *portainer.Endpoint) error {
+	kubernetesSnapshot, err := service.kubernetesSnapshotter.CreateSnapshot(endpoint)
+	if err != nil {
+		return err
+	}
+
+	if kubernetesSnapshot != nil {
+		snapshot := &portainer.Snapshot{EndpointID: endpoint.ID, Kubernetes: kubernetesSnapshot}
+
+		return service.dataStore.Snapshot().Create(snapshot)
+	}
+
+	return nil
+}
+
+func (service *Service) snapshotDockerEndpoint(endpoint *portainer.Endpoint) error {
+	dockerSnapshot, err := service.dockerSnapshotter.CreateSnapshot(endpoint)
+	if err != nil {
+		return err
+	}
+
+	if err := validateContainerEngineCompatibility(endpoint, dockerSnapshot); err != nil {
+		return err
+	}
+
+	if dockerSnapshot != nil {
+		snapshot := &portainer.Snapshot{EndpointID: endpoint.ID, Docker: dockerSnapshot}
+
+		return service.dataStore.Snapshot().Create(snapshot)
+	}
+
+	return nil
+}
+
+func validateContainerEngineCompatibility(endpoint *portainer.Endpoint, dockerSnapshot *portainer.DockerSnapshot) error {
+	if endpoint.ContainerEngine == portainer.ContainerEngineDocker && dockerSnapshot.IsPodman {
+		return errors.New("the Docker environment option doesn't support Podman environments. Please select the Podman option instead.")
+	}
+	if endpoint.ContainerEngine == portainer.ContainerEnginePodman && !dockerSnapshot.IsPodman {
+		return errors.New("the Podman environment option doesn't support Docker environments. Please select the Docker option instead.")
+	}
+	return nil
+}
+
+func (service *Service) startSnapshotLoop(ctx context.Context) {
+	ticker := time.NewTicker(time.Duration(service.snapshotIntervalInSeconds) * time.Second)
+
+	err := service.snapshotEndpoints()
+	if err != nil {
+		log.Error().Err(err).Msg("background schedule error (environment snapshot)")
+	}
+
+	for {
+		select {
+		case <-ticker.C:
+			err := service.snapshotEndpoints()
+			if err != nil {
+				log.Error().Err(err).Msg("background schedule error (environment snapshot)")
+			}
+		case <-ctx.Done():
+			log.Debug().Msg("shutting down snapshotting")
+			ticker.Stop()
+
+			return
+		case interval := <-service.snapshotIntervalCh:
+			ticker.Reset(interval)
+		}
+	}
+}
+
+func (service *Service) snapshotEndpoints() error {
+	endpoints, err := service.dataStore.Endpoint().Endpoints()
+	if err != nil {
+		return err
+	}
+
+	for _, endpoint := range endpoints {
+		if !SupportDirectSnapshot(&endpoint) || endpoint.URL == "" {
+			continue
+		}
+
+		snapshotError := service.SnapshotEndpoint(&endpoint)
+
+		if err := service.dataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+			updateEndpointStatus(tx, &endpoint, snapshotError, service.pendingActionsService)
+
+			return nil
+		}); err != nil {
+			log.Error().
+				Err(err).
+				Int("endpoint_id", int(endpoint.ID)).
+				Msg("unable to update environment status")
+		}
+	}
+
+	return nil
+}
+
+func updateEndpointStatus(tx dataservices.DataStoreTx, endpoint *portainer.Endpoint, snapshotError error, pendingActionsService *pendingactions.PendingActionsService) {
+	latestEndpointReference, err := tx.Endpoint().Endpoint(endpoint.ID)
+	if latestEndpointReference == nil {
+		log.Debug().
+			Str("endpoint", endpoint.Name).
+			Str("URL", endpoint.URL).Err(err).
+			Msg("background schedule error (environment snapshot), environment not found inside the database anymore")
+
+		return
+	}
+
+	latestEndpointReference.Status = portainer.EndpointStatusUp
+
+	if snapshotError != nil {
+		log.Debug().
+			Str("endpoint", endpoint.Name).
+			Str("URL", endpoint.URL).Err(err).
+			Msg("background schedule error (environment snapshot), unable to create snapshot")
+
+		latestEndpointReference.Status = portainer.EndpointStatusDown
+	}
+
+	latestEndpointReference.Agent.Version = endpoint.Agent.Version
+
+	if err := tx.Endpoint().UpdateEndpoint(latestEndpointReference.ID, latestEndpointReference); err != nil {
+		log.Debug().
+			Str("endpoint", endpoint.Name).
+			Str("URL", endpoint.URL).Err(err).
+			Msg("background schedule error (environment snapshot), unable to update environment")
+	}
+
+	// Run the pending actions
+	if latestEndpointReference.Status == portainer.EndpointStatusUp {
+		pendingActionsService.Execute(endpoint.ID)
+	}
+}
+
+// FetchDockerID fetches info.Swarm.Cluster.ID if environment(endpoint) is swarm and info.ID otherwise
+func FetchDockerID(snapshot portainer.DockerSnapshot) (string, error) {
+	info := snapshot.SnapshotRaw.Info
+
+	if !snapshot.Swarm {
+		return info.ID, nil
+	}
+
+	if info.Swarm.Cluster == nil {
+		return "", errors.New("swarm environment is missing cluster info snapshot")
+	}
+
+	return info.Swarm.Cluster.ID, nil
+}
+
+func FillSnapshotData(tx dataservices.DataStoreTx, endpoint *portainer.Endpoint, includeRaw bool) error {
+	var snapshot *portainer.Snapshot
+	var err error
+
+	if includeRaw {
+		snapshot, err = tx.Snapshot().Read(endpoint.ID)
+	} else {
+		snapshot, err = tx.Snapshot().ReadWithoutSnapshotRaw(endpoint.ID)
+	}
+
+	if tx.IsErrObjectNotFound(err) {
+		endpoint.Snapshots = []portainer.DockerSnapshot{}
+		endpoint.Kubernetes.Snapshots = []portainer.KubernetesSnapshot{}
+
+		return nil
+	} else if err != nil {
+		return err
+	}
+
+	if snapshot.Docker != nil {
+		endpoint.Snapshots = []portainer.DockerSnapshot{*snapshot.Docker}
+	}
+
+	if snapshot.Kubernetes != nil {
+		endpoint.Kubernetes.Snapshots = []portainer.KubernetesSnapshot{*snapshot.Kubernetes}
+	}
+
+	return nil
+}
diff --git a/api/internal/ssl/ssl.go b/api/internal/ssl/ssl.go
new file mode 100644
index 0000000..d6e348c
--- /dev/null
+++ b/api/internal/ssl/ssl.go
@@ -0,0 +1,165 @@
+package ssl
+
+import (
+	"context"
+	"crypto/tls"
+	"os"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/pkg/libcrypto"
+
+	"github.com/pkg/errors"
+	"github.com/rs/zerolog/log"
+)
+
+// Service represents a service to manage SSL certificates
+type Service struct {
+	fileService     portainer.FileService
+	dataStore       dataservices.DataStore
+	rawCert         *tls.Certificate
+	shutdownTrigger context.CancelFunc
+}
+
+// NewService returns a pointer to a new Service
+func NewService(fileService portainer.FileService, dataStore dataservices.DataStore, shutdownTrigger context.CancelFunc) *Service {
+	return &Service{
+		fileService:     fileService,
+		dataStore:       dataStore,
+		shutdownTrigger: shutdownTrigger,
+	}
+}
+
+// Init initializes the service
+func (service *Service) Init(host, certPath, keyPath string) error {
+	certSupplied := certPath != "" && keyPath != ""
+	if certSupplied {
+		newCertPath, newKeyPath, err := service.fileService.CopySSLCertPair(certPath, keyPath)
+		if err != nil {
+			return errors.Wrap(err, "failed copying supplied certs")
+		}
+
+		return service.cacheInfo(newCertPath, newKeyPath, false)
+	}
+
+	settings, err := service.GetSSLSettings()
+	if err != nil {
+		return errors.Wrap(err, "failed fetching SSL settings")
+	}
+
+	// certificates already exist
+	if settings.CertPath != "" && settings.KeyPath != "" {
+		err := service.cacheCertificate(settings.CertPath, settings.KeyPath)
+		if err != nil && !os.IsNotExist(err) {
+			return err
+		}
+
+		// continue if certs don't exist
+		if err == nil {
+			return nil
+		}
+	}
+
+	// path not supplied and certificates doesn't exist - generate self-signed
+	certPath, keyPath = service.fileService.GetDefaultSSLCertsPath()
+
+	if err := generateSelfSignedCertificates(host, certPath, keyPath); err != nil {
+		return errors.Wrap(err, "failed generating self signed certs")
+	}
+
+	return service.cacheInfo(certPath, keyPath, true)
+}
+
+func generateSelfSignedCertificates(ip, certPath, keyPath string) error {
+	if ip == "" {
+		return errors.New("host can't be empty")
+	}
+
+	log.Info().Msg("no cert files found, generating self signed SSL certificates")
+
+	return libcrypto.GenerateCertsForHost("localhost", ip, certPath, keyPath, time.Now().AddDate(5, 0, 0))
+}
+
+// GetRawCertificate gets the raw certificate
+func (service *Service) GetRawCertificate() *tls.Certificate {
+	return service.rawCert
+}
+
+// GetSSLSettings gets the certificate info
+func (service *Service) GetSSLSettings() (*portainer.SSLSettings, error) {
+	return service.dataStore.SSLSettings().Settings()
+}
+
+// SetCertificates sets the certificates
+func (service *Service) SetCertificates(certData, keyData []byte) error {
+	if len(certData) == 0 || len(keyData) == 0 {
+		return errors.New("missing certificate files")
+	}
+
+	if _, err := tls.X509KeyPair(certData, keyData); err != nil {
+		return err
+	}
+
+	certPath, keyPath, err := service.fileService.StoreSSLCertPair(certData, keyData)
+	if err != nil {
+		return err
+	}
+
+	if err := service.cacheInfo(certPath, keyPath, false); err != nil {
+		return err
+	}
+
+	service.shutdownTrigger()
+
+	return nil
+}
+
+func (service *Service) SetHTTPEnabled(httpEnabled bool) error {
+	settings, err := service.dataStore.SSLSettings().Settings()
+	if err != nil {
+		return err
+	}
+
+	if settings.HTTPEnabled == httpEnabled {
+		return nil
+	}
+
+	settings.HTTPEnabled = httpEnabled
+
+	if err := service.dataStore.SSLSettings().UpdateSettings(settings); err != nil {
+		return err
+	}
+
+	service.shutdownTrigger()
+
+	return nil
+}
+
+func (service *Service) cacheCertificate(certPath, keyPath string) error {
+	rawCert, err := tls.LoadX509KeyPair(certPath, keyPath)
+	if err != nil {
+		return err
+	}
+
+	service.rawCert = &rawCert
+
+	return nil
+}
+
+func (service *Service) cacheInfo(certPath string, keyPath string, selfSigned bool) error {
+	if err := service.cacheCertificate(certPath, keyPath); err != nil {
+		return err
+	}
+
+	settings, err := service.dataStore.SSLSettings().Settings()
+	if err != nil {
+		return err
+	}
+
+	settings.CertPath = certPath
+	settings.KeyPath = keyPath
+	settings.SelfSigned = selfSigned
+
+	return service.dataStore.SSLSettings().UpdateSettings(settings)
+}
diff --git a/api/internal/testhelpers/compose_stack_manager.go b/api/internal/testhelpers/compose_stack_manager.go
new file mode 100644
index 0000000..e33a945
--- /dev/null
+++ b/api/internal/testhelpers/compose_stack_manager.go
@@ -0,0 +1,38 @@
+package testhelpers
+
+import (
+	"context"
+
+	portainer "github.com/portainer/portainer/api"
+)
+
+var _ portainer.ComposeStackManager = composeStackManager{}
+
+type composeStackManager struct{}
+
+func NewComposeStackManager() composeStackManager {
+	return composeStackManager{}
+}
+
+func (manager composeStackManager) ComposeSyntaxMaxVersion() string {
+	return ""
+}
+
+func (manager composeStackManager) NormalizeStackName(name string) string {
+	return name
+}
+func (manager composeStackManager) Run(ctx context.Context, stack *portainer.Stack, endpoint *portainer.Endpoint, serviceName string, options portainer.ComposeRunOptions) error {
+	return nil
+}
+
+func (manager composeStackManager) Up(ctx context.Context, stack *portainer.Stack, endpoint *portainer.Endpoint, options portainer.ComposeUpOptions) error {
+	return nil
+}
+
+func (manager composeStackManager) Down(ctx context.Context, stack *portainer.Stack, endpoint *portainer.Endpoint) error {
+	return nil
+}
+
+func (manager composeStackManager) Pull(ctx context.Context, stack *portainer.Stack, endpoint *portainer.Endpoint, options portainer.ComposeOptions) error {
+	return nil
+}
diff --git a/api/internal/testhelpers/crypto_service.go b/api/internal/testhelpers/crypto_service.go
new file mode 100644
index 0000000..012144f
--- /dev/null
+++ b/api/internal/testhelpers/crypto_service.go
@@ -0,0 +1,16 @@
+package testhelpers
+
+// Service represents a service for encrypting/hashing data.
+type cryptoService struct{}
+
+func NewCryptoService() cryptoService {
+	return cryptoService{}
+}
+
+func (cryptoService) Hash(data string) (string, error) {
+	return "", nil
+}
+
+func (cryptoService) CompareHashAndData(hash string, data string) error {
+	return nil
+}
diff --git a/api/internal/testhelpers/datastore.go b/api/internal/testhelpers/datastore.go
new file mode 100644
index 0000000..80b7e19
--- /dev/null
+++ b/api/internal/testhelpers/datastore.go
@@ -0,0 +1,527 @@
+package testhelpers
+
+import (
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/database"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/dataservices/errors"
+	"github.com/portainer/portainer/api/slicesx"
+)
+
+var _ dataservices.DataStore = &testDatastore{}
+
+type testDatastore struct {
+	allowList               dataservices.AllowListService
+	customTemplate          dataservices.CustomTemplateService
+	edgeGroup               dataservices.EdgeGroupService
+	edgeJob                 dataservices.EdgeJobService
+	edgeStack               dataservices.EdgeStackService
+	edgeStackStatus         dataservices.EdgeStackStatusService
+	endpoint                dataservices.EndpointService
+	endpointGroup           dataservices.EndpointGroupService
+	endpointRelation        dataservices.EndpointRelationService
+	helmUserRepository      dataservices.HelmUserRepositoryService
+	registry                dataservices.RegistryService
+	resourceControl         dataservices.ResourceControlService
+	source                  dataservices.SourceService
+	apiKeyRepositoryService dataservices.APIKeyRepository
+	role                    dataservices.RoleService
+	sslSettings             dataservices.SSLSettingsService
+	settings                dataservices.SettingsService
+	snapshot                dataservices.SnapshotService
+	stack                   dataservices.StackService
+	tag                     dataservices.TagService
+	teamMembership          dataservices.TeamMembershipService
+	team                    dataservices.TeamService
+	tunnelServer            dataservices.TunnelServerService
+	user                    dataservices.UserService
+	version                 dataservices.VersionService
+	webhook                 dataservices.WebhookService
+	pendingActionsService   dataservices.PendingActionsService
+	workflow                dataservices.WorkflowService
+	connection              portainer.Connection
+}
+
+func (d *testDatastore) Backup(path string) (string, error)                  { return "", nil }
+func (d *testDatastore) Open() (bool, error)                                 { return false, nil }
+func (d *testDatastore) Init() error                                         { return nil }
+func (d *testDatastore) Close() error                                        { return nil }
+func (d *testDatastore) UpdateTx(func(dataservices.DataStoreTx) error) error { return nil }
+func (d *testDatastore) ViewTx(func(dataservices.DataStoreTx) error) error   { return nil }
+
+func (d *testDatastore) CheckCurrentEdition() error                         { return nil }
+func (d *testDatastore) MigrateData() error                                 { return nil }
+func (d *testDatastore) Rollback(force bool) error                          { return nil }
+func (d *testDatastore) AllowList() dataservices.AllowListService           { return d.allowList }
+func (d *testDatastore) CustomTemplate() dataservices.CustomTemplateService { return d.customTemplate }
+func (d *testDatastore) EdgeGroup() dataservices.EdgeGroupService           { return d.edgeGroup }
+func (d *testDatastore) EdgeJob() dataservices.EdgeJobService               { return d.edgeJob }
+func (d *testDatastore) EdgeStack() dataservices.EdgeStackService           { return d.edgeStack }
+func (d *testDatastore) EdgeStackStatus() dataservices.EdgeStackStatusService {
+	return d.edgeStackStatus
+}
+func (d *testDatastore) Endpoint() dataservices.EndpointService           { return d.endpoint }
+func (d *testDatastore) EndpointGroup() dataservices.EndpointGroupService { return d.endpointGroup }
+
+func (d *testDatastore) EndpointRelation() dataservices.EndpointRelationService {
+	return d.endpointRelation
+}
+
+func (d *testDatastore) HelmUserRepository() dataservices.HelmUserRepositoryService {
+	return d.helmUserRepository
+}
+func (d *testDatastore) Registry() dataservices.RegistryService { return d.registry }
+func (d *testDatastore) ResourceControl() dataservices.ResourceControlService {
+	return d.resourceControl
+}
+func (d *testDatastore) Source() dataservices.SourceService { return d.source }
+func (d *testDatastore) Role() dataservices.RoleService     { return d.role }
+func (d *testDatastore) APIKeyRepository() dataservices.APIKeyRepository {
+	return d.apiKeyRepositoryService
+}
+func (d *testDatastore) Settings() dataservices.SettingsService             { return d.settings }
+func (d *testDatastore) Snapshot() dataservices.SnapshotService             { return d.snapshot }
+func (d *testDatastore) SSLSettings() dataservices.SSLSettingsService       { return d.sslSettings }
+func (d *testDatastore) Stack() dataservices.StackService                   { return d.stack }
+func (d *testDatastore) Tag() dataservices.TagService                       { return d.tag }
+func (d *testDatastore) TeamMembership() dataservices.TeamMembershipService { return d.teamMembership }
+func (d *testDatastore) Team() dataservices.TeamService                     { return d.team }
+func (d *testDatastore) TunnelServer() dataservices.TunnelServerService     { return d.tunnelServer }
+func (d *testDatastore) User() dataservices.UserService                     { return d.user }
+func (d *testDatastore) Version() dataservices.VersionService               { return d.version }
+func (d *testDatastore) Webhook() dataservices.WebhookService               { return d.webhook }
+func (d *testDatastore) Workflow() dataservices.WorkflowService             { return d.workflow }
+
+func (d *testDatastore) PendingActions() dataservices.PendingActionsService {
+	return d.pendingActionsService
+}
+
+func (d *testDatastore) Connection() portainer.Connection {
+	return d.connection
+}
+
+func (d *testDatastore) IsErrObjectNotFound(e error) bool {
+	return false
+}
+
+func (d *testDatastore) Export(filename string) (err error) {
+	return nil
+}
+
+func (d *testDatastore) Import(filename string) (err error) {
+	return nil
+}
+
+type datastoreOption = func(d *testDatastore)
+
+// NewDatastore creates new instance of testDatastore.
+// Will apply options before returning, opts will be applied from left to right.
+func NewDatastore(options ...datastoreOption) *testDatastore {
+	conn, _ := database.NewDatabase("boltdb", "", nil, false)
+	d := testDatastore{connection: conn}
+
+	for _, o := range options {
+		o(&d)
+	}
+
+	return &d
+}
+
+type stubSettingsService struct {
+	settings *portainer.Settings
+}
+
+func (s *stubSettingsService) BucketName() string { return "settings" }
+
+func (s *stubSettingsService) Settings() (*portainer.Settings, error) {
+	return s.settings, nil
+}
+
+func (s *stubSettingsService) UpdateSettings(settings *portainer.Settings) error {
+	s.settings = settings
+
+	return nil
+}
+
+func WithSettingsService(settings *portainer.Settings) datastoreOption {
+	return func(d *testDatastore) {
+		d.settings = &stubSettingsService{
+			settings: settings,
+		}
+	}
+}
+
+type stubSSLSettingsService struct {
+	settings *portainer.SSLSettings
+}
+
+func (s *stubSSLSettingsService) BucketName() string { return "ssl" }
+
+func (s *stubSSLSettingsService) Settings() (*portainer.SSLSettings, error) {
+	return s.settings, nil
+}
+
+func (s *stubSSLSettingsService) UpdateSettings(settings *portainer.SSLSettings) error {
+	s.settings = settings
+	return nil
+}
+
+func WithSSLSettingsService(settings *portainer.SSLSettings) datastoreOption {
+	return func(d *testDatastore) {
+		d.sslSettings = &stubSSLSettingsService{settings: settings}
+	}
+}
+
+type stubUserService struct {
+	dataservices.UserService
+
+	users []portainer.User
+}
+
+func (s *stubUserService) BucketName() string { return "users" }
+func (s *stubUserService) ReadAll(predicates ...func(portainer.User) bool) ([]portainer.User, error) {
+	filtered := s.users
+
+	for _, p := range predicates {
+		filtered = slicesx.Filter(filtered, p)
+	}
+
+	return filtered, nil
+}
+
+func (s *stubUserService) UsersByRole(role portainer.UserRole) ([]portainer.User, error) {
+	return s.users, nil
+}
+
+// WithUsers testDatastore option that will instruct testDatastore to return provided users
+func WithUsers(us []portainer.User) datastoreOption {
+	return func(d *testDatastore) {
+		d.user = &stubUserService{users: us}
+	}
+}
+
+type stubEdgeJobService struct {
+	dataservices.EdgeJobService
+
+	jobs []portainer.EdgeJob
+}
+
+func (s *stubEdgeJobService) BucketName() string { return "edgejobs" }
+func (s *stubEdgeJobService) ReadAll(predicates ...func(portainer.EdgeJob) bool) ([]portainer.EdgeJob, error) {
+	filtered := s.jobs
+
+	for _, p := range predicates {
+		filtered = slicesx.Filter(filtered, p)
+	}
+
+	return filtered, nil
+}
+
+// WithEdgeJobs option will instruct testDatastore to return provided jobs
+func WithEdgeJobs(js []portainer.EdgeJob) datastoreOption {
+	return func(d *testDatastore) {
+		d.edgeJob = &stubEdgeJobService{jobs: js}
+	}
+}
+
+type stubEndpointRelationService struct {
+	dataservices.EndpointRelationService
+
+	relations []portainer.EndpointRelation
+}
+
+func (s *stubEndpointRelationService) BucketName() string { return "endpoint_relation" }
+func (s *stubEndpointRelationService) EndpointRelations() ([]portainer.EndpointRelation, error) {
+	return s.relations, nil
+}
+
+func (s *stubEndpointRelationService) EndpointRelation(ID portainer.EndpointID) (*portainer.EndpointRelation, error) {
+	for _, relation := range s.relations {
+		if relation.EndpointID == ID {
+			return &relation, nil
+		}
+	}
+
+	return nil, errors.ErrObjectNotFound
+}
+
+func (s *stubEndpointRelationService) UpdateEndpointRelation(ID portainer.EndpointID, relation *portainer.EndpointRelation) error {
+	for i, r := range s.relations {
+		if r.EndpointID == ID {
+			s.relations[i] = *relation
+		}
+	}
+
+	return nil
+}
+
+func (s *stubEndpointRelationService) AddEndpointRelationsForEdgeStack(endpointIDs []portainer.EndpointID, edgeStack *portainer.EdgeStack) error {
+	for _, endpointID := range endpointIDs {
+		for i, r := range s.relations {
+			if r.EndpointID == endpointID {
+				s.relations[i].EdgeStacks[edgeStack.ID] = true
+			}
+		}
+	}
+
+	return nil
+}
+
+func (s *stubEndpointRelationService) RemoveEndpointRelationsForEdgeStack(endpointIDs []portainer.EndpointID, edgeStackID portainer.EdgeStackID) error {
+	for _, endpointID := range endpointIDs {
+		for i, r := range s.relations {
+			if r.EndpointID == endpointID {
+				delete(s.relations[i].EdgeStacks, edgeStackID)
+			}
+		}
+	}
+
+	return nil
+}
+
+// WithEndpointRelations option will instruct testDatastore to return provided jobs
+func WithEndpointRelations(relations []portainer.EndpointRelation) datastoreOption {
+	return func(d *testDatastore) {
+		d.endpointRelation = &stubEndpointRelationService{relations: relations}
+	}
+}
+
+type stubEndpointService struct {
+	dataservices.EndpointService
+
+	endpoints []portainer.Endpoint
+}
+
+func (s *stubEndpointService) BucketName() string { return "endpoint" }
+func (s *stubEndpointService) Endpoint(ID portainer.EndpointID) (*portainer.Endpoint, error) {
+	for _, endpoint := range s.endpoints {
+		if endpoint.ID == ID {
+			return &endpoint, nil
+		}
+	}
+
+	return nil, errors.ErrObjectNotFound
+}
+
+func (s *stubEndpointService) EndpointIDByEdgeID(edgeID string) (portainer.EndpointID, bool) {
+	for _, endpoint := range s.endpoints {
+		if endpoint.EdgeID == edgeID {
+			return endpoint.ID, true
+		}
+	}
+
+	return 0, false
+}
+
+func (s *stubEndpointService) Heartbeat(endpointID portainer.EndpointID) (int64, bool) {
+	for i, endpoint := range s.endpoints {
+		if endpoint.ID == endpointID {
+			return s.endpoints[i].LastCheckInDate, true
+		}
+	}
+
+	return 0, false
+}
+
+func (s *stubEndpointService) UpdateHeartbeat(endpointID portainer.EndpointID) {
+	for i, endpoint := range s.endpoints {
+		if endpoint.ID == endpointID {
+			s.endpoints[i].LastCheckInDate = time.Now().Unix()
+		}
+	}
+}
+
+func (s *stubEndpointService) Endpoints() ([]portainer.Endpoint, error) {
+	return s.endpoints, nil
+}
+
+func (s *stubEndpointService) Create(endpoint *portainer.Endpoint) error {
+	s.endpoints = append(s.endpoints, *endpoint)
+
+	return nil
+}
+
+func (s *stubEndpointService) UpdateEndpoint(ID portainer.EndpointID, endpoint *portainer.Endpoint) error {
+	for i, e := range s.endpoints {
+		if e.ID == ID {
+			s.endpoints[i] = *endpoint
+		}
+	}
+
+	return nil
+}
+
+func (s *stubEndpointService) DeleteEndpoint(ID portainer.EndpointID) error {
+	endpoints := []portainer.Endpoint{}
+
+	for _, endpoint := range s.endpoints {
+		if endpoint.ID != ID {
+			endpoints = append(endpoints, endpoint)
+		}
+	}
+
+	s.endpoints = endpoints
+
+	return nil
+}
+
+func (s *stubEndpointService) GetNextIdentifier() int {
+	return len(s.endpoints)
+}
+
+func (s *stubEndpointService) EndpointsByTeamID(teamID portainer.TeamID) ([]portainer.Endpoint, error) {
+	endpoints := make([]portainer.Endpoint, 0)
+
+	for _, e := range s.endpoints {
+		for t := range e.TeamAccessPolicies {
+			if t == teamID {
+				endpoints = append(endpoints, e)
+			}
+		}
+	}
+
+	return endpoints, nil
+}
+
+// WithEndpoints option will instruct testDatastore to return provided environments(endpoints)
+func WithEndpoints(endpoints []portainer.Endpoint) datastoreOption {
+	return func(d *testDatastore) {
+		d.endpoint = &stubEndpointService{endpoints: endpoints}
+	}
+}
+
+type stubStacksService struct {
+	dataservices.StackService
+	stacks []portainer.Stack
+}
+
+func (s *stubStacksService) BucketName() string { return "stacks" }
+
+func (s *stubStacksService) Read(ID portainer.StackID) (*portainer.Stack, error) {
+	for _, stack := range s.stacks {
+		if stack.ID == ID {
+			return &stack, nil
+		}
+	}
+
+	return nil, errors.ErrObjectNotFound
+}
+
+func (s *stubStacksService) ReadAll(predicates ...func(portainer.Stack) bool) ([]portainer.Stack, error) {
+	filtered := s.stacks
+
+	for _, p := range predicates {
+		filtered = slicesx.Filter(filtered, p)
+	}
+
+	return filtered, nil
+}
+
+func (s *stubStacksService) StacksByEndpointID(endpointID portainer.EndpointID) ([]portainer.Stack, error) {
+	result := make([]portainer.Stack, 0)
+
+	for _, stack := range s.stacks {
+		if stack.EndpointID == endpointID {
+			result = append(result, stack)
+		}
+	}
+
+	return result, nil
+}
+
+func (s *stubStacksService) RefreshableStacks() ([]portainer.Stack, error) {
+	result := make([]portainer.Stack, 0)
+
+	for _, stack := range s.stacks {
+		if stack.AutoUpdate != nil {
+			result = append(result, stack)
+		}
+	}
+
+	return result, nil
+}
+
+func (s *stubStacksService) StackByName(name string) (*portainer.Stack, error) {
+	for _, stack := range s.stacks {
+		if stack.Name == name {
+			return &stack, nil
+		}
+	}
+
+	return nil, errors.ErrObjectNotFound
+}
+
+func (s *stubStacksService) StacksByName(name string) ([]portainer.Stack, error) {
+	result := make([]portainer.Stack, 0)
+
+	for _, stack := range s.stacks {
+		if stack.Name == name {
+			result = append(result, stack)
+		}
+	}
+
+	return result, nil
+}
+
+func (s *stubStacksService) StackByWebhookID(webhookID string) (*portainer.Stack, error) {
+	for _, stack := range s.stacks {
+		if stack.AutoUpdate != nil && stack.AutoUpdate.Webhook == webhookID {
+			return &stack, nil
+		}
+	}
+
+	return nil, errors.ErrObjectNotFound
+}
+
+func (s *stubStacksService) GetNextIdentifier() int {
+	return len(s.stacks)
+}
+
+func (s *stubStacksService) Exists(ID portainer.StackID) (bool, error) {
+	return false, nil
+}
+
+// WithStacks option will instruct testDatastore to return provided stacks
+func WithStacks(stacks []portainer.Stack) datastoreOption {
+	return func(d *testDatastore) {
+		d.stack = &stubStacksService{stacks: stacks}
+	}
+}
+
+type stubPendingActionService struct {
+	actions []portainer.PendingAction
+	dataservices.PendingActionsService
+}
+
+func WithPendingActions(pendingActions []portainer.PendingAction) datastoreOption {
+	return func(d *testDatastore) {
+		d.pendingActionsService = &stubPendingActionService{
+			actions: pendingActions,
+		}
+	}
+}
+
+func (s *stubPendingActionService) ReadAll(predicates ...func(portainer.PendingAction) bool) ([]portainer.PendingAction, error) {
+	filtered := s.actions
+
+	for _, predicate := range predicates {
+		filtered = slicesx.Filter(filtered, predicate)
+	}
+
+	return filtered, nil
+}
+
+func (s *stubPendingActionService) Delete(ID portainer.PendingActionID) error {
+	actions := []portainer.PendingAction{}
+
+	for _, action := range s.actions {
+		if action.ID != ID {
+			actions = append(actions, action)
+		}
+	}
+	s.actions = actions
+
+	return nil
+}
diff --git a/api/internal/testhelpers/git_service.go b/api/internal/testhelpers/git_service.go
new file mode 100644
index 0000000..1024a4b
--- /dev/null
+++ b/api/internal/testhelpers/git_service.go
@@ -0,0 +1,68 @@
+package testhelpers
+
+import (
+	"context"
+
+	portainer "github.com/portainer/portainer/api"
+)
+
+type gitService struct {
+	cloneErr error
+	id       string
+}
+
+// NewGitService creates new mock for portainer.GitService.
+func NewGitService(cloneErr error, id string) portainer.GitService {
+	return &gitService{
+		cloneErr: cloneErr,
+		id:       id,
+	}
+}
+
+func (g *gitService) CloneRepository(
+	_ context.Context,
+	destination,
+	repositoryURL,
+	referenceName,
+	username,
+	password string,
+	tlsSkipVerify bool,
+) error {
+	return g.cloneErr
+}
+
+func (g *gitService) LatestCommitID(
+	_ context.Context,
+	repositoryURL,
+	referenceName,
+	username,
+	password string,
+	tlsSkipVerify bool,
+) (string, error) {
+	return g.id, nil
+}
+
+func (g *gitService) ListRefs(
+	_ context.Context,
+	repositoryURL,
+	username,
+	password string,
+	hardRefresh bool,
+	tlsSkipVerify bool,
+) ([]string, error) {
+	return nil, nil
+}
+
+func (g *gitService) ListFiles(
+	_ context.Context,
+	repositoryURL,
+	referenceName,
+	username,
+	password string,
+	dirOnly,
+	hardRefresh bool,
+	includedExts []string,
+	tlsSkipVerify bool,
+) ([]string, error) {
+	return nil, nil
+}
diff --git a/api/internal/testhelpers/kube_client.go b/api/internal/testhelpers/kube_client.go
new file mode 100644
index 0000000..9c1bc76
--- /dev/null
+++ b/api/internal/testhelpers/kube_client.go
@@ -0,0 +1,26 @@
+package testhelpers
+
+import (
+	"context"
+
+	portainer "github.com/portainer/portainer/api"
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+)
+
+type testKubeClient struct {
+	portainer.KubeClient
+}
+
+func NewKubernetesClient() portainer.KubeClient {
+	return &testKubeClient{}
+}
+
+// Event
+func (kcl *testKubeClient) GetEvents(namespace string, resourceId string) ([]models.K8sEvent, error) {
+	return nil, nil
+}
+
+// Pod
+func (kcl *testKubeClient) DeletePod(namespace, name string) error             { return nil }
+func (kcl *testKubeClient) RestartPod(namespace, name string) error            { return nil }
+func (kcl *testKubeClient) SupportsPodRestart(_ context.Context) (bool, error) { return false, nil }
diff --git a/api/internal/testhelpers/request_bouncer.go b/api/internal/testhelpers/request_bouncer.go
new file mode 100644
index 0000000..c5720df
--- /dev/null
+++ b/api/internal/testhelpers/request_bouncer.go
@@ -0,0 +1,71 @@
+package testhelpers
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+)
+
+type testRequestBouncer struct{}
+
+// NewTestRequestBouncer creates new mock for requestBouncer
+func NewTestRequestBouncer() testRequestBouncer {
+	return testRequestBouncer{}
+}
+
+func (testRequestBouncer) AuthenticatedAccess(h http.Handler) http.Handler {
+	return h
+}
+
+func (testRequestBouncer) AdminAccess(h http.Handler) http.Handler {
+	return h
+}
+
+func (testRequestBouncer) RestrictedAccess(h http.Handler) http.Handler {
+	return h
+}
+
+func (testRequestBouncer) PublicAccess(h http.Handler) http.Handler {
+	return h
+}
+
+func (testRequestBouncer) TeamLeaderAccess(h http.Handler) http.Handler {
+	return h
+}
+
+func (testRequestBouncer) EdgeComputeOperation(h http.Handler) http.Handler {
+	return h
+}
+
+func (testRequestBouncer) AuthorizedEndpointOperation(r *http.Request, endpoint *portainer.Endpoint) error {
+	return nil
+}
+
+func (testRequestBouncer) AuthorizedEdgeEndpointOperation(r *http.Request, endpoint *portainer.Endpoint) error {
+	return nil
+}
+
+func (testRequestBouncer) TrustedEdgeEnvironmentAccess(tx dataservices.DataStoreTx, endpoint *portainer.Endpoint) error {
+	return nil
+}
+
+func (testRequestBouncer) CookieAuthLookup(r *http.Request) (*portainer.TokenData, error) {
+	return nil, nil
+}
+
+func (testRequestBouncer) JWTAuthLookup(r *http.Request) (*portainer.TokenData, error) {
+	return nil, nil
+}
+
+func (testRequestBouncer) RevokeJWT(jti string) {}
+
+func (testRequestBouncer) DisableCSP() {}
+
+// AddTestSecurityCookie adds a security cookie to the request
+func AddTestSecurityCookie(r *http.Request, jwt string) {
+	r.AddCookie(&http.Cookie{
+		Name:  portainer.AuthCookieKey,
+		Value: jwt,
+	})
+}
diff --git a/api/internal/testhelpers/stack_deployer.go b/api/internal/testhelpers/stack_deployer.go
new file mode 100644
index 0000000..9d39223
--- /dev/null
+++ b/api/internal/testhelpers/stack_deployer.go
@@ -0,0 +1,69 @@
+package testhelpers
+
+import (
+	"context"
+
+	portainer "github.com/portainer/portainer/api"
+)
+
+type TestStackDeployer struct {
+	DeployComposeCallCount int
+	DeploySwarmCallCount   int
+	LastPrune              bool
+}
+
+func NewTestStackDeployer() *TestStackDeployer {
+	return &TestStackDeployer{}
+}
+
+func (d *TestStackDeployer) DeployComposeStack(_ context.Context, stack *portainer.Stack, endpoint *portainer.Endpoint, registries []portainer.Registry, prune, forcePullImage, forceRecreate bool) error {
+	d.DeployComposeCallCount++
+	d.LastPrune = prune
+	return nil
+}
+
+func (d *TestStackDeployer) UndeployComposeStack(ctx context.Context, stack *portainer.Stack, endpoint *portainer.Endpoint) error {
+	return nil
+}
+
+func (d *TestStackDeployer) DeploySwarmStack(_ context.Context, stack *portainer.Stack, endpoint *portainer.Endpoint, registries []portainer.Registry, prune, pullImage bool) error {
+	d.DeploySwarmCallCount++
+	d.LastPrune = prune
+	return nil
+}
+
+func (d *TestStackDeployer) DeployKubernetesStack(_ context.Context, stack *portainer.Stack, endpoint *portainer.Endpoint, user *portainer.User) error {
+	return nil
+}
+
+func (d *TestStackDeployer) DeployRemoteComposeStack(_ context.Context, userId portainer.UserID, stack *portainer.Stack, endpoint *portainer.Endpoint, registries []portainer.Registry, prune, forcePullImage, forceRecreate bool) error {
+	return nil
+}
+
+func (d *TestStackDeployer) UndeployRemoteComposeStack(_ context.Context, userId portainer.UserID, stack *portainer.Stack, endpoint *portainer.Endpoint) error {
+	return nil
+}
+
+func (d *TestStackDeployer) StartRemoteComposeStack(_ context.Context, userId portainer.UserID, stack *portainer.Stack, endpoint *portainer.Endpoint, registries []portainer.Registry) error {
+	return nil
+}
+
+func (d *TestStackDeployer) StopRemoteComposeStack(_ context.Context, userId portainer.UserID, stack *portainer.Stack, endpoint *portainer.Endpoint) error {
+	return nil
+}
+
+func (d *TestStackDeployer) DeployRemoteSwarmStack(_ context.Context, userId portainer.UserID, stack *portainer.Stack, endpoint *portainer.Endpoint, registries []portainer.Registry, prune, pullImage bool) error {
+	return nil
+}
+
+func (d *TestStackDeployer) UndeployRemoteSwarmStack(_ context.Context, userId portainer.UserID, stack *portainer.Stack, endpoint *portainer.Endpoint) error {
+	return nil
+}
+
+func (d *TestStackDeployer) StartRemoteSwarmStack(_ context.Context, userId portainer.UserID, stack *portainer.Stack, endpoint *portainer.Endpoint, registries []portainer.Registry) error {
+	return nil
+}
+
+func (d *TestStackDeployer) StopRemoteSwarmStack(_ context.Context, userId portainer.UserID, stack *portainer.Stack, endpoint *portainer.Endpoint) error {
+	return nil
+}
diff --git a/api/internal/testhelpers/user_activity_service.go b/api/internal/testhelpers/user_activity_service.go
new file mode 100644
index 0000000..4e5828c
--- /dev/null
+++ b/api/internal/testhelpers/user_activity_service.go
@@ -0,0 +1,12 @@
+package testhelpers
+
+type userActivityService struct {
+}
+
+func NewUserActivityService() *userActivityService {
+	return &userActivityService{}
+}
+
+func (service *userActivityService) LogUserActivity(username string, context string, action string, payload []byte) error {
+	return nil
+}
diff --git a/api/internal/upgrade/upgrade.go b/api/internal/upgrade/upgrade.go
new file mode 100644
index 0000000..472875d
--- /dev/null
+++ b/api/internal/upgrade/upgrade.go
@@ -0,0 +1,81 @@
+package upgrade
+
+import (
+	"fmt"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	dockerclient "github.com/portainer/portainer/api/docker/client"
+	kubecli "github.com/portainer/portainer/api/kubernetes/cli"
+	plf "github.com/portainer/portainer/api/platform"
+	"github.com/portainer/portainer/api/stacks/deployments"
+	"github.com/rs/zerolog/log"
+)
+
+const (
+	// mustacheUpgradeDockerTemplateFile represents the name of the template file for the docker upgrade
+	mustacheUpgradeDockerTemplateFile = "upgrade-docker.yml.mustache"
+
+	// portainerImagePrefixEnvVar represents the name of the environment variable used to define the image prefix for portainer-updater
+	// useful if there's a need to test PR images
+	portainerImagePrefixEnvVar = "UPGRADE_PORTAINER_IMAGE_PREFIX"
+	// skipPullImageEnvVar represents the name of the environment variable used to define if the image pull should be skipped
+	// useful if there's a need to test local images
+	skipPullImageEnvVar = "UPGRADE_SKIP_PULL_PORTAINER_IMAGE"
+	// updaterImageEnvVar represents the name of the environment variable used to define the updater image
+	// useful if there's a need to test a different updater
+	updaterImageEnvVar = "UPGRADE_UPDATER_IMAGE"
+)
+
+type Service interface {
+	Upgrade(platform plf.ContainerPlatform, environment *portainer.Endpoint, licenseKey string) error
+}
+
+type service struct {
+	kubernetesClientFactory   *kubecli.ClientFactory
+	dockerClientFactory       *dockerclient.ClientFactory
+	dockerComposeStackManager portainer.ComposeStackManager
+	fileService               portainer.FileService
+
+	isUpdating bool
+
+	assetsPath string
+}
+
+func NewService(
+	assetsPath string,
+	kubernetesClientFactory *kubecli.ClientFactory,
+	dockerClientFactory *dockerclient.ClientFactory,
+	dockerComposeStackManager portainer.ComposeStackManager,
+	dataStore dataservices.DataStore,
+	fileService portainer.FileService,
+	stackDeployer deployments.StackDeployer,
+) (Service, error) {
+
+	return &service{
+		assetsPath:                assetsPath,
+		kubernetesClientFactory:   kubernetesClientFactory,
+		dockerClientFactory:       dockerClientFactory,
+		dockerComposeStackManager: dockerComposeStackManager,
+		fileService:               fileService,
+	}, nil
+}
+
+func (service *service) Upgrade(platform plf.ContainerPlatform, environment *portainer.Endpoint, licenseKey string) error {
+	service.isUpdating = true
+	log.Debug().
+		Str("platform", string(platform)).
+		Msg("Starting upgrade process")
+
+	switch platform {
+	case plf.PlatformDockerStandalone:
+		return service.upgradeDocker(environment, licenseKey, portainer.APIVersion, "standalone")
+	case plf.PlatformDockerSwarm:
+		return service.upgradeDocker(environment, licenseKey, portainer.APIVersion, "swarm")
+	case plf.PlatformKubernetes:
+		return service.upgradeKubernetes(environment, licenseKey, portainer.APIVersion)
+	}
+
+	service.isUpdating = false
+	return fmt.Errorf("unsupported platform %s", platform)
+}
diff --git a/api/internal/upgrade/upgrade_docker.go b/api/internal/upgrade/upgrade_docker.go
new file mode 100644
index 0000000..7f5a245
--- /dev/null
+++ b/api/internal/upgrade/upgrade_docker.go
@@ -0,0 +1,127 @@
+package upgrade
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/docker/docker/api/types/filters"
+	"github.com/docker/docker/api/types/image"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/filesystem"
+
+	"github.com/cbroglie/mustache"
+	"github.com/pkg/errors"
+	"github.com/rs/zerolog/log"
+)
+
+func (service *service) upgradeDocker(environment *portainer.Endpoint, licenseKey, version string, envType string) error {
+	ctx := context.TODO()
+
+	templateName := filesystem.JoinPaths(service.assetsPath, "mustache-templates", mustacheUpgradeDockerTemplateFile)
+
+	portainerImagePrefix := os.Getenv(portainerImagePrefixEnvVar)
+	if portainerImagePrefix == "" {
+		portainerImagePrefix = "portainer/portainer-ee"
+	}
+
+	image := fmt.Sprintf("%s:%s", portainerImagePrefix, version)
+
+	skipPullImageEnv := os.Getenv(skipPullImageEnvVar)
+	skipPullImage := skipPullImageEnv != ""
+
+	if err := service.checkImageForDocker(ctx, environment, image, skipPullImage); err != nil {
+		return err
+	}
+
+	updaterImage := getUpdaterImage()
+
+	composeFile, err := mustache.RenderFile(templateName, map[string]string{
+		"image":           image,
+		"skip_pull_image": skipPullImageEnv,
+		"updater_image":   updaterImage,
+		"license":         licenseKey,
+		"envType":         envType,
+	})
+
+	log.Debug().
+		Str("composeFile", composeFile).
+		Msg("Compose file for upgrade")
+
+	if err != nil {
+		return errors.Wrap(err, "failed to render upgrade template")
+	}
+
+	timeId := time.Now().Unix()
+	fileName := fmt.Sprintf("upgrade-%d.yml", timeId)
+
+	filePath, err := service.fileService.StoreStackFileFromBytes("upgrade", fileName, []byte(composeFile))
+	if err != nil {
+		return errors.Wrap(err, "failed to create upgrade compose file")
+	}
+
+	projectName := fmt.Sprintf(
+		"portainer-upgrade-%d-%s",
+		timeId,
+		strings.ReplaceAll(version, ".", "-"),
+	)
+
+	tempStack := &portainer.Stack{
+		Name:        projectName,
+		ProjectPath: filePath,
+		EntryPoint:  fileName,
+	}
+
+	err = service.dockerComposeStackManager.Run(ctx, tempStack, environment, "updater", portainer.ComposeRunOptions{
+		Remove:   true,
+		Detached: true,
+	})
+
+	if err != nil {
+		return errors.Wrap(err, "failed to deploy upgrade stack")
+	}
+
+	return nil
+}
+
+func (service *service) checkImageForDocker(ctx context.Context, environment *portainer.Endpoint, imageName string, skipPullImage bool) error {
+	cli, err := service.dockerClientFactory.CreateClient(environment, "", nil)
+	if err != nil {
+		return errors.Wrap(err, "failed to create docker client")
+	}
+
+	if skipPullImage {
+		filters := filters.NewArgs()
+		filters.Add("reference", imageName)
+		images, err := cli.ImageList(ctx, image.ListOptions{
+			Filters: filters,
+		})
+		if err != nil {
+			return errors.Wrap(err, "failed to list images")
+		}
+
+		if len(images) == 0 {
+			return errors.Errorf("image %s not found locally", imageName)
+		}
+
+		return nil
+	} else {
+		// check if available on registry
+		_, err := cli.DistributionInspect(ctx, imageName, "")
+		if err != nil {
+			return errors.Errorf("image %s not found on registry", imageName)
+		}
+
+		return nil
+	}
+}
+
+func getUpdaterImage() string {
+	updaterImage := os.Getenv(updaterImageEnvVar)
+	if updaterImage == "" {
+		updaterImage = "portainer/portainer-updater:" + portainer.APIVersion
+	}
+	return updaterImage
+}
diff --git a/api/internal/upgrade/upgrade_docker_test.go b/api/internal/upgrade/upgrade_docker_test.go
new file mode 100644
index 0000000..b994f6a
--- /dev/null
+++ b/api/internal/upgrade/upgrade_docker_test.go
@@ -0,0 +1,32 @@
+package upgrade
+
+import (
+	"os"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetUpdaterImage(t *testing.T) {
+	t.Run("updater image Environment Variable is set", func(t *testing.T) {
+		t.Setenv(updaterImageEnvVar, "portainer/portainer-updater:pr111")
+
+		expect := "portainer/portainer-updater:pr111"
+		updaterImage := getUpdaterImage()
+		if updaterImage != expect {
+			t.Fatalf("expected %v, got %v", expect, updaterImage)
+		}
+	})
+
+	t.Run("updater image Environment Variable not set", func(t *testing.T) {
+		err := os.Unsetenv(updaterImageEnvVar)
+		require.NoError(t, err)
+
+		expect := "portainer/portainer-updater:" + portainer.APIVersion
+		updaterImage := getUpdaterImage()
+		if updaterImage != expect {
+			t.Fatalf("expected %v, got %v", expect, updaterImage)
+		}
+	})
+}
diff --git a/api/internal/upgrade/upgrade_kubernetes.go b/api/internal/upgrade/upgrade_kubernetes.go
new file mode 100644
index 0000000..d4a49a4
--- /dev/null
+++ b/api/internal/upgrade/upgrade_kubernetes.go
@@ -0,0 +1,199 @@
+package upgrade
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"time"
+
+	"github.com/pkg/errors"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/rs/zerolog/log"
+	batchv1 "k8s.io/api/batch/v1"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes"
+)
+
+func (service *service) upgradeKubernetes(environment *portainer.Endpoint, licenseKey, version string) error {
+	ctx := context.TODO()
+
+	kubeCLI, _, err := service.kubernetesClientFactory.CreateClient(environment)
+	if err != nil {
+		return errors.WithMessage(err, "failed to get kubernetes client")
+	}
+
+	namespace := "portainer"
+	taskName := fmt.Sprintf("portainer-upgrade-%d", time.Now().Unix())
+
+	jobsCli := kubeCLI.BatchV1().Jobs(namespace)
+
+	updaterImage := os.Getenv(updaterImageEnvVar)
+	if updaterImage == "" {
+		updaterImage = "portainer/portainer-updater:latest"
+	}
+
+	portainerImagePrefix := os.Getenv(portainerImagePrefixEnvVar)
+	if portainerImagePrefix == "" {
+		portainerImagePrefix = "portainer/portainer-ee"
+	}
+
+	image := fmt.Sprintf("%s:%s", portainerImagePrefix, version)
+
+	if err := service.checkImageForKubernetes(ctx, kubeCLI, namespace, image); err != nil {
+		return err
+	}
+
+	job, err := jobsCli.Create(ctx, &batchv1.Job{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      taskName,
+			Namespace: namespace,
+		},
+
+		Spec: batchv1.JobSpec{
+			TTLSecondsAfterFinished: new(int32(5 * 60)), // cleanup after 5 minutes
+			BackoffLimit:            new(int32(0)),
+			Template: corev1.PodTemplateSpec{
+				Spec: corev1.PodSpec{
+
+					RestartPolicy:      "Never",
+					ServiceAccountName: "portainer-sa-clusteradmin",
+					Containers: []corev1.Container{
+						{
+							Name:  taskName,
+							Image: updaterImage,
+							Args: []string{
+								"--pretty-log",
+								"--log-level", "DEBUG",
+								"portainer",
+								"--env-type", "kubernetes",
+								"--image", image,
+								"--license", licenseKey,
+							},
+						},
+					},
+				},
+			},
+		},
+	}, metav1.CreateOptions{})
+
+	if err != nil {
+		return errors.WithMessage(err, "failed to create upgrade job")
+	}
+
+	watcher, err := jobsCli.Watch(ctx, metav1.ListOptions{
+		FieldSelector:  "metadata.name=" + taskName,
+		TimeoutSeconds: new(int64(60)),
+	})
+	if err != nil {
+		return errors.WithMessage(err, "failed to watch upgrade job")
+	}
+
+	for event := range watcher.ResultChan() {
+		job, ok := event.Object.(*batchv1.Job)
+		if !ok {
+			continue
+		}
+
+		for _, c := range job.Status.Conditions {
+			if c.Type == batchv1.JobComplete {
+				log.Debug().
+					Str("job", job.Name).
+					Msg("Upgrade job completed")
+				return nil
+			}
+
+			if c.Type == batchv1.JobFailed {
+				return fmt.Errorf("upgrade failed: %s", c.Message)
+			}
+		}
+	}
+
+	log.Debug().
+		Str("job", job.Name).
+		Msg("Upgrade job created")
+
+	return errors.New("upgrade failed: server should have been restarted by the updater")
+
+}
+
+func (service *service) checkImageForKubernetes(ctx context.Context, kubeCLI *kubernetes.Clientset, namespace, image string) error {
+	podsCli := kubeCLI.CoreV1().Pods(namespace)
+
+	log.Debug().
+		Str("image", image).
+		Msg("Checking image")
+
+	podName := fmt.Sprintf("portainer-image-check-%d", time.Now().Unix())
+	_, err := podsCli.Create(ctx, &corev1.Pod{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: podName,
+		},
+		Spec: corev1.PodSpec{
+			RestartPolicy: "Never",
+
+			Containers: []corev1.Container{
+				{
+					Name:  fmt.Sprint(podName, "-container"),
+					Image: image,
+				},
+			},
+		},
+	}, metav1.CreateOptions{})
+
+	if err != nil {
+		log.Warn().Err(err).Msg("failed to create image check pod")
+		return errors.WithMessage(err, "failed to create image check pod")
+	}
+
+	defer func() {
+		log.Debug().
+			Str("pod", podName).
+			Msg("Deleting image check pod")
+
+		if err := podsCli.Delete(ctx, podName, metav1.DeleteOptions{}); err != nil {
+			log.Warn().Err(err).Msg("failed to delete image check pod")
+		}
+	}()
+
+	i := 0
+	for {
+		time.Sleep(2 * time.Second)
+
+		log.Debug().
+			Str("image", image).
+			Int("try", i).
+			Msg("Checking image")
+
+		i++
+
+		pod, err := podsCli.Get(ctx, podName, metav1.GetOptions{})
+		if err != nil {
+			return errors.WithMessage(err, "failed to get image check pod")
+		}
+
+		for _, containerStatus := range pod.Status.ContainerStatuses {
+			if containerStatus.Ready {
+				log.Debug().
+					Str("image", image).
+					Str("pod", podName).
+					Msg("Image check container ready, assuming image is available")
+
+				return nil
+			}
+
+			if containerStatus.State.Waiting != nil {
+				if containerStatus.State.Waiting.Reason == "ErrImagePull" || containerStatus.State.Waiting.Reason == "ImagePullBackOff" {
+					log.Debug().
+						Str("image", image).
+						Str("pod", podName).
+						Str("reason", containerStatus.State.Waiting.Reason).
+						Str("message", containerStatus.State.Waiting.Message).
+						Str("container", containerStatus.Name).
+						Msg("Image check container failed because of missing image")
+					return fmt.Errorf("image %s not found", image)
+				}
+			}
+		}
+	}
+}
diff --git a/api/jwt/jwt.go b/api/jwt/jwt.go
new file mode 100644
index 0000000..f461f48
--- /dev/null
+++ b/api/jwt/jwt.go
@@ -0,0 +1,214 @@
+package jwt
+
+import (
+	"errors"
+	"fmt"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/apikey"
+	"github.com/portainer/portainer/api/dataservices"
+
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/google/uuid"
+	"github.com/rs/zerolog/log"
+)
+
+const (
+	year = time.Hour * 24 * 365
+
+	keyLen = 32
+
+	defaultScope    = scope("default")
+	kubeConfigScope = scope("kubeconfig")
+)
+
+// scope represents JWT scopes that are supported in JWT claims.
+type scope string
+
+// Service represents a service for managing JWT tokens.
+type Service struct {
+	secrets            map[scope][]byte
+	userSessionTimeout time.Duration
+	dataStore          dataservices.DataStore
+}
+
+type claims struct {
+	UserID              int    `json:"id"`
+	Username            string `json:"username"`
+	Role                int    `json:"role"`
+	Scope               scope  `json:"scope"`
+	ForceChangePassword bool   `json:"forceChangePassword"`
+	jwt.RegisteredClaims
+}
+
+var (
+	errSecretGeneration = errors.New("unable to generate secret key")
+	errInvalidJWTToken  = errors.New("invalid JWT token")
+)
+
+// NewService initializes a new service. It will generate a random key that will be used to sign JWT tokens.
+func NewService(userSessionDuration string, dataStore dataservices.DataStore) (*Service, error) {
+	userSessionTimeout, err := time.ParseDuration(userSessionDuration)
+	if err != nil {
+		return nil, err
+	}
+
+	secret := apikey.GenerateRandomKey(keyLen)
+	if secret == nil {
+		return nil, errSecretGeneration
+	}
+
+	kubeSecret, err := getOrCreateKubeSecret(dataStore)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Service{
+		map[scope][]byte{
+			defaultScope:    secret,
+			kubeConfigScope: kubeSecret,
+		},
+		userSessionTimeout,
+		dataStore,
+	}, nil
+}
+
+func getOrCreateKubeSecret(dataStore dataservices.DataStore) ([]byte, error) {
+	settings, err := dataStore.Settings().Settings()
+	if err != nil {
+		return nil, err
+	}
+
+	kubeSecret := settings.OAuthSettings.KubeSecretKey
+	if kubeSecret != nil {
+		return kubeSecret, nil
+	}
+
+	kubeSecret = apikey.GenerateRandomKey(keyLen)
+	if kubeSecret == nil {
+		return nil, errSecretGeneration
+	}
+
+	settings.OAuthSettings.KubeSecretKey = kubeSecret
+
+	if err := dataStore.Settings().UpdateSettings(settings); err != nil {
+		return nil, err
+	}
+
+	return kubeSecret, nil
+}
+
+func (service *Service) defaultExpireAt() time.Time {
+	return time.Now().Add(service.userSessionTimeout)
+}
+
+// GenerateToken generates a new JWT token.
+func (service *Service) GenerateToken(data *portainer.TokenData) (string, time.Time, error) {
+	expiryTime := service.defaultExpireAt()
+	token, err := service.generateSignedToken(data, expiryTime, defaultScope)
+
+	return token, expiryTime, err
+}
+
+// ParseAndVerifyToken parses a JWT token and verify its validity. It returns an error if token is invalid.
+func (service *Service) ParseAndVerifyToken(token string) (*portainer.TokenData, string, time.Time, error) {
+	scope := parseScope(token)
+	secret := service.secrets[scope]
+
+	parsedToken, err := jwt.ParseWithClaims(token, &claims{}, func(token *jwt.Token) (any, error) {
+		if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
+			return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
+		}
+
+		return secret, nil
+	})
+	if err != nil || parsedToken == nil {
+		return nil, "", time.Time{}, errInvalidJWTToken
+	}
+
+	cl, ok := parsedToken.Claims.(*claims)
+	if !ok || !parsedToken.Valid {
+		return nil, "", time.Time{}, errInvalidJWTToken
+	}
+
+	user, err := service.dataStore.User().Read(portainer.UserID(cl.UserID))
+	if err != nil || user.TokenIssueAt > cl.IssuedAt.Unix() {
+		return nil, "", time.Time{}, errInvalidJWTToken
+	}
+
+	if cl.ExpiresAt == nil {
+		cl.ExpiresAt = &jwt.NumericDate{}
+	}
+
+	return &portainer.TokenData{
+		ID:                  portainer.UserID(cl.UserID),
+		Username:            cl.Username,
+		Role:                portainer.UserRole(cl.Role),
+		Token:               token,
+		ForceChangePassword: cl.ForceChangePassword,
+	}, cl.ID, cl.ExpiresAt.Time, nil
+}
+
+// Parse a JWT token, fallback to defaultScope if no scope is present in the JWT
+func parseScope(token string) scope {
+	unverifiedToken, _, _ := new(jwt.Parser).ParseUnverified(token, &claims{})
+	if unverifiedToken == nil {
+		return defaultScope
+	}
+
+	if cl, ok := unverifiedToken.Claims.(*claims); ok && cl.Scope == kubeConfigScope {
+		return kubeConfigScope
+	}
+
+	return defaultScope
+}
+
+// SetUserSessionDuration sets the user session duration
+func (service *Service) SetUserSessionDuration(userSessionDuration time.Duration) {
+	service.userSessionTimeout = userSessionDuration
+}
+
+func (service *Service) generateSignedToken(data *portainer.TokenData, expiresAt time.Time, scope scope) (string, error) {
+	secret, found := service.secrets[scope]
+	if !found {
+		return "", fmt.Errorf("invalid scope: %v", scope)
+	}
+
+	settings, err := service.dataStore.Settings().Settings()
+	if err != nil {
+		return "", fmt.Errorf("failed fetching settings from db: %w", err)
+	}
+
+	if settings.IsDockerDesktopExtension {
+		log.Info().Msg("detected docker desktop extension mode")
+		expiresAt = time.Now().Add(99 * year)
+	}
+
+	uuid, err := uuid.NewRandom()
+	if err != nil {
+		return "", fmt.Errorf("unable to generate the JWT ID: %w", err)
+	}
+
+	cl := claims{
+		UserID:              int(data.ID),
+		Username:            data.Username,
+		Role:                int(data.Role),
+		Scope:               scope,
+		ForceChangePassword: data.ForceChangePassword,
+		RegisteredClaims: jwt.RegisteredClaims{
+			ID:        uuid.String(),
+			IssuedAt:  jwt.NewNumericDate(time.Now()),
+			ExpiresAt: jwt.NewNumericDate(expiresAt),
+		},
+	}
+
+	// If expiresAt is set to a zero value, the token should never expire
+	if expiresAt.IsZero() {
+		cl.ExpiresAt = nil
+	}
+
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, cl)
+
+	return token.SignedString(secret)
+}
diff --git a/api/jwt/jwt_kubeconfig.go b/api/jwt/jwt_kubeconfig.go
new file mode 100644
index 0000000..7913d12
--- /dev/null
+++ b/api/jwt/jwt_kubeconfig.go
@@ -0,0 +1,28 @@
+package jwt
+
+import (
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+)
+
+// GenerateTokenForKubeconfig generates a new JWT token for Kubeconfig
+func (service *Service) GenerateTokenForKubeconfig(data *portainer.TokenData) (string, error) {
+	settings, err := service.dataStore.Settings().Settings()
+	if err != nil {
+		return "", err
+	}
+
+	expiryDuration, err := time.ParseDuration(settings.KubeconfigExpiry)
+	if err != nil {
+		return "", err
+	}
+
+	// https://go.dev/play/p/bOrt6cQpA0I time.Time defaults to a zero value which is 0001-01-01 00:00:00 +0000 UTC
+	var expiryAt time.Time
+	if expiryDuration > time.Duration(0) {
+		expiryAt = time.Now().Add(expiryDuration)
+	}
+
+	return service.generateSignedToken(data, expiryAt, kubeConfigScope)
+}
diff --git a/api/jwt/jwt_kubeconfig_test.go b/api/jwt/jwt_kubeconfig_test.go
new file mode 100644
index 0000000..cf88843
--- /dev/null
+++ b/api/jwt/jwt_kubeconfig_test.go
@@ -0,0 +1,98 @@
+package jwt
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestService_GenerateTokenForKubeconfig(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, true, false)
+
+	err := store.User().Create(&portainer.User{ID: 1})
+	require.NoError(t, err)
+
+	type fields struct {
+		userSessionTimeout string
+		dataStore          dataservices.DataStore
+	}
+
+	type args struct {
+		data *portainer.TokenData
+	}
+
+	settings, err := store.Settings().Settings()
+	require.NoError(t, err)
+
+	settings.KubeconfigExpiry = "0"
+
+	err = store.Settings().UpdateSettings(settings)
+	require.NoError(t, err)
+
+	myFields := fields{
+		userSessionTimeout: "24h",
+		dataStore:          store,
+	}
+
+	myTokenData := &portainer.TokenData{
+		Username: "Joe",
+		ID:       1,
+		Role:     1,
+	}
+
+	myArgs := args{
+		data: myTokenData,
+	}
+
+	tests := []struct {
+		name          string
+		fields        fields
+		args          args
+		wantExpiresAt *jwt.NumericDate
+		wantErr       bool
+	}{
+		{
+			name:          "kubeconfig no expiry",
+			fields:        myFields,
+			args:          myArgs,
+			wantExpiresAt: nil,
+			wantErr:       false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			service, err := NewService(tt.fields.userSessionTimeout, tt.fields.dataStore)
+			require.NoError(t, err, "failed to create a copy of service")
+
+			got, err := service.GenerateTokenForKubeconfig(tt.args.data)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("GenerateTokenForKubeconfig() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+
+			_, _, _, err = service.ParseAndVerifyToken(got)
+			require.NoError(t, err)
+
+			parsedToken, err := jwt.ParseWithClaims(got, &claims{}, func(token *jwt.Token) (any, error) {
+				return service.secrets[kubeConfigScope], nil
+			})
+			require.NoError(t, err, "failed to parse generated token")
+
+			tokenClaims, ok := parsedToken.Claims.(*claims)
+			assert.True(t, ok, "failed to claims out of generated ticket")
+
+			assert.Equal(t, myTokenData.Username, tokenClaims.Username)
+			assert.Equal(t, int(myTokenData.ID), tokenClaims.UserID)
+			assert.Equal(t, int(myTokenData.Role), tokenClaims.Role)
+			assert.Equal(t, tt.wantExpiresAt, tokenClaims.ExpiresAt)
+		})
+	}
+}
diff --git a/api/jwt/jwt_test.go b/api/jwt/jwt_test.go
new file mode 100644
index 0000000..52c7d58
--- /dev/null
+++ b/api/jwt/jwt_test.go
@@ -0,0 +1,122 @@
+package jwt
+
+import (
+	"testing"
+	"testing/synctest"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGenerateSignedToken(t *testing.T) {
+	t.Parallel()
+	dataStore := testhelpers.NewDatastore(testhelpers.WithSettingsService(&portainer.Settings{}))
+	svc, err := NewService("24h", dataStore)
+	require.NoError(t, err, "failed to create a copy of service")
+
+	token := &portainer.TokenData{
+		Username: "Joe",
+		ID:       1,
+		Role:     1,
+	}
+	expiresAt := time.Now().Add(1 * time.Hour)
+
+	generatedToken, err := svc.generateSignedToken(token, expiresAt, defaultScope)
+	require.NoError(t, err, "failed to generate a signed token")
+
+	parsedToken, err := jwt.ParseWithClaims(generatedToken, &claims{}, func(token *jwt.Token) (any, error) {
+		return svc.secrets[defaultScope], nil
+	})
+	require.NoError(t, err, "failed to parse generated token")
+
+	tokenClaims, ok := parsedToken.Claims.(*claims)
+	assert.True(t, ok, "failed to claims out of generated ticket")
+
+	assert.Equal(t, token.Username, tokenClaims.Username)
+	assert.Equal(t, int(token.ID), tokenClaims.UserID)
+	assert.Equal(t, int(token.Role), tokenClaims.Role)
+	assert.Equal(t, jwt.NewNumericDate(expiresAt), tokenClaims.ExpiresAt)
+}
+
+func TestGenerateSignedToken_InvalidScope(t *testing.T) {
+	t.Parallel()
+	dataStore := testhelpers.NewDatastore(testhelpers.WithSettingsService(&portainer.Settings{}))
+	svc, err := NewService("24h", dataStore)
+	require.NoError(t, err, "failed to create a copy of service")
+
+	token := &portainer.TokenData{
+		Username: "Joe",
+		ID:       1,
+		Role:     1,
+	}
+	expiresAt := time.Now().Add(1 * time.Hour)
+
+	_, err = svc.generateSignedToken(token, expiresAt, "testing")
+	require.Error(t, err)
+	assert.Equal(t, "invalid scope: testing", err.Error())
+}
+
+func TestGenerationAndParsing(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, true, false)
+
+	err := store.User().Create(&portainer.User{ID: 1})
+	require.NoError(t, err)
+
+	service, err := NewService("1h", store)
+	require.NoError(t, err)
+
+	expectedToken := &portainer.TokenData{
+		Username: "User",
+		ID:       1,
+		Role:     1,
+	}
+
+	tokenString, _, err := service.GenerateToken(expectedToken)
+	require.NoError(t, err)
+
+	expectedToken.Token = tokenString
+
+	token, _, _, err := service.ParseAndVerifyToken(tokenString)
+	require.NoError(t, err)
+	require.Equal(t, expectedToken, token)
+}
+
+func TestExpiration(t *testing.T) {
+	t.Parallel()
+	synctest.Test(t, testExpiration)
+}
+
+func testExpiration(t *testing.T) {
+	_, store := datastore.MustNewTestStore(t, true, false)
+
+	err := store.User().Create(&portainer.User{ID: 1})
+	require.NoError(t, err)
+
+	service, err := NewService("1h", store)
+	require.NoError(t, err)
+
+	expectedToken := &portainer.TokenData{
+		Username: "User",
+		ID:       1,
+		Role:     1,
+	}
+
+	service.SetUserSessionDuration(time.Second)
+
+	tokenString, _, err := service.GenerateToken(expectedToken)
+	require.NoError(t, err)
+
+	expectedToken.Token = tokenString
+
+	time.Sleep(2 * time.Second)
+
+	_, _, _, err = service.ParseAndVerifyToken(tokenString)
+	require.Error(t, err)
+}
diff --git a/api/kubernetes.go b/api/kubernetes.go
new file mode 100644
index 0000000..b6bf967
--- /dev/null
+++ b/api/kubernetes.go
@@ -0,0 +1,14 @@
+package portainer
+
+func KubernetesDefault() KubernetesData {
+	return KubernetesData{
+		Configuration: KubernetesConfiguration{
+			UseLoadBalancer:          false,
+			UseServerMetrics:         false,
+			EnableResourceOverCommit: true,
+			StorageClasses:           []KubernetesStorageClassConfig{},
+			IngressClasses:           []KubernetesIngressClassConfig{},
+		},
+		Snapshots: []KubernetesSnapshot{},
+	}
+}
diff --git a/api/kubernetes/cli/access.go b/api/kubernetes/cli/access.go
new file mode 100644
index 0000000..30ef194
--- /dev/null
+++ b/api/kubernetes/cli/access.go
@@ -0,0 +1,177 @@
+package cli
+
+import (
+	"context"
+	"fmt"
+
+	portainer "github.com/portainer/portainer/api"
+
+	"github.com/pkg/errors"
+	"github.com/segmentio/encoding/json"
+	k8serrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// NamespaceAccessPoliciesDeleteNamespace removes stored policies associated with a given namespace
+func (kcl *KubeClient) NamespaceAccessPoliciesDeleteNamespace(ns string) error {
+	kcl.mu.Lock()
+	defer kcl.mu.Unlock()
+
+	policies, err := kcl.GetNamespaceAccessPolicies()
+	if err != nil {
+		return errors.WithMessage(err, "failed to fetch access policies")
+	}
+
+	if policies != nil {
+		delete(policies, ns)
+		return kcl.UpdateNamespaceAccessPolicies(policies)
+	}
+
+	return nil
+}
+
+// GetNamespaceAccessPolicies gets the namespace access policies
+// from config maps in the portainer namespace
+func (kcl *KubeClient) GetNamespaceAccessPolicies() (map[string]portainer.K8sNamespaceAccessPolicy, error) {
+	configMap, err := kcl.cli.CoreV1().ConfigMaps(portainerNamespace).Get(context.TODO(), portainerConfigMapName, metav1.GetOptions{})
+	if err != nil {
+		if k8serrors.IsNotFound(err) {
+			return nil, nil
+		}
+		return nil, err
+	}
+
+	accessData := configMap.Data[portainerConfigMapAccessPoliciesKey]
+	policies := map[string]portainer.K8sNamespaceAccessPolicy{}
+	err = json.Unmarshal([]byte(accessData), &policies)
+	if err != nil {
+		return nil, err
+	}
+
+	return policies, nil
+}
+
+func (kcl *KubeClient) setupNamespaceAccesses(userID int, teamIDs []int, serviceAccountName string, restrictDefaultNamespace bool) error {
+	accessPolicies, err := kcl.GetNamespaceAccessPolicies()
+	if err != nil {
+		return err
+	}
+
+	namespaces, err := kcl.cli.CoreV1().Namespaces().List(context.TODO(), metav1.ListOptions{})
+	if err != nil {
+		return err
+	}
+
+	for _, namespace := range namespaces.Items {
+		if namespace.Name == defaultNamespace && !restrictDefaultNamespace {
+			err = kcl.ensureNamespaceAccessForServiceAccount(serviceAccountName, defaultNamespace)
+			if err != nil {
+				return err
+			}
+			continue
+		}
+
+		policies, ok := accessPolicies[namespace.Name]
+		if !ok || !hasUserAccessToNamespace(userID, teamIDs, policies) {
+			err = kcl.removeNamespaceAccessForServiceAccount(serviceAccountName, namespace.Name)
+			if err != nil {
+				return err
+			}
+			continue
+		}
+
+		err = kcl.ensureNamespaceAccessForServiceAccount(serviceAccountName, namespace.Name)
+		if err != nil && !k8serrors.IsAlreadyExists(err) {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func hasUserAccessToNamespace(userID int, teamIDs []int, policies portainer.K8sNamespaceAccessPolicy) bool {
+	_, userAccess := policies.UserAccessPolicies[portainer.UserID(userID)]
+	if userAccess {
+		return true
+	}
+
+	for _, teamID := range teamIDs {
+		_, teamAccess := policies.TeamAccessPolicies[portainer.TeamID(teamID)]
+		if teamAccess {
+			return true
+		}
+	}
+
+	return false
+}
+
+// UpdateNamespaceAccessPolicies updates the namespace access policies
+func (kcl *KubeClient) UpdateNamespaceAccessPolicies(accessPolicies map[string]portainer.K8sNamespaceAccessPolicy) error {
+	data, err := json.Marshal(accessPolicies)
+	if err != nil {
+		return err
+	}
+
+	configMap, err := kcl.cli.CoreV1().ConfigMaps(portainerNamespace).Get(context.TODO(), portainerConfigMapName, metav1.GetOptions{})
+	if err != nil {
+		return err
+	}
+
+	configMap.Data[portainerConfigMapAccessPoliciesKey] = string(data)
+	_, err = kcl.cli.CoreV1().ConfigMaps(portainerNamespace).Update(context.TODO(), configMap, metav1.UpdateOptions{})
+
+	return err
+}
+
+// GetNonAdminNamespaces retrieves namespaces for a non-admin user, excluding the default namespace if restricted.
+func (kcl *KubeClient) GetNonAdminNamespaces(userID int, teamIDs []int, isRestrictDefaultNamespace bool) ([]string, error) {
+	accessPolicies, err := kcl.GetNamespaceAccessPolicies()
+	if err != nil {
+		return nil, fmt.Errorf("an error occurred during the getNonAdminNamespaces operation, unable to get namespace access policies via portainer-config. check if portainer-config configMap exists in the Kubernetes cluster: %w", err)
+	}
+
+	nonAdminNamespaces := []string{}
+	if !isRestrictDefaultNamespace {
+		nonAdminNamespaces = append(nonAdminNamespaces, defaultNamespace)
+	}
+
+	for namespace, accessPolicy := range accessPolicies {
+		if hasUserAccessToNamespace(userID, teamIDs, accessPolicy) {
+			nonAdminNamespaces = append(nonAdminNamespaces, namespace)
+		}
+	}
+
+	return nonAdminNamespaces, nil
+}
+
+// GetIsKubeAdmin retrieves true if client is admin
+func (kcl *KubeClient) GetIsKubeAdmin() bool {
+	kcl.mu.Lock()
+	defer kcl.mu.Unlock()
+
+	return kcl.isKubeAdmin
+}
+
+// UpdateIsKubeAdmin sets whether the kube client is admin
+func (kcl *KubeClient) SetIsKubeAdmin(isKubeAdmin bool) {
+	kcl.mu.Lock()
+	defer kcl.mu.Unlock()
+
+	kcl.isKubeAdmin = isKubeAdmin
+}
+
+// GetClientNonAdminNamespaces retrieves non-admin namespaces
+func (kcl *KubeClient) GetClientNonAdminNamespaces() []string {
+	kcl.mu.Lock()
+	defer kcl.mu.Unlock()
+
+	return kcl.nonAdminNamespaces
+}
+
+// UpdateClientNonAdminNamespaces sets the client non admin namespace list
+func (kcl *KubeClient) SetClientNonAdminNamespaces(nonAdminNamespaces []string) {
+	kcl.mu.Lock()
+	defer kcl.mu.Unlock()
+
+	kcl.nonAdminNamespaces = nonAdminNamespaces
+}
diff --git a/api/kubernetes/cli/access_test.go b/api/kubernetes/cli/access_test.go
new file mode 100644
index 0000000..c6f1ddc
--- /dev/null
+++ b/api/kubernetes/cli/access_test.go
@@ -0,0 +1,96 @@
+package cli
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	ktypes "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	kfake "k8s.io/client-go/kubernetes/fake"
+)
+
+func Test_NamespaceAccessPoliciesDeleteNamespace_updatesPortainerConfig_whenConfigExists(t *testing.T) {
+	t.Parallel()
+	testcases := []struct {
+		name              string
+		namespaceToDelete string
+		expectedConfig    map[string]portainer.K8sNamespaceAccessPolicy
+	}{
+		{
+			name:              "doesn't change config, when designated namespace absent",
+			namespaceToDelete: "missing-namespace",
+			expectedConfig: map[string]portainer.K8sNamespaceAccessPolicy{
+				"ns1": {UserAccessPolicies: portainer.UserAccessPolicies{2: {RoleID: 0}}},
+				"ns2": {UserAccessPolicies: portainer.UserAccessPolicies{2: {RoleID: 0}}},
+			},
+		},
+		{
+			name:              "removes designated namespace from config, when namespace is present",
+			namespaceToDelete: "ns2",
+			expectedConfig: map[string]portainer.K8sNamespaceAccessPolicy{
+				"ns1": {UserAccessPolicies: portainer.UserAccessPolicies{2: {RoleID: 0}}},
+			},
+		},
+	}
+
+	for _, test := range testcases {
+		t.Run(test.name, func(t *testing.T) {
+			k := &KubeClient{
+				cli:        kfake.NewSimpleClientset(),
+				instanceID: "instance",
+			}
+
+			config := &ktypes.ConfigMap{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      portainerConfigMapName,
+					Namespace: portainerNamespace,
+				},
+				Data: map[string]string{
+					"NamespaceAccessPolicies": `{"ns1":{"UserAccessPolicies":{"2":{"RoleId":0}}}, "ns2":{"UserAccessPolicies":{"2":{"RoleId":0}}}}`,
+				},
+			}
+
+			_, err := k.cli.CoreV1().ConfigMaps(portainerNamespace).Create(t.Context(), config, metav1.CreateOptions{})
+			require.NoError(t, err, "failed to create a portainer config")
+			defer func() {
+				err := k.cli.CoreV1().ConfigMaps(portainerNamespace).Delete(t.Context(), portainerConfigMapName, metav1.DeleteOptions{})
+				require.NoError(t, err)
+			}()
+
+			err = k.NamespaceAccessPoliciesDeleteNamespace(test.namespaceToDelete)
+			require.NoError(t, err, "failed to delete namespace")
+
+			policies, err := k.GetNamespaceAccessPolicies()
+			require.NoError(t, err, "failed to fetch policies")
+			assert.Equal(t, test.expectedConfig, policies)
+		})
+	}
+}
+
+func TestKubeAdmin(t *testing.T) {
+	t.Parallel()
+	kcl := &KubeClient{}
+	require.False(t, kcl.GetIsKubeAdmin())
+
+	kcl.SetIsKubeAdmin(true)
+	require.True(t, kcl.GetIsKubeAdmin())
+
+	kcl.SetIsKubeAdmin(false)
+	require.False(t, kcl.GetIsKubeAdmin())
+}
+
+func TestClientNonAdminNamespaces(t *testing.T) {
+	t.Parallel()
+	kcl := &KubeClient{}
+
+	require.Empty(t, kcl.GetClientNonAdminNamespaces())
+
+	nss := []string{"ns1", "ns2"}
+	kcl.SetClientNonAdminNamespaces(nss)
+	require.Equal(t, nss, kcl.GetClientNonAdminNamespaces())
+
+	kcl.SetClientNonAdminNamespaces([]string{})
+	require.Empty(t, kcl.GetClientNonAdminNamespaces())
+}
diff --git a/api/kubernetes/cli/applications.go b/api/kubernetes/cli/applications.go
new file mode 100644
index 0000000..3a15925
--- /dev/null
+++ b/api/kubernetes/cli/applications.go
@@ -0,0 +1,585 @@
+package cli
+
+import (
+	"context"
+
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+	"github.com/rs/zerolog/log"
+	appsv1 "k8s.io/api/apps/v1"
+	autoscalingv2 "k8s.io/api/autoscaling/v2"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	labels "k8s.io/apimachinery/pkg/labels"
+)
+
+// PortainerApplicationResources contains collections of various Kubernetes resources
+// associated with a Portainer application.
+type PortainerApplicationResources struct {
+	Pods                     []corev1.Pod
+	ReplicaSets              []appsv1.ReplicaSet
+	Deployments              []appsv1.Deployment
+	StatefulSets             []appsv1.StatefulSet
+	DaemonSets               []appsv1.DaemonSet
+	Services                 []corev1.Service
+	HorizontalPodAutoscalers []autoscalingv2.HorizontalPodAutoscaler
+}
+
+// GetAllKubernetesApplications gets a list of kubernetes workloads (or applications) across all namespaces in the cluster
+// if the user is an admin, all namespaces in the current k8s environment(endpoint) are fetched using the fetchApplications function.
+// otherwise, namespaces the non-admin user has access to will be used to filter the applications based on the allowed namespaces.
+func (kcl *KubeClient) GetApplications(namespace, nodeName string) ([]models.K8sApplication, error) {
+	if kcl.GetIsKubeAdmin() {
+		return kcl.fetchApplications(namespace, nodeName)
+	}
+
+	return kcl.fetchApplicationsForNonAdmin(namespace, nodeName)
+}
+
+// fetchApplications fetches the applications in the namespaces the user has access to.
+// This function is called when the user is an admin.
+func (kcl *KubeClient) fetchApplications(namespace, nodeName string) ([]models.K8sApplication, error) {
+	podListOptions := metav1.ListOptions{}
+	if nodeName != "" {
+		podListOptions.FieldSelector = "spec.nodeName=" + nodeName
+	}
+
+	portainerApplicationResources, err := kcl.fetchAllApplicationsListResources(namespace, podListOptions)
+	if err != nil {
+		return nil, err
+	}
+
+	applications, err := kcl.convertPodsToApplications(portainerApplicationResources)
+	if err != nil {
+		return nil, err
+	}
+
+	unhealthyApplications, err := fetchUnhealthyApplications(portainerApplicationResources)
+	if err != nil {
+		return nil, err
+	}
+
+	return append(applications, unhealthyApplications...), nil
+}
+
+// fetchApplicationsForNonAdmin fetches the applications in the namespaces the user has access to.
+// This function is called when the user is not an admin.
+func (kcl *KubeClient) fetchApplicationsForNonAdmin(namespace, nodeName string) ([]models.K8sApplication, error) {
+	nonAdminNamespaces := kcl.GetClientNonAdminNamespaces()
+
+	log.Debug().
+		Strs("non_admin_namespaces", nonAdminNamespaces).
+		Msg("fetching applications for non-admin user")
+
+	if len(nonAdminNamespaces) == 0 {
+		return nil, nil
+	}
+
+	podListOptions := metav1.ListOptions{}
+	if nodeName != "" {
+		podListOptions.FieldSelector = "spec.nodeName=" + nodeName
+	}
+
+	portainerApplicationResources, err := kcl.fetchAllApplicationsListResources(namespace, podListOptions)
+	if err != nil {
+		return nil, err
+	}
+
+	applications, err := kcl.convertPodsToApplications(portainerApplicationResources)
+	if err != nil {
+		return nil, err
+	}
+
+	unhealthyApplications, err := fetchUnhealthyApplications(portainerApplicationResources)
+	if err != nil {
+		return nil, err
+	}
+
+	nonAdminNamespaceSet := kcl.buildNonAdminNamespacesMap()
+	results := make([]models.K8sApplication, 0)
+	for _, application := range append(applications, unhealthyApplications...) {
+		if _, ok := nonAdminNamespaceSet[application.ResourcePool]; ok {
+			results = append(results, application)
+		}
+	}
+
+	return results, nil
+}
+
+// convertPodsToApplications processes pods and converts them to applications, ensuring uniqueness by owner reference.
+func (kcl *KubeClient) convertPodsToApplications(portainerApplicationResources PortainerApplicationResources) ([]models.K8sApplication, error) {
+	applications := []models.K8sApplication{}
+	processedOwners := make(map[string]struct{})
+
+	for _, pod := range portainerApplicationResources.Pods {
+		if len(pod.OwnerReferences) > 0 {
+			ownerUID := string(pod.OwnerReferences[0].UID)
+			if _, exists := processedOwners[ownerUID]; exists {
+				continue
+			}
+			processedOwners[ownerUID] = struct{}{}
+		}
+
+		application, err := kcl.ConvertPodToApplication(pod, portainerApplicationResources, true)
+		if err != nil {
+			return nil, err
+		}
+
+		if application != nil {
+			applications = append(applications, *application)
+		}
+	}
+
+	return applications, nil
+}
+
+// GetClusterApplicationsResource returns the total resource requests and limits for all applications in a namespace
+// for a cluster level resource, set the namespace to ""
+func (kcl *KubeClient) GetApplicationsResource(namespace, node string) (models.K8sApplicationResource, error) {
+	resource := models.K8sApplicationResource{}
+	podListOptions := metav1.ListOptions{}
+	if node != "" {
+		podListOptions.FieldSelector = "spec.nodeName=" + node
+	}
+
+	pods, err := kcl.cli.CoreV1().Pods(namespace).List(context.Background(), podListOptions)
+	if err != nil {
+		return resource, err
+	}
+
+	for _, pod := range pods.Items {
+		podResources := calculatePodResourceUsage(pod)
+		resource.CPURequest += podResources.CPURequest
+		resource.CPULimit += podResources.CPULimit
+		resource.MemoryRequest += podResources.MemoryRequest
+		resource.MemoryLimit += podResources.MemoryLimit
+	}
+
+	return resource, nil
+}
+
+// ConvertPodToApplication converts a pod to an application, updating owner references if necessary
+func (kcl *KubeClient) ConvertPodToApplication(pod corev1.Pod, portainerApplicationResources PortainerApplicationResources, withResource bool) (*models.K8sApplication, error) {
+	if isReplicaSetOwner(pod) {
+		updateOwnerReferenceToDeployment(&pod, portainerApplicationResources.ReplicaSets)
+	}
+
+	application := createApplicationFromPod(&pod, portainerApplicationResources)
+	if application.ID == "" && application.Name == "" {
+		return nil, nil
+	}
+
+	if withResource {
+		podResources := calculatePodResourceUsage(pod)
+		// multiply by the number of requested pods in the application (not the running count)
+		application.Resource.CPURequest = podResources.CPURequest * float64(application.TotalPodsCount)
+		application.Resource.CPULimit = podResources.CPULimit * float64(application.TotalPodsCount)
+		application.Resource.MemoryRequest = podResources.MemoryRequest * int64(application.TotalPodsCount)
+		application.Resource.MemoryLimit = podResources.MemoryLimit * int64(application.TotalPodsCount)
+	}
+
+	return &application, nil
+}
+
+// createApplicationFromPod creates a K8sApplication object from a pod
+// it sets the application name, namespace, kind, image, stack id, stack name, and labels
+func createApplicationFromPod(pod *corev1.Pod, portainerApplicationResources PortainerApplicationResources) models.K8sApplication {
+	kind := "Pod"
+	name := pod.Name
+
+	if len(pod.OwnerReferences) > 0 {
+		kind = pod.OwnerReferences[0].Kind
+		name = pod.OwnerReferences[0].Name
+	}
+
+	application := models.K8sApplication{
+		Services: []corev1.Service{},
+		Metadata: &models.Metadata{},
+	}
+
+	switch kind {
+	case "Deployment":
+		for _, deployment := range portainerApplicationResources.Deployments {
+			if deployment.Name == name && deployment.Namespace == pod.Namespace {
+				populateApplicationFromDeployment(&application, deployment)
+				break
+			}
+		}
+	case "StatefulSet":
+		for _, statefulSet := range portainerApplicationResources.StatefulSets {
+			if statefulSet.Name == name && statefulSet.Namespace == pod.Namespace {
+				populateApplicationFromStatefulSet(&application, statefulSet)
+				break
+			}
+		}
+	case "DaemonSet":
+		for _, daemonSet := range portainerApplicationResources.DaemonSets {
+			if daemonSet.Name == name && daemonSet.Namespace == pod.Namespace {
+				populateApplicationFromDaemonSet(&application, daemonSet)
+				break
+			}
+		}
+	case "Pod":
+		populateApplicationFromPod(&application, *pod)
+	}
+
+	if application.ID != "" && application.Name != "" && len(portainerApplicationResources.Services) > 0 {
+		updateApplicationWithService(&application, portainerApplicationResources.Services)
+	}
+
+	if application.ID != "" && application.Name != "" && len(portainerApplicationResources.HorizontalPodAutoscalers) > 0 {
+		updateApplicationWithHorizontalPodAutoscaler(&application, portainerApplicationResources.HorizontalPodAutoscalers)
+	}
+
+	return application
+}
+
+// createApplicationFromDeployment creates a K8sApplication from a Deployment
+func createApplicationFromDeployment(deployment appsv1.Deployment) models.K8sApplication {
+	var app models.K8sApplication
+	populateApplicationFromDeployment(&app, deployment)
+	return app
+}
+
+// createApplicationFromStatefulSet creates a K8sApplication from a StatefulSet
+func createApplicationFromStatefulSet(statefulSet appsv1.StatefulSet) models.K8sApplication {
+	var app models.K8sApplication
+	populateApplicationFromStatefulSet(&app, statefulSet)
+	return app
+}
+
+// createApplicationFromDaemonSet creates a K8sApplication from a DaemonSet
+func createApplicationFromDaemonSet(daemonSet appsv1.DaemonSet) models.K8sApplication {
+	var app models.K8sApplication
+	populateApplicationFromDaemonSet(&app, daemonSet)
+	return app
+}
+
+func populateApplicationFromDeployment(application *models.K8sApplication, deployment appsv1.Deployment) {
+	application.ApplicationType = "Deployment"
+	application.Kind = "Deployment"
+	application.ID = string(deployment.UID)
+	application.ResourcePool = deployment.Namespace
+	application.Name = deployment.Name
+	application.ApplicationOwner = deployment.Labels["io.portainer.kubernetes.application.owner"]
+	application.StackID = deployment.Labels["io.portainer.kubernetes.application.stackid"]
+	application.StackName = deployment.Labels["io.portainer.kubernetes.application.stack"]
+	application.StackKind = deployment.Labels["io.portainer.kubernetes.application.stackKind"]
+	application.Labels = deployment.Labels
+	application.MatchLabels = deployment.Spec.Selector.MatchLabels
+	application.CreationDate = deployment.CreationTimestamp.Time
+	application.TotalPodsCount = 0
+	if deployment.Spec.Replicas != nil {
+		application.TotalPodsCount = int(*deployment.Spec.Replicas)
+	}
+	application.RunningPodsCount = int(deployment.Status.ReadyReplicas)
+	application.DeploymentType = "Replicated"
+	application.Metadata = &models.Metadata{
+		Labels:      deployment.Labels,
+		Annotations: deployment.Annotations,
+	}
+
+	// If the deployment has containers, use the first container's image
+	if len(deployment.Spec.Template.Spec.Containers) > 0 {
+		application.Image = deployment.Spec.Template.Spec.Containers[0].Image
+	}
+}
+
+func populateApplicationFromStatefulSet(application *models.K8sApplication, statefulSet appsv1.StatefulSet) {
+	application.Kind = "StatefulSet"
+	application.ApplicationType = "StatefulSet"
+	application.ID = string(statefulSet.UID)
+	application.ResourcePool = statefulSet.Namespace
+	application.Name = statefulSet.Name
+	application.ApplicationOwner = statefulSet.Labels["io.portainer.kubernetes.application.owner"]
+	application.StackID = statefulSet.Labels["io.portainer.kubernetes.application.stackid"]
+	application.StackName = statefulSet.Labels["io.portainer.kubernetes.application.stack"]
+	application.StackKind = statefulSet.Labels["io.portainer.kubernetes.application.stackKind"]
+	application.Labels = statefulSet.Labels
+	application.MatchLabels = statefulSet.Spec.Selector.MatchLabels
+	application.CreationDate = statefulSet.CreationTimestamp.Time
+	application.TotalPodsCount = 0
+	if statefulSet.Spec.Replicas != nil {
+		application.TotalPodsCount = int(*statefulSet.Spec.Replicas)
+	}
+	application.RunningPodsCount = int(statefulSet.Status.ReadyReplicas)
+	application.DeploymentType = "Replicated"
+	application.Metadata = &models.Metadata{
+		Labels:      statefulSet.Labels,
+		Annotations: statefulSet.Annotations,
+	}
+
+	// If the statefulSet has containers, use the first container's image
+	if len(statefulSet.Spec.Template.Spec.Containers) > 0 {
+		application.Image = statefulSet.Spec.Template.Spec.Containers[0].Image
+	}
+}
+
+func populateApplicationFromDaemonSet(application *models.K8sApplication, daemonSet appsv1.DaemonSet) {
+	application.Kind = "DaemonSet"
+	application.ApplicationType = "DaemonSet"
+	application.ID = string(daemonSet.UID)
+	application.ResourcePool = daemonSet.Namespace
+	application.Name = daemonSet.Name
+	application.ApplicationOwner = daemonSet.Labels["io.portainer.kubernetes.application.owner"]
+	application.StackID = daemonSet.Labels["io.portainer.kubernetes.application.stackid"]
+	application.StackName = daemonSet.Labels["io.portainer.kubernetes.application.stack"]
+	application.StackKind = daemonSet.Labels["io.portainer.kubernetes.application.stackKind"]
+	application.Labels = daemonSet.Labels
+	application.MatchLabels = daemonSet.Spec.Selector.MatchLabels
+	application.CreationDate = daemonSet.CreationTimestamp.Time
+	application.TotalPodsCount = int(daemonSet.Status.DesiredNumberScheduled)
+	application.RunningPodsCount = int(daemonSet.Status.NumberReady)
+	application.DeploymentType = "Global"
+	application.Metadata = &models.Metadata{
+		Labels:      daemonSet.Labels,
+		Annotations: daemonSet.Annotations,
+	}
+
+	if len(daemonSet.Spec.Template.Spec.Containers) > 0 {
+		application.Image = daemonSet.Spec.Template.Spec.Containers[0].Image
+	}
+}
+
+func populateApplicationFromPod(application *models.K8sApplication, pod corev1.Pod) {
+	runningPodsCount := 1
+	if pod.Status.Phase != corev1.PodRunning {
+		runningPodsCount = 0
+	}
+
+	application.ApplicationType = "Pod"
+	application.Kind = "Pod"
+	application.ID = string(pod.UID)
+	application.ResourcePool = pod.Namespace
+	application.Name = pod.Name
+	application.ApplicationOwner = pod.Labels["io.portainer.kubernetes.application.owner"]
+	application.StackID = pod.Labels["io.portainer.kubernetes.application.stackid"]
+	application.StackName = pod.Labels["io.portainer.kubernetes.application.stack"]
+	application.StackKind = pod.Labels["io.portainer.kubernetes.application.stackKind"]
+	application.Labels = pod.Labels
+	application.MatchLabels = pod.Labels
+	application.CreationDate = pod.CreationTimestamp.Time
+	application.TotalPodsCount = 1
+	application.RunningPodsCount = runningPodsCount
+	application.DeploymentType = string(pod.Status.Phase)
+	application.Metadata = &models.Metadata{
+		Labels:      pod.Labels,
+		Annotations: pod.Annotations,
+	}
+
+	// If the pod has containers, use the first container's image
+	if len(pod.Spec.Containers) > 0 {
+		application.Image = pod.Spec.Containers[0].Image
+	}
+}
+
+// updateApplicationWithService updates the application with the services that match the application's selector match labels
+// and are in the same namespace as the application
+func updateApplicationWithService(application *models.K8sApplication, services []corev1.Service) {
+	for _, service := range services {
+		serviceSelector := labels.SelectorFromSet(service.Spec.Selector)
+
+		if service.Namespace == application.ResourcePool && !serviceSelector.Empty() && serviceSelector.Matches(labels.Set(application.MatchLabels)) {
+			application.ServiceType = string(service.Spec.Type)
+			application.Services = append(application.Services, service)
+		}
+	}
+}
+
+func updateApplicationWithHorizontalPodAutoscaler(application *models.K8sApplication, hpas []autoscalingv2.HorizontalPodAutoscaler) {
+	for _, hpa := range hpas {
+		// Check if HPA is in the same namespace as the application
+		if hpa.Namespace != application.ResourcePool {
+			continue
+		}
+
+		// Check if the scale target ref matches the application
+		scaleTargetRef := hpa.Spec.ScaleTargetRef
+		if scaleTargetRef.Name == application.Name && scaleTargetRef.Kind == application.Kind {
+			hpaCopy := hpa // Create a local copy
+			application.HorizontalPodAutoscaler = &hpaCopy
+			break
+		}
+	}
+}
+
+// calculatePodResourceUsage calculates the resource usage for a pod in CPU cores and Bytes
+func calculatePodResourceUsage(pod corev1.Pod) models.K8sApplicationResource {
+	resource := models.K8sApplicationResource{}
+	for _, container := range pod.Spec.Containers {
+		// CPU cores as a decimal
+		resource.CPURequest += float64(container.Resources.Requests.Cpu().MilliValue()) / 1000
+		resource.CPULimit += float64(container.Resources.Limits.Cpu().MilliValue()) / 1000
+		// Bytes
+		resource.MemoryRequest += container.Resources.Requests.Memory().Value()
+		resource.MemoryLimit += container.Resources.Limits.Memory().Value()
+	}
+	return resource
+}
+
+// GetApplicationFromServiceSelector gets applications based on service selectors
+// it matches the service selector with the pod labels
+func (kcl *KubeClient) GetApplicationFromServiceSelector(pods []corev1.Pod, service models.K8sServiceInfo, replicaSets []appsv1.ReplicaSet) (*models.K8sApplication, error) {
+	servicesSelector := labels.SelectorFromSet(service.Selector)
+	if servicesSelector.Empty() {
+		return nil, nil
+	}
+
+	for _, pod := range pods {
+		if servicesSelector.Matches(labels.Set(pod.Labels)) {
+			if isReplicaSetOwner(pod) {
+				updateOwnerReferenceToDeployment(&pod, replicaSets)
+			}
+
+			if len(pod.OwnerReferences) == 0 {
+				return &models.K8sApplication{
+					Name: pod.Name,
+					Kind: "Pod",
+				}, nil
+			}
+
+			return &models.K8sApplication{
+				Name: pod.OwnerReferences[0].Name,
+				Kind: pod.OwnerReferences[0].Kind,
+			}, nil
+		}
+	}
+
+	return nil, nil
+}
+
+// GetApplicationConfigurationOwnersFromConfigMap gets a list of applications that use a specific ConfigMap
+// by checking all pods in the same namespace as the ConfigMap
+func (kcl *KubeClient) GetApplicationConfigurationOwnersFromConfigMap(configMap models.K8sConfigMap, pods []corev1.Pod, replicaSets []appsv1.ReplicaSet) ([]models.K8sConfigurationOwnerResource, error) {
+	configurationOwners := []models.K8sConfigurationOwnerResource{}
+	for _, pod := range pods {
+		if isPodUsingConfigMap(&pod, configMap) {
+			kind := "Pod"
+			name := pod.Name
+
+			if len(pod.OwnerReferences) > 0 {
+				kind = pod.OwnerReferences[0].Kind
+				name = pod.OwnerReferences[0].Name
+			}
+
+			if isReplicaSetOwner(pod) {
+				updateOwnerReferenceToDeployment(&pod, replicaSets)
+			}
+
+			configurationOwners = append(configurationOwners, models.K8sConfigurationOwnerResource{
+				Name:         name,
+				ResourceKind: kind,
+			})
+		}
+	}
+
+	return configurationOwners, nil
+}
+
+// GetApplicationConfigurationOwnersFromSecret gets a list of applications that use a specific Secret
+// by checking all pods in the same namespace as the Secret
+func (kcl *KubeClient) GetApplicationConfigurationOwnersFromSecret(secret models.K8sSecret, pods []corev1.Pod, replicaSets []appsv1.ReplicaSet) ([]models.K8sConfigurationOwnerResource, error) {
+	configurationOwners := []models.K8sConfigurationOwnerResource{}
+	for _, pod := range pods {
+		if isPodUsingSecret(&pod, secret) {
+			kind := "Pod"
+			name := pod.Name
+
+			if len(pod.OwnerReferences) > 0 {
+				kind = pod.OwnerReferences[0].Kind
+				name = pod.OwnerReferences[0].Name
+			}
+
+			if isReplicaSetOwner(pod) {
+				updateOwnerReferenceToDeployment(&pod, replicaSets)
+			}
+
+			configurationOwners = append(configurationOwners, models.K8sConfigurationOwnerResource{
+				Name:         name,
+				ResourceKind: kind,
+			})
+		}
+	}
+
+	return configurationOwners, nil
+}
+
+// fetchUnhealthyApplications fetches applications that failed to schedule any pods
+// due to issues like missing resource limits or other scheduling constraints
+func fetchUnhealthyApplications(resources PortainerApplicationResources) ([]models.K8sApplication, error) {
+	var unhealthyApplications []models.K8sApplication
+
+	// Process Deployments
+	for _, deployment := range resources.Deployments {
+		if hasNoScheduledPods(deployment) {
+			app := createApplicationFromDeployment(deployment)
+			addRelatedResourcesToApplication(&app, resources)
+			unhealthyApplications = append(unhealthyApplications, app)
+		}
+	}
+
+	// Process StatefulSets
+	for _, statefulSet := range resources.StatefulSets {
+		if hasNoScheduledPods(statefulSet) {
+			app := createApplicationFromStatefulSet(statefulSet)
+			addRelatedResourcesToApplication(&app, resources)
+			unhealthyApplications = append(unhealthyApplications, app)
+		}
+	}
+
+	// Process DaemonSets
+	for _, daemonSet := range resources.DaemonSets {
+		if hasNoScheduledPods(daemonSet) {
+			app := createApplicationFromDaemonSet(daemonSet)
+			addRelatedResourcesToApplication(&app, resources)
+			unhealthyApplications = append(unhealthyApplications, app)
+		}
+	}
+
+	return unhealthyApplications, nil
+}
+
+// addRelatedResourcesToApplication adds Services and HPA information to the application
+func addRelatedResourcesToApplication(app *models.K8sApplication, resources PortainerApplicationResources) {
+	if app.ID == "" || app.Name == "" {
+		return
+	}
+
+	if len(resources.Services) > 0 {
+		updateApplicationWithService(app, resources.Services)
+	}
+
+	if len(resources.HorizontalPodAutoscalers) > 0 {
+		updateApplicationWithHorizontalPodAutoscaler(app, resources.HorizontalPodAutoscalers)
+	}
+}
+
+// hasNoScheduledPods checks if a workload has completely failed to schedule any pods
+// it checks for no replicas desired, i.e. nothing to schedule and see if any pods are running
+// if any pods exist at all (even if not ready), it returns false
+func hasNoScheduledPods(obj any) bool {
+	switch resource := obj.(type) {
+	case appsv1.Deployment:
+		if resource.Status.Replicas > 0 {
+			return false
+		}
+
+		return resource.Status.ReadyReplicas == 0 && resource.Status.AvailableReplicas == 0
+
+	case appsv1.StatefulSet:
+		if resource.Status.Replicas > 0 {
+			return false
+		}
+
+		return resource.Status.ReadyReplicas == 0 && resource.Status.CurrentReplicas == 0
+
+	case appsv1.DaemonSet:
+		if resource.Status.CurrentNumberScheduled > 0 || resource.Status.NumberMisscheduled > 0 {
+			return false
+		}
+
+		return resource.Status.NumberReady == 0 && resource.Status.DesiredNumberScheduled > 0
+
+	default:
+		return false
+	}
+}
diff --git a/api/kubernetes/cli/applications_test.go b/api/kubernetes/cli/applications_test.go
new file mode 100644
index 0000000..dffb62f
--- /dev/null
+++ b/api/kubernetes/cli/applications_test.go
@@ -0,0 +1,463 @@
+package cli
+
+import (
+	"testing"
+
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/client-go/kubernetes/fake"
+)
+
+// Helper functions to create test resources
+func createTestDeployment(name, namespace string, replicas int32) *appsv1.Deployment {
+	return &appsv1.Deployment{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      name,
+			Namespace: namespace,
+			UID:       types.UID("deploy-" + name),
+			Labels: map[string]string{
+				"app": name,
+			},
+		},
+		Spec: appsv1.DeploymentSpec{
+			Replicas: &replicas,
+			Selector: &metav1.LabelSelector{
+				MatchLabels: map[string]string{
+					"app": name,
+				},
+			},
+			Template: corev1.PodTemplateSpec{
+				ObjectMeta: metav1.ObjectMeta{
+					Labels: map[string]string{
+						"app": name,
+					},
+				},
+				Spec: corev1.PodSpec{
+					Containers: []corev1.Container{
+						{
+							Name:  name,
+							Image: "nginx:latest",
+							Resources: corev1.ResourceRequirements{
+								Limits:   corev1.ResourceList{},
+								Requests: corev1.ResourceList{},
+							},
+						},
+					},
+				},
+			},
+		},
+		Status: appsv1.DeploymentStatus{
+			Replicas:      replicas,
+			ReadyReplicas: replicas,
+		},
+	}
+}
+
+func createTestReplicaSet(name, namespace, deploymentName string) *appsv1.ReplicaSet {
+	return &appsv1.ReplicaSet{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      name,
+			Namespace: namespace,
+			UID:       types.UID("rs-" + name),
+			OwnerReferences: []metav1.OwnerReference{
+				{
+					Kind: "Deployment",
+					Name: deploymentName,
+					UID:  types.UID("deploy-" + deploymentName),
+				},
+			},
+		},
+		Spec: appsv1.ReplicaSetSpec{
+			Selector: &metav1.LabelSelector{
+				MatchLabels: map[string]string{
+					"app": deploymentName,
+				},
+			},
+		},
+	}
+}
+
+func createTestStatefulSet(name, namespace string, replicas int32) *appsv1.StatefulSet {
+	return &appsv1.StatefulSet{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      name,
+			Namespace: namespace,
+			UID:       types.UID("sts-" + name),
+			Labels: map[string]string{
+				"app": name,
+			},
+		},
+		Spec: appsv1.StatefulSetSpec{
+			Replicas: &replicas,
+			Selector: &metav1.LabelSelector{
+				MatchLabels: map[string]string{
+					"app": name,
+				},
+			},
+			Template: corev1.PodTemplateSpec{
+				ObjectMeta: metav1.ObjectMeta{
+					Labels: map[string]string{
+						"app": name,
+					},
+				},
+				Spec: corev1.PodSpec{
+					Containers: []corev1.Container{
+						{
+							Name:  name,
+							Image: "redis:latest",
+							Resources: corev1.ResourceRequirements{
+								Limits:   corev1.ResourceList{},
+								Requests: corev1.ResourceList{},
+							},
+						},
+					},
+				},
+			},
+		},
+		Status: appsv1.StatefulSetStatus{
+			Replicas:      replicas,
+			ReadyReplicas: replicas,
+		},
+	}
+}
+
+func createTestDaemonSet(name, namespace string) *appsv1.DaemonSet {
+	return &appsv1.DaemonSet{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      name,
+			Namespace: namespace,
+			UID:       types.UID("ds-" + name),
+			Labels: map[string]string{
+				"app": name,
+			},
+		},
+		Spec: appsv1.DaemonSetSpec{
+			Selector: &metav1.LabelSelector{
+				MatchLabels: map[string]string{
+					"app": name,
+				},
+			},
+			Template: corev1.PodTemplateSpec{
+				ObjectMeta: metav1.ObjectMeta{
+					Labels: map[string]string{
+						"app": name,
+					},
+				},
+				Spec: corev1.PodSpec{
+					Containers: []corev1.Container{
+						{
+							Name:  name,
+							Image: "fluentd:latest",
+							Resources: corev1.ResourceRequirements{
+								Limits:   corev1.ResourceList{},
+								Requests: corev1.ResourceList{},
+							},
+						},
+					},
+				},
+			},
+		},
+		Status: appsv1.DaemonSetStatus{
+			DesiredNumberScheduled: 2,
+			NumberReady:            2,
+		},
+	}
+}
+
+func createTestPod(name, namespace, ownerKind, ownerName string, isRunning bool) *corev1.Pod {
+	phase := corev1.PodPending
+	if isRunning {
+		phase = corev1.PodRunning
+	}
+
+	var ownerReferences []metav1.OwnerReference
+	if ownerKind != "" && ownerName != "" {
+		ownerReferences = []metav1.OwnerReference{
+			{
+				Kind: ownerKind,
+				Name: ownerName,
+				UID:  types.UID(ownerKind + "-" + ownerName),
+			},
+		}
+	}
+
+	return &corev1.Pod{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:            name,
+			Namespace:       namespace,
+			UID:             types.UID("pod-" + name),
+			OwnerReferences: ownerReferences,
+			Labels: map[string]string{
+				"app": ownerName,
+			},
+		},
+		Spec: corev1.PodSpec{
+			Containers: []corev1.Container{
+				{
+					Name:  "container-" + name,
+					Image: "busybox:latest",
+					Resources: corev1.ResourceRequirements{
+						Limits:   corev1.ResourceList{},
+						Requests: corev1.ResourceList{},
+					},
+				},
+			},
+		},
+		Status: corev1.PodStatus{
+			Phase: phase,
+		},
+	}
+}
+
+func createTestService(name, namespace string, selector map[string]string) *corev1.Service {
+	return &corev1.Service{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      name,
+			Namespace: namespace,
+			UID:       types.UID("svc-" + name),
+		},
+		Spec: corev1.ServiceSpec{
+			Selector: selector,
+			Type:     corev1.ServiceTypeClusterIP,
+		},
+	}
+}
+
+func TestGetApplications(t *testing.T) {
+	t.Parallel()
+	t.Run("Admin user - Mix of deployments, statefulsets and daemonsets with and without pods", func(t *testing.T) {
+		// Create a fake K8s client
+		fakeClient := fake.NewSimpleClientset()
+
+		// Setup the test namespace
+		namespace := "test-namespace"
+		defaultNamespace := "default"
+
+		// Create resources in the test namespace
+		// 1. Deployment with pods
+		deployWithPods := createTestDeployment("deploy-with-pods", namespace, 2)
+		_, err := fakeClient.AppsV1().Deployments(namespace).Create(t.Context(), deployWithPods, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		replicaSet := createTestReplicaSet("rs-deploy-with-pods", namespace, "deploy-with-pods")
+		_, err = fakeClient.AppsV1().ReplicaSets(namespace).Create(t.Context(), replicaSet, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		pod1 := createTestPod("pod1-deploy", namespace, "ReplicaSet", "rs-deploy-with-pods", true)
+		_, err = fakeClient.CoreV1().Pods(namespace).Create(t.Context(), pod1, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		pod2 := createTestPod("pod2-deploy", namespace, "ReplicaSet", "rs-deploy-with-pods", true)
+		_, err = fakeClient.CoreV1().Pods(namespace).Create(t.Context(), pod2, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		// 2. Deployment without pods (scaled to 0)
+		deployNoPods := createTestDeployment("deploy-no-pods", namespace, 0)
+		_, err = fakeClient.AppsV1().Deployments(namespace).Create(t.Context(), deployNoPods, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		// 3. StatefulSet with pods
+		stsWithPods := createTestStatefulSet("sts-with-pods", namespace, 1)
+		_, err = fakeClient.AppsV1().StatefulSets(namespace).Create(t.Context(), stsWithPods, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		pod3 := createTestPod("pod1-sts", namespace, "StatefulSet", "sts-with-pods", true)
+		_, err = fakeClient.CoreV1().Pods(namespace).Create(t.Context(), pod3, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		// 4. StatefulSet without pods
+		stsNoPods := createTestStatefulSet("sts-no-pods", namespace, 0)
+		_, err = fakeClient.AppsV1().StatefulSets(namespace).Create(t.Context(), stsNoPods, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		// 5. DaemonSet with pods
+		dsWithPods := createTestDaemonSet("ds-with-pods", namespace)
+		_, err = fakeClient.AppsV1().DaemonSets(namespace).Create(t.Context(), dsWithPods, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		pod4 := createTestPod("pod1-ds", namespace, "DaemonSet", "ds-with-pods", true)
+		_, err = fakeClient.CoreV1().Pods(namespace).Create(t.Context(), pod4, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		pod5 := createTestPod("pod2-ds", namespace, "DaemonSet", "ds-with-pods", true)
+		_, err = fakeClient.CoreV1().Pods(namespace).Create(t.Context(), pod5, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		// 6. Naked Pod (no owner reference)
+		nakedPod := createTestPod("naked-pod", namespace, "", "", true)
+		_, err = fakeClient.CoreV1().Pods(namespace).Create(t.Context(), nakedPod, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		// 7. Resources in another namespace
+		deployOtherNs := createTestDeployment("deploy-other-ns", defaultNamespace, 1)
+		_, err = fakeClient.AppsV1().Deployments(defaultNamespace).Create(t.Context(), deployOtherNs, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		podOtherNs := createTestPod("pod-other-ns", defaultNamespace, "Deployment", "deploy-other-ns", true)
+		_, err = fakeClient.CoreV1().Pods(defaultNamespace).Create(t.Context(), podOtherNs, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		// 8. Add a service (dependency)
+		service := createTestService("svc-deploy", namespace, map[string]string{"app": "deploy-with-pods"})
+		_, err = fakeClient.CoreV1().Services(namespace).Create(t.Context(), service, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		// Create the KubeClient with admin privileges
+		kubeClient := &KubeClient{
+			cli:         fakeClient,
+			instanceID:  "test-instance",
+			isKubeAdmin: true,
+		}
+
+		// Test cases
+
+		// 1. All resources, no filtering
+		t.Run("All resources with dependencies", func(t *testing.T) {
+			apps, err := kubeClient.GetApplications("", "")
+			require.NoError(t, err)
+
+			// We expect 7 resources: 2 deployments + 2 statefulsets + 1 daemonset + 1 naked pod + 1 deployment in other namespace
+			// Note: Each controller with pods should count once, not per pod
+			assert.Len(t, apps, 7)
+
+			// Verify one of the deployments has services attached
+			appsWithServices := []models.K8sApplication{}
+			for _, app := range apps {
+				if len(app.Services) > 0 {
+					appsWithServices = append(appsWithServices, app)
+				}
+			}
+			assert.Len(t, appsWithServices, 1)
+			assert.Equal(t, "deploy-with-pods", appsWithServices[0].Name)
+		})
+
+		// 2. Filter by namespace
+		t.Run("Filter by namespace", func(t *testing.T) {
+			apps, err := kubeClient.GetApplications(namespace, "")
+			require.NoError(t, err)
+
+			// We expect 6 resources in the test namespace
+			assert.Len(t, apps, 6)
+
+			// Verify resources from other namespaces are not included
+			for _, app := range apps {
+				assert.Equal(t, namespace, app.ResourcePool)
+			}
+		})
+	})
+
+	t.Run("Non-admin user - Resources filtered by accessible namespaces", func(t *testing.T) {
+		// Create a fake K8s client
+		fakeClient := fake.NewSimpleClientset()
+
+		// Setup the test namespaces
+		namespace1 := "allowed-ns"
+		namespace2 := "restricted-ns"
+
+		// Create resources in the allowed namespace
+		sts1 := createTestStatefulSet("sts-allowed", namespace1, 1)
+		_, err := fakeClient.AppsV1().StatefulSets(namespace1).Create(t.Context(), sts1, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		pod1 := createTestPod("pod-allowed", namespace1, "StatefulSet", "sts-allowed", true)
+		_, err = fakeClient.CoreV1().Pods(namespace1).Create(t.Context(), pod1, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		// Add a StatefulSet without pods in the allowed namespace
+		stsNoPods := createTestStatefulSet("sts-no-pods-allowed", namespace1, 0)
+		_, err = fakeClient.AppsV1().StatefulSets(namespace1).Create(t.Context(), stsNoPods, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		// Create resources in the restricted namespace
+		sts2 := createTestStatefulSet("sts-restricted", namespace2, 1)
+		_, err = fakeClient.AppsV1().StatefulSets(namespace2).Create(t.Context(), sts2, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		pod2 := createTestPod("pod-restricted", namespace2, "StatefulSet", "sts-restricted", true)
+		_, err = fakeClient.CoreV1().Pods(namespace2).Create(t.Context(), pod2, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		// Create the KubeClient with non-admin privileges (only allowed namespace1)
+		kubeClient := &KubeClient{
+			cli:                fakeClient,
+			instanceID:         "test-instance",
+			isKubeAdmin:        false,
+			nonAdminNamespaces: []string{namespace1},
+		}
+
+		// Test that only resources from allowed namespace are returned
+		apps, err := kubeClient.GetApplications("", "")
+		require.NoError(t, err)
+
+		// We expect 2 resources from the allowed namespace (1 sts with pod + 1 sts without pod)
+		assert.Len(t, apps, 2)
+
+		// Verify resources are from the allowed namespace
+		for _, app := range apps {
+			assert.Equal(t, namespace1, app.ResourcePool)
+			assert.Equal(t, "StatefulSet", app.Kind)
+		}
+
+		// Verify names of returned resources
+		stsNames := make(map[string]bool)
+		for _, app := range apps {
+			stsNames[app.Name] = true
+		}
+
+		assert.True(t, stsNames["sts-allowed"], "Expected StatefulSet 'sts-allowed' was not found")
+		assert.True(t, stsNames["sts-no-pods-allowed"], "Expected StatefulSet 'sts-no-pods-allowed' was not found")
+	})
+
+	t.Run("Filter by node name", func(t *testing.T) {
+		// Create a fake K8s client
+		fakeClient := fake.NewSimpleClientset()
+
+		// Setup test namespace
+		namespace := "node-filter-ns"
+		nodeName := "worker-node-1"
+
+		// Create a deployment with pods on specific node
+		deploy := createTestDeployment("node-deploy", namespace, 2)
+		_, err := fakeClient.AppsV1().Deployments(namespace).Create(t.Context(), deploy, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		// Create ReplicaSet for the deployment
+		rs := createTestReplicaSet("rs-node-deploy", namespace, "node-deploy")
+		_, err = fakeClient.AppsV1().ReplicaSets(namespace).Create(t.Context(), rs, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		// Create 2 pods, one on the specified node, one on a different node
+		pod1 := createTestPod("pod-on-node", namespace, "ReplicaSet", "rs-node-deploy", true)
+		pod1.Spec.NodeName = nodeName
+		_, err = fakeClient.CoreV1().Pods(namespace).Create(t.Context(), pod1, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		pod2 := createTestPod("pod-other-node", namespace, "ReplicaSet", "rs-node-deploy", true)
+		pod2.Spec.NodeName = "worker-node-2"
+		_, err = fakeClient.CoreV1().Pods(namespace).Create(t.Context(), pod2, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		// Create the KubeClient
+		kubeClient := &KubeClient{
+			cli:         fakeClient,
+			instanceID:  "test-instance",
+			isKubeAdmin: true,
+		}
+
+		// Test filtering by node name
+		apps, err := kubeClient.GetApplications(namespace, nodeName)
+		require.NoError(t, err)
+
+		// We expect to find only the pod on the specified node
+		assert.Len(t, apps, 1)
+		if len(apps) > 0 {
+			assert.Equal(t, "node-deploy", apps[0].Name)
+		}
+	})
+}
diff --git a/api/kubernetes/cli/client.go b/api/kubernetes/cli/client.go
new file mode 100644
index 0000000..5e6c15a
--- /dev/null
+++ b/api/kubernetes/cli/client.go
@@ -0,0 +1,495 @@
+package cli
+
+import (
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/rs/zerolog/log"
+
+	"github.com/patrickmn/go-cache"
+	pkgerrors "github.com/pkg/errors"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/clientcmd"
+	metricsv "k8s.io/metrics/pkg/client/clientset/versioned"
+	gatewaycliv1 "sigs.k8s.io/gateway-api/pkg/client/clientset/versioned/typed/apis/v1"
+)
+
+const (
+	defaultKubeClientQPS   = 30
+	defaultKubeClientBurst = 100
+	maxConcurrency         = 30
+)
+
+type (
+	// ClientFactory is used to create Kubernetes clients
+	ClientFactory struct {
+		dataStore            dataservices.DataStore
+		reverseTunnelService portainer.ReverseTunnelService
+		signatureService     portainer.DigitalSignatureService
+		instanceID           string
+		endpointProxyClients *cache.Cache
+		AddrHTTPS            string
+	}
+
+	// KubeClient represent a service used to execute Kubernetes operations
+	KubeClient struct {
+		cli                kubernetes.Interface
+		gatewayCLI         gatewaycliv1.GatewayV1Interface
+		instanceID         string
+		mu                 sync.Mutex
+		isKubeAdmin        bool
+		nonAdminNamespaces []string
+	}
+)
+
+// NewClientFactory returns a new instance of a ClientFactory
+func NewClientFactory(signatureService portainer.DigitalSignatureService, reverseTunnelService portainer.ReverseTunnelService, dataStore dataservices.DataStore, instanceID, addrHTTPS, userSessionTimeout string) (*ClientFactory, error) {
+	if userSessionTimeout == "" {
+		userSessionTimeout = portainer.DefaultUserSessionTimeout
+	}
+	timeout, err := time.ParseDuration(userSessionTimeout)
+	if err != nil {
+		return nil, err
+	}
+
+	return &ClientFactory{
+		dataStore:            dataStore,
+		signatureService:     signatureService,
+		reverseTunnelService: reverseTunnelService,
+		instanceID:           instanceID,
+		endpointProxyClients: cache.New(timeout, timeout),
+		AddrHTTPS:            addrHTTPS,
+	}, nil
+}
+
+func (factory *ClientFactory) GetInstanceID() (instanceID string) {
+	return factory.instanceID
+}
+
+// Clear removes all cached kube clients
+func (factory *ClientFactory) ClearClientCache() {
+	log.Debug().Msgf("kubernetes namespace permissions have changed, clearing the client cache")
+	factory.endpointProxyClients.Flush()
+}
+
+// ClearClientCache removes all cached kube clients for a userId
+func (factory *ClientFactory) ClearUserClientCache(userID string) {
+	for key := range factory.endpointProxyClients.Items() {
+		if strings.HasSuffix(key, "."+userID) {
+			factory.endpointProxyClients.Delete(key)
+		}
+	}
+}
+
+// Remove the cached kube client so a new one can be created
+func (factory *ClientFactory) RemoveKubeClient(endpointID portainer.EndpointID) {
+	factory.endpointProxyClients.Delete(strconv.Itoa(int(endpointID)))
+
+	endpointPrefix := strconv.Itoa(int(endpointID)) + "."
+
+	for key := range factory.endpointProxyClients.Items() {
+		if strings.HasPrefix(key, endpointPrefix) {
+			factory.endpointProxyClients.Delete(key)
+		}
+	}
+}
+
+func (factory *ClientFactory) GetAddrHTTPS() string {
+	return factory.AddrHTTPS
+}
+
+// GetPrivilegedKubeClient checks if an existing client is already registered
+// for the environment(endpoint) and returns it if one is found.
+//
+// If no client is registered, it will create a new client, register it, and return it.
+func (factory *ClientFactory) GetPrivilegedKubeClient(endpoint *portainer.Endpoint) (*KubeClient, error) {
+	key := strconv.Itoa(int(endpoint.ID))
+	pcl, ok := factory.endpointProxyClients.Get(key)
+	if ok {
+		return pcl.(*KubeClient), nil
+	}
+
+	kcl, err := factory.createCachedPrivilegedKubeClient(endpoint)
+	if err != nil {
+		return nil, err
+	}
+
+	factory.endpointProxyClients.Set(key, kcl, cache.DefaultExpiration)
+	return kcl, nil
+}
+
+// GetPrivilegedUserKubeClient checks if an existing admin client is already
+// registered for the environment(endpoint) and user and returns it if one is
+// found.
+//
+// If no client is registered, it will create a new client, register it, and return it.
+func (factory *ClientFactory) GetPrivilegedUserKubeClient(endpoint *portainer.Endpoint, userID portainer.UserID) (*KubeClient, error) {
+	key := strconv.Itoa(int(endpoint.ID)) + ".admin." + strconv.Itoa(int(userID))
+	pcl, ok := factory.endpointProxyClients.Get(key)
+	if ok {
+		return pcl.(*KubeClient), nil
+	}
+
+	kcl, err := factory.createCachedPrivilegedKubeClient(endpoint)
+	if err != nil {
+		return nil, err
+	}
+
+	factory.endpointProxyClients.Set(key, kcl, cache.DefaultExpiration)
+	return kcl, nil
+}
+
+// GetProxyKubeClient retrieves a KubeClient from the cache. You should be
+// calling SetProxyKubeClient before first. It is normally, called the
+// kubernetes middleware.
+func (factory *ClientFactory) GetProxyKubeClient(endpointID, userID string) (*KubeClient, bool) {
+	client, ok := factory.endpointProxyClients.Get(endpointID + "." + userID)
+	if ok {
+		return client.(*KubeClient), true
+	}
+
+	return nil, false
+}
+
+// SetProxyKubeClient stores a kubeclient in the cache.
+func (factory *ClientFactory) SetProxyKubeClient(endpointID, userID string, cli *KubeClient) {
+	factory.endpointProxyClients.Set(endpointID+"."+userID, cli, cache.DefaultExpiration)
+}
+
+// CreateKubeClientFromKubeConfig creates a KubeClient from a clusterID, and
+// Kubernetes config.
+func (factory *ClientFactory) CreateKubeClientFromKubeConfig(clusterID string, kubeConfig []byte, IsKubeAdmin bool, NonAdminNamespaces []string) (*KubeClient, error) {
+	config, err := clientcmd.NewClientConfigFromBytes(kubeConfig)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create a client config from kubeconfig: %w", err)
+	}
+
+	clientConfig, err := config.ClientConfig()
+	if err != nil {
+		return nil, fmt.Errorf("failed to get the complete client config from kubeconfig: %w", err)
+	}
+
+	clientConfig.QPS = defaultKubeClientQPS
+	clientConfig.Burst = defaultKubeClientBurst
+
+	httpClient, err := rest.HTTPClientFor(clientConfig)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create http client for the given config: %w", err)
+	}
+
+	cli, err := kubernetes.NewForConfigAndClient(clientConfig, httpClient)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create clientset for the given config: %w", err)
+	}
+
+	gatewayCLI, err := gatewaycliv1.NewForConfigAndClient(clientConfig, httpClient)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create gateway clientset for the given config: %w", err)
+	}
+
+	return &KubeClient{
+		cli:                cli,
+		gatewayCLI:         gatewayCLI,
+		instanceID:         factory.instanceID,
+		isKubeAdmin:        IsKubeAdmin,
+		nonAdminNamespaces: NonAdminNamespaces,
+	}, nil
+}
+
+func (factory *ClientFactory) createCachedPrivilegedKubeClient(endpoint *portainer.Endpoint) (*KubeClient, error) {
+	cli, gatewayCLI, err := factory.CreateClient(endpoint)
+	if err != nil {
+		return nil, err
+	}
+
+	return &KubeClient{
+		cli:         cli,
+		gatewayCLI:  gatewayCLI,
+		instanceID:  factory.instanceID,
+		isKubeAdmin: true,
+	}, nil
+}
+
+// CreateClient returns a pointer to a new Kubernetes Core Clientset instance.
+func (factory *ClientFactory) CreateClient(endpoint *portainer.Endpoint) (*kubernetes.Clientset, *gatewaycliv1.GatewayV1Client, error) {
+	switch endpoint.Type {
+	case portainer.KubernetesLocalEnvironment, portainer.AgentOnKubernetesEnvironment, portainer.EdgeAgentOnKubernetesEnvironment:
+		c, err := factory.CreateConfig(endpoint)
+		if err != nil {
+			return nil, nil, err
+		}
+
+		httpClient, err := rest.HTTPClientFor(c)
+		if err != nil {
+			return nil, nil, fmt.Errorf("failed to create http client for the given config: %w", err)
+		}
+
+		cli, err := kubernetes.NewForConfigAndClient(c, httpClient)
+		if err != nil {
+			return nil, nil, fmt.Errorf("failed to create clientset for the given config: %w", err)
+		}
+
+		gatewayCLI, err := gatewaycliv1.NewForConfigAndClient(c, httpClient)
+		if err != nil {
+			return nil, nil, fmt.Errorf("failed to create gateway clientset for the given config: %w", err)
+		}
+		return cli, gatewayCLI, nil
+	}
+	return nil, nil, errors.New("unsupported environment type")
+}
+
+// CreateConfig returns a pointer to a new kubeconfig ready to create a client.
+func (factory *ClientFactory) CreateConfig(endpoint *portainer.Endpoint) (*rest.Config, error) {
+	switch endpoint.Type {
+	case portainer.KubernetesLocalEnvironment:
+		return buildLocalConfig()
+	case portainer.AgentOnKubernetesEnvironment:
+		return factory.buildAgentConfig(endpoint)
+	case portainer.EdgeAgentOnKubernetesEnvironment:
+		return factory.buildEdgeConfig(endpoint)
+	}
+	return nil, errors.New("unsupported environment type")
+}
+
+// AgentHeaderRoundTripper decorates HTTP requests with Portainer agent
+// authentication headers and retries once on stale-connection errors
+type AgentHeaderRoundTripper struct {
+	signatureHeader string
+	publicKeyHeader string
+
+	roundTripper http.RoundTripper
+}
+
+// NewAgentHeaderRoundTripper creates a round tripper that attaches the agent
+// authentication headers to every request
+func NewAgentHeaderRoundTripper(signatureHeader, publicKeyHeader string, rt http.RoundTripper) *AgentHeaderRoundTripper {
+	return &AgentHeaderRoundTripper{
+		signatureHeader: signatureHeader,
+		publicKeyHeader: publicKeyHeader,
+		roundTripper:    rt,
+	}
+}
+
+func (rt *AgentHeaderRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
+	req.Header.Add(portainer.PortainerAgentPublicKeyHeader, rt.publicKeyHeader)
+	req.Header.Add(portainer.PortainerAgentSignatureHeader, rt.signatureHeader)
+
+	resp, err := rt.roundTripper.RoundTrip(req)
+	if err == nil {
+		return resp, nil
+	}
+
+	// Retry once if a stale pooled connection was reset (non-timeout transport error)
+	var opErr *net.OpError
+	if !errors.As(err, &opErr) || opErr.Timeout() {
+		return nil, err
+	}
+
+	if req.GetBody != nil {
+		body, bodyErr := req.GetBody()
+		if bodyErr != nil {
+			return nil, err
+		}
+		req.Body = body
+	} else if req.Body != nil {
+		return nil, err
+	}
+
+	return rt.roundTripper.RoundTrip(req)
+}
+
+func (factory *ClientFactory) buildAgentConfig(endpoint *portainer.Endpoint) (*rest.Config, error) {
+	var clientURL strings.Builder
+	if !strings.HasPrefix(endpoint.URL, "http") {
+		clientURL.WriteString("https://")
+	}
+	clientURL.WriteString(endpoint.URL)
+	clientURL.WriteString("/kubernetes")
+
+	signature, err := factory.signatureService.CreateSignature(portainer.PortainerAgentSignatureMessage)
+	if err != nil {
+		return nil, err
+	}
+
+	config, err := clientcmd.BuildConfigFromFlags(clientURL.String(), "")
+	if err != nil {
+		return nil, err
+	}
+
+	config.Insecure = true
+	config.QPS = defaultKubeClientQPS
+	config.Burst = defaultKubeClientBurst
+
+	config.Wrap(func(rt http.RoundTripper) http.RoundTripper {
+		return NewAgentHeaderRoundTripper(signature, factory.signatureService.EncodedPublicKey(), rt)
+	})
+
+	return config, nil
+}
+
+func (factory *ClientFactory) buildEdgeConfig(endpoint *portainer.Endpoint) (*rest.Config, error) {
+	tunnelAddr, err := factory.reverseTunnelService.TunnelAddr(endpoint)
+	if err != nil {
+		return nil, pkgerrors.Wrap(err, "failed to activate the chisel reverse tunnel. check if the tunnel port is open at the portainer instance")
+	}
+	endpointURL := fmt.Sprintf("http://%s/kubernetes", tunnelAddr)
+
+	config, err := clientcmd.BuildConfigFromFlags(endpointURL, "")
+	if err != nil {
+		return nil, err
+	}
+
+	signature, err := factory.signatureService.CreateSignature(portainer.PortainerAgentSignatureMessage)
+	if err != nil {
+		return nil, err
+	}
+
+	config.Insecure = true
+	config.QPS = defaultKubeClientQPS
+	config.Burst = defaultKubeClientBurst
+
+	config.Wrap(func(rt http.RoundTripper) http.RoundTripper {
+		return NewAgentHeaderRoundTripper(signature, factory.signatureService.EncodedPublicKey(), rt)
+	})
+
+	return config, nil
+}
+
+func (factory *ClientFactory) CreateRemoteMetricsClient(endpoint *portainer.Endpoint) (*metricsv.Clientset, error) {
+	config, err := factory.CreateConfig(endpoint)
+	if err != nil {
+		return nil, errors.New("failed to create metrics KubeConfig")
+	}
+	return metricsv.NewForConfig(config)
+}
+
+func buildLocalConfig() (*rest.Config, error) {
+	config, err := rest.InClusterConfig()
+	if err != nil {
+		return nil, err
+	}
+
+	config.QPS = defaultKubeClientQPS
+	config.Burst = defaultKubeClientBurst
+
+	return config, nil
+}
+
+func (factory *ClientFactory) MigrateEndpointIngresses(e *portainer.Endpoint, datastore dataservices.DataStore, cli *KubeClient) error {
+	return datastore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		environment, err := tx.Endpoint().Endpoint(e.ID)
+		if err != nil {
+			log.Error().Err(err).Msgf("Error retrieving environment %d", e.ID)
+			return err
+		}
+
+		// classes is a list of controllers which have been manually added to the
+		// cluster setup view. These need to all be allowed globally, but then
+		// blocked in specific namespaces which they were not previously allowed in.
+		classes := environment.Kubernetes.Configuration.IngressClasses
+
+		// In pre-2.16 versions of portainer, the namespace level permissions were stored by
+		// creating an actual ingress rule in the cluster with a particular
+		// annotation indicating that it's name (the class name) should be allowed.
+		detected, err := cli.GetIngressControllers()
+		if err != nil {
+			log.Error().Err(err).Msgf("Error getting ingress controllers in environment %d", environment.ID)
+			return err
+		}
+
+		// newControllers is a set of all currently detected controllers.
+		newControllers := make(map[string]struct{})
+		for _, controller := range detected {
+			newControllers[controller.ClassName] = struct{}{}
+		}
+
+		namespaces, err := cli.GetNamespaces()
+		if err != nil {
+			log.Error().Err(err).Msgf("Error getting namespaces in environment %d", environment.ID)
+			return err
+		}
+
+		// Set of namespaces, if any, in which "allow none" should be true.
+		allow := make(map[string]map[string]struct{})
+		for _, c := range classes {
+			allow[c.Name] = make(map[string]struct{})
+		}
+		allow["none"] = make(map[string]struct{})
+
+		for namespace := range namespaces {
+			// Compare old annotations with currently detected controllers.
+			ingresses, err := cli.GetIngresses(namespace)
+			if err != nil {
+				log.Error().Err(err).Msgf("Error getting ingresses in environment %d", environment.ID)
+				return err
+			}
+
+			for _, ingress := range ingresses {
+				oldController, ok := ingress.Annotations["ingress.portainer.io/ingress-type"]
+				if !ok {
+					// Skip rules without our old annotation.
+					continue
+				}
+
+				if _, ok := newControllers[oldController]; ok {
+					// Skip rules which match a detected controller.
+					// TODO: Allow this particular controller.
+					allow[oldController][ingress.Namespace] = struct{}{}
+					continue
+				}
+
+				allow["none"][ingress.Namespace] = struct{}{}
+			}
+		}
+
+		// Locally, disable "allow none" for namespaces not inside shouldAllowNone.
+		var newClasses []portainer.KubernetesIngressClassConfig
+		for _, c := range classes {
+			var blocked []string
+			for namespace := range namespaces {
+				if _, ok := allow[c.Name][namespace]; ok {
+					continue
+				}
+				blocked = append(blocked, namespace)
+			}
+
+			newClasses = append(newClasses, portainer.KubernetesIngressClassConfig{
+				Name:              c.Name,
+				Type:              c.Type,
+				GloballyBlocked:   false,
+				BlockedNamespaces: blocked,
+			})
+		}
+
+		// Handle "none".
+		if len(allow["none"]) != 0 {
+			environment.Kubernetes.Configuration.AllowNoneIngressClass = true
+			var disallowNone []string
+			for namespace := range namespaces {
+				if _, ok := allow["none"][namespace]; ok {
+					continue
+				}
+				disallowNone = append(disallowNone, namespace)
+			}
+			newClasses = append(newClasses, portainer.KubernetesIngressClassConfig{
+				Name:              "none",
+				Type:              "custom",
+				GloballyBlocked:   false,
+				BlockedNamespaces: disallowNone,
+			})
+		}
+
+		environment.Kubernetes.Configuration.IngressClasses = newClasses
+		environment.PostInitMigrations.MigrateIngresses = false
+		return tx.Endpoint().UpdateEndpoint(environment.ID, environment)
+	})
+}
diff --git a/api/kubernetes/cli/client_test.go b/api/kubernetes/cli/client_test.go
new file mode 100644
index 0000000..c8e91e2
--- /dev/null
+++ b/api/kubernetes/cli/client_test.go
@@ -0,0 +1,23 @@
+package cli
+
+import (
+	"testing"
+)
+
+func TestClearUserClientCache(t *testing.T) {
+	t.Parallel()
+	factory, _ := NewClientFactory(nil, nil, nil, "", "", "")
+	kcl := &KubeClient{}
+	factory.endpointProxyClients.Set("12.1", kcl, 0)
+	factory.endpointProxyClients.Set("12.12", kcl, 0)
+	factory.endpointProxyClients.Set("12", kcl, 0)
+
+	factory.ClearUserClientCache("12")
+
+	if len(factory.endpointProxyClients.Items()) != 2 {
+		t.Errorf("Incorrect clients cached after clearUserClientCache;\ngot=\n%d\nwant=\n%d", len(factory.endpointProxyClients.Items()), 2)
+	}
+	if _, ok := factory.GetProxyKubeClient("12", "12"); ok {
+		t.Errorf("Expected not to find client cache for user after clear")
+	}
+}
diff --git a/api/kubernetes/cli/cluster_role.go b/api/kubernetes/cli/cluster_role.go
new file mode 100644
index 0000000..1296aa4
--- /dev/null
+++ b/api/kubernetes/cli/cluster_role.go
@@ -0,0 +1,97 @@
+package cli
+
+import (
+	"context"
+	"errors"
+	"slices"
+	"strings"
+
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+	"github.com/rs/zerolog/log"
+	rbacv1 "k8s.io/api/rbac/v1"
+	k8serrors "k8s.io/apimachinery/pkg/api/errors"
+	meta "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// GetClusterRoles gets all the clusterRoles for at the cluster level in a k8s endpoint.
+// It returns a list of K8sClusterRole objects.
+func (kcl *KubeClient) GetClusterRoles() ([]models.K8sClusterRole, error) {
+	if kcl.GetIsKubeAdmin() {
+		return kcl.fetchClusterRoles()
+	}
+
+	return []models.K8sClusterRole{}, errors.New("non-admin users are not allowed to access cluster roles")
+}
+
+// fetchClusterRoles returns a list of all Roles in the specified namespace.
+func (kcl *KubeClient) fetchClusterRoles() ([]models.K8sClusterRole, error) {
+	clusterRoles, err := kcl.cli.RbacV1().ClusterRoles().List(context.TODO(), meta.ListOptions{})
+	if err != nil {
+		return nil, err
+	}
+
+	results := make([]models.K8sClusterRole, 0)
+	for _, clusterRole := range clusterRoles.Items {
+		results = append(results, parseClusterRole(clusterRole))
+	}
+
+	return results, nil
+}
+
+// parseClusterRole converts a rbacv1.ClusterRole object to a models.K8sClusterRole object.
+func parseClusterRole(clusterRole rbacv1.ClusterRole) models.K8sClusterRole {
+	return models.K8sClusterRole{
+		Name:         clusterRole.Name,
+		CreationDate: clusterRole.CreationTimestamp.Time,
+		UID:          clusterRole.UID,
+		IsSystem:     isSystemClusterRole(&clusterRole),
+	}
+}
+
+func (kcl *KubeClient) DeleteClusterRoles(req models.K8sClusterRoleDeleteRequests) error {
+	var errs error
+	for _, name := range req {
+		client := kcl.cli.RbacV1().ClusterRoles()
+
+		clusterRole, err := client.Get(context.Background(), name, meta.GetOptions{})
+		if err != nil {
+			if k8serrors.IsNotFound(err) {
+				continue
+			}
+			// this is a more serious error to do with the client so we return right away
+			return err
+		}
+
+		if isSystemClusterRole(clusterRole) {
+			log.Warn().Str("role_name", name).Msg("ignoring delete of 'system' cluster role, not allowed")
+		}
+
+		err = client.Delete(context.Background(), name, meta.DeleteOptions{})
+		if err != nil {
+			log.Err(err).Str("role_name", name).Msg("unable to delete the cluster role")
+			errs = errors.Join(errs, err)
+		}
+	}
+
+	return errs
+}
+
+func isSystemClusterRole(role *rbacv1.ClusterRole) bool {
+	if role.Namespace == "kube-system" || role.Namespace == "kube-public" ||
+		role.Namespace == "kube-node-lease" || role.Namespace == "portainer" {
+		return true
+	}
+
+	if strings.HasPrefix(role.Name, "system:") {
+		return true
+	}
+
+	if role.Labels != nil {
+		if role.Labels["kubernetes.io/bootstrapping"] == "rbac-defaults" {
+			return true
+		}
+	}
+
+	roles := getPortainerDefaultK8sRoleNames()
+	return slices.Contains(roles, role.Name)
+}
diff --git a/api/kubernetes/cli/cluster_role_binding.go b/api/kubernetes/cli/cluster_role_binding.go
new file mode 100644
index 0000000..bf39800
--- /dev/null
+++ b/api/kubernetes/cli/cluster_role_binding.go
@@ -0,0 +1,110 @@
+package cli
+
+import (
+	"context"
+	"errors"
+	"strings"
+
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+	"github.com/rs/zerolog/log"
+	rbacv1 "k8s.io/api/rbac/v1"
+	k8serrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// GetClusterRoleBindings gets all the clusterRoleBindings for at the cluster level in a k8s endpoint.
+// It returns a list of K8sClusterRoleBinding objects.
+func (kcl *KubeClient) GetClusterRoleBindings() ([]models.K8sClusterRoleBinding, error) {
+	if kcl.GetIsKubeAdmin() {
+		return kcl.fetchClusterRoleBindings()
+	}
+
+	return []models.K8sClusterRoleBinding{}, errors.New("non-admin users are not allowed to access cluster role bindings")
+}
+
+// fetchClusterRoleBindings returns a list of all cluster roles in the cluster.
+func (kcl *KubeClient) fetchClusterRoleBindings() ([]models.K8sClusterRoleBinding, error) {
+	clusterRoleBindings, err := kcl.cli.RbacV1().ClusterRoleBindings().List(context.TODO(), metav1.ListOptions{})
+	if err != nil {
+		return nil, err
+	}
+
+	results := make([]models.K8sClusterRoleBinding, 0)
+	for _, clusterRoleBinding := range clusterRoleBindings.Items {
+		results = append(results, parseClusterRoleBinding(clusterRoleBinding))
+	}
+
+	return results, nil
+}
+
+// parseClusterRoleBinding converts a rbacv1.ClusterRoleBinding object to a models.K8sClusterRoleBinding object.
+func parseClusterRoleBinding(clusterRoleBinding rbacv1.ClusterRoleBinding) models.K8sClusterRoleBinding {
+	return models.K8sClusterRoleBinding{
+		Name:         clusterRoleBinding.Name,
+		UID:          clusterRoleBinding.UID,
+		Namespace:    clusterRoleBinding.Namespace,
+		RoleRef:      clusterRoleBinding.RoleRef,
+		Subjects:     clusterRoleBinding.Subjects,
+		CreationDate: clusterRoleBinding.CreationTimestamp.Time,
+		IsSystem:     isSystemClusterRoleBinding(&clusterRoleBinding),
+	}
+}
+
+// DeleteClusterRoleBindings processes a K8sClusterRoleBindingDeleteRequest
+// by deleting each cluster role binding in its given namespace. If deleting a specific cluster role binding
+// fails, the error is logged and we continue to delete the remaining cluster role bindings.
+func (kcl *KubeClient) DeleteClusterRoleBindings(reqs models.K8sClusterRoleBindingDeleteRequests) error {
+	var errs error
+
+	for _, name := range reqs {
+		client := kcl.cli.RbacV1().ClusterRoleBindings()
+
+		clusterRoleBinding, err := client.Get(context.Background(), name, metav1.GetOptions{})
+		if err != nil {
+			if k8serrors.IsNotFound(err) {
+				continue
+			}
+
+			// This is a more serious error to do with the client so we return right away
+			return err
+		}
+
+		if isSystemClusterRoleBinding(clusterRoleBinding) {
+			log.Warn().Str("role_name", name).Msg("ignoring delete of 'system' cluster role binding, not allowed")
+		}
+
+		if err := client.Delete(context.Background(), name, metav1.DeleteOptions{}); err != nil {
+			log.Err(err).Str("role_name", name).Msg("unable to delete the cluster role binding")
+			errs = errors.Join(errs, err)
+		}
+	}
+
+	return errs
+}
+
+func isSystemClusterRoleBinding(binding *rbacv1.ClusterRoleBinding) bool {
+	if strings.HasPrefix(binding.Name, "system:") {
+		return true
+	}
+
+	if binding.Labels != nil {
+		if binding.Labels["kubernetes.io/bootstrapping"] == "rbac-defaults" {
+			return true
+		}
+	}
+
+	for _, sub := range binding.Subjects {
+		if strings.HasPrefix(sub.Name, "system:") {
+			return true
+		}
+
+		if sub.Namespace == "kube-system" ||
+			sub.Namespace == "kube-public" ||
+			sub.Namespace == "kube-node-lease" ||
+			sub.Namespace == "portainer" {
+			return true
+		}
+	}
+
+	return false
+}
diff --git a/api/kubernetes/cli/configmap.go b/api/kubernetes/cli/configmap.go
new file mode 100644
index 0000000..af6cdc2
--- /dev/null
+++ b/api/kubernetes/cli/configmap.go
@@ -0,0 +1,157 @@
+package cli
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+	"github.com/rs/zerolog/log"
+	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// GetConfigMaps gets all the ConfigMaps for a given namespace in a k8s endpoint.
+// if the user is an admin, all configMaps in the current k8s environment(endpoint) are fetched using the fetchConfigMaps function.
+// otherwise, namespaces the non-admin user has access to will be used to filter the configMaps based on the allowed namespaces.
+func (kcl *KubeClient) GetConfigMaps(namespace string) ([]models.K8sConfigMap, error) {
+	if kcl.GetIsKubeAdmin() {
+		return kcl.fetchConfigMaps(namespace)
+	}
+
+	return kcl.fetchConfigMapsForNonAdmin(namespace)
+}
+
+// fetchConfigMapsForNonAdmin fetches the configMaps in the namespaces the user has access to.
+// This function is called when the user is not an admin.
+func (kcl *KubeClient) fetchConfigMapsForNonAdmin(namespace string) ([]models.K8sConfigMap, error) {
+	nonAdminNamespaces := kcl.GetClientNonAdminNamespaces()
+
+	log.Debug().
+		Strs("non_admin_namespaces", nonAdminNamespaces).
+		Msg("fetching configMaps for non-admin user")
+
+	if len(nonAdminNamespaces) == 0 {
+		return nil, nil
+	}
+
+	configMaps, err := kcl.fetchConfigMaps(namespace)
+	if err != nil {
+		return nil, err
+	}
+
+	nonAdminNamespaceSet := kcl.buildNonAdminNamespacesMap()
+	results := make([]models.K8sConfigMap, 0)
+	for _, configMap := range configMaps {
+		if _, ok := nonAdminNamespaceSet[configMap.Namespace]; ok {
+			results = append(results, configMap)
+		}
+	}
+
+	return results, nil
+}
+
+// fetchConfigMaps gets all the ConfigMaps for a given namespace in a k8s endpoint.
+// the result is a list of config maps parsed into a K8sConfigMap struct.
+func (kcl *KubeClient) fetchConfigMaps(namespace string) ([]models.K8sConfigMap, error) {
+	configMaps, err := kcl.cli.CoreV1().ConfigMaps(namespace).List(context.Background(), metav1.ListOptions{})
+	if err != nil {
+		return nil, err
+	}
+
+	results := []models.K8sConfigMap{}
+	for _, configMap := range configMaps.Items {
+		results = append(results, parseConfigMap(&configMap, false))
+	}
+
+	return results, nil
+}
+
+func (kcl *KubeClient) GetConfigMap(namespace, configMapName string) (models.K8sConfigMap, error) {
+	configMap, err := kcl.cli.CoreV1().ConfigMaps(namespace).Get(context.Background(), configMapName, metav1.GetOptions{})
+	if err != nil {
+		return models.K8sConfigMap{}, err
+	}
+
+	return parseConfigMap(configMap, true), nil
+}
+
+// parseConfigMap parses a k8s ConfigMap object into a K8sConfigMap struct.
+// for get operation, withData will be set to true.
+// otherwise, only metadata will be parsed.
+func parseConfigMap(configMap *corev1.ConfigMap, withData bool) models.K8sConfigMap {
+	result := models.K8sConfigMap{
+		K8sConfiguration: models.K8sConfiguration{
+			UID:                  string(configMap.UID),
+			Name:                 configMap.Name,
+			Namespace:            configMap.Namespace,
+			CreationDate:         configMap.CreationTimestamp.Time.UTC().Format(time.RFC3339),
+			Annotations:          configMap.Annotations,
+			Labels:               configMap.Labels,
+			ConfigurationOwner:   configMap.Labels[labelPortainerKubeConfigOwner],
+			ConfigurationOwnerId: configMap.Labels[labelPortainerKubeConfigOwnerId],
+		},
+	}
+
+	if withData {
+		result.Data = configMap.Data
+	}
+
+	return result
+}
+
+// SetConfigMapsIsUsed combines the config maps with the applications that use them.
+// the function fetches all the pods and replica sets in the cluster and checks if the config map is used by any of the pods.
+// if the config map is used by a pod, the application that uses the pod is added to the config map.
+// otherwise, the config map is returned as is.
+func (kcl *KubeClient) SetConfigMapsIsUsed(configMaps *[]models.K8sConfigMap) error {
+	portainerApplicationResources, err := kcl.fetchAllApplicationsListResources("", metav1.ListOptions{})
+	if err != nil {
+		return fmt.Errorf("an error occurred during the SetConfigMapsIsUsed operation, unable to fetch Portainer application resources. Error: %w", err)
+	}
+
+	for i := range *configMaps {
+		configMap := &(*configMaps)[i]
+
+		for _, pod := range portainerApplicationResources.Pods {
+			if isPodUsingConfigMap(&pod, *configMap) {
+				configMap.IsUsed = true
+				break
+			}
+		}
+	}
+
+	return nil
+}
+
+// CombineConfigMapWithApplications combines the config map with the applications that use it.
+// the function fetches all the pods in the cluster and checks if the config map is used by any of the pods.
+// it needs to check if the pods are owned by a replica set to determine if the pod is part of a deployment.
+func (kcl *KubeClient) CombineConfigMapWithApplications(configMap models.K8sConfigMap) (models.K8sConfigMap, error) {
+	pods, err := kcl.cli.CoreV1().Pods(configMap.Namespace).List(context.Background(), metav1.ListOptions{})
+	if err != nil {
+		return models.K8sConfigMap{}, fmt.Errorf("an error occurred during the CombineConfigMapWithApplications operation, unable to get pods. Error: %w", err)
+	}
+
+	replicaSetsItems := []appsv1.ReplicaSet{}
+	if containsReplicaSetOwnerReference(pods) {
+		replicaSets, err := kcl.cli.AppsV1().ReplicaSets(configMap.Namespace).List(context.Background(), metav1.ListOptions{})
+		if err != nil {
+			return models.K8sConfigMap{}, fmt.Errorf("an error occurred during the CombineConfigMapWithApplications operation, unable to get replica sets. Error: %w", err)
+		}
+		replicaSetsItems = replicaSets.Items
+	}
+
+	applicationConfigurationOwners, err := kcl.GetApplicationConfigurationOwnersFromConfigMap(configMap, pods.Items, replicaSetsItems)
+	if err != nil {
+		return models.K8sConfigMap{}, fmt.Errorf("an error occurred during the CombineConfigMapWithApplications operation, unable to get applications from config map. Error: %w", err)
+	}
+
+	if len(applicationConfigurationOwners) > 0 {
+		configMap.ConfigurationOwnerResources = applicationConfigurationOwners
+		configMap.IsUsed = true
+	}
+
+	return configMap, nil
+}
diff --git a/api/kubernetes/cli/cronjob.go b/api/kubernetes/cli/cronjob.go
new file mode 100644
index 0000000..6dbc6a4
--- /dev/null
+++ b/api/kubernetes/cli/cronjob.go
@@ -0,0 +1,128 @@
+package cli
+
+import (
+	"context"
+	"errors"
+	"strings"
+
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+	batchv1 "k8s.io/api/batch/v1"
+	k8serrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// GetCronJobs returns all cronjobs in the given namespace
+// If the user is a kube admin, it returns all cronjobs in the namespace
+// Otherwise, it returns only the cronjobs in the non-admin namespaces
+func (kcl *KubeClient) GetCronJobs(namespace string) ([]models.K8sCronJob, error) {
+	if kcl.GetIsKubeAdmin() {
+		return kcl.fetchCronJobs(namespace)
+	}
+
+	return kcl.fetchCronJobsForNonAdmin(namespace)
+}
+
+// fetchCronJobsForNonAdmin returns all cronjobs in the given namespace
+// It returns only the cronjobs in the non-admin namespaces
+func (kcl *KubeClient) fetchCronJobsForNonAdmin(namespace string) ([]models.K8sCronJob, error) {
+	cronJobs, err := kcl.fetchCronJobs(namespace)
+	if err != nil {
+		return nil, err
+	}
+
+	nonAdminNamespaceSet := kcl.buildNonAdminNamespacesMap()
+	results := make([]models.K8sCronJob, 0)
+	for _, cronJob := range cronJobs {
+		if _, ok := nonAdminNamespaceSet[cronJob.Namespace]; ok {
+			results = append(results, cronJob)
+		}
+	}
+
+	return results, nil
+}
+
+// fetchCronJobs returns all cronjobs in the given namespace
+// It returns all cronjobs in the namespace
+func (kcl *KubeClient) fetchCronJobs(namespace string) ([]models.K8sCronJob, error) {
+	cronJobs, err := kcl.cli.BatchV1().CronJobs(namespace).List(context.TODO(), metav1.ListOptions{})
+	if err != nil {
+		return nil, err
+	}
+
+	jobs, err := kcl.cli.BatchV1().Jobs(namespace).List(context.TODO(), metav1.ListOptions{})
+	if err != nil {
+		return nil, err
+	}
+
+	results := make([]models.K8sCronJob, 0)
+	for _, cronJob := range cronJobs.Items {
+		results = append(results, kcl.parseCronJob(cronJob, jobs))
+	}
+
+	return results, nil
+}
+
+// parseCronJob converts a batchv1.CronJob object to a models.K8sCronJob object.
+func (kcl *KubeClient) parseCronJob(cronJob batchv1.CronJob, jobsList *batchv1.JobList) models.K8sCronJob {
+	jobs, err := kcl.getCronJobExecutions(cronJob.Name, cronJob.Namespace, jobsList)
+	if err != nil {
+		return models.K8sCronJob{}
+	}
+
+	timezone := "<none>"
+	if cronJob.Spec.TimeZone != nil {
+		timezone = *cronJob.Spec.TimeZone
+	}
+
+	suspend := false
+	if cronJob.Spec.Suspend != nil {
+		suspend = *cronJob.Spec.Suspend
+	}
+
+	var command string
+	if len(cronJob.Spec.JobTemplate.Spec.Template.Spec.Containers) > 0 {
+		command = strings.Join(cronJob.Spec.JobTemplate.Spec.Template.Spec.Containers[0].Command, " ")
+	}
+
+	return models.K8sCronJob{
+		Id:        string(cronJob.UID),
+		Name:      cronJob.Name,
+		Namespace: cronJob.Namespace,
+		Command:   command,
+		Schedule:  cronJob.Spec.Schedule,
+		Timezone:  timezone,
+		Suspend:   suspend,
+		Jobs:      jobs,
+		IsSystem:  kcl.isSystemCronJob(cronJob.Namespace),
+	}
+}
+
+func (kcl *KubeClient) isSystemCronJob(namespace string) bool {
+	return kcl.isSystemNamespace(namespace)
+}
+
+// DeleteCronJobs deletes the provided list of cronjobs in its namespace
+// it returns an error if any of the cronjobs are not found or if there is an error deleting the cronjobs
+func (kcl *KubeClient) DeleteCronJobs(payload models.K8sCronJobDeleteRequests) error {
+	var errs error
+	for namespace := range payload {
+		for _, cronJobName := range payload[namespace] {
+			client := kcl.cli.BatchV1().CronJobs(namespace)
+
+			_, err := client.Get(context.Background(), cronJobName, metav1.GetOptions{})
+			if err != nil {
+				if k8serrors.IsNotFound(err) {
+					continue
+				}
+
+				errs = errors.Join(errs, err)
+			}
+
+			if err := client.Delete(context.Background(), cronJobName, metav1.DeleteOptions{}); err != nil {
+				errs = errors.Join(errs, err)
+			}
+		}
+	}
+
+	return errs
+}
diff --git a/api/kubernetes/cli/cronjob_test.go b/api/kubernetes/cli/cronjob_test.go
new file mode 100644
index 0000000..b60147e
--- /dev/null
+++ b/api/kubernetes/cli/cronjob_test.go
@@ -0,0 +1,128 @@
+package cli
+
+import (
+	"testing"
+
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	batchv1 "k8s.io/api/batch/v1"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	kfake "k8s.io/client-go/kubernetes/fake"
+)
+
+// TestFetchCronJobs tests the fetchCronJobs method for both admin and non-admin clients
+// It creates a fake Kubernetes client and passes it to the fetchCronJobs method
+// It then logs the fetched Cron Jobs
+// non-admin client will have access to the default namespace only
+func (kcl *KubeClient) TestFetchCronJobs(t *testing.T) {
+	t.Run("admin client can fetch Cron Jobs from all namespaces", func(t *testing.T) {
+		kcl.cli = kfake.NewSimpleClientset()
+		kcl.instanceID = "test"
+		kcl.isKubeAdmin = true
+
+		cronJobs, err := kcl.GetCronJobs("")
+		if err != nil {
+			t.Fatalf("Failed to fetch Cron Jobs: %v", err)
+		}
+
+		t.Logf("Fetched Cron Jobs: %v", cronJobs)
+	})
+
+	t.Run("non-admin client can fetch Cron Jobs from the default namespace only", func(t *testing.T) {
+		kcl.cli = kfake.NewSimpleClientset()
+		kcl.instanceID = "test"
+		kcl.isKubeAdmin = false
+		kcl.SetClientNonAdminNamespaces([]string{"default"})
+
+		cronJobs, err := kcl.GetCronJobs("")
+		if err != nil {
+			t.Fatalf("Failed to fetch Cron Jobs: %v", err)
+		}
+
+		t.Logf("Fetched Cron Jobs: %v", cronJobs)
+	})
+
+	t.Run("delete Cron Jobs", func(t *testing.T) {
+		kcl.cli = kfake.NewSimpleClientset()
+		kcl.instanceID = "test"
+
+		_, err := kcl.cli.BatchV1().CronJobs("default").Create(t.Context(), &batchv1.CronJob{
+			ObjectMeta: metav1.ObjectMeta{Name: "test-cronjob"},
+		}, metav1.CreateOptions{})
+		if err != nil {
+			t.Fatalf("Failed to create cron job: %v", err)
+		}
+
+		err = kcl.DeleteCronJobs(models.K8sCronJobDeleteRequests{
+			"default": []string{"test-cronjob"},
+		})
+
+		if err != nil {
+			t.Fatalf("Failed to delete Cron Jobs: %v", err)
+		}
+
+		t.Logf("Deleted Cron Jobs")
+	})
+}
+
+// TestGetCronJobExecutionsNamespaceFilter verifies that getCronJobExecutions only returns
+// executions belonging to the CronJob's own namespace, even when same-named CronJobs
+// exist across multiple namespaces.
+func TestGetCronJobExecutionsNamespaceFilter(t *testing.T) {
+	t.Parallel()
+	backoffLimit := int32(3)
+	completions := int32(1)
+
+	makeJob := func(name, namespace, cronJobName string) batchv1.Job {
+		return batchv1.Job{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      name,
+				Namespace: namespace,
+				OwnerReferences: []metav1.OwnerReference{
+					{Kind: "CronJob", Name: cronJobName},
+				},
+			},
+			Spec: batchv1.JobSpec{
+				BackoffLimit: &backoffLimit,
+				Completions:  &completions,
+				Template: corev1.PodTemplateSpec{
+					Spec: corev1.PodSpec{
+						Containers: []corev1.Container{{Name: "worker", Image: "busybox"}},
+					},
+				},
+			},
+		}
+	}
+
+	// Simulate the cross-namespace job list returned when fetchCronJobs is called with namespace=""
+	allJobs := &batchv1.JobList{
+		Items: []batchv1.Job{
+			makeJob("backup-prod-28001440", "ns-prod", "backup"),
+			makeJob("backup-test-28001441", "ns-test", "backup"),
+		},
+	}
+
+	kcl := &KubeClient{
+		cli:         kfake.NewSimpleClientset(),
+		instanceID:  "test",
+		isKubeAdmin: true,
+	}
+
+	t.Run("returns only executions from the matching namespace", func(t *testing.T) {
+		result, err := kcl.getCronJobExecutions("backup", "ns-prod", allJobs)
+		require.NoError(t, err)
+		require.Len(t, result, 1)
+		assert.Equal(t, "ns-prod", result[0].Namespace)
+		assert.Equal(t, "backup-prod-28001440", result[0].Name)
+	})
+
+	t.Run("returns only executions from the other matching namespace", func(t *testing.T) {
+		result, err := kcl.getCronJobExecutions("backup", "ns-test", allJobs)
+		require.NoError(t, err)
+		require.Len(t, result, 1)
+		assert.Equal(t, "ns-test", result[0].Namespace)
+		assert.Equal(t, "backup-test-28001441", result[0].Name)
+	})
+}
diff --git a/api/kubernetes/cli/dashboard.go b/api/kubernetes/cli/dashboard.go
new file mode 100644
index 0000000..7a7951c
--- /dev/null
+++ b/api/kubernetes/cli/dashboard.go
@@ -0,0 +1,262 @@
+package cli
+
+import (
+	"context"
+
+	"github.com/portainer/portainer/api/concurrent"
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+
+	"k8s.io/apimachinery/pkg/api/errors"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func (kcl *KubeClient) GetDashboard() (models.K8sDashboard, error) {
+	dashboardData := models.K8sDashboard{}
+
+	// Get a list of all the namespaces first
+	namespaces, err := kcl.cli.CoreV1().Namespaces().List(context.TODO(), v1.ListOptions{})
+	if err != nil {
+		return dashboardData, err
+	}
+
+	getNamespaceCounts := func(namespace string) concurrent.Func {
+		return func(ctx context.Context) (any, error) {
+			data := models.K8sDashboard{}
+
+			// apps (deployments, statefulsets, daemonsets)
+			applicationCount, err := getApplicationsCount(ctx, kcl, namespace)
+			if err != nil {
+				// skip namespaces we're not allowed access to.  But don't return an error so that we
+				// can still count the other namespaces.  Returning an error here will stop concurrent.Run
+				if errors.IsForbidden(err) {
+					return nil, nil
+				}
+				return nil, err
+			}
+			data.ApplicationsCount = applicationCount
+
+			// services
+			serviceCount, err := getServicesCount(ctx, kcl, namespace)
+			if err != nil {
+				return nil, err
+			}
+			data.ServicesCount = serviceCount
+
+			// ingresses
+			ingressesCount, err := getIngressesCount(ctx, kcl, namespace)
+			if err != nil {
+				return nil, err
+			}
+			data.IngressesCount = ingressesCount
+
+			// configmaps
+			configMapCount, err := getConfigMapsCount(ctx, kcl, namespace)
+			if err != nil {
+				return nil, err
+			}
+			data.ConfigMapsCount = configMapCount
+
+			// secrets
+			secretsCount, err := getSecretsCount(ctx, kcl, namespace)
+			if err != nil {
+				return nil, err
+			}
+			data.SecretsCount = secretsCount
+
+			// volumes
+			volumesCount, err := getVolumesCount(ctx, kcl, namespace)
+			if err != nil {
+				return nil, err
+			}
+			data.VolumesCount = volumesCount
+
+			// count this namespace for the user
+			data.NamespacesCount = 1
+
+			return data, nil
+		}
+	}
+
+	dashboardTasks := make([]concurrent.Func, 0)
+	for _, ns := range namespaces.Items {
+		dashboardTasks = append(dashboardTasks, getNamespaceCounts(ns.Name))
+	}
+
+	// Fetch all the data for each namespace concurrently
+	results, err := concurrent.Run(context.TODO(), maxConcurrency, dashboardTasks...)
+	if err != nil {
+		return dashboardData, err
+	}
+
+	// Sum up the results
+	for i := range results {
+		data, _ := results[i].Result.(models.K8sDashboard)
+		dashboardData.NamespacesCount += data.NamespacesCount
+		dashboardData.ApplicationsCount += data.ApplicationsCount
+		dashboardData.ServicesCount += data.ServicesCount
+		dashboardData.IngressesCount += data.IngressesCount
+		dashboardData.ConfigMapsCount += data.ConfigMapsCount
+		dashboardData.SecretsCount += data.SecretsCount
+		dashboardData.VolumesCount += data.VolumesCount
+	}
+
+	return dashboardData, nil
+}
+
+// Get applications excluding nakedpods
+func getApplicationsCount(ctx context.Context, kcl *KubeClient, namespace string) (int64, error) {
+	options := v1.ListOptions{Limit: 1}
+	count := int64(0)
+
+	// deployments
+	deployments, err := kcl.cli.AppsV1().Deployments(namespace).List(ctx, options)
+	if err != nil {
+		return 0, err
+	}
+
+	if len(deployments.Items) > 0 {
+		count = 1 // first deployment
+		remainingItemsCount := deployments.GetRemainingItemCount()
+		if remainingItemsCount != nil {
+			count += *remainingItemsCount // add the remaining deployments if any
+		}
+	}
+
+	// StatefulSets
+	statefulSets, err := kcl.cli.AppsV1().StatefulSets(namespace).List(ctx, options)
+	if err != nil {
+		return 0, err
+	}
+
+	if len(statefulSets.Items) > 0 {
+		count += 1 // + first statefulset
+		remainingItemsCount := statefulSets.GetRemainingItemCount()
+		if remainingItemsCount != nil {
+			count += *remainingItemsCount // add the remaining statefulsets if any
+		}
+	}
+
+	// Daemonsets
+	daemonsets, err := kcl.cli.AppsV1().DaemonSets(namespace).List(ctx, options)
+	if err != nil {
+		return 0, err
+	}
+
+	if len(daemonsets.Items) > 0 {
+		count += 1 // + first daemonset
+		remainingItemsCount := daemonsets.GetRemainingItemCount()
+		if remainingItemsCount != nil {
+			count += *remainingItemsCount // add the remaining daemonsets if any
+		}
+	}
+
+	// + (naked pods)
+	// TODO: Implement fetching of naked pods
+	// This is to be reworked as part of the dashboard refactor
+
+	// nakedPods, err := kcl.GetApplications(namespace, "nakedpods")
+	// if err != nil {
+	// 	return 0, err
+	// }
+	// For now, we're not including naked pods in the count
+
+	return count, nil
+}
+
+// Get the total count of services for the given namespace
+func getServicesCount(ctx context.Context, kcl *KubeClient, namespace string) (int64, error) {
+	options := v1.ListOptions{
+		Limit: 1,
+	}
+	var count int64 = 0
+	services, err := kcl.cli.CoreV1().Services(namespace).List(ctx, options)
+	if err != nil {
+		return 0, err
+	}
+
+	if len(services.Items) > 0 {
+		count = 1 // first service
+		remainingItemsCount := services.GetRemainingItemCount()
+		if remainingItemsCount != nil {
+			count += *remainingItemsCount // add the remaining services if any
+		}
+	}
+
+	return count, nil
+}
+
+// Get the total count of ingresses for the given namespace
+func getIngressesCount(ctx context.Context, kcl *KubeClient, namespace string) (int64, error) {
+	ingresses, err := kcl.cli.NetworkingV1().Ingresses(namespace).List(ctx, v1.ListOptions{Limit: 1})
+	if err != nil {
+		return 0, err
+	}
+
+	count := int64(0)
+	if len(ingresses.Items) > 0 {
+		count = 1 // first ingress
+		remainingItemsCount := ingresses.GetRemainingItemCount()
+		if remainingItemsCount != nil {
+			count += *remainingItemsCount // add the remaining ingresses if any
+		}
+	}
+
+	return count, nil
+}
+
+// Get the total count of configMaps for the given namespace
+func getConfigMapsCount(ctx context.Context, kcl *KubeClient, namespace string) (int64, error) {
+	configMaps, err := kcl.cli.CoreV1().ConfigMaps(namespace).List(ctx, v1.ListOptions{Limit: 1})
+	if err != nil {
+		return 0, err
+	}
+
+	count := int64(0)
+	if len(configMaps.Items) > 0 {
+		count = 1 // first configmap
+		remainingItemsCount := configMaps.GetRemainingItemCount()
+		if remainingItemsCount != nil {
+			count += *remainingItemsCount // add the remaining configmaps if any
+		}
+	}
+
+	return count, nil
+}
+
+// Get the total count of secrets for the given namespace
+func getSecretsCount(ctx context.Context, kcl *KubeClient, namespace string) (int64, error) {
+	secrets, err := kcl.cli.CoreV1().Secrets(namespace).List(ctx, v1.ListOptions{Limit: 1})
+	if err != nil {
+		return 0, err
+	}
+
+	count := int64(0)
+	if len(secrets.Items) > 0 {
+		count = 1 // first secret
+		remainingItemsCount := secrets.GetRemainingItemCount()
+		if remainingItemsCount != nil {
+			count += *remainingItemsCount // add the remaining secrets if any
+		}
+	}
+
+	return count, nil
+}
+
+// Get the total count of volumes for the given namespace
+func getVolumesCount(ctx context.Context, kcl *KubeClient, namespace string) (int64, error) {
+	volumes, err := kcl.cli.CoreV1().PersistentVolumeClaims(namespace).List(ctx, v1.ListOptions{Limit: 1})
+	if err != nil {
+		return 0, err
+	}
+
+	count := int64(0)
+	if len(volumes.Items) > 0 {
+		count = 1 // first volume
+		remainingItemsCount := volumes.GetRemainingItemCount()
+		if remainingItemsCount != nil {
+			count += *remainingItemsCount // add the remaining volumes if any
+		}
+	}
+
+	return count, nil
+}
diff --git a/api/kubernetes/cli/deployment.go b/api/kubernetes/cli/deployment.go
new file mode 100644
index 0000000..ce0b72c
--- /dev/null
+++ b/api/kubernetes/cli/deployment.go
@@ -0,0 +1,22 @@
+package cli
+
+import (
+	"context"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	labels "k8s.io/apimachinery/pkg/labels"
+)
+
+// HasStackName checks whether the given name is used in the given namespace.
+func (kcl *KubeClient) HasStackName(namespace string, stackName string) (bool, error) {
+	querySet := labels.Set{"io.portainer.kubernetes.application.stack": stackName}
+	listOpts := metav1.ListOptions{LabelSelector: labels.SelectorFromSet(querySet).String()}
+	list, err := kcl.cli.AppsV1().Deployments(namespace).List(context.TODO(), listOpts)
+	if err != nil {
+		return false, err
+	}
+	if len(list.Items) > 0 {
+		return false, nil
+	}
+	return true, nil
+}
diff --git a/api/kubernetes/cli/errors.go b/api/kubernetes/cli/errors.go
new file mode 100644
index 0000000..7cd9b50
--- /dev/null
+++ b/api/kubernetes/cli/errors.go
@@ -0,0 +1,7 @@
+package cli
+
+import "errors"
+
+// ErrUnauthorized is returned when a non-admin user attempts to access a resource
+// outside their permitted namespace scope.
+var ErrUnauthorized = errors.New("unauthorized")
diff --git a/api/kubernetes/cli/event.go b/api/kubernetes/cli/event.go
new file mode 100644
index 0000000..2c250fc
--- /dev/null
+++ b/api/kubernetes/cli/event.go
@@ -0,0 +1,93 @@
+package cli
+
+import (
+	"context"
+
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// GetEvents gets all the Events for a given namespace and resource
+// If the user is a kube admin, it returns all events in the namespace
+// Otherwise, it returns only the events in the non-admin namespaces
+func (kcl *KubeClient) GetEvents(namespace string, resourceId string) ([]models.K8sEvent, error) {
+	if kcl.GetIsKubeAdmin() {
+		return kcl.fetchAllEvents(namespace, resourceId)
+	}
+
+	return kcl.fetchEventsForNonAdmin(namespace, resourceId)
+}
+
+// fetchEventsForNonAdmin returns all events in the given namespace and resource
+// It returns only the events in the non-admin namespaces
+func (kcl *KubeClient) fetchEventsForNonAdmin(namespace string, resourceId string) ([]models.K8sEvent, error) {
+	if len(kcl.GetClientNonAdminNamespaces()) == 0 {
+		return nil, nil
+	}
+
+	events, err := kcl.fetchAllEvents(namespace, resourceId)
+	if err != nil {
+		return nil, err
+	}
+
+	nonAdminNamespaceSet := kcl.buildNonAdminNamespacesMap()
+	results := make([]models.K8sEvent, 0)
+	for _, event := range events {
+		if _, ok := nonAdminNamespaceSet[event.Namespace]; ok {
+			results = append(results, event)
+		}
+	}
+
+	return results, nil
+}
+
+// fetchEventsForNonAdmin returns all events in the given namespace and resource
+// It returns all events in the namespace and resource
+func (kcl *KubeClient) fetchAllEvents(namespace string, resourceId string) ([]models.K8sEvent, error) {
+	options := metav1.ListOptions{}
+	if resourceId != "" {
+		options.FieldSelector = "involvedObject.uid=" + resourceId
+	}
+
+	list, err := kcl.cli.CoreV1().Events(namespace).List(context.TODO(), options)
+	if err != nil {
+		return nil, err
+	}
+
+	results := make([]models.K8sEvent, 0)
+	for _, event := range list.Items {
+		results = append(results, parseEvent(&event))
+	}
+
+	return results, nil
+}
+
+func parseEvent(event *corev1.Event) models.K8sEvent {
+	result := models.K8sEvent{
+		Type:      event.Type,
+		Name:      event.Name,
+		Message:   event.Message,
+		Reason:    event.Reason,
+		Namespace: event.Namespace,
+		EventTime: event.EventTime.UTC(),
+		Kind:      event.Kind,
+		Count:     event.Count,
+		UID:       string(event.GetUID()),
+		InvolvedObjectKind: models.K8sEventInvolvedObject{
+			Kind:      event.InvolvedObject.Kind,
+			UID:       string(event.InvolvedObject.UID),
+			Name:      event.InvolvedObject.Name,
+			Namespace: event.InvolvedObject.Namespace,
+		},
+	}
+
+	if !event.LastTimestamp.Time.IsZero() {
+		result.LastTimestamp = &event.LastTimestamp.Time
+	}
+	if !event.FirstTimestamp.Time.IsZero() {
+		result.FirstTimestamp = &event.FirstTimestamp.Time
+	}
+
+	return result
+}
diff --git a/api/kubernetes/cli/event_test.go b/api/kubernetes/cli/event_test.go
new file mode 100644
index 0000000..684f086
--- /dev/null
+++ b/api/kubernetes/cli/event_test.go
@@ -0,0 +1,101 @@
+package cli
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	kfake "k8s.io/client-go/kubernetes/fake"
+)
+
+// TestGetEvents tests the GetEvents method
+// It creates a fake Kubernetes client and passes it to the GetEvents method
+// It then logs the fetched events and validated the data returned
+func TestGetEvents(t *testing.T) {
+	t.Parallel()
+	t.Run("can get events for resource id when admin", func(t *testing.T) {
+		kcl := &KubeClient{
+			cli:         kfake.NewSimpleClientset(),
+			instanceID:  "instance",
+			isKubeAdmin: true,
+		}
+
+		event := corev1.Event{
+			InvolvedObject: corev1.ObjectReference{UID: "resourceId"},
+			Action:         "something",
+			ObjectMeta:     metav1.ObjectMeta{Namespace: "default", Name: "myEvent"},
+			EventTime:      metav1.NowMicro(),
+			Type:           "warning",
+			Message:        "This event has a very serious warning",
+		}
+
+		_, err := kcl.cli.CoreV1().Events("default").Create(t.Context(), &event, metav1.CreateOptions{})
+		require.NoError(t, err, "Failed to create Event")
+
+		events, err := kcl.GetEvents("default", "resourceId")
+		require.NoError(t, err, "Failed to fetch Events")
+
+		t.Logf("Fetched Events: %v", events)
+		require.Len(t, events, 1, "Expected to return 1 event")
+		assert.Equal(t, event.Message, events[0].Message, "Expected Message to be equal to event message created")
+		assert.Equal(t, event.Type, events[0].Type, "Expected Type to be equal to event type created")
+		assert.Equal(t, event.EventTime.UTC(), events[0].EventTime, "Expected EventTime to be saved as a string from event time created")
+	})
+	t.Run("can get kubernetes events for non admin namespace when non admin", func(t *testing.T) {
+		kcl := &KubeClient{
+			cli:                kfake.NewSimpleClientset(),
+			instanceID:         "instance",
+			isKubeAdmin:        false,
+			nonAdminNamespaces: []string{"nonAdmin"},
+		}
+
+		event := corev1.Event{
+			InvolvedObject: corev1.ObjectReference{UID: "resourceId"},
+			Action:         "something",
+			ObjectMeta:     metav1.ObjectMeta{Namespace: "nonAdmin", Name: "myEvent"},
+			EventTime:      metav1.NowMicro(),
+			Type:           "warning",
+			Message:        "This event has a very serious warning",
+		}
+
+		_, err := kcl.cli.CoreV1().Events("nonAdmin").Create(t.Context(), &event, metav1.CreateOptions{})
+		require.NoError(t, err, "Failed to create Event")
+
+		events, err := kcl.GetEvents("nonAdmin", "resourceId")
+		require.NoError(t, err, "Failed to fetch Cron Jobs")
+
+		t.Logf("Fetched Events: %v", events)
+		require.Len(t, events, 1, "Expected to return 1 event")
+		assert.Equal(t, event.Message, events[0].Message, "Expected Message to be equal to event message created")
+		assert.Equal(t, event.Type, events[0].Type, "Expected Type to be equal to event type created")
+		assert.Equal(t, event.EventTime.UTC(), events[0].EventTime, "Expected EventTime to be saved as a string from event time created")
+	})
+
+	t.Run("cannot get kubernetes events for admin namespace when non admin", func(t *testing.T) {
+		kcl := &KubeClient{
+			cli:                kfake.NewSimpleClientset(),
+			instanceID:         "instance",
+			isKubeAdmin:        false,
+			nonAdminNamespaces: []string{"nonAdmin"},
+		}
+
+		event := corev1.Event{
+			InvolvedObject: corev1.ObjectReference{UID: "resourceId"},
+			Action:         "something",
+			ObjectMeta:     metav1.ObjectMeta{Namespace: "admin", Name: "myEvent"},
+			EventTime:      metav1.NowMicro(),
+			Type:           "warning",
+			Message:        "This event has a very serious warning",
+		}
+
+		_, err := kcl.cli.CoreV1().Events("admin").Create(t.Context(), &event, metav1.CreateOptions{})
+		require.NoError(t, err, "Failed to create Event")
+
+		events, err := kcl.GetEvents("admin", "resourceId")
+		require.NoError(t, err, "Failed to fetch Cron Jobs")
+		t.Logf("Fetched Events: %v", events)
+		assert.Empty(t, events, "Expected to return 0 events")
+	})
+}
diff --git a/api/kubernetes/cli/exec.go b/api/kubernetes/cli/exec.go
new file mode 100644
index 0000000..a46a0be
--- /dev/null
+++ b/api/kubernetes/cli/exec.go
@@ -0,0 +1,101 @@
+package cli
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/rs/zerolog/log"
+	v1 "k8s.io/api/core/v1"
+	"k8s.io/client-go/kubernetes/scheme"
+	"k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/remotecommand"
+	utilexec "k8s.io/client-go/util/exec"
+)
+
+var (
+	channelProtocolList = []string{
+		"v5.channel.k8s.io",
+		"v4.channel.k8s.io",
+		"v3.channel.k8s.io",
+		"v2.channel.k8s.io",
+		"channel.k8s.io",
+	}
+)
+
+// StartExecProcess starts an exec process inside a container using an in-cluster config.
+// This is a blocking operation.
+func (kcl *KubeClient) StartExecProcess(params portainer.KubeExecParams) {
+	config, err := rest.InClusterConfig()
+	if err != nil {
+		params.ErrChan <- err
+		return
+	}
+
+	if !params.UseAdminToken {
+		config.BearerToken = params.Token
+		config.BearerTokenFile = ""
+	}
+
+	req := kcl.cli.CoreV1().RESTClient().
+		Post().
+		Resource("pods").
+		Name(params.PodName).
+		Namespace(params.Namespace).
+		SubResource("exec")
+
+	req.VersionedParams(&v1.PodExecOptions{
+		Container: params.ContainerName,
+		Command:   params.Command,
+		Stdin:     true,
+		Stdout:    true,
+		Stderr:    true,
+		TTY:       true,
+	}, scheme.ParameterCodec)
+
+	streamOpts := remotecommand.StreamOptions{
+		Stdin:             params.Stdin,
+		Stdout:            params.Stdout,
+		Tty:               true,
+		TerminalSizeQueue: params.ResizeQueue,
+	}
+
+	// Try WebSocket executor first, fall back to SPDY if it fails
+	exec, err := remotecommand.NewWebSocketExecutorForProtocols(
+		config,
+		"GET", // WebSocket uses GET for the upgrade request
+		req.URL().String(),
+		channelProtocolList...,
+	)
+	if err == nil {
+		err = exec.StreamWithContext(context.TODO(), streamOpts)
+		if err == nil {
+			params.ErrChan <- nil
+			return
+		}
+
+		log.Warn().
+			Err(err).
+			Str("context", "StartExecProcess").
+			Msg("WebSocket exec failed, falling back to SPDY")
+	}
+
+	// Fall back to SPDY executor
+	exec, err = remotecommand.NewSPDYExecutor(config, "POST", req.URL())
+	if err != nil {
+		params.ErrChan <- fmt.Errorf("unable to create SPDY executor: %w", err)
+		return
+	}
+
+	err = exec.StreamWithContext(context.TODO(), streamOpts)
+	if err != nil {
+		var exitError utilexec.ExitError
+		if !errors.As(err, &exitError) {
+			params.ErrChan <- fmt.Errorf("unable to start exec process: %w", err)
+			return
+		}
+	}
+
+	params.ErrChan <- nil
+}
diff --git a/api/kubernetes/cli/ingress.go b/api/kubernetes/cli/ingress.go
new file mode 100644
index 0000000..022df55
--- /dev/null
+++ b/api/kubernetes/cli/ingress.go
@@ -0,0 +1,371 @@
+package cli
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+	"github.com/rs/zerolog/log"
+	netv1 "k8s.io/api/networking/v1"
+	k8serrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func (kcl *KubeClient) GetIngressControllers() (models.K8sIngressControllers, error) {
+	classeses, err := kcl.cli.NetworkingV1().IngressClasses().List(context.Background(), metav1.ListOptions{})
+	if err != nil {
+		return nil, err
+	}
+
+	ingresses, err := kcl.GetIngresses("")
+	if err != nil {
+		return nil, err
+	}
+
+	usedClasses := make(map[string]struct{})
+	for _, ingress := range ingresses {
+		usedClasses[ingress.ClassName] = struct{}{}
+	}
+
+	results := []models.K8sIngressController{}
+	for _, class := range classeses.Items {
+		ingressClass := parseIngressClass(class)
+		if _, ok := usedClasses[class.Name]; ok {
+			ingressClass.Used = true
+		}
+
+		results = append(results, ingressClass)
+	}
+
+	return results, nil
+}
+
+// fetchIngressClasses fetches all the ingress classes in a k8s endpoint.
+func (kcl *KubeClient) fetchIngressClasses() ([]models.K8sIngressController, error) {
+	ingressClasses, err := kcl.cli.NetworkingV1().IngressClasses().List(context.Background(), metav1.ListOptions{})
+	if err != nil {
+		return nil, err
+	}
+
+	var controllers []models.K8sIngressController
+	for _, ingressClass := range ingressClasses.Items {
+		controllers = append(controllers, parseIngressClass(ingressClass))
+	}
+	return controllers, nil
+}
+
+// parseIngressClass converts a k8s native ingress class object to a Portainer K8sIngressController object.
+func parseIngressClass(ingressClasses netv1.IngressClass) models.K8sIngressController {
+	ingressContoller := models.K8sIngressController{
+		Name:      ingressClasses.Spec.Controller,
+		ClassName: ingressClasses.Name,
+	}
+
+	switch {
+	case strings.Contains(ingressContoller.Name, "nginx"):
+		ingressContoller.Type = "nginx"
+	case strings.Contains(ingressContoller.Name, "traefik"):
+		ingressContoller.Type = "traefik"
+	default:
+		ingressContoller.Type = "other"
+	}
+
+	return ingressContoller
+}
+
+// GetIngress gets an ingress in a given namespace in a k8s endpoint.
+func (kcl *KubeClient) GetIngress(namespace, ingressName string) (models.K8sIngressInfo, error) {
+	ingress, err := kcl.cli.NetworkingV1().Ingresses(namespace).Get(context.Background(), ingressName, metav1.GetOptions{})
+	if err != nil {
+		return models.K8sIngressInfo{}, err
+	}
+
+	return parseIngress(*ingress), nil
+}
+
+// GetIngresses gets all the ingresses for a given namespace in a k8s endpoint.
+func (kcl *KubeClient) GetIngresses(namespace string) ([]models.K8sIngressInfo, error) {
+	if kcl.GetIsKubeAdmin() {
+		return kcl.fetchIngresses(namespace)
+	}
+
+	return kcl.fetchIngressesForNonAdmin(namespace)
+}
+
+// fetchIngressesForNonAdmin gets all the ingresses for non-admin users in a k8s endpoint.
+func (kcl *KubeClient) fetchIngressesForNonAdmin(namespace string) ([]models.K8sIngressInfo, error) {
+	nonAdminNamespaces := kcl.GetClientNonAdminNamespaces()
+
+	log.Debug().
+		Strs("non_admin_namespaces", nonAdminNamespaces).
+		Msg("fetching ingresses for non-admin user")
+
+	if len(nonAdminNamespaces) == 0 {
+		return nil, nil
+	}
+
+	ingresses, err := kcl.fetchIngresses(namespace)
+	if err != nil {
+		return nil, err
+	}
+
+	nonAdminNamespaceSet := kcl.buildNonAdminNamespacesMap()
+	results := make([]models.K8sIngressInfo, 0)
+	for _, ingress := range ingresses {
+		if _, ok := nonAdminNamespaceSet[ingress.Namespace]; ok {
+			results = append(results, ingress)
+		}
+	}
+
+	return results, nil
+}
+
+// fetchIngresses fetches all the ingresses for a given namespace in a k8s endpoint.
+func (kcl *KubeClient) fetchIngresses(namespace string) ([]models.K8sIngressInfo, error) {
+	ingresses, err := kcl.cli.NetworkingV1().Ingresses(namespace).List(context.Background(), metav1.ListOptions{})
+	if err != nil {
+		return nil, err
+	}
+
+	ingressClasses, err := kcl.fetchIngressClasses()
+	if err != nil {
+		return nil, err
+	}
+
+	results := []models.K8sIngressInfo{}
+	if len(ingresses.Items) == 0 {
+		return results, nil
+	}
+
+	for _, ingress := range ingresses.Items {
+		result := parseIngress(ingress)
+		if ingress.Spec.IngressClassName != nil {
+			result.Type = findUsedIngressFromIngressClasses(ingressClasses, *ingress.Spec.IngressClassName).Name
+		}
+		results = append(results, result)
+	}
+
+	return results, nil
+}
+
+// parseIngress converts a k8s native ingress object to a Portainer K8sIngressInfo object.
+func parseIngress(ingress netv1.Ingress) models.K8sIngressInfo {
+	ingressClassName := ""
+	if ingress.Spec.IngressClassName != nil {
+		ingressClassName = *ingress.Spec.IngressClassName
+	}
+
+	result := models.K8sIngressInfo{
+		Name:         ingress.Name,
+		Namespace:    ingress.Namespace,
+		UID:          string(ingress.UID),
+		Annotations:  ingress.Annotations,
+		Labels:       ingress.Labels,
+		CreationDate: ingress.CreationTimestamp.Time,
+		ClassName:    ingressClassName,
+	}
+
+	for _, tls := range ingress.Spec.TLS {
+		result.TLS = append(result.TLS, models.K8sIngressTLS{
+			Hosts:      tls.Hosts,
+			SecretName: tls.SecretName,
+		})
+	}
+
+	hosts := make(map[string]struct{})
+	for _, r := range ingress.Spec.Rules {
+		hosts[r.Host] = struct{}{}
+
+		if r.HTTP == nil {
+			continue
+		}
+		for _, p := range r.HTTP.Paths {
+			var path models.K8sIngressPath
+			path.IngressName = result.Name
+			path.Host = r.Host
+
+			path.Path = p.Path
+			if p.PathType != nil {
+				path.PathType = string(*p.PathType)
+			}
+			if p.Backend.Service != nil {
+				path.ServiceName = p.Backend.Service.Name
+				path.Port = int(p.Backend.Service.Port.Number)
+			}
+			result.Paths = append(result.Paths, path)
+		}
+	}
+
+	for host := range hosts {
+		result.Hosts = append(result.Hosts, host)
+	}
+
+	return result
+}
+
+// findUsedIngressFromIngressClasses searches for an ingress in a slice of ingress classes and returns the ingress if found.
+func findUsedIngressFromIngressClasses(ingressClasses []models.K8sIngressController, className string) models.K8sIngressController {
+	for _, ingressClass := range ingressClasses {
+		if ingressClass.ClassName == className {
+			return ingressClass
+		}
+	}
+
+	return models.K8sIngressController{}
+}
+
+// CreateIngress creates a new ingress in a given namespace in a k8s endpoint.
+func (kcl *KubeClient) CreateIngress(namespace string, info models.K8sIngressInfo, owner string) error {
+	ingress := kcl.convertToK8sIngress(info, owner)
+	_, err := kcl.cli.NetworkingV1().Ingresses(namespace).Create(context.Background(), &ingress, metav1.CreateOptions{})
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// convertToK8sIngress converts a Portainer K8sIngressInfo object to a k8s native Ingress object.
+// this is required for create and update operations.
+func (kcl *KubeClient) convertToK8sIngress(info models.K8sIngressInfo, owner string) netv1.Ingress {
+	ingressSpec := netv1.IngressSpec{}
+	if info.ClassName != "" {
+		ingressSpec.IngressClassName = &info.ClassName
+	}
+
+	result := netv1.Ingress{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:        info.Name,
+			Namespace:   info.Namespace,
+			Annotations: info.Annotations,
+		},
+
+		Spec: ingressSpec,
+	}
+
+	labels := make(map[string]string)
+	labels["io.portainer.kubernetes.ingress.owner"] = stackutils.SanitizeLabel(owner)
+	result.Labels = labels
+
+	tls := []netv1.IngressTLS{}
+	for _, t := range info.TLS {
+		tls = append(tls, netv1.IngressTLS{
+			Hosts:      t.Hosts,
+			SecretName: t.SecretName,
+		})
+	}
+	result.Spec.TLS = tls
+
+	rules := make(map[string][]netv1.HTTPIngressPath)
+	for _, path := range info.Paths {
+		pathType := netv1.PathType(path.PathType)
+		rules[path.Host] = append(rules[path.Host], netv1.HTTPIngressPath{
+			Path:     path.Path,
+			PathType: &pathType,
+			Backend: netv1.IngressBackend{
+				Service: &netv1.IngressServiceBackend{
+					Name: path.ServiceName,
+					Port: netv1.ServiceBackendPort{
+						Number: int32(path.Port),
+					},
+				},
+			},
+		})
+	}
+
+	for rule, paths := range rules {
+		result.Spec.Rules = append(result.Spec.Rules, netv1.IngressRule{
+			Host: rule,
+			IngressRuleValue: netv1.IngressRuleValue{
+				HTTP: &netv1.HTTPIngressRuleValue{
+					Paths: paths,
+				},
+			},
+		})
+	}
+
+	for _, host := range info.Hosts {
+		if _, ok := rules[host]; !ok {
+			result.Spec.Rules = append(result.Spec.Rules, netv1.IngressRule{
+				Host: host,
+			})
+		}
+	}
+
+	return result
+}
+
+// DeleteIngresses processes a K8sIngressDeleteRequest by deleting each ingress
+// in its given namespace.
+func (kcl *KubeClient) DeleteIngresses(reqs models.K8sIngressDeleteRequests) error {
+	for namespace := range reqs {
+		for _, ingress := range reqs[namespace] {
+			err := kcl.cli.NetworkingV1().Ingresses(namespace).Delete(
+				context.Background(),
+				ingress,
+				metav1.DeleteOptions{},
+			)
+
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
+
+// UpdateIngress updates an existing ingress in a given namespace in a k8s endpoint.
+func (kcl *KubeClient) UpdateIngress(namespace string, info models.K8sIngressInfo) error {
+	ingress := kcl.convertToK8sIngress(info, "")
+	_, err := kcl.cli.NetworkingV1().Ingresses(namespace).Update(context.Background(), &ingress, metav1.UpdateOptions{})
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// CombineIngressWithService combines an ingress with a service that is being used by the ingress.
+// this is required to display the service that is being used by the ingress in the UI edit view.
+func (kcl *KubeClient) CombineIngressWithService(ingress models.K8sIngressInfo) (models.K8sIngressInfo, error) {
+	services, err := kcl.GetServices(ingress.Namespace)
+	if err != nil {
+		return models.K8sIngressInfo{}, fmt.Errorf("an error occurred during the CombineIngressWithService operation, unable to retrieve services from the Kubernetes for a namespace level user. Error: %w", err)
+	}
+
+	serviceMap := kcl.buildServicesMap(services)
+	for pathIndex, path := range ingress.Paths {
+		if _, ok := serviceMap[path.ServiceName]; ok {
+			ingress.Paths[pathIndex].HasService = true
+		}
+	}
+
+	return ingress, nil
+}
+
+// CombineIngressesWithServices combines a list of ingresses with a list of services that are being used by the ingresses.
+// this is required to display the services that are being used by the ingresses in the UI list view.
+func (kcl *KubeClient) CombineIngressesWithServices(ingresses []models.K8sIngressInfo) ([]models.K8sIngressInfo, error) {
+	services, err := kcl.GetServices("")
+	if err != nil {
+		if k8serrors.IsUnauthorized(err) {
+			return nil, fmt.Errorf("an error occurred during the CombineIngressesWithServices operation, unauthorized access to the Kubernetes API. Error: %w", err)
+		}
+
+		return nil, fmt.Errorf("an error occurred during the CombineIngressesWithServices operation, unable to retrieve services from the Kubernetes for a cluster level user. Error: %w", err)
+	}
+
+	serviceMap := kcl.buildServicesMap(services)
+	for ingressIndex, ingress := range ingresses {
+		for pathIndex, path := range ingress.Paths {
+			if _, ok := serviceMap[path.ServiceName]; ok {
+				(ingresses)[ingressIndex].Paths[pathIndex].HasService = true
+			}
+		}
+	}
+
+	return ingresses, nil
+}
diff --git a/api/kubernetes/cli/ingress_test.go b/api/kubernetes/cli/ingress_test.go
new file mode 100644
index 0000000..e6e36a6
--- /dev/null
+++ b/api/kubernetes/cli/ingress_test.go
@@ -0,0 +1,16 @@
+package cli
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetIngresses(t *testing.T) {
+	t.Parallel()
+	kcl := &KubeClient{}
+
+	ingresses, err := kcl.GetIngresses("default")
+	require.NoError(t, err)
+	require.Empty(t, ingresses)
+}
diff --git a/api/kubernetes/cli/job.go b/api/kubernetes/cli/job.go
new file mode 100644
index 0000000..8949436
--- /dev/null
+++ b/api/kubernetes/cli/job.go
@@ -0,0 +1,252 @@
+package cli
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"sort"
+	"strings"
+	"time"
+
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+	"github.com/rs/zerolog/log"
+	batchv1 "k8s.io/api/batch/v1"
+	corev1 "k8s.io/api/core/v1"
+	k8serrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// GetJobs returns all jobs in the given namespace
+// If the user is a kube admin, it returns all jobs in the namespace
+// Otherwise, it returns only the jobs in the non-admin namespaces
+func (kcl *KubeClient) GetJobs(namespace string, includeCronJobChildren bool) ([]models.K8sJob, error) {
+	if kcl.GetIsKubeAdmin() {
+		return kcl.fetchJobs(namespace, includeCronJobChildren)
+	}
+
+	return kcl.fetchJobsForNonAdmin(namespace, includeCronJobChildren)
+}
+
+// fetchJobsForNonAdmin returns all jobs in the given namespace
+// It returns only the jobs in the non-admin namespaces
+func (kcl *KubeClient) fetchJobsForNonAdmin(namespace string, includeCronJobChildren bool) ([]models.K8sJob, error) {
+	jobs, err := kcl.fetchJobs(namespace, includeCronJobChildren)
+	if err != nil {
+		return nil, err
+	}
+
+	nonAdminNamespaceSet := kcl.buildNonAdminNamespacesMap()
+	results := make([]models.K8sJob, 0)
+	for _, job := range jobs {
+		if _, ok := nonAdminNamespaceSet[job.Namespace]; ok {
+			results = append(results, job)
+		}
+	}
+
+	return results, nil
+}
+
+// fetchJobs returns all jobs in the given namespace
+// It returns all jobs in the namespace
+func (kcl *KubeClient) fetchJobs(namespace string, includeCronJobChildren bool) ([]models.K8sJob, error) {
+	jobs, err := kcl.cli.BatchV1().Jobs(namespace).List(context.TODO(), metav1.ListOptions{})
+	if err != nil {
+		return nil, err
+	}
+
+	results := make([]models.K8sJob, 0)
+	for _, job := range jobs.Items {
+		if !includeCronJobChildren && checkCronJobOwner(job) {
+			continue
+		}
+
+		results = append(results, kcl.parseJob(job))
+	}
+
+	return results, nil
+}
+
+// checkCronJobOwner checks if the job has a cronjob owner
+// it returns true if the job has a cronjob owner
+// otherwise, it returns false
+func checkCronJobOwner(job batchv1.Job) bool {
+	for _, owner := range job.OwnerReferences {
+		if owner.Kind == "CronJob" {
+			return true
+		}
+	}
+
+	return false
+}
+
+// parseJob converts a batchv1.Job object to a models.K8sJob object.
+func (kcl *KubeClient) parseJob(job batchv1.Job) models.K8sJob {
+	times := parseJobTimes(job)
+	status, failedReason := determineJobStatus(job)
+	podName := getJobPodName(kcl, job)
+
+	var command string
+	var container corev1.Container
+	if len(job.Spec.Template.Spec.Containers) > 0 {
+		command = strings.Join(job.Spec.Template.Spec.Containers[0].Command, " ")
+		container = job.Spec.Template.Spec.Containers[0]
+	}
+
+	var backoffLimit int32
+	if job.Spec.BackoffLimit != nil {
+		backoffLimit = *job.Spec.BackoffLimit
+	}
+
+	var completions int32
+	if job.Spec.Completions != nil {
+		completions = *job.Spec.Completions
+	}
+
+	return models.K8sJob{
+		ID:           string(job.UID),
+		Namespace:    job.Namespace,
+		Name:         job.Name,
+		PodName:      podName,
+		Command:      command,
+		Container:    container,
+		BackoffLimit: backoffLimit,
+		Completions:  completions,
+		StartTime:    times.start,
+		FinishTime:   times.finish,
+		Duration:     times.duration,
+		Status:       status,
+		FailedReason: failedReason,
+		IsSystem:     kcl.isSystemJob(job.Namespace),
+	}
+}
+
+func (kcl *KubeClient) isSystemJob(namespace string) bool {
+	return kcl.isSystemNamespace(namespace)
+}
+
+type jobTimes struct {
+	start    string
+	finish   string
+	duration string
+}
+
+func parseJobTimes(job batchv1.Job) jobTimes {
+	times := jobTimes{
+		start:    "N/A",
+		finish:   "N/A",
+		duration: "N/A",
+	}
+
+	st := job.Status.StartTime
+	if st == nil {
+		return times
+	}
+
+	times.start = st.Format(time.RFC3339)
+	times.duration = time.Since(st.Time).Truncate(time.Minute).String()
+
+	if ct := job.Status.CompletionTime; ct != nil {
+		times.finish = ct.Format(time.RFC3339)
+		times.duration = ct.Time.Sub(st.Time).String()
+	}
+
+	return times
+}
+
+func determineJobStatus(job batchv1.Job) (status, failedReason string) {
+	failedReason = "N/A"
+
+	switch {
+	case job.Status.Failed > 0:
+		return "Failed", getLatestJobCondition(job.Status.Conditions)
+	case job.Status.Succeeded > 0:
+		return "Succeeded", failedReason
+	case job.Status.Active == 0:
+		return "Completed", failedReason
+	default:
+		return "Running", failedReason
+	}
+}
+
+func getJobPodName(kcl *KubeClient, job batchv1.Job) string {
+	pod, err := kcl.getLatestJobPod(job.Namespace, job.Name)
+	if err != nil {
+		log.Warn().Err(err).
+			Str("job", job.Name).
+			Str("namespace", job.Namespace).
+			Msg("Failed to get latest job pod")
+		return ""
+	}
+
+	if pod != nil {
+		return pod.Name
+	}
+	return ""
+}
+
+// getCronJobExecutions returns the jobs for a given cronjob
+// it returns the jobs for the cronjob
+func (kcl *KubeClient) getCronJobExecutions(cronJobName string, cronJobNamespace string, jobs *batchv1.JobList) ([]models.K8sJob, error) {
+	maxItems := 5
+
+	results := make([]models.K8sJob, 0)
+	for _, job := range jobs.Items {
+		if job.Namespace != cronJobNamespace {
+			continue
+		}
+
+		for _, owner := range job.OwnerReferences {
+			if owner.Kind == "CronJob" && owner.Name == cronJobName {
+				results = append(results, kcl.parseJob(job))
+
+				if len(results) >= maxItems {
+					return results, nil
+				}
+			}
+		}
+	}
+
+	return results, nil
+}
+
+// DeleteJobs deletes the provided list of jobs
+// it returns an error if any of the jobs are not found or if there is an error deleting the jobs
+func (kcl *KubeClient) DeleteJobs(payload models.K8sJobDeleteRequests) error {
+	var errs error
+	for namespace := range payload {
+		for _, jobName := range payload[namespace] {
+			client := kcl.cli.BatchV1().Jobs(namespace)
+
+			_, err := client.Get(context.Background(), jobName, metav1.GetOptions{})
+			if err != nil {
+				if k8serrors.IsNotFound(err) {
+					continue
+				}
+
+				errs = errors.Join(errs, err)
+			}
+
+			if err := client.Delete(context.Background(), jobName, metav1.DeleteOptions{}); err != nil {
+				errs = errors.Join(errs, err)
+			}
+		}
+	}
+
+	return errs
+}
+
+// getLatestJobCondition returns the latest condition of the job
+// it returns the latest condition of the job
+// this is only used for the failed reason
+func getLatestJobCondition(conditions []batchv1.JobCondition) string {
+	if len(conditions) == 0 {
+		return "No conditions"
+	}
+
+	sort.Slice(conditions, func(i, j int) bool {
+		return conditions[i].LastTransitionTime.After(conditions[j].LastTransitionTime.Time)
+	})
+
+	latest := conditions[0]
+	return fmt.Sprintf("%s: %s", latest.Type, latest.Message)
+}
diff --git a/api/kubernetes/cli/job_test.go b/api/kubernetes/cli/job_test.go
new file mode 100644
index 0000000..f1e7736
--- /dev/null
+++ b/api/kubernetes/cli/job_test.go
@@ -0,0 +1,91 @@
+package cli
+
+import (
+	"testing"
+	"time"
+
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+
+	"github.com/stretchr/testify/require"
+	batchv1 "k8s.io/api/batch/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	kfake "k8s.io/client-go/kubernetes/fake"
+)
+
+// TestFetchJobs tests the fetchJobs method for both admin and non-admin clients
+// It creates a fake Kubernetes client and passes it to the fetchJobs method
+// It then logs the fetched jobs
+// non-admin client will have access to the default namespace only
+func (kcl *KubeClient) TestFetchJobs(t *testing.T) {
+	t.Run("admin client can fetch jobs from all namespaces", func(t *testing.T) {
+		kcl.cli = kfake.NewSimpleClientset()
+		kcl.instanceID = "test"
+		kcl.isKubeAdmin = true
+
+		jobs, err := kcl.GetJobs("", false)
+		if err != nil {
+			t.Fatalf("Failed to fetch jobs: %v", err)
+		}
+
+		t.Logf("Fetched jobs: %v", jobs)
+	})
+
+	t.Run("non-admin client can fetch jobs from the default namespace only", func(t *testing.T) {
+		kcl.cli = kfake.NewSimpleClientset()
+		kcl.instanceID = "test"
+		kcl.isKubeAdmin = false
+		kcl.SetClientNonAdminNamespaces([]string{"default"})
+
+		jobs, err := kcl.GetJobs("", false)
+		if err != nil {
+			t.Fatalf("Failed to fetch jobs: %v", err)
+		}
+
+		t.Logf("Fetched jobs: %v", jobs)
+	})
+
+	t.Run("delete jobs", func(t *testing.T) {
+		kcl.cli = kfake.NewSimpleClientset()
+		kcl.instanceID = "test"
+
+		_, err := kcl.cli.BatchV1().Jobs("default").Create(t.Context(), &batchv1.Job{
+			ObjectMeta: metav1.ObjectMeta{Name: "test-job"},
+		}, metav1.CreateOptions{})
+		if err != nil {
+			t.Fatalf("Failed to create job: %v", err)
+		}
+
+		err = kcl.DeleteJobs(models.K8sJobDeleteRequests{
+			"default": []string{"test-job"},
+		})
+
+		if err != nil {
+			t.Fatalf("Failed to delete jobs: %v", err)
+		}
+	})
+}
+
+func TestParseJobTimes(t *testing.T) {
+	t.Parallel()
+	// Empty job
+	jobTimes := parseJobTimes(batchv1.Job{})
+
+	require.Equal(t, "N/A", jobTimes.duration)
+	require.Equal(t, "N/A", jobTimes.start)
+	require.Equal(t, "N/A", jobTimes.finish)
+
+	// Full job
+	now := time.Now()
+	completionTime := now.Add(10 * time.Minute)
+
+	jobTimes = parseJobTimes(batchv1.Job{
+		Status: batchv1.JobStatus{
+			StartTime:      &metav1.Time{Time: now},
+			CompletionTime: &metav1.Time{Time: completionTime},
+		},
+	})
+
+	require.Equal(t, "10m0s", jobTimes.duration)
+	require.Equal(t, now.Format(time.RFC3339), jobTimes.start)
+	require.Equal(t, completionTime.Format(time.RFC3339), jobTimes.finish)
+}
diff --git a/api/kubernetes/cli/metrics.go b/api/kubernetes/cli/metrics.go
new file mode 100644
index 0000000..cd9a85e
--- /dev/null
+++ b/api/kubernetes/cli/metrics.go
@@ -0,0 +1,41 @@
+package cli
+
+import (
+	"context"
+	"regexp"
+
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+
+	"github.com/segmentio/encoding/json"
+)
+
+// featureGateEnabled reports whether the named Kubernetes feature gate is active
+// on the API server by scraping /metrics and checking the
+// kubernetes_feature_enabled gauge for that gate name.
+func (kcl *KubeClient) featureGateEnabled(ctx context.Context, gate string) (bool, error) {
+	raw, err := kcl.cli.CoreV1().RESTClient().Get().
+		AbsPath("/metrics").
+		DoRaw(ctx)
+	if err != nil {
+		return false, err
+	}
+	re := regexp.MustCompile(`(?m)kubernetes_feature_enabled\{[^}]*name="` + regexp.QuoteMeta(gate) + `"[^}]*\}\s+1$`)
+	return re.Match(raw), nil
+}
+
+// SupportsPodRestart reports whether the RestartAllContainersOnContainerExits
+// feature gate is active, which is required for the pods/restart subresource.
+func (kcl *KubeClient) SupportsPodRestart(ctx context.Context) (bool, error) {
+	return kcl.featureGateEnabled(ctx, "RestartAllContainersOnContainerExits")
+}
+
+func (kcl *KubeClient) GetMetrics() (models.K8sMetrics, error) {
+	var metrics models.K8sMetrics
+	resp, err := kcl.cli.CoreV1().RESTClient().Get().AbsPath("apis/metrics.k8s.io/v1beta1/nodes").DoRaw(context.Background())
+	if err != nil {
+		return metrics, err
+	}
+
+	err = json.Unmarshal(resp, &metrics)
+	return metrics, err
+}
diff --git a/api/kubernetes/cli/metrics_test.go b/api/kubernetes/cli/metrics_test.go
new file mode 100644
index 0000000..f45eaa9
--- /dev/null
+++ b/api/kubernetes/cli/metrics_test.go
@@ -0,0 +1,95 @@
+package cli
+
+import (
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/rest"
+)
+
+func metricsKubeClient(t *testing.T, statusCode int, body string) *KubeClient {
+	t.Helper()
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(statusCode)
+		_, _ = fmt.Fprint(w, body)
+	}))
+	t.Cleanup(server.Close)
+	cli, err := kubernetes.NewForConfig(&rest.Config{Host: server.URL})
+	require.NoError(t, err)
+	return &KubeClient{cli: cli}
+}
+
+func TestFeatureGateEnabled(t *testing.T) {
+	t.Parallel()
+
+	t.Run("returns true when feature gate is enabled", func(t *testing.T) {
+		t.Parallel()
+		kcl := metricsKubeClient(t, http.StatusOK,
+			"kubernetes_feature_enabled{name=\"TestGate\",stage=\"ALPHA\"} 1\n")
+		ok, err := kcl.featureGateEnabled(t.Context(), "TestGate")
+		require.NoError(t, err)
+		assert.True(t, ok)
+	})
+
+	t.Run("returns true when labels are in different order", func(t *testing.T) {
+		t.Parallel()
+		kcl := metricsKubeClient(t, http.StatusOK,
+			"kubernetes_feature_enabled{stage=\"ALPHA\",name=\"TestGate\"} 1\n")
+		ok, err := kcl.featureGateEnabled(t.Context(), "TestGate")
+		require.NoError(t, err)
+		assert.True(t, ok)
+	})
+
+	t.Run("returns false when feature gate is disabled", func(t *testing.T) {
+		t.Parallel()
+		kcl := metricsKubeClient(t, http.StatusOK,
+			"kubernetes_feature_enabled{name=\"TestGate\",stage=\"ALPHA\"} 0\n")
+		ok, err := kcl.featureGateEnabled(t.Context(), "TestGate")
+		require.NoError(t, err)
+		assert.False(t, ok)
+	})
+
+	t.Run("returns false when feature gate is absent", func(t *testing.T) {
+		t.Parallel()
+		kcl := metricsKubeClient(t, http.StatusOK,
+			"kubernetes_feature_enabled{name=\"OtherGate\",stage=\"ALPHA\"} 1\n")
+		ok, err := kcl.featureGateEnabled(t.Context(), "TestGate")
+		require.NoError(t, err)
+		assert.False(t, ok)
+	})
+
+	t.Run("returns error when metrics endpoint is unavailable", func(t *testing.T) {
+		t.Parallel()
+		kcl := metricsKubeClient(t, http.StatusForbidden, "")
+		ok, err := kcl.featureGateEnabled(t.Context(), "TestGate")
+		require.Error(t, err)
+		assert.False(t, ok)
+	})
+}
+
+func TestSupportsPodRestart(t *testing.T) {
+	t.Parallel()
+
+	t.Run("returns true when feature gate is enabled", func(t *testing.T) {
+		t.Parallel()
+		kcl := metricsKubeClient(t, http.StatusOK,
+			"kubernetes_feature_enabled{name=\"RestartAllContainersOnContainerExits\",stage=\"ALPHA\"} 1\n")
+		ok, err := kcl.SupportsPodRestart(t.Context())
+		require.NoError(t, err)
+		assert.True(t, ok)
+	})
+
+	t.Run("returns false when feature gate is absent", func(t *testing.T) {
+		t.Parallel()
+		kcl := metricsKubeClient(t, http.StatusOK,
+			"kubernetes_feature_enabled{name=\"OtherFeature\",stage=\"ALPHA\"} 1\n")
+		ok, err := kcl.SupportsPodRestart(t.Context())
+		require.NoError(t, err)
+		assert.False(t, ok)
+	})
+}
diff --git a/api/kubernetes/cli/namespace.go b/api/kubernetes/cli/namespace.go
new file mode 100644
index 0000000..34d3a89
--- /dev/null
+++ b/api/kubernetes/cli/namespace.go
@@ -0,0 +1,465 @@
+package cli
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"sort"
+	"strconv"
+	"time"
+
+	"github.com/pkg/errors"
+	portainer "github.com/portainer/portainer/api"
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/rs/zerolog/log"
+	corev1 "k8s.io/api/core/v1"
+	k8serrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/resource"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+const (
+	systemNamespaceLabel = "io.portainer.kubernetes.namespace.system"
+	namespaceOwnerLabel  = "io.portainer.kubernetes.resourcepool.owner"
+	namespaceNameLabel   = "io.portainer.kubernetes.resourcepool.name"
+)
+
+func defaultSystemNamespaces() map[string]struct{} {
+	return map[string]struct{}{
+		"kube-system":     {},
+		"kube-public":     {},
+		"kube-node-lease": {},
+		"portainer":       {},
+	}
+}
+
+// GetNamespaces gets the namespaces in the current k8s environment(endpoint).
+// if the user is an admin, all namespaces in the current k8s environment(endpoint) are fetched using the fetchNamespaces function.
+// otherwise, namespaces the non-admin user has access to will be used to filter the namespaces based on the allowed namespaces.
+func (kcl *KubeClient) GetNamespaces() (map[string]portainer.K8sNamespaceInfo, error) {
+	if kcl.GetIsKubeAdmin() {
+		return kcl.fetchNamespaces()
+	}
+
+	return kcl.fetchNamespacesForNonAdmin()
+}
+
+// fetchNamespacesForNonAdmin gets the namespaces in the current k8s environment(endpoint) for the non-admin user.
+func (kcl *KubeClient) fetchNamespacesForNonAdmin() (map[string]portainer.K8sNamespaceInfo, error) {
+	log.Debug().
+		Str("context", "fetchNamespacesForNonAdmin").
+		Msg("Fetching namespaces for non-admin user")
+
+	if len(kcl.GetClientNonAdminNamespaces()) == 0 {
+		return nil, nil
+	}
+
+	namespaces, err := kcl.fetchNamespaces()
+	if err != nil {
+		return nil, fmt.Errorf("an error occurred during the fetchNamespacesForNonAdmin operation, unable to list namespaces for the non-admin user: %w", err)
+	}
+
+	nonAdminNamespaceSet := kcl.buildNonAdminNamespacesMap()
+	results := make(map[string]portainer.K8sNamespaceInfo)
+	for _, namespace := range namespaces {
+		if _, exists := nonAdminNamespaceSet[namespace.Name]; exists {
+			results[namespace.Name] = namespace
+		}
+	}
+
+	return results, nil
+}
+
+// fetchNamespaces gets the namespaces in the current k8s environment(endpoint).
+// this function is used by both admin and non-admin users.
+// the result gets parsed to a map of namespace name to namespace info.
+func (kcl *KubeClient) fetchNamespaces() (map[string]portainer.K8sNamespaceInfo, error) {
+	namespaces, err := kcl.cli.CoreV1().Namespaces().List(context.TODO(), metav1.ListOptions{})
+	if err != nil {
+		log.Error().
+			Str("context", "fetchNamespaces").
+			Err(err).
+			Msg("Failed to list namespaces")
+
+		return nil, fmt.Errorf("an error occurred during the fetchNamespacesForAdmin operation, unable to list namespaces for the admin user: %w", err)
+	}
+
+	results := make(map[string]portainer.K8sNamespaceInfo)
+	for _, namespace := range namespaces.Items {
+		results[namespace.Name] = parseNamespace(&namespace)
+	}
+
+	return results, nil
+}
+
+// parseNamespace converts a k8s namespace object to a portainer namespace object.
+func parseNamespace(namespace *corev1.Namespace) portainer.K8sNamespaceInfo {
+	return portainer.K8sNamespaceInfo{
+		Id:             string(namespace.UID),
+		Name:           namespace.Name,
+		Status:         namespace.Status,
+		Annotations:    namespace.Annotations,
+		CreationDate:   namespace.CreationTimestamp.Format(time.RFC3339),
+		NamespaceOwner: namespace.Labels[namespaceOwnerLabel],
+		IsSystem:       isSystemNamespace(namespace),
+		IsDefault:      namespace.Name == defaultNamespace,
+	}
+}
+
+// GetNamespace gets the namespace in the current k8s environment(endpoint).
+func (kcl *KubeClient) GetNamespace(name string) (portainer.K8sNamespaceInfo, error) {
+	if !kcl.GetIsKubeAdmin() {
+		if _, allowed := kcl.buildNonAdminNamespacesMap()[name]; !allowed {
+			log.Warn().
+				Str("context", "GetNamespace").
+				Str("namespace", name).
+				Msg("Non-admin user denied access to namespace not in allowed list")
+			return portainer.K8sNamespaceInfo{}, k8serrors.NewForbidden(
+				corev1.Resource("namespaces"),
+				name,
+				errors.New("user does not have access to this namespace"),
+			)
+		}
+	}
+
+	namespace, err := kcl.cli.CoreV1().Namespaces().Get(context.TODO(), name, metav1.GetOptions{})
+	if err != nil {
+		log.Error().
+			Str("context", "GetNamespace").
+			Str("namespace", name).
+			Err(err).
+			Msg("Failed to get namespace")
+		return portainer.K8sNamespaceInfo{}, err
+	}
+
+	return parseNamespace(namespace), nil
+}
+
+// CreateNamespace creates a new namespace in a k8s endpoint.
+func (kcl *KubeClient) CreateNamespace(info models.K8sNamespaceDetails) (*corev1.Namespace, error) {
+	portainerLabels := map[string]string{
+		namespaceNameLabel:  stackutils.SanitizeLabel(info.Name),
+		namespaceOwnerLabel: stackutils.SanitizeLabel(info.Owner),
+	}
+
+	var ns corev1.Namespace
+	ns.Name = info.Name
+	ns.Annotations = info.Annotations
+	ns.Labels = portainerLabels
+
+	namespace, err := kcl.cli.CoreV1().Namespaces().Create(context.Background(), &ns, metav1.CreateOptions{})
+	if err != nil {
+		log.Error().
+			Err(err).
+			Str("context", "CreateNamespace").
+			Str("Namespace", info.Name).
+			Msg("Failed to create the namespace")
+
+		return nil, err
+	}
+
+	if err := kcl.createOrUpdateNamespaceResourceQuota(info, portainerLabels); err != nil {
+		log.Error().
+			Err(err).
+			Str("context", "CreateNamespace").
+			Str("name", info.Name).
+			Msg("failed to create or update resource quota for namespace")
+		return nil, err
+	}
+
+	return namespace, nil
+}
+
+// UpdateNamespace updates a namespace in a k8s endpoint.
+func (kcl *KubeClient) UpdateNamespace(info models.K8sNamespaceDetails) (*corev1.Namespace, error) {
+	portainerLabels := map[string]string{
+		namespaceNameLabel:  stackutils.SanitizeLabel(info.Name),
+		namespaceOwnerLabel: stackutils.SanitizeLabel(info.Owner),
+	}
+
+	namespace := corev1.Namespace{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:        info.Name,
+			Annotations: info.Annotations,
+		},
+	}
+
+	updatedNamespace, err := kcl.cli.CoreV1().Namespaces().Update(context.Background(), &namespace, metav1.UpdateOptions{})
+	if err != nil {
+		log.Error().
+			Str("context", "UpdateNamespace").
+			Str("namespace", info.Name).
+			Err(err).
+			Msg("Failed to update namespace")
+		return nil, err
+	}
+
+	if err := kcl.createOrUpdateNamespaceResourceQuota(info, portainerLabels); err != nil {
+		log.Error().
+			Err(err).
+			Str("context", "UpdateNamespace").
+			Str("name", info.Name).
+			Msg("failed to create or update resource quota for namespace")
+		return nil, err
+	}
+
+	return updatedNamespace, nil
+}
+
+func (kcl *KubeClient) createOrUpdateNamespaceResourceQuota(info models.K8sNamespaceDetails, portainerLabels map[string]string) error {
+	if !info.ResourceQuota.Enabled {
+		if err := kcl.deleteNamespaceResourceQuota(info.Name); err != nil {
+			log.Debug().Err(err).Str("context", "createOrUpdateNamespaceResourceQuota").Str("name", info.Name).Msg("failed to delete resource quota for namespace")
+		}
+		return nil
+	}
+
+	resourceQuota := &corev1.ResourceQuota{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "portainer-rq-" + info.Name,
+			Namespace: info.Name,
+			Labels:    portainerLabels,
+		},
+		Spec: corev1.ResourceQuotaSpec{
+			Hard: corev1.ResourceList{},
+		},
+	}
+
+	if info.ResourceQuota.Enabled {
+		memory := resource.MustParse(info.ResourceQuota.Memory)
+		cpu := resource.MustParse(info.ResourceQuota.CPU)
+
+		if memory.Value() > 0 {
+			memQuota := memory
+			resourceQuota.Spec.Hard[corev1.ResourceLimitsMemory] = memQuota
+			resourceQuota.Spec.Hard[corev1.ResourceRequestsMemory] = memQuota
+		}
+
+		if cpu.Value() > 0 {
+			cpuQuota := cpu
+			resourceQuota.Spec.Hard[corev1.ResourceLimitsCPU] = cpuQuota
+			resourceQuota.Spec.Hard[corev1.ResourceRequestsCPU] = cpuQuota
+		}
+	}
+
+	_, err := kcl.cli.CoreV1().ResourceQuotas(info.Name).Update(context.Background(), resourceQuota, metav1.UpdateOptions{})
+	if err != nil {
+		if k8serrors.IsNotFound(err) {
+			log.Warn().
+				Str("context", "createOrUpdateNamespaceResourceQuota").
+				Str("name", info.Name).
+				Msg("resource quota not found, creating")
+			_, err = kcl.cli.CoreV1().ResourceQuotas(info.Name).Create(context.Background(), resourceQuota, metav1.CreateOptions{})
+		}
+	}
+
+	return err
+}
+
+func (kcl *KubeClient) deleteNamespaceResourceQuota(namespaceName string) error {
+	err := kcl.cli.CoreV1().ResourceQuotas(namespaceName).Delete(context.Background(), "portainer-rq-"+namespaceName, metav1.DeleteOptions{})
+	if err != nil && !k8serrors.IsNotFound(err) {
+		log.Error().
+			Str("context", "deleteNamespaceResourceQuota").
+			Str("name", namespaceName).
+			Err(err).
+			Msg("failed to delete resource quota for namespace")
+		return err
+	}
+	log.Warn().
+		Str("context", "deleteNamespaceResourceQuota").
+		Str("name", namespaceName).
+		Msg("resource quota to delete not found")
+	return nil
+}
+
+func isSystemNamespace(namespace *corev1.Namespace) bool {
+	systemLabelValue, hasSystemLabel := namespace.Labels[systemNamespaceLabel]
+	if hasSystemLabel {
+		return systemLabelValue == "true"
+	}
+
+	return isSystemDefaultNamespace(namespace.Name)
+}
+
+func isSystemDefaultNamespace(namespace string) bool {
+	systemNamespaces := defaultSystemNamespaces()
+	_, isSystem := systemNamespaces[namespace]
+	return isSystem
+}
+
+func (kcl *KubeClient) isSystemNamespace(namespace string) bool {
+	ns, err := kcl.cli.CoreV1().Namespaces().Get(context.TODO(), namespace, metav1.GetOptions{})
+	if err != nil {
+		return false
+	}
+
+	return isSystemNamespace(ns)
+}
+
+// ToggleSystemState will set a namespace as a system namespace, or remove this state
+// if isSystem is true it will set `systemNamespaceLabel` to "true" and false otherwise
+// this will skip if namespace is "default" or if the required state is already set
+func (kcl *KubeClient) ToggleSystemState(namespaceName string, isSystem bool) error {
+	if namespaceName == "default" {
+		return nil
+	}
+
+	namespace, err := kcl.cli.CoreV1().Namespaces().Get(context.TODO(), namespaceName, metav1.GetOptions{})
+	if err != nil {
+		log.Error().
+			Str("context", "ToggleSystemState").
+			Str("namespace", namespaceName).
+			Err(err).
+			Msg("failed to get namespace")
+		return errors.Wrap(err, "failed fetching namespace object")
+	}
+
+	if isSystemNamespace(namespace) == isSystem {
+		return nil
+	}
+
+	if namespace.Labels == nil {
+		namespace.Labels = map[string]string{}
+	}
+
+	namespace.Labels[systemNamespaceLabel] = strconv.FormatBool(isSystem)
+
+	if _, err := kcl.cli.CoreV1().Namespaces().Update(context.TODO(), namespace, metav1.UpdateOptions{}); err != nil {
+		log.Error().
+			Str("context", "ToggleSystemState").
+			Str("namespace", namespaceName).
+			Err(err).
+			Msg("failed updating namespace object")
+		return errors.Wrap(err, "failed updating namespace object")
+	}
+
+	if isSystem {
+		return kcl.NamespaceAccessPoliciesDeleteNamespace(namespaceName)
+	}
+
+	return nil
+}
+
+func (kcl *KubeClient) DeleteNamespace(namespaceName string) (*corev1.Namespace, error) {
+	namespace, err := kcl.cli.CoreV1().Namespaces().Get(context.Background(), namespaceName, metav1.GetOptions{})
+	if err != nil {
+		log.Error().
+			Str("context", "DeleteNamespace").
+			Str("namespace", namespaceName).
+			Err(err).
+			Msg("failed fetching namespace object")
+		return nil, err
+	}
+
+	err = kcl.cli.CoreV1().Namespaces().Delete(context.Background(), namespaceName, metav1.DeleteOptions{})
+	if err != nil {
+		log.Error().
+			Str("context", "DeleteNamespace").
+			Str("namespace", namespaceName).
+			Err(err).
+			Msg("failed deleting namespace object")
+		return nil, err
+	}
+
+	return namespace, nil
+}
+
+// CombineNamespacesWithUnhealthyEvents combines namespaces with unhealthy events across all namespaces
+func (kcl *KubeClient) CombineNamespacesWithUnhealthyEvents(namespaces map[string]portainer.K8sNamespaceInfo) (map[string]portainer.K8sNamespaceInfo, error) {
+	allEvents, err := kcl.GetEvents("", "")
+	if err != nil && !k8serrors.IsNotFound(err) {
+		log.Error().
+			Str("context", "CombineNamespacesWithUnhealthyEvents").
+			Err(err).
+			Msg("unable to retrieve unhealthy events from the Kubernetes for an admin user")
+		return nil, err
+	}
+
+	unhealthyEventCounts := make(map[string]int)
+	for _, event := range allEvents {
+		if event.Type == "Warning" {
+			unhealthyEventCounts[event.Namespace]++
+		}
+	}
+
+	for namespaceName, namespace := range namespaces {
+		if count, exists := unhealthyEventCounts[namespaceName]; exists {
+			namespace.UnhealthyEventCount = count
+			namespaces[namespaceName] = namespace
+		}
+	}
+
+	return namespaces, nil
+}
+
+// CombineNamespacesWithResourceQuotas combines namespaces with resource quotas where matching is based on "portainer-rq-"+namespace.Name
+func (kcl *KubeClient) CombineNamespacesWithResourceQuotas(namespaces map[string]portainer.K8sNamespaceInfo, w http.ResponseWriter) *httperror.HandlerError {
+	resourceQuotas, err := kcl.GetResourceQuotas("")
+	if err != nil && !k8serrors.IsNotFound(err) {
+		log.Error().
+			Str("context", "CombineNamespacesWithResourceQuotas").
+			Err(err).
+			Msg("unable to retrieve resource quotas from the Kubernetes for an admin user")
+		return httperror.InternalServerError("an error occurred during the CombineNamespacesWithResourceQuotas operation, unable to retrieve resource quotas from the Kubernetes for an admin user. Error: ", err)
+	}
+
+	if len(*resourceQuotas) > 0 {
+		return response.JSON(w, kcl.UpdateNamespacesWithResourceQuotas(namespaces, *resourceQuotas))
+	}
+
+	return response.JSON(w, kcl.ConvertNamespaceMapToSlice(namespaces))
+}
+
+// CombineNamespaceWithResourceQuota combines a namespace with a resource quota prefixed with "portainer-rq-"+namespace.Name
+func (kcl *KubeClient) CombineNamespaceWithResourceQuota(namespace portainer.K8sNamespaceInfo, w http.ResponseWriter) *httperror.HandlerError {
+	resourceQuota, err := kcl.GetPortainerResourceQuota(namespace.Name)
+	if err != nil && !k8serrors.IsNotFound(err) {
+		log.Error().
+			Str("context", "CombineNamespaceWithResourceQuota").
+			Str("namespace", namespace.Name).
+			Err(err).
+			Msg("unable to retrieve the resource quota associated with the namespace")
+		return httperror.InternalServerError(fmt.Sprintf("an error occurred during the CombineNamespaceWithResourceQuota operation, unable to retrieve the resource quota associated with the namespace: %s for a non-admin user. Error: ", namespace.Name), err)
+	}
+
+	if resourceQuota != nil {
+		namespace.ResourceQuota = resourceQuota
+	}
+
+	return response.JSON(w, namespace)
+}
+
+// buildNonAdminNamespacesMap builds a map of non-admin namespaces.
+// the map is used to filter the namespaces based on the allowed namespaces.
+func (kcl *KubeClient) buildNonAdminNamespacesMap() map[string]struct{} {
+	nonAdminNamespaces := kcl.GetClientNonAdminNamespaces()
+	nonAdminNamespaceSet := make(map[string]struct{}, len(nonAdminNamespaces))
+
+	for _, namespace := range nonAdminNamespaces {
+		if !isSystemDefaultNamespace(namespace) {
+			nonAdminNamespaceSet[namespace] = struct{}{}
+		}
+	}
+
+	return nonAdminNamespaceSet
+}
+
+// ConvertNamespaceMapToSlice converts the namespace map to a slice of namespaces.
+// this is used to for the API response.
+func (kcl *KubeClient) ConvertNamespaceMapToSlice(namespaces map[string]portainer.K8sNamespaceInfo) []portainer.K8sNamespaceInfo {
+	namespaceSlice := make([]portainer.K8sNamespaceInfo, 0, len(namespaces))
+	for _, namespace := range namespaces {
+		namespaceSlice = append(namespaceSlice, namespace)
+	}
+
+	// Sort namespaces by name
+	sort.Slice(namespaceSlice, func(i, j int) bool {
+		return namespaceSlice[i].Name < namespaceSlice[j].Name
+	})
+
+	return namespaceSlice
+}
diff --git a/api/kubernetes/cli/namespace_test.go b/api/kubernetes/cli/namespace_test.go
new file mode 100644
index 0000000..2574b14
--- /dev/null
+++ b/api/kubernetes/cli/namespace_test.go
@@ -0,0 +1,244 @@
+package cli
+
+import (
+	"strconv"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	core "k8s.io/api/core/v1"
+	k8serrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	kfake "k8s.io/client-go/kubernetes/fake"
+)
+
+func Test_ToggleSystemState(t *testing.T) {
+	t.Parallel()
+	t.Run("should skip is default (exit without error)", func(t *testing.T) {
+		nsName := "default"
+		kcl := &KubeClient{
+			cli:        kfake.NewSimpleClientset(&core.Namespace{ObjectMeta: metav1.ObjectMeta{Name: nsName}}),
+			instanceID: "instance",
+		}
+
+		err := kcl.ToggleSystemState(nsName, true)
+		require.NoError(t, err)
+
+		ns, err := kcl.cli.CoreV1().Namespaces().Get(t.Context(), nsName, metav1.GetOptions{})
+		require.NoError(t, err)
+
+		_, exists := ns.Labels[systemNamespaceLabel]
+		assert.False(t, exists, "system label should not exists")
+	})
+
+	t.Run("should fail if namespace doesn't exist", func(t *testing.T) {
+		nsName := "not-exist"
+		kcl := &KubeClient{
+			cli:        kfake.NewSimpleClientset(),
+			instanceID: "instance",
+		}
+
+		err := kcl.ToggleSystemState(nsName, true)
+		require.Error(t, err)
+	})
+
+	t.Run("if called with the same state, should skip (exit without error)", func(t *testing.T) {
+		nsName := "namespace"
+		tests := []struct {
+			isSystem bool
+		}{
+			{isSystem: true},
+			{isSystem: false},
+		}
+
+		for _, test := range tests {
+			t.Run(strconv.FormatBool(test.isSystem), func(t *testing.T) {
+				kcl := &KubeClient{
+					cli: kfake.NewSimpleClientset(&core.Namespace{ObjectMeta: metav1.ObjectMeta{Name: nsName, Labels: map[string]string{
+						systemNamespaceLabel: strconv.FormatBool(test.isSystem),
+					}}}),
+					instanceID: "instance",
+				}
+
+				err := kcl.ToggleSystemState(nsName, test.isSystem)
+				require.NoError(t, err)
+
+				ns, err := kcl.cli.CoreV1().Namespaces().Get(t.Context(), nsName, metav1.GetOptions{})
+				require.NoError(t, err)
+
+				assert.Equal(t, test.isSystem, isSystemNamespace(ns))
+			})
+		}
+	})
+
+	t.Run("for regular namespace if isSystem is true and doesn't have a label, should set the label to true", func(t *testing.T) {
+		nsName := "namespace"
+
+		config := &core.ConfigMap{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      portainerConfigMapName,
+				Namespace: portainerNamespace,
+			},
+			Data: map[string]string{
+				"NamespaceAccessPolicies": `{"ns1":{"UserAccessPolicies":{"2":{"RoleId":0}}}, "ns2":{"UserAccessPolicies":{"2":{"RoleId":0}}}}`,
+			},
+		}
+
+		kcl := &KubeClient{
+			cli:        kfake.NewSimpleClientset(&core.Namespace{ObjectMeta: metav1.ObjectMeta{Name: nsName}}, config),
+			instanceID: "instance",
+		}
+
+		err := kcl.ToggleSystemState(nsName, true)
+		require.NoError(t, err)
+
+		ns, err := kcl.cli.CoreV1().Namespaces().Get(t.Context(), nsName, metav1.GetOptions{})
+		require.NoError(t, err)
+
+		labelValue, exists := ns.Labels[systemNamespaceLabel]
+		assert.True(t, exists, "system label should exists")
+
+		assert.Equal(t, "true", labelValue)
+	})
+
+	t.Run("for default system namespace if isSystem is false and doesn't have a label, should set the label to false", func(t *testing.T) {
+		nsName := "portainer"
+
+		kcl := &KubeClient{
+			cli:        kfake.NewSimpleClientset(&core.Namespace{ObjectMeta: metav1.ObjectMeta{Name: nsName}}),
+			instanceID: "instance",
+		}
+
+		err := kcl.ToggleSystemState(nsName, false)
+		require.NoError(t, err)
+
+		ns, err := kcl.cli.CoreV1().Namespaces().Get(t.Context(), nsName, metav1.GetOptions{})
+		require.NoError(t, err)
+
+		labelValue, exists := ns.Labels[systemNamespaceLabel]
+		assert.True(t, exists, "system label should exists")
+
+		assert.Equal(t, "false", labelValue)
+	})
+
+	t.Run("for system namespace (with label), if called with false, should set the label", func(t *testing.T) {
+		nsName := "namespace"
+
+		kcl := &KubeClient{
+			cli: kfake.NewSimpleClientset(&core.Namespace{ObjectMeta: metav1.ObjectMeta{Name: nsName, Labels: map[string]string{
+				systemNamespaceLabel: "true",
+			}}}),
+			instanceID: "instance",
+		}
+
+		err := kcl.ToggleSystemState(nsName, false)
+		require.NoError(t, err)
+
+		ns, err := kcl.cli.CoreV1().Namespaces().Get(t.Context(), nsName, metav1.GetOptions{})
+		require.NoError(t, err)
+
+		labelValue, exists := ns.Labels[systemNamespaceLabel]
+		assert.True(t, exists, "system label should exists")
+		assert.Equal(t, "false", labelValue)
+	})
+
+	t.Run("for non system namespace (with label), if called with true, should set the label, and remove accesses", func(t *testing.T) {
+		nsName := "ns1"
+
+		namespace := &core.Namespace{ObjectMeta: metav1.ObjectMeta{Name: nsName, Labels: map[string]string{
+			systemNamespaceLabel: "false",
+		}}}
+
+		config := &core.ConfigMap{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      portainerConfigMapName,
+				Namespace: portainerNamespace,
+			},
+			Data: map[string]string{
+				"NamespaceAccessPolicies": `{"ns1":{"UserAccessPolicies":{"2":{"RoleId":0}}}, "ns2":{"UserAccessPolicies":{"2":{"RoleId":0}}}}`,
+			},
+		}
+
+		kcl := &KubeClient{
+			cli:        kfake.NewSimpleClientset(namespace, config),
+			instanceID: "instance",
+		}
+
+		err := kcl.ToggleSystemState(nsName, true)
+		require.NoError(t, err)
+
+		ns, err := kcl.cli.CoreV1().Namespaces().Get(t.Context(), nsName, metav1.GetOptions{})
+		require.NoError(t, err)
+
+		labelValue, exists := ns.Labels[systemNamespaceLabel]
+		assert.True(t, exists, "system label should exists")
+		assert.Equal(t, "true", labelValue)
+
+		expectedPolicies := map[string]portainer.K8sNamespaceAccessPolicy{
+			"ns2": {UserAccessPolicies: portainer.UserAccessPolicies{2: {RoleID: 0}}},
+		}
+
+		actualPolicies, err := kcl.GetNamespaceAccessPolicies()
+		require.NoError(t, err, "failed to fetch policies")
+		assert.Equal(t, expectedPolicies, actualPolicies)
+	})
+}
+
+func Test_GetNamespace(t *testing.T) {
+	t.Parallel()
+
+	newClient := func() *KubeClient {
+		return &KubeClient{
+			cli: kfake.NewSimpleClientset(
+				&core.Namespace{ObjectMeta: metav1.ObjectMeta{Name: "ns-1"}},
+				&core.Namespace{ObjectMeta: metav1.ObjectMeta{Name: "ns-2"}},
+				&core.Namespace{ObjectMeta: metav1.ObjectMeta{Name: "kube-system"}},
+			),
+			instanceID: "instance",
+		}
+	}
+
+	t.Run("admin can fetch any namespace", func(t *testing.T) {
+		kcl := newClient()
+		kcl.SetIsKubeAdmin(true)
+		kcl.SetClientNonAdminNamespaces(nil)
+
+		for _, name := range []string{"ns-1", "ns-2", "kube-system"} {
+			ns, err := kcl.GetNamespace(name)
+			require.NoError(t, err)
+			assert.Equal(t, name, ns.Name)
+		}
+	})
+
+	t.Run("non-admin can fetch a namespace in their namespace access", func(t *testing.T) {
+		kcl := newClient()
+		kcl.SetIsKubeAdmin(false)
+		kcl.SetClientNonAdminNamespaces([]string{"ns-1"})
+
+		ns, err := kcl.GetNamespace("ns-1")
+		require.NoError(t, err)
+		assert.Equal(t, "ns-1", ns.Name)
+	})
+
+	t.Run("non-admin is forbidden from a namespace outside their namespace access", func(t *testing.T) {
+		kcl := newClient()
+		kcl.SetIsKubeAdmin(false)
+		kcl.SetClientNonAdminNamespaces([]string{"ns-1"})
+
+		_, err := kcl.GetNamespace("ns-2")
+		require.Error(t, err)
+		assert.True(t, k8serrors.IsForbidden(err), "expected a Forbidden error, got %v", err)
+	})
+
+	t.Run("non-admin with no namespace access is forbidden from any namespace", func(t *testing.T) {
+		kcl := newClient()
+		kcl.SetIsKubeAdmin(false)
+		kcl.SetClientNonAdminNamespaces(nil)
+
+		_, err := kcl.GetNamespace("ns-1")
+		require.Error(t, err)
+		assert.True(t, k8serrors.IsForbidden(err), "expected a Forbidden error, got %v", err)
+	})
+}
diff --git a/api/kubernetes/cli/naming.go b/api/kubernetes/cli/naming.go
new file mode 100644
index 0000000..f42289a
--- /dev/null
+++ b/api/kubernetes/cli/naming.go
@@ -0,0 +1,34 @@
+package cli
+
+import (
+	"fmt"
+)
+
+const (
+	defaultNamespace                        = "default"
+	portainerNamespace                      = "portainer"
+	portainerUserCRName                     = "portainer-cr-user"
+	portainerUserCRBName                    = "portainer-crb-user"
+	portainerClusterAdminServiceAccountName = "portainer-sa-clusteradmin"
+	portainerUserServiceAccountPrefix       = "portainer-sa-user"
+	portainerRBPrefix                       = "portainer-rb"
+	portainerConfigMapName                  = "portainer-config"
+	portainerConfigMapAccessPoliciesKey     = "NamespaceAccessPolicies"
+	portainerShellPodPrefix                 = "portainer-pod-kubectl-shell"
+)
+
+func UserServiceAccountName(userID int, instanceID string) string {
+	return fmt.Sprintf("%s-%s-%d", portainerUserServiceAccountPrefix, instanceID, userID)
+}
+
+func userServiceAccountTokenSecretName(serviceAccountName string, instanceID string) string {
+	return fmt.Sprintf("%s-%s-secret", instanceID, serviceAccountName)
+}
+
+func namespaceClusterRoleBindingName(namespace string, instanceID string) string {
+	return fmt.Sprintf("%s-%s-%s", portainerRBPrefix, instanceID, namespace)
+}
+
+func userShellPodPrefix(serviceAccountName string) string {
+	return fmt.Sprintf("%s-%s-", portainerShellPodPrefix, serviceAccountName)
+}
diff --git a/api/kubernetes/cli/nodes.go b/api/kubernetes/cli/nodes.go
new file mode 100644
index 0000000..9337924
--- /dev/null
+++ b/api/kubernetes/cli/nodes.go
@@ -0,0 +1,22 @@
+package cli
+
+import (
+	"context"
+
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// GetClusterNodes returns all nodes from the Kubernetes cluster.
+func (kcl *KubeClient) GetClusterNodes() ([]corev1.Node, error) {
+	nodes, err := kcl.cli.CoreV1().Nodes().List(context.TODO(), metav1.ListOptions{})
+	if err != nil {
+		return nil, err
+	}
+
+	for i := range nodes.Items {
+		nodes.Items[i].ManagedFields = nil
+	}
+
+	return nodes.Items, nil
+}
diff --git a/api/kubernetes/cli/nodes_limits.go b/api/kubernetes/cli/nodes_limits.go
new file mode 100644
index 0000000..0b2a641
--- /dev/null
+++ b/api/kubernetes/cli/nodes_limits.go
@@ -0,0 +1,104 @@
+package cli
+
+import (
+	"context"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/rs/zerolog/log"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// GetNodesLimits gets the CPU and Memory limits(unused resources) of all nodes in the current k8s environment(endpoint) connection
+func (kcl *KubeClient) GetNodesLimits() (portainer.K8sNodesLimits, error) {
+	nodesLimits := make(portainer.K8sNodesLimits)
+
+	nodes, err := kcl.cli.CoreV1().Nodes().List(context.TODO(), metav1.ListOptions{})
+	if err != nil {
+		return nil, err
+	}
+
+	pods, err := kcl.cli.CoreV1().Pods("").List(context.TODO(), metav1.ListOptions{})
+	if err != nil {
+		return nil, err
+	}
+
+	for _, item := range nodes.Items {
+		cpu := item.Status.Allocatable.Cpu().MilliValue()
+		memory := item.Status.Allocatable.Memory().Value() // bytes
+
+		nodesLimits[item.Name] = &portainer.K8sNodeLimits{
+			CPU:    cpu,
+			Memory: memory,
+		}
+	}
+
+	for _, item := range pods.Items {
+		if nodeLimits, ok := nodesLimits[item.Spec.NodeName]; ok {
+			for _, container := range item.Spec.Containers {
+				nodeLimits.CPU -= container.Resources.Requests.Cpu().MilliValue()
+				nodeLimits.Memory -= container.Resources.Requests.Memory().Value()
+			}
+		}
+	}
+
+	return nodesLimits, nil
+}
+
+// GetMaxResourceLimits gets the maximum CPU and Memory limits(unused resources) of all nodes in the current k8s environment(endpoint) connection, minus the accumulated resourcequotas for all namespaces except the one we're editing (skipNamespace)
+// if skipNamespace is set to "" then all namespaces are considered
+func (kcl *KubeClient) GetMaxResourceLimits(skipNamespace string, overCommitEnabled bool, resourceOverCommitPercent int) (portainer.K8sNodeLimits, error) {
+	limits := portainer.K8sNodeLimits{}
+	nodes, err := kcl.cli.CoreV1().Nodes().List(context.TODO(), metav1.ListOptions{})
+	if err != nil {
+		return limits, err
+	}
+
+	// accumulated node limits
+	memory := int64(0)
+	for _, node := range nodes.Items {
+		limits.CPU += node.Status.Allocatable.Cpu().MilliValue()
+		memory += node.Status.Allocatable.Memory().Value() // bytes
+	}
+	limits.Memory = memory / 1000000 // B to MB
+
+	if !overCommitEnabled {
+		namespaces, err := kcl.cli.CoreV1().Namespaces().List(context.TODO(), metav1.ListOptions{})
+		if err != nil {
+			return limits, err
+		}
+
+		reservedPercent := float64(resourceOverCommitPercent) / 100.0
+
+		reserved := portainer.K8sNodeLimits{}
+		for _, namespace := range namespaces.Items {
+			// skip the namespace we're editing
+			if namespace.Name == skipNamespace {
+				continue
+			}
+
+			// minus accumulated resourcequotas for all namespaces except the one we're editing
+			resourceQuota, err := kcl.cli.CoreV1().ResourceQuotas(namespace.Name).List(context.TODO(), metav1.ListOptions{})
+			if err != nil {
+				log.Debug().Msgf("error getting resourcequota for namespace %s: %s", namespace.Name, err)
+				continue // skip it
+			}
+
+			for _, rq := range resourceQuota.Items {
+				hardLimits := rq.Status.Hard
+				for resourceType, limit := range hardLimits {
+					switch resourceType {
+					case "limits.cpu":
+						reserved.CPU += limit.MilliValue()
+					case "limits.memory":
+						reserved.Memory += limit.ScaledValue(6) // MB
+					}
+				}
+			}
+		}
+
+		limits.CPU = limits.CPU - int64(float64(limits.CPU)*reservedPercent) - reserved.CPU
+		limits.Memory = limits.Memory - int64(float64(limits.Memory)*reservedPercent) - reserved.Memory
+	}
+
+	return limits, nil
+}
diff --git a/api/kubernetes/cli/nodes_limits_test.go b/api/kubernetes/cli/nodes_limits_test.go
new file mode 100644
index 0000000..044d1af
--- /dev/null
+++ b/api/kubernetes/cli/nodes_limits_test.go
@@ -0,0 +1,140 @@
+package cli
+
+import (
+	"reflect"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+
+	v1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/resource"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes"
+	kfake "k8s.io/client-go/kubernetes/fake"
+)
+
+func newNodes() *v1.NodeList {
+	return &v1.NodeList{
+		Items: []v1.Node{
+			{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "test-node-0",
+				},
+				Status: v1.NodeStatus{
+					Allocatable: v1.ResourceList{
+						v1.ResourceCPU:    resource.MustParse("2"),
+						v1.ResourceMemory: resource.MustParse("4M"),
+					},
+				},
+			},
+			{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "test-node-1",
+				},
+				Status: v1.NodeStatus{
+					Allocatable: v1.ResourceList{
+						v1.ResourceCPU:    resource.MustParse("3"),
+						v1.ResourceMemory: resource.MustParse("6M"),
+					},
+				},
+			},
+		},
+	}
+}
+
+func newPods() *v1.PodList {
+	return &v1.PodList{
+		Items: []v1.Pod{
+			{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "test-container-0",
+					Namespace: "test-namespace-0",
+				},
+				Spec: v1.PodSpec{
+					NodeName: "test-node-0",
+					Containers: []v1.Container{
+						{
+							Name: "test-container-0",
+							Resources: v1.ResourceRequirements{
+								Requests: v1.ResourceList{
+									v1.ResourceCPU:    resource.MustParse("1"),
+									v1.ResourceMemory: resource.MustParse("2M"),
+								},
+							},
+						},
+					},
+				},
+			},
+			{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "test-container-1",
+					Namespace: "test-namespace-1",
+				},
+				Spec: v1.PodSpec{
+					NodeName: "test-node-1",
+					Containers: []v1.Container{
+						{
+							Name: "test-container-1",
+							Resources: v1.ResourceRequirements{
+								Requests: v1.ResourceList{
+									v1.ResourceCPU:    resource.MustParse("2"),
+									v1.ResourceMemory: resource.MustParse("3M"),
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func TestKubeClient_GetNodesLimits(t *testing.T) {
+	t.Parallel()
+	type fields struct {
+		cli kubernetes.Interface
+	}
+
+	fieldsInstance := fields{
+		cli: kfake.NewSimpleClientset(newNodes(), newPods()),
+	}
+
+	tests := []struct {
+		name    string
+		fields  fields
+		want    portainer.K8sNodesLimits
+		wantErr bool
+	}{
+		{
+			name:   "2 nodes 2 pods",
+			fields: fieldsInstance,
+			want: portainer.K8sNodesLimits{
+				"test-node-0": &portainer.K8sNodeLimits{
+					CPU:    1000,
+					Memory: 2000000,
+				},
+				"test-node-1": &portainer.K8sNodeLimits{
+					CPU:    1000,
+					Memory: 3000000,
+				},
+			},
+			wantErr: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			kcl := &KubeClient{
+				cli: tt.fields.cli,
+			}
+			got, err := kcl.GetNodesLimits()
+			if (err != nil) != tt.wantErr {
+				t.Errorf("GetNodesLimits() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+			if !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("GetNodesLimits() got = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
diff --git a/api/kubernetes/cli/nodes_test.go b/api/kubernetes/cli/nodes_test.go
new file mode 100644
index 0000000..e2df3c3
--- /dev/null
+++ b/api/kubernetes/cli/nodes_test.go
@@ -0,0 +1,64 @@
+package cli
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	kfake "k8s.io/client-go/kubernetes/fake"
+)
+
+func TestGetClusterNodes_ReturnsAllNodes(t *testing.T) {
+	t.Parallel()
+
+	nodeList := &corev1.NodeList{
+		Items: []corev1.Node{
+			{ObjectMeta: metav1.ObjectMeta{Name: "node-0"}},
+			{ObjectMeta: metav1.ObjectMeta{Name: "node-1"}},
+		},
+	}
+
+	kcl := &KubeClient{cli: kfake.NewSimpleClientset(nodeList)}
+
+	got, err := kcl.GetClusterNodes()
+	require.NoError(t, err)
+	assert.Len(t, got, 2)
+	assert.Equal(t, "node-0", got[0].Name)
+	assert.Equal(t, "node-1", got[1].Name)
+}
+
+func TestGetClusterNodes_EmptyCluster(t *testing.T) {
+	t.Parallel()
+
+	kcl := &KubeClient{cli: kfake.NewSimpleClientset()}
+
+	got, err := kcl.GetClusterNodes()
+	require.NoError(t, err)
+	assert.Empty(t, got)
+}
+
+func TestGetClusterNodes_StripsManagedFields(t *testing.T) {
+	t.Parallel()
+
+	nodeList := &corev1.NodeList{
+		Items: []corev1.Node{
+			{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "node-0",
+					ManagedFields: []metav1.ManagedFieldsEntry{
+						{Manager: "kubectl"},
+					},
+				},
+			},
+		},
+	}
+
+	kcl := &KubeClient{cli: kfake.NewSimpleClientset(nodeList)}
+
+	got, err := kcl.GetClusterNodes()
+	require.NoError(t, err)
+	require.Len(t, got, 1)
+	assert.Nil(t, got[0].ManagedFields)
+}
diff --git a/api/kubernetes/cli/persistent_volume_claims.go b/api/kubernetes/cli/persistent_volume_claims.go
new file mode 100644
index 0000000..981a74d
--- /dev/null
+++ b/api/kubernetes/cli/persistent_volume_claims.go
@@ -0,0 +1,255 @@
+package cli
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+	"github.com/rs/zerolog/log"
+	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+	k8serrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/resource"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+)
+
+// GetPersistentVolumeClaims returns all PVCs in the given namespace (or all namespaces if empty).
+// For non-admin users, results are filtered to their accessible namespaces.
+func (kcl *KubeClient) GetPersistentVolumeClaims(namespace string) ([]models.K8sPersistentVolumeClaim, error) {
+	if kcl.GetIsKubeAdmin() {
+		return kcl.fetchPersistentVolumeClaims(namespace)
+	}
+
+	return kcl.fetchPersistentVolumeClaimsForNonAdmin(namespace)
+}
+
+// GetPersistentVolumeClaim returns a single PVC by namespace and name.
+func (kcl *KubeClient) GetPersistentVolumeClaim(namespace, name string) (*models.K8sPersistentVolumeClaim, error) {
+	if !kcl.GetIsKubeAdmin() {
+		allowedNamespaces := kcl.buildNonAdminNamespacesMap()
+		if _, ok := allowedNamespaces[namespace]; !ok {
+			return nil, fmt.Errorf("access to namespace %s is not authorized: %w", namespace, ErrUnauthorized)
+		}
+	}
+
+	pvc, err := kcl.cli.CoreV1().PersistentVolumeClaims(namespace).Get(context.Background(), name, metav1.GetOptions{})
+	if err != nil {
+		return nil, fmt.Errorf("unable to get persistent volume claim %s/%s. Error: %w", namespace, name, err)
+	}
+
+	result := parsePersistentVolumeClaimDetail(pvc)
+	return &result, nil
+}
+
+// DeletePersistentVolumeClaims deletes the specified PVCs.
+func (kcl *KubeClient) DeletePersistentVolumeClaims(reqs models.K8sVolumeDeleteRequests) error {
+	for _, req := range reqs {
+		log.Debug().
+			Str("context", "DeletePersistentVolumeClaims").
+			Str("namespace", req.Namespace).
+			Str("name", req.Name).
+			Msg("Deleting persistent volume claim")
+
+		err := kcl.cli.CoreV1().PersistentVolumeClaims(req.Namespace).Delete(context.Background(), req.Name, metav1.DeleteOptions{})
+		if err != nil {
+			return fmt.Errorf("unable to delete persistent volume claim %s/%s. Error: %w", req.Namespace, req.Name, err)
+		}
+	}
+
+	return nil
+}
+
+// ResizePersistentVolumeClaim resizes a PVC to the given new size.
+// The storage class must have AllowVolumeExpansion set to true.
+func (kcl *KubeClient) ResizePersistentVolumeClaim(namespace, name, newSize string) error {
+	pvc, err := kcl.cli.CoreV1().PersistentVolumeClaims(namespace).Get(context.Background(), name, metav1.GetOptions{})
+	if err != nil {
+		return fmt.Errorf("unable to get persistent volume claim %s/%s. Error: %w", namespace, name, err)
+	}
+
+	if pvc.Spec.StorageClassName != nil {
+		sc, err := kcl.GetStorageClass(*pvc.Spec.StorageClassName)
+		if err != nil {
+			return fmt.Errorf("unable to get storage class %s. Error: %w", *pvc.Spec.StorageClassName, err)
+		}
+
+		if sc.AllowVolumeExpansion == nil || !*sc.AllowVolumeExpansion {
+			return errors.New("storage class " + sc.Name + " does not allow volume expansion")
+		}
+	}
+
+	_, err = resource.ParseQuantity(newSize)
+	if err != nil {
+		return fmt.Errorf("invalid size format %q. Error: %w", newSize, err)
+	}
+
+	patch := fmt.Sprintf(`{"spec":{"resources":{"requests":{"storage":"%s"}}}}`, newSize)
+
+	_, err = kcl.cli.CoreV1().PersistentVolumeClaims(namespace).Patch(
+		context.Background(),
+		name,
+		types.MergePatchType,
+		[]byte(patch),
+		metav1.PatchOptions{},
+	)
+	if err != nil {
+		return fmt.Errorf("unable to resize persistent volume claim %s/%s. Error: %w", namespace, name, err)
+	}
+
+	return nil
+}
+
+func (kcl *KubeClient) fetchPersistentVolumeClaims(namespace string) ([]models.K8sPersistentVolumeClaim, error) {
+	pvcList, err := kcl.cli.CoreV1().PersistentVolumeClaims(namespace).List(context.Background(), metav1.ListOptions{})
+	if err != nil {
+		return nil, fmt.Errorf("unable to list persistent volume claims. Error: %w", err)
+	}
+
+	storageClasses, err := kcl.GetStorageClasses()
+	if err != nil {
+		return nil, fmt.Errorf("unable to list storage classes for volume expansion lookup. Error: %w", err)
+	}
+
+	scExpansionMap := make(map[string]bool, len(storageClasses))
+	for _, sc := range storageClasses {
+		if sc.AllowVolumeExpansion != nil {
+			scExpansionMap[sc.Name] = *sc.AllowVolumeExpansion
+		}
+	}
+
+	results := make([]models.K8sPersistentVolumeClaim, 0, len(pvcList.Items))
+	for i := range pvcList.Items {
+		pvc := parsePersistentVolumeClaimDetail(&pvcList.Items[i])
+		if pvc.StorageClass != nil {
+			pvc.AllowVolumeExpansion = scExpansionMap[*pvc.StorageClass]
+		}
+		results = append(results, pvc)
+	}
+
+	return results, nil
+}
+
+func (kcl *KubeClient) fetchPersistentVolumeClaimsForNonAdmin(namespace string) ([]models.K8sPersistentVolumeClaim, error) {
+	pvcs, err := kcl.fetchPersistentVolumeClaims(namespace)
+	if err != nil {
+		return nil, err
+	}
+
+	nonAdminNamespaceSet := kcl.buildNonAdminNamespacesMap()
+	results := make([]models.K8sPersistentVolumeClaim, 0)
+	for _, pvc := range pvcs {
+		if _, ok := nonAdminNamespaceSet[pvc.Namespace]; ok {
+			results = append(results, pvc)
+		}
+	}
+
+	return results, nil
+}
+
+// parsePersistentVolumeClaimDetail parses a PVC into the model with access modes and storage request string.
+func parsePersistentVolumeClaimDetail(pvc *corev1.PersistentVolumeClaim) models.K8sPersistentVolumeClaim {
+	storage := pvc.Spec.Resources.Requests[corev1.ResourceStorage]
+	return models.K8sPersistentVolumeClaim{
+		ID:                       string(pvc.UID),
+		Name:                     pvc.Name,
+		Namespace:                pvc.Namespace,
+		CreationDate:             pvc.CreationTimestamp.Time,
+		Storage:                  storage.Value(),
+		StorageRequest:           storage.String(),
+		AccessModes:              humanReadableAccessModes(pvc.Spec.AccessModes),
+		HumanReadableAccessModes: pvc.Spec.AccessModes,
+		VolumeName:               pvc.Spec.VolumeName,
+		ResourcesRequests:        &pvc.Spec.Resources.Requests,
+		StorageClass:             pvc.Spec.StorageClassName,
+		VolumeMode:               pvc.Spec.VolumeMode,
+		OwningApplications:       nil,
+		Phase:                    pvc.Status.Phase,
+		Labels:                   pvc.Labels,
+	}
+}
+
+// CombineClaimsWithApplications enriches each PVC with the workloads that mount it.
+func (kcl *KubeClient) CombineClaimsWithApplications(pvcs []models.K8sPersistentVolumeClaim) ([]models.K8sPersistentVolumeClaim, error) {
+	pods, err := kcl.cli.CoreV1().Pods("").List(context.Background(), metav1.ListOptions{})
+	if err != nil {
+		if k8serrors.IsNotFound(err) {
+			return pvcs, nil
+		}
+		return nil, fmt.Errorf("failed to list pods: %w", err)
+	}
+
+	replicaSetItems := make([]appsv1.ReplicaSet, 0)
+	deploymentItems := make([]appsv1.Deployment, 0)
+	if containsReplicaSetOwnerReference(pods) {
+		replicaSets, err := kcl.cli.AppsV1().ReplicaSets("").List(context.Background(), metav1.ListOptions{})
+		if err != nil {
+			return nil, fmt.Errorf("failed to list replica sets: %w", err)
+		}
+		replicaSetItems = replicaSets.Items
+
+		deployments, err := kcl.cli.AppsV1().Deployments("").List(context.Background(), metav1.ListOptions{})
+		if err != nil {
+			return nil, fmt.Errorf("failed to list deployments: %w", err)
+		}
+		deploymentItems = deployments.Items
+	}
+
+	statefulSetItems := make([]appsv1.StatefulSet, 0)
+	if containsStatefulSetOwnerReference(pods) {
+		statefulSets, err := kcl.cli.AppsV1().StatefulSets("").List(context.Background(), metav1.ListOptions{})
+		if err != nil {
+			return nil, fmt.Errorf("failed to list stateful sets: %w", err)
+		}
+		statefulSetItems = statefulSets.Items
+	}
+
+	daemonSetItems := make([]appsv1.DaemonSet, 0)
+	if containsDaemonSetOwnerReference(pods) {
+		daemonSets, err := kcl.cli.AppsV1().DaemonSets("").List(context.Background(), metav1.ListOptions{})
+		if err != nil {
+			return nil, fmt.Errorf("failed to list daemon sets: %w", err)
+		}
+		daemonSetItems = daemonSets.Items
+	}
+
+	resources := PortainerApplicationResources{
+		ReplicaSets:  replicaSetItems,
+		Deployments:  deploymentItems,
+		StatefulSets: statefulSetItems,
+		DaemonSets:   daemonSetItems,
+	}
+
+	for i := range pvcs {
+		for _, pod := range pods.Items {
+			for _, podVolume := range pod.Spec.Volumes {
+				if podVolume.PersistentVolumeClaim == nil {
+					continue
+				}
+				if podVolume.PersistentVolumeClaim.ClaimName != pvcs[i].Name || pod.Namespace != pvcs[i].Namespace {
+					continue
+				}
+				application, err := kcl.ConvertPodToApplication(pod, resources, false)
+				if err != nil {
+					return nil, fmt.Errorf("failed to convert pod to application: %w", err)
+				}
+				if application == nil {
+					continue
+				}
+				alreadyAdded := false
+				for _, existing := range pvcs[i].OwningApplications {
+					if existing.Name == application.Name && existing.Namespace == application.Namespace {
+						alreadyAdded = true
+						break
+					}
+				}
+				if !alreadyAdded {
+					pvcs[i].OwningApplications = append(pvcs[i].OwningApplications, *application)
+				}
+			}
+		}
+	}
+
+	return pvcs, nil
+}
diff --git a/api/kubernetes/cli/persistent_volume_claims_test.go b/api/kubernetes/cli/persistent_volume_claims_test.go
new file mode 100644
index 0000000..7ad4175
--- /dev/null
+++ b/api/kubernetes/cli/persistent_volume_claims_test.go
@@ -0,0 +1,378 @@
+package cli
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+	storagev1 "k8s.io/api/storage/v1"
+	"k8s.io/apimachinery/pkg/api/resource"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	kfake "k8s.io/client-go/kubernetes/fake"
+)
+
+func makeStorageClass(name string, allowExpansion bool) *storagev1.StorageClass {
+	return &storagev1.StorageClass{
+		ObjectMeta:           metav1.ObjectMeta{Name: name},
+		Provisioner:          "kubernetes.io/no-provisioner",
+		AllowVolumeExpansion: &allowExpansion,
+	}
+}
+
+func makePVC(namespace, name, scName string) *corev1.PersistentVolumeClaim {
+	storageRequest := resource.MustParse("1Gi")
+	pvc := &corev1.PersistentVolumeClaim{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      name,
+			Namespace: namespace,
+		},
+		Spec: corev1.PersistentVolumeClaimSpec{
+			Resources: corev1.VolumeResourceRequirements{
+				Requests: corev1.ResourceList{
+					corev1.ResourceStorage: storageRequest,
+				},
+			},
+		},
+	}
+	if scName != "" {
+		pvc.Spec.StorageClassName = &scName
+	}
+	return pvc
+}
+
+func TestResizePersistentVolumeClaim(t *testing.T) {
+	t.Parallel()
+
+	t.Run("returns error when storage class does not allow expansion", func(t *testing.T) {
+		t.Parallel()
+		k := NewTestKubeClient(kfake.NewClientset())
+
+		sc := makeStorageClass("no-expand", false)
+		_, err := k.cli.StorageV1().StorageClasses().Create(t.Context(), sc, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		pvc := makePVC("default", "pvc-no-expand", "no-expand")
+		_, err = k.cli.CoreV1().PersistentVolumeClaims("default").Create(t.Context(), pvc, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		err = k.ResizePersistentVolumeClaim("default", "pvc-no-expand", "2Gi")
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "does not allow volume expansion")
+	})
+
+	t.Run("returns error for invalid size format", func(t *testing.T) {
+		t.Parallel()
+		k := NewTestKubeClient(kfake.NewClientset())
+
+		sc := makeStorageClass("expandable", true)
+		_, err := k.cli.StorageV1().StorageClasses().Create(t.Context(), sc, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		pvc := makePVC("default", "pvc-badsize", "expandable")
+		_, err = k.cli.CoreV1().PersistentVolumeClaims("default").Create(t.Context(), pvc, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		err = k.ResizePersistentVolumeClaim("default", "pvc-badsize", "notasize")
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "invalid size format")
+	})
+
+	t.Run("success when storage class allows expansion with valid size", func(t *testing.T) {
+		t.Parallel()
+		k := NewTestKubeClient(kfake.NewClientset())
+
+		sc := makeStorageClass("expandable", true)
+		_, err := k.cli.StorageV1().StorageClasses().Create(t.Context(), sc, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		pvc := makePVC("default", "pvc-resize", "expandable")
+		_, err = k.cli.CoreV1().PersistentVolumeClaims("default").Create(t.Context(), pvc, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		err = k.ResizePersistentVolumeClaim("default", "pvc-resize", "5Gi")
+		require.NoError(t, err)
+	})
+
+	t.Run("success when PVC has no storage class", func(t *testing.T) {
+		t.Parallel()
+		k := NewTestKubeClient(kfake.NewClientset())
+
+		pvc := makePVC("default", "pvc-no-sc", "")
+		_, err := k.cli.CoreV1().PersistentVolumeClaims("default").Create(t.Context(), pvc, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		err = k.ResizePersistentVolumeClaim("default", "pvc-no-sc", "10Gi")
+		require.NoError(t, err)
+	})
+
+	t.Run("returns error for non-existent PVC", func(t *testing.T) {
+		t.Parallel()
+		k := NewTestKubeClient(kfake.NewClientset())
+
+		err := k.ResizePersistentVolumeClaim("default", "does-not-exist", "2Gi")
+		require.Error(t, err)
+	})
+}
+
+func TestGetPersistentVolumeClaims_EnrichesExpansionFlag(t *testing.T) {
+	t.Parallel()
+
+	t.Run("PVC with AllowVolumeExpansion=true SC gets flag true", func(t *testing.T) {
+		t.Parallel()
+		k := NewTestKubeClient(kfake.NewClientset())
+
+		sc := makeStorageClass("expandable", true)
+		_, err := k.cli.StorageV1().StorageClasses().Create(t.Context(), sc, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		pvc := makePVC("default", "pvc-expand", "expandable")
+		_, err = k.cli.CoreV1().PersistentVolumeClaims("default").Create(t.Context(), pvc, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		pvcs, err := k.GetPersistentVolumeClaims("default")
+		require.NoError(t, err)
+		require.Len(t, pvcs, 1)
+		assert.True(t, pvcs[0].AllowVolumeExpansion)
+	})
+
+	t.Run("PVC with AllowVolumeExpansion=false SC gets flag false", func(t *testing.T) {
+		t.Parallel()
+		k := NewTestKubeClient(kfake.NewClientset())
+
+		sc := makeStorageClass("not-expandable", false)
+		_, err := k.cli.StorageV1().StorageClasses().Create(t.Context(), sc, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		pvc := makePVC("default", "pvc-no-expand", "not-expandable")
+		_, err = k.cli.CoreV1().PersistentVolumeClaims("default").Create(t.Context(), pvc, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		pvcs, err := k.GetPersistentVolumeClaims("default")
+		require.NoError(t, err)
+		require.Len(t, pvcs, 1)
+		assert.False(t, pvcs[0].AllowVolumeExpansion)
+	})
+}
+
+func makePod(namespace, name, pvcName string) *corev1.Pod {
+	return &corev1.Pod{
+		ObjectMeta: metav1.ObjectMeta{Name: name, Namespace: namespace},
+		Spec: corev1.PodSpec{
+			Volumes: []corev1.Volume{
+				{
+					Name: "data",
+					VolumeSource: corev1.VolumeSource{
+						PersistentVolumeClaim: &corev1.PersistentVolumeClaimVolumeSource{
+							ClaimName: pvcName,
+						},
+					},
+				},
+			},
+			Containers: []corev1.Container{{Name: "app", Image: "nginx"}},
+		},
+	}
+}
+
+func makePodWithDeploymentOwner(namespace, name, pvcName, rsName string) *corev1.Pod {
+	pod := makePod(namespace, name, pvcName)
+	pod.OwnerReferences = []metav1.OwnerReference{
+		{Kind: "ReplicaSet", Name: rsName, APIVersion: "apps/v1"},
+	}
+	return pod
+}
+
+func makeReplicaSet(namespace, name, deploymentName string) *appsv1.ReplicaSet {
+	return &appsv1.ReplicaSet{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      name,
+			Namespace: namespace,
+			OwnerReferences: []metav1.OwnerReference{
+				{Kind: "Deployment", Name: deploymentName, APIVersion: "apps/v1"},
+			},
+		},
+	}
+}
+
+func makeDeployment(namespace, name string) *appsv1.Deployment {
+	return &appsv1.Deployment{
+		ObjectMeta: metav1.ObjectMeta{Name: name, Namespace: namespace},
+		Spec: appsv1.DeploymentSpec{
+			Selector: &metav1.LabelSelector{},
+		},
+	}
+}
+
+func TestCombineClaimsWithApplications(t *testing.T) {
+	t.Parallel()
+
+	t.Run("no pods leaves owningApplications empty", func(t *testing.T) {
+		t.Parallel()
+		k := NewTestKubeClient(kfake.NewClientset())
+
+		pvc := makePVC("default", "my-pvc", "")
+		_, err := k.cli.CoreV1().PersistentVolumeClaims("default").Create(t.Context(), pvc, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		pvcs, err := k.GetPersistentVolumeClaims("default")
+		require.NoError(t, err)
+
+		result, err := k.CombineClaimsWithApplications(pvcs)
+		require.NoError(t, err)
+		require.Len(t, result, 1)
+		assert.Empty(t, result[0].OwningApplications)
+	})
+
+	t.Run("pod with no PVC volumes leaves owningApplications empty", func(t *testing.T) {
+		t.Parallel()
+		k := NewTestKubeClient(kfake.NewClientset())
+
+		pvc := makePVC("default", "my-pvc", "")
+		_, err := k.cli.CoreV1().PersistentVolumeClaims("default").Create(t.Context(), pvc, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		pod := &corev1.Pod{
+			ObjectMeta: metav1.ObjectMeta{Name: "app", Namespace: "default"},
+			Spec: corev1.PodSpec{
+				Containers: []corev1.Container{{Name: "app", Image: "nginx"}},
+			},
+		}
+		_, err = k.cli.CoreV1().Pods("default").Create(t.Context(), pod, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		pvcs, err := k.GetPersistentVolumeClaims("default")
+		require.NoError(t, err)
+
+		result, err := k.CombineClaimsWithApplications(pvcs)
+		require.NoError(t, err)
+		assert.Empty(t, result[0].OwningApplications)
+	})
+
+	t.Run("pod mounting PVC populates owningApplications", func(t *testing.T) {
+		t.Parallel()
+		k := NewTestKubeClient(kfake.NewClientset())
+
+		pvc := makePVC("default", "my-pvc", "")
+		_, err := k.cli.CoreV1().PersistentVolumeClaims("default").Create(t.Context(), pvc, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		pod := makePod("default", "my-pod", "my-pvc")
+		_, err = k.cli.CoreV1().Pods("default").Create(t.Context(), pod, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		pvcs, err := k.GetPersistentVolumeClaims("default")
+		require.NoError(t, err)
+
+		result, err := k.CombineClaimsWithApplications(pvcs)
+		require.NoError(t, err)
+		require.Len(t, result[0].OwningApplications, 1)
+		assert.Equal(t, "my-pod", result[0].OwningApplications[0].Name)
+		assert.Equal(t, "Pod", result[0].OwningApplications[0].ApplicationType)
+		assert.Equal(t, "default", result[0].OwningApplications[0].ResourcePool)
+	})
+
+	t.Run("pod in different namespace does not match PVC", func(t *testing.T) {
+		t.Parallel()
+		k := NewTestKubeClient(kfake.NewClientset())
+
+		pvc := makePVC("default", "my-pvc", "")
+		_, err := k.cli.CoreV1().PersistentVolumeClaims("default").Create(t.Context(), pvc, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		pod := makePod("other-ns", "other-pod", "my-pvc")
+		_, err = k.cli.CoreV1().Pods("other-ns").Create(t.Context(), pod, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		pvcs, err := k.GetPersistentVolumeClaims("default")
+		require.NoError(t, err)
+
+		result, err := k.CombineClaimsWithApplications(pvcs)
+		require.NoError(t, err)
+		assert.Empty(t, result[0].OwningApplications)
+	})
+
+	t.Run("two pods mounting the same PVC from the same Deployment are deduplicated", func(t *testing.T) {
+		t.Parallel()
+		k := NewTestKubeClient(kfake.NewClientset())
+
+		pvc := makePVC("default", "shared-pvc", "")
+		_, err := k.cli.CoreV1().PersistentVolumeClaims("default").Create(t.Context(), pvc, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		deploy := makeDeployment("default", "my-deploy")
+		_, err = k.cli.AppsV1().Deployments("default").Create(t.Context(), deploy, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		rs := makeReplicaSet("default", "my-deploy-rs", "my-deploy")
+		_, err = k.cli.AppsV1().ReplicaSets("default").Create(t.Context(), rs, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		pod1 := makePodWithDeploymentOwner("default", "my-deploy-pod-1", "shared-pvc", "my-deploy-rs")
+		pod2 := makePodWithDeploymentOwner("default", "my-deploy-pod-2", "shared-pvc", "my-deploy-rs")
+		_, err = k.cli.CoreV1().Pods("default").Create(t.Context(), pod1, metav1.CreateOptions{})
+		require.NoError(t, err)
+		_, err = k.cli.CoreV1().Pods("default").Create(t.Context(), pod2, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		pvcs, err := k.GetPersistentVolumeClaims("default")
+		require.NoError(t, err)
+
+		result, err := k.CombineClaimsWithApplications(pvcs)
+		require.NoError(t, err)
+		require.Len(t, result[0].OwningApplications, 1)
+		assert.Equal(t, "my-deploy", result[0].OwningApplications[0].Name)
+		assert.Equal(t, "Deployment", result[0].OwningApplications[0].ApplicationType)
+	})
+
+	t.Run("pod owned by Deployment resolves application name to Deployment", func(t *testing.T) {
+		t.Parallel()
+		k := NewTestKubeClient(kfake.NewClientset())
+
+		pvc := makePVC("default", "app-pvc", "")
+		_, err := k.cli.CoreV1().PersistentVolumeClaims("default").Create(t.Context(), pvc, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		deploy := makeDeployment("default", "web-app")
+		_, err = k.cli.AppsV1().Deployments("default").Create(t.Context(), deploy, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		rs := makeReplicaSet("default", "web-app-rs-abc", "web-app")
+		_, err = k.cli.AppsV1().ReplicaSets("default").Create(t.Context(), rs, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		pod := makePodWithDeploymentOwner("default", "web-app-pod-xyz", "app-pvc", "web-app-rs-abc")
+		_, err = k.cli.CoreV1().Pods("default").Create(t.Context(), pod, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		pvcs, err := k.GetPersistentVolumeClaims("default")
+		require.NoError(t, err)
+
+		result, err := k.CombineClaimsWithApplications(pvcs)
+		require.NoError(t, err)
+		require.Len(t, result[0].OwningApplications, 1)
+		assert.Equal(t, "web-app", result[0].OwningApplications[0].Name)
+		assert.Equal(t, "Deployment", result[0].OwningApplications[0].ApplicationType)
+		assert.Equal(t, "default", result[0].OwningApplications[0].ResourcePool)
+	})
+
+	t.Run("unrelated pod mounting a different PVC does not affect result", func(t *testing.T) {
+		t.Parallel()
+		k := NewTestKubeClient(kfake.NewClientset())
+
+		pvc := makePVC("default", "target-pvc", "")
+		_, err := k.cli.CoreV1().PersistentVolumeClaims("default").Create(t.Context(), pvc, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		pod := makePod("default", "unrelated-pod", "other-pvc")
+		_, err = k.cli.CoreV1().Pods("default").Create(t.Context(), pod, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		pvcs, err := k.GetPersistentVolumeClaims("default")
+		require.NoError(t, err)
+
+		result, err := k.CombineClaimsWithApplications(pvcs)
+		require.NoError(t, err)
+		assert.Empty(t, result[0].OwningApplications)
+	})
+}
diff --git a/api/kubernetes/cli/persistent_volumes.go b/api/kubernetes/cli/persistent_volumes.go
new file mode 100644
index 0000000..0f8d9c5
--- /dev/null
+++ b/api/kubernetes/cli/persistent_volumes.go
@@ -0,0 +1,156 @@
+package cli
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/segmentio/encoding/json"
+
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+	"github.com/rs/zerolog/log"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+)
+
+// GetPersistentVolumes returns all PersistentVolumes in the cluster.
+// For non-admin users, results are filtered to PVs bound to their accessible namespaces.
+func (kcl *KubeClient) GetPersistentVolumes() ([]models.K8sPersistentVolume, error) {
+	pvList, err := kcl.cli.CoreV1().PersistentVolumes().List(context.Background(), metav1.ListOptions{})
+	if err != nil {
+		return nil, fmt.Errorf("unable to list persistent volumes. Error: %w", err)
+	}
+
+	results := make([]models.K8sPersistentVolume, 0)
+	if kcl.GetIsKubeAdmin() {
+		for i := range pvList.Items {
+			results = append(results, parsePersistentVolumeDetail(&pvList.Items[i]))
+		}
+		return results, nil
+	}
+
+	allowedNamespaces := kcl.buildNonAdminNamespacesMap()
+	for i := range pvList.Items {
+		pv := &pvList.Items[i]
+		if pv.Spec.ClaimRef != nil {
+			if _, ok := allowedNamespaces[pv.Spec.ClaimRef.Namespace]; ok {
+				results = append(results, parsePersistentVolumeDetail(pv))
+			}
+		}
+	}
+	return results, nil
+}
+
+// GetPersistentVolume returns a single PersistentVolume by name.
+// For non-admin users, access is restricted to PVs bound to their accessible namespaces.
+func (kcl *KubeClient) GetPersistentVolume(name string) (*models.K8sPersistentVolume, error) {
+	pv, err := kcl.cli.CoreV1().PersistentVolumes().Get(context.Background(), name, metav1.GetOptions{})
+	if err != nil {
+		return nil, fmt.Errorf("unable to get persistent volume %s. Error: %w", name, err)
+	}
+
+	if !kcl.GetIsKubeAdmin() {
+		allowedNamespaces := kcl.buildNonAdminNamespacesMap()
+		if pv.Spec.ClaimRef == nil {
+			return nil, fmt.Errorf("access to unbound persistent volume %s is not authorized: %w", name, ErrUnauthorized)
+		}
+		if _, ok := allowedNamespaces[pv.Spec.ClaimRef.Namespace]; !ok {
+			return nil, fmt.Errorf("access to persistent volume %s is not authorized: %w", name, ErrUnauthorized)
+		}
+	}
+
+	result := parsePersistentVolumeDetail(pv)
+	return &result, nil
+}
+
+// DeletePersistentVolumes deletes the specified PersistentVolumes by name.
+func (kcl *KubeClient) DeletePersistentVolumes(names []string) error {
+	for _, name := range names {
+		log.Debug().
+			Str("context", "DeletePersistentVolumes").
+			Str("persistent_volume", name).
+			Msg("Deleting persistent volume")
+
+		err := kcl.cli.CoreV1().PersistentVolumes().Delete(context.Background(), name, metav1.DeleteOptions{})
+		if err != nil {
+			return fmt.Errorf("unable to delete persistent volume %s. Error: %w", name, err)
+		}
+	}
+
+	return nil
+}
+
+// UpdatePersistentVolumeReclaimPolicy updates the reclaim policy on a PV.
+func (kcl *KubeClient) UpdatePersistentVolumeReclaimPolicy(name string, policy corev1.PersistentVolumeReclaimPolicy) error {
+	switch policy {
+	case corev1.PersistentVolumeReclaimRetain,
+		corev1.PersistentVolumeReclaimDelete,
+		corev1.PersistentVolumeReclaimRecycle:
+		// valid
+	default:
+		return fmt.Errorf("invalid reclaim policy %q: must be Retain, Delete, or Recycle", policy)
+	}
+
+	patch := map[string]any{
+		"spec": map[string]any{
+			"persistentVolumeReclaimPolicy": policy,
+		},
+	}
+	patchBytes, err := json.Marshal(patch)
+	if err != nil {
+		return fmt.Errorf("unable to marshal reclaim policy patch. Error: %w", err)
+	}
+
+	_, err = kcl.cli.CoreV1().PersistentVolumes().Patch(
+		context.Background(),
+		name,
+		types.MergePatchType,
+		patchBytes,
+		metav1.PatchOptions{},
+	)
+	if err != nil {
+		return fmt.Errorf("unable to update reclaim policy for persistent volume %s. Error: %w", name, err)
+	}
+
+	return nil
+}
+
+// parsePersistentVolumeDetail parses a full PV into the model with status and access modes.
+func parsePersistentVolumeDetail(pv *corev1.PersistentVolume) models.K8sPersistentVolume {
+	return models.K8sPersistentVolume{
+		Name:                          pv.Name,
+		Annotations:                   pv.Annotations,
+		Labels:                        pv.Labels,
+		AccessModes:                   humanReadableAccessModes(pv.Spec.AccessModes),
+		HumanReadableAccessModes:      pv.Spec.AccessModes,
+		Capacity:                      pv.Spec.Capacity,
+		ClaimRef:                      pv.Spec.ClaimRef,
+		StorageClassName:              pv.Spec.StorageClassName,
+		PersistentVolumeReclaimPolicy: pv.Spec.PersistentVolumeReclaimPolicy,
+		VolumeMode:                    pv.Spec.VolumeMode,
+		CSI:                           pv.Spec.CSI,
+		Status:                        pv.Status.Phase,
+		CreationDate:                  pv.CreationTimestamp.Time,
+	}
+}
+
+// humanReadableAccessModes converts Kubernetes access modes to short abbreviations.
+func humanReadableAccessModes(modes []corev1.PersistentVolumeAccessMode) []string {
+	readable := make([]string, 0, len(modes))
+	for _, mode := range modes {
+		switch mode {
+		case corev1.ReadWriteOnce:
+			readable = append(readable, "RWO")
+		case corev1.ReadOnlyMany:
+			readable = append(readable, "ROX")
+		case corev1.ReadWriteMany:
+			readable = append(readable, "RWX")
+		case corev1.ReadWriteOncePod:
+			readable = append(readable, "RWOP")
+		default:
+			readable = append(readable, string(mode))
+		}
+	}
+
+	return readable
+}
diff --git a/api/kubernetes/cli/persistent_volumes_test.go b/api/kubernetes/cli/persistent_volumes_test.go
new file mode 100644
index 0000000..49c951f
--- /dev/null
+++ b/api/kubernetes/cli/persistent_volumes_test.go
@@ -0,0 +1,166 @@
+package cli
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	kfake "k8s.io/client-go/kubernetes/fake"
+)
+
+func TestHumanReadableAccessModes(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name  string
+		input []corev1.PersistentVolumeAccessMode
+		want  []string
+	}{
+		{
+			name:  "ReadWriteOnce",
+			input: []corev1.PersistentVolumeAccessMode{corev1.ReadWriteOnce},
+			want:  []string{"RWO"},
+		},
+		{
+			name:  "ReadOnlyMany",
+			input: []corev1.PersistentVolumeAccessMode{corev1.ReadOnlyMany},
+			want:  []string{"ROX"},
+		},
+		{
+			name:  "ReadWriteMany",
+			input: []corev1.PersistentVolumeAccessMode{corev1.ReadWriteMany},
+			want:  []string{"RWX"},
+		},
+		{
+			name:  "ReadWriteOncePod",
+			input: []corev1.PersistentVolumeAccessMode{corev1.ReadWriteOncePod},
+			want:  []string{"RWOP"},
+		},
+		{
+			name:  "unknown mode passes through",
+			input: []corev1.PersistentVolumeAccessMode{"SomeUnknownMode"},
+			want:  []string{"SomeUnknownMode"},
+		},
+		{
+			name:  "empty slice returns empty slice",
+			input: []corev1.PersistentVolumeAccessMode{},
+			want:  []string{},
+		},
+		{
+			name:  "multiple modes in order",
+			input: []corev1.PersistentVolumeAccessMode{corev1.ReadWriteOnce, corev1.ReadOnlyMany, corev1.ReadWriteMany, corev1.ReadWriteOncePod},
+			want:  []string{"RWO", "ROX", "RWX", "RWOP"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			got := humanReadableAccessModes(tt.input)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
+
+func TestGetPersistentVolumes(t *testing.T) {
+	t.Parallel()
+
+	t.Run("empty cluster returns empty slice", func(t *testing.T) {
+		t.Parallel()
+		k := NewTestKubeClient(kfake.NewClientset())
+		pvs, err := k.GetPersistentVolumes()
+		require.NoError(t, err)
+		assert.Empty(t, pvs)
+	})
+
+	t.Run("returns correctly parsed PVs", func(t *testing.T) {
+		t.Parallel()
+		k := NewTestKubeClient(kfake.NewClientset())
+
+		pv := &corev1.PersistentVolume{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "pv-one",
+			},
+			Spec: corev1.PersistentVolumeSpec{
+				StorageClassName: "standard",
+				AccessModes:      []corev1.PersistentVolumeAccessMode{corev1.ReadWriteOnce},
+			},
+			Status: corev1.PersistentVolumeStatus{
+				Phase: corev1.VolumeBound,
+			},
+		}
+
+		_, err := k.cli.CoreV1().PersistentVolumes().Create(t.Context(), pv, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		pvs, err := k.GetPersistentVolumes()
+		require.NoError(t, err)
+		require.Len(t, pvs, 1)
+
+		got := pvs[0]
+		assert.Equal(t, "pv-one", got.Name)
+		assert.Equal(t, "standard", got.StorageClassName)
+		assert.Equal(t, corev1.VolumeBound, got.Status)
+		assert.Equal(t, []string{"RWO"}, got.AccessModes)
+	})
+}
+
+func TestDeletePersistentVolumes(t *testing.T) {
+	t.Parallel()
+
+	t.Run("successfully deletes specified PVs", func(t *testing.T) {
+		t.Parallel()
+		k := NewTestKubeClient(kfake.NewClientset())
+
+		for _, name := range []string{"pv-a", "pv-b", "pv-c"} {
+			pv := &corev1.PersistentVolume{
+				ObjectMeta: metav1.ObjectMeta{Name: name},
+			}
+			_, err := k.cli.CoreV1().PersistentVolumes().Create(t.Context(), pv, metav1.CreateOptions{})
+			require.NoError(t, err)
+		}
+
+		err := k.DeletePersistentVolumes([]string{"pv-a", "pv-c"})
+		require.NoError(t, err)
+
+		pvs, err := k.GetPersistentVolumes()
+		require.NoError(t, err)
+		require.Len(t, pvs, 1)
+		assert.Equal(t, "pv-b", pvs[0].Name)
+	})
+
+	t.Run("returns error for non-existent PV", func(t *testing.T) {
+		t.Parallel()
+		k := NewTestKubeClient(kfake.NewClientset())
+
+		err := k.DeletePersistentVolumes([]string{"does-not-exist"})
+		assert.Error(t, err)
+	})
+}
+
+func TestUpdatePersistentVolumeReclaimPolicy(t *testing.T) {
+	t.Parallel()
+
+	t.Run("successfully patches reclaim policy on existing PV", func(t *testing.T) {
+		t.Parallel()
+		k := NewTestKubeClient(kfake.NewClientset())
+
+		pv := &corev1.PersistentVolume{
+			ObjectMeta: metav1.ObjectMeta{Name: "pv-reclaim"},
+			Spec: corev1.PersistentVolumeSpec{
+				PersistentVolumeReclaimPolicy: corev1.PersistentVolumeReclaimDelete,
+			},
+		}
+		_, err := k.cli.CoreV1().PersistentVolumes().Create(t.Context(), pv, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		err = k.UpdatePersistentVolumeReclaimPolicy("pv-reclaim", corev1.PersistentVolumeReclaimRetain)
+		require.NoError(t, err)
+
+		updated, err := k.GetPersistentVolume("pv-reclaim")
+		require.NoError(t, err)
+		assert.Equal(t, corev1.PersistentVolumeReclaimRetain, updated.PersistentVolumeReclaimPolicy)
+	})
+}
diff --git a/api/kubernetes/cli/pod.go b/api/kubernetes/cli/pod.go
new file mode 100644
index 0000000..31aec5e
--- /dev/null
+++ b/api/kubernetes/cli/pod.go
@@ -0,0 +1,335 @@
+package cli
+
+import (
+	"context"
+	"fmt"
+	"strconv"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+
+	"github.com/pkg/errors"
+	"github.com/rs/zerolog/log"
+	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+	k8serrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func (kcl *KubeClient) GetPods(namespace string) ([]corev1.Pod, error) {
+	pods, err := kcl.cli.CoreV1().Pods(namespace).List(context.TODO(), metav1.ListOptions{})
+	if err != nil {
+		return nil, err
+	}
+
+	return pods.Items, nil
+}
+
+// DeletePod deletes a single pod. The owning controller (Deployment,
+// StatefulSet, DaemonSet, ...) is responsible for recreating it. For naked
+// pods the pod is removed permanently.
+func (kcl *KubeClient) DeletePod(namespace, name string) error {
+	return kcl.cli.CoreV1().Pods(namespace).Delete(context.TODO(), name, metav1.DeleteOptions{})
+}
+
+// RestartPod restarts all containers inside a pod in place using the
+// Kubernetes 1.35 alpha pod-restart subresource. The pod itself is preserved.
+// Requires the cluster to expose the corresponding subresource (and feature
+// gate). On clusters that don't, the API server typically returns 404 or 405
+// which is surfaced to the caller.
+func (kcl *KubeClient) RestartPod(namespace, name string) error {
+	return kcl.cli.CoreV1().RESTClient().Post().
+		Namespace(namespace).
+		Resource("pods").
+		Name(name).
+		SubResource("restart").
+		Do(context.TODO()).
+		Error()
+}
+
+// isReplicaSetOwner checks if the pod's owner reference is a ReplicaSet
+func isReplicaSetOwner(pod corev1.Pod) bool {
+	return len(pod.OwnerReferences) > 0 && pod.OwnerReferences[0].Kind == "ReplicaSet"
+}
+
+// updateOwnerReferenceToDeployment updates the pod's owner reference to the Deployment if applicable
+func updateOwnerReferenceToDeployment(pod *corev1.Pod, replicaSets []appsv1.ReplicaSet) {
+	for _, replicaSet := range replicaSets {
+		if pod.OwnerReferences[0].Name == replicaSet.Name {
+			if len(replicaSet.OwnerReferences) > 0 && replicaSet.OwnerReferences[0].Kind == "Deployment" {
+				pod.OwnerReferences[0].Kind = "Deployment"
+				pod.OwnerReferences[0].Name = replicaSet.OwnerReferences[0].Name
+			}
+			break
+		}
+	}
+}
+
+// containsStatefulSetOwnerReference checks if the pod list contains a pod with a StatefulSet owner reference
+func containsStatefulSetOwnerReference(pods *corev1.PodList) bool {
+	for _, pod := range pods.Items {
+		if len(pod.OwnerReferences) > 0 && pod.OwnerReferences[0].Kind == "StatefulSet" {
+			return true
+		}
+	}
+	return false
+}
+
+// containsDaemonSetOwnerReference checks if the pod list contains a pod with a DaemonSet owner reference
+func containsDaemonSetOwnerReference(pods *corev1.PodList) bool {
+	for _, pod := range pods.Items {
+		if len(pod.OwnerReferences) > 0 && pod.OwnerReferences[0].Kind == "DaemonSet" {
+			return true
+		}
+	}
+	return false
+}
+
+// containsReplicaSetOwnerReference checks if the pod list contains a pod with a ReplicaSet owner reference
+func containsReplicaSetOwnerReference(pods *corev1.PodList) bool {
+	for _, pod := range pods.Items {
+		if len(pod.OwnerReferences) > 0 && pod.OwnerReferences[0].Kind == "ReplicaSet" {
+			return true
+		}
+	}
+	return false
+}
+
+// CreateUserShellPod will create a kubectl based shell for the specified user by mounting their respective service account.
+// The lifecycle of the pod is managed in this function; this entails management of the following pod operations:
+// - The shell pod will be scoped to specified service accounts access permissions
+// - The shell pod will be automatically removed if it's not ready after specified period of time
+// - The shell pod will be automatically removed after a specified max life (prevent zombie pods)
+// - The shell pod will be automatically removed if request is cancelled (or client closes websocket connection)
+func (kcl *KubeClient) CreateUserShellPod(ctx context.Context, serviceAccountName, shellPodImage string) (*portainer.KubernetesShellPod, error) {
+	maxPodKeepAliveSecondsStr := strconv.Itoa(int(portainer.WebSocketKeepAlive.Seconds()))
+
+	podPrefix := userShellPodPrefix(serviceAccountName)
+
+	podSpec := &corev1.Pod{
+		ObjectMeta: metav1.ObjectMeta{
+			GenerateName: podPrefix,
+			Namespace:    portainerNamespace,
+			Annotations: map[string]string{
+				"kubernetes.io/pod.type": "kubectl-shell",
+			},
+		},
+		Spec: corev1.PodSpec{
+			TerminationGracePeriodSeconds: new(int64),
+			ServiceAccountName:            serviceAccountName,
+			Containers: []corev1.Container{
+				{
+					Name:    "kubectl-shell-container",
+					Image:   shellPodImage,
+					Command: []string{"sleep"},
+					// Specify sleep time to prevent zombie pods in case portainer process is terminated
+					Args:            []string{maxPodKeepAliveSecondsStr},
+					ImagePullPolicy: corev1.PullIfNotPresent,
+				},
+			},
+			RestartPolicy: corev1.RestartPolicyNever,
+		},
+	}
+
+	shellPod, err := kcl.cli.CoreV1().Pods(portainerNamespace).Create(context.TODO(), podSpec, metav1.CreateOptions{})
+	if err != nil {
+		return nil, errors.Wrap(err, "error creating shell pod")
+	}
+
+	// Wait for pod to reach ready state
+	timeoutCtx, cancelFunc := context.WithTimeout(ctx, 20*time.Second)
+	defer cancelFunc()
+
+	if err := kcl.waitForPodStatus(timeoutCtx, corev1.PodRunning, shellPod); err != nil {
+		innerErr := kcl.cli.CoreV1().Pods(portainerNamespace).Delete(context.TODO(), shellPod.Name, metav1.DeleteOptions{})
+		if innerErr != nil {
+			log.Warn().Err(innerErr).Msg("error deleting shell pod after failing to wait for ready status")
+		}
+
+		return nil, errors.Wrap(err, "aborting pod creation; error waiting for shell pod ready status")
+	}
+
+	var containerName string
+	if len(shellPod.Spec.Containers) > 0 {
+		containerName = shellPod.Spec.Containers[0].Name
+	}
+
+	podData := &portainer.KubernetesShellPod{
+		Namespace:        shellPod.Namespace,
+		PodName:          shellPod.Name,
+		ContainerName:    containerName,
+		ShellExecCommand: "env TERM=xterm-256color /bin/bash",
+	}
+
+	// Handle pod lifecycle/cleanup - terminate pod after maxPodKeepAlive or upon request (long-lived) cancellation
+	go func() {
+		select {
+		case <-time.After(portainer.WebSocketKeepAlive):
+			log.Debug().Msg("pod removal schedule duration exceeded")
+
+			if err := kcl.cli.CoreV1().Pods(portainerNamespace).Delete(context.TODO(), shellPod.Name, metav1.DeleteOptions{}); err != nil {
+				log.Warn().Err(err).Msg("error deleting shell pod after max keep alive duration exceeded")
+			}
+		case <-ctx.Done():
+			err := ctx.Err()
+			log.Debug().Err(err).Msg("context error")
+
+			if err := kcl.cli.CoreV1().Pods(portainerNamespace).Delete(context.TODO(), shellPod.Name, metav1.DeleteOptions{}); err != nil {
+				log.Warn().Err(err).Msg("error deleting shell pod after context cancellation")
+			}
+		}
+	}()
+
+	return podData, nil
+}
+
+// waitForPodStatus will wait until duration d (from now) for a pod to reach defined phase/status.
+// The pod status will be polled at specified delay until the pod reaches ready state.
+func (kcl *KubeClient) waitForPodStatus(ctx context.Context, phase corev1.PodPhase, pod *corev1.Pod) error {
+	log.Debug().Str("pod", pod.Name).Msg("waiting for pod ready")
+
+	for {
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		default:
+			pod, err := kcl.cli.CoreV1().Pods(pod.Namespace).Get(context.TODO(), pod.Name, metav1.GetOptions{})
+			if err != nil {
+				return err
+			}
+
+			if pod.Status.Phase == phase {
+				return nil
+			}
+
+			time.Sleep(500 * time.Millisecond)
+		}
+	}
+}
+
+// fetchAllApplicationsListResources fetches all pods, replica sets, stateful sets, and daemon sets across the cluster, i.e. all namespaces
+// this is required for the applications list view
+func (kcl *KubeClient) fetchAllApplicationsListResources(namespace string, podListOptions metav1.ListOptions) (PortainerApplicationResources, error) {
+	return kcl.fetchResourcesWithOwnerReferences(namespace, podListOptions, true, true)
+}
+
+// fetchResourcesWithOwnerReferences fetches pods and other resources based on owner references
+func (kcl *KubeClient) fetchResourcesWithOwnerReferences(namespace string, podListOptions metav1.ListOptions, includeStatefulSets, includeDaemonSets bool) (PortainerApplicationResources, error) {
+	pods, err := kcl.cli.CoreV1().Pods(namespace).List(context.Background(), podListOptions)
+	if err != nil {
+		if k8serrors.IsNotFound(err) {
+			return PortainerApplicationResources{}, nil
+		}
+		return PortainerApplicationResources{}, fmt.Errorf("unable to list pods across the cluster: %w", err)
+	}
+
+	portainerApplicationResources := PortainerApplicationResources{Pods: pods.Items}
+
+	replicaSets, err := kcl.cli.AppsV1().ReplicaSets(namespace).List(context.Background(), metav1.ListOptions{})
+	if err != nil && !k8serrors.IsNotFound(err) {
+		return PortainerApplicationResources{}, fmt.Errorf("unable to list replica sets across the cluster: %w", err)
+	}
+	portainerApplicationResources.ReplicaSets = replicaSets.Items
+
+	deployments, err := kcl.cli.AppsV1().Deployments(namespace).List(context.Background(), metav1.ListOptions{})
+	if err != nil && !k8serrors.IsNotFound(err) {
+		return PortainerApplicationResources{}, fmt.Errorf("unable to list deployments across the cluster: %w", err)
+	}
+	portainerApplicationResources.Deployments = deployments.Items
+
+	if includeStatefulSets {
+		statefulSets, err := kcl.cli.AppsV1().StatefulSets(namespace).List(context.Background(), metav1.ListOptions{})
+		if err != nil && !k8serrors.IsNotFound(err) {
+			return PortainerApplicationResources{}, fmt.Errorf("unable to list stateful sets across the cluster: %w", err)
+		}
+		portainerApplicationResources.StatefulSets = statefulSets.Items
+	}
+
+	if includeDaemonSets {
+		daemonSets, err := kcl.cli.AppsV1().DaemonSets(namespace).List(context.Background(), metav1.ListOptions{})
+		if err != nil && !k8serrors.IsNotFound(err) {
+			return PortainerApplicationResources{}, fmt.Errorf("unable to list daemon sets across the cluster: %w", err)
+		}
+		portainerApplicationResources.DaemonSets = daemonSets.Items
+	}
+
+	services, err := kcl.cli.CoreV1().Services(namespace).List(context.Background(), metav1.ListOptions{})
+	if err != nil && !k8serrors.IsNotFound(err) {
+		return PortainerApplicationResources{}, fmt.Errorf("unable to list services across the cluster: %w", err)
+	}
+	portainerApplicationResources.Services = services.Items
+
+	hpas, err := kcl.cli.AutoscalingV2().HorizontalPodAutoscalers(namespace).List(context.Background(), metav1.ListOptions{})
+	if err != nil && !k8serrors.IsNotFound(err) {
+		return PortainerApplicationResources{}, fmt.Errorf("unable to list horizontal pod autoscalers across the cluster: %w", err)
+	}
+	portainerApplicationResources.HorizontalPodAutoscalers = hpas.Items
+
+	return portainerApplicationResources, nil
+}
+
+// isPodUsingConfigMap checks if a pod is using a specific ConfigMap
+func isPodUsingConfigMap(pod *corev1.Pod, configMap models.K8sConfigMap) bool {
+	if pod.Namespace != configMap.Namespace {
+		return false
+	}
+
+	for _, volume := range pod.Spec.Volumes {
+		if volume.ConfigMap != nil && volume.ConfigMap.Name == configMap.Name {
+			return true
+		}
+	}
+
+	for _, container := range pod.Spec.Containers {
+		for _, env := range container.Env {
+			if env.ValueFrom != nil && env.ValueFrom.ConfigMapKeyRef != nil && env.ValueFrom.ConfigMapKeyRef.Name == configMap.Name {
+				return true
+			}
+		}
+	}
+
+	return false
+}
+
+// isPodUsingSecret checks if a pod is using a specific Secret
+func isPodUsingSecret(pod *corev1.Pod, secret models.K8sSecret) bool {
+	if pod.Namespace != secret.Namespace {
+		return false
+	}
+
+	for _, volume := range pod.Spec.Volumes {
+		if volume.Secret != nil && volume.Secret.SecretName == secret.Name {
+			return true
+		}
+	}
+
+	for _, container := range pod.Spec.Containers {
+		for _, env := range container.Env {
+			if env.ValueFrom != nil && env.ValueFrom.SecretKeyRef != nil && env.ValueFrom.SecretKeyRef.Name == secret.Name {
+				return true
+			}
+		}
+	}
+
+	return false
+}
+
+// getLatestJobPod returns the pods that are owned by a job
+// it returns an error if there is an error fetching the pods
+func (kcl *KubeClient) getLatestJobPod(namespace string, jobName string) (*corev1.Pod, error) {
+	pods, err := kcl.cli.CoreV1().Pods(namespace).List(context.TODO(), metav1.ListOptions{})
+	if err != nil {
+		return nil, err
+	}
+
+	for _, pod := range pods.Items {
+		for _, owner := range pod.OwnerReferences {
+			if owner.Kind == "Job" && owner.Name == jobName {
+				return &pod, nil
+			}
+		}
+	}
+
+	return nil, nil
+}
diff --git a/api/kubernetes/cli/pod_test.go b/api/kubernetes/cli/pod_test.go
new file mode 100644
index 0000000..e553fd7
--- /dev/null
+++ b/api/kubernetes/cli/pod_test.go
@@ -0,0 +1,125 @@
+package cli
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	v1 "k8s.io/api/core/v1"
+	k8serrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	kfake "k8s.io/client-go/kubernetes/fake"
+)
+
+func TestDeletePod(t *testing.T) {
+	t.Parallel()
+
+	t.Run("deletes an existing pod", func(t *testing.T) {
+		t.Parallel()
+		pod := &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "my-pod", Namespace: "default"}}
+		kcl := &KubeClient{cli: kfake.NewSimpleClientset(pod)}
+
+		err := kcl.DeletePod("default", "my-pod")
+		require.NoError(t, err)
+	})
+
+	t.Run("returns not-found error for a missing pod", func(t *testing.T) {
+		t.Parallel()
+		kcl := &KubeClient{cli: kfake.NewSimpleClientset()}
+
+		err := kcl.DeletePod("default", "nonexistent")
+		require.Error(t, err)
+		assert.True(t, k8serrors.IsNotFound(err), "expected a not-found error, got: %v", err)
+	})
+
+	t.Run("deletes only the named pod leaving others intact", func(t *testing.T) {
+		t.Parallel()
+		podA := &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "pod-a", Namespace: "default"}}
+		podB := &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "pod-b", Namespace: "default"}}
+		fakeClient := kfake.NewSimpleClientset(podA, podB)
+		kcl := &KubeClient{cli: fakeClient}
+
+		err := kcl.DeletePod("default", "pod-a")
+		require.NoError(t, err)
+
+		_, err = fakeClient.CoreV1().Pods("default").Get(t.Context(), "pod-a", metav1.GetOptions{})
+		assert.True(t, k8serrors.IsNotFound(err), "pod-a should have been deleted")
+
+		_, err = fakeClient.CoreV1().Pods("default").Get(t.Context(), "pod-b", metav1.GetOptions{})
+		require.NoError(t, err, "pod-b should still exist")
+	})
+
+	t.Run("returns not-found when pod exists in a different namespace", func(t *testing.T) {
+		t.Parallel()
+		pod := &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "my-pod", Namespace: "other"}}
+		kcl := &KubeClient{cli: kfake.NewSimpleClientset(pod)}
+
+		err := kcl.DeletePod("default", "my-pod")
+		require.Error(t, err)
+		assert.True(t, k8serrors.IsNotFound(err))
+	})
+}
+
+func Test_waitForPodStatus(t *testing.T) {
+	t.Parallel()
+
+	t.Run("successfully errors on cancelled context", func(t *testing.T) {
+		k := &KubeClient{
+			cli:        kfake.NewSimpleClientset(),
+			instanceID: "test",
+		}
+
+		podSpec := &v1.Pod{
+			ObjectMeta: metav1.ObjectMeta{Name: "test", Namespace: defaultNamespace},
+			Spec: v1.PodSpec{
+				Containers: []v1.Container{
+					{Name: "test-pod", Image: "containous/whoami"},
+				},
+			},
+		}
+
+		ctx, cancel := context.WithCancel(t.Context())
+		cancel()
+		err := k.waitForPodStatus(ctx, v1.PodRunning, podSpec)
+		if !errors.Is(err, context.Canceled) {
+			t.Errorf("waitForPodStatus should throw context cancellation error; err=%s", err)
+		}
+	})
+
+	t.Run("successfully errors on timeout", func(t *testing.T) {
+		k := &KubeClient{
+			cli:        kfake.NewSimpleClientset(),
+			instanceID: "test",
+		}
+
+		podSpec := &v1.Pod{
+			ObjectMeta: metav1.ObjectMeta{Name: "test", Namespace: defaultNamespace},
+			Spec: v1.PodSpec{
+				Containers: []v1.Container{
+					{Name: "test-pod", Image: "containous/whoami"},
+				},
+			},
+		}
+
+		pod, err := k.cli.CoreV1().Pods(defaultNamespace).Create(t.Context(), podSpec, metav1.CreateOptions{})
+		if err != nil {
+			t.Errorf("failed to create pod; err=%s", err)
+		}
+		defer func() {
+			err := k.cli.CoreV1().Pods(defaultNamespace).Delete(t.Context(), pod.Name, metav1.DeleteOptions{})
+			require.NoError(t, err)
+		}()
+
+		ctx, cancelFunc := context.WithTimeout(t.Context(), 0*time.Second)
+		defer cancelFunc()
+
+		err = k.waitForPodStatus(ctx, v1.PodRunning, podSpec)
+		if !errors.Is(err, context.DeadlineExceeded) {
+			t.Errorf("waitForPodStatus should throw deadline exceeded error; err=%s", err)
+		}
+	})
+
+}
diff --git a/api/kubernetes/cli/rbac.go b/api/kubernetes/cli/rbac.go
new file mode 100644
index 0000000..8d065f4
--- /dev/null
+++ b/api/kubernetes/cli/rbac.go
@@ -0,0 +1,201 @@
+package cli
+
+import (
+	"context"
+	"time"
+
+	"github.com/portainer/portainer/api/internal/randomstring"
+	"github.com/rs/zerolog/log"
+	authv1 "k8s.io/api/authorization/v1"
+	corev1 "k8s.io/api/core/v1"
+	rbacv1 "k8s.io/api/rbac/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	authv1types "k8s.io/client-go/kubernetes/typed/authorization/v1"
+	corev1types "k8s.io/client-go/kubernetes/typed/core/v1"
+	rbacv1types "k8s.io/client-go/kubernetes/typed/rbac/v1"
+)
+
+const maxRetries = 5
+
+// IsRBACEnabled checks if RBAC is enabled in the cluster by creating a service account, then checking it's access to a resourcequota before and after setting a cluster role and cluster role binding
+func (kcl *KubeClient) IsRBACEnabled() (bool, error) {
+	namespace := "default"
+	verb := "list"
+	resource := "resourcequotas"
+
+	saClient := kcl.cli.CoreV1().ServiceAccounts(namespace)
+	uniqueString := randomstring.RandomString(4) // Append a unique string to resource names, in case they already exist
+	saName := "portainer-rbac-test-sa-" + uniqueString
+	if err := createServiceAccount(saClient, saName, namespace); err != nil {
+		log.Error().Err(err).Msg("Error creating service account")
+
+		return false, err
+	}
+	defer deleteServiceAccount(saClient, saName)
+
+	accessReviewClient := kcl.cli.AuthorizationV1().LocalSubjectAccessReviews(namespace)
+	allowed, err := checkServiceAccountAccess(accessReviewClient, saName, verb, resource, namespace)
+	if err != nil {
+		log.Error().Err(err).Msg("Error checking service account access")
+
+		return false, err
+	}
+
+	// If the service account with no authorizations is allowed, RBAC must be disabled
+	if allowed {
+		return false, nil
+	}
+
+	// Otherwise give the service account an rbac authorisation and check again
+	roleClient := kcl.cli.RbacV1().Roles(namespace)
+	roleName := "portainer-rbac-test-role-" + uniqueString
+	if err := createRole(roleClient, roleName, verb, resource, namespace); err != nil {
+		log.Error().Err(err).Msg("Error creating role")
+
+		return false, err
+	}
+	defer deleteRole(roleClient, roleName)
+
+	roleBindingClient := kcl.cli.RbacV1().RoleBindings(namespace)
+	roleBindingName := "portainer-rbac-test-role-binding-" + uniqueString
+	if err := createRoleBinding(roleBindingClient, roleBindingName, roleName, saName, namespace); err != nil {
+		log.Error().Err(err).Msg("Error creating role binding")
+
+		return false, err
+	}
+	defer deleteRoleBinding(roleBindingClient, roleBindingName)
+
+	allowed, err = checkServiceAccountAccess(accessReviewClient, saName, verb, resource, namespace)
+	if err != nil {
+		log.Error().Err(err).Msg("Error checking service account access with authorizations added")
+
+		return false, err
+	}
+
+	// If the service account allowed to list resource quotas after given rbac role, then RBAC is enabled
+	return allowed, nil
+}
+
+func createServiceAccount(saClient corev1types.ServiceAccountInterface, name string, namespace string) error {
+	serviceAccount := &corev1.ServiceAccount{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      name,
+			Namespace: namespace,
+		},
+	}
+
+	_, err := saClient.Create(context.Background(), serviceAccount, metav1.CreateOptions{})
+
+	return err
+}
+
+func deleteServiceAccount(saClient corev1types.ServiceAccountInterface, name string) {
+	if err := saClient.Delete(context.Background(), name, metav1.DeleteOptions{}); err != nil {
+		log.Error().Err(err).Msg("Error deleting service account: " + name)
+	}
+}
+
+func createRole(roleClient rbacv1types.RoleInterface, name string, verb string, resource string, namespace string) error {
+	role := &rbacv1.Role{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      name,
+			Namespace: namespace,
+		},
+		Rules: []rbacv1.PolicyRule{
+			{
+				APIGroups: []string{""},
+				Verbs:     []string{verb},
+				Resources: []string{resource},
+			},
+		},
+	}
+
+	_, err := roleClient.Create(context.Background(), role, metav1.CreateOptions{})
+
+	return err
+}
+
+func deleteRole(roleClient rbacv1types.RoleInterface, name string) {
+	if err := roleClient.Delete(context.Background(), name, metav1.DeleteOptions{}); err != nil {
+		log.Error().Err(err).Msg("Error deleting role: " + name)
+	}
+}
+
+func createRoleBinding(roleBindingClient rbacv1types.RoleBindingInterface, clusterRoleBindingName string, roleName string, serviceAccountName string, namespace string) error {
+	clusterRoleBinding := &rbacv1.RoleBinding{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: clusterRoleBindingName,
+		},
+		Subjects: []rbacv1.Subject{
+			{
+				Kind:      "ServiceAccount",
+				Name:      serviceAccountName,
+				Namespace: namespace,
+			},
+		},
+		RoleRef: rbacv1.RoleRef{
+			Kind:     "Role",
+			Name:     roleName,
+			APIGroup: "rbac.authorization.k8s.io",
+		},
+	}
+
+	roleBinding, err := roleBindingClient.Create(context.Background(), clusterRoleBinding, metav1.CreateOptions{})
+	if err != nil {
+		log.Error().Err(err).Msg("Error creating role binding: " + clusterRoleBindingName)
+
+		return err
+	}
+
+	// Retry checkRoleBinding a maximum of 5 times with a 100ms wait after each attempt
+	for range maxRetries {
+		err = checkRoleBinding(roleBindingClient, roleBinding.Name)
+
+		time.Sleep(100 * time.Millisecond) // Wait for 100ms, even if the check passes
+
+		if err == nil {
+			break
+		}
+	}
+
+	return err
+}
+
+func checkRoleBinding(roleBindingClient rbacv1types.RoleBindingInterface, name string) error {
+	if _, err := roleBindingClient.Get(context.Background(), name, metav1.GetOptions{}); err != nil {
+		log.Error().Err(err).Msg("Error finding rolebinding: " + name)
+
+		return err
+	}
+
+	return nil
+}
+
+func deleteRoleBinding(roleBindingClient rbacv1types.RoleBindingInterface, name string) {
+	if err := roleBindingClient.Delete(context.Background(), name, metav1.DeleteOptions{}); err != nil {
+		log.Error().Err(err).Msg("Error deleting role binding: " + name)
+	}
+}
+
+func checkServiceAccountAccess(accessReviewClient authv1types.LocalSubjectAccessReviewInterface, serviceAccountName string, verb string, resource string, namespace string) (bool, error) {
+	subjectAccessReview := &authv1.LocalSubjectAccessReview{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: namespace,
+		},
+		Spec: authv1.SubjectAccessReviewSpec{
+			ResourceAttributes: &authv1.ResourceAttributes{
+				Namespace: namespace,
+				Verb:      verb,
+				Resource:  resource,
+			},
+			User: "system:serviceaccount:default:" + serviceAccountName, // a workaround to be able to use the service account as a user
+		},
+	}
+
+	result, err := accessReviewClient.Create(context.Background(), subjectAccessReview, metav1.CreateOptions{})
+	if err != nil {
+		return false, err
+	}
+
+	return result.Status.Allowed, nil
+}
diff --git a/api/kubernetes/cli/registries.go b/api/kubernetes/cli/registries.go
new file mode 100644
index 0000000..aaccaf3
--- /dev/null
+++ b/api/kubernetes/cli/registries.go
@@ -0,0 +1,104 @@
+package cli
+
+import (
+	"context"
+	"strconv"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/internal/registryutils"
+
+	"github.com/pkg/errors"
+	"github.com/segmentio/encoding/json"
+	v1 "k8s.io/api/core/v1"
+	k8serrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+const (
+	secretDockerConfigKey = ".dockerconfigjson"
+	labelRegistryType     = "io.portainer.kubernetes.registry.type"
+	annotationRegistryID  = "portainer.io/registry.id"
+)
+
+type (
+	dockerConfig struct {
+		Auths map[string]registryDockerConfig `json:"auths"`
+	}
+
+	registryDockerConfig struct {
+		Username string `json:"username"`
+		Password string `json:"password"`
+		Email    string `json:"email"`
+	}
+)
+
+func (kcl *KubeClient) DeleteRegistrySecret(registry portainer.RegistryID, namespace string) error {
+	if err := kcl.cli.CoreV1().Secrets(namespace).Delete(context.TODO(), registryutils.RegistrySecretName(registry), metav1.DeleteOptions{}); err != nil && !k8serrors.IsNotFound(err) {
+		return errors.Wrap(err, "failed removing secret")
+	}
+
+	return nil
+}
+
+func (kcl *KubeClient) CreateRegistrySecret(registry *portainer.Registry, namespace string) error {
+	username, password, err := registryutils.GetRegEffectiveCredential(registry)
+	if err != nil {
+		return err
+	}
+
+	config := dockerConfig{
+		Auths: map[string]registryDockerConfig{
+			registry.URL: {
+				Username: username,
+				Password: password,
+			},
+		},
+	}
+
+	configByte, err := json.Marshal(config)
+	if err != nil {
+		return errors.Wrap(err, "failed marshal config")
+	}
+
+	secret := &v1.Secret{
+		TypeMeta: metav1.TypeMeta{
+			APIVersion: "v1",
+			Kind:       "Secret",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Name: registryutils.RegistrySecretName(registry.ID),
+			Labels: map[string]string{
+				labelRegistryType:              strconv.Itoa(int(registry.Type)),
+				"app.kubernetes.io/managed-by": "portainer",
+			},
+			Annotations: map[string]string{
+				annotationRegistryID: strconv.Itoa(int(registry.ID)),
+			},
+		},
+		Data: map[string][]byte{
+			secretDockerConfigKey: configByte,
+		},
+		Type: v1.SecretTypeDockerConfigJson,
+	}
+
+	if _, err := kcl.cli.CoreV1().Secrets(namespace).Create(context.TODO(), secret, metav1.CreateOptions{}); err != nil && !k8serrors.IsAlreadyExists(err) {
+		return errors.Wrap(err, "failed saving secret")
+	}
+
+	return nil
+}
+
+func (cli *KubeClient) IsRegistrySecret(namespace, secretName string) (bool, error) {
+	secret, err := cli.cli.CoreV1().Secrets(namespace).Get(context.TODO(), secretName, metav1.GetOptions{})
+	if err != nil {
+		if k8serrors.IsNotFound(err) {
+			return false, nil
+		}
+
+		return false, err
+	}
+
+	isSecret := secret.Type == v1.SecretTypeDockerConfigJson
+
+	return isSecret, nil
+}
diff --git a/api/kubernetes/cli/resize.go b/api/kubernetes/cli/resize.go
new file mode 100644
index 0000000..80109e9
--- /dev/null
+++ b/api/kubernetes/cli/resize.go
@@ -0,0 +1,44 @@
+package cli
+
+import (
+	"sync"
+
+	"k8s.io/client-go/tools/remotecommand"
+)
+
+// TerminalSizeQueue implements remotecommand.TerminalSizeQueue for Kubernetes pod exec.
+// Resize events are received via Push and forwarded to the Kubernetes API server.
+type TerminalSizeQueue struct {
+	resizeChan chan *remotecommand.TerminalSize
+	done       chan struct{}
+	closeOnce  sync.Once
+}
+
+func NewTerminalSizeQueue() *TerminalSizeQueue {
+	return &TerminalSizeQueue{
+		resizeChan: make(chan *remotecommand.TerminalSize),
+		done:       make(chan struct{}),
+	}
+}
+
+// Next blocks until the next terminal resize event or the queue is closed.
+func (q *TerminalSizeQueue) Next() *remotecommand.TerminalSize {
+	return <-q.resizeChan
+}
+
+// Push queues a terminal resize.
+// Push is safe to call after Close.
+func (q *TerminalSizeQueue) Push(cols, rows uint16) {
+	select {
+	case <-q.done:
+	case q.resizeChan <- &remotecommand.TerminalSize{Width: cols, Height: rows}:
+	}
+}
+
+// Close shuts down the queue. Safe to call multiple times.
+func (q *TerminalSizeQueue) Close() {
+	q.closeOnce.Do(func() {
+		close(q.done)
+		close(q.resizeChan)
+	})
+}
diff --git a/api/kubernetes/cli/resize_test.go b/api/kubernetes/cli/resize_test.go
new file mode 100644
index 0000000..b1a97ab
--- /dev/null
+++ b/api/kubernetes/cli/resize_test.go
@@ -0,0 +1,63 @@
+package cli
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"k8s.io/client-go/tools/remotecommand"
+)
+
+func Test_TerminalSizeQueue(t *testing.T) {
+	t.Parallel()
+	t.Run("Next returns pushed size", func(t *testing.T) {
+		q := NewTerminalSizeQueue()
+		defer q.Close()
+
+		go q.Push(80, 24)
+		size := q.Next()
+		require.NotNil(t, size)
+		require.Equal(t, uint16(80), size.Width)
+		require.Equal(t, uint16(24), size.Height)
+	})
+
+	t.Run("Next returns sizes in push order", func(t *testing.T) {
+		q := NewTerminalSizeQueue()
+		defer q.Close()
+
+		go q.Push(80, 24)
+		size := q.Next()
+		require.NotNil(t, size)
+		require.Equal(t, uint16(80), size.Width)
+		require.Equal(t, uint16(24), size.Height)
+
+		go q.Push(120, 40)
+		size = q.Next()
+		require.NotNil(t, size)
+		require.Equal(t, uint16(120), size.Width)
+		require.Equal(t, uint16(40), size.Height)
+	})
+
+	t.Run("Close causes Next to return nil", func(t *testing.T) {
+		q := NewTerminalSizeQueue()
+		q.Close()
+
+		size := q.Next()
+		require.Nil(t, size)
+	})
+
+	t.Run("Next unblocks when queue is closed", func(t *testing.T) {
+		q := NewTerminalSizeQueue()
+
+		result := make(chan *remotecommand.TerminalSize, 1)
+		go func() { result <- q.Next() }()
+
+		q.Close()
+		require.Nil(t, <-result)
+	})
+
+	t.Run("Close is idempotent", func(t *testing.T) {
+		q := NewTerminalSizeQueue()
+		q.Close()
+		q.Close()
+	})
+}
diff --git a/api/kubernetes/cli/resource.go b/api/kubernetes/cli/resource.go
new file mode 100644
index 0000000..f3d69f5
--- /dev/null
+++ b/api/kubernetes/cli/resource.go
@@ -0,0 +1,27 @@
+package cli
+
+import (
+	"bytes"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/serializer/json"
+)
+
+func GenerateYAML(obj runtime.Object) (string, error) {
+	serializer := json.NewSerializerWithOptions(
+		json.DefaultMetaFactory, nil, nil,
+		json.SerializerOptions{
+			Yaml:   true,
+			Pretty: true,
+			Strict: true,
+		},
+	)
+
+	b := new(bytes.Buffer)
+	err := serializer.Encode(obj, b)
+	if err != nil {
+		return "", err
+	}
+
+	return b.String(), nil
+}
diff --git a/api/kubernetes/cli/resource_quota.go b/api/kubernetes/cli/resource_quota.go
new file mode 100644
index 0000000..5edb2b6
--- /dev/null
+++ b/api/kubernetes/cli/resource_quota.go
@@ -0,0 +1,100 @@
+package cli
+
+import (
+	"context"
+	"fmt"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/rs/zerolog/log"
+	corev1 "k8s.io/api/core/v1"
+	k8serrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// GetResourceQuotas gets all resource quotas in the current k8s environment(endpoint).
+// if the user is an admin, all resource quotas in all namespaces are fetched.
+// otherwise, namespaces the non-admin user has access to will be used to filter the resource quotas.
+func (kcl *KubeClient) GetResourceQuotas(namespace string) (*[]corev1.ResourceQuota, error) {
+	if kcl.GetIsKubeAdmin() {
+		return kcl.fetchResourceQuotas(namespace)
+	}
+
+	return kcl.fetchResourceQuotasForNonAdmin(namespace)
+}
+
+// fetchResourceQuotasForNonAdmin gets the resource quotas in the current k8s environment(endpoint) for a non-admin user.
+// the role of the user must have read access to the resource quotas in the defined namespaces.
+func (kcl *KubeClient) fetchResourceQuotasForNonAdmin(namespace string) (*[]corev1.ResourceQuota, error) {
+	nonAdminNamespaces := kcl.GetClientNonAdminNamespaces()
+
+	log.Debug().
+		Strs("non_admin_namespaces", nonAdminNamespaces).
+		Msg("fetching resource quotas for non-admin user")
+
+	if len(nonAdminNamespaces) == 0 {
+		return nil, nil
+	}
+
+	resourceQuotas, err := kcl.fetchResourceQuotas(namespace)
+	if err != nil && !k8serrors.IsNotFound(err) {
+		return nil, err
+	}
+
+	nonAdminNamespaceSet := kcl.buildNonAdminNamespacesMap()
+	results := []corev1.ResourceQuota{}
+	for _, resourceQuota := range *resourceQuotas {
+		if _, exists := nonAdminNamespaceSet[resourceQuota.Namespace]; exists {
+			results = append(results, resourceQuota)
+		}
+	}
+
+	return &results, nil
+}
+
+func (kcl *KubeClient) fetchResourceQuotas(namespace string) (*[]corev1.ResourceQuota, error) {
+	resourceQuotas, err := kcl.cli.CoreV1().ResourceQuotas(namespace).List(context.TODO(), metav1.ListOptions{})
+	if err != nil {
+		return nil, fmt.Errorf("an error occurred, failed to list resource quotas for the admin user: %w", err)
+	}
+
+	return &resourceQuotas.Items, nil
+}
+
+// GetPortainerResourceQuota gets the resource quota for the portainer namespace.
+// The resource quota is prefixed with "portainer-rq-".
+func (kcl *KubeClient) GetPortainerResourceQuota(namespace string) (*corev1.ResourceQuota, error) {
+	return kcl.cli.CoreV1().ResourceQuotas(namespace).Get(context.TODO(), "portainer-rq-"+namespace, metav1.GetOptions{})
+}
+
+// GetResourceQuota gets a resource quota in a specific namespace.
+func (kcl *KubeClient) GetResourceQuota(namespace, resourceQuota string) (*corev1.ResourceQuota, error) {
+	return kcl.cli.CoreV1().ResourceQuotas(namespace).Get(context.TODO(), resourceQuota, metav1.GetOptions{})
+}
+
+// UpdateNamespacesWithResourceQuotas updates the namespaces with the resource quotas.
+// The resource quotas are matched with the namespaces by name.
+func (kcl *KubeClient) UpdateNamespacesWithResourceQuotas(namespaces map[string]portainer.K8sNamespaceInfo, resourceQuotas []corev1.ResourceQuota) []portainer.K8sNamespaceInfo {
+	namespacesWithQuota := map[string]portainer.K8sNamespaceInfo{}
+
+	for _, namespace := range namespaces {
+		resourceQuota := kcl.GetResourceQuotaFromNamespace(namespace, resourceQuotas)
+		if resourceQuota != nil {
+			namespace.ResourceQuota = resourceQuota
+		}
+
+		namespacesWithQuota[namespace.Name] = namespace
+	}
+
+	return kcl.ConvertNamespaceMapToSlice(namespacesWithQuota)
+}
+
+// GetResourceQuotaFromNamespace gets the resource quota in a specific namespace where the resource quota's name is prefixed with "portainer-rq-".
+func (kcl *KubeClient) GetResourceQuotaFromNamespace(namespace portainer.K8sNamespaceInfo, resourceQuotas []corev1.ResourceQuota) *corev1.ResourceQuota {
+	for _, resourceQuota := range resourceQuotas {
+		if resourceQuota.Namespace == namespace.Name && resourceQuota.Name == "portainer-rq-"+namespace.Name {
+			return &resourceQuota
+		}
+	}
+
+	return nil
+}
diff --git a/api/kubernetes/cli/resource_quota_test.go b/api/kubernetes/cli/resource_quota_test.go
new file mode 100644
index 0000000..50f0292
--- /dev/null
+++ b/api/kubernetes/cli/resource_quota_test.go
@@ -0,0 +1,16 @@
+package cli
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetResourceQuotas(t *testing.T) {
+	t.Parallel()
+	kcl := &KubeClient{}
+
+	resourceQuotas, err := kcl.GetResourceQuotas("default")
+	require.NoError(t, err)
+	require.Empty(t, resourceQuotas)
+}
diff --git a/api/kubernetes/cli/resource_test.go b/api/kubernetes/cli/resource_test.go
new file mode 100644
index 0000000..c560209
--- /dev/null
+++ b/api/kubernetes/cli/resource_test.go
@@ -0,0 +1,131 @@
+package cli
+
+import (
+	"strings"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+
+	"github.com/stretchr/testify/require"
+	v1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	clientV1 "k8s.io/client-go/tools/clientcmd/api/v1"
+)
+
+// compareYAMLStrings will compare 2 strings by stripping tabs, newlines and whitespaces from both strings
+func compareYAMLStrings(in1, in2 string) int {
+	r := strings.NewReplacer("\t", "", "\n", "", " ", "")
+	in1 = r.Replace(in1)
+	in2 = r.Replace(in2)
+	return strings.Compare(in1, in2)
+}
+
+func Test_GenerateYAML(t *testing.T) {
+	t.Parallel()
+	resourceYAMLTests := []struct {
+		title    string
+		resource runtime.Object
+		wantYAML string
+	}{
+		{
+			title: "Config",
+			resource: &clientV1.Config{
+				APIVersion:     "v1",
+				Kind:           "Config",
+				CurrentContext: "portainer-ctx",
+				Contexts: []clientV1.NamedContext{
+					{
+						Name: "portainer-ctx",
+						Context: clientV1.Context{
+							AuthInfo: "test-user",
+							Cluster:  "portainer-cluster",
+						},
+					},
+				},
+				Clusters: []clientV1.NamedCluster{
+					{
+						Name: "portainer-cluster",
+						Cluster: clientV1.Cluster{
+							Server:                "localhost",
+							InsecureSkipTLSVerify: true,
+						},
+					},
+				},
+				AuthInfos: []clientV1.NamedAuthInfo{
+					{
+						Name: "test-user",
+						AuthInfo: clientV1.AuthInfo{
+							Token: "test-token",
+						},
+					},
+				},
+			},
+			wantYAML: `
+			apiVersion: v1
+			clusters:
+			- cluster:
+					insecure-skip-tls-verify: true
+					server: localhost
+				name: portainer-cluster
+			contexts:
+			- context:
+					cluster: portainer-cluster
+					user: test-user
+				name: portainer-ctx
+			current-context: portainer-ctx
+			kind: Config
+			users:
+			- name: test-user
+				user:
+					token: test-token
+			`,
+		},
+	}
+
+	for _, ryt := range resourceYAMLTests {
+		t.Run(ryt.title, func(t *testing.T) {
+			yaml, err := GenerateYAML(ryt.resource)
+			if err != nil {
+				t.Errorf("generateYamlConfig failed; err=%s", err)
+			}
+
+			if compareYAMLStrings(yaml, ryt.wantYAML) != 0 {
+				t.Errorf("generateYamlConfig failed;\ngot=\n%s\nwant=\n%s", yaml, ryt.wantYAML)
+			}
+		})
+	}
+}
+
+func TestGetResourceQuotaFromNamespace(t *testing.T) {
+	t.Parallel()
+	kcl := &KubeClient{}
+
+	namespace := portainer.K8sNamespaceInfo{Name: "my-namespace"}
+	resourceQuotas := []v1.ResourceQuota{
+		{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "portainer-rq-" + namespace.Name + "-1",
+				Namespace: namespace.Name,
+			},
+		},
+		{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "portainer-rq-" + namespace.Name,
+				Namespace: namespace.Name,
+			},
+		},
+	}
+
+	rq := kcl.GetResourceQuotaFromNamespace(namespace, resourceQuotas)
+	require.NotNil(t, rq)
+	require.Equal(t, namespace.Name, rq.Namespace)
+
+	// Empty cases
+	rq = kcl.GetResourceQuotaFromNamespace(namespace, nil)
+	require.Nil(t, rq)
+
+	namespace.Name = "another-namespace"
+	rq = kcl.GetResourceQuotaFromNamespace(namespace, resourceQuotas)
+	require.Nil(t, rq)
+}
diff --git a/api/kubernetes/cli/role.go b/api/kubernetes/cli/role.go
new file mode 100644
index 0000000..ac98388
--- /dev/null
+++ b/api/kubernetes/cli/role.go
@@ -0,0 +1,160 @@
+package cli
+
+import (
+	"context"
+	"errors"
+	"strings"
+
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+	"github.com/rs/zerolog/log"
+	rbacv1 "k8s.io/api/rbac/v1"
+	k8serrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// GetRoles gets all the roles for either at the cluster level or a given namespace in a k8s endpoint.
+// It returns a list of K8sRole objects.
+func (kcl *KubeClient) GetRoles(namespace string) ([]models.K8sRole, error) {
+	if kcl.GetIsKubeAdmin() {
+		return kcl.fetchRoles(namespace)
+	}
+
+	return kcl.fetchRolesForNonAdmin(namespace)
+}
+
+// fetchRolesForNonAdmin gets all the roles for either at the cluster level or a given namespace in a k8s endpoint.
+// the namespace will be coming from NonAdminNamespaces as non-admin users are restricted to certain namespaces.
+// it returns a list of K8sRole objects.
+func (kcl *KubeClient) fetchRolesForNonAdmin(namespace string) ([]models.K8sRole, error) {
+	roles, err := kcl.fetchRoles(namespace)
+	if err != nil {
+		return nil, err
+	}
+
+	nonAdminNamespaceSet := kcl.buildNonAdminNamespacesMap()
+	results := make([]models.K8sRole, 0)
+	for _, role := range roles {
+		if _, ok := nonAdminNamespaceSet[role.Namespace]; ok {
+			results = append(results, role)
+		}
+	}
+
+	return results, nil
+}
+
+// fetchRoles returns a list of all Roles in the specified namespace.
+func (kcl *KubeClient) fetchRoles(namespace string) ([]models.K8sRole, error) {
+	roles, err := kcl.cli.RbacV1().Roles(namespace).List(context.TODO(), metav1.ListOptions{})
+	if err != nil {
+		return nil, err
+	}
+
+	results := make([]models.K8sRole, 0)
+	for _, role := range roles.Items {
+		results = append(results, kcl.parseRole(role))
+	}
+
+	return results, nil
+}
+
+// parseRole converts a rbacv1.Role object to a models.K8sRole object.
+func (kcl *KubeClient) parseRole(role rbacv1.Role) models.K8sRole {
+	return models.K8sRole{
+		Name:         role.Name,
+		UID:          role.UID,
+		Namespace:    role.Namespace,
+		CreationDate: role.CreationTimestamp.Time,
+		IsSystem:     kcl.isSystemRole(&role),
+	}
+}
+
+func getPortainerUserDefaultPolicies() []rbacv1.PolicyRule {
+	return []rbacv1.PolicyRule{
+		{
+			Verbs:     []string{"list", "get"},
+			Resources: []string{"namespaces", "nodes", "endpoints"},
+			APIGroups: []string{""},
+		},
+		{
+			Verbs:     []string{"list"},
+			Resources: []string{"storageclasses"},
+			APIGroups: []string{"storage.k8s.io"},
+		},
+		{
+			Verbs:     []string{"list", "get"},
+			Resources: []string{"namespaces", "pods", "nodes"},
+			APIGroups: []string{"metrics.k8s.io"},
+		},
+		{
+			Verbs:     []string{"list"},
+			Resources: []string{"ingressclasses"},
+			APIGroups: []string{"networking.k8s.io"},
+		},
+	}
+}
+
+func (kcl *KubeClient) upsertPortainerK8sClusterRoles() error {
+	clusterRole := &rbacv1.ClusterRole{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: portainerUserCRName,
+		},
+		Rules: getPortainerUserDefaultPolicies(),
+	}
+
+	_, err := kcl.cli.RbacV1().ClusterRoles().Create(context.TODO(), clusterRole, metav1.CreateOptions{})
+	if err != nil {
+		if k8serrors.IsAlreadyExists(err) {
+			_, err = kcl.cli.RbacV1().ClusterRoles().Update(context.TODO(), clusterRole, metav1.UpdateOptions{})
+		}
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func getPortainerDefaultK8sRoleNames() []string {
+	return []string{
+		string(portainerUserCRName),
+	}
+}
+
+func (kcl *KubeClient) isSystemRole(role *rbacv1.Role) bool {
+	if strings.HasPrefix(role.Name, "system:") {
+		return true
+	}
+
+	return kcl.isSystemNamespace(role.Namespace)
+}
+
+// DeleteRoles processes a K8sServiceDeleteRequest by deleting each role
+// in its given namespace.
+func (kcl *KubeClient) DeleteRoles(reqs models.K8sRoleDeleteRequests) error {
+	var errs error
+	for namespace := range reqs {
+		for _, name := range reqs[namespace] {
+			client := kcl.cli.RbacV1().Roles(namespace)
+
+			role, err := client.Get(context.Background(), name, metav1.GetOptions{})
+			if err != nil {
+				if k8serrors.IsNotFound(err) {
+					continue
+				}
+
+				// This is a more serious error to do with the client so we return right away
+				return err
+			}
+
+			if kcl.isSystemRole(role) {
+				log.Error().Str("role_name", name).Msg("ignoring delete of 'system' role, not allowed")
+			}
+
+			if err := client.Delete(context.TODO(), name, metav1.DeleteOptions{}); err != nil {
+				errs = errors.Join(errs, err)
+			}
+		}
+	}
+
+	return errs
+}
diff --git a/api/kubernetes/cli/role_binding.go b/api/kubernetes/cli/role_binding.go
new file mode 100644
index 0000000..5baef7a
--- /dev/null
+++ b/api/kubernetes/cli/role_binding.go
@@ -0,0 +1,132 @@
+package cli
+
+import (
+	"context"
+	"errors"
+	"strings"
+
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+	"github.com/rs/zerolog/log"
+	rbacv1 "k8s.io/api/rbac/v1"
+	k8serrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// GetRoleBindings gets all the roleBindings for either at the cluster level or a given namespace in a k8s endpoint.
+// It returns a list of K8sRoleBinding objects.
+func (kcl *KubeClient) GetRoleBindings(namespace string) ([]models.K8sRoleBinding, error) {
+	if kcl.GetIsKubeAdmin() {
+		return kcl.fetchRoleBindings(namespace)
+	}
+
+	return kcl.fetchRolebindingsForNonAdmin(namespace)
+}
+
+// fetchRolebindingsForNonAdmin gets all the roleBindings for either at the cluster level or a given namespace in a k8s endpoint.
+// the namespace will be coming from NonAdminNamespaces as non-admin users are restricted to certain namespaces.
+// it returns a list of K8sRoleBinding objects.
+func (kcl *KubeClient) fetchRolebindingsForNonAdmin(namespace string) ([]models.K8sRoleBinding, error) {
+	roleBindings, err := kcl.fetchRoleBindings(namespace)
+	if err != nil {
+		return nil, err
+	}
+
+	nonAdminNamespaceSet := kcl.buildNonAdminNamespacesMap()
+	results := make([]models.K8sRoleBinding, 0)
+	for _, roleBinding := range roleBindings {
+		if _, ok := nonAdminNamespaceSet[roleBinding.Namespace]; ok {
+			results = append(results, roleBinding)
+		}
+	}
+
+	return results, nil
+}
+
+// fetchRoleBindings returns a list of all Roles in the specified namespace.
+func (kcl *KubeClient) fetchRoleBindings(namespace string) ([]models.K8sRoleBinding, error) {
+	roleBindings, err := kcl.cli.RbacV1().RoleBindings(namespace).List(context.TODO(), metav1.ListOptions{})
+	if err != nil {
+		return nil, err
+	}
+
+	results := make([]models.K8sRoleBinding, 0)
+	for _, roleBinding := range roleBindings.Items {
+		results = append(results, kcl.parseRoleBinding(roleBinding))
+	}
+
+	return results, nil
+}
+
+// parseRoleBinding converts a rbacv1.RoleBinding object to a models.K8sRoleBinding object.
+func (kcl *KubeClient) parseRoleBinding(roleBinding rbacv1.RoleBinding) models.K8sRoleBinding {
+	return models.K8sRoleBinding{
+		Name:         roleBinding.Name,
+		UID:          roleBinding.UID,
+		Namespace:    roleBinding.Namespace,
+		RoleRef:      roleBinding.RoleRef,
+		Subjects:     roleBinding.Subjects,
+		CreationDate: roleBinding.CreationTimestamp.Time,
+		IsSystem:     kcl.isSystemRoleBinding(&roleBinding),
+	}
+}
+
+func (kcl *KubeClient) isSystemRoleBinding(rb *rbacv1.RoleBinding) bool {
+	if strings.HasPrefix(rb.Name, "system:") {
+		return true
+	}
+
+	if rb.Labels != nil {
+		if rb.Labels["kubernetes.io/bootstrapping"] == "rbac-defaults" {
+			return true
+		}
+	}
+
+	if rb.RoleRef.Name != "" {
+		role, err := kcl.getRole(rb.Namespace, rb.RoleRef.Name)
+		if err != nil {
+			return false
+		}
+
+		// Linked to a role that is marked a system role
+		if kcl.isSystemRole(role) {
+			return true
+		}
+	}
+
+	return false
+}
+
+func (kcl *KubeClient) getRole(namespace, name string) (*rbacv1.Role, error) {
+	client := kcl.cli.RbacV1().Roles(namespace)
+	return client.Get(context.Background(), name, metav1.GetOptions{})
+}
+
+// DeleteRoleBindings processes a K8sServiceDeleteRequest by deleting each service
+// in its given namespace.
+func (kcl *KubeClient) DeleteRoleBindings(reqs models.K8sRoleBindingDeleteRequests) error {
+	var errs error
+	for namespace := range reqs {
+		for _, name := range reqs[namespace] {
+			client := kcl.cli.RbacV1().RoleBindings(namespace)
+
+			roleBinding, err := client.Get(context.Background(), name, metav1.GetOptions{})
+			if err != nil {
+				if k8serrors.IsNotFound(err) {
+					continue
+				}
+
+				// This is a more serious error to do with the client so we return right away
+				return err
+			}
+
+			if kcl.isSystemRoleBinding(roleBinding) {
+				log.Error().Str("role_name", name).Msg("ignoring delete of 'system' role binding, not allowed")
+			}
+
+			if err := client.Delete(context.Background(), name, metav1.DeleteOptions{}); err != nil {
+				errs = errors.Join(errs, err)
+			}
+		}
+	}
+	return errs
+}
diff --git a/api/kubernetes/cli/secret.go b/api/kubernetes/cli/secret.go
new file mode 100644
index 0000000..67652b3
--- /dev/null
+++ b/api/kubernetes/cli/secret.go
@@ -0,0 +1,262 @@
+package cli
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+	"github.com/rs/zerolog/log"
+	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+	k8serrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+const (
+	labelPortainerKubeConfigOwner   = "io.portainer.kubernetes.configuration.owner"
+	labelPortainerKubeConfigOwnerId = "io.portainer.kubernetes.configuration.owner.id"
+)
+
+// GetSecrets gets all the Secrets for a given namespace in a k8s endpoint.
+// if the user is an admin, all secrets in the current k8s environment(endpoint) are fetched using the getSecrets function.
+// otherwise, namespaces the non-admin user has access to will be used to filter the secrets based on the allowed namespaces.
+func (kcl *KubeClient) GetSecrets(namespace string) ([]models.K8sSecret, error) {
+	if kcl.GetIsKubeAdmin() {
+		return kcl.getSecrets(namespace)
+	}
+
+	return kcl.getSecretsForNonAdmin(namespace)
+}
+
+// getSecretsForNonAdmin fetches the secrets in the namespaces the user has access to.
+// This function is called when the user is not an admin.
+func (kcl *KubeClient) getSecretsForNonAdmin(namespace string) ([]models.K8sSecret, error) {
+	nonAdminNamespaces := kcl.GetClientNonAdminNamespaces()
+
+	log.Debug().
+		Strs("non_admin_namespaces", nonAdminNamespaces).
+		Msg("fetching secrets for non-admin user")
+
+	if len(nonAdminNamespaces) == 0 {
+		return nil, nil
+	}
+
+	secrets, err := kcl.getSecrets(namespace)
+	if err != nil {
+		return nil, err
+	}
+
+	nonAdminNamespaceSet := kcl.buildNonAdminNamespacesMap()
+	results := make([]models.K8sSecret, 0)
+	for _, secret := range secrets {
+		if _, ok := nonAdminNamespaceSet[secret.Namespace]; ok {
+			results = append(results, secret)
+		}
+	}
+
+	return results, nil
+}
+
+// getSecrets gets all the Secrets for a given namespace in a k8s endpoint.
+// the result is a list of secrets parsed into a K8sSecret struct.
+func (kcl *KubeClient) getSecrets(namespace string) ([]models.K8sSecret, error) {
+	secrets, err := kcl.cli.CoreV1().Secrets(namespace).List(context.Background(), metav1.ListOptions{})
+	if err != nil {
+		return nil, err
+	}
+
+	results := []models.K8sSecret{}
+	for _, secret := range secrets.Items {
+		results = append(results, parseSecret(&secret, false))
+	}
+
+	return results, nil
+}
+
+// GetSecret gets a Secret by name for a given namespace.
+// the result is a secret parsed into a K8sSecret struct.
+func (kcl *KubeClient) GetSecret(namespace string, secretName string) (models.K8sSecret, error) {
+	secret, err := kcl.cli.CoreV1().Secrets(namespace).Get(context.Background(), secretName, metav1.GetOptions{})
+	if err != nil {
+		return models.K8sSecret{}, err
+	}
+
+	return parseSecret(secret, true), nil
+}
+
+// parseSecret parses a k8s Secret object into a K8sSecret struct.
+// for get operation, withData will be set to true.
+// otherwise, only metadata will be parsed.
+func parseSecret(secret *corev1.Secret, withData bool) models.K8sSecret {
+	result := models.K8sSecret{
+		K8sConfiguration: models.K8sConfiguration{
+			UID:                  string(secret.UID),
+			Name:                 secret.Name,
+			Namespace:            secret.Namespace,
+			CreationDate:         secret.CreationTimestamp.Time.UTC().Format(time.RFC3339),
+			Annotations:          secret.Annotations,
+			Labels:               secret.Labels,
+			ConfigurationOwner:   secret.Labels[labelPortainerKubeConfigOwner],
+			ConfigurationOwnerId: secret.Labels[labelPortainerKubeConfigOwnerId],
+		},
+		SecretType: string(secret.Type),
+	}
+
+	if withData {
+		secretData := secret.Data
+		secretDataMap := make(map[string]string, len(secretData))
+		for key, value := range secretData {
+			secretDataMap[key] = string(value)
+		}
+
+		result.Data = secretDataMap
+	}
+
+	return result
+}
+
+// SetSecretsIsUsed combines the secrets with the applications that use them.
+// the function fetches all the pods and service accounts in the cluster and checks if the secret is used by any of them.
+// if the secret is used by a pod or service account, the secret is marked as used.
+// otherwise, the secret is returned as is.
+func (kcl *KubeClient) SetSecretsIsUsed(secrets *[]models.K8sSecret) error {
+	portainerApplicationResources, err := kcl.fetchAllApplicationsListResources("", metav1.ListOptions{})
+	if err != nil {
+		return fmt.Errorf("an error occurred during the SetSecretsIsUsed operation, unable to fetch Portainer application resources. Error: %w", err)
+	}
+
+	serviceAccounts, err := kcl.GetServiceAccounts("")
+	if err != nil {
+		return fmt.Errorf("an error occurred during the SetSecretsIsUsed operation, unable to fetch service accounts. Error: %w", err)
+	}
+
+	for i := range *secrets {
+		secret := &(*secrets)[i]
+
+		if isSecretUsedByServiceAccount(*secret, serviceAccounts) {
+			secret.IsUsed = true
+			continue
+		}
+
+		for _, pod := range portainerApplicationResources.Pods {
+			if isPodUsingSecret(&pod, *secret) {
+				secret.IsUsed = true
+				break
+			}
+		}
+	}
+
+	return nil
+}
+
+func isSecretUsedByServiceAccount(secret models.K8sSecret, serviceAccounts []models.K8sServiceAccount) bool {
+	for _, serviceAccount := range serviceAccounts {
+		if serviceAccount.Namespace != secret.Namespace {
+			continue
+		}
+
+		for _, imagePullSecret := range serviceAccount.ImagePullSecrets {
+			if imagePullSecret.Name == secret.Name {
+				return true
+			}
+		}
+	}
+
+	return false
+}
+
+// CombineSecretWithApplications combines the secret with the applications that use it.
+// the function fetches all the pods in the cluster and checks if the secret is used by any of the pods.
+// it needs to check if the pods are owned by a replica set to determine if the pod is part of a deployment.
+func (kcl *KubeClient) CombineSecretWithApplications(secret models.K8sSecret) (models.K8sSecret, error) {
+	pods, err := kcl.cli.CoreV1().Pods(secret.Namespace).List(context.Background(), metav1.ListOptions{})
+	if err != nil {
+		return models.K8sSecret{}, fmt.Errorf("an error occurred during the CombineSecretWithApplications operation, unable to get pods. Error: %w", err)
+	}
+
+	replicaSetsItems := []appsv1.ReplicaSet{}
+	if containsReplicaSetOwnerReference(pods) {
+		replicaSets, err := kcl.cli.AppsV1().ReplicaSets(secret.Namespace).List(context.Background(), metav1.ListOptions{})
+		if err != nil {
+			return models.K8sSecret{}, fmt.Errorf("an error occurred during the CombineSecretWithApplications operation, unable to get replica sets. Error: %w", err)
+		}
+		replicaSetsItems = replicaSets.Items
+	}
+
+	applicationConfigurationOwners, err := kcl.GetApplicationConfigurationOwnersFromSecret(secret, pods.Items, replicaSetsItems)
+	if err != nil {
+		return models.K8sSecret{}, fmt.Errorf("an error occurred during the CombineSecretWithApplications operation, unable to get applications from secret. Error: %w", err)
+	}
+
+	if len(applicationConfigurationOwners) > 0 {
+		secret.ConfigurationOwnerResources = applicationConfigurationOwners
+		secret.IsUsed = true
+	}
+
+	return secret, nil
+}
+
+func (kcl *KubeClient) createServiceAccountToken(serviceAccountName string) error {
+	serviceAccountSecretName := userServiceAccountTokenSecretName(serviceAccountName, kcl.instanceID)
+
+	serviceAccountSecret := &corev1.Secret{
+		TypeMeta: metav1.TypeMeta{},
+		ObjectMeta: metav1.ObjectMeta{
+			Name: serviceAccountSecretName,
+			Annotations: map[string]string{
+				"kubernetes.io/service-account.name": serviceAccountName,
+			},
+		},
+		Type: "kubernetes.io/service-account-token",
+	}
+
+	_, err := kcl.cli.CoreV1().Secrets(portainerNamespace).Create(context.TODO(), serviceAccountSecret, metav1.CreateOptions{})
+	if err != nil && !k8serrors.IsAlreadyExists(err) {
+		return err
+	}
+
+	return nil
+}
+
+func (kcl *KubeClient) getServiceAccountToken(serviceAccountName string) (string, error) {
+	serviceAccountSecretName := userServiceAccountTokenSecretName(serviceAccountName, kcl.instanceID)
+
+	secret, err := kcl.cli.CoreV1().Secrets(portainerNamespace).Get(context.TODO(), serviceAccountSecretName, metav1.GetOptions{})
+	if err != nil {
+		return "", err
+	}
+
+	// API token secret is populated asynchronously.
+	// Is it created by the controller and will depend on the environment(endpoint)/secret-store:
+	// https://github.com/kubernetes/kubernetes/issues/67882#issuecomment-422026204
+	// as a work-around, we wait for up to 5 seconds for the secret to be populated.
+	timeout := time.After(5 * time.Second)
+	searchingForSecret := true
+	for searchingForSecret {
+		select {
+		case <-timeout:
+			return "", errors.New("unable to find secret token associated to user service account (timeout)")
+		default:
+			secret, err = kcl.cli.CoreV1().Secrets(portainerNamespace).Get(context.TODO(), serviceAccountSecretName, metav1.GetOptions{})
+			if err != nil {
+				return "", err
+			}
+
+			if len(secret.Data) > 0 {
+				searchingForSecret = false
+				break
+			}
+
+			time.Sleep(1 * time.Second)
+		}
+	}
+
+	secretTokenData, ok := secret.Data["token"]
+	if ok {
+		return string(secretTokenData), nil
+	}
+
+	return "", errors.New("unable to find secret token associated to user service account")
+}
diff --git a/api/kubernetes/cli/secret_test.go b/api/kubernetes/cli/secret_test.go
new file mode 100644
index 0000000..4dcffff
--- /dev/null
+++ b/api/kubernetes/cli/secret_test.go
@@ -0,0 +1,152 @@
+package cli
+
+import (
+	"testing"
+
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	kfake "k8s.io/client-go/kubernetes/fake"
+)
+
+func Test_SetSecretsIsUsed_ServiceAccountImagePullSecret(t *testing.T) {
+	t.Parallel()
+
+	k := NewTestKubeClient(kfake.NewClientset())
+	secret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "registry-secret",
+			Namespace: "default",
+		},
+		Type: corev1.SecretTypeDockerConfigJson,
+	}
+
+	_, err := k.cli.CoreV1().Secrets("default").Create(t.Context(), secret, metav1.CreateOptions{})
+	require.NoError(t, err)
+
+	serviceAccount := &corev1.ServiceAccount{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "app-sa",
+			Namespace: "default",
+		},
+		ImagePullSecrets: []corev1.LocalObjectReference{
+			{Name: "registry-secret"},
+		},
+	}
+	_, err = k.cli.CoreV1().ServiceAccounts("default").Create(t.Context(), serviceAccount, metav1.CreateOptions{})
+	require.NoError(t, err)
+
+	secrets := []models.K8sSecret{parseSecret(secret, false)}
+
+	err = k.SetSecretsIsUsed(&secrets)
+
+	require.NoError(t, err)
+	assert.True(t, secrets[0].IsUsed)
+}
+
+func Test_SetSecretsIsUsed_NotReferencedByAnySA(t *testing.T) {
+	t.Parallel()
+
+	k := NewTestKubeClient(kfake.NewClientset())
+	secret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "unused-secret",
+			Namespace: "default",
+		},
+		Type: corev1.SecretTypeDockerConfigJson,
+	}
+	_, err := k.cli.CoreV1().Secrets("default").Create(t.Context(), secret, metav1.CreateOptions{})
+	require.NoError(t, err)
+
+	serviceAccount := &corev1.ServiceAccount{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "app-sa",
+			Namespace: "default",
+		},
+		ImagePullSecrets: []corev1.LocalObjectReference{
+			{Name: "other-secret"},
+		},
+	}
+	_, err = k.cli.CoreV1().ServiceAccounts("default").Create(t.Context(), serviceAccount, metav1.CreateOptions{})
+	require.NoError(t, err)
+
+	secrets := []models.K8sSecret{parseSecret(secret, false)}
+
+	err = k.SetSecretsIsUsed(&secrets)
+
+	require.NoError(t, err)
+	assert.False(t, secrets[0].IsUsed)
+}
+
+func Test_SetSecretsIsUsed_SAInDifferentNamespace(t *testing.T) {
+	t.Parallel()
+
+	k := NewTestKubeClient(kfake.NewClientset())
+	// Create a secret named "registry-secret" in the default namespace
+	secret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "registry-secret",
+			Namespace: "default",
+		},
+		Type: corev1.SecretTypeDockerConfigJson,
+	}
+	_, err := k.cli.CoreV1().Secrets("default").Create(t.Context(), secret, metav1.CreateOptions{})
+	require.NoError(t, err)
+
+	// Create a service account in a different namespace that references a secret with the same name.
+	// In Kubernetes, secrets are namespace-scoped, so this SA references a different secret
+	// (one that doesn't exist in "other-namespace"), not the one we created in "default".
+	serviceAccount := &corev1.ServiceAccount{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "app-sa",
+			Namespace: "other-namespace",
+		},
+		ImagePullSecrets: []corev1.LocalObjectReference{
+			{Name: "registry-secret"},
+		},
+	}
+	_, err = k.cli.CoreV1().ServiceAccounts("other-namespace").Create(t.Context(), serviceAccount, metav1.CreateOptions{})
+	require.NoError(t, err)
+
+	secrets := []models.K8sSecret{parseSecret(secret, false)}
+
+	err = k.SetSecretsIsUsed(&secrets)
+
+	// The secret in the default namespace should not be marked as used,
+	// since the SA reference is to a secret in a different namespace.
+	require.NoError(t, err)
+	assert.False(t, secrets[0].IsUsed)
+}
+
+func Test_SetSecretsIsUsed_SAWithEmptyImagePullSecrets(t *testing.T) {
+	t.Parallel()
+
+	k := NewTestKubeClient(kfake.NewClientset())
+	secret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "registry-secret",
+			Namespace: "default",
+		},
+		Type: corev1.SecretTypeDockerConfigJson,
+	}
+	_, err := k.cli.CoreV1().Secrets("default").Create(t.Context(), secret, metav1.CreateOptions{})
+	require.NoError(t, err)
+
+	serviceAccount := &corev1.ServiceAccount{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "app-sa",
+			Namespace: "default",
+		},
+	}
+	_, err = k.cli.CoreV1().ServiceAccounts("default").Create(t.Context(), serviceAccount, metav1.CreateOptions{})
+	require.NoError(t, err)
+
+	secrets := []models.K8sSecret{parseSecret(secret, false)}
+
+	err = k.SetSecretsIsUsed(&secrets)
+
+	require.NoError(t, err)
+	assert.False(t, secrets[0].IsUsed)
+}
diff --git a/api/kubernetes/cli/server_version.go b/api/kubernetes/cli/server_version.go
new file mode 100644
index 0000000..b529c22
--- /dev/null
+++ b/api/kubernetes/cli/server_version.go
@@ -0,0 +1,7 @@
+package cli
+
+import "k8s.io/apimachinery/pkg/version"
+
+func (kcl *KubeClient) ServerVersion() (*version.Info, error) {
+	return kcl.cli.Discovery().ServerVersion()
+}
diff --git a/api/kubernetes/cli/service.go b/api/kubernetes/cli/service.go
new file mode 100644
index 0000000..ce48ec0
--- /dev/null
+++ b/api/kubernetes/cli/service.go
@@ -0,0 +1,227 @@
+package cli
+
+import (
+	"context"
+	"fmt"
+
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+	"github.com/rs/zerolog/log"
+
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/intstr"
+)
+
+// GetServices gets all the services for either at the cluster level or a given namespace in a k8s endpoint.
+// It returns a list of K8sServiceInfo objects.
+func (kcl *KubeClient) GetServices(namespace string) ([]models.K8sServiceInfo, error) {
+	if kcl.GetIsKubeAdmin() {
+		return kcl.fetchServices(namespace)
+	}
+
+	return kcl.fetchServicesForNonAdmin(namespace)
+}
+
+// fetchServicesForNonAdmin gets all the services for either at the cluster level or a given namespace in a k8s endpoint.
+// the namespace will be coming from NonAdminNamespaces as non-admin users are restricted to certain namespaces.
+// it returns a list of K8sServiceInfo objects.
+func (kcl *KubeClient) fetchServicesForNonAdmin(namespace string) ([]models.K8sServiceInfo, error) {
+	nonAdminNamespaces := kcl.GetClientNonAdminNamespaces()
+
+	log.Debug().
+		Strs("non_admin_namespaces", nonAdminNamespaces).
+		Msg("fetching services for non-admin user")
+
+	if len(nonAdminNamespaces) == 0 {
+		return nil, nil
+	}
+
+	services, err := kcl.fetchServices(namespace)
+	if err != nil {
+		return nil, err
+	}
+
+	nonAdminNamespaceSet := kcl.buildNonAdminNamespacesMap()
+	results := make([]models.K8sServiceInfo, 0)
+	for _, service := range services {
+		if _, ok := nonAdminNamespaceSet[service.Namespace]; ok {
+			results = append(results, service)
+		}
+	}
+
+	return results, nil
+}
+
+// fetchServices gets the services in a given namespace in a k8s endpoint.
+// It returns a list of K8sServiceInfo objects.
+func (kcl *KubeClient) fetchServices(namespace string) ([]models.K8sServiceInfo, error) {
+	services, err := kcl.cli.CoreV1().Services(namespace).List(context.TODO(), metav1.ListOptions{})
+	if err != nil {
+		return nil, err
+	}
+
+	results := make([]models.K8sServiceInfo, 0)
+	for _, service := range services.Items {
+		results = append(results, parseService(service))
+	}
+
+	return results, nil
+}
+
+// parseService converts a k8s native service object to a Portainer K8sServiceInfo object.
+// service ports, ingress status, labels, annotations, cluster IPs, and external IPs are parsed.
+// it returns a K8sServiceInfo object.
+func parseService(service corev1.Service) models.K8sServiceInfo {
+	servicePorts := make([]models.K8sServicePort, 0)
+	for _, port := range service.Spec.Ports {
+		servicePorts = append(servicePorts, models.K8sServicePort{
+			Name:       port.Name,
+			NodePort:   int(port.NodePort),
+			Port:       int(port.Port),
+			Protocol:   string(port.Protocol),
+			TargetPort: port.TargetPort.String(),
+		})
+	}
+
+	ingressStatus := make([]models.K8sServiceIngress, 0)
+	for _, status := range service.Status.LoadBalancer.Ingress {
+		ingressStatus = append(ingressStatus, models.K8sServiceIngress{
+			IP:       status.IP,
+			Hostname: status.Hostname,
+		})
+	}
+
+	return models.K8sServiceInfo{
+		Name:                          service.Name,
+		UID:                           string(service.GetUID()),
+		Type:                          string(service.Spec.Type),
+		Namespace:                     service.Namespace,
+		CreationDate:                  service.GetCreationTimestamp().String(),
+		AllocateLoadBalancerNodePorts: service.Spec.AllocateLoadBalancerNodePorts,
+		Ports:                         servicePorts,
+		IngressStatus:                 ingressStatus,
+		Labels:                        service.GetLabels(),
+		Annotations:                   service.GetAnnotations(),
+		ClusterIPs:                    service.Spec.ClusterIPs,
+		ExternalName:                  service.Spec.ExternalName,
+		ExternalIPs:                   service.Spec.ExternalIPs,
+		Selector:                      service.Spec.Selector,
+	}
+}
+
+// convertToK8sService converts a K8sServiceInfo object back to a k8s native service object.
+// this is required for create and update operations.
+// it returns a v1.Service object.
+func (kcl *KubeClient) convertToK8sService(info models.K8sServiceInfo) corev1.Service {
+	service := corev1.Service{}
+	service.Name = info.Name
+	service.Spec.Type = corev1.ServiceType(info.Type)
+	service.Namespace = info.Namespace
+	service.Annotations = info.Annotations
+	service.Labels = info.Labels
+	service.Spec.AllocateLoadBalancerNodePorts = info.AllocateLoadBalancerNodePorts
+	service.Spec.Selector = info.Selector
+
+	for _, p := range info.Ports {
+		port := corev1.ServicePort{}
+		port.Name = p.Name
+		port.NodePort = int32(p.NodePort)
+		port.Port = int32(p.Port)
+		port.Protocol = corev1.Protocol(p.Protocol)
+		port.TargetPort = intstr.FromString(p.TargetPort)
+		service.Spec.Ports = append(service.Spec.Ports, port)
+	}
+
+	for _, i := range info.IngressStatus {
+		service.Status.LoadBalancer.Ingress = append(
+			service.Status.LoadBalancer.Ingress,
+			corev1.LoadBalancerIngress{IP: i.IP, Hostname: i.Hostname},
+		)
+	}
+
+	return service
+}
+
+// CreateService creates a new service in a given namespace in a k8s endpoint.
+func (kcl *KubeClient) CreateService(namespace string, info models.K8sServiceInfo) error {
+	service := kcl.convertToK8sService(info)
+	_, err := kcl.cli.CoreV1().Services(namespace).Create(context.Background(), &service, metav1.CreateOptions{})
+	return err
+}
+
+// DeleteServices processes a K8sServiceDeleteRequest by deleting each service
+// in its given namespace.
+func (kcl *KubeClient) DeleteServices(reqs models.K8sServiceDeleteRequests) error {
+	for namespace := range reqs {
+		for _, service := range reqs[namespace] {
+			err := kcl.cli.CoreV1().Services(namespace).Delete(context.Background(), service, metav1.DeleteOptions{})
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
+
+// UpdateService updates service in a given namespace in a k8s endpoint.
+func (kcl *KubeClient) UpdateService(namespace string, info models.K8sServiceInfo) error {
+	service := kcl.convertToK8sService(info)
+	_, err := kcl.cli.CoreV1().Services(namespace).Update(context.Background(), &service, metav1.UpdateOptions{})
+	return err
+}
+
+// CombineServicesWithApplications retrieves applications based on service selectors in a given namespace
+// for all services, it lists pods based on the service selector and converts the pod to an application
+// if replicasets are found, it updates the owner reference to deployment
+// it then combines the service with the application
+// finally, it returns a list of K8sServiceInfo objects
+func (kcl *KubeClient) CombineServicesWithApplications(services []models.K8sServiceInfo) ([]models.K8sServiceInfo, error) {
+	if containsServiceWithSelector(services) {
+		updatedServices := make([]models.K8sServiceInfo, len(services))
+		portainerApplicationResources, err := kcl.fetchAllApplicationsListResources("", metav1.ListOptions{})
+		if err != nil {
+			return nil, fmt.Errorf("an error occurred during the CombineServicesWithApplications operation, unable to fetch pods and replica sets. Error: %w", err)
+		}
+
+		for index, service := range services {
+			updatedService := service
+
+			application, err := kcl.GetApplicationFromServiceSelector(portainerApplicationResources.Pods, service, portainerApplicationResources.ReplicaSets)
+			if err != nil {
+				return services, fmt.Errorf("an error occurred during the CombineServicesWithApplications operation, unable to get application from service. Error: %w", err)
+			}
+
+			if application != nil {
+				updatedService.Applications = append(updatedService.Applications, *application)
+			}
+
+			updatedServices[index] = updatedService
+		}
+
+		return updatedServices, nil
+	}
+
+	return services, nil
+}
+
+// containsServiceWithSelector checks if a list of services contains a service with a selector
+// it returns true if any service has a selector, otherwise false
+func containsServiceWithSelector(services []models.K8sServiceInfo) bool {
+	for _, service := range services {
+		if len(service.Selector) > 0 {
+			return true
+		}
+	}
+	return false
+}
+
+// buildServicesMap builds a map of service names from a list of K8sServiceInfo objects
+// it returns a map of service names for lookups
+func (kcl *KubeClient) buildServicesMap(services []models.K8sServiceInfo) map[string]struct{} {
+	serviceMap := make(map[string]struct{})
+	for _, service := range services {
+		serviceMap[service.Name] = struct{}{}
+	}
+	return serviceMap
+}
diff --git a/api/kubernetes/cli/service_account.go b/api/kubernetes/cli/service_account.go
new file mode 100644
index 0000000..a1558d3
--- /dev/null
+++ b/api/kubernetes/cli/service_account.go
@@ -0,0 +1,372 @@
+package cli
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	portainer "github.com/portainer/portainer/api"
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+	corev1 "k8s.io/api/core/v1"
+	rbacv1 "k8s.io/api/rbac/v1"
+	k8serrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// GetServiceAccounts gets all the service accounts for either at the cluster level or a given namespace in a k8s endpoint.
+// It returns a list of K8sServiceAccount objects.
+func (kcl *KubeClient) GetServiceAccounts(namespace string) ([]models.K8sServiceAccount, error) {
+	if kcl.GetIsKubeAdmin() {
+		return kcl.fetchServiceAccounts(namespace)
+	}
+
+	return kcl.fetchServiceAccountsForNonAdmin(namespace)
+}
+
+// fetchServiceAccountsForNonAdmin gets all the service accounts for either at the cluster level or a given namespace in a k8s endpoint.
+// the namespace will be coming from NonAdminNamespaces as non-admin users are restricted to certain namespaces.
+// it returns a list of K8sServiceAccount objects.
+func (kcl *KubeClient) fetchServiceAccountsForNonAdmin(namespace string) ([]models.K8sServiceAccount, error) {
+	serviceAccounts, err := kcl.fetchServiceAccounts(namespace)
+	if err != nil {
+		return nil, err
+	}
+
+	nonAdminNamespaceSet := kcl.buildNonAdminNamespacesMap()
+	results := make([]models.K8sServiceAccount, 0)
+	for _, serviceAccount := range serviceAccounts {
+		if _, ok := nonAdminNamespaceSet[serviceAccount.Namespace]; ok {
+			results = append(results, serviceAccount)
+		}
+	}
+
+	return results, nil
+}
+
+// fetchServiceAccounts returns a list of all ServiceAccounts in the specified namespace.
+func (kcl *KubeClient) fetchServiceAccounts(namespace string) ([]models.K8sServiceAccount, error) {
+	serviceAccounts, err := kcl.cli.CoreV1().ServiceAccounts(namespace).List(context.TODO(), metav1.ListOptions{})
+	if err != nil {
+		return nil, err
+	}
+
+	results := make([]models.K8sServiceAccount, 0)
+	for _, serviceAccount := range serviceAccounts.Items {
+		results = append(results, kcl.parseServiceAccount(serviceAccount))
+	}
+
+	return results, nil
+}
+
+// parseServiceAccount converts a corev1.ServiceAccount object to a models.K8sServiceAccount object.
+func (kcl *KubeClient) parseServiceAccount(serviceAccount corev1.ServiceAccount) models.K8sServiceAccount {
+	return models.K8sServiceAccount{
+		Name:             serviceAccount.Name,
+		UID:              serviceAccount.UID,
+		Namespace:        serviceAccount.Namespace,
+		CreationDate:     serviceAccount.CreationTimestamp.Time,
+		IsSystem:         kcl.isSystemServiceAccount(serviceAccount.Namespace),
+		ImagePullSecrets: serviceAccount.ImagePullSecrets,
+	}
+}
+
+// GetServiceAccount returns the details of a single service account in the given namespace.
+func (kcl *KubeClient) GetServiceAccount(namespace, name string) (models.K8sServiceAccount, error) {
+	sa, err := kcl.cli.CoreV1().ServiceAccounts(namespace).Get(context.TODO(), name, metav1.GetOptions{})
+	if err != nil {
+		return models.K8sServiceAccount{}, err
+	}
+
+	return models.K8sServiceAccount{
+		Name:                         sa.Name,
+		UID:                          sa.UID,
+		Namespace:                    sa.Namespace,
+		CreationDate:                 sa.CreationTimestamp.Time,
+		IsSystem:                     kcl.isSystemServiceAccount(sa.Namespace),
+		AutomountServiceAccountToken: sa.AutomountServiceAccountToken,
+		ImagePullSecrets:             sa.ImagePullSecrets,
+		Labels:                       sa.Labels,
+		Annotations:                  sa.Annotations,
+	}, nil
+}
+
+// GetPortainerUserServiceAccount returns the portainer ServiceAccountName associated to the specified user.
+func (kcl *KubeClient) GetPortainerUserServiceAccount(tokenData *portainer.TokenData) (*corev1.ServiceAccount, error) {
+	portainerUserServiceAccountName := UserServiceAccountName(int(tokenData.ID), kcl.instanceID)
+	if tokenData.Role == portainer.AdministratorRole {
+		portainerUserServiceAccountName = portainerClusterAdminServiceAccountName
+	}
+
+	// verify name exists as service account resource within portainer namespace
+	serviceAccount, err := kcl.cli.CoreV1().ServiceAccounts(portainerNamespace).Get(context.TODO(), portainerUserServiceAccountName, metav1.GetOptions{})
+	if err != nil {
+		return nil, err
+	}
+
+	return serviceAccount, nil
+}
+
+func (kcl *KubeClient) isSystemServiceAccount(namespace string) bool {
+	return kcl.isSystemNamespace(namespace)
+}
+
+// DeleteServices processes a K8sServiceDeleteRequest by deleting each service
+// in its given namespace.
+func (kcl *KubeClient) DeleteServiceAccounts(reqs models.K8sServiceAccountDeleteRequests) error {
+	var errs error
+	for namespace := range reqs {
+		for _, serviceName := range reqs[namespace] {
+			client := kcl.cli.CoreV1().ServiceAccounts(namespace)
+
+			sa, err := client.Get(context.Background(), serviceName, metav1.GetOptions{})
+			if err != nil {
+				if k8serrors.IsNotFound(err) {
+					continue
+				}
+
+				return err
+			}
+
+			if kcl.isSystemServiceAccount(sa.Namespace) {
+				return fmt.Errorf("cannot delete system service account %q", namespace+"/"+serviceName)
+			}
+
+			if err := client.Delete(context.Background(), serviceName, metav1.DeleteOptions{}); err != nil {
+				errs = errors.Join(errs, err)
+			}
+		}
+	}
+
+	return errs
+}
+
+// GetServiceAccountBearerToken returns the ServiceAccountToken associated to the specified user.
+func (kcl *KubeClient) GetServiceAccountBearerToken(userID int) (string, error) {
+	serviceAccountName := UserServiceAccountName(userID, kcl.instanceID)
+
+	return kcl.getServiceAccountToken(serviceAccountName)
+}
+
+// SetupUserServiceAccount will make sure that all the required resources are created inside the Kubernetes
+// cluster before creating a ServiceAccount and a ServiceAccountToken for the specified Portainer user.
+// It will also create required default RoleBinding and ClusterRoleBinding rules.
+func (kcl *KubeClient) SetupUserServiceAccount(userID int, teamIDs []int, restrictDefaultNamespace bool) error {
+	serviceAccountName := UserServiceAccountName(userID, kcl.instanceID)
+
+	err := kcl.ensureRequiredResourcesExist()
+	if err != nil {
+		return err
+	}
+
+	err = kcl.createUserServiceAccount(portainerNamespace, serviceAccountName)
+	if err != nil {
+		return err
+	}
+
+	err = kcl.createServiceAccountToken(serviceAccountName)
+	if err != nil {
+		return err
+	}
+
+	err = kcl.ensureServiceAccountHasPortainerUserClusterRole(serviceAccountName)
+	if err != nil {
+		return err
+	}
+
+	return kcl.setupNamespaceAccesses(userID, teamIDs, serviceAccountName, restrictDefaultNamespace)
+}
+
+func (kcl *KubeClient) ensureRequiredResourcesExist() error {
+	return kcl.upsertPortainerK8sClusterRoles()
+}
+
+func (kcl *KubeClient) createUserServiceAccount(namespace, serviceAccountName string) error {
+	serviceAccount := &corev1.ServiceAccount{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: serviceAccountName,
+		},
+	}
+
+	_, err := kcl.cli.CoreV1().ServiceAccounts(namespace).Create(context.TODO(), serviceAccount, metav1.CreateOptions{})
+	if err != nil && !k8serrors.IsAlreadyExists(err) {
+		return err
+	}
+
+	return nil
+}
+
+func (kcl *KubeClient) ensureServiceAccountHasPortainerUserClusterRole(serviceAccountName string) error {
+	clusterRoleBinding, err := kcl.cli.RbacV1().ClusterRoleBindings().Get(context.TODO(), portainerUserCRBName, metav1.GetOptions{})
+	if k8serrors.IsNotFound(err) {
+		clusterRoleBinding = &rbacv1.ClusterRoleBinding{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: portainerUserCRBName,
+			},
+			Subjects: []rbacv1.Subject{
+				{
+					Kind:      "ServiceAccount",
+					Name:      serviceAccountName,
+					Namespace: portainerNamespace,
+				},
+			},
+			RoleRef: rbacv1.RoleRef{
+				Kind: "ClusterRole",
+				Name: portainerUserCRName,
+			},
+		}
+
+		_, err := kcl.cli.RbacV1().ClusterRoleBindings().Create(context.TODO(), clusterRoleBinding, metav1.CreateOptions{})
+		return err
+	} else if err != nil {
+		return err
+	}
+
+	for _, subject := range clusterRoleBinding.Subjects {
+		if subject.Name == serviceAccountName {
+			return nil
+		}
+	}
+
+	clusterRoleBinding.Subjects = append(clusterRoleBinding.Subjects, rbacv1.Subject{
+		Kind:      "ServiceAccount",
+		Name:      serviceAccountName,
+		Namespace: portainerNamespace,
+	})
+
+	_, err = kcl.cli.RbacV1().ClusterRoleBindings().Update(context.TODO(), clusterRoleBinding, metav1.UpdateOptions{})
+	return err
+}
+
+func (kcl *KubeClient) removeNamespaceAccessForServiceAccount(serviceAccountName, namespace string) error {
+	roleBindingName := namespaceClusterRoleBindingName(namespace, kcl.instanceID)
+
+	roleBinding, err := kcl.cli.RbacV1().RoleBindings(namespace).Get(context.TODO(), roleBindingName, metav1.GetOptions{})
+	if k8serrors.IsNotFound(err) {
+		return nil
+	} else if err != nil {
+		return err
+	}
+
+	updatedSubjects := roleBinding.Subjects[:0]
+
+	for _, subject := range roleBinding.Subjects {
+		if subject.Name != serviceAccountName {
+			updatedSubjects = append(updatedSubjects, subject)
+		}
+	}
+
+	roleBinding.Subjects = updatedSubjects
+
+	_, err = kcl.cli.RbacV1().RoleBindings(namespace).Update(context.TODO(), roleBinding, metav1.UpdateOptions{})
+	return err
+}
+
+func (kcl *KubeClient) AddImagePullSecretToServiceAccount(namespace, serviceAccountName, secretName string) error {
+	sa, err := kcl.cli.CoreV1().ServiceAccounts(namespace).Get(context.TODO(), serviceAccountName, metav1.GetOptions{})
+	if err != nil {
+		return err
+	}
+
+	for _, ref := range sa.ImagePullSecrets {
+		if ref.Name == secretName {
+			return nil
+		}
+	}
+
+	sa.ImagePullSecrets = append(sa.ImagePullSecrets, corev1.LocalObjectReference{Name: secretName})
+
+	_, err = kcl.cli.CoreV1().ServiceAccounts(namespace).Update(context.TODO(), sa, metav1.UpdateOptions{})
+	return err
+}
+
+func (kcl *KubeClient) RemoveImagePullSecretFromServiceAccount(namespace, serviceAccountName, secretName string) error {
+	sa, err := kcl.cli.CoreV1().ServiceAccounts(namespace).Get(context.TODO(), serviceAccountName, metav1.GetOptions{})
+	if err != nil {
+		if k8serrors.IsNotFound(err) {
+			return nil
+		}
+		return err
+	}
+
+	updated := sa.ImagePullSecrets[:0]
+	changed := false
+	for _, ref := range sa.ImagePullSecrets {
+		if ref.Name == secretName {
+			changed = true
+			continue
+		}
+		updated = append(updated, ref)
+	}
+
+	if !changed {
+		return nil
+	}
+
+	sa.ImagePullSecrets = updated
+
+	_, err = kcl.cli.CoreV1().ServiceAccounts(namespace).Update(context.TODO(), sa, metav1.UpdateOptions{})
+	return err
+}
+
+func (kcl *KubeClient) UpdateServiceAccountImagePullSecrets(namespace, name string, secretNames []string) error {
+	sa, err := kcl.cli.CoreV1().ServiceAccounts(namespace).Get(context.TODO(), name, metav1.GetOptions{})
+	if err != nil {
+		return fmt.Errorf("failed to get service account %q: %w", name, err)
+	}
+
+	refs := make([]corev1.LocalObjectReference, 0, len(secretNames))
+	for _, s := range secretNames {
+		refs = append(refs, corev1.LocalObjectReference{Name: s})
+	}
+	sa.ImagePullSecrets = refs
+
+	_, err = kcl.cli.CoreV1().ServiceAccounts(namespace).Update(context.TODO(), sa, metav1.UpdateOptions{})
+	if err != nil {
+		return fmt.Errorf("failed to update service account %q: %w", name, err)
+	}
+	return nil
+}
+
+func (kcl *KubeClient) ensureNamespaceAccessForServiceAccount(serviceAccountName, namespace string) error {
+	roleBindingName := namespaceClusterRoleBindingName(namespace, kcl.instanceID)
+
+	roleBinding, err := kcl.cli.RbacV1().RoleBindings(namespace).Get(context.TODO(), roleBindingName, metav1.GetOptions{})
+	if k8serrors.IsNotFound(err) {
+		roleBinding = &rbacv1.RoleBinding{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: roleBindingName,
+			},
+			Subjects: []rbacv1.Subject{
+				{
+					Kind:      "ServiceAccount",
+					Name:      serviceAccountName,
+					Namespace: portainerNamespace,
+				},
+			},
+			RoleRef: rbacv1.RoleRef{
+				Kind: "ClusterRole",
+				Name: "edit",
+			},
+		}
+
+		_, err = kcl.cli.RbacV1().RoleBindings(namespace).Create(context.TODO(), roleBinding, metav1.CreateOptions{})
+		return err
+	} else if err != nil {
+		return err
+	}
+
+	for _, subject := range roleBinding.Subjects {
+		if subject.Name == serviceAccountName {
+			return nil
+		}
+	}
+
+	roleBinding.Subjects = append(roleBinding.Subjects, rbacv1.Subject{
+		Kind:      "ServiceAccount",
+		Name:      serviceAccountName,
+		Namespace: portainerNamespace,
+	})
+
+	_, err = kcl.cli.RbacV1().RoleBindings(namespace).Update(context.TODO(), roleBinding, metav1.UpdateOptions{})
+	return err
+}
diff --git a/api/kubernetes/cli/service_account_test.go b/api/kubernetes/cli/service_account_test.go
new file mode 100644
index 0000000..845f0e0
--- /dev/null
+++ b/api/kubernetes/cli/service_account_test.go
@@ -0,0 +1,422 @@
+package cli
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	v1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	kfake "k8s.io/client-go/kubernetes/fake"
+)
+
+func Test_GetServiceAccount(t *testing.T) {
+	t.Parallel()
+
+	t.Run("returns error if non-existent", func(t *testing.T) {
+		k := &KubeClient{
+			cli:        kfake.NewSimpleClientset(),
+			instanceID: "test",
+		}
+		tokenData := &portainer.TokenData{ID: 1}
+		_, err := k.GetPortainerUserServiceAccount(tokenData)
+		if err == nil {
+			t.Error("GetPortainerUserServiceAccount should fail with service account not found")
+		}
+	})
+
+	t.Run("succeeds for cluster admin role", func(t *testing.T) {
+		k := &KubeClient{
+			cli:        kfake.NewSimpleClientset(),
+			instanceID: "test",
+		}
+
+		tokenData := &portainer.TokenData{
+			ID:       1,
+			Role:     portainer.AdministratorRole,
+			Username: portainerClusterAdminServiceAccountName,
+		}
+		serviceAccount := &v1.ServiceAccount{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: tokenData.Username,
+			},
+		}
+		_, err := k.cli.CoreV1().ServiceAccounts(portainerNamespace).Create(t.Context(), serviceAccount, metav1.CreateOptions{})
+		if err != nil {
+			t.Errorf("failed to create service acount; err=%s", err)
+		}
+		defer func() {
+			err := k.cli.CoreV1().ServiceAccounts(portainerNamespace).Delete(t.Context(), serviceAccount.Name, metav1.DeleteOptions{})
+			require.NoError(t, err)
+		}()
+
+		sa, err := k.GetPortainerUserServiceAccount(tokenData)
+		if err != nil {
+			t.Errorf("GetPortainerUserServiceAccount should succeed; err=%s", err)
+		}
+
+		want := "portainer-sa-clusteradmin"
+		if sa.Name != want {
+			t.Errorf("GetServiceAccount should succeed and return correct sa name; got=%s want=%s", sa.Name, want)
+		}
+	})
+
+	t.Run("succeeds for standard user role", func(t *testing.T) {
+		k := &KubeClient{
+			cli:        kfake.NewSimpleClientset(),
+			instanceID: "test",
+		}
+
+		tokenData := &portainer.TokenData{
+			ID:   1,
+			Role: portainer.StandardUserRole,
+		}
+		serviceAccountName := UserServiceAccountName(int(tokenData.ID), k.instanceID)
+		serviceAccount := &v1.ServiceAccount{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: serviceAccountName,
+			},
+		}
+		_, err := k.cli.CoreV1().ServiceAccounts(portainerNamespace).Create(t.Context(), serviceAccount, metav1.CreateOptions{})
+		if err != nil {
+			t.Errorf("failed to create service acount; err=%s", err)
+		}
+		defer func() {
+			err := k.cli.CoreV1().ServiceAccounts(portainerNamespace).Delete(t.Context(), serviceAccount.Name, metav1.DeleteOptions{})
+			require.NoError(t, err)
+		}()
+
+		sa, err := k.GetPortainerUserServiceAccount(tokenData)
+		if err != nil {
+			t.Errorf("GetPortainerUserServiceAccount should succeed; err=%s", err)
+		}
+
+		want := "portainer-sa-user-test-1"
+		if sa.Name != want {
+			t.Errorf("GetPortainerUserServiceAccount should succeed and return correct sa name; got=%s want=%s", sa.Name, want)
+		}
+	})
+
+}
+
+func TestGetServiceAccountDetails(t *testing.T) {
+	t.Parallel()
+	t.Run("returns service account details", func(t *testing.T) {
+		automount := false
+		sa := &v1.ServiceAccount{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "my-sa",
+				Namespace: "default",
+				Labels:    map[string]string{"app": "web"},
+			},
+			AutomountServiceAccountToken: &automount,
+			ImagePullSecrets: []v1.LocalObjectReference{
+				{Name: "registry-secret"},
+			},
+		}
+		kcl := &KubeClient{
+			cli:        kfake.NewSimpleClientset(sa),
+			instanceID: "test",
+		}
+
+		result, err := kcl.GetServiceAccount("default", "my-sa")
+		require.NoError(t, err)
+
+		assert.Equal(t, "my-sa", result.Name)
+		assert.Equal(t, "default", result.Namespace)
+		assert.Equal(t, &automount, result.AutomountServiceAccountToken)
+		assert.Len(t, result.ImagePullSecrets, 1)
+		assert.Equal(t, "registry-secret", result.ImagePullSecrets[0].Name)
+		assert.Equal(t, map[string]string{"app": "web"}, result.Labels)
+	})
+
+	t.Run("returns error when service account not found", func(t *testing.T) {
+		kcl := &KubeClient{
+			cli:        kfake.NewSimpleClientset(),
+			instanceID: "test",
+		}
+
+		_, err := kcl.GetServiceAccount("default", "does-not-exist")
+		require.Error(t, err)
+	})
+
+	t.Run("marks system namespace accounts as system", func(t *testing.T) {
+		sa := &v1.ServiceAccount{
+			ObjectMeta: metav1.ObjectMeta{Name: "default", Namespace: "kube-system"},
+		}
+		ns := &v1.Namespace{
+			ObjectMeta: metav1.ObjectMeta{Name: "kube-system"},
+		}
+		kcl := &KubeClient{
+			cli:        kfake.NewSimpleClientset(sa, ns),
+			instanceID: "test",
+		}
+
+		result, err := kcl.GetServiceAccount("kube-system", "default")
+		require.NoError(t, err)
+		assert.True(t, result.IsSystem)
+	})
+
+	t.Run("returns nil automount when not set", func(t *testing.T) {
+		sa := &v1.ServiceAccount{
+			ObjectMeta: metav1.ObjectMeta{Name: "my-sa", Namespace: "default"},
+		}
+		kcl := &KubeClient{
+			cli:        kfake.NewSimpleClientset(sa),
+			instanceID: "test",
+		}
+
+		result, err := kcl.GetServiceAccount("default", "my-sa")
+		require.NoError(t, err)
+		assert.Nil(t, result.AutomountServiceAccountToken)
+	})
+}
+
+func TestAddImagePullSecretToServiceAccount(t *testing.T) {
+	t.Parallel()
+	newKCL := func(sa *v1.ServiceAccount) *KubeClient {
+		return &KubeClient{cli: kfake.NewSimpleClientset(sa), instanceID: "test"}
+	}
+
+	defaultSA := func(namespace string, refs ...string) *v1.ServiceAccount {
+		pullSecrets := make([]v1.LocalObjectReference, len(refs))
+		for i, r := range refs {
+			pullSecrets[i] = v1.LocalObjectReference{Name: r}
+		}
+		return &v1.ServiceAccount{
+			ObjectMeta:       metav1.ObjectMeta{Name: "default", Namespace: namespace},
+			ImagePullSecrets: pullSecrets,
+		}
+	}
+
+	t.Run("adds entry to SA with empty ImagePullSecrets", func(t *testing.T) {
+		kcl := newKCL(defaultSA("ns-a"))
+		require.NoError(t, kcl.AddImagePullSecretToServiceAccount("ns-a", "default", "registry-1"))
+
+		sa, err := kcl.cli.CoreV1().ServiceAccounts("ns-a").Get(t.Context(), "default", metav1.GetOptions{})
+		require.NoError(t, err)
+		require.Len(t, sa.ImagePullSecrets, 1)
+		assert.Equal(t, "registry-1", sa.ImagePullSecrets[0].Name)
+	})
+
+	t.Run("is idempotent when secret already present", func(t *testing.T) {
+		kcl := newKCL(defaultSA("ns-a", "registry-1"))
+		require.NoError(t, kcl.AddImagePullSecretToServiceAccount("ns-a", "default", "registry-1"))
+
+		sa, err := kcl.cli.CoreV1().ServiceAccounts("ns-a").Get(t.Context(), "default", metav1.GetOptions{})
+		require.NoError(t, err)
+		assert.Len(t, sa.ImagePullSecrets, 1)
+	})
+
+	t.Run("preserves pre-existing pull secrets", func(t *testing.T) {
+		kcl := newKCL(defaultSA("ns-a", "other-1", "other-2"))
+		require.NoError(t, kcl.AddImagePullSecretToServiceAccount("ns-a", "default", "registry-3"))
+
+		sa, err := kcl.cli.CoreV1().ServiceAccounts("ns-a").Get(t.Context(), "default", metav1.GetOptions{})
+		require.NoError(t, err)
+		require.Len(t, sa.ImagePullSecrets, 3)
+		assert.Equal(t, "other-1", sa.ImagePullSecrets[0].Name)
+		assert.Equal(t, "other-2", sa.ImagePullSecrets[1].Name)
+		assert.Equal(t, "registry-3", sa.ImagePullSecrets[2].Name)
+	})
+
+	t.Run("returns error when SA does not exist", func(t *testing.T) {
+		kcl := &KubeClient{cli: kfake.NewSimpleClientset(), instanceID: "test"}
+		err := kcl.AddImagePullSecretToServiceAccount("ns-a", "default", "registry-1")
+		require.Error(t, err)
+	})
+
+	t.Run("works with non-default service account name", func(t *testing.T) {
+		sa := &v1.ServiceAccount{
+			ObjectMeta: metav1.ObjectMeta{Name: "custom", Namespace: "ns-a"},
+		}
+		kcl := newKCL(sa)
+		require.NoError(t, kcl.AddImagePullSecretToServiceAccount("ns-a", "custom", "registry-1"))
+
+		got, err := kcl.cli.CoreV1().ServiceAccounts("ns-a").Get(t.Context(), "custom", metav1.GetOptions{})
+		require.NoError(t, err)
+		require.Len(t, got.ImagePullSecrets, 1)
+		assert.Equal(t, "registry-1", got.ImagePullSecrets[0].Name)
+	})
+}
+
+func TestRemoveImagePullSecretFromServiceAccount(t *testing.T) {
+	t.Parallel()
+	newKCL := func(sa *v1.ServiceAccount) *KubeClient {
+		return &KubeClient{cli: kfake.NewSimpleClientset(sa), instanceID: "test"}
+	}
+
+	defaultSA := func(namespace string, refs ...string) *v1.ServiceAccount {
+		pullSecrets := make([]v1.LocalObjectReference, len(refs))
+		for i, r := range refs {
+			pullSecrets[i] = v1.LocalObjectReference{Name: r}
+		}
+		return &v1.ServiceAccount{
+			ObjectMeta:       metav1.ObjectMeta{Name: "default", Namespace: namespace},
+			ImagePullSecrets: pullSecrets,
+		}
+	}
+
+	t.Run("removes target entry from ImagePullSecrets", func(t *testing.T) {
+		kcl := newKCL(defaultSA("ns-a", "registry-1"))
+		require.NoError(t, kcl.RemoveImagePullSecretFromServiceAccount("ns-a", "default", "registry-1"))
+
+		sa, err := kcl.cli.CoreV1().ServiceAccounts("ns-a").Get(t.Context(), "default", metav1.GetOptions{})
+		require.NoError(t, err)
+		assert.Empty(t, sa.ImagePullSecrets)
+	})
+
+	t.Run("is idempotent when secret not in list", func(t *testing.T) {
+		kcl := newKCL(defaultSA("ns-a", "other-secret"))
+		require.NoError(t, kcl.RemoveImagePullSecretFromServiceAccount("ns-a", "default", "registry-1"))
+
+		sa, err := kcl.cli.CoreV1().ServiceAccounts("ns-a").Get(t.Context(), "default", metav1.GetOptions{})
+		require.NoError(t, err)
+		assert.Len(t, sa.ImagePullSecrets, 1)
+	})
+
+	t.Run("preserves other pull secrets when removing target", func(t *testing.T) {
+		kcl := newKCL(defaultSA("ns-a", "other-1", "registry-2", "other-3"))
+		require.NoError(t, kcl.RemoveImagePullSecretFromServiceAccount("ns-a", "default", "registry-2"))
+
+		sa, err := kcl.cli.CoreV1().ServiceAccounts("ns-a").Get(t.Context(), "default", metav1.GetOptions{})
+		require.NoError(t, err)
+		require.Len(t, sa.ImagePullSecrets, 2)
+		assert.Equal(t, "other-1", sa.ImagePullSecrets[0].Name)
+		assert.Equal(t, "other-3", sa.ImagePullSecrets[1].Name)
+	})
+
+	t.Run("returns nil when SA does not exist", func(t *testing.T) {
+		kcl := &KubeClient{cli: kfake.NewSimpleClientset(), instanceID: "test"}
+		require.NoError(t, kcl.RemoveImagePullSecretFromServiceAccount("ns-a", "default", "registry-1"))
+	})
+
+	t.Run("returns nil when ImagePullSecrets is nil", func(t *testing.T) {
+		sa := &v1.ServiceAccount{
+			ObjectMeta: metav1.ObjectMeta{Name: "default", Namespace: "ns-a"},
+		}
+		kcl := newKCL(sa)
+		require.NoError(t, kcl.RemoveImagePullSecretFromServiceAccount("ns-a", "default", "registry-1"))
+	})
+
+	t.Run("removes all occurrences when target appears more than once", func(t *testing.T) {
+		kcl := newKCL(defaultSA("ns-a", "registry-1", "registry-1"))
+		require.NoError(t, kcl.RemoveImagePullSecretFromServiceAccount("ns-a", "default", "registry-1"))
+
+		sa, err := kcl.cli.CoreV1().ServiceAccounts("ns-a").Get(t.Context(), "default", metav1.GetOptions{})
+		require.NoError(t, err)
+		assert.Empty(t, sa.ImagePullSecrets)
+	})
+}
+
+func TestGetServiceAccount_CreatesAndFetches(t *testing.T) {
+	t.Parallel()
+	t.Run("returns annotations when set", func(t *testing.T) {
+		sa := &v1.ServiceAccount{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:        "annotated-sa",
+				Namespace:   "default",
+				Annotations: map[string]string{"example.com/key": "value"},
+			},
+		}
+		kcl := &KubeClient{
+			cli:        kfake.NewSimpleClientset(sa),
+			instanceID: "test",
+		}
+
+		result, err := kcl.GetServiceAccount("default", "annotated-sa")
+		require.NoError(t, err)
+		assert.Equal(t, map[string]string{"example.com/key": "value"}, result.Annotations)
+	})
+
+	t.Run("round-trips UID correctly", func(t *testing.T) {
+		sa := &v1.ServiceAccount{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "uid-sa",
+				Namespace: "default",
+				UID:       "abc-123-def",
+			},
+		}
+		kcl := &KubeClient{
+			cli:        kfake.NewSimpleClientset(sa),
+			instanceID: "test",
+		}
+
+		result, err := kcl.GetServiceAccount("default", "uid-sa")
+		require.NoError(t, err)
+		assert.Equal(t, "abc-123-def", string(result.UID))
+	})
+
+	t.Run("creates service account and fetches it back", func(t *testing.T) {
+		kcl := &KubeClient{
+			cli:        kfake.NewSimpleClientset(),
+			instanceID: "test",
+		}
+
+		sa := &v1.ServiceAccount{
+			ObjectMeta: metav1.ObjectMeta{Name: "fresh-sa", Namespace: "staging"},
+		}
+		_, err := kcl.cli.CoreV1().ServiceAccounts("staging").Create(t.Context(), sa, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		result, err := kcl.GetServiceAccount("staging", "fresh-sa")
+		require.NoError(t, err)
+		assert.Equal(t, "fresh-sa", result.Name)
+		assert.Equal(t, "staging", result.Namespace)
+	})
+}
+
+func TestUpdateServiceAccountImagePullSecrets(t *testing.T) {
+	t.Parallel()
+	newKCL := func(sa *v1.ServiceAccount) *KubeClient {
+		return &KubeClient{cli: kfake.NewSimpleClientset(sa), instanceID: "test"}
+	}
+
+	defaultSA := func(namespace string, refs ...string) *v1.ServiceAccount {
+		pullSecrets := make([]v1.LocalObjectReference, len(refs))
+		for i, r := range refs {
+			pullSecrets[i] = v1.LocalObjectReference{Name: r}
+		}
+		return &v1.ServiceAccount{
+			ObjectMeta:       metav1.ObjectMeta{Name: "default", Namespace: namespace},
+			ImagePullSecrets: pullSecrets,
+		}
+	}
+
+	t.Run("sets full list replacing existing", func(t *testing.T) {
+		kcl := newKCL(defaultSA("ns-a", "old-1", "old-2"))
+		require.NoError(t, kcl.UpdateServiceAccountImagePullSecrets("ns-a", "default", []string{"new-1"}))
+
+		sa, err := kcl.cli.CoreV1().ServiceAccounts("ns-a").Get(t.Context(), "default", metav1.GetOptions{})
+		require.NoError(t, err)
+		require.Len(t, sa.ImagePullSecrets, 1)
+		assert.Equal(t, "new-1", sa.ImagePullSecrets[0].Name)
+	})
+
+	t.Run("clears list when secretNames is empty", func(t *testing.T) {
+		kcl := newKCL(defaultSA("ns-a", "secret-1", "secret-2"))
+		require.NoError(t, kcl.UpdateServiceAccountImagePullSecrets("ns-a", "default", []string{}))
+
+		sa, err := kcl.cli.CoreV1().ServiceAccounts("ns-a").Get(t.Context(), "default", metav1.GetOptions{})
+		require.NoError(t, err)
+		assert.Empty(t, sa.ImagePullSecrets)
+	})
+
+	t.Run("returns error when SA does not exist", func(t *testing.T) {
+		kcl := &KubeClient{cli: kfake.NewSimpleClientset(), instanceID: "test"}
+		err := kcl.UpdateServiceAccountImagePullSecrets("ns-a", "does-not-exist", []string{"secret-1"})
+		require.Error(t, err)
+	})
+
+	t.Run("sets list on SA with no existing pull secrets", func(t *testing.T) {
+		kcl := newKCL(defaultSA("ns-a"))
+		require.NoError(t, kcl.UpdateServiceAccountImagePullSecrets("ns-a", "default", []string{"s1", "s2"}))
+
+		sa, err := kcl.cli.CoreV1().ServiceAccounts("ns-a").Get(t.Context(), "default", metav1.GetOptions{})
+		require.NoError(t, err)
+		require.Len(t, sa.ImagePullSecrets, 2)
+		assert.Equal(t, "s1", sa.ImagePullSecrets[0].Name)
+		assert.Equal(t, "s2", sa.ImagePullSecrets[1].Name)
+	})
+}
diff --git a/api/kubernetes/cli/service_test.go b/api/kubernetes/cli/service_test.go
new file mode 100644
index 0000000..6d49805
--- /dev/null
+++ b/api/kubernetes/cli/service_test.go
@@ -0,0 +1,16 @@
+package cli
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetServices(t *testing.T) {
+	t.Parallel()
+	kcl := &KubeClient{}
+
+	services, err := kcl.GetServices("default")
+	require.NoError(t, err)
+	require.Empty(t, services)
+}
diff --git a/api/kubernetes/cli/storage.go b/api/kubernetes/cli/storage.go
new file mode 100644
index 0000000..4b8ca7e
--- /dev/null
+++ b/api/kubernetes/cli/storage.go
@@ -0,0 +1,37 @@
+package cli
+
+import (
+	"context"
+
+	portainer "github.com/portainer/portainer/api"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func (kcl *KubeClient) GetStorage() ([]portainer.KubernetesStorageClassConfig, error) {
+	var storages []portainer.KubernetesStorageClassConfig
+
+	storageClient := kcl.cli.StorageV1().StorageClasses()
+	storageList, err := storageClient.List(context.Background(), metav1.ListOptions{})
+	if err != nil {
+		return storages, err
+	}
+
+	for _, s := range storageList.Items {
+		var storage portainer.KubernetesStorageClassConfig
+
+		v, ok := s.Annotations["storageclass.kubernetes.io/is-default-class"]
+		if !ok || v != "true" {
+			continue
+		}
+		storage.Name = s.Name
+		storage.Provisioner = s.Provisioner
+		storage.AccessModes = []string{"RWO"}
+		if s.AllowVolumeExpansion != nil {
+			storage.AllowVolumeExpansion = *s.AllowVolumeExpansion
+		}
+
+		storages = append(storages, storage)
+	}
+
+	return storages, nil
+}
diff --git a/api/kubernetes/cli/storage_classes.go b/api/kubernetes/cli/storage_classes.go
new file mode 100644
index 0000000..d27b805
--- /dev/null
+++ b/api/kubernetes/cli/storage_classes.go
@@ -0,0 +1,136 @@
+package cli
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/segmentio/encoding/json"
+
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+	"github.com/rs/zerolog/log"
+	storagev1 "k8s.io/api/storage/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+)
+
+const storageClassDefaultAnnotation = "storageclass.kubernetes.io/is-default-class"
+
+// GetStorageClasses returns all StorageClasses in the cluster.
+func (kcl *KubeClient) GetStorageClasses() ([]models.K8sStorageClass, error) {
+	scList, err := kcl.cli.StorageV1().StorageClasses().List(context.Background(), metav1.ListOptions{})
+	if err != nil {
+		return nil, fmt.Errorf("unable to list storage classes. Error: %w", err)
+	}
+
+	results := make([]models.K8sStorageClass, 0, len(scList.Items))
+	for i := range scList.Items {
+		results = append(results, parseStorageClassDetail(&scList.Items[i]))
+	}
+
+	return results, nil
+}
+
+// GetStorageClass returns a single StorageClass by name.
+func (kcl *KubeClient) GetStorageClass(name string) (*models.K8sStorageClass, error) {
+	sc, err := kcl.cli.StorageV1().StorageClasses().Get(context.Background(), name, metav1.GetOptions{})
+	if err != nil {
+		return nil, fmt.Errorf("unable to get storage class %s. Error: %w", name, err)
+	}
+
+	result := parseStorageClassDetail(sc)
+	return &result, nil
+}
+
+// DeleteStorageClasses deletes the specified StorageClasses by name.
+func (kcl *KubeClient) DeleteStorageClasses(names []string) error {
+	for _, name := range names {
+		log.Debug().
+			Str("context", "DeleteStorageClasses").
+			Str("storage_class", name).
+			Msg("Deleting storage class")
+
+		err := kcl.cli.StorageV1().StorageClasses().Delete(context.Background(), name, metav1.DeleteOptions{})
+		if err != nil {
+			return fmt.Errorf("unable to delete storage class %s. Error: %w", name, err)
+		}
+	}
+
+	return nil
+}
+
+// SetDefaultStorageClass sets the specified StorageClass as the default.
+// It removes the default annotation from any other StorageClass that is currently default.
+func (kcl *KubeClient) SetDefaultStorageClass(name string) error {
+	_, err := kcl.cli.StorageV1().StorageClasses().Get(context.Background(), name, metav1.GetOptions{})
+	if err != nil {
+		return fmt.Errorf("unable to find storage class %s. Error: %w", name, err)
+	}
+
+	scList, err := kcl.cli.StorageV1().StorageClasses().List(context.Background(), metav1.ListOptions{})
+	if err != nil {
+		return fmt.Errorf("unable to list storage classes. Error: %w", err)
+	}
+
+	for i := range scList.Items {
+		sc := &scList.Items[i]
+		isCurrentDefault := sc.Annotations[storageClassDefaultAnnotation] == "true"
+		isTarget := sc.Name == name
+
+		if isTarget && !isCurrentDefault {
+			if err := kcl.patchStorageClassDefaultAnnotation(sc.Name, "true"); err != nil {
+				return err
+			}
+		} else if !isTarget && isCurrentDefault {
+			if err := kcl.patchStorageClassDefaultAnnotation(sc.Name, "false"); err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
+
+func (kcl *KubeClient) patchStorageClassDefaultAnnotation(name, value string) error {
+	patch := map[string]any{
+		"metadata": map[string]any{
+			"annotations": map[string]string{
+				storageClassDefaultAnnotation: value,
+			},
+		},
+	}
+
+	patchBytes, err := json.Marshal(patch)
+	if err != nil {
+		return fmt.Errorf("unable to marshal patch for storage class %s. Error: %w", name, err)
+	}
+
+	_, err = kcl.cli.StorageV1().StorageClasses().Patch(
+		context.Background(),
+		name,
+		types.MergePatchType,
+		patchBytes,
+		metav1.PatchOptions{},
+	)
+	if err != nil {
+		return fmt.Errorf("unable to patch default annotation on storage class %s. Error: %w", name, err)
+	}
+
+	return nil
+}
+
+// parseStorageClassDetail parses a StorageClass with full detail including default status.
+func parseStorageClassDetail(sc *storagev1.StorageClass) models.K8sStorageClass {
+	isDefault := sc.Annotations[storageClassDefaultAnnotation] == "true"
+	return models.K8sStorageClass{
+		Name:                 sc.Name,
+		Provisioner:          sc.Provisioner,
+		ReclaimPolicy:        sc.ReclaimPolicy,
+		AllowVolumeExpansion: sc.AllowVolumeExpansion,
+		IsDefault:            isDefault,
+		Annotations:          sc.Annotations,
+		Labels:               sc.Labels,
+		CreationDate:         sc.CreationTimestamp.Time,
+		Parameters:           sc.Parameters,
+		MountOptions:         sc.MountOptions,
+	}
+}
diff --git a/api/kubernetes/cli/storage_classes_test.go b/api/kubernetes/cli/storage_classes_test.go
new file mode 100644
index 0000000..878a281
--- /dev/null
+++ b/api/kubernetes/cli/storage_classes_test.go
@@ -0,0 +1,246 @@
+package cli
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	storagev1 "k8s.io/api/storage/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	kfake "k8s.io/client-go/kubernetes/fake"
+)
+
+func TestParseStorageClassDetail_IsDefault(t *testing.T) {
+	t.Parallel()
+
+	t.Run("annotation true sets isDefault", func(t *testing.T) {
+		t.Parallel()
+		sc := &storagev1.StorageClass{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "fast",
+				Annotations: map[string]string{
+					storageClassDefaultAnnotation: "true",
+				},
+			},
+		}
+		result := parseStorageClassDetail(sc)
+		assert.True(t, result.IsDefault)
+	})
+
+	t.Run("annotation false gives isDefault=false", func(t *testing.T) {
+		t.Parallel()
+		sc := &storagev1.StorageClass{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "slow",
+				Annotations: map[string]string{
+					storageClassDefaultAnnotation: "false",
+				},
+			},
+		}
+		result := parseStorageClassDetail(sc)
+		assert.False(t, result.IsDefault)
+	})
+
+	t.Run("missing annotation gives isDefault=false", func(t *testing.T) {
+		t.Parallel()
+		sc := &storagev1.StorageClass{
+			ObjectMeta: metav1.ObjectMeta{Name: "no-annotation"},
+		}
+		result := parseStorageClassDetail(sc)
+		assert.False(t, result.IsDefault)
+	})
+}
+
+func TestSetDefaultStorageClass(t *testing.T) {
+	t.Parallel()
+
+	t.Run("sets default annotation on target SC", func(t *testing.T) {
+		t.Parallel()
+		k := NewTestKubeClient(kfake.NewClientset())
+
+		sc := &storagev1.StorageClass{
+			ObjectMeta: metav1.ObjectMeta{Name: "standard"},
+		}
+		_, err := k.cli.StorageV1().StorageClasses().Create(t.Context(), sc, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		err = k.SetDefaultStorageClass("standard")
+		require.NoError(t, err)
+
+		result, err := k.GetStorageClass("standard")
+		require.NoError(t, err)
+		assert.True(t, result.IsDefault)
+	})
+
+	t.Run("removes default annotation from previously-default SC", func(t *testing.T) {
+		t.Parallel()
+		k := NewTestKubeClient(kfake.NewClientset())
+
+		oldDefault := &storagev1.StorageClass{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "old-default",
+				Annotations: map[string]string{
+					storageClassDefaultAnnotation: "true",
+				},
+			},
+		}
+		newDefault := &storagev1.StorageClass{
+			ObjectMeta: metav1.ObjectMeta{Name: "new-default"},
+		}
+
+		_, err := k.cli.StorageV1().StorageClasses().Create(t.Context(), oldDefault, metav1.CreateOptions{})
+		require.NoError(t, err)
+		_, err = k.cli.StorageV1().StorageClasses().Create(t.Context(), newDefault, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		err = k.SetDefaultStorageClass("new-default")
+		require.NoError(t, err)
+
+		old, err := k.GetStorageClass("old-default")
+		require.NoError(t, err)
+		assert.False(t, old.IsDefault)
+
+		newSC, err := k.GetStorageClass("new-default")
+		require.NoError(t, err)
+		assert.True(t, newSC.IsDefault)
+	})
+
+	t.Run("no-op if target is already default", func(t *testing.T) {
+		t.Parallel()
+		k := NewTestKubeClient(kfake.NewClientset())
+
+		sc := &storagev1.StorageClass{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "already-default",
+				Annotations: map[string]string{
+					storageClassDefaultAnnotation: "true",
+				},
+			},
+		}
+		_, err := k.cli.StorageV1().StorageClasses().Create(t.Context(), sc, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		err = k.SetDefaultStorageClass("already-default")
+		require.NoError(t, err)
+
+		result, err := k.GetStorageClass("already-default")
+		require.NoError(t, err)
+		assert.True(t, result.IsDefault)
+	})
+
+	t.Run("handles multiple SCs where only one was previously default", func(t *testing.T) {
+		t.Parallel()
+		k := NewTestKubeClient(kfake.NewClientset())
+
+		scs := []*storagev1.StorageClass{
+			{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "sc-default",
+					Annotations: map[string]string{
+						storageClassDefaultAnnotation: "true",
+					},
+				},
+			},
+			{ObjectMeta: metav1.ObjectMeta{Name: "sc-other-1"}},
+			{ObjectMeta: metav1.ObjectMeta{Name: "sc-other-2"}},
+			{ObjectMeta: metav1.ObjectMeta{Name: "sc-target"}},
+		}
+
+		for _, sc := range scs {
+			_, err := k.cli.StorageV1().StorageClasses().Create(t.Context(), sc, metav1.CreateOptions{})
+			require.NoError(t, err)
+		}
+
+		err := k.SetDefaultStorageClass("sc-target")
+		require.NoError(t, err)
+
+		target, err := k.GetStorageClass("sc-target")
+		require.NoError(t, err)
+		assert.True(t, target.IsDefault)
+
+		oldDefault, err := k.GetStorageClass("sc-default")
+		require.NoError(t, err)
+		assert.False(t, oldDefault.IsDefault)
+
+		for _, name := range []string{"sc-other-1", "sc-other-2"} {
+			sc, err := k.GetStorageClass(name)
+			require.NoError(t, err)
+			assert.False(t, sc.IsDefault)
+		}
+	})
+}
+
+func TestGetStorageClasses(t *testing.T) {
+	t.Parallel()
+
+	t.Run("empty cluster returns empty slice", func(t *testing.T) {
+		t.Parallel()
+		k := NewTestKubeClient(kfake.NewClientset())
+		scs, err := k.GetStorageClasses()
+		require.NoError(t, err)
+		assert.Empty(t, scs)
+	})
+
+	t.Run("returns all SCs with correct fields", func(t *testing.T) {
+		t.Parallel()
+		k := NewTestKubeClient(kfake.NewClientset())
+
+		allowExpansion := true
+		sc := &storagev1.StorageClass{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "fast",
+				Annotations: map[string]string{
+					storageClassDefaultAnnotation: "true",
+				},
+			},
+			Provisioner:          "kubernetes.io/aws-ebs",
+			AllowVolumeExpansion: &allowExpansion,
+		}
+		_, err := k.cli.StorageV1().StorageClasses().Create(t.Context(), sc, metav1.CreateOptions{})
+		require.NoError(t, err)
+
+		scs, err := k.GetStorageClasses()
+		require.NoError(t, err)
+		require.Len(t, scs, 1)
+
+		got := scs[0]
+		assert.Equal(t, "fast", got.Name)
+		assert.Equal(t, "kubernetes.io/aws-ebs", got.Provisioner)
+		assert.True(t, got.IsDefault)
+		require.NotNil(t, got.AllowVolumeExpansion)
+		assert.True(t, *got.AllowVolumeExpansion)
+	})
+}
+
+func TestDeleteStorageClasses(t *testing.T) {
+	t.Parallel()
+
+	t.Run("deletes specified SCs", func(t *testing.T) {
+		t.Parallel()
+		k := NewTestKubeClient(kfake.NewClientset())
+
+		for _, name := range []string{"sc-a", "sc-b", "sc-c"} {
+			sc := &storagev1.StorageClass{
+				ObjectMeta: metav1.ObjectMeta{Name: name},
+			}
+			_, err := k.cli.StorageV1().StorageClasses().Create(t.Context(), sc, metav1.CreateOptions{})
+			require.NoError(t, err)
+		}
+
+		err := k.DeleteStorageClasses([]string{"sc-a", "sc-c"})
+		require.NoError(t, err)
+
+		scs, err := k.GetStorageClasses()
+		require.NoError(t, err)
+		require.Len(t, scs, 1)
+		assert.Equal(t, "sc-b", scs[0].Name)
+	})
+
+	t.Run("returns error for non-existent SC", func(t *testing.T) {
+		t.Parallel()
+		k := NewTestKubeClient(kfake.NewClientset())
+
+		err := k.DeleteStorageClasses([]string{"does-not-exist"})
+		assert.Error(t, err)
+	})
+}
diff --git a/api/kubernetes/cli/test_helpers.go b/api/kubernetes/cli/test_helpers.go
new file mode 100644
index 0000000..689e964
--- /dev/null
+++ b/api/kubernetes/cli/test_helpers.go
@@ -0,0 +1,27 @@
+package cli
+
+import (
+	"strconv"
+
+	portainer "github.com/portainer/portainer/api"
+	"k8s.io/client-go/kubernetes"
+)
+
+// NewTestClientFactory creates a ClientFactory with a pre-seeded KubeClient for
+// a specific endpoint ID. Intended for use in tests across packages that need to
+// inject a fake Kubernetes client without a real cluster connection.
+func NewTestClientFactory(endpointID portainer.EndpointID, kcl *KubeClient) *ClientFactory {
+	factory, _ := NewClientFactory(nil, nil, nil, "test", "", "")
+	factory.endpointProxyClients.Set(strconv.Itoa(int(endpointID)), kcl, 0)
+	return factory
+}
+
+// NewTestKubeClient creates a KubeClient backed by the provided kubernetes.Interface.
+// Intended for use in tests.
+func NewTestKubeClient(clientset kubernetes.Interface) *KubeClient {
+	return &KubeClient{
+		cli:         clientset,
+		instanceID:  "test",
+		isKubeAdmin: true,
+	}
+}
diff --git a/api/kubernetes/cli/volumes.go b/api/kubernetes/cli/volumes.go
new file mode 100644
index 0000000..e98054f
--- /dev/null
+++ b/api/kubernetes/cli/volumes.go
@@ -0,0 +1,305 @@
+package cli
+
+import (
+	"context"
+	"fmt"
+
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+	"github.com/rs/zerolog/log"
+	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+	storagev1 "k8s.io/api/storage/v1"
+	k8serrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// GetVolumes gets the volumes in the current k8s environment(endpoint).
+// If the user is an admin, it fetches all the volumes in the cluster.
+// If the user is not an admin, it fetches the volumes in the namespaces the user has access to.
+// It returns a list of K8sVolumeInfo.
+func (kcl *KubeClient) GetVolumes(namespace string) ([]models.K8sVolumeInfo, error) {
+	if kcl.GetIsKubeAdmin() {
+		return kcl.fetchVolumes(namespace)
+	}
+
+	return kcl.fetchVolumesForNonAdmin(namespace)
+}
+
+// GetVolume gets the volume with the given name and namespace.
+func (kcl *KubeClient) GetVolume(namespace, volumeName string) (*models.K8sVolumeInfo, error) {
+	persistentVolumeClaim, err := kcl.cli.CoreV1().PersistentVolumeClaims(namespace).Get(context.TODO(), volumeName, metav1.GetOptions{})
+	if err != nil {
+		if k8serrors.IsNotFound(err) {
+			return nil, nil
+		}
+
+		return nil, err
+	}
+
+	persistentVolumesMap, storageClassesMap, err := kcl.fetchPersistentVolumesAndStorageClassesMap()
+	if err != nil {
+		return nil, err
+	}
+
+	volume := parseVolume(persistentVolumeClaim, persistentVolumesMap, storageClassesMap)
+	return &volume, nil
+}
+
+// fetchVolumesForNonAdmin fetches the volumes in the namespaces the user has access to.
+// This function is called when the user is not an admin.
+// It fetches all the persistent volume claims, persistent volumes and storage classes in the namespaces the user has access to.
+func (kcl *KubeClient) fetchVolumesForNonAdmin(namespace string) ([]models.K8sVolumeInfo, error) {
+	nonAdminNamespaces := kcl.GetClientNonAdminNamespaces()
+
+	log.Debug().
+		Strs("non_admin_namespaces", nonAdminNamespaces).
+		Msg("fetching volumes for non-admin user")
+
+	if len(nonAdminNamespaces) == 0 {
+		return nil, nil
+	}
+
+	volumes, err := kcl.fetchVolumes(namespace)
+	if err != nil {
+		return nil, err
+	}
+
+	nonAdminNamespaceSet := kcl.buildNonAdminNamespacesMap()
+	results := make([]models.K8sVolumeInfo, 0)
+	for _, volume := range volumes {
+		if _, ok := nonAdminNamespaceSet[volume.PersistentVolumeClaim.Namespace]; ok {
+			results = append(results, volume)
+		}
+	}
+
+	return results, nil
+}
+
+// fetchVolumes fetches all the persistent volume claims, persistent volumes and storage classes in the given namespace.
+// It returns a list of K8sVolumeInfo.
+// This function is called by fetchVolumesForAdmin and fetchVolumesForNonAdmin.
+func (kcl *KubeClient) fetchVolumes(namespace string) ([]models.K8sVolumeInfo, error) {
+	volumes := make([]models.K8sVolumeInfo, 0)
+	persistentVolumeClaims, err := kcl.cli.CoreV1().PersistentVolumeClaims(namespace).List(context.TODO(), metav1.ListOptions{})
+	if err != nil {
+		return nil, err
+	}
+
+	if len(persistentVolumeClaims.Items) > 0 {
+		persistentVolumesMap, storageClassesMap, err := kcl.fetchPersistentVolumesAndStorageClassesMap()
+		if err != nil {
+			return nil, err
+		}
+
+		for _, persistentVolumeClaim := range persistentVolumeClaims.Items {
+			volumes = append(volumes, parseVolume(&persistentVolumeClaim, persistentVolumesMap, storageClassesMap))
+		}
+	}
+
+	return volumes, nil
+}
+
+// parseVolume parses the given persistent volume claim and returns a K8sVolumeInfo.
+// This function is called by fetchVolumes.
+// It returns a K8sVolumeInfo.
+func parseVolume(persistentVolumeClaim *corev1.PersistentVolumeClaim, persistentVolumesMap map[string]models.K8sPersistentVolume, storageClassesMap map[string]models.K8sStorageClass) models.K8sVolumeInfo {
+	volume := models.K8sVolumeInfo{}
+	volumeClaim := parsePersistentVolumeClaim(persistentVolumeClaim)
+
+	if volumeClaim.VolumeName != "" {
+		persistentVolume, ok := persistentVolumesMap[volumeClaim.VolumeName]
+		if ok {
+			volume.PersistentVolume = persistentVolume
+		}
+	}
+
+	if volumeClaim.StorageClass != nil {
+		storageClass, ok := storageClassesMap[*volumeClaim.StorageClass]
+		if ok {
+			volume.StorageClass = storageClass
+		}
+	}
+
+	volume.PersistentVolumeClaim = volumeClaim
+	return volume
+}
+
+// parsePersistentVolumeClaim parses the given persistent volume claim and returns a K8sPersistentVolumeClaim.
+func parsePersistentVolumeClaim(volume *corev1.PersistentVolumeClaim) models.K8sPersistentVolumeClaim {
+	storage := volume.Spec.Resources.Requests[corev1.ResourceStorage]
+	return models.K8sPersistentVolumeClaim{
+		ID:                       string(volume.UID),
+		Name:                     volume.Name,
+		Namespace:                volume.Namespace,
+		CreationDate:             volume.CreationTimestamp.Time,
+		Storage:                  storage.Value(),
+		StorageRequest:           storage.String(),
+		AccessModes:              humanReadableAccessModes(volume.Spec.AccessModes),
+		HumanReadableAccessModes: volume.Spec.AccessModes,
+		VolumeName:               volume.Spec.VolumeName,
+		ResourcesRequests:        &volume.Spec.Resources.Requests,
+		StorageClass:             volume.Spec.StorageClassName,
+		VolumeMode:               volume.Spec.VolumeMode,
+		OwningApplications:       nil,
+		Phase:                    volume.Status.Phase,
+		Labels:                   volume.Labels,
+	}
+}
+
+// parsePersistentVolume parses the given persistent volume and returns a K8sPersistentVolume.
+func parsePersistentVolume(volume *corev1.PersistentVolume) models.K8sPersistentVolume {
+	return models.K8sPersistentVolume{
+		Name:                          volume.Name,
+		Annotations:                   volume.Annotations,
+		Labels:                        volume.Labels,
+		AccessModes:                   humanReadableAccessModes(volume.Spec.AccessModes),
+		HumanReadableAccessModes:      volume.Spec.AccessModes,
+		Capacity:                      volume.Spec.Capacity,
+		ClaimRef:                      volume.Spec.ClaimRef,
+		StorageClassName:              volume.Spec.StorageClassName,
+		PersistentVolumeReclaimPolicy: volume.Spec.PersistentVolumeReclaimPolicy,
+		VolumeMode:                    volume.Spec.VolumeMode,
+		CSI:                           volume.Spec.CSI,
+		Status:                        volume.Status.Phase,
+		CreationDate:                  volume.CreationTimestamp.Time,
+	}
+}
+
+// buildPersistentVolumesMap builds a map of persistent volumes.
+func (kcl *KubeClient) buildPersistentVolumesMap(persistentVolumes *corev1.PersistentVolumeList) map[string]models.K8sPersistentVolume {
+	persistentVolumesMap := make(map[string]models.K8sPersistentVolume)
+	for _, persistentVolume := range persistentVolumes.Items {
+		persistentVolumesMap[persistentVolume.Name] = parsePersistentVolume(&persistentVolume)
+	}
+
+	return persistentVolumesMap
+}
+
+// parseStorageClass parses the given storage class and returns a K8sStorageClass.
+func parseStorageClass(storageClass *storagev1.StorageClass) models.K8sStorageClass {
+	return models.K8sStorageClass{
+		Name:                 storageClass.Name,
+		Provisioner:          storageClass.Provisioner,
+		ReclaimPolicy:        storageClass.ReclaimPolicy,
+		AllowVolumeExpansion: storageClass.AllowVolumeExpansion,
+	}
+}
+
+// buildStorageClassesMap builds a map of storage classes.
+func (kcl *KubeClient) buildStorageClassesMap(storageClasses *storagev1.StorageClassList) map[string]models.K8sStorageClass {
+	storageClassesMap := make(map[string]models.K8sStorageClass)
+	for _, storageClass := range storageClasses.Items {
+		storageClassesMap[storageClass.Name] = parseStorageClass(&storageClass)
+	}
+
+	return storageClassesMap
+}
+
+// fetchPersistentVolumesAndStorageClassesMap fetches all the persistent volumes and storage classes in the cluster.
+// It returns a map of persistent volumes and a map of storage classes.
+func (kcl *KubeClient) fetchPersistentVolumesAndStorageClassesMap() (map[string]models.K8sPersistentVolume, map[string]models.K8sStorageClass, error) {
+	persistentVolumes, err := kcl.cli.CoreV1().PersistentVolumes().List(context.TODO(), metav1.ListOptions{})
+	if err != nil {
+		return nil, nil, err
+	}
+	persistentVolumesMap := kcl.buildPersistentVolumesMap(persistentVolumes)
+
+	storageClasses, err := kcl.cli.StorageV1().StorageClasses().List(context.TODO(), metav1.ListOptions{})
+	if err != nil {
+		return nil, nil, err
+	}
+	storageClassesMap := kcl.buildStorageClassesMap(storageClasses)
+
+	return persistentVolumesMap, storageClassesMap, nil
+}
+
+// CombineVolumesWithApplications combines the volumes with the applications that use them.
+func (kcl *KubeClient) CombineVolumesWithApplications(volumes *[]models.K8sVolumeInfo) (*[]models.K8sVolumeInfo, error) {
+	pods, err := kcl.cli.CoreV1().Pods("").List(context.Background(), metav1.ListOptions{})
+	if err != nil {
+		if k8serrors.IsNotFound(err) {
+			return volumes, nil
+		}
+		log.Error().Err(err).Msg("Failed to list pods across the cluster")
+		return nil, fmt.Errorf("an error occurred during the CombineServicesWithApplications operation, unable to list pods across the cluster. Error: %w", err)
+	}
+
+	hasReplicaSetOwnerReference := containsReplicaSetOwnerReference(pods)
+	replicaSetItems := make([]appsv1.ReplicaSet, 0)
+	deploymentItems := make([]appsv1.Deployment, 0)
+	if hasReplicaSetOwnerReference {
+		replicaSets, err := kcl.cli.AppsV1().ReplicaSets("").List(context.Background(), metav1.ListOptions{})
+		if err != nil {
+			log.Error().Err(err).Msg("Failed to list replica sets across the cluster")
+			return nil, fmt.Errorf("an error occurred during the CombineVolumesWithApplications operation, unable to list replica sets across the cluster. Error: %w", err)
+		}
+		replicaSetItems = replicaSets.Items
+
+		deployments, err := kcl.cli.AppsV1().Deployments("").List(context.Background(), metav1.ListOptions{})
+		if err != nil {
+			log.Error().Err(err).Msg("Failed to list deployments across the cluster")
+			return nil, fmt.Errorf("an error occurred during the CombineVolumesWithApplications operation, unable to list deployments across the cluster. Error: %w", err)
+		}
+		deploymentItems = deployments.Items
+	}
+
+	hasStatefulSetOwnerReference := containsStatefulSetOwnerReference(pods)
+	statefulSetItems := make([]appsv1.StatefulSet, 0)
+	if hasStatefulSetOwnerReference {
+		statefulSets, err := kcl.cli.AppsV1().StatefulSets("").List(context.Background(), metav1.ListOptions{})
+		if err != nil {
+			log.Error().Err(err).Msg("Failed to list stateful sets across the cluster")
+			return nil, fmt.Errorf("an error occurred during the CombineVolumesWithApplications operation, unable to list stateful sets across the cluster. Error: %w", err)
+		}
+		statefulSetItems = statefulSets.Items
+	}
+
+	hasDaemonSetOwnerReference := containsDaemonSetOwnerReference(pods)
+	daemonSetItems := make([]appsv1.DaemonSet, 0)
+	if hasDaemonSetOwnerReference {
+		daemonSets, err := kcl.cli.AppsV1().DaemonSets("").List(context.Background(), metav1.ListOptions{})
+		if err != nil {
+			log.Error().Err(err).Msg("Failed to list daemon sets across the cluster")
+			return nil, fmt.Errorf("an error occurred during the CombineVolumesWithApplications operation, unable to list daemon sets across the cluster. Error: %w", err)
+		}
+		daemonSetItems = daemonSets.Items
+	}
+
+	return kcl.updateVolumesWithOwningApplications(volumes, pods, deploymentItems, replicaSetItems, statefulSetItems, daemonSetItems)
+}
+
+// updateVolumesWithOwningApplications updates the volumes with the applications that use them.
+func (kcl *KubeClient) updateVolumesWithOwningApplications(volumes *[]models.K8sVolumeInfo, pods *corev1.PodList, deploymentItems []appsv1.Deployment, replicaSetItems []appsv1.ReplicaSet, statefulSetItems []appsv1.StatefulSet, daemonSetItems []appsv1.DaemonSet) (*[]models.K8sVolumeInfo, error) {
+	for i, volume := range *volumes {
+		for _, pod := range pods.Items {
+			if pod.Spec.Volumes != nil {
+				for _, podVolume := range pod.Spec.Volumes {
+					if podVolume.PersistentVolumeClaim != nil && podVolume.PersistentVolumeClaim.ClaimName == volume.PersistentVolumeClaim.Name && pod.Namespace == volume.PersistentVolumeClaim.Namespace {
+						application, err := kcl.ConvertPodToApplication(pod, PortainerApplicationResources{
+							ReplicaSets:  replicaSetItems,
+							Deployments:  deploymentItems,
+							StatefulSets: statefulSetItems,
+							DaemonSets:   daemonSetItems,
+						}, false)
+						if err != nil {
+							log.Error().Err(err).Msg("Failed to convert pod to application")
+							return nil, fmt.Errorf("an error occurred during the CombineServicesWithApplications operation, unable to convert pod to application. Error: %w", err)
+						}
+						// Check if the application already exists in the OwningApplications slice
+						exists := false
+						for _, existingApp := range (*volumes)[i].PersistentVolumeClaim.OwningApplications {
+							if existingApp.Name == application.Name && existingApp.Namespace == application.Namespace {
+								exists = true
+								break
+							}
+						}
+						if !exists && application != nil {
+							(*volumes)[i].PersistentVolumeClaim.OwningApplications = append((*volumes)[i].PersistentVolumeClaim.OwningApplications, *application)
+						}
+					}
+				}
+			}
+		}
+	}
+	return volumes, nil
+}
diff --git a/api/kubernetes/cli/volumes_test.go b/api/kubernetes/cli/volumes_test.go
new file mode 100644
index 0000000..283fb7c
--- /dev/null
+++ b/api/kubernetes/cli/volumes_test.go
@@ -0,0 +1,16 @@
+package cli
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetVolumes(t *testing.T) {
+	t.Parallel()
+	kcl := &KubeClient{}
+
+	volumes, err := kcl.GetVolumes("default")
+	require.NoError(t, err)
+	require.Empty(t, volumes)
+}
diff --git a/api/kubernetes/constants.go b/api/kubernetes/constants.go
new file mode 100644
index 0000000..a2d934a
--- /dev/null
+++ b/api/kubernetes/constants.go
@@ -0,0 +1,6 @@
+package kubernetes
+
+const (
+	// DefaultNamespace is the default namespace used when no namespace is specified
+	DefaultNamespace = "default"
+)
diff --git a/api/kubernetes/kubeclusteraccess_service.go b/api/kubernetes/kubeclusteraccess_service.go
new file mode 100644
index 0000000..fce7f55
--- /dev/null
+++ b/api/kubernetes/kubeclusteraccess_service.go
@@ -0,0 +1,125 @@
+package kubernetes
+
+import (
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/pem"
+	"net/url"
+	"os"
+	"strconv"
+
+	portainer "github.com/portainer/portainer/api"
+
+	"github.com/pkg/errors"
+	"github.com/rs/zerolog/log"
+)
+
+// KubeClusterAccessService represents a service that is responsible for centralizing kube cluster access data
+type KubeClusterAccessService interface {
+	IsSecure() bool
+	GetClusterDetails(hostURL string, endpointId portainer.EndpointID, isInternal bool) kubernetesClusterAccessData
+}
+
+// KubernetesClusterAccess represents core details which can be used to generate KubeConfig file/data
+type kubernetesClusterAccessData struct {
+	ClusterServerURL         string `example:"https://mycompany.k8s.com"`
+	CertificateAuthorityFile string `example:"/data/tls/localhost.crt"`
+	CertificateAuthorityData string `example:"MIIC5TCCAc2gAwIBAgIJAJ+...+xuhOaFXwQ=="`
+}
+
+type kubeClusterAccessService struct {
+	baseURL                  string
+	httpsBindAddr            string
+	certificateAuthorityFile string
+	certificateAuthorityData string
+}
+
+var (
+	errTLSCertNotProvided   = errors.New("tls cert path not provided")
+	errTLSCertFileMissing   = errors.New("missing tls cert file")
+	errTLSCertIncorrectType = errors.New("incorrect tls cert type")
+	errTLSCertValidation    = errors.New("failed to parse tls certificate")
+)
+
+// NewKubeClusterAccessService creates a new instance of a KubeClusterAccessService
+func NewKubeClusterAccessService(baseURL, httpsBindAddr, tlsCertPath string) KubeClusterAccessService {
+	certificateAuthorityData, err := getCertificateAuthorityData(tlsCertPath)
+	if err != nil {
+		log.Debug().Err(err).Msg("generated KubeConfig will be insecure")
+	}
+
+	return &kubeClusterAccessService{
+		baseURL:                  baseURL,
+		httpsBindAddr:            httpsBindAddr,
+		certificateAuthorityFile: tlsCertPath,
+		certificateAuthorityData: certificateAuthorityData,
+	}
+}
+
+// getCertificateAuthorityData reads tls certificate from supplied path and verifies the tls certificate
+// then returns content (string) of the certificate within `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----`
+func getCertificateAuthorityData(tlsCertPath string) (string, error) {
+	if tlsCertPath == "" {
+		return "", errTLSCertNotProvided
+	}
+
+	data, err := os.ReadFile(tlsCertPath)
+	if err != nil {
+		return "", errors.Wrap(errTLSCertFileMissing, err.Error())
+	}
+
+	block, _ := pem.Decode(data)
+	if block == nil || block.Type != "CERTIFICATE" {
+		return "", errTLSCertIncorrectType
+	}
+
+	certificate, err := x509.ParseCertificate(block.Bytes)
+	if err != nil {
+		return "", errors.Wrap(errTLSCertValidation, err.Error())
+	}
+
+	return base64.StdEncoding.EncodeToString(certificate.Raw), nil
+}
+
+// IsSecure specifies whether generated KubeConfig structs from the service will not have `insecure-skip-tls-verify: true`
+// this is based on the fact that we can successfully extract `certificateAuthorityData` from
+// certificate file at `tlsCertPath`. If we can successfully extract `certificateAuthorityData`,
+// then this will be used as `certificate-authority-data` attribute in a generated KubeConfig.
+func (service *kubeClusterAccessService) IsSecure() bool {
+	return service.certificateAuthorityData != ""
+}
+
+// GetClusterDetails returns K8s cluster access details for the specified environment(endpoint).
+// The struct can be used to:
+// - generate a kubeconfig file
+// - pass down params to binaries
+// - isInternal is used to determine whether the kubeclient is accessed internally (for example using the kube client for backend calls) or externally (for example downloading the kubeconfig file)
+func (service *kubeClusterAccessService) GetClusterDetails(hostURL string, endpointID portainer.EndpointID, isInternal bool) kubernetesClusterAccessData {
+	if hostURL == "localhost" {
+		hostURL += service.httpsBindAddr
+	}
+
+	baseURL := service.baseURL
+	// When the kubeclient call is internal, the baseURL should not be used.
+	if isInternal {
+		baseURL = ""
+	}
+
+	log.Debug().
+		Str("host_URL", hostURL).
+		Str("HTTPS_bind_address", service.httpsBindAddr).
+		Str("base_URL", baseURL).
+		Bool("is_internal", isInternal).
+		Msg("kubeconfig")
+
+	clusterServerURL, err := url.JoinPath("https://", hostURL, baseURL, "/api/endpoints/", strconv.Itoa(int(endpointID)), "/kubernetes")
+	if err != nil {
+		log.Error().Err(err).Msg("Failed to create Kubeconfig cluster URL")
+	}
+
+	return kubernetesClusterAccessData{
+		ClusterServerURL:         clusterServerURL,
+		CertificateAuthorityFile: service.certificateAuthorityFile,
+		CertificateAuthorityData: service.certificateAuthorityData,
+	}
+}
diff --git a/api/kubernetes/kubeclusteraccess_service_test.go b/api/kubernetes/kubeclusteraccess_service_test.go
new file mode 100644
index 0000000..156c2a1
--- /dev/null
+++ b/api/kubernetes/kubeclusteraccess_service_test.go
@@ -0,0 +1,138 @@
+package kubernetes
+
+import (
+	"fmt"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TLS certificate can be generated using:
+// openssl req -x509 -out localhost.crt -keyout localhost.key -newkey rsa:2048 -nodes -sha25 -subj '/CN=localhost' -extensions EXT -config <( \
+// printf "[dn]\nCN=localhost\n[req]\ndistinguished_name = dn\n[EXT]\nsubjectAltName=DNS:localhost\nkeyUsage=digitalSignature\nextendedKeyUsage=serverAuth")
+const certData = `-----BEGIN CERTIFICATE-----
+MIIC5TCCAc2gAwIBAgIJAJ+poiEBdsplMA0GCSqGSIb3DQEBCwUAMBQxEjAQBgNV
+BAMMCWxvY2FsaG9zdDAeFw0yMTA4MDQwNDM0MTZaFw0yMTA5MDMwNDM0MTZaMBQx
+EjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
+ggEBAKQ0HStP34FY/lSDIfMG9MV/lKNUkiLZcMXepbyhPit4ND/w9kOA4WTJ+oP0
+B2IYklRvLkneZOfQiPweGAPwZl3CjwII6gL6NCkhcXXAJ4JQ9duL5Q6pL//95Ocv
+X+qMTssyS1DcH88F6v+gifACLpvG86G9V0DeSGS2fqqfOJngrOCgum1DsWi3Xsew
+B3A7GkPRjYmckU3t4iHgcMb+6lGQAxtnllSM9DpqGnjXRs4mnQHKgufaeW5nvHXi
+oa5l0aHIhN6MQS99QwKwfml7UtWAYhSJksMrrTovB6rThYpp2ID/iU9MGfkpxubT
+oA6scv8alFa8Bo+NEKo255dxsScCAwEAAaM6MDgwFAYDVR0RBA0wC4IJbG9jYWxo
+b3N0MAsGA1UdDwQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATANBgkqhkiG9w0B
+AQsFAAOCAQEALFBHW/r79KOj5bhoDtHs8h/ESAlD5DJI/kzc1RajA8AuWPsaagG/
+S0Bqiq2ApMA6Tr3t9An8peaLCaUapWw59kyQcwwPXm9vxhEEfoBRtk8po8XblsUS
+Q5Ku07ycSg5NBGEW2rCLsvjQFuQiAt8sW4jGCCN+ph/GQF9XC8ir+ssiqiMEkbm/
+JaK7sTi5kZ/GsSK8bJ+9N/ztoFr89YYEWjjOuIS3HNMdBcuQXIel7siEFdNjbzMo
+iuViiuhTPJkxKOzCmv52cxf15B0/+cgcImoX4zc9Z0NxKthBmIe00ojexE0ZBOFi
+4PxB7Ou6y/c9OvJb7gJv3z08+xuhOaFXwQ==
+-----END CERTIFICATE-----
+`
+
+// string within the `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` without linebreaks
+const certDataString = "MIIC5TCCAc2gAwIBAgIJAJ+poiEBdsplMA0GCSqGSIb3DQEBCwUAMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDAeFw0yMTA4MDQwNDM0MTZaFw0yMTA5MDMwNDM0MTZaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKQ0HStP34FY/lSDIfMG9MV/lKNUkiLZcMXepbyhPit4ND/w9kOA4WTJ+oP0B2IYklRvLkneZOfQiPweGAPwZl3CjwII6gL6NCkhcXXAJ4JQ9duL5Q6pL//95OcvX+qMTssyS1DcH88F6v+gifACLpvG86G9V0DeSGS2fqqfOJngrOCgum1DsWi3XsewB3A7GkPRjYmckU3t4iHgcMb+6lGQAxtnllSM9DpqGnjXRs4mnQHKgufaeW5nvHXioa5l0aHIhN6MQS99QwKwfml7UtWAYhSJksMrrTovB6rThYpp2ID/iU9MGfkpxubToA6scv8alFa8Bo+NEKo255dxsScCAwEAAaM6MDgwFAYDVR0RBA0wC4IJbG9jYWxob3N0MAsGA1UdDwQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATANBgkqhkiG9w0BAQsFAAOCAQEALFBHW/r79KOj5bhoDtHs8h/ESAlD5DJI/kzc1RajA8AuWPsaagG/S0Bqiq2ApMA6Tr3t9An8peaLCaUapWw59kyQcwwPXm9vxhEEfoBRtk8po8XblsUSQ5Ku07ycSg5NBGEW2rCLsvjQFuQiAt8sW4jGCCN+ph/GQF9XC8ir+ssiqiMEkbm/JaK7sTi5kZ/GsSK8bJ+9N/ztoFr89YYEWjjOuIS3HNMdBcuQXIel7siEFdNjbzMoiuViiuhTPJkxKOzCmv52cxf15B0/+cgcImoX4zc9Z0NxKthBmIe00ojexE0ZBOFi4PxB7Ou6y/c9OvJb7gJv3z08+xuhOaFXwQ=="
+
+func createTempFile(filename, content string, t *testing.T) string {
+	tempPath := t.TempDir()
+	filePath := fmt.Sprintf("%s/%s", tempPath, filename)
+
+	err := os.WriteFile(filePath, []byte(content), 0644)
+	require.NoError(t, err)
+
+	return filePath
+}
+
+func Test_getCertificateAuthorityData(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	t.Run("getCertificateAuthorityData fails on tls cert not provided", func(t *testing.T) {
+		_, err := getCertificateAuthorityData("")
+		is.ErrorIs(err, errTLSCertNotProvided, "getCertificateAuthorityData should fail with %w", errTLSCertNotProvided)
+	})
+
+	t.Run("getCertificateAuthorityData fails on tls cert provided but missing file", func(t *testing.T) {
+		_, err := getCertificateAuthorityData("/tmp/non-existent.crt")
+		is.ErrorIs(err, errTLSCertFileMissing, "getCertificateAuthorityData should fail with %w", errTLSCertFileMissing)
+	})
+
+	t.Run("getCertificateAuthorityData fails on tls cert provided but invalid file data", func(t *testing.T) {
+		filePath := createTempFile("invalid-cert.crt", "hello\ngo\n", t)
+		_, err := getCertificateAuthorityData(filePath)
+		is.ErrorIs(err, errTLSCertIncorrectType, "getCertificateAuthorityData should fail with %w", errTLSCertIncorrectType)
+	})
+
+	t.Run("getCertificateAuthorityData succeeds on valid tls cert provided", func(t *testing.T) {
+		filePath := createTempFile("valid-cert.crt", certData, t)
+
+		certificateAuthorityData, err := getCertificateAuthorityData(filePath)
+		require.NoError(t, err, "getCertificateAuthorityData succeed with valid cert; err=%w", errTLSCertIncorrectType)
+
+		is.Equal(certDataString, certificateAuthorityData, "returned certificateAuthorityData should be %s", certDataString)
+	})
+}
+
+func TestKubeClusterAccessService_IsSecure(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	t.Run("IsSecure should be false", func(t *testing.T) {
+		kcs := NewKubeClusterAccessService("", "", "")
+		is.False(kcs.IsSecure(), "should be false if TLS cert not provided")
+	})
+
+	t.Run("IsSecure should be false", func(t *testing.T) {
+		filePath := createTempFile("valid-cert.crt", certData, t)
+
+		kcs := NewKubeClusterAccessService("", "", filePath)
+		is.True(kcs.IsSecure(), "should be true if valid TLS cert (path and content) provided")
+	})
+}
+
+func TestKubeClusterAccessService_GetKubeConfigInternal(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	t.Run("GetClusterDetails contains host address", func(t *testing.T) {
+		kcs := NewKubeClusterAccessService("/", "", "")
+		clusterAccessDetails := kcs.GetClusterDetails("mysite.com", 1, true)
+		is.Contains(clusterAccessDetails.ClusterServerURL, "https://mysite.com", "should contain host address")
+	})
+
+	t.Run("GetClusterDetails contains environment proxy url", func(t *testing.T) {
+		kcs := NewKubeClusterAccessService("/", "", "")
+		clusterAccessDetails := kcs.GetClusterDetails("mysite.com", 100, true)
+		is.Contains(clusterAccessDetails.ClusterServerURL, "api/endpoints/100/kubernetes", "should contain environment proxy url")
+	})
+
+	t.Run("GetClusterDetails returns insecure cluster access config", func(t *testing.T) {
+		kcs := NewKubeClusterAccessService("/", ":9443", "")
+		clusterAccessDetails := kcs.GetClusterDetails("mysite.com", 1, true)
+
+		wantClusterAccessDetails := kubernetesClusterAccessData{
+			ClusterServerURL:         "https://mysite.com/api/endpoints/1/kubernetes",
+			CertificateAuthorityFile: "",
+			CertificateAuthorityData: "",
+		}
+
+		is.Equal(wantClusterAccessDetails, clusterAccessDetails)
+	})
+
+	t.Run("GetClusterDetails returns secure cluster access config", func(t *testing.T) {
+		filePath := createTempFile("valid-cert.crt", certData, t)
+
+		kcs := NewKubeClusterAccessService("/", "", filePath)
+		clusterAccessDetails := kcs.GetClusterDetails("localhost", 1, true)
+
+		wantClusterAccessDetails := kubernetesClusterAccessData{
+			ClusterServerURL:         "https://localhost/api/endpoints/1/kubernetes",
+			CertificateAuthorityFile: filePath,
+			CertificateAuthorityData: certDataString,
+		}
+
+		is.Equal(wantClusterAccessDetails, clusterAccessDetails)
+	})
+}
diff --git a/api/kubernetes/privateregistries/labels.go b/api/kubernetes/privateregistries/labels.go
new file mode 100644
index 0000000..dc78081
--- /dev/null
+++ b/api/kubernetes/privateregistries/labels.go
@@ -0,0 +1,5 @@
+package privateregistries
+
+const (
+	RegistryIDLabel = "portainer.io/registry.id"
+)
diff --git a/api/kubernetes/snapshot.go b/api/kubernetes/snapshot.go
new file mode 100644
index 0000000..c8f6c2e
--- /dev/null
+++ b/api/kubernetes/snapshot.go
@@ -0,0 +1,28 @@
+package kubernetes
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/kubernetes/cli"
+	"github.com/portainer/portainer/pkg/snapshot"
+)
+
+type Snapshotter struct {
+	clientFactory *cli.ClientFactory
+}
+
+// NewSnapshotter returns a new Snapshotter instance
+func NewSnapshotter(clientFactory *cli.ClientFactory) *Snapshotter {
+	return &Snapshotter{
+		clientFactory: clientFactory,
+	}
+}
+
+// CreateSnapshot creates a snapshot of a specific Kubernetes environment(endpoint)
+func (snapshotter *Snapshotter) CreateSnapshot(endpoint *portainer.Endpoint) (*portainer.KubernetesSnapshot, error) {
+	client, _, err := snapshotter.clientFactory.CreateClient(endpoint)
+	if err != nil {
+		return nil, err
+	}
+
+	return snapshot.CreateKubernetesSnapshot(client)
+}
diff --git a/api/kubernetes/validation/validation.go b/api/kubernetes/validation/validation.go
new file mode 100644
index 0000000..4f3e3d1
--- /dev/null
+++ b/api/kubernetes/validation/validation.go
@@ -0,0 +1,61 @@
+package validation
+
+// borrowed from apimachinery@v0.17.2/pkg/util/validation/validation.go
+// https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/util/validation/validation.go
+
+import (
+	"errors"
+	"fmt"
+	"regexp"
+	"strings"
+)
+
+const dns1123LabelFmt string = "[a-z0-9]([-a-z0-9]*[a-z0-9])?"
+const dns1123SubdomainFmt string = dns1123LabelFmt + "(\\." + dns1123LabelFmt + ")*"
+const DNS1123SubdomainMaxLength int = 253
+
+var dns1123SubdomainRegexp = regexp.MustCompile("^" + dns1123SubdomainFmt + "$")
+
+// IsDNS1123Subdomain tests for a string that conforms to the definition of a subdomain in DNS (RFC 1123).
+func IsDNS1123Subdomain(value string) error {
+	var errs error
+	if len(value) > DNS1123SubdomainMaxLength {
+		errs = errors.Join(errs, MaxLenError(DNS1123SubdomainMaxLength))
+	}
+	if !dns1123SubdomainRegexp.MatchString(value) {
+		errs = errors.Join(errs, RegexError(dns1123SubdomainFmt, "example.com"))
+	}
+	return errs
+}
+
+// MaxLenError returns a string explanation of a "string too long" validation failure.
+func MaxLenError(length int) error {
+	return fmt.Errorf("must be no more than %d characters", length)
+}
+
+// RegexError returns a string explanation of a regex validation failure.
+func RegexError(fmt string, examples ...string) error {
+	var s strings.Builder
+
+	_, _ = s.WriteString("must match the regex ")
+	_, _ = s.WriteString(fmt)
+
+	if len(examples) == 0 {
+		return errors.New(s.String())
+	}
+
+	s.WriteString(" (e.g. ")
+	for i := range examples {
+		if i > 0 {
+			_, _ = s.WriteString(" or ")
+		}
+
+		_, _ = s.WriteRune('\'')
+		_, _ = s.WriteString(examples[i])
+		_, _ = s.WriteRune('\'')
+	}
+
+	_, _ = s.WriteRune(')')
+
+	return errors.New(s.String())
+}
diff --git a/api/kubernetes/yaml.go b/api/kubernetes/yaml.go
new file mode 100644
index 0000000..4b435d1
--- /dev/null
+++ b/api/kubernetes/yaml.go
@@ -0,0 +1,206 @@
+package kubernetes
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"maps"
+	"strconv"
+	"strings"
+
+	"github.com/pkg/errors"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+	"go.yaml.in/yaml/v3"
+)
+
+const (
+	labelPortainerAppStack     = "io.portainer.kubernetes.application.stack"
+	labelPortainerAppStackID   = "io.portainer.kubernetes.application.stackid"
+	labelPortainerAppName      = "io.portainer.kubernetes.application.name"
+	labelPortainerAppOwner     = "io.portainer.kubernetes.application.owner"
+	labelPortainerAppOwnerId   = "io.portainer.kubernetes.application.owner.id"
+	labelPortainerAppKind      = "io.portainer.kubernetes.application.kind"
+	labelPortainerAppStackKind = "io.portainer.kubernetes.application.stackKind"
+)
+
+// KubeAppLabels are labels applied to all resources deployed in a kubernetes stack
+type KubeAppLabels struct {
+	StackID   int
+	StackName string
+	Owner     string
+	OwnerId   string
+	Kind      string
+	StackKind string
+}
+
+// ToMap converts KubeAppLabels to a map[string]string
+func (kal *KubeAppLabels) ToMap() map[string]string {
+	labels := map[string]string{
+		labelPortainerAppStackID: strconv.Itoa(kal.StackID),
+		labelPortainerAppStack:   stackutils.SanitizeLabel(kal.StackName),
+		labelPortainerAppName:    stackutils.SanitizeLabel(kal.StackName),
+		labelPortainerAppOwner:   stackutils.SanitizeLabel(kal.Owner),
+		labelPortainerAppKind:    kal.Kind,
+		labelPortainerAppOwnerId: kal.OwnerId,
+	}
+
+	// Add optional labels only if they are non-empty
+	if kal.StackKind != "" {
+		labels[labelPortainerAppStackKind] = kal.StackKind
+	}
+
+	return labels
+}
+
+// GetHelmAppLabels returns the labels to be applied to portainer deployed helm applications
+func GetHelmAppLabels(name, owner string) map[string]string {
+	return map[string]string{
+		labelPortainerAppName:  name,
+		labelPortainerAppOwner: stackutils.SanitizeLabel(owner),
+	}
+}
+
+// AddAppLabels adds required labels to "Resource"->metadata->labels.
+// It'll add those labels to all Resource (nodes with a kind property exluding a list) it can find in provided yaml.
+// Items in the yaml file could either be organised as a list or broken into multi documents.
+func AddAppLabels(manifestYaml []byte, appLabels map[string]string) ([]byte, error) {
+	if bytes.Equal(manifestYaml, []byte("")) {
+		return manifestYaml, nil
+	}
+
+	postProcessYaml := func(yamlDoc any) error {
+		addResourceLabels(yamlDoc, appLabels)
+		return nil
+	}
+
+	docs, err := ExtractDocuments(manifestYaml, postProcessYaml)
+	if err != nil {
+		return nil, err
+	}
+
+	return bytes.Join(docs, []byte("---\n")), nil
+}
+
+// ExtractDocuments extracts all the documents from a yaml file
+// Optionally post-process each document with a function, which can modify the document in place.
+// Pass in nil for postProcessYaml to skip post-processing.
+func ExtractDocuments(manifestYaml []byte, postProcessYaml func(any) error) ([][]byte, error) {
+	docs := make([][]byte, 0)
+	yamlDecoder := yaml.NewDecoder(bytes.NewReader(manifestYaml))
+
+	for {
+		m := make(map[string]any)
+		err := yamlDecoder.Decode(&m)
+
+		// if there are no more documents in the file
+		if errors.Is(err, io.EOF) {
+			break
+		}
+
+		// if there's any other error, return it
+		if err != nil {
+			return nil, errors.Wrap(err, "failed to decode yaml manifest")
+		}
+
+		// if decoded document is empty, skip to next document
+		if m == nil {
+			continue
+		}
+
+		// optionally post-process yaml
+		if postProcessYaml != nil {
+			if err := postProcessYaml(m); err != nil {
+				return nil, errors.Wrap(err, "failed to post process yaml document")
+			}
+		}
+
+		var out bytes.Buffer
+		yamlEncoder := yaml.NewEncoder(&out)
+		yamlEncoder.SetIndent(2)
+		if err := yamlEncoder.Encode(m); err != nil {
+			return nil, errors.Wrap(err, "failed to marshal yaml manifest")
+		}
+
+		docs = append(docs, out.Bytes())
+	}
+
+	return docs, nil
+}
+
+// GetNamespace returns the namespace of a kubernetes resource from its metadata
+// It returns an empty string if namespace is not found in the resource
+func GetNamespace(manifestYaml []byte) (string, error) {
+	yamlDecoder := yaml.NewDecoder(bytes.NewReader(manifestYaml))
+	m := make(map[string]any)
+	err := yamlDecoder.Decode(&m)
+	if err != nil {
+		return "", errors.Wrap(err, "failed to unmarshal yaml manifest when obtaining namespace")
+	}
+
+	kind, ok := m["kind"].(string)
+	if !ok {
+		return "", errors.New("invalid kubernetes manifest, missing 'kind' field")
+	}
+
+	if _, ok := m["metadata"]; ok {
+		var namespace any
+		var ok bool
+		if strings.EqualFold(kind, "namespace") {
+			namespace, ok = m["metadata"].(map[string]any)["name"]
+		} else {
+			namespace, ok = m["metadata"].(map[string]any)["namespace"]
+		}
+
+		if ok {
+			if v, ok := namespace.(string); ok {
+				return v, nil
+			}
+			return "", errors.New("invalid kubernetes manifest, 'namespace' field is not a string")
+		}
+	}
+	return "", nil
+}
+
+func addResourceLabels(yamlDoc any, appLabels map[string]string) {
+	m, ok := yamlDoc.(map[string]any)
+	if !ok {
+		return
+	}
+
+	kind, ok := m["kind"]
+	if ok && !strings.EqualFold(kind.(string), "list") {
+		addLabels(m, appLabels)
+		return
+	}
+
+	for _, v := range m {
+		switch v := v.(type) {
+		case map[string]any:
+			addResourceLabels(v, appLabels)
+		case []any:
+			for _, item := range v {
+				addResourceLabels(item, appLabels)
+			}
+		}
+	}
+}
+
+func addLabels(obj map[string]any, appLabels map[string]string) {
+	metadata := make(map[string]any)
+	if m, ok := obj["metadata"]; ok {
+		metadata = m.(map[string]any)
+	}
+
+	labels := make(map[string]string)
+	if l, ok := metadata["labels"]; ok {
+		for k, v := range l.(map[string]any) {
+			labels[k] = fmt.Sprintf("%v", v)
+		}
+	}
+
+	// merge app labels with existing labels
+	maps.Copy(labels, appLabels)
+
+	metadata["labels"] = labels
+	obj["metadata"] = metadata
+}
diff --git a/api/kubernetes/yaml_test.go b/api/kubernetes/yaml_test.go
new file mode 100644
index 0000000..bfd0f8f
--- /dev/null
+++ b/api/kubernetes/yaml_test.go
@@ -0,0 +1,823 @@
+package kubernetes
+
+import (
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_AddAppLabels(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name       string
+		input      string
+		wantOutput string
+	}{
+		{
+			name: "single deployment without labels",
+			input: `apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: busybox
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: busybox
+  template:
+    metadata:
+      labels:
+        app: busybox
+    spec:
+      containers:
+        - image: busybox
+          name: busybox
+`,
+			wantOutput: `apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    io.portainer.kubernetes.application.kind: git
+    io.portainer.kubernetes.application.name: best-name
+    io.portainer.kubernetes.application.owner: best-owner
+    io.portainer.kubernetes.application.owner.id: ""
+    io.portainer.kubernetes.application.stack: best-name
+    io.portainer.kubernetes.application.stackid: "123"
+  name: busybox
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: busybox
+  template:
+    metadata:
+      labels:
+        app: busybox
+    spec:
+      containers:
+        - image: busybox
+          name: busybox
+`,
+		},
+		{
+			name: "single deployment with existing labels",
+			input: `apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    foo: bar
+  name: busybox
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: busybox
+  template:
+    metadata:
+      labels:
+        app: busybox
+    spec:
+      containers:
+        - image: busybox
+          name: busybox
+`,
+			wantOutput: `apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    foo: bar
+    io.portainer.kubernetes.application.kind: git
+    io.portainer.kubernetes.application.name: best-name
+    io.portainer.kubernetes.application.owner: best-owner
+    io.portainer.kubernetes.application.owner.id: ""
+    io.portainer.kubernetes.application.stack: best-name
+    io.portainer.kubernetes.application.stackid: "123"
+  name: busybox
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: busybox
+  template:
+    metadata:
+      labels:
+        app: busybox
+    spec:
+      containers:
+        - image: busybox
+          name: busybox
+`,
+		},
+		{
+			name: "complex kompose output",
+			input: `apiVersion: v1
+items:
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      creationTimestamp: null
+      labels:
+        io.kompose.service: web
+      name: web
+    spec:
+      ports:
+        - name: "5000"
+          port: 5000
+          targetPort: 5000
+      selector:
+        io.kompose.service: web
+    status:
+      loadBalancer: {}
+  - apiVersion: apps/v1
+    kind: Deployment
+    metadata:
+      creationTimestamp: null
+      labels:
+        io.kompose.service: redis
+      name: redis
+    spec:
+      replicas: 1
+      selector:
+        matchLabels:
+          io.kompose.service: redis
+      strategy: {}
+      template:
+        metadata:
+          creationTimestamp: null
+          labels:
+            io.kompose.service: redis
+    status: {}
+  - apiVersion: apps/v1
+    kind: Deployment
+    metadata:
+      creationTimestamp: null
+      name: web
+    spec:
+      replicas: 1
+      selector:
+        matchLabels:
+          io.kompose.service: web
+      strategy:
+        type: Recreate
+      template:
+        metadata:
+          creationTimestamp: null
+          labels:
+            io.kompose.service: web
+    status: {}
+kind: List
+metadata: {}
+`,
+			wantOutput: `apiVersion: v1
+items:
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      creationTimestamp: null
+      labels:
+        io.kompose.service: web
+        io.portainer.kubernetes.application.kind: git
+        io.portainer.kubernetes.application.name: best-name
+        io.portainer.kubernetes.application.owner: best-owner
+        io.portainer.kubernetes.application.owner.id: ""
+        io.portainer.kubernetes.application.stack: best-name
+        io.portainer.kubernetes.application.stackid: "123"
+      name: web
+    spec:
+      ports:
+        - name: "5000"
+          port: 5000
+          targetPort: 5000
+      selector:
+        io.kompose.service: web
+    status:
+      loadBalancer: {}
+  - apiVersion: apps/v1
+    kind: Deployment
+    metadata:
+      creationTimestamp: null
+      labels:
+        io.kompose.service: redis
+        io.portainer.kubernetes.application.kind: git
+        io.portainer.kubernetes.application.name: best-name
+        io.portainer.kubernetes.application.owner: best-owner
+        io.portainer.kubernetes.application.owner.id: ""
+        io.portainer.kubernetes.application.stack: best-name
+        io.portainer.kubernetes.application.stackid: "123"
+      name: redis
+    spec:
+      replicas: 1
+      selector:
+        matchLabels:
+          io.kompose.service: redis
+      strategy: {}
+      template:
+        metadata:
+          creationTimestamp: null
+          labels:
+            io.kompose.service: redis
+    status: {}
+  - apiVersion: apps/v1
+    kind: Deployment
+    metadata:
+      creationTimestamp: null
+      labels:
+        io.portainer.kubernetes.application.kind: git
+        io.portainer.kubernetes.application.name: best-name
+        io.portainer.kubernetes.application.owner: best-owner
+        io.portainer.kubernetes.application.owner.id: ""
+        io.portainer.kubernetes.application.stack: best-name
+        io.portainer.kubernetes.application.stackid: "123"
+      name: web
+    spec:
+      replicas: 1
+      selector:
+        matchLabels:
+          io.kompose.service: web
+      strategy:
+        type: Recreate
+      template:
+        metadata:
+          creationTimestamp: null
+          labels:
+            io.kompose.service: web
+    status: {}
+kind: List
+metadata: {}
+`,
+		},
+		{
+			name: "multiple items separated by ---",
+			input: `apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: busybox
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: busybox
+  template:
+    metadata:
+      labels:
+        app: busybox
+    spec:
+      containers:
+        - image: busybox
+          name: busybox
+---
+apiVersion: v1
+kind: Service
+metadata:
+  creationTimestamp: null
+  labels:
+    io.kompose.service: web
+  name: web
+spec:
+  ports:
+    - name: "5000"
+      port: 5000
+      targetPort: 5000
+  selector:
+    io.kompose.service: web
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    foo: bar
+  name: busybox
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: busybox
+  template:
+    metadata:
+      labels:
+        app: busybox
+    spec:
+      containers:
+        - image: busybox
+          name: busybox
+`,
+			wantOutput: `apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    io.portainer.kubernetes.application.kind: git
+    io.portainer.kubernetes.application.name: best-name
+    io.portainer.kubernetes.application.owner: best-owner
+    io.portainer.kubernetes.application.owner.id: ""
+    io.portainer.kubernetes.application.stack: best-name
+    io.portainer.kubernetes.application.stackid: "123"
+  name: busybox
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: busybox
+  template:
+    metadata:
+      labels:
+        app: busybox
+    spec:
+      containers:
+        - image: busybox
+          name: busybox
+---
+apiVersion: v1
+kind: Service
+metadata:
+  creationTimestamp: null
+  labels:
+    io.kompose.service: web
+    io.portainer.kubernetes.application.kind: git
+    io.portainer.kubernetes.application.name: best-name
+    io.portainer.kubernetes.application.owner: best-owner
+    io.portainer.kubernetes.application.owner.id: ""
+    io.portainer.kubernetes.application.stack: best-name
+    io.portainer.kubernetes.application.stackid: "123"
+  name: web
+spec:
+  ports:
+    - name: "5000"
+      port: 5000
+      targetPort: 5000
+  selector:
+    io.kompose.service: web
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    foo: bar
+    io.portainer.kubernetes.application.kind: git
+    io.portainer.kubernetes.application.name: best-name
+    io.portainer.kubernetes.application.owner: best-owner
+    io.portainer.kubernetes.application.owner.id: ""
+    io.portainer.kubernetes.application.stack: best-name
+    io.portainer.kubernetes.application.stackid: "123"
+  name: busybox
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: busybox
+  template:
+    metadata:
+      labels:
+        app: busybox
+    spec:
+      containers:
+        - image: busybox
+          name: busybox
+`,
+		},
+		{
+			name:       "empty",
+			input:      "",
+			wantOutput: "",
+		},
+		{
+			name: "no only deployments",
+			input: `apiVersion: v1
+kind: Service
+metadata:
+  creationTimestamp: null
+  labels:
+    io.kompose.service: web
+  name: web
+spec:
+  ports:
+    - name: "5000"
+      port: 5000
+      targetPort: 5000
+  selector:
+    io.kompose.service: web
+`,
+			wantOutput: `apiVersion: v1
+kind: Service
+metadata:
+  creationTimestamp: null
+  labels:
+    io.kompose.service: web
+    io.portainer.kubernetes.application.kind: git
+    io.portainer.kubernetes.application.name: best-name
+    io.portainer.kubernetes.application.owner: best-owner
+    io.portainer.kubernetes.application.owner.id: ""
+    io.portainer.kubernetes.application.stack: best-name
+    io.portainer.kubernetes.application.stackid: "123"
+  name: web
+spec:
+  ports:
+    - name: "5000"
+      port: 5000
+      targetPort: 5000
+  selector:
+    io.kompose.service: web
+`,
+		},
+	}
+
+	labels := KubeAppLabels{
+		StackID:   123,
+		StackName: "best-name",
+		Owner:     "best-owner",
+		Kind:      "git",
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result, err := AddAppLabels([]byte(tt.input), labels.ToMap())
+			require.NoError(t, err)
+			assert.Equal(t, tt.wantOutput, string(result))
+		})
+	}
+}
+
+func Test_AddAppLabels_HelmApp(t *testing.T) {
+	t.Parallel()
+	labels := GetHelmAppLabels("best-name", "best-owner")
+
+	tests := []struct {
+		name       string
+		input      string
+		wantOutput string
+	}{
+		{
+			name: "bitnami nginx configmap",
+			input: `apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: nginx-test-server-block
+  labels:
+    app.kubernetes.io/name: nginx
+    helm.sh/chart: nginx-9.5.4
+    app.kubernetes.io/instance: nginx-test
+    app.kubernetes.io/managed-by: Helm
+data:
+  server-blocks-paths.conf: |-
+    include  "/opt/bitnami/nginx/conf/server_blocks/ldap/*.conf";
+    include  "/opt/bitnami/nginx/conf/server_blocks/common/*.conf";
+`,
+			wantOutput: `apiVersion: v1
+data:
+  server-blocks-paths.conf: |-
+    include  "/opt/bitnami/nginx/conf/server_blocks/ldap/*.conf";
+    include  "/opt/bitnami/nginx/conf/server_blocks/common/*.conf";
+kind: ConfigMap
+metadata:
+  labels:
+    app.kubernetes.io/instance: nginx-test
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: nginx
+    helm.sh/chart: nginx-9.5.4
+    io.portainer.kubernetes.application.name: best-name
+    io.portainer.kubernetes.application.owner: best-owner
+  name: nginx-test-server-block
+`,
+		},
+		{
+			name: "bitnami nginx service",
+			input: `apiVersion: v1
+kind: Service
+metadata:
+  name: nginx-test
+  labels:
+    app.kubernetes.io/name: nginx
+    helm.sh/chart: nginx-9.5.4
+    app.kubernetes.io/instance: nginx-test
+    app.kubernetes.io/managed-by: Helm
+spec:
+  type: LoadBalancer
+  externalTrafficPolicy: "Cluster"
+  ports:
+    - name: http
+      port: 80
+      targetPort: http
+  selector:
+    app.kubernetes.io/name: nginx
+    app.kubernetes.io/instance: nginx-test
+`,
+			wantOutput: `apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/instance: nginx-test
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: nginx
+    helm.sh/chart: nginx-9.5.4
+    io.portainer.kubernetes.application.name: best-name
+    io.portainer.kubernetes.application.owner: best-owner
+  name: nginx-test
+spec:
+  externalTrafficPolicy: Cluster
+  ports:
+    - name: http
+      port: 80
+      targetPort: http
+  selector:
+    app.kubernetes.io/instance: nginx-test
+    app.kubernetes.io/name: nginx
+  type: LoadBalancer
+`,
+		},
+		{
+			name: "bitnami nginx deployment",
+			input: `apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx-test
+  labels:
+    app.kubernetes.io/name: nginx
+    helm.sh/chart: nginx-9.5.4
+    app.kubernetes.io/instance: nginx-test
+    app.kubernetes.io/managed-by: Helm
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: nginx
+      app.kubernetes.io/instance: nginx-test
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: nginx
+        helm.sh/chart: nginx-9.5.4
+        app.kubernetes.io/instance: nginx-test
+        app.kubernetes.io/managed-by: Helm
+    spec:
+      automountServiceAccountToken: false
+      shareProcessNamespace: false
+      serviceAccountName: default
+      containers:
+        - name: nginx
+          image: docker.io/bitnami/nginx:1.21.3-debian-10-r0
+          imagePullPolicy: "IfNotPresent"
+`,
+			wantOutput: `apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app.kubernetes.io/instance: nginx-test
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: nginx
+    helm.sh/chart: nginx-9.5.4
+    io.portainer.kubernetes.application.name: best-name
+    io.portainer.kubernetes.application.owner: best-owner
+  name: nginx-test
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: nginx-test
+      app.kubernetes.io/name: nginx
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: nginx-test
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: nginx
+        helm.sh/chart: nginx-9.5.4
+    spec:
+      automountServiceAccountToken: false
+      containers:
+        - image: docker.io/bitnami/nginx:1.21.3-debian-10-r0
+          imagePullPolicy: IfNotPresent
+          name: nginx
+      serviceAccountName: default
+      shareProcessNamespace: false
+`,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result, err := AddAppLabels([]byte(tt.input), labels)
+			require.NoError(t, err)
+			assert.Equal(t, tt.wantOutput, string(result))
+		})
+	}
+}
+
+func Test_DocumentSeperator(t *testing.T) {
+	t.Parallel()
+	labels := KubeAppLabels{
+		StackID:   123,
+		StackName: "best-name",
+		Owner:     "best-owner",
+		Kind:      "git",
+	}
+
+	input := `apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    io.kompose.service: database
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    io.kompose.service: backend
+`
+	expected := `apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    io.kompose.service: database
+    io.portainer.kubernetes.application.kind: git
+    io.portainer.kubernetes.application.name: best-name
+    io.portainer.kubernetes.application.owner: best-owner
+    io.portainer.kubernetes.application.owner.id: ""
+    io.portainer.kubernetes.application.stack: best-name
+    io.portainer.kubernetes.application.stackid: "123"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    io.kompose.service: backend
+    io.portainer.kubernetes.application.kind: git
+    io.portainer.kubernetes.application.name: best-name
+    io.portainer.kubernetes.application.owner: best-owner
+    io.portainer.kubernetes.application.owner.id: ""
+    io.portainer.kubernetes.application.stack: best-name
+    io.portainer.kubernetes.application.stackid: "123"
+`
+	result, err := AddAppLabels([]byte(input), labels.ToMap())
+	require.NoError(t, err)
+	assert.Equal(t, expected, string(result))
+}
+
+func Test_GetNamespace(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name  string
+		input string
+		want  string
+	}{
+		{
+			name: "valid namespace",
+			input: `apiVersion: v1
+kind: Namespace
+metadata:
+  name: test-namespace
+`,
+			want: "test-namespace",
+		},
+		{
+			name: "invalid namespace",
+			input: `apiVersion: v1
+kind: Namespace
+`,
+			want: "",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result, err := GetNamespace([]byte(tt.input))
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, result)
+		})
+	}
+}
+
+func Test_ExtractDocuments(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name  string
+		input string
+		want  []string
+	}{
+		{
+			name: "multiple documents",
+			input: `apiVersion: v1
+kind: Namespace
+---
+apiVersion: v1
+kind: Service
+`,
+			want: []string{`apiVersion: v1
+kind: Namespace
+`, `apiVersion: v1
+kind: Service
+`},
+		},
+		{
+			name: "single document",
+			input: `apiVersion: v1
+kind: Namespace
+`,
+			want: []string{`apiVersion: v1
+kind: Namespace
+`},
+		},
+		{
+			name: "empty document separator is skipped",
+			input: `apiVersion: v1
+kind: Namespace
+---
+---
+apiVersion: v1
+kind: Service
+`,
+			want: []string{`apiVersion: v1
+kind: Namespace
+`, `apiVersion: v1
+kind: Service
+`},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			results, err := ExtractDocuments([]byte(tt.input), nil)
+			require.NoError(t, err)
+
+			for i := range results {
+				assert.Equal(t, tt.want[i], string(results[i]))
+			}
+		})
+	}
+}
+
+func Test_ExtractDocuments_PostProcess(t *testing.T) {
+	t.Parallel()
+
+	input := `apiVersion: v1
+kind: Namespace
+metadata:
+  name: test
+`
+
+	t.Run("post-process callback is applied to each document", func(t *testing.T) {
+		called := 0
+		result, err := ExtractDocuments([]byte(input), func(doc any) error {
+			called++
+			m := doc.(map[string]any)
+			m["injected"] = "value"
+			return nil
+		})
+		require.NoError(t, err)
+		assert.Equal(t, 1, called)
+		assert.Contains(t, string(result[0]), "injected")
+	})
+
+	t.Run("post-process callback error is returned", func(t *testing.T) {
+		_, err := ExtractDocuments([]byte(input), func(any) error {
+			return errors.New("post-process failed")
+		})
+		require.ErrorContains(t, err, "post-process failed")
+	})
+}
+
+// Test_ExtractDocuments_MalformedYAML is a regression test for the infinite loop
+// described in https://github.com/portainer/portainer/issues/13051.
+// Previously, a malformed YAML document (bad indentation) caused Decode() to
+// return both err != nil and m == nil. The pre-fix implementation checked
+// m == nil first and continued, skipping the EOF check and looping forever.
+func Test_ExtractDocuments_MalformedYAML(t *testing.T) {
+	malformedYAML := `---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: error
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: error
+  template:
+    metadata:
+      labels:
+        app: error
+    spec:
+      containers:
+        - name: alpine
+          image: alpine:latest
+          command: [ "/bin/bash", "-c" ]
+          args:
+            - |
+            echo "crash"
+`
+
+	done := make(chan error, 1)
+	go func() {
+		_, err := ExtractDocuments([]byte(malformedYAML), nil)
+		done <- err
+	}()
+
+	select {
+	case err := <-done:
+		// Should return an error, not hang
+		require.Error(t, err, "expected an error for malformed YAML, not a hang")
+	case <-time.After(3 * time.Second):
+		t.Fatal("ExtractDocuments hung on malformed YAML (infinite loop — issue #13051 reproduced)")
+	}
+}
diff --git a/api/ldap/ldap.go b/api/ldap/ldap.go
new file mode 100644
index 0000000..0b38714
--- /dev/null
+++ b/api/ldap/ldap.go
@@ -0,0 +1,331 @@
+package ldap
+
+import (
+	"fmt"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/crypto"
+	httperrors "github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/api/logs"
+
+	ldap "github.com/go-ldap/ldap/v3"
+	"github.com/pkg/errors"
+)
+
+var (
+	// errUserNotFound defines an error raised when the user is not found via LDAP search
+	// or that too many entries (> 1) are returned.
+	errUserNotFound = errors.New("User not found or too many entries returned")
+)
+
+// Service represents a service used to authenticate users against a LDAP/AD.
+type Service struct{}
+
+func createConnection(settings *portainer.LDAPSettings) (*ldap.Conn, error) {
+	conn, err := createConnectionForURL(settings.URL, settings)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed creating LDAP connection")
+	}
+
+	return conn, nil
+}
+
+func createConnectionForURL(url string, settings *portainer.LDAPSettings) (*ldap.Conn, error) {
+	if !settings.TLSConfig.TLS && !settings.StartTLS {
+		return ldap.Dial("tcp", url)
+	}
+
+	// Store the original value to ensure the TLSConfig is created
+	t := settings.TLSConfig.TLS
+	settings.TLSConfig.TLS = settings.TLSConfig.TLS || settings.StartTLS
+
+	config, err := crypto.CreateTLSConfigurationFromDisk(settings.TLSConfig)
+	if err != nil {
+		return nil, err
+	}
+
+	// Restore the original value
+	settings.TLSConfig.TLS = t
+
+	if settings.TLSConfig.TLS || settings.StartTLS {
+		config.ServerName = strings.Split(url, ":")[0]
+	}
+
+	if settings.TLSConfig.TLS {
+		return ldap.DialTLS("tcp", url, config)
+	}
+
+	conn, err := ldap.Dial("tcp", url)
+	if err != nil {
+		return nil, err
+	}
+
+	if err := conn.StartTLS(config); err != nil {
+		return nil, err
+	}
+
+	return conn, nil
+}
+
+// AuthenticateUser is used to authenticate a user against a LDAP/AD.
+func (Service) AuthenticateUser(username, password string, settings *portainer.LDAPSettings) error {
+	connection, err := createConnection(settings)
+	if err != nil {
+		return err
+	}
+	defer logs.CloseAndLogErr(connection)
+
+	if !settings.AnonymousMode {
+		err = connection.Bind(settings.ReaderDN, settings.Password)
+		if err != nil {
+			return err
+		}
+	}
+
+	userDN, err := searchUser(username, connection, settings.SearchSettings)
+	if err != nil {
+		if errors.Is(err, errUserNotFound) {
+			// prevent user enumeration timing attack by attempting the bind with a fake user
+			// and whatever password was provided should definitely fail
+			// https://en.wikipedia.org/wiki/Timing_attack
+			userDN = "portainer-fake-ldap-username"
+		} else {
+			return err
+		}
+	}
+
+	err = connection.Bind(userDN, password)
+	if err != nil {
+		return httperrors.ErrUnauthorized
+	}
+
+	return nil
+}
+
+// GetUserGroups is used to retrieve user groups from LDAP/AD.
+func (Service) GetUserGroups(username string, settings *portainer.LDAPSettings) ([]string, error) {
+	connection, err := createConnection(settings)
+	if err != nil {
+		return nil, err
+	}
+	defer logs.CloseAndLogErr(connection)
+
+	if !settings.AnonymousMode {
+		err = connection.Bind(settings.ReaderDN, settings.Password)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	userDN, err := searchUser(username, connection, settings.SearchSettings)
+	if err != nil {
+		return nil, err
+	}
+
+	userGroups := getGroupsByUser(userDN, connection, settings.GroupSearchSettings)
+
+	return userGroups, nil
+}
+
+// SearchUsers searches for users with the specified settings
+func (Service) SearchUsers(settings *portainer.LDAPSettings) ([]string, error) {
+	connection, err := createConnection(settings)
+	if err != nil {
+		return nil, err
+	}
+	defer logs.CloseAndLogErr(connection)
+
+	if !settings.AnonymousMode {
+		err = connection.Bind(settings.ReaderDN, settings.Password)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	users := map[string]bool{}
+
+	for _, searchSettings := range settings.SearchSettings {
+		searchRequest := ldap.NewSearchRequest(
+			searchSettings.BaseDN,
+			ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
+			searchSettings.Filter,
+			[]string{"dn", searchSettings.UserNameAttribute},
+			nil,
+		)
+
+		sr, err := connection.Search(searchRequest)
+		if err != nil {
+			return nil, err
+		}
+
+		for _, user := range sr.Entries {
+			username := user.GetAttributeValue(searchSettings.UserNameAttribute)
+			if username != "" {
+				users[username] = true
+			}
+		}
+	}
+
+	usersList := []string{}
+	for user := range users {
+		usersList = append(usersList, user)
+	}
+
+	return usersList, nil
+}
+
+// SearchGroups searches for groups with the specified settings
+func (Service) SearchGroups(settings *portainer.LDAPSettings) ([]portainer.LDAPUser, error) {
+	type groupSet map[string]bool
+
+	connection, err := createConnection(settings)
+	if err != nil {
+		return nil, err
+	}
+	defer logs.CloseAndLogErr(connection)
+
+	if !settings.AnonymousMode {
+		err = connection.Bind(settings.ReaderDN, settings.Password)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	userGroups := map[string]groupSet{}
+
+	for _, searchSettings := range settings.GroupSearchSettings {
+		searchRequest := ldap.NewSearchRequest(
+			searchSettings.GroupBaseDN,
+			ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
+			searchSettings.GroupFilter,
+			[]string{"cn", searchSettings.GroupAttribute},
+			nil,
+		)
+
+		sr, err := connection.Search(searchRequest)
+		if err != nil {
+			return nil, err
+		}
+
+		for _, entry := range sr.Entries {
+			members := entry.GetAttributeValues(searchSettings.GroupAttribute)
+			for _, username := range members {
+				_, ok := userGroups[username]
+				if !ok {
+					userGroups[username] = groupSet{}
+				}
+				userGroups[username][entry.GetAttributeValue("cn")] = true
+			}
+		}
+	}
+
+	users := []portainer.LDAPUser{}
+
+	for username, groups := range userGroups {
+		groupList := []string{}
+		for group := range groups {
+			groupList = append(groupList, group)
+		}
+		user := portainer.LDAPUser{
+			Name:   username,
+			Groups: groupList,
+		}
+		users = append(users, user)
+	}
+
+	return users, nil
+}
+
+func searchUser(username string, conn *ldap.Conn, settings []portainer.LDAPSearchSettings) (string, error) {
+	var userDN string
+	found := false
+	usernameEscaped := ldap.EscapeFilter(username)
+
+	for _, searchSettings := range settings {
+		searchRequest := ldap.NewSearchRequest(
+			searchSettings.BaseDN,
+			ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
+			fmt.Sprintf("(&%s(%s=%s))", searchSettings.Filter, searchSettings.UserNameAttribute, usernameEscaped),
+			[]string{"dn"},
+			nil,
+		)
+
+		// Deliberately skip errors on the search request so that we can jump to other search settings
+		// if any issue arise with the current one.
+		sr, err := conn.Search(searchRequest)
+		if err != nil {
+			continue
+		}
+
+		if len(sr.Entries) == 1 {
+			found = true
+			userDN = sr.Entries[0].DN
+			break
+		}
+	}
+
+	if !found {
+		return "", errUserNotFound
+	}
+
+	return userDN, nil
+}
+
+// Get a list of group names for specified user from LDAP/AD
+func getGroupsByUser(userDN string, conn *ldap.Conn, settings []portainer.LDAPGroupSearchSettings) []string {
+	groups := make([]string, 0)
+	userDNEscaped := ldap.EscapeFilter(userDN)
+
+	for _, searchSettings := range settings {
+		searchRequest := ldap.NewSearchRequest(
+			searchSettings.GroupBaseDN,
+			ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
+			fmt.Sprintf("(&%s(%s=%s))", searchSettings.GroupFilter, searchSettings.GroupAttribute, userDNEscaped),
+			[]string{"cn"},
+			nil,
+		)
+
+		// Deliberately skip errors on the search request so that we can jump to other search settings
+		// if any issue arise with the current one.
+		sr, err := conn.Search(searchRequest)
+		if err != nil {
+			continue
+		}
+
+		for _, entry := range sr.Entries {
+			for _, attr := range entry.Attributes {
+				if len(attr.Values) > 0 {
+					groups = append(groups, attr.Values[0])
+				}
+			}
+		}
+	}
+
+	return groups
+}
+
+// TestConnectivity is used to test a connection against the LDAP server using the credentials
+// specified in the LDAPSettings.
+func (Service) TestConnectivity(settings *portainer.LDAPSettings) error {
+	connection, err := createConnection(settings)
+	if err != nil {
+		return err
+	}
+	defer logs.CloseAndLogErr(connection)
+
+	if !settings.AnonymousMode {
+		err = connection.Bind(settings.ReaderDN, settings.Password)
+		if err != nil {
+			return err
+		}
+
+	} else {
+		err = connection.UnauthenticatedBind("")
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
diff --git a/api/ldap/ldap_test.go b/api/ldap/ldap_test.go
new file mode 100644
index 0000000..071a7ab
--- /dev/null
+++ b/api/ldap/ldap_test.go
@@ -0,0 +1,97 @@
+package ldap
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/pkg/fips"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestCreateConnectionForURL(t *testing.T) {
+	t.Parallel()
+	fips.InitFIPS(false)
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {}))
+	defer srv.Close()
+
+	tlsSrv := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {}))
+	defer tlsSrv.Close()
+
+	srvURL, err := url.Parse(tlsSrv.URL)
+	require.NoError(t, err)
+
+	// TCP
+
+	settings := &portainer.LDAPSettings{
+		URL: srvURL.Host,
+	}
+
+	conn, err := createConnectionForURL(settings.URL, settings)
+	require.NoError(t, err)
+	require.NotNil(t, conn)
+	err = conn.Close()
+	require.NoError(t, err)
+
+	// TLS
+
+	settings.TLSConfig = portainer.TLSConfiguration{
+		TLS:           true,
+		TLSSkipVerify: true,
+	}
+
+	conn, err = createConnectionForURL(settings.URL, settings)
+	require.NoError(t, err)
+	require.NotNil(t, conn)
+	err = conn.Close()
+	require.NoError(t, err)
+
+	// Invalid TLS
+
+	settings.TLSConfig = portainer.TLSConfiguration{
+		TLS:           true,
+		TLSSkipVerify: true,
+		TLSCertPath:   "/invalid/path/cert",
+		TLSKeyPath:    "/invalid/path/key",
+	}
+
+	conn, err = createConnectionForURL(settings.URL, settings)
+	require.Error(t, err)
+	require.Nil(t, conn)
+
+	// StartTLS
+
+	settings.TLSConfig.TLS = false
+	settings.StartTLS = true
+
+	conn, err = createConnectionForURL(settings.URL, settings)
+	require.Error(t, err)
+	require.Nil(t, conn)
+}
+
+func TestFailures(t *testing.T) {
+	t.Parallel()
+	s := Service{}
+
+	err := s.AuthenticateUser("username", "password", &portainer.LDAPSettings{})
+	require.Error(t, err)
+
+	uGroups, err := s.GetUserGroups("username", &portainer.LDAPSettings{})
+	require.Error(t, err)
+	require.Empty(t, uGroups)
+
+	users, err := s.SearchUsers(&portainer.LDAPSettings{})
+	require.Error(t, err)
+	require.Empty(t, users)
+
+	groups, err := s.SearchGroups(&portainer.LDAPSettings{})
+	require.Error(t, err)
+	require.Empty(t, groups)
+
+	err = s.TestConnectivity(&portainer.LDAPSettings{})
+	require.Error(t, err)
+}
diff --git a/api/logoutcontext/logout_context.go b/api/logoutcontext/logout_context.go
new file mode 100644
index 0000000..ea172ba
--- /dev/null
+++ b/api/logoutcontext/logout_context.go
@@ -0,0 +1,20 @@
+package logoutcontext
+
+import (
+	"context"
+)
+
+const LogoutPrefix = "logout-"
+
+func GetContext(token string) context.Context {
+	return GetService(logoutToken(token)).GetLogoutCtx()
+}
+
+func Cancel(token string) {
+	GetService(logoutToken(token)).Cancel()
+	RemoveService(logoutToken(token))
+}
+
+func logoutToken(token string) string {
+	return LogoutPrefix + token
+}
diff --git a/api/logoutcontext/logoutcontext_test.go b/api/logoutcontext/logoutcontext_test.go
new file mode 100644
index 0000000..203d83b
--- /dev/null
+++ b/api/logoutcontext/logoutcontext_test.go
@@ -0,0 +1,106 @@
+package logoutcontext
+
+import (
+	"context"
+	"sync"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetContext_ReturnsActiveContext(t *testing.T) {
+	t.Parallel()
+
+	token := "token-get-context-active"
+	defer Cancel(token)
+
+	ctx := GetContext(token)
+	require.NoError(t, ctx.Err())
+}
+
+func TestCancel_CancelsContext(t *testing.T) {
+	t.Parallel()
+
+	token := "token-cancel"
+
+	ctx := GetContext(token)
+	require.NoError(t, ctx.Err())
+
+	Cancel(token)
+
+	require.ErrorIs(t, ctx.Err(), context.Canceled)
+}
+
+func TestCancel_RemovesService(t *testing.T) {
+	t.Parallel()
+
+	token := "token-cancel-removes"
+
+	first := GetContext(token)
+	Cancel(token)
+
+	second := GetContext(token)
+	defer Cancel(token)
+
+	require.ErrorIs(t, first.Err(), context.Canceled)
+	require.NoError(t, second.Err())
+	require.NotEqual(t, first, second)
+}
+
+func TestGetService_ReturnsSameServiceForSameToken(t *testing.T) {
+	t.Parallel()
+
+	token := logoutToken("token-same-service")
+	defer RemoveService(token)
+
+	s1 := GetService(token)
+	s2 := GetService(token)
+
+	require.Same(t, s1, s2)
+}
+
+func TestGetService_ReturnsDistinctServicesForDifferentTokens(t *testing.T) {
+	t.Parallel()
+
+	tokenA := logoutToken("token-distinct-a")
+	tokenB := logoutToken("token-distinct-b")
+	defer RemoveService(tokenA)
+	defer RemoveService(tokenB)
+
+	sA := GetService(tokenA)
+	sB := GetService(tokenB)
+
+	require.NotSame(t, sA, sB)
+}
+
+func TestGetService_ConcurrentAccess(t *testing.T) {
+	t.Parallel()
+
+	const goroutines = 50
+	token := logoutToken("token-concurrent")
+	defer RemoveService(token)
+
+	var wg sync.WaitGroup
+	services := make([]*Service, goroutines)
+
+	for i := range goroutines {
+		wg.Add(1)
+		go func(i int) {
+			defer wg.Done()
+			services[i] = GetService(token)
+		}(i)
+	}
+
+	wg.Wait()
+
+	for i := 1; i < goroutines; i++ {
+		require.Same(t, services[0], services[i])
+	}
+}
+
+func TestLogoutToken_AddsPrefix(t *testing.T) {
+	t.Parallel()
+
+	result := logoutToken("abc123")
+	require.Equal(t, LogoutPrefix+"abc123", result)
+}
diff --git a/api/logoutcontext/service.go b/api/logoutcontext/service.go
new file mode 100644
index 0000000..d608b0e
--- /dev/null
+++ b/api/logoutcontext/service.go
@@ -0,0 +1,28 @@
+package logoutcontext
+
+import (
+	"context"
+)
+
+type (
+	Service struct {
+		ctx    context.Context
+		cancel context.CancelFunc
+	}
+)
+
+func NewService() *Service {
+	ctx, cancel := context.WithCancel(context.Background())
+	return &Service{
+		ctx:    ctx,
+		cancel: cancel,
+	}
+}
+
+func (s *Service) Cancel() {
+	s.cancel()
+}
+
+func (s *Service) GetLogoutCtx() context.Context {
+	return s.ctx
+}
diff --git a/api/logoutcontext/service_factory.go b/api/logoutcontext/service_factory.go
new file mode 100644
index 0000000..c01e4ae
--- /dev/null
+++ b/api/logoutcontext/service_factory.go
@@ -0,0 +1,34 @@
+package logoutcontext
+
+import "sync"
+
+type (
+	ServiceFactory struct {
+		mu       sync.Mutex
+		services map[string]*Service
+	}
+)
+
+var serviceFactory = ServiceFactory{
+	services: make(map[string]*Service),
+}
+
+func GetService(token string) *Service {
+	serviceFactory.mu.Lock()
+	defer serviceFactory.mu.Unlock()
+
+	service, ok := serviceFactory.services[token]
+	if !ok {
+		service = NewService()
+		serviceFactory.services[token] = service
+	}
+
+	return service
+}
+
+func RemoveService(token string) {
+	serviceFactory.mu.Lock()
+	defer serviceFactory.mu.Unlock()
+
+	delete(serviceFactory.services, token)
+}
diff --git a/api/logs/log.go b/api/logs/log.go
new file mode 100644
index 0000000..1c6ff74
--- /dev/null
+++ b/api/logs/log.go
@@ -0,0 +1,70 @@
+package logs
+
+import (
+	"fmt"
+	"io"
+	stdlog "log"
+	"os"
+
+	"github.com/rs/zerolog"
+	"github.com/rs/zerolog/log"
+	"github.com/rs/zerolog/pkgerrors"
+)
+
+func ConfigureLogger() {
+	zerolog.ErrorStackFieldName = "stack_trace"
+	zerolog.ErrorStackMarshaler = pkgerrors.MarshalStack
+	zerolog.TimeFieldFormat = zerolog.TimeFormatUnix
+
+	stdlog.SetFlags(0)
+	stdlog.SetOutput(log.Logger)
+
+	log.Logger = log.Logger.With().Caller().Stack().Logger()
+}
+
+func SetLoggingLevel(level string) {
+	switch level {
+	case "ERROR":
+		zerolog.SetGlobalLevel(zerolog.ErrorLevel)
+	case "WARN":
+		zerolog.SetGlobalLevel(zerolog.WarnLevel)
+	case "INFO":
+		zerolog.SetGlobalLevel(zerolog.InfoLevel)
+	case "DEBUG":
+		zerolog.SetGlobalLevel(zerolog.DebugLevel)
+	}
+}
+
+func SetLoggingMode(mode string) {
+	switch mode {
+	case "PRETTY":
+		log.Logger = log.Output(zerolog.ConsoleWriter{
+			Out:           os.Stderr,
+			TimeFormat:    "2006/01/02 03:04PM",
+			FormatMessage: formatMessage,
+		})
+	case "NOCOLOR":
+		log.Logger = log.Output(zerolog.ConsoleWriter{
+			Out:           os.Stderr,
+			TimeFormat:    "2006/01/02 03:04PM",
+			FormatMessage: formatMessage,
+			NoColor:       true,
+		})
+	case "JSON":
+		log.Logger = log.Output(os.Stderr)
+	}
+}
+
+func formatMessage(i any) string {
+	if i == nil {
+		return ""
+	}
+
+	return fmt.Sprintf("%s |", i)
+}
+
+func CloseAndLogErr(c io.Closer) {
+	if err := c.Close(); err != nil {
+		log.Error().Err(err).Msg("failure to close resource")
+	}
+}
diff --git a/api/logs/log_test.go b/api/logs/log_test.go
new file mode 100644
index 0000000..e3034e8
--- /dev/null
+++ b/api/logs/log_test.go
@@ -0,0 +1,111 @@
+package logs
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/rs/zerolog"
+	"github.com/rs/zerolog/log"
+
+	"github.com/stretchr/testify/require"
+)
+
+func saveGlobalLevel(t *testing.T) {
+	t.Helper()
+	orig := zerolog.GlobalLevel()
+	t.Cleanup(func() { zerolog.SetGlobalLevel(orig) })
+}
+
+func saveLogger(t *testing.T) {
+	t.Helper()
+	orig := log.Logger
+	t.Cleanup(func() { log.Logger = orig })
+}
+
+func TestSetLoggingLevel_Error(t *testing.T) {
+	saveGlobalLevel(t)
+
+	SetLoggingLevel("ERROR")
+	require.Equal(t, zerolog.ErrorLevel, zerolog.GlobalLevel())
+}
+
+func TestSetLoggingLevel_Warn(t *testing.T) {
+	saveGlobalLevel(t)
+
+	SetLoggingLevel("WARN")
+	require.Equal(t, zerolog.WarnLevel, zerolog.GlobalLevel())
+}
+
+func TestSetLoggingLevel_Info(t *testing.T) {
+	saveGlobalLevel(t)
+
+	SetLoggingLevel("INFO")
+	require.Equal(t, zerolog.InfoLevel, zerolog.GlobalLevel())
+}
+
+func TestSetLoggingLevel_Debug(t *testing.T) {
+	saveGlobalLevel(t)
+
+	SetLoggingLevel("DEBUG")
+	require.Equal(t, zerolog.DebugLevel, zerolog.GlobalLevel())
+}
+
+func TestSetLoggingLevel_UnknownLevelIsNoop(t *testing.T) {
+	saveGlobalLevel(t)
+
+	zerolog.SetGlobalLevel(zerolog.InfoLevel)
+	SetLoggingLevel("TRACE")
+	require.Equal(t, zerolog.InfoLevel, zerolog.GlobalLevel())
+}
+
+func TestSetLoggingMode_Pretty(t *testing.T) {
+	saveLogger(t)
+
+	SetLoggingMode("PRETTY")
+}
+
+func TestSetLoggingMode_Nocolor(t *testing.T) {
+	saveLogger(t)
+
+	SetLoggingMode("NOCOLOR")
+}
+
+func TestSetLoggingMode_JSON(t *testing.T) {
+	saveLogger(t)
+
+	SetLoggingMode("JSON")
+}
+
+func TestSetLoggingMode_UnknownModeIsNoop(t *testing.T) {
+	saveLogger(t)
+
+	SetLoggingMode("UNKNOWN")
+}
+
+func TestFormatMessage_NonNil(t *testing.T) {
+	t.Parallel()
+
+	require.Equal(t, "hello |", formatMessage("hello"))
+}
+
+func TestFormatMessage_Nil(t *testing.T) {
+	t.Parallel()
+
+	require.Empty(t, formatMessage(nil))
+}
+
+type stubCloser struct{ err error }
+
+func (s *stubCloser) Close() error { return s.err }
+
+func TestCloseAndLogErr_Success(t *testing.T) {
+	t.Parallel()
+
+	CloseAndLogErr(&stubCloser{err: nil})
+}
+
+func TestCloseAndLogErr_Error(t *testing.T) {
+	t.Parallel()
+
+	CloseAndLogErr(&stubCloser{err: errors.New("close failed")})
+}
diff --git a/api/motd/service.go b/api/motd/service.go
new file mode 100644
index 0000000..d53a5f1
--- /dev/null
+++ b/api/motd/service.go
@@ -0,0 +1,100 @@
+package motd
+
+import (
+	"context"
+	"strings"
+	"sync/atomic"
+	"time"
+
+	"github.com/portainer/portainer/api/http/client"
+	"github.com/portainer/portainer/pkg/libcrypto"
+	libclient "github.com/portainer/portainer/pkg/libhttp/client"
+	"github.com/portainer/portainer/pkg/schedule"
+	"github.com/rs/zerolog/log"
+
+	"github.com/segmentio/encoding/json"
+)
+
+const refreshInterval = 6 * time.Hour
+
+// Motd holds the processed message of the day data.
+type Motd struct {
+	Title         string            `json:"Title"`
+	Message       string            `json:"Message"`
+	ContentLayout map[string]string `json:"ContentLayout"`
+	Style         string            `json:"Style"`
+	Hash          []byte            `json:"Hash"`
+}
+
+// Service fetches and caches the MOTD from an external URL.
+type Service struct {
+	cached  atomic.Pointer[Motd]
+	motdURL string
+}
+
+// NewService creates a new MOTD service that fetches from motdURL.
+func NewService(motdURL string) *Service {
+	return &Service{
+		motdURL: motdURL,
+	}
+}
+
+// Start warms the cache immediately and refreshes it every refreshInterval.
+func (s *Service) Start(ctx context.Context) {
+	if err := libclient.ExternalRequestDisabled(s.motdURL); err != nil {
+		return
+	}
+
+	go s.refresh()
+	go schedule.RunOnInterval(ctx, refreshInterval, s.refresh, nil)
+}
+
+// GetCached returns the cached MOTD
+func (s *Service) GetCached() Motd {
+	motd := s.cached.Load()
+	if motd == nil {
+		return Motd{}
+	}
+
+	return *motd
+}
+
+type motdData struct {
+	Title         string            `json:"title"`
+	Message       []string          `json:"message"`
+	ContentLayout map[string]string `json:"contentLayout"`
+	Style         string            `json:"style"`
+}
+
+func (s *Service) refresh() {
+	if err := libclient.ExternalRequestDisabled(s.motdURL); err != nil {
+		log.Debug().Err(err).Msg("External request disabled: MOTD")
+
+		s.cached.Store(nil)
+
+		return
+	}
+
+	raw, err := client.Get(s.motdURL, 0)
+	if err != nil {
+		log.Debug().Err(err).Msg("Failed to fetch MOTD")
+		return
+	}
+
+	var data motdData
+	if err := json.Unmarshal(raw, &data); err != nil {
+		log.Debug().Err(err).Msg("Failed to parse MOTD")
+		return
+	}
+
+	message := strings.Join(data.Message, "\n")
+	hash := libcrypto.InsecureHashFromBytes([]byte(message))
+
+	s.cached.Store(&Motd{
+		Title:         data.Title,
+		Message:       message,
+		Hash:          hash,
+		ContentLayout: data.ContentLayout,
+		Style:         data.Style,
+	})
+}
diff --git a/api/motd/service_test.go b/api/motd/service_test.go
new file mode 100644
index 0000000..283b474
--- /dev/null
+++ b/api/motd/service_test.go
@@ -0,0 +1,84 @@
+package motd
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestGetCached_InitiallyEmpty(t *testing.T) {
+	t.Parallel()
+	svc := NewService("http://unused")
+	assert.Equal(t, Motd{}, svc.GetCached())
+}
+
+func TestRefresh_Success_PopulatesCache(t *testing.T) {
+	t.Parallel()
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"title":"Test title","message":["Hello","world"]}`))
+	}))
+	defer ts.Close()
+
+	svc := NewService(ts.URL)
+	svc.refresh()
+
+	result := svc.GetCached()
+	assert.Equal(t, "Test title", result.Title)
+	assert.Equal(t, "Hello\nworld", result.Message)
+	assert.NotEmpty(t, result.Hash)
+}
+
+func TestRefresh_FetchError_KeepsPreviousCache(t *testing.T) {
+	t.Parallel()
+	// First populate cache with good data
+	good := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"title":"Cached","message":["Cached message"]}`))
+	}))
+	defer good.Close()
+
+	svc := NewService(good.URL)
+	svc.refresh()
+	assert.Equal(t, "Cached", svc.GetCached().Title)
+
+	// Now point at a failing server and refresh
+	svc.motdURL = "http://127.0.0.1:0" // unreachable
+	svc.refresh()
+
+	// Cache should be unchanged
+	assert.Equal(t, "Cached", svc.GetCached().Title)
+}
+
+func TestRefresh_InvalidJSON_KeepsPreviousCache(t *testing.T) {
+	t.Parallel()
+	good := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"title":"Cached","message":["Cached message"]}`))
+	}))
+	defer good.Close()
+
+	svc := NewService(good.URL)
+	svc.refresh()
+	assert.Equal(t, "Cached", svc.GetCached().Title)
+
+	// Serve invalid JSON
+	bad := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write([]byte(`not json`))
+	}))
+	defer bad.Close()
+
+	svc.motdURL = bad.URL
+	svc.refresh()
+
+	assert.Equal(t, "Cached", svc.GetCached().Title)
+}
+
+func TestRefresh_FetchError_CacheRemainsEmpty(t *testing.T) {
+	t.Parallel()
+	svc := NewService("http://127.0.0.1:0") // unreachable
+	svc.refresh()
+	assert.Equal(t, Motd{}, svc.GetCached())
+}
diff --git a/api/oauth/oauth.go b/api/oauth/oauth.go
new file mode 100644
index 0000000..7221189
--- /dev/null
+++ b/api/oauth/oauth.go
@@ -0,0 +1,187 @@
+package oauth
+
+import (
+	"context"
+	"io"
+	"maps"
+	"mime"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/pkg/errors"
+	"github.com/rs/zerolog/log"
+	"github.com/segmentio/encoding/json"
+	"golang.org/x/oauth2"
+)
+
+// Service represents a service used to authenticate users against an authorization server
+type Service struct{}
+
+// NewService returns a pointer to a new instance of this service
+func NewService() Service {
+	return Service{}
+}
+
+// Authenticate takes an access code and exchanges it for an access token from portainer OAuthSettings token environment(endpoint).
+// On success, it will then return the username and token expiry time associated to authenticated user by fetching this information
+// from the resource server and matching it with the user identifier setting.
+func (Service) Authenticate(ctx context.Context, code string, configuration *portainer.OAuthSettings) (string, error) {
+	ctx, cancel := context.WithTimeout(ctx, time.Minute)
+	defer cancel()
+
+	token, err := GetOAuthToken(ctx, code, configuration)
+	if err != nil {
+		log.Error().Err(err).Msg("failed retrieving oauth token")
+
+		return "", err
+	}
+
+	idToken, err := GetIdToken(token)
+	if err != nil {
+		log.Error().Err(err).Msg("failed parsing id_token")
+	}
+
+	resource, err := GetResource(ctx, token.AccessToken, configuration.ResourceURI)
+	if err != nil {
+		log.Error().Err(err).Msg("failed retrieving resource")
+
+		return "", err
+	}
+
+	maps.Copy(resource, idToken)
+
+	username, err := GetUsername(resource, configuration.UserIdentifier)
+	if err != nil {
+		log.Error().Err(err).Msg("failed retrieving username")
+
+		return "", err
+	}
+
+	return username, nil
+}
+
+func GetOAuthToken(ctx context.Context, code string, configuration *portainer.OAuthSettings) (*oauth2.Token, error) {
+	unescapedCode, err := url.QueryUnescape(code)
+	if err != nil {
+		return nil, err
+	}
+
+	config := buildConfig(configuration)
+
+	return config.Exchange(ctx, unescapedCode)
+}
+
+// GetIdToken retrieves parsed id_token from the OAuth token response.
+// This is necessary for OAuth providers like Azure
+// that do not provide information about user groups on the user resource endpoint.
+func GetIdToken(token *oauth2.Token) (map[string]any, error) {
+	tokenData := make(map[string]any)
+
+	idToken := token.Extra("id_token")
+	if idToken == nil {
+		return tokenData, nil
+	}
+
+	jwtParser := jwt.NewParser(jwt.WithoutClaimsValidation())
+
+	t, _, err := jwtParser.ParseUnverified(idToken.(string), jwt.MapClaims{})
+	if err != nil {
+		return tokenData, errors.Wrap(err, "failed to parse id_token")
+	}
+
+	if claims, ok := t.Claims.(jwt.MapClaims); ok {
+		maps.Copy(tokenData, claims)
+	}
+
+	return tokenData, nil
+}
+
+func GetResource(ctx context.Context, token string, resourceURI string) (map[string]any, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, resourceURI, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	req.Header.Set("Authorization", "Bearer "+token)
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer func() {
+		if err := resp.Body.Close(); err != nil {
+			log.Warn().Err(err).Msg("failed to close response body")
+		}
+	}()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, err
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, &oauth2.RetrieveError{
+			Response: resp,
+			Body:     body,
+		}
+	}
+
+	// Some OAuth providers (e.g. Cloudflare Access) return malformed Content-Type headers
+	// (e.g. "application/json; charset=utf-8, application/json") that mime.ParseMediaType
+	// cannot parse. We intentionally ignore that error: if parsing fails, content is empty,
+	// the urlencoded branch is skipped, and json.Unmarshal below acts as the final validator.
+	originalContentType := resp.Header.Get("Content-Type")
+	content, _, err := mime.ParseMediaType(originalContentType)
+	if err != nil {
+		log.Debug().
+			Err(err).
+			Str("context", "OAuthResourceFetch").
+			Str("original_content_type", originalContentType).
+			Str("parsed_content_type", content).
+			Msg("Failed to parse Content-Type header from resource endpoint, falling back to JSON")
+	}
+
+	if content == "application/x-www-form-urlencoded" || content == "text/plain" {
+		values, err := url.ParseQuery(string(body))
+		if err != nil {
+			return nil, err
+		}
+
+		datamap := make(map[string]any)
+		for k, v := range values {
+			if len(v) == 0 {
+				datamap[k] = ""
+			} else {
+				datamap[k] = v[0]
+			}
+		}
+
+		return datamap, nil
+	}
+
+	var datamap map[string]any
+	if err = json.Unmarshal(body, &datamap); err != nil {
+		return nil, err
+	}
+
+	return datamap, nil
+}
+
+func buildConfig(config *portainer.OAuthSettings) *oauth2.Config {
+	return &oauth2.Config{
+		ClientID:     config.ClientID,
+		ClientSecret: config.ClientSecret,
+		RedirectURL:  config.RedirectURI,
+		Scopes:       strings.Split(config.Scopes, ","),
+		Endpoint: oauth2.Endpoint{
+			AuthURL:   config.AuthorizationURI,
+			TokenURL:  config.AccessTokenURI,
+			AuthStyle: config.AuthStyle,
+		},
+	}
+}
diff --git a/api/oauth/oauth_resource.go b/api/oauth/oauth_resource.go
new file mode 100644
index 0000000..f0f1d7a
--- /dev/null
+++ b/api/oauth/oauth_resource.go
@@ -0,0 +1,22 @@
+package oauth
+
+import (
+	"errors"
+	"strconv"
+)
+
+func GetUsername(datamap map[string]any, userIdentifier string) (string, error) {
+	username, ok := datamap[userIdentifier].(string)
+	if ok && username != "" {
+		return username, nil
+	}
+
+	if !ok {
+		username, ok := datamap[userIdentifier].(float64)
+		if ok && username != 0 {
+			return strconv.Itoa(int(username)), nil
+		}
+	}
+
+	return "", errors.New("failed to extract username from oauth resource")
+}
diff --git a/api/oauth/oauth_resource_test.go b/api/oauth/oauth_resource_test.go
new file mode 100644
index 0000000..9968587
--- /dev/null
+++ b/api/oauth/oauth_resource_test.go
@@ -0,0 +1,74 @@
+package oauth
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+)
+
+func Test_getUsername(t *testing.T) {
+	t.Parallel()
+	t.Run("fails for non-matching user identifier", func(t *testing.T) {
+		oauthSettings := &portainer.OAuthSettings{UserIdentifier: "username"}
+		datamap := map[string]any{"name": "john"}
+
+		if _, err := GetUsername(datamap, oauthSettings.UserIdentifier); err == nil {
+			t.Errorf("getUsername should fail if user identifier doesn't exist as key in oauth userinfo object")
+		}
+	})
+
+	t.Run("fails if username is empty string", func(t *testing.T) {
+		oauthSettings := &portainer.OAuthSettings{UserIdentifier: "username"}
+		datamap := map[string]any{"username": ""}
+
+		if _, err := GetUsername(datamap, oauthSettings.UserIdentifier); err == nil {
+			t.Errorf("getUsername should fail if username from oauth userinfo object is empty string")
+		}
+	})
+
+	t.Run("fails if username is 0 int", func(t *testing.T) {
+		oauthSettings := &portainer.OAuthSettings{UserIdentifier: "username"}
+		datamap := map[string]any{"username": 0}
+
+		if _, err := GetUsername(datamap, oauthSettings.UserIdentifier); err == nil {
+			t.Errorf("getUsername should fail if username from oauth userinfo object is 0 val int")
+		}
+	})
+
+	t.Run("fails if username is negative int", func(t *testing.T) {
+		oauthSettings := &portainer.OAuthSettings{UserIdentifier: "username"}
+		datamap := map[string]any{"username": -1}
+
+		if _, err := GetUsername(datamap, oauthSettings.UserIdentifier); err == nil {
+			t.Errorf("getUsername should fail if username from oauth userinfo object is -1 (negative) int")
+		}
+	})
+
+	t.Run("succeeds if username is matched and is not empty", func(t *testing.T) {
+		oauthSettings := &portainer.OAuthSettings{UserIdentifier: "username"}
+		datamap := map[string]any{"username": "john"}
+
+		if _, err := GetUsername(datamap, oauthSettings.UserIdentifier); err != nil {
+			t.Errorf("getUsername should succeed if username from oauth userinfo object matched and non-empty")
+		}
+	})
+
+	// looks like a bug!?
+	t.Run("fails if username is matched and is positive int", func(t *testing.T) {
+		oauthSettings := &portainer.OAuthSettings{UserIdentifier: "username"}
+		datamap := map[string]any{"username": 1}
+
+		if _, err := GetUsername(datamap, oauthSettings.UserIdentifier); err == nil {
+			t.Errorf("getUsername should fail if username from oauth userinfo object matched is positive int")
+		}
+	})
+
+	t.Run("succeeds if username is matched and is non-zero (or negative) float", func(t *testing.T) {
+		oauthSettings := &portainer.OAuthSettings{UserIdentifier: "username"}
+		datamap := map[string]any{"username": 1.1}
+
+		if _, err := GetUsername(datamap, oauthSettings.UserIdentifier); err != nil {
+			t.Errorf("getUsername should succeed if username from oauth userinfo object matched and non-zero (or negative)")
+		}
+	})
+}
diff --git a/api/oauth/oauth_test.go b/api/oauth/oauth_test.go
new file mode 100644
index 0000000..823107b
--- /dev/null
+++ b/api/oauth/oauth_test.go
@@ -0,0 +1,182 @@
+package oauth
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/oauth/oauthtest"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/oauth2"
+)
+
+func Test_getOAuthToken(t *testing.T) {
+	t.Parallel()
+	validCode := "valid-code"
+	srv, config := oauthtest.RunOAuthServer(validCode, &portainer.OAuthSettings{})
+	defer srv.Close()
+
+	t.Run("getOAuthToken fails upon invalid code", func(t *testing.T) {
+		code := ""
+		if _, err := GetOAuthToken(t.Context(), code, config); err == nil {
+			t.Errorf("getOAuthToken should fail upon providing invalid code; code=%v", code)
+		}
+	})
+
+	t.Run("getOAuthToken succeeds upon providing valid code", func(t *testing.T) {
+		code := validCode
+		token, err := GetOAuthToken(t.Context(), code, config)
+
+		if token == nil || err != nil {
+			t.Errorf("getOAuthToken should successfully return access token upon providing valid code")
+		}
+	})
+}
+
+func Test_getIdToken(t *testing.T) {
+	t.Parallel()
+	verifiedToken := `eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJPbmxpbmUgSldUIEJ1aWxkZXIiLCJpYXQiOjE2NTM1NDA3MjksImV4cCI6MTY4NTA3NjcyOSwiYXVkIjoid3d3LmV4YW1wbGUuY29tIiwic3ViIjoiam9obi5kb2VAZXhhbXBsZS5jb20iLCJHaXZlbk5hbWUiOiJKb2huIiwiU3VybmFtZSI6IkRvZSIsIkdyb3VwcyI6WyJGaXJzdCIsIlNlY29uZCJdfQ.GeU8XCV4Y4p5Vm-i63Aj7UP5zpb_0Zxb7-DjM2_z-s8`
+	nonVerifiedToken := `eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJPbmxpbmUgSldUIEJ1aWxkZXIiLCJpYXQiOjE2NTM1NDA3MjksImV4cCI6MTY4NTA3NjcyOSwiYXVkIjoid3d3LmV4YW1wbGUuY29tIiwic3ViIjoiam9obi5kb2VAZXhhbXBsZS5jb20iLCJHaXZlbk5hbWUiOiJKb2huIiwiU3VybmFtZSI6IkRvZSIsIkdyb3VwcyI6WyJGaXJzdCIsIlNlY29uZCJdfQ.`
+	claims := map[string]any{
+		"iss":       "Online JWT Builder",
+		"iat":       float64(1653540729),
+		"exp":       float64(1685076729),
+		"aud":       "www.example.com",
+		"sub":       "john.doe@example.com",
+		"GivenName": "John",
+		"Surname":   "Doe",
+		"Groups":    []any{"First", "Second"},
+	}
+
+	tests := []struct {
+		testName       string
+		idToken        string
+		expectedResult map[string]any
+		expectedError  error
+	}{
+		{
+			testName:       "should return claims if token exists and is verified",
+			idToken:        verifiedToken,
+			expectedResult: claims,
+			expectedError:  nil,
+		},
+		{
+			testName:       "should return claims if token exists but is not verified",
+			idToken:        nonVerifiedToken,
+			expectedResult: claims,
+			expectedError:  nil,
+		},
+		{
+			testName:       "should return empty map if token does not exist",
+			idToken:        "",
+			expectedResult: make(map[string]any),
+			expectedError:  nil,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.testName, func(t *testing.T) {
+			token := &oauth2.Token{}
+			if tc.idToken != "" {
+				token = token.WithExtra(map[string]any{"id_token": tc.idToken})
+			}
+
+			result, err := GetIdToken(token)
+			require.ErrorIs(t, err, tc.expectedError)
+			assert.Equal(t, tc.expectedResult, result)
+		})
+	}
+}
+
+func Test_getResource(t *testing.T) {
+	t.Parallel()
+	srv, config := oauthtest.RunOAuthServer("", &portainer.OAuthSettings{})
+	defer srv.Close()
+
+	t.Run("should fail upon missing Authorization Bearer header", func(t *testing.T) {
+		if _, err := GetResource(t.Context(), "", config.ResourceURI); err == nil {
+			t.Errorf("getResource should fail if access token is not provided in auth bearer header")
+		}
+	})
+
+	t.Run("should fail upon providing incorrect Authorization Bearer header", func(t *testing.T) {
+		if _, err := GetResource(t.Context(), "incorrect-token", config.ResourceURI); err == nil {
+			t.Errorf("getResource should fail if incorrect access token provided in auth bearer header")
+		}
+	})
+
+	t.Run("should succeed upon providing correct Authorization Bearer header", func(t *testing.T) {
+		if _, err := GetResource(t.Context(), oauthtest.AccessToken, config.ResourceURI); err != nil {
+			t.Errorf("getResource should succeed if correct access token provided in auth bearer header")
+		}
+	})
+}
+
+func Test_getResource_malformedContentType(t *testing.T) {
+	t.Parallel()
+	body := `{"username":"test-oauth-user"}`
+
+	tests := []struct {
+		name        string
+		contentType string
+	}{
+		{
+			name:        "duplicate mime types separated by comma",
+			contentType: "application/json; charset=utf-8, application/json",
+		},
+		{
+			name:        "missing mime type with only parameters",
+			contentType: "; charset=utf-8",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.Header().Set("Content-Type", tc.contentType)
+				w.WriteHeader(http.StatusOK)
+				_, _ = w.Write([]byte(body))
+			}))
+			defer srv.Close()
+
+			result, err := GetResource(t.Context(), "any-token", srv.URL)
+			require.NoError(t, err, "GetResource should succeed despite malformed Content-Type header")
+			assert.Equal(t, "test-oauth-user", result["username"])
+		})
+	}
+}
+
+func Test_Authenticate(t *testing.T) {
+	t.Parallel()
+	code := "valid-code"
+	authService := NewService()
+
+	t.Run("should fail if user identifier does not get matched in resource", func(t *testing.T) {
+		srv, config := oauthtest.RunOAuthServer(code, &portainer.OAuthSettings{})
+		defer srv.Close()
+
+		if _, err := authService.Authenticate(t.Context(), code, config); err == nil {
+			t.Error("Authenticate should fail to extract username from resource if incorrect UserIdentifier provided")
+		}
+	})
+
+	t.Run("should succeed if user identifier does get matched in resource", func(t *testing.T) {
+		config := &portainer.OAuthSettings{UserIdentifier: "username"}
+		srv, config := oauthtest.RunOAuthServer(code, config)
+		defer srv.Close()
+
+		username, err := authService.Authenticate(t.Context(), code, config)
+		if err != nil {
+			t.Errorf("Authenticate should succeed to extract username from resource if correct UserIdentifier provided; UserIdentifier=%s", config.UserIdentifier)
+		}
+
+		want := "test-oauth-user"
+		if username != want {
+			t.Errorf("Authenticate should return correct username; got=%s, want=%s", username, want)
+		}
+	})
+
+}
diff --git a/api/oauth/oauthtest/oauth_server.go b/api/oauth/oauthtest/oauth_server.go
new file mode 100644
index 0000000..08368f6
--- /dev/null
+++ b/api/oauth/oauthtest/oauth_server.go
@@ -0,0 +1,103 @@
+package oauthtest
+
+import (
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/rs/zerolog/log"
+
+	"github.com/gorilla/mux"
+	"github.com/segmentio/encoding/json"
+)
+
+const AccessToken = "test-token"
+
+// OAuthRoutes is an OAuth 2.0 compliant handler
+func OAuthRoutes(code string, config *portainer.OAuthSettings) http.Handler {
+	router := mux.NewRouter()
+
+	router.HandleFunc(
+		"/authorize",
+		func(w http.ResponseWriter, req *http.Request) {
+			location := fmt.Sprintf("%s?code=%s&state=%s", config.RedirectURI, code, "anything")
+			// w.Header().Set("Location", location)
+			// w.WriteHeader(http.StatusFound)
+			http.Redirect(w, req, location, http.StatusFound)
+		},
+	).Methods(http.MethodGet)
+
+	router.HandleFunc(
+		"/access_token",
+		func(w http.ResponseWriter, req *http.Request) {
+			w.Header().Set("Content-Type", "application/json")
+
+			if err := req.ParseForm(); err != nil {
+				if _, innerErr := fmt.Fprintf(w, "ParseForm() err: %v", err); innerErr != nil {
+					log.Warn().Err(innerErr).Msg("failed to write response")
+				}
+
+				return
+			}
+
+			reqCode := req.FormValue("code")
+			if reqCode != code {
+				w.WriteHeader(http.StatusUnauthorized)
+				return
+			}
+
+			w.WriteHeader(http.StatusOK)
+			if err := json.NewEncoder(w).Encode(map[string]any{
+				"token_type":   "Bearer",
+				"expires_in":   86400,
+				"access_token": AccessToken,
+				"scope":        "groups",
+			}); err != nil {
+				log.Warn().Err(err).Msg("failed to write response")
+			}
+		},
+	).Methods(http.MethodPost)
+
+	router.HandleFunc(
+		"/user",
+		func(w http.ResponseWriter, req *http.Request) {
+			w.Header().Set("Content-Type", "application/json")
+
+			authHeader := req.Header.Get("Authorization")
+			splitToken := strings.Split(authHeader, "Bearer ")
+			if len(splitToken) < 2 || splitToken[1] != AccessToken {
+				w.WriteHeader(http.StatusUnauthorized)
+				return
+			}
+
+			w.WriteHeader(http.StatusOK)
+			if err := json.NewEncoder(w).Encode(map[string]any{
+				"username": "test-oauth-user",
+				"groups":   "testing",
+			}); err != nil {
+				log.Warn().Err(err).Msg("failed to write response")
+			}
+		},
+	).Methods(http.MethodGet)
+
+	return router
+}
+
+// RunOAuthServer is a barebones OAuth 2.0 compliant test server which can be used to test OAuth 2 functionality
+func RunOAuthServer(code string, config *portainer.OAuthSettings) (*httptest.Server, *portainer.OAuthSettings) {
+	srv := httptest.NewUnstartedServer(http.DefaultServeMux)
+
+	addr := srv.Listener.Addr()
+
+	config.AuthorizationURI = fmt.Sprintf("http://%s/authorize", addr)
+	config.AccessTokenURI = fmt.Sprintf("http://%s/access_token", addr)
+	config.ResourceURI = fmt.Sprintf("http://%s/user", addr)
+	config.RedirectURI = fmt.Sprintf("http://%s/", addr)
+
+	srv.Config.Handler = OAuthRoutes(code, config)
+	srv.Start()
+
+	return srv, config
+}
diff --git a/api/pending_action.go b/api/pending_action.go
new file mode 100644
index 0000000..212ba22
--- /dev/null
+++ b/api/pending_action.go
@@ -0,0 +1,50 @@
+package portainer
+
+import "github.com/segmentio/encoding/json"
+
+type (
+	PendingActionID int
+	PendingAction   struct {
+		ID         PendingActionID `json:"ID"`
+		EndpointID EndpointID      `json:"EndpointID"`
+		Action     string          `json:"Action"`
+		ActionData any             `json:"ActionData"`
+		CreatedAt  int64           `json:"CreatedAt"`
+	}
+
+	PendingActionHandler interface {
+		Execute(PendingAction, *Endpoint) error
+	}
+)
+
+// MarshalJSON marshals the PendingAction struct to JSON
+// and converts the ActionData field to an embedded json string
+// This makes unmarshalling the ActionData field easier
+func (pa PendingAction) MarshalJSON() ([]byte, error) {
+	// Create a map to hold the marshalled fields
+	data := map[string]any{
+		"ID":         pa.ID,
+		"EndpointID": pa.EndpointID,
+		"Action":     pa.Action,
+		"CreatedAt":  pa.CreatedAt,
+	}
+
+	actionDataBytes, err := json.Marshal(pa.ActionData)
+	if err != nil {
+		return nil, err
+	}
+	data["ActionData"] = string(actionDataBytes)
+
+	// Marshal the map
+	return json.Marshal(data)
+}
+
+// Unmarshal the ActionData field from a string to a specific type.
+func (pa PendingAction) UnmarshallActionData(v any) error {
+	s, ok := pa.ActionData.(string)
+	if !ok {
+		return nil
+	}
+
+	return json.Unmarshal([]byte(s), v)
+}
diff --git a/api/pendingactions/actions/actions.go b/api/pendingactions/actions/actions.go
new file mode 100644
index 0000000..4931589
--- /dev/null
+++ b/api/pendingactions/actions/actions.go
@@ -0,0 +1,7 @@
+package actions
+
+const (
+	CleanNAPWithOverridePolicies      = "CleanNAPWithOverridePolicies"
+	DeletePortainerK8sRegistrySecrets = "DeletePortainerK8sRegistrySecrets"
+	PostInitMigrateEnvironment        = "PostInitMigrateEnvironment"
+)
diff --git a/api/pendingactions/handlers/clean_nap_with_override_policies.go b/api/pendingactions/handlers/clean_nap_with_override_policies.go
new file mode 100644
index 0000000..94f31cb
--- /dev/null
+++ b/api/pendingactions/handlers/clean_nap_with_override_policies.go
@@ -0,0 +1,78 @@
+package handlers
+
+import (
+	"fmt"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/pendingactions/actions"
+	"github.com/rs/zerolog/log"
+)
+
+type (
+	cleanNAPWithOverridePolicies struct {
+		EndpointGroupID portainer.EndpointGroupID
+	}
+
+	HandlerCleanNAPWithOverridePolicies struct {
+		authorizationService *authorization.Service
+		dataStore            dataservices.DataStore
+	}
+)
+
+// NewCleanNAPWithOverridePolicies creates a new CleanNAPWithOverridePolicies pending action
+func NewCleanNAPWithOverridePolicies(endpointID portainer.EndpointID, gid *portainer.EndpointGroupID) portainer.PendingAction {
+	pendingAction := portainer.PendingAction{
+		EndpointID: endpointID,
+		Action:     actions.CleanNAPWithOverridePolicies,
+	}
+
+	if gid != nil {
+		pendingAction.ActionData = cleanNAPWithOverridePolicies{
+			EndpointGroupID: *gid,
+		}
+	}
+
+	return pendingAction
+}
+
+// NewHandlerCleanNAPWithOverridePolicies creates a new handler to execute CleanNAPWithOverridePolicies pending action
+func NewHandlerCleanNAPWithOverridePolicies(
+	authorizationService *authorization.Service,
+	dataStore dataservices.DataStore,
+) *HandlerCleanNAPWithOverridePolicies {
+	return &HandlerCleanNAPWithOverridePolicies{
+		authorizationService: authorizationService,
+		dataStore:            dataStore,
+	}
+}
+
+func (h *HandlerCleanNAPWithOverridePolicies) Execute(pendingAction portainer.PendingAction, endpoint *portainer.Endpoint) error {
+	if pendingAction.ActionData == nil {
+		return h.authorizationService.CleanNAPWithOverridePolicies(h.dataStore, endpoint, nil)
+	}
+
+	var payload cleanNAPWithOverridePolicies
+	if err := pendingAction.UnmarshallActionData(&payload); err != nil {
+		log.Error().Err(err).Msgf("Error unmarshalling endpoint group ID for cleaning NAP with override policies for environment %d", endpoint.ID)
+		return fmt.Errorf("failed to unmarshal endpoint group ID for cleaning NAP with override policies for environment %d: %w", endpoint.ID, err)
+	}
+
+	if payload.EndpointGroupID == 0 {
+		return h.authorizationService.CleanNAPWithOverridePolicies(h.dataStore, endpoint, nil)
+	}
+
+	endpointGroup, err := h.dataStore.EndpointGroup().Read(payload.EndpointGroupID)
+	if err != nil {
+		log.Error().Err(err).Msgf("Error reading environment group to clean NAP with override policies for environment %d and environment group %d", endpoint.ID, endpointGroup.ID)
+		return fmt.Errorf("failed to retrieve environment group %d: %w", payload.EndpointGroupID, err)
+	}
+
+	if err := h.authorizationService.CleanNAPWithOverridePolicies(h.dataStore, endpoint, endpointGroup); err != nil {
+		log.Error().Err(err).Msgf("Error cleaning NAP with override policies for environment %d and environment group %d", endpoint.ID, endpointGroup.ID)
+		return fmt.Errorf("failed to clean NAP with override policies for environment %d and environment group %d: %w", endpoint.ID, endpointGroup.ID, err)
+	}
+
+	return nil
+}
diff --git a/api/pendingactions/handlers/delete_k8s_registry_secrets.go b/api/pendingactions/handlers/delete_k8s_registry_secrets.go
new file mode 100644
index 0000000..d97848f
--- /dev/null
+++ b/api/pendingactions/handlers/delete_k8s_registry_secrets.go
@@ -0,0 +1,79 @@
+package handlers
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/internal/registryutils"
+	kubecli "github.com/portainer/portainer/api/kubernetes/cli"
+	"github.com/portainer/portainer/api/pendingactions/actions"
+)
+
+type (
+	HandlerDeleteK8sRegistrySecrets struct {
+		authorizationService *authorization.Service
+		dataStore            dataservices.DataStore
+		kubeFactory          *kubecli.ClientFactory
+	}
+
+	deleteK8sRegistrySecretsData struct {
+		RegistryID portainer.RegistryID `json:"RegistryID"`
+		Namespaces []string             `json:"Namespaces"`
+	}
+)
+
+// NewDeleteK8sRegistrySecrets creates a new DeleteK8sRegistrySecrets pending action
+func NewDeleteK8sRegistrySecrets(endpointID portainer.EndpointID, registryID portainer.RegistryID, namespaces []string) portainer.PendingAction {
+	return portainer.PendingAction{
+		EndpointID: endpointID,
+		Action:     actions.DeletePortainerK8sRegistrySecrets,
+		ActionData: &deleteK8sRegistrySecretsData{
+			RegistryID: registryID,
+			Namespaces: namespaces,
+		},
+	}
+}
+
+// NewHandlerDeleteRegistrySecrets creates a new handler to execute DeleteK8sRegistrySecrets pending action
+func NewHandlerDeleteRegistrySecrets(
+	authorizationService *authorization.Service,
+	dataStore dataservices.DataStore,
+	kubeFactory *kubecli.ClientFactory,
+) *HandlerDeleteK8sRegistrySecrets {
+	return &HandlerDeleteK8sRegistrySecrets{
+		authorizationService: authorizationService,
+		dataStore:            dataStore,
+		kubeFactory:          kubeFactory,
+	}
+}
+
+func (h *HandlerDeleteK8sRegistrySecrets) Execute(pa portainer.PendingAction, endpoint *portainer.Endpoint) error {
+	if endpoint == nil || pa.ActionData == nil {
+		return nil
+	}
+
+	var registryData deleteK8sRegistrySecretsData
+	err := pa.UnmarshallActionData(&registryData)
+	if err != nil {
+		return err
+	}
+
+	kubeClient, err := h.kubeFactory.GetPrivilegedKubeClient(endpoint)
+	if err != nil {
+		return err
+	}
+
+	secretName := registryutils.RegistrySecretName(registryData.RegistryID)
+
+	for _, namespace := range registryData.Namespaces {
+		if err = kubeClient.RemoveImagePullSecretFromServiceAccount(namespace, "default", secretName); err != nil {
+			return err
+		}
+
+		if err = kubeClient.DeleteRegistrySecret(registryData.RegistryID, namespace); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
diff --git a/api/pendingactions/handlers/delete_k8s_registry_secrets_test.go b/api/pendingactions/handlers/delete_k8s_registry_secrets_test.go
new file mode 100644
index 0000000..2b5a4e9
--- /dev/null
+++ b/api/pendingactions/handlers/delete_k8s_registry_secrets_test.go
@@ -0,0 +1,126 @@
+package handlers
+
+import (
+	"encoding/json"
+	"fmt"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	kubecli "github.com/portainer/portainer/api/kubernetes/cli"
+	v1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	kfake "k8s.io/client-go/kubernetes/fake"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// buildPendingAction creates a PendingAction with ActionData serialized as a
+// JSON string — matching the format UnmarshallActionData expects (string type assertion).
+func buildPendingAction(endpointID portainer.EndpointID, registryID portainer.RegistryID, namespaces []string) portainer.PendingAction {
+	data := deleteK8sRegistrySecretsData{
+		RegistryID: registryID,
+		Namespaces: namespaces,
+	}
+	raw, _ := json.Marshal(data)
+	return portainer.PendingAction{
+		EndpointID: endpointID,
+		ActionData: string(raw),
+	}
+}
+
+func TestHandlerDeleteK8sRegistrySecrets_Execute(t *testing.T) {
+	t.Parallel()
+	const endpointID portainer.EndpointID = 1
+	const registryID portainer.RegistryID = 3
+
+	endpoint := &portainer.Endpoint{ID: endpointID, Name: "test-env", Type: portainer.AgentOnKubernetesEnvironment}
+
+	t.Run("nil endpoint - returns nil without error", func(t *testing.T) {
+		factory := kubecli.NewTestClientFactory(endpointID, kubecli.NewTestKubeClient(kfake.NewSimpleClientset()))
+		h := NewHandlerDeleteRegistrySecrets(nil, nil, factory)
+		pa := buildPendingAction(endpointID, registryID, []string{"ns-a"})
+		err := h.Execute(pa, nil)
+		require.NoError(t, err)
+	})
+
+	t.Run("nil action data - returns nil without error", func(t *testing.T) {
+		factory := kubecli.NewTestClientFactory(endpointID, kubecli.NewTestKubeClient(kfake.NewSimpleClientset()))
+		h := NewHandlerDeleteRegistrySecrets(nil, nil, factory)
+		pa := portainer.PendingAction{EndpointID: endpointID, ActionData: nil}
+		err := h.Execute(pa, endpoint)
+		require.NoError(t, err)
+	})
+
+	t.Run("malformed action data - returns unmarshal error", func(t *testing.T) {
+		factory := kubecli.NewTestClientFactory(endpointID, kubecli.NewTestKubeClient(kfake.NewSimpleClientset()))
+		h := NewHandlerDeleteRegistrySecrets(nil, nil, factory)
+		pa := portainer.PendingAction{
+			EndpointID: endpointID,
+			ActionData: "{invalid json",
+		}
+		err := h.Execute(pa, endpoint)
+		require.Error(t, err)
+	})
+
+	t.Run("kube factory has no client for endpoint - returns error", func(t *testing.T) {
+		emptyFactory, err := kubecli.NewClientFactory(nil, nil, nil, "test", "", "")
+		require.NoError(t, err)
+
+		h := NewHandlerDeleteRegistrySecrets(nil, nil, emptyFactory)
+		pa := buildPendingAction(endpointID, registryID, []string{"ns-a"})
+		localEndpoint := &portainer.Endpoint{
+			ID:   endpointID,
+			Name: "test-env",
+			Type: portainer.KubernetesLocalEnvironment,
+		}
+		execErr := h.Execute(pa, localEndpoint)
+		assert.Error(t, execErr, "should return error when kube client cannot be obtained")
+	})
+
+	t.Run("all namespaces succeed - returns no error", func(t *testing.T) {
+		secretName := fmt.Sprintf("registry-%d", registryID)
+
+		saA := &v1.ServiceAccount{
+			ObjectMeta:       metav1.ObjectMeta{Name: "default", Namespace: "ns-a"},
+			ImagePullSecrets: []v1.LocalObjectReference{{Name: secretName}},
+		}
+		saB := &v1.ServiceAccount{
+			ObjectMeta:       metav1.ObjectMeta{Name: "default", Namespace: "ns-b"},
+			ImagePullSecrets: []v1.LocalObjectReference{{Name: secretName}},
+		}
+		secretA := &v1.Secret{ObjectMeta: metav1.ObjectMeta{Name: secretName, Namespace: "ns-a"}}
+		secretB := &v1.Secret{ObjectMeta: metav1.ObjectMeta{Name: secretName, Namespace: "ns-b"}}
+
+		fakeK8s := kfake.NewSimpleClientset(saA, saB, secretA, secretB)
+		factory := kubecli.NewTestClientFactory(endpointID, kubecli.NewTestKubeClient(fakeK8s))
+		h := NewHandlerDeleteRegistrySecrets(nil, nil, factory)
+		pa := buildPendingAction(endpointID, registryID, []string{"ns-a", "ns-b"})
+
+		err := h.Execute(pa, endpoint)
+		require.NoError(t, err)
+	})
+
+	t.Run("SA not found is idempotent - Execute succeeds", func(t *testing.T) {
+		secretName := fmt.Sprintf("registry-%d", registryID)
+		secretA := &v1.Secret{ObjectMeta: metav1.ObjectMeta{Name: secretName, Namespace: "ns-a"}}
+		// No SA present; RemoveImagePullSecretFromServiceAccount treats not-found as idempotent
+		fakeK8s := kfake.NewSimpleClientset(secretA)
+		factory := kubecli.NewTestClientFactory(endpointID, kubecli.NewTestKubeClient(fakeK8s))
+		h := NewHandlerDeleteRegistrySecrets(nil, nil, factory)
+		pa := buildPendingAction(endpointID, registryID, []string{"ns-a"})
+
+		err := h.Execute(pa, endpoint)
+		require.NoError(t, err, "missing SA should be treated as idempotent")
+	})
+
+	t.Run("empty namespaces list - Execute succeeds with no operations", func(t *testing.T) {
+		fakeK8s := kfake.NewSimpleClientset()
+		factory := kubecli.NewTestClientFactory(endpointID, kubecli.NewTestKubeClient(fakeK8s))
+		h := NewHandlerDeleteRegistrySecrets(nil, nil, factory)
+		pa := buildPendingAction(endpointID, registryID, []string{})
+
+		err := h.Execute(pa, endpoint)
+		require.NoError(t, err)
+	})
+}
diff --git a/api/pendingactions/handlers/post_init_migrate_environment.go b/api/pendingactions/handlers/post_init_migrate_environment.go
new file mode 100644
index 0000000..cdbfe67
--- /dev/null
+++ b/api/pendingactions/handlers/post_init_migrate_environment.go
@@ -0,0 +1,58 @@
+package handlers
+
+import (
+	"fmt"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore/postinit"
+	dockerClient "github.com/portainer/portainer/api/docker/client"
+	"github.com/portainer/portainer/api/internal/authorization"
+	kubecli "github.com/portainer/portainer/api/kubernetes/cli"
+	"github.com/rs/zerolog/log"
+)
+
+type HandlerPostInitMigrateEnvironment struct {
+	authorizationService *authorization.Service
+	dataStore            dataservices.DataStore
+	kubeFactory          *kubecli.ClientFactory
+	dockerFactory        *dockerClient.ClientFactory
+	assetsPath           string
+	kubernetesDeployer   portainer.KubernetesDeployer
+}
+
+// NewPostInitMigrateEnvironment creates a new PostInitMigrateEnvironment pending action
+func NewHandlerPostInitMigrateEnvironment(
+	authorizationService *authorization.Service,
+	dataStore dataservices.DataStore,
+	kubeFactory *kubecli.ClientFactory,
+	dockerFactory *dockerClient.ClientFactory,
+	assetsPath string,
+	kubernetesDeployer portainer.KubernetesDeployer,
+) *HandlerPostInitMigrateEnvironment {
+	return &HandlerPostInitMigrateEnvironment{
+		authorizationService: authorizationService,
+		dataStore:            dataStore,
+		kubeFactory:          kubeFactory,
+		dockerFactory:        dockerFactory,
+		assetsPath:           assetsPath,
+		kubernetesDeployer:   kubernetesDeployer,
+	}
+}
+
+func (h *HandlerPostInitMigrateEnvironment) Execute(_ portainer.PendingAction, endpoint *portainer.Endpoint) error {
+	postInitMigrator := postinit.NewPostInitMigrator(
+		h.kubeFactory,
+		h.dockerFactory,
+		h.dataStore,
+		h.assetsPath,
+		h.kubernetesDeployer,
+	)
+	err := postInitMigrator.MigrateEnvironment(endpoint)
+	if err != nil {
+		log.Error().Err(err).Msgf("Error running post-init migrations for edge environment %d", endpoint.ID)
+		return fmt.Errorf("failed running post-init migrations for edge environment %d: %w", endpoint.ID, err)
+	}
+
+	return nil
+}
diff --git a/api/pendingactions/pendingactions.go b/api/pendingactions/pendingactions.go
new file mode 100644
index 0000000..95c6276
--- /dev/null
+++ b/api/pendingactions/pendingactions.go
@@ -0,0 +1,154 @@
+package pendingactions
+
+import (
+	"fmt"
+	"reflect"
+	"sync"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+	kubecli "github.com/portainer/portainer/api/kubernetes/cli"
+
+	"github.com/rs/zerolog/log"
+)
+
+type PendingActionsService struct {
+	kubeFactory *kubecli.ClientFactory
+	dataStore   dataservices.DataStore
+	mu          sync.Mutex
+}
+
+var handlers = make(map[string]portainer.PendingActionHandler)
+
+func NewService(dataStore dataservices.DataStore, kubeFactory *kubecli.ClientFactory) *PendingActionsService {
+	return &PendingActionsService{dataStore: dataStore, kubeFactory: kubeFactory}
+}
+
+func (service *PendingActionsService) RegisterHandler(name string, handler portainer.PendingActionHandler) {
+	handlers[name] = handler
+}
+
+func (service *PendingActionsService) Create(tx dataservices.DataStoreTx, action portainer.PendingAction) error {
+	// Check if this pendingAction already exists
+	pendingActions, err := tx.PendingActions().ReadAll(func(a portainer.PendingAction) bool {
+		return a.EndpointID == action.EndpointID && a.Action == action.Action && reflect.DeepEqual(a.ActionData, action.ActionData)
+	})
+	if err != nil {
+		return fmt.Errorf("failed to retrieve pending actions: %w", err)
+	}
+
+	if len(pendingActions) > 0 {
+		// Same endpoint, same action and data, don't create a repeat
+		log.Debug().
+			Str("action", action.Action).
+			Int("endpoint_id", int(action.EndpointID)).
+			Msg("pending action already exists for environment, skipping...")
+
+		return nil
+	}
+
+	return tx.PendingActions().Create(&action)
+}
+
+func (service *PendingActionsService) Execute(id portainer.EndpointID) {
+	// Run in a goroutine to avoid blocking the main thread due to db tx	=
+	go service.execute(id)
+}
+
+func (service *PendingActionsService) execute(environmentID portainer.EndpointID) {
+	service.mu.Lock()
+	defer service.mu.Unlock()
+
+	endpoint, err := service.dataStore.Endpoint().Endpoint(environmentID)
+	if err != nil {
+		log.Debug().Err(err).Int("endpoint_id", int(environmentID)).Msg("failed to retrieve environment")
+
+		return
+	}
+
+	isKubernetesEndpoint := endpointutils.IsKubernetesEndpoint(endpoint) && !endpointutils.IsEdgeEndpoint(endpoint)
+
+	if !isKubernetesEndpoint {
+		// Edge environments check the heartbeat
+		// Other environments check the endpoint status
+		if endpointutils.IsEdgeEndpoint(endpoint) {
+			if !endpoint.Heartbeat {
+				return
+			}
+		} else if endpoint.Status != portainer.EndpointStatusUp {
+			return
+		}
+	} else {
+		// For Kubernetes endpoints, we need to check if the endpoint is up by
+		// creating a kube client and performing a simple operation
+		client, err := service.kubeFactory.GetPrivilegedKubeClient(endpoint)
+		if err != nil {
+			log.Debug().
+				Err(err).
+				Int("endpoint_id", int(environmentID)).
+				Msg("failed to create Kubernetes client for environment")
+
+			return
+		}
+
+		if _, err = client.ServerVersion(); err != nil {
+			log.Debug().
+				Err(err).
+				Str("endpoint_name", endpoint.Name).
+				Int("endpoint_id", int(environmentID)).
+				Msg("environment is not up")
+
+			return
+		}
+	}
+
+	pendingActions, err := service.dataStore.PendingActions().ReadAll(func(a portainer.PendingAction) bool {
+		return a.EndpointID == environmentID
+	})
+	if err != nil {
+		log.Warn().Err(err).Msg("failed to read pending actions")
+		return
+	}
+
+	if len(pendingActions) > 0 {
+		log.Debug().Int("pending_action_count", len(pendingActions)).Msg("found pending actions")
+	}
+
+	for _, pendingAction := range pendingActions {
+		log.Debug().
+			Int("pending_action_id", int(pendingAction.ID)).
+			Str("action", pendingAction.Action).
+			Msg("executing pending action")
+		if err := service.executePendingAction(pendingAction, endpoint); err != nil {
+			log.Warn().Err(err).Msg("failed to execute pending action")
+
+			continue
+		}
+
+		if err := service.dataStore.PendingActions().Delete(pendingAction.ID); err != nil {
+			log.Warn().Err(err).Msg("failed to delete pending action")
+
+			continue
+		}
+
+		log.Debug().Int("pending_action_id", int(pendingAction.ID)).Msg("pending action finished")
+	}
+}
+
+func (service *PendingActionsService) executePendingAction(pendingAction portainer.PendingAction, endpoint *portainer.Endpoint) error {
+	defer func() {
+		if r := recover(); r != nil {
+			log.Error().Msgf("recovered from panic while executing pending action %s for environment %d: %v", pendingAction.Action, pendingAction.EndpointID, r)
+		}
+	}()
+
+	handler, ok := handlers[pendingAction.Action]
+	if !ok {
+		log.Warn().Str("action", pendingAction.Action).Msg("no handler found for pending action")
+
+		return nil
+	}
+
+	return handler.Execute(pendingAction, endpoint)
+}
diff --git a/api/pendingactions/pendingactions_test.go b/api/pendingactions/pendingactions_test.go
new file mode 100644
index 0000000..e0685e3
--- /dev/null
+++ b/api/pendingactions/pendingactions_test.go
@@ -0,0 +1,93 @@
+package pendingactions
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestExecute(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name           string
+		endpoint       *portainer.Endpoint
+		pendingActions []portainer.PendingAction
+		shouldExecute  bool
+	}{
+		{
+			name: "Edge endpoint with heartbeat should execute",
+			// Create test endpoint
+			endpoint: &portainer.Endpoint{
+				ID:        1,
+				Heartbeat: true,
+				Type:      portainer.EdgeAgentOnDockerEnvironment,
+				EdgeID:    "edge-1",
+			},
+			pendingActions: []portainer.PendingAction{
+				{ID: 1, EndpointID: 1, Action: "test-action"},
+			},
+			shouldExecute: true,
+		},
+		{
+			name: "Edge endpoint without heartbeat should not execute",
+			endpoint: &portainer.Endpoint{
+				ID:        2,
+				EdgeID:    "edge-2",
+				Heartbeat: false,
+				Type:      portainer.EdgeAgentOnDockerEnvironment,
+			},
+			pendingActions: []portainer.PendingAction{
+				{ID: 2, EndpointID: 2, Action: "test-action"},
+			},
+			shouldExecute: false,
+		},
+		{
+			name: "Regular endpoint with status UP should execute",
+			endpoint: &portainer.Endpoint{
+				ID:     3,
+				Status: portainer.EndpointStatusUp,
+				Type:   portainer.AgentOnDockerEnvironment,
+			},
+			pendingActions: []portainer.PendingAction{
+				{ID: 3, EndpointID: 3, Action: "test-action"},
+			},
+			shouldExecute: true,
+		},
+		{
+			name: "Regular endpoint with status DOWN should not execute",
+			endpoint: &portainer.Endpoint{
+				ID:     4,
+				Status: portainer.EndpointStatusDown,
+				Type:   portainer.AgentOnDockerEnvironment,
+			},
+			pendingActions: []portainer.PendingAction{
+				{ID: 4, EndpointID: 4, Action: "test-action"},
+			},
+			shouldExecute: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Setup services
+			store := testhelpers.NewDatastore(testhelpers.WithEndpoints([]portainer.Endpoint{*tt.endpoint}), testhelpers.WithPendingActions(tt.pendingActions))
+			service := NewService(store, nil)
+
+			// Execute
+			service.execute(tt.endpoint.ID)
+
+			// Verify expectations
+			pendingActions, err := store.PendingActions().ReadAll()
+			require.NoError(t, err)
+
+			if tt.shouldExecute {
+				assert.Len(t, pendingActions, len(tt.pendingActions)-1)
+			} else {
+				assert.Len(t, pendingActions, len(tt.pendingActions))
+			}
+		})
+	}
+}
diff --git a/api/platform/platform.go b/api/platform/platform.go
new file mode 100644
index 0000000..3da4b90
--- /dev/null
+++ b/api/platform/platform.go
@@ -0,0 +1,56 @@
+package platform
+
+import (
+	"os"
+)
+
+const (
+	PodmanMode            = "PODMAN"
+	KubernetesServiceHost = "KUBERNETES_SERVICE_HOST"
+)
+
+// ContainerPlatform represent the platform on which the container is running (Docker, Kubernetes)
+type ContainerPlatform string
+
+const (
+	// PlatformDocker represent the Docker platform (Unknown)
+	PlatformDocker = ContainerPlatform("Docker")
+	// PlatformDockerStandalone represent the Docker platform (Standalone)
+	PlatformDockerStandalone = ContainerPlatform("Docker Standalone")
+	// PlatformDockerSwarm represent the Docker platform (Swarm)
+	PlatformDockerSwarm = ContainerPlatform("Docker Swarm")
+	// PlatformKubernetes represent the Kubernetes platform
+	PlatformKubernetes = ContainerPlatform("Kubernetes")
+	// PlatformPodman represent the Podman platform (Standalone)
+	PlatformPodman = ContainerPlatform("Podman")
+)
+
+// DetermineContainerPlatform will check for the existence of the PODMAN_MODE
+// or KUBERNETES_SERVICE_HOST environment variable to determine if
+// the container is running on Podman or inside the Kubernetes platform.
+// Defaults to Docker otherwise.
+func DetermineContainerPlatform() ContainerPlatform {
+	podmanModeEnvVar := os.Getenv(PodmanMode)
+	if podmanModeEnvVar == "1" {
+		return PlatformPodman
+	}
+
+	serviceHostKubernetesEnvVar := os.Getenv(KubernetesServiceHost)
+	if serviceHostKubernetesEnvVar != "" {
+		return PlatformKubernetes
+	}
+
+	if !isRunningInContainer() {
+		return ""
+	}
+
+	return PlatformDocker
+}
+
+// isRunningInContainer returns true if the process is running inside a container
+// this code is taken from https://github.com/moby/libnetwork/blob/master/drivers/bridge/setup_bridgenetfiltering.go
+func isRunningInContainer() bool {
+	_, err := os.Stat("/.dockerenv")
+
+	return !os.IsNotExist(err)
+}
diff --git a/api/platform/platform_test.go b/api/platform/platform_test.go
new file mode 100644
index 0000000..be18621
--- /dev/null
+++ b/api/platform/platform_test.go
@@ -0,0 +1,155 @@
+package platform
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestDetermineContainerPlatform_Podman(t *testing.T) {
+	t.Setenv(PodmanMode, "1")
+
+	require.Equal(t, PlatformPodman, DetermineContainerPlatform())
+}
+
+func TestDetermineContainerPlatform_Kubernetes(t *testing.T) {
+	t.Setenv(KubernetesServiceHost, "10.96.0.1")
+
+	require.Equal(t, PlatformKubernetes, DetermineContainerPlatform())
+}
+
+func TestDetermineContainerPlatform_PodmanTakesPrecedenceOverKubernetes(t *testing.T) {
+	t.Setenv(PodmanMode, "1")
+	t.Setenv(KubernetesServiceHost, "10.96.0.1")
+
+	require.Equal(t, PlatformPodman, DetermineContainerPlatform())
+}
+
+func TestCheckDockerEnvTypeForUpgrade_UnixSocket(t *testing.T) {
+	t.Parallel()
+
+	endpoint := &portainer.Endpoint{URL: "unix:///var/run/docker.sock"}
+	require.Equal(t, PlatformDockerStandalone, checkDockerEnvTypeForUpgrade(endpoint))
+}
+
+func TestCheckDockerEnvTypeForUpgrade_Npipe(t *testing.T) {
+	t.Parallel()
+
+	endpoint := &portainer.Endpoint{URL: "npipe:////./pipe/docker_engine", Type: portainer.DockerEnvironment}
+	require.Equal(t, PlatformDockerStandalone, checkDockerEnvTypeForUpgrade(endpoint))
+}
+
+func TestCheckDockerEnvTypeForUpgrade_Swarm(t *testing.T) {
+	t.Parallel()
+
+	endpoint := &portainer.Endpoint{URL: "tcp://tasks.portainer_agent:9001"}
+	require.Equal(t, PlatformDockerSwarm, checkDockerEnvTypeForUpgrade(endpoint))
+}
+
+func TestCheckDockerEnvTypeForUpgrade_RemoteTCP(t *testing.T) {
+	t.Parallel()
+
+	endpoint := &portainer.Endpoint{URL: "tcp://192.168.1.100:2376"}
+	require.Equal(t, ContainerPlatform(""), checkDockerEnvTypeForUpgrade(endpoint))
+}
+
+func TestDetectLocalEnvironment_UnsupportedPlatform(t *testing.T) {
+	t.Setenv(PodmanMode, "1")
+	t.Setenv(KubernetesServiceHost, "")
+
+	ds := testhelpers.NewDatastore(testhelpers.WithEndpoints([]portainer.Endpoint{
+		{ID: 1, Type: portainer.DockerEnvironment},
+	}))
+
+	endpoint, platform, err := detectLocalEnvironment(ds)
+	require.NoError(t, err)
+	require.Nil(t, endpoint)
+	require.Empty(t, platform)
+}
+
+func TestDetectLocalEnvironment_NoEndpoints(t *testing.T) {
+	t.Setenv(KubernetesServiceHost, "10.96.0.1")
+	t.Setenv(PodmanMode, "")
+
+	ds := testhelpers.NewDatastore(testhelpers.WithEndpoints([]portainer.Endpoint{}))
+
+	endpoint, platform, err := detectLocalEnvironment(ds)
+	require.NoError(t, err)
+	require.Nil(t, endpoint)
+	require.Empty(t, platform)
+}
+
+func TestDetectLocalEnvironment_KubernetesEndpointFound(t *testing.T) {
+	t.Setenv(KubernetesServiceHost, "10.96.0.1")
+	t.Setenv(PodmanMode, "")
+
+	kube := portainer.Endpoint{ID: 1, Name: "local-k8s", Type: portainer.KubernetesLocalEnvironment}
+	ds := testhelpers.NewDatastore(testhelpers.WithEndpoints([]portainer.Endpoint{kube}))
+
+	endpoint, platform, err := detectLocalEnvironment(ds)
+	require.NoError(t, err)
+	require.NotNil(t, endpoint)
+	require.Equal(t, portainer.EndpointID(1), endpoint.ID)
+	require.Equal(t, PlatformKubernetes, platform)
+}
+
+func TestDetectLocalEnvironment_NoMatchingEndpointType(t *testing.T) {
+	t.Setenv(KubernetesServiceHost, "10.96.0.1")
+	t.Setenv(PodmanMode, "")
+
+	docker := portainer.Endpoint{ID: 1, Type: portainer.DockerEnvironment}
+	ds := testhelpers.NewDatastore(testhelpers.WithEndpoints([]portainer.Endpoint{docker}))
+
+	_, _, err := detectLocalEnvironment(ds)
+	require.ErrorIs(t, err, ErrNoLocalEnvironment)
+}
+
+func TestService_GetPlatform(t *testing.T) {
+	t.Setenv(KubernetesServiceHost, "10.96.0.1")
+	t.Setenv(PodmanMode, "")
+
+	kube := portainer.Endpoint{ID: 1, Type: portainer.KubernetesLocalEnvironment}
+	ds := testhelpers.NewDatastore(testhelpers.WithEndpoints([]portainer.Endpoint{kube}))
+
+	svc := NewService(ds)
+
+	platform, err := svc.GetPlatform()
+	require.NoError(t, err)
+	require.Equal(t, PlatformKubernetes, platform)
+}
+
+func TestService_GetLocalEnvironment(t *testing.T) {
+	t.Setenv(KubernetesServiceHost, "10.96.0.1")
+	t.Setenv(PodmanMode, "")
+
+	kube := portainer.Endpoint{ID: 1, Type: portainer.KubernetesLocalEnvironment}
+	ds := testhelpers.NewDatastore(testhelpers.WithEndpoints([]portainer.Endpoint{kube}))
+
+	svc := NewService(ds)
+
+	env, err := svc.GetLocalEnvironment()
+	require.NoError(t, err)
+	require.NotNil(t, env)
+	require.Equal(t, portainer.EndpointID(1), env.ID)
+}
+
+func TestService_CachesLoadedEnvironment(t *testing.T) {
+	t.Setenv(KubernetesServiceHost, "10.96.0.1")
+	t.Setenv(PodmanMode, "")
+
+	kube := portainer.Endpoint{ID: 1, Type: portainer.KubernetesLocalEnvironment}
+	ds := testhelpers.NewDatastore(testhelpers.WithEndpoints([]portainer.Endpoint{kube}))
+
+	svc := NewService(ds)
+
+	env1, err := svc.GetLocalEnvironment()
+	require.NoError(t, err)
+
+	env2, err := svc.GetLocalEnvironment()
+	require.NoError(t, err)
+
+	require.Same(t, env1, env2)
+}
diff --git a/api/platform/service.go b/api/platform/service.go
new file mode 100644
index 0000000..5bb1d53
--- /dev/null
+++ b/api/platform/service.go
@@ -0,0 +1,133 @@
+package platform
+
+import (
+	"errors"
+	"fmt"
+	"slices"
+	"strings"
+	"sync"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+
+	"github.com/rs/zerolog/log"
+)
+
+var (
+	ErrNoLocalEnvironment = errors.New("No local environment was detected")
+)
+
+type Service interface {
+	GetLocalEnvironment() (*portainer.Endpoint, error)
+	GetPlatform() (ContainerPlatform, error)
+}
+
+type service struct {
+	dataStore   dataservices.DataStore
+	environment *portainer.Endpoint
+	platform    ContainerPlatform
+	mu          sync.Mutex
+}
+
+func NewService(dataStore dataservices.DataStore) *service {
+	return &service{dataStore: dataStore}
+}
+
+func (service *service) loadEnvAndPlatform() error {
+	if service.environment != nil {
+		return nil
+	}
+
+	environment, platform, err := detectLocalEnvironment(service.dataStore)
+	if err != nil {
+		return err
+	}
+
+	service.environment = environment
+	service.platform = platform
+
+	return nil
+}
+
+func (service *service) GetLocalEnvironment() (*portainer.Endpoint, error) {
+	service.mu.Lock()
+	defer service.mu.Unlock()
+
+	if err := service.loadEnvAndPlatform(); err != nil {
+		return nil, err
+	}
+
+	return service.environment, nil
+}
+
+func (service *service) GetPlatform() (ContainerPlatform, error) {
+	service.mu.Lock()
+	defer service.mu.Unlock()
+
+	if err := service.loadEnvAndPlatform(); err != nil {
+		return "", err
+	}
+
+	return service.platform, nil
+}
+
+var platformToEndpointType = map[ContainerPlatform][]portainer.EndpointType{
+	PlatformDocker:     {portainer.AgentOnDockerEnvironment, portainer.DockerEnvironment},
+	PlatformKubernetes: {portainer.KubernetesLocalEnvironment},
+}
+
+func detectLocalEnvironment(dataStore dataservices.DataStore) (*portainer.Endpoint, ContainerPlatform, error) {
+	platform := DetermineContainerPlatform()
+
+	if !slices.Contains([]ContainerPlatform{PlatformDocker, PlatformKubernetes}, platform) {
+		log.Debug().
+			Str("platform", string(platform)).
+			Msg("environment not supported for upgrade")
+
+		return nil, "", nil
+	}
+
+	endpoints, err := dataStore.Endpoint().Endpoints()
+	if err != nil {
+		return nil, "", fmt.Errorf("failed to retrieve environments: %w", err)
+	}
+
+	// skip guessing when there is no endpoints registered in DB
+	if len(endpoints) == 0 {
+		return nil, "", nil
+	}
+
+	endpointTypes, ok := platformToEndpointType[platform]
+	if !ok {
+		return nil, "", errors.New("failed to determine environment type")
+	}
+
+	for _, endpoint := range endpoints {
+		if !slices.Contains(endpointTypes, endpoint.Type) {
+			continue
+		}
+
+		if platform != PlatformDocker {
+			return &endpoint, platform, nil
+		}
+
+		if dockerPlatform := checkDockerEnvTypeForUpgrade(&endpoint); dockerPlatform != "" {
+			return &endpoint, dockerPlatform, nil
+		}
+	}
+
+	return nil, "", ErrNoLocalEnvironment
+}
+
+func checkDockerEnvTypeForUpgrade(environment *portainer.Endpoint) ContainerPlatform {
+	if endpointutils.IsLocalEndpoint(environment) { // standalone
+		return PlatformDockerStandalone
+	}
+
+	if strings.HasPrefix(environment.URL, "tcp://tasks.") { // swarm
+		return PlatformDockerSwarm
+	}
+
+	return ""
+}
diff --git a/api/portainer.go b/api/portainer.go
new file mode 100644
index 0000000..f944fbe
--- /dev/null
+++ b/api/portainer.go
@@ -0,0 +1,2732 @@
+package portainer
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"time"
+
+	gittypes "github.com/portainer/portainer/api/git/types"
+	models "github.com/portainer/portainer/api/http/models/kubernetes"
+	"github.com/portainer/portainer/api/roar"
+	"github.com/portainer/portainer/pkg/featureflags"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+
+	"github.com/docker/docker/api/types"
+	"github.com/docker/docker/api/types/image"
+	"github.com/docker/docker/api/types/network"
+	"github.com/docker/docker/api/types/system"
+	"github.com/docker/docker/api/types/volume"
+	"github.com/segmentio/encoding/json"
+	"golang.org/x/oauth2"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/version"
+	"k8s.io/client-go/tools/remotecommand"
+)
+
+type (
+	// AccessPolicy represent a policy that can be associated to a user or team
+	AccessPolicy struct {
+		// Role identifier. Reference the role that will be associated to this access policy
+		RoleID RoleID `json:"RoleId" example:"1" validate:"required"`
+		// Namespaces is a list of namespaces that this access policy applies to. Only used for namespaced level roles
+		Namespaces []string `json:"Namespaces,omitempty"`
+	}
+
+	// AgentPlatform represents a platform type for an Agent
+	AgentPlatform int
+
+	// AuthenticationMethod represents the authentication method used to authenticate a user
+	AuthenticationMethod int
+
+	// Authorization represents an authorization associated to an operation
+	Authorization string
+
+	// Authorizations represents a set of authorizations associated to a role
+	Authorizations map[Authorization]bool
+
+	// AutoUpdateSettings represents the git auto sync config for stack deployment
+	AutoUpdateSettings struct {
+		// Auto update interval
+		Interval string `example:"1m30s"`
+		// A UUID generated from client
+		Webhook string `example:"05de31a2-79fa-4644-9c12-faa67e5c49f0"`
+		// Autoupdate job id
+		JobID string `example:"15"`
+		// Force update ignores repo changes
+		ForceUpdate bool `example:"false"`
+		// Pull latest image
+		ForcePullImage bool `example:"false"`
+	}
+
+	// AzureCredentials represents the credentials used to connect to an Azure
+	// environment(endpoint).
+	AzureCredentials struct {
+		// Azure application ID
+		ApplicationID string `json:"ApplicationID" example:"eag7cdo9-o09l-9i83-9dO9-f0b23oe78db4" validate:"required"`
+		// Azure tenant ID
+		TenantID string `json:"TenantID" example:"34ddc78d-4fel-2358-8cc1-df84c8o839f5" validate:"required"`
+		// Azure authentication key
+		AuthenticationKey string `json:"AuthenticationKey" example:"cOrXoK/1D35w8YQ8nH1/8ZGwzz45JIYD5jxHKXEQknk=" validate:"required"`
+	}
+
+	// CLIFlags represents the available flags on the CLI
+	CLIFlags struct {
+		Addr                      *string
+		AddrHTTPS                 *string
+		TunnelAddr                *string
+		TunnelPort                *string
+		AdminPassword             *string
+		AdminPasswordFile         *string
+		Assets                    *string
+		CSP                       *bool
+		CompactDB                 *bool
+		Data                      *string
+		FeatureFlags              *[]string
+		EnableEdgeComputeFeatures *bool
+		EndpointURL               *string
+		Labels                    *[]Pair
+		Logo                      *string
+		NoAnalytics               *bool
+		Templates                 *string
+		TLS                       *bool
+		TLSSkipVerify             *bool
+		HasTLSCacert              *bool
+		TLSCacert                 *string
+		TLSCert                   *string
+		TLSKey                    *string
+		HTTPDisabled              *bool
+		HTTPEnabled               *bool
+		Rollback                  *bool
+		SnapshotInterval          *string
+		BaseURL                   *string
+		InitialMmapSize           *int
+		MaxBatchSize              *int
+		MaxBatchDelay             *time.Duration
+		SecretKeyName             *string
+		LogLevel                  *string
+		LogMode                   *string
+		KubectlShellImage         *string
+		KubectlShellImageSet      bool
+		PullLimitCheckDisabled    *bool
+		TrustedOrigins            *string
+		NoSetupToken              *bool
+		SetupToken                *string
+	}
+
+	// CustomTemplateVariableDefinition
+	CustomTemplateVariableDefinition struct {
+		Name         string `json:"name" example:"MY_VAR"`
+		Label        string `json:"label" example:"My Variable"`
+		DefaultValue string `json:"defaultValue" example:"default value"`
+		Description  string `json:"description" example:"Description"`
+	}
+
+	// CustomTemplate represents a custom template
+	CustomTemplate struct {
+		// CustomTemplate Identifier
+		ID CustomTemplateID `json:"Id" example:"1"`
+		// Title of the template
+		Title string `json:"Title" example:"Nginx"`
+		// Description of the template
+		Description string `json:"Description" example:"High performance web server"`
+		// Path on disk to the repository hosting the Stack file
+		ProjectPath string `json:"ProjectPath" example:"/data/custom_template/3"`
+		// Path to the Stack file
+		EntryPoint string `json:"EntryPoint" example:"docker-compose.yml"`
+		// User identifier who created this template
+		CreatedByUserID UserID `json:"CreatedByUserId" example:"3"`
+		// A note that will be displayed in the UI. Supports HTML content
+		Note string `json:"Note" example:"This is my <b>custom</b> template"`
+		// Platform associated to the template.
+		// Valid values are: 1 - 'linux', 2 - 'windows'
+		Platform CustomTemplatePlatform `json:"Platform" example:"1" enums:"1,2"`
+		// URL of the template's logo
+		Logo string `json:"Logo" example:"https://portainer.io/img/logo.svg"`
+		// Type of created stack:
+		// * 1 - swarm
+		// * 2 - compose
+		// * 3 - kubernetes
+		Type            StackType        `json:"Type" example:"1" enums:"1,2,3"`
+		ResourceControl *ResourceControl `json:"ResourceControl"`
+		Variables       []CustomTemplateVariableDefinition
+		GitConfig       *gittypes.RepoConfig `json:"GitConfig"`
+		Artifact        *Artifact            `json:"artifact,omitempty"`
+		// IsComposeFormat indicates if the Kubernetes template is created from a Docker Compose file
+		IsComposeFormat bool `example:"false"`
+		// EdgeTemplate indicates if this template purpose for Edge Stack
+		EdgeTemplate bool `example:"false"`
+	}
+
+	// CustomTemplateID represents a custom template identifier
+	CustomTemplateID int
+
+	// CustomTemplatePlatform represents a custom template platform
+	CustomTemplatePlatform int
+
+	// DiagnosticsData represents the diagnostics data for an environment
+	// this contains the logs, telnet, traceroute, dns and proxy information
+	// which will be part of the DockerSnapshot and KubernetesSnapshot structs
+	DiagnosticsData struct {
+		Log    string            `json:"Log,omitempty"`
+		Telnet map[string]string `json:"Telnet,omitempty"`
+		DNS    map[string]string `json:"DNS,omitempty"`
+		Proxy  map[string]string `json:"Proxy,omitempty"`
+	}
+
+	// DockerHub represents all the required information to connect and use the
+	// Docker Hub
+	DockerHub struct {
+		// Is authentication against DockerHub enabled
+		Authentication bool `json:"Authentication" example:"true"`
+		// Username used to authenticate against the DockerHub
+		Username string `json:"Username" example:"user"`
+		// Password used to authenticate against the DockerHub
+		Password string `json:"Password,omitempty" example:"passwd"`
+	}
+
+	// DockerSnapshot represents a snapshot of a specific Docker environment(endpoint) at a specific time
+	DockerSnapshot struct {
+		Time                    int64               `json:"Time" validate:"required"`
+		DockerVersion           string              `json:"DockerVersion" validate:"required"`
+		Swarm                   bool                `json:"Swarm" validate:"required"`
+		TotalCPU                int                 `json:"TotalCPU" validate:"required"`
+		TotalMemory             int64               `json:"TotalMemory" validate:"required"`
+		ContainerCount          int                 `json:"ContainerCount" validate:"required"`
+		RunningContainerCount   int                 `json:"RunningContainerCount" validate:"required"`
+		StoppedContainerCount   int                 `json:"StoppedContainerCount" validate:"required"`
+		HealthyContainerCount   int                 `json:"HealthyContainerCount" validate:"required"`
+		UnhealthyContainerCount int                 `json:"UnhealthyContainerCount" validate:"required"`
+		VolumeCount             int                 `json:"VolumeCount" validate:"required"`
+		ImageCount              int                 `json:"ImageCount" validate:"required"`
+		ServiceCount            int                 `json:"ServiceCount" validate:"required"`
+		StackCount              int                 `json:"StackCount" validate:"required"`
+		SnapshotRaw             DockerSnapshotRaw   `json:"DockerSnapshotRaw"`
+		NodeCount               int                 `json:"NodeCount" validate:"required"`
+		GpuUseAll               bool                `json:"GpuUseAll" validate:"required"`
+		GpuUseList              []string            `json:"GpuUseList,omitempty"`
+		IsPodman                bool                `json:"IsPodman" validate:"required"`
+		DiagnosticsData         *DiagnosticsData    `json:"DiagnosticsData,omitempty"`
+		PerformanceMetrics      *PerformanceMetrics `json:"PerformanceMetrics,omitempty"`
+	}
+
+	// PerformanceMetrics represents the performance metrics of a Docker, Swarm, Podman, and Kubernetes environments
+	PerformanceMetrics struct {
+		CPUUsage     float64 `json:"CPUUsage,omitempty"`
+		MemoryUsage  float64 `json:"MemoryUsage,omitempty"`
+		DiskUsage    float64 `json:"DiskUsage,omitempty"`
+		NetworkUsage float64 `json:"NetworkUsage,omitempty"`
+	}
+
+	// DockerContainerSnapshot is an extent of Docker's Container struct
+	// It contains some information of Docker's ContainerJSON struct
+	DockerContainerSnapshot struct {
+		types.Container
+		Env []string `json:"Env,omitempty"` // EE-5240
+	}
+
+	// DockerSnapshotRaw represents all the information related to a snapshot as returned by the Docker API
+	DockerSnapshotRaw struct {
+		Containers []DockerContainerSnapshot `json:"Containers,omitempty" swaggerignore:"true"`
+		Volumes    volume.ListResponse       `json:"Volumes" swaggerignore:"true"`
+		Networks   []network.Summary         `json:"Networks,omitempty" swaggerignore:"true"`
+		Images     []image.Summary           `json:"Images,omitempty" swaggerignore:"true"`
+		Info       system.Info               `json:"Info" swaggerignore:"true"`
+		Version    types.Version             `json:"Version" swaggerignore:"true"`
+	}
+
+	// EdgeGroup represents an Edge group
+	EdgeGroup struct {
+		// EdgeGroup Identifier
+		ID           EdgeGroupID           `json:"Id" example:"1"`
+		Name         string                `json:"Name"`
+		Dynamic      bool                  `json:"Dynamic"`
+		TagIDs       []TagID               `json:"TagIds"`
+		EndpointIDs  roar.Roar[EndpointID] `json:"EndpointIds" validate:"optional"`
+		PartialMatch bool                  `json:"PartialMatch"`
+
+		// Deprecated: only used for API responses
+		Endpoints []EndpointID `json:"Endpoints"`
+	}
+
+	// EdgeGroupID represents an Edge group identifier
+	EdgeGroupID int
+
+	// EdgeJob represents a job that can run on Edge environments(endpoints).
+	EdgeJob struct {
+		// EdgeJob Identifier
+		ID             EdgeJobID                          `json:"Id" example:"1"`
+		Created        int64                              `json:"Created"`
+		CronExpression string                             `json:"CronExpression"`
+		Endpoints      map[EndpointID]EdgeJobEndpointMeta `json:"Endpoints"`
+		EdgeGroups     []EdgeGroupID                      `json:"EdgeGroups"`
+		Name           string                             `json:"Name"`
+		ScriptPath     string                             `json:"ScriptPath"`
+		Recurring      bool                               `json:"Recurring"`
+		Version        int                                `json:"Version"`
+
+		// Field used for log collection of Endpoints belonging to EdgeGroups
+		GroupLogsCollection map[EndpointID]EdgeJobEndpointMeta
+	}
+
+	// EdgeJobEndpointMeta represents a meta data object for an Edge job and Environment(Endpoint) relation
+	EdgeJobEndpointMeta struct {
+		LogsStatus  EdgeJobLogsStatus
+		CollectLogs bool
+	}
+
+	// EdgeJobID represents an Edge job identifier
+	EdgeJobID int
+
+	// EdgeJobLogsStatus represent status of logs collection job
+	EdgeJobLogsStatus int
+
+	// EdgeSchedule represents a scheduled job that can run on Edge environments(endpoints).
+	//
+	// Deprecated: in favor of EdgeJob
+	EdgeSchedule struct {
+		// EdgeSchedule Identifier
+		ID             ScheduleID   `json:"Id" example:"1"`
+		CronExpression string       `json:"CronExpression"`
+		Script         string       `json:"Script"`
+		Version        int          `json:"Version"`
+		Endpoints      []EndpointID `json:"Endpoints"`
+	}
+
+	// StackDeploymentStatus records one status transition in the current deployment lifecycle.
+	// The slice is reset at the start of each new deployment, so it represents the
+	// progression of the most recent deployment only (e.g. Deploying -> Active).
+	StackDeploymentStatus struct {
+		Status  StackStatus `json:"Status"`
+		Time    int64       `json:"Time"`
+		Message string      `json:"Message,omitempty"` // populated on Error entries
+	}
+
+	// StackDeploymentInfo records the information of a deployed stack
+	StackDeploymentInfo struct {
+		// Version is the version of the stack and also is the deployed version in edge agent
+		Version int `json:"Version"`
+		// FileVersion is the version of the stack file, used to detect changes
+		FileVersion int `json:"FileVersion"`
+		// ConfigHash is the commit hash of the git repository used for deploying the stack
+		ConfigHash string `json:"ConfigHash,omitempty"`
+		// RepositoryURL is the git repository URL used for deploying the stack
+		RepositoryURL string `json:"RepositoryURL,omitempty"`
+		// ConfigFilePath is the path to the config file in the git repository used for deploying the stack
+		ConfigFilePath string `json:"ConfigFilePath,omitempty"`
+		// ReferenceName is the git reference (branch/tag) used for deploying the stack
+		ReferenceName string `json:"ReferenceName,omitempty"`
+		// AdditionalFiles are the additional files used for deploying the stack
+		AdditionalFiles []string `json:"AdditionalFiles,omitempty"`
+		// SourceID is the Source used for deploying the stack
+		SourceID SourceID `json:"SourceID,omitempty"`
+	}
+
+	// EdgeStack represents an edge stack
+	EdgeStack struct {
+		// EdgeStack Identifier
+		ID     EdgeStackID                    `json:"Id" example:"1"`
+		Name   string                         `json:"Name"`
+		Status map[EndpointID]EdgeStackStatus `json:"Status"`
+		// StatusArray    map[EndpointID][]EdgeStackStatus `json:"StatusArray"`
+		CreationDate   int64                   `json:"CreationDate"`
+		EdgeGroups     []EdgeGroupID           `json:"EdgeGroups"`
+		ProjectPath    string                  `json:"ProjectPath"`
+		EntryPoint     string                  `json:"EntryPoint"`
+		Version        int                     `json:"Version"`
+		NumDeployments int                     `json:"NumDeployments"`
+		ManifestPath   string                  `json:"ManifestPath"`
+		DeploymentType EdgeStackDeploymentType `json:"DeploymentType"`
+		// Uses the manifest's namespaces instead of the default one
+		UseManifestNamespaces bool
+		// The username id which created this stack
+		CreatedByUserId string `example:"1"`
+		// The username which created this stack
+		CreatedBy string `example:"admin"`
+	}
+
+	// HelmConfig represents the Helm configuration for an edge stack.
+	// Exactly one of ChartPath (git repo deployment) or ChartURL (Helm repo deployment) must be set.
+	HelmConfig struct {
+		// ChartPath is the path to a Helm chart folder within the cloned git repository.
+		// Used exclusively for git repo helm deployments. Mutually exclusive with ChartURL.
+		ChartPath string `json:"ChartPath,omitempty" example:"charts/my-app"`
+		// ValuesFiles is a list of relative paths to Helm values YAML files within the cloned git repository.
+		// Used exclusively for git repo helm deployments.
+		ValuesFiles []string `json:"ValuesFiles,omitempty" example:"['values/prod.yaml', 'values/secrets.yaml']"`
+		// ChartURL is the URL of a Helm chart repository.
+		// Used exclusively for Helm repository deployments. Mutually exclusive with ChartPath.
+		ChartURL string `json:"ChartURL,omitempty" example:"https://charts.bitnami.com/bitnami"`
+		// ChartName is the name of the Helm chart within the repository.
+		// Required for Helm repository deployments.
+		ChartName string `json:"ChartName,omitempty" example:"nginx"`
+		// ChartVersion is the version of the Helm chart to deploy. Empty means latest.
+		// Used exclusively for Helm repository deployments.
+		ChartVersion string `json:"ChartVersion,omitempty" example:"15.0.0"`
+		// ValuesInline is the inline YAML string of Helm values.
+		// Used exclusively for Helm repository deployments.
+		ValuesInline string `json:"ValuesInline,omitempty" example:"replicaCount: 2"`
+		// Atomic enables automatic rollback on deployment failure (equivalent to helm --atomic).
+		// Used by both git repo and Helm repository deployments.
+		Atomic bool `json:"Atomic" example:"true"`
+		// Timeout sets the deadline for Helm operations (equivalent to helm --timeout, e.g. "5m0s").
+		// Used by both git repo and Helm repository deployments.
+		Timeout string `json:"Timeout,omitempty" example:"5m0s"`
+		// Namespace is the Kubernetes namespace to deploy the Helm chart into.
+		// Used by both git repo and Helm repository deployments.
+		Namespace string `json:"Namespace,omitempty" example:"default"`
+	}
+
+	EdgeStackStatusForEnv struct {
+		EndpointID EndpointID
+		Status     []EdgeStackDeploymentStatus
+		// EE only feature
+		DeploymentInfo StackDeploymentInfo
+		// RePullImage is a flag to indicate whether the auto update is trigger to re-pull image
+		RePullImage bool `json:"RePullImage,omitempty"`
+		// ForceRedeploy is a flag to indicate whether the force redeployment is set for the current
+		// deployment of the edge stack. The redeployment could be triggered by GitOps Update or manually by user.
+		ForceRedeploy bool `json:"ForceRedeploy,omitempty"`
+
+		// Deprecated(2.36): use ForceRedeploy and RePullImage instead for cleaner
+		// responsibility, but keep it for backward compatibility. To remove in future versions (2.44+)
+		// ReadyRePullImage is a flag to indicate whether the auto update is trigger to re-pull image
+		ReadyRePullImage bool `json:"ReadyRePullImage,omitempty"`
+	}
+
+	EdgeStackDeploymentType int
+
+	// EdgeStackID represents an edge stack id
+	EdgeStackID int
+
+	EdgeStackStatusDetails struct {
+		Pending             bool
+		Ok                  bool
+		Error               bool
+		Acknowledged        bool
+		Remove              bool
+		RemoteUpdateSuccess bool
+		ImagesPulled        bool
+	}
+
+	// EdgeStackStatus represents an edge stack status
+	EdgeStackStatus struct {
+		Status     []EdgeStackDeploymentStatus
+		EndpointID EndpointID
+		// EE only feature
+		DeploymentInfo StackDeploymentInfo
+		// ReadyRePullImage is a flag to indicate whether the auto update is trigger to re-pull image
+		ReadyRePullImage bool `json:"ReadyRePullImage,omitempty"`
+
+		// Deprecated
+		Details *EdgeStackStatusDetails `json:"Details,omitempty"`
+		// Deprecated
+		Error string `json:"Error,omitempty"`
+		// Deprecated
+		Type EdgeStackStatusType `json:"Type,omitempty"`
+	}
+
+	// EdgeStackDeploymentStatus represents an edge stack deployment status
+	EdgeStackDeploymentStatus struct {
+		Time  int64
+		Type  EdgeStackStatusType
+		Error string `json:"Error,omitempty"`
+		// EE only feature
+		RollbackTo *int `json:"RollbackTo,omitempty"`
+		Version    int  `json:"Version,omitempty"`
+	}
+
+	// EdgeStackStatusType represents an edge stack status type
+	EdgeStackStatusType int
+
+	// Environment(Endpoint) represents a Docker environment(endpoint) with all the info required
+	// to connect to it
+	Endpoint struct {
+		// Environment(Endpoint) Identifier
+		ID EndpointID `json:"Id" example:"1" validate:"required"`
+		// Environment(Endpoint) name
+		Name string `json:"Name" example:"my-environment" validate:"required"`
+		// Environment(Endpoint) environment(endpoint) type. 1 for a Docker environment(endpoint), 2 for an agent on Docker environment(endpoint) or 3 for an Azure environment(endpoint).
+		Type EndpointType `json:"Type" example:"1" validate:"required"`
+		// ContainerEngine represents the container engine type. This can be 'docker' or 'podman' when interacting directly with these environments, otherwise '' for kubernetes environments.
+		ContainerEngine string `json:"ContainerEngine" example:"docker" validate:"required"`
+		// URL or IP address of the Docker host associated to this environment(endpoint)
+		URL string `json:"URL" example:"docker.mydomain.tld:2375" validate:"required"`
+		// Environment(Endpoint) group identifier
+		GroupID EndpointGroupID `json:"GroupId" example:"1" validate:"required"`
+		// URL or IP address where exposed containers will be reachable
+		PublicURL        string           `json:"PublicURL" example:"docker.mydomain.tld:2375" validate:"required"`
+		Gpus             []Pair           `json:"Gpus,omitempty"`
+		TLSConfig        TLSConfiguration `json:"TLSConfig" validate:"required"`
+		AzureCredentials AzureCredentials `json:"AzureCredentials,omitzero"`
+		// List of tag identifiers to which this environment(endpoint) is associated
+		TagIDs []TagID `json:"TagIds,omitempty"`
+		// The status of the environment(endpoint) (1 - up, 2 - down, 3 - provisioning, 4 - error)
+		Status EndpointStatus `json:"Status,omitempty" example:"1" enums:"1,2,3,4"`
+		// List of snapshots
+		Snapshots []DockerSnapshot `json:"Snapshots,omitempty"`
+		// List of user identifiers authorized to connect to this environment(endpoint)
+		UserAccessPolicies UserAccessPolicies `json:"UserAccessPolicies,omitempty"`
+		// List of team identifiers authorized to connect to this environment(endpoint)
+		TeamAccessPolicies TeamAccessPolicies `json:"TeamAccessPolicies,omitempty"`
+		// The identifier of the edge agent associated with this environment(endpoint)
+		EdgeID string `json:"EdgeID,omitempty"`
+		// The key which is used to map the agent to Portainer
+		EdgeKey string `json:"EdgeKey" validate:"required"`
+		// The check in interval for edge agent (in seconds)
+		EdgeCheckinInterval int `json:"EdgeCheckinInterval" example:"5" validate:"required"`
+		// Associated Kubernetes data
+		Kubernetes KubernetesData `json:"Kubernetes" validate:"required"`
+		// Maximum version of docker-compose
+		ComposeSyntaxMaxVersion string `json:"ComposeSyntaxMaxVersion" example:"3.8" validate:"required"`
+		// Environment(Endpoint) specific security settings
+		SecuritySettings EndpointSecuritySettings `validate:"required"`
+		// LastCheckInDate mark last check-in date on checkin
+		LastCheckInDate int64 `validate:"required"`
+		// Heartbeat indicates the heartbeat status of an edge environment
+		Heartbeat bool `json:"Heartbeat" example:"true"`
+
+		// Whether the device has been trusted or not by the user
+		UserTrusted bool `json:"UserTrusted,omitempty"`
+
+		// Whether we need to run any "post init migrations".
+		PostInitMigrations EndpointPostInitMigrations `json:"PostInitMigrations" swaggerignore:"true"`
+
+		Edge EnvironmentEdgeSettings `validate:"required"`
+
+		Agent EnvironmentAgentData `validate:"required"`
+
+		EnableGPUManagement bool `json:"EnableGPUManagement,omitempty"`
+
+		// Deprecated fields
+		// Deprecated in DBVersion == 4
+		TLS           bool   `json:"TLS,omitempty" swaggerignore:"true"`
+		TLSCACertPath string `json:"TLSCACert,omitempty" swaggerignore:"true"`
+		TLSCertPath   string `json:"TLSCert,omitempty" swaggerignore:"true"`
+		TLSKeyPath    string `json:"TLSKey,omitempty" swaggerignore:"true"`
+
+		// Deprecated in DBVersion == 18
+		AuthorizedUsers []UserID `json:"AuthorizedUsers,omitempty" swaggerignore:"true"`
+		AuthorizedTeams []TeamID `json:"AuthorizedTeams,omitempty" swaggerignore:"true"`
+
+		// Deprecated in DBVersion == 22
+		Tags []string `json:"Tags,omitempty" swaggerignore:"true"`
+
+		// Deprecated v2.18
+		IsEdgeDevice bool `json:"IsEdgeDevice,omitempty" swaggerignore:"true"`
+	}
+
+	// EnvironmentAgentData represents the data associated to an agent deployed
+	EnvironmentAgentData struct {
+		Version string `json:"Version,omitempty" example:"1.0.0"`
+	}
+
+	EnvironmentEdgeSettings struct {
+		// Whether the device has been started in edge async mode
+		AsyncMode bool `validate:"required"`
+		// The ping interval for edge agent - used in edge async mode [seconds]
+		PingInterval int `json:"PingInterval" example:"60" validate:"required"`
+		// The snapshot interval for edge agent - used in edge async mode [seconds]
+		SnapshotInterval int `json:"SnapshotInterval" example:"60" validate:"required"`
+		// The command list interval for edge agent - used in edge async mode [seconds]
+		CommandInterval int `json:"CommandInterval" example:"60" validate:"required"`
+	}
+
+	// EndpointAuthorizations represents the authorizations associated to a set of environments(endpoints)
+	EndpointAuthorizations map[EndpointID]Authorizations
+
+	// EndpointGroup represents a group of environments(endpoints).
+	//
+	// An environment(endpoint) may belong to only 1 environment(endpoint) group.
+	EndpointGroup struct {
+		// Environment(Endpoint) group Identifier
+		ID EndpointGroupID `json:"Id" example:"1" validate:"required"`
+		// Environment(Endpoint) group name
+		Name string `json:"Name" example:"my-environment-group" validate:"required"`
+		// Description associated to the environment(endpoint) group
+		Description        string             `json:"Description" example:"Environment(Endpoint) group description" validate:"required"`
+		UserAccessPolicies UserAccessPolicies `json:"UserAccessPolicies,omitempty"`
+		TeamAccessPolicies TeamAccessPolicies `json:"TeamAccessPolicies,omitempty"`
+		// List of tags associated to this environment(endpoint) group
+		TagIDs []TagID `json:"TagIds,omitempty"`
+
+		// Deprecated fields
+		Labels []Pair `json:"Labels,omitempty" swaggerignore:"true"`
+
+		// Deprecated in DBVersion == 18
+		AuthorizedUsers []UserID `json:"AuthorizedUsers,omitempty" swaggerignore:"true"`
+		AuthorizedTeams []TeamID `json:"AuthorizedTeams,omitempty" swaggerignore:"true"`
+
+		// Deprecated in DBVersion == 22
+		Tags []string `json:"Tags,omitempty" swaggerignore:"true"`
+	}
+
+	PolicyChartSummary struct {
+		ChartName   string   `json:"ChartName"`
+		Fingerprint string   `json:"Fingerprint"`
+		PolicyID    PolicyID `json:"PolicyID,omitempty"` // 0 when server hasn't populated the field
+	}
+
+	PolicyChartStatus struct {
+		// EnvironmentID is the endpoint this status belongs to.
+		// Stored so that ReadAll can group statuses by endpoint without parsing keys.
+		EnvironmentID EndpointID        `json:"environmentID,omitempty"`
+		ChartName     string            `json:"chartName"`
+		Fingerprint   string            `json:"fingerprint"`
+		Status        HelmInstallStatus `json:"status"`
+		Message       string            `json:"message"`
+		Namespace     string            `json:"namespace"`
+		// Unix timestamp
+		LastAttemptTime int64 `json:"lastAttemptTime"`
+	}
+
+	ImageBundle struct {
+		FileName     string `json:"FileName"`
+		EncodedTarGz string `json:"EncodedTarGz"`
+	}
+
+	PolicyChartBundle struct {
+		PolicyChartSummary `mapstructure:",squash"`
+		EncodedTgz         string `json:"EncodedTgz"`
+		Namespace          string `json:"Namespace"`
+		ReleaseName        string `json:"ReleaseName,omitempty"`
+		// Base64 YAML kubectl-applied by the agent before Helm install when set (e.g. Gatekeeper gatekeeper-system namespace + PSA labels).
+		PreReleaseManifest  string             `json:"PreReleaseManifest,omitempty"`
+		EncodedValues       string             `json:"EncodedValues"`
+		PreInstallDeletions []ResourceDeletion `json:"PreInstallDeletions,omitempty"`
+		PreInstallAdoptions []ResourceAdoption `json:"PreInstallAdoptions,omitempty"`
+		// WaitForCRDs lists CRD names that must be registered in API discovery after
+		// this chart installs before the agent proceeds to the next chart.
+		WaitForCRDs []string `json:"WaitForCRDs,omitempty"`
+		// NoWait disables waiting for pods to be ready after install.
+		NoWait bool `json:"NoWait,omitempty"`
+	}
+
+	// ResourceDeletion identifies an existing Kubernetes resource to delete before policy install
+	ResourceDeletion struct {
+		APIVersion string `json:"apiVersion" example:"v1" yaml:"apiVersion"`
+		Kind       string `json:"kind" example:"Secret" yaml:"kind"`
+		Name       string `json:"name" example:"registry-1" yaml:"name"`
+		Namespace  string `json:"namespace,omitempty" example:"default" yaml:"namespace,omitempty"`
+	}
+
+	// ResourceAdoption identifies an existing Kubernetes resource to adopt into a Helm release
+	ResourceAdoption struct {
+		APIVersion string `json:"apiVersion" example:"v1" yaml:"apiVersion"`
+		Kind       string `json:"kind" example:"Secret" yaml:"kind"`
+		Name       string `json:"name" example:"registry-1" yaml:"name"`
+		Namespace  string `json:"namespace,omitempty" example:"default" yaml:"namespace,omitempty"`
+	}
+
+	// RestoreSettings contains instructions for restoring environment-level settings
+	RestoreSettings struct {
+		Manifest string `json:"manifest,omitempty"` // Base64-encoded Kubernetes YAML manifest
+	}
+
+	// RestoreSettingsBundle maps restore type to restoration instructions
+	RestoreSettingsBundle map[PolicyType]RestoreSettings
+
+	PolicyID int
+
+	// PolicyDesiredState is the per-policy desired state sent from server to agent
+	// in PollStatusResponse.PolicyStates (per-policy payload format).
+	PolicyDesiredState struct {
+		PolicyID    PolicyID `json:"policyID"`
+		Type        string   `json:"type"`        // e.g. "helm-k8s"
+		Fingerprint string   `json:"fingerprint"` // install-affecting only; restore manifest excluded
+		Config      []byte   `json:"config"`      // handler-specific config blob (e.g. HelmPolicyConfig JSON)
+	}
+
+	// PolicyStatesAsyncPayload is the value of an async "policyStates" command.
+	// States carries per-policy desired state; ChartBundles carries helm chart tarballs
+	// for policies that need installing (emitted only on mutation, never idle polls).
+	PolicyStatesAsyncPayload struct {
+		States        []PolicyDesiredState  `json:"states"`
+		ChartBundles  []PolicyChartBundle   `json:"chartBundles,omitempty"`
+		RestoreBundle RestoreSettingsBundle `json:"restoreBundle,omitempty"`
+	}
+
+	// PolicyActualState is the per-policy actual state reported by the agent
+	// via PUT /endpoints/{id}/edge/policies/statuses.
+	PolicyActualState struct {
+		PolicyID    PolicyID `json:"policyID"`
+		Type        string   `json:"type"`
+		Fingerprint string   `json:"fingerprint"`
+		Status      string   `json:"status"` // applying|applied|failed|removing
+		Message     string   `json:"message,omitempty"`
+	}
+
+	// HelmPolicyConfig is the Config payload for "helm-k8s" PolicyDesiredState entries.
+	// Bundles are not included in the poll response Config — they travel separately
+	// (sync: on-demand GetCharts; async: PolicyStatesCommandPayload.ChartBundles).
+	// RestoreSettings is helm-internal metadata and is intentionally NOT part of the
+	// fingerprint — see Fingerprint contract in reconcile-refactor-plan.md.
+	HelmPolicyConfig struct {
+		Charts          []PolicyChartSummary `json:"charts"`
+		Bundles         []PolicyChartBundle  `json:"bundles,omitempty"`
+		RestoreSettings *RestoreSettings     `json:"restoreSettings,omitempty"`
+	}
+
+	// PolicyType represents the type of policy
+	PolicyType string
+)
+
+type (
+	// EndpointGroupID represents an environment(endpoint) group identifier
+	EndpointGroupID int
+
+	// EndpointID represents an environment(endpoint) identifier
+	EndpointID int
+
+	// EndpointStatus represents the status of an environment(endpoint)
+	EndpointStatus int
+
+	// EndpointSyncJob represents a scheduled job that synchronize environments(endpoints) based on an external file
+	// Deprecated
+	EndpointSyncJob struct{}
+
+	// EndpointSecuritySettings represents settings for an environment(endpoint)
+	EndpointSecuritySettings struct {
+		// Whether non-administrator should be able to use bind mounts when creating containers
+		AllowBindMountsForRegularUsers bool `json:"allowBindMountsForRegularUsers" example:"false" validate:"required"`
+		// Whether non-administrator should be able to use privileged mode when creating containers
+		AllowPrivilegedModeForRegularUsers bool `json:"allowPrivilegedModeForRegularUsers" example:"false" validate:"required"`
+		// Whether non-administrator should be able to browse volumes
+		AllowVolumeBrowserForRegularUsers bool `json:"allowVolumeBrowserForRegularUsers" example:"true" validate:"required"`
+		// Whether non-administrator should be able to use the host pid
+		AllowHostNamespaceForRegularUsers bool `json:"allowHostNamespaceForRegularUsers" example:"true" validate:"required"`
+		// Whether non-administrator should be able to use device mapping
+		AllowDeviceMappingForRegularUsers bool `json:"allowDeviceMappingForRegularUsers" example:"true" validate:"required"`
+		// Whether non-administrator should be able to manage stacks
+		AllowStackManagementForRegularUsers bool `json:"allowStackManagementForRegularUsers" example:"true" validate:"required"`
+		// Whether non-administrator should be able to use container capabilities
+		AllowContainerCapabilitiesForRegularUsers bool `json:"allowContainerCapabilitiesForRegularUsers" example:"true" validate:"required"`
+		// Whether non-administrator should be able to use sysctl settings
+		AllowSysctlSettingForRegularUsers bool `json:"allowSysctlSettingForRegularUsers" example:"true" validate:"required"`
+		// Whether non-administrator should be able to use security-opt settings
+		AllowSecurityOptForRegularUsers bool `json:"allowSecurityOptForRegularUsers" example:"true" validate:"required"`
+		// Whether host management features are enabled
+		EnableHostManagementFeatures bool `json:"enableHostManagementFeatures" example:"true" validate:"required"`
+	}
+
+	// EndpointType represents the type of an environment(endpoint)
+	EndpointType int
+
+	// PlatformType represents the platform that an agent is running on
+	PlatformType int
+
+	// EndpointRelation represents a environment(endpoint) relation object
+	EndpointRelation struct {
+		EndpointID EndpointID
+		EdgeStacks map[EdgeStackID]bool
+	}
+
+	// EndpointPostInitMigrations
+	EndpointPostInitMigrations struct {
+		MigrateIngresses         bool `json:"MigrateIngresses"`
+		MigrateGPUs              bool `json:"MigrateGPUs"`
+		MigrateRegistrySASecrets bool `json:"MigrateRegistrySASecrets"`
+	}
+
+	// Extension represents a deprecated Portainer extension
+	Extension struct {
+		ID               ExtensionID                 `json:"Id" example:"1"`
+		Enabled          bool                        `json:"Enabled"`
+		Name             string                      `json:"Name,omitempty"`
+		ShortDescription string                      `json:"ShortDescription,omitempty"`
+		Description      string                      `json:"Description,omitempty"`
+		DescriptionURL   string                      `json:"DescriptionURL,omitempty"`
+		Price            string                      `json:"Price,omitempty"`
+		PriceDescription string                      `json:"PriceDescription,omitempty"`
+		Deal             bool                        `json:"Deal,omitempty"`
+		Available        bool                        `json:"Available,omitempty"`
+		License          ExtensionLicenseInformation `json:"License,omitzero"`
+		Version          string                      `json:"Version"`
+		UpdateAvailable  bool                        `json:"UpdateAvailable"`
+		ShopURL          string                      `json:"ShopURL,omitempty"`
+		Images           []string                    `json:"Images,omitempty"`
+		Logo             string                      `json:"Logo,omitempty"`
+	}
+
+	// ExtensionID represents a extension identifier
+	ExtensionID int
+
+	// GitlabRegistryData represents data required for gitlab registry to work
+	GitlabRegistryData struct {
+		ProjectID   int    `json:"ProjectId"`
+		InstanceURL string `json:"InstanceURL"`
+		ProjectPath string `json:"ProjectPath"`
+	}
+
+	// GithubRegistryData represents data required for Github registry to work
+	GithubRegistryData struct {
+		UseOrganisation  bool   `json:"UseOrganisation"`
+		OrganisationName string `json:"OrganisationName"`
+	}
+
+	HelmUserRepositoryID int
+
+	// HelmUserRepositories stores a Helm repository URL for the given user
+	HelmUserRepository struct {
+		// Membership Identifier
+		ID HelmUserRepositoryID `json:"Id" example:"1"`
+		// User identifier
+		UserID UserID `json:"UserId" example:"1"`
+		// Helm repository URL
+		URL string `json:"URL" example:"https://charts.bitnami.com/bitnami"`
+	}
+
+	// QuayRegistryData represents data required for Quay registry to work
+	QuayRegistryData struct {
+		UseOrganisation  bool   `json:"UseOrganisation,omitempty"`
+		OrganisationName string `json:"OrganisationName"`
+	}
+
+	// EcrData represents data required for ECR registry
+	EcrData struct {
+		Region string `json:"Region" example:"ap-southeast-2"`
+	}
+
+	// JobType represents a job type
+	JobType int
+
+	K8sNamespaceInfo struct {
+		Id                  string                 `json:"Id"`
+		Name                string                 `json:"Name"`
+		Status              corev1.NamespaceStatus `json:"Status"`
+		Annotations         map[string]string      `json:"Annotations"`
+		CreationDate        string                 `json:"CreationDate"`
+		UnhealthyEventCount int                    `json:"UnhealthyEventCount"`
+		NamespaceOwner      string                 `json:"NamespaceOwner"`
+		IsSystem            bool                   `json:"IsSystem"`
+		IsDefault           bool                   `json:"IsDefault"`
+		ResourceQuota       *corev1.ResourceQuota  `json:"ResourceQuota"`
+	}
+
+	K8sNodeLimits struct {
+		CPU    int64 `json:"CPU"`
+		Memory int64 `json:"Memory"`
+	}
+
+	K8sNodesLimits map[string]*K8sNodeLimits
+
+	K8sNamespaceAccessPolicy struct {
+		UserAccessPolicies UserAccessPolicies `json:"UserAccessPolicies"`
+		TeamAccessPolicies TeamAccessPolicies `json:"TeamAccessPolicies"`
+	}
+
+	// KubernetesData contains all the Kubernetes related environment(endpoint) information
+	KubernetesData struct {
+		Snapshots     []KubernetesSnapshot    `json:"Snapshots,omitempty"`
+		Configuration KubernetesConfiguration `json:"Configuration" validate:"required"`
+		Flags         KubernetesFlags         `json:"Flags" validate:"required"`
+	}
+
+	// KubernetesFlags are used to detect if we need to run initial cluster
+	// detection again.
+	KubernetesFlags struct {
+		IsServerMetricsDetected      bool `json:"IsServerMetricsDetected" validate:"required"`
+		IsServerIngressClassDetected bool `json:"IsServerIngressClassDetected" validate:"required"`
+		IsServerStorageDetected      bool `json:"IsServerStorageDetected" validate:"required"`
+		GPUOperator                  bool `json:"GPUOperator,omitempty"`
+	}
+
+	// KubernetesSnapshot represents a snapshot of a specific Kubernetes environment(endpoint) at a specific time
+	KubernetesSnapshot struct {
+		Time               int64               `json:"Time" validate:"required"`
+		KubernetesVersion  string              `json:"KubernetesVersion" validate:"required"`
+		NodeCount          int                 `json:"NodeCount" validate:"required"`
+		TotalCPU           int64               `json:"TotalCPU" validate:"required"`
+		TotalMemory        int64               `json:"TotalMemory" validate:"required"`
+		ClusterType        string              `json:"ClusterType,omitempty"`
+		GPUNodeCount       int                 `json:"GPUNodeCount,omitempty"`
+		TotalGPU           map[string]int64    `json:"TotalGPU,omitempty"`
+		DiagnosticsData    *DiagnosticsData    `json:"DiagnosticsData,omitempty"`
+		PerformanceMetrics *PerformanceMetrics `json:"PerformanceMetrics,omitempty"`
+	}
+
+	// KubernetesConfiguration represents the configuration of a Kubernetes environment(endpoint)
+	KubernetesConfiguration struct {
+		UseLoadBalancer                 bool                           `json:"UseLoadBalancer"`
+		UseServerMetrics                bool                           `json:"UseServerMetrics"`
+		EnableResourceOverCommit        bool                           `json:"EnableResourceOverCommit"`
+		ResourceOverCommitPercentage    int                            `json:"ResourceOverCommitPercentage"`
+		StorageClasses                  []KubernetesStorageClassConfig `json:"StorageClasses,omitempty"`
+		IngressClasses                  []KubernetesIngressClassConfig `json:"IngressClasses,omitempty"`
+		RestrictDefaultNamespace        bool                           `json:"RestrictDefaultNamespace"`
+		IngressAvailabilityPerNamespace bool                           `json:"IngressAvailabilityPerNamespace" validate:"required"`
+		AllowNoneIngressClass           bool                           `json:"AllowNoneIngressClass" validate:"required"`
+	}
+
+	// KubernetesStorageClassConfig represents a Kubernetes Storage Class configuration
+	KubernetesStorageClassConfig struct {
+		Name                 string   `json:"Name" validate:"required"`
+		AccessModes          []string `json:"AccessModes,omitempty"`
+		Provisioner          string   `json:"Provisioner" validate:"required"`
+		AllowVolumeExpansion bool     `json:"AllowVolumeExpansion" validate:"required"`
+	}
+
+	// KubernetesIngressClassConfig represents a Kubernetes Ingress Class configuration
+	KubernetesIngressClassConfig struct {
+		Name              string   `json:"Name" validate:"required"`
+		Type              string   `json:"Type" validate:"required"`
+		GloballyBlocked   bool     `json:"Blocked"`
+		BlockedNamespaces []string `json:"BlockedNamespaces,omitempty"`
+	}
+
+	// KubernetesShellPod represents a Kubectl Shell details to facilitate pod exec functionality
+	KubernetesShellPod struct {
+		Namespace        string
+		PodName          string
+		ContainerName    string
+		ShellExecCommand string
+	}
+
+	// InternalAuthSettings represents settings used for the default 'internal' authentication
+	InternalAuthSettings struct {
+		RequiredPasswordLength int
+	}
+
+	// LDAPGroupSearchSettings represents settings used to search for groups in a LDAP server
+	LDAPGroupSearchSettings struct {
+		// The distinguished name of the element from which the LDAP server will search for groups
+		GroupBaseDN string `json:"GroupBaseDN" example:"dc=ldap,dc=domain,dc=tld"`
+		// The LDAP search filter used to select group elements, optional
+		GroupFilter string `json:"GroupFilter" example:"(objectClass=account"`
+		// LDAP attribute which denotes the group membership
+		GroupAttribute string `json:"GroupAttribute" example:"member"`
+	}
+
+	// LDAPSearchSettings represents settings used to search for users in a LDAP server
+	LDAPSearchSettings struct {
+		// The distinguished name of the element from which the LDAP server will search for users
+		BaseDN string `json:"BaseDN" example:"dc=ldap,dc=domain,dc=tld"`
+		// Optional LDAP search filter used to select user elements
+		Filter string `json:"Filter" example:"(objectClass=account)"`
+		// LDAP attribute which denotes the username
+		UserNameAttribute string `json:"UserNameAttribute" example:"uid"`
+	}
+
+	// LDAPSettings represents the settings used to connect to a LDAP server
+	LDAPSettings struct {
+		// Enable this option if the server is configured for Anonymous access. When enabled, ReaderDN and Password will not be used
+		AnonymousMode bool `json:"AnonymousMode" example:"true" validate:"validate_bool"`
+		// Account that will be used to search for users
+		ReaderDN string `json:"ReaderDN" example:"cn=readonly-account,dc=ldap,dc=domain,dc=tld" validate:"required_if=AnonymousMode false"`
+		// Password of the account that will be used to search users
+		Password string `json:"Password,omitempty" example:"readonly-password" validate:"required_if=AnonymousMode false"`
+		// URL or IP address of the LDAP server
+		URL       string           `json:"URL" example:"myldap.domain.tld:389" validate:"hostname_port"`
+		TLSConfig TLSConfiguration `json:"TLSConfig"`
+		// Whether LDAP connection should use StartTLS
+		StartTLS            bool                      `json:"StartTLS" example:"true"`
+		SearchSettings      []LDAPSearchSettings      `json:"SearchSettings"`
+		GroupSearchSettings []LDAPGroupSearchSettings `json:"GroupSearchSettings"`
+		// Automatically provision users and assign them to matching LDAP group names
+		AutoCreateUsers bool `json:"AutoCreateUsers" example:"true"`
+	}
+
+	// LDAPUser represents a LDAP user
+	LDAPUser struct {
+		Name   string
+		Groups []string
+	}
+
+	// ExtensionLicenseInformation represents information about an extension license
+	ExtensionLicenseInformation struct {
+		LicenseKey string `json:"LicenseKey,omitempty"`
+		Company    string `json:"Company,omitempty"`
+		Expiration string `json:"Expiration,omitempty"`
+		Valid      bool   `json:"Valid,omitempty"`
+	}
+
+	// MembershipRole represents the role of a user within a team
+	MembershipRole int
+
+	// OAuthSettings represents the settings used to authorize with an authorization server
+	OAuthSettings struct {
+		ClientID             string           `json:"ClientID"`
+		ClientSecret         string           `json:"ClientSecret,omitempty"`
+		AccessTokenURI       string           `json:"AccessTokenURI"`
+		AuthorizationURI     string           `json:"AuthorizationURI"`
+		ResourceURI          string           `json:"ResourceURI"`
+		RedirectURI          string           `json:"RedirectURI"`
+		UserIdentifier       string           `json:"UserIdentifier"`
+		Scopes               string           `json:"Scopes"`
+		OAuthAutoCreateUsers bool             `json:"OAuthAutoCreateUsers"`
+		DefaultTeamID        TeamID           `json:"DefaultTeamID"`
+		SSO                  bool             `json:"SSO"`
+		LogoutURI            string           `json:"LogoutURI"`
+		KubeSecretKey        []byte           `json:"KubeSecretKey"`
+		AuthStyle            oauth2.AuthStyle `json:"AuthStyle"`
+	}
+
+	// Pair defines a key/value string pair
+	Pair struct {
+		Name  string `json:"name" example:"name" validate:"required"`
+		Value string `json:"value" example:"value" validate:"required"`
+	}
+
+	// Registry represents a Docker registry with all the info required
+	// to connect to it
+	Registry struct {
+		// Registry Identifier
+		ID RegistryID `json:"Id" example:"1"`
+		// Registry Type (1 - Quay, 2 - Azure, 3 - Custom, 4 - Gitlab, 5 - ProGet, 6 - DockerHub, 7 - ECR)
+		Type RegistryType `json:"Type" enums:"1,2,3,4,5,6,7"`
+		// Registry Name
+		Name string `json:"Name" example:"my-registry"`
+		// URL or IP address of the Docker registry
+		URL string `json:"URL" example:"registry.mydomain.tld:2375"`
+		// Base URL, introduced for ProGet registry
+		BaseURL string `json:"BaseURL" example:"registry.mydomain.tld:2375"`
+		// Is authentication against this registry enabled
+		Authentication bool `json:"Authentication" example:"true"`
+		// Username or AccessKeyID used to authenticate against this registry
+		Username string `json:"Username" example:"registry user"`
+		// Password or SecretAccessKey used to authenticate against this registry
+		Password                string                           `json:"Password,omitempty" example:"registry_password"`
+		ManagementConfiguration *RegistryManagementConfiguration `json:"ManagementConfiguration"`
+		Gitlab                  GitlabRegistryData               `json:"Gitlab"`
+		Github                  GithubRegistryData               `json:"Github"`
+		Quay                    QuayRegistryData                 `json:"Quay"`
+		Ecr                     EcrData                          `json:"Ecr"`
+		RegistryAccesses        RegistryAccesses                 `json:"RegistryAccesses"`
+
+		// Deprecated fields
+		// Deprecated in DBVersion == 31
+		UserAccessPolicies UserAccessPolicies `json:"UserAccessPolicies"`
+		// Deprecated in DBVersion == 31
+		TeamAccessPolicies TeamAccessPolicies `json:"TeamAccessPolicies"`
+
+		// Deprecated in DBVersion == 18
+		AuthorizedUsers []UserID `json:"AuthorizedUsers"`
+		// Deprecated in DBVersion == 18
+		AuthorizedTeams []TeamID `json:"AuthorizedTeams"`
+
+		// Stores temporary access token
+		AccessToken       string `json:"AccessToken,omitempty"`
+		AccessTokenExpiry int64  `json:"AccessTokenExpiry,omitempty"`
+	}
+
+	RegistryAccesses map[EndpointID]RegistryAccessPolicies
+
+	RegistryAccessPolicies struct {
+		// Docker specific fields (with docker, users/teams have access to a registry)
+		UserAccessPolicies UserAccessPolicies `json:"UserAccessPolicies"`
+		TeamAccessPolicies TeamAccessPolicies `json:"TeamAccessPolicies"`
+		// Kubernetes specific fields (with kubernetes, namespaces have access to a registry, if users/teams have access to the same namespace, they have access to the registry)
+		Namespaces []string `json:"Namespaces"`
+	}
+
+	// RegistryID represents a registry identifier
+	RegistryID int
+
+	// RegistryManagementConfiguration represents a configuration that can be used to query
+	// the registry API via the registry management extension.
+	RegistryManagementConfiguration struct {
+		Type              RegistryType     `json:"Type"`
+		Authentication    bool             `json:"Authentication"`
+		Username          string           `json:"Username"`
+		Password          string           `json:"Password"`
+		TLSConfig         TLSConfiguration `json:"TLSConfig"`
+		Ecr               EcrData          `json:"Ecr"`
+		AccessToken       string           `json:"AccessToken,omitempty"`
+		AccessTokenExpiry int64            `json:"AccessTokenExpiry,omitempty"`
+	}
+
+	// RegistryType represents a type of registry
+	RegistryType int
+
+	// ResourceAccessLevel represents the level of control associated to a resource
+	ResourceAccessLevel int
+
+	// ResourceControl represent a reference to a Docker resource with specific access controls
+	ResourceControl struct {
+		// ResourceControl Identifier
+		ID ResourceControlID `json:"Id" example:"1"`
+		// Docker resource identifier on which access control will be applied.\
+		// In the case of a resource control applied to a stack, use the stack name as identifier
+		ResourceID string `json:"ResourceId" example:"617c5f22bb9b023d6daab7cba43a57576f83492867bc767d1c59416b065e5f08"`
+		// List of Docker resources that will inherit this access control
+		SubResourceIDs []string `json:"SubResourceIds" example:"617c5f22bb9b023d6daab7cba43a57576f83492867bc767d1c59416b065e5f08"`
+		// Type of Docker resource. Valid values are: 1- container, 2 -service
+		// 3 - volume, 4 - secret, 5 - stack, 6 - config or 7 - custom template
+		Type         ResourceControlType  `json:"Type" example:"1"`
+		UserAccesses []UserResourceAccess `json:"UserAccesses"`
+		TeamAccesses []TeamResourceAccess `json:"TeamAccesses"`
+		// Permit access to the associated resource to any user
+		Public bool `json:"Public" example:"true"`
+		// Permit access to resource only to admins
+		AdministratorsOnly bool `json:"AdministratorsOnly" example:"true"`
+		System             bool `json:"System"`
+
+		// Deprecated fields
+		// Deprecated in DBVersion == 2
+		OwnerID     UserID              `json:"OwnerId,omitempty"`
+		AccessLevel ResourceAccessLevel `json:"AccessLevel,omitempty"`
+	}
+
+	// ResourceControlID represents a resource control identifier
+	ResourceControlID int
+
+	// ResourceControlType represents the type of resource associated to the resource control (volume, container, service...)
+	ResourceControlType int
+
+	// Role represents a set of authorizations that can be associated to a user or
+	// to a team.
+	Role struct {
+		// Role Identifier
+		ID RoleID `json:"Id" example:"1"`
+		// Role name
+		Name string `json:"Name" example:"HelpDesk"`
+		// Role description
+		Description string `json:"Description" example:"Read-only access of all resources in an environment(endpoint)"`
+		// Authorizations associated to a role
+		Authorizations Authorizations `json:"Authorizations"`
+		Priority       int            `json:"Priority"`
+	}
+
+	// RoleID represents a role identifier
+	RoleID int
+
+	// APIKeyID represents an API key identifier
+	APIKeyID int
+
+	// APIKey represents an API key
+	APIKey struct {
+		ID          APIKeyID `json:"id" example:"1"`
+		UserID      UserID   `json:"userId" example:"1"`
+		Description string   `json:"description" example:"portainer-api-key"`
+		Prefix      string   `json:"prefix"`           // API key identifier (7 char prefix)
+		DateCreated int64    `json:"dateCreated"`      // Unix timestamp (UTC) when the API key was created
+		LastUsed    int64    `json:"lastUsed"`         // Unix timestamp (UTC) when the API key was last used
+		Digest      string   `json:"digest,omitempty"` // Digest represents SHA256 hash of the raw API key
+	}
+
+	// Schedule represents a scheduled job.
+	// It only contains a pointer to one of the JobRunner implementations
+	// based on the JobType.
+	// NOTE: The Recurring option is only used by ScriptExecutionJob at the moment
+	// Deprecated in favor of EdgeJob
+	Schedule struct {
+		// Schedule Identifier
+		ID             ScheduleID `json:"Id" example:"1"`
+		Name           string
+		CronExpression string
+		Recurring      bool
+		Created        int64
+		JobType        JobType
+		EdgeSchedule   *EdgeSchedule
+	}
+
+	// ScheduleID represents a schedule identifier.
+	// Deprecated in favor of EdgeJob
+	ScheduleID int
+
+	// ScriptExecutionJob represents a scheduled job that can execute a script via a privileged container
+	ScriptExecutionJob struct {
+		Endpoints     []EndpointID
+		Image         string
+		ScriptPath    string
+		RetryCount    int
+		RetryInterval int
+	}
+
+	GlobalDeploymentOptions struct {
+		HideStacksFunctionality bool `json:"hideStacksFunctionality" example:"false"`
+	}
+
+	Edge struct {
+		// The command list interval for edge agent - used in edge async mode (in seconds)
+		CommandInterval int `json:"CommandInterval" example:"5"`
+		// The ping interval for edge agent - used in edge async mode (in seconds)
+		PingInterval int `json:"PingInterval" example:"5"`
+		// The snapshot interval for edge agent - used in edge async mode (in seconds)
+		SnapshotInterval int `json:"SnapshotInterval" example:"5"`
+
+		// Deprecated 2.18
+		AsyncMode bool `json:"AsyncMode,omitempty" example:"false"`
+	}
+
+	// Settings represents the application settings
+	Settings struct {
+		// URL to a logo that will be displayed on the login page as well as on top of the sidebar. Will use default Portainer logo when value is empty string
+		LogoURL string `json:"LogoURL" example:"https://mycompany.mydomain.tld/logo.png"`
+		// A list of label name & value that will be used to hide containers when querying containers
+		BlackListedLabels []Pair `json:"BlackListedLabels"`
+		// Active authentication method for the Portainer instance. Valid values are: 1 for internal, 2 for LDAP, or 3 for oauth
+		AuthenticationMethod AuthenticationMethod          `json:"AuthenticationMethod" example:"1"`
+		InternalAuthSettings InternalAuthSettings          `json:"InternalAuthSettings"`
+		LDAPSettings         LDAPSettings                  `json:"LDAPSettings"`
+		OAuthSettings        OAuthSettings                 `json:"OAuthSettings"`
+		FeatureFlagSettings  map[featureflags.Feature]bool `json:"FeatureFlagSettings"`
+		// The interval in which environment(endpoint) snapshots are created
+		SnapshotInterval string `json:"SnapshotInterval" example:"5m"`
+		// URL to the templates that will be displayed in the UI when navigating to App Templates
+		TemplatesURL string `json:"TemplatesURL" example:"https://raw.githubusercontent.com/portainer/templates/master/templates.json"`
+		// Deployment options for encouraging git ops workflows
+		GlobalDeploymentOptions GlobalDeploymentOptions `json:"GlobalDeploymentOptions"`
+		// The default check in interval for edge agent (in seconds)
+		EdgeAgentCheckinInterval int `json:"EdgeAgentCheckinInterval" example:"5"`
+		// Whether edge compute features are enabled
+		EnableEdgeComputeFeatures bool `json:"EnableEdgeComputeFeatures"`
+		// The duration of a user session
+		UserSessionTimeout string `json:"UserSessionTimeout" example:"5m"`
+		// The expiry of a Kubeconfig
+		KubeconfigExpiry string `json:"KubeconfigExpiry" example:"24h"`
+		// Helm repository URL, defaults to "https://charts.bitnami.com/bitnami"
+		HelmRepositoryURL string `json:"HelmRepositoryURL" example:"https://charts.bitnami.com/bitnami"`
+		// KubectlImage, defaults to portainer/kubectl-shell
+		KubectlShellImage string `json:"KubectlShellImage" example:"portainer/kubectl-shell"`
+		// TrustOnFirstConnect makes Portainer accepting edge agent connection by default
+		TrustOnFirstConnect bool `json:"TrustOnFirstConnect" example:"false"`
+		// EnforceEdgeID makes Portainer store the Edge ID instead of accepting anyone
+		EnforceEdgeID bool `json:"EnforceEdgeID" example:"false"`
+		// Container environment parameter AGENT_SECRET
+		AgentSecret string `json:"AgentSecret"`
+		// EdgePortainerURL is the URL that is exposed to edge agents
+		EdgePortainerURL string `json:"EdgePortainerUrl"`
+
+		Edge Edge `json:"Edge"`
+
+		// Deprecated fields
+		DisplayDonationHeader       bool `json:"DisplayDonationHeader,omitempty"`
+		DisplayExternalContributors bool `json:"DisplayExternalContributors,omitempty"`
+
+		// Deprecated fields v26
+		EnableHostManagementFeatures              bool `json:"EnableHostManagementFeatures,omitempty"`
+		AllowVolumeBrowserForRegularUsers         bool `json:"AllowVolumeBrowserForRegularUsers,omitempty"`
+		AllowBindMountsForRegularUsers            bool `json:"AllowBindMountsForRegularUsers,omitempty"`
+		AllowPrivilegedModeForRegularUsers        bool `json:"AllowPrivilegedModeForRegularUsers,omitempty"`
+		AllowHostNamespaceForRegularUsers         bool `json:"AllowHostNamespaceForRegularUsers,omitempty"`
+		AllowStackManagementForRegularUsers       bool `json:"AllowStackManagementForRegularUsers,omitempty"`
+		AllowDeviceMappingForRegularUsers         bool `json:"AllowDeviceMappingForRegularUsers,omitempty"`
+		AllowContainerCapabilitiesForRegularUsers bool `json:"AllowContainerCapabilitiesForRegularUsers,omitempty"`
+
+		IsDockerDesktopExtension bool `json:"IsDockerDesktopExtension,omitempty"`
+
+		// ForceSecureCookies forces the Secure attribute on auth cookies regardless of detected scheme.
+		// Enable when Portainer runs behind a TLS-terminating proxy.
+		ForceSecureCookies bool `json:"ForceSecureCookies" example:"false"`
+	}
+
+	// SnapshotJob represents a scheduled job that can create environment(endpoint) snapshots
+	SnapshotJob struct{}
+
+	// SoftwareEdition represents an edition of Portainer
+	SoftwareEdition int
+
+	// AllowList holds the list of permitted outbound proxy destinations.
+	AllowList struct {
+		ID      AllowListKey `json:"Id"`
+		Mode    SSRFMode     `json:"Mode"`
+		Entries []string     `json:"Entries"`
+	}
+
+	// ParsedAllowList holds the three parsed forms of allow list entries.
+	ParsedAllowList struct {
+		Mode  SSRFMode
+		Nets  []*net.IPNet
+		Hosts map[string]bool
+		Wilds []string // stored as ".foo.com" ("*." prefix stripped)
+	}
+
+	// SSLSettings represents a pair of SSL certificate and key
+	SSLSettings struct {
+		CertPath    string `json:"certPath"`
+		KeyPath     string `json:"keyPath"`
+		SelfSigned  bool   `json:"selfSigned"`
+		HTTPEnabled bool   `json:"httpEnabled"`
+	}
+
+	// Stack represents a Docker stack created via docker stack deploy
+	Stack struct {
+		// Stack Identifier
+		ID StackID `json:"Id" example:"1"`
+		// Stack name
+		Name string `json:"Name" example:"myStack"`
+		// Stack type. 1 for a Swarm stack, 2 for a Compose stack
+		Type StackType `json:"Type" example:"2"`
+		// Environment(Endpoint) identifier. Reference the environment(endpoint) that will be used for deployment
+		EndpointID EndpointID `json:"EndpointId" example:"1"`
+		// Cluster identifier of the Swarm cluster where the stack is deployed
+		SwarmID string `json:"SwarmId" example:"jpofkc0i9uo9wtx1zesuk649w"`
+		// EntryPoint is the path to the config file relative to the project root.
+		// NOTE: For git stacks this mirrors GitConfig.ConfigFilePath and the two are kept in sync
+		// by stackUpdateGit. The deploy command builder (compose_unpacker_cmd_builder) uses this
+		// field directly; Kubernetes deploy and git clone operations use GitConfig.ConfigFilePath.
+		EntryPoint string `json:"EntryPoint" example:"docker-compose.yml"`
+		// A list of environment(endpoint) variables used during stack deployment
+		Env []Pair `json:"Env"`
+		//
+		ResourceControl *ResourceControl `json:"ResourceControl"`
+		// Stack status (1 - active, 2 - inactive, 3 - deploying, 4 - error)
+		Status StackStatus `json:"Status" example:"1"`
+		// DeploymentStartStatus is the stack status captured when the current
+		// deployment starts. It is used by deployment logic during the current
+		// deployment attempt and is cleared/replaced when a new deployment begins.
+		DeploymentStartStatus StackStatus `json:"DeploymentStartStatus" example:"1"`
+		// Path on disk to the repository hosting the Stack file
+		ProjectPath string `example:"/data/compose/myStack_jpofkc0i9uo9wtx1zesuk649w"`
+		// The date in unix time when stack was created
+		CreationDate int64 `example:"1587399600"`
+		// The username which created this stack
+		CreatedBy string `example:"admin"`
+		// The date in unix time when stack was last updated
+		UpdateDate int64 `example:"1587399600"`
+		// The username which last updated this stack
+		UpdatedBy string `example:"bob"`
+		// Only applies when deploying stack with multiple files
+		AdditionalFiles []string `json:"AdditionalFiles"`
+		// The GitOps update settings of a git stack
+		AutoUpdate *AutoUpdateSettings `json:"AutoUpdate"`
+		// The stack deployment option
+		Option *StackOption `json:"Option"`
+		// GitConfig is the git repository configuration for git-backed stacks.
+		// Deprecated: loaded from Source via WorkflowID; kept for DB backwards-compatibility only.
+		// Non-migration code must not read or write this field; use Source records instead.
+		GitConfig *gittypes.RepoConfig `json:"GitConfig"`
+		// WorkflowID is the ID of the Workflow that owns the Source for this stack.
+		WorkflowID WorkflowID `json:"WorkflowID,omitempty"`
+		// CurrentDeploymentInfo records the git repository state at the time of the last actual deployment.
+		CurrentDeploymentInfo *StackDeploymentInfo `json:"CurrentDeploymentInfo,omitempty"`
+		// Whether the stack is from a app template
+		FromAppTemplate bool `example:"false"`
+		// Kubernetes namespace if stack is a kube application
+		Namespace string `example:"default"`
+		// DeploymentStatus records the status progression of the current deployment.
+		// Cleared when a new deployment starts.
+		DeploymentStatus []StackDeploymentStatus `json:"DeploymentStatus,omitempty"`
+	}
+
+	// StackOption represents the options for stack deployment
+	StackOption struct {
+		// Prune services that are no longer referenced
+		Prune bool `example:"false"`
+		// Enable atomic rollback on failure (Helm --atomic flag for Kubernetes Helm stacks)
+		HelmAtomic bool `example:"false"`
+	}
+
+	// StackID represents a stack identifier (it must be composed of Name + "_" + SwarmID to create a unique identifier)
+	StackID int
+
+	// StackStatus represent a status for a stack
+	StackStatus int
+
+	// StackType represents the type of the stack (compose v2, stack deploy v3)
+	StackType int
+
+	// Source represents a GitOps source that can be referenced by stacks or deployments.
+	Source struct {
+		ID       SourceID            `json:"id" example:"1"`
+		Name     string              `json:"name" example:"my-source"`
+		LastSync int64               `json:"lastSync,omitempty" example:"1587399600"`
+		Type     SourceType          `json:"type" example:"1"`
+		Git      *gittypes.GitSource `json:"git,omitempty"`
+		Registry *Registry           `json:"registry,omitempty"`
+		Helm     *HelmConfig         `json:"helm,omitempty"`
+
+		Public             bool         `json:"public"`
+		AdministratorsOnly bool         `json:"administratorsOnly"`
+		UserAccesses       []UserID     `json:"userAccesses"`
+		TeamAccesses       []TeamID     `json:"teamAccesses"`
+		OwnerID            UserID       `json:"ownerID,omitempty"`
+		Status             SourceStatus `json:"status,omitempty"`
+		StatusError        string       `json:"statusError,omitempty"`
+	}
+
+	SourceStatus int
+
+	// SourceID represents a source identifier
+	SourceID int
+
+	// SourceType represents the type of a source
+	SourceType int
+
+	// Status represents the application status
+	Status struct {
+		// Portainer API version
+		Version string `json:"Version" example:"2.0.0"`
+		// Server Instance ID
+		InstanceID string `example:"299ab403-70a8-4c05-92f7-bf7a994d50df"`
+	}
+
+	// Tag represents a tag that can be associated to a resource
+	Tag struct {
+		// Tag identifier
+		ID TagID `example:"1"`
+		// Tag name
+		Name string `json:"Name" example:"org/acme"`
+		// A set of environment(endpoint) ids that have this tag
+		Endpoints map[EndpointID]bool `json:"Endpoints"`
+		// A set of environment(endpoint) group ids that have this tag
+		EndpointGroups map[EndpointGroupID]bool `json:"EndpointGroups"`
+	}
+
+	// TagID represents a tag identifier
+	TagID int
+
+	// Team represents a list of user accounts
+	Team struct {
+		// Team Identifier
+		ID TeamID `json:"Id" example:"1"`
+		// Team name
+		Name string `json:"Name" example:"developers"`
+	}
+
+	// TeamAccessPolicies represent the association of an access policy and a team
+	TeamAccessPolicies map[TeamID]AccessPolicy
+
+	// TeamID represents a team identifier
+	TeamID int
+
+	// TeamMembership represents a membership association between a user and a team.
+	//
+	// A user may belong to multiple teams.
+	TeamMembership struct {
+		// Membership Identifier
+		ID TeamMembershipID `json:"Id" example:"1"`
+		// User identifier
+		UserID UserID `json:"UserID" example:"1"`
+		// Team identifier
+		TeamID TeamID `json:"TeamID" example:"1"`
+		// Team role (1 for team leader and 2 for team member)
+		Role MembershipRole `json:"Role" example:"1"`
+	}
+
+	// TeamMembershipID represents a team membership identifier
+	TeamMembershipID int
+
+	// TeamResourceAccess represents the level of control on a resource for a specific team
+	TeamResourceAccess struct {
+		TeamID      TeamID              `json:"TeamId"`
+		AccessLevel ResourceAccessLevel `json:"AccessLevel"`
+	}
+
+	// Template represents an application template that can be used as an App Template
+	// or an Edge template
+	Template struct {
+		// Mandatory container/stack fields
+		// Template Identifier
+		ID TemplateID `json:"id" example:"1"`
+		// Template type. Valid values are: 1 (container), 2 (Swarm stack), 3 (Compose stack), 4 (Compose edge stack)
+		Type TemplateType `json:"type" example:"1"`
+		// Title of the template
+		Title string `json:"title" example:"Nginx"`
+		// Description of the template
+		Description string `json:"description" example:"High performance web server"`
+		// Whether the template should be available to administrators only
+		AdministratorOnly bool `json:"administrator_only" example:"true"`
+
+		// Mandatory container fields
+		// Image associated to a container template. Mandatory for a container template
+		Image string `json:"image" example:"nginx:latest"`
+
+		// Mandatory stack fields
+		Repository TemplateRepository `json:"repository"`
+
+		// Mandatory Edge stack fields
+		// Stack file used for this template
+		StackFile string `json:"stackFile"`
+
+		// Optional stack/container fields
+		// Default name for the stack/container to be used on deployment
+		Name string `json:"name,omitempty" example:"mystackname"`
+		// URL of the template's logo
+		Logo string `json:"logo,omitempty" example:"https://portainer.io/img/logo.svg"`
+		// A list of environment(endpoint) variables used during the template deployment
+		Env []TemplateEnv `json:"env,omitempty"`
+		// A note that will be displayed in the UI. Supports HTML content
+		Note string `json:"note,omitempty" example:"This is my <b>custom</b> template"`
+		// Platform associated to the template.
+		// Valid values are: 'linux', 'windows' or leave empty for multi-platform
+		Platform string `json:"platform,omitempty" example:"linux"`
+		// A list of categories associated to the template
+		Categories []string `json:"categories,omitempty" example:"database"`
+
+		// Optional container fields
+		// The URL of a registry associated to the image for a container template
+		Registry string `json:"registry,omitempty" example:"quay.io"`
+		// The command that will be executed in a container template
+		Command string `json:"command,omitempty" example:"ls -lah"`
+		// Name of a network that will be used on container deployment if it exists inside the environment(endpoint)
+		Network string `json:"network,omitempty" example:"mynet"`
+		// A list of volumes used during the container template deployment
+		Volumes []TemplateVolume `json:"volumes,omitempty"`
+		// A list of ports exposed by the container
+		Ports []string `json:"ports,omitempty" example:"8080:80/tcp"`
+		// Container labels
+		Labels []Pair `json:"labels,omitempty"`
+		// Whether the container should be started in privileged mode
+		Privileged bool `json:"privileged,omitempty" example:"true"`
+		// Whether the container should be started in
+		// interactive mode (-i -t equivalent on the CLI)
+		Interactive bool `json:"interactive,omitempty" example:"true"`
+		// Container restart policy
+		RestartPolicy string `json:"restart_policy,omitempty" example:"on-failure"`
+		// Container hostname
+		Hostname string `json:"hostname,omitempty" example:"mycontainer"`
+	}
+
+	// TemplateEnv represents a template environment(endpoint) variable configuration
+	TemplateEnv struct {
+		// name of the environment(endpoint) variable
+		Name string `json:"name" example:"MYSQL_ROOT_PASSWORD"`
+		// Text for the label that will be generated in the UI
+		Label string `json:"label,omitempty" example:"Root password"`
+		// Content of the tooltip that will be generated in the UI
+		Description string `json:"description,omitempty" example:"MySQL root account password"`
+		// Default value that will be set for the variable
+		Default string `json:"default,omitempty" example:"default_value"`
+		// If set to true, will not generate any input for this variable in the UI
+		Preset bool `json:"preset,omitempty" example:"false"`
+		// A list of name/value that will be used to generate a dropdown in the UI
+		Select []TemplateEnvSelect `json:"select,omitempty"`
+	}
+
+	// TemplateEnvSelect represents text/value pair that will be displayed as a choice for the
+	// template user
+	TemplateEnvSelect struct {
+		// Some text that will displayed as a choice
+		Text string `json:"text" example:"text value"`
+		// A value that will be associated to the choice
+		Value string `json:"value" example:"value"`
+		// Will set this choice as the default choice
+		Default bool `json:"default" example:"false"`
+	}
+
+	// TemplateID represents a template identifier
+	TemplateID int
+
+	// TemplateRepository represents the git repository configuration for a template
+	TemplateRepository struct {
+		// URL of a git repository used to deploy a stack template. Mandatory for a Swarm/Compose stack template
+		URL string `json:"url" example:"https://github.com/portainer/portainer-compose"`
+		// Path to the stack file inside the git repository
+		StackFile string `json:"stackfile" example:"./subfolder/docker-compose.yml"`
+	}
+
+	// TemplateType represents the type of a template
+	TemplateType int
+
+	// TemplateVolume represents a template volume configuration
+	TemplateVolume struct {
+		// Path inside the container
+		Container string `json:"container" example:"/data"`
+		// Path on the host
+		Bind string `json:"bind,omitempty" example:"/tmp"`
+		// Whether the volume used should be readonly
+		ReadOnly bool `json:"readonly,omitempty" example:"true"`
+	}
+
+	// TLSConfiguration represents a TLS configuration
+	TLSConfiguration struct {
+		// Use TLS
+		TLS bool `json:"TLS" example:"true" validate:"required"`
+		// Skip the verification of the server TLS certificate
+		TLSSkipVerify bool `json:"TLSSkipVerify" example:"false" validate:"required"`
+		// Path to the TLS CA certificate file
+		TLSCACertPath string `json:"TLSCACert,omitempty" example:"/data/tls/ca.pem"`
+		// Path to the TLS client certificate file
+		TLSCertPath string `json:"TLSCert,omitempty" example:"/data/tls/cert.pem"`
+		// Path to the TLS client key file
+		TLSKeyPath string `json:"TLSKey,omitempty" example:"/data/tls/key.pem"`
+	}
+
+	// TLSFileType represents a type of TLS file required to connect to a Docker environment(endpoint).
+	// It can be either a TLS CA file, a TLS certificate file or a TLS key file
+	TLSFileType int
+
+	// TokenData represents the data embedded in a JWT token
+	TokenData struct {
+		ID                  UserID
+		Username            string
+		Role                UserRole
+		ForceChangePassword bool
+		Token               string
+	}
+
+	// TunnelDetails represents information associated to a tunnel
+	TunnelDetails struct {
+		Status       string
+		LastActivity time.Time
+		Port         int
+		Credentials  string
+		HasSnapshot  bool
+	}
+
+	// TunnelServerInfo represents information associated to the tunnel server
+	TunnelServerInfo struct {
+		PrivateKeySeed string `json:"PrivateKeySeed"`
+	}
+
+	// User represents a user account
+	User struct {
+		// User Identifier
+		ID       UserID `json:"Id" example:"1" validate:"required"`
+		Username string `json:"Username" example:"bob" validate:"required"`
+		Password string `json:"Password,omitempty" swaggerignore:"true"`
+		// User role (1 for administrator account and 2 for regular account)
+		Role          UserRole          `json:"Role" example:"1" validate:"required"`
+		TokenIssueAt  int64             `json:"TokenIssueAt" example:"1"`
+		ThemeSettings UserThemeSettings `json:"ThemeSettings"`
+		UseCache      bool              `json:"UseCache" example:"true"`
+
+		// Deprecated fields
+
+		// Deprecated
+		UserTheme string `json:"UserTheme,omitempty" example:"dark" swaggerignore:"true"`
+		// Deprecated in DBVersion == 25
+		PortainerAuthorizations Authorizations `swaggerignore:"true"`
+		// Deprecated in DBVersion == 25
+		EndpointAuthorizations EndpointAuthorizations `swaggerignore:"true"`
+	}
+
+	// UserAccessPolicies represent the association of an access policy and a user
+	UserAccessPolicies map[UserID]AccessPolicy
+
+	// UserID represents a user identifier
+	UserID int
+
+	// UserResourceAccess represents the level of control on a resource for a specific user
+	UserResourceAccess struct {
+		UserID      UserID              `json:"UserId"`
+		AccessLevel ResourceAccessLevel `json:"AccessLevel"`
+	}
+
+	// UserRole represents the role of a user. It can be either an administrator
+	// or a regular user
+	UserRole int
+
+	// UserThemeSettings represents the theme settings for a user
+	UserThemeSettings struct {
+		// Color represents the color theme of the UI
+		Color string `json:"color" example:"dark" enums:"dark,light,highcontrast,auto,"`
+	}
+
+	// Webhook represents a url webhook that can be used to update a service
+	Webhook struct {
+		// Webhook Identifier
+		ID         WebhookID  `json:"Id" example:"1"`
+		Token      string     `json:"Token"`
+		ResourceID string     `json:"ResourceId"`
+		EndpointID EndpointID `json:"EndpointId"`
+		RegistryID RegistryID `json:"RegistryId"`
+		// Type of webhook (1 - service)
+		WebhookType WebhookType `json:"Type"`
+	}
+
+	// WebhookID represents a webhook identifier.
+	WebhookID int
+
+	// WebhookType represents the type of resource a webhook is related to
+	WebhookType int
+
+	// Artifact is one entry in a Workflow's artifact list, pairing target IDs with source files
+	Artifact struct {
+		StackID     StackID           `json:"stackId,omitempty"`
+		EdgeStackID EdgeStackID       `json:"edgeStackId,omitempty"`
+		Files       []ArtifactFile    `json:"files,omitempty"`
+		EnvIDs      []EndpointID      `json:"envIds,omitempty"`
+		EnvGroups   []EndpointGroupID `json:"envGroups,omitempty"`
+		EdgeGroups  []EdgeGroupID     `json:"edgeGroups,omitempty"`
+	}
+
+	// ArtifactFile represents one file within an artifact, tied to a specific source and location within it
+	ArtifactFile struct {
+		SourceID   SourceID     `json:"sourceId"`
+		Path       string       `json:"path,omitempty" example:"portainer.yaml"`
+		Ref        string       `json:"ref,omitempty" example:"refs/heads/main"`
+		Hash       string       `json:"hash,omitempty" example:"abc123"`
+		RefStatus  SourceStatus `json:"refStatus,omitempty"`
+		RefError   string       `json:"refError,omitempty"`
+		PathStatus SourceStatus `json:"pathStatus,omitempty"`
+		PathError  string       `json:"pathError,omitempty"`
+	}
+
+	// Workflow represents a GitOps workflow
+	Workflow struct {
+		ID        WorkflowID `json:"id" example:"1"`
+		Name      string     `json:"name,omitempty" example:"my-workflow"`
+		Artifacts []Artifact `json:"artifacts,omitempty"`
+	}
+
+	WorkflowID int
+
+	Snapshot struct {
+		EndpointID EndpointID          `json:"EndpointId"`
+		Docker     *DockerSnapshot     `json:"Docker"`
+		Kubernetes *KubernetesSnapshot `json:"Kubernetes"`
+	}
+
+	SnapshotRawMessage struct {
+		EndpointID EndpointID      `json:"EndpointId"`
+		Docker     json.RawMessage `json:"Docker"`
+		Kubernetes json.RawMessage `json:"Kubernetes"`
+	}
+
+	// CLIService represents a service for managing CLI
+	CLIService interface {
+		ParseFlags(version string) (*CLIFlags, error)
+		ValidateFlags(flags *CLIFlags) error
+	}
+
+	ComposeOptions struct {
+		Registries []Registry
+	}
+
+	ComposeUpOptions struct {
+		ComposeOptions
+
+		// ForceRecreate forces to recreate containers
+		ForceRecreate bool
+		// AbortOnContainerExit will stop the deployment if a container exits.
+		// This is useful when running a onetime task.
+		//
+		// When this is set, docker compose will output its logs to stdout
+		AbortOnContainerExit bool
+		Prune                bool
+	}
+
+	ComposeDownOptions struct {
+		// RemoveVolumes will remove the named volumes declared in the compose file
+		// and anonymous volumes attached to the stack's containers
+		// Drives `docker compose down --volumes`
+		RemoveVolumes bool
+	}
+
+	ComposeRunOptions struct {
+		ComposeOptions
+
+		// Remove will remove the container after it has stopped
+		Remove bool
+		// Args are the arguments to pass to the container
+		Args []string
+		// Detached will run the container in the background
+		Detached bool
+	}
+
+	// ComposeStackManager represents a service to manage Compose stacks
+	ComposeStackManager interface {
+		ComposeSyntaxMaxVersion() string
+		NormalizeStackName(name string) string
+		Run(ctx context.Context, stack *Stack, endpoint *Endpoint, serviceName string, options ComposeRunOptions) error
+		Up(ctx context.Context, stack *Stack, endpoint *Endpoint, options ComposeUpOptions) error
+		Down(ctx context.Context, stack *Stack, endpoint *Endpoint) error
+		Pull(ctx context.Context, stack *Stack, endpoint *Endpoint, options ComposeOptions) error
+	}
+
+	// CryptoService represents a service for encrypting/hashing data
+	CryptoService interface {
+		Hash(data string) (string, error)
+		CompareHashAndData(hash string, data string) error
+	}
+
+	// DigitalSignatureService represents a service to manage digital signatures
+	DigitalSignatureService interface {
+		ParseKeyPair(private, public []byte) error
+		GenerateKeyPair() ([]byte, []byte, error)
+		EncodedPublicKey() string
+		PEMHeaders() (string, string)
+		CreateSignature(message string) (string, error)
+	}
+
+	// DockerSnapshotter represents a service used to create Docker environment(endpoint) snapshots
+	DockerSnapshotter interface {
+		CreateSnapshot(endpoint *Endpoint) (*DockerSnapshot, error)
+	}
+
+	// FileService represents a service for managing files
+	FileService interface {
+		GetFileContent(trustedRootPath, filePath string) ([]byte, error)
+		Copy(fromFilePath string, toFilePath string, deleteIfExists bool) error
+		Rename(oldPath, newPath string) error
+		RemoveDirectory(directoryPath string) error
+		StoreTLSFileFromBytes(folder string, fileType TLSFileType, data []byte) (string, error)
+		GetPathForTLSFile(folder string, fileType TLSFileType) (string, error)
+		DeleteTLSFile(folder string, fileType TLSFileType) error
+		DeleteTLSFiles(folder string) error
+		GetStackProjectPath(stackIdentifier string) string
+		GetStackProjectPathByVersion(stackIdentifier string, version int, commitHash string) string
+		StoreStackFileFromBytes(stackIdentifier, fileName string, data []byte) (string, error)
+		StoreStackFileFromBytesByVersion(stackIdentifier, fileName string, version int, data []byte) (string, error)
+		UpdateStoreStackFileFromBytes(stackIdentifier, fileName string, data []byte) (string, error)
+		UpdateStoreStackFileFromBytesByVersion(stackIdentifier, fileName string, version int, commitHash string, data []byte) (string, error)
+		RemoveStackFileBackup(stackIdentifier, fileName string) error
+		RemoveStackFileBackupByVersion(stackIdentifier string, version int, fileName string) error
+		RollbackStackFile(stackIdentifier, fileName string) error
+		RollbackStackFileByVersion(stackIdentifier string, version int, fileName string) error
+		GetEdgeStackProjectPath(edgeStackIdentifier string) string
+		StoreEdgeStackFileFromBytes(edgeStackIdentifier, fileName string, data []byte) (string, error)
+		GetEdgeStackProjectPathByVersion(edgeStackIdentifier string, version int, commitHash string) string
+		StoreEdgeStackFileFromBytesByVersion(edgeStackIdentifier, fileName string, version int, data []byte) (string, error)
+		FormProjectPathByVersion(projectPath string, version int, commitHash string) string
+		SafeMoveDirectory(src, dst string) error
+		StoreRegistryManagementFileFromBytes(folder, fileName string, data []byte) (string, error)
+		KeyPairFilesExist() (bool, error)
+		StoreKeyPair(private, public []byte, privatePEMHeader, publicPEMHeader string) error
+		LoadKeyPair() ([]byte, []byte, error)
+		WriteJSONToFile(path string, content any) error
+		FileExists(path string) (bool, error)
+		StoreEdgeJobFileFromBytes(identifier string, data []byte) (string, error)
+		GetEdgeJobFolder(identifier string) string
+		ClearEdgeJobTaskLogs(edgeJobID, taskID string) error
+		GetEdgeJobTaskLogFileContent(edgeJobID, taskID string) (string, error)
+		StoreEdgeJobTaskLogFileFromBytes(edgeJobID, taskID string, data []byte) error
+		GetBinaryFolder() string
+		StoreCustomTemplateFileFromBytes(identifier, fileName string, data []byte) (string, error)
+		GetCustomTemplateProjectPath(identifier string) string
+		GetTemporaryPath() (string, error)
+		GetDatastorePath() string
+		GetDefaultSSLCertsPath() (string, string)
+		StoreSSLCertPair(cert, key []byte) (string, string, error)
+		CopySSLCertPair(certPath, keyPath string) (string, string, error)
+		CopySSLCACert(caCertPath string) (string, error)
+		StoreMTLSCertificates(caCert, cert, key []byte) (string, string, string, error)
+		GetMTLSCertificates() (string, string, string, error)
+		GetDefaultChiselPrivateKeyPath() string
+		StoreChiselPrivateKey(privateKey []byte) error
+	}
+
+	// GitService represents a service for managing Git
+	GitService interface {
+		CloneRepository(
+			ctx context.Context,
+			destination string,
+			repositoryURL,
+			referenceName,
+			username,
+			password string,
+			tlsSkipVerify bool,
+		) error
+		LatestCommitID(
+			ctx context.Context,
+			repositoryURL,
+			referenceName,
+			username,
+			password string,
+			tlsSkipVerify bool,
+		) (string, error)
+		ListRefs(
+			ctx context.Context,
+			repositoryURL,
+			username,
+			password string,
+			hardRefresh bool,
+			tlsSkipVerify bool,
+		) ([]string, error)
+		ListFiles(
+			ctx context.Context,
+			repositoryURL,
+			referenceName,
+			username,
+			password string,
+			dirOnly,
+			hardRefresh bool,
+			includeExts []string,
+			tlsSkipVerify bool,
+		) ([]string, error)
+	}
+
+	// JWTService represents a service for managing JWT tokens
+	JWTService interface {
+		GenerateToken(data *TokenData) (string, time.Time, error)
+		GenerateTokenForKubeconfig(data *TokenData) (string, error)
+		ParseAndVerifyToken(token string) (*TokenData, string, time.Time, error)
+		SetUserSessionDuration(userSessionDuration time.Duration)
+	}
+
+	// KubeExecParams holds parameters for KubeClient.StartExecProcess.
+	KubeExecParams struct {
+		Token         string
+		UseAdminToken bool
+		Namespace     string
+		PodName       string
+		ContainerName string
+		Command       []string
+		Stdin         io.Reader                       // bound to the exec process stdin
+		Stdout        io.Writer                       // receives exec process output
+		ResizeQueue   remotecommand.TerminalSizeQueue // nil if resize not needed
+		ErrChan       chan error
+	}
+
+	// KubeClient represents a service used to query a Kubernetes environment(endpoint)
+	KubeClient interface {
+		// Access
+		GetIsKubeAdmin() bool
+		SetIsKubeAdmin(isKubeAdmin bool)
+		GetClientNonAdminNamespaces() []string
+		SetClientNonAdminNamespaces([]string)
+		NamespaceAccessPoliciesDeleteNamespace(ns string) error
+		UpdateNamespaceAccessPolicies(accessPolicies map[string]K8sNamespaceAccessPolicy) error
+		GetNamespaceAccessPolicies() (map[string]K8sNamespaceAccessPolicy, error)
+		GetNonAdminNamespaces(userID int, teamIDs []int, isRestrictDefaultNamespace bool) ([]string, error)
+
+		// Applications
+		GetApplications(namespace, nodeName string) ([]models.K8sApplication, error)
+		GetApplicationsResource(namespace, node string) (models.K8sApplicationResource, error)
+		GetClusterNodes() ([]corev1.Node, error)
+
+		// ClusterRole
+		GetClusterRoles() ([]models.K8sClusterRole, error)
+		DeleteClusterRoles(req models.K8sClusterRoleDeleteRequests) error
+
+		// ConfigMap
+		GetConfigMap(namespace, configMapName string) (models.K8sConfigMap, error)
+		CombineConfigMapWithApplications(configMap models.K8sConfigMap) (models.K8sConfigMap, error)
+
+		// CronJob
+		GetCronJobs(namespace string) ([]models.K8sCronJob, error)
+		DeleteCronJobs(payload models.K8sCronJobDeleteRequests) error
+
+		// Event
+		GetEvents(namespace string, resourceId string) ([]models.K8sEvent, error)
+
+		// Exec
+		StartExecProcess(params KubeExecParams)
+
+		// ClusterRoleBinding
+		GetClusterRoleBindings() ([]models.K8sClusterRoleBinding, error)
+		DeleteClusterRoleBindings(reqs models.K8sClusterRoleBindingDeleteRequests) error
+
+		// Dashboard
+		GetDashboard() (models.K8sDashboard, error)
+
+		// Deployment
+		HasStackName(namespace string, stackName string) (bool, error)
+
+		// Ingress
+		GetIngressControllers() (models.K8sIngressControllers, error)
+		GetIngress(namespace, ingressName string) (models.K8sIngressInfo, error)
+		GetIngresses(namespace string) ([]models.K8sIngressInfo, error)
+		CreateIngress(namespace string, info models.K8sIngressInfo, owner string) error
+		DeleteIngresses(reqs models.K8sIngressDeleteRequests) error
+		UpdateIngress(namespace string, info models.K8sIngressInfo) error
+		CombineIngressWithService(ingress models.K8sIngressInfo) (models.K8sIngressInfo, error)
+		CombineIngressesWithServices(ingresses []models.K8sIngressInfo) ([]models.K8sIngressInfo, error)
+
+		// Job
+		GetJobs(namespace string, includeCronJobChildren bool) ([]models.K8sJob, error)
+		DeleteJobs(payload models.K8sJobDeleteRequests) error
+
+		// Metrics
+		GetMetrics() (models.K8sMetrics, error)
+
+		// Namespace
+		ToggleSystemState(namespaceName string, isSystem bool) error
+		UpdateNamespace(info models.K8sNamespaceDetails) (*corev1.Namespace, error)
+		GetNamespace(name string) (K8sNamespaceInfo, error)
+		CreateNamespace(info models.K8sNamespaceDetails) (*corev1.Namespace, error)
+		GetNamespaces() (map[string]K8sNamespaceInfo, error)
+		CombineNamespaceWithResourceQuota(namespace K8sNamespaceInfo, w http.ResponseWriter) *httperror.HandlerError
+		DeleteNamespace(namespaceName string) (*corev1.Namespace, error)
+		CombineNamespacesWithResourceQuotas(namespaces map[string]K8sNamespaceInfo, w http.ResponseWriter) *httperror.HandlerError
+		ConvertNamespaceMapToSlice(namespaces map[string]K8sNamespaceInfo) []K8sNamespaceInfo
+
+		// NodeLimits
+		GetNodesLimits() (K8sNodesLimits, error)
+		GetMaxResourceLimits(skipNamespace string, overCommitEnabled bool, resourceOverCommitPercent int) (K8sNodeLimits, error)
+
+		// Pod
+		CreateUserShellPod(ctx context.Context, serviceAccountName, shellPodImage string) (*KubernetesShellPod, error)
+		DeletePod(namespace, name string) error
+		RestartPod(namespace, name string) error
+		SupportsPodRestart(ctx context.Context) (bool, error)
+
+		// RBAC
+		IsRBACEnabled() (bool, error)
+
+		// Registries
+		DeleteRegistrySecret(registry RegistryID, namespace string) error
+		CreateRegistrySecret(registry *Registry, namespace string) error
+		IsRegistrySecret(namespace, secretName string) (bool, error)
+
+		// RoleBinding
+		GetRoleBindings(namespace string) ([]models.K8sRoleBinding, error)
+		DeleteRoleBindings(reqs models.K8sRoleBindingDeleteRequests) error
+
+		// Role
+		DeleteRoles(reqs models.K8sRoleDeleteRequests) error
+
+		// Secret
+		GetSecrets(namespace string) ([]models.K8sSecret, error)
+		GetSecret(namespace string, secretName string) (models.K8sSecret, error)
+		CombineSecretWithApplications(secret models.K8sSecret) (models.K8sSecret, error)
+
+		// ServiceAccount
+		GetServiceAccounts(namespace string) ([]models.K8sServiceAccount, error)
+		GetServiceAccount(namespace, name string) (models.K8sServiceAccount, error)
+		DeleteServiceAccounts(reqs models.K8sServiceAccountDeleteRequests) error
+		AddImagePullSecretToServiceAccount(namespace, serviceAccountName, secretName string) error
+		RemoveImagePullSecretFromServiceAccount(namespace, serviceAccountName, secretName string) error
+		UpdateServiceAccountImagePullSecrets(namespace, name string, secretNames []string) error
+		SetupUserServiceAccount(int, []int, bool) error
+		GetPortainerUserServiceAccount(tokendata *TokenData) (*corev1.ServiceAccount, error)
+		GetServiceAccountBearerToken(userID int) (string, error)
+
+		// Service
+		GetServices(namespace string) ([]models.K8sServiceInfo, error)
+		CombineServicesWithApplications(services []models.K8sServiceInfo) ([]models.K8sServiceInfo, error)
+		CreateService(namespace string, info models.K8sServiceInfo) error
+		DeleteServices(reqs models.K8sServiceDeleteRequests) error
+		UpdateService(namespace string, info models.K8sServiceInfo) error
+
+		// ServerVersion
+		ServerVersion() (*version.Info, error)
+
+		// Storage
+		GetStorage() ([]KubernetesStorageClassConfig, error)
+
+		// Volumes
+		GetVolumes(namespace string) ([]models.K8sVolumeInfo, error)
+		GetVolume(namespace, volumeName string) (*models.K8sVolumeInfo, error)
+		CombineVolumesWithApplications(volumes *[]models.K8sVolumeInfo) (*[]models.K8sVolumeInfo, error)
+
+		// StorageClass
+		GetStorageClasses() ([]models.K8sStorageClass, error)
+		GetStorageClass(name string) (*models.K8sStorageClass, error)
+		DeleteStorageClasses(names []string) error
+		SetDefaultStorageClass(name string) error
+
+		// PersistentVolume
+		GetPersistentVolumes() ([]models.K8sPersistentVolume, error)
+		GetPersistentVolume(name string) (*models.K8sPersistentVolume, error)
+		DeletePersistentVolumes(names []string) error
+		UpdatePersistentVolumeReclaimPolicy(name string, policy corev1.PersistentVolumeReclaimPolicy) error
+
+		// PersistentVolumeClaim
+		GetPersistentVolumeClaims(namespace string) ([]models.K8sPersistentVolumeClaim, error)
+		GetPersistentVolumeClaim(namespace, name string) (*models.K8sPersistentVolumeClaim, error)
+		DeletePersistentVolumeClaims(reqs models.K8sVolumeDeleteRequests) error
+		ResizePersistentVolumeClaim(namespace, name, newSize string) error
+	}
+
+	// KubernetesDeployer represents a service to deploy a manifest inside a Kubernetes environment(endpoint)
+	KubernetesDeployer interface {
+		Deploy(ctx context.Context, userID UserID, endpoint *Endpoint, manifestFiles []string, namespace string) (string, error)
+		Remove(ctx context.Context, userID UserID, endpoint *Endpoint, manifestFiles []string, namespace string) (string, error)
+	}
+
+	// KubernetesSnapshotter represents a service used to create Kubernetes environment(endpoint) snapshots
+	KubernetesSnapshotter interface {
+		CreateSnapshot(endpoint *Endpoint) (*KubernetesSnapshot, error)
+	}
+
+	// LDAPService represents a service used to authenticate users against a LDAP/AD
+	LDAPService interface {
+		AuthenticateUser(username, password string, settings *LDAPSettings) error
+		TestConnectivity(settings *LDAPSettings) error
+		GetUserGroups(username string, settings *LDAPSettings) ([]string, error)
+		SearchGroups(settings *LDAPSettings) ([]LDAPUser, error)
+		SearchUsers(settings *LDAPSettings) ([]string, error)
+	}
+
+	// OAuthService represents a service used to authenticate users using OAuth
+	OAuthService interface {
+		Authenticate(ctx context.Context, code string, configuration *OAuthSettings) (string, error)
+	}
+
+	// ReverseTunnelService represents a service used to manage reverse tunnel connections.
+	ReverseTunnelService interface {
+		StartTunnelServer(addr, port string, snapshotService SnapshotService) error
+		StopTunnelServer() error
+		GenerateEdgeKey(apiURL, tunnelAddr string, endpointIdentifier int) string
+		Open(endpoint *Endpoint) error
+		Config(endpointID EndpointID) TunnelDetails
+		TunnelAddr(endpoint *Endpoint) (string, error)
+		UpdateLastActivity(endpointID EndpointID)
+		KeepTunnelAlive(endpointID EndpointID, ctx context.Context, maxKeepAlive time.Duration)
+	}
+
+	// Server defines the interface to serve the API
+	Server interface {
+		Start(ctx context.Context) error
+	}
+
+	// SnapshotService represents a service for managing environment(endpoint) snapshots
+	SnapshotService interface {
+		Start(ctx context.Context)
+		SetSnapshotInterval(snapshotInterval string) error
+		SnapshotEndpoint(endpoint *Endpoint) error
+		FillSnapshotData(endpoint *Endpoint, includeRaw bool) error
+	}
+
+	// SwarmStackManager represents a service to manage Swarm stacks
+	SwarmStackManager interface {
+		Deploy(ctx context.Context, stack *Stack, prune bool, pullImage bool, endpoint *Endpoint, registries []Registry) error
+		Remove(ctx context.Context, stack *Stack, endpoint *Endpoint) error
+		NormalizeStackName(name string) string
+	}
+)
+
+const (
+	// APIVersion is the version number of the Portainer API
+	APIVersion = "2.43.0"
+	// Support annotation for the API version ("STS" for Short-Term Support or "LTS" for Long-Term Support)
+	APIVersionSupport = "STS"
+	// Edition is what this edition of Portainer is called
+	Edition = PortainerCE
+	// ComposeSyntaxMaxVersion is a maximum supported version of the docker compose syntax
+	ComposeSyntaxMaxVersion = "3.9"
+	// AssetsServerURL represents the URL of the Portainer asset server
+	AssetsServerURL = "https://portainer-io-assets.sfo2.digitaloceanspaces.com"
+	// MessageOfTheDayURL represents the URL where Portainer MOTD message can be retrieved
+	MessageOfTheDayURL = AssetsServerURL + "/motd.json"
+	// ReleasesURL represents the URL used to retrieve all releases of Portainer
+	ReleasesURL = "https://api.github.com/repos/portainer/portainer/releases"
+	// VersionCheckURL represents the URL used to retrieve the latest version of Portainer
+	VersionCheckURL = ReleasesURL + "/latest"
+	// PortainerAgentHeader represents the name of the header available in any agent response
+	PortainerAgentHeader = "Portainer-Agent"
+	// PortainerAgentEdgeIDHeader represent the name of the header containing the Edge ID associated to an agent/agent cluster
+	PortainerAgentEdgeIDHeader = "X-PortainerAgent-EdgeID"
+	// HTTPResponseAgentPlatform represents the name of the header containing the Agent platform
+	HTTPResponseAgentPlatform = "Portainer-Agent-Platform"
+	// PortainerAgentTargetHeader represent the name of the header containing the target node name
+	PortainerAgentTargetHeader = "X-PortainerAgent-Target"
+	// PortainerAgentSignatureHeader represent the name of the header containing the digital signature
+	PortainerAgentSignatureHeader = "X-PortainerAgent-Signature"
+	// PortainerAgentPublicKeyHeader represent the name of the header containing the public key
+	PortainerAgentPublicKeyHeader = "X-PortainerAgent-PublicKey"
+	// PortainerAgentKubernetesSATokenHeader represent the name of the header containing a Kubernetes SA token
+	PortainerAgentKubernetesSATokenHeader = "X-PortainerAgent-SA-Token"
+	// HTTPAlertStateHeaderName is the name of the header used to transmit edge alert evaluation state
+	HTTPAlertStateHeaderName = "X-PortainerAgent-AlertState"
+	// HTTPResponseAgentGPUOperator represents the name of the header indicating whether the GPU operator is enabled on the agent
+	HTTPResponseAgentGPUOperator = "Portainer-Agent-GPU-Operator"
+	// PortainerAgentSignatureMessage represents the message used to create a digital signature
+	// to be used when communicating with an agent
+	PortainerAgentSignatureMessage = "Portainer-App"
+	// DefaultSnapshotInterval represents the default interval between each environment snapshot job
+	DefaultSnapshotInterval = "5m"
+	// DefaultEdgeAgentCheckinIntervalInSeconds represents the default interval (in seconds) used by Edge agents to checkin with the Portainer instance
+	DefaultEdgeAgentCheckinIntervalInSeconds = 5
+	// DefaultTemplatesURL represents the URL to the official templates supported by Portainer
+	DefaultTemplatesURL = "https://raw.githubusercontent.com/portainer/templates/v3/templates.json"
+	// DefaultHelmrepositoryURL represents the URL to the official templates supported by Bitnami
+	DefaultHelmRepositoryURL = "https://charts.bitnami.com/bitnami"
+	// DefaultUserSessionTimeout represents the default timeout after which the user session is cleared
+	DefaultUserSessionTimeout = "8h"
+	// DefaultUserSessionTimeout represents the default timeout after which the user session is cleared
+	DefaultKubeconfigExpiry = "0"
+	// DefaultKubectlShellImage represents the default image and tag for the kubectl shell
+	DefaultKubectlShellImage = "portainer/kubectl-shell:" + APIVersion
+	// WebSocketKeepAlive web socket keep alive for edge environments
+	WebSocketKeepAlive = 1 * time.Hour
+	// AuthCookieName is the name of the cookie used to store the JWT token
+	AuthCookieKey = "portainer_api_key"
+	// PortainerCacheHeader is used to enabled FE caching for Kubernetes resources
+	PortainerCacheHeader = "X-Portainer-Cache"
+	// KubectlShellImageEnvVar is the environment variable used to override the default kubectl shell image
+	KubectlShellImageEnvVar = "KUBECTL_SHELL_IMAGE"
+	// PullLimitCheckDisabledEnvVar is the environment variable used to disable the pull limit check
+	PullLimitCheckDisabledEnvVar = "PULL_LIMIT_CHECK_DISABLED"
+	// FeatureFlagEnvVar is the environment variable used to set the list of enabled feature flags
+	FeatureFlagEnvVar = "FEATURE_FLAG"
+	// LicenseServerBaseURL represents the base URL of the API used to validate
+	// an extension license.
+	LicenseServerBaseURL = "https://api.portainer.io"
+	// URL to validate licenses along with system metadata.
+	LicenseCheckInURL = LicenseServerBaseURL + "/licenses/checkin"
+	// TrustedOriginsEnvVar is the environment variable used to set the trusted origins for CSRF protection
+	TrustedOriginsEnvVar = "TRUSTED_ORIGINS"
+	// CSPEnvVar is the environment variable used to enable/disable the Content Security Policy
+	CSPEnvVar = "CSP"
+	// CompactDBEnvVar is the environment variable used to enable/disable the startup compaction of the database
+	CompactDBEnvVar = "COMPACT_DB"
+	// NoSetupTokenEnvVar is the environment variable used to disable the setup token requirement on an uninitialized instance
+	NoSetupTokenEnvVar = "PORTAINER_NO_SETUP_TOKEN"
+	// SetupTokenEnvVar is the environment variable used to provide a custom setup token for admin initialization and restore on an uninitialized instance
+	SetupTokenEnvVar = "PORTAINER_SETUP_TOKEN"
+)
+
+// List of supported features
+var SupportedFeatureFlags = []featureflags.Feature{"hsts", "csp"}
+
+const (
+	_ AuthenticationMethod = iota
+	// AuthenticationInternal represents the internal authentication method (authentication against Portainer API)
+	AuthenticationInternal
+	// AuthenticationLDAP represents the LDAP authentication method (authentication against a LDAP server)
+	AuthenticationLDAP
+	// AuthenticationOAuth represents the OAuth authentication method (authentication against a authorization server)
+	AuthenticationOAuth
+)
+
+const (
+	_ AgentPlatform = iota
+	// AgentPlatformDocker represent the Docker platform (Standalone/Swarm)
+	AgentPlatformDocker
+	// AgentPlatformKubernetes represent the Kubernetes platform
+	AgentPlatformKubernetes
+)
+
+const (
+	_ EdgeJobLogsStatus = iota
+	// EdgeJobLogsStatusIdle represents an idle log collection job
+	EdgeJobLogsStatusIdle
+	// EdgeJobLogsStatusPending represents a pending log collection job
+	EdgeJobLogsStatusPending
+	// EdgeJobLogsStatusCollected represents a completed log collection job
+	EdgeJobLogsStatusCollected
+)
+
+const (
+	_ CustomTemplatePlatform = iota
+	// CustomTemplatePlatformLinux represents a custom template for linux
+	CustomTemplatePlatformLinux
+	// CustomTemplatePlatformWindows represents a custom template for windows
+	CustomTemplatePlatformWindows
+)
+
+const (
+	// EdgeStackDeploymentCompose represent an edge stack deployed using a compose file
+	EdgeStackDeploymentCompose EdgeStackDeploymentType = iota
+	// EdgeStackDeploymentKubernetes represent an edge stack deployed using a kubernetes manifest file
+	EdgeStackDeploymentKubernetes
+)
+
+const (
+	// EdgeStackStatusPending represents a pending edge stack
+	EdgeStackStatusPending EdgeStackStatusType = iota
+	// EdgeStackStatusDeploymentReceived represents an edge environment which received the edge stack deployment
+	EdgeStackStatusDeploymentReceived
+	// EdgeStackStatusError represents an edge environment which failed to deploy its edge stack
+	EdgeStackStatusError
+	// EdgeStackStatusAcknowledged represents an acknowledged edge stack
+	EdgeStackStatusAcknowledged
+	// EdgeStackStatusRemoved represents a removed edge stack
+	EdgeStackStatusRemoved
+	// StatusRemoteUpdateSuccess represents a successfully updated edge stack
+	EdgeStackStatusRemoteUpdateSuccess
+	// EdgeStackStatusImagesPulled represents a successfully images-pulling
+	EdgeStackStatusImagesPulled
+	// EdgeStackStatusRunning represents a running Edge stack
+	EdgeStackStatusRunning
+	// EdgeStackStatusDeploying represents an Edge stack which is being deployed
+	EdgeStackStatusDeploying
+	// EdgeStackStatusRemoving represents an Edge stack which is being removed
+	EdgeStackStatusRemoving
+	// EdgeStackStatusPausedDeploying represents a paused Edge stack
+	EdgeStackStatusPausedDeploying
+	// EdgeStackStatusRollingBack represents an Edge stack which is being rolled back
+	EdgeStackStatusRollingBack
+	// EdgeStackStatusRolledBack represents an Edge stack which has rolled back
+	EdgeStackStatusRolledBack
+	// EdgeStackStatusCompleted represents a completed Edge stack
+	EdgeStackStatusCompleted
+)
+
+var edgeStackStatusTypeStr = map[EdgeStackStatusType]string{
+	EdgeStackStatusPending:             "Pending",
+	EdgeStackStatusDeploymentReceived:  "DeploymentReceived",
+	EdgeStackStatusError:               "Error",
+	EdgeStackStatusAcknowledged:        "Acknowledged",
+	EdgeStackStatusRemoved:             "Removed",
+	EdgeStackStatusRemoteUpdateSuccess: "RemoteUpdateSuccess",
+	EdgeStackStatusImagesPulled:        "ImagesPulled",
+	EdgeStackStatusRunning:             "Running",
+	EdgeStackStatusDeploying:           "Deploying",
+	EdgeStackStatusRemoving:            "Removing",
+	EdgeStackStatusPausedDeploying:     "PausedDeploying",
+	EdgeStackStatusRollingBack:         "RollingBack",
+	EdgeStackStatusRolledBack:          "RolledBack",
+	EdgeStackStatusCompleted:           "Completed",
+}
+
+func (s EdgeStackStatusType) String() string {
+	if str, ok := edgeStackStatusTypeStr[s]; ok {
+		return fmt.Sprintf("%d (%s)", s, str)
+	}
+	return fmt.Sprintf("%d (UNKNOWN)", s)
+}
+
+const (
+	_ EndpointStatus = iota
+	// EndpointStatusUp is used to represent an available environment(endpoint)
+	EndpointStatusUp
+	// EndpointStatusDown is used to represent an unavailable environment(endpoint)
+	EndpointStatusDown
+)
+
+const (
+	_ EndpointType = iota
+	// DockerEnvironment represents an environment(endpoint) connected to a Docker environment(endpoint) via the Docker API or Socket
+	DockerEnvironment
+	// AgentOnDockerEnvironment represents an environment(endpoint) connected to a Portainer agent deployed on a Docker environment(endpoint)
+	AgentOnDockerEnvironment
+	// AzureEnvironment represents an environment(endpoint) connected to an Azure environment(endpoint)
+	AzureEnvironment
+	// EdgeAgentOnDockerEnvironment represents an environment(endpoint) connected to an Edge agent deployed on a Docker environment(endpoint)
+	EdgeAgentOnDockerEnvironment
+	// KubernetesLocalEnvironment represents an environment(endpoint) connected to a local Kubernetes environment(endpoint)
+	KubernetesLocalEnvironment
+	// AgentOnKubernetesEnvironment represents an environment(endpoint) connected to a Portainer agent deployed on a Kubernetes environment(endpoint)
+	AgentOnKubernetesEnvironment
+	// EdgeAgentOnKubernetesEnvironment represents an environment(endpoint) connected to an Edge agent deployed on a Kubernetes environment(endpoint)
+	EdgeAgentOnKubernetesEnvironment
+)
+
+const (
+	DockerPlatformType PlatformType = iota
+	KubernetesPlatformType
+	AzurePlatformType
+	PodmanPlatformType
+	UnknownPlatformType
+)
+
+const (
+	_ JobType = iota
+	// SnapshotJobType is a system job used to create environment(endpoint) snapshots
+	SnapshotJobType = 2
+)
+
+const (
+	_ MembershipRole = iota
+	// TeamLeader represents a leader role inside a team
+	TeamLeader
+	// TeamMember represents a member role inside a team
+	TeamMember
+)
+
+const (
+	_ SoftwareEdition = iota
+	// PortainerCE represents the community edition of Portainer
+	PortainerCE
+	// PortainerBE represents the business edition of Portainer
+	PortainerBE
+	// PortainerEE represents the business edition of Portainer
+	PortainerEE
+)
+
+const (
+	_ SourceType = iota
+	SourceTypeGit
+	SourceTypeRegistry
+	SourceTypeHelm
+)
+
+const (
+	// SourceStatusUnknown means the check has not been performed yet
+	SourceStatusUnknown SourceStatus = iota
+	// SourceStatusHealthy means the last check succeeded
+	SourceStatusHealthy
+	// SourceStatusError means the last check failed
+	SourceStatusError
+)
+
+const (
+	_ RegistryType = iota
+	// QuayRegistry represents a Quay.io registry
+	QuayRegistry
+	// AzureRegistry represents an ACR registry
+	AzureRegistry
+	// CustomRegistry represents a custom registry
+	CustomRegistry
+	// GitlabRegistry represents a gitlab registry
+	GitlabRegistry
+	// ProGetRegistry represents a proget registry
+	ProGetRegistry
+	// DockerHubRegistry represents a dockerhub registry
+	DockerHubRegistry
+	// EcrRegistry represents an ECR registry
+	EcrRegistry
+	// Github container registry
+	GithubRegistry
+)
+
+const (
+	_ ResourceAccessLevel = iota
+	// ReadWriteAccessLevel represents an access level with read-write permissions on a resource
+	ReadWriteAccessLevel
+)
+
+const (
+	_ ResourceControlType = iota
+	// ContainerResourceControl represents a resource control associated to a Docker container
+	ContainerResourceControl
+	// ServiceResourceControl represents a resource control associated to a Docker service
+	ServiceResourceControl
+	// VolumeResourceControl represents a resource control associated to a Docker volume
+	VolumeResourceControl
+	// NetworkResourceControl represents a resource control associated to a Docker network
+	NetworkResourceControl
+	// SecretResourceControl represents a resource control associated to a Docker secret
+	SecretResourceControl
+	// StackResourceControl represents a resource control associated to a stack composed of Docker services
+	StackResourceControl
+	// ConfigResourceControl represents a resource control associated to a Docker config
+	ConfigResourceControl
+	// CustomTemplateResourceControl represents a resource control associated to a custom template
+	CustomTemplateResourceControl
+	// ContainerGroupResourceControl represents a resource control associated to an Azure container group
+	ContainerGroupResourceControl
+)
+
+const (
+	_ StackType = iota
+	// DockerSwarmStack represents a stack managed via docker stack
+	DockerSwarmStack
+	// DockerComposeStack represents a stack managed via docker-compose
+	DockerComposeStack
+	// KubernetesStack represents a stack managed via kubectl
+	KubernetesStack
+)
+
+// StackStatus represents a status for a stack
+const (
+	_                    StackStatus = iota
+	StackStatusActive                // 1 - deployed and running
+	StackStatusInactive              // 2 - intentionally stopped
+	StackStatusDeploying             // 3 - deployment in progress
+	StackStatusError                 // 4 - deployment failed
+)
+
+const (
+	_ TemplateType = iota
+	// ContainerTemplate represents a container template
+	ContainerTemplate
+	// SwarmStackTemplate represents a template used to deploy a Swarm stack
+	SwarmStackTemplate
+	// ComposeStackTemplate represents a template used to deploy a Compose stack
+	ComposeStackTemplate
+)
+
+const (
+	// TLSFileCA represents a TLS CA certificate file
+	TLSFileCA TLSFileType = iota
+	// TLSFileCert represents a TLS certificate file
+	TLSFileCert
+	// TLSFileKey represents a TLS key file
+	TLSFileKey
+)
+
+const (
+	_ UserRole = iota
+	// AdministratorRole represents an administrator user role
+	AdministratorRole
+	// StandardUserRole represents a regular user role
+	StandardUserRole
+)
+
+const (
+	_ WebhookType = iota
+	// ServiceWebhook is a webhook for restarting a docker service
+	ServiceWebhook
+)
+
+const (
+	// EdgeAgentIdle represents an idle state for a tunnel connected to an Edge environment(endpoint).
+	EdgeAgentIdle string = "IDLE"
+	// EdgeAgentManagementRequired represents a required state for a tunnel connected to an Edge environment(endpoint)
+	EdgeAgentManagementRequired string = "REQUIRED"
+)
+
+// represents an authorization type
+const (
+	OperationDockerContainerArchiveInfo         Authorization = "DockerContainerArchiveInfo"
+	OperationDockerContainerList                Authorization = "DockerContainerList"
+	OperationDockerContainerExport              Authorization = "DockerContainerExport"
+	OperationDockerContainerChanges             Authorization = "DockerContainerChanges"
+	OperationDockerContainerInspect             Authorization = "DockerContainerInspect"
+	OperationDockerContainerTop                 Authorization = "DockerContainerTop"
+	OperationDockerContainerLogs                Authorization = "DockerContainerLogs"
+	OperationDockerContainerStats               Authorization = "DockerContainerStats"
+	OperationDockerContainerAttachWebsocket     Authorization = "DockerContainerAttachWebsocket"
+	OperationDockerContainerArchive             Authorization = "DockerContainerArchive"
+	OperationDockerContainerCreate              Authorization = "DockerContainerCreate"
+	OperationDockerContainerPrune               Authorization = "DockerContainerPrune"
+	OperationDockerContainerKill                Authorization = "DockerContainerKill"
+	OperationDockerContainerPause               Authorization = "DockerContainerPause"
+	OperationDockerContainerUnpause             Authorization = "DockerContainerUnpause"
+	OperationDockerContainerRestart             Authorization = "DockerContainerRestart"
+	OperationDockerContainerStart               Authorization = "DockerContainerStart"
+	OperationDockerContainerStop                Authorization = "DockerContainerStop"
+	OperationDockerContainerWait                Authorization = "DockerContainerWait"
+	OperationDockerContainerResize              Authorization = "DockerContainerResize"
+	OperationDockerContainerAttach              Authorization = "DockerContainerAttach"
+	OperationDockerContainerExec                Authorization = "DockerContainerExec"
+	OperationDockerContainerRename              Authorization = "DockerContainerRename"
+	OperationDockerContainerUpdate              Authorization = "DockerContainerUpdate"
+	OperationDockerContainerPutContainerArchive Authorization = "DockerContainerPutContainerArchive"
+	OperationDockerContainerDelete              Authorization = "DockerContainerDelete"
+	OperationDockerImageList                    Authorization = "DockerImageList"
+	OperationDockerImageSearch                  Authorization = "DockerImageSearch"
+	OperationDockerImageGetAll                  Authorization = "DockerImageGetAll"
+	OperationDockerImageGet                     Authorization = "DockerImageGet"
+	OperationDockerImageHistory                 Authorization = "DockerImageHistory"
+	OperationDockerImageInspect                 Authorization = "DockerImageInspect"
+	OperationDockerImageLoad                    Authorization = "DockerImageLoad"
+	OperationDockerImageCreate                  Authorization = "DockerImageCreate"
+	OperationDockerImagePrune                   Authorization = "DockerImagePrune"
+	OperationDockerImagePush                    Authorization = "DockerImagePush"
+	OperationDockerImageTag                     Authorization = "DockerImageTag"
+	OperationDockerImageDelete                  Authorization = "DockerImageDelete"
+	OperationDockerImageCommit                  Authorization = "DockerImageCommit"
+	OperationDockerImageBuild                   Authorization = "DockerImageBuild"
+	OperationDockerNetworkList                  Authorization = "DockerNetworkList"
+	OperationDockerNetworkInspect               Authorization = "DockerNetworkInspect"
+	OperationDockerNetworkCreate                Authorization = "DockerNetworkCreate"
+	OperationDockerNetworkConnect               Authorization = "DockerNetworkConnect"
+	OperationDockerNetworkDisconnect            Authorization = "DockerNetworkDisconnect"
+	OperationDockerNetworkPrune                 Authorization = "DockerNetworkPrune"
+	OperationDockerNetworkDelete                Authorization = "DockerNetworkDelete"
+	OperationDockerVolumeList                   Authorization = "DockerVolumeList"
+	OperationDockerVolumeInspect                Authorization = "DockerVolumeInspect"
+	OperationDockerVolumeCreate                 Authorization = "DockerVolumeCreate"
+	OperationDockerVolumePrune                  Authorization = "DockerVolumePrune"
+	OperationDockerVolumeDelete                 Authorization = "DockerVolumeDelete"
+	OperationDockerExecInspect                  Authorization = "DockerExecInspect"
+	OperationDockerExecStart                    Authorization = "DockerExecStart"
+	OperationDockerExecResize                   Authorization = "DockerExecResize"
+	OperationDockerSwarmInspect                 Authorization = "DockerSwarmInspect"
+	OperationDockerSwarmUnlockKey               Authorization = "DockerSwarmUnlockKey"
+	OperationDockerSwarmInit                    Authorization = "DockerSwarmInit"
+	OperationDockerSwarmJoin                    Authorization = "DockerSwarmJoin"
+	OperationDockerSwarmLeave                   Authorization = "DockerSwarmLeave"
+	OperationDockerSwarmUpdate                  Authorization = "DockerSwarmUpdate"
+	OperationDockerSwarmUnlock                  Authorization = "DockerSwarmUnlock"
+	OperationDockerNodeList                     Authorization = "DockerNodeList"
+	OperationDockerNodeInspect                  Authorization = "DockerNodeInspect"
+	OperationDockerNodeUpdate                   Authorization = "DockerNodeUpdate"
+	OperationDockerNodeDelete                   Authorization = "DockerNodeDelete"
+	OperationDockerServiceList                  Authorization = "DockerServiceList"
+	OperationDockerServiceInspect               Authorization = "DockerServiceInspect"
+	OperationDockerServiceLogs                  Authorization = "DockerServiceLogs"
+	OperationDockerServiceCreate                Authorization = "DockerServiceCreate"
+	OperationDockerServiceUpdate                Authorization = "DockerServiceUpdate"
+	OperationDockerServiceDelete                Authorization = "DockerServiceDelete"
+	OperationDockerSecretList                   Authorization = "DockerSecretList"
+	OperationDockerSecretInspect                Authorization = "DockerSecretInspect"
+	OperationDockerSecretCreate                 Authorization = "DockerSecretCreate"
+	OperationDockerSecretUpdate                 Authorization = "DockerSecretUpdate"
+	OperationDockerSecretDelete                 Authorization = "DockerSecretDelete"
+	OperationDockerConfigList                   Authorization = "DockerConfigList"
+	OperationDockerConfigInspect                Authorization = "DockerConfigInspect"
+	OperationDockerConfigCreate                 Authorization = "DockerConfigCreate"
+	OperationDockerConfigUpdate                 Authorization = "DockerConfigUpdate"
+	OperationDockerConfigDelete                 Authorization = "DockerConfigDelete"
+	OperationDockerTaskList                     Authorization = "DockerTaskList"
+	OperationDockerTaskInspect                  Authorization = "DockerTaskInspect"
+	OperationDockerTaskLogs                     Authorization = "DockerTaskLogs"
+	OperationDockerPluginList                   Authorization = "DockerPluginList"
+	OperationDockerPluginPrivileges             Authorization = "DockerPluginPrivileges"
+	OperationDockerPluginInspect                Authorization = "DockerPluginInspect"
+	OperationDockerPluginPull                   Authorization = "DockerPluginPull"
+	OperationDockerPluginCreate                 Authorization = "DockerPluginCreate"
+	OperationDockerPluginEnable                 Authorization = "DockerPluginEnable"
+	OperationDockerPluginDisable                Authorization = "DockerPluginDisable"
+	OperationDockerPluginPush                   Authorization = "DockerPluginPush"
+	OperationDockerPluginUpgrade                Authorization = "DockerPluginUpgrade"
+	OperationDockerPluginSet                    Authorization = "DockerPluginSet"
+	OperationDockerPluginDelete                 Authorization = "DockerPluginDelete"
+	OperationDockerSessionStart                 Authorization = "DockerSessionStart"
+	OperationDockerDistributionInspect          Authorization = "DockerDistributionInspect"
+	OperationDockerBuildPrune                   Authorization = "DockerBuildPrune"
+	OperationDockerBuildCancel                  Authorization = "DockerBuildCancel"
+	OperationDockerPing                         Authorization = "DockerPing"
+	OperationDockerInfo                         Authorization = "DockerInfo"
+	OperationDockerEvents                       Authorization = "DockerEvents"
+	OperationDockerSystem                       Authorization = "DockerSystem"
+	OperationDockerVersion                      Authorization = "DockerVersion"
+
+	OperationDockerAgentPing         Authorization = "DockerAgentPing"
+	OperationDockerAgentList         Authorization = "DockerAgentList"
+	OperationDockerAgentHostInfo     Authorization = "DockerAgentHostInfo"
+	OperationDockerAgentBrowseDelete Authorization = "DockerAgentBrowseDelete"
+	OperationDockerAgentBrowseGet    Authorization = "DockerAgentBrowseGet"
+	OperationDockerAgentBrowseList   Authorization = "DockerAgentBrowseList"
+	OperationDockerAgentBrowsePut    Authorization = "DockerAgentBrowsePut"
+	OperationDockerAgentBrowseRename Authorization = "DockerAgentBrowseRename"
+
+	OperationPortainerDockerHubInspect      Authorization = "PortainerDockerHubInspect"
+	OperationPortainerDockerHubUpdate       Authorization = "PortainerDockerHubUpdate"
+	OperationPortainerEndpointGroupCreate   Authorization = "PortainerEndpointGroupCreate"
+	OperationPortainerEndpointGroupList     Authorization = "PortainerEndpointGroupList"
+	OperationPortainerEndpointGroupDelete   Authorization = "PortainerEndpointGroupDelete"
+	OperationPortainerEndpointGroupInspect  Authorization = "PortainerEndpointGroupInspect"
+	OperationPortainerEndpointGroupUpdate   Authorization = "PortainerEndpointGroupEdit"
+	OperationPortainerEndpointGroupAccess   Authorization = "PortainerEndpointGroupAccess "
+	OperationPortainerEndpointList          Authorization = "PortainerEndpointList"
+	OperationPortainerEndpointInspect       Authorization = "PortainerEndpointInspect"
+	OperationPortainerEndpointCreate        Authorization = "PortainerEndpointCreate"
+	OperationPortainerEndpointJob           Authorization = "PortainerEndpointJob"
+	OperationPortainerEndpointSnapshots     Authorization = "PortainerEndpointSnapshots"
+	OperationPortainerEndpointSnapshot      Authorization = "PortainerEndpointSnapshot"
+	OperationPortainerEndpointUpdate        Authorization = "PortainerEndpointUpdate"
+	OperationPortainerEndpointUpdateAccess  Authorization = "PortainerEndpointUpdateAccess"
+	OperationPortainerEndpointDelete        Authorization = "PortainerEndpointDelete"
+	OperationPortainerExtensionList         Authorization = "PortainerExtensionList"
+	OperationPortainerExtensionInspect      Authorization = "PortainerExtensionInspect"
+	OperationPortainerExtensionCreate       Authorization = "PortainerExtensionCreate"
+	OperationPortainerExtensionUpdate       Authorization = "PortainerExtensionUpdate"
+	OperationPortainerExtensionDelete       Authorization = "PortainerExtensionDelete"
+	OperationPortainerMOTD                  Authorization = "PortainerMOTD"
+	OperationPortainerRegistryList          Authorization = "PortainerRegistryList"
+	OperationPortainerRegistryInspect       Authorization = "PortainerRegistryInspect"
+	OperationPortainerRegistryCreate        Authorization = "PortainerRegistryCreate"
+	OperationPortainerRegistryConfigure     Authorization = "PortainerRegistryConfigure"
+	OperationPortainerRegistryUpdate        Authorization = "PortainerRegistryUpdate"
+	OperationPortainerRegistryUpdateAccess  Authorization = "PortainerRegistryUpdateAccess"
+	OperationPortainerRegistryDelete        Authorization = "PortainerRegistryDelete"
+	OperationPortainerResourceControlCreate Authorization = "PortainerResourceControlCreate"
+	OperationPortainerResourceControlUpdate Authorization = "PortainerResourceControlUpdate"
+	OperationPortainerResourceControlDelete Authorization = "PortainerResourceControlDelete"
+	OperationPortainerRoleList              Authorization = "PortainerRoleList"
+	OperationPortainerRoleInspect           Authorization = "PortainerRoleInspect"
+	OperationPortainerRoleCreate            Authorization = "PortainerRoleCreate"
+	OperationPortainerRoleUpdate            Authorization = "PortainerRoleUpdate"
+	OperationPortainerRoleDelete            Authorization = "PortainerRoleDelete"
+	OperationPortainerScheduleList          Authorization = "PortainerScheduleList"
+	OperationPortainerScheduleInspect       Authorization = "PortainerScheduleInspect"
+	OperationPortainerScheduleFile          Authorization = "PortainerScheduleFile"
+	OperationPortainerScheduleTasks         Authorization = "PortainerScheduleTasks"
+	OperationPortainerScheduleCreate        Authorization = "PortainerScheduleCreate"
+	OperationPortainerScheduleUpdate        Authorization = "PortainerScheduleUpdate"
+	OperationPortainerScheduleDelete        Authorization = "PortainerScheduleDelete"
+	OperationPortainerSettingsInspect       Authorization = "PortainerSettingsInspect"
+	OperationPortainerSettingsUpdate        Authorization = "PortainerSettingsUpdate"
+	OperationPortainerSettingsLDAPCheck     Authorization = "PortainerSettingsLDAPCheck"
+	OperationPortainerStackList             Authorization = "PortainerStackList"
+	OperationPortainerStackInspect          Authorization = "PortainerStackInspect"
+	OperationPortainerStackFile             Authorization = "PortainerStackFile"
+	OperationPortainerStackCreate           Authorization = "PortainerStackCreate"
+	OperationPortainerStackMigrate          Authorization = "PortainerStackMigrate"
+	OperationPortainerStackUpdate           Authorization = "PortainerStackUpdate"
+	OperationPortainerStackDelete           Authorization = "PortainerStackDelete"
+	OperationPortainerTagList               Authorization = "PortainerTagList"
+	OperationPortainerTagCreate             Authorization = "PortainerTagCreate"
+	OperationPortainerTagDelete             Authorization = "PortainerTagDelete"
+	OperationPortainerTeamMembershipList    Authorization = "PortainerTeamMembershipList"
+	OperationPortainerTeamMembershipCreate  Authorization = "PortainerTeamMembershipCreate"
+	OperationPortainerTeamMembershipUpdate  Authorization = "PortainerTeamMembershipUpdate"
+	OperationPortainerTeamMembershipDelete  Authorization = "PortainerTeamMembershipDelete"
+	OperationPortainerTeamList              Authorization = "PortainerTeamList"
+	OperationPortainerTeamInspect           Authorization = "PortainerTeamInspect"
+	OperationPortainerTeamMemberships       Authorization = "PortainerTeamMemberships"
+	OperationPortainerTeamCreate            Authorization = "PortainerTeamCreate"
+	OperationPortainerTeamUpdate            Authorization = "PortainerTeamUpdate"
+	OperationPortainerTeamDelete            Authorization = "PortainerTeamDelete"
+	OperationPortainerTemplateList          Authorization = "PortainerTemplateList"
+	OperationPortainerTemplateInspect       Authorization = "PortainerTemplateInspect"
+	OperationPortainerTemplateCreate        Authorization = "PortainerTemplateCreate"
+	OperationPortainerTemplateUpdate        Authorization = "PortainerTemplateUpdate"
+	OperationPortainerTemplateDelete        Authorization = "PortainerTemplateDelete"
+	OperationPortainerUploadTLS             Authorization = "PortainerUploadTLS"
+	OperationPortainerUserList              Authorization = "PortainerUserList"
+	OperationPortainerUserInspect           Authorization = "PortainerUserInspect"
+	OperationPortainerUserMemberships       Authorization = "PortainerUserMemberships"
+	OperationPortainerUserCreate            Authorization = "PortainerUserCreate"
+	OperationPortainerUserListToken         Authorization = "PortainerUserListToken"
+	OperationPortainerUserCreateToken       Authorization = "PortainerUserCreateToken"
+	OperationPortainerUserRevokeToken       Authorization = "PortainerUserRevokeToken"
+	OperationPortainerUserUpdate            Authorization = "PortainerUserUpdate"
+	OperationPortainerUserUpdatePassword    Authorization = "PortainerUserUpdatePassword"
+	OperationPortainerUserDelete            Authorization = "PortainerUserDelete"
+	OperationPortainerWebsocketExec         Authorization = "PortainerWebsocketExec"
+	OperationPortainerWebhookList           Authorization = "PortainerWebhookList"
+	OperationPortainerWebhookCreate         Authorization = "PortainerWebhookCreate"
+	OperationPortainerWebhookDelete         Authorization = "PortainerWebhookDelete"
+
+	OperationDockerUndefined      Authorization = "DockerUndefined"
+	OperationDockerAgentUndefined Authorization = "DockerAgentUndefined"
+	OperationPortainerUndefined   Authorization = "PortainerUndefined"
+
+	EndpointResourcesAccess Authorization = "EndpointResourcesAccess"
+
+	// Deprecated operations
+	OperationPortainerEndpointExtensionAdd    Authorization = "PortainerEndpointExtensionAdd"
+	OperationPortainerEndpointExtensionRemove Authorization = "PortainerEndpointExtensionRemove"
+	OperationIntegrationStoridgeAdmin         Authorization = "IntegrationStoridgeAdmin"
+)
+
+// GetEditionLabel returns the portainer edition label
+func (e SoftwareEdition) GetEditionLabel() string {
+	switch e {
+	case PortainerCE:
+		return "CE"
+	case PortainerBE:
+		return "BE"
+	case PortainerEE:
+		return "EE"
+	}
+
+	return "CE"
+}
+
+const (
+	AzurePathContainerGroups = "/subscriptions/*/providers/Microsoft.ContainerInstance/containerGroups"
+	AzurePathContainerGroup  = "/subscriptions/*/resourceGroups/*/providers/Microsoft.ContainerInstance/containerGroups/*"
+)
+
+type PerDevConfigsFilterType string
+
+const (
+	PerDevConfigsTypeFile PerDevConfigsFilterType = "file"
+	PerDevConfigsTypeDir  PerDevConfigsFilterType = "dir"
+)
+
+const (
+	ContainerEngineDocker = "docker"
+	ContainerEnginePodman = "podman"
+)
+
+const (
+	// PolicyType constants
+	RbacK8s                 PolicyType = "rbac-k8s"
+	SecurityK8s             PolicyType = "security-k8s"
+	SetupK8s                PolicyType = "setup-k8s"
+	RegistryK8s             PolicyType = "registry-k8s"
+	RbacDocker              PolicyType = "rbac-docker"
+	SecurityDocker          PolicyType = "security-docker"
+	SetupDocker             PolicyType = "setup-docker"
+	RegistryDocker          PolicyType = "registry-docker"
+	ChangeConfirmation      PolicyType = "change-confirmation"
+	CleanupDocker           PolicyType = "cleanup-docker"
+	ObservabilityK8s        PolicyType = "observability-k8s"
+	PodSecurityStandardsK8s PolicyType = "pod-security-standards-k8s"
+	NetworkSecurityK8s      PolicyType = "network-security-k8s"
+)
+
+type HelmInstallStatus string
+
+const (
+	HelmInstallStatusInstalling   HelmInstallStatus = "installing"
+	HelmInstallStatusInstalled    HelmInstallStatus = "installed"
+	HelmInstallStatusFailed       HelmInstallStatus = "failed"
+	HelmInstallStatusUninstalling HelmInstallStatus = "uninstalling"
+	HelmInstallStatusConflict     HelmInstallStatus = "conflict"
+)
+
+func DefaultEndpointSecuritySettings() EndpointSecuritySettings {
+	return EndpointSecuritySettings{
+		AllowBindMountsForRegularUsers:            false,
+		AllowContainerCapabilitiesForRegularUsers: false,
+		AllowDeviceMappingForRegularUsers:         false,
+		AllowHostNamespaceForRegularUsers:         false,
+		AllowPrivilegedModeForRegularUsers:        false,
+		AllowSysctlSettingForRegularUsers:         false,
+		AllowSecurityOptForRegularUsers:           false,
+		AllowVolumeBrowserForRegularUsers:         false,
+		EnableHostManagementFeatures:              false,
+
+		AllowStackManagementForRegularUsers: true,
+	}
+}
+
+type AllowListKey int
+
+const (
+	AllowListSSRF AllowListKey = iota
+)
+
+type SSRFMode int
+
+const (
+	SSRFModeOff SSRFMode = iota
+	SSRFModeAudit
+	SSRFModeEnforce
+)
diff --git a/api/roar/roar.go b/api/roar/roar.go
new file mode 100644
index 0000000..6edc67f
--- /dev/null
+++ b/api/roar/roar.go
@@ -0,0 +1,145 @@
+package roar
+
+import (
+	"fmt"
+
+	"github.com/RoaringBitmap/roaring/v2"
+)
+
+type Roar[T ~int] struct {
+	rb *roaring.Bitmap
+}
+
+// Iterate iterates over the bitmap, calling the given callback with each value in the bitmap.  If the callback returns
+// false, the iteration is halted.
+// The iteration results are undefined if the bitmap is modified (e.g., with Add or Remove).
+// There is no guarantee as to what order the values will be iterated.
+func (r *Roar[T]) Iterate(f func(T) bool) {
+	if r.rb == nil {
+		return
+	}
+
+	r.rb.Iterate(func(e uint32) bool {
+		return f(T(e))
+	})
+}
+
+// Len returns the number of elements contained in the bitmap
+func (r *Roar[T]) Len() int {
+	if r.rb == nil {
+		return 0
+	}
+
+	return int(r.rb.GetCardinality())
+}
+
+// Remove removes the given element from the bitmap
+func (r *Roar[T]) Remove(e T) {
+	if r.rb == nil {
+		return
+	}
+
+	r.rb.Remove(uint32(e))
+}
+
+// Add adds the given element to the bitmap
+func (r *Roar[T]) Add(e T) {
+	if r.rb == nil {
+		r.rb = roaring.New()
+	}
+
+	r.rb.AddInt(int(e))
+}
+
+// Contains returns whether the bitmap contains the given element or not
+func (r *Roar[T]) Contains(e T) bool {
+	if r.rb == nil {
+		return false
+	}
+
+	return r.rb.ContainsInt(int(e))
+}
+
+// Union combines the elements of the given bitmap with this bitmap
+func (r *Roar[T]) Union(other Roar[T]) {
+	if other.rb == nil {
+		return
+	} else if r.rb == nil {
+		r.rb = roaring.New()
+	}
+
+	r.rb.Or(other.rb)
+}
+
+// Intersection modifies this bitmap to only contain elements that are also in the other bitmap
+func (r *Roar[T]) Intersection(other Roar[T]) {
+	if other.rb == nil {
+		if r.rb != nil {
+			r.rb.Clear()
+		}
+
+		return
+	}
+
+	if r.rb == nil {
+		r.rb = roaring.New()
+	}
+
+	r.rb.And(other.rb)
+}
+
+// ToSlice converts the bitmap to a slice of elements
+func (r *Roar[T]) ToSlice() []T {
+	if r.rb == nil {
+		return make([]T, 0)
+	}
+
+	slice := make([]T, 0, r.rb.GetCardinality())
+	r.rb.Iterate(func(e uint32) bool {
+		slice = append(slice, T(e))
+
+		return true
+	})
+
+	return slice
+}
+
+func (r *Roar[T]) MarshalJSON() ([]byte, error) {
+	if r.rb == nil {
+		return []byte("null"), nil
+	}
+
+	r.rb.RunOptimize()
+
+	buf, err := r.rb.ToBase64()
+	if err != nil {
+		return nil, fmt.Errorf("failed to encode roaring bitmap: %w", err)
+	}
+
+	return fmt.Appendf(nil, `"%s"`, buf), nil
+}
+
+func (r *Roar[T]) UnmarshalJSON(data []byte) error {
+	if len(data) == 0 || string(data) == "null" {
+		return nil
+	}
+
+	r.rb = roaring.New()
+
+	_, err := r.rb.FromBase64(string(data[1 : len(data)-1]))
+
+	return err
+}
+
+// FromSlice creates a Roar by adding all elements from the provided slices
+func FromSlice[T ~int](ess ...[]T) Roar[T] {
+	var r Roar[T]
+
+	for _, es := range ess {
+		for _, e := range es {
+			r.Add(e)
+		}
+	}
+
+	return r
+}
diff --git a/api/roar/roar_test.go b/api/roar/roar_test.go
new file mode 100644
index 0000000..3f2ed73
--- /dev/null
+++ b/api/roar/roar_test.go
@@ -0,0 +1,126 @@
+package roar
+
+import (
+	"slices"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestRoar(t *testing.T) {
+	t.Parallel()
+	r := Roar[int]{}
+	require.Equal(t, 0, r.Len())
+
+	r.Add(1)
+	require.Equal(t, 1, r.Len())
+	require.True(t, r.Contains(1))
+	require.False(t, r.Contains(2))
+
+	r.Add(2)
+	require.Equal(t, 2, r.Len())
+	require.True(t, r.Contains(2))
+
+	r.Remove(1)
+	require.Equal(t, 1, r.Len())
+	require.False(t, r.Contains(1))
+
+	s := FromSlice([]int{3, 4, 5})
+	require.Equal(t, 3, s.Len())
+	require.True(t, s.Contains(3))
+	require.True(t, s.Contains(4))
+	require.True(t, s.Contains(5))
+
+	r.Union(s)
+	require.Equal(t, 4, r.Len())
+	require.True(t, r.Contains(2))
+	require.True(t, r.Contains(3))
+	require.True(t, r.Contains(4))
+	require.True(t, r.Contains(5))
+
+	r.Iterate(func(id int) bool {
+		require.True(t, slices.Contains([]int{2, 3, 4, 5}, id))
+
+		return true
+	})
+
+	rSlice := r.ToSlice()
+	require.Equal(t, []int{2, 3, 4, 5}, rSlice)
+
+	r.Intersection(FromSlice([]int{4}))
+	require.Equal(t, 1, r.Len())
+	require.True(t, r.Contains(4))
+	require.False(t, r.Contains(2))
+	require.False(t, r.Contains(3))
+	require.False(t, r.Contains(5))
+
+	b, err := r.MarshalJSON()
+	require.NoError(t, err)
+	require.NotEqual(t, "null", string(b))
+	require.True(t, strings.HasPrefix(string(b), `"`))
+	require.True(t, strings.HasSuffix(string(b), `"`))
+}
+
+func TestNilSafety(t *testing.T) {
+	t.Parallel()
+	var r, s, u Roar[int]
+
+	r.Iterate(func(id int) bool {
+		require.Fail(t, "should not iterate over nil Roar")
+
+		return true
+	})
+
+	b, err := r.MarshalJSON()
+	require.NoError(t, err)
+	require.Equal(t, "null", string(b))
+
+	err = r.UnmarshalJSON([]byte("null"))
+	require.NoError(t, err)
+	require.Equal(t, 0, r.Len())
+
+	r.Contains(1)
+	r.Remove(1)
+
+	require.Equal(t, 0, r.Len())
+	require.Empty(t, r.ToSlice())
+
+	r.Add(1)
+	require.Equal(t, 1, r.Len())
+	require.False(t, r.Contains(2))
+
+	s.Union(r)
+	require.Equal(t, 1, s.Len())
+	require.True(t, s.Contains(1))
+
+	r.Union(u)
+	require.Equal(t, 1, r.Len())
+	require.True(t, r.Contains(1))
+
+	s.Intersection(u)
+	require.Equal(t, 0, s.Len())
+
+	u.Intersection(r)
+	require.Equal(t, 0, u.Len())
+}
+
+func TestJSON(t *testing.T) {
+	t.Parallel()
+	var r, u Roar[int]
+
+	r.Add(1)
+	r.Add(2)
+	r.Add(3)
+
+	b, err := r.MarshalJSON()
+	require.NoError(t, err)
+	require.NotEqual(t, "null", string(b))
+
+	err = u.UnmarshalJSON(b)
+	require.NoError(t, err)
+	require.Equal(t, 3, u.Len())
+	require.True(t, u.Contains(1))
+	require.True(t, u.Contains(2))
+	require.True(t, u.Contains(3))
+}
diff --git a/api/scheduler/scheduler.go b/api/scheduler/scheduler.go
new file mode 100644
index 0000000..9565f0e
--- /dev/null
+++ b/api/scheduler/scheduler.go
@@ -0,0 +1,141 @@
+package scheduler
+
+import (
+	"context"
+	"strconv"
+	"sync"
+	"time"
+
+	"github.com/pkg/errors"
+	"github.com/robfig/cron/v3"
+	"github.com/rs/zerolog/log"
+)
+
+type Scheduler struct {
+	crontab    *cron.Cron
+	activeJobs map[cron.EntryID]context.CancelFunc
+	mu         sync.Mutex
+}
+
+type PermanentError struct {
+	err error
+}
+
+func NewPermanentError(err error) *PermanentError {
+	return &PermanentError{err: err}
+}
+
+func (e *PermanentError) Error() string {
+	return e.err.Error()
+}
+
+func NewScheduler(ctx context.Context) *Scheduler {
+	crontab := cron.New(cron.WithChain(cron.Recover(cron.DefaultLogger)))
+	crontab.Start()
+
+	s := &Scheduler{
+		crontab:    crontab,
+		activeJobs: make(map[cron.EntryID]context.CancelFunc),
+	}
+
+	if ctx != nil {
+		go func() {
+			<-ctx.Done()
+
+			if err := s.Shutdown(); err != nil {
+				log.Error().Err(err).Msg("failed to shutdown the scheduler")
+			}
+		}()
+	}
+
+	return s
+}
+
+// Shutdown stops the scheduler and waits for it to stop if it is running; otherwise does nothing.
+func (s *Scheduler) Shutdown() error {
+	if s.crontab == nil {
+		return nil
+	}
+
+	log.Debug().Msg("stopping scheduler")
+
+	ctx := s.crontab.Stop()
+	<-ctx.Done()
+
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	for _, job := range s.crontab.Entries() {
+		if cancel, ok := s.activeJobs[job.ID]; ok {
+			cancel()
+		}
+	}
+
+	err := ctx.Err()
+	if errors.Is(err, context.Canceled) {
+		return nil
+	}
+
+	return err
+}
+
+// StopJob stops the job from being run in the future
+func (s *Scheduler) StopJob(jobID string) error {
+	id, err := strconv.Atoi(jobID)
+	if err != nil {
+		return errors.Wrapf(err, "failed convert jobID %q to int", jobID)
+	}
+
+	entryID := cron.EntryID(id)
+
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	if cancel, ok := s.activeJobs[entryID]; ok {
+		cancel()
+	}
+
+	return nil
+}
+
+// StartJobEvery schedules a new periodic job with a given duration.
+// Returns job id that could be used to stop the given job.
+// When job run returns an error, that job won't be run again.
+func (s *Scheduler) StartJobEvery(duration time.Duration, job func() error) string {
+	entryID := new(cron.EntryID)
+
+	cancelFn := func() {
+		log.Debug().Msg("job cancelled, stopping")
+		s.crontab.Remove(*entryID)
+		delete(s.activeJobs, *entryID)
+	}
+
+	jobFn := cron.FuncJob(func() {
+		err := job()
+		if err == nil {
+			return
+		}
+
+		var permErr *PermanentError
+		if errors.As(err, &permErr) {
+			log.Error().Err(permErr).Msg("job returned a permanent error, it will be stopped")
+
+			s.mu.Lock()
+			defer s.mu.Unlock()
+
+			cancelFn()
+
+			return
+		}
+
+		log.Error().Err(err).Msg("job returned an error, it will be rescheduled")
+	})
+
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	*entryID = s.crontab.Schedule(cron.Every(duration), jobFn)
+	s.activeJobs[*entryID] = cancelFn
+
+	return strconv.Itoa(int(*entryID))
+}
diff --git a/api/scheduler/scheduler_test.go b/api/scheduler/scheduler_test.go
new file mode 100644
index 0000000..5f5d020
--- /dev/null
+++ b/api/scheduler/scheduler_test.go
@@ -0,0 +1,175 @@
+package scheduler
+
+import (
+	"context"
+	"errors"
+	"sync/atomic"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+var jobInterval = time.Second
+
+func requireNoShutdownErr(t *testing.T, fn func() error) {
+	require.NoError(t, fn(), "scheduler must be shutdown without error")
+}
+
+func Test_ScheduledJobRuns(t *testing.T) {
+	t.Parallel()
+	synctest.Test(t, func(t *testing.T) {
+		s := NewScheduler(t.Context())
+		defer requireNoShutdownErr(t, s.Shutdown)
+
+		ctx, cancel := context.WithTimeout(t.Context(), 2*jobInterval)
+
+		var workDone bool
+		s.StartJobEvery(jobInterval, func() error {
+			workDone = true
+
+			cancel()
+
+			return nil
+		})
+
+		<-ctx.Done()
+		assert.True(t, workDone, "value should been set in the job")
+	})
+}
+
+func Test_JobCanBeStopped(t *testing.T) {
+	t.Parallel()
+	synctest.Test(t, func(t *testing.T) {
+		s := NewScheduler(t.Context())
+		defer requireNoShutdownErr(t, s.Shutdown)
+
+		ctx, cancel := context.WithTimeout(t.Context(), 2*jobInterval)
+
+		var workDone bool
+		jobID := s.StartJobEvery(jobInterval, func() error {
+			workDone = true
+
+			cancel()
+
+			return nil
+		})
+
+		err := s.StopJob(jobID)
+		require.NoError(t, err)
+
+		<-ctx.Done()
+		assert.False(t, workDone, "job shouldn't had a chance to run")
+	})
+}
+
+func Test_JobShouldStop_UponPermError(t *testing.T) {
+	t.Parallel()
+	synctest.Test(t, func(t *testing.T) {
+		s := NewScheduler(t.Context())
+		defer requireNoShutdownErr(t, s.Shutdown)
+
+		var acc int
+
+		ch := make(chan struct{})
+		s.StartJobEvery(jobInterval, func() error {
+			acc++
+			close(ch)
+
+			return NewPermanentError(errors.New("failed"))
+		})
+
+		<-time.After(3 * jobInterval)
+		<-ch
+		assert.Equal(t, 1, acc, "job stop after the first run because it returns an error")
+	})
+}
+
+func Test_JobShouldNotStop_UponError(t *testing.T) {
+	t.Parallel()
+	synctest.Test(t, func(t *testing.T) {
+		s := NewScheduler(t.Context())
+		defer requireNoShutdownErr(t, s.Shutdown)
+
+		var acc atomic.Int64
+
+		ch := make(chan struct{})
+		s.StartJobEvery(jobInterval, func() error {
+			if acc.Add(1) == 2 {
+				close(ch)
+
+				return NewPermanentError(errors.New("failed"))
+			}
+
+			return errors.New("non-permanent error")
+		})
+
+		<-time.After(3 * jobInterval)
+		<-ch
+		assert.Equal(t, int64(2), acc.Load())
+	})
+}
+
+func Test_CanTerminateAllJobs_ByShuttingDownScheduler(t *testing.T) {
+	t.Parallel()
+	synctest.Test(t, func(t *testing.T) {
+		s := NewScheduler(t.Context())
+
+		ctx, cancel := context.WithTimeout(t.Context(), 2*jobInterval)
+
+		var workDone bool
+		s.StartJobEvery(jobInterval, func() error {
+			workDone = true
+			cancel()
+
+			return nil
+		})
+
+		requireNoShutdownErr(t, s.Shutdown)
+
+		<-ctx.Done()
+		assert.False(t, workDone, "job shouldn't had a chance to run")
+	})
+}
+
+func Test_CanTerminateAllJobs_ByCancellingParentContext(t *testing.T) {
+	t.Parallel()
+	synctest.Test(t, func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(t.Context(), 2*jobInterval)
+		s := NewScheduler(ctx)
+
+		var workDone bool
+		s.StartJobEvery(jobInterval, func() error {
+			workDone = true
+			cancel()
+
+			return nil
+		})
+
+		cancel()
+
+		<-ctx.Done()
+		assert.False(t, workDone, "job shouldn't had a chance to run")
+	})
+}
+
+func Test_StartJobEvery_Concurrently(t *testing.T) {
+	t.Parallel()
+	synctest.Test(t, func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(t.Context(), 2*jobInterval)
+		s := NewScheduler(ctx)
+
+		f := func() error {
+			return errors.New("error")
+		}
+
+		go s.StartJobEvery(jobInterval, f)
+		s.StartJobEvery(jobInterval, f)
+
+		cancel()
+
+		<-ctx.Done()
+	})
+}
diff --git a/api/set/set.go b/api/set/set.go
new file mode 100644
index 0000000..1376842
--- /dev/null
+++ b/api/set/set.go
@@ -0,0 +1,111 @@
+package set
+
+type SetKey interface {
+	~int | ~string
+}
+
+type Set[T SetKey] map[T]bool
+
+// Add adds a key to the set.
+func (s Set[T]) Add(key T) {
+	s[key] = true
+}
+
+// Contains returns true if the set contains the key.
+func (s Set[T]) Contains(key T) bool {
+	_, ok := s[key]
+
+	return ok
+}
+
+// Remove removes a key from the set.
+func (s Set[T]) Remove(key T) {
+	delete(s, key)
+}
+
+// Len returns the number of keys in the set.
+func (s Set[T]) Len() int {
+	return len(s)
+}
+
+// IsEmpty returns true if the set is empty.
+func (s Set[T]) IsEmpty() bool {
+	return len(s) == 0
+}
+
+// Clear removes all keys from the set.
+func (s Set[T]) Keys() []T {
+	keys := make([]T, s.Len())
+
+	i := 0
+	for k := range s {
+		keys[i] = k
+		i++
+	}
+
+	return keys
+}
+
+// Clear removes all keys from the set.
+func (s Set[T]) Copy() Set[T] {
+	c := make(Set[T])
+
+	for key := range s {
+		c.Add(key)
+	}
+
+	return c
+}
+
+// Difference returns a new set containing the keys that are in the first set but not in the second set.
+func (s Set[T]) Difference(second Set[T]) Set[T] {
+	difference := s.Copy()
+
+	for key := range second {
+		difference.Remove(key)
+	}
+
+	return difference
+}
+
+// Union returns a new set containing the keys that are in either set.
+func Union[T SetKey](sets ...Set[T]) Set[T] {
+	union := make(Set[T])
+
+	for _, set := range sets {
+		for key := range set {
+			union.Add(key)
+		}
+	}
+
+	return union
+}
+
+// Intersection returns a new set containing the keys that are in all sets.
+func Intersection[T SetKey](sets ...Set[T]) Set[T] {
+	if len(sets) == 0 {
+		return make(Set[T])
+	}
+
+	intersection := sets[0].Copy()
+
+	for _, set := range sets[1:] {
+		for key := range intersection {
+			if !set.Contains(key) {
+				intersection.Remove(key)
+			}
+		}
+	}
+
+	return intersection
+}
+
+// ToSet returns a new set containing the keys.
+func ToSet[T SetKey](keys []T) Set[T] {
+	set := make(Set[T])
+	for _, key := range keys {
+		set.Add(key)
+	}
+
+	return set
+}
diff --git a/api/set/set_test.go b/api/set/set_test.go
new file mode 100644
index 0000000..e109340
--- /dev/null
+++ b/api/set/set_test.go
@@ -0,0 +1,203 @@
+package set
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestAdd(t *testing.T) {
+	t.Parallel()
+
+	s := make(Set[int])
+	s.Add(1)
+	s.Add(2)
+	s.Add(2)
+
+	require.Equal(t, 2, s.Len())
+	require.True(t, s.Contains(1))
+	require.True(t, s.Contains(2))
+}
+
+func TestContains(t *testing.T) {
+	t.Parallel()
+
+	s := make(Set[string])
+	s.Add("hello")
+
+	require.True(t, s.Contains("hello"))
+	require.False(t, s.Contains("world"))
+}
+
+func TestRemove(t *testing.T) {
+	t.Parallel()
+
+	s := make(Set[int])
+	s.Add(1)
+	s.Add(2)
+	s.Remove(1)
+	s.Remove(99)
+
+	require.Equal(t, 1, s.Len())
+	require.False(t, s.Contains(1))
+	require.True(t, s.Contains(2))
+}
+
+func TestIsEmpty(t *testing.T) {
+	t.Parallel()
+
+	s := make(Set[int])
+	require.True(t, s.IsEmpty())
+
+	s.Add(1)
+	require.False(t, s.IsEmpty())
+
+	s.Remove(1)
+	require.True(t, s.IsEmpty())
+}
+
+func TestKeys(t *testing.T) {
+	t.Parallel()
+
+	s := ToSet([]int{1, 2, 3})
+	keys := s.Keys()
+
+	require.Len(t, keys, 3)
+	require.ElementsMatch(t, []int{1, 2, 3}, keys)
+}
+
+func TestCopy(t *testing.T) {
+	t.Parallel()
+
+	original := ToSet([]string{"a", "b", "c"})
+	copied := original.Copy()
+
+	require.Equal(t, original.Len(), copied.Len())
+	require.True(t, copied.Contains("a"))
+	require.True(t, copied.Contains("b"))
+	require.True(t, copied.Contains("c"))
+
+	copied.Add("d")
+	require.False(t, original.Contains("d"))
+
+	copied.Remove("a")
+	require.True(t, original.Contains("a"))
+}
+
+func TestDifference(t *testing.T) {
+	t.Parallel()
+
+	a := ToSet([]int{1, 2, 3, 4})
+	b := ToSet([]int{3, 4, 5})
+
+	diff := a.Difference(b)
+
+	require.Equal(t, 2, diff.Len())
+	require.True(t, diff.Contains(1))
+	require.True(t, diff.Contains(2))
+	require.False(t, diff.Contains(3))
+	require.False(t, diff.Contains(4))
+}
+
+func TestDifference_EmptySecond(t *testing.T) {
+	t.Parallel()
+
+	a := ToSet([]int{1, 2, 3})
+	b := make(Set[int])
+
+	diff := a.Difference(b)
+
+	require.Equal(t, 3, diff.Len())
+}
+
+func TestDifference_EmptyFirst(t *testing.T) {
+	t.Parallel()
+
+	a := make(Set[int])
+	b := ToSet([]int{1, 2, 3})
+
+	diff := a.Difference(b)
+
+	require.True(t, diff.IsEmpty())
+}
+
+func TestUnion(t *testing.T) {
+	t.Parallel()
+
+	a := ToSet([]int{1, 2})
+	b := ToSet([]int{2, 3})
+	c := ToSet([]int{3, 4})
+
+	u := Union(a, b, c)
+
+	require.Equal(t, 4, u.Len())
+	require.True(t, u.Contains(1))
+	require.True(t, u.Contains(2))
+	require.True(t, u.Contains(3))
+	require.True(t, u.Contains(4))
+}
+
+func TestUnion_NoSets(t *testing.T) {
+	t.Parallel()
+
+	u := Union[int]()
+	require.True(t, u.IsEmpty())
+}
+
+func TestIntersection(t *testing.T) {
+	t.Parallel()
+
+	a := ToSet([]int{1, 2, 3})
+	b := ToSet([]int{2, 3, 4})
+	c := ToSet([]int{3, 4, 5})
+
+	inter := Intersection(a, b, c)
+
+	require.Equal(t, 1, inter.Len())
+	require.True(t, inter.Contains(3))
+}
+
+func TestIntersection_NoOverlap(t *testing.T) {
+	t.Parallel()
+
+	a := ToSet([]int{1, 2})
+	b := ToSet([]int{3, 4})
+
+	inter := Intersection(a, b)
+
+	require.True(t, inter.IsEmpty())
+}
+
+func TestIntersection_NoSets(t *testing.T) {
+	t.Parallel()
+
+	inter := Intersection[int]()
+	require.True(t, inter.IsEmpty())
+}
+
+func TestIntersection_SingleSet(t *testing.T) {
+	t.Parallel()
+
+	a := ToSet([]int{1, 2, 3})
+	inter := Intersection(a)
+
+	require.Equal(t, 3, inter.Len())
+}
+
+func TestToSet(t *testing.T) {
+	t.Parallel()
+
+	keys := []string{"x", "y", "x"}
+	s := ToSet(keys)
+
+	require.Equal(t, 2, s.Len())
+	require.True(t, s.Contains("x"))
+	require.True(t, s.Contains("y"))
+}
+
+func TestToSet_Empty(t *testing.T) {
+	t.Parallel()
+
+	s := ToSet([]int{})
+	require.True(t, s.IsEmpty())
+}
diff --git a/api/slicesx/filter.go b/api/slicesx/filter.go
new file mode 100644
index 0000000..5f9a2e8
--- /dev/null
+++ b/api/slicesx/filter.go
@@ -0,0 +1,23 @@
+package slicesx
+
+import "slices"
+
+// Iterates over elements of collection, returning an array of all elements predicate returns truthy for.
+//
+// Note: Unlike `FilterInPlace`, this method returns a new array.
+func Filter[T any](input []T, predicate func(T) bool) []T {
+	result := make([]T, 0)
+	for i := range input {
+		if predicate(input[i]) {
+			result = append(result, input[i])
+		}
+	}
+	return result
+}
+
+// Filter in place all elements from input that predicate returns truthy for.
+//
+// Note: Unlike `Filter`, this method mutates input.
+func FilterInPlace[T any](input []T, predicate func(T) bool) []T {
+	return slices.DeleteFunc(input, func(v T) bool { return !predicate(v) })
+}
diff --git a/api/slicesx/filter_test.go b/api/slicesx/filter_test.go
new file mode 100644
index 0000000..40d4376
--- /dev/null
+++ b/api/slicesx/filter_test.go
@@ -0,0 +1,95 @@
+package slicesx_test
+
+import (
+	"testing"
+
+	"github.com/portainer/portainer/api/slicesx"
+
+	"github.com/stretchr/testify/require"
+)
+
+func Test_Filter(t *testing.T) {
+	t.Parallel()
+	test(t, slicesx.Filter, "Filter even numbers",
+		[]int{1, 2, 3, 4, 5, 6, 7, 8, 9},
+		[]int{2, 4, 6, 8},
+		func(x int) bool { return x%2 == 0 },
+	)
+	test(t, slicesx.Filter, "Filter odd numbers",
+		[]int{1, 2, 3, 4, 5, 6, 7, 8, 9},
+		[]int{1, 3, 5, 7, 9},
+		func(x int) bool { return x%2 == 1 },
+	)
+	test(t, slicesx.Filter, "Filter strings starting with 'A'",
+		[]string{"Apple", "Banana", "Avocado", "Grapes", "Apricot"},
+		[]string{"Apple", "Avocado", "Apricot"},
+		func(s string) bool { return s[0] == 'A' },
+	)
+	test(t, slicesx.Filter, "Filter strings longer than 5 chars",
+		[]string{"Apple", "Banana", "Avocado", "Grapes", "Apricot"},
+		[]string{"Banana", "Avocado", "Grapes", "Apricot"},
+		func(s string) bool { return len(s) > 5 },
+	)
+}
+
+func Test_Retain(t *testing.T) {
+	t.Parallel()
+	test(t, slicesx.FilterInPlace, "Filter even numbers",
+		[]int{1, 2, 3, 4, 5, 6, 7, 8, 9},
+		[]int{2, 4, 6, 8},
+		func(x int) bool { return x%2 == 0 },
+	)
+	test(t, slicesx.FilterInPlace, "Filter odd numbers",
+		[]int{1, 2, 3, 4, 5, 6, 7, 8, 9},
+		[]int{1, 3, 5, 7, 9},
+		func(x int) bool { return x%2 == 1 },
+	)
+	test(t, slicesx.FilterInPlace, "Filter strings starting with 'A'",
+		[]string{"Apple", "Banana", "Avocado", "Grapes", "Apricot"},
+		[]string{"Apple", "Avocado", "Apricot"},
+		func(s string) bool { return s[0] == 'A' },
+	)
+	test(t, slicesx.FilterInPlace, "Filter strings longer than 5 chars",
+		[]string{"Apple", "Banana", "Avocado", "Grapes", "Apricot"},
+		[]string{"Banana", "Avocado", "Grapes", "Apricot"},
+		func(s string) bool { return len(s) > 5 },
+	)
+}
+
+func Benchmark_Filter(b *testing.B) {
+	n := 100000
+
+	source := make([]int, n)
+	for i := range source {
+		source[i] = i
+	}
+
+	for b.Loop() {
+		e := slicesx.Filter(source, func(x int) bool { return x%2 == 0 })
+		require.Len(b, e, n/2)
+	}
+}
+
+func Benchmark_FilterInPlace(b *testing.B) {
+	n := 100000
+
+	source := make([]int, n)
+	for i := range source {
+		source[i] = i
+	}
+
+	// Preallocate all copies before timing
+	// because FilterInPlace mutates the original slice
+	copies := make([][]int, b.N)
+	for i := range b.N {
+		buf := make([]int, len(source))
+		copy(buf, source)
+		copies[i] = buf
+	}
+
+	b.ResetTimer()
+	for i := range b.N {
+		e := slicesx.FilterInPlace(copies[i], func(x int) bool { return x%2 == 0 })
+		require.Len(b, e, n/2)
+	}
+}
diff --git a/api/slicesx/flatten.go b/api/slicesx/flatten.go
new file mode 100644
index 0000000..56a77f3
--- /dev/null
+++ b/api/slicesx/flatten.go
@@ -0,0 +1,7 @@
+package slicesx
+
+import "slices"
+
+func Flatten[T any](input [][]T) []T {
+	return slices.Concat(input...)
+}
diff --git a/api/slicesx/flatten_test.go b/api/slicesx/flatten_test.go
new file mode 100644
index 0000000..5a6bca1
--- /dev/null
+++ b/api/slicesx/flatten_test.go
@@ -0,0 +1,20 @@
+package slicesx_test
+
+import (
+	"testing"
+
+	"github.com/portainer/portainer/api/slicesx"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_Flatten(t *testing.T) {
+	t.Parallel()
+	t.Run("Flatten an array of arrays", func(t *testing.T) {
+		is := assert.New(t)
+
+		source := [][]int{{1, 2, 3}, {4, 5, 6}, {7, 8, 9}}
+		expected := []int{1, 2, 3, 4, 5, 6, 7, 8, 9}
+		is.ElementsMatch(slicesx.Flatten(source), expected)
+
+	})
+}
diff --git a/api/slicesx/group_by.go b/api/slicesx/group_by.go
new file mode 100644
index 0000000..7c87c2e
--- /dev/null
+++ b/api/slicesx/group_by.go
@@ -0,0 +1,10 @@
+package slicesx
+
+func GroupBy[A any, K comparable](input []A, f func(A) K) map[K][]A {
+	result := make(map[K][]A)
+	for _, v := range input {
+		key := f(v)
+		result[key] = append(result[key], v)
+	}
+	return result
+}
diff --git a/api/slicesx/group_by_test.go b/api/slicesx/group_by_test.go
new file mode 100644
index 0000000..27ae322
--- /dev/null
+++ b/api/slicesx/group_by_test.go
@@ -0,0 +1,21 @@
+package slicesx_test
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/portainer/portainer/api/slicesx"
+)
+
+func TestGroupBy(t *testing.T) {
+	t.Parallel()
+	input := []string{"apple", "banana", "cherry", "date", "elderberry"}
+	f := func(a string) int {
+		return len(a)
+	}
+	expected := map[int][]string{5: {"apple"}, 6: {"banana", "cherry"}, 4: {"date"}, 10: {"elderberry"}}
+	result := slicesx.GroupBy(input, f)
+	if !reflect.DeepEqual(expected, result) {
+		t.Errorf("Expected %v, got %v", expected, result)
+	}
+}
diff --git a/api/slicesx/includes.go b/api/slicesx/includes.go
new file mode 100644
index 0000000..377a542
--- /dev/null
+++ b/api/slicesx/includes.go
@@ -0,0 +1,17 @@
+package slicesx
+
+import "slices"
+
+// Checks if predicate returns truthy for any element of input. Iteration is stopped once predicate returns truthy.
+func Some[T any](input []T, predicate func(T) bool) bool {
+	return slices.ContainsFunc(input, predicate)
+}
+
+// Checks if predicate returns truthy for all elements of input. Iteration is stopped once predicate returns falsey.
+//
+// Note: This method returns true for empty collections because everything is true of elements of empty collections.
+// https://en.wikipedia.org/wiki/Vacuous_truth
+func Every[T any](input []T, predicate func(T) bool) bool {
+	// if the slice doesn't contain an inverted predicate then all items follow the predicate
+	return !slices.ContainsFunc(input, func(t T) bool { return !predicate(t) })
+}
diff --git a/api/slicesx/includes_test.go b/api/slicesx/includes_test.go
new file mode 100644
index 0000000..6c36d32
--- /dev/null
+++ b/api/slicesx/includes_test.go
@@ -0,0 +1,78 @@
+package slicesx_test
+
+import (
+	"testing"
+
+	"github.com/portainer/portainer/api/slicesx"
+)
+
+func Test_Every(t *testing.T) {
+	t.Parallel()
+	test(t, slicesx.Every, "All start with an A (ok)",
+		[]string{"Apple", "Avocado", "Apricot"},
+		true,
+		func(s string) bool { return s[0] == 'A' },
+	)
+	test(t, slicesx.Every, "All start with an A (ko = some don't start with A)",
+		[]string{"Apple", "Avocado", "Banana"},
+		false,
+		func(s string) bool { return s[0] == 'A' },
+	)
+	test(t, slicesx.Every, "All are under 5 (ok)",
+		[]int{1, 2, 3},
+		true,
+		func(i int) bool { return i < 5 },
+	)
+	test(t, slicesx.Every, "All are under 5 (ko = some above 10)",
+		[]int{1, 2, 10},
+		false,
+		func(i int) bool { return i < 5 },
+	)
+	test(t, slicesx.Every, "All are true (ok)",
+		[]struct{ x bool }{{x: true}, {x: true}, {x: true}},
+		true,
+		func(s struct{ x bool }) bool { return s.x })
+	test(t, slicesx.Every, "All are true (ko = some are false)",
+		[]struct{ x bool }{{x: true}, {x: true}, {x: false}},
+		false,
+		func(s struct{ x bool }) bool { return s.x })
+	test(t, slicesx.Every, "Must be true on empty slice",
+		[]int{},
+		true,
+		func(i int) bool { return i%2 == 0 },
+	)
+}
+
+func Test_Some(t *testing.T) {
+	t.Parallel()
+	test(t, slicesx.Some, "Some start with an A (ok)",
+		[]string{"Apple", "Avocado", "Banana"},
+		true,
+		func(s string) bool { return s[0] == 'A' },
+	)
+	test(t, slicesx.Some, "Some start with an A (ko = all don't start with A)",
+		[]string{"Banana", "Cherry", "Peach"},
+		false,
+		func(s string) bool { return s[0] == 'A' },
+	)
+	test(t, slicesx.Some, "Some are under 5 (ok)",
+		[]int{1, 2, 30},
+		true,
+		func(i int) bool { return i < 5 },
+	)
+	test(t, slicesx.Some, "Some are under 5 (ko = all above 5)",
+		[]int{10, 11, 12},
+		false,
+		func(i int) bool { return i < 5 },
+	)
+	test(t, slicesx.Some, "Some are true (ok)",
+		[]struct{ x bool }{{x: true}, {x: true}, {x: false}},
+		true,
+		func(s struct{ x bool }) bool { return s.x },
+	)
+	test(t, slicesx.Some, "Some are true (ko = all are false)",
+		[]struct{ x bool }{{x: false}, {x: false}, {x: false}},
+		false,
+		func(s struct{ x bool }) bool { return s.x },
+	)
+}
diff --git a/api/slicesx/map.go b/api/slicesx/map.go
new file mode 100644
index 0000000..7e24bdd
--- /dev/null
+++ b/api/slicesx/map.go
@@ -0,0 +1,15 @@
+package slicesx
+
+// Map applies the given function to each element of the slice and returns a new slice with the results
+func Map[T, U any](s []T, f func(T) U) []U {
+	result := make([]U, len(s))
+	for i, v := range s {
+		result[i] = f(v)
+	}
+	return result
+}
+
+// FlatMap applies the given function to each element of the slice and returns a new slice with the flattened results
+func FlatMap[T, U any](s []T, f func(T) []U) []U {
+	return Flatten(Map(s, f))
+}
diff --git a/api/slicesx/map_test.go b/api/slicesx/map_test.go
new file mode 100644
index 0000000..1d44c27
--- /dev/null
+++ b/api/slicesx/map_test.go
@@ -0,0 +1,45 @@
+package slicesx_test
+
+import (
+	"strconv"
+	"testing"
+
+	"github.com/portainer/portainer/api/slicesx"
+)
+
+func Test_Map(t *testing.T) {
+	t.Parallel()
+	test(t, slicesx.Map, "Map integers to strings",
+		[]int{1, 2, 3, 4, 5},
+		[]string{"1", "2", "3", "4", "5"},
+		strconv.Itoa,
+	)
+	test(t, slicesx.Map, "Map strings to integers",
+		[]string{"1", "2", "3", "4", "5"},
+		[]int{1, 2, 3, 4, 5},
+		func(s string) int {
+			n, _ := strconv.Atoi(s)
+			return n
+		},
+	)
+}
+
+func Test_FlatMap(t *testing.T) {
+	t.Parallel()
+	test(t, slicesx.FlatMap, "Map integers to strings and flatten",
+		[]int{1, 2, 3, 4, 5},
+		[]string{"1", "1", "2", "2", "3", "3", "4", "4", "5", "5"},
+		func(i int) []string {
+			x := strconv.Itoa(i)
+			return []string{x, x}
+		},
+	)
+	test(t, slicesx.FlatMap, "Map strings to integers and flatten",
+		[]string{"1", "2", "3", "4", "5"},
+		[]int{1, 1, 2, 2, 3, 3, 4, 4, 5, 5},
+		func(s string) []int {
+			n, _ := strconv.Atoi(s)
+			return []int{n, n}
+		},
+	)
+}
diff --git a/api/slicesx/partition.go b/api/slicesx/partition.go
new file mode 100644
index 0000000..2ed834b
--- /dev/null
+++ b/api/slicesx/partition.go
@@ -0,0 +1,19 @@
+package slicesx
+
+// Split elements in two slices.
+// The first contains elements predicate returns truthy for
+// The second contains elements predicate returns falsey for
+// The predicate is invoked with one argument: (value).
+func Partition[T any](input []T, predicate func(T) bool) ([]T, []T) {
+	truthy := make([]T, 0)
+	falsey := make([]T, 0)
+
+	for i := range input {
+		if predicate(input[i]) {
+			truthy = append(truthy, input[i])
+		} else {
+			falsey = append(falsey, input[i])
+		}
+	}
+	return truthy, falsey
+}
diff --git a/api/slicesx/partition_test.go b/api/slicesx/partition_test.go
new file mode 100644
index 0000000..6e09146
--- /dev/null
+++ b/api/slicesx/partition_test.go
@@ -0,0 +1,32 @@
+package slicesx_test
+
+import (
+	"testing"
+
+	"github.com/portainer/portainer/api/slicesx"
+)
+
+func partition[T any](input []T, predicate func(T) bool) [2][]T {
+	left, right := slicesx.Partition(input, predicate)
+	return [2][]T{left, right}
+}
+
+func Test_Partition(t *testing.T) {
+	t.Parallel()
+
+	test(t, partition, "Partition even and odd",
+		[]int{1, 2, 3, 4, 5, 6, 7, 8, 9},
+		[2][]int{{2, 4, 6, 8}, {1, 3, 5, 7, 9}},
+		func(x int) bool { return x%2 == 0 },
+	)
+	test(t, partition, "Partition strings starting with 'A'",
+		[]string{"Apple", "Banana", "Avocado", "Grapes", "Apricot"},
+		[2][]string{{"Apple", "Avocado", "Apricot"}, {"Banana", "Grapes"}},
+		func(s string) bool { return s[0] == 'A' },
+	)
+	test(t, partition, "Partition strings longer than 5 chars",
+		[]string{"Apple", "Banana", "Avocado", "Grapes", "Apricot"},
+		[2][]string{{"Banana", "Avocado", "Grapes", "Apricot"}, {"Apple"}},
+		func(s string) bool { return len(s) > 5 },
+	)
+}
diff --git a/api/slicesx/slicesx_test.go b/api/slicesx/slicesx_test.go
new file mode 100644
index 0000000..1bb8a76
--- /dev/null
+++ b/api/slicesx/slicesx_test.go
@@ -0,0 +1,29 @@
+package slicesx_test
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+type libFunc[T, U, V any] func([]T, func(T) U) V
+type predicateFunc[T, U any] func(T) U
+
+func test[T, U, V any](t *testing.T, libFn libFunc[T, U, V], name string, input []T, expected V, predicate predicateFunc[T, U]) {
+	t.Helper()
+
+	t.Run(name, func(t *testing.T) {
+		is := assert.New(t)
+
+		result := libFn(input, predicate)
+
+		switch reflect.TypeOf(result).Kind() {
+		case reflect.Slice, reflect.Array:
+			is.Equal(expected, result)
+			is.ElementsMatch(expected, result)
+		default:
+			is.Equal(expected, result)
+		}
+	})
+}
diff --git a/api/slicesx/unique.go b/api/slicesx/unique.go
new file mode 100644
index 0000000..8659b07
--- /dev/null
+++ b/api/slicesx/unique.go
@@ -0,0 +1,21 @@
+package slicesx
+
+func Unique[T comparable](items []T) []T {
+	return UniqueBy(items, func(item T) T {
+		return item
+	})
+}
+
+func UniqueBy[ItemType any, ComparableType comparable](items []ItemType, accessorFunc func(ItemType) ComparableType) []ItemType {
+	includedItems := make(map[ComparableType]bool)
+	result := []ItemType{}
+
+	for _, item := range items {
+		if _, isIncluded := includedItems[accessorFunc(item)]; !isIncluded {
+			includedItems[accessorFunc(item)] = true
+			result = append(result, item)
+		}
+	}
+
+	return result
+}
diff --git a/api/slicesx/unique_test.go b/api/slicesx/unique_test.go
new file mode 100644
index 0000000..298465a
--- /dev/null
+++ b/api/slicesx/unique_test.go
@@ -0,0 +1,48 @@
+package slicesx_test
+
+import (
+	"testing"
+
+	"github.com/portainer/portainer/api/slicesx"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_Unique(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+	t.Run("Should extract unique numbers", func(t *testing.T) {
+
+		source := []int{1, 1, 2, 3, 4, 4, 5, 4, 6, 7, 8, 9, 1}
+		result := slicesx.Unique(source)
+		expected := []int{1, 2, 3, 4, 5, 6, 7, 8, 9}
+
+		is.ElementsMatch(result, expected)
+	})
+
+	t.Run("Should return empty array", func(t *testing.T) {
+		source := []int{}
+		result := slicesx.Unique(source)
+		expected := []int{}
+		is.ElementsMatch(result, expected)
+	})
+}
+
+func Test_UniqueBy(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+	t.Run("Should extract unique numbers by property", func(t *testing.T) {
+
+		source := []struct{ int }{{1}, {1}, {2}, {3}, {4}, {4}, {5}, {4}, {6}, {7}, {8}, {9}, {1}}
+		result := slicesx.UniqueBy(source, func(item struct{ int }) int { return item.int })
+		expected := []struct{ int }{{1}, {2}, {3}, {4}, {5}, {6}, {7}, {8}, {9}}
+
+		is.ElementsMatch(result, expected)
+	})
+
+	t.Run("Should return empty array", func(t *testing.T) {
+		source := []int{}
+		result := slicesx.UniqueBy(source, func(x int) int { return x })
+		expected := []int{}
+		is.ElementsMatch(result, expected)
+	})
+}
diff --git a/api/stacks/deployments/autoupdate.go b/api/stacks/deployments/autoupdate.go
new file mode 100644
index 0000000..b201691
--- /dev/null
+++ b/api/stacks/deployments/autoupdate.go
@@ -0,0 +1,36 @@
+package deployments
+
+import (
+	"context"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/scheduler"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+
+	"github.com/rs/zerolog/log"
+)
+
+func StartAutoupdate(ctx context.Context, stackID portainer.StackID, interval string, scheduler *scheduler.Scheduler, stackDeployer StackDeployer, datastore dataservices.DataStore, gitService portainer.GitService) (jobID string, e *httperror.HandlerError) {
+	d, err := time.ParseDuration(interval)
+	if err != nil {
+		return "", httperror.BadRequest("Unable to parse stack's auto update interval", err)
+	}
+
+	jobID = scheduler.StartJobEvery(d, func() error {
+		return RedeployWhenChanged(ctx, stackID, stackDeployer, datastore, gitService)
+	})
+
+	return jobID, nil
+}
+
+func StopAutoupdate(stackID portainer.StackID, jobID string, scheduler *scheduler.Scheduler) {
+	if jobID == "" {
+		return
+	}
+
+	if err := scheduler.StopJob(jobID); err != nil {
+		log.Warn().Int("stack_id", int(stackID)).Msg("could not stop the job for the stack")
+	}
+}
diff --git a/api/stacks/deployments/compose_unpacker_cmd_builder.go b/api/stacks/deployments/compose_unpacker_cmd_builder.go
new file mode 100644
index 0000000..f6b889d
--- /dev/null
+++ b/api/stacks/deployments/compose_unpacker_cmd_builder.go
@@ -0,0 +1,245 @@
+package deployments
+
+import (
+	"fmt"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	"github.com/portainer/portainer/api/internal/registryutils"
+)
+
+type StackRemoteOperation string
+
+const (
+	OperationDeploy        StackRemoteOperation = "compose-deploy"
+	OperationUndeploy      StackRemoteOperation = "compose-undeploy"
+	OperationComposeStart  StackRemoteOperation = "compose-start"
+	OperationComposeStop   StackRemoteOperation = "compose-stop"
+	OperationSwarmDeploy   StackRemoteOperation = "swarm-deploy"
+	OperationSwarmUndeploy StackRemoteOperation = "swarm-undeploy"
+	OperationSwarmStart    StackRemoteOperation = "swarm-start"
+	OperationSwarmStop     StackRemoteOperation = "swarm-stop"
+)
+
+const (
+	UnpackerCmdDeploy        = "deploy"
+	UnpackerCmdUndeploy      = "undeploy"
+	UnpackerCmdSwarmDeploy   = "swarm-deploy"
+	UnpackerCmdSwarmUndeploy = "swarm-undeploy"
+)
+
+type unpackerCmdBuilderOptions struct {
+	pullImage          bool
+	prune              bool
+	forceRecreate      bool
+	composeDestination string
+	registries         []portainer.Registry
+	gitConfig          *gittypes.RepoConfig
+}
+
+type buildCmdFunc func(stack *portainer.Stack, opts unpackerCmdBuilderOptions, registries []string, env []string) []string
+
+var funcmap = map[StackRemoteOperation]buildCmdFunc{
+	OperationDeploy:        buildDeployCmd,
+	OperationUndeploy:      buildUndeployCmd,
+	OperationComposeStart:  buildComposeStartCmd,
+	OperationComposeStop:   buildComposeStopCmd,
+	OperationSwarmDeploy:   buildSwarmDeployCmd,
+	OperationSwarmUndeploy: buildSwarmUndeployCmd,
+	OperationSwarmStart:    buildSwarmStartCmd,
+	OperationSwarmStop:     buildSwarmStopCmd,
+}
+
+// build the unpacker cmd for stack based on stackOperation
+func (d *stackDeployer) buildUnpackerCmdForStack(stack *portainer.Stack, operation StackRemoteOperation, opts unpackerCmdBuilderOptions) ([]string, error) {
+	fn := funcmap[operation]
+	if fn == nil {
+		return nil, fmt.Errorf("unknown stack operation %s", operation)
+	}
+
+	registriesStrings := generateRegistriesStrings(opts.registries, d.dataStore)
+	envStrings := getEnv(stack.Env)
+
+	return fn(stack, opts, registriesStrings, envStrings), nil
+}
+
+// deploy [-u username -p password] [--skip-tls-verify] [--force-recreate] [-r] [-k] [--env KEY1=VALUE1 --env KEY2=VALUE2] <git-repo-url> <ref> <project-name> <destination> <compose-file-path> [<more-file-paths>...]
+func buildDeployCmd(stack *portainer.Stack, opts unpackerCmdBuilderOptions, registries []string, env []string) []string {
+	cmd := []string{UnpackerCmdDeploy}
+	cmd = appendGitAuthIfNeeded(cmd, opts.gitConfig)
+	cmd = appendSkipTLSVerifyIfNeeded(cmd, opts.gitConfig)
+	cmd = appendForceRecreateIfNeeded(cmd, opts.forceRecreate)
+
+	if opts.prune {
+		cmd = append(cmd, "-r")
+	}
+
+	cmd = append(cmd, env...)
+	cmd = append(cmd, registries...)
+	cmd = append(cmd,
+		opts.gitConfig.URL,
+		opts.gitConfig.ReferenceName,
+		stack.Name,
+		opts.composeDestination,
+		stack.EntryPoint,
+	)
+
+	return append(cmd, stack.AdditionalFiles...)
+}
+
+// undeploy [-u username -p password] [-k] <git-repo-url> <project-name> <destination> <compose-file-path> [<more-file-paths>...]
+func buildUndeployCmd(stack *portainer.Stack, opts unpackerCmdBuilderOptions, registries []string, env []string) []string {
+	cmd := []string{UnpackerCmdUndeploy}
+	cmd = appendGitAuthIfNeeded(cmd, opts.gitConfig)
+	cmd = append(cmd, opts.gitConfig.URL,
+		stack.Name,
+		opts.composeDestination,
+		stack.EntryPoint,
+	)
+
+	return append(cmd, stack.AdditionalFiles...)
+}
+
+// deploy [-u username -p password] [--skip-tls-verify] [-k] [--env KEY1=VALUE1 --env KEY2=VALUE2] <git-repo-url> <project-name> <destination> <compose-file-path> [<more-file-paths>...]
+func buildComposeStartCmd(stack *portainer.Stack, opts unpackerCmdBuilderOptions, registries []string, env []string) []string {
+	cmd := []string{UnpackerCmdDeploy}
+	cmd = appendGitAuthIfNeeded(cmd, opts.gitConfig)
+	cmd = appendSkipTLSVerifyIfNeeded(cmd, opts.gitConfig)
+	cmd = append(cmd, "-k")
+	cmd = append(cmd, env...)
+	cmd = append(cmd, registries...)
+	cmd = append(cmd, opts.gitConfig.URL,
+		opts.gitConfig.ReferenceName,
+		stack.Name,
+		opts.composeDestination,
+		stack.EntryPoint,
+	)
+
+	return append(cmd, stack.AdditionalFiles...)
+}
+
+// undeploy [-u username -p password] [-k] <git-repo-url> <project-name> <destination> <compose-file-path> [<more-file-paths>...]
+func buildComposeStopCmd(stack *portainer.Stack, opts unpackerCmdBuilderOptions, registries []string, env []string) []string {
+	cmd := []string{UnpackerCmdUndeploy}
+	cmd = appendGitAuthIfNeeded(cmd, opts.gitConfig)
+	cmd = append(cmd,
+		"-k",
+		opts.gitConfig.URL,
+		stack.Name,
+		opts.composeDestination,
+		stack.EntryPoint,
+	)
+
+	return append(cmd, stack.AdditionalFiles...)
+}
+
+// swarm-deploy [-u username -p password] [--skip-tls-verify] [--force-recreate] [-f] [-r] [-k] [--env KEY1=VALUE1 --env KEY2=VALUE2] <git-repo-url> <git-ref> <project-name> <destination> <compose-file-path> [<more-file-paths>...]
+func buildSwarmDeployCmd(stack *portainer.Stack, opts unpackerCmdBuilderOptions, registries []string, env []string) []string {
+	cmd := []string{UnpackerCmdSwarmDeploy}
+	cmd = appendGitAuthIfNeeded(cmd, opts.gitConfig)
+	cmd = appendSkipTLSVerifyIfNeeded(cmd, opts.gitConfig)
+	cmd = appendForceRecreateIfNeeded(cmd, opts.forceRecreate)
+	if opts.pullImage {
+		cmd = append(cmd, "-f")
+	}
+
+	if opts.prune {
+		cmd = append(cmd, "-r")
+	}
+
+	cmd = append(cmd, env...)
+	cmd = append(cmd, registries...)
+	cmd = append(cmd, opts.gitConfig.URL,
+		opts.gitConfig.ReferenceName,
+		stack.Name,
+		opts.composeDestination,
+		stack.EntryPoint,
+	)
+
+	return append(cmd, stack.AdditionalFiles...)
+}
+
+// swarm-undeploy [-k] <project-name> <destination>
+func buildSwarmUndeployCmd(stack *portainer.Stack, opts unpackerCmdBuilderOptions, registries []string, env []string) []string {
+	return []string{UnpackerCmdSwarmUndeploy, stack.Name, opts.composeDestination}
+}
+
+// swarm-deploy [-u username -p password] [-f] [-r] [-k] [--skip-tls-verify] [--env KEY1=VALUE1 --env KEY2=VALUE2] <git-repo-url> <project-name> <destination> <compose-file-path> [<more-file-paths>...]
+func buildSwarmStartCmd(stack *portainer.Stack, opts unpackerCmdBuilderOptions, registries []string, env []string) []string {
+	cmd := []string{UnpackerCmdSwarmDeploy, "-f", "-r", "-k"}
+	cmd = appendSkipTLSVerifyIfNeeded(cmd, opts.gitConfig)
+	cmd = append(cmd, getEnv(stack.Env)...)
+	cmd = append(cmd, registries...)
+	cmd = append(cmd, opts.gitConfig.URL,
+		opts.gitConfig.ReferenceName,
+		stack.Name,
+		opts.composeDestination,
+		stack.EntryPoint,
+	)
+
+	return append(cmd, stack.AdditionalFiles...)
+}
+
+// swarm-undeploy [-k] <project-name> <destination>
+func buildSwarmStopCmd(stack *portainer.Stack, opts unpackerCmdBuilderOptions, registries []string, env []string) []string {
+	return []string{UnpackerCmdSwarmUndeploy, "-k", stack.Name, opts.composeDestination}
+}
+
+func appendGitAuthIfNeeded(cmd []string, gc *gittypes.RepoConfig) []string {
+	if gc == nil || gc.Authentication == nil || gc.Authentication.Password == "" {
+		return cmd
+	}
+
+	return append(cmd, "-u", gc.Authentication.Username, "-p", gc.Authentication.Password)
+}
+
+func appendSkipTLSVerifyIfNeeded(cmd []string, gc *gittypes.RepoConfig) []string {
+	if gc == nil || !gc.TLSSkipVerify {
+		return cmd
+	}
+
+	return append(cmd, "--skip-tls-verify")
+}
+
+func appendForceRecreateIfNeeded(cmd []string, forceRecreate bool) []string {
+	if forceRecreate {
+		cmd = append(cmd, "--force-recreate")
+	}
+
+	return cmd
+}
+
+func generateRegistriesStrings(registries []portainer.Registry, dataStore dataservices.DataStore) []string {
+	cmds := []string{}
+
+	for _, registry := range registries {
+		if registry.Authentication {
+			if err := registryutils.EnsureRegTokenValid(dataStore, &registry); err != nil {
+				continue
+			}
+
+			username, password, err := registryutils.GetRegEffectiveCredential(&registry)
+			if err != nil {
+				continue
+			}
+
+			cmds = append(cmds, fmt.Sprintf("--registry=%s:%s:%s", username, password, registry.URL))
+		}
+	}
+
+	return cmds
+}
+
+func getEnv(env []portainer.Pair) []string {
+	if len(env) == 0 {
+		return nil
+	}
+
+	cmd := []string{}
+	for _, pair := range env {
+		cmd = append(cmd, fmt.Sprintf(`--env=%s=%s`, pair.Name, pair.Value))
+	}
+
+	return cmd
+}
diff --git a/api/stacks/deployments/deploy.go b/api/stacks/deployments/deploy.go
new file mode 100644
index 0000000..1462d05
--- /dev/null
+++ b/api/stacks/deployments/deploy.go
@@ -0,0 +1,304 @@
+package deployments
+
+import (
+	"cmp"
+	"context"
+	"fmt"
+	"strconv"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/agent"
+	"github.com/portainer/portainer/api/crypto"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/dataservices/source"
+	"github.com/portainer/portainer/api/git/update"
+	"github.com/portainer/portainer/api/gitops/workflows"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/scheduler"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+
+	"github.com/pkg/errors"
+	"github.com/rs/zerolog/log"
+	"golang.org/x/sync/singleflight"
+)
+
+type StackAuthorMissingErr struct {
+	stackID    int
+	authorName string
+}
+
+func (e *StackAuthorMissingErr) Error() string {
+	return fmt.Sprintf("stack's %v author %s is missing", e.stackID, e.authorName)
+}
+
+var singleflightGroup = &singleflight.Group{}
+
+// RedeployWhenChanged pull and redeploy the stack when git repo changed
+// Stack will always be redeployed if force deployment is set to true
+func RedeployWhenChanged(ctx context.Context, stackID portainer.StackID, deployer StackDeployer, datastore dataservices.DataStore, gitService portainer.GitService) error {
+	stack, err := datastore.Stack().Read(stackID)
+	if dataservices.IsErrObjectNotFound(err) {
+		return scheduler.NewPermanentError(errors.WithMessagef(err, "failed to get the stack %v", stackID))
+	} else if err != nil {
+		return errors.WithMessagef(err, "failed to get the stack %v", stackID)
+	}
+
+	// Webhook
+	if stack.AutoUpdate != nil && stack.AutoUpdate.Webhook != "" {
+		return redeployWhenChanged(ctx, stack, deployer, datastore, gitService, true)
+	}
+
+	// Polling
+	_, err, _ = singleflightGroup.Do(strconv.Itoa(int(stackID)), func() (any, error) {
+		return nil, redeployWhenChanged(ctx, stack, deployer, datastore, gitService, false)
+	})
+
+	return err
+}
+
+func redeployWhenChanged(ctx context.Context, stack *portainer.Stack, deployer StackDeployer, datastore dataservices.DataStore, gitService portainer.GitService, webhook bool) error {
+	log.Debug().Int("stack_id", int(stack.ID)).Msg("redeploying stack")
+
+	if stack.WorkflowID == 0 {
+		return nil // do nothing if it isn't a git-based stack
+	}
+
+	endpoint, err := datastore.Endpoint().Endpoint(stack.EndpointID)
+	if dataservices.IsErrObjectNotFound(err) {
+		return scheduler.NewPermanentError(
+			errors.WithMessagef(err,
+				"failed to find the environment %v associated to the stack %v",
+				stack.EndpointID,
+				stack.ID,
+			),
+		)
+	} else if err != nil {
+		return errors.WithMessagef(err, "failed to find the environment %v associated to the stack %v", stack.EndpointID, stack.ID)
+	}
+
+	author := cmp.Or(stack.UpdatedBy, stack.CreatedBy)
+
+	user, err := datastore.User().UserByUsername(author)
+	if err != nil {
+		log.Warn().
+			Int("stack_id", int(stack.ID)).
+			Str("stack", stack.Name).
+			Str("author", author).
+			Int("endpoint_id", int(stack.EndpointID)).
+			Msg("cannot auto update a stack, stack author user is missing")
+
+		return &StackAuthorMissingErr{int(stack.ID), author}
+	}
+
+	if !isEnvironmentOnline(endpoint) {
+		return nil
+	}
+
+	if webhook {
+		go func() {
+			if err := redeployWhenChangedSecondStage(ctx, stack, deployer, datastore, gitService, user, endpoint); err != nil {
+				log.Error().Err(err).
+					Int("stack_id", int(stack.ID)).
+					Str("stack", stack.Name).
+					Str("author", author).
+					Int("endpoint_id", int(stack.EndpointID)).
+					Msg("webhook failed to redeploy a stack")
+			}
+		}()
+
+		return nil
+	}
+
+	return redeployWhenChangedSecondStage(ctx, stack, deployer, datastore, gitService, user, endpoint)
+}
+
+func redeployWhenChangedSecondStage(
+	ctx context.Context,
+	stack *portainer.Stack,
+	deployer StackDeployer,
+	datastore dataservices.DataStore,
+	gitService portainer.GitService,
+	user *portainer.User,
+	endpoint *portainer.Endpoint,
+) error {
+	var teamMemberships []portainer.TeamMembership
+	if err := datastore.ViewTx(func(tx dataservices.DataStoreTx) error {
+		var err error
+		teamMemberships, err = tx.TeamMembership().TeamMembershipsByUserID(user.ID)
+		return err
+	}); err != nil {
+		return err
+	}
+
+	userContext := source.NewUserContext(user, teamMemberships)
+	gitSrc, file, err := workflows.GitSourceAndArtifactForStack(datastore, userContext, stack.WorkflowID, stack.ID)
+	if err != nil {
+		return errors.WithMessagef(err, "failed to load git config for stack %v", stack.ID)
+	}
+
+	if gitSrc == nil {
+		return nil
+	}
+
+	gitConfig := workflows.MergeSourceAndFile(gitSrc, file)
+
+	var gitCommitChangedOrForceUpdate bool
+
+	if !stack.FromAppTemplate {
+		updated, newHash, err := update.UpdateGitObject(ctx, gitService, fmt.Sprintf("stack:%d", stack.ID), gitConfig, false, stack.ProjectPath)
+		if err != nil {
+			if txErr := datastore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+				return workflows.SaveStackStatus(tx, userContext, stack.WorkflowID, stack.ID, gitSrc.ID, err)
+			}); txErr != nil {
+				return fmt.Errorf("git check failed for stack %d: %w (and failed to persist status: %w)", stack.ID, err, txErr)
+			}
+
+			return err
+		}
+
+		if txErr := datastore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+			return workflows.SaveStackStatus(tx, userContext, stack.WorkflowID, stack.ID, gitSrc.ID, nil)
+		}); txErr != nil {
+			return fmt.Errorf("failed to persist git sync status for stack %d: %w", stack.ID, txErr)
+		}
+
+		if updated {
+			gitConfig.ConfigHash = newHash
+
+			stack.UpdateDate = time.Now().Unix()
+			gitCommitChangedOrForceUpdate = updated
+		}
+
+		if stack.AutoUpdate != nil && stack.AutoUpdate.ForceUpdate {
+			gitCommitChangedOrForceUpdate = true
+		}
+	}
+
+	if !gitCommitChangedOrForceUpdate {
+		return nil
+	}
+
+	if err := datastore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		stackutils.PrepareStackStatusForDeployment(stack)
+		return tx.Stack().Update(stack.ID, stack)
+	}); err != nil {
+		return errors.WithMessagef(err, "failed to set the deploying status for stack %v", stack.ID)
+	}
+
+	stack.CurrentDeploymentInfo = &portainer.StackDeploymentInfo{
+		RepositoryURL:   gitConfig.URL,
+		ReferenceName:   gitConfig.ReferenceName,
+		ConfigFilePath:  gitConfig.ConfigFilePath,
+		AdditionalFiles: stack.AdditionalFiles,
+		ConfigHash:      gitConfig.ConfigHash,
+		SourceID:        gitSrc.ID,
+	}
+
+	registries, err := getUserRegistries(datastore, user, endpoint.ID)
+	if dataservices.IsErrObjectNotFound(err) {
+		return scheduler.NewPermanentError(err)
+	} else if err != nil {
+		return err
+	}
+
+	redeployStack := func(stack *portainer.Stack) error {
+		var err error
+		switch stack.Type {
+		case portainer.DockerComposeStack:
+			if stackutils.IsRelativePathStack(stack) {
+				err = deployer.DeployRemoteComposeStack(ctx, user.ID, stack, endpoint, registries, true, true, false)
+			} else {
+				err = deployer.DeployComposeStack(ctx, stack, endpoint, registries, true, true, false)
+			}
+
+			if err != nil {
+				return errors.WithMessagef(err, "failed to deploy a docker compose stack %v", stack.ID)
+			}
+		case portainer.DockerSwarmStack:
+			if stackutils.IsRelativePathStack(stack) {
+				err = deployer.DeployRemoteSwarmStack(ctx, user.ID, stack, endpoint, registries, true, true)
+			} else {
+				err = deployer.DeploySwarmStack(ctx, stack, endpoint, registries, true, true)
+			}
+			if err != nil {
+				return errors.WithMessagef(err, "failed to deploy a docker compose stack %v", stack.ID)
+			}
+		case portainer.KubernetesStack:
+			log.Debug().Int("stack_id", int(stack.ID)).Msg("deploying a kube app")
+
+			if err := deployer.DeployKubernetesStack(ctx, stack, endpoint, user); err != nil {
+				return errors.WithMessagef(err, "failed to deploy a kubernetes app stack %v", stack.ID)
+			}
+		default:
+			return errors.Errorf("cannot update stack, type %v is unsupported", stack.Type)
+		}
+
+		return nil
+	}
+
+	deployErr := redeployStack(stack)
+
+	if err := datastore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		stack.UpdateDate = time.Now().Unix()
+
+		stackutils.UpdateStackStatusFromDeploymentResult(stack, deployErr)
+		if err := tx.Stack().Update(stack.ID, stack); err != nil {
+			return err
+		}
+
+		newHash := gitConfig.ConfigHash
+
+		return workflows.UpdateArtifactFileForStack(tx, stack.WorkflowID, stack.ID, gitSrc.ID, func(a *portainer.ArtifactFile) {
+			a.Hash = newHash
+			a.RefStatus = portainer.SourceStatusHealthy
+			a.RefError = ""
+			a.PathStatus = portainer.SourceStatusHealthy
+			a.PathError = ""
+		})
+	}); err != nil {
+		return errors.WithMessagef(err, "failed to update the stack %v", stack.ID)
+	}
+
+	return nil
+}
+
+func getUserRegistries(datastore dataservices.DataStore, user *portainer.User, endpointID portainer.EndpointID) ([]portainer.Registry, error) {
+	registries, err := datastore.Registry().ReadAll()
+	if err != nil {
+		return nil, errors.WithMessage(err, "unable to retrieve registries from the database")
+	}
+
+	if user.Role == portainer.AdministratorRole {
+		return registries, nil
+	}
+
+	userMemberships, err := datastore.TeamMembership().TeamMembershipsByUserID(user.ID)
+	if err != nil {
+		return nil, errors.WithMessagef(err, "failed to fetch memberships of the stack author [%s]", user.Username)
+	}
+
+	filteredRegistries := make([]portainer.Registry, 0, len(registries))
+	for _, registry := range registries {
+		if security.AuthorizedRegistryAccess(&registry, user, userMemberships, endpointID) {
+			filteredRegistries = append(filteredRegistries, registry)
+		}
+	}
+
+	return filteredRegistries, nil
+}
+
+func isEnvironmentOnline(endpoint *portainer.Endpoint) bool {
+	if endpoint.Type != portainer.AgentOnDockerEnvironment &&
+		endpoint.Type != portainer.AgentOnKubernetesEnvironment {
+		return true
+	}
+
+	tlsConfig, err := crypto.CreateTLSConfigurationFromDisk(endpoint.TLSConfig)
+	if err != nil {
+		return false
+	}
+
+	_, _, err = agent.GetAgentVersionAndPlatform(endpoint.URL, tlsConfig)
+	return err == nil
+}
diff --git a/api/stacks/deployments/deploy_test.go b/api/stacks/deployments/deploy_test.go
new file mode 100644
index 0000000..488e98d
--- /dev/null
+++ b/api/stacks/deployments/deploy_test.go
@@ -0,0 +1,434 @@
+package deployments
+
+import (
+	"context"
+	"crypto/tls"
+	"errors"
+	"net/http"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/crypto"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/dataservices/source"
+	"github.com/portainer/portainer/api/datastore"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+	"github.com/portainer/portainer/pkg/fips"
+	"github.com/portainer/portainer/pkg/libhttp/response"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const localhostCert = `-----BEGIN CERTIFICATE-----
+MIIEOjCCAiKgAwIBAgIRALg8rJET2/9LjKSxHj0dQhYwDQYJKoZIhvcNAQELBQAw
+FzEVMBMGA1UEAxMMUG9ydGFpbmVyIENBMB4XDTIzMTAxMTE5NDcxMVoXDTI1MDQx
+MTE5NTM0MVowFDESMBAGA1UEAxMJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEAx4nNGiwcCqUCxZyVLIHqvjTy20ZtZDVCedssTv1W5tmz
+YqOIYGaW3CqzlRn6vBHu9bMHXef4+XfS0igKBn76MAKn5IcTccIWIal+5jq48pI3
+c2FzQ3qNujX2zqZPjAjhJnVeVCP3kJu4wUtuubswLPBVLdktGa6EkL+8nu6o0Phw
+6scV6s3gUmQk5/lpH4FIff8M7NAdTOxiFImQ1M0vplKtaEeiCnskpgyI8CbZl7X0
+38Pu178W3+LqB7N4iMy2gKnBwjsXzw/+1dfUGkKjYdDBD+kNEKrQ4dwkjkrkQVdt
+Z+GN26NvXHoeeyX/MLnVgdLbiIjvsf0DDIhabKqTcwIDAQABo4GDMIGAMA4GA1Ud
+DwEB/wQEAwIDuDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwHQYDVR0O
+BBYEFPCefmK5Szzlfs8FRCa5+kRCIEWuMB8GA1UdIwQYMBaAFKZZ074SR/ajD3zE
+gxpLGRvFT3XAMA8GA1UdEQQIMAaHBH8AAAEwDQYJKoZIhvcNAQELBQADggIBABcQ
+/WPSUpuQvrcVBsmIlOMz74cDZYuIDls/mAcB/yP3mm+oWlO0qvH/F/BMs1P/bkgj
+fByQZq8Zmi6/TEZNlGvW7KGx077VxDKi8jd1jL3gLDPmkFjYuGeIWQusgxBu1y3m
+0WoTTqnkoism1mzV/dgNwrm3YQIV4H/fi9EEdQSm0UFRTKSAGBkwS7N2pmNb5yQO
+U8glFpyznCv4evDJbs/JUUXKYExgFFhWUd25P7iBRLXg/BFfqdSTiUGUj/Msz0pO
+Evqmq78eIiXjyyKSxzve6/mEIeq6AE3AC9zH+fwTd6Mhp+T2P/S/iO4EU19IMR4m
+sbNBd6h/3GvRekO1KbqQ42awuMnxvWT0NVclSxiU1lMpAmRmk/w9z7wB3r4n7oh4
+iiOTl5VSw1UBkcLDOJw+HB/FU2PdVFfIJKRfjLCZOGrcJX9vEcz7dYGpB5HrdqOc
+/8q5j1g6f/pGE+20HITrtz6ChguETzqw5dLNeKeolC6bVH8yEtmpnP2n8VPnT9Di
+V+hnONcJ+wd/dkBqabGr7LPG24Kj1F2Zp3CDDvJA94FaEsgaLfSg3JD+43uRCOWM
+RuqU8bGuhQRqilR2dSIOrFaW2+MeUHsb24cUn/pkHqKpSg+RBEnf6QfGDlIgqYEl
+19f/HFVBc/a8lM/D81lMyDbjQ9zH4LDYj4ipBbkL
+-----END CERTIFICATE-----`
+
+const localhostKey = `-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAx4nNGiwcCqUCxZyVLIHqvjTy20ZtZDVCedssTv1W5tmzYqOI
+YGaW3CqzlRn6vBHu9bMHXef4+XfS0igKBn76MAKn5IcTccIWIal+5jq48pI3c2Fz
+Q3qNujX2zqZPjAjhJnVeVCP3kJu4wUtuubswLPBVLdktGa6EkL+8nu6o0Phw6scV
+6s3gUmQk5/lpH4FIff8M7NAdTOxiFImQ1M0vplKtaEeiCnskpgyI8CbZl7X038Pu
+178W3+LqB7N4iMy2gKnBwjsXzw/+1dfUGkKjYdDBD+kNEKrQ4dwkjkrkQVdtZ+GN
+26NvXHoeeyX/MLnVgdLbiIjvsf0DDIhabKqTcwIDAQABAoIBAQCqSP6BPG195A52
+iEeCISksw9ERsou+fflKNvIcQvV7swP0xOyooERUhhiVwQMKpx9QDUXXLRV8CHch
+JExR+OEYQdv4GhJM/b6XYafLYQfe80thKyQLzTXQWSdUeffe4OEMShODKOKoRUyp
+oO9Qj9/wKfX3V6S2iwnU4dxdofztv+YP9rYQyjnhKbv/9OfeCp2Pb9eFKKRsA+QQ
+xneDz1+wr8ToTuiTn8HBPNSeSAKvhzXuzyluI7VAetRloNgCtumrA9kpVbW2cDgE
+Gk0q3RY125ejFELQO/cOJFuBsqoJlvPxzg8/vHyfyF9hFMqbqvcUw2e1eqHpnJd5
+dP4+ZGYZAoGBAOOFuPXMLBts0rN9mfNbVfx36H+aOCL77SafZvWm0D+rH69QN3/q
+/ZSWQEjwH5Tzn1e+NVcl/Um2vL/dIyEGBklXQ7yAyJo25gpEOD/rt1U94HKzMOwy
+yKtsKghRAOx0piie7ORS6MGbEOQxU3/1Eg1uvd0qoSnALqJ/le75QpFXAoGBAOCD
+aZQTszzDddr1cFPzLyqjIGJWfPcDYSONXVcCeQmhvC7mkfw9SWdIfku7JbdNgFYq
+ZAAU0klsLX0lEe8f4A12FnHNylKoxmTWdE3wWPptejdA1KUgzt/2kNljgOMFuY0Q
+rlCEW/Jabrg5aFMwVVG8bHLZR0xalfniDvXLvnFFAoGACdztJLKiIto31BIYz2Th
+OF2WVZnA3ztej3MPioydsHThnb7zePcd4QgWZ1MJe3KIMMyNEWcTMNPcINEcSb0y
+HpHK3OwURiMlG8LTUWoNe4OALFi6QTL+YfgBZnTkflucLFyfVlKFxobLV6kPvpdI
+Hg7z6heD/wRWwTKYtFBX42cCgYBIeoQJ9rYlRqB0eEm0AEzYweLBfFRJVgD0/j0E
+ytqSPnFG3s6AFLTur9t9zUPmwhFNP9Aaqp4cb9zbiq0YejzVe6rRQHMxbiTmBslz
+I8VFyzPqRHahfE7sxGeMlm/UWlPFc34ipigcvA8EUBwaxv60LVUBWp2Gy7OhANZ9
+iTHI1QKBgQCdHFj9dnbpaEHA426CoaPsyj5cv2nBLRf8p1cs71sq+qQOGlGJfajm
+L9x22ol5c5rToZa1qKSnSdSDCud298MyRujMUy2UcUKHeNs3MK9AT41sDv266I7b
+vJUUCFYm8+9p6gTVOcoMit+eGSwa81PCPEs1TnU1PV/PaDFeUhn/mg==
+-----END RSA PRIVATE KEY-----`
+
+var adminUserContext = source.InsecureNewAdminContext()
+
+type noopDeployer struct{}
+
+// without unpacker
+func (s noopDeployer) DeploySwarmStack(_ context.Context, stack *portainer.Stack, endpoint *portainer.Endpoint, registries []portainer.Registry, prune, pullImage bool) error {
+	return nil
+}
+
+func (s noopDeployer) DeployComposeStack(_ context.Context, stack *portainer.Stack, endpoint *portainer.Endpoint, registries []portainer.Registry, prune, forcePullImage, forceRecreate bool) error {
+	return nil
+}
+
+func (s noopDeployer) UndeployComposeStack(_ context.Context, stack *portainer.Stack, endpoint *portainer.Endpoint) error {
+	return nil
+}
+
+func (s noopDeployer) DeployKubernetesStack(_ context.Context, stack *portainer.Stack, endpoint *portainer.Endpoint, user *portainer.User) error {
+	return nil
+}
+
+// with unpacker
+func (s noopDeployer) DeployRemoteComposeStack(_ context.Context, userId portainer.UserID, stack *portainer.Stack, endpoint *portainer.Endpoint, registries []portainer.Registry, prune, forcePullImage, forceRecreate bool) error {
+	return nil
+}
+func (s noopDeployer) UndeployRemoteComposeStack(_ context.Context, userId portainer.UserID, stack *portainer.Stack, endpoint *portainer.Endpoint) error {
+	return nil
+}
+func (s noopDeployer) StartRemoteComposeStack(_ context.Context, userId portainer.UserID, stack *portainer.Stack, endpoint *portainer.Endpoint, registries []portainer.Registry) error {
+	return nil
+}
+func (s noopDeployer) StopRemoteComposeStack(_ context.Context, userId portainer.UserID, stack *portainer.Stack, endpoint *portainer.Endpoint) error {
+	return nil
+}
+func (s noopDeployer) DeployRemoteSwarmStack(_ context.Context, userId portainer.UserID, stack *portainer.Stack, endpoint *portainer.Endpoint, registries []portainer.Registry, prune, pullImage bool) error {
+	return nil
+}
+func (s noopDeployer) UndeployRemoteSwarmStack(_ context.Context, userId portainer.UserID, stack *portainer.Stack, endpoint *portainer.Endpoint) error {
+	return nil
+}
+func (s noopDeployer) StartRemoteSwarmStack(_ context.Context, userId portainer.UserID, stack *portainer.Stack, endpoint *portainer.Endpoint, registries []portainer.Registry) error {
+	return nil
+}
+func (s noopDeployer) StopRemoteSwarmStack(_ context.Context, userId portainer.UserID, stack *portainer.Stack, endpoint *portainer.Endpoint) error {
+	return nil
+}
+
+func agentServer(t *testing.T) string {
+	h := http.NewServeMux()
+
+	h.HandleFunc("/ping", func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set(portainer.PortainerAgentHeader, "v2.19.0")
+		w.Header().Set(portainer.HTTPResponseAgentPlatform, strconv.Itoa(int(portainer.AgentPlatformDocker)))
+
+		_ = response.Empty(w)
+	})
+
+	cert, err := tls.X509KeyPair([]byte(localhostCert), []byte(localhostKey))
+	require.NoError(t, err)
+
+	tlsConfig := crypto.CreateTLSConfiguration(false)
+	tlsConfig.Certificates = []tls.Certificate{cert}
+
+	l, err := tls.Listen("tcp", "127.0.0.1:0", tlsConfig)
+	require.NoError(t, err)
+
+	s := &http.Server{
+		Handler: h,
+	}
+
+	errCh := make(chan error)
+	go func() {
+		errCh <- s.Serve(l)
+	}()
+
+	t.Cleanup(func() {
+		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		defer cancel()
+
+		require.NoError(t, s.Shutdown(ctx))
+		require.ErrorIs(t, <-errCh, http.ErrServerClosed)
+	})
+
+	return "http://" + l.Addr().String()
+}
+
+func Test_redeployWhenChanged_FailsWhenCannotFindStack(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	err := RedeployWhenChanged(t.Context(), 1, nil, store, nil)
+	require.Error(t, err)
+	assert.Truef(t, strings.HasPrefix(err.Error(), "failed to get the stack"), "it isn't an error we expected: %v", err.Error())
+}
+
+func Test_redeployWhenChanged_DoesNothingWhenNotAGitBasedStack(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	admin := &portainer.User{ID: 1, Username: "admin"}
+	err := store.User().Create(admin)
+	require.NoError(t, err, "error creating an admin")
+
+	err = store.Stack().Create(&portainer.Stack{ID: 1, CreatedBy: "admin"})
+	require.NoError(t, err, "failed to create a test stack")
+
+	err = RedeployWhenChanged(t.Context(), 1, nil, store, testhelpers.NewGitService(nil, ""))
+	require.NoError(t, err)
+}
+
+func Test_redeployWhenChanged_DoesNothingWhenNoGitChanges(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	tmpDir := t.TempDir()
+
+	admin := &portainer.User{ID: 1, Username: "admin", Role: portainer.AdministratorRole}
+	err := store.User().Create(admin)
+	require.NoError(t, err, "error creating an admin")
+
+	err = store.Endpoint().Create(&portainer.Endpoint{ID: 0})
+	require.NoError(t, err, "error creating environment")
+
+	src := &portainer.Source{
+		Type: portainer.SourceTypeGit,
+		Git: &gittypes.GitSource{
+			URL: "url",
+		},
+	}
+	err = store.Source().Create(adminUserContext, src)
+	require.NoError(t, err, "failed to create source")
+
+	wf := &portainer.Workflow{Artifacts: []portainer.Artifact{{StackID: 1, Files: []portainer.ArtifactFile{{SourceID: src.ID}}}}}
+	err = store.Workflow().Create(wf)
+	require.NoError(t, err, "failed to create workflow")
+
+	err = store.Stack().Create(&portainer.Stack{
+		ID:          1,
+		CreatedBy:   "admin",
+		ProjectPath: tmpDir,
+		WorkflowID:  wf.ID,
+	})
+	require.NoError(t, err, "failed to create a test stack")
+
+	err = RedeployWhenChanged(t.Context(), 1, nil, store, testhelpers.NewGitService(nil, "oldHash"))
+	require.NoError(t, err)
+
+	updatedSrc, err := store.Source().Read(adminUserContext, src.ID)
+	require.NoError(t, err)
+	require.Equal(t, portainer.SourceStatusHealthy, updatedSrc.Status)
+	require.Empty(t, updatedSrc.StatusError)
+	require.NotZero(t, updatedSrc.LastSync)
+}
+
+func Test_redeployWhenChanged_FailsWhenCannotClone(t *testing.T) {
+	fips.InitFIPS(false)
+
+	cloneErr := errors.New("failed to clone")
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	admin := &portainer.User{ID: 1, Username: "admin", Role: portainer.AdministratorRole}
+	err := store.User().Create(admin)
+	require.NoError(t, err, "error creating an admin")
+
+	err = store.Endpoint().Create(&portainer.Endpoint{
+		ID:  0,
+		URL: agentServer(t),
+		TLSConfig: portainer.TLSConfiguration{
+			TLS:           true,
+			TLSSkipVerify: true,
+		},
+	})
+	require.NoError(t, err, "error creating environment")
+
+	src := &portainer.Source{
+		Type: portainer.SourceTypeGit,
+		Git: &gittypes.GitSource{
+			URL: "url",
+		},
+	}
+	err = store.Source().Create(adminUserContext, src)
+	require.NoError(t, err, "failed to create source")
+
+	wf := &portainer.Workflow{Artifacts: []portainer.Artifact{{
+		StackID: 1,
+		Files:   []portainer.ArtifactFile{{SourceID: src.ID}},
+	}}}
+	err = store.Workflow().Create(wf)
+	require.NoError(t, err, "failed to create workflow")
+
+	err = store.Stack().Create(&portainer.Stack{
+		ID:         1,
+		CreatedBy:  "admin",
+		WorkflowID: wf.ID,
+	})
+	require.NoError(t, err, "failed to create a test stack")
+
+	err = RedeployWhenChanged(t.Context(), 1, nil, store, testhelpers.NewGitService(cloneErr, "newHash"))
+	require.Error(t, err)
+	require.ErrorIs(t, err, cloneErr, "should failed to clone but didn't, check test setup")
+
+	updatedSrc, err := store.Source().Read(adminUserContext, src.ID)
+	require.NoError(t, err)
+	require.Equal(t, portainer.SourceStatusError, updatedSrc.Status)
+	require.Contains(t, updatedSrc.StatusError, cloneErr.Error())
+	require.Zero(t, updatedSrc.LastSync)
+}
+
+func setupRedeployStore(t *testing.T, stackType portainer.StackType) (dataservices.DataStore, portainer.StackID) {
+	t.Helper()
+
+	_, store := datastore.MustNewTestStore(t, false, true)
+	tmpDir := t.TempDir()
+
+	err := store.Endpoint().Create(&portainer.Endpoint{ID: 1})
+	require.NoError(t, err, "error creating environment")
+
+	username := "user"
+	err = store.User().Create(&portainer.User{Username: username, Role: portainer.AdministratorRole})
+	require.NoError(t, err, "error creating a user")
+
+	src := &portainer.Source{
+		Type: portainer.SourceTypeGit,
+		Git: &gittypes.GitSource{
+			URL: "url",
+		},
+	}
+	err = store.Source().Create(adminUserContext, src)
+	require.NoError(t, err, "failed to create source")
+
+	wf := &portainer.Workflow{Artifacts: []portainer.Artifact{{Files: []portainer.ArtifactFile{{SourceID: src.ID}}}}}
+	err = store.Workflow().Create(wf)
+	require.NoError(t, err, "failed to create workflow")
+
+	const stackID portainer.StackID = 1
+
+	err = store.Stack().Create(&portainer.Stack{
+		ID:          stackID,
+		EndpointID:  1,
+		ProjectPath: tmpDir,
+		UpdatedBy:   username,
+		WorkflowID:  wf.ID,
+		Type:        stackType,
+	})
+	require.NoError(t, err, "failed to create a test stack")
+
+	return store, stackID
+}
+
+func Test_redeployWhenChanged_DockerComposeStack(t *testing.T) {
+	t.Parallel()
+
+	store, stackID := setupRedeployStore(t, portainer.DockerComposeStack)
+
+	err := RedeployWhenChanged(t.Context(), stackID, noopDeployer{}, store, testhelpers.NewGitService(nil, "newHash"))
+	require.NoError(t, err)
+}
+
+func Test_redeployWhenChanged_DockerSwarmStack(t *testing.T) {
+	t.Parallel()
+
+	store, stackID := setupRedeployStore(t, portainer.DockerSwarmStack)
+
+	err := RedeployWhenChanged(t.Context(), stackID, noopDeployer{}, store, testhelpers.NewGitService(nil, "newHash"))
+	require.NoError(t, err)
+}
+
+func Test_redeployWhenChanged_KubernetesStack(t *testing.T) {
+	t.Parallel()
+
+	store, stackID := setupRedeployStore(t, portainer.KubernetesStack)
+
+	err := RedeployWhenChanged(t.Context(), stackID, noopDeployer{}, store, testhelpers.NewGitService(nil, "newHash"))
+	require.NoError(t, err)
+}
+
+func Test_getUserRegistries(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	endpointID := 123
+
+	admin := &portainer.User{ID: 1, Username: "admin", Role: portainer.AdministratorRole}
+	err := store.User().Create(admin)
+	require.NoError(t, err, "error creating an admin")
+
+	user := &portainer.User{ID: 2, Username: "user", Role: portainer.StandardUserRole}
+	err = store.User().Create(user)
+	require.NoError(t, err, "error creating a user")
+
+	team := portainer.Team{ID: 1}
+
+	err = store.TeamMembership().Create(&portainer.TeamMembership{
+		ID:     1,
+		UserID: user.ID,
+		TeamID: team.ID,
+		Role:   portainer.TeamMember,
+	})
+	require.NoError(t, err)
+
+	registryReachableByUser := portainer.Registry{
+		ID:   1,
+		Name: "registryReachableByUser",
+		RegistryAccesses: portainer.RegistryAccesses{
+			portainer.EndpointID(endpointID): {
+				UserAccessPolicies: map[portainer.UserID]portainer.AccessPolicy{
+					user.ID: {RoleID: portainer.RoleID(portainer.StandardUserRole)},
+				},
+			},
+		},
+	}
+	err = store.Registry().Create(&registryReachableByUser)
+	require.NoError(t, err, "couldn't create a registry")
+
+	registryReachableByTeam := portainer.Registry{
+		ID:   2,
+		Name: "registryReachableByTeam",
+		RegistryAccesses: portainer.RegistryAccesses{
+			portainer.EndpointID(endpointID): {
+				TeamAccessPolicies: map[portainer.TeamID]portainer.AccessPolicy{
+					team.ID: {RoleID: portainer.RoleID(portainer.StandardUserRole)},
+				},
+			},
+		},
+	}
+	err = store.Registry().Create(&registryReachableByTeam)
+	require.NoError(t, err, "couldn't create a registry")
+
+	registryRestricted := portainer.Registry{
+		ID:   3,
+		Name: "registryRestricted",
+		RegistryAccesses: portainer.RegistryAccesses{
+			portainer.EndpointID(endpointID): {
+				UserAccessPolicies: map[portainer.UserID]portainer.AccessPolicy{
+					user.ID + 100: {RoleID: portainer.RoleID(portainer.StandardUserRole)},
+				},
+			},
+		},
+	}
+	err = store.Registry().Create(&registryRestricted)
+	require.NoError(t, err, "couldn't create a registry")
+
+	t.Run("admin should has access to all registries", func(t *testing.T) {
+		registries, err := getUserRegistries(store, admin, portainer.EndpointID(endpointID))
+		require.NoError(t, err)
+		assert.ElementsMatch(t, []portainer.Registry{registryReachableByUser, registryReachableByTeam, registryRestricted}, registries)
+	})
+
+	t.Run("regular user has access to registries allowed to him and/or his team", func(t *testing.T) {
+		registries, err := getUserRegistries(store, user, portainer.EndpointID(endpointID))
+		require.NoError(t, err)
+		assert.ElementsMatch(t, []portainer.Registry{registryReachableByUser, registryReachableByTeam}, registries)
+	})
+}
diff --git a/api/stacks/deployments/deployer.go b/api/stacks/deployments/deployer.go
new file mode 100644
index 0000000..63127bd
--- /dev/null
+++ b/api/stacks/deployments/deployer.go
@@ -0,0 +1,106 @@
+package deployments
+
+import (
+	"context"
+	"sync"
+
+	"github.com/pkg/errors"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	dockerclient "github.com/portainer/portainer/api/docker/client"
+	k "github.com/portainer/portainer/api/kubernetes"
+)
+
+type BaseStackDeployer interface {
+	DeploySwarmStack(ctx context.Context, stack *portainer.Stack, endpoint *portainer.Endpoint, registries []portainer.Registry, prune, pullImage bool) error
+	DeployComposeStack(ctx context.Context, stack *portainer.Stack, endpoint *portainer.Endpoint, registries []portainer.Registry, prune, forcePullImage, forceRecreate bool) error
+	UndeployComposeStack(ctx context.Context, stack *portainer.Stack, endpoint *portainer.Endpoint) error
+	DeployKubernetesStack(ctx context.Context, stack *portainer.Stack, endpoint *portainer.Endpoint, user *portainer.User) error
+}
+
+type StackDeployer interface {
+	BaseStackDeployer
+	RemoteStackDeployer
+}
+
+type stackDeployer struct {
+	lock                *sync.Mutex
+	swarmStackManager   portainer.SwarmStackManager
+	composeStackManager portainer.ComposeStackManager
+	kubernetesDeployer  portainer.KubernetesDeployer
+	ClientFactory       *dockerclient.ClientFactory
+	dataStore           dataservices.DataStore
+}
+
+// NewStackDeployer inits a stackDeployer struct with a SwarmStackManager, a ComposeStackManager and a KubernetesDeployer
+func NewStackDeployer(swarmStackManager portainer.SwarmStackManager, composeStackManager portainer.ComposeStackManager,
+	kubernetesDeployer portainer.KubernetesDeployer, clientFactory *dockerclient.ClientFactory, dataStore dataservices.DataStore,
+) *stackDeployer {
+	return &stackDeployer{
+		lock:                &sync.Mutex{},
+		swarmStackManager:   swarmStackManager,
+		composeStackManager: composeStackManager,
+		kubernetesDeployer:  kubernetesDeployer,
+		ClientFactory:       clientFactory,
+		dataStore:           dataStore,
+	}
+}
+
+func (d *stackDeployer) DeploySwarmStack(ctx context.Context, stack *portainer.Stack, endpoint *portainer.Endpoint, registries []portainer.Registry, prune, pullImage bool) error {
+	d.lock.Lock()
+	defer d.lock.Unlock()
+
+	return d.swarmStackManager.Deploy(ctx, stack, prune, pullImage, endpoint, registries)
+}
+
+func (d *stackDeployer) DeployComposeStack(ctx context.Context, stack *portainer.Stack, endpoint *portainer.Endpoint, registries []portainer.Registry, prune, forcePullImage, forceRecreate bool) error {
+	d.lock.Lock()
+	defer d.lock.Unlock()
+
+	options := portainer.ComposeOptions{Registries: registries}
+
+	// --force-recreate doesn't pull updated images
+	if forcePullImage {
+		if err := d.composeStackManager.Pull(ctx, stack, endpoint, options); err != nil {
+			return err
+		}
+	}
+
+	return d.composeStackManager.Up(ctx, stack, endpoint, portainer.ComposeUpOptions{
+		ComposeOptions: options,
+		ForceRecreate:  forceRecreate,
+		Prune:          prune,
+	})
+}
+
+func (d *stackDeployer) UndeployComposeStack(ctx context.Context, stack *portainer.Stack, endpoint *portainer.Endpoint) error {
+	d.lock.Lock()
+	defer d.lock.Unlock()
+
+	return d.composeStackManager.Down(ctx, stack, endpoint)
+}
+
+func (d *stackDeployer) DeployKubernetesStack(ctx context.Context, stack *portainer.Stack, endpoint *portainer.Endpoint, user *portainer.User) error {
+	d.lock.Lock()
+	defer d.lock.Unlock()
+
+	appLabels := k.KubeAppLabels{
+		StackID:   int(stack.ID),
+		StackName: stack.Name,
+		Owner:     user.Username,
+	}
+
+	if stack.WorkflowID == 0 {
+		appLabels.Kind = "content"
+	} else {
+		appLabels.Kind = "git"
+	}
+
+	k8sDeploymentConfig := CreateKubernetesStackDeploymentConfig(stack, d.kubernetesDeployer, appLabels, user, endpoint)
+
+	if err := k8sDeploymentConfig.Deploy(ctx); err != nil {
+		return errors.Wrap(err, "failed to deploy kubernetes application")
+	}
+
+	return nil
+}
diff --git a/api/stacks/deployments/deployer_remote.go b/api/stacks/deployments/deployer_remote.go
new file mode 100644
index 0000000..fa57de5
--- /dev/null
+++ b/api/stacks/deployments/deployer_remote.go
@@ -0,0 +1,427 @@
+package deployments
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"os"
+	"strings"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/dataservices/source"
+	"github.com/portainer/portainer/api/filesystem"
+	"github.com/portainer/portainer/api/gitops/workflows"
+	"github.com/portainer/portainer/api/logs"
+	"github.com/portainer/portainer/pkg/librand"
+
+	"github.com/docker/docker/api/types"
+	"github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/api/types/image"
+	"github.com/docker/docker/api/types/swarm"
+	"github.com/docker/docker/api/types/system"
+	dockerclient "github.com/docker/docker/client"
+	"github.com/docker/docker/pkg/stdcopy"
+	"github.com/pkg/errors"
+	"github.com/rs/zerolog/log"
+	"github.com/segmentio/encoding/json"
+)
+
+const (
+	defaultUnpackerImage       = "portainer/compose-unpacker:" + portainer.APIVersion
+	composeUnpackerImageEnvVar = "COMPOSE_UNPACKER_IMAGE"
+	composePathPrefix          = "portainer-compose-unpacker"
+)
+
+type RemoteStackDeployer interface {
+	// compose
+	DeployRemoteComposeStack(ctx context.Context, userId portainer.UserID, stack *portainer.Stack, endpoint *portainer.Endpoint, registries []portainer.Registry, prune bool, forcePullImage bool, forceRecreate bool) error
+	UndeployRemoteComposeStack(ctx context.Context, userId portainer.UserID, stack *portainer.Stack, endpoint *portainer.Endpoint) error
+	StartRemoteComposeStack(ctx context.Context, userId portainer.UserID, stack *portainer.Stack, endpoint *portainer.Endpoint, registries []portainer.Registry) error
+	StopRemoteComposeStack(ctx context.Context, userId portainer.UserID, stack *portainer.Stack, endpoint *portainer.Endpoint) error
+	// swarm
+	DeployRemoteSwarmStack(ctx context.Context, userId portainer.UserID, stack *portainer.Stack, endpoint *portainer.Endpoint, registries []portainer.Registry, prune bool, pullImage bool) error
+	UndeployRemoteSwarmStack(ctx context.Context, userId portainer.UserID, stack *portainer.Stack, endpoint *portainer.Endpoint) error
+	StartRemoteSwarmStack(ctx context.Context, userId portainer.UserID, stack *portainer.Stack, endpoint *portainer.Endpoint, registries []portainer.Registry) error
+	StopRemoteSwarmStack(ctx context.Context, userId portainer.UserID, stack *portainer.Stack, endpoint *portainer.Endpoint) error
+}
+
+// Deploy a compose stack on remote environment using a https://github.com/portainer/compose-unpacker container
+func (d *stackDeployer) DeployRemoteComposeStack(
+	ctx context.Context,
+	userId portainer.UserID,
+	stack *portainer.Stack,
+	endpoint *portainer.Endpoint,
+	registries []portainer.Registry,
+	prune bool,
+	forcePullImage bool,
+	forceRecreate bool,
+) error {
+	d.lock.Lock()
+	defer d.lock.Unlock()
+
+	options := portainer.ComposeOptions{Registries: registries}
+
+	// --force-recreate doesn't pull updated images
+	if forcePullImage {
+		if err := d.composeStackManager.Pull(ctx, stack, endpoint, options); err != nil {
+			return err
+		}
+	}
+
+	return d.remoteStack(
+		ctx,
+		userId,
+		stack,
+		endpoint,
+		OperationDeploy,
+		unpackerCmdBuilderOptions{
+			forceRecreate: forceRecreate,
+			registries:    registries,
+			prune:         prune,
+		},
+	)
+}
+
+// Undeploy a compose stack on remote environment using a https://github.com/portainer/compose-unpacker container
+func (d *stackDeployer) UndeployRemoteComposeStack(
+	ctx context.Context,
+	userId portainer.UserID,
+	stack *portainer.Stack,
+	endpoint *portainer.Endpoint,
+) error {
+	d.lock.Lock()
+	defer d.lock.Unlock()
+
+	return d.remoteStack(ctx, userId, stack, endpoint, OperationUndeploy, unpackerCmdBuilderOptions{})
+}
+
+// Start a compose stack on remote environment using a https://github.com/portainer/compose-unpacker container
+func (d *stackDeployer) StartRemoteComposeStack(
+	ctx context.Context,
+	userId portainer.UserID,
+	stack *portainer.Stack,
+	endpoint *portainer.Endpoint,
+	registries []portainer.Registry,
+) error {
+	return d.remoteStack(
+		ctx,
+		userId,
+		stack,
+		endpoint,
+		OperationComposeStart,
+		unpackerCmdBuilderOptions{
+			registries: registries,
+		},
+	)
+}
+
+// Stop a compose stack on remote environment using a https://github.com/portainer/compose-unpacker container
+func (d *stackDeployer) StopRemoteComposeStack(
+	ctx context.Context,
+	userId portainer.UserID,
+	stack *portainer.Stack,
+	endpoint *portainer.Endpoint,
+) error {
+	return d.remoteStack(ctx, userId, stack, endpoint, OperationComposeStop, unpackerCmdBuilderOptions{})
+}
+
+// Deploy a swarm stack on remote environment using a https://github.com/portainer/compose-unpacker container
+func (d *stackDeployer) DeployRemoteSwarmStack(
+	ctx context.Context,
+	userId portainer.UserID,
+	stack *portainer.Stack,
+	endpoint *portainer.Endpoint,
+	registries []portainer.Registry,
+	prune bool,
+	pullImage bool,
+) error {
+	d.lock.Lock()
+	defer d.lock.Unlock()
+
+	return d.remoteStack(ctx, userId, stack, endpoint, OperationSwarmDeploy, unpackerCmdBuilderOptions{
+		pullImage:     pullImage,
+		prune:         prune,
+		forceRecreate: stack.AutoUpdate != nil && stack.AutoUpdate.ForceUpdate,
+		registries:    registries,
+	})
+}
+
+// Undeploy a swarm stack on remote environment using a https://github.com/portainer/compose-unpacker container
+func (d *stackDeployer) UndeployRemoteSwarmStack(
+	ctx context.Context,
+	userId portainer.UserID,
+	stack *portainer.Stack,
+	endpoint *portainer.Endpoint,
+) error {
+	d.lock.Lock()
+	defer d.lock.Unlock()
+
+	return d.remoteStack(ctx, userId, stack, endpoint, OperationSwarmUndeploy, unpackerCmdBuilderOptions{})
+}
+
+// Start a swarm stack on remote environment using a https://github.com/portainer/compose-unpacker container
+func (d *stackDeployer) StartRemoteSwarmStack(
+	ctx context.Context,
+	userId portainer.UserID,
+	stack *portainer.Stack,
+	endpoint *portainer.Endpoint,
+	registries []portainer.Registry,
+) error {
+	return d.remoteStack(
+		ctx,
+		userId,
+		stack,
+		endpoint,
+		OperationSwarmStart,
+		unpackerCmdBuilderOptions{registries: registries},
+	)
+}
+
+// Stop a swarm stack on remote environment using a https://github.com/portainer/compose-unpacker container
+func (d *stackDeployer) StopRemoteSwarmStack(
+	ctx context.Context,
+	userId portainer.UserID,
+	stack *portainer.Stack,
+	endpoint *portainer.Endpoint,
+) error {
+	return d.remoteStack(
+		ctx,
+		userId,
+		stack,
+		endpoint,
+		OperationSwarmStop,
+		unpackerCmdBuilderOptions{},
+	)
+}
+
+// Does all the heavy lifting:
+// * connect to env
+// * build the args for compose-unpacker
+// * deploy compose-unpacker container
+// * wait for deployment to end
+// * gather deployment logs and bubble them up
+func (d *stackDeployer) remoteStack(ctx context.Context, userID portainer.UserID, stack *portainer.Stack, endpoint *portainer.Endpoint, operation StackRemoteOperation, opts unpackerCmdBuilderOptions) error {
+	if stack.WorkflowID != 0 && opts.gitConfig == nil {
+		if err := d.dataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
+			user, err := tx.User().Read(userID)
+			if err != nil {
+				return err
+			}
+
+			memberships, err := tx.TeamMembership().TeamMembershipsByUserID(userID)
+			if err != nil {
+				return err
+			}
+
+			userContext := source.NewUserContext(user, memberships)
+			src, file, err := workflows.GitSourceAndArtifactForStack(tx, userContext, stack.WorkflowID, stack.ID)
+			if err != nil {
+				return errors.Wrap(err, "failed to load git config for remote stack")
+			}
+
+			if src != nil {
+				opts.gitConfig = workflows.MergeSourceAndFile(src, file)
+			}
+			return nil
+		}); err != nil {
+			return err
+		}
+	}
+
+	cli, err := d.createDockerClient(ctx, endpoint)
+	if err != nil {
+		return errors.WithMessage(err, "unable to create docker client")
+	}
+	defer logs.CloseAndLogErr(cli)
+
+	unpackerImg := getUnpackerImage()
+	log.Debug().Str("unpacker_image", unpackerImg).Msg("Resolved unpacker image")
+
+	reader, err := cli.ImagePull(ctx, unpackerImg, image.PullOptions{})
+	if err != nil {
+		return errors.Wrap(err, "unable to pull unpacker image")
+	}
+	defer logs.CloseAndLogErr(reader)
+	_, _ = io.Copy(io.Discard, reader)
+
+	info, err := cli.Info(ctx)
+	if err != nil {
+		return errors.Wrap(err, "unable to get agent info")
+	}
+	// ensure the targetSocketBindHost is changed to podman for podman environments
+	targetSocketBindHost := getTargetSocketBindHost(info.OSType, endpoint.ContainerEngine)
+	targetSocketBindContainer := getTargetSocketBindContainer(info.OSType)
+
+	composeDestination := filesystem.JoinPaths(stack.ProjectPath, composePathPrefix)
+
+	opts.composeDestination = composeDestination
+
+	cmd, err := d.buildUnpackerCmdForStack(stack, operation, opts)
+	if err != nil {
+		return errors.Wrap(err, "unable to build command for unpacker")
+	}
+
+	log.Debug().
+		Str("image", unpackerImg).
+		Str("cmd", strings.Join(cmd, " ")).
+		Msg("running unpacker")
+
+	unpackerContainer, err := cli.ContainerCreate(ctx, &container.Config{
+		Image: unpackerImg,
+		Cmd:   cmd,
+	}, &container.HostConfig{
+		Binds: []string{
+			fmt.Sprintf("%s:%s", composeDestination, composeDestination),
+			fmt.Sprintf("%s:%s", targetSocketBindHost, targetSocketBindContainer),
+		},
+	}, nil, nil, fmt.Sprintf("portainer-unpacker-%d-%s-%d", stack.ID, stack.Name, librand.Intn(100)))
+	if err != nil {
+		return errors.Wrap(err, "unable to create unpacker container")
+	}
+	defer func() {
+		if err := cli.ContainerRemove(ctx, unpackerContainer.ID, container.RemoveOptions{}); err != nil {
+			log.Warn().Err(err).Msg("unable to remove unpacker container")
+		}
+	}()
+
+	if err := cli.ContainerStart(ctx, unpackerContainer.ID, container.StartOptions{}); err != nil {
+		return errors.Wrap(err, "start unpacker container error")
+	}
+
+	statusCh, errCh := cli.ContainerWait(ctx, unpackerContainer.ID, container.WaitConditionNotRunning)
+	select {
+	case err := <-errCh:
+		if err != nil {
+			return errors.Wrap(err, "An error occurred while waiting for the deployment of the stack.")
+		}
+	case <-statusCh:
+	}
+
+	stdErr := &bytes.Buffer{}
+
+	out, err := cli.ContainerLogs(ctx, unpackerContainer.ID, container.LogsOptions{ShowStdout: true, ShowStderr: true})
+	if err != nil {
+		log.Error().Err(err).Msg("unable to get logs from unpacker container")
+	} else {
+		if _, err := stdcopy.StdCopy(io.Discard, stdErr, out); err != nil {
+			log.Warn().Err(err).Msg("unable to parse logs from unpacker container")
+		} else {
+			log.Info().
+				Str("output", stdErr.String()).
+				Msg("Stack deployment output")
+		}
+	}
+
+	status, err := cli.ContainerInspect(ctx, unpackerContainer.ID)
+	if err != nil {
+		return errors.Wrap(err, "fetch container information error")
+	}
+
+	if status.State.ExitCode == 0 {
+		return nil
+	}
+
+	dec := json.NewDecoder(stdErr)
+	for {
+		errorStruct := struct {
+			Level string
+			Error string
+		}{}
+
+		if err := dec.Decode(&errorStruct); errors.Is(err, io.EOF) {
+			break
+		} else if err != nil {
+			log.Warn().Err(err).Msg("unable to parse logs from unpacker container")
+
+			continue
+		}
+
+		if errorStruct.Level == "error" {
+			return fmt.Errorf("an error occurred while running unpacker container with exit code %d: %s", status.State.ExitCode, errorStruct.Error)
+		}
+	}
+
+	return fmt.Errorf("an error occurred while running unpacker container with exit code %d", status.State.ExitCode)
+}
+
+// Creates a docker client with 1 hour timeout
+func (d *stackDeployer) createDockerClient(ctx context.Context, endpoint *portainer.Endpoint) (*dockerclient.Client, error) {
+	timeout := 3600 * time.Second
+	cli, err := d.ClientFactory.CreateClient(endpoint, "", &timeout)
+	if err != nil {
+		return nil, errors.Wrap(err, "unable to create Docker client")
+	}
+
+	info, err := cli.Info(ctx)
+	if err != nil {
+		return nil, errors.Wrap(err, "unable to get agent info")
+	}
+
+	if isNotInASwarm(&info) {
+		return cli, nil
+	}
+	defer logs.CloseAndLogErr(cli)
+
+	nodes, err := cli.NodeList(ctx, types.NodeListOptions{})
+	if err != nil {
+		return nil, errors.Wrap(err, "unable to list nodes")
+	}
+
+	if len(nodes) == 0 {
+		return nil, errors.New("no nodes available")
+	}
+
+	var managerNode swarm.Node
+	for _, node := range nodes {
+		if node.ManagerStatus != nil && node.ManagerStatus.Leader {
+			managerNode = node
+			break
+		}
+	}
+
+	if managerNode.ID == "" {
+		return nil, errors.New("no leader node available")
+	}
+
+	return d.ClientFactory.CreateClient(endpoint, managerNode.Description.Hostname, &timeout)
+}
+
+func getUnpackerImage() string {
+	image := os.Getenv(composeUnpackerImageEnvVar)
+	if image == "" {
+		image = defaultUnpackerImage
+	}
+
+	return image
+}
+
+func getTargetSocketBindHost(osType string, containerEngine string) string {
+	targetSocketBind := "//./pipe/docker_engine"
+	if strings.EqualFold(osType, "linux") {
+		if containerEngine == portainer.ContainerEnginePodman {
+			targetSocketBind = "/run/podman/podman.sock"
+		} else {
+			targetSocketBind = "/var/run/docker.sock"
+		}
+	}
+
+	return targetSocketBind
+}
+
+func getTargetSocketBindContainer(osType string) string {
+	targetSocketBind := "//./pipe/docker_engine"
+	if strings.EqualFold(osType, "linux") {
+		targetSocketBind = "/var/run/docker.sock"
+	}
+
+	return targetSocketBind
+}
+
+// Per https://stackoverflow.com/a/50590287 and Docker's LocalNodeState possible values
+// `LocalNodeStateInactive` means the node is not in a swarm cluster
+func isNotInASwarm(info *system.Info) bool {
+	return info.Swarm.LocalNodeState == swarm.LocalNodeStateInactive
+}
diff --git a/api/stacks/deployments/deployment_compose_config.go b/api/stacks/deployments/deployment_compose_config.go
new file mode 100644
index 0000000..bd214fb
--- /dev/null
+++ b/api/stacks/deployments/deployment_compose_config.go
@@ -0,0 +1,99 @@
+package deployments
+
+import (
+	"context"
+	"fmt"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/registryutils"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+
+	"github.com/pkg/errors"
+	"github.com/rs/zerolog/log"
+)
+
+type ComposeStackDeploymentConfig struct {
+	stack          *portainer.Stack
+	endpoint       *portainer.Endpoint
+	registries     []portainer.Registry
+	isAdmin        bool
+	user           *portainer.User
+	forcePullImage bool
+	ForceCreate    bool
+	FileService    portainer.FileService
+	StackDeployer  StackDeployer
+	prune          bool
+}
+
+func CreateComposeStackDeploymentConfigTx(tx dataservices.DataStoreTx, securityContext *security.RestrictedRequestContext, stack *portainer.Stack, endpoint *portainer.Endpoint, fileService portainer.FileService, deployer StackDeployer, prune, forcePullImage, forceCreate bool) (*ComposeStackDeploymentConfig, error) {
+	user, err := tx.User().Read(securityContext.UserID)
+	if err != nil {
+		return nil, fmt.Errorf("unable to load user information from the database: %w", err)
+	}
+
+	registries, err := tx.Registry().ReadAll()
+	if err != nil {
+		return nil, fmt.Errorf("unable to retrieve registries from the database: %w", err)
+	}
+
+	filteredRegistries := security.FilterRegistries(registries, user, securityContext.UserMemberships, endpoint.ID)
+
+	registryutils.RefreshAndPersistECRTokens(tx, filteredRegistries)
+
+	config := &ComposeStackDeploymentConfig{
+		stack:          stack,
+		endpoint:       endpoint,
+		registries:     filteredRegistries,
+		prune:          prune,
+		isAdmin:        securityContext.IsAdmin,
+		user:           user,
+		forcePullImage: forcePullImage,
+		ForceCreate:    forceCreate,
+		FileService:    fileService,
+		StackDeployer:  deployer,
+	}
+
+	return config, nil
+}
+
+func (config *ComposeStackDeploymentConfig) Deploy(ctx context.Context) error {
+	if config.FileService == nil || config.StackDeployer == nil {
+		log.Debug().Msg("file service or stack deployer is not initialized")
+		return errors.New("file service or stack deployer cannot be nil")
+	}
+
+	isAdminOrEndpointAdmin := stackutils.UserIsAdminOrEndpointAdmin(config.user)
+	if !isAdminOrEndpointAdmin && config.endpoint != nil {
+		if err := stackutils.ValidateStackFiles(config.stack, &config.endpoint.SecuritySettings, config.FileService); err != nil {
+			return err
+		}
+	}
+
+	if err := stackutils.ValidateComposeURLs(ctx, config.stack, config.FileService); err != nil {
+		return err
+	}
+
+	if stackutils.IsRelativePathStack(config.stack) {
+		return config.StackDeployer.DeployRemoteComposeStack(ctx, config.user.ID, config.stack, config.endpoint, config.registries, config.prune, config.forcePullImage, config.ForceCreate)
+	}
+
+	return config.StackDeployer.DeployComposeStack(ctx, config.stack, config.endpoint, config.registries, config.prune, config.forcePullImage, config.ForceCreate)
+}
+
+func (config *ComposeStackDeploymentConfig) Undeploy(ctx context.Context) error {
+	if config.StackDeployer == nil {
+		log.Debug().Msg("stack deployer is not initialized")
+		return errors.New("stack deployer cannot be nil")
+	}
+
+	if stackutils.IsRelativePathStack(config.stack) {
+		return config.StackDeployer.UndeployRemoteComposeStack(ctx, config.user.ID, config.stack, config.endpoint)
+	}
+	return config.StackDeployer.UndeployComposeStack(ctx, config.stack, config.endpoint)
+}
+
+func (config *ComposeStackDeploymentConfig) GetResponse() string {
+	return ""
+}
diff --git a/api/stacks/deployments/deployment_config.go b/api/stacks/deployments/deployment_config.go
new file mode 100644
index 0000000..01ee2e7
--- /dev/null
+++ b/api/stacks/deployments/deployment_config.go
@@ -0,0 +1,9 @@
+package deployments
+
+import "context"
+
+type StackDeploymentConfiger interface {
+	Deploy(ctx context.Context) error
+	Undeploy(ctx context.Context) error
+	GetResponse() string
+}
diff --git a/api/stacks/deployments/deployment_kubernetes_config.go b/api/stacks/deployments/deployment_kubernetes_config.go
new file mode 100644
index 0000000..30848d3
--- /dev/null
+++ b/api/stacks/deployments/deployment_kubernetes_config.go
@@ -0,0 +1,88 @@
+package deployments
+
+import (
+	"context"
+	"fmt"
+	"os"
+
+	"github.com/pkg/errors"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/filesystem"
+	k "github.com/portainer/portainer/api/kubernetes"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+	"github.com/rs/zerolog/log"
+)
+
+type KubernetesStackDeploymentConfig struct {
+	stack              *portainer.Stack
+	kubernetesDeployer portainer.KubernetesDeployer
+	appLabels          k.KubeAppLabels
+	user               *portainer.User
+	endpoint           *portainer.Endpoint
+	output             string
+}
+
+func CreateKubernetesStackDeploymentConfig(stack *portainer.Stack, kubeDeployer portainer.KubernetesDeployer, appLabels k.KubeAppLabels, user *portainer.User, endpoint *portainer.Endpoint) *KubernetesStackDeploymentConfig {
+	return &KubernetesStackDeploymentConfig{
+		stack:              stack,
+		kubernetesDeployer: kubeDeployer,
+		appLabels:          appLabels,
+		user:               user,
+		endpoint:           endpoint,
+	}
+}
+
+func (config *KubernetesStackDeploymentConfig) Deploy(ctx context.Context) error {
+	fileNames := stackutils.GetStackFilePaths(config.stack, false)
+
+	manifestFilePaths := make([]string, 0, len(fileNames))
+
+	tmpDir, err := os.MkdirTemp("", "kub_deployment")
+	if err != nil {
+		return errors.Wrap(err, "failed to create temp kub deployment directory")
+	}
+
+	defer func() {
+		if err := os.RemoveAll(tmpDir); err != nil {
+			log.Warn().Err(err).Msg("failed to remove temp kub deployment directory")
+		}
+	}()
+
+	for _, fileName := range fileNames {
+		manifestFilePath := filesystem.JoinPaths(tmpDir, fileName)
+		manifestContent, err := os.ReadFile(filesystem.JoinPaths(config.stack.ProjectPath, fileName))
+		if err != nil {
+			return errors.Wrap(err, "failed to read manifest file")
+		}
+
+		manifestContent, err = k.AddAppLabels(manifestContent, config.appLabels.ToMap())
+		if err != nil {
+			return errors.Wrap(err, "failed to add application labels")
+		}
+
+		if err := filesystem.WriteToFile(manifestFilePath, manifestContent); err != nil {
+			return errors.Wrap(err, "failed to create temp manifest file")
+		}
+
+		manifestFilePaths = append(manifestFilePaths, manifestFilePath)
+	}
+
+	output, err := config.kubernetesDeployer.Deploy(ctx, config.user.ID, config.endpoint, manifestFilePaths, config.stack.Namespace)
+	if err != nil {
+		return fmt.Errorf("failed to deploy kubernete stack: %w", err)
+	}
+
+	config.output = output
+	return nil
+}
+
+func (config *KubernetesStackDeploymentConfig) Undeploy(ctx context.Context) error {
+	// Kubernetes is an orchestrator that handles partial failures internally,
+	// so there is no need to remove failed resources before redeploying.
+	// This method exists only to satisfy the deployment interface.
+	return nil
+}
+
+func (config *KubernetesStackDeploymentConfig) GetResponse() string {
+	return config.output
+}
diff --git a/api/stacks/deployments/deployment_swarm_config.go b/api/stacks/deployments/deployment_swarm_config.go
new file mode 100644
index 0000000..3122420
--- /dev/null
+++ b/api/stacks/deployments/deployment_swarm_config.go
@@ -0,0 +1,94 @@
+package deployments
+
+import (
+	"context"
+	"fmt"
+	"log"
+
+	"github.com/pkg/errors"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/registryutils"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+)
+
+type SwarmStackDeploymentConfig struct {
+	stack         *portainer.Stack
+	endpoint      *portainer.Endpoint
+	registries    []portainer.Registry
+	prune         bool
+	isAdmin       bool
+	user          *portainer.User
+	pullImage     bool
+	FileService   portainer.FileService
+	StackDeployer StackDeployer
+}
+
+func CreateSwarmStackDeploymentConfigTx(tx dataservices.DataStoreTx, securityContext *security.RestrictedRequestContext, stack *portainer.Stack, endpoint *portainer.Endpoint, fileService portainer.FileService, deployer StackDeployer, prune bool, pullImage bool) (*SwarmStackDeploymentConfig, error) {
+	user, err := tx.User().Read(securityContext.UserID)
+	if err != nil {
+		return nil, fmt.Errorf("unable to load user information from the database: %w", err)
+	}
+
+	registries, err := tx.Registry().ReadAll()
+	if err != nil {
+		return nil, fmt.Errorf("unable to retrieve registries from the database: %w", err)
+	}
+
+	filteredRegistries := security.FilterRegistries(registries, user, securityContext.UserMemberships, endpoint.ID)
+
+	registryutils.RefreshAndPersistECRTokens(tx, filteredRegistries)
+
+	config := &SwarmStackDeploymentConfig{
+		stack:         stack,
+		endpoint:      endpoint,
+		registries:    filteredRegistries,
+		prune:         prune,
+		isAdmin:       securityContext.IsAdmin,
+		user:          user,
+		pullImage:     pullImage,
+		FileService:   fileService,
+		StackDeployer: deployer,
+	}
+
+	return config, nil
+}
+
+func (config *SwarmStackDeploymentConfig) Deploy(ctx context.Context) error {
+	if config.FileService == nil || config.StackDeployer == nil {
+		log.Println("[deployment, swarm] file service or stack deployer is not initialised")
+		return errors.New("file service or stack deployer cannot be nil")
+	}
+
+	isAdminOrEndpointAdmin := stackutils.UserIsAdminOrEndpointAdmin(config.user)
+
+	settings := &config.endpoint.SecuritySettings
+
+	if !isAdminOrEndpointAdmin {
+		if err := stackutils.ValidateStackFiles(config.stack, settings, config.FileService); err != nil {
+			return err
+		}
+	}
+
+	if err := stackutils.ValidateComposeURLs(ctx, config.stack, config.FileService); err != nil {
+		return err
+	}
+
+	if stackutils.IsRelativePathStack(config.stack) {
+		return config.StackDeployer.DeployRemoteSwarmStack(ctx, config.user.ID, config.stack, config.endpoint, config.registries, config.prune, config.pullImage)
+	}
+
+	return config.StackDeployer.DeploySwarmStack(ctx, config.stack, config.endpoint, config.registries, config.prune, config.pullImage)
+}
+
+func (config *SwarmStackDeploymentConfig) Undeploy(ctx context.Context) error {
+	// Swarm is an orchestrator that handles partial failures internally,
+	// so there is no need to remove failed resources before redeploying.
+	// This method exists only to satisfy the deployment interface.
+	return nil
+}
+
+func (config *SwarmStackDeploymentConfig) GetResponse() string {
+	return ""
+}
diff --git a/api/stacks/deployments/scheduled.go b/api/stacks/deployments/scheduled.go
new file mode 100644
index 0000000..44ee81c
--- /dev/null
+++ b/api/stacks/deployments/scheduled.go
@@ -0,0 +1,35 @@
+package deployments
+
+import (
+	"context"
+	"time"
+
+	"github.com/pkg/errors"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/scheduler"
+)
+
+func StartStackSchedules(scheduler *scheduler.Scheduler, stackdeployer StackDeployer, datastore dataservices.DataStore, gitService portainer.GitService) error {
+	stacks, err := datastore.Stack().RefreshableStacks()
+	if err != nil {
+		return errors.Wrap(err, "failed to fetch refreshable stacks")
+	}
+
+	for _, stack := range stacks {
+		d, err := time.ParseDuration(stack.AutoUpdate.Interval)
+		if err != nil {
+			return errors.Wrap(err, "Unable to parse auto update interval")
+		}
+		stackID := stack.ID // to be captured by the scheduled function
+		jobID := scheduler.StartJobEvery(d, func() error {
+			return RedeployWhenChanged(context.Background(), stackID, stackdeployer, datastore, gitService)
+		})
+
+		stack.AutoUpdate.JobID = jobID
+		if err := datastore.Stack().Update(stack.ID, &stack); err != nil {
+			return errors.Wrap(err, "failed to update stack job id")
+		}
+	}
+	return nil
+}
diff --git a/api/stacks/stackbuilders/compose_file_builder.go b/api/stacks/stackbuilders/compose_file_builder.go
new file mode 100644
index 0000000..a2f7bd5
--- /dev/null
+++ b/api/stacks/stackbuilders/compose_file_builder.go
@@ -0,0 +1,50 @@
+package stackbuilders
+
+import (
+	"context"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/filesystem"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/stacks/deployments"
+)
+
+type ComposeStackFileBuilder struct {
+	StackBuilder
+	SecurityContext *security.RestrictedRequestContext
+}
+
+// CreateComposeStackFileBuilder creates a builder for compose stacks deployed from a file (either uploaded or provided as text content).
+func CreateComposeStackFileBuilder(securityContext *security.RestrictedRequestContext,
+	dataStore dataservices.DataStore,
+	fileService portainer.FileService,
+	stackDeployer deployments.StackDeployer) *ComposeStackFileBuilder {
+
+	return &ComposeStackFileBuilder{
+		StackBuilder:    CreateStackBuilder(dataStore, fileService, stackDeployer),
+		SecurityContext: securityContext,
+	}
+}
+
+func (b *ComposeStackFileBuilder) prepare(_ context.Context, payload *StackPayload, userID portainer.UserID) error {
+	b.stack.Name = payload.Name
+	b.stack.Type = portainer.DockerComposeStack
+	b.stack.EntryPoint = filesystem.ComposeFileDefaultName
+	b.stack.Env = payload.Env
+	b.stack.FromAppTemplate = payload.FromAppTemplate
+
+	if err := b.initCreatedBy(userID); err != nil {
+		return err
+	}
+
+	return b.storeStackFile(payload.StackFileContent)
+}
+
+func (b *ComposeStackFileBuilder) deploy(ctx context.Context, endpoint *portainer.Endpoint) error {
+	if err := b.initComposeDeployment(b.SecurityContext, endpoint); err != nil {
+		return err
+	}
+
+	return b.deploymentConfiger.Deploy(ctx)
+}
diff --git a/api/stacks/stackbuilders/compose_git_builder.go b/api/stacks/stackbuilders/compose_git_builder.go
new file mode 100644
index 0000000..6eb77f3
--- /dev/null
+++ b/api/stacks/stackbuilders/compose_git_builder.go
@@ -0,0 +1,52 @@
+package stackbuilders
+
+import (
+	"context"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/scheduler"
+	"github.com/portainer/portainer/api/stacks/deployments"
+)
+
+type ComposeStackGitBuilder struct {
+	GitMethodStackBuilder
+	SecurityContext *security.RestrictedRequestContext
+}
+
+// CreateComposeStackGitBuilder creates a builder for the compose stack (docker standalone) that will be deployed by git repository method
+func CreateComposeStackGitBuilder(securityContext *security.RestrictedRequestContext,
+	dataStore dataservices.DataStore,
+	fileService portainer.FileService,
+	gitService portainer.GitService,
+	scheduler *scheduler.Scheduler,
+	stackDeployer deployments.StackDeployer) *ComposeStackGitBuilder {
+
+	return &ComposeStackGitBuilder{
+		GitMethodStackBuilder: GitMethodStackBuilder{
+			StackBuilder: CreateStackBuilder(dataStore, fileService, stackDeployer),
+			gitService:   gitService,
+			scheduler:    scheduler,
+		},
+		SecurityContext: securityContext,
+	}
+}
+
+func (b *ComposeStackGitBuilder) prepare(ctx context.Context, payload *StackPayload, userID portainer.UserID) error {
+	b.stack.Name = payload.Name
+	b.stack.Type = portainer.DockerComposeStack
+	b.stack.EntryPoint = payload.ComposeFile
+	b.stack.FromAppTemplate = payload.FromAppTemplate
+	b.stack.Env = payload.Env
+
+	return b.GitMethodStackBuilder.prepare(ctx, payload, userID)
+}
+
+func (b *ComposeStackGitBuilder) deploy(ctx context.Context, endpoint *portainer.Endpoint) error {
+	if err := b.initComposeDeployment(b.SecurityContext, endpoint); err != nil {
+		return err
+	}
+
+	return b.deploymentConfiger.Deploy(ctx)
+}
diff --git a/api/stacks/stackbuilders/director.go b/api/stacks/stackbuilders/director.go
new file mode 100644
index 0000000..f0a9ea7
--- /dev/null
+++ b/api/stacks/stackbuilders/director.go
@@ -0,0 +1,93 @@
+package stackbuilders
+
+import (
+	"context"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+
+	"github.com/rs/zerolog/log"
+)
+
+// stackBuildProcess is the common interface shared by all stack build methods.
+type stackBuildProcess interface {
+	setGeneralInfo(payload *StackPayload, endpoint *portainer.Endpoint)
+	// prepare handles all pre-save steps: sets type-specific metadata, stores
+	// files on disk, or clones the git repository.
+	prepare(ctx context.Context, payload *StackPayload, userID portainer.UserID) error
+	saveStack() (*portainer.Stack, error)
+	deploy(ctx context.Context, endpoint *portainer.Endpoint) error
+	// postDeploy runs after a successful deployment: for git builders it enables
+	// auto-update; for other builders it is a no-op.
+	postDeploy(ctx context.Context, stack *portainer.Stack) error
+}
+
+// Build executes the stack build process. It returns the created stack and any
+// error encountered during the process. The returned error is of type
+// *httperror.HandlerError, which could be an InternalServerError depending on
+// the error encountered during the stack build process.
+//
+// The stack is saved to DB with Status=Deploying and returned immediately.
+// Deployment runs in a background goroutine. The caller must poll
+// GET /stacks/{id} to track completion.
+func Build(ctx context.Context, dataStore dataservices.DataStore, builder stackBuildProcess, payload *StackPayload, endpoint *portainer.Endpoint, userID portainer.UserID) (*portainer.Stack, *httperror.HandlerError) {
+	builder.setGeneralInfo(payload, endpoint)
+
+	if err := builder.prepare(ctx, payload, userID); err != nil {
+		return nil, httperror.InternalServerError("Failed to prepare stack", err)
+	}
+
+	stack, err := builder.saveStack()
+	if err != nil {
+		return nil, httperror.InternalServerError("Failed to save stack", err)
+	}
+
+	go deploy(dataStore, builder, stack.ID, endpoint)
+
+	return stack, nil
+}
+
+func deploy(dataStore dataservices.DataStore, builder stackBuildProcess, stackID portainer.StackID, endpoint *portainer.Endpoint) {
+	backgroundCtx := context.Background()
+	ctx, cancel := context.WithTimeout(backgroundCtx, 15*time.Minute)
+	defer cancel()
+
+	deployErr := builder.deploy(ctx, endpoint)
+
+	var stack *portainer.Stack
+
+	if err := dataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		var err error
+
+		stack, err = tx.Stack().Read(stackID)
+		if err != nil {
+			return err
+		}
+
+		stackutils.UpdateStackStatusFromDeploymentResult(stack, deployErr)
+
+		return tx.Stack().Update(stack.ID, stack)
+	}); err != nil {
+		log.Error().Err(err).
+			AnErr("deploy_error", deployErr).
+			Int("stack_id", int(stackID)).
+			Str("context", "deploy").
+			Msg("Failed to update stack status after async deployment")
+
+		return
+	}
+
+	if deployErr != nil {
+		return
+	}
+
+	if err := builder.postDeploy(backgroundCtx, stack); err != nil {
+		log.Error().Err(err).
+			Int("stack_id", int(stackID)).
+			Str("context", "deploy").
+			Msg("Failed to run post-deployment hook")
+	}
+}
diff --git a/api/stacks/stackbuilders/director_test.go b/api/stacks/stackbuilders/director_test.go
new file mode 100644
index 0000000..a5e1057
--- /dev/null
+++ b/api/stacks/stackbuilders/director_test.go
@@ -0,0 +1,164 @@
+package stackbuilders
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+	httperrors "github.com/portainer/portainer/api/http/errors"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// Stubs
+
+type stubBuilder struct {
+	store      *datastore.Store
+	savedStack *portainer.Stack
+	saveErr    error
+	deployErr  error
+	hookCalled atomic.Bool
+}
+
+func (s *stubBuilder) setGeneralInfo(_ *StackPayload, _ *portainer.Endpoint) {
+	if s.savedStack == nil {
+		return
+	}
+
+	now := time.Now().Unix()
+	s.savedStack.Status = portainer.StackStatusDeploying
+	s.savedStack.DeploymentStatus = []portainer.StackDeploymentStatus{
+		{Status: portainer.StackStatusDeploying, Time: now},
+	}
+}
+
+func (s *stubBuilder) prepare(_ context.Context, _ *StackPayload, _ portainer.UserID) error {
+	return nil
+}
+
+func (s *stubBuilder) saveStack() (*portainer.Stack, error) {
+	if s.saveErr != nil {
+		return nil, s.saveErr
+	}
+
+	return s.savedStack, s.store.Stack().Create(s.savedStack)
+}
+
+func (s *stubBuilder) deploy(_ context.Context, _ *portainer.Endpoint) error {
+	return s.deployErr
+}
+
+func (s *stubBuilder) postDeploy(_ context.Context, _ *portainer.Stack) error {
+	s.hookCalled.Store(true)
+
+	return nil
+}
+
+// Helpers
+
+func waitForStackStatus(t *testing.T, store *datastore.Store, id portainer.StackID, wantStatus portainer.StackStatus) *portainer.Stack {
+	t.Helper()
+
+	var stack *portainer.Stack
+
+	require.Eventually(t, func() bool {
+		var err error
+		stack, err = store.Stack().Read(id)
+
+		return err == nil && stack.Status == wantStatus
+	}, 5*time.Second, 10*time.Millisecond, "stack did not reach status %d in time", wantStatus)
+
+	return stack
+}
+
+// Tests
+
+func TestBuild_SaveError_ErrUnauthorized_ReturnsInternalServerError(t *testing.T) {
+	t.Parallel()
+	builder := &stubBuilder{saveErr: httperrors.ErrUnauthorized}
+
+	_, herr := Build(t.Context(), nil, builder, &StackPayload{}, &portainer.Endpoint{}, 0)
+
+	require.NotNil(t, herr)
+	assert.Equal(t, http.StatusInternalServerError, herr.StatusCode)
+}
+
+func TestBuild_SaveError_ReturnsInternalServerError(t *testing.T) {
+	t.Parallel()
+	builder := &stubBuilder{saveErr: errors.New("db error")}
+
+	_, herr := Build(t.Context(), nil, builder, &StackPayload{}, &portainer.Endpoint{}, 0)
+
+	require.NotNil(t, herr)
+	assert.Equal(t, http.StatusInternalServerError, herr.StatusCode)
+}
+
+func TestBuild_SpawnAsync_DeploySuccess_UpdatesStackStatusToActive(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, true, false)
+	stack := &portainer.Stack{ID: 1}
+	builder := &stubBuilder{store: store, savedStack: stack}
+
+	_, herr := Build(t.Context(), store, builder, &StackPayload{}, &portainer.Endpoint{}, 0)
+	require.Nil(t, herr)
+
+	updated := waitForStackStatus(t, store, stack.ID, portainer.StackStatusActive)
+
+	assert.Equal(t, portainer.StackStatusActive, updated.Status)
+	require.Len(t, updated.DeploymentStatus, 2)
+	assert.Equal(t, portainer.StackStatusDeploying, updated.DeploymentStatus[0].Status)
+	assert.Equal(t, portainer.StackStatusActive, updated.DeploymentStatus[1].Status)
+}
+
+func TestBuild_SpawnAsync_DeployFailure_UpdatesStackStatusToError(t *testing.T) {
+	t.Parallel()
+	deployErr := errors.New("failed to pull image nginx:999")
+	_, store := datastore.MustNewTestStore(t, true, false)
+	stack := &portainer.Stack{ID: 1}
+	builder := &stubBuilder{store: store, savedStack: stack, deployErr: deployErr}
+
+	_, herr := Build(t.Context(), store, builder, &StackPayload{}, &portainer.Endpoint{}, 0)
+	require.Nil(t, herr)
+
+	updated := waitForStackStatus(t, store, stack.ID, portainer.StackStatusError)
+
+	assert.Equal(t, portainer.StackStatusError, updated.Status)
+	require.Len(t, updated.DeploymentStatus, 2)
+	assert.Equal(t, portainer.StackStatusDeploying, updated.DeploymentStatus[0].Status)
+	lastEntry := updated.DeploymentStatus[1]
+	assert.Equal(t, portainer.StackStatusError, lastEntry.Status)
+	assert.Equal(t, deployErr.Error(), lastEntry.Message)
+}
+
+func TestBuild_SpawnAsync_PostDeployHook_CalledOnSuccess(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, true, false)
+	stack := &portainer.Stack{ID: 1}
+	builder := &stubBuilder{store: store, savedStack: stack}
+
+	_, herr := Build(t.Context(), store, builder, &StackPayload{}, &portainer.Endpoint{}, 0)
+	require.Nil(t, herr)
+
+	waitForStackStatus(t, store, stack.ID, portainer.StackStatusActive)
+
+	require.Eventually(t, builder.hookCalled.Load, 5*time.Second, 10*time.Millisecond, "post-deploy hook should be called after a successful deployment")
+}
+
+func TestBuild_SpawnAsync_PostDeployHook_NotCalledOnDeployFailure(t *testing.T) {
+	t.Parallel()
+	_, store := datastore.MustNewTestStore(t, true, false)
+	stack := &portainer.Stack{ID: 1}
+	builder := &stubBuilder{store: store, savedStack: stack, deployErr: errors.New("failed to deploy")}
+
+	_, herr := Build(t.Context(), store, builder, &StackPayload{}, &portainer.Endpoint{}, 0)
+	require.Nil(t, herr)
+
+	waitForStackStatus(t, store, stack.ID, portainer.StackStatusError)
+
+	require.False(t, builder.hookCalled.Load(), "post-deploy hook should not be called after a failed deployment")
+}
diff --git a/api/stacks/stackbuilders/k8s_git_builder.go b/api/stacks/stackbuilders/k8s_git_builder.go
new file mode 100644
index 0000000..6b4c9db
--- /dev/null
+++ b/api/stacks/stackbuilders/k8s_git_builder.go
@@ -0,0 +1,58 @@
+package stackbuilders
+
+import (
+	"context"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/scheduler"
+	"github.com/portainer/portainer/api/stacks/deployments"
+)
+
+type KubernetesStackGitBuilder struct {
+	GitMethodStackBuilder
+	kubernetesDeployer portainer.KubernetesDeployer
+	user               *portainer.User
+}
+
+// CreateKubernetesStackGitBuilder creates a builder for the Kubernetes stack that will be deployed by git repository method
+func CreateKubernetesStackGitBuilder(dataStore dataservices.DataStore,
+	fileService portainer.FileService,
+	gitService portainer.GitService,
+	scheduler *scheduler.Scheduler,
+	stackDeployer deployments.StackDeployer,
+	kubernetesDeployer portainer.KubernetesDeployer,
+	user *portainer.User) *KubernetesStackGitBuilder {
+
+	return &KubernetesStackGitBuilder{
+		GitMethodStackBuilder: GitMethodStackBuilder{
+			StackBuilder: CreateStackBuilder(dataStore, fileService, stackDeployer),
+			gitService:   gitService,
+			scheduler:    scheduler,
+		},
+		kubernetesDeployer: kubernetesDeployer,
+		user:               user,
+	}
+}
+
+func (b *KubernetesStackGitBuilder) prepare(ctx context.Context, payload *StackPayload, userID portainer.UserID) error {
+	b.stack.Type = portainer.KubernetesStack
+	b.stack.Namespace = payload.Namespace
+	b.stack.Name = payload.StackName
+	b.stack.EntryPoint = payload.ManifestFile
+	if err := b.GitMethodStackBuilder.prepare(ctx, payload, userID); err != nil {
+		return err
+	}
+
+	b.deploymentConfiger = newKubernetesDeploymentConfig(b.stack, b.kubernetesDeployer, "git", b.user, b.endpoint)
+
+	return nil
+}
+
+func (b *KubernetesStackGitBuilder) deploy(ctx context.Context, endpoint *portainer.Endpoint) error {
+	return b.deploymentConfiger.Deploy(ctx)
+}
+
+func (b *KubernetesStackGitBuilder) GetResponse() string {
+	return b.deploymentConfiger.GetResponse()
+}
diff --git a/api/stacks/stackbuilders/k8s_stack_builder.go b/api/stacks/stackbuilders/k8s_stack_builder.go
new file mode 100644
index 0000000..ac3b1dc
--- /dev/null
+++ b/api/stacks/stackbuilders/k8s_stack_builder.go
@@ -0,0 +1,102 @@
+package stackbuilders
+
+import (
+	"context"
+	"fmt"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/filesystem"
+	"github.com/portainer/portainer/api/http/client"
+	k "github.com/portainer/portainer/api/kubernetes"
+	"github.com/portainer/portainer/api/stacks/deployments"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+)
+
+type KubernetesStackBuilder struct {
+	StackBuilder
+	kubernetesDeployer portainer.KubernetesDeployer
+	user               *portainer.User
+	kind               string
+	contentFn          func(*StackPayload) ([]byte, error)
+}
+
+// CreateK8sStackFileContentBuilder creates a builder for the Kubernetes stack deployed from file content.
+func CreateK8sStackFileContentBuilder(dataStore dataservices.DataStore,
+	fileService portainer.FileService,
+	stackDeployer deployments.StackDeployer,
+	kubernetesDeployer portainer.KubernetesDeployer,
+	user *portainer.User) *KubernetesStackBuilder {
+
+	return &KubernetesStackBuilder{
+		StackBuilder:       CreateStackBuilder(dataStore, fileService, stackDeployer),
+		kubernetesDeployer: kubernetesDeployer,
+		user:               user,
+		kind:               "content",
+		contentFn: func(p *StackPayload) ([]byte, error) {
+			return p.StackFileContent, nil
+		},
+	}
+}
+
+// CreateKubernetesStackUrlBuilder creates a builder for the Kubernetes stack deployed from a URL.
+func CreateKubernetesStackUrlBuilder(dataStore dataservices.DataStore,
+	fileService portainer.FileService,
+	stackDeployer deployments.StackDeployer,
+	kubernetesDeployer portainer.KubernetesDeployer,
+	user *portainer.User) *KubernetesStackBuilder {
+
+	return &KubernetesStackBuilder{
+		StackBuilder:       CreateStackBuilder(dataStore, fileService, stackDeployer),
+		kubernetesDeployer: kubernetesDeployer,
+		user:               user,
+		kind:               "url",
+		contentFn: func(p *StackPayload) ([]byte, error) {
+			return client.Get(p.ManifestURL, 30)
+		},
+	}
+}
+
+func (b *KubernetesStackBuilder) prepare(_ context.Context, payload *StackPayload, userID portainer.UserID) error {
+	b.stack.Name = payload.StackName
+	b.stack.Type = portainer.KubernetesStack
+	b.stack.EntryPoint = filesystem.ManifestFileDefaultName
+	b.stack.Namespace = payload.Namespace
+	b.stack.FromAppTemplate = payload.FromAppTemplate
+
+	if err := b.initCreatedBy(userID); err != nil {
+		return err
+	}
+
+	content, err := b.contentFn(payload)
+	if err != nil {
+		return fmt.Errorf("unable to retrieve manifest content: %w", err)
+	}
+
+	if err := b.storeStackFile(content); err != nil {
+		return err
+	}
+
+	b.deploymentConfiger = newKubernetesDeploymentConfig(b.stack, b.kubernetesDeployer, b.kind, b.user, b.endpoint)
+
+	return nil
+}
+
+func (b *KubernetesStackBuilder) deploy(ctx context.Context, endpoint *portainer.Endpoint) error {
+	return b.deploymentConfiger.Deploy(ctx)
+}
+
+func (b *KubernetesStackBuilder) GetResponse() string {
+	return b.deploymentConfiger.GetResponse()
+}
+
+func newKubernetesDeploymentConfig(stack *portainer.Stack, deployer portainer.KubernetesDeployer, kind string, user *portainer.User, endpoint *portainer.Endpoint) deployments.StackDeploymentConfiger {
+	k8sAppLabel := k.KubeAppLabels{
+		StackID:   int(stack.ID),
+		StackName: stack.Name,
+		Owner:     stackutils.SanitizeLabel(stack.CreatedBy),
+		Kind:      kind,
+	}
+
+	return deployments.CreateKubernetesStackDeploymentConfig(stack, deployer, k8sAppLabel, user, endpoint)
+}
diff --git a/api/stacks/stackbuilders/stack_builder.go b/api/stacks/stackbuilders/stack_builder.go
new file mode 100644
index 0000000..0181c40
--- /dev/null
+++ b/api/stacks/stackbuilders/stack_builder.go
@@ -0,0 +1,140 @@
+package stackbuilders
+
+import (
+	"context"
+	"fmt"
+	"strconv"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/stacks/deployments"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+
+	"github.com/rs/zerolog/log"
+)
+
+type StackBuilder struct {
+	stack              *portainer.Stack
+	endpoint           *portainer.Endpoint
+	dataStore          dataservices.DataStore
+	fileService        portainer.FileService
+	stackDeployer      deployments.StackDeployer
+	deploymentConfiger deployments.StackDeploymentConfiger
+	doCleanUp          bool
+}
+
+func CreateStackBuilder(dataStore dataservices.DataStore, fileService portainer.FileService, deployer deployments.StackDeployer) StackBuilder {
+	return StackBuilder{
+		stack:         &portainer.Stack{},
+		dataStore:     dataStore,
+		fileService:   fileService,
+		stackDeployer: deployer,
+		doCleanUp:     true,
+	}
+}
+
+func (b *StackBuilder) setGeneralInfo(_ *StackPayload, endpoint *portainer.Endpoint) {
+	b.endpoint = endpoint
+	stackID := b.dataStore.Stack().GetNextIdentifier()
+	b.stack.ID = portainer.StackID(stackID)
+	b.stack.EndpointID = endpoint.ID
+	now := time.Now().Unix()
+	b.stack.CreationDate = now
+	stackutils.PrepareStackStatusForDeployment(b.stack)
+}
+
+func (b *StackBuilder) deploy(ctx context.Context, _ *portainer.Endpoint) error {
+	return b.deploymentConfiger.Deploy(ctx)
+}
+
+func (b *StackBuilder) postDeploy(_ context.Context, _ *portainer.Stack) error { return nil }
+
+func (b *StackBuilder) saveStack() (*portainer.Stack, error) {
+	defer func() { _ = b.cleanUp() }()
+
+	if err := b.dataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		if err := tx.Stack().Create(b.stack); err != nil {
+			return fmt.Errorf("Unable to persist the stack inside the database: %w", err)
+		}
+
+		return nil
+	}); err != nil {
+		return nil, err
+	}
+
+	b.doCleanUp = false
+
+	return b.stack, nil
+}
+
+func (b *StackBuilder) cleanUp() error {
+	if !b.doCleanUp {
+		return nil
+	}
+
+	if b.stack.WorkflowID != 0 {
+		if err := b.dataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+			err := tx.Workflow().Delete(b.stack.WorkflowID)
+			if tx.IsErrObjectNotFound(err) {
+				return nil
+			}
+
+			return err
+		}); err != nil {
+			log.Error().Err(err).Msg("unable to cleanup orphan workflow records after failed stack creation")
+		}
+	}
+
+	if err := b.fileService.RemoveDirectory(b.stack.ProjectPath); err != nil {
+		log.Error().Err(err).Msg("unable to cleanup stack creation")
+	}
+
+	return nil
+}
+
+func (b *StackBuilder) initCreatedBy(userID portainer.UserID) error {
+	return b.dataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
+		user, err := tx.User().Read(userID)
+		if err != nil {
+			return fmt.Errorf("failed to find stack author: %w", err)
+		}
+		b.stack.CreatedBy = user.Username
+		return nil
+	})
+}
+
+func (b *StackBuilder) storeStackFile(content []byte) error {
+	stackFolder := strconv.Itoa(int(b.stack.ID))
+	projectPath, err := b.fileService.StoreStackFileFromBytes(stackFolder, b.stack.EntryPoint, content)
+	if err != nil {
+		return err
+	}
+
+	b.stack.ProjectPath = projectPath
+
+	return nil
+}
+
+func (b *StackBuilder) initComposeDeployment(secCtx *security.RestrictedRequestContext, endpoint *portainer.Endpoint) error {
+	config, err := deployments.CreateComposeStackDeploymentConfigTx(b.dataStore, secCtx, b.stack, endpoint, b.fileService, b.stackDeployer, false, false, false)
+	if err != nil {
+		return fmt.Errorf("failed to create compose deployment config: %w", err)
+	}
+
+	b.deploymentConfiger = config
+
+	return nil
+}
+
+func (b *StackBuilder) initSwarmDeployment(secCtx *security.RestrictedRequestContext, endpoint *portainer.Endpoint) error {
+	config, err := deployments.CreateSwarmStackDeploymentConfigTx(b.dataStore, secCtx, b.stack, endpoint, b.fileService, b.stackDeployer, false, true)
+	if err != nil {
+		return fmt.Errorf("failed to create swarm deployment config: %w", err)
+	}
+
+	b.deploymentConfiger = config
+
+	return nil
+}
diff --git a/api/stacks/stackbuilders/stack_git_builder.go b/api/stacks/stackbuilders/stack_git_builder.go
new file mode 100644
index 0000000..d52e6f1
--- /dev/null
+++ b/api/stacks/stackbuilders/stack_git_builder.go
@@ -0,0 +1,209 @@
+package stackbuilders
+
+import (
+	"context"
+	"fmt"
+	"strconv"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/dataservices/source"
+	"github.com/portainer/portainer/api/filesystem"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	"github.com/portainer/portainer/api/gitops/workflows"
+	"github.com/portainer/portainer/api/scheduler"
+	"github.com/portainer/portainer/api/stacks/deployments"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/portainer/portainer/pkg/libhttp/ssrf"
+)
+
+type GitMethodStackBuilder struct {
+	StackBuilder
+	gitService portainer.GitService
+	scheduler  *scheduler.Scheduler
+}
+
+func (b *GitMethodStackBuilder) prepare(ctx context.Context, payload *StackPayload, userID portainer.UserID) error {
+	b.stack.AdditionalFiles = payload.AdditionalFiles
+	b.stack.AutoUpdate = payload.AutoUpdate
+
+	if err := b.initCreatedBy(userID); err != nil {
+		return err
+	}
+
+	var userContext source.UserContext
+	if err := b.dataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
+		user, err := tx.User().Read(userID)
+		if err != nil {
+			return httperror.InternalServerError("Unable to read user", err)
+		}
+		memberships, err := tx.TeamMembership().TeamMembershipsByUserID(userID)
+		if err != nil {
+			return httperror.InternalServerError("Unable to read user team memberships", err)
+		}
+
+		userContext = source.NewUserContext(user, memberships)
+		return nil
+	}); err != nil {
+		return err
+	}
+
+	var repoConfig gittypes.RepoConfig
+	var sourceID portainer.SourceID
+
+	if payload.SourceID != 0 {
+		src, err := b.dataStore.Source().Read(userContext, payload.SourceID)
+		if err != nil {
+			return fmt.Errorf("failed to read source: %w", err)
+		}
+		if src.Git == nil {
+			return fmt.Errorf("source %d has no git configuration", payload.SourceID)
+		}
+
+		repoConfig.URL = src.Git.URL
+		repoConfig.Authentication = src.Git.Authentication
+		repoConfig.TLSSkipVerify = src.Git.TLSSkipVerify
+		repoConfig.ReferenceName = payload.ReferenceName
+		sourceID = src.ID
+	} else {
+		if payload.Authentication {
+			repoConfig.Authentication = &gittypes.GitAuthentication{
+				Username: payload.Username,
+				Password: payload.Password,
+			}
+		}
+
+		repoConfig.URL = payload.URL
+		repoConfig.ReferenceName = payload.ReferenceName
+		repoConfig.TLSSkipVerify = payload.TLSSkipVerify
+	}
+
+	repoConfig.ConfigFilePath = payload.ComposeFile
+	if payload.ComposeFile == "" {
+		repoConfig.ConfigFilePath = filesystem.ComposeFileDefaultName
+	}
+
+	// If a manifest file is specified (for kube git apps), then use it instead of the default compose file name
+	if payload.ManifestFile != "" {
+		repoConfig.ConfigFilePath = payload.ManifestFile
+	}
+
+	stackFolder := strconv.Itoa(int(b.stack.ID))
+	// Set the project path on the disk
+	b.stack.ProjectPath = b.fileService.GetStackProjectPath(stackFolder)
+
+	getProjectPath := func() string {
+		stackFolder := fmt.Sprintf("%d", b.stack.ID)
+		return b.fileService.GetStackProjectPath(stackFolder)
+	}
+
+	if err := ssrf.CheckURL(ctx, repoConfig.URL); err != nil {
+		return fmt.Errorf("repository URL blocked by SSRF policy: %w", err)
+	}
+
+	commitHash, err := stackutils.DownloadGitRepository(ctx, repoConfig, b.gitService, getProjectPath)
+	if err != nil {
+		if txErr := b.dataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+			return workflows.SaveSourceStatus(tx, userContext, sourceID, err)
+		}); txErr != nil {
+			return fmt.Errorf("failed to download git repository: %w (and failed to persist status: %w)", err, txErr)
+		}
+
+		return fmt.Errorf("failed to download git repository: %w", err)
+	}
+
+	// Update the latest commit id
+	repoConfig.ConfigHash = commitHash
+
+	var workflowID portainer.WorkflowID
+
+	if err := b.dataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		file := portainer.ArtifactFile{
+			Path:       repoConfig.ConfigFilePath,
+			Ref:        repoConfig.ReferenceName,
+			Hash:       repoConfig.ConfigHash,
+			RefStatus:  portainer.SourceStatusHealthy,
+			PathStatus: portainer.SourceStatusHealthy,
+		}
+
+		if sourceID != 0 {
+			file.SourceID = sourceID
+		} else {
+			repoConfig.URL = gittypes.SanitizeURL(repoConfig.URL)
+
+			src, err := workflows.FindOrCreateGitSource(tx, userContext, &portainer.Source{
+				Name: gittypes.RepoName(repoConfig.URL),
+				Type: portainer.SourceTypeGit,
+				Git: &gittypes.GitSource{
+					URL:            repoConfig.URL,
+					Authentication: repoConfig.Authentication,
+					TLSSkipVerify:  repoConfig.TLSSkipVerify,
+				},
+			})
+			if err != nil {
+				return fmt.Errorf("failed to find or create source: %w", err)
+			}
+
+			file.SourceID = src.ID
+		}
+
+		if err := workflows.SaveSourceStatus(tx, userContext, file.SourceID, nil); err != nil {
+			return fmt.Errorf("failed to persist source sync status: %w", err)
+		}
+
+		wf := &portainer.Workflow{
+			Name: b.stack.Name,
+			Artifacts: []portainer.Artifact{{
+				StackID: b.stack.ID,
+				Files:   []portainer.ArtifactFile{file},
+			}},
+		}
+		if err := tx.Workflow().Create(wf); err != nil {
+			return fmt.Errorf("failed to create workflow: %w", err)
+		}
+
+		workflowID = wf.ID
+
+		return nil
+	}); err != nil {
+		return err
+	}
+
+	b.stack.WorkflowID = workflowID
+
+	return nil
+}
+
+// postDeploy enables the auto-update scheduler job for the stack if configured,
+// and persists the resulting job ID back to the database.
+func (b *GitMethodStackBuilder) postDeploy(ctx context.Context, stack *portainer.Stack) error {
+	if stack.AutoUpdate == nil || stack.AutoUpdate.Interval == "" {
+		return nil
+	}
+
+	jobID, err := deployments.StartAutoupdate(ctx, stack.ID,
+		stack.AutoUpdate.Interval,
+		b.scheduler,
+		b.stackDeployer,
+		b.dataStore,
+		b.gitService)
+	if err != nil {
+		return err
+	}
+
+	return b.dataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		s, err := tx.Stack().Read(stack.ID)
+		if err != nil {
+			return fmt.Errorf("Unable to retrieve the stack from the database: %w", err)
+		}
+
+		s.AutoUpdate.JobID = jobID
+
+		if err := tx.Stack().Update(s.ID, s); err != nil {
+			return fmt.Errorf("Unable to update the stack inside the database: %w", err)
+		}
+
+		return nil
+	})
+}
diff --git a/api/stacks/stackbuilders/stack_git_builder_test.go b/api/stacks/stackbuilders/stack_git_builder_test.go
new file mode 100644
index 0000000..384673e
--- /dev/null
+++ b/api/stacks/stackbuilders/stack_git_builder_test.go
@@ -0,0 +1,196 @@
+package stackbuilders
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices/source"
+	"github.com/portainer/portainer/api/datastore"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	"github.com/portainer/portainer/api/gitops/workflows"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+var adminUserContext = source.InsecureNewAdminContext()
+
+// stubFileService satisfies portainer.FileService for git builder tests.
+type stubFileService struct {
+	portainer.FileService
+}
+
+func (s *stubFileService) GetStackProjectPath(stackIdentifier string) string {
+	return "/data/compose/" + stackIdentifier
+}
+
+func newGitMethodBuilder(t *testing.T, commitHash string) *GitMethodStackBuilder {
+	t.Helper()
+	_, store := datastore.MustNewTestStore(t, false, false)
+	require.NoError(t, store.User().Create(&portainer.User{ID: 1, Username: "testuser", Role: portainer.AdministratorRole}))
+	return &GitMethodStackBuilder{
+		StackBuilder: StackBuilder{
+			stack:       &portainer.Stack{},
+			fileService: &stubFileService{},
+			dataStore:   store,
+		},
+		gitService: testhelpers.NewGitService(nil, commitHash),
+	}
+}
+
+func TestGitMethodStackBuilder_WithSourceID_ReferencesExistingSource(t *testing.T) {
+	t.Parallel()
+	builder := newGitMethodBuilder(t, "abc123")
+	builder.stack.ID = 1
+
+	src := &portainer.Source{
+		Name: "my-repo",
+		Type: portainer.SourceTypeGit,
+		Git: &gittypes.GitSource{
+			URL: "https://github.com/org/private-repo",
+			Authentication: &gittypes.GitAuthentication{
+				Username: "git-user",
+				Password: "git-token",
+			},
+		},
+	}
+	require.NoError(t, builder.dataStore.Source().Create(adminUserContext, src))
+
+	payload := &StackPayload{
+		RepositoryConfigPayload: RepositoryConfigPayload{
+			SourceID:      src.ID,
+			ReferenceName: "refs/heads/main",
+		},
+	}
+
+	err := builder.prepare(context.Background(), payload, portainer.UserID(1))
+	require.NoError(t, err)
+
+	// Workflow Artifact must reference the existing Source — not a new one.
+	referencedSourceID := builderWorkflowSourceID(t, builder)
+	assert.Equal(t, src.ID, referencedSourceID)
+
+	// Only one Source exists — no duplicate was created.
+	allSources, err := builder.dataStore.Source().ReadAll(adminUserContext)
+	require.NoError(t, err)
+	assert.Len(t, allSources, 1)
+
+	// The merged git config picks up the Source URL/auth.
+	readSrc, artifact, err := workflows.GitSourceAndArtifactForStack(builder.dataStore, adminUserContext, builder.stack.WorkflowID, builder.stack.ID)
+	require.NoError(t, err)
+	merged := workflows.MergeSourceAndFile(readSrc, artifact)
+	assert.Equal(t, "https://github.com/org/private-repo", merged.URL)
+	assert.Equal(t, "refs/heads/main", merged.ReferenceName)
+	require.NotNil(t, merged.Authentication)
+	assert.Equal(t, "git-user", merged.Authentication.Username)
+}
+
+func TestGitMethodStackBuilder_WithSourceID_PersistsHealthyStatusOnSuccess(t *testing.T) {
+	t.Parallel()
+	builder := newGitMethodBuilder(t, "abc123")
+	builder.stack.ID = 1
+
+	src := &portainer.Source{
+		Name: "my-repo",
+		Type: portainer.SourceTypeGit,
+		Git:  &gittypes.GitSource{URL: "https://github.com/org/private-repo"},
+	}
+	require.NoError(t, builder.dataStore.Source().Create(adminUserContext, src))
+
+	payload := &StackPayload{
+		RepositoryConfigPayload: RepositoryConfigPayload{
+			SourceID:      src.ID,
+			ReferenceName: "refs/heads/main",
+		},
+	}
+
+	err := builder.prepare(t.Context(), payload, portainer.UserID(1))
+	require.NoError(t, err)
+
+	updatedSrc, err := builder.dataStore.Source().Read(adminUserContext, src.ID)
+	require.NoError(t, err)
+	assert.Equal(t, portainer.SourceStatusHealthy, updatedSrc.Status)
+	assert.NotZero(t, updatedSrc.LastSync)
+}
+
+func TestGitMethodStackBuilder_WithSourceID_PersistsErrorStatusOnCloneFailure(t *testing.T) {
+	t.Parallel()
+	builder := newGitMethodBuilder(t, "abc123")
+	cloneErr := errors.New("failed to clone")
+	builder.gitService = testhelpers.NewGitService(cloneErr, "abc123")
+	builder.stack.ID = 1
+
+	src := &portainer.Source{
+		Name: "my-repo",
+		Type: portainer.SourceTypeGit,
+		Git:  &gittypes.GitSource{URL: "https://github.com/org/private-repo"},
+	}
+	require.NoError(t, builder.dataStore.Source().Create(adminUserContext, src))
+
+	payload := &StackPayload{
+		RepositoryConfigPayload: RepositoryConfigPayload{
+			SourceID:      src.ID,
+			ReferenceName: "refs/heads/main",
+		},
+	}
+
+	err := builder.prepare(t.Context(), payload, portainer.UserID(1))
+	require.Error(t, err)
+
+	updatedSrc, err := builder.dataStore.Source().Read(adminUserContext, src.ID)
+	require.NoError(t, err)
+	assert.Equal(t, portainer.SourceStatusError, updatedSrc.Status)
+	assert.Contains(t, updatedSrc.StatusError, cloneErr.Error())
+	assert.Zero(t, updatedSrc.LastSync)
+}
+
+func TestGitMethodStackBuilder_WithMissingSourceID_ReturnsError(t *testing.T) {
+	t.Parallel()
+	builder := newGitMethodBuilder(t, "abc123")
+	builder.stack.ID = 2
+
+	payload := &StackPayload{
+		RepositoryConfigPayload: RepositoryConfigPayload{
+			SourceID: portainer.SourceID(999), // does not exist
+		},
+	}
+
+	err := builder.prepare(context.Background(), payload, portainer.UserID(1))
+	require.Error(t, err)
+}
+
+func TestGitMethodStackBuilder_WithoutSourceID_InlinePathStillWorks(t *testing.T) {
+	t.Parallel()
+	builder := newGitMethodBuilder(t, "feedcafe")
+	builder.stack.ID = 4
+
+	payload := &StackPayload{
+		RepositoryConfigPayload: RepositoryConfigPayload{
+			URL:           "https://github.com/org/public-repo",
+			ReferenceName: "refs/heads/main",
+		},
+	}
+
+	err := builder.prepare(context.Background(), payload, portainer.UserID(1))
+	require.NoError(t, err)
+
+	// A Source was created via the inline path.
+	allSources, err := builder.dataStore.Source().ReadAll(adminUserContext)
+	require.NoError(t, err)
+	assert.Len(t, allSources, 1)
+	assert.Equal(t, "https://github.com/org/public-repo", allSources[0].Git.URL)
+}
+
+// builderWorkflowSourceID returns the first SourceID referenced by the Workflow Artifact for this stack.
+func builderWorkflowSourceID(t *testing.T, builder *GitMethodStackBuilder) portainer.SourceID {
+	t.Helper()
+	require.NotZero(t, builder.stack.WorkflowID)
+
+	wf, err := builder.dataStore.Workflow().Read(builder.stack.WorkflowID)
+	require.NoError(t, err)
+	require.Len(t, wf.Artifacts, 1)
+	require.Len(t, wf.Artifacts[0].Files, 1)
+	return wf.Artifacts[0].Files[0].SourceID
+}
diff --git a/api/stacks/stackbuilders/stack_payload.go b/api/stacks/stackbuilders/stack_payload.go
new file mode 100644
index 0000000..8ef0059
--- /dev/null
+++ b/api/stacks/stackbuilders/stack_payload.go
@@ -0,0 +1,54 @@
+package stackbuilders
+
+import (
+	portainer "github.com/portainer/portainer/api"
+)
+
+// StackPayload contains all the fields for creating a stack with all kinds of methods
+type StackPayload struct {
+	// Name of the stack
+	Name string `example:"myStack" validate:"required"`
+	// Swarm cluster identifier
+	SwarmID string `example:"jpofkc0i9uo9wtx1zesuk649w" validate:"required"`
+	// Stack file data
+	StackFileContent []byte
+	Webhook          string
+	// A list of environment(endpoint) variables used during stack deployment
+	Env []portainer.Pair
+	// Optional GitOps update configuration
+	AutoUpdate *portainer.AutoUpdateSettings
+	// Whether the stack is from a app template
+	FromAppTemplate bool `example:"false"`
+	// Kubernetes stack name
+	StackName string
+	// Kubernetes stack namespace
+	Namespace string
+	// Path to the k8s Stack file. Used by k8s git repository method
+	ManifestFile string
+	// URL to the k8s Stack file. Used by k8s git repository method
+	ManifestURL string
+	// Path to the Stack file inside the Git repository
+	ComposeFile string `example:"docker-compose.yml" default:"docker-compose.yml"`
+	// Applicable when deploying with multiple stack files
+	AdditionalFiles []string `example:"[nz.compose.yml, uat.compose.yml]"`
+	// Git repository configuration of a stack
+	RepositoryConfigPayload
+}
+
+type RepositoryConfigPayload struct {
+	// SourceID references an existing Source.
+	// When non-zero, only ReferenceName is still applied.
+	SourceID portainer.SourceID
+	// URL of a Git repository hosting the Stack file
+	URL string `example:"https://github.com/openfaas/faas"`
+	// Reference name of a Git repository hosting the Stack file
+	ReferenceName string `example:"refs/heads/master"`
+	// Use basic authentication to clone the Git repository
+	Authentication bool `example:"true"`
+	// Username used in basic authentication. Required when RepositoryAuthentication is true
+	Username string `example:"myGitUsername"`
+	// Password used in basic authentication. Required when RepositoryAuthentication is true
+	Password string `example:"myGitPassword"`
+	// TLSSkipVerify skips SSL verification when cloning the Git repository
+	TLSSkipVerify bool `example:"false"`
+}
diff --git a/api/stacks/stackbuilders/swarm_file_builder.go b/api/stacks/stackbuilders/swarm_file_builder.go
new file mode 100644
index 0000000..13720b9
--- /dev/null
+++ b/api/stacks/stackbuilders/swarm_file_builder.go
@@ -0,0 +1,51 @@
+package stackbuilders
+
+import (
+	"context"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/filesystem"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/stacks/deployments"
+)
+
+type SwarmStackFileBuilder struct {
+	StackBuilder
+	SecurityContext *security.RestrictedRequestContext
+}
+
+// CreateSwarmStackFileBuilder creates a builder for swarm stacks deployed from a file (either uploaded or provided as text content).
+func CreateSwarmStackFileBuilder(securityContext *security.RestrictedRequestContext,
+	dataStore dataservices.DataStore,
+	fileService portainer.FileService,
+	stackDeployer deployments.StackDeployer) *SwarmStackFileBuilder {
+
+	return &SwarmStackFileBuilder{
+		StackBuilder:    CreateStackBuilder(dataStore, fileService, stackDeployer),
+		SecurityContext: securityContext,
+	}
+}
+
+func (b *SwarmStackFileBuilder) prepare(_ context.Context, payload *StackPayload, userID portainer.UserID) error {
+	b.stack.Name = payload.Name
+	b.stack.Type = portainer.DockerSwarmStack
+	b.stack.SwarmID = payload.SwarmID
+	b.stack.EntryPoint = filesystem.ComposeFileDefaultName
+	b.stack.Env = payload.Env
+	b.stack.FromAppTemplate = payload.FromAppTemplate
+
+	if err := b.initCreatedBy(userID); err != nil {
+		return err
+	}
+
+	return b.storeStackFile(payload.StackFileContent)
+}
+
+func (b *SwarmStackFileBuilder) deploy(ctx context.Context, endpoint *portainer.Endpoint) error {
+	if err := b.initSwarmDeployment(b.SecurityContext, endpoint); err != nil {
+		return err
+	}
+
+	return b.deploymentConfiger.Deploy(ctx)
+}
diff --git a/api/stacks/stackbuilders/swarm_git_builder.go b/api/stacks/stackbuilders/swarm_git_builder.go
new file mode 100644
index 0000000..e9ecdbc
--- /dev/null
+++ b/api/stacks/stackbuilders/swarm_git_builder.go
@@ -0,0 +1,54 @@
+package stackbuilders
+
+import (
+	"context"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/scheduler"
+	"github.com/portainer/portainer/api/stacks/deployments"
+)
+
+type SwarmStackGitBuilder struct {
+	GitMethodStackBuilder
+	SecurityContext *security.RestrictedRequestContext
+}
+
+// CreateSwarmStackGitBuilder creates a builder for the swarm stack that will be deployed by git repository method
+func CreateSwarmStackGitBuilder(securityContext *security.RestrictedRequestContext,
+	dataStore dataservices.DataStore,
+	fileService portainer.FileService,
+	gitService portainer.GitService,
+	scheduler *scheduler.Scheduler,
+	stackDeployer deployments.StackDeployer) *SwarmStackGitBuilder {
+
+	return &SwarmStackGitBuilder{
+		GitMethodStackBuilder: GitMethodStackBuilder{
+			StackBuilder: CreateStackBuilder(dataStore, fileService, stackDeployer),
+			gitService:   gitService,
+			scheduler:    scheduler,
+		},
+		SecurityContext: securityContext,
+	}
+}
+
+func (b *SwarmStackGitBuilder) prepare(ctx context.Context, payload *StackPayload, userID portainer.UserID) error {
+	b.stack.Name = payload.Name
+	b.stack.Type = portainer.DockerSwarmStack
+	b.stack.SwarmID = payload.SwarmID
+	b.stack.EntryPoint = payload.ComposeFile
+	b.stack.FromAppTemplate = payload.FromAppTemplate
+	b.stack.Env = payload.Env
+
+	return b.GitMethodStackBuilder.prepare(ctx, payload, userID)
+}
+
+// deploy creates deployment configuration for swarm stack
+func (b *SwarmStackGitBuilder) deploy(ctx context.Context, endpoint *portainer.Endpoint) error {
+	if err := b.initSwarmDeployment(b.SecurityContext, endpoint); err != nil {
+		return err
+	}
+
+	return b.deploymentConfiger.Deploy(ctx)
+}
diff --git a/api/stacks/stackutils/env.go b/api/stacks/stackutils/env.go
new file mode 100644
index 0000000..826bd38
--- /dev/null
+++ b/api/stacks/stackutils/env.go
@@ -0,0 +1,34 @@
+package stackutils
+
+import (
+	"maps"
+	"os"
+	"path"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/filesystem"
+
+	"github.com/compose-spec/compose-go/v2/dotenv"
+)
+
+// BuildEnvMap builds the environment variable map for stack validation/loading.
+// Priority (lowest to highest): OS env, .env file, stack.Env
+func BuildEnvMap(stack *portainer.Stack) map[string]string {
+	env := make(map[string]string, len(os.Environ()))
+	for _, e := range os.Environ() {
+		k, v, _ := strings.Cut(e, "=")
+		env[k] = v
+	}
+
+	dotEnvPath := filesystem.JoinPaths(stack.ProjectPath, path.Dir(stack.EntryPoint), ".env")
+	if dotVars, err := dotenv.Read(dotEnvPath); err == nil {
+		maps.Copy(env, dotVars)
+	}
+
+	for _, pair := range stack.Env {
+		env[pair.Name] = pair.Value
+	}
+
+	return env
+}
diff --git a/api/stacks/stackutils/gitops.go b/api/stacks/stackutils/gitops.go
new file mode 100644
index 0000000..3cff71f
--- /dev/null
+++ b/api/stacks/stackutils/gitops.go
@@ -0,0 +1,61 @@
+package stackutils
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/pkg/errors"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/git"
+	gittypes "github.com/portainer/portainer/api/git/types"
+)
+
+var (
+	ErrStackAlreadyExists     = errors.New("A stack already exists with this name")
+	ErrWebhookIDAlreadyExists = errors.New("A webhook ID already exists")
+)
+
+// DownloadGitRepository downloads the target git repository on the disk
+// The first return value represents the commit hash of the downloaded git repository
+func DownloadGitRepository(ctx context.Context, config gittypes.RepoConfig, gitService portainer.GitService, getProjectPath func() string) (string, error) {
+	username := ""
+	password := ""
+	if config.Authentication != nil {
+		username = config.Authentication.Username
+		password = config.Authentication.Password
+	}
+
+	projectPath := getProjectPath()
+	err := gitService.CloneRepository(
+		ctx,
+		projectPath,
+		config.URL,
+		config.ReferenceName,
+		username,
+		password,
+		config.TLSSkipVerify,
+	)
+	if err != nil {
+		if errors.Is(err, gittypes.ErrAuthenticationFailure) {
+			newErr := git.ErrInvalidGitCredential
+			return "", newErr
+		}
+
+		newErr := fmt.Errorf("unable to clone git repository: %w", err)
+		return "", newErr
+	}
+
+	commitID, err := gitService.LatestCommitID(
+		ctx,
+		config.URL,
+		config.ReferenceName,
+		username,
+		password,
+		config.TLSSkipVerify,
+	)
+	if err != nil {
+		newErr := fmt.Errorf("unable to fetch git repository id: %w", err)
+		return "", newErr
+	}
+	return commitID, nil
+}
diff --git a/api/stacks/stackutils/gitops_test.go b/api/stacks/stackutils/gitops_test.go
new file mode 100644
index 0000000..b4d8e7a
--- /dev/null
+++ b/api/stacks/stackutils/gitops_test.go
@@ -0,0 +1,101 @@
+package stackutils
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/git"
+	gittypes "github.com/portainer/portainer/api/git/types"
+
+	"github.com/stretchr/testify/require"
+)
+
+type mockGitSvc struct {
+	cloneErr  error
+	commitID  string
+	commitErr error
+}
+
+func (m *mockGitSvc) CloneRepository(_ context.Context, _, _, _, _, _ string, _ bool) error {
+	return m.cloneErr
+}
+
+func (m *mockGitSvc) LatestCommitID(_ context.Context, _, _, _, _ string, _ bool) (string, error) {
+	return m.commitID, m.commitErr
+}
+
+func (m *mockGitSvc) ListRefs(_ context.Context, _, _, _ string, _ bool, _ bool) ([]string, error) {
+	return nil, nil
+}
+
+func (m *mockGitSvc) ListFiles(_ context.Context, _, _, _, _ string, _, _ bool, _ []string, _ bool) ([]string, error) {
+	return nil, nil
+}
+
+var _ portainer.GitService = (*mockGitSvc)(nil)
+
+func TestDownloadGitRepository_Success(t *testing.T) {
+	t.Parallel()
+
+	svc := &mockGitSvc{commitID: "abc123"}
+	cfg := gittypes.RepoConfig{
+		URL:           "https://github.com/x/repo",
+		ReferenceName: "refs/heads/main",
+	}
+
+	commitID, err := DownloadGitRepository(t.Context(), cfg, svc, func() string { return t.TempDir() })
+	require.NoError(t, err)
+	require.Equal(t, "abc123", commitID)
+}
+
+func TestDownloadGitRepository_NilAuthentication(t *testing.T) {
+	t.Parallel()
+
+	svc := &mockGitSvc{commitID: "deadbeef"}
+	cfg := gittypes.RepoConfig{
+		URL:            "https://github.com/x/repo",
+		Authentication: nil,
+	}
+
+	commitID, err := DownloadGitRepository(t.Context(), cfg, svc, func() string { return t.TempDir() })
+	require.NoError(t, err)
+	require.Equal(t, "deadbeef", commitID)
+}
+
+func TestDownloadGitRepository_AuthenticationFailure(t *testing.T) {
+	t.Parallel()
+
+	svc := &mockGitSvc{cloneErr: gittypes.ErrAuthenticationFailure}
+	cfg := gittypes.RepoConfig{URL: "https://github.com/x/private"}
+
+	_, err := DownloadGitRepository(t.Context(), cfg, svc, func() string { return t.TempDir() })
+	require.Error(t, err)
+	require.ErrorIs(t, err, git.ErrInvalidGitCredential)
+}
+
+func TestDownloadGitRepository_OtherCloneError(t *testing.T) {
+	t.Parallel()
+
+	cloneErr := errors.New("network timeout")
+	svc := &mockGitSvc{cloneErr: cloneErr}
+	cfg := gittypes.RepoConfig{URL: "https://github.com/x/repo"}
+
+	_, err := DownloadGitRepository(t.Context(), cfg, svc, func() string { return t.TempDir() })
+	require.Error(t, err)
+	require.ErrorIs(t, err, cloneErr)
+	require.NotErrorIs(t, err, git.ErrInvalidGitCredential)
+}
+
+func TestDownloadGitRepository_LatestCommitIDError(t *testing.T) {
+	t.Parallel()
+
+	commitErr := errors.New("remote unreachable")
+	svc := &mockGitSvc{commitErr: commitErr}
+	cfg := gittypes.RepoConfig{URL: "https://github.com/x/repo"}
+
+	_, err := DownloadGitRepository(t.Context(), cfg, svc, func() string { return t.TempDir() })
+	require.Error(t, err)
+	require.ErrorIs(t, err, commitErr)
+}
diff --git a/api/stacks/stackutils/stack_status.go b/api/stacks/stackutils/stack_status.go
new file mode 100644
index 0000000..2ce34a7
--- /dev/null
+++ b/api/stacks/stackutils/stack_status.go
@@ -0,0 +1,61 @@
+package stackutils
+
+import (
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+)
+
+// PrepareStackStatusForDeployment transitions a stack into the deploying state before a deployment begins.
+// It saves the current status in DeploymentStartStatus so that pre-deployment actions can be determined
+// (e.g. whether to undeploy before redeploying), sets Status to StackStatusDeploying, and resets the
+// DeploymentStatus history with a single deploying entry.
+func PrepareStackStatusForDeployment(stack *portainer.Stack) {
+	stack.DeploymentStartStatus = stack.Status
+	stack.Status = portainer.StackStatusDeploying
+	stack.DeploymentStatus = []portainer.StackDeploymentStatus{
+		{Status: portainer.StackStatusDeploying, Time: time.Now().Unix()},
+	}
+}
+
+// UpdateStackStatusFromDeploymentResult updates a stack's status after a deployment attempt completes.
+// On success (err == nil) the stack is marked active; on failure it is marked as errored with the error message recorded.
+func UpdateStackStatusFromDeploymentResult(stack *portainer.Stack, err error) {
+	if err != nil {
+		stack.Status = portainer.StackStatusError
+		stack.DeploymentStatus = append(stack.DeploymentStatus, portainer.StackDeploymentStatus{
+			Status:  portainer.StackStatusError,
+			Time:    time.Now().Unix(),
+			Message: err.Error(),
+		})
+
+		return
+	}
+
+	stack.Status = portainer.StackStatusActive
+	stack.DeploymentStatus = append(stack.DeploymentStatus, portainer.StackDeploymentStatus{
+		Status: portainer.StackStatusActive,
+		Time:   time.Now().Unix(),
+	})
+}
+
+// UpdateStackStatusFromUndeploymentResult updates a stack's status after an undeployment attempt completes.
+// On success (err == nil) the stack is marked inactive; on failure it is marked as errored with the error message recorded.
+func UpdateStackStatusFromUndeploymentResult(stack *portainer.Stack, err error) {
+	if err != nil {
+		stack.Status = portainer.StackStatusError
+		stack.DeploymentStatus = append(stack.DeploymentStatus, portainer.StackDeploymentStatus{
+			Status:  portainer.StackStatusError,
+			Time:    time.Now().Unix(),
+			Message: err.Error(),
+		})
+
+		return
+	}
+
+	stack.Status = portainer.StackStatusInactive
+	stack.DeploymentStatus = append(stack.DeploymentStatus, portainer.StackDeploymentStatus{
+		Status: portainer.StackStatusInactive,
+		Time:   time.Now().Unix(),
+	})
+}
diff --git a/api/stacks/stackutils/stack_status_test.go b/api/stacks/stackutils/stack_status_test.go
new file mode 100644
index 0000000..b9219b7
--- /dev/null
+++ b/api/stacks/stackutils/stack_status_test.go
@@ -0,0 +1,92 @@
+package stackutils
+
+import (
+	"errors"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestPrepareStackStatusForDeployment(t *testing.T) {
+	t.Parallel()
+
+	stack := &portainer.Stack{
+		Status: portainer.StackStatusActive,
+	}
+
+	PrepareStackStatusForDeployment(stack)
+
+	require.Equal(t, portainer.StackStatusActive, stack.DeploymentStartStatus)
+	require.Equal(t, portainer.StackStatusDeploying, stack.Status)
+	require.Len(t, stack.DeploymentStatus, 1)
+	require.Equal(t, portainer.StackStatusDeploying, stack.DeploymentStatus[0].Status)
+	require.Positive(t, stack.DeploymentStatus[0].Time)
+}
+
+func TestUpdateStackStatusFromDeploymentResult(t *testing.T) {
+	t.Parallel()
+
+	t.Run("on error", func(t *testing.T) {
+		t.Parallel()
+
+		stack := &portainer.Stack{}
+		deployErr := errors.New("deployment failed")
+
+		UpdateStackStatusFromDeploymentResult(stack, deployErr)
+
+		require.Equal(t, portainer.StackStatusError, stack.Status)
+		require.Len(t, stack.DeploymentStatus, 1)
+		require.Equal(t, portainer.StackStatusError, stack.DeploymentStatus[0].Status)
+		require.Equal(t, deployErr.Error(), stack.DeploymentStatus[0].Message)
+		require.Positive(t, stack.DeploymentStatus[0].Time)
+	})
+
+	t.Run("on success", func(t *testing.T) {
+		t.Parallel()
+
+		stack := &portainer.Stack{}
+
+		UpdateStackStatusFromDeploymentResult(stack, nil)
+
+		require.Equal(t, portainer.StackStatusActive, stack.Status)
+		require.Len(t, stack.DeploymentStatus, 1)
+		require.Equal(t, portainer.StackStatusActive, stack.DeploymentStatus[0].Status)
+		require.Empty(t, stack.DeploymentStatus[0].Message)
+		require.Positive(t, stack.DeploymentStatus[0].Time)
+	})
+}
+
+func TestUpdateStackStatusFromUndeploymentResult(t *testing.T) {
+	t.Parallel()
+
+	t.Run("on error", func(t *testing.T) {
+		t.Parallel()
+
+		stack := &portainer.Stack{}
+		undeployErr := errors.New("undeployment failed")
+
+		UpdateStackStatusFromUndeploymentResult(stack, undeployErr)
+
+		require.Equal(t, portainer.StackStatusError, stack.Status)
+		require.Len(t, stack.DeploymentStatus, 1)
+		require.Equal(t, portainer.StackStatusError, stack.DeploymentStatus[0].Status)
+		require.Equal(t, undeployErr.Error(), stack.DeploymentStatus[0].Message)
+		require.Positive(t, stack.DeploymentStatus[0].Time)
+	})
+
+	t.Run("on success", func(t *testing.T) {
+		t.Parallel()
+
+		stack := &portainer.Stack{}
+
+		UpdateStackStatusFromUndeploymentResult(stack, nil)
+
+		require.Equal(t, portainer.StackStatusInactive, stack.Status)
+		require.Len(t, stack.DeploymentStatus, 1)
+		require.Equal(t, portainer.StackStatusInactive, stack.DeploymentStatus[0].Status)
+		require.Empty(t, stack.DeploymentStatus[0].Message)
+		require.Positive(t, stack.DeploymentStatus[0].Time)
+	})
+}
diff --git a/api/stacks/stackutils/util.go b/api/stacks/stackutils/util.go
new file mode 100644
index 0000000..1d263d0
--- /dev/null
+++ b/api/stacks/stackutils/util.go
@@ -0,0 +1,51 @@
+package stackutils
+
+import (
+	"fmt"
+	"regexp"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/filesystem"
+)
+
+func UserIsAdminOrEndpointAdmin(user *portainer.User) bool {
+	return user.Role == portainer.AdministratorRole
+}
+
+// GetStackFilePaths returns a list of file paths based on stack project path
+// If absolute is false, the path sanitization step will be skipped, which makes the returning
+// paths vulnerable to path traversal attacks. Thus, the followed function using the returning
+// paths are responsible to sanitize the raw paths
+// If absolute is true, the raw paths will be sanitized
+func GetStackFilePaths(stack *portainer.Stack, absolute bool) []string {
+	if !absolute {
+		return append([]string{stack.EntryPoint}, stack.AdditionalFiles...)
+	}
+
+	var filePaths []string
+	for _, file := range append([]string{stack.EntryPoint}, stack.AdditionalFiles...) {
+		filePaths = append(filePaths, filesystem.JoinPaths(stack.ProjectPath, file))
+	}
+
+	return filePaths
+}
+
+// ResourceControlID returns the stack resource control id
+func ResourceControlID(endpointID portainer.EndpointID, name string) string {
+	return fmt.Sprintf("%d_%s", endpointID, name)
+}
+
+// convert string to valid kubernetes label by replacing invalid characters with periods and removing any periods at the beginning or end of the string
+func SanitizeLabel(value string) string {
+	re := regexp.MustCompile(`[^A-Za-z0-9\.\-\_]+`)
+	onlyAllowedCharacterString := re.ReplaceAllString(value, ".")
+	return strings.Trim(onlyAllowedCharacterString, ".-_")
+}
+
+// IsRelativePathStack checks if the stack is a git stack or not
+func IsRelativePathStack(stack *portainer.Stack) bool {
+	// Always return false in CE
+	// This function is only for code consistency with EE
+	return false
+}
diff --git a/api/stacks/stackutils/util_test.go b/api/stacks/stackutils/util_test.go
new file mode 100644
index 0000000..ea2873e
--- /dev/null
+++ b/api/stacks/stackutils/util_test.go
@@ -0,0 +1,27 @@
+package stackutils
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_GetStackFilePaths(t *testing.T) {
+	t.Parallel()
+	stack := &portainer.Stack{
+		ProjectPath: "/tmp/stack/1",
+		EntryPoint:  "file-one.yml",
+	}
+
+	t.Run("stack doesn't have additional files", func(t *testing.T) {
+		expected := []string{"/tmp/stack/1/file-one.yml"}
+		assert.ElementsMatch(t, expected, GetStackFilePaths(stack, true))
+	})
+
+	t.Run("stack has additional files", func(t *testing.T) {
+		stack.AdditionalFiles = []string{"file-two.yml", "file-three.yml"}
+		expected := []string{"/tmp/stack/1/file-one.yml", "/tmp/stack/1/file-two.yml", "/tmp/stack/1/file-three.yml"}
+		assert.ElementsMatch(t, expected, GetStackFilePaths(stack, true))
+	})
+}
diff --git a/api/stacks/stackutils/validation.go b/api/stacks/stackutils/validation.go
new file mode 100644
index 0000000..9f74ac1
--- /dev/null
+++ b/api/stacks/stackutils/validation.go
@@ -0,0 +1,186 @@
+package stackutils
+
+import (
+	"context"
+	"fmt"
+	"path"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/filesystem"
+	"github.com/portainer/portainer/pkg/libhttp/ssrf"
+
+	composeloader "github.com/compose-spec/compose-go/v2/loader"
+	composetypes "github.com/compose-spec/compose-go/v2/types"
+	"github.com/pkg/errors"
+)
+
+type StackFileValidationConfig struct {
+	Content          []byte
+	SecuritySettings *portainer.EndpointSecuritySettings
+	Env              map[string]string
+	WorkingDir       string
+}
+
+func IsValidStackFile(config StackFileValidationConfig) error {
+	composeConfigDetails := composetypes.ConfigDetails{
+		ConfigFiles: []composetypes.ConfigFile{{Content: config.Content}},
+		Environment: config.Env,
+		WorkingDir:  config.WorkingDir,
+	}
+
+	composeConfig, err := composeloader.LoadWithContext(context.Background(), composeConfigDetails, composeloader.WithSkipValidation)
+	if err != nil {
+		return err
+	}
+
+	for _, service := range composeConfig.Services {
+		if !config.SecuritySettings.AllowBindMountsForRegularUsers {
+			for _, volume := range service.Volumes {
+				if volume.Type == "bind" {
+					return errors.New("bind-mount disabled for non administrator users")
+				}
+			}
+		}
+
+		if !config.SecuritySettings.AllowPrivilegedModeForRegularUsers && service.Privileged {
+			return errors.New("privileged mode disabled for non administrator users")
+		}
+
+		if !config.SecuritySettings.AllowHostNamespaceForRegularUsers && service.Pid == "host" {
+			return errors.New("pid host disabled for non administrator users")
+		}
+
+		if !config.SecuritySettings.AllowDeviceMappingForRegularUsers && len(service.Devices) > 0 {
+			return errors.New("device mapping disabled for non administrator users")
+		}
+
+		if !config.SecuritySettings.AllowSysctlSettingForRegularUsers && len(service.Sysctls) > 0 {
+			return errors.New("sysctl setting disabled for non administrator users")
+		}
+
+		if !config.SecuritySettings.AllowSecurityOptForRegularUsers && len(service.SecurityOpt) > 0 {
+			return errors.New("security-opt setting disabled for non administrator users")
+		}
+
+		if !config.SecuritySettings.AllowContainerCapabilitiesForRegularUsers && (len(service.CapAdd) > 0 || len(service.CapDrop) > 0) {
+			return errors.New("container capabilities disabled for non administrator users")
+		}
+	}
+
+	return nil
+}
+
+// ValidateComposeURLs parses each stack file and checks that every external URL
+// (build contexts and image registry hostnames) is permitted by the active SSRF
+// policy. It is a no-op when SSRF protection is disabled.
+func ValidateComposeURLs(ctx context.Context, stack *portainer.Stack, fileService portainer.FileService) error {
+	if !ssrf.IsEnabled() {
+		return nil
+	}
+
+	env := BuildEnvMap(stack)
+	workingDir := filesystem.JoinPaths(stack.ProjectPath, path.Dir(stack.EntryPoint))
+
+	for _, file := range GetStackFilePaths(stack, false) {
+		stackContent, err := fileService.GetFileContent(stack.ProjectPath, file)
+		if err != nil {
+			return errors.Wrap(err, "failed to get stack file content")
+		}
+
+		if err := checkComposeFileURLs(ctx, stackContent, env, workingDir); err != nil {
+			return errors.Wrap(err, "stack file contains a URL blocked by the SSRF policy")
+		}
+	}
+
+	return nil
+}
+
+// ValidateEdgeStackComposeContent checks that every external URL in an edge
+// stack's Compose file is permitted by the active SSRF policy. It is a no-op
+// when SSRF protection is disabled or the deployment type is not compose.
+func ValidateEdgeStackComposeContent(ctx context.Context, deploymentType portainer.EdgeStackDeploymentType, content []byte) error {
+	if !ssrf.IsEnabled() || deploymentType != portainer.EdgeStackDeploymentCompose {
+		return nil
+	}
+
+	if err := checkComposeFileURLs(ctx, content, nil, ""); err != nil {
+		return errors.Wrap(err, "stack file contains a URL blocked by the SSRF policy")
+	}
+
+	return nil
+}
+
+func checkComposeFileURLs(ctx context.Context, content []byte, env map[string]string, workingDir string) error {
+	composeConfigDetails := composetypes.ConfigDetails{
+		ConfigFiles: []composetypes.ConfigFile{{Content: content}},
+		Environment: env,
+		WorkingDir:  workingDir,
+	}
+
+	composeConfig, err := composeloader.LoadWithContext(ctx, composeConfigDetails, composeloader.WithSkipValidation)
+	if err != nil {
+		return err
+	}
+
+	for _, service := range composeConfig.Services {
+		if service.Build != nil {
+			buildCtx := service.Build.Context
+			if strings.HasPrefix(buildCtx, "http://") || strings.HasPrefix(buildCtx, "https://") {
+				if err := ssrf.CheckURL(ctx, buildCtx); err != nil {
+					return fmt.Errorf("service %q: build context URL blocked: %w", service.Name, err)
+				}
+			}
+		}
+
+		if service.Image != "" {
+			if registry := extractImageRegistry(service.Image); registry != "" {
+				if err := ssrf.CheckURL(ctx, "https://"+registry); err != nil {
+					return fmt.Errorf("service %q: image registry %q blocked: %w", service.Name, registry, err)
+				}
+			}
+		}
+	}
+
+	return nil
+}
+
+// extractImageRegistry returns the registry hostname from an OCI image reference,
+// or an empty string if the image resolves to Docker Hub (no explicit registry).
+func extractImageRegistry(imageRef string) string {
+	ref, _, _ := strings.Cut(imageRef, "@")
+
+	first, _, hasSlash := strings.Cut(ref, "/")
+	if !hasSlash {
+		return ""
+	}
+
+	if strings.ContainsAny(first, ".:") || first == "localhost" {
+		return first
+	}
+
+	return ""
+}
+
+func ValidateStackFiles(stack *portainer.Stack, securitySettings *portainer.EndpointSecuritySettings, fileService portainer.FileService) error {
+	env := BuildEnvMap(stack)
+	workingDir := filesystem.JoinPaths(stack.ProjectPath, path.Dir(stack.EntryPoint))
+
+	for _, file := range GetStackFilePaths(stack, false) {
+		stackContent, err := fileService.GetFileContent(stack.ProjectPath, file)
+		if err != nil {
+			return errors.Wrap(err, "failed to get stack file content")
+		}
+
+		if err := IsValidStackFile(StackFileValidationConfig{
+			Content:          stackContent,
+			SecuritySettings: securitySettings,
+			Env:              env,
+			WorkingDir:       workingDir,
+		}); err != nil {
+			return errors.Wrap(err, "stack config file is invalid")
+		}
+	}
+
+	return nil
+}
diff --git a/api/stacks/stackutils/validation_test.go b/api/stacks/stackutils/validation_test.go
new file mode 100644
index 0000000..9f02073
--- /dev/null
+++ b/api/stacks/stackutils/validation_test.go
@@ -0,0 +1,456 @@
+package stackutils
+
+import (
+	"os"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/filesystem"
+	"github.com/portainer/portainer/pkg/libhttp/ssrf"
+	"github.com/stretchr/testify/require"
+)
+
+func TestIsValidStackFile_DefaultPortEnvSubstitution(t *testing.T) {
+	t.Parallel()
+	yamlContent := []byte(`
+version: "3"
+
+services:
+  webservice:
+    image: nginx
+    container_name: hello-world
+    networks:
+      - "mynet1"
+    ports:
+      - "${PORT:-8080}:80"
+
+networks:
+  mynet1:
+    driver: bridge
+    ipam:
+      config:
+        - subnet: 172.16.0.0/24
+`)
+
+	securitySettings := &portainer.EndpointSecuritySettings{}
+	err := IsValidStackFile(StackFileValidationConfig{
+		Content:          yamlContent,
+		SecuritySettings: securitySettings,
+	})
+	require.NoError(t, err)
+}
+
+// TestIsValidStackFile_MissingEnvVarBehavior documents how port variable position affects
+// validation when the env var is not provided. Docker accepts an empty host port (left side)
+// but requires a valid container port (right side).
+func TestIsValidStackFile_MissingEnvVarBehavior(t *testing.T) {
+	t.Parallel()
+	securitySettings := &portainer.EndpointSecuritySettings{}
+
+	t.Run("var on left side only passes (docker allows :9090)", func(t *testing.T) {
+		err := IsValidStackFile(StackFileValidationConfig{
+			Content: []byte(`
+version: "3"
+services:
+  api:
+    image: nginx
+    ports:
+      - "${API_PORT}:9090"
+`),
+			SecuritySettings: securitySettings,
+		})
+		require.NoError(t, err)
+	})
+
+	t.Run("var on right side fails", func(t *testing.T) {
+		err := IsValidStackFile(StackFileValidationConfig{
+			Content: []byte(`
+version: "3"
+services:
+  api:
+    image: nginx
+    ports:
+      - "9090:${API_PORT}"
+`),
+			SecuritySettings: securitySettings,
+		})
+		require.Error(t, err)
+	})
+
+	t.Run("var on both sides fails", func(t *testing.T) {
+		err := IsValidStackFile(StackFileValidationConfig{
+			Content: []byte(`
+version: "3"
+services:
+  api:
+    image: nginx
+    ports:
+      - "${API_PORT}:${API_PORT}"
+`),
+			SecuritySettings: securitySettings,
+		})
+		require.Error(t, err)
+	})
+}
+
+func TestIsValidStackFile_EnvVarInBothPortFields(t *testing.T) {
+	t.Parallel()
+	securitySettings := &portainer.EndpointSecuritySettings{}
+	err := IsValidStackFile(StackFileValidationConfig{
+		Content: []byte(`
+version: "3"
+
+services:
+  api:
+    image: nginx
+    ports:
+      - "${API_PORT}:${API_PORT}"
+`),
+		SecuritySettings: securitySettings,
+		Env:              map[string]string{"API_PORT": "3000"},
+	})
+	require.NoError(t, err)
+}
+
+type mockFileService struct {
+	portainer.FileService
+	fileContent        []byte
+	projectVersionPath string
+}
+
+func (m mockFileService) GetFileContent(trustedRootPath, filePath string) ([]byte, error) {
+	return m.fileContent, nil
+}
+
+func (m mockFileService) FormProjectPathByVersion(projectPath string, version int, commitHash string) string {
+	return m.projectVersionPath
+}
+
+func TestValidateStackFiles_EnvVars(t *testing.T) {
+	t.Parallel()
+	fileContent := []byte(`
+version: "3"
+
+services:
+  api:
+    image: nginx
+    ports:
+      - "${API_PORT}:${API_PORT}"
+`)
+
+	stack := &portainer.Stack{
+		ProjectPath: "/tmp/stack/1",
+		EntryPoint:  "docker-compose.yml",
+		Env:         []portainer.Pair{{Name: "API_PORT", Value: "3000"}},
+	}
+
+	fileService := mockFileService{
+		fileContent:        fileContent,
+		projectVersionPath: "/tmp/stack/1",
+	}
+
+	securitySettings := &portainer.EndpointSecuritySettings{}
+	err := ValidateStackFiles(stack, securitySettings, fileService)
+	require.NoError(t, err)
+}
+
+func TestValidateStackFiles_OSEnvVar(t *testing.T) {
+	t.Setenv("HOST_PORT", "3000")
+
+	fileContent := []byte(`
+version: "3"
+services:
+  api:
+    image: nginx
+    ports:
+      - "80:${HOST_PORT}"
+`)
+
+	stack := &portainer.Stack{
+		ProjectPath: "/tmp/stack/1",
+		EntryPoint:  "docker-compose.yml",
+	}
+
+	fileService := mockFileService{
+		fileContent:        fileContent,
+		projectVersionPath: "/tmp/stack/1",
+	}
+
+	securitySettings := &portainer.EndpointSecuritySettings{}
+	err := ValidateStackFiles(stack, securitySettings, fileService)
+	require.NoError(t, err)
+}
+
+func TestValidateStackFiles_DotEnvFile(t *testing.T) {
+	t.Parallel()
+	tmpDir := t.TempDir()
+
+	err := os.WriteFile(filesystem.JoinPaths(tmpDir, ".env"), []byte("HOST_PORT=3000\n"), 0o600)
+	require.NoError(t, err)
+
+	fileContent := []byte(`
+version: "3"
+services:
+  api:
+    image: nginx
+    ports:
+      - "80:${HOST_PORT}"
+`)
+
+	stack := &portainer.Stack{
+		ProjectPath: tmpDir,
+		EntryPoint:  "docker-compose.yml",
+	}
+
+	fileService := mockFileService{
+		fileContent:        fileContent,
+		projectVersionPath: tmpDir,
+	}
+
+	securitySettings := &portainer.EndpointSecuritySettings{}
+	err = ValidateStackFiles(stack, securitySettings, fileService)
+	require.NoError(t, err)
+}
+
+func TestValidateStackFiles_EnvFileAttribute(t *testing.T) {
+	t.Parallel()
+	tmpDir := t.TempDir()
+
+	err := os.WriteFile(filesystem.JoinPaths(tmpDir, "web.env"), []byte("HOST_PORT=3000\n"), 0o600)
+	require.NoError(t, err)
+
+	fileContent := []byte(`
+version: "3"
+services:
+  api:
+    image: nginx
+    env_file:
+      - ./web.env
+`)
+
+	stack := &portainer.Stack{
+		ProjectPath: tmpDir,
+		EntryPoint:  "docker-compose.yml",
+	}
+
+	fileService := mockFileService{
+		fileContent:        fileContent,
+		projectVersionPath: tmpDir,
+	}
+
+	securitySettings := &portainer.EndpointSecuritySettings{}
+	err = ValidateStackFiles(stack, securitySettings, fileService)
+	require.NoError(t, err)
+}
+
+func TestValidateStackFiles_BindMountBlockedForNonAdmin(t *testing.T) {
+	t.Parallel()
+	fileContent := []byte(`
+version: "3"
+
+services:
+  api:
+    image: nginx
+    volumes:
+      - /host/path:/container/path
+`)
+
+	stack := &portainer.Stack{
+		ProjectPath: "/tmp/stack/1",
+		EntryPoint:  "docker-compose.yml",
+	}
+
+	fileService := mockFileService{
+		fileContent:        fileContent,
+		projectVersionPath: "/tmp/stack/1",
+	}
+
+	securitySettings := &portainer.EndpointSecuritySettings{
+		AllowBindMountsForRegularUsers: false,
+	}
+	err := ValidateStackFiles(stack, securitySettings, fileService)
+	require.ErrorContains(t, err, "bind-mount disabled for non administrator users")
+}
+
+func TestExtractImageRegistry(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		image    string
+		expected string
+	}{
+		{"nginx", ""},
+		{"nginx:latest", ""},
+		{"library/nginx", ""},
+		{"ghcr.io/owner/image:tag", "ghcr.io"},
+		{"myregistry.com/image:tag", "myregistry.com"},
+		{"myregistry.com:5000/image:tag", "myregistry.com:5000"},
+		{"localhost/image:tag", "localhost"},
+		{"localhost:5000/image:tag", "localhost:5000"},
+		{"myregistry.com/image@sha256:abc", "myregistry.com"},
+		{"169.254.169.254/image:tag", "169.254.169.254"},
+	}
+
+	for _, tc := range cases {
+		got := extractImageRegistry(tc.image)
+		require.Equal(t, tc.expected, got, "image: %s", tc.image)
+	}
+}
+
+type staticAllowListService struct {
+	parsed portainer.ParsedAllowList
+}
+
+func (s *staticAllowListService) ReadParsed(id portainer.AllowListKey) (*portainer.ParsedAllowList, error) {
+	return &s.parsed, nil
+}
+
+func configureSSRF(t *testing.T, mode portainer.SSRFMode, entries []string) {
+	t.Helper()
+
+	parsed := ssrf.ParseAllowedHosts(entries)
+	parsed.Mode = mode
+	err := ssrf.Configure(&staticAllowListService{parsed: parsed})
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		err := ssrf.Configure(&staticAllowListService{})
+		require.NoError(t, err)
+	})
+}
+
+func TestValidateComposeURLs_DisabledSSRF(t *testing.T) {
+	configureSSRF(t, portainer.SSRFModeOff, nil)
+
+	stack := &portainer.Stack{
+		ProjectPath: "/tmp/stack/1",
+		EntryPoint:  "docker-compose.yml",
+	}
+
+	fileService := mockFileService{
+		fileContent: []byte(`
+version: "3"
+services:
+  web:
+    build:
+      context: http://169.254.169.254/repo.tar.gz
+`),
+		projectVersionPath: "/tmp/stack/1",
+	}
+
+	err := ValidateComposeURLs(t.Context(), stack, fileService)
+	require.NoError(t, err)
+}
+
+func TestValidateComposeURLs_BuildContextBlocked(t *testing.T) {
+	configureSSRF(t, portainer.SSRFModeEnforce, []string{"example.com"})
+
+	stack := &portainer.Stack{
+		ProjectPath: "/tmp/stack/1",
+		EntryPoint:  "docker-compose.yml",
+	}
+
+	fileService := mockFileService{
+		fileContent: []byte(`
+version: "3"
+services:
+  web:
+    build:
+      context: http://169.254.169.254/repo.tar.gz
+    image: nginx
+`),
+		projectVersionPath: "/tmp/stack/1",
+	}
+
+	err := ValidateComposeURLs(t.Context(), stack, fileService)
+	require.ErrorContains(t, err, "SSRF policy")
+}
+
+func TestValidateComposeURLs_BuildContextPath(t *testing.T) {
+	configureSSRF(t, portainer.SSRFModeEnforce, []string{"example.com"})
+
+	stack := &portainer.Stack{
+		ProjectPath: "/tmp/stack/1",
+		EntryPoint:  "docker-compose.yml",
+	}
+
+	fileService := mockFileService{
+		fileContent: []byte(`
+version: "3"
+services:
+  web:
+    build:
+      context: ./app
+    image: nginx
+`),
+		projectVersionPath: "/tmp/stack/1",
+	}
+
+	err := ValidateComposeURLs(t.Context(), stack, fileService)
+	require.NoError(t, err)
+}
+
+func TestValidateComposeURLs_ImageRegistryBlocked(t *testing.T) {
+	configureSSRF(t, portainer.SSRFModeEnforce, []string{"example.com"})
+
+	stack := &portainer.Stack{
+		ProjectPath: "/tmp/stack/1",
+		EntryPoint:  "docker-compose.yml",
+	}
+
+	fileService := mockFileService{
+		fileContent: []byte(`
+version: "3"
+services:
+  web:
+    image: 169.254.169.254/myimage:latest
+`),
+		projectVersionPath: "/tmp/stack/1",
+	}
+
+	err := ValidateComposeURLs(t.Context(), stack, fileService)
+	require.ErrorContains(t, err, "SSRF policy")
+}
+
+func TestValidateComposeURLs_ImageRegistryAllowed(t *testing.T) {
+	configureSSRF(t, portainer.SSRFModeEnforce, []string{"myregistry.com"})
+
+	stack := &portainer.Stack{
+		ProjectPath: "/tmp/stack/1",
+		EntryPoint:  "docker-compose.yml",
+	}
+
+	fileService := mockFileService{
+		fileContent: []byte(`
+version: "3"
+services:
+  web:
+    image: myregistry.com/myimage:latest
+`),
+		projectVersionPath: "/tmp/stack/1",
+	}
+
+	err := ValidateComposeURLs(t.Context(), stack, fileService)
+	require.NoError(t, err)
+}
+
+func TestValidateComposeURLs_DockerHubImageAllowed(t *testing.T) {
+	configureSSRF(t, portainer.SSRFModeEnforce, []string{"example.com"})
+
+	stack := &portainer.Stack{
+		ProjectPath: "/tmp/stack/1",
+		EntryPoint:  "docker-compose.yml",
+	}
+
+	fileService := mockFileService{
+		fileContent: []byte(`
+version: "3"
+services:
+  web:
+    image: nginx:latest
+`),
+		projectVersionPath: "/tmp/stack/1",
+	}
+
+	err := ValidateComposeURLs(t.Context(), stack, fileService)
+	require.NoError(t, err)
+}
diff --git a/api/swagger_config.json b/api/swagger_config.json
new file mode 100644
index 0000000..240c90d
--- /dev/null
+++ b/api/swagger_config.json
@@ -0,0 +1,5 @@
+{
+  "packageName": "portainer",
+  "packageVersion": "2.0.0",
+  "projectName": "portainer"
+}
diff --git a/api/tag/tag.go b/api/tag/tag.go
new file mode 100644
index 0000000..3b6d080
--- /dev/null
+++ b/api/tag/tag.go
@@ -0,0 +1,75 @@
+package tag
+
+import (
+	portainer "github.com/portainer/portainer/api"
+)
+
+type tagSet map[portainer.TagID]struct{}
+
+// Set converts an array of ids to a set
+func Set(tagIDs []portainer.TagID) tagSet {
+	set := map[portainer.TagID]struct{}{}
+	for _, tagID := range tagIDs {
+		set[tagID] = struct{}{}
+	}
+
+	return set
+}
+
+// IntersectionCount returns the element count of the intersection of the sets
+func IntersectionCount(setA, setB tagSet) int {
+	if len(setA) > len(setB) {
+		setA, setB = setB, setA
+	}
+
+	count := 0
+
+	for tag := range setA {
+		if _, ok := setB[tag]; ok {
+			count++
+		}
+	}
+
+	return count
+}
+
+// Union returns a set union of provided sets
+func Union(sets ...tagSet) tagSet {
+	union := tagSet{}
+
+	for _, set := range sets {
+		for tag := range set {
+			union[tag] = struct{}{}
+		}
+	}
+
+	return union
+}
+
+// Contains return true if setA contains setB
+func Contains(setA tagSet, setB []portainer.TagID) bool {
+	if len(setA) == 0 || len(setB) == 0 {
+		return false
+	}
+
+	for _, tag := range setB {
+		if _, ok := setA[tag]; !ok {
+			return false
+		}
+	}
+
+	return true
+}
+
+// Difference returns the set difference tagsA - tagsB
+func Difference(setA tagSet, setB tagSet) tagSet {
+	set := tagSet{}
+
+	for tag := range setA {
+		if _, ok := setB[tag]; !ok {
+			set[tag] = struct{}{}
+		}
+	}
+
+	return set
+}
diff --git a/api/tag/tag_match.go b/api/tag/tag_match.go
new file mode 100644
index 0000000..fadd02d
--- /dev/null
+++ b/api/tag/tag_match.go
@@ -0,0 +1,19 @@
+package tag
+
+import portainer "github.com/portainer/portainer/api"
+
+// FullMatch returns true if environment tags matches all edge group tags
+func FullMatch(edgeGroupTags []portainer.TagID, environmentTags tagSet) bool {
+	return Contains(environmentTags, edgeGroupTags)
+}
+
+// PartialMatch returns true if environment tags matches at least one edge group tag
+func PartialMatch(edgeGroupTags []portainer.TagID, environmentTags tagSet) bool {
+	for _, tagID := range edgeGroupTags {
+		if _, ok := environmentTags[tagID]; ok {
+			return true
+		}
+	}
+
+	return false
+}
diff --git a/api/tag/tag_match_test.go b/api/tag/tag_match_test.go
new file mode 100644
index 0000000..651f6dc
--- /dev/null
+++ b/api/tag/tag_match_test.go
@@ -0,0 +1,137 @@
+package tag
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+)
+
+func TestFullMatch(t *testing.T) {
+	t.Parallel()
+	cases := []struct {
+		name           string
+		edgeGroupTags  []portainer.TagID
+		environmentTag tagSet
+		expected       bool
+	}{
+		{
+			name:           "environment tag partially match edge group tags",
+			edgeGroupTags:  []portainer.TagID{1, 2, 3},
+			environmentTag: Set([]portainer.TagID{1, 2}),
+			expected:       false,
+		},
+		{
+			name:           "edge group tags equal to environment tags",
+			edgeGroupTags:  []portainer.TagID{1, 2},
+			environmentTag: Set([]portainer.TagID{1, 2}),
+			expected:       true,
+		},
+		{
+			name:           "environment tags fully match edge group tags",
+			edgeGroupTags:  []portainer.TagID{1, 2},
+			environmentTag: Set([]portainer.TagID{1, 2, 3}),
+			expected:       true,
+		},
+		{
+			name:           "environment tags do not match edge group tags",
+			edgeGroupTags:  []portainer.TagID{1, 2},
+			environmentTag: Set([]portainer.TagID{3, 4}),
+			expected:       false,
+		},
+		{
+			name:           "edge group has no tags and environment has tags",
+			edgeGroupTags:  []portainer.TagID{},
+			environmentTag: Set([]portainer.TagID{1, 2}),
+			expected:       false,
+		},
+		{
+			name:           "edge group has tags and environment has no tags",
+			edgeGroupTags:  []portainer.TagID{1, 2},
+			environmentTag: Set([]portainer.TagID{}),
+			expected:       false,
+		},
+		{
+			name:           "both edge group and environment have no tags",
+			edgeGroupTags:  []portainer.TagID{},
+			environmentTag: Set([]portainer.TagID{}),
+			expected:       false,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			result := FullMatch(tc.edgeGroupTags, tc.environmentTag)
+			if result != tc.expected {
+				t.Errorf("Expected %v, got %v", tc.expected, result)
+			}
+		})
+	}
+}
+
+func TestPartialMatch(t *testing.T) {
+	t.Parallel()
+	cases := []struct {
+		name           string
+		edgeGroupTags  []portainer.TagID
+		environmentTag tagSet
+		expected       bool
+	}{
+		{
+			name:           "environment tags partially match edge group tags 1",
+			edgeGroupTags:  []portainer.TagID{1, 2, 3},
+			environmentTag: Set([]portainer.TagID{1, 2}),
+			expected:       true,
+		},
+		{
+			name:           "environment tags partially match edge group tags 2",
+			edgeGroupTags:  []portainer.TagID{1, 2, 3},
+			environmentTag: Set([]portainer.TagID{1, 4, 5}),
+			expected:       true,
+		},
+		{
+			name:           "edge group tags equal to environment tags",
+			edgeGroupTags:  []portainer.TagID{1, 2},
+			environmentTag: Set([]portainer.TagID{1, 2}),
+			expected:       true,
+		},
+		{
+			name:           "environment tags fully match edge group tags",
+			edgeGroupTags:  []portainer.TagID{1, 2},
+			environmentTag: Set([]portainer.TagID{1, 2, 3}),
+			expected:       true,
+		},
+		{
+			name:           "environment tags do not match edge group tags",
+			edgeGroupTags:  []portainer.TagID{1, 2},
+			environmentTag: Set([]portainer.TagID{3, 4}),
+			expected:       false,
+		},
+		{
+			name:           "edge group has no tags and environment has tags",
+			edgeGroupTags:  []portainer.TagID{},
+			environmentTag: Set([]portainer.TagID{1, 2}),
+			expected:       false,
+		},
+		{
+			name:           "edge group has tags and environment has no tags",
+			edgeGroupTags:  []portainer.TagID{1, 2},
+			environmentTag: Set([]portainer.TagID{}),
+			expected:       false,
+		},
+		{
+			name:           "both edge group and environment have no tags",
+			edgeGroupTags:  []portainer.TagID{},
+			environmentTag: Set([]portainer.TagID{}),
+			expected:       false,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			result := PartialMatch(tc.edgeGroupTags, tc.environmentTag)
+			if result != tc.expected {
+				t.Errorf("Expected %v, got %v", tc.expected, result)
+			}
+		})
+	}
+}
diff --git a/api/tag/tag_test.go b/api/tag/tag_test.go
new file mode 100644
index 0000000..07c9c8c
--- /dev/null
+++ b/api/tag/tag_test.go
@@ -0,0 +1,208 @@
+package tag
+
+import (
+	"reflect"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+)
+
+func TestIntersectionCount(t *testing.T) {
+	t.Parallel()
+	cases := []struct {
+		name     string
+		setA     tagSet
+		setB     tagSet
+		expected int
+	}{
+		{
+			name:     "positive numbers set intersection",
+			setA:     Set([]portainer.TagID{1, 2, 3, 4, 5}),
+			setB:     Set([]portainer.TagID{4, 5, 6, 7}),
+			expected: 2,
+		},
+		{
+			name:     "empty setA intersection",
+			setA:     Set([]portainer.TagID{1, 2, 3}),
+			setB:     Set([]portainer.TagID{}),
+			expected: 0,
+		},
+		{
+			name:     "empty setB intersection",
+			setA:     Set([]portainer.TagID{}),
+			setB:     Set([]portainer.TagID{1, 2, 3}),
+			expected: 0,
+		},
+		{
+			name:     "no common elements sets intersection",
+			setA:     Set([]portainer.TagID{1, 2, 3}),
+			setB:     Set([]portainer.TagID{4, 5, 6}),
+			expected: 0,
+		},
+		{
+			name:     "equal sets intersection",
+			setA:     Set([]portainer.TagID{1, 2, 3}),
+			setB:     Set([]portainer.TagID{1, 2, 3}),
+			expected: 3,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			result := IntersectionCount(tc.setA, tc.setB)
+			if result != tc.expected {
+				t.Errorf("Expected %v, got %v", tc.expected, result)
+			}
+		})
+	}
+}
+
+func TestUnion(t *testing.T) {
+	t.Parallel()
+	cases := []struct {
+		name     string
+		setA     tagSet
+		setB     tagSet
+		expected tagSet
+	}{
+		{
+			name:     "non-duplicate set union",
+			setA:     Set([]portainer.TagID{1, 2, 3}),
+			setB:     Set([]portainer.TagID{4, 5, 6}),
+			expected: Set([]portainer.TagID{1, 2, 3, 4, 5, 6}),
+		},
+		{
+			name:     "empty setA union",
+			setA:     Set([]portainer.TagID{1, 2, 3}),
+			setB:     Set([]portainer.TagID{}),
+			expected: Set([]portainer.TagID{1, 2, 3}),
+		},
+		{
+			name:     "empty setB union",
+			setA:     Set([]portainer.TagID{}),
+			setB:     Set([]portainer.TagID{1, 2, 3}),
+			expected: Set([]portainer.TagID{1, 2, 3}),
+		},
+		{
+			name:     "duplicate elements in set union",
+			setA:     Set([]portainer.TagID{1, 2, 3}),
+			setB:     Set([]portainer.TagID{3, 4, 5}),
+			expected: Set([]portainer.TagID{1, 2, 3, 4, 5}),
+		},
+		{
+			name:     "equal sets union",
+			setA:     Set([]portainer.TagID{1, 2, 3}),
+			setB:     Set([]portainer.TagID{1, 2, 3}),
+			expected: Set([]portainer.TagID{1, 2, 3}),
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			result := Union(tc.setA, tc.setB)
+			if !reflect.DeepEqual(result, tc.expected) {
+				t.Errorf("Expected %v, got %v", tc.expected, result)
+			}
+		})
+	}
+}
+
+func TestContains(t *testing.T) {
+	t.Parallel()
+	cases := []struct {
+		name     string
+		setA     tagSet
+		setB     []portainer.TagID
+		expected bool
+	}{
+		{
+			name:     "setA contains setB",
+			setA:     Set([]portainer.TagID{1, 2, 3}),
+			setB:     []portainer.TagID{1, 2},
+			expected: true,
+		},
+		{
+			name:     "setA equals to setB",
+			setA:     Set([]portainer.TagID{1, 2}),
+			setB:     []portainer.TagID{1, 2},
+			expected: true,
+		},
+		{
+			name:     "setA contains parts of setB",
+			setA:     Set([]portainer.TagID{1, 2}),
+			setB:     []portainer.TagID{1, 2, 3},
+			expected: false,
+		},
+		{
+			name:     "setA does not contain setB",
+			setA:     Set([]portainer.TagID{1, 2}),
+			setB:     []portainer.TagID{3, 4},
+			expected: false,
+		},
+		{
+			name:     "setA is empty and setB is not empty",
+			setA:     Set([]portainer.TagID{}),
+			setB:     []portainer.TagID{1, 2},
+			expected: false,
+		},
+		{
+			name:     "setA is not empty and setB is empty",
+			setA:     Set([]portainer.TagID{1, 2}),
+			setB:     []portainer.TagID{},
+			expected: false,
+		},
+		{
+			name:     "setA is empty and setB is empty",
+			setA:     Set([]portainer.TagID{}),
+			setB:     []portainer.TagID{},
+			expected: false,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			result := Contains(tc.setA, tc.setB)
+			if result != tc.expected {
+				t.Errorf("Expected %v, got %v", tc.expected, result)
+			}
+		})
+	}
+}
+
+func TestDifference(t *testing.T) {
+	t.Parallel()
+	cases := []struct {
+		name     string
+		setA     tagSet
+		setB     tagSet
+		expected tagSet
+	}{
+		{
+			name:     "positive numbers set difference",
+			setA:     Set([]portainer.TagID{1, 2, 3, 4, 5}),
+			setB:     Set([]portainer.TagID{4, 5, 6, 7}),
+			expected: Set([]portainer.TagID{1, 2, 3}),
+		},
+		{
+			name:     "empty set difference",
+			setA:     Set([]portainer.TagID{1, 2, 3}),
+			setB:     Set([]portainer.TagID{}),
+			expected: Set([]portainer.TagID{1, 2, 3}),
+		},
+		{
+			name:     "equal sets difference",
+			setA:     Set([]portainer.TagID{1, 2, 3}),
+			setB:     Set([]portainer.TagID{1, 2, 3}),
+			expected: Set([]portainer.TagID{}),
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			result := Difference(tc.setA, tc.setB)
+			if !reflect.DeepEqual(result, tc.expected) {
+				t.Errorf("Expected %v, got %v", tc.expected, result)
+			}
+		})
+	}
+}
diff --git a/api/uac/configs.go b/api/uac/configs.go
new file mode 100644
index 0000000..e1ed14d
--- /dev/null
+++ b/api/uac/configs.go
@@ -0,0 +1,30 @@
+package uac
+
+import (
+	"github.com/docker/docker/api/types/swarm"
+	portainer "github.com/portainer/portainer/api"
+)
+
+func ConfigResourceControlGetter[
+	TX txLike[RCS, TS, US],
+	RCS rcServiceLike,
+	TS teamServiceLike,
+	US userServiceLike,
+](
+	tx TX,
+	endpointID portainer.EndpointID,
+) func(item swarm.Config) (*portainer.ResourceControl, error) {
+	return genericResourcControlGetter(tx, endpointID, ResourceContext[swarm.Config]{
+		RCType:       portainer.ConfigResourceControl,
+		IDGetter:     ConfigResourceControlID,
+		LabelsGetter: ConfigLabels,
+	})
+}
+
+func ConfigResourceControlID(item swarm.Config) string {
+	return item.ID
+}
+
+func ConfigLabels(item swarm.Config) map[string]string {
+	return item.Spec.Labels
+}
diff --git a/api/uac/configs_test.go b/api/uac/configs_test.go
new file mode 100644
index 0000000..f3b0059
--- /dev/null
+++ b/api/uac/configs_test.go
@@ -0,0 +1,71 @@
+package uac
+
+import (
+	"testing"
+
+	"github.com/docker/docker/api/types/swarm"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/docker/consts"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+	"github.com/stretchr/testify/require"
+)
+
+func TestConfigResourceControlGetter(t *testing.T) {
+	t.Parallel()
+	is := require.New(t)
+
+	ok, store := datastore.MustNewTestStore(t, true, false)
+	is.True(ok)
+	is.NotNil(store)
+
+	envID := portainer.EndpointID(1)
+	configID := "config"
+	stackName := "stack"
+	stackRCID := stackutils.ResourceControlID(envID, stackName)
+	serviceID := "service"
+
+	is.NoError(store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		is.NoError(tx.ResourceControl().Create(authorization.NewPublicResourceControl(configID, portainer.ConfigResourceControl)))
+		is.NoError(tx.ResourceControl().Create(authorization.NewPublicResourceControl(stackRCID, portainer.StackResourceControl)))
+		is.NoError(tx.ResourceControl().Create(authorization.NewPublicResourceControl(serviceID, portainer.ServiceResourceControl)))
+		return nil
+	}))
+
+	is.NoError(store.ViewTx(func(tx dataservices.DataStoreTx) error {
+		// by direct ID
+		rc, err := ConfigResourceControlGetter(tx, envID)(swarm.Config{ID: configID})
+		is.NoError(err)
+		is.NotNil(rc)
+		is.Equal(configID, rc.ResourceID)
+
+		// by compose stack label
+		rc, err = ConfigResourceControlGetter(tx, envID)(
+			swarm.Config{ID: "unknown", Spec: swarm.ConfigSpec{Annotations: swarm.Annotations{Labels: map[string]string{consts.ComposeStackNameLabel: stackName}}}},
+		)
+		is.NoError(err)
+		is.NotNil(rc)
+		is.Equal(stackRCID, rc.ResourceID)
+
+		// by swarm stack label
+		rc, err = ConfigResourceControlGetter(tx, envID)(
+			swarm.Config{ID: "unknown", Spec: swarm.ConfigSpec{Annotations: swarm.Annotations{Labels: map[string]string{consts.SwarmStackNameLabel: stackName}}}},
+		)
+		is.NoError(err)
+		is.NotNil(rc)
+		is.Equal(stackRCID, rc.ResourceID)
+
+		// by service ID
+		rc, err = ConfigResourceControlGetter(tx, envID)(
+			swarm.Config{ID: "unknown", Spec: swarm.ConfigSpec{Annotations: swarm.Annotations{Labels: map[string]string{consts.SwarmServiceIDLabel: serviceID}}}},
+		)
+		is.NoError(err)
+		is.NotNil(rc)
+		is.Equal(serviceID, rc.ResourceID)
+
+		return nil
+	}))
+
+}
diff --git a/api/uac/containergroup.go b/api/uac/containergroup.go
new file mode 100644
index 0000000..30fd6cd
--- /dev/null
+++ b/api/uac/containergroup.go
@@ -0,0 +1,4 @@
+package uac
+
+// TODO: implement UAC rules for Container groups
+// See usage of portainer.ContainerGroupResourceControl
diff --git a/api/uac/containers.go b/api/uac/containers.go
new file mode 100644
index 0000000..d7c551f
--- /dev/null
+++ b/api/uac/containers.go
@@ -0,0 +1,30 @@
+package uac
+
+import (
+	"github.com/docker/docker/api/types/container"
+	portainer "github.com/portainer/portainer/api"
+)
+
+func ContainerResourceControlGetter[
+	TX txLike[RCS, TS, US],
+	RCS rcServiceLike,
+	TS teamServiceLike,
+	US userServiceLike,
+](
+	tx TX,
+	endpointID portainer.EndpointID,
+) func(item container.Summary) (*portainer.ResourceControl, error) {
+	return genericResourcControlGetter(tx, endpointID, ResourceContext[container.Summary]{
+		RCType:       portainer.ContainerResourceControl,
+		IDGetter:     ContainerResourceControlID,
+		LabelsGetter: ContainerLabels,
+	})
+}
+
+func ContainerResourceControlID(item container.Summary) string {
+	return item.ID
+}
+
+func ContainerLabels(item container.Summary) map[string]string {
+	return item.Labels
+}
diff --git a/api/uac/containers_test.go b/api/uac/containers_test.go
new file mode 100644
index 0000000..ec29be6
--- /dev/null
+++ b/api/uac/containers_test.go
@@ -0,0 +1,71 @@
+package uac
+
+import (
+	"testing"
+
+	"github.com/docker/docker/api/types/container"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/docker/consts"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+	"github.com/stretchr/testify/require"
+)
+
+func TestContainerResourceControlGetter(t *testing.T) {
+	t.Parallel()
+	is := require.New(t)
+
+	ok, store := datastore.MustNewTestStore(t, true, false)
+	is.True(ok)
+	is.NotNil(store)
+
+	envID := portainer.EndpointID(1)
+	containerID := "container"
+	stackName := "stack"
+	stackRCID := stackutils.ResourceControlID(envID, stackName)
+	serviceID := "service"
+
+	is.NoError(store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		is.NoError(tx.ResourceControl().Create(authorization.NewPublicResourceControl(containerID, portainer.ContainerResourceControl)))
+		is.NoError(tx.ResourceControl().Create(authorization.NewPublicResourceControl(stackRCID, portainer.StackResourceControl)))
+		is.NoError(tx.ResourceControl().Create(authorization.NewPublicResourceControl(serviceID, portainer.ServiceResourceControl)))
+		return nil
+	}))
+
+	is.NoError(store.ViewTx(func(tx dataservices.DataStoreTx) error {
+		// by direct ID
+		rc, err := ContainerResourceControlGetter(tx, envID)(container.Summary{ID: containerID})
+		is.NoError(err)
+		is.NotNil(rc)
+		is.Equal(containerID, rc.ResourceID)
+
+		// by compose stack label
+		rc, err = ContainerResourceControlGetter(tx, envID)(
+			container.Summary{ID: "unknown", Labels: map[string]string{consts.ComposeStackNameLabel: stackName}},
+		)
+		is.NoError(err)
+		is.NotNil(rc)
+		is.Equal(stackRCID, rc.ResourceID)
+
+		// by swarm stack label
+		rc, err = ContainerResourceControlGetter(tx, envID)(
+			container.Summary{ID: "unknown", Labels: map[string]string{consts.SwarmStackNameLabel: stackName}},
+		)
+		is.NoError(err)
+		is.NotNil(rc)
+		is.Equal(stackRCID, rc.ResourceID)
+
+		// by service ID
+		rc, err = ContainerResourceControlGetter(tx, envID)(
+			container.Summary{ID: "unknown", Labels: map[string]string{consts.SwarmServiceIDLabel: serviceID}},
+		)
+		is.NoError(err)
+		is.NotNil(rc)
+		is.Equal(serviceID, rc.ResourceID)
+
+		return nil
+	}))
+
+}
diff --git a/api/uac/custom_template.go b/api/uac/custom_template.go
new file mode 100644
index 0000000..12e998d
--- /dev/null
+++ b/api/uac/custom_template.go
@@ -0,0 +1,4 @@
+package uac
+
+// TODO: implement UAC rules for Custom templates
+// See usage of portainer.CustomTemplateResourceControl
diff --git a/api/uac/generic_rc_getter.go b/api/uac/generic_rc_getter.go
new file mode 100644
index 0000000..04ae933
--- /dev/null
+++ b/api/uac/generic_rc_getter.go
@@ -0,0 +1,184 @@
+package uac
+
+import (
+	"strings"
+
+	"github.com/docker/docker/api/types/swarm"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/docker/consts"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/slicesx"
+	"github.com/rs/zerolog/log"
+)
+
+type rcServiceLike interface {
+	ResourceControlByResourceIDAndType(resourceID string, resourceType portainer.ResourceControlType) (*portainer.ResourceControl, error)
+}
+
+type teamServiceLike interface {
+	TeamByName(name string) (*portainer.Team, error)
+}
+
+type userServiceLike interface {
+	UserIDByUsername(name string) (portainer.UserID, error)
+}
+
+type txLike[
+	RCS rcServiceLike,
+	TS teamServiceLike,
+	US userServiceLike,
+] interface {
+	ResourceControl() RCS
+	Team() TS
+	User() US
+}
+
+type ResourceContext[T any] struct {
+	RCType       portainer.ResourceControlType
+	IDGetter     func(T) string
+	LabelsGetter func(T) map[string]string
+}
+
+func genericResourcControlGetter[
+	T any,
+	TX txLike[RCS, TS, US],
+	RCS rcServiceLike,
+	TS teamServiceLike,
+	US userServiceLike,
+](
+	tx TX,
+	endpointID portainer.EndpointID,
+	context ResourceContext[T],
+) func(T) (*portainer.ResourceControl, error) {
+	return func(item T) (*portainer.ResourceControl, error) {
+		resourceID := context.IDGetter(item)
+		resourceType := context.RCType
+
+		if rc, err := tx.ResourceControl().ResourceControlByResourceIDAndType(
+			resourceID, resourceType,
+		); err != nil && !dataservices.IsErrObjectNotFound(err) {
+			return nil, err
+		} else if rc != nil {
+			return rc, nil
+		}
+
+		if context.LabelsGetter == nil {
+			return authorization.NewEmptyRestrictedResourceControl(resourceID, resourceType), nil
+		}
+
+		labels := context.LabelsGetter(item)
+		if labels == nil {
+			return authorization.NewEmptyRestrictedResourceControl(resourceID, resourceType), nil
+		}
+
+		if serviceId, ok := labels[consts.SwarmServiceIDLabel]; ok {
+			if rc, err := tx.ResourceControl().ResourceControlByResourceIDAndType(
+				ServiceResourceControlID(swarm.Service{ID: serviceId}),
+				portainer.ServiceResourceControl,
+			); err != nil && !dataservices.IsErrObjectNotFound(err) {
+				return nil, err
+			} else if rc != nil {
+				return rc, nil
+			}
+		}
+
+		if stackName, ok := labels[consts.SwarmStackNameLabel]; ok {
+			if rc, err := tx.ResourceControl().ResourceControlByResourceIDAndType(
+				StackResourceControlID(endpointID, stackName),
+				portainer.StackResourceControl,
+			); err != nil && !dataservices.IsErrObjectNotFound(err) {
+				return nil, err
+			} else if rc != nil {
+				return rc, nil
+			}
+		}
+
+		if stackName, ok := labels[consts.ComposeStackNameLabel]; ok {
+			if rc, err := tx.ResourceControl().ResourceControlByResourceIDAndType(
+				StackResourceControlID(endpointID, stackName),
+				portainer.StackResourceControl,
+			); err != nil && !dataservices.IsErrObjectNotFound(err) {
+				return nil, err
+			} else if rc != nil {
+				return rc, nil
+			}
+		}
+
+		return rcFromPortainerLabels(tx, labels, resourceID, resourceType)
+	}
+}
+
+const (
+	publicRCLabel = "io.portainer.accesscontrol.public"
+	userRCLabel   = "io.portainer.accesscontrol.users"
+	teamRCLabel   = "io.portainer.accesscontrol.teams"
+)
+
+// translation of rules from transport.newResourceControlFromPortainerLabels(resourceLabelsObject, resourceIdentifier, resourceType)
+func rcFromPortainerLabels[
+	TX txLike[RCS, TS, US],
+	RCS rcServiceLike,
+	TS teamServiceLike,
+	US userServiceLike,
+](
+	tx TX, labels map[string]string, resourceID string, resourceType portainer.ResourceControlType,
+) (*portainer.ResourceControl, error) {
+	if _, ok := labels[publicRCLabel]; ok {
+		return authorization.NewPublicResourceControl(resourceID, resourceType), nil
+	}
+
+	teamNames := make([]string, 0)
+	userNames := make([]string, 0)
+
+	if teams, ok := labels[teamRCLabel]; ok {
+		teamNames = getUniqueElements(teams)
+	}
+
+	if users, ok := labels[userRCLabel]; ok {
+		userNames = getUniqueElements(users)
+	}
+
+	if len(teamNames) == 0 && len(userNames) == 0 {
+		return authorization.NewEmptyRestrictedResourceControl(resourceID, resourceType), nil
+	}
+
+	teamIDs := make([]portainer.TeamID, 0)
+	userIDs := make([]portainer.UserID, 0)
+	for _, name := range teamNames {
+		team, err := tx.Team().TeamByName(name)
+		if err != nil {
+			log.Warn().
+				Str("name", name).
+				Str("resource_id", resourceID).
+				Msg("unknown team name in access control label, ignoring access control rule for this team")
+
+			continue
+		}
+
+		teamIDs = append(teamIDs, team.ID)
+	}
+
+	for _, name := range userNames {
+		userID, err := tx.User().UserIDByUsername(name)
+		if err != nil {
+			log.Warn().
+				Str("name", name).
+				Str("resource_id", resourceID).
+				Msg("unknown user name in access control label, ignoring access control rule for this user")
+			continue
+		}
+
+		userIDs = append(userIDs, userID)
+	}
+
+	return authorization.NewRestrictedResourceControl(resourceID, resourceType, userIDs, teamIDs), nil
+}
+
+func getUniqueElements(items string) []string {
+	xs := strings.Split(items, ",")
+	xs = slicesx.Map(xs, strings.TrimSpace)
+	xs = slicesx.FilterInPlace(xs, func(x string) bool { return len(x) > 0 })
+
+	return slicesx.Unique(xs)
+}
diff --git a/api/uac/generic_rc_getter_test.go b/api/uac/generic_rc_getter_test.go
new file mode 100644
index 0000000..93d0ffb
--- /dev/null
+++ b/api/uac/generic_rc_getter_test.go
@@ -0,0 +1,172 @@
+package uac
+
+import (
+	"testing"
+
+	"github.com/docker/docker/api/types/container"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/docker/consts"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGenericResourcControlGetter(t *testing.T) {
+	t.Parallel()
+	is := require.New(t)
+
+	ok, store := datastore.MustNewTestStore(t, true, false)
+	is.True(ok)
+	is.NotNil(store)
+
+	endpointID := portainer.EndpointID(1)
+	composeStackName := "compose-stack"
+	composeStackRCID := StackResourceControlID(endpointID, composeStackName)
+	swarmStackName := "swarm-stack"
+	swarmStackRCID := StackResourceControlID(endpointID, swarmStackName)
+	serviceID := "service"
+
+	err := store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		// created on container create
+		is.NoError(tx.ResourceControl().Create(authorization.NewPublicResourceControl("container", portainer.ContainerResourceControl)))
+		// created on compose stack create
+		is.NoError(tx.ResourceControl().Create(authorization.NewPublicResourceControl(composeStackRCID, portainer.StackResourceControl)))
+		// created on swarm stack create
+		is.NoError(tx.ResourceControl().Create(authorization.NewPublicResourceControl(swarmStackRCID, portainer.StackResourceControl)))
+		// created a swarm service create
+		is.NoError(tx.ResourceControl().Create(authorization.NewPublicResourceControl(serviceID, portainer.ServiceResourceControl)))
+		return nil
+	})
+	is.NoError(err)
+
+	err = store.ViewTx(func(tx dataservices.DataStoreTx) error {
+		context := ResourceContext[container.Summary]{RCType: portainer.ContainerResourceControl, IDGetter: ContainerResourceControlID, LabelsGetter: ContainerLabels}
+
+		// trying to get UAC for a container created through Portainer
+		rc, err := genericResourcControlGetter(tx, 1, context)(container.Summary{ID: "container"})
+		is.NoError(err)
+		is.NotNil(rc)
+
+		// trying to get UAC for an external container
+		rc, err = genericResourcControlGetter(tx, 1, context)(container.Summary{ID: "unknown"})
+		is.NoError(err)
+		is.NotNil(rc)
+		is.Empty(rc.UserAccesses)
+		is.Empty(rc.TeamAccesses)
+
+		// trying to get UAC for a container from a compose stack
+		rc, err = genericResourcControlGetter(tx, 1, context)(container.Summary{ID: "by-compose-stack-name-label", Labels: map[string]string{consts.ComposeStackNameLabel: composeStackName}})
+		is.NoError(err)
+		is.NotNil(rc)
+		is.Equal(composeStackRCID, rc.ResourceID)
+
+		// trying to get UAC for a container from a swarm stack
+		rc, err = genericResourcControlGetter(tx, 1, context)(container.Summary{ID: "by-swarm-stack-name-label", Labels: map[string]string{consts.SwarmStackNameLabel: swarmStackName}})
+		is.NoError(err)
+		is.NotNil(rc)
+		is.Equal(swarmStackRCID, rc.ResourceID)
+
+		// trying to get UAC for a container from a swarm service
+		rc, err = genericResourcControlGetter(tx, 1, context)(container.Summary{ID: "by-swarm-service-id-label", Labels: map[string]string{consts.SwarmServiceIDLabel: serviceID}})
+		is.NoError(err)
+		is.NotNil(rc)
+		is.Equal(serviceID, rc.ResourceID)
+
+		return nil
+	})
+
+	is.NoError(err)
+
+}
+
+func TestGenericResourcControlGetterWithPortainerLabels(t *testing.T) {
+	t.Parallel()
+	is := require.New(t)
+
+	ok, store := datastore.MustNewTestStore(t, true, false)
+	is.True(ok)
+	is.NotNil(store)
+
+	is.NoError(store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		is.NoError(tx.User().Create(&portainer.User{Role: portainer.AdministratorRole, Username: "admin"}))
+		is.NoError(tx.User().Create(&portainer.User{Role: portainer.AdministratorRole, Username: "user"}))
+		is.NoError(tx.Team().Create(&portainer.Team{Name: "team"}))
+		is.NoError(tx.TeamMembership().Create(&portainer.TeamMembership{UserID: 2, TeamID: 1}))
+		return nil
+	}))
+
+	is.NoError(store.ViewTx(func(tx dataservices.DataStoreTx) error {
+		context := ResourceContext[container.Summary]{RCType: portainer.ContainerResourceControl, IDGetter: ContainerResourceControlID, LabelsGetter: ContainerLabels}
+
+		rc, err := genericResourcControlGetter(tx, 1, context)(container.Summary{
+			ID:     "public",
+			Labels: map[string]string{publicRCLabel: "true"},
+		})
+		is.NoError(err)
+		is.NotNil(rc)
+		is.True(rc.Public)
+
+		rc, err = genericResourcControlGetter(tx, 1, context)(container.Summary{
+			ID:     "team",
+			Labels: map[string]string{teamRCLabel: "team"},
+		})
+		is.NoError(err)
+		is.NotNil(rc)
+		is.Contains(rc.TeamAccesses, portainer.TeamResourceAccess{TeamID: 1, AccessLevel: portainer.ReadWriteAccessLevel})
+
+		rc, err = genericResourcControlGetter(tx, 1, context)(container.Summary{
+			ID:     "no-team",
+			Labels: map[string]string{teamRCLabel: "team2"},
+		})
+		is.NoError(err)
+		is.NotNil(rc)
+		is.Empty(rc.UserAccesses)
+		is.Empty(rc.TeamAccesses)
+
+		rc, err = genericResourcControlGetter(tx, 1, context)(container.Summary{
+			ID:     "user",
+			Labels: map[string]string{userRCLabel: "user"},
+		})
+		is.NoError(err)
+		is.NotNil(rc)
+		is.Contains(rc.UserAccesses, portainer.UserResourceAccess{UserID: 2, AccessLevel: portainer.ReadWriteAccessLevel})
+
+		rc, err = genericResourcControlGetter(tx, 1, context)(container.Summary{
+			ID:     "no-user",
+			Labels: map[string]string{userRCLabel: "user2"},
+		})
+		is.NoError(err)
+		is.NotNil(rc)
+		is.Empty(rc.UserAccesses)
+		is.Empty(rc.TeamAccesses)
+
+		rc, err = genericResourcControlGetter(tx, 1, context)(container.Summary{
+			ID:     "warn-on-unknown",
+			Labels: map[string]string{userRCLabel: "user2,user3", teamRCLabel: "team2,team3"},
+		})
+		is.NoError(err)
+		is.NotNil(rc)
+		is.Empty(rc.UserAccesses)
+		is.Empty(rc.TeamAccesses)
+
+		rc, err = genericResourcControlGetter(tx, 1, context)(container.Summary{
+			ID: "empty-when-no-label",
+		})
+		is.NoError(err)
+		is.NotNil(rc)
+		is.Empty(rc.UserAccesses)
+		is.Empty(rc.TeamAccesses)
+
+		rc, err = genericResourcControlGetter(tx, 1, context)(container.Summary{
+			ID:     "empty-when-empty-labels",
+			Labels: map[string]string{},
+		})
+		is.NoError(err)
+		is.NotNil(rc)
+		is.Empty(rc.UserAccesses)
+		is.Empty(rc.TeamAccesses)
+
+		return nil
+	}))
+}
diff --git a/api/uac/networks.go b/api/uac/networks.go
new file mode 100644
index 0000000..a2537c2
--- /dev/null
+++ b/api/uac/networks.go
@@ -0,0 +1,30 @@
+package uac
+
+import (
+	"github.com/docker/docker/api/types/network"
+	portainer "github.com/portainer/portainer/api"
+)
+
+func NetworkResourceControlGetter[
+	TX txLike[RCS, TS, US],
+	RCS rcServiceLike,
+	TS teamServiceLike,
+	US userServiceLike,
+](
+	tx TX,
+	endpointID portainer.EndpointID,
+) func(item network.Summary) (*portainer.ResourceControl, error) {
+	return genericResourcControlGetter(tx, endpointID, ResourceContext[network.Summary]{
+		RCType:       portainer.NetworkResourceControl,
+		IDGetter:     NetworkResourceControlID,
+		LabelsGetter: NetworkLabels,
+	})
+}
+
+func NetworkResourceControlID(item network.Summary) string {
+	return item.ID
+}
+
+func NetworkLabels(item network.Summary) map[string]string {
+	return item.Labels
+}
diff --git a/api/uac/networks_test.go b/api/uac/networks_test.go
new file mode 100644
index 0000000..23d0c26
--- /dev/null
+++ b/api/uac/networks_test.go
@@ -0,0 +1,71 @@
+package uac
+
+import (
+	"testing"
+
+	"github.com/docker/docker/api/types/network"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/docker/consts"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+	"github.com/stretchr/testify/require"
+)
+
+func TestNetworkResourceControlGetter(t *testing.T) {
+	t.Parallel()
+	is := require.New(t)
+
+	ok, store := datastore.MustNewTestStore(t, true, false)
+	is.True(ok)
+	is.NotNil(store)
+
+	envID := portainer.EndpointID(1)
+	networkID := "network"
+	stackName := "stack"
+	stackRCID := stackutils.ResourceControlID(envID, stackName)
+	serviceID := "service"
+
+	is.NoError(store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		is.NoError(tx.ResourceControl().Create(authorization.NewPublicResourceControl(networkID, portainer.NetworkResourceControl)))
+		is.NoError(tx.ResourceControl().Create(authorization.NewPublicResourceControl(stackRCID, portainer.StackResourceControl)))
+		is.NoError(tx.ResourceControl().Create(authorization.NewPublicResourceControl(serviceID, portainer.ServiceResourceControl)))
+		return nil
+	}))
+
+	is.NoError(store.ViewTx(func(tx dataservices.DataStoreTx) error {
+		// by direct ID
+		rc, err := NetworkResourceControlGetter(tx, envID)(network.Inspect{ID: networkID})
+		is.NoError(err)
+		is.NotNil(rc)
+		is.Equal(networkID, rc.ResourceID)
+
+		// by compose stack label
+		rc, err = NetworkResourceControlGetter(tx, envID)(
+			network.Inspect{ID: "unknown", Labels: map[string]string{consts.ComposeStackNameLabel: stackName}},
+		)
+		is.NoError(err)
+		is.NotNil(rc)
+		is.Equal(stackRCID, rc.ResourceID)
+
+		// by swarm stack label
+		rc, err = NetworkResourceControlGetter(tx, envID)(
+			network.Inspect{ID: "unknown", Labels: map[string]string{consts.SwarmStackNameLabel: stackName}},
+		)
+		is.NoError(err)
+		is.NotNil(rc)
+		is.Equal(stackRCID, rc.ResourceID)
+
+		// by service ID
+		rc, err = NetworkResourceControlGetter(tx, envID)(
+			network.Inspect{ID: "unknown", Labels: map[string]string{consts.SwarmServiceIDLabel: serviceID}},
+		)
+		is.NoError(err)
+		is.NotNil(rc)
+		is.Equal(serviceID, rc.ResourceID)
+
+		return nil
+	}))
+
+}
diff --git a/api/uac/secrets.go b/api/uac/secrets.go
new file mode 100644
index 0000000..39fb65f
--- /dev/null
+++ b/api/uac/secrets.go
@@ -0,0 +1,30 @@
+package uac
+
+import (
+	"github.com/docker/docker/api/types/swarm"
+	portainer "github.com/portainer/portainer/api"
+)
+
+func SecretResourceControlGetter[
+	TX txLike[RCS, TS, US],
+	RCS rcServiceLike,
+	TS teamServiceLike,
+	US userServiceLike,
+](
+	tx TX,
+	endpointID portainer.EndpointID,
+) func(item swarm.Secret) (*portainer.ResourceControl, error) {
+	return genericResourcControlGetter(tx, endpointID, ResourceContext[swarm.Secret]{
+		RCType:       portainer.SecretResourceControl,
+		IDGetter:     SecretResourceControlID,
+		LabelsGetter: SecretLabels,
+	})
+}
+
+func SecretResourceControlID(item swarm.Secret) string {
+	return item.ID
+}
+
+func SecretLabels(item swarm.Secret) map[string]string {
+	return item.Spec.Labels
+}
diff --git a/api/uac/secrets_test.go b/api/uac/secrets_test.go
new file mode 100644
index 0000000..fe976ed
--- /dev/null
+++ b/api/uac/secrets_test.go
@@ -0,0 +1,71 @@
+package uac
+
+import (
+	"testing"
+
+	"github.com/docker/docker/api/types/swarm"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/docker/consts"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSecretResourceControlGetter(t *testing.T) {
+	t.Parallel()
+	is := require.New(t)
+
+	ok, store := datastore.MustNewTestStore(t, true, false)
+	is.True(ok)
+	is.NotNil(store)
+
+	envID := portainer.EndpointID(1)
+	secretID := "secret"
+	stackName := "stack"
+	stackRCID := stackutils.ResourceControlID(envID, stackName)
+	serviceID := "service"
+
+	is.NoError(store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		is.NoError(tx.ResourceControl().Create(authorization.NewPublicResourceControl(secretID, portainer.SecretResourceControl)))
+		is.NoError(tx.ResourceControl().Create(authorization.NewPublicResourceControl(stackRCID, portainer.StackResourceControl)))
+		is.NoError(tx.ResourceControl().Create(authorization.NewPublicResourceControl(serviceID, portainer.ServiceResourceControl)))
+		return nil
+	}))
+
+	is.NoError(store.ViewTx(func(tx dataservices.DataStoreTx) error {
+		// by direct ID
+		rc, err := SecretResourceControlGetter(tx, envID)(swarm.Secret{ID: secretID})
+		is.NoError(err)
+		is.NotNil(rc)
+		is.Equal(secretID, rc.ResourceID)
+
+		// by compose stack label
+		rc, err = SecretResourceControlGetter(tx, envID)(
+			swarm.Secret{ID: "unknown", Spec: swarm.SecretSpec{Annotations: swarm.Annotations{Labels: map[string]string{consts.ComposeStackNameLabel: stackName}}}},
+		)
+		is.NoError(err)
+		is.NotNil(rc)
+		is.Equal(stackRCID, rc.ResourceID)
+
+		// by swarm stack label
+		rc, err = SecretResourceControlGetter(tx, envID)(
+			swarm.Secret{ID: "unknown", Spec: swarm.SecretSpec{Annotations: swarm.Annotations{Labels: map[string]string{consts.SwarmStackNameLabel: stackName}}}},
+		)
+		is.NoError(err)
+		is.NotNil(rc)
+		is.Equal(stackRCID, rc.ResourceID)
+
+		// by service ID
+		rc, err = SecretResourceControlGetter(tx, envID)(
+			swarm.Secret{ID: "unknown", Spec: swarm.SecretSpec{Annotations: swarm.Annotations{Labels: map[string]string{consts.SwarmServiceIDLabel: serviceID}}}},
+		)
+		is.NoError(err)
+		is.NotNil(rc)
+		is.Equal(serviceID, rc.ResourceID)
+
+		return nil
+	}))
+
+}
diff --git a/api/uac/services.go b/api/uac/services.go
new file mode 100644
index 0000000..961d6ab
--- /dev/null
+++ b/api/uac/services.go
@@ -0,0 +1,30 @@
+package uac
+
+import (
+	"github.com/docker/docker/api/types/swarm"
+	portainer "github.com/portainer/portainer/api"
+)
+
+func ServiceResourceControlGetter[
+	TX txLike[RCS, TS, US],
+	RCS rcServiceLike,
+	TS teamServiceLike,
+	US userServiceLike,
+](
+	tx TX,
+	endpointID portainer.EndpointID,
+) func(item swarm.Service) (*portainer.ResourceControl, error) {
+	return genericResourcControlGetter(tx, endpointID, ResourceContext[swarm.Service]{
+		RCType:       portainer.ServiceResourceControl,
+		IDGetter:     ServiceResourceControlID,
+		LabelsGetter: ServiceLabels,
+	})
+}
+
+func ServiceResourceControlID(item swarm.Service) string {
+	return item.ID
+}
+
+func ServiceLabels(item swarm.Service) map[string]string {
+	return item.Spec.Labels
+}
diff --git a/api/uac/stacks.go b/api/uac/stacks.go
new file mode 100644
index 0000000..d9c34f6
--- /dev/null
+++ b/api/uac/stacks.go
@@ -0,0 +1,48 @@
+package uac
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+)
+
+func StackResourceControlGetter[
+	TX txLike[RCS, TS, US],
+	RCS rcServiceLike,
+	TS teamServiceLike,
+	US userServiceLike,
+](
+	tx TX,
+	endpointID portainer.EndpointID,
+) func(item portainer.Stack) (*portainer.ResourceControl, error) {
+	return genericResourcControlGetter(tx, endpointID, ResourceContext[portainer.Stack]{
+		RCType:   portainer.StackResourceControl,
+		IDGetter: func(s portainer.Stack) string { return StackResourceControlID(s.EndpointID, s.Name) },
+		// stacks don't have labels so we don't pass a getter
+	})
+}
+
+// TODO: replace usage of stackutils function to this package
+func StackResourceControlID(endpointID portainer.EndpointID, name string) string {
+	return stackutils.ResourceControlID(endpointID, name)
+}
+
+type ExternalStack struct {
+	Labels map[string]string
+}
+
+// External stacks are indirectly detected either via containers or services labels
+// Any UAC applied to them can only be fetched from containers'/services' labels
+func ExternalStackResourceControlGetter[
+	TX txLike[RCS, TS, US],
+	RCS rcServiceLike,
+	TS teamServiceLike,
+	US userServiceLike,
+](
+	tx TX,
+	endpointID portainer.EndpointID) func(item ExternalStack) (*portainer.ResourceControl, error) {
+	return genericResourcControlGetter(tx, endpointID, ResourceContext[ExternalStack]{
+		RCType:       portainer.StackResourceControl,
+		IDGetter:     func(s ExternalStack) string { return "0" },
+		LabelsGetter: func(es ExternalStack) map[string]string { return es.Labels },
+	})
+}
diff --git a/api/uac/uac.go b/api/uac/uac.go
new file mode 100644
index 0000000..3f2e512
--- /dev/null
+++ b/api/uac/uac.go
@@ -0,0 +1,53 @@
+package uac
+
+import (
+	"fmt"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/slicesx"
+)
+
+// FilterByResourceControl filters a list of items based on the user's role and the resource control associated to the item.
+// UAC rules
+// * UAC in DB (direct)
+// * UAC inherited (from swarm service | swarm stack | compose stack)
+// * UAC defined in labels (UAC on external resources)
+func FilterByResourceControl[T any](
+	items []T,
+	user *portainer.User,
+	userMemberships []portainer.TeamMembership,
+	resourceControlGetter func(item T) (*portainer.ResourceControl, error),
+) ([]T, error) {
+	filteredItems := make([]T, 0)
+
+	if user == nil {
+		return filteredItems, nil
+	}
+
+	if canBypassUAC(user) {
+		return items, nil
+	}
+
+	userTeamIDs := slicesx.Map(userMemberships, func(membership portainer.TeamMembership) portainer.TeamID {
+		return membership.TeamID
+	})
+
+	for _, item := range items {
+		rc, err := resourceControlGetter(item)
+		if err != nil {
+			return nil, fmt.Errorf("Unable to retrieve resource control: %w", err)
+		}
+
+		// TODO: move UserCanAccessResource function to the UAC package
+		if authorization.UserCanAccessResource(user.ID, userTeamIDs, rc) {
+			filteredItems = append(filteredItems, item)
+		}
+	}
+
+	return filteredItems, nil
+}
+
+func canBypassUAC(user *portainer.User) bool {
+	return user != nil && user.Role == portainer.AdministratorRole
+}
diff --git a/api/uac/uac_test.go b/api/uac/uac_test.go
new file mode 100644
index 0000000..08eb423
--- /dev/null
+++ b/api/uac/uac_test.go
@@ -0,0 +1,78 @@
+package uac
+
+import (
+	"testing"
+
+	"github.com/docker/docker/api/types/container"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/docker/consts"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/stretchr/testify/require"
+)
+
+func TestCanBypassUAC(t *testing.T) {
+	t.Parallel()
+	is := require.New(t)
+
+	admin := &portainer.User{Role: portainer.AdministratorRole}
+	user := &portainer.User{Role: portainer.StandardUserRole}
+
+	is.False(canBypassUAC(nil))
+	is.False(canBypassUAC(user))
+	is.True(canBypassUAC(admin))
+}
+
+func TestFilterByResourceControl(t *testing.T) {
+	t.Parallel()
+	is := require.New(t)
+
+	ok, store := datastore.MustNewTestStore(t, true, false)
+	is.True(ok)
+	is.NotNil(store)
+
+	endpointID := portainer.EndpointID(1)
+	stackRCID := StackResourceControlID(endpointID, "stack")
+
+	is.NoError(store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		is.NoError(tx.ResourceControl().Create(authorization.NewPrivateResourceControl(stackRCID, portainer.StackResourceControl, 2)))
+
+		is.NoError(tx.ResourceControl().Create(authorization.NewAdministratorsOnlyResourceControl("admin", portainer.ContainerResourceControl)))
+		is.NoError(tx.ResourceControl().Create(authorization.NewPrivateResourceControl("private", portainer.ContainerResourceControl, 2)))
+		is.NoError(tx.ResourceControl().Create(authorization.NewPublicResourceControl("public", portainer.ContainerResourceControl)))
+		is.NoError(tx.ResourceControl().Create(authorization.NewSystemResourceControl("system", portainer.ContainerResourceControl)))
+		return nil
+	}))
+
+	admin := &portainer.User{ID: 1, Role: portainer.AdministratorRole}
+	std := &portainer.User{ID: 2, Role: portainer.StandardUserRole}
+	std2 := &portainer.User{ID: 3, Role: portainer.StandardUserRole}
+
+	containers := []container.Summary{{ID: "admin"}, {ID: "private"}, {ID: "public"}, {ID: "system"},
+		{ID: "bylabel", Labels: map[string]string{consts.ComposeStackNameLabel: "stack"}},
+	}
+
+	is.NoError(store.ViewTx(func(tx dataservices.DataStoreTx) error {
+		c, err := FilterByResourceControl(containers, admin, []portainer.TeamMembership{}, ContainerResourceControlGetter(tx, endpointID))
+		is.NoError(err)
+		is.Len(c, len(containers))
+
+		c, err = FilterByResourceControl(containers, std, []portainer.TeamMembership{}, ContainerResourceControlGetter(tx, endpointID))
+		is.NoError(err)
+		is.Len(c, 4)
+		is.Contains(c, container.Summary{ID: "private"})
+		is.Contains(c, container.Summary{ID: "public"})
+		is.Contains(c, container.Summary{ID: "system"})
+		is.Contains(c, container.Summary{ID: "bylabel", Labels: map[string]string{consts.ComposeStackNameLabel: "stack"}})
+
+		c, err = FilterByResourceControl(containers, std2, []portainer.TeamMembership{}, ContainerResourceControlGetter(tx, endpointID))
+		is.NoError(err)
+		is.Len(c, 2)
+		is.Contains(c, container.Summary{ID: "public"})
+		is.Contains(c, container.Summary{ID: "system"})
+
+		return nil
+	}))
+
+}
diff --git a/api/uac/volumes.go b/api/uac/volumes.go
new file mode 100644
index 0000000..34dab92
--- /dev/null
+++ b/api/uac/volumes.go
@@ -0,0 +1,32 @@
+package uac
+
+import (
+	"github.com/docker/docker/api/types/volume"
+	portainer "github.com/portainer/portainer/api"
+)
+
+func VolumeResourceControlGetter[
+	TX txLike[RCS, TS, US],
+	RCS rcServiceLike,
+	TS teamServiceLike,
+	US userServiceLike,
+](
+	tx TX,
+	endpointID portainer.EndpointID,
+) func(item volume.Volume) (*portainer.ResourceControl, error) {
+	return genericResourcControlGetter(tx, endpointID, ResourceContext[volume.Volume]{
+		RCType:       portainer.VolumeResourceControl,
+		IDGetter:     VolumeResourceControlID,
+		LabelsGetter: VolumeLabels,
+	})
+}
+
+// TODO: use a copy of getVolumeResourceID()
+// or change the key (+ migrate) to not require using the dockerID/swarm nodeID
+func VolumeResourceControlID(item volume.Volume) string {
+	return item.Name
+}
+
+func VolumeLabels(item volume.Volume) map[string]string {
+	return item.Labels
+}
diff --git a/api/uac/volumes_test.go b/api/uac/volumes_test.go
new file mode 100644
index 0000000..7dfde42
--- /dev/null
+++ b/api/uac/volumes_test.go
@@ -0,0 +1,71 @@
+package uac
+
+import (
+	"testing"
+
+	"github.com/docker/docker/api/types/volume"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/docker/consts"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+	"github.com/stretchr/testify/require"
+)
+
+func TestVolumeResourceControlGetter(t *testing.T) {
+	t.Parallel()
+	is := require.New(t)
+
+	ok, store := datastore.MustNewTestStore(t, true, false)
+	is.True(ok)
+	is.NotNil(store)
+
+	envID := portainer.EndpointID(1)
+	volumeName := "volume"
+	stackName := "stack"
+	stackRCID := stackutils.ResourceControlID(envID, stackName)
+	serviceID := "service"
+
+	is.NoError(store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		is.NoError(tx.ResourceControl().Create(authorization.NewPublicResourceControl(volumeName, portainer.VolumeResourceControl)))
+		is.NoError(tx.ResourceControl().Create(authorization.NewPublicResourceControl(stackRCID, portainer.StackResourceControl)))
+		is.NoError(tx.ResourceControl().Create(authorization.NewPublicResourceControl(serviceID, portainer.ServiceResourceControl)))
+		return nil
+	}))
+
+	is.NoError(store.ViewTx(func(tx dataservices.DataStoreTx) error {
+		// by direct ID
+		rc, err := VolumeResourceControlGetter(tx, envID)(volume.Volume{Name: volumeName})
+		is.NoError(err)
+		is.NotNil(rc)
+		is.Equal(volumeName, rc.ResourceID)
+
+		// by compose stack label
+		rc, err = VolumeResourceControlGetter(tx, envID)(
+			volume.Volume{Name: "unknown", Labels: map[string]string{consts.ComposeStackNameLabel: stackName}},
+		)
+		is.NoError(err)
+		is.NotNil(rc)
+		is.Equal(stackRCID, rc.ResourceID)
+
+		// by swarm stack label
+		rc, err = VolumeResourceControlGetter(tx, envID)(
+			volume.Volume{Name: "unknown", Labels: map[string]string{consts.SwarmStackNameLabel: stackName}},
+		)
+		is.NoError(err)
+		is.NotNil(rc)
+		is.Equal(stackRCID, rc.ResourceID)
+
+		// by service ID
+		rc, err = VolumeResourceControlGetter(tx, envID)(
+			volume.Volume{Name: "unknown", Labels: map[string]string{consts.SwarmServiceIDLabel: serviceID}},
+		)
+		is.NoError(err)
+		is.NotNil(rc)
+		is.Equal(serviceID, rc.ResourceID)
+
+		return nil
+	}))
+
+}
diff --git a/api/url/url.go b/api/url/url.go
new file mode 100644
index 0000000..8a752b3
--- /dev/null
+++ b/api/url/url.go
@@ -0,0 +1,22 @@
+package url
+
+import (
+	"net/url"
+	"strings"
+)
+
+// ParseURL parses the endpointURL using url.Parse.
+//
+// to prevent an error when url has port but no protocol prefix
+// we add `//` prefix if needed
+func ParseURL(endpointURL string) (*url.URL, error) {
+	if !strings.HasPrefix(endpointURL, "http") &&
+		!strings.HasPrefix(endpointURL, "tcp") &&
+		!strings.HasPrefix(endpointURL, "//") &&
+		!strings.HasPrefix(endpointURL, `unix:`) &&
+		!strings.HasPrefix(endpointURL, `npipe:`) {
+		endpointURL = "//" + endpointURL
+	}
+
+	return url.Parse(endpointURL)
+}
diff --git a/api/url/url_test.go b/api/url/url_test.go
new file mode 100644
index 0000000..97eca24
--- /dev/null
+++ b/api/url/url_test.go
@@ -0,0 +1,67 @@
+package url
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseURL_NoPrefix(t *testing.T) {
+	t.Parallel()
+
+	u, err := ParseURL("192.168.1.1:9000")
+	require.NoError(t, err)
+	require.Equal(t, "192.168.1.1:9000", u.Host)
+}
+
+func TestParseURL_HTTPPrefix(t *testing.T) {
+	t.Parallel()
+
+	u, err := ParseURL("http://example.com:8080")
+	require.NoError(t, err)
+	require.Equal(t, "http", u.Scheme)
+	require.Equal(t, "example.com:8080", u.Host)
+}
+
+func TestParseURL_HTTPSPrefix(t *testing.T) {
+	t.Parallel()
+
+	u, err := ParseURL("https://example.com")
+	require.NoError(t, err)
+	require.Equal(t, "https", u.Scheme)
+	require.Equal(t, "example.com", u.Host)
+}
+
+func TestParseURL_TCPPrefix(t *testing.T) {
+	t.Parallel()
+
+	u, err := ParseURL("tcp://192.168.1.1:2376")
+	require.NoError(t, err)
+	require.Equal(t, "tcp", u.Scheme)
+	require.Equal(t, "192.168.1.1:2376", u.Host)
+}
+
+func TestParseURL_SlashSlashPrefix(t *testing.T) {
+	t.Parallel()
+
+	u, err := ParseURL("//192.168.1.1:2376")
+	require.NoError(t, err)
+	require.Equal(t, "192.168.1.1:2376", u.Host)
+}
+
+func TestParseURL_UnixPrefix(t *testing.T) {
+	t.Parallel()
+
+	u, err := ParseURL("unix:///var/run/docker.sock")
+	require.NoError(t, err)
+	require.Equal(t, "unix", u.Scheme)
+	require.Equal(t, "/var/run/docker.sock", u.Path)
+}
+
+func TestParseURL_NpipePrefix(t *testing.T) {
+	t.Parallel()
+
+	u, err := ParseURL("npipe:////./pipe/docker_engine")
+	require.NoError(t, err)
+	require.Equal(t, "npipe", u.Scheme)
+}
diff --git a/api/ws/hijack.go b/api/ws/hijack.go
new file mode 100644
index 0000000..4b935b9
--- /dev/null
+++ b/api/ws/hijack.go
@@ -0,0 +1,172 @@
+package ws
+
+import (
+	"bufio"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"sync"
+	"time"
+
+	"github.com/gorilla/websocket"
+	"github.com/portainer/portainer/api/logs"
+	"github.com/rs/zerolog/log"
+)
+
+const (
+	// Time allowed to write a message to the peer
+	WriteWait = 10 * time.Second
+
+	// Send pings to peer with this period
+	PingPeriod = 50 * time.Second
+)
+
+func HijackRequest(websocketConn *websocket.Conn, conn net.Conn, request *http.Request) error {
+	resp, err := sendHTTPRequest(conn, request)
+	if err != nil {
+		return err
+	}
+	defer func() {
+		if err := resp.Body.Close(); err != nil {
+			log.Warn().Err(err).Msg("failed to close response body")
+		}
+	}()
+
+	// Check if the response status code indicates an upgrade (101 Switching Protocols)
+	if resp.StatusCode != http.StatusSwitchingProtocols {
+		return fmt.Errorf("unexpected response status code: %d", resp.StatusCode)
+	}
+
+	var mu sync.Mutex
+
+	errorChan := make(chan error, 2)
+	go StreamFromWebsocketToWriter(websocketConn, conn, errorChan)
+	go WriteReaderToWebSocket(websocketConn, &mu, conn, errorChan)
+
+	err = <-errorChan
+	if websocket.IsUnexpectedCloseError(err, websocket.CloseGoingAway, websocket.CloseNoStatusReceived) {
+		log.Debug().Err(err).Msg("unexpected close error")
+
+		return err
+	}
+
+	log.Debug().Msg("session ended")
+
+	return nil
+}
+
+// sendHTTPRequest sends an HTTP request over the provided net.Conn and parses the response.
+func sendHTTPRequest(conn net.Conn, req *http.Request) (*http.Response, error) {
+	// Send the HTTP request to the server
+	if err := req.Write(conn); err != nil {
+		return nil, fmt.Errorf("error writing request: %w", err)
+	}
+
+	// Read the response from the server
+	resp, err := http.ReadResponse(bufio.NewReader(conn), req)
+	if err != nil {
+		return nil, fmt.Errorf("error reading response: %w", err)
+	}
+
+	return resp, nil
+}
+
+func WriteReaderToWebSocket(websocketConn *websocket.Conn, mu *sync.Mutex, reader io.Reader, errorChan chan error) {
+	out := make([]byte, ReaderBufferSize)
+	input := make(chan string)
+	pingTicker := time.NewTicker(PingPeriod)
+
+	defer logs.CloseAndLogErr(websocketConn)
+
+	done := make(chan struct{})
+	defer close(done)
+
+	if err := websocketConn.SetReadDeadline(time.Now().Add(PingPeriod + WriteWait)); err != nil {
+		errorChan <- err
+
+		return
+	}
+
+	mu.Lock()
+	websocketConn.SetPongHandler(func(string) error {
+		return websocketConn.SetReadDeadline(time.Now().Add(PingPeriod + WriteWait))
+	})
+
+	websocketConn.SetPingHandler(func(data string) error {
+		mu.Lock()
+		defer mu.Unlock()
+
+		if err := websocketConn.SetWriteDeadline(time.Now().Add(WriteWait)); err != nil {
+			return err
+		}
+
+		return websocketConn.WriteMessage(websocket.PongMessage, []byte(data))
+	})
+	mu.Unlock()
+
+	go func() {
+		for {
+			n, err := reader.Read(out)
+			if err != nil {
+				errorChan <- err
+
+				if !errors.Is(err, io.EOF) {
+					log.Debug().Err(err).Msg("error reading from server")
+				}
+
+				return
+			}
+
+			processedOutput := ValidString(string(out[:n]))
+
+			select {
+			case input <- processedOutput:
+			case <-done:
+				return
+			}
+		}
+	}()
+
+	for {
+		select {
+		case msg := <-input:
+			if err := wsWrite(websocketConn, mu, msg); err != nil {
+				log.Debug().Err(err).Msg("error writing to websocket")
+				errorChan <- err
+
+				return
+			}
+		case <-pingTicker.C:
+			if err := wsPing(websocketConn, mu); err != nil {
+				log.Debug().Err(err).Msg("error writing to websocket during pong response")
+				errorChan <- err
+
+				return
+			}
+		}
+	}
+}
+
+func wsWrite(websocketConn *websocket.Conn, mu *sync.Mutex, msg string) error {
+	mu.Lock()
+	defer mu.Unlock()
+
+	if err := websocketConn.SetWriteDeadline(time.Now().Add(WriteWait)); err != nil {
+		return err
+	}
+
+	return websocketConn.WriteMessage(websocket.TextMessage, []byte(msg))
+}
+
+func wsPing(websocketConn *websocket.Conn, mu *sync.Mutex) error {
+	mu.Lock()
+	defer mu.Unlock()
+
+	if err := websocketConn.SetWriteDeadline(time.Now().Add(WriteWait)); err != nil {
+		return err
+	}
+
+	return websocketConn.WriteMessage(websocket.PingMessage, nil)
+}
diff --git a/api/ws/resize.go b/api/ws/resize.go
new file mode 100644
index 0000000..5ce24ef
--- /dev/null
+++ b/api/ws/resize.go
@@ -0,0 +1,35 @@
+package ws
+
+import (
+	"github.com/segmentio/encoding/json"
+
+	"github.com/gorilla/websocket"
+)
+
+// SizeQueue is implemented by types that accept terminal resize events.
+type SizeQueue interface {
+	Push(cols, rows uint16)
+}
+
+// ResizeHandler returns a MessageHandler that intercepts terminal resize messages
+// and forwards them to the given SizeQueue.
+// Resize messages are JSON text frames: {"type":"resize","data":{"width":N,"height":N}}.
+func ResizeHandler(q SizeQueue) MessageHandler {
+	return func(messageType int, data []byte) bool {
+		if messageType != websocket.TextMessage {
+			return false
+		}
+		var msg struct {
+			Type string `json:"type"`
+			Data struct {
+				Width  uint16 `json:"width"`
+				Height uint16 `json:"height"`
+			} `json:"data"`
+		}
+		if err := json.Unmarshal(data, &msg); err != nil || msg.Type != "resize" {
+			return false
+		}
+		q.Push(msg.Data.Width, msg.Data.Height)
+		return true
+	}
+}
diff --git a/api/ws/stream.go b/api/ws/stream.go
new file mode 100644
index 0000000..bcdf0ab
--- /dev/null
+++ b/api/ws/stream.go
@@ -0,0 +1,101 @@
+package ws
+
+import (
+	"io"
+	"time"
+	"unicode/utf8"
+
+	"github.com/gorilla/websocket"
+	"github.com/rs/zerolog/log"
+)
+
+const ReaderBufferSize = 2048
+
+// MessageHandler processes a WebSocket message before it is forwarded to the writer.
+// It returns true if the message was handled and should not be forwarded to the writer.
+type MessageHandler func(messageType int, data []byte) bool
+
+func StreamFromWebsocketToWriter(websocketConn *websocket.Conn, writer io.Writer, errorChan chan error, handlers ...MessageHandler) {
+	for {
+		messageType, in, err := websocketConn.ReadMessage()
+		if err != nil {
+			if websocket.IsUnexpectedCloseError(err, websocket.CloseGoingAway) {
+				log.Debug().Err(err).Msg("unexpected close error")
+			}
+			errorChan <- err
+
+			return
+		}
+
+		if messageType != websocket.TextMessage && messageType != websocket.BinaryMessage {
+			continue
+		}
+
+		handled := false
+		for _, h := range handlers {
+			if h(messageType, in) {
+				handled = true
+				break
+			}
+		}
+
+		if handled {
+			continue
+		}
+
+		if _, err := writer.Write(in); err != nil {
+			log.Debug().Err(err).Msg("writing error")
+			errorChan <- err
+
+			return
+		}
+	}
+}
+
+func StreamFromReaderToWebsocket(websocketConn *websocket.Conn, reader io.Reader, errorChan chan error) {
+	out := make([]byte, ReaderBufferSize)
+
+	for {
+		n, err := reader.Read(out)
+		if err != nil {
+			errorChan <- err
+
+			break
+		}
+
+		processedOutput := ValidString(string(out[:n]))
+
+		if err := websocketConn.SetWriteDeadline(time.Now().Add(WriteWait)); err != nil {
+			errorChan <- err
+
+			break
+		}
+
+		if err := websocketConn.WriteMessage(websocket.TextMessage, []byte(processedOutput)); err != nil {
+			errorChan <- err
+
+			break
+		}
+	}
+}
+
+func ValidString(s string) string {
+	if utf8.ValidString(s) {
+		return s
+	}
+
+	v := make([]rune, 0, len(s))
+
+	for i, r := range s {
+		if r == utf8.RuneError {
+			_, size := utf8.DecodeRuneInString(s[i:])
+			if size == 1 {
+				continue
+			}
+		}
+
+		v = append(v, r)
+	}
+
+	return string(v)
+}
diff --git a/api/ws/ws_test.go b/api/ws/ws_test.go
new file mode 100644
index 0000000..04bad98
--- /dev/null
+++ b/api/ws/ws_test.go
@@ -0,0 +1,436 @@
+package ws
+
+import (
+	"bytes"
+	"errors"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+	"unicode/utf8"
+
+	"github.com/portainer/portainer/api/logs"
+
+	"github.com/gorilla/websocket"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+var testUpgrader = websocket.Upgrader{
+	CheckOrigin: func(r *http.Request) bool { return true },
+}
+
+// newTestWSPair creates an httptest server, upgrades one connection to websocket,
+// and dials a client connection. Returns (server, client) connections
+func newTestWSPair(t *testing.T) (*websocket.Conn, *websocket.Conn) {
+	t.Helper()
+
+	connCh := make(chan *websocket.Conn, 1)
+	doneCh := make(chan struct{})
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		conn, err := testUpgrader.Upgrade(w, r, nil)
+		if !assert.NoError(t, err) {
+			return
+		}
+
+		connCh <- conn
+		<-doneCh
+	}))
+
+	t.Cleanup(func() {
+		close(doneCh)
+		srv.Close()
+	})
+
+	u := "ws" + strings.TrimPrefix(srv.URL, "http")
+
+	client, resp, err := websocket.DefaultDialer.Dial(u, nil)
+	require.NoError(t, err)
+
+	t.Cleanup(func() { logs.CloseAndLogErr(resp.Body) })
+
+	t.Cleanup(func() {
+		err := client.Close()
+		require.NoError(t, err)
+	})
+
+	server := <-connCh
+	t.Cleanup(func() {
+		err := server.Close()
+		require.NoError(t, err)
+	})
+
+	return server, client
+}
+
+type failWriter struct {
+	err error
+}
+
+func (w *failWriter) Write(_ []byte) (int, error) {
+	return 0, w.err
+}
+
+type failReader struct {
+	err error
+}
+
+func (r *failReader) Read(_ []byte) (int, error) {
+	return 0, r.err
+}
+
+func TestValidString(t *testing.T) {
+	t.Parallel()
+
+	f := func(input, expected string) {
+		t.Helper()
+		result := ValidString(input)
+		require.Equal(t, expected, result)
+		require.True(t, utf8.ValidString(result))
+	}
+
+	f("hello world", "hello world")
+	// \xff and \xfe are invalid UTF-8 bytes and must be stripped
+	f("hello\xff\xfeworld", "helloworld")
+	f("", "")
+}
+
+func TestStreamFromWebsocketToWriter_ForwardsMessages(t *testing.T) {
+	t.Parallel()
+
+	serverConn, clientConn := newTestWSPair(t)
+
+	var buf bytes.Buffer
+	errorChan := make(chan error, 1)
+
+	go StreamFromWebsocketToWriter(serverConn, &buf, errorChan)
+
+	err := clientConn.WriteMessage(websocket.TextMessage, []byte("hello"))
+	require.NoError(t, err)
+
+	err = clientConn.WriteMessage(websocket.CloseMessage, websocket.FormatCloseMessage(websocket.CloseNormalClosure, ""))
+	require.NoError(t, err)
+
+	// The goroutine sends to errorChan after processing all prior messages,
+	// so buf is fully written by the time we receive here
+	err = <-errorChan
+	require.Error(t, err)
+
+	require.Equal(t, "hello", buf.String())
+}
+
+func TestStreamFromWebsocketToWriter_HandlerInterceptsMessage(t *testing.T) {
+	t.Parallel()
+
+	serverConn, clientConn := newTestWSPair(t)
+
+	var buf bytes.Buffer
+	errorChan := make(chan error, 1)
+
+	intercepted := false
+	handler := MessageHandler(func(_ int, data []byte) bool {
+		if string(data) == "intercept" {
+			intercepted = true
+
+			return true
+		}
+
+		return false
+	})
+
+	go StreamFromWebsocketToWriter(serverConn, &buf, errorChan, handler)
+
+	err := clientConn.WriteMessage(websocket.TextMessage, []byte("intercept"))
+	require.NoError(t, err)
+
+	err = clientConn.WriteMessage(websocket.TextMessage, []byte("forward"))
+	require.NoError(t, err)
+
+	err = clientConn.WriteMessage(websocket.CloseMessage, websocket.FormatCloseMessage(websocket.CloseNormalClosure, ""))
+	require.NoError(t, err)
+
+	err = <-errorChan
+	require.Error(t, err)
+
+	require.True(t, intercepted)
+	require.Equal(t, "forward", buf.String())
+}
+
+func TestStreamFromWebsocketToWriter_WriteError(t *testing.T) {
+	t.Parallel()
+
+	serverConn, clientConn := newTestWSPair(t)
+
+	expectedErr := errors.New("write error")
+	errorChan := make(chan error, 1)
+
+	go StreamFromWebsocketToWriter(serverConn, &failWriter{err: expectedErr}, errorChan)
+
+	err := clientConn.WriteMessage(websocket.TextMessage, []byte("trigger"))
+	require.NoError(t, err)
+
+	err = <-errorChan
+	require.ErrorIs(t, err, expectedErr)
+}
+
+func TestStreamFromReaderToWebsocket_ForwardsData(t *testing.T) {
+	t.Parallel()
+
+	serverConn, clientConn := newTestWSPair(t)
+
+	reader := strings.NewReader("hello world")
+	errorChan := make(chan error, 1)
+
+	go StreamFromReaderToWebsocket(serverConn, reader, errorChan)
+
+	msgType, msg, err := clientConn.ReadMessage()
+	require.NoError(t, err)
+	require.Equal(t, websocket.TextMessage, msgType)
+	require.Equal(t, "hello world", string(msg))
+
+	err = <-errorChan
+	require.ErrorIs(t, err, io.EOF)
+}
+
+func TestStreamFromReaderToWebsocket_ReadError(t *testing.T) {
+	t.Parallel()
+
+	serverConn, _ := newTestWSPair(t)
+
+	expectedErr := errors.New("read error")
+	errorChan := make(chan error, 1)
+
+	go StreamFromReaderToWebsocket(serverConn, &failReader{err: expectedErr}, errorChan)
+
+	err := <-errorChan
+	require.ErrorIs(t, err, expectedErr)
+}
+
+func TestWriteReaderToWebSocket_ForwardsData(t *testing.T) {
+	t.Parallel()
+
+	serverConn, clientConn := newTestWSPair(t)
+
+	var mu sync.Mutex
+	reader := strings.NewReader("hello")
+	errorChan := make(chan error, 2)
+
+	go WriteReaderToWebSocket(serverConn, &mu, reader, errorChan)
+
+	msgType, msg, err := clientConn.ReadMessage()
+	require.NoError(t, err)
+	require.Equal(t, websocket.TextMessage, msgType)
+	require.Equal(t, "hello", string(msg))
+
+	// The inner goroutine sends EOF after the reader is exhausted
+	err = <-errorChan
+	require.ErrorIs(t, err, io.EOF)
+}
+
+func TestWriteReaderToWebSocket_ReaderError(t *testing.T) {
+	t.Parallel()
+
+	serverConn, _ := newTestWSPair(t)
+
+	var mu sync.Mutex
+	expectedErr := errors.New("read error")
+	errorChan := make(chan error, 2)
+
+	go WriteReaderToWebSocket(serverConn, &mu, &failReader{err: expectedErr}, errorChan)
+
+	err := <-errorChan
+	require.ErrorIs(t, err, expectedErr)
+}
+
+// newTestWSConn creates a websocket server connection without registering a close cleanup
+// for it, allowing the caller to close it manually without triggering a double-close
+func newTestWSConn(t *testing.T) *websocket.Conn {
+	t.Helper()
+
+	connCh := make(chan *websocket.Conn, 1)
+	doneCh := make(chan struct{})
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		conn, err := testUpgrader.Upgrade(w, r, nil)
+		if !assert.NoError(t, err) {
+			return
+		}
+
+		connCh <- conn
+		<-doneCh
+	}))
+
+	t.Cleanup(func() {
+		close(doneCh)
+		srv.Close()
+	})
+
+	u := "ws" + strings.TrimPrefix(srv.URL, "http")
+
+	client, resp, err := websocket.DefaultDialer.Dial(u, nil)
+	require.NoError(t, err)
+
+	t.Cleanup(func() { logs.CloseAndLogErr(resp.Body) })
+
+	t.Cleanup(func() { logs.CloseAndLogErr(client) })
+
+	return <-connCh
+}
+
+type mockSizeQueue struct {
+	cols uint16
+	rows uint16
+}
+
+func (m *mockSizeQueue) Push(cols, rows uint16) {
+	m.cols = cols
+	m.rows = rows
+}
+
+func TestResizeHandler(t *testing.T) {
+	t.Parallel()
+
+	f := func(msgType int, data []byte, expectedHandled bool, expectedCols, expectedRows uint16) {
+		t.Helper()
+		q := &mockSizeQueue{}
+		handled := ResizeHandler(q)(msgType, data)
+		require.Equal(t, expectedHandled, handled)
+		require.Equal(t, expectedCols, q.cols)
+		require.Equal(t, expectedRows, q.rows)
+	}
+
+	f(websocket.BinaryMessage, []byte(`{"type":"resize","data":{"width":80,"height":24}}`), false, 0, 0)
+	f(websocket.TextMessage, []byte(`not json`), false, 0, 0)
+	f(websocket.TextMessage, []byte(`{"type":"other","data":{"width":80,"height":24}}`), false, 0, 0)
+	f(websocket.TextMessage, []byte(`{"type":"resize","data":{"width":80,"height":24}}`), true, 80, 24)
+}
+
+func TestWsPing_Success(t *testing.T) {
+	t.Parallel()
+
+	serverConn, _ := newTestWSPair(t)
+
+	var mu sync.Mutex
+	err := wsPing(serverConn, &mu)
+	require.NoError(t, err)
+}
+
+func TestWsPing_ClosedConnection(t *testing.T) {
+	t.Parallel()
+
+	serverConn := newTestWSConn(t)
+
+	err := serverConn.Close()
+	require.NoError(t, err)
+
+	var mu sync.Mutex
+	err = wsPing(serverConn, &mu)
+	require.Error(t, err)
+}
+
+func TestWsWrite_ClosedConnection(t *testing.T) {
+	t.Parallel()
+
+	serverConn := newTestWSConn(t)
+
+	err := serverConn.Close()
+	require.NoError(t, err)
+
+	var mu sync.Mutex
+	err = wsWrite(serverConn, &mu, "hello")
+	require.Error(t, err)
+}
+
+func TestWriteReaderToWebSocket_ClosedConnection(t *testing.T) {
+	t.Parallel()
+
+	serverConn := newTestWSConn(t)
+
+	err := serverConn.Close()
+	require.NoError(t, err)
+
+	var mu sync.Mutex
+	errorChan := make(chan error, 2)
+	go WriteReaderToWebSocket(serverConn, &mu, strings.NewReader("hello"), errorChan)
+
+	err = <-errorChan
+	require.Error(t, err)
+}
+
+func TestStreamFromReaderToWebsocket_ClosedConnection(t *testing.T) {
+	t.Parallel()
+
+	serverConn := newTestWSConn(t)
+
+	err := serverConn.Close()
+	require.NoError(t, err)
+
+	errorChan := make(chan error, 1)
+	go StreamFromReaderToWebsocket(serverConn, strings.NewReader("hello"), errorChan)
+
+	err = <-errorChan
+	require.Error(t, err)
+}
+
+func TestHijackRequest_UnexpectedStatus(t *testing.T) {
+	t.Parallel()
+
+	serverConn, _ := newTestWSPair(t)
+
+	backendServer, backendClient := net.Pipe()
+	defer logs.CloseAndLogErr(backendServer)
+	defer logs.CloseAndLogErr(backendClient)
+
+	go func() {
+		buf := make([]byte, 4096)
+		if _, err := backendServer.Read(buf); err != nil {
+			return
+		}
+
+		resp := "HTTP/1.1 403 Forbidden\r\nContent-Length: 0\r\n\r\n"
+		if _, err := backendServer.Write([]byte(resp)); err != nil {
+			return
+		}
+	}()
+
+	req, err := http.NewRequestWithContext(t.Context(), http.MethodGet, "http://backend/", nil)
+	require.NoError(t, err)
+
+	err = HijackRequest(serverConn, backendClient, req)
+	require.ErrorContains(t, err, "403")
+}
+
+func TestHijackRequest_Success(t *testing.T) {
+	t.Parallel()
+
+	serverConn, _ := newTestWSPair(t)
+
+	backendServer, backendClient := net.Pipe()
+	defer logs.CloseAndLogErr(backendClient)
+
+	go func() {
+		defer logs.CloseAndLogErr(backendServer)
+
+		buf := make([]byte, 4096)
+		if _, err := backendServer.Read(buf); err != nil {
+			return
+		}
+
+		resp := "HTTP/1.1 101 Switching Protocols\r\nUpgrade: websocket\r\nConnection: Upgrade\r\n\r\n"
+		if _, err := backendServer.Write([]byte(resp)); err != nil {
+			return
+		}
+	}()
+
+	req, err := http.NewRequestWithContext(t.Context(), http.MethodGet, "http://backend/", nil)
+	require.NoError(t, err)
+
+	// The backend closes after sending 101, which delivers EOF to the reader goroutine.
+	// HijackRequest treats EOF (not a CloseError) as a clean session end and returns nil.
+	err = HijackRequest(serverConn, backendClient, req)
+	require.NoError(t, err)
+}
diff --git a/app/__mocks__/fileMock.js b/app/__mocks__/fileMock.js
new file mode 100644
index 0000000..86059f3
--- /dev/null
+++ b/app/__mocks__/fileMock.js
@@ -0,0 +1 @@
+module.exports = 'test-file-stub';
diff --git a/app/__mocks__/i18next.test.ts b/app/__mocks__/i18next.test.ts
new file mode 100644
index 0000000..e6cc970
--- /dev/null
+++ b/app/__mocks__/i18next.test.ts
@@ -0,0 +1,39 @@
+import * as i18nextMocks from './i18next';
+
+describe('mockT', () => {
+  it('should return correctly with no arguments', async () => {
+    const testText = `The company's new IT initiative, code named Phoenix Project, is critical to the
+        future of Parts Unlimited, but the project is massively over budget and very late. The CEO wants
+        Bill to report directly to him and fix the mess in ninety days or else Bill's entire department
+        will be outsourced.`;
+
+    const translatedText = i18nextMocks.mockT(testText);
+
+    expect(translatedText).toBe(testText);
+  });
+
+  test.each`
+    testText                            | args                                          | expectedText
+    ${'{{fileName}} is invalid.'}       | ${{ fileName: 'example_5.csv' }}              | ${'example_5.csv is invalid.'}
+    ${'{{fileName}} {is}.'}             | ${{ fileName: '   ' }}                        | ${'    {is}.'}
+    ${'{{number}} of {{total}}'}        | ${{ number: 0, total: 999 }}                  | ${'0 of 999'}
+    ${'There was an error:\n{{error}}'} | ${{ error: 'Failed' }}                        | ${'There was an error:\nFailed'}
+    ${'Click:{{li}}{{li2}}{{li_3}}'}    | ${{ li: '', li2: 'https://', li_3: '!@#$%' }} | ${'Click:https://!@#$%'}
+    ${'{{happy}}😏y✔{{sad}}{{laugh}}'}  | ${{ happy: '😃', sad: '😢', laugh: '🤣' }}    | ${'😃😏y✔😢🤣'}
+  `(
+    'should return correctly while handling arguments in different scenarios',
+    ({ testText, args, expectedText }) => {
+      const translatedText = i18nextMocks.mockT(testText, args);
+
+      expect(translatedText).toBe(expectedText);
+    }
+  );
+});
+
+describe('language', () => {
+  it('should return language', async () => {
+    const { language } = i18nextMocks.default;
+
+    expect(language).toBe('en');
+  });
+});
diff --git a/app/__mocks__/i18next.ts b/app/__mocks__/i18next.ts
new file mode 100644
index 0000000..4194dd0
--- /dev/null
+++ b/app/__mocks__/i18next.ts
@@ -0,0 +1,35 @@
+function replaceBetween(
+  startIndex: number,
+  endIndex: number,
+  original: string,
+  insertion: string
+) {
+  const result =
+    original.substring(0, startIndex) +
+    insertion +
+    original.substring(endIndex);
+  return result;
+}
+
+export function mockT(i18nKey: string, args?: Record<string, string>) {
+  let key = i18nKey;
+
+  while (key.includes('{{') && args) {
+    const startIndex = key.indexOf('{{');
+    const endIndex = key.indexOf('}}');
+
+    const currentArg = key.substring(startIndex + 2, endIndex);
+    const value = args[currentArg];
+
+    key = replaceBetween(startIndex, endIndex + 2, key, value);
+  }
+
+  return key;
+}
+
+export default {
+  t: mockT,
+  language: 'en',
+  changeLanguage: () => new Promise(() => {}),
+  use: () => this,
+};
diff --git a/app/__mocks__/react-i18next.tsx b/app/__mocks__/react-i18next.tsx
new file mode 100644
index 0000000..f2aa454
--- /dev/null
+++ b/app/__mocks__/react-i18next.tsx
@@ -0,0 +1,16 @@
+import { PropsWithChildren } from 'react';
+
+import { mockT } from './i18next';
+
+export function useTranslation() {
+  return {
+    t: mockT,
+    i18n: {
+      changeLanguage: () => new Promise(() => {}),
+    },
+  };
+}
+
+export function Trans({ children }: PropsWithChildren<unknown>) {
+  return <>{children}</>;
+}
diff --git a/app/__mocks__/styleMock.js b/app/__mocks__/styleMock.js
new file mode 100644
index 0000000..f053ebf
--- /dev/null
+++ b/app/__mocks__/styleMock.js
@@ -0,0 +1 @@
+module.exports = {};
diff --git a/app/__mocks__/svg.tsx b/app/__mocks__/svg.tsx
new file mode 100644
index 0000000..42e49b9
--- /dev/null
+++ b/app/__mocks__/svg.tsx
@@ -0,0 +1,10 @@
+import { forwardRef } from 'react';
+
+const SvgrMock = forwardRef<HTMLSpanElement>((props, ref) => (
+  // eslint-disable-next-line react/jsx-props-no-spreading
+  <span ref={ref} {...props} />
+));
+
+SvgrMock.displayName = 'SvgrMock';
+
+export default SvgrMock;
diff --git a/app/agent/components/host-browser/hostBrowser.html b/app/agent/components/host-browser/hostBrowser.html
new file mode 100644
index 0000000..53704c6
--- /dev/null
+++ b/app/agent/components/host-browser/hostBrowser.html
@@ -0,0 +1,12 @@
+<agent-host-browser-react
+  ng-if="$ctrl.files"
+  dataset="$ctrl.files"
+  is-root="$ctrl.isRoot()"
+  on-go-to-parent="($ctrl.goToParent)"
+  relative-path="$ctrl.getRelativePath()"
+  on-browse="($ctrl.browse)"
+  on-rename="($ctrl.renameFile)"
+  on-download="($ctrl.downloadFile)"
+  on-delete="($ctrl.confirmDeleteFile)"
+  on-file-selected-for-upload="($ctrl.onFileSelectedForUpload)"
+></agent-host-browser-react>
diff --git a/app/agent/components/host-browser/hostBrowserController.js b/app/agent/components/host-browser/hostBrowserController.js
new file mode 100644
index 0000000..4d5ddaa
--- /dev/null
+++ b/app/agent/components/host-browser/hostBrowserController.js
@@ -0,0 +1,163 @@
+import _ from 'lodash-es';
+import { confirmDelete } from '@@/modals/confirm';
+
+const ROOT_PATH = '/host';
+
+export class HostBrowserController {
+  /* @ngInject */
+  constructor($async, HostBrowserService, Notifications, FileSaver) {
+    Object.assign(this, { $async, HostBrowserService, Notifications, FileSaver });
+
+    this.state = {
+      path: ROOT_PATH,
+    };
+
+    this.goToParent = this.goToParent.bind(this);
+    this.browse = this.browse.bind(this);
+    this.confirmDeleteFile = this.confirmDeleteFile.bind(this);
+    this.isRoot = this.isRoot.bind(this);
+    this.getRelativePath = this.getRelativePath.bind(this);
+    this.getFilesForPath = this.getFilesForPath.bind(this);
+    this.getFilesForPathAsync = this.getFilesForPathAsync.bind(this);
+    this.downloadFile = this.downloadFile.bind(this);
+    this.downloadFileAsync = this.downloadFileAsync.bind(this);
+    this.renameFile = this.renameFile.bind(this);
+    this.renameFileAsync = this.renameFileAsync.bind(this);
+    this.deleteFile = this.deleteFile.bind(this);
+    this.deleteFileAsync = this.deleteFileAsync.bind(this);
+    this.onFileSelectedForUpload = this.onFileSelectedForUpload.bind(this);
+    this.onFileSelectedForUploadAsync = this.onFileSelectedForUploadAsync.bind(this);
+  }
+
+  getRelativePath(path) {
+    path = path || this.state.path;
+    const rootPathRegex = new RegExp(`^${ROOT_PATH}/?`);
+    const relativePath = path.replace(rootPathRegex, '/');
+    return relativePath;
+  }
+
+  goToParent() {
+    this.getFilesForPath(this.parentPath(this.state.path));
+  }
+
+  isRoot() {
+    return this.state.path === ROOT_PATH;
+  }
+
+  browse(folder) {
+    this.getFilesForPath(this.buildPath(this.state.path, folder));
+  }
+
+  getFilesForPath(path) {
+    return this.$async(this.getFilesForPathAsync, path);
+  }
+  async getFilesForPathAsync(path) {
+    try {
+      const files = await this.HostBrowserService.ls(this.endpointId, path);
+      this.state.path = path;
+      this.files = files;
+    } catch (err) {
+      this.Notifications.error('Failure', err, 'Unable to browse');
+    }
+  }
+
+  renameFile(name, newName) {
+    return this.$async(this.renameFileAsync, name, newName);
+  }
+  async renameFileAsync(name, newName) {
+    const filePath = this.buildPath(this.state.path, name);
+    const newFilePath = this.buildPath(this.state.path, newName);
+    try {
+      await this.HostBrowserService.rename(this.endpointId, filePath, newFilePath);
+      this.Notifications.success('File successfully renamed', this.getRelativePath(newFilePath));
+      const files = await this.HostBrowserService.ls(this.endpointId, this.state.path);
+      this.files = files;
+    } catch (err) {
+      this.Notifications.error('Failure', err, 'Unable to rename file');
+    }
+  }
+
+  downloadFile(fileName) {
+    return this.$async(this.downloadFileAsync, fileName);
+  }
+  async downloadFileAsync(fileName) {
+    const filePath = this.buildPath(this.state.path, fileName);
+    try {
+      const { file } = await this.HostBrowserService.get(this.endpointId, filePath);
+      const downloadData = new Blob([file], {
+        type: 'text/plain;charset=utf-8',
+      });
+      this.FileSaver.saveAs(downloadData, fileName);
+    } catch (err) {
+      this.Notifications.error('Failure', err, 'Unable to download file');
+    }
+  }
+
+  confirmDeleteFile(name) {
+    const filePath = this.buildPath(this.state.path, name);
+
+    confirmDelete(`Are you sure that you want to delete ${this.getRelativePath(filePath)}?`).then((confirmed) => {
+      if (!confirmed) {
+        return;
+      }
+      return this.deleteFile(filePath);
+    });
+  }
+
+  deleteFile(path) {
+    this.$async(this.deleteFileAsync, path);
+  }
+  async deleteFileAsync(path) {
+    try {
+      await this.HostBrowserService.delete(this.endpointId, path);
+      this.Notifications.success('File successfully deleted', this.getRelativePath(path));
+      const files = await this.HostBrowserService.ls(this.endpointId, this.state.path);
+      this.files = files;
+    } catch (err) {
+      this.Notifications.error('Failure', err, 'Unable to delete file');
+    }
+  }
+
+  $onInit() {
+    this.getFilesForPath(ROOT_PATH);
+  }
+
+  parentPath(path) {
+    if (path === ROOT_PATH) {
+      return ROOT_PATH;
+    }
+
+    const split = _.split(path, '/');
+    return _.join(_.slice(split, 0, split.length - 1), '/');
+  }
+
+  buildPath(parent, file) {
+    if (parent.lastIndexOf('/') === parent.length - 1) {
+      return parent + file;
+    }
+    return parent + '/' + file;
+  }
+
+  onFileSelectedForUpload(file) {
+    return this.$async(this.onFileSelectedForUploadAsync, file);
+  }
+  async onFileSelectedForUploadAsync(file) {
+    if (!this.endpointId) {
+      throw new Error('missing endpoint id');
+    }
+    try {
+      await this.HostBrowserService.upload(this.endpointId, this.state.path, file);
+      this.onFileUploaded();
+    } catch (err) {
+      this.Notifications.error('Failure', err, 'Unable to upload file');
+    }
+  }
+
+  onFileUploaded() {
+    this.refreshList();
+  }
+
+  refreshList() {
+    this.getFilesForPath(this.state.path);
+  }
+}
diff --git a/app/agent/components/host-browser/index.js b/app/agent/components/host-browser/index.js
new file mode 100644
index 0000000..936d16b
--- /dev/null
+++ b/app/agent/components/host-browser/index.js
@@ -0,0 +1,10 @@
+import angular from 'angular';
+import { HostBrowserController } from './hostBrowserController';
+
+angular.module('portainer.agent').component('hostBrowser', {
+  controller: HostBrowserController,
+  templateUrl: './hostBrowser.html',
+  bindings: {
+    endpointId: '<',
+  },
+});
diff --git a/app/agent/components/node-selector/index.js b/app/agent/components/node-selector/index.js
new file mode 100644
index 0000000..a489f99
--- /dev/null
+++ b/app/agent/components/node-selector/index.js
@@ -0,0 +1,12 @@
+import angular from 'angular';
+
+import { NodeSelectorController } from './nodeSelectorController';
+
+angular.module('portainer.agent').component('nodeSelector', {
+  templateUrl: './nodeSelector.html',
+  controller: NodeSelectorController,
+  bindings: {
+    model: '=',
+    endpointId: '<',
+  },
+});
diff --git a/app/agent/components/node-selector/nodeSelector.html b/app/agent/components/node-selector/nodeSelector.html
new file mode 100644
index 0000000..7cf9815
--- /dev/null
+++ b/app/agent/components/node-selector/nodeSelector.html
@@ -0,0 +1,6 @@
+<div class="form-group">
+  <label for="target_node" class="col-sm-1 control-label text-left">Node</label>
+  <div class="col-sm-11">
+    <select class="form-control" ng-model="$ctrl.model" ng-options="agent.NodeName as agent.NodeName for agent in $ctrl.agents" data-cy="target-node-c"></select>
+  </div>
+</div>
diff --git a/app/agent/components/node-selector/nodeSelectorController.js b/app/agent/components/node-selector/nodeSelectorController.js
new file mode 100644
index 0000000..26cd5bd
--- /dev/null
+++ b/app/agent/components/node-selector/nodeSelectorController.js
@@ -0,0 +1,18 @@
+export class NodeSelectorController {
+  /* @ngInject */
+  constructor(AgentService, Notifications) {
+    Object.assign(this, { AgentService, Notifications });
+  }
+
+  async $onInit() {
+    try {
+      const agents = await this.AgentService.agents(this.endpointId);
+      this.agents = agents;
+      if (!this.model) {
+        this.model = agents[0].NodeName;
+      }
+    } catch (err) {
+      this.Notifications.error('Failure', err, 'Unable to load agents');
+    }
+  }
+}
diff --git a/app/agent/components/volume-browser/index.js b/app/agent/components/volume-browser/index.js
new file mode 100644
index 0000000..5d5104c
--- /dev/null
+++ b/app/agent/components/volume-browser/index.js
@@ -0,0 +1,14 @@
+import angular from 'angular';
+
+import { VolumeBrowserController } from './volumeBrowserController';
+
+angular.module('portainer.agent').component('volumeBrowser', {
+  templateUrl: './volumeBrowser.html',
+  controller: VolumeBrowserController,
+  bindings: {
+    volumeId: '<',
+    nodeName: '<',
+    isUploadEnabled: '<',
+    endpointId: '<',
+  },
+});
diff --git a/app/agent/components/volume-browser/volumeBrowser.html b/app/agent/components/volume-browser/volumeBrowser.html
new file mode 100644
index 0000000..76f20ef
--- /dev/null
+++ b/app/agent/components/volume-browser/volumeBrowser.html
@@ -0,0 +1,13 @@
+<agent-volume-browser-react
+  ng-if="$ctrl.files"
+  dataset="$ctrl.files"
+  is-root="$ctrl.state.path === '/'"
+  on-go-to-parent="($ctrl.up)"
+  on-browse="($ctrl.browse)"
+  on-rename="($ctrl.rename)"
+  on-download="($ctrl.download)"
+  on-delete="($ctrl.confirmDelete)"
+  is-upload-allowed="$ctrl.isUploadEnabled"
+  on-file-selected-for-upload="($ctrl.onFileSelectedForUpload)"
+  relative-path="$ctrl.state.path"
+></agent-volume-browser-react>
diff --git a/app/agent/components/volume-browser/volumeBrowserController.js b/app/agent/components/volume-browser/volumeBrowserController.js
new file mode 100644
index 0000000..c0f3073
--- /dev/null
+++ b/app/agent/components/volume-browser/volumeBrowserController.js
@@ -0,0 +1,154 @@
+import _ from 'lodash-es';
+import { confirmDelete } from '@@/modals/confirm';
+
+export class VolumeBrowserController {
+  /* @ngInject */
+  constructor($async, HttpRequestHelper, VolumeBrowserService, FileSaver, Blob, Notifications) {
+    Object.assign(this, { $async, HttpRequestHelper, VolumeBrowserService, FileSaver, Blob, Notifications });
+    this.state = {
+      path: '/',
+    };
+
+    this.rename = this.rename.bind(this);
+    this.renameAsync = this.renameAsync.bind(this);
+    this.confirmDelete = this.confirmDelete.bind(this);
+    this.download = this.download.bind(this);
+    this.downloadAsync = this.downloadAsync.bind(this);
+    this.up = this.up.bind(this);
+    this.browse = this.browse.bind(this);
+    this.deleteFile = this.deleteFile.bind(this);
+    this.deleteFileAsync = this.deleteFileAsync.bind(this);
+    this.getFilesForPath = this.getFilesForPath.bind(this);
+    this.getFilesForPathAsync = this.getFilesForPathAsync.bind(this);
+    this.onFileSelectedForUpload = this.onFileSelectedForUpload.bind(this);
+    this.onFileSelectedForUploadAsync = this.onFileSelectedForUploadAsync.bind(this);
+    this.parentPath = this.parentPath.bind(this);
+    this.buildPath = this.buildPath.bind(this);
+    this.$onInit = this.$onInit.bind(this);
+    this.onFileUploaded = this.onFileUploaded.bind(this);
+    this.refreshList = this.refreshList.bind(this);
+  }
+
+  rename(file, newName) {
+    return this.$async(this.renameAsync, file, newName);
+  }
+  async renameAsync(file, newName) {
+    const filePath = this.state.path === '/' ? file : `${this.state.path}/${file}`;
+    const newFilePath = this.state.path === '/' ? newName : `${this.state.path}/${newName}`;
+
+    try {
+      await this.VolumeBrowserService.rename(this.endpointId, this.volumeId, filePath, newFilePath);
+      this.Notifications.success('File successfully renamed', newFilePath);
+      this.files = await this.VolumeBrowserService.ls(this.endpointId, this.volumeId, this.state.path);
+    } catch (err) {
+      this.Notifications.error('Failure', err, 'Unable to rename file');
+    }
+  }
+
+  confirmDelete(file) {
+    const filePath = this.state.path === '/' ? file : `${this.state.path}/${file}`;
+
+    confirmDelete(`Are you sure that you want to delete ${filePath} ?`).then((confirmed) => {
+      if (!confirmed) {
+        return;
+      }
+      this.deleteFile(filePath);
+    });
+  }
+
+  download(file) {
+    return this.$async(this.downloadAsync, file);
+  }
+  async downloadAsync(file) {
+    const filePath = this.state.path === '/' ? file : `${this.state.path}/${file}`;
+
+    try {
+      const data = await this.VolumeBrowserService.get(this.endpointId, this.volumeId, filePath);
+      const downloadData = new Blob([data.file]);
+      this.FileSaver.saveAs(downloadData, file);
+    } catch (err) {
+      this.Notifications.error('Failure', err, 'Unable to download file');
+    }
+  }
+
+  up() {
+    const parentFolder = this.parentPath(this.state.path);
+    this.getFilesForPath(parentFolder);
+  }
+
+  browse(folder) {
+    const path = this.buildPath(this.state.path, folder);
+    this.getFilesForPath(path);
+  }
+
+  deleteFile(file) {
+    return this.$async(this.deleteFileAsync, file);
+  }
+  async deleteFileAsync(file) {
+    try {
+      await this.VolumeBrowserService.delete(this.endpointId, this.volumeId, file);
+      this.Notifications.success('File successfully deleted', file);
+      this.files = await this.VolumeBrowserService.ls(this.endpointId, this.volumeId, this.state.path);
+    } catch (err) {
+      this.Notifications.error('Failure', err, 'Unable to delete file');
+    }
+  }
+
+  getFilesForPath(path) {
+    return this.$async(this.getFilesForPathAsync, path);
+  }
+  async getFilesForPathAsync(path) {
+    try {
+      const files = await this.VolumeBrowserService.ls(this.endpointId, this.volumeId, path);
+      this.state.path = path;
+      this.files = files;
+    } catch (err) {
+      this.Notifications.error('Failure', err, 'Unable to browse volume');
+    }
+  }
+
+  onFileSelectedForUpload(file) {
+    return this.$async(this.onFileSelectedForUploadAsync, file);
+  }
+  async onFileSelectedForUploadAsync(file) {
+    try {
+      await this.VolumeBrowserService.upload(this.endpointId, this.state.path, file, this.volumeId);
+      this.onFileUploaded();
+    } catch (err) {
+      this.Notifications.error('Failure', err, 'Unable to upload file');
+    }
+  }
+
+  parentPath(path) {
+    if (path.lastIndexOf('/') === 0) {
+      return '/';
+    }
+
+    const split = _.split(path, '/');
+    return _.join(_.slice(split, 0, split.length - 1), '/');
+  }
+
+  buildPath(parent, file) {
+    if (parent === '/') {
+      return parent + file;
+    }
+    return `${parent}/${file}`;
+  }
+
+  onFileUploaded() {
+    this.refreshList();
+  }
+
+  refreshList() {
+    this.getFilesForPath(this.state.path);
+  }
+
+  async $onInit() {
+    this.HttpRequestHelper.setPortainerAgentTargetHeader(this.nodeName);
+    try {
+      this.files = await this.VolumeBrowserService.ls(this.endpointId, this.volumeId, this.state.path);
+    } catch (err) {
+      this.Notifications.error('Failure', err, 'Unable to browse volume');
+    }
+  }
+}
diff --git a/app/agent/index.js b/app/agent/index.js
new file mode 100644
index 0000000..140612a
--- /dev/null
+++ b/app/agent/index.js
@@ -0,0 +1,3 @@
+import angular from 'angular';
+
+angular.module('portainer.agent', []);
diff --git a/app/agent/models/agent.js b/app/agent/models/agent.js
new file mode 100644
index 0000000..c417265
--- /dev/null
+++ b/app/agent/models/agent.js
@@ -0,0 +1,7 @@
+export class AgentViewModel {
+  constructor(data) {
+    this.IPAddress = data.IPAddress;
+    this.NodeName = data.NodeName;
+    this.NodeRole = data.NodeRole;
+  }
+}
diff --git a/app/agent/rest/agent.js b/app/agent/rest/agent.js
new file mode 100644
index 0000000..fc93a52
--- /dev/null
+++ b/app/agent/rest/agent.js
@@ -0,0 +1,15 @@
+import angular from 'angular';
+
+angular.module('portainer.agent').factory('Agent', AgentFactory);
+
+function AgentFactory($resource, API_ENDPOINT_ENDPOINTS, StateManager) {
+  return $resource(
+    `${API_ENDPOINT_ENDPOINTS}/:endpointId/docker/v:version/agents`,
+    {
+      version: StateManager.getAgentApiVersion,
+    },
+    {
+      query: { method: 'GET', isArray: true },
+    }
+  );
+}
diff --git a/app/agent/rest/browse.js b/app/agent/rest/browse.js
new file mode 100644
index 0000000..d31b315
--- /dev/null
+++ b/app/agent/rest/browse.js
@@ -0,0 +1,35 @@
+import angular from 'angular';
+
+import { browseGetResponse } from './response/browse';
+
+angular.module('portainer.agent').factory('Browse', BrowseFactory);
+
+function BrowseFactory($resource, API_ENDPOINT_ENDPOINTS, StateManager) {
+  return $resource(
+    `${API_ENDPOINT_ENDPOINTS}/:endpointId/docker/v:version/browse/:action`,
+    {
+      version: StateManager.getAgentApiVersion,
+    },
+    {
+      ls: {
+        method: 'GET',
+        isArray: true,
+        params: { action: 'ls' },
+      },
+      get: {
+        method: 'GET',
+        params: { action: 'get' },
+        transformResponse: browseGetResponse,
+        responseType: 'arraybuffer',
+      },
+      delete: {
+        method: 'DELETE',
+        params: { action: 'delete' },
+      },
+      rename: {
+        method: 'PUT',
+        params: { action: 'rename' },
+      },
+    }
+  );
+}
diff --git a/app/agent/rest/dockerhub.js b/app/agent/rest/dockerhub.js
new file mode 100644
index 0000000..369feda
--- /dev/null
+++ b/app/agent/rest/dockerhub.js
@@ -0,0 +1,13 @@
+import angular from 'angular';
+
+angular.module('portainer.agent').factory('AgentDockerhub', AgentDockerhub);
+
+function AgentDockerhub($resource, API_ENDPOINT_ENDPOINTS) {
+  return $resource(
+    `${API_ENDPOINT_ENDPOINTS}/:endpointId/agent/:endpointType/v2/dockerhub/:registryId`,
+    {},
+    {
+      limits: { method: 'GET', params: { registryId: '@registryId' } },
+    }
+  );
+}
diff --git a/app/agent/rest/host.js b/app/agent/rest/host.js
new file mode 100644
index 0000000..daed21c
--- /dev/null
+++ b/app/agent/rest/host.js
@@ -0,0 +1,15 @@
+import angular from 'angular';
+
+angular.module('portainer.agent').factory('Host', HostFactory);
+
+function HostFactory($resource, API_ENDPOINT_ENDPOINTS, StateManager) {
+  return $resource(
+    `${API_ENDPOINT_ENDPOINTS}/:endpointId/docker/v:version/host/:action`,
+    {
+      version: StateManager.getAgentApiVersion,
+    },
+    {
+      info: { method: 'GET', params: { action: 'info' } },
+    }
+  );
+}
diff --git a/app/agent/rest/ping.js b/app/agent/rest/ping.js
new file mode 100644
index 0000000..91cb559
--- /dev/null
+++ b/app/agent/rest/ping.js
@@ -0,0 +1,30 @@
+import angular from 'angular';
+
+angular.module('portainer.agent').factory('AgentPing', AgentPingFactory);
+
+function AgentPingFactory($resource, API_ENDPOINT_ENDPOINTS, $q) {
+  return $resource(
+    `${API_ENDPOINT_ENDPOINTS}/:endpointId/docker/ping`,
+    {},
+    {
+      ping: {
+        method: 'GET',
+        interceptor: {
+          response: function versionInterceptor(response) {
+            const instance = response.resource;
+            const version = response.headers('Portainer-Agent-Api-Version') || 1;
+            instance.version = Number(version);
+            return instance;
+          },
+          responseError: function versionResponseError(error) {
+            // 404 - agent is up - set version to 1
+            if (error.status === 404) {
+              return { version: 1 };
+            }
+            return $q.reject(error);
+          },
+        },
+      },
+    }
+  );
+}
diff --git a/app/agent/rest/response/browse.js b/app/agent/rest/response/browse.js
new file mode 100644
index 0000000..b88f321
--- /dev/null
+++ b/app/agent/rest/response/browse.js
@@ -0,0 +1,9 @@
+// The get action of the Browse service returns a file.
+// ngResource will transform it as an array of chars.
+// This functions simply creates a response object and assign
+// the data to a field.
+export function browseGetResponse(data) {
+  const response = {};
+  response.file = data;
+  return response;
+}
diff --git a/app/agent/rest/v1/agent.js b/app/agent/rest/v1/agent.js
new file mode 100644
index 0000000..2b69ea5
--- /dev/null
+++ b/app/agent/rest/v1/agent.js
@@ -0,0 +1,13 @@
+import angular from 'angular';
+
+angular.module('portainer.agent').factory('AgentVersion1', AgentFactory);
+
+function AgentFactory($resource, API_ENDPOINT_ENDPOINTS) {
+  return $resource(
+    `${API_ENDPOINT_ENDPOINTS}/:endpointId/docker/agents`,
+    {},
+    {
+      query: { method: 'GET', isArray: true },
+    }
+  );
+}
diff --git a/app/agent/rest/v1/browse.js b/app/agent/rest/v1/browse.js
new file mode 100644
index 0000000..f192185
--- /dev/null
+++ b/app/agent/rest/v1/browse.js
@@ -0,0 +1,33 @@
+import angular from 'angular';
+
+import { browseGetResponse } from '../response/browse';
+
+angular.module('portainer.agent').factory('BrowseVersion1', BrowseFactory);
+
+function BrowseFactory($resource, API_ENDPOINT_ENDPOINTS) {
+  return $resource(
+    `${API_ENDPOINT_ENDPOINTS}/:endpointId/docker/browse/:volumeID/:action`,
+    {},
+    {
+      ls: {
+        method: 'GET',
+        isArray: true,
+        params: { action: 'ls' },
+      },
+      get: {
+        method: 'GET',
+        params: { action: 'get' },
+        transformResponse: browseGetResponse,
+        responseType: 'arraybuffer',
+      },
+      delete: {
+        method: 'DELETE',
+        params: { action: 'delete' },
+      },
+      rename: {
+        method: 'PUT',
+        params: { action: 'rename' },
+      },
+    }
+  );
+}
diff --git a/app/agent/services/agentService.js b/app/agent/services/agentService.js
new file mode 100644
index 0000000..03a6de4
--- /dev/null
+++ b/app/agent/services/agentService.js
@@ -0,0 +1,39 @@
+import angular from 'angular';
+
+import { AgentViewModel } from '../models/agent';
+
+angular.module('portainer.agent').factory('AgentService', AgentServiceFactory);
+
+function AgentServiceFactory(Agent, AgentVersion1, HttpRequestHelper, Host, StateManager) {
+  return {
+    agents,
+    hostInfo,
+  };
+
+  function getAgentApiVersion() {
+    const state = StateManager.getState();
+    return state.endpoint.agentApiVersion;
+  }
+
+  function hostInfo(endpointId, nodeName) {
+    HttpRequestHelper.setPortainerAgentTargetHeader(nodeName);
+    return Host.info({ endpointId }).$promise;
+  }
+
+  /**
+   * @deprecated
+   * useAgentNodes instead
+   */
+  async function agents(endpointId) {
+    const agentVersion = getAgentApiVersion();
+    const service = agentVersion > 1 ? Agent : AgentVersion1;
+    try {
+      const agents = await service.query({ version: agentVersion, endpointId }).$promise;
+      return agents.map(function (item) {
+        return new AgentViewModel(item);
+      });
+    } catch (err) {
+      throw { msg: 'Unable to retrieve agents', err };
+    }
+  }
+}
diff --git a/app/agent/services/hostBrowserService.js b/app/agent/services/hostBrowserService.js
new file mode 100644
index 0000000..1c369fc
--- /dev/null
+++ b/app/agent/services/hostBrowserService.js
@@ -0,0 +1,40 @@
+import angular from 'angular';
+
+angular.module('portainer.agent').factory('HostBrowserService', HostBrowserServiceFactory);
+
+/* @ngInject */
+function HostBrowserServiceFactory(Browse, Upload, API_ENDPOINT_ENDPOINTS, StateManager) {
+  return { ls, get, delete: deletePath, rename, upload };
+
+  function ls(endpointId, path) {
+    return Browse.ls({ endpointId, path: path }).$promise;
+  }
+
+  function get(endpointId, path) {
+    return Browse.get({ endpointId, path: path }).$promise;
+  }
+
+  function deletePath(endpointId, path) {
+    return Browse.delete({ endpointId, path: path }).$promise;
+  }
+
+  function rename(endpointId, path, newPath) {
+    const payload = {
+      CurrentFilePath: path,
+      NewFilePath: newPath,
+    };
+    return Browse.rename({ endpointId }, payload).$promise;
+  }
+
+  function upload(endpointId, Path, file, onProgress) {
+    const agentVersion = StateManager.getAgentApiVersion();
+    const url = `${API_ENDPOINT_ENDPOINTS}/${endpointId}/docker${agentVersion > 1 ? '/v' + agentVersion : ''}/browse/put`;
+
+    return new Promise((resolve, reject) => {
+      Upload.upload({
+        url: url,
+        data: { file, Path },
+      }).then(resolve, reject, onProgress);
+    });
+  }
+}
diff --git a/app/agent/services/pingService.js b/app/agent/services/pingService.js
new file mode 100644
index 0000000..02d0f57
--- /dev/null
+++ b/app/agent/services/pingService.js
@@ -0,0 +1,11 @@
+import angular from 'angular';
+
+angular.module('portainer.agent').service('AgentPingService', AgentPingService);
+
+function AgentPingService(AgentPing) {
+  return { ping };
+
+  function ping(endpointId) {
+    return AgentPing.ping({ endpointId }).$promise;
+  }
+}
diff --git a/app/agent/services/volumeBrowserService.js b/app/agent/services/volumeBrowserService.js
new file mode 100644
index 0000000..575696e
--- /dev/null
+++ b/app/agent/services/volumeBrowserService.js
@@ -0,0 +1,60 @@
+import angular from 'angular';
+
+angular.module('portainer.agent').factory('VolumeBrowserService', VolumeBrowserServiceFactory);
+
+/* @ngInject */
+function VolumeBrowserServiceFactory(StateManager, Browse, BrowseVersion1, API_ENDPOINT_ENDPOINTS, Upload) {
+  return {
+    ls,
+    get,
+    delete: deletePath,
+    rename,
+    upload,
+  };
+
+  function getAgentApiVersion() {
+    const state = StateManager.getState();
+    return state.endpoint.agentApiVersion;
+  }
+
+  function getBrowseService() {
+    const agentVersion = getAgentApiVersion();
+    return agentVersion > 1 ? Browse : BrowseVersion1;
+  }
+
+  function ls(endpointId, volumeId, path) {
+    return getBrowseService().ls({ endpointId, volumeID: volumeId, path, version: getAgentApiVersion() }).$promise;
+  }
+
+  function get(endpointId, volumeId, path) {
+    return getBrowseService().get({ endpointId, volumeID: volumeId, path, version: getAgentApiVersion() }).$promise;
+  }
+
+  function deletePath(endpointId, volumeId, path) {
+    return getBrowseService().delete({ endpointId, volumeID: volumeId, path, version: getAgentApiVersion() }).$promise;
+  }
+
+  function rename(endpointId, volumeId, path, newPath) {
+    const payload = {
+      CurrentFilePath: path,
+      NewFilePath: newPath,
+    };
+    return getBrowseService().rename({ endpointId, volumeID: volumeId, version: getAgentApiVersion() }, payload).$promise;
+  }
+
+  function upload(endpointId, path, file, volumeId, onProgress) {
+    const agentVersion = StateManager.getAgentApiVersion();
+    if (agentVersion < 2) {
+      throw new Error('upload is not supported on this agent version');
+    }
+
+    const url = `${API_ENDPOINT_ENDPOINTS}/${endpointId}/docker/v${agentVersion}/browse/put?volumeID=${volumeId}`;
+
+    return new Promise((resolve, reject) => {
+      Upload.upload({
+        url: url,
+        data: { file, Path: path },
+      }).then(resolve, reject, onProgress);
+    });
+  }
+}
diff --git a/app/app.js b/app/app.js
new file mode 100644
index 0000000..f5286f5
--- /dev/null
+++ b/app/app.js
@@ -0,0 +1,37 @@
+import $ from 'jquery';
+
+/* @ngInject */
+export function onStartupAngular($rootScope, $state, cfpLoadingBar, $transitions, HttpRequestHelper) {
+  $rootScope.$state = $state;
+
+  // Workaround to prevent the loading bar from going backward
+  // https://github.com/chieffancypants/angular-loading-bar/issues/273
+  const originalSet = cfpLoadingBar.set;
+  cfpLoadingBar.set = function overrideSet(n) {
+    if (n > cfpLoadingBar.status()) {
+      originalSet.apply(cfpLoadingBar, arguments);
+    }
+  };
+
+  $transitions.onBefore({}, () => {
+    HttpRequestHelper.resetAgentHeaders();
+  });
+
+  // EE-6751: screens not loading  when switching quickly between side menu options
+  // Known bug of @uirouter/angularjs
+  // Fix found at https://github.com/angular-ui/ui-router/issues/3652#issuecomment-574499009
+  // This hook is cleaning the internal viewConfigs list, removing leftover data unrelated to the current transition
+  $transitions.onStart({}, (transition) => {
+    const toList = transition.treeChanges().to.map((t) => t.state.name);
+    const toConfigs = transition.router.viewService._viewConfigs.filter((vc) => toList.includes(vc.viewDecl.$context.name));
+    transition.router.viewService._viewConfigs = toConfigs;
+  });
+
+  $(document).ajaxSend((event, jqXhr, jqOpts) => {
+    const type = jqOpts.type === 'POST' || jqOpts.type === 'PUT' || jqOpts.type === 'PATCH';
+    const hasNoContentType = jqOpts.contentType !== 'application/json' && jqOpts.headers && !jqOpts.headers['Content-Type'];
+    if (type && hasNoContentType) {
+      jqXhr.setRequestHeader('Content-Type', 'application/json');
+    }
+  });
+}
diff --git a/app/assets/css/app.css b/app/assets/css/app.css
new file mode 100644
index 0000000..93c176d
--- /dev/null
+++ b/app/assets/css/app.css
@@ -0,0 +1,730 @@
+@tailwind base;
+@tailwind components;
+@tailwind utilities;
+
+@font-face {
+  font-family: 'Inter';
+  src: url('../fonts/Inter-VariableFont.ttf') format('truetype');
+  font-weight: 100 900;
+  font-style: normal;
+}
+@media screen and (-webkit-min-device-pixel-ratio: 0) {
+  select {
+    font-family: Inter, Arial, Helvetica, sans-serif;
+  }
+}
+
+html {
+  font-size: 16px;
+  overflow-y: scroll;
+  scroll-behavior: smooth;
+}
+
+html[theme='dark'],
+html[theme='highcontrast'] {
+  /* make the scrollbars dark theme when in the dark modes */
+  color-scheme: dark;
+}
+
+body {
+  background: var(--bg-body-color);
+  font-family: 'Inter';
+  color: var(--text-body-color) !important;
+}
+
+.bg-widget-color {
+  background: var(--bg-widget-color);
+}
+
+html,
+body,
+#page-wrapper,
+#content-wrapper,
+.page-content,
+#view {
+  height: 100%;
+  width: 100%;
+  overflow-y: initial;
+}
+
+#view {
+  position: relative;
+}
+
+.logo {
+  display: inline;
+  max-width: 155px;
+  max-height: 55px;
+}
+
+.white-space-normal {
+  white-space: normal !important;
+}
+
+.legend .title {
+  padding: 0 0.3em;
+  margin: 0.5em;
+  border-style: solid;
+  border-width: 0 0 0 1em;
+}
+.messages {
+  max-height: 50px;
+  overflow-x: hidden;
+  overflow-y: scroll;
+}
+.containerNameInput {
+  width: 85%;
+  border: none;
+  background: none;
+  border-bottom: 1px solid black;
+}
+
+.containerNameInput:active,
+.containerNameInput:focus {
+  outline: none;
+}
+
+#network-legend {
+  text-align: center;
+}
+
+#network-legend span {
+  display: inline;
+  font-size: 18px;
+}
+
+.form-section-title {
+  @apply text-gray-9;
+  @apply th-dark:text-white;
+  @apply th-highcontrast:text-white;
+
+  margin-top: 20px;
+  margin-bottom: 10px;
+  padding-left: 0;
+  font-weight: 500;
+  font-size: 16px;
+}
+
+.form-section-title:first-child {
+  margin-top: 5px;
+}
+
+.form-horizontal .control-label.text-left,
+.form-row .control-label.text-left {
+  text-align: left;
+  font-size: 0.9em;
+}
+
+input[type='checkbox'] {
+  margin-top: 1px;
+  vertical-align: middle;
+}
+
+.md-checkbox input[type='checkbox'] {
+  width: 16px;
+  height: 16px;
+  margin-top: -1px;
+}
+
+.md-checkbox input[type='checkbox']:indeterminate + label:before {
+  content: '-';
+  align-content: center;
+  line-height: 16px;
+  text-align: center;
+}
+
+.space-right {
+  margin-right: 5px;
+}
+
+.space-left {
+  margin-left: 5px;
+}
+
+.portainer-disabled-link {
+  color: gray;
+  pointer-events: none;
+}
+
+.portainer-disabled-datatable {
+  color: gray;
+}
+
+.portainer-disabled-datatable a {
+  color: gray;
+  pointer-events: none;
+}
+
+.datatable-highlighted {
+  background-color: var(--bg-item-highlighted-color);
+}
+
+.datatable-unhighlighted {
+  background-color: var(--bg-item-highlighted-null-color);
+}
+
+.text-warning {
+  @apply text-warning-9 th-highcontrast:text-warning-1 th-dark:text-warning-7;
+}
+
+.widget .widget-body table tbody .image-tag {
+  font-size: 90% !important;
+  margin-right: 5px;
+}
+
+.widget .widget-body table tbody .label-margins {
+  margin-left: 5px;
+  margin-right: 0;
+}
+
+.widget .widget-body table tbody .fit-text-size {
+  font-size: 90% !important;
+}
+
+.widget .widget-body table thead th {
+  font-weight: normal;
+}
+
+.widget .widget-body .nowrap-cells tbody td {
+  white-space: nowrap;
+}
+
+.widget .widget-body table tbody td {
+  white-space: normal;
+  word-break: break-word;
+}
+
+.widget .widget-body table.container-details-table > tbody > tr > td:first-child {
+  word-break: normal;
+  text-transform: uppercase;
+}
+
+.widget .widget-body table.description-table {
+  table-layout: fixed;
+}
+
+.template-widget {
+  height: 100%;
+}
+
+.template-widget-body {
+  max-height: 86%;
+  overflow-y: auto;
+}
+
+.blocklist {
+  display: flex;
+  flex-direction: column;
+  padding: 10px;
+}
+
+.blocklist-item {
+  padding: 10px;
+  margin-bottom: 10px;
+  border: 1px solid var(--border-blocklist);
+  border-radius: 8px;
+  margin-right: 10px;
+}
+
+.blocklist-item--selected {
+  background-color: var(--bg-blocklist-item-selected-color);
+  border-color: var(--border-blocklist-item-selected-color);
+  color: var(--text-blocklist-item-selected-color);
+}
+
+.blocklist-item:not(.blocklist-item-not-interactive):hover {
+  @apply border border-blue-7;
+  cursor: pointer;
+
+  background-color: var(--bg-blocklist-hover-color);
+  color: var(--text-blocklist-hover-color);
+}
+
+.blocklist-item-box {
+  display: flex;
+}
+
+.blocklist-item-line {
+  display: flex;
+  justify-content: space-between;
+}
+
+.blocklist-item-logo {
+  width: 100%;
+  max-width: 60px;
+  max-height: 60px;
+}
+
+.blocklist-item-title {
+  font-size: 1.8em;
+  font-weight: bold;
+}
+
+.blocklist-item-subtitle {
+  font-size: 0.9em;
+  padding-right: 1em;
+}
+
+.blocklist-item-desc {
+  font-size: 0.9em;
+  padding-right: 1em;
+}
+
+.template-note {
+  padding: 0.5em;
+  font-size: 0.9em;
+}
+
+.nopadding {
+  padding: 0 !important;
+}
+
+.padding-top {
+  padding-top: 15px !important;
+}
+
+.nomargin {
+  margin: 0 !important;
+}
+
+.interactive {
+  cursor: pointer;
+}
+
+.custom-header-ico {
+  max-width: 32px;
+  max-height: 32px;
+}
+
+.btn-responsive {
+  padding: 5px 10px;
+  font-size: 12px;
+  line-height: 1.5;
+  border-radius: 3px;
+}
+
+.btn-datatable {
+  padding: 2.6px 7.8px 3.9px;
+  line-height: 1;
+  margin: 0px 0px 0px 0px;
+}
+
+@media screen and (min-width: 1107px) {
+  .btn-responsive {
+    padding: 6px 12px;
+    font-size: 14px;
+    line-height: 1.42857143;
+    border-radius: 4px;
+  }
+}
+
+.page-wrapper {
+  height: 100%;
+  width: 100%;
+  display: flex;
+  align-items: center;
+}
+
+.simple-box {
+  margin-bottom: 80px;
+}
+
+.simple-box > div:first-child {
+  padding-bottom: 10px;
+}
+
+.simple-box-logo {
+  display: block;
+  margin: auto;
+  position: relative;
+  width: 240px;
+  margin-bottom: 10px;
+}
+
+.simple-box-form > div {
+  margin-bottom: 25px;
+}
+
+.simple-box-form > div:last-child {
+  margin-top: 10px;
+  margin-bottom: 10px;
+}
+
+.panel-body {
+  padding: 20px 25px;
+  background-color: var(--white-color);
+  border-radius: 8px;
+}
+
+.user-box {
+  margin-right: 15px;
+}
+
+.select-endpoint {
+  width: 80%;
+  margin: 0 auto;
+}
+
+#image-layers .btn {
+  padding: 0;
+}
+
+#image-layers .expand {
+  padding-right: 0;
+}
+
+.createResource {
+  margin-left: 5px;
+  font-size: 90%;
+}
+
+@media (min-width: 768px) {
+  .margin-sm-top {
+    margin-top: 5px;
+  }
+}
+@media (min-width: 768px) {
+  .pull-sm-left {
+    float: left !important;
+  }
+  .pull-sm-right {
+    float: right !important;
+  }
+  .pull-sm-none {
+    float: none !important;
+  }
+}
+@media (min-width: 992px) {
+  .pull-md-left {
+    float: left !important;
+  }
+  .pull-md-right {
+    float: right !important;
+  }
+  .pull-md-none {
+    float: none !important;
+  }
+}
+@media (min-width: 1200px) {
+  .pull-lg-left {
+    float: left !important;
+  }
+  .pull-lg-right {
+    float: right !important;
+  }
+  .pull-lg-none {
+    float: none !important;
+  }
+}
+.pull-none {
+  float: none !important;
+}
+
+.small-select {
+  display: inline-block;
+  padding: 0px 6px;
+  margin-left: 10px;
+  color: var(--text-small-select-color);
+  background-color: var(--bg-small-select-color);
+  background-image: none;
+  border-radius: 4px;
+  font-size: 14px;
+}
+
+.visualizer_container {
+  display: flex;
+  flex-direction: row;
+  flex-wrap: wrap;
+  justify-content: space-around;
+}
+
+.visualizer_container .node {
+  border: 1px dashed var(--blue-2);
+  background-color: rgb(51, 122, 183);
+  background-color: rgba(51, 122, 183, 0.1);
+  border-radius: 4px;
+  box-shadow: 0 3px 10px -2px var(--grey-50);
+  padding: 15px;
+  margin: 5px;
+}
+
+.visualizer_container .node .node_info {
+  display: flex;
+  flex-direction: column;
+  justify-content: center;
+  text-align: center;
+  border-bottom: 1px solid var(--grey-26);
+  padding-bottom: 10px;
+}
+
+.visualizer_container .node .node_info .node_platform {
+  margin-left: 2px;
+  font-size: 16px;
+}
+
+.visualizer_container .node .node_info .node_labels {
+  border-top: 1px solid var(--grey-26);
+  padding-top: 10px;
+  margin-top: 10px;
+}
+
+.visualizer_container .node .node_info .node_label {
+  font-style: italic;
+  color: #787878;
+}
+
+.visualizer_container .node .tasks {
+  display: flex;
+  flex-direction: column;
+  margin-top: 5px;
+}
+
+.visualizer_container .node .tasks .task {
+  border: 1px solid var(--grey-6);
+  border-radius: 2px;
+  box-shadow: 0 3px 10px -2px var(--grey-50);
+  padding: 10px;
+  margin: 5px;
+  font-size: 10px;
+}
+
+.visualizer_container .node .tasks .task div {
+  padding: 2px;
+}
+
+.visualizer_container .node .tasks .task_running {
+  border-radius: 4px;
+  background-color: rgb(35, 174, 137);
+  background-color: rgba(35, 174, 137, 0.2);
+}
+
+.visualizer_container .node .tasks .task_stopped {
+  border-radius: 4px;
+  background-color: rgb(174, 35, 35);
+  background-color: rgba(174, 35, 35, 0.2);
+}
+
+.visualizer_container .node .tasks .task_warning {
+  border-radius: 4px;
+  background-color: rgb(240, 173, 78);
+  background-color: rgba(240, 173, 78, 0.2);
+}
+
+.visualizer_container .node .tasks .task_info {
+  border-radius: 4px;
+  background-color: rgb(70, 184, 218);
+  background-color: rgba(70, 184, 218, 0.2);
+}
+
+.visualizer_container .node .tasks .task .service_name {
+  text-align: center;
+  margin-bottom: 5px;
+}
+
+.log_viewer {
+  height: 100%;
+  overflow-y: scroll;
+  color: var(--text-log-viewer-color);
+  font-size: 0.85em;
+  background-color: var(--bg-log-viewer-color);
+}
+
+.log_viewer.wrap_lines {
+  white-space: pre-wrap;
+}
+
+.log_viewer .inner_line {
+  padding: 0 15px;
+  cursor: pointer;
+  margin-bottom: 0;
+}
+
+.log_viewer .inner_line:empty::after {
+  content: '.';
+  visibility: hidden;
+}
+
+.log_viewer .line_selected {
+  background-color: var(--bg-log-line-selected-color);
+}
+
+.tag:not(.token) {
+  padding: 2px 6px;
+  color: white;
+  background-color: var(--blue-2);
+  border: 1px solid #2e6da4;
+  border-radius: 4px;
+}
+
+.template-envvar {
+  padding-bottom: 5px;
+}
+
+.line-separator {
+  border-bottom: 1px solid var(--grey-26);
+  width: 50%;
+  margin: 20px auto 10px auto;
+}
+
+.modal {
+  text-align: center;
+  padding: 0 !important;
+}
+
+.striked::after {
+  border-bottom: 0.2em solid var(--grey-26);
+  content: '';
+  left: 0;
+  margin-top: calc(0.2em / 2 * -1);
+  position: absolute;
+  right: 0;
+  top: 50%;
+  z-index: 2;
+}
+
+.striketext:before,
+.striketext:after {
+  background-color: var(--grey-26);
+  content: '';
+  display: inline-block;
+  height: 1px;
+  position: relative;
+  vertical-align: middle;
+  width: 50%;
+}
+
+.striketext:before {
+  right: 0.5em;
+  margin-left: -50%;
+}
+
+.striketext:after {
+  left: 0.5em;
+  margin-right: -50%;
+}
+
+/*toaster override*/
+#toast-container > div {
+  opacity: 0.9;
+}
+/*!toaster override*/
+
+.monospaced {
+  font-family: monospace;
+  font-weight: 600;
+}
+
+/* uib-progressbar override */
+.progress-bar {
+  color: var(--text-progress-bar-color);
+}
+/* !uib-progressbar override */
+
+.loading-view-area {
+  height: 85%;
+  display: flex;
+  align-items: center;
+}
+
+/* bootstrap extend */
+.input-xs {
+  height: 22px;
+  padding: 2px 5px;
+  font-size: 12px;
+  line-height: 1.5; /* If Placeholder of the input is moved up, rem/modify this. */
+  border-radius: 3px;
+}
+/* !bootstrap extend */
+
+/* spinkit override */
+.sk-fold {
+  width: 57px;
+  height: 57px;
+}
+
+.sk-fold-cube {
+  background-color: white;
+}
+
+.sk-fold-cube:before {
+  background-color: var(--blue-2);
+}
+/* !spinkit override */
+
+/* uib-typeahead override */
+#scrollable-dropdown-menu .dropdown-menu {
+  max-height: 300px;
+  overflow-y: auto;
+}
+/* !uib-typeahead override */
+
+.no-margin {
+  margin: 0 !important;
+}
+
+.no-border {
+  border: none;
+}
+
+.text-wrap {
+  word-break: break-all;
+  white-space: normal;
+}
+
+.icon-disabled {
+  opacity: 0.5;
+  cursor: not-allowed;
+}
+
+.web-editor {
+  background-color: var(--bg-webeditor-color);
+  border-radius: 8px;
+  padding: 10px;
+}
+
+.web-editor a {
+  color: var(--text-link-color);
+}
+
+.web-editor a:hover {
+  color: var(--text-link-hover-color);
+  text-decoration-line: underline;
+}
+
+reach-portal > div {
+  z-index: 10;
+}
+
+input[style*='background-image: url("data:image/png'] + [data-cy='auth-passwordInputToggle'] {
+  right: 20px;
+}
+
+input[style*='background-image: url("data:image/png'] {
+  padding-right: 60px;
+}
+
+.web-editor .trancluded-item:empty {
+  display: none;
+}
+
+input:-webkit-autofill {
+  @apply caret-[--grey-25] th-highcontrast:caret-white th-dark:caret-white;
+}
+
+/*
+rules for styling the progress bar on both chrome and firefox
+first rule is for firefox and the second rule is for chrome
+
+use the `.progress-filled` tailwind variant util to style the filled value of the progress bar, 
+and the usual styles to style the unfilled value.
+
+see app/react/edge/edge-stacks/ListView/EdgeStacksDatatable/DeploymentCounter.tsx for an example
+*/
+
+progress {
+  appearance: none;
+}
+
+progress::-webkit-progress-bar {
+  background-color: transparent;
+}
diff --git a/app/assets/css/bootstrap-override.css b/app/assets/css/bootstrap-override.css
new file mode 100644
index 0000000..c177fa9
--- /dev/null
+++ b/app/assets/css/bootstrap-override.css
@@ -0,0 +1,375 @@
+/* Label, Section Title */
+.label {
+  border-radius: 5px;
+}
+
+.label-success {
+  background-color: var(--ui-success-7);
+}
+
+.label-danger {
+  background-color: var(--ui-error-6);
+}
+
+.control-label {
+  @apply inline-flex items-center;
+  @apply font-medium;
+  @apply text-gray-7;
+  @apply th-dark:text-gray-warm-3;
+  @apply th-highcontrast:text-white;
+}
+
+.vertical-center {
+  @apply inline-flex items-center gap-1;
+}
+
+.flex-center {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+}
+
+.blue {
+  background: var(--bg-dashboard-item) !important;
+}
+
+.form-control {
+  border-radius: 5px;
+}
+
+/* Input Group Addon */
+.input-group-addon:first-child {
+  border-top-left-radius: 5px;
+  border-bottom-left-radius: 5px;
+}
+
+.input-group .form-control:not(:first-child):not(:last-child) {
+  border-top-right-radius: 5px;
+  border-bottom-right-radius: 5px;
+}
+
+.input-group-btn:last-child .btn {
+  margin-left: 5px;
+  border-radius: 5px;
+}
+
+/* Toggle switch */
+.switch {
+  position: relative;
+  display: inline-block;
+  width: 42px;
+  height: 25px;
+}
+
+.switch input {
+  opacity: 0;
+  width: 0;
+  height: 0;
+}
+
+.switch input[type='checkbox']:disabled + .slider {
+  opacity: 0.3;
+  @apply th-dark:bg-gray-warm-6 th-dark:opacity-40;
+  @apply th-highcontrast:bg-gray-warm-6 th-highcontrast:opacity-40;
+}
+
+.switch input[type='checkbox']:disabled:is(:checked) + .slider {
+  @apply th-dark:!bg-blue-8 th-dark:!opacity-60;
+  @apply th-highcontrast:!bg-blue-8 th-highcontrast:!opacity-60;
+}
+
+.switch-values {
+  font-style: normal;
+  font-weight: 500;
+  margin-left: 5px;
+}
+
+/* Toggle */
+
+.slider {
+  position: absolute;
+  cursor: pointer;
+  top: 0;
+  left: 0;
+  right: 0;
+  bottom: 0;
+  -webkit-transition: 0.4s;
+  transition: 0.4s;
+  /* speed up the hover color changes to 200ms, while keeping the movement transition 400ms */
+  @apply transition-colors duration-200;
+  @apply bg-gray-6;
+  @apply th-dark:bg-gray-warm-8;
+  @apply th-highcontrast:bg-gray-warm-8;
+}
+
+.slider:hover {
+  @apply bg-gray-7;
+  @apply th-dark:bg-gray-warm-7;
+  @apply th-highcontrast:bg-gray-warm-7;
+}
+
+input:checked + .slider:hover {
+  background-color: var(--ui-blue-9);
+  @apply th-dark:bg-blue-10;
+  @apply th-highcontrast:bg-blue-10;
+}
+
+.slider:before {
+  position: absolute;
+  content: '';
+  height: 19px;
+  width: 19px;
+  left: 3px;
+  bottom: 3px;
+  background-color: var(--white-color);
+  -webkit-transition: 0.4s;
+  transition: 0.4s;
+}
+
+input:checked + .slider {
+  background-color: var(--ui-blue-8);
+  @apply th-dark:bg-blue-9;
+  @apply th-highcontrast:bg-blue-9;
+}
+
+input:focus + .slider {
+  box-shadow: 0 0 2px var(--ui-blue-8);
+}
+
+input:checked + .slider:before {
+  -webkit-transform: translateX(17px);
+  -ms-transform: translateX(17px);
+  transform: translateX(17px);
+}
+
+.slider.round {
+  border-radius: 25px;
+}
+
+.slider.round:before {
+  border-radius: 50%;
+}
+
+/* Checkbox */
+
+.md-checkbox input[type='checkbox']:enabled + label:before {
+  background-color: var(--bg-checkbox) !important;
+  border: 1px solid var(--border-checkbox) !important;
+  border-radius: 5px;
+  color: var(--black-color);
+}
+
+.md-checkbox input[type='checkbox']:disabled + label:before {
+  border-radius: 5px;
+}
+
+.md-checkbox input[type='checkbox']:checked + label:before {
+  background-color: var(--ui-blue-8) !important;
+  color: var(--ui-blue-8) !important;
+  border: 1px solid var(--ui-blue-8) !important;
+}
+
+.md-checkbox input[type='checkbox']:checked + .checkmark {
+  border-color: var(--grey-6);
+  background-color: var(--bg-checkbox);
+}
+
+/* Slider */
+
+.rzslider .rz-pointer {
+  background-color: var(--white-color);
+  border: 3px solid var(--ui-blue-8);
+  width: 25px;
+  height: 25px;
+  top: -10px;
+}
+
+.rzslider .rz-bar {
+  background-color: var(--ui-gray-5);
+  height: 8px;
+  border-radius: 5px;
+}
+
+.rzslider .rz-selection {
+  background-color: var(--ui-blue-8);
+}
+
+.rzslider .rz-pointer:after {
+  display: none;
+}
+
+/* Widget */
+
+.widget .widget-icon {
+  @apply mr-1 flex-none !p-2 text-lg;
+  @apply bg-blue-3 text-blue-8;
+  @apply th-dark:bg-gray-9 th-dark:text-blue-3;
+
+  border-radius: 50%;
+  display: inline-flex;
+  justify-content: center;
+  align-items: center;
+  padding: 1.5%;
+}
+
+.widget .widget-icon .icon {
+  display: flex !important;
+}
+
+.widget .widget-body table thead {
+  border-top: 1px solid var(--border-table-color);
+}
+
+/* Toaster */
+
+#toast-container > .toast-success {
+  background-image: url(../images/icon-success.svg) !important;
+  background-size: 40px 40px;
+  background-position: top 12px left 12px;
+}
+
+#toast-container > .toast-error {
+  background-image: url(../images/icon-error.svg) !important;
+  background-size: 40px 40px;
+  background-position: top 12px left 12px;
+}
+
+#toast-container > .toast-warning {
+  background-image: url(../images/icon-warning.svg) !important;
+  background-size: 40px 40px;
+  background-position: top 12px left 12px;
+}
+
+.toast-success .toast-progress {
+  background-color: var(--ui-success-7);
+}
+.toast-warning .toast-progress {
+  background-color: var(--ui-warning-6);
+}
+.toast-error .toast-progress {
+  background-color: var(--ui-error-8);
+}
+
+#toast-container > div {
+  color: var(--ui-gray-7);
+  background-color: var(--white-color);
+  border-radius: 8px;
+  padding: 18px 20px 18px 68px;
+  width: 300px;
+  opacity: 1;
+  -ms-filter: progid:DXImageTransform.Microsoft.Alpha(Opacity=100);
+  filter: alpha(opacity=100);
+}
+
+#toast-container > div:hover {
+  -moz-box-shadow: 0 0 12px var(--ui-gray-7);
+  -webkit-box-shadow: 0 0 12px var(--ui-gray-7);
+  box-shadow: 0 0 12px var(--ui-gray-7);
+}
+
+.toast-close-button {
+  color: var(--black-color);
+  text-decoration: none;
+  margin-top: 5px;
+  cursor: pointer;
+  opacity: 0.4;
+  -ms-filter: progid:DXImageTransform.Microsoft.Alpha(Opacity=40);
+  filter: alpha(opacity=40);
+}
+
+.toast-close-button:hover,
+.toast-close-button:focus {
+  color: var(--black-color);
+  text-decoration: none;
+  cursor: pointer;
+  opacity: 0.6;
+  -ms-filter: progid:DXImageTransform.Microsoft.Alpha(Opacity=60);
+  filter: alpha(opacity=60);
+}
+
+.toast-title {
+  font-weight: 500;
+  color: var(--black-color);
+  padding-right: 10px;
+  margin-bottom: 4px;
+}
+
+/* Modal */
+
+.modal-dialog {
+  width: 450px;
+}
+
+/* !Modal */
+
+/* Status Indicator Inside Table Section Label Style */
+.table .label {
+  border-radius: 8px !important;
+  display: inline-flex;
+  align-items: center;
+}
+
+.table .label .label-danger {
+  background-color: var(--ui-error-8);
+}
+
+.table .label .label-warn {
+  background-color: var(--ui-warning-9);
+}
+
+.table .label .label-success {
+  background-color: var(--ui-success-7);
+}
+
+/* Required Label with asterisk */
+
+.required:after {
+  content: '*';
+  color: var(--ui-error-9);
+}
+
+.progress {
+  height: 8px;
+  border-radius: 4px;
+  width: 50%;
+  display: inline-block;
+  margin-bottom: 0;
+}
+
+.progress .progress-bar {
+  background-color: var(--ui-blue-8);
+}
+
+.progress + span {
+  display: inline-block;
+  font-size: 85%;
+  margin-left: 10px;
+}
+
+/* Pagination */
+.datatable .footer .paginationControls .pagination {
+  border: 1px solid var(--border-pagination-color);
+}
+
+.paginationControls > form {
+  @apply inline-flex items-center;
+}
+
+.pagination li button {
+  color: var(--ui-gray-9) !important;
+}
+
+.pagination li:active button,
+.pagination li:focus button {
+  border: 1px solid var(--ui-gray-5) !important;
+}
+
+.pagination li a {
+  text-decoration: none !important;
+  cursor: pointer;
+  color: var(--ui-gray-9) !important;
+}
+
+.widget-header {
+  font-size: 16px;
+}
diff --git a/app/assets/css/button.css b/app/assets/css/button.css
new file mode 100644
index 0000000..4aa79e1
--- /dev/null
+++ b/app/assets/css/button.css
@@ -0,0 +1,193 @@
+.btn {
+  @apply !outline-none;
+  @apply border border-solid border-transparent;
+
+  border-radius: 8px;
+  display: inline-flex;
+  justify-content: center;
+  align-items: center;
+  gap: 5px;
+}
+
+.btn.disabled,
+.btn[disabled],
+fieldset[disabled] .btn {
+  @apply opacity-40;
+  touch-action: none;
+}
+
+.btn:hover {
+  color: var(--text-button-hover-color);
+}
+
+.btn.active {
+  box-shadow: none;
+}
+
+.btn-icon {
+  @apply !border-none !bg-transparent p-0;
+}
+
+.btn.btn-primary {
+  @apply border-graphite-700 bg-graphite-700 text-mist-100;
+  @apply hover:border-graphite-700/90 hover:bg-graphite-700/90 hover:text-mist-100;
+  @apply focus:border-blue-5 focus:text-mist-100 focus:shadow-graphite-700/80;
+
+  @apply th-dark:border-mist-100 th-dark:bg-mist-100 th-dark:text-graphite-700;
+  @apply th-dark:hover:border-mist-100/90 th-dark:hover:bg-mist-100/90 th-dark:hover:text-graphite-700;
+  @apply th-dark:focus:border-blue-5 th-dark:focus:text-graphite-700 th-dark:focus:shadow-white/80;
+
+  @apply th-highcontrast:border-mist-100 th-highcontrast:bg-mist-100 th-highcontrast:text-graphite-700;
+  @apply th-highcontrast:hover:border-mist-100/90 th-highcontrast:hover:bg-mist-100/90 th-highcontrast:hover:text-graphite-700;
+  @apply th-highcontrast:focus:border-blue-5 th-highcontrast:focus:text-graphite-700 th-highcontrast:focus:shadow-white/80;
+}
+
+/* Sidebar background is always dark, so we need to override the primary button styles */
+.btn.btn-primary.sidebar {
+  @apply border-mist-100 bg-mist-100 text-graphite-700;
+  @apply hover:border-mist-100/90 hover:bg-mist-100/90 hover:text-graphite-700;
+  @apply focus:border-blue-5 focus:text-graphite-700 focus:shadow-white/80;
+}
+
+.btn.btn-primary:active,
+.btn.btn-primary.active,
+.open > .dropdown-toggle.btn-primary {
+  @apply border-graphite-700/80 bg-graphite-700 text-mist-100;
+  @apply th-dark:border-white/80 th-dark:bg-mist-100 th-dark:text-graphite-700;
+  @apply th-highcontrast:border-white/80 th-highcontrast:bg-mist-100 th-highcontrast:text-graphite-700;
+}
+
+.nav-pills > li.active > a,
+.nav-pills > li.active > a:hover,
+.nav-pills > li.active > a:focus {
+  @apply bg-graphite-700 text-mist-100;
+  @apply th-dark:bg-mist-100 th-dark:text-graphite-700;
+  @apply th-highcontrast:bg-mist-100 th-highcontrast:text-graphite-700;
+}
+
+/* Button Secondary */
+.btn.btn-secondary {
+  @apply border border-solid;
+
+  @apply border-graphite-700 bg-mist-100 text-graphite-700;
+  @apply hover:border-graphite-700 hover:bg-graphite-700/10 hover:text-graphite-700;
+  @apply focus:border-blue-5 focus:text-graphite-700 focus:shadow-graphite-700/20;
+
+  @apply th-dark:border-mist-100 th-dark:bg-graphite-700 th-dark:text-mist-100;
+  @apply th-dark:hover:border-mist-100 th-dark:hover:bg-mist-100/20 th-dark:hover:text-mist-100;
+  @apply th-dark:focus:border-blue-5 th-dark:focus:text-mist-100 th-dark:focus:shadow-white/80;
+
+  @apply th-highcontrast:border-mist-100 th-highcontrast:bg-graphite-700 th-highcontrast:text-mist-100;
+  @apply th-highcontrast:hover:border-mist-100 th-highcontrast:hover:bg-mist-100/20 th-highcontrast:hover:text-mist-100;
+  @apply th-highcontrast:focus:border-blue-5 th-highcontrast:focus:text-mist-100 th-highcontrast:focus:shadow-white/80;
+}
+
+.btn.btn-secondary:active,
+.btn.btn-secondary.active,
+.open > .dropdown-toggle.btn-secondary {
+  @apply border-graphite-700 bg-graphite-700/10 text-graphite-700;
+  @apply th-dark:border-mist-100 th-dark:bg-mist-100/20 th-dark:text-mist-100;
+  @apply th-highcontrast:border-mist-100 th-highcontrast:bg-mist-100/20 th-highcontrast:text-mist-100;
+}
+
+.btn.btn-danger {
+  @apply border-error-8 bg-error-8;
+  @apply hover:border-error-7 hover:bg-error-7 hover:text-white;
+  @apply focus:border-blue-5 focus:text-white focus:shadow-error-8/20;
+  @apply th-dark:focus:border-blue-5 th-dark:focus:text-white th-dark:focus:shadow-white/80;
+  @apply th-highcontrast:focus:border-blue-5 th-highcontrast:focus:text-white th-highcontrast:focus:shadow-white/80;
+}
+
+.btn.btn-danger:active,
+.btn.btn-danger.active,
+.open > .dropdown-toggle.btn-danger {
+  @apply border-error-5 bg-error-8 text-white;
+}
+
+.btn.btn-dangerlight {
+  @apply text-error-9 th-dark:text-white;
+  @apply bg-error-3 th-dark:bg-error-9;
+  @apply hover:bg-error-2 th-dark:hover:bg-error-11;
+  @apply border-error-5 th-highcontrast:border-error-7 th-dark:border-error-7;
+  @apply border border-solid;
+
+  @apply focus:border-blue-5 focus:text-error-9 focus:shadow-error-8/20;
+  @apply th-dark:focus:border-blue-5 th-dark:focus:text-white th-dark:focus:shadow-white/80;
+  @apply th-highcontrast:focus:border-blue-5 th-highcontrast:focus:shadow-white/80;
+}
+.btn.btn-icon.btn-dangerlight {
+  @apply hover:text-error-11 th-dark:hover:text-error-7;
+}
+
+.btn.btn-success {
+  background-color: var(--ui-success-7);
+}
+
+.btn.btn-success:hover {
+  color: var(--white-color);
+}
+
+/* secondary-grey */
+.btn.btn-default,
+.btn.btn-light {
+  @apply border-gray-5 bg-white text-gray-8;
+  @apply hover:border-gray-5 hover:bg-gray-3 hover:text-gray-10;
+  @apply focus:border-blue-5 focus:text-gray-8 focus:shadow-graphite-700/20;
+
+  /* dark mode */
+  @apply th-dark:border-gray-warm-7 th-dark:bg-gray-iron-10 th-dark:text-gray-warm-4;
+  @apply th-dark:hover:border-gray-6 th-dark:hover:bg-gray-iron-9 th-dark:hover:text-gray-warm-4;
+  @apply th-dark:focus:border-blue-5 th-dark:focus:text-gray-warm-4 th-dark:focus:shadow-white/80;
+
+  @apply th-highcontrast:border-gray-2 th-highcontrast:bg-black th-highcontrast:text-white;
+  @apply th-highcontrast:hover:border-gray-6 th-highcontrast:hover:bg-gray-9 th-highcontrast:hover:text-gray-warm-4;
+  @apply th-highcontrast:focus:border-blue-5 th-highcontrast:focus:text-white th-highcontrast:focus:shadow-white/80;
+}
+
+.btn.btn-light:active,
+.btn.btn-light.active,
+.open > .dropdown-toggle.btn-light {
+  background-color: var(--ui-gray-3);
+}
+
+.btn.btn-link {
+  @apply text-blue-8 hover:text-blue-9 disabled:text-gray-5;
+  @apply th-dark:text-blue-7 th-dark:hover:text-blue-8;
+  @apply th-highcontrast:text-blue-5 th-highcontrast:hover:text-blue-6;
+}
+
+.btn-group {
+  display: inline-flex;
+}
+
+.input-group-btn .btn.active,
+.btn-group .btn.active {
+  @apply border-graphite-700/80 bg-graphite-700 text-mist-100;
+  @apply th-dark:border-white/80 th-dark:bg-mist-100 th-dark:text-graphite-700;
+  @apply th-highcontrast:border-white/80 th-highcontrast:bg-mist-100 th-highcontrast:text-graphite-700;
+}
+
+.btn.btn-icon:focus {
+  box-shadow: none !important;
+}
+
+.btn:focus {
+  box-shadow: 0px 0px 0px 2px var(--tw-shadow-color);
+}
+
+a.no-link,
+a[ng-click] {
+  @apply text-current th-highcontrast:text-current th-dark:text-current;
+  @apply hover:text-current hover:no-underline;
+  @apply focus:text-current focus:no-underline;
+}
+
+a,
+a.hyperlink {
+  @apply text-blue-8 hover:text-blue-9 th-highcontrast:text-blue-5 th-highcontrast:hover:text-blue-6 th-dark:text-blue-7 th-dark:hover:text-blue-8;
+  @apply cursor-pointer hover:underline;
+}
+
+a.no-decoration {
+  text-decoration: none;
+}
diff --git a/app/assets/css/colors.json b/app/assets/css/colors.json
new file mode 100644
index 0000000..94d3c20
--- /dev/null
+++ b/app/assets/css/colors.json
@@ -0,0 +1,380 @@
+{
+  "black": "#000000",
+  "white": "#ffffff",
+  "graphite": {
+    "10": "#f5f5f6",
+    "50": "#e5e6e8",
+    "100": "#ced0d3",
+    "200": "#abafb5",
+    "300": "#7b8089",
+    "400": "#5c6066",
+    "500": "#484a4e",
+    "600": "#3a3b3f",
+    "700": "#2e2f33",
+    "800": "#222326",
+    "900": "#161719"
+  },
+  "mist": {
+    "50": "#fcfbfa",
+    "100": "#f7f6f3",
+    "200": "#f0f0ec",
+    "300": "#e8e7e2",
+    "400": "#e2e1db",
+    "500": "#d9d8d2",
+    "600": "#ceccc4",
+    "700": "#bebcb4",
+    "800": "#a7a6a0",
+    "900": "#8b8983"
+  },
+  "gray": {
+    "1": "#fcfcfd",
+    "2": "#f9fafb",
+    "3": "#f2f4f7",
+    "4": "#eaecf0",
+    "5": "#d0d5dd",
+    "6": "#98a2b3",
+    "7": "#667085",
+    "8": "#475467",
+    "9": "#344054",
+    "10": "#1d2939",
+    "11": "#101828"
+  },
+  "blue": {
+    "1": "#f5fbff",
+    "2": "#f0f9ff",
+    "3": "#e0f2fe",
+    "4": "#b9e6fe",
+    "5": "#7cd4fd",
+    "6": "#36bffa",
+    "7": "#0ba5ec",
+    "8": "#0086c9",
+    "9": "#026aa2",
+    "10": "#065986",
+    "11": "#0b4a6f"
+  },
+  "error": {
+    "1": "#fffbfa",
+    "2": "#fef3f2",
+    "3": "#fee4e2",
+    "4": "#fecdca",
+    "5": "#fda29b",
+    "6": "#f97066",
+    "7": "#f04438",
+    "8": "#d92d20",
+    "9": "#b42318",
+    "10": "#912018",
+    "11": "#7a271a"
+  },
+  "warning": {
+    "1": "#fffcf5",
+    "2": "#fffaeb",
+    "3": "#fef0c7",
+    "4": "#fedf89",
+    "5": "#fec84b",
+    "6": "#fdb022",
+    "7": "#f79009",
+    "8": "#dc6803",
+    "9": "#b54708",
+    "10": "#93370d",
+    "11": "#7a2e0e"
+  },
+  "success": {
+    "1": "#f6fef9",
+    "2": "#ecfdf3",
+    "3": "#d1fadf",
+    "4": "#a6f4c5",
+    "5": "#6ce9a6",
+    "6": "#32d583",
+    "7": "#12b76a",
+    "8": "#039855",
+    "9": "#027a48",
+    "10": "#05603a",
+    "11": "#054f31"
+  },
+  "gray-blue": {
+    "1": "#fcfcfd",
+    "2": "#f8f9fc",
+    "3": "#eaecf5",
+    "4": "#d5d9eb",
+    "5": "#b3b8db",
+    "6": "#717bbc",
+    "7": "#4e5ba6",
+    "8": "#3e4784",
+    "9": "#363f72",
+    "10": "#293056",
+    "11": "#293056"
+  },
+  "gray-cool": {
+    "1": "#fcfcfd",
+    "2": "#f9f9fb",
+    "3": "#eff1f5",
+    "4": "#dcdfea",
+    "5": "#b9c0d4",
+    "6": "#7d89b0",
+    "7": "#5d6b98",
+    "8": "#4a5578",
+    "9": "#404968",
+    "10": "#30374f",
+    "11": "#111322"
+  },
+  "gray-modern": {
+    "1": "#fcfcfd",
+    "2": "#f8fafc",
+    "3": "#eef2f6",
+    "4": "#e3e8ef",
+    "5": "#cdd5df",
+    "6": "#9aa4b2",
+    "7": "#697586",
+    "8": "#4b5565",
+    "9": "#364152",
+    "10": "#202939",
+    "11": "#121926"
+  },
+  "gray-neutral": {
+    "1": "#fcfcfd",
+    "2": "#f9fafb",
+    "3": "#f3f4f6",
+    "4": "#e5e7eb",
+    "5": "#d2d6db",
+    "6": "#9da4ae",
+    "7": "#6c737f",
+    "8": "#4d5761",
+    "9": "#384250",
+    "10": "#1f2a37",
+    "11": "#111927"
+  },
+  "gray-iron": {
+    "1": "#fcfcfc",
+    "2": "#fafafa",
+    "3": "#f4f4f5",
+    "4": "#e4e4e7",
+    "5": "#d1d1d6",
+    "6": "#d1d1d6",
+    "7": "#70707b",
+    "8": "#51525c",
+    "9": "#3f3f46",
+    "10": "#26272b",
+    "11": "#18181b"
+  },
+  "gray-true": {
+    "1": "#fcfcfc",
+    "2": "#fafafa",
+    "3": "#f5f5f5",
+    "4": "#e5e5e5",
+    "5": "#d6d6d6",
+    "6": "#a3a3a3",
+    "7": "#737373",
+    "8": "#525252",
+    "9": "#424242",
+    "10": "#292929",
+    "11": "#141414"
+  },
+  "gray-warm": {
+    "1": "#fdfdfc",
+    "2": "#fafaf9",
+    "3": "#f5f5f4",
+    "4": "#e7e5e4",
+    "5": "#d7d3d0",
+    "6": "#a9a29d",
+    "7": "#79716b",
+    "8": "#57534e",
+    "9": "#44403c",
+    "10": "#292524",
+    "11": "#1c1917"
+  },
+  "moss": {
+    "1": "#fafdf7",
+    "2": "#f5fbee",
+    "3": "#e6f4d7",
+    "4": "#ceeab0",
+    "5": "#acdc79",
+    "6": "#86cb3c",
+    "7": "#669f2a",
+    "8": "#4f7a21",
+    "9": "#3f621a",
+    "10": "#335015",
+    "11": "#2b4212"
+  },
+  "green-light": {
+    "1": "#fafef5",
+    "2": "#f3fee7",
+    "3": "#e4fbcc",
+    "4": "#d0f8ab",
+    "5": "#a6ef67",
+    "6": "#85e13a",
+    "7": "#66c61c",
+    "8": "#4ca30d",
+    "9": "#3b7c0f",
+    "10": "#326212",
+    "11": "#2b5314"
+  },
+  "green": {
+    "1": "#f6fef9",
+    "2": "#edfcf2",
+    "3": "#d3f8df",
+    "4": "#aaf0c4",
+    "5": "#73e2a3",
+    "6": "#73e2a3",
+    "7": "#16b364",
+    "8": "#099250",
+    "9": "#087443",
+    "10": "#095c37",
+    "11": "#084c2e"
+  },
+  "teal": {
+    "1": "#f6fefc",
+    "2": "#f0fdf9",
+    "3": "#ccfbef",
+    "4": "#99f6e0",
+    "5": "#5fe9d0",
+    "6": "#2ed3b7",
+    "7": "#15b79e",
+    "8": "#0e9384",
+    "9": "#107569",
+    "10": "#125d56",
+    "11": "#134e48"
+  },
+  "cyan": {
+    "1": "#f5feff",
+    "2": "#ecfdff",
+    "3": "#cff9fe",
+    "4": "#a5f0fc",
+    "5": "#67e3f9",
+    "6": "#22ccee",
+    "7": "#06aed4",
+    "8": "#088ab2",
+    "9": "#0e7090",
+    "10": "#155b75",
+    "11": "#164c63"
+  },
+  "blue-dark": {
+    "1": "#f5f8ff",
+    "2": "#eff4ff",
+    "3": "#d1e0ff",
+    "4": "#b2ccff",
+    "5": "#84adff",
+    "6": "#528bff",
+    "7": "#2970ff",
+    "8": "#155eef",
+    "9": "#004eeb",
+    "10": "#0040c1",
+    "11": "#00359e"
+  },
+  "indigo": {
+    "1": "#f5f8ff",
+    "2": "#eef4ff",
+    "3": "#e0eaff",
+    "4": "#c7d7fe",
+    "5": "#a4bcfd",
+    "6": "#8098f9",
+    "7": "#8098f9",
+    "8": "#444ce7",
+    "9": "#3538cd",
+    "10": "#2d31a6",
+    "11": "#2d3282"
+  },
+  "violet": {
+    "1": "#fbfaff",
+    "2": "#f5f3ff",
+    "3": "#ece9fe",
+    "4": "#ddd6fe",
+    "5": "#c3b5fd",
+    "6": "#a48afb",
+    "7": "#875bf7",
+    "8": "#7839ee",
+    "9": "#6927da",
+    "10": "#5720b7",
+    "11": "#491c96"
+  },
+  "purple": {
+    "1": "#fafaff",
+    "2": "#f4f3ff",
+    "3": "#ebe9fe",
+    "4": "#d9d6fe",
+    "5": "#bdb4fe",
+    "6": "#9b8afb",
+    "7": "#7a5af8",
+    "8": "#6938ef",
+    "9": "#5925dc",
+    "10": "#4a1fb8",
+    "11": "#3e1c96"
+  },
+  "fuchsia": {
+    "1": "#fefaff",
+    "2": "#fdf4ff",
+    "3": "#fbe8ff",
+    "4": "#f6d0fe",
+    "5": "#eeaafd",
+    "6": "#e478fa",
+    "7": "#d444f1",
+    "8": "#ba24d5",
+    "9": "#9f1ab1",
+    "10": "#821890",
+    "11": "#6f1877"
+  },
+  "pink": {
+    "1": "#fef6fb",
+    "2": "#fdf2fa",
+    "3": "#fce7f6",
+    "4": "#fce7f6",
+    "5": "#faa7e0",
+    "6": "#f670c7",
+    "7": "#ee46bc",
+    "8": "#dd2590",
+    "9": "#c11574",
+    "10": "#9e165f",
+    "11": "#851651"
+  },
+  "rose": {
+    "1": "#fff5f6",
+    "2": "#fff1f3",
+    "3": "#ffe4e8",
+    "4": "#fecdd6",
+    "5": "#fea3b4",
+    "6": "#fd6f8e",
+    "7": "#f63d68",
+    "8": "#e31b54",
+    "9": "#c01048",
+    "10": "#a11043",
+    "11": "#89123e"
+  },
+  "orange-dark": {
+    "1": "#fff9f5",
+    "2": "#fff4ed",
+    "3": "#ffe6d5",
+    "4": "#ffd6ae",
+    "5": "#ff9c66",
+    "6": "#ff692e",
+    "7": "#ff4405",
+    "8": "#e62e05",
+    "9": "#bc1b06",
+    "10": "#97180c",
+    "11": "#771a0d"
+  },
+  "orange": {
+    "1": "#fefaf5",
+    "2": "#fef6ee",
+    "3": "#fdead7",
+    "4": "#f9dbaf",
+    "5": "#f7b27a",
+    "6": "#f38744",
+    "7": "#ef6820",
+    "8": "#e04f16",
+    "9": "#b93815",
+    "10": "#932f19",
+    "11": "#772917"
+  },
+  "yellow": {
+    "1": "#fefdf0",
+    "2": "#fefbe8",
+    "3": "#fef7c3",
+    "4": "#feee95",
+    "5": "#feee95",
+    "6": "#fac515",
+    "7": "#eaaa08",
+    "8": "#ca8504",
+    "9": "#a15c07",
+    "10": "#854a0e",
+    "11": "#713b12"
+  }
+}
diff --git a/app/assets/css/colors.ts b/app/assets/css/colors.ts
new file mode 100644
index 0000000..5505c87
--- /dev/null
+++ b/app/assets/css/colors.ts
@@ -0,0 +1,19 @@
+import colors from './colors.json';
+
+const element = document.createElement('style');
+
+element.innerHTML = `:root {
+  ${Object.entries(colors)
+    .map(([color, hex]) => {
+      if (typeof hex === 'string') {
+        return `--ui-${color}: ${hex}`;
+      }
+
+      return Object.entries(hex)
+        .map(([key, value]) => `--ui-${color}-${key}: ${value}`)
+        .join(';\n');
+    })
+    .join(';\n')}
+}`;
+
+document.head.prepend(element);
diff --git a/app/assets/css/icon.css b/app/assets/css/icon.css
new file mode 100644
index 0000000..9008b29
--- /dev/null
+++ b/app/assets/css/icon.css
@@ -0,0 +1,129 @@
+.lucide {
+  display: block;
+  height: 1em;
+  width: 1em;
+  color: inherit;
+}
+
+pr-icon {
+  display: inline-flex;
+}
+
+.icon {
+  color: currentColor;
+  margin: 0;
+
+  font-size: var(--icon-size);
+  height: var(--icon-size);
+  width: var(--icon-size);
+
+  --icon-size: 1em;
+}
+
+.icon-xs {
+  --icon-size: 10px;
+}
+
+.icon-sm {
+  --icon-size: 14px;
+}
+
+.icon-md {
+  --icon-size: 16px;
+}
+
+.icon-lg {
+  --icon-size: 22px;
+}
+
+.icon-xl {
+  --icon-size: 26px;
+}
+
+.icon.icon-alt {
+  fill: var(--black-color);
+  stroke: var(--white-color);
+}
+
+.icon-primary,
+.icon-blue {
+  color: var(--ui-blue-8);
+}
+
+.icon.icon-primary-alt {
+  fill: var(--ui-blue-8);
+  stroke: var(--white-color);
+}
+
+.icon-secondary {
+  color: var(--ui-gray-8);
+}
+
+.icon.icon-secondary-alt {
+  fill: var(--ui-gray-8);
+  stroke: var(--black-color);
+}
+
+.icon-warning,
+.icon-orange {
+  @apply text-warning-9 th-highcontrast:text-warning-1 th-dark:text-warning-7;
+}
+
+.icon.icon-warning-alt {
+  fill: var(--ui-warning-9);
+  stroke: var(--white-color);
+}
+
+.icon-danger {
+  color: var(--ui-error-9);
+}
+
+.icon.icon-danger-alt {
+  fill: var(--ui-error-9);
+  stroke: var(--white-color);
+}
+
+.icon-success {
+  color: var(--ui-success-6);
+}
+
+.icon.icon-success-alt {
+  fill: var(--ui-success-8);
+  stroke: var(--white-color);
+}
+
+.icon-badge {
+  border-radius: 50%;
+  display: flex;
+  justify-content: center;
+  align-items: center;
+  padding: 1.5%;
+}
+
+.icon-nested-blue {
+  @apply bg-blue-3 text-blue-8;
+  @apply th-dark:bg-gray-9 th-dark:text-blue-3;
+  @apply th-highcontrast:bg-gray-9 th-highcontrast:text-blue-3;
+  display: flex;
+  justify-content: center;
+  align-items: center;
+  height: 30px;
+  width: 30px;
+  padding: 5px;
+  text-align: center;
+  border-radius: 50%;
+  margin-right: 5px;
+}
+
+.icon-nested-blue > svg {
+  height: 20px;
+  width: 20px;
+}
+
+.btn-only-icon {
+  padding: 6px;
+}
+
+.btn-only-icon pr-icon {
+  margin-top: 0;
+}
diff --git a/app/assets/css/index.js b/app/assets/css/index.js
new file mode 100644
index 0000000..0b9264e
--- /dev/null
+++ b/app/assets/css/index.js
@@ -0,0 +1,18 @@
+import 'bootstrap/dist/css/bootstrap.css';
+import 'toastr/build/toastr.css';
+import 'angularjs-slider/dist/rzslider.css';
+import 'angular-loading-bar/build/loading-bar.css';
+import 'spinkit/spinkit.min.css'; // ViewLoading, index.html, internal-auth. auth,
+import '@reach/menu-button/styles.css';
+
+import './colors';
+
+import './rdash.css';
+import './app.css';
+
+import './theme.css';
+import './vendor-override.css';
+import './bootstrap-override.css';
+import './icon.css';
+import './button.css';
+import './react-datetime-picker-override.css';
diff --git a/app/assets/css/rdash.css b/app/assets/css/rdash.css
new file mode 100644
index 0000000..832b25a
--- /dev/null
+++ b/app/assets/css/rdash.css
@@ -0,0 +1,154 @@
+#content-wrapper {
+  padding-left: 0;
+  margin-left: 0;
+  width: 100%;
+  height: auto;
+}
+
+.loading {
+  width: 40px;
+  height: 40px;
+  position: relative;
+  margin: 100px auto;
+}
+.double-bounce1,
+.double-bounce2 {
+  width: 100%;
+  height: 100%;
+  border-radius: 50%;
+  background-color: #333;
+  opacity: 0.6;
+  position: absolute;
+  top: 0;
+  left: 0;
+  -webkit-animation: bounce 2s infinite ease-in-out;
+  animation: bounce 2s infinite ease-in-out;
+}
+.double-bounce2 {
+  -webkit-animation-delay: -1s;
+  animation-delay: -1s;
+}
+@-webkit-keyframes bounce {
+  0%,
+  100% {
+    -webkit-transform: scale(0);
+  }
+  50% {
+    -webkit-transform: scale(1);
+  }
+}
+@keyframes bounce {
+  0%,
+  100% {
+    transform: scale(0);
+    -webkit-transform: scale(0);
+  }
+  50% {
+    transform: scale(1);
+    -webkit-transform: scale(1);
+  }
+}
+
+.row {
+  margin-left: 0 !important;
+  margin-right: 0 !important;
+}
+.row > div {
+  margin-bottom: 15px;
+}
+.alerts-container .alert:last-child {
+  margin-bottom: 0;
+}
+
+.green {
+  background: #23ae89 !important;
+}
+.blue {
+  background: var(--blue-color) !important;
+}
+.orange {
+  background: #d3a938 !important;
+}
+.red {
+  background: #ae2323 !important;
+}
+.form-group .help-block.form-group-inline-message {
+  padding-top: 5px;
+}
+div.input-mask {
+  padding-top: 7px;
+}
+
+/**
+ * Widgets
+ */
+.widget {
+  -webkit-box-shadow: 0 1px 1px rgba(0, 0, 0, 0.05);
+  -moz-box-shadow: 0 1px 1px rgba(0, 0, 0, 0.05);
+  box-shadow: 0 1px 1px rgba(0, 0, 0, 0.05);
+  background: var(--bg-widget-color);
+  border: 1px solid var(--border-widget);
+  border-radius: 12px;
+}
+.widget .widget-header .pagination,
+.widget .widget-footer .pagination {
+  margin: 0;
+}
+.widget .widget-header {
+  color: var(--text-widget-header-color);
+  padding: 20px 20px 10px 20px;
+  line-height: 30px;
+  font-weight: 500;
+}
+
+.widget .widget-body {
+  padding: 20px;
+  border-radius: 12px;
+}
+.widget .widget-body table thead {
+  background: var(--bg-widget-table-color);
+}
+.widget .widget-body table thead * {
+  font-size: 14px;
+}
+.widget .widget-body table tbody * {
+  font-size: 13px;
+}
+.widget .widget-body .error {
+  color: #ff0000;
+}
+
+.widget .widget-body div.alert {
+  margin-bottom: 10px;
+}
+.widget .widget-body.large {
+  height: 350px;
+  overflow-y: auto;
+}
+.widget .widget-body.medium {
+  height: 250px;
+  overflow-y: auto;
+}
+.widget .widget-body.small {
+  height: 150px;
+  overflow-y: auto;
+}
+.widget .widget-body.no-padding {
+  padding: 0;
+}
+.widget .widget-body.no-padding .error,
+.widget .widget-body.no-padding .message {
+  padding: 20px;
+}
+.widget .widget-footer {
+  border-top: 1px solid #e9e9e9;
+  padding: 20px;
+}
+.widget .widget-title .pagination,
+.widget .widget-footer .pagination {
+  margin: 0;
+}
+.widget .widget-content .title {
+  font-size: 28px;
+  display: block;
+}
diff --git a/app/assets/css/react-datetime-picker-override.css b/app/assets/css/react-datetime-picker-override.css
new file mode 100644
index 0000000..dbbea47
--- /dev/null
+++ b/app/assets/css/react-datetime-picker-override.css
@@ -0,0 +1,125 @@
+/* react-datetime-picker */
+/* https://github.com/wojtekmaj/react-datetime-picker#custom-styling */
+
+/*
+  library css for buttons is overriden by `.widget .widget-body button`
+  so we have to force margin: 0
+*/
+.react-daterange-picker__calendar .react-calendar button {
+  margin: 0 !important;
+}
+
+/*
+  Extending Calendar.css from react-daterange-picker__calendar
+*/
+.react-calendar {
+  background: var(--bg-calendar-color);
+  color: var(--text-main-color);
+  @apply th-dark:bg-gray-iron-10;
+}
+
+/* calendar nav buttons */
+.react-calendar__navigation button:disabled {
+  background: var(--bg-calendar-color);
+  @apply opacity-60;
+  @apply brightness-95 th-dark:brightness-110;
+  @apply th-dark:bg-gray-iron-7;
+}
+.react-calendar__navigation button:enabled:hover,
+.react-calendar__navigation button:enabled:focus {
+  background: var(--bg-daterangepicker-color);
+  @apply th-dark:bg-gray-iron-7;
+}
+
+/* date tile */
+.react-calendar__tile:disabled {
+  @apply opacity-60;
+  @apply brightness-95 th-dark:brightness-110;
+  @apply th-dark:bg-gray-iron-7;
+}
+
+.react-calendar__tile:enabled:hover,
+.react-calendar__tile:enabled:focus {
+  background: var(--bg-daterangepicker-hover);
+  @apply th-dark:bg-gray-iron-7;
+}
+
+/* today's date tile */
+.react-calendar__tile--now {
+  @apply th-highcontrast:text-[color:var(--bg-calendar-color)] th-dark:text-[color:var(--bg-calendar-color)];
+  border-radius: 0.25rem !important;
+}
+.react-daterange-picker__calendar .react-calendar__tile--now:enabled:hover,
+.react-daterange-picker__calendar .react-calendar__tile--now:enabled:focus {
+  background: var(--bg-daterangepicker-hover);
+  color: var(--text-daterangepicker-hover);
+  @apply th-dark:bg-gray-iron-7;
+}
+
+/* probably date tile in range */
+.react-calendar__tile--hasActive {
+  background: var(--bg-daterangepicker-end-date);
+  color: var(--text-daterangepicker-end-date);
+  @apply th-dark:bg-gray-iron-7;
+}
+.react-calendar__tile--hasActive:enabled:hover,
+.react-calendar__tile--hasActive:enabled:focus {
+  background: var(--bg-daterangepicker-hover);
+  color: var(--text-daterangepicker-hover);
+  @apply th-dark:bg-gray-iron-7;
+}
+
+.react-calendar__tile--active:enabled:hover,
+.react-calendar__tile--active:enabled:focus {
+  background: var(--bg-daterangepicker-hover);
+  color: var(--text-daterangepicker-hover);
+  @apply th-dark:bg-gray-iron-7;
+}
+
+.react-daterange-picker__calendar
+  .react-calendar__month-view__days__day:hover:not(.react-daterange-picker__calendar .react-calendar__tile--hoverEnd):not(
+    .react-daterange-picker__calendar .react-calendar__tile--hoverStart
+  ):not(.react-calendar__tile--active) {
+  border-radius: 0.25rem !important;
+}
+
+/* on range select hover */
+.react-calendar--selectRange .react-calendar__tile--hover {
+  background: var(--bg-daterangepicker-in-range);
+  color: var(--text-daterangepicker-in-range);
+  @apply th-dark:bg-gray-iron-7;
+}
+
+/*
+  Extending DateTimePicker.css from react-daterange-picker__calendar
+*/
+.react-daterange-picker__calendar .react-daterange-picker__calendar--disabled {
+  @apply opacity-40;
+}
+
+/* selected date tile */
+.react-daterange-picker__calendar .react-calendar__tile--active {
+  background: var(--bg-daterangepicker-active) !important;
+  color: var(--text-daterangepicker-active) !important;
+}
+
+.react-daterange-picker__calendar .react-calendar__tile--rangeStart:not(.react-calendar__tile--rangeEnd),
+.react-daterange-picker__calendar .react-calendar__tile--hoverStart {
+  border-top-left-radius: 0.25rem;
+  border-bottom-left-radius: 0.25rem;
+}
+
+.react-daterange-picker__calendar .react-calendar__tile--rangeEnd:not(.react-calendar__tile--rangeStart),
+.react-daterange-picker__calendar .react-calendar__tile--hoverEnd {
+  border-top-right-radius: 0.25rem;
+  border-bottom-right-radius: 0.25rem;
+}
+
+.react-daterange-picker__calendar .react-calendar__month-view__days__day--weekend {
+  color: inherit;
+}
+
+.react-calendar__tile--active.react-calendar__month-view__days__day--weekend {
+  color: var(--text-daterangepicker-active);
+  @apply th-dark:bg-gray-iron-7;
+}
diff --git a/app/assets/css/theme.css b/app/assets/css/theme.css
new file mode 100644
index 0000000..318e0d9
--- /dev/null
+++ b/app/assets/css/theme.css
@@ -0,0 +1,604 @@
+/* Color Variable */
+:root {
+  --black-color: var(--ui-black);
+  --white-color: var(--ui-white);
+
+  --graphite-600: #3a3b3f;
+  --graphite-700: #2e2f33;
+  --graphite-800: #222326;
+  --graphite-900: #161719;
+
+  --mist-50: #fcfbfa;
+  --mist-100: #f7f6f3;
+  --mist-200: #f0f0ec;
+  --mist-300: #e8e7e2;
+
+  --grey-1: #212121;
+  --grey-2: #181818;
+  --grey-3: #383838;
+  --grey-4: #585858;
+  --grey-6: #333333;
+  --grey-7: #767676;
+  --grey-8: #aaa;
+  --grey-9: #f3f3f3;
+  --grey-10: #f6f6f6;
+  --grey-11: #eeeeee;
+  --grey-12: #ececec;
+  --grey-13: #fafafa;
+  --grey-14: #f5f5f5;
+  --grey-15: #f9f2f4;
+  --grey-16: #eee;
+  --grey-17: #f7f7f7;
+  --grey-18: #c5cae9;
+  --grey-19: #ddd;
+  --grey-20: #dae3f3;
+  --grey-21: #d5e8f3;
+  --grey-22: #c3c3e4;
+  --grey-23: #e7f6ff;
+  --grey-24: #f1f9fd;
+  --grey-25: #555555;
+  --grey-26: #777777;
+  --grey-27: #4e4e4e;
+  --grey-28: #262626;
+  --grey-29: #555;
+  --grey-30: #444;
+  --grey-31: #868686;
+  --grey-32: #65798e;
+  --grey-35: #546477;
+  --grey-36: #55637d;
+  --grey-37: #2d3e63;
+  --grey-38: #434343;
+  --grey-39: #194973;
+  --grey-40: #cfddfc;
+  --grey-41: #b4b4b4;
+  --grey-42: #d2d1d1;
+  --grey-43: #e9e9e9;
+  --grey-44: #ccc;
+  --grey-45: #e5e5e5;
+  --grey-46: #bbbbbb;
+  --grey-47: #d4d4d5;
+  --grey-48: #c6c6c6;
+  --grey-49: rgba(0, 0, 0, 0.54);
+  --grey-50: rgba(161, 170, 166, 0.5);
+  --grey-51: rgba(0, 0, 0, 0.15);
+  --grey-53: rgba(255, 255, 255, 0.6);
+  --grey-54: rgb(54, 54, 54);
+  --grey-55: rgba(255, 255, 255, 0.8);
+  --grey-57: #999;
+  --grey-58: #ebf4f8;
+  --grey-59: #e6e6e6;
+  --grey-61: rgb(231, 231, 231);
+  --grey-62: #fdfdfd;
+  --grey-63: #121212;
+
+  --blue-1: #219;
+  --blue-2: #337ab7;
+  --blue-3: #738bc0;
+  --blue-4: #23527c;
+  --blue-5: #30426a;
+  --blue-6: #577bc9;
+  --blue-7: #6b9aff;
+  --blue-8: #90ccff;
+  --blue-9: #3ea6ff;
+  --blue-10: #61b6ff;
+  --blue-11: #3ea5ff;
+  --blue-12: #41a6ff;
+  --blue-14: #357ebd;
+  --blue-15: #36bffa;
+
+  --red-1: #a94442;
+  --red-2: #c7254e;
+  --red-3: #a11;
+  --red-4: #d9534f;
+  --red-5: #ff2727;
+  --red-7: #f00;
+
+  --green-1: #164;
+  --green-2: #1ec863;
+  --green-3: #23ae89;
+
+  --orange-1: #e86925;
+
+  --BE-only: var(--ui-gray-6);
+
+  --text-log-viewer-color-json-grey: var(--text-log-viewer-color);
+  --text-log-viewer-color-json-magenta: var(--text-log-viewer-color);
+  --text-log-viewer-color-json-yellow: var(--text-log-viewer-color);
+  --text-log-viewer-color-json-green: var(--text-log-viewer-color);
+  --text-log-viewer-color-json-red: var(--text-log-viewer-color);
+  --text-log-viewer-color-json-blue: var(--text-log-viewer-color);
+
+  /* Default Theme */
+  --bg-card-color: var(--white-color);
+  --bg-main-color: var(--white-color);
+  --bg-body-color: var(--grey-62);
+  --bg-checkbox-border-color: var(--grey-49);
+  --bg-sidebar-color: var(--graphite-700);
+  --bg-sidebar-nav-color: var(--graphite-600);
+  --bg-widget-color: var(--white-color);
+  --bg-widget-header-color: var(--grey-10);
+  --bg-widget-table-color: var(--ui-gray-3);
+  --bg-header-color: var(--white-color);
+  --bg-hover-table-color: var(--grey-14);
+  --bg-input-group-addon-color: var(--ui-gray-3);
+  --bg-blocklist-hover-color: var(--ui-blue-2);
+  --bg-table-color: var(--white-color);
+  --bg-md-checkbox-color: var(--grey-12);
+  --bg-form-control-disabled-color: var(--grey-11);
+  --bg-modal-content-color: var(--white-color);
+  --bg-navtabs-hover-color: var(--grey-16);
+  --bg-nav-tab-active-color: var(--ui-gray-4);
+  --bg-table-selected-color: var(--grey-14);
+  --bg-dropdown-menu-color: var(--white-color);
+  --bg-log-viewer-color: var(--white-color);
+  --bg-log-line-selected-color: var(--grey-18);
+  --bg-pre-color: var(--grey-14);
+  --bg-blocklist-item-selected-color: var(--grey-12);
+  --bg-progress-color: var(--grey-14);
+  --bg-pagination-color: var(--ui-blue-3);
+  --border-pagination-color: var(--ui-white);
+  --bg-pagination-span-color: var(--white-color);
+  --bg-pagination-hover-color: var(--ui-blue-3);
+  --bg-motd-body-color: var(--mist-50);
+  --bg-motd-btn-color: var(--graphite-700);
+  --bg-item-highlighted-color: var(--grey-21);
+  --bg-item-highlighted-null-color: var(--grey-14);
+  --bg-panel-body-color: var(--white-color);
+  --bg-tooltip-color: var(--ui-gray-11);
+  --bg-input-sm-color: var(--white-color);
+  --bg-app-datatable-thead: var(--grey-23);
+  --bg-app-datatable-tbody: var(--grey-24);
+  --bg-daterangepicker-color: var(--white-color);
+  --bg-calendar-color: var(--white-color);
+  --bg-calendar-table-color: var(--white-color);
+  --bg-daterangepicker-end-date: var(--white-color);
+  --bg-daterangepicker-hover: var(--grey-16);
+  --bg-daterangepicker-in-range: var(--grey-58);
+  --bg-daterangepicker-active: var(--blue-14);
+  --bg-input-autofill-color: var(--bg-inputbox);
+  --bg-small-select-color: var(--white-color);
+  --bg-stepper-item-active: var(--white-color);
+  --bg-stepper-item-counter: var(--grey-61);
+  --bg-sortbutton-color: var(--white-color);
+  --bg-dashboard-item: var(--ui-blue-3);
+  --bg-searchbar: var(--ui-gray-2);
+  --bg-inputbox: var(--ui-gray-2);
+  --bg-dropdown-hover: var(--ui-gray-3);
+  --bg-webeditor-color: var(--ui-gray-3);
+  --bg-button-group-color: var(--ui-white);
+  --bg-pagination-disabled-color: var(--ui-white);
+  --bg-code-script-color: var(--ui-white);
+  --bg-stepper-color: var(--ui-white);
+  --bg-stepper-active-color: var(--ui-blue-1);
+  --bg-code-color: var(--ui-white);
+
+  --text-main-color: var(--grey-7);
+  --text-body-color: var(--grey-6);
+  --text-widget-header-color: var(--ui-gray-11);
+  --text-form-control-color: var(--grey-25);
+  --text-muted-color: var(--grey-26);
+  --text-link-color: var(--blue-2);
+  --text-link-hover-color: var(--blue-4);
+  --text-input-group-addon-color: var(--grey-25);
+  --text-blocklist-hover-color: var(--grey-37);
+  --text-dashboard-item-color: var(--grey-32);
+  --text-danger-color: var(--red-1);
+  --text-code-color: var(--ui-gray-9);
+  --text-navtabs-color: var(--grey-7);
+  --text-navtabs-hover-color: var(--grey-6);
+  --text-nav-tab-active-color: var(--grey-25);
+  --text-dropdown-menu-color: var(--grey-6);
+  --text-log-viewer-color: var(--black-color);
+  --text-json-tree-color: var(--blue-3);
+  --text-json-tree-leaf-color: var(--blue-5);
+  --text-json-tree-branch-preview-color: var(--blue-5);
+  --text-pre-color: var(--grey-6);
+  --text-blocklist-item-selected-color: var(--grey-37);
+  --text-progress-bar-color: var(--grey-27);
+  --text-pagination-color: var(--grey-26);
+  --text-pagination-span-color: var(--grey-3);
+  --text-pagination-span-hover-color: var(--grey-3);
+  --text-motd-body-color: var(--black-color);
+  --text-motd-btn-color: var(--mist-100);
+  --text-summary-color: var(--black-color);
+  --text-tooltip-color: var(--white-color);
+  --text-rzslider-color: var(--grey-36);
+  --text-rzslider-limit-color: var(--grey-36);
+  --text-daterangepicker-end-date: var(--grey-57);
+  --text-daterangepicker-in-range: var(--black-color);
+  --text-daterangepicker-active: var(--white-color);
+  --text-input-autofill-color: var(--text-form-control-color);
+  --text-button-hover-color: var(--grey-6);
+  --text-small-select-color: var(--grey-25);
+  --text-bootbox: var(--ui-gray-7);
+  --text-button-group-color: var(--ui-gray-9);
+  --text-button-dangerlight-color: var(--ui-error-5);
+  --text-stepper-active-color: var(--ui-blue-8);
+
+  --border-color: var(--grey-42);
+  --border-widget-color: var(--grey-43);
+  --border-sidebar-color: var(--ui-blue-9);
+  --border-form-control-color: var(--grey-44);
+  --border-table-color: var(--grey-19);
+  --border-table-top-color: var(--grey-19);
+  --border-datatable-top-color: var(--grey-10);
+  --border-input-group-addon-color: var(--grey-44);
+  --border-btn-default-color: var(--grey-44);
+  --border-md-checkbox-color: var(--grey-19);
+  --border-modal-header-color: var(--grey-45);
+  --border-navtabs-color: var(--ui-white);
+  --border-pre-color: var(--grey-43);
+  --border-pagination-span-color: var(--ui-white);
+  --border-pagination-hover-color: var(--ui-white);
+  --border-motd-body-color: var(--mist-300);
+  --border-panel-color: var(--mist-300);
+  --border-input-sm-color: var(--grey-47);
+  --border-daterangepicker-color: var(--grey-19);
+  --border-calendar-table: var(--white-color);
+  --border-daterangepicker: var(--grey-19);
+  --border-pre-next-month: var(--black-color);
+  --border-daterangepicker-after: var(--white-color);
+  --border-modal: 0px;
+  --border-sortbutton: var(--grey-8);
+  --border-bootbox: var(--ui-gray-5);
+  --border-blocklist: var(--ui-gray-5);
+  --border-blocklist-item-selected-color: var(--grey-46);
+  --border-widget: var(--ui-gray-5);
+  --border-stepper-color: var(--ui-gray-4);
+
+  --shadow-box-color: 0 3px 10px -2px var(--grey-50);
+  --shadow-boxselector-color: 0 3px 10px -2px var(--grey-50);
+  --blue-color: var(--blue-13);
+  --button-close-color: var(--black-color);
+  --button-opacity: 0.2;
+  --button-opacity-hover: 0.5;
+
+  --text-input-textarea: var(--white-color);
+
+  --user-menu-icon-color: var(--ui-gray-4);
+  --sort-icon-muted: var(--ui-gray-5);
+  --sort-icon-hover: var(--ui-gray-6);
+  --sort-icon: var(--ui-gray-9);
+  --border-checkbox: var(--ui-gray-5);
+  --bg-checkbox: var(--white-color);
+  --border-searchbar: var(--grey-44);
+  --bg-button-group: var(--white-color);
+  --border-button-group: var(--ui-gray-5);
+  --text-button-group: var(--ui-gray-9);
+}
+
+/* Dark Theme */
+[theme='dark'] {
+  --BE-only: var(--ui-gray-6);
+
+  --text-log-viewer-color-json-grey: var(--text-log-viewer-color);
+  --text-log-viewer-color-json-magenta: var(--text-log-viewer-color);
+  --text-log-viewer-color-json-yellow: var(--text-log-viewer-color);
+  --text-log-viewer-color-json-green: var(--text-log-viewer-color);
+  --text-log-viewer-color-json-red: var(--text-log-viewer-color);
+  --text-log-viewer-color-json-blue: var(--text-log-viewer-color);
+
+  --bg-body-color: var(--grey-63);
+  --bg-blocklist-hover-color: var(--ui-gray-iron-10);
+  --bg-blocklist-item-selected-color: var(--ui-gray-iron-10);
+  --bg-card-color: var(--grey-1);
+  --bg-checkbox-border-color: var(--grey-8);
+  --bg-code-color: var(--grey-2);
+  --bg-dropdown-menu-color: var(--ui-gray-warm-8);
+  --bg-main-color: var(--grey-2);
+  --bg-widget-color: var(--grey-1);
+  --bg-widget-header-color: var(--grey-3);
+  --bg-widget-table-color: var(--grey-3);
+  --bg-header-color: var(--grey-2);
+  --bg-hover-table-color: var(--grey-3);
+  --bg-table-color: var(--grey-1);
+  --bg-md-checkbox-color: var(--grey-31);
+  --bg-form-control-disabled-color: var(--grey-3);
+  --bg-modal-content-color: var(--grey-1);
+
+  --bg-navtabs-hover-color: var(--grey-3);
+  --bg-nav-tab-active-color: var(--grey-2);
+  --bg-table-selected-color: var(--grey-3);
+  --bg-log-viewer-color: var(--grey-2);
+  --bg-log-line-selected-color: var(--grey-3);
+  --bg-pre-color: var(--grey-2);
+  --bg-progress-color: var(--grey-3);
+  --bg-pagination-color: var(--grey-3);
+  --bg-pagination-span-color: var(--grey-1);
+  --bg-pagination-hover-color: var(--grey-3);
+  --bg-motd-body-color: var(--graphite-800);
+  --bg-motd-btn-color: var(--mist-100);
+  --bg-item-highlighted-color: var(--grey-2);
+  --bg-item-highlighted-null-color: var(--grey-2);
+  --bg-panel-body-color: var(--grey-1);
+  --bg-input-group-addon-color: var(--grey-3);
+  --bg-tooltip-color: var(--grey-3);
+  --bg-input-sm-color: var(--grey-1);
+  --bg-service-datatable-thead: var(--grey-1);
+  --bg-inner-datatable-thead: var(--grey-1);
+  --bg-app-datatable-thead: var(--grey-1);
+  --bg-service-datatable-tbody: var(--grey-1);
+  --bg-app-datatable-tbody: var(--grey-1);
+  --bg-daterangepicker-color: var(--grey-3);
+  --bg-calendar-color: var(--grey-3);
+  --bg-calendar-table-color: var(--grey-3);
+  --bg-daterangepicker-end-date: var(--grey-4);
+  --bg-daterangepicker-hover: var(--grey-4);
+  --bg-daterangepicker-in-range: var(--ui-gray-warm-11);
+  --bg-daterangepicker-active: var(--blue-14);
+  --bg-input-autofill-color: var(--bg-inputbox);
+  --bg-small-select-color: var(--grey-2);
+  --bg-stepper-item-active: var(--grey-1);
+  --bg-stepper-item-counter: var(--grey-7);
+  --bg-sortbutton-color: var(--grey-1);
+  --bg-dashboard-item: var(--grey-3);
+  --bg-searchbar: var(--ui-grey-warm-11);
+  --bg-inputbox: var(--grey-2);
+  --bg-dropdown-hover: var(--grey-3);
+  --bg-webeditor-color: var(--ui-gray-iron-10);
+  --bg-button-group-color: var(--ui-black);
+  --bg-pagination-disabled-color: var(--grey-1);
+  --bg-code-script-color: var(--ui-gray-warm-11);
+  --bg-stepper-color: var(--ui-gray-iron-10);
+  --bg-stepper-active-color: var(--ui-blue-8);
+
+  --text-main-color: var(--white-color);
+  --text-body-color: var(--white-color);
+  --text-widget-header-color: var(--white-color);
+  --text-form-control-color: var(--white-color);
+  --text-muted-color: var(--grey-8);
+  --text-link-color: var(--blue-9);
+  --text-link-hover-color: var(--blue-2);
+  --text-input-group-addon-color: var(--grey-8);
+  --text-blocklist-hover-color: var(--white-color);
+  --text-dashboard-item-color: var(--blue-2);
+  --text-danger-color: var(--red-4);
+  --text-code-color: var(--white-color);
+  --text-navtabs-color: var(--grey-8);
+  --text-navtabs-hover-color: var(--grey-9);
+  --text-nav-tab-active-color: var(--white-color);
+  --text-dropdown-menu-color: var(--white-color);
+  --text-log-viewer-color: var(--white-color);
+  --text-json-tree-color: var(--grey-40);
+  --text-json-tree-leaf-color: var(--blue-6);
+  --text-json-tree-branch-preview-color: var(--blue-7);
+  --text-pre-color: var(--white-color);
+  --text-blocklist-item-selected-color: var(--white-color);
+  --text-progress-bar-color: var(--white-color);
+  --text-pagination-color: var(--white-color);
+  --text-pagination-span-color: var(--ui-white);
+  --text-pagination-span-hover-color: var(--ui-white);
+  --text-motd-body-color: var(--mist-100);
+  --text-motd-btn-color: var(--graphite-700);
+  --text-summary-color: var(--white-color);
+  --text-tooltip-color: var(--white-color);
+  --text-rzslider-color: var(--white-color);
+  --text-rzslider-limit-color: var(--white-color);
+  --text-daterangepicker-end-date: var(--grey-7);
+  --text-daterangepicker-in-range: var(--white-color);
+  --text-daterangepicker-active: var(--white-color);
+  --text-input-autofill-color: var(--text-form-control-color);
+  --text-button-hover-color: var(--white-color);
+  --text-small-select-color: var(--white-color);
+  --text-bootbox: var(--white-color);
+  --text-button-group-color: var(--ui-white);
+  --text-button-dangerlight-color: var(--ui-error-7);
+  --text-stepper-active-color: var(--ui-white);
+
+  --border-color: var(--grey-3);
+  --border-widget-color: var(--grey-1);
+  --border-sidebar-color: var(--ui-gray-8);
+  --border-form-control-color: var(--grey-54);
+  --border-table-color: var(--grey-3);
+  --border-table-top-color: var(--grey-3);
+  --border-datatable-top-color: var(--grey-3);
+  --border-input-group-addon-color: var(--grey-38);
+  --border-btn-default-color: var(--grey-38);
+  --border-md-checkbox-color: var(--grey-41);
+  --border-modal-header-color: var(--grey-1);
+  --border-navtabs-color: var(--grey-38);
+  --border-pre-color: var(--grey-3);
+  --border-blocklist: var(--ui-gray-9);
+  --border-blocklist-item-selected-color: var(--grey-31);
+  --border-pagination-span-color: var(--grey-1);
+  --border-pagination-hover-color: var(--grey-3);
+  --border-motd-body-color: var(--graphite-800);
+  --border-panel-color: var(--grey-2);
+  --border-input-sm-color: var(--grey-3);
+  --border-daterangepicker-color: var(--grey-3);
+  --border-calendar-table: var(--grey-3);
+  --border-daterangepicker: var(--grey-4);
+  --border-pre-next-month: var(--white-color);
+  --border-daterangepicker-after: var(--grey-3);
+  --border-modal: 0px;
+  --border-sortbutton: var(--grey-3);
+  --border-bootbox: var(--ui-gray-9);
+  --border-widget: var(--grey-3);
+  --border-pagination-color: var(--grey-1);
+  --border-stepper-color: var(--ui-gray-warm-9);
+
+  --blue-color: var(--blue-2);
+  --button-close-color: var(--white-color);
+  --button-opacity: 0.6;
+  --button-opacity-hover: 0.3;
+  --shadow-box-color: none;
+  --shadow-boxselector-color: none;
+
+  --text-input-textarea: var(--grey-1);
+
+  --user-menu-icon-color: var(--grey-3);
+  --sort-icon-muted: var(--ui-gray-7);
+  --sort-icon-hover: var(--ui-gray-6);
+  --sort-icon: var(--ui-gray-3);
+  --border-checkbox: var(--ui-gray-5);
+  --bg-checkbox: var(--white-color);
+  --border-searchbar: var(--grey-54);
+  --bg-button-group: var(--white-color);
+  --border-button-group: var(--ui-gray-5);
+  --text-button-group: var(--ui-gray-9);
+}
+
+/* High Contrast Theme */
+[theme='highcontrast'] {
+  --BE-only: var(--ui-gray-6);
+  --text-log-viewer-color-json-grey: var(--text-log-viewer-color);
+  --text-log-viewer-color-json-magenta: var(--text-log-viewer-color);
+  --text-log-viewer-color-json-yellow: var(--text-log-viewer-color);
+  --text-log-viewer-color-json-green: var(--text-log-viewer-color);
+  --text-log-viewer-color-json-red: var(--text-log-viewer-color);
+  --text-log-viewer-color-json-blue: var(--text-log-viewer-color);
+
+  --bg-card-color: var(--black-color);
+  --bg-main-color: var(--black-color);
+  --bg-body-color: var(--black-color);
+  --bg-checkbox-border-color: var(--grey-8);
+  --bg-sidebar-color: var(--black-color);
+  --bg-sidebar-nav-color: var(--black-color);
+  --bg-widget-color: var(--black-color);
+  --bg-widget-header-color: var(--black-color);
+  --bg-widget-table-color: var(--black-color);
+  --bg-header-color: var(--black-color);
+  --bg-hover-table-color: var(--grey-3);
+  --bg-panel-body-color: var(--black-color);
+  --bg-dropdown-menu-color: var(--ui-gray-warm-8);
+  --bg-motd-body-color: var(--black-color);
+  --bg-motd-btn-color: var(--white-color);
+  --bg-blocklist-hover-color: var(--black-color);
+  --bg-blocklist-item-selected-color: var(--black-color);
+  --bg-input-group-addon-color: var(--grey-3);
+  --bg-table-color: var(--black-color);
+
+  --bg-log-viewer-color: var(--black-color);
+  --bg-log-line-selected-color: var(--grey-3);
+  --bg-modal-content-color: var(--black-color);
+  --bg-form-control-disabled-color: var(--grey-1);
+  --bg-input-sm-color: var(--black-color);
+  --bg-item-highlighted-color: var(--black-color);
+  --bg-service-datatable-thead: var(--black-color);
+  --bg-inner-datatable-thead: var(--black-color);
+  --bg-app-datatable-thead: var(--black-color);
+  --bg-service-datatable-tbody: var(--black-color);
+  --bg-app-datatable-tbody: var(--black-color);
+  --bg-pagination-color: var(--grey-3);
+  --bg-pagination-span-color: var(--ui-black);
+  --bg-daterangepicker-color: var(--black-color);
+  --bg-calendar-color: var(--black-color);
+  --bg-calendar-table-color: var(--black-color);
+  --bg-daterangepicker-end-date: var(--grey-3);
+  --bg-daterangepicker-hover: var(--grey-3);
+  --bg-daterangepicker-in-range: var(--grey-2);
+  --bg-daterangepicker-active: var(--blue-14);
+  --bg-tooltip-color: var(--black-color);
+  --bg-table-selected-color: var(--grey-3);
+  --bg-pre-color: var(--grey-2);
+
+  --bg-navtabs-hover-color: var(--grey-3);
+  --bg-nav-tab-active-color: var(--ui-black);
+  --bg-input-autofill-color: var(--bg-inputbox);
+  --bg-code-color: var(--ui-black);
+  --bg-small-select-color: var(--black-color);
+  --bg-stepper-item-active: var(--black-color);
+  --bg-stepper-item-counter: var(--grey-3);
+  --bg-sortbutton-color: var(--grey-1);
+  --bg-inputbox: var(--black-color);
+  --bg-searchbar: var(--black-color);
+  --bg-dropdown-hover: var(--black-color);
+  --bg-webeditor-color: var(--ui-gray-warm-9);
+  --bg-pagination-disabled-color: var(--ui-black);
+  --bg-pagination-hover-color: var(--ui-black);
+  --bg-code-script-color: var(--ui-black);
+  --bg-stepper-active-color: var(--ui-blue-8);
+  --bg-stepper-color: var(--ui-black);
+
+  --text-main-color: var(--white-color);
+  --text-body-color: var(--white-color);
+  --text-widget-header-color: var(--white-color);
+  --text-link-color: var(--blue-9);
+  --text-link-hover-color: var(--blue-9);
+  --text-danger-color: var(--red-7);
+  --text-code-color: var(--red-7);
+  --text-form-control-color: var(--white-color);
+  --text-blocklist-hover-color: var(--blue-11);
+  --text-dashboard-item-color: var(--blue-12);
+  --text-muted-color: var(--white-color);
+  --text-tooltip-color: var(--white-color);
+  --text-blocklist-item-selected-color: var(--blue-9);
+  --text-input-group-addon-color: var(--white-color);
+  --text-dropdown-menu-color: var(--white-color);
+  --text-log-viewer-color: var(--white-color);
+  --text-summary-color: var(--white-color);
+  --text-rzslider-color: var(--white-color);
+  --text-rzslider-limit-color: var(--white-color);
+  --text-pagination-color: var(--white-color);
+  --text-daterangepicker-end-date: var(--ui-white);
+  --text-daterangepicker-in-range: var(--white-color);
+  --text-daterangepicker-active: var(--white-color);
+  --text-motd-body-color: var(--white-color);
+  --text-motd-btn-color: var(--black-color);
+  --text-json-tree-color: var(--white-color);
+  --text-json-tree-leaf-color: var(--white-color);
+  --text-json-tree-branch-preview-color: var(--white-color);
+  --text-pre-color: var(--white-color);
+  --text-navtabs-color: var(--white-color);
+  --text-navtabs-hover-color: var(--white-color);
+  --text-nav-tab-active-color: var(--white-color);
+  --text-input-autofill-color: var(--text-form-control-color);
+  --text-button-hover-color: var(--white-color);
+  --text-small-select-color: var(--white-color);
+  --text-pagination-span-color: var(--ui-white);
+  --text-bootbox: var(--white-color);
+  --text-pagination-span-hover-color: var(--ui-white);
+  --text-stepper-active-color: var(--ui-white);
+
+  --border-color: var(--grey-55);
+  --border-widget-color: var(--white-color);
+  --border-sidebar-color: var(--white-color);
+  --border-form-control-color: var(--grey-54);
+  --border-table-color: var(--grey-55);
+  --border-table-top-color: var(--grey-55);
+  --border-datatable-top-color: var(--grey-55);
+  --border-sidebar-high-contrast: 1px solid var(--blue-9);
+  --border-code-high-contrast: 1px solid var(--white-color);
+  --border-panel-color: var(--white-color);
+  --border-input-group-addon-color: var(--grey-54);
+  --border-modal-header-color: var(--grey-3);
+  --border-input-sm-color: var(--white-color);
+  --border-pagination-color: var(--grey-1);
+  --border-pagination-span-color: var(--grey-1);
+  --border-motd-body-color: var(--white-color);
+  --border-daterangepicker-color: var(--white-color);
+  --border-calendar-table: var(--black-color);
+  --border-daterangepicker: var(--black-color);
+  --border-pre-next-month: var(--white-color);
+  --border-daterangepicker-after: var(--black-color);
+  --border-pre-color: var(--grey-3);
+  --border-modal: 1px solid var(--white-color);
+  --border-sortbutton: var(--black-color);
+  --border-bootbox: var(--black-color);
+  --border-blocklist: var(--white-color);
+  --border-widget: var(--white-color);
+  --border-stepper-color: var(--ui-gray-warm-9);
+
+  --button-close-color: var(--white-color);
+  --button-opacity: 1;
+  --button-opacity-hover: 0.7;
+
+  --shadow-box-color: none;
+  --shadow-boxselector-color: none;
+
+  --text-input-textarea: var(--black-color);
+  --bg-item-highlighted-null-color: var(--grey-2);
+
+  --text-progress-bar-color: var(--black-color);
+
+  --user-menu-icon-color: var(--white-color);
+  --sort-icon-muted: var(--ui-gray-7);
+  --sort-icon-hover: var(--ui-gray-6);
+  --sort-icon: var(--ui-gray-3);
+  --border-checkbox: var(--ui-gray-5);
+  --bg-checkbox: var(--white-color);
+  --border-searchbar: var(--ui-gray-5);
+  --bg-button-group: var(--white-color);
+  --border-button-group: var(--ui-gray-5);
+  --text-button-group: var(--ui-gray-9);
+}
diff --git a/app/assets/css/vendor-override.css b/app/assets/css/vendor-override.css
new file mode 100644
index 0000000..4cf5c1d
--- /dev/null
+++ b/app/assets/css/vendor-override.css
@@ -0,0 +1,436 @@
+/* Overide Vendor CSS */
+.form-control {
+  border: 1px solid var(--border-form-control-color);
+  background-color: var(--bg-inputbox);
+  color: var(--text-form-control-color);
+}
+
+.text-muted {
+  color: var(--text-muted-color);
+}
+
+.table > thead > tr > th {
+  border-bottom: 1px solid var(--border-table-color);
+}
+
+.table-hover > tbody > tr:hover {
+  background-color: var(--bg-hover-table-color);
+}
+
+.switch i {
+  @apply bg-gray-6;
+  @apply th-dark:bg-gray-warm-8;
+  @apply th-highcontrast:bg-gray-warm-8;
+}
+
+.table > thead > tr > th,
+.table > tbody > tr > th,
+.table > tfoot > tr > th,
+.table > thead > tr > td,
+.table > tbody > tr > td,
+.table > tfoot > tr > td {
+  border-top: 1px solid var(--border-table-top-color);
+}
+
+/* the first cell in the table should have 20px padding instead of 5px to match all other widgets */
+.widget .table:not(td .table) > thead > tr > th:first-child,
+.widget .table:not(td .table) > tbody > tr > th:first-child,
+.widget .table:not(td .table) > tfoot > tr > th:first-child,
+.widget .table:not(td .table) > thead > tr > td:first-child,
+.widget .table:not(td .table) > tbody > tr > td:first-child,
+.widget .table:not(td .table) > tfoot > tr > td:first-child {
+  padding-left: 20px;
+}
+
+/* the last cell in the table should have 20px padding instead of 5px to match all other widgets */
+.widget .table:not(td .table) > thead > tr > th:last-child,
+.widget .table:not(td .table) > tbody > tr > th:last-child,
+.widget .table:not(td .table) > tfoot > tr > th:last-child,
+.widget .table:not(td .table) > thead > tr > td:last-child,
+.widget .table:not(td .table) > tbody > tr > td:last-child,
+.widget .table:not(td .table) > tfoot > tr > td:last-child {
+  padding-right: 20px;
+}
+
+/* tables inside widgets should extend the full width of the widget, with 20px table cell padding padding on the left and right */
+.widget-body:not(.no-padding) > .table,
+.widget-body:not(.no-padding) > .widget-content > .table,
+.widget-body:not(.no-padding) > .widget-content > form > .table {
+  margin: 0 -20px;
+  width: calc(100% + 40px);
+  max-width: calc(100% + 40px);
+}
+
+.input-group-addon {
+  color: var(--text-input-group-addon-color);
+  background-color: var(--bg-input-group-addon-color);
+  border: 1px solid var(--border-input-group-addon-color);
+}
+
+.input-group .form-control {
+  z-index: unset;
+}
+
+.input-group-sm > .input-group-addon {
+  line-height: 1;
+}
+
+.text-danger {
+  color: var(--ui-error-9);
+}
+
+.table .table {
+  background-color: initial;
+}
+
+.table-bordered {
+  border-color: var(--border-table-top-color);
+}
+
+.table-bordered > thead > tr > th,
+.table-bordered > tbody > tr > th,
+.table-bordered > tfoot > tr > th,
+.table-bordered > thead > tr > td,
+.table-bordered > tbody > tr > td,
+.table-bordered > tfoot > tr > td {
+  border-color: var(--border-table-top-color);
+}
+
+.md-checkbox input[type='checkbox']:disabled + label:before {
+  background: var(--bg-md-checkbox-color) !important;
+  border-color: var(--border-md-checkbox-color) !important;
+}
+
+.form-control[disabled],
+.form-control[readonly],
+fieldset[disabled] .form-control {
+  background-color: var(--bg-form-control-disabled-color) !important;
+}
+
+.modal.in .modal-dialog {
+  border: var(--border-modal);
+}
+
+.modal-content {
+  background-color: var(--bg-modal-content-color);
+}
+
+code {
+  color: var(--text-code-color);
+  background-color: var(--bg-code-color);
+}
+
+.nav-tabs {
+  border-bottom: 1px solid var(--border-navtabs-color);
+}
+
+.nav-tabs > li {
+  background-color: var(--bg-nav-tabs-active-color);
+  border-top-right-radius: 8px;
+}
+
+.nav-tabs > li.active > a {
+  border: 1px solid transparent;
+}
+
+.nav-tabs > li.active > a,
+.nav-tabs > li.active > a:hover,
+.nav-tabs > li.active > a:focus {
+  color: var(--text-nav-tab-active-color);
+  background-color: var(--bg-nav-tab-active-color);
+  border: 1px solid var(--border-navtabs-color);
+}
+
+.nav-tabs > li.disabled > a {
+  border-color: transparent;
+  pointer-events: none;
+}
+
+.nav-tabs > li > a:hover {
+  border-color: var(--border-navtabs-color);
+}
+
+.nav > li > a {
+  color: var(--text-navtabs-color);
+}
+
+.nav > li > a:hover,
+.nav > li > a:focus {
+  color: var(--text-navtabs-hover-color);
+  background-color: var(--bg-navtabs-hover-color);
+}
+
+.table > thead > tr > td.active,
+.table > tbody > tr > td.active,
+.table > tfoot > tr > td.active,
+.table > thead > tr > th.active,
+.table > tbody > tr > th.active,
+.table > tfoot > tr > th.active,
+.table > thead > tr.active > td,
+.table > tbody > tr.active > td,
+.table > tfoot > tr.active > td,
+.table > thead > tr.active > th,
+.table > tbody > tr.active > th,
+.table > tfoot > tr.active > th {
+  background-color: var(--bg-table-selected-color);
+}
+.table-hover > tbody > tr > td.active:hover,
+.table-hover > tbody > tr > th.active:hover,
+.table-hover > tbody > tr.active:hover > td,
+.table-hover > tbody > tr:hover > .active,
+.table-hover > tbody > tr.active:hover > th {
+  background-color: var(--bg-table-selected-color);
+}
+
+.dropdown-menu {
+  background: var(--bg-dropdown-menu-color);
+  border-radius: 8px;
+}
+
+.dropdown-menu > li > a {
+  color: var(--text-dropdown-menu-color);
+}
+
+pre {
+  border: 1px solid var(--border-pre-color);
+  border-radius: 8px;
+  background-color: var(--bg-pre-color);
+  color: var(--text-pre-color);
+}
+
+.progress {
+  background-color: var(--bg-progress-color);
+}
+
+.widget-body.motd-body {
+  border: 1px solid var(--border-motd-body-color);
+  color: var(--text-motd-body-color);
+  background: var(--bg-motd-body-color) url(../images/purple-gradient.svg) top right / 40% no-repeat;
+}
+
+.widget-body.motd-body .btn.btn-link,
+.widget-body.motd-body .btn.btn-link:hover {
+  padding: 0 5px 0 4px;
+  border-radius: 4px;
+  background-color: var(--bg-motd-btn-color);
+  color: var(--text-motd-btn-color);
+}
+
+.panel-body {
+  background-color: var(--bg-panel-body-color) !important;
+}
+
+.panel {
+  border: 1px solid var(--border-panel-color);
+  background-color: var(--bg-panel-body-color);
+  border-radius: 8px;
+  -webkit-box-shadow: 0 4px 4px rgba(0, 0, 0, 0.05);
+  -moz-box-shadow: 0 4px 4px rgba(0, 0, 0, 0.05);
+  box-shadow: 0 4px 4px rgba(0, 0, 0, 0.05);
+}
+
+.theme-information .col-sm-12 {
+  padding-left: 0px;
+  padding-right: 0px;
+  margin-top: 15px;
+}
+
+.theme-panel {
+  margin-top: 15px;
+}
+
+.bold {
+  color: var(--text-summary-color);
+  font-weight: 700;
+}
+
+.input-sm {
+  background-color: var(--bg-input-sm-color);
+  border: 1px solid var(--border-input-sm-color);
+}
+
+.rzslider .rz-bubble {
+  color: var(--text-rzslider-color);
+}
+
+.rzslider .rz-bubble.rz-limit {
+  color: var(--text-rzslider-limit-color);
+}
+
+.rz-bubble.rz-limit.rz-ceil {
+  position: absolute;
+  right: 0;
+  left: auto !important;
+  top: -26px;
+}
+
+input,
+select,
+textarea {
+  background: var(--text-input-textarea);
+}
+
+[theme='highcontrast'] input,
+[theme='highcontrast'] select,
+[theme='highcontrast'] textarea {
+  border: 1px solid var(--white-color);
+}
+
+.daterangepicker {
+  background-color: var(--bg-daterangepicker-color);
+  border: 1px solid var(--border-daterangepicker-color);
+}
+
+.daterangepicker .drp-calendar.left {
+  background: var(--bg-calendar-color);
+}
+
+.daterangepicker .drp-calendar.left .calendar-table {
+  background: var(--bg-calendar-table-color);
+}
+
+.daterangepicker .drp-calendar.right {
+  background: var(--bg-calendar-color);
+}
+
+.daterangepicker .drp-calendar.right .calendar-table {
+  background: var(--bg-calendar-table-color);
+}
+
+.daterangepicker .calendar-table {
+  border: 1px solid var(--border-calendar-table);
+}
+
+.daterangepicker td.off,
+.daterangepicker td.off.in-range,
+.daterangepicker td.off.start-date,
+.daterangepicker td.off.end-date {
+  background-color: var(--bg-daterangepicker-end-date);
+  color: var(--text-daterangepicker-end-date);
+}
+
+.daterangepicker td.available:hover,
+.daterangepicker th.available:hover {
+  background-color: var(--bg-daterangepicker-hover);
+}
+
+.daterangepicker td.in-range {
+  background-color: var(--bg-daterangepicker-in-range);
+  color: var(--text-daterangepicker-in-range);
+}
+
+.daterangepicker td.active,
+.daterangepicker td.active:hover {
+  background-color: var(--bg-daterangepicker-active);
+  color: var(--text-daterangepicker-active);
+}
+
+.daterangepicker .drp-buttons {
+  border-top: 1px solid var(--border-daterangepicker);
+}
+
+.daterangepicker .calendar-table .next span,
+.daterangepicker .calendar-table .prev span {
+  border-color: var(--border-pre-next-month);
+}
+
+.daterangepicker:after {
+  border-bottom: 6px solid var(--border-daterangepicker-after);
+}
+
+input:-webkit-autofill,
+input:-webkit-autofill:hover,
+input:-webkit-autofill:focus,
+input:-webkit-autofill:active {
+  -webkit-box-shadow: 0 0 0 30px var(--bg-input-autofill-color) inset !important;
+  box-shadow: 0 0 0 30px var(--bg-input-autofill-color) inset !important;
+}
+
+input:-webkit-autofill {
+  -webkit-text-fill-color: var(--text-input-autofill-color) !important;
+}
+
+/* Overide Vendor CSS */
+.multiSelect.inlineBlock button {
+  margin: 0;
+}
+
+.label-default {
+  line-height: 11px;
+}
+
+/* Code Script Style */
+.code-script {
+  background-color: var(--bg-code-script-color);
+  border-bottom-left-radius: 8px;
+  border-bottom-right-radius: 8px;
+  padding: 5px;
+}
+
+/* Tippy */
+/* For triangle arrow (Sharp) */
+/* Tippy */
+/* For triangle arrow (Sharp) */
+.tippy-box[data-placement^='top'] > .tippy-arrow:before {
+  border-top: 8px solid var(--bg-tooltip-color);
+}
+
+.tippy-box[data-placement^='bottom'] > .tippy-arrow:before {
+  border-bottom: 8px solid var(--bg-tooltip-color);
+}
+
+.tippy-box[data-placement^='right'] > .tippy-arrow:before {
+  border-right: 8px solid var(--bg-tooltip-color);
+}
+
+.tippy-box[data-placement^='left'] > .tippy-arrow:before {
+  border-left: 8px solid var(--bg-tooltip-color);
+}
+
+[theme='highcontrast'] .tippy-box[data-placement^='top'] > .tippy-arrow:before {
+  border-top: 8px solid var(--white-color);
+  margin-bottom: -1px;
+}
+
+[theme='highcontrast'] .tippy-box[data-placement^='bottom'] > .tippy-arrow:before {
+  border-bottom: 8px solid var(--white-color);
+  margin-top: -1px;
+}
+
+[theme='highcontrast'] .tippy-box[data-placement^='right'] > .tippy-arrow:before {
+  border-right: 8px solid var(--white-color);
+  margin-left: -1px;
+}
+
+[theme='highcontrast'] .tippy-box[data-placement^='left'] > .tippy-arrow:before {
+  border-left: 8px solid var(--white-color);
+  margin-right: -1px;
+}
+
+/* Sidebar */
+.sidebar .tippy-box {
+  font-size: 12px;
+}
+
+.sidebar.tippy-box[data-placement^='right'] > .tippy-arrow {
+  width: 12px;
+  height: 12px;
+  margin-left: -1px;
+}
+
+.sidebar.tippy-box[data-placement^='right'] > .tippy-arrow:before {
+  border-right: 8px solid var(--graphite-600);
+  border-width: 6px 8px 6px 0;
+}
+
+[theme='highcontrast'] .sidebar.tippy-box[data-placement^='right'] > .tippy-arrow:before {
+  border-right: 8px solid var(--ui-white);
+}
+
+.sidebar .tippy-content {
+  white-space: nowrap;
+}
+
+.tippy-content {
+  padding: 0;
+}
diff --git a/app/assets/fonts/Inter-VariableFont.ttf b/app/assets/fonts/Inter-VariableFont.ttf
new file mode 100644
index 0000000..969a990
Binary files /dev/null and b/app/assets/fonts/Inter-VariableFont.ttf differ
diff --git a/app/assets/ico/android-chrome-192x192.png b/app/assets/ico/android-chrome-192x192.png
new file mode 100644
index 0000000..236db0e
Binary files /dev/null and b/app/assets/ico/android-chrome-192x192.png differ
diff --git a/app/assets/ico/android-chrome-256x256.png b/app/assets/ico/android-chrome-256x256.png
new file mode 100644
index 0000000..52848e0
Binary files /dev/null and b/app/assets/ico/android-chrome-256x256.png differ
diff --git a/app/assets/ico/apple-touch-icon.png b/app/assets/ico/apple-touch-icon.png
new file mode 100644
index 0000000..f05e9c1
Binary files /dev/null and b/app/assets/ico/apple-touch-icon.png differ
diff --git a/app/assets/ico/beta.svg b/app/assets/ico/beta.svg
new file mode 100644
index 0000000..23261c7
--- /dev/null
+++ b/app/assets/ico/beta.svg
@@ -0,0 +1,3 @@
+<svg width="auto" height="auto" viewBox="0 0 8 16" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M1 14.3223V3.49792C1 2.11836 2.11832 1 3.49792 1C4.87753 1 5.99585 2.11836 5.99585 3.49792C5.99585 4.87749 4.87753 5.99585 3.49792 5.99585L3.91425 5.99609C5.52374 5.99609 6.82849 7.30084 6.82849 8.91034C6.82849 10.5198 5.52374 11.8246 3.91425 11.8246C2.30475 11.8246 1 10.5198 1 8.91034" stroke="currentColor" stroke-width="1.4" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>
diff --git a/app/assets/ico/browserconfig.xml b/app/assets/ico/browserconfig.xml
new file mode 100644
index 0000000..44751e9
--- /dev/null
+++ b/app/assets/ico/browserconfig.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="utf-8"?>
+<browserconfig>
+    <msapplication>
+        <tile>
+            <square150x150logo src="ico/mstile-150x150.png"/>
+            <TileColor>#2d89ef</TileColor>
+        </tile>
+    </msapplication>
+</browserconfig>
diff --git a/app/assets/ico/dataflow-1.svg b/app/assets/ico/dataflow-1.svg
new file mode 100644
index 0000000..4e9f506
--- /dev/null
+++ b/app/assets/ico/dataflow-1.svg
@@ -0,0 +1 @@
+<svg width="auto" height="auto" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg"> <path d="M17 20H16.8C15.1198 20 14.2798 20 13.638 19.673C13.0735 19.3854 12.6146 18.9265 12.327 18.362C12 17.7202 12 16.8802 12 15.2V8.8C12 7.11984 12 6.27976 12.327 5.63803C12.6146 5.07354 13.0735 4.6146 13.638 4.32698C14.2798 4 15.1198 4 16.8 4H17M17 20C17 21.1046 17.8954 22 19 22C20.1046 22 21 21.1046 21 20C21 18.8954 20.1046 18 19 18C17.8954 18 17 18.8954 17 20ZM17 4C17 5.10457 17.8954 6 19 6C20.1046 6 21 5.10457 21 4C21 2.89543 20.1046 2 19 2C17.8954 2 17 2.89543 17 4ZM7 12L17 12M7 12C7 13.1046 6.10457 14 5 14C3.89543 14 3 13.1046 3 12C3 10.8954 3.89543 10 5 10C6.10457 10 7 10.8954 7 12ZM17 12C17 13.1046 17.8954 14 19 14C20.1046 14 21 13.1046 21 12C21 10.8954 20.1046 10 19 10C17.8954 10 17 10.8954 17 12Z" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/> </svg>
\ No newline at end of file
diff --git a/app/assets/ico/docker-edge-environment.svg b/app/assets/ico/docker-edge-environment.svg
new file mode 100644
index 0000000..b533838
--- /dev/null
+++ b/app/assets/ico/docker-edge-environment.svg
@@ -0,0 +1,25 @@
+<svg width="60" height="60" viewBox="0 0 60 60" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0_3_63)">
+<path d="M10.0931 24.7167C10.0916 24.6319 10.0898 24.5473 10.0898 24.4624C10.0898 16.3646 16.6544 9.80001 24.7522 9.80001C31.7306 9.80001 37.5698 14.6753 39.051 21.2057C40.4323 20.4325 42.0233 19.9898 43.7187 19.9898C49.0089 19.9898 53.2975 24.2783 53.2975 29.5686C53.2975 29.7848 53.2878 29.9987 53.2736 30.2113C57.201 31.6693 60 35.4496 60 39.8843C60 45.5814 55.3816 50.2 49.6843 50.2H12.8946C5.77316 50.1998 0 44.4267 0 37.3052C0 31.1458 4.31877 25.9961 10.0931 24.7167Z" fill="#0077BB"/>
+<g clip-path="url(#clip1_3_63)">
+<path d="M45.5486 31.3321C45.4597 31.2558 44.6618 30.6292 42.9481 30.6292C42.505 30.6292 42.0468 30.6748 41.6037 30.7518C41.2785 28.4127 39.4021 27.2812 39.3284 27.2207L38.8702 26.9454L38.5746 27.3889C38.2052 27.9849 37.9248 28.658 37.7622 29.3459C37.4521 30.6762 37.6436 31.9296 38.2941 32.9997C37.5107 33.458 36.2401 33.565 35.974 33.5807H14.9921C14.4457 33.5807 14.0019 34.0391 14.0019 34.6052C13.9723 36.5008 14.2824 38.3965 14.9177 40.1852C15.6419 42.1422 16.7203 43.5945 18.1094 44.4813C19.6757 45.4751 22.2321 46.0405 25.1131 46.0405C26.4133 46.0405 27.7136 45.9178 28.9994 45.6733C30.7875 45.3368 32.5012 44.6952 34.0826 43.7627C35.3828 42.9827 36.5501 41.9897 37.5404 40.8276C39.21 38.8863 40.2001 36.7154 40.9243 34.789H41.2199C43.0377 34.789 44.1602 34.0398 44.781 33.3982C45.1944 33.0004 45.5052 32.5113 45.7264 31.9609L45.8594 31.5631L45.5493 31.3336L45.5486 31.3321Z" fill="white"/>
+<path d="M16.9416 32.9526H19.7489C19.8818 32.9526 20.0004 32.8456 20.0004 32.6923V30.0937C20.0004 29.9561 19.897 29.8343 19.7489 29.8343H16.9416C16.8086 29.8343 16.6901 29.9412 16.6901 30.0937V32.6923C16.7046 32.8449 16.8086 32.9526 16.9416 32.9526Z" fill="white"/>
+<path d="M20.814 32.9526H23.6212C23.7542 32.9526 23.8721 32.8456 23.8721 32.6923V30.0937C23.8721 29.9561 23.7687 29.8343 23.6212 29.8343H20.814C20.681 29.8343 20.5625 29.9412 20.5625 30.0937V32.6923C20.577 32.8449 20.681 32.9526 20.814 32.9526Z" fill="white"/>
+<path d="M24.7593 32.9526H27.5666C27.6996 32.9526 27.818 32.8456 27.818 32.6923V30.0937C27.818 29.9561 27.7147 29.8343 27.5666 29.8343H24.7593C24.6263 29.8343 24.5078 29.9412 24.5078 30.0937V32.6923C24.5078 32.8449 24.6112 32.9526 24.7593 32.9526Z" fill="white"/>
+<path d="M28.6447 32.9526H31.452C31.585 32.9526 31.7035 32.8456 31.7035 32.6923V30.0937C31.7035 29.9561 31.6001 29.8343 31.452 29.8343H28.6447C28.5117 29.8343 28.3932 29.9412 28.3932 30.0937V32.6923C28.3932 32.8449 28.5117 32.9526 28.6447 32.9526Z" fill="white"/>
+<path d="M20.814 29.2375H23.6212C23.7542 29.2375 23.8721 29.1148 23.8721 28.9773V26.3786C23.8721 26.241 23.7687 26.1184 23.6212 26.1184H20.814C20.681 26.1184 20.5625 26.2254 20.5625 26.3786V28.9773C20.577 29.1148 20.681 29.2375 20.814 29.2375Z" fill="white"/>
+<path d="M24.7593 29.2375H27.5666C27.6996 29.2375 27.818 29.1148 27.818 28.9773V26.3786C27.818 26.241 27.7147 26.1184 27.5666 26.1184H24.7593C24.6263 26.1184 24.5078 26.2254 24.5078 26.3786V28.9773C24.5078 29.1148 24.6112 29.2375 24.7593 29.2375Z" fill="white"/>
+<path d="M28.6447 29.2375H31.452C31.585 29.2375 31.7035 29.1148 31.7035 28.9773V26.3786C31.7035 26.241 31.585 26.1184 31.452 26.1184H28.6447C28.5117 26.1184 28.3932 26.2254 28.3932 26.3786V28.9773C28.3932 29.1148 28.5117 29.2375 28.6447 29.2375Z" fill="white"/>
+<path d="M28.6447 25.5075H31.452C31.585 25.5075 31.7035 25.4006 31.7035 25.2473V22.6487C31.7035 22.5111 31.585 22.3885 31.452 22.3885H28.6447C28.5117 22.3885 28.3932 22.4954 28.3932 22.6487V25.2473C28.3932 25.3849 28.5117 25.5075 28.6447 25.5075Z" fill="white"/>
+<path d="M32.5623 32.9526H35.3695C35.5025 32.9526 35.6211 32.8456 35.6211 32.6923V30.0937C35.6211 29.9561 35.5177 29.8343 35.3695 29.8343H32.5623C32.4293 29.8343 32.3108 29.9412 32.3108 30.0937V32.6923C32.3252 32.8449 32.4293 32.9526 32.5623 32.9526Z" fill="white"/>
+</g>
+</g>
+<defs>
+<clipPath id="clip0_3_63">
+<rect width="60" height="60" fill="white"/>
+</clipPath>
+<clipPath id="clip1_3_63">
+<rect width="32" height="36" fill="white" transform="translate(14 17)"/>
+</clipPath>
+</defs>
+</svg>
diff --git a/app/assets/ico/favicon-16x16.png b/app/assets/ico/favicon-16x16.png
new file mode 100644
index 0000000..e224635
Binary files /dev/null and b/app/assets/ico/favicon-16x16.png differ
diff --git a/app/assets/ico/favicon-32x32.png b/app/assets/ico/favicon-32x32.png
new file mode 100644
index 0000000..2b94e3a
Binary files /dev/null and b/app/assets/ico/favicon-32x32.png differ
diff --git a/app/assets/ico/favicon.ico b/app/assets/ico/favicon.ico
new file mode 100644
index 0000000..d8c1d7f
Binary files /dev/null and b/app/assets/ico/favicon.ico differ
diff --git a/app/assets/ico/filter-lines.svg b/app/assets/ico/filter-lines.svg
new file mode 100644
index 0000000..03081d5
--- /dev/null
+++ b/app/assets/ico/filter-lines.svg
@@ -0,0 +1 @@
+<svg width="auto" height="auto" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M6 12H18M3 6H21M9 18H15" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/></svg>
\ No newline at end of file
diff --git a/app/assets/ico/flask.svg b/app/assets/ico/flask.svg
new file mode 100644
index 0000000..23e84d1
--- /dev/null
+++ b/app/assets/ico/flask.svg
@@ -0,0 +1,3 @@
+<svg width="auto" height="auto" viewBox="0 0 100 100" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M37.5 25.0002V43.7552C37.5 46.0507 37.5 47.1985 37.2138 48.2621C36.9603 49.2044 36.5432 50.095 35.9816 50.893C35.3477 51.7938 34.4659 52.5286 32.7025 53.9981L17.2975 66.8356C15.5341 68.3051 14.6523 69.0399 14.0184 69.9406C13.4568 70.7387 13.0397 71.6292 12.7862 72.5716C12.5 73.6352 12.5 74.783 12.5 77.0785V78.3335C12.5 83.0006 12.5 85.3342 13.4083 87.1168C14.2072 88.6848 15.4821 89.9596 17.0501 90.7586C18.8327 91.6668 21.1662 91.6668 25.8333 91.6668H74.1667C78.8338 91.6668 81.1673 91.6668 82.9499 90.7586C84.5179 89.9596 85.7928 88.6848 86.5917 87.1168C87.5 85.3342 87.5 83.0006 87.5 78.3335V77.0785C87.5 74.783 87.5 73.6352 87.2138 72.5716C86.9603 71.6292 86.5432 70.7387 85.9816 69.9406C85.3477 69.0399 84.4659 68.3051 82.7025 66.8356L67.2975 53.9981C65.5341 52.5286 64.6523 51.7938 64.0184 50.893C63.4568 50.095 63.0397 49.2044 62.7861 48.2621C62.5 47.1985 62.5 46.0507 62.5 43.7552V25.0002M34.5833 25.0002H65.4167C66.5834 25.0002 67.1668 25.0002 67.6125 24.7731C68.0045 24.5734 68.3232 24.2546 68.5229 23.8626C68.75 23.417 68.75 22.8336 68.75 21.6668V11.6668C68.75 10.5001 68.75 9.91667 68.5229 9.47102C68.3232 9.07901 68.0045 8.7603 67.6125 8.56057C67.1668 8.3335 66.5834 8.3335 65.4167 8.3335H34.5833C33.4166 8.3335 32.8332 8.3335 32.3875 8.56057C31.9955 8.7603 31.6768 9.07901 31.4771 9.47102C31.25 9.91667 31.25 10.5001 31.25 11.6668V21.6668C31.25 22.8336 31.25 23.417 31.4771 23.8626C31.6768 24.2546 31.9955 24.5734 32.3875 24.7731C32.8332 25.0002 33.4166 25.0002 34.5833 25.0002ZM22.9167 70.8335H77.0833C79.0194 70.8335 79.9874 70.8335 80.7924 70.9936C84.0982 71.6512 86.6823 74.2353 87.3399 77.5411C87.5 78.3461 87.5 79.3141 87.5 81.2502C87.5 83.1862 87.5 84.1543 87.3399 84.9593C86.6823 88.265 84.0982 90.8492 80.7924 91.5067C79.9874 91.6668 79.0194 91.6668 77.0833 91.6668H22.9167C20.9806 91.6668 20.0126 91.6668 19.2076 91.5067C15.9018 90.8492 13.3177 88.265 12.6601 84.9593C12.5 84.1543 12.5 83.1862 12.5 81.2502C12.5 79.3141 12.5 78.3461 12.6601 77.5411C13.3177 74.2353 15.9018 71.6512 19.2076 70.9936C20.0126 70.8335 20.9806 70.8335 22.9167 70.8335Z" stroke="currentColor" stroke-width="8.2" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>
diff --git a/app/assets/ico/git.svg b/app/assets/ico/git.svg
new file mode 100644
index 0000000..32e300e
--- /dev/null
+++ b/app/assets/ico/git.svg
@@ -0,0 +1,3 @@
+<svg width="36" height="40" viewBox="0 0 36 40" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M27.3629 17.9077L15.5368 5.65985C14.6877 4.78038 13.3115 4.78038 12.4624 5.65985L10.0975 8.10918L13.3098 11.4363C13.5655 11.327 13.8452 11.2663 14.1389 11.2663C15.3414 11.2663 16.3162 12.2758 16.3162 13.5213C16.3162 13.8255 16.2575 14.1151 16.152 14.38L19.227 17.5648C19.4827 17.4555 19.7624 17.3948 20.0561 17.3948C21.2586 17.3948 22.2334 18.4044 22.2334 19.6499C22.2334 20.8953 21.2586 21.9049 20.0561 21.9049C18.8536 21.9049 17.8788 20.8953 17.8788 19.6499C17.8788 19.3457 17.9374 19.056 18.0429 18.7912L14.9757 15.6145V23.639C15.7624 23.979 16.3156 24.7827 16.3156 25.7212C16.3156 26.9666 15.3408 27.9762 14.1383 27.9762C12.9358 27.9762 11.961 26.9666 11.961 25.7212C11.961 24.7833 12.5143 23.979 13.3009 23.639V15.6035C12.5143 15.2635 11.961 14.4598 11.961 13.5213C11.961 13.2172 12.0196 12.9275 12.1252 12.6627L8.91281 9.33559L0.636858 17.9077C-0.212286 18.7872 -0.212286 20.2125 0.636858 21.0919L12.4629 33.3404C13.3121 34.2198 14.6882 34.2198 15.5374 33.3404L27.3634 21.0919C28.2126 20.2125 28.2126 18.7872 27.3634 17.9077H27.3629Z" fill="#E15B39"/>
+</svg>
diff --git a/app/assets/ico/heartbeat-down.svg b/app/assets/ico/heartbeat-down.svg
new file mode 100644
index 0000000..eafa69d
--- /dev/null
+++ b/app/assets/ico/heartbeat-down.svg
@@ -0,0 +1,4 @@
+<svg width="16" height="15" viewBox="0 0 16 15" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M7.91895 2.19267C6.33456 0.34043 3.69255 -0.157821 1.70745 1.53828C-0.277637 3.23438 -0.557105 6.0702 1.0018 8.07617C2.17927 9.59131 5.52429 12.6331 7.0907 14.0309C7.37867 14.2878 7.52266 14.4164 7.69121 14.4669C7.83757 14.5108 8.00026 14.5108 8.14662 14.4669C8.31517 14.4164 8.45916 14.2878 8.74713 14.0309C10.3135 12.6331 13.6586 9.59131 14.836 8.07617C16.3949 6.0702 16.1496 3.21655 14.1304 1.53828C12.1112 -0.139975 9.50327 0.34043 7.91895 2.19267Z" fill="#D92D20"/>
+<path d="M8.03754 9.71338L8.03754 4.94044M8.03754 9.71338L5.90125 7.57709M8.03754 9.71338L10.1738 7.57709" stroke="white" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>
diff --git a/app/assets/ico/heartbeat-up.svg b/app/assets/ico/heartbeat-up.svg
new file mode 100644
index 0000000..87f7f68
--- /dev/null
+++ b/app/assets/ico/heartbeat-up.svg
@@ -0,0 +1,4 @@
+<svg width="16" height="15" viewBox="0 0 16 15" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M7.91895 2.19267C6.33456 0.34043 3.69255 -0.157821 1.70745 1.53828C-0.277637 3.23438 -0.557105 6.0702 1.0018 8.07617C2.17927 9.59131 5.52429 12.6331 7.0907 14.0309C7.37867 14.2878 7.52266 14.4164 7.69121 14.4669C7.83757 14.5108 8.00026 14.5108 8.14662 14.4669C8.31517 14.4164 8.45916 14.2878 8.74713 14.0309C10.3135 12.6331 13.6586 9.59131 14.836 8.07617C16.3949 6.0702 16.1496 3.21655 14.1304 1.53828C12.1112 -0.139975 9.50327 0.34043 7.91895 2.19267Z" fill="#039855"/>
+<path d="M8.03754 4.94043L8.03754 9.71337M8.03754 4.94043L10.1738 7.07672M8.03754 4.94043L5.90125 7.07672" stroke="white" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>
diff --git a/app/assets/ico/helm.svg b/app/assets/ico/helm.svg
new file mode 100644
index 0000000..49e4704
--- /dev/null
+++ b/app/assets/ico/helm.svg
@@ -0,0 +1 @@
+<svg fill="currentColor" width="auto" height="auto" viewBox="-2 -2 28 28" role="img" xmlns="http://www.w3.org/2000/svg"><title>Helm</title><path d="M18.651,19.252c0.704,1.005,0.96,2.039,0.573,2.31c-0.387,0.271-1.271-0.324-1.975-1.329 c-0.259-0.37-0.456-0.744-0.584-1.082c-1.156,0.772-2.493,1.258-3.898,1.4c0.081,0.34,0.13,0.737,0.13,1.166 c0,1.227-0.383,2.221-0.856,2.221c-0.473,0-0.856-0.994-0.856-2.221c0-0.42,0.047-0.807,0.125-1.142 c-1.414-0.099-2.765-0.547-3.944-1.284c-0.127,0.301-0.3,0.621-0.524,0.942c-0.704,1.005-1.588,1.6-1.975,1.329 c-0.387-0.271-0.131-1.305,0.573-2.31c0.236-0.337,0.492-0.622,0.743-0.85c-0.487-0.437-0.928-0.931-1.309-1.479l1.124-0.782 c1.345,1.934,3.554,3.088,5.908,3.088c2.36,0,4.571-1.158,5.916-3.098l1.125,0.78c-0.348,0.502-0.747,0.957-1.183,1.366 C18.06,18.518,18.369,18.85,18.651,19.252z M6.277,5.623C5.682,6.143,5.153,6.746,4.711,7.43l1.15,0.743 C7.193,6.111,9.453,4.88,11.907,4.88c2.535,0,4.835,1.294,6.151,3.461l1.17-0.711c-0.435-0.716-0.963-1.349-1.56-1.895 c0.324-0.245,0.671-0.603,0.983-1.049c0.704-1.005,0.96-2.039,0.573-2.31c-0.387-0.271-1.271,0.324-1.975,1.329 c-0.294,0.419-0.504,0.84-0.627,1.212c-1.152-0.761-2.485-1.232-3.9-1.364c0.108-0.372,0.175-0.83,0.175-1.333 C12.897,0.994,12.514,0,12.041,0c-0.473,0-0.856,0.994-0.856,2.221c0,0.491,0.063,0.941,0.167,1.308 c-1.413,0.09-2.757,0.525-3.93,1.247c-0.128-0.336-0.323-0.705-0.58-1.071C6.139,2.7,5.255,2.106,4.868,2.377 c-0.387,0.271-0.131,1.305,0.573,2.31C5.706,5.065,5.997,5.385,6.277,5.623z M0.5,15.272h1.648V12.8h1.859v2.473h1.648V9.043H4.008 v2.319H2.148V9.043H0.5V15.272z M7.036,9.043v6.229h4.121v-1.38H8.684v-1.112h2.032v-1.38H8.684v-0.978h2.377v-1.38L7.036,9.043 L7.036,9.043z M12.364,9.043v6.229h4.006v-1.38h-2.358V9.043L12.364,9.043L12.364,9.043z M17.443,9.043v6.229h1.514v-1.84 c0-0.16-0.008-0.335-0.024-0.527c-0.016-0.192-0.034-0.388-0.053-0.589c-0.019-0.201-0.042-0.398-0.067-0.589 c-0.026-0.192-0.048-0.364-0.067-0.517h0.038l0.498,1.457l0.863,2.099h0.613l0.862-2.099l0.517-1.457h0.038 c-0.019,0.153-0.042,0.326-0.067,0.518c-0.026,0.192-0.048,0.388-0.067,0.589c-0.019,0.201-0.037,0.398-0.053,0.589 c-0.016,0.192-0.024,0.367-0.024,0.527v1.84H23.5V9.043h-1.706l-0.939,2.588l-0.345,1.016h-0.038l-0.345-1.016l-0.978-2.588 L17.443,9.043L17.443,9.043z"/></svg>
\ No newline at end of file
diff --git a/app/assets/ico/icon_up-to-date.svg b/app/assets/ico/icon_up-to-date.svg
new file mode 100644
index 0000000..82fc747
--- /dev/null
+++ b/app/assets/ico/icon_up-to-date.svg
@@ -0,0 +1,5 @@
+<svg width="15" height="14" viewBox="0 0 15 14" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect x="0.5" width="14" height="14" rx="7" fill="#039855"/>
+<path fill-rule="evenodd" clip-rule="evenodd" d="M10.4729 4.31086L6.29623 8.34169L5.1879 7.15753C4.98373 6.96503 4.6629 6.95336 4.42957 7.11669C4.20207 7.28586 4.1379 7.58336 4.2779 7.82253L5.5904 9.95753C5.71873 10.1559 5.9404 10.2784 6.19123 10.2784C6.4304 10.2784 6.6579 10.1559 6.78623 9.95753C6.99623 9.68336 11.0037 4.90586 11.0037 4.90586C11.5287 4.36919 10.8929 3.89669 10.4729 4.30503V4.31086Z" fill="#0BA5EC"/>
+<path fill-rule="evenodd" clip-rule="evenodd" d="M11.1403 4.30503C11.0118 4.12405 10.7084 4.07605 10.4729 4.30503V4.31086L10.3899 4.39096L6.29623 8.34169L5.1879 7.15753C4.98373 6.96503 4.6629 6.95336 4.42957 7.11669C4.20207 7.28586 4.1379 7.58336 4.2779 7.82253L5.5904 9.95753C5.69222 10.1149 5.85279 10.2245 6.04006 10.2631C6.08883 10.2731 6.13941 10.2784 6.19123 10.2784C6.31863 10.2784 6.44272 10.2436 6.55028 10.1811C6.64463 10.1263 6.72626 10.0502 6.78623 9.95753C6.78962 9.9531 6.794 9.94751 6.79933 9.94078C6.85798 9.86677 7.03221 9.65571 7.27843 9.35943C8.07017 8.40673 9.60624 6.57293 10.4372 5.5816C10.7807 5.17172 11.0037 4.90586 11.0037 4.90586C11.0111 4.89829 11.0183 4.89074 11.0253 4.8832C11.0268 4.88147 11.0284 4.87975 11.03 4.87803C11.2318 4.65583 11.2369 4.44719 11.1444 4.31086C11.143 4.3089 11.1417 4.30696 11.1403 4.30503Z" fill="white"/>
+</svg>
diff --git a/app/assets/ico/icon_updates-available.svg b/app/assets/ico/icon_updates-available.svg
new file mode 100644
index 0000000..2b653c2
--- /dev/null
+++ b/app/assets/ico/icon_updates-available.svg
@@ -0,0 +1,11 @@
+<svg width="15" height="14" viewBox="0 0 15 14" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0_0_118)">
+<rect x="0.5" width="14" height="14" rx="7" fill="#F79009"/>
+<path fill-rule="evenodd" clip-rule="evenodd" d="M4.81723 4.55883C5.11013 4.26593 5.585 4.26593 5.87789 4.55883L7.55801 6.23895L9.23813 4.55883C9.53103 4.26593 10.0059 4.26593 10.2988 4.55883C10.5917 4.85172 10.5917 5.32659 10.2988 5.61949L8.61867 7.29961L10.2988 8.97973C10.5917 9.27262 10.5917 9.74749 10.2988 10.0404C10.0059 10.3333 9.53103 10.3333 9.23813 10.0404L7.55801 8.36027L5.87789 10.0404C5.585 10.3333 5.11013 10.3333 4.81723 10.0404C4.52434 9.74749 4.52434 9.27262 4.81723 8.97973L6.49735 7.29961L4.81723 5.61949C4.52434 5.32659 4.52434 4.85172 4.81723 4.55883Z" fill="white"/>
+</g>
+<defs>
+<clipPath id="clip0_0_118">
+<rect x="0.5" width="14" height="14" rx="7" fill="white"/>
+</clipPath>
+</defs>
+</svg>
diff --git a/app/assets/ico/icon_updates-unknown.svg b/app/assets/ico/icon_updates-unknown.svg
new file mode 100644
index 0000000..d64bb36
--- /dev/null
+++ b/app/assets/ico/icon_updates-unknown.svg
@@ -0,0 +1,3 @@
+<svg width="15" height="14" viewBox="0 0 15 14" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path fill-rule="evenodd" clip-rule="evenodd" d="M2.89453 7C2.89453 6.44772 3.34225 6 3.89453 6L11.1055 6C11.6578 6 12.1055 6.44771 12.1055 7C12.1055 7.55228 11.6578 8 11.1055 8L3.89453 8C3.34225 8 2.89453 7.55228 2.89453 7Z" fill="#98A2B3"/>
+</svg>
diff --git a/app/assets/ico/kube.svg b/app/assets/ico/kube.svg
new file mode 100644
index 0000000..17c2765
--- /dev/null
+++ b/app/assets/ico/kube.svg
@@ -0,0 +1 @@
+<svg width="auto" height="auto" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg"> <path d="M12 2V12M12 12V22M12 12L19.0711 4.92893M12 12L4.92893 19.0711M12 12L22 12M12 12L2 12M12 12L19.0711 19.0711M12 12L4.92893 4.92893M20.3334 11.9999C20.3334 16.6022 16.6025 20.3332 12.0001 20.3332C7.39772 20.3332 3.66676 16.6022 3.66676 11.9999C3.66676 7.39748 7.39772 3.66652 12.0001 3.66652C16.6025 3.66652 20.3334 7.39748 20.3334 11.9999Z" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/> </svg>
\ No newline at end of file
diff --git a/app/assets/ico/kubernetes-edge-environment.svg b/app/assets/ico/kubernetes-edge-environment.svg
new file mode 100644
index 0000000..880d85d
--- /dev/null
+++ b/app/assets/ico/kubernetes-edge-environment.svg
@@ -0,0 +1,11 @@
+<svg width="60" height="60" viewBox="0 0 60 60" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0_3_36)">
+<path d="M10.0931 24.7167C10.0916 24.6319 10.0898 24.5473 10.0898 24.4624C10.0898 16.3646 16.6544 9.80001 24.7522 9.80001C31.7306 9.80001 37.5698 14.6753 39.051 21.2057C40.4323 20.4325 42.0233 19.9898 43.7187 19.9898C49.0089 19.9898 53.2975 24.2783 53.2975 29.5686C53.2975 29.7848 53.2878 29.9987 53.2736 30.2113C57.201 31.6693 60 35.4496 60 39.8843C60 45.5814 55.3816 50.2 49.6843 50.2H12.8946C5.77316 50.1998 0 44.4267 0 37.3052C0 31.1458 4.31877 25.9961 10.0931 24.7167Z" fill="#0077BB"/>
+<path d="M26.8844 21.4222C26.8224 20.9834 26.7453 20.5472 26.7001 20.1064C26.6353 19.4611 26.9961 18.9406 27.4857 18.9388C27.9753 18.9369 28.3381 19.4593 28.278 20.1027C28.2263 20.6551 28.1257 21.2019 28.106 21.7533C28.0759 22.5486 28.3099 22.8009 29.0852 22.9425C31.0153 23.2943 32.7209 24.1064 34.1916 25.4092C34.7912 25.9392 35.1737 25.9513 35.8061 25.4204C36.1237 25.1541 36.3963 24.8333 36.6997 24.5502C36.9216 24.3437 37.1377 24.1046 37.4017 23.9751C37.7457 23.8054 38.1207 23.8364 38.3707 24.189C38.6149 24.5323 38.5557 24.8859 38.2757 25.1729C38.0849 25.3679 37.8396 25.5096 37.6095 25.6634C37.2401 25.9081 36.8408 26.1135 36.4921 26.3837C35.8823 26.8591 35.824 27.2493 36.1952 27.9031C37.164 29.6118 37.584 31.4501 37.5004 33.4094C37.4656 34.2281 37.7711 34.5919 38.6017 34.7214C39.1233 34.8012 39.6543 34.8133 40.1759 34.8996C40.8373 35.0093 41.1663 35.4069 41.0149 35.8919C40.8299 36.4893 40.3365 36.5052 39.8572 36.3852C39.3225 36.252 38.8113 36.0204 38.2813 35.8627C37.4159 35.6077 37.0955 35.7691 36.7561 36.585C36.026 38.3463 34.8852 39.7813 33.3431 40.904C32.5189 41.5042 32.4437 41.8108 32.9568 42.7102C33.2172 43.1671 33.5329 43.5928 33.796 44.0495C34.0648 44.5213 34.0451 44.9846 33.5235 45.2603C32.9625 45.5567 32.6148 45.1872 32.4071 44.7332C32.1779 44.2334 32.0481 43.6857 31.8405 43.1745C31.4843 42.2957 31.1555 42.1475 30.2599 42.3942C28.4217 42.9015 26.5836 42.8941 24.7475 42.3857C23.8405 42.1353 23.4741 42.3173 23.1236 43.2242C22.9047 43.7917 22.744 44.3862 22.4705 44.9236C22.2703 45.3185 21.8756 45.5436 21.4208 45.2538C21.013 44.994 20.9162 44.6085 21.1436 44.1696C21.2592 43.9492 21.3926 43.7391 21.5242 43.5272C21.7281 43.197 21.9583 42.8819 22.1388 42.5386C22.5212 41.808 22.4141 41.4085 21.7544 40.9442C20.2189 39.8638 19.0659 38.471 18.3113 36.7519C17.8799 35.7728 17.5322 35.6095 16.5032 35.9218C16.0005 36.0757 15.5137 36.2867 15.0044 36.4143C14.5336 36.5305 14.074 36.4443 13.9632 35.8788C13.8495 35.2935 14.2235 35.0047 14.7497 34.9146C15.2139 34.8359 15.6885 34.8076 16.1583 34.7542C17.208 34.6379 17.5116 34.3088 17.4749 33.2705C17.4082 31.3675 17.8226 29.5856 18.7482 27.9208C19.1495 27.1987 19.0875 26.8554 18.4109 26.3499C18.0782 26.1013 17.707 25.9063 17.3612 25.6765C17.131 25.5246 16.8866 25.3801 16.6959 25.184C16.4168 24.8972 16.3548 24.5351 16.6019 24.2002C16.8763 23.8288 17.2653 23.795 17.6365 24.0249C17.8903 24.1834 18.0979 24.4188 18.3197 24.627C18.6439 24.9308 18.9343 25.2808 19.2923 25.534C19.7584 25.864 20.1982 25.9728 20.7226 25.4608C22.1077 24.1064 23.8189 23.3327 25.7153 22.9632C26.7829 22.755 26.9239 22.5778 26.8844 21.4222ZM26.4464 25.9466H26.4916C26.4916 25.7262 26.4803 25.503 26.4953 25.2826C26.5151 24.9787 26.4013 24.9074 26.1044 24.9655C24.6572 25.247 23.3688 25.8481 22.2365 26.7935C21.9245 27.0533 21.9856 27.2006 22.2882 27.4059C23.1819 28.0165 24.0539 28.6571 24.9467 29.2666C25.7539 29.8172 26.25 29.5734 26.3131 28.6027C26.3693 27.7192 26.4032 26.8319 26.4464 25.9466ZM19.5057 32.6149C19.4981 33.2986 19.797 33.5529 20.4031 33.3784C21.3325 33.1102 22.2675 32.8559 23.1912 32.5708C24.0369 32.3092 24.1667 31.7868 23.522 31.1799C22.7364 30.4399 21.8982 29.7544 21.1192 29.0051C20.7047 28.6064 20.5544 28.8053 20.3636 29.1898C19.8139 30.2984 19.5536 31.4745 19.5047 32.613L19.5057 32.6149ZM27.4623 40.7389C28.1887 40.7585 28.8944 40.6301 29.5964 40.4556C29.8821 40.3843 30.0663 40.3393 29.8605 39.982C29.2675 38.9512 28.7263 37.8905 28.1144 36.872C27.7724 36.3017 27.1973 36.3083 26.8599 36.8803C26.2548 37.9046 25.7041 38.9578 25.1205 39.9942C24.9683 40.2643 25.0303 40.3627 25.3309 40.4378C26.0329 40.6131 26.7349 40.752 27.4623 40.7389ZM35.4744 32.6393C35.4096 31.5269 35.1699 30.3715 34.6352 29.2854C34.4181 28.8455 34.1739 28.6955 33.7547 29.0866C33.0048 29.7854 32.2192 30.4475 31.4703 31.1481C30.7983 31.7764 30.9393 32.3007 31.8415 32.5718C32.7689 32.8522 33.7031 33.1102 34.6333 33.3774C35.4876 33.6222 35.4913 33.6222 35.4744 32.6393ZM31.3837 34.8959C30.1809 34.9493 30.0324 35.1744 30.4393 36.1732C30.8265 37.1224 31.2363 38.0621 31.6103 39.016C31.7371 39.3395 31.8405 39.498 32.1863 39.2392C33.3675 38.3519 34.2735 37.2519 34.8429 35.8873C34.9133 35.7183 35.0421 35.4924 34.7207 35.437C33.5733 35.242 32.4221 35.0647 31.3837 34.8959ZM28.4895 25.8481H28.5176C28.5645 26.7569 28.6079 27.6658 28.6595 28.5764C28.7159 29.5565 29.2045 29.8153 30.0033 29.2705C30.8707 28.6786 31.7004 28.0315 32.5847 27.4678C33.0575 27.1658 32.9521 26.998 32.5979 26.711C31.5237 25.8435 30.3237 25.2751 28.9659 24.9965C28.4875 24.8981 28.4424 25.0603 28.4847 25.4354C28.4997 25.5724 28.4865 25.7102 28.4865 25.8491L28.4895 25.8481ZM24.7953 35.5571C24.6648 35.2756 24.6816 34.9052 24.192 34.923C22.9611 34.9681 21.761 35.2344 20.5478 35.4014C20.1202 35.4595 20.0328 35.6433 20.2001 36.0119C20.7865 37.2977 21.6435 38.3631 22.7815 39.2073C23.0737 39.4239 23.226 39.4277 23.366 39.0376C23.6179 38.3369 23.9355 37.6598 24.2212 36.9714C24.412 36.5128 24.5952 36.0513 24.7944 35.5589L24.7953 35.5571ZM27.5309 31.7268C26.6785 31.7249 26.1759 32.0616 26.1561 32.6487C26.1325 33.354 26.8224 34.1465 27.4745 34.1596C28.0947 34.1727 28.8043 33.4262 28.808 32.7556C28.8117 32.1319 28.3119 31.7268 27.53 31.7249L27.5309 31.7268Z" fill="#FDFDFE"/>
+</g>
+<defs>
+<clipPath id="clip0_3_36">
+<rect width="60" height="60" fill="white"/>
+</clipPath>
+</defs>
+</svg>
diff --git a/app/assets/ico/laptop-code.svg b/app/assets/ico/laptop-code.svg
new file mode 100644
index 0000000..18975e7
--- /dev/null
+++ b/app/assets/ico/laptop-code.svg
@@ -0,0 +1 @@
+<svg width="auto" height="auto" viewBox="0 0 25 25" fill="none" xmlns="http://www.w3.org/2000/svg"> <path d="M21.0886 16.5918V7.7918C21.0886 6.67169 21.0886 6.11164 20.8706 5.68382C20.6789 5.30749 20.3729 5.00153 19.9966 4.80978C19.5688 4.5918 19.0087 4.5918 17.8886 4.5918H6.28862C5.16852 4.5918 4.60847 4.5918 4.18064 4.80978C3.80432 5.00153 3.49836 5.30749 3.30661 5.68382C3.08862 6.11164 3.08862 6.67169 3.08862 7.7918V16.5918M4.75529 20.5918H19.422C20.0419 20.5918 20.3519 20.5918 20.6063 20.5236C21.2964 20.3387 21.8355 19.7996 22.0205 19.1094C22.0886 18.8551 22.0886 18.5451 22.0886 17.9251C22.0886 17.6151 22.0886 17.4601 22.0545 17.333C21.9621 16.9879 21.6925 16.7183 21.3474 16.6259C21.2203 16.5918 21.0653 16.5918 20.7553 16.5918H3.42196C3.11197 16.5918 2.95697 16.5918 2.8298 16.6259C2.48471 16.7183 2.21516 16.9879 2.1227 17.333C2.08862 17.4601 2.08862 17.6151 2.08862 17.9251C2.08862 18.5451 2.08862 18.8551 2.15677 19.1094C2.34171 19.7996 2.8808 20.3387 3.57098 20.5236C3.82532 20.5918 4.13531 20.5918 4.75529 20.5918Z" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/> <path d="M14.0886 13.582L16.5886 11.082C15.6123 10.1057 15.0649 9.55834 14.0886 8.58203M10.0886 8.58203C9.11231 9.55834 8.56493 10.1057 7.58862 11.082C8.56493 12.0583 9.11231 12.6057 10.0886 13.582" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/> </svg>
\ No newline at end of file
diff --git a/app/assets/ico/ldap.svg b/app/assets/ico/ldap.svg
new file mode 100644
index 0000000..4ce73f7
--- /dev/null
+++ b/app/assets/ico/ldap.svg
@@ -0,0 +1,6 @@
+<svg width="79" height="44" viewBox="0 0 79 44" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M45.3224 11.3193L54.6351 27.3044L63.9515 43.2856H45.3224H26.6934L36.006 27.3044L45.3224 11.3193Z" fill="#CB2026"/>
+<path d="M64.1569 38.7032H79.0003L69.6839 22.7181L60.3713 6.73692L52.9496 19.4733L59.1631 30.1388L64.1569 38.7032Z" fill="#CB2026"/>
+<path d="M31.9306 29.5575L27.9455 22.7181L18.6291 6.73692L9.31645 22.7181L0 38.7032H18.6291H26.5993L29.2151 34.2158L31.9306 29.5575Z" fill="#CB2026"/>
+<path d="M33.2951 27.2245L33.763 26.4228L40.4214 15.0011L31.78 0.174988L24.6575 12.3984L30.5258 22.4674L33.2951 27.2245Z" fill="#CB2026"/>
+</svg>
diff --git a/app/assets/ico/linux.svg b/app/assets/ico/linux.svg
new file mode 100644
index 0000000..cf9c866
--- /dev/null
+++ b/app/assets/ico/linux.svg
@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="24px" height="24px" viewBox="0 0 24 24">
+<path style=" stroke:none;fill-rule:nonzero;fill:currentColor;fill-opacity:1;" d="M 21.613281 19.269531 C 20.910156 18.980469 20.609375 18.597656 20.636719 18.027344 C 20.667969 17.363281 20.289062 16.875 20.109375 16.679688 C 20.21875 16.265625 20.535156 14.835938 20.109375 13.589844 C 19.652344 12.257812 18.257812 10.222656 16.820312 8.222656 C 16.230469 7.402344 16.203125 6.507812 16.171875 5.476562 C 16.140625 4.488281 16.105469 3.371094 15.554688 2.128906 C 14.957031 0.777344 13.757812 0 12.265625 0 C 11.375 0 10.460938 0.277344 9.761719 0.761719 C 8.324219 1.753906 8.511719 3.917969 8.640625 5.347656 C 8.65625 5.542969 8.671875 5.730469 8.679688 5.886719 C 8.765625 7.289062 8.6875 8.027344 8.589844 8.253906 C 8.523438 8.398438 8.207031 8.816406 7.871094 9.261719 C 7.523438 9.71875 7.132812 10.234375 6.808594 10.71875 C 6.421875 11.300781 6.113281 12.1875 5.8125 13.046875 C 5.59375 13.675781 5.382812 14.269531 5.183594 14.625 C 4.796875 15.308594 4.894531 15.945312 4.972656 16.238281 C 4.828125 16.339844 4.617188 16.539062 4.441406 16.914062 C 4.226562 17.367188 3.792969 17.613281 2.890625 17.789062 C 2.476562 17.871094 2.191406 18.046875 2.042969 18.304688 C 1.824219 18.683594 1.941406 19.15625 2.050781 19.480469 C 2.210938 19.957031 2.109375 20.257812 1.929688 20.804688 C 1.886719 20.929688 1.839844 21.074219 1.792969 21.230469 C 1.71875 21.480469 1.746094 21.707031 1.875 21.902344 C 2.214844 22.425781 3.210938 22.609375 4.234375 22.730469 C 4.84375 22.800781 5.511719 23.046875 6.160156 23.28125 C 6.792969 23.515625 7.449219 23.753906 8.046875 23.828125 C 8.136719 23.835938 8.226562 23.84375 8.3125 23.84375 C 9.210938 23.84375 9.617188 23.246094 9.746094 23 C 10.070312 22.933594 11.183594 22.722656 12.335938 22.695312 C 13.480469 22.664062 14.589844 22.890625 14.90625 22.960938 C 15.003906 23.148438 15.265625 23.582031 15.679688 23.804688 C 15.90625 23.929688 16.226562 24 16.550781 24 C 16.898438 24 17.558594 23.917969 18.082031 23.367188 C 18.605469 22.8125 19.910156 22.109375 20.859375 21.59375 C 21.074219 21.476562 21.273438 21.371094 21.445312 21.273438 C 21.980469 20.976562 22.273438 20.554688 22.246094 20.109375 C 22.226562 19.742188 21.980469 19.421875 21.613281 19.269531 Z M 9.773438 19.164062 C 9.707031 18.695312 9.101562 18.230469 8.402344 17.691406 C 7.832031 17.25 7.183594 16.75 7.007812 16.328125 C 6.636719 15.457031 6.929688 13.921875 7.433594 13.132812 C 7.6875 12.738281 7.890625 12.140625 8.089844 11.558594 C 8.300781 10.933594 8.523438 10.285156 8.769531 10.003906 C 9.160156 9.558594 9.523438 8.699219 9.585938 8.019531 C 9.953125 8.371094 10.519531 8.8125 11.046875 8.8125 C 11.125 8.8125 11.203125 8.804688 11.28125 8.78125 C 11.640625 8.679688 12.167969 8.375 12.679688 8.078125 C 13.117188 7.824219 13.660156 7.511719 13.867188 7.480469 C 14.214844 7.984375 16.253906 12.492188 16.460938 13.9375 C 16.625 15.082031 16.449219 16.027344 16.363281 16.398438 C 16.292969 16.390625 16.210938 16.382812 16.121094 16.382812 C 15.554688 16.382812 15.402344 16.691406 15.363281 16.875 C 15.265625 17.355469 15.253906 18.890625 15.253906 19.238281 C 15.046875 19.5 14.011719 20.726562 12.523438 20.945312 C 11.914062 21.035156 11.347656 21.078125 10.839844 21.078125 C 10.402344 21.078125 10.125 21.042969 10.007812 21.027344 L 9.261719 20.171875 C 9.554688 20.027344 9.851562 19.71875 9.773438 19.164062 Z M 10.722656 5.046875 C 10.699219 5.058594 10.675781 5.070312 10.652344 5.082031 C 10.652344 5.03125 10.644531 4.976562 10.636719 4.925781 C 10.554688 4.457031 10.242188 4.113281 9.894531 4.113281 C 9.871094 4.113281 9.84375 4.117188 9.816406 4.121094 C 9.609375 4.15625 9.445312 4.3125 9.359375 4.53125 C 9.4375 4.046875 9.710938 3.691406 10.035156 3.691406 C 10.417969 3.691406 10.738281 4.203125 10.738281 4.8125 C 10.738281 4.890625 10.734375 4.964844 10.722656 5.046875 Z M 13.6875 5.410156 C 13.722656 5.300781 13.742188 5.179688 13.742188 5.054688 C 13.742188 4.5 13.390625 4.070312 12.945312 4.070312 C 12.507812 4.070312 12.152344 4.511719 12.152344 5.054688 C 12.152344 5.089844 12.152344 5.128906 12.15625 5.164062 C 12.132812 5.15625 12.109375 5.148438 12.089844 5.140625 C 12.039062 4.988281 12.011719 4.828125 12.011719 4.664062 C 12.011719 4.003906 12.433594 3.46875 12.953125 3.46875 C 13.472656 3.46875 13.894531 4.003906 13.894531 4.664062 C 13.894531 4.941406 13.816406 5.203125 13.6875 5.410156 Z M 13.304688 6.695312 C 13.296875 6.726562 13.28125 6.742188 13.105469 6.835938 C 13.015625 6.878906 12.90625 6.9375 12.769531 7.023438 L 12.675781 7.078125 C 12.304688 7.304688 11.433594 7.832031 11.199219 7.863281 C 11.039062 7.882812 10.941406 7.820312 10.71875 7.667969 C 10.667969 7.636719 10.613281 7.597656 10.554688 7.5625 C 10.152344 7.296875 9.894531 7.007812 9.867188 6.894531 C 9.996094 6.792969 10.324219 6.539062 10.488281 6.390625 C 10.824219 6.074219 11.164062 5.863281 11.332031 5.863281 C 11.34375 5.863281 11.351562 5.867188 11.359375 5.867188 C 11.554688 5.902344 12.042969 6.097656 12.398438 6.238281 C 12.5625 6.304688 12.707031 6.359375 12.804688 6.398438 C 13.121094 6.503906 13.285156 6.644531 13.304688 6.695312 Z M 16.132812 21.359375 C 16.3125 20.558594 16.515625 19.46875 16.484375 18.828125 C 16.476562 18.679688 16.460938 18.523438 16.449219 18.367188 C 16.425781 18.082031 16.390625 17.652344 16.425781 17.527344 C 16.433594 17.523438 16.441406 17.519531 16.449219 17.519531 C 16.453125 17.886719 16.53125 18.617188 17.117188 18.875 C 17.292969 18.949219 17.492188 18.988281 17.710938 18.988281 C 18.296875 18.988281 18.949219 18.703125 19.214844 18.433594 C 19.375 18.277344 19.503906 18.085938 19.597656 17.933594 C 19.617188 17.992188 19.628906 18.070312 19.625 18.167969 C 19.589844 18.710938 19.851562 19.429688 20.351562 19.695312 L 20.425781 19.734375 C 20.605469 19.828125 21.078125 20.074219 21.085938 20.195312 C 21.085938 20.195312 21.082031 20.207031 21.054688 20.230469 C 20.9375 20.339844 20.519531 20.554688 20.117188 20.761719 C 19.398438 21.125 18.585938 21.542969 18.222656 21.925781 C 17.707031 22.464844 17.125 22.828125 16.773438 22.828125 C 16.734375 22.828125 16.695312 22.824219 16.660156 22.8125 C 16.277344 22.695312 15.964844 22.144531 16.132812 21.359375 Z M 3.140625 19.316406 C 3.101562 19.132812 3.070312 18.992188 3.105469 18.851562 C 3.128906 18.75 3.636719 18.636719 3.855469 18.589844 C 4.160156 18.523438 4.476562 18.457031 4.683594 18.332031 C 4.960938 18.160156 5.113281 17.847656 5.246094 17.574219 C 5.34375 17.375 5.445312 17.167969 5.5625 17.101562 C 5.570312 17.097656 5.578125 17.09375 5.597656 17.09375 C 5.820312 17.09375 6.289062 17.558594 6.558594 17.980469 C 6.625 18.085938 6.75 18.296875 6.898438 18.539062 C 7.335938 19.273438 7.933594 20.273438 8.246094 20.609375 C 8.527344 20.914062 8.984375 21.492188 8.871094 21.992188 C 8.789062 22.375 8.351562 22.691406 8.25 22.761719 C 8.210938 22.769531 8.164062 22.773438 8.109375 22.773438 C 7.511719 22.773438 6.328125 22.273438 5.691406 22.007812 L 5.597656 21.96875 C 5.242188 21.820312 4.660156 21.726562 4.101562 21.632812 C 3.652344 21.5625 3.042969 21.464844 2.941406 21.375 C 2.859375 21.28125 2.953125 20.980469 3.039062 20.71875 C 3.097656 20.527344 3.160156 20.332031 3.195312 20.125 C 3.242188 19.796875 3.1875 19.53125 3.140625 19.316406 Z M 3.140625 19.316406 "/>
+</svg>
diff --git a/app/assets/ico/lock-2.svg b/app/assets/ico/lock-2.svg
new file mode 100644
index 0000000..cfcaa8c
--- /dev/null
+++ b/app/assets/ico/lock-2.svg
@@ -0,0 +1,11 @@
+<svg width="76" height="75" viewBox="0 0 76 75" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0_1_2)">
+<path opacity="0.2" d="M75.5 37.5C75.5 16.7893 58.7107 0 38 0C17.2893 0 0.5 16.7893 0.5 37.5C0.5 58.2107 17.2893 75 38 75C58.7107 75 75.5 58.2107 75.5 37.5Z" fill="#E1DFDF" fill-opacity="0.08"/>
+<path d="M31.5353 36.1666V30.8333C31.5353 29.0652 32.2164 27.3695 33.4288 26.1192C34.6412 24.869 36.2855 24.1666 38 24.1666C39.7145 24.1666 41.3588 24.869 42.5712 26.1192C43.7835 27.3695 44.4646 29.0652 44.4646 30.8333V36.1666M28.9495 36.1666H47.0505C48.4786 36.1666 49.6364 37.3605 49.6364 38.8333V48.1666C49.6364 49.6394 48.4786 50.8333 47.0505 50.8333H28.9495C27.5214 50.8333 26.3636 49.6394 26.3636 48.1666V38.8333C26.3636 37.3605 27.5214 36.1666 28.9495 36.1666Z" stroke="#0086C9" stroke-width="2.6" stroke-linecap="round" stroke-linejoin="round"/>
+</g>
+<defs>
+<clipPath id="clip0_1_2">
+<rect width="76" height="75" fill="white"/>
+</clipPath>
+</defs>
+</svg>
diff --git a/app/assets/ico/lock.svg b/app/assets/ico/lock.svg
new file mode 100644
index 0000000..d28402e
--- /dev/null
+++ b/app/assets/ico/lock.svg
@@ -0,0 +1,4 @@
+<svg width="76" height="75" viewBox="0 0 76 75" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect opacity="0.2" x="0.5" width="75" height="75" rx="37.5" fill="#713B12"/>
+<path d="M31.5353 36.1666V30.8333C31.5353 29.0652 32.2164 27.3695 33.4288 26.1192C34.6412 24.869 36.2855 24.1666 38 24.1666C39.7145 24.1666 41.3588 24.869 42.5712 26.1192C43.7835 27.3695 44.4646 29.0652 44.4646 30.8333V36.1666M28.9495 36.1666H47.0505C48.4786 36.1666 49.6364 37.3605 49.6364 38.8333V48.1666C49.6364 49.6394 48.4786 50.8333 47.0505 50.8333H28.9495C27.5214 50.8333 26.3636 49.6394 26.3636 48.1666V38.8333C26.3636 37.3605 27.5214 36.1666 28.9495 36.1666Z" stroke="#FEC84B" stroke-width="2.6" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>
diff --git a/app/assets/ico/logomark.svg b/app/assets/ico/logomark.svg
new file mode 100644
index 0000000..140c1b4
--- /dev/null
+++ b/app/assets/ico/logomark.svg
@@ -0,0 +1,12 @@
+<svg width="38" height="47" viewBox="0 0 84 104" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0_282_116279)">
+<rect width="84" height="104" rx="1" fill="#2E2F33"/>
+<path d="M54.2295 74.5278H73.7517V94H54.2295V74.5278Z" fill="#F7F6F3"/>
+<path d="M10 11H40.4488C61.4576 11 73.8513 17.5661 73.8513 38.9807V39.7125C73.8513 61.1936 61.4842 67.6931 40.4754 67.6931H33.8295V93.7845H10V11ZM39.0517 49.3986C45.5579 49.3986 48.984 46.9837 48.984 39.7657V38.9341C48.984 31.7493 45.5579 29.2879 39.0517 29.2879H33.8361V49.3919H39.0517V49.3986Z" fill="#F7F6F3"/>
+</g>
+<defs>
+<clipPath id="clip0_282_116279">
+<rect width="84" height="104" fill="white"/>
+</clipPath>
+</defs>
+</svg>
diff --git a/app/assets/ico/manifest.json b/app/assets/ico/manifest.json
new file mode 100644
index 0000000..f70fd66
--- /dev/null
+++ b/app/assets/ico/manifest.json
@@ -0,0 +1,18 @@
+{
+  "name": "Portainer",
+  "icons": [
+    {
+      "src": "ico/android-chrome-192x192.png",
+      "sizes": "192x192",
+      "type": "image/png"
+    },
+    {
+      "src": "ico/android-chrome-256x256.png",
+      "sizes": "256x256",
+      "type": "image/png"
+    }
+  ],
+  "theme_color": "#ffffff",
+  "background_color": "#ffffff",
+  "display": "standalone"
+}
diff --git a/app/assets/ico/memory.svg b/app/assets/ico/memory.svg
new file mode 100644
index 0000000..18ec358
--- /dev/null
+++ b/app/assets/ico/memory.svg
@@ -0,0 +1 @@
+<svg width="auto" height="auto" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg"> <path d="M14.5 18.3V20.8799M17 11.0399V8.03992M5.5 18.3V20.8799M10 18.3V20.8799M10 18.3H15.2C16.8802 18.3 19.8583 18.3 20.5 17.973C21.0645 17.6854 21.5234 17.2265 21.811 16.662C22.054 16.1852 22.1164 15.4789 22.1325 14.5199M10 18.3H8.8C7.11984 18.3 4.27976 18.3 3.63803 17.973C3.07354 17.6854 2.6146 17.2265 2.32698 16.662C2.08404 16.1852 2.0216 15.4789 2.00555 14.5199M19 18.3V20.8799M12.12 11.0399V8.03992M7.08 11.0399V8.03992M2.00555 14.5199C2 14.1882 2 13.9318 2 13.5V8.8C2 7.11984 2 6.27976 2.32698 5.63803C2.6146 5.07354 3.07354 4.6146 3.63803 4.32698C4.27976 4 7.11984 4 8.8 4H15.2C16.8802 4 19.8583 4 20.5 4.32698C21.0645 4.6146 21.5234 5.07354 21.811 5.63803C22.138 6.27976 22.138 7.11984 22.138 8.8V13.5C22.138 13.9318 22.138 14.1882 22.1325 14.5199M2.00555 14.5199H22.1325" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/> </svg>
\ No newline at end of file
diff --git a/app/assets/ico/mstile-150x150.png b/app/assets/ico/mstile-150x150.png
new file mode 100644
index 0000000..f483745
Binary files /dev/null and b/app/assets/ico/mstile-150x150.png differ
diff --git a/app/assets/ico/oauth.svg b/app/assets/ico/oauth.svg
new file mode 100644
index 0000000..09faac7
--- /dev/null
+++ b/app/assets/ico/oauth.svg
@@ -0,0 +1,8 @@
+<svg width="auto" height="auto" viewBox="0 0 36 40" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <path
+    d="M22.9751 15.3177L20.4526 7.52911H3.77358L1.25103 15.3177C1.25103 15.3177 -1.72806 23.2041 5.23082 28.0533C11.5711 32.4721 12.1131 33.0091 12.1131 33.0091C12.1131 33.0091 12.655 32.471 18.9953 28.0533C25.9542 23.2041 22.9751 15.3177 22.9751 15.3177Z"
+    fill="#F4552A" />
+  <path
+    d="M12.1152 7.60529L14.803 15.283L22.9882 15.4493L16.4639 20.3594L18.8354 28.1393L12.1152 23.4966L5.39497 28.1393L7.76642 20.3594L1.24219 15.4493L9.42731 15.283L12.1152 7.60529Z"
+    fill="white" />
+</svg>
\ No newline at end of file
diff --git a/app/assets/ico/object-group.svg b/app/assets/ico/object-group.svg
new file mode 100644
index 0000000..7cdd808
--- /dev/null
+++ b/app/assets/ico/object-group.svg
@@ -0,0 +1 @@
+<svg width="auto" height="auto" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg"> <path d="M19 7V17M5 7V17M17 5L7 5M17 19H7M4.6 7H5.4C5.96005 7 6.24008 7 6.45399 6.89101C6.64215 6.79513 6.79513 6.64215 6.89101 6.45399C7 6.24008 7 5.96005 7 5.4V4.6C7 4.03995 7 3.75992 6.89101 3.54601C6.79513 3.35785 6.64215 3.20487 6.45399 3.10899C6.24008 3 5.96005 3 5.4 3H4.6C4.03995 3 3.75992 3 3.54601 3.10899C3.35785 3.20487 3.20487 3.35785 3.10899 3.54601C3 3.75992 3 4.03995 3 4.6V5.4C3 5.96005 3 6.24008 3.10899 6.45399C3.20487 6.64215 3.35785 6.79513 3.54601 6.89101C3.75992 7 4.03995 7 4.6 7ZM4.6 21H5.4C5.96005 21 6.24008 21 6.45399 20.891C6.64215 20.7951 6.79513 20.6422 6.89101 20.454C7 20.2401 7 19.9601 7 19.4V18.6C7 18.0399 7 17.7599 6.89101 17.546C6.79513 17.3578 6.64215 17.2049 6.45399 17.109C6.24008 17 5.96005 17 5.4 17H4.6C4.03995 17 3.75992 17 3.54601 17.109C3.35785 17.2049 3.20487 17.3578 3.10899 17.546C3 17.7599 3 18.0399 3 18.6V19.4C3 19.9601 3 20.2401 3.10899 20.454C3.20487 20.6422 3.35785 20.7951 3.54601 20.891C3.75992 21 4.03995 21 4.6 21ZM18.6 7H19.4C19.9601 7 20.2401 7 20.454 6.89101C20.6422 6.79513 20.7951 6.64215 20.891 6.45399C21 6.24008 21 5.96005 21 5.4V4.6C21 4.03995 21 3.75992 20.891 3.54601C20.7951 3.35785 20.6422 3.20487 20.454 3.10899C20.2401 3 19.9601 3 19.4 3H18.6C18.0399 3 17.7599 3 17.546 3.10899C17.3578 3.20487 17.2049 3.35785 17.109 3.54601C17 3.75992 17 4.03995 17 4.6V5.4C17 5.96005 17 6.24008 17.109 6.45399C17.2049 6.64215 17.3578 6.79513 17.546 6.89101C17.7599 7 18.0399 7 18.6 7ZM18.6 21H19.4C19.9601 21 20.2401 21 20.454 20.891C20.6422 20.7951 20.7951 20.6422 20.891 20.454C21 20.2401 21 19.9601 21 19.4V18.6C21 18.0399 21 17.7599 20.891 17.546C20.7951 17.3578 20.6422 17.2049 20.454 17.109C20.2401 17 19.9601 17 19.4 17H18.6C18.0399 17 17.7599 17 17.546 17.109C17.3578 17.2049 17.2049 17.3578 17.109 17.546C17 17.7599 17 18.0399 17 18.6V19.4C17 19.9601 17 20.2401 17.109 20.454C17.2049 20.6422 17.3578 20.7951 17.546 20.891C17.7599 21 18.0399 21 18.6 21Z" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/> </svg>
\ No newline at end of file
diff --git a/app/assets/ico/placeholder.svg b/app/assets/ico/placeholder.svg
new file mode 100644
index 0000000..e71f462
--- /dev/null
+++ b/app/assets/ico/placeholder.svg
@@ -0,0 +1,5 @@
+<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <path d="M23.4187 11.6494C23.3461 11.5285 23.2495 11.4559 23.1286 11.4319L20.7593 10.8275C20.4934 10.7549 20.2273 10.9242 20.179 11.1903L19.647 13.342L17.5924 12.8341L17.4958 12.8098C17.3748 12.7855 17.2299 12.8098 17.133 12.8581C17.0121 12.9307 16.9395 13.0273 16.9155 13.1483L16.3835 15.3L14.2317 14.768C13.9659 14.6954 13.6998 14.8646 13.6514 15.1308L13.0714 17.2582L10.9197 16.7262C10.7987 16.7019 10.6538 16.7262 10.5569 16.7745C10.436 16.8471 10.3634 16.9438 10.3393 17.0647L10.291 17.2582L9.73501 19.5306C9.66241 19.7965 9.83165 20.0626 10.0978 20.1109L19.4779 22.4559C19.5988 22.4802 19.6954 22.5042 19.8163 22.5042C20.4207 22.5042 20.9766 22.0932 21.1219 21.4888L23.4911 12.0119C23.5152 11.8909 23.4909 11.7703 23.4185 11.6494L23.4187 11.6494ZM14.4496 15.8074L16.5528 16.3394C16.6737 16.3877 16.843 16.3637 16.9639 16.2911C17.0848 16.2185 17.1814 16.0735 17.1814 15.9283L17.5925 14.2603L18.9464 16.0493L18.2694 18.757L13.9662 17.669L14.4496 15.8074ZM20.1791 21.2469C20.1307 21.4645 19.9132 21.5854 19.7197 21.5371L10.799 19.313L11.1375 17.9835L18.5353 19.845C18.5595 19.845 18.6079 19.8693 18.6319 19.8693H18.6562C18.6805 19.8693 18.7045 19.8693 18.7528 19.845H18.7771C18.8254 19.845 18.8497 19.8207 18.8737 19.7967C18.9947 19.7241 19.0673 19.6275 19.0913 19.5065L19.9375 16.0978C19.9618 15.9529 19.9375 15.8077 19.8649 15.6868L18.6802 14.1396L19.8405 14.4298C20.1064 14.5024 20.3725 14.3331 20.4208 14.067L20.9528 11.9153L22.4033 12.278L20.1791 21.2469Z" fill="currentColor" stroke="currentColor" stroke-width="0.3" />
+  <path d="M10.2912 15.7109C10.5571 15.7109 10.7746 15.4933 10.7746 15.2275V13.0034H12.9747C13.2405 13.0034 13.4581 12.7859 13.4581 12.52V10.32H15.6581C15.924 10.32 16.1415 10.1024 16.1415 9.83654V7.6125H18.124C18.3899 7.6125 18.6074 7.39495 18.6074 7.12908V2.84963C18.6074 2.1001 18.0031 1.49573 17.2535 1.49573H1.85391C1.10438 1.49573 0.5 2.10006 0.5 2.84963V16.9201C0.5 17.6696 1.10434 18.274 1.85391 18.274H7.58359C7.84946 18.274 8.06701 18.0564 8.06701 17.7906V15.7358L10.2912 15.7109ZM12.4912 12.0363H10.2912C10.0254 12.0363 9.8078 12.2539 9.8078 12.5197V14.7438H3.83656V13.269L5.72214 11.8425L7.36615 12.7853C7.55967 12.8819 7.77722 12.8579 7.94646 12.7127L11.5487 9.23141L12.4915 9.98094L12.4912 12.0363ZM7.10004 17.2823H1.85379C1.63624 17.2823 1.467 17.1131 1.467 16.8955V2.84993C1.467 2.63239 1.63623 2.46315 1.85379 2.46315H17.2534C17.471 2.46315 17.6402 2.63238 17.6402 2.84993V6.6697H15.682C15.4161 6.6697 15.1986 6.88725 15.1986 7.15312V9.37717H13.2646L11.8381 8.24086C11.6446 8.09592 11.3788 8.09592 11.2095 8.26515L7.53498 11.7707L5.93926 10.852C5.77003 10.7553 5.55247 10.7553 5.40727 10.8762L3.06228 12.6409C2.94136 12.7376 2.86876 12.8828 2.86876 13.0277V15.252C2.86876 15.373 2.91708 15.4939 3.01371 15.5905C3.11034 15.6871 3.23126 15.7354 3.35218 15.7354H7.09937L7.10004 17.2823Z" fill="currentColor" stroke="currentColor" stroke-width="0.3" />
+  <path d="M5.40775 8.82098C6.61644 8.82098 7.58351 7.82983 7.58351 6.64523C7.58351 5.43655 6.59236 4.46948 5.40775 4.46948C4.19907 4.46948 3.232 5.46063 3.232 6.64523C3.20772 7.8299 4.19907 8.82098 5.40775 8.82098ZM5.40775 5.41227C6.08471 5.41227 6.61644 5.96829 6.61644 6.62095C6.61644 7.29791 6.06042 7.82964 5.40775 7.82964C4.7308 7.82964 4.19907 7.27362 4.19907 6.62095C4.17478 5.94426 4.7308 5.41227 5.40775 5.41227Z" fill="currentColor" stroke="currentColor" stroke-width="0.3" />
+</svg>
diff --git a/app/assets/ico/plug.svg b/app/assets/ico/plug.svg
new file mode 100644
index 0000000..a43d6ff
--- /dev/null
+++ b/app/assets/ico/plug.svg
@@ -0,0 +1,3 @@
+<svg width="100" height="100" viewBox="0 0 100 100" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M50.0004 74.401C68.1158 74.401 82.8013 59.7156 82.8013 41.6001L82.8013 24.5843L66.3959 24.5843M50.0004 74.401C31.885 74.401 17.1995 59.7156 17.1995 41.6001L17.1995 24.5843L66.3959 24.5843M50.0004 74.401C50.0004 84.5503 50.0004 95.7898 66.3959 95.7898L71.7592 95.7898M66.3959 24.5843L66.3959 4.21012M33.572 24.5843L33.572 4.21012" stroke="currentColor" stroke-width="8.2" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>
diff --git a/app/assets/ico/podman-edge-environment.svg b/app/assets/ico/podman-edge-environment.svg
new file mode 100644
index 0000000..1157684
--- /dev/null
+++ b/app/assets/ico/podman-edge-environment.svg
@@ -0,0 +1,16 @@
+<svg width="60" height="60" viewBox="0 0 60 60" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0_14_99)">
+<path d="M10.0931 24.7167C10.0916 24.6319 10.0898 24.5473 10.0898 24.4624C10.0898 16.3646 16.6544 9.80001 24.7522 9.80001C31.7306 9.80001 37.5698 14.6753 39.051 21.2057C40.4323 20.4325 42.0233 19.9898 43.7187 19.9898C49.0089 19.9898 53.2975 24.2783 53.2975 29.5686C53.2975 29.7848 53.2878 29.9987 53.2736 30.2113C57.201 31.6693 60 35.4496 60 39.8843C60 45.5814 55.3816 50.2 49.6843 50.2H12.8946C5.77316 50.1998 0 44.4267 0 37.3052C0 31.1458 4.31877 25.9961 10.0931 24.7167Z" fill="#0077BB"/>
+<path d="M21.5688 35.8125C21.1986 35.813 20.8437 35.9682 20.5821 36.2442C20.3205 36.5201 20.1735 36.8942 20.1735 37.2842C20.1735 37.6743 20.3205 38.0483 20.5821 38.3243C20.8437 38.6002 21.1986 38.7555 21.5688 38.756C21.9391 38.7556 22.2941 38.6004 22.5558 38.3244C22.8175 38.0485 22.9645 37.6743 22.9645 37.2842C22.9645 36.8942 22.8176 36.5201 22.5559 36.2442C22.2943 35.9682 21.939 35.813 21.5688 35.8125ZM35.6846 35.8125C35.3144 35.813 34.9595 35.9682 34.6979 36.2442C34.4363 36.5201 34.2893 36.8942 34.2893 37.2842C34.2893 37.6743 34.4363 38.0483 34.6979 38.3243C34.9595 38.6002 35.3144 38.7555 35.6846 38.756C35.8683 38.7563 36.0502 38.7185 36.22 38.6447C36.3898 38.5709 36.5441 38.4625 36.6741 38.3258C36.804 38.1891 36.9072 38.0268 36.9775 37.8481C37.0479 37.6693 37.0841 37.4777 37.0841 37.2842C37.0841 37.0907 37.0479 36.8991 36.9775 36.7204C36.9072 36.5417 36.804 36.3793 36.6741 36.2426C36.5441 36.1059 36.3898 35.9976 36.22 35.9238C36.0502 35.85 35.8683 35.8121 35.6846 35.8125Z" fill="white" stroke="white" stroke-width="0.67"/>
+<path d="M23.9208 36.196L18.7289 37.588L18.8777 38.1444L24.0703 36.7524L23.9208 36.196ZM33.7463 36.196L33.5967 36.7524L38.7881 38.1444L38.9377 37.588L33.7463 36.196ZM24.4404 37.0348L19.219 40.0506L19.5072 40.549L24.7279 37.5336L24.4404 37.0348ZM33.2295 37.0348L32.9413 37.5336L38.1623 40.549L38.4506 40.0506L33.2295 37.0348ZM24.8223 38.0354L21.2267 41.636C21.4715 41.6669 21.7046 41.7057 21.9273 41.7492L25.2296 38.4423L24.8223 38.0354ZM32.8473 38.0354L32.4404 38.4423L36.9559 42.9648C37.2115 42.9481 37.4726 42.9368 37.7371 42.9314L32.8473 38.0354ZM24.9969 39.3463L23.3438 42.2121C23.5155 42.2969 23.6839 42.39 23.8472 42.4928L25.4961 39.6337L24.9969 39.3463ZM32.6731 39.3463L32.1739 39.6337L34.3825 43.4636C34.4235 43.4473 34.4631 43.4281 34.5049 43.4131C34.6344 43.3617 34.7827 43.3157 34.9381 43.2727L32.6731 39.3463Z" fill="white" stroke="white" stroke-width="0.67"/>
+<path d="M28.7754 31.5535C26.0764 31.5535 23.8585 33.6515 23.8585 36.2541C23.8585 38.8567 26.0764 40.9546 28.7754 40.9546C31.475 40.9546 33.6928 38.8567 33.6928 36.2541C33.6928 33.6515 31.4741 31.5535 28.7754 31.5535ZM28.7754 32.4178C31.0305 32.4178 32.8289 34.1423 32.8289 36.2541C32.8289 38.3662 31.0305 40.0899 28.7754 40.0899C26.5208 40.0899 24.722 38.3662 24.722 36.2541C24.722 34.1423 26.5208 32.4178 28.7754 32.4178Z" fill="white" stroke="white" stroke-width="0.67"/>
+<path d="M28.1864 21.375C26.1052 21.375 24.0791 21.6023 22.7736 22.1199C19.3133 23.3911 16.7045 26.8091 15.9287 30.9244C15.2386 34.1891 15.0556 36.95 14.6884 39.4499C14.5318 40.5185 14.3383 41.5365 14.0635 42.5316C13.3495 45.3148 12.4583 47.0972 12.4583 47.0972H13.3495C13.3495 47.0972 13.5653 47.4728 15.1275 41.8511C15.2966 41.0987 15.4359 40.3399 15.5452 39.5765C15.9191 37.0273 16.0946 34.299 16.7709 31.1015L16.7751 31.0973V31.0907C17.5003 27.2306 19.9525 24.0699 23.0773 22.9261L23.0815 22.9228H23.0877C24.176 22.49 26.1687 22.2393 28.1864 22.2397C30.2012 22.2397 32.2653 22.4833 33.5378 22.9261C36.6626 24.0695 39.1148 27.2302 39.8392 31.0902L39.8433 31.0986V31.1015C40.5193 34.299 40.6989 37.0273 41.0728 39.5765C41.2411 40.7244 41.4322 41.8447 41.7746 42.9331C42.8044 46.206 43.6505 47.0972 43.6505 47.0972H44.5417C44.5417 47.0972 43.3372 44.962 42.8044 43.363C42.385 42.1043 42.1276 40.8176 41.9267 39.4499C41.5603 36.9517 41.3786 34.1929 40.6897 30.9319C39.9152 26.8095 37.3047 23.3815 33.8377 22.1123H33.8302C32.3831 21.6069 30.271 21.3754 28.1864 21.375ZM21.682 26.5814C21.2382 26.579 20.7999 26.6789 20.4009 26.8734C20.002 27.0678 19.6533 27.3516 19.3819 27.7027L19.1174 28.0427L19.805 28.5708L20.0686 28.227C20.2491 27.9978 20.4762 27.8097 20.7349 27.6751C20.9936 27.5404 21.278 27.4624 21.5692 27.4462C22.1123 27.4232 22.6763 27.6417 23.0623 28.0248L23.3697 28.3322L23.9809 27.7173L23.6734 27.4136C23.1419 26.889 22.4288 26.5901 21.682 26.5814ZM35.6232 26.5814C34.8763 26.5904 34.162 26.8887 33.6305 27.4136L33.3231 27.7173L33.9309 28.3322L34.2388 28.0248C34.4359 27.8329 34.6698 27.6827 34.9263 27.5833C35.1829 27.4838 35.4568 27.4372 35.7318 27.4462C36.3062 27.4713 36.8848 27.7708 37.2357 28.2274L37.5002 28.5708L38.1836 28.0427L37.9192 27.7027C37.6485 27.3518 37.3006 27.068 36.9023 26.8736C36.5041 26.6791 36.0664 26.5791 35.6232 26.5814ZM28.7754 33.5892C28.4588 33.5892 28.1993 33.6866 27.9838 33.7593C27.7678 33.8324 27.5953 33.8821 27.4624 33.8821C27.2256 33.8821 26.9929 34.012 26.8663 34.1645C26.7401 34.3165 26.6804 34.4736 26.6345 34.6232C26.5425 34.921 26.4978 35.2239 26.4573 35.3292C26.3646 35.569 26.4531 35.7599 26.5267 35.8852C26.5998 36.0105 26.6892 36.1091 26.7899 36.211C26.992 36.4141 27.2477 36.6175 27.5059 36.8072C27.7703 37.001 28.0356 37.1773 28.2328 37.306L28.2223 37.4798C28.125 37.5591 27.8881 37.7693 27.4954 37.9021C27.2632 37.9806 27.0292 38.0086 26.8262 37.9568C26.6537 37.9125 26.482 37.7605 26.3057 37.5303C26.317 37.4392 26.3211 37.4021 26.3416 37.2521C26.378 36.9897 26.4306 36.6727 26.4544 36.5787L25.6151 36.369C25.565 36.5695 25.5224 36.8619 25.4848 37.133C25.4472 37.4037 25.4196 37.6356 25.4196 37.6356L25.4017 37.7901L25.4848 37.9201C25.7893 38.3988 26.1954 38.6891 26.6131 38.7957C27.0309 38.9026 27.4361 38.8379 27.7745 38.7238C28.2131 38.5747 28.5707 38.3353 28.7679 38.1849C28.9655 38.3353 29.321 38.5755 29.7584 38.7238C30.0968 38.8383 30.4978 38.9026 30.9156 38.7957C31.3333 38.6887 31.7398 38.3988 32.0439 37.9201L32.1275 37.7906L32.1091 37.6356C32.1091 37.6356 32.0815 37.4037 32.0439 37.133C32.0063 36.8615 31.9629 36.5695 31.9136 36.369L31.0747 36.5787C31.0981 36.6727 31.1508 36.9897 31.1875 37.2521C31.2076 37.4 31.2126 37.4359 31.223 37.527C31.0459 37.7592 30.8763 37.9125 30.7025 37.9572C30.4995 38.0086 30.266 37.9806 30.0337 37.9021C29.641 37.7693 29.4037 37.5591 29.3068 37.4798L29.2993 37.3172C29.4994 37.1877 29.7705 37.0081 30.0441 36.8076C30.3023 36.6175 30.558 36.4137 30.7606 36.2102C30.8608 36.1087 30.9511 36.0101 31.0238 35.8852C31.0977 35.7599 31.1854 35.569 31.0927 35.3287C31.0522 35.2243 31.0041 34.921 30.9122 34.6227C30.8663 34.474 30.8111 34.3161 30.6846 34.1636C30.558 34.0116 30.3253 33.8821 30.088 33.8821C29.9556 33.8821 29.783 33.8319 29.5675 33.7593C29.3515 33.6866 29.0925 33.5892 28.7754 33.5892ZM28.7754 34.4536C28.9028 34.4536 29.072 34.5029 29.2893 34.576C29.4889 34.6436 29.74 34.718 30.0262 34.7318C30.0358 34.7464 30.0617 34.7944 30.088 34.8801C30.1344 35.0305 30.1816 35.2602 30.2468 35.4837C30.2259 35.5121 30.2008 35.5477 30.1461 35.6028C30.0032 35.7465 29.7701 35.9332 29.5307 36.1087C29.1631 36.379 28.9333 36.5198 28.7754 36.6188C28.6188 36.5202 28.3844 36.3806 28.0155 36.1091C27.7762 35.9337 27.5477 35.7465 27.4048 35.6028C27.3496 35.5477 27.3254 35.5121 27.3045 35.4837C27.3689 35.2602 27.4165 35.0309 27.4624 34.8801C27.4769 34.8283 27.4978 34.7784 27.5247 34.7318C27.8104 34.7184 28.0581 34.6436 28.2583 34.576C28.4746 34.5029 28.6484 34.4536 28.7754 34.4536Z" fill="white" stroke="white" stroke-width="0.67"/>
+<path d="M21.659 29.959C21.3172 29.9591 20.9788 30.0282 20.6643 30.1621C20.3498 30.2961 20.0655 30.4921 19.8284 30.7385C19.5309 31.0432 19.311 31.415 19.1872 31.8225C19.0964 32.1197 19.0583 32.4305 19.0744 32.7408C19.0946 33.1475 19.2076 33.5443 19.4046 33.9007C19.6016 34.2571 19.8775 34.5638 20.2111 34.7974C20.3844 34.9173 20.5717 35.0156 20.7688 35.0902C21.3843 35.3226 22.0661 35.3061 22.6696 35.0443C22.9014 34.9439 23.1169 34.8095 23.3092 34.6457C23.5349 34.4554 23.7269 34.2285 23.8773 33.9744C24.1939 33.4423 24.3158 32.8168 24.2224 32.2048C24.1706 31.8629 24.0533 31.5343 23.8769 31.2369C23.6825 30.9107 23.4209 30.6297 23.1095 30.4126C22.936 30.2928 22.7486 30.1946 22.5514 30.1202C22.2663 30.0132 21.9635 29.9585 21.659 29.959ZM35.6412 29.959C35.337 29.9596 35.0354 30.0146 34.7505 30.1215C34.5139 30.2102 34.2919 30.3339 34.0918 30.4882C33.858 30.6673 33.656 30.8846 33.4944 31.1308C33.1041 31.7212 32.9641 32.4424 33.105 33.136C33.2066 33.6401 33.4515 34.1042 33.8102 34.4728C33.9862 34.653 34.1871 34.8072 34.4067 34.9306C34.6296 35.0546 34.8696 35.1448 35.119 35.198C35.3777 35.2529 35.6435 35.2666 35.9065 35.2385C36.4169 35.1852 36.8992 34.9781 37.2892 34.6445C37.547 34.4264 37.7606 34.1609 37.9184 33.8624C38.1672 33.3948 38.2712 32.8637 38.2171 32.3368C38.1779 31.9487 38.0548 31.5738 37.8561 31.2381C37.6403 30.8757 37.3416 30.5697 36.9847 30.345C36.7689 30.2107 36.5346 30.1091 36.2891 30.0433C36.0779 29.9872 35.8598 29.9588 35.6412 29.959ZM21.659 30.8195C21.7471 30.8198 21.8359 30.8265 21.9231 30.8396C22.1201 30.87 22.3101 30.9353 22.4841 31.0326C22.6315 31.1143 22.7661 31.2174 22.8835 31.3384C23.0429 31.5017 23.1692 31.6943 23.2553 31.9057C23.3347 32.0987 23.3801 32.3041 23.3894 32.5127C23.3993 32.7249 23.3736 32.9373 23.3133 33.141C23.2469 33.3613 23.139 33.5669 22.9954 33.7467C22.8541 33.9221 22.6806 34.0689 22.4841 34.1791C22.1531 34.3624 21.7704 34.43 21.3967 34.3713C20.9737 34.3055 20.5914 34.082 20.3264 33.7459C20.1823 33.5664 20.0745 33.3607 20.0089 33.1401C19.9567 32.9667 19.9305 32.7865 19.9312 32.6054C19.9316 32.4244 19.9579 32.2443 20.0093 32.0707C20.0757 31.8506 20.1835 31.6451 20.3268 31.4654C20.4676 31.2902 20.6406 31.1436 20.8365 31.0334C21.0619 30.9081 21.3129 30.8358 21.5705 30.822C21.5997 30.8204 21.6294 30.8195 21.659 30.8195ZM35.6412 30.8195C35.8155 30.8197 35.9888 30.8466 36.155 30.8993C36.3698 30.9676 36.5686 31.0783 36.7399 31.2247C36.9129 31.371 37.056 31.5495 37.161 31.7503C37.2711 31.9588 37.3391 32.1869 37.3611 32.4216C37.3959 32.7803 37.3263 33.1414 37.1606 33.4614C37.0549 33.6616 36.9121 33.84 36.7399 33.9869C36.6115 34.0957 36.468 34.1852 36.3138 34.2526C36.1017 34.3449 35.8729 34.3925 35.6416 34.3925C35.4103 34.3925 35.1815 34.3449 34.9694 34.2526C34.7629 34.1634 34.5762 34.034 34.4201 33.872C34.261 33.7087 34.135 33.516 34.0491 33.3047C33.9699 33.1118 33.9247 32.9065 33.9155 32.6982C33.9081 32.5456 33.9192 32.3927 33.9485 32.2428C33.9937 32.0149 34.082 31.7976 34.2087 31.6028C34.3325 31.4145 34.491 31.2514 34.6758 31.1224C34.8383 31.0099 35.0191 30.9264 35.2101 30.8755C35.3508 30.8383 35.4957 30.8195 35.6412 30.8195Z" fill="white" stroke="white" stroke-width="0.67"/>
+<path d="M20.9401 30.8772C20.6585 30.8769 20.3883 30.993 20.1889 31.1998C19.9896 31.4066 19.8773 31.6872 19.8769 31.98C19.8766 32.1254 19.9039 32.2693 19.9572 32.4037C20.0105 32.538 20.0887 32.6601 20.1875 32.763C20.2863 32.8658 20.4036 32.9474 20.5327 33.003C20.6619 33.0586 20.8003 33.0872 20.9401 33.0871C21.0799 33.0872 21.2183 33.0586 21.3474 33.003C21.4766 32.9474 21.5939 32.8658 21.6927 32.763C21.7914 32.6601 21.8697 32.538 21.923 32.4037C21.9763 32.2693 22.0036 32.1254 22.0033 31.98C22.0028 31.6872 21.8906 31.4066 21.6913 31.1998C21.4919 30.993 21.2217 30.8769 20.9401 30.8772ZM34.9151 30.8772C34.6335 30.8769 34.3633 30.993 34.164 31.1998C33.9646 31.4066 33.8524 31.6872 33.852 31.98C33.8516 32.1254 33.8789 32.2693 33.9322 32.4037C33.9855 32.538 34.0638 32.6601 34.1626 32.763C34.2613 32.8658 34.3786 32.9474 34.5078 33.003C34.6369 33.0586 34.7754 33.0872 34.9151 33.0871C35.0549 33.0871 35.1932 33.0584 35.3222 33.0028C35.4513 32.9471 35.5685 32.8655 35.6672 32.7627C35.7659 32.6598 35.8441 32.5378 35.8973 32.4035C35.9506 32.2692 35.9778 32.1253 35.9775 31.98C35.9771 31.6874 35.8649 31.4069 35.6658 31.2001C35.4666 30.9933 35.1966 30.8772 34.9151 30.8772Z" fill="white" stroke="white" stroke-width="0.67"/>
+</g>
+<defs>
+<clipPath id="clip0_14_99">
+<rect width="60" height="60" fill="white"/>
+</clipPath>
+</defs>
+</svg>
diff --git a/app/assets/ico/restore-window.svg b/app/assets/ico/restore-window.svg
new file mode 100644
index 0000000..55e7379
--- /dev/null
+++ b/app/assets/ico/restore-window.svg
@@ -0,0 +1 @@
+<svg width="auto" height="auto" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg"> <path d="M10.5 2.0028C9.82495 2.01194 9.4197 2.05103 9.09202 2.21799C8.7157 2.40973 8.40973 2.71569 8.21799 3.09202C8.05103 3.4197 8.01194 3.82495 8.0028 4.5M19.5 2.0028C20.1751 2.01194 20.5803 2.05103 20.908 2.21799C21.2843 2.40973 21.5903 2.71569 21.782 3.09202C21.949 3.4197 21.9881 3.82494 21.9972 4.49999M21.9972 13.5C21.9881 14.175 21.949 14.5803 21.782 14.908C21.5903 15.2843 21.2843 15.5903 20.908 15.782C20.5803 15.949 20.1751 15.9881 19.5 15.9972M22 7.99999V9.99999M14.0001 2H16M5.2 22H12.8C13.9201 22 14.4802 22 14.908 21.782C15.2843 21.5903 15.5903 21.2843 15.782 20.908C16 20.4802 16 19.9201 16 18.8V11.2C16 10.0799 16 9.51984 15.782 9.09202C15.5903 8.7157 15.2843 8.40973 14.908 8.21799C14.4802 8 13.9201 8 12.8 8H5.2C4.0799 8 3.51984 8 3.09202 8.21799C2.71569 8.40973 2.40973 8.7157 2.21799 9.09202C2 9.51984 2 10.0799 2 11.2V18.8C2 19.9201 2 20.4802 2.21799 20.908C2.40973 21.2843 2.71569 21.5903 3.09202 21.782C3.51984 22 4.0799 22 5.2 22Z" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/> </svg>
\ No newline at end of file
diff --git a/app/assets/ico/route.svg b/app/assets/ico/route.svg
new file mode 100644
index 0000000..ed08380
--- /dev/null
+++ b/app/assets/ico/route.svg
@@ -0,0 +1 @@
+<svg width="auto" height="auto" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg"> <path d="M11.5 5H11.9344C14.9816 5 16.5053 5 17.0836 5.54729C17.5836 6.02037 17.8051 6.71728 17.6702 7.39221C17.514 8.17302 16.2701 9.05285 13.7823 10.8125L9.71772 13.6875C7.2299 15.4471 5.98599 16.327 5.82984 17.1078C5.69486 17.7827 5.91642 18.4796 6.41636 18.9527C6.99474 19.5 8.51836 19.5 11.5656 19.5H12.5M8 5C8 6.65685 6.65685 8 5 8C3.34315 8 2 6.65685 2 5C2 3.34315 3.34315 2 5 2C6.65685 2 8 3.34315 8 5ZM22 19C22 20.6569 20.6569 22 19 22C17.3431 22 16 20.6569 16 19C16 17.3431 17.3431 16 19 16C20.6569 16 22 17.3431 22 19Z" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/> </svg>
\ No newline at end of file
diff --git a/app/assets/ico/safari-pinned-tab.svg b/app/assets/ico/safari-pinned-tab.svg
new file mode 100644
index 0000000..d0509a5
--- /dev/null
+++ b/app/assets/ico/safari-pinned-tab.svg
@@ -0,0 +1,6 @@
+<svg viewBox="0 0 104 104" xmlns="http://www.w3.org/2000/svg">
+  <g transform="translate(10, 0)">
+    <path d="M54.2295 74.5278H73.7517V94H54.2295V74.5278Z" fill="#000000"/>
+    <path d="M10 11H40.4488C61.4576 11 73.8513 17.5661 73.8513 38.9807V39.7125C73.8513 61.1936 61.4842 67.6931 40.4754 67.6931H33.8295V93.7845H10V11ZM39.0517 49.3986C45.5579 49.3986 48.984 46.9837 48.984 39.7657V38.9341C48.984 31.7493 45.5579 29.2879 39.0517 29.2879H33.8361V49.3919H39.0517V49.3986Z" fill="#000000"/>
+  </g>
+</svg>
\ No newline at end of file
diff --git a/app/assets/ico/sort.svg b/app/assets/ico/sort.svg
new file mode 100644
index 0000000..337094b
--- /dev/null
+++ b/app/assets/ico/sort.svg
@@ -0,0 +1 @@
+<svg width="auto" height="auto" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg"> <path d="M17 4V20M17 20L13 16M17 20L21 16M7 20V4M7 4L3 8M7 4L11 8" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/> </svg>
\ No newline at end of file
diff --git a/app/assets/ico/subscription.svg b/app/assets/ico/subscription.svg
new file mode 100644
index 0000000..0e8c96c
--- /dev/null
+++ b/app/assets/ico/subscription.svg
@@ -0,0 +1,3 @@
+<svg width="22" height="20" viewBox="0 0 22 20" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <path d="M20.8641 8.08333H1.69743M10.3224 16.7083L17.7974 16.7083C18.8709 16.7083 19.4076 16.7083 19.8176 16.4994C20.1782 16.3157 20.4714 16.0225 20.6552 15.6618C20.8641 15.2518 20.8641 14.7151 20.8641 13.6417V6.35833C20.8641 5.2849 20.8641 4.74818 20.6552 4.33819C20.4714 3.97754 20.1782 3.68433 19.8176 3.50057C19.4076 3.29167 18.8709 3.29167 17.7974 3.29167H16.0724M10.3224 16.7083L12.2391 18.625M10.3224 16.7083L12.2391 14.7917M6.48909 16.7083H4.76409C3.69066 16.7083 3.15394 16.7083 2.74394 16.4994C2.3833 16.3157 2.09009 16.0225 1.90633 15.6618C1.69743 15.2518 1.69743 14.7151 1.69743 13.6417V6.35833C1.69743 5.2849 1.69743 4.74818 1.90633 4.33818C2.09009 3.97754 2.3833 3.68433 2.74394 3.50057C3.15394 3.29167 3.69066 3.29167 4.76409 3.29167H12.2391M12.2391 3.29167L10.3224 5.20833M12.2391 3.29167L10.3224 1.375" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" />
+</svg>
diff --git a/app/assets/ico/user-lock.svg b/app/assets/ico/user-lock.svg
new file mode 100644
index 0000000..afc79bf
--- /dev/null
+++ b/app/assets/ico/user-lock.svg
@@ -0,0 +1,5 @@
+<svg width="100" height="100" viewBox="0 0 100 100" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M70.8333 87.5V79.1667C70.8333 74.7464 69.0774 70.5072 65.9518 67.3816C62.8262 64.256 58.5869 62.5 54.1667 62.5H20.8333C16.413 62.5 12.1738 64.256 9.04821 67.3816C5.9226 70.5072 4.16666 74.7464 4.16666 79.1667V87.5" stroke="currentColor" stroke-width="8.2" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M37.5 45.8333C46.7048 45.8333 54.1667 38.3714 54.1667 29.1667C54.1667 19.9619 46.7048 12.5 37.5 12.5C28.2953 12.5 20.8333 19.9619 20.8333 29.1667C20.8333 38.3714 28.2953 45.8333 37.5 45.8333Z" stroke="currentColor" stroke-width="8.2" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M88.5417 35.4166V28.1249C88.5417 24.0978 85.2771 20.8333 81.25 20.8333C77.2229 20.8333 73.9583 24.0978 73.9583 28.1249V35.4166M73.3333 52.0833H89.1667C91.5002 52.0833 92.667 52.0832 93.5583 51.6291C94.3423 51.2296 94.9797 50.5922 95.3792 49.8082C95.8333 48.9169 95.8333 47.7501 95.8333 45.4166V42.0833C95.8333 39.7497 95.8333 38.5829 95.3792 37.6916C94.9797 36.9076 94.3423 36.2702 93.5583 35.8707C92.667 35.4166 91.5002 35.4166 89.1667 35.4166H73.3333C70.9998 35.4166 69.833 35.4166 68.9417 35.8707C68.1577 36.2702 67.5203 36.9076 67.1208 37.6916C66.6667 38.5829 66.6667 39.7497 66.6667 42.0833V45.4166C66.6667 47.7501 66.6667 48.9169 67.1208 49.8082C67.5203 50.5922 68.1577 51.2296 68.9417 51.6291C69.833 52.0832 70.9998 52.0833 73.3333 52.0833Z" stroke="currentColor" stroke-width="8.2" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>
diff --git a/app/assets/ico/vendor/akamai.svg b/app/assets/ico/vendor/akamai.svg
new file mode 100644
index 0000000..5a08c58
--- /dev/null
+++ b/app/assets/ico/vendor/akamai.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" xml:space="preserve" width="409.333" height="166.751"><defs><clipPath id="a" clipPathUnits="userSpaceOnUse"><path d="M0 0h612v792H0Z"/></clipPath><clipPath id="b" clipPathUnits="userSpaceOnUse"><path d="M0 0h612v792H0Z"/></clipPath></defs><g style="fill:#09c;fill-opacity:1"><path d="M0 0c-6.127 1.862-10.58 7.517-10.58 14.209 0 6.763 4.548 12.465 10.768 14.279.637.189.472.59-.306.59-8.271 0-14.986-6.669-14.986-14.869S-8.389-.66-.118-.66C.66-.66.707-.212 0 0" style="fill:#09c;fill-opacity:1;fill-rule:nonzero;stroke:none" transform="matrix(5.60732 0 0 -5.60732 84.693 163.05)"/></g><g style="fill:#000"><path d="M0 0a10 10 0 0 0-.071 1.202 11.797 11.797 0 0 0 11.806 11.805c6.173 0 8.011-2.757 8.247-2.568.259.188-2.239 5.655-9.473 5.655A11.796 11.796 0 0 1-1.296 4.289c0-1.508.283-2.946.801-4.265C-.283-.542.047-.542 0 0" style="fill:#09c;fill-opacity:1;fill-rule:nonzero;stroke:none" transform="matrix(5.60732 0 0 -5.60732 41.355 102.799)"/></g><g style="fill:#09c;fill-opacity:1"><path d="M0 0c3.063 1.343 6.928 1.39 10.721.047 2.545-.895 4.03-2.168 4.148-2.097.212.094-1.485 2.757-4.525 3.912A10.79 10.79 0 0 1-.165.259C-.495 0-.377-.165 0 0" style="fill:#09c;fill-opacity:1;fill-rule:nonzero;stroke:none" transform="matrix(5.60732 0 0 -5.60732 69.102 55.1)"/></g><g style="fill:#f93;fill-opacity:1"><path d="M0 0c0-.848-.707-1.555-1.555-1.555-.849 0-1.555.683-1.555 1.555 0 .848.683 1.555 1.555 1.555S0 .872 0 0" style="fill:#f93;fill-opacity:1;fill-rule:nonzero;stroke:none" transform="matrix(5.60732 0 0 -5.60732 409.333 86.283)"/></g><path d="m525.457 729.914.188-2.074h3.276l-1.108 12.041h-4.877l-6.174-12.04h3.346l1.037 2.073zm-.165 2.333H522.3l2.57 5.207h.022zM533.469 733.096h.495l2.333 3.18h3.039l-3.228-4.052 1.98-4.383h-3.229l-1.296 3.417h-.471l-.73-3.417h-2.757l2.544 12.04h2.757z" style="fill:#f93;fill-opacity:1;fill-rule:nonzero;stroke:none" transform="matrix(5.60732 0 0 -5.60732 -2820.89 4227.904)"/><g clip-path="url(#b)" style="fill:#f93;fill-opacity:1" transform="matrix(5.60732 0 0 -5.60732 -2820.89 4227.904)"><g style="fill:#f93;fill-opacity:1"><path d="M0 0h2.757l1.107 5.255C4.477 8.153 3.37 8.506.542 8.506c-1.979 0-3.888.024-4.43-2.591h2.757c.165.754.636.918 1.32.918 1.201 0 1.154-.494.989-1.272L.895 4.218H.778c-.095.966-1.32.942-2.098.942-2.002 0-3.181-.636-3.605-2.662-.447-2.144.566-2.616 2.498-2.616.966 0 2.262.189 2.71 1.343h.094Zm-.778 3.487c.896 0 1.485-.07 1.343-.777C.377 1.838 0 1.673-1.155 1.673c-.424 0-1.201 0-1.013.919.165.778.707.895 1.39.895" style="fill:#f93;fill-opacity:1;fill-rule:nonzero;stroke:none" transform="translate(543.649 727.84)"/></g><g style="fill:#f93;fill-opacity:1"><path d="m0 0-.259-1.178h.118C.401-.188 1.508.094 2.451.094c1.178 0 2.356-.212 2.191-1.649h.118C5.16-.353 6.386.094 7.446.094c1.956 0 2.781-.801 2.356-2.757L8.577-8.436H5.82l1.037 4.878c.141.872.283 1.532-.778 1.532-1.084 0-1.437-.707-1.626-1.626L3.44-8.436H.683l1.084 5.114c.142.777.189 1.296-.777 1.296-1.131 0-1.485-.613-1.697-1.626L-1.72-8.436h-2.757L-2.686 0Z" style="fill:#f93;fill-opacity:1;fill-rule:nonzero;stroke:none" transform="translate(551.99 736.277)"/></g><g style="fill:#f93;fill-opacity:1"><path d="M0 0h2.757l1.131 5.255c.613 2.898-.495 3.251-3.322 3.251-1.98 0-3.889.024-4.43-2.591h2.757c.164.754.636.918 1.319.918 1.202 0 1.155-.494.99-1.272L.919 4.218H.801c-.094.966-1.319.942-2.097.942-2.003 0-3.181-.636-3.605-2.662-.448-2.144.565-2.616 2.497-2.616.967 0 2.263.189 2.71 1.343h.095Zm-.754 3.487c.895 0 1.484-.07 1.343-.777-.188-.872-.565-1.037-1.72-1.037-.424 0-1.202 0-1.013.919.165.778.707.895 1.39.895" style="fill:#f93;fill-opacity:1;fill-rule:nonzero;stroke:none" transform="translate(566.906 727.84)"/></g></g><path d="M573.669 727.84h-2.757l1.767 8.437h2.78z" style="fill:#f93;fill-opacity:1;fill-rule:nonzero;stroke:none" transform="matrix(5.60732 0 0 -5.60732 -2820.89 4227.904)"/></svg>
\ No newline at end of file
diff --git a/app/assets/ico/vendor/aws.svg b/app/assets/ico/vendor/aws.svg
new file mode 100644
index 0000000..4715937
--- /dev/null
+++ b/app/assets/ico/vendor/aws.svg
@@ -0,0 +1,38 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generator: Adobe Illustrator 19.0.1, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
+<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
+	 viewBox="0 0 304 182" style="enable-background:new 0 0 304 182;" xml:space="preserve">
+<style type="text/css">
+	.st0{fill:#252F3E;}
+	.st1{fill-rule:evenodd;clip-rule:evenodd;fill:#FF9900;}
+</style>
+<g>
+	<path class="st0" d="M86.4,66.4c0,3.7,0.4,6.7,1.1,8.9c0.8,2.2,1.8,4.6,3.2,7.2c0.5,0.8,0.7,1.6,0.7,2.3c0,1-0.6,2-1.9,3l-6.3,4.2
+		c-0.9,0.6-1.8,0.9-2.6,0.9c-1,0-2-0.5-3-1.4C76.2,90,75,88.4,74,86.8c-1-1.7-2-3.6-3.1-5.9c-7.8,9.2-17.6,13.8-29.4,13.8
+		c-8.4,0-15.1-2.4-20-7.2c-4.9-4.8-7.4-11.2-7.4-19.2c0-8.5,3-15.4,9.1-20.6c6.1-5.2,14.2-7.8,24.5-7.8c3.4,0,6.9,0.3,10.6,0.8
+		c3.7,0.5,7.5,1.3,11.5,2.2v-7.3c0-7.6-1.6-12.9-4.7-16c-3.2-3.1-8.6-4.6-16.3-4.6c-3.5,0-7.1,0.4-10.8,1.3c-3.7,0.9-7.3,2-10.8,3.4
+		c-1.6,0.7-2.8,1.1-3.5,1.3c-0.7,0.2-1.2,0.3-1.6,0.3c-1.4,0-2.1-1-2.1-3.1v-4.9c0-1.6,0.2-2.8,0.7-3.5c0.5-0.7,1.4-1.4,2.8-2.1
+		c3.5-1.8,7.7-3.3,12.6-4.5c4.9-1.3,10.1-1.9,15.6-1.9c11.9,0,20.6,2.7,26.2,8.1c5.5,5.4,8.3,13.6,8.3,24.6V66.4z M45.8,81.6
+		c3.3,0,6.7-0.6,10.3-1.8c3.6-1.2,6.8-3.4,9.5-6.4c1.6-1.9,2.8-4,3.4-6.4c0.6-2.4,1-5.3,1-8.7v-4.2c-2.9-0.7-6-1.3-9.2-1.7
+		c-3.2-0.4-6.3-0.6-9.4-0.6c-6.7,0-11.6,1.3-14.9,4c-3.3,2.7-4.9,6.5-4.9,11.5c0,4.7,1.2,8.2,3.7,10.6
+		C37.7,80.4,41.2,81.6,45.8,81.6z M126.1,92.4c-1.8,0-3-0.3-3.8-1c-0.8-0.6-1.5-2-2.1-3.9L96.7,10.2c-0.6-2-0.9-3.3-0.9-4
+		c0-1.6,0.8-2.5,2.4-2.5h9.8c1.9,0,3.2,0.3,3.9,1c0.8,0.6,1.4,2,2,3.9l16.8,66.2l15.6-66.2c0.5-2,1.1-3.3,1.9-3.9c0.8-0.6,2.2-1,4-1
+		h8c1.9,0,3.2,0.3,4,1c0.8,0.6,1.5,2,1.9,3.9l15.8,67l17.3-67c0.6-2,1.3-3.3,2-3.9c0.8-0.6,2.1-1,3.9-1h9.3c1.6,0,2.5,0.8,2.5,2.5
+		c0,0.5-0.1,1-0.2,1.6c-0.1,0.6-0.3,1.4-0.7,2.5l-24.1,77.3c-0.6,2-1.3,3.3-2.1,3.9c-0.8,0.6-2.1,1-3.8,1h-8.6c-1.9,0-3.2-0.3-4-1
+		c-0.8-0.7-1.5-2-1.9-4L156,23l-15.4,64.4c-0.5,2-1.1,3.3-1.9,4c-0.8,0.7-2.2,1-4,1H126.1z M254.6,95.1c-5.2,0-10.4-0.6-15.4-1.8
+		c-5-1.2-8.9-2.5-11.5-4c-1.6-0.9-2.7-1.9-3.1-2.8c-0.4-0.9-0.6-1.9-0.6-2.8v-5.1c0-2.1,0.8-3.1,2.3-3.1c0.6,0,1.2,0.1,1.8,0.3
+		c0.6,0.2,1.5,0.6,2.5,1c3.4,1.5,7.1,2.7,11,3.5c4,0.8,7.9,1.2,11.9,1.2c6.3,0,11.2-1.1,14.6-3.3c3.4-2.2,5.2-5.4,5.2-9.5
+		c0-2.8-0.9-5.1-2.7-7c-1.8-1.9-5.2-3.6-10.1-5.2L246,52c-7.3-2.3-12.7-5.7-16-10.2c-3.3-4.4-5-9.3-5-14.5c0-4.2,0.9-7.9,2.7-11.1
+		c1.8-3.2,4.2-6,7.2-8.2c3-2.3,6.4-4,10.4-5.2c4-1.2,8.2-1.7,12.6-1.7c2.2,0,4.5,0.1,6.7,0.4c2.3,0.3,4.4,0.7,6.5,1.1
+		c2,0.5,3.9,1,5.7,1.6c1.8,0.6,3.2,1.2,4.2,1.8c1.4,0.8,2.4,1.6,3,2.5c0.6,0.8,0.9,1.9,0.9,3.3v4.7c0,2.1-0.8,3.2-2.3,3.2
+		c-0.8,0-2.1-0.4-3.8-1.2c-5.7-2.6-12.1-3.9-19.2-3.9c-5.7,0-10.2,0.9-13.3,2.8c-3.1,1.9-4.7,4.8-4.7,8.9c0,2.8,1,5.2,3,7.1
+		c2,1.9,5.7,3.8,11,5.5l14.2,4.5c7.2,2.3,12.4,5.5,15.5,9.6c3.1,4.1,4.6,8.8,4.6,14c0,4.3-0.9,8.2-2.6,11.6
+		c-1.8,3.4-4.2,6.4-7.3,8.8c-3.1,2.5-6.8,4.3-11.1,5.6C264.4,94.4,259.7,95.1,254.6,95.1z"/>
+	<g>
+		<path class="st1" d="M273.5,143.7c-32.9,24.3-80.7,37.2-121.8,37.2c-57.6,0-109.5-21.3-148.7-56.7c-3.1-2.8-0.3-6.6,3.4-4.4
+			c42.4,24.6,94.7,39.5,148.8,39.5c36.5,0,76.6-7.6,113.5-23.2C274.2,133.6,278.9,139.7,273.5,143.7z"/>
+		<path class="st1" d="M287.2,128.1c-4.2-5.4-27.8-2.6-38.5-1.3c-3.2,0.4-3.7-2.4-0.8-4.5c18.8-13.2,49.7-9.4,53.3-5
+			c3.6,4.5-1,35.4-18.6,50.2c-2.7,2.3-5.3,1.1-4.1-1.9C282.5,155.7,291.4,133.4,287.2,128.1z"/>
+	</g>
+</g>
+</svg>
diff --git a/app/assets/ico/vendor/azure.svg b/app/assets/ico/vendor/azure.svg
new file mode 100644
index 0000000..f60d954
--- /dev/null
+++ b/app/assets/ico/vendor/azure.svg
@@ -0,0 +1,23 @@
+<svg width="36" height="40" viewBox="0 0 36 40" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M8.33911 7.95502H15.7413L8.0577 31.2225C7.9787 31.4619 7.82847 31.6695 7.62746 31.8165C7.42715 31.9636 7.18594 32.0428 6.93908 32.0428H1.17885C0.991942 32.0428 0.807152 31.9974 0.640699 31.9102C0.474247 31.823 0.330365 31.6961 0.221042 31.5411C0.11172 31.3862 0.040484 31.206 0.012977 31.0171C-0.0145299 30.8283 0.0016923 30.6351 0.0616433 30.4534L7.2212 8.77604C7.3002 8.53672 7.45043 8.32913 7.65144 8.18208C7.85175 8.03503 8.09296 7.95574 8.33982 7.95574L8.33911 7.95502Z" fill="url(#paint0_linear_7969_394201)"/>
+<path d="M19.0959 23.5616H7.35817C7.24885 23.5616 7.14235 23.5948 7.05207 23.6575C6.96179 23.7202 6.89196 23.8096 6.85247 23.9127C6.81227 24.0165 6.8038 24.1304 6.82778 24.2385C6.85176 24.3473 6.90748 24.4461 6.98718 24.5218L14.5297 31.7163C14.7491 31.9261 15.0382 32.0421 15.3387 32.0421H21.9848L19.0959 23.5602V23.5616Z" fill="#0078D4"/>
+<path d="M8.33953 7.95502C8.08985 7.9543 7.84652 8.03503 7.6448 8.18497C7.44308 8.33562 7.29356 8.54754 7.2188 8.79118L0.0712212 30.4347C0.00703836 30.6163 -0.0127103 30.8117 0.0126807 31.0027C0.0380717 31.1944 0.108602 31.3768 0.21722 31.5347C0.326542 31.6925 0.47113 31.8216 0.638993 31.9102C0.806855 31.9989 0.993057 32.045 1.18208 32.0443H7.09114C7.31119 32.0039 7.51714 31.9052 7.68712 31.7567C7.8578 31.6089 7.98617 31.4172 8.06023 31.2017L9.48565 26.9091L14.5773 31.7625C14.7903 31.9427 15.0583 32.0429 15.3355 32.045H21.9569L19.0524 23.5631L10.5866 23.5652L15.7685 7.95502H8.33953Z" fill="url(#paint1_linear_7969_394201)"/>
+<path d="M17.7935 8.7746C17.7145 8.536 17.5643 8.3284 17.364 8.18136C17.1637 8.03431 16.9231 7.95502 16.677 7.95502H8.42773C8.67459 7.95502 8.91439 8.03431 9.1147 8.18136C9.31501 8.3284 9.46524 8.536 9.54423 8.7746L16.7038 30.4542C16.7637 30.6351 16.7807 30.8283 16.7525 31.0178C16.725 31.2067 16.6537 31.3869 16.5444 31.5419C16.4351 31.6969 16.2919 31.8237 16.1247 31.9109C15.9583 31.9982 15.7742 32.0436 15.5866 32.0436H23.8358C24.0228 32.0436 24.2075 31.9982 24.374 31.9109C24.5404 31.8237 24.6843 31.6969 24.7929 31.5419C24.9023 31.3869 24.9735 31.2067 25.001 31.0178C25.0285 30.829 25.0123 30.6358 24.9523 30.4542L17.7935 8.7746Z" fill="url(#paint2_linear_7969_394201)"/>
+<defs>
+<linearGradient id="paint0_linear_7969_394201" x1="11.0376" y1="9.7405" x2="3.0443" y2="32.844" gradientUnits="userSpaceOnUse">
+<stop stop-color="#114A8B"/>
+<stop offset="1" stop-color="#0669BC"/>
+</linearGradient>
+<linearGradient id="paint1_linear_7969_394201" x1="13.4382" y1="20.5565" x2="11.6523" y2="21.1471" gradientUnits="userSpaceOnUse">
+<stop stop-opacity="0.3"/>
+<stop offset="0.07" stop-opacity="0.2"/>
+<stop offset="0.32" stop-opacity="0.1"/>
+<stop offset="0.62" stop-opacity="0.05"/>
+<stop offset="1" stop-opacity="0"/>
+</linearGradient>
+<linearGradient id="paint2_linear_7969_394201" x1="12.5157" y1="9.04202" x2="21.2812" y2="31.8921" gradientUnits="userSpaceOnUse">
+<stop stop-color="#3CCBF4"/>
+<stop offset="1" stop-color="#2892DF"/>
+</linearGradient>
+</defs>
+</svg>
diff --git a/app/assets/ico/vendor/civo.svg b/app/assets/ico/vendor/civo.svg
new file mode 100644
index 0000000..96f90d6
--- /dev/null
+++ b/app/assets/ico/vendor/civo.svg
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generator: Adobe Illustrator 16.0.4, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
+	 width="711.364px" height="238.193px" viewBox="0 0 711.364 238.193" enable-background="new 0 0 711.364 238.193"
+	 xml:space="preserve">
+<g>
+	<path fill="#239DFF" d="M273.539,0.081h-29.424c-5.424,0-8.981,4.179-8.981,9.423v219.13c0,5.245,3.557,9.447,8.981,9.447h29.424
+		c5.424,0,9.595-4.202,9.595-9.447V9.504C283.134,4.26,278.963,0.081,273.539,0.081"/>
+	<path fill="#239DFF" d="M181.662,173.122c-2.671-5.859-10.327-7.473-15.027-3.072c-12.446,11.658-29.136,18.819-47.538,18.819
+		c-48.218,0-85.012-48.909-63.477-99.824c6.365-15.049,18.442-27.092,33.495-33.447c29.421-12.421,58.048-5.345,77.037,12.095
+		c4.749,4.361,12.365,2.814,15.04-3.054l12.744-27.956c2.039-4.474,0.631-9.721-3.292-12.685
+		C160.789,1.437,120.037-7.42,77.562,7.052C43.472,18.666,16.89,46.154,6.065,80.503c-25.894,82.163,34.749,157.69,113.032,157.69
+		c27.245,0,52.286-9.214,72.327-24.633c3.786-2.913,4.973-8.113,2.991-12.462L181.662,173.122z"/>
+	<path fill="#239DFF" d="M705.299,80.503c-10.825-34.349-37.407-61.837-71.497-73.451c-24.128-8.221-47.698-8.906-69.033-3.835
+		c-35.585,7.946-61.358,24.817-84.01,73.453l-45.455,98.598L358.15,5.667c-1.541-3.381-4.911-5.554-8.626-5.56l-33.706-0.053
+		c-6.917-0.011-11.524,7.142-8.653,13.436l100.064,218.79c1.542,3.383,4.917,5.67,8.634,5.671l1.637,0.131h37.841
+		c0.761,0,1.522-0.157,2.244-0.403c2.604-0.887,4.798-2.745,5.938-5.311c0,0,50.098-114.027,50.681-115.402
+		c15.244-35.949,24.495-50.922,48.691-61.206c18.307-7.78,39.955-8.727,60.885,0.753c14.57,6.599,26.028,18.657,32.122,33.443
+		c3.857,9.254,5.801,18.768,6.122,28.142c0.545,38.992-30.891,70.773-69.758,70.773c-18.402,0-35.092-7.162-47.538-18.819
+		c-4.7-4.402-12.356-2.788-15.027,3.071L516.947,201.1c-1.981,4.348-0.795,9.547,2.993,12.461
+		c20.04,15.418,45.081,24.633,72.326,24.633C670.55,238.193,731.192,162.666,705.299,80.503"/>
+</g>
+</svg>
diff --git a/app/assets/ico/vendor/digitalocean.svg b/app/assets/ico/vendor/digitalocean.svg
new file mode 100644
index 0000000..5a81f24
--- /dev/null
+++ b/app/assets/ico/vendor/digitalocean.svg
@@ -0,0 +1 @@
+<svg height="2500" width="2500" xmlns="http://www.w3.org/2000/svg" viewBox="0 -3.954 53.927 53.954"><g fill="#0080ff" fill-rule="evenodd"><path d="M24.915 50v-9.661c10.226 0 18.164-10.141 14.237-20.904a14.438 14.438 0 0 0-8.615-8.616C19.774 6.921 9.633 14.83 9.633 25.056H0C0 8.758 15.763-3.954 32.853 1.384 40.311 3.73 46.271 9.661 48.588 17.12 53.927 34.237 41.243 50 24.915 50"/><path d="M15.339 40.367h9.604v-9.604H15.34zm-7.401 7.401h7.4v-7.4h-7.4zm-6.187-7.4h6.187V34.18H1.751z"/></g></svg>
\ No newline at end of file
diff --git a/app/assets/ico/vendor/docker-compose.svg b/app/assets/ico/vendor/docker-compose.svg
new file mode 100644
index 0000000..27559f0
--- /dev/null
+++ b/app/assets/ico/vendor/docker-compose.svg
@@ -0,0 +1,71 @@
+<svg width="36" height="40" viewBox="0 0 36 40" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0_9452_431191)">
+<path d="M26.923 21.7271C24.3515 21.7271 24.1024 23.774 24.1024 23.774L25.7745 23.3C25.7745 23.3 27.0222 22.6508 28.1212 23.8743C29.3194 25.1221 28.6701 27.2439 28.1212 28.0431C27.3474 29.2908 24.2777 29.4407 24.077 29.3911C22.7289 26.5209 19.6084 26.3952 19.6084 26.3952L22.978 23.3C22.978 23.3 26.4975 19.8809 26.4975 16.6854C26.4975 13.4899 22.8027 10.0454 22.8027 10.0454C22.8027 10.0454 21.2805 8.84723 21.2805 7.82436C21.2805 6.10151 24.7505 5.62755 26.697 4.60468C28.6436 3.58181 27.1468 0.761129 26.373 0.311388C24.8508 -0.337852 24.002 0.836085 24.002 0.836085L22.3541 4.97946L21.156 5.45342C21.156 5.45342 20.2069 5.40383 19.4331 6.37712C18.6594 7.3504 19.2832 9.49762 19.2832 9.49762C19.2832 9.49762 17.9847 8.82416 15.7891 8.82416C8.60017 8.82416 7.95093 14.8149 7.95093 15.8632C7.95093 16.9114 8.52521 19.0079 9.34858 20.0066C10.172 21.0052 11.994 23.1017 11.994 24.4244C11.994 26.5209 8.69934 27.794 7.00186 27.794C4.68051 27.794 3.78218 26.371 3.78218 25.3977C3.78218 24 4.70588 22.4767 5.25479 21.4538C5.80371 20.4309 4.90538 19.1324 4.90538 19.1324L3.70722 19.6814L1.28555 18.3079C1.28555 18.3079 1.31668 16.1296 1.21751 16.08C0.767768 16.1803 0.237305 16.8595 0.237305 17.9608C0.237305 19.4599 1.83446 19.6987 2.67397 20.0215C3.80986 20.4586 3.8064 21.5288 3.05798 22.5516C2.30957 23.5745 1.7595 25.7967 1.7595 26.8945C1.7595 29.0913 4.60555 30.1142 6.52675 30.1142C9.49734 30.1142 11.5189 28.5666 11.5189 28.5666C11.5189 28.5666 11.7933 30.2895 11.7933 31.1382C11.7933 31.9869 11.0195 32.7861 9.69684 32.7861C8.37414 32.7861 7.3259 32.1876 7.3259 32.1876C7.3259 32.1876 4.62977 30.4405 3.50657 30.4405C1.53463 30.4405 0.835805 32.4621 0.835805 32.9118C0.835805 33.3615 1.15985 34.3844 1.43431 34.7592C1.70876 35.134 3.13179 35.7083 3.50657 35.6079C3.88135 35.5076 4.03127 34.6842 3.95631 34.4098C3.88135 34.1353 2.63361 33.3615 2.63361 32.9867C2.63361 32.612 2.85041 32.2879 3.52387 32.2879C4.19733 32.2879 4.98379 32.8795 6.20616 34.0292C7.09527 34.8664 9.37049 35.8732 10.7958 35.8074C11.7437 35.7636 13.5542 35.33 13.9405 33.8355C14.162 32.9787 13.8402 30.4659 14.0651 31.1151C14.29 31.7644 14.8296 32.9245 16.4222 33.9889C16.9699 34.3544 19.5254 35.0556 21.1283 34.4605C23.1256 34.0857 24.2235 31.3158 24.2488 31.2904C26.3707 31.2904 27.7937 30.4913 29.2663 29.7175C30.7389 28.9437 30.7135 26.2983 30.7135 24.8753C30.7135 23.0279 27.9932 21.7306 26.9196 21.7306L26.923 21.7271ZM13.7434 30.2145C13.7434 30.2145 13.244 29.4661 13.244 28.6669C13.244 27.8678 13.4193 27.1447 14.7166 26.6454C14.6913 26.6708 13.5346 27.7778 13.7434 30.2145ZM19.0607 32.6858C17.1141 32.6858 16.0405 30.7634 16.0405 29.5157C16.0405 28.2679 16.6897 27.4192 16.6897 27.4192C16.6897 27.4192 16.7209 28.0511 16.7209 28.1757C16.7209 28.3002 17.0611 29.4165 17.8348 30.2145C18.6086 31.0137 21.7314 31.1878 21.6565 31.2627C21.1571 32.2614 19.7341 32.6858 19.0607 32.6858V32.6858ZM21.6576 28.8226C20.3418 28.4478 19.5277 27.5311 19.5277 27.5311C21.0257 27.4376 21.7556 28.8607 21.6576 28.8226Z" fill="#B8C9DA"/>
+<path d="M11.5117 13.0493C12.3881 12.0968 12.6187 10.8837 12.0283 10.3405C11.7296 10.0661 11.2776 10.0165 10.791 10.156C9.65622 10.9598 8.9597 12.0057 8.53418 12.9905C8.54341 13.3134 8.64488 13.5959 8.85707 13.7908C9.4475 14.334 10.6376 14.003 11.5128 13.0505L11.5117 13.0493Z" fill="#99B3D1"/>
+<path d="M14.802 11.4765C15.472 11.0901 15.8168 10.4328 15.5723 10.0096C15.3278 9.58639 14.5863 9.55641 13.9163 9.94273C13.2463 10.329 12.9015 10.9864 13.146 11.4096C13.3905 11.8328 14.132 11.8628 14.802 11.4765Z" fill="#99B3D1"/>
+<path d="M8.91448 34.8514C9.15319 34.4108 8.78071 33.7478 8.08304 33.3707C7.38536 32.9936 6.62773 33.0466 6.38902 33.4871C6.29446 33.6613 6.29907 33.87 6.37749 34.0822C6.80416 34.4939 7.58256 34.8883 8.38863 35.1915C8.62388 35.1454 8.81531 35.0336 8.91333 34.8514H8.91448Z" fill="#99B3D1"/>
+<path d="M15.1446 27.4145C14.8194 27.2219 14.3823 27.3788 14.0433 27.7628C13.8761 28.2298 13.7319 28.8399 13.6904 29.5871C13.7492 29.6897 13.8265 29.7762 13.9234 29.8339C14.3466 30.0853 14.9624 29.7463 15.3003 29.0786C15.637 28.4109 15.5678 27.6659 15.1446 27.4145V27.4145Z" fill="#99B3D1"/>
+<path d="M15.3114 30.2445C15.0773 30.7069 15.1257 31.2224 15.4186 31.3965C15.7046 31.566 16.1175 31.3457 16.3539 30.9041C16.1417 30.4901 16.016 30.0588 15.9848 29.6725C15.7404 29.7059 15.4774 29.9158 15.3114 30.2445Z" fill="#99B3D1"/>
+<path d="M21.5931 28.7822C20.9127 28.5885 20.3695 28.2506 20.0005 27.9681C20.1527 28.5597 20.4237 29.9366 19.9971 30.9433C20.8539 31.114 21.6311 31.182 21.5908 31.2224C21.5573 31.2904 21.5089 31.3492 21.4674 31.4115C21.6277 31.2766 22.1362 30.7911 22.1155 30.0738C22.1005 29.5664 21.8791 29.0959 21.5885 28.7292C21.6035 28.7672 21.6046 28.7868 21.5919 28.7822H21.5931Z" fill="#8597A9"/>
+<path d="M23.6003 19.1163C23.0133 19.965 21.7656 21.2381 21.7656 21.2381C21.7656 21.2381 19.194 22.7361 18.2207 24.708C18.2207 24.708 19.5111 23.9204 21.7644 24.316L22.9141 23.2608C22.9141 23.2608 26.4337 19.8416 26.4337 16.6462C26.4337 15.049 25.51 13.3884 24.5863 12.128C24.562 12.7945 24.4848 13.6248 24.2622 14.1749C24.2876 14.6246 24.6612 17.4695 23.6003 19.1174V19.1163Z" fill="#8597A9"/>
+<path d="M4.60993 22.4974C4.81404 22.1007 5.03315 21.802 5.21074 21.4872C5.94762 20.1829 4.84287 19.0909 4.84287 19.0909L3.64472 19.6398L2.13521 18.7841C2.03603 19.0263 1.93225 19.2996 1.89765 19.4668C1.88727 19.5175 1.90342 19.5856 1.93686 19.6628C2.31625 19.7839 2.48923 19.9846 2.75216 20.0768C3.34835 20.2879 3.74389 20.906 3.52133 21.6394C3.80732 21.9623 4.24552 22.2552 4.60993 22.4962V22.4974Z" fill="#8597A9"/>
+<path d="M17.942 25.4726C17.942 25.4726 18.0204 24.4186 18.9303 23.3715C19.8402 22.3244 20.3153 22.0431 21.2505 21.2278C22.1869 20.4136 23.6837 19.1866 24.0239 17.0186C24.2545 15.719 24.1507 14.2049 23.4761 13.1232C22.8015 12.0415 21.1652 10.0154 18.0331 9.29118C14.9011 8.56583 12.4667 9.57832 12.4667 9.57832C12.4667 9.57832 8.40407 11.0417 8.09502 15.6948C8.02583 17.0359 8.3591 17.8386 8.3591 17.8386C8.3591 17.8386 8.79384 19.2097 9.40157 19.9627C10.0093 20.7157 10.7197 21.5945 10.7197 21.5945C10.7197 21.5945 12.0227 22.9206 12.0227 24.4716C12.0227 25.0898 11.7806 25.671 11.3839 26.0815C10.9883 26.492 9.83171 28.0592 6.83574 28.0592C5.01603 28.0592 3.54688 26.9014 3.54688 25.5891C3.54688 24.5132 3.88822 23.5929 4.30221 22.8883C4.71735 22.1837 5.41964 21.3269 5.41964 20.5047C5.41964 19.9523 4.85804 19.1705 4.85804 19.1705L4.96759 19.0678C4.96759 19.0678 5.53611 19.7205 5.53611 20.4932C5.53611 20.9706 5.44847 21.2647 5.33315 21.5022C5.21783 21.7398 3.89398 23.7717 3.89398 25.2108C3.89398 26.0146 4.40599 27.591 6.83344 27.591C8.63471 27.591 9.58839 27.0444 10.7035 26.2164C11.3389 25.7252 11.8163 25.0586 11.8163 24.4474C11.8163 23.8362 11.6168 23.3242 11.1832 22.7188C10.7496 22.1134 10.4556 21.7259 9.88014 21.0767C9.3047 20.4263 7.59338 18.8937 7.59338 15.5299C7.59338 13.9373 8.99104 8.52893 16.0231 8.52893C17.5695 8.52893 24.6904 9.84471 24.6904 15.9658C24.6904 17.7451 23.7068 19.995 22.1926 21.2427C20.6785 22.4905 18.4656 23.9343 17.9386 25.4726H17.942Z" fill="#101111"/>
+<path d="M19.5855 26.4378C19.5855 26.4378 19.0262 26.5958 19.1646 26.5358C19.3768 26.4436 20.0076 25.9973 20.3685 25.6306C21.0846 24.9029 26.1529 20.6419 26.1529 17.1409C26.1529 13.8889 23.9445 11.8086 23.9445 11.8086C23.9445 11.8086 23.6193 11.5306 22.6587 10.3994C21.6981 9.26811 21.4271 8.91177 21.3176 8.52892C21.1112 8.17374 21.1181 7.03786 21.8307 6.54084C22.5434 6.04266 22.6841 6.09225 22.6841 6.09225L22.7025 6.26292C22.7025 6.26292 21.7085 6.68844 21.4156 7.59369C21.3568 7.89236 21.2968 8.5047 22.0083 9.21275C22.7198 9.92081 23.9445 11.1409 23.9445 11.1409C23.9445 11.1409 26.6729 13.4023 26.6729 17.1432C26.6729 18.2952 26.0041 20.1414 24.9213 21.3707C23.8384 22.6 21.3545 25.2581 19.5855 26.4378V26.4378Z" fill="#121313"/>
+<path d="M19.0818 9.32805C19.0818 9.32805 18.466 8.00766 18.805 6.78644C19.1406 5.7555 20.0943 5.43953 21.2278 5.31152C21.4054 5.34843 21.4262 5.43261 21.4262 5.43261C21.4262 5.43261 19.7506 5.57445 19.144 7.17391C18.9526 7.75396 19.1913 8.96249 19.4 9.41108C19.4392 9.47796 19.0818 9.32805 19.0818 9.32805Z" fill="#121313"/>
+<path d="M14.6247 19.9846C13.9547 19.4657 12.9526 19.6698 12.4671 20.2844C11.9262 20.9706 11.9816 21.9669 12.6493 22.4547C13.1532 22.8226 14.3467 22.7419 14.8069 22.1549C15.4123 21.3811 15.2785 20.4909 14.6247 19.9846V19.9846ZM14.6154 22.0027C14.2061 22.5251 13.1521 22.5839 12.6942 22.2691C12.203 21.9312 12.045 20.9441 12.5305 20.3363C12.7934 20.0065 13.1682 19.8266 13.5464 19.799C13.4865 19.8716 13.4496 19.9246 13.4496 20.0238C13.4496 20.2625 13.6514 20.4563 13.9016 20.4563C14.1519 20.4563 14.3537 20.2994 14.3537 20.0596C14.3537 20.04 14.3502 20.0204 14.3467 20.0019C14.3825 20.025 14.4194 20.0423 14.4528 20.0699C15.0283 20.5301 15.1551 21.3131 14.6166 22.0027H14.6154Z" fill="#121313"/>
+<path d="M14.4519 20.0699C14.4184 20.0434 14.3815 20.025 14.3458 20.0019C14.3492 20.0215 14.3527 20.04 14.3527 20.0596C14.3527 20.2983 14.1509 20.492 13.9007 20.492C13.6504 20.492 13.4486 20.2983 13.4486 20.0596C13.4486 19.9604 13.4855 19.8704 13.5455 19.7978C13.1672 19.8255 12.7924 20.0054 12.5295 20.3352C12.044 20.9417 12.202 21.9289 12.6933 22.2679C13.1511 22.5827 14.2051 22.5239 14.6145 22.0015C15.1542 21.3131 15.0262 20.5289 14.4507 20.0688L14.4519 20.0699Z" fill="white"/>
+<path d="M17.7956 20.4632C17.1256 19.9443 16.1235 20.1484 15.638 20.763C15.0971 21.4492 15.1525 22.4455 15.8202 22.9333C16.3241 23.3012 17.5176 23.2204 17.9778 22.6335C18.5832 21.8597 18.4494 20.9694 17.7956 20.4632ZM17.7863 22.4813C17.377 23.0036 16.323 23.0625 15.8651 22.7476C15.3739 22.4098 15.2159 21.4226 15.7014 20.8149C15.9643 20.4851 16.3391 20.3052 16.7173 20.2775C16.6574 20.3502 16.6205 20.4032 16.6205 20.5024C16.6205 20.7411 16.8223 20.9348 17.0725 20.9348C17.3228 20.9348 17.5246 20.778 17.5246 20.5381C17.5246 20.5185 17.5211 20.4989 17.5176 20.4805C17.5534 20.5036 17.5903 20.5208 17.6237 20.5485C18.1992 21.0086 18.326 21.7917 17.7875 22.4813H17.7863Z" fill="#121313"/>
+<path d="M17.6228 20.5485C17.5893 20.522 17.5524 20.5035 17.5167 20.4805C17.5201 20.5001 17.5236 20.5185 17.5236 20.5381C17.5236 20.7768 17.3218 20.9706 17.0716 20.9706C16.8213 20.9706 16.6195 20.7768 16.6195 20.5381C16.6195 20.439 16.6564 20.349 16.7164 20.2764C16.3381 20.304 15.9633 20.4839 15.7004 20.8137C15.2149 21.4203 15.3729 22.4074 15.8642 22.7465C16.322 23.0613 17.376 23.0025 17.7854 22.4801C18.3251 21.7916 18.1971 21.0075 17.6216 20.5474L17.6228 20.5485Z" fill="white"/>
+<path d="M1.18796 18.1049L1.04727 16.0557C1.04727 16.0557 0.984998 15.7974 1.28828 15.6982C1.59157 15.599 4.24158 14.7272 4.24158 14.7272C4.24158 14.7272 4.75013 14.62 5.16182 14.7595C5.5735 14.8991 6.87775 15.4468 6.87775 15.4468C6.87775 15.4468 7.19603 15.5529 7.19603 15.8966C7.19603 16.2402 7.17296 17.5525 7.17296 17.5525C7.17296 17.5525 7.17527 18.0691 6.96539 18.1856C6.75551 18.3021 3.91869 19.7436 3.91869 19.7436C3.91869 19.7436 3.44934 19.8543 3.15759 19.6628C2.86583 19.4714 1.4751 18.6527 1.4751 18.6527C1.4751 18.6527 1.18911 18.4878 1.18911 18.1049H1.18796Z" fill="#151516"/>
+<path d="M1.29004 16.3002L1.3846 18.0611C1.3846 18.0611 1.39152 18.3263 1.80897 18.5812C2.22642 18.8361 3.36576 19.4818 3.36576 19.4818C3.36576 19.4818 3.488 19.5476 3.488 19.2443V17.5791C3.488 17.5791 3.56526 17.2181 3.36576 17.142C3.16626 17.0659 1.45725 16.2126 1.45725 16.2126C1.45725 16.2126 1.29004 16.0615 1.29004 16.2991V16.3002Z" fill="#0F5983"/>
+<path d="M3.67873 19.122V17.5364C3.67873 17.5364 3.63606 17.2285 3.94742 17.1155C4.25878 17.0025 6.59974 16.013 6.59974 16.013C6.59974 16.013 6.87765 15.8827 6.87765 16.201V17.5491C6.87765 17.5491 6.87304 17.8097 6.64817 17.9423C6.4233 18.0749 3.96818 19.355 3.96818 19.355C3.96818 19.355 3.67989 19.4461 3.67989 19.1209L3.67873 19.122Z" fill="#29B4FA"/>
+<path d="M1.63244 16.0027L3.45562 16.9379C3.45562 16.9379 3.64935 17.0567 3.99992 16.9102C4.35048 16.7638 6.54844 15.8481 6.54844 15.8481C6.54844 15.8481 6.79061 15.7132 6.5669 15.6394C6.34318 15.5656 4.86826 14.9763 4.86826 14.9763C4.86826 14.9763 4.50501 14.891 4.22248 14.9763C3.93995 15.0617 1.76967 15.764 1.76967 15.764C1.76967 15.764 1.36144 15.8608 1.63128 16.0027H1.63244Z" fill="#72CCFA"/>
+<path d="M3.252 19.2189C3.24047 19.2189 3.22893 19.2166 3.2174 19.212L3.17358 19.1947C3.11823 19.1728 3.07326 19.0955 3.07095 19.0136L3.02252 17.3669C3.02136 17.3127 3.03866 17.2689 3.07095 17.2458C3.09517 17.2285 3.12515 17.225 3.15398 17.2366L3.1978 17.2539C3.2543 17.2758 3.29813 17.3542 3.30043 17.4349L3.34887 19.0817C3.35002 19.1359 3.33272 19.1797 3.30043 19.2028C3.28544 19.2131 3.26814 19.2189 3.25084 19.2189H3.252ZM3.2543 19.1209L3.23585 19.167L3.2543 19.1209ZM3.12284 17.3311C3.12284 17.3311 3.12169 17.3461 3.12284 17.3657L3.17128 19.0125C3.17243 19.0598 3.1978 19.099 3.21164 19.1047L3.252 19.1209C3.252 19.1209 3.25315 19.1059 3.252 19.0863L3.20356 17.4395C3.20241 17.3923 3.17704 17.353 3.1632 17.3473L3.12284 17.3311Z" fill="#05446D"/>
+<path d="M2.87407 18.9964C2.86254 18.9964 2.851 18.9941 2.83947 18.9894L2.79565 18.9721C2.73915 18.9502 2.69533 18.873 2.69302 18.7911L2.64459 17.1444C2.64343 17.0902 2.66073 17.0463 2.69302 17.0233C2.71724 17.006 2.74722 17.0025 2.7772 17.014L2.82102 17.0313C2.87753 17.0533 2.92135 17.1317 2.92366 17.2124L2.97209 18.8591C2.97324 18.9133 2.95594 18.9572 2.92366 18.9802C2.90866 18.9906 2.89252 18.9964 2.87407 18.9964V18.9964ZM2.87637 18.8983L2.85792 18.9445L2.87637 18.8983ZM2.74491 17.1086C2.74491 17.1086 2.74376 17.1236 2.74491 17.1432L2.79335 18.7899C2.7945 18.8384 2.81987 18.8764 2.83371 18.8822L2.87407 18.8983C2.87407 18.8983 2.87522 18.8834 2.87407 18.8637L2.82563 17.217C2.82448 17.1697 2.79911 17.1305 2.78527 17.1248L2.74491 17.1086Z" fill="#05446D"/>
+<path d="M2.47856 18.7911C2.46703 18.7911 2.4555 18.7888 2.44397 18.7842L2.40014 18.7669C2.34364 18.745 2.29982 18.6666 2.29751 18.5858L2.24908 16.9391C2.24792 16.8849 2.26522 16.8411 2.29751 16.818C2.32173 16.8007 2.35286 16.7973 2.38169 16.8088L2.42551 16.8261C2.48202 16.848 2.52584 16.9264 2.52815 17.0071L2.57658 18.6539C2.57773 18.7081 2.56044 18.7519 2.52815 18.775C2.51316 18.7853 2.49586 18.7911 2.47856 18.7911V18.7911ZM2.47971 18.6931L2.46242 18.7392L2.48087 18.6931H2.47971ZM2.34825 16.9033C2.34825 16.9033 2.3471 16.9183 2.34825 16.9368L2.39668 18.5835C2.39784 18.6308 2.42321 18.67 2.43705 18.6758L2.47741 18.6919C2.47741 18.6919 2.47856 18.6769 2.47741 18.6573L2.42897 17.0106C2.42782 16.9622 2.40245 16.9241 2.38861 16.9183L2.34825 16.9022V16.9033Z" fill="#05446D"/>
+<path d="M2.0827 18.5282C2.07117 18.5282 2.05964 18.5259 2.04926 18.5213L2.00544 18.504C1.94893 18.482 1.90511 18.4059 1.9028 18.3264L1.85552 16.7108C1.85437 16.6577 1.87167 16.615 1.90396 16.592C1.92817 16.5747 1.95816 16.5724 1.98814 16.5828L2.03196 16.6001C2.08847 16.622 2.13229 16.6981 2.13459 16.7788L2.18187 18.3944C2.18303 18.4474 2.16573 18.4901 2.13459 18.5132C2.1196 18.5236 2.1023 18.5293 2.08501 18.5293L2.0827 18.5282ZM2.08385 18.4302L2.06655 18.4763L2.08501 18.4302H2.08385ZM1.95354 16.675C1.95354 16.675 1.95239 16.6888 1.95354 16.7073L2.00082 18.3229C2.00198 18.369 2.02735 18.4071 2.04003 18.4117L2.08155 18.4278C2.08155 18.4278 2.0827 18.414 2.08155 18.3956L2.03427 16.7799C2.03311 16.7338 2.00774 16.6958 1.9939 16.6912L1.95354 16.675V16.675Z" fill="#05446D"/>
+<path d="M1.68897 18.3079C1.67744 18.3079 1.66706 18.3056 1.65553 18.3021L1.61171 18.286C1.5552 18.2652 1.51138 18.1891 1.50907 18.1107L1.46294 16.5193C1.46179 16.4674 1.47909 16.4247 1.51023 16.4017C1.53444 16.3855 1.56558 16.3809 1.59441 16.3925L1.63823 16.4086C1.69473 16.4294 1.73855 16.5055 1.74086 16.585L1.78699 18.1753C1.78814 18.2272 1.77084 18.2698 1.73971 18.2929C1.72472 18.3033 1.70742 18.309 1.68897 18.309V18.3079ZM1.69012 18.2099L1.67282 18.256L1.69012 18.2099ZM1.56212 16.4836C1.56212 16.4836 1.55981 16.4974 1.56097 16.5147L1.60709 18.1061C1.60825 18.1511 1.63362 18.188 1.6463 18.1926L1.68782 18.2087C1.68782 18.2087 1.68897 18.1949 1.68782 18.1776L1.64169 16.5873C1.64053 16.5424 1.61516 16.5055 1.60248 16.4997L1.56097 16.4847L1.56212 16.4836Z" fill="#05446D"/>
+<path d="M27.797 23.5675C27.1881 23.1397 26.8825 23.0394 26.3209 23.0394C25.7593 23.0394 25.5379 23.4695 25.5379 23.4695C25.5379 23.4695 26.1929 23.2123 26.5954 23.2123C26.9979 23.2123 28.5915 24.0357 28.5915 25.7309C28.5915 28.2679 26.5204 29.2146 24.8322 29.2146C24.5139 29.2146 24.2129 29.2031 23.9258 29.1835L24.0642 29.5675C24.3144 29.5952 24.5566 29.6113 24.7791 29.6113C26.7937 29.6113 27.8558 28.5573 28.2883 28.0119C28.7207 27.4653 28.9156 26.4805 28.9156 25.7505C28.9156 25.0205 28.4047 23.9965 27.797 23.5687V23.5675Z" fill="#101111"/>
+<path d="M21.7215 29.0555L21.5808 28.7465C20.6283 28.4293 19.964 27.9934 19.5039 27.5748C19.5131 27.606 19.535 27.6532 19.5858 27.7155C19.6757 27.8251 19.7046 27.9796 19.7115 28.0177C19.9144 28.2125 20.107 28.374 20.2569 28.4639C20.6398 28.6692 21.1553 28.8745 21.7215 29.0544V29.0555Z" fill="#101111"/>
+<path d="M18.5559 26.2648C18.5017 26.3617 18.5629 26.5462 18.6897 26.7676L18.7785 26.7111C18.6147 26.4436 18.5559 26.2648 18.5559 26.2648Z" fill="#101111"/>
+<path d="M14.7454 26.62C14.7454 26.62 13.4619 27.7317 13.4619 29.4834C13.4619 31.235 14.208 32.2729 14.4064 32.4886C14.6047 32.7042 16.2618 34.7776 19.7064 34.7776C20.9518 34.7776 24.3122 33.734 24.3122 30.4762C24.3122 28.5666 22.6274 26.4067 19.3973 26.4067C18.5082 26.447 17.9293 27.1343 17.9293 27.6394C17.9293 28.3971 18.3768 28.8745 18.9384 28.8745C19.4412 28.8745 19.771 28.6519 19.771 28.058C19.771 27.7582 19.5276 27.5875 19.4665 27.5472C19.4054 27.5068 19.7098 27.8724 19.6395 28.2045C19.5692 28.5366 19.4146 28.7799 18.9557 28.7799C18.642 28.7799 18.0101 28.3556 18.1323 27.6625C18.2165 27.2404 18.6005 26.7353 19.3743 26.6431C20.7339 26.4816 23.9535 27.4849 23.9535 30.4497C23.9535 32.5347 22.0358 34.6496 19.7052 34.6496C17.3747 34.6496 16.0681 33.606 16.0681 33.606C16.0681 33.606 13.8344 31.7863 13.8344 29.5053C13.8344 28.4351 13.9751 27.6129 14.7339 26.6339" fill="#101111"/>
+<path d="M16.6758 27.4791C16.6758 27.4791 16.0727 28.1653 16.0727 29.3588C16.0727 30.5524 16.9434 32.4655 18.8484 32.4655C20.1054 32.4655 21.8144 31.5222 21.8144 30.1591C21.8144 28.9148 20.8054 27.5506 19.4665 27.5506C19.4354 27.5195 19.5046 27.4803 19.5888 27.4803C19.673 27.4803 20.5033 27.4884 21.2655 28.1468C22.0278 28.8053 22.2376 29.4522 22.2376 30.1314C22.2376 30.8107 22.0773 31.4357 21.2724 32.0411C20.4675 32.6465 19.9313 32.9025 18.8484 32.9025C17.7656 32.9025 16.8108 31.935 16.8108 31.935C16.8108 31.935 15.8848 31.0736 15.8848 29.5387C15.8848 28.9829 16.3299 27.5241 16.677 27.4803L16.6758 27.4791Z" fill="#101111"/>
+<path d="M18.415 30.2963C17.7219 29.9054 16.774 29.2342 16.6495 26.7664C16.6495 26.7664 16.1398 29.2757 17.986 30.5927C18.6906 31.1197 19.4805 31.393 21.3948 31.5014L21.6266 31.1762C20.4769 31.0193 19.2499 30.7483 18.4161 30.2963H18.415Z" fill="#101111"/>
+<path d="M30.9246 26.4078C30.9246 25.2489 30.9661 21.5956 26.6716 21.5956C25.2106 21.5956 23.9824 22.8906 23.9824 23.8466C24.0574 23.8466 24.1496 23.7589 24.1496 23.7589C24.1496 23.7589 24.2511 22.9725 24.8923 22.4801C25.5358 21.9854 25.8425 21.8366 26.6716 21.8366C27.5008 21.8366 30.4933 22.3059 30.4933 26.0284C30.4933 28.0153 29.5361 29.5537 28.1004 30.2467C26.9242 30.8141 25.7768 31.2062 24.0977 31.2731L24.0159 31.5579C27.8975 31.5395 30.9257 29.3807 30.9257 26.4078H30.9246Z" fill="#101111"/>
+<path d="M1.15419 16.1422C1.15419 16.1422 0.622571 16.088 0.320438 16.6381C0.0183051 17.1882 -0.11777 17.91 0.124398 18.5812C0.366566 19.2523 0.865892 19.4818 1.3779 19.6617C1.88992 19.8416 3.54127 20.326 3.54127 21.2312C3.54127 21.6925 2.84129 22.8145 2.4838 23.3646C2.12632 23.9147 1.51513 25.3803 1.51513 27.0525C1.51513 28.547 3.13766 30.4578 6.32966 30.4578C7.93027 30.4578 9.47438 29.9988 11.3379 28.9494C11.5628 28.7903 11.4129 28.3878 11.4129 28.3878C11.4129 28.3878 9.30371 29.9654 6.31928 29.9654C4.2424 29.9654 1.92682 28.803 1.92682 26.9948C1.92682 25.1866 2.26816 24.1095 2.67984 23.3888C3.09153 22.6681 3.65659 21.9093 3.65659 21.2174C3.65659 20.5255 2.98544 19.8774 2.48496 19.6733C1.98448 19.4691 1.15419 19.2696 0.773638 19.0079C0.393089 18.7461 0.318132 18.0761 0.318132 17.8374C0.318132 17.5987 0.300834 16.7984 0.839369 16.3313C0.965066 16.2483 1.15419 16.1411 1.15419 16.1411V16.1422Z" fill="#090D0F"/>
+<path d="M14.9855 25.2327C14.9855 25.2327 14.6603 25.0828 14.1206 25.0828C13.3619 25.0828 11.165 26.1057 11.165 27.5772C11.165 29.0486 12.5731 32.5427 9.6244 32.5427C7.83005 32.5427 6.1983 31.3238 6.1983 31.3238C6.1983 31.3238 4.80987 30.2525 3.45488 30.2525C2.0999 30.2525 0.599609 31.4149 0.599609 33.0236C0.599609 34.6323 2.02494 35.8801 2.97055 35.8801C3.91616 35.8801 4.06838 35.1916 4.06838 35.1916C4.06838 35.1916 4.30362 34.6046 3.94614 34.2956C3.58865 33.9865 2.74222 33.5599 2.74222 32.9314C2.74222 32.3029 3.45604 32.3352 3.45604 32.3352C3.45604 32.3352 4.10874 32.2948 4.84331 32.9314C5.57789 33.5679 7.8485 36.0819 10.638 36.0819C12.5938 36.0819 13.3584 35.24 13.6928 34.7522C14.0272 34.2644 14.6546 33.3569 14.078 31.6652C13.438 29.7878 12.3413 27.9877 14.7376 26.635C14.7376 26.6477 13.6674 26.8668 13.1554 28.0961C12.8498 28.8699 13.1969 30.0207 13.4137 30.8799C13.6305 31.739 14.0918 33.3004 13.3492 34.2794C12.783 35.0267 11.9757 35.5918 10.66 35.5918C9.34418 35.5918 8.12065 35.0279 8.12065 35.0279C8.12065 35.0279 7.08855 34.6508 6.24443 33.9404C5.4003 33.23 4.7303 32.6742 4.7303 32.6742C4.7303 32.6742 4.12719 32.1887 3.38454 32.1887C2.64189 32.1887 2.46084 32.6938 2.46084 32.906C2.46084 33.1182 2.57039 33.5783 2.88983 33.8066C3.20926 34.035 3.47795 34.2414 3.60249 34.3913C3.72703 34.5412 3.84581 34.8341 3.68321 35.0901C3.52061 35.3461 3.41337 35.5018 3.00284 35.5018C2.5923 35.5018 2.21406 35.2573 1.94076 35.0394C1.66745 34.8214 1.19119 34.2541 1.07011 33.7801C0.949023 33.3062 0.968627 33.0236 0.968627 33.0236C0.968627 33.0236 1.01129 32.3825 1.29844 31.9085C1.58558 31.4345 2.25558 30.6296 3.45604 30.6296C3.94499 30.6296 4.47314 30.8049 5.25384 31.2754C6.03455 31.7459 7.04243 32.3871 7.04243 32.3871C7.04243 32.3871 7.98803 33.0236 9.56674 33.0236C10.5965 33.0236 11.2827 32.6442 11.6944 32.0711C12.106 31.498 12.008 30.4682 11.7578 29.0048C11.5075 27.5414 11.3438 27.0721 12.1937 26.168C12.9859 25.325 14.0976 25.0598 14.9867 25.2327H14.9855Z" fill="#101111"/>
+<path d="M15.6833 34.6196L15.7525 36.1857C15.7525 36.1857 15.6971 36.5847 16.1688 36.8833C16.6416 37.182 19.6871 39.2001 19.6871 39.2001C19.6871 39.2001 20.0434 39.4376 20.5439 39.1389C21.0444 38.8403 22.8918 37.7263 22.8918 37.7263C22.8918 37.7263 23.1178 37.5845 23.1432 37.2085C23.1686 36.8326 23.2308 35.6425 23.2308 35.6425C23.2308 35.6425 23.262 35.4857 22.984 35.2977C22.7061 35.1097 18.9191 33.448 18.9191 33.448C18.9191 33.448 18.5443 33.2842 18.1372 33.4203C17.7302 33.5564 16.0719 34.1388 16.0719 34.1388C16.0719 34.1388 15.6683 34.3256 15.681 34.6196H15.6833Z" fill="#0E1011"/>
+<path d="M16.2542 34.5147L19.9375 36.482C19.9375 36.482 20.16 36.6365 20.5048 36.482C20.8496 36.3275 22.4053 35.4937 22.4053 35.4937C22.4053 35.4937 22.6601 35.4107 22.2946 35.2412C21.929 35.0728 18.8212 33.5933 18.8212 33.5933C18.8212 33.5933 18.6528 33.4561 18.3276 33.5495C18.0024 33.6429 16.2911 34.2218 16.2911 34.2218C16.2911 34.2218 15.8794 34.314 16.2542 34.5147V34.5147Z" fill="#72CCFA"/>
+<path d="M15.8887 34.7292L15.9959 36.1591C15.9959 36.1591 15.9763 36.4232 16.3995 36.6492C16.8227 36.8753 19.8706 38.9487 19.8706 38.9487C19.8706 38.9487 20.1001 39.0559 20.1001 38.6673C20.1001 38.2787 20.0759 37.1555 20.0759 37.1555C20.0759 37.1555 20.1105 36.8902 19.8902 36.7645C19.6699 36.6388 16.1239 34.6427 16.1239 34.6427C16.1239 34.6427 15.8887 34.5112 15.8887 34.7292Z" fill="#29B4FA"/>
+<path d="M20.3337 38.6673L20.3152 37.0494C20.3152 37.0494 20.2679 36.8199 20.5113 36.6977C20.7557 36.5754 22.7577 35.5941 22.7577 35.5941C22.7577 35.5941 22.9376 35.4834 22.9364 35.7671C22.9353 36.0507 22.8926 37.2108 22.8926 37.2108C22.8926 37.2108 22.8638 37.3884 22.7058 37.4865C22.5478 37.5845 20.5632 38.8103 20.5632 38.8103C20.5632 38.8103 20.3337 38.9637 20.3337 38.6685V38.6673Z" fill="#0F5983"/>
+<path d="M20.6619 38.552C20.6412 38.552 20.6204 38.5462 20.6031 38.5335C20.572 38.5116 20.5547 38.4724 20.5547 38.4274L20.557 36.9271C20.557 36.8499 20.6054 36.7749 20.67 36.753L20.7207 36.7346C20.7553 36.723 20.7899 36.7276 20.8176 36.7461C20.8487 36.768 20.866 36.8072 20.866 36.8522L20.8637 38.3525C20.8637 38.4297 20.8153 38.5047 20.7507 38.5266L20.6988 38.5451C20.6862 38.5497 20.6735 38.552 20.6608 38.552H20.6619ZM20.7611 36.8268L20.7023 36.8453C20.6804 36.8522 20.655 36.8902 20.655 36.9271L20.6527 38.4274C20.6527 38.4424 20.6573 38.4516 20.6596 38.454L20.7184 38.4355C20.7403 38.4274 20.7657 38.3917 20.7657 38.3536L20.768 36.8533C20.768 36.8383 20.7634 36.8291 20.7611 36.8268Z" fill="#05446D"/>
+<path d="M21.1522 38.1957C21.1303 38.1957 21.1083 38.1888 21.091 38.1761C21.0622 38.1542 21.0449 38.1184 21.0449 38.0769L21.0518 36.7069C21.0518 36.6354 21.1026 36.5639 21.166 36.5432L21.2179 36.527C21.2525 36.5155 21.2882 36.5213 21.3159 36.5409C21.3447 36.5616 21.362 36.5985 21.362 36.6389L21.3551 38.0089C21.3551 38.0804 21.3044 38.1518 21.241 38.1726L21.1891 38.1888C21.1764 38.1922 21.1649 38.1945 21.1522 38.1945V38.1957ZM21.2583 36.6204L21.196 36.6377C21.1741 36.6446 21.1499 36.6758 21.1499 36.7081L21.1429 38.078C21.1429 38.0896 21.1464 38.0953 21.1487 38.0965L21.211 38.0792C21.2329 38.0723 21.2571 38.0411 21.2571 38.0089L21.264 36.6389C21.264 36.6273 21.2606 36.6216 21.2583 36.6204Z" fill="#05446D"/>
+<path d="M21.6169 37.867C21.5938 37.867 21.5708 37.8601 21.5535 37.8462C21.5258 37.8255 21.5096 37.792 21.5108 37.7528L21.5212 36.4763C21.5212 36.4082 21.5731 36.3402 21.6365 36.3206L21.6884 36.3044C21.7241 36.2929 21.761 36.2987 21.7887 36.3194C21.8164 36.3402 21.8314 36.3736 21.8314 36.4117L21.821 37.6883C21.821 37.7563 21.7691 37.8243 21.7057 37.8439L21.6538 37.8589C21.6423 37.8624 21.6296 37.8647 21.618 37.8647L21.6169 37.867ZM21.7241 36.399C21.7241 36.399 21.7195 36.399 21.7161 36.4002L21.6653 36.4163C21.6423 36.4232 21.6192 36.4532 21.6192 36.4786L21.6088 37.7551C21.6088 37.7632 21.6111 37.7678 21.6123 37.769C21.6134 37.769 21.6192 37.7701 21.625 37.769L21.6769 37.754C21.7011 37.7471 21.723 37.7171 21.723 37.6917L21.7334 36.4151C21.7334 36.4082 21.7322 36.4036 21.7299 36.4013C21.7299 36.4013 21.7276 36.4013 21.7253 36.4013L21.7241 36.399Z" fill="#05446D"/>
+<path d="M22.0788 37.6064C22.0557 37.6064 22.0338 37.5995 22.0154 37.5856C21.9877 37.5649 21.9716 37.5314 21.9727 37.4922L21.9831 36.2157C21.9831 36.1476 22.035 36.0796 22.0984 36.06L22.1503 36.045C22.1861 36.0346 22.223 36.0404 22.2495 36.06C22.2772 36.0807 22.2933 36.1142 22.2921 36.1534L22.2818 37.43C22.2818 37.498 22.2299 37.566 22.1664 37.5856L22.1146 37.6006C22.103 37.6041 22.0903 37.6064 22.0788 37.6064ZM22.1861 36.1384C22.1861 36.1384 22.1814 36.1384 22.178 36.1396L22.1261 36.1546C22.1019 36.1615 22.08 36.1915 22.08 36.2168L22.0696 37.4934C22.0696 37.5015 22.0719 37.5061 22.073 37.5072H22.0857L22.1376 37.4911C22.1618 37.4842 22.1826 37.4542 22.1837 37.4288L22.1941 36.1522C22.1941 36.1442 22.1918 36.1396 22.1907 36.1384C22.1907 36.1384 22.1884 36.1384 22.1861 36.1384V36.1384Z" fill="#05446D"/>
+<path d="M22.5172 37.3677C22.493 37.3677 22.4711 37.3608 22.4526 37.3469C22.4261 37.3262 22.4111 37.2939 22.4111 37.257L22.4227 36.0219C22.4227 35.9562 22.4746 35.8893 22.5391 35.8697L22.591 35.8547C22.6279 35.8443 22.6637 35.8501 22.6914 35.8709C22.7179 35.8916 22.734 35.9239 22.7329 35.9608L22.7213 37.197C22.7213 37.2651 22.6706 37.3296 22.6049 37.3492L22.553 37.3642C22.5414 37.3677 22.5288 37.3688 22.5172 37.3688V37.3677ZM22.6233 35.947C22.6233 35.947 22.6199 35.947 22.6187 35.947L22.5668 35.962C22.5437 35.9689 22.5218 35.9966 22.5218 36.0208L22.5103 37.2558C22.5149 37.2685 22.5195 37.2685 22.5265 37.2662L22.5783 37.2512C22.6014 37.2443 22.6233 37.2166 22.6245 37.1924L22.636 35.9573C22.6325 35.9481 22.6291 35.9458 22.6245 35.9458L22.6233 35.947Z" fill="#05446D"/>
+<path d="M26.4344 23.134L23.5284 23.8224C23.5284 23.8224 23.1132 23.8328 23.1294 24.3955C23.1455 24.9583 23.2135 26.1334 23.2135 26.1334C23.2135 26.1334 23.3023 26.6558 23.8074 26.8357C24.3125 27.0156 25.9973 27.7605 25.9973 27.7605C25.9973 27.7605 26.213 27.9381 26.5324 27.8228C26.853 27.7063 28.592 27.0202 28.592 27.0202C28.592 27.0202 28.9921 26.1541 28.6496 25.084C28.306 24.015 27.4515 23.1328 26.4344 23.1328V23.134Z" fill="#0E1011"/>
+<path d="M26.3929 27.3338V25.5003C26.3929 25.5003 26.3641 25.2327 26.5751 25.1624C26.7862 25.0921 28.072 24.6412 28.072 24.6412C28.072 24.6412 28.2426 24.5247 28.3579 24.7334C28.4733 24.941 28.5909 25.3446 28.5909 25.7621C28.5909 26.1795 28.4836 26.6235 28.4836 26.6235C28.4836 26.6235 28.4352 26.7861 28.2934 26.8391C28.1515 26.8922 26.5878 27.5011 26.5878 27.5011C26.5878 27.5011 26.3941 27.6267 26.3941 27.3338H26.3929Z" fill="#29B4FA"/>
+<path d="M26.2132 25.5372V27.2381C26.2132 27.2381 26.2512 27.5207 26.1198 27.4699C25.9883 27.4192 23.7327 26.4067 23.7327 26.4067C23.7327 26.4067 23.5113 26.2625 23.4928 25.8889C23.4744 25.5153 23.3959 24.4174 23.3959 24.4174C23.3959 24.4174 23.3798 24.1995 23.5447 24.2837C23.7096 24.3667 25.8061 25.1486 25.9295 25.1901C26.0529 25.2316 26.2132 25.3608 26.2132 25.5383V25.5372Z" fill="#0F5983"/>
+<path d="M23.6336 24.1199L25.8961 24.9202C25.8961 24.9202 26.1129 25.1243 26.6053 24.9433C27.0977 24.7622 28.0099 24.4601 28.0099 24.4601C28.0099 24.4601 28.2152 24.414 28.0964 24.264C27.9776 24.1141 27.6928 23.6932 26.8498 23.3011C26.6515 23.2181 26.3758 23.2965 26.1798 23.3496C25.9838 23.4026 23.6843 23.9481 23.6843 23.9481C23.6843 23.9481 23.4525 24.0565 23.6336 24.1199Z" fill="#72CCFA"/>
+<path d="M18.9929 3.57717C18.9929 3.57717 19.2524 1.47608 19.295 1.23737C19.3377 0.998663 19.5153 0.849903 19.942 0.79801C20.3352 0.749576 22.5147 0.464741 22.5147 0.464741C22.5147 0.464741 23.0129 0.337891 23.5491 0.625033C24.0842 0.912174 26.5762 2.25678 26.7653 2.38594C26.9545 2.51509 27.1263 2.54508 27.0502 3.16203C26.9568 3.91967 26.7538 5.1455 26.7538 5.1455C26.7538 5.1455 26.8057 5.46724 26.4102 5.57909C26.0146 5.69095 23.2389 6.40592 23.2389 6.40592C23.2389 6.40592 22.8849 6.54085 22.3625 6.24217C21.8401 5.9435 19.3031 4.33943 19.1751 4.25294C19.0471 4.16645 18.9249 4.00154 18.9952 3.57717H18.9929Z" fill="#121313"/>
+<path d="M26.7931 4.27137C26.7931 4.27137 27.4666 3.91619 27.4666 2.9775C27.4666 2.19104 26.9027 0.23063 25.4347 0.23063C24.2192 0.23063 23.8848 0.980197 23.8848 0.980197L23.7061 0.82913C23.7061 0.82913 24.1789 -0.00115967 25.4358 -0.00115967C26.6928 -0.00115967 27.7779 1.67672 27.7779 3.04093C27.7779 4.09494 26.7205 4.77993 26.7205 4.77993L26.7954 4.27022L26.7931 4.27137Z" fill="#090D0F"/>
+<path d="M19.2367 3.71669L19.4915 1.46338C19.4915 1.46338 19.4788 1.19353 19.6656 1.31231C19.8524 1.43109 22.838 3.26119 22.838 3.26119C22.838 3.26119 23.0537 3.42378 22.9787 3.85046C22.9038 4.27598 22.755 5.83047 22.755 5.83047C22.755 5.83047 22.7735 6.05534 22.5244 5.91927C22.2764 5.78319 19.3358 4.04304 19.3358 4.04304C19.3358 4.04304 19.2078 3.96462 19.2367 3.71669V3.71669Z" fill="#29B4FA"/>
+<path d="M22.9987 5.98041L23.2397 3.60601C23.2397 3.60601 23.287 3.40651 23.4785 3.37883C23.6699 3.35115 26.7074 2.80801 26.7074 2.80801C26.7074 2.80801 26.9115 2.79417 26.8561 3.12167C26.8008 3.44917 26.5194 5.10168 26.5194 5.10168C26.5194 5.10168 26.4444 5.32079 26.2438 5.40727C26.0431 5.49376 23.2824 6.13032 23.2824 6.13032C23.2824 6.13032 22.9849 6.23872 22.9964 5.98041H22.9987Z" fill="#0F5983"/>
+<path d="M19.9764 1.16241L23.0277 3.05593C23.0277 3.05593 23.173 3.21161 23.6505 3.13204C24.1279 3.05247 26.4596 2.63502 26.4596 2.63502C26.4596 2.63502 26.6084 2.63502 26.5438 2.56929C26.4792 2.50355 23.3898 0.856814 23.3898 0.856814C23.3898 0.856814 23.1292 0.667692 22.5895 0.716126C22.0498 0.764559 20.0099 1.00442 20.0099 1.00442C20.0099 1.00442 19.7908 1.04939 19.9753 1.16356L19.9764 1.16241Z" fill="#72CCFA"/>
+<path d="M25.8687 27.1274C25.8583 27.1274 25.8479 27.1263 25.8364 27.1228L25.788 27.1078C25.7269 27.0882 25.6773 27.0156 25.6738 26.9383L25.5989 25.4172C25.5965 25.37 25.6127 25.3285 25.6427 25.3054C25.668 25.2858 25.7015 25.2812 25.7326 25.2904L25.7811 25.3054C25.8422 25.325 25.8918 25.3976 25.8952 25.4749L25.9702 26.996C25.9725 27.0432 25.9563 27.0847 25.9264 27.1078C25.9091 27.1205 25.8895 27.1274 25.8675 27.1274H25.8687ZM25.8664 27.0282H25.8687C25.8687 27.0282 25.8733 27.019 25.8733 26.9994L25.7983 25.4784C25.796 25.438 25.7695 25.4034 25.7522 25.3976L25.7038 25.3827C25.7038 25.3827 25.6969 25.3907 25.6969 25.4103L25.7718 26.9314C25.7741 26.9729 25.8007 27.0063 25.818 27.0121L25.8664 27.0271V27.0282Z" fill="#05446D"/>
+<path d="M25.3717 26.8703C25.3613 26.8703 25.351 26.8691 25.3406 26.8657L25.2921 26.8518C25.2299 26.8334 25.1803 26.7642 25.1768 26.6904L25.1076 25.2697C25.1053 25.2258 25.1215 25.1866 25.1503 25.1636C25.1757 25.144 25.2091 25.1382 25.2414 25.1474L25.2898 25.1613C25.3521 25.1797 25.4017 25.2489 25.4052 25.3227L25.4744 26.7434C25.4767 26.7872 25.4605 26.8264 25.4317 26.8495C25.4144 26.8634 25.3936 26.8703 25.3717 26.8703V26.8703ZM25.2137 25.242C25.2137 25.242 25.2057 25.2489 25.2057 25.265L25.2749 26.6858C25.276 26.7192 25.3002 26.7515 25.3198 26.7573L25.3683 26.7722H25.3717C25.3717 26.7722 25.3763 26.7642 25.3763 26.7492L25.3071 25.3285C25.306 25.295 25.2818 25.2627 25.2622 25.257L25.2137 25.2431V25.242Z" fill="#05446D"/>
+<path d="M24.8864 26.68C24.876 26.68 24.8656 26.6789 24.8552 26.6754L24.8068 26.6604C24.7445 26.642 24.6949 26.5728 24.6915 26.499L24.6223 25.0783C24.62 25.0344 24.6361 24.9952 24.665 24.9722C24.6903 24.9526 24.7238 24.9468 24.7561 24.956L24.8045 24.971C24.8668 24.9895 24.9163 25.0586 24.9198 25.1324L24.989 26.5532C24.9913 26.597 24.9763 26.6362 24.9463 26.6593C24.929 26.6731 24.9083 26.68 24.8864 26.68V26.68ZM24.8829 26.5808C24.8829 26.5808 24.8852 26.5808 24.8864 26.5808C24.8864 26.5808 24.8921 26.5797 24.891 26.5578L24.8218 25.1371C24.8206 25.1036 24.7964 25.0713 24.7768 25.0656L24.7284 25.0506C24.7284 25.0506 24.7203 25.0575 24.7203 25.0736L24.7895 26.4944C24.7907 26.5278 24.8149 26.5601 24.8345 26.5659L24.8829 26.5797V26.5808Z" fill="#05446D"/>
+<path d="M24.4039 26.4748C24.3936 26.4748 24.3832 26.4736 24.3728 26.4701L24.3244 26.4563C24.2621 26.4379 24.2125 26.3687 24.2091 26.2949L24.1399 24.8741C24.1376 24.8303 24.1537 24.7911 24.1825 24.7681C24.2079 24.7485 24.2413 24.7427 24.2736 24.7519L24.3221 24.7657C24.3843 24.7842 24.4339 24.8534 24.4374 24.9272L24.5066 26.3479C24.5089 26.3917 24.4927 26.4309 24.4639 26.454C24.4466 26.4678 24.4259 26.4748 24.4039 26.4748V26.4748ZM24.246 24.8465C24.246 24.8465 24.2379 24.8534 24.2379 24.8695L24.3071 26.2903C24.3082 26.3237 24.3324 26.356 24.3521 26.3618L24.4005 26.3756C24.4005 26.3756 24.4028 26.3756 24.4039 26.3756C24.4039 26.3756 24.4086 26.3687 24.4074 26.3525L24.3382 24.9318C24.3371 24.8984 24.3128 24.8661 24.2932 24.8603L24.2448 24.8465H24.246Z" fill="#05446D"/>
+<path d="M23.9134 26.2649C23.903 26.2649 23.8926 26.2637 23.8834 26.2602L23.835 26.2464C23.7727 26.2291 23.7231 26.1611 23.7196 26.0884L23.6516 24.7069C23.6493 24.6642 23.6643 24.6262 23.6931 24.6031C23.7185 24.5835 23.7531 24.5766 23.7854 24.5858L23.8338 24.5997C23.8961 24.617 23.9457 24.685 23.9491 24.7576L24.0172 26.1392C24.0195 26.1818 24.0045 26.2199 23.9756 26.2429C23.9583 26.2568 23.9364 26.2637 23.9145 26.2637L23.9134 26.2649ZM23.7577 24.6815C23.7577 24.6815 23.7485 24.6885 23.7496 24.7023L23.8177 26.0838C23.8188 26.1161 23.843 26.1472 23.8615 26.1518L23.9099 26.1657C23.9099 26.1657 23.9134 26.1657 23.9145 26.1657C23.9145 26.1657 23.9191 26.1588 23.918 26.1449L23.8499 24.7634C23.8488 24.7311 23.8257 24.7 23.8061 24.6954L23.7577 24.6815Z" fill="#05446D"/>
+<path d="M23.4958 5.81782H23.4128C23.3678 5.81552 23.3263 5.79591 23.2974 5.76247C23.2675 5.72672 23.2536 5.67829 23.2605 5.62986L23.5246 3.69713C23.5373 3.60141 23.6261 3.52761 23.7137 3.52876H23.7922C23.8371 3.53107 23.8786 3.55067 23.9075 3.58411C23.9375 3.61986 23.9513 3.6683 23.9444 3.71788L23.6803 5.65061C23.6676 5.74517 23.5857 5.81898 23.4946 5.81898L23.4958 5.81782ZM23.7114 3.62678C23.6699 3.62678 23.6296 3.66484 23.6238 3.70981L23.3597 5.64254C23.3563 5.66445 23.362 5.68405 23.3736 5.69905C23.3839 5.71173 23.3989 5.7175 23.4162 5.71865H23.4969C23.5385 5.7198 23.5788 5.6829 23.5846 5.63677L23.8487 3.70404C23.8521 3.68213 23.8464 3.66253 23.8348 3.64754C23.8244 3.63485 23.8095 3.62909 23.7922 3.62793H23.7126L23.7114 3.62678Z" fill="#05446D"/>
+<path d="M24.1577 5.69097H24.1543L24.0758 5.68867C24.0309 5.68867 23.9894 5.66906 23.9605 5.63447C23.9305 5.59872 23.9167 5.55028 23.9236 5.50185L24.1877 3.56912C24.2004 3.47456 24.2811 3.40076 24.3734 3.40076H24.3768L24.4552 3.40306C24.5002 3.40306 24.5406 3.42267 24.5694 3.45726C24.5994 3.49301 24.6132 3.54144 24.6063 3.58988L24.3422 5.52261C24.3295 5.61717 24.2488 5.69097 24.1566 5.69097H24.1577ZM24.1566 5.59295H24.1577C24.1992 5.59295 24.2396 5.5549 24.2454 5.50992L24.5094 3.57719C24.5129 3.55528 24.5071 3.53568 24.4956 3.52184C24.4852 3.50916 24.4702 3.50339 24.4529 3.50224L24.3745 3.49993H24.3734C24.3319 3.49993 24.2915 3.53799 24.2857 3.58296L24.0216 5.51569C24.0182 5.5376 24.024 5.5572 24.0355 5.57104C24.0459 5.58373 24.0609 5.58949 24.0782 5.59065L24.1566 5.59295Z" fill="#05446D"/>
+<path d="M24.821 5.5537H24.738C24.693 5.5514 24.6515 5.53179 24.6226 5.49835C24.5927 5.4626 24.5788 5.41417 24.5857 5.36458L24.8498 3.43185C24.8625 3.33729 24.9432 3.26349 25.0355 3.26349H25.1185C25.1635 3.2658 25.205 3.2854 25.2338 3.31884C25.2638 3.35459 25.2776 3.40302 25.2707 3.45261L25.0066 5.38534C24.994 5.4799 24.9132 5.5537 24.821 5.5537V5.5537ZM25.0366 3.36266C24.9951 3.36266 24.9548 3.40072 24.949 3.44569L24.6849 5.37842C24.6815 5.40033 24.6872 5.41994 24.6987 5.43493C24.7091 5.44761 24.7241 5.45338 24.7414 5.45453H24.8221C24.8637 5.45568 24.904 5.41878 24.9098 5.37266L25.1739 3.43993C25.1773 3.41801 25.1716 3.39841 25.16 3.38342C25.1496 3.37073 25.1346 3.36497 25.1174 3.36382H25.0366V3.36266Z" fill="#05446D"/>
+<path d="M25.4313 5.40381H25.3483C25.3033 5.4015 25.2618 5.3819 25.233 5.34846C25.203 5.31271 25.1892 5.26427 25.1961 5.21584L25.4602 3.28311C25.4729 3.18855 25.5547 3.11475 25.6458 3.11475H25.7277C25.7727 3.11705 25.8142 3.13666 25.843 3.1701C25.873 3.20585 25.8868 3.25428 25.8799 3.30271L25.6158 5.23544C25.6032 5.33001 25.5224 5.40381 25.4313 5.40381V5.40381ZM25.647 3.21277C25.6055 3.21277 25.5651 3.25082 25.5593 3.2958L25.2953 5.22853C25.2918 5.25044 25.2976 5.27004 25.3091 5.28503C25.3195 5.29772 25.3345 5.30348 25.3518 5.30464H25.4313C25.4729 5.30579 25.5132 5.26889 25.519 5.22391L25.7831 3.29118C25.7865 3.26927 25.7808 3.24967 25.7692 3.23468C25.7588 3.22199 25.7438 3.21623 25.7265 3.21507H25.647V3.21277Z" fill="#05446D"/>
+<path d="M26.0825 5.28156H26.0007C25.9557 5.27925 25.9142 5.25964 25.8853 5.2262C25.8554 5.19045 25.8415 5.14202 25.8484 5.09359L26.1125 3.16086C26.1252 3.0663 26.2071 2.99249 26.2982 2.99249H26.38C26.425 2.9948 26.4665 3.0144 26.4954 3.04785C26.5253 3.08359 26.5392 3.13203 26.5323 3.18046L26.2682 5.11319C26.2555 5.20775 26.1736 5.28156 26.0825 5.28156V5.28156ZM26.2982 3.09051C26.2567 3.09051 26.2163 3.12857 26.2105 3.17354L25.9465 5.10627C25.943 5.12818 25.9488 5.14779 25.9603 5.16278C25.9707 5.17546 25.9857 5.18123 26.003 5.18238H26.0825C26.124 5.18353 26.1644 5.14663 26.1702 5.10051L26.4342 3.16778C26.4377 3.14587 26.4319 3.12626 26.4204 3.11127C26.41 3.09859 26.395 3.09282 26.3777 3.09167H26.2982V3.09051Z" fill="#05446D"/>
+</g>
+<defs>
+<clipPath id="clip0_9452_431191">
+<rect width="30.9248" height="39.29" fill="white"/>
+</clipPath>
+</defs>
+</svg>
diff --git a/app/assets/ico/vendor/docker-icon.svg b/app/assets/ico/vendor/docker-icon.svg
new file mode 100644
index 0000000..0e2cbe5
--- /dev/null
+++ b/app/assets/ico/vendor/docker-icon.svg
@@ -0,0 +1,9 @@
+<!--
+This exists because it has 'fill:currentColor' unlike the other docker icon assets
+and can directly replace fa-docker.
+-->
+<svg width="34" height="24" viewBox="0 0 34 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <path d="M19.0332 9.67619H22.2271ZM15.2309 9.67619H18.4249ZM11.5047 9.67619H14.6986ZM7.77848 9.67619H10.8963ZM3.9762 9.67619H7.17011ZM7.77848 6.17809H10.8963ZM11.5047 6.17809H14.6986ZM15.2309 6.17809H18.4249ZM15.2309 2.67999H18.4249Z" fill="currentColor" />
+  <path d="M19.0332 9.67619H22.2271M15.2309 9.67619H18.4249M11.5047 9.67619H14.6986M7.77848 9.67619H10.8963M3.9762 9.67619H7.17011M7.77848 6.17809H10.8963M11.5047 6.17809H14.6986M15.2309 6.17809H18.4249M15.2309 2.67999H18.4249" stroke="currentColor" stroke-width="2.887" />
+  <path d="M32.4172 9.82825C32.4172 9.82825 31.0484 8.53548 28.2347 8.99175C27.9305 6.78643 25.5731 5.49365 25.5731 5.49365C25.5731 5.49365 23.3678 8.15525 24.9647 11.121C24.5085 11.3492 23.748 11.6533 22.6073 11.6533H1.69477C1.31454 13.0982 1.31454 22.68 11.8088 22.68C19.3374 22.68 24.9647 19.1819 27.6263 12.794C31.5807 13.0982 32.4172 9.82825 32.4172 9.82825Z" fill="currentColor" />
+</svg>
diff --git a/app/assets/ico/vendor/docker.svg b/app/assets/ico/vendor/docker.svg
new file mode 100644
index 0000000..083a3e3
--- /dev/null
+++ b/app/assets/ico/vendor/docker.svg
@@ -0,0 +1,12 @@
+<svg width="36" height="40" viewBox="0 0 36 40" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M35.4922 15.9246C35.3922 15.8398 34.4945 15.1435 32.5666 15.1435C32.0681 15.1435 31.5526 15.1942 31.0542 15.2798C30.6883 12.6808 28.5774 11.4236 28.4945 11.3563L27.979 11.0505L27.6464 11.5432C27.2309 12.2055 26.9154 12.9533 26.7325 13.7177C26.3836 15.1958 26.5991 16.5884 27.3309 17.7774C26.4495 18.2867 25.0201 18.4055 24.7208 18.423H1.11614C0.501408 18.423 0.00218188 18.9323 0.00218188 19.5613C-0.0311515 21.6676 0.317686 23.7739 1.03242 25.7613C1.84715 27.9358 3.06033 29.5494 4.62312 30.5348C6.38514 31.639 9.26112 32.2672 12.5022 32.2672C13.965 32.2672 15.4278 32.1309 16.8743 31.8592C18.8859 31.4853 20.8139 30.7724 22.5929 29.7363C24.0557 28.8697 25.3689 27.7663 26.4829 26.4751C28.3612 24.3181 29.4751 21.906 30.2898 19.7656H30.6224C32.6674 19.7656 33.9302 18.9331 34.6286 18.2202C35.0937 17.7782 35.4433 17.2348 35.6922 16.6232L35.8418 16.1812L35.493 15.9262L35.4922 15.9246Z" fill="#0091E2"/>
+<path d="M3.30931 17.7251H6.46746C6.61707 17.7251 6.75041 17.6062 6.75041 17.4359V14.5486C6.75041 14.3957 6.63413 14.2603 6.46746 14.2603H3.30931C3.1597 14.2603 3.02637 14.3791 3.02637 14.5486V17.4359C3.04265 17.6055 3.1597 17.7251 3.30931 17.7251Z" fill="#0091E2"/>
+<path d="M7.66576 17.7251H10.8239C10.9735 17.7251 11.1061 17.6062 11.1061 17.4359V14.5486C11.1061 14.3957 10.9898 14.2603 10.8239 14.2603H7.66576C7.51615 14.2603 7.38281 14.3791 7.38281 14.5486V17.4359C7.39909 17.6055 7.51615 17.7251 7.66576 17.7251Z" fill="#0091E2"/>
+<path d="M12.1042 17.7251H15.2624C15.412 17.7251 15.5453 17.6062 15.5453 17.4359V14.5486C15.5453 14.3957 15.429 14.2603 15.2624 14.2603H12.1042C11.9546 14.2603 11.8213 14.3791 11.8213 14.5486V17.4359C11.8213 17.6055 11.9376 17.7251 12.1042 17.7251Z" fill="#0091E2"/>
+<path d="M16.4753 17.7251H19.6335C19.7831 17.7251 19.9164 17.6062 19.9164 17.4359V14.5486C19.9164 14.3957 19.8001 14.2603 19.6335 14.2603H16.4753C16.3257 14.2603 16.1924 14.3791 16.1924 14.5486V17.4359C16.1924 17.6055 16.3257 17.7251 16.4753 17.7251V17.7251Z" fill="#0091E2"/>
+<path d="M7.66576 13.5972H10.8239C10.9735 13.5972 11.1061 13.4609 11.1061 13.3081V10.4207C11.1061 10.2678 10.9898 10.1316 10.8239 10.1316H7.66576C7.51615 10.1316 7.38281 10.2504 7.38281 10.4207V13.3081C7.39909 13.4609 7.51615 13.5972 7.66576 13.5972Z" fill="#0091E2"/>
+<path d="M12.1042 13.5972H15.2624C15.412 13.5972 15.5453 13.4609 15.5453 13.3081V10.4207C15.5453 10.2678 15.429 10.1316 15.2624 10.1316H12.1042C11.9546 10.1316 11.8213 10.2504 11.8213 10.4207V13.3081C11.8213 13.4609 11.9376 13.5972 12.1042 13.5972Z" fill="#0091E2"/>
+<path d="M16.4753 13.5972H19.6335C19.7831 13.5972 19.9164 13.4609 19.9164 13.3081V10.4207C19.9164 10.2678 19.7831 10.1316 19.6335 10.1316H16.4753C16.3257 10.1316 16.1924 10.2504 16.1924 10.4207V13.3081C16.1924 13.4609 16.3257 13.5972 16.4753 13.5972V13.5972Z" fill="#0091E2"/>
+<path d="M16.4753 9.45279H19.6335C19.7831 9.45279 19.9164 9.33397 19.9164 9.16366V6.27631C19.9164 6.12343 19.7831 5.98718 19.6335 5.98718H16.4753C16.3257 5.98718 16.1924 6.106 16.1924 6.27631V9.16366C16.1924 9.31654 16.3257 9.45279 16.4753 9.45279V9.45279Z" fill="#0091E2"/>
+<path d="M20.8826 17.7251H24.0407C24.1903 17.7251 24.3237 17.6062 24.3237 17.4359V14.5486C24.3237 14.3957 24.2074 14.2603 24.0407 14.2603H20.8826C20.7329 14.2603 20.5996 14.3791 20.5996 14.5486V17.4359C20.6159 17.6055 20.7329 17.7251 20.8826 17.7251Z" fill="#0091E2"/>
+</svg>
diff --git a/app/assets/ico/vendor/ecr.svg b/app/assets/ico/vendor/ecr.svg
new file mode 100644
index 0000000..5119fbc
--- /dev/null
+++ b/app/assets/ico/vendor/ecr.svg
@@ -0,0 +1,23 @@
+<svg width="auto" height="auto" viewBox="0 0 37 41" fill="none" xmlns="http://www.w3.org/2000/svg">
+    <g clip-path="url(#clip0_11049_510847)">
+        <path d="M13.2486 34.6999C13.1255 34.6999 13.0025 34.6675 12.8931 34.6027L1.34493 27.7706C1.13206 27.6448 1 27.4122 1 27.1636V12.6471C1 12.3949 1.13523 12.1607 1.35339 12.0354L13.9776 4.79229C14.1942 4.66803 14.463 4.66909 14.678 4.79601L26.0065 11.4523C26.2236 11.5803 26.3535 11.8076 26.3535 12.0604C26.3535 12.3137 26.2236 12.5409 26.0059 12.6684L13.9491 19.7389V33.9963C13.9491 34.2485 13.8138 34.4827 13.5962 34.6075C13.489 34.6691 13.3685 34.6999 13.2486 34.6999V34.6999ZM1.84517 27.0803L13.1039 33.7414V19.655C13.1039 19.4054 13.237 19.1723 13.4515 19.047L25.3662 12.0604L14.3241 5.57183L1.84517 12.7316V27.0803Z"
+              fill="url(#paint0_linear_11049_510847)"/>
+        <path d="M15.7668 34.703C15.6459 34.703 15.5254 34.6717 15.4172 34.6096C15.2006 34.4842 15.0664 34.2506 15.0664 33.9994V27.8475C15.0664 27.5985 15.199 27.3659 15.4129 27.24L21.0428 23.9244V17.1358C21.0428 16.8878 21.1749 16.6552 21.3872 16.5294L26.9215 13.2477C27.1375 13.1197 27.4069 13.1176 27.6246 13.2429C27.8422 13.3677 27.9774 13.6024 27.9774 13.8541V27.2836C27.9774 27.5337 27.8438 27.7668 27.6288 27.8927L16.1176 34.6085C16.0093 34.6717 15.8878 34.7035 15.7658 34.7035L15.7668 34.703ZM15.9116 27.9304V33.7461L27.1333 27.1992V14.109L21.888 17.2186V24.0072C21.888 24.2562 21.7554 24.4888 21.5415 24.6147L15.911 27.9304H15.9116Z"
+              fill="url(#paint1_linear_11049_510847)"/>
+    </g>
+    <defs>
+        <linearGradient id="paint0_linear_11049_510847" x1="1.42681" y1="19.7002" x2="18.9678" y2="19.7002"
+                        gradientUnits="userSpaceOnUse">
+            <stop stop-color="#DF6B4A"/>
+            <stop offset="1" stop-color="#E99B41"/>
+        </linearGradient>
+        <linearGradient id="paint1_linear_11049_510847" x1="15.7906" y1="23.9265" x2="23.5715" y2="23.9265"
+                        gradientUnits="userSpaceOnUse">
+            <stop stop-color="#DF6B4A"/>
+            <stop offset="1" stop-color="#E99B41"/>
+        </linearGradient>
+        <clipPath id="clip0_11049_510847">
+            <rect width="27" height="30" fill="white" transform="translate(1 4.69983)"/>
+        </clipPath>
+    </defs>
+</svg>
\ No newline at end of file
diff --git a/app/assets/ico/vendor/github.svg b/app/assets/ico/vendor/github.svg
new file mode 100644
index 0000000..a8d1174
--- /dev/null
+++ b/app/assets/ico/vendor/github.svg
@@ -0,0 +1,3 @@
+<svg width="1024" height="1024" viewBox="0 0 1024 1024" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path fill-rule="evenodd" clip-rule="evenodd" d="M8 0C3.58 0 0 3.58 0 8C0 11.54 2.29 14.53 5.47 15.59C5.87 15.66 6.02 15.42 6.02 15.21C6.02 15.02 6.01 14.39 6.01 13.72C4 14.09 3.48 13.23 3.32 12.78C3.23 12.55 2.84 11.84 2.5 11.65C2.22 11.5 1.82 11.13 2.49 11.12C3.12 11.11 3.57 11.7 3.72 11.94C4.44 13.15 5.59 12.81 6.05 12.6C6.12 12.08 6.33 11.73 6.56 11.53C4.78 11.33 2.92 10.64 2.92 7.58C2.92 6.71 3.23 5.99 3.74 5.43C3.66 5.23 3.38 4.41 3.82 3.31C3.82 3.31 4.49 3.1 6.02 4.13C6.66 3.95 7.34 3.86 8.02 3.86C8.7 3.86 9.38 3.95 10.02 4.13C11.55 3.09 12.22 3.31 12.22 3.31C12.66 4.41 12.38 5.23 12.3 5.43C12.81 5.99 13.12 6.7 13.12 7.58C13.12 10.65 11.25 11.33 9.47 11.53C9.76 11.78 10.01 12.26 10.01 13.01C10.01 14.08 10 14.94 10 15.21C10 15.42 10.15 15.67 10.55 15.59C13.71 14.53 16 11.53 16 8C16 3.58 12.42 0 8 0Z" transform="scale(64)" fill="#1B1F23"/>
+</svg>
diff --git a/app/assets/ico/vendor/gitlab.svg b/app/assets/ico/vendor/gitlab.svg
new file mode 100644
index 0000000..5e5cb91
--- /dev/null
+++ b/app/assets/ico/vendor/gitlab.svg
@@ -0,0 +1,9 @@
+<svg width="36" height="40" viewBox="0 0 36 40" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M13.7992 32.71L18.8805 17.0721H8.71777L13.7992 32.71Z" fill="#E24329"/>
+<path d="M13.7995 32.71L8.71811 17.0721H1.59668L13.7995 32.71Z" fill="#FC6D26"/>
+<path d="M1.59571 17.0721L0.0515681 21.8243C-0.0892746 22.2577 0.0649817 22.7326 0.433724 23.0004L13.7985 32.71L1.59571 17.0721Z" fill="#FCA326"/>
+<path d="M1.59668 17.0721H8.71811L5.65758 7.65352C5.50017 7.16881 4.8145 7.16895 4.65708 7.65352L1.59668 17.0721Z" fill="#E24329"/>
+<path d="M13.8008 32.71L18.8822 17.0721H26.0036L13.8008 32.71Z" fill="#FC6D26"/>
+<path d="M26.0036 17.0721L27.5477 21.8243C27.6886 22.2577 27.5343 22.7326 27.1656 23.0004L13.8008 32.71L26.0036 17.0721Z" fill="#FCA326"/>
+<path d="M26.0023 17.0721H18.8809L21.9414 7.65352C22.0988 7.16881 22.7845 7.16895 22.9419 7.65352L26.0023 17.0721Z" fill="#E24329"/>
+</svg>
diff --git a/app/assets/ico/vendor/google.svg b/app/assets/ico/vendor/google.svg
new file mode 100644
index 0000000..c652a5a
--- /dev/null
+++ b/app/assets/ico/vendor/google.svg
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="utf-8"?>
+<svg viewBox="0 0 24 24" width="24" height="24" xmlns="http://www.w3.org/2000/svg">
+  <g transform="matrix(1, 0, 0, 1, 27.009001, -39.238998)">
+    <path fill="#4285F4" d="M -3.264 51.509 C -3.264 50.719 -3.334 49.969 -3.454 49.239 L -14.754 49.239 L -14.754 53.749 L -8.284 53.749 C -8.574 55.229 -9.424 56.479 -10.684 57.329 L -10.684 60.329 L -6.824 60.329 C -4.564 58.239 -3.264 55.159 -3.264 51.509 Z"/>
+    <path fill="#34A853" d="M -14.754 63.239 C -11.514 63.239 -8.804 62.159 -6.824 60.329 L -10.684 57.329 C -11.764 58.049 -13.134 58.489 -14.754 58.489 C -17.884 58.489 -20.534 56.379 -21.484 53.529 L -25.464 53.529 L -25.464 56.619 C -23.494 60.539 -19.444 63.239 -14.754 63.239 Z"/>
+    <path fill="#FBBC05" d="M -21.484 53.529 C -21.734 52.809 -21.864 52.039 -21.864 51.239 C -21.864 50.439 -21.724 49.669 -21.484 48.949 L -21.484 45.859 L -25.464 45.859 C -26.284 47.479 -26.754 49.299 -26.754 51.239 C -26.754 53.179 -26.284 54.999 -25.464 56.619 L -21.484 53.529 Z"/>
+    <path fill="#EA4335" d="M -14.754 43.989 C -12.984 43.989 -11.404 44.599 -10.154 45.789 L -6.734 42.369 C -8.804 40.429 -11.514 39.239 -14.754 39.239 C -19.444 39.239 -23.494 41.939 -25.464 45.859 L -21.484 48.949 C -20.534 46.099 -17.884 43.989 -14.754 43.989 Z"/>
+  </g>
+</svg>
\ No newline at end of file
diff --git a/app/assets/ico/vendor/googlecloud.svg b/app/assets/ico/vendor/googlecloud.svg
new file mode 100644
index 0000000..b8478f1
--- /dev/null
+++ b/app/assets/ico/vendor/googlecloud.svg
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg width="256px" height="206px" viewBox="0 0 256 206" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" preserveAspectRatio="xMidYMid">
+		<g>
+				<path d="M170.2517,56.8186 L192.5047,34.5656 L193.9877,25.1956 C153.4367,-11.6774 88.9757,-7.4964 52.4207,33.9196 C42.2667,45.4226 34.7337,59.7636 30.7167,74.5726 L38.6867,73.4496 L83.1917,66.1106 L86.6277,62.5966 C106.4247,40.8546 139.8977,37.9296 162.7557,56.4286 L170.2517,56.8186 Z" fill="#EA4335"></path>
+				<path d="M224.2048,73.9182 C219.0898,55.0822 208.5888,38.1492 193.9878,25.1962 L162.7558,56.4282 C175.9438,67.2042 183.4568,83.4382 183.1348,100.4652 L183.1348,106.0092 C198.4858,106.0092 210.9318,118.4542 210.9318,133.8052 C210.9318,149.1572 198.4858,161.2902 183.1348,161.2902 L127.4638,161.2902 L121.9978,167.2242 L121.9978,200.5642 L127.4638,205.7952 L183.1348,205.7952 C223.0648,206.1062 255.6868,174.3012 255.9978,134.3712 C256.1858,110.1682 244.2528,87.4782 224.2048,73.9182" fill="#4285F4"></path>
+				<path d="M71.8704,205.7957 L127.4634,205.7957 L127.4634,161.2897 L71.8704,161.2897 C67.9094,161.2887 64.0734,160.4377 60.4714,158.7917 L52.5844,161.2117 L30.1754,183.4647 L28.2234,191.0387 C40.7904,200.5277 56.1234,205.8637 71.8704,205.7957" fill="#34A853"></path>
+				<path d="M71.8704,61.4255 C31.9394,61.6635 -0.2366,94.2275 0.0014,134.1575 C0.1344,156.4555 10.5484,177.4455 28.2234,191.0385 L60.4714,158.7915 C46.4804,152.4705 40.2634,136.0055 46.5844,122.0155 C52.9044,108.0255 69.3704,101.8085 83.3594,108.1285 C89.5244,110.9135 94.4614,115.8515 97.2464,122.0155 L129.4944,89.7685 C115.7734,71.8315 94.4534,61.3445 71.8704,61.4255" fill="#FBBC05"></path>
+		</g>
+</svg>
diff --git a/app/assets/ico/vendor/helm.svg b/app/assets/ico/vendor/helm.svg
new file mode 100644
index 0000000..fbc279f
--- /dev/null
+++ b/app/assets/ico/vendor/helm.svg
@@ -0,0 +1,10 @@
+<svg width="auto" height="auto" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <g clip-path="url(#clip0_2026_8347)">
+    <path d="M2.03394 12.0799L21.9659 12.0799M4.05923 7.91314C4.44428 7.25611 4.90783 6.65064 5.437 6.10964M5.437 6.10964C7.12201 4.38695 9.4724 3.31777 12.0725 3.31777C14.6331 3.31777 16.9516 4.35473 18.6308 6.03161M5.437 6.10964L3.87003 4.54238M5.437 6.10964L5.44586 6.1185M18.6308 6.03161C19.1922 6.59221 19.6821 7.22434 20.0858 7.91314M18.6308 6.03161L20.1869 4.47547M18.6308 6.03161L18.6243 6.03807M11.9948 1.04492L11.9948 3.31804M19.969 16.069C19.584 16.726 19.1204 17.3315 18.5912 17.8725M18.5912 17.8725C16.9062 19.5952 14.5559 20.6643 11.9557 20.6643C9.39512 20.6643 7.07669 19.6274 5.39746 17.9505M18.5912 17.8725L20.1582 19.4397M18.5912 17.8725L18.5824 17.8636M5.39746 17.9505C4.83608 17.3899 4.34614 16.7578 3.94248 16.069M5.39746 17.9505L3.84132 19.5066M5.39746 17.9505L5.40392 17.944M12.0335 22.9372L12.0335 20.6641" stroke="currentColor" stroke-width="2" stroke-linecap="round"/>
+  </g>
+  <defs>
+    <clipPath id="clip0_2026_8347">
+      <rect width="24" height="24" fill="white" transform="translate(24) rotate(90)"/>
+    </clipPath>
+  </defs>
+</svg>
\ No newline at end of file
diff --git a/app/assets/ico/vendor/install-kubernetes.svg b/app/assets/ico/vendor/install-kubernetes.svg
new file mode 100644
index 0000000..075065f
--- /dev/null
+++ b/app/assets/ico/vendor/install-kubernetes.svg
@@ -0,0 +1,6 @@
+<svg width="36" height="32" viewBox="0 0 36 32" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M26.1865 14.6468C26.381 15.5368 26.4174 16.4262 26.3331 17.3162L22.1137 16.1121C21.7142 16.0229 21.4917 15.6215 21.5806 15.2201C21.6253 15.0863 21.6694 14.9971 21.7583 14.9079L23.3738 13.4375C22.7058 12.9669 22.1195 12.3891 21.6396 11.7291L20.1149 12.8118C19.8043 12.9902 19.36 12.9456 19.1376 12.6334C19.0487 12.5442 19.0046 12.455 19.0046 12.3212L18.7381 7.81741C19.2653 7.87752 19.7757 7.98481 20.2667 8.13283C20.242 7.88851 20.2297 7.64031 20.2297 7.38952C20.2297 6.82267 20.2939 6.27132 20.4152 5.74067C19.8354 5.5849 19.2446 5.47243 18.6492 5.40909L18.6045 5.0523V5.0969C18.4715 5.0077 18.4268 4.8739 18.3827 4.74011C18.3827 4.24953 18.3827 3.75894 18.4715 3.22376V3.17916C18.4715 3.08996 18.5163 3.00077 18.5163 2.91157C18.5604 2.73318 18.5604 2.55478 18.6051 2.37639V2.1088C18.6499 1.66281 18.2945 1.21683 17.8502 1.17223C17.5837 1.12763 17.3171 1.26143 17.0953 1.48442C16.9176 1.66281 16.8288 1.8858 16.8288 2.1088V2.33179C16.8288 2.51018 16.8735 2.68858 16.9176 2.86697C16.9624 2.95617 16.9624 3.04537 16.9624 3.13456V3.17916C17.0512 3.66974 17.0512 4.16033 17.0512 4.69551C17.0071 4.82931 16.9624 4.9631 16.8294 5.0523V5.1415L16.7847 5.49828C16.2963 5.54288 15.8073 5.63208 15.2742 5.72128C13.1866 6.16726 11.2767 7.28158 9.81097 8.84253L9.54442 8.66413H9.49967C9.45492 8.66413 9.41082 8.70873 9.32197 8.70873C9.23312 8.70873 9.14427 8.66413 9.05542 8.61953C8.65592 8.30734 8.25578 7.95056 7.94513 7.59377C7.90103 7.50457 7.81218 7.45997 7.76743 7.41537C7.63383 7.28158 7.54498 7.14778 7.41203 7.01399C7.36793 6.96939 7.32318 6.96939 7.27908 6.92479L7.23498 6.88019C7.05728 6.7464 6.83548 6.6572 6.61304 6.6572C6.34649 6.6572 6.12469 6.7464 5.99109 6.96939C5.72454 7.37077 5.81339 7.90596 6.16879 8.21815C6.21289 8.21815 6.21289 8.26274 6.21289 8.26274C6.21289 8.26274 6.30174 8.35194 6.34584 8.35194C6.47879 8.44114 6.65649 8.53034 6.83419 8.61953C6.92304 8.66413 7.01189 8.70873 7.10074 8.75333C7.54498 9.02092 7.98923 9.28851 8.34463 9.6453C8.42569 9.72674 8.50546 9.88122 8.48536 10.0098L8.74412 10.2697C8.69938 10.3589 8.65528 10.4035 8.61117 10.4927C7.23433 12.6774 6.65649 15.2641 7.05664 17.8055L6.70124 17.8947C6.70124 17.9393 6.65714 17.9393 6.65714 17.9393C6.61304 18.0731 6.47944 18.1623 6.34649 18.2515C5.85814 18.3853 5.36915 18.4745 4.83605 18.5191C4.7472 18.5191 4.65835 18.5191 4.5695 18.5637C4.3918 18.5637 4.2141 18.6083 4.03641 18.6083C3.9923 18.6083 3.94756 18.6529 3.85871 18.6529C3.82931 18.6529 3.79969 18.6678 3.76986 18.6975C3.28151 18.7867 2.97021 19.2327 3.05906 19.7233C3.14791 20.1247 3.54741 20.3922 3.94756 20.3476C4.03641 20.3476 4.08051 20.3476 4.16935 20.303C4.19876 20.303 4.21346 20.2882 4.21346 20.2584C4.21346 20.2139 4.34641 20.2584 4.39115 20.2584C4.56885 20.2139 4.74655 20.1247 4.8795 20.0801C4.96835 20.0355 5.0572 19.9909 5.14605 19.9909H5.19015C5.6785 19.8125 6.12274 19.6787 6.65584 19.5895H6.69994C6.83289 19.5895 6.96649 19.6341 7.05534 19.7233C7.09944 19.7233 7.09944 19.7679 7.09944 19.7679L7.49894 19.7233C8.16498 21.7742 9.40887 23.6027 11.1411 24.94C11.5406 25.2522 11.896 25.5198 12.3403 25.7428L12.1185 26.055C12.1185 26.0996 12.1626 26.0996 12.1626 26.0996C12.2514 26.2334 12.2514 26.4118 12.2073 26.5455C12.0296 26.9915 11.7631 27.4375 11.4965 27.8389V27.8835C11.4524 27.9727 11.4077 28.0173 11.3188 28.1065C11.23 28.1957 11.1411 28.3741 11.0082 28.5525C10.9641 28.5971 10.9641 28.6417 10.9193 28.6863C10.9193 28.6863 10.9193 28.7309 10.8746 28.7309C10.6528 29.1769 10.8305 29.712 11.23 29.935C11.3188 29.9796 11.4518 30.0242 11.5406 30.0242C11.896 30.0242 12.2067 29.8012 12.3844 29.489C12.3844 29.489 12.3844 29.4444 12.4285 29.4444C12.4285 29.3998 12.4732 29.3553 12.5173 29.3107C12.5614 29.1323 12.6503 28.9985 12.695 28.8201L12.7839 28.5525C12.9168 28.0619 13.1393 27.6159 13.361 27.1699C13.4499 27.0361 13.5828 26.9469 13.7164 26.9023C13.7463 26.9023 13.7612 26.8875 13.7612 26.8577L13.9389 26.5009C15.1828 26.9915 16.4708 27.2145 17.8035 27.2145C18.6032 27.2145 19.4028 27.1253 20.2025 26.9023C20.6908 26.8131 21.1798 26.6347 21.624 26.5009L21.8017 26.8131C21.8316 26.8131 21.8465 26.828 21.8465 26.8577C21.9794 26.9023 22.113 26.9915 22.2019 27.1253C22.4237 27.5713 22.6461 28.0173 22.7791 28.5079V28.5525L22.8679 28.8201C22.912 28.9985 22.9568 29.1769 23.0456 29.3107C23.0904 29.3553 23.0904 29.3998 23.1345 29.4444C23.1345 29.4444 23.1345 29.489 23.1786 29.489C23.3563 29.8012 23.6669 30.0242 24.0223 30.0242C24.1553 30.0242 24.2441 29.9796 24.3777 29.935C24.5554 29.8458 24.7331 29.6674 24.7772 29.4444C24.822 29.2215 24.822 28.9985 24.7325 28.7755C24.7325 28.7309 24.6884 28.7309 24.6884 28.7309C24.6884 28.6863 24.6436 28.6417 24.5995 28.5971C24.5107 28.4187 24.4218 28.2849 24.2889 28.1511C24.2441 28.0619 24.2 28.0173 24.1112 27.9281V27.8389C23.8005 27.4375 23.5781 26.9915 23.4004 26.5455C23.3556 26.4118 23.3556 26.2334 23.4445 26.0996C23.4445 26.055 23.4892 26.055 23.4892 26.055L23.3563 25.6982C25.6216 24.3156 27.3539 22.1755 28.1535 19.6341L28.5089 19.6787C28.5536 19.6787 28.5536 19.6341 28.5536 19.6341C28.6425 19.5449 28.7754 19.5003 28.909 19.5003H28.9531C29.4421 19.5895 29.9305 19.7233 30.3747 19.9017H30.4195C30.5083 19.9463 30.5972 19.9909 30.686 19.9909C30.8637 20.0801 30.9967 20.1693 31.1744 20.2139C31.2191 20.2139 31.2632 20.2584 31.3521 20.2584C31.3815 20.2584 31.4111 20.2733 31.4409 20.303C31.5298 20.3476 31.5739 20.3476 31.6627 20.3476C32.0622 20.3476 32.4176 20.0801 32.5512 19.7233C32.5071 19.2327 32.1517 18.8759 31.7516 18.7867C31.7068 18.7867 31.6627 18.7867 31.6627 18.7421C31.6627 18.6975 31.5739 18.6975 31.485 18.6975C31.3073 18.6529 31.1296 18.6529 30.9519 18.6529C30.8631 18.6529 30.7742 18.6529 30.6854 18.6083H30.6406C30.1523 18.5637 29.6192 18.4745 29.1302 18.3407C28.9972 18.2961 28.8636 18.1623 28.8195 18.0285L28.4641 17.9393C28.6081 16.8903 28.577 15.8115 28.4181 14.7515C28.1671 14.7774 27.9122 14.7903 27.6541 14.7903C27.1515 14.7903 26.6606 14.7405 26.1858 14.6455L26.1865 14.6468ZM17.0493 15.0424H18.382L19.2258 16.1127L18.9151 17.4061L17.716 17.9859L16.5168 17.4061L16.2062 16.1127L17.0493 15.0424ZM15.7165 7.95249L16.605 7.7741L16.3826 12.2333C16.3826 12.6347 16.0272 12.9469 15.6277 12.9469C15.4947 12.9469 15.4059 12.9023 15.2723 12.8577L11.5854 10.227C12.7404 9.11206 14.1613 8.30864 15.7165 7.95249ZM10.2974 11.8765L13.5841 14.8194C13.8948 15.087 13.9395 15.5329 13.673 15.8451C13.5841 15.9789 13.4953 16.0235 13.3176 16.0681L9.00938 17.3169C8.87643 15.4438 9.32002 13.5267 10.2974 11.8765ZM14.6503 19.68L12.9622 23.7824C11.4077 22.7566 10.1638 21.1963 9.54182 19.4124L13.9389 18.6542C14.2943 18.6542 14.6497 18.8772 14.6938 19.234C14.7379 19.3678 14.7379 19.5462 14.649 19.68H14.6503ZM19.6253 24.9413C19.0033 25.0751 18.3814 25.1643 17.7153 25.1643C16.7827 25.1643 15.8054 24.9859 14.9169 24.7183L17.0934 20.7497C17.3152 20.4821 17.6706 20.3929 17.9819 20.5713C18.1148 20.6605 18.2037 20.7497 18.3373 20.8835L20.4696 24.7629C20.2031 24.8075 19.9359 24.8521 19.6253 24.9413ZM25.0444 21.0619C24.3784 22.1322 23.4451 23.0682 22.3796 23.7371L20.6473 19.5455C20.5585 19.1887 20.7362 18.8319 21.0468 18.6981C21.1798 18.6536 21.3134 18.6089 21.4463 18.6089L25.8882 19.3671C25.6664 19.9915 25.3998 20.5713 25.0444 21.0619Z" fill="#326DE6"/>
+<path d="M27.6547 13.7574C31.1827 13.7574 34.0428 10.907 34.0428 7.39083C34.0428 3.87465 31.1827 1.02423 27.6547 1.02423C24.1266 1.02423 21.2666 3.87465 21.2666 7.39083C21.2666 10.907 24.1266 13.7574 27.6547 13.7574Z" fill="#344054"/>
+<path d="M29.5009 9.79014H25.8691C25.4397 9.79014 25.0908 9.4424 25.0908 9.01451V7.98034C25.0908 7.8375 25.2069 7.7218 25.3502 7.7218C25.4936 7.7218 25.6096 7.8375 25.6096 7.98034V9.01451C25.6096 9.15735 25.7257 9.27305 25.8691 9.27305H29.5009C29.6442 9.27305 29.7603 9.15735 29.7603 9.01451V7.98034C29.7603 7.8375 29.8764 7.7218 30.0197 7.7218C30.163 7.7218 30.2791 7.8375 30.2791 7.98034V9.01451C30.2791 9.4424 29.9302 9.79014 29.5009 9.79014Z" fill="white"/>
+<path d="M29.1653 6.50469C29.0641 6.40386 28.9 6.40386 28.7982 6.50469L27.9441 7.35594V4.87781C27.9441 4.73497 27.828 4.61927 27.6847 4.61927C27.5413 4.61927 27.4252 4.73497 27.4252 4.87781V7.35594L26.5711 6.50469C26.47 6.40386 26.3059 6.40386 26.2041 6.50469C26.1022 6.60552 26.1029 6.76905 26.2041 6.87052L27.5005 8.16259C27.5128 8.17487 27.5264 8.18586 27.5407 8.19555C27.5459 8.19943 27.5524 8.20137 27.5582 8.2046C27.5673 8.20977 27.5757 8.21494 27.5854 8.21882C27.5939 8.22205 27.6023 8.22399 27.6107 8.22658C27.6185 8.22916 27.6263 8.23175 27.6341 8.23369C27.6509 8.23692 27.6678 8.23886 27.6847 8.23886C27.7015 8.23886 27.7184 8.23692 27.7352 8.23369C27.743 8.23239 27.7508 8.22916 27.7586 8.22658C27.767 8.22399 27.7755 8.22205 27.7839 8.21882C27.7936 8.21494 27.802 8.20977 27.8111 8.2046C27.817 8.20137 27.8228 8.19878 27.8286 8.19555C27.8429 8.18586 27.8565 8.17487 27.8688 8.16259L29.1653 6.87052C29.2664 6.76969 29.2664 6.60617 29.1653 6.50469Z" fill="white"/>
+</svg>
diff --git a/app/assets/ico/vendor/internal.svg b/app/assets/ico/vendor/internal.svg
new file mode 100644
index 0000000..5766e13
--- /dev/null
+++ b/app/assets/ico/vendor/internal.svg
@@ -0,0 +1 @@
+<svg width="auto" height="auto" viewBox="0 0 36 40" fill="none" xmlns="http://www.w3.org/2000/svg"> <path d="M14.3817 5.28003C22.1592 5.28003 28.4649 11.5865 28.4649 19.365C28.4649 27.1435 22.1592 33.45 14.3817 33.45C6.60065 33.4535 0.294922 27.1435 0.294922 19.365C0.294922 11.5865 6.60065 5.28003 14.3817 5.28003Z" fill="#E0F2FE"/> <path fill-rule="evenodd" clip-rule="evenodd" d="M14.3805 14.085C11.3543 14.085 8.9012 16.5097 8.9012 19.5009C8.9012 22.492 11.3543 24.9168 14.3805 24.9168C17.4066 24.9168 19.8597 22.492 19.8597 19.5009C19.8597 16.5097 17.4066 14.085 14.3805 14.085ZM7.81738 19.5009C7.81738 15.9181 10.7558 13.0137 14.3805 13.0137C18.0052 13.0137 20.9436 15.9181 20.9436 19.5009C20.9436 23.0837 18.0052 25.9881 14.3805 25.9881C10.7558 25.9881 7.81738 23.0837 7.81738 19.5009ZM14.3805 16.5846C14.6798 16.5846 14.9224 16.8244 14.9224 17.1203V20.5884L16.4058 19.1221C16.6174 18.9129 16.9605 18.9129 17.1721 19.1221C17.3838 19.3313 17.3838 19.6705 17.1721 19.8796L14.7637 22.2603C14.552 22.4694 14.2089 22.4694 13.9973 22.2603L11.5888 19.8796C11.3772 19.6705 11.3772 19.3313 11.5888 19.1221C11.8004 18.9129 12.1436 18.9129 12.3552 19.1221L13.8386 20.5884V17.1203C13.8386 16.8244 14.0812 16.5846 14.3805 16.5846Z" fill="#0086C9"/> </svg>
\ No newline at end of file
diff --git a/app/assets/ico/vendor/kaas-icon.svg b/app/assets/ico/vendor/kaas-icon.svg
new file mode 100644
index 0000000..37d427e
--- /dev/null
+++ b/app/assets/ico/vendor/kaas-icon.svg
@@ -0,0 +1,4 @@
+<svg width="37" height="32" viewBox="0 0 37 32" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path fill-rule="evenodd" clip-rule="evenodd" d="M9.62573 28.1393C5.49717 28.0455 2.1792 24.6693 2.1792 20.5182C2.1792 17.4853 3.95038 14.8661 6.51483 13.6385C7.19949 7.82879 12.1406 3.32202 18.1343 3.32202C24.0207 3.32202 28.8918 7.66876 29.713 13.3275C32.6758 14.3729 34.799 17.1976 34.799 20.5182C34.799 24.7283 31.386 28.1413 27.1759 28.1413C27.1169 28.1413 27.058 28.1406 26.9992 28.1393V28.1413H9.62573V28.1393Z" fill="#326DE6"/>
+<path d="M26.0422 18.1192C26.0178 18.1192 25.9933 18.1192 25.9933 18.0941C25.9933 18.069 25.9445 18.069 25.8956 18.069C25.7979 18.044 25.7002 18.044 25.6025 18.044C25.5537 18.044 25.5048 18.044 25.4559 18.0189H25.4315C25.1628 17.9938 24.8697 17.9437 24.601 17.8684C24.5277 17.8434 24.4544 17.7681 24.43 17.6929L24.2346 17.6428C24.3323 16.9156 24.2834 16.1634 24.1369 15.4362C23.9659 14.7091 23.6728 14.007 23.2819 13.3801L23.4285 13.2297V13.2046C23.4285 13.1294 23.4529 13.0291 23.5018 12.9789C23.7216 12.7783 23.9415 12.6279 24.1857 12.4774C24.2346 12.4524 24.2834 12.4273 24.3323 12.4022C24.43 12.3521 24.5033 12.3019 24.601 12.2518C24.6254 12.2267 24.6499 12.2267 24.6743 12.2016C24.6987 12.1765 24.6743 12.1765 24.6743 12.1515C24.8941 11.9759 24.943 11.675 24.772 11.4494C24.6987 11.3491 24.5521 11.2739 24.43 11.2739C24.3079 11.2739 24.1857 11.324 24.088 11.3992L24.0636 11.4243C24.0392 11.4494 24.0147 11.4744 23.9903 11.4744C23.917 11.5497 23.8438 11.6249 23.7949 11.7001C23.7705 11.7503 23.7216 11.7753 23.6972 11.8004C23.5262 12.001 23.3064 12.2016 23.0865 12.3521C23.0377 12.3771 22.9888 12.4022 22.9399 12.4022C22.9155 12.4022 22.8667 12.4022 22.8422 12.3771H22.8178L22.6224 12.5025C22.427 12.3019 22.2071 12.1013 22.0117 11.9007C21.1079 11.1736 19.9843 10.7222 18.8362 10.5968L18.8117 10.3962V10.4213C18.7385 10.3712 18.714 10.2959 18.6896 10.2207C18.6896 9.9449 18.6896 9.66908 18.7385 9.36819V9.34312C18.7385 9.29297 18.7629 9.24282 18.7629 9.19267C18.7873 9.09237 18.7873 8.99207 18.8117 8.89178V8.74133C18.8362 8.49058 18.6408 8.23984 18.3965 8.21477C18.2499 8.18969 18.1034 8.26491 17.9812 8.39029C17.8835 8.49058 17.8347 8.61596 17.8347 8.74133V8.8667C17.8347 8.967 17.8591 9.0673 17.8835 9.1676C17.9079 9.21774 17.9079 9.26789 17.9079 9.31804V9.34312C17.9568 9.61894 17.9568 9.89475 17.9568 10.1956C17.9324 10.2709 17.9079 10.3461 17.8347 10.3962V10.4464L17.8102 10.647C17.5415 10.6721 17.2728 10.7222 16.9797 10.7724C15.8316 11.0231 14.7813 11.65 13.9752 12.5276L13.8286 12.4273H13.8042C13.7797 12.4273 13.7553 12.4524 13.7065 12.4524C13.6576 12.4524 13.6088 12.4273 13.5599 12.4022C13.3401 12.2267 13.1202 12.0261 12.9492 11.8255C12.9248 11.7753 12.8759 11.7503 12.8515 11.7252C12.7782 11.65 12.7294 11.5747 12.6561 11.4995C12.6317 11.4744 12.6072 11.4744 12.5828 11.4494C12.5584 11.4243 12.5584 11.4243 12.5584 11.4243C12.4607 11.3491 12.3385 11.2989 12.2164 11.2989C12.0698 11.2989 11.9477 11.3491 11.8744 11.4744C11.7279 11.7001 11.7767 12.001 11.9721 12.1765C11.9966 12.1765 11.9966 12.2016 11.9966 12.2016C11.9966 12.2016 12.0454 12.2518 12.0698 12.2518C12.1431 12.3019 12.2408 12.3521 12.3385 12.4022C12.3874 12.4273 12.4362 12.4524 12.4851 12.4774C12.7294 12.6279 12.9736 12.7783 13.1691 12.9789C13.2179 13.0291 13.2668 13.1294 13.2423 13.2046V13.1795L13.3889 13.33C13.3645 13.3801 13.3401 13.4052 13.3156 13.4553C12.5584 14.684 12.2408 16.1383 12.4607 17.5675L12.2653 17.6177C12.2653 17.6428 12.2408 17.6428 12.2408 17.6428C12.2164 17.718 12.1431 17.7681 12.0698 17.8183C11.8011 17.8935 11.5324 17.9437 11.2393 17.9687C11.1905 17.9687 11.1416 17.9687 11.0927 17.9938C10.995 17.9938 10.8973 18.0189 10.7996 18.0189C10.7752 18.0189 10.7508 18.044 10.7019 18.044C10.6775 18.044 10.6775 18.044 10.6531 18.069C10.3844 18.1192 10.2134 18.3699 10.2622 18.6457C10.3111 18.8714 10.5309 19.0219 10.7508 18.9968C10.7996 18.9968 10.8241 18.9968 10.8729 18.9717C10.8973 18.9717 10.8973 18.9717 10.8973 18.9466C10.8973 18.9216 10.9706 18.9466 10.995 18.9466C11.0927 18.9216 11.1905 18.8714 11.2637 18.8463C11.3126 18.8213 11.3614 18.7962 11.4103 18.7962H11.4347C11.7034 18.6959 11.9477 18.6207 12.2408 18.5705H12.2653C12.3385 18.5705 12.4118 18.5956 12.4607 18.6457C12.4851 18.6457 12.4851 18.6708 12.4851 18.6708L12.7049 18.6457C13.0714 19.7992 13.7553 20.8272 14.708 21.5795C14.9278 21.755 15.1232 21.9054 15.3675 22.0308L15.2454 22.2063C15.2454 22.2314 15.2698 22.2314 15.2698 22.2314C15.3187 22.3066 15.3187 22.4069 15.2942 22.4821C15.1965 22.7329 15.05 22.9836 14.9034 23.2093V23.2344C14.879 23.2845 14.8545 23.3096 14.8057 23.3597C14.7568 23.4099 14.708 23.5102 14.6347 23.6105C14.6103 23.6356 14.6103 23.6606 14.5858 23.6857C14.5858 23.6857 14.5858 23.7108 14.5614 23.7108C14.4393 23.9615 14.537 24.2624 14.7568 24.3878C14.8057 24.4129 14.879 24.4379 14.9278 24.4379C15.1232 24.4379 15.2942 24.3126 15.3919 24.1371C15.3919 24.1371 15.3919 24.112 15.4164 24.112C15.4164 24.0869 15.4408 24.0618 15.4652 24.0368C15.4896 23.9365 15.5385 23.8612 15.5629 23.7609L15.6118 23.6105C15.6851 23.3347 15.8072 23.0839 15.9293 22.8332C15.9782 22.758 16.0515 22.7078 16.1248 22.6827C16.1492 22.6827 16.1492 22.6827 16.1492 22.6577L16.2469 22.4571C16.9309 22.7329 17.6392 22.8583 18.3721 22.8583C18.8117 22.8583 19.2514 22.8081 19.6911 22.6827C19.9598 22.6326 20.2285 22.5323 20.4728 22.4571L20.5705 22.6326C20.5949 22.6326 20.5949 22.6326 20.5949 22.6577C20.6682 22.6827 20.7415 22.7329 20.7904 22.8081C20.9125 23.0589 21.0346 23.3096 21.1079 23.5854V23.6105L21.1568 23.7609C21.1812 23.8612 21.2056 23.9615 21.2545 24.0368C21.2789 24.0618 21.2789 24.0869 21.3033 24.112C21.3033 24.112 21.3033 24.1371 21.3278 24.1371C21.4255 24.3126 21.5965 24.4379 21.7919 24.4379C21.8652 24.4379 21.914 24.4129 21.9873 24.3878C22.085 24.3376 22.1827 24.2374 22.2071 24.112C22.2316 23.9866 22.2316 23.8612 22.1827 23.7359C22.1827 23.7108 22.1583 23.7108 22.1583 23.7108C22.1583 23.6857 22.1338 23.6606 22.1094 23.6356C22.0606 23.5353 22.0117 23.46 21.9384 23.3848C21.914 23.3347 21.8896 23.3096 21.8407 23.2594V23.2093C21.6697 22.9836 21.5476 22.7329 21.4499 22.4821C21.4255 22.4069 21.4255 22.3066 21.4743 22.2314C21.4743 22.2063 21.4987 22.2063 21.4987 22.2063L21.4255 22.0057C22.6712 21.2284 23.6239 20.0248 24.0636 18.5956L24.259 18.6207C24.2834 18.6207 24.2834 18.5956 24.2834 18.5956C24.3323 18.5454 24.4056 18.5204 24.4789 18.5204H24.5033C24.772 18.5705 25.0407 18.6457 25.285 18.746H25.3094C25.3582 18.7711 25.4071 18.7962 25.4559 18.7962C25.5537 18.8463 25.6269 18.8965 25.7247 18.9216C25.7491 18.9216 25.7735 18.9466 25.8224 18.9466C25.8468 18.9466 25.8468 18.9466 25.8712 18.9717C25.9201 18.9968 25.9445 18.9968 25.9933 18.9968C26.2132 18.9968 26.4086 18.8463 26.4819 18.6457C26.4575 18.3699 26.262 18.1693 26.0422 18.1192ZM18.9827 17.3419L18.3232 17.6678L17.6637 17.3419L17.4927 16.6147L17.9568 16.0129H18.6896L19.1537 16.6147L18.9827 17.3419ZM22.9644 15.712C23.0865 16.2386 23.1109 16.7652 23.0621 17.2917L20.7415 16.6147C20.5217 16.5646 20.3995 16.3389 20.4484 16.1132C20.4728 16.038 20.4972 15.9879 20.5461 15.9377L22.3781 14.2326C22.6468 14.684 22.8422 15.1855 22.9644 15.712ZM21.6453 13.3049L19.6423 14.7592C19.4713 14.8595 19.227 14.8344 19.1049 14.6589C19.056 14.6088 19.0316 14.5586 19.0316 14.4834L18.885 11.9509C19.9598 12.0762 20.9125 12.5526 21.6453 13.3049ZM17.224 12.0261L17.7125 11.9258L17.5904 14.4332C17.5904 14.6589 17.395 14.8344 17.1751 14.8344C17.1018 14.8344 17.053 14.8094 16.9797 14.7843L14.9522 13.3049C15.5874 12.678 16.369 12.2267 17.224 12.0261ZM14.2439 14.2326L16.0515 15.8876C16.2225 16.038 16.2469 16.2887 16.1003 16.4643C16.0515 16.5395 16.0026 16.5646 15.9049 16.5896L13.5355 17.2917C13.4622 16.2386 13.7065 15.1604 14.2439 14.2326ZM13.8286 18.4702L16.2469 18.044C16.4423 18.044 16.6377 18.1693 16.6622 18.3699C16.6866 18.4452 16.6866 18.5454 16.6377 18.6207L15.7095 20.9275C14.8545 20.3508 14.1706 19.4732 13.8286 18.4702ZM19.3736 21.5795C19.0316 21.6547 18.6896 21.7048 18.3232 21.7048C17.8102 21.7048 17.2728 21.6045 16.7843 21.4541L17.9812 19.2225C18.1034 19.072 18.2988 19.0219 18.4698 19.1222C18.543 19.1723 18.5919 19.2225 18.6652 19.2977L19.8377 21.4792C19.6911 21.5042 19.5446 21.5293 19.3736 21.5795ZM22.3537 19.398C21.9873 19.9998 21.4743 20.5263 20.8881 20.9024L19.9354 18.5454C19.8865 18.3449 19.9843 18.1443 20.1552 18.069C20.2285 18.044 20.3018 18.0189 20.3751 18.0189L22.8178 18.4452C22.6957 18.7962 22.5491 19.1222 22.3537 19.398Z" fill="white"/>
+</svg>
diff --git a/app/assets/ico/vendor/kubernetes.svg b/app/assets/ico/vendor/kubernetes.svg
new file mode 100644
index 0000000..2eb65a2
--- /dev/null
+++ b/app/assets/ico/vendor/kubernetes.svg
@@ -0,0 +1,12 @@
+<svg width="36" height="40" viewBox="0 0 36 40" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M13.8489 32.4934C12.1581 32.4934 10.468 32.4793 8.77866 32.4998C8.01043 32.5083 7.4177 32.2358 6.93562 31.6313C4.79799 28.9493 2.64766 26.2787 0.498045 23.6059C0.0667113 23.07 -0.102439 22.4995 0.0617779 21.7974C0.851146 18.421 1.61162 15.0368 2.38407 11.6548C2.53842 10.9774 2.93029 10.5123 3.5646 10.2115C6.68895 8.72648 9.80625 7.23012 12.9214 5.72739C13.5734 5.4124 14.1943 5.43151 14.8413 5.74225C17.9374 7.23507 21.0357 8.72507 24.1417 10.1988C24.7986 10.5109 25.1982 10.988 25.3575 11.6874C26.1278 15.0701 26.894 18.4535 27.6784 21.832C27.8285 22.4804 27.6925 23.0276 27.2872 23.5308C25.1158 26.239 22.9429 28.9465 20.7785 31.661C20.3112 32.2478 19.7234 32.5041 18.9841 32.4977C17.2735 32.4849 15.5616 32.4941 13.8511 32.4941L13.8482 32.4927L13.8489 32.4934ZM13.4141 10.8847C13.4444 11.7567 13.3387 11.8905 12.538 12.0476C11.1172 12.3272 9.83373 12.9112 8.79346 13.9326C8.40089 14.3191 8.07034 14.237 7.72076 13.9878C7.45153 13.7967 7.23446 13.532 6.9913 13.3033C6.82497 13.1476 6.66921 12.9685 6.47892 12.8489C6.19982 12.6755 5.90733 12.7003 5.70294 12.9813C5.51758 13.234 5.5641 13.5072 5.77342 13.7238C5.91649 13.871 6.09904 13.9807 6.27241 14.0954C6.53178 14.2688 6.81017 14.4161 7.05967 14.6036C7.56712 14.9852 7.61364 15.2442 7.31269 15.7893C6.61847 17.045 6.30765 18.3905 6.35769 19.8267C6.38518 20.6096 6.15612 20.8573 5.37028 20.9465C5.01788 20.9869 4.66337 21.0081 4.31379 21.0676C3.91911 21.1341 3.6386 21.3535 3.72388 21.7952C3.80564 22.2206 4.15099 22.2858 4.50479 22.1994C4.88679 22.1038 5.25187 21.9439 5.62894 21.8278C6.40069 21.5914 6.66146 21.716 6.98496 22.4542C7.55161 23.7517 8.41498 24.8028 9.56732 25.6182C10.0621 25.9693 10.1424 26.2702 9.85558 26.8216C9.72167 27.0792 9.54759 27.3185 9.39465 27.5676C9.29668 27.7276 9.19519 27.8861 9.10921 28.0525C8.93724 28.3838 9.01053 28.674 9.31712 28.8707C9.65824 29.0895 9.95214 28.9196 10.1044 28.6216C10.3102 28.2153 10.4293 27.7658 10.5942 27.339C10.8585 26.6531 11.1334 26.5158 11.8121 26.7062C13.1893 27.0898 14.5678 27.0948 15.9464 26.7126C16.6181 26.5264 16.8662 26.6382 17.1319 27.3015C17.2869 27.6879 17.3835 28.0992 17.5569 28.4779C17.7119 28.8212 17.9727 29.0994 18.3941 28.8757C18.7853 28.6683 18.8001 28.3172 18.5985 27.9619C18.4033 27.6172 18.1651 27.2958 17.9692 26.9511C17.5858 26.273 17.6407 26.0415 18.2588 25.5878C19.4154 24.7405 20.271 23.6575 20.8186 22.3282C21.0717 21.7131 21.3127 21.5907 21.9625 21.7832C22.3607 21.9014 22.7434 22.0762 23.1445 22.1775C23.5039 22.2681 23.8739 22.2553 24.0128 21.8051C24.1255 21.4392 23.8788 21.1384 23.3834 21.0562C22.9936 20.9911 22.594 20.9819 22.2029 20.9218C21.5791 20.8248 21.3508 20.5501 21.3768 19.9315C21.4396 18.4528 21.1252 17.0655 20.3979 15.7758C20.1195 15.2824 20.1639 14.988 20.6206 14.6291C20.8828 14.4238 21.1809 14.2688 21.4586 14.0855C21.6313 13.9708 21.8159 13.8625 21.9583 13.7153C22.169 13.5001 22.2127 13.2318 22.0295 12.9728C21.8413 12.7073 21.5608 12.6833 21.3028 12.8114C21.1048 12.9098 20.9434 13.0896 20.7764 13.2453C20.548 13.4591 20.3443 13.7011 20.1061 13.9022C19.6325 14.3021 19.3456 14.2936 18.8953 13.8937C17.7923 12.9119 16.5131 12.2975 15.0654 12.0321C14.484 11.9252 14.3071 11.7348 14.331 11.1345C14.3472 10.7176 14.4226 10.3042 14.46 9.88875C14.5051 9.40317 14.2331 9.00891 13.8659 9.01032C13.4987 9.01174 13.228 9.40459 13.2766 9.89158C13.3105 10.2236 13.3669 10.5534 13.4148 10.8847H13.412H13.4141Z" fill="#326CE4"/>
+<path d="M13.4133 10.8847C13.3668 10.5535 13.309 10.2243 13.2751 9.89163C13.2265 9.40464 13.4971 9.0118 13.8643 9.01038C14.2315 9.00896 14.5036 9.40323 14.4585 9.8888C14.4197 10.3057 14.3443 10.7184 14.3295 11.1346C14.3069 11.7348 14.4824 11.9252 15.0639 12.0321C16.5115 12.2976 17.7907 12.9105 18.8937 13.8937C19.3434 14.2937 19.6303 14.3029 20.1046 13.9022C20.3428 13.7012 20.5472 13.4591 20.7748 13.2454C20.9412 13.0896 21.1033 12.9091 21.3013 12.8114C21.5593 12.6833 21.8405 12.7067 22.028 12.9728C22.2112 13.2319 22.1668 13.4988 21.9568 13.7154C21.8137 13.8626 21.6297 13.9695 21.4571 14.0856C21.1801 14.2703 20.8806 14.4253 20.6191 14.6292C20.1617 14.988 20.118 15.2825 20.3964 15.7759C21.123 17.0655 21.438 18.4529 21.3753 19.9316C21.3492 20.5495 21.5783 20.8241 22.2013 20.9218C22.5925 20.982 22.9907 20.9912 23.3819 21.0563C23.878 21.1391 24.1247 21.4392 24.0112 21.8052C23.8724 22.2561 23.5024 22.2681 23.1429 22.1775C22.7419 22.077 22.3585 21.9022 21.961 21.7832C21.3119 21.5907 21.0716 21.7125 20.8171 22.3283C20.2695 23.6576 19.4139 24.7406 18.2573 25.5879C17.6392 26.0409 17.5828 26.2723 17.9676 26.9511C18.1629 27.2959 18.3997 27.6172 18.597 27.9619C18.7986 28.318 18.7838 28.6676 18.3926 28.8757C17.9719 29.0994 17.7111 28.8205 17.5553 28.4779C17.3834 28.1007 17.2861 27.6873 17.1304 27.3015C16.8632 26.6383 16.6166 26.5264 15.9449 26.7126C14.5663 27.0955 13.1877 27.0899 11.8106 26.7062C11.1304 26.5172 10.8556 26.6546 10.5927 27.339C10.4285 27.7673 10.308 28.216 10.1029 28.6216C9.95274 28.9196 9.65673 29.0895 9.31561 28.8708C9.00973 28.6747 8.93713 28.3838 9.10769 28.0525C9.19438 27.8862 9.29446 27.7276 9.39313 27.5677C9.54607 27.3185 9.71875 27.0807 9.85407 26.8216C10.1409 26.2702 10.0606 25.9687 9.56581 25.6183C8.41417 24.8029 7.54939 23.7517 6.98344 22.4543C6.65994 21.7153 6.39917 21.5921 5.62742 21.8278C5.25036 21.9439 4.88528 22.1032 4.50328 22.1995C4.15018 22.2872 3.80553 22.2221 3.72237 21.7953C3.63709 21.3536 3.9176 21.1356 4.31228 21.0676C4.66045 21.0082 5.01637 20.9869 5.36876 20.9466C6.15602 20.8588 6.38367 20.6104 6.35618 19.8268C6.30614 18.3906 6.61695 17.0457 7.31117 15.7893C7.61212 15.2443 7.5656 14.9852 7.05815 14.6037C6.80866 14.4161 6.53026 14.2689 6.2709 14.0955C6.09822 13.9808 5.91498 13.8718 5.77191 13.7238C5.56258 13.5073 5.51607 13.234 5.70143 12.9813C5.90723 12.701 6.19901 12.6755 6.4774 12.849C6.6677 12.9686 6.82346 13.1463 6.98979 13.3034C7.23294 13.5327 7.45072 13.7968 7.71925 13.9879C8.06883 14.237 8.39867 14.3191 8.79194 13.9327C9.83081 12.9105 11.1142 12.3266 12.5365 12.0477C13.3372 11.8906 13.4422 11.7568 13.4126 10.8847H13.4154H13.4133ZM13.0848 14.2993H13.1187C13.1187 14.133 13.1102 13.9645 13.1215 13.7982C13.1363 13.5688 13.051 13.515 12.8283 13.5589C11.7429 13.7713 10.7766 14.225 9.92737 14.9385C9.69337 15.1346 9.73919 15.2457 9.96613 15.4007C10.6364 15.8615 11.2904 16.345 11.96 16.805C12.5654 17.2205 12.9375 17.0365 12.9848 16.3039C13.027 15.6371 13.0524 14.9675 13.0848 14.2993V14.2993ZM7.87924 19.332C7.8736 19.848 8.09772 20.0399 8.55231 19.9082C9.24935 19.7058 9.95062 19.5139 10.6434 19.2987C11.2777 19.1013 11.375 18.707 10.8915 18.249C10.3023 17.6905 9.67364 17.1731 9.08937 16.6076C8.77855 16.3067 8.66579 16.4568 8.52271 16.747C8.11041 17.5837 7.91518 18.4713 7.87853 19.3306L7.87924 19.332ZM13.8467 25.4633C14.3915 25.4781 14.9208 25.3812 15.4473 25.2495C15.6616 25.1957 15.7997 25.1617 15.6454 24.8921C15.2006 24.1141 14.7947 23.3136 14.3358 22.5449C14.0793 22.1145 13.648 22.1195 13.3949 22.5512C12.9411 23.3242 12.5281 24.1191 12.0904 24.9013C11.9762 25.1051 12.0227 25.1794 12.2482 25.2361C12.7747 25.3684 13.3019 25.4725 13.8474 25.4626V25.464L13.8467 25.4633ZM19.8558 19.3504C19.8072 18.5109 19.6274 17.6389 19.2264 16.8192C19.0636 16.4872 18.8804 16.374 18.566 16.6691C18.0036 17.1965 17.4144 17.6962 16.8527 18.225C16.3487 18.6992 16.4545 19.0949 17.1311 19.2995C17.8267 19.5111 18.5273 19.7058 19.225 19.9075C19.8657 20.0922 19.8678 20.0915 19.8551 19.3497L19.8558 19.3504ZM16.7878 21.0535C15.8857 21.0938 15.7743 21.2637 16.0795 22.0175C16.3699 22.7339 16.6772 23.4431 16.9577 24.163C17.0528 24.4072 17.1304 24.5268 17.3897 24.3315C18.2756 23.6618 18.9551 22.8316 19.3822 21.8017C19.435 21.6742 19.5316 21.5037 19.2905 21.4619C18.43 21.3147 17.5659 21.1802 16.7871 21.0528L16.7878 21.0535ZM14.6171 14.225H14.6382C14.6734 14.9109 14.7059 15.5968 14.7446 16.2841C14.7869 17.0238 15.1534 17.2191 15.7525 16.8079C16.403 16.3612 17.0253 15.8728 17.6885 15.4474C18.0431 15.2195 17.9641 15.0928 17.6984 14.8762C16.8928 14.2215 15.9928 13.7925 14.9744 13.5823C14.6156 13.508 14.5818 13.6304 14.6135 13.9135C14.6248 14.0169 14.6149 14.1209 14.6149 14.2257H14.6178L14.6171 14.225ZM11.8465 21.5525C11.7486 21.3401 11.7612 21.0605 11.394 21.074C10.4708 21.108 9.57074 21.309 8.66085 21.435C8.34017 21.4789 8.27463 21.6176 8.40008 21.8958C8.83987 22.8662 9.48264 23.6703 10.3361 24.3074C10.5553 24.4709 10.6695 24.4737 10.7745 24.1793C10.9634 23.6505 11.2016 23.1395 11.4159 22.6199C11.559 22.2738 11.6964 21.9255 11.8458 21.5539V21.5525H11.8465ZM13.8982 18.6617C13.2589 18.6603 12.8819 18.9144 12.8671 19.3575C12.8494 19.8898 13.3668 20.4879 13.8559 20.4978C14.321 20.5077 14.8532 19.9443 14.856 19.4382C14.8588 18.9675 14.4839 18.6617 13.8975 18.6603L13.8989 18.6617H13.8982Z" fill="#FDFDFE"/>
+<path d="M13.0865 14.2993C13.0541 14.9675 13.0287 15.6357 12.9864 16.3039C12.9385 17.0379 12.5657 17.2212 11.9617 16.805C11.2914 16.3442 10.6381 15.8601 9.96781 15.4007C9.74086 15.245 9.69576 15.1353 9.92904 14.9385C10.7783 14.225 11.7446 13.772 12.83 13.5589C13.0541 13.515 13.138 13.5702 13.1232 13.7982C13.1119 13.9645 13.1203 14.133 13.1203 14.3H13.0865V14.2986V14.2993Z" fill="#326CE4"/>
+<path d="M7.88086 19.332C7.91821 18.4727 8.11274 17.5851 8.52504 16.7484C8.66811 16.4575 8.78088 16.3067 9.09169 16.609C9.67456 17.1738 10.3046 17.6899 10.8938 18.2505C11.3773 18.7098 11.2801 19.1034 10.6458 19.3002C9.95295 19.5154 9.25239 19.7065 8.55464 19.9096C8.10075 20.0413 7.87663 19.8495 7.88156 19.3334L7.88086 19.332Z" fill="#326CE4"/>
+<path d="M13.8497 25.4618C13.3049 25.4717 12.777 25.3662 12.2505 25.2338C12.025 25.1772 11.9799 25.1029 12.0926 24.899C12.5303 24.1176 12.9433 23.3206 13.3972 22.549C13.6502 22.1173 14.0816 22.1123 14.3381 22.5427C14.7969 23.3114 15.2043 24.1119 15.6476 24.8898C15.802 25.1588 15.6624 25.1928 15.4496 25.2473C14.9231 25.3797 14.3945 25.4766 13.849 25.4611L13.8497 25.4618Z" fill="#326CE4"/>
+<path d="M19.8564 19.3497C19.8691 20.0908 19.8662 20.0937 19.2263 19.9075C18.5285 19.7051 17.828 19.5097 17.1324 19.2995C16.4558 19.0942 16.3507 18.7006 16.854 18.225C17.4157 17.6962 18.0042 17.1965 18.5673 16.6692C18.8817 16.3747 19.0649 16.4865 19.2277 16.8192C19.6287 17.6382 19.8077 18.5109 19.8571 19.3504L19.8564 19.3497Z" fill="#326CE4"/>
+<path d="M16.7902 21.052C17.5683 21.178 18.4317 21.3139 19.2936 21.4611C19.5333 21.5015 19.4374 21.6728 19.3853 21.8009C18.9567 22.8315 18.2787 23.6625 17.3928 24.3307C17.1334 24.5268 17.0559 24.4064 16.9608 24.1622C16.6803 23.4424 16.373 22.7324 16.0826 22.0168C15.7767 21.2629 15.8895 21.0931 16.7909 21.0527L16.7902 21.052Z" fill="#326CE4"/>
+<path d="M14.6197 14.2236C14.6197 14.1188 14.6296 14.0148 14.6183 13.9114C14.5873 13.6283 14.6211 13.5073 14.9792 13.5802C15.9983 13.7904 16.8976 14.2193 17.7032 14.8741C17.9689 15.0907 18.0492 15.2167 17.6933 15.4453C17.0301 15.8721 16.4078 16.3591 15.7573 16.8058C15.1582 17.217 14.791 17.0224 14.7494 16.282C14.7106 15.5961 14.6782 14.9088 14.643 14.2229H14.619L14.6197 14.2236Z" fill="#326CE4"/>
+<path d="M11.8462 21.5503C11.6968 21.9219 11.5593 22.2702 11.4163 22.6163C11.202 23.1359 10.9652 23.6469 10.7749 24.1757C10.6699 24.4701 10.5557 24.4687 10.3365 24.3038C9.48302 23.6667 8.84165 22.8626 8.40045 21.8922C8.27359 21.614 8.33913 21.4753 8.66123 21.4314C9.57112 21.3068 10.4704 21.1044 11.3944 21.0704C11.7616 21.0562 11.7489 21.3373 11.8469 21.5489V21.5503H11.8462Z" fill="#326CE4"/>
+<path d="M13.899 18.6595C14.484 18.661 14.8603 18.9653 14.8575 19.4375C14.854 19.9436 14.3226 20.507 13.8574 20.4971C13.369 20.4858 12.851 19.8891 12.8686 19.3568C12.8834 18.9137 13.2612 18.6581 13.8997 18.661L13.8983 18.6595H13.899Z" fill="#326CE4"/>
+</svg>
diff --git a/app/assets/ico/vendor/kubesolo.svg b/app/assets/ico/vendor/kubesolo.svg
new file mode 100644
index 0000000..ecda7b7
--- /dev/null
+++ b/app/assets/ico/vendor/kubesolo.svg
@@ -0,0 +1,985 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg version="1.1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1156 1221">
+<path d="M0 0 C12.54 0 25.08 0 38 0 C38 0.99 38 1.98 38 3 C43.61 3.33 49.22 3.66 55 4 C55.33 4.66 55.66 5.32 56 6 C58.58605332 6.4683265 58.58605332 6.4683265 61.5625 6.625 C62.57441406 6.69976563 63.58632813 6.77453125 64.62890625 6.8515625 C65.41136719 6.90054687 66.19382812 6.94953125 67 7 C67 7.99 67 8.98 67 10 C67.62648438 10.04898437 68.25296875 10.09796875 68.8984375 10.1484375 C69.71570313 10.22320312 70.53296875 10.29796875 71.375 10.375 C72.18710937 10.44460937 72.99921875 10.51421875 73.8359375 10.5859375 C76 11 76 11 78 13 C80.32275177 13.40047444 82.65739357 13.7397104 85 14 C85.33 14.99 85.66 15.98 86 17 C87.98 17 89.96 17 92 17 C92.33 17.99 92.66 18.98 93 20 C94.98 20.33 96.96 20.66 99 21 C99 21.99 99 22.98 99 24 C101.31 24 103.62 24 106 24 C106.33 24.99 106.66 25.98 107 27 C109.475 27.495 109.475 27.495 112 28 C112 28.99 112 29.98 112 31 C114.31 31 116.62 31 119 31 C119.33 31.99 119.66 32.98 120 34 C121.98 34.33 123.96 34.66 126 35 C126 35.99 126 36.98 126 38 C127.98 38 129.96 38 132 38 C132 38.99 132 39.98 132 41 C133.423125 40.9071875 133.423125 40.9071875 134.875 40.8125 C135.90625 40.874375 136.9375 40.93625 138 41 C138.66 41.99 139.32 42.98 140 44 C143.06556598 44.73343428 143.06556598 44.73343428 146 45 C146 45.99 146 46.98 146 48 C148.31 48 150.62 48 153 48 C153.33 48.99 153.66 49.98 154 51 C155.32303717 51.3721042 156.65737935 51.70630173 158 52 C158.33 52.66 158.66 53.32 159 54 C162.02934491 54.65772428 162.02934491 54.65772428 165 55 C165 55.99 165 56.98 165 58 C165.969375 58.12375 166.93875 58.2475 167.9375 58.375 C168.948125 58.58125 169.95875 58.7875 171 59 C171.33 59.66 171.66 60.32 172 61 C175.02934491 61.65772428 175.02934491 61.65772428 178 62 C178 62.99 178 63.98 178 65 C178.969375 65.12375 179.93875 65.2475 180.9375 65.375 C181.948125 65.58125 182.95875 65.7875 184 66 C184.33 66.66 184.66 67.32 185 68 C188.02934491 68.65772428 188.02934491 68.65772428 191 69 C191 69.99 191 70.98 191 72 C192.98 72 194.96 72 197 72 C197.33 72.99 197.66 73.98 198 75 C198.928125 75.103125 199.85625 75.20625 200.8125 75.3125 C204.16152638 76.03483902 204.8030365 76.59380188 207 79 C207.99 79 208.98 79 210 79 C210 79.99 210 80.98 210 82 C211.98 82.33 213.96 82.66 216 83 C216 83.99 216 84.98 216 86 C218.31 86 220.62 86 223 86 C223 86.99 223 87.98 223 89 C224.98 89.33 226.96 89.66 229 90 C229 90.99 229 91.98 229 93 C231.31 93 233.62 93 236 93 C236.33 93.99 236.66 94.98 237 96 C237.804375 96.12375 238.60875 96.2475 239.4375 96.375 C240.283125 96.58125 241.12875 96.7875 242 97 C242.33 97.66 242.66 98.32 243 99 C245.52733235 99.65555119 245.52733235 99.65555119 248 100 C248 100.66 248 101.32 248 102 C248.969375 102.28875 249.93875 102.5775 250.9375 102.875 C254 104 254 104 255 106 C257.52733235 106.65555119 257.52733235 106.65555119 260 107 C260 107.99 260 108.98 260 110 C262.31 110 264.62 110 267 110 C267.33 110.99 267.66 111.98 268 113 C268.804375 113.12375 269.60875 113.2475 270.4375 113.375 C271.283125 113.58125 272.12875 113.7875 273 114 C273.33 114.66 273.66 115.32 274 116 C276.52733235 116.65555119 276.52733235 116.65555119 279 117 C279 117.66 279 118.32 279 119 C280.98 119.66 282.96 120.32 285 121 C285 121.99 285 122.98 285 124 C286.98 124 288.96 124 291 124 C291.33 124.99 291.66 125.98 292 127 C293.98 127 295.96 127 298 127 C298 128.32 298 129.64 298 131 C299.98 131 301.96 131 304 131 C304 131.99 304 132.98 304 134 C305.98 134 307.96 134 310 134 C309.67 134.99 309.34 135.98 309 137 C309.969375 137.12375 310.93875 137.2475 311.9375 137.375 C312.948125 137.58125 313.95875 137.7875 315 138 C315.33 138.66 315.66 139.32 316 140 C319.02934491 140.65772428 319.02934491 140.65772428 322 141 C322.33 141.99 322.66 142.98 323 144 C323.804375 144.12375 324.60875 144.2475 325.4375 144.375 C326.283125 144.58125 327.12875 144.7875 328 145 C328.33 145.66 328.66 146.32 329 147 C329.78375 147.144375 330.5675 147.28875 331.375 147.4375 C334.32298401 148.06921086 335.02209075 148.84228081 337 151 C337.99 151.33 338.98 151.66 340 152 C340 152.66 340 153.32 340 154 C342.31 154.33 344.62 154.66 347 155 C347 155.66 347 156.32 347 157 C348.65 157.33 350.3 157.66 352 158 C352.33 159.32 352.66 160.64 353 162 C354.98 162 356.96 162 359 162 C359 162.99 359 163.98 359 165 C360.98 165 362.96 165 365 165 C364.67 165.99 364.34 166.98 364 168 C366.31 168.33 368.62 168.66 371 169 C371 169.99 371 170.98 371 172 C372.98 172 374.96 172 377 172 C377.33 172.99 377.66 173.98 378 175 C378.804375 175.12375 379.60875 175.2475 380.4375 175.375 C381.283125 175.58125 382.12875 175.7875 383 176 C383.33 176.66 383.66 177.32 384 178 C387.02934491 178.65772428 387.02934491 178.65772428 390 179 C390 179.99 390 180.98 390 182 C391.65 182.33 393.3 182.66 395 183 C395 183.66 395 184.32 395 185 C395.969375 185.12375 396.93875 185.2475 397.9375 185.375 C398.948125 185.58125 399.95875 185.7875 401 186 C401.33 186.66 401.66 187.32 402 188 C402.99 188.33 403.98 188.66 405 189 C408 190 408 190 409 192 C409.825 192.165 410.65 192.33 411.5 192.5 C412.325 192.665 413.15 192.83 414 193 C414.33 193.66 414.66 194.32 415 195 C418.02934491 195.65772428 418.02934491 195.65772428 421 196 C421.33 196.99 421.66 197.98 422 199 C423.32303717 199.3721042 424.65737935 199.70630173 426 200 C426.33 200.66 426.66 201.32 427 202 C427.825 202.165 428.65 202.33 429.5 202.5 C430.325 202.665 431.15 202.83 432 203 C432.33 203.66 432.66 204.32 433 205 C434.97888961 205.72693904 436.97954558 206.39816251 439 207 C439 207.99 439 208.98 439 210 C439.94875 209.938125 440.8975 209.87625 441.875 209.8125 C442.90625 209.874375 443.9375 209.93625 445 210 C445.66 210.99 446.32 211.98 447 213 C449.58380177 213.25030977 449.58380177 213.25030977 452 213 C452.33 213.99 452.66 214.98 453 216 C454.32303717 216.3721042 455.65737935 216.70630173 457 217 C457.33 217.66 457.66 218.32 458 219 C458.804375 219.144375 459.60875 219.28875 460.4375 219.4375 C463 220 463 220 465 223 C466.66014616 223.36442233 468.32706064 223.69972883 470 224 C470.33 224.66 470.66 225.32 471 226 C471.804375 226.144375 472.60875 226.28875 473.4375 226.4375 C476 227 476 227 478 230 C479.66014616 230.36442233 481.32706064 230.69972883 483 231 C483.33 231.66 483.66 232.32 484 233 C487.02934491 233.65772428 487.02934491 233.65772428 490 234 C490 234.66 490 235.32 490 236 C490.804375 236.28875 491.60875 236.5775 492.4375 236.875 C495 238 495 238 496 240 C499.02934491 240.65772428 499.02934491 240.65772428 502 241 C502 241.99 502 242.98 502 244 C502.78375 243.938125 503.5675 243.87625 504.375 243.8125 C505.24125 243.874375 506.1075 243.93625 507 244 C507.66 244.99 508.32 245.98 509 247 C512.06556598 247.73343428 512.06556598 247.73343428 515 248 C515 248.99 515 249.98 515 251 C516.98 251 518.96 251 521 251 C521.33 251.99 521.66 252.98 522 254 C523.98 254.33 525.96 254.66 528 255 C528 255.99 528 256.98 528 258 C530.31 258 532.62 258 535 258 C535.33 258.99 535.66 259.98 536 261 C536.99 261.66 537.98 262.32 539 263 C539 263.66 539 264.32 539 265 C540.32 265.33 541.64 265.66 543 266 C543 266.66 543 267.32 543 268 C543.99 268 544.98 268 546 268 C546.33 268.99 546.66 269.98 547 271 C547.99 271.33 548.98 271.66 550 272 C550 272.99 550 273.98 550 275 C550.99 275 551.98 275 553 275 C553.33 275.99 553.66 276.98 554 278 C554.99 278.33 555.98 278.66 557 279 C557 279.99 557 280.98 557 282 C557.99 282.33 558.98 282.66 560 283 C560 283.99 560 284.98 560 286 C560.99 286.33 561.98 286.66 563 287 C565.97663508 289.53889462 567.21486253 291.2051689 568 295 C568.66 295.33 569.32 295.66 570 296 C570.33 296.99 570.66 297.98 571 299 C571.99 299.66 572.98 300.32 574 301 C574.36162029 302.32594105 574.69728039 303.65938457 575 305 C575.66 305.33 576.32 305.66 577 306 C577.144375 306.66 577.28875 307.32 577.4375 308 C577.623125 308.66 577.80875 309.32 578 310 C578.99 310.33 579.98 310.66 581 311 C581 313.31 581 315.62 581 318 C581.99 318 582.98 318 584 318 C584.103125 319.11375 584.20625 320.2275 584.3125 321.375 C584.539375 322.57125 584.76625 323.7675 585 325 C585.99 325.66 586.98 326.32 588 327 C588.44140625 329.12890625 588.44140625 329.12890625 588.5625 331.5625 C588.64690135 333.93738847 588.64690135 333.93738847 589 336 C589.66 336.33 590.32 336.66 591 337 C591.33142013 340.43471767 591.46573403 343.82689444 591.56640625 347.2734375 C591.64581314 349.1861079 591.81613904 351.09453191 592 353 C592.66 353.33 593.32 353.66 594 354 C594 518.67 594 683.34 594 853 C593.34 853.33 592.68 853.66 592 854 C591.74051219 856.68923726 591.57872686 859.30476284 591.5 862 C591.42127314 864.69523716 591.25948781 867.31076274 591 870 C590.34 870.33 589.68 870.66 589 871 C588.64562795 873.29220405 588.55663389 875.55538982 588.44140625 877.87109375 C588 880 588 880 585 882 C584.26393501 885.56769552 584.26393501 885.56769552 584 889 C583.01 889 582.02 889 581 889 C581 891.31 581 893.62 581 896 C580.01 896.33 579.02 896.66 578 897 C577.6278958 898.32303717 577.29369827 899.65737935 577 901 C576.34 901.33 575.68 901.66 575 902 C574.67 902.825 574.34 903.65 574 904.5 C573 907 573 907 571 908 C570.7525 908.99 570.7525 908.99 570.5 910 C570.2525 910.99 570.2525 910.99 570 912 C569.34 912.33 568.68 912.66 568 913 C567.71125 913.598125 567.4225 914.19625 567.125 914.8125 C565.78469739 917.41864396 564.19813469 919.07663215 562 921 C561.34 921 560.68 921 560 921 C560 922.32 560 923.64 560 925 C559.01 925.33 558.02 925.66 557 926 C554.4140505 928.08865152 553.5623951 929.73810844 553 933 C552.34 933 551.68 933 551 933 C551 933.66 551 934.32 551 935 C550.1028125 935.1546875 550.1028125 935.1546875 549.1875 935.3125 C546.66155205 936.10636936 545.65114593 936.95572409 544 939 C543.67 939.99 543.34 940.98 543 942 C541.68 942 540.36 942 539 942 C539 942.99 539 943.98 539 945 C537.02 945.33 535.04 945.66 533 946 C533 946.99 533 947.98 533 949 C531.7934375 949.185625 531.7934375 949.185625 530.5625 949.375 C529.716875 949.58125 528.87125 949.7875 528 950 C527.67 950.66 527.34 951.32 527 952 C524.4375 952.625 524.4375 952.625 522 953 C521.67 953.99 521.34 954.98 521 956 C519.5459375 956.185625 519.5459375 956.185625 518.0625 956.375 C517.051875 956.58125 516.04125 956.7875 515 957 C514.67 957.66 514.34 958.32 514 959 C511.4375 959.625 511.4375 959.625 509 960 C508.67 960.99 508.34 961.98 508 963 C506.5459375 963.185625 506.5459375 963.185625 505.0625 963.375 C504.051875 963.58125 503.04125 963.7875 502 964 C501.67 964.66 501.34 965.32 501 966 C499.33333333 966.33333333 497.66666667 966.66666667 496 967 C495.67 967.66 495.34 968.32 495 969 C492.4375 969.625 492.4375 969.625 490 970 C490 970.99 490 971.98 490 973 C487.69 973 485.38 973 483 973 C482.67 973.99 482.34 974.98 482 976 C480.02 976.33 478.04 976.66 476 977 C476 977.99 476 978.98 476 980 C474.7934375 980.185625 474.7934375 980.185625 473.5625 980.375 C472.716875 980.58125 471.87125 980.7875 471 981 C470.67 981.66 470.34 982.32 470 983 C468.02 983 466.04 983 464 983 C463.67 984.32 463.34 985.64 463 987 C462.195625 987.12375 461.39125 987.2475 460.5625 987.375 C459.716875 987.58125 458.87125 987.7875 458 988 C457.67 988.66 457.34 989.32 457 990 C456.34 990.144375 455.68 990.28875 455 990.4375 C454.34 990.623125 453.68 990.80875 453 991 C452.67 991.99 452.34 992.98 452 994 C451.21625 993.938125 450.4325 993.87625 449.625 993.8125 C448.75875 993.874375 447.8925 993.93625 447 994 C446.34 994.99 445.68 995.98 445 997 C443.33985384 997.36442233 441.67293936 997.69972883 440 998 C439.67 998.66 439.34 999.32 439 1000 C437.02111039 1000.72693904 435.02045442 1001.39816251 433 1002 C433 1002.66 433 1003.32 433 1004 C431.5459375 1004.185625 431.5459375 1004.185625 430.0625 1004.375 C429.051875 1004.58125 428.04125 1004.7875 427 1005 C426.67 1005.66 426.34 1006.32 426 1007 C425.34 1007.144375 424.68 1007.28875 424 1007.4375 C423.34 1007.623125 422.68 1007.80875 422 1008 C421.67 1008.99 421.34 1009.98 421 1011 C419.5459375 1011.185625 419.5459375 1011.185625 418.0625 1011.375 C417.051875 1011.58125 416.04125 1011.7875 415 1012 C414.67 1012.66 414.34 1013.32 414 1014 C410.9375 1014.625 410.9375 1014.625 408 1015 C407.67 1015.99 407.34 1016.98 407 1018 C405.67696283 1018.3721042 404.34262065 1018.70630173 403 1019 C402.67 1019.66 402.34 1020.32 402 1021 C400.33333333 1021.33333333 398.66666667 1021.66666667 397 1022 C396.67 1022.66 396.34 1023.32 396 1024 C392.9375 1024.625 392.9375 1024.625 390 1025 C390 1025.99 390 1026.98 390 1028 C388.02 1028 386.04 1028 384 1028 C384 1028.99 384 1029.98 384 1031 C382.02 1031.66 380.04 1032.32 378 1033 C378 1033.66 378 1034.32 378 1035 C376.5459375 1035.185625 376.5459375 1035.185625 375.0625 1035.375 C373.5465625 1035.684375 373.5465625 1035.684375 372 1036 C371.67 1036.66 371.34 1037.32 371 1038 C370.34 1038.144375 369.68 1038.28875 369 1038.4375 C368.34 1038.623125 367.68 1038.80875 367 1039 C366.67 1039.99 366.34 1040.98 366 1042 C364.5459375 1042.185625 364.5459375 1042.185625 363.0625 1042.375 C361.5465625 1042.684375 361.5465625 1042.684375 360 1043 C359.67 1043.66 359.34 1044.32 359 1045 C358.21625 1045.144375 357.4325 1045.28875 356.625 1045.4375 C353.67701599 1046.06921086 352.97790925 1046.84228081 351 1049 C350.01 1049.33 349.02 1049.66 348 1050 C347.67 1050.66 347.34 1051.32 347 1052 C345.33333333 1052.33333333 343.66666667 1052.66666667 342 1053 C341.67 1053.66 341.34 1054.32 341 1055 C337.9375 1055.625 337.9375 1055.625 335 1056 C335 1056.99 335 1057.98 335 1059 C333.02 1059 331.04 1059 329 1059 C329 1059.99 329 1060.98 329 1062 C328.030625 1062.28875 327.06125 1062.5775 326.0625 1062.875 C322.89335797 1063.64214682 322.89335797 1063.64214682 322 1066 C320.33333333 1066.33333333 318.66666667 1066.66666667 317 1067 C316.67 1067.66 316.34 1068.32 316 1069 C315.34 1069.144375 314.68 1069.28875 314 1069.4375 C313.34 1069.623125 312.68 1069.80875 312 1070 C311.67 1070.99 311.34 1071.98 311 1073 C310.21625 1072.938125 309.4325 1072.87625 308.625 1072.8125 C307.75875 1072.874375 306.8925 1072.93625 306 1073 C305.34 1073.99 304.68 1074.98 304 1076 C302.33499557 1076.34153937 300.66821323 1076.67449498 299 1077 C298.484375 1077.515625 297.96875 1078.03125 297.4375 1078.5625 C296.963125 1079.036875 296.48875 1079.51125 296 1080 C294.68 1080 293.36 1080 292 1080 C292 1080.99 292 1081.98 292 1083 C290.5459375 1083.185625 290.5459375 1083.185625 289.0625 1083.375 C287.5465625 1083.684375 287.5465625 1083.684375 286 1084 C285.67 1084.66 285.34 1085.32 285 1086 C282.4375 1086.625 282.4375 1086.625 280 1087 C280 1087.99 280 1088.98 280 1090 C278.5459375 1090.185625 278.5459375 1090.185625 277.0625 1090.375 C275.5465625 1090.684375 275.5465625 1090.684375 274 1091 C273.67 1091.66 273.34 1092.32 273 1093 C271.35636866 1093.72159424 269.68949614 1094.39351421 268 1095 C268 1095.66 268 1096.32 268 1097 C265.69 1097 263.38 1097 261 1097 C261 1097.99 261 1098.98 261 1100 C258.69 1100.33 256.38 1100.66 254 1101 C254 1101.66 254 1102.32 254 1103 C252.35 1103.33 250.7 1103.66 249 1104 C249 1104.99 249 1105.98 249 1107 C247.02 1107 245.04 1107 243 1107 C243 1107.99 243 1108.98 243 1110 C241.02 1110.33 239.04 1110.66 237 1111 C236.67 1111.99 236.34 1112.98 236 1114 C234.02 1114 232.04 1114 230 1114 C230 1114.99 230 1115.98 230 1117 C228.02 1117.66 226.04 1118.32 224 1119 C224 1119.66 224 1120.32 224 1121 C222.5459375 1121.185625 222.5459375 1121.185625 221.0625 1121.375 C219.5465625 1121.684375 219.5465625 1121.684375 218 1122 C217.67 1122.66 217.34 1123.32 217 1124 C214.4375 1124.625 214.4375 1124.625 212 1125 C211.67 1125.99 211.34 1126.98 211 1128 C209.02 1128 207.04 1128 205 1128 C205 1128.99 205 1129.98 205 1131 C204.071875 1131.103125 203.14375 1131.20625 202.1875 1131.3125 C198.79667432 1132.04385456 198.26653158 1132.63044426 196 1135 C194.68 1135 193.36 1135 192 1135 C192 1135.99 192 1136.98 192 1138 C190.5459375 1138.185625 190.5459375 1138.185625 189.0625 1138.375 C187.5465625 1138.684375 187.5465625 1138.684375 186 1139 C185.67 1139.66 185.34 1140.32 185 1141 C181.9375 1141.625 181.9375 1141.625 179 1142 C179 1142.99 179 1143.98 179 1145 C177.5459375 1145.185625 177.5459375 1145.185625 176.0625 1145.375 C174.5465625 1145.684375 174.5465625 1145.684375 173 1146 C172.67 1146.66 172.34 1147.32 172 1148 C170.35636866 1148.72159424 168.68949614 1149.39351421 167 1150 C167 1150.66 167 1151.32 167 1152 C165.2984375 1152.185625 165.2984375 1152.185625 163.5625 1152.375 C161.7990625 1152.684375 161.7990625 1152.684375 160 1153 C159.67 1153.66 159.34 1154.32 159 1155 C156.4375 1155.625 156.4375 1155.625 154 1156 C153.67 1156.99 153.34 1157.98 153 1159 C151.35 1159 149.7 1159 148 1159 C147.67 1159.99 147.34 1160.98 147 1162 C145.5459375 1162.185625 145.5459375 1162.185625 144.0625 1162.375 C142.5465625 1162.684375 142.5465625 1162.684375 141 1163 C140.67 1163.66 140.34 1164.32 140 1165 C138 1165.66666667 136 1166.33333333 134 1167 C133.67 1167.66 133.34 1168.32 133 1169 C131.02 1169 129.04 1169 127 1169 C127 1169.99 127 1170.98 127 1172 C125.02 1172.66 123.04 1173.32 121 1174 C121 1174.66 121 1175.32 121 1176 C119.2984375 1176.185625 119.2984375 1176.185625 117.5625 1176.375 C115.7990625 1176.684375 115.7990625 1176.684375 114 1177 C113.67 1177.66 113.34 1178.32 113 1179 C109.9375 1179.625 109.9375 1179.625 107 1180 C106.67 1180.99 106.34 1181.98 106 1183 C103.69 1183 101.38 1183 99 1183 C99 1183.99 99 1184.98 99 1186 C96.69 1186.33 94.38 1186.66 92 1187 C91.67 1187.99 91.34 1188.98 91 1190 C88.36 1190.33 85.72 1190.66 83 1191 C83 1191.66 83 1192.32 83 1193 C79.92382812 1193.29296875 79.92382812 1193.29296875 76.84765625 1193.5859375 C76.23792969 1193.72257812 75.62820313 1193.85921875 75 1194 C74.67 1194.66 74.34 1195.32 74 1196 C71.93359375 1196.6328125 71.93359375 1196.6328125 69.4375 1197.125 C68.61121094 1197.29257813 67.78492188 1197.46015625 66.93359375 1197.6328125 C66.29550781 1197.75398438 65.65742187 1197.87515625 65 1198 C65 1198.66 65 1199.32 65 1200 C64.28972656 1200.04898437 63.57945312 1200.09796875 62.84765625 1200.1484375 C61.46900391 1200.26058594 61.46900391 1200.26058594 60.0625 1200.375 C59.14597656 1200.44460938 58.22945312 1200.51421875 57.28515625 1200.5859375 C56.53105469 1200.72257812 55.77695312 1200.85921875 55 1201 C54.67 1201.66 54.34 1202.32 54 1203 C48.39 1203.33 42.78 1203.66 37 1204 C36.67 1204.99 36.34 1205.98 36 1207 C25.44 1207 14.88 1207 4 1207 C4 1206.01 4 1205.02 4 1204 C-1.94 1203.67 -7.88 1203.34 -14 1203 C-14.33 1202.34 -14.66 1201.68 -15 1201 C-17.58605332 1200.5316735 -17.58605332 1200.5316735 -20.5625 1200.375 C-21.57441406 1200.30023437 -22.58632813 1200.22546875 -23.62890625 1200.1484375 C-24.41136719 1200.09945313 -25.19382812 1200.05046875 -26 1200 C-26 1199.34 -26 1198.68 -26 1198 C-26.63808594 1197.87882812 -27.27617188 1197.75765625 -27.93359375 1197.6328125 C-28.75988281 1197.46523437 -29.58617187 1197.29765625 -30.4375 1197.125 C-31.26121094 1196.96257812 -32.08492187 1196.80015625 -32.93359375 1196.6328125 C-33.61550781 1196.42398437 -34.29742188 1196.21515625 -35 1196 C-35.33 1195.34 -35.66 1194.68 -36 1194 C-38.32156597 1193.59270772 -40.6568787 1193.25561323 -43 1193 C-43 1192.01 -43 1191.02 -43 1190 C-45.31 1190 -47.62 1190 -50 1190 C-50.33 1188.68 -50.66 1187.36 -51 1186 C-51.928125 1186.061875 -52.85625 1186.12375 -53.8125 1186.1875 C-57.44303323 1185.97393922 -57.68902983 1185.52105837 -60 1183 C-61.32 1183 -62.64 1183 -64 1183 C-64.33 1182.01 -64.66 1181.02 -65 1180 C-66.98 1179.67 -68.96 1179.34 -71 1179 C-71 1178.01 -71 1177.02 -71 1176 C-72.65 1176 -74.3 1176 -76 1176 C-76 1175.01 -76 1174.02 -76 1173 C-76.969375 1172.87625 -77.93875 1172.7525 -78.9375 1172.625 C-79.948125 1172.41875 -80.95875 1172.2125 -82 1172 C-82.33 1171.34 -82.66 1170.68 -83 1170 C-86.02934491 1169.34227572 -86.02934491 1169.34227572 -89 1169 C-89 1168.01 -89 1167.02 -89 1166 C-89.969375 1165.87625 -90.93875 1165.7525 -91.9375 1165.625 C-92.948125 1165.41875 -93.95875 1165.2125 -95 1165 C-95.33 1164.34 -95.66 1163.68 -96 1163 C-99.02934491 1162.34227572 -99.02934491 1162.34227572 -102 1162 C-102 1161.01 -102 1160.02 -102 1159 C-102.94875 1159.061875 -103.8975 1159.12375 -104.875 1159.1875 C-105.90625 1159.125625 -106.9375 1159.06375 -108 1159 C-108.66 1158.01 -109.32 1157.02 -110 1156 C-112.05925139 1155.27617533 -112.05925139 1155.27617533 -114 1155 C-114 1154.01 -114 1153.02 -114 1152 C-116.31 1152 -118.62 1152 -121 1152 C-121 1151.01 -121 1150.02 -121 1149 C-122.98 1148.67 -124.96 1148.34 -127 1148 C-127 1147.01 -127 1146.02 -127 1145 C-128.98 1145 -130.96 1145 -133 1145 C-133.33 1144.01 -133.66 1143.02 -134 1142 C-134.969375 1141.87625 -135.93875 1141.7525 -136.9375 1141.625 C-137.948125 1141.41875 -138.95875 1141.2125 -140 1141 C-140.33 1140.34 -140.66 1139.68 -141 1139 C-141.804375 1138.855625 -142.60875 1138.71125 -143.4375 1138.5625 C-146 1138 -146 1138 -148 1135 C-149.32 1135 -150.64 1135 -152 1135 C-152.66 1134.01 -153.32 1133.02 -154 1132 C-156.56282742 1131.27034634 -156.56282742 1131.27034634 -159 1131 C-159 1130.34 -159 1129.68 -159 1129 C-159.969375 1128.71125 -160.93875 1128.4225 -161.9375 1128.125 C-165 1127 -165 1127 -166 1125 C-169.02934491 1124.34227572 -169.02934491 1124.34227572 -172 1124 C-172 1123.01 -172 1122.02 -172 1121 C-172.78375 1121.061875 -173.5675 1121.12375 -174.375 1121.1875 C-175.24125 1121.125625 -176.1075 1121.06375 -177 1121 C-177.66 1120.01 -178.32 1119.02 -179 1118 C-180.66014616 1117.63557767 -182.32706064 1117.30027117 -184 1117 C-184.33 1116.34 -184.66 1115.68 -185 1115 C-188.02934491 1114.34227572 -188.02934491 1114.34227572 -191 1114 C-191 1113.01 -191 1112.02 -191 1111 C-192.65 1110.67 -194.3 1110.34 -196 1110 C-196 1109.34 -196 1108.68 -196 1108 C-198.31 1107.67 -200.62 1107.34 -203 1107 C-203 1106.01 -203 1105.02 -203 1104 C-203.78375 1104.061875 -204.5675 1104.12375 -205.375 1104.1875 C-206.24125 1104.125625 -207.1075 1104.06375 -208 1104 C-208.66 1103.01 -209.32 1102.02 -210 1101 C-211.66014616 1100.63557767 -213.32706064 1100.30027117 -215 1100 C-215.33 1099.34 -215.66 1098.68 -216 1098 C-218.32156597 1097.59270772 -220.6568787 1097.25561323 -223 1097 C-223 1095.68 -223 1094.36 -223 1093 C-224.98 1093 -226.96 1093 -229 1093 C-229 1092.01 -229 1091.02 -229 1090 C-230.65 1090 -232.3 1090 -234 1090 C-234 1089.01 -234 1088.02 -234 1087 C-235.7015625 1086.814375 -235.7015625 1086.814375 -237.4375 1086.625 C-238.613125 1086.41875 -239.78875 1086.2125 -241 1086 C-241.33 1085.34 -241.66 1084.68 -242 1084 C-244.52733235 1083.34444881 -244.52733235 1083.34444881 -247 1083 C-247 1082.01 -247 1081.02 -247 1080 C-249.31 1079.67 -251.62 1079.34 -254 1079 C-254 1078.01 -254 1077.02 -254 1076 C-254.94875 1076.061875 -255.8975 1076.12375 -256.875 1076.1875 C-257.90625 1076.125625 -258.9375 1076.06375 -260 1076 C-260.66 1075.01 -261.32 1074.02 -262 1073 C-264.58380177 1072.74969023 -264.58380177 1072.74969023 -267 1073 C-267.33 1072.01 -267.66 1071.02 -268 1070 C-269.98 1069.67 -271.96 1069.34 -274 1069 C-274 1068.34 -274 1067.68 -274 1067 C-275.65 1066.67 -277.3 1066.34 -279 1066 C-279 1065.01 -279 1064.02 -279 1063 C-279.969375 1062.87625 -280.93875 1062.7525 -281.9375 1062.625 C-282.948125 1062.41875 -283.95875 1062.2125 -285 1062 C-285.33 1061.34 -285.66 1060.68 -286 1060 C-289.02934491 1059.34227572 -289.02934491 1059.34227572 -292 1059 C-292 1058.01 -292 1057.02 -292 1056 C-292.969375 1055.87625 -293.93875 1055.7525 -294.9375 1055.625 C-295.948125 1055.41875 -296.95875 1055.2125 -298 1055 C-298.33 1054.34 -298.66 1053.68 -299 1053 C-302.02934491 1052.34227572 -302.02934491 1052.34227572 -305 1052 C-305 1051.01 -305 1050.02 -305 1049 C-306.98 1049 -308.96 1049 -311 1049 C-311.33 1048.01 -311.66 1047.02 -312 1046 C-313.65 1045.67 -315.3 1045.34 -317 1045 C-317 1044.01 -317 1043.02 -317 1042 C-319.31 1042 -321.62 1042 -324 1042 C-324 1041.01 -324 1040.02 -324 1039 C-325.98 1038.67 -327.96 1038.34 -330 1038 C-330 1037.01 -330 1036.02 -330 1035 C-331.98 1035 -333.96 1035 -336 1035 C-336.33 1034.01 -336.66 1033.02 -337 1032 C-338.98 1031.67 -340.96 1031.34 -343 1031 C-343 1030.01 -343 1029.02 -343 1028 C-344.98 1028 -346.96 1028 -349 1028 C-349 1027.01 -349 1026.02 -349 1025 C-350.98 1025 -352.96 1025 -355 1025 C-355 1024.01 -355 1023.02 -355 1022 C-355.969375 1021.87625 -356.93875 1021.7525 -357.9375 1021.625 C-358.948125 1021.41875 -359.95875 1021.2125 -361 1021 C-361.33 1020.34 -361.66 1019.68 -362 1019 C-363.66072849 1018.31867549 -365.327767 1017.65257873 -367 1017 C-367.66 1016.34 -368.32 1015.68 -369 1015 C-369.845625 1014.835 -370.69125 1014.67 -371.5625 1014.5 C-372.366875 1014.335 -373.17125 1014.17 -374 1014 C-374.33 1013.34 -374.66 1012.68 -375 1012 C-375.804375 1011.855625 -376.60875 1011.71125 -377.4375 1011.5625 C-380 1011 -380 1011 -382 1008 C-383.66014616 1007.63557767 -385.32706064 1007.30027117 -387 1007 C-387.33 1006.34 -387.66 1005.68 -388 1005 C-391.02934491 1004.34227572 -391.02934491 1004.34227572 -394 1004 C-394 1003.01 -394 1002.02 -394 1001 C-394.804375 1000.87625 -395.60875 1000.7525 -396.4375 1000.625 C-397.283125 1000.41875 -398.12875 1000.2125 -399 1000 C-399.33 999.34 -399.66 998.68 -400 998 C-400.825 997.835 -401.65 997.67 -402.5 997.5 C-403.325 997.335 -404.15 997.17 -405 997 C-405.33 996.34 -405.66 995.68 -406 995 C-406.99 994.67 -407.98 994.34 -409 994 C-409.99 993.67 -410.98 993.34 -412 993 C-412.33 992.34 -412.66 991.68 -413 991 C-413.825 990.835 -414.65 990.67 -415.5 990.5 C-416.325 990.335 -417.15 990.17 -418 990 C-418.33 989.34 -418.66 988.68 -419 988 C-422.02934491 987.34227572 -422.02934491 987.34227572 -425 987 C-425.33 986.01 -425.66 985.02 -426 984 C-427.2065625 983.814375 -427.2065625 983.814375 -428.4375 983.625 C-429.283125 983.41875 -430.12875 983.2125 -431 983 C-431.33 982.34 -431.66 981.68 -432 981 C-434.52733235 980.34444881 -434.52733235 980.34444881 -437 980 C-437 979.01 -437 978.02 -437 977 C-438.134375 976.87625 -439.26875 976.7525 -440.4375 976.625 C-441.613125 976.41875 -442.78875 976.2125 -444 976 C-444.33 975.34 -444.66 974.68 -445 974 C-447.52733235 973.34444881 -447.52733235 973.34444881 -450 973 C-450 972.01 -450 971.02 -450 970 C-451.175625 970.0928125 -451.175625 970.0928125 -452.375 970.1875 C-453.24125 970.125625 -454.1075 970.06375 -455 970 C-455.99 968.515 -455.99 968.515 -457 967 C-460.06556598 966.26656572 -460.06556598 966.26656572 -463 966 C-463 965.01 -463 964.02 -463 963 C-464.98 963 -466.96 963 -469 963 C-469 962.01 -469 961.02 -469 960 C-470.134375 959.87625 -471.26875 959.7525 -472.4375 959.625 C-473.613125 959.41875 -474.78875 959.2125 -476 959 C-476.33 958.34 -476.66 957.68 -477 957 C-479.52733235 956.34444881 -479.52733235 956.34444881 -482 956 C-482 955.01 -482 954.02 -482 953 C-483.98 952.67 -485.96 952.34 -488 952 C-488 951.01 -488 950.02 -488 949 C-489.32 949 -490.64 949 -492 949 C-493.5625 947.625 -493.5625 947.625 -495 946 C-495.99 945.34 -496.98 944.68 -498 944 C-498 943.34 -498 942.68 -498 942 C-498.99 941.67 -499.98 941.34 -501 941 C-501.33 940.34 -501.66 939.68 -502 939 C-502.99 938.67 -503.98 938.34 -505 938 C-505.33 937.34 -505.66 936.68 -506 936 C-506.99 935.67 -507.98 935.34 -509 935 C-509 934.01 -509 933.02 -509 932 C-509.99 932 -510.98 932 -512 932 C-512.495 930.515 -512.495 930.515 -513 929 C-513.515625 928.484375 -514.03125 927.96875 -514.5625 927.4375 C-515.2740625 926.7259375 -515.2740625 926.7259375 -516 926 C-516 925.34 -516 924.68 -516 924 C-516.99 924 -517.98 924 -519 924 C-519 923.01 -519 922.02 -519 921 C-519.639375 920.731875 -520.27875 920.46375 -520.9375 920.1875 C-523 919 -523 919 -524 916 C-524.66 915.67 -525.32 915.34 -526 915 C-526.33 914.01 -526.66 913.02 -527 912 C-527.66 911.67 -528.32 911.34 -529 911 C-529.66666667 909.33333333 -530.33333333 907.66666667 -531 906 C-531.66 905.67 -532.32 905.34 -533 905 C-533.33333333 903.33333333 -533.66666667 901.66666667 -534 900 C-534.66 899.67 -535.32 899.34 -536 899 C-536.72693904 897.02111039 -537.39816251 895.02045442 -538 893 C-538.66 893 -539.32 893 -540 893 C-540.185625 891.2984375 -540.185625 891.2984375 -540.375 889.5625 C-540.58125 888.386875 -540.7875 887.21125 -541 886 C-541.66 885.67 -542.32 885.34 -543 885 C-543.4140625 882.93359375 -543.4140625 882.93359375 -543.625 880.4375 C-543.73714844 879.19806641 -543.73714844 879.19806641 -543.8515625 877.93359375 C-543.92503906 876.97646484 -543.92503906 876.97646484 -544 876 C-544.99 875.67 -545.98 875.34 -547 875 C-547 871.7 -547 868.4 -547 865 C-547.99 865 -548.98 865 -550 865 C-550.33 861.04 -550.66 857.08 -551 853 C-551.99 852.67 -552.98 852.34 -554 852 C-554 687.99 -554 523.98 -554 355 C-553.01 355 -552.02 355 -551 355 C-550.67 350.38 -550.34 345.76 -550 341 C-549.01 341 -548.02 341 -547 341 C-547 337.7 -547 334.4 -547 331 C-546.01 331 -545.02 331 -544 331 C-543.95101562 330.36191406 -543.90203125 329.72382813 -543.8515625 329.06640625 C-543.77679687 328.24011719 -543.70203125 327.41382813 -543.625 326.5625 C-543.55539062 325.73878906 -543.48578125 324.91507812 -543.4140625 324.06640625 C-543.27742187 323.38449219 -543.14078125 322.70257813 -543 322 C-542.34 321.67 -541.68 321.34 -541 321 C-540.59270772 318.67843403 -540.25561323 316.3431213 -540 314 C-539.01 313.67 -538.02 313.34 -537 313 C-536.87625 312.195625 -536.7525 311.39125 -536.625 310.5625 C-536.41875 309.716875 -536.2125 308.87125 -536 308 C-535.34 307.67 -534.68 307.34 -534 307 C-533.855625 306.21625 -533.71125 305.4325 -533.5625 304.625 C-532.79658202 301.0507161 -531.07376153 299.90856745 -528.375 297.625 C-526.5933412 295.51940324 -526.36419948 293.69507616 -526 291 C-525.01 291 -524.02 291 -523 291 C-522.87625 290.360625 -522.7525 289.72125 -522.625 289.0625 C-522.41875 288.381875 -522.2125 287.70125 -522 287 C-521.34 286.67 -520.68 286.34 -520 286 C-519.67 285.01 -519.34 284.02 -519 283 C-518.01 283 -517.02 283 -516 283 C-515.67 281.68 -515.34 280.36 -515 279 C-514.01 279 -513.02 279 -512 279 C-512 278.01 -512 277.02 -512 276 C-511.01 276 -510.02 276 -509 276 C-508.34 274.68 -507.68 273.36 -507 272 C-506.34 272 -505.68 272 -505 272 C-505 271.01 -505 270.02 -505 269 C-504.01 268.67 -503.02 268.34 -502 268 C-501.319375 267.319375 -500.63875 266.63875 -499.9375 265.9375 C-499.298125 265.298125 -498.65875 264.65875 -498 264 C-497.34 264 -496.68 264 -496 264 C-495.67 263.01 -495.34 262.02 -495 261 C-494.01 260.67 -493.02 260.34 -492 260 C-491.67 259.34 -491.34 258.68 -491 258 C-490.01 257.67 -489.02 257.34 -488 257 C-487.67 256.34 -487.34 255.68 -487 255 C-483.9375 254.375 -483.9375 254.375 -481 254 C-481 253.01 -481 252.02 -481 251 C-479.02 251 -477.04 251 -475 251 C-475 250.01 -475 249.02 -475 248 C-473.02 247.67 -471.04 247.34 -469 247 C-469.33 246.01 -469.66 245.02 -470 244 C-467.69 243.67 -465.38 243.34 -463 243 C-463 242.34 -463 241.68 -463 241 C-461.576875 240.8453125 -461.576875 240.8453125 -460.125 240.6875 C-456.70892499 240.31460705 -456.70892499 240.31460705 -455 237 C-451.875 236.8125 -451.875 236.8125 -449 237 C-449 236.01 -449 235.02 -449 234 C-448.030625 233.87625 -447.06125 233.7525 -446.0625 233.625 C-445.051875 233.41875 -444.04125 233.2125 -443 233 C-442.67 232.34 -442.34 231.68 -442 231 C-440.02111039 230.27306096 -438.02045442 229.60183749 -436 229 C-436 228.34 -436 227.68 -436 227 C-433.69 227 -431.38 227 -429 227 C-429 226.01 -429 225.02 -429 224 C-426.03 223.01 -426.03 223.01 -423 222 C-423 221.34 -423 220.68 -423 220 C-420.69 220 -418.38 220 -416 220 C-416 219.01 -416 218.02 -416 217 C-414.6696875 216.5978125 -414.6696875 216.5978125 -413.3125 216.1875 C-407.70923408 214.27175632 -407.70923408 214.27175632 -404 210 C-402.576875 209.7834375 -402.576875 209.7834375 -401.125 209.5625 C-397.76217163 208.95719089 -397.19205718 208.40082453 -395 206 C-394.01 206 -393.02 206 -392 206 C-391.67 205.01 -391.34 204.02 -391 203 C-389.02 203 -387.04 203 -385 203 C-385 202.01 -385 201.02 -385 200 C-383.02 199.67 -381.04 199.34 -379 199 C-378.67 198.01 -378.34 197.02 -378 196 C-376.02 196 -374.04 196 -372 196 C-372 195.01 -372 194.02 -372 193 C-370.02 192.34 -368.04 191.68 -366 191 C-366 190.34 -366 189.68 -366 189 C-365.030625 188.87625 -364.06125 188.7525 -363.0625 188.625 C-362.051875 188.41875 -361.04125 188.2125 -360 188 C-359.67 187.34 -359.34 186.68 -359 186 C-356.4375 185.375 -356.4375 185.375 -354 185 C-353.67 184.01 -353.34 183.02 -353 182 C-352.21625 182.061875 -351.4325 182.12375 -350.625 182.1875 C-349.75875 182.125625 -348.8925 182.06375 -348 182 C-347.34 181.01 -346.68 180.02 -346 179 C-344.33985384 178.63557767 -342.67293936 178.30027117 -341 178 C-340.67 177.34 -340.34 176.68 -340 176 C-336.9375 175.375 -336.9375 175.375 -334 175 C-334 174.01 -334 173.02 -334 172 C-332.35 172 -330.7 172 -329 172 C-328.67 171.01 -328.34 170.02 -328 169 C-324.9375 167.8125 -324.9375 167.8125 -322 167 C-322 166.34 -322 165.68 -322 165 C-321.030625 164.87625 -320.06125 164.7525 -319.0625 164.625 C-318.051875 164.41875 -317.04125 164.2125 -316 164 C-315.67 163.34 -315.34 162.68 -315 162 C-312.4375 161.375 -312.4375 161.375 -310 161 C-309.67 160.01 -309.34 159.02 -309 158 C-308.030625 157.87625 -307.06125 157.7525 -306.0625 157.625 C-305.051875 157.41875 -304.04125 157.2125 -303 157 C-302.67 156.34 -302.34 155.68 -302 155 C-300.33333333 154.66666667 -298.66666667 154.33333333 -297 154 C-296.67 153.34 -296.34 152.68 -296 152 C-293.4375 151.375 -293.4375 151.375 -291 151 C-291 150.01 -291 149.02 -291 148 C-289.5459375 147.814375 -289.5459375 147.814375 -288.0625 147.625 C-287.051875 147.41875 -286.04125 147.2125 -285 147 C-284.67 146.34 -284.34 145.68 -284 145 C-282 144.33333333 -280 143.66666667 -278 143 C-277.67 142.34 -277.34 141.68 -277 141 C-275.33333333 140.66666667 -273.66666667 140.33333333 -272 140 C-271.67 139.34 -271.34 138.68 -271 138 C-267.9375 137.375 -267.9375 137.375 -265 137 C-265 136.01 -265 135.02 -265 134 C-264.195625 133.87625 -263.39125 133.7525 -262.5625 133.625 C-261.716875 133.41875 -260.87125 133.2125 -260 133 C-259.67 132.34 -259.34 131.68 -259 131 C-256.4375 130.375 -256.4375 130.375 -254 130 C-253.67 129.01 -253.34 128.02 -253 127 C-251.35 127 -249.7 127 -248 127 C-247.67 126.01 -247.34 125.02 -247 124 C-243.7 124 -240.4 124 -237 124 C-237 124.99 -237 125.98 -237 127 C-236.030625 127.12375 -235.06125 127.2475 -234.0625 127.375 C-233.051875 127.58125 -232.04125 127.7875 -231 128 C-230.67 128.66 -230.34 129.32 -230 130 C-227.47266765 130.65555119 -227.47266765 130.65555119 -225 131 C-225 131.99 -225 132.98 -225 134 C-223.02 134 -221.04 134 -219 134 C-219 134.99 -219 135.98 -219 137 C-216.69 137.33 -214.38 137.66 -212 138 C-212 138.99 -212 139.98 -212 141 C-211.62875 140.525625 -211.2575 140.05125 -210.875 139.5625 C-208.37353038 137.47794198 -206.18406582 137.35378509 -203 137 C-203 136.01 -203 135.02 -203 134 C-201.5459375 133.814375 -201.5459375 133.814375 -200.0625 133.625 C-199.051875 133.41875 -198.04125 133.2125 -197 133 C-196.67 132.34 -196.34 131.68 -196 131 C-194.02416285 130.26480478 -192.01822402 129.60927518 -190 129 C-188.88625 128.62875 -187.7725 128.2575 -186.625 127.875 C-185.75875 127.58625 -184.8925 127.2975 -184 127 C-184.33 126.34 -184.66 125.68 -185 125 C-187.02463255 124.34786708 -187.02463255 124.34786708 -189 124 C-189 123.01 -189 122.02 -189 121 C-190.98 120.34 -192.96 119.68 -195 119 C-195 118.34 -195 117.68 -195 117 C-196.32 117 -197.64 117 -199 117 C-199 116.01 -199 115.02 -199 114 C-199.969375 113.87625 -200.93875 113.7525 -201.9375 113.625 C-202.948125 113.41875 -203.95875 113.2125 -205 113 C-205.33 112.34 -205.66 111.68 -206 111 C-208.02463255 110.34786708 -208.02463255 110.34786708 -210 110 C-210 108.02 -210 106.04 -210 104 C-209.360625 103.71125 -208.72125 103.4225 -208.0625 103.125 C-205.84793921 102.17176549 -205.84793921 102.17176549 -205 100 C-201.9375 99.375 -201.9375 99.375 -199 99 C-198.67 98.01 -198.34 97.02 -198 96 C-196.35 96 -194.7 96 -193 96 C-192.67 95.01 -192.34 94.02 -192 93 C-190.5459375 92.814375 -190.5459375 92.814375 -189.0625 92.625 C-187.5465625 92.315625 -187.5465625 92.315625 -186 92 C-185.67 91.34 -185.34 90.68 -185 90 C-181.9375 89.375 -181.9375 89.375 -179 89 C-179 88.01 -179 87.02 -179 86 C-177.35 86 -175.7 86 -174 86 C-174 85.01 -174 84.02 -174 83 C-172.02 83 -170.04 83 -168 83 C-168 81.68 -168 80.36 -168 79 C-165.69 79 -163.38 79 -161 79 C-161 78.01 -161 77.02 -161 76 C-160.071875 75.896875 -159.14375 75.79375 -158.1875 75.6875 C-154.8495811 74.96755671 -154.14853242 74.45546562 -152 72 C-150.515 71.505 -150.515 71.505 -149 71 C-148.67 70.34 -148.34 69.68 -148 69 C-146.66666667 68.66666667 -145.33333333 68.33333333 -144 68 C-143.67 67.34 -143.34 66.68 -143 66 C-140.67843403 65.59270772 -138.3431213 65.25561323 -136 65 C-136 64.01 -136 63.02 -136 62 C-134.02 62 -132.04 62 -130 62 C-129.67 61.01 -129.34 60.02 -129 59 C-126.4375 57.8125 -126.4375 57.8125 -124 57 C-124 56.34 -124 55.68 -124 55 C-121.69 55 -119.38 55 -117 55 C-117 54.01 -117 53.02 -117 52 C-115.02 51.34 -113.04 50.68 -111 50 C-111 49.34 -111 48.68 -111 48 C-107.535 47.505 -107.535 47.505 -104 47 C-104 46.34 -104 45.68 -104 45 C-103.13375 44.731875 -102.2675 44.46375 -101.375 44.1875 C-95.22129592 42.32539704 -95.22129592 42.32539704 -91 38 C-89 37.66666667 -87 37.33333333 -85 37 C-84.67 36.34 -84.34 35.68 -84 35 C-82.02111039 34.27306096 -80.02045442 33.60183749 -78 33 C-78 32.34 -78 31.68 -78 31 C-76.5459375 30.814375 -76.5459375 30.814375 -75.0625 30.625 C-74.051875 30.41875 -73.04125 30.2125 -72 30 C-71.67 29.34 -71.34 28.68 -71 28 C-67.9375 27.375 -67.9375 27.375 -65 27 C-64.67 26.01 -64.34 25.02 -64 24 C-61.69 24 -59.38 24 -57 24 C-57 23.01 -57 22.02 -57 21 C-55.02 20.67 -53.04 20.34 -51 20 C-50.67 19.01 -50.34 18.02 -50 17 C-47.36 17 -44.72 17 -42 17 C-42 16.01 -42 15.02 -42 14 C-40.2984375 13.814375 -40.2984375 13.814375 -38.5625 13.625 C-37.386875 13.41875 -36.21125 13.2125 -35 13 C-34.67 12.34 -34.34 11.68 -34 11 C-31.93359375 10.3671875 -31.93359375 10.3671875 -29.4375 9.875 C-28.61121094 9.70742188 -27.78492188 9.53984375 -26.93359375 9.3671875 C-25.97646484 9.18542969 -25.97646484 9.18542969 -25 9 C-25 8.34 -25 7.68 -25 7 C-24.04287109 6.92652344 -24.04287109 6.92652344 -23.06640625 6.8515625 C-22.24011719 6.77679687 -21.41382813 6.70203125 -20.5625 6.625 C-19.32693359 6.52058594 -19.32693359 6.52058594 -18.06640625 6.4140625 C-17.04353516 6.20910156 -17.04353516 6.20910156 -16 6 C-15.67 5.34 -15.34 4.68 -15 4 C-12.12890625 3.65625 -12.12890625 3.65625 -8.5625 3.5 C-3.736478 3.55039406 -3.736478 3.55039406 0 1 C0 0.67 0 0.34 0 0 Z " fill="#2F4059" transform="translate(556,11)"/>
+<path d="M0 0 C0 0.66 0 1.32 0 2 C0.58652344 2.10828125 1.17304687 2.2165625 1.77734375 2.328125 C7.43059809 4.03701735 11.2906238 8.98765403 14 14 C14.8353125 14.7734375 14.8353125 14.7734375 15.6875 15.5625 C17 17 17 17 17 21 C18.32 21.33 19.64 21.66 21 22 C21.185625 23.670625 21.185625 23.670625 21.375 25.375 C21.6465813 29.03103677 21.6465813 29.03103677 24 31 C24.34375 33.0234375 24.34375 33.0234375 24.5 35.375 C24.66744149 37.87825025 24.80479521 39.63068787 25.9829179 41.8596034 C30.25831728 50.85695998 28.13944339 64.62860972 28.12698364 74.43347168 C28.12813691 76.41090533 28.12972581 78.38833878 28.13171089 80.36577177 C28.13587597 85.78104185 28.13382626 91.19629426 28.13072467 96.6115644 C28.1284593 102.45894473 28.13195585 108.30632205 28.13470459 114.15370178 C28.13914908 125.60140856 28.13819168 137.04910877 28.13529195 148.4968158 C28.13303274 157.80138015 28.13272764 167.10594266 28.13381577 176.4105072 C28.13393034 177.4030686 28.13393034 177.4030686 28.13404724 178.41568175 C28.13435859 181.1019414 28.13467699 183.78820105 28.135007 186.4744607 C28.13806424 211.66046301 28.13529533 236.84646173 28.1299101 262.03246348 C28.12516469 284.39615596 28.12558933 306.75984273 28.13037109 329.12353516 C28.1357287 354.26422923 28.1378474 379.40492015 28.13475883 404.54561472 C28.13443813 407.22690741 28.13412528 409.9082001 28.13381577 412.5894928 C28.13366149 413.90870892 28.13350721 415.22792504 28.13334826 416.5871174 C28.13248517 425.87952578 28.13394153 435.17193214 28.13629532 444.46434021 C28.13910111 455.79004939 28.13833857 467.11575163 28.13301457 478.44146001 C28.13038811 484.21896329 28.12935466 489.99645502 28.13266373 495.77395821 C28.13564836 501.06507889 28.13399774 506.35617734 28.12868617 511.64729601 C28.12757125 513.55899393 28.12813263 515.47069374 28.13056196 517.38239044 C28.16091648 543.25862528 28.16091648 543.25862528 25 548 C24.835 549.19625 24.67 550.3925 24.5 551.625 C24.335 552.73875 24.17 553.8525 24 555 C23.34 555.33 22.68 555.66 22 556 C21.19740802 557.91203452 21.19740802 557.91203452 20.5625 560.1875 C19.35859312 564.01701285 17.86057921 567.43388985 16 571 C15.319375 572.7015625 15.319375 572.7015625 14.625 574.4375 C13.08117098 577.82204823 11.35020068 580.4669003 9.140625 583.421875 C7.86261113 585.19008596 6.87830531 587.00385156 6 589 C5.34 589 4.68 589 4 589 C3.95875 589.556875 3.9175 590.11375 3.875 590.6875 C2.1968977 595.12248465 -2.2986838 597.53713131 -6.125 600.0625 C-8.97194919 601.82515247 -8.97194919 601.82515247 -10.8125 603.9375 C-14.10331915 607.04027234 -18.02421118 608.891412 -22 611 C-25.4659102 612.91731202 -26.77629565 613.66444348 -29 617 C-30.6640625 618.04321289 -30.6640625 618.04321289 -32.625 618.97265625 C-33.33140625 619.31490234 -34.0378125 619.65714844 -34.765625 620.00976562 C-35.50296875 620.35716797 -36.2403125 620.70457031 -37 621.0625 C-38.46007378 621.75807711 -39.91848856 622.45715027 -41.375 623.16015625 C-42.34566406 623.61853882 -42.34566406 623.61853882 -43.3359375 624.08618164 C-45.18946432 625.00317248 -45.18946432 625.00317248 -47 627 C-49.625 627.125 -49.625 627.125 -52 627 C-52.33 627.99 -52.66 628.98 -53 630 C-57.55706506 632.41256386 -60.76779612 633.38284419 -66 633 C-66.33 633.99 -66.66 634.98 -67 636 C-68.99609375 637.31640625 -68.99609375 637.31640625 -71.4375 638.5625 C-74.06030591 639.91389759 -75.9031259 640.9031259 -78 643 C-81.125 643.125 -81.125 643.125 -84 643 C-84.33 643.99 -84.66 644.98 -85 646 C-85.7425 646.28875 -86.485 646.5775 -87.25 646.875 C-90.17746555 647.85277778 -90.17746555 647.85277778 -92.3125 650.4375 C-97.00700185 654.91365292 -102.64759366 656.20594921 -109 657 C-109 657.66 -109 658.32 -109 659 C-110.175625 659.12375 -110.175625 659.12375 -111.375 659.25 C-114.14749104 659.72806339 -114.14749104 659.72806339 -115.3125 662.0625 C-115.6528125 663.0215625 -115.6528125 663.0215625 -116 664 C-117.65 664 -119.3 664 -121 664 C-121.3403125 664.928125 -121.3403125 664.928125 -121.6875 665.875 C-123.42697464 668.69129228 -124.90208786 668.89852013 -128 670 C-129.1753132 670.693892 -130.34160828 671.40321344 -131.5 672.125 C-134.83918146 673.91384721 -136.32776178 674.44511978 -140 674 C-140.33 674.99 -140.66 675.98 -141 677 C-141.66 677 -142.32 677 -143 677 C-143.24878906 677.60457031 -143.49757813 678.20914063 -143.75390625 678.83203125 C-145.19797455 681.34443848 -146.46135813 682.22579242 -148.9375 683.6875 C-149.97197266 684.31205078 -149.97197266 684.31205078 -151.02734375 684.94921875 C-153 686 -153 686 -156 687 C-156.33 687.66 -156.66 688.32 -157 689 C-157.86625 689.268125 -158.7325 689.53625 -159.625 689.8125 C-162.55821638 690.84455762 -164.09858135 691.68025831 -166.5 693.5 C-169.55380752 695.79035564 -172.31082829 696.92399158 -176 698 C-180.79335465 699.50815242 -180.79335465 699.50815242 -184 703 C-185.63671811 704.04829938 -187.30935705 705.04109219 -189 706 C-190.7300416 707.01934985 -192.4592166 708.040172 -194.1875 709.0625 C-195.04730469 709.56910156 -195.90710938 710.07570313 -196.79296875 710.59765625 C-199.08971412 711.94464647 -199.08971412 711.94464647 -201 714 C-202.99541868 714.68025637 -204.99617991 715.34490497 -207 716 C-209.00847365 716.98287008 -211.00819591 717.98377342 -213 719 C-215.33124929 720.00484883 -217.66443537 721.00522247 -220 722 C-220.7425 722.391875 -221.485 722.78375 -222.25 723.1875 C-224 724 -224 724 -227 724 C-227 724.66 -227 725.32 -227 726 C-229.31 726.33 -231.62 726.66 -234 727 C-234.33 727.99 -234.66 728.98 -235 730 C-235.680625 730.268125 -236.36125 730.53625 -237.0625 730.8125 C-239.82816986 731.93053675 -241.44717255 733.04101167 -243.75 734.875 C-247.33196995 737.67383964 -250.88197171 739.42709374 -255.1171875 741.04296875 C-257.34043177 741.9793994 -257.34043177 741.9793994 -259 745 C-260.9812585 745.72045764 -262.98504093 746.38001259 -265 747 C-265.94875 747.474375 -266.8975 747.94875 -267.875 748.4375 C-270.23815608 749.61907804 -272.33691295 750.47913406 -274.8125 751.3125 C-278.84120169 752.77748243 -282.06491889 754.94845851 -285.57421875 757.37890625 C-292.10777895 761.74513408 -298.46141029 764.84611723 -306 767 C-308.80292991 768.4500829 -311.5422653 769.99640361 -314.29296875 771.54296875 C-318.9579208 774.05383039 -323.68226242 775.65436391 -328.8125 777 C-331.94862453 777.98388221 -332.88082275 778.66890502 -335 781 C-335.99 781 -336.98 781 -338 781 C-338.33 781.99 -338.66 782.98 -339 784 C-340.98 784 -342.96 784 -345 784 C-345.33 784.99 -345.66 785.98 -346 787 C-346.99 787 -347.98 787 -349 787 C-349.185625 787.5775 -349.37125 788.155 -349.5625 788.75 C-352.93987445 794.03632522 -359.26135024 795.50795106 -365 797 C-365.33 797.33 -365.66 797.66 -366 798 C-367.66617115 798.04063832 -369.33388095 798.042721 -371 798 C-371.33 798.99 -371.66 799.98 -372 801 C-372.66 801 -373.32 801 -374 801 C-374.33 801.99 -374.66 802.98 -375 804 C-377.32339707 805.33014482 -379.5808628 806.50114886 -382 807.625 C-386.28854102 809.39903629 -386.28854102 809.39903629 -390 812 C-391.99958364 812.04080783 -394.00045254 812.04254356 -396 812 C-396.33 812.99 -396.66 813.98 -397 815 C-398.98 815 -400.96 815 -403 815 C-403.020625 815.598125 -403.04125 816.19625 -403.0625 816.8125 C-404 819 -404 819 -407.3125 820.75 C-411 822 -411 822 -415 822 C-415.66 823.32 -416.32 824.64 -417 826 C-418.32 826 -419.64 826 -421 826 C-421.33 826.99 -421.66 827.98 -422 829 C-424.01171875 830.32421875 -424.01171875 830.32421875 -426.6875 831.6875 C-429.9869385 833.40355037 -433.25973889 835.12830788 -436.45703125 837.02734375 C-442.78556687 840.78037358 -448.89026412 843.98905715 -455.98828125 846.11328125 C-456.98408203 846.55220703 -456.98408203 846.55220703 -458 847 C-458.33 847.99 -458.66 848.98 -459 850 C-460.64551962 850.71727778 -462.31422289 851.38325228 -464 852 C-464.66 852.66 -465.32 853.32 -466 854 C-474.05789787 854.95455098 -481.43670588 854.35740461 -488.0546875 849.48828125 C-490.14883351 847.72998885 -492.09107316 845.95973478 -494 844 C-495.01449785 843.15648011 -496.0289957 842.31296022 -497.07423592 841.44387913 C-502.06315392 835.52090496 -500.88372189 827.11098083 -500.86691284 819.78855896 C-500.88430119 818.00984647 -500.90413496 816.23115647 -500.92621219 814.45249599 C-500.97772916 809.63122002 -500.9908953 804.81055348 -500.99490327 799.98903093 C-501.00163726 796.03981339 -501.02731014 792.09081407 -501.05277683 788.14168019 C-501.13498214 775.094908 -501.13785076 762.04845949 -501.13072467 749.00148046 C-501.12842181 742.73693768 -501.13197362 736.47239746 -501.13470459 730.20785522 C-501.13885441 718.70604441 -501.13855232 707.20424035 -501.13579312 695.70242939 C-501.13326083 685.09311213 -501.13262864 674.4837968 -501.13381577 663.87447929 C-501.13389215 663.16617811 -501.13396854 662.45787692 -501.13404724 661.72811206 C-501.13435863 658.85211201 -501.13467704 655.97611196 -501.135007 653.10011191 C-501.13804994 626.25707064 -501.13531587 599.41403274 -501.1299101 572.570992 C-501.12514603 548.73246618 -501.1256078 524.8939457 -501.13037109 501.05541992 C-501.13571997 474.19733948 -501.13785405 447.33926199 -501.13475883 420.48118109 C-501.13443814 417.62302268 -501.1341253 414.76486427 -501.13381577 411.90670586 C-501.13373669 411.2030771 -501.13365761 410.49944834 -501.13357614 409.7744975 C-501.13243828 399.14587352 -501.13376922 388.51725168 -501.13629532 377.88862801 C-501.13914601 365.83503955 -501.13836011 353.7814588 -501.13301457 341.72787059 C-501.13037676 335.57673066 -501.12937413 329.42560161 -501.13266373 323.27446175 C-501.13562385 317.65502986 -501.13403877 312.03561907 -501.12868617 306.41618913 C-501.12756101 304.37431202 -501.12815534 302.33243316 -501.13056196 300.29055715 C-501.1335634 297.53468754 -501.13052425 294.77889207 -501.12584114 292.02302647 C-501.12818231 291.21405817 -501.13052347 290.40508987 -501.13293558 289.57160738 C-501.11415095 284.11415095 -501.11415095 284.11415095 -500 283 C-499.71390984 279.70315145 -499.55109853 276.40618875 -499.37890625 273.1015625 C-499 270 -499 270 -497 267 C-496.938125 265.948125 -496.87625 264.89625 -496.8125 263.8125 C-495.82942681 259.19961812 -494.06777419 257.62390434 -490.890625 254.3046875 C-488.72461283 251.66430076 -487.47212543 249.04332307 -486.0625 245.9375 C-483.71921827 240.97745008 -481.36441993 238.05474321 -477.06640625 234.7109375 C-474.76645036 232.80662619 -472.97574316 230.72730593 -471.0625 228.4375 C-467.20394829 223.9800768 -463.00329452 221.0466989 -458 218 C-456.4221875 216.88625 -456.4221875 216.88625 -454.8125 215.75 C-450.78601084 213.24462897 -446.58965747 212.05915172 -442 211 C-441.67 209.68 -441.34 208.36 -441 207 C-439.02 206.67 -437.04 206.34 -435 206 C-434.67 205.01 -434.34 204.02 -434 203 C-432.865625 202.938125 -431.73125 202.87625 -430.5625 202.8125 C-426.12007912 202.27093279 -422.97343255 200.54391137 -419.171875 198.26953125 C-416.21402067 196.54056964 -413.16625312 195.30375128 -410 194 C-406.82144422 192.7113001 -406.82144422 192.7113001 -405 190 C-403.96875 189.9175 -402.9375 189.835 -401.875 189.75 C-397.46327399 188.89611755 -395.98999658 187.60951175 -392.96875 184.47265625 C-390.21054239 182.40947318 -387.30958572 181.90987561 -384 181 C-381.62008301 179.90865685 -379.26521474 178.76115709 -376.9375 177.5625 C-375.18759766 176.66724609 -375.18759766 176.66724609 -373.40234375 175.75390625 C-371.71818359 174.88572266 -371.71818359 174.88572266 -370 174 C-368.98292969 173.4946875 -367.96585938 172.989375 -366.91796875 172.46875 C-364.03427323 171.01725132 -361.20278351 169.49477233 -358.375 167.9375 C-356.5862835 166.95295437 -354.79484124 165.97333536 -353 165 C-352.28585937 164.61199219 -351.57171875 164.22398437 -350.8359375 163.82421875 C-348.480704 162.76686924 -346.55079073 162.8582894 -344 163 C-343.67 162.01 -343.34 161.02 -343 160 C-340.69747517 158.93097061 -338.3627974 157.92824183 -336 157 C-335.67 156.67 -335.34 156.34 -335 156 C-333.33382885 155.95936168 -331.66611905 155.957279 -330 156 C-329.67 155.01 -329.34 154.02 -329 153 C-325.96317824 151.26467328 -322.86292304 149.94415383 -319.625 148.625 C-316.80765679 147.36205304 -314.4996673 146.10168867 -311.9375 144.4375 C-308.69225115 142.34419063 -305.67239896 141.22413299 -302 140 C-299.16070671 138.53683134 -296.37246519 136.99857994 -293.5859375 135.4375 C-289.38860688 133.10424068 -286.88664754 131.72851958 -282 132 C-281.67 131.01 -281.34 130.02 -281 129 C-278.78056546 127.70655471 -276.63109525 126.58248382 -274.3125 125.5 C-273.39307617 125.05720703 -273.39307617 125.05720703 -272.45507812 124.60546875 C-271.23254601 124.01689019 -270.00777535 123.43293766 -268.78076172 122.85375977 C-267.07670671 122.0367759 -265.39500666 121.1736479 -263.71484375 120.30859375 C-261 119 -261 119 -258.25 118.5625 C-257.13625 118.2840625 -257.13625 118.2840625 -256 118 C-255.71125 117.360625 -255.4225 116.72125 -255.125 116.0625 C-254 114 -254 114 -250.75 113 C-249.5125 112.67 -248.275 112.34 -247 112 C-246.01 111.29875 -245.02 110.5975 -244 109.875 C-240.39881579 107.62425987 -238.16943884 107.66644489 -234 108 C-233.67 107.01 -233.34 106.02 -233 105 C-230.9375 103.625 -230.9375 103.625 -228 102 C-226.70779081 101.14665431 -225.41616411 100.29242614 -224.125 99.4375 C-220.52551709 97.17516083 -217.13483097 96.05250243 -213 95 C-208.67723718 93.52189632 -208.67723718 93.52189632 -205 91 C-202.66702567 90.95907063 -200.33294775 90.95758277 -198 91 C-197.67 90.01 -197.34 89.02 -197 88 C-195.01751285 87.28293018 -193.01584651 86.61709587 -191 86 C-190.34 85.34 -189.68 84.68 -189 84 C-186.375 83.875 -186.375 83.875 -184 84 C-183.67 83.01 -183.34 82.02 -183 81 C-181.31725583 80.20812039 -179.62657391 79.4272957 -177.89453125 78.75 C-175.78397504 77.94610791 -175.78397504 77.94610791 -173 76.5 C-170 75 -170 75 -166.625 73.625 C-163.74766414 72.33515979 -161.46784225 71.04268609 -158.875 69.3125 C-155.79226783 67.30932384 -153.76732826 66.41135496 -150 67 C-149.67 66.01 -149.34 65.02 -149 64 C-147.865625 63.87625 -146.73125 63.7525 -145.5625 63.625 C-144.386875 63.41875 -143.21125 63.2125 -142 63 C-141.67 62.34 -141.34 61.68 -141 61 C-139.02 61 -137.04 61 -135 61 C-135 59.68 -135 58.36 -135 57 C-134.05125 56.62875 -133.1025 56.2575 -132.125 55.875 C-123.33270546 52.34358113 -123.33270546 52.34358113 -117 46 C-115.01679982 44.96708324 -113.01652194 43.9662501 -111 43 C-110.67 42.67 -110.34 42.34 -110 42 C-108.515 41.8453125 -108.515 41.8453125 -107 41.6875 C-102.25232648 41.07458313 -98.28635555 39.03238962 -94 37 C-92.824375 36.505 -91.64875 36.01 -90.4375 35.5 C-86.54865975 33.80305153 -82.77814817 31.92778462 -79 30 C-75.89952671 28.41812587 -72.84975591 26.93878945 -69.625 25.625 C-64.52016468 23.33662555 -59.856351 20.61209429 -55.625 16.9375 C-52.42862096 14.57826785 -49.1748157 13.40007747 -45.48046875 11.9921875 C-41.30683068 10.32273227 -37.59371235 8.15490819 -33.95703125 5.51953125 C-24.96696345 -0.92467664 -10.41339281 -6.17910543 0 0 Z " fill="#6496FC" transform="translate(1091,321)"/>
+<path d="M0 0 C0.99 0.66 1.98 1.32 3 2 C4.051875 2.268125 5.10375 2.53625 6.1875 2.8125 C10.00156951 4.00048886 12.53435414 5.52788578 15.81640625 7.703125 C18.95709096 9.56843327 22.27398195 10.77375784 25.703125 12.0078125 C28 13 28 13 29.984375 14.4921875 C32.23655233 16.17695581 34.37604928 17.00553466 37 18 C39.54998117 19.26123876 42.07295321 20.56792794 44.59765625 21.87890625 C46.7482449 22.88251429 48.68410504 23.52398464 51 24 C51.495 25.98 51.495 25.98 52 28 C52.94875 27.95875 53.8975 27.9175 54.875 27.875 C58 28 58 28 60 30 C60.886875 30.2475 61.77375 30.495 62.6875 30.75 C66.3973866 32.14995721 68.46646765 33.95020016 71.2890625 36.66015625 C73.19402947 38.15194545 74.67927834 38.44674779 77 39 C77.33 39.66 77.66 40.32 78 41 C79.62659418 41.50831068 81.25784308 42.00513097 82.90625 42.4375 C90.6053773 44.50592226 98.45207474 46.88009376 104.75 51.875 C108.68074394 54.95853505 112.79487008 56.86427904 117.3671875 58.83203125 C120.73915645 60.32790471 123.83928319 62.10356991 127 64 C127 64.66 127 65.32 127 66 C127.66 66.0825 128.32 66.165 129 66.25 C132.32530719 67.0813268 134.97279898 68.43409814 137.99609375 70.01171875 C140.58352999 71.28778379 143.24040164 72.17212049 146 73 C146 73.66 146 74.32 146 75 C146.94875 75.12375 147.8975 75.2475 148.875 75.375 C152 76 152 76 154 78 C155.051875 78.0825 156.10375 78.165 157.1875 78.25 C161.61908355 79.12178693 163.11837396 80.56835116 166.29296875 83.578125 C168.61425917 85.51164837 171.14556176 86.1164834 174 87 C174.33 87.99 174.66 88.98 175 90 C175.94875 89.95875 176.8975 89.9175 177.875 89.875 C181 90 181 90 183 92 C184.3921875 92.4640625 184.3921875 92.4640625 185.8125 92.9375 C188.90697261 93.96899087 191.33969984 95.12214106 194 97 C194 97.66 194 98.32 194 99 C195.485 99.37125 195.485 99.37125 197 99.75 C200.57223334 100.7634505 203.67765094 102.28082192 206.9609375 103.9921875 C210.20676613 105.59644763 213.60269977 106.76025939 217 108 C220.87589631 109.49595998 223.80125181 110.84181267 227.0625 113.4375 C233.44659013 118.23278942 242.15878366 119.37702456 249.8125 121.0625 C251.3903125 121.5265625 251.3903125 121.5265625 253 122 C253.33 122.99 253.66 123.98 254 125 C254.99 125.33 255.98 125.66 257 126 C257.33 126.99 257.66 127.98 258 129 C259.423125 129.1546875 259.423125 129.1546875 260.875 129.3125 C264 130 264 130 266 133 C268.80376352 134.12949221 268.80376352 134.12949221 272 135 C274.01822402 135.60927518 276.02416285 136.26480478 278 137 C278.33 137.66 278.66 138.32 279 139 C282.58448862 140.72055454 286.03376351 142.05457224 289.875 143.0625 C290.90625 143.371875 291.9375 143.68125 293 144 C293.33 144.66 293.66 145.32 294 146 C294.825 146.33 295.65 146.66 296.5 147 C299 148 299 148 300 150 C301.7117096 151.01960978 301.7117096 151.01960978 303.75 151.9375 C306.13523738 153.07716049 308.32453629 154.2058035 310.5625 155.625 C313.03818782 157.15434963 313.03818782 157.15434963 316.25 157.875 C320.94130107 159.28239032 324.80082275 161.52105815 329 164 C334.56312751 167.23672873 340.22757408 170.15393529 346 173 C348.00054259 173.99891408 350.00050075 174.99899912 352 176 C353.66675781 176.83337891 353.66675781 176.83337891 355.3671875 177.68359375 C357.15777997 178.57888999 358.94835527 179.47422088 360.73852539 180.37036133 C363.30325497 181.65390989 365.86883173 182.93536028 368.44140625 184.203125 C371.56953369 185.74576319 374.62532531 187.34861998 377.625 189.125 C380.75737644 190.86520914 383.6103889 191.89318821 387 193 C389.70620388 194.25781307 392.34852467 195.6314966 395 197 C395.99 197.474375 396.98 197.94875 398 198.4375 C400.4580706 199.71774511 402.73215838 201.07282368 405.0625 202.5625 C407.97846294 204.41460501 410.75842659 205.78440997 414 207 C422.96208531 211.22393365 422.96208531 211.22393365 427 214 C427 214.66 427 215.32 427 216 C428.010625 216.04125 429.02125 216.0825 430.0625 216.125 C434.2500829 216.68560948 436.45984513 218.7460177 439.421875 221.625 C441.06642351 223.2359095 441.06642351 223.2359095 444 224 C444 224.66 444 225.32 444 226 C444.55429687 226.0721875 445.10859375 226.144375 445.6796875 226.21875 C448.87955767 227.29614736 450.67931538 229.19302585 453.125 231.5 C456.30782183 234.61378784 456.30782183 234.61378784 460 237 C460.89972515 238.59182141 461.79445284 240.18661552 462.66796875 241.79296875 C464.24863585 244.41196263 466.0737589 246.76217966 467.9375 249.1875 C471.4221385 253.89402473 473.74612384 258.5092483 475.796875 263.98046875 C476.85183944 266.83364365 476.85183944 266.83364365 477.97489447 268.70254747 C481.06851518 274.13609842 481.56848467 278.5574546 481.50057125 284.7373476 C481.5088425 286.17061201 481.5088425 286.17061201 481.51728085 287.63283125 C481.53087863 290.83534366 481.51597686 294.03708031 481.50120544 297.23957825 C481.50509817 299.55836109 481.51073837 301.87714154 481.51797634 304.19591635 C481.53275237 310.56841741 481.52253684 316.9406719 481.50823963 323.31316507 C481.49632971 329.47929095 481.50710086 335.64539926 481.51536357 341.81152431 C481.53255244 355.19992368 481.52701716 368.58824116 481.51200638 381.97663884 C481.49895814 393.68986908 481.49375797 405.40307091 481.49632454 417.11630821 C481.49656516 418.28144109 481.49656516 418.28144109 481.49681065 419.47011201 C481.49747422 422.62310521 481.49817663 425.7760984 481.49893599 428.92909157 C481.5059599 458.50507042 481.49046784 488.0809992 481.46431253 517.65696531 C481.44118607 543.9473513 481.43581351 570.2376823 481.44604492 596.52807617 C481.44864683 603.26276809 481.4512318 609.99746 481.45364285 616.73215199 C481.45394029 617.56121253 481.45423774 618.39027307 481.4545442 619.24445667 C481.46215315 641.20150974 481.45575252 663.15855829 481.44494683 685.11560935 C481.443799 687.47711429 481.44265582 689.83861923 481.44152 692.20012417 C481.44076476 693.76673678 481.43999911 695.33334938 481.43922299 696.89996197 C481.43355799 708.61078577 481.43489903 720.32159535 481.43945122 732.0324192 C481.44455076 745.34058646 481.43874248 758.64870039 481.41855692 771.95685432 C481.40851604 778.75207552 481.40322719 785.54721747 481.41144943 792.34244347 C481.41846854 798.55421735 481.41179055 804.76581518 481.3938458 810.97756573 C481.3897768 813.23308176 481.39084178 815.48861365 481.39736467 817.74412391 C481.40543362 820.79358345 481.39530241 823.84243796 481.38031673 826.8918581 C481.39042321 828.22666306 481.39042321 828.22666306 481.40073386 829.58843377 C481.34328641 835.57106011 481.34328641 835.57106011 479.60142512 837.74753366 C478 839 478 839 476 839 C475.814375 839.556875 475.62875 840.11375 475.4375 840.6875 C473.67102326 843.52922345 471.64744862 844.79115032 468.8515625 846.55859375 C466.79827703 847.9767062 466.79827703 847.9767062 465.4375 850.625 C462.12826038 853.84938732 459.81172334 853.62546497 455.31640625 853.63476562 C454.34574219 853.61091797 453.37507813 853.58707031 452.375 853.5625 C450.95380859 853.57893555 450.95380859 853.57893555 449.50390625 853.59570312 C442.60764256 853.52494803 437.20420818 851.9682247 431 849 C431 848.34 431 847.68 431 847 C429.989375 846.938125 428.97875 846.87625 427.9375 846.8125 C424.22551275 846.28854156 422.1092299 844.72945767 419.171875 842.3984375 C415.33990289 839.93108855 410.99110857 838.66896396 406.6953125 837.2109375 C405.80585938 836.81132813 404.91640625 836.41171875 404 836 C403.67 835.01 403.34 834.02 403 833 C400.3738971 832.07462652 400.3738971 832.07462652 397.25 831.5 C392.8779676 830.59544157 389.75720637 829.40256734 386 827 C385.01 826.67 384.02 826.34 383 826 C382.67 825.34 382.34 824.68 382 824 C381.175 823.690625 380.35 823.38125 379.5 823.0625 C378.675 822.711875 377.85 822.36125 377 822 C376.67 821.01 376.34 820.02 376 819 C374.68 819 373.36 819 372 819 C371.34 818.01 370.68 817.02 370 816 C368.35767228 815.27544365 366.68375165 814.62225605 365 814 C360.56097918 811.91527767 356.04463204 809.78068453 352 807 C352 806.34 352 805.68 352 805 C351.319375 804.731875 350.63875 804.46375 349.9375 804.1875 C348.4834375 803.5996875 348.4834375 803.5996875 347 803 C345.88625 802.566875 344.7725 802.13375 343.625 801.6875 C340.23815449 800.11086502 337.65689113 798.35961293 334.70703125 796.12890625 C332.82902815 794.78079655 332.82902815 794.78079655 329.625 793.875 C328.75875 793.58625 327.8925 793.2975 327 793 C326.67 792.01 326.34 791.02 326 790 C324.69482422 790.08894531 324.69482422 790.08894531 323.36328125 790.1796875 C319.53464655 789.97513791 317.49447648 789.01599339 314.1875 787.125 C313.23230469 786.59132813 312.27710938 786.05765625 311.29296875 785.5078125 C309 784 309 784 308 782 C305.67767861 780.93173216 303.37261514 779.94241599 301 779 C296.25121932 777.10048773 292.11663951 774.89305398 287.84765625 772.12109375 C285.92899558 770.87769544 285.92899558 770.87769544 283.3125 770 C280.17173141 768.6418298 278.375546 766.43493465 276 764 C275.071875 763.443125 274.14375 762.88625 273.1875 762.3125 C272.1046875 761.6628125 272.1046875 761.6628125 271 761 C271 760.34 271 759.68 271 759 C269.88431641 759.08894531 269.88431641 759.08894531 268.74609375 759.1796875 C265.49908378 758.96722312 264.49994349 758.20854065 262.0625 756.125 C258.80437373 753.49011379 256.00902181 752.27115326 252 751 C251.67 750.01 251.34 749.02 251 748 C250.34 748.103125 249.68 748.20625 249 748.3125 C245.1729559 747.91384957 243.05963679 746.33274248 239.90625 744.2265625 C237.97338394 742.8974808 237.97338394 742.8974808 235.5 742 C231.7113161 740.48452644 228.4207861 738.20605797 225 736 C222.38178537 734.31686202 220.21750566 733.06920635 217.25 732.125 C211.75283915 730.22213663 206.82778338 727.21852225 202 724 C200.00945124 723.30562253 198.00744615 722.64389782 196 722 C193.32484832 721.0215211 190.66340397 720.01025668 188 719 C188 718.01 188 717.02 188 716 C186.6696875 716.185625 186.6696875 716.185625 185.3125 716.375 C182 716 182 716 179.5 713.125 C178.89671875 712.29935547 178.89671875 712.29935547 178.28125 711.45703125 C176.27838783 709.17938617 173.86519929 708.77599147 171 708 C166.22727273 705.45454545 166.22727273 705.45454545 165 703 C162.6859378 702.26924352 160.35171131 701.59861742 158 701 C157.67 699.68 157.34 698.36 157 697 C156.46632812 696.89558594 155.93265625 696.79117188 155.3828125 696.68359375 C152.34510666 695.81212076 149.69787628 694.48087395 146.875 693.0625 C145.82054687 692.53785156 144.76609375 692.01320313 143.6796875 691.47265625 C141 690 141 690 139 688 C136.49363378 687.17887487 133.96374344 686.53704728 131.41015625 685.87890625 C128.86548298 684.95094598 127.64839653 684.12713876 126 682 C126 681.34 126 680.68 126 680 C125.484375 679.896875 124.96875 679.79375 124.4375 679.6875 C118.65396185 678.05624565 113.93235293 675.35819774 109 672 C106.07034531 670.47413818 103.10464787 669.05004898 100.125 667.625 C97.79207878 666.41188096 95.6915212 665.17682018 93.5 663.75 C89.1365702 660.95401586 84.51367767 658.71206824 79.8359375 656.49902344 C76.70364737 654.98670376 74.36094425 653.5392633 72 651 C68.70971319 649.41578783 65.71352703 648.13960311 62.125 647.4375 C61.42375 647.293125 60.7225 647.14875 60 647 C59.67 646.34 59.34 645.68 59 645 C56.32170239 643.87749959 53.66865055 642.84991113 50.9375 641.875 C50.17888672 641.59785156 49.42027344 641.32070313 48.63867188 641.03515625 C46.76143432 640.35037777 44.88100446 639.67436237 43 639 C43 638.34 43 637.68 43 637 C42.278125 636.896875 41.55625 636.79375 40.8125 636.6875 C37.74014552 635.93648002 35.67905871 634.64865151 33 633 C30.80869466 632.30420546 30.80869466 632.30420546 29 632 C29 631.34 29 630.68 29 630 C27.35 630 25.7 630 24 630 C23.505 628.515 23.505 628.515 23 627 C21.34015202 626.31653318 19.67163195 625.65411685 18 625 C16.34394426 623.79854779 14.68887017 622.59559818 13.046875 621.375 C9.26039887 618.83141298 5.11657743 616.94647022 1 615 C1 614.34 1 613.68 1 613 C0.43667969 612.75507812 -0.12664062 612.51015625 -0.70703125 612.2578125 C-4.40594889 610.22876398 -7.23614461 607.29220239 -10.3203125 604.44140625 C-12.04919724 602.86625616 -13.81340459 601.32863771 -15.6171875 599.83984375 C-21.80687043 594.70814177 -21.80687043 594.70814177 -22.9375 590.5625 C-22.958125 589.716875 -22.97875 588.87125 -23 588 C-23.66 587.67 -24.32 587.34 -25 587 C-26.62700009 583.4409373 -27.78941273 579.71823233 -29 576 C-29.99 576 -30.98 576 -32 576 C-38.57293497 563.1827768 -38.57293497 563.1827768 -39.5625 558.125 C-39.80080462 555.92158536 -39.80080462 555.92158536 -41.45703125 554.65625 C-43.372708 552.59992863 -43.63364051 551.11767931 -44.125 548.375 C-44.49097593 545.40059351 -44.49097593 545.40059351 -46 543 C-46.10161919 540.42586365 -46.13730362 537.87842675 -46.13142776 535.30366993 C-46.1334804 534.48376405 -46.13553303 533.66385818 -46.13764787 532.81910667 C-46.14336073 530.03595006 -46.14185538 527.25284227 -46.14044189 524.46968079 C-46.14302309 522.46844032 -46.14603555 520.46720038 -46.1494453 518.46596116 C-46.1575476 512.93863675 -46.15930666 507.4113253 -46.16004276 501.88399565 C-46.16188775 495.93360074 -46.1694323 489.98321265 -46.17617798 484.03282166 C-46.19049531 470.32840603 -46.19629109 456.62399135 -46.20086992 442.91956995 C-46.2032038 436.15052414 -46.20680624 429.38147919 -46.2105653 422.61243405 C-46.22340336 399.45133954 -46.2341219 376.29024552 -46.2375679 353.12914753 C-46.23778954 351.67438533 -46.23801132 350.21962314 -46.23823325 348.76486094 C-46.2384539 347.3065338 -46.23867438 345.84820666 -46.2388947 344.38987952 C-46.23933726 341.46410263 -46.23978437 338.53832573 -46.24023438 335.61254883 C-46.24034377 334.88712272 -46.24045316 334.16169661 -46.24056586 333.41428789 C-46.24419669 309.89101603 -46.2601164 286.36777498 -46.28342474 262.84451492 C-46.30800957 237.98763386 -46.32174014 213.13077042 -46.32293582 188.27387685 C-46.32310728 185.54617798 -46.32332271 182.81847912 -46.32357025 180.09078026 C-46.32362602 179.41912016 -46.32368179 178.74746007 -46.32373925 178.05544664 C-46.32489094 167.23620434 -46.33592311 156.4169936 -46.35045731 145.59776196 C-46.36480948 134.72615491 -46.36781365 123.85459035 -46.36001733 112.98297653 C-46.35610019 107.09068618 -46.35709211 101.19850221 -46.37107468 95.30622482 C-46.38375011 89.91560635 -46.38267227 84.5251749 -46.37048396 79.13455691 C-46.36851588 77.18092459 -46.37165626 75.2272793 -46.38032833 73.27366523 C-46.39134829 70.62405952 -46.38398438 67.97512233 -46.3719368 65.32553577 C-46.37953199 64.56187182 -46.38712718 63.79820786 -46.39495254 63.01140258 C-46.34785768 58.23423111 -45.34513282 55.12800724 -43 51 C-42.26499153 47.87965463 -42.26499153 47.87965463 -41.875 44.75 C-41.08333333 39.16666667 -41.08333333 39.16666667 -40 37 C-39.72975292 34.70075503 -39.55502159 32.40198513 -39.37890625 30.09375 C-39 28 -39 28 -37 26 C-36.690625 24.906875 -36.38125 23.81375 -36.0625 22.6875 C-35.08010071 19.2779966 -34.13500944 16.81821246 -32 14 C-31.01 14 -30.02 14 -29 14 C-28.9175 13.443125 -28.835 12.88625 -28.75 12.3125 C-27.09644278 7.2140319 -23.18629692 3.65759947 -18.69140625 0.9453125 C-12.83262793 -1.11248772 -6.11450155 -0.64613754 0 0 Z " fill="#FDFDFD" transform="translate(81,319)"/>
+<path d="M0 0 C0.83917969 0.27457031 1.67835938 0.54914062 2.54296875 0.83203125 C3.41566406 1.15558594 4.28835938 1.47914063 5.1875 1.8125 C6.50814453 2.28623047 6.50814453 2.28623047 7.85546875 2.76953125 C10 4 10 4 10.80078125 6.13671875 C10.86652344 6.75160156 10.93226563 7.36648438 11 8 C11.680625 8.061875 12.36125 8.12375 13.0625 8.1875 C16.47124485 9.13034432 18.45019686 10.69058371 21.234375 12.796875 C23.66351168 14.45212743 26.19159648 15.18868343 29 16 C32.30706008 17.3779417 32.91162262 17.86743394 35 21 C37.54609974 22.43019872 40.06012478 23.73961802 42.6875 25 C43.38294922 25.34289062 44.07839844 25.68578125 44.79492188 26.0390625 C48.14510164 27.6781794 51.50194473 29.22001973 54.95703125 30.625 C58 32 58 32 59 34 C59.763125 34.433125 60.52625 34.86625 61.3125 35.3125 C64.29861598 37.18750305 65.81164884 39.26456104 68 42 C70.37612865 43.60907108 70.37612865 43.60907108 73 45 C73.99 45.680625 74.98 46.36125 76 47.0625 C78.81650502 49.03243167 78.81650502 49.03243167 81.5 49.9375 C84 51 84 51 86.9375 53.5 C90.0627494 56.051224 92.20133312 56.83714279 96 58 C98.39647711 59.24423155 100.68267353 60.60960412 103 62 C103 62.66 103 63.32 103 64 C103.928125 64.28875 104.85625 64.5775 105.8125 64.875 C109 66 109 66 112 68 C112 68.66 112 69.32 112 70 C112.99 69.87625 113.98 69.7525 115 69.625 C119.35908762 69.625 121.43473951 71.58755772 124.6875 74.28125 C128.2373289 76.91963635 132.16788039 78.65193926 136.16796875 80.5078125 C139.10688625 82.056318 141.44542237 83.88913484 144 86 C145.98246398 87.03432904 147.98413316 88.03238392 150 89 C151.21251551 89.70115027 152.42079024 90.40967881 153.625 91.125 C156.30853872 92.61585484 158.10819949 93.33266142 161 94 C161.33 94.66 161.66 95.32 162 96 C162.99 96.33 163.98 96.66 165 97 C165 97.66 165 98.32 165 99 C165.60328125 99.19335938 166.2065625 99.38671875 166.828125 99.5859375 C167.62734375 99.84632813 168.4265625 100.10671875 169.25 100.375 C170.03890625 100.63023437 170.8278125 100.88546875 171.640625 101.1484375 C176.55708876 102.92292277 179.37659138 105.18073146 183 109 C184.14834208 110.37007743 184.14834208 110.37007743 187.25 110.1875 C191.19236399 111.04167886 192.5394588 111.97937419 194.978495 115.12463593 C196.91275986 118.67572068 196.6684638 122.30512188 196.60127258 126.26339722 C196.60554471 127.18732305 196.60981683 128.11124888 196.61421841 129.06317246 C196.62244441 132.15442693 196.59496929 135.24432008 196.56762695 138.33544922 C196.5662164 140.55305448 196.5670086 142.77066208 196.56983948 144.98826599 C196.57127474 151.00651828 196.54186636 157.02427285 196.50696969 163.04240942 C196.47572501 169.33245671 196.47277692 175.62251526 196.46684265 181.91262817 C196.45306506 192.4695074 196.42182867 203.02622341 196.37719727 213.58300781 C196.33128083 224.45506886 196.29589918 235.32708028 196.2746582 246.19921875 C196.27334459 246.86971641 196.27203097 247.54021408 196.27067754 248.23102985 C196.26415221 251.59482177 196.25783371 254.95861403 196.25161803 258.32240653 C196.19934741 286.21506485 196.11139419 314.10751958 196 342 C194.89986572 342.4647876 193.79973145 342.9295752 192.66625977 343.40844727 C187.81790105 345.51315862 183.47024265 348.19874597 179 351 C178.360625 351.39832031 177.72125 351.79664063 177.0625 352.20703125 C174.0135245 354.10686355 174.0135245 354.10686355 172 357 C170.13971608 358.0646726 168.2357306 359.05376108 166.3125 360 C165.27738281 360.515625 164.24226563 361.03125 163.17578125 361.5625 C160 363 160 363 156.99609375 363.9921875 C153.72337435 365.09305009 150.81160212 366.5326592 147.75 368.125 C142.22009569 371 142.22009569 371 140 371 C140 371.66 140 372.32 140 373 C139.46632813 373.29132813 138.93265625 373.58265625 138.3828125 373.8828125 C128.33925411 379.26119362 128.33925411 379.26119362 118.91015625 385.60546875 C116.44218103 387.40724207 113.91208625 388.13961088 111 389 C111 389.66 111 390.32 111 391 C106.49893296 394.77089394 101.98515697 397.69306887 96 398 C96 398.66 96 399.32 96 400 C94.989375 400.2475 93.97875 400.495 92.9375 400.75 C88.84690306 401.91636165 85.58071053 403.70834526 82 406 C81.67 406.66 81.34 407.32 81 408 C77.54179464 410.49759276 75.26322371 411.36541918 71 411 C70.67 411.99 70.34 412.98 70 414 C68.34015202 414.68346682 66.67163195 415.34588315 65 416 C63.83637264 416.80830059 62.69143423 417.6439124 61.5625 418.5 C58.52600022 420.75739786 55.6831482 422.01183829 52 423 C52 423.66 52 424.32 52 425 C51.27554688 425.32613281 50.55109375 425.65226562 49.8046875 425.98828125 C40.64479549 430.01319289 40.64479549 430.01319289 32 435 C31.01 435 30.02 435 29 435 C28.67 435.99 28.34 436.98 28 438 C26.68 438 25.36 438 24 438 C23.67 438.99 23.34 439.98 23 441 C21.0282696 442.05464649 19.02237052 443.04605164 17 444 C16.01 444.66 15.02 445.32 14 446 C11.08273524 447.94484317 8.13164127 449.43417937 5 451 C3.96875 451.7425 2.9375 452.485 1.875 453.25 C-1 455 -1 455 -3 455 C-5.83350805 453.58324598 -8.36504047 451.75663969 -11 450 C-14.40224451 448.42038648 -17.74134942 447.08296339 -21.3125 445.9375 C-24 445 -24 445 -26 443 C-27.66296671 442.32415687 -29.33016741 441.6586967 -31 441 C-32.66453857 440.05298043 -34.31048953 439.07263447 -35.9375 438.0625 C-38.78726725 436.3143592 -41.55627855 434.72674036 -44.5625 433.25 C-47 432 -47 432 -48 430 C-49.97583715 429.26480478 -51.98177598 428.60927518 -54 428 C-56 427.33333333 -58 426.66666667 -60 426 C-60 425.34 -60 424.68 -60 424 C-60.78375 423.731875 -61.5675 423.46375 -62.375 423.1875 C-65 422 -65 422 -67 419 C-69.60219142 417.17143306 -71.54858606 416.08398399 -74.6875 415.5 C-77 415 -77 415 -79 412 C-81.55183404 410.79549696 -81.55183404 410.79549696 -84 410 C-84 409.34 -84 408.68 -84 408 C-84.78375 407.87625 -85.5675 407.7525 -86.375 407.625 C-89 407 -89 407 -91 405 C-91.845625 404.731875 -92.69125 404.46375 -93.5625 404.1875 C-98.03260556 402.64328172 -101.91122632 400.34695609 -106 398 C-106.66 397.67 -107.32 397.34 -108 397 C-108 395.68 -108 394.36 -108 393 C-108.53625 392.896875 -109.0725 392.79375 -109.625 392.6875 C-112.62502044 391.81907303 -115.2379535 390.44379704 -118 389 C-118 388.34 -118 387.68 -118 387 C-119.175625 386.62875 -119.175625 386.62875 -120.375 386.25 C-133.63389831 381.6779661 -133.63389831 381.6779661 -138 377 C-139.99571323 376.32060826 -141.99594773 375.65438441 -144 375 C-145.66666667 373.66666667 -147.33333333 372.33333333 -149 371 C-150.97888961 370.27306096 -152.97954558 369.60183749 -155 369 C-158.30706008 367.6220583 -158.91162262 367.13256606 -161 364 C-162.093125 363.855625 -163.18625 363.71125 -164.3125 363.5625 C-168.54624152 362.91667502 -169.83225435 361.77177745 -173 359 C-174.73907888 357.98817229 -176.47906981 356.9771456 -178.2421875 356.0078125 C-179.90463796 355.05467424 -181.4880889 353.96744852 -183.0625 352.875 C-185.9992718 351.00046481 -188.66311375 349.95339607 -192 349 C-192 348.34 -192 347.68 -192 347 C-192.7425 347.0825 -193.485 347.165 -194.25 347.25 C-197 347 -197 347 -199.14012909 345.55374146 C-201.89502718 341.77106094 -201.55467138 338.46150989 -201.50793457 333.89013672 C-201.51729451 332.49266866 -201.51729451 332.49266866 -201.52684355 331.06696892 C-201.5428292 327.93761951 -201.53014732 324.80904302 -201.51757812 321.6796875 C-201.52299675 319.43930608 -201.53011795 317.19892821 -201.53881836 314.95855713 C-201.55708532 308.86772205 -201.54997013 302.77715737 -201.53730202 296.68631744 C-201.52719187 290.31935382 -201.53656217 283.95241373 -201.54284668 277.58544922 C-201.55059564 266.20679462 -201.53814625 254.82827762 -201.51780933 243.44965053 C-201.49993807 233.13108615 -201.5030421 222.81270176 -201.52148438 212.49414062 C-201.54288669 200.51379468 -201.55086055 188.53355812 -201.53903532 176.55318642 C-201.53279143 170.2105235 -201.53198942 163.8679846 -201.54518127 157.52532959 C-201.5567153 151.56302263 -201.54875854 145.60105638 -201.52560425 139.63878632 C-201.5203041 137.44739091 -201.52185312 135.25596696 -201.53065491 133.06458282 C-201.54154219 130.07928598 -201.52792898 127.0950895 -201.50793457 124.10986328 C-201.51685746 123.23710691 -201.52578034 122.36435055 -201.53497362 121.46514702 C-201.45862115 115.61144007 -201.45862115 115.61144007 -199.12718964 112.50314331 C-196.00438629 110.29646607 -192.73753026 109.25306669 -189.14453125 108.02734375 C-188.43683594 107.68832031 -187.72914063 107.34929687 -187 107 C-186.67 106.01 -186.34 105.02 -186 104 C-184.0187415 103.27954236 -182.01495907 102.61998741 -180 102 C-176.32064321 100.17499082 -176.32064321 100.17499082 -174 97 C-171.48810588 95.90575335 -168.92891181 95.01502333 -166.34765625 94.09765625 C-163.69522955 93.10486973 -163.69522955 93.10486973 -162 90 C-159.68925595 89.25881795 -157.35188447 88.59793673 -155 88 C-150.6454441 86.44480146 -146.9608266 84.26195765 -143.08203125 81.765625 C-140.09930466 79.86294763 -137.3778692 78.14471587 -134.0625 76.875 C-133.381875 76.58625 -132.70125 76.2975 -132 76 C-131.505 74.515 -131.505 74.515 -131 73 C-126.8715354 70.13301069 -122.52853873 68.47031961 -117.75 67 C-114.86786388 66.30884829 -114.86786388 66.30884829 -114 64 C-113.113125 63.566875 -112.22625 63.13375 -111.3125 62.6875 C-108.66415306 61.33834213 -107.03592057 60.28298839 -104.875 58.375 C-102.24765345 56.20458328 -101.18486259 55.58978937 -98 55 C-97.505 54.01 -97.505 54.01 -97 53 C-94.10693136 50.98361883 -91.24740045 49.69873448 -87.9375 48.5625 C-84.41443752 47.31557339 -82.60462142 45.69443596 -80 43 C-77.25 42.25 -77.25 42.25 -75 42 C-74.67 41.01 -74.34 40.02 -74 39 C-71.82421875 38.015625 -71.82421875 38.015625 -69 37 C-55.39645888 31.26652235 -55.39645888 31.26652235 -45 22 C-42.52201062 20.90311223 -39.99451293 20.01551704 -37.4453125 19.09765625 C-35.00030345 18.00013621 -33.85564226 16.8609441 -32 15 C-31.01 15 -30.02 15 -29 15 C-28.92652344 14.38253906 -28.85304688 13.76507812 -28.77734375 13.12890625 C-28 11 -28 11 -26.00390625 9.83984375 C-25.19824219 9.54207031 -24.39257812 9.24429688 -23.5625 8.9375 C-20.00134349 7.6056389 -19.20304684 7.30457026 -17 4 C-14.875 3 -14.875 3 -12 2 C-11.35160156 1.72800781 -10.70320312 1.45601562 -10.03515625 1.17578125 C-9.34292969 0.89089844 -8.65070313 0.60601563 -7.9375 0.3125 C-6.96103516 -0.09548828 -6.96103516 -0.09548828 -5.96484375 -0.51171875 C-3.54870827 -1.11215003 -2.35073505 -0.78652413 0 0 Z " fill="#F7FAFE" transform="translate(857,513)"/>
+<path d="M0 0 C1.90183637 1.12362324 3.5718228 2.38249191 5.29296875 3.765625 C7.14739266 5.23640815 7.14739266 5.23640815 10.375 6.125 C11.24125 6.41375 12.1075 6.7025 13 7 C13.33 7.99 13.66 8.98 14 10 C14.804375 10.12375 15.60875 10.2475 16.4375 10.375 C17.283125 10.58125 18.12875 10.7875 19 11 C19.33 11.66 19.66 12.32 20 13 C22.52733235 13.65555119 22.52733235 13.65555119 25 14 C25 14.66 25 15.32 25 16 C26.11375 16.103125 27.2275 16.20625 28.375 16.3125 C29.57125 16.539375 30.7675 16.76625 32 17 C32.99 18.485 32.99 18.485 34 20 C36.32315031 20.7013284 38.65789079 21.36485174 41 22 C42.67465927 22.9865567 44.34054522 23.98807728 46 25 C47.92506 25.92226222 49.86286775 26.81838683 51.8125 27.6875 C53.27623047 28.34298828 53.27623047 28.34298828 54.76953125 29.01171875 C55.50558594 29.33785156 56.24164063 29.66398437 57 30 C57 30.66 57 31.32 57 32 C57.66 32 58.32 32 59 32 C59.33 32.66 59.66 33.32 60 34 C61.010625 34.144375 62.02125 34.28875 63.0625 34.4375 C69.88151421 35.41164489 75.55475837 37.77993774 81 42 C81 42.66 81 43.32 81 44 C81.845625 43.896875 82.69125 43.79375 83.5625 43.6875 C87.63880915 44.05807356 89.24869925 45.29776238 92.38671875 47.75390625 C94.15286051 49.11806902 95.95921007 50.10205243 98 51 C97.43867066 54.5371438 96.30442253 55.99261679 93.5625 58.25 C92.94503906 58.77078125 92.32757813 59.2915625 91.69140625 59.828125 C90 61 90 61 88 61 C88 61.99 88 62.98 88 64 C87.34 64 86.68 64 86 64 C85.67 65.32 85.34 66.64 85 68 C84.01 68 83.02 68 82 68 C82 68.66 82 69.32 82 70 C81.38125 70.268125 80.7625 70.53625 80.125 70.8125 C77.7004767 71.95556848 77.7004767 71.95556848 76 75 C75.34 75 74.68 75 74 75 C73.81824219 75.59167969 73.63648438 76.18335938 73.44921875 76.79296875 C72.0304396 81.25302833 70.47959424 85.01108753 68 89 C67.31039038 90.99220557 66.63920943 92.99105606 66 95 C65.67 95.33 65.34 95.66 65 96 C64.88658441 98.5351719 64.83582079 101.0420479 64.83203125 103.578125 C64.82870285 104.34171326 64.82537445 105.10530151 64.82194519 105.89202881 C64.81687107 107.51281124 64.81453701 109.13360416 64.81469727 110.75439453 C64.81252134 113.22576381 64.79440054 115.69667917 64.77539062 118.16796875 C64.77245462 119.74218597 64.77047121 121.31640532 64.76953125 122.890625 C64.75875298 123.99558319 64.75875298 123.99558319 64.74775696 125.12286377 C64.76583127 129.21824776 65.20285598 132.31677271 67 136 C67.7115625 137.670625 67.7115625 137.670625 68.4375 139.375 C68.953125 140.57125 69.46875 141.7675 70 143 C70.474375 144.175625 70.94875 145.35125 71.4375 146.5625 C73.50099094 151.10218007 76.05411149 154.87018873 79.25 158.6875 C81 161 81 161 81 164 C81.804375 164.37125 81.804375 164.37125 82.625 164.75 C85.60525596 166.31855577 88.30987348 167.96745997 91 170 C91.35169068 171.32860925 91.68770276 172.66158328 92 174 C93.65204456 174.70211894 95.31923769 175.36971413 97 176 C97.33 176.99 97.66 177.98 98 179 C98.70511719 179.07605469 99.41023438 179.15210938 100.13671875 179.23046875 C103.77769019 180.20901087 105.87608345 181.96105765 108.8125 184.3125 C113.33463814 187.85670826 117.73953049 190.67325387 123 193 C123 193.66 123 194.32 123 195 C123.99 195.061875 124.98 195.12375 126 195.1875 C130.87318321 195.85383321 135.51932401 198.51932401 139 202 C141.0063874 202.23024118 143.01280966 202.46018994 145.01953125 202.6875 C147.3292917 203.05195924 148.94132652 203.90632972 151 205 C152.93188683 205.49115767 154.86470786 205.97934983 156.8046875 206.4375 C159.01935175 207.00495845 161.15108825 207.69378843 163.3125 208.4375 C167.63222017 209.91983032 172.00161594 211.11006728 176.421875 212.25390625 C179 213 179 213 181.3515625 213.9921875 C184.70394846 215.26787419 188.11100699 215.91392121 191.625 216.5625 C198.65992239 217.8866408 198.65992239 217.8866408 202 219 C204.50326538 219.20296746 206.99306611 219.37107197 209.5 219.5 C216.59459459 219.86486486 216.59459459 219.86486486 220 221 C222.34498792 221.11037297 224.69301155 221.15910888 227.04052734 221.17700195 C227.75516144 221.18357315 228.46979553 221.19014435 229.20608521 221.19691467 C231.58270394 221.21668116 233.95925826 221.22833906 236.3359375 221.23828125 C237.15752979 221.24235678 237.97912209 221.2464323 238.82561111 221.25063133 C243.20323687 221.27154021 247.58083116 221.28580173 251.95849609 221.29516602 C255.52312994 221.3039009 259.08735786 221.32446267 262.65185547 221.35668945 C287.31727531 221.57489538 310.74363137 220.41858539 334.97879028 215.40467834 C337.39148982 214.92161751 339.81212665 214.58029252 342.25 214.25 C348.48194524 213.23587768 354.53381429 211.63804833 360.625 210 C361.61016602 209.73864258 362.59533203 209.47728516 363.61035156 209.20800781 C364.53557617 208.95374023 365.46080078 208.69947266 366.4140625 208.4375 C367.2488916 208.20933594 368.0837207 207.98117187 368.94384766 207.74609375 C371.1853539 207.09698446 371.1853539 207.09698446 373 205 C374.84765625 204.5078125 374.84765625 204.5078125 377.0625 204.125 C381.38186231 203.26112754 385.02597802 201.76663392 388.95703125 199.8046875 C391 199 391 199 395 199 C395 199.66 395 200.32 395 201 C395.94875 201.12375 396.8975 201.2475 397.875 201.375 C401 202 401 202 403 204 C404.64991582 204.70710678 406.3207762 205.36562656 408 206 C414.78136201 208.78136201 414.78136201 208.78136201 416 210 C417.7015625 210.185625 417.7015625 210.185625 419.4375 210.375 C420.613125 210.58125 421.78875 210.7875 423 211 C423.66 211.99 424.32 212.98 425 214 C425.99 214.33 426.98 214.66 428 215 C428 215.66 428 216.32 428 217 C429.670625 217.185625 429.670625 217.185625 431.375 217.375 C435 218 435 218 437 220 C437.886875 220.268125 438.77375 220.53625 439.6875 220.8125 C442.60586153 221.85870508 444.11830123 222.72473687 446.5 224.5625 C449.63814566 226.95611886 452.10554156 227.36601839 456 228 C457.0625 229.875 457.0625 229.875 458 232 C461.45899447 234.49816267 464.96321743 235.70822958 469 237 C471.34205301 237.97940398 473.67518826 238.98034573 476 240 C477.19625 240.495 478.3925 240.99 479.625 241.5 C482.63003648 242.83557177 485.35117791 244.0523367 488 246 C488.6328125 248.09765625 488.6328125 248.09765625 489 250 C483.08315098 254.90153173 483.08315098 254.90153173 478.5625 255.3125 C477.2940625 255.1578125 477.2940625 255.1578125 476 255 C475.67 255.99 475.34 256.98 475 258 C473.02 258.33 471.04 258.66 469 259 C468.67 259.99 468.34 260.98 468 262 C466.02 262 464.04 262 462 262 C461.67 262.99 461.34 263.98 461 265 C459.865625 265.144375 458.73125 265.28875 457.5625 265.4375 C454.19222799 265.61171478 454.19222799 265.61171478 453 267 C451.906875 267.12375 450.81375 267.2475 449.6875 267.375 C445.81949633 268.03059384 444.96842815 268.69363443 442 271 C440.06638507 272.10684643 438.10554039 273.16699255 436.125 274.1875 C435.11695313 274.71730469 434.10890625 275.24710937 433.0703125 275.79296875 C429.80507805 277.07662962 427.47403264 277.23333055 424 277 C423.67 277.99 423.34 278.98 423 280 C421.02 280.33 419.04 280.66 417 281 C416.67 281.99 416.34 282.98 416 284 C411.4124011 285.6515356 406.82797319 286.40881961 402 287 C401.67 287.99 401.34 288.98 401 290 C400.319375 290.268125 399.63875 290.53625 398.9375 290.8125 C396.23694121 291.90421526 394.9302865 292.807278 392.75 294.625 C388.67274574 297.81083936 384.31157414 299.82579321 379.625 301.9375 C373.6708478 304.62653432 368.31282956 307.49334309 363.078125 311.45703125 C358.89135738 314.56562751 354.93627204 316.38815607 350 318 C346.59694752 319.55356743 343.48977834 321.32207791 340.375 323.375 C336.00975431 326.17518667 331.36101101 328.01287294 326.5390625 329.88671875 C323.89500302 330.86256503 323.89500302 330.86256503 322 333 C320.989375 333.103125 319.97875 333.20625 318.9375 333.3125 C314.59058362 334.0714854 311.82876908 335.57564031 308.08203125 337.796875 C305.79989131 339.11563504 303.44822546 340.03554755 301 341 C300.34 341.66 299.68 342.32 299 343 C297.01363702 343.70626239 295.01151741 344.36893571 293 345 C292.154375 345.37125 291.30875 345.7425 290.4375 346.125 C287.80171456 347.07117939 285.77832339 347.15876134 283 347 C283 347.66 283 348.32 283 349 C262.87767711 354.95167297 238.51852776 353.87589717 219 346 C218.34 345.34 217.68 344.68 217 344 C214.85246947 343.17735726 212.68145148 342.41544087 210.5 341.6875 C204.38341456 339.58722669 198.70409805 337.03557218 193 334 C187.83230547 331.35691109 182.7109412 328.9857968 177.25 327 C175 326 175 326 174 324 C172.01922047 322.96244882 170.01470098 321.97004121 168 321 C165.64806655 319.69702887 163.32603355 318.34909946 161 317 C161 316.34 161 315.68 161 315 C159.989375 314.9175 158.97875 314.835 157.9375 314.75 C153.59282288 314.13944456 150.64548275 312.40601861 147 310 C146.67 309.34 146.34 308.68 146 308 C143.01990872 307.13888437 140.01377056 306.52546876 136.98046875 305.87890625 C133.99455218 304.9983935 132.35575017 303.97714746 130 302 C129.278125 301.649375 128.55625 301.29875 127.8125 300.9375 C126 300 126 300 125 298 C121.76556961 296.69082579 118.98388217 295.99856091 115.5 295.6875 C111.12981439 294.82907068 109.3197366 292.90476952 106 290 C104.12153536 289.08851136 104.12153536 289.08851136 102.1875 288.375 C100.6096875 287.694375 100.6096875 287.694375 99 287 C98.67 286.01 98.34 285.02 98 284 C96.15302626 283.39184816 96.15302626 283.39184816 94 283 C92.56637928 282.34859204 91.14898188 281.6603073 89.75 280.9375 C89.04359375 280.57527344 88.3371875 280.21304687 87.609375 279.83984375 C87.07828125 279.56269531 86.5471875 279.28554688 86 279 C86 278.34 86 277.68 86 277 C84.35 277 82.7 277 81 277 C80.67 276.01 80.34 275.02 80 274 C77.27564363 272.92414941 77.27564363 272.92414941 74 272 C71.64353401 271.04798774 69.32671974 270.02375668 67 269 C67 268.34 67 267.68 67 267 C65.02 266.34 63.04 265.68 61 265 C61 264.34 61 263.68 61 263 C58.69 263 56.38 263 54 263 C53.67 262.01 53.34 261.02 53 260 C50.02496878 258.84164327 50.02496878 258.84164327 47 258 C46.67 257.67 46.34 257.34 46 257 C43.67182036 256.63239269 41.3381615 256.29758419 39 256 C38.67 255.01 38.34 254.02 38 253 C37.319375 252.896875 36.63875 252.79375 35.9375 252.6875 C32.37084011 251.85274981 29.33777806 250.50527246 26 249 C26 248.34 26 247.68 26 247 C25.21625 246.71125 24.4325 246.4225 23.625 246.125 C21 245 21 245 19 243 C16.67190457 242.31526605 14.33762223 241.65146849 12 241 C9.52925976 240.14230714 7.35515999 239.17757999 5 238 C4.67 237.01 4.34 236.02 4 235 C3.34 235.103125 2.68 235.20625 2 235.3125 C-1.81870549 234.91471818 -3.88427509 233.3297748 -7.02734375 231.2265625 C-9.08029894 229.84412963 -9.08029894 229.84412963 -12 229 C-14.70032237 228.09989254 -16.3604967 227.18262898 -18.6875 225.625 C-22.78739597 222.93667363 -27.03665453 221.41418689 -31.6796875 219.89453125 C-34 219 -34 219 -36 217 C-37.010625 216.7525 -38.02125 216.505 -39.0625 216.25 C-43.1748042 215.1687109 -46.195786 213.01416548 -49.6484375 210.59375 C-52.73650585 208.50083989 -55.9652776 206.74258545 -59.25 204.98046875 C-61 204 -61 204 -62 203 C-63.5159375 202.8453125 -63.5159375 202.8453125 -65.0625 202.6875 C-69.61320016 201.8929333 -73.00474643 200.23111563 -77 198 C-77 197.34 -77 196.68 -77 196 C-77.61875 195.9175 -78.2375 195.835 -78.875 195.75 C-81 195 -81 195 -82.25 192.9375 C-82.4975 192.298125 -82.745 191.65875 -83 191 C-83.825 191.0825 -84.65 191.165 -85.5 191.25 C-90.05881178 190.92437059 -93.03689354 189.13575971 -97 187 C-100.60122756 185.3573348 -104.04298013 183.95215158 -107.875 183 C-108.90625 182.67 -109.9375 182.34 -111 182 C-111.33 181.01 -111.66 180.02 -112 179 C-112.9075 178.71125 -113.815 178.4225 -114.75 178.125 C-118.59196444 176.79508923 -120.1563786 174.8436214 -123 172 C-125.92914165 170.82917122 -125.92914165 170.82917122 -129 170 C-133.32213437 168.17140469 -135.04471393 167.18989873 -137 163 C-138.84864941 162.4266714 -138.84864941 162.4266714 -141 162 C-142.40407603 161.56757584 -143.80037886 161.10906104 -145.1875 160.625 C-145.88230469 160.39039063 -146.57710938 160.15578125 -147.29296875 159.9140625 C-149 159 -149 159 -150 156 C-150.78375 156.04125 -151.5675 156.0825 -152.375 156.125 C-155 156 -155 156 -157 154 C-158.98536627 153.29094062 -160.98910922 152.63305821 -163 152 C-167.81281808 150.31263749 -172.58713408 148.58314102 -177 146 C-177.33 145.01 -177.66 144.02 -178 143 C-179.3194294 142.6152989 -180.65820387 142.29744249 -182 142 C-184.38219652 140.89090267 -186.72337734 139.75513679 -189.0625 138.5625 C-189.99932617 138.09360352 -189.99932617 138.09360352 -190.95507812 137.61523438 C-193.75669991 136.20096852 -196.38508406 134.7432773 -199 133 C-199.928125 132.690625 -200.85625 132.38125 -201.8125 132.0625 C-207.6084613 130.1305129 -212.2017259 127.91541354 -216 123 C-216.8125 119.6875 -216.8125 119.6875 -216 116 C-211.57995552 109.78867434 -206.01870823 106.56379577 -199 104 C-194.37175214 102.16466033 -190.65367564 100.14970922 -186.6953125 97.203125 C-183.10889688 94.65792682 -179.3225862 92.83126658 -175 92 C-175 91.01 -175 90.02 -175 89 C-172.37623339 87.14792945 -169.64417621 85.82893087 -166.75 84.4375 C-163.90101081 83.28993042 -163.90101081 83.28993042 -163 81 C-161.00945124 80.30562253 -159.00744615 79.64389782 -157 79 C-152.73329705 77.33618316 -152.73329705 77.33618316 -150 74 C-148.33333333 73.66666667 -146.66666667 73.33333333 -145 73 C-144.67 72.34 -144.34 71.68 -144 71 C-142.989375 70.9175 -141.97875 70.835 -140.9375 70.75 C-136.61335795 70.28638065 -134.06815482 68.09670481 -130.796875 65.375 C-129 64 -129 64 -126 63 C-125.505 62.01 -125.505 62.01 -125 61 C-123.02829794 59.94530053 -121.02153413 58.9557195 -119 58 C-117.87722656 57.4328125 -116.75445312 56.865625 -115.59765625 56.28125 C-114.43105469 55.6934375 -113.26445312 55.105625 -112.0625 54.5 C-110.89847656 53.9121875 -109.73445313 53.324375 -108.53515625 52.71875 C-106.16076142 51.56434809 -103.75653993 50.46954523 -101.328125 49.43359375 C-98.63664289 48.27423467 -96.20069102 47.05089468 -93.6875 45.5625 C-90.48634971 43.73560844 -87.32556394 42.29330697 -83.875 41 C-79.93326031 39.498966 -76.90738132 37.65199872 -73.58203125 35.08984375 C-71.25354604 33.48577616 -68.67933321 32.85510634 -66 32 C-63.9934562 30.67653494 -61.99371825 29.34270821 -60 28 C-56.51793545 26.41724339 -53.00548846 25.00211835 -49.4375 23.625 C-46.35936157 22.16988001 -44.37168072 20.62994306 -41.859375 18.39453125 C-35.006468 13.254851 -25.83209817 9.43173279 -17.625 7 C-16.75875 6.67 -15.8925 6.34 -15 6 C-14.67 5.01 -14.34 4.02 -14 3 C-9.23266183 0.42563739 -5.49436896 -0.78490985 0 0 Z " fill="#FDFDFD" transform="translate(321,172)"/>
+<path d="M0 0 C2.49457129 0.27379441 4.98892067 0.44549145 7.4921875 0.62109375 C10.06915734 1.01044901 11.72508157 1.77323613 14 3 C15.11375 3.28875 16.2275 3.5775 17.375 3.875 C21.19291961 5.0598716 23.69410054 6.79606703 27 9 C29.32748694 9.68679942 31.65986656 10.35761043 34 11 C34.33 11.66 34.66 12.32 35 13 C36.66220581 14.00739746 38.33020674 15.00522955 40 16 C41.21335145 16.95197189 42.42120345 17.91097402 43.625 18.875 C47.55837529 21.87678641 51.65154579 23.75485243 56.17578125 25.7109375 C67.62425447 30.93638171 67.62425447 30.93638171 71 36 C73.05925139 36.72382467 73.05925139 36.72382467 75 37 C75 37.66 75 38.32 75 39 C75.58007812 39.09796875 76.16015625 39.1959375 76.7578125 39.296875 C82.09636104 40.31877538 85.49301166 41.86470376 90 45 C91.134375 45.309375 92.26875 45.61875 93.4375 45.9375 C97.86546449 47.25812099 100.42930811 49.08514947 104 52 C104 52.66 104 53.32 104 54 C105.32 54 106.64 54 108 54 C108 54.66 108 55.32 108 56 C108.94875 56.12375 109.8975 56.2475 110.875 56.375 C114 57 114 57 116 59 C117.64991582 59.70710678 119.31562256 60.37943989 121 61 C121 61.66 121 62.32 121 63 C121.92232422 63.30744141 121.92232422 63.30744141 122.86328125 63.62109375 C126.2421875 64.74739583 129.62109375 65.87369792 133 67 C133.33 67.99 133.66 68.98 134 70 C136.33814997 71.12411056 138.58255576 72.09409458 141 73 C141.969375 73.391875 142.93875 73.78375 143.9375 74.1875 C144.618125 74.455625 145.29875 74.72375 146 75 C146 75.66 146 76.32 146 77 C147.8253125 76.9071875 147.8253125 76.9071875 149.6875 76.8125 C153.69295964 76.82652963 155.70711999 77.61266199 159 80 C164.62461209 83.80902346 164.62461209 83.80902346 170.9375 86.1875 C171.948125 86.455625 172.95875 86.72375 174 87 C174.33 87.66 174.66 88.32 175 89 C178.09703025 90.69599276 181.23372904 92.09599586 184.5 93.4375 C187.99161249 94.99625557 190.87581596 96.80642397 194 99 C195.11375 99.70125 196.2275 100.4025 197.375 101.125 C198.24125 101.74375 199.1075 102.3625 200 103 C200 103.66 200 104.32 200 105 C200.78375 104.95875 201.5675 104.9175 202.375 104.875 C205 105 205 105 207 107 C207.886875 107.268125 208.77375 107.53625 209.6875 107.8125 C212.60586153 108.85870508 214.11830123 109.72473687 216.5 111.5625 C219.59211978 113.90397155 222.07231176 114.71260818 226 115 C226 115.66 226 116.32 226 117 C227.051875 117.103125 228.10375 117.20625 229.1875 117.3125 C232.98176948 117.99671253 234.84757509 118.89838339 238 121 C239.0725 121.474375 240.145 121.94875 241.25 122.4375 C242.1575 122.953125 243.065 123.46875 244 124 C244.33 125.32 244.66 126.64 245 128 C248.63 128.66 252.26 129.32 256 130 C256 130.66 256 131.32 256 132 C256.66 132 257.32 132 258 132 C258 132.99 258 133.98 258 135 C258.9590625 135.2165625 258.9590625 135.2165625 259.9375 135.4375 C262 136 262 136 263 137 C264.134375 137.144375 265.26875 137.28875 266.4375 137.4375 C270 138 270 138 272 140 C272.928125 140.268125 273.85625 140.53625 274.8125 140.8125 C278.57531658 142.21433363 280.25586776 144.11514303 283 147 C283.928125 147.556875 284.85625 148.11375 285.8125 148.6875 C286.534375 149.120625 287.25625 149.55375 288 150 C288 150.66 288 151.32 288 152 C288.78375 152.12375 289.5675 152.2475 290.375 152.375 C293 153 293 153 295 155 C297.50055504 156.05941183 300.03799689 156.97405778 302.58984375 157.90234375 C305.01025789 159.00467175 306.23673661 160.0557565 308 162 C310.44874277 163.61101498 312.77746486 164.91098594 315.5 166 C318.20473834 167.08189534 320.52197868 168.4750638 323 170 C324.32608822 170.68096422 325.65686601 171.35330586 327 172 C327 172.66 327 173.32 327 174 C329.35218587 175.31722409 331.35360942 176.08103549 334 176.6875 C338.79837145 177.9773848 342.82007144 180.70173172 347.04296875 183.24609375 C350.61568793 185.36518346 354.25804514 187.20098324 358 189 C358 189.66 358 190.32 358 191 C358.721875 190.9175 359.44375 190.835 360.1875 190.75 C363.87110419 191.07743148 365.38626111 192.46093936 368 195 C368 195.66 368 196.32 368 197 C368.58007812 197.18175781 369.16015625 197.36351562 369.7578125 197.55078125 C374.40904607 199.04746532 378.62464036 200.81232018 383 203 C385.33010909 203.67784992 387.66359824 204.34416793 390 205 C394.80534267 206.85469366 398.7532177 209.11218804 403 212 C404.43083214 212.80365524 405.86894471 213.59442938 407.3125 214.375 C410.53711408 216.12797812 413.55130385 218.02754613 416.5625 220.125 C419.99619252 222.4639787 423.25672573 224.02747107 427.17578125 225.3671875 C435.67062642 228.31400745 448.66266338 234.78188851 453 243 C453.79970381 248.03813402 453.79970381 248.03813402 453 251 C448.70712313 255.10208234 443.70765862 257.12008685 438.3125 259.48046875 C434.17758457 261.37726368 430.15153165 263.44708388 426.125 265.5625 C425.03662842 266.12662598 425.03662842 266.12662598 423.92626953 266.70214844 C419.93317334 268.81488795 416.45854297 271.05803358 413 274 C409.44091677 276.37272215 406.05223293 277.6768219 402 279 C398.24537328 280.61066405 398.24537328 280.61066405 395 283 C393.515 283.061875 393.515 283.061875 392 283.125 C386.59567116 283.79220109 383.04503783 287.64315386 379 291 C375.43342471 293.40536473 372.07715726 294.66868334 368 296 C363.65247756 298.00007904 363.65247756 298.00007904 360 301 C358.01363702 301.70626239 356.01151741 302.36893571 354 303 C351.24743756 303.84979475 351.24743756 303.84979475 349 305 C348.67 305.99 348.34 306.98 348 308 C343.94093822 310.43543707 339.65791167 311.80495594 335.18359375 313.24609375 C331.28726126 314.59133913 327.92329604 316.07670396 325 319 C322.49363378 319.82112513 319.96374344 320.46295272 317.41015625 321.12109375 C314.85089561 322.05437356 313.81974672 323.03824993 312 325 C311.113125 325.28875 310.22625 325.5775 309.3125 325.875 C306.41830652 326.85793363 304.51776944 327.85358098 302 329.5 C298.7487799 331.61391116 295.72519597 332.8662447 292 334 C288.80827831 335.50198668 285.93670119 337.04219921 283 339 C282.06414063 339.30292969 281.12828125 339.60585938 280.1640625 339.91796875 C276.88576922 341.03906411 274.31285971 342.48746594 271.375 344.3125 C266.24148062 347.39517518 261.09323808 349.74836704 255.49609375 351.859375 C253.0308083 352.98592172 251.83254168 354.06711742 250 356 C248.01643517 356.71408334 246.01684563 357.38617742 244 358 C243.67 358.33 243.34 358.66 243 359 C241.35769636 359.1245486 239.70947724 359.17568524 238.0625 359.1875 C237.16660156 359.20167969 236.27070312 359.21585937 235.34765625 359.23046875 C233 359 233 359 231 357 C228.93125966 356.3574765 228.93125966 356.3574765 227 356 C226.67 354.68 226.34 353.36 226 352 C225.175 351.9175 224.35 351.835 223.5 351.75 C214.68163222 349.86034976 206.95549851 344.06945057 199.3828125 339.37890625 C196.66963555 337.80882188 193.97624504 336.97183511 191 336 C188.99152635 335.01712992 186.99180409 334.01622658 185 333 C180.82139559 331.14284249 176.60421345 329.4787756 172.3203125 327.8828125 C169.43071377 326.78340288 166.55570803 325.65419456 163.6875 324.5 C162.68074219 324.0978125 161.67398437 323.695625 160.63671875 323.28125 C158.15170021 322.07371506 156.82994773 321.00793657 155 319 C151.15195881 317.18286944 147.09602931 316.1244002 143 315 C142.75137069 312.01644824 142.81008567 310.35134151 144.25 307.6875 C146 306 146 306 150 306 C150.33 305.01 150.66 304.02 151 303 C152.66075482 302.31873966 154.32867994 301.65491334 156 301 C157.8780172 299.5779956 159.70986761 298.09366661 161.5 296.5625 C164.17739548 294.27994515 166.66647544 292.19367493 169.7109375 290.42578125 C173.00220925 288.37575704 174.29401384 285.3531452 176 282 C178.75757576 277.12121212 178.75757576 277.12121212 181 276 C181.34541851 273.66842508 181.67794257 271.33491639 182 269 C182.66 268.01 183.32 267.02 184 266 C184.67784992 263.66989091 185.34416793 261.33640176 186 259 C186.33644531 258.44054687 186.67289063 257.88109375 187.01953125 257.3046875 C188.496451 253.83304346 188.51277947 250.28245892 188.6875 246.5625 C188.73455078 245.81162109 188.78160156 245.06074219 188.83007812 244.28710938 C189.04383262 240.30286573 188.87946275 236.91164028 188 233 C187.93466565 231.06348981 187.91415697 229.12497139 187.9375 227.1875 C187.94652344 226.21167969 187.95554687 225.23585938 187.96484375 224.23046875 C187.98224609 223.12638672 187.98224609 223.12638672 188 222 C186.68 221.67 185.36 221.34 184 221 C183.5978125 219.4840625 183.5978125 219.4840625 183.1875 217.9375 C182.10835772 214.14136829 180.57849919 210.61739397 179 207 C178.31163487 205.00736409 177.63718601 203.00958663 177 201 C176.34 201 175.68 201 175 201 C174.38125 200.195625 173.7625 199.39125 173.125 198.5625 C171.32285328 195.8303083 171.32285328 195.8303083 168.9375 195.625 C168.298125 195.41875 167.65875 195.2125 167 195 C166.24572327 193.29467869 165.4996571 191.58389092 164.83984375 189.83984375 C163.03470439 185.88532915 159.54205242 183.42159633 156.1875 180.8125 C155.465625 180.214375 154.74375 179.61625 154 179 C154 178.34 154 177.68 154 177 C153.34 177 152.68 177 152 177 C152 175.68 152 174.36 152 173 C150.02 172.34 148.04 171.68 146 171 C146 170.34 146 169.68 146 169 C145.21625 169.04125 144.4325 169.0825 143.625 169.125 C141 169 141 169 139 167 C137.34877081 166.29596564 135.67917062 165.63451419 134 165 C132.16136863 164.19956134 130.32810817 163.38668922 128.5 162.5625 C127.5821875 162.15128906 126.664375 161.74007812 125.71875 161.31640625 C123.03803238 160.01841511 120.54303632 158.54683862 118 157 C113.05394643 154.66695586 108.30341078 153.20954983 103 152 C103 151.01 103 150.02 103 149 C101.989375 149.061875 100.97875 149.12375 99.9375 149.1875 C95.56899032 148.97947573 92.96737476 147.77847834 89 146 C86.85326401 145.42698343 84.69999437 144.9769613 82.5234375 144.53125 C79.64158812 143.92454487 76.79327165 143.21933795 73.9375 142.5 C72.91269531 142.24476563 71.88789062 141.98953125 70.83203125 141.7265625 C69.19820446 141.30740142 67.56776047 140.87320974 65.94921875 140.3984375 C60.57311797 138.85583042 55.2346808 138.59975572 49.66015625 138.34375 C46.90192406 138.08470578 44.6050682 137.70288572 41.95092773 137.04638672 C36.70267421 135.85781136 31.48320395 135.33658704 26.125 134.9140625 C25.09052734 134.83048492 24.05605469 134.74690735 22.99023438 134.66079712 C10.67271665 133.73327458 -1.65318934 133.54522746 -14 133.375 C-16.34766829 133.33666807 -18.69532482 133.2976086 -21.04296875 133.2578125 C-26.69520529 133.16353725 -32.34751731 133.0780531 -38 133 C-38 133.66 -38 134.32 -38 135 C-46.01491995 135.9084812 -53.99272456 136.29231541 -62.05273438 136.51757812 C-67.36313387 136.71371135 -71.90904781 137.33467609 -77 139 C-78.68289483 139.35585441 -80.37022681 139.69181366 -82.0625 140 C-84.88914199 140.5422712 -87.44797422 141.14932474 -90.1875 142.0625 C-93 143 -93 143 -96.625 143.5 C-99.84742016 143.7971139 -99.84742016 143.7971139 -101.92578125 144.96875 C-104.81221376 146.40381249 -107.73019489 146.84280241 -110.87890625 147.4375 C-113.27653722 147.95116341 -113.27653722 147.95116341 -116 150 C-121.04284982 151.68094994 -126.10762882 152.59606652 -131.3515625 153.4375 C-134.07678959 154.01630929 -136.43981045 154.91372989 -139 156 C-139.969375 156.309375 -140.93875 156.61875 -141.9375 156.9375 C-145.07528155 157.94316464 -145.07528155 157.94316464 -148.125 159.625 C-151 161 -151 161 -155 161 C-155 160.34 -155 159.68 -155 159 C-155.721875 159.061875 -156.44375 159.12375 -157.1875 159.1875 C-160.66890498 158.95540633 -162.08492035 157.9213025 -165 156 C-170.56752071 152.79413395 -176.23379615 149.83068189 -182 147 C-182 146.34 -182 145.68 -182 145 C-183.11375 145.04125 -184.2275 145.0825 -185.375 145.125 C-189 145 -189 145 -191 143 C-192.64991582 142.29289322 -194.31562256 141.62056011 -196 141 C-196 140.34 -196 139.68 -196 139 C-197.32 138.34 -198.64 137.68 -200 137 C-200 136.34 -200 135.68 -200 135 C-200.969375 134.938125 -201.93875 134.87625 -202.9375 134.8125 C-207.15453576 134.23083989 -210.29597275 132.35401964 -213.9140625 130.19921875 C-216.08746512 128.87465455 -216.08746512 128.87465455 -219 127.875 C-219.99 127.441875 -219.99 127.441875 -221 127 C-221.33 126.01 -221.66 125.02 -222 124 C-222.680625 124.0825 -223.36125 124.165 -224.0625 124.25 C-228.16875665 123.90053135 -230.52321895 122.18150968 -234 120 C-234 119.34 -234 118.68 -234 118 C-235.051875 117.9175 -236.10375 117.835 -237.1875 117.75 C-241.30271705 116.9404491 -243.02972998 115.88290914 -246 113 C-246.33 112.34 -246.66 111.68 -247 111 C-247.825 110.71125 -248.65 110.4225 -249.5 110.125 C-252 109 -252 109 -252.875 107 C-253 105 -253 105 -252 103 C-248.9375 102.375 -248.9375 102.375 -246 102 C-246 101.01 -246 100.02 -246 99 C-245.030625 98.87625 -244.06125 98.7525 -243.0625 98.625 C-241.5465625 98.315625 -241.5465625 98.315625 -240 98 C-239.505 97.01 -239.505 97.01 -239 96 C-237.00945124 95.30562253 -235.00744615 94.64389782 -233 94 C-232.113125 93.505 -231.22625 93.01 -230.3125 92.5 C-227.23123861 91.10471182 -225.170136 90.68493904 -221.875 90.25 C-213.73608797 88.93977951 -207.29150243 84.30009307 -200.625 79.6875 C-197.82570457 77.88795294 -195.1895772 76.91130777 -192 76 C-192 75.34 -192 74.68 -192 74 C-190.329375 73.443125 -190.329375 73.443125 -188.625 72.875 C-182.67445 70.65416973 -176.51696366 67.51696366 -172 63 C-170.00231474 62.32642889 -168.0018939 61.66095784 -166 61 C-163.76759111 59.92356531 -161.55910869 58.79633698 -159.375 57.625 C-158.26898438 57.03976563 -157.16296875 56.45453125 -156.0234375 55.8515625 C-153.20887946 54.12791843 -151.27911286 52.34939387 -149 50 C-148.0925 49.71125 -147.185 49.4225 -146.25 49.125 C-143.13788912 48.04773085 -141.58369331 47.01890528 -139.0625 45 C-135.51878895 42.21517162 -132.45644408 40.94270932 -128 40 C-127.195625 39.79375 -126.39125 39.5875 -125.5625 39.375 C-125.046875 39.25125 -124.53125 39.1275 -124 39 C-124 38.01 -124 37.02 -124 36 C-122.329375 35.814375 -122.329375 35.814375 -120.625 35.625 C-116.96896323 35.3534187 -116.96896323 35.3534187 -115 33 C-114.0925 32.731875 -113.185 32.46375 -112.25 32.1875 C-108.83170268 31.14582074 -108.83170268 31.14582074 -106 28.5 C-102.91715106 25.93095921 -100.76886507 25.17777034 -97 24 C-94.9866347 22.68693567 -92.98768394 21.35162508 -91 20 C-88.36993665 18.5899058 -85.68808501 17.29526677 -83 16 C-82.01 15.505 -81.02 15.01 -80 14.5 C-79.01 14.005 -78.02 13.51 -77 13 C-76.32582031 12.64550781 -75.65164063 12.29101562 -74.95703125 11.92578125 C-74.24933594 11.55839844 -73.54164063 11.19101562 -72.8125 10.8125 C-72.15894531 10.46832031 -71.50539063 10.12414063 -70.83203125 9.76953125 C-69 9 -69 9 -66 9 C-66 8.34 -66 7.68 -66 7 C-62.98425212 4.64394697 -60.48095843 3.81327999 -56.75 3.4375 C-55.5125 3.293125 -54.275 3.14875 -53 3 C-52.67 2.34 -52.34 1.68 -52 1 C-50.01318359 0.49755859 -50.01318359 0.49755859 -47.3984375 0.1484375 C-45.96141479 -0.04540527 -45.96141479 -0.04540527 -44.49536133 -0.24316406 C-43.46564209 -0.36916992 -42.43592285 -0.49517578 -41.375 -0.625 C-40.32916748 -0.75616211 -39.28333496 -0.88732422 -38.20581055 -1.02246094 C-8.97686543 -4.48843272 -8.97686543 -4.48843272 0 0 Z " fill="#FDFDFD" transform="translate(599,46)"/>
+<path d="M0 0 C0.99 0.66 1.98 1.32 3 2 C4.175625 2.33 5.35125 2.66 6.5625 3 C10 4 10 4 12 6 C13.99571323 6.67939174 15.99594773 7.34561559 18 8 C18.99 8.66 19.98 9.32 21 10 C21 10.99 21 11.98 21 13 C21.66 13 22.32 13 23 13 C24.47265625 14.93359375 24.47265625 14.93359375 26.0625 17.4375 C27.83678892 20.3718143 27.83678892 20.3718143 30 23 C30.04063832 24.66617115 30.042721 26.33388095 30 28 C31.32 28 32.64 28 34 28 C34.42152344 28.92683594 34.84304687 29.85367188 35.27734375 30.80859375 C35.82519531 32.00613281 36.37304688 33.20367188 36.9375 34.4375 C37.48277344 35.63246094 38.02804688 36.82742188 38.58984375 38.05859375 C39.71746856 40.82811326 39.71746856 40.82811326 41 42 C41.09660952 43.92361627 41.12187168 45.85083066 41.12025452 47.77687073 C41.12231651 49.65949615 41.12231651 49.65949615 41.12442017 51.58015442 C41.12088055 52.98385644 41.11724574 54.38755822 41.11352539 55.79125977 C41.11324353 57.25936888 41.11340124 58.72747813 41.1139679 60.19558716 C41.1142559 64.19334657 41.10835874 68.19107624 41.10139394 72.18882871 C41.09516085 76.36220733 41.09455664 80.53558656 41.09336853 84.70896912 C41.09025508 92.61732792 41.08204151 100.52567297 41.07201904 108.4340257 C41.06085832 117.43508494 41.05534756 126.43614482 41.05032361 135.43720925 C41.03985891 153.95814731 41.0222592 172.47907255 41 191 C45.06681648 189.44003187 48.45298368 187.49972918 52 185 C52.825 184.42378906 53.65 183.84757813 54.5 183.25390625 C56.24524488 182.03375685 57.98883429 180.81123486 59.73046875 179.5859375 C64.77990431 176.05741627 64.77990431 176.05741627 67.875 175.25 C71.86360037 173.65455985 73.35227676 171.32662663 76 168 C78.5 166.375 78.5 166.375 81 165 C81.86625 164.278125 82.7325 163.55625 83.625 162.8125 C86 161 86 161 89 161 C89.66 159.68 90.32 158.36 91 157 C91.66 157 92.32 157 93 157 C93.33 156.01 93.66 155.02 94 154 C95.8125 152.68359375 95.8125 152.68359375 98 151.4375 C101.08502827 149.78625452 101.08502827 149.78625452 103 147 C103.99 146.67 104.98 146.34 106 146 C107.14468952 144.82164314 108.28787653 143.641774 109.421875 142.453125 C111.94532306 140.12955401 114.8407166 138.40622232 117.71875 136.5546875 C120.52043168 134.64532224 123.00056987 132.49222918 125.4921875 130.19921875 C127 129 127 129 130 128 C131.2065625 126.7934375 131.2065625 126.7934375 132.4375 125.5625 C134.68737791 123.31262209 136.19813231 122.30086714 139 121 C139.33 120.34 139.66 119.68 140 119 C141.6899258 118.31189902 143.37991438 117.62395157 145.0703125 116.93701172 C148.32936473 115.35449117 150.83597684 112.98345535 153.5 110.5625 C156.79751833 107.5899196 159.94080711 104.92694928 163.84375 102.77734375 C167.0547428 101.35711444 167.0547428 101.35711444 168 99 C170.35605999 97.47174487 172.71062587 96.13664889 175.25 94.9375 C177.18053285 94.11996415 177.18053285 94.11996415 178 92 C179.98320018 90.96708324 181.98347806 89.9662501 184 89 C184.33 88.67 184.66 88.34 185 88 C198.28149225 86.85891405 207.46567642 89.76870886 218.19921875 97.4140625 C218.79347656 97.93742188 219.38773438 98.46078125 220 99 C220 99.66 220 100.32 220 101 C221.32 101.66 222.64 102.32 224 103 C224 103.66 224 104.32 224 105 C224.62390625 105.23460937 225.2478125 105.46921875 225.890625 105.7109375 C228.60255941 107.36823075 228.88975997 108.6141599 229.75 111.625 C229.99234375 112.44226563 230.2346875 113.25953125 230.484375 114.1015625 C230.65453125 114.72804688 230.8246875 115.35453125 231 116 C231.66 116 232.32 116 233 116 C233.33 118.31 233.66 120.62 234 123 C234.66 123 235.32 123 236 123 C238.917004 133.02646315 240.76610926 146.44991543 236.609375 156.29296875 C234.8851487 158.53071462 233.20669073 160.24655072 231 162 C230.071875 162.845625 229.14375 163.69125 228.1875 164.5625 C226 166 226 166 224 166 C224 166.66 224 167.32 224 168 C223.360625 168.103125 222.72125 168.20625 222.0625 168.3125 C221.381875 168.539375 220.70125 168.76625 220 169 C219.67 169.99 219.34 170.98 219 172 C217.29296875 173.0625 217.29296875 173.0625 215.1875 174 C212.1542557 175.41947198 209.63197151 176.91257432 207 179 C202.44444444 182 202.44444444 182 199 182 C199 182.99 199 183.98 199 185 C197.865625 185.37125 196.73125 185.7425 195.5625 186.125 C191.32650825 187.7041418 187.86845944 189.94494122 184.16796875 192.51171875 C179.67560168 195.59566804 175.06956352 197.9988565 170 200 C166.76065951 201.75099486 163.90799046 203.82012837 161 206.0625 C158.06661734 208.30373619 155.43341032 209.64470645 152 211 C148.56319759 212.9333994 148.56319759 212.9333994 146 216 C144.72086271 221.68390846 146.00238635 225.16681058 149 230 C149.66655583 231.75561357 150.29124183 233.52764648 150.875 235.3125 C152.41508478 239.72543524 154.31835358 243.3058685 156.9140625 247.16796875 C158 249 158 249 159 252.5625 C160.06958534 256.23919962 161.53755336 258.25248853 163.83203125 261.2265625 C165.07093042 263.10770037 165.63296877 264.70123759 166.1875 266.875 C166.5896875 268.421875 166.5896875 268.421875 167 270 C167.66 270.33 168.32 270.66 169 271 C169.73401257 272.7862884 170.39001031 274.60514816 171 276.4375 C172.33336865 280.62213295 172.33336865 280.62213295 175 284 C175.66666667 286.33333333 176.33333333 288.66666667 177 291 C177.66 291.66 178.32 292.32 179 293 C179.68346682 294.65984798 180.34588315 296.32836805 181 298 C181.66183548 299.25256467 182.3289515 300.50234686 183 301.75 C184.51656186 304.70506539 185.38505766 307.36360935 186 310.625 C186.83522474 314.93535624 188.25967517 317.57459396 191 321 C191.66 321.33 192.32 321.66 193 322 C194.25147255 324.75323961 195.20003344 327.57904416 196.1875 330.4375 C198.12734185 335.67009905 200.73836143 340.57763883 203.28125 345.53515625 C205.59912727 350.20778612 207.58494346 354.98726203 209.5625 359.8125 C210.78171388 363.01764194 210.78171388 363.01764194 213 365 C213.68753301 366.65816784 214.35561283 368.32459336 215 370 C215.33 370.33 215.66 370.66 216 371 C216.04080783 372.99958364 216.04254356 375.00045254 216 377 C216.99 377.33 217.98 377.66 219 378 C219 378.99 219 379.98 219 381 C219.66 381 220.32 381 221 381 C221.79423861 382.56119422 222.58527123 384.12401964 223.375 385.6875 C223.81585938 386.55761719 224.25671875 387.42773438 224.7109375 388.32421875 C226 391 226 391 227.0703125 393.74609375 C227.82977495 396.03893587 227.82977495 396.03893587 229.5 397.375 C233.63167933 401.85098594 233.19995068 408.30140572 233 414 C233.99 414.33 234.98 414.66 236 415 C237.0625 418.125 237.0625 418.125 238 422 C238.59346189 424.37384754 239.25287095 426.66522172 240 429 C240.66 429.33 241.32 429.66 242 430 C242.40729228 432.32156597 242.74438677 434.6568787 243 437 C243.99 437 244.98 437 246 437 C246.12117188 437.68707031 246.24234375 438.37414062 246.3671875 439.08203125 C246.53476562 439.98308594 246.70234375 440.88414062 246.875 441.8125 C247.03742188 442.70582031 247.19984375 443.59914063 247.3671875 444.51953125 C247.91188449 447.22727846 247.91188449 447.22727846 250 450 C250.144375 451.11375 250.28875 452.2275 250.4375 453.375 C250.71179139 456.92904852 250.71179139 456.92904852 252.50390625 459.11328125 C254.68221621 463.31633884 254.51373734 467.14523801 254.5 471.8125 C254.52835937 472.67681641 254.55671875 473.54113281 254.5859375 474.43164062 C254.60522423 480.82036946 253.19925005 485.12960344 249 490 C244.98016416 493.41383044 241.48285057 493.37833208 236.3125 493.3125 C235.63638672 493.31572266 234.96027344 493.31894531 234.26367188 493.32226562 C229.26758205 493.26758205 229.26758205 493.26758205 227 491 C226.030625 490.95875 225.06125 490.9175 224.0625 490.875 C214.16019269 489.66289184 205.32522124 478.96888368 199 472 C197 469 197 469 197 466 C196.01 465.67 195.02 465.34 194 465 C193.29788106 463.34795544 192.63028587 461.68076231 192 460 C191.34 459.67 190.68 459.34 190 459 C189.01 457.515 189.01 457.515 188 456 C187.34 455.34 186.68 454.68 186 454 C185.875 450.375 185.875 450.375 186 447 C185.071875 446.690625 185.071875 446.690625 184.125 446.375 C181.09162588 444.41222851 181.003687 442.45017408 180 439 C179.37500213 437.51190982 178.72754547 436.03312886 178.0625 434.5625 C177.71574219 433.79292969 177.36898437 433.02335937 177.01171875 432.23046875 C176.67785156 431.49441406 176.34398437 430.75835938 176 430 C174.38187521 426.39033701 173.00017687 423.00063465 171.9375 419.1875 C171.2585469 415.93931214 171.2585469 415.93931214 169 414 C168.875 411.375 168.875 411.375 169 409 C168.01 408.67 167.02 408.34 166 408 C165.034339 405.69772285 164.23463806 403.4995398 163.5 401.125 C161.76532696 395.41287262 161.76532696 395.41287262 158 391 C157.29289322 389.35008418 156.63437344 387.6792238 156 386 C155.3631032 384.74542311 154.71636769 383.49581609 154.0625 382.25 C152.59392043 379.37763113 151.498814 376.58558021 150.5625 373.5 C149.30369289 369.48150037 147.44091083 366.32657527 145.125 362.83203125 C143.60329093 360.35397029 142.86508131 357.7682602 142 355 C141.37232971 353.72009842 140.72479018 352.44983505 140.0625 351.1875 C138.60507622 348.35869961 137.46652432 345.59411181 136.5 342.5625 C133.97248731 334.64205918 130.19765667 327.35080384 126.45703125 319.9453125 C124.79401914 316.58362046 123.25484066 313.18203797 121.76171875 309.7421875 C121.20940221 308.47894044 120.61657874 307.23315747 120 306 C119.95977609 303.6670134 119.95679753 301.33293334 120 299 C119.34 299 118.68 299 118 299 C117.525625 297.865625 117.05125 296.73125 116.5625 295.5625 C115.36377917 292.24259834 115.36377917 292.24259834 114 291 C113.95919217 289.00041636 113.95745644 286.99954746 114 285 C113.01 284.67 112.02 284.34 111 284 C111 283.01 111 282.02 111 281 C110.34 281 109.68 281 109 281 C108.73445312 280.28972656 108.46890625 279.57945312 108.1953125 278.84765625 C107.84210938 277.92855469 107.48890625 277.00945312 107.125 276.0625 C106.77695312 275.14597656 106.42890625 274.22945312 106.0703125 273.28515625 C105.2180914 270.85058944 105.2180914 270.85058944 103 270 C102.49291665 268.37733328 101.99705513 266.75007276 101.56640625 265.10546875 C100.94979265 262.81336715 100.24162457 260.56718777 99.5 258.3125 C99.2628125 257.58675781 99.025625 256.86101562 98.78125 256.11328125 C97.99404022 253.98387878 97.05251051 252.00975067 96 250 C92.0106301 251.3713459 88.71759153 253.36944689 85.1953125 255.6328125 C82.16372203 257.52081368 79.03123101 259.2028085 75.8828125 260.88671875 C73.85200078 261.98215236 73.85200078 261.98215236 72 264 C71.01 264 70.02 264 69 264 C68.67 264.99 68.34 265.98 68 267 C65.50548587 269.49451413 64.32610265 269.98118639 60.75 270.1875 C59.8425 270.125625 58.935 270.06375 58 270 C57.67 270.99 57.34 271.98 57 273 C54.890625 274.9375 54.890625 274.9375 52.25 277 C51.38890625 277.680625 50.5278125 278.36125 49.640625 279.0625 C47 281 47 281 44.37319946 282.08366394 C41.58621352 283.8988735 41.58621352 283.8988735 41.38095093 287.77510071 C41.35781699 289.3828615 41.36236816 290.99115698 41.38818359 292.59887695 C41.38251877 293.4772522 41.37685394 294.35562744 41.37101746 295.26062012 C41.35749083 298.1702716 41.37848098 301.07868367 41.3984375 303.98828125 C41.39293913 306.00987096 41.38481618 308.0314551 41.37417603 310.05302429 C41.35124724 315.38228019 41.35552518 320.71112668 41.36798096 326.04040527 C41.3862566 334.56003303 41.37631892 343.07941911 41.34212112 351.59898949 C41.33601855 354.57377238 41.34927844 357.548039 41.36410522 360.52278137 C41.36115639 362.35283542 41.35750121 364.1828885 41.35302734 366.01293945 C41.36231766 366.83757187 41.37160797 367.66220428 41.38117981 368.51182556 C41.34699018 373.46488258 40.54816326 376.62497733 38 381 C37.7525 381.94875 37.505 382.8975 37.25 383.875 C35.46049332 388.34876671 32.51116347 391.72343543 29 395 C22.3411723 397.21960923 14.34553346 396.90318198 7.91796875 394.02734375 C-1.90287528 388.76689165 -10.28726874 381.63814601 -16 372 C-16.66 371.67 -17.32 371.34 -18 371 C-18.495 369.515 -18.495 369.515 -19 368 C-19.66 367.67 -20.32 367.34 -21 367 C-24.18664604 358.74263252 -25.64773107 350.81633954 -25 342 C-25.66 342 -26.32 342 -27 342 C-27.90047952 334.59491362 -28.14427143 327.30150174 -28.13371277 319.84658813 C-28.13597833 318.65975791 -28.13824388 317.47292769 -28.14057809 316.25013292 C-28.14578489 312.98206848 -28.14656785 309.71403896 -28.14538372 306.44597173 C-28.14517855 302.91062231 -28.15070965 299.37528092 -28.15544128 295.8399353 C-28.16372477 288.92169365 -28.16649512 282.00346053 -28.16705366 275.08521433 C-28.16753013 269.45442567 -28.16959142 263.8236398 -28.17275429 258.19285202 C-28.18155635 242.19468705 -28.18617463 226.19652876 -28.18542381 210.19836135 C-28.18538386 209.33706714 -28.1853439 208.47577294 -28.18530273 207.58837891 C-28.18526185 206.72602062 -28.18522097 205.86366233 -28.18517885 204.97517197 C-28.18477302 191.02161025 -28.19432797 177.0680756 -28.2084411 163.1145217 C-28.2228501 148.75390903 -28.22970873 134.39330952 -28.22884732 120.03268945 C-28.2285168 111.983834 -28.23119964 103.93500689 -28.24202538 95.88615799 C-28.25119035 89.02853162 -28.25325711 82.17094642 -28.24651595 75.31331654 C-28.24328005 71.82323129 -28.24308591 68.33322474 -28.2518692 64.84314728 C-28.27666305 52.76732693 -28.29463501 40.72587208 -27.1723175 28.69271851 C-27.10316515 27.91633486 -27.0340128 27.13995122 -26.96276492 26.3400408 C-26.39632193 21.16476834 -25.17675022 16.74556273 -23 12 C-22.01 11.67 -21.02 11.34 -20 11 C-20 9.68 -20 8.36 -20 7 C-14.97806449 -0.26703609 -8.34831234 -1.39756933 0 0 Z " fill="#31405C" transform="translate(183,495)"/>
+<path d="M0 0 C3.46806102 0.00541308 6.93599534 -0.00000974 10.40405273 -0.00634766 C12.64689156 -0.00568757 14.8897303 -0.00440785 17.13256836 -0.00244141 C18.15048965 -0.00446564 19.16841095 -0.00648987 20.21717834 -0.00857544 C38.79975 0.05145898 38.79975 0.05145898 40.87866211 2.13037109 C42.64794282 2.40585616 44.42646026 2.62243789 46.20678711 2.81396484 C47.31119141 2.93578125 48.4155957 3.05759766 49.5534668 3.18310547 C50.73328125 3.31007812 51.9130957 3.43705078 53.12866211 3.56787109 C55.51424967 3.83588554 57.89966927 4.10539964 60.28491211 4.37646484 C62.00194336 4.57151611 62.00194336 4.57151611 63.75366211 4.77050781 C79.95344874 6.63601449 79.95344874 6.63601449 85.87866211 10.13037109 C88.11391246 10.81673734 88.11391246 10.81673734 89.87866211 11.13037109 C89.87866211 12.12037109 89.87866211 13.11037109 89.87866211 14.13037109 C93.17866211 14.46037109 96.47866211 14.79037109 99.87866211 15.13037109 C100.20866211 16.12037109 100.53866211 17.11037109 100.87866211 18.13037109 C102.15741211 18.25412109 103.43616211 18.37787109 104.75366211 18.50537109 C108.62866211 18.88037109 108.62866211 18.88037109 110.87866211 21.13037109 C112.03366211 21.27474609 113.18866211 21.41912109 114.37866211 21.56787109 C115.53366211 21.75349609 116.68866211 21.93912109 117.87866211 22.13037109 C118.53866211 23.12037109 119.19866211 24.11037109 119.87866211 25.13037109 C122.94422809 25.86380538 122.94422809 25.86380538 125.87866211 26.13037109 C125.87866211 27.12037109 125.87866211 28.11037109 125.87866211 29.13037109 C126.64178711 29.06849609 127.40491211 29.00662109 128.19116211 28.94287109 C131.40883118 29.16735963 131.77828742 29.84735512 133.87866211 32.13037109 C135.98199102 32.84484752 135.98199102 32.84484752 137.87866211 33.13037109 C137.87866211 34.12037109 137.87866211 35.11037109 137.87866211 36.13037109 C138.70366211 36.00662109 139.52866211 35.88287109 140.37866211 35.75537109 C148.22844668 36.59641944 154.36375048 44.30055699 159.69116211 49.69287109 C160.34536133 50.33933594 160.99956055 50.98580078 161.67358398 51.65185547 C167.26495375 57.26607047 169.82399776 61.14505531 170.87866211 69.13037109 C171.53866211 69.79037109 172.19866211 70.45037109 172.87866211 71.13037109 C173.33075136 74.31709797 173.202661 77.5402802 173.19116211 80.75537109 C173.20727539 81.63322266 173.22338867 82.51107422 173.23999023 83.41552734 C173.24456373 89.57144638 172.87049365 96.09464396 168.29785156 100.734375 C167.59535278 101.42539307 167.59535278 101.42539307 166.87866211 102.13037109 C166.75491211 102.74912109 166.63116211 103.36787109 166.50366211 104.00537109 C165.54929219 107.25022883 163.32083346 108.85858379 160.87866211 111.13037109 C158.56578782 113.30719396 156.91903776 115.06092497 155.31616211 117.81787109 C153.87866211 120.13037109 153.87866211 120.13037109 150.87866211 121.13037109 C150.54866211 122.12037109 150.21866211 123.11037109 149.87866211 124.13037109 C147.89265874 125.4844643 145.89048668 126.81494733 143.87866211 128.13037109 C143.09491211 128.95537109 142.31116211 129.78037109 141.50366211 130.63037109 C138.76233944 133.24115459 136.37002238 134.5236969 132.98413086 136.09912109 C130.84104537 137.14879562 128.88371914 138.33831077 126.87866211 139.63037109 C120.86494175 143.45195557 114.89835129 146.30739128 108.05444336 148.32177734 C105.75653567 149.08521202 105.75653567 149.08521202 103.48413086 150.68896484 C99.6547875 152.80744715 96.11511609 152.59252046 91.81616211 152.72412109 C88.49735549 153.18310499 86.67197207 154.34097952 83.87866211 156.13037109 C81.55048247 156.4979784 79.21682361 156.8327869 76.87866211 157.13037109 C76.29729492 157.45650391 75.71592773 157.78263672 75.11694336 158.11865234 C71.97155992 159.54038762 69.06125233 159.56467164 65.62866211 159.75537109 C63.73374023 159.86751953 63.73374023 159.86751953 61.80053711 159.98193359 C60.83631836 160.03091797 59.87209961 160.07990234 58.87866211 160.13037109 C58.87866211 160.79037109 58.87866211 161.45037109 58.87866211 162.13037109 C38.04666966 165.3339822 17.51986203 166.51555882 -3.55883789 166.44287109 C-4.68930542 166.44005127 -5.81977295 166.43723145 -6.98449707 166.43432617 C-10.25812346 166.42172844 -13.53141992 166.39851246 -16.80493164 166.36865234 C-17.76948776 166.36110428 -18.73404388 166.35355621 -19.72782898 166.34577942 C-26.55921004 166.25251559 -33.32052918 165.77276211 -40.12133789 165.13037109 C-40.12133789 164.47037109 -40.12133789 163.81037109 -40.12133789 163.13037109 C-40.67595703 163.11055176 -41.23057617 163.09073242 -41.80200195 163.0703125 C-44.32557482 162.97479458 -46.84835013 162.86522542 -49.37133789 162.75537109 C-50.2440332 162.72443359 -51.11672852 162.69349609 -52.01586914 162.66162109 C-53.28237305 162.60361328 -53.28237305 162.60361328 -54.57446289 162.54443359 C-55.34951172 162.5130127 -56.12456055 162.4815918 -56.9230957 162.44921875 C-59.34275725 162.09825496 -60.95743724 161.23507651 -63.12133789 160.13037109 C-65.80916391 159.88398704 -68.42949737 159.71327198 -71.12133789 159.63037109 C-79.20773267 159.38133357 -79.20773267 159.38133357 -83.12133789 157.13037109 C-85.46913206 156.56216545 -87.8199905 156.12832675 -90.19555664 155.69287109 C-90.83106445 155.50724609 -91.46657227 155.32162109 -92.12133789 155.13037109 C-92.45133789 154.47037109 -92.78133789 153.81037109 -93.12133789 153.13037109 C-95.93114462 152.43810077 -95.93114462 152.43810077 -99.18383789 152.00537109 C-100.84092773 151.75400391 -100.84092773 151.75400391 -102.53149414 151.49755859 C-103.38614258 151.37638672 -104.24079102 151.25521484 -105.12133789 151.13037109 C-105.12133789 150.47037109 -105.12133789 149.81037109 -105.12133789 149.13037109 C-108.09985352 148.83740234 -108.09985352 148.83740234 -111.07836914 148.54443359 C-113.12133789 148.13037109 -113.12133789 148.13037109 -116.12133789 146.13037109 C-116.96696289 145.86224609 -117.81258789 145.59412109 -118.68383789 145.31787109 C-122.55675565 143.97995405 -126.04357794 142.21638815 -129.67993164 140.34130859 C-132.25417228 139.01302586 -132.25417228 139.01302586 -135.62133789 137.81787109 C-139.91667902 135.74690305 -143.18654093 132.97036974 -146.78930664 129.87255859 C-149.01318124 128.21117154 -150.41406516 127.54112971 -153.12133789 127.13037109 C-153.12133789 126.47037109 -153.12133789 125.81037109 -153.12133789 125.13037109 C-154.44133789 124.47037109 -155.76133789 123.81037109 -157.12133789 123.13037109 C-157.12133789 122.47037109 -157.12133789 121.81037109 -157.12133789 121.13037109 C-158.23508789 120.75912109 -158.23508789 120.75912109 -159.37133789 120.38037109 C-162.3522261 119.02542191 -163.86385768 117.46067324 -166.12133789 115.13037109 C-166.80196289 114.84162109 -167.48258789 114.55287109 -168.18383789 114.25537109 C-171.12147452 112.5496466 -171.72624558 110.19957417 -173.12133789 107.13037109 C-173.94621088 105.66723573 -174.78017476 104.20920229 -175.62133789 102.75537109 C-181.24269717 92.48068118 -183.45317859 82.11759557 -180.10180664 70.63818359 C-178.89756155 67.72034503 -177.57297175 64.93184742 -176.12133789 62.13037109 C-175.68821289 61.07849609 -175.25508789 60.02662109 -174.80883789 58.94287109 C-172.61049069 55.2789591 -169.86076504 52.3075188 -166.96118164 49.18115234 C-164.97475834 47.06513946 -164.97475834 47.06513946 -163.12133789 44.13037109 C-161.42993164 43.03271484 -161.42993164 43.03271484 -159.55883789 42.06787109 C-156.09079041 40.53560488 -156.09079041 40.53560488 -155.12133789 38.13037109 C-153.78800456 37.46370443 -152.45467122 36.79703776 -151.12133789 36.13037109 C-150.79133789 35.47037109 -150.46133789 34.81037109 -150.12133789 34.13037109 C-149.13133789 34.13037109 -148.14133789 34.13037109 -147.12133789 34.13037109 C-147.01821289 33.49099609 -146.91508789 32.85162109 -146.80883789 32.19287109 C-146.58196289 31.51224609 -146.35508789 30.83162109 -146.12133789 30.13037109 C-145.13133789 29.80037109 -144.14133789 29.47037109 -143.12133789 29.13037109 C-142.79133789 28.47037109 -142.46133789 27.81037109 -142.12133789 27.13037109 C-140.12133789 26.79703776 -138.12133789 26.46370443 -136.12133789 26.13037109 C-135.79133789 25.47037109 -135.46133789 24.81037109 -135.12133789 24.13037109 C-133.13150976 23.43393125 -131.12839032 22.77549509 -129.12133789 22.13037109 C-127.67627384 21.52306463 -126.23915674 20.89663488 -124.80883789 20.25537109 C-124.03411133 19.91119141 -123.25938477 19.56701172 -122.46118164 19.21240234 C-120.95694853 18.5167887 -119.46768475 17.78729348 -118.00024414 17.01708984 C-112.29385653 14.13771995 -107.21435469 13.59752716 -100.84399414 13.40380859 C-97.97477513 13.40574695 -97.97477513 13.40574695 -96.12133789 11.13037109 C-94.05493164 10.56787109 -94.05493164 10.56787109 -91.55883789 10.13037109 C-88.18225249 9.51335477 -84.8380165 8.85243912 -81.49633789 8.06787109 C-78.54142945 7.39486704 -75.63239617 6.91076741 -72.62133789 6.56787109 C-69.30314471 6.51682478 -69.30314471 6.51682478 -68.12133789 5.13037109 C-66.27133829 4.90214509 -64.41368275 4.73532171 -62.55493164 4.59521484 C-61.43022461 4.50820312 -60.30551758 4.42119141 -59.14672852 4.33154297 C-57.96272461 4.24453125 -56.7787207 4.15751953 -55.55883789 4.06787109 C-53.77703125 3.93155273 -53.77703125 3.93155273 -51.95922852 3.79248047 C-49.01354884 3.56770973 -46.06761115 3.34719913 -43.12133789 3.13037109 C-43.12133789 2.47037109 -43.12133789 1.81037109 -43.12133789 1.13037109 C-28.74072205 0.23457963 -14.40706952 -0.02676937 0 0 Z " fill="#6395FB" transform="translate(590.121337890625,204.86962890625)"/>
+<path d="M0 0 C2.4375 1 2.4375 1 4 2 C4 2.66 4 3.32 4 4 C4.99 4 5.98 4 7 4 C7 4.66 7 5.32 7 6 C8.918125 6.185625 8.918125 6.185625 10.875 6.375 C14.75 6.75 14.75 6.75 17 9 C18.66235013 9.67735829 20.32969103 10.34251224 22 11 C23.74896886 11.96494834 25.4785458 12.9658371 27.1875 14 C28.04730469 14.515625 28.90710938 15.03125 29.79296875 15.5625 C32 17 32 17 34 19 C35.99541868 19.68025637 37.99617991 20.34490497 40 21 C44.29940428 22.97056029 48.0718048 25.3812032 52 28 C54.74363883 29.42669219 57.50302128 30.77165843 60.3125 32.0625 C62 33 62 33 63 35 C64.99541868 35.68025637 66.99617991 36.34490497 69 37 C70.69207001 37.9563874 72.36816893 38.94410931 74 40 C73.64930333 42.59515537 73.33376494 44.52570246 71.8125 46.6875 C70 48 70 48 67.26171875 48.8671875 C63.85532859 50.05024516 61.0806086 51.57228776 58 53.4375 C54.98262011 55.25657147 52.00380343 56.99811007 48.84765625 58.56640625 C46.50446776 59.74603612 44.52306473 60.93205736 42.4375 62.5 C39.72395196 64.53028055 36.91642657 66.27305255 34 68 C33.20980469 68.495 32.41960937 68.99 31.60546875 69.5 C27.73947122 71.89829249 24.07534681 74.10964838 19.75 75.5625 C16.94284342 76.50949258 15.08760342 77.59064618 12.875 79.5625 C9.82871686 82.14521832 7.73714865 82.75428378 4 84 C1.73533305 85.39826028 -0.44180935 86.90116927 -2.63671875 88.40625 C-8.60438059 92.43072278 -13.72491842 95.53563309 -21 96 C-21.495 97.485 -21.495 97.485 -22 99 C-23.485 99.495 -23.485 99.495 -25 100 C-25.66 100.99 -26.32 101.98 -27 103 C-28.99774401 103.67339686 -30.99806487 104.33916705 -33 105 C-34.87966101 106.2671872 -36.71392957 107.60399093 -38.5 109 C-42.28537714 111.95868558 -45.43011277 113.56846906 -50 115 C-52.21777933 116.2446001 -52.21777933 116.2446001 -54.1875 117.625 C-57.66763006 120 -57.66763006 120 -61 120 C-61.061875 120.61875 -61.12375 121.2375 -61.1875 121.875 C-62 124 -62 124 -64.125 125.125 C-66.16118592 125.74470876 -68.21299689 126.3141054 -70.2734375 126.84765625 C-78.95698484 129.53282026 -86.76838193 134.57628645 -94 140 C-98.01910363 142.77509537 -98.79755012 143 -104 143 C-104 114.29 -104 85.58 -104 56 C-102.68 55.34 -101.36 54.68 -100 54 C-99.67 53.34 -99.34 52.68 -99 52 C-97.67413083 51.30217412 -96.34168934 50.61544434 -94.98828125 49.97265625 C-92.55483603 48.78222823 -90.18826534 47.48924267 -87.8125 46.1875 C-86.87148438 45.67316406 -85.93046875 45.15882813 -84.9609375 44.62890625 C-82.94178537 43.5181062 -80.92629594 42.4006285 -78.9140625 41.27734375 C-77.93179688 40.73207031 -76.94953125 40.18679688 -75.9375 39.625 C-75.03902344 39.12226562 -74.14054688 38.61953125 -73.21484375 38.1015625 C-71 37 -71 37 -69 37 C-69 36.34 -69 35.68 -69 35 C-68.13375 34.5875 -67.2675 34.175 -66.375 33.75 C-62.99373054 32.07485356 -62.99373054 32.07485356 -60 30 C-57.07292508 28.04861672 -54.15611713 26.54711624 -51 25 C-46.64309154 22.63801299 -42.33537669 20.19781505 -38.0625 17.6875 C-35 16 -35 16 -33 16 C-33 15.34 -33 14.68 -33 14 C-30.08703567 12.47416154 -27.35331151 11.10206777 -24.1875 10.1875 C-18.70594094 8.14535055 -14.11273747 4.50909819 -9.375 1.125 C-6.09774552 -0.4273837 -3.58171371 -0.32561034 0 0 Z " fill="#6597FD" transform="translate(963,804)"/>
+<path d="M0 0 C0.495 1.485 0.495 1.485 1 3 C3.26225382 4.07254351 3.26225382 4.07254351 6 5 C10.66647344 7.08502005 14.11742109 9.69567752 18 13 C18.94875 13.556875 19.8975 14.11375 20.875 14.6875 C21.57625 15.120625 22.2775 15.55375 23 16 C23 16.66 23 17.32 23 18 C23.78375 17.95875 24.5675 17.9175 25.375 17.875 C28 18 28 18 30 20 C31.99541868 20.68025637 33.99617991 21.34490497 36 22 C39.62548569 23.66772342 42.99738035 25.34383646 46 28 C46 28.66 46 29.32 46 30 C46.969375 30.309375 47.93875 30.61875 48.9375 30.9375 C52 32 52 32 53 33 C54.010625 33.061875 55.02125 33.12375 56.0625 33.1875 C61.0583501 33.81326356 64.19984157 36.93095027 68 40 C70.47012923 41.60845625 72.69102308 42.88116272 75.4375 43.9375 C78.59202214 45.2454726 81.17026051 47.09425708 84 49 C85.093125 49.515625 86.18625 50.03125 87.3125 50.5625 C90 52 90 52 91 55 C91.99 55 92.98 55 94 55 C94 84.37 94 113.74 94 144 C90.37673261 145.2077558 89.35853631 144.54311128 86 143 C86 142.34 86 141.68 86 141 C83.03 140.01 83.03 140.01 80 139 C80 138.34 80 137.68 80 137 C78.700625 136.8453125 78.700625 136.8453125 77.375 136.6875 C71.74283535 135.5402072 68.1067298 133.13521581 63.83203125 129.390625 C60.65824213 126.98152281 57.10335864 125.25535515 53.5859375 123.40234375 C51 122 51 122 48.125 120 C44.01456215 117.36931978 39.66589363 115.46076417 35.21875 113.46484375 C32.1056998 112.04810367 29.05357922 110.53987638 26 109 C25.2575 108.67 24.515 108.34 23.75 108 C22 107 22 107 20 104 C16.94570927 102.78715124 16.94570927 102.78715124 14 102 C14 101.34 14 100.68 14 100 C13.195625 99.5978125 13.195625 99.5978125 12.375 99.1875 C11.59125 98.795625 10.8075 98.40375 10 98 C9.113125 97.5875 8.22625 97.175 7.3125 96.75 C3.77264237 94.87988654 0.55048189 92.73839977 -2.75 90.48046875 C-4.76955613 89.15162887 -6.80104962 88.00108739 -8.9375 86.875 C-11.90209526 85.05994168 -12.95679308 84.24553264 -14 81 C-14.71671875 81.05414062 -15.4334375 81.10828125 -16.171875 81.1640625 C-19.52760368 80.96939316 -21.34045541 80.03395086 -24.25 78.375 C-25.20648437 77.83101562 -26.16296875 77.28703125 -27.1484375 76.7265625 C-30.49551608 74.6999752 -33.73544607 72.55592027 -36.9296875 70.296875 C-39.2124539 68.86691567 -41.47707083 67.93396897 -44 67 C-49.62792903 64.86138697 -54.32845755 61.91712375 -59.3671875 58.62890625 C-62.45177756 56.72048777 -65.6665871 55.41978697 -69 54 C-72.07898045 52.11050601 -75.05453814 50.09067903 -78 48 C-78.74894531 47.525625 -79.49789062 47.05125 -80.26953125 46.5625 C-80.84058594 46.046875 -81.41164063 45.53125 -82 45 C-82 43.68 -82 42.36 -82 41 C-79.525 40.505 -79.525 40.505 -77 40 C-76.67 39.01 -76.34 38.02 -76 37 C-73.70703125 35.53515625 -73.70703125 35.53515625 -70.8125 34.0625 C-67.62848772 32.40681362 -64.70642916 30.79675865 -61.75 28.75 C-58.56719353 26.7245777 -55.63834236 25.95745852 -52 25 C-43.85306978 21.83174936 -36.72994208 17.68236605 -29.83984375 12.34765625 C-27.3728554 10.54062656 -24.77699001 9.26775631 -22 8 C-17.94218927 6.06064529 -17.94218927 6.06064529 -14.125 3.69921875 C-9.12262435 0.23077469 -6.08548319 -0.54334671 0 0 Z " fill="#6597FD" transform="translate(756,804)"/>
+<path d="M0 0 C2.25 0.75 2.25 0.75 3.25 1.75 C3.37290595 3.26577226 3.42723834 4.78715732 3.45433044 6.30766296 C3.48394143 7.79135533 3.48394143 7.79135533 3.51415062 9.30502129 C3.53066988 10.40278955 3.54718914 11.50055782 3.56420898 12.6315918 C3.59519652 14.36149447 3.59519652 14.36149447 3.62681007 16.12634468 C3.68193455 19.32857577 3.73195202 22.53083141 3.77869725 25.73319459 C3.80870243 27.76909257 3.84036872 29.80495906 3.8724041 31.84082603 C4.37433622 64.0951683 4.36999201 96.34895482 4.32202756 128.6063565 C4.31049221 136.50833233 4.30526454 144.41030948 4.30032361 152.31229174 C4.29009895 168.45820432 4.2727229 184.60409984 4.25 200.75 C-1.35053891 199.38228944 -5.45979769 197.40773251 -10.00390625 193.87109375 C-11.72488768 192.63275435 -11.72488768 192.63275435 -13.90234375 192.22265625 C-14.81693359 191.98869141 -14.81693359 191.98869141 -15.75 191.75 C-16.08 191.09 -16.41 190.43 -16.75 189.75 C-18.38978318 188.70650161 -20.06464976 187.71817992 -21.75 186.75 C-23.08469032 185.89795527 -24.41793698 185.04364636 -25.75 184.1875 C-28.67986051 182.3494789 -31.4969177 180.948504 -34.75 179.75 C-37.788808 178.26292375 -40.79895647 176.72502221 -43.8125 175.1875 C-46.69019213 173.72237218 -46.69019213 173.72237218 -49.5625 172.6875 C-51.75 171.75 -51.75 171.75 -52.75 169.75 C-53.389375 169.440625 -54.02875 169.13125 -54.6875 168.8125 C-56.75 167.75 -56.75 167.75 -58.75 164.75 C-59.636875 164.481875 -60.52375 164.21375 -61.4375 163.9375 C-65.85216604 162.35488387 -68.96589344 160.60096557 -71.75 156.75 C-72.7904019 152.50428704 -72.70387475 148.34624767 -72.65234375 143.9921875 C-72.66468048 142.71940948 -72.67701721 141.44663147 -72.68972778 140.13528442 C-72.72241887 136.68050723 -72.71251288 133.22705154 -72.69441605 129.7722168 C-72.68285428 126.18264757 -72.71062572 122.5933861 -72.73413086 119.00390625 C-72.77134595 112.40378248 -72.77385459 105.80418806 -72.76006603 99.20399094 C-72.74530798 91.78433426 -72.76720337 84.3649517 -72.7890625 76.9453125 C-72.81805583 64.87999361 -72.80095114 52.81523084 -72.75 40.75 C-71.945625 40.46125 -71.14125 40.1725 -70.3125 39.875 C-67.6173532 39.01737432 -67.6173532 39.01737432 -66.75 36.75 C-64.1875 36.125 -64.1875 36.125 -61.75 35.75 C-61.75 34.76 -61.75 33.77 -61.75 32.75 C-60.945625 32.46125 -60.14125 32.1725 -59.3125 31.875 C-56.6173532 31.01737432 -56.6173532 31.01737432 -55.75 28.75 C-54.08927151 28.06867549 -52.422233 27.40257873 -50.75 26.75 C-50.09 26.09 -49.43 25.43 -48.75 24.75 C-47.7290625 24.5025 -47.7290625 24.5025 -46.6875 24.25 C-46.048125 24.085 -45.40875 23.92 -44.75 23.75 C-44.42 23.09 -44.09 22.43 -43.75 21.75 C-38.76707962 18.85770552 -33.51780895 15.99653 -27.875 14.6875 C-24.89835357 13.79450607 -23.8137984 13.15389463 -21.5625 11.1875 C-18.95061332 8.92386487 -17.97105035 8.34649081 -14.75 7.75 C-14.42 7.09 -14.09 6.43 -13.75 5.75 C-11.76833966 4.7141321 -9.76526169 3.71887581 -7.75 2.75 C-6.904375 2.1725 -6.05875 1.595 -5.1875 1 C-2.75 -0.25 -2.75 -0.25 0 0 Z " fill="#6496FD" transform="translate(1034.75,636.25)"/>
+<path d="M0 0 C4.12612221 0.47155682 7.43755592 1.89491941 11 4 C11.33 4.99 11.66 5.98 12 7 C16.81045736 10.96398203 22.20685565 13.78134897 28 16 C28 16.66 28 17.32 28 18 C28.99 18.33 29.98 18.66 31 19 C31 19.66 31 20.32 31 21 C32.98 21.33 34.96 21.66 37 22 C37 22.66 37 23.32 37 24 C38.0725 24.020625 39.145 24.04125 40.25 24.0625 C46.6435513 24.86169391 51.64180043 28.65690631 57 32 C59.1418147 33.2568733 61.2875467 34.50709957 63.4375 35.75 C65.29324636 36.83062509 67.14751987 37.91378524 69 39 C69.91910156 39.52078125 70.83820313 40.0415625 71.78515625 40.578125 C74 42 74 42 75 44 C75.11528424 45.51001166 75.16998623 47.02485124 75.1942749 48.5390625 C75.21154633 49.49498795 75.22881775 50.45091339 75.24661255 51.43580627 C75.26029877 52.4882402 75.27398499 53.54067413 75.28808594 54.625 C75.30590118 55.73088974 75.32371643 56.83677948 75.34207153 57.97618103 C75.49666486 68.19299702 75.58550254 78.4108152 75.65206528 88.6285553 C75.70222241 96.1750629 75.78800087 103.71938542 75.92068648 111.26490211 C76.02183937 117.21919708 76.06228123 123.17302908 76.0825882 129.12817383 C76.10035254 131.65442404 76.13715478 134.18061672 76.19359589 136.70629883 C76.6592598 158.57839462 76.6592598 158.57839462 71.27985001 164.33900452 C67.82507292 167.36190877 65.25608732 168.92130219 60.637146 169.21069336 C59.76688782 169.14116455 58.89662964 169.07163574 58 169 C57.67 169.99 57.34 170.98 57 172 C55.0201901 173.0394002 53.01418 174.0288775 51 175 C49.63391677 175.8988113 48.28074246 176.81739888 46.9375 177.75 C40.13280778 182.36705851 32.81962663 186.61635917 25.125 189.5625 C21.75526226 191.11257936 19.61904893 192.96905995 16.90625 195.44140625 C14.10399254 197.73259627 11.01763169 199.34500306 7.8203125 201.01953125 C6.03615104 201.86810718 6.03615104 201.86810718 5 203 C3.00041636 203.04080783 0.99954746 203.04254356 -1 203 C-1.02332572 176.67974346 -1.04097756 150.35948846 -1.05181217 124.03922367 C-1.05697583 111.81919574 -1.06401984 99.59917421 -1.07543945 87.37915039 C-1.08538417 76.7323487 -1.09185292 66.08555165 -1.09408849 55.43874544 C-1.09539596 49.79759328 -1.09848409 44.15645439 -1.10573006 38.51530647 C-1.11248693 33.21226576 -1.11461764 27.90924387 -1.11310768 22.60619926 C-1.11338416 20.65381137 -1.11539124 18.70142288 -1.11920547 16.7490387 C-1.12413754 14.09565409 -1.1230001 11.44234176 -1.12025452 8.78895569 C-1.12316736 8.00589697 -1.1260802 7.22283826 -1.12908131 6.41605049 C-1.11412121 1.11412121 -1.11412121 1.11412121 0 0 Z " fill="#6496FD" transform="translate(671,635)"/>
+<path d="M0 0 C0.80340674 6.37710695 1.16196752 12.60638548 1.19287109 19.03027344 C1.20513733 20.46860283 1.20513733 20.46860283 1.21765137 21.93598938 C1.2422642 25.07711183 1.25894866 28.21819024 1.2734375 31.359375 C1.27876118 32.43710426 1.28408485 33.51483353 1.28956985 34.62522125 C1.31618172 40.31736029 1.33560429 46.00947818 1.35009766 51.70166016 C1.36349019 56.40791019 1.39145747 61.11373211 1.43212891 65.81982422 C1.4813459 71.51662589 1.50620284 77.21303661 1.51332474 82.91004181 C1.52004432 85.07741834 1.53528463 87.24478588 1.55921555 89.41204071 C1.59074995 92.4375968 1.59092276 95.46162819 1.58349609 98.48730469 C1.59990143 99.38091202 1.61630676 100.27451935 1.63320923 101.19520569 C1.58863792 105.6256527 1.5071996 107.38856706 -1.41146851 110.90704346 C-2.2656839 111.59771912 -3.11989929 112.28839478 -4 113 C-4.66 113.99 -5.32 114.98 -6 116 C-9.125 116.6875 -9.125 116.6875 -12 117 C-12 117.66 -12 118.32 -12 119 C-12.50789062 119.24234375 -13.01578125 119.4846875 -13.5390625 119.734375 C-16.95096694 121.39560188 -20.20717891 123.05984911 -23.3125 125.25 C-26 127 -26 127 -29 127 C-29.33 127.99 -29.66 128.98 -30 130 C-34.15315733 132.47211746 -38.36067815 133.73473041 -43 135 C-47.46848705 136.38310314 -49.83772156 138.57419836 -53 142 C-54 143 -54 143 -57.0625 143.0625 C-58.031875 143.041875 -59.00125 143.02125 -60 143 C-60.33 143.99 -60.66 144.98 -61 146 C-62.98 146.33 -64.96 146.66 -67 147 C-67.33 147.99 -67.66 148.98 -68 150 C-69.32796291 150.35412344 -70.66216607 150.68521554 -72 151 C-72.515625 151.515625 -73.03125 152.03125 -73.5625 152.5625 C-74.036875 153.036875 -74.51125 153.51125 -75 154 C-75.99 154 -76.98 154 -78 154 C-78.33 154.99 -78.66 155.98 -79 157 C-81.46875 158.5703125 -81.46875 158.5703125 -84.5 160.125 C-87.97105852 161.7444356 -87.97105852 161.7444356 -91 164 C-92.99958364 164.04080783 -95.00045254 164.04254356 -97 164 C-97.00955481 149.8570608 -96.98456697 135.71454488 -96.9197216 121.57174301 C-96.89062374 115.0049261 -96.87264416 108.4384674 -96.87988281 101.87158203 C-96.88646002 95.53655208 -96.86408151 89.20223098 -96.82144547 82.86734772 C-96.81028571 80.44801608 -96.80963973 78.02861279 -96.81957626 75.60927582 C-96.83169541 72.22537995 -96.8067624 68.8436655 -96.77294922 65.45996094 C-96.78517014 64.45511154 -96.79739105 63.45026215 -96.8099823 62.41496277 C-96.76284063 59.80456213 -96.67162461 57.52297871 -96 55 C-93.09329224 52.41876221 -93.09329224 52.41876221 -90 51 C-89.25234375 50.61714844 -88.5046875 50.23429688 -87.734375 49.83984375 C-86.40184406 49.2339094 -85.06849693 48.62976703 -83.734375 48.02734375 C-81.66933413 46.97328527 -81.66933413 46.97328527 -80 44 C-78.01922047 42.96244882 -76.01470098 41.97004121 -74 41 C-72.67776495 40.20344055 -71.36563923 39.38993015 -70.0625 38.5625 C-65.22528043 35.50015377 -60.4433716 32.54134281 -55.125 30.375 C-51.91335609 29.3588559 -51.91335609 29.3588559 -51 27 C-49.38375534 26.11063786 -47.73169109 25.28550169 -46.0625 24.5 C-42.2248649 22.69388758 -42.2248649 22.69388758 -39 20 C-35.71297314 18.78522921 -32.41392117 17.78782796 -29 17 C-29 16.34 -29 15.68 -29 15 C-28.10796875 14.52949219 -27.2159375 14.05898438 -26.296875 13.57421875 C-25.11448908 12.94548973 -23.93220265 12.31657357 -22.75 11.6875 C-21.00976562 10.76517578 -21.00976562 10.76517578 -19.234375 9.82421875 C-16.07683007 8.13695015 -16.07683007 8.13695015 -13.703125 6.26953125 C-12 5 -12 5 -10 5 C-9.67 4.01 -9.34 3.02 -9 2 C-5.99208089 -0.04108797 -3.57804656 -0.19878036 0 0 Z " fill="#6597FD" transform="translate(955,684)"/>
+<path d="M0 0 C0 26.73 0 53.46 0 81 C-8 84 -8 84 -10 84 C-10.33 84.99 -10.66 85.98 -11 87 C-12.32 87 -13.64 87 -15 87 C-15.33 87.99 -15.66 88.98 -16 90 C-18.475 90.495 -18.475 90.495 -21 91 C-21 91.99 -21 92.98 -21 94 C-21.886875 94.433125 -22.77375 94.86625 -23.6875 95.3125 C-26.9510585 96.92003881 -26.9510585 96.92003881 -29.75 98.6875 C-32 100 -32 100 -34 100 C-34 100.66 -34 101.32 -34 102 C-34.85271484 102.45439453 -34.85271484 102.45439453 -35.72265625 102.91796875 C-39.55402343 104.99675728 -43.24540985 107.08806889 -46.75 109.6875 C-49.5750874 111.69765834 -51.81659466 112.77561333 -55 114 C-56.4540625 114.99 -56.4540625 114.99 -57.9375 116 C-60.94232612 117.96233543 -63.6054676 118.91992151 -67 120 C-67.66 120.66 -68.32 121.32 -69 122 C-69.99 122 -70.98 122 -72 122 C-72.495 123.485 -72.495 123.485 -73 125 C-75.328125 126.17578125 -75.328125 126.17578125 -78.25 127.3125 C-81.90947408 128.86600577 -84.45856556 130.01042686 -86.8125 133.25 C-89 136 -89 136 -92.3125 136.875 C-93.199375 136.91625 -94.08625 136.9575 -95 137 C-95 137.66 -95 138.32 -95 139 C-98.73396158 138.5607104 -101.08778768 137.40651604 -104.12890625 135.2421875 C-107.38828954 133.07833805 -110.86901458 131.30834256 -114.31640625 129.46484375 C-115.20199219 128.98144531 -116.08757813 128.49804688 -117 128 C-117.93714844 127.50628906 -118.87429688 127.01257813 -119.83984375 126.50390625 C-120.55269531 126.00761719 -121.26554688 125.51132812 -122 125 C-122 124.01 -122 123.02 -122 122 C-123.98 122 -125.96 122 -128 122 C-128 121.01 -128 120.02 -128 119 C-129.65 119 -131.3 119 -133 119 C-133.3403125 118.0409375 -133.3403125 118.0409375 -133.6875 117.0625 C-134.120625 116.381875 -134.55375 115.70125 -135 115 C-135.7425 114.855625 -136.485 114.71125 -137.25 114.5625 C-141.08473623 113.77812213 -143.05601719 111.51465198 -146 109 C-149.06865333 107.42633162 -151.21934487 106.97769374 -154.6875 106.625 C-158 106 -158 106 -159.4375 103.9375 C-159.7159375 102.9784375 -159.7159375 102.9784375 -160 102 C-160.99 102 -161.98 102 -163 102 C-163.495 99.03 -163.495 99.03 -164 96 C-163.43152344 95.78085937 -162.86304688 95.56171875 -162.27734375 95.3359375 C-157.28742132 93.28665383 -153.58760791 91.02828204 -149.625 87.38671875 C-147.30785022 85.40934334 -144.77020703 84.23120312 -142 83 C-138.83795653 81.69495823 -138.83795653 81.69495823 -137 79 C-135.01030767 77.97964496 -133.00699249 76.98589105 -131 76 C-127.63888501 74.04561365 -124.32125575 72.02117624 -121 70 C-111.1037037 64 -111.1037037 64 -108 64 C-108 63.34 -108 62.68 -108 62 C-107.13375 61.5875 -106.2675 61.175 -105.375 60.75 C-102.01247844 59.08812091 -102.01247844 59.08812091 -99.125 57.0625 C-96.12131131 55.08006546 -93.12251153 53.50965251 -89.890625 51.94921875 C-87.80597794 50.93855897 -87.80597794 50.93855897 -85.1875 49.25 C-83 48 -83 48 -80 48 C-79.8246875 47.41734375 -79.649375 46.8346875 -79.46875 46.234375 C-77.27586102 42.89838432 -74.04345066 41.79322244 -70.5 40.25 C-69.81035156 39.93417969 -69.12070312 39.61835937 -68.41015625 39.29296875 C-63.3179789 37 -63.3179789 37 -61 37 C-60.938125 36.401875 -60.87625 35.80375 -60.8125 35.1875 C-59.65138972 32.06143387 -57.93376981 31.4668849 -55 30 C-52.2688227 28.80948682 -49.6163082 27.88931967 -46.75 27.0625 C-45.8425 26.711875 -44.935 26.36125 -44 26 C-43.505 24.515 -43.505 24.515 -43 23 C-40.9609375 22.04296875 -40.9609375 22.04296875 -38.375 21.1875 C-33.86449139 19.52912988 -30.86772667 17.54192033 -27.47265625 14.171875 C-26 13 -26 13 -23 13 C-23 12.34 -23 11.68 -23 11 C-22.030625 10.54625 -21.06125 10.0925 -20.0625 9.625 C-16.92920418 8.34213779 -16.92920418 8.34213779 -16 6 C-14.6696875 5.566875 -14.6696875 5.566875 -13.3125 5.125 C-9.88575688 4.12531102 -9.88575688 4.12531102 -6.875 1.875 C-4 0 -4 0 0 0 Z " fill="#6597FD" transform="translate(849,533)"/>
+<path d="M0 0 C3.49664204 0.77621018 5.93802769 2.13294371 9 4 C10.65369357 4.69822617 12.31727014 5.37498605 14 6 C14 6.66 14 7.32 14 8 C14.8971875 8.1546875 14.8971875 8.1546875 15.8125 8.3125 C18.32225354 9.10127968 19.17017086 10.17017086 21 12 C23.10332891 12.71447643 23.10332891 12.71447643 25 13 C25 13.66 25 14.32 25 15 C25.969375 15.12375 26.93875 15.2475 27.9375 15.375 C28.948125 15.58125 29.95875 15.7875 31 16 C31.33 16.66 31.66 17.32 32 18 C33.7862884 18.73401257 35.60514816 19.39001031 37.4375 20 C42.78473581 21.78473581 42.78473581 21.78473581 45 24 C46.6635479 24.67441131 48.33066942 25.3400321 50 26 C54.8440367 28.53211009 54.8440367 28.53211009 56 32 C58.71370273 33.50761263 61.4651391 34.7687088 64.3125 36 C66 37 66 37 67 40 C69.29283166 41.17248853 69.29283166 41.17248853 72 42.0625 C76.89732528 43.79465056 76.89732528 43.79465056 78 46 C78.804375 46.144375 79.60875 46.28875 80.4375 46.4375 C83 47 83 47 85 50 C87.20127528 51.34312527 87.20127528 51.34312527 89.75 52.5 C90.59046875 52.9021875 91.4309375 53.304375 92.296875 53.71875 C93.18890625 54.1415625 94.0809375 54.564375 95 55 C97.0010805 55.99783608 99.00100553 56.99799146 101 58 C102.134375 58.55558594 103.26875 59.11117187 104.4375 59.68359375 C106.2009375 60.55177734 106.2009375 60.55177734 108 61.4375 C109.7634375 62.30181641 109.7634375 62.30181641 111.5625 63.18359375 C114.88057992 64.93689734 117.91471986 66.86827485 121 69 C121.7734375 69.515625 122.546875 70.03125 123.34375 70.5625 C124.0553125 71.036875 124.766875 71.51125 125.5 72 C126.27214844 72.51175781 127.04429687 73.02351562 127.83984375 73.55078125 C129.60149136 74.7326461 131.33627096 75.95447926 133.0625 77.1875 C135.4403042 78.65465578 137.22630775 79.49426918 139.8125 80.375 C145.48662912 82.36744229 150.13523352 85.89878851 154.94921875 89.4296875 C158.19676892 91.81075465 161.16587588 93.72195863 165 95 C164.875 97.3125 164.875 97.3125 164 100 C161.3125 101.625 161.3125 101.625 158 103 C154.51574552 104.59694997 151.89321111 106.08935397 148.9375 108.5625 C146.1879769 110.84401916 144.2768349 111.77118691 141 113 C140.05125 113.639375 139.1025 114.27875 138.125 114.9375 C135.77360459 116.48942097 133.86341409 117.56704194 131.3125 118.625 C127.94235433 119.89880541 127.94235433 119.89880541 125 122 C124.01 122 123.02 122 122 122 C122 122.66 122 123.32 122 124 C120.35 124.33 118.7 124.66 117 125 C117 125.66 117 126.32 117 127 C116.443125 127.226875 115.88625 127.45375 115.3125 127.6875 C112.35823409 129.36424552 110.33152149 131.54576685 108 134 C105.77077045 136.22922955 103.90864722 136.88128953 101 138 C100.67 138.33 100.34 138.66 100 139 C96.36113938 139.51983723 94.95087332 138.97219245 91.6875 137.125 C90.800625 136.42375 89.91375 135.7225 89 135 C89 134.34 89 133.68 89 133 C87.700625 132.5978125 87.700625 132.5978125 86.375 132.1875 C83.07295105 131.02566796 80.10008256 129.61743438 77 128 C76.2575 127.67 75.515 127.34 74.75 127 C73 126 73 126 71 123 C70.13375 122.484375 69.2675 121.96875 68.375 121.4375 C67.59125 120.963125 66.8075 120.48875 66 120 C66 119.34 66 118.68 66 118 C65.41992188 117.86207031 64.83984375 117.72414063 64.2421875 117.58203125 C54.41616134 115.03137289 47.82262812 110.02759957 40.5625 103.0234375 C37.76466776 100.81417363 35.39154422 100.00729787 32 99 C29.125 97 29.125 97 27 95 C27 94.34 27 93.68 27 93 C26.29101562 93.05800781 25.58203125 93.11601563 24.8515625 93.17578125 C21.37990888 92.9617752 19.39083457 91.89481131 16.375 90.1875 C15.43398438 89.66542969 14.49296875 89.14335938 13.5234375 88.60546875 C11.32399475 87.20613288 9.77429296 85.87373711 8 84 C6.34051852 82.98812105 4.67419438 81.9873454 3 81 C0.05498515 78.05498515 0.64370856 74.87240424 0.5859375 70.91796875 C0.56652603 70.08782761 0.54711456 69.25768646 0.52711487 68.40238953 C0.46630772 65.66419957 0.42026108 62.92598774 0.375 60.1875 C0.33708235 58.30028464 0.29874843 56.41307759 0.26000977 54.52587891 C-0.09107695 36.35143415 -0.10566085 18.1769172 0 0 Z " fill="#6597FD" transform="translate(859,534)"/>
+<path d="M0 0 C0.99 0 1.98 0 3 0 C3.33 0.99 3.66 1.98 4 3 C6.26701447 3.91735661 6.26701447 3.91735661 8.9375 4.5 C13.78044597 5.67066895 13.78044597 5.67066895 16 9 C18.40485798 10.44422226 18.40485798 10.44422226 21.125 11.6875 C22.03507813 12.12449219 22.94515625 12.56148437 23.8828125 13.01171875 C24.58148437 13.33785156 25.28015625 13.66398438 26 14 C26 14.66 26 15.32 26 16 C26.804375 16.2475 27.60875 16.495 28.4375 16.75 C32.02306666 18.00809356 35.42594768 19.48059751 38.87890625 21.05859375 C41.12024545 22.08605829 41.12024545 22.08605829 44 23.0625 C44.66 23.371875 45.32 23.68125 46 24 C46.495 25.485 46.495 25.485 47 27 C47.99 27 48.98 27 50 27 C50.495 28.485 50.495 28.485 51 30 C53.04683779 31.32847443 53.04683779 31.32847443 55.5625 32.4375 C56.46613281 32.86804688 57.36976563 33.29859375 58.30078125 33.7421875 C59.19152344 34.15726563 60.08226562 34.57234375 61 35 C64.88278066 36.86319072 68.55651481 38.69843007 72.125 41.125 C74.88547662 43.10680339 74.88547662 43.10680339 77.9375 43.9375 C81.74264674 45.25765295 85.12746085 47.13595949 88 50 C88 50.99 88 51.98 88 53 C90.31 53.66 92.62 54.32 95 55 C95 90.64 95 126.28 95 163 C90.07140968 161.76785242 86.25774712 159.85633846 82.0625 157 C79.42618145 155.27832258 76.91275974 154.0369894 74.0078125 152.8515625 C71.50644385 151.79067074 69.06756117 150.6274657 66.625 149.4375 C65.34496094 148.81681641 65.34496094 148.81681641 64.0390625 148.18359375 C62 147 62 147 61 145 C59.9275 144.896875 58.855 144.79375 57.75 144.6875 C53.15697658 143.84544571 52.09172861 142.40090147 49 139 C45.19437785 135.907932 41.5653961 133.78161799 37 132 C34.98973725 130.78315384 33.02249063 129.51487284 31.0625 128.21875 C28.7791826 126.86951699 26.46345776 125.97949143 24 125 C22.04906292 123.98372238 20.11153494 122.94133262 18.1875 121.875 C17.21167969 121.33617187 16.23585938 120.79734375 15.23046875 120.2421875 C14.49441406 119.83226562 13.75835938 119.42234375 13 119 C13 118.01 13 117.02 13 116 C12.22914063 115.89042969 11.45828125 115.78085937 10.6640625 115.66796875 C9.15972656 115.43013672 9.15972656 115.43013672 7.625 115.1875 C6.12839844 114.96126953 6.12839844 114.96126953 4.6015625 114.73046875 C2 114 2 114 0 111 C-0.24609566 108.89732838 -0.24609566 108.89732838 -0.24050903 106.42524719 C-0.24325836 105.4871521 -0.24600769 104.54905701 -0.24884033 103.58253479 C-0.24164978 102.55538864 -0.23445923 101.52824249 -0.22705078 100.4699707 C-0.22734283 99.38688629 -0.22763489 98.30380188 -0.22793579 97.18789673 C-0.22654012 93.600444 -0.21096759 90.0131978 -0.1953125 86.42578125 C-0.19158322 83.94142266 -0.18873585 81.45706261 -0.18673706 78.97270203 C-0.17987556 73.097257 -0.16410542 67.22188848 -0.14403808 61.34647483 C-0.11949471 54.0011775 -0.10874925 46.65587584 -0.09765625 39.31054688 C-0.07619438 26.20699345 -0.04243365 13.10350143 0 0 Z " fill="#6597FD" transform="translate(754,684)"/>
+<path d="M0 0 C0.886875 0.23460937 1.77375 0.46921875 2.6875 0.7109375 C3.56148437 0.93910156 4.43546875 1.16726563 5.3359375 1.40234375 C11.68134766 3.4296023 14.84205552 5.56073829 18.859375 10.81640625 C21.62866406 13.68628915 24.80425564 14.64805068 28.55078125 15.82421875 C30.6875 16.7109375 30.6875 16.7109375 32.6875 19.7109375 C35.61617039 21.71476461 38.19085208 23.06341011 41.6875 23.7109375 C41.6875 24.3709375 41.6875 25.0309375 41.6875 25.7109375 C42.23277344 25.86949219 42.77804687 26.02804687 43.33984375 26.19140625 C49.24871247 28.01962033 54.38614172 30.54014874 59.6875 33.7109375 C59.6875 34.3709375 59.6875 35.0309375 59.6875 35.7109375 C60.615625 35.6490625 61.54375 35.5871875 62.5 35.5234375 C66.24463932 35.7437104 66.2421519 36.18147423 68.6875 38.7109375 C70.99532359 40.03894827 73.34998334 41.22986113 75.7265625 42.4296875 C77.6875 43.7109375 77.6875 43.7109375 78.6875 46.7109375 C80.94537891 47.88475874 80.94537891 47.88475874 83.625 48.7734375 C88.49467489 50.51811239 88.49467489 50.51811239 90.6875 52.7109375 C90.6875 53.7009375 90.6875 54.6909375 90.6875 55.7109375 C89.90375 55.9996875 89.12 56.2884375 88.3125 56.5859375 C85.59078368 57.56006004 85.59078368 57.56006004 83.6875 59.7109375 C82.57375 60.1853125 81.46 60.6596875 80.3125 61.1484375 C76.78739201 62.48081663 76.78739201 62.48081663 74.5625 64.3984375 C72.15916038 66.08077524 70.55673803 65.95004067 67.6875 65.7109375 C67.3575 66.7009375 67.0275 67.6909375 66.6875 68.7109375 C64.70429982 69.74385426 62.70402194 70.7446874 60.6875 71.7109375 C60.3575 72.3709375 60.0275 73.0309375 59.6875 73.7109375 C58.6975 73.7109375 57.7075 73.7109375 56.6875 73.7109375 C56.3575 74.7009375 56.0275 75.6909375 55.6875 76.7109375 C53.70590288 77.43046325 51.70143537 78.08763277 49.6875 78.7109375 C47.55422798 79.82349265 45.44917485 80.99174631 43.375 82.2109375 C42.32699219 82.819375 41.27898437 83.4278125 40.19921875 84.0546875 C37.60062548 85.46759509 37.60062548 85.46759509 36.6875 87.7109375 C35.6975 87.7109375 34.7075 87.7109375 33.6875 87.7109375 C33.6875 88.3709375 33.6875 89.0309375 33.6875 89.7109375 C32.65625 90.1234375 31.625 90.5359375 30.5625 90.9609375 C27.93479785 92.07347269 25.9646416 93.20248121 23.5625 94.8359375 C20.78315704 96.64855248 18.94215009 97.32803749 15.6875 97.7109375 C15.1925 99.1959375 15.1925 99.1959375 14.6875 100.7109375 C13.04517228 101.43549385 11.37125165 102.08868145 9.6875 102.7109375 C8.51396187 103.42899279 7.34757393 104.15882705 6.1875 104.8984375 C2.6875 106.7109375 2.6875 106.7109375 -0.25 106.4609375 C-0.930625 106.2134375 -1.61125 105.9659375 -2.3125 105.7109375 C-2.3125 105.0509375 -2.3125 104.3909375 -2.3125 103.7109375 C-4.6225 103.7109375 -6.9325 103.7109375 -9.3125 103.7109375 C-9.6425 102.7209375 -9.9725 101.7309375 -10.3125 100.7109375 C-11.6325 100.7109375 -12.9525 100.7109375 -14.3125 100.7109375 C-14.6425 99.7209375 -14.9725 98.7309375 -15.3125 97.7109375 C-18.75843665 95.24955418 -22.2767154 93.93105843 -26.3125 92.7109375 C-26.3125 92.0509375 -26.3125 91.3909375 -26.3125 90.7109375 C-27.488125 90.80375 -27.488125 90.80375 -28.6875 90.8984375 C-29.55375 90.8365625 -30.42 90.7746875 -31.3125 90.7109375 C-31.9725 89.7209375 -32.6325 88.7309375 -33.3125 87.7109375 C-34.7046875 87.246875 -34.7046875 87.246875 -36.125 86.7734375 C-39.59934739 85.6153217 -41.47768023 83.97879331 -44.3125 81.7109375 C-47.49171787 80.45536863 -47.49171787 80.45536863 -50.3125 79.7109375 C-50.3125 79.0509375 -50.3125 78.3909375 -50.3125 77.7109375 C-50.90417969 77.54078125 -51.49585938 77.370625 -52.10546875 77.1953125 C-57.00089882 75.6939408 -60.43289646 74.15947398 -64.3125 70.7109375 C-65.240625 70.1746875 -66.16875 69.6384375 -67.125 69.0859375 C-67.846875 68.6321875 -68.56875 68.1784375 -69.3125 67.7109375 C-69.3125 67.0509375 -69.3125 66.3909375 -69.3125 65.7109375 C-70.6325 65.3809375 -71.9525 65.0509375 -73.3125 64.7109375 C-73.3125 64.0509375 -73.3125 63.3909375 -73.3125 62.7109375 C-75.9525 62.7109375 -78.5925 62.7109375 -81.3125 62.7109375 C-81.3125 62.0509375 -81.3125 61.3909375 -81.3125 60.7109375 C-82.17875 60.4428125 -83.045 60.1746875 -83.9375 59.8984375 C-87.23041964 58.73981763 -90.22377875 57.32883911 -93.3125 55.7109375 C-93.3125 54.7209375 -93.3125 53.7309375 -93.3125 52.7109375 C-92.6525 52.7109375 -91.9925 52.7109375 -91.3125 52.7109375 C-90.9825 51.7209375 -90.6525 50.7309375 -90.3125 49.7109375 C-87.66015625 48.39453125 -87.66015625 48.39453125 -84.375 47.1484375 C-79.94862705 45.54490062 -79.94862705 45.54490062 -76.3125 42.7109375 C-74.65811387 42.01435387 -72.98995682 41.34996867 -71.3125 40.7109375 C-68.15232742 39.4209661 -68.15232742 39.4209661 -66.3125 36.7109375 C-64.3407696 35.65629101 -62.33487052 34.66488586 -60.3125 33.7109375 C-54.75880565 31.06031065 -49.56337125 27.90639639 -44.3125 24.7109375 C-43.47074219 24.21207031 -42.62898437 23.71320312 -41.76171875 23.19921875 C-39.51319374 21.83289016 -37.35237005 20.39244478 -35.1875 18.8984375 C-29.42355731 15.02684451 -23.35476218 11.58196732 -17.05078125 8.6640625 C-15.13348369 7.82728471 -15.13348369 7.82728471 -14.3125 5.7109375 C-12.70375 5.2778125 -12.70375 5.2778125 -11.0625 4.8359375 C-7.26829955 3.96502622 -7.26829955 3.96502622 -4.6875 1.5234375 C-2.3125 -0.2890625 -2.3125 -0.2890625 0 0 Z " fill="#6597FD" transform="translate(854.3125,623.2890625)"/>
+<path d="M0 0 C0.66 0 1.32 0 2 0 C4.46169275 3.69253913 4.27603296 6.47065336 4.24609566 10.74054241 C4.24840335 11.54091632 4.25071103 12.34129024 4.25308865 13.1659179 C4.25841807 15.87059689 4.24938026 18.57504179 4.24050903 21.27970886 C4.2413805 23.22920437 4.24313039 25.17869965 4.24568737 27.12819368 C4.2501765 32.5029882 4.24213578 37.87770358 4.23213124 43.25248802 C4.22352152 49.04185546 4.22641514 54.83121817 4.22793579 60.62059021 C4.22898622 70.65695955 4.22269318 80.69330294 4.21146011 90.72966576 C4.19522938 105.24068967 4.1899996 119.75170101 4.18748413 134.26273302 C4.18328117 157.80398726 4.16980049 181.34522798 4.15087891 204.88647461 C4.13251585 227.75919523 4.11834578 250.63191216 4.10986328 273.50463867 C4.1094687 274.56183839 4.1094687 274.56183839 4.10906615 275.64039568 C4.10642916 282.71816155 4.10387752 289.79592746 4.10138843 296.87369339 C4.09631575 311.29244883 4.09067324 325.71120402 4.08468628 340.12995911 C4.0844117 340.79293801 4.08413712 341.45591691 4.08385422 342.13898608 C4.06544694 386.42599637 4.03371431 430.71299906 4 475 C2.68 475.66 1.36 476.32 0 477 C0 319.59 0 162.18 0 0 Z " fill="#354A6C" transform="translate(1119,377)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C1.67 1.33 1.34 1.66 1 2 C0.63272554 3.49205247 0.3050154 4.99398648 0 6.5 C-0.88888889 10.88888889 -0.88888889 10.88888889 -2 12 C-2.20931897 14.16296273 -2.36797069 16.3309471 -2.5 18.5 C-2.88888889 24.88888889 -2.88888889 24.88888889 -4 26 C-4.09907031 28.92751587 -4.13174336 31.83146909 -4.12304783 34.75945377 C-4.12420167 35.69427827 -4.12535552 36.62910276 -4.12654433 37.59225526 C-4.12921906 40.7662785 -4.12468183 43.94025234 -4.12025452 47.11427307 C-4.12069004 49.39615085 -4.12156461 51.67802858 -4.12284368 53.95990604 C-4.12509228 60.26272333 -4.12106241 66.5655238 -4.11606562 72.86833894 C-4.11172055 78.95723636 -4.1130248 85.04613386 -4.11374746 91.13503236 C-4.11506351 103.59638231 -4.11171185 116.05772698 -4.10573006 128.51907539 C-4.09981967 140.8632262 -4.09596545 153.20737481 -4.09487724 165.55152702 C-4.0948085 166.31810805 -4.09473976 167.08468908 -4.09466894 167.87449984 C-4.09433062 171.76733572 -4.09402923 175.6601716 -4.09374207 179.55300748 C-4.09163982 207.14951625 -4.08489735 234.74602215 -4.07543945 262.3425293 C-4.06625994 289.15763331 -4.05917392 315.97273653 -4.05493164 342.7878418 C-4.05480011 343.61392319 -4.05466859 344.44000458 -4.05453308 345.29111875 C-4.05321459 353.58671928 -4.05193877 361.88231982 -4.05069422 370.17792036 C-4.04815778 387.07808119 -4.04533653 403.97824196 -4.04234314 420.87840271 C-4.04220585 421.65550079 -4.04206856 422.43259888 -4.04192711 423.23324539 C-4.03272135 475.15549814 -4.01685481 527.07774924 -4 579 C-8.75659001 574.24340999 -7.38225809 566.3218385 -7.55342102 560.00448608 C-7.57437339 559.26774927 -7.59532577 558.53101246 -7.61691306 557.77195029 C-8.21994241 536.04363489 -8.14986615 514.30754352 -8.14538372 492.57276535 C-8.14517663 486.28556354 -8.15072661 479.99836608 -8.15544128 473.71116638 C-8.16367643 461.45147275 -8.16650572 449.19178491 -8.16705366 436.93208887 C-8.16751586 426.97345667 -8.1695878 417.014826 -8.17275429 407.05619431 C-8.17365195 404.17469641 -8.17454177 401.29319851 -8.17542917 398.41170061 C-8.17565021 397.69515493 -8.17587126 396.97860926 -8.17609901 396.24035007 C-8.18223316 376.15083221 -8.18620149 356.06131488 -8.18575573 335.97179604 C-8.18574015 335.21766841 -8.18572457 334.46354079 -8.18570852 333.68656082 C-8.18562543 329.86541791 -8.18552639 326.044275 -8.18542381 322.22313209 C-8.18540387 321.46439251 -8.18538392 320.70565292 -8.18536337 319.92392123 C-8.18532294 318.38958653 -8.18528114 316.85525183 -8.18523798 315.32091713 C-8.18462319 291.36921215 -8.19217746 267.41752126 -8.20581055 243.46582031 C-8.22115767 216.49239017 -8.22977803 189.51896928 -8.22884732 162.54553449 C-8.2287727 159.67346724 -8.22872399 156.80139999 -8.22869301 153.92933273 C-8.22868135 153.22226094 -8.2286697 152.51518915 -8.22865769 151.78669094 C-8.22862691 140.40632704 -8.23501244 129.02597541 -8.24362527 117.64561516 C-8.25208351 106.23477496 -8.25293331 94.82395768 -8.24651595 83.41311432 C-8.24323847 77.23125278 -8.24323868 71.04943587 -8.2518692 64.86757851 C-8.2596786 59.21627319 -8.2583604 53.56504832 -8.24958507 47.91374509 C-8.24803799 45.86355939 -8.24991113 43.81336785 -8.25544515 41.76318903 C-8.26244194 38.98874838 -8.25726191 36.21459502 -8.24888897 33.44016457 C-8.25385715 32.63415353 -8.25882533 31.8281425 -8.26394406 30.99770689 C-8.23905131 27.12826744 -8.04542787 24.31777596 -6 21 C-5.56526661 18.92830754 -5.19345777 16.84272249 -4.875 14.75 C-4.70742188 13.67234375 -4.53984375 12.5946875 -4.3671875 11.484375 C-4.24601563 10.66453125 -4.12484375 9.8446875 -4 9 C-3.01 8.67 -2.02 8.34 -1 8 C-1.020625 6.865625 -1.04125 5.73125 -1.0625 4.5625 C-1 1 -1 1 0 0 Z " fill="#3B547F" transform="translate(595,579)"/>
+<path d="M0 0 C7.22268908 7.22268908 7.22268908 7.22268908 8.875 12.125 C10.01343433 15.50203628 11.28451096 18.50337879 13.04342133 21.58623999 C15.42558842 26.33913508 15.55820683 30.49270369 15.50057125 35.7373476 C15.50608542 36.6928572 15.51159958 37.64836681 15.51728085 38.63283125 C15.53087863 41.83534366 15.51597686 45.03708031 15.50120544 48.23957825 C15.50509817 50.55836109 15.51073837 52.87714154 15.51797634 55.19591635 C15.53275237 61.56841741 15.52253684 67.9406719 15.50823963 74.31316507 C15.49632971 80.47929095 15.50710086 86.64539926 15.51536357 92.81152431 C15.53255244 106.19992368 15.52701716 119.58824116 15.51200638 132.97663884 C15.49895814 144.68986908 15.49375797 156.40307091 15.49632454 168.11630821 C15.49648495 168.89306346 15.49664537 169.66981872 15.49681065 170.47011201 C15.49747422 173.62310521 15.49817663 176.7760984 15.49893599 179.92909157 C15.5059599 209.50507042 15.49046784 239.0809992 15.46431253 268.65696531 C15.44118607 294.9473513 15.43581351 321.2376823 15.44604492 347.52807617 C15.44864683 354.26276809 15.4512318 360.99746 15.45364285 367.73215199 C15.45394029 368.56121253 15.45423774 369.39027307 15.4545442 370.24445667 C15.46215315 392.20150974 15.45575252 414.15855829 15.44494683 436.11560935 C15.443799 438.47711429 15.44265582 440.83861923 15.44152 443.20012417 C15.44076476 444.76673678 15.43999911 446.33334938 15.43922299 447.89996197 C15.43355799 459.61078577 15.43489903 471.32159535 15.43945122 483.0324192 C15.44455076 496.34058646 15.43874248 509.64870039 15.41855692 522.95685432 C15.40851604 529.75207552 15.40322719 536.54721747 15.41144943 543.34244347 C15.41846854 549.55421735 15.41179055 555.76581518 15.3938458 561.97756573 C15.3897768 564.23308176 15.39084178 566.48861365 15.39736467 568.74412391 C15.40543362 571.79358345 15.39530241 574.84243796 15.38031673 577.8918581 C15.38705439 578.78172807 15.39379204 579.67159804 15.40073386 580.58843377 C15.34328641 586.57106011 15.34328641 586.57106011 13.60142512 588.74753366 C12 590 12 590 10 590 C9.7215625 590.8353125 9.7215625 590.8353125 9.4375 591.6875 C7.67102326 594.52922345 5.64744862 595.79115032 2.8515625 597.55859375 C0.79827703 598.9767062 0.79827703 598.9767062 -0.5625 601.625 C-3.87173962 604.84938732 -6.18827666 604.62546497 -10.68359375 604.63476562 C-11.65425781 604.61091797 -12.62492188 604.58707031 -13.625 604.5625 C-15.04619141 604.57893555 -15.04619141 604.57893555 -16.49609375 604.59570312 C-23.39235744 604.52494803 -28.79579182 602.9682247 -35 600 C-35 599.34 -35 598.68 -35 598 C-36.010625 597.938125 -37.02125 597.87625 -38.0625 597.8125 C-41.77448725 597.28854156 -43.8907701 595.72945767 -46.828125 593.3984375 C-50.66009711 590.93108855 -55.00889143 589.66896396 -59.3046875 588.2109375 C-60.19414062 587.81132813 -61.08359375 587.41171875 -62 587 C-62.495 585.515 -62.495 585.515 -63 584 C-65.6261029 583.07462652 -65.6261029 583.07462652 -68.75 582.5 C-73.1220324 581.59544157 -76.24279363 580.40256734 -80 578 C-80.99 577.67 -81.98 577.34 -83 577 C-83.33 576.34 -83.66 575.68 -84 575 C-84.825 574.690625 -85.65 574.38125 -86.5 574.0625 C-87.325 573.711875 -88.15 573.36125 -89 573 C-89.495 571.515 -89.495 571.515 -90 570 C-91.32 570 -92.64 570 -94 570 C-94.66 568.68 -95.32 567.36 -96 566 C-89.25204469 567.67001711 -84.47862313 569.72667396 -79 574 C-78.2575 574.37125 -77.515 574.7425 -76.75 575.125 C-75 576 -75 576 -73.5625 577.5 C-70.57156373 580.37129882 -67.34651642 580.95301472 -63.3125 581.5 C-60 582 -60 582 -58 584 C-57.113125 584.268125 -56.22625 584.53625 -55.3125 584.8125 C-51.86590294 586.04807253 -49.55334116 587.60489205 -46.65234375 589.76953125 C-42.95462459 592.5231519 -39.12677788 594.46178885 -34.8515625 596.171875 C-33 597 -33 597 -31.3359375 598.078125 C-26.5144882 601.0941858 -22.18187554 601.36822558 -16.625 601.375 C-15.91029541 601.37653076 -15.19559082 601.37806152 -14.45922852 601.37963867 C-10.27093327 601.39591519 -10.27093327 601.39591519 -7 599 C-5.906875 598.71125 -4.81375 598.4225 -3.6875 598.125 C0.15858762 596.95161734 2.0706186 595.69186399 5 593 C5.7425 592.38125 6.485 591.7625 7.25 591.125 C9.4381737 588.46793194 9.55216189 586.35878586 10 583 C10.66 582.67 11.32 582.34 12 582 C12.05135228 529.50105963 12.0991145 477.00211718 12.12702942 424.50315857 C12.12744359 423.72622596 12.12785776 422.94929335 12.12828448 422.14881733 C12.13726309 405.26420345 12.14557365 388.37958931 12.15319599 371.49497477 C12.15693802 363.21483012 12.16082768 354.93468555 12.16479492 346.65454102 C12.16538334 345.41857651 12.16538334 345.41857651 12.16598364 344.15764303 C12.17876894 317.44754205 12.20130381 290.73746011 12.22889166 264.02737067 C12.25718898 236.58055088 12.27565623 209.13374162 12.28174497 181.6869075 C12.28260944 177.81072596 12.28358635 173.93454445 12.28463173 170.05836296 C12.284834 169.2954707 12.28503627 168.53257844 12.28524467 167.74656824 C12.28879058 155.46337507 12.30270681 143.18021447 12.3204961 130.89703458 C12.33815682 118.54994557 12.34490419 106.20288885 12.34050413 93.85578764 C12.33842248 87.16517795 12.341573 80.47467541 12.35761642 73.78407669 C12.37219321 67.66050542 12.37296665 61.53709426 12.36269668 55.41351568 C12.36142699 53.1966779 12.3652512 50.97983022 12.37464955 48.763012 C12.38667714 45.75121834 12.38020647 42.74000373 12.36914349 39.72821903 C12.37702453 38.86626347 12.38490557 38.00430791 12.39302543 37.11623248 C12.34426017 31.24670623 11.10640817 26.45760459 9 21 C8.505 19.515 8.505 19.515 8 18 C7.34 17.67 6.68 17.34 6 17 C5.896875 15.989375 5.79375 14.97875 5.6875 13.9375 C4.93205441 9.6108571 3.51591224 7.24249102 1.05859375 3.69921875 C0 2 0 2 0 0 Z " fill="#CACED4" transform="translate(547,568)"/>
+<path d="M0 0 C2.5 1.75 2.5 1.75 5 4 C5 5.32 5 6.64 5 8 C6.32 8.33 7.64 8.66 9 9 C9.12375 10.11375 9.2475 11.2275 9.375 12.375 C9.6465813 16.03103677 9.6465813 16.03103677 12 18 C12.34375 20.0234375 12.34375 20.0234375 12.5 22.375 C12.66744149 24.87825025 12.80479521 26.63068787 13.9829179 28.8596034 C18.25831728 37.85695998 16.13944339 51.62860972 16.12698364 61.43347168 C16.12813691 63.41090533 16.12972581 65.38833878 16.13171089 67.36577177 C16.13587597 72.78104185 16.13382626 78.19629426 16.13072467 83.6115644 C16.1284593 89.45894473 16.13195585 95.30632205 16.13470459 101.15370178 C16.13914908 112.60140856 16.13819168 124.04910877 16.13529195 135.4968158 C16.13303274 144.80138015 16.13272764 154.10594266 16.13381577 163.4105072 C16.13389215 164.0722148 16.13396854 164.7339224 16.13404724 165.41568175 C16.13435859 168.1019414 16.13467699 170.78820105 16.135007 173.4744607 C16.13806424 198.66046301 16.13529533 223.84646173 16.1299101 249.03246348 C16.12516469 271.39615596 16.12558933 293.75984273 16.13037109 316.12353516 C16.1357287 341.26422923 16.1378474 366.40492015 16.13475883 391.54561472 C16.13443813 394.22690741 16.13412528 396.9082001 16.13381577 399.5894928 C16.13358435 401.56831698 16.13358435 401.56831698 16.13334826 403.5871174 C16.13248517 412.87952578 16.13394153 422.17193214 16.13629532 431.46434021 C16.13910111 442.79004939 16.13833857 454.11575163 16.13301457 465.44146001 C16.13038811 471.21896329 16.12935466 476.99645502 16.13266373 482.77395821 C16.13564836 488.06507889 16.13399774 493.35617734 16.12868617 498.64729601 C16.12757125 500.55899393 16.12813263 502.47069374 16.13056196 504.38239044 C16.16091648 530.25862528 16.16091648 530.25862528 13 535 C12.835 536.19625 12.67 537.3925 12.5 538.625 C12.2525 540.295625 12.2525 540.295625 12 542 C11.34 542.33 10.68 542.66 10 543 C9.19740802 544.91203452 9.19740802 544.91203452 8.5625 547.1875 C7.35859312 551.01701285 5.86057921 554.43388985 4 558 C3.319375 559.7015625 3.319375 559.7015625 2.625 561.4375 C1.08117098 564.82204823 -0.64979932 567.4669003 -2.859375 570.421875 C-4.13738887 572.19008596 -5.12169469 574.00385156 -6 576 C-6.66 576 -7.32 576 -8 576 C-8.061875 576.8353125 -8.061875 576.8353125 -8.125 577.6875 C-9.46930374 581.24030274 -12.00974189 582.70958953 -15 585 C-15.33 584.34 -15.66 583.68 -16 583 C-14.71034824 581.62437146 -13.37310707 580.29233607 -12 579 C-11.34 579 -10.68 579 -10 579 C-9.87625 578.195625 -9.7525 577.39125 -9.625 576.5625 C-9.41875 575.716875 -9.2125 574.87125 -9 574 C-8.34 573.67 -7.68 573.34 -7 573 C-5.75907248 570.28547104 -4.90166715 567.6347637 -4.125 564.75 C-3.75375 563.8425 -3.3825 562.935 -3 562 C-0.875 561.125 -0.875 561.125 1 561 C0.95875 560.21625 0.9175 559.4325 0.875 558.625 C1 556 1 556 3 554 C3.144375 553.030625 3.28875 552.06125 3.4375 551.0625 C4.06801815 547.62967897 4.60836744 547.29964669 7 545 C9.67024072 539.87313783 10.68543381 534.95518933 11.5703125 529.2578125 C12 527 12 527 13 526 C13.10072818 523.38673563 13.13545676 520.79980907 13.12863445 518.1859684 C13.13038749 517.35334512 13.13214053 516.52072184 13.13394669 515.66286755 C13.13864676 512.83647772 13.13613098 510.01013843 13.13371277 507.18374634 C13.13557873 505.15149435 13.13787857 503.11924272 13.14057809 501.08699167 C13.14672911 495.4740629 13.14655864 489.86114895 13.14538372 484.24821758 C13.14518054 478.20585586 13.15069051 472.16349901 13.15544128 466.12113953 C13.16376649 454.27235317 13.16650989 442.42357163 13.16705366 430.5747831 C13.16751255 420.948591 13.16956747 411.32240053 13.17275429 401.69620895 C13.17365178 398.92903118 13.1745416 396.16185339 13.17542917 393.39467561 C13.17565021 392.70681798 13.17587126 392.01896034 13.17609901 391.31025853 C13.18225648 371.95205618 13.18619924 352.59385439 13.18575573 333.23565102 C13.18574015 332.50524258 13.18572457 331.77483414 13.18570852 331.02229212 C13.18562541 327.31996804 13.18552637 323.61764396 13.18542381 319.91531987 C13.18540387 319.17997655 13.18538392 318.44463323 13.18536337 317.68700677 C13.18532294 316.19996212 13.18528114 314.71291747 13.18523798 313.22587281 C13.1846251 290.08514591 13.19213279 266.94443365 13.20581055 243.80371094 C13.22115785 217.82741971 13.22977758 191.8511381 13.22884732 165.87484205 C13.22877269 163.10703556 13.22872399 160.33922907 13.22869301 157.57142258 C13.22867553 156.54910595 13.22867553 156.54910595 13.22865769 155.50613646 C13.22862687 144.51894031 13.23502381 133.53175683 13.24362527 122.54456445 C13.25208579 111.50946678 13.25293214 100.474384 13.24651595 89.43928386 C13.24323685 83.45625119 13.24324379 77.47326465 13.2518692 71.49023628 C13.2596742 66.02024069 13.25836488 60.55032824 13.24958507 55.08033483 C13.24803673 53.09445601 13.24991575 51.10857117 13.25544515 49.12269945 C13.26243188 46.43693482 13.25726991 43.75146786 13.24888897 41.06571388 C13.25385715 40.28293847 13.25882533 39.50016305 13.26394406 38.69366717 C13.23878751 34.91733356 13.148722 33.223083 11 30 C10.855625 28.88625 10.71125 27.7725 10.5625 26.625 C9.98733351 22.91837153 8.96665154 21.11386493 7 18 C6.65939189 16.33480481 6.32441604 14.66842534 6 13 C5.34 12.67 4.68 12.34 4 12 C3.32060826 10.00428677 2.65438441 8.00405227 2 6 C1.34 5.34 0.68 4.68 0 4 C0 2.68 0 1.36 0 0 Z " fill="#557ECE" transform="translate(1103,334)"/>
+<path d="M0 0 C0 0.66 0 1.32 0 2 C0.94875 2.12375 1.8975 2.2475 2.875 2.375 C6 3 6 3 8 5 C9.64991582 5.70710678 11.3207762 6.36562656 13 7 C19.78136201 9.78136201 19.78136201 9.78136201 21 11 C22.134375 11.12375 23.26875 11.2475 24.4375 11.375 C25.613125 11.58125 26.78875 11.7875 28 12 C28.99 13.485 28.99 13.485 30 15 C30.99 15.33 31.98 15.66 33 16 C33 16.66 33 17.32 33 18 C34.11375 18.12375 35.2275 18.2475 36.375 18.375 C40 19 40 19 42 21 C42.886875 21.268125 43.77375 21.53625 44.6875 21.8125 C47.60586153 22.85870508 49.11830123 23.72473687 51.5 25.5625 C54.63814566 27.95611886 57.10554156 28.36601839 61 29 C62.0625 30.875 62.0625 30.875 63 33 C66.45899447 35.49816267 69.96321743 36.70822958 74 38 C76.34205301 38.97940398 78.67518826 39.98034573 81 41 C82.19625 41.495 83.3925 41.99 84.625 42.5 C87.63003648 43.83557177 90.35117791 45.0523367 93 47 C93.6328125 49.09765625 93.6328125 49.09765625 94 51 C88.08315098 55.90153173 88.08315098 55.90153173 83.5625 56.3125 C82.716875 56.209375 81.87125 56.10625 81 56 C80.67 56.99 80.34 57.98 80 59 C77.03 59.495 77.03 59.495 74 60 C73.67 60.99 73.34 61.98 73 63 C71.02 63 69.04 63 67 63 C66.67 63.99 66.34 64.98 66 66 C64.39125 66.2165625 64.39125 66.2165625 62.75 66.4375 C60.08337051 66.83749442 57.58600271 67.27591924 55 68 C58.29658854 64.58567616 61.23220172 61.698897 65.6875 59.9375 C68.15938605 59.23196154 68.15938605 59.23196154 69 57 C70.62231782 56.49302568 72.24945273 55.99769372 73.89453125 55.5703125 C76.93917506 54.74560379 79.90380591 53.70615535 82.88671875 52.68359375 C84.90973664 52.02919794 86.93174285 51.49021896 89 51 C89 49.68 89 48.36 89 47 C88.484375 46.896875 87.96875 46.79375 87.4375 46.6875 C82.87202254 45.39980123 78.87317654 43.61850005 75 40.875 C71.58868722 38.74292951 68.97417136 38.31793371 65 38 C64.67 37.01 64.34 36.02 64 35 C62.01578741 34.28771856 60.01032877 33.63484067 58 33 C53.9105295 31.08084691 49.90152335 28.99856533 45.90234375 26.8984375 C43.82267813 25.84569688 43.82267813 25.84569688 40.6875 25.125 C36.57687793 23.87091191 33.6105757 22.31076845 30 20 C29.67 19.34 29.34 18.68 29 18 C28.319375 17.731875 27.63875 17.46375 26.9375 17.1875 C24.38532758 16.15577072 22.61622645 15.09960397 20.375 13.5625 C16.23674889 10.86158038 12.13173565 9.84275999 7.3203125 8.87109375 C5 8 5 8 3.6796875 5.91015625 C3.34324219 4.96462891 3.34324219 4.96462891 3 4 C-3.88331771 4.23293799 -9.52181984 4.83245838 -15.6953125 7.953125 C-19.2364357 9.5616352 -22.94203436 10.38698431 -26.71484375 11.2890625 C-29.16808334 11.85799805 -29.16808334 11.85799805 -31 14 C-33.27279815 14.34070409 -35.51422264 14.44141829 -37.80859375 14.55859375 C-40.08106126 14.79542137 -40.08106126 14.79542137 -41.40234375 16.5 C-43.7959405 18.74728888 -45.90069205 18.4443516 -49.125 18.5625 C-53.09684674 18.77339452 -56.77552622 19.05828945 -60.625 20.0625 C-65.72808466 21.34539838 -70.77093829 21.17593105 -76 21 C-76.66 22.32 -77.32 23.64 -78 25 C-78.86278564 25.02505615 -79.72557129 25.0501123 -80.61450195 25.07592773 C-83.81823769 25.17111385 -87.02181537 25.27034444 -90.2253418 25.37231445 C-91.61135983 25.41560218 -92.99742906 25.45728164 -94.38354492 25.49731445 C-96.37691798 25.55516584 -98.37010565 25.61929776 -100.36328125 25.68359375 C-101.56251221 25.72025146 -102.76174316 25.75690918 -103.99731445 25.79467773 C-107.04994349 25.87733025 -107.04994349 25.87733025 -110 27 C-112.94964113 27.085409 -115.87503019 27.11582927 -118.82421875 27.09765625 C-119.68561966 27.0962413 -120.54702057 27.09482635 -121.43452454 27.09336853 C-124.18555169 27.0877714 -126.93649744 27.07521946 -129.6875 27.0625 C-131.5527332 27.05748463 -133.41796767 27.05292179 -135.28320312 27.04882812 C-139.85550011 27.03780292 -144.42773625 27.02054027 -149 27 C-149.33 26.34 -149.66 25.68 -150 25 C-152.8159849 24.53101037 -152.8159849 24.53101037 -156.0625 24.375 C-157.16722656 24.30023438 -158.27195312 24.22546875 -159.41015625 24.1484375 C-160.26480469 24.09945313 -161.11945312 24.05046875 -162 24 C-162 23.67 -162 23.34 -162 23 C-160.87510918 22.99453156 -160.87510918 22.99453156 -159.72749329 22.98895264 C-152.51063471 22.95040806 -145.29425536 22.8928461 -138.07771015 22.81609726 C-134.37137396 22.77729236 -130.66525162 22.7447892 -126.95874023 22.72900391 C-104.25101973 22.6253901 -82.31931224 21.04985867 -60.00733948 16.40563965 C-57.59964016 15.91909598 -55.18366133 15.57972186 -52.75 15.25 C-46.51805476 14.23587768 -40.46618571 12.63804833 -34.375 11 C-33.38983398 10.73864258 -32.40466797 10.47728516 -31.38964844 10.20800781 C-30.46442383 9.95374023 -29.53919922 9.69947266 -28.5859375 9.4375 C-27.7511084 9.20933594 -26.9162793 8.98117187 -26.05615234 8.74609375 C-23.8146461 8.09698446 -23.8146461 8.09698446 -22 6 C-20.15234375 5.5078125 -20.15234375 5.5078125 -17.9375 5.125 C-13.61813769 4.26112754 -9.97402198 2.76663392 -6.04296875 0.8046875 C-4 0 -4 0 0 0 Z " fill="#A0A7B2" transform="translate(716,371)"/>
+<path d="M0 0 C0.33 0 0.66 0 1 0 C1.125 6.75 1.125 6.75 0 9 C-0.09614644 10.98880924 -0.12630841 12.98091409 -0.12698364 14.9720459 C-0.12980347 16.24668198 -0.13262329 17.52131805 -0.13552856 18.83457947 C-0.13358372 20.25625624 -0.13153552 21.67793288 -0.12939453 23.09960938 C-0.13074929 24.59151757 -0.13252965 26.08342542 -0.13470459 27.57533264 C-0.1392826 31.64555739 -0.13748455 35.71575691 -0.1343255 39.78598213 C-0.13178886 44.07424105 -0.13414446 48.36249783 -0.13571167 52.65075684 C-0.13753583 59.88745507 -0.13512717 67.12414315 -0.13037109 74.36083984 C-0.1249937 82.63651603 -0.12664175 90.91216733 -0.1321975 99.18784285 C-0.1368013 106.33994996 -0.13734246 113.49204976 -0.13475883 120.64415789 C-0.13322674 124.89295892 -0.13291369 129.14174848 -0.13629532 133.39054871 C-0.14833829 150.86205522 -0.00064154 168.30573472 0.57478309 185.76844192 C0.99381355 198.52574858 1.12254503 211.26856427 1.07516479 224.03291702 C1.06194538 227.62736846 1.05577691 231.22178151 1.05102539 234.81625366 C1.03983646 242.41918704 1.0205409 250.02208692 1 257.625 C0.97618686 266.51976673 0.95592824 275.41451578 0.94406128 284.3093071 C0.93767764 287.81647011 0.92518958 291.32357461 0.91235352 294.83071899 C0.07334638 315.26139747 0.07334638 315.26139747 4 335 C4.33 335.33 4.66 335.66 5 336 C5.28306234 338.54756104 5.44815786 341.09510022 5.62109375 343.65234375 C5.79485724 346.18512773 5.79485724 346.18512773 8 348 C7.625 350.125 7.625 350.125 7 352 C6.505 350.515 6.505 350.515 6 349 C5.34 348.67 4.68 348.34 4 348 C0.81335396 339.74263252 -0.64773107 331.81633954 0 323 C-0.66 323 -1.32 323 -2 323 C-2.90047952 315.59491362 -3.14427143 308.30150174 -3.13371277 300.84658813 C-3.13597833 299.65975791 -3.13824388 298.47292769 -3.14057809 297.25013292 C-3.14578489 293.98206848 -3.14656785 290.71403896 -3.14538372 287.44597173 C-3.14517855 283.91062231 -3.15070965 280.37528092 -3.15544128 276.8399353 C-3.16372477 269.92169365 -3.16649512 263.00346053 -3.16705366 256.08521433 C-3.16753013 250.45442567 -3.16959142 244.8236398 -3.17275429 239.19285202 C-3.18155635 223.19468705 -3.18617463 207.19652876 -3.18542381 191.19836135 C-3.18538386 190.33706714 -3.1853439 189.47577294 -3.18530273 188.58837891 C-3.18526185 187.72602062 -3.18522097 186.86366233 -3.18517885 185.97517197 C-3.18477302 172.02161025 -3.19432797 158.0680756 -3.2084411 144.1145217 C-3.2228501 129.75390903 -3.22970873 115.39330952 -3.22884732 101.03268945 C-3.2285168 92.983834 -3.23119964 84.93500689 -3.24202538 76.88615799 C-3.25119035 70.02853162 -3.25325711 63.17094642 -3.24651595 56.31331654 C-3.24328005 52.82323129 -3.24308591 49.33322474 -3.2518692 45.84314728 C-3.28269219 30.8308392 -3.26671299 15.87591642 -1 1 C-0.67 0.67 -0.34 0.34 0 0 Z " fill="#737D90" transform="translate(158,514)"/>
+<path d="M0 0 C-2.87846866 2.34541891 -5.54323547 3.68313732 -9 5 C-12.38654212 6.48161218 -14.72172406 7.71420309 -17.3125 10.375 C-20.27722087 13.27077387 -23.20858598 14.9438382 -26.84765625 16.86328125 C-28.5815496 17.77900351 -30.26874589 18.78284321 -31.9375 19.8125 C-34 21 -34 21 -36 21 C-36.33 21.99 -36.66 22.98 -37 24 C-39.06640625 24.73046875 -39.06640625 24.73046875 -41.5625 25.1875 C-42.38878906 25.34605469 -43.21507812 25.50460937 -44.06640625 25.66796875 C-44.70449219 25.77753906 -45.34257813 25.88710938 -46 26 C-45.91812777 54.74004167 -45.82613159 83.48003435 -45.71994839 112.2199971 C-45.70742911 115.61093854 -45.6949964 119.0018803 -45.68261719 122.39282227 C-45.68015119 123.06791427 -45.6776852 123.74300628 -45.67514448 124.43855562 C-45.6353916 135.37787817 -45.60265547 146.31721108 -45.57250018 157.25656382 C-45.54141571 168.47650201 -45.50267051 179.69639595 -45.45720994 190.91628665 C-45.43191137 197.22036622 -45.41014005 203.52441443 -45.39665604 209.82853127 C-45.38386612 215.75705985 -45.36184507 221.68548109 -45.33261681 227.61395073 C-45.32351695 229.79446887 -45.31784522 231.97500431 -45.31578636 234.15554047 C-45.31248079 237.12361769 -45.29704982 240.09138742 -45.2784729 243.05940247 C-45.28040763 243.93001826 -45.28234237 244.80063405 -45.28433573 245.69763213 C-45.24076408 250.6429148 -45.24076408 250.6429148 -43 255 C-41.18630565 255.93311346 -41.18630565 255.93311346 -39.125 256.5625 C-31.36710165 259.2657967 -31.36710165 259.2657967 -30 262 C-28.01363702 262.70626239 -26.01151741 263.36893571 -24 264 C-20.69293992 265.3779417 -20.08837738 265.86743394 -18 269 C-15.04064004 270.68145452 -12.26919796 271.92148393 -9 272.875 C-5.17595707 274.3090161 -3.05022286 276.28869079 0 279 C0.99 279.66 1.98 280.32 3 281 C-0.32943825 280.44509362 -3.11610028 279.79000672 -6 278 C-6.66 277.01 -7.32 276.02 -8 275 C-9.093125 274.855625 -10.18625 274.71125 -11.3125 274.5625 C-15.54624152 273.91667502 -16.83225435 272.77177745 -20 270 C-21.73907888 268.98817229 -23.47906981 267.9771456 -25.2421875 267.0078125 C-26.90463796 266.05467424 -28.4880889 264.96744852 -30.0625 263.875 C-32.9992718 262.00046481 -35.66311375 260.95339607 -39 260 C-39 259.34 -39 258.68 -39 258 C-39.7425 258.0825 -40.485 258.165 -41.25 258.25 C-44 258 -44 258 -46.14012909 256.55374146 C-48.89502718 252.77106094 -48.55467138 249.46150989 -48.50793457 244.89013672 C-48.51417453 243.95849134 -48.5204145 243.02684597 -48.52684355 242.06696892 C-48.5428292 238.93761951 -48.53014732 235.80904302 -48.51757812 232.6796875 C-48.52299675 230.43930608 -48.53011795 228.19892821 -48.53881836 225.95855713 C-48.55708532 219.86772205 -48.54997013 213.77715737 -48.53730202 207.68631744 C-48.52719187 201.31935382 -48.53656217 194.95241373 -48.54284668 188.58544922 C-48.55059564 177.20679462 -48.53814625 165.82827762 -48.51780933 154.44965053 C-48.49993807 144.13108615 -48.5030421 133.81270176 -48.52148438 123.49414062 C-48.54288669 111.51379468 -48.55086055 99.53355812 -48.53903532 87.55318642 C-48.53279143 81.2105235 -48.53198942 74.8679846 -48.54518127 68.52532959 C-48.5567153 62.56302263 -48.54875854 56.60105638 -48.52560425 50.63878632 C-48.5203041 48.44739091 -48.52185312 46.25596696 -48.53065491 44.06458282 C-48.54154219 41.07928598 -48.52792898 38.0950895 -48.50793457 35.10986328 C-48.51685746 34.23710691 -48.52578034 33.36435055 -48.53497362 32.46514702 C-48.45862115 26.61144007 -48.45862115 26.61144007 -46.12718964 23.50314331 C-43.00438629 21.29646607 -39.73753026 20.25306669 -36.14453125 19.02734375 C-35.08298828 18.51880859 -35.08298828 18.51880859 -34 18 C-33.67 17.01 -33.34 16.02 -33 15 C-31.0187415 14.27954236 -29.01495907 13.61998741 -27 13 C-23.32064321 11.17499082 -23.32064321 11.17499082 -21 8 C-18.48810588 6.90575335 -15.92891181 6.01502333 -13.34765625 5.09765625 C-10.69522955 4.10486973 -10.69522955 4.10486973 -9 1 C-2.58333333 -1.29166667 -2.58333333 -1.29166667 0 0 Z " fill="#A6C3FD" transform="translate(704,602)"/>
+<path d="M0 0 C0.77730469 0.00580078 1.55460937 0.01160156 2.35546875 0.01757812 C9.21376627 0.16166001 15.46601419 1.27648102 21.125 5.4375 C21.62 6.9225 21.62 6.9225 22.125 8.4375 C17.375 7.6875 17.375 7.6875 15.125 5.4375 C12.80293475 4.73258733 10.46906932 4.06537571 8.125 3.4375 C7.465 3.1075 6.805 2.7775 6.125 2.4375 C-1.95139906 1.51949781 -1.95139906 1.51949781 -8.9375 4.875 C-9.576875 5.720625 -10.21625 6.56625 -10.875 7.4375 C-11.865 7.7675 -12.855 8.0975 -13.875 8.4375 C-13.875 9.7575 -13.875 11.0775 -13.875 12.4375 C-14.865 13.0975 -15.855 13.7575 -16.875 14.4375 C-17.8760669 17.058801 -17.8760669 17.058801 -18.5 20.1875 C-18.73976562 21.21359375 -18.97953125 22.2396875 -19.2265625 23.296875 C-21.08033658 33.56208227 -21.02195456 44.18891518 -20.99525452 54.58615112 C-20.99610894 55.83134588 -20.99696337 57.07654064 -20.99784368 58.35946858 C-20.99919328 61.77113496 -20.99611695 65.18274242 -20.99106562 68.5944016 C-20.98670942 72.29016818 -20.98821118 75.98593323 -20.9889679 79.68170166 C-20.98948988 86.0701019 -20.98637725 92.45849185 -20.98073006 98.8468895 C-20.97257073 108.08321124 -20.96999531 117.31952806 -20.96874207 126.55585302 C-20.96655849 141.54456238 -20.95991728 156.53326627 -20.95043945 171.52197266 C-20.94124734 186.07405571 -20.93417532 200.62613728 -20.92993164 215.17822266 C-20.92966892 216.07661719 -20.92940619 216.97501173 -20.92913551 217.90063034 C-20.92783038 222.40803097 -20.9265667 226.91543161 -20.92532361 231.42283225 C-20.91497262 268.76105869 -20.89737325 306.09927892 -20.875 343.4375 C-20.215 343.4375 -19.555 343.4375 -18.875 343.4375 C-18.69324219 345.10039063 -18.69324219 345.10039063 -18.5078125 346.796875 C-18.33893704 348.26046234 -18.16964428 349.72400157 -18 351.1875 C-17.92136719 351.91710937 -17.84273437 352.64671875 -17.76171875 353.3984375 C-17.31775151 357.15508337 -16.73886474 360.1446723 -14.875 363.4375 C-14.75 366.1875 -14.75 366.1875 -14.875 368.4375 C-13.885 368.7675 -12.895 369.0975 -11.875 369.4375 C-11.875 370.4275 -11.875 371.4175 -11.875 372.4375 C-10.946875 372.7778125 -10.946875 372.7778125 -10 373.125 C-7.26089791 374.81679835 -6.82475528 376.42994161 -5.875 379.4375 C-6.865 379.1075 -7.855 378.7775 -8.875 378.4375 C-8.875 377.7775 -8.875 377.1175 -8.875 376.4375 C-9.865 376.4375 -10.855 376.4375 -11.875 376.4375 C-14.45953566 372.12994057 -16.34614311 368.24247881 -17.875 363.4375 C-18.865 361.9525 -18.865 361.9525 -19.875 360.4375 C-20.17491069 357.84864829 -20.38365225 355.34600918 -20.5 352.75 C-20.53867188 352.04810547 -20.57734375 351.34621094 -20.6171875 350.62304688 C-20.7112334 348.89495345 -20.7941968 347.16626325 -20.875 345.4375 C-21.535 345.4375 -22.195 345.4375 -22.875 345.4375 C-22.9207358 304.06847005 -22.95599801 262.69944302 -22.97713066 221.33039282 C-22.9796322 216.45105611 -22.98222083 211.57171945 -22.98486328 206.69238281 C-22.9853879 205.72095763 -22.98591252 204.74953245 -22.98645304 203.74867015 C-22.99516563 188.00078837 -23.01094028 172.25292113 -23.02930559 156.50504799 C-23.04798093 140.35716204 -23.0591117 124.20928373 -23.06317699 108.06138742 C-23.06592697 98.09001192 -23.07462558 88.11867751 -23.09083293 78.14731465 C-23.10137065 71.3179787 -23.10460795 64.48866411 -23.10200275 57.65932061 C-23.10071643 53.71382546 -23.10274607 49.76840232 -23.11341095 45.82291985 C-23.12309081 42.21568565 -23.12366951 38.60857238 -23.11679779 35.0013328 C-23.11554274 33.06818955 -23.12421571 31.13504787 -23.13316262 29.20192492 C-23.12918052 28.06583926 -23.12519842 26.9297536 -23.12109566 25.7592411 C-23.1218551 24.77272769 -23.12261454 23.78621427 -23.12339699 22.7698065 C-22.875 20.4375 -22.875 20.4375 -20.875 18.4375 C-20.47452556 16.11474823 -20.1352896 13.78010643 -19.875 11.4375 C-19.070625 11.19 -18.26625 10.9425 -17.4375 10.6875 C-16.591875 10.275 -15.74625 9.8625 -14.875 9.4375 C-14.50951555 8.11261887 -14.1812434 6.77731486 -13.875 5.4375 C-9.71037077 -0.06046902 -6.42880597 -0.26918646 0 0 Z " fill="#D4D8DD" transform="translate(176.875,493.5625)"/>
+<path d="M0 0 C0.99 0.495 0.99 0.495 2 1 C-1.19944066 3.81162967 -4.16712061 5.58306319 -8.1171875 7.15625 C-10.19369032 8.08679898 -12.02421228 9.20699339 -13.9375 10.4375 C-19.96768135 14.29913536 -25.94637048 17.16703043 -32.82421875 19.19140625 C-35.12212644 19.95484093 -35.12212644 19.95484093 -37.39453125 21.55859375 C-41.22387461 23.67707606 -44.76354602 23.46214937 -49.0625 23.59375 C-52.38130662 24.05273389 -54.20669004 25.21060843 -57 27 C-59.32817964 27.36760731 -61.6618385 27.70241581 -64 28 C-64.87205078 28.48919922 -64.87205078 28.48919922 -65.76171875 28.98828125 C-68.90710219 30.41001652 -71.81740978 30.43430054 -75.25 30.625 C-76.51328125 30.69976562 -77.7765625 30.77453125 -79.078125 30.8515625 C-80.52445313 30.92503906 -80.52445313 30.92503906 -82 31 C-82 31.66 -82 32.32 -82 33 C-102.83199245 36.20361111 -123.35880008 37.38518773 -144.4375 37.3125 C-145.56796753 37.30968018 -146.69843506 37.30686035 -147.86315918 37.30395508 C-151.13678557 37.29135735 -154.41008203 37.26814136 -157.68359375 37.23828125 C-158.64814987 37.23073318 -159.61270599 37.22318512 -160.60649109 37.21540833 C-167.43787215 37.12214449 -174.19919129 36.64239101 -181 36 C-181 35.34 -181 34.68 -181 34 C-181.55461914 33.98018066 -182.10923828 33.96036133 -182.68066406 33.93994141 C-185.20423693 33.84442349 -187.72701224 33.73485433 -190.25 33.625 C-191.55904297 33.57859375 -191.55904297 33.57859375 -192.89453125 33.53125 C-193.73886719 33.49257813 -194.58320312 33.45390625 -195.453125 33.4140625 C-196.22817383 33.3826416 -197.00322266 33.3512207 -197.80175781 33.31884766 C-200.22141936 32.96788386 -201.83609935 32.10470542 -204 31 C-206.68782602 30.75361595 -209.30815948 30.58290089 -212 30.5 C-220.08639478 30.25096248 -220.08639478 30.25096248 -224 28 C-226.34779417 27.43179435 -228.69865261 26.99795566 -231.07421875 26.5625 C-231.70972656 26.376875 -232.34523438 26.19125 -233 26 C-233.33 25.34 -233.66 24.68 -234 24 C-236.80980673 23.30772968 -236.80980673 23.30772968 -240.0625 22.875 C-241.16722656 22.70742188 -242.27195312 22.53984375 -243.41015625 22.3671875 C-244.26480469 22.24601562 -245.11945313 22.12484375 -246 22 C-246 21.34 -246 20.68 -246 20 C-247.32 19.67 -248.64 19.34 -250 19 C-247.36 19 -244.72 19 -242 19 C-242 19.99 -242 20.98 -242 22 C-241.09507812 21.94779297 -241.09507812 21.94779297 -240.171875 21.89453125 C-235.2017216 21.72618734 -232.91610029 21.81816851 -229 25 C-226.72224158 25.65198223 -224.44713039 26.12314863 -222.12109375 26.5703125 C-220 27 -220 27 -217 28 C-215.39851606 28.20138735 -213.79191895 28.36362644 -212.18359375 28.5 C-211.25482422 28.5825 -210.32605469 28.665 -209.36914062 28.75 C-207.41083547 28.91699738 -205.45250196 29.08366274 -203.49414062 29.25 C-202.56666016 29.3325 -201.63917969 29.415 -200.68359375 29.5 C-199.83337646 29.5721875 -198.98315918 29.644375 -198.10717773 29.71875 C-196 30 -196 30 -194 31 C-192.42440742 31.20973915 -190.84183152 31.36821903 -189.2578125 31.5 C-187.79661987 31.6230249 -187.79661987 31.6230249 -186.3059082 31.74853516 C-185.2562085 31.83151855 -184.20650879 31.91450195 -183.125 32 C-182.04887451 32.08685059 -180.97274902 32.17370117 -179.86401367 32.26318359 C-173.01777819 32.80095436 -166.17063258 33.26936319 -159.3125 33.625 C-158.18642334 33.68494141 -158.18642334 33.68494141 -157.03759766 33.74609375 C-145.49409614 34.29038459 -134.08138906 33.92687645 -122.5625 33.0625 C-120.75168945 32.93198242 -120.75168945 32.93198242 -118.90429688 32.79882812 C-116.48414423 32.62401774 -114.06436863 32.44390096 -111.64501953 32.25830078 C-109.14791126 32.08134562 -106.64846594 31.93541281 -104.14794922 31.81591797 C-102.29387451 31.71947998 -102.29387451 31.71947998 -100.40234375 31.62109375 C-99.29238037 31.57267334 -98.18241699 31.52425293 -97.03881836 31.47436523 C-93.68996836 30.95160348 -91.84456653 29.77705505 -89 28 C-86.68823242 27.56762695 -86.68823242 27.56762695 -84.35546875 27.48828125 C-83.51435547 27.45283203 -82.67324219 27.41738281 -81.80664062 27.38085938 C-80.94232422 27.35830078 -80.07800781 27.33574219 -79.1875 27.3125 C-77.86202148 27.26125977 -77.86202148 27.26125977 -76.50976562 27.20898438 C-74.34027833 27.12689567 -72.1701611 27.06176121 -70 27 C-69.67 26.34 -69.34 25.68 -69 25 C-66.41796875 24.65625 -66.41796875 24.65625 -63.1875 24.5 C-59.16572696 24.30405491 -56.53056986 23.883463 -53 22 C-50.96484375 21.69140625 -50.96484375 21.69140625 -48.9375 21.5625 C-44.77370382 20.96767197 -44.62860389 20.74808588 -42 18 C-38.8125 17.8125 -38.8125 17.8125 -36 18 C-35.67 17.01 -35.34 16.02 -35 15 C-31.92382812 14.70703125 -31.92382812 14.70703125 -28.84765625 14.4140625 C-28.23792969 14.27742188 -27.62820313 14.14078125 -27 14 C-26.67 13.34 -26.34 12.68 -26 12 C-24 11.33333333 -22 10.66666667 -20 10 C-19.67 9.34 -19.34 8.68 -19 8 C-18.030625 7.855625 -17.06125 7.71125 -16.0625 7.5625 C-14.5465625 7.2840625 -14.5465625 7.2840625 -13 7 C-12.34 6.01 -11.68 5.02 -11 4 C-7.875 3.8125 -7.875 3.8125 -5 4 C-5 3.34 -5 2.68 -5 2 C-2.625 0.9375 -2.625 0.9375 0 0 Z " fill="#4767A3" transform="translate(731,334)"/>
+<path d="M0 0 C4.10645074 -0.13408475 5.69941122 0.13548187 8.8125 2.875 C11.57728276 5.1034878 13.64086476 6.40552274 17.125 7.125 C21.30865807 8.06969698 23.55415404 9.50726037 27 12 C29.31025303 13.37771682 31.65274736 14.68553852 34 16 C34 16.66 34 17.32 34 18 C34.825 18.226875 35.65 18.45375 36.5 18.6875 C40.08232831 20.03087312 42.85854311 21.75071352 46.03515625 23.8359375 C48.15688316 25.18887081 48.15688316 25.18887081 51.4375 26.125 C52.7059375 26.558125 52.7059375 26.558125 54 27 C54.495 28.485 54.495 28.485 55 30 C56.65 30 58.3 30 60 30 C60.495 31.98 60.495 31.98 61 34 C61.53625 34.103125 62.0725 34.20625 62.625 34.3125 C65.65012928 35.18819532 68.2504489 36.47247161 71 38 C71.33 38.66 71.66 39.32 72 40 C73.6476038 40.71247732 75.31763529 41.37400383 77 42 C80.85714286 43.71428571 80.85714286 43.71428571 82 46 C83.99531815 46.68055118 85.99624711 47.34469947 88 48 C94.67992738 51.49398046 100.93255887 55.54228815 107 60 C107.94875 60.556875 108.8975 61.11375 109.875 61.6875 C112 63 112 63 113 65 C108.0800765 63.51771536 104.07395482 62.18277721 100 59 C98.55284113 58.32950168 97.09274184 57.686656 95.625 57.0625 C91.72659004 55.38070661 88.36898847 53.5915296 85 51 C85 50.34 85 49.68 85 49 C83.35 49 81.7 49 80 49 C79.67 48.01 79.34 47.02 79 46 C76.45003743 45.0836072 73.89162888 44.53802414 71.25 43.94140625 C70.13625 43.47541016 70.13625 43.47541016 69 43 C68.1875 40.90234375 68.1875 40.90234375 68 39 C67.484375 38.9175 66.96875 38.835 66.4375 38.75 C62.95544268 37.67859775 60.12799115 35.86476395 57 34 C57 33.01 57 32.02 57 31 C56.38125 30.87625 55.7625 30.7525 55.125 30.625 C53 30 53 30 51 28 C49.34015202 27.31653318 47.67163195 26.65411685 46 26 C44.66129085 25.34419512 43.32828326 24.6766726 42 24 C39.05069548 22.50300452 36.10048544 21.16268204 33 20 C33 19.34 33 18.68 33 18 C31.02 17.67 29.04 17.34 27 17 C27 16.34 27 15.68 27 15 C26.236875 14.896875 25.47375 14.79375 24.6875 14.6875 C21.75657342 13.93772808 20.98482838 13.16526733 19 11 C18.01 10.67 17.02 10.34 16 10 C16 9.34 16 8.68 16 8 C15.29875 7.9175 14.5975 7.835 13.875 7.75 C10.34301021 6.82861136 7.98071643 5.07354186 5 3 C4.01 2.67 3.02 2.34 2 2 C2.19177089 12.24890223 2.3992414 22.49735399 2.62686634 32.74552631 C2.7320618 37.50398149 2.83180714 42.26242197 2.91918945 47.02124023 C3.00368791 51.61216208 3.10238172 56.20257752 3.21100426 60.79298973 C3.24997362 62.54599659 3.28379136 64.29912566 3.31241798 66.05233192 C3.35333117 68.50456618 3.41240284 70.95573007 3.47583008 73.4074707 C3.48374573 74.13539322 3.49166138 74.86331573 3.49981689 75.61329651 C3.61636487 79.51760883 3.61636487 79.51760883 5.39604187 82.90031433 C7.19417414 84.13312724 9.01139844 85.10855792 11 86 C11 86.66 11 87.32 11 88 C12.2684375 88.37125 12.2684375 88.37125 13.5625 88.75 C16.21839003 89.71577819 18.18873034 90.63095031 20.5625 92.0625 C23.73768046 94.10966373 23.73768046 94.10966373 26.625 94.4375 C30.05022542 95.2487376 31.53689622 97.53689622 34 100 C35.79121666 100.91876453 35.79121666 100.91876453 37.6875 101.625 C41 103 41 103 43 106 C38.76677156 105.37954537 35.47709705 103.89476441 31.6875 101.9375 C30.08455078 101.11572266 30.08455078 101.11572266 28.44921875 100.27734375 C27.64097656 99.85582031 26.83273437 99.43429687 26 99 C26 98.34 26 97.68 26 97 C24.88625 96.814375 24.88625 96.814375 23.75 96.625 C19.36332389 95.62802816 17.53339359 94.80009038 15 91 C11.94570927 89.78715124 11.94570927 89.78715124 9 89 C9 88.34 9 87.68 9 87 C8.2575 86.9175 7.515 86.835 6.75 86.75 C3.28559362 85.8051619 2.16888584 84.86453796 0 82 C-0.3741618 79.20434998 -0.50744226 76.80919187 -0.45410156 74.01855469 C-0.45468567 73.2181778 -0.45526978 72.4178009 -0.45587158 71.59317017 C-0.45308875 68.95229455 -0.42198834 66.31255299 -0.390625 63.671875 C-0.3831633 61.83913795 -0.37747003 60.00639291 -0.37347412 58.17364502 C-0.35821221 53.35329098 -0.31892562 48.53342015 -0.2746582 43.71325684 C-0.23371751 38.79327939 -0.21546567 33.87322375 -0.1953125 28.953125 C-0.15243189 19.3018712 -0.08417381 9.6509758 0 0 Z " fill="#A2C0FD" transform="translate(857,532)"/>
+<path d="M0 0 C0.33 1.32 0.66 2.64 1 4 C0.01 4.495 0.01 4.495 -1 5 C-1.46898963 7.8159849 -1.46898963 7.8159849 -1.625 11.0625 C-1.69976563 12.16722656 -1.77453125 13.27195312 -1.8515625 14.41015625 C-1.90054688 15.26480469 -1.94953125 16.11945312 -2 17 C-2.66 17 -3.32 17 -4 17 C-4 203.45 -4 389.9 -4 582 C-3.34 582 -2.68 582 -2 582 C-2.33 583.32 -2.66 584.64 -3 586 C-5.65130483 583.45864566 -6.22859153 581.4060298 -6.37489682 577.86462539 C-6.39024198 576.12499198 -6.38886015 574.38516583 -6.37473011 572.64552212 C-6.37879084 571.68280928 -6.38285156 570.72009644 -6.38703534 569.72821048 C-6.39704249 566.47722635 -6.38551889 563.22666772 -6.3742218 559.97569275 C-6.37696027 557.63149016 -6.38101051 555.2872888 -6.38626546 552.9430905 C-6.39577646 547.160213 -6.39125845 541.37746318 -6.38092325 535.59458984 C-6.36932711 528.66985037 -6.3751119 521.74515364 -6.38149153 514.82041131 C-6.39343142 501.25236531 -6.38832327 487.6843657 -6.37621326 474.11632225 C-6.3656881 462.24352001 -6.36113635 450.37073358 -6.36250877 438.49792671 C-6.3625928 437.71119207 -6.36267683 436.92445744 -6.36276341 436.11388235 C-6.36311564 432.92049526 -6.36349965 429.72710817 -6.36392899 426.53372109 C-6.36789629 396.56211277 -6.35516535 366.59053245 -6.33440243 336.61893214 C-6.31603045 309.97340538 -6.31022039 283.32790546 -6.31567383 256.68237305 C-6.31602026 254.9713969 -6.31636636 253.26042075 -6.31671212 251.54944461 C-6.31688311 250.70358242 -6.31705411 249.85772024 -6.31723029 248.98622587 C-6.31808379 244.72853615 -6.31890758 240.47084643 -6.31969929 236.2131567 C-6.31985637 235.37323453 -6.32001345 234.53331236 -6.32017529 233.667938 C-6.32416244 211.42205818 -6.31869372 189.17618094 -6.310188 166.93030268 C-6.30928093 164.53755859 -6.30837528 162.1448145 -6.30747276 159.75207041 C-6.30687165 158.16469722 -6.30626303 156.57732403 -6.30564686 154.98995085 C-6.30142026 143.9092606 -6.3008494 132.82857543 -6.30275235 121.74788463 C-6.30519186 107.47124817 -6.30115146 93.19463893 -6.28554235 78.91800993 C-6.27818534 72.02966872 -6.27398488 65.14136192 -6.27878571 58.25301743 C-6.28284037 51.95600092 -6.27775906 45.65906259 -6.26515963 39.36205799 C-6.26221408 37.07546549 -6.26269007 34.78886569 -6.26680271 32.50227498 C-6.27186086 29.41096709 -6.26478722 26.31992576 -6.25447559 23.22863674 C-6.25887208 22.32639296 -6.26326856 21.42414918 -6.26779827 20.49456468 C-6.26253501 19.67466673 -6.25727175 18.85476878 -6.251849 18.01002544 C-6.25148974 17.30261239 -6.25113048 16.59519933 -6.25076034 15.86634951 C-6 14 -6 14 -4 11 C-3.855625 9.865625 -3.71125 8.73125 -3.5625 7.5625 C-3.00303507 4.01922213 -2.37832661 2.58513762 0 0 Z " fill="#5C8AE4" transform="translate(598,577)"/>
+<path d="M0 0 C3.24267403 0.27022284 4.72457708 0.7454705 7.14181137 2.97933483 C9.69214275 7.12514491 9.54566272 10.36666138 9.48101807 15.1431427 C9.48443577 16.06621411 9.48785347 16.98928551 9.49137473 17.94032878 C9.49796526 21.03450934 9.47595779 24.12782314 9.45410156 27.22192383 C9.45297334 29.43938171 9.45360645 31.65684108 9.45587158 33.8742981 C9.45702063 39.8966678 9.43348002 45.91871972 9.40557575 51.94101548 C9.38059416 58.23374721 9.37822265 64.52648598 9.37347412 70.81925964 C9.36244872 81.38208419 9.33745298 91.94480442 9.30175781 102.50756836 C9.26503258 113.38646868 9.23672335 124.2653373 9.21972656 135.14428711 C9.21867567 135.8150475 9.21762477 136.48580788 9.21654204 137.17689434 C9.21132182 140.54195701 9.20626701 143.90701989 9.20129442 147.27208292 C9.15946853 175.1814699 9.08909784 203.09072674 9 231 C7.89986572 231.4647876 6.79973145 231.9295752 5.66625977 232.40844727 C0.81790105 234.51315862 -3.52975735 237.19874597 -8 240 C-8.9590625 240.59748047 -8.9590625 240.59748047 -9.9375 241.20703125 C-12.9864755 243.10686355 -12.9864755 243.10686355 -15 246 C-16.94168103 247.12954935 -18.9287976 248.18195457 -20.9375 249.1875 C-22.01902344 249.73792969 -23.10054687 250.28835938 -24.21484375 250.85546875 C-25.13394531 251.23316406 -26.05304687 251.61085938 -27 252 C-27.66 251.67 -28.32 251.34 -29 251 C-27.47005208 249.76302083 -25.94010417 248.52604167 -24.41015625 247.2890625 C-22.86733563 246.0333609 -22.86733563 246.0333609 -22 244 C-20.33333333 243.66666667 -18.66666667 243.33333333 -17 243 C-16.505 242.01 -16.505 242.01 -16 241 C-13.47694792 239.31796528 -11.08103526 238.03130908 -8.25 236.9375 C-5.83767007 236.22002336 -5.83767007 236.22002336 -5 234 C-3.00882592 233.30741771 -1.0078864 232.64252365 1 232 C2.485 231.01 2.485 231.01 4 230 C5.32 230 6.64 230 8 230 C7.98747192 229.4255011 7.97494385 228.8510022 7.96203613 228.25909424 C7.7905369 220.25638002 7.63975058 212.25332847 7.5 204.25 C7.48812275 203.57042866 7.4762455 202.89085732 7.46400833 202.1906929 C6.91741304 170.44087195 6.91534881 138.69122549 6.9375 106.9375 C6.93878403 105.08379539 6.93878403 105.08379539 6.94009399 103.19264221 C6.95154635 87.7950805 6.97171162 72.39753965 7 57 C6.34 57 5.68 57 5 57 C5 39.84 5 22.68 5 5 C3.68 5 2.36 5 1 5 C0.67 3.35 0.34 1.7 0 0 Z " fill="#AFC8FE" transform="translate(1044,624)"/>
+<path d="M0 0 C2.89826128 1.41211945 5.59776451 1.32994104 8.80078125 1.46875 C13.85016976 1.76086338 18.15161859 2.45136563 22.98828125 3.96875 C24.52755429 4.13798944 26.06968825 4.2824594 27.61328125 4.40625 C31.48792207 4.76622508 33.68362694 5.88159991 36.98828125 7.96875 C40.68352077 8.68798208 40.68352077 8.68798208 43.98828125 8.96875 C43.98828125 9.62875 43.98828125 10.28875 43.98828125 10.96875 C49.92828125 11.46375 49.92828125 11.46375 55.98828125 11.96875 C55.98828125 13.28875 55.98828125 14.60875 55.98828125 15.96875 C56.77203125 16.0925 57.55578125 16.21625 58.36328125 16.34375 C60.98828125 16.96875 60.98828125 16.96875 62.98828125 18.96875 C64.99366454 19.19157037 67.00127952 19.41062467 69.015625 19.52734375 C70.98828125 19.96875 70.98828125 19.96875 72.375 21.38671875 C74.61667502 23.58497149 76.86085423 23.99767954 79.86328125 24.84375 C84.84614275 26.40276804 87.52097656 27.97609611 90.98828125 31.96875 C93.45959043 33.12396502 93.45959043 33.12396502 95.98828125 33.96875 C99.57683305 35.84846761 101.76234081 37.57126196 103.98828125 40.96875 C103.65828125 41.62875 103.32828125 42.28875 102.98828125 42.96875 C102.43140625 42.370625 101.87453125 41.7725 101.30078125 41.15625 C97.14291049 37.22312901 93.67930981 35.63049751 87.98828125 34.96875 C87.98828125 33.97875 87.98828125 32.98875 87.98828125 31.96875 C86.81265625 31.783125 86.81265625 31.783125 85.61328125 31.59375 C82.98828125 30.96875 82.98828125 30.96875 80.98828125 28.96875 C78.41766814 28.32107207 78.41766814 28.32107207 75.98828125 27.96875 C75.98828125 26.97875 75.98828125 25.98875 75.98828125 24.96875 C74.00828125 24.96875 72.02828125 24.96875 69.98828125 24.96875 C68.99828125 22.98875 68.99828125 22.98875 67.98828125 20.96875 C66.31765625 21.030625 66.31765625 21.030625 64.61328125 21.09375 C60.98828125 20.96875 60.98828125 20.96875 58.98828125 18.96875 C56.93013129 18.36266903 54.86780668 17.95700831 52.765625 17.53125 C51.88583984 17.2528125 51.88583984 17.2528125 50.98828125 16.96875 C50.65828125 16.30875 50.32828125 15.64875 49.98828125 14.96875 C47.6392025 14.27943656 47.6392025 14.27943656 44.92578125 13.84375 C44.00667969 13.67617187 43.08757812 13.50859375 42.140625 13.3359375 C41.07521484 13.15417969 41.07521484 13.15417969 39.98828125 12.96875 C39.98828125 11.97875 39.98828125 10.98875 39.98828125 9.96875 C38.89515625 9.845 37.80203125 9.72125 36.67578125 9.59375 C32.98828125 8.96875 32.98828125 8.96875 29.98828125 6.96875 C20.15731799 4.6362719 9.68858398 4.10013886 -0.33618164 3.02172852 C-1.44082764 2.89983154 -2.54547363 2.77793457 -3.68359375 2.65234375 C-4.68487305 2.54462646 -5.68615234 2.43690918 -6.71777344 2.32592773 C-9.01171875 1.96875 -9.01171875 1.96875 -10.01171875 0.96875 C-19.16728044 -0.52957627 -28.58771736 -0.16099294 -37.8359375 -0.12890625 C-39.43447322 -0.127037 -41.03300952 -0.1256155 -42.63154602 -0.12461853 C-46.80221183 -0.12083325 -50.97284182 -0.11103789 -55.14349365 -0.09991455 C-59.41401688 -0.08961381 -63.684546 -0.0851025 -67.95507812 -0.08007812 C-76.30730795 -0.06941132 -84.65950887 -0.05238392 -93.01171875 -0.03125 C-93.01171875 0.62875 -93.01171875 1.28875 -93.01171875 1.96875 C-100.41659862 3.52528597 -107.68233452 4.32109292 -115.23828125 4.72265625 C-117.91836161 4.66144563 -117.91836161 4.66144563 -119.01171875 5.96875 C-122.10020498 6.41695715 -125.18765286 6.78725426 -128.2890625 7.13085938 C-132.18175203 7.60119416 -135.42107649 8.42633498 -139.01171875 9.96875 C-140.22859375 10.13375 -141.44546875 10.29875 -142.69921875 10.46875 C-146.08303908 10.64430436 -146.08303908 10.64430436 -148.01171875 12.96875 C-151.13671875 13.09375 -151.13671875 13.09375 -154.01171875 12.96875 C-150.67964429 10.07129394 -146.96077026 8.53479794 -142.9375 6.8359375 C-141.04570574 6.12087622 -141.04570574 6.12087622 -140.01171875 4.96875 C-136.91022229 4.68474669 -133.80879229 4.5200029 -130.69921875 4.34765625 C-129.36890625 4.16009766 -129.36890625 4.16009766 -128.01171875 3.96875 C-127.68171875 3.30875 -127.35171875 2.64875 -127.01171875 1.96875 C-120.41171875 1.96875 -113.81171875 1.96875 -107.01171875 1.96875 C-107.01171875 1.30875 -107.01171875 0.64875 -107.01171875 -0.03125 C-80.40929862 -4.26779037 -24.47811956 -12.54800692 0 0 Z " fill="#4A6CAD" transform="translate(640.01171875,206.03125)"/>
+<path d="M0 0 C2.2477975 2.05233685 3.0022242 3.00667261 4 6 C4.09898864 9.04824754 4.13929542 12.07365651 4.13422108 15.12210846 C4.13657331 16.07184884 4.13892554 17.02158922 4.14134905 18.00010961 C4.14805638 21.21285291 4.1475803 24.42555593 4.14717102 27.63830566 C4.15046854 29.95277039 4.15419387 32.26723453 4.1583125 34.58169794 C4.16729824 40.29486217 4.17156209 46.00801656 4.17383147 51.7211871 C4.17679104 58.56172564 4.18548686 65.40225386 4.19424575 72.24278699 C4.21509868 88.77575446 4.22556034 105.30872373 4.23437535 121.84170129 C4.23857969 129.65863831 4.24380189 137.47557457 4.24905988 145.29251094 C4.26694867 172.03730848 4.28194685 198.78210624 4.28938007 225.52690887 C4.28985483 227.20617136 4.29033072 228.88543385 4.29080774 230.56469634 C4.29104411 231.39747659 4.29128049 232.23025684 4.29152403 233.08827286 C4.29272525 237.30770925 4.29394069 241.52714564 4.29516602 245.74658203 C4.29540617 246.58394785 4.29564632 247.42131366 4.29589374 248.2840542 C4.30379218 275.45257168 4.32723594 302.62104558 4.35972196 329.78954402 C4.39398581 358.49711681 4.41372789 387.20466409 4.41702431 415.91225767 C4.41744187 419.06086446 4.41792144 422.20947123 4.41844749 425.358078 C4.41857069 426.13338365 4.41869388 426.9086893 4.4188208 427.70748906 C4.42115685 440.20650132 4.43683898 452.70546309 4.45728934 465.20445733 C4.47750082 477.75608354 4.48304685 490.30764886 4.47351871 502.85928833 C4.46874803 509.66463404 4.470471 516.46982951 4.49028015 523.27515221 C4.5077598 529.49640594 4.50703895 535.71737319 4.49138286 541.93862933 C4.48898352 544.19766632 4.49344896 546.45672237 4.50521151 548.71573001 C4.52013945 551.77014002 4.51079127 554.82350948 4.49498463 557.87789154 C4.51031794 559.21484035 4.51031794 559.21484035 4.52596101 560.57879823 C4.45800766 566.5331532 4.45800766 566.5331532 1.96906346 569.07013178 C0.99437705 569.53041655 0.99437705 569.53041655 0 570 C0.875 565.125 0.875 565.125 2 564 C2.10090793 561.06678888 2.13543735 558.15702622 2.12863445 555.22327805 C2.13038749 554.28657479 2.13214053 553.34987153 2.13394669 552.38478333 C2.13864765 549.20432286 2.13613075 546.0239073 2.13371277 542.84344482 C2.13557869 540.55688065 2.13787851 538.27031679 2.14057809 535.98375344 C2.14672969 529.66778878 2.14655857 523.35183729 2.14538372 517.03587031 C2.14471776 510.93405587 2.14968327 504.83224467 2.1539966 498.73043214 C2.16368709 484.69982327 2.16648149 470.66921804 2.16705366 456.63860622 C2.16751256 445.80533737 2.16956755 434.97206996 2.17275429 424.13880157 C2.17365179 421.02452541 2.1745416 417.91024923 2.17542917 414.79597306 C2.17565021 414.02182861 2.17587126 413.24768415 2.17609901 412.45008077 C2.1822567 390.66268292 2.18619922 368.87528557 2.18575573 347.08788681 C2.18573236 345.85474381 2.18573236 345.85474381 2.18570852 344.59668882 C2.18562541 340.42963461 2.18552637 336.2625804 2.18542381 332.09552619 C2.18540387 331.267883 2.18538392 330.44023981 2.18536337 329.58751653 C2.18532294 327.91381819 2.18528114 326.24011986 2.18523798 324.56642153 C2.18462521 298.52555799 2.19213076 272.48470747 2.20581055 246.44384766 C2.22116108 217.2102511 2.22977737 187.9766631 2.22884732 158.74306226 C2.22877269 155.62752867 2.22872399 152.51199508 2.22869301 149.39646149 C2.22867553 148.24571413 2.22867553 148.24571413 2.22865769 147.07171936 C2.22862688 134.70876577 2.23502158 122.34582345 2.24362527 109.98287321 C2.25208984 97.56316358 2.25310113 85.14347048 2.24651595 72.72375956 C2.24313892 65.9911317 2.24323666 59.25854728 2.2518692 52.52592278 C2.259683 46.36870201 2.25835562 40.21155507 2.24958507 34.05433622 C2.2480387 31.82077882 2.24990854 29.58721604 2.25544515 27.35366496 C2.26244906 24.32904805 2.25725594 21.30469414 2.24888897 18.28008652 C2.25385715 17.40309571 2.25882533 16.52610491 2.26394406 15.62253863 C2.23798811 11.21609814 1.84556099 8.06813957 0 4 C0 2.68 0 1.36 0 0 Z " fill="#959DA9" transform="translate(558,588)"/>
+<path d="M0 0 C4.13347071 0.47239665 7.35761877 2.05174957 11 4 C10.67 4.66 10.34 5.32 10 6 C5.545 5.01 5.545 5.01 1 4 C1 69.01 1 134.02 1 201 C6.77260299 197.86824314 6.77260299 197.86824314 8 195 C9.66666667 194.66666667 11.33333333 194.33333333 13 194 C13.495 193.01 13.495 193.01 14 192 C16.5625 191.375 16.5625 191.375 19 191 C19.33 190.01 19.66 189.02 20 188 C21.98 188 23.96 188 26 188 C26.33 186.68 26.66 185.36 27 184 C27.9590625 183.814375 27.9590625 183.814375 28.9375 183.625 C29.618125 183.41875 30.29875 183.2125 31 183 C31.33 182.34 31.66 181.68 32 181 C33.66666667 180.66666667 35.33333333 180.33333333 37 180 C37.33 179.34 37.66 178.68 38 178 C39.66666667 177.66666667 41.33333333 177.33333333 43 177 C43.33 176.34 43.66 175.68 44 175 C46.32156597 174.59270772 48.6568787 174.25561323 51 174 C49.62864848 176.74270303 47.51141126 177.49605514 44.88671875 178.90234375 C42.93950509 179.98274016 42.93950509 179.98274016 41.0703125 181.47265625 C38.86121667 183.10238544 36.64994369 184.29010641 34.1875 185.5 C32.86878906 186.15162109 32.86878906 186.15162109 31.5234375 186.81640625 C29.48899089 187.77064359 27.40615836 188.6213281 25.3125 189.4375 C21.86985849 191.06138751 19.6856261 192.90838394 16.90625 195.44140625 C14.10399254 197.73259627 11.01763169 199.34500306 7.8203125 201.01953125 C6.03615104 201.86810718 6.03615104 201.86810718 5 203 C3.00041636 203.04080783 0.99954746 203.04254356 -1 203 C-1.02332572 176.67974346 -1.04097756 150.35948846 -1.05181217 124.03922367 C-1.05697583 111.81919574 -1.06401984 99.59917421 -1.07543945 87.37915039 C-1.08538417 76.7323487 -1.09185292 66.08555165 -1.09408849 55.43874544 C-1.09539596 49.79759328 -1.09848409 44.15645439 -1.10573006 38.51530647 C-1.11248693 33.21226576 -1.11461764 27.90924387 -1.11310768 22.60619926 C-1.11338416 20.65381137 -1.11539124 18.70142288 -1.11920547 16.7490387 C-1.12413754 14.09565409 -1.1230001 11.44234176 -1.12025452 8.78895569 C-1.12316736 8.00589697 -1.1260802 7.22283826 -1.12908131 6.41605049 C-1.11412121 1.11412121 -1.11412121 1.11412121 0 0 Z " fill="#9CBCFE" transform="translate(671,635)"/>
+<path d="M0 0 C2.5 1.75 2.5 1.75 5 4 C5 5.32 5 6.64 5 8 C6.32 8.33 7.64 8.66 9 9 C9.12375 10.11375 9.2475 11.2275 9.375 12.375 C9.6465813 16.03103677 9.6465813 16.03103677 12 18 C12.34375 20.0234375 12.34375 20.0234375 12.5 22.375 C12.66744595 24.87831689 12.80490767 26.63083338 13.98289162 28.85989255 C18.26800086 37.87623181 16.13633699 51.68353159 16.12025452 61.50749207 C16.120691 63.49276519 16.12156732 65.47803826 16.12284368 67.46331102 C16.12507354 72.89981942 16.12108803 78.33630803 16.11606562 83.77281392 C16.11173962 89.64247773 16.11320907 95.51214046 16.1139679 101.38180542 C16.11449177 111.54516552 16.11135924 121.70851919 16.10573006 131.87187767 C16.09983206 142.52752923 16.09596284 153.18317759 16.09487724 163.83883095 C16.0948085 164.50213492 16.09473976 165.16543889 16.09466894 165.84884298 C16.09433059 169.21762595 16.09402922 172.58640892 16.09374207 175.95519189 C16.09164339 199.79703397 16.08491086 223.6388727 16.07543945 247.48071289 C16.06625052 270.63826479 16.05916911 293.79581578 16.05493164 316.95336914 C16.05480011 317.66757513 16.05466859 318.38178113 16.05453308 319.11762973 C16.05321452 326.29018247 16.05193871 333.46273521 16.05069422 340.63528797 C16.04815822 355.24573504 16.04533696 369.85618205 16.04234314 384.46662903 C16.04220585 385.13834803 16.04206856 385.81006704 16.04192711 386.50214116 C16.03273126 431.33476218 16.01686578 476.16738129 16 521 C15.67 521 15.34 521 15 521 C14.99826375 519.99236371 14.9965275 518.98472741 14.99473864 517.94655669 C14.91814809 473.53446481 14.84034058 429.12237516 14.7563324 384.71029663 C14.75506072 384.03782266 14.75378904 383.36534868 14.75247882 382.67249671 C14.72483388 368.05750675 14.69697081 353.44251721 14.66888306 338.8275281 C14.65510998 331.66024667 14.6413851 324.49296516 14.62768555 317.32568359 C14.62563942 316.25584277 14.62563942 316.25584277 14.62355196 315.164389 C14.57936791 292.05042622 14.538366 268.93645914 14.49901587 245.82248767 C14.45855863 222.06808261 14.41488786 198.31368557 14.36717889 174.55929391 C14.33644357 159.2527145 14.30852982 143.9461358 14.28482103 128.63954394 C14.2690062 118.60830606 14.24958993 108.5770792 14.22733159 98.54585357 C14.21459201 92.75640353 14.20344993 86.96696192 14.19658089 81.17750168 C14.1902559 75.8761185 14.17940354 70.57476449 14.1649667 65.27339737 C14.16054328 63.35668082 14.15777423 61.43995957 14.15683801 59.52323814 C15.16076663 44.10720234 15.16076663 44.10720234 11 30 C10.855625 28.88625 10.71125 27.7725 10.5625 26.625 C9.98733351 22.91837153 8.96665154 21.11386493 7 18 C6.65939189 16.33480481 6.32441604 14.66842534 6 13 C5.34 12.67 4.68 12.34 4 12 C3.32060826 10.00428677 2.65438441 8.00405227 2 6 C1.34 5.34 0.68 4.68 0 4 C0 2.68 0 1.36 0 0 Z " fill="#4868A5" transform="translate(1103,334)"/>
+<path d="M0 0 C74.26436395 -0.86781803 74.26436395 -0.86781803 84 4 C85.46000808 4.19532662 86.92653089 4.34338995 88.39453125 4.46484375 C89.26787109 4.54283203 90.14121094 4.62082031 91.04101562 4.70117188 C92.8767093 4.85770389 94.71264823 5.01138797 96.54882812 5.16210938 C101.06974376 5.57068588 104.84322232 6.05557729 109 8 C110.36643325 8.34805375 111.74221721 8.66146921 113.125 8.9375 C119.35439739 10.26046567 125.68121461 11.64845844 131.58984375 14.0546875 C134.68205514 15.26751595 137.71321315 15.61331919 141 16 C141 16.99 141 17.98 141 19 C141.99 19.33 142.98 19.66 144 20 C141.69 19.67 139.38 19.34 137 19 C137 18.34 137 17.68 137 17 C135.01432292 17.06510417 133.02864583 17.13020833 131.04296875 17.1953125 C129 17 129 17 126 15 C123.32802965 14.57885802 123.32802965 14.57885802 120.4375 14.4375 C115.19236641 14.09618321 115.19236641 14.09618321 113 13 C113 12.34 113 11.68 113 11 C112.34 11.061875 111.68 11.12375 111 11.1875 C108 11 108 11 104.75 9.5625 C99.73792372 7.51166955 94.60015154 7.52204963 89.25488281 7.37915039 C88.55073242 7.3558667 87.84658203 7.33258301 87.12109375 7.30859375 C86.4964624 7.29626709 85.87183105 7.28394043 85.22827148 7.27124023 C83 7 83 7 79.98413086 6.00297546 C75.34995679 4.66371612 70.82053791 4.6925358 66.02563477 4.68115234 C65.04925552 4.67110672 64.07287628 4.6610611 63.06690979 4.65071106 C59.85841428 4.6199644 56.65000189 4.60286752 53.44140625 4.5859375 C51.20937896 4.56721902 48.97735869 4.5476451 46.74534607 4.5272522 C40.88465523 4.475997 35.02394147 4.43633581 29.16314697 4.39910889 C23.17706664 4.35902783 17.19108114 4.30795419 11.20507812 4.2578125 C-0.52988124 4.16113146 -12.26489423 4.0767016 -24 4 C-24.33 4.99 -24.66 5.98 -25 7 C-31.6 7 -38.2 7 -45 7 C-45.33 7.99 -45.66 8.98 -46 10 C-52.435 10.495 -52.435 10.495 -59 11 C-59.33 11.99 -59.66 12.98 -60 14 C-60.77085937 14.03738281 -61.54171875 14.07476562 -62.3359375 14.11328125 C-63.84027344 14.21189453 -63.84027344 14.21189453 -65.375 14.3125 C-66.87160156 14.39951172 -66.87160156 14.39951172 -68.3984375 14.48828125 C-69.25695312 14.65714844 -70.11546875 14.82601562 -71 15 C-71.99 16.485 -71.99 16.485 -73 18 C-74.65 17.67 -76.3 17.34 -78 17 C-75.42040522 13.77099674 -72.83075299 13.24240608 -68.875 12.375 C-65.12903172 11.80973147 -65.12903172 11.80973147 -62 10 C-59.2965852 9.46022423 -56.58104449 9.03533013 -53.859375 8.59765625 C-51.01621535 8.09158574 -51.01621535 8.09158574 -48.52734375 7 C-45.62441617 5.85139187 -42.89759448 5.39355744 -39.8125 4.9375 C-35.76973462 4.4001844 -35.76973462 4.4001844 -32 3 C-29.59439727 2.84391977 -27.21297228 2.74195542 -24.8046875 2.68359375 C-24.09724396 2.66281265 -23.38980042 2.64203156 -22.66091919 2.62062073 C-20.39904575 2.55518922 -18.13705538 2.49627026 -15.875 2.4375 C-14.34243578 2.39430867 -12.80988343 2.35069418 -11.27734375 2.30664062 C-7.51834927 2.19951445 -3.75923708 2.0982291 0 2 C0 1.34 0 0.68 0 0 Z " fill="#4D5B71" transform="translate(561,179)"/>
+<path d="M0 0 C0.33 0 0.66 0 1 0 C1.00135653 1.01165086 1.00271306 2.02330173 1.00411069 3.06560868 C1.06401087 47.63955787 1.12637152 92.21350314 1.20132446 136.78742981 C1.2030249 137.79929081 1.2030249 137.79929081 1.20475969 138.83159344 C1.22940975 153.49105668 1.25450256 168.15051912 1.28005161 182.80998082 C1.29257773 189.99872731 1.30500598 197.18747396 1.31738281 204.3762207 C1.31861614 205.09159656 1.31984946 205.80697241 1.32112016 206.54402632 C1.36106715 229.74143797 1.39454907 252.93885349 1.42468691 276.13627978 C1.45568533 299.96987303 1.49318899 323.80344736 1.53890612 347.63701714 C1.54535675 351.00148881 1.55173282 354.36596061 1.55806351 357.73043251 C1.55931181 358.39262448 1.56056012 359.05481644 1.56184625 359.73707483 C1.58299832 371.06575798 1.5960542 382.39443752 1.60726251 393.72313384 C1.61777788 403.78471419 1.63557177 413.84626499 1.65916704 423.90782311 C1.67257726 429.71894058 1.68270393 435.5300165 1.68421364 441.34115028 C1.68566513 446.65648693 1.69621249 451.9717234 1.71413441 457.2870293 C1.71900239 459.21442153 1.72047157 461.14182582 1.71827881 463.06922295 C1.71579433 465.68094832 1.72547363 468.29235184 1.73828697 470.90404034 C1.73463729 471.65938673 1.73098761 472.41473313 1.72722733 473.19296882 C1.76180941 477.26396333 2.28266807 480.31432843 4 484 C4.30890042 486.53767557 4.43666368 489.04499127 4.55859375 491.59765625 C5.07944481 494.43237663 6.23217488 495.76917306 8 498 C8.1875 500.75 8.1875 500.75 8 503 C8.99 503.33 9.98 503.66 11 504 C11.103125 505.051875 11.20625 506.10375 11.3125 507.1875 C11.98485228 510.91599898 13.06714408 512.83714485 15 516 C14.67 516.99 14.34 517.98 14 519 C7.42706503 506.1827768 7.42706503 506.1827768 6.4375 501.125 C6.19919538 498.92158536 6.19919538 498.92158536 4.54296875 497.65625 C2.627292 495.59992863 2.36635949 494.11767931 1.875 491.375 C1.50902407 488.40059351 1.50902407 488.40059351 0 486 C-0.09887694 483.42021618 -0.13177075 480.86719631 -0.12304783 478.28691006 C-0.12420167 477.4652066 -0.12535552 476.64350315 -0.12654433 475.79689959 C-0.12921851 473.00768204 -0.12468229 470.21852073 -0.12025452 467.42930603 C-0.12069006 465.42378986 -0.12156464 463.41827374 -0.12284368 461.41275793 C-0.12509206 455.87384522 -0.12106271 450.33495164 -0.11606562 444.79604137 C-0.11176619 438.83349472 -0.11320718 432.87094925 -0.1139679 426.90840149 C-0.11449345 416.56861565 -0.11137806 406.22883565 -0.10573006 395.88905144 C-0.09981952 385.04092313 -0.09596542 374.19279734 -0.09487724 363.34466743 C-0.0948085 362.67097164 -0.09473976 361.99727584 -0.09466894 361.30316502 C-0.09433062 357.88201216 -0.09402923 354.46085929 -0.09374207 351.03970642 C-0.09163986 326.78745556 -0.08489751 302.53520799 -0.07543945 278.28295898 C-0.06625983 254.71752947 -0.05917386 231.15210086 -0.05493164 207.58666992 C-0.05480011 206.86069027 -0.05466859 206.13471063 -0.05453308 205.3867316 C-0.05321459 198.09635886 -0.05193877 190.80598612 -0.05069422 183.51561337 C-0.04815779 168.66336805 -0.04533653 153.81112279 -0.04234314 138.95887756 C-0.04220585 138.27594724 -0.04206856 137.59301691 -0.04192711 136.88939172 C-0.03272146 91.2595931 -0.01685493 45.62979637 0 0 Z " fill="#BBC0C8" transform="translate(35,376)"/>
+<path d="M0 0 C1.38149095 3.73002558 0.43774626 5.40563435 -1 9 C-1.26570345 11.20738254 -1.43549467 13.40133943 -1.55859375 15.62109375 C-2 18 -2 18 -3.50354034 20.63401759 C-5.26813545 24.60311629 -5.42018456 27.97745785 -5.38476086 32.23462486 C-5.38991076 33.0519673 -5.39506067 33.86930973 -5.40036663 34.71142012 C-5.41400464 37.45582771 -5.40629514 40.1997583 -5.39872742 42.94418335 C-5.40416559 44.92926976 -5.41091662 46.91435294 -5.41886932 48.89943087 C-5.4369321 54.35866782 -5.43633296 59.81776899 -5.43273985 65.2770288 C-5.43211711 71.16248137 -5.44872571 77.04788796 -5.46325684 82.93331909 C-5.48607103 93.1316906 -5.49793281 103.33002789 -5.50238609 113.52842331 C-5.50706815 124.22450864 -5.51777735 134.920557 -5.53681374 145.61662674 C-5.53799386 146.28166076 -5.53917399 146.94669477 -5.54038988 147.63188133 C-5.54641529 151.0092493 -5.55255109 154.38661706 -5.55872939 157.76398475 C-5.60229233 181.68623433 -5.63200223 205.60848305 -5.65356445 229.53076172 C-5.67454364 252.7710091 -5.70179824 276.01123528 -5.73754883 299.25146484 C-5.73864831 299.96782252 -5.73974778 300.68418021 -5.74088058 301.42224569 C-5.75192891 308.61620012 -5.76310482 315.81015434 -5.7743742 323.00410843 C-5.79732836 337.65903871 -5.81943097 352.31397023 -5.84101868 366.96890259 C-5.8420123 367.64271353 -5.84300591 368.31652447 -5.84402964 369.01075393 C-5.91028488 414.00715205 -5.95662773 459.00357467 -6 504 C-6.33 504 -6.66 504 -7 504 C-7 342.3 -7 180.6 -7 14 C-5.68 13.34 -4.36 12.68 -3 12 C-2.37323909 9.91203981 -2.37323909 9.91203981 -2.375 7.5625 C-2.22297607 4.01332594 -2.072003 3.1080045 0 0 Z " fill="#707C8D" transform="translate(41,352)"/>
+<path d="M0 0 C0.53625 0.268125 1.0725 0.53625 1.625 0.8125 C-0.06770833 1.75651042 -1.76041667 2.70052083 -3.453125 3.64453125 C-5.42613077 4.79491029 -5.42613077 4.79491029 -7.30859375 6.3046875 C-9.51692116 7.91605684 -11.70488539 8.98729787 -14.1875 10.125 C-18.35970477 12.14361084 -21.45979059 14.46140759 -24.83984375 17.59375 C-26.88733042 19.2192356 -28.81603664 19.51144549 -31.375 19.8125 C-31.705 20.4725 -32.035 21.1325 -32.375 21.8125 C-34.61823529 23.14263756 -36.92508544 24.30764808 -39.24609375 25.49609375 C-41.65470023 26.78143341 -41.65470023 26.78143341 -43.375 29.8125 C-46.91329881 32.39450183 -49.05796893 32.96435536 -53.375 32.8125 C-53.36120107 47.75498208 -53.31900851 62.69718231 -53.24290943 77.63947773 C-53.20823973 84.57731462 -53.18290136 91.51495242 -53.17944336 98.45288086 C-53.17608204 105.14446891 -53.14683228 111.83548013 -53.10156822 118.52693748 C-53.08854686 121.08385492 -53.08430181 123.64083215 -53.08884621 126.1977787 C-53.09371897 129.77083508 -53.06780499 133.34240871 -53.03442383 136.9152832 C-53.04304947 137.97983231 -53.05167511 139.04438141 -53.06056213 140.14118958 C-53.01880952 142.79520326 -52.95127087 145.22170725 -52.375 147.8125 C-50.12263922 150.04098911 -50.12263922 150.04098911 -47.375 150.8125 C-43.67116116 153.05023596 -40.08027022 155.22477482 -36.75 158 C-34.03312711 160.07340299 -31.6294709 160.8162334 -28.375 161.8125 C-24.27551576 163.58090497 -21.75140378 164.98384946 -19.375 168.8125 C-23.52476705 168.20224014 -26.66996658 166.74220491 -30.375 164.8125 C-31.303125 164.461875 -32.23125 164.11125 -33.1875 163.75 C-35.375 162.8125 -35.375 162.8125 -36.375 160.8125 C-37.014375 160.503125 -37.65375 160.19375 -38.3125 159.875 C-40.375 158.8125 -40.375 158.8125 -42.375 155.8125 C-43.261875 155.544375 -44.14875 155.27625 -45.0625 155 C-49.47716604 153.41738387 -52.59089344 151.66346557 -55.375 147.8125 C-56.4154019 143.56678704 -56.32887475 139.40874767 -56.27734375 135.0546875 C-56.28968048 133.78190948 -56.30201721 132.50913147 -56.31472778 131.19778442 C-56.34741887 127.74300723 -56.33751288 124.28955154 -56.31941605 120.8347168 C-56.30785428 117.24514757 -56.33562572 113.6558861 -56.35913086 110.06640625 C-56.39634595 103.46628248 -56.39885459 96.86668806 -56.38506603 90.26649094 C-56.37030798 82.84683426 -56.39220337 75.4274517 -56.4140625 68.0078125 C-56.44305583 55.94249361 -56.42595114 43.87773084 -56.375 31.8125 C-55.570625 31.52375 -54.76625 31.235 -53.9375 30.9375 C-51.2423532 30.07987432 -51.2423532 30.07987432 -50.375 27.8125 C-47.8125 27.1875 -47.8125 27.1875 -45.375 26.8125 C-45.375 25.8225 -45.375 24.8325 -45.375 23.8125 C-44.570625 23.52375 -43.76625 23.235 -42.9375 22.9375 C-40.2423532 22.07987432 -40.2423532 22.07987432 -39.375 19.8125 C-37.71427151 19.13117549 -36.047233 18.46507873 -34.375 17.8125 C-33.715 17.1525 -33.055 16.4925 -32.375 15.8125 C-31.694375 15.6475 -31.01375 15.4825 -30.3125 15.3125 C-29.673125 15.1475 -29.03375 14.9825 -28.375 14.8125 C-28.045 14.1525 -27.715 13.4925 -27.375 12.8125 C-22.39207962 9.92020552 -17.14280895 7.05903 -11.5 5.75 C-8.45723314 4.83716994 -7.44778367 4.17776383 -5.1875 2.125 C-2.375 -0.1875 -2.375 -0.1875 0 0 Z " fill="#80A9FD" transform="translate(1018.375,645.1875)"/>
+<path d="M0 0 C1.485 0.99 1.485 0.99 3 2 C3.38063221 4.3260857 3.71269945 6.66055264 4 9 C4.99 10.485 4.99 10.485 6 12 C6.19321964 14.71998597 6.2679718 17.33709476 6.25168228 20.05733395 C6.25458916 20.89196532 6.25749604 21.72659669 6.26049101 22.58651993 C6.26784064 25.40776294 6.26082465 28.22879183 6.25396729 31.05003357 C6.25626976 33.08329968 6.25944484 35.11656497 6.26342177 37.14982849 C6.27180779 42.75632632 6.26762729 48.36275647 6.26144934 53.96925461 C6.25694132 60.00819438 6.26390039 66.04712215 6.26940918 72.08605957 C6.27780695 83.2392457 6.27705319 94.39241003 6.27158624 105.54559572 C6.26656066 115.84860181 6.26523914 126.15159995 6.26763153 136.45460701 C6.26786069 137.47863038 6.26786069 137.47863038 6.26809447 138.52334108 C6.26871712 141.29438721 6.26935392 144.06543333 6.270014 146.83647944 C6.27613609 172.84697953 6.27057872 198.8574658 6.2598202 224.86796375 C6.25032961 247.98888754 6.25117689 271.1097893 6.26074219 294.23071289 C6.2714463 320.19128208 6.27570089 346.15183904 6.26951766 372.11241013 C6.2688762 374.87879916 6.26825052 377.64518819 6.26763153 380.41157722 C6.2673943 381.43335322 6.2673943 381.43335322 6.26715227 382.47577115 C6.26487509 392.77291264 6.26754206 403.07004532 6.27259064 413.36718559 C6.27830143 425.073545 6.27670295 436.77988337 6.26602915 448.48624115 C6.26075957 454.46333405 6.2587375 460.44038215 6.26532745 466.41747475 C6.27126254 471.88312827 6.26805235 477.34869523 6.25737235 482.81434084 C6.2551279 484.79748466 6.25629781 486.78063571 6.26112393 488.76377492 C6.26715842 491.4482306 6.26101548 494.13238526 6.25168228 496.81682491 C6.25636461 497.59640162 6.26104695 498.37597832 6.26587117 499.17917857 C6.2392436 502.98101215 6.02631605 505.74565276 4 509 C3.55499715 511.12593058 3.55499715 511.12593058 3.375 513.25 C3.25125 514.4875 3.1275 515.725 3 517 C2.67 517 2.34 517 2 517 C1.94583812 515.39620659 1.90713362 513.79188594 1.875 512.1875 C1.85179687 511.29417969 1.82859375 510.40085937 1.8046875 509.48046875 C2 507 2 507 4 504 C4.19312108 501.31597733 4.26799047 498.73623014 4.25168228 496.05198765 C4.25458916 495.22917489 4.25749604 494.40636213 4.26049101 493.55861565 C4.26784011 490.77757542 4.2608249 487.99675244 4.25396729 485.2157135 C4.25626978 483.21132097 4.25944488 481.20692929 4.26342177 479.20253938 C4.2718075 473.67585225 4.26762742 468.14923377 4.26144934 462.62254632 C4.2569412 456.66949685 4.26390045 450.71645955 4.26940918 444.76341248 C4.27780683 433.76891883 4.27705325 422.7744457 4.27158624 411.77995125 C4.2665606 401.62352082 4.26523917 391.46709846 4.26763153 381.31066704 C4.2677843 380.63768922 4.26793707 379.9647114 4.26809447 379.27134032 C4.26871712 376.53968283 4.26935392 373.80802534 4.270014 371.07636786 C4.27613605 345.43572907 4.27057878 319.79510431 4.2598202 294.15446769 C4.25032963 271.36249243 4.25117688 248.57053952 4.26074219 225.77856445 C4.27144639 200.18715921 4.27570084 174.59576636 4.26951766 149.00435919 C4.2688762 146.27728904 4.26825052 143.55021888 4.26763153 140.82314873 C4.26747338 140.15164679 4.26731522 139.48014485 4.26715227 138.78829436 C4.26487513 128.63767383 4.267542 118.48706224 4.27259064 108.33644295 C4.27830153 96.79660172 4.27670275 85.25678561 4.26602915 73.71694738 C4.2607597 67.82491547 4.25873728 61.93292899 4.26532745 56.04089737 C4.27126281 50.65296116 4.26805191 45.26511275 4.25737235 39.87718456 C4.25512802 37.92230436 4.25629755 35.96741683 4.26112393 34.0125413 C4.26715902 31.36620485 4.26101487 28.72017369 4.25168228 26.07385349 C4.25636461 25.30550721 4.26104695 24.53716092 4.26587117 23.74553141 C4.23892184 19.9517628 3.97528967 17.26016289 2 14 C1.62109375 11.30859375 1.62109375 11.30859375 1.4375 8.4375 C1.23116194 5.33400708 0.98863604 2.96590813 0 0 Z " fill="#6191F2" transform="translate(1111,355)"/>
+<path d="M0 0 C2.25 0.75 2.25 0.75 3.25 1.75 C3.37290595 3.26577226 3.42723834 4.78715732 3.45433044 6.30766296 C3.4740711 7.29679121 3.49381176 8.28591946 3.51415062 9.30502129 C3.53892951 10.95167369 3.53892951 10.95167369 3.56420898 12.6315918 C3.59519652 14.36149447 3.59519652 14.36149447 3.62681007 16.12634468 C3.68193455 19.32857577 3.73195202 22.53083141 3.77869725 25.73319459 C3.80870243 27.76909257 3.84036872 29.80495906 3.8724041 31.84082603 C4.37433622 64.0951683 4.36999201 96.34895482 4.32202756 128.6063565 C4.31049221 136.50833233 4.30526454 144.41030948 4.30032361 152.31229174 C4.29009895 168.45820432 4.2727229 184.60409984 4.25 200.75 C-1.35642214 199.3808527 -5.47857463 197.34759978 -10.1015625 193.92578125 C-11.89868084 192.6439504 -13.72983386 191.6388731 -15.75 190.75 C-13.77 190.75 -11.79 190.75 -9.75 190.75 C-9.42 191.41 -9.09 192.07 -8.75 192.75 C-7.10636866 193.47159424 -5.43949614 194.14351421 -3.75 194.75 C-3.75 195.41 -3.75 196.07 -3.75 196.75 C-2.1 196.75 -0.45 196.75 1.25 196.75 C1.27332856 179.55661031 1.29097896 162.36322553 1.30181217 145.16982365 C1.30697522 137.187185 1.31401809 129.20455617 1.32543945 121.22192383 C1.33538602 114.26676201 1.34185336 107.31160731 1.34408849 100.35643858 C1.34539565 96.67148073 1.34848179 92.98654322 1.35573006 89.30159187 C1.3637434 85.19462292 1.36399116 81.08768963 1.36352539 76.98071289 C1.36712067 75.75001068 1.37071594 74.51930847 1.37442017 73.25131226 C1.3730455 72.13926926 1.37167084 71.02722626 1.37025452 69.88148499 C1.37117631 68.90899339 1.3720981 67.93650179 1.37304783 66.93454075 C1.49460337 64.77252944 1.49460337 64.77252944 0.25 63.75 C0.15608704 61.84756238 0.13256342 59.94161541 0.13647461 58.03686523 C0.13655014 56.8156749 0.13662567 55.59448456 0.13670349 54.33628845 C0.14181089 52.99372314 0.14702689 51.65115825 0.15234375 50.30859375 C0.15420801 48.94238842 0.15563187 47.57618243 0.15663147 46.2099762 C0.16045606 42.60798305 0.17028583 39.00603 0.18133545 35.40405273 C0.19155084 31.73096255 0.19612936 28.05786591 0.20117188 24.38476562 C0.21190816 17.17315877 0.22898386 9.961585 0.25 2.75 C-3.54303725 3.75193437 -6.46536341 4.56024227 -9.75 6.75 C-10.74 6.75 -11.73 6.75 -12.75 6.75 C-12.75 7.41 -12.75 8.07 -12.75 8.75 C-13.41 8.42 -14.07 8.09 -14.75 7.75 C-13.24079343 4.73158687 -10.74339947 4.18913436 -7.75 2.75 C-6.904375 2.1725 -6.05875 1.595 -5.1875 1 C-2.75 -0.25 -2.75 -0.25 0 0 Z " fill="#8AAFFD" transform="translate(1034.75,636.25)"/>
+<path d="M0 0 C2.92622891 1.44637402 5.81786939 2.94423332 8.6875 4.5 C9.47511719 4.9228125 10.26273438 5.345625 11.07421875 5.78125 C13 7 13 7 14 9 C14.11528424 10.51001166 14.16998623 12.02485124 14.1942749 13.5390625 C14.21154633 14.49498795 14.22881775 15.45091339 14.24661255 16.43580627 C14.26714188 18.01445717 14.26714188 18.01445717 14.28808594 19.625 C14.30590118 20.73088974 14.32371643 21.83677948 14.34207153 22.97618103 C14.49666486 33.19299702 14.58550254 43.4108152 14.65206528 53.6285553 C14.70222241 61.1750629 14.78800087 68.71938542 14.92068648 76.26490211 C15.02183937 82.21919708 15.06228123 88.17302908 15.0825882 94.12817383 C15.10035254 96.65442404 15.13715478 99.18061672 15.19359589 101.70629883 C15.6592598 123.57839462 15.6592598 123.57839462 10.27985001 129.33900452 C6.82507292 132.36190877 4.25608732 133.92130219 -0.362854 134.21069336 C-1.23311218 134.14116455 -2.10337036 134.07163574 -3 134 C-3.33 134.99 -3.66 135.98 -4 137 C-7.0625 138.1875 -7.0625 138.1875 -10 139 C-10 138.34 -10 137.68 -10 137 C-8.7934375 136.566875 -8.7934375 136.566875 -7.5625 136.125 C-4.8673532 135.26737432 -4.8673532 135.26737432 -4 133 C-3.01 132.67 -2.02 132.34 -1 132 C-0.34 131.01 0.32 130.02 1 129 C3.97 127.68 6.94 126.36 10 125 C10 86.39 10 47.78 10 8 C6.7 6.35 3.4 4.7 0 3 C0 2.01 0 1.02 0 0 Z " fill="#88AEFD" transform="translate(732,670)"/>
+<path d="M0 0 C0.83917969 0.27457031 1.67835938 0.54914062 2.54296875 0.83203125 C3.85201172 1.31736328 3.85201172 1.31736328 5.1875 1.8125 C6.50814453 2.28623047 6.50814453 2.28623047 7.85546875 2.76953125 C10 4 10 4 10.80078125 6.13671875 C10.86652344 6.75160156 10.93226563 7.36648438 11 8 C11.680625 8.061875 12.36125 8.12375 13.0625 8.1875 C16.47124485 9.13034432 18.45019686 10.69058371 21.234375 12.796875 C23.66351168 14.45212743 26.19159648 15.18868343 29 16 C32.30706008 17.3779417 32.91162262 17.86743394 35 21 C37.54609974 22.43019872 40.06012478 23.73961802 42.6875 25 C43.38294922 25.34289062 44.07839844 25.68578125 44.79492188 26.0390625 C48.14510164 27.6781794 51.50194473 29.22001973 54.95703125 30.625 C58 32 58 32 59 34 C59.825 34.495 60.65 34.99 61.5 35.5 C64 37 64 37 65 39 C63.68 39 62.36 39 61 39 C61 38.34 61 37.68 61 37 C59.68 36.34 58.36 35.68 57 35 C57 34.34 57 33.68 57 33 C56.13375 32.9175 55.2675 32.835 54.375 32.75 C50.47227743 31.88272832 48.29164311 30.23831732 45 28 C43.00486291 27.15467083 40.98660331 26.4327373 38.9453125 25.70703125 C33.41078996 23.69548792 29.45779382 20.79386708 25 17 C21.47384866 14.61984785 18.06931119 13.23025687 14 12 C14 11.34 14 10.68 14 10 C12.35 9.34 10.7 8.68 9 8 C9 7.34 9 6.68 9 6 C8.030625 5.690625 7.06125 5.38125 6.0625 5.0625 C3 4 3 4 2 3 C-0.29615554 2.76180772 -0.29615554 2.76180772 -2.9375 2.75 C-3.83339844 2.72421875 -4.72929688 2.6984375 -5.65234375 2.671875 C-6.42707031 2.78015625 -7.20179688 2.8884375 -8 3 C-8.66 3.99 -9.32 4.98 -10 6 C-13.16588074 8.28095986 -16.01601747 10 -20 10 C-20.33 10.99 -20.66 11.98 -21 13 C-22.99054876 13.69437747 -24.99255385 14.35610218 -27 15 C-29.03833424 16.2739589 -31.03852126 17.61061923 -33 19 C-36.61812613 21.5105365 -39.92752672 23.37101069 -44 25 C-44.33 25.66 -44.66 26.32 -45 27 C-45.99 27.33 -46.98 27.66 -48 28 C-48.33 28.66 -48.66 29.32 -49 30 C-49.804375 30.144375 -50.60875 30.28875 -51.4375 30.4375 C-54.34440658 30.76502717 -54.34440658 30.76502717 -56 34 C-58.171875 35.28125 -58.171875 35.28125 -60.75 36.5 C-61.64847656 36.933125 -62.54695312 37.36625 -63.47265625 37.8125 C-64.72369141 38.4003125 -64.72369141 38.4003125 -66 39 C-69.99108683 40.87815851 -73.37949031 42.97579171 -76.92578125 45.59765625 C-80.37628728 47.93048424 -84.06321593 49.82088254 -87.7421875 51.765625 C-89.90355702 52.80981157 -89.90355702 52.80981157 -91 54 C-92.66617115 54.04063832 -94.33388095 54.042721 -96 54 C-96.33 54.99 -96.66 55.98 -97 57 C-98.65204456 57.70211894 -100.31923769 58.36971413 -102 59 C-102.33 59.66 -102.66 60.32 -103 61 C-104.97888961 61.72693904 -106.97954558 62.39816251 -109 63 C-102 56 -102 56 -99.9375 55.5 C-98.9784375 55.2525 -98.9784375 55.2525 -98 55 C-97.67 54.34 -97.34 53.68 -97 53 C-94.10693136 50.98361883 -91.24740045 49.69873448 -87.9375 48.5625 C-84.41443752 47.31557339 -82.60462142 45.69443596 -80 43 C-77.25 42.25 -77.25 42.25 -75 42 C-74.67 41.01 -74.34 40.02 -74 39 C-71.82421875 38.015625 -71.82421875 38.015625 -69 37 C-55.39645888 31.26652235 -55.39645888 31.26652235 -45 22 C-42.52201062 20.90311223 -39.99451293 20.01551704 -37.4453125 19.09765625 C-35.00030345 18.00013621 -33.85564226 16.8609441 -32 15 C-31.01 15 -30.02 15 -29 15 C-28.92652344 14.38253906 -28.85304688 13.76507812 -28.77734375 13.12890625 C-28 11 -28 11 -26.00390625 9.83984375 C-25.19824219 9.54207031 -24.39257812 9.24429688 -23.5625 8.9375 C-20.00134349 7.6056389 -19.20304684 7.30457026 -17 4 C-14.875 3 -14.875 3 -12 2 C-11.35160156 1.72800781 -10.70320312 1.45601562 -10.03515625 1.17578125 C-9.34292969 0.89089844 -8.65070313 0.60601563 -7.9375 0.3125 C-7.28652344 0.04050781 -6.63554688 -0.23148438 -5.96484375 -0.51171875 C-3.54870827 -1.11215003 -2.35073505 -0.78652413 0 0 Z " fill="#BBD1FE" transform="translate(857,513)"/>
+<path d="M0 0 C1.31942093 -0.00095673 2.63884186 -0.00191345 3.99824524 -0.00289917 C6.77073355 -0.0043616 9.54318934 -0.00226788 12.31567383 0.00244141 C15.84911768 0.00815466 19.38248581 0.00484034 22.91592693 -0.00113106 C26.31895721 -0.00563307 29.72196759 -0.00247295 33.125 0 C35.01275398 -0.00303635 35.01275398 -0.00303635 36.93864441 -0.00613403 C53.76909866 0.03862991 53.76909866 0.03862991 55.86328125 2.1328125 C57.42276667 2.28967499 58.98870793 2.38357889 60.5546875 2.44921875 C61.97104492 2.51206055 61.97104492 2.51206055 63.41601562 2.57617188 C64.90584961 2.63514648 64.90584961 2.63514648 66.42578125 2.6953125 C67.92141602 2.76008789 67.92141602 2.76008789 69.44726562 2.82617188 C71.91912275 2.93261548 74.39108435 3.03463178 76.86328125 3.1328125 C77.19328125 4.1228125 77.52328125 5.1128125 77.86328125 6.1328125 C78.85328125 6.6278125 78.85328125 6.6278125 79.86328125 7.1328125 C78.38457154 7.18837988 76.90519881 7.22628762 75.42578125 7.2578125 C74.60207031 7.28101563 73.77835938 7.30421875 72.9296875 7.328125 C70.36998348 7.16508653 68.31648583 6.79829744 65.85131836 6.18847656 C60.58984137 4.99607629 55.36017563 4.4704791 49.98828125 4.046875 C48.43657227 3.92150864 48.43657227 3.92150864 46.85351562 3.79360962 C34.5359979 2.86608708 22.21009191 2.67803996 9.86328125 2.5078125 C7.51561296 2.46948057 5.16795643 2.4304211 2.8203125 2.390625 C-2.83192404 2.29634975 -8.48423606 2.2108656 -14.13671875 2.1328125 C-14.13671875 2.7928125 -14.13671875 3.4528125 -14.13671875 4.1328125 C-22.1516387 5.0412937 -30.12944331 5.42512791 -38.18945312 5.65039062 C-43.49985262 5.84652385 -48.04576656 6.46748859 -53.13671875 8.1328125 C-54.81961358 8.48866691 -56.50694556 8.82462616 -58.19921875 9.1328125 C-61.02586074 9.6750837 -63.58469297 10.28213724 -66.32421875 11.1953125 C-69.13671875 12.1328125 -69.13671875 12.1328125 -72.76171875 12.6328125 C-75.98413891 12.9299264 -75.98413891 12.9299264 -78.0625 14.1015625 C-80.94893251 15.53662499 -83.86691364 15.97561491 -87.015625 16.5703125 C-89.41325597 17.08397591 -89.41325597 17.08397591 -92.13671875 19.1328125 C-99.38062119 21.63525152 -99.38062119 21.63525152 -103.13671875 20.1328125 C-100.51247217 18.38331478 -98.57944659 17.47891269 -95.63671875 16.5078125 C-94.86328125 16.24742187 -94.08984375 15.98703125 -93.29296875 15.71875 C-91.13671875 15.1328125 -91.13671875 15.1328125 -88.13671875 15.1328125 C-88.13671875 14.4728125 -88.13671875 13.8128125 -88.13671875 13.1328125 C-86.48671875 13.1328125 -84.83671875 13.1328125 -83.13671875 13.1328125 C-82.80671875 12.1428125 -82.47671875 11.1528125 -82.13671875 10.1328125 C-81.2446875 10.08382812 -80.35265625 10.03484375 -79.43359375 9.984375 C-78.263125 9.90960938 -77.09265625 9.83484375 -75.88671875 9.7578125 C-74.14648438 9.65339844 -74.14648438 9.65339844 -72.37109375 9.546875 C-69.3002097 9.1537425 -67.82820926 8.48112108 -65.13671875 7.1328125 C-62.60408538 6.7083953 -60.12148315 6.35279602 -57.57421875 6.0703125 C-52.28460096 5.4683292 -52.28460096 5.4683292 -47.13671875 4.1328125 C-45.43804687 3.98503314 -43.73494386 3.88534184 -42.03125 3.81640625 C-41.04833984 3.77451172 -40.06542969 3.73261719 -39.05273438 3.68945312 C-38.02857422 3.65013672 -37.00441406 3.61082031 -35.94921875 3.5703125 C-34.91345703 3.52712891 -33.87769531 3.48394531 -32.81054688 3.43945312 C-30.25273685 3.33336884 -27.6948303 3.23131104 -25.13671875 3.1328125 C-25.13671875 2.4728125 -25.13671875 1.8128125 -25.13671875 1.1328125 C-16.74206659 0.19153802 -8.44228735 -0.01364479 0 0 Z " fill="#B3B9C2" transform="translate(575.13671875,176.8671875)"/>
+<path d="M0 0 C4.46285528 1.41505167 8.71026274 3.12811465 13 5 C13.928125 5.33 14.85625 5.66 15.8125 6 C18 7 18 7 20 10 C21.485 10.495 21.485 10.495 23 11 C23.66 11.99 24.32 12.98 25 14 C25.99 14.33 26.98 14.66 28 15 C28 51.96 28 88.92 28 127 C21.64705882 125.94117647 21.64705882 125.94117647 18 123 C16.3523962 122.28752268 14.68236471 121.62599617 13 121 C11.72670162 120.4641536 10.45593173 119.92226692 9.1875 119.375 C7.6096875 118.694375 7.6096875 118.694375 6 118 C6 117.34 6 116.68 6 116 C5.29875 115.9175 4.5975 115.835 3.875 115.75 C0.3096548 114.81990995 -2.09015572 113.23313631 -5 111 C-5 110.34 -5 109.68 -5 109 C-5.61875 108.896875 -6.2375 108.79375 -6.875 108.6875 C-9 108 -9 108 -11 105 C-9.68 105.33 -8.36 105.66 -7 106 C-7 106.66 -7 107.32 -7 108 C-6.29875 108.0825 -5.5975 108.165 -4.875 108.25 C-1.34019913 109.17212197 0.97988738 110.9660466 4 113 C5.4540625 113.4640625 5.4540625 113.4640625 6.9375 113.9375 C9.66614103 114.88417138 11.07520878 115.67898892 13.3125 117.375 C17.64787476 120.64555273 17.64787476 120.64555273 26 124 C26 88.36 26 52.72 26 16 C23.525 15.505 23.525 15.505 21 15 C19 14 19 14 18.1875 12.125 C16.05585746 8.31048176 12.39683301 7.17007129 8.5 5.5 C5.46056486 4.19738494 2.74727587 2.83151724 0 1 C0 0.67 0 0.34 0 0 Z " fill="#ABC6FE" transform="translate(823,723)"/>
+<path d="M0 0 C1.27875 -0.061875 2.5575 -0.12375 3.875 -0.1875 C4.95394531 -0.23970703 4.95394531 -0.23970703 6.0546875 -0.29296875 C6.69664062 -0.19628906 7.33859375 -0.09960938 8 0 C8.99 1.485 8.99 1.485 10 3 C12.37421026 4.37277467 12.37421026 4.37277467 15.0625 5.5625 C19.89375582 7.78751165 19.89375582 7.78751165 21 10 C23.24937226 11.08726996 25.54904372 11.98172359 27.87109375 12.90234375 C30 14 30 14 32 17 C33.97033426 18.05725253 35.97843296 19.04435012 38 20 C44.94181466 23.69545771 51.68092236 27.67664565 58.125 32.1875 C60.93633426 34.11951714 60.93633426 34.11951714 64.1875 35.0625 C66.9783494 35.99278313 68.16786789 36.76072742 70 39 C68.02 39 66.04 39 64 39 C63.67 38.34 63.34 37.68 63 37 C61.11732556 35.93738621 59.19300583 34.94780772 57.25 34 C55.67992187 33.2265625 55.67992187 33.2265625 54.078125 32.4375 C51.41310545 31.19292234 48.74379273 30.05686831 46 29 C46 28.34 46 27.68 46 27 C45.29875 26.9175 44.5975 26.835 43.875 26.75 C40.3096548 25.81990995 37.90984428 24.23313631 35 22 C35 21.34 35 20.68 35 20 C34.33613281 19.84144531 33.67226563 19.68289063 32.98828125 19.51953125 C27.36480889 18.03362104 23.70373978 16.7454166 20 12 C19.649375 11.2575 19.29875 10.515 18.9375 9.75 C18.4734375 8.88375 18.4734375 8.88375 18 8 C16.67638484 7.62995705 15.34073169 7.30220428 14 7 C12.70355398 6.4698743 11.41186037 5.92798819 10.125 5.375 C6.37592015 3.96038437 3.89507277 3.67213428 0 5 C-0.66 5.680625 -1.32 6.36125 -2 7.0625 C-4 9 -4 9 -7.25 9.25 C-8.1575 9.1675 -9.065 9.085 -10 9 C-10.33 9.99 -10.66 10.98 -11 12 C-13.046875 13.32421875 -13.046875 13.32421875 -15.75 14.6875 C-21.35460438 17.61418636 -26.69211833 20.82789189 -32.0546875 24.16796875 C-34.68798541 25.80592196 -37.33785064 27.40956938 -40 29 C-40.81339844 29.495 -41.62679687 29.99 -42.46484375 30.5 C-46.9029205 33.192293 -51.33114651 35.72251049 -56 38 C-56.99 38.66 -57.98 39.32 -59 40 C-59.99 40 -60.98 40 -62 40 C-62.33 40.99 -62.66 41.98 -63 43 C-65.37938535 44.65235094 -67.6814697 45.87426435 -70.375 46.9375 C-72.66610015 47.86485006 -74.52992499 48.90228592 -76.625 50.1875 C-77.73875 50.785625 -78.8525 51.38375 -80 52 C-80.99 51.67 -81.98 51.34 -83 51 C-80.69852146 47.54778219 -79.76852609 47.37037312 -76 46 C-75.030625 45.505 -74.06125 45.01 -73.0625 44.5 C-70 43 -70 43 -66.6875 41.9375 C-63.86026986 41.30155523 -63.86026986 41.30155523 -63 39 C-61.0282696 37.94535351 -59.02237052 36.95394836 -57 36 C-53.73428626 34.43517883 -50.80398241 32.86547813 -47.8125 30.8125 C-45 29 -45 29 -42 29 C-41.7525 28.195625 -41.505 27.39125 -41.25 26.5625 C-40.8375 25.716875 -40.425 24.87125 -40 24 C-37.9375 23.3125 -37.9375 23.3125 -36 23 C-35.67 22.34 -35.34 21.68 -35 21 C-32.48810588 19.90575335 -29.92891181 19.01502333 -27.34765625 18.09765625 C-24.69522955 17.10486973 -24.69522955 17.10486973 -23 14 C-20.30556809 12.72762937 -17.59889725 11.87658377 -14.75 11 C-11.86786388 10.30884829 -11.86786388 10.30884829 -11 8 C-9.02 8 -7.04 8 -5 8 C-5 7.01 -5 6.02 -5 5 C-4.01 5 -3.02 5 -2 5 C-1.34 3.35 -0.68 1.7 0 0 Z " fill="#B9D0FE" transform="translate(850,620)"/>
+<path d="M0 0 C5.75 2.75 5.75 2.75 8 5 C9.99541868 5.68025637 11.99617991 6.34490497 14 7 C18.29940428 8.97056029 22.0718048 11.3812032 26 14 C28.74363883 15.42669219 31.50302128 16.77165843 34.3125 18.0625 C36 19 36 19 37 21 C38.99541868 21.68025637 40.99617991 22.34490497 43 23 C44.69207001 23.9563874 46.36816893 24.94410931 48 26 C47.64930333 28.59515537 47.33376494 30.52570246 45.8125 32.6875 C44 34 44 34 41.26171875 34.8671875 C37.85532859 36.05024516 35.0806086 37.57228776 32 39.4375 C28.98262011 41.25657147 26.00380343 42.99811007 22.84765625 44.56640625 C20.50446776 45.74603612 18.52306473 46.93205736 16.4375 48.5 C13.72395196 50.53028055 10.91642657 52.27305255 8 54 C7.20980469 54.495 6.41960937 54.99 5.60546875 55.5 C1.73947122 57.89829249 -1.92465319 60.10964838 -6.25 61.5625 C-9.05715658 62.50949258 -10.91239658 63.59064618 -13.125 65.5625 C-16.17128314 68.14521832 -18.26285135 68.75428378 -22 70 C-24.26466695 71.39826028 -26.44180935 72.90116927 -28.63671875 74.40625 C-34.60438059 78.43072278 -39.72491842 81.53563309 -47 82 C-47.33 82.99 -47.66 83.98 -48 85 C-49.485 85.495 -49.485 85.495 -51 86 C-51.66 86.99 -52.32 87.98 -53 89 C-56.18578426 90.28787023 -58.5551941 91 -62 91 C-60.8125 89.5 -60.8125 89.5 -59 88 C-56.3125 87.8125 -56.3125 87.8125 -54 88 C-54 86.68 -54 85.36 -54 84 C-51.03 83.505 -51.03 83.505 -48 83 C-48 82.34 -48 81.68 -48 81 C-47.030625 80.525625 -46.06125 80.05125 -45.0625 79.5625 C-42.19522563 78.29806053 -42.19522563 78.29806053 -41 77 C-39.33382885 76.95936168 -37.66611905 76.957279 -36 77 C-36 76.01 -36 75.02 -36 74 C-34.7625 73.5875 -33.525 73.175 -32.25 72.75 C-28.63317386 71.41279315 -26.64360688 69.83243594 -24 67 C-21.8125 66.375 -21.8125 66.375 -20 66 C-19.67 65.34 -19.34 64.68 -19 64 C-17.00882592 63.30741771 -15.0078864 62.64252365 -13 62 C-12.01 61.34 -11.02 60.68 -10 60 C-8.68 60 -7.36 60 -6 60 C-6 59.01 -6 58.02 -6 57 C-5.195625 56.71125 -4.39125 56.4225 -3.5625 56.125 C-0.8673532 55.26737432 -0.8673532 55.26737432 0 53 C0.845625 52.731875 1.69125 52.46375 2.5625 52.1875 C6.21782046 50.92475293 8.91676284 49.21445795 12.0703125 47.0234375 C14 46 14 46 18 46 C18 45.01 18 44.02 18 43 C18.72703125 42.72027344 19.4540625 42.44054687 20.203125 42.15234375 C27.01409085 39.43668942 33.2468247 36.27551214 39.50390625 32.453125 C42 31 42 31 45 30 C45 29.01 45 28.02 45 27 C44.46375 26.9175 43.9275 26.835 43.375 26.75 C40.1615724 25.73523339 37.78092498 23.89102899 35 22 C32.27848495 20.58481218 29.55262545 19.24561131 26.75 18 C25 17 25 17 23 14 C20.86112391 12.94549199 20.86112391 12.94549199 18.375 12.125 C14.15083004 10.53407885 10.52020761 8.64939184 6.76171875 6.1640625 C5.21815451 5.14414644 3.61248997 4.21952561 2 3.3125 C1.34 2.879375 0.68 2.44625 0 2 C0 1.34 0 0.68 0 0 Z " fill="#ACC7FE" transform="translate(989,818)"/>
+<path d="M0 0 C0.99 0.495 0.99 0.495 2 1 C-2.87608667 4.44576792 -7.21277834 7.32813596 -13 9 C-17.34752244 11.00007904 -17.34752244 11.00007904 -21 14 C-22.98636298 14.70626239 -24.98848259 15.36893571 -27 16 C-29.75256244 16.84979475 -29.75256244 16.84979475 -32 18 C-32.495 19.485 -32.495 19.485 -33 21 C-37.05906178 23.43543707 -41.34208833 24.80495594 -45.81640625 26.24609375 C-49.71273874 27.59133913 -53.07670396 29.07670396 -56 32 C-58.50636622 32.82112513 -61.03625656 33.46295272 -63.58984375 34.12109375 C-66.14910439 35.05437356 -67.18025328 36.03824993 -69 38 C-70.3303125 38.433125 -70.3303125 38.433125 -71.6875 38.875 C-74.58169348 39.85793363 -76.48223056 40.85358098 -79 42.5 C-82.2512201 44.61391116 -85.27480403 45.8662447 -89 47 C-92.19172169 48.50198668 -95.06329881 50.04219921 -98 52 C-98.93585937 52.30292969 -99.87171875 52.60585938 -100.8359375 52.91796875 C-104.11423078 54.03906411 -106.68714029 55.48746594 -109.625 57.3125 C-114.75851938 60.39517518 -119.90676192 62.74836704 -125.50390625 64.859375 C-127.9691917 65.98592172 -129.16745832 67.06711742 -131 69 C-132.98356483 69.71408334 -134.98315437 70.38617742 -137 71 C-137.33 71.33 -137.66 71.66 -138 72 C-139.64230364 72.1245486 -141.29052276 72.17568524 -142.9375 72.1875 C-143.83339844 72.20167969 -144.72929688 72.21585937 -145.65234375 72.23046875 C-148 72 -148 72 -150 70 C-151.31747324 69.30251417 -152.64914193 68.63040043 -154 68 C-152.02 68 -150.04 68 -148 68 C-147.67 68.66 -147.34 69.32 -147 70 C-142.9899066 70.17864631 -142.9899066 70.17864631 -139 70 C-138.01 69.01 -138.01 69.01 -137 68 C-136.319375 67.835 -135.63875 67.67 -134.9375 67.5 C-134.298125 67.335 -133.65875 67.17 -133 67 C-132.67 66.34 -132.34 65.68 -132 65 C-130 64.33333333 -128 63.66666667 -126 63 C-125.67 62.34 -125.34 61.68 -125 61 C-123.33333333 60.33333333 -121.66666667 59.66666667 -120 59 C-119.505 58.01 -119.505 58.01 -119 57 C-117.02095687 56.27347903 -115.01567136 55.61766772 -113 55 C-101.11997035 51.05617242 -101.11997035 51.05617242 -91 44 C-89.7315625 43.505 -89.7315625 43.505 -88.4375 43 C-85.85158559 42.25129886 -85.85158559 42.25129886 -85 40 C-81.92331032 39.03853448 -78.83428447 38.21213035 -75.7109375 37.41796875 C-71.60772281 36.24464147 -68.91015996 35.36638863 -66.3125 31.875 C-64 29 -64 29 -60.75 28.25 C-59.8425 28.1675 -58.935 28.085 -58 28 C-57.67 27.34 -57.34 26.68 -57 26 C-55.33333333 25.66666667 -53.66666667 25.33333333 -52 25 C-51.67 24.34 -51.34 23.68 -51 23 C-48.97456444 22.74280183 -46.94649776 22.49157878 -44.91015625 22.34375 C-42.76477844 22.14523788 -42.76477844 22.14523788 -41 20 C-39.26787817 19.28100603 -37.53517016 18.56331271 -35.796875 17.859375 C-33.75500516 16.97252308 -33.75500516 16.97252308 -31.4375 14.875 C-28.58574158 12.68133968 -26.50862029 12.47844822 -23 12 C-22.67 11.34 -22.34 10.68 -22 10 C-20 9.33333333 -18 8.66666667 -16 8 C-15.67 7.34 -15.34 6.68 -15 6 C-13.07098741 5.53437627 -11.14069241 5.07316577 -9.203125 4.64453125 C-6.90844499 3.97321529 -5.15942753 3.05623616 -3.125 1.8125 C-2.09375 1.214375 -1.0625 0.61625 0 0 Z " fill="#8D97A4" transform="translate(980,333)"/>
+<path d="M0 0 C1.32 0 2.64 0 4 0 C4.0694446 10.77000233 4.12278307 21.53995159 4.15543652 32.31013203 C4.17110684 37.31092029 4.19237004 42.31155562 4.22631836 47.31225586 C4.25886309 52.13627314 4.27684271 56.96014313 4.28463173 61.7842617 C4.29018404 63.62671414 4.30102608 65.46915833 4.31719017 67.31154823 C4.33889965 69.88797184 4.34196967 72.46378317 4.34057617 75.0402832 C4.351362 75.80560867 4.36214783 76.57093414 4.3732605 77.35945129 C4.34307058 82.50213315 4.34307058 82.50213315 2.69355774 84.8959198 C-1.15793587 87.40682199 -5.49594934 89.09918987 -10 90 C-10 90.66 -10 91.32 -10 92 C-11.4540625 92.680625 -11.4540625 92.680625 -12.9375 93.375 C-16.07079582 94.65786221 -16.07079582 94.65786221 -17 97 C-19.93230451 98.98128683 -22.51102321 100.35389319 -26 101 C-26 101.66 -26 102.32 -26 103 C-26.86625 103.4125 -27.7325 103.825 -28.625 104.25 C-32.01652825 105.92033984 -32.01652825 105.92033984 -35 108.0625 C-37.96603554 109.97806462 -40.62015861 111.03433103 -44 112 C-44 112.66 -44 113.32 -44 114 C-44.75925781 114.25394531 -45.51851562 114.50789062 -46.30078125 114.76953125 C-47.29464844 115.11371094 -48.28851562 115.45789063 -49.3125 115.8125 C-50.29863281 116.14894531 -51.28476562 116.48539063 -52.30078125 116.83203125 C-54.91435434 117.96294059 -56.14641241 118.9097842 -58 121 C-59.65848177 122.01351664 -61.32665961 123.01120795 -63 124 C-64.5778125 125.175625 -64.5778125 125.175625 -66.1875 126.375 C-70.50016733 129.501213 -75.20752982 131.71000193 -80 134 C-81.20976726 134.60129026 -82.41838303 135.20491273 -83.625 135.8125 C-84.40875 136.204375 -85.1925 136.59625 -86 137 C-85.67 136.01 -85.34 135.02 -85 134 C-84.34 134 -83.68 134 -83 134 C-82.67708984 133.09121094 -82.67708984 133.09121094 -82.34765625 132.1640625 C-80.5183906 129.22663302 -78.61456645 128.65908161 -75.4375 127.375 C-71.46072344 126.03525828 -71.46072344 126.03525828 -69 123 C-66.27460708 121.15635185 -63.60299944 119.83398158 -60.5625 118.5625 C-57.04940283 117.02166791 -54.17208791 115.13771141 -51 113 C-49.33333333 112.33333333 -47.66666667 111.66666667 -46 111 C-42.87078908 109.00263133 -39.84523274 106.89075252 -36.8125 104.75 C-34 103 -34 103 -31 103 C-31 102.34 -31 101.68 -31 101 C-29.21118264 99.99491199 -27.41885304 98.99607264 -25.625 98 C-24.62726562 97.443125 -23.62953125 96.88625 -22.6015625 96.3125 C-20 95 -20 95 -18 95 C-18 94.01 -18 93.02 -18 92 C-17.195625 91.71125 -16.39125 91.4225 -15.5625 91.125 C-12.8673532 90.26737432 -12.8673532 90.26737432 -12 88 C-11.38125 87.855625 -10.7625 87.71125 -10.125 87.5625 C-7.93151796 87.17235693 -7.93151796 87.17235693 -6.5625 85.5625 C-4.56207695 83.56207695 -2.67327498 82.86881437 0 82 C0.99 82 1.98 82 3 82 C3 55.27 3 28.54 3 1 C2.01 0.67 1.02 0.34 0 0 Z " fill="#B7CEFE" transform="translate(846,532)"/>
+<path d="M0 0 C5.04969516 0.44556134 7.47618687 2.55813601 11 6 C11 6.99 11 7.98 11 9 C11.99 9.33 12.98 9.66 14 10 C17.03580227 12.64659685 19.25574023 15.2468834 21.1875 18.75 C22.62678935 22.04811835 22.62678935 22.04811835 25 23 C26.03515625 24.59375 26.03515625 24.59375 27.0625 26.5 C28.3141421 28.9117304 28.3141421 28.9117304 30 31 C30.04080783 32.99958364 30.04254356 35.00045254 30 37 C30.66 37 31.32 37 32 37 C33.41000419 39.82000838 33.37608381 42.59357703 33.62109375 45.7109375 C33.86860321 48.00414952 33.86860321 48.00414952 35.01147461 49.81787109 C36.20225618 52.44647216 36.22877432 54.3254088 36.1953125 57.203125 C36.18886719 58.1828125 36.18242188 59.1625 36.17578125 60.171875 C36.15902344 61.18765625 36.14226563 62.2034375 36.125 63.25 C36.11597656 64.28125 36.10695313 65.3125 36.09765625 66.375 C36.07412011 68.91690287 36.04124023 71.4583328 36 74 C35.01 74.33 34.02 74.66 33 75 C32.95875 76.155 32.9175 77.31 32.875 78.5 C32.2629922 83.7726826 29.39745449 87.09344683 26 91 C26 88.06922536 26.44173927 86.30222085 27.375 83.5625 C27.63023437 82.80066406 27.88546875 82.03882813 28.1484375 81.25390625 C29 79 29 79 30.05859375 77.2421875 C31.50544337 73.79616393 31.51434507 70.24912592 31.6875 66.5625 C31.73455078 65.81162109 31.78160156 65.06074219 31.83007812 64.28710938 C32.04383262 60.30286573 31.87946275 56.91164028 31 53 C30.93466565 51.06348981 30.91415697 49.12497139 30.9375 47.1875 C30.94652344 46.21167969 30.95554687 45.23585938 30.96484375 44.23046875 C30.97644531 43.49441406 30.98804688 42.75835937 31 42 C29.68 41.67 28.36 41.34 27 41 C26.731875 39.989375 26.46375 38.97875 26.1875 37.9375 C25.10835772 34.14136829 23.57849919 30.61739397 22 27 C21.31163487 25.00736409 20.63718601 23.00958663 20 21 C19.34 21 18.68 21 18 21 C17.38125 20.195625 16.7625 19.39125 16.125 18.5625 C14.32285328 15.8303083 14.32285328 15.8303083 11.9375 15.625 C11.298125 15.41875 10.65875 15.2125 10 15 C9.24681823 13.29715425 8.50221173 11.58834795 7.8515625 9.84375 C6.52183237 6.96470127 4.30359354 5.12639404 2 3 C1.34 2.01 0.68 1.02 0 0 Z " fill="#C8CDD3" transform="translate(756,226)"/>
+<path d="M0 0 C2 2 2 2 2.24609566 4.43252754 C2.24425207 5.4630921 2.24240849 6.49365665 2.24050903 7.55545044 C2.24325836 8.73618134 2.24600769 9.91691223 2.24884033 11.13342285 C2.24164978 12.43533569 2.23445923 13.73724854 2.22705078 15.07861328 C2.22648687 16.45820101 2.22680284 17.83778933 2.22793579 19.21737671 C2.22851108 22.969257 2.21672847 26.72101015 2.20278788 30.47286081 C2.1903097 34.39131436 2.18911232 38.30977062 2.18673706 42.22824097 C2.1805137 49.65138931 2.16409135 57.07447894 2.14403808 64.49760139 C2.12170566 72.94729737 2.11069235 81.39699612 2.10064721 89.84671426 C2.07972584 107.23117683 2.04453329 124.61558221 2 142 C1.01 142.33 0.02 142.66 -1 143 C-1.02332798 124.50277268 -1.04097868 106.00554833 -1.05181217 87.50830936 C-1.05697534 78.92032951 -1.06401844 70.33235877 -1.07543945 61.74438477 C-1.08538565 54.26184583 -1.09185327 46.77931349 -1.09408849 39.29676813 C-1.09539571 35.33235414 -1.09848226 31.36795905 -1.10573006 27.4035511 C-1.11248926 23.67639787 -1.11461717 19.94927143 -1.11310768 16.22211266 C-1.11338406 14.85024495 -1.11538978 13.4783764 -1.11920547 12.10651398 C-1.12414108 10.24139037 -1.12239794 8.37625256 -1.12025452 6.51112366 C-1.12117631 5.46488862 -1.1220981 4.41865358 -1.12304783 3.34071445 C-1 1 -1 1 0 0 Z " fill="#273754" transform="translate(158,536)"/>
+<path d="M0 0 C3.55780196 0.60990891 6.6828589 1.5783681 10 3 C10 3.66 10 4.32 10 5 C10.94875 5.268125 11.8975 5.53625 12.875 5.8125 C16 7 16 7 18 10 C18 11.32 18 12.64 18 14 C17.360625 14.103125 16.72125 14.20625 16.0625 14.3125 C15.381875 14.539375 14.70125 14.76625 14 15 C13.67 15.99 13.34 16.98 13 18 C10.375 18.95703125 10.375 18.95703125 7 19.8125 C1.46408178 21.37594064 -2.63566967 23.35247273 -7.1953125 26.828125 C-9 28 -9 28 -12 28 C-12.495 29.485 -12.495 29.485 -13 31 C-14.65 31.33 -16.3 31.66 -18 32 C-18.33 32.99 -18.66 33.98 -19 35 C-20.890625 36.28125 -20.890625 36.28125 -23.25 37.5 C-24.06597656 37.93183594 -24.88195312 38.36367188 -25.72265625 38.80859375 C-26.84994141 39.39833984 -26.84994141 39.39833984 -28 40 C-30.66823599 41.5513 -33.24406379 43.16270919 -35.8125 44.875 C-36.864375 45.57625 -37.91625 46.2775 -39 47 C-39.65484375 47.43957031 -40.3096875 47.87914062 -40.984375 48.33203125 C-44.61747406 50.7017406 -47.57333829 52.58500046 -52 53 C-52.33 53.99 -52.66 54.98 -53 56 C-55.50761902 57.7414021 -57.90206553 58.96216168 -60.75 60.0625 C-63.16232993 60.77997664 -63.16232993 60.77997664 -64 63 C-69.24361692 65.78232735 -73.07373674 66.59262633 -79 66 C-80.6875 64.625 -80.6875 64.625 -82 63 C-82.825 62.67 -83.65 62.34 -84.5 62 C-87.01929235 60.99228306 -88.24899945 60.02747432 -90 58 C-88.68 58 -87.36 58 -86 58 C-85.67 58.66 -85.34 59.32 -85 60 C-83.845 60.165 -82.69 60.33 -81.5 60.5 C-79.7675 60.7475 -79.7675 60.7475 -78 61 C-77.67 61.66 -77.34 62.32 -77 63 C-71.93932579 62.51803103 -69.16239856 60.80509468 -65 58 C-63.68 58 -62.36 58 -61 58 C-60.95875 57.38125 -60.9175 56.7625 -60.875 56.125 C-60.58625 55.42375 -60.2975 54.7225 -60 54 C-58.02416285 53.26480478 -56.01822402 52.60927518 -54 52 C-53.01 51.319375 -52.02 50.63875 -51 49.9375 C-47.86066895 47.91001536 -45.68112175 47.35058302 -42 47 C-42 46.34 -42 45.68 -42 45 C-41.01 45 -40.02 45 -39 45 C-38.67 44.01 -38.34 43.02 -38 42 C-35.48828125 40.24609375 -35.48828125 40.24609375 -32.3125 38.4375 C-31.27738281 37.83808594 -30.24226562 37.23867188 -29.17578125 36.62109375 C-26 35 -26 35 -22.66796875 33.91015625 C-19.85739321 33.29989619 -19.85739321 33.29989619 -19 31 C-18.01 31 -17.02 31 -16 31 C-15.505 29.515 -15.505 29.515 -15 28 C-13.01679982 26.96708324 -11.01652194 25.9662501 -9 25 C-8.67 24.34 -8.34 23.68 -8 23 C-6.6696875 22.566875 -6.6696875 22.566875 -5.3125 22.125 C-1.70933959 20.90128514 0.86638353 19.13352611 4 17 C5.66140763 16.32033324 7.32700041 15.65061095 9 15 C9.66 14.34 10.32 13.68 11 13 C12.32 13 13.64 13 15 13 C13.94768703 10.03323813 13.18219261 9.10395374 10.3984375 7.515625 C9.40070313 7.09796875 8.40296875 6.6803125 7.375 6.25 C6.37210938 5.82203125 5.36921875 5.3940625 4.3359375 4.953125 C3.56507813 4.63859375 2.79421875 4.3240625 2 4 C2 3.01 2 2.02 2 1 C1.01 0.505 1.01 0.505 0 0 Z " fill="#C8DAFE" transform="translate(930,666)"/>
+<path d="M0 0 C5.75 -0.125 5.75 -0.125 8 1 C8.13199785 21.28368343 8.26244131 41.56737633 8.39115143 61.85108089 C8.45097992 71.27417906 8.51127267 80.69727379 8.57275391 90.12036133 C8.62648799 98.35625668 8.67925388 106.59215764 8.73096704 114.82806593 C8.75824975 119.16822328 8.78594202 123.50837693 8.81480408 127.84852409 C8.98096938 152.89929656 9.0276841 177.94869561 9 203 C4.09293348 203.16494341 1.29317695 202.45324397 -3 200 C-3 199.01 -3 198.02 -3 197 C-2.34 197.66 -1.68 198.32 -1 199 C0.96488831 199.88778692 0.96488831 199.88778692 3.125 200.625 C3.84945313 200.88539063 4.57390625 201.14578125 5.3203125 201.4140625 C5.87460938 201.60742188 6.42890625 201.80078125 7 202 C6.89055205 185.06052265 6.77750027 168.12107321 6.66066074 151.18164539 C6.60643049 143.30836235 6.55320448 135.43507538 6.50268555 127.56176758 C6.44389545 118.42266511 6.38219483 109.28358615 6.31640625 100.14453125 C6.31099335 99.3925957 6.30558045 98.64066014 6.30000353 97.86593866 C6.06994166 66.24027442 5.59192824 34.62086656 5 3 C2.525 2.01 2.525 2.01 0 1 C0 0.67 0 0.34 0 0 Z " fill="#D7E3FE" transform="translate(1032,635)"/>
+<path d="M0 0 C0.33 0.66 0.66 1.32 1 2 C-3.65041369 6.39698515 -8.17174203 9.80046509 -13.84765625 12.75 C-16.00752568 14.00437063 -17.66956152 15.37156376 -19.5 17.0625 C-22.71525934 19.99915373 -26.02857807 21.51507504 -30.08203125 23.04296875 C-32.33953776 23.97105639 -32.33953776 23.97105639 -34 27 C-38.91479147 30.41304963 -44.15409962 31.96837052 -50 33 C-50.33 34.32 -50.66 35.64 -51 37 C-52.98 37 -54.96 37 -57 37 C-57 37.99 -57 38.98 -57 40 C-57.89203125 40.25394531 -58.7840625 40.50789062 -59.703125 40.76953125 C-60.87359375 41.11371094 -62.0440625 41.45789063 -63.25 41.8125 C-64.41015625 42.14894531 -65.5703125 42.48539063 -66.765625 42.83203125 C-69.75307611 43.91083304 -71.56096889 45.04006428 -74 47 C-76.75 47.6875 -76.75 47.6875 -79 48 C-79 48.66 -79 49.32 -79 50 C-81.1640625 51.4375 -81.1640625 51.4375 -84 53 C-84.87398437 53.495 -85.74796875 53.99 -86.6484375 54.5 C-91.69097531 57.27411822 -96.68088776 59.80977731 -102 62 C-106.4538581 63.90879633 -109.20984367 65.96865643 -112.3125 69.59765625 C-114.6617822 71.54995326 -117.08882944 72.11491884 -120 73 C-122.07073114 73.81266429 -124.13343313 74.64609134 -126.1875 75.5 C-127.21230469 75.9228125 -128.23710938 76.345625 -129.29296875 76.78125 C-132.13626317 77.97223774 -132.13626317 77.97223774 -135 80 C-135.99 79.67 -136.98 79.34 -138 79 C-136.04634442 76.47173984 -134.83786887 75.95411383 -131.6875 75.0625 C-127.78906675 73.93922262 -125.30764909 72.30097328 -122 70 C-120.33333333 69.33333333 -118.66666667 68.66666667 -117 68 C-116.67 67.34 -116.34 66.68 -116 66 C-114 65.33333333 -112 64.66666667 -110 64 C-109.67 63.34 -109.34 62.68 -109 62 C-106.4375 61.375 -106.4375 61.375 -104 61 C-104 60.34 -104 59.68 -104 59 C-100.41349943 57.38973444 -97.20846643 56.05031948 -93.375 55.125 C-89.42762837 53.80920946 -87.83089511 51.97988959 -85 49 C-83.35202764 48.28837557 -81.68834592 47.60968047 -80 47 C-79.505 46.01 -79.505 46.01 -79 45 C-77.32626673 44.56482935 -75.65226011 44.13066925 -73.9765625 43.703125 C-71.11059698 42.68361158 -68.9518266 40.99010646 -66.578125 39.12109375 C-65 38 -65 38 -62 37 C-61.505 36.01 -61.505 36.01 -61 35 C-58.68456957 34.27359045 -56.34730065 33.61568542 -54 33 C-50.72435637 32.07585059 -50.72435637 32.07585059 -48 31 C-47.67 30.34 -47.34 29.68 -47 29 C-45.00458132 28.31974363 -43.00382009 27.65509503 -41 27 C-39.32986432 26.00580456 -37.66366777 25.00498126 -36 24 C-32.89527499 22.46955789 -29.77297489 20.98128527 -26.64453125 19.5 C-23.75838089 18.12513858 -23.75838089 18.12513858 -22 15 C-20.37148694 13.93899907 -18.69917317 12.94370988 -17 12 C-10.80009585 8.44153412 -5.28935495 4.82941104 0 0 Z " fill="#4869A6" transform="translate(1086,919)"/>
+<path d="M0 0 C-3.25345306 2.04502764 -6.41802947 3.62231903 -10 5 C-11.051875 5.556875 -11.051875 5.556875 -12.125 6.125 C-14 7 -14 7 -17 7 C-17.0928125 7.8971875 -17.0928125 7.8971875 -17.1875 8.8125 C-18.35709526 11.96141032 -20.02454817 12.54533466 -23 14 C-23.928125 14.28875 -24.85625 14.5775 -25.8125 14.875 C-29.32735699 16.11553776 -32.07889209 17.82561466 -35.16796875 19.87890625 C-37 21 -37 21 -40 22 C-40.99 23.485 -40.99 23.485 -42 25 C-43.9812585 25.72045764 -45.98504093 26.38001259 -48 27 C-50.01800895 27.96314063 -52.01549844 28.96958573 -54 30 C-55.23556641 30.59361328 -55.23556641 30.59361328 -56.49609375 31.19921875 C-57.38425781 31.62847656 -58.27242187 32.05773438 -59.1875 32.5 C-60.02667969 32.9021875 -60.86585938 33.304375 -61.73046875 33.71875 C-64.00717068 34.86347563 -64.00717068 34.86347563 -65.48828125 36.53125 C-67.45680919 38.44382495 -69.43654296 39.04916282 -72 40 C-74.58208002 41.29496414 -77.13866732 42.63218677 -79.6953125 43.9765625 C-82 45 -82 45 -85 45 C-85.04125 45.5775 -85.0825 46.155 -85.125 46.75 C-86.4733895 50.21728729 -88.8241362 51.20234125 -92 53 C-93.97888961 53.72693904 -95.97954558 54.39816251 -98 55 C-101.76756732 56.10666307 -101.76756732 56.10666307 -104 59 C-106.33247761 59.33926947 -108.66585471 59.67240066 -111 60 C-111.66 60.66 -112.32 61.32 -113 62 C-115.125 61.625 -115.125 61.625 -117 61 C-115.25048432 60.04078278 -113.50036756 59.08266183 -111.75 58.125 C-110.77546875 57.59132813 -109.8009375 57.05765625 -108.796875 56.5078125 C-107.12178079 55.60475892 -105.42804982 54.733479 -103.703125 53.9296875 C-101.81751006 53.11068735 -101.81751006 53.11068735 -101 51 C-99.33333333 50.33333333 -97.66666667 49.66666667 -96 49 C-95.67 48.34 -95.34 47.68 -95 47 C-92.19194065 45.90254643 -89.34122354 45.01196162 -86.46875 44.09765625 C-85.24671875 43.55431641 -85.24671875 43.55431641 -84 43 C-83.67 42.01 -83.34 41.02 -83 40 C-82.030625 39.87625 -81.06125 39.7525 -80.0625 39.625 C-79.051875 39.41875 -78.04125 39.2125 -77 39 C-76.505 38.01 -76.505 38.01 -76 37 C-74.33024638 36.50766361 -72.65802904 36.02207099 -70.97412109 35.58056641 C-67.7488927 34.63206367 -64.82341956 33.16833394 -61.8125 31.6875 C-61.20986328 31.40455078 -60.60722656 31.12160156 -59.98632812 30.83007812 C-55.92557382 28.81975959 -53.67940989 26.59857965 -51 23 C-48.3125 21.875 -48.3125 21.875 -45 21 C-39.36734693 19.34155278 -34.66883079 17.61834386 -30 14 C-29.67 13.34 -29.34 12.68 -29 12 C-28.01 11.67 -27.02 11.34 -26 11 C-25.67 10.34 -25.34 9.68 -25 9 C-23 8.66666667 -21 8.33333333 -19 8 C-18.67 7.34 -18.34 6.68 -18 6 C-15.4375 5.375 -15.4375 5.375 -13 5 C-12.67 4.01 -12.34 3.02 -12 2 C-10.29296875 1.015625 -10.29296875 1.015625 -8.1875 0.25 C-7.50042969 -0.01296875 -6.81335938 -0.2759375 -6.10546875 -0.546875 C-3.71856031 -1.06056958 -2.29362227 -0.76282269 0 0 Z " fill="#436096" transform="translate(771,1096)"/>
+<path d="M0 0 C4.49350481 0.42126608 7.3521834 2.39843481 11.0234375 4.8046875 C13.55892451 6.33800573 16.18415118 7.10132485 19 8 C20.2004901 8.66455702 21.38767684 9.35355499 22.5625 10.0625 C25.77155685 12.10574394 25.77155685 12.10574394 28.8125 12.5625 C31 13 31 13 33 16 C35.72435637 17.07585059 35.72435637 17.07585059 39 18 C44.20059246 19.71971783 48.64879579 21.62781674 53 25 C53 25.66 53 26.32 53 27 C53.680625 27.103125 54.36125 27.20625 55.0625 27.3125 C58.67054778 28.15693671 61.65617122 29.39239001 65 31 C65.495 31.99 65.495 31.99 66 33 C68.33247761 33.33926947 70.66585471 33.67240066 73 34 C73.66 34.66 74.32 35.32 75 36 C76.98356483 36.71408334 78.98315437 37.38617742 81 38 C81 38.99 81 39.98 81 41 C83.31 41 85.62 41 88 41 C88.33 41.66 88.66 42.32 89 43 C89.825 43.33 90.65 43.66 91.5 44 C94 45 94 45 95 47 C96.99054876 47.69437747 98.99255385 48.35610218 101 49 C106.81707317 51.63414634 106.81707317 51.63414634 108 54 C108.825 54.165 109.65 54.33 110.5 54.5 C111.325 54.665 112.15 54.83 113 55 C113.33 55.66 113.66 56.32 114 57 C115.72996853 57.75074106 117.46196889 58.49777964 119.2109375 59.203125 C121.40050954 60.1783929 123.16930968 61.46222013 125 63 C119.57814191 63.2756877 116.49764122 63.34110491 112 60 C109.01353231 58.00902154 106.40312738 57.05875074 103 56 C103 54.68 103 53.36 103 52 C102.43152344 51.84144531 101.86304688 51.68289063 101.27734375 51.51953125 C96.39843007 50.04526852 92.78032259 48.32158571 88.76953125 45.203125 C85.75591896 43.15413474 82.43126186 42.18319374 79 41 C78.67 40.67 78.34 40.34 78 40 C75.67182036 39.63239269 73.3381615 39.29758419 71 39 C70.67 38.01 70.34 37.02 70 36 C68.35 36 66.7 36 65 36 C64.67 35.34 64.34 34.68 64 34 C61.69034152 32.94647157 59.3570226 31.94280904 57 31 C57 30.34 57 29.68 57 29 C54.69 28.67 52.38 28.34 50 28 C50 27.34 50 26.68 50 26 C49.21625 25.896875 48.4325 25.79375 47.625 25.6875 C45 25 45 25 43 22 C41.0187415 21.27954236 39.01495907 20.61998741 37 20 C35 19 33 18 31 17 C29.906875 16.649375 28.81375 16.29875 27.6875 15.9375 C25 15 25 15 24 13 C21.6859378 12.26924352 19.35171131 11.59861742 17 11 C17 10.34 17 9.68 17 9 C14.69 8.34 12.38 7.68 10 7 C10 6.34 10 5.68 10 5 C7.69 5 5.38 5 3 5 C3 4.01 3 3.02 3 2 C2.01 1.67 1.02 1.34 0 1 C0 0.67 0 0.34 0 0 Z " fill="#7C8696" transform="translate(294,394)"/>
+<path d="M0 0 C3.79039298 1.81938863 7.43082843 3.77768563 11 6 C11.33 6.99 11.66 7.98 12 9 C14.00016466 10.20882096 14.00016466 10.20882096 16 11 C16 11.66 16 12.32 16 13 C16.62390625 13.23460937 17.2478125 13.46921875 17.890625 13.7109375 C20.60255941 15.36823075 20.88975997 16.6141599 21.75 19.625 C21.99234375 20.44226563 22.2346875 21.25953125 22.484375 22.1015625 C22.65453125 22.72804688 22.8246875 23.35453125 23 24 C23.66 24 24.32 24 25 24 C25.495 27.465 25.495 27.465 26 31 C26.66 31 27.32 31 28 31 C30.917004 41.02646315 32.76610926 54.44991543 28.609375 64.29296875 C26.8851487 66.53071462 25.20669073 68.24655072 23 70 C21.6078125 71.2684375 21.6078125 71.2684375 20.1875 72.5625 C18 74 18 74 16 74 C16 74.66 16 75.32 16 76 C15.360625 76.103125 14.72125 76.20625 14.0625 76.3125 C13.381875 76.539375 12.70125 76.76625 12 77 C11.67 77.99 11.34 78.98 11 80 C9.29296875 81.0625 9.29296875 81.0625 7.1875 82 C4.1542557 83.41947198 1.63197151 84.91257432 -1 87 C-5.55555556 90 -5.55555556 90 -9 90 C-9 90.99 -9 91.98 -9 93 C-11.97 93.495 -11.97 93.495 -15 94 C-11.58195341 90.15469758 -8.49411039 88.03378384 -3.76953125 85.9921875 C-1.66340165 84.98743598 -1.66340165 84.98743598 0 82 C0.99 82 1.98 82 3 82 C3.04125 81.38125 3.0825 80.7625 3.125 80.125 C3.41375 79.42375 3.7025 78.7225 4 78 C5.99527669 77.31932728 7.99627333 76.65538071 10 76 C19.02169169 71.34593766 19.02169169 71.34593766 24.1875 63.0625 C24.47258129 61.71126104 24.74747379 60.35769973 25 59 C25.33 58.67 25.66 58.34 26 58 C26.09899523 56.45044441 26.13079524 54.89646327 26.1328125 53.34375 C26.13410156 52.40402344 26.13539063 51.46429687 26.13671875 50.49609375 C26.13091797 49.01302734 26.13091797 49.01302734 26.125 47.5 C26.12886719 46.51128906 26.13273437 45.52257812 26.13671875 44.50390625 C26.13478516 43.09431641 26.13478516 43.09431641 26.1328125 41.65625 C26.13112061 40.35397461 26.13112061 40.35397461 26.12939453 39.02539062 C26.2241537 37.00395846 26.2241537 37.00395846 25 36 C24.87625 34.72125 24.7525 33.4425 24.625 32.125 C24.23058381 28.65537006 23.77227461 27.23914488 21 25 C20.525625 24.195625 20.05125 23.39125 19.5625 22.5625 C18.09417766 19.91457106 18.09417766 19.91457106 15.8125 17.875 C14 16 14 16 14 13 C12.68 12.67 11.36 12.34 10 12 C10 10.68 10 9.36 10 8 C9.195625 7.6596875 9.195625 7.6596875 8.375 7.3125 C5.19684374 5.55615049 2.71920931 3.41020825 0 1 C0 0.67 0 0.34 0 0 Z " fill="#687388" transform="translate(391,587)"/>
+<path d="M0 0 C2.49457129 0.27379441 4.98892067 0.44549145 7.4921875 0.62109375 C10.06915734 1.01044901 11.72508157 1.77323613 14 3 C15.11375 3.28875 16.2275 3.5775 17.375 3.875 C21.19291961 5.0598716 23.69410054 6.79606703 27 9 C29.32748694 9.68679942 31.65986656 10.35761043 34 11 C34.495 11.99 34.495 11.99 35 13 C35.825 13.495 36.65 13.99 37.5 14.5 C40 16 40 16 41 18 C29.35294118 14.19852941 29.35294118 14.19852941 24 12 C23.505 11.01 23.505 11.01 23 10 C20.67843403 9.59270772 18.3431213 9.25561323 16 9 C16 8.34 16 7.68 16 7 C15.09507812 6.94392578 15.09507812 6.94392578 14.171875 6.88671875 C13.37265625 6.82097656 12.5734375 6.75523438 11.75 6.6875 C10.56664062 6.60048828 10.56664062 6.60048828 9.359375 6.51171875 C7 6 7 6 5.17352295 4.48930359 C2.5124578 2.66593482 1.06422899 2.63566167 -2.13574219 2.65942383 C-3.15649841 2.65965042 -4.17725464 2.65987701 -5.22894287 2.66011047 C-6.32386047 2.67559433 -7.41877808 2.69107819 -8.546875 2.70703125 C-9.6732135 2.71127609 -10.799552 2.71552094 -11.96002197 2.71989441 C-15.55692463 2.73668503 -19.15326672 2.77433901 -22.75 2.8125 C-25.18879399 2.82754629 -27.62759677 2.84123479 -30.06640625 2.85351562 C-36.04446205 2.88658985 -42.02219097 2.93679357 -48 3 C-48.33 3.66 -48.66 4.32 -49 5 C-51.29296875 5.59765625 -51.29296875 5.59765625 -54.1875 6.0625 C-55.1775 6.22621094 -56.1675 6.38992187 -57.1875 6.55859375 C-58.115625 6.70425781 -59.04375 6.84992187 -60 7 C-61.216875 7.20625 -62.43375 7.4125 -63.6875 7.625 C-64.450625 7.74875 -65.21375 7.8725 -66 8 C-62.99586308 5.08974236 -60.86129036 3.76690358 -56.75 3.375 C-55.5125 3.25125 -54.275 3.1275 -53 3 C-52.67 2.34 -52.34 1.68 -52 1 C-50.01318359 0.49755859 -50.01318359 0.49755859 -47.3984375 0.1484375 C-46.44042236 0.01920898 -45.48240723 -0.11001953 -44.49536133 -0.24316406 C-43.46564209 -0.36916992 -42.43592285 -0.49517578 -41.375 -0.625 C-40.32916748 -0.75616211 -39.28333496 -0.88732422 -38.20581055 -1.02246094 C-8.97686543 -4.48843272 -8.97686543 -4.48843272 0 0 Z " fill="#CCD0D6" transform="translate(599,46)"/>
+<path d="M0 0 C4.36899951 -0.37448567 6.40113978 0.57286171 10 3 C15.62727418 6.80358261 15.62727418 6.80358261 21.9375 9.1875 C22.948125 9.455625 23.95875 9.72375 25 10 C25.33 10.66 25.66 11.32 26 12 C29.09703025 13.69599276 32.23372904 15.09599586 35.5 16.4375 C38.99161249 17.99625557 41.87581596 19.80642397 45 22 C46.11375 22.70125 47.2275 23.4025 48.375 24.125 C49.24125 24.74375 50.1075 25.3625 51 26 C51 26.66 51 27.32 51 28 C51.78375 27.95875 52.5675 27.9175 53.375 27.875 C56 28 56 28 58 30 C58.886875 30.268125 59.77375 30.53625 60.6875 30.8125 C63.60586153 31.85870508 65.11830123 32.72473687 67.5 34.5625 C70.59211978 36.90397155 73.07231176 37.71260818 77 38 C77 38.66 77 39.32 77 40 C78.5778125 40.1546875 78.5778125 40.1546875 80.1875 40.3125 C83.98176948 40.99671253 85.84757509 41.89838339 89 44 C90.60875 44.7115625 90.60875 44.7115625 92.25 45.4375 C93.61125 46.2109375 93.61125 46.2109375 95 47 C95.495 48.98 95.495 48.98 96 51 C99.63 51.66 103.26 52.32 107 53 C107 53.66 107 54.32 107 55 C107.66 55 108.32 55 109 55 C109 55.99 109 56.98 109 58 C109.639375 58.144375 110.27875 58.28875 110.9375 58.4375 C113 59 113 59 114 60 C115.134375 60.144375 116.26875 60.28875 117.4375 60.4375 C121 61 121 61 123 63 C123.99 63.309375 124.98 63.61875 126 63.9375 C129 65 129 65 131 68 C126.64569372 67.34025662 123.00783889 65.79661743 119 64 C117.80375 63.505 116.6075 63.01 115.375 62.5 C112.39628639 61.17612728 109.6734805 59.86333489 107 58 C107 57.34 107 56.68 107 56 C106.16855469 56.10828125 105.33710937 56.2165625 104.48046875 56.328125 C99.65726247 55.87341195 97.09303567 53.62227837 93.3125 50.75 C87.16760626 46.28001653 81.42420465 42.96615589 74 41 C74 40.34 74 39.68 74 39 C72.02 39 70.04 39 68 39 C67.67 38.01 67.34 37.02 67 36 C65.35 36 63.7 36 62 36 C61.505 34.02 61.505 34.02 61 32 C59.824375 32.061875 59.824375 32.061875 58.625 32.125 C56 32 56 32 54 30 C53.278125 29.71125 52.55625 29.4225 51.8125 29.125 C48.31495146 27.72598058 45.24635365 25.90961979 42 24 C42 23.01 42 22.02 42 21 C41.360625 20.855625 40.72125 20.71125 40.0625 20.5625 C38 20 38 20 37 19 C34.67182036 18.63239269 32.3381615 18.29758419 30 18 C29.67 17.01 29.34 16.02 29 15 C27.35 15 25.7 15 24 15 C23.67 13.68 23.34 12.36 23 11 C21.576875 11.0928125 21.576875 11.0928125 20.125 11.1875 C19.09375 11.125625 18.0625 11.06375 17 11 C16.34 10.01 15.68 9.02 15 8 C12.76595324 6.6218096 12.76595324 6.6218096 10.1875 5.4375 C9.33542969 5.02371094 8.48335937 4.60992187 7.60546875 4.18359375 C5.09641185 3.04379729 2.56749097 2.00026129 0 1 C0 0.67 0 0.34 0 0 Z " fill="#B3B9C2" transform="translate(748,123)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C1.34 1.66 0.68 2.32 0 3 C-0.67342121 4.64988196 -1.34577232 6.30021182 -2.01171875 7.953125 C-3.13710026 10.28395469 -4.53895236 12.22179229 -6.0625 14.3125 C-8.93453948 18.44283401 -9.96593766 22.08524306 -10.67578125 27.03125 C-11 29 -11 29 -12 30 C-12.21809756 34.25748426 -12.18579161 38.52045724 -12.18530273 42.78295898 C-12.18748743 44.92517 -12.20563512 47.06686471 -12.22460938 49.20898438 C-12.22754359 50.5651024 -12.2295282 51.92122288 -12.23046875 53.27734375 C-12.23457764 54.51734131 -12.23868652 55.75733887 -12.24291992 57.03491211 C-12.31211805 60.1192207 -12.31211805 60.1192207 -10 62 C-9.66666667 64.33333333 -9.33333333 66.66666667 -9 69 C-8.34 69.66 -7.68 70.32 -7 71 C-6.87625 72.0725 -6.7525 73.145 -6.625 74.25 C-5.91730528 78.49616829 -4.70112196 80.68147874 -2 84 C-0.68252676 84.69748583 0.64914193 85.36959957 2 86 C2.68486725 87.32407669 3.34870203 88.65909241 4 90 C5.6222454 91.70993434 7.29413425 93.37347684 9 95 C9.86625 95.9075 10.7325 96.815 11.625 97.75 C13.86533112 100.19004674 13.86533112 100.19004674 17 101 C18.69088222 102.97956942 20.35830472 104.97945196 22 107 C22.99 107.495 22.99 107.495 24 108 C23.67 108.66 23.34 109.32 23 110 C19.17069104 109.45295586 17.56164428 107.80954534 15 105 C14.46375 104.484375 13.9275 103.96875 13.375 103.4375 C12 102 12 102 10 99 C8.36368108 97.95107762 6.69514137 96.95093297 5 96 C1.81007783 93.87338522 0.76684252 91.97663925 -1.02734375 88.66796875 C-2.12221883 86.79041189 -3.43511919 85.49684251 -5 84 C-7.39091536 80.46144526 -8.70353077 77.05146634 -10 73 C-11.95435514 68.35687004 -11.95435514 68.35687004 -14.07714844 63.78979492 C-15.27934197 60.15554479 -15.28651238 56.71016454 -15.265625 52.92578125 C-15.26753845 52.16073776 -15.2694519 51.39569427 -15.27142334 50.60746765 C-15.27277934 48.99799265 -15.26912392 47.38850649 -15.26074219 45.77905273 C-15.24998971 43.31013674 -15.26067962 40.84194104 -15.2734375 38.37304688 C-15.27211667 36.80729006 -15.26955585 35.24153369 -15.265625 33.67578125 C-15.26967346 32.93620682 -15.27372192 32.19663239 -15.27789307 31.43464661 C-15.22995283 26.22995283 -15.22995283 26.22995283 -13 24 C-12.28166626 22.14126234 -12.28166626 22.14126234 -11.6875 20 C-9.21689912 12.30265051 -6.2179849 5.32970135 0 0 Z " fill="#6F7B8C" transform="translate(400,242)"/>
+<path d="M0 0 C4.35430628 0.65974338 7.99216111 2.20338257 12 4 C16.92823651 6.17524093 16.92823651 6.17524093 22.0625 7.75 C25.67936742 9.28909252 27.09601842 11.30576202 29.50390625 14.3203125 C33.23403528 18.50818582 38.76977111 19.64014049 44 21 C44 21.66 44 22.32 44 23 C44.721875 23.103125 45.44375 23.20625 46.1875 23.3125 C49.2596772 24.06347665 51.34022542 25.32014237 54 27 C54.99 27.33 55.98 27.66 57 28 C57.495 28.99 57.495 28.99 58 30 C61.91287321 32.87711265 65.25634775 33.36143143 70 34 C70.33 34.66 70.66 35.32 71 36 C71.969375 36.144375 72.93875 36.28875 73.9375 36.4375 C75.4534375 36.7159375 75.4534375 36.7159375 77 37 C77.66 37.99 78.32 38.98 79 40 C80.485 40.495 80.485 40.495 82 41 C82 42.32 82 43.64 82 45 C82.74378906 44.94070312 83.48757813 44.88140625 84.25390625 44.8203125 C87.50091622 45.03277688 88.50005651 45.79145935 90.9375 47.875 C94.19815928 50.49089615 96.92716753 51.88922751 101 53 C103.76757105 54.07627763 104.7301188 54.54120195 106.25 57.125 C106.4975 57.74375 106.745 58.3625 107 59 C106.01 59 105.02 59 104 59 C104 58.34 104 57.68 104 57 C103.34 56.9175 102.68 56.835 102 56.75 C98.00960837 55.75240209 94.61450357 53.92833317 91 52 C91 51.01 91 50.02 91 49 C90.13955078 48.79697266 90.13955078 48.79697266 89.26171875 48.58984375 C87.05991893 48.01562653 84.95147198 47.33702456 82.8125 46.5625 C82.11769531 46.31628906 81.42289063 46.07007813 80.70703125 45.81640625 C79 45 79 45 78 43 C76.35767228 42.27544365 74.68375165 41.62225605 73 41 C71.7264543 40.46474166 70.45565616 39.9229052 69.1875 39.375 C68.135625 38.92125 67.08375 38.4675 66 38 C66 37.34 66 36.68 66 36 C64.68 36 63.36 36 62 36 C61.34 35.01 60.68 34.02 60 33 C55.71757344 30.28230622 51.8219221 28.57450518 47 27 C45.65760982 26.35176329 44.32467746 25.6837045 43 25 C39.74556021 23.3227118 36.51560105 22.05468031 33 21 C33 20.34 33 19.68 33 19 C31.35 18.67 29.7 18.34 28 18 C27.67 17.01 27.34 16.02 27 15 C25.25132517 13.91568906 25.25132517 13.91568906 23 13 C20.9988707 12.0022618 18.99903335 11.00193097 17 10 C15.99839844 9.51660156 14.99679687 9.03320312 13.96484375 8.53515625 C12.96582031 8.04917969 11.96679688 7.56320313 10.9375 7.0625 C9.93589844 6.57910156 8.93429687 6.09570312 7.90234375 5.59765625 C4.97637715 3.9869963 2.54098146 2.15866865 0 0 Z " fill="#959EAA" transform="translate(641,64)"/>
+<path d="M0 0 C3.60882498 1.34042071 6.73061032 2.9760921 10 5 C12.32656309 6.34542375 14.6636936 7.67151204 17 9 C17 9.66 17 10.32 17 11 C17.825 11.226875 18.65 11.45375 19.5 11.6875 C23.08232831 13.03087312 25.85854311 14.75071352 29.03515625 16.8359375 C31.15688316 18.18887081 31.15688316 18.18887081 34.4375 19.125 C35.7059375 19.558125 35.7059375 19.558125 37 20 C37.495 21.485 37.495 21.485 38 23 C39.65 23 41.3 23 43 23 C43.495 24.98 43.495 24.98 44 27 C44.53625 27.103125 45.0725 27.20625 45.625 27.3125 C48.65012928 28.18819532 51.2504489 29.47247161 54 31 C54.495 31.99 54.495 31.99 55 33 C56.6476038 33.71247732 58.31763529 34.37400383 60 35 C63.85714286 36.71428571 63.85714286 36.71428571 65 39 C66.99531815 39.68055118 68.99624711 40.34469947 71 41 C77.67992738 44.49398046 83.93255887 48.54228815 90 53 C90.94875 53.556875 91.8975 54.11375 92.875 54.6875 C95 56 95 56 96 58 C91.0800765 56.51771536 87.07395482 55.18277721 83 52 C81.55284113 51.32950168 80.09274184 50.686656 78.625 50.0625 C74.72659004 48.38070661 71.36898847 46.5915296 68 44 C68 43.34 68 42.68 68 42 C66.35 42 64.7 42 63 42 C62.67 41.01 62.34 40.02 62 39 C59.45003743 38.0836072 56.89162888 37.53802414 54.25 36.94140625 C53.5075 36.63074219 52.765 36.32007813 52 36 C51.1875 33.90234375 51.1875 33.90234375 51 32 C50.484375 31.9175 49.96875 31.835 49.4375 31.75 C45.95544268 30.67859775 43.12799115 28.86476395 40 27 C40 26.01 40 25.02 40 24 C39.38125 23.87625 38.7625 23.7525 38.125 23.625 C36 23 36 23 34 21 C32.34015202 20.31653318 30.67163195 19.65411685 29 19 C27.66129085 18.34419512 26.32828326 17.6766726 25 17 C22.05069548 15.50300452 19.10048544 14.16268204 16 13 C16 12.34 16 11.68 16 11 C13.03 10.505 13.03 10.505 10 10 C10 9.34 10 8.68 10 8 C9.278125 7.938125 8.55625 7.87625 7.8125 7.8125 C4.11600926 6.7446249 2.46861132 4.89180184 0 2 C0 1.34 0 0.68 0 0 Z " fill="#A5C2FD" transform="translate(874,539)"/>
+<path d="M0 0 C6.75 0.75 6.75 0.75 9 3 C10.3303125 3.4021875 10.3303125 3.4021875 11.6875 3.8125 C14.60586153 4.85870508 16.11830123 5.72473687 18.5 7.5625 C21.63814566 9.95611886 24.10554156 10.36601839 28 11 C29.0625 12.875 29.0625 12.875 30 15 C33.45899447 17.49816267 36.96321743 18.70822958 41 20 C43.34205301 20.97940398 45.67518826 21.98034573 48 23 C49.19625 23.495 50.3925 23.99 51.625 24.5 C54.63003648 25.83557177 57.35117791 27.0523367 60 29 C60.6328125 31.09765625 60.6328125 31.09765625 61 33 C55.08315098 37.90153173 55.08315098 37.90153173 50.5625 38.3125 C49.716875 38.209375 48.87125 38.10625 48 38 C47.67 38.99 47.34 39.98 47 41 C44.03 41.495 44.03 41.495 41 42 C40.67 42.99 40.34 43.98 40 45 C38.02 45 36.04 45 34 45 C33.67 45.99 33.34 46.98 33 48 C31.9275 48.144375 30.855 48.28875 29.75 48.4375 C27.08337051 48.83749442 24.58600271 49.27591924 22 50 C25.29658854 46.58567616 28.23220172 43.698897 32.6875 41.9375 C35.15938605 41.23196154 35.15938605 41.23196154 36 39 C37.62231782 38.49302568 39.24945273 37.99769372 40.89453125 37.5703125 C43.93917506 36.74560379 46.90380591 35.70615535 49.88671875 34.68359375 C51.90973664 34.02919794 53.93174285 33.49021896 56 33 C56 31.68 56 30.36 56 29 C55.484375 28.896875 54.96875 28.79375 54.4375 28.6875 C49.87202254 27.39980123 45.87317654 25.61850005 42 22.875 C38.58868722 20.74292951 35.97417136 20.31793371 32 20 C31.67 19.01 31.34 18.02 31 17 C30.113125 16.71125 29.22625 16.4225 28.3125 16.125 C25.01279368 15.00434502 23.14701722 13.58242535 20.5625 11.30078125 C15.89986896 7.41914091 10.79888891 5.61080247 5 4 C2.0625 2.4375 2.0625 2.4375 0 1 C0 0.67 0 0.34 0 0 Z " fill="#566478" transform="translate(749,389)"/>
+<path d="M0 0 C0.81724625 6.41347171 1.13952711 12.64863003 1.11352539 19.10961914 C1.11367142 20.07653687 1.11381744 21.04345459 1.1139679 22.03967285 C1.11327662 25.20485758 1.10552129 28.36998192 1.09765625 31.53515625 C1.09578928 33.74189726 1.09436669 35.94863868 1.09336853 38.15538025 C1.08956534 43.94047201 1.07975397 49.72553834 1.06866455 55.51062012 C1.05840302 61.4230922 1.05386078 67.33556843 1.04882812 73.24804688 C1.0381296 84.83204237 1.02107977 96.41601906 1 108 C0.67 108 0.34 108 0 108 C-0.76042412 103.92149121 -1.13944806 100.03808269 -1.18945312 95.89160156 C-1.2062059 94.69940506 -1.22295868 93.50720856 -1.24021912 92.27888489 C-1.25375931 90.99575912 -1.2672995 89.71263336 -1.28125 88.390625 C-1.29906204 87.03280533 -1.31734686 85.67499179 -1.33607483 84.31718445 C-1.37502282 81.44511332 -1.41146652 78.57302681 -1.4458313 75.70089722 C-1.53469977 68.30695653 -1.64028609 60.91324574 -1.74609375 53.51953125 C-1.75633009 52.79531542 -1.76656643 52.07109959 -1.77711296 51.32493782 C-1.94500286 39.52621935 -2.18634528 27.73157422 -2.5625 15.9375 C-2.58473633 15.23894897 -2.60697266 14.54039795 -2.62988281 13.82067871 C-2.7462216 10.21352525 -2.86894875 6.60664826 -3 3 C-3.75925781 3.433125 -4.51851562 3.86625 -5.30078125 4.3125 C-6.29464844 4.869375 -7.28851562 5.42625 -8.3125 6 C-9.79169922 6.8353125 -9.79169922 6.8353125 -11.30078125 7.6875 C-14 9 -14 9 -17 9 C-12.25 5 -12.25 5 -10 5 C-9.67 4.01 -9.34 3.02 -9 2 C-5.99208089 -0.04108797 -3.57804656 -0.19878036 0 0 Z " fill="#9ABBFD" transform="translate(955,684)"/>
+<path d="M0 0 C0.77730469 0.00580078 1.55460937 0.01160156 2.35546875 0.01757812 C9.21376627 0.16166001 15.46601419 1.27648102 21.125 5.4375 C21.62 6.9225 21.62 6.9225 22.125 8.4375 C17.375 7.6875 17.375 7.6875 15.125 5.4375 C12.80293475 4.73258733 10.46906932 4.06537571 8.125 3.4375 C7.465 3.1075 6.805 2.7775 6.125 2.4375 C-1.95139906 1.51949781 -1.95139906 1.51949781 -8.9375 4.875 C-9.576875 5.720625 -10.21625 6.56625 -10.875 7.4375 C-11.865 7.7675 -12.855 8.0975 -13.875 8.4375 C-13.875 9.7575 -13.875 11.0775 -13.875 12.4375 C-14.865 13.0975 -15.855 13.7575 -16.875 14.4375 C-17.8760669 17.058801 -17.8760669 17.058801 -18.5 20.1875 C-18.73976562 21.21359375 -18.97953125 22.2396875 -19.2265625 23.296875 C-21.72132927 37.42255593 -21.0877355 52.14538088 -21.19140625 66.4296875 C-21.21201506 68.83106817 -21.23301245 71.23244553 -21.25437927 73.63381958 C-21.3091949 79.91035256 -21.35878037 86.18691604 -21.40722656 92.46350098 C-21.45774011 98.88585071 -21.51326929 105.30815693 -21.56835938 111.73046875 C-21.67544436 124.29944165 -21.77716729 136.86845185 -21.875 149.4375 C-22.205 149.4375 -22.535 149.4375 -22.875 149.4375 C-22.92167433 132.65253997 -22.95696638 115.86760013 -22.97862434 99.0825901 C-22.98894679 91.28941303 -23.00302555 83.49627623 -23.02587891 75.703125 C-23.04578323 68.91239247 -23.05870939 62.1216891 -23.06317699 55.33092821 C-23.06578941 51.73366016 -23.07194965 48.13647553 -23.08646011 44.53923416 C-23.10250907 40.52823399 -23.1029816 36.51737981 -23.10205078 32.50634766 C-23.10924133 31.30729294 -23.11643188 30.10823822 -23.12384033 28.87284851 C-23.121091 27.78467331 -23.11834167 26.69649811 -23.11550903 25.5753479 C-23.11735262 24.62590113 -23.11919621 23.67645435 -23.12109566 22.69823647 C-22.875 20.4375 -22.875 20.4375 -20.875 18.4375 C-20.47452556 16.11474823 -20.1352896 13.78010643 -19.875 11.4375 C-19.070625 11.19 -18.26625 10.9425 -17.4375 10.6875 C-16.591875 10.275 -15.74625 9.8625 -14.875 9.4375 C-14.50951555 8.11261887 -14.1812434 6.77731486 -13.875 5.4375 C-9.71037077 -0.06046902 -6.42880597 -0.26918646 0 0 Z " fill="#BABEC8" transform="translate(176.875,493.5625)"/>
+<path d="M0 0 C2.77165126 3.23359313 4.51160377 6.03094338 6 10 C6.47179687 10.75796875 6.94359375 11.5159375 7.4296875 12.296875 C9.53683999 15.92411262 10.7147372 19.70531497 12.03515625 23.671875 C12.76700134 26.15644337 12.76700134 26.15644337 15 27 C15.67939174 28.99571323 16.34561559 30.99594773 17 33 C17.66 33.66 18.32 34.32 19 35 C19.70963655 37.32062596 20.36937851 39.65666788 21 42 C21.81070864 44.44511803 22.64401576 46.88286182 23.5 49.3125 C23.9228125 50.52550781 24.345625 51.73851562 24.78125 52.98828125 C25.79393807 56.05408629 25.79393807 56.05408629 28 58 C28.33 59.010625 28.66 60.02125 29 61.0625 C29.65752556 64.12150806 29.65752556 64.12150806 32 65 C32.40729228 67.32156597 32.74438677 69.6568787 33 72 C33.99 72.33 34.98 72.66 36 73 C36 74.32 36 75.64 36 77 C36.9590625 77.37125 36.9590625 77.37125 37.9375 77.75 C40 79 40 79 40.625 81.0625 C40.74875 81.701875 40.8725 82.34125 41 83 C41.99 83.495 41.99 83.495 43 84 C43.495 84.969375 43.99 85.93875 44.5 86.9375 C47.53282316 92.53655814 52.42692402 96.66255961 57 101 C55.2109375 101.6953125 55.2109375 101.6953125 53 102 C51.2890625 100.7421875 51.2890625 100.7421875 49.625 98.875 C47.40727287 96.45175075 45.31324295 94.44297764 42.625 92.5625 C39.8180327 89.82236526 39.66295695 89.4512287 39.375 85.8125 C39.189375 83.9253125 39.189375 83.9253125 39 82 C37.13355094 80.81669817 37.13355094 80.81669817 35 80 C33.08283549 76.77916363 31.77942404 73.44431513 30.5 69.9375 C28.77705137 65.24425971 27.25659467 61.83772978 23 59 C22.12109375 56.5390625 22.12109375 56.5390625 21.4375 53.625 C20.60302023 50.12678536 19.65241018 47.18536902 18 44 C17.67 42.80375 17.34 41.6075 17 40.375 C16.28091922 36.96285798 16.28091922 36.96285798 14 35 C13.67 33.824375 13.34 32.64875 13 31.4375 C12.67 30.303125 12.34 29.16875 12 28 C11.34 27.67 10.68 27.34 10 27 C6.60184386 22.65036013 6.33624045 18.32187472 6 13 C5.34 13 4.68 13 4 13 C0.71428571 4.57142857 0.71428571 4.57142857 0 0 Z " fill="#9CA3B0" transform="translate(337,877)"/>
+<path d="M0 0 C0.99 0.495 0.99 0.495 2 1 C-0.79854744 4.29240875 -4.20673275 6.03562946 -8 8 C-8.99 8 -9.98 8 -11 8 C-11 8.66 -11 9.32 -11 10 C-11.78503906 10.37511719 -12.57007813 10.75023437 -13.37890625 11.13671875 C-19.34441509 14.04261692 -24.68833177 17.04228642 -30 21 C-36.24104235 25 -36.24104235 25 -40 25 C-40.33 25.99 -40.66 26.98 -41 28 C-43.2578125 29.39453125 -43.2578125 29.39453125 -46.125 30.8125 C-50.46522469 33.06694314 -53.91467207 35.45850414 -57.5078125 38.7421875 C-60.50006825 41.26445543 -63.1593039 42 -67 42 C-66.67 43.98 -66.34 45.96 -66 48 C-65.01 48 -64.02 48 -63 48 C-62.34 48.99 -61.68 49.98 -61 51 C-58.67038557 51.35840222 -56.33634657 51.68848712 -54 52 C-50.46727919 53.44192686 -47.73276877 55.1468346 -44.875 57.625 C-42.30495266 60.09544061 -42.30495266 60.09544061 -39.75 60.5625 C-38 61 -38 61 -36.75 63.0625 C-36.5025 63.701875 -36.255 64.34125 -36 65 C-44.3089701 63.22923588 -44.3089701 63.22923588 -47 60 C-49.09989652 58.82425289 -49.09989652 58.82425289 -51 58 C-51 57.34 -51 56.68 -51 56 C-54.465 55.505 -54.465 55.505 -58 55 C-58 54.34 -58 53.68 -58 53 C-59.175625 52.814375 -59.175625 52.814375 -60.375 52.625 C-63 52 -63 52 -65 50 C-65.825 49.690625 -66.65 49.38125 -67.5 49.0625 C-70 48 -70 48 -72 45 C-71.625 42.3125 -71.625 42.3125 -71 40 C-70.195625 39.87625 -69.39125 39.7525 -68.5625 39.625 C-67.716875 39.41875 -66.87125 39.2125 -66 39 C-65.67 38.34 -65.34 37.68 -65 37 C-63.02 37 -61.04 37 -59 37 C-58.67 36.01 -58.34 35.02 -58 34 C-55.41796875 32.46484375 -55.41796875 32.46484375 -52.1875 30.9375 C-51.12917969 30.43089844 -50.07085938 29.92429687 -48.98046875 29.40234375 C-47.21670514 28.57247332 -45.44969331 27.74935611 -43.67578125 26.94140625 C-41.81834716 26.10400078 -41.81834716 26.10400078 -41 24 C-39.00934459 22.98152514 -37.00751815 21.98482022 -35 21 C-33.948125 20.278125 -32.89625 19.55625 -31.8125 18.8125 C-29 17 -29 17 -26 17 C-25.67 15.68 -25.34 14.36 -25 13 C-24.21625 12.896875 -23.4325 12.79375 -22.625 12.6875 C-19.66954819 12.22404978 -19.66954819 12.22404978 -18 9 C-16.67405895 8.63837971 -15.34061543 8.30271961 -14 8 C-13.67 7.34 -13.34 6.68 -13 6 C-11.328125 5.25390625 -11.328125 5.25390625 -9.25 4.5625 C-6.58922167 3.63265811 -4.56203979 2.73341553 -2.125 1.25 C-1.073125 0.63125 -1.073125 0.63125 0 0 Z " fill="#B2CBFE" transform="translate(752,587)"/>
+<path d="M0 0 C2.375 -0.125 2.375 -0.125 5 0 C5.99 0.99 5.99 0.99 7 2 C7.8971875 2.12375 7.8971875 2.12375 8.8125 2.25 C12.25657198 3.43082468 13.77825094 6.2085717 16 9 C16.99 9.66 17.98 10.32 19 11 C17.02 10.67 15.04 10.34 13 10 C13 9.34 13 8.68 13 8 C12.01 8 11.02 8 10 8 C9.505 7.01 9.505 7.01 9 6 C5.19495826 4.73165275 3.02679608 4.48866082 -1 5 C-3.67953863 6.55923231 -6.10530084 8.29748962 -8.5703125 10.17578125 C-14.31794609 14.49112673 -19.93068311 16.75247349 -27 18 C-27 18.66 -27 19.32 -27 20 C-27.87269531 20.42667969 -28.74539063 20.85335937 -29.64453125 21.29296875 C-32.73531059 22.86534427 -35.70625178 24.54327357 -38.6875 26.3125 C-43.60654425 29.21001922 -48.58046184 31.96822085 -53.625 34.640625 C-56.0326618 35.94184511 -56.0326618 35.94184511 -58.125 37.671875 C-60 39 -60 39 -63 39 C-63 39.66 -63 40.32 -63 41 C-64.11375 41.53625 -65.2275 42.0725 -66.375 42.625 C-70.73229294 44.78030383 -74.80522402 47.30891257 -78.8984375 49.92578125 C-79.59195313 50.28027344 -80.28546875 50.63476562 -81 51 C-81.66 50.67 -82.32 50.34 -83 50 C-82.195625 49.566875 -81.39125 49.13375 -80.5625 48.6875 C-77.72153646 47.19525998 -77.72153646 47.19525998 -77 44 C-76.195625 43.87625 -75.39125 43.7525 -74.5625 43.625 C-73.716875 43.41875 -72.87125 43.2125 -72 43 C-71.67 42.34 -71.34 41.68 -71 41 C-69.33333333 40.33333333 -67.66666667 39.66666667 -66 39 C-65.67 38.34 -65.34 37.68 -65 37 C-63.35008418 36.29289322 -61.6792238 35.63437344 -60 35 C-55.74478226 33.32137418 -55.74478226 33.32137418 -53 30 C-51.9275 29.731875 -50.855 29.46375 -49.75 29.1875 C-45.90180863 28.28567953 -45.90180863 28.28567953 -43.5 25.5 C-40.4719979 22.4719979 -38.06191296 22.16054656 -34 21 C-32.29319053 19.37446717 -30.62339805 17.70884005 -29 16 C-26.625 14.875 -26.625 14.875 -24 14 C-22.2675 13.2265625 -22.2675 13.2265625 -20.5 12.4375 C-17.59272667 11.24344131 -15.0872655 10.4677675 -12 10 C-11.979375 9.401875 -11.95875 8.80375 -11.9375 8.1875 C-11 6 -11 6 -7.625 4.25 C-4 3 -4 3 -1 3 C-0.67 2.01 -0.34 1.02 0 0 Z " fill="#C4D7FE" transform="translate(957,800)"/>
+<path d="M0 0 C2.0625 0.4375 2.0625 0.4375 4 1 C-2.625 5 -2.625 5 -6 5 C-6.33 5.99 -6.66 6.98 -7 8 C-7.99 8.33 -8.98 8.66 -10 9 C-10.33 37.71 -10.66 66.42 -11 96 C-6.58835662 94.52945221 -3.7278874 93.42323256 0.0625 91.0625 C0.87847656 90.55847656 1.69445312 90.05445313 2.53515625 89.53515625 C3.34855469 89.02855469 4.16195312 88.52195312 5 88 C8.15020423 86.09624443 11.30761595 84.20724859 14.5 82.375 C15.2321875 81.94960938 15.964375 81.52421875 16.71875 81.0859375 C19.14592965 79.93053349 21.35370227 79.41930774 24 79 C21.13644497 81.50561065 18.36125682 83.38731454 14.9375 85 C11.63520303 86.57693956 9.51443998 88.31215036 7 91 C3.48564179 93.40456088 0.04357509 94.71340793 -4 96 C-4.495 96.495 -4.495 96.495 -5 97 C-8.5 97.125 -8.5 97.125 -12 97 C-14.03411692 94.96588308 -13.17808507 90.74257438 -13.19287109 87.94775391 C-13.20104858 87.10386612 -13.20922607 86.25997833 -13.21765137 85.39051819 C-13.24255214 82.58587364 -13.25903218 79.7812798 -13.2734375 76.9765625 C-13.27876118 76.02139111 -13.28408485 75.06621971 -13.28956985 74.08210373 C-13.31632025 69.02772574 -13.33569014 63.97337263 -13.35009766 58.91894531 C-13.36676134 53.68726033 -13.41154801 48.45620339 -13.4624691 43.22475624 C-13.49605597 39.21167238 -13.50766562 35.1987392 -13.51332474 31.1855278 C-13.52005968 29.25652637 -13.53533954 27.32753562 -13.55921555 25.3986702 C-13.59069095 22.70226477 -13.59093098 20.00757459 -13.58349609 17.31103516 C-13.59990143 16.50987778 -13.61630676 15.7087204 -13.63320923 14.88328552 C-13.60800171 12.65689087 -13.60800171 12.65689087 -13 9 C-10.52603149 7.1055603 -10.52603149 7.1055603 -8 6 C-7.67 5.34 -7.34 4.68 -7 4 C-5.01679982 2.96708324 -3.01652194 1.9662501 -1 1 C-0.67 0.67 -0.34 0.34 0 0 Z " fill="#B7CEFE" transform="translate(870,851)"/>
+<path d="M0 0 C3.46806102 0.00541308 6.93599534 -0.00000974 10.40405273 -0.00634766 C12.64689156 -0.00568757 14.8897303 -0.00440785 17.13256836 -0.00244141 C18.15048965 -0.00446564 19.16841095 -0.00648987 20.21717834 -0.00857544 C38.79975 0.05145898 38.79975 0.05145898 40.87866211 2.13037109 C42.64794282 2.40585616 44.42646026 2.62243789 46.20678711 2.81396484 C47.31119141 2.93578125 48.4155957 3.05759766 49.5534668 3.18310547 C50.73328125 3.31007812 51.9130957 3.43705078 53.12866211 3.56787109 C55.51424967 3.83588554 57.89966927 4.10539964 60.28491211 4.37646484 C62.00194336 4.57151611 62.00194336 4.57151611 63.75366211 4.77050781 C80.25716712 6.67098956 80.25716712 6.67098956 85.87866211 10.13037109 C87.20762573 10.80570651 88.54027446 11.47391034 89.87866211 12.13037109 C88.2748687 12.18453297 86.67054805 12.22323747 85.06616211 12.25537109 C84.1728418 12.27857422 83.27952148 12.30177734 82.35913086 12.32568359 C79.87866211 12.13037109 79.87866211 12.13037109 76.87866211 10.13037109 C73.87854586 9.79275117 70.90262388 9.68894605 67.88647461 9.57177734 C64.87866211 9.13037109 64.87866211 9.13037109 62.59350586 7.63037109 C58.60277961 5.42542307 54.80639624 5.63968748 50.31616211 5.56787109 C48.62716731 5.53329728 46.93831473 5.49061488 45.24975586 5.43896484 C44.13491821 5.42047485 44.13491821 5.42047485 42.99755859 5.40161133 C40.87866211 5.13037109 40.87866211 5.13037109 39.22013855 4.1295929 C35.94231681 2.73078705 32.79890928 2.85166052 29.29614258 2.87158203 C28.15891754 2.86632507 28.15891754 2.86632507 26.99871826 2.86096191 C24.49766839 2.8521731 21.99690225 2.85798244 19.49584961 2.86474609 C17.75757798 2.8633989 16.01930672 2.86145792 14.28103638 2.85894775 C10.64117845 2.8560006 7.00141877 2.86028206 3.36157227 2.86962891 C-1.31053519 2.88104019 -5.9824133 2.87445083 -10.65451241 2.86248398 C-14.24207295 2.85526882 -17.8295788 2.85755142 -21.41714096 2.86273956 C-23.14037986 2.86407614 -24.86362369 2.86242807 -26.58685684 2.85778046 C-28.990575 2.85271899 -31.39391736 2.86041909 -33.79760742 2.87158203 C-34.5134903 2.86753357 -35.22937317 2.86348511 -35.96694946 2.85931396 C-39.99165418 2.78282531 -39.99165418 2.78282531 -43.12133789 5.13037109 C-45.72290039 5.32568359 -45.72290039 5.32568359 -48.74633789 5.25537109 C-50.25067383 5.22830078 -50.25067383 5.22830078 -51.78540039 5.20068359 C-52.55625977 5.17748047 -53.32711914 5.15427734 -54.12133789 5.13037109 C-54.12133789 4.80037109 -54.12133789 4.47037109 -54.12133789 4.13037109 C-48.67633789 3.63537109 -48.67633789 3.63537109 -43.12133789 3.13037109 C-43.12133789 2.47037109 -43.12133789 1.81037109 -43.12133789 1.13037109 C-28.74072205 0.23457963 -14.40706952 -0.02676937 0 0 Z " fill="#5D8AE5" transform="translate(590.121337890625,204.86962890625)"/>
+<path d="M0 0 C0.66 0 1.32 0 2 0 C2.02315033 13.62121343 2.04092886 27.24242219 2.05181217 40.86365128 C2.05703509 47.18824202 2.06412207 53.51281933 2.07543945 59.83740234 C2.08628925 65.93872968 2.0922813 72.04004407 2.09487724 78.14138031 C2.0967277 80.4714249 2.10034108 82.80146878 2.10573006 85.13150787 C2.11296819 88.39009646 2.11398976 91.64863126 2.11352539 94.90722656 C2.11712067 95.874673 2.12071594 96.84211945 2.12442017 97.83888245 C2.1230455 98.72786728 2.12167084 99.61685211 2.12025452 100.53277588 C2.12117631 101.30339481 2.1220981 102.07401375 2.12304783 102.86798477 C1.99841699 105.02742845 1.59397132 106.92459296 1 109 C7.57815191 107.53818846 13.32325486 104.61425988 19 101 C19.33 100.34 19.66 99.68 20 99 C22.5625 98.375 22.5625 98.375 25 98 C24.67 98.66 24.34 99.32 24 100 C23.01 100 22.02 100 21 100 C20.67 100.99 20.34 101.98 20 103 C17.70703125 104.5 17.70703125 104.5 14.8125 106 C13.32169922 106.77730469 13.32169922 106.77730469 11.80078125 107.5703125 C10.87652344 108.04210937 9.95226562 108.51390625 9 109 C7.845 109.61875 6.69 110.2375 5.5 110.875 C3 112 3 112 0 112 C0 75.04 0 38.08 0 0 Z " fill="#BBD1FE" transform="translate(857,739)"/>
+<path d="M0 0 C6.74795531 1.67001711 11.52137687 3.72667396 17 8 C17.7425 8.37125 18.485 8.7425 19.25 9.125 C21 10 21 10 22.4375 11.5 C25.42843627 14.37129882 28.65348358 14.95301472 32.6875 15.5 C36 16 36 16 38 18 C38.886875 18.268125 39.77375 18.53625 40.6875 18.8125 C44.13409706 20.04807253 46.44665884 21.60489205 49.34765625 23.76953125 C52.98110354 26.47528987 56.74859776 28.42342137 60.94921875 30.10546875 C63 31 63 31 65.33203125 32.30078125 C73.39669176 36.59306683 81.05263716 37.00354129 90 36 C90.99 35.01 90.99 35.01 92 34 C94.125 34.375 94.125 34.375 96 35 C94.33088115 37.04379825 93.43476684 37.92020194 90.79858398 38.40405273 C88.01057704 38.43631948 85.22570461 38.45769108 82.4375 38.4375 C81.48552734 38.45748047 80.53355469 38.47746094 79.55273438 38.49804688 C72.60655373 38.49331837 67.24510395 37.00683864 61 34 C61 33.34 61 32.68 61 32 C59.4840625 31.9071875 59.4840625 31.9071875 57.9375 31.8125 C54.22551275 31.28854156 52.1092299 29.72945767 49.171875 27.3984375 C45.33990289 24.93108855 40.99110857 23.66896396 36.6953125 22.2109375 C35.80585938 21.81132813 34.91640625 21.41171875 34 21 C33.505 19.515 33.505 19.515 33 18 C30.3738971 17.07462652 30.3738971 17.07462652 27.25 16.5 C22.8779676 15.59544157 19.75720637 14.40256734 16 12 C15.01 11.67 14.02 11.34 13 11 C12.67 10.34 12.34 9.68 12 9 C11.175 8.690625 10.35 8.38125 9.5 8.0625 C8.2625 7.5365625 8.2625 7.5365625 7 7 C6.67 6.01 6.34 5.02 6 4 C4.68 4 3.36 4 2 4 C1.34 2.68 0.68 1.36 0 0 Z " fill="#848E9D" transform="translate(451,1134)"/>
+<path d="M0 0 C2.9375 0.1875 2.9375 0.1875 6 1 C7.375 3.0625 7.375 3.0625 8 5 C8.66 5 9.32 5 10 5 C9.67 5.66 9.34 6.32 9 7 C6.525 6.01 6.525 6.01 4 5 C4 4.01 4 3.02 4 2 C3.01 2 2.02 2 1 2 C1.33 38.96 1.66 75.92 2 114 C1.01 114 0.02 114 -1 114 C-1.02332994 99.28390435 -1.04097964 84.56781115 -1.05181217 69.85170078 C-1.05697493 63.01921026 -1.06401723 56.18673121 -1.07543945 49.35424805 C-1.08644707 42.76664695 -1.09227623 36.17905469 -1.09487724 29.59144402 C-1.096732 27.07191721 -1.10035357 24.55239109 -1.10573006 22.03286934 C-1.11293676 18.51742235 -1.1139911 15.00202539 -1.11352539 11.48657227 C-1.11712067 10.43353409 -1.12071594 9.38049591 -1.12442017 8.29554749 C-1.12235817 6.86728638 -1.12235817 6.86728638 -1.12025452 5.41017151 C-1.12117631 4.57779244 -1.1220981 3.74541338 -1.12304783 2.88781071 C-1 1 -1 1 0 0 Z " fill="#C9DAFE" transform="translate(753,682)"/>
+<path d="M0 0 C-0.66 1.32 -1.32 2.64 -2 4 C-3.29417847 4.03758423 -3.29417847 4.03758423 -4.61450195 4.07592773 C-7.81823769 4.17111385 -11.02181537 4.27034444 -14.2253418 4.37231445 C-15.61135983 4.41560218 -16.99742906 4.45728164 -18.38354492 4.49731445 C-20.37691798 4.55516584 -22.37010565 4.61929776 -24.36328125 4.68359375 C-25.56251221 4.72025146 -26.76174316 4.75690918 -27.99731445 4.79467773 C-31.04994349 4.87733025 -31.04994349 4.87733025 -34 6 C-36.94964113 6.085409 -39.87503019 6.11582927 -42.82421875 6.09765625 C-43.68561966 6.0962413 -44.54702057 6.09482635 -45.43452454 6.09336853 C-48.18555169 6.0877714 -50.93649744 6.07521946 -53.6875 6.0625 C-55.5527332 6.05748463 -57.41796767 6.05292179 -59.28320312 6.04882812 C-63.85550011 6.03780292 -68.42773625 6.02054027 -73 6 C-73.33 5.34 -73.66 4.68 -74 4 C-76.8159849 3.53101037 -76.8159849 3.53101037 -80.0625 3.375 C-81.71958984 3.26285156 -81.71958984 3.26285156 -83.41015625 3.1484375 C-84.26480469 3.09945313 -85.11945312 3.05046875 -86 3 C-86 2.67 -86 2.34 -86 2 C-85.0316925 1.98969254 -84.06338501 1.97938507 -83.06573486 1.96876526 C-73.94290914 1.87103331 -64.82015166 1.76829936 -55.69743729 1.66066074 C-51.00729961 1.60548294 -46.31715565 1.55207114 -41.62695312 1.50268555 C-37.101149 1.45496618 -32.57541992 1.40262061 -28.04970551 1.34705925 C-26.32255674 1.32667001 -24.59538741 1.3079513 -22.86820221 1.29092598 C-20.45014518 1.26680596 -18.03222921 1.23676187 -15.61425781 1.20532227 C-14.89928131 1.1995668 -14.18430481 1.19381134 -13.44766235 1.18788147 C-8.83201517 1.11961077 -4.58062224 0 0 0 Z " fill="#BEC3CB" transform="translate(640,392)"/>
+<path d="M0 0 C3.20034869 0.28073234 5.00126455 0.44082794 7.5625 2.3125 C8.0575 3.7975 8.0575 3.7975 8.5625 5.3125 C7.5725 4.9825 6.5825 4.6525 5.5625 4.3125 C1.20624056 4.07488585 -1.65001658 4.14822376 -5.4375 6.3125 C-6.4275 6.3125 -7.4175 6.3125 -8.4375 6.3125 C-8.47875 6.93125 -8.52 7.55 -8.5625 8.1875 C-8.85125 8.88875 -9.14 9.59 -9.4375 10.3125 C-11.9375 11.3125 -11.9375 11.3125 -15.4375 12.3125 C-24.63463598 15.92103424 -34.52586909 20.17450564 -41.4375 27.3125 C-44.25 28.375 -44.25 28.375 -47.4375 29.3125 C-51.33544157 30.80080496 -54.67353037 32.38381129 -58 34.875 C-61.03532967 37.14308448 -63.81235167 38.15245253 -67.4375 39.3125 C-69.7617187 40.53446933 -72.03391515 41.83192101 -74.3125 43.13671875 C-76.62007612 44.41352098 -78.95233702 45.43066798 -81.4375 46.3125 C-81.1075 45.3225 -80.7775 44.3325 -80.4375 43.3125 C-78.81516988 42.56893203 -77.18504636 41.83857939 -75.5234375 41.1875 C-71.65540272 39.56495358 -68.08020903 37.38097296 -64.4375 35.3125 C-62.8752899 34.45780324 -61.3127947 33.60362736 -59.75 32.75 C-56.18507118 30.77016929 -52.80985917 28.60857433 -49.4375 26.3125 C-48.0699269 25.38478959 -46.69450742 24.46856748 -45.3125 23.5625 C-44.67054688 23.13453125 -44.02859375 22.7065625 -43.3671875 22.265625 C-41.4375 21.3125 -41.4375 21.3125 -37.4375 21.3125 C-36.9425 19.8275 -36.9425 19.8275 -36.4375 18.3125 C-34.7875 17.9825 -33.1375 17.6525 -31.4375 17.3125 C-31.4375 16.3225 -31.4375 15.3325 -31.4375 14.3125 C-30.385625 14.02375 -29.33375 13.735 -28.25 13.4375 C-25.19841892 12.53703345 -22.31283255 11.66559767 -19.4375 10.3125 C-19.1075 9.6525 -18.7775 8.9925 -18.4375 8.3125 C-16.44178677 7.63310826 -14.44155227 6.96688441 -12.4375 6.3125 C-11.7775 5.6525 -11.1175 4.9925 -10.4375 4.3125 C-9.798125 4.168125 -9.15875 4.02375 -8.5 3.875 C-6.33855571 3.49583795 -6.33855571 3.49583795 -5.125 1.75 C-3.4375 0.3125 -3.4375 0.3125 0 0 Z " fill="#5E6B7E" transform="translate(315.4375,168.6875)"/>
+<path d="M0 0 C1.32 0 2.64 0 4 0 C5.17813828 4.20737501 5.13260152 8.28468569 5.11352539 12.62402344 C5.11367142 13.49267532 5.11381744 14.36132721 5.1139679 15.25630188 C5.11327191 18.12401843 5.10549415 20.99166981 5.09765625 23.859375 C5.09579096 25.8490597 5.09436758 27.83874485 5.09336853 29.82843018 C5.08955212 35.06285879 5.07972929 40.29725961 5.06866455 45.53167725 C5.05843162 50.87397892 5.05386687 56.21628509 5.04882812 61.55859375 C5.03810626 72.0390747 5.02104032 82.51953504 5 93 C-1.82295732 93.2301166 -6.59514261 89.9892995 -12 86 C-12 85.34 -12 84.68 -12 84 C-12.78375 84.04125 -13.5675 84.0825 -14.375 84.125 C-17 84 -17 84 -19 82 C-20.5159375 81.5359375 -20.5159375 81.5359375 -22.0625 81.0625 C-23.031875 80.711875 -24.00125 80.36125 -25 80 C-25.33 79.01 -25.66 78.02 -26 77 C-25.45730469 77.28875 -24.91460938 77.5775 -24.35546875 77.875 C-20.80510913 79.57069415 -17.08571035 80.73782536 -13.36328125 82 C-11 83 -11 83 -10 85 C-9.175 85.33 -8.35 85.66 -7.5 86 C-5 87 -5 87 -4 89 C-2.02 89.33 -0.04 89.66 2 90 C2.33 60.63 2.66 31.26 3 1 C2.01 0.67 1.02 0.34 0 0 Z " fill="#CDDDFE" transform="translate(847,858)"/>
+<path d="M0 0 C5.875 0.875 5.875 0.875 7 2 C8.155 2.144375 9.31 2.28875 10.5 2.4375 C11.655 2.623125 12.81 2.80875 14 3 C14.33 3.66 14.66 4.32 15 5 C16.69378804 5.73065366 18.39004523 6.45643145 20.1015625 7.14453125 C22 8 22 8 25.0625 10.0625 C28.95611082 12.63062629 32.85653097 13.67637669 37.3125 14.9375 C38.6428125 15.4634375 38.6428125 15.4634375 40 16 C40.495 17.485 40.495 17.485 41 19 C42.134375 19.12375 43.26875 19.2475 44.4375 19.375 C45.613125 19.58125 46.78875 19.7875 48 20 C48.495 20.99 48.495 20.99 49 22 C51.52733235 22.65555119 51.52733235 22.65555119 54 23 C54.495 24.485 54.495 24.485 55 26 C57.72435637 27.07585059 57.72435637 27.07585059 61 28 C72.27472527 32.54945055 72.27472527 32.54945055 74 36 C77.43814849 37.61795223 80.75026404 38.92137942 84.375 40.0625 C87 41 87 41 88 43 C90.01669827 44.13350534 90.01669827 44.13350534 92 45 C91.01 45.495 91.01 45.495 90 46 C88.33333333 45 86.66666667 44 85 43 C83.9275 42.731875 82.855 42.46375 81.75 42.1875 C77.64517377 40.88763836 74.84574437 39.04327956 71.3515625 36.59375 C68.26349415 34.50083989 65.0347224 32.74258545 61.75 30.98046875 C60 30 60 30 59 29 C57.989375 28.896875 56.97875 28.79375 55.9375 28.6875 C51.38679984 27.8929333 47.99525357 26.23111563 44 24 C44 23.34 44 22.68 44 22 C43.38125 21.9175 42.7625 21.835 42.125 21.75 C40 21 40 21 38.75 18.9375 C38.5025 18.298125 38.255 17.65875 38 17 C36.7625 17.12375 36.7625 17.12375 35.5 17.25 C30.94118822 16.92437059 27.96310646 15.13575971 24 13 C20.39877244 11.3573348 16.95701987 9.95215158 13.125 9 C12.09375 8.67 11.0625 8.34 10 8 C9.67 7.01 9.34 6.02 9 5 C7.00882592 4.30741771 5.0078864 3.64252365 3 3 C1.125 1.375 1.125 1.375 0 0 Z " fill="#BDC3CA" transform="translate(200,346)"/>
+<path d="M0 0 C0.66 0 1.32 0 2 0 C2 35.31 2 70.62 2 107 C3.98 106.01 3.98 106.01 6 105 C8.25 105.375 8.25 105.375 10 106 C5.75755532 108.99466683 4.65814459 109 -1 109 C-0.67 73.03 -0.34 37.06 0 0 Z " fill="#88AEFD" transform="translate(859,739)"/>
+<path d="M0 0 C4.43954231 0.43312608 7.40707525 1.68487716 11.19140625 4.01953125 C13.07473587 5.04051556 14.80417326 5.59564756 16.875 6.125 C18.421875 6.558125 18.421875 6.558125 20 7 C20.33 7.66 20.66 8.32 21 9 C22.99054876 9.69437747 24.99255385 10.35610218 27 11 C32.81707317 13.63414634 32.81707317 13.63414634 34 16 C37.32128657 17.56295839 40.47780006 18.84769168 44 19.875 C47.27662799 21.1037355 49.52255906 22.76691929 52.296875 24.84765625 C54.68974896 26.46668794 57.25717467 27.1033071 60 28 C63.71747911 29.91022818 67.36266509 31.94186388 71 34 C71 34.33 71 34.66 71 35 C69.00045254 35.04254356 66.99958364 35.04080783 65 35 C64.67 34.67 64.34 34.34 64 34 C61.67182036 33.63239269 59.3381615 33.29758419 57 33 C56.67 32.01 56.34 31.02 56 30 C55.34 30 54.68 30 54 30 C54 29.34 54 28.68 54 28 C53.484375 27.896875 52.96875 27.79375 52.4375 27.6875 C47.89479872 26.40622528 43.8903045 24.61208435 40 21.9375 C36.732279 19.82709686 33.72665516 19.02300338 30 18 C29.67 17.34 29.34 16.68 29 16 C26.6859378 15.26924352 24.35171131 14.59861742 22 14 C22 13.34 22 12.68 22 12 C20.35 12 18.7 12 17 12 C16.67 11.01 16.34 10.02 16 9 C14.35 9 12.7 9 11 9 C10.67 7.68 10.34 6.36 10 5 C8.906875 4.731875 7.81375 4.46375 6.6875 4.1875 C3.38307337 3.12336261 2.05039578 2.65345336 0 0 Z " fill="#737F8F" transform="translate(324,174)"/>
+<path d="M0 0 C2.60546875 0.39453125 2.60546875 0.39453125 5 1 C6.19213854 16.75976327 6.25374137 32.54058444 6.29516602 48.33642578 C6.30639631 52.15390258 6.3410776 55.97082279 6.38033772 59.78809929 C6.40641797 62.75120135 6.41484816 65.71416523 6.41844749 68.67737198 C6.423305 70.08639588 6.43489523 71.49541395 6.45348549 72.90432358 C6.4777758 74.86038903 6.47450211 76.8167382 6.4699707 78.77294922 C6.47877007 80.43691238 6.47877007 80.43691238 6.48774719 82.13449097 C5.88775908 85.65941408 4.735058 86.78051325 2 89 C-1.71693921 91.61931958 -5.44465047 93.44783642 -10 94 C-10 93.34 -10 92.68 -10 92 C-9.48050781 91.74605469 -8.96101562 91.49210938 -8.42578125 91.23046875 C-7.72839844 90.88628906 -7.03101563 90.54210937 -6.3125 90.1875 C-5.62800781 89.85105469 -4.94351563 89.51460937 -4.23828125 89.16796875 C-3.49964844 88.78253906 -2.76101563 88.39710938 -2 88 C-0.7136541 87.46761971 -0.7136541 87.46761971 0.59867859 86.92448425 C3.37237412 85.1325553 3.37237412 85.1325553 3.63923645 81.48823547 C3.67149395 80.00592039 3.67613323 78.52285507 3.65942383 77.0402832 C3.67514938 75.82530655 3.67514938 75.82530655 3.69119263 74.58578491 C3.72000664 71.90706371 3.71364399 69.22963005 3.70703125 66.55078125 C3.7201425 64.6941719 3.73544495 62.83757684 3.75285339 60.98100281 C3.79278356 56.09337881 3.80289898 51.20612726 3.80688477 46.31835938 C3.81620114 41.33126469 3.85360523 36.34439022 3.88867188 31.35742188 C3.95332928 21.57162494 3.98650247 11.78599183 4 2 C0.76272927 3.24811236 -1.79780117 4.44539622 -4.5 6.625 C-6.94697954 8.45086439 -7.80480582 8.97923466 -10.9375 9.3125 C-11.618125 9.209375 -12.29875 9.10625 -13 9 C-13.33 9.99 -13.66 10.98 -14 12 C-17.0625 13.1875 -17.0625 13.1875 -20 14 C-20 14.66 -20 15.32 -20 16 C-21.65 16.66 -23.3 17.32 -25 18 C-24.505 16.515 -24.505 16.515 -24 15 C-23.01 15 -22.02 15 -21 15 C-21 14.34 -21 13.68 -21 13 C-20.030625 12.54625 -19.06125 12.0925 -18.0625 11.625 C-14.92920418 10.34213779 -14.92920418 10.34213779 -14 8 C-12.4204228 7.31522883 -10.81026806 6.69997785 -9.1875 6.125 C-5.92577166 4.89721873 -4.18098712 4.18098712 -1.6875 1.6875 C-1.130625 1.130625 -0.57375 0.57375 0 0 Z " fill="#C7D9FE" transform="translate(846,530)"/>
+<path d="M0 0 C2.15822618 0.46961403 4.31446557 0.94615281 6.46875 1.43359375 C8.09015434 1.79640799 9.71503815 2.14419936 11.34375 2.47265625 C13.25283663 2.88421659 15.13126499 3.43270544 17 4 C17.33 4.99 17.66 5.98 18 7 C18.99 7.33 19.98 7.66 21 8 C21.33 8.99 21.66 9.98 22 11 C22.94875 11.103125 23.8975 11.20625 24.875 11.3125 C28 12 28 12 30 15 C32.80376352 16.12949221 32.80376352 16.12949221 36 17 C38.01822402 17.60927518 40.02416285 18.26480478 42 19 C42.495 19.99 42.495 19.99 43 21 C46.58448862 22.72055454 50.03376351 24.05457224 53.875 25.0625 C54.90625 25.371875 55.9375 25.68125 57 26 C57.495 26.99 57.495 26.99 58 28 C58.825 28.33 59.65 28.66 60.5 29 C63 30 63 30 64 32 C65.7117096 33.01960978 65.7117096 33.01960978 67.75 33.9375 C70.13523738 35.07716049 72.32453629 36.2058035 74.5625 37.625 C77.09623703 39.18389043 77.09623703 39.18389043 80.625 40 C83.78970827 40.93769134 85.03317771 41.45470056 87 44 C85.02 43.67 83.04 43.34 81 43 C81 42.34 81 41.68 81 41 C79.88625 41.04125 78.7725 41.0825 77.625 41.125 C74 41 74 41 72 39 C71.319375 38.835 70.63875 38.67 69.9375 38.5 C69.298125 38.335 68.65875 38.17 68 38 C67.67 37.34 67.34 36.68 67 36 C65.05518267 35.01397877 65.05518267 35.01397877 62.75 34.125 C58.95551328 32.51503639 56.1997761 30.61034366 53 28 C49.76895436 26.47259661 46.59908092 25.18638073 43.1875 24.125 C38.5816436 22.49940362 34.33659743 20.23270363 30 18 C28.66757123 17.33152726 27.33456107 16.66420551 26 16 C26 15.34 26 14.68 26 14 C24.35 14 22.7 14 21 14 C20.67 12.68 20.34 11.36 20 10 C18.88625 10.12375 18.88625 10.12375 17.75 10.25 C14.16815607 9.92437782 13.3727202 8.60233828 11 6 C7.81718049 3.98421431 4.70670385 3.50545962 1 3 C0.67 2.01 0.34 1.02 0 0 Z " fill="#C1C6CD" transform="translate(317,437)"/>
+<path d="M0 0 C0.99 0.495 0.99 0.495 2 1 C-2.39042858 4.42453429 -5.2902045 6.58221009 -11 7 C-11 8.32 -11 9.64 -11 11 C-12.98 11 -14.96 11 -17 11 C-17.33 11.99 -17.66 12.98 -18 14 C-19.134375 14.12375 -20.26875 14.2475 -21.4375 14.375 C-22.613125 14.58125 -23.78875 14.7875 -25 15 C-25.33 15.66 -25.66 16.32 -26 17 C-26.845625 17.268125 -27.69125 17.53625 -28.5625 17.8125 C-31.50395425 18.82863874 -33.44205635 19.82579888 -36 21.5 C-39.2512201 23.61391116 -42.27480403 24.8662447 -46 26 C-48.00847365 26.98287008 -50.00819591 27.98377342 -52 29 C-53.2682358 29.52712681 -54.53911091 30.04794686 -55.8125 30.5625 C-59.07910341 31.63196098 -59.07910341 31.63196098 -60 34 C-61.99571323 34.67939174 -63.99594773 35.34561559 -66 36 C-66.66 36.66 -67.32 37.32 -68 38 C-69.2684375 38.2475 -69.2684375 38.2475 -70.5625 38.5 C-71.7690625 38.7475 -71.7690625 38.7475 -73 39 C-73.33 39.66 -73.66 40.32 -74 41 C-75.32 41 -76.64 41 -78 41 C-77.67 39.35 -77.34 37.7 -77 36 C-75.88625 35.87625 -74.7725 35.7525 -73.625 35.625 C-69.96896323 35.3534187 -69.96896323 35.3534187 -68 33 C-67.319375 32.855625 -66.63875 32.71125 -65.9375 32.5625 C-65.298125 32.376875 -64.65875 32.19125 -64 32 C-63.67 31.01 -63.34 30.02 -63 29 C-62.030625 28.87625 -61.06125 28.7525 -60.0625 28.625 C-59.051875 28.41875 -58.04125 28.2125 -57 28 C-56.67 27.34 -56.34 26.68 -56 26 C-50.08053276 23.50759274 -44.1278549 21.81519576 -37.82421875 20.5703125 C-37.22222656 20.38210938 -36.62023437 20.19390625 -36 20 C-35.690625 19.34 -35.38125 18.68 -35.0625 18 C-34.5365625 17.01 -34.5365625 17.01 -34 16 C-31.375 15.25 -31.375 15.25 -29 15 C-29 14.01 -29 13.02 -29 12 C-27.329375 11.814375 -27.329375 11.814375 -25.625 11.625 C-21.96896323 11.3534187 -21.96896323 11.3534187 -20 9 C-18.35735554 8.56419637 -16.71449513 8.12918283 -15.0703125 7.69921875 C-11.8561394 6.61367727 -9.03598546 4.92149775 -6.11328125 3.21875 C-1.97125 0.83 -1.97125 0.83 0 0 Z " fill="#45639C" transform="translate(967,371)"/>
+<path d="M0 0 C3.32720629 2.45162569 5.26378671 4.27954294 7 8 C7.99 8.66 8.98 9.32 10 10 C10 10.66 10 11.32 10 12 C10.66 12 11.32 12 12 12 C12.12375 12.639375 12.2475 13.27875 12.375 13.9375 C12.58125 14.618125 12.7875 15.29875 13 16 C13.66 16.33 14.32 16.66 15 17 C15.81640625 19.25 15.81640625 19.25 16.5625 22 C17.26490893 25.28253366 17.26490893 25.28253366 19 28 C19.09662973 29.936283 19.12187144 31.87614262 19.12025452 33.81483459 C19.12162918 35.07833237 19.12300385 36.34183014 19.12442017 37.64361572 C19.12088055 39.05676293 19.11724574 40.4699099 19.11352539 41.88305664 C19.11324353 43.36101784 19.11340124 44.83897919 19.1139679 46.31694031 C19.1142559 50.34155828 19.1083587 54.36614672 19.10139394 58.3907578 C19.09516088 62.59216365 19.09455664 66.7935701 19.09336853 70.99497986 C19.09025507 78.95646257 19.08204149 86.91793162 19.07201904 94.8794083 C19.06085836 103.94092589 19.05534757 113.00244412 19.05032361 122.06396687 C19.03985888 140.709319 19.02225916 159.35465841 19 178 C18.67 178 18.34 178 18 178 C17.99761165 177.23670285 17.99522329 176.4734057 17.99276257 175.68697834 C17.93363495 157.11705988 17.85809925 138.54727458 17.76428509 119.97749805 C17.71931327 110.99729905 17.67990181 102.01713982 17.65356445 93.03686523 C17.63059559 85.2099526 17.59721005 77.38316572 17.55129844 69.55635279 C17.52735116 65.41183045 17.50863228 61.26743275 17.50238609 57.12284279 C17.496342 53.221534 17.47636688 49.32054422 17.44572449 45.41935349 C17.43693338 43.98791277 17.43322391 42.55643038 17.43499184 41.12496376 C17.43664456 39.16923545 17.41817875 37.21352108 17.39872742 35.25788879 C17.39411845 34.16372052 17.38950949 33.06955225 17.38476086 31.94222736 C16.94665069 28.59204319 15.89617757 26.76433303 14 24 C11 18.44444444 11 18.44444444 11 15 C9.68 15 8.36 15 7 15 C6.6596875 13.7315625 6.6596875 13.7315625 6.3125 12.4375 C4.96513439 8.90868531 3.32162397 6.4647429 1.0234375 3.515625 C0 2 0 2 0 0 Z " fill="#B7BCC6" transform="translate(206,508)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C0.76125579 2.178611 -0.4914801 3.34252915 -1.75 4.5 C-2.44609375 5.1496875 -3.1421875 5.799375 -3.859375 6.46875 C-6 8 -6 8 -10 8 C-10.33 8.99 -10.66 9.98 -11 11 C-14.00684278 12.60831125 -17.07764748 14.03617606 -20.16821289 15.47607422 C-23.27441961 18.24458574 -23.4283988 18.57055038 -23.69702148 22.46142578 C-23.70282383 24.28955402 -23.67545431 26.11798346 -23.62109375 27.9453125 C-23.61497574 28.91153534 -23.60885773 29.87775818 -23.60255432 30.8732605 C-23.5756156 33.95823443 -23.50645089 37.04070886 -23.4375 40.125 C-23.41597748 42.20960981 -23.39706647 44.29424834 -23.38085938 46.37890625 C-23.33871022 50.18541126 -23.29333607 53.99154422 -23.20874023 57.79736328 C-23.19286362 58.56251251 -23.176987 59.32766174 -23.16062927 60.11599731 C-23.10927523 62.08946133 -23.10927523 62.08946133 -22 64 C-21.91360131 66.40838678 -21.88432236 68.78733881 -21.90234375 71.1953125 C-21.9037587 71.90275604 -21.90517365 72.61019958 -21.90663147 73.33908081 C-21.912234 75.60109669 -21.92478682 77.86301398 -21.9375 80.125 C-21.94251468 81.65755065 -21.94707764 83.19010286 -21.95117188 84.72265625 C-21.96220423 88.48180888 -21.97947048 92.24088772 -22 96 C-22.66 96 -23.32 96 -24 96 C-24 99.96 -24 103.92 -24 108 C-24.33 108 -24.66 108 -25 108 C-25.06943466 96.1869235 -25.12277803 84.37389536 -25.15543652 72.56065655 C-25.17110899 67.07560214 -25.19237618 61.59068709 -25.22631836 56.10571289 C-25.2588553 50.8148594 -25.27684109 45.52414015 -25.28463173 40.23319435 C-25.29018543 38.21211444 -25.30103011 36.19104208 -25.31719017 34.17001915 C-25.3388891 31.34454704 -25.34197008 28.51963348 -25.34057617 25.6940918 C-25.351362 24.85396042 -25.36214783 24.01382904 -25.3732605 23.14823914 C-25.34251671 17.409399 -25.34251671 17.409399 -23.61417103 15.34356403 C-21.55032391 13.62570966 -19.30448982 12.38269389 -17 11 C-11.7714673 7.66952758 -11.7714673 7.66952758 -8 3 C-5.67793475 2.29508733 -3.34406932 1.62787571 -1 1 C-0.67 0.67 -0.34 0.34 0 0 Z " fill="#BABFC8" transform="translate(249,762)"/>
+<path d="M0 0 C2.91926519 2.63675566 4.09111127 4.23460384 5 8 C5.99 8.33 6.98 8.66 8 9 C8.103125 9.928125 8.20625 10.85625 8.3125 11.8125 C9.04385456 15.20332568 9.63044426 15.73346842 12 18 C12 19.32 12 20.64 12 22 C12.99 22.33 13.98 22.66 15 23 C15.66015625 25.03125 15.66015625 25.03125 16.0625 27.5 C16.42516952 29.91007019 16.42516952 29.91007019 17 32 C17.66 32.33 18.32 32.66 19 33 C19.34375 35.14453125 19.34375 35.14453125 19.5 37.8125 C19.66533035 41.44525911 19.66533035 41.44525911 20.99829102 44.74902344 C23.01719555 49.28577699 22.41181089 54.5253316 22.42553711 59.41723633 C22.4374466 61.42848137 22.486666 63.43666642 22.53710938 65.44726562 C22.54419922 66.72150391 22.55128906 67.99574219 22.55859375 69.30859375 C22.57204834 70.47189209 22.58550293 71.63519043 22.59936523 72.83374023 C21.83125931 76.89140447 20.10027938 78.38178843 17 81 C15.515 80.505 15.515 80.505 14 80 C14.6496875 79.4121875 14.6496875 79.4121875 15.3125 78.8125 C20.27922398 73.47787054 20.4663431 69.00297094 20.375 62 C20.38660156 61.11054687 20.39820313 60.22109375 20.41015625 59.3046875 C20.38753348 54.25226812 20.00340149 51.21689704 17 47 C16.3046875 44.578125 16.3046875 44.578125 15.875 42.25 C15.49680409 39.34053237 15.49680409 39.34053237 14 37 C13.76712992 35.31816052 13.58735834 33.6287584 13.4375 31.9375 C13.35371094 31.01839844 13.26992188 30.09929688 13.18359375 29.15234375 C13.12300781 28.44207031 13.06242187 27.73179687 13 27 C12.01 27 11.02 27 10 27 C9.67 24.69 9.34 22.38 9 20 C8.01 19.67 7.02 19.34 6 19 C4.9375 15.875 4.9375 15.875 4 12 C3.40653811 9.62615246 2.74712905 7.33477828 2 5 C1.34 4.67 0.68 4.34 0 4 C0 2.68 0 1.36 0 0 Z " fill="#A3A9B6" transform="translate(416,905)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-0.05233685 3.2477975 -1.00667261 4.0022242 -4 5 C-4.99 6.485 -4.99 6.485 -6 8 C-9.125 8.1875 -9.125 8.1875 -12 8 C-12.33 8.99 -12.66 9.98 -13 11 C-13.99 11 -14.98 11 -16 11 C-16 39.38 -16 67.76 -16 97 C-15.01 97.33 -14.02 97.66 -13 98 C-14.65 98 -16.3 98 -18 98 C-18 69.29 -18 40.58 -18 11 C-16.68 10.34 -15.36 9.68 -14 9 C-13.67 8.34 -13.34 7.68 -13 7 C-11.01922047 5.96244882 -9.01470098 4.97004121 -7 4 C-5.74634305 3.25612887 -4.49630401 2.50612586 -3.25 1.75 C-2.1775 1.1725 -1.105 0.595 0 0 Z " fill="#84ACFD" transform="translate(877,849)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C0.60823368 1.96423026 -0.7886223 2.92111602 -2.1875 3.875 C-3.35345703 4.67550781 -3.35345703 4.67550781 -4.54296875 5.4921875 C-6.97252674 6.98314042 -9.35157267 7.96572854 -12 9 C-13.010625 9.680625 -14.02125 10.36125 -15.0625 11.0625 C-18 13 -18 13 -20.25 13.5 C-22.22926762 13.85101127 -22.22926762 13.85101127 -23.25 16.0625 C-23.4975 16.701875 -23.745 17.34125 -24 18 C-24.99 18 -25.98 18 -27 18 C-27.23847656 18.89074219 -27.47695313 19.78148437 -27.72265625 20.69921875 C-29.12733864 24.32905551 -30.65377943 26.12934076 -33.4375 28.8125 C-34.21996094 29.58207031 -35.00242187 30.35164063 -35.80859375 31.14453125 C-38 33 -38 33 -41 34 C-43.77395969 36.99587647 -44.85373196 40.12032356 -46 44 C-46.99 44 -47.98 44 -49 44 C-49.33 46.97 -49.66 49.94 -50 53 C-50.66 53 -51.32 53 -52 53 C-52.33 58.28 -52.66 63.56 -53 69 C-53.33 69 -53.66 69 -54 69 C-54.60456224 58.41344345 -53.98961949 50.62935712 -49 41 C-48.566875 39.948125 -48.13375 38.89625 -47.6875 37.8125 C-45.4891528 34.148588 -42.73942715 31.1771477 -39.83984375 28.05078125 C-37.85342045 25.93476837 -37.85342045 25.93476837 -36 23 C-34.30859375 21.90234375 -34.30859375 21.90234375 -32.4375 20.9375 C-28.96945252 19.40523379 -28.96945252 19.40523379 -28 17 C-26.66666667 16.33333333 -25.33333333 15.66666667 -24 15 C-23.67 14.34 -23.34 13.68 -23 13 C-22.01 13 -21.02 13 -20 13 C-19.8453125 12.0409375 -19.8453125 12.0409375 -19.6875 11.0625 C-19.3471875 10.0415625 -19.3471875 10.0415625 -19 9 C-18.01 8.67 -17.02 8.34 -16 8 C-15.67 7.34 -15.34 6.68 -15 6 C-13 5.66666667 -11 5.33333333 -9 5 C-8.67 4.34 -8.34 3.68 -8 3 C-6.01751285 2.28293018 -4.01584651 1.61709587 -2 1 C-1.34 0.67 -0.68 0.34 0 0 Z " fill="#5E8DEB" transform="translate(463,226)"/>
+<path d="M0 0 C0.53625 0.268125 1.0725 0.53625 1.625 0.8125 C-0.06770833 1.75651042 -1.76041667 2.70052083 -3.453125 3.64453125 C-5.42613077 4.79491029 -5.42613077 4.79491029 -7.30859375 6.3046875 C-9.51692116 7.91605684 -11.70488539 8.98729787 -14.1875 10.125 C-18.35970477 12.14361084 -21.45979059 14.46140759 -24.83984375 17.59375 C-26.88733042 19.2192356 -28.81603664 19.51144549 -31.375 19.8125 C-31.705 20.4725 -32.035 21.1325 -32.375 21.8125 C-33.69715323 22.63703758 -35.05878453 23.39898688 -36.4375 24.125 C-40.27637362 26.17565427 -43.87945572 28.41281647 -47.453125 30.89453125 C-49.375 31.8125 -49.375 31.8125 -54.375 31.8125 C-54.705 48.9725 -55.035 66.1325 -55.375 83.8125 C-55.705 83.8125 -56.035 83.8125 -56.375 83.8125 C-56.375 66.6525 -56.375 49.4925 -56.375 31.8125 C-54.725 31.1525 -53.075 30.4925 -51.375 29.8125 C-51.045 29.1525 -50.715 28.4925 -50.375 27.8125 C-47.8125 27.1875 -47.8125 27.1875 -45.375 26.8125 C-45.375 25.8225 -45.375 24.8325 -45.375 23.8125 C-44.570625 23.52375 -43.76625 23.235 -42.9375 22.9375 C-40.2423532 22.07987432 -40.2423532 22.07987432 -39.375 19.8125 C-37.71427151 19.13117549 -36.047233 18.46507873 -34.375 17.8125 C-33.715 17.1525 -33.055 16.4925 -32.375 15.8125 C-31.694375 15.6475 -31.01375 15.4825 -30.3125 15.3125 C-29.673125 15.1475 -29.03375 14.9825 -28.375 14.8125 C-28.045 14.1525 -27.715 13.4925 -27.375 12.8125 C-22.39207962 9.92020552 -17.14280895 7.05903 -11.5 5.75 C-8.45723314 4.83716994 -7.44778367 4.17776383 -5.1875 2.125 C-2.375 -0.1875 -2.375 -0.1875 0 0 Z " fill="#A8C4FD" transform="translate(1018.375,645.1875)"/>
+<path d="M0 0 C3.23256243 1.61628121 3.67336704 4.76993715 5 8 C5.33 8.33 5.66 8.66 6 9 C6.09660952 10.92361627 6.12187168 12.85083066 6.12025452 14.77687073 C6.12162918 16.03195435 6.12300385 17.28703796 6.12442017 18.58015442 C6.12088055 19.98385644 6.11724574 21.38755822 6.11352539 22.79125977 C6.11324353 24.25936888 6.11340124 25.72747813 6.1139679 27.19558716 C6.1142559 31.19334657 6.10835874 35.19107624 6.10139394 39.18882871 C6.09516085 43.36220733 6.09455664 47.53558656 6.09336853 51.70896912 C6.09025508 59.61732792 6.08204151 67.52567297 6.07201904 75.4340257 C6.06085832 84.43508494 6.05534756 93.43614482 6.05032361 102.43720925 C6.03985891 120.95814731 6.0222592 139.47907255 6 158 C9.77948596 156.51911112 13.3850182 154.84952557 17 153 C16.67 153.99 16.34 154.98 16 156 C15.34 156 14.68 156 14 156 C13.01 157.98 13.01 157.98 12 160 C9.69 160 7.38 160 5 160 C4.99761165 159.26615869 4.99522329 158.53231737 4.99276257 157.77623844 C4.93355568 139.89756563 4.85796925 122.01903019 4.76428509 104.14050388 C4.71937213 95.4944792 4.67994714 86.8484953 4.65356445 78.20239258 C4.63054787 70.66403161 4.59710909 63.12580016 4.55129844 55.587542 C4.52741544 51.59826977 4.50865449 47.60912543 4.50238609 43.6197834 C4.49631284 39.85963181 4.47623288 36.09980723 4.44572449 32.33977699 C4.4328319 30.31262651 4.43450805 28.2853995 4.4367218 26.25820923 C4.3729175 20.0294486 4.05620367 14.67571065 1.70818806 8.86483669 C0.60382103 5.95676145 0.32790489 3.08230597 0 0 Z " fill="#737D90" transform="translate(218,528)"/>
+<path d="M0 0 C4.01150224 1.17409822 7.42177276 2.72610333 11.01171875 4.859375 C14.90819544 7.09468187 18.97244409 9.01423441 23 11 C25.00054259 11.99891408 27.00050075 12.99899912 29 14 C30.11117188 14.55558594 31.22234375 15.11117188 32.3671875 15.68359375 C34.15777997 16.57888999 35.94835527 17.47422088 37.73852539 18.37036133 C40.30325497 19.65390989 42.86883173 20.93536028 45.44140625 22.203125 C48.56953369 23.74576319 51.62532531 25.34861998 54.625 27.125 C57.75737644 28.86520914 60.6103889 29.89318821 64 31 C66.70620388 32.25781307 69.34852467 33.6314966 72 35 C72.99 35.474375 73.98 35.94875 75 36.4375 C77.4580706 37.71774511 79.73215838 39.07282368 82.0625 40.5625 C84.97846294 42.41460501 87.75842659 43.78440997 91 45 C92.42451367 45.64973047 93.84072342 46.31785016 95.25 47 C95.93578125 47.33 96.6215625 47.66 97.328125 48 C99 49 99 49 100 51 C98.53932801 50.54917531 97.08151968 50.08906463 95.625 49.625 C94.81289063 49.36976563 94.00078125 49.11453125 93.1640625 48.8515625 C91 48 91 48 89 46 C87.824375 45.835 86.64875 45.67 85.4375 45.5 C84.303125 45.335 83.16875 45.17 82 45 C81.67 44.34 81.34 43.68 81 43 C79.34302621 42.30959426 77.6744239 41.6469365 76 41 C71.1875 38.375 71.1875 38.375 70 36 C67.68191636 34.96514123 65.34824702 33.9644586 63 33 C62.67 32.67 62.34 32.34 62 32 C59.67182036 31.63239269 57.3381615 31.29758419 55 31 C55 30.34 55 29.68 55 29 C53.96875 28.7525 52.9375 28.505 51.875 28.25 C49.06279974 27.46100594 47.56296544 26.70244455 45.0625 25 C42.30008299 23.19597257 40.85374408 22.60298747 37.75 21.9375 C34 21 34 21 32 18 C28.09772043 15.10116375 24.74832873 14.6391981 20 14 C19.67 13.34 19.34 12.68 19 12 C17.34302621 11.30959426 15.6744239 10.6469365 14 10 C13.21625 9.525625 12.4325 9.05125 11.625 8.5625 C8.90755331 6.84753314 8.90755331 6.84753314 5.3125 5.5625 C2 4 2 4 0.5625 1.8125 C0.376875 1.214375 0.19125 0.61625 0 0 Z " fill="#BEC4CB" transform="translate(404,481)"/>
+<path d="M0 0 C1.25876953 0.41185547 1.25876953 0.41185547 2.54296875 0.83203125 C3.85201172 1.31736328 3.85201172 1.31736328 5.1875 1.8125 C6.06792969 2.12832031 6.94835937 2.44414063 7.85546875 2.76953125 C10 4 10 4 10.80078125 6.13671875 C10.89939453 7.05904297 10.89939453 7.05904297 11 8 C11.680625 8.061875 12.36125 8.12375 13.0625 8.1875 C16.47124485 9.13034432 18.45019686 10.69058371 21.234375 12.796875 C23.66351168 14.45212743 26.19159648 15.18868343 29 16 C32.30706008 17.3779417 32.91162262 17.86743394 35 21 C37.54609974 22.43019872 40.06012478 23.73961802 42.6875 25 C43.38294922 25.34289062 44.07839844 25.68578125 44.79492188 26.0390625 C48.14510164 27.6781794 51.50194473 29.22001973 54.95703125 30.625 C58 32 58 32 59 34 C59.825 34.495 60.65 34.99 61.5 35.5 C64 37 64 37 65 39 C63.68 39 62.36 39 61 39 C61 38.34 61 37.68 61 37 C59.68 36.34 58.36 35.68 57 35 C57 34.34 57 33.68 57 33 C56.13375 32.9175 55.2675 32.835 54.375 32.75 C50.47227743 31.88272832 48.29164311 30.23831732 45 28 C43.00486291 27.15467083 40.98660331 26.4327373 38.9453125 25.70703125 C33.41078996 23.69548792 29.45779382 20.79386708 25 17 C21.47384866 14.61984785 18.06931119 13.23025687 14 12 C14 11.34 14 10.68 14 10 C11.525 9.01 11.525 9.01 9 8 C9 7.34 9 6.68 9 6 C8.030625 5.690625 7.06125 5.38125 6.0625 5.0625 C3 4 3 4 2 3 C0.35769636 2.8754514 -1.29052276 2.82431476 -2.9375 2.8125 C-3.83339844 2.79832031 -4.72929688 2.78414062 -5.65234375 2.76953125 C-8.19114534 2.76805231 -8.19114534 2.76805231 -10 5 C-11.65829673 5.68722207 -13.32704372 6.3492777 -15 7 C-17.44864291 8.19064925 -19.88419911 9.3945942 -22.3125 10.625 C-22.95767578 10.94984375 -23.60285156 11.2746875 -24.26757812 11.609375 C-25.84597541 12.40441956 -27.42311694 13.20195634 -29 14 C-28 11 -28 11 -26.00390625 9.9375 C-25.19824219 9.628125 -24.39257812 9.31875 -23.5625 9 C-20.02469848 7.63712301 -19.19275781 7.28913671 -17 4 C-14.875 3 -14.875 3 -12 2 C-11.35160156 1.72800781 -10.70320312 1.45601562 -10.03515625 1.17578125 C-8.99681641 0.74845703 -8.99681641 0.74845703 -7.9375 0.3125 C-7.28652344 0.04050781 -6.63554688 -0.23148438 -5.96484375 -0.51171875 C-3.54870827 -1.11215003 -2.35073505 -0.78652413 0 0 Z " fill="#A4C1FE" transform="translate(857,513)"/>
+<path d="M0 0 C2.64 0 5.28 0 8 0 C8 0.99 8 1.98 8 3 C8.90492188 2.94779297 8.90492188 2.94779297 9.828125 2.89453125 C14.7982784 2.72618734 17.08389971 2.81816851 21 6 C23.27775842 6.65198223 25.55286961 7.12314863 27.87890625 7.5703125 C30 8 30 8 33 9 C34.60148394 9.20138735 36.20808105 9.36362644 37.81640625 9.5 C38.74517578 9.5825 39.67394531 9.665 40.63085938 9.75 C42.58916453 9.91699738 44.54749804 10.08366274 46.50585938 10.25 C47.43333984 10.3325 48.36082031 10.415 49.31640625 10.5 C50.16662354 10.5721875 51.01684082 10.644375 51.89282227 10.71875 C54 11 54 11 56 12 C57.81036822 12.22133998 59.62712099 12.39161482 61.4453125 12.53515625 C62.52167969 12.62216797 63.59804688 12.70917969 64.70703125 12.79882812 C66.39892578 12.9293457 66.39892578 12.9293457 68.125 13.0625 C69.82849609 13.19881836 69.82849609 13.19881836 71.56640625 13.33789062 C74.37733201 13.56229226 77.18850766 13.78283166 80 14 C80 14.66 80 15.32 80 16 C97.49 16.33 114.98 16.66 133 17 C133 17.33 133 17.66 133 18 C125.8141354 18.02553888 118.62828269 18.04294555 111.44238281 18.05493164 C109.0022742 18.05993319 106.56216853 18.06673655 104.12207031 18.07543945 C100.59699775 18.0876893 97.07196511 18.09327026 93.546875 18.09765625 C91.93362335 18.10539818 91.93362335 18.10539818 90.28778076 18.11329651 C83.14462629 18.1138152 76.10826543 17.700824 69 17 C69 16.34 69 15.68 69 15 C68.44538086 14.98018066 67.89076172 14.96036133 67.31933594 14.93994141 C64.79576307 14.84442349 62.27298776 14.73485433 59.75 14.625 C58.44095703 14.57859375 58.44095703 14.57859375 57.10546875 14.53125 C55.83896484 14.47324219 55.83896484 14.47324219 54.546875 14.4140625 C53.77182617 14.3826416 52.99677734 14.3512207 52.19824219 14.31884766 C49.77858064 13.96788386 48.16390065 13.10470542 46 12 C43.31217398 11.75361595 40.69184052 11.58290089 38 11.5 C29.91360522 11.25096248 29.91360522 11.25096248 26 9 C23.65220583 8.43179435 21.30134739 7.99795566 18.92578125 7.5625 C18.29027344 7.376875 17.65476562 7.19125 17 7 C16.67 6.34 16.34 5.68 16 5 C13.19019327 4.30772968 13.19019327 4.30772968 9.9375 3.875 C8.28041016 3.62363281 8.28041016 3.62363281 6.58984375 3.3671875 C5.73519531 3.24601562 4.88054687 3.12484375 4 3 C4 2.34 4 1.68 4 1 C2.68 0.67 1.36 0.34 0 0 Z " fill="#4869A7" transform="translate(481,353)"/>
+<path d="M0 0 C4.46254673 0.65305562 8.71702233 1.57234078 13 3 C13.33 3.66 13.66 4.32 14 5 C17.02934491 5.65772428 17.02934491 5.65772428 20 6 C20.33 6.99 20.66 7.98 21 9 C22.97583715 9.73519522 24.98177598 10.39072482 27 11 C32.81707317 13.63414634 32.81707317 13.63414634 34 16 C34.845625 16.268125 35.69125 16.53625 36.5625 16.8125 C39.47361167 17.81815676 41.40225307 18.79008274 43.9375 20.4375 C48.53790719 23.40804864 52.81897053 25.670788 58.3125 26.5 C59.199375 26.665 60.08625 26.83 61 27 C61.66 27.99 62.32 28.98 63 30 C66.0882965 30.93558491 69.1843985 31.52435071 72.34765625 32.15625 C73.22292969 32.4346875 74.09820312 32.713125 75 33 C75.33 33.99 75.66 34.98 76 36 C76.9075 36.04125 77.815 36.0825 78.75 36.125 C82 37 82 37 84.375 40.0625 C84.91125 41.031875 85.4475 42.00125 86 43 C81.34168654 41.6690533 77.98815575 39.71194591 74 37 C70.24803493 34.88232647 66.65165753 33.18618787 62.5 32 C59.0316778 31.0090508 56.1794294 29.67755401 53 28.01953125 C50.06198566 26.52183253 47.04326661 25.26802775 44 24 C44 23.34 44 22.68 44 22 C43.38125 21.87625 42.7625 21.7525 42.125 21.625 C40 21 40 21 38 19 C34.78230481 17.80271807 31.58186879 16.8954672 28.25 16.0625 C25 15 25 15 23 12 C21.63875 11.566875 21.63875 11.566875 20.25 11.125 C17 10 17 10 14.0625 7.4375 C10.51942587 4.61750222 8.39518907 4.56974673 4 4 C1.5625 1.9375 1.5625 1.9375 0 0 Z " fill="#86909E" transform="translate(231,394)"/>
+<path d="M0 0 C1.32 0.33 2.64 0.66 4 1 C3.01 1 2.02 1 1 1 C1 1.99 1 2.98 1 4 C0.27554688 4.38671875 -0.44890625 4.7734375 -1.1953125 5.171875 C-5.31512106 7.39107855 -9.36535903 9.57283781 -13.25 12.1875 C-15.76754154 13.84678874 -18.23170429 15.01753769 -21.01171875 16.1640625 C-27.99902764 19.10175229 -34.33174715 21.85756204 -39 28 C-39.9168022 31.54321553 -39.9168022 31.54321553 -39 35 C-36.54905772 37.98087575 -34.20472002 39.86351998 -31 42 C-34.89407957 41.65640474 -37.86365113 40.38438401 -40.8359375 37.80078125 C-43.2678515 34.03865926 -42.5448558 29.28298039 -42 25 C-41.67 24.34 -41.34 23.68 -41 23 C-40.34 23 -39.68 23 -39 23 C-38.67 22.01 -38.34 21.02 -38 20 C-35.53125 18.68359375 -35.53125 18.68359375 -32.5 17.4375 C-28.49211799 16.06397128 -28.49211799 16.06397128 -26 13 C-24.0187415 12.27954236 -22.01495907 11.61998741 -20 11 C-15.75184667 9.57262152 -15.75184667 9.57262152 -13 6 C-11.33333333 5.66666667 -9.66666667 5.33333333 -8 5 C-7.34 4.01 -6.68 3.02 -6 2 C-2.875 1.8125 -2.875 1.8125 0 2 C0 1.34 0 0.68 0 0 Z " fill="#637083" transform="translate(145,260)"/>
+<path d="M0 0 C1.32 0 2.64 0 4 0 C5.73473712 1.94125344 7.4045651 3.94272868 9 6 C9.66 6.33 10.32 6.66 11 7 C11.33 7.99 11.66 8.98 12 10 C12.66 10.33 13.32 10.66 14 11 C14.72455635 12.64232772 15.37774395 14.31624835 16 16 C17.51535548 20.31309915 17.51535548 20.31309915 20 24 C21.99899523 33.77286555 22.09169146 43.81711994 18 53 C17.62101563 53.92296875 17.24203125 54.8459375 16.8515625 55.796875 C13.53511883 63.19657013 9.18251272 68.58165733 3.5859375 74.30859375 C0.97527023 76.92216268 0.97527023 76.92216268 -1.1015625 79.765625 C-3.67555298 82.79509528 -6.19013885 83.19406783 -10 84 C-7.6017087 81.50577705 -5.10917497 79.25304706 -2.4375 77.0625 C0.45485022 74.61135575 2.13602835 72.32273208 4 69 C5.87937743 66.55885215 7.78313388 64.14276474 10 62 C10.66 62 11.32 62 12 62 C12.0825 61.29875 12.165 60.5975 12.25 59.875 C13.17029865 56.34718852 14.95812462 53.99900446 17 51 C18.4952102 46.4009069 18.18411611 41.6598237 18.1875 36.875 C18.20586914 35.49634766 18.20586914 35.49634766 18.22460938 34.08984375 C18.22654297 33.21199219 18.22847656 32.33414063 18.23046875 31.4296875 C18.23457764 30.62772949 18.23868652 29.82577148 18.24291992 28.99951172 C18.18052464 26.76941371 18.18052464 26.76941371 16 25 C15.9175 23.96875 15.835 22.9375 15.75 21.875 C14.17247968 13.72447835 7.54877082 8.35632573 1.7578125 2.78515625 C0 1 0 1 0 0 Z " fill="#5279C6" transform="translate(744,249)"/>
+<path d="M0 0 C-3.11881841 3.44711508 -6.47706486 5.54635975 -10.9375 6.875 C-14.19320451 7.87631539 -14.19320451 7.87631539 -17 10.5 C-20.02456613 13.02047177 -22.25734297 13.95553757 -26 15 C-26.495 15.495 -26.495 15.495 -27 16 C-29.33297433 16.04092937 -31.66705225 16.04241723 -34 16 C-34 16.99 -34 17.98 -34 19 C-36.71950753 21.06023298 -38.99247555 21.99815438 -42.3125 22.8125 C-46.39702342 24.127855 -48.78551154 25.97890133 -52.08984375 28.62109375 C-54.55207462 30.3985324 -57.12747556 31.06330725 -60 32 C-61.42120298 33.1951025 -62.84051832 34.3932002 -64.2265625 35.62890625 C-68.77447866 39.14502645 -74.37521475 41.80764921 -80 43 C-77.63707344 40.47411298 -76.33537489 39.11179163 -73 38 C-72.67 37.34 -72.34 36.68 -72 36 C-70.00934459 34.98152514 -68.00751815 33.98482022 -66 33 C-64.96875 32.29875 -63.9375 31.5975 -62.875 30.875 C-60.33096808 29.21584875 -58.83186758 28.70796689 -56 28 C-55.34 27.01 -54.68 26.02 -54 25 C-52.01276732 24.29618843 -50.01222047 23.6288189 -48 23 C-47.34 22.34 -46.68 21.68 -46 21 C-44.68 21 -43.36 21 -42 21 C-42 20.01 -42 19.02 -42 18 C-41.030625 17.87625 -40.06125 17.7525 -39.0625 17.625 C-38.051875 17.41875 -37.04125 17.2125 -36 17 C-35.67 16.34 -35.34 15.68 -35 15 C-33.00491933 14.31875294 -31.00361307 13.65572791 -29 13 C-26.91790997 11.97859734 -24.87219018 10.9072586 -22.83203125 9.8046875 C-21 9 -21 9 -18 9 C-17.67 7.35 -17.34 5.7 -17 4 C-16.030625 3.87625 -15.06125 3.7525 -14.0625 3.625 C-13.051875 3.41875 -12.04125 3.2125 -11 3 C-10.67 2.34 -10.34 1.68 -10 1 C-6.3241179 -0.55203911 -3.80989402 -1.46534385 0 0 Z " fill="#88919F" transform="translate(509,66)"/>
+<path d="M0 0 C0.55429687 0.2784375 1.10859375 0.556875 1.6796875 0.84375 C3.28496753 1.64368752 4.89466836 2.4347921 6.5078125 3.21875 C7.37148438 3.6415625 8.23515625 4.064375 9.125 4.5 C9.99382813 4.9228125 10.86265625 5.345625 11.7578125 5.78125 C14 7 14 7 16 9 C16.845625 9.165 17.69125 9.33 18.5625 9.5 C19.366875 9.665 20.17125 9.83 21 10 C21.33 10.66 21.66 11.32 22 12 C22.99 12.2165625 22.99 12.2165625 24 12.4375 C24.66 12.623125 25.32 12.80875 26 13 C26.33 13.99 26.66 14.98 27 16 C29.70363009 17.93116435 32.06618736 19.02036534 35.25 20 C36.1575 20.33 37.065 20.66 38 21 C38.495 22.485 38.495 22.485 39 24 C39.721875 24.103125 40.44375 24.20625 41.1875 24.3125 C44.27793421 25.06793947 46.41743841 26.15531315 49 28 C49 28.66 49 29.32 49 30 C50.97986082 29.88652381 52.95891598 29.7589065 54.9375 29.625 C56.03964844 29.55539062 57.14179687 29.48578125 58.27734375 29.4140625 C59.17582031 29.27742187 60.07429687 29.14078125 61 29 C61.33 28.34 61.66 27.68 62 27 C64.64860427 26.40644386 67.29197322 26.25790731 70 26 C66.60750339 29.69183455 63.55763348 31.92834842 59 34 C58.67 34.33 58.34 34.66 58 35 C54.36113938 35.51983723 52.95087332 34.97219245 49.6875 33.125 C48.800625 32.42375 47.91375 31.7225 47 31 C47 30.34 47 29.68 47 29 C46.13375 28.731875 45.2675 28.46375 44.375 28.1875 C41.07295105 27.02566796 38.10008256 25.61743438 35 24 C34.2575 23.67 33.515 23.34 32.75 23 C31 22 31 22 29 19 C28.13375 18.484375 27.2675 17.96875 26.375 17.4375 C25.59125 16.963125 24.8075 16.48875 24 16 C24 15.34 24 14.68 24 14 C23.41992188 13.86207031 22.83984375 13.72414063 22.2421875 13.58203125 C13.46473782 11.30356435 6.76653939 6.96099899 0 1 C0 0.67 0 0.34 0 0 Z " fill="#A1BFFD" transform="translate(901,638)"/>
+<path d="M0 0 C4.35430628 0.65974338 7.99216111 2.20338257 12 4 C15.42518006 5.50227195 18.73079019 6.91872911 22.3125 8 C25 9 25 9 27 12 C29.05003955 13.19232613 29.05003955 13.19232613 31 14 C31 14.66 31 15.32 31 16 C31.721875 16.103125 32.44375 16.20625 33.1875 16.3125 C37.37975434 17.33727328 40.44068776 19.62712517 44 22 C44.845625 22.144375 45.69125 22.28875 46.5625 22.4375 C49 23 49 23 51 26 C54.28037711 27.6092416 57.19294693 28.87445841 60.8125 29.4375 C63 30 63 30 64.3125 32.0625 C64.539375 32.701875 64.76625 33.34125 65 34 C63.68528432 33.71848913 62.37324233 33.42446661 61.0625 33.125 C60.33160156 32.96257813 59.60070312 32.80015625 58.84765625 32.6328125 C57 32 57 32 56 30 C53.32170239 28.87749959 50.66865055 27.84991113 47.9375 26.875 C47.17888672 26.59785156 46.42027344 26.32070313 45.63867188 26.03515625 C43.76143432 25.35037777 41.88100446 24.67436237 40 24 C40 23.34 40 22.68 40 22 C39.278125 21.896875 38.55625 21.79375 37.8125 21.6875 C34.74014552 20.93648002 32.67905871 19.64865151 30 18 C27.80869466 17.30420546 27.80869466 17.30420546 26 17 C26 16.34 26 15.68 26 15 C24.35 15 22.7 15 21 15 C20.67 14.01 20.34 13.02 20 12 C18.34015202 11.31653318 16.67163195 10.65411685 15 10 C13.87716025 9.23504835 12.77411869 8.44058565 11.6875 7.625 C7.99976441 4.88762798 4.14659349 2.96417586 0 1 C0 0.67 0 0.34 0 0 Z " fill="#778292" transform="translate(84,934)"/>
+<path d="M0 0 C20.79 0 41.58 0 63 0 C63 0.99 63 1.98 63 3 C42.54 3 22.08 3 1 3 C0.67 2.01 0.34 1.02 0 0 Z " fill="#263852" transform="translate(555,390)"/>
+<path d="M0 0 C1.5921785 0.00666183 1.5921785 0.00666183 3.21652222 0.01345825 C4.41761627 0.01360931 5.61871033 0.01376038 6.85620117 0.01391602 C8.15830536 0.02423859 9.46040955 0.03456116 10.80197144 0.04519653 C12.14432566 0.04892627 13.48668261 0.05177343 14.82904053 0.05377197 C18.36367294 0.06141159 21.89814122 0.08106273 25.43270874 0.10317993 C29.03884663 0.12363138 32.64501103 0.13277218 36.25119019 0.14285278 C43.32808029 0.16430843 50.4048589 0.19844824 57.48165894 0.24050903 C57.97665894 1.72550903 57.97665894 1.72550903 58.48165894 3.24050903 C57.91965286 3.23606781 57.35764679 3.23162659 56.77861023 3.22705078 C19.33435447 2.924576 19.33435447 2.924576 -18.02761841 5.05300903 C-21.20653082 5.29231552 -24.33248058 5.31260771 -27.51834106 5.24050903 C-27.51834106 5.90050903 -27.51834106 6.56050903 -27.51834106 7.24050903 C-28.83834106 6.91050903 -30.15834106 6.58050903 -31.51834106 6.24050903 C-29.75582898 3.99937254 -28.86839739 3.29633977 -26.00637817 2.83987427 C-25.02934937 2.82641968 -24.05232056 2.81296509 -23.04568481 2.79910278 C-21.98156372 2.772677 -20.91744263 2.74625122 -19.82107544 2.71902466 C-18.7105481 2.7054895 -17.60002075 2.69195435 -16.45584106 2.67800903 C-14.25647074 2.64366375 -12.05720836 2.60111122 -9.85818481 2.54910278 C-8.88228394 2.53677612 -7.90638306 2.52444946 -6.90090942 2.51174927 C-3.71818593 2.14941647 -3.22936778 0.30841419 0 0 Z " fill="#385077" transform="translate(560.5183410644531,200.75949096679688)"/>
+<path d="M0 0 C4.58074963 1.41484928 8.84311285 3.23866061 13.125 5.375 C14.03572266 5.81199219 14.03572266 5.81199219 14.96484375 6.2578125 C17.76716511 7.64981527 19.95652685 8.9561352 22.16796875 11.1875 C24.29835258 13.29517185 25.25205469 13.50383715 28.1875 13.625 C29.445625 13.74875 30.70375 13.8725 32 14 C32.495 14.99 32.495 14.99 33 16 C37.73901307 18.55407862 42.86427902 20.41977816 48 22 C48 22.66 48 23.32 48 24 C49.27875 24.144375 50.5575 24.28875 51.875 24.4375 C54.25692894 24.70642746 55.84452691 24.92226346 58 26 C58 26.66 58 27.32 58 28 C55.85318469 27.52525225 53.70756772 27.04508251 51.5625 26.5625 C50.36753906 26.29566406 49.17257812 26.02882813 47.94140625 25.75390625 C45 25 45 25 44 24 C42.7625 23.896875 41.525 23.79375 40.25 23.6875 C36.02440822 23.21053726 34.31019802 21.69434723 31 19 C28.13952588 17.85992614 25.25758212 16.87745304 22.328125 15.9296875 C20 15 20 15 19 13 C17.52619826 12.21923598 16.01970632 11.49965116 14.5 10.8125 C9.11747191 8.21430561 4.44737341 4.9961906 0 1 C0 0.67 0 0.34 0 0 Z " fill="#AEB5BE" transform="translate(424,352)"/>
+<path d="M0 0 C0.680625 0.680625 1.36125 1.36125 2.0625 2.0625 C2.74892578 2.74119141 2.74892578 2.74119141 3.44921875 3.43359375 C4.5351907 4.53050748 5.59870565 5.64990138 6.64453125 6.78515625 C11.72417364 12.18585956 17.18174108 15.65201463 24.8125 16.203125 C25.864375 16.21859375 26.91625 16.2340625 28 16.25 C29.5778125 16.28867188 29.5778125 16.28867188 31.1875 16.328125 C34.42520444 15.95039282 34.87778443 15.29102817 37 13 C38.32 13 39.64 13 41 13 C41.03738281 12.3915625 41.07476563 11.783125 41.11328125 11.15625 C42 9 42 9 44.73046875 7.65625 C45.87128906 7.2746875 47.01210938 6.893125 48.1875 6.5 C53.01815447 4.78538308 56.95175505 3.12293182 61 0 C61.66 0.33 62.32 0.66 63 1 C60.79631059 3.41290042 58.64053626 4.86909125 55.75 6.375 C52.72557175 7.99786394 49.93668038 9.69553691 47.1875 11.75 C44 14 44 14 42.05078125 14.390625 C39.80519078 14.84756276 39.80519078 14.84756276 38.34765625 17.0390625 C34.69054046 20.09375822 31.04643905 19.50638761 26.4375 19.375 C25.57447266 19.37371094 24.71144531 19.37242188 23.82226562 19.37109375 C17.42237723 19.28158482 17.42237723 19.28158482 14 17 C14 16.34 14 15.68 14 15 C13.195625 14.9071875 13.195625 14.9071875 12.375 14.8125 C7.17766187 13.03446327 2.9914456 8.4871684 0 4 C0 2.68 0 1.36 0 0 Z " fill="#415D90" transform="translate(591,1158)"/>
+<path d="M0 0 C1.98 0 3.96 0 6 0 C6.33 0.66 6.66 1.32 7 2 C9.08611558 2.650539 9.08611558 2.650539 11.5 3.0625 C15.90606654 3.90606654 15.90606654 3.90606654 17 5 C34.60272433 7.10920218 57.15723582 8.76642426 74 3 C76.375 3.375 76.375 3.375 78 4 C75.36 4.33 72.72 4.66 70 5 C70 5.66 70 6.32 70 7 C49.87767711 12.95167297 25.51852776 11.87589717 6 4 C5.34 3.34 4.68 2.68 4 2 C2.68252676 1.30251417 1.35085807 0.63040043 0 0 Z " fill="#DFE1E5" transform="translate(534,514)"/>
+<path d="M0 0 C0.391875 0.45375 0.78375 0.9075 1.1875 1.375 C2.93339098 3.14134108 2.93339098 3.14134108 5.375 3.875 C8 5 8 5 10.375 7.5 C13.46053401 10.43860382 15.92609171 10.98152293 20 12 C20.33 12.66 20.66 13.32 21 14 C23.9263311 15.66268812 26.42772752 16.89595046 29.75 17.5 C32 18 32 18 34 21 C36.30609459 22.1587633 36.30609459 22.1587633 38.9375 23.0625 C41.99531134 24.18384761 44.26398355 25.17598903 47 27 C48.11375 27.2475 49.2275 27.495 50.375 27.75 C54.98543573 29.33980542 56.20703397 31.10677463 59 35 C58.01 35.495 58.01 35.495 57 36 C57 35.34 57 34.68 57 34 C55.35 34 53.7 34 52 34 C51.67 33.34 51.34 32.68 51 32 C49.845 31.690625 48.69 31.38125 47.5 31.0625 C45.7675 30.5365625 45.7675 30.5365625 44 30 C43.505 28.515 43.505 28.515 43 27 C42.34 26.896875 41.68 26.79375 41 26.6875 C37.87443087 25.97122374 35.05280077 24.92233148 32.0703125 23.765625 C29.08941466 22.66325523 26.06675956 21.83058071 23 21 C22.95875 20.4225 22.9175 19.845 22.875 19.25 C21.56452319 15.88020248 19.09243338 14.58666099 16 13 C14.3406056 12.33570435 12.67330429 11.69093555 11 11.0625 C6.4624493 9.31465192 3.3601832 7.53703494 0 4 C0 2.68 0 1.36 0 0 Z " fill="#9FA7B3" transform="translate(345,152)"/>
+<path d="M0 0 C0.515625 0.309375 1.03125 0.61875 1.5625 0.9375 C4.1293925 2.18828017 4.1293925 2.18828017 7.6875 2.5 C9.3271875 2.7475 9.3271875 2.7475 11 3 C11.33 3.66 11.66 4.32 12 5 C13.65697379 5.69040574 15.3255761 6.3530635 17 7 C19.8125 8.4375 19.8125 8.4375 22 10 C22 10.99 22 11.98 22 13 C22.78375 13.12375 23.5675 13.2475 24.375 13.375 C27 14 27 14 29 16 C30.11375 16.433125 30.11375 16.433125 31.25 16.875 C34.50412029 18.20623103 37.11317921 19.99689986 40 22 C44.94963648 25.40287508 49.53913564 28.41834115 55.4375 29.8125 C59.92610063 31.30870021 62.64193837 33.75421399 66 37 C60.11620813 37 54.45357639 34.06859794 49 32 C49 31.01 49 30.02 49 29 C48.113125 29.12375 47.22625 29.2475 46.3125 29.375 C43 29 43 29 40.5 26.125 C40.0978125 25.57457031 39.695625 25.02414062 39.28125 24.45703125 C37.27838783 22.17938617 34.86519929 21.77599147 32 21 C27.22727273 18.45454545 27.22727273 18.45454545 26 16 C23.6859378 15.26924352 21.35171131 14.59861742 19 14 C18.67 12.68 18.34 11.36 18 10 C17.46632812 9.89429688 16.93265625 9.78859375 16.3828125 9.6796875 C13.35524839 8.81608725 10.69718387 7.51875665 7.875 6.125 C6.82054687 5.61195313 5.76609375 5.09890625 4.6796875 4.5703125 C2 3 2 3 0 0 Z " fill="#939CA9" transform="translate(220,1006)"/>
+<path d="M0 0 C2.97 0 5.94 0 9 0 C9 0.33 9 0.66 9 1 C2.12914952 3.79923538 -4.45495324 4.64976109 -11.79052734 5.26513672 C-15.5812794 5.60784457 -17.7762087 5.8508058 -21 8 C-23.8190918 8.31884766 -23.8190918 8.31884766 -27.19921875 8.4140625 C-29.01196289 8.47207031 -29.01196289 8.47207031 -30.86132812 8.53125 C-32.7552832 8.57765625 -32.7552832 8.57765625 -34.6875 8.625 C-36.59885742 8.68300781 -36.59885742 8.68300781 -38.54882812 8.7421875 C-41.69907292 8.83657686 -44.84930991 8.9221583 -48 9 C-48 9.66 -48 10.32 -48 11 C-55.06580552 11.0506353 -62.1315644 11.0857062 -69.19750977 11.10986328 C-71.60214995 11.11993201 -74.00677786 11.13358785 -76.41137695 11.15087891 C-79.86412584 11.17508874 -83.3167131 11.18647432 -86.76953125 11.1953125 C-88.38683891 11.21079636 -88.38683891 11.21079636 -90.03681946 11.22659302 C-91.53803596 11.22681961 -91.53803596 11.22681961 -93.06958008 11.22705078 C-93.95116287 11.231492 -94.83274567 11.23593323 -95.74104309 11.24050903 C-98 11 -98 11 -101 9 C-99.72829956 9.01571045 -99.72829956 9.01571045 -98.4309082 9.03173828 C-79.63427026 9.23147389 -61.06823294 8.8660283 -42.32275391 7.25830078 C-39.96297064 7.07485841 -37.59991723 6.93153052 -35.23583984 6.81591797 C-33.99656738 6.75162598 -32.75729492 6.68733398 -31.48046875 6.62109375 C-29.79860474 6.54846313 -29.79860474 6.54846313 -28.08276367 6.47436523 C-24.70406644 5.95446275 -22.86581352 4.79399339 -20 3 C-17.68823242 2.56762695 -17.68823242 2.56762695 -15.35546875 2.48828125 C-14.51435547 2.45283203 -13.67324219 2.41738281 -12.80664062 2.38085938 C-11.94232422 2.35830078 -11.07800781 2.33574219 -10.1875 2.3125 C-8.86202148 2.26125977 -8.86202148 2.26125977 -7.50976562 2.20898438 C-5.34027833 2.12689567 -3.1701611 2.06176121 -1 2 C-0.67 1.34 -0.34 0.68 0 0 Z " fill="#557FD0" transform="translate(662,359)"/>
+<path d="M0 0 C0.33 0.66 0.66 1.32 1 2 C0.38125 2.4125 -0.2375 2.825 -0.875 3.25 C-3.07576498 4.80189832 -3.07576498 4.80189832 -3.859375 6.8828125 C-5.2891528 9.53671513 -6.97587764 10.8156951 -9.375 12.625 C-10.14585937 13.21539062 -10.91671875 13.80578125 -11.7109375 14.4140625 C-14 16 -14 16 -16.2265625 17.0234375 C-18.35497492 17.93412008 -18.35497492 17.93412008 -19 21 C-17.35 21.33 -15.7 21.66 -14 22 C-14 22.66 -14 23.32 -14 24 C-12.02 24 -10.04 24 -8 24 C-7.67 24.99 -7.34 25.98 -7 27 C-5.31743792 27.72581109 -3.63116666 28.44506061 -1.921875 29.10546875 C1.19361585 30.5555651 3.45907134 32.70696682 6 35 C2.45424969 35 0.26856076 34.04539473 -3 32.6875 C-4.051875 32.25824219 -5.10375 31.82898438 -6.1875 31.38671875 C-8.75347925 30.12154843 -10.11853075 29.07890738 -12 27 C-15.84804119 25.18286944 -19.90397069 24.1244002 -24 23 C-24.24862931 20.01644824 -24.18991433 18.35134151 -22.75 15.6875 C-21 14 -21 14 -17 14 C-16.67 13.01 -16.34 12.02 -16 11 C-14.33826345 10.32113782 -12.67049507 9.6570148 -11 9 C-9.01694355 7.51739099 -7.08024714 5.97129277 -5.1875 4.375 C-4.21167969 3.55773437 -3.23585938 2.74046875 -2.23046875 1.8984375 C-1.49441406 1.27195312 -0.75835938 0.64546875 0 0 Z " fill="#B9BEC7" transform="translate(766,338)"/>
+<path d="M0 0 C0.66 0 1.32 0 2 0 C1.67 1.32 1.34 2.64 1 4 C-0.134375 4.12375 -1.26875 4.2475 -2.4375 4.375 C-3.613125 4.58125 -4.78875 4.7875 -6 5 C-6.33 5.66 -6.66 6.32 -7 7 C-8.9812585 7.72045764 -10.98504093 8.38001259 -13 9 C-16.84845191 10.15050826 -16.84845191 10.15050826 -19.3125 13.125 C-19.539375 13.74375 -19.76625 14.3625 -20 15 C-21.98 15 -23.96 15 -26 15 C-26.33 15.99 -26.66 16.98 -27 18 C-31.26063699 19.50375423 -35.5364662 20.34679993 -40 21 C-40 22.32 -40 23.64 -40 25 C-41.98 25 -43.96 25 -46 25 C-46.33 25.99 -46.66 26.98 -47 28 C-49.31 28 -51.62 28 -54 28 C-54 28.99 -54 29.98 -54 31 C-55.19625 31.433125 -56.3925 31.86625 -57.625 32.3125 C-60.26576639 33.29521906 -62.66651943 34.33979422 -65.1875 35.625 C-67.85020439 36.92676659 -70.08348014 37.57110002 -73 38 C-69.51742701 35.0295701 -66.1378607 32.94226114 -62 31 C-60.989375 30.46375 -59.97875 29.9275 -58.9375 29.375 C-56 28 -56 28 -53.25 27.5625 C-52.5075 27.376875 -51.765 27.19125 -51 27 C-50.71125 26.360625 -50.4225 25.72125 -50.125 25.0625 C-49 23 -49 23 -45.75 22 C-44.5125 21.67 -43.275 21.34 -42 21 C-41.01 20.29875 -40.02 19.5975 -39 18.875 C-35.39881579 16.62425987 -33.16943884 16.66644489 -29 17 C-28.505 15.515 -28.505 15.515 -28 14 C-25.9375 12.625 -25.9375 12.625 -23 11 C-21.70779081 10.14665431 -20.41616411 9.29242614 -19.125 8.4375 C-15.52551709 6.17516083 -12.13483097 5.05250243 -8 4 C-3.67723718 2.52189632 -3.67723718 2.52189632 0 0 Z " fill="#5278C3" transform="translate(886,412)"/>
+<path d="M0 0 C0.66 0 1.32 0 2 0 C2.33 0.66 2.66 1.32 3 2 C4.485 2.2475 4.485 2.2475 6 2.5 C7.485 2.7475 7.485 2.7475 9 3 C9.33 3.66 9.66 4.32 10 5 C11.2684375 5.4021875 11.2684375 5.4021875 12.5625 5.8125 C15.53393344 6.83899519 17.48213239 7.86180316 20.0625 9.5625 C23.07025798 11.53310006 25.41299262 12.45651403 29 13 C29.33 13.66 29.66 14.32 30 15 C32.35671551 15.79819537 34.66213375 16.49147225 37.0625 17.125 C37.72572266 17.30675781 38.38894531 17.48851562 39.07226562 17.67578125 C40.71291479 18.12430404 42.35622449 18.56307386 44 19 C44.495 20.98 44.495 20.98 45 23 C45.721875 22.938125 46.44375 22.87625 47.1875 22.8125 C51.1522233 23.07681489 53.75592293 24.64774232 56.4375 27.5625 C58.02792662 29.22263721 58.02792662 29.22263721 60.8125 29.9375 C64.38346521 31.12782174 66.92812413 32.84315098 70 35 C71.66026356 36.01059521 73.32470102 37.01453001 75 38 C74.01 38.495 74.01 38.495 73 39 C71.05246221 38.09338758 69.10992518 37.172307 67.2109375 36.16796875 C65.1653057 35.0873258 63.09453047 34.10603502 61 33.125 C58.01500208 31.65005985 55.49509102 29.9272386 52.875 27.875 C49.66085022 25.38481405 46.97065354 24.0534387 43 23 C41.53862991 22.53017635 40.08051527 22.05015982 38.625 21.5625 C37.48611328 21.18351562 37.48611328 21.18351562 36.32421875 20.796875 C32.85295502 19.60672743 29.42810457 18.30891266 26 17 C26 16.34 26 15.68 26 15 C25.319375 14.95875 24.63875 14.9175 23.9375 14.875 C20.90114568 13.97055403 19.8457901 13.14790496 17.5625 11.0625 C14.50488152 8.29545433 12.05598239 7.0139956 8 6 C6.70734342 5.62842665 5.41567726 5.25339132 4.125 4.875 C3.09375 4.58625 2.0625 4.2975 1 4 C0.67 2.68 0.34 1.36 0 0 Z " fill="#87919F" transform="translate(132,343)"/>
+<path d="M0 0 C0.33 0 0.66 0 1 0 C1.92281532 19.67468308 2.12992722 39.29421814 2.06866455 58.98547363 C2.05818755 62.7279399 2.05381638 66.47041373 2.04882812 70.21289062 C2.03830011 77.47527991 2.02137801 84.73763364 2 92 C-0.3720747 88.44188794 -0.31250246 85.89168668 -0.3347168 81.78149414 C-0.34636871 81.04930664 -0.35802063 80.31711914 -0.37002563 79.56274414 C-0.40606277 77.13690463 -0.42790942 74.7111665 -0.44921875 72.28515625 C-0.47048585 70.59182367 -0.49245375 68.89849976 -0.51509094 67.20518494 C-0.56053885 63.64846732 -0.5993014 60.09175952 -0.63305664 56.53491211 C-0.67630235 52.00603574 -0.73306717 47.47746084 -0.7946043 42.94880009 C-0.84115378 39.44582308 -0.88178455 35.94279669 -0.92057228 32.43972588 C-0.9394566 30.77218349 -0.95978693 29.10465676 -0.98166466 27.43715096 C-1.09785734 18.22797367 -1.01363363 9.17109451 0 0 Z " fill="#73A0FD" transform="translate(952,694)"/>
+<path d="M0 0 C2 1.1875 2 1.1875 4 3 C4.25 5.6875 4.25 5.6875 4 8 C5.32 8.33 6.64 8.66 8 9 C8 10.98 8 12.96 8 15 C8.66 15 9.32 15 10 15 C10.33 17.31 10.66 19.62 11 22 C11.99 22.33 12.98 22.66 14 23 C14.70381157 24.98723268 15.3711811 26.98777953 16 29 C16.66 29.33 17.32 29.66 18 30 C18 32.31 18 34.62 18 37 C18.66 37 19.32 37 20 37 C20.32613281 37.91523437 20.65226562 38.83046875 20.98828125 39.7734375 C21.64376953 41.55621094 21.64376953 41.55621094 22.3125 43.375 C22.74175781 44.55835938 23.17101562 45.74171875 23.61328125 46.9609375 C24.78621555 50.23787198 24.78621555 50.23787198 28 52 C28.96394326 54.35980175 29.79711656 56.64079781 30.5625 59.0625 C31.31461675 61.41199166 32.11625938 63.69294117 33 66 C33.99 66.495 33.99 66.495 35 67 C35 68.98 35 70.96 35 73 C35.66 73 36.32 73 37 73 C36.505 74.98 36.505 74.98 36 77 C32.80072161 73.80072161 32.21209281 69.59069611 31.625 65.1875 C31.41875 64.465625 31.2125 63.74375 31 63 C30.1028125 62.566875 30.1028125 62.566875 29.1875 62.125 C25.80523533 60.3855496 24.41446222 57.39470933 23 54 C22.66073053 51.66752239 22.32759934 49.33414529 22 47 C20.84741131 44.23163278 19.43106738 41.6325232 18 39 C17.46375 37.88625 16.9275 36.7725 16.375 35.625 C15.13049531 32.93164531 15.13049531 32.93164531 13 31 C12.53464332 29.33801185 12.07315752 27.67473751 11.640625 26.00390625 C10.71469758 23.10756013 9.28282616 20.54331256 7.8046875 17.89453125 C7 16 7 16 7 12 C6.38125 11.814375 5.7625 11.62875 5.125 11.4375 C1.9314247 9.27714024 1.83291086 6.65199378 1 3 C0.67 2.01 0.34 1.02 0 0 Z " fill="#CACED5" transform="translate(345,754)"/>
+<path d="M0 0 C-0.62648438 0.25394531 -1.25296875 0.50789063 -1.8984375 0.76953125 C-2.71570313 1.11371094 -3.53296875 1.45789062 -4.375 1.8125 C-5.18710937 2.14894531 -5.99921875 2.48539063 -6.8359375 2.83203125 C-9.30147458 3.94439082 -9.30147458 3.94439082 -11 7 C-12.9812585 7.72045764 -14.98504093 8.38001259 -17 9 C-17.94875 9.474375 -18.8975 9.94875 -19.875 10.4375 C-22.23815608 11.61907804 -24.33691295 12.47913406 -26.8125 13.3125 C-30.84120169 14.77748243 -34.06491889 16.94845851 -37.57421875 19.37890625 C-44.10777895 23.74513408 -50.46141029 26.84611723 -58 29 C-60.89699391 30.47713955 -63.72340332 32.04730721 -66.546875 33.66015625 C-69 35 -69 35 -72 36 C-71.67 34.68 -71.34 33.36 -71 32 C-70.195625 31.87625 -69.39125 31.7525 -68.5625 31.625 C-67.716875 31.41875 -66.87125 31.2125 -66 31 C-65.67 30.34 -65.34 29.68 -65 29 C-63 28.33333333 -61 27.66666667 -59 27 C-58.67 26.34 -58.34 25.68 -58 25 C-56.02 25 -54.04 25 -52 25 C-52 24.01 -52 23.02 -52 22 C-51.071875 21.71125 -50.14375 21.4225 -49.1875 21.125 C-45.90208333 20.1125 -45.90208333 20.1125 -43 18 C-40.73703813 17.2169824 -38.45482922 16.54932519 -36.15625 15.87890625 C-33.81485937 14.92453507 -32.72815951 13.80118034 -31 12 C-28.3125 11.3125 -28.3125 11.3125 -26 11 C-26 10.01 -26 9.02 -26 8 C-24.783125 7.896875 -23.56625 7.79375 -22.3125 7.6875 C-18.49667902 7.20051585 -16.2097986 6.19205758 -13 4 C-11.49143803 3.0632756 -9.96934232 2.14814859 -8.4375 1.25 C-7.69371094 0.80140625 -6.94992187 0.3528125 -6.18359375 -0.109375 C-3.63543667 -1.14869488 -2.53604303 -0.94310897 0 0 Z " fill="#547BC9" transform="translate(843,1059)"/>
+<path d="M0 0 C0.99 0.495 0.99 0.495 2 1 C-1.95694221 5.37346244 -6.47572494 7.23223198 -12 9 C-16.79197233 10.51025208 -16.79197233 10.51025208 -20 14 C-21.63671811 15.04829938 -23.30935705 16.04109219 -25 17 C-26.7300416 18.01934985 -28.4592166 19.040172 -30.1875 20.0625 C-31.04730469 20.56910156 -31.90710938 21.07570313 -32.79296875 21.59765625 C-35.08971412 22.94464647 -35.08971412 22.94464647 -37 25 C-38.99541868 25.68025637 -40.99617991 26.34490497 -43 27 C-45.00847365 27.98287008 -47.00819591 28.98377342 -49 30 C-51.33124929 31.00484883 -53.66443537 32.00522247 -56 33 C-57.11375 33.5878125 -57.11375 33.5878125 -58.25 34.1875 C-60 35 -60 35 -63 35 C-63 35.66 -63 36.32 -63 37 C-63.66 36.67 -64.32 36.34 -65 36 C-64 34 -64 34 -60.9375 32.875 C-59.4834375 32.441875 -59.4834375 32.441875 -58 32 C-58 31.34 -58 30.68 -58 30 C-57.195625 29.7525 -56.39125 29.505 -55.5625 29.25 C-51.95242437 27.9833068 -48.5264561 26.4931103 -45.05078125 24.90234375 C-43 24 -43 24 -40 23 C-39.67 22.01 -39.34 21.02 -39 20 C-37.35 19.67 -35.7 19.34 -34 19 C-33.67 18.01 -33.34 17.02 -33 16 C-29.41388869 14.53295446 -25.8088684 13.67215325 -22 13 C-21.67 11.68 -21.34 10.36 -21 9 C-19.989375 8.938125 -18.97875 8.87625 -17.9375 8.8125 C-14.05066875 8.27287956 -11.81763202 6.64817249 -8.76953125 4.28125 C-5.99461633 2.27204008 -3.2282246 1.13937339 0 0 Z " fill="#4D70B5" transform="translate(927,1010)"/>
+<path d="M0 0 C7.80830616 0.89889435 17.13812817 2.13812817 23 8 C24.99567879 8.19313021 26.99209519 8.38320963 28.9921875 8.5234375 C31 9 31 9 32.390625 10.421875 C34.62982946 12.61759977 36.87609612 13.02992235 39.875 13.875 C44.8578615 15.43401804 47.53269531 17.00734611 51 21 C53.47130918 22.15521502 53.47130918 22.15521502 56 23 C59.5885518 24.87971761 61.77405956 26.60251196 64 30 C63.67 30.66 63.34 31.32 63 32 C62.443125 31.401875 61.88625 30.80375 61.3125 30.1875 C57.15462924 26.25437901 53.69102856 24.66174751 48 24 C48 23.01 48 22.02 48 21 C47.21625 20.87625 46.4325 20.7525 45.625 20.625 C43 20 43 20 41 18 C38.42938689 17.35232207 38.42938689 17.35232207 36 17 C36 16.01 36 15.02 36 14 C34.02 14 32.04 14 30 14 C29.34 12.68 28.68 11.36 28 10 C26.329375 10.061875 26.329375 10.061875 24.625 10.125 C21 10 21 10 19 8 C16.94185004 7.39391903 14.87952543 6.98825831 12.77734375 6.5625 C12.19082031 6.376875 11.60429688 6.19125 11 6 C10.67 5.34 10.34 4.68 10 4 C7.65092125 3.31068656 7.65092125 3.31068656 4.9375 2.875 C4.01839844 2.70742187 3.09929688 2.53984375 2.15234375 2.3671875 C1.44207031 2.24601563 0.73179687 2.12484375 0 2 C0 1.34 0 0.68 0 0 Z " fill="#547CCC" transform="translate(680,217)"/>
+<path d="M0 0 C1.33333333 0.66666667 2.66666667 1.33333333 4 2 C4.94875 2.45375 5.8975 2.9075 6.875 3.375 C10 5 10 5 13.0625 7.0625 C15.72191073 8.81657942 18.05527298 9.85083823 21 11 C22.17390633 11.67506392 23.34013999 12.36357788 24.5 13.0625 C26.77040686 14.40792629 28.1704406 15.03408812 30.8125 15.5625 C33 16 33 16 35 19 C35.886875 19.28875 36.77375 19.5775 37.6875 19.875 C40.64284388 20.8787017 42.15145761 21.72526464 44.5625 23.5625 C47.36975312 25.69128174 49.47772816 26.48201885 53 27 C53.495 27.99 53.495 27.99 54 29 C54.825 29.495 55.65 29.99 56.5 30.5 C59 32 59 32 60 34 C57.77449157 32.9284589 55.66829864 31.79587609 53.5625 30.5 C51.07533074 29.04409605 48.68924083 28.0244727 46 27 C43.66443537 26.00522247 41.33124929 25.00484883 39 24 C37.2675 23.2575 37.2675 23.2575 35.5 22.5 C32 21 28.5 19.5 25 18 C25 17.01 25 16.02 25 15 C24.319375 15.103125 23.63875 15.20625 22.9375 15.3125 C19.24098539 14.91925377 17.58710484 13.46999852 14.7109375 11.234375 C12.91016424 9.8270784 12.91016424 9.8270784 10.125 8.875 C9.073125 8.441875 9.073125 8.441875 8 8 C7.67 7.01 7.34 6.02 7 5 C6.21625 5.04125 5.4325 5.0825 4.625 5.125 C2 5 2 5 0 3 C0 2.01 0 1.02 0 0 Z " fill="#8A94A2" transform="translate(299,1051)"/>
+<path d="M0 0 C1.98 0 3.96 0 6 0 C6.16357806 14.64681449 6.28698793 29.29350798 6.3626852 43.94105053 C6.39876853 50.74234248 6.44795413 57.54306665 6.52807617 64.34399414 C6.60534263 70.90566552 6.64597534 77.46690156 6.6641407 84.02904701 C6.67708804 86.53419602 6.70237131 89.03931224 6.7401104 91.54421043 C6.7908341 95.04996223 6.79792726 98.55326725 6.79467773 102.05932617 C6.81984467 103.09798325 6.8450116 104.13664032 6.87094116 105.20677185 C6.80214235 112.05381967 6.80214235 112.05381967 4.52662849 114.73793983 C0.66302567 117.61700045 -3.33174185 118.95202368 -8 120 C-8 119.34 -8 118.68 -8 118 C-7.05125 117.9175 -6.1025 117.835 -5.125 117.75 C-1.93674268 117.37211306 -1.93674268 117.37211306 -0.875 115.1875 C-0.58625 114.465625 -0.2975 113.74375 0 113 C1.00302155 112.26308929 1.00302155 112.26308929 2.02630615 111.5112915 C5.14518633 107.54288612 4.52496225 103.5370031 4.45410156 98.63183594 C4.45468567 97.57786621 4.45526978 96.52389648 4.45587158 95.43798828 C4.45308414 91.95311589 4.42195968 88.46909804 4.390625 84.984375 C4.38316499 82.56870999 4.37747093 80.15303894 4.37347412 77.73736572 C4.35819905 71.3782888 4.31890049 65.01957711 4.2746582 58.66064453 C4.23374624 52.17225078 4.21547178 45.68379804 4.1953125 39.1953125 C4.15240856 26.46338581 4.08490262 13.73171233 4 1 C2.68 0.67 1.36 0.34 0 0 Z " fill="#D3E1FE" transform="translate(951,683)"/>
+<path d="M0 0 C5.0614803 1.55483382 9.49375316 3.16750198 14 6 C14.7425 6.185625 15.485 6.37125 16.25 6.5625 C16.8275 6.706875 17.405 6.85125 18 7 C18.33 7.66 18.66 8.32 19 9 C19.99 9.33 20.98 9.66 22 10 C22.33 10.66 22.66 11.32 23 12 C23.804375 12.144375 24.60875 12.28875 25.4375 12.4375 C28 13 28 13 30 16 C31.97583715 16.73519522 33.98177598 17.39072482 36 18 C38.34570085 18.97063483 40.68020619 19.96898053 43 21 C43.763125 21.33 44.52625 21.66 45.3125 22 C47 23 47 23 49 26 C53.63776123 29.09184082 58.63416508 31.46678874 63.8125 33.5 C64.864375 33.995 65.91625 34.49 67 35 C67.33 35.99 67.66 36.98 68 38 C64.21283842 36.49637741 60.44754813 34.94512999 56.6875 33.375 C55.08455078 32.70597656 55.08455078 32.70597656 53.44921875 32.0234375 C52.23685547 31.51683594 52.23685547 31.51683594 51 31 C51 30.34 51 29.68 51 29 C48.61766476 27.7172041 46.40889449 26.81455513 43.8125 26 C41 25 41 25 40 23 C38.37566656 22.28935412 36.74811723 21.58518885 35.10546875 20.91796875 C30.49287355 18.90691147 25.92315259 16.49822745 21.94921875 13.40234375 C19.89636741 11.75086971 19.89636741 11.75086971 16.5 11.0625 C12.69851623 9.90847814 11.6891988 8.77323626 9 6 C6.66875071 4.99515117 4.33556463 3.99477753 2 3 C1.34 2.01 0.68 1.02 0 0 Z " fill="#7E8898" transform="translate(916,212)"/>
+<path d="M0 0 C6.0546875 -0.1953125 6.0546875 -0.1953125 8 0 C8.66 0.66 9.32 1.32 10 2 C12.11158787 2.40979603 14.24084734 2.73143247 16.375 3 C22.5693544 3.78303351 22.5693544 3.78303351 25.046875 5.03125 C27.67237596 6.33349848 29.95960389 6.35163379 32.875 6.5 C36.13168075 6.66658214 38.79782011 6.93242505 41.8984375 7.96875 C45.48919418 9.16265398 49.00879165 9.60670726 52.75 10 C58.90925645 10.7031439 64.94732188 11.63232754 71 13 C71 13.33 71 13.66 71 14 C68.89590361 14.02701408 66.79170822 14.04640223 64.6875 14.0625 C63.51574219 14.07410156 62.34398437 14.08570313 61.13671875 14.09765625 C58 14 58 14 55 13 C52.66842065 12.84570431 50.33451859 12.72546084 48 12.625 C42.27161023 12.31567384 37.05515638 11.44419733 31.5703125 9.7578125 C28.15260983 8.75016156 24.69930903 8.13414736 21.19140625 7.52734375 C18.89086467 6.97373749 17.10534698 6.06301409 15 5 C13.55283502 4.6211059 12.09287549 4.28842466 10.625 4 C6.97806808 3.24047368 3.51188647 2.26067719 0 1 C0 0.67 0 0.34 0 0 Z " fill="#8A94A1" transform="translate(483,380)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-2.87608667 4.44576792 -7.21277834 7.32813596 -13 9 C-17.34752244 11.00007904 -17.34752244 11.00007904 -21 14 C-22.98636298 14.70626239 -24.98848259 15.36893571 -27 16 C-29.75256244 16.84979475 -29.75256244 16.84979475 -32 18 C-32.33 18.99 -32.66 19.98 -33 21 C-36.81373009 23.23242737 -40.8450948 24.74130346 -44.984375 26.2421875 C-46.92167954 26.97055394 -48.79900367 27.77928208 -50.6875 28.625 C-53.51899137 29.80033604 -55.98483875 30.54315739 -59 31 C-55.29529689 27.7733231 -51.41727179 25.50045716 -47.0859375 23.24609375 C-45.03910042 22.02335774 -43.65973352 20.68834962 -42 19 C-40.67139075 18.64830932 -39.33841672 18.31229724 -38 18 C-37.67 17.34 -37.34 16.68 -37 16 C-34.0229051 15.04732963 -31.04451188 14.2631841 -28.015625 13.5 C-26.32858392 13.05384038 -24.66201862 12.53184596 -23 12 C-22.67 11.34 -22.34 10.68 -22 10 C-20 9.33333333 -18 8.66666667 -16 8 C-15.67 7.34 -15.34 6.68 -15 6 C-13.07098741 5.53437627 -11.14069241 5.07316577 -9.203125 4.64453125 C-6.90844499 3.97321529 -5.15942753 3.05623616 -3.125 1.8125 C-2.09375 1.214375 -1.0625 0.61625 0 0 Z " fill="#8B95A3" transform="translate(760,443)"/>
+<path d="M0 0 C7.81524066 -0.0232496 15.6304731 -0.0409791 23.44573975 -0.05181217 C27.07532988 -0.05701352 30.70489621 -0.06406083 34.33447266 -0.07543945 C37.84227734 -0.08636654 41.35005924 -0.0922975 44.85787964 -0.09487724 C46.83633171 -0.09760298 48.81477471 -0.10539921 50.79321289 -0.11329651 C56.94808427 -0.11367735 62.92790259 -0.0625238 69 1 C69.495 1.495 69.495 1.495 70 2 C71.55948542 2.15686249 73.12542668 2.25076639 74.69140625 2.31640625 C76.10776367 2.37924805 76.10776367 2.37924805 77.55273438 2.44335938 C79.04256836 2.50233398 79.04256836 2.50233398 80.5625 2.5625 C82.05813477 2.62727539 82.05813477 2.62727539 83.58398438 2.69335938 C86.0558415 2.79980298 88.5278031 2.90181928 91 3 C91.495 4.485 91.495 4.485 92 6 C92.99 6.495 92.99 6.495 94 7 C89.12519761 7.18318673 84.50203415 7.27064428 79.75 6.0625 C73.60652249 4.50172463 67.30691326 4.34091423 61 4 C61 3.34 61 2.68 61 2 C30.805 1.505 30.805 1.505 0 1 C0 0.67 0 0.34 0 0 Z " fill="#CDD1D7" transform="translate(561,177)"/>
+<path d="M0 0 C0.33 0 0.66 0 1 0 C1 21.78 1 43.56 1 66 C-1.31 66.99 -3.62 67.98 -6 69 C-9.40990126 70.87769893 -12.7017819 72.93318899 -16 75 C-16.639375 75.39832031 -17.27875 75.79664063 -17.9375 76.20703125 C-20.9864755 78.10686355 -20.9864755 78.10686355 -23 81 C-24.94168103 82.12954935 -26.9287976 83.18195457 -28.9375 84.1875 C-30.55978516 85.01314453 -30.55978516 85.01314453 -32.21484375 85.85546875 C-33.13394531 86.23316406 -34.05304687 86.61085938 -35 87 C-35.66 86.67 -36.32 86.34 -37 86 C-35.47005208 84.76302083 -33.94010417 83.52604167 -32.41015625 82.2890625 C-30.86733563 81.0333609 -30.86733563 81.0333609 -30 79 C-28.33333333 78.66666667 -26.66666667 78.33333333 -25 78 C-24.505 77.01 -24.505 77.01 -24 76 C-21.47694792 74.31796528 -19.08103526 73.03130908 -16.25 71.9375 C-13.83767007 71.22002336 -13.83767007 71.22002336 -13 69 C-11.00882592 68.30741771 -9.0078864 67.64252365 -7 67 C-5.515 66.01 -5.515 66.01 -4 65 C-2.68 65 -1.36 65 0 65 C0 43.55 0 22.1 0 0 Z " fill="#B3CCFE" transform="translate(1052,789)"/>
+<path d="M0 0 C0 0.66 0 1.32 0 2 C0.58265625 2.10183594 1.1653125 2.20367187 1.765625 2.30859375 C4.37219275 3.11517153 5.73535414 4.24157009 7.75 6.0625 C8.67039062 6.88427734 8.67039062 6.88427734 9.609375 7.72265625 C10.29773437 8.35494141 10.29773437 8.35494141 11 9 C10.67 9.66 10.34 10.32 10 11 C7.37625263 9.54236257 5.25515595 8.28705044 3.25 6.03125 C0.41346554 3.47048972 -2.08705977 2.77562326 -5.75 1.75 C-6.92046875 1.41484375 -8.0909375 1.0796875 -9.296875 0.734375 C-10.18890625 0.49203125 -11.0809375 0.2496875 -12 0 C-12 0.66 -12 1.32 -12 2 C-12.70125 2.09796875 -13.4025 2.1959375 -14.125 2.296875 C-19.64257429 3.16649269 -24.19569691 4.2910868 -29.08984375 6.984375 C-33.46691883 9.31165418 -38.1847702 10.86011153 -43 12 C-39.97836521 8.62971504 -37.05702536 6.94737217 -33 5 C-32.113125 4.34 -31.22625 3.68 -30.3125 3 C-22.06722359 -1.9782801 -8.77171745 -5.20496709 0 0 Z " fill="#4868A4" transform="translate(1091,321)"/>
+<path d="M0 0 C6.04730427 -0.83411093 9.37330644 0.31567719 14.43359375 3.61328125 C16 5 16 5 17 8 C12.2743106 6.33962264 12.2743106 6.33962264 10.6875 4.375 C8.26571214 2.40169137 5.94833014 2.59105395 2.921875 2.70703125 C0.26864022 3.11148777 -1.05365851 4.18788896 -3 6 C-5.41131087 7.54571209 -7.67048234 8.87258651 -10.34375 9.90625 C-13.09676635 11.03984497 -15.51938351 12.39276309 -18.0625 13.9375 C-18.89910156 14.44152344 -19.73570312 14.94554687 -20.59765625 15.46484375 C-22.97970462 16.9436437 -22.97970462 16.9436437 -25.04296875 18.5390625 C-28.46082495 21.09051603 -32.24633016 22.99108013 -36 25 C-36.75667969 25.41121094 -37.51335938 25.82242188 -38.29296875 26.24609375 C-40.16205886 27.23000458 -42.07823939 28.12340744 -44 29 C-44.66 28.67 -45.32 28.34 -46 28 C-41.32 25.14 -41.32 25.14 -39 24.125 C-36.74401206 22.97432096 -36.74401206 22.97432096 -34.4375 20.4375 C-32 18 -32 18 -29 17 C-28.34 16.01 -27.68 15.02 -27 14 C-24.1830911 12.6317871 -21.48482241 11.87346515 -18.4375 11.125 C-14.99213481 10.29341549 -14.99213481 10.29341549 -13.125 8.0625 C-10.36717543 5.38578792 -7.68459242 4.78773983 -4.0234375 3.80859375 C-1.64343105 3.07918327 -1.64343105 3.07918327 0 0 Z " fill="#A8C5FD" transform="translate(747,802)"/>
+<path d="M0 0 C1.32 0 2.64 0 4 0 C4.0694446 10.77000233 4.12278307 21.53995159 4.15543652 32.31013203 C4.17110684 37.31092029 4.19237004 42.31155562 4.22631836 47.31225586 C4.25886309 52.13627314 4.27684271 56.96014313 4.28463173 61.7842617 C4.29018404 63.62671414 4.30102608 65.46915833 4.31719017 67.31154823 C4.33889965 69.88797184 4.34196967 72.46378317 4.34057617 75.0402832 C4.351362 75.80560867 4.36214783 76.57093414 4.3732605 77.35945129 C4.34307058 82.50213315 4.34307058 82.50213315 2.69355774 84.8959198 C-1.15793587 87.40682199 -5.49594934 89.09918987 -10 90 C-10 90.66 -10 91.32 -10 92 C-15.17578125 95.22265625 -15.17578125 95.22265625 -17 96 C-17.99 95.67 -18.98 95.34 -20 95 C-19.34 95 -18.68 95 -18 95 C-18 94.01 -18 93.02 -18 92 C-17.195625 91.71125 -16.39125 91.4225 -15.5625 91.125 C-12.8673532 90.26737432 -12.8673532 90.26737432 -12 88 C-11.071875 87.7834375 -11.071875 87.7834375 -10.125 87.5625 C-7.93151796 87.17235693 -7.93151796 87.17235693 -6.5625 85.5625 C-4.56207695 83.56207695 -2.67327498 82.86881437 0 82 C0.99 82 1.98 82 3 82 C3 55.27 3 28.54 3 1 C2.01 0.67 1.02 0.34 0 0 Z " fill="#9DBCFE" transform="translate(846,532)"/>
+<path d="M0 0 C3.52081558 -0.02927632 7.04159939 -0.04689119 10.5625 -0.0625 C11.55314453 -0.07087891 12.54378906 -0.07925781 13.56445312 -0.08789062 C26.79206202 -0.13183617 26.79206202 -0.13183617 31.01171875 2.03125 C33.90998003 3.44336945 36.60948326 3.36119104 39.8125 3.5 C44.86188851 3.79211338 49.16333734 4.48261563 54 6 C55.53927304 6.16923944 57.081407 6.3137094 58.625 6.4375 C62.49964082 6.79747508 64.69534569 7.91284991 68 10 C71.69523952 10.71923208 71.69523952 10.71923208 75 11 C75 11.66 75 12.32 75 13 C78.96 13.33 82.92 13.66 87 14 C87 14.99 87 15.98 87 17 C66.52868852 14.52868852 66.52868852 14.52868852 61 9 C51.06153353 6.89358129 40.76181906 6.13765733 30.67602539 5.05322266 C29.0188147 4.87025635 29.0188147 4.87025635 27.328125 4.68359375 C26.3268457 4.57587646 25.32556641 4.46815918 24.29394531 4.35717773 C22 4 22 4 21 3 C19.44246949 2.77329092 17.87622641 2.60564908 16.30859375 2.46484375 C15.36435547 2.37783203 14.42011719 2.29082031 13.44726562 2.20117188 C12.45404297 2.11416016 11.46082031 2.02714844 10.4375 1.9375 C9.44041016 1.84662109 8.44332031 1.75574219 7.41601562 1.66210938 C4.94434298 1.43741186 2.47236744 1.21689649 0 1 C0 0.67 0 0.34 0 0 Z " fill="#405C8F" transform="translate(609,204)"/>
+<path d="M0 0 C0.60714844 0.19722656 1.21429687 0.39445313 1.83984375 0.59765625 C1.28296875 0.90058594 0.72609375 1.20351563 0.15234375 1.515625 C-10.06744331 6.77004039 -10.06744331 6.77004039 -18.16015625 14.59765625 C-19.48015625 14.59765625 -20.80015625 14.59765625 -22.16015625 14.59765625 C-21.17015625 16.08265625 -21.17015625 16.08265625 -20.16015625 17.59765625 C-19.33515625 17.74203125 -18.51015625 17.88640625 -17.66015625 18.03515625 C-16.83515625 18.22078125 -16.01015625 18.40640625 -15.16015625 18.59765625 C-14.71929688 19.52578125 -14.71929688 19.52578125 -14.26953125 20.47265625 C-12.87697713 23.14008387 -11.56126592 23.7940232 -8.91015625 25.16015625 C-8.1109375 25.58039062 -7.31171875 26.000625 -6.48828125 26.43359375 C-4.55383445 27.40081715 -2.60831828 28.34586384 -0.66015625 29.28515625 C1.83984375 30.59765625 1.83984375 30.59765625 2.83984375 32.59765625 C4.83526243 33.27791262 6.83602366 33.94256122 8.83984375 34.59765625 C10.53191376 35.55404365 12.20801268 36.54176556 13.83984375 37.59765625 C13.34484375 38.58765625 13.34484375 38.58765625 12.83984375 39.59765625 C7.2162306 37.47318017 2.49964999 34.50712108 -2.52734375 31.2265625 C-5.61193381 29.31814402 -8.82674335 28.01744322 -12.16015625 26.59765625 C-15.2391367 24.70816226 -18.21469439 22.68833528 -21.16015625 20.59765625 C-21.90910156 20.12328125 -22.65804687 19.64890625 -23.4296875 19.16015625 C-24.00074219 18.64453125 -24.57179688 18.12890625 -25.16015625 17.59765625 C-25.16015625 16.27765625 -25.16015625 14.95765625 -25.16015625 13.59765625 C-23.51015625 13.26765625 -21.86015625 12.93765625 -20.16015625 12.59765625 C-19.83015625 11.60765625 -19.50015625 10.61765625 -19.16015625 9.59765625 C-16.8671875 8.1328125 -16.8671875 8.1328125 -13.97265625 6.66015625 C-10.72919877 4.97960833 -7.65622913 3.33765364 -4.72265625 1.16015625 C-2.16015625 -0.40234375 -2.16015625 -0.40234375 0 0 Z " fill="#A1BFFD" transform="translate(699.16015625,831.40234375)"/>
+<path d="M0 0 C0.99 0.495 0.99 0.495 2 1 C-1.66719754 3.8267981 -4.8621429 6.10550134 -9.25 7.625 C-12.75685066 8.91084524 -13.6242397 9.46016785 -16 12 C-19.21857609 14.11748427 -22.4127865 15.6203025 -26 17 C-28.21771064 17.85790183 -28.21771064 17.85790183 -30 19 C-30.495 20.485 -30.495 20.485 -31 22 C-32.64233398 23.02734375 -32.64233398 23.02734375 -34.74609375 23.9375 C-35.87821289 24.44410156 -35.87821289 24.44410156 -37.03320312 24.9609375 C-37.82662109 25.30382812 -38.62003906 25.64671875 -39.4375 26 C-41.00218719 26.67952129 -42.56356624 27.36672471 -44.12109375 28.0625 C-44.8164624 28.36285156 -45.51183105 28.66320312 -46.22827148 28.97265625 C-48.33051088 30.01742654 -48.33051088 30.01742654 -50 33 C-54.31672072 35.73197865 -59.123948 37.5371844 -64 39 C-61.5175644 35.15222482 -61.5175644 35.15222482 -58.875 34.375 C-57.946875 34.189375 -57.946875 34.189375 -57 34 C-56.67 33.34 -56.34 32.68 -56 32 C-54.68 32 -53.36 32 -52 32 C-51.67 30.68 -51.34 29.36 -51 28 C-49.9275 27.71125 -48.855 27.4225 -47.75 27.125 C-44.90184789 26.27055437 -42.51227358 25.54601451 -40 24 C-39.67 23.34 -39.34 22.68 -39 22 C-36.4375 21.375 -36.4375 21.375 -34 21 C-33.67 19.68 -33.34 18.36 -33 17 C-31.35 17 -29.7 17 -28 17 C-28 16.01 -28 15.02 -28 14 C-26.7625 13.5875 -25.525 13.175 -24.25 12.75 C-20.62529225 11.40586409 -18.65303376 9.8360016 -16 7 C-13.12312981 5.60044153 -10.35054545 4.82681212 -7.25 4 C-6.1775 3.67 -5.105 3.34 -4 3 C-3.67 2.34 -3.34 1.68 -3 1 C-2.01 0.67 -1.02 0.34 0 0 Z " fill="#B8CFFE" transform="translate(819,548)"/>
+<path d="M0 0 C0.99 0.495 0.99 0.495 2 1 C0.8125 2.5 0.8125 2.5 -1 4 C-3.6875 4.1875 -3.6875 4.1875 -6 4 C-6.33 4.99 -6.66 5.98 -7 7 C-8.65 7.33 -10.3 7.66 -12 8 C-12 8.99 -12 9.98 -12 11 C-13.0725 11.4125 -14.145 11.825 -15.25 12.25 C-17.79444497 13.32590759 -19.06510303 14.06510303 -21.0625 16.0625 C-23 18 -23 18 -25.6875 18.875 C-29.52510727 20.17833832 -32.31430736 22.12802505 -35.63671875 24.40625 C-41.60438059 28.43072278 -46.72491842 31.53563309 -54 32 C-54.33 32.99 -54.66 33.98 -55 35 C-56.485 35.495 -56.485 35.495 -58 36 C-58.66 36.99 -59.32 37.98 -60 39 C-63.18578426 40.28787023 -65.5551941 41 -69 41 C-67.8125 39.5 -67.8125 39.5 -66 38 C-63.3125 37.8125 -63.3125 37.8125 -61 38 C-61 36.68 -61 35.36 -61 34 C-58.03 33.505 -58.03 33.505 -55 33 C-55 32.34 -55 31.68 -55 31 C-54.030625 30.525625 -53.06125 30.05125 -52.0625 29.5625 C-49.19522563 28.29806053 -49.19522563 28.29806053 -48 27 C-46.33382885 26.95936168 -44.66611905 26.957279 -43 27 C-43 26.01 -43 25.02 -43 24 C-41.7625 23.5875 -40.525 23.175 -39.25 22.75 C-35.63317386 21.41279315 -33.64360688 19.83243594 -31 17 C-28.8125 16.375 -28.8125 16.375 -27 16 C-26.67 15.34 -26.34 14.68 -26 14 C-24.00882592 13.30741771 -22.0078864 12.64252365 -20 12 C-19.01 11.34 -18.02 10.68 -17 10 C-15.68 10 -14.36 10 -13 10 C-13 9.01 -13 8.02 -13 7 C-12.195625 6.71125 -11.39125 6.4225 -10.5625 6.125 C-7.8673532 5.26737432 -7.8673532 5.26737432 -7 3 C-5.01276732 2.29618843 -3.01222047 1.6288189 -1 1 C-0.67 0.67 -0.34 0.34 0 0 Z " fill="#93B6FD" transform="translate(996,868)"/>
+<path d="M0 0 C5.01742011 1.54129899 9.6143495 3.03323643 14 6 C16.6365901 7.75772673 18.23771341 8.46149962 21.1875 9.3125 C26.68194994 11.07537726 31.37077016 13.82408565 35.8125 17.5 C39.56881351 20.07575783 43.92136653 21.23411163 48.19921875 22.71875 C49.12347656 23.1415625 50.04773438 23.564375 51 24 C51.495 25.485 51.495 25.485 52 27 C34.96813354 22.07890744 34.96813354 22.07890744 28 18 C27.67 17.01 27.34 16.02 27 15 C25.824375 15.0928125 25.824375 15.0928125 24.625 15.1875 C23.325625 15.0946875 23.325625 15.0946875 22 15 C21.34 14.01 20.68 13.02 20 12 C18.67405895 11.63837971 17.34061543 11.30271961 16 11 C15.67 10.34 15.34 9.68 15 9 C12.6859378 8.26924352 10.35171131 7.59861742 8 7 C8 6.34 8 5.68 8 5 C5.69 4.67 3.38 4.34 1 4 C0.67 2.68 0.34 1.36 0 0 Z " fill="#505E73" transform="translate(774,374)"/>
+<path d="M0 0 C0.495 0.99 0.495 0.99 1 2 C-3.65041369 6.39698515 -8.17174203 9.80046509 -13.84765625 12.75 C-16.00752568 14.00437063 -17.66956152 15.37156376 -19.5 17.0625 C-22.71525934 19.99915373 -26.02857807 21.51507504 -30.08203125 23.04296875 C-32.33953776 23.97105639 -32.33953776 23.97105639 -34 27 C-38.91479147 30.41304963 -44.15409962 31.96837052 -50 33 C-50.33 34.32 -50.66 35.64 -51 37 C-52.98 37 -54.96 37 -57 37 C-57 37.99 -57 38.98 -57 40 C-59.64 40.66 -62.28 41.32 -65 42 C-64.67 41.01 -64.34 40.02 -64 39 C-61.59245177 37.82876032 -59.37710325 37.07332563 -56.75 36.5625 C-56.1725 36.376875 -55.595 36.19125 -55 36 C-54.67 35.01 -54.34 34.02 -54 33 C-52.01276732 32.29618843 -50.01222047 31.6288189 -48 31 C-47.67 30.34 -47.34 29.68 -47 29 C-45.00458132 28.31974363 -43.00382009 27.65509503 -41 27 C-39.32986432 26.00580456 -37.66366777 25.00498126 -36 24 C-32.89527499 22.46955789 -29.77297489 20.98128527 -26.64453125 19.5 C-23.75838089 18.12513858 -23.75838089 18.12513858 -22 15 C-20.37148694 13.93899907 -18.69917317 12.94370988 -17 12 C-10.80009585 8.44153412 -5.28935495 4.82941104 0 0 Z " fill="#415D90" transform="translate(1086,919)"/>
+<path d="M0 0 C1.32 0.33 2.64 0.66 4 1 C-0.5 5 -0.5 5 -5 5 C-5 41.96 -5 78.92 -5 117 C-3.02 116.01 -3.02 116.01 -1 115 C1.25 115.375 1.25 115.375 3 116 C-0.46214649 118.05164237 -1.59389235 118 -6 118 C-6 80.38 -6 42.76 -6 4 C-4.02 3.34 -2.04 2.68 0 2 C0 1.34 0 0.68 0 0 Z " fill="#DFEAFE" transform="translate(862,734)"/>
+<path d="M0 0 C1.65 0.33 3.3 0.66 5 1 C5.33 1.99 5.66 2.98 6 4 C6.99 4 7.98 4 9 4 C9 33.37 9 62.74 9 93 C5.37673261 94.2077558 4.35853631 93.54311128 1 92 C1 91.34 1 90.68 1 90 C-0.98 89.34 -2.96 88.68 -5 88 C-5 87.34 -5 86.68 -5 86 C-5.99 85.67 -6.98 85.34 -8 85 C-6.35 85 -4.7 85 -3 85 C-3 85.66 -3 86.32 -3 87 C-1.02 87.66 0.96 88.32 3 89 C3 89.99 3 90.98 3 92 C4.65 92 6.3 92 8 92 C7.67 63.62 7.34 35.24 7 6 C4.525 5.01 4.525 5.01 2 4 C0.6875 1.875 0.6875 1.875 0 0 Z " fill="#95B7FD" transform="translate(841,855)"/>
+<path d="M0 0 C2.0625 0.4375 2.0625 0.4375 4 1 C-1.625 4 -1.625 4 -5 4 C-5.22816406 4.64710938 -5.45632813 5.29421875 -5.69140625 5.9609375 C-7 8 -7 8 -9.27734375 8.5390625 C-10.59412109 8.58160156 -10.59412109 8.58160156 -11.9375 8.625 C-15.66701467 8.7678091 -16.77843904 8.85229269 -20 11 C-24.62038091 11.39132188 -29.25100263 11.3290597 -33.88598633 11.31567383 C-36.16211782 11.312535 -38.43692183 11.33589969 -40.71289062 11.36132812 C-47.98376606 11.39164971 -54.36138536 11.33249662 -61 8 C-61 7.67 -61 7.34 -61 7 C-59.7625 6.979375 -58.525 6.95875 -57.25 6.9375 C-56.55390625 6.92589844 -55.8578125 6.91429687 -55.140625 6.90234375 C-53 7 -53 7 -51.20117188 7.49560547 C-46.65510422 8.5373286 -41.89238199 8.1847168 -37.25 8.1875 C-36.19039062 8.19974609 -35.13078125 8.21199219 -34.0390625 8.22460938 C-27.96549001 8.23591255 -22.8282312 7.68122054 -17 6 C-13.5 5.875 -13.5 5.875 -11 6 C-11 5.34 -11 4.68 -11 4 C-10.28972656 3.79503906 -9.57945312 3.59007812 -8.84765625 3.37890625 C-7.92855469 3.10949219 -7.00945313 2.84007812 -6.0625 2.5625 C-5.14597656 2.29566406 -4.22945312 2.02882813 -3.28515625 1.75390625 C-1.0597507 1.20973949 -1.0597507 1.20973949 0 0 Z " fill="#667285" transform="translate(615,515)"/>
+<path d="M0 0 C4.38889325 0.66498383 7.9811485 2.18757677 12 4 C12 4.99 12 5.98 12 7 C14.31 7 16.62 7 19 7 C19.33 7.66 19.66 8.32 20 9 C21.2375 9.495 21.2375 9.495 22.5 10 C25 11 25 11 26 13 C27.99054876 13.69437747 29.99255385 14.35610218 32 15 C37.81707317 17.63414634 37.81707317 17.63414634 39 20 C39.825 20.165 40.65 20.33 41.5 20.5 C42.325 20.665 43.15 20.83 44 21 C44.495 21.99 44.495 21.99 45 23 C46.72996853 23.75074106 48.46196889 24.49777964 50.2109375 25.203125 C52.40050954 26.1783929 54.16930968 27.46222013 56 29 C50.57814191 29.2756877 47.49764122 29.34110491 43 26 C40.01353231 24.00902154 37.40312738 23.05875074 34 22 C34 20.68 34 19.36 34 18 C33.43152344 17.84144531 32.86304688 17.68289063 32.27734375 17.51953125 C27.38190996 16.04027663 23.76576462 14.29959903 19.734375 11.18359375 C17.91276302 9.94046666 16.27169628 9.26695834 14.1875 8.5625 C9.05817641 6.81913461 4.46005307 4.05257731 0 1 C0 0.67 0 0.34 0 0 Z " fill="#C1C6CD" transform="translate(363,428)"/>
+<path d="M0 0 C0.98613281 0.00322266 1.97226562 0.00644531 2.98828125 0.00976562 C4.02082031 0.01814453 5.05335938 0.02652344 6.1171875 0.03515625 C7.67759766 0.04192383 7.67759766 0.04192383 9.26953125 0.04882812 C11.84380712 0.06063673 14.41796896 0.0771055 16.9921875 0.09765625 C16.9921875 0.42765625 16.9921875 0.75765625 16.9921875 1.09765625 C12.3721875 1.09765625 7.7521875 1.09765625 2.9921875 1.09765625 C2.6621875 2.08765625 2.3321875 3.07765625 1.9921875 4.09765625 C-4.6078125 4.09765625 -11.2078125 4.09765625 -18.0078125 4.09765625 C-18.3378125 5.08765625 -18.6678125 6.07765625 -19.0078125 7.09765625 C-25.4428125 7.59265625 -25.4428125 7.59265625 -32.0078125 8.09765625 C-32.3378125 9.08765625 -32.6678125 10.07765625 -33.0078125 11.09765625 C-33.77867187 11.13503906 -34.54953125 11.17242187 -35.34375 11.2109375 C-36.84808594 11.30955078 -36.84808594 11.30955078 -38.3828125 11.41015625 C-39.87941406 11.49716797 -39.87941406 11.49716797 -41.40625 11.5859375 C-42.26476562 11.75480469 -43.12328125 11.92367187 -44.0078125 12.09765625 C-44.9978125 13.58265625 -44.9978125 13.58265625 -46.0078125 15.09765625 C-47.6578125 14.76765625 -49.3078125 14.43765625 -51.0078125 14.09765625 C-48.42821772 10.86865299 -45.83856549 10.34006233 -41.8828125 9.47265625 C-38.13684422 8.90738772 -38.13684422 8.90738772 -35.0078125 7.09765625 C-32.3043977 6.55788048 -29.58885699 6.13298638 -26.8671875 5.6953125 C-24.02402785 5.18924199 -24.02402785 5.18924199 -21.53515625 4.09765625 C-18.63222867 2.94904812 -15.90540698 2.49121369 -12.8203125 2.03515625 C-8.30058413 1.36081947 -4.56255907 -0.0262216 0 0 Z " fill="#505E73" transform="translate(534.0078125,181.90234375)"/>
+<path d="M0 0 C1.32 0.33 2.64 0.66 4 1 C3.01 1 2.02 1 1 1 C0.67 1.99 0.34 2.98 0 4 C-1.98 4.99 -1.98 4.99 -4 6 C-4 34.71 -4 63.42 -4 93 C2.2276592 93.28938792 2.2276592 93.28938792 7 91 C5.9280096 94.4541913 4.90283569 95.05218083 1.625 96.8125 C-1.941828 97.98094365 -2.67475827 98.07667519 -6 97 C-6.11572192 85.05660607 -6.20462811 73.11334495 -6.25906086 61.16950512 C-6.28518266 55.62378868 -6.32062825 50.07845506 -6.37719727 44.53295898 C-6.43142429 39.18372638 -6.46140106 33.83486255 -6.47438622 28.48537636 C-6.48364281 26.44193017 -6.50171843 24.39850474 -6.52865028 22.35521507 C-6.56481682 19.49832523 -6.56995055 16.64296966 -6.56762695 13.78588867 C-6.58560333 12.93640656 -6.60357971 12.08692444 -6.62210083 11.21170044 C-6.60127258 8.85343933 -6.60127258 8.85343933 -6 5 C-3.52702332 3.07588196 -3.52702332 3.07588196 -1 2 C-0.67 1.34 -0.34 0.68 0 0 Z " fill="#E0EAFE" transform="translate(862,854)"/>
+<path d="M0 0 C0.66 0 1.32 0 2 0 C2 0.66 2 1.32 2 2 C3.051875 2.103125 4.10375 2.20625 5.1875 2.3125 C8.98176948 2.99671253 10.84757509 3.89838339 14 6 C15.0725 6.474375 16.145 6.94875 17.25 7.4375 C18.1575 7.953125 19.065 8.46875 20 9 C20.33 10.32 20.66 11.64 21 13 C24.63 13.66 28.26 14.32 32 15 C32 15.66 32 16.32 32 17 C32.66 17 33.32 17 34 17 C34 17.99 34 18.98 34 20 C34.9590625 20.2165625 34.9590625 20.2165625 35.9375 20.4375 C38 21 38 21 39 22 C40.7015625 22.2165625 40.7015625 22.2165625 42.4375 22.4375 C46 23 46 23 48 25 C48.99 25.309375 49.98 25.61875 51 25.9375 C54 27 54 27 56 30 C51.64569372 29.34025662 48.00783889 27.79661743 44 26 C42.80375 25.505 41.6075 25.01 40.375 24.5 C37.39628639 23.17612728 34.6734805 21.86333489 32 20 C32 19.34 32 18.68 32 18 C31.16984375 18.10699219 30.3396875 18.21398437 29.484375 18.32421875 C24.6634379 17.8756338 22.04970423 15.66091333 18.25 12.8125 C12.39885714 8.59349674 6.64235332 4.89006238 0 2 C0 1.34 0 0.68 0 0 Z " fill="#8A94A2" transform="translate(823,161)"/>
+<path d="M0 0 C4.58200097 0.53905894 7.24312676 2.39908776 11 5 C13.21708696 6.2651407 15.4574256 7.48238385 17.69921875 8.703125 C19.92082978 9.95537434 22.04988907 11.29784853 24.1875 12.6875 C27.34560409 14.70868662 30.41861525 15.86443898 34 17 C34.495 17.99 34.495 17.99 35 19 C35.7425 19.0825 36.485 19.165 37.25 19.25 C40 20 40 20 42.4375 22.9375 C45.32055573 26.38310319 46.75032313 26.89508401 51 28 C53.35894666 28.94643223 55.67305619 29.97614473 58 31 C57.75 32.875 57.75 32.875 57 35 C54.9375 36.25 54.9375 36.25 53 37 C53.33 35.35 53.66 33.7 54 32 C53.13375 31.7525 52.2675 31.505 51.375 31.25 C46.77540904 29.54644779 43.24057874 26.9985146 39.4375 23.9375 C36.01079414 21.21370816 33.19168506 19.26217071 28.875 18.3125 C24.0880137 17.09475787 20.50662253 13.92986111 16.6484375 10.97265625 C12.70507348 8.03548983 8.48563029 5.68609434 4.1875 3.3125 C3.00220703 2.65701172 3.00220703 2.65701172 1.79296875 1.98828125 C1.20128906 1.66214844 0.60960937 1.33601562 0 1 C0 0.67 0 0.34 0 0 Z " fill="#C6D9FE" transform="translate(970,597)"/>
+<path d="M0 0 C2.0625 0.4375 2.0625 0.4375 4 1 C-1.13542212 5.25506404 -5.6710836 7.93341505 -12 10 C-15.40305248 11.55356743 -18.51022166 13.32207791 -21.625 15.375 C-25.99024569 18.17518667 -30.63898899 20.01287294 -35.4609375 21.88671875 C-38.10499698 22.86256503 -38.10499698 22.86256503 -40 25 C-41.32 25 -42.64 25 -44 25 C-43.375 22.625 -43.375 22.625 -42 20 C-39.31640625 18.984375 -39.31640625 18.984375 -36 18 C-24.11997035 14.05617242 -24.11997035 14.05617242 -14 7 C-13.154375 6.67 -12.30875 6.34 -11.4375 6 C-8.85158559 5.25129886 -8.85158559 5.25129886 -8 3 C-5.67793475 2.29508733 -3.34406932 1.62787571 -1 1 C-0.67 0.67 -0.34 0.34 0 0 Z " fill="#87919F" transform="translate(683,480)"/>
+<path d="M0 0 C1.46109063 0.25554054 2.91888096 0.53000372 4.375 0.8125 C5.59316406 1.03873047 5.59316406 1.03873047 6.8359375 1.26953125 C9 2 9 2 11 5 C16.47715383 8.12980219 22.42729974 10.20480174 28.4375 12.0625 C31 13 31 13 32 15 C35.24116794 16.85209597 38.20823519 18.05803276 41.8125 19.0625 C42.864375 19.371875 43.91625 19.68125 45 20 C45.495 20.99 45.495 20.99 46 22 C46.99 22.66 47.98 23.32 49 24 C44.91333648 23.25697027 40.94981078 22.29128429 37 21 C36.505 20.01 36.505 20.01 36 19 C34.14255793 18.38932856 34.14255793 18.38932856 32 18 C29.8125 17.5625 29.8125 17.5625 28 17 C27.67 16.34 27.34 15.68 27 15 C24.19521805 14.08514427 24.19521805 14.08514427 20.9375 13.375 C19.83277344 13.11460937 18.72804688 12.85421875 17.58984375 12.5859375 C16.73519531 12.39257812 15.88054687 12.19921875 15 12 C14.67 10.68 14.34 9.36 14 8 C13.113125 8.103125 12.22625 8.20625 11.3125 8.3125 C6.93733393 7.89974848 5.81017043 6.26587374 3 3 C2.00710032 1.99294974 1.00868257 0.99124138 0 0 Z " fill="#566478" transform="translate(437,467)"/>
+<path d="M0 0 C0.33 0 0.66 0 1 0 C0.125 6.875 0.125 6.875 -1 8 C-1.144375 9.155 -1.28875 10.31 -1.4375 11.5 C-1.623125 12.655 -1.80875 13.81 -2 15 C-2.99 15.495 -2.99 15.495 -4 16 C-4.80259198 17.91203452 -4.80259198 17.91203452 -5.4375 20.1875 C-6.64140688 24.01701285 -8.13942079 27.43388985 -10 31 C-10.45375 32.134375 -10.9075 33.26875 -11.375 34.4375 C-12.91882902 37.82204823 -14.64979932 40.4669003 -16.859375 43.421875 C-18.13738887 45.19008596 -19.12169469 47.00385156 -20 49 C-20.66 49 -21.32 49 -22 49 C-22.061875 49.8353125 -22.061875 49.8353125 -22.125 50.6875 C-23.46930374 54.24030274 -26.00974189 55.70958953 -29 58 C-29.33 57.34 -29.66 56.68 -30 56 C-28.71034824 54.62437146 -27.37310707 53.29233607 -26 52 C-25.34 52 -24.68 52 -24 52 C-23.814375 50.7934375 -23.814375 50.7934375 -23.625 49.5625 C-23.315625 48.2940625 -23.315625 48.2940625 -23 47 C-22.01 46.505 -22.01 46.505 -21 46 C-19.75907248 43.28547104 -18.90166715 40.6347637 -18.125 37.75 C-17.75375 36.8425 -17.3825 35.935 -17 35 C-14.875 34.125 -14.875 34.125 -13 34 C-13.04125 33.21625 -13.0825 32.4325 -13.125 31.625 C-13 29 -13 29 -11 27 C-10.855625 26.030625 -10.71125 25.06125 -10.5625 24.0625 C-10 21 -10 21 -8.58984375 19.63671875 C-6.5352223 17.52151878 -5.93404712 15.5365739 -5 12.75 C-3.49911902 8.40321779 -1.86709229 4.20095764 0 0 Z " fill="#4A6CAC" transform="translate(1117,861)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-2.87608667 4.44576792 -7.21277834 7.32813596 -13 9 C-17.34752244 11.00007904 -17.34752244 11.00007904 -21 14 C-22.98636298 14.70626239 -24.98848259 15.36893571 -27 16 C-29.75256244 16.84979475 -29.75256244 16.84979475 -32 18 C-32.33 18.99 -32.66 19.98 -33 21 C-37.05906178 23.43543707 -41.34208833 24.80495594 -45.81640625 26.24609375 C-49.71273874 27.59133913 -53.07670396 29.07670396 -56 32 C-58.125 31.625 -58.125 31.625 -60 31 C-56.70708299 27.04849959 -53.85760566 26.3763216 -49 25 C-46.92932103 23.82607176 -44.96534994 22.53957868 -42.98046875 21.2265625 C-41.12093171 20.07489656 -39.34227626 19.23884334 -37.3125 18.4375 C-33.95429263 17.16329475 -33.95429263 17.16329475 -31.4375 14.875 C-28.58574158 12.68133968 -26.50862029 12.47844822 -23 12 C-22.67 11.34 -22.34 10.68 -22 10 C-20 9.33333333 -18 8.66666667 -16 8 C-15.67 7.34 -15.34 6.68 -15 6 C-13.07098741 5.53437627 -11.14069241 5.07316577 -9.203125 4.64453125 C-6.90844499 3.97321529 -5.15942753 3.05623616 -3.125 1.8125 C-2.09375 1.214375 -1.0625 0.61625 0 0 Z " fill="#8B95A3" transform="translate(980,333)"/>
+<path d="M0 0 C4.875 0.875 4.875 0.875 6 2 C7.155 2.144375 8.31 2.28875 9.5 2.4375 C10.655 2.623125 11.81 2.80875 13 3 C13.33 3.66 13.66 4.32 14 5 C15.62543123 5.71112616 17.25420014 6.41553997 18.8984375 7.08203125 C23.73238685 9.1935147 28.30487735 11.92128558 32.75 14.75 C35.17793983 16.09885546 37.26340064 16.60905723 40 17 C40 17.66 40 18.32 40 19 C40.65226562 18.73445313 41.30453125 18.46890625 41.9765625 18.1953125 C46.6158089 16.32045481 51.24130964 14.55174686 56 13 C56.66 12.72929687 57.32 12.45859375 58 12.1796875 C58.70125 11.89351562 59.4025 11.60734375 60.125 11.3125 C60.76695312 11.04050781 61.40890625 10.76851562 62.0703125 10.48828125 C64.37939664 9.90399883 65.76492742 10.25994264 68 11 C64.93682594 13.17386547 62.33202335 14.21923801 58.6875 14.875 C55.17417585 15.54974437 52.86352987 16.57447513 49.9375 18.625 C45.76629889 21.45874184 42.97938438 21.60096018 38 21 C37.34 20.34 36.68 19.68 36 19 C34.88625 18.566875 34.88625 18.566875 33.75 18.125 C30.51663102 16.80225814 27.90251994 14.93501329 25 13 C24.071875 12.62875 23.14375 12.2575 22.1875 11.875 C20 11 20 11 19 9 C14.69050046 6.97717369 10.26450289 5.34212243 5.80078125 3.6953125 C3.79565789 2.92110001 1.88987309 2.02368126 0 1 C0 0.67 0 0.34 0 0 Z " fill="#97A0AC" transform="translate(404,188)"/>
+<path d="M0 0 C1.32 0 2.64 0 4 0 C4.33 0.66 4.66 1.32 5 2 C6.134375 2.144375 7.26875 2.28875 8.4375 2.4375 C9.613125 2.623125 10.78875 2.80875 12 3 C12.99 4.485 12.99 4.485 14 6 C17.59020572 8.59292635 20.62032928 9.49073596 25 10 C25.33 10.99 25.66 11.98 26 13 C28.3430809 14.12085312 28.3430809 14.12085312 31 15 C34.27098074 16.40184889 34.92180103 16.88270155 37 20 C39.30206915 20.9123797 41.61384728 21.51380215 44.00390625 22.15625 C44.99197266 22.57390625 44.99197266 22.57390625 46 23 C46.495 24.485 46.495 24.485 47 26 C49.00121175 28.36506843 49.96799661 28.9893322 53 30 C54.421875 31.77734375 54.421875 31.77734375 55.75 33.9375 C56.19859375 34.64777344 56.6471875 35.35804688 57.109375 36.08984375 C57.40328125 36.72019531 57.6971875 37.35054687 58 38 C57.505 38.99 57.505 38.99 57 40 C56.34 39.34 55.68 38.68 55 38 C55 37.01 55 36.02 55 35 C54.43410156 34.75378906 53.86820313 34.50757813 53.28515625 34.25390625 C49.74658642 32.31222947 47.05891093 29.51699451 44.12109375 26.77734375 C42.03357773 24.80734668 42.03357773 24.80734668 39 24 C39 23.34 39 22.68 39 22 C38.46375 21.938125 37.9275 21.87625 37.375 21.8125 C34.54611924 20.844725 32.87137239 19.16766585 30.66015625 17.2109375 C27.96341129 15.2439 25.23557422 14.71182633 22 14 C22 13.34 22 12.68 22 12 C21.443125 11.896875 20.88625 11.79375 20.3125 11.6875 C17.53150251 10.86071696 15.44799816 9.55238908 13 8 C10.47304291 6.42065182 8.16283578 5.06203268 5.375 4 C2.95769855 2.98218886 1.69737101 1.96537696 0 0 Z " fill="#677485" transform="translate(486,521)"/>
+<path d="M0 0 C0.99 0 1.98 0 3 0 C2.67 0.66 2.34 1.32 2 2 C1.89639288 3.44411794 1.85353855 4.89282465 1.84178162 6.34060669 C1.8319928 7.25208466 1.82220398 8.16356262 1.81211853 9.10266113 C1.80636307 10.10535034 1.8006076 11.10803955 1.79467773 12.14111328 C1.78477814 13.19479095 1.77487854 14.24846863 1.76467896 15.33407593 C1.73299999 18.82946498 1.70828124 22.32486764 1.68359375 25.8203125 C1.66302975 28.23884441 1.64203343 30.65737267 1.62062073 33.07589722 C1.56534287 39.45124368 1.51595882 45.82662288 1.46777344 52.20202637 C1.41760008 58.70372441 1.36189231 65.20537473 1.30664062 71.70703125 C1.19898918 84.47131315 1.09737195 97.23563576 1 110 C1.66 110 2.32 110 3 110 C3 110.66 3 111.32 3 112 C4.32 112 5.64 112 7 112 C6.67 112.99 6.34 113.98 6 115 C1.125 113.25 1.125 113.25 0 111 C-0.0921488 109.51748736 -0.12193101 108.0308745 -0.12025452 106.54550171 C-0.12162918 105.60878128 -0.12300385 104.67206085 -0.12442017 103.70695496 C-0.12082489 102.67621353 -0.11722961 101.64547211 -0.11352539 100.58349609 C-0.11367142 99.50055771 -0.11381744 98.41761932 -0.1139679 97.30186462 C-0.11326915 93.70903547 -0.10547852 90.11625764 -0.09765625 86.5234375 C-0.09579193 84.03764881 -0.0943681 81.55185975 -0.09336853 79.06607056 C-0.08993565 73.18353603 -0.08204773 67.30102057 -0.07201904 61.41849387 C-0.05975492 54.06545754 -0.05437626 46.71241893 -0.04882812 39.359375 C-0.03809268 26.23957391 -0.02120886 13.11978812 0 0 Z " fill="#80A9FD" transform="translate(754,684)"/>
+<path d="M0 0 C0.33 0 0.66 0 1 0 C2.29675642 21.90805838 2.29675642 21.90805838 -2.1875 27.625 C-4.1171875 29.50390625 -4.1171875 29.50390625 -6 31 C-7.3921875 32.2684375 -7.3921875 32.2684375 -8.8125 33.5625 C-11 35 -11 35 -13 35 C-13 35.66 -13 36.32 -13 37 C-13.639375 37.103125 -14.27875 37.20625 -14.9375 37.3125 C-15.618125 37.539375 -16.29875 37.76625 -17 38 C-17.33 38.99 -17.66 39.98 -18 41 C-19.70703125 42.0625 -19.70703125 42.0625 -21.8125 43 C-24.8457443 44.41947198 -27.36802849 45.91257432 -30 48 C-34.55555556 51 -34.55555556 51 -38 51 C-38 51.99 -38 52.98 -38 54 C-40.97 54.495 -40.97 54.495 -44 55 C-40.58195341 51.15469758 -37.49411039 49.03378384 -32.76953125 46.9921875 C-30.66340165 45.98743598 -30.66340165 45.98743598 -29 43 C-28.01 43 -27.02 43 -26 43 C-25.95875 42.38125 -25.9175 41.7625 -25.875 41.125 C-25.58625 40.42375 -25.2975 39.7225 -25 39 C-23.00293025 38.32460615 -21.00234321 37.65959541 -19 37 C-15.95623689 35.35902381 -15.95623689 35.35902381 -13 33.375 C-12.01 32.74335937 -11.02 32.11171875 -10 31.4609375 C-5.54354656 27.80525304 -1.69166986 24.19494137 -0.43457031 18.38818359 C-0.19114959 15.57692265 -0.1172168 12.82140877 -0.125 10 C-0.104375 9.03449219 -0.08375 8.06898438 -0.0625 7.07421875 C-0.01578817 4.7152715 0.00447808 2.35931094 0 0 Z " fill="#99A0AE" transform="translate(420,626)"/>
+<path d="M0 0 C4.94556148 1.23639037 8.12987463 3.47191788 12.05859375 6.55078125 C14.55265031 8.41254178 17.18566382 9.68265115 20 11 C21.21282041 11.70062273 22.42103493 12.40926705 23.625 13.125 C26.30853872 14.61585484 28.10819949 15.33266142 31 16 C31.33 16.66 31.66 17.32 32 18 C32.99 18.33 33.98 18.66 35 19 C35 19.66 35 20.32 35 21 C35.60328125 21.19335938 36.2065625 21.38671875 36.828125 21.5859375 C37.62734375 21.84632813 38.4265625 22.10671875 39.25 22.375 C40.03890625 22.63023437 40.8278125 22.88546875 41.640625 23.1484375 C46.54994588 24.9203447 48.51734176 26.28294934 51 31 C47.44765442 30.39102647 44.2668126 29.54266151 41 28 C40.505 27.01 40.505 27.01 40 26 C39.175 25.690625 38.35 25.38125 37.5 25.0625 C36.675 24.711875 35.85 24.36125 35 24 C34.505 22.515 34.505 22.515 34 21 C33.01 21 32.02 21 31 21 C30.34 20.01 29.68 19.02 29 18 C25.94570927 16.78715124 25.94570927 16.78715124 23 16 C23 15.34 23 14.68 23 14 C22.47921875 13.90847656 21.9584375 13.81695313 21.421875 13.72265625 C18.12441749 12.73873748 15.24326632 11.09859834 12.25 9.4375 C11.64800781 9.10814453 11.04601562 8.77878906 10.42578125 8.43945312 C8.94829497 7.6303535 7.47383964 6.81572338 6 6 C6 5.34 6 4.68 6 4 C4.68 4 3.36 4 2 4 C1.34 2.68 0.68 1.36 0 0 Z " fill="#B2CBFE" transform="translate(987,591)"/>
+<path d="M0 0 C0 26.73 0 53.46 0 81 C-0.33 81 -0.66 81 -1 81 C-1 54.6 -1 28.2 -1 1 C-1.99 1.99 -2.98 2.98 -4 4 C-5.32 4 -6.64 4 -8 4 C-8.33 4.99 -8.66 5.98 -9 7 C-11.1796875 8.0625 -11.1796875 8.0625 -13.875 9 C-17.41097339 10.23707524 -19.41069521 11.33386124 -22 14 C-24.1875 13.6875 -24.1875 13.6875 -26 13 C-25.01 13 -24.02 13 -23 13 C-23 12.34 -23 11.68 -23 11 C-22.030625 10.54625 -21.06125 10.0925 -20.0625 9.625 C-16.92920418 8.34213779 -16.92920418 8.34213779 -16 6 C-15.113125 5.71125 -14.22625 5.4225 -13.3125 5.125 C-9.88575688 4.12531102 -9.88575688 4.12531102 -6.875 1.875 C-4 0 -4 0 0 0 Z " fill="#729FFD" transform="translate(849,533)"/>
+<path d="M0 0 C2.96175123 0.61277612 4.38058783 1.25372522 7 3 C5.68 3.33 4.36 3.66 3 4 C2.67 28.75 2.34 53.5 2 79 C1.67 79 1.34 79 1 79 C0.26019726 52.66026805 -0.15317175 26.35025458 0 0 Z " fill="#74A1FD" transform="translate(859,534)"/>
+<path d="M0 0 C1.18529297 0.02707031 1.18529297 0.02707031 2.39453125 0.0546875 C2.98621094 0.07789063 3.57789063 0.10109375 4.1875 0.125 C4.1875 0.455 4.1875 0.785 4.1875 1.125 C-2.64594878 3.29664686 -9.33958664 4.55153085 -16.46240234 5.3527832 C-23.05141588 6.10779054 -29.54856076 7.24788306 -36.0703125 8.44140625 C-37.30523438 8.66699219 -38.54015625 8.89257812 -39.8125 9.125 C-40.864375 9.31835938 -41.91625 9.51171875 -43 9.7109375 C-45.61595884 10.09606477 -48.04790067 10.22749393 -50.6875 10.1875 C-51.46867188 10.17847656 -52.24984375 10.16945313 -53.0546875 10.16015625 C-53.63476562 10.14855469 -54.21484375 10.13695312 -54.8125 10.125 C-53.67260742 8.16308594 -53.67260742 8.16308594 -51.8125 6.125 C-49.17700195 5.57910156 -49.17700195 5.57910156 -46.05078125 5.515625 C-44.93251953 5.48339844 -43.81425781 5.45117188 -42.66210938 5.41796875 C-41.49486328 5.40378906 -40.32761719 5.38960938 -39.125 5.375 C-37.94615234 5.34535156 -36.76730469 5.31570313 -35.55273438 5.28515625 C-32.63925368 5.21438344 -29.72657664 5.16172275 -26.8125 5.125 C-26.4825 4.465 -26.1525 3.805 -25.8125 3.125 C-23.20577112 2.86313683 -20.67580159 2.70321501 -18.0625 2.625 C-11.74799396 2.43193057 -6.15200948 -0.18364207 0 0 Z " fill="#46556B" transform="translate(673.8125,382.875)"/>
+<path d="M0 0 C0.33 0 0.66 0 1 0 C1.06953885 11.76126405 1.12283113 23.5224791 1.15543652 35.28390694 C1.1710862 40.74533479 1.19231195 46.2066219 1.22631836 51.66796875 C1.25893635 56.93938453 1.27685827 62.210665 1.28463173 67.48217392 C1.29017083 69.49240117 1.30098734 71.5026211 1.31719017 73.51279068 C1.3389967 76.33046673 1.34196555 79.14758505 1.34057617 81.96533203 C1.35675491 83.20935036 1.35675491 83.20935036 1.3732605 84.47850037 C1.34678776 89.4465517 0.56465665 92.61597458 -2 97 C-2.33 98.051875 -2.66 99.10375 -3 100.1875 C-3.97943139 102.94215078 -4.7727148 104.17767575 -7 106 C-7 104.68 -7 103.36 -7 102 C-6.01 101.505 -6.01 101.505 -5 101 C-4.38479304 98.71573609 -4.38479304 98.71573609 -4 96.0625 C-3.21955403 91.21955403 -3.21955403 91.21955403 -1 89 C-0.78227448 86.17023633 -0.68856858 83.43545897 -0.68115234 80.60302734 C-0.67110672 79.73466751 -0.6610611 78.86630768 -0.65071106 77.97163391 C-0.61974858 75.09307536 -0.60280778 72.21461035 -0.5859375 69.3359375 C-0.56723635 67.3433857 -0.54766374 65.3508419 -0.5272522 63.35830688 C-0.47581372 58.10746978 -0.43625083 52.85660696 -0.39910889 47.60565186 C-0.35914251 42.25005676 -0.30801666 36.89456968 -0.2578125 31.5390625 C-0.16091457 21.02611742 -0.07655433 10.51311151 0 0 Z " fill="#687388" transform="translate(223,779)"/>
+<path d="M0 0 C2.1875 0.3125 2.1875 0.3125 4 1 C2.35 1.33 0.7 1.66 -1 2 C-1.33 2.99 -1.66 3.98 -2 5 C-3.32 5.33 -4.64 5.66 -6 6 C-6.33 22.83 -6.66 39.66 -7 57 C-7.66 57 -8.32 57 -9 57 C-9.21925465 50.2561504 -9.41409513 43.51191087 -9.59204102 36.7668457 C-9.65543744 34.47273838 -9.72440512 32.17877792 -9.79907227 29.88500977 C-9.90548132 26.586329 -9.99178939 23.28763761 -10.07421875 19.98828125 C-10.11157639 18.96414627 -10.14893402 17.94001129 -10.18742371 16.88484192 C-10.37762113 7.86108354 -10.37762113 7.86108354 -7 4 C-5 3.375 -5 3.375 -3 3 C-2.505 2.46375 -2.01 1.9275 -1.5 1.375 C-1.005 0.92125 -0.51 0.4675 0 0 Z " fill="#E2EBFE" transform="translate(969,671)"/>
+<path d="M0 0 C1.46067199 0.45082469 2.91848032 0.91093537 4.375 1.375 C5.18710938 1.63023437 5.99921875 1.88546875 6.8359375 2.1484375 C9 3 9 3 11 5 C11.825 5.144375 12.65 5.28875 13.5 5.4375 C16 6 16 6 18 9 C20.31470912 9.72870472 22.6505947 10.39239518 25 11 C27.63910581 12.02631893 28.72891575 12.61801765 30.375 14.9375 C33.19404139 18.51551408 37.07027532 19.70178642 41.3125 21.0625 C44 22 44 22 45 24 C41.37 23.01 37.74 22.02 34 21 C34 20.34 34 19.68 34 19 C32.02 18.67 30.04 18.34 28 18 C27.67 17.01 27.34 16.02 27 15 C24.69 14.67 22.38 14.34 20 14 C20 13.34 20 12.68 20 12 C19.319375 11.87625 18.63875 11.7525 17.9375 11.625 C14.52617887 10.89918699 11.2884794 10.17888884 8 9 C6.875 7.0625 6.875 7.0625 6 5 C4.35857037 3.9590934 2.69287785 2.95495674 1 2 C0.67 1.34 0.34 0.68 0 0 Z " fill="#808A9A" transform="translate(155,322)"/>
+<path d="M0 0 C6.90486386 1.04619149 12.30246501 4.12567621 18 8 C19.43083214 8.80365524 20.86894471 9.59442938 22.3125 10.375 C25.53711408 12.12797812 28.55130385 14.02754613 31.5625 16.125 C34.99619252 18.4639787 38.25672573 20.02747107 42.17578125 21.3671875 C49.58457771 23.9372625 58.59687801 28.35946097 63 35 C62.44699219 34.7215625 61.89398437 34.443125 61.32421875 34.15625 C59.70793324 33.35218191 58.08496793 32.56145928 56.45703125 31.78125 C55.58433594 31.3584375 54.71164062 30.935625 53.8125 30.5 C52.49185547 29.86578125 52.49185547 29.86578125 51.14453125 29.21875 C49 28 49 28 48 26 C46.11235097 25.31527335 46.11235097 25.31527335 43.9375 24.875 C43.20402344 24.70742188 42.47054688 24.53984375 41.71484375 24.3671875 C41.14894531 24.24601562 40.58304688 24.12484375 40 24 C40 23.34 40 22.68 40 22 C39.278125 21.896875 38.55625 21.79375 37.8125 21.6875 C34.74041242 20.93654526 32.63996279 19.7124083 30 18 C29.34 17.67 28.68 17.34 28 17 C28 16.34 28 15.68 28 15 C26.35 15 24.7 15 23 15 C22.67 14.34 22.34 13.68 22 13 C19.69034152 11.94647157 17.3570226 10.94280904 15 10 C15 9.34 15 8.68 15 8 C12.53434347 6.71785861 10.07584711 5.62043721 7.5 4.5625 C4.58726566 3.26217217 2.41958727 2.03245331 0 0 Z " fill="#A4ACB6" transform="translate(984,250)"/>
+<path d="M0 0 C1.32 0.33 2.64 0.66 4 1 C3.01 1 2.02 1 1 1 C0.67 1.99 0.34 2.98 0 4 C-0.99 4.33 -1.98 4.66 -3 5 C-3 6.65 -3 8.3 -3 10 C-1.824375 10.1546875 -1.824375 10.1546875 -0.625 10.3125 C2 11 2 11 4 14 C6.32961443 14.35840222 8.66365343 14.68848712 11 15 C14.53272081 16.44192686 17.26723123 18.1468346 20.125 20.625 C22.69504734 23.09544061 22.69504734 23.09544061 25.25 23.5625 C27 24 27 24 28.25 26.0625 C28.4975 26.701875 28.745 27.34125 29 28 C20.6910299 26.22923588 20.6910299 26.22923588 18 23 C15.90010348 21.82425289 15.90010348 21.82425289 14 21 C14 20.34 14 19.68 14 19 C11.69 18.67 9.38 18.34 7 18 C7 17.34 7 16.68 7 16 C6.21625 15.87625 5.4325 15.7525 4.625 15.625 C2 15 2 15 0 13 C-0.825 12.690625 -1.65 12.38125 -2.5 12.0625 C-5 11 -5 11 -7 8 C-6.625 5.3125 -6.625 5.3125 -6 3 C-5.195625 2.87625 -4.39125 2.7525 -3.5625 2.625 C-2.716875 2.41875 -1.87125 2.2125 -1 2 C-0.67 1.34 -0.34 0.68 0 0 Z " fill="#DBE7FE" transform="translate(687,624)"/>
+<path d="M0 0 C6.75 0.75 6.75 0.75 9 3 C10.3303125 3.4021875 10.3303125 3.4021875 11.6875 3.8125 C14.60586153 4.85870508 16.11830123 5.72473687 18.5 7.5625 C21.63814566 9.95611886 24.10554156 10.36601839 28 11 C29.0625 12.875 29.0625 12.875 30 15 C33.45899447 17.49816267 36.96321743 18.70822958 41 20 C52.82222222 24.64444444 52.82222222 24.64444444 55 29 C50.32025975 27.69476632 46.22995897 26.40452356 42.375 23.375 C38.94891014 20.70313133 36.30149643 20.26335692 32 20 C31.67 19.01 31.34 18.02 31 17 C30.113125 16.71125 29.22625 16.4225 28.3125 16.125 C25.01279368 15.00434502 23.14701722 13.58242535 20.5625 11.30078125 C15.89986896 7.41914091 10.79888891 5.61080247 5 4 C2.0625 2.4375 2.0625 2.4375 0 1 C0 0.67 0 0.34 0 0 Z " fill="#949CA9" transform="translate(749,389)"/>
+<path d="M0 0 C1.47906892 -0.02689216 2.95827483 -0.04634621 4.4375 -0.0625 C5.26121094 -0.07410156 6.08492187 -0.08570313 6.93359375 -0.09765625 C9 0 9 0 10 1 C11.76928071 1.27548507 13.54779815 1.49206679 15.328125 1.68359375 C16.4325293 1.80541016 17.53693359 1.92722656 18.67480469 2.05273438 C19.85461914 2.17970703 21.03443359 2.30667969 22.25 2.4375 C24.63558756 2.70551445 27.02100716 2.97502855 29.40625 3.24609375 C31.12328125 3.44114502 31.12328125 3.44114502 32.875 3.64013672 C49.37850501 5.54061847 49.37850501 5.54061847 55 9 C56.32896362 9.67533541 57.66161235 10.34353925 59 11 C57.39620659 11.05416188 55.79188594 11.09286638 54.1875 11.125 C53.29417969 11.14820313 52.40085937 11.17140625 51.48046875 11.1953125 C49 11 49 11 46 9 C42.99988375 8.66238008 40.02396177 8.55857496 37.0078125 8.44140625 C34 8 34 8 31.71484375 6.5 C27.7241175 4.29505197 23.92773413 4.50931639 19.4375 4.4375 C17.7485052 4.40292619 16.05965262 4.36024379 14.37109375 4.30859375 C13.2562561 4.29010376 13.2562561 4.29010376 12.11889648 4.27124023 C9.71585154 3.96362612 8.12956728 3.12526281 6 2 C4.00889599 1.61709538 2.00899487 1.27395385 0 1 C0 0.67 0 0.34 0 0 Z " fill="#5C89E3" transform="translate(621,206)"/>
+<path d="M0 0 C5.70809773 -0.20386063 10.49687826 0.45492942 16 2 C17.93644037 2.48343112 19.87403243 2.96226279 21.8125 3.4375 C37.37681779 7.33843028 37.37681779 7.33843028 41.578125 9.05078125 C44.67519286 10.26463204 47.70826189 10.61273669 51 11 C51 11.99 51 12.98 51 14 C51.99 14.33 52.98 14.66 54 15 C51.69 14.67 49.38 14.34 47 14 C47 13.34 47 12.68 47 12 C45.01432292 12.06510417 43.02864583 12.13020833 41.04296875 12.1953125 C39 12 39 12 36 10 C33.32802965 9.57885802 33.32802965 9.57885802 30.4375 9.4375 C25.19236641 9.09618321 25.19236641 9.09618321 23 8 C23 7.34 23 6.68 23 6 C22.34 6.061875 21.68 6.12375 21 6.1875 C17.75593822 5.98474614 15.26348275 5.00866608 12.26953125 3.80078125 C8.28855562 2.39613408 4.15018664 1.72288087 0 1 C0 0.67 0 0.34 0 0 Z " fill="#5B687C" transform="translate(651,184)"/>
+<path d="M0 0 C8.05873977 -0.02326234 16.11746529 -0.04098548 24.17623043 -0.05181217 C27.91901277 -0.05701078 31.66177198 -0.06405297 35.40454102 -0.07543945 C39.02257576 -0.08637646 42.64058837 -0.09229955 46.25863838 -0.09487724 C47.63279124 -0.09671213 49.00694301 -0.10029485 50.38108635 -0.10573006 C57.67346532 -0.1334032 64.77121115 0.00375776 72 1 C72 1.33 72 1.66 72 2 C41.805 1.505 41.805 1.505 11 1 C11 1.66 11 2.32 11 3 C2.64399592 4.10102642 -5.58807963 4.10094304 -14 4 C-14 3.67 -14 3.34 -14 3 C-9.38 2.67 -4.76 2.34 0 2 C0 1.34 0 0.68 0 0 Z " fill="#969FAB" transform="translate(550,178)"/>
+<path d="M0 0 C5.42877866 1.38380633 9.37791349 3.18913786 13.95703125 6.3515625 C18.70764928 9.59629285 23.46348174 12.28530083 28.6484375 14.7734375 C30.86008243 15.92701974 32.76127458 17.18938526 34.75 18.6875 C37.87435852 20.91060125 40.39284188 21.85226787 44 23 C45.875 24.625 45.875 24.625 47 26 C45.02 26 43.04 26 41 26 C40.505 25.01 40.505 25.01 40 24 C38.11732556 22.93738621 36.19300583 21.94780772 34.25 21 C33.20328125 20.484375 32.1565625 19.96875 31.078125 19.4375 C28.41310545 18.19292234 25.74379273 17.05686831 23 16 C23 15.34 23 14.68 23 14 C22.29875 13.9175 21.5975 13.835 20.875 13.75 C17.3096548 12.81990995 14.90984428 11.23313631 12 9 C12 8.34 12 7.68 12 7 C11.30132813 6.82984375 10.60265625 6.6596875 9.8828125 6.484375 C8.97273437 6.24203125 8.06265625 5.9996875 7.125 5.75 C5.76761719 5.40195312 5.76761719 5.40195312 4.3828125 5.046875 C2 4 2 4 0.6796875 1.890625 C0.45539062 1.26671875 0.23109375 0.6428125 0 0 Z " fill="#8FB3FD" transform="translate(873,633)"/>
+<path d="M0 0 C4.63558231 0.55185504 7.8891554 1.82823304 12 4 C14.7650093 5.25608092 17.53927716 6.48972266 20.31640625 7.71875 C22.99158985 8.99598468 25.47078386 10.45769084 28 12 C30.72316206 13.18701936 33.40830474 14.12563223 36.25 15 C39 16 39 16 40 18 C41.64363134 18.72159424 43.31050386 19.39351421 45 20 C45 20.99 45 21.98 45 23 C44.34 23 43.68 23 43 23 C43 22.34 43 21.68 43 21 C41.02 21 39.04 21 37 21 C36.505 19.515 36.505 19.515 36 18 C35.319375 17.896875 34.63875 17.79375 33.9375 17.6875 C30.37084011 16.85274981 27.33777806 15.50527246 24 14 C24 13.01 24 12.02 24 11 C23.40832031 10.81824219 22.81664062 10.63648438 22.20703125 10.44921875 C15.46002805 8.3029453 15.46002805 8.3029453 12.4375 6.3125 C8.86987647 4.39147194 6.0168031 4.79575577 2 5 C1.34 3.35 0.68 1.7 0 0 Z " fill="#778292" transform="translate(706,199)"/>
+<path d="M0 0 C6.74795531 1.67001711 11.52137687 3.72667396 17 8 C17.7425 8.37125 18.485 8.7425 19.25 9.125 C21 10 21 10 22.265625 11.4296875 C24.50566803 13.45783457 26.63387694 14.07544417 29.5 15 C33.17853571 16.18662442 35.42326535 17.11922587 38 20 C39.64605826 21.03357147 41.30963442 22.04060332 43 23 C42.01 23.495 42.01 23.495 41 24 C39.0546875 23.22265625 39.0546875 23.22265625 36.875 22.0625 C36.15054688 21.68222656 35.42609375 21.30195312 34.6796875 20.91015625 C34.12539063 20.60980469 33.57109375 20.30945312 33 20 C33 19.34 33 18.68 33 18 C32.19175781 17.81824219 31.38351562 17.63648438 30.55078125 17.44921875 C29.48214844 17.19785156 28.41351563 16.94648437 27.3125 16.6875 C26.25675781 16.44386719 25.20101563 16.20023438 24.11328125 15.94921875 C21.01005211 15.00306482 18.72391189 13.73086735 16 12 C15.01 11.67 14.02 11.34 13 11 C12.67 10.34 12.34 9.68 12 9 C11.175 8.690625 10.35 8.38125 9.5 8.0625 C8.2625 7.5365625 8.2625 7.5365625 7 7 C6.67 6.01 6.34 5.02 6 4 C4.68 4 3.36 4 2 4 C1.34 2.68 0.68 1.36 0 0 Z " fill="#5B687C" transform="translate(451,1134)"/>
+<path d="M0 0 C3.14737182 0.69941596 6.02588876 1.76078698 9 3 C9 3.66 9 4.32 9 5 C10.299375 5.0928125 10.299375 5.0928125 11.625 5.1875 C15.80691459 6.19425722 17.75703775 8.22996975 21 11 C22.98451771 11.71143088 24.98202112 12.38991336 27 13 C27.33 13.66 27.66 14.32 28 15 C28.825 15.165 29.65 15.33 30.5 15.5 C31.325 15.665 32.15 15.83 33 16 C33.495 16.99 33.495 16.99 34 18 C35.99541868 18.68025637 37.99617991 19.34490497 40 20 C42.875 21.4375 42.875 21.4375 45 23 C45 23.99 45 24.98 45 26 C44.34 26 43.68 26 43 26 C43 25.34 43 24.68 43 24 C42.13375 23.7525 41.2675 23.505 40.375 23.25 C37 22 37 22 34.0625 20 C30.63504328 17.76166092 27.94599946 16.94703987 24 16 C24 15.34 24 14.68 24 14 C23.071875 13.896875 22.14375 13.79375 21.1875 13.6875 C17.8495811 12.96755671 17.14853242 12.45546562 15 10 C14.01 9.67 13.02 9.34 12 9 C12 8.34 12 7.68 12 7 C9.03 6.505 9.03 6.505 6 6 C6 5.34 6 4.68 6 4 C4.35 3.67 2.7 3.34 1 3 C0.67 2.01 0.34 1.02 0 0 Z " fill="#BFD3FE" transform="translate(795,698)"/>
+<path d="M0 0 C0.66 0 1.32 0 2 0 C1.67 1.32 1.34 2.64 1 4 C0.05125 4.103125 -0.8975 4.20625 -1.875 4.3125 C-5.29107501 4.68539295 -5.29107501 4.68539295 -7 8 C-9.625 8.1875 -9.625 8.1875 -12 8 C-12 8.99 -12 9.98 -12 11 C-13.98 11 -15.96 11 -18 11 C-18.33 11.99 -18.66 12.98 -19 14 C-20.96615661 15.0650015 -22.96726926 16.06833174 -25 17 C-25.33 17.33 -25.66 17.66 -26 18 C-27.99958364 18.04080783 -30.00045254 18.04254356 -32 18 C-32.33 18.99 -32.66 19.98 -33 21 C-34.134375 21.12375 -35.26875 21.2475 -36.4375 21.375 C-38.2009375 21.684375 -38.2009375 21.684375 -40 22 C-40.33 22.66 -40.66 23.32 -41 24 C-42.32 23.67 -43.64 23.34 -45 23 C-42.77868967 21.12042972 -41.04324099 20.0137585 -38.25 19.125 C-35.40137409 18.13893718 -33.48852313 17.12418876 -31 15.5 C-27.72803031 13.37414399 -24.71061462 12.23687154 -21 11 C-18.16070671 9.53683134 -15.37246519 7.99857994 -12.5859375 6.4375 C-8.38860688 4.10424068 -5.88664754 2.72851958 -1 3 C-0.67 2.01 -0.34 1.02 0 0 Z " fill="#5781D5" transform="translate(810,450)"/>
+<path d="M0 0 C1.46067199 0.45082469 2.91848032 0.91093537 4.375 1.375 C5.18710937 1.63023437 5.99921875 1.88546875 6.8359375 2.1484375 C9 3 9 3 11 5 C12.155 5.144375 13.31 5.28875 14.5 5.4375 C15.655 5.623125 16.81 5.80875 18 6 C18.99 7.485 18.99 7.485 20 9 C20.99 9.33 21.98 9.66 23 10 C23.4640625 10.9590625 23.4640625 10.9590625 23.9375 11.9375 C25.31211797 14.60587605 26.19173871 14.96537742 29 16 C30.258125 16.268125 31.51625 16.53625 32.8125 16.8125 C37.39960977 17.87106379 40.33492245 20.09848027 44 23 C40.76958469 23 38.7938486 22.09648624 35.890625 20.78515625 C33.77186183 19.85666632 33.77186183 19.85666632 30.5 19.0625 C26.47497877 17.84061855 23.53786217 16.26423179 20 14 C19.67 13.34 19.34 12.68 19 12 C17.34399541 11.30727277 15.67468922 10.64624937 14 10 C11.91764528 8.89065827 9.85555739 7.74265116 7.8125 6.5625 C6.76707031 5.96566406 5.72164062 5.36882812 4.64453125 4.75390625 C2 3 2 3 0 0 Z " fill="#7E8998" transform="translate(726,377)"/>
+<path d="M0 0 C3.03899538 1.45871778 5.94664394 3.11133508 8.87109375 4.78515625 C9.57363281 5.18605469 10.27617188 5.58695313 11 6 C11.89847656 6.51433594 12.79695312 7.02867187 13.72265625 7.55859375 C15.15931641 8.36490234 15.15931641 8.36490234 16.625 9.1875 C17.52476562 9.69667969 18.42453125 10.20585938 19.3515625 10.73046875 C21.93421075 12.10284281 21.93421075 12.10284281 24.703125 12.5390625 C27.54507158 13.10938511 28.45557748 14.44512759 30.34375 16.5390625 C33.31641285 19.16117549 36.94285112 20.72516336 40.4765625 22.47265625 C43.07731356 24.04679505 44.37416486 25.46304248 46 28 C39.48409368 26.44377383 35.63472964 25.02095711 31 20 C29.00779443 19.31039038 27.00894394 18.63920943 25 18 C24.67 17.01 24.34 16.02 24 15 C23.01 15 22.02 15 21 15 C20.67 14.34 20.34 13.68 20 13 C18.28431898 12.20147986 18.28431898 12.20147986 16.25 11.5625 C7.77490448 8.54980895 7.77490448 8.54980895 6 5 C5.175 4.505 4.35 4.01 3.5 3.5 C1 2 1 2 0 0 Z " fill="#CADBFE" transform="translate(715,872)"/>
+<path d="M0 0 C3.60882498 1.34042071 6.73061032 2.9760921 10 5 C12.32656309 6.34542375 14.6636936 7.67151204 17 9 C17 9.66 17 10.32 17 11 C17.825 11.226875 18.65 11.45375 19.5 11.6875 C23.08232831 13.03087312 25.85854311 14.75071352 29.03515625 16.8359375 C31.15688316 18.18887081 31.15688316 18.18887081 34.4375 19.125 C35.7059375 19.558125 35.7059375 19.558125 37 20 C37.495 21.485 37.495 21.485 38 23 C39.65 23 41.3 23 43 23 C43.495 24.485 43.495 24.485 44 26 C40.48478927 25.34903505 38.0225326 23.87109161 35 22 C33.00892752 20.98234073 31.00781177 19.98422146 29 19 C28.01773438 18.50113281 28.01773438 18.50113281 27.015625 17.9921875 C23.39635558 16.15534024 19.80600962 14.42725361 16 13 C16 12.34 16 11.68 16 11 C13.03 10.505 13.03 10.505 10 10 C10 9.34 10 8.68 10 8 C9.278125 7.938125 8.55625 7.87625 7.8125 7.8125 C4.11600926 6.7446249 2.46861132 4.89180184 0 2 C0 1.34 0 0.68 0 0 Z " fill="#A1BFFD" transform="translate(874,539)"/>
+<path d="M0 0 C1.98 0 3.96 0 6 0 C6.33 1.32 6.66 2.64 7 4 C7.7425 3.94199219 8.485 3.88398437 9.25 3.82421875 C12.48210597 4.03081643 13.53981706 4.77392099 16 6.8125 C18.9053593 9.13569929 21.77500962 11.13290031 25 13 C25.94875 13.66 26.8975 14.32 27.875 15 C32.92412605 18.23144067 38.30691143 20.19487436 44 22 C44 22.99 44 23.98 44 25 C45.32 25.33 46.64 25.66 48 26 C47.67 26.66 47.34 27.32 47 28 C42.125 26.25 42.125 26.25 41 24 C39.02416285 23.26480478 37.01822402 22.60927518 35 22 C33 21.33333333 31 20.66666667 29 20 C29 19.34 29 18.68 29 18 C28.21625 17.731875 27.4325 17.46375 26.625 17.1875 C24 16 24 16 22 13 C19.39780858 11.17143306 17.45141394 10.08398399 14.3125 9.5 C12 9 12 9 10 6 C7.44816596 4.79549696 7.44816596 4.79549696 5 4 C5 3.34 5 2.68 5 2 C3.35 1.67 1.7 1.34 0 1 C0 0.67 0 0.34 0 0 Z " fill="#A2C0FD" transform="translate(768,919)"/>
+<path d="M0 0 C0.33 0 0.66 0 1 0 C1.04254356 1.99954746 1.04080783 4.00041636 1 6 C0.67 6.33 0.34 6.66 0 7 C-0.0825 8.093125 -0.165 9.18625 -0.25 10.3125 C-1.15366149 14.75550235 -2.35663006 15.51184492 -6 18 C-6.66 18.99 -7.32 19.98 -8 21 C-9.32594105 21.36162029 -10.65938457 21.69728039 -12 22 C-12.33 22.66 -12.66 23.32 -13 24 C-17.62 24 -22.24 24 -27 24 C-27.33 23.01 -27.66 22.02 -28 21 C-28.66 20.67 -29.32 20.34 -30 20 C-28.35451172 20.05220703 -28.35451172 20.05220703 -26.67578125 20.10546875 C-25.22136955 20.13361865 -23.7669412 20.16091752 -22.3125 20.1875 C-21.59126953 20.21263672 -20.87003906 20.23777344 -20.12695312 20.26367188 C-15.50584437 20.32697473 -12.67467254 19.83130507 -9 17 C-4.94948935 12.94948935 -3.18110278 9.43307231 -1.578125 3.953125 C-1 2 -1 2 0 0 Z " fill="#D6D9DF" transform="translate(223,870)"/>
+<path d="M0 0 C-2.87846866 2.34541891 -5.54323547 3.68313732 -9 5 C-12.38654212 6.48161218 -14.72172406 7.71420309 -17.3125 10.375 C-20.27722087 13.27077387 -23.20858598 14.9438382 -26.84765625 16.86328125 C-28.5815496 17.77900351 -30.26874589 18.78284321 -31.9375 19.8125 C-34 21 -34 21 -36 21 C-36.33 21.99 -36.66 22.98 -37 24 C-38.98 24.33 -40.96 24.66 -43 25 C-43 24.34 -43 23.68 -43 23 C-42.01 23 -41.02 23 -40 23 C-39.67 22.01 -39.34 21.02 -39 20 C-37.33333333 19.33333333 -35.66666667 18.66666667 -34 18 C-33.67 17.01 -33.34 16.02 -33 15 C-31.0187415 14.27954236 -29.01495907 13.61998741 -27 13 C-23.32064321 11.17499082 -23.32064321 11.17499082 -21 8 C-18.48810588 6.90575335 -15.92891181 6.01502333 -13.34765625 5.09765625 C-10.69522955 4.10486973 -10.69522955 4.10486973 -9 1 C-2.58333333 -1.29166667 -2.58333333 -1.29166667 0 0 Z " fill="#A7C3FD" transform="translate(704,602)"/>
+<path d="M0 0 C1.48199902 0.44909061 2.96055236 0.90956564 4.4375 1.375 C5.26121094 1.63023437 6.08492187 1.88546875 6.93359375 2.1484375 C9 3 9 3 10 5 C10.07092842 7.2072923 10.08415025 9.41667452 10.0625 11.625 C10.05347656 12.81351562 10.04445313 14.00203125 10.03515625 15.2265625 C10.02355469 16.14179688 10.01195312 17.05703125 10 18 C9.01 18.33 8.02 18.66 7 19 C6.67 19.99 6.34 20.98 6 22 C3.69 22.33 1.38 22.66 -1 23 C-1 23.66 -1 24.32 -1 25 C-2.98 25.33 -4.96 25.66 -7 26 C-7 26.66 -7 27.32 -7 28 C-8.98 28 -10.96 28 -13 28 C-10.44928662 24.75363752 -7.89461833 23.43063828 -4.125 22 C1.8969043 19.76019457 1.8969043 19.76019457 7 16 C7.82883135 12.35314206 7.36488178 9.15545896 6.25 5.625 C4.73336292 3.6533718 3.24334435 3.01312325 1 2 C0.67 1.34 0.34 0.68 0 0 Z " fill="#45546A" transform="translate(1044,281)"/>
+<path d="M0 0 C4.04735984 3.34953917 5.71112914 7.01636599 7 12 C7.1875 15.5 7.1875 15.5 7 18 C7.99 18.33 8.98 18.66 10 19 C11.74672985 22.4934597 13 25.06845568 13 29 C13.66 29 14.32 29 15 29 C15.33 29.99 15.66 30.98 16 32 C16.66 32.33 17.32 32.66 18 33 C18.7013284 35.32315031 19.36485174 37.65789079 20 40 C20.37125 40.7425 20.7425 41.485 21.125 42.25 C22 44 22 44 22 47 C22.66 47 23.32 47 24 47 C24 49.31 24 51.62 24 54 C20.30789006 50.06968942 19.60991928 47.28596712 19 42 C18.34 41.67 17.68 41.34 17 41 C16.33333333 38.66666667 15.66666667 36.33333333 15 34 C14.34 33.67 13.68 33.34 13 33 C9.95051511 28.42577266 8.44972312 25.64033805 9 20 C8.01 20 7.02 20 6 20 C6 17.69 6 15.38 6 13 C5.01 12.67 4.02 12.34 3 12 C1.63866302 8.06724871 0.74383122 4.09107168 0 0 Z " fill="#CBCED5" transform="translate(279,747)"/>
+<path d="M0 0 C2.125 0.375 2.125 0.375 4 1 C1.42017416 2.66929908 -0.86812201 3.95897129 -3.8125 4.875 C-6.61593256 5.86444679 -8.54061783 6.89788819 -11 8.5 C-14.2512201 10.61391116 -17.27480403 11.8662447 -21 13 C-25.26670295 14.66381684 -25.26670295 14.66381684 -28 18 C-29.98536627 18.70905938 -31.98910922 19.36694179 -34 20 C-38.79234499 21.50947319 -38.79234499 21.50947319 -42 25 C-44.06640625 25.6328125 -44.06640625 25.6328125 -46.5625 26.125 C-47.38878906 26.29257812 -48.21507812 26.46015625 -49.06640625 26.6328125 C-49.70449219 26.75398438 -50.34257813 26.87515625 -51 27 C-50.505 25.515 -50.505 25.515 -50 24 C-46.535 23.505 -46.535 23.505 -43 23 C-43 22.01 -43 21.02 -43 20 C-42.175 19.731875 -41.35 19.46375 -40.5 19.1875 C-37.90928699 18.30850808 -35.32424809 17.425414 -32.75 16.5 C-32.08484375 16.2628125 -31.4196875 16.025625 -30.734375 15.78125 C-28.79436633 15.03056901 -28.79436633 15.03056901 -27 13 C-25.68 13 -24.36 13 -23 13 C-23 12.01 -23 11.02 -23 10 C-21.906875 9.896875 -20.81375 9.79375 -19.6875 9.6875 C-15.88845793 8.97920402 -15.41623585 8.64635355 -13 6 C-11.68 6 -10.36 6 -9 6 C-9 5.01 -9 4.02 -9 3 C-7.329375 2.814375 -7.329375 2.814375 -5.625 2.625 C-1.96896323 2.3534187 -1.96896323 2.3534187 0 0 Z " fill="#3E5888" transform="translate(789,459)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-2.79054395 4.72597863 -7.23263288 7.11677808 -13 9 C-15.01723344 9.96476382 -17.01612292 10.96838392 -19 12 C-23.9336697 14.52232602 -28.88995147 16.84840062 -34 19 C-34.76957031 19.36609375 -35.53914062 19.7321875 -36.33203125 20.109375 C-37.12996094 20.48578125 -37.92789063 20.8621875 -38.75 21.25 C-39.85601563 21.78367187 -39.85601563 21.78367187 -40.984375 22.328125 C-43 23 -43 23 -46 22 C-43.13824239 19.6681975 -40.44267513 18.30263383 -37 17 C-36.67 16.67 -36.34 16.34 -36 16 C-34.33382885 15.95936168 -32.66611905 15.957279 -31 16 C-30.67 14.68 -30.34 13.36 -30 12 C-28.5459375 11.814375 -28.5459375 11.814375 -27.0625 11.625 C-26.051875 11.41875 -25.04125 11.2125 -24 11 C-23.67 10.34 -23.34 9.68 -23 9 C-21.80375 8.896875 -20.6075 8.79375 -19.375 8.6875 C-15.15803289 8.28158873 -12.99095366 6.80169177 -9.73828125 4.20703125 C-7.00544658 2.30939999 -4.21409857 1.77138366 -1 1 C-0.67 0.67 -0.34 0.34 0 0 Z " fill="#4767A3" transform="translate(1031,340)"/>
+<path d="M0 0 C2.375 -0.125 2.375 -0.125 5 0 C5.66 0.66 6.32 1.32 7 2 C7.598125 2.0825 8.19625 2.165 8.8125 2.25 C12.25657198 3.43082468 13.77825094 6.2085717 16 9 C16.99 9.66 17.98 10.32 19 11 C17.02 10.67 15.04 10.34 13 10 C13 9.34 13 8.68 13 8 C12.01 8 11.02 8 10 8 C9.67 7.34 9.34 6.68 9 6 C5.19495826 4.73165275 3.02679608 4.48866082 -1 5 C-3.67953863 6.55923231 -6.10530084 8.29748962 -8.5703125 10.17578125 C-15.14890382 15.115013 -15.14890382 15.115013 -18.3125 14.6875 C-18.869375 14.460625 -19.42625 14.23375 -20 14 C-15.375 11 -15.375 11 -12 11 C-11.979375 10.236875 -11.95875 9.47375 -11.9375 8.6875 C-11 6 -11 6 -7.625 4.1875 C-4 3 -4 3 -1 3 C-0.67 2.01 -0.34 1.02 0 0 Z " fill="#B4CDFE" transform="translate(957,800)"/>
+<path d="M0 0 C-2.12470334 3.18705501 -4.0118549 4.232572 -7.32421875 6.015625 C-9.1266125 6.97987268 -9.1266125 6.97987268 -10.75 8.75 C-11.1625 9.1625 -11.575 9.575 -12 10 C-12.99 10 -13.98 10 -15 10 C-15.2475 10.5775 -15.495 11.155 -15.75 11.75 C-17.75998021 15.36796438 -19.69370499 17.57469465 -23.6875 18.875 C-28.33279451 20.45264719 -32.01542868 23.18423627 -36 26 C-36.66 25.67 -37.32 25.34 -38 25 C-37.236875 24.401875 -36.47375 23.80375 -35.6875 23.1875 C-33.1165855 21.20164646 -33.1165855 21.20164646 -31.5625 19.4375 C-30 18 -30 18 -27.0625 16.5625 C-23.43404159 14.71124571 -21.22755814 12.45075053 -18.625 9.375 C-17 8 -17 8 -14.0625 7.125 C-10.37002962 5.76858231 -9.36879761 4.05651304 -7 1 C-2.60465116 -1.30232558 -2.60465116 -1.30232558 0 0 Z " fill="#A3A9B6" transform="translate(274,653)"/>
+<path d="M0 0 C4.0663003 -0.18483183 6.45811739 0.06806403 10 2 C11.670625 2.433125 11.670625 2.433125 13.375 2.875 C17.19291961 4.0598716 19.69410054 5.79606703 23 8 C25.32748694 8.68679942 27.65986656 9.35761043 30 10 C30.33 10.66 30.66 11.32 31 12 C31.825 12.495 32.65 12.99 33.5 13.5 C36 15 36 15 37 17 C25.35294118 13.19852941 25.35294118 13.19852941 20 11 C19.67 10.34 19.34 9.68 19 9 C16.67843403 8.59270772 14.3431213 8.25561323 12 8 C12 7.34 12 6.68 12 6 C11.36191406 5.95101562 10.72382812 5.90203125 10.06640625 5.8515625 C9.24011719 5.77679688 8.41382813 5.70203125 7.5625 5.625 C6.73878906 5.55539063 5.91507813 5.48578125 5.06640625 5.4140625 C4.38449219 5.27742188 3.70257812 5.14078125 3 5 C2.67 4.34 2.34 3.68 2 3 C3.32 3 4.64 3 6 3 C4.02 2.34 2.04 1.68 0 1 C0 0.67 0 0.34 0 0 Z " fill="#D5D9DE" transform="translate(603,47)"/>
+<path d="M0 0 C5.75 2.75 5.75 2.75 8 5 C9.99541868 5.68025637 11.99617991 6.34490497 14 7 C18.29940428 8.97056029 22.0718048 11.3812032 26 14 C28.74363883 15.42669219 31.50302128 16.77165843 34.3125 18.0625 C36 19 36 19 37 21 C38.99541868 21.68025637 40.99617991 22.34490497 43 23 C44.69207001 23.9563874 46.36816893 24.94410931 48 26 C47.67 27.32 47.34 28.64 47 30 C47 29.01 47 28.02 47 27 C46.2575 27.05929687 45.515 27.11859375 44.75 27.1796875 C41.49781648 26.96718687 40.45774435 26.19624423 38 24.125 C35.07552953 21.78322477 32.58547864 20.19515955 29 19 C25.72901926 17.59815111 25.07819897 17.11729845 23 14 C20.86112391 12.94549199 20.86112391 12.94549199 18.375 12.125 C14.15083004 10.53407885 10.52020761 8.64939184 6.76171875 6.1640625 C5.21815451 5.14414644 3.61248997 4.21952561 2 3.3125 C1.34 2.879375 0.68 2.44625 0 2 C0 1.34 0 0.68 0 0 Z " fill="#BFD4FE" transform="translate(989,818)"/>
+<path d="M0 0 C2.79129482 2.53893118 3.69031157 4.81397172 4.921875 8.37109375 C6.33884592 11.82624385 8.13809636 15.04680951 9.9375 18.3125 C14.4369901 26.54539222 17.58325669 34.93721259 20 44 C18.68 43.67 17.36 43.34 16 43 C15.87625 41.88625 15.7525 40.7725 15.625 39.625 C15.3534187 35.96896323 15.3534187 35.96896323 13 34 C12.60235737 32.01178687 12.26224651 30.01055661 12 28 C11.01 27.67 10.02 27.34 9 27 C8.87625 26.030625 8.7525 25.06125 8.625 24.0625 C8.41875 23.051875 8.2125 22.04125 8 21 C7.34 20.67 6.68 20.34 6 20 C5.855625 18.865625 5.71125 17.73125 5.5625 16.5625 C5.376875 15.386875 5.19125 14.21125 5 13 C4.01 12.34 3.02 11.68 2 11 C0.63071479 7.10834729 0 4.14156548 0 0 Z " fill="#C7CBD2" transform="translate(303,801)"/>
+<path d="M0 0 C3.79746835 4.55696203 3.79746835 4.55696203 5 7.1875 C5.87144569 9.17201523 5.87144569 9.17201523 8 10 C10.56160784 11.28080392 10.76461393 12.4565581 12 15 C13.6222454 16.70993434 15.29413425 18.37347684 17 20 C17.86625 20.9075 18.7325 21.815 19.625 22.75 C21.86533112 25.19004674 21.86533112 25.19004674 25 26 C26.69088222 27.97956942 28.35830472 29.97945196 30 32 C30.66 32.33 31.32 32.66 32 33 C31.67 33.66 31.34 34.32 31 35 C27.17069104 34.45295586 25.56164428 32.80954534 23 30 C22.46375 29.484375 21.9275 28.96875 21.375 28.4375 C20 27 20 27 18 24 C16.36368108 22.95107762 14.69514137 21.95093297 13 21 C9.81007783 18.87338522 8.76684252 16.97663925 6.97265625 13.66796875 C5.87778117 11.79041189 4.56488081 10.49684251 3 9 C0.59907095 5.53199138 0 4.34827524 0 0 Z " fill="#959EAA" transform="translate(392,317)"/>
+<path d="M0 0 C0.33 0 0.66 0 1 0 C1 5.61 1 11.22 1 17 C1.66 17 2.32 17 3 17 C3.07347656 18.62808594 3.07347656 18.62808594 3.1484375 20.2890625 C3.22351986 21.73439784 3.29906528 23.17970919 3.375 24.625 C3.42140625 25.69427734 3.42140625 25.69427734 3.46875 26.78515625 C3.72429077 33.94037902 3.72429077 33.94037902 7 40 C7.28306234 42.54756104 7.44815786 45.09510022 7.62109375 47.65234375 C7.79485724 50.18512773 7.79485724 50.18512773 10 52 C9.625 54.125 9.625 54.125 9 56 C8.505 54.515 8.505 54.515 8 53 C7.34 52.67 6.68 52.34 6 52 C2.81335396 43.74263252 1.35226893 35.81633954 2 27 C1.34 27 0.68 27 0 27 C0 18.09 0 9.18 0 0 Z " fill="#7A8395" transform="translate(156,810)"/>
+<path d="M0 0 C-1.68801625 1.95454513 -2.87112791 2.95123759 -5.3125 3.875 C-9.01682906 5.42564937 -11.27712128 7.02383023 -14 10 C-15.27790192 15.678419 -14.00619179 19.17542879 -11 24 C-10.22291316 25.85565219 -9.49310216 27.73183077 -8.8125 29.625 C-8.46832031 30.56601562 -8.12414062 31.50703125 -7.76953125 32.4765625 C-7 35 -7 35 -7 38 C-7.99 37.34 -8.98 36.68 -10 36 C-10.37400786 33.67284 -10.70764733 31.33882138 -11 29 C-11.66 28.34 -12.32 27.68 -13 27 C-14.36763024 23.37980231 -15.32795196 19.80827223 -16 16 C-16.66 16 -17.32 16 -18 16 C-20 13 -20 13 -20 9 C-18.02 8.67 -16.04 8.34 -14 8 C-14 7.01 -14 6.02 -14 5 C-13.195625 4.71125 -12.39125 4.4225 -11.5625 4.125 C-8.8673532 3.26737432 -8.8673532 3.26737432 -8 1 C-2.47058824 -1.23529412 -2.47058824 -1.23529412 0 0 Z " fill="#606B81" transform="translate(343,701)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-0.38573379 2.89213369 -2.07175348 4.02391783 -5 5 C-5.33 5.66 -5.66 6.32 -6 7 C-7.99508067 7.68124706 -9.99638693 8.34427209 -12 9 C-17.40624953 11.38886548 -17.40624953 11.38886548 -22 15 C-22.99 15 -23.98 15 -25 15 C-25 15.66 -25 16.32 -25 17 C-29.64144669 18.76054874 -34.27775484 20.46527032 -39 22 C-37.60387736 19.20775471 -35.69511726 18.55717886 -33 17 C-32.030625 16.319375 -31.06125 15.63875 -30.0625 14.9375 C-25.93611018 12.32692685 -21.72412489 11.09018267 -17 10 C-16.67 8.68 -16.34 7.36 -16 6 C-14.02 5.67 -12.04 5.34 -10 5 C-9.67 4.01 -9.34 3.02 -9 2 C-6.94921875 1.77213542 -4.8984375 1.54427083 -2.84765625 1.31640625 C-0.98859771 1.18113386 -0.98859771 1.18113386 0 0 Z " fill="#5279C4" transform="translate(666,522)"/>
+<path d="M0 0 C2.125 0.375 2.125 0.375 4 1 C-2.625 5 -2.625 5 -6 5 C-6.33 5.99 -6.66 6.98 -7 8 C-8.99054876 8.69437747 -10.99255385 9.35610218 -13 10 C-15.03833424 11.2739589 -17.03852126 12.61061923 -19 14 C-22.61812613 16.5105365 -25.92752672 18.37101069 -30 20 C-30.33 20.66 -30.66 21.32 -31 22 C-31.99 22.33 -32.98 22.66 -34 23 C-34.33 23.66 -34.66 24.32 -35 25 C-35.804375 25.144375 -36.60875 25.28875 -37.4375 25.4375 C-40.34440658 25.76502717 -40.34440658 25.76502717 -42 29 C-45 30.75 -45 30.75 -48 32 C-48.66 31.67 -49.32 31.34 -50 31 C-45.16441641 27.07780442 -40.61149519 23.74049765 -35 21 C-34.4225 20.360625 -33.845 19.72125 -33.25 19.0625 C-30.27713815 16.33737664 -27.11343264 15.34951851 -23.33984375 14.02734375 C-20.99022675 13.1687849 -20.99022675 13.1687849 -19.58642578 11.55908203 C-17.89611376 9.89790435 -16.40780287 9.04537536 -14.27734375 8.02734375 C-13.57416016 7.68509766 -12.87097656 7.34285156 -12.14648438 6.99023438 C-11.41751953 6.64283203 -10.68855469 6.29542969 -9.9375 5.9375 C-8.48649817 5.24198901 -7.03719544 4.54291909 -5.58984375 3.83984375 C-4.94909912 3.53425537 -4.30835449 3.22866699 -3.64819336 2.91381836 C-1.80982132 1.99351714 -1.80982132 1.99351714 0 0 Z " fill="#C2D6FE" transform="translate(843,518)"/>
+<path d="M0 0 C0.33 0 0.66 0 1 0 C1.33 2.97 1.66 5.94 2 9 C2.99 9.33 3.98 9.66 5 10 C5.53284956 11.66515488 6.05207397 13.33720144 6.46875 15.03515625 C7.3127873 18.15685302 8.70866428 21.04068898 10 24 C10.68836513 25.99263591 11.36281399 27.99041337 12 30 C12.99 30 13.98 30 15 30 C16.96189209 33.6678852 18.39301257 36.87248551 19 41 C20.485 41.495 20.485 41.495 22 42 C21.67 42.66 21.34 43.32 21 44 C17.33663903 42.77887968 16.64957986 41.13279518 14.76953125 37.88671875 C14 36 14 36 14 32 C13.01 32 12.02 32 11 32 C9.375 29.5625 9.375 29.5625 8 27 C7.67 26.67 7.34 26.34 7 26 C6.95936168 24.33382885 6.957279 22.66611905 7 21 C6.01 20.67 5.02 20.34 4 20 C4 17.03 4 14.06 4 11 C2.68 10.67 1.36 10.34 0 10 C0 6.7 0 3.4 0 0 Z " fill="#5D6B7E" transform="translate(37,865)"/>
+<path d="M0 0 C4.75032037 0.46571768 8.12160643 1.14824002 12 4 C12.33 4.66 12.66 5.32 13 6 C14.98636298 6.70626239 16.98848259 7.36893571 19 8 C22.30706008 9.3779417 22.91162262 9.86743394 25 13 C27.95935996 14.68145452 30.73080204 15.92148393 34 16.875 C37.82404293 18.3090161 39.94977714 20.28869079 43 23 C43.99 23.66 44.98 24.32 46 25 C42.67056175 24.44509362 39.88389972 23.79000672 37 22 C36.34 21.01 35.68 20.02 35 19 C33.906875 18.855625 32.81375 18.71125 31.6875 18.5625 C27.45375848 17.91667502 26.16774565 16.77177745 23 14 C21.26092112 12.98817229 19.52093019 11.9771456 17.7578125 11.0078125 C16.09536204 10.05467424 14.5119111 8.96744852 12.9375 7.875 C10.0007282 6.00046481 7.33688625 4.95339607 4 4 C4 3.34 4 2.68 4 2 C2.68 1.34 1.36 0.68 0 0 Z " fill="#B1CAFE" transform="translate(661,858)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C3.00005304 4.00015912 3.11575585 5.97423756 3.09765625 9.10546875 C3.09443359 10.08837891 3.09121094 11.07128906 3.08789062 12.08398438 C3.07951172 13.10814453 3.07113281 14.13230469 3.0625 15.1875 C3.05798828 16.22326172 3.05347656 17.25902344 3.04882812 18.32617188 C3.0370401 20.88417266 3.02058515 23.44205733 3 26 C2.01 26.33 1.02 26.66 0 27 C-0.04125 28.155 -0.0825 29.31 -0.125 30.5 C-0.7370078 35.7726826 -3.60254551 39.09344683 -7 43 C-7 40.12382735 -6.61048208 38.48678142 -5.6875 35.8125 C-5.41421875 35.01457031 -5.1409375 34.21664062 -4.859375 33.39453125 C-4.0884384 31.24642155 -3.27179412 29.12404473 -2.4375 27 C1.01935868 17.67196864 1.04470585 9.92470557 0 0 Z " fill="#C2C7CE" transform="translate(789,274)"/>
+<path d="M0 0 C0.33 0 0.66 0 1 0 C1.0926956 8.53619235 1.16376219 17.07217429 1.20724869 25.60874557 C1.22812052 29.57267793 1.25642999 33.53626587 1.30175781 37.5 C1.34523119 41.32552727 1.36914015 45.15072334 1.37950897 48.97647858 C1.38689778 50.43575505 1.40132665 51.89501346 1.42292023 53.35414886 C1.45197624 55.398932 1.45595541 57.4423482 1.45410156 59.48730469 C1.46298401 60.65090515 1.47186646 61.81450562 1.48101807 63.0133667 C0.89825345 66.63174267 -0.18522303 67.74106119 -3 70 C-6.71693921 72.61931958 -10.44465047 74.44783642 -15 75 C-15 74.34 -15 73.68 -15 73 C-14.48050781 72.74605469 -13.96101562 72.49210938 -13.42578125 72.23046875 C-6.78790913 69.24566025 -6.78790913 69.24566025 -1 65 C-0.87624831 62.97585009 -0.82202689 60.94742263 -0.79467773 58.91967773 C-0.77473251 57.61840439 -0.75478729 56.31713104 -0.73423767 54.97642517 C-0.71725201 53.5454826 -0.70037325 52.11453875 -0.68359375 50.68359375 C-0.66303094 49.2277008 -0.64203466 47.77181391 -0.62062073 46.31593323 C-0.56533039 42.47727353 -0.51595198 38.63855935 -0.46777344 34.79980469 C-0.41760909 30.88536712 -0.36189664 26.97100904 -0.30664062 23.05664062 C-0.19897397 15.37116099 -0.09754807 7.68561543 0 0 Z " fill="#DDE8FE" transform="translate(851,549)"/>
+<path d="M0 0 C0.66 0 1.32 0 2 0 C2 0.66 2 1.32 2 2 C5.96 2.33 9.92 2.66 14 3 C14.33 3.99 14.66 4.98 15 6 C15.60328125 6.04898437 16.2065625 6.09796875 16.828125 6.1484375 C18.02695312 6.26058594 18.02695312 6.26058594 19.25 6.375 C20.03890625 6.44460938 20.8278125 6.51421875 21.640625 6.5859375 C24 7 24 7 25.796875 8.0078125 C29.08514171 9.48869857 32.45045494 9.3906843 36 9.5 C40.47092139 9.63769142 44.00312727 9.86943561 48 12 C50.0742625 12.28480806 52.16071439 12.48874224 54.25 12.625 C55.32765625 12.69976562 56.4053125 12.77453125 57.515625 12.8515625 C58.74539063 12.92503906 58.74539063 12.92503906 60 13 C60 13.33 60 13.66 60 14 C54.06 14 48.12 14 42 14 C41.505 13.01 41.505 13.01 41 12 C38.51723744 11.7392803 36.11443931 11.57866258 33.625 11.5 C26.40387463 11.26924975 26.40387463 11.26924975 23 9 C20.49103314 8.54398739 20.49103314 8.54398739 17.8125 8.375 C16.91144531 8.30023438 16.01039063 8.22546875 15.08203125 8.1484375 C14.39496094 8.09945313 13.70789063 8.05046875 13 8 C13 7.34 13 6.68 13 6 C12.34 6 11.68 6 11 6 C11 5.34 11 4.68 11 4 C8.03 4 5.06 4 2 4 C1.34 2.68 0.68 1.36 0 0 Z " fill="#374E74" transform="translate(483,354)"/>
+<path d="M0 0 C0.76183594 0.41572266 0.76183594 0.41572266 1.5390625 0.83984375 C5.77733382 3.07009514 9.25351746 4.20891958 14 5 C14.99 6.485 14.99 6.485 16 8 C17.99541868 8.68025637 19.99617991 9.34490497 22 10 C24.0065438 11.32346506 26.00628175 12.65729179 28 14 C29.21796233 14.54652156 30.44766186 15.06760663 31.6875 15.5625 C34.56574436 16.81154944 36.06867658 17.61424754 38 20 C33.04378488 19.50437849 29.29718625 18.55784896 25 16 C24.67 15.34 24.34 14.68 24 14 C21.19194065 12.90254643 18.34122354 12.01196162 15.46875 11.09765625 C14.6540625 10.73542969 13.839375 10.37320312 13 10 C12.67 9.01 12.34 8.02 12 7 C11.21625 7.04125 10.4325 7.0825 9.625 7.125 C7 7 7 7 5 5 C3.35008418 4.29289322 1.68437744 3.62056011 0 3 C0 2.01 0 1.02 0 0 Z " fill="#5A677B" transform="translate(393,1104)"/>
+<path d="M0 0 C3.35688001 2.9237342 4.2267197 4.69172404 5 9 C5.495 9.474375 5.99 9.94875 6.5 10.4375 C8.67409173 12.70217889 8.66189749 14.95707737 9 18 C9.66 18 10.32 18 11 18 C11.1546875 19.175625 11.1546875 19.175625 11.3125 20.375 C11.77595022 23.33045181 11.77595022 23.33045181 15 25 C15.6875 28.625 15.6875 28.625 16 32 C16.66 32 17.32 32 18 32 C18.12375 33.11375 18.2475 34.2275 18.375 35.375 C18.6465813 39.03103677 18.6465813 39.03103677 21 41 C20.625 43.125 20.625 43.125 20 45 C19.67 44.01 19.34 43.02 19 42 C18.34 41.67 17.68 41.34 17 41 C16.31526605 38.67190457 15.65146849 36.33762223 15 34 C13.55947451 30.81883953 12.46743518 28.46743518 10 26 C9.31875294 24.00491933 8.65572791 22.00361307 8 20 C6.19095597 15.55815083 4.23444709 11.29300476 1.75 7.1875 C0 4 0 4 0 0 Z " fill="#B6BBC5" transform="translate(382,831)"/>
+<path d="M0 0 C2.4375 0.375 2.4375 0.375 5 1 C5.33 1.66 5.66 2.32 6 3 C7.98536627 3.70905938 9.98910922 4.36694179 12 5 C15.7340472 6.54512298 19.41389802 8.13522697 23 10 C23 10.66 23 11.32 23 12 C23.78375 12.268125 24.5675 12.53625 25.375 12.8125 C28 14 28 14 30 17 C30.99 17.66 31.98 18.32 33 19 C30.69 18.67 28.38 18.34 26 18 C26 17.34 26 16.68 26 16 C25.0925 15.938125 24.185 15.87625 23.25 15.8125 C19.16896164 14.79224041 18.54576934 13.24007007 16 10 C14.3549303 9.25810582 12.70474104 8.52197326 11.015625 7.88671875 C7.05280362 6.14338454 3.44447033 3.60873717 0 1 C0 0.67 0 0.34 0 0 Z " fill="#B6CDFE" transform="translate(682,641)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-6.51243944 10.76710739 -6.51243944 10.76710739 -10.6875 13.875 C-14.79870047 17.17540688 -16.54385888 21.65523185 -18.640625 26.390625 C-20 29 -20 29 -23 31 C-19.4028777 19.99280576 -19.4028777 19.99280576 -18 17 C-17.34 16.67 -16.68 16.34 -16 16 C-15.62875 15.29875 -15.2575 14.5975 -14.875 13.875 C-11.1697744 8.19365407 -5.30382278 4.14361155 0 0 Z " fill="#415E93" transform="translate(622,545)"/>
+<path d="M0 0 C-8.10756191 5.71928786 -16.73078471 10.93132347 -25.9375 14.6875 C-29.31808517 16.13632222 -32.00478712 17.88143479 -35 20 C-35 19.01 -35 18.02 -35 17 C-34.01 16.67 -33.02 16.34 -32 16 C-31.67 15.01 -31.34 14.02 -31 13 C-29.02 13 -27.04 13 -25 13 C-24.67 11.68 -24.34 10.36 -24 9 C-23.360625 8.87625 -22.72125 8.7525 -22.0625 8.625 C-21.381875 8.41875 -20.70125 8.2125 -20 8 C-19.67 7.34 -19.34 6.68 -19 6 C-17.33333333 5.66666667 -15.66666667 5.33333333 -14 5 C-13.67 4.34 -13.34 3.68 -13 3 C-10.5 2.5 -10.5 2.5 -8 2 C-7.67 1.34 -7.34 0.68 -7 0 C-2.52459016 -1.26229508 -2.52459016 -1.26229508 0 0 Z " fill="#9ABBFD" transform="translate(722,810)"/>
+<path d="M0 0 C1.27445454 0.42683632 2.54445882 0.86697202 3.8125 1.3125 C4.52019531 1.55613281 5.22789062 1.79976562 5.95703125 2.05078125 C8 3 8 3 9.4609375 4.48046875 C11.40867898 6.40349269 13.25268676 7.05629005 15.8125 8 C26.5579792 12.11595841 26.5579792 12.11595841 28 15 C29.6635479 15.67441131 31.33066942 16.3400321 33 17 C34.36365283 17.95824253 35.70794169 18.94721175 37 20 C32.82851735 20.19402245 29.71055417 20.01430083 26 18 C25.67 17.01 25.34 16.02 25 15 C24.030625 14.87625 23.06125 14.7525 22.0625 14.625 C21.051875 14.41875 20.04125 14.2125 19 14 C18.67 13.34 18.34 12.68 18 12 C17.113125 11.71125 16.22625 11.4225 15.3125 11.125 C11.67796784 9.89063059 9.01447426 8.36851549 6 6 C6 5.01 6 4.02 6 3 C4.35 3 2.7 3 1 3 C0.67 2.01 0.34 1.02 0 0 Z " fill="#8FB3FD" transform="translate(712,887)"/>
+<path d="M0 0 C3.55780196 0.60990891 6.6828589 1.5783681 10 3 C10 3.66 10 4.32 10 5 C10.94875 5.268125 11.8975 5.53625 12.875 5.8125 C16 7 16 7 18 10 C18 11.32 18 12.64 18 14 C17.360625 14.103125 16.72125 14.20625 16.0625 14.3125 C15.381875 14.539375 14.70125 14.76625 14 15 C13.67 15.99 13.34 16.98 13 18 C11.15234375 18.73046875 11.15234375 18.73046875 8.9375 19.1875 C8.20402344 19.34605469 7.47054687 19.50460937 6.71484375 19.66796875 C6.14894531 19.77753906 5.58304688 19.88710938 5 20 C6.2499227 16.2502319 7.76053962 15.18475235 11 13 C12.32 13 13.64 13 15 13 C13.94768703 10.03323813 13.18219261 9.10395374 10.3984375 7.515625 C9.40070312 7.09796875 8.40296875 6.6803125 7.375 6.25 C6.37210938 5.82203125 5.36921875 5.3940625 4.3359375 4.953125 C3.56507813 4.63859375 2.79421875 4.3240625 2 4 C2 3.01 2 2.02 2 1 C1.34 0.67 0.68 0.34 0 0 Z " fill="#B3CCFE" transform="translate(930,666)"/>
+<path d="M0 0 C2.31 0 4.62 0 7 0 C7 0.66 7 1.32 7 2 C27.79 2.33 48.58 2.66 70 3 C70 3.33 70 3.66 70 4 C62.18475934 4.0232496 54.3695269 4.0409791 46.55426025 4.05181217 C42.92467012 4.05701352 39.29510379 4.06406083 35.66552734 4.07543945 C32.15772266 4.08636654 28.64994076 4.0922975 25.14212036 4.09487724 C23.16366829 4.09760298 21.18522529 4.10539921 19.20678711 4.11329651 C13.04011637 4.11367808 7.09445611 3.9656238 1 3 C0.67 2.01 0.34 1.02 0 0 Z " fill="#344868" transform="translate(543,368)"/>
+<path d="M0 0 C1.32 0 2.64 0 4 0 C4.33 0.66 4.66 1.32 5 2 C7.52733235 2.65555119 7.52733235 2.65555119 10 3 C10.33 3.99 10.66 4.98 11 6 C13.72435637 7.07585059 13.72435637 7.07585059 17 8 C28.27472527 12.54945055 28.27472527 12.54945055 30 16 C33.43814849 17.61795223 36.75026404 18.92137942 40.375 20.0625 C43 21 43 21 44 23 C46.01669827 24.13350534 46.01669827 24.13350534 48 25 C47.01 25.495 47.01 25.495 46 26 C43.5 24.5 43.5 24.5 41 23 C39.9275 22.731875 38.855 22.46375 37.75 22.1875 C33.63866544 20.88557739 30.83391531 19.03045115 27.328125 16.5859375 C22.50001654 13.29699114 17.43516581 10.5157898 12 8.375 C10.515 7.694375 10.515 7.694375 9 7 C8.67 6.01 8.34 5.02 8 4 C7.236875 3.896875 6.47375 3.79375 5.6875 3.6875 C2.82940576 2.95635961 1.84257115 2.23048087 0 0 Z " fill="#D1D5DA" transform="translate(244,366)"/>
+<path d="M0 0 C2.97 0 5.94 0 9 0 C2.89117129 4.97756413 -4.16533325 6.11594665 -11.734375 7.5 C-13.07242187 7.7475 -13.07242187 7.7475 -14.4375 8 C-15.26121094 8.144375 -16.08492188 8.28875 -16.93359375 8.4375 C-19.20246378 8.87142674 -19.20246378 8.87142674 -21 11 C-24.125 11.125 -24.125 11.125 -27 11 C-23.66792554 8.10254394 -19.94905151 6.56604794 -15.92578125 4.8671875 C-14.03398699 4.15212622 -14.03398699 4.15212622 -13 3 C-9.89850354 2.71599669 -6.79707354 2.5512529 -3.6875 2.37890625 C-2.3571875 2.19134766 -2.3571875 2.19134766 -1 2 C-0.67 1.34 -0.34 0.68 0 0 Z " fill="#3A537D" transform="translate(513,208)"/>
+<path d="M0 0 C3.67230705 3.07999946 4.56802365 5.2482602 5 10 C5.66 10 6.32 10 7 10 C10.1888944 21.31154996 12.2531791 31.5181914 9 43 C8.67 43 8.34 43 8 43 C8.01160156 42.11957031 8.02320313 41.23914063 8.03515625 40.33203125 C8.04417969 39.17058594 8.05320312 38.00914062 8.0625 36.8125 C8.07410156 35.66394531 8.08570313 34.51539063 8.09765625 33.33203125 C8.01132816 30.38651674 7.58872787 27.87004836 7 25 C6.93466565 23.06348981 6.91415697 21.12497139 6.9375 19.1875 C6.94652344 18.21167969 6.95554687 17.23585938 6.96484375 16.23046875 C6.97644531 15.49441406 6.98804688 14.75835937 7 14 C5.68 13.67 4.36 13.34 3 13 C1.70074209 8.66914029 0.656379 4.48525648 0 0 Z " fill="#838D9C" transform="translate(780,254)"/>
+<path d="M0 0 C2.22694714 1.07223381 4.25980644 2.17554489 6.3125 3.5625 C9.53485115 5.28608317 12.40228671 5.52483032 16 6 C16.66 6.66 17.32 7.32 18 8 C20.5186429 8.14592369 22.92372043 8.18648473 25.4375 8.125 C26.4594043 8.11146484 26.4594043 8.11146484 27.50195312 8.09765625 C29.3347522 8.07252482 31.16739758 8.03677463 33 8 C33.99 8 34.98 8 36 8 C35.02734375 9.48046875 35.02734375 9.48046875 33 11 C30.10161608 11.27199768 27.45331453 11.37318041 24.5625 11.3125 C23.4168457 11.31733398 23.4168457 11.31733398 22.24804688 11.32226562 C18.2696957 11.28417871 15.47965985 11.08779591 12 9 C9.67504723 8.61250787 7.34148732 8.27017161 5 8 C5 6.68 5 5.36 5 4 C4.360625 3.71125 3.72125 3.4225 3.0625 3.125 C1 2 1 2 0 0 Z " fill="#BBC0C9" transform="translate(394,979)"/>
+<path d="M0 0 C0.77730469 0.00580078 1.55460937 0.01160156 2.35546875 0.01757812 C9.21376627 0.16166001 15.46601419 1.27648102 21.125 5.4375 C21.62 6.9225 21.62 6.9225 22.125 8.4375 C17.375 7.6875 17.375 7.6875 15.125 5.4375 C12.80293475 4.73258733 10.46906932 4.06537571 8.125 3.4375 C7.465 3.1075 6.805 2.7775 6.125 2.4375 C-1.95139906 1.51949781 -1.95139906 1.51949781 -8.9375 4.875 C-9.576875 5.720625 -10.21625 6.56625 -10.875 7.4375 C-11.865 7.7675 -12.855 8.0975 -13.875 8.4375 C-13.875 9.7575 -13.875 11.0775 -13.875 12.4375 C-15.855 13.4275 -15.855 13.4275 -17.875 14.4375 C-17.22438905 12.76450041 -16.55466676 11.09890763 -15.875 9.4375 C-15.606875 8.7775 -15.33875 8.1175 -15.0625 7.4375 C-11.04415727 0.66976488 -7.3627616 -0.30829297 0 0 Z " fill="#838C9D" transform="translate(176.875,493.5625)"/>
+<path d="M0 0 C0.33 0 0.66 0 1 0 C1 3.3 1 6.6 1 10 C1.66 10 2.32 10 3 10 C3.12117187 11.10859375 3.24234375 12.2171875 3.3671875 13.359375 C3.53606296 14.82296234 3.70535572 16.28650157 3.875 17.75 C3.95363281 18.47960937 4.03226563 19.20921875 4.11328125 19.9609375 C4.55724849 23.71758337 5.13613526 26.7071723 7 30 C7.125 32.75 7.125 32.75 7 35 C7.99 35.33 8.98 35.66 10 36 C10 36.99 10 37.98 10 39 C10.61875 39.226875 11.2375 39.45375 11.875 39.6875 C14.61410209 41.37929835 15.05024472 42.99244161 16 46 C15.01 45.67 14.02 45.34 13 45 C13 44.34 13 43.68 13 43 C12.01 43 11.02 43 10 43 C7.41546434 38.69244057 5.52885689 34.80497881 4 30 C3.34 29.01 2.68 28.02 2 27 C0.20453315 18.05591515 -0.30525016 9.10662964 0 0 Z " fill="#C5C9D1" transform="translate(155,827)"/>
+<path d="M0 0 C0.598125 0.309375 1.19625 0.61875 1.8125 0.9375 C4.08956772 2.10209704 4.08956772 2.10209704 7 3 C7.99 4.485 7.99 4.485 9 6 C12.64523703 8.65108148 16.48600058 9.90577833 20.734375 11.2421875 C23 12 23 12 26.625 13.625 C29.97731811 15.17654903 29.97731811 15.17654903 33.75 15.375 C37 16 37 16 38.9375 18.5625 C39.288125 19.366875 39.63875 20.17125 40 21 C32.54583092 19.83528608 26.00543694 16.59898116 19.37109375 13.17578125 C16.85487157 11.87810752 16.85487157 11.87810752 13.5 10.6875 C8.41693696 8.23673746 4.19103412 4.76096824 0 1 C0 0.67 0 0.34 0 0 Z " fill="#4E73BA" transform="translate(441,332)"/>
+<path d="M0 0 C0.53625 0.268125 1.0725 0.53625 1.625 0.8125 C0.5525 1.410625 -0.52 2.00875 -1.625 2.625 C-3.67929887 3.79418012 -5.55010033 4.94515177 -7.4375 6.375 C-13.02899436 10.52352807 -19.58550123 12.61435316 -26.375 13.8125 C-26.705 14.8025 -27.035 15.7925 -27.375 16.8125 C-29.02927588 17.50934542 -30.69880914 18.17015553 -32.375 18.8125 C-34.30371064 20.14098948 -36.1990418 21.51893291 -38.0625 22.9375 C-43.15791815 26.8125 -43.15791815 26.8125 -45.375 26.8125 C-45.375 25.8225 -45.375 24.8325 -45.375 23.8125 C-44.570625 23.52375 -43.76625 23.235 -42.9375 22.9375 C-40.2423532 22.07987432 -40.2423532 22.07987432 -39.375 19.8125 C-37.71427151 19.13117549 -36.047233 18.46507873 -34.375 17.8125 C-33.715 17.1525 -33.055 16.4925 -32.375 15.8125 C-31.694375 15.6475 -31.01375 15.4825 -30.3125 15.3125 C-29.673125 15.1475 -29.03375 14.9825 -28.375 14.8125 C-28.045 14.1525 -27.715 13.4925 -27.375 12.8125 C-22.39207962 9.92020552 -17.14280895 7.05903 -11.5 5.75 C-8.45723314 4.83716994 -7.44778367 4.17776383 -5.1875 2.125 C-2.375 -0.1875 -2.375 -0.1875 0 0 Z " fill="#C3D7FE" transform="translate(1018.375,645.1875)"/>
+<path d="M0 0 C1.65 0 3.3 0 5 0 C5 0.66 5 1.32 5 2 C6.2684375 2.37125 6.2684375 2.37125 7.5625 2.75 C10.21839003 3.71577819 12.18873034 4.63095031 14.5625 6.0625 C17.73768046 8.10966373 17.73768046 8.10966373 20.625 8.4375 C24.05022542 9.2487376 25.53689622 11.53689622 28 14 C29.79121666 14.91876453 29.79121666 14.91876453 31.6875 15.625 C35 17 35 17 37 20 C32.76677156 19.37954537 29.47709705 17.89476441 25.6875 15.9375 C24.08455078 15.11572266 24.08455078 15.11572266 22.44921875 14.27734375 C21.64097656 13.85582031 20.83273437 13.43429687 20 13 C20 12.34 20 11.68 20 11 C19.2575 10.87625 18.515 10.7525 17.75 10.625 C13.36332389 9.62802816 11.53339359 8.80009038 9 5 C5.94570927 3.78715124 5.94570927 3.78715124 3 3 C3 2.34 3 1.68 3 1 C2.01 0.67 1.02 0.34 0 0 Z " fill="#9DBDFD" transform="translate(863,618)"/>
+<path d="M0 0 C7.85640296 7.85640296 10.49958821 15.22899536 13 26 C13.33 26.99 13.66 27.98 14 29 C14.08239169 30.84610532 14.10743359 32.69505164 14.09765625 34.54296875 C14.09443359 35.61611328 14.09121094 36.68925781 14.08789062 37.79492188 C14.07951172 38.91447266 14.07113281 40.03402344 14.0625 41.1875 C14.05798828 42.31865234 14.05347656 43.44980469 14.04882812 44.61523438 C14.03703498 47.41020927 14.0205765 50.2050782 14 53 C13.67 53 13.34 53 13 53 C12.98541748 52.35039307 12.97083496 51.70078613 12.95581055 51.03149414 C12.88058338 48.0412806 12.78417388 45.05209403 12.6875 42.0625 C12.66494141 41.04091797 12.64238281 40.01933594 12.61914062 38.96679688 C12.39040407 32.45820219 11.40080867 27.04579688 9 21 C8.67 20.01 8.34 19.02 8 18 C7.34 17.67 6.68 17.34 6 17 C5.896875 15.989375 5.79375 14.97875 5.6875 13.9375 C4.93205441 9.6108571 3.51591224 7.24249102 1.05859375 3.69921875 C0 2 0 2 0 0 Z " fill="#B7BDC5" transform="translate(547,568)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C1.01 2.485 1.01 2.485 0 4 C-1.32 4 -2.64 4 -4 4 C-5.20628008 6.33214148 -6.1654738 8.49642139 -7 11 C-4.69 11 -2.38 11 0 11 C0.33 11.66 0.66 12.32 1 13 C2.155 13.165 3.31 13.33 4.5 13.5 C5.655 13.665 6.81 13.83 8 14 C8.33 14.66 8.66 15.32 9 16 C10.69029165 16.69600244 12.38137358 17.39020966 14.078125 18.0703125 C17.17078282 19.56635429 19.45811506 21.70610383 22 24 C18.45424969 24 16.26856076 23.04539473 13 21.6875 C11.948125 21.25824219 10.89625 20.82898438 9.8125 20.38671875 C7.24652075 19.12154843 5.88146925 18.07890738 4 16 C0.15195881 14.18286944 -3.90397069 13.1244002 -8 12 C-8.24862931 9.01644824 -8.18991433 7.35134151 -6.75 4.6875 C-5 3 -5 3 -1 3 C-0.67 2.01 -0.34 1.02 0 0 Z " fill="#818B9A" transform="translate(750,349)"/>
+<path d="M0 0 C1.32 0.33 2.64 0.66 4 1 C0.375 4 0.375 4 -3 4 C-3.04125 4.61875 -3.0825 5.2375 -3.125 5.875 C-3.558125 6.926875 -3.558125 6.926875 -4 8 C-5.98536627 8.70905938 -7.98910922 9.36694179 -10 10 C-11.17069806 10.81975654 -12.31609101 11.67651095 -13.4375 12.5625 C-17.69070838 15.76890986 -21.76699901 16 -27 16 C-26.236875 15.566875 -25.47375 15.13375 -24.6875 14.6875 C-22.05841181 13.20105936 -22.05841181 13.20105936 -20.5625 11.4375 C-18.32693316 9.3807785 -15.88105497 8.90386038 -13 8 C-8.73329705 6.33618316 -8.73329705 6.33618316 -6 3 C-3.5 2.5 -3.5 2.5 -1 2 C-0.67 1.34 -0.34 0.68 0 0 Z " fill="#D3D7DC" transform="translate(177,243)"/>
+<path d="M0 0 C1.32 0.33 2.64 0.66 4 1 C3.01 1 2.02 1 1 1 C1 1.99 1 2.98 1 4 C0.34 4.20625 -0.32 4.4125 -1 4.625 C-3.73337197 5.87779549 -5.59696157 7.15811755 -7.9375 9 C-11.2118006 11.54940853 -14.04795844 12.7112908 -18 14 C-19.42120298 15.1951025 -20.84051832 16.3932002 -22.2265625 17.62890625 C-26.77447866 21.14502645 -32.37521475 23.80764921 -38 25 C-35.63707344 22.47411298 -34.33537489 21.11179163 -31 20 C-30.67 19.34 -30.34 18.68 -30 18 C-28.00934459 16.98152514 -26.00751815 15.98482022 -24 15 C-22.96875 14.29875 -21.9375 13.5975 -20.875 12.875 C-18.33096808 11.21584875 -16.83186758 10.70796689 -14 10 C-13.34 9.01 -12.68 8.02 -12 7 C-10.01276732 6.29618843 -8.01222047 5.6288189 -6 5 C-5.34 4.34 -4.68 3.68 -4 3 C-2.68 3 -1.36 3 0 3 C0 2.01 0 1.02 0 0 Z " fill="#6A7688" transform="translate(467,84)"/>
+<path d="M0 0 C0.99 1.051875 0.99 1.051875 2 2.125 C4.13622066 4.26723818 6.37407771 6.08586175 8.8125 7.875 C20.48850756 16.46552267 20.48850756 16.46552267 22 21 C22.99 21.33 23.98 21.66 25 22 C25 22.99 25 23.98 25 25 C24.34 25 23.68 25 23 25 C23 24.34 23 23.68 23 23 C22.43667969 22.75507812 21.87335938 22.51015625 21.29296875 22.2578125 C18.58043513 20.76984687 16.58442137 18.97497241 14.3125 16.875 C11.69189512 14.45687871 9.07698726 12.06474186 6.34765625 9.76953125 C5.53167969 9.08246094 4.71570312 8.39539063 3.875 7.6875 C2.75738281 6.76517578 2.75738281 6.76517578 1.6171875 5.82421875 C0 4 0 4 0 0 Z " fill="#8892A0" transform="translate(59,909)"/>
+<path d="M0 0 C1.98 0.99 1.98 0.99 4 2 C4 3.98 4 5.96 4 8 C4.66 8 5.32 8 6 8 C8.61407872 13.36190101 10.49228528 18.03435204 11 24 C11.99 24.33 12.98 24.66 14 25 C14 26.98 14 28.96 14 31 C14.66 31 15.32 31 16 31 C15.505 32.485 15.505 32.485 15 34 C11.26614372 29.19932765 8.91993674 24.75981022 7 19 C6.36817113 17.76357626 5.72108838 16.53487995 5.0625 15.3125 C2.54078608 10.44851997 1.28631248 5.30116659 0 0 Z " fill="#677287" transform="translate(318,831)"/>
+<path d="M0 0 C0.83917969 0.42345703 0.83917969 0.42345703 1.6953125 0.85546875 C3.24442257 1.62477256 4.80202334 2.37718919 6.3671875 3.11328125 C10.31334411 5.0003063 13.97279025 6.75708493 17.25 9.6875 C20.18546432 12.15595864 22.35691809 12.93743444 26 14 C30.09948424 15.76840497 32.62359622 17.17134946 35 21 C30.85023295 20.38974014 27.70503342 18.92970491 24 17 C23.071875 16.649375 22.14375 16.29875 21.1875 15.9375 C19 15 19 15 18 13 C17.360625 12.690625 16.72125 12.38125 16.0625 12.0625 C14 11 14 11 12 8 C11.0925 7.71125 10.185 7.4225 9.25 7.125 C5.21459826 5.72813017 3.11467721 3.89220026 0 1 C0 0.67 0 0.34 0 0 Z " fill="#A1BFFD" transform="translate(964,793)"/>
+<path d="M0 0 C2.81092815 2.34244013 3.92636884 3.73983655 4.9375 7.3125 C6.04213985 11.14625008 7.4526828 13.14248035 9.83203125 16.2265625 C11.07093042 18.10770037 11.63296877 19.70123759 12.1875 21.875 C12.455625 22.90625 12.72375 23.9375 13 25 C13.66 25.33 14.32 25.66 15 26 C16 28.36328125 16 28.36328125 17 31.3125 C18.14963771 34.67608847 19.32896192 37.85934361 21 41 C18.5 39.75 18.5 39.75 16 38 C16 36.68 16 35.36 16 34 C15.01 33.67 14.02 33.34 13 33 C12.87625 32.030625 12.7525 31.06125 12.625 30.0625 C12.41875 29.051875 12.2125 28.04125 12 27 C11.34 26.67 10.68 26.34 10 26 C9.855625 24.88625 9.71125 23.7725 9.5625 22.625 C8.98104569 18.87785 8.6792744 18.32980383 6 16 C6 15.01 6 14.02 6 13 C5.01 12.67 4.02 12.34 3 12 C2.87625 10.865625 2.7525 9.73125 2.625 8.5625 C2.41875 7.386875 2.2125 6.21125 2 5 C1.34 4.67 0.68 4.34 0 4 C0 2.68 0 1.36 0 0 Z " fill="#717B8E" transform="translate(337,740)"/>
+<path d="M0 0 C2.125 0.375 2.125 0.375 4 1 C3.01 1 2.02 1 1 1 C0.93425781 1.61746094 0.86851562 2.23492188 0.80078125 2.87109375 C0 5 0 5 -2.14453125 6.16015625 C-3.02496094 6.45792969 -3.90539062 6.75570312 -4.8125 7.0625 C-8.42458904 8.3056562 -10.99776446 9.65301428 -14 12 C-16.33422691 13.32207474 -18.6995167 14.56881319 -21.07421875 15.81640625 C-23.14902259 16.85817541 -23.14902259 16.85817541 -24 19 C-25.98 19 -27.96 19 -30 19 C-28.625 17.5 -28.625 17.5 -27 16 C-26.34 16 -25.68 16 -25 16 C-25 15.34 -25 14.68 -25 14 C-23.35 13.67 -21.7 13.34 -20 13 C-20 12.34 -20 11.68 -20 11 C-16.95933818 9.4751172 -13.91543896 7.95866606 -10.859375 6.46484375 C-9.32023438 5.70880859 -9.32023438 5.70880859 -7.75 4.9375 C-6.71359375 4.43089844 -5.6771875 3.92429687 -4.609375 3.40234375 C-1.93387651 2.12595497 -1.93387651 2.12595497 0 0 Z " fill="#BAD0FE" transform="translate(1001,645)"/>
+<path d="M0 0 C0.89203125 0.36222656 1.7840625 0.72445312 2.703125 1.09765625 C3.71632813 1.51337891 3.71632813 1.51337891 4.75 1.9375 C4.75 2.9275 4.75 3.9175 4.75 4.9375 C-2.125 2.0625 -2.125 2.0625 -3.25 0.9375 C-4.89230364 0.8129514 -6.54052276 0.76181476 -8.1875 0.75 C-9.08339844 0.73582031 -9.97929688 0.72164062 -10.90234375 0.70703125 C-13.44114534 0.70555231 -13.44114534 0.70555231 -15.25 2.9375 C-16.90829673 3.62472207 -18.57704372 4.2867777 -20.25 4.9375 C-22.69864291 6.12814925 -25.13419911 7.3320942 -27.5625 8.5625 C-28.20767578 8.88734375 -28.85285156 9.2121875 -29.51757812 9.546875 C-31.09597541 10.34191956 -32.67311694 11.13945634 -34.25 11.9375 C-33.25 8.9375 -33.25 8.9375 -31.25390625 7.875 C-30.44824219 7.565625 -29.64257812 7.25625 -28.8125 6.9375 C-25.27469848 5.57462301 -24.44275781 5.22663671 -22.25 1.9375 C-20.125 0.9375 -20.125 0.9375 -17.25 -0.0625 C-16.60160156 -0.33449219 -15.95320312 -0.60648438 -15.28515625 -0.88671875 C-14.24681641 -1.31404297 -14.24681641 -1.31404297 -13.1875 -1.75 C-12.53652344 -2.02199219 -11.88554688 -2.29398438 -11.21484375 -2.57421875 C-7.23446584 -3.56337827 -3.6635114 -1.49432702 0 0 Z " fill="#A4C1FD" transform="translate(862.25,515.0625)"/>
+<path d="M0 0 C4.455 0.99 4.455 0.99 9 2 C9.33 3.32 9.66 4.64 10 6 C11.0828125 5.9071875 11.0828125 5.9071875 12.1875 5.8125 C16.1522233 6.07681489 18.75592293 7.64774232 21.4375 10.5625 C23.02792662 12.22263721 23.02792662 12.22263721 25.8125 12.9375 C29.38346521 14.12782174 31.92812413 15.84315098 35 18 C36.66026356 19.01059521 38.32470102 20.01453001 40 21 C39.01 21.495 39.01 21.495 38 22 C36.05246221 21.09338758 34.10992518 20.172307 32.2109375 19.16796875 C30.1653057 18.0873258 28.09453047 17.10603502 26 16.125 C23.01500208 14.65005985 20.49509102 12.9272386 17.875 10.875 C14.66857404 8.37972688 11.92772826 7.14558741 8 6 C5.29446797 4.74069782 2.64436126 3.38258482 0 2 C0 1.34 0 0.68 0 0 Z " fill="#758091" transform="translate(167,360)"/>
+<path d="M0 0 C2.48046784 0.00502644 4.96093668 0.00958732 7.44140625 0.01367188 C13.46095943 0.02458356 19.48047497 0.04123045 25.5 0.0625 C25.5 0.3925 25.5 0.7225 25.5 1.0625 C4.71 1.3925 -16.08 1.7225 -37.5 2.0625 C-37.5 2.7225 -37.5 3.3825 -37.5 4.0625 C-39.48 4.0625 -41.46 4.0625 -43.5 4.0625 C-43.5 3.0725 -43.5 2.0825 -43.5 1.0625 C-29.00836995 -0.17632767 -14.53342739 -0.05153698 0 0 Z " fill="#F5F5F7" transform="translate(587.5,175.9375)"/>
+<path d="M0 0 C0 0.99 0 1.98 0 3 C-3.79792585 5.98408459 -7.40149902 7.63023375 -12 9 C-15.76756732 10.10666307 -15.76756732 10.10666307 -18 13 C-20.33247761 13.33926947 -22.66585471 13.67240066 -25 14 C-25.66 14.66 -26.32 15.32 -27 16 C-29.125 15.625 -29.125 15.625 -31 15 C-29.25048432 14.04078278 -27.50036756 13.08266183 -25.75 12.125 C-24.28820312 11.32449219 -24.28820312 11.32449219 -22.796875 10.5078125 C-21.12178079 9.60475892 -19.42804982 8.733479 -17.703125 7.9296875 C-15.81751006 7.11068735 -15.81751006 7.11068735 -15 5 C-12.66752239 4.66073053 -10.33414529 4.32759934 -8 4 C-7.34 3.34 -6.68 2.68 -6 2 C-4.01643517 1.28591666 -2.01684563 0.61382258 0 0 Z " fill="#3B537D" transform="translate(685,1142)"/>
+<path d="M0 0 C1.65 0 3.3 0 5 0 C5.33 0.99 5.66 1.98 6 3 C8.97503122 4.15835673 8.97503122 4.15835673 12 5 C12.33 5.33 12.66 5.66 13 6 C14.48638992 6.15655027 15.97949127 6.25066943 17.47265625 6.31640625 C18.82133789 6.37924805 18.82133789 6.37924805 20.19726562 6.44335938 C21.61555664 6.50233398 21.61555664 6.50233398 23.0625 6.5625 C24.01189453 6.60568359 24.96128906 6.64886719 25.93945312 6.69335938 C28.29281353 6.79979276 30.64628354 6.90181008 33 7 C32.67 7.66 32.34 8.32 32 9 C25.34513073 11.21828976 17.39715649 10.88259695 10.95703125 8.0625 C7.12957846 5.98452164 3.44687301 3.66494349 0 1 C0 0.67 0 0.34 0 0 Z " fill="#606C81" transform="translate(180,881)"/>
+<path d="M0 0 C1.98 0 3.96 0 6 0 C2.57653445 3.14958831 -0.44262737 3.56179109 -5 4 C-5.33 4.99 -5.66 5.98 -6 7 C-9.53031657 9.56750296 -13.25970036 11.75582021 -17 14 C-17.33 14.33 -17.66 14.66 -18 15 C-19.485 15.12375 -19.485 15.12375 -21 15.25 C-25.2986835 15.76619802 -28.45447712 17.77886526 -32.08203125 20.0390625 C-32.71496094 20.35617187 -33.34789062 20.67328125 -34 21 C-34.66 20.67 -35.32 20.34 -36 20 C-33.48195773 16.2229366 -31.15552262 16.0369168 -27 15 C-20.2848042 13.37790573 -20.2848042 13.37790573 -15.3125 8.875 C-13 6 -13 6 -9.75 5.25 C-8.8425 5.1675 -7.935 5.085 -7 5 C-6.67 4.34 -6.34 3.68 -6 3 C-4.33333333 2.66666667 -2.66666667 2.33333333 -1 2 C-0.67 1.34 -0.34 0.68 0 0 Z " fill="#919AA7" transform="translate(929,356)"/>
+<path d="M0 0 C7.75 1.625 7.75 1.625 10 5 C11.97583715 5.73519522 13.98177598 6.39072482 16 7 C20.7909473 8.88215787 24.90981712 10.9074227 29 14 C29 14.66 29 15.32 29 16 C30.32 16 31.64 16 33 16 C33.66 17.32 34.32 18.64 35 20 C26.06369427 18.0955414 26.06369427 18.0955414 24 15 C24 14.34 24 13.68 24 13 C23.2265625 12.8453125 23.2265625 12.8453125 22.4375 12.6875 C16.65396185 11.05624565 11.93235293 8.35819774 7 5 C5.906875 4.46375 4.81375 3.9275 3.6875 3.375 C1 2 1 2 0 0 Z " fill="#AFB5BF" transform="translate(183,986)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C0 4 0 4 -3.125 4.6875 C-4.07375 4.790625 -5.0225 4.89375 -6 5 C-6 5.66 -6 6.32 -6 7 C-6.50789062 7.24234375 -7.01578125 7.4846875 -7.5390625 7.734375 C-10.95096694 9.39560188 -14.20717891 11.05984911 -17.3125 13.25 C-20 15 -20 15 -23 15 C-23.33 15.99 -23.66 16.98 -24 18 C-26.9375 19.75 -26.9375 19.75 -30 21 C-30.66 20.67 -31.32 20.34 -32 20 C-31.34 19.34 -30.68 18.68 -30 18 C-29.01 18 -28.02 18 -27 18 C-26.67 17.01 -26.34 16.02 -26 15 C-22.9375 13.8125 -22.9375 13.8125 -20 13 C-20 12.01 -20 11.02 -20 10 C-18.02 9.67 -16.04 9.34 -14 9 C-14 8.34 -14 7.68 -14 7 C-13.195625 6.71125 -12.39125 6.4225 -11.5625 6.125 C-8.8673532 5.26737432 -8.8673532 5.26737432 -8 3 C-5.67793475 2.29508733 -3.34406932 1.62787571 -1 1 C-0.67 0.67 -0.34 0.34 0 0 Z " fill="#91B5FD" transform="translate(949,796)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-0.46995218 3.77765666 -3.18000819 5.36586602 -6.4375 7.125 C-7.85869141 7.90230469 -7.85869141 7.90230469 -9.30859375 8.6953125 C-12 10 -12 10 -14.28515625 10.4921875 C-14.85105469 10.65976562 -15.41695312 10.82734375 -16 11 C-16.33 11.99 -16.66 12.98 -17 14 C-18.65 14.33 -20.3 14.66 -22 15 C-22.33 15.99 -22.66 16.98 -23 18 C-27.5461841 21.24727436 -32.60619697 22.75527622 -38 24 C-33.7387667 19.42311979 -30.1100127 17.18805802 -24 16 C-23.67 15.34 -23.34 14.68 -23 14 C-22.01 14 -21.02 14 -20 14 C-19.67 13.01 -19.34 12.02 -19 11 C-17.01679982 9.96708324 -15.01652194 8.9662501 -13 8 C-12.67 7.34 -12.34 6.68 -12 6 C-11.113125 5.71125 -10.22625 5.4225 -9.3125 5.125 C-5.72553394 3.90678511 -3.07007891 2.19291351 0 0 Z " fill="#90B4FD" transform="translate(934,683)"/>
+<path d="M0 0 C0.99 0.33 1.98 0.66 3 1 C4.71001372 6.13004116 4.31112904 11.50403272 4.375 16.875 C4.43107422 18.65197266 4.43107422 18.65197266 4.48828125 20.46484375 C4.57512439 29.02371772 4.57512439 29.02371772 2.86035156 31.93457031 C1.4765625 33.3203125 1.4765625 33.3203125 -1 35 C-0.125 29.125 -0.125 29.125 1 28 C1.09899523 26.45044441 1.13079524 24.89646327 1.1328125 23.34375 C1.13474609 21.93416016 1.13474609 21.93416016 1.13671875 20.49609375 C1.13285156 19.50738281 1.12898438 18.51867187 1.125 17.5 C1.12886719 16.51128906 1.13273437 15.52257812 1.13671875 14.50390625 C1.13542969 13.56417969 1.13414062 12.62445312 1.1328125 11.65625 C1.13168457 10.78806641 1.13055664 9.91988281 1.12939453 9.02539062 C1.2241537 7.00395846 1.2241537 7.00395846 0 6 C-0.04080783 4.00041636 -0.04254356 1.99954746 0 0 Z " fill="#626D82" transform="translate(416,617)"/>
+<path d="M0 0 C3.32720629 2.45162569 5.26378671 4.27954294 7 8 C7.99 8.66 8.98 9.32 10 10 C10 10.66 10 11.32 10 12 C10.66 12 11.32 12 12 12 C12.12375 12.639375 12.2475 13.27875 12.375 13.9375 C12.58125 14.618125 12.7875 15.29875 13 16 C13.66 16.33 14.32 16.66 15 17 C15.81640625 19.25 15.81640625 19.25 16.5625 22 C17.26490893 25.28253366 17.26490893 25.28253366 19 28 C19.14115161 30.67058851 19.04247107 33.32432238 19 36 C18.67 36 18.34 36 18 36 C17.896875 34.948125 17.79375 33.89625 17.6875 32.8125 C17.00328747 29.01823052 16.10161661 27.15242491 14 24 C11 18.44444444 11 18.44444444 11 15 C9.68 15 8.36 15 7 15 C6.6596875 13.7315625 6.6596875 13.7315625 6.3125 12.4375 C4.96513439 8.90868531 3.32162397 6.4647429 1.0234375 3.515625 C0 2 0 2 0 0 Z " fill="#AEB3BE" transform="translate(206,508)"/>
+<path d="M0 0 C6.18364505 0.02529098 10.81184465 0.89628054 16.5 3.25 C16.5 3.58 16.5 3.91 16.5 4.25 C14.50045254 4.29254356 12.49958364 4.29080783 10.5 4.25 C10.005 3.755 10.005 3.755 9.5 3.25 C7.25268875 3.1235152 5.00083761 3.07417447 2.75 3.0625 C1.51765625 3.04832031 0.2853125 3.03414062 -0.984375 3.01953125 C-4.34341747 3.23973515 -6.46334896 3.90686589 -9.5 5.25 C-10.49 5.25 -11.48 5.25 -12.5 5.25 C-12.83 6.24 -13.16 7.23 -13.5 8.25 C-15.14333504 9.28789581 -16.81243867 10.28567924 -18.5 11.25 C-20.25149165 12.83245275 -20.25149165 12.83245275 -21.5 14.25 C-22.49 13.92 -23.48 13.59 -24.5 13.25 C-22.84435047 9.93870093 -19.51103415 8.72743279 -16.25 7.1875 C-14.31946715 6.36996415 -14.31946715 6.36996415 -13.5 4.25 C-11.51679982 3.21708324 -9.51652194 2.2162501 -7.5 1.25 C-5.61520858 -0.63479142 -2.51579362 0.03225376 0 0 Z " fill="#9199A8" transform="translate(374.5,582.75)"/>
+<path d="M0 0 C4.88461056 0.61057632 8.70856688 2.74805985 13 5 C13.99 5.474375 14.98 5.94875 16 6.4375 C18.4580706 7.71774511 20.73215838 9.07282368 23.0625 10.5625 C25.97846294 12.41460501 28.75842659 13.78440997 32 15 C33.42451367 15.64973047 34.84072342 16.31785016 36.25 17 C36.93578125 17.33 37.6215625 17.66 38.328125 18 C40 19 40 19 41 21 C39.53932801 20.54917531 38.08151968 20.08906463 36.625 19.625 C35.40683594 19.24214844 35.40683594 19.24214844 34.1640625 18.8515625 C32 18 32 18 30 16 C28.824375 15.835 27.64875 15.67 26.4375 15.5 C25.303125 15.335 24.16875 15.17 23 15 C22.67 14.34 22.34 13.68 22 13 C20.34302621 12.30959426 18.6744239 11.6469365 17 11 C12.1875 8.375 12.1875 8.375 11 6 C9.27003147 5.24925894 7.53803111 4.50222036 5.7890625 3.796875 C3.59949046 2.8216071 1.83069032 1.53777987 0 0 Z " fill="#B7BDC5" transform="translate(463,511)"/>
+<path d="M0 0 C3.47291497 5.20937245 4.26391545 9.42842355 4.55859375 15.59765625 C5.07944481 18.43237663 6.23217488 19.76917306 8 22 C8.1875 24.75 8.1875 24.75 8 27 C8.99 27.33 9.98 27.66 11 28 C11.103125 29.051875 11.20625 30.10375 11.3125 31.1875 C11.98485228 34.91599898 13.06714408 36.83714485 15 40 C14.67 40.99 14.34 41.98 14 43 C7.42706503 30.1827768 7.42706503 30.1827768 6.4375 25.125 C6.19919538 22.92158536 6.19919538 22.92158536 4.54296875 21.65625 C2.627292 19.59992863 2.36635949 18.11767931 1.875 15.375 C1.50902407 12.40059351 1.50902407 12.40059351 0 10 C-0.07205511 8.31391034 -0.08386068 6.62499341 -0.0625 4.9375 C-0.05347656 4.01839844 -0.04445312 3.09929688 -0.03515625 2.15234375 C-0.02355469 1.44207031 -0.01195312 0.73179687 0 0 Z " fill="#99A2AD" transform="translate(35,852)"/>
+<path d="M0 0 C1.44096586 0.42594588 2.87768712 0.86626633 4.3125 1.3125 C5.11300781 1.55613281 5.91351562 1.79976562 6.73828125 2.05078125 C9.12912936 3.05419419 10.25098011 4.13172875 12 6 C14.59915538 7.19027984 14.59915538 7.19027984 17 8 C17 8.66 17 9.32 17 10 C17.9590625 10.1546875 17.9590625 10.1546875 18.9375 10.3125 C19.618125 10.539375 20.29875 10.76625 21 11 C21.33 11.99 21.66 12.98 22 14 C22.70125 14.0825 23.4025 14.165 24.125 14.25 C27.68527538 15.17876749 30.07030552 16.80272914 33 19 C33.495 19.99 33.495 19.99 34 21 C28.05863321 19.46413648 24.03505817 17.54329006 19.55078125 13.34765625 C17.54704971 11.60637821 15.48402862 10.89170258 13 10 C10.97386717 8.70672372 8.97485205 7.3703055 7 6 C5.906875 5.29875 4.81375 4.5975 3.6875 3.875 C1 2 1 2 0 0 Z " fill="#A7C4FD" transform="translate(922,552)"/>
+<path d="M0 0 C0.556875 0.226875 1.11375 0.45375 1.6875 0.6875 C0.50390625 2.6484375 0.50390625 2.6484375 -1.3125 4.6875 C-3.72265625 5.2265625 -3.72265625 5.2265625 -6.375 5.3125 C-10.31841174 5.31436778 -10.31841174 5.31436778 -13.3125 7.6875 C-15.89314129 7.83247985 -18.36193884 7.87427545 -20.9375 7.8125 C-21.64390625 7.80347656 -22.3503125 7.79445313 -23.078125 7.78515625 C-24.82306098 7.76157603 -26.56782295 7.72570461 -28.3125 7.6875 C-28.6425 8.6775 -28.9725 9.6675 -29.3125 10.6875 C-32.6125 10.6875 -35.9125 10.6875 -39.3125 10.6875 C-39.3125 10.3575 -39.3125 10.0275 -39.3125 9.6875 C-37.0025 9.6875 -34.6925 9.6875 -32.3125 9.6875 C-32.3125 9.0275 -32.3125 8.3675 -32.3125 7.6875 C-28.53955637 6.42985212 -24.95677268 6.31917458 -21.00390625 6.06640625 C-18.31900506 5.68841581 -16.67806437 4.94451538 -14.3125 3.6875 C-13.178125 3.543125 -12.04375 3.39875 -10.875 3.25 C-7.30985964 2.91688809 -7.30985964 2.91688809 -4.625 1.0625 C-2.3125 -0.3125 -2.3125 -0.3125 0 0 Z " fill="#354A6C" transform="translate(681.3125,357.3125)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-1.06994664 4.54224612 -3.54399684 5.68941083 -8 7 C-11.89794157 8.48830496 -15.23603037 10.07131129 -18.5625 12.5625 C-21.59782967 14.83058448 -24.37485167 15.83995253 -28 17 C-30.3242187 18.22196933 -32.59641515 19.51942101 -34.875 20.82421875 C-37.18257612 22.10102098 -39.51483702 23.11816798 -42 24 C-41.505 22.515 -41.505 22.515 -41 21 C-39.37766988 20.25643203 -37.74754636 19.52607939 -36.0859375 18.875 C-32.21910845 17.25295935 -28.63770302 15.07519971 -25 13 C-19.75129041 10.00576969 -14.5603272 7.38299737 -9 5 C-6.61893602 3.6618814 -4.26110402 2.2940864 -1.91796875 0.890625 C-1.28503906 0.59671875 -0.65210938 0.3028125 0 0 Z " fill="#99A1AD" transform="translate(276,191)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C1.34 1.66 0.68 2.32 0 3 C-0.67379214 4.65079075 -1.34735106 6.30167722 -2.01953125 7.953125 C-3.1232789 10.25736313 -4.4673434 12.22391481 -5.9375 14.3125 C-10.0992573 20.3687886 -12.70539557 26.77072379 -14 34 C-14.33 34 -14.66 34 -15 34 C-15.1953125 27.9453125 -15.1953125 27.9453125 -15 26 C-14.34 25.34 -13.68 24.68 -13 24 C-12.28166626 22.14126234 -12.28166626 22.14126234 -11.6875 20 C-9.21689912 12.30265051 -6.2179849 5.32970135 0 0 Z " fill="#AFB5BF" transform="translate(400,242)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-6.89019981 6.52730733 -6.89019981 6.52730733 -11.375 8.4375 C-15.87371551 10.37660151 -19.94363799 12.84908008 -24.1328125 15.37890625 C-27.83839642 17.47402522 -30.70993484 19 -35 19 C-35.33 19.99 -35.66 20.98 -36 22 C-38.4375 23.75 -38.4375 23.75 -41 25 C-41.66 24.67 -42.32 24.34 -43 24 C-40.94766315 21.7522025 -39.99332739 20.9977758 -37 20 C-36.67 19.34 -36.34 18.68 -36 18 C-34.02829794 16.94530053 -32.02153413 15.9557195 -30 15 C-28.31583984 14.14921875 -28.31583984 14.14921875 -26.59765625 13.28125 C-25.43105469 12.6934375 -24.26445312 12.105625 -23.0625 11.5 C-21.89847656 10.9121875 -20.73445313 10.324375 -19.53515625 9.71875 C-17.1717138 8.56967301 -14.77807252 7.48081193 -12.359375 6.453125 C-8.680865 4.86195556 -5.34906695 2.94574062 -1.91796875 0.890625 C-1.28503906 0.59671875 -0.65210938 0.3028125 0 0 Z " fill="#A1A9B4" transform="translate(232,215)"/>
+<path d="M0 0 C4.3817463 0.39834057 6.89720766 2.17117112 10.3046875 4.73046875 C13.18784991 6.88951894 16.07475791 8.64413766 19.4375 9.9375 C23.16402279 11.4826436 27.14564362 13.29128724 29 17 C25.00465792 16.42923685 22.411827 15.09958585 19 13 C16.80869466 12.30420546 16.80869466 12.30420546 15 12 C15 11.34 15 10.68 15 10 C14.113125 9.7525 13.22625 9.505 12.3125 9.25 C8.3201848 7.74346596 4.95937668 5.91875337 3 2 C2.01 1.34 1.02 0.68 0 0 Z " fill="#9DBCFD" transform="translate(812,838)"/>
+<path d="M0 0 C1.98 0 3.96 0 6 0 C1.38714347 3.99780899 -3.71488913 6.99202569 -9 10 C-9.85464844 10.49371094 -10.70929688 10.98742187 -11.58984375 11.49609375 C-17.04575623 14.46363937 -20.79150797 15.57486037 -27 15 C-27 14.67 -27 14.34 -27 14 C-25.865625 13.71125 -24.73125 13.4225 -23.5625 13.125 C-22.386875 12.75375 -21.21125 12.3825 -20 12 C-19.67 11.34 -19.34 10.68 -19 10 C-17.33333333 9.66666667 -15.66666667 9.33333333 -14 9 C-13.67 8.34 -13.34 7.68 -13 7 C-11.0390625 6.18359375 -11.0390625 6.18359375 -8.625 5.4375 C-7.83351563 5.18871094 -7.04203125 4.93992187 -6.2265625 4.68359375 C-5.49179687 4.45800781 -4.75703125 4.23242188 -4 4 C-3.01 3.67 -2.02 3.34 -1 3 C-0.67 2.01 -0.34 1.02 0 0 Z " fill="#7E8898" transform="translate(399,122)"/>
+<path d="M0 0 C4.35430628 0.65974338 7.99216111 2.20338257 12 4 C16.99382407 6.19317308 16.99382407 6.19317308 22.1875 7.8125 C25.90385902 9.38162936 27.0515978 11.55282688 29 15 C25.03908343 14.40764671 22.15507177 13.16968647 18.6875 11.1875 C15.36968946 9.31648706 12.06375627 7.51281371 8.625 5.875 C5.39343148 4.29246233 2.71819475 2.3784204 0 0 Z " fill="#717D8E" transform="translate(641,64)"/>
+<path d="M0 0 C2.91926519 2.63675566 4.09111127 4.23460384 5 8 C5.99 8.33 6.98 8.66 8 9 C8.1953125 11.01822917 8.390625 13.03645833 8.5859375 15.0546875 C8.86374749 17.22668245 8.86374749 17.22668245 11 19 C14.10204082 25.20408163 14.10204082 25.20408163 13.6875 28.4375 C13.460625 28.953125 13.23375 29.46875 13 30 C13 29.01 13 28.02 13 27 C12.01 27 11.02 27 10 27 C9.67 24.69 9.34 22.38 9 20 C8.01 19.67 7.02 19.34 6 19 C4.9375 15.875 4.9375 15.875 4 12 C3.40653811 9.62615246 2.74712905 7.33477828 2 5 C1.34 4.67 0.68 4.34 0 4 C0 2.68 0 1.36 0 0 Z " fill="#6E788C" transform="translate(416,905)"/>
+<path d="M0 0 C1.32 0.33 2.64 0.66 4 1 C1.62997587 3.61950036 -0.95453979 5.23683883 -4 7 C-4.33 7.33 -4.66 7.66 -5 8 C-6.66617115 8.04063832 -8.33388095 8.042721 -10 8 C-10.33 8.99 -10.66 9.98 -11 11 C-12.98248715 11.71706982 -14.98415349 12.38290413 -17 13 C-17.66 13.66 -18.32 14.32 -19 15 C-20.32 15 -21.64 15 -23 15 C-23.33 15.99 -23.66 16.98 -24 18 C-26.375 19.75 -26.375 19.75 -29 21 C-29.99 20.67 -30.98 20.34 -32 20 C-27.78239137 16.03195401 -24.54289929 13.8099263 -19 12 C-17.66176263 11.03471403 -16.35097051 10.03077641 -15.0625 9 C-11.51878895 6.21517162 -8.45644408 4.94270932 -4 4 C-3.195625 3.79375 -2.39125 3.5875 -1.5625 3.375 C-1.046875 3.25125 -0.53125 3.1275 0 3 C0 2.01 0 1.02 0 0 Z " fill="#C6CBD2" transform="translate(475,82)"/>
+<path d="M0 0 C1.32 0.33 2.64 0.66 4 1 C4 1.66 4 2.32 4 3 C4.70125 3.0825 5.4025 3.165 6.125 3.25 C9.65980087 4.17212197 11.97988738 5.9660466 15 8 C15.99 8.268125 16.98 8.53625 18 8.8125 C22.22691204 10.48565268 24.31175494 13.43473882 27 17 C25.5164999 16.57742724 24.03823576 16.13643678 22.5625 15.6875 C21.73878906 15.44386719 20.91507813 15.20023438 20.06640625 14.94921875 C19.38449219 14.63597656 18.70257812 14.32273437 18 14 C17.67 13.01 17.34 12.02 17 11 C16.29875 10.9175 15.5975 10.835 14.875 10.75 C11.3096548 9.81990995 8.90984428 8.23313631 6 6 C6 5.34 6 4.68 6 4 C5.38125 3.896875 4.7625 3.79375 4.125 3.6875 C2 3 2 3 0 0 Z " fill="#99BAFD" transform="translate(812,828)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-0.6103671 4.91555065 -3.40286535 6.38292525 -7.75 8.0625 C-10.16232993 8.77997664 -10.16232993 8.77997664 -11 11 C-14.49360803 13.39561694 -17.95665186 14.77759242 -22 16 C-22 17.32 -22 18.64 -22 20 C-23.65 19.67 -25.3 19.34 -27 19 C-27 18.01 -27 17.02 -27 16 C-26.34 16 -25.68 16 -25 16 C-24.67 15.01 -24.34 14.02 -24 13 C-21.34765625 11.68359375 -21.34765625 11.68359375 -18.0625 10.4375 C-13.63612705 8.83396312 -13.63612705 8.83396312 -10 6 C-8.34561387 5.30341637 -6.67745682 4.63903117 -5 4 C-1.83982742 2.7100286 -1.83982742 2.7100286 0 0 Z " fill="#7DA7FD" transform="translate(788,660)"/>
+<path d="M0 0 C5.43480231 1.487975 10.24450116 2.90892575 15 6 C17.52019589 7.26630533 20.0557151 8.49673823 22.59765625 9.71875 C24.93073685 10.96305965 26.93293484 12.35780504 29 14 C24.125 13.125 24.125 13.125 23 12 C21.48834346 11.60851239 19.96530368 11.26027543 18.4375 10.9375 C17.19806641 10.67259766 17.19806641 10.67259766 15.93359375 10.40234375 C15.29550781 10.26957031 14.65742188 10.13679688 14 10 C14 9.34 14 8.68 14 8 C12.02 8 10.04 8 8 8 C7.34 6.68 6.68 5.36 6 4 C4.68 4 3.36 4 2 4 C1.34 2.68 0.68 1.36 0 0 Z " fill="#7C8696" transform="translate(114,302)"/>
+<path d="M0 0 C-1.66094138 1.92319528 -2.85895448 2.94514896 -5.25 3.875 C-7.73403388 4.89119568 -9.32405433 5.9044185 -11.4375 7.5 C-14.50615642 9.77824492 -17.34814727 10.83451508 -21 12 C-21.94875 12.639375 -22.8975 13.27875 -23.875 13.9375 C-27.50453928 16.33299592 -30.89870312 17.58575969 -35 19 C-34.505 17.515 -34.505 17.515 -34 16 C-32.67696283 15.6278958 -31.34262065 15.29369827 -30 15 C-29.67 14.34 -29.34 13.68 -29 13 C-27 12.33333333 -25 11.66666667 -23 11 C-22.67 10.34 -22.34 9.68 -22 9 C-20.9275 8.731875 -19.855 8.46375 -18.75 8.1875 C-14.49582159 6.84034351 -13.02745618 5.18271034 -10 2 C-3.9818044 -1.68460955 -3.9818044 -1.68460955 0 0 Z " fill="#BAD0FE" transform="translate(917,818)"/>
+<path d="M0 0 C1.99954746 -0.04254356 4.00041636 -0.04080783 6 0 C7 1 7 1 7.12025452 3.51197815 C7.11803391 4.62894577 7.11581329 5.74591339 7.11352539 6.89672852 C7.11344986 8.15796036 7.11337433 9.4191922 7.11329651 10.71864319 C7.1081891 12.10539794 7.10297309 13.49215229 7.09765625 14.87890625 C7.09579201 16.28995209 7.09436814 17.70099857 7.09336853 19.11204529 C7.08954379 22.83240535 7.0797139 26.5527266 7.06866455 30.27307129 C7.05844948 34.06680781 7.05387071 37.86055058 7.04882812 41.65429688 C7.03809158 49.10288231 7.0210157 56.55143572 7 64 C6.67 64 6.34 64 6 64 C5.67 43.87 5.34 23.74 5 3 C2.525 2.01 2.525 2.01 0 1 C0 0.67 0 0.34 0 0 Z " fill="#C0D4FE" transform="translate(1032,635)"/>
+<path d="M0 0 C2.27076842 -0.02699725 4.54162821 -0.04639453 6.8125 -0.0625 C8.07707031 -0.07410156 9.34164062 -0.08570313 10.64453125 -0.09765625 C14 0 14 0 17 1 C18.91669758 1.21608346 20.83844643 1.3887142 22.76171875 1.53515625 C24.43911133 1.66567383 24.43911133 1.66567383 26.15039062 1.79882812 C27.90125977 1.9293457 27.90125977 1.9293457 29.6875 2.0625 C31.45577148 2.19881836 31.45577148 2.19881836 33.25976562 2.33789062 C36.17293532 2.5619806 39.0863289 2.78254296 42 3 C42 3.33 42 3.66 42 4 C37.78248718 4.04946113 33.56512832 4.08574827 29.34741211 4.10986328 C27.91281188 4.119917 26.47823211 4.13356194 25.04370117 4.15087891 C22.98090562 4.17515549 20.91838115 4.18648919 18.85546875 4.1953125 C17.61434326 4.20578613 16.37321777 4.21625977 15.09448242 4.22705078 C12 4 12 4 9 2 C6.72087062 1.54605448 6.72087062 1.54605448 4.3125 1.375 C3.50425781 1.30023438 2.69601562 1.22546875 1.86328125 1.1484375 C1.24839844 1.09945313 0.63351562 1.05046875 0 1 C0 0.67 0 0.34 0 0 Z " fill="#DBDEE2" transform="translate(524,392)"/>
+<path d="M0 0 C4.455 1.98 4.455 1.98 9 4 C9 4.66 9 5.32 9 6 C9.78375 5.95875 10.5675 5.9175 11.375 5.875 C14 6 14 6 16 8 C17.3303125 8.4021875 17.3303125 8.4021875 18.6875 8.8125 C22.15248406 10.0546641 24.4344746 11.62069939 27.2890625 13.87890625 C28.97322331 15.12869631 28.97322331 15.12869631 31.1484375 15.46484375 C31.75945313 15.64144531 32.37046875 15.81804687 33 16 C33.495 17.485 33.495 17.485 34 19 C33.34 19 32.68 19 32 19 C32 18.34 32 17.68 32 17 C30.02 17 28.04 17 26 17 C25.67 16.01 25.34 15.02 25 14 C23.35 14 21.7 14 20 14 C19.67 12.68 19.34 11.36 19 10 C18.21625 10.04125 17.4325 10.0825 16.625 10.125 C14 10 14 10 12 8 C11.278125 7.71125 10.55625 7.4225 9.8125 7.125 C6.31495146 5.72598058 3.24635365 3.90961979 0 2 C0 1.34 0 0.68 0 0 Z " fill="#C5CAD1" transform="translate(790,145)"/>
+<path d="M0 0 C-3.59162927 3.17399796 -6.414712 5.42790126 -11 7 C-11.33 7.33 -11.66 7.66 -12 8 C-15.08638202 8.33366292 -16.61536475 8.22870204 -19.3125 6.625 C-19.869375 6.08875 -20.42625 5.5525 -21 5 C-21 4.34 -21 3.68 -21 3 C-20.14535156 2.95101562 -19.29070313 2.90203125 -18.41015625 2.8515625 C-17.30542969 2.77679687 -16.20070313 2.70203125 -15.0625 2.625 C-13.40927734 2.52058594 -13.40927734 2.52058594 -11.72265625 2.4140625 C-10.37494141 2.20910156 -10.37494141 2.20910156 -9 2 C-8.67 1.34 -8.34 0.68 -8 0 C-2.55072464 -1.27536232 -2.55072464 -1.27536232 0 0 Z " fill="#9ABBFD" transform="translate(971,665)"/>
+<path d="M0 0 C3.49618108 0.56843504 6.17880526 1.43009412 9.25 3.1875 C10.02730469 3.63222656 10.80460937 4.07695312 11.60546875 4.53515625 C13.98427301 5.99037908 16.27034482 7.53751429 18.5625 9.125 C21.94853764 11.42938672 25.1337753 12.97691745 29.00390625 14.27734375 C32.48976583 15.53934771 35.7115677 17.29706184 39 19 C34.82412255 20.39195915 32.86525224 18.82323219 29 17 C29 16.34 29 15.68 29 15 C28.071875 15.061875 27.14375 15.12375 26.1875 15.1875 C23 15 23 15 21.4375 13.625 C20.963125 13.08875 20.48875 12.5525 20 12 C17.40084462 10.80972016 17.40084462 10.80972016 15 10 C15 9.34 15 8.68 15 8 C14.13375 8.12375 13.2675 8.2475 12.375 8.375 C8.1774907 7.90861008 7.083874 6.57499679 4.39453125 3.5078125 C2.87679227 1.74870926 2.87679227 1.74870926 0 0 Z " fill="#6A7688" transform="translate(255,374)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C0.60823368 1.96423026 -0.7886223 2.92111602 -2.1875 3.875 C-3.35345703 4.67550781 -3.35345703 4.67550781 -4.54296875 5.4921875 C-6.97252674 6.98314042 -9.35157267 7.96572854 -12 9 C-13.010625 9.680625 -14.02125 10.36125 -15.0625 11.0625 C-18 13 -18 13 -20.25 13.5 C-22.22926762 13.85101127 -22.22926762 13.85101127 -23.25 16.0625 C-23.62125 17.0215625 -23.62125 17.0215625 -24 18 C-24.99 18 -25.98 18 -27 18 C-27.33 18.99 -27.66 19.98 -28 21 C-30.0625 21.6875 -30.0625 21.6875 -32 22 C-29.56427537 18.69437371 -27.74111712 16.6770525 -24 15 C-23.67 14.34 -23.34 13.68 -23 13 C-22.01 13 -21.02 13 -20 13 C-19.896875 12.360625 -19.79375 11.72125 -19.6875 11.0625 C-19.3471875 10.0415625 -19.3471875 10.0415625 -19 9 C-18.01 8.67 -17.02 8.34 -16 8 C-15.67 7.34 -15.34 6.68 -15 6 C-13 5.66666667 -11 5.33333333 -9 5 C-8.67 4.34 -8.34 3.68 -8 3 C-6.01751285 2.28293018 -4.01584651 1.61709587 -2 1 C-1.34 0.67 -0.68 0.34 0 0 Z " fill="#45649E" transform="translate(463,226)"/>
+<path d="M0 0 C0.66 0.66 1.32 1.32 2 2 C-12.19 2 -26.38 2 -41 2 C-41 1.67 -41 1.34 -41 1 C-27.61830146 -1.3093224 -13.46523945 -2.43154239 0 0 Z " fill="#A2A9B4" transform="translate(597,45)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-2.69741479 5.67181579 -6.61922676 8.71200653 -13.1171875 10.296875 C-15.37714355 10.93151918 -15.37714355 10.93151918 -17 14 C-18.64142963 15.0409066 -20.30712215 16.04504326 -22 17 C-22.33 17.33 -22.66 17.66 -23 18 C-24.66617115 18.04063832 -26.33388095 18.042721 -28 18 C-28.33 18.99 -28.66 19.98 -29 21 C-30.32 20.67 -31.64 20.34 -33 20 C-26.25 16 -26.25 16 -24 16 C-24 15.34 -24 14.68 -24 14 C-23.13375 13.5875 -22.2675 13.175 -21.375 12.75 C-17.99373054 11.07485356 -17.99373054 11.07485356 -15 9 C-12.08273524 7.05515683 -9.13164127 5.56582063 -6 4 C-3.95889772 2.71848601 -1.98406102 1.3699469 0 0 Z " fill="#77A3FD" transform="translate(918,825)"/>
+<path d="M0 0 C2.33203125 0.55859375 2.33203125 0.55859375 5 2 C6.1382417 4.42648425 6.95057197 6.52250406 7.6875 9.0625 C8.40471318 11.40446797 9.16886131 13.69322559 10 16 C10.66 16.33 11.32 16.66 12 17 C12 18.98 12 20.96 12 23 C12.66 23 13.32 23 14 23 C13.67 24.32 13.34 25.64 13 27 C9.80072161 23.80072161 9.21209281 19.59069611 8.625 15.1875 C8.41875 14.465625 8.2125 13.74375 8 13 C7.1028125 12.566875 7.1028125 12.566875 6.1875 12.125 C2.85658196 10.41195643 1.36018286 7.42939722 0 4 C0 2.68 0 1.36 0 0 Z " fill="#C0C5CD" transform="translate(368,804)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-0.67478244 2.6627026 -2.9995144 3.99983813 -6 5 C-6.33 5.66 -6.66 6.32 -7 7 C-7.845625 7.268125 -8.69125 7.53625 -9.5625 7.8125 C-12.50395425 8.82863874 -14.44205635 9.82579888 -17 11.5 C-20.2512201 13.61391116 -23.27480403 14.8662447 -27 16 C-28.03125 16.515625 -29.0625 17.03125 -30.125 17.5625 C-32.48906677 18.74453338 -34.42844149 19.50546952 -37 20 C-34.63707344 17.47411298 -33.33537489 16.11179163 -30 15 C-29.67 14.34 -29.34 13.68 -29 13 C-27.453125 12.87625 -27.453125 12.87625 -25.875 12.75 C-21.37329261 11.8787018 -19.97318137 10.4438126 -16.74609375 7.41796875 C-14.11355684 5.28013676 -11.2587941 4.80040557 -8 4 C-5.85767666 2.96778966 -3.77737234 1.86246831 -1.69921875 0.70703125 C-1.13847656 0.47371094 -0.57773437 0.24039062 0 0 Z " fill="#5075BE" transform="translate(715,498)"/>
+<path d="M0 0 C2.32222453 2.63185447 3.88236503 4.6235681 4.9375 8 C6.228259 11.644496 8.26263627 13.33467216 11 16 C11 16.99 11 17.98 11 19 C11.66 19 12.32 19 13 19 C14.02137457 20.65365406 15.01612294 22.32376502 16 24 C17.60843974 26.05629871 19.29638679 28.02012519 21 30 C18.0737247 28.68822142 16.24710766 27.24710766 14 25 C13.34 24.731875 12.68 24.46375 12 24.1875 C9.02980365 22.42394592 8.42169906 20.12773793 7 17 C6.1575368 15.4519068 5.3026565 13.91052631 4.4375 12.375 C3.61833162 10.92040194 2.80553494 9.46219213 2 8 C1.61972656 7.33226562 1.23945313 6.66453125 0.84765625 5.9765625 C0 4 0 4 0 0 Z " fill="#496BAB" transform="translate(410,295)"/>
+<path d="M0 0 C4.82978743 0.52780611 8.10529922 1.93297604 12.25 4.4375 C13.28640625 5.05496094 14.3228125 5.67242187 15.390625 6.30859375 C18 8 18 8 20 10 C20.969375 10.309375 21.93875 10.61875 22.9375 10.9375 C25.85839516 11.95087179 27.08604685 12.66072393 29 15 C26.69 14.67 24.38 14.34 22 14 C22 13.34 22 12.68 22 12 C20.35 12 18.7 12 17 12 C16.67 11.01 16.34 10.02 16 9 C14.35 9 12.7 9 11 9 C10.67 7.68 10.34 6.36 10 5 C8.906875 4.731875 7.81375 4.46375 6.6875 4.1875 C3.38307337 3.12336261 2.05039578 2.65345336 0 0 Z " fill="#C4C8CF" transform="translate(324,174)"/>
+<path d="M0 0 C3.32722441 0.5545374 6.1013913 1.24013043 9 3 C9.33 3.66 9.66 4.32 10 5 C11.99541868 5.68025637 13.99617991 6.34490497 16 7 C20.87265581 9.633868 25.40742928 12.90826938 30 16 C26.56745236 16 24.23129274 15.14045626 21 14 C19.9275 13.690625 18.855 13.38125 17.75 13.0625 C15 12 15 12 13 9 C11.23592738 7.97363047 9.46976911 6.94969877 7.67578125 5.9765625 C5.79618866 4.88122882 4.45881449 3.60469593 3 2 C2.01 1.34 1.02 0.68 0 0 Z " fill="#B5CDFE" transform="translate(764,810)"/>
+<path d="M0 0 C-0.804375 0.61875 -1.60875 1.2375 -2.4375 1.875 C-5.03874519 3.74164041 -5.03874519 3.74164041 -6 6 C-7.40403544 6.88855792 -8.84852714 7.71410295 -10.3125 8.5 C-11.09238281 8.9228125 -11.87226563 9.345625 -12.67578125 9.78125 C-15 11 -15 11 -17.23046875 11.96875 C-19.34741639 12.94154263 -19.34741639 12.94154263 -20 16 C-22.9375 17.75 -22.9375 17.75 -26 19 C-26.66 18.67 -27.32 18.34 -28 18 C-26.73427767 16.84852339 -25.46222094 15.70400686 -24.1875 14.5625 C-23.12595703 13.60537109 -23.12595703 13.60537109 -22.04296875 12.62890625 C-20 11 -20 11 -17 10 C-16.195625 9.195625 -15.39125 8.39125 -14.5625 7.5625 C-12.31262209 5.31262209 -10.80186769 4.30086714 -8 3 C-7.67 2.34 -7.34 1.68 -7 1 C-2.44155844 -1.22077922 -2.44155844 -1.22077922 0 0 Z " fill="#828B9C" transform="translate(330,613)"/>
+<path d="M0 0 C4.931222 0.43510782 7.54881403 2.54881403 11 6 C12 9 12 9 13 12 C14.40331374 13.39341966 14.40331374 13.39341966 16.0625 14.625 C19 17 19 17 19.875 19.3125 C19.91625 19.869375 19.9575 20.42625 20 21 C19.34 21 18.68 21 18 21 C17.38125 20.195625 16.7625 19.39125 16.125 18.5625 C14.32285328 15.8303083 14.32285328 15.8303083 11.9375 15.625 C11.298125 15.41875 10.65875 15.2125 10 15 C9.24681823 13.29715425 8.50221173 11.58834795 7.8515625 9.84375 C6.52183237 6.96470127 4.30359354 5.12639404 2 3 C1.34 2.01 0.68 1.02 0 0 Z " fill="#6C788A" transform="translate(756,226)"/>
+<path d="M0 0 C-2.17468175 3.31480616 -4.12059518 4.86584041 -7.6875 6.5625 C-8.57308594 6.9853125 -9.45867187 7.408125 -10.37109375 7.84375 C-13.26475809 9.11644635 -16.19357782 10.18888728 -19.171875 11.2421875 C-22.07680229 12.44636676 -24.45988493 14.15841658 -27 16 C-27.66 15.67 -28.32 15.34 -29 15 C-26.19380839 11.6985981 -22.81959588 9.94330317 -19 8 C-17.68 8 -16.36 8 -15 8 C-14.67 7.01 -14.34 6.02 -14 5 C-12.35 4.67 -10.7 4.34 -9 4 C-9 3.01 -9 2.02 -9 1 C-2.25 -1.125 -2.25 -1.125 0 0 Z " fill="#7D8897" transform="translate(293,182)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-6.09684793 8.51419634 -6.09684793 8.51419634 -11 10 C-11.33 10.33 -11.66 10.66 -12 11 C-13.66617115 11.04063832 -15.33388095 11.042721 -17 11 C-17.33 12.32 -17.66 13.64 -18 15 C-20.64 15.66 -23.28 16.32 -26 17 C-25 14 -25 14 -22.3125 12.5625 C-21.219375 12.046875 -20.12625 11.53125 -19 11 C-17.62134766 10.07960938 -17.62134766 10.07960938 -16.21484375 9.140625 C-12.96826262 6.97886746 -9.67098639 5.05958357 -6.25 3.1875 C-5.12078125 2.56230469 -3.9915625 1.93710937 -2.828125 1.29296875 C-1.89484375 0.86628906 -0.9615625 0.43960938 0 0 Z " fill="#3B537E" transform="translate(960,993)"/>
+<path d="M0 0 C4.35430628 0.65974338 7.99216111 2.20338257 12 4 C15.42518006 5.50227195 18.73079019 6.91872911 22.3125 8 C25 9 25 9 27 12 C29.05003955 13.19232613 29.05003955 13.19232613 31 14 C30.67 14.66 30.34 15.32 30 16 C26.04173899 14.43318835 22.50786872 12.76271123 18.9375 10.4375 C15.7004257 8.34766467 12.67161158 7.19889358 9 6 C5.94835983 4.42139207 2.96887467 2.72854481 0 1 C0 0.67 0 0.34 0 0 Z " fill="#BEC4CB" transform="translate(84,934)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-2.56602931 4.68527239 -6.3588275 7.2371336 -12 9 C-14.10614257 10.26046391 -16.14074163 11.59308995 -18.16796875 12.9765625 C-20 14 -20 14 -23 14 C-23.33 15.32 -23.66 16.64 -24 18 C-26.31 18.66 -28.62 19.32 -31 20 C-30.505 18.515 -30.505 18.515 -30 17 C-28.35 16.67 -26.7 16.34 -25 16 C-24.67 15.01 -24.34 14.02 -24 13 C-23.01 12.67 -22.02 12.34 -21 12 C-20.34 11.01 -19.68 10.02 -19 9 C-16.375 8.8125 -16.375 8.8125 -14 9 C-14 8.01 -14 7.02 -14 6 C-12.865625 5.87625 -11.73125 5.7525 -10.5625 5.625 C-8.7990625 5.315625 -8.7990625 5.315625 -7 5 C-6.67 4.34 -6.34 3.68 -6 3 C-3.0625 1.3125 -3.0625 1.3125 0 0 Z " fill="#A1C0FD" transform="translate(925,910)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C1.360625 1.103125 0.72125 1.20625 0.0625 1.3125 C-0.618125 1.539375 -1.29875 1.76625 -2 2 C-2.33 2.99 -2.66 3.98 -3 5 C-5.328125 6.5703125 -5.328125 6.5703125 -8.25 8.125 C-9.68085937 8.90230469 -9.68085937 8.90230469 -11.140625 9.6953125 C-13.80950688 10.91308101 -16.11173149 11.56781384 -19 12 C-19 12.66 -19 13.32 -19 14 C-24.625 17 -24.625 17 -28 17 C-23.25 13 -23.25 13 -21 13 C-20.67 12.01 -20.34 11.02 -20 10 C-15.8715354 7.13301069 -11.52853873 5.47031961 -6.75 4 C-3.86786388 3.30884829 -3.86786388 3.30884829 -3 1 C-2.01 0.67 -1.02 0.34 0 0 Z " fill="#C3D6FE" transform="translate(746,576)"/>
+<path d="M0 0 C3.52081558 -0.02927632 7.04159939 -0.04689119 10.5625 -0.0625 C11.55314453 -0.07087891 12.54378906 -0.07925781 13.56445312 -0.08789062 C22.08211005 -0.11618849 29.09692913 0.81104158 37 4 C37 4.33 37 4.66 37 5 C34.52039864 4.85975781 32.04147598 4.7130815 29.5625 4.5625 C28.85544922 4.52318359 28.14839844 4.48386719 27.41992188 4.44335938 C22.11328125 4.11328125 22.11328125 4.11328125 21 3 C19.44246949 2.77329092 17.87622641 2.60564908 16.30859375 2.46484375 C15.36435547 2.37783203 14.42011719 2.29082031 13.44726562 2.20117188 C12.45404297 2.11416016 11.46082031 2.02714844 10.4375 1.9375 C9.44041016 1.84662109 8.44332031 1.75574219 7.41601562 1.66210938 C4.94434298 1.43741186 2.47236744 1.21689649 0 1 C0 0.67 0 0.34 0 0 Z " fill="#4666A2" transform="translate(609,204)"/>
+<path d="M0 0 C0.54269531 0.30550781 1.08539063 0.61101562 1.64453125 0.92578125 C4.31540356 2.14384076 6.80824688 2.62670429 9.6875 3.1875 C16.0731505 4.69184957 20.22665601 7.60032688 25 12 C19.11620813 12 13.45357639 9.06859794 8 7 C8 6.01 8 5.02 8 4 C6.02 4 4.04 4 2 4 C1.34 2.68 0.68 1.36 0 0 Z " fill="#616E81" transform="translate(261,1031)"/>
+<path d="M0 0 C0.495 0.99 0.495 0.99 1 2 C0.49549316 2.2266333 -0.00901367 2.4532666 -0.52880859 2.68676758 C-2.81500759 3.71979668 -5.09495901 4.76595386 -7.375 5.8125 C-8.1690625 6.16892578 -8.963125 6.52535156 -9.78125 6.89257812 C-10.54179688 7.24384766 -11.30234375 7.59511719 -12.0859375 7.95703125 C-12.7876709 8.27647705 -13.4894043 8.59592285 -14.21240234 8.92504883 C-16.32214222 10.02041631 -16.32214222 10.02041631 -18 13 C-22.31672072 15.73197865 -27.123948 17.5371844 -32 19 C-29.5175644 15.15222482 -29.5175644 15.15222482 -26.875 14.375 C-26.25625 14.25125 -25.6375 14.1275 -25 14 C-24.67 13.34 -24.34 12.68 -24 12 C-22.68 12 -21.36 12 -20 12 C-19.67 10.68 -19.34 9.36 -19 8 C-17.9275 7.71125 -16.855 7.4225 -15.75 7.125 C-12.90184789 6.27055437 -10.51227358 5.54601451 -8 4 C-7.67 3.34 -7.34 2.68 -7 2 C-4.6859378 1.26924352 -2.35171131 0.59861742 0 0 Z " fill="#B4CCFE" transform="translate(787,568)"/>
+<path d="M0 0 C9.9 0 19.8 0 30 0 C30.33 0.99 30.66 1.98 31 3 C31.66 3.33 32.32 3.66 33 4 C28.12519761 4.18318673 23.50203415 4.27064428 18.75 3.0625 C12.60652249 1.50172463 6.30691326 1.34091423 0 1 C0 0.67 0 0.34 0 0 Z " fill="#C2C7CE" transform="translate(622,180)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-0.36797991 3.61724095 -2.89600354 5.32861729 -6 7 C-6.66 7 -7.32 7 -8 7 C-8 21.52 -8 36.04 -8 51 C-8.33 51 -8.66 51 -9 51 C-9.050652 44.64627481 -9.08571322 38.29260156 -9.10986328 31.9387207 C-9.11992951 29.77659153 -9.13358354 27.614476 -9.15087891 25.45239258 C-9.17509978 22.34713375 -9.18647681 19.2420547 -9.1953125 16.13671875 C-9.20563507 15.16788254 -9.21595764 14.19904633 -9.22659302 13.20085144 C-9.22674408 12.3001442 -9.22689514 11.39943695 -9.22705078 10.47143555 C-9.231492 9.67867722 -9.23593323 8.88591888 -9.24050903 8.06913757 C-9 6 -9 6 -7 3 C-5.02111039 2.27306096 -3.02045442 1.60183749 -1 1 C-0.67 0.67 -0.34 0.34 0 0 Z " fill="#43506A" transform="translate(231,772)"/>
+<path d="M0 0 C6.03648672 1.88021718 11.69829221 4.13033889 17.421875 6.81640625 C19.91998227 7.96326459 22.4475517 8.98153541 25 10 C27.00751815 10.98482022 29.00934459 11.98152514 31 13 C31 13.33 31 13.66 31 14 C25.32808998 14.58173436 20.84911616 12.79717437 16 10 C15.67 9.34 15.34 8.68 15 8 C13.88625 7.855625 12.7725 7.71125 11.625 7.5625 C7.84319 6.97566741 7.35312898 6.68929027 5 4 C3.948125 3.7525 3.948125 3.7525 2.875 3.5 C2.25625 3.335 1.6375 3.17 1 3 C0.67 2.01 0.34 1.02 0 0 Z " fill="#626F82" transform="translate(514,506)"/>
+<path d="M0 0 C2.0625 0.4375 2.0625 0.4375 4 1 C-1.13542212 5.25506404 -5.6710836 7.93341505 -12 10 C-13.03125 10.515625 -14.0625 11.03125 -15.125 11.5625 C-17.48906677 12.74453338 -19.42844149 13.50546952 -22 14 C-18.70341146 10.58567616 -15.76779828 7.698897 -11.3125 5.9375 C-8.84061395 5.23196154 -8.84061395 5.23196154 -8 3 C-5.67793475 2.29508733 -3.34406932 1.62787571 -1 1 C-0.67 0.67 -0.34 0.34 0 0 Z " fill="#8D96A4" transform="translate(793,425)"/>
+<path d="M0 0 C5.01742011 1.54129899 9.6143495 3.03323643 14 6 C17.2762651 8.18417673 20.19605266 9.04484272 23.94140625 10.12109375 C26 11 26 11 28 14 C23.91333648 13.25697027 19.94981078 12.29128429 16 11 C15.67 10.34 15.34 9.68 15 9 C12.6859378 8.26924352 10.35171131 7.59861742 8 7 C8 6.34 8 5.68 8 5 C5.69 4.67 3.38 4.34 1 4 C0.67 2.68 0.34 1.36 0 0 Z " fill="#778292" transform="translate(774,374)"/>
+<path d="M0 0 C2.0625 0.4375 2.0625 0.4375 4 1 C-1.13542212 5.25506404 -5.6710836 7.93341505 -12 10 C-13.03125 10.515625 -14.0625 11.03125 -15.125 11.5625 C-17.48906677 12.74453338 -19.42844149 13.50546952 -22 14 C-18.70341146 10.58567616 -15.76779828 7.698897 -11.3125 5.9375 C-8.84061395 5.23196154 -8.84061395 5.23196154 -8 3 C-5.67793475 2.29508733 -3.34406932 1.62787571 -1 1 C-0.67 0.67 -0.34 0.34 0 0 Z " fill="#8C96A4" transform="translate(1013,315)"/>
+<path d="M0 0 C6.01630549 1.58763617 10.31342524 3.74838414 15.15234375 7.64453125 C17.60306572 9.44241819 20.0861803 10.2053219 23 11 C25.76757105 12.07627763 26.7301188 12.54120195 28.25 15.125 C28.4975 15.74375 28.745 16.3625 29 17 C28.01 17 27.02 17 26 17 C26 16.34 26 15.68 26 15 C25.34 14.9175 24.68 14.835 24 14.75 C20.00960837 13.75240209 16.61450357 11.92833317 13 10 C13 9.01 13 8.02 13 7 C12.42636719 6.86335938 11.85273437 6.72671875 11.26171875 6.5859375 C9.070004 6.01813575 6.94988158 5.370878 4.8125 4.625 C4.11769531 4.39039062 3.42289063 4.15578125 2.70703125 3.9140625 C1 3 1 3 0 0 Z " fill="#BCC2CA" transform="translate(719,106)"/>
+<path d="M0 0 C1.32 0.33 2.64 0.66 4 1 C-1.38519551 7.60910358 -12.70779748 12.3415595 -21 14 C-20.34765625 12.12890625 -20.34765625 12.12890625 -19 10 C-16.43359375 8.83984375 -16.43359375 8.83984375 -13.4375 7.9375 C-10.49419344 7.10313324 -10.49419344 7.10313324 -8 6 C-7.67 5.01 -7.34 4.02 -7 3 C-6.030625 2.87625 -5.06125 2.7525 -4.0625 2.625 C-3.051875 2.41875 -2.04125 2.2125 -1 2 C-0.67 1.34 -0.34 0.68 0 0 Z " fill="#5278C4" transform="translate(695,1133)"/>
+<path d="M0 0 C0.495 0.99 0.495 0.99 1 2 C-2.13200328 3.6041968 -5.24323561 5.09990034 -8.5 6.4375 C-12.01719485 7.89061251 -12.01719485 7.89061251 -15 10 C-18.22995671 12.15330447 -21.40401082 13.54898682 -25 15 C-26.25024105 15.56196402 -27.50024627 16.12445306 -28.75 16.6875 C-32 18 -32 18 -35 18 C-32.77644774 15.4429149 -31.24981807 14.75829088 -28 14 C-27.67 13.34 -27.34 12.68 -27 12 C-24.67843403 11.59270772 -22.3431213 11.25561323 -20 11 C-20 10.34 -20 9.68 -20 9 C-18.989375 8.566875 -17.97875 8.13375 -16.9375 7.6875 C-16.298125 7.41292969 -15.65875 7.13835937 -15 6.85546875 C-13.14869017 6.0635999 -11.29326366 5.28137417 -9.4375 4.5 C-6.23133867 3.10094778 -3.11282959 1.59437613 0 0 Z " fill="#374D72" transform="translate(884,1036)"/>
+<path d="M0 0 C0.556875 0.226875 1.11375 0.45375 1.6875 0.6875 C-0.87235305 3.81620928 -3.52185755 4.49827884 -7.3125 5.6875 C-9.32097365 6.67037008 -11.32069591 7.67127342 -13.3125 8.6875 C-15.64374929 9.69234883 -17.97693537 10.69272247 -20.3125 11.6875 C-21.055 12.079375 -21.7975 12.47125 -22.5625 12.875 C-24.3125 13.6875 -24.3125 13.6875 -27.3125 13.6875 C-27.3125 14.3475 -27.3125 15.0075 -27.3125 15.6875 C-27.9725 15.3575 -28.6325 15.0275 -29.3125 14.6875 C-28.3125 12.6875 -28.3125 12.6875 -25.25 11.5625 C-23.7959375 11.129375 -23.7959375 11.129375 -22.3125 10.6875 C-22.3125 10.0275 -22.3125 9.3675 -22.3125 8.6875 C-21.508125 8.44 -20.70375 8.1925 -19.875 7.9375 C-14.51134755 6.05551668 -9.2878139 3.96048007 -4.5 0.875 C-2.3125 -0.3125 -2.3125 -0.3125 0 0 Z " fill="#415E92" transform="translate(891.3125,1031.3125)"/>
+<path d="M0 0 C2.64 0.33 5.28 0.66 8 1 C8 1.66 8 2.32 8 3 C8.680625 3.103125 9.36125 3.20625 10.0625 3.3125 C13.67054778 4.15693671 16.65617122 5.39239001 20 7 C20.33 7.66 20.66 8.32 21 9 C22.84971696 10.05021103 22.84971696 10.05021103 25 11 C28.88888889 12.77777778 28.88888889 12.77777778 30 15 C27.525 14.505 27.525 14.505 25 14 C25 13.34 25 12.68 25 12 C23.35 12 21.7 12 20 12 C19.67 11.34 19.34 10.68 19 10 C16.69034152 8.94647157 14.3570226 7.94280904 12 7 C12 6.34 12 5.68 12 5 C9.69 4.67 7.38 4.34 5 4 C5 3.34 5 2.68 5 2 C3.35 1.67 1.7 1.34 0 1 C0 0.67 0 0.34 0 0 Z " fill="#7E8898" transform="translate(339,418)"/>
+<path d="M0 0 C0.495 0.99 0.495 0.99 1 2 C-2 4 -2 4 -5 4 C-5.33 4.99 -5.66 5.98 -6 7 C-7.98 7 -9.96 7 -12 7 C-12.33 7.99 -12.66 8.98 -13 10 C-17.95 10 -22.9 10 -28 10 C-28.33 9.01 -28.66 8.02 -29 7 C-30.65 7 -32.3 7 -34 7 C-34.33 5.68 -34.66 4.36 -35 3 C-33.51960029 3.64300189 -32.04071218 4.28948499 -30.5625 4.9375 C-29.73878906 5.29714844 -28.91507813 5.65679687 -28.06640625 6.02734375 C-26 7 -26 7 -25 8 C-23.35769636 8.1245486 -21.70947724 8.17568524 -20.0625 8.1875 C-19.16660156 8.20167969 -18.27070312 8.21585937 -17.34765625 8.23046875 C-14.80885466 8.23194769 -14.80885466 8.23194769 -13 6 C-11 5.33333333 -9 4.66666667 -7 4 C-5.31008021 3.0398183 -3.63790712 2.04644066 -2 1 C-1.34 0.67 -0.68 0.34 0 0 Z " fill="#5C697D" transform="translate(857,396)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-2.39042858 4.42453429 -5.2902045 6.58221009 -11 7 C-11 8.32 -11 9.64 -11 11 C-12.98 11 -14.96 11 -17 11 C-17.33 11.99 -17.66 12.98 -18 14 C-19.134375 14.12375 -20.26875 14.2475 -21.4375 14.375 C-23.2009375 14.684375 -23.2009375 14.684375 -25 15 C-25.33 15.66 -25.66 16.32 -26 17 C-27.32 16.67 -28.64 16.34 -30 16 C-27.76758555 14.11103393 -26.0248175 13.00794718 -23.21875 12.109375 C-19.86438985 10.95326058 -17.15324023 9.46443505 -14.125 7.625 C-9.48902836 4.86878801 -4.93149032 2.19177347 0 0 Z " fill="#5780D2" transform="translate(967,371)"/>
+<path d="M0 0 C1.48117801 0.28127421 2.95993249 0.57533732 4.4375 0.875 C5.67306641 1.11863281 5.67306641 1.11863281 6.93359375 1.3671875 C7.61550781 1.57601563 8.29742187 1.78484375 9 2 C9.33 2.66 9.66 3.32 10 4 C14.2406158 5.61547269 18.63217177 6.77700809 23 8 C23.33 9.32 23.66 10.64 24 12 C22.68 12 21.36 12 20 12 C20 11.34 20 10.68 20 10 C19.175 9.9175 18.35 9.835 17.5 9.75 C13.85480993 8.96888784 11.15975684 7.71343372 7.8984375 5.9765625 C5.87163609 4.88287547 5.87163609 4.88287547 3.0625 3.9375 C2.381875 3.628125 1.70125 3.31875 1 3 C0.67 2.01 0.34 1.02 0 0 Z " fill="#9FA6B2" transform="translate(207,382)"/>
+<path d="M0 0 C0.99 0.33 1.98 0.66 3 1 C3.33 2.98 3.66 4.96 4 7 C4.99 7.33 5.98 7.66 7 8 C7.66015625 10.03125 7.66015625 10.03125 8.0625 12.5 C8.42516952 14.91007019 8.42516952 14.91007019 9 17 C9.66 17.33 10.32 17.66 11 18 C11.34375 20.14453125 11.34375 20.14453125 11.5 22.8125 C11.71499817 26.45134398 12.32639087 28.7841808 14 32 C13.625 34.25 13.625 34.25 13 36 C10.27386903 30.04992283 8.57796294 24.09358015 6.98242188 17.75976562 C5.75112645 13.0935943 4.16989316 8.9786689 1.88256836 4.72436523 C1 3 1 3 0 0 Z " fill="#C0C5CD" transform="translate(424,920)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-0.79854744 4.29240875 -4.20673275 6.03562946 -8 8 C-8.99 8 -9.98 8 -11 8 C-11 8.66 -11 9.32 -11 10 C-12.93108963 11.03290841 -14.870118 12.05098672 -16.8125 13.0625 C-17.89144531 13.63097656 -18.97039063 14.19945312 -20.08203125 14.78515625 C-23 16 -23 16 -26 15 C-25.67 14.34 -25.34 13.68 -25 13 C-23.7934375 12.7834375 -23.7934375 12.7834375 -22.5625 12.5625 C-19.65559342 12.23497283 -19.65559342 12.23497283 -18 9 C-16.67405895 8.63837971 -15.34061543 8.30271961 -14 8 C-13.67 7.34 -13.34 6.68 -13 6 C-11.328125 5.25390625 -11.328125 5.25390625 -9.25 4.5625 C-6.58922167 3.63265811 -4.56203979 2.73341553 -2.125 1.25 C-1.42375 0.8375 -0.7225 0.425 0 0 Z " fill="#C4D7FE" transform="translate(752,587)"/>
+<path d="M0 0 C8.96883924 1.24840986 16.85195843 7.74837762 24 13 C24.94875 13.556875 25.8975 14.11375 26.875 14.6875 C29 16 29 16 30 18 C23.87061739 16.3574857 20.43753284 14.6710872 16 10 C13.68895182 8.94952356 11.35416349 7.94992562 9 7 C6.84147934 5.78819893 4.98513872 4.50095854 3 3 C3 2.34 3 1.68 3 1 C2.01 0.67 1.02 0.34 0 0 Z " fill="#CADBFE" transform="translate(940,579)"/>
+<path d="M0 0 C1.64767247 0.28109113 3.29313145 0.57518526 4.9375 0.875 C5.85402344 1.03742188 6.77054687 1.19984375 7.71484375 1.3671875 C8.46894531 1.57601563 9.22304688 1.78484375 10 2 C10.33 2.66 10.66 3.32 11 4 C12.72996853 4.75074106 14.46196889 5.49777964 16.2109375 6.203125 C18.40050954 7.1783929 20.16930968 8.46222013 22 10 C16.57814191 10.2756877 13.49764122 10.34110491 9 7 C6.01353231 5.00902154 3.40312738 4.05875074 0 3 C0 2.01 0 1.02 0 0 Z " fill="#788493" transform="translate(397,447)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-1.76487846 4.30852956 -5.40358162 6.06466595 -10 8 C-10.94875 8.70125 -11.8975 9.4025 -12.875 10.125 C-16.8940907 12.53645442 -20.38845287 12.79504235 -25 13 C-25 13.66 -25 14.32 -25 15 C-25.66 14.67 -26.32 14.34 -27 14 C-25.49736177 10.99472353 -23.08347159 11.02782386 -20 10 C-19.67 9.34 -19.34 8.68 -19 8 C-18.030625 7.855625 -17.06125 7.71125 -16.0625 7.5625 C-14.5465625 7.2840625 -14.5465625 7.2840625 -13 7 C-12.34 6.01 -11.68 5.02 -11 4 C-7.875 3.8125 -7.875 3.8125 -5 4 C-5 3.34 -5 2.68 -5 2 C-2.625 0.9375 -2.625 0.9375 0 0 Z " fill="#4C6FB3" transform="translate(731,334)"/>
+<path d="M0 0 C12.57534247 3.8630137 12.57534247 3.8630137 16 9 C17.9812585 9.72045764 19.98504093 10.38001259 22 11 C27.81707317 13.63414634 27.81707317 13.63414634 29 16 C29.99 16.66 30.98 17.32 32 18 C28.46508101 17.67864373 26.3345527 16.65693982 23.5625 14.5625 C20.48705539 12.24593134 17.74171965 11.03494373 14 10 C11.98177598 9.39072482 9.97583715 8.73519522 8 8 C7.67 7.34 7.34 6.68 7 6 C6.195625 5.525625 5.39125 5.05125 4.5625 4.5625 C2 3 2 3 0 0 Z " fill="#6E7A8B" transform="translate(791,143)"/>
+<path d="M0 0 C5.0263346 1.54403742 9.58806394 3.05870929 14 6 C14.66 6.33 15.32 6.66 16 7 C16 7.66 16 8.32 16 9 C16.763125 8.9175 17.52625 8.835 18.3125 8.75 C19.6428125 8.87375 19.6428125 8.87375 21 9 C22.5 11 22.5 11 24 13 C26.5821435 14.5225388 29.26441992 15.7784108 32 17 C28.2734375 18.140625 28.2734375 18.140625 25.8125 16.875 C24.884375 16.25625 23.95625 15.6375 23 15 C21.40192345 14.09334714 19.79731185 13.19814884 18.1875 12.3125 C17.39730469 11.87550781 16.60710937 11.43851563 15.79296875 10.98828125 C15.20128906 10.66214844 14.60960937 10.33601563 14 10 C14 9.34 14 8.68 14 8 C13.319375 7.731875 12.63875 7.46375 11.9375 7.1875 C10.968125 6.795625 9.99875 6.40375 9 6 C7.783125 5.525625 6.56625 5.05125 5.3125 4.5625 C2 3 2 3 0 0 Z " fill="#CBCFD5" transform="translate(419,1116)"/>
+<path d="M0 0 C1.98 0 3.96 0 6 0 C6.33 0.66 6.66 1.32 7 2 C8.2375 2.495 8.2375 2.495 9.5 3 C12 4 12 4 13 6 C13.886875 6.28875 14.77375 6.5775 15.6875 6.875 C19.28894955 8.09813381 21.84707103 9.89804735 25 12 C28.2249208 13.24324147 28.2249208 13.24324147 31 14 C30.67 14.66 30.34 15.32 30 16 C28.32998743 15.28428033 26.66028834 14.56782027 24.9921875 13.84765625 C23.19264423 13.08196823 21.37829139 12.35131656 19.5625 11.625 C16.08765627 10.03998356 13.05010599 8.19893232 9.85546875 6.12890625 C7.90479206 4.87202428 7.90479206 4.87202428 5.1875 3.875 C2.84647043 2.93858817 1.63407315 1.8920847 0 0 Z " fill="#A7AEB9" transform="translate(359,1085)"/>
+<path d="M0 0 C-1.32 0.33 -2.64 0.66 -4 1 C-4 1.66 -4 2.32 -4 3 C-5.051875 3.14695312 -5.051875 3.14695312 -6.125 3.296875 C-11.64257429 4.16649269 -16.19569691 5.2910868 -21.08984375 7.984375 C-25.46691883 10.31165418 -30.1847702 11.86011153 -35 13 C-31.93745875 9.52219892 -29.11498955 7.97375358 -24.8125 6.3125 C-21.1362404 5.1013057 -21.1362404 5.1013057 -18 3 C-16.36197128 2.63021574 -14.71412956 2.30331217 -13.0625 2 C-1.97053015 -0.04283761 -1.97053015 -0.04283761 0 0 Z " fill="#557ECE" transform="translate(1083,320)"/>
+<path d="M0 0 C6.32532275 4.39497902 11.67248457 9.45050476 17 15 C15.2109375 15.6953125 15.2109375 15.6953125 13 16 C11.2890625 14.7421875 11.2890625 14.7421875 9.625 12.875 C7.38389661 10.44028076 5.20424346 8.3047368 2.5625 6.3125 C1.716875 5.549375 0.87125 4.78625 0 4 C0 2.68 0 1.36 0 0 Z " fill="#B8BEC7" transform="translate(377,963)"/>
+<path d="M0 0 C1.9375 0.5625 1.9375 0.5625 4 2 C4.75 5.625 4.75 5.625 5 9 C5.99 9.33 6.98 9.66 8 10 C8 11.32 8 12.64 8 14 C8.639375 14.2475 9.27875 14.495 9.9375 14.75 C12 16 12 16 12.625 18.0625 C12.74875 18.701875 12.8725 19.34125 13 20 C13.66 20.33 14.32 20.66 15 21 C15.72693904 22.97888961 16.39816251 24.97954558 17 27 C12.3125 23.38671875 12.3125 23.38671875 11 22 C11 21.01 11 20.02 11 19 C10.1028125 18.690625 10.1028125 18.690625 9.1875 18.375 C3.74909671 14.95657507 1.97426297 5.92278892 0 0 Z " fill="#7F8899" transform="translate(365,940)"/>
+<path d="M0 0 C4.46254673 0.65305562 8.71702233 1.57234078 13 3 C13.33 3.66 13.66 4.32 14 5 C17.02934491 5.65772428 17.02934491 5.65772428 20 6 C20.33 6.99 20.66 7.98 21 9 C22.98636298 9.70626239 24.98848259 10.36893571 27 11 C29.375 12.625 29.375 12.625 31 14 C26.125 13.125 26.125 13.125 25 12 C23.96875 11.938125 22.9375 11.87625 21.875 11.8125 C17.39090608 10.87228676 15.97060135 9.39459274 12.76171875 6.3515625 C10.09613984 4.30657292 7.27217764 4.3704352 4 4 C1.5625 1.9375 1.5625 1.9375 0 0 Z " fill="#737E8F" transform="translate(231,394)"/>
+<path d="M0 0 C-1.87824891 1.87824891 -5.03935276 1.39102397 -7.5625 1.5625 C-8.76003906 1.64628906 -9.95757812 1.73007813 -11.19140625 1.81640625 C-12.58166016 1.90728516 -12.58166016 1.90728516 -14 2 C-14.33 2.99 -14.66 3.98 -15 5 C-15.77085937 5.03738281 -16.54171875 5.07476562 -17.3359375 5.11328125 C-18.84027344 5.21189453 -18.84027344 5.21189453 -20.375 5.3125 C-21.37273437 5.37050781 -22.37046875 5.42851562 -23.3984375 5.48828125 C-24.25695312 5.65714844 -25.11546875 5.82601562 -26 6 C-26.99 7.485 -26.99 7.485 -28 9 C-29.65 8.67 -31.3 8.34 -33 8 C-30.42040522 4.77099674 -27.83075299 4.24240608 -23.875 3.375 C-20.12903172 2.80973147 -20.12903172 2.80973147 -17 1 C-14.51880533 0.57230883 -12.05705345 0.20207903 -9.5625 -0.125 C-8.52125977 -0.27388672 -8.52125977 -0.27388672 -7.45898438 -0.42578125 C-2.24472403 -1.12236201 -2.24472403 -1.12236201 0 0 Z " fill="#576479" transform="translate(516,188)"/>
+<path d="M0 0 C0.99 0 1.98 0 3 0 C3.103125 0.928125 3.20625 1.85625 3.3125 2.8125 C3.67465323 5.97794817 3.67465323 5.97794817 5.5625 7.4375 C7 9 7 9 7.1875 12.6875 C7.125625 13.780625 7.06375 14.87375 7 16 C8.32 16.33 9.64 16.66 11 17 C11.144375 18.051875 11.28875 19.10375 11.4375 20.1875 C11.87526966 23.15460549 12.37804866 26.06794366 13 29 C8.87380502 23.89137765 6.48556755 17.9205958 3.8671875 11.953125 C3.27581509 10.62120515 2.65172568 9.30345136 2 8 C1.95977609 5.6670134 1.95679753 3.33293334 2 1 C1.34 0.67 0.68 0.34 0 0 Z " fill="#657085" transform="translate(301,793)"/>
+<path d="M0 0 C4.58200097 0.53905894 7.24312676 2.39908776 11 5 C12.44994135 5.82738289 13.90896112 6.63898741 15.375 7.4375 C18.42812893 9.11646261 21.45523944 10.82265378 24.4375 12.625 C25.07558594 13.00914062 25.71367188 13.39328125 26.37109375 13.7890625 C28 15 28 15 30 18 C25.55183344 17.468154 23.02612439 15.82902235 19.5 13.125 C14.59752978 9.3930634 9.5746572 6.28749726 4.1875 3.3125 C3.00220703 2.65701172 3.00220703 2.65701172 1.79296875 1.98828125 C1.20128906 1.66214844 0.60960937 1.33601562 0 1 C0 0.67 0 0.34 0 0 Z " fill="#BCD2FE" transform="translate(970,597)"/>
+<path d="M0 0 C2.64 0 5.28 0 8 0 C8 0.99 8 1.98 8 3 C8.90492188 2.94779297 8.90492188 2.94779297 9.828125 2.89453125 C14.7982784 2.72618734 17.08389971 2.81816851 21 6 C23.18465053 6.64228726 25.3718452 7.08654574 27.60546875 7.52734375 C31.10576295 8.21826642 34.54295823 9.12002573 38 10 C38 10.33 38 10.66 38 11 C36.14375 11.061875 36.14375 11.061875 34.25 11.125 C33.20585938 11.15980469 33.20585938 11.15980469 32.140625 11.1953125 C29.67005545 10.96989557 28.18843356 10.13849145 26 9 C23.65220583 8.43179435 21.30134739 7.99795566 18.92578125 7.5625 C18.29027344 7.376875 17.65476562 7.19125 17 7 C16.67 6.34 16.34 5.68 16 5 C13.19019327 4.30772968 13.19019327 4.30772968 9.9375 3.875 C8.28041016 3.62363281 8.28041016 3.62363281 6.58984375 3.3671875 C5.73519531 3.24601562 4.88054687 3.12484375 4 3 C4 2.34 4 1.68 4 1 C2.68 0.67 1.36 0.34 0 0 Z " fill="#446299" transform="translate(481,353)"/>
+<path d="M0 0 C0.33 0.66 0.66 1.32 1 2 C-2.42771102 3.84569055 -5.801204 5.31713631 -9.5 6.5 C-14.13825656 7.99394098 -18.50005616 9.50005616 -22 13 C-24.125 12.625 -24.125 12.625 -26 12 C-22.70708299 8.04849959 -19.85760566 7.3763216 -15 6 C-13.64360096 5.18295648 -12.31045193 4.32637243 -11 3.4375 C-7.26156668 0.95494662 -4.45396982 0.27837311 0 0 Z " fill="#5F6C7F" transform="translate(946,352)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C0.58833114 1.98635837 -0.82956184 2.96381255 -2.25 3.9375 C-3.43335938 4.75541016 -3.43335938 4.75541016 -4.640625 5.58984375 C-7 7 -7 7 -9.234375 7.50390625 C-9.81703125 7.66761719 -10.3996875 7.83132813 -11 8 C-11.33 8.99 -11.66 9.98 -12 11 C-13.98 11.33 -15.96 11.66 -18 12 C-18.33 12.99 -18.66 13.98 -19 15 C-20.98 15 -22.96 15 -25 15 C-25.33 15.99 -25.66 16.98 -26 18 C-27.98 18 -29.96 18 -32 18 C-26 14 -26 14 -23.3125 13.1875 C-19.93307011 11.97600627 -17.35500563 10.44494549 -14.359375 8.51171875 C-11.47709697 6.66496114 -8.56128857 4.88466576 -5.625 3.125 C-4.60664062 2.50882812 -3.58828125 1.89265625 -2.5390625 1.2578125 C-1.70117188 0.84273438 -0.86328125 0.42765625 0 0 Z " fill="#59667A" transform="translate(1028,309)"/>
+<path d="M0 0 C2.58979477 -0.29213973 4.93709467 -0.39623204 7.52734375 -0.36328125 C8.27206436 -0.36377975 9.01678497 -0.36427826 9.78407288 -0.36479187 C11.36022609 -0.36244995 12.93638293 -0.35271439 14.51245117 -0.33618164 C16.92465714 -0.31262542 19.33575542 -0.31561477 21.74804688 -0.32226562 C23.27865242 -0.31668762 24.80925331 -0.30957697 26.33984375 -0.30078125 C27.06179428 -0.30169266 27.78374481 -0.30260406 28.52757263 -0.30354309 C32.22784107 -0.25121405 33.83943367 -0.10704422 37 2 C35.86739746 1.99214478 35.86739746 1.99214478 34.71191406 1.98413086 C31.22461816 1.96308775 27.73733569 1.9502541 24.25 1.9375 C23.06277344 1.92912109 21.87554688 1.92074219 20.65234375 1.91210938 C13.04697478 1.89132968 5.56658475 2.22855624 -2 3 C-1.34 2.01 -0.68 1.02 0 0 Z " fill="#616D80" transform="translate(560,43)"/>
+<path d="M0 0 C0.33 0 0.66 0 1 0 C2.29675642 21.90805838 2.29675642 21.90805838 -2.1875 27.625 C-4.1171875 29.50390625 -4.1171875 29.50390625 -6 31 C-7.3921875 32.2684375 -7.3921875 32.2684375 -8.8125 33.5625 C-11 35 -11 35 -13 35 C-13 35.66 -13 36.32 -13 37 C-14.98 37.495 -14.98 37.495 -17 38 C-15.28233375 33.82852483 -13.15538334 32.7251962 -9.265625 30.734375 C-5.00740018 27.47463048 -1.59634176 23.72831444 -0.42773438 18.38183594 C-0.19097299 15.57352757 -0.11722634 12.81795077 -0.125 10 C-0.104375 9.03449219 -0.08375 8.06898438 -0.0625 7.07421875 C-0.01578817 4.7152715 0.00447808 2.35931094 0 0 Z " fill="#B0B6C1" transform="translate(420,626)"/>
+<path d="M0 0 C1.48199902 0.44909061 2.96055236 0.90956564 4.4375 1.375 C5.26121094 1.63023437 6.08492188 1.88546875 6.93359375 2.1484375 C9 3 9 3 10 5 C13.24116794 6.85209597 16.20823519 8.05803276 19.8125 9.0625 C20.864375 9.371875 21.91625 9.68125 23 10 C23.33 10.66 23.66 11.32 24 12 C24.99 12.66 25.98 13.32 27 14 C22.91333648 13.25697027 18.94981078 12.29128429 15 11 C14.67 10.34 14.34 9.68 14 9 C12.11235097 8.31527335 12.11235097 8.31527335 9.9375 7.875 C9.20402344 7.70742188 8.47054688 7.53984375 7.71484375 7.3671875 C7.14894531 7.24601562 6.58304687 7.12484375 6 7 C5.67 5.68 5.34 4.36 5 3 C4.360625 2.87625 3.72125 2.7525 3.0625 2.625 C2.381875 2.41875 1.70125 2.2125 1 2 C0.67 1.34 0.34 0.68 0 0 Z " fill="#8C95A3" transform="translate(459,477)"/>
+<path d="M0 0 C0 6.93 0 13.86 0 21 C-0.99 20.67 -1.98 20.34 -3 20 C-3 13.73 -3 7.46 -3 1 C-1 0 -1 0 0 0 Z " fill="#D1D5DB" transform="translate(385,277)"/>
+<path d="M0 0 C1.33333333 0.66666667 2.66666667 1.33333333 4 2 C4.886875 2.4125 5.77375 2.825 6.6875 3.25 C12.64110839 6.39530255 18.50291956 9.91634385 23 15 C18.98966393 14.38302522 16.31577651 12.23307398 13 10 C12.071875 9.649375 11.14375 9.29875 10.1875 8.9375 C9.465625 8.628125 8.74375 8.31875 8 8 C7.67 7.01 7.34 6.02 7 5 C6.21625 5.04125 5.4325 5.0825 4.625 5.125 C2 5 2 5 0 3 C0 2.01 0 1.02 0 0 Z " fill="#727D8E" transform="translate(299,1051)"/>
+<path d="M0 0 C1.98 0 3.96 0 6 0 C2.98015857 2.60041901 0.84592281 4.10261801 -3 5 C-3.4125 5.44085937 -3.825 5.88171875 -4.25 6.3359375 C-6.5539728 8.52676878 -9.02125694 9.6712113 -11.875 11.0625 C-12.90367187 11.56910156 -13.93234375 12.07570313 -14.9921875 12.59765625 C-17.63403525 13.82937488 -20.28737815 14.93669004 -23 16 C-23.66 16.33 -24.32 16.66 -25 17 C-24.25 15.0625 -24.25 15.0625 -23 13 C-20.9375 12.375 -20.9375 12.375 -19 12 C-18.67 11.34 -18.34 10.68 -18 10 C-16.32626673 9.56482935 -14.65226011 9.13066925 -12.9765625 8.703125 C-10.11059698 7.68361158 -7.9518266 5.99010646 -5.578125 4.12109375 C-4 3 -4 3 -1 2 C-0.67 1.34 -0.34 0.68 0 0 Z " fill="#537AC7" transform="translate(1025,954)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C1.34 1.66 0.68 2.32 0 3 C-0.99 3 -1.98 3 -3 3 C-3.33 3.99 -3.66 4.98 -4 6 C-5.98 6 -7.96 6 -10 6 C-10.33 6.99 -10.66 7.98 -11 9 C-12.98 9.33 -14.96 9.66 -17 10 C-17.33 10.99 -17.66 11.98 -18 13 C-19.98 13 -21.96 13 -24 13 C-24.33 13.99 -24.66 14.98 -25 16 C-26.98 16 -28.96 16 -31 16 C-25 12 -25 12 -22.3125 11.1875 C-19.46210733 10.16566112 -17.50002134 9.13003303 -15 7.5 C-11.75291747 5.38475767 -8.71267041 4.15505302 -5 3 C-4.0925 2.443125 -3.185 1.88625 -2.25 1.3125 C-1.13625 0.6628125 -1.13625 0.6628125 0 0 Z " fill="#46556C" transform="translate(917,366)"/>
+<path d="M0 0 C-3.625 3 -3.625 3 -7 3 C-7 3.66 -7 4.32 -7 5 C-8.11375 5.53625 -9.2275 6.0725 -10.375 6.625 C-14.73229294 8.78030383 -18.80522402 11.30891257 -22.8984375 13.92578125 C-23.59195313 14.28027344 -24.28546875 14.63476562 -25 15 C-25.66 14.67 -26.32 14.34 -27 14 C-26.195625 13.566875 -25.39125 13.13375 -24.5625 12.6875 C-21.72153646 11.19525998 -21.72153646 11.19525998 -21 8 C-20.195625 7.87625 -19.39125 7.7525 -18.5625 7.625 C-17.716875 7.41875 -16.87125 7.2125 -16 7 C-15.67 6.34 -15.34 5.68 -15 5 C-13.33333333 4.33333333 -11.66666667 3.66666667 -10 3 C-9.67 2.34 -9.34 1.68 -9 1 C-2.49462366 -1.24731183 -2.49462366 -1.24731183 0 0 Z " fill="#B8CFFE" transform="translate(901,836)"/>
+<path d="M0 0 C0.55429687 0.2784375 1.10859375 0.556875 1.6796875 0.84375 C3.28496753 1.64368752 4.89466836 2.4347921 6.5078125 3.21875 C7.37148438 3.6415625 8.23515625 4.064375 9.125 4.5 C9.99382813 4.9228125 10.86265625 5.345625 11.7578125 5.78125 C14 7 14 7 16 9 C16.845625 9.165 17.69125 9.33 18.5625 9.5 C19.366875 9.665 20.17125 9.83 21 10 C21.33 10.66 21.66 11.32 22 12 C24.02463255 12.65213292 24.02463255 12.65213292 26 13 C26 13.66 26 14.32 26 15 C23.99504414 14.34838935 21.99640639 13.67735217 20 13 C19.3503125 12.78214844 18.700625 12.56429687 18.03125 12.33984375 C11.01099614 9.86925441 5.54897684 5.88838436 0 1 C0 0.67 0 0.34 0 0 Z " fill="#90B4FD" transform="translate(901,638)"/>
+<path d="M0 0 C4.77859327 0.58275528 8.63935766 1.9811841 13 4 C13.7425 4.28875 14.485 4.5775 15.25 4.875 C17.691485 6.44452607 18.66770603 8.46864146 20 11 C16.44765442 10.39102647 13.2668126 9.54266151 10 8 C9.67 7.34 9.34 6.68 9 6 C7.7625 5.5359375 7.7625 5.5359375 6.5 5.0625 C5.675 4.711875 4.85 4.36125 4 4 C3.67 3.01 3.34 2.02 3 1 C2.01 0.67 1.02 0.34 0 0 Z " fill="#BCD2FE" transform="translate(1018,611)"/>
+<path d="M0 0 C1.18529297 0.02707031 1.18529297 0.02707031 2.39453125 0.0546875 C2.98621094 0.07789063 3.57789063 0.10109375 4.1875 0.125 C4.1875 0.455 4.1875 0.785 4.1875 1.125 C-3.55773791 3.58641035 -11.16901793 4.8086291 -19.2109375 5.6953125 C-22.12962112 6.04352855 -24.9448026 6.49388513 -27.8125 7.125 C-27.30078125 5.1640625 -27.30078125 5.1640625 -25.8125 3.125 C-23.09679361 2.70905385 -20.72154541 2.51938768 -18 2.5 C-11.68260218 2.38565796 -6.14104533 -0.18331479 0 0 Z " fill="#536176" transform="translate(673.8125,382.875)"/>
+<path d="M0 0 C6.88483636 1.50920212 11.499922 3.81721638 16.8828125 8.34765625 C19.76245509 10.59505259 22.58029989 11.7630872 26 13 C23.5332355 13.88336837 22.36140628 14.1312406 19.859375 13.22265625 C19.16328125 12.83980469 18.4671875 12.45695312 17.75 12.0625 C17.04359375 11.68222656 16.3371875 11.30195313 15.609375 10.91015625 C15.07828125 10.60980469 14.5471875 10.30945313 14 10 C14 9.34 14 8.68 14 8 C12.35 8 10.7 8 9 8 C8.67 6.68 8.34 5.36 8 4 C6.02 4 4.04 4 2 4 C1.34 2.68 0.68 1.36 0 0 Z " fill="#D3D6DC" transform="translate(171,364)"/>
+<path d="M0 0 C4.79218334 1.06492963 8.24745203 2.37031701 12.0625 5.5625 C14.6802775 8.0925371 14.6802775 8.0925371 17.25 8.5625 C19 9 19 9 20.25 11.0625 C20.4975 11.701875 20.745 12.34125 21 13 C12.6910299 11.22923588 12.6910299 11.22923588 10 8 C7.90010348 6.82425289 7.90010348 6.82425289 6 6 C6 5.34 6 4.68 6 4 C5.38125 3.896875 4.7625 3.79375 4.125 3.6875 C2 3 2 3 0 0 Z " fill="#BED3FE" transform="translate(695,639)"/>
+<path d="M0 0 C10.4040404 2.84848485 10.4040404 2.84848485 15 6 C17.94736444 7.93905555 20.18999262 9.05241176 23.625 10 C26.78970827 10.93769134 28.03317771 11.45470056 30 14 C27.03 13.505 27.03 13.505 24 13 C24 12.34 24 11.68 24 11 C22.329375 11.061875 22.329375 11.061875 20.625 11.125 C17 11 17 11 15 9 C14.319375 8.835 13.63875 8.67 12.9375 8.5 C12.298125 8.335 11.65875 8.17 11 8 C10.67 7.34 10.34 6.68 10 6 C7.92020794 4.94558944 7.92020794 4.94558944 5.5 4 C1.11111111 2.22222222 1.11111111 2.22222222 0 0 Z " fill="#BFC4CC" transform="translate(374,467)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-2.79054395 4.72597863 -7.23263288 7.11677808 -13 9 C-16.19172169 10.50198668 -19.06329881 12.04219921 -22 14 C-23.98723268 14.70381157 -25.98777953 15.3711811 -28 16 C-28.99 16.33 -29.98 16.66 -31 17 C-31 16.34 -31 15.68 -31 15 C-29.989375 14.5875 -28.97875 14.175 -27.9375 13.75 C-23.28540623 11.75489474 -18.60860963 9.60860963 -15 6 C-13.05809572 5.53920915 -11.11551387 5.0808665 -9.16796875 4.64453125 C-6.89477337 3.96871641 -5.14464669 3.0446115 -3.125 1.8125 C-2.09375 1.214375 -1.0625 0.61625 0 0 Z " fill="#909AA7" transform="translate(904,371)"/>
+<path d="M0 0 C3.68774807 0.50287474 6.85682422 0.94067793 10 3 C10.45375 3.639375 10.9075 4.27875 11.375 4.9375 C14.19404139 8.51551408 18.07027532 9.70178642 22.3125 11.0625 C25 12 25 12 26 14 C22.37 13.01 18.74 12.02 15 11 C15 10.34 15 9.68 15 9 C12.03 8.505 12.03 8.505 9 8 C8.67 7.01 8.34 6.02 8 5 C6.68 5 5.36 5 4 5 C1.75 2.5 1.75 2.5 0 0 Z " fill="#727D8E" transform="translate(174,332)"/>
+<path d="M0 0 C4.7070106 -0.32839609 7.1464373 0.29209107 11 3 C13.91765 4.9451 15.62537285 5.45276317 19 6 C19.33 6.99 19.66 7.98 20 9 C21.99571323 9.67939174 23.99594773 10.34561559 26 11 C26.99 12.485 26.99 12.485 28 14 C26.53633658 13.60246179 25.0791065 13.18118616 23.625 12.75 C22.40683594 12.40195313 22.40683594 12.40195313 21.1640625 12.046875 C18.54214546 10.7785108 18.00617682 9.67576692 17 7 C15.69675781 7.0928125 15.69675781 7.0928125 14.3671875 7.1875 C10.49081623 6.97164638 8.45310542 5.94815927 5.125 4 C4.15820312 3.443125 3.19140625 2.88625 2.1953125 2.3125 C1.47085937 1.879375 0.74640625 1.44625 0 1 C0 0.67 0 0.34 0 0 Z " fill="#CFD3D8" transform="translate(390,1102)"/>
+<path d="M0 0 C0.556875 0.2475 1.11375 0.495 1.6875 0.75 C0.615 1.348125 -0.4575 1.94625 -1.5625 2.5625 C-3.71416528 3.78148779 -5.60349612 4.97633031 -7.5625 6.5 C-9.3125 7.75 -9.3125 7.75 -12.3125 7.75 C-12.333125 8.348125 -12.35375 8.94625 -12.375 9.5625 C-13.3125 11.75 -13.3125 11.75 -16.375 13.375 C-20.2721115 14.85460872 -24.25249538 15.82403404 -28.3125 16.75 C-25.78213112 12.95444669 -23.53175236 12.3044614 -19.3125 10.75 C-18.3225 10.75 -17.3325 10.75 -16.3125 10.75 C-16.3125 10.09 -16.3125 9.43 -16.3125 8.75 C-15.72082031 8.43546875 -15.12914062 8.1209375 -14.51953125 7.796875 C-10.9118877 5.84297996 -7.646576 4.03210862 -4.5 1.375 C-2.3125 -0.25 -2.3125 -0.25 0 0 Z " fill="#97B9FD" transform="translate(925.3125,927.25)"/>
+<path d="M0 0 C3.03899538 1.45871778 5.94664394 3.11133508 8.87109375 4.78515625 C9.57363281 5.18605469 10.27617188 5.58695313 11 6 C11.89847656 6.51433594 12.79695312 7.02867187 13.72265625 7.55859375 C15.15931641 8.36490234 15.15931641 8.36490234 16.625 9.1875 C17.52476562 9.69667969 18.42453125 10.20585938 19.3515625 10.73046875 C21.94184792 12.10692882 21.94184792 12.10692882 24.75390625 12.546875 C25.49511719 12.69640625 26.23632812 12.8459375 27 13 C28.3125 15.0625 28.3125 15.0625 29 17 C28.46117187 16.70867188 27.92234375 16.41734375 27.3671875 16.1171875 C24.67375533 14.84602974 21.97096448 14.00123843 19.125 13.125 C14.46476731 11.60003985 10.80602613 10.08596713 7 7 C6.67 6.34 6.34 5.68 6 5 C5.175 4.505 4.35 4.01 3.5 3.5 C1 2 1 2 0 0 Z " fill="#B9D0FE" transform="translate(715,872)"/>
+<path d="M0 0 C0.52722656 0.24234375 1.05445313 0.4846875 1.59765625 0.734375 C0.60765625 1.064375 -0.38234375 1.394375 -1.40234375 1.734375 C-2.39234375 3.219375 -2.39234375 3.219375 -3.40234375 4.734375 C-5.49609375 6.05078125 -5.49609375 6.05078125 -7.90234375 7.296875 C-10.49853361 8.64975965 -12.32167085 9.6537021 -14.40234375 11.734375 C-17.03468167 12.5906777 -19.69781193 13.12367427 -22.40234375 13.734375 C-20.21394349 10.4517746 -18.77966183 9.64803068 -15.40234375 7.734375 C-13.82259766 6.70570313 -13.82259766 6.70570313 -12.2109375 5.65625 C-11.65857422 5.30046875 -11.10621094 4.9446875 -10.53710938 4.578125 C-9.39568677 3.84257073 -8.26030107 3.09757166 -7.13085938 2.34375 C-2.93684229 -0.32472403 -2.93684229 -0.32472403 0 0 Z " fill="#88AEFD" transform="translate(1051.40234375,855.265625)"/>
+<path d="M0 0 C1.32 0 2.64 0 4 0 C4.33 0.66 4.66 1.32 5 2 C6.155 2.165 7.31 2.33 8.5 2.5 C9.655 2.665 10.81 2.83 12 3 C12.33 3.66 12.66 4.32 13 5 C17.99911924 4.52389341 20.97832683 2.96837781 25 0 C25.66 0.33 26.32 0.66 27 1 C24.85199157 3.36280927 22.83319533 4.58340234 20 6 C19.67 6.66 19.34 7.32 19 8 C11.45537597 8.37104708 11.45537597 8.37104708 9.3125 6.625 C8.879375 6.08875 8.44625 5.5525 8 5 C6.7625 4.505 6.7625 4.505 5.5 4 C2.98070765 2.99228306 1.75100055 2.02747432 0 0 Z " fill="#A5C2FD" transform="translate(840,724)"/>
+<path d="M0 0 C5.70687252 -0.20381688 10.49864993 0.45126069 16 2 C17.97766323 2.50591385 19.95695421 3.0054911 21.9375 3.5 C22.95199219 3.75394531 23.96648438 4.00789062 25.01171875 4.26953125 C28.99514778 5.24325835 32.9923679 6.13167971 37 7 C37 7.33 37 7.66 37 8 C35.39620659 8.05416188 33.79188594 8.09286638 32.1875 8.125 C31.29417969 8.14820313 30.40085937 8.17140625 29.48046875 8.1953125 C27 8 27 8 24 6 C21.8868096 5.59854958 19.75853829 5.27340536 17.625 5 C13.40304683 4.45648419 9.91057594 3.66549231 6 2 C4.0075675 1.62406934 2.0081326 1.28020455 0 1 C0 0.67 0 0.34 0 0 Z " fill="#8F98A5" transform="translate(651,184)"/>
+<path d="M0 0 C0.391875 0.45375 0.78375 0.9075 1.1875 1.375 C2.93339098 3.14134108 2.93339098 3.14134108 5.375 3.875 C8 5 8 5 10.375 7.5 C13.46053401 10.43860382 15.92609171 10.98152293 20 12 C20.33 12.66 20.66 13.32 21 14 C21.99 14.66 22.98 15.32 24 16 C19.11344244 15.38918031 15.2943443 13.24861335 11 11 C9.948125 10.505 8.89625 10.01 7.8125 9.5 C4.8380759 7.91364048 2.42198981 6.35075482 0 4 C0 2.68 0 1.36 0 0 Z " fill="#969FAB" transform="translate(345,152)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-2.36045937 5.76317695 -8.89769859 9.02572601 -15 11 C-15.99 11 -16.98 11 -18 11 C-18 11.66 -18 12.32 -18 13 C-18.66 13 -19.32 13 -20 13 C-20 11.68 -20 10.36 -20 9 C-19.195625 8.87625 -18.39125 8.7525 -17.5625 8.625 C-16.716875 8.41875 -15.87125 8.2125 -15 8 C-14.67 7.34 -14.34 6.68 -14 6 C-12.01463373 5.29094062 -10.01089078 4.63305821 -8 4 C-3.68203758 2.50303351 -3.68203758 2.50303351 0 0 Z " fill="#86909F" transform="translate(425,109)"/>
+<path d="M0 0 C4.00010733 3.23818212 5.29248744 8.05434047 7 12.75 C7.8317159 15.03034043 7.8317159 15.03034043 9.48828125 16.34765625 C11.37489486 18.4097688 11.67397804 19.96188345 12.1875 22.6875 C12.34605469 23.49574219 12.50460937 24.30398438 12.66796875 25.13671875 C12.77753906 25.75160156 12.88710938 26.36648438 13 27 C12.01 26.67 11.02 26.34 10 26 C9.67 24.02 9.34 22.04 9 20 C8.01 19.67 7.02 19.34 6 19 C5.67 16.69 5.34 14.38 5 12 C4.01 11.67 3.02 11.34 2 11 C0.60955102 7.12137916 0 4.13537997 0 0 Z " fill="#868FA0" transform="translate(403,876)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C1 4 1 4 -1.5625 5.5 C-4.67598502 6.85861164 -7.7928314 8.08494841 -10.984375 9.2421875 C-12.92167954 9.97055394 -14.79900367 10.77928208 -16.6875 11.625 C-19.51899137 12.80033604 -21.98483875 13.54315739 -25 14 C-19.1478298 9.15105898 -14.34367299 6.60597222 -7 5 C-5.66571665 4.67049002 -4.33210275 4.33821762 -3 4 C-3 3.34 -3 2.68 -3 2 C-2.01 1.34 -1.02 0.68 0 0 Z " fill="#687587" transform="translate(726,460)"/>
+<path d="M0 0 C2.0625 0.4375 2.0625 0.4375 4 1 C3.01 1.33 2.02 1.66 1 2 C0.67 2.66 0.34 3.32 0 4 C-1.99571323 4.67939174 -3.99594773 5.34561559 -6 6 C-6.66 6.66 -7.32 7.32 -8 8 C-8.845625 8.165 -9.69125 8.33 -10.5625 8.5 C-11.366875 8.665 -12.17125 8.83 -13 9 C-13.33 9.66 -13.66 10.32 -14 11 C-15.32 11 -16.64 11 -18 11 C-17.67 9.35 -17.34 7.7 -17 6 C-15.88625 5.87625 -14.7725 5.7525 -13.625 5.625 C-9.96896323 5.3534187 -9.96896323 5.3534187 -8 3 C-5.67451993 2.30643577 -3.34119555 1.63850788 -1 1 C-0.67 0.67 -0.34 0.34 0 0 Z " fill="#496AA9" transform="translate(907,401)"/>
+<path d="M0 0 C1.65 0 3.3 0 5 0 C5.33 0.66 5.66 1.32 6 2 C10.73901307 4.55407862 15.86427902 6.41977816 21 8 C21 8.66 21 9.32 21 10 C22.27875 10.144375 23.5575 10.28875 24.875 10.4375 C27.25692894 10.70642746 28.84452691 10.92226346 31 12 C31 12.66 31 13.32 31 14 C29.37181054 13.77169299 27.7473651 13.51656424 26.125 13.25 C25.22007812 13.11078125 24.31515625 12.9715625 23.3828125 12.828125 C21 12 21 12 19.89453125 9.9453125 C19.59933594 9.30335938 19.30414063 8.66140625 19 8 C17.15003555 7.7981857 15.29804096 7.60697977 13.44140625 7.48046875 C8.51080394 6.51012622 4.26431492 3.56329224 0 1 C0 0.67 0 0.34 0 0 Z " fill="#707B8D" transform="translate(451,366)"/>
+<path d="M0 0 C-3.85205427 4.25753367 -8.46850547 6.58770352 -14 8 C-16.375 7.625 -16.375 7.625 -18 7 C-17.67 6.01 -17.34 5.02 -17 4 C-16.030625 3.87625 -15.06125 3.7525 -14.0625 3.625 C-13.051875 3.41875 -12.04125 3.2125 -11 3 C-10.67 2.34 -10.34 1.68 -10 1 C-6.3241179 -0.55203911 -3.80989402 -1.46534385 0 0 Z " fill="#818B9A" transform="translate(509,66)"/>
+<path d="M0 0 C4.40219569 0.66699935 8.00855246 2.08103484 12 4 C12.33 4.66 12.66 5.32 13 6 C14.97522846 7.04808041 16.97481509 8.0520411 19 9 C19 9.66 19 10.32 19 11 C19.99 11 20.98 11 22 11 C22.33 11.66 22.66 12.32 23 13 C23.99 13.33 24.98 13.66 26 14 C29 15 29 15 30 17 C24.61445149 15.80321144 21.04019282 14.09592493 16.875 10.4296875 C13.69189335 8.00256868 10.13172789 6.2671419 6.5859375 4.4296875 C4.20770322 3.1148329 2.1253574 1.68631643 0 0 Z " fill="#8DB2FD" transform="translate(803,923)"/>
+<path d="M0 0 C4.49670551 0.42156614 7.41256881 2.39602645 11.08984375 4.80859375 C13.03945319 6.10621686 13.03945319 6.10621686 15.5625 7 C19.12856915 8.46300273 21.91244133 10.69946609 25 13 C23.68 13.33 22.36 13.66 21 14 C21 13.34 21 12.68 21 12 C20.42765625 11.87753906 19.8553125 11.75507812 19.265625 11.62890625 C16.90046809 10.97237132 14.92793203 10.06276488 12.75 8.9375 C12.04359375 8.57527344 11.3371875 8.21304688 10.609375 7.83984375 C10.07828125 7.56269531 9.5471875 7.28554688 9 7 C9 6.34 9 5.68 9 5 C8.2575 4.71125 7.515 4.4225 6.75 4.125 C4.43260203 3.17697356 2.22082885 2.15154089 0 1 C0 0.67 0 0.34 0 0 Z " fill="#B8CFFE" transform="translate(779,810)"/>
+<path d="M0 0 C0.8971875 0.309375 0.8971875 0.309375 1.8125 0.625 C0.11979167 1.56901042 -1.57291667 2.51302083 -3.265625 3.45703125 C-5.23759119 4.60830962 -5.23759119 4.60830962 -7.125 6.109375 C-9.31347851 7.71757512 -11.49610213 8.87678925 -13.9375 10.0625 C-14.80632813 10.48789062 -15.67515625 10.91328125 -16.5703125 11.3515625 C-17.43398438 11.77179687 -18.29765625 12.19203125 -19.1875 12.625 C-20.73015745 13.39384857 -22.27193138 14.16447447 -23.8125 14.9375 C-24.92625 15.494375 -26.04 16.05125 -27.1875 16.625 C-26.1875 13.625 -26.1875 13.625 -23.625 12.25 C-22.490625 11.71375 -21.35625 11.1775 -20.1875 10.625 C-18.86455236 9.8296246 -17.55241068 9.01607644 -16.25 8.1875 C-13.65728585 6.53849407 -11.049823 4.94984718 -8.375 3.4375 C-1.79007381 -0.3068698 -1.79007381 -0.3068698 0 0 Z " fill="#A9C5FD" transform="translate(901.1875,714.375)"/>
+<path d="M0 0 C6.75 0.75 6.75 0.75 9 3 C10.3303125 3.4021875 10.3303125 3.4021875 11.6875 3.8125 C14.60586153 4.85870508 16.11830123 5.72473687 18.5 7.5625 C21.59211978 9.90397155 24.07231176 10.71260818 28 11 C28.33 12.32 28.66 13.64 29 15 C28.01 14.67 27.02 14.34 26 14 C26 13.34 26 12.68 26 12 C24.89785156 12.08894531 24.89785156 12.08894531 23.7734375 12.1796875 C20.47538127 11.96601062 19.23585528 11.0949233 16.625 9.125 C12.82247038 6.42785689 9.5502706 5.13756765 5 4 C2.0625 2.4375 2.0625 2.4375 0 1 C0 0.67 0 0.34 0 0 Z " fill="#556277" transform="translate(749,389)"/>
+<path d="M0 0 C2.63311833 0.97801538 4.94982155 1.96745182 7.3125 3.5 C10.14741384 5.08227749 12.78218498 5.63399897 15.9296875 6.328125 C19.50050833 7.48695742 22.07594063 9.68511966 25 12 C21.76958469 12 19.7938486 11.09648624 16.890625 9.78515625 C14.77186183 8.85666632 14.77186183 8.85666632 11.5 8.0625 C7.44707775 6.8321486 4.53335805 5.33201631 1 3 C0.67 2.01 0.34 1.02 0 0 Z " fill="#D3D6DC" transform="translate(745,388)"/>
+<path d="M0 0 C2.9375 0.375 2.9375 0.375 6 1 C6.33 1.66 6.66 2.32 7 3 C8.485 3.2475 8.485 3.2475 10 3.5 C11.485 3.7475 11.485 3.7475 13 4 C13.33 4.66 13.66 5.32 14 6 C15.97888961 6.72693904 17.97954558 7.39816251 20 8 C20 8.66 20 9.32 20 10 C21.32 10 22.64 10 24 10 C24 11.65 24 13.3 24 15 C23.01 15 22.02 15 21 15 C21 14.01 21 13.02 21 12 C14.84742597 8.28899718 14.84742597 8.28899718 8.125 5.875 C5.01942651 5.00543942 3.94792958 4.46054263 2 2 C1.34 1.34 0.68 0.68 0 0 Z " fill="#737F8F" transform="translate(397,211)"/>
+<path d="M0 0 C0.5775 0.20625 1.155 0.4125 1.75 0.625 C-1.31317406 2.79886547 -3.91797665 3.84423801 -7.5625 4.5 C-11.07582415 5.17474437 -13.38647013 6.19947513 -16.3125 8.25 C-20.49060653 11.08006013 -23.26331466 11.31281867 -28.25 10.625 C-28.91 9.635 -29.57 8.645 -30.25 7.625 C-29.63511719 7.73199219 -29.02023437 7.83898437 -28.38671875 7.94921875 C-27.57847656 8.06910156 -26.77023437 8.18898437 -25.9375 8.3125 C-25.13699219 8.44011719 -24.33648437 8.56773437 -23.51171875 8.69921875 C-21.18817849 8.85682113 -21.18817849 8.85682113 -19.64453125 7.26953125 C-19.18433594 6.72683594 -18.72414063 6.18414062 -18.25 5.625 C-15.41363401 3.73408934 -14.04086771 3.2347423 -10.8125 2.625 C-8.32754707 2.15407829 -6.36901614 1.68526683 -4.10546875 0.5390625 C-2.25 -0.375 -2.25 -0.375 0 0 Z " fill="#848E9D" transform="translate(470.25,198.375)"/>
+<path d="M0 0 C2.4375 0.375 2.4375 0.375 5 1 C5.33 1.66 5.66 2.32 6 3 C7.3303125 3.433125 7.3303125 3.433125 8.6875 3.875 C14.70487947 5.91863831 19.24253933 9.92217657 24 14 C20.30581799 14 18.22163822 12.71820705 15 11 C15 10.34 15 9.68 15 9 C13.700625 8.62875 13.700625 8.62875 12.375 8.25 C8.78939936 6.92199976 6.03672013 5.31369152 3 3 C3 2.34 3 1.68 3 1 C2.01 0.67 1.02 0.34 0 0 Z " fill="#B9D0FE" transform="translate(765,689)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C0.92643323 2.15498897 -0.15929788 3.29867867 -1.25 4.4375 C-1.85328125 5.07558594 -2.4565625 5.71367188 -3.078125 6.37109375 C-5 8 -5 8 -7.171875 8.53515625 C-8.07679688 8.76525391 -8.07679688 8.76525391 -9 9 C-9.33 9.99 -9.66 10.98 -10 12 C-10.99 12 -11.98 12 -13 12 C-13.33 12.99 -13.66 13.98 -14 15 C-15.32 14.67 -16.64 14.34 -18 14 C-15.94127451 12.22461301 -13.87827001 10.45465816 -11.8125 8.6875 C-11.23435547 8.18798828 -10.65621094 7.68847656 -10.06054688 7.17382812 C-6.87583153 4.45692407 -3.78116572 1.8603604 0 0 Z " fill="#788294" transform="translate(348,597)"/>
+<path d="M0 0 C2.51543117 1.48430142 4.86175037 3.00187838 7 5 C7.6875 8.1875 7.6875 8.1875 8 11 C8.66 11.309375 9.32 11.61875 10 11.9375 C10.66 12.288125 11.32 12.63875 12 13 C12.6875 16.3125 12.6875 16.3125 13 20 C13.31966139 21.66934283 13.64731066 23.3373217 14 25 C11.82566509 22.51504581 10.66058375 20.21399839 9.625 17.125 C8.13078638 12.88615189 5.97591157 10.34790051 3 7 C0 2.44827586 0 2.44827586 0 0 Z " fill="#616D80" transform="translate(544,561)"/>
+<path d="M0 0 C1.32 0 2.64 0 4 0 C4.33 0.66 4.66 1.32 5 2 C7.3140622 2.73075648 9.64828869 3.40138258 12 4 C12 4.66 12 5.32 12 6 C13.65 6 15.3 6 17 6 C17.33 7.32 17.66 8.64 18 10 C18.763125 9.9175 19.52625 9.835 20.3125 9.75 C23 10 23 10 24.8125 12 C25.204375 12.66 25.59625 13.32 26 14 C21.43380236 13.46280028 18.72935582 11.61054908 15 9 C11.84641066 7.06309479 8.71125216 5.27480197 5.25 3.9375 C2.8962096 2.956754 1.65257644 1.91350956 0 0 Z " fill="#6B7789" transform="translate(890,198)"/>
+<path d="M0 0 C-3.25345306 2.04502764 -6.41802947 3.62231903 -10 5 C-10.70125 5.37125 -11.4025 5.7425 -12.125 6.125 C-14 7 -14 7 -17 7 C-17.33 7.99 -17.66 8.98 -18 10 C-23.93662491 13.13633014 -23.93662491 13.13633014 -27.4375 12.6875 C-27.953125 12.460625 -28.46875 12.23375 -29 12 C-28.01 11.67 -27.02 11.34 -26 11 C-25.67 10.34 -25.34 9.68 -25 9 C-23 8.66666667 -21 8.33333333 -19 8 C-18.67 7.34 -18.34 6.68 -18 6 C-15.4375 5.375 -15.4375 5.375 -13 5 C-12.67 4.01 -12.34 3.02 -12 2 C-10.29296875 1.015625 -10.29296875 1.015625 -8.1875 0.25 C-7.15689453 -0.14445312 -7.15689453 -0.14445312 -6.10546875 -0.546875 C-3.71856031 -1.06056958 -2.29362227 -0.76282269 0 0 Z " fill="#557ECE" transform="translate(771,1096)"/>
+<path d="M0 0 C1.98 0 3.96 0 6 0 C6.33 1.32 6.66 2.64 7 4 C7.7425 3.94199219 8.485 3.88398437 9.25 3.82421875 C12.48210597 4.03081643 13.53981706 4.77392099 16 6.8125 C18.28979435 8.65212684 20.40332611 10.24027938 22.9375 11.75 C25 13 25 13 26 15 C23.75412346 13.91865204 21.66454604 12.78496541 19.5625 11.4375 C17.08408233 9.86666489 17.08408233 9.86666489 14.3125 9.5 C12 9 12 9 10 6 C7.44816596 4.79549696 7.44816596 4.79549696 5 4 C5 3.34 5 2.68 5 2 C3.35 1.67 1.7 1.34 0 1 C0 0.67 0 0.34 0 0 Z " fill="#C6D9FE" transform="translate(768,919)"/>
+<path d="M0 0 C1.2375 -0.020625 2.475 -0.04125 3.75 -0.0625 C4.44609375 -0.07410156 5.1421875 -0.08570313 5.859375 -0.09765625 C8 0 8 0 9.7265625 0.5 C12.69491357 1.15283322 15.47668349 1.11146962 18.515625 1.09765625 C20.39121094 1.09282227 20.39121094 1.09282227 22.3046875 1.08789062 C23.60664062 1.07951172 24.90859375 1.07113281 26.25 1.0625 C27.56742188 1.05798828 28.88484375 1.05347656 30.2421875 1.04882812 C33.49483741 1.03704316 36.74739584 1.02059011 40 1 C37.11800663 3.88199337 35.0440995 3.258591 31.015625 3.265625 C30.3224115 3.26753845 29.629198 3.2694519 28.91497803 3.27142334 C27.44559365 3.27278545 25.97619725 3.26908718 24.50683594 3.26074219 C22.27250576 3.25010712 20.03899152 3.26060235 17.8046875 3.2734375 C16.37499824 3.27211464 14.94530948 3.26954964 13.515625 3.265625 C11.57091309 3.26224121 11.57091309 3.26224121 9.58691406 3.25878906 C6.05728385 3.00413292 3.28515974 2.27678729 0 1 C0 0.67 0 0.34 0 0 Z " fill="#8B94A2" transform="translate(554,522)"/>
+<path d="M0 0 C2.0625 0.4375 2.0625 0.4375 4 1 C2.9375 2.5 2.9375 2.5 1 4 C-2.6875 4.1875 -2.6875 4.1875 -6 4 C-6.33 4.99 -6.66 5.98 -7 7 C-11.78255965 10.12330426 -16.62222809 12.11306249 -22 14 C-21.67 12.68 -21.34 11.36 -21 10 C-20.071875 9.896875 -19.14375 9.79375 -18.1875 9.6875 C-14.80894117 8.95879123 -14.21848867 8.42016946 -12 6 C-10.67139075 5.64830932 -9.33841672 5.31229724 -8 5 C-7.67 4.34 -7.34 3.68 -7 3 C-5.01276732 2.29618843 -3.01222047 1.6288189 -1 1 C-0.67 0.67 -0.34 0.34 0 0 Z " fill="#3C5580" transform="translate(692,507)"/>
+<path d="M0 0 C3.68266103 0.59950296 7.34543185 1.24758891 11 2 C11.33 2.99 11.66 3.98 12 5 C13.36125 5.061875 13.36125 5.061875 14.75 5.125 C18 6 18 6 20.375 9.0625 C20.91125 10.031875 21.4475 11.00125 22 12 C17.33050268 10.66585791 14.00901115 8.69837289 10 6 C6.70113805 4.26141059 3.3586684 2.61959504 0 1 C0 0.67 0 0.34 0 0 Z " fill="#626E81" transform="translate(295,425)"/>
+<path d="M0 0 C0.90596924 0.02094727 1.81193848 0.04189453 2.74536133 0.06347656 C4.21972656 0.0828125 4.21972656 0.0828125 5.72387695 0.10253906 C6.74803711 0.13605469 7.77219727 0.16957031 8.82739258 0.20410156 C10.38103516 0.23117187 10.38103516 0.23117187 11.96606445 0.25878906 C14.52493541 0.30595719 17.081951 0.37176099 19.63989258 0.45410156 C19.96989258 1.44410156 20.29989258 2.43410156 20.63989258 3.45410156 C22.28989258 3.45410156 23.93989258 3.45410156 25.63989258 3.45410156 C26.29989258 4.77410156 26.95989258 6.09410156 27.63989258 7.45410156 C27.12426758 7.16535156 26.60864258 6.87660156 26.07739258 6.57910156 C23.01777377 5.1669698 19.88266596 4.35487195 16.63989258 3.45410156 C15.97989258 3.12410156 15.31989258 2.79410156 14.63989258 2.45410156 C12.00229106 2.32946764 9.40262088 2.26893584 6.76489258 2.26660156 C5.68401367 2.24823242 5.68401367 2.24823242 4.58129883 2.22949219 C0.77501346 2.21897759 -2.13523854 2.31825909 -5.36010742 4.45410156 C-3.04824808 0.58650475 -3.04824808 0.58650475 0 0 Z " fill="#768192" transform="translate(66.360107421875,317.5458984375)"/>
+<path d="M0 0 C5.94 0 11.88 0 18 0 C18.66 1.32 19.32 2.64 20 4 C19.46117187 3.83757812 18.92234375 3.67515625 18.3671875 3.5078125 C11.88375742 2.11697766 4.43864976 2.56918894 -2 4 C-1.34 2.68 -0.68 1.36 0 0 Z " fill="#364C6F" transform="translate(1071,317)"/>
+<path d="M0 0 C1.85625 0.061875 1.85625 0.061875 3.75 0.125 C3.75 0.455 3.75 0.785 3.75 1.125 C2.6775 1.24875 1.605 1.3725 0.5 1.5 C-3.04191654 1.90091822 -3.04191654 1.90091822 -5.19921875 3.1015625 C-8.07452267 4.53647608 -10.99019486 4.9696911 -14.12890625 5.5625 C-16.52653722 6.07616341 -16.52653722 6.07616341 -19.25 8.125 C-26.49390244 10.62743902 -26.49390244 10.62743902 -30.25 9.125 C-24.32367716 5.17411811 -17.45992344 3.82716097 -10.51171875 2.65234375 C-8.2230097 2.21669595 -8.2230097 2.21669595 -6.22265625 1.07421875 C-3.96409609 -0.01257357 -2.48667469 -0.08288916 0 0 Z " fill="#8E97A4" transform="translate(502.25,187.875)"/>
+<path d="M0 0 C2.31 0 4.62 0 7 0 C7.33 0.99 7.66 1.98 8 3 C8.70125 3.0825 9.4025 3.165 10.125 3.25 C13.64876457 4.16924293 15.98302038 5.98868025 19 8 C21.7282504 8.78215588 21.7282504 8.78215588 24 9 C24.33 10.32 24.66 11.64 25 13 C23.824375 12.401875 22.64875 11.80375 21.4375 11.1875 C17.68331264 9.30709575 13.86333422 7.64549421 10 6 C6.35365711 4.28407393 3.13795785 2.53450442 0 0 Z " fill="#9FBEFD" transform="translate(778,910)"/>
+<path d="M0 0 C0.57363281 0.21914063 1.14726562 0.43828125 1.73828125 0.6640625 C1.18140625 0.96699219 0.62453125 1.26992188 0.05078125 1.58203125 C-4.60387302 4.13737354 -9.12027071 6.7937526 -13.53515625 9.74609375 C-15.26171875 10.6640625 -15.26171875 10.6640625 -18.26171875 10.6640625 C-18.59171875 11.9840625 -18.92171875 13.3040625 -19.26171875 14.6640625 C-21.57171875 15.3240625 -23.88171875 15.9840625 -26.26171875 16.6640625 C-24.83004835 12.36905131 -22.11359338 11.66536681 -18.24609375 9.57421875 C-17.50875 9.17074219 -16.77140625 8.76726563 -16.01171875 8.3515625 C-15.23957031 7.93003906 -14.46742188 7.50851562 -13.671875 7.07421875 C-10.39775899 5.15856903 -7.35309909 2.95750589 -4.3046875 0.703125 C-2.26171875 -0.3359375 -2.26171875 -0.3359375 0 0 Z " fill="#B0B6C0" transform="translate(277.26171875,745.3359375)"/>
+<path d="M0 0 C-4.625 3 -4.625 3 -8 3 C-8.33 4.32 -8.66 5.64 -9 7 C-9.99 7 -10.98 7 -12 7 C-12 7.66 -12 8.32 -12 9 C-17.17578125 12.22265625 -17.17578125 12.22265625 -19 13 C-19.99 12.67 -20.98 12.34 -22 12 C-21.34 12 -20.68 12 -20 12 C-20 11.01 -20 10.02 -20 9 C-18.7934375 8.566875 -18.7934375 8.566875 -17.5625 8.125 C-14.8673532 7.26737432 -14.8673532 7.26737432 -14 5 C-13.38125 4.855625 -12.7625 4.71125 -12.125 4.5625 C-9.93151796 4.17235693 -9.93151796 4.17235693 -8.5625 2.5625 C-6.07228104 0.07228104 -3.30674739 -1.65337369 0 0 Z " fill="#92B5FD" transform="translate(848,615)"/>
+<path d="M0 0 C4.65741591 1.43084974 8.96852582 3.31659342 13.3125 5.5 C14.26092773 5.96212891 14.26092773 5.96212891 15.22851562 6.43359375 C19.87789621 8.75579241 19.87789621 8.75579241 21 11 C12.72448399 9.70695062 6.22517779 6.52981218 0 1 C0 0.67 0 0.34 0 0 Z " fill="#6B7788" transform="translate(424,352)"/>
+<path d="M0 0 C1.32 0 2.64 0 4 0 C5.73473712 1.94125344 7.4045651 3.94272868 9 6 C9.66 6.33 10.32 6.66 11 7 C11.33 7.99 11.66 8.98 12 10 C12.66 10.33 13.32 10.66 14 11 C15.54266151 14.2668126 16.39102647 17.44765442 17 21 C15.03044691 18.62295317 13.19648005 16.35144199 11.6875 13.65234375 C9.72371242 10.56574243 7.44387321 8.28644633 4.8125 5.75 C3.19228295 4.18309482 1.58335288 2.60414738 0 1 C0 0.67 0 0.34 0 0 Z " fill="#3F5989" transform="translate(744,249)"/>
+<path d="M0 0 C1.98 0.99 3.96 1.98 6 3 C5.43867066 6.5371438 4.30442253 7.99261679 1.5625 10.25 C0.94503906 10.77078125 0.32757813 11.2915625 -0.30859375 11.828125 C-2 13 -2 13 -4 13 C-4 13.99 -4 14.98 -4 16 C-4.66 16 -5.32 16 -6 16 C-6.33 17.32 -6.66 18.64 -7 20 C-7.99 20 -8.98 20 -10 20 C-10.33 20.66 -10.66 21.32 -11 22 C-10.67 20.68 -10.34 19.36 -10 18 C-9.34 18 -8.68 18 -8 18 C-7.67 17.01 -7.34 16.02 -7 15 C-6.34 15 -5.68 15 -5 15 C-5 14.01 -5 13.02 -5 12 C-4.360625 11.896875 -3.72125 11.79375 -3.0625 11.6875 C-2.381875 11.460625 -1.70125 11.23375 -1 11 C-0.67 10.01 -0.34 9.02 0 8 C1.29355827 6.62804426 2.62298702 5.28817344 4 4 C3.01 4 2.02 4 1 4 C0.67 2.68 0.34 1.36 0 0 Z " fill="#CACFD5" transform="translate(413,220)"/>
+<path d="M0 0 C0.515625 0.309375 1.03125 0.61875 1.5625 0.9375 C4.1293925 2.18828017 4.1293925 2.18828017 7.6875 2.5 C9.3271875 2.7475 9.3271875 2.7475 11 3 C11.33 3.66 11.66 4.32 12 5 C13.65697379 5.69040574 15.3255761 6.3530635 17 7 C18.6829392 7.97236487 20.35443434 8.96564444 22 10 C21.67 10.99 21.34 11.98 21 13 C20.53851563 12.68546875 20.07703125 12.3709375 19.6015625 12.046875 C14.96661788 9.00576509 10.44799208 6.87788741 5.19921875 5.08984375 C2.6175457 3.81047114 1.54109264 2.39891766 0 0 Z " fill="#C2C7CE" transform="translate(220,1006)"/>
+<path d="M0 0 C0.53625 0.268125 1.0725 0.53625 1.625 0.8125 C0.635 1.1425 -0.355 1.4725 -1.375 1.8125 C-2.365 3.2975 -2.365 3.2975 -3.375 4.8125 C-8.34774919 8.13441799 -13.84500949 10.5792346 -19.375 12.8125 C-20.344375 13.204375 -21.31375 13.59625 -22.3125 14 C-22.993125 14.268125 -23.67375 14.53625 -24.375 14.8125 C-20.42055724 10.63208908 -17.00680427 7.5964417 -11.4375 5.9375 C-8.56895886 4.88375019 -7.42543709 4.11412762 -5.25 2.125 C-2.375 -0.1875 -2.375 -0.1875 0 0 Z " fill="#D6E3FE" transform="translate(982.375,879.1875)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C1.96519531 1.59167969 1.93039062 2.18335938 1.89453125 2.79296875 C1.86746094 3.58316406 1.84039062 4.37335937 1.8125 5.1875 C1.77769531 5.96480469 1.74289062 6.74210938 1.70703125 7.54296875 C2.07620869 10.63913685 3.33274866 12.38289634 5 15 C5.77708684 16.85565219 6.50689784 18.73183077 7.1875 20.625 C7.53167969 21.56601562 7.87585938 22.50703125 8.23046875 23.4765625 C9 26 9 26 9 29 C8.01 28.34 7.02 27.68 6 27 C5.62599214 24.67284 5.29235267 22.33882138 5 20 C4.34 19.34 3.68 18.68 3 18 C2.29373761 16.01363702 1.63106429 14.01151741 1 12 C0.62875 11.175 0.2575 10.35 -0.125 9.5 C-1.16458348 6.52976148 -1.21310204 4.12549651 -1 1 C-0.67 0.67 -0.34 0.34 0 0 Z " fill="#9DA4B1" transform="translate(327,710)"/>
+<path d="M0 0 C0 2.97 0 5.94 0 9 C-0.66 9 -1.32 9 -2 9 C-2 6.69 -2 4.38 -2 2 C-4.3753606 3.41037035 -6.73668669 4.82630384 -9.04296875 6.34765625 C-10.10451172 7.04181641 -10.10451172 7.04181641 -11.1875 7.75 C-11.86167969 8.19859375 -12.53585937 8.6471875 -13.23046875 9.109375 C-13.81441406 9.40328125 -14.39835938 9.6971875 -15 10 C-15.66 9.67 -16.32 9.34 -17 9 C-12.25 5 -12.25 5 -10 5 C-9.67 4.01 -9.34 3.02 -9 2 C-5.99208089 -0.04108797 -3.57804656 -0.19878036 0 0 Z " fill="#A3C1FD" transform="translate(955,684)"/>
+<path d="M0 0 C1.32 0 2.64 0 4 0 C4.33 0.66 4.66 1.32 5 2 C6.134375 2.144375 7.26875 2.28875 8.4375 2.4375 C9.613125 2.623125 10.78875 2.80875 12 3 C12.99 4.485 12.99 4.485 14 6 C17.05429073 7.21284876 17.05429073 7.21284876 20 8 C20 8.66 20 9.32 20 10 C20.61875 10.103125 21.2375 10.20625 21.875 10.3125 C24 11 24 11 26 14 C25.47148437 13.73058594 24.94296875 13.46117187 24.3984375 13.18359375 C20.40342535 11.21211381 16.33941007 9.38958939 12.2890625 7.53515625 C2.57070136 2.99915158 2.57070136 2.99915158 0 0 Z " fill="#677385" transform="translate(424,490)"/>
+<path d="M0 0 C0.66 0 1.32 0 2 0 C1.67 1.32 1.34 2.64 1 4 C-0.134375 4.12375 -1.26875 4.2475 -2.4375 4.375 C-4.2009375 4.684375 -4.2009375 4.684375 -6 5 C-6.33 5.66 -6.66 6.32 -7 7 C-8.98982813 7.69643985 -10.99294757 8.354876 -13 9 C-15.36462218 10.06725397 -17.70924074 11.16788287 -20.046875 12.29296875 C-20.69140625 12.52628906 -21.3359375 12.75960938 -22 13 C-22.66 12.67 -23.32 12.34 -24 12 C-23.2575 11.566875 -22.515 11.13375 -21.75 10.6875 C-19.06639699 9.1315022 -19.06639699 9.1315022 -17.125 7.4375 C-14.25665498 5.49714896 -11.33379472 4.90407992 -8 4 C-3.67771276 2.52089862 -3.67771276 2.52089862 0 0 Z " fill="#4868A6" transform="translate(886,412)"/>
+<path d="M0 0 C1.670625 0.2165625 1.670625 0.2165625 3.375 0.4375 C5.76702762 0.74710641 8.14067335 1.01014056 10.546875 1.18359375 C15.72797034 1.56825083 19.44734633 2.2900871 24 5 C25.32947159 5.67433487 26.66214338 6.3424577 28 7 C26.39620659 7.05416188 24.79188594 7.09286638 23.1875 7.125 C22.29417969 7.14820313 21.40085937 7.17140625 20.48046875 7.1953125 C18 7 18 7 15 5 C15 4.34 15 3.68 15 3 C14.00419922 3.03480469 14.00419922 3.03480469 12.98828125 3.0703125 C4.21792619 3.24956063 4.21792619 3.24956063 0 1 C0 0.67 0 0.34 0 0 Z " fill="#4F75BD" transform="translate(652,210)"/>
+<path d="M0 0 C0.721875 0.144375 1.44375 0.28875 2.1875 0.4375 C4.96513657 1.0439459 4.96513657 1.0439459 7.6875 1.25 C8.8321875 1.62125 8.8321875 1.62125 10 2 C11.1875 4.5 11.1875 4.5 12 7 C12.66 7.33 13.32 7.66 14 8 C11.625 8.125 11.625 8.125 9 8 C8.34 7.34 7.68 6.68 7 6 C5.01178687 5.60235737 3.01055661 5.26224651 1 5 C0.67 3.35 0.34 1.7 0 0 Z " fill="#6E798B" transform="translate(367,168)"/>
+<path d="M0 0 C4.45042252 1.48347417 8.03848222 2.85968572 11.75 5.75 C14.62140092 8.26641048 14.62140092 8.26641048 17 7.76953125 C19.97116742 6.62632816 22.40870286 4.82568662 25 3 C25.66 3.33 26.32 3.66 27 4 C23.70345617 7.64354845 20.68762144 9.90447426 15.6875 10.1875 C14.3571875 10.0946875 14.3571875 10.0946875 13 10 C12.67 9.34 12.34 8.68 12 8 C10.29301854 7.24498897 8.58351376 6.49453242 6.85546875 5.7890625 C4.39870151 4.74428991 2.18958969 3.52607766 0 2 C0 1.34 0 0.68 0 0 Z " fill="#ADC8FD" transform="translate(838,959)"/>
+<path d="M0 0 C3.7404892 3.22455965 5.1689395 6.46215442 7 11 C7.8353125 12.2684375 7.8353125 12.2684375 8.6875 13.5625 C10.29358241 16.54522448 10.23289747 18.66180292 10 22 C4.41600246 17.62335328 3.57080568 12.71519428 2 6 C1.35377514 3.99330175 0.69883384 1.98898862 0 0 Z " fill="#C2C7CF" transform="translate(355,919)"/>
+<path d="M0 0 C2.125 0.375 2.125 0.375 4 1 C3.34 2.32 2.68 3.64 2 5 C0.35 5 -1.3 5 -3 5 C-3.33 5.99 -3.66 6.98 -4 8 C-6.31 8 -8.62 8 -11 8 C-11 8.66 -11 9.32 -11 10 C-11.66 9.67 -12.32 9.34 -13 9 C-11.60648806 6.21297611 -9.85529103 5.8142546 -7.0625 4.5 C-3.2248649 2.69388758 -3.2248649 2.69388758 0 0 Z " fill="#88AFFD" transform="translate(916,704)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C0.68 1.33 -0.64 1.66 -2 2 C-2 2.66 -2 3.32 -2 4 C-3.65 4.33 -5.3 4.66 -7 5 C-7.33 5.99 -7.66 6.98 -8 8 C-9.65 8 -11.3 8 -13 8 C-13.33 8.99 -13.66 9.98 -14 11 C-16.89558441 12.4477922 -18.74188938 13 -22 13 C-15.14244822 7.74197642 -8.27507584 2.79629282 0 0 Z " fill="#BFC4CD" transform="translate(362,690)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C0.73742767 2.17560179 -0.53537084 3.34022865 -1.8125 4.5 C-2.87404297 5.47453125 -2.87404297 5.47453125 -3.95703125 6.46875 C-6 8 -6 8 -9 8 C-9.33 8.99 -9.66 9.98 -10 11 C-10.99 11 -11.98 11 -13 11 C-13.33 11.99 -13.66 12.98 -14 14 C-15.875 15.75 -15.875 15.75 -18 17 C-18.99 16.67 -19.98 16.34 -21 16 C-20.030625 15.38125 -19.06125 14.7625 -18.0625 14.125 C-14.97164638 12.34321154 -14.97164638 12.34321154 -14 10 C-13.01 9.67 -12.02 9.34 -11 9 C-10.236875 8.236875 -9.47375 7.47375 -8.6875 6.6875 C-5.92029402 3.92029402 -3.29544601 2.06923354 0 0 Z " fill="#7F8899" transform="translate(300,632)"/>
+<path d="M0 0 C4.61006527 1.26776795 8.08664632 3.24768982 12.03515625 5.83203125 C14.5598618 7.33280055 17.21063678 8.11556776 20 9 C20.33 9.66 20.66 10.32 21 11 C21.825 11.495 22.65 11.99 23.5 12.5 C26 14 26 14 27 16 C25.68 16 24.36 16 23 16 C23 15.34 23 14.68 23 14 C21.68 13.34 20.36 12.68 19 12 C19 11.34 19 10.68 19 10 C18.13375 9.9175 17.2675 9.835 16.375 9.75 C12.47068326 8.88237406 10.24708727 7.30002015 7 5 C5.906875 4.46375 4.81375 3.9275 3.6875 3.375 C1 2 1 2 0 0 Z " fill="#91B5FD" transform="translate(895,536)"/>
+<path d="M0 0 C2.15822618 0.46961403 4.31446557 0.94615281 6.46875 1.43359375 C8.09015434 1.79640799 9.71503815 2.14419936 11.34375 2.47265625 C13.25283663 2.88421659 15.13126499 3.43270544 17 4 C17.33 4.99 17.66 5.98 18 7 C18.99 7.66 19.98 8.32 21 9 C16.45430898 9.30993348 14.434771 8.97680153 11 6 C7.76436215 4.05861729 4.72318033 3.50770641 1 3 C0.67 2.01 0.34 1.02 0 0 Z " fill="#717C8D" transform="translate(317,437)"/>
+<path d="M0 0 C1.55544021 4.66632064 -0.48852847 8.46558541 -2 13 C-2.66 13 -3.32 13 -4 13 C-4.33 18.28 -4.66 23.56 -5 29 C-5.33 29 -5.66 29 -6 29 C-6.59627658 18.5585345 -6.20305645 10.43373842 -1 1 C-0.67 0.67 -0.34 0.34 0 0 Z " fill="#4A6CAC" transform="translate(415,266)"/>
+<path d="M0 0 C1.32 0.33 2.64 0.66 4 1 C3.01 1 2.02 1 1 1 C1 1.99 1 2.98 1 4 C-2.68351198 6.79053938 -6.56391653 7.87081512 -11 9 C-11.804375 9.20625 -12.60875 9.4125 -13.4375 9.625 C-13.953125 9.74875 -14.46875 9.8725 -15 10 C-14.3125 8.0625 -14.3125 8.0625 -13 6 C-11.34178227 5.62690101 -9.67422986 5.29299023 -8 5 C-7.34 4.01 -6.68 3.02 -6 2 C-2.875 1.8125 -2.875 1.8125 0 2 C0 1.34 0 0.68 0 0 Z " fill="#5E6B7F" transform="translate(145,260)"/>
+<path d="M0 0 C7.49378025 2.68450969 14.52628497 5.30338321 21 10 C21 10.66 21 11.32 21 12 C21.99 12.33 22.98 12.66 24 13 C19.87248551 12.39301257 16.6678852 10.96189209 13 9 C13 8.34 13 7.68 13 7 C12.21625 7.04125 11.4325 7.0825 10.625 7.125 C8 7 8 7 6 5 C4.7315625 4.5359375 4.7315625 4.5359375 3.4375 4.0625 C2.633125 3.711875 1.82875 3.36125 1 3 C0.67 2.01 0.34 1.02 0 0 Z " fill="#B6BCC5" transform="translate(866,186)"/>
+<path d="M0 0 C1.32 0 2.64 0 4 0 C4.33 0.66 4.66 1.32 5 2 C6.4540625 2.2165625 6.4540625 2.2165625 7.9375 2.4375 C8.948125 2.623125 9.95875 2.80875 11 3 C11.99 4.485 11.99 4.485 13 6 C13.99 6.33 14.98 6.66 16 7 C15.67 7.99 15.34 8.98 15 10 C12.32451673 9.01898947 9.66004175 8.02112927 7 7 C6.236875 6.71125 5.47375 6.4225 4.6875 6.125 C2.30699153 4.53799436 1.31392387 2.49645535 0 0 Z " fill="#858F9E" transform="translate(707,98)"/>
+<path d="M0 0 C6.76443607 1.02491456 11.9766276 3.7637207 17.359375 7.80078125 C19.15645721 9.15642368 19.15645721 9.15642368 21.875 10.6875 C24 12 24 12 25 14 C22.78537326 12.93369824 20.70583833 11.81421368 18.625 10.5 C16.03383563 8.89823121 16.03383563 8.89823121 13.0625 8.0625 C8.10039237 6.34095246 4.13217981 3.17859986 0 0 Z " fill="#BABFC7" transform="translate(483,1150)"/>
+<path d="M0 0 C7.75 1.625 7.75 1.625 10 5 C13.28037711 6.6092416 16.19294693 7.87445841 19.8125 8.4375 C22 9 22 9 23.3125 11.0625 C23.539375 11.701875 23.76625 12.34125 24 13 C22.68528432 12.71848913 21.37324233 12.42446661 20.0625 12.125 C19.33160156 11.96257813 18.60070312 11.80015625 17.84765625 11.6328125 C16 11 16 11 15 9 C11.70544902 7.68217961 8.36278475 6.55703981 5.00390625 5.4140625 C2 4 2 4 0.58984375 1.8359375 C0.39519531 1.23007812 0.20054688 0.62421875 0 0 Z " fill="#969EAB" transform="translate(125,955)"/>
+<path d="M0 0 C0.66 0 1.32 0 2 0 C2 0.66 2 1.32 2 2 C3.5778125 1.9071875 3.5778125 1.9071875 5.1875 1.8125 C9.35904314 2.01765786 10.57254381 2.80356757 14 5 C16.88284343 6.54775611 19.77529021 8.0757875 22.671875 9.59765625 C25 11 25 11 26 13 C24.68 13 23.36 13 22 13 C22 12.34 22 11.68 22 11 C20.96875 10.7525 19.9375 10.505 18.875 10.25 C16.06279974 9.46100594 14.56296544 8.70244455 12.0625 7 C9.28165703 5.18393928 7.81718222 4.60019072 4.6875 3.9375 C3.470625 3.628125 2.25375 3.31875 1 3 C0.67 2.01 0.34 1.02 0 0 Z " fill="#CBCFD5" transform="translate(437,499)"/>
+<path d="M0 0 C2.88810999 0.44432461 4.40064775 1.27000175 6.875 2.9375 C9.87534963 5.11112412 9.87534963 5.11112412 13.1875 6.0625 C15.9783494 6.99278313 17.16786789 7.76072742 19 10 C16.69 9.67 14.38 9.34 12 9 C12 8.34 12 7.68 12 7 C10.35 7 8.7 7 7 7 C6.67 6.01 6.34 5.02 6 4 C4.35 4 2.7 4 1 4 C0.67 2.68 0.34 1.36 0 0 Z " fill="#677385" transform="translate(378,437)"/>
+<path d="M0 0 C1.32 0 2.64 0 4 0 C4.66 0.99 5.32 1.98 6 3 C8.72435637 4.07585059 8.72435637 4.07585059 12 5 C16.93739844 6.5761695 20.58974269 7.87927241 24 12 C18.25 11.25 18.25 11.25 16 9 C14.00458132 8.31974363 12.00382009 7.65509503 10 7 C5.88013028 5.18725732 3.01004931 3.35736269 0 0 Z " fill="#A1A9B4" transform="translate(321,407)"/>
+<path d="M0 0 C3.79746835 4.55696203 3.79746835 4.55696203 5 7.1875 C5.85098835 9.17316862 5.85098835 9.17316862 7.9375 9.8125 C11.14747448 11.66066712 11.6349449 14.64423954 13 18 C15.05787515 20.84600677 15.05787515 20.84600677 17 23 C12.03554823 20.60336811 9.64284287 18.59207716 6.97265625 13.66796875 C5.87778117 11.79041189 4.56488081 10.49684251 3 9 C0.59907095 5.53199138 0 4.34827524 0 0 Z " fill="#AEB5BE" transform="translate(392,317)"/>
+<path d="M0 0 C1.4540625 0.0309375 1.4540625 0.0309375 2.9375 0.0625 C1.22125031 3.09117593 0.1162615 3.99457063 -3.1875 5.25 C-7.47296412 6.14856506 -11.70413931 6.68694965 -16.0625 7.0625 C-12.25937457 3.60511324 -9.02063462 2.30203366 -4.0625 1.0625 C-3.0625 0.0625 -3.0625 0.0625 0 0 Z " fill="#496BAA" transform="translate(482.0625,218.9375)"/>
+<path d="M0 0 C0 0.66 0 1.32 0 2 C-7.40487987 3.55653597 -14.67061577 4.35234292 -22.2265625 4.75390625 C-24.90664286 4.69269563 -24.90664286 4.69269563 -26 6 C-27.99958364 6.04080783 -30.00045254 6.04254356 -32 6 C-27.72982167 3.15321444 -25.44017641 2.82950972 -20.3125 2.5625 C-14.57224898 2.22459971 -14.57224898 2.22459971 -9 0.9375 C-5.84315909 -0.04901278 -3.28619415 -0.16030215 0 0 Z " fill="#5680D2" transform="translate(547,206)"/>
+<path d="M0 0 C0.52851562 0.23203125 1.05703125 0.4640625 1.6015625 0.703125 C0.66183594 1.08404297 0.66183594 1.08404297 -0.296875 1.47265625 C-1.11414063 1.81683594 -1.93140625 2.16101562 -2.7734375 2.515625 C-3.58554687 2.85207031 -4.39765625 3.18851563 -5.234375 3.53515625 C-7.69991208 4.64751582 -7.69991208 4.64751582 -9.3984375 7.703125 C-11.379696 8.42358264 -13.38347843 9.08313759 -15.3984375 9.703125 C-16.4296875 10.21875 -17.4609375 10.734375 -18.5234375 11.265625 C-20.88750427 12.44765838 -22.82687899 13.20859452 -25.3984375 13.703125 C-22.36433112 10.31892942 -19.45486464 8.6876689 -15.3984375 6.703125 C-12.06820927 4.82047816 -8.74052233 2.93425057 -5.421875 1.03125 C-2.3984375 -0.296875 -2.3984375 -0.296875 0 0 Z " fill="#425F94" transform="translate(841.3984375,1058.296875)"/>
+<path d="M0 0 C1.32 0 2.64 0 4 0 C4.33 0.66 4.66 1.32 5 2 C6.97888961 2.72693904 8.97954558 3.39816251 11 4 C11 4.66 11 5.32 11 6 C11.763125 5.938125 12.52625 5.87625 13.3125 5.8125 C16.50339968 6.03512091 16.96106145 6.68302438 19 9 C19.99 9.33 20.98 9.66 22 10 C21.67 10.99 21.34 11.98 21 13 C20.22076172 12.49339844 20.22076172 12.49339844 19.42578125 11.9765625 C15.11562175 9.1991468 15.11562175 9.1991468 10.5 7 C6.73246284 5.49298514 3.30343615 3.35257115 0 1 C0 0.67 0 0.34 0 0 Z " fill="#D7DADF" transform="translate(306,1054)"/>
+<path d="M0 0 C6.05373353 2.5083757 11.51719682 5.42425879 17 9 C18.66360078 10.00509214 20.32874278 11.00769103 22 12 C15.86228945 12 11.11564575 9.06938745 6 6 C6 5.34 6 4.68 6 4 C4.35 4 2.7 4 1 4 C0.67 2.68 0.34 1.36 0 0 Z " fill="#566478" transform="translate(145,966)"/>
+<path d="M0 0 C2.97 0.495 2.97 0.495 6 1 C6 1.66 6 2.32 6 3 C6.886875 3.103125 7.77375 3.20625 8.6875 3.3125 C13.59438359 4.3309098 16.21486635 5.82229952 19 10 C19.99 10.66 20.98 11.32 22 12 C17.25 11.25 17.25 11.25 15 9 C13.33746677 8.32309124 11.67013418 7.65793165 10 7 C8.20928742 6.01445454 6.43792648 4.99294234 4.6875 3.9375 C3.80449219 3.41027344 2.92148437 2.88304687 2.01171875 2.33984375 C1.34785156 1.89769531 0.68398438 1.45554687 0 1 C0 0.67 0 0.34 0 0 Z " fill="#B8CFFE" transform="translate(816,947)"/>
+<path d="M0 0 C1.98 0 3.96 0 6 0 C6.33 0.66 6.66 1.32 7 2 C7.99 2.33 8.98 2.66 10 3 C10.99 4.485 10.99 4.485 12 6 C13.99180409 7.01622658 15.99152635 8.01712992 18 9 C18.33 9.66 18.66 10.32 19 11 C14.63664278 9.92974257 12.12531673 9.12531673 9 6 C6.69011685 5.25613932 4.35684056 4.57809297 2 4 C2 3.01 2 2.02 2 1 C1.34 0.67 0.68 0.34 0 0 Z " fill="#B2CBFE" transform="translate(775,686)"/>
+<path d="M0 0 C2.0625 0.4375 2.0625 0.4375 4 1 C3.06027344 1.50660156 3.06027344 1.50660156 2.1015625 2.0234375 C1.28429687 2.46945312 0.46703125 2.91546875 -0.375 3.375 C-1.18710938 3.81585938 -1.99921875 4.25671875 -2.8359375 4.7109375 C-5.10814302 5.9443893 -5.10814302 5.9443893 -7 8 C-8.98536627 8.70905938 -10.98910922 9.36694179 -13 10 C-15.67574867 10.97693701 -18.33656158 11.98973025 -21 13 C-21 12.34 -21 11.68 -21 11 C-20.195625 10.71125 -19.39125 10.4225 -18.5625 10.125 C-15.8673532 9.26737432 -15.8673532 9.26737432 -15 7 C-13.00491933 6.31875294 -11.00361307 5.65572791 -9 5 C-4.17726818 2.99390153 -4.17726818 2.99390153 0 0 Z " fill="#AFB6BF" transform="translate(135,267)"/>
+<path d="M0 0 C5.95703125 -0.29296875 5.95703125 -0.29296875 8 0 C8.72703125 0.7425 8.72703125 0.7425 9.46875 1.5 C10.91723419 3.22009484 10.91723419 3.22009484 13.26171875 3.29296875 C14.46248047 3.24076172 14.46248047 3.24076172 15.6875 3.1875 C16.89986328 3.14689453 16.89986328 3.14689453 18.13671875 3.10546875 C19.05904297 3.05326172 19.05904297 3.05326172 20 3 C20.33 2.34 20.66 1.68 21 1 C22.32 1.33 23.64 1.66 25 2 C23.20202958 4.31956593 22.31532915 4.95235026 19.36328125 5.3984375 C5.29032258 5.29032258 5.29032258 5.29032258 0 0 Z " fill="#5883D8" transform="translate(603,1170)"/>
+<path d="M0 0 C1.32 0 2.64 0 4 0 C4.33 0.99 4.66 1.98 5 3 C7.00121175 5.36506843 7.96799661 5.9893322 11 7 C12.421875 8.77734375 12.421875 8.77734375 13.75 10.9375 C14.19859375 11.64777344 14.6471875 12.35804688 15.109375 13.08984375 C15.40328125 13.72019531 15.6971875 14.35054687 16 15 C15.67 15.66 15.34 16.32 15 17 C14.34 16.34 13.68 15.68 13 15 C13 14.01 13 13.02 13 12 C12.15695312 11.62875 12.15695312 11.62875 11.296875 11.25 C8.60907431 9.78725133 6.53594518 8.03195127 4.25 6 C3.45078125 5.29875 2.6515625 4.5975 1.828125 3.875 C0 2 0 2 0 0 Z " fill="#637083" transform="translate(528,544)"/>
+<path d="M0 0 C3.79219129 0.11140185 7.58352194 0.24165376 11.375 0.375 C12.43589844 0.4059375 13.49679687 0.436875 14.58984375 0.46875 C21.24602788 0.71376291 27.51818952 1.45532884 34 3 C34 3.33 34 3.66 34 4 C31.89590361 4.02701408 29.79170822 4.04640223 27.6875 4.0625 C26.51574219 4.07410156 25.34398437 4.08570313 24.13671875 4.09765625 C21 4 21 4 18 3 C14.81591307 2.77410194 11.63846659 2.60695441 8.44921875 2.48242188 C4.81145799 2.29228251 3.10385071 2.06923381 0 0 Z " fill="#98A1AD" transform="translate(520,390)"/>
+<path d="M0 0 C4.54983634 1.07100959 7.88362328 4.45921371 11.2734375 7.53515625 C7.83225414 7.53515625 5.44586398 6.84550632 2.2734375 5.53515625 C1.9434375 4.54515625 1.6134375 3.55515625 1.2734375 2.53515625 C-2.0265625 2.53515625 -5.3265625 2.53515625 -8.7265625 2.53515625 C-5.62761653 0.46919227 -3.70183555 -0.04816515 0 0 Z " fill="#AEB4BE" transform="translate(717.7265625,372.46484375)"/>
+<path d="M0 0 C3.76921925 2.67812947 5.5712723 4.59475626 7 9 C7.33 9.33 7.66 9.66 8 10 C8.39569108 12.01311449 8.74252191 14.03597208 9.0625 16.0625 C9.23910156 17.16722656 9.41570312 18.27195312 9.59765625 19.41015625 C9.73042969 20.26480469 9.86320312 21.11945313 10 22 C9.34 21.67 8.68 21.34 8 21 C7.36614078 18.95756472 6.98173496 16.90867481 6.5625 14.8125 C6.376875 14.214375 6.19125 13.61625 6 13 C5.34 12.67 4.68 12.34 4 12 C3.32060826 10.00428677 2.65438441 8.00405227 2 6 C1.34 5.34 0.68 4.68 0 4 C0 2.68 0 1.36 0 0 Z " fill="#5279C5" transform="translate(1103,334)"/>
+<path d="M0 0 C1.32 0 2.64 0 4 0 C4.33 0.66 4.66 1.32 5 2 C6.66583773 2.49975132 8.33424409 2.99283728 10.015625 3.4375 C13.20670207 4.34205728 16.0273625 5.51368125 19 7 C19.33 7.99 19.66 8.98 20 10 C20.99 10.33 21.98 10.66 23 11 C17.9187445 10.34435413 13.58468513 8.1589258 9 6 C7.88625 5.484375 6.7725 4.96875 5.625 4.4375 C3.27744872 3.15193621 1.72802423 2.01602827 0 0 Z " fill="#717C8D" transform="translate(109,332)"/>
+<path d="M0 0 C4.40706615 1.17521764 6.67180324 2.02837024 9 6 C9.80272298 10.91758223 9.96059026 15.49050103 7.25 19.75 C5 21 5 21 2.75 20.75 C2.1725 20.5025 1.595 20.255 1 20 C1.99 19.505 2.98 19.01 4 18.5 C7.09592494 16.42257505 7.09592494 16.42257505 7.46875 14.09375 C7.52389584 10.39897846 7.31490232 7.00937302 5 4 C2.98330173 2.86649466 2.98330173 2.86649466 1 2 C0.67 1.34 0.34 0.68 0 0 Z " fill="#838D9C" transform="translate(1044,281)"/>
+<path d="M0 0 C0.33 0.99 0.66 1.98 1 3 C0.69449219 3.55945313 0.38898438 4.11890625 0.07421875 4.6953125 C-1.47801254 8.02555417 -1.25021555 11.27710806 -1.1875 14.875 C-1.18685547 15.56980469 -1.18621094 16.26460938 -1.18554688 16.98046875 C-1.15077526 21.08351936 -0.78859955 24.97498789 0 29 C-0.99 28.67 -1.98 28.34 -3 28 C-3.0867562 23.70845978 -3.1403089 19.41714332 -3.1875 15.125 C-3.21263672 13.90167969 -3.23777344 12.67835938 -3.26367188 11.41796875 C-3.27333984 10.25136719 -3.28300781 9.08476562 -3.29296875 7.8828125 C-3.3086792 6.80402832 -3.32438965 5.72524414 -3.34057617 4.61376953 C-3.22818604 3.75122559 -3.1157959 2.88868164 -3 2 C-2.01 1.34 -1.02 0.68 0 0 Z " fill="#354A6C" transform="translate(411,272)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-0.05233685 3.2477975 -1.00667261 4.0022242 -4 5 C-4.99 6.485 -4.99 6.485 -6 8 C-8.75 9.640625 -8.75 9.640625 -12 11.25 C-13.60875 12.06210937 -13.60875 12.06210937 -15.25 12.890625 C-16.1575 13.25671875 -17.065 13.6228125 -18 14 C-18.66 13.67 -19.32 13.34 -20 13 C-19.34 12.01 -18.68 11.02 -18 10 C-16.33333333 9.66666667 -14.66666667 9.33333333 -13 9 C-12.34 8.01 -11.68 7.02 -11 6 C-8.375 5.8125 -8.375 5.8125 -6 6 C-5.67 5.01 -5.34 4.02 -5 3 C-2.5625 1.25 -2.5625 1.25 0 0 Z " fill="#567FD1" transform="translate(1068,930)"/>
+<path d="M0 0 C3.90373711 3.25311426 4.78537025 6.14148101 6 11 C6.37125 11.7425 6.7425 12.485 7.125 13.25 C8 15 8 15 8 18 C8.66 18 9.32 18 10 18 C10 20.31 10 22.62 10 25 C6.30789006 21.06968942 5.60991928 18.28596712 5 13 C4.34 12.67 3.68 12.34 3 12 C1.70871571 8.05018922 0.74302973 4.08666352 0 0 Z " fill="#939BAA" transform="translate(293,776)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-3.625 5.875 -3.625 5.875 -7 7 C-7.33 7.66 -7.66 8.32 -8 9 C-9.84765625 9.6328125 -9.84765625 9.6328125 -12.0625 10.125 C-12.79597656 10.29257812 -13.52945313 10.46015625 -14.28515625 10.6328125 C-14.85105469 10.75398437 -15.41695312 10.87515625 -16 11 C-8.84615385 3.84615385 -8.84615385 3.84615385 -4 2 C-3.278125 1.608125 -2.55625 1.21625 -1.8125 0.8125 C-1.214375 0.544375 -0.61625 0.27625 0 0 Z " fill="#CADBFE" transform="translate(1021,634)"/>
+<path d="M0 0 C3.32722441 0.5545374 6.1013913 1.24013043 9 3 C9.33 3.66 9.66 4.32 10 5 C12.79691761 6.8920325 15.63606574 8.29386011 18.75 9.5625 C22 11 22 11 23 13 C19.33420402 12.41503256 16.49500856 11.42173293 13.25 9.625 C12.47140625 9.20476563 11.6928125 8.78453125 10.890625 8.3515625 C9 7 9 7 8 4 C6.35 4 4.7 4 3 4 C2.67 3.01 2.34 2.02 2 1 C1.34 0.67 0.68 0.34 0 0 Z " fill="#8DB2FD" transform="translate(934,577)"/>
+<path d="M0 0 C0.33 0.66 0.66 1.32 1 2 C-0.98 2.33 -2.96 2.66 -5 3 C-5.33 3.99 -5.66 4.98 -6 6 C-7.1446875 6.1546875 -7.1446875 6.1546875 -8.3125 6.3125 C-11.02954673 6.75593985 -11.02954673 6.75593985 -12.5 8.5625 C-14 10 -14 10 -16.6875 10.1875 C-17.450625 10.125625 -18.21375 10.06375 -19 10 C-18.41863281 9.56945312 -17.83726562 9.13890625 -17.23828125 8.6953125 C-15.83866664 7.63522046 -14.45725122 6.550134 -13.10546875 5.4296875 C-8.68512949 1.8466019 -5.71201265 0.23800053 0 0 Z " fill="#59677B" transform="translate(774,438)"/>
+<path d="M0 0 C0.99 0.33 1.98 0.66 3 1 C3.12375 2.11375 3.2475 3.2275 3.375 4.375 C3.6465813 8.03103677 3.6465813 8.03103677 6 10 C6.34375 12.0234375 6.34375 12.0234375 6.5 14.375 C6.72824146 17.78720989 7.45356424 19.97103079 9 23 C8.625 25.25 8.625 25.25 8 27 C4.58850017 22.34795478 3.96031887 17.54584145 3 12 C2.65202977 10.16548048 2.29808345 8.33208207 1.9375 6.5 C1.78152344 5.6853125 1.62554688 4.870625 1.46484375 4.03125 C1.07217756 1.947342 1.07217756 1.947342 0 0 Z " fill="#425F94" transform="translate(1109,342)"/>
+<path d="M0 0 C0.33 0.66 0.66 1.32 1 2 C-0.98 2.33 -2.96 2.66 -5 3 C-5.33 3.99 -5.66 4.98 -6 6 C-7.1446875 6.1546875 -7.1446875 6.1546875 -8.3125 6.3125 C-11.02954673 6.75593985 -11.02954673 6.75593985 -12.5 8.5625 C-14 10 -14 10 -16.6875 10.1875 C-17.450625 10.125625 -18.21375 10.06375 -19 10 C-18.41863281 9.56945312 -17.83726562 9.13890625 -17.23828125 8.6953125 C-15.83866664 7.63522046 -14.45725122 6.550134 -13.10546875 5.4296875 C-8.68512949 1.8466019 -5.71201265 0.23800053 0 0 Z " fill="#59667A" transform="translate(994,328)"/>
+<path d="M0 0 C2.22694714 1.07223381 4.25980644 2.17554489 6.3125 3.5625 C9.53485115 5.28608317 12.40228671 5.52483032 16 6 C16.66 6.66 17.32 7.32 18 8 C21.12196336 8.46486718 21.12196336 8.46486718 24.625 8.625 C25.81351562 8.69976563 27.00203125 8.77453125 28.2265625 8.8515625 C29.14179688 8.90054688 30.05703125 8.94953125 31 9 C31 9.33 31 9.66 31 10 C19.27324041 10.60830453 10.40805523 9.23696556 1 2 C0.67 1.34 0.34 0.68 0 0 Z " fill="#80899A" transform="translate(394,979)"/>
+<path d="M0 0 C4.875 0.875 4.875 0.875 6 2 C7.155 2.144375 8.31 2.28875 9.5 2.4375 C10.655 2.623125 11.81 2.80875 13 3 C13.33 3.66 13.66 4.32 14 5 C16.01669827 6.13350534 16.01669827 6.13350534 18 7 C18 7.99 18 8.98 18 10 C18.99 10.33 19.98 10.66 21 11 C16.58720563 10.58630053 13.7453706 8.70827617 10.13671875 6.34375 C6.87963695 4.29542068 3.4639759 2.67013124 0 1 C0 0.67 0 0.34 0 0 Z " fill="#B6BCC5" transform="translate(162,975)"/>
+<path d="M0 0 C1.32 0 2.64 0 4 0 C2.9574168 3.02349127 2.12578605 3.92686857 -0.6875 5.5625 C-2.3271875 6.2740625 -2.3271875 6.2740625 -4 7 C-4.6084375 7.28101563 -5.216875 7.56203125 -5.84375 7.8515625 C-8.73332093 9.16166458 -10.79344203 10 -14 10 C-11.60578294 7.28074022 -9.14304439 5.95718828 -5.875 4.4375 C-2.23783085 2.95747651 -2.23783085 2.95747651 0 0 Z " fill="#98B9FD" transform="translate(881,951)"/>
+<path d="M0 0 C2.0625 0.4375 2.0625 0.4375 4 1 C3.360625 1.28875 2.72125 1.5775 2.0625 1.875 C-0.15206079 2.82823451 -0.15206079 2.82823451 -1 5 C-2.80211036 6.07499305 -4.64170189 7.08785138 -6.5 8.0625 C-9.9681637 9.71970534 -9.9681637 9.71970534 -13 12 C-14.66617115 12.04063832 -16.33388095 12.042721 -18 12 C-18 12.66 -18 13.32 -18 14 C-18.66 13.67 -19.32 13.34 -20 13 C-19 11 -19 11 -16.1875 9.9375 C-13 9 -13 9 -10.75 8.625 C-10.1725 8.41875 -9.595 8.2125 -9 8 C-8.566875 7.071875 -8.566875 7.071875 -8.125 6.125 C-6.49203823 3.04051666 -4.10913337 2.38918725 -1 1 C-0.67 0.67 -0.34 0.34 0 0 Z " fill="#A2C0FD" transform="translate(947,913)"/>
+<path d="M0 0 C2.5 1.0625 2.5 1.0625 5 3 C5.3125 6.6875 5.3125 6.6875 5 10 C5.66 10 6.32 10 7 10 C7.70180531 11.4096347 8.38593958 12.82807641 9.0625 14.25 C9.44535156 15.03890625 9.82820313 15.8278125 10.22265625 16.640625 C11.08564091 19.25993522 10.93045933 20.44855176 10 23 C9.67386719 22.27554688 9.34773438 21.55109375 9.01171875 20.8046875 C5.44223733 11.7897237 5.44223733 11.7897237 0 4 C0 2.68 0 1.36 0 0 Z " fill="#C2C7CF" transform="translate(358,781)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-0.38573379 2.89213369 -2.07175348 4.02391783 -5 5 C-5.33 5.66 -5.66 6.32 -6 7 C-8.32375692 7.39460023 -10.6593935 7.72230092 -13 8 C-14.33917261 8.30903983 -15.67653254 8.62942911 -17 9 C-16.67 8.01 -16.34 7.02 -16 6 C-14.02 5.67 -12.04 5.34 -10 5 C-9.67 4.01 -9.34 3.02 -9 2 C-6.94921875 1.77213542 -4.8984375 1.54427083 -2.84765625 1.31640625 C-0.98859771 1.18113386 -0.98859771 1.18113386 0 0 Z " fill="#45649C" transform="translate(666,522)"/>
+<path d="M0 0 C1.98 0 3.96 0 6 0 C6.33 0.66 6.66 1.32 7 2 C9.01943037 2.61461533 9.01943037 2.61461533 11.375 3 C14.67525619 3.60200113 16.11408973 4.07605982 19 6 C21.32387947 6.39387788 23.65793749 6.73486085 26 7 C26 7.33 26 7.66 26 8 C18.75643562 8.55719726 12.67614963 6.81425384 6 4 C5.34 3.34 4.68 2.68 4 2 C2.68252676 1.30251417 1.35085807 0.63040043 0 0 Z " fill="#B4BAC3" transform="translate(534,514)"/>
+<path d="M0 0 C1.48206495 0.254496 2.96068615 0.52911762 4.4375 0.8125 C5.67306641 1.03873047 5.67306641 1.03873047 6.93359375 1.26953125 C7.95646484 1.63111328 7.95646484 1.63111328 9 2 C9.33 2.99 9.66 3.98 10 5 C10.969375 5.12375 11.93875 5.2475 12.9375 5.375 C14.4534375 5.684375 14.4534375 5.684375 16 6 C16.33 6.66 16.66 7.32 17 8 C20.02934491 8.65772428 20.02934491 8.65772428 23 9 C23.33 10.32 23.66 11.64 24 13 C23.01 12.67 22.02 12.34 21 12 C21 11.34 21 10.68 21 10 C20.21625 10.04125 19.4325 10.0825 18.625 10.125 C16 10 16 10 14 8 C12.4840625 7.5359375 12.4840625 7.5359375 10.9375 7.0625 C9.968125 6.711875 8.99875 6.36125 8 6 C7.67 5.01 7.34 4.02 7 3 C5.02 3 3.04 3 1 3 C0.67 2.01 0.34 1.02 0 0 Z " fill="#5C697D" transform="translate(338,446)"/>
+<path d="M0 0 C5.03780976 0.49690081 8.6252535 2.23990106 12.8125 4.9375 C13.39708984 5.29779297 13.98167969 5.65808594 14.58398438 6.02929688 C18.85983067 8.71966135 18.85983067 8.71966135 20 11 C18.53815942 10.77139942 17.08044581 10.51629608 15.625 10.25 C14.81289062 10.11078125 14.00078125 9.9715625 13.1640625 9.828125 C10.38329787 8.76400568 10.18560767 7.63525897 9 5 C7.01751285 4.28293018 5.01584651 3.61709587 3 3 C1.125 1.375 1.125 1.375 0 0 Z " fill="#647083" transform="translate(200,346)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-2.79054395 4.72597863 -7.23263288 7.11677808 -13 9 C-14.03125 9.515625 -15.0625 10.03125 -16.125 10.5625 C-18.48906677 11.74453338 -20.42844149 12.50546952 -23 13 C-20.16978797 9.85531997 -17.91323919 8.49075779 -14 7 C-13.05125 6.34 -12.1025 5.68 -11.125 5 C-7.79261518 2.86727372 -4.81167676 1.97160388 -1 1 C-0.67 0.67 -0.34 0.34 0 0 Z " fill="#5075BD" transform="translate(1031,340)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C1.4946875 1.42410156 0.989375 1.84820312 0.46875 2.28515625 C-2.91356466 5.33863477 -4.80599018 7.06228589 -5.75 11.625 C-4.56484824 16.95818292 -1.39467491 19.07021673 3 22 C-0.35289282 21.71260919 -2.03956604 20.97186415 -4.8125 19 C-7.40299411 15.44732236 -7.67337008 13.51576986 -7.4296875 9.22265625 C-6.76680991 5.79377128 -5.27383386 3.59866727 -3 1 C-2.01 0.67 -1.02 0.34 0 0 Z " fill="#AEB5BE" transform="translate(111,280)"/>
+<path d="M0 0 C4.5076467 0.53031138 7.41954788 2.25221116 11 5 C11 5.66 11 6.32 11 7 C12.3303125 6.87625 12.3303125 6.87625 13.6875 6.75 C17.69008159 7.05208163 19.12835434 8.29727467 22 11 C19.03 10.505 19.03 10.505 16 10 C16 9.34 16 8.68 16 8 C14.02 8 12.04 8 10 8 C9.67 7.01 9.34 6.02 9 5 C7.02 5 5.04 5 3 5 C2.87625 4.360625 2.7525 3.72125 2.625 3.0625 C2.315625 2.0415625 2.315625 2.0415625 2 1 C1.34 0.67 0.68 0.34 0 0 Z " fill="#C4C9D0" transform="translate(391,209)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-1.97775619 5.39646736 -6.48295702 7.16098567 -12 9 C-14.11238375 10.05816607 -16.19415727 11.15687307 -18.265625 12.29296875 C-18.83796875 12.52628906 -19.4103125 12.75960938 -20 13 C-20.66 12.67 -21.32 12.34 -22 12 C-20.20963542 11.0234375 -18.41927083 10.046875 -16.62890625 9.0703125 C-14.83381685 8.08589976 -14.83381685 8.08589976 -14 6 C-12.109375 5.25390625 -12.109375 5.25390625 -9.75 4.5625 C-6.13022833 3.44031323 -3.24481285 1.96655324 0 0 Z " fill="#537BC8" transform="translate(850,1051)"/>
+<path d="M0 0 C0.99 0 1.98 0 3 0 C3.33 0.66 3.66 1.32 4 2 C4.825 2.309375 5.65 2.61875 6.5 2.9375 C7.325 3.288125 8.15 3.63875 9 4 C9.33 4.99 9.66 5.98 10 7 C10.680625 6.896875 11.36125 6.79375 12.0625 6.6875 C16.27422541 7.13555589 18.76919052 9.39300676 22 12 C19 13 19 13 16.375 12.1875 C14 11 14 11 13 9 C12.175 8.690625 11.35 8.38125 10.5 8.0625 C9.2625 7.5365625 9.2625 7.5365625 8 7 C7.67 6.01 7.34 5.02 7 4 C6.21625 3.896875 5.4325 3.79375 4.625 3.6875 C2 3 2 3 0 0 Z " fill="#87AEFD" transform="translate(770,921)"/>
+<path d="M0 0 C1.32 0.33 2.64 0.66 4 1 C0.32531726 4.31906828 -3.3590111 6.15860568 -7.859375 8.05859375 C-10.37928985 9.16680448 -12.65349285 10.56602341 -15 12 C-16.65369357 12.69822617 -18.31727014 13.37498605 -20 14 C-15.6819815 9.36212828 -10.73773634 6.61940137 -5 4 C-4.01 4 -3.02 4 -2 4 C-1.34 2.68 -0.68 1.36 0 0 Z " fill="#6A7589" transform="translate(363,686)"/>
+<path d="M0 0 C3.89051128 1.12392548 6.27180738 2.03457324 9 5 C11.6935891 6.81999264 14.01893883 8.00606043 17.125 9 C19.93006152 9.97567357 21.15213798 10.74150198 23 13 C21.02 13 19.04 13 17 13 C16.67 12.34 16.34 11.68 16 11 C14.65523362 10.17755704 13.27335035 9.4151162 11.875 8.6875 C7.6436943 6.40597997 3.81675636 3.92347295 0 1 C0 0.67 0 0.34 0 0 Z " fill="#B3CBFE" transform="translate(897,646)"/>
+<path d="M0 0 C-2.03606863 1.65901889 -3.80033766 2.92310069 -6.26171875 3.87109375 C-10.54332512 5.63626385 -14.33336432 8.19494862 -18.2578125 10.63671875 C-21 12 -21 12 -24 11 C-21.00070404 7.51566938 -17.51506223 6.55596907 -13.27734375 5.0625 C-10.68775536 4.09441987 -10.68775536 4.09441987 -9 1 C-2.58333333 -1.29166667 -2.58333333 -1.29166667 0 0 Z " fill="#9DBDFD" transform="translate(704,602)"/>
+<path d="M0 0 C0.33 0.66 0.66 1.32 1 2 C0.67 2.66 0.34 3.32 0 4 C-1.32 4 -2.64 4 -4 4 C-4.33 4.99 -4.66 5.98 -5 7 C-7.1796875 8.0625 -7.1796875 8.0625 -9.875 9 C-13.41097339 10.23707524 -15.41069521 11.33386124 -18 14 C-20.1875 13.6875 -20.1875 13.6875 -22 13 C-21.01 13 -20.02 13 -19 13 C-19 12.34 -19 11.68 -19 11 C-18.030625 10.54625 -17.06125 10.0925 -16.0625 9.625 C-12.92920418 8.34213779 -12.92920418 8.34213779 -12 6 C-11.113125 5.71125 -10.22625 5.4225 -9.3125 5.125 C-5.72553394 3.90678511 -3.07007891 2.19291351 0 0 Z " fill="#8EB3FD" transform="translate(845,533)"/>
+<path d="M0 0 C-0.80824219 0.39832031 -1.61648438 0.79664063 -2.44921875 1.20703125 C-3.51785156 1.73683594 -4.58648438 2.26664062 -5.6875 2.8125 C-6.74324219 3.33457031 -7.79898438 3.85664063 -8.88671875 4.39453125 C-11.98911805 5.92827713 -11.98911805 5.92827713 -14.70703125 7.76171875 C-15.46371094 8.17035156 -16.22039063 8.57898438 -17 9 C-17.99 8.67 -18.98 8.34 -20 8 C-19.67 7.34 -19.34 6.68 -19 6 C-18.05125 5.690625 -17.1025 5.38125 -16.125 5.0625 C-13.05425492 4.27517983 -13.05425492 4.27517983 -11.5 2.5 C-8.14655797 -0.85344203 -4.34767998 -1.31463325 0 0 Z " fill="#3D5786" transform="translate(731,491)"/>
+<path d="M0 0 C6.19593088 0.81488433 9.85374402 2.27853738 14.36328125 6.609375 C16.65249922 8.55439075 19.14642296 9.18469227 22 10 C22.33 10.66 22.66 11.32 23 12 C16.27431535 10.00178934 10.20757449 7.24852344 4 4 C2.66803091 3.33061179 1.33516147 2.6629978 0 2 C0 1.34 0 0.68 0 0 Z " fill="#CDD1D6" transform="translate(233,396)"/>
+<path d="M0 0 C0 0.33 0 0.66 0 1 C-1.35544922 1.05607422 -1.35544922 1.05607422 -2.73828125 1.11328125 C-3.91777344 1.17902344 -5.09726563 1.24476563 -6.3125 1.3125 C-7.48425781 1.37050781 -8.65601563 1.42851562 -9.86328125 1.48828125 C-13.21423769 2.03495036 -13.89015843 2.52093615 -16 5 C-18.6875 5.1875 -18.6875 5.1875 -21 5 C-21 5.66 -21 6.32 -21 7 C-22.32 6.67 -23.64 6.34 -25 6 C-17.30462003 -1.18235464 -9.87776186 -0.65447747 0 0 Z " fill="#C3C8CF" transform="translate(81,319)"/>
+<path d="M0 0 C0.33 0 0.66 0 1 0 C1 2.64 1 5.28 1 8 C1.66 8 2.32 8 3 8 C4.32 13.28 5.64 18.56 7 24 C3.33304789 21.55536526 3.23418341 20.11394469 2 16 C1.47986328 15.10667969 1.47986328 15.10667969 0.94921875 14.1953125 C-0.30933848 11.28457521 -0.19362732 8.90685673 -0.125 5.75 C-0.10695313 4.67234375 -0.08890625 3.5946875 -0.0703125 2.484375 C-0.04710937 1.66453125 -0.02390625 0.8446875 0 0 Z " fill="#5782D6" transform="translate(410,283)"/>
+<path d="M0 0 C0.33 0 0.66 0 1 0 C2.34797265 11.17369067 3.51482739 21.78208903 2 33 C1.67 33 1.34 33 1 33 C0.16941486 21.97991499 -0.12308347 11.05016019 0 0 Z " fill="#4A596E" transform="translate(786,268)"/>
+<path d="M0 0 C-1.08667969 0.48919922 -1.08667969 0.48919922 -2.1953125 0.98828125 C-11.35520451 5.01319289 -11.35520451 5.01319289 -20 10 C-22.1875 9.625 -22.1875 9.625 -24 9 C-23.01 8.67 -22.02 8.34 -21 8 C-20.67 7.34 -20.34 6.68 -20 6 C-16.41812714 3.97945633 -12.65253586 2.36814682 -8.875 0.75 C-8.04742188 0.39421875 -7.21984375 0.0384375 -6.3671875 -0.328125 C-3.77672133 -1.06337282 -2.50064994 -0.89885113 0 0 Z " fill="#939CA9" transform="translate(533,55)"/>
+<path d="M0 0 C4.56664195 0.53725199 7.24147184 2.44420085 11 5 C12.21742725 5.54771247 13.4471224 6.06896028 14.6875 6.5625 C17.56574436 7.81154944 19.06867658 8.61424754 21 11 C12.96004264 10.19600426 8.52370486 7.8222835 3 2 C2.01 1.34 1.02 0.68 0 0 Z " fill="#7B8695" transform="translate(410,1113)"/>
+<path d="M0 0 C0.556875 0.28875 1.11375 0.5775 1.6875 0.875 C4.02806407 2.05960441 4.02806407 2.05960441 6.6875 3 C9 4 9 4 10 6 C11.6635479 6.67441131 13.33066942 7.3400321 15 8 C16.36365283 8.95824253 17.70794169 9.94721175 19 11 C14.82851735 11.19402245 11.71055417 11.01430083 8 9 C7.67 8.01 7.34 7.02 7 6 C5.01924973 4.63823419 3.01920337 3.30406884 1 2 C0.67 1.34 0.34 0.68 0 0 Z " fill="#AEC8FD" transform="translate(730,896)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-0.88579369 3.24450621 -3.85903009 5.13375948 -7 7 C-7.84820313 7.51820313 -8.69640625 8.03640625 -9.5703125 8.5703125 C-10.41335938 9.08335937 -11.25640625 9.59640625 -12.125 10.125 C-12.97320313 10.64320313 -13.82140625 11.16140625 -14.6953125 11.6953125 C-17 13 -17 13 -20 14 C-20 13.01 -20 12.02 -20 11 C-19.195625 10.71125 -18.39125 10.4225 -17.5625 10.125 C-14.8673532 9.26737432 -14.8673532 9.26737432 -14 7 C-12.00458132 6.31974363 -10.00382009 5.65509503 -8 5 C-5.22949053 3.45366913 -2.64063103 1.76042068 0 0 Z " fill="#BBD1FE" transform="translate(1004,865)"/>
+<path d="M0 0 C6.72670877 2.43553248 12.89646679 5.23017066 19 9 C18.67 9.66 18.34 10.32 18 11 C11.72320373 8.48928149 5.89695365 5.29504282 0 2 C0 1.34 0 0.68 0 0 Z " fill="#B1CAFE" transform="translate(804,712)"/>
+<path d="M0 0 C1.27738037 0.48218994 1.27738037 0.48218994 2.58056641 0.97412109 C6.10658449 2.03197687 9.03979577 2.3130219 12.7109375 2.4140625 C14.57685547 2.47207031 14.57685547 2.47207031 16.48046875 2.53125 C17.76566406 2.5621875 19.05085937 2.593125 20.375 2.625 C21.68339844 2.66367187 22.99179687 2.70234375 24.33984375 2.7421875 C27.55975716 2.83619957 30.7796688 2.92185821 34 3 C34 3.33 34 3.66 34 4 C23.44 4 12.88 4 2 4 C2 3.34 2 2.68 2 2 C1.34 2 0.68 2 0 2 C0 1.34 0 0.68 0 0 Z " fill="#3A4A62" transform="translate(556,523)"/>
+<path d="M0 0 C2.475 0.495 2.475 0.495 5 1 C5 1.66 5 2.32 5 3 C5.99 2.87625 6.98 2.7525 8 2.625 C13.11141181 2.56228329 16.31963747 5.78804725 20 9 C16.39123368 9 13.93812023 8.0220839 10.5625 6.75 C9.42941406 6.33234375 8.29632812 5.9146875 7.12890625 5.484375 C4.02611187 4.01238765 2.23525664 2.57027053 0 0 Z " fill="#BEC4CB" transform="translate(513,504)"/>
+<path d="M0 0 C0 0.99 0 1.98 0 3 C-3 5 -3 5 -6 5 C-6.33 5.99 -6.66 6.98 -7 8 C-9.31 8 -11.62 8 -14 8 C-11.72402354 5.50447597 -9.39278822 3.93377014 -6.4375 2.3125 C-5.65246094 1.87550781 -4.86742187 1.43851562 -4.05859375 0.98828125 C-2 0 -2 0 0 0 Z " fill="#616E81" transform="translate(700,474)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-1.1254959 3.64465038 -4.08788267 4.84414715 -8 6 C-8 6.66 -8 7.32 -8 8 C-13.41538462 11.07692308 -13.41538462 11.07692308 -16.375 10.6875 C-16.91125 10.460625 -17.4475 10.23375 -18 10 C-15.0045072 7.42054787 -12.85648699 5.82639007 -9 5 C-8.67 4.34 -8.34 3.68 -8 3 C-5.67793475 2.29508733 -3.34406932 1.62787571 -1 1 C-0.67 0.67 -0.34 0.34 0 0 Z " fill="#CACFD4" transform="translate(731,456)"/>
+<path d="M0 0 C1.32 0 2.64 0 4 0 C4.33 0.66 4.66 1.32 5 2 C8.43814849 3.61795223 11.75026404 4.92137942 15.375 6.0625 C18 7 18 7 19 9 C21.01669827 10.13350534 21.01669827 10.13350534 23 11 C22.01 11.495 22.01 11.495 21 12 C19.33333333 11 17.66666667 10 16 9 C14.9275 8.731875 13.855 8.46375 12.75 8.1875 C7.89386336 6.6497234 4.00993183 4.11883587 0 1 C0 0.67 0 0.34 0 0 Z " fill="#ABB2BC" transform="translate(269,380)"/>
+<path d="M0 0 C5.30999598 1.62249877 10.2167143 3.50864215 15.13671875 6.08203125 C17.67447734 7.33228967 20.29458365 8.18837509 23 9 C23 9.33 23 9.66 23 10 C17.375 10.25 17.375 10.25 14 8 C12.205625 7.5359375 12.205625 7.5359375 10.375 7.0625 C8.704375 6.5365625 8.704375 6.5365625 7 6 C6.67 5.01 6.34 4.02 6 3 C5.195625 2.87625 4.39125 2.7525 3.5625 2.625 C2.716875 2.41875 1.87125 2.2125 1 2 C0.67 1.34 0.34 0.68 0 0 Z " fill="#395179" transform="translate(451,341)"/>
+<path d="M0 0 C2.33294775 -0.04241723 4.66702567 -0.04092937 7 0 C7.33 0.33 7.66 0.66 8 1 C11.18119432 1.20281522 14.35469227 1.34684901 17.54101562 1.4296875 C19.55859375 1.5234375 19.55859375 1.5234375 23 2 C23.99 3.485 23.99 3.485 25 5 C21.58211729 4.72159206 18.16605265 4.42496793 14.75 4.125 C13.29787109 4.00705078 13.29787109 4.00705078 11.81640625 3.88671875 C10.41455078 3.76103516 10.41455078 3.76103516 8.984375 3.6328125 C8.12553711 3.55949707 7.26669922 3.48618164 6.38183594 3.41064453 C3.92290383 2.9867081 2.15840847 2.22775866 0 1 C0 0.67 0 0.34 0 0 Z " fill="#334665" transform="translate(638,205)"/>
+<path d="M0 0 C1.85625 -0.061875 1.85625 -0.061875 3.75 -0.125 C4.79414062 -0.15980469 4.79414062 -0.15980469 5.859375 -0.1953125 C8 0 8 0 9.91796875 0.984375 C13.27198131 2.62047869 16.76090011 2.35107165 20.44140625 2.4609375 C23 3 23 3 24.83984375 5.0390625 C25.22269531 5.68617188 25.60554687 6.33328125 26 7 C21.97862553 6.37352475 18.06720631 5.57157933 14.125 4.5625 C13.09117187 4.29953125 12.05734375 4.0365625 10.9921875 3.765625 C10.00476563 3.51296875 9.01734375 3.2603125 8 3 C6.41695185 2.60302768 4.8336643 2.20700712 3.25 1.8125 C2.1775 1.544375 1.105 1.27625 0 1 C0 0.67 0 0.34 0 0 Z " fill="#D2D6DB" transform="translate(659,184)"/>
+<path d="M0 0 C2.64 0 5.28 0 8 0 C7.360625 0.28875 6.72125 0.5775 6.0625 0.875 C3.84793921 1.82823451 3.84793921 1.82823451 3 4 C0.70703125 4.59765625 0.70703125 4.59765625 -2.1875 5.0625 C-3.1775 5.22621094 -4.1675 5.38992187 -5.1875 5.55859375 C-6.115625 5.70425781 -7.04375 5.84992187 -8 6 C-9.8253125 6.309375 -9.8253125 6.309375 -11.6875 6.625 C-12.450625 6.74875 -13.21375 6.8725 -14 7 C-10.99586308 4.08974236 -8.86129036 2.76690358 -4.75 2.375 C-3.5125 2.25125 -2.275 2.1275 -1 2 C-0.67 1.34 -0.34 0.68 0 0 Z " fill="#A0A8B3" transform="translate(547,47)"/>
+<path d="M0 0 C4.455 1.98 4.455 1.98 9 4 C9 4.66 9 5.32 9 6 C14.29860806 4.7023817 18.34525646 2.84984298 23 0 C21.59505784 3.39527689 20.30238306 5.30647023 17 7 C12.64055086 7.60411842 9.12179928 7.5365127 5.125 5.625 C4.42375 5.08875 3.7225 4.5525 3 4 C2.01 3.34 1.02 2.68 0 2 C0 1.34 0 0.68 0 0 Z " fill="#78A4FD" transform="translate(842,963)"/>
+<path d="M0 0 C0.66 0 1.32 0 2 0 C2 0.66 2 1.32 2 2 C3.32 2 4.64 2 6 2 C6.99 3.485 6.99 3.485 8 5 C9.98636298 5.70626239 11.98848259 6.36893571 14 7 C15.69207001 7.9563874 17.36816893 8.94410931 19 10 C18.67 10.66 18.34 11.32 18 12 C13.09063519 10.01536316 8.52240319 7.70119286 3.91796875 5.0859375 C2.63046505 4.35696392 1.32334977 3.66167488 0 3 C0 2.01 0 1.02 0 0 Z " fill="#B8CFFE" transform="translate(749,907)"/>
+<path d="M0 0 C2.97 0.495 2.97 0.495 6 1 C6 1.99 6 2.98 6 4 C6.85851562 4.16822266 6.85851562 4.16822266 7.734375 4.33984375 C10.24789112 5.07223034 12.05930543 6.13854853 14.25 7.5625 C14.95640625 8.01753906 15.6628125 8.47257813 16.390625 8.94140625 C16.92171875 9.29074219 17.4528125 9.64007812 18 10 C15 11 15 11 11.875 9.6875 C9 8 9 8 8 6 C6.11986894 4.87775145 6.11986894 4.87775145 3.9375 3.875 C3.20402344 3.52179687 2.47054687 3.16859375 1.71484375 2.8046875 C1.14894531 2.53914062 0.58304688 2.27359375 0 2 C0 1.34 0 0.68 0 0 Z " fill="#BED4FE" transform="translate(761,799)"/>
+<path d="M0 0 C2.2477975 2.05233685 3.0022242 3.00667261 4 6 C4.08315752 8.06498892 4.10735878 10.1325789 4.09765625 12.19921875 C4.09443359 13.40771484 4.09121094 14.61621094 4.08789062 15.86132812 C4.07951172 17.12396484 4.07113281 18.38660156 4.0625 19.6875 C4.05798828 20.96173828 4.05347656 22.23597656 4.04882812 23.54882812 C4.03702873 26.69926564 4.02056597 29.84960949 4 33 C3.67 33 3.34 33 3 33 C2.970271 31.94872925 2.970271 31.94872925 2.93994141 30.8762207 C2.84443834 27.68794838 2.73486129 24.50030853 2.625 21.3125 C2.5940625 20.20970703 2.563125 19.10691406 2.53125 17.97070312 C2.49257813 16.90400391 2.45390625 15.83730469 2.4140625 14.73828125 C2.3826416 13.75899658 2.3512207 12.77971191 2.31884766 11.77075195 C1.98456826 8.8658998 1.09699673 6.69300324 0 4 C0 2.68 0 1.36 0 0 Z " fill="#6D798A" transform="translate(558,588)"/>
+<path d="M0 0 C1.33333333 0.66666667 2.66666667 1.33333333 4 2 C5.0828125 2.433125 5.0828125 2.433125 6.1875 2.875 C8 4 8 4 8.61328125 6.0703125 C8.74089844 6.70710938 8.86851562 7.34390625 9 8 C7.90554162 8.86657116 6.79902219 9.71792724 5.6875 10.5625 C5.07261719 11.03816406 4.45773437 11.51382812 3.82421875 12.00390625 C3.22222656 12.33261719 2.62023437 12.66132813 2 13 C1.01 12.67 0.02 12.34 -1 12 C0.3125 10.5 0.3125 10.5 2 9 C2.99 9 3.98 9 5 9 C3.7508258 5.54074837 2.32472205 2.85306797 0 0 Z " fill="#46556B" transform="translate(801,414)"/>
+<path d="M0 0 C5.57048313 -0.22281933 9.68935532 0.22978511 15 2 C18.99193164 2.46752353 22.98889143 2.75336226 27 3 C27 3.33 27 3.66 27 4 C17.49232119 4.322092 9.09743079 4.23806859 0 1 C0 0.67 0 0.34 0 0 Z " fill="#6F7B8C" transform="translate(513,387)"/>
+<path d="M0 0 C3.50325718 0.32843036 5.81062185 1.41014244 8.6875 3.3125 C13.19012075 6.27407082 17.95711438 8.15025302 23 10 C19.78177396 11.07033136 17.96857567 10.95795392 14.8125 9.75 C14.11769531 9.49734375 13.42289063 9.2446875 12.70703125 8.984375 C11 8 11 8 10 5 C9.278125 4.9175 8.55625 4.835 7.8125 4.75 C4.44686746 3.85249799 2.58387184 2.2885722 0 0 Z " fill="#C3C8CF" transform="translate(86,322)"/>
+<path d="M0 0 C4.68863653 -0.19535986 8.54762255 0.24627637 13.06640625 1.48828125 C15.68279342 2.18069886 18.32557358 2.59883604 21 3 C21 3.33 21 3.66 21 4 C6.82667294 4.38363893 6.82667294 4.38363893 1 2 C0.67 1.34 0.34 0.68 0 0 Z " fill="#5A687B" transform="translate(636,182)"/>
+<path d="M0 0 C6.74795531 1.67001711 11.52137687 3.72667396 17 8 C18.31252882 8.70674629 19.63552891 9.39963272 21 10 C20.01 10.495 20.01 10.495 19 11 C17.08809909 10.06082061 15.17992082 9.11249887 13.30078125 8.109375 C10.2605457 6.64345497 7.13901292 5.7685191 3.8828125 4.90625 C1.44923588 3.73490192 0.95981163 2.46520041 0 0 Z " fill="#A4ABB6" transform="translate(451,1134)"/>
+<path d="M0 0 C1.33333333 0.66666667 2.66666667 1.33333333 4 2 C4.94875 2.45375 5.8975 2.9075 6.875 3.375 C15.40540541 7.81081081 15.40540541 7.81081081 17 11 C4.44555215 7.14340491 4.44555215 7.14340491 1.1875 2.3125 C0.795625 1.549375 0.40375 0.78625 0 0 Z " fill="#D0DFFE" transform="translate(804,924)"/>
+<path d="M0 0 C2.5 0.25 2.5 0.25 4.5 2.25 C4.125 4.375 4.125 4.375 3.5 6.25 C2.84 4.93 2.18 3.61 1.5 2.25 C-1.57171498 3.3341347 -3.9574701 4.55498007 -6.6875 6.375 C-9.5 8.25 -9.5 8.25 -11.5 8.25 C-11.375 6.375 -11.375 6.375 -10.5 4.25 C-7.5625 3.125 -7.5625 3.125 -4.5 2.25 C-2.5 0.25 -2.5 0.25 0 0 Z " fill="#5C677D" transform="translate(277.5,742.75)"/>
+<path d="M0 0 C4.1071694 0.53488718 6.17832614 2.72045092 9.125 5.5 C12.30782183 8.61378784 12.30782183 8.61378784 16 11 C16.625 13.0625 16.625 13.0625 17 15 C14 15 14 15 12.5 13.8125 C11 12 11 12 9.625 9.5625 C7.15346648 5.66508176 4.36685975 3.45561992 0 2 C0 1.34 0 0.68 0 0 Z " fill="#C7CCD2" transform="translate(525,545)"/>
+<path d="M0 0 C4.58625609 0.54598287 7.95174647 1.79986221 12 4 C13.11375 4.495 13.11375 4.495 14.25 5 C16 6 16 6 18 9 C19.63495707 10.05104383 21.29883624 11.05988318 23 12 C22.01 12.33 21.02 12.66 20 13 C20 12.34 20 11.68 20 11 C19.195625 10.9071875 19.195625 10.9071875 18.375 10.8125 C15.54611924 9.844725 13.87137239 8.16766585 11.66015625 6.2109375 C8.96341129 4.2439 6.23557422 3.71182633 3 3 C3 2.34 3 1.68 3 1 C2.01 0.67 1.02 0.34 0 0 Z " fill="#959EAA" transform="translate(505,532)"/>
+<path d="M0 0 C3.3 0 6.6 0 10 0 C5.06739161 2.4663042 1.8356895 3.12678558 -3.640625 3.09765625 C-4.71054687 3.09443359 -5.78046875 3.09121094 -6.8828125 3.08789062 C-7.99398437 3.07951172 -9.10515625 3.07113281 -10.25 3.0625 C-11.93996094 3.05573242 -11.93996094 3.05573242 -13.6640625 3.04882812 C-16.44276217 3.03705397 -19.22135409 3.0206084 -22 3 C-22 2.67 -22 2.34 -22 2 C-14.74 2 -7.48 2 0 2 C0 1.34 0 0.68 0 0 Z " fill="#C0C5CD" transform="translate(588,521)"/>
+<path d="M0 0 C1.98 0 3.96 0 6 0 C-0.31735554 5.52768609 -6.87603506 8.25915037 -15 10 C-14.34 9.01 -13.68 8.02 -13 7 C-10.5 6.5 -10.5 6.5 -8 6 C-7.34 5.01 -6.68 4.02 -6 3 C-2.875 2.8125 -2.875 2.8125 0 3 C0 2.01 0 1.02 0 0 Z " fill="#3C5581" transform="translate(1035,335)"/>
+<path d="M0 0 C-0.71285156 0.38671875 -1.42570312 0.7734375 -2.16015625 1.171875 C-3.11792969 1.69265625 -4.07570313 2.2134375 -5.0625 2.75 C-6.06410156 3.29269531 -7.06570313 3.83539063 -8.09765625 4.39453125 C-10.4392633 5.68982129 -12.7196001 7.03983555 -15 8.4375 C-16.485 9.2109375 -16.485 9.2109375 -18 10 C-18.99 9.67 -19.98 9.34 -21 9 C-19.49736177 5.99472353 -17.08347159 6.02782386 -14 5 C-13.67 4.34 -13.34 3.68 -13 3 C-11.33333333 2.66666667 -9.66666667 2.33333333 -8 2 C-7.67 1.34 -7.34 0.68 -7 0 C-3.86650268 -1.04449911 -3.01031744 -0.93423645 0 0 Z " fill="#395179" transform="translate(1062,325)"/>
+<path d="M0 0 C0 3 0 3 -1.64453125 4.90234375 C-2.71767578 5.90974609 -2.71767578 5.90974609 -3.8125 6.9375 C-5.93991684 8.94866456 -7.84437886 10.77887506 -9.53125 13.17578125 C-11.79080001 15.98219044 -14.59095889 16.22814163 -18 17 C-15.49407552 14.389662 -12.86054502 11.98846897 -10.125 9.625 C-6.58651984 6.55699192 -3.26988406 3.35163116 0 0 Z " fill="#486AA8" transform="translate(752,316)"/>
+<path d="M0 0 C1.9375 1.0625 1.9375 1.0625 4 3 C5.68595223 9.46281688 5.08977187 16.36685591 5 23 C4.67 23 4.34 23 4 23 C3.87882813 21.79601562 3.75765625 20.59203125 3.6328125 19.3515625 C3.46400141 17.77599234 3.29470541 16.20047408 3.125 14.625 C3.00705078 13.43390625 3.00705078 13.43390625 2.88671875 12.21875 C2.53523142 7.6406878 2.53523142 7.6406878 0 4 C0 2.68 0 1.36 0 0 Z " fill="#4B6EB0" transform="translate(760,270)"/>
+<path d="M0 0 C0.66 0 1.32 0 2 0 C2 0.66 2 1.32 2 2 C3.051875 2.103125 4.10375 2.20625 5.1875 2.3125 C8.98176948 2.99671253 10.84757509 3.89838339 14 6 C15.99242489 7.0150089 17.99074195 8.01873444 20 9 C20 9.33 20 9.66 20 10 C15.32615737 10.31867109 13.61670901 9.81890555 10 7 C8.26860386 6.06871874 6.51761712 5.17305044 4.75 4.3125 C3.85796875 3.87550781 2.9659375 3.43851563 2.046875 2.98828125 C1.37140625 2.66214844 0.6959375 2.33601562 0 2 C0 1.34 0 0.68 0 0 Z " fill="#788293" transform="translate(823,161)"/>
+<path d="M0 0 C4.0663003 -0.18483183 6.45811739 0.06806403 10 2 C11.670625 2.433125 11.670625 2.433125 13.375 2.875 C17.19117855 4.05933127 19.83327457 5.58725681 23 8 C23.33 8.66 23.66 9.32 24 10 C22.53932801 9.54917531 21.08151968 9.08906463 19.625 8.625 C18.81289063 8.36976562 18.00078125 8.11453125 17.1640625 7.8515625 C15 7 15 7 13 5 C10.68060793 4.2863409 8.34476551 3.6252708 6 3 C3.99638693 2.34427209 1.99508067 1.68124706 0 1 C0 0.67 0 0.34 0 0 Z " fill="#7A8595" transform="translate(603,47)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C0 4 0 4 -2.75 4.875 C-6.63453683 6.21964736 -8.88815982 8.35162538 -12 11 C-15.01435688 12.47212778 -16.63630588 13 -20 13 C-17.7255286 10.49149939 -15.42644655 9.00829728 -12.4375 7.4375 C-9.86817488 6.08322518 -8.0643321 5.0643321 -6 3 C-4.34183216 2.31246699 -2.67540664 1.64438717 -1 1 C-0.67 0.67 -0.34 0.34 0 0 Z " fill="#364C70" transform="translate(660,1155)"/>
+<path d="M0 0 C-0.125 1.875 -0.125 1.875 -1 4 C-3.6875 5.0625 -3.6875 5.0625 -7 6 C-10.37177167 7.5782761 -13.56271483 9.33630911 -16.75 11.25 C-17.8225 11.8275 -18.895 12.405 -20 13 C-20.66 12.67 -21.32 12.34 -22 12 C-18.66702863 9.98001735 -15.29813725 8.0362816 -11.90625 6.1171875 C-9.1156089 4.48168882 -6.40812368 2.72003352 -3.69921875 0.953125 C-2 0 -2 0 0 0 Z " fill="#405B8D" transform="translate(788,1086)"/>
+<path d="M0 0 C1.65 0 3.3 0 5 0 C-0.37517791 4.81912502 -7.14887353 8.71629118 -14 11 C-13.67 9.68 -13.34 8.36 -13 7 C-12.195625 6.87625 -11.39125 6.7525 -10.5625 6.625 C-9.716875 6.41875 -8.87125 6.2125 -8 6 C-7.67 5.34 -7.34 4.68 -7 4 C-5 3.33333333 -3 2.66666667 -1 2 C-0.67 1.34 -0.34 0.68 0 0 Z " fill="#5781D4" transform="translate(785,1084)"/>
+<path d="M0 0 C-2.39421706 2.71925978 -4.85695561 4.04281172 -8.125 5.5625 C-11.76216915 7.04252349 -11.76216915 7.04252349 -14 10 C-15.32 9.67 -16.64 9.34 -18 9 C-17.01 9 -16.02 9 -15 9 C-14.79375 8.4225 -14.5875 7.845 -14.375 7.25 C-11.90248992 3.20407441 -4.79590849 -2.39795424 0 0 Z " fill="#5178C3" transform="translate(948,1000)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C0.6875 2.5 0.6875 2.5 -1 4 C-1.99 4 -2.98 4 -4 4 C-4 4.66 -4 5.32 -4 6 C-4.969375 6.28875 -5.93875 6.5775 -6.9375 6.875 C-10.10664203 7.64214682 -10.10664203 7.64214682 -11 10 C-13.3140622 10.73075648 -15.64828869 11.40138258 -18 12 C-17.67 11.01 -17.34 10.02 -17 9 C-16.01 8.67 -15.02 8.34 -14 8 C-13.67 7.34 -13.34 6.68 -13 6 C-11.2137116 5.26598743 -9.39485184 4.60998969 -7.5625 4 C-3.37786705 2.66663135 -3.37786705 2.66663135 0 0 Z " fill="#CDDDFE" transform="translate(955,894)"/>
+<path d="M0 0 C3.519934 3.05060947 4.65772597 5.58967104 6 10 C6.66 10.66 7.32 11.32 8 12 C8.6328125 14.1640625 8.6328125 14.1640625 9.125 16.625 C9.37636719 17.85089844 9.37636719 17.85089844 9.6328125 19.1015625 C9.81457031 20.04128906 9.81457031 20.04128906 10 21 C6.61018429 18.74012286 6.37425812 17.66468831 5 14 C4.34 13.34 3.68 12.68 3 12 C1.73094972 8.04354913 0.743044 4.08674202 0 0 Z " fill="#8790A0" transform="translate(348,900)"/>
+<path d="M0 0 C1.9375 0.5625 1.9375 0.5625 4 2 C4.75 5.625 4.75 5.625 5 9 C5.66 9 6.32 9 7 9 C7.12375 10.11375 7.2475 11.2275 7.375 12.375 C7.6465813 16.03103677 7.6465813 16.03103677 10 18 C9.625 20.125 9.625 20.125 9 22 C8.67 21.01 8.34 20.02 8 19 C7.34 18.67 6.68 18.34 6 18 C5.49662066 16.3556275 5.00272457 14.70741205 4.5703125 13.04296875 C3.78330593 10.2237603 2.73687026 7.52557062 1.68359375 4.796875 C1.08104615 3.2130356 0.53587413 1.6076224 0 0 Z " fill="#BDC2CB" transform="translate(393,854)"/>
+<path d="M0 0 C2.70028512 2.82254213 3.92924572 4.39646601 4.390625 8.33203125 C4.34421875 9.48058594 4.2978125 10.62914062 4.25 11.8125 C4.21390625 12.97394531 4.1778125 14.13539063 4.140625 15.33203125 C4.09421875 16.21246094 4.0478125 17.09289062 4 18 C4.99 18.33 5.98 18.66 7 19 C6.67 20.32 6.34 21.64 6 23 C3.03879408 19.68280211 2.43495415 16.99264237 1.875 12.625 C1.72804687 11.52414062 1.58109375 10.42328125 1.4296875 9.2890625 C1.28789063 8.20367188 1.14609375 7.11828125 1 6 C0.67483871 3.99865514 0.34409682 1.99817629 0 0 Z " fill="#E8EAED" transform="translate(36,851)"/>
+<path d="M0 0 C0.28875 0.61875 0.5775 1.2375 0.875 1.875 C1.93720042 4.13325765 1.93720042 4.13325765 4 6 C4.72640955 8.31543043 5.38431458 10.65269935 6 13 C6.37163684 14.31345624 6.74648071 15.62601062 7.125 16.9375 C7.41375 17.948125 7.7025 18.95875 8 20 C7.34 20 6.68 20 6 20 C5.67 18.35 5.34 16.7 5 15 C4.01 14.67 3.02 14.34 2 14 C0.45073518 9.18912503 -0.25400178 5.08003559 0 0 Z " fill="#667186" transform="translate(375,817)"/>
+<path d="M0 0 C-3 2 -3 2 -6 2 C-6.33 2.99 -6.66 3.98 -7 5 C-11.5461841 8.24727436 -16.60619697 9.75527622 -22 11 C-17.7387667 6.42311979 -14.1100127 4.18805802 -8 3 C-7.67 2.34 -7.34 1.68 -7 1 C-2.44155844 -1.22077922 -2.44155844 -1.22077922 0 0 Z " fill="#A5C2FD" transform="translate(918,696)"/>
+<path d="M0 0 C5.75 1.75 5.75 1.75 8 4 C9.5159375 4.4640625 9.5159375 4.4640625 11.0625 4.9375 C12.5165625 5.4634375 12.5165625 5.4634375 14 6 C14.33 6.99 14.66 7.98 15 9 C16.65 9 18.3 9 20 9 C20.33 9.99 20.66 10.98 21 12 C17.48478927 11.34903505 15.0225326 9.87109161 12 8 C10.5459375 7.2884375 10.5459375 7.2884375 9.0625 6.5625 C5.85228652 4.92463598 2.93153414 3.09395296 0 1 C0 0.67 0 0.34 0 0 Z " fill="#D2E1FE" transform="translate(897,553)"/>
+<path d="M0 0 C5.85967836 0.24415327 8.56735287 1.96691715 13.06640625 5.6328125 C15.61868901 7.43745688 17.90897422 7.84544871 21 8 C21 8.66 21 9.32 21 10 C16.12928472 9.52247889 13.05161394 8.70107596 9 6 C7.40157767 5.09395689 5.79694107 4.19882246 4.1875 3.3125 C3.00220703 2.65701172 3.00220703 2.65701172 1.79296875 1.98828125 C1.20128906 1.66214844 0.60960937 1.33601563 0 1 C0 0.67 0 0.34 0 0 Z " fill="#647183" transform="translate(380,468)"/>
+<path d="M0 0 C8.07930292 0.56696863 13.44551368 2.77897532 19 9 C18.67 9.66 18.34 10.32 18 11 C15.36004658 9.53335921 13.25040507 8.28617722 11.25 6 C7.95881056 3.07449828 4.18462323 2.18027835 0 1 C0 0.67 0 0.34 0 0 Z " fill="#547CCA" transform="translate(1083,321)"/>
+<path d="M0 0 C1.32 0.33 2.64 0.66 4 1 C3.01 1 2.02 1 1 1 C0.67 1.99 0.34 2.98 0 4 C-2.1875 5.4375 -2.1875 5.4375 -5 7 C-6.03125 7.7425 -7.0625 8.485 -8.125 9.25 C-9.07375 9.8275 -10.0225 10.405 -11 11 C-11.99 10.67 -12.98 10.34 -14 10 C-12.25 8 -12.25 8 -10 6 C-8.68 6 -7.36 6 -6 6 C-6 5.01 -6 4.02 -6 3 C-5.195625 2.87625 -4.39125 2.7525 -3.5625 2.625 C-2.716875 2.41875 -1.87125 2.2125 -1 2 C-0.67 1.34 -0.34 0.68 0 0 Z " fill="#657284" transform="translate(195,232)"/>
+<path d="M0 0 C1.48199902 0.44909061 2.96055236 0.90956564 4.4375 1.375 C5.26121094 1.63023437 6.08492187 1.88546875 6.93359375 2.1484375 C9 3 9 3 10 5 C11.64363134 5.72159424 13.31050386 6.39351421 15 7 C15 7.99 15 8.98 15 10 C14.34 10 13.68 10 13 10 C13 9.34 13 8.68 13 8 C12.113125 8.103125 11.22625 8.20625 10.3125 8.3125 C5.94027062 7.90002553 4.76441548 6.30194071 2 3 C1.34 2.01 0.68 1.02 0 0 Z " fill="#A2A9B4" transform="translate(736,212)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C3.42677273 5.28031818 3.264656 9.39042242 3.3125 13.875 C3.34150391 14.77347656 3.37050781 15.67195312 3.40039062 16.59765625 C3.44285953 21.02095578 3.43135678 23.33085466 0.98046875 27.1328125 C0.00013672 28.05707031 0.00013672 28.05707031 -1 29 C-1 27.35 -1 25.7 -1 24 C-0.34 24 0.32 24 1 24 C1.0270491 20.93744039 1.04686298 17.8751214 1.0625 14.8125 C1.07087891 13.94818359 1.07925781 13.08386719 1.08789062 12.19335938 C1.10396812 7.99713231 1.07559038 4.09063114 0 0 Z " fill="#626E83" transform="translate(434,953)"/>
+<path d="M0 0 C3.18559952 1.39633107 5.23943845 3.04557493 7.625 5.5625 C10.04521959 8.14015389 10.04521959 8.14015389 13 10 C13.33 10.99 13.66 11.98 14 13 C14.99 13.33 15.98 13.66 17 14 C17 14.99 17 15.98 17 17 C16.34 17 15.68 17 15 17 C15 16.34 15 15.68 15 15 C14.43539062 14.77183594 13.87078125 14.54367187 13.2890625 14.30859375 C10.37809185 12.6444723 8.58436619 10.57851735 6.375 8.0625 C5.59898438 7.18722656 4.82296875 6.31195312 4.0234375 5.41015625 C2 3 2 3 0 0 Z " fill="#BABFC8" transform="translate(67,917)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-0.14800843 3.36280927 -2.16680467 4.58340234 -5 6 C-5.33 6.66 -5.66 7.32 -6 8 C-9.59903281 10.57073772 -12.62563349 11.49135273 -17 12 C-13.58150045 8.27986814 -10.55071418 6.13604951 -6 4 C-3.95508885 2.72367732 -1.98448669 1.37024081 0 0 Z " fill="#A2C0FD" transform="translate(994,886)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-3.91684902 6.88183807 -3.91684902 6.88183807 -8.4375 7.375 C-9.283125 7.25125 -10.12875 7.1275 -11 7 C-11.33 7.99 -11.66 8.98 -12 10 C-15.0625 11.1875 -15.0625 11.1875 -18 12 C-18 11.34 -18 10.68 -18 10 C-17.195625 9.71125 -16.39125 9.4225 -15.5625 9.125 C-12.8673532 8.26737432 -12.8673532 8.26737432 -12 6 C-10.05831897 4.87045065 -8.0712024 3.81804543 -6.0625 2.8125 C-4.98097656 2.26207031 -3.89945313 1.71164062 -2.78515625 1.14453125 C-1.86605469 0.76683594 -0.94695313 0.38914062 0 0 Z " fill="#B3CCFE" transform="translate(740,797)"/>
+<path d="M0 0 C0.763125 0.061875 1.52625 0.12375 2.3125 0.1875 C1.1875 2.125 1.1875 2.125 -0.6875 4.1875 C-3.875 4.9375 -3.875 4.9375 -6.6875 5.1875 C-6.6875 5.8475 -6.6875 6.5075 -6.6875 7.1875 C-11.00142226 6.7081753 -12.85319547 5.4417015 -15.6875 2.1875 C-14.6975 2.5175 -13.7075 2.8475 -12.6875 3.1875 C-9.1875 3.52083333 -9.1875 3.52083333 -5.6875 3.1875 C-2.41705975 0.16863208 -2.41705975 0.16863208 0 0 Z " fill="#90B4FD" transform="translate(760.6875,664.8125)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C0.58680023 2.12935196 -0.83071405 3.25330626 -2.25 4.375 C-3.03890625 5.00148438 -3.8278125 5.62796875 -4.640625 6.2734375 C-6.74333352 7.81217453 -8.5639251 9.08395531 -11 10 C-11.99 9.67 -12.98 9.34 -14 9 C-11.69852146 5.54778219 -10.76852609 5.37037312 -7 4 C-3.25070831 2.37738745 -3.25070831 2.37738745 0 0 Z " fill="#CFDEFE" transform="translate(781,662)"/>
+<path d="M0 0 C0.66 0 1.32 0 2 0 C2.33 0.66 2.66 1.32 3 2 C3.70125 2.268125 4.4025 2.53625 5.125 2.8125 C8.2484534 4.10262206 10.59170613 5.76322071 13.2890625 7.765625 C15.147339 9.14708724 15.147339 9.14708724 17.875 10.6875 C20 12 20 12 21 14 C17.81020102 12.43136944 14.68348597 10.76367543 11.5625 9.0625 C10.63566406 8.55847656 9.70882812 8.05445313 8.75390625 7.53515625 C7.84511719 7.02855469 6.93632813 6.52195312 6 6 C5.08089844 5.50371094 4.16179688 5.00742187 3.21484375 4.49609375 C1 3 1 3 0 0 Z " fill="#D7E4FE" transform="translate(710,655)"/>
+<path d="M0 0 C1.485 0.99 1.485 0.99 3 2 C3.38063221 4.3260857 3.71269945 6.66055264 4 9 C4.99 10.485 4.99 10.485 6 12 C6.25760279 14.69452521 6.08900053 17.28548375 6 20 C2.45294171 16.45294171 1.75340029 13.37764284 1.4375 8.4375 C1.23116194 5.33400708 0.98863604 2.96590813 0 0 Z " fill="#5A85DC" transform="translate(1111,355)"/>
+<path d="M0 0 C1.38149095 3.73002558 0.43774626 5.40563435 -1 9 C-1.26473392 11.27263886 -1.43585195 13.53182499 -1.55859375 15.81640625 C-2.09867735 18.48814725 -3.25213469 19.9445104 -5 22 C-4.74320437 19.4562127 -4.47007458 16.91594626 -4.1875 14.375 C-4.11724609 13.66214844 -4.04699219 12.94929688 -3.97460938 12.21484375 C-3.44318938 7.58086137 -2.36531606 4.10852159 0 0 Z " fill="#A0A8B3" transform="translate(41,352)"/>
+<path d="M0 0 C-3.19908062 2.84278491 -5.3870152 3.38544134 -9.625 3.5625 C-13.81137053 3.57372628 -13.81137053 3.57372628 -17 6 C-19.68839385 6.26991906 -22.29141936 6.08737357 -25 6 C-25 5.67 -25 5.34 -25 5 C-23.88625 4.87625 -22.7725 4.7525 -21.625 4.625 C-17.96896323 4.3534187 -17.96896323 4.3534187 -16 2 C-13.6875 1.40234375 -13.6875 1.40234375 -11 0.9375 C-2.09529627 -0.62858888 -2.09529627 -0.62858888 0 0 Z " fill="#5A85DD" transform="translate(510,214)"/>
+<path d="M0 0 C1.8871875 0.0309375 1.8871875 0.0309375 3.8125 0.0625 C3.8125 0.3925 3.8125 0.7225 3.8125 1.0625 C-1.81652202 2.33356949 -7.43653153 3.50364481 -13.12109375 4.5 C-15.38996378 4.93392674 -15.38996378 4.93392674 -17.1875 7.0625 C-20.3125 7.1875 -20.3125 7.1875 -23.1875 7.0625 C-19.99395746 4.3075886 -17.21590102 3.36010717 -13.125 2.4375 C-2.3552499 -0.03861065 -2.3552499 -0.03861065 0 0 Z " fill="#4A6BAC" transform="translate(509.1875,211.9375)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-3.55833964 5.14150797 -8.08248857 7.8141409 -15 9 C-12.7445814 5.43881274 -10.95109129 4.34696294 -7 3 C-5.76894751 2.44163926 -4.5398438 1.87896637 -3.3125 1.3125 C-1.6728125 0.6628125 -1.6728125 0.6628125 0 0 Z " fill="#415D8F" transform="translate(640,1166)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-3.82229607 7.16478408 -8.78355633 10.30004614 -17 12 C-17 11.34 -17 10.68 -17 10 C-15.7625 9.5875 -14.525 9.175 -13.25 8.75 C-9.63317386 7.41279315 -7.64360688 5.83243594 -5 3 C-2.8125 2.375 -2.8125 2.375 -1 2 C-0.67 1.34 -0.34 0.68 0 0 Z " fill="#89AFFD" transform="translate(970,882)"/>
+<path d="M0 0 C-3.24483403 2.78128631 -6.04743485 4.45753555 -10 6 C-11.03125 6.721875 -12.0625 7.44375 -13.125 8.1875 C-14.07375 8.785625 -15.0225 9.38375 -16 10 C-16.99 9.67 -17.98 9.34 -19 9 C-18 7 -18 7 -15.0625 6 C-14.051875 5.67 -13.04125 5.34 -12 5 C-11.34 4.34 -10.68 3.68 -10 3 C-8.68 3 -7.36 3 -6 3 C-6 2.01 -6 1.02 -6 0 C-3.50907189 -1.24546405 -2.58919267 -0.7767578 0 0 Z " fill="#8BB1FD" transform="translate(1010,641)"/>
+<path d="M0 0 C3.50989295 0.64998018 5.97242212 2.15391593 9 4 C10.3303125 4.495 10.3303125 4.495 11.6875 5 C14 6 14 6 16 9 C5.53488372 5.72093023 5.53488372 5.72093023 1 3 C0.67 2.01 0.34 1.02 0 0 Z " fill="#8AB0FD" transform="translate(895,554)"/>
+<path d="M0 0 C1.32 0.33 2.64 0.66 4 1 C0.89559368 3.49540795 -2.30028833 5.25357598 -5.875 7 C-6.88304687 7.495 -7.89109375 7.99 -8.9296875 8.5 C-9.94289063 8.995 -10.95609375 9.49 -12 10 C-14.00092336 10.99815114 -16.00119474 11.99761408 -18 13 C-17 10 -17 10 -14.41796875 8.46484375 C-12.81888672 7.70880859 -12.81888672 7.70880859 -11.1875 6.9375 C-10.12917969 6.43089844 -9.07085938 5.92429687 -7.98046875 5.40234375 C-6.21670514 4.57247332 -4.44969331 3.74935611 -2.67578125 2.94140625 C-0.81834716 2.10400078 -0.81834716 2.10400078 0 0 Z " fill="#8BB1FD" transform="translate(805,538)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-4.21281493 6.32307847 -10.42424419 9.9272168 -18 13 C-17 10 -17 10 -15.00390625 8.9375 C-14.19824219 8.628125 -13.39257812 8.31875 -12.5625 8 C-9.02469848 6.63712301 -8.19275781 6.28913671 -6 3 C-4.35636866 2.27840576 -2.68949614 1.60648579 -1 1 C-0.67 0.67 -0.34 0.34 0 0 Z " fill="#8CB1FD" transform="translate(846,514)"/>
+<path d="M0 0 C7.0971146 1.10892416 13.28619611 3.67980682 19 8 C19.33 8.66 19.66 9.32 20 10 C12.755702 7.86233829 6.53281715 4.77315981 0 1 C0 0.67 0 0.34 0 0 Z " fill="#6B7788" transform="translate(451,504)"/>
+<path d="M0 0 C1.9375 1.4375 1.9375 1.4375 3 3 C3 3.33 3 3.66 3 4 C-2.21979128 4.1799928 -6.07262981 3.97094808 -11 2 C-7.35969312 -0.3297964 -4.24881273 -0.3862557 0 0 Z " fill="#47566C" transform="translate(551,389)"/>
+<path d="M0 0 C3.3 0 6.6 0 10 0 C10 0.33 10 0.66 10 1 C8.88625 1.12375 7.7725 1.2475 6.625 1.375 C2.96896323 1.6465813 2.96896323 1.6465813 1 4 C-1.1894648 4.61350042 -3.40231857 5.14559812 -5.625 5.625 C-6.81351563 5.88539063 -8.00203125 6.14578125 -9.2265625 6.4140625 C-10.14179687 6.60742188 -11.05703125 6.80078125 -12 7 C-11.67 6.01 -11.34 5.02 -11 4 C-5.555 3.505 -5.555 3.505 0 3 C0 2.01 0 1.02 0 0 Z " fill="#536176" transform="translate(691,376)"/>
+<path d="M0 0 C4.15929828 0.61166151 7.28450751 2.06794391 11 4 C12.2686975 4.5053949 13.53955537 5.00539984 14.8125 5.5 C15.864375 5.995 16.91625 6.49 18 7 C18.33 7.99 18.66 8.98 19 10 C15.21283842 8.49637741 11.44754813 6.94512999 7.6875 5.375 C6.61886719 4.92898437 5.55023437 4.48296875 4.44921875 4.0234375 C3.23685547 3.51683594 3.23685547 3.51683594 2 3 C2 2.34 2 1.68 2 1 C1.34 0.67 0.68 0.34 0 0 Z " fill="#939BA8" transform="translate(965,240)"/>
+<path d="M0 0 C1.32 0.33 2.64 0.66 4 1 C4 2.98 4 4.96 4 7 C4.99 7.33 5.98 7.66 7 8 C8 14.625 8 14.625 8 18 C5.79046606 14.5341882 4.21966689 11.1929757 2.875 7.3125 C1.59368008 3.58991116 1.59368008 3.58991116 0 0 Z " fill="#5D697F" transform="translate(356,917)"/>
+<path d="M0 0 C0.99 0 1.98 0 3 0 C4.96189209 3.6678852 6.39301257 6.87248551 7 11 C7.99 11.33 8.98 11.66 10 12 C9.67 12.66 9.34 13.32 9 14 C5.33663903 12.77887968 4.64957986 11.13279518 2.76953125 7.88671875 C2 6 2 6 2 2 C1.34 2 0.68 2 0 2 C0 1.34 0 0.68 0 0 Z " fill="#828C9B" transform="translate(49,895)"/>
+<path d="M0 0 C5.0548361 0.48141296 7.92435247 2.02817367 12 5 C13.093125 5.70125 14.18625 6.4025 15.3125 7.125 C18 9 18 9 19 11 C14.43864068 9.75599291 12.28754936 8.28754936 9 5 C7.00827818 4.30899447 5.00838196 3.64097297 3 3 C1.125 1.375 1.125 1.375 0 0 Z " fill="#D1E0FE" transform="translate(710,885)"/>
+<path d="M0 0 C1.485 0.99 1.485 0.99 3 2 C3.1875 4.625 3.1875 4.625 3 7 C3.99 7.33 4.98 7.66 6 8 C6.103125 9.051875 6.20625 10.10375 6.3125 11.1875 C6.98485228 14.91599898 8.06714408 16.83714485 10 20 C9.67 20.99 9.34 21.98 9 23 C5.13716869 15.46747894 1.80882648 8.29045471 0 0 Z " fill="#B9BFC7" transform="translate(40,872)"/>
+<path d="M0 0 C2.0625 0.4375 2.0625 0.4375 4 1 C3.360625 1.28875 2.72125 1.5775 2.0625 1.875 C-0.15206079 2.82823451 -0.15206079 2.82823451 -1 5 C-2.94168103 6.12954935 -4.9287976 7.18195457 -6.9375 8.1875 C-8.01902344 8.73792969 -9.10054687 9.28835938 -10.21484375 9.85546875 C-11.13394531 10.23316406 -12.05304687 10.61085938 -13 11 C-13.66 10.67 -14.32 10.34 -15 10 C-13.2421875 9.05598958 -11.484375 8.11197917 -9.7265625 7.16796875 C-7.69497635 5.95236507 -7.69497635 5.95236507 -6 3 C-4.35636866 2.27840576 -2.68949614 1.60648579 -1 1 C-0.67 0.67 -0.34 0.34 0 0 Z " fill="#CDDDFE" transform="translate(726,813)"/>
+<path d="M0 0 C2.83634884 1.41817442 2.86615595 3.03940721 4 6 C5.07647246 8.08891682 6.17460972 10.16367804 7.29296875 12.23046875 C7.52628906 12.81441406 7.75960938 13.39835938 8 14 C7.67 14.66 7.34 15.32 7 16 C6.401875 15.05125 5.80375 14.1025 5.1875 13.125 C3.18437474 9.86035803 3.18437474 9.86035803 0 8 C-0.40843923 5.28796348 -0.13336867 2.7562858 0 0 Z " fill="#6D788B" transform="translate(360,787)"/>
+<path d="M0 0 C1.44096586 0.42594588 2.87768712 0.86626633 4.3125 1.3125 C5.11300781 1.55613281 5.91351562 1.79976562 6.73828125 2.05078125 C9.13522167 3.05675107 10.26430461 4.10651412 12 6 C13.64605826 7.03357147 15.30963442 8.04060332 17 9 C16.01 9.495 16.01 9.495 15 10 C11.4375 8.75 11.4375 8.75 8 7 C7.67 6.01 7.34 5.02 7 4 C5.35 4 3.7 4 2 4 C1.34 2.68 0.68 1.36 0 0 Z " fill="#8EB3FD" transform="translate(825,725)"/>
+<path d="M0 0 C1.32 0 2.64 0 4 0 C4.33 0.66 4.66 1.32 5 2 C6.99541868 2.68025637 8.99617991 3.34490497 11 4 C13.875 5.4375 13.875 5.4375 16 7 C16 7.99 16 8.98 16 10 C15.34 10 14.68 10 14 10 C14 9.34 14 8.68 14 8 C13.175 7.773125 12.35 7.54625 11.5 7.3125 C7.30128952 5.73798357 3.62460158 3.64025547 0 1 C0 0.67 0 0.34 0 0 Z " fill="#9FBEFD" transform="translate(824,714)"/>
+<path d="M0 0 C1.46366342 0.39753821 2.9208935 0.81881384 4.375 1.25 C5.18710937 1.48203125 5.99921875 1.7140625 6.8359375 1.953125 C9.49811935 3.24096748 9.79661613 4.38394811 11 7 C11.99 7.33 12.98 7.66 14 8 C8.87729157 8.62472054 6.39541865 7.31053954 2.41796875 4.38671875 C1 3 1 3 0 0 Z " fill="#9CBDFD" transform="translate(790,704)"/>
+<path d="M0 0 C5.76878411 2.83194857 11.40467128 5.83967544 17 9 C13.25 10.125 13.25 10.125 11 9 C11 8.34 11 7.68 11 7 C10.29875 7.0825 9.5975 7.165 8.875 7.25 C5.00323092 6.91332443 2.98055586 5.42603384 0 3 C0 2.01 0 1.02 0 0 Z " fill="#94B7FD" transform="translate(715,660)"/>
+<path d="M0 0 C0.99 0.495 0.99 0.495 2 1 C2 1.66 2 2.32 2 3 C2.94875 2.95875 3.8975 2.9175 4.875 2.875 C8 3 8 3 10 5 C11.7015625 5.4640625 11.7015625 5.4640625 13.4375 5.9375 C16.713753 6.91462809 17.97465139 7.37896062 20 10 C17.69 9.67 15.38 9.34 13 9 C13 8.34 13 7.68 13 7 C12.34 6.896875 11.68 6.79375 11 6.6875 C7.16158991 5.80786436 3.66903309 4.43030104 0 3 C0 2.01 0 1.02 0 0 Z " fill="#647083" transform="translate(472,485)"/>
+<path d="M0 0 C0.804375 0.4640625 0.804375 0.4640625 1.625 0.9375 C4.06246442 2.15239728 4.06246442 2.15239728 7.1875 2.5 C8.115625 2.665 9.04375 2.83 10 3 C10.33 3.66 10.66 4.32 11 5 C11.825 5.309375 12.65 5.61875 13.5 5.9375 C14.7375 6.4634375 14.7375 6.4634375 16 7 C16.33 7.99 16.66 8.98 17 10 C15.53932801 9.54917531 14.08151968 9.08906463 12.625 8.625 C11.40683594 8.24214844 11.40683594 8.24214844 10.1640625 7.8515625 C8 7 8 7 6 5 C5.34 4.87625 4.68 4.7525 4 4.625 C2 4 2 4 0.75 1.9375 C0.5025 1.298125 0.255 0.65875 0 0 Z " fill="#98A0AD" transform="translate(364,460)"/>
+<path d="M0 0 C6.89835786 1.85913191 12.24385683 4.79515783 18 9 C16.17578125 9.640625 16.17578125 9.640625 14 10 C12.52149759 8.81719807 11.04902937 7.62247986 9.65625 6.33984375 C7.89309525 4.9135181 6.28957582 4.14385376 4.1875 3.3125 C1 2 1 2 0 0 Z " fill="#9EA6B1" transform="translate(419,457)"/>
+<path d="M0 0 C0.33 0.66 0.66 1.32 1 2 C-2 4 -2 4 -5 4 C-5.33 4.99 -5.66 5.98 -6 7 C-9 8.125 -9 8.125 -12 9 C-12.33 9.33 -12.66 9.66 -13 10 C-14.99958364 10.04080783 -17.00045254 10.04254356 -19 10 C-18.38125 9.71125 -17.7625 9.4225 -17.125 9.125 C-14.86674235 8.06279958 -14.86674235 8.06279958 -13 6 C-11 5.33333333 -9 4.66666667 -7 4 C-5.31008021 3.0398183 -3.63790712 2.04644066 -2 1 C-1.34 0.67 -0.68 0.34 0 0 Z " fill="#48576D" transform="translate(747,451)"/>
+<path d="M0 0 C-0.33 1.32 -0.66 2.64 -1 4 C-2.98 4 -4.96 4 -7 4 C-7.33 4.99 -7.66 5.98 -8 7 C-10.06640625 7.73046875 -10.06640625 7.73046875 -12.5625 8.1875 C-13.38878906 8.34605469 -14.21507812 8.50460937 -15.06640625 8.66796875 C-15.70449219 8.77753906 -16.34257813 8.88710938 -17 9 C-16.34 8.01 -15.68 7.02 -15 6 C-12.375 5.8125 -12.375 5.8125 -10 6 C-9.67 5.01 -9.34 4.02 -9 3 C-2.88888889 0 -2.88888889 0 0 0 Z " fill="#577FD2" transform="translate(867,423)"/>
+<path d="M0 0 C5.97869952 0.39315711 10.47830484 1.54591326 16 4 C18.32189536 4.4054103 20.65515344 4.76072994 23 5 C23 5.33 23 5.66 23 6 C21.20841511 6.02696365 19.41671527 6.04637917 17.625 6.0625 C16.62726563 6.07410156 15.62953125 6.08570313 14.6015625 6.09765625 C12 6 12 6 10 5 C10 4.34 10 3.68 10 3 C9.36191406 2.95101563 8.72382813 2.90203125 8.06640625 2.8515625 C7.24011719 2.77679688 6.41382813 2.70203125 5.5625 2.625 C4.73878906 2.55539062 3.91507812 2.48578125 3.06640625 2.4140625 C2.38449219 2.27742188 1.70257813 2.14078125 1 2 C0.67 1.34 0.34 0.68 0 0 Z " fill="#D6D9DE" transform="translate(489,383)"/>
+<path d="M0 0 C1.85625 -0.061875 1.85625 -0.061875 3.75 -0.125 C4.79414062 -0.15980469 4.79414062 -0.15980469 5.859375 -0.1953125 C8 0 8 0 9.875 0.96875 C12.68026955 2.33013081 15.14976931 2.42281104 18.25 2.625 C19.32765625 2.69976562 20.4053125 2.77453125 21.515625 2.8515625 C22.33546875 2.90054687 23.1553125 2.94953125 24 3 C24 3.33 24 3.66 24 4 C18.06 4 12.12 4 6 4 C5.67 3.34 5.34 2.68 5 2 C2.47266765 1.34444881 2.47266765 1.34444881 0 1 C0 0.67 0 0.34 0 0 Z " fill="#3A527B" transform="translate(519,364)"/>
+<path d="M0 0 C0.33 0.66 0.66 1.32 1 2 C-2 4 -2 4 -5 4 C-5.33 4.99 -5.66 5.98 -6 7 C-7.98 7 -9.96 7 -12 7 C-12.33 7.99 -12.66 8.98 -13 10 C-14.98 10 -16.96 10 -19 10 C-13 6 -13 6 -10.125 5.0625 C-7.08149642 4.02770878 -4.69807001 2.72376695 -2 1 C-1.34 0.67 -0.68 0.34 0 0 Z " fill="#4A596E" transform="translate(967,341)"/>
+<path d="M0 0 C1.4835001 0.42257276 2.96176424 0.86356322 4.4375 1.3125 C5.67306641 1.67794922 5.67306641 1.67794922 6.93359375 2.05078125 C7.61550781 2.36402344 8.29742187 2.67726563 9 3 C9.33 3.99 9.66 4.98 10 6 C11.0828125 5.87625 11.0828125 5.87625 12.1875 5.75 C15.83548794 6.07426559 17.34568298 7.57319587 20 10 C16.06379173 9.3391237 12.57251869 8.18411471 8.875 6.6875 C7.84117187 6.27886719 6.80734375 5.87023437 5.7421875 5.44921875 C2.90154635 3.94796823 1.67029687 2.70127322 0 0 Z " fill="#C5C9D1" transform="translate(184,336)"/>
+<path d="M0 0 C0.85078125 0.33451172 0.85078125 0.33451172 1.71875 0.67578125 C0.72875 0.67578125 -0.26125 0.67578125 -1.28125 0.67578125 C-1.28125 1.66578125 -1.28125 2.65578125 -1.28125 3.67578125 C-2.250625 4.15015625 -3.22 4.62453125 -4.21875 5.11328125 C-7.08602437 6.37772072 -7.08602437 6.37772072 -8.28125 7.67578125 C-10.61422433 7.71671062 -12.94830225 7.71819848 -15.28125 7.67578125 C-14.7140625 7.41152344 -14.146875 7.14726562 -13.5625 6.875 C-10.31737814 5.16908833 -7.45552015 2.98128357 -4.5 0.8203125 C-2.28125 -0.32421875 -2.28125 -0.32421875 0 0 Z " fill="#5780D4" transform="translate(467.28125,226.32421875)"/>
+<path d="M0 0 C5.56932457 1.98904449 10.74815169 4.28029284 16 7 C16 7.66 16 8.32 16 9 C16.99 9.33 17.98 9.66 19 10 C17.35 10 15.7 10 14 10 C14 9.34 14 8.68 14 8 C13.175 7.7525 12.35 7.505 11.5 7.25 C7.47626529 5.81295189 3.78020976 3.97645485 0 2 C0 1.34 0 0.68 0 0 Z " fill="#616E80" transform="translate(374,1094)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-3.73114108 6.9938868 -8.88612362 9.43390254 -17 11 C-14.9007582 8.70578218 -13.00589024 7.35773654 -10.1875 6.0625 C-6.54175951 4.31712701 -3.309155 2.3164085 0 0 Z " fill="#81AAFD" transform="translate(918,825)"/>
+<path d="M0 0 C5.75 2.75 5.75 2.75 8 5 C8.94875 5.28875 9.8975 5.5775 10.875 5.875 C14.20111038 7.07239974 15.71324878 8.3614409 18 11 C13.54561762 10.58240165 10.58437021 8.6662433 6.9375 6.26953125 C5.33286926 5.2181099 3.67204598 4.25302587 2 3.3125 C1.34 2.879375 0.68 2.44625 0 2 C0 1.34 0 0.68 0 0 Z " fill="#A5C2FD" transform="translate(989,818)"/>
+<path d="M0 0 C0.66 0 1.32 0 2 0 C2.10957031 0.59167969 2.21914063 1.18335938 2.33203125 1.79296875 C3.26552356 6.44525155 4.28011784 10.03350518 7 14 C9.11056645 17.48243464 9.11056645 17.48243464 8.546875 20.12109375 C8.36640625 20.74113281 8.1859375 21.36117187 8 22 C7.73445313 21.28972656 7.46890625 20.57945312 7.1953125 19.84765625 C6.84210938 18.92855469 6.48890625 18.00945313 6.125 17.0625 C5.77695312 16.14597656 5.42890625 15.22945312 5.0703125 14.28515625 C4.2180914 11.85058944 4.2180914 11.85058944 2 11 C0.68254143 7.12081644 0 4.11624135 0 0 Z " fill="#788194" transform="translate(284,754)"/>
+<path d="M0 0 C0.5775 0.226875 1.155 0.45375 1.75 0.6875 C-0.45249807 4.04920759 -2.58676075 5.98990132 -6.25 7.6875 C-8.5625 7.375 -8.5625 7.375 -10.25 6.6875 C-9.26 6.3575 -8.27 6.0275 -7.25 5.6875 C-6.92 4.6975 -6.59 3.7075 -6.25 2.6875 C-3.03057242 -0.42091284 -3.03057242 -0.42091284 0 0 Z " fill="#C7CBD3" transform="translate(338.25,704.3125)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C1.01 2.485 1.01 2.485 0 4 C-0.99 4 -1.98 4 -3 4 C-3.33 4.99 -3.66 5.98 -4 7 C-5.8125 8.31640625 -5.8125 8.31640625 -8 9.5625 C-11.08502827 11.21374548 -11.08502827 11.21374548 -13 14 C-13.66 13.67 -14.32 13.34 -15 13 C-14.09515208 11.84481082 -13.1755794 10.70114594 -12.25 9.5625 C-11.73953125 8.92441406 -11.2290625 8.28632812 -10.703125 7.62890625 C-8.78169758 5.79121076 -7.54364341 5.55041023 -5 5 C-4.67 4.34 -4.34 3.68 -4 3 C-3.01 2.67 -2.02 2.34 -1 2 C-0.67 1.34 -0.34 0.68 0 0 Z " fill="#C2C7CF" transform="translate(289,638)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-0.76922851 4.07692057 -3.02850024 5.77800007 -7 7 C-7.99 7 -8.98 7 -10 7 C-9.67 8.65 -9.34 10.3 -9 12 C-9.66 12 -10.32 12 -11 12 C-11.33 10.35 -11.66 8.7 -12 7 C-11.360625 6.71125 -10.72125 6.4225 -10.0625 6.125 C-7.84793921 5.17176549 -7.84793921 5.17176549 -7 3 C-3.5625 1.3125 -3.5625 1.3125 0 0 Z " fill="#96B8FD" transform="translate(695,622)"/>
+<path d="M0 0 C6.93 0 13.86 0 21 0 C21.33 0.99 21.66 1.98 22 3 C20.73542969 2.75830078 20.73542969 2.75830078 19.4453125 2.51171875 C15.87731459 1.98177802 12.48076534 1.83196958 8.875 1.8125 C7.07675781 1.79123047 7.07675781 1.79123047 5.2421875 1.76953125 C2.19715247 1.98598555 0.54672995 2.39720727 -2 4 C-1.34 2.68 -0.68 1.36 0 0 Z " fill="#E0E2E6" transform="translate(366,582)"/>
+<path d="M0 0 C-0.99 0.33 -1.98 0.66 -3 1 C-3.33 1.66 -3.66 2.32 -4 3 C-4.804375 3.144375 -5.60875 3.28875 -6.4375 3.4375 C-9.34440658 3.76502717 -9.34440658 3.76502717 -11 7 C-14 8.75 -14 8.75 -17 10 C-17.66 9.67 -18.32 9.34 -19 9 C-5.19459834 -2.19771468 -5.19459834 -2.19771468 0 0 Z " fill="#D4E2FE" transform="translate(812,540)"/>
+<path d="M0 0 C0.33 0.99 0.66 1.98 1 3 C-0.98 3.33 -2.96 3.66 -5 4 C-5.33 4.99 -5.66 5.98 -6 7 C-7.98 7 -9.96 7 -12 7 C-12.33 7.99 -12.66 8.98 -13 10 C-14.98 10 -16.96 10 -19 10 C-13 6 -13 6 -10.25 5.125 C-6.47348323 3.81774419 -3.42243501 2.053461 0 0 Z " fill="#46556C" transform="translate(685,482)"/>
+<path d="M0 0 C0.33 0 0.66 0 1 0 C1.57934159 5.40718817 1.34220083 8.10649656 -2 12.5 C-2.98191175 13.68193081 -3.97612198 14.85423174 -5 16 C-5 13.06922536 -4.55826073 11.30222085 -3.625 8.5625 C-3.24214844 7.41974609 -3.24214844 7.41974609 -2.8515625 6.25390625 C-2.03086162 4.08168419 -1.07689508 2.05546496 0 0 Z " fill="#8A94A2" transform="translate(787,301)"/>
+<path d="M0 0 C3.52142777 0.11081889 7.04187564 0.24122073 10.5625 0.375 C11.55314453 0.4059375 12.54378906 0.436875 13.56445312 0.46875 C19.04202523 0.68712497 23.8104654 1.20950139 29 3 C29 3.33 29 3.66 29 4 C21.25 4.125 21.25 4.125 19 3 C15.86145371 2.7684679 12.73014249 2.60590119 9.5859375 2.48242188 C5.85766237 2.28793508 3.25230121 1.78898935 0 0 Z " fill="#3F4F66" transform="translate(639,185)"/>
+<path d="M0 0 C5.7308977 1.10209571 10.12138952 3.67385754 14 8 C11.36 7.34 8.72 6.68 6 6 C6 5.34 6 4.68 6 4 C4.35 3.67 2.7 3.34 1 3 C0.67 2.01 0.34 1.02 0 0 Z " fill="#BFC4CB" transform="translate(668,79)"/>
+<path d="M0 0 C1.32 0.33 2.64 0.66 4 1 C0.99785011 3.35933662 -2.09573847 5.28031056 -5.4375 7.125 C-6.36433594 7.64320312 -7.29117188 8.16140625 -8.24609375 8.6953125 C-10.87778298 9.94209861 -13.13273 10.57329194 -16 11 C-11.85416333 7.46384519 -7.61270383 5.20043149 -2.6875 2.9375 C-0.81810662 2.10678318 -0.81810662 2.10678318 0 0 Z " fill="#4C6EB1" transform="translate(670,1147)"/>
+<path d="M0 0 C0 3.59857954 -0.95830515 5.09451118 -3 8 C-3.66 8 -4.32 8 -5 8 C-5.04125 8.556875 -5.0825 9.11375 -5.125 9.6875 C-6.46930374 13.24030274 -9.00974189 14.70958953 -12 17 C-12.33 16.34 -12.66 15.68 -13 15 C-11.71034824 13.62437146 -10.37310707 12.29233607 -9 11 C-8.34 11 -7.68 11 -7 11 C-6.938125 10.278125 -6.87625 9.55625 -6.8125 8.8125 C-5.75187255 5.1410973 -3.80330069 3.52297062 -1 1 C-0.67 0.67 -0.34 0.34 0 0 Z " fill="#425E92" transform="translate(1100,902)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-2.41688013 5.26920329 -5.83954717 7.69682729 -12 9 C-12.99 9.33 -13.98 9.66 -15 10 C-15 9.34 -15 8.68 -15 8 C-12.54665445 6.63603538 -10.08808766 5.28365831 -7.625 3.9375 C-6.92632813 3.54755859 -6.22765625 3.15761719 -5.5078125 2.75585938 C-3.70389816 1.77584822 -1.85416518 0.88124929 0 0 Z " fill="#ACC7FD" transform="translate(1012,876)"/>
+<path d="M0 0 C2.64525803 0.95523207 4.81123085 1.85699307 7.0625 3.5625 C9.07687729 5.05703799 10.55493989 5.56338212 13 6 C13 5.34 13 4.68 13 4 C14.98 3.67 16.96 3.34 19 3 C16.66287776 5.99151647 15.50223953 6.92419026 11.6875 7.5 C7.08753981 6.87627658 4.79205677 5.65443974 1 3 C0.67 2.01 0.34 1.02 0 0 Z " fill="#CBDCFE" transform="translate(741,666)"/>
+<path d="M0 0 C13.98244782 4.38116698 13.98244782 4.38116698 16.375 8.1875 C16.58125 8.785625 16.7875 9.38375 17 10 C10.35384615 8.52307692 10.35384615 8.52307692 8.5625 5.875 C8.376875 5.25625 8.19125 4.6375 8 4 C6.8553125 4.12375 6.8553125 4.12375 5.6875 4.25 C3 4 3 4 1.1875 2 C0.5996875 1.01 0.5996875 1.01 0 0 Z " fill="#CFDFFE" transform="translate(910,646)"/>
+<path d="M0 0 C-9.37209302 7.18604651 -9.37209302 7.18604651 -13 9 C-13.66 8.67 -14.32 8.34 -15 8 C-13.77172885 4.31518656 -12.17089247 3.69608736 -8.84765625 1.921875 C-2.4952381 -1.24761905 -2.4952381 -1.24761905 0 0 Z " fill="#3C5683" transform="translate(639,536)"/>
+<path d="M0 0 C0.55558594 0.23332031 1.11117187 0.46664062 1.68359375 0.70703125 C0.69359375 0.70703125 -0.29640625 0.70703125 -1.31640625 0.70703125 C-1.64640625 2.02703125 -1.97640625 3.34703125 -2.31640625 4.70703125 C-3.12078125 4.83078125 -3.92515625 4.95453125 -4.75390625 5.08203125 C-6.02234375 5.39140625 -6.02234375 5.39140625 -7.31640625 5.70703125 C-7.64640625 6.36703125 -7.97640625 7.02703125 -8.31640625 7.70703125 C-10.63797222 8.11432353 -12.97328495 8.45141802 -15.31640625 8.70703125 C-14.32640625 8.04703125 -13.33640625 7.38703125 -12.31640625 6.70703125 C-11.54425781 6.12566406 -10.77210938 5.54429687 -9.9765625 4.9453125 C-9.11933594 4.30980469 -8.26210938 3.67429687 -7.37890625 3.01953125 C-6.52425781 2.37628906 -5.66960938 1.73304688 -4.7890625 1.0703125 C-2.31640625 -0.29296875 -2.31640625 -0.29296875 0 0 Z " fill="#5781D4" transform="translate(676.31640625,518.29296875)"/>
+<path d="M0 0 C5.94 2.475 5.94 2.475 12 5 C12 6.32 12 7.64 12 9 C10.03533587 10.06775224 8.03144641 11.06553465 6 12 C5.34 11.67 4.68 11.34 4 11 C4.66 10.01 5.32 9.02 6 8 C8.625 7.8125 8.625 7.8125 11 8 C11 7.34 11 6.68 11 6 C9.948125 5.8453125 9.948125 5.8453125 8.875 5.6875 C5.60862353 4.90640997 2.9528148 3.57941257 0 2 C0 1.34 0 0.68 0 0 Z " fill="#CFD3D8" transform="translate(793,413)"/>
+<path d="M0 0 C2.125 0.375 2.125 0.375 4 1 C1.40419457 2.67963881 -0.92609647 3.97590102 -3.875 4.9375 C-6.50609878 5.83207358 -8.40586897 6.76740403 -10.75 8.1875 C-12.35875 9.0846875 -12.35875 9.0846875 -14 10 C-14.66 9.67 -15.32 9.34 -16 9 C-14.75 7.5 -14.75 7.5 -13 6 C-11.68 6 -10.36 6 -9 6 C-9 5.01 -9 4.02 -9 3 C-7.88625 2.87625 -6.7725 2.7525 -5.625 2.625 C-1.96896323 2.3534187 -1.96896323 2.3534187 0 0 Z " fill="#3F5989" transform="translate(947,380)"/>
+<path d="M0 0 C0.33 0 0.66 0 1 0 C1.05395478 1.62463842 1.09277195 3.24978541 1.125 4.875 C1.14820313 5.77992188 1.17140625 6.68484375 1.1953125 7.6171875 C1 10 1 10 -1 12 C-1.6425235 14.06874034 -1.6425235 14.06874034 -2 16 C-3.32 15.67 -4.64 15.34 -6 15 C-5.65066406 14.33613281 -5.30132813 13.67226563 -4.94140625 12.98828125 C-4.48636719 12.10527344 -4.03132812 11.22226562 -3.5625 10.3125 C-3.11003906 9.44238281 -2.65757812 8.57226562 -2.19140625 7.67578125 C-1.04008072 5.09001736 -0.43679247 2.78643472 0 0 Z " fill="#3A537D" transform="translate(764,293)"/>
+<path d="M0 0 C5.03985731 0.44469329 7.37634988 2.71343362 11 6 C10.67 6.99 10.34 7.98 10 9 C4.93126149 6.92642516 2.73152399 4.72763768 0 0 Z " fill="#B3BAC2" transform="translate(756,226)"/>
+<path d="M0 0 C10.16236162 3.12177122 10.16236162 3.12177122 14 6 C14.33 6.99 14.66 7.98 15 9 C15.99 9.66 16.98 10.32 18 11 C13.54271376 10.50474597 12.09689767 9.09689767 9 6 C6.66875071 4.99515117 4.33556463 3.99477753 2 3 C1.34 2.01 0.68 1.02 0 0 Z " fill="#98A1AD" transform="translate(916,212)"/>
+<path d="M0 0 C2.1875 0.3125 2.1875 0.3125 4 1 C3.01 1 2.02 1 1 1 C0.95875 1.61875 0.9175 2.2375 0.875 2.875 C0 5 0 5 -2.5 6.0625 C-4.2325 6.5265625 -4.2325 6.5265625 -6 7 C-7.62789287 7.53290955 -9.25283642 8.07489721 -10.875 8.625 C-12.25 9.08333333 -13.625 9.54166667 -15 10 C-12.72984147 6.59476221 -11.79140014 6.31414983 -8.0625 5 C-4.554491 3.76005573 -2.57487815 2.64343999 0 0 Z " fill="#B3B8C2" transform="translate(306,174)"/>
+<path d="M0 0 C1.44096586 0.42594588 2.87768712 0.86626633 4.3125 1.3125 C5.11300781 1.55613281 5.91351563 1.79976562 6.73828125 2.05078125 C9.13522167 3.05675107 10.26430461 4.10651412 12 6 C13.64605826 7.03357147 15.30963442 8.04060332 17 9 C16.01 9.495 16.01 9.495 15 10 C13.0546875 9.22265625 13.0546875 9.22265625 10.875 8.0625 C10.15054687 7.68222656 9.42609375 7.30195312 8.6796875 6.91015625 C7.84824219 6.45962891 7.84824219 6.45962891 7 6 C7 5.34 7 4.68 7 4 C6.030625 3.71125 5.06125 3.4225 4.0625 3.125 C1 2 1 2 0 0 Z " fill="#6D798A" transform="translate(477,1148)"/>
+<path d="M0 0 C0.66 0 1.32 0 2 0 C1.1875 1.9375 1.1875 1.9375 0 4 C-0.99 4.33 -1.98 4.66 -3 5 C-3.33 5.99 -3.66 6.98 -4 8 C-7.23306391 9.61653196 -10.45028204 10.39147692 -14 11 C-11.55204993 8.97169851 -9.18462885 7.10807543 -6.4375 5.5 C-3.89818348 4.06707344 -3.89818348 4.06707344 -1.8125 1.8125 C-1.214375 1.214375 -0.61625 0.61625 0 0 Z " fill="#34496A" transform="translate(1085,921)"/>
+<path d="M0 0 C0.99 0.33 1.98 0.66 3 1 C1.10673459 2.12931621 -0.7897264 3.25327616 -2.6875 4.375 C-3.74324219 5.00148438 -4.79898437 5.62796875 -5.88671875 6.2734375 C-9.69063273 8.38301087 -12.6180641 10 -17 10 C-14.77644774 7.4429149 -13.24981807 6.75829088 -10 6 C-9.67 5.34 -9.34 4.68 -9 4 C-7.00882592 3.30741771 -5.0078864 2.64252365 -3 2 C-2.01 1.34 -1.02 0.68 0 0 Z " fill="#D6E3FE" transform="translate(1048,854)"/>
+<path d="M0 0 C6.99536447 0.82298405 11.8471499 5.58327134 17 10 C13.30581799 10 11.22163822 8.71820705 8 7 C8 6.34 8 5.68 8 5 C7.4225 4.731875 6.845 4.46375 6.25 4.1875 C3.9674132 2.98280141 2.0262058 1.59201885 0 0 Z " fill="#B9D0FE" transform="translate(794,827)"/>
+<path d="M0 0 C-5.49349789 3.81492909 -10.95092327 7.14043646 -17 10 C-16.67 9.01 -16.34 8.02 -16 7 C-15.01 6.67 -14.02 6.34 -13 6 C-12.67 5.34 -12.34 4.68 -12 4 C-10.66666667 3.33333333 -9.33333333 2.66666667 -8 2 C-7.67 1.34 -7.34 0.68 -7 0 C-2.52459016 -1.26229508 -2.52459016 -1.26229508 0 0 Z " fill="#B2CBFE" transform="translate(722,810)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-3.625 5 -3.625 5 -7 5 C-7.33 5.99 -7.66 6.98 -8 8 C-10.9375 9.75 -10.9375 9.75 -14 11 C-14.66 10.67 -15.32 10.34 -16 10 C-15.34 9.34 -14.68 8.68 -14 8 C-13.01 8 -12.02 8 -11 8 C-10.67 7.01 -10.34 6.02 -10 5 C-7.78515625 3.578125 -7.78515625 3.578125 -5.0625 2.25 C-4.16660156 1.80140625 -3.27070312 1.3528125 -2.34765625 0.890625 C-1.18556641 0.44976563 -1.18556641 0.44976563 0 0 Z " fill="#A8C4FE" transform="translate(933,806)"/>
+<path d="M0 0 C1.88671875 0.23046875 1.88671875 0.23046875 4 1 C5.08203125 2.92578125 5.08203125 2.92578125 5.8125 5.3125 C6.06644531 6.09238281 6.32039063 6.87226562 6.58203125 7.67578125 C7.02792519 10.15528491 6.79557487 11.63492369 6 14 C3.69381964 10.43590308 2.23467679 7.05679517 1 3 C0.67 2.01 0.34 1.02 0 0 Z " fill="#BEC3CC" transform="translate(338,740)"/>
+<path d="M0 0 C1.32 0.33 2.64 0.66 4 1 C3.01 1.33 2.02 1.66 1 2 C-0.02297922 2.97648017 -1.01904252 3.98131338 -2 5 C-7.63101604 9.76470588 -7.63101604 9.76470588 -11 11 C-11.99 10.67 -12.98 10.34 -14 10 C-12.16341586 6.32683171 -6.87813874 5.30543956 -3.125 4 C-2.42375 3.67 -1.7225 3.34 -1 3 C-0.67 2.01 -0.34 1.02 0 0 Z " fill="#D1E0FE" transform="translate(945,685)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-5.71428571 7 -5.71428571 7 -10 7 C-10 7.99 -10 8.98 -10 10 C-11.98 10.33 -13.96 10.66 -16 11 C-11.64592545 5.89522294 -6.15201402 2.63516221 0 0 Z " fill="#B3B8C3" transform="translate(392,670)"/>
+<path d="M0 0 C1.65 0 3.3 0 5 0 C5 0.66 5 1.32 5 2 C5.9075 2.28875 6.815 2.5775 7.75 2.875 C14.54545455 5.22727273 14.54545455 5.22727273 16.25 8.125 C16.4975 8.74375 16.745 9.3625 17 10 C11.25 8.375 11.25 8.375 9 5 C5.94570927 3.78715124 5.94570927 3.78715124 3 3 C3 2.34 3 1.68 3 1 C2.01 0.67 1.02 0.34 0 0 Z " fill="#B7CEFE" transform="translate(863,618)"/>
+<path d="M0 0 C10.52631579 5.05263158 10.52631579 5.05263158 12 8 C10.02 8 8.04 8 6 8 C6 7.01 6 6.02 6 5 C4.02 4.34 2.04 3.68 0 3 C0 2.01 0 1.02 0 0 Z " fill="#8AB0FD" transform="translate(1000,615)"/>
+<path d="M0 0 C-2.35662521 2.65023753 -4.75254154 4.03467782 -7.9375 5.5625 C-8.79214844 5.97628906 -9.64679687 6.39007812 -10.52734375 6.81640625 C-11.34332031 7.20699219 -12.15929687 7.59757813 -13 8 C-14.33468103 8.66396443 -15.66852538 9.32962879 -17 10 C-13.375 5.125 -13.375 5.125 -10 4 C-9.319375 3.2884375 -9.319375 3.2884375 -8.625 2.5625 C-6.07854579 0.11398634 -3.32963048 -1.66481524 0 0 Z " fill="#92B5FD" transform="translate(721,591)"/>
+<path d="M0 0 C2.475 0.495 2.475 0.495 5 1 C5 1.66 5 2.32 5 3 C5.886875 3.103125 6.77375 3.20625 7.6875 3.3125 C11.10101256 4.02096487 13.23923528 4.88882698 16 7 C16 7.99 16 8.98 16 10 C15.01 10 14.02 10 13 10 C11.66666667 8.66666667 10.33333333 7.33333333 9 6 C7.34416775 5.30686092 5.67889021 4.63525576 4 4 C3.67 3.34 3.34 2.68 3 2 C2.01 1.34 1.02 0.68 0 0 Z " fill="#A8C4FD" transform="translate(956,573)"/>
+<path d="M0 0 C5.04503138 1.54978088 9.53856389 3.1131884 14 6 C14.99 6.33 15.98 6.66 17 7 C17.33 7.99 17.66 8.98 18 10 C10.5 7 10.5 7 3 4 C3 3.34 3 2.68 3 2 C2.01 1.67 1.02 1.34 0 1 C0 0.67 0 0.34 0 0 Z " fill="#C5D8FE" transform="translate(897,539)"/>
+<path d="M0 0 C0.66 0 1.32 0 2 0 C1.67 1.32 1.34 2.64 1 4 C-0.546875 4.433125 -0.546875 4.433125 -2.125 4.875 C-7.10675268 6.30079043 -7.10675268 6.30079043 -12 8 C-12.33 8.66 -12.66 9.32 -13 10 C-14.32 9.67 -15.64 9.34 -17 9 C-15.27121286 8.0026228 -13.54143106 7.0068947 -11.8046875 6.0234375 C-10.48831881 5.27692538 -9.17937359 4.51727858 -7.875 3.75 C-5.50572363 2.80228945 -3.52693627 2.85961465 -1 3 C-0.67 2.01 -0.34 1.02 0 0 Z " fill="#537AC8" transform="translate(748,481)"/>
+<path d="M0 0 C8.35010941 2.3107221 8.35010941 2.3107221 11.0625 5.1875 C11.371875 5.785625 11.68125 6.38375 12 7 C7.61110675 6.33501617 4.0188515 4.81242323 0 3 C0 2.01 0 1.02 0 0 Z " fill="#BCC1CA" transform="translate(295,426)"/>
+<path d="M0 0 C1.98 0 3.96 0 6 0 C2.57653445 3.14958831 -0.44262737 3.56179109 -5 4 C-5.33 4.99 -5.66 5.98 -6 7 C-7.98 7 -9.96 7 -12 7 C-12.33 7.99 -12.66 8.98 -13 10 C-13.66 9.67 -14.32 9.34 -15 9 C-14.34 8.01 -13.68 7.02 -13 6 C-11.00577205 5.63371323 -9.00546689 5.29868656 -7 5 C-6.67 4.34 -6.34 3.68 -6 3 C-4.33333333 2.66666667 -2.66666667 2.33333333 -1 2 C-0.67 1.34 -0.34 0.68 0 0 Z " fill="#D2D6DB" transform="translate(929,356)"/>
+<path d="M0 0 C5.04661443 0.48062995 7.9220794 2.05001488 12 5 C13.66026356 6.01059521 15.32470102 7.01453001 17 8 C14.3333581 9.33332095 12.83319697 8.67102033 10 8 C9.67 7.01 9.34 6.02 9 5 C7.00882592 4.30741771 5.0078864 3.64252365 3 3 C1.125 1.375 1.125 1.375 0 0 Z " fill="#C6CBD1" transform="translate(894,202)"/>
+<path d="M0 0 C5.19585831 -0.52839237 5.19585831 -0.52839237 8 0 C10.6875 2.9375 10.6875 2.9375 13 6 C15.67108098 6.95547581 15.67108098 6.95547581 18 7 C18 7.33 18 7.66 18 8 C15.1875 8.1875 15.1875 8.1875 12 8 C10.98882787 7.01129836 9.99024459 6.00966115 9 5 C6.73972655 3.7951851 6.73972655 3.7951851 4.3125 2.8125 C3.50425781 2.46832031 2.69601562 2.12414062 1.86328125 1.76953125 C1.24839844 1.51558594 0.63351562 1.26164062 0 1 C0 0.67 0 0.34 0 0 Z " fill="#637082" transform="translate(755,125)"/>
+<path d="M0 0 C-3.00617269 3.00617269 -5.82381598 2.59585316 -10 3 C-10.33 3.99 -10.66 4.98 -11 6 C-13.06640625 6.73046875 -13.06640625 6.73046875 -15.5625 7.1875 C-16.38878906 7.34605469 -17.21507812 7.50460938 -18.06640625 7.66796875 C-18.70449219 7.77753906 -19.34257813 7.88710938 -20 8 C-17.38511618 4.07767427 -14.25660564 3.28297336 -10 1.75 C-9.26265625 1.46898437 -8.5253125 1.18796875 -7.765625 0.8984375 C-2.26116071 -1.13058036 -2.26116071 -1.13058036 0 0 Z " fill="#DCDEE3" transform="translate(541,53)"/>
+<path d="M0 0 C5.97031739 0.29123499 8.894534 3.02814384 13 7 C9.48615893 7 7.23253263 6.38537113 4 5 C1.625 2.375 1.625 2.375 0 0 Z " fill="#A9B0BA" transform="translate(273,1036)"/>
+<path d="M0 0 C1.32 0.33 2.64 0.66 4 1 C-5.22551253 7.70387244 -5.22551253 7.70387244 -11 8 C-11 8.66 -11 9.32 -11 10 C-11.66 9.67 -12.32 9.34 -13 9 C-12.67 8.34 -12.34 7.68 -12 7 C-9.4375 6.375 -9.4375 6.375 -7 6 C-6.67 5.01 -6.34 4.02 -6 3 C-5.195625 2.87625 -4.39125 2.7525 -3.5625 2.625 C-2.716875 2.41875 -1.87125 2.2125 -1 2 C-0.67 1.34 -0.34 0.68 0 0 Z " fill="#AFC9FE" transform="translate(964,903)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-2.40528021 4.55811094 -6.24512263 7 -12 7 C-12.33 7.99 -12.66 8.98 -13 10 C-14.65 10 -16.3 10 -18 10 C-17.360625 9.71125 -16.72125 9.4225 -16.0625 9.125 C-13.84793921 8.17176549 -13.84793921 8.17176549 -13 6 C-11.66666667 5.66666667 -10.33333333 5.33333333 -9 5 C-8.67 4.34 -8.34 3.68 -8 3 C-5.67793475 2.29508733 -3.34406932 1.62787571 -1 1 C-0.67 0.67 -0.34 0.34 0 0 Z " fill="#D6E3FE" transform="translate(976,896)"/>
+<path d="M0 0 C6.31514377 1.26302875 11.85481126 4.20236069 17 8 C17.33 8.66 17.66 9.32 18 10 C16.5164999 9.57742724 15.03823576 9.13643678 13.5625 8.6875 C12.73878906 8.44386719 11.91507813 8.20023438 11.06640625 7.94921875 C10.38449219 7.63597656 9.70257812 7.32273437 9 7 C8.67 6.01 8.34 5.02 8 4 C7.236875 3.896875 6.47375 3.79375 5.6875 3.6875 C2.82940576 2.95635961 1.84257115 2.23048087 0 0 Z " fill="#CBDCFE" transform="translate(821,835)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-1.625 4 -1.625 4 -5 4 C-5.33 5.32 -5.66 6.64 -6 8 C-8.64 8.66 -11.28 9.32 -14 10 C-13.34 9.01 -12.68 8.02 -12 7 C-11.01 7 -10.02 7 -9 7 C-9 6.34 -9 5.68 -9 5 C-7.54735962 4.1361871 -6.0876837 3.28419546 -4.625 2.4375 C-3.81289063 1.96183594 -3.00078125 1.48617187 -2.1640625 0.99609375 C-1.44992187 0.66738281 -0.73578125 0.33867188 0 0 Z " fill="#8BB1FD" transform="translate(935,694)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C1.37351562 1.32613281 0.74703125 1.65226563 0.1015625 1.98828125 C-0.71570313 2.42527344 -1.53296875 2.86226562 -2.375 3.3125 C-3.18710937 3.74175781 -3.99921875 4.17101562 -4.8359375 4.61328125 C-7.26834043 5.96778724 -7.26834043 5.96778724 -9 9 C-11.625 9.1875 -11.625 9.1875 -14 9 C-14 9.66 -14 10.32 -14 11 C-14.66 10.67 -15.32 10.34 -16 10 C-14.56134011 7.12268022 -12.50689217 6.49371771 -9.6875 5 C-8.72199219 4.484375 -7.75648438 3.96875 -6.76171875 3.4375 C-5.85035156 2.963125 -4.93898438 2.48875 -4 2 C-3.26394531 1.5875 -2.52789063 1.175 -1.76953125 0.75 C-1.18558594 0.5025 -0.60164062 0.255 0 0 Z " fill="#D1E0FE" transform="translate(933,686)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-0.39509338 3.89932357 -2.31245243 4.50168276 -6 5 C-6.33 5.99 -6.66 6.98 -7 8 C-8.98 8.33 -10.96 8.66 -13 9 C-13 8.34 -13 7.68 -13 7 C-12.01 7 -11.02 7 -10 7 C-9.67 6.01 -9.34 5.02 -9 4 C-7.1875 3.0859375 -7.1875 3.0859375 -5 2.375 C-2.25730729 1.58884867 -2.25730729 1.58884867 0 0 Z " fill="#BBD0FE" transform="translate(674,618)"/>
+<path d="M0 0 C-1.55615009 1.29930979 -3.1202168 2.58914138 -4.6875 3.875 C-5.55761719 4.59429688 -6.42773438 5.31359375 -7.32421875 6.0546875 C-9.8477646 7.88932376 -12.06338486 8.99467229 -15 10 C-14.1875 8.0625 -14.1875 8.0625 -13 6 C-12.01 5.67 -11.02 5.34 -10 5 C-9.34 4.01 -8.68 3.02 -8 2 C-3.56097561 -1.18699187 -3.56097561 -1.18699187 0 0 Z " fill="#C4C8D1" transform="translate(340,604)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C0.73608512 2.00873016 -0.53640883 3.00671822 -1.8125 4 C-2.87404297 4.8353125 -2.87404297 4.8353125 -3.95703125 5.6875 C-6 7 -6 7 -9 7 C-9.33 7.99 -9.66 8.98 -10 10 C-13.5625 11.1875 -13.5625 11.1875 -17 12 C-17 11.34 -17 10.68 -17 10 C-15.700625 9.38125 -15.700625 9.38125 -14.375 8.75 C-11.06478863 7.03359411 -8.07953348 5.09670365 -5 3 C-2.25 1.1875 -2.25 1.1875 0 0 Z " fill="#81AAFD" transform="translate(758,585)"/>
+<path d="M0 0 C1.44096586 0.42594588 2.87768712 0.86626633 4.3125 1.3125 C5.11300781 1.55613281 5.91351563 1.79976563 6.73828125 2.05078125 C9.12905456 3.0541628 10.23231866 4.15309485 12 6 C12.99 6.33 13.98 6.66 15 7 C14.67 7.66 14.34 8.32 14 9 C11.69 8.01 9.38 7.02 7 6 C7 5.34 7 4.68 7 4 C5.02 4 3.04 4 1 4 C0.67 2.68 0.34 1.36 0 0 Z " fill="#D1D5DA" transform="translate(260,409)"/>
+<path d="M0 0 C0.33 0.66 0.66 1.32 1 2 C-2 4 -2 4 -5 4 C-5.33 4.99 -5.66 5.98 -6 7 C-7.98 7 -9.96 7 -12 7 C-12.33 7.99 -12.66 8.98 -13 10 C-13.99 9.67 -14.98 9.34 -16 9 C-13.44254816 5.87422553 -10.77604006 5.20833282 -7 4 C-5.31008021 3.0398183 -3.63790712 2.04644066 -2 1 C-1.34 0.67 -0.68 0.34 0 0 Z " fill="#47566C" transform="translate(857,396)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-2.33885303 4.29752831 -5.75721791 6.37723411 -11 8 C-11.33 8.66 -11.66 9.32 -12 10 C-13.32 9.67 -14.64 9.34 -16 9 C-10.86281509 5.40047588 -5.95303969 2.0653403 0 0 Z " fill="#4D70B4" transform="translate(967,371)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C1.67 1.99 1.34 2.98 1 4 C-0.98 4.33 -2.96 4.66 -5 5 C-5 5.66 -5 6.32 -5 7 C-6.98 7 -8.96 7 -11 7 C-7.71103088 3.18479582 -4.67184669 1.64379791 0 0 Z " fill="#6D798B" transform="translate(1042,302)"/>
+<path d="M0 0 C1.32 0 2.64 0 4 0 C4 0.66 4 1.32 4 2 C5.134375 2.12375 6.26875 2.2475 7.4375 2.375 C8.613125 2.58125 9.78875 2.7875 11 3 C11.33 3.66 11.66 4.32 12 5 C12.99 5.66 13.98 6.32 15 7 C12.125 7.125 12.125 7.125 9 7 C8.34 6.34 7.68 5.68 7 5 C5.35008418 4.29289322 3.68437744 3.62056011 2 3 C2 2.34 2 1.68 2 1 C1.34 0.67 0.68 0.34 0 0 Z " fill="#CACED4" transform="translate(401,184)"/>
+<path d="M0 0 C-2.86061065 2.2646501 -5.73442599 4.00216901 -9 5.625 C-9.845625 6.05039063 -10.69125 6.47578125 -11.5625 6.9140625 C-13.71975214 7.87514599 -15.69540428 8.51987589 -18 9 C-15.63707344 6.47411298 -14.33537489 5.11179163 -11 4 C-10.67 3.34 -10.34 2.68 -10 2 C-8.22265625 1.11328125 -8.22265625 1.11328125 -6.0625 0.3125 C-5.35222656 0.04050781 -4.64195312 -0.23148437 -3.91015625 -0.51171875 C-2 -1 -2 -1 0 0 Z " fill="#99A2AE" transform="translate(447,100)"/>
+<path d="M0 0 C5.28 0.33 10.56 0.66 16 1 C15.67 1.66 15.34 2.32 15 3 C10.71 3 6.42 3 2 3 C2 2.34 2 1.68 2 1 C1.34 0.67 0.68 0.34 0 0 Z " fill="#BABFC8" transform="translate(193,890)"/>
+<path d="M0 0 C7.48291572 6.15034169 7.48291572 6.15034169 10 10 C5.62683198 8.80731781 2.79306775 7.65247321 0 4 C0 2.68 0 1.36 0 0 Z " fill="#BEC3CB" transform="translate(171,873)"/>
+<path d="M0 0 C1.30249153 3.59855032 0.69931441 5.58099473 -0.75 9.0625 C-1.09546875 9.91972656 -1.4409375 10.77695312 -1.796875 11.66015625 C-2.96264917 13.92735991 -4.09652606 15.33172543 -6 17 C-6 15.68 -6 14.36 -6 13 C-5.34 12.67 -4.68 12.34 -4 12 C-3.38479304 9.71573609 -3.38479304 9.71573609 -3 7.0625 C-2.21955403 2.21955403 -2.21955403 2.21955403 0 0 Z " fill="#556178" transform="translate(222,868)"/>
+<path d="M0 0 C1.32 0.33 2.64 0.66 4 1 C-1.49121491 4.927744 -6.57273858 7.89653263 -13 10 C-12.67 9.01 -12.34 8.02 -12 7 C-10.67696283 6.6278958 -9.34262065 6.29369827 -8 6 C-7.67 5.34 -7.34 4.68 -7 4 C-5 3.33333333 -3 2.66666667 -1 2 C-0.67 1.34 -0.34 0.68 0 0 Z " fill="#AAC6FD" transform="translate(895,827)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-1.625 4 -1.625 4 -5 4 C-5.0825 4.61875 -5.165 5.2375 -5.25 5.875 C-6 8 -6 8 -7.875 9.3125 C-10 10 -10 10 -13 9 C-10.7629196 5.6443794 -10.57482962 5.80721959 -7 5 C-6.67 4.34 -6.34 3.68 -6 3 C-3.0625 1.3125 -3.0625 1.3125 0 0 Z " fill="#D0DFFE" transform="translate(821,638)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C0.375 3 0.375 3 -2 5 C-5.25 5.25 -5.25 5.25 -8 5 C-8.33 5.99 -8.66 6.98 -9 8 C-11.4375 9.75 -11.4375 9.75 -14 11 C-14.66 10.67 -15.32 10.34 -16 10 C-13.94766315 7.7522025 -12.99332739 6.9977758 -10 6 C-9.67 5.34 -9.34 4.68 -9 4 C-7.02 4 -5.04 4 -3 4 C-3 3.01 -3 2.02 -3 1 C-2.01 0.67 -1.02 0.34 0 0 Z " fill="#A3C1FD" transform="translate(848,624)"/>
+<path d="M0 0 C2.125 0.375 2.125 0.375 4 1 C0.41623436 3.31890718 -2.9274409 4.74690489 -7 6 C-8.62606312 6.5384668 -10.25102104 7.08027978 -11.875 7.625 C-13.25 8.08333333 -14.625 8.54166667 -16 9 C-15.67 8.01 -15.34 7.02 -15 6 C-13.02 6 -11.04 6 -9 6 C-9 5.01 -9 4.02 -9 3 C-7.88625 2.87625 -6.7725 2.7525 -5.625 2.625 C-1.96896323 2.3534187 -1.96896323 2.3534187 0 0 Z " fill="#3C5581" transform="translate(885,411)"/>
+<path d="M0 0 C2.31 0 4.62 0 7 0 C7 0.66 7 1.32 7 2 C10.96 2 14.92 2 19 2 C19 2.33 19 2.66 19 3 C13.06 3 7.12 3 1 3 C0.67 2.01 0.34 1.02 0 0 Z " fill="#384F75" transform="translate(543,368)"/>
+<path d="M0 0 C2.0625 0.4375 2.0625 0.4375 4 1 C1.62671491 3.74801432 -0.6481365 4.71082173 -4 6 C-4.66 6.66 -5.32 7.32 -6 8 C-8.125 7.625 -8.125 7.625 -10 7 C-7.45115655 4.02634931 -4.49777936 2.672851 -1 1 C-0.67 0.67 -0.34 0.34 0 0 Z " fill="#4C6EB1" transform="translate(981,363)"/>
+<path d="M0 0 C9.33041575 1.17286652 9.33041575 1.17286652 12.125 4.625 C12.558125 5.800625 12.558125 5.800625 13 7 C7.92990529 6.52467862 4.02506742 3.95637706 0 1 C0 0.67 0 0.34 0 0 Z " fill="#567FD2" transform="translate(468,346)"/>
+<path d="M0 0 C2 1.625 2 1.625 4 4 C4.25 7.25 4.25 7.25 4 10 C4.66 10 5.32 10 6 10 C7.60725635 13.21451269 7.05748185 16.43612536 7 20 C6.67 20 6.34 20 6 20 C5.67 17.03 5.34 14.06 5 11 C4.34 11 3.68 11 3 11 C0 4.5 0 4.5 0 0 Z " fill="#D5D8DD" transform="translate(782,253)"/>
+<path d="M0 0 C4.4114727 3.23507998 4.84694558 6.84557192 5.703125 11.953125 C5.80109375 12.62859375 5.8990625 13.3040625 6 14 C5.01 13.67 4.02 13.34 3 13 C1.49624577 8.73936301 0.65320007 4.4635338 0 0 Z " fill="#697587" transform="translate(780,254)"/>
+<path d="M0 0 C5.15464734 0.48324819 8.81550319 3.18610761 13 6 C9.58900832 6 6.36911686 5.50854594 3 5 C2.67 4.01 2.34 3.02 2 2 C1.34 2 0.68 2 0 2 C0 1.34 0 0.68 0 0 Z " fill="#BCC2CA" transform="translate(378,202)"/>
+<path d="M0 0 C4.455 1.98 4.455 1.98 9 4 C9 4.66 9 5.32 9 6 C10.1446875 5.87625 10.1446875 5.87625 11.3125 5.75 C14 6 14 6 15.8125 8 C16.204375 8.66 16.59625 9.32 17 10 C10.79609988 8.80694228 5.39699664 5.13025805 0 2 C0 1.34 0 0.68 0 0 Z " fill="#D5D8DD" transform="translate(790,145)"/>
+<path d="M0 0 C1.48199902 0.44909061 2.96055236 0.90956564 4.4375 1.375 C5.26121094 1.63023438 6.08492187 1.88546875 6.93359375 2.1484375 C9 3 9 3 10 5 C12.01669827 6.13350534 12.01669827 6.13350534 14 7 C13.67 7.66 13.34 8.32 13 9 C9.5625 7.6875 9.5625 7.6875 6 6 C5.67 5.01 5.34 4.02 5 3 C3.67696283 2.6278958 2.34262065 2.29369827 1 2 C0.67 1.34 0.34 0.68 0 0 Z " fill="#677486" transform="translate(741,116)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-0.13900633 3.33285378 -2.16655353 4.7868759 -5 6.1875 C-5.680625 6.53167969 -6.36125 6.87585937 -7.0625 7.23046875 C-9 8 -9 8 -12 8 C-12 8.66 -12 9.32 -12 10 C-12.66 9.67 -13.32 9.34 -14 9 C-13 7 -13 7 -9.9375 5.875 C-8.4834375 5.441875 -8.4834375 5.441875 -7 5 C-7 4.34 -7 3.68 -7 3 C-5.5459375 2.5359375 -5.5459375 2.5359375 -4.0625 2.0625 C-1.15934208 1.30476658 -1.15934208 1.30476658 0 0 Z " fill="#5075BE" transform="translate(876,1037)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-0.57360122 3.9667903 -3.51704221 5.49144778 -7 7.25 C-8.5778125 8.06210937 -8.5778125 8.06210937 -10.1875 8.890625 C-13 10 -13 10 -16 9 C-14.04634442 6.47173984 -12.83786887 5.95411383 -9.6875 5.0625 C-5.6600911 3.90206015 -3.34266642 2.44585348 0 0 Z " fill="#557DCC" transform="translate(964,989)"/>
+<path d="M0 0 C0 0.99 0 1.98 0 3 C-4.38181948 6.31956021 -9.51395686 8 -15 8 C-12.60931792 5.2318418 -10.41160403 4.24058328 -7 3 C-5.72630356 2.46510046 -4.45552937 1.92319856 -3.1875 1.375 C-2.135625 0.92125 -1.08375 0.4675 0 0 Z " fill="#3D5683" transform="translate(991,977)"/>
+<path d="M0 0 C2.10968724 0.73432766 4.21262133 1.48807681 6.3125 2.25 C7.48425781 2.66765625 8.65601563 3.0853125 9.86328125 3.515625 C13.01972114 5.00933254 14.25005761 6.04341863 16 9 C10.18738629 7.26017005 5.16830006 5.1889511 0 2 C0 1.34 0 0.68 0 0 Z " fill="#D1E0FE" transform="translate(787,915)"/>
+<path d="M0 0 C0 0.99 0 1.98 0 3 C-4.42000392 6.64650323 -8.42767259 7.84710467 -14 9 C-12 6 -12 6 -9.375 5.3125 C-8.59125 5.209375 -7.8075 5.10625 -7 5 C-7 4.34 -7 3.68 -7 3 C-4.69 2.01 -2.38 1.02 0 0 Z " fill="#7AA5FD" transform="translate(960,908)"/>
+<path d="M0 0 C3.46101743 3.00336223 4.69352564 5.31280768 5.75 9.75 C5.99234375 10.73484375 6.2346875 11.7196875 6.484375 12.734375 C6.73960937 13.85585938 6.73960937 13.85585938 7 15 C4 14 4 14 3.0859375 12.36328125 C1.66108774 8.2531377 0.54262015 4.34096117 0 0 Z " fill="#B0B6C1" transform="translate(330,861)"/>
+<path d="M0 0 C0.33 0.99 0.66 1.98 1 3 C0.21753906 3.33773437 -0.56492187 3.67546875 -1.37109375 4.0234375 C-2.38300781 4.46945312 -3.39492188 4.91546875 -4.4375 5.375 C-5.44683594 5.81585937 -6.45617187 6.25671875 -7.49609375 6.7109375 C-10.12143547 7.75076286 -10.12143547 7.75076286 -11 10 C-12.32 9.67 -13.64 9.34 -15 9 C-8.25 5 -8.25 5 -6 5 C-6 4.34 -6 3.68 -6 3 C-4.02 2.01 -2.04 1.02 0 0 Z " fill="#80A9FD" transform="translate(936,815)"/>
+<path d="M0 0 C1.32 0.33 2.64 0.66 4 1 C3.01 1 2.02 1 1 1 C0.67 1.99 0.34 2.98 0 4 C-0.99 4.33 -1.98 4.66 -3 5 C-3.33 5.66 -3.66 6.32 -4 7 C-5.98 7 -7.96 7 -10 7 C-10.33 7.99 -10.66 8.98 -11 10 C-11.33 9.34 -11.66 8.68 -12 8 C-11.67 7.34 -11.34 6.68 -11 6 C-9.66666667 5.66666667 -8.33333333 5.33333333 -7 5 C-6.67 4.34 -6.34 3.68 -6 3 C-4.33333333 2.66666667 -2.66666667 2.33333333 -1 2 C-0.67 1.34 -0.34 0.68 0 0 Z " fill="#84ACFD" transform="translate(709,813)"/>
+<path d="M0 0 C0.99 0.33 1.98 0.66 3 1 C3.12375 1.969375 3.2475 2.93875 3.375 3.9375 C3.684375 5.4534375 3.684375 5.4534375 4 7 C4.66 7.33 5.32 7.66 6 8 C6 10.31 6 12.62 6 15 C2.35219334 10.8310781 0 5.55196264 0 0 Z " fill="#C3C7CF" transform="translate(332,725)"/>
+<path d="M0 0 C-8.07744875 7.66742597 -8.07744875 7.66742597 -14 9 C-13.34 8.01 -12.68 7.02 -12 6 C-11.01 6 -10.02 6 -9 6 C-8.67 4.35 -8.34 2.7 -8 1 C-2.25 -1.125 -2.25 -1.125 0 0 Z " fill="#687387" transform="translate(381,677)"/>
+<path d="M0 0 C0.99 0.33 1.98 0.66 3 1 C3.125 8.75 3.125 8.75 2 11 C1.34 11 0.68 11 0 11 C0 7.37 0 3.74 0 0 Z " fill="#DDDFE4" transform="translate(421,629)"/>
+<path d="M0 0 C2.72943537 -0.05416741 5.45778564 -0.09375225 8.1875 -0.125 C9.34088867 -0.15013672 9.34088867 -0.15013672 10.51757812 -0.17578125 C14.8149434 -0.21266851 18.07901831 0.0041496 22 2 C22 2.33 22 2.66 22 3 C20.00045254 3.04254356 17.99958364 3.04080783 16 3 C15.67 2.67 15.34 2.34 15 2 C12.68925832 1.90067608 10.37537058 1.87030382 8.0625 1.875 C6.79535156 1.87242187 5.52820313 1.86984375 4.22265625 1.8671875 C1.10845111 1.77493931 1.10845111 1.77493931 -1 3 C-0.67 2.01 -0.34 1.02 0 0 Z " fill="#7E8899" transform="translate(369,584)"/>
+<path d="M0 0 C2.64 0 5.28 0 8 0 C8 0.99 8 1.98 8 3 C8.62648438 2.96519531 9.25296875 2.93039062 9.8984375 2.89453125 C10.71570313 2.86746094 11.53296875 2.84039062 12.375 2.8125 C13.18710937 2.77769531 13.99921875 2.74289062 14.8359375 2.70703125 C15.55007813 2.80371094 16.26421875 2.90039062 17 3 C17.99 4.485 17.99 4.485 19 6 C14.05 5.01 9.1 4.02 4 3 C4 2.34 4 1.68 4 1 C2.68 0.67 1.36 0.34 0 0 Z " fill="#4E72B9" transform="translate(481,353)"/>
+<path d="M0 0 C-2.66666667 1.33333333 -5.33333333 2.66666667 -8 4 C-9.03640625 4.556875 -9.03640625 4.556875 -10.09375 5.125 C-12.48903913 6.22447698 -14.39576316 6.14467982 -17 6 C-14.93243723 3.2027092 -13.85559629 2.97307727 -10.3125 2.3125 C-9.219375 2.209375 -8.12625 2.10625 -7 2 C-7 1.34 -7 0.68 -7 0 C-3.86650268 -1.04449911 -3.01031744 -0.93423645 0 0 Z " fill="#3F5B8C" transform="translate(713,347)"/>
+<path d="M0 0 C5.80160774 1.48701402 10.57763179 2.72504406 15 7 C10.45347674 6.45441721 6.20780855 5.85926424 2 4 C0.83203125 1.92578125 0.83203125 1.92578125 0 0 Z " fill="#A0A8B3" transform="translate(114,302)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-2.49603974 5.88578932 -8.74304928 8.12291478 -15 10 C-12.74442264 6.61663396 -11.63811468 6.39927488 -8 5 C-7.67 4.34 -7.34 3.68 -7 3 C-5.01276732 2.29618843 -3.01222047 1.6288189 -1 1 C-0.67 0.67 -0.34 0.34 0 0 Z " fill="#8E98A5" transform="translate(165,250)"/>
+<path d="M0 0 C0 3 0 3 -1.6875 5.1875 C-4.3961577 7.31050198 -5.64708882 7.37254569 -9 7 C-9.33 7.99 -9.66 8.98 -10 10 C-10.66 9.67 -11.32 9.34 -12 9 C-9.83330307 5.7499546 -8.3510269 4.8703406 -5 3 C-3.6078125 2.1646875 -3.6078125 2.1646875 -2.1875 1.3125 C-1.1046875 0.6628125 -1.1046875 0.6628125 0 0 Z " fill="#5A85DD" transform="translate(451,234)"/>
+<path d="M0 0 C0.33 1.32 0.66 2.64 1 4 C0.01 4 -0.98 4 -2 4 C-2.33 4.99 -2.66 5.98 -3 7 C-3.99 7 -4.98 7 -6 7 C-6.33 7.99 -6.66 8.98 -7 10 C-7.99 9.67 -8.98 9.34 -10 9 C-9.34 9 -8.68 9 -8 9 C-8 8.01 -8 7.02 -8 6 C-7.360625 5.896875 -6.72125 5.79375 -6.0625 5.6875 C-5.381875 5.460625 -4.70125 5.23375 -4 5 C-3.67 4.01 -3.34 3.02 -3 2 C-2.01 1.34 -1.02 0.68 0 0 Z " fill="#657184" transform="translate(417,227)"/>
+<path d="M0 0 C2.06298828 -0.34057617 2.06298828 -0.34057617 4.5703125 -0.29296875 C5.46621094 -0.28330078 6.36210938 -0.27363281 7.28515625 -0.26367188 C8.69087891 -0.2259668 8.69087891 -0.2259668 10.125 -0.1875 C11.06988281 -0.17396484 12.01476562 -0.16042969 12.98828125 -0.14648438 C15.32608779 -0.11106306 17.66276237 -0.06167271 20 0 C20 0.33 20 0.66 20 1 C18.99839844 1.06058594 17.99679687 1.12117187 16.96484375 1.18359375 C15.62238669 1.26808405 14.27993928 1.35272768 12.9375 1.4375 C11.62652344 1.51871094 10.31554687 1.59992188 8.96484375 1.68359375 C5.26336762 1.97898249 1.66629552 2.43265388 -2 3 C-1.34 2.01 -0.68 1.02 0 0 Z " fill="#E1E3E7" transform="translate(523,180)"/>
+<path d="M0 0 C6.30214697 0.33169195 10.85216936 3.67323988 16 7 C14.68 7.33 13.36 7.66 12 8 C11.67 7.34 11.34 6.68 11 6 C9.03700146 5.15934368 7.03929129 4.53482652 5.0078125 3.87890625 C2.80438673 2.91437162 1.58331246 1.78745022 0 0 Z " fill="#9BA3AF" transform="translate(324,174)"/>
+<path d="M0 0 C1.485 0.99 1.485 0.99 3 2 C3.9075 2.268125 4.815 2.53625 5.75 2.8125 C9.80149506 4.29285397 12.57174507 6.39452625 16 9 C15.01 9.33 14.02 9.66 13 10 C11.3515625 9.07421875 11.3515625 9.07421875 9.625 7.6875 C7.39245151 5.97051885 5.7855121 4.91606995 3.125 3.875 C2.42375 3.58625 1.7225 3.2975 1 3 C0.67 2.01 0.34 1.02 0 0 Z " fill="#515F74" transform="translate(306,1056)"/>
+<path d="M0 0 C5.80160774 1.48701402 10.57763179 2.72504406 15 7 C14.29875 6.855625 13.5975 6.71125 12.875 6.5625 C10.84479439 6.16528586 8.8002058 5.83848924 6.75 5.5625 C5.8425 5.376875 4.935 5.19125 4 5 C3.67 4.34 3.34 3.68 3 3 C2.01 2.67 1.02 2.34 0 2 C0 1.34 0 0.68 0 0 Z " fill="#637082" transform="translate(223,1010)"/>
+<path d="M0 0 C0 0.99 0 1.98 0 3 C-1.98 3 -3.96 3 -6 3 C-6 3.99 -6 4.98 -6 6 C-8.64 6.66 -11.28 7.32 -14 8 C-13.67 7.01 -13.34 6.02 -13 5 C-10.9375 4 -10.9375 4 -8 3 C-6.56120451 2.46178391 -5.12375409 1.91996166 -3.6875 1.375 C-2.470625 0.92125 -1.25375 0.4675 0 0 Z " fill="#395179" transform="translate(1035,953)"/>
+<path d="M0 0 C2.91926519 2.63675566 4.09111127 4.23460384 5 8 C5.99 8.33 6.98 8.66 8 9 C7.67 10.32 7.34 11.64 7 13 C5.0625 11.8125 5.0625 11.8125 3 10 C2.375 7.375 2.375 7.375 2 5 C1.34 4.67 0.68 4.34 0 4 C0 2.68 0 1.36 0 0 Z " fill="#98A0AD" transform="translate(416,905)"/>
+<path d="M0 0 C3.66497049 5.49745573 5.56836424 10.61270199 7 17 C3.50271955 14.6684797 3.16708156 13.49671586 1.8125 9.625 C1.46832031 8.66851563 1.12414062 7.71203125 0.76953125 6.7265625 C0 4 0 4 0 0 Z " fill="#687387" transform="translate(334,865)"/>
+<path d="M0 0 C3.48662616 3.02174267 4.86057282 5.53724356 6 10 C6 10.99 6 11.98 6 13 C3 12 3 12 2.05078125 10.29296875 C1.80714844 9.59816406 1.56351562 8.90335938 1.3125 8.1875 C1.06113281 7.50042969 0.80976563 6.81335938 0.55078125 6.10546875 C0 4 0 4 0 0 Z " fill="#5F6B80" transform="translate(385,841)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-4 7 -4 7 -7.0625 7.0625 C-8.031875 7.041875 -9.00125 7.02125 -10 7 C-10.33 7.99 -10.66 8.98 -11 10 C-11.33 9.34 -11.66 8.68 -12 8 C-10.32374262 4.64748524 -6.63976674 4.23264245 -3.25 3 C-0.84296517 2.21568639 -0.84296517 2.21568639 0 0 Z " fill="#86ADFD" transform="translate(905,820)"/>
+<path d="M0 0 C0.50789062 0.40992188 1.01578125 0.81984375 1.5390625 1.2421875 C5.6142593 4.43213556 8.97675363 6.52978155 14 8 C14.33 8.66 14.66 9.32 15 10 C8.70323565 9.8385445 4.38206645 6.21652171 0 2 C0 1.34 0 0.68 0 0 Z " fill="#CDDDFE" transform="translate(963,793)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-0.2612574 3.478686 -2.55798745 5.02650651 -5.5 6.625 C-6.2734375 7.05039062 -7.046875 7.47578125 -7.84375 7.9140625 C-10 9 -10 9 -13 10 C-12.875 8.125 -12.875 8.125 -12 6 C-10.02416285 5.26480478 -8.01822402 4.60927518 -6 4 C-3.9659094 2.71927629 -1.95597184 1.39712274 0 0 Z " fill="#9CBCFD" transform="translate(882,714)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C1.505 1.4125 1.01 1.825 0.5 2.25 C-1.43386092 4.12202338 -1.43386092 4.12202338 -1 8 C-2.65 7.67 -4.3 7.34 -6 7 C-6 6.01 -6 5.02 -6 4 C-5.34 4 -4.68 4 -4 4 C-3.67 3.01 -3.34 2.02 -3 1 C-2.01 0.67 -1.02 0.34 0 0 Z " fill="#A2C0FE" transform="translate(767,672)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-0.28110101 4.42165151 -1.24607319 4.69049065 -5 6 C-8.75522906 7.12027864 -8.75522906 7.12027864 -11 10 C-12.32 9.67 -13.64 9.34 -15 9 C-12.92483194 7.30912232 -11.1254453 6.04951788 -8.625 5.0625 C-5.43561596 3.77155884 -2.81461896 1.96368764 0 0 Z " fill="#7BA6FD" transform="translate(806,650)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-2.51670951 5.99215261 -8.52024112 8.56005358 -15 10 C-13.25 8 -13.25 8 -11 6 C-9.68 6 -8.36 6 -7 6 C-7 5.01 -7 4.02 -7 3 C-5.5459375 2.5359375 -5.5459375 2.5359375 -4.0625 2.0625 C-1.15934208 1.30476658 -1.15934208 1.30476658 0 0 Z " fill="#84ACFD" transform="translate(805,638)"/>
+<path d="M0 0 C0.33 0.66 0.66 1.32 1 2 C-1.28703308 3.19725883 -3.57884862 4.38297018 -5.875 5.5625 C-6.52597656 5.90474609 -7.17695312 6.24699219 -7.84765625 6.59960938 C-9.53529857 7.46082891 -11.26579593 8.23686703 -13 9 C-13.66 8.67 -14.32 8.34 -15 8 C-13.20963542 7.0234375 -11.41927083 6.046875 -9.62890625 5.0703125 C-7.83381685 4.08589976 -7.83381685 4.08589976 -7 2 C-4.6859378 1.26924352 -2.35171131 0.59861742 0 0 Z " fill="#A4C2FD" transform="translate(787,568)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C1.360625 1.103125 0.72125 1.20625 0.0625 1.3125 C-0.618125 1.539375 -1.29875 1.76625 -2 2 C-2.33 2.99 -2.66 3.98 -3 5 C-5.21484375 6.203125 -5.21484375 6.203125 -7.9375 7.25 C-9.28134766 7.78367187 -9.28134766 7.78367187 -10.65234375 8.328125 C-13 9 -13 9 -15 8 C-11.41836472 5.50118469 -8.09443994 3.50847787 -4 2 C-3.278125 1.608125 -2.55625 1.21625 -1.8125 0.8125 C-1.214375 0.544375 -0.61625 0.27625 0 0 Z " fill="#87AEFD" transform="translate(803,559)"/>
+<path d="M0 0 C8.35010941 1.17286652 8.35010941 1.17286652 11.0625 4.625 C11.371875 5.40875 11.68125 6.1925 12 7 C7.48292068 6.4685789 4.61312423 4.70984317 1 2 C0.67 1.34 0.34 0.68 0 0 Z " fill="#7E8898" transform="translate(283,419)"/>
+<path d="M0 0 C0.87011719 0.50660156 0.87011719 0.50660156 1.7578125 1.0234375 C6.12019057 3.51416821 10.20964884 5.44313587 15 7 C15.33 7.66 15.66 8.32 16 9 C12.65819325 8.02665823 9.32706956 7.02253973 6 6 C4.4840625 5.5359375 4.4840625 5.5359375 2.9375 5.0625 C1 4 1 4 0.37890625 1.93359375 C0.25386719 1.29550781 0.12882812 0.65742188 0 0 Z " fill="#526075" transform="translate(323,409)"/>
+<path d="M0 0 C4.455 0.99 4.455 0.99 9 2 C9.33 3.32 9.66 4.64 10 6 C10.99 6.33 11.98 6.66 13 7 C8.14036821 6.39254603 4.2594482 4.27241033 0 2 C0 1.34 0 0.68 0 0 Z " fill="#626F82" transform="translate(167,360)"/>
+<path d="M0 0 C0.625 1.875 0.625 1.875 1 4 C0.34 4.66 -0.32 5.32 -1 6 C-1.71408334 7.98356483 -2.38617742 9.98315437 -3 12 C-3.66 11.67 -4.32 11.34 -5 11 C-4.50769231 4.6 -4.50769231 4.6 -1.9375 1.5625 C-0.9784375 0.7890625 -0.9784375 0.7890625 0 0 Z " fill="#5076BF" transform="translate(420,258)"/>
+<path d="M0 0 C4.29 0 8.58 0 13 0 C13 0.33 13 0.66 13 1 C12.21753906 1.13277344 11.43507813 1.26554688 10.62890625 1.40234375 C9.11103516 1.66724609 9.11103516 1.66724609 7.5625 1.9375 C6.55316406 2.11152344 5.54382813 2.28554687 4.50390625 2.46484375 C2.0712562 2.74751097 2.0712562 2.74751097 1 4 C-1.33297433 4.04092937 -3.66705225 4.04241723 -6 4 C-6 3.67 -6 3.34 -6 3 C-4.35 3 -2.7 3 -1 3 C-0.67 2.01 -0.34 1.02 0 0 Z " fill="#D5D9DD" transform="translate(493,187)"/>
+<path d="M0 0 C5.61 0 11.22 0 17 0 C17 0.33 17 0.66 17 1 C13.37 1 9.74 1 6 1 C6 1.66 6 2.32 6 3 C4.02 3 2.04 3 0 3 C0 2.01 0 1.02 0 0 Z " fill="#E1E4E7" transform="translate(544,177)"/>
+<path d="M0 0 C2.475 0.495 2.475 0.495 5 1 C5 1.66 5 2.32 5 3 C6.65 3.33 8.3 3.66 10 4 C10 4.66 10 5.32 10 6 C11.32 6.66 12.64 7.32 14 8 C8.04697456 7.70234873 4.31075199 4.85123021 0 1 C0 0.67 0 0.34 0 0 Z " fill="#B5BCC4" transform="translate(839,171)"/>
+<path d="M0 0 C5.64742605 0.4132263 8.69710825 2.65562166 13 6 C13.99 6.66 14.98 7.32 16 8 C9.88633632 7.23579204 4.17460278 4.53761171 0 0 Z " fill="#9BA3AF" transform="translate(435,1126)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-0.08291164 4.12436746 -0.61276477 4.5365026 -3.9375 5.75 C-4.62714844 6.01296875 -5.31679688 6.2759375 -6.02734375 6.546875 C-8 7 -8 7 -11 6 C-8.46023329 2.89584069 -5.77812602 2.12539924 -2 1 C-1.34 0.67 -0.68 0.34 0 0 Z " fill="#5279C5" transform="translate(728,1116)"/>
+<path d="M0 0 C4.64474974 -0.32405231 7.29105728 0.11526677 11 3 C12.3125 5.1875 12.3125 5.1875 13 7 C8.1725201 5.58707905 4.2837641 3.57025846 0 1 C0 0.67 0 0.34 0 0 Z " fill="#AAB1BB" transform="translate(390,1102)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C0.09273249 2.20253816 -1.8262012 3.38658949 -3.75 4.5625 C-4.81734375 5.22378906 -5.8846875 5.88507813 -6.984375 6.56640625 C-10 8 -10 8 -12.390625 7.71484375 C-12.92171875 7.47894531 -13.4528125 7.24304687 -14 7 C-10.85361797 4.33767674 -7.91102256 3.22219455 -4 2 C-3.2575 1.608125 -2.515 1.21625 -1.75 0.8125 C-0.88375 0.4103125 -0.88375 0.4103125 0 0 Z " fill="#4666A1" transform="translate(802,1078)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-2.4204796 5.88579324 -7.94063905 7.84327831 -14 10 C-13.67 9.01 -13.34 8.02 -13 7 C-11.35 6.67 -9.7 6.34 -8 6 C-7.67 5.01 -7.34 4.02 -7 3 C-4 1.875 -4 1.875 -1 1 C-0.67 0.67 -0.34 0.34 0 0 Z " fill="#547DCC" transform="translate(901,1023)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-2.87776102 5.84639278 -7.34969294 8.28087301 -14 10 C-12.25 8 -12.25 8 -10 6 C-8.68 6 -7.36 6 -6 6 C-6 5.01 -6 4.02 -6 3 C-4.03533587 1.93224776 -2.03144641 0.93446535 0 0 Z " fill="#8AB0FD" transform="translate(1013,858)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-0.17329319 4.25993978 -1.50593231 5.33237678 -5 7 C-8.3125 7.1875 -8.3125 7.1875 -11 7 C-7.54143152 4.05004453 -4.19978515 1.77324262 0 0 Z " fill="#78A4FD" transform="translate(704,829)"/>
+<path d="M0 0 C5.08536612 0.74784796 9.46376439 2.20772512 12.875 6.1875 C13.24625 6.785625 13.6175 7.38375 14 8 C12.35 7.67 10.7 7.34 9 7 C8.67 6.01 8.34 5.02 8 4 C6.67511887 3.63451555 5.33981486 3.3062434 4 3 C1.75 1.4375 1.75 1.4375 0 0 Z " fill="#8DB2FD" transform="translate(985,806)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-2 4 -6 7 -10 10 C-10.66 9.67 -11.32 9.34 -12 9 C-11.236875 8.401875 -10.47375 7.80375 -9.6875 7.1875 C-7.10890051 5.17912563 -7.10890051 5.17912563 -5.4375 3.375 C-3.74298955 1.75416392 -2.1839351 0.84539423 0 0 Z " fill="#C2C6CE" transform="translate(248,669)"/>
+<path d="M0 0 C1.98 0.99 1.98 0.99 4 2 C4 2.66 4 3.32 4 4 C4.61875 4.20625 5.2375 4.4125 5.875 4.625 C8.84653645 6.54775888 9.13024659 8.66594527 10 12 C5.40493818 8.44984265 2.23545746 5.52289491 0 0 Z " fill="#A5ACB8" transform="translate(403,596)"/>
+<path d="M0 0 C1.98 0 3.96 0 6 0 C6.33 0.66 6.66 1.32 7 2 C7.969375 2.12375 8.93875 2.2475 9.9375 2.375 C11.4534375 2.684375 11.4534375 2.684375 13 3 C13.66 4.32 14.32 5.64 15 7 C10.545 6.01 10.545 6.01 6 5 C5.67 3.68 5.34 2.36 5 1 C3.35 1 1.7 1 0 1 C0 0.67 0 0.34 0 0 Z " fill="#B4BAC3" transform="translate(332,446)"/>
+<path d="M0 0 C4.08378283 0.74250597 8.01939223 1.82923301 12 3 C12.33 4.32 12.66 5.64 13 7 C11.68 7 10.36 7 9 7 C9 6.34 9 5.68 9 5 C8.443125 4.9175 7.88625 4.835 7.3125 4.75 C4.30285794 3.77389987 2.37845248 2.04811186 0 0 Z " fill="#7B8695" transform="translate(218,387)"/>
+<path d="M0 0 C2.0625 0.4375 2.0625 0.4375 4 1 C0.60828336 3.26114443 -2.0037341 3.71333041 -5.94140625 4.4375 C-8.20323279 4.87275231 -8.20323279 4.87275231 -10 7 C-12.125 6.625 -12.125 6.625 -14 6 C-13.01 5.67 -12.02 5.34 -11 5 C-10.67 4.34 -10.34 3.68 -10 3 C-7.96875 2.40234375 -7.96875 2.40234375 -5.5 1.9375 C-2.46226779 1.54135157 -2.46226779 1.54135157 0 0 Z " fill="#B9BEC7" transform="translate(695,378)"/>
+<path d="M0 0 C1.67056149 0.31323028 3.33605325 0.65334443 5 1 C5.68578125 1.1340625 6.3715625 1.268125 7.078125 1.40625 C9.07631168 1.83751331 11.04201516 2.41260455 13 3 C13.33 3.99 13.66 4.98 14 6 C12.22631108 5.77113691 10.45598923 5.5160762 8.6875 5.25 C7.20830078 5.04117187 7.20830078 5.04117187 5.69921875 4.828125 C2.53202216 3.85642358 1.66599922 2.79751404 0 0 Z " fill="#C1C6CE" transform="translate(457,371)"/>
+<path d="M0 0 C0.33 0 0.66 0 1 0 C1 4.62 1 9.24 1 14 C0.01 14.33 -0.98 14.66 -2 15 C-2.33 15.66 -2.66 16.32 -3 17 C-2.125 11.25 -2.125 11.25 -1 9 C-0.77532169 7.46331135 -0.59203195 5.92031946 -0.4375 4.375 C-0.35371094 3.55773437 -0.26992188 2.74046875 -0.18359375 1.8984375 C-0.12300781 1.27195312 -0.06242187 0.64546875 0 0 Z " fill="#E1E3E7" transform="translate(39,361)"/>
+<path d="M0 0 C0 2.87015231 -0.34115056 4.21764027 -1.375 6.8125 C-2.68784051 10.17859818 -3.88290234 13.56277642 -5 17 C-5.33 17 -5.66 17 -6 17 C-6 14.36 -6 11.72 -6 9 C-5.01 8.67 -4.02 8.34 -3 8 C-3.061875 7.236875 -3.12375 6.47375 -3.1875 5.6875 C-3 3 -3 3 -1.5 1.1875 C-1.005 0.795625 -0.51 0.40375 0 0 Z " fill="#5F6C7F" transform="translate(47,335)"/>
+<path d="M0 0 C5 2 5 2 10 4 C10.91394531 4.31195313 11.82789063 4.62390625 12.76953125 4.9453125 C13.50558594 5.29335938 14.24164063 5.64140625 15 6 C15.33 6.99 15.66 7.98 16 9 C15.34 9 14.68 9 14 9 C14 8.34 14 7.68 14 7 C11.69 6.67 9.38 6.34 7 6 C7 5.34 7 4.68 7 4 C4.03 3.505 4.03 3.505 1 3 C0.67 2.01 0.34 1.02 0 0 Z " fill="#C4C8D0" transform="translate(117,337)"/>
+<path d="M0 0 C4.9944922 0.71349889 8.55389572 2.25470173 11.8125 6.1875 C12.204375 6.785625 12.59625 7.38375 13 8 C12.67 8.66 12.34 9.32 12 10 C11.443125 9.401875 10.88625 8.80375 10.3125 8.1875 C8.00530031 6.00501381 5.72375426 4.60631661 3 3 C1.1875 1.3125 1.1875 1.3125 0 0 Z " fill="#436096" transform="translate(731,239)"/>
+<path d="M0 0 C-3.0622744 2.48627517 -6.1457054 4.09989404 -9.75 5.6875 C-10.73484375 6.12449219 -11.7196875 6.56148437 -12.734375 7.01171875 C-13.48203125 7.33785156 -14.2296875 7.66398438 -15 8 C-14.67 7.01 -14.34 6.02 -14 5 C-12.35 4.67 -10.7 4.34 -9 4 C-9 3.01 -9 2.02 -9 1 C-2.25 -1.125 -2.25 -1.125 0 0 Z " fill="#576478" transform="translate(293,182)"/>
+<path d="M0 0 C0.80824219 0.10183594 1.61648438 0.20367187 2.44921875 0.30859375 C3.06410156 0.39238281 3.67898438 0.47617188 4.3125 0.5625 C4.6425 1.5525 4.9725 2.5425 5.3125 3.5625 C4.3225 3.2325 3.3325 2.9025 2.3125 2.5625 C-1.53033684 2.42276048 -5.0046369 2.38398381 -8.6875 3.5625 C-8.3575 2.5725 -8.0275 1.5825 -7.6875 0.5625 C-4.59271121 -0.46909626 -3.16118607 -0.41232862 0 0 Z " fill="#99A2AE" transform="translate(318.6875,170.4375)"/>
+<path d="M0 0 C7.26758219 -0.6158968 7.26758219 -0.6158968 10.75 2.3125 C11.4925 3.199375 12.235 4.08625 13 5 C14.31175986 6.02813611 15.6369893 7.04084432 17 8 C12.55422963 7.59583906 10.14642795 5.75013238 6.71484375 3.14453125 C4.54760184 1.69805772 2.57945543 1.23449595 0 1 C0 0.67 0 0.34 0 0 Z " fill="#5F6C80" transform="translate(723,108)"/>
+<path d="M0 0 C0.33 0 0.66 0 1 0 C1.74737188 5.97897503 -0.6768102 9.32379721 -4 14 C-4 11.02705059 -3.51954268 9.217045 -2.5625 6.4375 C-2.29566406 5.65246094 -2.02882812 4.86742187 -1.75390625 4.05859375 C-1 2 -1 2 0 0 Z " fill="#A0A7B4" transform="translate(223,870)"/>
+<path d="M0 0 C0.33 0.99 0.66 1.98 1 3 C-8.41002278 8.37129841 -8.41002278 8.37129841 -13 10 C-9.11973109 5.75595588 -4.95745654 2.89082453 0 0 Z " fill="#707A8E" transform="translate(248,671)"/>
+<path d="M0 0 C4 2 8 4 12 6 C9.5332355 6.88336837 8.36140628 7.1312406 5.859375 6.22265625 C5.16328125 5.83980469 4.4671875 5.45695313 3.75 5.0625 C3.04359375 4.68222656 2.3371875 4.30195312 1.609375 3.91015625 C1.07828125 3.60980469 0.5471875 3.30945313 0 3 C0 2.01 0 1.02 0 0 Z " fill="#93B6FD" transform="translate(732,670)"/>
+<path d="M0 0 C1.32 0 2.64 0 4 0 C4 0.99 4 1.98 4 3 C5.98 3 7.96 3 10 3 C10.33 4.32 10.66 5.64 11 7 C8.03 6.01 5.06 5.02 2 4 C2 3.01 2 2.02 2 1 C1.34 0.67 0.68 0.34 0 0 Z " fill="#B3CCFE" transform="translate(717,652)"/>
+<path d="M0 0 C2.0625 0.4375 2.0625 0.4375 4 1 C3.01 1 2.02 1 1 1 C0.89365234 1.93585937 0.89365234 1.93585937 0.78515625 2.890625 C0 5 0 5 -2.06640625 6.046875 C-2.89011719 6.27890625 -3.71382812 6.5109375 -4.5625 6.75 C-5.80193359 7.11351562 -5.80193359 7.11351562 -7.06640625 7.484375 C-8.02353516 7.73960937 -8.02353516 7.73960937 -9 8 C-6.78189589 4.61447267 -4.52377014 2.94734666 -1 1 C-0.67 0.67 -0.34 0.34 0 0 Z " fill="#D2E1FE" transform="translate(1001,645)"/>
+<path d="M0 0 C5.48540468 1.21897882 9.18341525 2.75935028 13 7 C11.39120578 6.60157441 9.78801827 6.18046843 8.1875 5.75 C7.29417969 5.51796875 6.40085937 5.2859375 5.48046875 5.046875 C2.62353901 3.84111568 1.61630966 2.59898297 0 0 Z " fill="#9CBCFD" transform="translate(695,639)"/>
+<path d="M0 0 C-8.44827586 7 -8.44827586 7 -12 7 C-11.67 5.68 -11.34 4.36 -11 3 C-9.35 3 -7.7 3 -6 3 C-6 2.01 -6 1.02 -6 0 C-3 -1 -3 -1 0 0 Z " fill="#D4E2FE" transform="translate(797,562)"/>
+<path d="M0 0 C2.0625 0.4375 2.0625 0.4375 4 1 C2.8553125 1.6496875 2.8553125 1.6496875 1.6875 2.3125 C-0.9478461 3.77587646 -0.9478461 3.77587646 -2.3125 5.5625 C-5.11253576 7.94771565 -8.44237632 8.2418179 -12 9 C-11.67 8.01 -11.34 7.02 -11 6 C-9.35 6 -7.7 6 -6 6 C-6 5.34 -6 4.68 -6 4 C-4.36368108 2.95107762 -2.69514137 1.95093297 -1 1 C-0.67 0.67 -0.34 0.34 0 0 Z " fill="#84ACFD" transform="translate(776,555)"/>
+<path d="M0 0 C0 0.99 0 1.98 0 3 C-2.4375 4.625 -2.4375 4.625 -5 6 C-5.33 6.33 -5.66 6.66 -6 7 C-8.33297433 7.04092937 -10.66705225 7.04241723 -13 7 C-10.31767339 5.21178226 -7.69711039 3.79857396 -4.8125 2.375 C-3.91144531 1.92898438 -3.01039063 1.48296875 -2.08203125 1.0234375 C-1.39496094 0.68570313 -0.70789063 0.34796875 0 0 Z " fill="#44536A" transform="translate(623,513)"/>
+<path d="M0 0 C2.0625 0.4375 2.0625 0.4375 4 1 C1.61686091 2.45636277 -0.72295473 3.86917307 -3.25 5.0625 C-5.18053285 5.88003585 -5.18053285 5.88003585 -6 8 C-7.32 7.67 -8.64 7.34 -10 7 C-9.34 6.67 -8.68 6.34 -8 6 C-7.67 5.01 -7.34 4.02 -7 3 C-4 1.875 -4 1.875 -1 1 C-0.67 0.67 -0.34 0.34 0 0 Z " fill="#3D5684" transform="translate(863,421)"/>
+<path d="M0 0 C0.33 0 0.66 0 1 0 C0.67 3.96 0.34 7.92 0 12 C-0.66 12 -1.32 12 -2 12 C-2.05395478 10.37536158 -2.09277195 8.75021459 -2.125 7.125 C-2.14820313 6.22007812 -2.17140625 5.31515625 -2.1953125 4.3828125 C-2 2 -2 2 0 0 Z " fill="#626F81" transform="translate(36,364)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-2.45585836 4.46566761 -6.31858349 7.18836907 -12 8 C-8.91579295 3.31200529 -6.40707089 2.22424246 -1 1 C-0.67 0.67 -0.34 0.34 0 0 Z " fill="#7B8696" transform="translate(932,357)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C0.8553125 2.0828125 0.8553125 2.0828125 -0.3125 3.1875 C-2.71133591 5.69790967 -4.35410221 7.96808302 -6 11 C-6.66 10.67 -7.32 10.34 -8 10 C-7.04735876 5.80837855 -6.36739592 4.2792209 -2.875 1.625 C-1.92625 1.08875 -0.9775 0.5525 0 0 Z " fill="#707B8D" transform="translate(58,322)"/>
+<path d="M0 0 C0 0.99 0 1.98 0 3 C-0.66 3 -1.32 3 -2 3 C-2.33 4.32 -2.66 5.64 -3 7 C-3.99 7 -4.98 7 -6 7 C-6.33 7.99 -6.66 8.98 -7 10 C-7.66 9.67 -8.32 9.34 -9 9 C-8.07161713 7.68103535 -7.13194268 6.37001311 -6.1875 5.0625 C-5.66542969 4.33160156 -5.14335937 3.60070312 -4.60546875 2.84765625 C-3 1 -3 1 0 0 Z " fill="#486AA9" transform="translate(430,248)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-1.02174267 4.48662616 -3.53724356 5.86057282 -8 7 C-8.99 7 -9.98 7 -11 7 C-7.54143152 4.05004453 -4.19978515 1.77324262 0 0 Z " fill="#B7BCC5" transform="translate(491,74)"/>
+<path d="M0 0 C-9.42857143 6 -9.42857143 6 -15 6 C-12.77644774 3.4429149 -11.24981807 2.75829088 -8 2 C-7.67 1.34 -7.34 0.68 -7 0 C-3.86650268 -1.04449911 -3.01031744 -0.93423645 0 0 Z " fill="#405B8D" transform="translate(864,1048)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-1.29654383 4.64354845 -4.31237856 6.90447426 -9.3125 7.1875 C-10.199375 7.125625 -11.08625 7.06375 -12 7 C-9 5 -9 5 -7 5 C-7 4.34 -7 3.68 -7 3 C-4.69631264 1.93347808 -2.35981813 0.93578995 0 0 Z " fill="#5780D2" transform="translate(989,975)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-0.2158648 4.38210943 -2.32066733 6.28868248 -6 8 C-9.3125 8.1875 -9.3125 8.1875 -12 8 C-8.9540687 5.96937913 -5.85687334 4.04352805 -2.7421875 2.12109375 C-1.04594593 1.1166082 -1.04594593 1.1166082 0 0 Z " fill="#354A6C" transform="translate(1004,969)"/>
+<path d="M0 0 C2.0625 0.4375 2.0625 0.4375 4 1 C-0.30769231 4.93846154 -0.30769231 4.93846154 -3.8125 5.25 C-4.8953125 5.12625 -4.8953125 5.12625 -6 5 C-6 5.66 -6 6.32 -6 7 C-6.66 6.67 -7.32 6.34 -8 6 C-6.49650603 2.99301207 -3.9581052 2.41742541 -1 1 C-0.67 0.67 -0.34 0.34 0 0 Z " fill="#AAC6FD" transform="translate(893,944)"/>
+<path d="M0 0 C2.5 2.0625 2.5 2.0625 5 5 C5.3125 8.8125 5.3125 8.8125 5 12 C5.66 12 6.32 12 7 12 C6.67 12.99 6.34 13.98 6 15 C4 13 4 13 3.875 9.375 C3.91625 8.26125 3.9575 7.1475 4 6 C2.68 5.34 1.36 4.68 0 4 C0 2.68 0 1.36 0 0 Z " fill="#566379" transform="translate(365,936)"/>
+<path d="M0 0 C2.31 0.33 4.62 0.66 7 1 C7.33 2.32 7.66 3.64 8 5 C9.32 5.33 10.64 5.66 12 6 C11.67 6.66 11.34 7.32 11 8 C7.34683329 6.75023244 6.21934164 6.32901247 4 3 C1.94996045 1.80767387 1.94996045 1.80767387 0 1 C0 0.67 0 0.34 0 0 Z " fill="#C8DAFE" transform="translate(804,939)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C1.01 1.33 0.02 1.66 -1 2 C-1 2.66 -1 3.32 -1 4 C-4.96 5.65 -8.92 7.3 -13 9 C-12.67 8.01 -12.34 7.02 -12 6 C-10.35 5.67 -8.7 5.34 -7 5 C-7 4.34 -7 3.68 -7 3 C-5.35 3 -3.7 3 -2 3 C-2 2.34 -2 1.68 -2 1 C-1.34 0.67 -0.68 0.34 0 0 Z " fill="#D1E0FE" transform="translate(910,934)"/>
+<path d="M0 0 C4.34510827 0.65834974 8.05797217 2.06617503 12 4 C12.99 5.485 12.99 5.485 14 7 C10.2397015 6.41892368 7.46964968 5.34800504 4.1875 3.4375 C3.39730469 2.98246094 2.60710937 2.52742187 1.79296875 2.05859375 C1.20128906 1.70925781 0.60960938 1.35992188 0 1 C0 0.67 0 0.34 0 0 Z " fill="#A4ABB6" transform="translate(84,934)"/>
+<path d="M0 0 C1.98 0.99 1.98 0.99 4 2 C4 3.98 4 5.96 4 8 C4.99 8.33 5.98 8.66 7 9 C6.67 10.32 6.34 11.64 6 13 C2.85487785 8.70166639 1.24303439 5.17930997 0 0 Z " fill="#CED2D8" transform="translate(414,898)"/>
+<path d="M0 0 C3.95371299 0.56481614 6.71675094 1.71996593 10 4 C10.33 4.66 10.66 5.32 11 6 C13.01669827 7.13350534 13.01669827 7.13350534 15 8 C14.01 8.495 14.01 8.495 13 9 C10.875 7.875 10.875 7.875 8 6 C7.30519531 5.5771875 6.61039063 5.154375 5.89453125 4.71875 C1.6037599 2.10631576 1.6037599 2.10631576 0 1 C0 0.67 0 0.34 0 0 Z " fill="#89AFFD" transform="translate(751,892)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-0.05233685 3.2477975 -1.00667261 4.0022242 -4 5 C-4.99 6.485 -4.99 6.485 -6 8 C-9.625 9.1875 -9.625 9.1875 -13 10 C-10.81898993 6.7284849 -9.36096221 5.90963762 -6 4 C-3.99419671 2.67541292 -1.99284138 1.3440093 0 0 Z " fill="#82ABFD" transform="translate(1001,883)"/>
+<path d="M0 0 C3.96189783 4.23513217 5.43181728 8.547001 7 14 C5.68 13.67 4.36 13.34 3 13 C2.87625 11.88625 2.7525 10.7725 2.625 9.625 C2.3534187 5.96896323 2.3534187 5.96896323 0 4 C0 2.68 0 1.36 0 0 Z " fill="#C8CCD3" transform="translate(316,831)"/>
+<path d="M0 0 C1.98 0.99 1.98 0.99 4 2 C4 3.98 4 5.96 4 8 C4.66 8 5.32 8 6 8 C6.33 9.98 6.66 11.96 7 14 C3.03810217 9.76486783 1.56818272 5.452999 0 0 Z " fill="#536077" transform="translate(318,831)"/>
+<path d="M0 0 C2.475 0.495 2.475 0.495 5 1 C5 1.66 5 2.32 5 3 C5.9590625 3.1546875 5.9590625 3.1546875 6.9375 3.3125 C7.618125 3.539375 8.29875 3.76625 9 4 C9.33 4.99 9.66 5.98 10 7 C10.66 7.33 11.32 7.66 12 8 C8 8 8 8 5.4375 5.6875 C4.633125 4.800625 3.82875 3.91375 3 3 C2.401875 2.401875 1.80375 1.80375 1.1875 1.1875 C0.795625 0.795625 0.40375 0.40375 0 0 Z " fill="#8CB2FD" transform="translate(800,820)"/>
+<path d="M0 0 C1.32 0.33 2.64 0.66 4 1 C0.81546523 3.63861452 -2.27084628 6.1832328 -6 8 C-8.3125 7.6875 -8.3125 7.6875 -10 7 C-5.375 4 -5.375 4 -2 4 C-1.34 2.68 -0.68 1.36 0 0 Z " fill="#95B7FD" transform="translate(947,807)"/>
+<path d="M0 0 C0 0.99 0 1.98 0 3 C-1.41328129 3.81837442 -2.83078346 4.62946219 -4.25 5.4375 C-5.43335938 6.11619141 -5.43335938 6.11619141 -6.640625 6.80859375 C-8.78833468 7.89311602 -10.65205061 8.53148716 -13 9 C-13 8.34 -13 7.68 -13 7 C-11.576875 6.87625 -11.576875 6.87625 -10.125 6.75 C-9.09375 6.5025 -8.0625 6.255 -7 6 C-5.90833725 4.06669397 -5.90833725 4.06669397 -5 2 C-2.375 0.75 -2.375 0.75 0 0 Z " fill="#DBE6FE" transform="translate(956,794)"/>
+<path d="M0 0 C5.1343828 4.27865233 5.85102355 9.68062955 7 16 C6.67 15.01 6.34 14.02 6 13 C5.01 12.67 4.02 12.34 3 12 C2.87625 10.865625 2.7525 9.73125 2.625 8.5625 C2.41875 7.386875 2.2125 6.21125 2 5 C1.34 4.67 0.68 4.34 0 4 C0 2.68 0 1.36 0 0 Z " fill="#626D82" transform="translate(337,740)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-0.39509338 3.89932357 -2.31245243 4.50168276 -6 5 C-6 5.66 -6 6.32 -6 7 C-7.98 7.33 -9.96 7.66 -12 8 C-11.01 7.67 -10.02 7.34 -9 7 C-8.731875 6.360625 -8.46375 5.72125 -8.1875 5.0625 C-6.45501873 2.05345358 -4.23972436 1.89609397 -1 1 C-0.67 0.67 -0.34 0.34 0 0 Z " fill="#D9E5FE" transform="translate(808,639)"/>
+<path d="M0 0 C4.99464924 0.47568088 8.02785403 1.95160891 12 5 C12.33 5.66 12.66 6.32 13 7 C3.40546697 4.29384966 3.40546697 4.29384966 0 0 Z " fill="#B6CEFE" transform="translate(957,590)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C1.67 1.33 1.34 1.66 1 2 C0.65239293 3.38750721 0.34663367 4.78561734 0.0625 6.1875 C-0.72497367 9.89395501 -1.71783977 13.42826792 -3 17 C-3.33 17 -3.66 17 -4 17 C-4 14.36 -4 11.72 -4 9 C-3.01 8.67 -2.02 8.34 -1 8 C-1.020625 6.865625 -1.04125 5.73125 -1.0625 4.5625 C-1 1 -1 1 0 0 Z " fill="#3A517A" transform="translate(595,579)"/>
+<path d="M0 0 C0 5.55196264 -2.35219334 10.8310781 -6 15 C-6 13.02 -6 11.04 -6 9 C-5.01 8.67 -4.02 8.34 -3 8 C-3.061875 7.236875 -3.12375 6.47375 -3.1875 5.6875 C-3 3 -3 3 -1.5 1.1875 C-1.005 0.795625 -0.51 0.40375 0 0 Z " fill="#5A86DE" transform="translate(602,573)"/>
+<path d="M0 0 C5.10436996 1.22504879 8.75006878 2.76195717 13 6 C13.33 6.66 13.66 7.32 14 8 C7.96719209 6.3833652 4.049191 4.83290538 0 0 Z " fill="#B0C9FE" transform="translate(942,565)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C1.23925157 2.62974564 0.46601567 4.25366648 -0.3125 5.875 C-0.95638672 7.23238281 -0.95638672 7.23238281 -1.61328125 8.6171875 C-3 11 -3 11 -6 13 C-3.10933941 3.40546697 -3.10933941 3.40546697 0 0 Z " fill="#496AA8" transform="translate(605,563)"/>
+<path d="M0 0 C2 1 2 1 2.8515625 2.85546875 C4.3516571 7.37848126 5.37173481 11.16744753 5 16 C2.09707248 12.72327085 1.41970936 10.04717391 0.8125 5.75 C0.57466797 4.13351562 0.57466797 4.13351562 0.33203125 2.484375 C0.22246094 1.66453125 0.11289063 0.8446875 0 0 Z " fill="#626E83" transform="translate(218,528)"/>
+<path d="M0 0 C3.3125 0.1875 3.3125 0.1875 7 1 C8.9375 3.5625 8.9375 3.5625 10 6 C7.625 5.75 7.625 5.75 5 5 C3.875 3 3.875 3 3 1 C2.01 0.67 1.02 0.34 0 0 Z " fill="#A8AEBA" transform="translate(189,496)"/>
+<path d="M0 0 C2.31 0 4.62 0 7 0 C6.38125 0.28875 5.7625 0.5775 5.125 0.875 C2.86674235 1.93720042 2.86674235 1.93720042 1 4 C-1.63412345 5.14820766 -4.27349121 6.09116374 -7 7 C-7 6.01 -7 5.02 -7 4 C-3.535 3.505 -3.535 3.505 0 3 C0 2.01 0 1.02 0 0 Z " fill="#3B547F" transform="translate(828,438)"/>
+<path d="M0 0 C3.92410537 0.54754959 7.47515924 1.13966738 11 3 C12.3125 5.125 12.3125 5.125 13 7 C9.20696275 5.99806563 6.28463659 5.18975773 3 3 C3 2.34 3 1.68 3 1 C2.01 0.67 1.02 0.34 0 0 Z " fill="#A3AAB5" transform="translate(272,415)"/>
+<path d="M0 0 C4.85745385 0.59237242 8.66821752 1.79164031 13 4 C13.33 4.99 13.66 5.98 14 7 C3.25740319 4.29384966 3.25740319 4.29384966 0 0 Z " fill="#979FAB" transform="translate(812,394)"/>
+<path d="M0 0 C3.92410537 0.54754959 7.47515924 1.13966738 11 3 C12.3125 5.125 12.3125 5.125 13 7 C9.20696275 5.99806563 6.28463659 5.18975773 3 3 C3 2.34 3 1.68 3 1 C2.01 0.67 1.02 0.34 0 0 Z " fill="#828C9B" transform="translate(241,367)"/>
+<path d="M0 0 C-4.18586481 3.18923033 -6.70558305 4.50423019 -12 4 C-9.8923766 -0.2152468 -4.26296995 -1.87570678 0 0 Z " fill="#5B86DE" transform="translate(996,361)"/>
+<path d="M0 0 C2.375 -0.125 2.375 -0.125 5 0 C5.66 0.66 6.32 1.32 7 2 C8.5159375 2.2475 8.5159375 2.2475 10.0625 2.5 C11.031875 2.665 12.00125 2.83 13 3 C13.33 3.66 13.66 4.32 14 5 C14.99 5.66 15.98 6.32 17 7 C12.39146203 6.27991594 8.32762591 4.68704061 4 3 C4 2.34 4 1.68 4 1 C2.68 0.67 1.36 0.34 0 0 Z " fill="#BFC4CC" transform="translate(154,357)"/>
+<path d="M0 0 C8.35010941 2.3107221 8.35010941 2.3107221 11.0625 5.1875 C11.371875 5.785625 11.68125 6.38375 12 7 C10.35 6.67 8.7 6.34 7 6 C7 5.34 7 4.68 7 4 C5.02 4 3.04 4 1 4 C0.67 2.68 0.34 1.36 0 0 Z " fill="#C8CCD3" transform="translate(137,347)"/>
+<path d="M0 0 C1.98 0 3.96 0 6 0 C1.95001278 3.40198926 -2.63626649 6 -8 6 C-7.67 5.01 -7.34 4.02 -7 3 C-5.5459375 2.814375 -5.5459375 2.814375 -4.0625 2.625 C-2.5465625 2.315625 -2.5465625 2.315625 -1 2 C-0.67 1.34 -0.34 0.68 0 0 Z " fill="#CED2D7" transform="translate(1039,301)"/>
+<path d="M0 0 C1.32 0.33 2.64 0.66 4 1 C0.86835277 3.52940738 -2.27808042 5.44920018 -6 7 C-8.375 6.6875 -8.375 6.6875 -10 6 C-9.01 5.67 -8.02 5.34 -7 5 C-6.67 4.34 -6.34 3.68 -6 3 C-4.33333333 2.66666667 -2.66666667 2.33333333 -1 2 C-0.67 1.34 -0.34 0.68 0 0 Z " fill="#8E97A4" transform="translate(177,243)"/>
+<path d="M0 0 C5.37305699 -0.44041451 5.37305699 -0.44041451 8 0 C10 2.5 10 2.5 11 5 C6.87248551 4.39301257 3.6678852 2.96189209 0 1 C0 0.67 0 0.34 0 0 Z " fill="#3E5887" transform="translate(696,221)"/>
+<path d="M0 0 C0.94875 0.04125 1.8975 0.0825 2.875 0.125 C-0.0862064 2.6327502 -2.37737227 3.64012452 -6.1875 4.3125 C-7.04472656 4.47105469 -7.90195312 4.62960938 -8.78515625 4.79296875 C-11.125 5.125 -11.125 5.125 -14.125 5.125 C-11.36933749 2.36933749 -8.90960367 2.66565767 -5.125 2.125 C-3.125 0.125 -3.125 0.125 0 0 Z " fill="#374D71" transform="translate(490.125,214.875)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-1.02174267 4.48662616 -3.53724356 5.86057282 -8 7 C-8.99 7 -9.98 7 -11 7 C-8.84658594 4.65082102 -6.78332063 3.17556996 -3.9375 1.75 C-3.24527344 1.39421875 -2.55304688 1.0384375 -1.83984375 0.671875 C-1.23269531 0.45015625 -0.62554687 0.2284375 0 0 Z " fill="#B3BAC3" transform="translate(276,191)"/>
+<path d="M0 0 C8.35010941 2.3107221 8.35010941 2.3107221 11.0625 5.1875 C11.371875 5.785625 11.68125 6.38375 12 7 C8.03925073 6.43417868 5.27740694 5.30304271 2 3 C1.34 2.01 0.68 1.02 0 0 Z " fill="#5D6A7E" transform="translate(867,184)"/>
+<path d="M0 0 C1.32 0.33 2.64 0.66 4 1 C-0.625 5 -0.625 5 -4 5 C-4 5.66 -4 6.32 -4 7 C-4.66 7 -5.32 7 -6 7 C-6 5.68 -6 4.36 -6 3 C-5.195625 2.87625 -4.39125 2.7525 -3.5625 2.625 C-2.716875 2.41875 -1.87125 2.2125 -1 2 C-0.67 1.34 -0.34 0.68 0 0 Z " fill="#5D6A7E" transform="translate(411,115)"/>
+<path d="M0 0 C1.98 0 3.96 0 6 0 C6.33 0.66 6.66 1.32 7 2 C7.825 2.495 8.65 2.99 9.5 3.5 C12 5 12 5 13 7 C3.40546697 4.29384966 3.40546697 4.29384966 0 0 Z " fill="#8891A0" transform="translate(627,57)"/>
+<path d="M0 0 C4 2 8 4 12 6 C9.5332355 6.88336837 8.36140628 7.1312406 5.859375 6.22265625 C5.16328125 5.83980469 4.4671875 5.45695313 3.75 5.0625 C3.04359375 4.68222656 2.3371875 4.30195312 1.609375 3.91015625 C1.07828125 3.60980469 0.5471875 3.30945313 0 3 C0 2.01 0 1.02 0 0 Z " fill="#BCC1CA" transform="translate(181,883)"/>
+<path d="M0 0 C3.10876096 3.52326242 4.72415085 6.48545685 6 11 C6.33 11.99 6.66 12.98 7 14 C5.68 13.67 4.36 13.34 3 13 C2.87625 11.88625 2.7525 10.7725 2.625 9.625 C2.3534187 5.96896323 2.3534187 5.96896323 0 4 C0 2.68 0 1.36 0 0 Z " fill="#C3C7D0" transform="translate(323,846)"/>
+<path d="M0 0 C3.77727089 1.81309003 7.37269822 3.9073259 11 6 C11 6.99 11 7.98 11 9 C6.90784086 6.71320518 3.50049752 4.09346293 0 1 C0 0.67 0 0.34 0 0 Z " fill="#9DA4B1" transform="translate(391,587)"/>
+<path d="M0 0 C0.33 0.66 0.66 1.32 1 2 C0.01 2.495 0.01 2.495 -1 3 C-2.01866229 4.65532623 -3.01810813 6.32260138 -4 8 C-4.66 8.66 -5.32 9.32 -6 10 C-6.99 9.67 -7.98 9.34 -9 9 C-7.87895467 7.68412059 -6.75303035 6.37239647 -5.625 5.0625 C-4.99851562 4.33160156 -4.37203125 3.60070312 -3.7265625 2.84765625 C-2 1 -2 1 0 0 Z " fill="#5D8AE5" transform="translate(626,544)"/>
+<path d="M0 0 C9.21052632 3.42105263 9.21052632 3.42105263 11 7 C9.35 6.67 7.7 6.34 6 6 C6 5.34 6 4.68 6 4 C4.02 3.34 2.04 2.68 0 2 C0 1.34 0 0.68 0 0 Z " fill="#CADBFE" transform="translate(874,539)"/>
+<path d="M0 0 C1.46109063 0.25554054 2.91888096 0.53000372 4.375 0.8125 C5.59316406 1.03873047 5.59316406 1.03873047 6.8359375 1.26953125 C9 2 9 2 11 5 C11.99 5.66 12.98 6.32 14 7 C8.357521 6.17022368 3.92015925 4.15212134 0 0 Z " fill="#929BA8" transform="translate(437,467)"/>
+<path d="M0 0 C0.66 0 1.32 0 2 0 C1.67 1.32 1.34 2.64 1 4 C-0.134375 4.12375 -1.26875 4.2475 -2.4375 4.375 C-4.2009375 4.684375 -4.2009375 4.684375 -6 5 C-6.33 5.66 -6.66 6.32 -7 7 C-8.32 6.67 -9.64 6.34 -11 6 C-7.86498151 3.34729204 -4.89922551 2.21309238 -1 1 C-0.67 0.67 -0.34 0.34 0 0 Z " fill="#547CCB" transform="translate(776,467)"/>
+<path d="M0 0 C-0.99 0.33 -1.98 0.66 -3 1 C-3.33 1.66 -3.66 2.32 -4 3 C-6.06640625 3.6328125 -6.06640625 3.6328125 -8.5625 4.125 C-9.38878906 4.29257812 -10.21507812 4.46015625 -11.06640625 4.6328125 C-11.70449219 4.75398438 -12.34257813 4.87515625 -13 5 C-12 2 -12 2 -10.29296875 1.015625 C-9.59816406 0.76296875 -8.90335938 0.5103125 -8.1875 0.25 C-7.15689453 -0.14445312 -7.15689453 -0.14445312 -6.10546875 -0.546875 C-3.71856031 -1.06056958 -2.29362227 -0.76282269 0 0 Z " fill="#405B8C" transform="translate(813,450)"/>
+<path d="M0 0 C0.66 0 1.32 0 2 0 C1.67 1.32 1.34 2.64 1 4 C-0.134375 4.12375 -1.26875 4.2475 -2.4375 4.375 C-4.2009375 4.684375 -4.2009375 4.684375 -6 5 C-6.33 5.66 -6.66 6.32 -7 7 C-8.32 6.67 -9.64 6.34 -11 6 C-7.86498151 3.34729204 -4.89922551 2.21309238 -1 1 C-0.67 0.67 -0.34 0.34 0 0 Z " fill="#547CCB" transform="translate(886,412)"/>
+<path d="M0 0 C10.74259681 2.70615034 10.74259681 2.70615034 14 7 C12.68 7 11.36 7 10 7 C9.67 6.34 9.34 5.68 9 5 C7.865625 4.87625 6.73125 4.7525 5.5625 4.625 C4.386875 4.41875 3.21125 4.2125 2 4 C0.77734375 1.9609375 0.77734375 1.9609375 0 0 Z " fill="#B5BAC4" transform="translate(171,364)"/>
+<path d="M0 0 C-4.17688767 3.37364004 -8.68367579 5.97762996 -14 7 C-6.79411765 -0.46323529 -6.79411765 -0.46323529 0 0 Z " fill="#99A2AE" transform="translate(957,346)"/>
+<path d="M0 0 C2.475 0.99 2.475 0.99 5 2 C5.33 4.31 5.66 6.62 6 9 C5.67 8.34 5.34 7.68 5 7 C4.34 6.731875 3.68 6.46375 3 6.1875 C1 5 1 5 0.25 2.375 C0.1675 1.59125 0.085 0.8075 0 0 Z " fill="#A5ACB7" transform="translate(776,247)"/>
+<path d="M0 0 C0.33 0 0.66 0 1 0 C1.39169887 2.66355234 1.40564529 4.39224373 -0.11328125 6.66796875 C-1.36389317 8.1510888 -2.67864514 9.57954352 -4 11 C-4.66 10.67 -5.32 10.34 -6 10 C-4.2786986 6.39346373 -2.59039184 3.06137217 0 0 Z " fill="#5B697C" transform="translate(403,240)"/>
+<path d="M0 0 C-1.87824891 1.87824891 -5.03935276 1.39102397 -7.5625 1.5625 C-8.76003906 1.64628906 -9.95757812 1.73007813 -11.19140625 1.81640625 C-12.11824219 1.87699219 -13.04507812 1.93757812 -14 2 C-14.33 2.99 -14.66 3.98 -15 5 C-15.66 5 -16.32 5 -17 5 C-16.40625 3.08203125 -16.40625 3.08203125 -15 1 C-12.03125 0.13671875 -12.03125 0.13671875 -8.5 -0.3125 C-7.3346875 -0.47363281 -6.169375 -0.63476562 -4.96875 -0.80078125 C-2 -1 -2 -1 0 0 Z " fill="#48576C" transform="translate(516,188)"/>
+<path d="M0 0 C1.32 0.33 2.64 0.66 4 1 C1.62997587 3.61950036 -0.95453979 5.23683883 -4 7 C-4.33 7.33 -4.66 7.66 -5 8 C-6.66617115 8.04063832 -8.33388095 8.042721 -10 8 C-9.01 7.34 -8.02 6.68 -7 6 C-6.34 5.46375 -5.68 4.9275 -5 4.375 C-3 3 -3 3 0 3 C0 2.01 0 1.02 0 0 Z " fill="#D3D7DC" transform="translate(475,82)"/>
+<path d="M0 0 C0.66 0 1.32 0 2 0 C1.5206753 4.31392226 0.2542015 6.16569547 -3 9 C-3.99 8.67 -4.98 8.34 -6 8 C-5.566875 7.608125 -5.13375 7.21625 -4.6875 6.8125 C-2.85439739 4.97761098 -2.85439739 4.97761098 -1.4375 2.3125 C-0.7259375 1.1678125 -0.7259375 1.1678125 0 0 Z " fill="#B4B9C3" transform="translate(436,977)"/>
+<path d="M0 0 C4.61513112 1.31860889 8.09897612 3.21355437 12 6 C11.67 6.66 11.34 7.32 11 8 C8.69 7.01 6.38 6.02 4 5 C4 4.34 4 3.68 4 3 C2.68 2.34 1.36 1.68 0 1 C0 0.67 0 0.34 0 0 Z " fill="#A3C1FE" transform="translate(766,901)"/>
+<path d="M0 0 C0.99 0 1.98 0 3 0 C3.28875 1.11375 3.5775 2.2275 3.875 3.375 C4.69241329 7.00291092 4.69241329 7.00291092 7 9 C7.125 12.125 7.125 12.125 7 15 C6.67 15 6.34 15 6 15 C6 13.35 6 11.7 6 10 C5.01 9.67 4.02 9.34 3 9 C2.05078125 6.93359375 2.05078125 6.93359375 1.3125 4.4375 C1.06113281 3.61121094 0.80976563 2.78492188 0.55078125 1.93359375 C0.36902344 1.29550781 0.18726563 0.65742187 0 0 Z " fill="#4E5B73" transform="translate(346,894)"/>
+<path d="M0 0 C3.96189783 4.23513217 5.43181728 8.547001 7 14 C3.9941923 11.9961282 3.33407138 11.21478096 1.8125 8.125 C1.46832031 7.44695313 1.12414062 6.76890625 0.76953125 6.0703125 C0 4 0 4 0 0 Z " fill="#979FAD" transform="translate(313,822)"/>
+<path d="M0 0 C2.475 0.495 2.475 0.495 5 1 C5.33 1.99 5.66 2.98 6 4 C6.78375 4.103125 7.5675 4.20625 8.375 4.3125 C11 5 11 5 13 8 C11.68 7.67 10.36 7.34 9 7 C9 6.34 9 5.68 9 5 C8.2575 4.9175 7.515 4.835 6.75 4.75 C3.48778646 3.8603054 2.19045122 2.51496251 0 0 Z " fill="#D9E5FE" transform="translate(802,824)"/>
+<path d="M0 0 C4.99464924 0.47568088 8.02785403 1.95160891 12 5 C12.33 5.66 12.66 6.32 13 7 C3.40546697 4.29384966 3.40546697 4.29384966 0 0 Z " fill="#B8CFFE" transform="translate(1001,817)"/>
+<path d="M0 0 C0.556875 0.28875 1.11375 0.5775 1.6875 0.875 C3.99884441 2.04417906 3.99884441 2.04417906 6.5 2.9375 C9.01519507 4.0064579 10.88942672 5.28027362 13 7 C8.39146203 6.27991594 4.32762591 4.68704061 0 3 C0 2.01 0 1.02 0 0 Z " fill="#9CBCFD" transform="translate(976,811)"/>
+<path d="M0 0 C2.475 0.495 2.475 0.495 5 1 C5.33 1.99 5.66 2.98 6 4 C8.00016466 5.20882096 8.00016466 5.20882096 10 6 C6.79604584 6 4.90600261 5.25664978 2 4 C2 3.01 2 2.02 2 1 C1.34 0.67 0.68 0.34 0 0 Z " fill="#9FBEFD" transform="translate(930,666)"/>
+<path d="M0 0 C1.32 0 2.64 0 4 0 C4.33 0.66 4.66 1.32 5 2 C6.175625 2.185625 6.175625 2.185625 7.375 2.375 C10 3 10 3 11.8125 5.0625 C12.204375 5.701875 12.59625 6.34125 13 7 C7.92990529 6.52467862 4.02506742 3.95637706 0 1 C0 0.67 0 0.34 0 0 Z " fill="#D8E4FE" transform="translate(1000,614)"/>
+<path d="M0 0 C3.5786304 1.65167557 6.74820188 3.78286492 10 6 C9.01 6.495 9.01 6.495 8 7 C4.4375 5.8125 4.4375 5.8125 1 4 C0.0625 1.8125 0.0625 1.8125 0 0 Z " fill="#84ADFD" transform="translate(976,601)"/>
+<path d="M0 0 C3.32104626 0.55350771 6.16244492 1.14091219 9 3 C10.25 5.125 10.25 5.125 11 7 C10.1646875 6.566875 10.1646875 6.566875 9.3125 6.125 C6.98588247 4.94092436 6.98588247 4.94092436 4.375 4.0625 C2 3 2 3 0 0 Z " fill="#C2D6FE" transform="translate(886,532)"/>
+<path d="M0 0 C2.125 0.375 2.125 0.375 4 1 C2.33779419 2.00739746 0.66979326 3.00522955 -1 4 C-1.60070312 4.37125 -2.20140625 4.7425 -2.8203125 5.125 C-4.51172339 6.14409275 -6.25398763 7.07757837 -8 8 C-8.66 7.67 -9.32 7.34 -10 7 C-7.5682889 3.35243335 -6.06120946 3.26912796 -2 2 C-1.34 1.34 -0.68 0.68 0 0 Z " fill="#8AAFFD" transform="translate(824,527)"/>
+<path d="M0 0 C5.7097955 0.41778991 8.60957142 2.57546571 13 6 C8.43924444 6 4.50557127 4.31130401 1.0625 1.3125 C0.711875 0.879375 0.36125 0.44625 0 0 Z " fill="#9EA6B1" transform="translate(757,394)"/>
+<path d="M0 0 C1.98146451 0.44829514 3.96014211 0.90892498 5.9375 1.375 C7.03964844 1.63023437 8.14179688 1.88546875 9.27734375 2.1484375 C10.17582031 2.42945313 11.07429688 2.71046875 12 3 C12.33 3.66 12.66 4.32 13 5 C11.20739868 4.94004678 9.41574205 4.8512759 7.625 4.75 C6.62726563 4.70359375 5.62953125 4.6571875 4.6015625 4.609375 C2 4 2 4 0.6484375 1.953125 C0.43445313 1.30859375 0.22046875 0.6640625 0 0 Z " fill="#CBCFD5" transform="translate(476,378)"/>
+<path d="M0 0 C-0.99 1.32 -1.98 2.64 -3 4 C-5.97 3.505 -5.97 3.505 -9 3 C-7.01532024 -0.96935951 -3.9567243 -1.41311582 0 0 Z " fill="#3A537D" transform="translate(683,358)"/>
+<path d="M0 0 C1.32 0.33 2.64 0.66 4 1 C0.37464179 4.17218843 -3.51150278 5.42902597 -8 7 C-7.67 5.68 -7.34 4.36 -7 3 C-5.5459375 2.814375 -5.5459375 2.814375 -4.0625 2.625 C-2.5465625 2.315625 -2.5465625 2.315625 -1 2 C-0.67 1.34 -0.34 0.68 0 0 Z " fill="#3C5683" transform="translate(1008,349)"/>
+<path d="M0 0 C-1.32 0.33 -2.64 0.66 -4 1 C-4 1.66 -4 2.32 -4 3 C-7.47325181 4.1577506 -10.36067448 4.06866652 -14 4 C-9.2157506 0.8105004 -5.77575443 -0.26863974 0 0 Z " fill="#5C88E1" transform="translate(1083,320)"/>
+<path d="M0 0 C2.0625 0.4375 2.0625 0.4375 4 1 C2.58671871 1.81837442 1.16921654 2.62946219 -0.25 3.4375 C-1.43335938 4.11619141 -1.43335938 4.11619141 -2.640625 4.80859375 C-4.78833468 5.89311602 -6.65205061 6.53148716 -9 7 C-8.375 5.125 -8.375 5.125 -7 3 C-3.9375 1.8125 -3.9375 1.8125 -1 1 C-0.67 0.67 -0.34 0.34 0 0 Z " fill="#677386" transform="translate(228,215)"/>
+<path d="M0 0 C1.41750563 0.11509661 2.83401169 0.24253658 4.25 0.375 C5.03890625 0.44460937 5.8278125 0.51421875 6.640625 0.5859375 C9.085877 1.01507113 10.84836903 1.78600638 13 3 C11.39667209 3.08121924 9.79215974 3.13929134 8.1875 3.1875 C7.29417969 3.22230469 6.40085937 3.25710937 5.48046875 3.29296875 C2.58352485 2.95081002 1.77444972 2.24606427 0 0 Z " fill="#5781D5" transform="translate(667,214)"/>
+<path d="M0 0 C8.35010941 2.3107221 8.35010941 2.3107221 11.0625 5.1875 C11.371875 5.785625 11.68125 6.38375 12 7 C7.48292068 6.4685789 4.61312423 4.70984317 1 2 C0.67 1.34 0.34 0.68 0 0 Z " fill="#808A99" transform="translate(904,205)"/>
+<path d="M0 0 C3.63 0.33 7.26 0.66 11 1 C11 1.99 11 2.98 11 4 C11.99 4.33 12.98 4.66 14 5 C11.69 4.67 9.38 4.34 7 4 C7 3.34 7 2.68 7 2 C4.69 1.67 2.38 1.34 0 1 C0 0.67 0 0.34 0 0 Z " fill="#8E97A4" transform="translate(691,194)"/>
+<path d="M0 0 C1.44122613 0.59522337 2.87785868 1.20157619 4.3125 1.8125 C5.11300781 2.14894531 5.91351562 2.48539063 6.73828125 2.83203125 C8.96515745 3.98200704 10.34987767 5.13626961 12 7 C7.87161932 6.39288519 4.59577618 5.12477683 1 3 C0.67 2.01 0.34 1.02 0 0 Z " fill="#CED2D8" transform="translate(866,186)"/>
+<path d="M0 0 C0.391875 0.45375 0.78375 0.9075 1.1875 1.375 C2.96944965 3.16809237 2.96944965 3.16809237 5.625 4 C6.40875 4.33 7.1925 4.66 8 5 C8.33 5.99 8.66 6.98 9 8 C2.25 6.25 2.25 6.25 0 4 C0 2.68 0 1.36 0 0 Z " fill="#C4C9D0" transform="translate(345,152)"/>
+<path d="M0 0 C3.37705625 0.53725895 6.696686 1.11064623 10 2 C10.33 3.32 10.66 4.64 11 6 C9.72554546 5.57316368 8.45554118 5.13302798 7.1875 4.6875 C6.47980469 4.44386719 5.77210938 4.20023438 5.04296875 3.94921875 C2.85527627 2.93275742 1.59103282 1.79179406 0 0 Z " fill="#526075" transform="translate(777,136)"/>
+<path d="M0 0 C3.63 2.31 7.26 4.62 11 7 C7 8 7 8 5.078125 6.85546875 C4.47484375 6.30503906 3.8715625 5.75460937 3.25 5.1875 C2.63640625 4.64480469 2.0228125 4.10210938 1.390625 3.54296875 C0 2 0 2 0 0 Z " fill="#3C5480" transform="translate(595,1165)"/>
+<path d="M0 0 C1.32 0 2.64 0 4 0 C4.33 0.66 4.66 1.32 5 2 C6.97888961 2.72693904 8.97954558 3.39816251 11 4 C11 4.99 11 5.98 11 7 C7.22272911 5.18690997 3.62730178 3.0926741 0 1 C0 0.67 0 0.34 0 0 Z " fill="#C6CBD2" transform="translate(306,1054)"/>
+<path d="M0 0 C0.99 0.33 1.98 0.66 3 1 C3.33 2.98 3.66 4.96 4 7 C4.99 7.33 5.98 7.66 7 8 C6.67 9.32 6.34 10.64 6 12 C2.95691029 8.26529899 1.51110655 4.53331966 0 0 Z " fill="#CDD1D7" transform="translate(424,920)"/>
+<path d="M0 0 C1.65 0 3.3 0 5 0 C5.33 0.99 5.66 1.98 6 3 C7.64821244 4.03013277 9.31503702 5.03114628 11 6 C11.33 6.66 11.66 7.32 12 8 C1.47368421 2.94736842 1.47368421 2.94736842 0 0 Z " fill="#616D82" transform="translate(180,881)"/>
+<path d="M0 0 C1.32 0.33 2.64 0.66 4 1 C4 1.66 4 2.32 4 3 C4.763125 3.103125 5.52625 3.20625 6.3125 3.3125 C9.17059424 4.04364039 10.15742885 4.76951913 12 7 C10.35 7 8.7 7 7 7 C7 6.01 7 5.02 7 4 C6.21625 3.896875 5.4325 3.79375 4.625 3.6875 C2 3 2 3 0 0 Z " fill="#D6E3FE" transform="translate(1015,825)"/>
+<path d="M0 0 C1.32 0.33 2.64 0.66 4 1 C4.144375 2.051875 4.28875 3.10375 4.4375 4.1875 C4.87526966 7.15460549 5.37804866 10.06794366 6 13 C2.57068046 9.2440786 1.43570917 4.76533255 0 0 Z " fill="#57637A" transform="translate(308,809)"/>
+<path d="M0 0 C1.32 0.33 2.64 0.66 4 1 C3.01 1.33 2.02 1.66 1 2 C0.01 3.485 0.01 3.485 -1 5 C-4.625 6.1875 -4.625 6.1875 -8 7 C-7.34 5.68 -6.68 4.36 -6 3 C-4.35 3 -2.7 3 -1 3 C-0.67 2.01 -0.34 1.02 0 0 Z " fill="#D4E2FE" transform="translate(874,727)"/>
+<path d="M0 0 C0 3 0 3 -1.6875 5.1875 C-4.3961577 7.31050198 -5.64708882 7.37254569 -9 7 C-6.24479785 4.04070881 -3.53372712 1.96318174 0 0 Z " fill="#D2D6DC" transform="translate(375,681)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C1.09972412 2.03531726 0.17906965 3.05294165 -0.75 4.0625 C-1.51570312 4.91521484 -1.51570312 4.91521484 -2.296875 5.78515625 C-4 7 -4 7 -6.203125 6.68359375 C-6.79609375 6.45800781 -7.3890625 6.23242188 -8 6 C-7.01 5.67 -6.02 5.34 -5 5 C-4.67 4.01 -4.34 3.02 -4 2 C-2.0625 0.75 -2.0625 0.75 0 0 Z " fill="#737D90" transform="translate(257,664)"/>
+<path d="M0 0 C-0.33 1.32 -0.66 2.64 -1 4 C-1.804375 4.12375 -2.60875 4.2475 -3.4375 4.375 C-4.7059375 4.684375 -4.7059375 4.684375 -6 5 C-6.33 5.66 -6.66 6.32 -7 7 C-8.32 6.67 -9.64 6.34 -11 6 C-9.54550599 4.9944239 -8.08627557 3.99569565 -6.625 3 C-5.40683594 2.1646875 -5.40683594 2.1646875 -4.1640625 1.3125 C-2 0 -2 0 0 0 Z " fill="#7AA5FD" transform="translate(831,636)"/>
+<path d="M0 0 C2.97 0.99 5.94 1.98 9 3 C9 3.99 9 4.98 9 6 C9.99 6.33 10.98 6.66 12 7 C7.0682659 6.55166054 3.6807076 4.13973905 0 1 C0 0.67 0 0.34 0 0 Z " fill="#D0DFFE" transform="translate(862,532)"/>
+<path d="M0 0 C0.33 0.99 0.66 1.98 1 3 C-0.98 3.33 -2.96 3.66 -5 4 C-5.33 4.99 -5.66 5.98 -6 7 C-8.31 7 -10.62 7 -13 7 C-13 6.67 -13 6.34 -13 6 C-11.7315625 5.62875 -11.7315625 5.62875 -10.4375 5.25 C-6.61572526 3.86026373 -3.48131937 2.08879162 0 0 Z " fill="#425268" transform="translate(637,506)"/>
+<path d="M0 0 C2.0625 0.4375 2.0625 0.4375 4 1 C2.04669132 2.03041513 0.08718472 3.0490893 -1.875 4.0625 C-2.96554687 4.63097656 -4.05609375 5.19945312 -5.1796875 5.78515625 C-6.11039063 6.18605469 -7.04109375 6.58695312 -8 7 C-8.66 6.67 -9.32 6.34 -10 6 C-7.41804126 2.12706189 -5.39076016 2.11764804 -1 1 C-0.67 0.67 -0.34 0.34 0 0 Z " fill="#C4C9D0" transform="translate(635,504)"/>
+<path d="M0 0 C-1.95330868 1.03041513 -3.91281528 2.0490893 -5.875 3.0625 C-6.96554687 3.63097656 -8.05609375 4.19945312 -9.1796875 4.78515625 C-10.11039063 5.18605469 -11.04109375 5.58695312 -12 6 C-12.66 5.67 -13.32 5.34 -14 5 C-11.57563772 1.36345658 -10.08079664 1.19023235 -6 0 C-3.50907189 -1.24546405 -2.58919267 -0.7767578 0 0 Z " fill="#C6CBD2" transform="translate(653,498)"/>
+<path d="M0 0 C2.0625 0.4375 2.0625 0.4375 4 1 C2.04669132 2.03041513 0.08718472 3.0490893 -1.875 4.0625 C-2.96554687 4.63097656 -4.05609375 5.19945312 -5.1796875 5.78515625 C-6.11039063 6.18605469 -7.04109375 6.58695312 -8 7 C-8.66 6.67 -9.32 6.34 -10 6 C-7.41804126 2.12706189 -5.39076016 2.11764804 -1 1 C-0.67 0.67 -0.34 0.34 0 0 Z " fill="#C4C9D0" transform="translate(683,480)"/>
+<path d="M0 0 C0.66 0 1.32 0 2 0 C1.67 1.32 1.34 2.64 1 4 C-2.98060777 5.17076699 -6.91621717 6.25749403 -11 7 C-6.69230769 3.06153846 -6.69230769 3.06153846 -3.1875 2.75 C-2.465625 2.8325 -1.74375 2.915 -1 3 C-0.67 2.01 -0.34 1.02 0 0 Z " fill="#567FD1" transform="translate(762,474)"/>
+<path d="M0 0 C-1.95330868 1.03041513 -3.91281528 2.0490893 -5.875 3.0625 C-6.96554687 3.63097656 -8.05609375 4.19945312 -9.1796875 4.78515625 C-10.11039063 5.18605469 -11.04109375 5.58695312 -12 6 C-12.66 5.67 -13.32 5.34 -14 5 C-11.57563772 1.36345658 -10.08079664 1.19023235 -6 0 C-3.50907189 -1.24546405 -2.58919267 -0.7767578 0 0 Z " fill="#C6CBD2" transform="translate(701,474)"/>
+<path d="M0 0 C0.515625 0.268125 1.03125 0.53625 1.5625 0.8125 C3.56684829 1.78897737 5.62227249 2.65990745 7.6875 3.5 C11 5 11 5 12 7 C7.87161932 6.39288519 4.59577618 5.12477683 1 3 C0.67 2.01 0.34 1.02 0 0 Z " fill="#5F6C7F" transform="translate(417,457)"/>
+<path d="M0 0 C-1.95330868 1.03041513 -3.91281528 2.0490893 -5.875 3.0625 C-6.96554687 3.63097656 -8.05609375 4.19945312 -9.1796875 4.78515625 C-10.11039063 5.18605469 -11.04109375 5.58695312 -12 6 C-12.66 5.67 -13.32 5.34 -14 5 C-11.57563772 1.36345658 -10.08079664 1.19023235 -6 0 C-3.50907189 -1.24546405 -2.58919267 -0.7767578 0 0 Z " fill="#C6CBD2" transform="translate(763,443)"/>
+<path d="M0 0 C2.0625 0.4375 2.0625 0.4375 4 1 C2.04669132 2.03041513 0.08718472 3.0490893 -1.875 4.0625 C-2.96554687 4.63097656 -4.05609375 5.19945312 -5.1796875 5.78515625 C-6.11039063 6.18605469 -7.04109375 6.58695312 -8 7 C-8.66 6.67 -9.32 6.34 -10 6 C-7.41804126 2.12706189 -5.39076016 2.11764804 -1 1 C-0.67 0.67 -0.34 0.34 0 0 Z " fill="#C4C9D0" transform="translate(793,425)"/>
+<path d="M0 0 C-1.95330868 1.03041513 -3.91281528 2.0490893 -5.875 3.0625 C-6.96554687 3.63097656 -8.05609375 4.19945312 -9.1796875 4.78515625 C-10.11039063 5.18605469 -11.04109375 5.58695312 -12 6 C-12.66 5.67 -13.32 5.34 -14 5 C-11.57563772 1.36345658 -10.08079664 1.19023235 -6 0 C-3.50907189 -1.24546405 -2.58919267 -0.7767578 0 0 Z " fill="#C6CBD2" transform="translate(873,388)"/>
+<path d="M0 0 C0.33 0.66 0.66 1.32 1 2 C-0.98 2.33 -2.96 2.66 -5 3 C-5.33 3.99 -5.66 4.98 -6 6 C-7.98 6 -9.96 6 -12 6 C-8.0949151 2.44992282 -5.02265357 1.18180084 0 0 Z " fill="#505E73" transform="translate(884,383)"/>
+<path d="M0 0 C2.0625 0.4375 2.0625 0.4375 4 1 C2.04669132 2.03041513 0.08718472 3.0490893 -1.875 4.0625 C-2.96554687 4.63097656 -4.05609375 5.19945312 -5.1796875 5.78515625 C-6.11039063 6.18605469 -7.04109375 6.58695312 -8 7 C-8.66 6.67 -9.32 6.34 -10 6 C-7.41804126 2.12706189 -5.39076016 2.11764804 -1 1 C-0.67 0.67 -0.34 0.34 0 0 Z " fill="#C4C9D0" transform="translate(903,370)"/>
+<path d="M0 0 C6.51791392 -0.3540919 11.17521449 -0.03901852 17 3 C17 3.33 17 3.66 17 4 C9.125 3.125 9.125 3.125 8 2 C6.65252916 1.76924918 5.29622435 1.58846937 3.9375 1.4375 C2.638125 1.293125 1.33875 1.14875 0 1 C0 0.67 0 0.34 0 0 Z " fill="#4D71B7" transform="translate(519,363)"/>
+<path d="M0 0 C-1.95330868 1.03041513 -3.91281528 2.0490893 -5.875 3.0625 C-6.96554687 3.63097656 -8.05609375 4.19945312 -9.1796875 4.78515625 C-10.11039063 5.18605469 -11.04109375 5.58695312 -12 6 C-12.66 5.67 -13.32 5.34 -14 5 C-11.57563772 1.36345658 -10.08079664 1.19023235 -6 0 C-3.50907189 -1.24546405 -2.58919267 -0.7767578 0 0 Z " fill="#C6CBD1" transform="translate(983,333)"/>
+<path d="M0 0 C1.32 0 2.64 0 4 0 C4 0.99 4 1.98 4 3 C4.928125 3.1546875 4.928125 3.1546875 5.875 3.3125 C8 4 8 4 10 7 C8.68 7 7.36 7 6 7 C6 6.34 6 5.68 6 5 C4.68 4.34 3.36 3.68 2 3 C2 2.34 2 1.68 2 1 C1.34 0.67 0.68 0.34 0 0 Z " fill="#547CCB" transform="translate(431,325)"/>
+<path d="M0 0 C2.0625 0.4375 2.0625 0.4375 4 1 C2.04669132 2.03041513 0.08718472 3.0490893 -1.875 4.0625 C-2.96554687 4.63097656 -4.05609375 5.19945312 -5.1796875 5.78515625 C-6.11039063 6.18605469 -7.04109375 6.58695312 -8 7 C-8.66 6.67 -9.32 6.34 -10 6 C-7.41804126 2.12706189 -5.39076016 2.11764804 -1 1 C-0.67 0.67 -0.34 0.34 0 0 Z " fill="#C4C9D0" transform="translate(1013,315)"/>
+<path d="M0 0 C-1.95330868 1.03041513 -3.91281528 2.0490893 -5.875 3.0625 C-6.96554687 3.63097656 -8.05609375 4.19945312 -9.1796875 4.78515625 C-10.11039063 5.18605469 -11.04109375 5.58695312 -12 6 C-12.66 5.67 -13.32 5.34 -14 5 C-11.57563772 1.36345658 -10.08079664 1.19023235 -6 0 C-3.50907189 -1.24546405 -2.58919267 -0.7767578 0 0 Z " fill="#C6CBD1" transform="translate(1031,309)"/>
+<path d="M0 0 C0.33 0 0.66 0 1 0 C1 2.31 1 4.62 1 7 C0.01 7.33 -0.98 7.66 -2 8 C-2.73323796 10.01508358 -2.73323796 10.01508358 -3 12 C-3 9.36 -3 6.72 -3 4 C-2.01 4 -1.02 4 0 4 C0 2.68 0 1.36 0 0 Z " fill="#CFD3D9" transform="translate(791,293)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-6.261959 7.70387244 -6.261959 7.70387244 -11 8 C-10.67 7.34 -10.34 6.68 -10 6 C-9.01 6 -8.02 6 -7 6 C-7 5.01 -7 4.02 -7 3 C-4.69631264 1.93347808 -2.35981813 0.93578995 0 0 Z " fill="#CDD1D7" transform="translate(153,258)"/>
+<path d="M0 0 C1.4835001 0.42257276 2.96176424 0.86356322 4.4375 1.3125 C5.67306641 1.67794922 5.67306641 1.67794922 6.93359375 2.05078125 C7.61550781 2.36402344 8.29742188 2.67726562 9 3 C9.33 3.99 9.66 4.98 10 6 C10.66 6.33 11.32 6.66 12 7 C10.35 7 8.7 7 7 7 C7 6.01 7 5.02 7 4 C6.21625 3.896875 5.4325 3.79375 4.625 3.6875 C2 3 2 3 0 0 Z " fill="#5882D7" transform="translate(721,234)"/>
+<path d="M0 0 C1.46224799 0.42423244 2.91973412 0.86490245 4.375 1.3125 C5.18710937 1.55613281 5.99921875 1.79976562 6.8359375 2.05078125 C9 3 9 3 11 6 C6.48986609 5.46939601 3.61621781 3.69113883 0 1 C0 0.67 0 0.34 0 0 Z " fill="#44629B" transform="translate(718,231)"/>
+<path d="M0 0 C4.60272162 1.77027754 7.7129243 3.18699218 11 7 C7.08406554 6.21681311 3.63593365 4.60820142 0 3 C0 2.01 0 1.02 0 0 Z " fill="#59667A" transform="translate(730,210)"/>
+<path d="M0 0 C4.29 0 8.58 0 13 0 C9 3 9 3 5 3 C5 2.34 5 1.68 5 1 C3.35 1 1.7 1 0 1 C0 0.67 0 0.34 0 0 Z " fill="#DEE1E5" transform="translate(439,204)"/>
+<path d="M0 0 C0.515625 0.268125 1.03125 0.53625 1.5625 0.8125 C4.66401415 2.32349407 7.82262806 3.65572726 11 5 C11 5.66 11 6.32 11 7 C11.66 7.33 12.32 7.66 13 8 C10.06984666 7.3547078 7.51243525 6.4319105 4.8125 5.125 C4.11769531 4.79757813 3.42289062 4.47015625 2.70703125 4.1328125 C1 3 1 3 0 0 Z " fill="#5E6B7E" transform="translate(413,192)"/>
+<path d="M0 0 C1.46184058 0.22860058 2.91955419 0.48370392 4.375 0.75 C5.59316406 0.95882812 5.59316406 0.95882812 6.8359375 1.171875 C9 2 9 2 10.2890625 4.078125 C10.64097656 5.02945313 10.64097656 5.02945313 11 6 C9.53815942 5.77139942 8.08044581 5.51629608 6.625 5.25 C5.40683594 5.04117188 5.40683594 5.04117188 4.1640625 4.828125 C2 4 2 4 0.7109375 1.921875 C0.47632813 1.28765625 0.24171875 0.6534375 0 0 Z " fill="#B3B9C2" transform="translate(353,189)"/>
+<path d="M0 0 C1.98 0 3.96 0 6 0 C2.45960866 2.9156164 -1.1626772 5.50127818 -5 8 C-5.66 7.67 -6.32 7.34 -7 7 C-4.94766315 4.7522025 -3.99332739 3.9977758 -1 3 C-0.67 2.01 -0.34 1.02 0 0 Z " fill="#858F9E" transform="translate(399,122)"/>
+<path d="M0 0 C1.32 0 2.64 0 4 0 C4.66 0.99 5.32 1.98 6 3 C6.99 3.33 7.98 3.66 9 4 C8.67 4.99 8.34 5.98 8 7 C6.66144944 6.21718695 5.32926356 5.42348123 4 4.625 C3.2575 4.18414062 2.515 3.74328125 1.75 3.2890625 C1.1725 2.86367187 0.595 2.43828125 0 2 C0 1.34 0 0.68 0 0 Z " fill="#5F6D7F" transform="translate(714,101)"/>
+<path d="M0 0 C2.8203125 -0.29296875 2.8203125 -0.29296875 6.125 -0.1875 C7.76855469 -0.14689453 7.76855469 -0.14689453 9.4453125 -0.10546875 C10.28835938 -0.07066406 11.13140625 -0.03585938 12 0 C12 0.33 12 0.66 12 1 C9.03 1 6.06 1 3 1 C2.67 1.99 2.34 2.98 2 4 C0.68 3.67 -0.64 3.34 -2 3 C-1.34 2.01 -0.68 1.02 0 0 Z " fill="#556377" transform="translate(544,46)"/>
+<path d="M0 0 C1.32 0.33 2.64 0.66 4 1 C2.88671875 2.48828125 2.88671875 2.48828125 1 4 C-1.91796875 4.29296875 -1.91796875 4.29296875 -5.1875 4.1875 C-6.27417969 4.16042969 -7.36085938 4.13335938 -8.48046875 4.10546875 C-9.31191406 4.07066406 -10.14335938 4.03585937 -11 4 C-11 3.67 -11 3.34 -11 3 C-10.28972656 2.95101563 -9.57945312 2.90203125 -8.84765625 2.8515625 C-7.46900391 2.73941406 -7.46900391 2.73941406 -6.0625 2.625 C-5.14597656 2.55539062 -4.22945312 2.48578125 -3.28515625 2.4140625 C-2.15400391 2.20910156 -2.15400391 2.20910156 -1 2 C-0.67 1.34 -0.34 0.68 0 0 Z " fill="#5379C6" transform="translate(624,1171)"/>
+<path d="M0 0 C8.44646925 4.03872437 8.44646925 4.03872437 12 7 C9.03 6.505 9.03 6.505 6 6 C6 5.34 6 4.68 6 4 C4.02 4 2.04 4 0 4 C0 2.68 0 1.36 0 0 Z " fill="#5B697C" transform="translate(343,1076)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C1.01 2.485 1.01 2.485 0 4 C-3.125 4.1875 -3.125 4.1875 -6 4 C-6.33 4.99 -6.66 5.98 -7 7 C-7.99 6.67 -8.98 6.34 -10 6 C-7.46157564 2.89748134 -4.7659296 2.14615249 -1 1 C-0.67 0.67 -0.34 0.34 0 0 Z " fill="#364B6E" transform="translate(853,1052)"/>
+<path d="M0 0 C3.70270486 5.5540573 4.22186294 9.45504337 4 16 C3.67 16 3.34 16 3 16 C2.86722656 15.36191406 2.73445313 14.72382812 2.59765625 14.06640625 C2.42105469 13.24011719 2.24445313 12.41382813 2.0625 11.5625 C1.88847656 10.73878906 1.71445312 9.91507813 1.53515625 9.06640625 C1.19247006 7.02338796 1.19247006 7.02338796 0 6 C-0.04080783 4.00041636 -0.04254356 1.99954746 0 0 Z " fill="#6D788C" transform="translate(430,936)"/>
+<path d="M0 0 C1.485 0.99 1.485 0.99 3 2 C4.98799818 2.70164642 6.98698517 3.37372872 9 4 C9 4.66 9 5.32 9 6 C9.66 6.33 10.32 6.66 11 7 C9.35 7 7.7 7 6 7 C6 6.01 6 5.02 6 4 C4.35 3.67 2.7 3.34 1 3 C0.67 2.01 0.34 1.02 0 0 Z " fill="#7DA7FD" transform="translate(801,939)"/>
+<path d="M0 0 C2.4375 0.375 2.4375 0.375 5 1 C5.33 1.66 5.66 2.32 6 3 C6.99 3.33 7.98 3.66 9 4 C12 5 12 5 13 7 C7.51459532 5.78102118 3.81658475 4.24064972 0 0 Z " fill="#A9C5FD" transform="translate(820,933)"/>
+<path d="M0 0 C5.2688172 7.90322581 5.2688172 7.90322581 4.6875 12.4375 C4.460625 12.953125 4.23375 13.46875 4 14 C0.68557793 9.53273547 0.33990833 5.37992836 0 0 Z " fill="#CBCFD6" transform="translate(343,890)"/>
+<path d="M0 0 C0.99 0.33 1.98 0.66 3 1 C3.73046875 3.06640625 3.73046875 3.06640625 4.1875 5.5625 C4.34605469 6.38878906 4.50460937 7.21507812 4.66796875 8.06640625 C4.77753906 8.70449219 4.88710938 9.34257813 5 10 C4.01 9.67 3.02 9.34 2 9 C1.26953125 6.93359375 1.26953125 6.93359375 0.8125 4.4375 C0.65394531 3.61121094 0.49539063 2.78492188 0.33203125 1.93359375 C0.16767578 0.97646484 0.16767578 0.97646484 0 0 Z " fill="#536077" transform="translate(399,872)"/>
+<path d="M0 0 C0 0.99 0 1.98 0 3 C-2.25 5.25 -2.25 5.25 -5 7 C-7.3125 6.75 -7.3125 6.75 -9 6 C-6.45543849 3.03134491 -3.51005335 1.6380249 0 0 Z " fill="#77A3FD" transform="translate(692,836)"/>
+<path d="M0 0 C5.36716665 -0.83861979 8.79627239 2.07929595 13 5 C7.84482685 5 3.91055355 3.30892993 0 0 Z " fill="#8EB2FD" transform="translate(786,825)"/>
+<path d="M0 0 C1.921875 0.7109375 1.921875 0.7109375 4 2 C4.828125 4.1640625 4.828125 4.1640625 5.25 6.625 C5.39953125 7.44226563 5.5490625 8.25953125 5.703125 9.1015625 C5.80109375 9.72804688 5.8990625 10.35453125 6 11 C2.6433715 8.76224766 2.42003986 8.06679952 1.3125 4.375 C1.06113281 3.55773437 0.80976563 2.74046875 0.55078125 1.8984375 C0.36902344 1.27195312 0.18726563 0.64546875 0 0 Z " fill="#CDD0D7" transform="translate(369,804)"/>
+<path d="M0 0 C3.32532111 2.69192661 4.52454943 6.06546515 6 10 C6 10.99 6 11.98 6 13 C3.01947605 10.44526518 1.53659812 7.58539561 0 4 C0 2.68 0 1.36 0 0 Z " fill="#7E8899" transform="translate(368,804)"/>
+<path d="M0 0 C3.23664501 1.83409884 3.96849677 2.91179094 5.25 6.5 C6 10 6 10 6 13 C5.01 12.34 4.02 11.68 3 11 C2.61250787 8.67504723 2.28241883 6.3400417 2 4 C1.04415562 1.66411677 1.04415562 1.66411677 0 0 Z " fill="#6B768A" transform="translate(330,726)"/>
+<path d="M0 0 C1.65 0 3.3 0 5 0 C5.66 1.32 6.32 2.64 7 4 C7.66 4 8.32 4 9 4 C8.67 4.66 8.34 5.32 8 6 C5.525 5.01 5.525 5.01 3 4 C3 3.01 3 2.02 3 1 C2.01 0.67 1.02 0.34 0 0 Z " fill="#B3CBFD" transform="translate(754,683)"/>
+<path d="M0 0 C3.34373475 0.55728913 6.03312999 1.35173889 9 3 C9 3.99 9 4.98 9 6 C8.34 6 7.68 6 7 6 C7 5.34 7 4.68 7 4 C6.030625 3.71125 5.06125 3.4225 4.0625 3.125 C1 2 1 2 0 0 Z " fill="#96B8FD" transform="translate(766,680)"/>
+<path d="M0 0 C0 0.99 0 1.98 0 3 C-0.99 3 -1.98 3 -3 3 C-3.33 3.99 -3.66 4.98 -4 6 C-5.65 6.33 -7.3 6.66 -9 7 C-9 7.66 -9 8.32 -9 9 C-9.66 8.67 -10.32 8.34 -11 8 C-8.80861021 5.64270057 -6.56068027 3.97942902 -3.8125 2.3125 C-3.09707031 1.87550781 -2.38164062 1.43851563 -1.64453125 0.98828125 C-1.10183594 0.66214844 -0.55914062 0.33601562 0 0 Z " fill="#43506A" transform="translate(245,675)"/>
+<path d="M0 0 C2.1875 0.3125 2.1875 0.3125 4 1 C1.31158141 3.25245881 -0.64641875 4.88213958 -4 6 C-4.33 6.66 -4.66 7.32 -5 8 C-5.66 7.67 -6.32 7.34 -7 7 C-5.66666667 5.66666667 -4.33333333 4.33333333 -3 3 C-2.505 2.401875 -2.01 1.80375 -1.5 1.1875 C-1.005 0.795625 -0.51 0.40375 0 0 Z " fill="#CACED5" transform="translate(257,661)"/>
+<path d="M0 0 C1.32 0.33 2.64 0.66 4 1 C2.8125 3 2.8125 3 1 5 C-1.6875 5.25 -1.6875 5.25 -4 5 C-3.67 4.34 -3.34 3.68 -3 3 C-2.34 3 -1.68 3 -1 3 C-0.67 2.01 -0.34 1.02 0 0 Z " fill="#535F77" transform="translate(277,649)"/>
+<path d="M0 0 C2.4375 0.375 2.4375 0.375 5 1 C5.33 1.66 5.66 2.32 6 3 C6.825 3.495 7.65 3.99 8.5 4.5 C11 6 11 6 12 8 C1.47368421 2.94736842 1.47368421 2.94736842 0 0 Z " fill="#AAC6FD" transform="translate(682,641)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-2.455 4.465 -2.455 4.465 -7 8 C-7.33 7.34 -7.66 6.68 -8 6 C-7 4 -7 4 -4 3 C-3.67 2.34 -3.34 1.68 -3 1 C-2.01 0.67 -1.02 0.34 0 0 Z " fill="#CED2D8" transform="translate(306,626)"/>
+<path d="M0 0 C0.99 0.33 1.98 0.66 3 1 C0.19840003 5.20239996 -3.21553735 5.93678608 -8 7 C-3.04087193 1.86376022 -3.04087193 1.86376022 0 0 Z " fill="#77A3FD" transform="translate(822,547)"/>
+<path d="M0 0 C1.48199902 0.44909061 2.96055236 0.90956564 4.4375 1.375 C5.26121094 1.63023437 6.08492188 1.88546875 6.93359375 2.1484375 C9 3 9 3 10 5 C10.99 5.66 11.98 6.32 13 7 C7.92990529 6.52467862 4.02506742 3.95637706 0 1 C0 0.67 0 0.34 0 0 Z " fill="#B3B9C2" transform="translate(459,477)"/>
+<path d="M0 0 C6.52307692 0.49230769 6.52307692 0.49230769 8.9375 3.0625 C9.288125 3.701875 9.63875 4.34125 10 5 C6.05140217 4.4359146 3.29120954 3.2568294 0 1 C0 0.67 0 0.34 0 0 Z " fill="#768192" transform="translate(749,389)"/>
+<path d="M0 0 C1.27875 0.2475 2.5575 0.495 3.875 0.75 C4.95394531 0.95882813 4.95394531 0.95882813 6.0546875 1.171875 C8 2 8 2 10 6 C5.545 5.01 5.545 5.01 1 4 C0.67 2.68 0.34 1.36 0 0 Z " fill="#707C8D" transform="translate(230,361)"/>
+<path d="M0 0 C2.64 0 5.28 0 8 0 C8 0.33 8 0.66 8 1 C7.05125 1.309375 6.1025 1.61875 5.125 1.9375 C2.13919592 2.87394742 2.13919592 2.87394742 0 4 C-2.3329866 4.04022391 -4.66706666 4.04320247 -7 4 C-7 3.67 -7 3.34 -7 3 C-5.02 3 -3.04 3 -1 3 C-0.67 2.01 -0.34 1.02 0 0 Z " fill="#557ECF" transform="translate(696,349)"/>
+<path d="M0 0 C1.32 0.33 2.64 0.66 4 1 C1.93243723 3.7972908 0.85559629 4.02692273 -2.6875 4.6875 C-3.780625 4.790625 -4.87375 4.89375 -6 5 C-6 5.66 -6 6.32 -6 7 C-6.66 6.67 -7.32 6.34 -8 6 C-6.49736177 2.99472353 -4.08347159 3.02782386 -1 2 C-0.67 1.34 -0.34 0.68 0 0 Z " fill="#557ECF" transform="translate(712,342)"/>
+<path d="M0 0 C4.31392226 0.4793247 6.16569547 1.7457985 9 5 C5.93606987 5.25532751 4.36766788 5.21861333 1.6875 3.625 C1.130625 3.08875 0.57375 2.5525 0 2 C0 1.34 0 0.68 0 0 Z " fill="#3D5785" transform="translate(437,332)"/>
+<path d="M0 0 C0.33 0 0.66 0 1 0 C1.44041451 5.28497409 1.44041451 5.28497409 1 8 C-1.5 10.5 -1.5 10.5 -4 12 C-4.66 11.67 -5.32 11.34 -6 11 C-5.195625 10.113125 -4.39125 9.22625 -3.5625 8.3125 C-1.2960841 5.61712968 -0.31582634 3.57936522 0 0 Z " fill="#C4C9D0" transform="translate(1051,289)"/>
+<path d="M0 0 C1.485 0.99 1.485 0.99 3 2 C4.155 2.309375 5.31 2.61875 6.5 2.9375 C9.72756225 3.91729568 10.99732631 4.40830463 13 7 C11.35 7 9.7 7 8 7 C8 6.01 8 5.02 8 4 C6.02 4 4.04 4 2 4 C1.34 2.68 0.68 1.36 0 0 Z " fill="#5984DA" transform="translate(708,227)"/>
+<path d="M0 0 C2.475 0.495 2.475 0.495 5 1 C5 1.66 5 2.32 5 3 C6.65 3.33 8.3 3.66 10 4 C10 4.99 10 5.98 10 7 C9.34 7 8.68 7 8 7 C8 6.34 8 5.68 8 5 C6.8553125 4.5978125 6.8553125 4.5978125 5.6875 4.1875 C3.12619116 3.05575888 1.80307062 2.08776599 0 0 Z " fill="#637083" transform="translate(879,191)"/>
+<path d="M0 0 C0 0.99 0 1.98 0 3 C-2.75 5.25 -2.75 5.25 -6 7 C-8.375 6.75 -8.375 6.75 -10 6 C-9.01 5.67 -8.02 5.34 -7 5 C-6.67 4.01 -6.34 3.02 -6 2 C-2.9375 0.8125 -2.9375 0.8125 0 0 Z " fill="#354A6C" transform="translate(685,1142)"/>
+<path d="M0 0 C3.8063457 0.67170806 7.35206816 1.72746564 11 3 C10.67 3.66 10.34 4.32 10 5 C3.47692308 4.50769231 3.47692308 4.50769231 1.0625 1.9375 C0.711875 1.298125 0.36125 0.65875 0 0 Z " fill="#D6DADF" transform="translate(98,940)"/>
+<path d="M0 0 C0.99 0.33 1.98 0.66 3 1 C3.94921875 3.50390625 3.94921875 3.50390625 4.6875 6.5625 C4.93886719 7.57441406 5.19023437 8.58632813 5.44921875 9.62890625 C5.63097656 10.41136719 5.81273437 11.19382812 6 12 C5.01 11.67 4.02 11.34 3 11 C1.875 7.6875 1.875 7.6875 1 4 C0.79375 3.195625 0.5875 2.39125 0.375 1.5625 C0.25125 1.046875 0.1275 0.53125 0 0 Z " fill="#A2A9B6" transform="translate(410,891)"/>
+<path d="M0 0 C0.33 0 0.66 0 1 0 C0.125 6.875 0.125 6.875 -1 8 C-1.36760731 10.32817964 -1.70241581 12.6618385 -2 15 C-2.33 15 -2.66 15 -3 15 C-3.3152595 9.01006953 -2.68219822 5.36439644 0 0 Z " fill="#446199" transform="translate(1117,861)"/>
+<path d="M0 0 C1.32 0.33 2.64 0.66 4 1 C4.12375 2.0725 4.2475 3.145 4.375 4.25 C4.89643936 7.37863615 5.40088254 9.33480424 7 12 C3.0521638 9.63129828 2.18399317 7.37166708 1 3 C0.67 2.01 0.34 1.02 0 0 Z " fill="#A5ACB8" transform="translate(389,848)"/>
+<path d="M0 0 C1.32 0.33 2.64 0.66 4 1 C3.01 1 2.02 1 1 1 C0.67 1.99 0.34 2.98 0 4 C-2.4375 5.75 -2.4375 5.75 -5 7 C-5.66 6.67 -6.32 6.34 -7 6 C-6.67 5.01 -6.34 4.02 -6 3 C-4.02 2.67 -2.04 2.34 0 2 C0 1.34 0 0.68 0 0 Z " fill="#88AEFD" transform="translate(876,837)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C1.67 1.99 1.34 2.98 1 4 C-0.84765625 4.73046875 -0.84765625 4.73046875 -3.0625 5.1875 C-3.79597656 5.34605469 -4.52945313 5.50460937 -5.28515625 5.66796875 C-6.13400391 5.83232422 -6.13400391 5.83232422 -7 6 C-6.67 5.01 -6.34 4.02 -6 3 C-3.5 1.875 -3.5 1.875 -1 1 C-0.67 0.67 -0.34 0.34 0 0 Z " fill="#D3E1FE" transform="translate(942,680)"/>
+<path d="M0 0 C1.48484412 0.39595843 2.9628831 0.81750706 4.4375 1.25 C5.26121094 1.48203125 6.08492187 1.7140625 6.93359375 1.953125 C9 3 9 3 9.78515625 5.109375 C9.85605469 5.73328125 9.92695312 6.3571875 10 7 C1.43902439 2.87804878 1.43902439 2.87804878 0 0 Z " fill="#C7DAFE" transform="translate(920,659)"/>
+<path d="M0 0 C2.8125 -0.3125 2.8125 -0.3125 6 0 C7.875 2.5 7.875 2.5 9 5 C7.35 4.67 5.7 4.34 4 4 C3.67 3.01 3.34 2.02 3 1 C2.01 0.67 1.02 0.34 0 0 Z " fill="#9BBBFD" transform="translate(686,634)"/>
+<path d="M0 0 C1.29640378 0.59393382 2.58698839 1.20057989 3.875 1.8125 C4.59429688 2.14894531 5.31359375 2.48539063 6.0546875 2.83203125 C8 4 8 4 10 7 C8.35 6.67 6.7 6.34 5 6 C5 5.34 5 4.68 5 4 C2.525 3.01 2.525 3.01 0 2 C0 1.34 0 0.68 0 0 Z " fill="#BCD2FE" transform="translate(866,519)"/>
+<path d="M0 0 C1.98 0 3.96 0 6 0 C1.84015388 3.89985574 -1.55084591 4.89169747 -7 6 C-6.67 5.01 -6.34 4.02 -6 3 C-4.02 3 -2.04 3 0 3 C0 2.01 0 1.02 0 0 Z " fill="#39517A" transform="translate(705,500)"/>
+<path d="M0 0 C1.32 0.33 2.64 0.66 4 1 C0.24532309 4.05936637 -3.08113061 6 -8 6 C-5.77644774 3.4429149 -4.24981807 2.75829088 -1 2 C-0.67 1.34 -0.34 0.68 0 0 Z " fill="#CCD0D6" transform="translate(771,435)"/>
+<path d="M0 0 C4.95 0 9.9 0 15 0 C15.33 0.99 15.66 1.98 16 3 C10.72 2.34 5.44 1.68 0 1 C0 0.67 0 0.34 0 0 Z " fill="#415067" transform="translate(510,386)"/>
+<path d="M0 0 C6.52307692 0.49230769 6.52307692 0.49230769 8.9375 3.0625 C9.288125 3.701875 9.63875 4.34125 10 5 C5.59885603 4.49701212 3.28804981 2.91227269 0 0 Z " fill="#B0B7C0" transform="translate(792,383)"/>
+<path d="M0 0 C6.52307692 1.47692308 6.52307692 1.47692308 8.9375 4.125 C9.288125 4.74375 9.63875 5.3625 10 6 C8.5164999 5.57742724 7.03823576 5.13643678 5.5625 4.6875 C4.73878906 4.44386719 3.91507813 4.20023437 3.06640625 3.94921875 C2.04353516 3.47935547 2.04353516 3.47935547 1 3 C0.67 2.01 0.34 1.02 0 0 Z " fill="#CED3D8" transform="translate(719,375)"/>
+<path d="M0 0 C2.25 -0.3125 2.25 -0.3125 5 0 C7.3125 2.5 7.3125 2.5 9 5 C4.68607774 4.5206753 2.83430453 3.2542015 0 0 Z " fill="#CDD2D7" transform="translate(767,369)"/>
+<path d="M0 0 C2.9375 0.8125 2.9375 0.8125 6 2 C6.33 2.99 6.66 3.98 7 5 C9.00016466 6.20882096 9.00016466 6.20882096 11 7 C7.41584854 7 6.58796261 6.21108216 3.8125 4.0625 C3.09707031 3.51722656 2.38164062 2.97195313 1.64453125 2.41015625 C1.10183594 1.94480469 0.55914062 1.47945313 0 1 C0 0.67 0 0.34 0 0 Z " fill="#AAB1BB" transform="translate(424,352)"/>
+<path d="M0 0 C1.32 0.33 2.64 0.66 4 1 C0.24532309 4.05936637 -3.08113061 6 -8 6 C-5.77644774 3.4429149 -4.24981807 2.75829088 -1 2 C-0.67 1.34 -0.34 0.68 0 0 Z " fill="#CBD0D6" transform="translate(943,349)"/>
+<path d="M0 0 C2.475 0.495 2.475 0.495 5 1 C5 1.66 5 2.32 5 3 C7.475 3.99 7.475 3.99 10 5 C9.67 5.66 9.34 6.32 9 7 C7.02 6.01 5.04 5.02 3 4 C3 3.34 3 2.68 3 2 C2.01 1.67 1.02 1.34 0 1 C0 0.67 0 0.34 0 0 Z " fill="#4F5D72" transform="translate(421,348)"/>
+<path d="M0 0 C1.32 0.33 2.64 0.66 4 1 C0.24532309 4.05936637 -3.08113061 6 -8 6 C-5.77644774 3.4429149 -4.24981807 2.75829088 -1 2 C-0.67 1.34 -0.34 0.68 0 0 Z " fill="#CCD0D6" transform="translate(991,325)"/>
+<path d="M0 0 C1.32 0 2.64 0 4 0 C3.4375 1.875 3.4375 1.875 2 4 C-1.625 5.25 -1.625 5.25 -5 6 C-4.67 5.01 -4.34 4.02 -4 3 C-3.01 2.67 -2.02 2.34 -1 2 C-0.67 1.34 -0.34 0.68 0 0 Z " fill="#3B547F" transform="translate(448,232)"/>
+<path d="M0 0 C0.33 0 0.66 0 1 0 C1.35233161 5.37305699 1.35233161 5.37305699 1 8 C-1 10 -1 10 -3 11 C-2.32829194 7.1936543 -1.27253436 3.64793184 0 0 Z " fill="#697587" transform="translate(561,1147)"/>
+<path d="M0 0 C1.32 0.33 2.64 0.66 4 1 C0.98112756 4.48331435 -1.56909529 5.79157144 -6 7 C-5.34 6.01 -4.68 5.02 -4 4 C-3.01 4 -2.02 4 -1 4 C-0.67 2.68 -0.34 1.36 0 0 Z " fill="#4B6DAF" transform="translate(695,1133)"/>
+<path d="M0 0 C6.75 2.625 6.75 2.625 9 6 C8.01 6 7.02 6 6 6 C6 5.34 6 4.68 6 4 C4.35 4 2.7 4 1 4 C0.67 2.68 0.34 1.36 0 0 Z " fill="#5F6C7F" transform="translate(214,1004)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-0.13478166 4.20217249 -1.62795029 5.27285259 -5 7 C-5.99 7 -6.98 7 -8 7 C-7.67 6.01 -7.34 5.02 -7 4 C-5.01276732 3.29618843 -3.01222047 2.6288189 -1 2 C-0.67 1.34 -0.34 0.68 0 0 Z " fill="#44629A" transform="translate(1039,948)"/>
+<path d="M0 0 C1.65 0 3.3 0 5 0 C5 0.66 5 1.32 5 2 C6.98 2.66 8.96 3.32 11 4 C10.67 4.66 10.34 5.32 10 6 C7.69 5.01 5.38 4.02 3 3 C3 2.34 3 1.68 3 1 C2.01 0.67 1.02 0.34 0 0 Z " fill="#8AB0FD" transform="translate(833,940)"/>
+<path d="M0 0 C2.33524782 2.25740623 4.18705073 4.2805761 6 7 C5.625 9.1875 5.625 9.1875 5 11 C4.16151196 9.54462432 3.32936066 8.08559627 2.5 6.625 C1.80390625 5.40683594 1.80390625 5.40683594 1.09375 4.1640625 C0 2 0 2 0 0 Z " fill="#AFB5C0" transform="translate(355,919)"/>
+<path d="M0 0 C1.98 0.99 1.98 0.99 4 2 C4 2.66 4 3.32 4 4 C4.639375 4.12375 5.27875 4.2475 5.9375 4.375 C6.618125 4.58125 7.29875 4.7875 8 5 C8.33 5.66 8.66 6.32 9 7 C5.59687262 5.94124926 2.98646769 4.99097846 0 3 C0 2.01 0 1.02 0 0 Z " fill="#8EB3FD" transform="translate(694,876)"/>
+<path d="M0 0 C4.455 1.98 4.455 1.98 9 4 C9 4.66 9 5.32 9 6 C9.66 6.33 10.32 6.66 11 7 C6.80639551 6.32902328 3.59665648 4.1441606 0 2 C0 1.34 0 0.68 0 0 Z " fill="#7BA6FD" transform="translate(807,836)"/>
+<path d="M0 0 C2.375 -0.1875 2.375 -0.1875 5 0 C5.66 0.99 6.32 1.98 7 3 C4.36 3 1.72 3 -1 3 C-0.67 2.01 -0.34 1.02 0 0 Z " fill="#D0DFFE" transform="translate(957,800)"/>
+<path d="M0 0 C-0.99 0.495 -0.99 0.495 -2 1 C-2.65772428 4.02934491 -2.65772428 4.02934491 -3 7 C-4.5 5.75 -4.5 5.75 -6 4 C-6 2.68 -6 1.36 -6 0 C-3 -1 -3 -1 0 0 Z " fill="#535F77" transform="translate(329,710)"/>
+<path d="M0 0 C2.38564077 0.57584432 4.66682784 1.22227595 7 2 C7.6875 4.0625 7.6875 4.0625 8 6 C7.34 6 6.68 6 6 6 C6 5.34 6 4.68 6 4 C4.35 3.67 2.7 3.34 1 3 C0.67 2.01 0.34 1.02 0 0 Z " fill="#CFDFFE" transform="translate(795,698)"/>
+<path d="M0 0 C0 0.99 0 1.98 0 3 C-0.639375 3.103125 -1.27875 3.20625 -1.9375 3.3125 C-2.618125 3.539375 -3.29875 3.76625 -4 4 C-4.33 4.99 -4.66 5.98 -5 7 C-5.99 6.67 -6.98 6.34 -8 6 C-2.25 1.125 -2.25 1.125 0 0 Z " fill="#44526B" transform="translate(306,630)"/>
+<path d="M0 0 C-0.33 1.32 -0.66 2.64 -1 4 C-3.97 4.66 -6.94 5.32 -10 6 C-4 0 -4 0 0 0 Z " fill="#CEDEFE" transform="translate(698,605)"/>
+<path d="M0 0 C1.31602523 0.61754259 2.62773556 1.24428742 3.9375 1.875 C4.66839844 2.22304688 5.39929688 2.57109375 6.15234375 2.9296875 C8 4 8 4 9 6 C7.68 6 6.36 6 5 6 C5 5.34 5 4.68 5 4 C3.35 3.67 1.7 3.34 0 3 C0 2.01 0 1.02 0 0 Z " fill="#8AB0FD" transform="translate(966,595)"/>
+<path d="M0 0 C-0.99 0 -1.98 0 -3 0 C-3.33 0.99 -3.66 1.98 -4 3 C-7.5625 4.1875 -7.5625 4.1875 -11 5 C-10 2 -10 2 -7.1875 0.25 C-4.03596914 -0.98589446 -3.03070628 -1.28222189 0 0 Z " fill="#8FB3FD" transform="translate(746,577)"/>
+<path d="M0 0 C3.375 0.3125 3.375 0.3125 7 1 C7.66 1.99 8.32 2.98 9 4 C9.99 4.66 10.98 5.32 12 6 C7.24518354 5.42365861 4.02951788 3.44931479 0 1 C0 0.67 0 0.34 0 0 Z " fill="#C8CCD3" transform="translate(447,471)"/>
+<path d="M0 0 C4.31392226 0.4793247 6.16569547 1.7457985 9 5 C3.46153846 4.50769231 3.46153846 4.50769231 1.125 1.9375 C0.75375 1.298125 0.3825 0.65875 0 0 Z " fill="#B8BDC6" transform="translate(336,414)"/>
+<path d="M0 0 C7.38461538 -0.49230769 7.38461538 -0.49230769 10.5 2 C10.995 2.66 11.49 3.32 12 4 C7.80530429 3.40075776 3.99000166 2.42500059 0 1 C0 0.67 0 0.34 0 0 Z " fill="#828C9B" transform="translate(483,380)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C1.01 2.485 1.01 2.485 0 4 C-2.3828125 4.29296875 -2.3828125 4.29296875 -5.125 4.1875 C-6.03507813 4.16042969 -6.94515625 4.13335937 -7.8828125 4.10546875 C-8.58148437 4.07066406 -9.28015625 4.03585937 -10 4 C-10 3.67 -10 3.34 -10 3 C-7.69 3 -5.38 3 -3 3 C-3 2.34 -3 1.68 -3 1 C-2.01 0.67 -1.02 0.34 0 0 Z " fill="#385077" transform="translate(652,364)"/>
+<path d="M0 0 C4.3890815 0.51035831 7.33708062 1.52214277 11 4 C9 5 9 5 6.0625 4.25 C3.25169164 3.10273128 1.8842594 2.30298372 0 0 Z " fill="#8A93A1" transform="translate(200,346)"/>
+<path d="M0 0 C0.33 0.99 0.66 1.98 1 3 C-0.98 3.33 -2.96 3.66 -5 4 C-5.33 4.99 -5.66 5.98 -6 7 C-6.99 6.67 -7.98 6.34 -9 6 C-6.45543849 3.03134491 -3.51005335 1.6380249 0 0 Z " fill="#425168" transform="translate(1029,310)"/>
+<path d="M0 0 C1.32 0.33 2.64 0.66 4 1 C3.01 1 2.02 1 1 1 C1 1.99 1 2.98 1 4 C-3.22222222 7 -3.22222222 7 -6 7 C-6 6.01 -6 5.02 -6 4 C-4.7934375 3.566875 -4.7934375 3.566875 -3.5625 3.125 C-0.8673532 2.26737432 -0.8673532 2.26737432 0 0 Z " fill="#919AA8" transform="translate(145,260)"/>
+<path d="M0 0 C0.68359375 1.765625 0.68359375 1.765625 1 4 C-0.21484375 5.921875 -0.21484375 5.921875 -1.9375 7.75 C-2.50339844 8.36359375 -3.06929688 8.9771875 -3.65234375 9.609375 C-4.31943359 10.29773438 -4.31943359 10.29773438 -5 11 C-5 7.58678765 -4.33132534 6.60527115 -2.5 3.8125 C-2.0359375 3.09707031 -1.571875 2.38164062 -1.09375 1.64453125 C-0.7328125 1.10183594 -0.371875 0.55914062 0 0 Z " fill="#4D5B70" transform="translate(396,252)"/>
+<path d="M0 0 C4.50802601 1.25805377 7.4912812 2.90407165 11 6 C9.35 6 7.7 6 6 6 C5.67 5.01 5.34 4.02 5 3 C3.35 2.67 1.7 2.34 0 2 C0 1.34 0 0.68 0 0 Z " fill="#D5D9DD" transform="translate(911,211)"/>
+<path d="M0 0 C3.3 0 6.6 0 10 0 C10.33 1.32 10.66 2.64 11 4 C9.68 3.67 8.36 3.34 7 3 C7 2.34 7 1.68 7 1 C4.69 1 2.38 1 0 1 C0 0.67 0 0.34 0 0 Z " fill="#364B6D" transform="translate(677,214)"/>
+<path d="M0 0 C1.48253267 0.61697319 2.96095174 1.24383896 4.4375 1.875 C5.67306641 2.39707031 5.67306641 2.39707031 6.93359375 2.9296875 C9 4 9 4 10 6 C5.545 5.01 5.545 5.01 1 4 C0.67 2.68 0.34 1.36 0 0 Z " fill="#546176" transform="translate(355,162)"/>
+<path d="M0 0 C1.31602523 0.61754259 2.62773556 1.24428742 3.9375 1.875 C4.66839844 2.22304687 5.39929688 2.57109375 6.15234375 2.9296875 C8 4 8 4 9 6 C4.545 5.01 4.545 5.01 0 4 C0 2.68 0 1.36 0 0 Z " fill="#5A687B" transform="translate(282,1042)"/>
+<path d="M0 0 C1.32 0.33 2.64 0.66 4 1 C1.36 2.98 -1.28 4.96 -4 7 C-4.66 6.67 -5.32 6.34 -6 6 C-5.195625 5.38125 -4.39125 4.7625 -3.5625 4.125 C-0.96125481 2.25835959 -0.96125481 2.25835959 0 0 Z " fill="#7C8597" transform="translate(241,765)"/>
+<path d="M0 0 C0 0.99 0 1.98 0 3 C-2.31 3.33 -4.62 3.66 -7 4 C-7 4.66 -7 5.32 -7 6 C-7.66 5.67 -8.32 5.34 -9 5 C-7.36885863 1.73771726 -3.62038485 0 0 0 Z " fill="#9ABAFD" transform="translate(912,708)"/>
+<path d="M0 0 C-3.87564767 3.61139896 -3.87564767 3.61139896 -6 5 C-8.375 4.8125 -8.375 4.8125 -10 4 C-7.39928297 0.98864344 -3.94054294 -1.97027147 0 0 Z " fill="#BBD1FE" transform="translate(971,665)"/>
+<path d="M0 0 C4.455 1.98 4.455 1.98 9 4 C9 4.66 9 5.32 9 6 C9.66 6.33 10.32 6.66 11 7 C6.80639551 6.32902328 3.59665648 4.1441606 0 2 C0 1.34 0 0.68 0 0 Z " fill="#79A4FD" transform="translate(690,647)"/>
+<path d="M0 0 C3.68754757 0.49831724 5.60490662 1.10067643 8 4 C7.67 4.66 7.34 5.32 7 6 C1.125 2.25 1.125 2.25 0 0 Z " fill="#8AB0FD" transform="translate(1044,624)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C0.6875 2.5 0.6875 2.5 -1 4 C-1.99 4 -2.98 4 -4 4 C-4.33 4.99 -4.66 5.98 -5 7 C-6.32 6.67 -7.64 6.34 -9 6 C-6.03 4.02 -3.06 2.04 0 0 Z " fill="#82AAFD" transform="translate(724,605)"/>
+<path d="M0 0 C0.99 0.33 1.98 0.66 3 1 C-0.465 3.97 -0.465 3.97 -4 7 C-4.66 6.67 -5.32 6.34 -6 6 C-4.02 4.02 -2.04 2.04 0 0 Z " fill="#6191F0" transform="translate(616,554)"/>
+<path d="M0 0 C6.75 0.75 6.75 0.75 9 3 C6.36 3 3.72 3 1 3 C0.67 2.01 0.34 1.02 0 0 Z " fill="#59667A" transform="translate(545,520)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-0.77079887 4.80984844 -4.62868145 5.06840752 -9 6 C-9 5.01 -9 4.02 -9 3 C-7.88625 2.87625 -6.7725 2.7525 -5.625 2.625 C-1.96896323 2.3534187 -1.96896323 2.3534187 0 0 Z " fill="#C4C8CF" transform="translate(621,511)"/>
+<path d="M0 0 C0.7734375 0.433125 0.7734375 0.433125 1.5625 0.875 C4.146337 2.14974074 4.146337 2.14974074 7.6875 3 C8.780625 3.33 9.87375 3.66 11 4 C11.33 4.66 11.66 5.32 12 6 C10.37181054 5.77169299 8.7473651 5.51656424 7.125 5.25 C6.22007812 5.11078125 5.31515625 4.9715625 4.3828125 4.828125 C2 4 2 4 0.6796875 1.921875 C0.45539063 1.28765625 0.23109375 0.6534375 0 0 Z " fill="#5D6A7E" transform="translate(443,471)"/>
+<path d="M0 0 C-3.08035356 3.08035356 -6.81125605 4.06916801 -11 5 C-10 2 -10 2 -8.22265625 1.015625 C-7.15337891 0.63664062 -7.15337891 0.63664062 -6.0625 0.25 C-5.35222656 -0.01296875 -4.64195312 -0.2759375 -3.91015625 -0.546875 C-2 -1 -2 -1 0 0 Z " fill="#4E71B7" transform="translate(922,396)"/>
+<path d="M0 0 C1.32 0.33 2.64 0.66 4 1 C0.63576723 3.96052484 -2.69159287 4.92289822 -7 6 C-7 5.34 -7 4.68 -7 4 C-6.030625 3.71125 -5.06125 3.4225 -4.0625 3.125 C-0.89335797 2.35785318 -0.89335797 2.35785318 0 0 Z " fill="#A2A9B5" transform="translate(855,394)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C1.01 2.485 1.01 2.485 0 4 C-1.9453125 4.29296875 -1.9453125 4.29296875 -4.125 4.1875 C-5.40375 4.125625 -6.6825 4.06375 -8 4 C-5.31143836 2.20762558 -3.0466145 1.01553817 0 0 Z " fill="#DFE2E6" transform="translate(707,375)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C0.73760288 1.86658615 -0.53527501 2.71792059 -1.8125 3.5625 C-2.87404297 4.27599609 -2.87404297 4.27599609 -3.95703125 5.00390625 C-6 6 -6 6 -9 5 C-8 3 -8 3 -5.0625 1.9375 C-3.5465625 1.4734375 -3.5465625 1.4734375 -2 1 C-1.34 0.67 -0.68 0.34 0 0 Z " fill="#3F5B8D" transform="translate(1050,329)"/>
+<path d="M0 0 C1.98 0 3.96 0 6 0 C6.103125 0.639375 6.20625 1.27875 6.3125 1.9375 C6.539375 2.618125 6.76625 3.29875 7 4 C7.99 4.33 8.98 4.66 10 5 C5.59885603 4.49701212 3.28804981 2.91227269 0 0 Z " fill="#6E7A8B" transform="translate(1015,266)"/>
+<path d="M0 0 C1.33333333 0.66666667 2.66666667 1.33333333 4 2 C5.051875 2.495 6.10375 2.99 7.1875 3.5 C10 5 10 5 11 7 C9.53633658 6.60246179 8.0791065 6.18118616 6.625 5.75 C5.81289063 5.51796875 5.00078125 5.2859375 4.1640625 5.046875 C1.54214546 3.7785108 1.00617682 2.67576692 0 0 Z " fill="#D4D7DC" transform="translate(934,223)"/>
+<path d="M0 0 C0 0.33 0 0.66 0 1 C-4.92737019 2.97094808 -8.78020872 3.1799928 -14 3 C-14 2.67 -14 2.34 -14 2 C-9.126739 0.4087311 -5.19209404 -0.21192221 0 0 Z " fill="#7D8897" transform="translate(536,182)"/>
+<path d="M0 0 C0.268125 0.598125 0.53625 1.19625 0.8125 1.8125 C1.98493467 3.97224808 3.19369282 5.35790256 5 7 C3.33388095 7.042721 1.66617115 7.04063832 0 7 C-1 6 -1 6 -1.125 3.5 C-1 1 -1 1 0 0 Z " fill="#566579" transform="translate(344,152)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C1.2884375 1.6496875 1.2884375 1.6496875 0.5625 2.3125 C-1.23686957 4.02309613 -1.23686957 4.02309613 -2 7 C-3.32 6.67 -4.64 6.34 -6 6 C-4 4 -2 2 0 0 Z " fill="#44546A" transform="translate(561,1155)"/>
+<path d="M0 0 C-2.25 2.0625 -2.25 2.0625 -5 4 C-7.3125 3.75 -7.3125 3.75 -9 3 C-6.38997624 -0.48003168 -4.1689578 -0.27793052 0 0 Z " fill="#3A517A" transform="translate(819,1072)"/>
+<path d="M0 0 C1.48253267 0.61697319 2.96095174 1.24383896 4.4375 1.875 C5.67306641 2.39707031 5.67306641 2.39707031 6.93359375 2.9296875 C9 4 9 4 10 6 C5.545 5.01 5.545 5.01 1 4 C0.67 2.68 0.34 1.36 0 0 Z " fill="#657184" transform="translate(145,966)"/>
+<path d="M0 0 C0.33 0.99 0.66 1.98 1 3 C-3.455 4.485 -3.455 4.485 -8 6 C-8 5.34 -8 4.68 -8 4 C-5.36 2.68 -2.72 1.36 0 0 Z " fill="#395179" transform="translate(1015,963)"/>
+<path d="M0 0 C0.33 0 0.66 0 1 0 C1.66 3.96 2.32 7.92 3 12 C2.01 11.67 1.02 11.34 0 11 C0 7.37 0 3.74 0 0 Z " fill="#425069" transform="translate(432,945)"/>
+<path d="M0 0 C1.32 0.33 2.64 0.66 4 1 C4.33 3.64 4.66 6.28 5 9 C1.9083091 6.47043472 1.09068668 3.77545388 0 0 Z " fill="#525F76" transform="translate(356,917)"/>
+<path d="M0 0 C0.33 0.99 0.66 1.98 1 3 C-2.26760563 8.63380282 -2.26760563 8.63380282 -5 10 C-4.55090939 8.51800098 -4.09043436 7.03944764 -3.625 5.5625 C-3.36976562 4.73878906 -3.11453125 3.91507813 -2.8515625 3.06640625 C-2 1 -2 1 0 0 Z " fill="#5279C4" transform="translate(1102,895)"/>
+<path d="M0 0 C2 1 2 1 3.125 3.375 C4 6 4 6 4 9 C2 7.875 2 7.875 0 6 C-0.25 2.8125 -0.25 2.8125 0 0 Z " fill="#7A8395" transform="translate(353,772)"/>
+<path d="M0 0 C3.2542015 2.83430453 4.5206753 4.68607774 5 9 C2.5 6.75 2.5 6.75 0 4 C0 2.68 0 1.36 0 0 Z " fill="#A7AEB9" transform="translate(279,747)"/>
+<path d="M0 0 C-1.09445838 0.86657116 -2.20097781 1.71792724 -3.3125 2.5625 C-3.92738281 3.03816406 -4.54226563 3.51382813 -5.17578125 4.00390625 C-5.77777344 4.33261719 -6.37976563 4.66132812 -7 5 C-7.99 4.67 -8.98 4.34 -10 4 C-7.39928297 0.98864344 -3.94054294 -1.97027147 0 0 Z " fill="#89AFFD" transform="translate(690,609)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C-1.465 3.97 -1.465 3.97 -5 7 C-5.66 6.67 -6.32 6.34 -7 6 C-6.67 5.01 -6.34 4.02 -6 3 C-3.5 1.875 -3.5 1.875 -1 1 C-0.67 0.67 -0.34 0.34 0 0 Z " fill="#8AB0FD" transform="translate(753,569)"/>
+<path d="M0 0 C1.32 0.33 2.64 0.66 4 1 C4 1.66 4 2.32 4 3 C4.639375 3.12375 5.27875 3.2475 5.9375 3.375 C6.618125 3.58125 7.29875 3.7875 8 4 C8.33 4.66 8.66 5.32 9 6 C4.75177626 5.52797514 2.80010291 3.03344482 0 0 Z " fill="#93B6FD" transform="translate(935,559)"/>
+<path d="M0 0 C1.32 0.33 2.64 0.66 4 1 C4 1.66 4 2.32 4 3 C4.804375 3.12375 5.60875 3.2475 6.4375 3.375 C7.7059375 3.684375 7.7059375 3.684375 9 4 C9.33 4.66 9.66 5.32 10 6 C9.01 6 8.02 6 7 6 C7 5.34 7 4.68 7 4 C6.21625 3.896875 5.4325 3.79375 4.625 3.6875 C2 3 2 3 0 0 Z " fill="#677385" transform="translate(492,495)"/>
+<path d="M0 0 C-1.28524261 0.86380259 -2.57842419 1.71580369 -3.875 2.5625 C-4.59429688 3.03816406 -5.31359375 3.51382812 -6.0546875 4.00390625 C-6.69664062 4.33261719 -7.33859375 4.66132813 -8 5 C-8.66 4.67 -9.32 4.34 -10 4 C-7.6604297 0.49064455 -4.21379901 -2.1068995 0 0 Z " fill="#CACED4" transform="translate(711,468)"/>
+<path d="M0 0 C1.36125 0.12375 1.36125 0.12375 2.75 0.25 C-0.45336822 3.08374881 -3.03087253 3.7705537 -7.25 4.25 C-4.83923194 1.28290085 -3.90322061 0.30024774 0 0 Z " fill="#A3ABB6" transform="translate(720.25,462.75)"/>
+<path d="M0 0 C4.95 0.99 4.95 0.99 10 2 C10 2.33 10 2.66 10 3 C7.03 3 4.06 3 1 3 C0.67 2.01 0.34 1.02 0 0 Z " fill="#DFE2E5" transform="translate(513,389)"/>
+<path d="M0 0 C3.99455527 0.61454696 6.74466336 2.70646737 10 5 C6.26879511 5 4.21944311 3.81968524 1 2 C0.67 1.34 0.34 0.68 0 0 Z " fill="#9DA4B0" transform="translate(802,388)"/>
+<path d="M0 0 C7.38461538 -0.36923077 7.38461538 -0.36923077 10.5 1.5 C10.995 1.995 11.49 2.49 12 3 C7.53160785 3.21278058 4.17737474 2.59138085 0 1 C0 0.67 0 0.34 0 0 Z " fill="#3F5A8B" transform="translate(519,364)"/>
+<path d="M0 0 C3.63 0 7.26 0 11 0 C11.66 1.32 12.32 2.64 13 4 C12.43796875 3.68289063 11.8759375 3.36578125 11.296875 3.0390625 C8.84803683 1.93125475 6.91612145 1.61024601 4.25 1.375 C3.45078125 1.30023438 2.6515625 1.22546875 1.828125 1.1484375 C1.22484375 1.09945313 0.6215625 1.05046875 0 1 C0 0.67 0 0.34 0 0 Z " fill="#5C89E4" transform="translate(489,355)"/>
+<path d="M0 0 C4.21912747 0.4794463 6.79663178 1.16625119 10 4 C7.25 4.25 7.25 4.25 4 4 C1.625 2 1.625 2 0 0 Z " fill="#B6BCC5" transform="translate(174,332)"/>
+<path d="M0 0 C2.4375 1.125 2.4375 1.125 5 3 C5.8125 6.1875 5.8125 6.1875 6 9 C2.81227007 6.87484671 1.75079247 5.33484279 0 2 C0 1.34 0 0.68 0 0 Z " fill="#647184" transform="translate(393,318)"/>
+<path d="M0 0 C0.33 0 0.66 0 1 0 C1 2.97 1 5.94 1 9 C-0.98 9.99 -0.98 9.99 -3 11 C-2.01 7.37 -1.02 3.74 0 0 Z " fill="#3C4C64" transform="translate(390,263)"/>
+<path d="M0 0 C0 0.33 0 0.66 0 1 C-4.53701494 2.45184478 -8.18061476 3.23509196 -13 3 C-8.16353702 -0.22430866 -5.73060016 -0.09242903 0 0 Z " fill="#5177C2" transform="translate(528,209)"/>
+<path d="M0 0 C2.31 0 4.62 0 7 0 C7.33 0.99 7.66 1.98 8 3 C5.6568787 2.74438677 3.32156597 2.40729228 1 2 C0.67 1.34 0.34 0.68 0 0 Z " fill="#395179" transform="translate(638,205)"/>
+<path d="M0 0 C3.67446567 0.70662801 6.73912209 2.18840116 10 4 C10.33 4.66 10.66 5.32 11 6 C9.53775201 5.57576756 8.08026588 5.13509755 6.625 4.6875 C5.81289063 4.44386719 5.00078125 4.20023438 4.1640625 3.94921875 C2 3 2 3 0 0 Z " fill="#C2C6CD" transform="translate(717,202)"/>
+<path d="M0 0 C2.1875 0.3125 2.1875 0.3125 4 1 C3.01 2.485 3.01 2.485 2 4 C0.35 3.67 -1.3 3.34 -3 3 C-1.75 1.4375 -1.75 1.4375 0 0 Z " fill="#4A596F" transform="translate(486,193)"/>
+<path d="M0 0 C4.21912747 0.4794463 6.79663178 1.16625119 10 4 C7.25 4.25 7.25 4.25 4 4 C1.625 2 1.625 2 0 0 Z " fill="#959DAA" transform="translate(379,174)"/>
+<path d="M0 0 C6.52307692 0.49230769 6.52307692 0.49230769 8.9375 3.0625 C9.288125 3.701875 9.63875 4.34125 10 5 C5.59885603 4.49701212 3.28804981 2.91227269 0 0 Z " fill="#48576D" transform="translate(621,52)"/>
+<path d="M0 0 C2.25 0.25 2.25 0.25 4 1 C2.8125 2.5 2.8125 2.5 1 4 C-1.6875 4.1875 -1.6875 4.1875 -4 4 C-2.25 1.9375 -2.25 1.9375 0 0 Z " fill="#737F8F" transform="translate(543,1168)"/>
+<path d="M0 0 C3.60296594 -0.41176754 4.78402067 -0.1535853 7.8125 2 C8.534375 2.66 9.25625 3.32 10 4 C6.39703406 4.41176754 5.21597933 4.1535853 2.1875 2 C1.465625 1.34 0.74375 0.68 0 0 Z " fill="#526175" transform="translate(467,1145)"/>
+<path d="M0 0 C4.40114397 0.50298788 6.71195019 2.08772731 10 5 C8.02 5 6.04 5 4 5 C3.67 4.01 3.34 3.02 3 2 C2.01 1.34 1.02 0.68 0 0 Z " fill="#5A677B" transform="translate(185,989)"/>
+<path d="M0 0 C0.33 0 0.66 0 1 0 C1 1.65 1 3.3 1 5 C1.99 5.33 2.98 5.66 4 6 C3.67 7.32 3.34 8.64 3 10 C0.64551835 7.44931155 0.01672076 6.28982642 -0.1875 2.75 C-0.125625 1.8425 -0.06375 0.935 0 0 Z " fill="#DADDE1" transform="translate(39,864)"/>
+<path d="M0 0 C1.32 0.33 2.64 0.66 4 1 C4 1.66 4 2.32 4 3 C4.99 3 5.98 3 7 3 C7.66 4.32 8.32 5.64 9 7 C8.01 6.67 7.02 6.34 6 6 C6 5.34 6 4.68 6 4 C5.38125 3.896875 4.7625 3.79375 4.125 3.6875 C2 3 2 3 0 0 Z " fill="#B5CDFE" transform="translate(812,828)"/>
+<path d="M0 0 C5.75 1.625 5.75 1.625 8 5 C6.68 5 5.36 5 4 5 C3.67 4.34 3.34 3.68 3 3 C2.01 2.67 1.02 2.34 0 2 C0 1.34 0 0.68 0 0 Z " fill="#86AEFD" transform="translate(762,810)"/>
+<path d="M0 0 C1.32 0.33 2.64 0.66 4 1 C2.35 2.32 0.7 3.64 -1 5 C-1.66 4.67 -2.32 4.34 -3 4 C-2.01 2.68 -1.02 1.36 0 0 Z " fill="#8891A1" transform="translate(363,686)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C0.87926138 1.83905565 -0.24674547 2.67107831 -1.375 3.5 C-2.00148438 3.9640625 -2.62796875 4.428125 -3.2734375 4.90625 C-5 6 -5 6 -7 6 C-7 5.01 -7 4.02 -7 3 C-4.69631264 1.93347808 -2.35981813 0.93578995 0 0 Z " fill="#C8DAFE" transform="translate(980,666)"/>
+<path d="M0 0 C2.66666667 1.33333333 5.33333333 2.66666667 8 4 C7.67 4.66 7.34 5.32 7 6 C2.32307692 4.52307692 2.32307692 4.52307692 0.6875 1.875 C0.460625 1.25625 0.23375 0.6375 0 0 Z " fill="#80AAFD" transform="translate(924,663)"/>
+<path d="M0 0 C0.66 0.33 1.32 0.66 2 1 C1.01 2.485 1.01 2.485 0 4 C-3.125 4.1875 -3.125 4.1875 -6 4 C-3.94766315 1.7522025 -2.99332739 0.9977758 0 0 Z " fill="#CBDCFE" transform="translate(977,660)"/>
+<path d="M0 0 C0 0.99 0 1.98 0 3 C-0.99 3 -1.98 3 -3 3 C-3.33 3.99 -3.66 4.98 -4 6 C-5.32 5.67 -6.64 5.34 -8 5 C-4.04 2.525 -4.04 2.525 0 0 Z " fill="#57637A" transform="translate(338,606)"/>
+<path d="M0 0 C0.70125 0.144375 1.4025 0.28875 2.125 0.4375 C5.07556141 1.01478375 8.03270151 1.51695141 11 2 C11 2.33 11 2.66 11 3 C9.54257537 3.08096803 8.08387193 3.13917774 6.625 3.1875 C5.81289063 3.22230469 5.00078125 3.25710938 4.1640625 3.29296875 C3.44992187 3.19628906 2.73578125 3.09960938 2 3 C1.34 2.01 0.68 1.02 0 0 Z " fill="#57637A" transform="translate(380,585)"/>
+<path d="M0 0 C2.25 0.25 2.25 0.25 4 1 C2.8125 2.5 2.8125 2.5 1 4 C-1.6875 4.1875 -1.6875 4.1875 -4 4 C-2.25 1.9375 -2.25 1.9375 0 0 Z " fill="#496AA9" transform="translate(700,504)"/>
+<path d="M0 0 C-1.98 1.32 -3.96 2.64 -6 4 C-6.66 3.67 -7.32 3.34 -8 3 C-7.67 2.01 -7.34 1.02 -7 0 C-3.86650268 -1.04449911 -3.01031744 -0.93423645 0 0 Z " fill="#395078" transform="translate(849,431)"/>
+<path d="M0 0 C2.75 -0.25 2.75 -0.25 6 0 C8.375 2 8.375 2 10 4 C8.35 3.67 6.7 3.34 5 3 C5 2.34 5 1.68 5 1 C3.35 1 1.7 1 0 1 C0 0.67 0 0.34 0 0 Z " fill="#737E8F" transform="translate(359,429)"/>
+<path d="M0 0 C-0.33 1.32 -0.66 2.64 -1 4 C-2.98 4 -4.96 4 -7 4 C-5.53303752 1.06607504 -3.25996861 0 0 0 Z " fill="#5A86DE" transform="translate(867,423)"/>
+<path d="M0 0 C-1.98 1.32 -3.96 2.64 -6 4 C-6.66 3.67 -7.32 3.34 -8 3 C-7.67 2.01 -7.34 1.02 -7 0 C-3.86650268 -1.04449911 -3.01031744 -0.93423645 0 0 Z " fill="#395078" transform="translate(959,376)"/>
+<path d="M0 0 C0 0.99 0 1.98 0 3 C-1.96466413 4.06775224 -3.96855359 5.06553465 -6 6 C-6.66 5.67 -7.32 5.34 -8 5 C-4.04 2.525 -4.04 2.525 0 0 Z " fill="#405C8F" transform="translate(742,327)"/>
+<path d="M0 0 C2.25 -0.25 2.25 -0.25 5 0 C7.3125 2 7.3125 2 9 4 C8.67 4.66 8.34 5.32 8 6 C7.236875 5.38125 6.47375 4.7625 5.6875 4.125 C3.00374191 1.94402948 3.00374191 1.94402948 0 0 Z " fill="#3C5581" transform="translate(1091,322)"/>
+<path d="M0 0 C5.66153846 1.47692308 5.66153846 1.47692308 7.375 4.125 C7.684375 5.053125 7.684375 5.053125 8 6 C2.25 3.375 2.25 3.375 0 0 Z " fill="#6D798A" transform="translate(1044,281)"/>
+<path d="M0 0 C1.32 0 2.64 0 4 0 C5.8125 2.375 5.8125 2.375 7 5 C6.67 5.66 6.34 6.32 6 7 C4.02 4.69 2.04 2.38 0 0 Z " fill="#425F94" transform="translate(744,249)"/>
+<path d="M0 0 C4.31392226 0.4793247 6.16569547 1.7457985 9 5 C6.69 4.34 4.38 3.68 2 3 C2 2.34 2 1.68 2 1 C1.34 0.67 0.68 0.34 0 0 Z " fill="#B7BDC5" transform="translate(965,240)"/>
+<path d="M0 0 C0.99 0.33 1.98 0.66 3 1 C2.34 1 1.68 1 1 1 C0.67 2.32 0.34 3.64 0 5 C-0.99 5 -1.98 5 -3 5 C-3.33 5.66 -3.66 6.32 -4 7 C-3.67 5.68 -3.34 4.36 -3 3 C-2.34 3 -1.68 3 -1 3 C-0.67 2.01 -0.34 1.02 0 0 Z " fill="#B2B8C1" transform="translate(406,235)"/>
+<path d="M0 0 C1.65 0 3.3 0 5 0 C5.2475 0.639375 5.495 1.27875 5.75 1.9375 C6.81562433 4.18741541 6.81562433 4.18741541 9.125 4.75 C9.74375 4.8325 10.3625 4.915 11 5 C9.35 5 7.7 5 6 5 C5.7525 4.360625 5.505 3.72125 5.25 3.0625 C4.18437567 0.81258459 4.18437567 0.81258459 1.875 0.25 C0.946875 0.12625 0.946875 0.12625 0 0 Z " fill="#5F6C7F" transform="translate(384,178)"/>
+<path d="M0 0 C0.66 0 1.32 0 2 0 C1.67 0.66 1.34 1.32 1 2 C0.67 1.34 0.34 0.68 0 0 Z " fill="#000000" transform="translate(299,1091)"/>
+<path d="M0 0 C0.99 0.495 0.99 0.495 2 1 C1.01 1.495 1.01 1.495 0 2 C0 1.34 0 0.68 0 0 Z " fill="#000000" transform="translate(1096,957)"/>
+<path d="M0 0 C0.66 0.66 1.32 1.32 2 2 C1.34 2 0.68 2 0 2 C0 1.34 0 0.68 0 0 Z " fill="#000000" transform="translate(52,953)"/>
+<path d="M0 0 C0.99 0.495 0.99 0.495 2 1 C1.01 1.495 1.01 1.495 0 2 C0 1.34 0 0.68 0 0 Z " fill="#000000" transform="translate(1120,933)"/>
+<path d="M0 0 C0.33 0.66 0.66 1.32 1 2 C0.34 1.67 -0.32 1.34 -1 1 C-0.67 0.67 -0.34 0.34 0 0 Z " fill="#000000" transform="translate(1131,308)"/>
+<path d="M0 0 C0.66 0.66 1.32 1.32 2 2 C1.34 2 0.68 2 0 2 C0 1.34 0 0.68 0 0 Z " fill="#000000" transform="translate(1120,294)"/>
+<path d="M0 0 C0.33 0.66 0.66 1.32 1 2 C0.34 1.67 -0.32 1.34 -1 1 C-0.67 0.67 -0.34 0.34 0 0 Z " fill="#000000" transform="translate(49,277)"/>
+<path d="M0 0 C2 1 2 1 2 1 Z " fill="#000000" transform="translate(704,1174)"/>
+<path d="M0 0 C2 1 2 1 2 1 Z " fill="#000000" transform="translate(886,1074)"/>
+<path d="M0 0 C2 1 2 1 2 1 Z " fill="#000000" transform="translate(941,1043)"/>
+<path d="" fill="#000000" transform="translate(0,0)"/>
+<path d="" fill="#000000" transform="translate(0,0)"/>
+<path d="M0 0 C2 1 2 1 2 1 Z " fill="#000000" transform="translate(1130,919)"/>
+<path d="M0 0 C2 1 2 1 2 1 Z " fill="#000000" transform="translate(24,305)"/>
+<path d="" fill="#000000" transform="translate(0,0)"/>
+<path d="M0 0 C2 1 2 1 2 1 Z " fill="#000000" transform="translate(38,288)"/>
+<path d="" fill="#000000" transform="translate(0,0)"/>
+<path d="M0 0 C2 1 2 1 2 1 Z " fill="#000000" transform="translate(45,281)"/>
+<path d="" fill="#000000" transform="translate(0,0)"/>
+<path d="M0 0 C2 1 2 1 2 1 Z " fill="#000000" transform="translate(996,216)"/>
+<path d="M0 0 C2 1 2 1 2 1 Z " fill="#000000" transform="translate(934,181)"/>
+<path d="M0 0 C2 1 2 1 2 1 Z " fill="#000000" transform="translate(848,133)"/>
+<path d="M0 0 C2 1 2 1 2 1 Z " fill="#000000" transform="translate(361,102)"/>
+<path d="M0 0 C2 1 2 1 2 1 Z " fill="#000000" transform="translate(392,85)"/>
+<path d="" fill="#000000" transform="translate(0,0)"/>
+<path d="" fill="#000000" transform="translate(0,0)"/>
+<path d="" fill="#000000" transform="translate(0,0)"/>
+<path d="" fill="#000000" transform="translate(0,0)"/>
+<path d="" fill="#000000" transform="translate(0,0)"/>
+<path d="" fill="#000000" transform="translate(0,0)"/>
+<path d="" fill="#000000" transform="translate(0,0)"/>
+<path d="" fill="#000000" transform="translate(0,0)"/>
+<path d="" fill="#000000" transform="translate(0,0)"/>
+<path d="" fill="#000000" transform="translate(0,0)"/>
+<path d="" fill="#000000" transform="translate(0,0)"/>
+<path d="" fill="#000000" transform="translate(0,0)"/>
+<path d="" fill="#000000" transform="translate(0,0)"/>
+<path d="" fill="#000000" transform="translate(0,0)"/>
+<path d="" fill="#000000" transform="translate(0,0)"/>
+<path d="" fill="#000000" transform="translate(0,0)"/>
+<path d="" fill="#000000" transform="translate(0,0)"/>
+<path d="" fill="#000000" transform="translate(0,0)"/>
+<path d="" fill="#000000" transform="translate(0,0)"/>
+<path d="" fill="#000000" transform="translate(0,0)"/>
+<path d="" fill="#000000" transform="translate(0,0)"/>
+<path d="" fill="#000000" transform="translate(0,0)"/>
+<path d="" fill="#000000" transform="translate(0,0)"/>
+<path d="" fill="#000000" transform="translate(0,0)"/>
+<path d="" fill="#000000" transform="translate(0,0)"/>
+<path d="" fill="#000000" transform="translate(0,0)"/>
+<path d="" fill="#000000" transform="translate(0,0)"/>
+<path d="" fill="#000000" transform="translate(0,0)"/>
+</svg>
diff --git a/app/assets/ico/vendor/microsoft-icon.svg b/app/assets/ico/vendor/microsoft-icon.svg
new file mode 100644
index 0000000..4a3c87d
--- /dev/null
+++ b/app/assets/ico/vendor/microsoft-icon.svg
@@ -0,0 +1,10 @@
+<!--
+This exists because it has 'fill:currentColor' unlike the other microsoft icon asset
+and can directly replace fa-microsoft.
+-->
+<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <path d="M0 0H11.406V11.406H0V0Z" fill="currentColor" />
+  <path d="M12.5984 0H24V11.406H12.5984V0Z" fill="currentColor" />
+  <path d="M0 12.594H11.406V24H0V12.594Z" fill="currentColor" />
+  <path d="M12.5984 12.594H24V24H12.5984V12.594Z" fill="currentColor" />
+</svg>
diff --git a/app/assets/ico/vendor/microsoft.svg b/app/assets/ico/vendor/microsoft.svg
new file mode 100644
index 0000000..92eed2d
--- /dev/null
+++ b/app/assets/ico/vendor/microsoft.svg
@@ -0,0 +1,6 @@
+<svg width="36" height="40" viewBox="0 0 36 40" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M11.2465 7.46112H0V18.7076H11.2465V7.46112Z" fill="#F35325"/>
+<path d="M23.7035 7.46112H12.457V18.7076H23.7035V7.46112Z" fill="#81BC06"/>
+<path d="M11.2465 19.9186H0V31.1651H11.2465V19.9186Z" fill="#05A6F0"/>
+<path d="M23.7035 19.9186H12.457V31.1651H23.7035V19.9186Z" fill="#FFBA08"/>
+</svg>
diff --git a/app/assets/ico/vendor/openldap.svg b/app/assets/ico/vendor/openldap.svg
new file mode 100644
index 0000000..71f61b2
--- /dev/null
+++ b/app/assets/ico/vendor/openldap.svg
@@ -0,0 +1,550 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!-- Created with Inkscape (http://www.inkscape.org/) -->
+<svg
+    xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+    xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+    xmlns="http://www.w3.org/2000/svg"
+    xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+    xmlns:cc="http://creativecommons.org/ns#"
+    xmlns:xlink="http://www.w3.org/1999/xlink"
+    xmlns:dc="http://purl.org/dc/elements/1.1/"
+    xmlns:svg="http://www.w3.org/2000/svg"
+    xmlns:ns1="http://sozi.baierouge.fr"
+    id="svg2"
+    sodipodi:docname="open_ldap_plain.svg"
+    viewBox="0 0 744.09 1052.4"
+    version="1.1"
+    inkscape:version="0.48.1 r9760"
+  >
+  <sodipodi:namedview
+      id="namedview92"
+      bordercolor="#666666"
+      inkscape:pageshadow="2"
+      guidetolerance="10"
+      pagecolor="#ffffff"
+      gridtolerance="10"
+      inkscape:window-maximized="1"
+      inkscape:zoom="0.46093946"
+      objecttolerance="10"
+      borderopacity="1"
+      inkscape:current-layer="svg2"
+      inkscape:cx="76.25105"
+      inkscape:cy="600.16618"
+      inkscape:window-y="30"
+      inkscape:window-x="0"
+      inkscape:window-width="1600"
+      showgrid="false"
+      inkscape:pageopacity="0"
+      inkscape:window-height="844"
+  />
+  <defs
+      id="defs4"
+    >
+    <linearGradient
+        id="linearGradient3069"
+        y2="129.23"
+        gradientUnits="userSpaceOnUse"
+        x2="89.429"
+        gradientTransform="matrix(1.9236 0 0 1.9236 244.83 -81.693)"
+        y1="129.23"
+        x1="80.916"
+        inkscape:collect="always"
+      >
+      <stop
+          id="stop3954-7"
+          style="stop-color:#6600cc"
+          offset="0"
+      />
+      <stop
+          id="stop3956-7"
+          style="stop-color:#6600cc;stop-opacity:0"
+          offset="1"
+      />
+    </linearGradient
+    >
+    <linearGradient
+        id="linearGradient3078"
+        y2="129.23"
+        gradientUnits="userSpaceOnUse"
+        x2="89.429"
+        gradientTransform="matrix(1.9236 0 0 1.9236 216.56 -73.967)"
+        y1="129.23"
+        x1="80.916"
+        inkscape:collect="always"
+      >
+      <stop
+          id="stop3954"
+          style="stop-color:#6600cc"
+          offset="0"
+      />
+      <stop
+          id="stop3956"
+          style="stop-color:#6600cc;stop-opacity:0"
+          offset="1"
+      />
+    </linearGradient
+    >
+    <linearGradient
+        id="linearGradient3099"
+        y2="465.09"
+        gradientUnits="userSpaceOnUse"
+        x2="77.015"
+        gradientTransform="matrix(1.9236 0 0 1.9236 267.18 -40.495)"
+        y1="384.81"
+        x1="8.535"
+        inkscape:collect="always"
+      >
+      <stop
+          id="stop5263"
+          style="stop-color:#6d5744"
+          offset="0"
+      />
+      <stop
+          id="stop5265"
+          style="stop-color:#6d5744;stop-opacity:0"
+          offset="1"
+      />
+    </linearGradient
+    >
+    <linearGradient
+        id="linearGradient3102"
+        y2="197.66"
+        gradientUnits="userSpaceOnUse"
+        x2="100.23"
+        gradientTransform="matrix(1.9236 0 0 1.9236 267.18 -40.495)"
+        y1="163.64"
+        x1="-41.915"
+        inkscape:collect="always"
+      >
+      <stop
+          id="stop5276"
+          style="stop-color:#6d5744"
+          offset="0"
+      />
+      <stop
+          id="stop5278"
+          style="stop-color:#6d5744;stop-opacity:0"
+          offset="1"
+      />
+    </linearGradient
+    >
+    <linearGradient
+        id="linearGradient3922"
+        y2="202.05"
+        gradientUnits="userSpaceOnUse"
+        x2="416.51"
+        y1="220.22"
+        x1="420.17"
+        inkscape:collect="always"
+      >
+      <stop
+          id="stop3918"
+          style="stop-color:#212121"
+          offset="0"
+      />
+      <stop
+          id="stop3920"
+          style="stop-color:#212121;stop-opacity:0"
+          offset="1"
+      />
+    </linearGradient
+    >
+  </defs
+  >
+  <path
+      id="path3881-5"
+      d="m416.93 357.28c-13.927 2.158-29.996 7.1063-40.074 15.502 4.9656 23.732 26.302-3.8631 41.709 1.114 19.575-1.994 11.267-20.953-1.6356-16.616z"
+      style="stroke:#816647;stroke-width:2.5007;fill:#ffff99"
+      inkscape:connector-curvature="0"
+  />
+  <path
+      id="path3881-8"
+      d="m405.02 320.44c-14.087-0.43938-30.791 1.4704-42.241 7.8706 0.51772 24.24 26.564 1.0384 40.793 8.7633 19.608 1.639 14.927-18.525 1.4472-16.634z"
+      style="stroke:#816647;stroke-width:2.5007;fill:#ffff99"
+      inkscape:connector-curvature="0"
+  />
+  <path
+      id="path3881"
+      d="m445.25 394.59c-13.87 2.5-29.812 7.8423-39.68 16.484 5.548 23.602 26.199-4.5092 41.724 0.0873 19.52-2.475 10.748-21.224-2.044-16.571z"
+      style="stroke:#816647;stroke-width:2.5007;fill:#ffff99"
+      inkscape:connector-curvature="0"
+  />
+  <path
+      id="path3879"
+      d="m469.88 440.79c-14.484-5.1225-45.334 19.408-19.277 22.574 8.3193-8.5573 21.103-5.3377 32.541-7.2704 13.791-10.401-3.5877-17.608-13.264-15.303z"
+      style="stroke:#816647;stroke-width:2.5007;fill:#ffff99"
+      inkscape:connector-curvature="0"
+  />
+  <path
+      id="path3877"
+      d="m511.36 603.7c-19.378 6.1904 0.0229 20.385 12.165 15.99 8.7924 0.10927 17.767-0.41843 26.333 0.71187 14.807-8.2997-3.011-20.33-13.628-16.702h-24.87z"
+      style="stroke:#816647;stroke-width:2.5007;fill:#ffff99"
+      inkscape:connector-curvature="0"
+  />
+  <path
+      id="path3875"
+      d="m543.52 678c-16.558-7.7861-30.682 18.894-7.9722 16.243 11.17-3.0762 30.464 6.0676 35.019-8.2476-1.6588-13.088-18.785-5.9798-27.047-7.9952z"
+      style="stroke:#816647;stroke-width:2.5007;fill:#ffff99"
+      inkscape:connector-curvature="0"
+  />
+  <path
+      id="path3873"
+      d="m510.94 752.36c-23.064 11.227 20.121 24.639 19.417 29.155 5.015 8.059 5.4222 11.558 9.5927 13.687 18.953 4.0678 9.7199-18.678 0.80672-25.048-8.2684-8.3927-17.81-15.759-29.816-17.794z"
+      style="stroke:#816647;stroke-width:2.5007;fill:#ffff99"
+      inkscape:connector-curvature="0"
+  />
+  <path
+      id="path3871"
+      d="m536.13 790.23 0.06 0.24046z"
+      style="stroke:#816647;stroke-width:2.5007;fill:#ffff99"
+      inkscape:connector-curvature="0"
+  />
+  <path
+      id="path4272"
+      d="m458.58 832.25c-21.038 7.3703 4.8131 20.578 14.908 23.685-2.9615 12.592 14.925 29.912 18.094 9.7384 1.7944-20.171-15.98-29.587-33.002-33.423z"
+      style="stroke:#816647;stroke-width:2.5007;fill:#ffff99"
+      inkscape:connector-curvature="0"
+  />
+  <g
+      id="g5904"
+      style="stroke:#015a01"
+      transform="matrix(1.9236 0 0 1.9236 215.33 -72.118)"
+    >
+    <path
+        id="path4269"
+        d="m155.98 488.01a31.122 36.497 0 1 1 -1.22 -64.48"
+        style="stroke:#015a01;stroke-width:0.9;fill:#66cc33"
+        transform="translate(-132.55 5.7985)"
+        inkscape:connector-curvature="0"
+    />
+    <path
+        id="path4267"
+        d="m135.8 445.27a33.986 36.899 0 1 1 9.7369 39.546"
+        style="stroke:#015a01;stroke-width:.88405;fill:#66cc33"
+        transform="matrix(1.0019 -.18062 .18062 1.0019 -218.91 35.24)"
+        inkscape:connector-curvature="0"
+    />
+    <path
+        id="path4265"
+        d="m167.9 478.33a43.697 33.986 0 1 1 38.346 11.559"
+        style="stroke:#015a01;stroke-width:.84894;fill:#66cc33"
+        transform="matrix(.96989 .51946 -.56662 .85532 129.04 -34.443)"
+        inkscape:connector-curvature="0"
+    />
+    <path
+        id="path4227-5-0"
+        d="m205.36 406.05a50.381 30.214 0 1 1 75.368 24.902"
+        style="stroke:#015a01;stroke-width:.86545;fill:#66cc33"
+        transform="matrix(.94681 .38718 -.36996 .99090 -4.7168 -49.065)"
+        inkscape:connector-curvature="0"
+    />
+    <path
+        id="path4227-5"
+        d="m221.38 425.53a50.381 28.411 0 1 1 67.773 0.43838"
+        style="stroke:#015a01;stroke-width:.82037;fill:#66cc33"
+        transform="matrix(1.0373 .24762 -.23671 1.1038 -65.132 -75.481)"
+        inkscape:connector-curvature="0"
+    />
+    <path
+        id="path4227"
+        d="m206.04 409.53a50.381 28.411 0 1 1 86.24 14.733"
+        style="stroke:#015a01;stroke-width:.77966;fill:#66cc33"
+        transform="matrix(1.0639 0 0 1.2525 -157.93 -98.496)"
+        inkscape:connector-curvature="0"
+    />
+    <path
+        id="path4225-2"
+        d="m225.39 392a46.972 26.895 0 1 1 62.784 -15.176"
+        style="stroke:#015a01;stroke-width:0.806;fill:#66cc33"
+        transform="matrix(1.1209 0 0 1.1123 -158.46 -18.128)"
+        inkscape:connector-curvature="0"
+    />
+    <path
+        id="path3418-9"
+        d="m157.51 375.64c4.9383-9.0103 1.6526-17.354-7.625-24.469 6.0772-17.646-8.6538-60.144-35.031-91.812-1.3807-1.6577-3.2934-2.9847-5.625-4-6.1882-22.424-26.148-28.54-43.875-23.594-23.792 6.6391-44.719 13.087-44.719 29.25 0 8.4362 5.4591 16.034 14.188 21.375-0.31026 0.68092-0.59427 1.3623-0.84375 2.0625-6.4803 27.801 16.103 65.353 26.031 76.75 0.14487 0.1663 0.29268 0.30837 0.4375 0.46875-5.5745 13.415 6.6106 27.527 29.75 32.969"
+        style="stroke:#015a01;stroke-width:0.9;fill:#66cc33"
+        inkscape:connector-curvature="0"
+    />
+    <path
+        id="path3418-54"
+        d="m165.1 192.18a35.714 25.423 0 1 1 60.364 -7.4578"
+        style="stroke:#015a01;stroke-width:.75961;fill:#66cc33"
+        transform="matrix(1.1757 -.14689 .14689 1.1757 -199.58 52.104)"
+        inkscape:connector-curvature="0"
+    />
+    <path
+        id="path3418-5"
+        d="m165.18 192.64a35.714 26.026 0 1 1 58.892 -5.4041"
+        style="stroke:#015a01;stroke-width:.75961;fill:#66cc33"
+        transform="matrix(1.1848 0 0 1.1848 -180.57 -7.7238)"
+        inkscape:connector-curvature="0"
+    />
+    <path
+        id="path3418"
+        d="m178.08 200.01a35.714 26.582 0 1 1 43.239 -9.1014"
+        style="stroke:#015a01;stroke-width:.75961;fill:#66cc33"
+        transform="matrix(1.1848 0 0 1.1848 -178.07 -33.132)"
+        inkscape:connector-curvature="0"
+    />
+    <path
+        id="path3416"
+        d="m194.64 164.22a50.528 44.244 0 1 1 42.772 22.373"
+        style="stroke:#015a01;stroke-width:0.9;fill:#66cc33"
+        transform="matrix(.90360 -.42838 .42838 .90360 -206.62 119.72)"
+        inkscape:connector-curvature="0"
+    />
+  </g
+  >
+  <path
+      id="path5079"
+      d="m345.16 123.48c-18.445 2.4161-36.231 9.6388-51.157 20.739 3.6699 10.439 8.5515 19.439 7.7641 31.245 6.17 3.4251 6.9736 0.76021 8.707 8.6708-5.4724 1.3476 12.146 3.9913 16.649 3.1967 12.843-6.387 1.9658-24.003 5.4726-35.177-1.1571-12.639 4.1781-18.613 12.564-28.674zm-11.662 17.072c-1.079 1.8301 2.0594 0.045 0 0zm-54.47 17.26c-14.103 14.686-23.007 34.328-24.586 54.643 5.548 6.7011 10.064 14.055 23.745 12.744 12.83-0.61243 25.13 13.586 38.054 3.7706 0.55824-10.676-11.82-20.204-21.377-24.202-10.807-5.4779-9.3371-17.826-11.324-24.489-4.4842-7.633-1.2084-4.5369-4.03-14.412-0.42064-2.6619-0.52783-5.3643-0.48101-8.0551zm-39.194 77.006c-12.088 13.667-14.622 34.874-6.4923 51.157-8.4468 11.861-13.275 28.947-6.3867 42.527 8.6842 9.3758 15.535 18.781 23.923 27.836 5.1483 4.2315 29.949 1.3273 22.899-9.3922 3.6196-9.7389 11.573-4.6697 20.46-5.5455-0.88247-6.9442-13.13-21.402-3.727-21.28-5.3079-0.46722-10.441 0.91186-16.634-0.66296-2.3157 1.1785-11.748 3.9647-16.789 7.1552-2.8126-4.3696-9.5277-9.0259-14.006-13.285 6.3287-6.9414 12.568-11.394 18.635-22.362-1.4185-11.027 1.41-23.937-4.9522-34.526-4.389-7.9815-9.5377-16.258-16.929-21.62zm21.04 29.576c-2.5786 2.0684 2.6481 1.2222 0 0zm33.063 1.2624c-7.9622 8.5941-13.598-0.63713-22.603 6.853-7.3911 6.563-7.9568 18.171 0.76732 23.49 4.0606 2.4481 8.1395 13.005 11.977 4.8232 3.5072-0.20831 6.0999-0.73004 12.383-6.2514 8.1255-2.6433 16.85-9.2057 7.935-11.722-1.7296 2.5665-1.6737-1.9938-4.2677-3.9078-2.254 2.3539-1.0538-11.239-6.1921-13.285zm9.6783 15.149c-4.602 4.3418 3.1492 1.2185 0 0zm-11.963 20.439c6.2358 3.0298 17.229-0.0281 4.4192 0.28595-1.4819 0.20384-2.9453-0.17409-4.4192-0.28595zm12.203 0.48091c-0.5951 3.2901 1.8957 0.63285 0 0zm-56.026 14.908c-0.85071 0.90406 1.5434 0.18967 0 0zm43.703 3.4866c-2.5729 1.4834 1.9598-0.001 0 0zm0.4208 0.12023c-0.56136 0.63662 1.279 0.29689 0 0zm-13.646 20.92c-1.3015 0.20939 0.81141 1.1377 0 0zm3.9074 0.4208c-3.4042 3.4072 4.7216 0.29281 0 0zm-38.713 20.138c-16.799 2.2842-10.957 31.496 2.805 33.354 5.6389 9.2858 19.757 13.694 24.547 24.655 12.72 4.1125 22.56-7.8951 20.439-20.018 8.7311 1.2836 22.707-6.8259 20.379-18.335-11.926-0.22364-22.746-2.6034-33.62 2.7574-15.887 2.6923-25.953-11.899-34.549-22.415zm45.025 14.968c-2.2953 3.0545 1.9457 1.4797 0 0zm-0.78148 1.5028c-1.0407-3.2076-2.8889 3.5887 0 0zm2.645-1.5028c-3.1491 1.9188 5.5645 0.92096 0 0zm0.84159 1.6832c-1.5168 1.5189 3.6701 0.68611 0 0zm22.362 4.2681c-2.0811 2.1726 2.7996 3.9462 0 0zm1.9236 42.44c-1.061 2.5216 4.0223 2.2817 0 0zm-60.835 0.48091c-3.1292 19.345 11.046 36.912 26.69 46.468-7.2725 14.968 24.864 4.591 22.529-7.4313-3.5197-4.4063-3.5959-8.4263-6.6588-12.226 10.339 0.22491 18.674-0.72332 29.335-7.5743 10.545-0.48228-9.4314-19.033-14.573-17.474-7.4915 6.7038-18.908 3.1739-26.725 11.463-8.8854-6.5616-19.78-11.221-30.598-13.225zm50.616 27.232c-2.0162 0.84174 3.1506 1.7946 0 0zm-0.78148 8.2356c-5.8835 2.5487 3.0934 1.1944 0 0z"
+      style="fill:url(#linearGradient3102)"
+      inkscape:connector-curvature="0"
+  />
+  <path
+      id="path5255"
+      d="m376.06 624.62c-5.8761 3.0415-21.757 3.7052-21.12 7.5348 6.7064 3.036-9.727 2.3097-3.0455-1.5234-6.0552 3.6293-4.3876-1.1053-6.9732 4.5085-4.3442-0.5876-1.7898-8.5827-9.2351-2.7449-12.237 6.275-3.7081 20.152 2.6534 27.602 2.6651 6.1334 15.762-6.604 17.041 4.5388 8.0211-2.4798 15.795-2.1732 24.887-5.5305 7.4956-0.57342 12.594 10.911 15.569 5.9512 7.2214-1.0651 4.5536 7.0877 9.3239 0.25154 5.2254-7.084 10.894-21.606 4.8559-21.06-2.713-2.0604-4.2963-9.4323 0.008-2.9963 4.3062-2.7217 0.14408-4.499 6.8517-4.4922 4.6036-4.4885-10.706 2.5354-3.846-2.481-8.94 0.79795 7.6122-4.5626-4.7025-3.546-8.2587-1.493-26.336 1.1968-28.377-1.9178 6.6072-4.3432-4.6855 1.9507-3.8905-4.0944zm-30.177 6.853c-0.38239-2.5965-2.7827-0.59019 0 0zm38.413-5.3501c-5.5472 4.1092 3.6607 3.3604 0 0zm-35.167 3.2461c-5.5711 2.0121 3.4623 2.6678 0 0.0001zm-4.5085 2.0439c-3.5955 1.3884 5.3465 4.0436 0 0zm-1.6832 0.54102c-0.85203 1.1592 0.95448 2.0024 0 0zm69.792 10.279c-3.3738 1.0807 2.5644 1.7659 0 0zm0.78148 12.444c1.6431 4.1478 3.2862 8.2957 4.9293 12.444-1.2103-4.2753-1.6602-9.1091-4.9293-12.444zm-65.764 27.592c-5.276 5.0443-13.384 8.0777-14.41 16.23-5.0399 9.2858 0.7307 20.869 9.0911 22.718 4.2026 9.5949 17.531 7.6703 22.511 16.336 10.903 2.6509 26.672 0.47343 27.793-13.261 6.0182-16.31 13.062 9.7161 22.882 9.7722 4.9283-1.5222 7.3337-2.0604 10.615 1.2778 3.2269-2.624 8.7731-1.2205 12.59-5.9441 2.4106-1.3702 5.5762-10.131-1.4904-13.02-6.0476-4.7824-11.198-22.286-19.282-11.598-2.1852-3.091-10.746-6.5889-9.7996-0.39683-5.9388 4.8397-10.637 0.0173-5.7973-4.9212-11.975 1.7572-23.053-0.58733-34.994-0.39733-5.4776 1.5038-14.347 1.2805-6.7855-4.4719-3.4554-4.9865-10.878-6.3787-12.924-12.323zm17.794 13.105c-10.605 2.3083 7.3622 2.8266 0 0zm51.157 4.8091c-1.8534 2.2459 4.1447 1.6865 0 0zm2.1641 1.3225c-2.2169 4.0113 3.0123 0.56457 0 0zm-77.066 20.859c-2.9416 1.2539 1.5631 2.3851 0 0zm102.19 2.2843c0.70007 2.9919 4.89 1.7246 0 0zm-125.94 6.6726c-8.1153 5.5128-20.707 9.8407-24.887 18.094 5.3624 7.5373 9.8599 15.711 12.551 23.686 3.7104 1.483 12.269 11.936 10.232 7.152-2.5481-3.3942 10.374 6.4024 2.5571 2.029-3.4853 5.5478 6.9052 14.76 12.921 6.7048 3.3672-2.554 11.628-6.8865 5.2612 0.0427-6.1533 14.272 11.759 23.915 21.881 23.324-1.5874 5.0386 13.156 3.3429 10.159-3.7873 9.7839 6.2055 10.035-12.581 12.151-18.922 1.0394-4.4329 2.0789-8.8658 3.1183-13.299-1.8907 2.531-9.142 0.33385-9.0029 1.8345-4.9308-4.1092-13.488 3.4394-16.666-0.15139-6.9376-1.54-9.0614-7.5172-9.7385-12.985-8.0942 0.5672-3.6984 0.62023-1.5756-4.5135-5.8695-0.31527-13.837-1.7599-12.141-7.1015-11.401-4.6558-2.2083-15.071-10.818-21.29-1.9309-0.64788-3.9849-0.76872-6.0032-0.8191zm-44.965 12.864c-8.5906-0.99564-7.514 5.9674-13.225 2.9454-10.15 5.7453-20.136-2.7509-30.925-1.3869-29.137 0.25348-51.071 29.092-55.872 56.421-7.3256 13.755 5.3391-0.47789 13.637-2.2011-2.1738-12.195 15.58-25.188 15.597-13.978-2.5714 4.9572 0.56193 35.905 9.3717 42.415 5.6511 7.4113 15.864 7.4385 16.829-3.369 2.9645-7.9415 10.06-14.313 13.028-18.148-6.7024 3.5446-3.7893-6.9034-7.8802-9.2185 6.7387-6.2414-3.489-25.475 0.9672-30.577 1.888 0.82197 19.213-10.243 18.074 3.7696 1.1601 3.5551-8.1178 5.1405-2.0236 8.4334-7.658 4.6644 3.4546 5.3888-3.4265 9.498 3.2525 5.3986 6.0092 9.8328 2.1642 15.028 5.351 2.8796-0.84527 4.956 2.4646 9.8586 1.7773 3.9279 6.2451 0.77777 1.3826 5.4102-1.361 8.392 12.419 11.331 9.2775 18.591 8.5162 3.1381 17.255 14.93 21.647 1.1752 4.3902-6.6425 8.9883-13.158 13.44-19.766-3.4158 1.6723-6.978-2.014-10.4-3.3062 3.1831-7.4422-7.5674-10.669-4.3883-18.695 2.0264-5.5766-2.9418-14.986 1.397-15.442-3.6342-2.8895 2.3455 0.64869-0.43524-4.3354 3.824-1.8179-1.3018-7.1327 5.5906-7.0934-4.774-7.513 7.2864-4.6901 3.0604-10.753-6.3293-3.2127 11.083-14.42-1.0169-12.034-3.5922-0.46385-14.71-3.2873-18.334-3.2428zm68.409 12.564c-5.5938 0.81602-1.0622 2.6709 0 0zm-106.58 10.76c-3.124 2.5075 2.5307 1.9933 0 0zm-0.18025 2.1641c-2.7068 0.23051 3.6024 2.2328 0 0zm116.32 1.9838c-0.61191 2.059 1.5361 0.48789 0 0zm-33.123 9.2575c-1.109 1.0486 0.89934 0.70854 0 0zm-75.743 29.816c0.20716 1.6664-0.15966 0.54064 0 0zm1.3225 0.06c0.48713 1.0641-0.18928 0.14504 0 0zm112.77 2.1641c-3.7913 1.324 3.0671 2.7103 0 0z"
+      style="fill:url(#linearGradient3099)"
+      inkscape:connector-curvature="0"
+  />
+  <g
+      id="g5899"
+      style="stroke:#015a01"
+      transform="matrix(1.9236 0 0 1.9236 215.33 -72.118)"
+    >
+    <path
+        id="path3355"
+        d="m117.95 147.91c2.0616 13.147-6.6428 16.932-10.971 15.996"
+        style="stroke:#015a01;stroke-width:1px;fill:#66cc33"
+        inkscape:connector-curvature="0"
+    />
+    <path
+        id="path4593"
+        d="m247.45 144.66a14.908 15.413 0 0 1 -28.87 1.4092"
+        style="stroke:#015a01;fill:#66cc33"
+        transform="matrix(1.075 0 0 1 -156.26 4.7896)"
+        inkscape:connector-curvature="0"
+    />
+    <path
+        id="path4595"
+        d="m254.4 122.14a13.756 14.188 0 0 1 -9.5956 26.558"
+        style="stroke:#015a01;fill:#66cc33"
+        transform="matrix(.87876 0 0 1 -107.75 4.7896)"
+        inkscape:connector-curvature="0"
+    />
+  </g
+  >
+  <path
+      id="path4619"
+      d="m427.42 204.03a13.577 11.915 0 1 1 -20.903 3.6512"
+      style="stroke:#333333;stroke-width:1.431;fill:url(#linearGradient3922)"
+      inkscape:connector-curvature="0"
+  />
+  <path
+      id="path4564"
+      d="m280.54 469.64c8.6331 3.9392 25.105 1.9993 46.417-3.5705"
+      style="stroke:#015a01;stroke-width:1.7313;fill:none"
+      inkscape:connector-curvature="0"
+  />
+  <path
+      id="path4564-1"
+      d="m257.12 414.7c8.633 3.9392 28.892 5.7864 50.204 0.2166"
+      style="stroke:#015a01;stroke-width:1.7313;fill:none"
+      inkscape:connector-curvature="0"
+  />
+  <path
+      id="path4564-7"
+      d="m241.99 350.59c12.42 7.7263 15.901 10.802 32.109 11.815"
+      style="stroke:#015a01;stroke-width:1.7313;fill:none"
+      inkscape:connector-curvature="0"
+  />
+  <g
+      id="g3342"
+      style="opacity:.45;stroke:#015a01"
+      transform="matrix(1.9236 0 0 1.9236 336.93 -40.977)"
+    >
+    <path
+        id="path3320"
+        d="m238.76 154.03a10.902 13.628 0 1 1 -21.804 0 10.902 13.628 0 1 1 21.804 0z"
+        style="opacity:0.33;stroke:#015a01;fill:#006600"
+        transform="matrix(.99455 -.56691 .64461 .87466 -323.18 128.31)"
+        inkscape:connector-curvature="0"
+    />
+    <path
+        id="path3320-7"
+        d="m-2.4673 124.52c-10.397 7.8672 3.174 25.794 15.402 20.06 11.488-7.4648-3.2008-26.94-15.402-20.06z"
+        style="opacity:0.33;stroke:#015a01;fill:#006600"
+        inkscape:connector-curvature="0"
+    />
+  </g
+  >
+  <path
+      id="path4211-6"
+      d="m403.28 150.64c-7.6918 0.50109-14.793 4.6846-15.089 13.586 0.0687 1.1249 0.23539 2.2293 0.48091 3.3062-3.3184-3.5233-7.4353-6.3133-11.361-7.8148-11.249-6.3111-32.094-3.9016-32.642 12.083 1.2721 20.2 29.984 34.111 46.288 21.701 4.5439-4.3771 5.4815-9.502 4.2681-14.487 8.6484 8.6881 23.31 12.136 32.942 4.5686 10.541-10.48-1.2541-25.962-11.782-30.117-3.6418-2.1086-8.4897-3.126-13.105-2.8253z"
+      style="opacity:.56960;stroke:#015a01;stroke-width:1.9236;fill:#015a01"
+      inkscape:connector-curvature="0"
+  />
+  <path
+      id="rect3395"
+      d="m352.96 116.34c1.9377-0.88782 4.2488 0.0369 5.1819 2.0733 0 0 3.1828 13.713 11.456 25.004 2.1453 6.4622-6.445 8.7127-8.7629 4.015 0 0-0.96847-10.617-11.456-25.004s0.64827-4.7446 3.5811-6.0884z"
+      style="stroke:#424242;stroke-width:1.9236;fill:#474747"
+      inkscape:connector-curvature="0"
+  />
+  <path
+      id="path3415"
+      d="m362.23 112.63a11.734 11.734 0 1 1 -23.468 0 11.734 11.734 0 1 1 23.468 0z"
+      style="stroke:#3c3c3c;stroke-width:2.843;fill:#474747"
+      inkscape:connector-curvature="0"
+  />
+  <path
+      id="path4211"
+      d="m392.01 189.01c-3.4793 7.0669-14.963 8.5306-25.649 3.2693-10.687-5.2613-16.529-15.255-13.05-22.322 3.4793-7.0669 12.924-3.3404 25.649-3.2693 11.911 0.0666 16.529 15.255 13.05 22.322z"
+      style="stroke:#015a01;stroke-width:1.9236;fill:#eeeeee"
+      inkscape:connector-curvature="0"
+  />
+  <path
+      id="path4211-0"
+      d="m428.77 179.39c-2.9322 6.1467-12.61 7.4198-21.616 2.8436s-13.93-13.269-10.998-19.416c2.9322-6.1467 10.386-3.7125 21.616-2.8436 10.072 0.77931 13.93 13.269 10.998 19.416z"
+      style="stroke:#015a01;stroke-width:1.9236;fill:#eeeeee"
+      inkscape:connector-curvature="0"
+  />
+  <path
+      id="path4292"
+      d="m386.95 174.62a6.5536 6.2915 0 1 1 -13.107 0 6.5536 6.2915 0 1 1 13.107 0z"
+      style="stroke:url(#linearGradient3078);stroke-width:3.2702;fill:#212121"
+      inkscape:connector-curvature="0"
+  />
+  <path
+      id="path4239"
+      d="m420.28 260.08c-66.519-0.14389-41.52 15.048-88.371 22.3-26.994 12.355 2.2541 36.023-28.249 57.531-12.191 24.257 25.422 32.975 14.127 56.988 1.0942 17.721 28.212 17.044 15.87 35.106 0.0766 27.295 34.615 32.862 24.995 61.134 5.8224 58.494 26.558 115.42 56.87 165.61 24.209 15.049 1.4009 44.842 26.58 58.256-15.417 16.017-2.3081 41.461-16.414 58.695-15.858 27.915-52.033 71.541-86.055 70.198-32.5 6.1626-62.672-8.1012-85.514 18.724-21.068 27.152 26.849 29.08 43.943 22.231 17.663-15.932 35.21-5.8757 56.135-3.4617 21.996 1.5603 46.031-3.3542 62.056-19.468 25.603 0.82289 58.065-11.778 61.136-40.697 25.458-6.1126 48.466-32.949 36.241-59.636 7.3419-17.164 35.37-42.277 20.025-68.406 16.566-22.139-13.544-40.219-11.646-57.89 1.5199-24.036-27.484-32.739-16.422-57.827-5.8796-56.776-34.65-108.99-69.858-152.93-17.715-10.826-17.772-37.67-38.852-46.975-1.5774-13.237-0.0816-35.222-15.13-46.081 12.85-21.034-11.481-49.555 20.581-57.404 9.3201-6.8252 11.765-6.1505 17.952-15.995z"
+      style="opacity:0.16;stroke-opacity:.45631;stroke:#015a01;stroke-width:1.9236;fill:#2f5a01"
+      inkscape:connector-curvature="0"
+  />
+  <path
+      id="path3079"
+      d="m364.39 291.24-33.123 5.2299c17.189-1.0582 41.41 10.702 52.138 2.1443 2.808-7.6518-14.418-4.5507-19.015-7.3742zm18.755 37.451c-2.2259 0.22145-5.1591 0.95307-5.9513 0.18025-15.899 0.46696-38.753 1.6887-50.255 5.9512l31.379 7.9951c9.7854-5.7642 36.092 1.6511 26.45-11.301 2.0908-2.7267 0.60283-3.0468-1.6231-2.8253zm15.269 47.37c-23.53 1.4179-46.945 4.2343-70.513 5.1698 18.484 2.734 36.866 6.7977 55.605 3.5467 8.8493-2.8771 26.726 3.8827 14.908-8.7165zm30.418 42.621c-17.609 2.141-22.028 0.73167-40.577 1.082-12.172-0.34942-44.69 0.34774-44.244 2.9456 15.711 2.0699 31.36 6.1021 47.189 2.4647 8.7742-3.2047 54.756 6.4248 37.631-6.4923zm27.472 33.664c-30.006 4.477-61.241 1.0513-90.411 10.881l33.363 3.9074c16.451-8.8604 54.588-1.713 59.693-10.941z"
+      style="opacity:0.22;fill:#816647"
+      inkscape:connector-curvature="0"
+  />
+  <path
+      id="path3069"
+      d="m497 602.56c-7.1344-0.10715-15.756 1.4446-21.4 0.36068-22.649 0.0744-44.368 7.0197-66.305 11.782 15.165 0.92271 30.594 7.2816 45.446 1.6231 15.954-6.5805 41.892-5.3025 52.539-10.82-2.28-2.2092-5.9988-2.8813-10.279-2.9456zm13.526 44.965c-14.177-0.29825-32.495 2.8674-43.582 0.9017l-33.002 5.2299c31.72-0.0489 63.44 0.025 95.16 0-3.034-4.5231-10.069-5.9527-18.575-6.1316zm-6.9131 48.692c-4.4958-0.07-8.9817 0.18755-13.526 1.0219l-32.522 8.1755c21.543-3.5497 43.01 2.8464 64.562-1.2023 11.962 2.2157 20.66-8.7808 3.9074-6.7928-7.5008-0.17505-14.929-1.0857-22.422-1.2023zm-38.413 61.556-29.576 7.9951c23.849 2.8363 47.753 6.2143 71.656 1.5028 9.7438-1.574 4.5667-13.919-3.6669-5.5906-12.552 1.8631-25.699-3.4034-38.413-3.9074zm-33.063 63.961-33.123 5.2299c26.419-2.515 51.986 6.292 78.328 4.6889 5.416-14.802-36.343-7.5721-45.206-9.9188zm-38.773 30.297c-10.945 0.79458-21.774 3.1335-32.642 4.8091 19.66-1.4424 39.974 13.755 57.409 7.5743 8.563 0.63037 33.329-2.7394 11.842-4.9293-12.149-2.6227-23.995-7.7076-36.609-7.4541z"
+      style="opacity:0.22;fill:#816647"
+      inkscape:connector-curvature="0"
+  />
+  <path
+      id="path4248"
+      d="m304.45 326.16c-10.886 1.9668-8.3996 22.052 3.0657 22.302 8.4655 2.3252 15.632 3.8451 26.342 0.93191 11.164-8.7407-4.137-14.974-12.453-12.714-16.156 1.4022-6.8856-8.0342-16.955-10.52zm5.9513 53.08c-15.564 5.843-1.7432 25.357 11.602 21.821 10.833 0.87303 16.443-4.8233 22.422-7.514 13.366-13.213-9.2008-14.904-16.952-6.0115-12.514 4.0968-8.0604-5.8985-17.072-8.2956zm50.736 40.877c-10.278-0.31204-16.719 10.516-26.51 10.099-15.413-2.7144-11.509 17.881 2.1641 13.285 10.433 1.7385 13.941-8.4649 23.925-9.3175 8.0756-0.63032 9.6002-13.529 0.4208-14.067zm19.717 50.916c-7.2374 2.8166-15.739 11.599-24.045 7.2134-17.483-12.77-11.249 18.608-0.9017 14.127 9.0281 2.152 20.787-3.3889 25.428-6.7929 3.6464 0.5125 11.826-13.3-0.4812-14.547zm-4.6288 17.373c-1.7574 1.0636 1.6989-0.60931 0 0zm48.632 150.16c-16.235 5.2206 1.8954 25.317 13.465 25.067 10.318 0.82553 21.684 0.34623 28.734-8.1756 9.2486-23.358-30.97 7.1221-37.196-14.127l-1.4512-1.5153-3.5525-1.2495zm7.3339 67.027c-12.786 3.2794-2.8409 22.219 3.7268 28.433 9.8728 6.7063 22.122 6.7938 33.616 5.3801 11.174-8.7148-4.1487-14.989-12.453-12.714-8.0003 1.0293-16.762-3.3111-17.255-12.143-1.5302-3.6836-2.4803-8.882-7.6346-8.9566zm12.864 32.822-0.60114-0.30057zm-60.354 65.344c-11.482 3.6582-6.5407 21.416-0.12042 28.373 4.4848 5.2208 7.8728 12.227 12.203 15.208 5.7158 3.3546 9.6709 8.4533 16.776 5.4158 9.556-6.9294-8.1989-14.998-5.8352-13.892-5.8848-2.6902-9.8857-12.655-15.028-18.034-3.5246-5.6389 2.1409-16.518-7.995-17.072zm11.963 43.462c-2.0547-2.2638-0.50695-0.13639 0 0zm-91.313-6.3119c-10.661 4.691-10.693 19.058-10.219 29.212-1.4886 10.106 2.8386 20.308 12.804 24.048 16.495 8.5379 9.8149-16.676 2.104-14.427-4.5-4.5727 0.28154-13.545-1.6227-19.356-0.47777-6.5505 10.803-17.505-3.0662-19.477zm-75.623 3.2461c-8.979 2.7235-15.863 14.021-15.509 26.029-2.0087 9.593 3.4176 22.027 10.4 23.865 15.634 10.556 16.949-11.274 2.8854-14.668-0.47929-9.208-0.56797-19.474 8.1393-25.047 3.0901-4.2113-0.79895-10.666-5.9153-10.179zm172.17 6.372c0.43358 0.0194 0.0323 0.14581 0 0zm-92.816 5.5906c0.28585-0.0587-0.47684 0.46032 0 0z"
+      style="stroke:#816647;stroke-width:2.5007;fill:#ffff99"
+      inkscape:connector-curvature="0"
+  />
+  <path
+      id="rect3395-8"
+      d="m403.43 108.33c2.1038 0.3421 3.508 2.3975 3.1484 4.6084 0 0-4.9958 13.162-4.4143 27.147-1.8182 6.5617-10.206 3.6454-9.514-1.547 0 0 5.1098-9.3565 4.4143-27.147-0.69553-17.79 3.1814-3.5792 6.3655-3.0614z"
+      style="stroke:#424242;stroke-width:1.9236;fill:#474747"
+      inkscape:connector-curvature="0"
+  />
+  <path
+      id="path3415-7"
+      d="m413.2 110.41a11.734 11.734 0 1 1 -19.49 -13.077 11.734 11.734 0 1 1 19.49 13.077z"
+      style="stroke:#3c3c3c;stroke-width:2.843;fill:#474747"
+      inkscape:connector-curvature="0"
+  />
+  <path
+      id="path4292-3"
+      d="m415.23 166.9a6.5536 6.2915 0 1 1 -13.107 0 6.5536 6.2915 0 1 1 13.107 0z"
+      style="stroke:url(#linearGradient3069);stroke-width:3.2702;fill:#212121"
+      inkscape:connector-curvature="0"
+  />
+  <metadata
+    >
+    <rdf:RDF
+      >
+      <cc:Work
+        >
+        <dc:format
+          >image/svg+xml</dc:format
+        >
+        <dc:type
+            rdf:resource="http://purl.org/dc/dcmitype/StillImage"
+        />
+        <cc:license
+            rdf:resource="http://creativecommons.org/licenses/publicdomain/"
+        />
+        <dc:publisher
+          >
+          <cc:Agent
+              rdf:about="http://openclipart.org/"
+            >
+            <dc:title
+              >Openclipart</dc:title
+            >
+          </cc:Agent
+          >
+        </dc:publisher
+        >
+        <dc:title
+          >Caterpillar 4 LDAP</dc:title
+        >
+        <dc:date
+          >2012-04-08T15:30:21</dc:date
+        >
+        <dc:description
+          >The OpenLDAP caterpillar mascot . This is a Vector inspired by the "low res" bitmap at the homepage (as of 2012/04)</dc:description
+        >
+        <dc:source
+          >https://openclipart.org/detail/169427/caterpillar-4-ldap-by-dynnamitt</dc:source
+        >
+        <dc:creator
+          >
+          <cc:Agent
+            >
+            <dc:title
+              >dynnamitt</dc:title
+            >
+          </cc:Agent
+          >
+        </dc:creator
+        >
+        <dc:subject
+          >
+          <rdf:Bag
+            >
+            <rdf:li
+              >LDAP</rdf:li
+            >
+            <rdf:li
+              >caterpillar</rdf:li
+            >
+            <rdf:li
+              >green</rdf:li
+            >
+            <rdf:li
+              >happy</rdf:li
+            >
+          </rdf:Bag
+          >
+        </dc:subject
+        >
+      </cc:Work
+      >
+      <cc:License
+          rdf:about="http://creativecommons.org/licenses/publicdomain/"
+        >
+        <cc:permits
+            rdf:resource="http://creativecommons.org/ns#Reproduction"
+        />
+        <cc:permits
+            rdf:resource="http://creativecommons.org/ns#Distribution"
+        />
+        <cc:permits
+            rdf:resource="http://creativecommons.org/ns#DerivativeWorks"
+        />
+      </cc:License
+      >
+    </rdf:RDF
+    >
+  </metadata
+  >
+</svg
+>
diff --git a/app/assets/ico/vendor/podman-icon.svg b/app/assets/ico/vendor/podman-icon.svg
new file mode 100644
index 0000000..05d3144
--- /dev/null
+++ b/app/assets/ico/vendor/podman-icon.svg
@@ -0,0 +1,8 @@
+<svg width="24" height="24" viewBox="0 0 24 24" fill="currentColor" stroke="currentColor" xmlns="http://www.w3.org/2000/svg">
+<path d="M7.24718 12.9C6.99332 12.9003 6.74996 13.0068 6.57057 13.196C6.39117 13.3852 6.29041 13.6417 6.29041 13.9092C6.29041 14.1766 6.39117 14.4331 6.57057 14.6224C6.74996 14.8116 6.99332 14.9181 7.24718 14.9184C7.50108 14.9181 7.74451 14.8117 7.92397 14.6225C8.10343 14.4332 8.20423 14.1767 8.20423 13.9092C8.20423 13.6417 8.10347 13.3852 7.92407 13.196C7.74468 13.0068 7.50103 12.9003 7.24718 12.9ZM16.9266 12.9C16.6728 12.9003 16.4294 13.0068 16.25 13.196C16.0706 13.3852 15.9698 13.6417 15.9698 13.9092C15.9698 14.1766 16.0706 14.4331 16.25 14.6224C16.4294 14.8116 16.6728 14.9181 16.9266 14.9184C17.0525 14.9186 17.1773 14.8927 17.2937 14.8421C17.4101 14.7915 17.5159 14.7172 17.6051 14.6234C17.6942 14.5297 17.7649 14.4184 17.8132 14.2958C17.8614 14.1733 17.8862 14.0419 17.8862 13.9092C17.8862 13.7765 17.8614 13.6451 17.8132 13.5226C17.7649 13.4 17.6942 13.2887 17.6051 13.1949C17.5159 13.1012 17.4101 13.0269 17.2937 12.9763C17.1773 12.9257 17.0525 12.8998 16.9266 12.9Z" stroke-width="0.67"/>
+<path d="M8.85996 13.163L5.29985 14.1175L5.40183 14.499L8.96251 13.5445L8.85996 13.163ZM15.5975 13.163L15.4949 13.5445L19.0547 14.499L19.1573 14.1175L15.5975 13.163ZM9.21631 13.7382L5.63587 15.8061L5.83352 16.1479L9.41339 14.0802L9.21631 13.7382ZM15.2431 13.7382L15.0455 14.0802L18.6256 16.1479L18.8233 15.8061L15.2431 13.7382ZM9.47813 14.4242L7.01259 16.8932C7.18045 16.9144 7.34029 16.9411 7.49298 16.9709L9.75743 14.7033L9.47813 14.4242ZM14.981 14.4242L14.702 14.7033L17.7983 17.8045C17.9736 17.793 18.1527 17.7853 18.334 17.7815L14.981 14.4242ZM9.59787 15.3232L8.46436 17.2883C8.58209 17.3464 8.69753 17.4103 8.80954 17.4808L9.94019 15.5202L9.59787 15.3232ZM14.8615 15.3232L14.5192 15.5202L16.0337 18.1465C16.0618 18.1353 16.089 18.1221 16.1177 18.1118C16.2065 18.0766 16.3082 18.0451 16.4147 18.0156L14.8615 15.3232Z" stroke-width="0.67"/>
+<path d="M12.1889 9.97955C10.3381 9.97955 8.81726 11.4181 8.81726 13.2028C8.81726 14.9874 10.3381 16.426 12.1889 16.426C14.04 16.426 15.5608 14.9874 15.5608 13.2028C15.5608 11.4181 14.0394 9.97955 12.1889 9.97955ZM12.1889 10.5722C13.7352 10.5722 14.9684 11.7547 14.9684 13.2028C14.9684 14.6511 13.7352 15.833 12.1889 15.833C10.6429 15.833 9.40937 14.6511 9.40937 13.2028C9.40937 11.7547 10.6429 10.5722 12.1889 10.5722Z" stroke-width="0.67"/>
+<path d="M11.785 3C10.3578 3 8.9685 3.15583 8.07332 3.51076C5.70059 4.38245 3.91165 6.72625 3.3797 9.54815C2.90647 11.7868 2.781 13.68 2.5292 15.3942C2.42178 16.127 2.28915 16.8251 2.10066 17.5074C1.61111 19.4159 1 20.6381 1 20.6381H1.61111C1.61111 20.6381 1.75909 20.8956 2.83027 17.0408C2.94622 16.5248 3.04178 16.0045 3.11673 15.481C3.37311 13.733 3.49342 11.8622 3.9572 9.66961L3.96006 9.66675V9.66216C4.45736 7.01529 6.13887 4.84794 8.28158 4.06362L8.28444 4.06133H8.28874C9.03496 3.76456 10.4014 3.59268 11.785 3.59297C13.1666 3.59297 14.5819 3.75997 15.4545 4.06362C17.5972 4.84766 19.2787 7.015 19.7754 9.66188L19.7783 9.66761V9.66961C20.2418 11.8622 20.365 13.733 20.6213 15.481C20.7368 16.2682 20.8678 17.0364 21.1026 17.7827C21.8087 20.027 22.3889 20.6381 22.3889 20.6381H23C23 20.6381 22.1741 19.174 21.8087 18.0775C21.5211 17.2144 21.3447 16.3321 21.2069 15.3942C20.9556 13.6812 20.831 11.7894 20.3587 9.55331C19.8276 6.72654 18.0375 4.37586 15.6602 3.5056H15.655C14.6627 3.15898 13.2144 3.00029 11.785 3ZM7.32481 6.57013C7.0205 6.56847 6.71991 6.63696 6.44637 6.7703C6.17283 6.90365 5.9337 7.09824 5.74757 7.33899L5.56624 7.57216L6.03775 7.93425L6.2185 7.69849C6.34221 7.54136 6.49794 7.41235 6.67535 7.32004C6.85276 7.22773 7.04778 7.17423 7.24746 7.1631C7.61986 7.14735 8.00658 7.29716 8.27126 7.55985L8.4821 7.77068L8.90119 7.34901L8.69035 7.14076C8.32585 6.78101 7.8369 6.5761 7.32481 6.57013ZM16.8845 6.57013C16.3723 6.57625 15.8825 6.78081 15.5181 7.14076L15.3073 7.34901L15.7241 7.77068L15.9352 7.55985C16.0704 7.42824 16.2307 7.32527 16.4066 7.2571C16.5825 7.18893 16.7704 7.15696 16.959 7.1631C17.3529 7.18029 17.7496 7.38568 17.9902 7.69878L18.1716 7.93425L18.6402 7.57216L18.4589 7.33899C18.2733 7.09835 18.0347 6.90379 17.7616 6.77043C17.4885 6.63708 17.1884 6.56854 16.8845 6.57013ZM12.1889 11.3755C11.9717 11.3755 11.7938 11.4422 11.646 11.4921C11.4979 11.5422 11.3796 11.5763 11.2885 11.5763C11.1261 11.5763 10.9666 11.6654 10.8798 11.7699C10.7932 11.8742 10.7523 11.9819 10.7208 12.0845C10.6577 12.2887 10.6271 12.4964 10.5993 12.5686C10.5357 12.733 10.5964 12.8639 10.6469 12.9498C10.697 13.0358 10.7583 13.1034 10.8273 13.1733C10.966 13.3125 11.1413 13.452 11.3183 13.5821C11.4997 13.715 11.6816 13.8359 11.8168 13.9241L11.8096 14.0433C11.7429 14.0977 11.5804 14.2418 11.3112 14.3329C11.1519 14.3867 10.9915 14.4059 10.8523 14.3704C10.7339 14.34 10.6162 14.2358 10.4953 14.0779C10.5031 14.0155 10.5059 13.99 10.52 13.8871C10.5449 13.7072 10.581 13.4898 10.5973 13.4254L10.0218 13.2816C9.98744 13.4191 9.95822 13.6196 9.93244 13.8055C9.90665 13.9911 9.88775 14.1501 9.88775 14.1501L9.87543 14.2561L9.93244 14.3452C10.1413 14.6735 10.4197 14.8726 10.7062 14.9456C10.9926 15.0189 11.2705 14.9745 11.5025 14.8963C11.8033 14.7941 12.0485 14.6299 12.1837 14.5268C12.3192 14.6299 12.563 14.7946 12.8629 14.8963C13.0949 14.9748 13.3699 15.0189 13.6564 14.9456C13.9429 14.8723 14.2216 14.6735 14.4301 14.3452L14.4874 14.2564L14.4748 14.1501C14.4748 14.1501 14.4559 13.9911 14.4301 13.8055C14.4043 13.6193 14.3745 13.4191 14.3407 13.2816L13.7655 13.4254C13.7816 13.4898 13.8177 13.7072 13.8429 13.8871C13.8566 13.9885 13.8601 14.0132 13.8672 14.0756C13.7458 14.2349 13.6295 14.34 13.5103 14.3707C13.3711 14.4059 13.211 14.3867 13.0517 14.3329C12.7824 14.2418 12.6197 14.0977 12.5532 14.0433L12.5481 13.9318C12.6853 13.843 12.8712 13.7198 13.0588 13.5823C13.2359 13.452 13.4112 13.3122 13.5501 13.1727C13.6189 13.1031 13.6807 13.0355 13.7306 12.9498C13.7813 12.8639 13.8414 12.733 13.7779 12.5683C13.7501 12.4967 13.7171 12.2887 13.6541 12.0842C13.6226 11.9822 13.5848 11.8739 13.498 11.7694C13.4112 11.6651 13.2516 11.5763 13.0889 11.5763C12.9981 11.5763 12.8798 11.5419 12.732 11.4921C12.5839 11.4422 12.4063 11.3755 12.1889 11.3755ZM12.1889 11.9682C12.2762 11.9682 12.3923 12.002 12.5412 12.0521C12.6781 12.0985 12.8503 12.1495 13.0465 12.1589C13.0531 12.169 13.0709 12.2019 13.0889 12.2606C13.1207 12.3638 13.1531 12.5213 13.1978 12.6746C13.1835 12.694 13.1663 12.7184 13.1287 12.7562C13.0308 12.8547 12.8709 12.9828 12.7068 13.1031C12.4547 13.2884 12.2972 13.385 12.1889 13.4529C12.0814 13.3853 11.9207 13.2896 11.6678 13.1034C11.5037 12.9831 11.347 12.8547 11.249 12.7562C11.2112 12.7184 11.1946 12.694 11.1802 12.6746C11.2244 12.5213 11.257 12.364 11.2885 12.2606C11.2985 12.2251 11.3128 12.1909 11.3312 12.1589C11.5272 12.1498 11.697 12.0985 11.8342 12.0521C11.9826 12.002 12.1018 11.9682 12.1889 11.9682Z" stroke-width="0.67"/>
+<path d="M7.30906 8.88614C7.07464 8.88624 6.84264 8.93362 6.62695 9.02547C6.41127 9.11732 6.21633 9.25173 6.0538 9.42067C5.84978 9.62964 5.69897 9.88459 5.61409 10.164C5.55185 10.3678 5.52567 10.5809 5.53674 10.7937C5.55062 11.0726 5.62806 11.3446 5.76315 11.5891C5.89824 11.8335 6.08741 12.0438 6.3162 12.2039C6.43504 12.2861 6.56346 12.3536 6.69862 12.4047C7.12065 12.5641 7.58817 12.5528 8.00201 12.3732C8.16094 12.3044 8.30875 12.2123 8.44057 12.0999C8.59535 11.9694 8.72706 11.8138 8.83016 11.6396C9.04723 11.2747 9.13087 10.8458 9.06677 10.4261C9.03125 10.1917 8.95081 9.96635 8.82987 9.76242C8.69661 9.53878 8.51722 9.3461 8.30365 9.19723C8.1847 9.11509 8.05618 9.04776 7.92094 8.99671C7.7255 8.92332 7.51783 8.88586 7.30906 8.88614ZM16.8968 8.88614C16.6882 8.88658 16.4814 8.92432 16.2861 8.99757C16.1238 9.05845 15.9716 9.14322 15.8344 9.24908C15.674 9.37189 15.5356 9.52084 15.4247 9.68966C15.1571 10.0945 15.0611 10.5891 15.1577 11.0647C15.2274 11.4104 15.3953 11.7286 15.6413 11.9813C15.762 12.1049 15.8997 12.2107 16.0503 12.2953C16.2031 12.3803 16.3677 12.4421 16.5388 12.4786C16.7162 12.5163 16.8984 12.5256 17.0787 12.5064C17.4288 12.4699 17.7594 12.3278 18.0269 12.0991C18.2037 11.9495 18.3501 11.7675 18.4583 11.5628C18.629 11.2422 18.7003 10.878 18.6631 10.5167C18.6363 10.2505 18.5518 9.99346 18.4156 9.76328C18.2676 9.51479 18.0629 9.3049 17.8181 9.15083C17.6701 9.05879 17.5094 8.9891 17.3411 8.944C17.1963 8.90551 17.0467 8.88605 16.8968 8.88614ZM7.30906 9.47624C7.36947 9.47641 7.43036 9.48101 7.4901 9.48999C7.6252 9.51084 7.75549 9.55566 7.87482 9.62234C7.97591 9.6784 8.06818 9.74906 8.14867 9.83203C8.258 9.944 8.34458 10.0761 8.40362 10.221C8.45809 10.3534 8.4892 10.4942 8.49557 10.6373C8.50241 10.7828 8.48479 10.9284 8.44344 11.0681C8.39789 11.2192 8.32389 11.3601 8.22544 11.4835C8.12855 11.6038 8.00954 11.7044 7.87482 11.7799C7.64786 11.9056 7.38545 11.952 7.12917 11.9117C6.83915 11.8666 6.57695 11.7134 6.39526 11.4829C6.29647 11.3598 6.22253 11.2188 6.17755 11.0675C6.14172 10.9486 6.12376 10.825 6.12427 10.7009C6.12453 10.5767 6.14257 10.4532 6.17784 10.3342C6.22337 10.1832 6.29726 10.0424 6.39555 9.91911C6.49208 9.79899 6.61071 9.69845 6.74503 9.62291C6.8996 9.53697 7.07173 9.4874 7.24833 9.47796C7.26838 9.47682 7.28872 9.47624 7.30906 9.47624ZM16.8968 9.47624C17.0164 9.47639 17.1352 9.49484 17.2492 9.53096C17.3964 9.5778 17.5328 9.65367 17.6502 9.75411C17.7689 9.85441 17.8669 9.97679 17.939 10.1145C18.0145 10.2574 18.0611 10.4138 18.0762 10.5748C18.1001 10.8208 18.0523 11.0684 17.9387 11.2878C17.8662 11.4251 17.7683 11.5474 17.6502 11.6482C17.5622 11.7228 17.4638 11.7841 17.358 11.8304C17.2126 11.8936 17.0557 11.9263 16.8971 11.9263C16.7385 11.9263 16.5816 11.8936 16.4362 11.8304C16.2946 11.7692 16.1666 11.6805 16.0595 11.5694C15.9504 11.4574 15.864 11.3253 15.8051 11.1804C15.7508 11.0481 15.7198 10.9073 15.7135 10.7644C15.7084 10.6598 15.716 10.555 15.7361 10.4522C15.7671 10.2959 15.8277 10.147 15.9146 10.0134C15.9994 9.88421 16.1081 9.77242 16.2348 9.68393C16.3463 9.6068 16.4702 9.54953 16.6012 9.51463C16.6977 9.48913 16.797 9.47623 16.8968 9.47624Z" stroke-width="0.67"/>
+<path d="M6.81606 9.51578C6.62295 9.51562 6.43768 9.59519 6.30098 9.737C6.16427 9.87881 6.08731 10.0712 6.08702 10.272C6.08681 10.3717 6.10551 10.4704 6.14205 10.5625C6.1786 10.6547 6.23228 10.7384 6.3 10.8089C6.36773 10.8794 6.44818 10.9354 6.53673 10.9735C6.62529 11.0116 6.72021 11.0312 6.81606 11.0311C6.91191 11.0312 7.00683 11.0116 7.09539 10.9735C7.18394 10.9354 7.26439 10.8794 7.33212 10.8089C7.39984 10.7384 7.45352 10.6547 7.49007 10.5625C7.52661 10.4704 7.54531 10.3717 7.5451 10.272C7.5448 10.0712 7.46785 9.87881 7.33114 9.737C7.19444 9.59519 7.00917 9.51562 6.81606 9.51578ZM16.399 9.51578C16.2058 9.51562 16.0206 9.59519 15.8839 9.737C15.7472 9.87881 15.6702 10.0712 15.6699 10.272C15.6697 10.3717 15.6884 10.4704 15.7249 10.5625C15.7615 10.6547 15.8152 10.7384 15.8829 10.8089C15.9506 10.8794 16.0311 10.9354 16.1196 10.9735C16.2082 11.0116 16.3031 11.0312 16.399 11.0311C16.4948 11.0311 16.5896 11.0115 16.6781 10.9733C16.7666 10.9352 16.847 10.8792 16.9146 10.8087C16.9823 10.7382 17.0359 10.6545 17.0724 10.5624C17.109 10.4703 17.1276 10.3716 17.1274 10.272C17.1271 10.0714 17.0502 9.879 16.9137 9.73721C16.7771 9.59542 16.592 9.51578 16.399 9.51578Z" stroke-width="0.67"/>
+</svg>
diff --git a/app/assets/ico/vendor/podman.svg b/app/assets/ico/vendor/podman.svg
new file mode 100644
index 0000000..4b0af51
--- /dev/null
+++ b/app/assets/ico/vendor/podman.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 128"><path fill="#3c6eb4" d="M93.188 59.803c.148.927.3 1.854.482 2.76h8.955v-2.76zm1.484 6.896c.185.634.381 1.265.598 1.893.52.259 1.027.548 1.517.87h11.352v-2.763zm-18.431 1.282c-.426.155-.843.336-1.252.533v.004c.41-.198.825-.382 1.252-.537zm-41.248 34.57v2.76H68.15v-2.76zm19.31 6.896v2.752H81.6v-2.752z"/><path fill="#ccc" d="M61.114 16.26c-4.91 0-9.721.567-12.586 1.707-7.89 2.888-13.95 10.775-15.746 20.33-2.365 11.186-2.224 19.941-4.572 28.178a13.589 13.589 0 0 1 3.529-1.94c1.834-.726 4.909-1.09 8.049-1.09 3.14 0 6.35.365 8.431 1.09 4.571 1.67 8.177 5.96 9.67 11.284h9.719c1.991-3.681 5.03-6.523 8.633-7.838 3.919-1.554 13.165-1.55 17.617 0 .483.176.952.39 1.414.619-3.062-8.866-2.673-18.151-5.242-30.303-1.795-9.555-7.857-17.442-15.746-20.33-3.254-1.136-8.261-1.706-13.17-1.707Z"/><path fill="#e7e8e9" d="M45.275 49.787a3.344 3.523 0 0 0-3.34 3.523 3.344 3.523 0 0 0 3.34 3.523 3.344 3.523 0 0 0 3.341-3.523 3.344 3.523 0 0 0-3.34-3.523zm33.79 0a3.344 3.523 0 0 0-3.34 3.523 3.344 3.523 0 0 0 3.34 3.523 3.344 3.523 0 0 0 3.35-3.523 3.344 3.523 0 0 0-3.35-3.523z"/><path fill="#a7a9ac" d="m50.905 50.705-12.428 3.332.356 1.332 12.43-3.332zm23.52 0-.358 1.332 12.427 3.332.358-1.332zm-22.276 2.008L39.65 59.932l.69 1.193 12.497-7.218zm21.039 0-.69 1.194 12.498 7.218.69-1.193zm-20.125 2.395-8.607 8.619c.586.074 1.144.167 1.677.271l7.905-7.916zm19.21 0-.974.974 10.809 10.826c.612-.04 1.237-.067 1.87-.08zm-18.792 3.138-3.957 6.86c.411.203.814.426 1.205.672l3.947-6.844zm18.375 0-1.195.688 5.287 9.168c.098-.039.193-.085.293-.121.31-.123.665-.233 1.037-.336z"/><path fill="#fff" d="M73.261 50.84a10.736 10.217 0 0 1-10.736 10.218A10.736 10.217 0 0 1 51.788 50.84a10.736 10.217 0 0 1 10.737-10.217A10.736 10.217 0 0 1 73.26 50.84Z"/><path fill="#808080" d="M67.107 48.998c-.36-.933-.36-2.799-1.44-2.799s-2.08-.7-3.142-.7c-1.063 0-2.06.7-3.142.7-1.08 0-1.08 1.866-1.44 2.8-.36.932 4.582 3.964 4.582 3.964s4.942-3.032 4.582-3.965z"/><path fill="#3c6eb4" d="M57.399 74.29c.33.886.59 1.81.793 2.761h8.799c.443-.973.958-1.897 1.535-2.762zm44.177.001a19.673 19.673 0 0 1 1.532 2.76h11.072v-2.76z"/><path fill="#ccc" d="M39.789 63.445c-3.14 0-6.216.364-8.05 1.09-5.046 1.844-8.917 6.878-10.065 12.975-.6 2.826-.945 5.391-1.238 7.807h39.086c-.293-2.416-.63-4.98-1.23-7.807-1.147-6.097-5.027-11.13-10.074-12.974-2.082-.725-5.29-1.09-8.43-1.09Z"/><path fill="#e7e8e9" d="M29.663 84.84a2.14 2.248 0 0 0-1.255.477h2.56a2.14 2.248 0 0 0-1.305-.476zm21.62 0a2.14 2.248 0 0 0-1.256.477h2.562a2.14 2.248 0 0 0-1.307-.476z"/><path fill="#a7a9ac" d="m33.202 85.187-.484.13h.52zm15.172 0-.035.13h.52z"/><path fill="#fff" d="M40.698 79a6.868 6.52 0 0 0-6.846 6.317h13.682A6.868 6.52 0 0 0 40.698 79Z"/><path fill="#808080" d="M40.698 82.106c-.68 0-1.317.45-2.008.45-.691 0-.696 1.188-.926 1.783-.08.208.268.583.735.978h4.396c.468-.395.808-.77.727-.978-.23-.595-.226-1.783-.917-1.783-.69 0-1.327-.45-2.007-.45z"/><path fill="#892ca0" d="m91.736 1.467-55.738.164a1.38 1.38 0 0 0-1.073.52L.295 45.883a1.38 1.38 0 0 0-.26 1.16l12.56 54.363a1.38 1.38 0 0 0 .753.935l50.285 24.061a1.38 1.38 0 0 0 1.195-.01l50.148-24.355a1.38 1.38 0 0 0 .744-.943l12.247-54.432a1.38 1.38 0 0 0-.268-1.16L92.82 1.977a1.38 1.38 0 0 0-1.083-.51Zm-.657 2.76 34.05 42.48-11.954 53.142-48.945 23.776-49.091-23.482L2.875 47.07 36.673 4.383Z"/><path fill="#ccc" d="M106.644 95.737c-.606-4.124-.9-8.61-2.019-13.887-1.228-6.518-5.373-11.9-10.768-13.87-4.452-1.55-13.697-1.554-17.616 0-5.395 1.97-9.54 7.352-10.768 13.87-1.118 5.278-1.413 9.763-2.019 13.887"/><path fill="#e7e8e9" d="M74.02 89.688a2.287 2.404 0 0 0-2.286 2.406A2.287 2.404 0 0 0 74.02 94.5a2.287 2.404 0 0 0 2.285-2.406 2.287 2.404 0 0 0-2.285-2.406zm23.11 0a2.287 2.404 0 0 0-2.286 2.406A2.287 2.404 0 0 0 97.13 94.5a2.287 2.404 0 0 0 2.285-2.406 2.287 2.404 0 0 0-2.285-2.406z"/><path fill="#a7a9ac" d="m77.814 90.104-8.5 2.277.358 1.332 8.498-2.277zm16.196 0-.358 1.332 8.5 2.277.358-1.332zm-15.4 1.392-8.544 4.926.688 1.193 8.543-4.924zm14.605 0-.69 1.195 8.543 4.924.69-1.193z"/><path fill="#fff" d="M93.157 90.41a7.343 6.97 0 0 1-7.342 6.97 7.343 6.97 0 0 1-7.343-6.97 7.343 6.97 0 0 1 7.343-6.97 7.343 6.97 0 0 1 7.342 6.97z"/><path fill="#808080" d="M88.948 89.152c-.246-.636-.246-1.91-.985-1.91-.738 0-1.42-.476-2.148-.476-.727 0-1.41.477-2.149.477-.738 0-.738 1.273-.985 1.91-.246.636 3.134 2.704 3.134 2.704s3.38-2.068 3.133-2.705z"/><path fill="#60605b" d="M62.526 39.592c-6.461 0-11.77 5.022-11.77 11.252s5.309 11.252 11.77 11.252c6.462 0 11.771-5.022 11.771-11.252s-5.311-11.252-11.771-11.252zm0 2.069c5.398 0 9.703 4.128 9.703 9.183 0 5.056-4.305 9.182-9.703 9.182-5.397 0-9.703-4.126-9.703-9.182 0-5.055 4.306-9.183 9.703-9.183zm-21.828 36.3c-4.254 0-7.78 3.26-7.895 7.356h2.069c.112-2.92 2.637-5.288 5.826-5.288 3.19 0 5.712 2.368 5.824 5.288h2.068c-.113-4.095-3.64-7.356-7.892-7.356zm45.119 4.447c-4.585 0-8.38 3.56-8.38 7.998 0 4.44 3.795 8.006 8.38 8.006 4.586 0 8.379-3.567 8.379-8.006 0-4.438-3.793-7.998-8.38-7.998zm0 2.069c3.525 0 6.31 2.667 6.31 5.93 0 3.26-2.785 5.937-6.31 5.937-3.524 0-6.31-2.677-6.31-5.938 0-3.26 2.786-5.93 6.31-5.93z"/><path fill="#3c6eb4" d="M15.962 85.317v2.76h48.462c.12-.897.253-1.816.406-2.76zM40.516 95.66v2.752h71.664V95.66h-5.545l.01.076H63.453l.01-.076z"/><path d="M61.116 15.227h-.002c-4.982 0-9.83.544-12.955 1.783-8.283 3.043-14.528 11.225-16.385 21.076-1.652 7.815-2.09 14.424-2.969 20.408-.375 2.558-.838 4.995-1.496 7.377-3.361 2.655-5.775 6.766-6.658 11.45-.616 2.913-.957 5.54-1.254 7.996h2.078c.288-2.37.624-4.86 1.203-7.59l.008-.01v-.018c1.09-5.783 4.77-10.492 9.408-12.185l.018-.01.008-.008c1.573-.624 4.607-1.014 7.668-1.014 3.057 0 6.211.381 8.084 1.031 4.634 1.696 8.311 6.406 9.4 12.186v.018l.008.01c.58 2.73.915 5.221 1.203 7.59h2.079c-.297-2.458-.637-5.09-1.254-8.006-1.21-6.406-5.282-11.754-10.735-13.745h-.008l-.008-.01c-2.292-.796-5.55-1.14-8.77-1.142-3.214 0-6.328.333-8.419 1.16-.518.19-1.02.42-1.512.668a70.243 70.243 0 0 0 1-5.445c.895-6.102 1.315-12.633 2.934-20.287l.01-.01v-.016c1.736-9.24 7.606-16.806 15.086-19.544l.01-.008h.015c2.605-1.036 7.375-1.636 12.205-1.635 4.823 0 9.764.583 12.81 1.643 7.48 2.737 13.35 10.303 15.084 19.543l.01.02v.007c1.618 7.654 2.048 14.185 2.943 20.287.403 2.748.926 5.41 1.68 8.035-2.394-.724-5.604-1.05-8.795-1.05-3.43 0-6.747.36-8.966 1.238-5.794 2.12-10.125 7.8-11.416 14.619-1.136 5.358-1.438 9.879-2.036 13.943l2.051.303c.615-4.183.898-8.626 2-13.823l.01-.01v-.007c1.168-6.205 5.123-11.276 10.11-13.096h.007l.018-.01c1.7-.674 4.946-1.09 8.223-1.09 3.275 0 6.648.407 8.664 1.108h.01c4.977 1.826 8.922 6.89 10.09 13.088v.017c1.101 5.196 1.392 9.64 2.007 13.822l2.053-.302c-.597-4.065-.9-8.586-2.035-13.944-1.146-6.057-4.692-11.213-9.53-13.777-1.004-3.013-1.62-6.093-2.101-9.367-.877-5.98-1.312-12.584-2.961-20.39-1.854-9.868-8.103-18.074-16.402-21.112h-.018c-3.464-1.21-8.52-1.764-13.51-1.765zM45.546 27.69a6.912 6.912 0 0 0-5.506 2.684l-.633.814 1.646 1.264.631-.823a4.92 4.92 0 0 1 3.592-1.869c1.3-.055 2.65.468 3.574 1.385l.736.736 1.463-1.472-.736-.727a6.905 6.905 0 0 0-4.77-1.99zm33.372 0a6.905 6.905 0 0 0-4.77 1.992l-.736.727 1.455 1.472.737-.736a4.895 4.895 0 0 1 3.574-1.385c1.375.06 2.76.777 3.6 1.87l.633.822 1.636-1.264-.633-.814a6.895 6.895 0 0 0-5.496-2.684zm-33.425 9.115a5.17 5.306 0 0 0-5.168 5.305 5.17 5.306 0 0 0 5.168 5.306 5.17 5.306 0 0 0 5.175-5.306 5.17 5.306 0 0 0-5.175-5.305zm33.468 0a5.17 5.306 0 0 0-5.167 5.305 5.17 5.306 0 0 0 5.167 5.306 5.17 5.306 0 0 0 5.168-5.306 5.17 5.306 0 0 0-5.167-5.305zm-16.435 7.66c-.758 0-1.379.233-1.895.407-.517.175-.93.294-1.248.294-.567 0-1.124.311-1.427.676-.302.364-.445.74-.555 1.098-.22.713-.327 1.438-.424 1.69-.222.574-.01 1.031.166 1.331.175.3.389.536.63.78.484.486 1.096.973 1.714 1.427.633.464 1.268.886 1.74 1.194l-.025.416c-.233.19-.8.693-1.74 1.011-.556.188-1.116.255-1.602.131-.413-.106-.824-.47-1.246-1.021.027-.218.037-.307.086-.666.087-.628.213-1.387.27-1.612l-2.009-.502c-.12.48-.222 1.18-.312 1.829-.09.648-.156 1.203-.156 1.203l-.043.37.199.311c.729 1.146 1.701 1.841 2.701 2.096 1 .256 1.97.101 2.78-.172 1.05-.357 1.906-.93 2.378-1.29.473.36 1.324.935 2.371 1.29.81.274 1.77.428 2.77.172s1.973-.95 2.701-2.096l.2-.31-.044-.371s-.066-.555-.156-1.203c-.09-.65-.194-1.349-.312-1.829l-2.008.502c.056.225.182.984.27 1.612.048.354.06.44.085.658-.424.556-.83.923-1.246 1.03-.486.123-1.045.056-1.601-.132-.94-.318-1.508-.821-1.74-1.011l-.018-.389c.479-.31 1.128-.74 1.783-1.22.618-.455 1.23-.943 1.715-1.43.24-.243.456-.479.63-.778.177-.3.387-.757.165-1.332-.097-.25-.212-.976-.432-1.69-.11-.356-.242-.734-.545-1.099-.303-.364-.86-.674-1.428-.674-.317 0-.73-.12-1.246-.294-.517-.174-1.137-.407-1.896-.407zm0 2.069c.305 0 .71.118 1.23.293.478.162 1.079.34 1.764.373.023.035.085.15.148.355.111.36.224.91.38 1.445-.05.068-.11.153-.241.285-.342.344-.9.791-1.473 1.211-.88.647-1.43.984-1.808 1.221-.375-.236-.936-.57-1.819-1.22-.573-.42-1.12-.868-1.462-1.212-.132-.132-.19-.217-.24-.285.154-.535.268-1.084.378-1.445a1.55 1.55 0 0 1 .149-.355c.684-.032 1.277-.211 1.756-.373.518-.175.934-.293 1.238-.293zM29.584 70.369c-1.4.06-2.71.744-3.566 1.854l-.63.822 1.634 1.264.633-.824a2.803 2.803 0 0 1 2.025-1.047 2.777 2.777 0 0 1 2.008.779l.736.727 1.453-1.471-.736-.727a4.786 4.786 0 0 0-3.557-1.377zm21.838 0a4.767 4.767 0 0 0-3.55 1.377l-.735.727 1.453 1.47.737-.726a2.777 2.777 0 0 1 2.007-.78 2.8 2.8 0 0 1 2.026 1.048l.623.824 1.644-1.264-.632-.822a4.79 4.79 0 0 0-3.573-1.854zm45.604 3.912h-.002a5.046 5.046 0 0 0-3.487 1.456l-.736.726 1.455 1.47.734-.726a3.029 3.029 0 0 1 2.2-.847c.84.035 1.701.477 2.214 1.142l.633.822 1.637-1.263-.633-.822a5.022 5.022 0 0 0-3.758-1.95c-.085-.003-.17-.008-.257-.008zm-22.824 0c-.087 0-.173.004-.26.009a5.04 5.04 0 0 0-3.766 1.949l-.63.822 1.644 1.264.63-.823a3.035 3.035 0 0 1 2.208-1.142 3.048 3.048 0 0 1 2.207.847l.736.727 1.455-1.47-.736-.727a5.045 5.045 0 0 0-3.488-1.455zM29.8 76.559a3.307 3.386 0 0 0-3.306 3.384 3.307 3.386 0 0 0 3.306 3.393 3.307 3.386 0 0 0 3.306-3.393 3.307 3.386 0 0 0-3.306-3.384zm21.412 0a3.307 3.386 0 0 0-3.315 3.384 3.307 3.386 0 0 0 3.315 3.393 3.307 3.386 0 0 0 3.306-3.393 3.307 3.386 0 0 0-3.306-3.384zm22.953 4.276a3.536 3.62 0 0 0-3.53 3.617 3.536 3.62 0 0 0 3.53 3.618 3.536 3.62 0 0 0 3.54-3.618 3.536 3.62 0 0 0-3.54-3.617zm22.893 0a3.536 3.62 0 0 0-3.54 3.617 3.536 3.62 0 0 0 3.54 3.618 3.536 3.62 0 0 0 3.532-3.618 3.536 3.62 0 0 0-3.532-3.617zm-56.361.242c-.566 0-1.004.167-1.334.278-.33.11-.551.164-.674.164-.47 0-.957.276-1.203.572-.246.295-.347.58-.424.83-.156.503-.229.965-.26 1.047-.206.533-.01.94.13 1.178.038.066.08.115.12.172h3.16a11.125 11.125 0 0 1-.459-.32c-.358-.264-.707-.541-.9-.735v-.01c.063-.26.137-.572.182-.719.005-.016.004-.002.01-.015.366-.054.733-.127.976-.21.332-.111.562-.163.676-.163.113 0 .334.052.666.164.243.082.613.155.978.209.005.013.003 0 .008.015.046.147.128.457.19.72l-.008.009c-.193.194-.54.471-.899.734a15.49 15.49 0 0 1-.45.32h3.16c.04-.055.082-.106.119-.171.14-.238.337-.645.13-1.178-.03-.081-.113-.544-.27-1.047a2.198 2.198 0 0 0-.423-.83c-.246-.296-.723-.572-1.193-.572-.123 0-.346-.053-.676-.164-.33-.111-.766-.278-1.332-.278Zm45.119 4.657c-.59 0-1.05.176-1.403.295s-.597.18-.744.18c-.482 0-.976.275-1.23.58-.252.303-.359.602-.44.866-.164.528-.246 1.023-.285 1.125-.209.54-.006.95.137 1.194.144.246.31.42.486.598.353.353.781.688 1.211 1.003.355.26.701.496.996.694-.195.155-.454.367-.928.527-.34.115-.656.142-.908.078-.184-.047-.391-.261-.597-.492.016-.127.02-.135.043-.295.06-.425.145-.952.173-1.064l-2.007-.502c-.092.368-.155.834-.217 1.279-.062.447-.104.832-.104.832l-.043.363.2.313c.533.838 1.277 1.379 2.04 1.574.765.195 1.486.071 2.079-.129a6.1 6.1 0 0 0 1.523-.789c.358.252.887.573 1.524.79.593.2 1.312.323 2.076.128.765-.195 1.509-.736 2.043-1.574l.2-.313-.044-.363s-.051-.384-.113-.83c-.061-.446-.123-.913-.215-1.281l-2.008.502c.028.112.123.64.182 1.064.02.16.017.168.033.295-.205.23-.405.445-.588.492-.252.064-.57.037-.91-.078-.46-.156-.713-.364-.908-.52.3-.198.65-.436 1.013-.7.43-.316.858-.65 1.211-1.004a2.89 2.89 0 0 0 .485-.598c.144-.245.338-.655.13-1.194-.04-.102-.123-.597-.287-1.125-.08-.264-.18-.563-.431-.867-.254-.304-.747-.58-1.229-.58-.146 0-.39-.06-.744-.18-.353-.12-.812-.294-1.402-.294zm0 2.068c.137 0 .381.062.736.182a6.22 6.22 0 0 0 1.082.224c.013.028 0 .01.015.06.054.175.141.511.217.815l-.035.035a9.253 9.253 0 0 1-.969.795c-.505.37-.744.51-1.046.701-.3-.19-.54-.329-1.047-.7a9.251 9.251 0 0 1-.971-.796c-.022-.023-.014-.024-.033-.045.074-.298.154-.632.207-.804.016-.053.012-.033.025-.06a6.043 6.043 0 0 0 1.074-.225c.355-.12.607-.182.744-.182z"/><path fill="#892ca0" d="M45.491 35.775a6.084 6.084 0 0 0-4.382 1.866 6.361 6.361 0 0 0-1.535 2.595 6.388 6.388 0 0 0-.27 2.198 6.397 6.397 0 0 0 2.721 4.923 6.211 6.211 0 0 0 1.335.701 6.056 6.056 0 0 0 4.55-.11 6.095 6.095 0 0 0 1.531-.954 6.295 6.295 0 0 0 1.36-1.607 6.396 6.396 0 0 0 .826-4.236 6.431 6.431 0 0 0-.827-2.317 6.396 6.396 0 0 0-1.837-1.973 6.211 6.211 0 0 0-1.336-.7 6.047 6.047 0 0 0-2.134-.386zm33.47 0a6.107 6.107 0 0 0-2.132.389 6.075 6.075 0 0 0-1.577.878 6.277 6.277 0 0 0-1.43 1.538 6.396 6.396 0 0 0-.932 4.8 6.401 6.401 0 0 0 1.688 3.2 6.33 6.33 0 0 0 1.428 1.096 6.141 6.141 0 0 0 1.705.64 6.01 6.01 0 0 0 1.885.097 6.06 6.06 0 0 0 3.31-1.422 6.32 6.32 0 0 0 1.506-1.872 6.383 6.383 0 0 0 .715-3.652 6.431 6.431 0 0 0-.864-2.63 6.39 6.39 0 0 0-2.086-2.138 6.18 6.18 0 0 0-1.665-.722 6.021 6.021 0 0 0-1.55-.202zm-33.47 2.06h.002a4.315 4.315 0 0 1 .63.048 4.006 4.006 0 0 1 1.343.462 4.108 4.108 0 0 1 .956.732 4.226 4.226 0 0 1 .89 1.358 4.325 4.325 0 0 1 .321 1.453 4.547 4.547 0 0 1-.182 1.504 4.325 4.325 0 0 1-.761 1.45 4.226 4.226 0 0 1-1.224 1.035 4.069 4.069 0 0 1-2.603.46 4.056 4.056 0 0 1-2.562-1.497 4.252 4.252 0 0 1-.76-1.45 4.375 4.375 0 0 1-.186-1.28 4.54 4.54 0 0 1 .187-1.28 4.33 4.33 0 0 1 .76-1.449 4.218 4.218 0 0 1 1.22-1.034 4.062 4.062 0 0 1 1.757-.506c.07-.004.141-.005.212-.005zm33.47 0a4.088 4.088 0 0 1 1.23.191 4.036 4.036 0 0 1 1.4.779 4.19 4.19 0 0 1 1.008 1.258 4.3 4.3 0 0 1 .479 1.607 4.472 4.472 0 0 1-.48 2.489 4.28 4.28 0 0 1-1.007 1.258 4.146 4.146 0 0 1-1.02.636 4.033 4.033 0 0 1-3.218 0 4.068 4.068 0 0 1-1.315-.911 4.226 4.226 0 0 1-.888-1.358 4.326 4.326 0 0 1-.32-1.452 4.54 4.54 0 0 1 .079-1.09 4.372 4.372 0 0 1 .623-1.532 4.25 4.25 0 0 1 1.118-1.15 4.105 4.105 0 0 1 1.279-.591 4.035 4.035 0 0 1 1.032-.134zM29.688 75.527a1.39 1.39 0 0 0-.112.001c-2.295.12-4.111 2.074-4.111 4.414 0 2.416 1.937 4.423 4.336 4.423s4.344-2.007 4.344-4.423-1.945-4.414-4.344-4.414l-.113-.001zm21.413 0a1.415 1.415 0 0 0-.113.001c-2.295.12-4.12 2.074-4.12 4.414 0 2.416 1.946 4.423 4.345 4.423 2.4 0 4.336-2.007 4.336-4.423s-1.937-4.414-4.336-4.414l-.112-.001zm-21.3 2.07c1.254 0 2.275 1.021 2.275 2.345 0 1.324-1.021 2.354-2.275 2.354s-2.269-1.03-2.269-2.354 1.015-2.345 2.269-2.345zm21.412 0c1.254 0 2.268 1.021 2.268 2.345 0 1.324-1.014 2.354-2.268 2.354-1.254 0-2.276-1.03-2.276-2.354s1.022-2.345 2.276-2.345zm22.953 2.198c-2.525 0-4.57 2.111-4.57 4.656 0 2.546 2.045 4.657 4.57 4.657 2.526 0 4.57-2.11 4.57-4.657 0-2.545-2.044-4.656-4.57-4.656zm22.893 0c-2.525 0-4.57 2.111-4.57 4.656 0 2.546 2.045 4.657 4.57 4.657 2.526 0 4.57-2.11 4.57-4.657 0-2.545-2.044-4.656-4.57-4.656zm-22.957 2.068.065.001c1.38 0 2.5 1.134 2.5 2.587 0 1.454-1.12 2.588-2.5 2.588s-2.502-1.134-2.502-2.588c0-1.408 1.05-2.52 2.372-2.587a.761.761 0 0 1 .065 0zm22.892 0 .066.001c1.38 0 2.5 1.134 2.5 2.587 0 1.454-1.12 2.588-2.5 2.588s-2.502-1.134-2.502-2.588c0-1.408 1.05-2.52 2.372-2.587a.757.757 0 0 1 .064 0z"/><path fill="#fff" d="M43.77 37.973a2.543 2.644 0 0 0-2.545 2.64 2.543 2.644 0 0 0 2.545 2.65 2.543 2.644 0 0 0 2.545-2.65 2.543 2.644 0 0 0-2.545-2.64zm33.453 0a2.543 2.644 0 0 0-2.545 2.64 2.543 2.644 0 0 0 2.545 2.65 2.543 2.644 0 0 0 2.543-2.65 2.543 2.644 0 0 0-2.543-2.64zM28.7 77.303a1.626 1.687 0 0 0-1.625 1.687 1.626 1.687 0 0 0 1.627 1.688 1.626 1.687 0 0 0 1.627-1.688 1.626 1.687 0 0 0-1.627-1.687zm21.62.242a1.626 1.687 0 0 0-1.626 1.688 1.626 1.687 0 0 0 1.627 1.687 1.626 1.687 0 0 0 1.629-1.687 1.626 1.687 0 0 0-1.63-1.688zm22.67 4.086a1.739 1.804 0 0 0-1.74 1.799 1.739 1.804 0 0 0 1.74 1.808 1.739 1.804 0 0 0 1.74-1.808 1.739 1.804 0 0 0-1.74-1.799zm23.247.232a1.739 1.804 0 0 0-1.74 1.81 1.739 1.804 0 0 0 1.74 1.8 1.739 1.804 0 0 0 1.74-1.8 1.739 1.804 0 0 0-1.74-1.81z"/></svg>
diff --git a/app/assets/ico/vendor/proget.svg b/app/assets/ico/vendor/proget.svg
new file mode 100644
index 0000000..8daaec0
--- /dev/null
+++ b/app/assets/ico/vendor/proget.svg
@@ -0,0 +1,7 @@
+<svg width="36" height="40" viewBox="0 0 36 40" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M23.5857 13.0352L13.4607 7.38101C13.1259 7.19319 12.7486 7.09454 12.3648 7.09454C11.981 7.09454 11.6036 7.19319 11.2689 7.38101L1.14386 13.0352C0.79091 13.2351 0.498401 13.5265 0.297151 13.8787C0.0959015 14.2309 -0.00663838 14.6309 0.000333212 15.0364V26.2337C0.000466821 26.6325 0.106378 27.0242 0.307266 27.3688C0.508155 27.7134 0.796833 27.9985 1.14386 28.1952L11.2689 33.8494C11.6036 34.0372 11.981 34.1359 12.3648 34.1359C12.7486 34.1359 13.1259 34.0372 13.4607 33.8494L23.5857 28.1555C23.9347 27.9605 24.2255 27.6759 24.4279 27.3311C24.6303 26.9863 24.737 26.5938 24.7371 26.194V15.0364C24.7442 14.6299 24.6408 14.2291 24.438 13.8767C24.2353 13.5242 23.9407 13.2334 23.5857 13.0352Z" fill="#282B3A"/>
+<path d="M16.0096 18.213L12.6346 16.3229C12.5508 16.2763 12.4565 16.2519 12.3606 16.2519C12.2648 16.2519 12.1705 16.2763 12.0867 16.3229L8.71961 18.213C8.63052 18.2606 8.55609 18.3316 8.50432 18.4183C8.45255 18.5051 8.4254 18.6043 8.42579 18.7053V22.4377C8.4254 22.5388 8.45255 22.638 8.50432 22.7247C8.55609 22.8115 8.63052 22.8825 8.71961 22.9301L12.0867 24.8201C12.1705 24.8667 12.2648 24.8912 12.3606 24.8912C12.4565 24.8912 12.5508 24.8667 12.6346 24.8201L16.0096 22.9777C16.0967 22.9284 16.169 22.8568 16.2193 22.7703C16.2695 22.6838 16.2958 22.5854 16.2955 22.4854V18.753C16.3048 18.645 16.2828 18.5367 16.2321 18.4409C16.1814 18.3451 16.1041 18.266 16.0096 18.213V18.213Z" fill="#3FA9F5"/>
+<path d="M6.74219 23.7718V18.4591L3.36719 16.6246V24.963C3.36817 25.1637 3.42233 25.3606 3.52416 25.5336C3.626 25.7066 3.77186 25.8495 3.94689 25.9477L11.5228 30.1804V26.4083L6.74219 23.7718Z" fill="#1696F0"/>
+<path d="M12.9112 10.8434C12.7439 10.7495 12.5552 10.7002 12.3633 10.7002C12.1714 10.7002 11.9827 10.7495 11.8153 10.8434L4.16797 15.1159L7.5668 16.99L12.3315 14.3138L17.0724 16.9424L20.4077 15.0364L12.9112 10.8434Z" fill="#37BBF7"/>
+<path d="M18.0264 18.3718V23.7719L13.2617 26.4402V30.2123L20.8376 25.9796C21.0117 25.8809 21.1564 25.7377 21.2569 25.5647C21.3574 25.3916 21.41 25.195 21.4094 24.9949V16.45L18.0264 18.3718Z" fill="#79BFF2"/>
+</svg>
diff --git a/app/assets/ico/vendor/quay.svg b/app/assets/ico/vendor/quay.svg
new file mode 100644
index 0000000..3de9c16
--- /dev/null
+++ b/app/assets/ico/vendor/quay.svg
@@ -0,0 +1,7 @@
+<svg width="36" height="40" viewBox="0 0 36 40" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path fill-rule="evenodd" clip-rule="evenodd" d="M21.6959 7.09998L27.7201 20.0013L21.6959 32.9H16.5703L22.5911 20.0013L16.5703 7.09998H21.6959Z" fill="#40B4E5"/>
+<path fill-rule="evenodd" clip-rule="evenodd" d="M16.57 32.9L10.5459 20.0013L16.57 7.09998H21.6957L15.6749 20.0013L21.6957 32.9H16.57Z" fill="#003764"/>
+<path fill-rule="evenodd" clip-rule="evenodd" d="M13.8589 12.9045L11.15 7.09998H6.02441L11.2975 18.3962L13.8589 12.9045Z" fill="#40B4E5"/>
+<path fill-rule="evenodd" clip-rule="evenodd" d="M11.2975 21.6038L6.02441 32.9H11.15L13.8589 27.0955L11.2975 21.6038Z" fill="#40B4E5"/>
+<path fill-rule="evenodd" clip-rule="evenodd" d="M6.02414 32.9L0 20.0013L6.02414 7.09998H11.1498L5.12562 20.0013L11.1498 32.9H6.02414Z" fill="#003764"/>
+</svg>
diff --git a/app/assets/ico/wizard/agent.svg b/app/assets/ico/wizard/agent.svg
new file mode 100644
index 0000000..31274e7
--- /dev/null
+++ b/app/assets/ico/wizard/agent.svg
@@ -0,0 +1,11 @@
+<svg width="36" height="40" viewBox="0 0 36 40" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M14.3817 5.28003C22.1592 5.28003 28.4649 11.5865 28.4649 19.365C28.4649 27.1435 22.1592 33.45 14.3817 33.45C6.60065 33.4535 0.294922 27.1435 0.294922 19.365C0.294922 11.5865 6.60065 5.28003 14.3817 5.28003Z" fill="#E0F2FE"/>
+<g clip-path="url(#clip0_9538_418895)">
+<path d="M15.0049 13.2509L8.75488 20.7509H14.3799L13.7549 25.7509L20.0049 18.2509H14.3799L15.0049 13.2509Z" stroke="#0086C9" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/>
+</g>
+<defs>
+<clipPath id="clip0_9538_418895">
+<rect width="15" height="15" fill="white" transform="translate(6.87988 12.0009)"/>
+</clipPath>
+</defs>
+</svg>
diff --git a/app/assets/ico/wizard/api.svg b/app/assets/ico/wizard/api.svg
new file mode 100644
index 0000000..2ed7748
--- /dev/null
+++ b/app/assets/ico/wizard/api.svg
@@ -0,0 +1,4 @@
+<svg width="36" height="40" viewBox="0 0 36 40" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M14.3817 5.28003C22.1592 5.28003 28.4649 11.5865 28.4649 19.365C28.4649 27.1435 22.1592 33.45 14.3817 33.45C6.60065 33.4535 0.294922 27.1435 0.294922 19.365C0.294922 11.5865 6.60065 5.28003 14.3817 5.28003Z" fill="#E0F2FE"/>
+<path d="M9.32758 23.1544V23.0281C9.32758 21.9669 9.32758 21.4364 9.53409 21.0311C9.71574 20.6746 10.0056 20.3847 10.3621 20.2031C10.7674 19.9966 11.298 19.9966 12.3591 19.9966H16.4011C17.4622 19.9966 17.9928 19.9966 18.3981 20.2031C18.7546 20.3847 19.0444 20.6746 19.2261 21.0311C19.4326 21.4364 19.4326 21.9669 19.4326 23.0281V23.1544M9.32758 23.1544C8.62997 23.1544 8.06445 23.7199 8.06445 24.4175C8.06445 25.1151 8.62997 25.6806 9.32758 25.6806C10.0252 25.6806 10.5907 25.1151 10.5907 24.4175C10.5907 23.7199 10.0252 23.1544 9.32758 23.1544ZM19.4326 23.1544C18.735 23.1544 18.1695 23.7199 18.1695 24.4175C18.1695 25.1151 18.735 25.6806 19.4326 25.6806C20.1302 25.6806 20.6957 25.1151 20.6957 24.4175C20.6957 23.7199 20.1302 23.1544 19.4326 23.1544ZM14.3801 23.1544C13.6825 23.1544 13.117 23.7199 13.117 24.4175C13.117 25.1151 13.6825 25.6806 14.3801 25.6806C15.0777 25.6806 15.6432 25.1151 15.6432 24.4175C15.6432 23.7199 15.0777 23.1544 14.3801 23.1544ZM14.3801 23.1544V16.8388M10.5907 16.8388H18.1695C18.758 16.8388 19.0523 16.8388 19.2844 16.7426C19.5939 16.6144 19.8398 16.3685 19.968 16.059C20.0641 15.8269 20.0641 15.5326 20.0641 14.9441C20.0641 14.3555 20.0641 14.0613 19.968 13.8291C19.8398 13.5196 19.5939 13.2737 19.2844 13.1455C19.0523 13.0494 18.758 13.0494 18.1695 13.0494H10.5907C10.0022 13.0494 9.70789 13.0494 9.47576 13.1455C9.16626 13.2737 8.92036 13.5196 8.79217 13.8291C8.69602 14.0613 8.69602 14.3555 8.69602 14.9441C8.69602 15.5326 8.69602 15.8269 8.79217 16.059C8.92036 16.3685 9.16626 16.6144 9.47576 16.7426C9.70789 16.8388 10.0022 16.8388 10.5907 16.8388Z" stroke="#0086C9" stroke-width="1.15" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>
diff --git a/app/assets/ico/wizard/edge-agent.svg b/app/assets/ico/wizard/edge-agent.svg
new file mode 100644
index 0000000..a3e45f3
--- /dev/null
+++ b/app/assets/ico/wizard/edge-agent.svg
@@ -0,0 +1,11 @@
+<svg width="36" height="40" viewBox="0 0 36 40" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M14.3817 5.28003C22.1592 5.28003 28.4649 11.5865 28.4649 19.365C28.4649 27.1435 22.1592 33.45 14.3817 33.45C6.60065 33.4535 0.294922 27.1435 0.294922 19.365C0.294922 11.5865 6.60065 5.28003 14.3817 5.28003Z" fill="#E0F2FE"/>
+<g clip-path="url(#clip0_9538_418898)">
+<path d="M18.1297 18.2509H17.3422C17.1084 17.3452 16.6252 16.5233 15.9476 15.8786C15.27 15.2339 14.4252 14.7921 13.509 14.6035C12.5929 14.415 11.6423 14.4871 10.7651 14.8118C9.88797 15.1366 9.11948 15.7008 8.54699 16.4405C7.9745 17.1801 7.62095 18.0655 7.52652 18.9961C7.4321 19.9266 7.60058 20.865 8.01282 21.7046C8.42506 22.5442 9.06453 23.2513 9.85857 23.7456C10.6526 24.2399 11.5694 24.5016 12.5047 24.5009H18.1297C18.9585 24.5009 19.7534 24.1716 20.3394 23.5856C20.9255 22.9995 21.2547 22.2047 21.2547 21.3759C21.2547 20.5471 20.9255 19.7522 20.3394 19.1661C19.7534 18.5801 18.9585 18.2509 18.1297 18.2509Z" stroke="#0086C9" stroke-width="1.33333" stroke-linecap="round" stroke-linejoin="round"/>
+</g>
+<defs>
+<clipPath id="clip0_9538_418898">
+<rect width="15" height="15" fill="white" transform="translate(6.87988 12.0009)"/>
+</clipPath>
+</defs>
+</svg>
diff --git a/app/assets/ico/wizard/import.svg b/app/assets/ico/wizard/import.svg
new file mode 100644
index 0000000..570da8e
--- /dev/null
+++ b/app/assets/ico/wizard/import.svg
@@ -0,0 +1,11 @@
+<svg width="37" height="40" viewBox="0 0 37 40" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M14.8817 5.28003C22.6592 5.28003 28.9649 11.5865 28.9649 19.365C28.9649 27.1435 22.6592 33.45 14.8817 33.45C7.10065 33.4535 0.794922 27.1435 0.794922 19.365C0.794922 11.5865 7.10065 5.28003 14.8817 5.28003Z" fill="#E0F2FE"/>
+<g clip-path="url(#clip0_9540_418847)">
+<path d="M17.3803 22.0008L14.8803 19.5008M14.8803 19.5008L12.3803 22.0008M14.8803 19.5008V25.1258M20.124 23.4946C20.7336 23.1623 21.2152 22.6364 21.4927 22C21.7702 21.3636 21.8279 20.6529 21.6567 19.98C21.4854 19.3072 21.095 18.7105 20.547 18.2842C19.9989 17.858 19.3246 17.6263 18.6303 17.6258H17.8428C17.6536 16.8941 17.301 16.2148 16.8115 15.639C16.322 15.0631 15.7083 14.6058 15.0166 14.3012C14.3249 13.9967 13.5731 13.8529 12.8179 13.8808C12.0626 13.9086 11.3235 14.1073 10.656 14.4619C9.98859 14.8165 9.41023 15.3178 8.96442 15.9281C8.51862 16.5384 8.21697 17.2418 8.08215 17.9855C7.94733 18.7291 7.98285 19.4937 8.18604 20.2216C8.38924 20.9496 8.75481 21.622 9.25529 22.1883" stroke="#0086C9" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/>
+</g>
+<defs>
+<clipPath id="clip0_9540_418847">
+<rect width="15" height="15" fill="white" transform="translate(7.37988 12.0009)"/>
+</clipPath>
+</defs>
+</svg>
diff --git a/app/assets/ico/wizard/socket.svg b/app/assets/ico/wizard/socket.svg
new file mode 100644
index 0000000..b3974e2
--- /dev/null
+++ b/app/assets/ico/wizard/socket.svg
@@ -0,0 +1,4 @@
+<svg width="36" height="40" viewBox="0 0 36 40" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M14.3817 5.28003C22.1592 5.28003 28.4649 11.5865 28.4649 19.365C28.4649 27.1435 22.1592 33.45 14.3817 33.45C6.60065 33.4535 0.294922 27.1435 0.294922 19.365C0.294922 11.5865 6.60065 5.28003 14.3817 5.28003Z" fill="#E0F2FE"/>
+<path d="M14.3797 23.5025C16.98 23.5025 19.0879 21.3946 19.0879 18.7943L19.0879 16.3519L16.7331 16.3519M14.3797 23.5025C11.7795 23.5025 9.67156 21.3946 9.67156 18.7943L9.67156 16.3519L16.7331 16.3519M14.3797 23.5025C14.3797 24.9593 14.3797 26.5726 16.7331 26.5726L17.7794 26.5726M16.7331 16.3519L16.7331 13.4274M12.0216 16.3519L12.0216 13.4274" stroke="#0086C9" stroke-width="1.33" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>
diff --git a/app/assets/images/extensions_overview_diagram.png b/app/assets/images/extensions_overview_diagram.png
new file mode 100644
index 0000000..91f7ee1
Binary files /dev/null and b/app/assets/images/extensions_overview_diagram.png differ
diff --git a/app/assets/images/icon-error.svg b/app/assets/images/icon-error.svg
new file mode 100644
index 0000000..564b5fa
--- /dev/null
+++ b/app/assets/images/icon-error.svg
@@ -0,0 +1,5 @@
+<svg width="46" height="46" viewBox="0 0 46 46" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect x="3" y="3" width="40" height="40" rx="20" fill="#FEE4E2"/>
+<path d="M23 19.6667V23M23 26.3333H23.0083M31.3333 23C31.3333 27.6024 27.6024 31.3333 23 31.3333C18.3976 31.3333 14.6667 27.6024 14.6667 23C14.6667 18.3976 18.3976 14.6667 23 14.6667C27.6024 14.6667 31.3333 18.3976 31.3333 23Z" stroke="#D92D20" stroke-width="1.66667" stroke-linecap="round" stroke-linejoin="round"/>
+<rect x="3" y="3" width="40" height="40" rx="20" stroke="#FEF3F2" stroke-width="6"/>
+</svg>
diff --git a/app/assets/images/icon-success.svg b/app/assets/images/icon-success.svg
new file mode 100644
index 0000000..890fe91
--- /dev/null
+++ b/app/assets/images/icon-success.svg
@@ -0,0 +1,5 @@
+<svg width="46" height="46" viewBox="0 0 46 46" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect x="3" y="3" width="40" height="40" rx="20" fill="#D1FADF"/>
+<path d="M31.3333 22.2333V23C31.3323 24.797 30.7504 26.5456 29.6744 27.9849C28.5985 29.4241 27.0861 30.4771 25.3628 30.9866C23.6395 31.4961 21.7977 31.4349 20.112 30.8122C18.4264 30.1894 16.9872 29.0384 16.0091 27.5309C15.031 26.0234 14.5665 24.2401 14.6847 22.4469C14.803 20.6538 15.4977 18.9469 16.6652 17.5809C17.8328 16.2148 19.4106 15.2628 21.1635 14.8668C22.9163 14.4708 24.7502 14.6519 26.3917 15.3833M31.3333 16.3333L23 24.675L20.5 22.175" stroke="#039855" stroke-width="1.66667" stroke-linecap="round" stroke-linejoin="round"/>
+<rect x="3" y="3" width="40" height="40" rx="20" stroke="#ECFDF3" stroke-width="6"/>
+</svg>
diff --git a/app/assets/images/icon-warning.svg b/app/assets/images/icon-warning.svg
new file mode 100644
index 0000000..8832458
--- /dev/null
+++ b/app/assets/images/icon-warning.svg
@@ -0,0 +1,5 @@
+<svg width="46" height="46" viewBox="0 0 46 46" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect x="3" y="3" width="40" height="40" rx="20" fill="#FEF0C7"/>
+<path d="M22.9998 19.6667V23M22.9998 26.3333H23.0081M21.5748 15.3833L14.5165 27.1667C14.3709 27.4187 14.2939 27.7044 14.2931 27.9954C14.2923 28.2864 14.3677 28.5726 14.5118 28.8254C14.6559 29.0783 14.8637 29.2889 15.1146 29.4365C15.3654 29.5841 15.6505 29.6635 15.9415 29.6667H30.0581C30.3491 29.6635 30.6342 29.5841 30.885 29.4365C31.1359 29.2889 31.3437 29.0783 31.4878 28.8254C31.6319 28.5726 31.7073 28.2864 31.7065 27.9954C31.7057 27.7044 31.6287 27.4187 31.4831 27.1667L24.4248 15.3833C24.2762 15.1384 24.0671 14.9359 23.8175 14.7954C23.5679 14.6549 23.2863 14.581 22.9998 14.581C22.7134 14.581 22.4317 14.6549 22.1821 14.7954C21.9325 14.9359 21.7234 15.1384 21.5748 15.3833Z" stroke="#DC6803" stroke-width="1.66667" stroke-linecap="round" stroke-linejoin="round"/>
+<rect x="3" y="3" width="40" height="40" rx="20" stroke="#FFFAEB" stroke-width="6"/>
+</svg>
diff --git a/app/assets/images/ingress-explanatory-diagram.png b/app/assets/images/ingress-explanatory-diagram.png
new file mode 100644
index 0000000..20b5599
Binary files /dev/null and b/app/assets/images/ingress-explanatory-diagram.png differ
diff --git a/app/assets/images/kubernetes_endpoint.png b/app/assets/images/kubernetes_endpoint.png
new file mode 100644
index 0000000..3a85817
Binary files /dev/null and b/app/assets/images/kubernetes_endpoint.png differ
diff --git a/app/assets/images/logo_alt.svg b/app/assets/images/logo_alt.svg
new file mode 100644
index 0000000..8d254e4
--- /dev/null
+++ b/app/assets/images/logo_alt.svg
@@ -0,0 +1,14 @@
+<svg width="1064" height="131" viewBox="0 0 1064 131" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M0 3.08984H45.77C77.35 3.08984 95.98 12.9598 95.98 45.1498V46.2498C95.98 78.5398 77.39 88.3098 45.81 88.3098H35.82V127.53H0V3.08984ZM43.67 60.8098C53.45 60.8098 58.6 57.1798 58.6 46.3298V45.0798C58.6 34.2798 53.45 30.5798 43.67 30.5798H35.83V60.7998H43.67V60.8098Z" fill="#F7F6F3"/>
+<path d="M100.93 71.76V58.86C100.93 15.56 117.85 0 153.84 0C189.83 0 206.73 15.56 206.73 58.86V71.76C206.73 115.05 189.81 130.62 153.84 130.62C117.87 130.62 100.93 115.05 100.93 71.76ZM168.87 71.84V58.77C168.87 36.2 165.81 28.65 153.84 28.65C141.87 28.65 138.78 36.2 138.78 58.77V71.84C138.78 94.41 141.9 101.98 153.84 101.98C165.78 101.98 168.87 94.41 168.87 71.84Z" fill="#F7F6F3"/>
+<path d="M213.77 3.08984H256.91C289.3 3.08984 309.24 8.34984 309.24 36.5298V37.0098C309.17 53.8598 302.64 62.4799 291.7 67.1498C301.84 71.2098 305.35 76.0298 306.84 92.9998L308.14 108.5C309.29 121.82 309.77 124.57 311.51 127.53H274.87C273.71 124.4 273.11 120.96 272.8 116.89L271.22 97.1898C270.17 85.3598 268.39 82.3898 258.61 82.3898H249.6V127.52H213.78V3.08984H213.77ZM257.54 55.6898C268.7 55.6898 272.72 52.5198 272.72 43.2398V42.6998C272.72 33.4598 268.7 30.5098 257.54 30.5098H249.59V55.6898H257.54Z" fill="#F7F6F3"/>
+<path d="M343.52 32.5898H312.2V3.08984H410.63V32.5998H379.35V127.54H343.53V32.5898H343.52Z" fill="#F7F6F3"/>
+<path d="M425.88 3.08984H475.1L508.03 127.54H471.03L465.42 102.18H435.52L429.88 127.54H393.03L425.88 3.08984ZM459.58 73.8998L450.55 32.7398H450.32L441.3 73.8998H459.59H459.58Z" fill="#F7F6F3"/>
+<path d="M513.45 3.08984H549.27V127.54H513.45V3.08984Z" fill="#F7F6F3"/>
+<path d="M560.29 3.08984H602.69L629.04 85.0499H629.41L627.13 44.7498V3.08984H660.24V127.54H617.85L591.54 50.1298H591.17L593.39 90.5198V127.54H560.28V3.08984H560.29Z" fill="#F7F6F3"/>
+<path d="M671.24 3.08984H753.91V32.5998H707.06V50.3998H748.46V79.9099H707.06V98.0398H754.52V127.55H671.24V3.08984Z" fill="#F7F6F3"/>
+<path d="M763.42 3.08984H806.56C838.95 3.08984 858.89 8.34984 858.89 36.5298V37.0098C858.82 53.8598 852.29 62.4799 841.35 67.1498C851.49 71.2098 855 76.0298 856.49 92.9998L857.79 108.5C858.94 121.82 859.42 124.57 861.16 127.53H824.52C823.36 124.4 822.76 120.96 822.45 116.89L820.87 97.1898C819.82 85.3598 818.04 82.3898 808.26 82.3898H799.25V127.52H763.43V3.08984H763.42ZM807.2 55.6898C818.36 55.6898 822.38 52.5198 822.38 43.2398V42.6998C822.38 33.4598 818.36 30.5098 807.2 30.5098H799.25V55.6898H807.2Z" fill="#F7F6F3"/>
+<path d="M870.36 93.27H904.71V127.53H870.36V93.27Z" fill="#F7F6F3"/>
+<path d="M914.92 3.08984H949.85V28.7598H914.92V3.08984ZM914.92 35.5798H949.85V127.54H914.92V35.5798Z" fill="#F7F6F3"/>
+<path d="M958.1 71.76V58.86C958.1 15.57 975.02 0 1011.01 0C1047 0 1063.9 15.56 1063.9 58.86V71.76C1063.9 115.05 1046.98 130.62 1011.01 130.62C975.04 130.62 958.1 115.05 958.1 71.76ZM1026.05 71.84V58.77C1026.05 36.2 1022.99 28.65 1011.02 28.65C999.05 28.65 995.96 36.2 995.96 58.77V71.84C995.96 94.41 999.08 101.98 1011.02 101.98C1022.96 101.98 1026.05 94.41 1026.05 71.84Z" fill="#F7F6F3"/>
+</svg>
diff --git a/app/assets/images/logo_alt_black.svg b/app/assets/images/logo_alt_black.svg
new file mode 100644
index 0000000..d9243b4
--- /dev/null
+++ b/app/assets/images/logo_alt_black.svg
@@ -0,0 +1,14 @@
+<svg width="1064" height="131" viewBox="0 0 1064 131" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M0 3.08984H45.77C77.35 3.08984 95.98 12.9598 95.98 45.1498V46.2498C95.98 78.5398 77.39 88.3098 45.81 88.3098H35.82V127.53H0V3.08984ZM43.67 60.8098C53.45 60.8098 58.6 57.1798 58.6 46.3298V45.0798C58.6 34.2798 53.45 30.5798 43.67 30.5798H35.83V60.7998H43.67V60.8098Z" fill="#2E2F33"/>
+<path d="M100.93 71.76V58.86C100.93 15.56 117.85 0 153.84 0C189.83 0 206.73 15.56 206.73 58.86V71.76C206.73 115.05 189.81 130.62 153.84 130.62C117.87 130.62 100.93 115.05 100.93 71.76ZM168.87 71.84V58.77C168.87 36.2 165.81 28.65 153.84 28.65C141.87 28.65 138.78 36.2 138.78 58.77V71.84C138.78 94.41 141.9 101.98 153.84 101.98C165.78 101.98 168.87 94.41 168.87 71.84Z" fill="#2E2F33"/>
+<path d="M213.77 3.08984H256.91C289.3 3.08984 309.24 8.34984 309.24 36.5298V37.0098C309.17 53.8598 302.64 62.4799 291.7 67.1498C301.84 71.2098 305.35 76.0298 306.84 92.9998L308.14 108.5C309.29 121.82 309.77 124.57 311.51 127.53H274.87C273.71 124.4 273.11 120.96 272.8 116.89L271.22 97.1898C270.17 85.3598 268.39 82.3898 258.61 82.3898H249.6V127.52H213.78V3.08984H213.77ZM257.54 55.6898C268.7 55.6898 272.72 52.5198 272.72 43.2398V42.6998C272.72 33.4598 268.7 30.5098 257.54 30.5098H249.59V55.6898H257.54Z" fill="#2E2F33"/>
+<path d="M343.52 32.5898H312.2V3.08984H410.63V32.5998H379.35V127.54H343.53V32.5898H343.52Z" fill="#2E2F33"/>
+<path d="M425.88 3.08984H475.1L508.03 127.54H471.03L465.42 102.18H435.52L429.88 127.54H393.03L425.88 3.08984ZM459.58 73.8998L450.55 32.7398H450.32L441.3 73.8998H459.59H459.58Z" fill="#2E2F33"/>
+<path d="M513.45 3.08984H549.27V127.54H513.45V3.08984Z" fill="#2E2F33"/>
+<path d="M560.29 3.08984H602.69L629.04 85.0499H629.41L627.13 44.7498V3.08984H660.24V127.54H617.85L591.54 50.1298H591.17L593.39 90.5198V127.54H560.28V3.08984H560.29Z" fill="#2E2F33"/>
+<path d="M671.24 3.08984H753.91V32.5998H707.06V50.3998H748.46V79.9099H707.06V98.0398H754.52V127.55H671.24V3.08984Z" fill="#2E2F33"/>
+<path d="M763.42 3.08984H806.56C838.95 3.08984 858.89 8.34984 858.89 36.5298V37.0098C858.82 53.8598 852.29 62.4799 841.35 67.1498C851.49 71.2098 855 76.0298 856.49 92.9998L857.79 108.5C858.94 121.82 859.42 124.57 861.16 127.53H824.52C823.36 124.4 822.76 120.96 822.45 116.89L820.87 97.1898C819.82 85.3598 818.04 82.3898 808.26 82.3898H799.25V127.52H763.43V3.08984H763.42ZM807.2 55.6898C818.36 55.6898 822.38 52.5198 822.38 43.2398V42.6998C822.38 33.4598 818.36 30.5098 807.2 30.5098H799.25V55.6898H807.2Z" fill="#2E2F33"/>
+<path d="M870.36 93.27H904.71V127.53H870.36V93.27Z" fill="#2E2F33"/>
+<path d="M914.92 3.08984H949.85V28.7598H914.92V3.08984ZM914.92 35.5798H949.85V127.54H914.92V35.5798Z" fill="#2E2F33"/>
+<path d="M958.1 71.76V58.86C958.1 15.57 975.02 0 1011.01 0C1047 0 1063.9 15.56 1063.9 58.86V71.76C1063.9 115.05 1046.98 130.62 1011.01 130.62C975.04 130.62 958.1 115.05 958.1 71.76ZM1026.05 71.84V58.77C1026.05 36.2 1022.99 28.65 1011.02 28.65C999.05 28.65 995.96 36.2 995.96 58.77V71.84C995.96 94.41 999.08 101.98 1011.02 101.98C1022.96 101.98 1026.05 94.41 1026.05 71.84Z" fill="#2E2F33"/>
+</svg>
diff --git a/app/assets/images/portainer-github-banner.png b/app/assets/images/portainer-github-banner.png
new file mode 100644
index 0000000..75871e3
Binary files /dev/null and b/app/assets/images/portainer-github-banner.png differ
diff --git a/app/assets/images/purple-gradient.svg b/app/assets/images/purple-gradient.svg
new file mode 100644
index 0000000..0b3bc71
--- /dev/null
+++ b/app/assets/images/purple-gradient.svg
@@ -0,0 +1,522 @@
+<svg width="1421" height="507" viewBox="0 0 1421 507" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0_414_125114)">
+<path d="M1119.89 1.0446V9.76338H1128.63C1128.71 6.87373 1128.53 3.93425 1128.63 1.0446C1125.74 1.14425 1122.8 0.969872 1119.91 1.0446H1119.89Z" fill="#C080FF"/>
+<path d="M1137.33 9.76292H1146.05V1.01921C1143.16 0.944482 1140.22 1.11885 1137.33 1.01921C1137.43 3.90886 1137.26 6.84833 1137.33 9.73798V9.76292Z" fill="#C080FF"/>
+<path d="M1173.45 9.76292H1182.17V1.01921C1179.28 0.944482 1176.34 1.11885 1173.45 1.01921C1173.55 3.90886 1173.38 6.84833 1173.45 9.73798V9.76292Z" fill="#C080FF"/>
+<path d="M1190.89 1.0446V9.76338H1199.64C1199.71 6.87373 1199.54 3.93425 1199.64 1.0446C1196.75 1.14425 1193.81 0.969872 1190.92 1.0446H1190.89Z" fill="#C080FF"/>
+<path d="M1208.33 9.76292H1217.05V1.01921C1214.16 0.944482 1211.22 1.11885 1208.33 1.01921C1208.43 3.90886 1208.26 6.84833 1208.33 9.73798V9.76292Z" fill="#C080FF"/>
+<path d="M1154.77 1.04403V9.76281H1164.76C1164.83 6.87316 1164.66 3.93368 1164.76 1.04403C1161.44 1.11876 1158.11 0.969304 1154.79 1.04403H1154.77Z" fill="#C080FF"/>
+<path d="M1244.46 9.76292H1253.18V1.01921C1250.29 0.944482 1247.35 1.11885 1244.46 1.01921C1244.56 3.90886 1244.38 6.84833 1244.46 9.73798V9.76292Z" fill="#C080FF"/>
+<path d="M1225.77 1.04403V9.76281H1235.76C1235.84 6.87316 1235.66 3.93368 1235.76 1.04403C1232.45 1.11876 1229.11 0.969304 1225.8 1.04403H1225.77Z" fill="#C080FF"/>
+<path d="M1288.06 9.76172C1288.16 12.6264 1288.16 15.6157 1288.06 18.4805C1291.35 18.3808 1294.73 18.3808 1298.02 18.4805C1297.92 15.6157 1297.92 12.6264 1298.02 9.76172C1294.73 9.86136 1291.35 9.86136 1288.06 9.76172Z" fill="#C080FF"/>
+<path d="M1298.02 37.1637V45.8825H1306.77C1306.84 42.9929 1306.67 40.0534 1306.77 37.1637C1303.88 37.2634 1300.94 37.089 1298.05 37.1637H1298.02Z" fill="#C080FF"/>
+<path d="M1306.75 37.1645C1309.64 37.0649 1312.58 37.0649 1315.47 37.1645C1315.37 33.8763 1315.37 30.4884 1315.47 27.2002C1312.6 27.2999 1309.61 27.2999 1306.75 27.2002C1306.85 30.4884 1306.85 33.8763 1306.75 37.1645Z" fill="#C080FF"/>
+<path d="M1261.9 37.1637V45.8825H1270.64C1270.72 42.9929 1270.54 40.0534 1270.64 37.1637C1267.75 37.2634 1264.81 37.089 1261.92 37.1637H1261.9Z" fill="#C080FF"/>
+<path d="M1279.34 18.4548C1279.26 21.3444 1279.44 24.2839 1279.34 27.1735C1282.23 27.0739 1285.17 27.2483 1288.06 27.1735C1288.13 24.2839 1287.96 21.3444 1288.06 18.4548C1285.17 18.5544 1282.23 18.38 1279.34 18.4548Z" fill="#C080FF"/>
+<path d="M1270.62 27.2002C1270.72 30.4884 1270.72 33.8763 1270.62 37.1645C1273.51 37.0649 1276.45 37.0649 1279.34 37.1645C1279.24 33.8763 1279.24 30.4884 1279.34 27.2002C1276.47 27.2999 1273.48 27.2999 1270.62 27.2002Z" fill="#C080FF"/>
+<path d="M1270.62 18.4551H1261.9V27.1988C1264.79 27.2736 1267.73 27.0992 1270.62 27.1988C1270.52 24.3092 1270.69 21.3697 1270.62 18.4801V18.4551Z" fill="#C080FF"/>
+<path d="M1298.02 27.1989C1300.91 27.2737 1303.85 27.0993 1306.74 27.1989C1306.64 24.3093 1306.82 21.3698 1306.74 18.4802C1303.85 18.4054 1300.91 18.5798 1298.02 18.4802C1298.12 21.3698 1297.95 24.3093 1298.02 27.1989Z" fill="#C080FF"/>
+<path d="M1279.34 45.882H1288.06V37.1383C1285.17 37.0636 1282.23 37.238 1279.34 37.1383C1279.44 40.028 1279.26 42.9674 1279.34 45.8571V45.882Z" fill="#C080FF"/>
+<path d="M1324.18 27.2017V18.458H1315.44C1315.36 21.3477 1315.54 24.2872 1315.44 27.1768C1318.33 27.0772 1321.27 27.2515 1324.16 27.1768L1324.18 27.2017Z" fill="#C080FF"/>
+<path d="M1315.46 45.882H1324.18V37.1383C1321.29 37.0636 1318.35 37.238 1315.46 37.1383C1315.56 40.028 1315.39 42.9674 1315.46 45.8571V45.882Z" fill="#C080FF"/>
+<path d="M1261.9 1.0446V9.76338H1270.64C1270.72 6.87373 1270.54 3.93425 1270.64 1.0446C1267.75 1.14425 1264.81 0.969872 1261.92 1.0446H1261.9Z" fill="#C080FF"/>
+<path d="M1288.06 1.02116C1285.17 0.946434 1282.23 1.12081 1279.34 1.02116C1279.44 3.91081 1279.26 6.85029 1279.34 9.73994C1282.23 9.81467 1285.17 9.6403 1288.06 9.73994C1287.96 6.85029 1288.13 3.91081 1288.06 1.02116Z" fill="#C080FF"/>
+<path d="M1298.02 1.02116C1297.95 3.91081 1298.12 6.85029 1298.02 9.73994C1300.91 9.6403 1303.85 9.81467 1306.74 9.73994C1306.82 6.85029 1306.64 3.91081 1306.74 1.02116C1303.85 1.12081 1300.91 0.946434 1298.02 1.02116Z" fill="#C080FF"/>
+<path d="M1315.46 9.76292H1324.18V1.01921C1321.29 0.944482 1318.35 1.11885 1315.46 1.01921C1315.56 3.90886 1315.39 6.84833 1315.46 9.73798V9.76292Z" fill="#C080FF"/>
+<path d="M1341.62 18.4551H1332.9V27.1988C1335.79 27.2736 1338.73 27.0992 1341.62 27.1988C1341.52 24.3092 1341.7 21.3697 1341.62 18.4801V18.4551Z" fill="#C080FF"/>
+<path d="M1350.34 45.8821H1360.31V37.1384C1356.99 37.0886 1353.66 37.2381 1350.34 37.1384C1350.44 40.0281 1350.27 42.9675 1350.34 45.8572V45.8821Z" fill="#C080FF"/>
+<path d="M1341.62 27.2002C1341.72 30.4884 1341.72 33.8763 1341.62 37.1645C1344.51 37.0649 1347.45 37.0898 1350.34 37.1645C1350.24 33.8763 1350.24 30.4884 1350.34 27.2002C1347.45 27.275 1344.51 27.2999 1341.62 27.2002Z" fill="#C080FF"/>
+<path d="M1360.31 9.76172C1360.41 12.6264 1360.41 15.6157 1360.31 18.4805C1363.2 18.4057 1366.14 18.3808 1369.03 18.4805C1368.93 15.6157 1368.93 12.6264 1369.03 9.76172C1366.14 9.86136 1363.2 9.83645 1360.31 9.76172Z" fill="#C080FF"/>
+<path d="M1332.9 37.1637V45.8825H1341.65C1341.72 42.9929 1341.55 40.0534 1341.65 37.1637C1338.76 37.2634 1335.82 37.089 1332.93 37.1637H1332.9Z" fill="#C080FF"/>
+<path d="M1350.34 18.4548C1350.27 21.3444 1350.44 24.2839 1350.34 27.1735C1353.66 27.0739 1356.99 27.2483 1360.31 27.1735C1360.38 24.2839 1360.21 21.3444 1360.31 18.4548C1356.99 18.5544 1353.66 18.38 1350.34 18.4548Z" fill="#C080FF"/>
+<path d="M1332.9 1.0446V9.76338H1341.65C1341.72 6.87373 1341.55 3.93425 1341.65 1.0446C1338.76 1.14425 1335.82 0.969872 1332.93 1.0446H1332.9Z" fill="#C080FF"/>
+<path d="M1360.31 1.01634C1356.99 0.96652 1353.66 1.11598 1350.34 1.01634C1350.44 3.90599 1350.27 6.84547 1350.34 9.73512C1353.66 9.78494 1356.99 9.63547 1360.31 9.73512C1360.21 6.84547 1360.38 3.90599 1360.31 1.01634Z" fill="#C080FF"/>
+<path d="M1386.47 54.5788C1386.4 57.4685 1386.57 60.4079 1386.47 63.2976C1389.36 63.1979 1392.3 63.3723 1395.19 63.2976C1395.27 60.4079 1395.09 57.4685 1395.19 54.5788C1392.3 54.6784 1389.36 54.5041 1386.47 54.5788Z" fill="#C080FF"/>
+<path d="M1386.47 80.7591H1395.19V72.0153C1392.3 71.9406 1389.36 72.115 1386.47 72.0153C1386.57 74.905 1386.4 77.8445 1386.47 80.7341V80.7591Z" fill="#C080FF"/>
+<path d="M1369.03 72.0407V80.7595H1377.78C1377.85 77.8698 1377.68 74.9303 1377.78 72.0407C1374.89 72.1403 1371.95 71.966 1369.06 72.0407H1369.03Z" fill="#C080FF"/>
+<path d="M1377.75 54.5791H1369.03V63.3228C1371.92 63.3975 1374.86 63.2231 1377.75 63.3228C1377.65 60.4331 1377.83 57.4936 1377.75 54.604V54.5791Z" fill="#C080FF"/>
+<path d="M1403.91 72.0407V80.7595H1412.66C1412.73 77.8698 1412.56 74.9303 1412.66 72.0407C1409.77 72.1403 1406.83 71.966 1403.94 72.0407H1403.91Z" fill="#C080FF"/>
+<path d="M1403.91 63.323C1406.8 63.3977 1409.74 63.2233 1412.63 63.323C1412.53 60.4333 1412.7 57.4938 1412.63 54.6042C1409.74 54.5295 1406.8 54.7038 1403.91 54.6042C1404.01 57.4938 1403.83 60.4333 1403.91 63.323Z" fill="#C080FF"/>
+<path d="M1412.63 72.0381C1415.52 71.9384 1418.46 71.9633 1421.35 72.0381C1421.25 69.1484 1421.25 66.209 1421.35 63.3193C1418.46 63.394 1415.52 63.4189 1412.63 63.3193C1412.73 66.184 1412.73 69.1733 1412.63 72.0381Z" fill="#C080FF"/>
+<path d="M1377.75 63.3193C1377.85 66.209 1377.85 69.1484 1377.75 72.0381C1380.64 71.9384 1383.58 71.9384 1386.47 72.0381C1386.37 69.1733 1386.37 66.184 1386.47 63.3193C1383.61 63.4189 1380.62 63.4189 1377.75 63.3193Z" fill="#C080FF"/>
+<path d="M1395.19 54.6036C1398.05 54.504 1401.04 54.504 1403.91 54.6036C1403.81 51.7389 1403.81 48.7496 1403.91 45.8848C1401.04 45.9845 1398.05 45.9845 1395.19 45.8848C1395.29 48.7496 1395.29 51.7389 1395.19 54.6036Z" fill="#C080FF"/>
+<path d="M1369.03 37.1637V45.8825H1377.78C1377.85 42.9929 1377.68 40.0534 1377.78 37.1637C1374.89 37.2634 1371.95 37.089 1369.06 37.1637H1369.03Z" fill="#C080FF"/>
+<path d="M1386.47 27.2002C1383.61 27.2999 1380.62 27.2999 1377.75 27.2002C1377.85 30.4884 1377.85 33.8763 1377.75 37.1645C1380.62 37.0649 1383.61 37.0649 1386.47 37.1645C1386.37 33.8763 1386.37 30.4884 1386.47 27.2002Z" fill="#C080FF"/>
+<path d="M1395.19 27.2017V18.458H1386.44C1386.37 21.3477 1386.54 24.2872 1386.44 27.1768C1389.33 27.0772 1392.27 27.2515 1395.16 27.1768L1395.19 27.2017Z" fill="#C080FF"/>
+<path d="M1377.75 18.4548C1374.86 18.38 1371.92 18.5544 1369.03 18.4548C1369.13 21.3444 1368.95 24.2839 1369.03 27.1735C1371.92 27.2483 1374.86 27.0739 1377.75 27.1735C1377.65 24.2839 1377.82 21.3444 1377.75 18.4548Z" fill="#C080FF"/>
+<path d="M1369.03 1.02116C1368.95 3.91081 1369.13 6.85029 1369.03 9.73994C1371.92 9.6403 1374.86 9.81467 1377.75 9.73994C1377.82 6.85029 1377.65 3.91081 1377.75 1.02116C1374.86 1.12081 1371.92 0.946434 1369.03 1.02116Z" fill="#C080FF"/>
+<path d="M1386.47 9.76292H1395.19V1.01921C1392.3 0.944482 1389.36 1.11885 1386.47 1.01921C1386.57 3.90886 1386.4 6.84833 1386.47 9.73798V9.76292Z" fill="#C080FF"/>
+<path d="M1395.19 37.1393C1392.3 37.0646 1389.36 37.239 1386.47 37.1393C1386.57 40.029 1386.4 42.9685 1386.47 45.8581C1389.36 45.9328 1392.3 45.7585 1395.19 45.8581C1395.09 42.9685 1395.27 40.029 1395.19 37.1393Z" fill="#C080FF"/>
+<path d="M1403.91 37.1393C1403.83 40.029 1404.01 42.9685 1403.91 45.8581C1406.8 45.7585 1409.74 45.9328 1412.63 45.8581C1412.7 42.9685 1412.53 40.029 1412.63 37.1393C1409.74 37.239 1406.8 37.0646 1403.91 37.1393Z" fill="#C080FF"/>
+<path d="M1412.63 18.4551H1403.89V27.1988C1406.78 27.2736 1409.71 27.0992 1412.61 27.1988C1412.51 24.3092 1412.68 21.3697 1412.61 18.4801L1412.63 18.4551Z" fill="#C080FF"/>
+<path d="M1412.63 27.2002C1412.73 30.4884 1412.73 33.8763 1412.63 37.1645C1415.52 37.0649 1418.46 37.0898 1421.35 37.1645C1421.25 33.8763 1421.25 30.4884 1421.35 27.2002C1418.46 27.275 1415.52 27.2999 1412.63 27.2002Z" fill="#C080FF"/>
+<path d="M1403.91 1.0446V9.76338H1412.66C1412.73 6.87373 1412.56 3.93425 1412.66 1.0446C1409.77 1.14425 1406.83 0.969872 1403.94 1.0446H1403.91Z" fill="#C080FF"/>
+<path d="M1350.34 160.472V170.436H1360.31V160.472H1350.34Z" fill="#C080FF"/>
+<path d="M1350.34 427.02V436.984H1360.31V427.02H1350.34Z" fill="#C080FF"/>
+<path d="M1350.34 498.016V507.98H1360.31V498.016H1350.34Z" fill="#C080FF"/>
+<path d="M1154.77 231.468V241.432H1164.73V231.468H1154.77Z" fill="#C080FF"/>
+<path d="M1154.77 160.472V170.436H1164.73V160.472H1154.77Z" fill="#C080FF"/>
+<path d="M1225.77 160.472V170.436H1235.74V160.472H1225.77Z" fill="#C080FF"/>
+<path d="M1225.77 231.468V241.432H1235.74V231.468H1225.77Z" fill="#C080FF"/>
+<path d="M1403.91 108.16V116.879H1412.66C1412.73 113.989 1412.56 111.049 1412.66 108.16C1409.77 108.259 1406.83 108.085 1403.94 108.16H1403.91Z" fill="#C080FF"/>
+<path d="M1421.35 98.1973C1418.46 98.272 1415.52 98.2969 1412.63 98.1973C1412.73 101.485 1412.73 104.873 1412.63 108.161C1415.52 108.062 1418.46 108.086 1421.35 108.161C1421.25 104.873 1421.25 101.485 1421.35 98.1973Z" fill="#C080FF"/>
+<path d="M1412.63 89.4521H1403.89V98.1958C1406.78 98.2705 1409.71 98.0962 1412.61 98.1958C1412.51 95.3062 1412.68 92.3667 1412.61 89.477L1412.63 89.4521Z" fill="#C080FF"/>
+<path d="M1403.91 160.472V170.436H1412.66V160.472H1403.91Z" fill="#C080FF"/>
+<path d="M1403.91 231.468V241.432H1412.66V231.468H1403.91Z" fill="#C080FF"/>
+<path d="M1386.47 160.472V170.436H1395.21V160.472H1386.47Z" fill="#C080FF"/>
+<path d="M1386.47 231.468V241.432H1395.21V231.468H1386.47Z" fill="#C080FF"/>
+<path d="M1386.47 116.88H1395.19V108.136C1392.3 108.061 1389.36 108.235 1386.47 108.136C1386.57 111.025 1386.4 113.965 1386.47 116.855V116.88Z" fill="#C080FF"/>
+<path d="M1369.03 108.16V116.879H1377.78C1377.85 113.989 1377.68 111.049 1377.78 108.16C1374.89 108.259 1371.95 108.085 1369.06 108.16H1369.03Z" fill="#C080FF"/>
+<path d="M1386.47 98.1973C1383.58 98.2969 1380.64 98.2969 1377.75 98.1973C1377.85 101.485 1377.85 104.873 1377.75 108.161C1380.64 108.062 1383.58 108.062 1386.47 108.161C1386.37 104.873 1386.37 101.485 1386.47 98.1973Z" fill="#C080FF"/>
+<path d="M1395.19 98.1939V89.4502H1386.44C1386.37 92.3399 1386.54 95.2793 1386.44 98.169C1389.33 98.0694 1392.27 98.2437 1395.16 98.169L1395.19 98.1939Z" fill="#C080FF"/>
+<path d="M1377.75 89.4521H1369.03V98.1958C1371.92 98.2705 1374.86 98.0962 1377.75 98.1958C1377.65 95.3062 1377.83 92.3667 1377.75 89.477V89.4521Z" fill="#C080FF"/>
+<path d="M1369.03 160.472V170.436H1377.78V160.472H1369.03Z" fill="#C080FF"/>
+<path d="M1369.03 231.468V241.432H1377.78V231.468H1369.03Z" fill="#C080FF"/>
+<path d="M1332.9 72.0407V80.7595H1341.65C1341.72 77.8698 1341.55 74.9303 1341.65 72.0407C1338.76 72.1403 1335.82 71.966 1332.93 72.0407H1332.9Z" fill="#C080FF"/>
+<path d="M1341.62 54.5791H1332.9V63.3228C1335.79 63.3975 1338.73 63.2231 1341.62 63.3228C1341.52 60.4331 1341.7 57.4936 1341.62 54.604V54.5791Z" fill="#C080FF"/>
+<path d="M1350.34 63.3193C1347.45 63.394 1344.51 63.4189 1341.62 63.3193C1341.72 66.209 1341.72 69.1484 1341.62 72.0381C1344.51 71.9384 1347.45 71.9633 1350.34 72.0381C1350.24 69.1484 1350.24 66.209 1350.34 63.3193Z" fill="#C080FF"/>
+<path d="M1350.34 80.7592H1360.31V72.0154C1356.99 71.9656 1353.66 72.1151 1350.34 72.0154C1350.44 74.9051 1350.27 77.8445 1350.34 80.7341V80.7592Z" fill="#C080FF"/>
+<path d="M1360.31 63.3208V54.5771H1350.32C1350.24 57.4667 1350.42 60.4062 1350.32 63.2958C1353.63 63.2211 1356.97 63.3706 1360.28 63.2958L1360.31 63.3208Z" fill="#C080FF"/>
+<path d="M1350.34 89.4502V98.1939H1360.31V89.4502H1350.34Z" fill="#C080FF"/>
+<path d="M1350.34 108.135V116.879H1360.31V108.135H1350.34Z" fill="#C080FF"/>
+<path d="M1350.34 125.573V134.317H1360.31V125.573H1350.34Z" fill="#C080FF"/>
+<path d="M1350.34 143.008V151.752H1360.31V143.008H1350.34Z" fill="#C080FF"/>
+<path d="M1350.34 179.131V187.875H1360.31V179.131H1350.34Z" fill="#C080FF"/>
+<path d="M1350.34 196.57V205.314H1360.31V196.57H1350.34Z" fill="#C080FF"/>
+<path d="M1350.34 214.004V222.748H1360.31V214.004H1350.34Z" fill="#C080FF"/>
+<path d="M1350.34 250.128V258.871H1360.31V250.128H1350.34Z" fill="#C080FF"/>
+<path d="M1350.34 285.001V293.744H1360.31V285.001H1350.34Z" fill="#C080FF"/>
+<path d="M1350.34 321.124V329.868H1360.31V321.124H1350.34Z" fill="#C080FF"/>
+<path d="M1350.34 355.997V364.741H1360.31V355.997H1350.34Z" fill="#C080FF"/>
+<path d="M1332.9 160.472V170.436H1341.65V160.472H1332.9Z" fill="#C080FF"/>
+<path d="M1332.9 231.468V241.432H1341.65V231.468H1332.9Z" fill="#C080FF"/>
+<path d="M1315.46 160.472V170.436H1324.21V160.472H1315.46Z" fill="#C080FF"/>
+<path d="M1298.02 160.472V170.436H1306.77V160.472H1298.02Z" fill="#C080FF"/>
+<path d="M1298.02 231.468V241.432H1306.77V231.468H1298.02Z" fill="#C080FF"/>
+<path d="M1279.34 160.472V170.436H1288.08V160.472H1279.34Z" fill="#C080FF"/>
+<path d="M1279.34 427.02V436.984H1288.08V427.02H1279.34Z" fill="#C080FF"/>
+<path d="M1261.9 160.472V170.436H1270.64V160.472H1261.9Z" fill="#C080FF"/>
+<path d="M1261.9 231.468V241.432H1270.64V231.468H1261.9Z" fill="#C080FF"/>
+<path d="M1244.46 160.472V170.436H1253.2V160.472H1244.46Z" fill="#C080FF"/>
+<path d="M1235.74 18.4561H1225.77V27.1998C1229.09 27.2496 1232.42 27.1001 1235.74 27.1998C1235.64 24.3101 1235.81 21.3706 1235.74 18.481V18.4561Z" fill="#C080FF"/>
+<path d="M1253.18 27.2017V18.458H1244.43C1244.36 21.3477 1244.53 24.2872 1244.43 27.1768C1247.32 27.0772 1250.26 27.2515 1253.15 27.1768L1253.18 27.2017Z" fill="#C080FF"/>
+<path d="M1244.46 37.1645C1244.36 33.8763 1244.36 30.4884 1244.46 27.2002C1241.57 27.2999 1238.63 27.275 1235.74 27.2002C1235.84 30.4884 1235.84 33.8763 1235.74 37.1645C1238.63 37.0898 1241.57 37.0649 1244.46 37.1645Z" fill="#C080FF"/>
+<path d="M1244.46 45.882H1253.18V37.1383C1250.29 37.0636 1247.35 37.238 1244.46 37.1383C1244.56 40.028 1244.38 42.9674 1244.46 45.8571V45.882Z" fill="#C080FF"/>
+<path d="M1235.74 37.1632C1232.42 37.238 1229.09 37.0885 1225.77 37.1632V45.882H1235.76C1235.84 42.9924 1235.66 40.0529 1235.76 37.1632H1235.74Z" fill="#C080FF"/>
+<path d="M1225.77 54.5771V63.3208H1235.74V54.5771H1225.77Z" fill="#C080FF"/>
+<path d="M1225.77 72.0156V80.7594H1235.74V72.0156H1225.77Z" fill="#C080FF"/>
+<path d="M1225.77 89.4502V98.1939H1235.74V89.4502H1225.77Z" fill="#C080FF"/>
+<path d="M1225.77 125.573V134.317H1235.74V125.573H1225.77Z" fill="#C080FF"/>
+<path d="M1225.77 196.57V205.314H1235.74V196.57H1225.77Z" fill="#C080FF"/>
+<path d="M1208.33 160.472V170.436H1217.08V160.472H1208.33Z" fill="#C080FF"/>
+<path d="M1190.89 37.1637V45.8825H1199.64C1199.71 42.9929 1199.54 40.0534 1199.64 37.1637C1196.75 37.2634 1193.81 37.089 1190.92 37.1637H1190.89Z" fill="#C080FF"/>
+<path d="M1208.33 45.882H1217.05V37.1383C1214.16 37.0636 1211.22 37.238 1208.33 37.1383C1208.43 40.028 1208.26 42.9674 1208.33 45.8571V45.882Z" fill="#C080FF"/>
+<path d="M1217.05 27.2017V18.458H1208.31C1208.23 21.3477 1208.41 24.2872 1208.31 27.1768C1211.2 27.0772 1214.14 27.2515 1217.03 27.1768L1217.05 27.2017Z" fill="#C080FF"/>
+<path d="M1199.61 37.1645C1202.5 37.0649 1205.44 37.0649 1208.33 37.1645C1208.23 33.8763 1208.23 30.4884 1208.33 27.2002C1205.44 27.2999 1202.5 27.2999 1199.61 27.2002C1199.71 30.4884 1199.71 33.8763 1199.61 37.1645Z" fill="#C080FF"/>
+<path d="M1199.61 18.4551H1190.89V27.1988C1193.78 27.2736 1196.72 27.0992 1199.61 27.1988C1199.51 24.3092 1199.69 21.3697 1199.61 18.4801V18.4551Z" fill="#C080FF"/>
+<path d="M1190.89 160.472V170.436H1199.64V160.472H1190.89Z" fill="#C080FF"/>
+<path d="M1173.45 160.472V170.436H1182.2V160.472H1173.45Z" fill="#C080FF"/>
+<path d="M1164.73 37.1632C1161.42 37.238 1158.08 37.0885 1154.77 37.1632V45.882H1164.76C1164.83 42.9924 1164.66 40.0529 1164.76 37.1632H1164.73Z" fill="#C080FF"/>
+<path d="M1173.45 37.1645C1173.35 33.8763 1173.35 30.4884 1173.45 27.2002C1170.56 27.2999 1167.62 27.275 1164.73 27.2002C1164.83 30.4884 1164.83 33.8763 1164.73 37.1645C1167.62 37.0898 1170.56 37.0649 1173.45 37.1645Z" fill="#C080FF"/>
+<path d="M1164.73 18.4561H1154.77V27.1998C1158.08 27.2496 1161.42 27.1001 1164.73 27.1998C1164.63 24.3101 1164.81 21.3706 1164.73 18.481V18.4561Z" fill="#C080FF"/>
+<path d="M1173.45 45.882H1182.17V37.1383C1179.28 37.0636 1176.34 37.238 1173.45 37.1383C1173.55 40.028 1173.38 42.9674 1173.45 45.8571V45.882Z" fill="#C080FF"/>
+<path d="M1182.17 27.2017V18.458H1173.43C1173.35 21.3477 1173.53 24.2872 1173.43 27.1768C1176.32 27.0772 1179.26 27.2515 1182.15 27.1768L1182.17 27.2017Z" fill="#C080FF"/>
+<path d="M1154.77 54.5771V63.3208H1164.73V54.5771H1154.77Z" fill="#C080FF"/>
+<path d="M1154.77 72.0156V80.7594H1164.73V72.0156H1154.77Z" fill="#C080FF"/>
+<path d="M1154.77 89.4502V98.1939H1164.73V89.4502H1154.77Z" fill="#C080FF"/>
+<path d="M1154.77 125.573V134.317H1164.73V125.573H1154.77Z" fill="#C080FF"/>
+<path d="M1154.77 196.57V205.314H1164.73V196.57H1154.77Z" fill="#C080FF"/>
+<path d="M1137.33 427.02V436.984H1146.07V427.02H1137.33Z" fill="#C080FF"/>
+<path d="M1119.89 160.472V170.436H1128.63V160.472H1119.89Z" fill="#C080FF"/>
+<path d="M1083.76 160.472V170.436H1092.51V160.472H1083.76Z" fill="#C080FF"/>
+<path d="M1048.88 160.472V170.436H1057.63V160.472H1048.88Z" fill="#C080FF"/>
+<path d="M1012.76 160.472V170.436H1021.5V160.472H1012.76Z" fill="#C080FF"/>
+<path d="M995.319 427.02V436.984H1004.06V427.02H995.319Z" fill="#C080FF"/>
+<path d="M959.189 1.01953V9.76324H969.159V1.01953H959.189Z" fill="#C080FF"/>
+<path d="M959.189 18.458V27.2017H969.159V18.458H959.189Z" fill="#C080FF"/>
+<path d="M959.189 37.1387V45.8824H969.159V37.1387H959.189Z" fill="#C080FF"/>
+<path d="M959.189 54.5771V63.3208H969.159V54.5771H959.189Z" fill="#C080FF"/>
+<path d="M959.189 72.0156V80.7594H969.159V72.0156H959.189Z" fill="#C080FF"/>
+<path d="M959.189 89.4502V98.1939H969.159V89.4502H959.189Z" fill="#C080FF"/>
+<path d="M959.189 108.135V116.879H969.159V108.135H959.189Z" fill="#C080FF"/>
+<path d="M959.189 143.008V151.752H969.159V143.008H959.189Z" fill="#C080FF"/>
+<path d="M959.189 179.131V187.875H969.159V179.131H959.189Z" fill="#C080FF"/>
+<path d="M959.189 214.004V222.748H969.159V214.004H959.189Z" fill="#C080FF"/>
+<path d="M959.189 250.128V258.871H969.159V250.128H959.189Z" fill="#C080FF"/>
+<path d="M941.749 160.472V170.436H950.499V160.472H941.749Z" fill="#C080FF"/>
+<path d="M888.189 1.01953V9.76324H898.159V1.01953H888.189Z" fill="#C080FF"/>
+<path d="M888.189 18.458V27.2017H898.159V18.458H888.189Z" fill="#C080FF"/>
+<path d="M888.189 37.1387V45.8824H898.159V37.1387H888.189Z" fill="#C080FF"/>
+<path d="M888.189 72.0156V80.7594H898.159V72.0156H888.189Z" fill="#C080FF"/>
+<path d="M888.189 108.135V116.879H898.159V108.135H888.189Z" fill="#C080FF"/>
+<path d="M888.189 143.008V151.752H898.159V143.008H888.189Z" fill="#C080FF"/>
+<path d="M888.189 179.131V187.875H898.159V179.131H888.189Z" fill="#C080FF"/>
+<path d="M888.189 250.128V258.871H898.159V250.128H888.189Z" fill="#C080FF"/>
+<path d="M763.619 18.458V27.2017H773.579V18.458H763.619Z" fill="#C080FF"/>
+<path d="M763.619 54.5771V63.3208H773.579V54.5771H763.619Z" fill="#C080FF"/>
+<path d="M763.619 125.573V134.317H773.579V125.573H763.619Z" fill="#C080FF"/>
+<path d="M426.029 143.008V151.752H435.999V143.008H426.029Z" fill="#C080FF"/>
+<path d="M426.029 72.0156V80.7594H435.999V72.0156H426.029Z" fill="#C080FF"/>
+<path d="M426.029 37.1387V45.8824H435.999V37.1387H426.029Z" fill="#C080FF"/>
+<path d="M426.029 1.01953V9.76324H435.999V1.01953H426.029Z" fill="#C080FF"/>
+<path d="M692.609 18.458V27.2017H702.579V18.458H692.609Z" fill="#C080FF"/>
+<path d="M692.609 54.5771V63.3208H702.579V54.5771H692.609Z" fill="#C080FF"/>
+<path d="M692.609 125.573V134.317H702.579V125.573H692.609Z" fill="#C080FF"/>
+<path d="M497.039 214.004V222.748H506.999V214.004H497.039Z" fill="#C080FF"/>
+<path d="M497.039 143.008V151.752H506.999V143.008H497.039Z" fill="#C080FF"/>
+<path d="M497.039 72.0156V80.7594H506.999V72.0156H497.039Z" fill="#C080FF"/>
+<path d="M497.039 37.1387V45.8824H506.999V37.1387H497.039Z" fill="#C080FF"/>
+<path d="M497.039 1.01953V9.76324H506.999V1.01953H497.039Z" fill="#C080FF"/>
+<path d="M515.719 18.458V27.2017H524.439V18.458H515.719Z" fill="#C080FF"/>
+<path d="M533.159 108.135V116.879H541.879V108.135H533.159Z" fill="#C080FF"/>
+<path d="M533.159 72.0156V80.7594H541.879V72.0156H533.159Z" fill="#C080FF"/>
+<path d="M533.159 37.1387V45.8824H541.879V37.1387H533.159Z" fill="#C080FF"/>
+<path d="M533.159 1.01953V9.76324H541.879V1.01953H533.159Z" fill="#C080FF"/>
+<path d="M550.599 54.5771V63.3208H559.319V54.5771H550.599Z" fill="#C080FF"/>
+<path d="M569.289 285.001V293.744H578.009V285.001H569.289Z" fill="#C080FF"/>
+<path d="M569.289 214.004V222.748H578.009V214.004H569.289Z" fill="#C080FF"/>
+<path d="M569.289 143.008V151.752H578.009V143.008H569.289Z" fill="#C080FF"/>
+<path d="M569.289 108.135V116.879H578.009V108.135H569.289Z" fill="#C080FF"/>
+<path d="M569.289 72.0156V80.7594H578.009V72.0156H569.289Z" fill="#C080FF"/>
+<path d="M569.289 37.1387V45.8824H578.009V37.1387H569.289Z" fill="#C080FF"/>
+<path d="M569.289 1.01953V9.76324H578.009V1.01953H569.289Z" fill="#C080FF"/>
+<path d="M586.729 18.458V27.2017H595.449V18.458H586.729Z" fill="#C080FF"/>
+<path d="M604.169 179.131V187.875H612.889V179.131H604.169Z" fill="#C080FF"/>
+<path d="M604.169 108.135V116.879H612.889V108.135H604.169Z" fill="#C080FF"/>
+<path d="M604.169 72.0156V80.7594H612.889V72.0156H604.169Z" fill="#C080FF"/>
+<path d="M604.169 37.1387V45.8824H612.889V37.1387H604.169Z" fill="#C080FF"/>
+<path d="M604.169 1.01953V9.76324H612.889V1.01953H604.169Z" fill="#C080FF"/>
+<path d="M621.609 54.5771V63.3208H630.329V54.5771H621.609Z" fill="#C080FF"/>
+<path d="M621.609 18.458V27.2017H630.329V18.458H621.609Z" fill="#C080FF"/>
+<path d="M462.149 1.01953V9.76324H470.869V1.01953H462.149Z" fill="#C080FF"/>
+<path d="M462.149 37.1387V45.8824H470.869V37.1387H462.149Z" fill="#C080FF"/>
+<path d="M462.149 108.135V116.879H470.869V108.135H462.149Z" fill="#C080FF"/>
+<path d="M640.289 214.004V222.748H649.009V214.004H640.289Z" fill="#C080FF"/>
+<path d="M640.289 179.131V187.875H649.009V179.131H640.289Z" fill="#C080FF"/>
+<path d="M640.289 143.008V151.752H649.009V143.008H640.289Z" fill="#C080FF"/>
+<path d="M640.289 108.135V116.879H649.009V108.135H640.289Z" fill="#C080FF"/>
+<path d="M640.289 72.0156V80.7594H649.009V72.0156H640.289Z" fill="#C080FF"/>
+<path d="M640.289 37.1387V45.8824H649.009V37.1387H640.289Z" fill="#C080FF"/>
+<path d="M640.289 1.01953V9.76324H649.009V1.01953H640.289Z" fill="#C080FF"/>
+<path d="M657.729 54.5771V63.3208H666.449V54.5771H657.729Z" fill="#C080FF"/>
+<path d="M657.729 18.458V27.2017H666.449V18.458H657.729Z" fill="#C080FF"/>
+<path d="M675.169 179.131V187.875H683.889V179.131H675.169Z" fill="#C080FF"/>
+<path d="M675.169 108.135V116.879H683.889V108.135H675.169Z" fill="#C080FF"/>
+<path d="M675.169 72.0156V80.7594H683.889V72.0156H675.169Z" fill="#C080FF"/>
+<path d="M675.169 37.1387V45.8824H683.889V37.1387H675.169Z" fill="#C080FF"/>
+<path d="M675.169 1.01953V9.76324H683.889V1.01953H675.169Z" fill="#C080FF"/>
+<path d="M711.299 285.001V293.744H720.019V285.001H711.299Z" fill="#C080FF"/>
+<path d="M711.299 214.004V222.748H720.019V214.004H711.299Z" fill="#C080FF"/>
+<path d="M711.299 179.131V187.875H720.019V179.131H711.299Z" fill="#C080FF"/>
+<path d="M711.299 143.008V151.752H720.019V143.008H711.299Z" fill="#C080FF"/>
+<path d="M711.299 108.135V116.879H720.019V108.135H711.299Z" fill="#C080FF"/>
+<path d="M711.299 72.0156V80.7594H720.019V72.0156H711.299Z" fill="#C080FF"/>
+<path d="M711.299 37.1387V45.8824H720.019V37.1387H711.299Z" fill="#C080FF"/>
+<path d="M711.299 1.01953V9.76324H720.019V1.01953H711.299Z" fill="#C080FF"/>
+<path d="M728.739 89.4502V98.1939H737.459V89.4502H728.739Z" fill="#C080FF"/>
+<path d="M728.739 54.5771V63.3208H737.459V54.5771H728.739Z" fill="#C080FF"/>
+<path d="M728.739 18.458V27.2017H737.459V18.458H728.739Z" fill="#C080FF"/>
+<path d="M746.179 179.131V187.875H754.899V179.131H746.179Z" fill="#C080FF"/>
+<path d="M746.179 143.008V151.752H754.899V143.008H746.179Z" fill="#C080FF"/>
+<path d="M746.179 108.135V116.879H754.899V108.135H746.179Z" fill="#C080FF"/>
+<path d="M746.179 72.0156V80.7594H754.899V72.0156H746.179Z" fill="#C080FF"/>
+<path d="M746.179 37.1387V45.8824H754.899V37.1387H746.179Z" fill="#C080FF"/>
+<path d="M746.179 18.458V27.2017H754.899V18.458H746.179Z" fill="#C080FF"/>
+<path d="M746.179 1.01953V9.76324H754.899V1.01953H746.179Z" fill="#C080FF"/>
+<path d="M391.149 1.01953V9.76324H399.869V1.01953H391.149Z" fill="#C080FF"/>
+<path d="M391.149 37.1387V45.8824H399.869V37.1387H391.149Z" fill="#C080FF"/>
+<path d="M391.149 108.135V116.879H399.869V108.135H391.149Z" fill="#C080FF"/>
+<path d="M782.299 285.001V293.744H791.019V285.001H782.299Z" fill="#C080FF"/>
+<path d="M782.299 214.004V222.748H791.019V214.004H782.299Z" fill="#C080FF"/>
+<path d="M782.299 179.131V187.875H791.019V179.131H782.299Z" fill="#C080FF"/>
+<path d="M782.299 143.008V151.752H791.019V143.008H782.299Z" fill="#C080FF"/>
+<path d="M782.299 108.135V116.879H791.019V108.135H782.299Z" fill="#C080FF"/>
+<path d="M782.299 72.0156V80.7594H791.019V72.0156H782.299Z" fill="#C080FF"/>
+<path d="M782.299 54.5771V63.3208H791.019V54.5771H782.299Z" fill="#C080FF"/>
+<path d="M782.299 37.1387V45.8824H791.019V37.1387H782.299Z" fill="#C080FF"/>
+<path d="M782.299 18.458V27.2017H791.019V18.458H782.299Z" fill="#C080FF"/>
+<path d="M782.299 1.01953V9.76324H791.019V1.01953H782.299Z" fill="#C080FF"/>
+<path d="M799.739 89.4502V98.1939H808.459V89.4502H799.739Z" fill="#C080FF"/>
+<path d="M799.739 54.5771V63.3208H808.459V54.5771H799.739Z" fill="#C080FF"/>
+<path d="M799.739 18.458V27.2017H808.459V18.458H799.739Z" fill="#C080FF"/>
+<path d="M817.179 250.128V258.871H825.899V250.128H817.179Z" fill="#C080FF"/>
+<path d="M817.179 179.131V187.875H825.899V179.131H817.179Z" fill="#C080FF"/>
+<path d="M817.179 143.008V151.752H825.899V143.008H817.179Z" fill="#C080FF"/>
+<path d="M817.179 108.135V116.879H825.899V108.135H817.179Z" fill="#C080FF"/>
+<path d="M817.179 72.0156V80.7594H825.899V72.0156H817.179Z" fill="#C080FF"/>
+<path d="M817.179 37.1387V45.8824H825.899V37.1387H817.179Z" fill="#C080FF"/>
+<path d="M817.179 18.458V27.2017H825.899V18.458H817.179Z" fill="#C080FF"/>
+<path d="M817.179 1.01953V9.76324H825.899V1.01953H817.179Z" fill="#C080FF"/>
+<path d="M355.029 1.01953V9.76324H363.749V1.01953H355.029Z" fill="#C080FF"/>
+<path d="M355.029 37.1387V45.8824H363.749V37.1387H355.029Z" fill="#C080FF"/>
+<path d="M355.029 72.0156V80.7594H363.749V72.0156H355.029Z" fill="#C080FF"/>
+<path d="M355.029 143.008V151.752H363.749V143.008H355.029Z" fill="#C080FF"/>
+<path d="M355.029 214.004V222.748H363.749V214.004H355.029Z" fill="#C080FF"/>
+<path d="M835.869 125.573V134.317H844.589V125.573H835.869Z" fill="#C080FF"/>
+<path d="M835.869 89.4502V98.1939H844.589V89.4502H835.869Z" fill="#C080FF"/>
+<path d="M835.869 54.5771V63.3208H844.589V54.5771H835.869Z" fill="#C080FF"/>
+<path d="M835.869 18.458V27.2017H844.589V18.458H835.869Z" fill="#C080FF"/>
+<path d="M853.309 285.001V293.744H862.029V285.001H853.309Z" fill="#C080FF"/>
+<path d="M853.309 214.004V222.748H862.029V214.004H853.309Z" fill="#C080FF"/>
+<path d="M853.309 179.131V187.875H862.029V179.131H853.309Z" fill="#C080FF"/>
+<path d="M853.309 143.008V151.752H862.029V143.008H853.309Z" fill="#C080FF"/>
+<path d="M853.309 108.135V116.879H862.029V108.135H853.309Z" fill="#C080FF"/>
+<path d="M853.309 72.0156V80.7594H862.029V72.0156H853.309Z" fill="#C080FF"/>
+<path d="M853.309 54.5771V63.3208H862.029V54.5771H853.309Z" fill="#C080FF"/>
+<path d="M853.309 37.1387V45.8824H862.029V37.1387H853.309Z" fill="#C080FF"/>
+<path d="M853.309 18.458V27.2017H862.029V18.458H853.309Z" fill="#C080FF"/>
+<path d="M853.309 1.01953V9.76324H862.029V1.01953H853.309Z" fill="#C080FF"/>
+<path d="M870.749 125.573V134.317H879.469V125.573H870.749Z" fill="#C080FF"/>
+<path d="M870.749 89.4502V98.1939H879.469V89.4502H870.749Z" fill="#C080FF"/>
+<path d="M870.749 54.5771V63.3208H879.469V54.5771H870.749Z" fill="#C080FF"/>
+<path d="M870.749 18.458V27.2017H879.469V18.458H870.749Z" fill="#C080FF"/>
+<path d="M870.749 1.01953V9.76324H879.469V1.01953H870.749Z" fill="#C080FF"/>
+<path d="M906.869 196.57V205.314H915.589V196.57H906.869Z" fill="#C080FF"/>
+<path d="M906.869 125.573V134.317H915.589V125.573H906.869Z" fill="#C080FF"/>
+<path d="M906.869 89.4502V98.1939H915.589V89.4502H906.869Z" fill="#C080FF"/>
+<path d="M906.869 54.5771V63.3208H915.589V54.5771H906.869Z" fill="#C080FF"/>
+<path d="M906.869 37.1387V45.8824H915.589V37.1387H906.869Z" fill="#C080FF"/>
+<path d="M906.869 18.458V27.2017H915.589V18.458H906.869Z" fill="#C080FF"/>
+<path d="M320.149 1.01953V9.76324H328.869V1.01953H320.149Z" fill="#C080FF"/>
+<path d="M320.149 37.1387V45.8824H328.869V37.1387H320.149Z" fill="#C080FF"/>
+<path d="M924.309 355.997V364.741H933.029V355.997H924.309Z" fill="#C080FF"/>
+<path d="M924.309 285.001V293.744H933.029V285.001H924.309Z" fill="#C080FF"/>
+<path d="M924.309 214.004V222.748H933.029V214.004H924.309Z" fill="#C080FF"/>
+<path d="M924.309 179.131V187.875H933.029V179.131H924.309Z" fill="#C080FF"/>
+<path d="M924.309 143.008V151.752H933.029V143.008H924.309Z" fill="#C080FF"/>
+<path d="M924.309 108.135V116.879H933.029V108.135H924.309Z" fill="#C080FF"/>
+<path d="M924.309 72.0156V80.7594H933.029V72.0156H924.309Z" fill="#C080FF"/>
+<path d="M924.309 54.5771V63.3208H933.029V54.5771H924.309Z" fill="#C080FF"/>
+<path d="M924.309 37.1387V45.8824H933.029V37.1387H924.309Z" fill="#C080FF"/>
+<path d="M924.309 18.458V27.2017H933.029V18.458H924.309Z" fill="#C080FF"/>
+<path d="M924.309 1.01953V9.76324H933.029V1.01953H924.309Z" fill="#C080FF"/>
+<path d="M941.749 125.573V134.317H950.469V125.573H941.749Z" fill="#C080FF"/>
+<path d="M941.749 89.4502V98.1939H950.469V89.4502H941.749Z" fill="#C080FF"/>
+<path d="M941.749 54.5771V63.3208H950.469V54.5771H941.749Z" fill="#C080FF"/>
+<path d="M941.749 18.458V27.2017H950.469V18.458H941.749Z" fill="#C080FF"/>
+<path d="M941.749 1.01953V9.76324H950.469V1.01953H941.749Z" fill="#C080FF"/>
+<path d="M284.019 1.01953V9.76324H292.739V1.01953H284.019Z" fill="#C080FF"/>
+<path d="M284.019 72.0156V80.7594H292.739V72.0156H284.019Z" fill="#C080FF"/>
+<path d="M284.019 143.008V151.752H292.739V143.008H284.019Z" fill="#C080FF"/>
+<path d="M977.879 196.57V205.314H986.599V196.57H977.879Z" fill="#C080FF"/>
+<path d="M977.879 125.573V134.317H986.599V125.573H977.879Z" fill="#C080FF"/>
+<path d="M977.879 89.4502V98.1939H986.599V89.4502H977.879Z" fill="#C080FF"/>
+<path d="M977.879 54.5771V63.3208H986.599V54.5771H977.879Z" fill="#C080FF"/>
+<path d="M977.879 37.1387V45.8824H986.599V37.1387H977.879Z" fill="#C080FF"/>
+<path d="M977.879 18.458V27.2017H986.599V18.458H977.879Z" fill="#C080FF"/>
+<path d="M977.879 1.0446V9.76338H986.619C986.699 6.87373 986.519 3.93425 986.619 1.0446C983.729 1.14425 980.789 0.969872 977.899 1.0446H977.879Z" fill="#C080FF"/>
+<path d="M995.319 9.76292H1004.04V1.01921C1001.15 0.944482 998.209 1.11885 995.319 1.01921C995.419 3.90886 995.239 6.84833 995.319 9.73798V9.76292Z" fill="#C080FF"/>
+<path d="M995.319 355.997V364.741H1004.04V355.997H995.319Z" fill="#C080FF"/>
+<path d="M995.319 285.001V293.744H1004.04V285.001H995.319Z" fill="#C080FF"/>
+<path d="M995.319 250.128V258.871H1004.04V250.128H995.319Z" fill="#C080FF"/>
+<path d="M995.319 214.004V222.748H1004.04V214.004H995.319Z" fill="#C080FF"/>
+<path d="M995.319 179.131V187.875H1004.04V179.131H995.319Z" fill="#C080FF"/>
+<path d="M995.319 143.008V151.752H1004.04V143.008H995.319Z" fill="#C080FF"/>
+<path d="M995.319 125.573V134.317H1004.04V125.573H995.319Z" fill="#C080FF"/>
+<path d="M995.319 108.135V116.879H1004.04V108.135H995.319Z" fill="#C080FF"/>
+<path d="M995.319 89.4502V98.1939H1004.04V89.4502H995.319Z" fill="#C080FF"/>
+<path d="M995.319 72.0156V80.7594H1004.04V72.0156H995.319Z" fill="#C080FF"/>
+<path d="M995.319 54.5771V63.3208H1004.04V54.5771H995.319Z" fill="#C080FF"/>
+<path d="M995.319 37.1387V45.8824H1004.04V37.1387H995.319Z" fill="#C080FF"/>
+<path d="M995.319 18.458V27.2017H1004.04V18.458H995.319Z" fill="#C080FF"/>
+<path d="M1012.76 125.573V134.317H1021.48V125.573H1012.76Z" fill="#C080FF"/>
+<path d="M1012.76 89.4502V98.1939H1021.48V89.4502H1012.76Z" fill="#C080FF"/>
+<path d="M1012.76 54.5771V63.3208H1021.48V54.5771H1012.76Z" fill="#C080FF"/>
+<path d="M1012.76 18.458V27.2017H1021.48V18.458H1012.76Z" fill="#C080FF"/>
+<path d="M1012.76 1.01953V9.76324H1021.48V1.01953H1012.76Z" fill="#C080FF"/>
+<path d="M1031.44 321.124V329.868H1040.16V321.124H1031.44Z" fill="#C080FF"/>
+<path d="M1031.44 250.128V258.871H1040.16V250.128H1031.44Z" fill="#C080FF"/>
+<path d="M1031.44 214.004V222.748H1040.16V214.004H1031.44Z" fill="#C080FF"/>
+<path d="M1031.44 179.131V187.875H1040.16V179.131H1031.44Z" fill="#C080FF"/>
+<path d="M1031.44 143.008V151.752H1040.16V143.008H1031.44Z" fill="#C080FF"/>
+<path d="M1031.44 108.135V116.879H1040.16V108.135H1031.44Z" fill="#C080FF"/>
+<path d="M1031.44 89.4502V98.1939H1040.16V89.4502H1031.44Z" fill="#C080FF"/>
+<path d="M1031.44 72.0156V80.7594H1040.16V72.0156H1031.44Z" fill="#C080FF"/>
+<path d="M1031.44 54.5771V63.3208H1040.16V54.5771H1031.44Z" fill="#C080FF"/>
+<path d="M1031.44 37.1387V45.8824H1040.16V37.1387H1031.44Z" fill="#C080FF"/>
+<path d="M1031.44 18.458V27.2017H1040.16V18.458H1031.44Z" fill="#C080FF"/>
+<path d="M1031.44 1.01953V9.76324H1040.16V1.01953H1031.44Z" fill="#C080FF"/>
+<path d="M1048.88 196.57V205.314H1057.6V196.57H1048.88Z" fill="#C080FF"/>
+<path d="M1048.88 125.573V134.317H1057.6V125.573H1048.88Z" fill="#C080FF"/>
+<path d="M1048.88 89.4502V98.1939H1057.6V89.4502H1048.88Z" fill="#C080FF"/>
+<path d="M1048.88 54.5771V63.3208H1057.6V54.5771H1048.88Z" fill="#C080FF"/>
+<path d="M1048.88 37.1387V45.8824H1057.6V37.1387H1048.88Z" fill="#C080FF"/>
+<path d="M1048.88 18.458V27.2017H1057.6V18.458H1048.88Z" fill="#C080FF"/>
+<path d="M1048.88 1.0446V9.76338H1057.63C1057.7 6.87373 1057.53 3.93425 1057.63 1.0446C1054.74 1.14425 1051.8 0.969872 1048.91 1.0446H1048.88Z" fill="#C080FF"/>
+<path d="M1066.32 9.76292H1075.04V1.01921C1072.15 0.944482 1069.21 1.11885 1066.32 1.01921C1066.42 3.90886 1066.25 6.84833 1066.32 9.73798V9.76292Z" fill="#C080FF"/>
+<path d="M1066.32 355.997V364.741H1075.04V355.997H1066.32Z" fill="#C080FF"/>
+<path d="M1066.32 285.001V293.744H1075.04V285.001H1066.32Z" fill="#C080FF"/>
+<path d="M1066.32 250.128V258.871H1075.04V250.128H1066.32Z" fill="#C080FF"/>
+<path d="M1066.32 214.004V222.748H1075.04V214.004H1066.32Z" fill="#C080FF"/>
+<path d="M1066.32 179.131V187.875H1075.04V179.131H1066.32Z" fill="#C080FF"/>
+<path d="M1066.32 143.008V151.752H1075.04V143.008H1066.32Z" fill="#C080FF"/>
+<path d="M1066.32 125.573V134.317H1075.04V125.573H1066.32Z" fill="#C080FF"/>
+<path d="M1066.32 108.135V116.879H1075.04V108.135H1066.32Z" fill="#C080FF"/>
+<path d="M1066.32 89.4502V98.1939H1075.04V89.4502H1066.32Z" fill="#C080FF"/>
+<path d="M1066.32 72.0156V80.7594H1075.04V72.0156H1066.32Z" fill="#C080FF"/>
+<path d="M1066.32 54.5771V63.3208H1075.04V54.5771H1066.32Z" fill="#C080FF"/>
+<path d="M1066.32 37.1387V45.8824H1075.04V37.1387H1066.32Z" fill="#C080FF"/>
+<path d="M1066.32 18.458V27.2017H1075.04V18.458H1066.32Z" fill="#C080FF"/>
+<path d="M249.139 37.1387V45.8824H257.859V37.1387H249.139Z" fill="#C080FF"/>
+<path d="M1083.76 196.57V205.314H1092.48V196.57H1083.76Z" fill="#C080FF"/>
+<path d="M1083.76 125.573V134.317H1092.48V125.573H1083.76Z" fill="#C080FF"/>
+<path d="M1083.76 89.4502V98.1939H1092.48V89.4502H1083.76Z" fill="#C080FF"/>
+<path d="M1083.76 72.0156V80.7594H1092.48V72.0156H1083.76Z" fill="#C080FF"/>
+<path d="M1083.76 54.5771V63.3208H1092.48V54.5771H1083.76Z" fill="#C080FF"/>
+<path d="M1083.76 37.1387V45.8824H1092.48V37.1387H1083.76Z" fill="#C080FF"/>
+<path d="M1083.76 18.458V27.2017H1092.48V18.458H1083.76Z" fill="#C080FF"/>
+<path d="M1083.76 1.01953V9.76324H1092.48V1.01953H1083.76Z" fill="#C080FF"/>
+<path d="M1102.45 321.124V329.868H1111.17V321.124H1102.45Z" fill="#C080FF"/>
+<path d="M1102.45 250.128V258.871H1111.17V250.128H1102.45Z" fill="#C080FF"/>
+<path d="M1102.45 214.004V222.748H1111.17V214.004H1102.45Z" fill="#C080FF"/>
+<path d="M1102.45 179.131V187.875H1111.17V179.131H1102.45Z" fill="#C080FF"/>
+<path d="M1102.45 143.008V151.752H1111.17V143.008H1102.45Z" fill="#C080FF"/>
+<path d="M1102.45 108.135V116.879H1111.17V108.135H1102.45Z" fill="#C080FF"/>
+<path d="M1102.45 89.4502V98.1939H1111.17V89.4502H1102.45Z" fill="#C080FF"/>
+<path d="M1102.45 72.0156V80.7594H1111.17V72.0156H1102.45Z" fill="#C080FF"/>
+<path d="M1102.45 54.5771V63.3208H1111.17V54.5771H1102.45Z" fill="#C080FF"/>
+<path d="M1102.45 37.1387V45.8824H1111.17V37.1387H1102.45Z" fill="#C080FF"/>
+<path d="M1102.45 18.458V27.2017H1111.17V18.458H1102.45Z" fill="#C080FF"/>
+<path d="M1102.45 1.01953V9.76324H1111.17V1.01953H1102.45Z" fill="#C080FF"/>
+<path d="M1119.89 196.57V205.314H1128.61V196.57H1119.89Z" fill="#C080FF"/>
+<path d="M1119.89 125.573V134.317H1128.61V125.573H1119.89Z" fill="#C080FF"/>
+<path d="M1119.89 89.4502V98.1939H1128.61V89.4502H1119.89Z" fill="#C080FF"/>
+<path d="M1119.89 54.5771V63.3208H1128.61V54.5771H1119.89Z" fill="#C080FF"/>
+<path d="M1119.89 37.1387V45.8824H1128.61V37.1387H1119.89Z" fill="#C080FF"/>
+<path d="M1119.89 18.458V27.2017H1128.61V18.458H1119.89Z" fill="#C080FF"/>
+<path d="M213.009 1.01953V9.76324H221.729V1.01953H213.009Z" fill="#C080FF"/>
+<path d="M213.009 72.0156V80.7594H221.729V72.0156H213.009Z" fill="#C080FF"/>
+<path d="M1137.33 355.997V364.741H1146.05V355.997H1137.33Z" fill="#C080FF"/>
+<path d="M1137.33 285.001V293.744H1146.05V285.001H1137.33Z" fill="#C080FF"/>
+<path d="M1137.33 250.128V258.871H1146.05V250.128H1137.33Z" fill="#C080FF"/>
+<path d="M1137.33 214.004V222.748H1146.05V214.004H1137.33Z" fill="#C080FF"/>
+<path d="M1137.33 179.131V187.875H1146.05V179.131H1137.33Z" fill="#C080FF"/>
+<path d="M1137.33 143.008V151.752H1146.05V143.008H1137.33Z" fill="#C080FF"/>
+<path d="M1137.33 125.573V134.317H1146.05V125.573H1137.33Z" fill="#C080FF"/>
+<path d="M1137.33 108.135V116.879H1146.05V108.135H1137.33Z" fill="#C080FF"/>
+<path d="M1137.33 89.4502V98.1939H1146.05V89.4502H1137.33Z" fill="#C080FF"/>
+<path d="M1137.33 72.0156V80.7594H1146.05V72.0156H1137.33Z" fill="#C080FF"/>
+<path d="M1137.33 54.5771V63.3208H1146.05V54.5771H1137.33Z" fill="#C080FF"/>
+<path d="M1137.33 37.1387V45.8824H1146.05V37.1387H1137.33Z" fill="#C080FF"/>
+<path d="M1137.33 18.458V27.2017H1146.05V18.458H1137.33Z" fill="#C080FF"/>
+<path d="M1173.45 321.124V329.868H1182.17V321.124H1173.45Z" fill="#C080FF"/>
+<path d="M1173.45 285.001V293.744H1182.17V285.001H1173.45Z" fill="#C080FF"/>
+<path d="M1173.45 250.128V258.871H1182.17V250.128H1173.45Z" fill="#C080FF"/>
+<path d="M1173.45 214.004V222.748H1182.17V214.004H1173.45Z" fill="#C080FF"/>
+<path d="M1173.45 179.131V187.875H1182.17V179.131H1173.45Z" fill="#C080FF"/>
+<path d="M1173.45 143.008V151.752H1182.17V143.008H1173.45Z" fill="#C080FF"/>
+<path d="M1173.45 125.573V134.317H1182.17V125.573H1173.45Z" fill="#C080FF"/>
+<path d="M1173.45 108.135V116.879H1182.17V108.135H1173.45Z" fill="#C080FF"/>
+<path d="M1173.45 89.4502V98.1939H1182.17V89.4502H1173.45Z" fill="#C080FF"/>
+<path d="M1173.45 72.0156V80.7594H1182.17V72.0156H1173.45Z" fill="#C080FF"/>
+<path d="M1173.45 54.5771V63.3208H1182.17V54.5771H1173.45Z" fill="#C080FF"/>
+<path d="M1190.89 267.562V276.306H1199.61V267.562H1190.89Z" fill="#C080FF"/>
+<path d="M1190.89 196.57V205.314H1199.61V196.57H1190.89Z" fill="#C080FF"/>
+<path d="M1190.89 125.573V134.317H1199.61V125.573H1190.89Z" fill="#C080FF"/>
+<path d="M1190.89 108.135V116.879H1199.61V108.135H1190.89Z" fill="#C080FF"/>
+<path d="M1190.89 89.4502V98.1939H1199.61V89.4502H1190.89Z" fill="#C080FF"/>
+<path d="M1199.61 54.5791H1190.89V63.3228C1193.78 63.3975 1196.72 63.2231 1199.61 63.3228C1199.51 60.4331 1199.69 57.4936 1199.61 54.604V54.5791Z" fill="#C080FF"/>
+<path d="M1217.05 63.3208V54.5771H1208.31C1208.23 57.4667 1208.41 60.4062 1208.31 63.2958C1211.2 63.1962 1214.14 63.3706 1217.03 63.2958L1217.05 63.3208Z" fill="#C080FF"/>
+<path d="M1208.33 80.7591H1217.05V72.0153C1214.16 71.9406 1211.22 72.115 1208.33 72.0153C1208.43 74.905 1208.26 77.8445 1208.33 80.7341V80.7591Z" fill="#C080FF"/>
+<path d="M1190.89 72.0407V80.7595H1199.64C1199.71 77.8698 1199.54 74.9303 1199.64 72.0407C1196.75 72.1403 1193.81 71.966 1190.92 72.0407H1190.89Z" fill="#C080FF"/>
+<path d="M1208.33 63.3193C1205.44 63.4189 1202.5 63.4189 1199.61 63.3193C1199.71 66.209 1199.71 69.1484 1199.61 72.0381C1202.5 71.9384 1205.44 71.9384 1208.33 72.0381C1208.23 69.1484 1208.23 66.209 1208.33 63.3193Z" fill="#C080FF"/>
+<path d="M1208.33 355.997V364.741H1217.05V355.997H1208.33Z" fill="#C080FF"/>
+<path d="M1208.33 321.124V329.868H1217.05V321.124H1208.33Z" fill="#C080FF"/>
+<path d="M1208.33 285.001V293.744H1217.05V285.001H1208.33Z" fill="#C080FF"/>
+<path d="M1208.33 250.128V258.871H1217.05V250.128H1208.33Z" fill="#C080FF"/>
+<path d="M1208.33 214.004V222.748H1217.05V214.004H1208.33Z" fill="#C080FF"/>
+<path d="M1208.33 196.57V205.314H1217.05V196.57H1208.33Z" fill="#C080FF"/>
+<path d="M1208.33 179.131V187.875H1217.05V179.131H1208.33Z" fill="#C080FF"/>
+<path d="M1208.33 143.008V151.752H1217.05V143.008H1208.33Z" fill="#C080FF"/>
+<path d="M1208.33 125.573V134.317H1217.05V125.573H1208.33Z" fill="#C080FF"/>
+<path d="M1208.33 108.135V116.879H1217.05V108.135H1208.33Z" fill="#C080FF"/>
+<path d="M1208.33 89.4502V98.1939H1217.05V89.4502H1208.33Z" fill="#C080FF"/>
+<path d="M1244.46 392.116V400.859H1253.18V392.116H1244.46Z" fill="#C080FF"/>
+<path d="M1244.46 321.124V329.868H1253.18V321.124H1244.46Z" fill="#C080FF"/>
+<path d="M1244.46 285.001V293.744H1253.18V285.001H1244.46Z" fill="#C080FF"/>
+<path d="M1244.46 250.128V258.871H1253.18V250.128H1244.46Z" fill="#C080FF"/>
+<path d="M1244.46 214.004V222.748H1253.18V214.004H1244.46Z" fill="#C080FF"/>
+<path d="M1244.46 179.131V187.875H1253.18V179.131H1244.46Z" fill="#C080FF"/>
+<path d="M1244.46 143.008V151.752H1253.18V143.008H1244.46Z" fill="#C080FF"/>
+<path d="M1244.46 125.573V134.317H1253.18V125.573H1244.46Z" fill="#C080FF"/>
+<path d="M1244.46 108.135V116.879H1253.18V108.135H1244.46Z" fill="#C080FF"/>
+<path d="M1244.46 89.4502V98.1939H1253.18V89.4502H1244.46Z" fill="#C080FF"/>
+<path d="M1244.46 72.0156V80.7594H1253.18V72.0156H1244.46Z" fill="#C080FF"/>
+<path d="M1244.46 54.5771V63.3208H1253.18V54.5771H1244.46Z" fill="#C080FF"/>
+<path d="M142.009 1.01953V9.76324H150.729V1.01953H142.009Z" fill="#C080FF"/>
+<path d="M1261.9 267.562V276.306H1270.62V267.562H1261.9Z" fill="#C080FF"/>
+<path d="M1261.9 196.57V205.314H1270.62V196.57H1261.9Z" fill="#C080FF"/>
+<path d="M1261.9 125.573V134.317H1270.62V125.573H1261.9Z" fill="#C080FF"/>
+<path d="M1261.9 108.135V116.879H1270.62V108.135H1261.9Z" fill="#C080FF"/>
+<path d="M1261.9 89.4502V98.1939H1270.62V89.4502H1261.9Z" fill="#C080FF"/>
+<path d="M1279.34 63.3193C1276.45 63.4189 1273.51 63.4189 1270.62 63.3193C1270.72 66.209 1270.72 69.1484 1270.62 72.0381C1273.51 71.9384 1276.45 71.9384 1279.34 72.0381C1279.24 69.1484 1279.24 66.209 1279.34 63.3193Z" fill="#C080FF"/>
+<path d="M1279.34 80.7591H1288.06V72.0153C1285.17 71.9406 1282.23 72.115 1279.34 72.0153C1279.44 74.905 1279.26 77.8445 1279.34 80.7341V80.7591Z" fill="#C080FF"/>
+<path d="M1288.06 63.3208V54.5771H1279.31C1279.24 57.4667 1279.41 60.4062 1279.31 63.2958C1282.2 63.1962 1285.14 63.3706 1288.03 63.2958L1288.06 63.3208Z" fill="#C080FF"/>
+<path d="M1270.62 54.5791H1261.9V63.3228C1264.79 63.3975 1267.73 63.2231 1270.62 63.3228C1270.52 60.4331 1270.69 57.4936 1270.62 54.604V54.5791Z" fill="#C080FF"/>
+<path d="M1261.9 72.0407V80.7595H1270.64C1270.72 77.8698 1270.54 74.9303 1270.64 72.0407C1267.75 72.1403 1264.81 71.966 1261.92 72.0407H1261.9Z" fill="#C080FF"/>
+<path d="M1279.34 355.997V364.741H1288.06V355.997H1279.34Z" fill="#C080FF"/>
+<path d="M1279.34 321.124V329.868H1288.06V321.124H1279.34Z" fill="#C080FF"/>
+<path d="M1279.34 285.001V293.744H1288.06V285.001H1279.34Z" fill="#C080FF"/>
+<path d="M1279.34 250.128V258.871H1288.06V250.128H1279.34Z" fill="#C080FF"/>
+<path d="M1279.34 214.004V222.748H1288.06V214.004H1279.34Z" fill="#C080FF"/>
+<path d="M1279.34 196.57V205.314H1288.06V196.57H1279.34Z" fill="#C080FF"/>
+<path d="M1279.34 179.131V187.875H1288.06V179.131H1279.34Z" fill="#C080FF"/>
+<path d="M1279.34 143.008V151.752H1288.06V143.008H1279.34Z" fill="#C080FF"/>
+<path d="M1279.34 125.573V134.317H1288.06V125.573H1279.34Z" fill="#C080FF"/>
+<path d="M1279.34 108.135V116.879H1288.06V108.135H1279.34Z" fill="#C080FF"/>
+<path d="M1279.34 89.4502V98.1939H1288.06V89.4502H1279.34Z" fill="#C080FF"/>
+<path d="M1298.02 267.562V276.306H1306.74V267.562H1298.02Z" fill="#C080FF"/>
+<path d="M1298.02 196.57V205.314H1306.74V196.57H1298.02Z" fill="#C080FF"/>
+<path d="M1298.02 143.008V151.752H1306.74V143.008H1298.02Z" fill="#C080FF"/>
+<path d="M1298.02 125.573V134.317H1306.74V125.573H1298.02Z" fill="#C080FF"/>
+<path d="M1298.02 108.135V116.879H1306.74V108.135H1298.02Z" fill="#C080FF"/>
+<path d="M1298.02 89.4502V98.1939H1306.74V89.4502H1298.02Z" fill="#C080FF"/>
+<path d="M1298.02 72.0156V80.7594H1306.74V72.0156H1298.02Z" fill="#C080FF"/>
+<path d="M1298.02 54.5771V63.3208H1306.74V54.5771H1298.02Z" fill="#C080FF"/>
+<path d="M1315.46 392.116V400.859H1324.18V392.116H1315.46Z" fill="#C080FF"/>
+<path d="M1315.46 321.124V329.868H1324.18V321.124H1315.46Z" fill="#C080FF"/>
+<path d="M1315.46 285.001V293.744H1324.18V285.001H1315.46Z" fill="#C080FF"/>
+<path d="M1315.46 250.128V258.871H1324.18V250.128H1315.46Z" fill="#C080FF"/>
+<path d="M1315.46 214.004V222.748H1324.18V214.004H1315.46Z" fill="#C080FF"/>
+<path d="M1315.46 179.131V187.875H1324.18V179.131H1315.46Z" fill="#C080FF"/>
+<path d="M1315.46 143.008V151.752H1324.18V143.008H1315.46Z" fill="#C080FF"/>
+<path d="M1315.46 125.573V134.317H1324.18V125.573H1315.46Z" fill="#C080FF"/>
+<path d="M1315.46 108.135V116.879H1324.18V108.135H1315.46Z" fill="#C080FF"/>
+<path d="M1315.46 89.4502V98.1939H1324.18V89.4502H1315.46Z" fill="#C080FF"/>
+<path d="M1315.46 72.0156V80.7594H1324.18V72.0156H1315.46Z" fill="#C080FF"/>
+<path d="M1315.46 54.5771V63.3208H1324.18V54.5771H1315.46Z" fill="#C080FF"/>
+<path d="M1332.9 267.562V276.306H1341.62V267.562H1332.9Z" fill="#C080FF"/>
+<path d="M1332.9 196.57V205.314H1341.62V196.57H1332.9Z" fill="#C080FF"/>
+<path d="M1332.9 125.573V134.317H1341.62V125.573H1332.9Z" fill="#C080FF"/>
+<path d="M1332.9 108.135V116.879H1341.62V108.135H1332.9Z" fill="#C080FF"/>
+<path d="M1332.9 89.4502V98.1939H1341.62V89.4502H1332.9Z" fill="#C080FF"/>
+<path d="M71.0049 1.01953V9.76324H79.7249V1.01953H71.0049Z" fill="#C080FF"/>
+<path d="M71.0049 72.0156V80.7594H79.7249V72.0156H71.0049Z" fill="#C080FF"/>
+<path d="M1369.03 303.686V312.43H1377.75V303.686H1369.03Z" fill="#C080FF"/>
+<path d="M1369.03 267.562V276.306H1377.75V267.562H1369.03Z" fill="#C080FF"/>
+<path d="M1369.03 196.57V205.314H1377.75V196.57H1369.03Z" fill="#C080FF"/>
+<path d="M1369.03 143.008V151.752H1377.75V143.008H1369.03Z" fill="#C080FF"/>
+<path d="M1369.03 125.573V134.317H1377.75V125.573H1369.03Z" fill="#C080FF"/>
+<path d="M1386.47 392.116V400.859H1395.19V392.116H1386.47Z" fill="#C080FF"/>
+<path d="M1386.47 355.997V364.741H1395.19V355.997H1386.47Z" fill="#C080FF"/>
+<path d="M1386.47 321.124V329.868H1395.19V321.124H1386.47Z" fill="#C080FF"/>
+<path d="M1386.47 285.001V293.744H1395.19V285.001H1386.47Z" fill="#C080FF"/>
+<path d="M1386.47 250.128V258.871H1395.19V250.128H1386.47Z" fill="#C080FF"/>
+<path d="M1386.47 214.004V222.748H1395.19V214.004H1386.47Z" fill="#C080FF"/>
+<path d="M1386.47 196.57V205.314H1395.19V196.57H1386.47Z" fill="#C080FF"/>
+<path d="M1386.47 179.131V187.875H1395.19V179.131H1386.47Z" fill="#C080FF"/>
+<path d="M1386.47 143.008V151.752H1395.19V143.008H1386.47Z" fill="#C080FF"/>
+<path d="M1386.47 125.573V134.317H1395.19V125.573H1386.47Z" fill="#C080FF"/>
+<path d="M1403.91 267.562V276.306H1412.66V267.562H1403.91Z" fill="#C080FF"/>
+<path d="M1403.91 196.57V205.314H1412.66V196.57H1403.91Z" fill="#C080FF"/>
+<path d="M1403.91 179.131V187.875H1412.66V179.131H1403.91Z" fill="#C080FF"/>
+<path d="M1403.91 143.008V151.752H1412.66V143.008H1403.91Z" fill="#C080FF"/>
+<path d="M1403.91 125.573V134.317H1412.66V125.573H1403.91Z" fill="#C080FF"/>
+<path d="M0 1.01953V9.76324H8.72003V1.01953H0Z" fill="#C080FF"/>
+</g>
+<defs>
+<clipPath id="clip0_414_125114">
+<rect width="1421" height="507" fill="white"/>
+</clipPath>
+</defs>
+</svg>
diff --git a/app/assets/images/support_1.png b/app/assets/images/support_1.png
new file mode 100644
index 0000000..9b92a10
Binary files /dev/null and b/app/assets/images/support_1.png differ
diff --git a/app/assets/images/support_2.png b/app/assets/images/support_2.png
new file mode 100644
index 0000000..8bac085
Binary files /dev/null and b/app/assets/images/support_2.png differ
diff --git a/app/azure/index.ts b/app/azure/index.ts
new file mode 100644
index 0000000..0034565
--- /dev/null
+++ b/app/azure/index.ts
@@ -0,0 +1,93 @@
+import angular from 'angular';
+import { StateRegistry, StateService } from '@uirouter/angularjs';
+
+import { Environment } from '@/react/portainer/environments/types';
+import { notifyError } from '@/portainer/services/notifications';
+import { StateManager } from '@/portainer/services/types';
+
+import { reactModule } from './react';
+
+export const azureModule = angular
+  .module('portainer.azure', [reactModule])
+  .config(config).name;
+
+/* @ngInject */
+function config($stateRegistryProvider: StateRegistry) {
+  const azure = {
+    name: 'azure',
+    url: '/azure',
+    parent: 'endpoint',
+    abstract: true,
+    onEnter: /* @ngInject */ function onEnter(
+      $async: (fn: () => Promise<void>) => Promise<void>,
+      $state: StateService,
+      endpoint: Environment,
+      StateManager: StateManager
+    ) {
+      return $async(async () => {
+        if (endpoint.Type !== 3) {
+          $state.go('portainer.home');
+          return;
+        }
+        try {
+          await StateManager.updateEndpointState(endpoint);
+        } catch (e) {
+          notifyError('Failed loading environment', e as Error);
+          $state.go('portainer.home', {}, { reload: true });
+        }
+      });
+    },
+  };
+
+  const containerInstances = {
+    name: 'azure.containerinstances',
+    url: '/containerinstances',
+    views: {
+      'content@': {
+        component: 'containerInstancesView',
+      },
+    },
+    data: {
+      docs: '/user/aci/containers',
+    },
+  };
+
+  const containerInstance = {
+    name: 'azure.containerinstances.container',
+    url: '/:id',
+    views: {
+      'content@': {
+        component: 'containerInstanceView',
+      },
+    },
+  };
+
+  const containerInstanceCreation = {
+    name: 'azure.containerinstances.new',
+    url: '/new/',
+    views: {
+      'content@': {
+        component: 'createContainerInstanceView',
+      },
+    },
+  };
+
+  const dashboard = {
+    name: 'azure.dashboard',
+    url: '/dashboard',
+    views: {
+      'content@': {
+        component: 'dashboardView',
+      },
+    },
+    data: {
+      docs: '/user/aci/dashboard',
+    },
+  };
+
+  $stateRegistryProvider.register(azure);
+  $stateRegistryProvider.register(containerInstances);
+  $stateRegistryProvider.register(containerInstance);
+  $stateRegistryProvider.register(containerInstanceCreation);
+  $stateRegistryProvider.register(dashboard);
+}
diff --git a/app/azure/react/components/index.ts b/app/azure/react/components/index.ts
new file mode 100644
index 0000000..de9063e
--- /dev/null
+++ b/app/azure/react/components/index.ts
@@ -0,0 +1,6 @@
+import angular from 'angular';
+
+export const componentsModule = angular.module(
+  'portainer.azure.react.components',
+  []
+).name;
diff --git a/app/azure/react/index.ts b/app/azure/react/index.ts
new file mode 100644
index 0000000..f84c1f7
--- /dev/null
+++ b/app/azure/react/index.ts
@@ -0,0 +1,9 @@
+import angular from 'angular';
+
+import { componentsModule } from './components';
+import { viewsModule } from './views';
+
+export const reactModule = angular.module('portainer.azure.react', [
+  viewsModule,
+  componentsModule,
+]).name;
diff --git a/app/azure/react/views/index.ts b/app/azure/react/views/index.ts
new file mode 100644
index 0000000..44c9f81
--- /dev/null
+++ b/app/azure/react/views/index.ts
@@ -0,0 +1,29 @@
+import angular from 'angular';
+
+import { r2a } from '@/react-tools/react2angular';
+import { CreateView } from '@/react/azure/container-instances/CreateView';
+import { ItemView } from '@/react/azure/container-instances/ItemView';
+import { ListView } from '@/react/azure/container-instances/ListView';
+import { DashboardView } from '@/react/azure/DashboardView';
+import { withCurrentUser } from '@/react-tools/withCurrentUser';
+import { withReactQuery } from '@/react-tools/withReactQuery';
+import { withUIRouter } from '@/react-tools/withUIRouter';
+
+export const viewsModule = angular
+  .module('portainer.azure.react.views', [])
+  .component(
+    'containerInstanceView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(ItemView))), [])
+  )
+  .component(
+    'createContainerInstanceView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(CreateView))), [])
+  )
+  .component(
+    'containerInstancesView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(ListView))), [])
+  )
+  .component(
+    'dashboardView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(DashboardView))), [])
+  ).name;
diff --git a/app/config.js b/app/config.js
new file mode 100644
index 0000000..fbad8d4
--- /dev/null
+++ b/app/config.js
@@ -0,0 +1,40 @@
+import { agentInterceptor } from '@/react/portainer/services/axios/axios';
+import { dispatchCacheRefreshEventIfNeeded } from './portainer/services/http-request.helper';
+
+/* @ngInject */
+export function configApp($urlRouterProvider, $httpProvider, localStorageServiceProvider, $uibTooltipProvider, $compileProvider, cfpLoadingBarProvider) {
+  if (process.env.NODE_ENV === 'testing') {
+    $compileProvider.debugInfoEnabled(false);
+  }
+
+  // ask to clear cache on mutation
+  $httpProvider.interceptors.push(() => ({
+    request: (reqConfig) => {
+      dispatchCacheRefreshEventIfNeeded(reqConfig);
+      return reqConfig;
+    },
+  }));
+
+  localStorageServiceProvider.setPrefix('portainer');
+
+  $httpProvider.defaults.headers.post['Content-Type'] = 'application/json';
+  $httpProvider.defaults.headers.put['Content-Type'] = 'application/json';
+  $httpProvider.defaults.headers.patch['Content-Type'] = 'application/json';
+
+  $httpProvider.interceptors.push(() => ({
+    request: agentInterceptor,
+  }));
+
+  $uibTooltipProvider.setTriggers({
+    mouseenter: 'mouseleave',
+    click: 'click',
+    focus: 'blur',
+    outsideClick: 'outsideClick',
+  });
+
+  cfpLoadingBarProvider.includeSpinner = false;
+  cfpLoadingBarProvider.parentSelector = '#loadingbar-placeholder';
+  cfpLoadingBarProvider.latencyThreshold = 600;
+
+  $urlRouterProvider.otherwise('/auth');
+}
diff --git a/app/constants.ts b/app/constants.ts
new file mode 100644
index 0000000..e61172d
--- /dev/null
+++ b/app/constants.ts
@@ -0,0 +1,28 @@
+// try to declare constant where it's needed, not in a global file
+export const API_ENDPOINT_AUTH = 'api/auth';
+export const API_ENDPOINT_BACKUP = 'api/backup';
+export const API_ENDPOINT_CUSTOM_TEMPLATES = 'api/custom_templates';
+export const API_ENDPOINT_EDGE_GROUPS = 'api/edge_groups';
+export const API_ENDPOINT_EDGE_JOBS = 'api/edge_jobs';
+export const API_ENDPOINT_EDGE_STACKS = 'api/edge_stacks';
+export const API_ENDPOINT_ENDPOINTS = 'api/endpoints';
+export const API_ENDPOINT_ENDPOINT_GROUPS = 'api/endpoint_groups';
+export const API_ENDPOINT_KUBERNETES = 'api/kubernetes';
+export const API_ENDPOINT_MOTD = 'api/motd';
+export const API_ENDPOINT_REGISTRIES = 'api/registries';
+export const API_ENDPOINT_RESOURCE_CONTROLS = 'api/resource_controls';
+export const API_ENDPOINT_SETTINGS = 'api/settings';
+export const API_ENDPOINT_STACKS = 'api/stacks';
+export const API_ENDPOINT_SUPPORT = 'api/support';
+export const API_ENDPOINT_USERS = 'api/users';
+export const API_ENDPOINT_TAGS = 'api/tags';
+export const API_ENDPOINT_TEAMS = 'api/teams';
+export const API_ENDPOINT_TEAM_MEMBERSHIPS = 'api/team_memberships';
+export const API_ENDPOINT_TEMPLATES = 'api/templates';
+export const API_ENDPOINT_WEBHOOKS = 'api/webhooks';
+export const PAGINATION_MAX_ITEMS = 10;
+export const APPLICATION_CACHE_VALIDITY = 3600;
+export const CONSOLE_COMMANDS_LABEL_PREFIX = 'io.portainer.commands.';
+export const PREDEFINED_NETWORKS = ['host', 'bridge', 'ingress', 'nat', 'none'];
+export const PORTAINER_FADEOUT = 1500;
+export const STACK_NAME_VALIDATION_REGEX = '^[-_a-z0-9]+$';
diff --git a/app/docker/__module.js b/app/docker/__module.js
new file mode 100644
index 0000000..8b20235
--- /dev/null
+++ b/app/docker/__module.js
@@ -0,0 +1,689 @@
+import angular from 'angular';
+
+import { PortainerEndpointTypes } from '@/portainer/models/endpoint/models';
+
+import { EnvironmentStatus } from '@/react/portainer/environments/types';
+
+import { reactModule } from './react';
+
+angular.module('portainer.docker', ['portainer.app', reactModule]).config([
+  '$stateRegistryProvider',
+  function ($stateRegistryProvider) {
+    'use strict';
+
+    var docker = {
+      name: 'docker',
+      parent: 'endpoint',
+      url: '/docker',
+      abstract: true,
+      onEnter: /* @ngInject */ function onEnter(endpoint, $async, $state, EndpointService, Notifications, StateManager, SystemService, EndpointProvider) {
+        return $async(async () => {
+          const dockerTypes = [PortainerEndpointTypes.DockerEnvironment, PortainerEndpointTypes.AgentOnDockerEnvironment, PortainerEndpointTypes.EdgeAgentOnDockerEnvironment];
+
+          if (!dockerTypes.includes(endpoint.Type)) {
+            $state.go('portainer.home');
+            return;
+          }
+
+          try {
+            const { status, error } = await checkEndpointStatus(endpoint);
+
+            if (endpoint.Type !== PortainerEndpointTypes.EdgeAgentOnDockerEnvironment) {
+              await updateEndpointStatus(endpoint, status);
+            }
+            endpoint.Status = status;
+
+            if (status === EnvironmentStatus.Down) {
+              throw error || new Error(`The environment named ${endpoint.Name} is unreachable.`);
+            }
+
+            await StateManager.updateEndpointState(endpoint);
+          } catch (e) {
+            let params = {};
+
+            if (endpoint.Type == PortainerEndpointTypes.EdgeAgentOnDockerEnvironment) {
+              params = { redirect: true, environmentId: endpoint.Id, environmentName: endpoint.Name, route: 'docker.dashboard' };
+            } else {
+              EndpointProvider.clean();
+              Notifications.error('Failed loading environment', e);
+            }
+            $state.go('portainer.home', params, { reload: true, inherit: false });
+            return false;
+          }
+
+          async function checkEndpointStatus(endpoint) {
+            try {
+              await SystemService.ping(endpoint.Id);
+              return { status: EnvironmentStatus.Up };
+            } catch (e) {
+              return { status: EnvironmentStatus.Down, error: e };
+            }
+          }
+
+          async function updateEndpointStatus(endpoint, status) {
+            if (endpoint.Status === status) {
+              return;
+            }
+            await EndpointService.updateEndpoint(endpoint.Id, { Status: status });
+          }
+        });
+      },
+    };
+
+    var configs = {
+      name: 'docker.configs',
+      url: '/configs',
+      views: {
+        'content@': {
+          component: 'configsListView',
+        },
+      },
+      data: {
+        docs: '/user/docker/configs',
+      },
+    };
+
+    var config = {
+      name: 'docker.configs.config',
+      url: '/:id',
+      views: {
+        'content@': {
+          templateUrl: './views/configs/edit/config.html',
+          controller: 'ConfigController',
+        },
+      },
+    };
+
+    var configCreation = {
+      name: 'docker.configs.new',
+      url: '/new?id',
+      views: {
+        'content@': {
+          templateUrl: './views/configs/create/createconfig.html',
+          controller: 'CreateConfigController',
+          controllerAs: 'ctrl',
+        },
+      },
+      data: {
+        docs: '/user/docker/configs/add',
+      },
+    };
+
+    const customTemplates = {
+      name: 'docker.templates.custom',
+      url: '/custom',
+
+      views: {
+        'content@': {
+          component: 'customTemplatesView',
+        },
+      },
+      data: {
+        docs: '/user/docker/templates/custom',
+      },
+    };
+
+    const customTemplatesNew = {
+      name: 'docker.templates.custom.new',
+      url: '/new?fileContent&appTemplateId&type',
+
+      views: {
+        'content@': {
+          component: 'createCustomTemplatesView',
+        },
+      },
+    };
+
+    const customTemplatesEdit = {
+      name: 'docker.templates.custom.edit',
+      url: '/:id',
+
+      views: {
+        'content@': {
+          component: 'editCustomTemplatesView',
+        },
+      },
+    };
+
+    var dashboard = {
+      name: 'docker.dashboard',
+      url: '/dashboard',
+      views: {
+        'content@': {
+          component: 'dockerDashboardView',
+        },
+      },
+      data: {
+        docs: '/user/docker/dashboard',
+      },
+    };
+
+    var host = {
+      name: 'docker.host',
+      url: '/host',
+      views: {
+        'content@': {
+          component: 'hostView',
+        },
+      },
+      data: {
+        docs: '/user/docker/host/details',
+      },
+    };
+
+    var hostBrowser = {
+      name: 'docker.host.browser',
+      url: '/browser',
+      views: {
+        'content@': {
+          component: 'hostBrowserView',
+        },
+      },
+    };
+
+    var events = {
+      name: 'docker.events',
+      url: '/events',
+      views: {
+        'content@': {
+          component: 'eventsListView',
+        },
+      },
+      data: {
+        docs: '/user/docker/events',
+      },
+    };
+
+    var images = {
+      name: 'docker.images',
+      url: '/images',
+      views: {
+        'content@': {
+          component: 'imagesListView',
+        },
+      },
+      data: {
+        docs: '/user/docker/images',
+      },
+    };
+
+    var image = {
+      name: 'docker.images.image',
+      url: '/:id?nodeName',
+      views: {
+        'content@': {
+          templateUrl: './views/images/edit/image.html',
+          controller: 'ImageController',
+        },
+      },
+    };
+
+    var imageBuild = {
+      name: 'docker.images.build',
+      url: '/build',
+      views: {
+        'content@': {
+          templateUrl: './views/images/build/buildimage.html',
+          controller: 'BuildImageController',
+        },
+      },
+      data: {
+        docs: '/user/docker/images/build',
+      },
+    };
+
+    var imageImport = {
+      name: 'docker.images.import',
+      url: '/import',
+      views: {
+        'content@': {
+          templateUrl: './views/images/import/importimage.html',
+          controller: 'ImportImageController',
+        },
+      },
+      data: {
+        docs: '/user/docker/images/import',
+      },
+    };
+
+    var networks = {
+      name: 'docker.networks',
+      url: '/networks',
+      views: {
+        'content@': {
+          component: 'networksListView',
+        },
+      },
+      data: {
+        docs: '/user/docker/networks',
+      },
+    };
+
+    var network = {
+      name: 'docker.networks.network',
+      url: '/:id?nodeName',
+      views: {
+        'content@': {
+          component: 'networkDetailsView',
+        },
+      },
+    };
+
+    var networkCreation = {
+      name: 'docker.networks.new',
+      url: '/new',
+      views: {
+        'content@': {
+          templateUrl: './views/networks/create/createnetwork.html',
+          controller: 'CreateNetworkController',
+        },
+      },
+      data: {
+        docs: '/user/docker/networks/add',
+      },
+    };
+
+    var nodes = {
+      name: 'docker.nodes',
+      url: '/nodes',
+      abstract: true,
+      data: {
+        docs: '/user/docker/swarm/details',
+      },
+    };
+
+    var node = {
+      name: 'docker.nodes.node',
+      url: '/:id',
+      views: {
+        'content@': {
+          component: 'nodeDetailsView',
+        },
+      },
+    };
+
+    var nodeBrowser = {
+      name: 'docker.nodes.node.browse',
+      url: '/browse',
+      views: {
+        'content@': {
+          component: 'nodeBrowserView',
+        },
+      },
+    };
+
+    var secrets = {
+      name: 'docker.secrets',
+      url: '/secrets',
+      views: {
+        'content@': {
+          templateUrl: './views/secrets/secrets.html',
+          controller: 'SecretsController',
+        },
+      },
+      data: {
+        docs: '/user/docker/secrets',
+      },
+    };
+
+    var secret = {
+      name: 'docker.secrets.secret',
+      url: '/:id',
+      views: {
+        'content@': {
+          templateUrl: './views/secrets/edit/secret.html',
+          controller: 'SecretController',
+        },
+      },
+    };
+
+    var secretCreation = {
+      name: 'docker.secrets.new',
+      url: '/new',
+      views: {
+        'content@': {
+          templateUrl: './views/secrets/create/createsecret.html',
+          controller: 'CreateSecretController',
+        },
+      },
+      data: {
+        docs: '/user/docker/secrets/add',
+      },
+    };
+
+    var services = {
+      name: 'docker.services',
+      url: '/services',
+      views: {
+        'content@': {
+          templateUrl: './views/services/services.html',
+          controller: 'ServicesController',
+        },
+      },
+      data: {
+        docs: '/user/docker/services',
+      },
+    };
+
+    var service = {
+      name: 'docker.services.service',
+      url: '/:id',
+      views: {
+        'content@': {
+          templateUrl: './views/services/edit/service.html',
+          controller: 'ServiceController',
+        },
+      },
+    };
+
+    var serviceCreation = {
+      name: 'docker.services.new',
+      url: '/new',
+      views: {
+        'content@': {
+          templateUrl: './views/services/create/createservice.html',
+          controller: 'CreateServiceController',
+        },
+      },
+      data: {
+        docs: '/user/docker/stacks/add',
+      },
+    };
+
+    var serviceLogs = {
+      name: 'docker.services.service.logs',
+      url: '/logs',
+      views: {
+        'content@': {
+          templateUrl: './views/services/logs/servicelogs.html',
+          controller: 'ServiceLogsController',
+        },
+      },
+    };
+
+    var stacks = {
+      name: 'docker.stacks',
+      url: '/stacks',
+      views: {
+        'content@': {
+          templateUrl: '~@/portainer/views/stacks/stacks.html',
+          controller: 'StacksController',
+        },
+      },
+      data: {
+        docs: '/user/docker/stacks',
+      },
+    };
+
+    var stack = {
+      name: 'docker.stacks.stack',
+      url: '/:name?id&type&regular&external&orphaned&orphanedRunning&tab',
+      views: {
+        'content@': {
+          component: 'stackItemView',
+        },
+      },
+    };
+
+    var stackContainer = {
+      name: 'docker.stacks.stack.container',
+      url: '/:id?nodeName',
+      views: {
+        'content@': {
+          component: 'containerItemView',
+        },
+      },
+    };
+
+    var stackCreation = {
+      name: 'docker.stacks.newstack',
+      url: '/newstack',
+      views: {
+        'content@': {
+          component: 'createStackView',
+        },
+      },
+    };
+
+    var swarm = {
+      name: 'docker.swarm',
+      url: '/swarm',
+      views: {
+        'content@': {
+          templateUrl: './views/swarm/swarm.html',
+          controller: 'SwarmController',
+        },
+      },
+      data: {
+        docs: '/user/docker/swarm/details',
+      },
+    };
+
+    var swarmVisualizer = {
+      name: 'docker.swarm.visualizer',
+      url: '/visualizer',
+      views: {
+        'content@': {
+          templateUrl: './views/swarm/visualizer/swarmvisualizer.html',
+          controller: 'SwarmVisualizerController',
+        },
+      },
+      data: {
+        docs: '/user/docker/swarm/cluster-visualizer',
+      },
+    };
+
+    var tasks = {
+      name: 'docker.tasks',
+      url: '/tasks',
+      abstract: true,
+    };
+
+    var task = {
+      name: 'docker.tasks.task',
+      url: '/:id',
+      views: {
+        'content@': {
+          templateUrl: './views/tasks/edit/task.html',
+          controller: 'TaskController',
+        },
+      },
+    };
+
+    var taskLogs = {
+      name: 'docker.tasks.task.logs',
+      url: '/logs',
+      views: {
+        'content@': {
+          templateUrl: './views/tasks/logs/tasklogs.html',
+          controller: 'TaskLogsController',
+        },
+      },
+    };
+
+    var templates = {
+      name: 'docker.templates',
+      url: '/templates?template',
+      views: {
+        'content@': {
+          component: 'appTemplatesView',
+        },
+      },
+      data: {
+        docs: '/user/docker/templates/application',
+      },
+    };
+
+    var volumes = {
+      name: 'docker.volumes',
+      url: '/volumes',
+      views: {
+        'content@': {
+          templateUrl: './views/volumes/volumes.html',
+          controller: 'VolumesController',
+        },
+      },
+      data: {
+        docs: '/user/docker/volumes',
+      },
+    };
+
+    var volume = {
+      name: 'docker.volumes.volume',
+      url: '/:id?nodeName',
+      views: {
+        'content@': {
+          templateUrl: './views/volumes/edit/volume.html',
+          controller: 'VolumeController',
+        },
+      },
+    };
+
+    var volumeBrowse = {
+      name: 'docker.volumes.volume.browse',
+      url: '/browse',
+      views: {
+        'content@': {
+          templateUrl: './views/volumes/browse/browsevolume.html',
+          controller: 'BrowseVolumeController',
+        },
+      },
+    };
+
+    var volumeCreation = {
+      name: 'docker.volumes.new',
+      url: '/new',
+      views: {
+        'content@': {
+          templateUrl: './views/volumes/create/createvolume.html',
+          controller: 'CreateVolumeController',
+        },
+      },
+      data: {
+        docs: '/user/docker/volumes/add',
+      },
+    };
+
+    const dockerFeaturesConfiguration = {
+      name: 'docker.host.featuresConfiguration',
+      url: '/feat-config',
+      views: {
+        'content@': {
+          component: 'dockerFeaturesConfigurationView',
+        },
+      },
+      data: {
+        docs: '/user/docker/host/setup',
+      },
+    };
+
+    const swarmFeaturesConfiguration = {
+      name: 'docker.swarm.featuresConfiguration',
+      url: '/feat-config',
+      views: {
+        'content@': {
+          component: 'dockerFeaturesConfigurationView',
+        },
+      },
+      data: {
+        docs: '/user/docker/swarm/setup',
+      },
+    };
+
+    const dockerRegistries = {
+      name: 'docker.host.registries',
+      url: '/registries',
+      views: {
+        'content@': {
+          component: 'environmentRegistriesView',
+        },
+      },
+      data: {
+        docs: '/user/docker/host/registries',
+      },
+    };
+
+    const swarmRegistries = {
+      name: 'docker.swarm.registries',
+      url: '/registries',
+      views: {
+        'content@': {
+          component: 'environmentRegistriesView',
+        },
+      },
+      data: {
+        docs: '/user/docker/swarm/registries',
+      },
+    };
+
+    const dockerRegistryAccess = {
+      name: 'docker.host.registries.access',
+      url: '/:id/access',
+      views: {
+        'content@': {
+          component: 'dockerRegistryAccessView',
+        },
+      },
+    };
+
+    const swarmRegistryAccess = {
+      name: 'docker.swarm.registries.access',
+      url: '/:id/access',
+      views: {
+        'content@': {
+          component: 'dockerRegistryAccessView',
+        },
+      },
+    };
+
+    $stateRegistryProvider.register(configs);
+    $stateRegistryProvider.register(config);
+    $stateRegistryProvider.register(configCreation);
+
+    $stateRegistryProvider.register(customTemplates);
+    $stateRegistryProvider.register(customTemplatesNew);
+    $stateRegistryProvider.register(customTemplatesEdit);
+    $stateRegistryProvider.register(docker);
+    $stateRegistryProvider.register(dashboard);
+    $stateRegistryProvider.register(host);
+    $stateRegistryProvider.register(hostBrowser);
+    $stateRegistryProvider.register(events);
+    $stateRegistryProvider.register(images);
+    $stateRegistryProvider.register(image);
+    $stateRegistryProvider.register(imageBuild);
+    $stateRegistryProvider.register(imageImport);
+    $stateRegistryProvider.register(networks);
+    $stateRegistryProvider.register(network);
+    $stateRegistryProvider.register(networkCreation);
+    $stateRegistryProvider.register(nodes);
+    $stateRegistryProvider.register(node);
+    $stateRegistryProvider.register(nodeBrowser);
+    $stateRegistryProvider.register(secrets);
+    $stateRegistryProvider.register(secret);
+    $stateRegistryProvider.register(secretCreation);
+    $stateRegistryProvider.register(services);
+    $stateRegistryProvider.register(service);
+    $stateRegistryProvider.register(serviceCreation);
+    $stateRegistryProvider.register(serviceLogs);
+    $stateRegistryProvider.register(stacks);
+    $stateRegistryProvider.register(stack);
+    $stateRegistryProvider.register(stackContainer);
+    $stateRegistryProvider.register(stackCreation);
+    $stateRegistryProvider.register(swarm);
+    $stateRegistryProvider.register(swarmVisualizer);
+    $stateRegistryProvider.register(tasks);
+    $stateRegistryProvider.register(task);
+    $stateRegistryProvider.register(taskLogs);
+    $stateRegistryProvider.register(templates);
+    $stateRegistryProvider.register(volumes);
+    $stateRegistryProvider.register(volume);
+    $stateRegistryProvider.register(volumeBrowse);
+    $stateRegistryProvider.register(volumeCreation);
+    $stateRegistryProvider.register(dockerFeaturesConfiguration);
+    $stateRegistryProvider.register(swarmFeaturesConfiguration);
+    $stateRegistryProvider.register(dockerRegistries);
+    $stateRegistryProvider.register(swarmRegistries);
+    $stateRegistryProvider.register(dockerRegistryAccess);
+    $stateRegistryProvider.register(swarmRegistryAccess);
+  },
+]);
diff --git a/app/docker/components/host-overview/host-overview.html b/app/docker/components/host-overview/host-overview.html
new file mode 100644
index 0000000..f193d80
--- /dev/null
+++ b/app/docker/components/host-overview/host-overview.html
@@ -0,0 +1,15 @@
+<page-header title="'Host overview'" breadcrumbs="['Docker']" reload="true"> </page-header>
+
+<host-details-panel
+  host="$ctrl.hostDetails"
+  is-browse-enabled="$ctrl.isAdmin && $ctrl.isAgent && $ctrl.agentApiVersion > 1 && $ctrl.hostFeaturesEnabled"
+  browse-url="$ctrl.browseUrl"
+  endpoint-id="$ctrl.endpointId"
+></host-details-panel>
+
+<engine-details-panel engine="$ctrl.engineDetails"></engine-details-panel>
+
+<devices-panel ng-if="$ctrl.isAgent && $ctrl.agentApiVersion > 1 && $ctrl.hostFeaturesEnabled" devices="$ctrl.devices"></devices-panel>
+<disks-panel ng-if="$ctrl.isAgent && $ctrl.agentApiVersion > 1 && $ctrl.hostFeaturesEnabled" disks="$ctrl.disks"></disks-panel>
+
+<ng-transclude></ng-transclude>
diff --git a/app/docker/components/host-overview/host-overview.js b/app/docker/components/host-overview/host-overview.js
new file mode 100644
index 0000000..5798994
--- /dev/null
+++ b/app/docker/components/host-overview/host-overview.js
@@ -0,0 +1,17 @@
+angular.module('portainer.docker').component('hostOverview', {
+  templateUrl: './host-overview.html',
+  bindings: {
+    hostDetails: '<',
+    engineDetails: '<',
+    devices: '<',
+    disks: '<',
+    isAgent: '<',
+    agentApiVersion: '<',
+    refreshUrl: '@',
+    browseUrl: '@',
+    hostFeaturesEnabled: '<',
+    isAdmin: '<',
+    endpointId: '<',
+  },
+  transclude: true,
+});
diff --git a/app/docker/components/host-view-panels/devices-panel/devices-panel.html b/app/docker/components/host-view-panels/devices-panel/devices-panel.html
new file mode 100644
index 0000000..63bda40
--- /dev/null
+++ b/app/docker/components/host-view-panels/devices-panel/devices-panel.html
@@ -0,0 +1,32 @@
+<div class="row">
+  <div class="col-lg-12 col-md-12 col-sm-12 col-xs-12">
+    <rd-widget>
+      <rd-widget-header icon="code" title-text="PCI Devices"></rd-widget-header>
+      <rd-widget-body classes="no-padding">
+        <table class="table">
+          <thead>
+            <tr>
+              <th>Name</th>
+              <th>Vendor</th>
+            </tr>
+          </thead>
+          <tbody>
+            <tr ng-if="$ctrl.devices && $ctrl.devices.length" ng-repeat="device in $ctrl.devices">
+              <td>{{ device.Name }}</td>
+              <td>{{ device.Vendor }}</td>
+            </tr>
+            <tr ng-if="$ctrl.devices === undefined">
+              <td colspan="2" class="text-muted text-center">Loading...</td>
+            </tr>
+            <tr ng-if="$ctrl.devices === null">
+              <td colspan="2" class="text-muted text-center"> Failed to load devices. </td>
+            </tr>
+            <tr ng-if="$ctrl.devices.length === 0">
+              <td colspan="2" class="text-muted text-center"> No device available. </td>
+            </tr>
+          </tbody>
+        </table>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
diff --git a/app/docker/components/host-view-panels/devices-panel/devices-panel.js b/app/docker/components/host-view-panels/devices-panel/devices-panel.js
new file mode 100644
index 0000000..a7d19bc
--- /dev/null
+++ b/app/docker/components/host-view-panels/devices-panel/devices-panel.js
@@ -0,0 +1,6 @@
+angular.module('portainer.docker').component('devicesPanel', {
+  templateUrl: './devices-panel.html',
+  bindings: {
+    devices: '<',
+  },
+});
diff --git a/app/docker/components/host-view-panels/disks-panel/disks-panel.html b/app/docker/components/host-view-panels/disks-panel/disks-panel.html
new file mode 100644
index 0000000..9653cd4
--- /dev/null
+++ b/app/docker/components/host-view-panels/disks-panel/disks-panel.html
@@ -0,0 +1,32 @@
+<div class="row">
+  <div class="col-lg-12 col-md-12 col-sm-12 col-xs-12">
+    <rd-widget>
+      <rd-widget-header icon="code" title-text="Physical Disks"></rd-widget-header>
+      <rd-widget-body classes="no-padding">
+        <table class="table">
+          <thead>
+            <tr>
+              <th>Vendor</th>
+              <th>Size</th>
+            </tr>
+          </thead>
+          <tbody>
+            <tr ng-if="$ctrl.disks" ng-repeat="disk in $ctrl.disks">
+              <td>{{ disk.Vendor }}</td>
+              <td>{{ disk.Size | humansize }}</td>
+            </tr>
+            <tr ng-if="$ctrl.disks === undefined">
+              <td colspan="2" class="text-muted text-center">Loading...</td>
+            </tr>
+            <tr ng-if="$ctrl.disks === null">
+              <td colspan="2" class="text-muted text-center"> Failed to load devices. </td>
+            </tr>
+            <tr ng-if="$ctrl.disks.length === 0">
+              <td colspan="2" class="text-muted text-center"> No disks available. </td>
+            </tr>
+          </tbody>
+        </table>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
diff --git a/app/docker/components/host-view-panels/disks-panel/disks-panel.js b/app/docker/components/host-view-panels/disks-panel/disks-panel.js
new file mode 100644
index 0000000..4b755a6
--- /dev/null
+++ b/app/docker/components/host-view-panels/disks-panel/disks-panel.js
@@ -0,0 +1,6 @@
+angular.module('portainer.docker').component('disksPanel', {
+  templateUrl: './disks-panel.html',
+  bindings: {
+    disks: '<',
+  },
+});
diff --git a/app/docker/components/host-view-panels/engine-details-panel/engine-details-panel.html b/app/docker/components/host-view-panels/engine-details-panel/engine-details-panel.html
new file mode 100644
index 0000000..0ea5fd9
--- /dev/null
+++ b/app/docker/components/host-view-panels/engine-details-panel/engine-details-panel.html
@@ -0,0 +1,43 @@
+<div class="row">
+  <div class="col-lg-12 col-md-12 col-sm-12 col-xs-12">
+    <rd-widget>
+      <rd-widget-header icon="code" title-text="Engine Details"></rd-widget-header>
+      <rd-widget-body classes="no-padding">
+        <table class="table">
+          <tbody>
+            <tr>
+              <td>Version</td>
+              <td
+                >{{ $ctrl.engine.releaseVersion }} <span ng-if="$ctrl.engine.apiVersion">(API: {{ $ctrl.engine.apiVersion }})</span></td
+              >
+            </tr>
+            <tr ng-if="$ctrl.engine.rootDirectory">
+              <td>Root directory</td>
+              <td>{{ $ctrl.engine.rootDirectory }}</td>
+            </tr>
+            <tr ng-if="$ctrl.engine.storageDriver">
+              <td>Storage Driver</td>
+              <td>{{ $ctrl.engine.storageDriver }}</td>
+            </tr>
+            <tr ng-if="$ctrl.engine.loggingDriver">
+              <td>Logging Driver</td>
+              <td>{{ $ctrl.engine.loggingDriver }}</td>
+            </tr>
+            <tr>
+              <td>Volume Plugins</td>
+              <td>{{ $ctrl.engine.volumePlugins | arraytostr: ', ' }}</td>
+            </tr>
+            <tr>
+              <td>Network Plugins</td>
+              <td>{{ $ctrl.engine.networkPlugins | arraytostr: ', ' }}</td>
+            </tr>
+            <tr ng-if="$ctrl.engine.engineLabels.length">
+              <td>Engine Labels</td>
+              <td>{{ $ctrl.engine.engineLabels | labelsToStr: ', ' }}</td>
+            </tr>
+          </tbody>
+        </table>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
diff --git a/app/docker/components/host-view-panels/engine-details-panel/engine-details-panel.js b/app/docker/components/host-view-panels/engine-details-panel/engine-details-panel.js
new file mode 100644
index 0000000..543a590
--- /dev/null
+++ b/app/docker/components/host-view-panels/engine-details-panel/engine-details-panel.js
@@ -0,0 +1,6 @@
+angular.module('portainer.docker').component('engineDetailsPanel', {
+  templateUrl: './engine-details-panel.html',
+  bindings: {
+    engine: '<',
+  },
+});
diff --git a/app/docker/components/host-view-panels/node-availability-select/node-availability-select-controller.js b/app/docker/components/host-view-panels/node-availability-select/node-availability-select-controller.js
new file mode 100644
index 0000000..2ebd29e
--- /dev/null
+++ b/app/docker/components/host-view-panels/node-availability-select/node-availability-select-controller.js
@@ -0,0 +1,9 @@
+angular.module('portainer.docker').controller('NodeAvailabilitySelectController', [
+  function NodeAvailabilitySelectController() {
+    this.onChange = onChange;
+
+    function onChange() {
+      this.onSave({ availability: this.availability });
+    }
+  },
+]);
diff --git a/app/docker/components/host-view-panels/node-availability-select/node-availability-select.html b/app/docker/components/host-view-panels/node-availability-select/node-availability-select.html
new file mode 100644
index 0000000..fd910da
--- /dev/null
+++ b/app/docker/components/host-view-panels/node-availability-select/node-availability-select.html
@@ -0,0 +1,8 @@
+<div class="input-group input-group-sm">
+  <select name="nodeAvailability" class="selectpicker form-control" ng-model="$ctrl.availability" ng-change="$ctrl.onChange()" data-cy="node-availability-select">
+    >
+    <option value="active">Active</option>
+    <option value="pause">Pause</option>
+    <option value="drain">Drain</option>
+  </select>
+</div>
diff --git a/app/docker/components/host-view-panels/node-availability-select/node-availability-select.js b/app/docker/components/host-view-panels/node-availability-select/node-availability-select.js
new file mode 100644
index 0000000..b9af163
--- /dev/null
+++ b/app/docker/components/host-view-panels/node-availability-select/node-availability-select.js
@@ -0,0 +1,9 @@
+angular.module('portainer.docker').component('nodeAvailabilitySelect', {
+  templateUrl: './node-availability-select.html',
+  controller: 'NodeAvailabilitySelectController',
+  bindings: {
+    availability: '<',
+    originalValue: '<',
+    onSave: '&',
+  },
+});
diff --git a/app/docker/components/host-view-panels/node-labels-table/node-labels-table-controller.js b/app/docker/components/host-view-panels/node-labels-table/node-labels-table-controller.js
new file mode 100644
index 0000000..4296d4b
--- /dev/null
+++ b/app/docker/components/host-view-panels/node-labels-table/node-labels-table-controller.js
@@ -0,0 +1,20 @@
+angular.module('portainer.docker').controller('NodeLabelsTableController', [
+  function NodeLabelsTableController() {
+    var ctrl = this;
+    ctrl.removeLabel = removeLabel;
+    ctrl.updateLabel = updateLabel;
+
+    function removeLabel(index) {
+      var label = ctrl.labels.splice(index, 1);
+      if (label !== null) {
+        ctrl.onChangedLabels({ labels: ctrl.labels });
+      }
+    }
+
+    function updateLabel(label) {
+      if (label.value !== label.originalValue || label.key !== label.originalKey) {
+        ctrl.onChangedLabels({ labels: ctrl.labels });
+      }
+    }
+  },
+]);
diff --git a/app/docker/components/host-view-panels/node-labels-table/node-labels-table.html b/app/docker/components/host-view-panels/node-labels-table/node-labels-table.html
new file mode 100644
index 0000000..b08d4a3
--- /dev/null
+++ b/app/docker/components/host-view-panels/node-labels-table/node-labels-table.html
@@ -0,0 +1,24 @@
+<div ng-if="!$ctrl.labels.length"> There are no labels for this node. </div>
+
+<div class="col-sm-12 form-inline !p-0" ng-if="$ctrl.labels.length">
+  <div ng-repeat="label in $ctrl.labels" class="mt-1">
+    <div class="input-group col-sm-5 input-group-sm">
+      <span class="input-group-addon">name</span>
+      <input
+        type="text"
+        class="form-control"
+        ng-model="label.key"
+        placeholder="e.g. com.example.foo"
+        ng-change="$ctrl.updateLabel(label)"
+        data-cy="node-label-input_{{ $index }}"
+      />
+    </div>
+    <div class="input-group col-sm-5 input-group-sm">
+      <span class="input-group-addon">value</span>
+      <input type="text" class="form-control" ng-model="label.value" placeholder="e.g. bar" ng-change="$ctrl.updateLabel(label)" data-cy="node-label-value_{{ $index }}" />
+    </div>
+    <button class="btn btn-light" type="button" ng-click="$ctrl.removeLabel($index)">
+      <pr-icon icon="'trash-2'" class-name="'icon-secondary icon-md'"></pr-icon>
+    </button>
+  </div>
+</div>
diff --git a/app/docker/components/host-view-panels/node-labels-table/node-labels-table.js b/app/docker/components/host-view-panels/node-labels-table/node-labels-table.js
new file mode 100644
index 0000000..045a575
--- /dev/null
+++ b/app/docker/components/host-view-panels/node-labels-table/node-labels-table.js
@@ -0,0 +1,8 @@
+angular.module('portainer.docker').component('nodeLabelsTable', {
+  templateUrl: './node-labels-table.html',
+  controller: 'NodeLabelsTableController',
+  bindings: {
+    labels: '<',
+    onChangedLabels: '&',
+  },
+});
diff --git a/app/docker/components/host-view-panels/swarm-node-details-panel/swarm-node-details-panel-controller.js b/app/docker/components/host-view-panels/swarm-node-details-panel/swarm-node-details-panel-controller.js
new file mode 100644
index 0000000..acf17b7
--- /dev/null
+++ b/app/docker/components/host-view-panels/swarm-node-details-panel/swarm-node-details-panel-controller.js
@@ -0,0 +1,91 @@
+angular.module('portainer.docker').controller('SwarmNodeDetailsPanelController', [
+  'NodeService',
+  'LabelHelper',
+  'Notifications',
+  '$state',
+  function SwarmNodeDetailsPanelController(NodeService, LabelHelper, Notifications, $state) {
+    var ctrl = this;
+    ctrl.state = {
+      managerAddress: '',
+      hasChanges: false,
+    };
+    ctrl.$onChanges = $onChanges;
+    ctrl.addLabel = addLabel;
+    ctrl.updateNodeLabels = updateNodeLabels;
+    ctrl.updateNodeAvailability = updateNodeAvailability;
+    ctrl.saveChanges = saveChanges;
+    ctrl.cancelChanges = cancelChanges;
+
+    var managerRole = 'manager';
+
+    function $onChanges() {
+      if (!ctrl.details) {
+        return;
+      }
+      if (ctrl.details.role === managerRole) {
+        ctrl.state.managerAddress = '(' + ctrl.details.managerAddress + ')';
+      }
+    }
+
+    function addLabel() {
+      ctrl.details.nodeLabels.push({
+        key: '',
+        value: '',
+        originalValue: '',
+        originalKey: '',
+      });
+    }
+
+    function updateNodeLabels(labels) {
+      ctrl.details.nodeLabels = labels;
+      ctrl.state.hasChanges = true;
+    }
+
+    function updateNodeAvailability(availability) {
+      ctrl.details.availability = availability;
+      ctrl.state.hasChanges = true;
+    }
+
+    function saveChanges() {
+      var originalNode = ctrl.originalNode;
+      var config = {
+        Name: originalNode.Name,
+        Availability: ctrl.details.availability,
+        Role: originalNode.Role,
+        Labels: LabelHelper.fromKeyValueToLabelHash(ctrl.details.nodeLabels),
+        Id: originalNode.Id,
+        Version: originalNode.Version,
+      };
+
+      NodeService.updateNode(config).then(onUpdateSuccess).catch(notifyOnError);
+
+      function onUpdateSuccess() {
+        Notifications.success('Node successfully updated', 'Node updated');
+        $state.go('docker.nodes.node', { id: originalNode.Id }, { reload: true });
+      }
+
+      function notifyOnError(error) {
+        Notifications.error('Failure', error, 'Failed to update node');
+      }
+    }
+
+    function cancelChanges() {
+      cancelLabelChanges();
+      ctrl.details.availability = ctrl.originalNode.Availability;
+      ctrl.state.hasChanges = false;
+    }
+
+    function cancelLabelChanges() {
+      ctrl.details.nodeLabels = ctrl.details.nodeLabels
+        .filter(function (label) {
+          return label.originalValue || label.originalKey;
+        })
+        .map(function (label) {
+          return Object.assign(label, {
+            value: label.originalValue,
+            key: label.originalKey,
+          });
+        });
+    }
+  },
+]);
diff --git a/app/docker/components/host-view-panels/swarm-node-details-panel/swarm-node-details-panel.html b/app/docker/components/host-view-panels/swarm-node-details-panel/swarm-node-details-panel.html
new file mode 100644
index 0000000..5e431af
--- /dev/null
+++ b/app/docker/components/host-view-panels/swarm-node-details-panel/swarm-node-details-panel.html
@@ -0,0 +1,67 @@
+<div class="row">
+  <div class="col-lg-12 col-md-12 col-sm-12 col-xs-12">
+    <rd-widget>
+      <rd-widget-header icon="code" title-text="Node Details"></rd-widget-header>
+      <rd-widget-body classes="no-padding">
+        <table class="table">
+          <tbody>
+            <tr ng-if="$ctrl.details.name">
+              <td>Node name</td>
+              <td>{{ $ctrl.details.name }}</td>
+            </tr>
+            <tr>
+              <td>Role</td>
+              <td>{{ $ctrl.details.role }} {{ $ctrl.state.managerAddress }}</td>
+            </tr>
+            <tr>
+              <td>Availability</td>
+              <td>
+                <node-availability-select
+                  on-save="$ctrl.updateNodeAvailability(availability)"
+                  availability="$ctrl.details.availability"
+                  original-value="$ctrl.details.availability"
+                >
+                </node-availability-select>
+              </td>
+            </tr>
+            <tr>
+              <td>Status</td>
+              <td
+                ><span class="label label-{{ $ctrl.details.status | nodestatusbadge }}">{{ $ctrl.details.status }}</span></td
+              >
+            </tr>
+            <tr>
+              <td>
+                <div class="nopadding">
+                  <a class="btn btn-secondary btn-sm pull-right" ng-click="$ctrl.addLabel(node)"> <pr-icon icon="'plus'"></pr-icon> label </a>
+                </div>
+                Node Labels
+              </td>
+              <td></td>
+            </tr>
+            <tr>
+              <td colspan="2">
+                <node-labels-table labels="$ctrl.details.nodeLabels" on-changed-labels="$ctrl.updateNodeLabels(labels)"></node-labels-table>
+              </td>
+            </tr>
+            <tr>
+              <td colspan="2">
+                <div class="btn-toolbar" role="toolbar">
+                  <div class="btn-group" role="group">
+                    <button type="button" class="btn btn-primary btn-sm" ng-disabled="!$ctrl.state.hasChanges" ng-click="$ctrl.saveChanges()"> Apply changes </button>
+                    <button type="button" class="btn btn-default btn-sm dropdown-toggle" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
+                      <span class="caret"></span>
+                    </button>
+                    <ul class="dropdown-menu">
+                      <li><a ng-click="$ctrl.cancelChanges()">Reset changes</a></li>
+                    </ul>
+                  </div>
+                </div>
+              </td>
+            </tr>
+          </tbody>
+        </table>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
diff --git a/app/docker/components/host-view-panels/swarm-node-details-panel/swarm-node-details-panel.js b/app/docker/components/host-view-panels/swarm-node-details-panel/swarm-node-details-panel.js
new file mode 100644
index 0000000..751e4ae
--- /dev/null
+++ b/app/docker/components/host-view-panels/swarm-node-details-panel/swarm-node-details-panel.js
@@ -0,0 +1,8 @@
+angular.module('portainer.docker').component('swarmNodeDetailsPanel', {
+  templateUrl: './swarm-node-details-panel.html',
+  controller: 'SwarmNodeDetailsPanelController',
+  bindings: {
+    details: '<',
+    originalNode: '<',
+  },
+});
diff --git a/app/docker/components/imageRegistry/por-image-registry-rate-limits.controller.js b/app/docker/components/imageRegistry/por-image-registry-rate-limits.controller.js
new file mode 100644
index 0000000..05c80ec
--- /dev/null
+++ b/app/docker/components/imageRegistry/por-image-registry-rate-limits.controller.js
@@ -0,0 +1,42 @@
+import { isAgentEnvironment, isLocalEnvironment } from '@/react/portainer/environments/utils';
+
+export default class porImageRegistryContainerController {
+  /* @ngInject */
+  constructor(DockerHubService, Notifications) {
+    this.DockerHubService = DockerHubService;
+    this.Notifications = Notifications;
+
+    this.pullRateLimits = null;
+  }
+
+  $onChanges({ registryId }) {
+    if (registryId) {
+      this.fetchRateLimits();
+    }
+  }
+
+  $onInit() {
+    this.setValidity =
+      this.setValidity ||
+      (() => {
+        /* noop */
+      });
+  }
+
+  async fetchRateLimits() {
+    this.pullRateLimits = null;
+    if (!isAgentEnvironment(this.endpoint.Type) && !isLocalEnvironment(this.endpoint)) {
+      this.setValidity(true);
+      return;
+    }
+
+    try {
+      this.pullRateLimits = await this.DockerHubService.checkRateLimits(this.endpoint, this.registryId || 0);
+      this.setValidity(!this.pullRateLimits.limit || (this.pullRateLimits.limit && this.pullRateLimits.remaining >= 0));
+    } catch (e) {
+      // eslint-disable-next-line no-console
+      console.error('Failed loading DockerHub pull rate limits', e);
+      this.setValidity(true);
+    }
+  }
+}
diff --git a/app/docker/components/imageRegistry/por-image-registry-rate-limits.html b/app/docker/components/imageRegistry/por-image-registry-rate-limits.html
new file mode 100644
index 0000000..a50f0c7
--- /dev/null
+++ b/app/docker/components/imageRegistry/por-image-registry-rate-limits.html
@@ -0,0 +1,34 @@
+<div class="form-group" ng-if="$ctrl.pullRateLimits">
+  <div class="col-sm-12 small">
+    <div ng-if="$ctrl.pullRateLimits.remaining > 0" class="text-muted vertical-center">
+      <pr-icon icon="'alert-circle'" mode="'primary'"></pr-icon>
+      <span ng-if="$ctrl.isAuthenticated">
+        You are currently using a free account to pull images from DockerHub and will be limited to 200 pulls every 6 hours. Remaining pulls:
+        <span style="font-weight: bold">{{ $ctrl.pullRateLimits.remaining }}/{{ $ctrl.pullRateLimits.limit }}</span>
+      </span>
+      <span ng-if="!$ctrl.isAuthenticated">
+        <span ng-if="$ctrl.isAdmin">
+          You are currently using an anonymous account to pull images from DockerHub and will be limited to 100 pulls every 6 hours. You can configure DockerHub authentication in
+          the
+          <a ui-sref="portainer.registries">Registries View</a>. Remaining pulls:
+          <span style="font-weight: bold">{{ $ctrl.pullRateLimits.remaining }}/{{ $ctrl.pullRateLimits.limit }}</span>
+        </span>
+        <span ng-if="!$ctrl.isAdmin">
+          You are currently using an anonymous account to pull images from DockerHub and will be limited to 100 pulls every 6 hours. Contact your administrator to configure
+          DockerHub authentication. Remaining pulls: <span style="font-weight: bold">{{ $ctrl.pullRateLimits.remaining }}/{{ $ctrl.pullRateLimits.limit }}</span>
+        </span>
+      </span>
+    </div>
+    <div ng-if="$ctrl.pullRateLimits.remaining <= 0" class="text-warning vertical-center">
+      <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon>
+      <span ng-if="$ctrl.isAuthenticated">
+        Your authorized pull count quota as a free user is now exceeded.
+        <span ng-transclude="rateLimitExceeded">You will not be able to pull any image from the DockerHub registry.</span>
+      </span>
+      <span ng-if="!$ctrl.isAuthenticated">
+        Your authorized pull count quota as an anonymous user is now exceeded.
+        <span ng-transclude="rateLimitExceeded">You will not be able to pull any image from the DockerHub registry.</span>
+      </span>
+    </div>
+  </div>
+</div>
diff --git a/app/docker/components/imageRegistry/por-image-registry-rate-limits.js b/app/docker/components/imageRegistry/por-image-registry-rate-limits.js
new file mode 100644
index 0000000..b87835a
--- /dev/null
+++ b/app/docker/components/imageRegistry/por-image-registry-rate-limits.js
@@ -0,0 +1,20 @@
+import angular from 'angular';
+
+import controller from './por-image-registry-rate-limits.controller';
+
+angular.module('portainer.docker').component('porImageRegistryRateLimits', {
+  bindings: {
+    endpoint: '<',
+    registry: '<',
+    setValidity: '<',
+    isAdmin: '<',
+    isDockerHubRegistry: '<',
+    isAuthenticated: '<',
+    registryId: '<',
+  },
+  controller,
+  transclude: {
+    rateLimitExceeded: '?porImageRegistryRateLimitExceeded',
+  },
+  templateUrl: './por-image-registry-rate-limits.html',
+});
diff --git a/app/docker/components/imageRegistry/por-image-registry.controller.js b/app/docker/components/imageRegistry/por-image-registry.controller.js
new file mode 100644
index 0000000..8bde1d9
--- /dev/null
+++ b/app/docker/components/imageRegistry/por-image-registry.controller.js
@@ -0,0 +1,137 @@
+import angular from 'angular';
+import _ from 'lodash-es';
+import { DockerHubViewModel } from '@/portainer/models/dockerhub';
+import { RegistryTypes } from '@/portainer/models/registryTypes';
+
+class porImageRegistryController {
+  /* @ngInject */
+  constructor($async, $scope, ImageHelper, RegistryService, EndpointService, ImageService, Notifications) {
+    this.$async = $async;
+    this.$scope = $scope;
+    this.ImageHelper = ImageHelper;
+    this.RegistryService = RegistryService;
+    this.EndpointService = EndpointService;
+    this.ImageService = ImageService;
+    this.Notifications = Notifications;
+
+    this.onRegistryChange = this.onRegistryChange.bind(this);
+    this.onImageChange = this.onImageChange.bind(this);
+
+    this.registries = [];
+    this.images = [];
+    this.defaultRegistry = new DockerHubViewModel();
+
+    this.$scope.$watch(() => this.model.Registry, this.onRegistryChange);
+    this.$scope.$watch(() => this.model.Image, this.onImageChange);
+  }
+
+  isKnownRegistry(registry) {
+    return registry && !(registry instanceof DockerHubViewModel) && registry.URL;
+  }
+
+  getRegistryURL(registry) {
+    if (!registry) {
+      return;
+    }
+    let url = registry.URL;
+    if (registry.Type === RegistryTypes.GITLAB) {
+      url = registry.URL + '/' + registry.Gitlab.ProjectPath;
+    }
+    return url;
+  }
+
+  prepareAutocomplete() {
+    let images = [];
+    const registry = this.model.Registry;
+    if (this.isKnownRegistry(registry)) {
+      const url = this.getRegistryURL(registry);
+      const registryImages = _.filter(this.images, (image) => _.includes(image, url));
+      images = _.map(registryImages, (image) => _.replace(image, new RegExp(url + '/?'), ''));
+    } else {
+      const registries = _.filter(this.registries, (reg) => this.isKnownRegistry(reg));
+      const registryImages = _.flatMap(registries, (registry) => _.filter(this.images, (image) => _.includes(image, registry.URL)));
+      const imagesWithoutKnown = _.difference(this.images, registryImages);
+      images = _.filter(imagesWithoutKnown, (image) => !this.ImageHelper.imageContainsURL(image));
+    }
+    this.availableImages = images;
+  }
+
+  isDockerHubRegistry() {
+    return this.model.UseRegistry && this.model.Registry && (this.model.Registry.Type === RegistryTypes.DOCKERHUB || this.model.Registry.Type === RegistryTypes.ANONYMOUS);
+  }
+
+  async onRegistryChange() {
+    this.prepareAutocomplete();
+    if (this.model.Registry && this.model.Registry.Type === RegistryTypes.GITLAB && this.model.Image) {
+      this.model.Image = _.replace(this.model.Image, this.model.Registry.Gitlab.ProjectPath, '');
+    }
+  }
+
+  async onImageChange() {
+    if (!this.isDockerHubRegistry()) {
+      this.setValidity(true);
+    }
+  }
+
+  displayedRegistryURL() {
+    return (this.model.Registry && this.getRegistryURL(this.model.Registry)) || 'docker.io';
+  }
+
+  async reloadRegistries() {
+    return this.$async(async () => {
+      try {
+        let showDefaultRegistry = false;
+        this.registries = await this.EndpointService.registries(this.endpoint.Id, this.namespace);
+
+        // Sort the registries by Name
+        this.registries.sort((a, b) => a.Name.localeCompare(b.Name));
+
+        // hide default(anonymous) dockerhub registry if user has an authenticated one
+        if (!this.registries.some((registry) => registry.Type === RegistryTypes.DOCKERHUB)) {
+          showDefaultRegistry = true;
+          // Add dockerhub on top
+          this.registries.splice(0, 0, this.defaultRegistry);
+        }
+
+        const id = this.model.Registry && this.model.Registry.Id;
+        const registry = _.find(this.registries, { Id: id });
+        if (!registry) {
+          this.model.Registry = showDefaultRegistry ? this.defaultRegistry : this.registries[0];
+        }
+      } catch (err) {
+        this.Notifications.error('Failure', err, 'Unable to retrieve registries');
+      }
+    });
+  }
+
+  async loadImages() {
+    return this.$async(async () => {
+      try {
+        if (!this.autoComplete) {
+          this.images = [];
+          return;
+        }
+
+        const images = await this.ImageService.images();
+        this.images = this.ImageService.getUniqueTagListFromImages(images);
+      } catch (err) {
+        this.Notifications.error('Failure', err, 'Unable to retrieve images');
+      }
+    });
+  }
+
+  $onChanges({ namespace, endpoint }) {
+    if ((namespace || endpoint) && this.endpoint.Id) {
+      this.reloadRegistries();
+    }
+  }
+
+  $onInit() {
+    return this.$async(async () => {
+      await this.loadImages();
+    });
+  }
+}
+
+export default porImageRegistryController;
+angular.module('portainer.docker').controller('porImageRegistryController', porImageRegistryController);
diff --git a/app/docker/components/imageRegistry/por-image-registry.html b/app/docker/components/imageRegistry/por-image-registry.html
new file mode 100644
index 0000000..7da5776
--- /dev/null
+++ b/app/docker/components/imageRegistry/por-image-registry.html
@@ -0,0 +1,104 @@
+<!-- use registry -->
+<div class="row">
+  <div class="form-group" ng-if="$ctrl.model.UseRegistry">
+    <label for="image_registry" class="control-label col-sm-3 col-lg-2 text-left" ng-class="$ctrl.labelClass"> Registry </label>
+    <div ng-class="$ctrl.inputClass" class="col-sm-8">
+      <select
+        data-cy="component-registrySelect"
+        ng-options="registry as registry.Name for registry in $ctrl.registries track by registry.Id"
+        ng-model="$ctrl.model.Registry"
+        id="image_registry"
+        class="form-control"
+        data-cy="component-registrySelect"
+      ></select>
+    </div>
+  </div>
+  <div class="form-group" ng-if="$ctrl.model.UseRegistry">
+    <label for="image_name" ng-class="$ctrl.labelClass" class="control-label col-sm-3 col-lg-2 required text-left">Image</label>
+    <div ng-class="$ctrl.inputClass" class="col-sm-8">
+      <div class="input-group">
+        <span class="input-group-addon" id="registry-name">{{ $ctrl.displayedRegistryURL() }}</span>
+        <input
+          type="text"
+          data-cy="component-imageInput"
+          class="form-control"
+          aria-describedby="registry-name"
+          uib-typeahead="image for image in $ctrl.availableImages | filter:$viewValue | limitTo:5"
+          ng-model="$ctrl.model.Image"
+          name="image_name"
+          placeholder="e.g. my-image:my-tag"
+          ng-change="$ctrl.onImageChange()"
+          required
+        />
+        <span ng-if="$ctrl.isDockerHubRegistry()" class="input-group-btn">
+          <a
+            href="https://hub.docker.com/search?type=image&q={{ $ctrl.model.Image | trimshasum | trimversiontag }}"
+            class="btn btn-default vertical-center"
+            title="Search image on Docker Hub"
+            target="_blank"
+          >
+            <pr-icon icon="'svg-docker'" size="'md'"></pr-icon> Search
+          </a>
+        </span>
+      </div>
+    </div>
+  </div>
+  <!-- ! use registry -->
+  <!-- don't use registry -->
+  <div ng-if="!$ctrl.model.UseRegistry">
+    <div class="form-group">
+      <span class="small">
+        <p class="text-muted ml-4"> When using advanced mode, image and repository <b>must be</b> publicly available. </p>
+      </span>
+      <label for="image_name" ng-class="$ctrl.labelClass" class="control-label col-sm-3 col-lg-2 required text-left">Image </label>
+      <div ng-class="$ctrl.inputClass" class="col-sm-8">
+        <input
+          type="text"
+          class="form-control"
+          ng-model="$ctrl.model.Image"
+          name="image_name"
+          placeholder="e.g. registry:port/my-image:my-tag"
+          required
+          data-cy="component-imageInput"
+        />
+      </div>
+    </div>
+  </div>
+  <!-- ! don't use registry -->
+  <!-- info message -->
+  <div class="form-group" ng-show="$ctrl.form.image_name.$invalid">
+    <div class="small">
+      <div class="col-sm-3 col-lg-2"></div>
+      <div class="col-sm-8" ng-messages="$ctrl.form.image_name.$error">
+        <p class="text-warning vertical-center" ng-message="required">
+          <pr-icon icon="'alert-triangle'" mode="'warning'" class="vertical-center"></pr-icon> Image name is required.
+          <span ng-if="$ctrl.canPull">Tag must be specified otherwise Portainer will pull all tags associated to the image.</span>
+        </p>
+      </div>
+    </div>
+  </div>
+  <!-- ! info message -->
+  <div class="form-group">
+    <div class="col-sm-12">
+      <button type="button" class="btn btn-link btn-sm vertical-center !ml-0 p-0 hover:no-underline" ng-if="!$ctrl.model.UseRegistry" ng-click="$ctrl.model.UseRegistry = true;">
+        <pr-icon icon="'database'"> </pr-icon> Simple mode
+      </button>
+      <button type="button" class="btn btn-link btn-sm vertical-center !ml-0 p-0 hover:no-underline" ng-if="$ctrl.model.UseRegistry" ng-click="$ctrl.model.UseRegistry = false;">
+        <pr-icon icon="'globe'"> </pr-icon> Advanced mode
+      </button>
+    </div>
+  </div>
+
+  <div ng-transclude></div>
+
+  <por-image-registry-rate-limits
+    ng-if="$ctrl.checkRateLimits && $ctrl.isDockerHubRegistry()"
+    endpoint="$ctrl.endpoint"
+    registry="$ctrl.model.Registry"
+    set-validity="$ctrl.setValidity"
+    is-authenticated="$ctrl.model.Registry.Authentication"
+    is-admin="$ctrl.isAdmin"
+    registry-id="$ctrl.model.Registry.Id"
+  >
+  </por-image-registry-rate-limits>
+</div>
diff --git a/app/docker/components/imageRegistry/por-image-registry.js b/app/docker/components/imageRegistry/por-image-registry.js
new file mode 100644
index 0000000..5c39704
--- /dev/null
+++ b/app/docker/components/imageRegistry/por-image-registry.js
@@ -0,0 +1,20 @@
+angular.module('portainer.docker').component('porImageRegistry', {
+  templateUrl: './por-image-registry.html',
+  controller: 'porImageRegistryController',
+  bindings: {
+    model: '=', // must be of type PorImageRegistryModel
+    autoComplete: '<',
+    labelClass: '@',
+    inputClass: '@',
+    endpoint: '<',
+    isAdmin: '<',
+    checkRateLimits: '<',
+    onImageChange: '&',
+    setValidity: '<',
+    namespace: '<',
+  },
+  require: {
+    form: '^form',
+  },
+  transclude: true,
+});
diff --git a/app/docker/components/log-viewer/log-viewer.js b/app/docker/components/log-viewer/log-viewer.js
new file mode 100644
index 0000000..ed2f9aa
--- /dev/null
+++ b/app/docker/components/log-viewer/log-viewer.js
@@ -0,0 +1,12 @@
+angular.module('portainer.docker').component('logViewer', {
+  templateUrl: './logViewer.html',
+  controller: 'LogViewerController',
+  bindings: {
+    data: '=',
+    displayTimestamps: '=',
+    logCollectionChange: '<',
+    sinceTimestamp: '=',
+    lineCount: '=',
+    resourceName: '<',
+  },
+});
diff --git a/app/docker/components/log-viewer/logViewer.html b/app/docker/components/log-viewer/logViewer.html
new file mode 100644
index 0000000..e98e905
--- /dev/null
+++ b/app/docker/components/log-viewer/logViewer.html
@@ -0,0 +1,94 @@
+<div class="row">
+  <div class="col-sm-12">
+    <rd-widget>
+      <rd-widget-header icon="file" title-text="Log viewer settings"></rd-widget-header>
+      <rd-widget-body>
+        <form class="form-horizontal">
+          <div class="form-group">
+            <div class="col-sm-12">
+              <por-switch-field
+                label-class="'col-sm-2'"
+                checked="$ctrl.state.logCollection"
+                label="'Auto-refresh logs'"
+                tooltip="'Disabling this option allows you to pause the log collection process and the auto-scrolling.'"
+                on-change="($ctrl.handleLogsCollectionChange)"
+              ></por-switch-field>
+            </div>
+          </div>
+          <div class="form-group">
+            <div class="col-sm-12">
+              <por-switch-field label-class="'col-sm-2'" checked="$ctrl.state.wrapLines" label="'Wrap lines'" on-change="($ctrl.handleLogsWrapLinesChange)"></por-switch-field>
+            </div>
+          </div>
+          <div class="form-group">
+            <div class="col-sm-12">
+              <por-switch-field
+                label-class="'col-sm-2'"
+                checked="$ctrl.displayTimestamps"
+                label="'Display timestamps'"
+                on-change="($ctrl.handleDisplayTimestampsChange)"
+              ></por-switch-field>
+            </div>
+          </div>
+          <div class="form-group">
+            <label for="logs_since" class="col-sm-2 control-label text-left"> Fetch </label>
+            <div class="col-sm-2">
+              <select class="form-control" ng-model="$ctrl.sinceTimestamp" id="logs_since">
+                <option selected value="">All logs</option>
+                <option ng-repeat="dt in $ctrl.state.availableSinceDatetime" ng-value="dt.value" title="{{ dt.value }}">{{ dt.desc }}</option>
+              </select>
+            </div>
+          </div>
+          <div class="form-group">
+            <label for="logs_search" class="col-sm-2 control-label text-left"> Search </label>
+            <div class="col-sm-8">
+              <input class="form-control" type="text" name="logs_search" ng-model="$ctrl.state.search" ng-change="$ctrl.state.selectedLines.length = 0;" placeholder="Filter..." />
+            </div>
+          </div>
+          <div class="form-group">
+            <label for="lines_count" class="col-sm-2 control-label text-left"> Lines </label>
+            <div class="col-sm-8">
+              <input class="form-control" type="number" name="lines_count" ng-model="$ctrl.lineCount" placeholder="Enter no of lines..." />
+            </div>
+          </div>
+          <div class="form-group" ng-if="$ctrl.state.copySupported">
+            <label class="col-sm-2 control-label text-left"> Actions </label>
+            <div class="col-sm-10">
+              <button class="btn btn-primary btn-sm" type="button" ng-click="$ctrl.downloadLogs()" style="margin-left: 0" data-cy="download-logs-button"
+                ><pr-icon icon="'download'"></pr-icon> Download logs</button
+              >
+              <button
+                class="btn btn-primary btn-sm"
+                ng-click="$ctrl.copy()"
+                ng-disabled="($ctrl.state.filteredLogs.length === 1 && !$ctrl.state.filteredLogs[0].line) || !$ctrl.state.filteredLogs.length"
+                ><pr-icon icon="'copy'" class-name="'space-right'"></pr-icon>Copy</button
+              >
+              <button
+                class="btn btn-primary btn-sm"
+                ng-click="$ctrl.copySelection()"
+                ng-disabled="($ctrl.state.filteredLogs.length === 1 && !$ctrl.state.filteredLogs[0].line) || !$ctrl.state.filteredLogs.length || !$ctrl.state.selectedLines.length"
+                ><pr-icon icon="'copy'" class-name="'space-right'"></pr-icon>Copy selected lines</button
+              >
+              <button class="btn btn-primary btn-sm" ng-click="$ctrl.clearSelection()" ng-disabled="$ctrl.state.selectedLines.length === 0"
+                ><pr-icon icon="'x'" class-name="'space-right'"></pr-icon>Unselect</button
+              >
+              <span>
+                <pr-icon id="refreshRateChange" icon="'check'" mode="'success'" style="display: none"></pr-icon>
+              </span>
+            </div>
+          </div>
+        </form>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
+
+<div class="row" style="height: 54%">
+  <div class="col-sm-12" style="height: 100%">
+    <pre ng-class="{ wrap_lines: $ctrl.state.wrapLines }" class="log_viewer" scroll-glue="$ctrl.state.autoScroll" force-glue>
+      <div ng-repeat="log in $ctrl.state.filteredLogs = ($ctrl.data | filter:{ 'line': $ctrl.state.search }) track by $index" class="line" ng-if="log.line"><p class="inner_line" ng-click="$ctrl.selectLine(log.line)" ng-class="{ 'line_selected': $ctrl.state.selectedLines.indexOf(log.line) > -1 }"><span ng-repeat="span in log.spans track by $index" ng-style="{ 'color': span.fgColor, 'background-color': span.bgColor, 'font-weight': span.fontWeight }">{{ span.text }}</span></p></div>
+      <div ng-if="!$ctrl.state.filteredLogs.length" class="line"><p class="inner_line">No log line matching the '{{ $ctrl.state.search }}' filter</p></div>
+      <div ng-if="$ctrl.state.filteredLogs.length === 1 && !$ctrl.state.filteredLogs[0].line" class="line"><p class="inner_line">No logs available</p></div>
+    </pre>
+  </div>
+</div>
diff --git a/app/docker/components/log-viewer/logViewerController.js b/app/docker/components/log-viewer/logViewerController.js
new file mode 100644
index 0000000..632187e
--- /dev/null
+++ b/app/docker/components/log-viewer/logViewerController.js
@@ -0,0 +1,82 @@
+import moment from 'moment';
+
+import { concatLogsToString, NEW_LINE_BREAKER } from '@/docker/helpers/logHelper';
+
+angular.module('portainer.docker').controller('LogViewerController', [
+  '$scope',
+  'clipboard',
+  'Blob',
+  'FileSaver',
+  function ($scope, clipboard, Blob, FileSaver) {
+    this.state = {
+      availableSinceDatetime: [
+        { desc: 'Last day', value: moment().subtract(1, 'days').format() },
+        { desc: 'Last 4 hours', value: moment().subtract(4, 'hours').format() },
+        { desc: 'Last hour', value: moment().subtract(1, 'hours').format() },
+        { desc: 'Last 10 minutes', value: moment().subtract(10, 'minutes').format() },
+      ],
+      copySupported: clipboard.supported,
+      logCollection: true,
+      autoScroll: true,
+      wrapLines: true,
+      search: '',
+      filteredLogs: [],
+      selectedLines: [],
+    };
+
+    this.handleLogsCollectionChange = handleLogsCollectionChange.bind(this);
+    this.handleLogsWrapLinesChange = handleLogsWrapLinesChange.bind(this);
+    this.handleDisplayTimestampsChange = handleDisplayTimestampsChange.bind(this);
+
+    function handleLogsCollectionChange(enabled) {
+      $scope.$evalAsync(() => {
+        this.state.logCollection = enabled;
+        this.state.autoScroll = enabled;
+        this.logCollectionChange(enabled);
+      });
+    }
+
+    function handleLogsWrapLinesChange(enabled) {
+      $scope.$evalAsync(() => {
+        this.state.wrapLines = enabled;
+      });
+    }
+
+    function handleDisplayTimestampsChange(enabled) {
+      $scope.$evalAsync(() => {
+        this.displayTimestamps = enabled;
+      });
+    }
+
+    this.copy = function () {
+      clipboard.copyText(this.state.filteredLogs.map((log) => log.line).join(NEW_LINE_BREAKER));
+      $('#refreshRateChange').show();
+      $('#refreshRateChange').fadeOut(2000);
+    };
+
+    this.copySelection = function () {
+      clipboard.copyText(this.state.selectedLines.join(NEW_LINE_BREAKER));
+      $('#refreshRateChange').show();
+      $('#refreshRateChange').fadeOut(2000);
+    };
+
+    this.clearSelection = function () {
+      this.state.selectedLines = [];
+    };
+
+    this.selectLine = function (line) {
+      var idx = this.state.selectedLines.indexOf(line);
+      if (idx === -1) {
+        this.state.selectedLines.push(line);
+      } else {
+        this.state.selectedLines.splice(idx, 1);
+      }
+    };
+
+    this.downloadLogs = function () {
+      const logsAsString = concatLogsToString(this.state.filteredLogs);
+      const data = new Blob([logsAsString]);
+      FileSaver.saveAs(data, this.resourceName + '_logs.txt');
+    };
+  },
+]);
diff --git a/app/docker/components/network-macvlan-form/network-macvlan-form.js b/app/docker/components/network-macvlan-form/network-macvlan-form.js
new file mode 100644
index 0000000..3ae345c
--- /dev/null
+++ b/app/docker/components/network-macvlan-form/network-macvlan-form.js
@@ -0,0 +1,8 @@
+angular.module('portainer.docker').component('networkMacvlanForm', {
+  templateUrl: './networkMacvlanForm.html',
+  controller: 'NetworkMacvlanFormController',
+  bindings: {
+    data: '=',
+    applicationState: '<',
+  },
+});
diff --git a/app/docker/components/network-macvlan-form/networkMacvlanForm.html b/app/docker/components/network-macvlan-form/networkMacvlanForm.html
new file mode 100644
index 0000000..0bcb634
--- /dev/null
+++ b/app/docker/components/network-macvlan-form/networkMacvlanForm.html
@@ -0,0 +1,91 @@
+<div>
+  <div class="col-sm-12 form-section-title"> Macvlan configuration </div>
+
+  <div class="form-group">
+    <span class="col-sm-12 text-muted small vertical-center">
+      <pr-icon icon="'alert-circle'" mode="'primary'"></pr-icon>
+      To create a MACVLAN network you need to create a configuration, then create the network from this configuration.
+    </span>
+  </div>
+
+  <box-selector slim="true" options="$ctrl.options" value="$ctrl.data.Scope" on-change="($ctrl.onChangeScope)"></box-selector>
+
+  <ng-form name="macvlanConfigurationForm">
+    <!-- configuration-inputs -->
+    <div ng-show="$ctrl.data.Scope === 'local'">
+      <!-- network-card-input -->
+      <div class="form-group">
+        <label for="network_card" class="col-sm-3 col-lg-2 control-label text-left">Parent network card</label>
+        <div class="col-sm-9 col-lg-10">
+          <input
+            type="text"
+            data-cy="macvlan-network-card-input"
+            class="form-control"
+            name="network_card"
+            ng-model="$ctrl.data.ParentNetworkCard"
+            placeholder="e.g. eth0 or ens160 ..."
+            ng-required="$ctrl.data.Scope === 'local' && !$ctrl.data.ParentNetworkCard"
+          />
+        </div>
+      </div>
+      <div class="form-group" ng-show="macvlanConfigurationForm.network_card.$invalid">
+        <div class="col-sm-12 small text-warning">
+          <div ng-messages="macvlanConfigurationForm.network_card.$error">
+            <p ng-message="required" class="vertical-center"> <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon> Parent network card must be specified.</p>
+          </div>
+        </div>
+      </div>
+      <!-- network-card-input -->
+      <!-- nodes-selector -->
+      <div ng-if="$ctrl.applicationState.endpoint.mode.agentProxy && $ctrl.applicationState.endpoint.mode.provider === 'DOCKER_SWARM_MODE'">
+        <macvlan-nodes-selector
+          dataset="$ctrl.nodes"
+          is-ip-column-visible="$ctrl.applicationState.endpoint.apiVersion >= 1.25"
+          have-access-to-node="$ctrl.isAdmin"
+          value="$ctrl.data.DatatableState.selectedItems"
+          on-change="($ctrl.onChangeSelectedNodes)"
+        ></macvlan-nodes-selector>
+
+        <div class="form-group" ng-show="macvlanConfigurationForm.node_selector.$invalid">
+          <div class="col-sm-12 small text-warning">
+            <div ng-messages="macvlanConfigurationForm.node_selector.$error">
+              <p ng-message="required" class="vertical-center"> <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon> At least one node must be selected.</p>
+            </div>
+          </div>
+        </div>
+      </div>
+      <!-- !nodes-selector -->
+    </div>
+    <!-- configuration-inputs -->
+    <!-- deploy-inputs -->
+    <div ng-show="$ctrl.data.Scope === 'swarm'">
+      <!-- configuration-selector -->
+      <!-- network-input -->
+      <div class="form-group">
+        <label for="config_network" class="col-sm-3 col-lg-2 control-label text-left">Configuration</label>
+        <div class="col-sm-9 col-lg-10">
+          <select
+            class="form-control"
+            ng-options="net.Name for net in $ctrl.availableNetworks"
+            ng-model="$ctrl.data.SelectedNetworkConfig"
+            name="config_network"
+            ng-required="$ctrl.requiredConfigSelection()"
+            data-cy="macvlanConfigNetworkSelector"
+          >
+            <option selected disabled hidden value="">Select a network</option>
+          </select>
+        </div>
+      </div>
+      <!-- !network-input -->
+      <div class="form-group" ng-show="macvlanConfigurationForm.config_network.$invalid">
+        <div class="col-sm-12 small text-warning">
+          <div ng-messages="macvlanConfigurationForm.config_network.$error">
+            <p ng-message="required" class="vertical-center"> <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon> Select a configuration network.</p>
+          </div>
+        </div>
+      </div>
+      <!-- !configuration-selector -->
+    </div>
+    <!-- deploy-inputs -->
+  </ng-form>
+</div>
diff --git a/app/docker/components/network-macvlan-form/networkMacvlanFormController.js b/app/docker/components/network-macvlan-form/networkMacvlanFormController.js
new file mode 100644
index 0000000..3080095
--- /dev/null
+++ b/app/docker/components/network-macvlan-form/networkMacvlanFormController.js
@@ -0,0 +1,69 @@
+import { getOptions } from '@/react/docker/networks/CreateView/macvlanOptions';
+
+angular.module('portainer.docker').controller('NetworkMacvlanFormController', [
+  '$q',
+  'NodeService',
+  'NetworkService',
+  'Notifications',
+  '$scope',
+  'Authentication',
+  function ($q, NodeService, NetworkService, Notifications, $scope, Authentication) {
+    var ctrl = this;
+
+    this.options = [];
+
+    ctrl.onChangeSelectedNodes = onChangeSelectedNodes.bind(ctrl);
+    function onChangeSelectedNodes(nodes) {
+      return $scope.$evalAsync(() => {
+        ctrl.data.DatatableState.selectedItems = nodes;
+      });
+    }
+
+    ctrl.requiredNodeSelection = function () {
+      if (ctrl.data.Scope !== 'local' || ctrl.data.DatatableState === undefined) {
+        return false;
+      }
+      return ctrl.data.DatatableState.selectedItems.length;
+    };
+
+    ctrl.requiredConfigSelection = function () {
+      if (ctrl.data.Scope !== 'swarm') {
+        return false;
+      }
+      return !ctrl.data.SelectedNetworkConfig;
+    };
+
+    this.onChangeScope = onChangeScope.bind(this);
+    function onChangeScope(value) {
+      return $scope.$evalAsync(() => {
+        this.data.Scope = value;
+      });
+    }
+
+    this.$onInit = $onInit;
+    function $onInit() {
+      var isAdmin = Authentication.isAdmin();
+      ctrl.isAdmin = isAdmin;
+
+      var provider = ctrl.applicationState.endpoint.mode.provider;
+      var apiVersion = ctrl.applicationState.endpoint.apiVersion;
+      $q.all({
+        nodes: provider !== 'DOCKER_SWARM_MODE' || NodeService.nodes(),
+        networks: NetworkService.networks(provider === 'DOCKER_STANDALONE' || provider === 'DOCKER_SWARM_MODE', false, provider === 'DOCKER_SWARM_MODE' && apiVersion >= 1.25),
+      })
+        .then(function success(data) {
+          if (data.nodes !== true) {
+            ctrl.nodes = data.nodes;
+          }
+          ctrl.availableNetworks = data.networks.filter(function (item) {
+            return item.ConfigOnly === true;
+          });
+
+          ctrl.options = getOptions(ctrl.availableNetworks.length > 0);
+        })
+        .catch(function error(err) {
+          Notifications.error('Failure', err, 'Unable to retrieve informations for macvlan');
+        });
+    }
+  },
+]);
diff --git a/app/docker/components/network-macvlan-form/networkMacvlanFormModel.js b/app/docker/components/network-macvlan-form/networkMacvlanFormModel.js
new file mode 100644
index 0000000..e790d80
--- /dev/null
+++ b/app/docker/components/network-macvlan-form/networkMacvlanFormModel.js
@@ -0,0 +1,8 @@
+export function MacvlanFormData() {
+  this.Scope = 'local';
+  this.SelectedNetworkConfig = null;
+  this.DatatableState = {
+    selectedItems: [],
+  };
+  this.ParentNetworkCard = '';
+}
diff --git a/app/docker/components/volumesCIFSForm/volumesCifsForm.html b/app/docker/components/volumesCIFSForm/volumesCifsForm.html
new file mode 100644
index 0000000..7a749f7
--- /dev/null
+++ b/app/docker/components/volumesCIFSForm/volumesCifsForm.html
@@ -0,0 +1,97 @@
+<!-- CIFS-settings -->
+<div ng-show="$ctrl.data.useCIFS">
+  <ng-form class="form-horizontal" name="cifsInformationForm">
+    <div class="col-sm-12 form-section-title"> CIFS Settings </div>
+    <!-- address-input -->
+    <div class="form-group col-md-12">
+      <label for="cifs_address" class="col-sm-2 col-md-1 control-label required text-left">Address</label>
+      <div class="col-sm-10 col-md-11">
+        <input
+          type="text"
+          class="form-control"
+          ng-model="$ctrl.data.serverAddress"
+          name="cifs_address"
+          placeholder="e.g. my.cifs-server.com OR xxx.xxx.xxx.xxx"
+          required
+          data-cy="cifs-address-input"
+        />
+      </div>
+    </div>
+    <div class="form-group col-md-12" ng-show="cifsInformationForm.cifs_address.$invalid">
+      <div class="small text-warning">
+        <div ng-messages="cifsInformationForm.cifs_address.$error">
+          <p ng-message="required"> <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon> This field is required.</p>
+        </div>
+      </div>
+    </div>
+    <!-- !address-input -->
+    <!-- mount-point-input -->
+    <div class="form-group col-md-12">
+      <label for="cifs_share" class="col-sm-2 col-md-1 control-label required text-left">Share</label>
+      <div class="col-sm-10 col-md-11">
+        <input type="text" class="form-control" ng-model="$ctrl.data.share" name="cifs_share" placeholder="e.g. /myshare" required data-cy="cifs-share-input" />
+      </div>
+    </div>
+    <div class="form-group col-md-12" ng-show="cifsInformationForm.cifs_share.$invalid">
+      <div class="small text-warning">
+        <div ng-messages="cifsInformationForm.cifs_share.$error">
+          <p ng-message="required"> <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon> This field is required.</p>
+        </div>
+      </div>
+    </div>
+    <!-- !mount-point-input -->
+    <!-- version-input -->
+    <div class="form-group col-md-12">
+      <label for="cifs_version" class="col-sm-2 col-md-1 control-label text-left">CIFS Version</label>
+      <div class="col-sm-10 col-md-11">
+        <select
+          class="form-control"
+          ng-model="$ctrl.data.version"
+          name="cifs_version"
+          ng-options="version for version in $ctrl.data.versions"
+          required
+          data-cy="cifs-version-select"
+        ></select>
+      </div>
+    </div>
+    <div class="form-group col-md-12" ng-show="cifsInformationForm.cifs_version.$invalid">
+      <div class="small text-warning">
+        <div ng-messages="cifsInformationForm.cifs_version.$error">
+          <p ng-message="required"> <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon> This field is required.</p>
+        </div>
+      </div>
+    </div>
+    <!-- !version-input -->
+    <!-- username -->
+    <div class="form-group col-md-12">
+      <label for="cifs_username" class="col-sm-2 col-md-1 control-label required text-left">Username</label>
+      <div class="col-sm-10 col-md-11">
+        <input type="text" class="form-control" ng-model="$ctrl.data.username" name="cifs_username" required data-cy="cifs-username-input" />
+      </div>
+    </div>
+    <div class="form-group col-md-12" ng-show="cifsInformationForm.cifs_username.$invalid">
+      <div class="small text-warning">
+        <div ng-messages="cifsInformationForm.cifs_username.$error">
+          <p ng-message="required"> <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon> This field is required.</p>
+        </div>
+      </div>
+    </div>
+    <!-- !username -->
+    <!-- password -->
+    <div class="form-group col-md-12">
+      <label for="cifs_password" class="col-sm-2 col-md-1 control-label text-left">Password</label>
+      <div class="col-sm-10 col-md-11">
+        <input type="text" class="form-control" ng-model="$ctrl.data.password" name="cifs_password" required data-cy="cifs-password-input" />
+      </div>
+    </div>
+    <div class="form-group col-md-12" ng-show="cifsInformationForm.password.$invalid">
+      <div class="small text-warning">
+        <div ng-messages="cifsInformationForm.cifs_password.$error">
+          <p ng-message="required"> <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon> This field is required.</p>
+        </div>
+      </div>
+    </div>
+    <!-- !password -->
+  </ng-form>
+</div>
+<!-- !CIFS-settings -->
diff --git a/app/docker/components/volumesCIFSForm/volumesCifsForm.js b/app/docker/components/volumesCIFSForm/volumesCifsForm.js
new file mode 100644
index 0000000..5d34957
--- /dev/null
+++ b/app/docker/components/volumesCIFSForm/volumesCifsForm.js
@@ -0,0 +1,6 @@
+angular.module('portainer.docker').component('volumesCifsForm', {
+  templateUrl: './volumesCifsForm.html',
+  bindings: {
+    data: '=',
+  },
+});
diff --git a/app/docker/components/volumesCIFSForm/volumesCifsFormModel.js b/app/docker/components/volumesCIFSForm/volumesCifsFormModel.js
new file mode 100644
index 0000000..db51e41
--- /dev/null
+++ b/app/docker/components/volumesCIFSForm/volumesCifsFormModel.js
@@ -0,0 +1,15 @@
+export function VolumesCIFSFormData() {
+  this.useCIFS = false;
+  this.serverAddress = '';
+  this.share = '';
+  this.version = 'CIFS v2.0 (Used by Windows Vista / Server 2008)';
+  this.versions = [
+    'CIFS v1.0 (Used by Windows XP / Server 2003 and earlier)',
+    'CIFS v2.0 (Used by Windows Vista / Server 2008)',
+    'CIFS v2.1 (Used by Windows 7 / Server 2008 R2)',
+    'CIFS 3.0 (Used by Windows 8 / Server 2012 and newer)',
+  ];
+  this.versionsNumber = ['1.0', '2.0', '2.1', '3.0'];
+  this.username = '';
+  this.password = '';
+}
diff --git a/app/docker/components/volumesNFSForm/volumes-nfs-form.js b/app/docker/components/volumesNFSForm/volumes-nfs-form.js
new file mode 100644
index 0000000..cece7b6
--- /dev/null
+++ b/app/docker/components/volumesNFSForm/volumes-nfs-form.js
@@ -0,0 +1,6 @@
+angular.module('portainer.docker').component('volumesNfsForm', {
+  templateUrl: './volumesnfsForm.html',
+  bindings: {
+    data: '=',
+  },
+});
diff --git a/app/docker/components/volumesNFSForm/volumesNFSFormModel.js b/app/docker/components/volumesNFSForm/volumesNFSFormModel.js
new file mode 100644
index 0000000..594c818
--- /dev/null
+++ b/app/docker/components/volumesNFSForm/volumesNFSFormModel.js
@@ -0,0 +1,8 @@
+export function VolumesNFSFormData() {
+  this.useNFS = false;
+  this.serverAddress = '';
+  this.mountPoint = '';
+  this.version = 'NFS4';
+  this.options = 'rw,noatime,rsize=8192,wsize=8192,tcp,timeo=14';
+  this.versions = ['NFS4', 'NFS'];
+}
diff --git a/app/docker/components/volumesNFSForm/volumesnfsForm.html b/app/docker/components/volumesNFSForm/volumesnfsForm.html
new file mode 100644
index 0000000..23db95b
--- /dev/null
+++ b/app/docker/components/volumesNFSForm/volumesnfsForm.html
@@ -0,0 +1,93 @@
+<!-- NFS-settings -->
+<div ng-show="$ctrl.data.useNFS">
+  <ng-form class="form-horizontal" name="nfsInformationForm">
+    <div class="col-sm-12 form-section-title"> NFS Settings </div>
+    <!-- address-input -->
+    <div class="form-group col-md-12">
+      <label for="nfs_address" class="col-sm-2 col-md-1 control-label required text-left">Address</label>
+      <div class="col-sm-10 col-md-11">
+        <input
+          type="text"
+          class="form-control"
+          ng-model="$ctrl.data.serverAddress"
+          name="nfs_address"
+          placeholder="e.g. my.nfs-server.com OR xxx.xxx.xxx.xxx"
+          required
+          data-cy="nfs-address-input"
+        />
+      </div>
+    </div>
+    <div class="form-group col-md-12" ng-show="nfsInformationForm.nfs_address.$invalid">
+      <div class="small text-warning">
+        <div ng-messages="nfsInformationForm.nfs_address.$error">
+          <p ng-message="required"> <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon> This field is required.</p>
+        </div>
+      </div>
+    </div>
+    <!-- !address-input -->
+    <!-- version-input -->
+    <div class="form-group col-md-12">
+      <label for="nfs_version" class="col-sm-2 col-md-1 control-label text-left">NFS Version</label>
+      <div class="col-sm-10 col-md-11">
+        <select
+          class="form-control"
+          ng-model="$ctrl.data.version"
+          name="nfs_version"
+          ng-options="version for version in $ctrl.data.versions"
+          required
+          data-cy="nfs-version-select"
+        ></select>
+      </div>
+    </div>
+    <div class="form-group col-md-12" ng-show="nfsInformationForm.nfs_version.$invalid">
+      <div class="small text-warning">
+        <div ng-messages="nfsInformationForm.nfs_version.$error">
+          <p ng-message="required"> <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon> This field is required.</p>
+        </div>
+      </div>
+    </div>
+    <!-- !version-input -->
+    <!-- mount-point-input -->
+    <div class="form-group col-md-12">
+      <label for="nfs_mountpoint" class="col-sm-2 col-md-1 control-label required text-left">Mount point</label>
+      <div class="col-sm-10 col-md-11">
+        <input
+          type="text"
+          data-cy="nfs-mountpoint-input"
+          class="form-control"
+          ng-model="$ctrl.data.mountPoint"
+          name="nfs_mountpoint"
+          placeholder="e.g. /export/share, :/export/share, address:/export/share, /share, :/share or address:/share"
+          required
+        />
+      </div>
+    </div>
+    <div class="form-group col-md-12" ng-show="nfsInformationForm.nfs_mountpoint.$invalid">
+      <div class="small text-warning">
+        <div ng-messages="nfsInformationForm.nfs_mountpoint.$error">
+          <p ng-message="required"> <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon> This field is required.</p>
+        </div>
+      </div>
+    </div>
+    <!-- !mount-point-input -->
+    <!-- options-input -->
+    <div class="form-group col-md-12">
+      <label for="nfs_options" class="col-sm-2 col-md-1 control-label text-left"
+        >Options
+        <portainer-tooltip message="'Comma separated list of options'"></portainer-tooltip>
+      </label>
+      <div class="col-sm-10 col-md-11">
+        <input type="text" class="form-control" ng-model="$ctrl.data.options" name="nfs_options" placeholder="e.g. rw,noatime,tcp ..." required data-cy="nfs-options-input" />
+      </div>
+    </div>
+    <div class="form-group col-md-12" ng-show="nfsInformationForm.nfs_options.$invalid">
+      <div class="small text-warning">
+        <div ng-messages="nfsInformationForm.nfs_options.$error">
+          <p ng-message="required"> <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon> This field is required.</p>
+        </div>
+      </div>
+    </div>
+    <!-- !options-input -->
+  </ng-form>
+</div>
+<!-- !NFS-settings -->
diff --git a/app/docker/filters/filters.js b/app/docker/filters/filters.js
new file mode 100644
index 0000000..0bef356
--- /dev/null
+++ b/app/docker/filters/filters.js
@@ -0,0 +1,154 @@
+import _ from 'lodash-es';
+
+import { strToHash } from '@/react/utils/hash';
+
+import { hideShaSum, joinCommand, nodeStatusBadge, taskStatusBadge, trimContainerName, trimSHA, trimVersionTag } from './utils';
+
+function includeString(text, values) {
+  return values.some(function (val) {
+    return text.indexOf(val) !== -1;
+  });
+}
+
+function hashToHexColor(hash) {
+  var color = '#';
+  for (var i = 0; i < 3; ) {
+    color += ('00' + ((hash >> (i++ * 8)) & 0xff).toString(16)).slice(-2);
+  }
+  return color;
+}
+
+angular
+  .module('portainer.docker')
+  .filter('visualizerTask', function () {
+    'use strict';
+    return function (text) {
+      var status = _.toLower(text);
+      if (includeString(status, ['new', 'allocated', 'assigned', 'accepted', 'complete', 'preparing'])) {
+        return 'info';
+      } else if (includeString(status, ['pending'])) {
+        return 'warning';
+      } else if (includeString(status, ['shutdown', 'failed', 'rejected'])) {
+        return 'stopped';
+      }
+      return 'running';
+    };
+  })
+  .filter('visualizerTaskBorderColor', function () {
+    'use strict';
+    return function (str) {
+      var hash = strToHash(str);
+      var color = hashToHexColor(hash);
+      return color;
+    };
+  })
+  .filter('taskstatusbadge', function () {
+    'use strict';
+    return taskStatusBadge;
+  })
+  .filter('taskhaslogs', function () {
+    'use strict';
+    return function (state) {
+      var validState = ['running', 'complete', 'failed', 'shutdown'];
+      if (validState.indexOf(state) > -1) {
+        return true;
+      }
+      return false;
+    };
+  })
+  .filter('containerstatusbadge', function () {
+    'use strict';
+    return function (text) {
+      var status = _.toLower(text);
+      if (includeString(status, ['paused', 'starting', 'unhealthy'])) {
+        return 'warning';
+      } else if (includeString(status, ['created'])) {
+        return 'info';
+      } else if (includeString(status, ['stopped', 'dead', 'exited'])) {
+        return 'danger';
+      }
+      return 'success';
+    };
+  })
+  .filter('nodestatusbadge', () => nodeStatusBadge)
+  .filter('trimcontainername', () => trimContainerName)
+  .filter('getstatelabel', function () {
+    'use strict';
+    return function (state) {
+      if (state === undefined) {
+        return 'label-default';
+      }
+      if (state.Ghost && state.Running) {
+        return 'label-important';
+      }
+      if (state.Running) {
+        return 'label-success';
+      }
+      return 'label-default';
+    };
+  })
+  .filter('containername', function () {
+    'use strict';
+    return function (container) {
+      return container.Names[0];
+    };
+  })
+  .filter('swarmversion', function () {
+    'use strict';
+    return function (text) {
+      return _.split(text, '/')[1];
+    };
+  })
+  .filter('swarmhostname', function () {
+    'use strict';
+    return function (container) {
+      return container.Names[0];
+    };
+  })
+  .filter('repotags', function () {
+    'use strict';
+    return function (image) {
+      if (image.RepoTags && image.RepoTags.length > 0) {
+        var tag = image.RepoTags[0];
+        if (tag === '<none>:<none>') {
+          return [];
+        }
+        return image.RepoTags;
+      }
+      return [];
+    };
+  })
+  .filter('command', function () {
+    return joinCommand;
+  })
+  .filter('hideshasum', () => hideShaSum)
+  .filter('tasknodename', function () {
+    'use strict';
+    return function (nodeId, nodes) {
+      var node = _.find(nodes, { Id: nodeId });
+      if (node) {
+        return node.Hostname;
+      }
+      return '';
+    };
+  })
+  .filter('imagelayercommand', function () {
+    'use strict';
+    return function (createdBy) {
+      if (!createdBy) {
+        return '';
+      }
+      return createdBy.replace('/bin/sh -c #(nop) ', '').replace('/bin/sh -c ', 'RUN ');
+    };
+  })
+  .filter('trimshasum', function () {
+    'use strict';
+    return trimSHA;
+  })
+  .filter('trimversiontag', function () {
+    'use strict';
+    return trimVersionTag;
+  })
+  .filter('unique', function () {
+    return _.uniqBy;
+  });
diff --git a/app/docker/filters/utils.ts b/app/docker/filters/utils.ts
new file mode 100644
index 0000000..ef5766a
--- /dev/null
+++ b/app/docker/filters/utils.ts
@@ -0,0 +1,92 @@
+import { NodeStatus, TaskState } from 'docker-types';
+import _ from 'lodash';
+
+export function trimVersionTag(fullName: string) {
+  if (!fullName) {
+    return fullName;
+  }
+
+  const versionIdx = fullName.lastIndexOf(':');
+  if (versionIdx < 0) {
+    return fullName;
+  }
+
+  const hostIdx = fullName.indexOf('/');
+  if (hostIdx > versionIdx) {
+    return fullName;
+  }
+
+  return fullName.substring(0, versionIdx);
+}
+
+export function trimSHA(imageName: string) {
+  if (!imageName) {
+    return '';
+  }
+  if (imageName.indexOf('sha256:') === 0) {
+    return imageName.substring(7, 19);
+  }
+  return _.split(imageName, '@sha256')[0];
+}
+
+export function joinCommand(command: null | Array<string> = []) {
+  if (!command) {
+    return '';
+  }
+
+  return command.join(' ');
+}
+
+export function taskStatusBadge(text?: TaskState) {
+  const status = _.toLower(text);
+  if (
+    [
+      'new',
+      'allocated',
+      'assigned',
+      'accepted',
+      'preparing',
+      'ready',
+      'starting',
+      'remove',
+    ].includes(status)
+  ) {
+    return 'info';
+  }
+
+  if (['pending'].includes(status)) {
+    return 'warning';
+  }
+
+  if (['shutdown', 'failed', 'rejected', 'orphaned'].includes(status)) {
+    return 'danger';
+  }
+
+  if (['complete'].includes(status)) {
+    return 'primary';
+  }
+
+  if (['running'].includes(status)) {
+    return 'success';
+  }
+  return 'default';
+}
+
+export function nodeStatusBadge(text: NodeStatus['State']) {
+  if (text === 'down' || text === 'unknown' || text === 'disconnected') {
+    return 'danger';
+  }
+
+  return 'success';
+}
+
+export function hideShaSum(imageName = '') {
+  return imageName.split('@sha')[0];
+}
+
+export function trimContainerName(name?: string) {
+  if (name) {
+    return name.indexOf('/') === 0 ? name.slice(1) : name;
+  }
+  return '';
+}
diff --git a/app/docker/helpers/configHelper.js b/app/docker/helpers/configHelper.js
new file mode 100644
index 0000000..4822096
--- /dev/null
+++ b/app/docker/helpers/configHelper.js
@@ -0,0 +1,36 @@
+angular.module('portainer.docker').factory('ConfigHelper', [
+  function ConfigHelperFactory() {
+    'use strict';
+    return {
+      flattenConfig: function (config) {
+        if (config) {
+          return {
+            Id: config.ConfigID,
+            Name: config.ConfigName,
+            ...(config.File ? { FileName: config.File.Name, Uid: config.File.UID, Gid: config.File.GID, Mode: config.File.Mode } : {}),
+            credSpec: !!config.Runtime,
+          };
+        }
+        return {};
+      },
+      configConfig: function (config) {
+        if (config) {
+          return {
+            ConfigID: config.Id,
+            ConfigName: config.Name,
+            File: config.credSpec
+              ? null
+              : {
+                  Name: config.FileName || config.Name,
+                  UID: config.Uid || '0',
+                  GID: config.Gid || '0',
+                  Mode: config.Mode || 292,
+                },
+            Runtime: config.credSpec ? {} : null,
+          };
+        }
+        return {};
+      },
+    };
+  },
+]);
diff --git a/app/docker/helpers/containerHelper.js b/app/docker/helpers/containerHelper.js
new file mode 100644
index 0000000..90446c1
--- /dev/null
+++ b/app/docker/helpers/containerHelper.js
@@ -0,0 +1,256 @@
+import _ from 'lodash-es';
+
+const portPattern = /^([1-9]|[1-5]?[0-9]{2,4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$/m;
+
+function parsePort(port) {
+  if (portPattern.test(port)) {
+    return parseInt(port, 10);
+  } else {
+    return 0;
+  }
+}
+
+function parsePortRange(portRange) {
+  if (typeof portRange !== 'string') {
+    portRange = portRange.toString();
+  }
+
+  // Split the range and convert to integers
+  const stringPorts = _.split(portRange, '-', 2);
+  const intPorts = _.map(stringPorts, parsePort);
+
+  // If it's not a range, we still make sure that we return two ports (start & end)
+  if (intPorts.length == 1) {
+    intPorts.push(intPorts[0]);
+  }
+
+  return intPorts;
+}
+
+function isValidPortRange(portRange) {
+  if (typeof portRange === 'string') {
+    portRange = parsePortRange();
+  }
+
+  return Array.isArray(portRange) && portRange.length === 2 && portRange[0] > 0 && portRange[1] >= portRange[0];
+}
+
+function createPortRange(portRangeText, port) {
+  if (typeof portRangeText !== 'string') {
+    portRangeText = portRangeText.toString();
+  }
+
+  let hostIp = null;
+  const colonIndex = portRangeText.indexOf(':');
+  if (colonIndex >= 0) {
+    hostIp = portRangeText.substr(0, colonIndex);
+    portRangeText = portRangeText.substr(colonIndex + 1);
+  }
+
+  port = typeof port === 'number' ? port : parsePort(port);
+  const portRange = parsePortRange(portRangeText);
+  const startPort = Math.min(portRange[0], port);
+  const endPort = Math.max(portRange[1], port);
+
+  if (hostIp) {
+    return hostIp + ':' + startPort + '-' + endPort;
+  } else {
+    return startPort + '-' + endPort;
+  }
+}
+
+angular.module('portainer.docker').factory('ContainerHelper', [
+  function ContainerHelperFactory() {
+    'use strict';
+    var helper = {};
+
+    helper.configFromContainer = function (container) {
+      var config = container.Config;
+      // HostConfig
+      config.HostConfig = container.HostConfig;
+      // Name
+      config.name = container.Name.replace(/^\//g, '');
+      // Network
+      var mode = config.HostConfig.NetworkMode;
+      config.NetworkingConfig = {
+        EndpointsConfig: {},
+      };
+      config.NetworkingConfig.EndpointsConfig = container.NetworkSettings.Networks;
+
+      if (config.ExposedPorts === undefined) {
+        config.ExposedPorts = {};
+      }
+
+      if (mode.indexOf('container:') !== -1) {
+        delete config.Hostname;
+        delete config.ExposedPorts;
+      }
+      // Set volumes
+      var binds = [];
+      var volumes = {};
+      for (var v in container.Mounts) {
+        if ({}.hasOwnProperty.call(container.Mounts, v)) {
+          var mount = container.Mounts[v];
+          var name = mount.Name || mount.Source;
+          var containerPath = mount.Destination;
+          if (name && containerPath) {
+            var bind = name + ':' + containerPath;
+            volumes[containerPath] = {};
+            if (mount.RW === false) {
+              bind += ':ro';
+            }
+            binds.push(bind);
+          }
+        }
+      }
+      config.HostConfig.Mounts = null;
+      config.HostConfig.Binds = binds;
+      config.Volumes = volumes;
+      return config;
+    };
+
+    helper.preparePortBindings = function (portBindings) {
+      const bindings = {};
+      _.forEach(portBindings, (portBinding) => {
+        if (!portBinding.containerPort) {
+          return;
+        }
+
+        let hostPort = portBinding.hostPort;
+        const containerPortRange = parsePortRange(portBinding.containerPort);
+        if (!isValidPortRange(containerPortRange)) {
+          throw new Error('Invalid port specification: ' + portBinding.containerPort);
+        }
+
+        const startPort = containerPortRange[0];
+        const endPort = containerPortRange[1];
+        let hostIp = undefined;
+        let startHostPort = 0;
+        let endHostPort = 0;
+        if (hostPort) {
+          if (hostPort.indexOf('[') > -1) {
+            const hostAndPort = _.split(hostPort, ']:');
+
+            if (hostAndPort.length < 2) {
+              throw new Error('Invalid port specification: ' + portBinding.containerPort);
+            }
+
+            hostIp = hostAndPort[0].replace('[', '');
+            hostPort = hostAndPort[1];
+          } else {
+            if (hostPort.indexOf(':') > -1) {
+              const hostAndPort = _.split(hostPort, ':');
+              hostIp = hostAndPort[0];
+              hostPort = hostAndPort[1];
+            }
+          }
+
+          const hostPortRange = parsePortRange(hostPort);
+          if (!isValidPortRange(hostPortRange)) {
+            throw new Error('Invalid port specification: ' + hostPort);
+          }
+
+          startHostPort = hostPortRange[0];
+          endHostPort = hostPortRange[1];
+          if (endPort !== startPort && endPort - startPort !== endHostPort - startHostPort) {
+            throw new Error('Invalid port specification: ' + hostPort);
+          }
+        }
+
+        for (let i = 0; i <= endPort - startPort; i++) {
+          const containerPort = (startPort + i).toString();
+          if (startHostPort > 0) {
+            hostPort = (startHostPort + i).toString();
+          }
+          if (startPort === endPort && startHostPort !== endHostPort) {
+            hostPort += '-' + endHostPort.toString();
+          }
+
+          const bindKey = containerPort + '/' + portBinding.protocol;
+          if (bindings[bindKey]) {
+            bindings[bindKey].push({ HostIp: hostIp, HostPort: hostPort });
+          } else {
+            bindings[bindKey] = [{ HostIp: hostIp, HostPort: hostPort }];
+          }
+        }
+      });
+      return bindings;
+    };
+
+    helper.sortAndCombinePorts = function (portBindings) {
+      const bindings = [];
+      const portBindingKeys = _.keys(portBindings);
+
+      // Group the port bindings by protocol
+      const portBindingKeysByProtocol = _.groupBy(portBindingKeys, (portKey) => {
+        return _.split(portKey, '/')[1];
+      });
+
+      _.forEach(portBindingKeysByProtocol, (portBindingKeys, protocol) => {
+        // Group the port bindings by host IP
+        const portBindingKeysByHostIp = {};
+        for (const portKey of portBindingKeys) {
+          for (const portBinding of portBindings[portKey]) {
+            portBindingKeysByHostIp[portBinding.HostIp] = portBindingKeysByHostIp[portBinding.HostIp] || [];
+            portBindingKeysByHostIp[portBinding.HostIp].push(portKey);
+          }
+        }
+
+        _.forEach(portBindingKeysByHostIp, (portBindingKeys, ip) => {
+          // Sort by host port
+          const sortedPortBindingKeys = _.orderBy(portBindingKeys, (portKey) => {
+            return parseInt(_.split(portKey, '/')[0], 10);
+          });
+
+          let previousHostPort = -1;
+          let previousContainerPort = -1;
+          _.forEach(sortedPortBindingKeys, (portKey) => {
+            const portKeySplit = _.split(portKey, '/');
+            const containerPort = parseInt(portKeySplit[0], 10);
+            const portBinding = portBindings[portKey][0];
+            portBindings[portKey].shift();
+            const hostPort = parsePort(portBinding.HostPort);
+
+            // We only combine single ports, and skip the host port ranges on one container port
+            if (hostPort > 0) {
+              // If we detect consecutive ports, we create a range of them
+              if (bindings.length > 0 && previousHostPort === hostPort - 1 && previousContainerPort === containerPort - 1) {
+                bindings[bindings.length - 1].hostPort = createPortRange(bindings[bindings.length - 1].hostPort, hostPort);
+                bindings[bindings.length - 1].containerPort = createPortRange(bindings[bindings.length - 1].containerPort, containerPort);
+                previousHostPort = hostPort;
+                previousContainerPort = containerPort;
+                return;
+              }
+
+              previousHostPort = hostPort;
+              previousContainerPort = containerPort;
+            } else {
+              previousHostPort = -1;
+              previousContainerPort = -1;
+            }
+
+            let bindingHostPort = portBinding.HostPort.toString();
+            if (ip) {
+              bindingHostPort = `${ip}:${bindingHostPort}`;
+            }
+
+            const binding = {
+              hostPort: bindingHostPort,
+              containerPort: containerPort,
+              protocol: protocol,
+            };
+            bindings.push(binding);
+          });
+        });
+      });
+
+      return bindings;
+    };
+
+    helper.getContainerNames = function (containers) {
+      return _.map(_.flatten(_.map(containers, 'Names')), (name) => _.trimStart(name, '/'));
+    };
+
+    return helper;
+  },
+]);
diff --git a/app/docker/helpers/containers.ts b/app/docker/helpers/containers.ts
new file mode 100644
index 0000000..9650b50
--- /dev/null
+++ b/app/docker/helpers/containers.ts
@@ -0,0 +1,21 @@
+import { splitargs } from './splitargs';
+
+export function commandStringToArray(command: string) {
+  return splitargs(command);
+}
+
+export function commandArrayToString(array: string[]) {
+  return array.map((elem) => `'${elem}'`).join(' ');
+}
+
+export function getSwarmService(container: {
+  Config?: { Labels?: Record<string, unknown> };
+}) {
+  return container.Config?.Labels?.['com.docker.swarm.service.id'];
+}
+
+export function isPartOfSwarmService(
+  ...params: Parameters<typeof getSwarmService>
+) {
+  return !!getSwarmService(...params);
+}
diff --git a/app/docker/helpers/imageHelper.js b/app/docker/helpers/imageHelper.js
new file mode 100644
index 0000000..3ce3d4a
--- /dev/null
+++ b/app/docker/helpers/imageHelper.js
@@ -0,0 +1,33 @@
+import { buildImageFullURIFromModel, imageContainsURL, fullURIIntoRepoAndTag } from '@/react/docker/images/utils';
+
+angular.module('portainer.docker').factory('ImageHelper', ImageHelperFactory);
+function ImageHelperFactory() {
+  return {
+    isValidTag,
+    createImageConfigForContainer,
+    removeDigestFromRepository,
+    imageContainsURL,
+  };
+
+  function isValidTag(tag) {
+    return tag.match(/^(?![\.\-])([a-zA-Z0-9\_\.\-])+$/g);
+  }
+
+  /**
+   *
+   * @param {PorImageRegistryModel} registry
+   */
+  function createImageConfigForContainer(imageModel) {
+    const fromImage = buildImageFullURIFromModel(imageModel);
+    const { tag, repo } = fullURIIntoRepoAndTag(fromImage);
+    return {
+      fromImage,
+      tag,
+      repo,
+    };
+  }
+
+  function removeDigestFromRepository(repository) {
+    return repository.split('@sha')[0];
+  }
+}
diff --git a/app/docker/helpers/infoHelper.js b/app/docker/helpers/infoHelper.js
new file mode 100644
index 0000000..7bd7bcf
--- /dev/null
+++ b/app/docker/helpers/infoHelper.js
@@ -0,0 +1,35 @@
+import _ from 'lodash-es';
+
+angular.module('portainer.docker').factory('InfoHelper', [
+  function InfoHelperFactory() {
+    'use strict';
+
+    var helper = {};
+
+    helper.determineEndpointMode = function (info, type) {
+      var mode = {
+        provider: '',
+        role: '',
+        agentProxy: false,
+      };
+
+      if (type === 2 || type === 4) {
+        mode.agentProxy = true;
+      }
+
+      if (!info.Swarm || _.isEmpty(info.Swarm.NodeID)) {
+        mode.provider = 'DOCKER_STANDALONE';
+      } else {
+        mode.provider = 'DOCKER_SWARM_MODE';
+        if (info.Swarm.ControlAvailable) {
+          mode.role = 'MANAGER';
+        } else {
+          mode.role = 'WORKER';
+        }
+      }
+      return mode;
+    };
+
+    return helper;
+  },
+]);
diff --git a/app/docker/helpers/labelHelper.js b/app/docker/helpers/labelHelper.js
new file mode 100644
index 0000000..b19c552
--- /dev/null
+++ b/app/docker/helpers/labelHelper.js
@@ -0,0 +1,26 @@
+angular.module('portainer.docker').factory('LabelHelper', [
+  function LabelHelperFactory() {
+    'use strict';
+    return {
+      fromLabelHashToKeyValue: function (labels) {
+        if (labels) {
+          return Object.keys(labels).map(function (key) {
+            return { key: key, value: labels[key], originalKey: key, originalValue: labels[key], added: true };
+          });
+        }
+        return [];
+      },
+      fromKeyValueToLabelHash: function (labelKV) {
+        var labels = {};
+        if (labelKV) {
+          labelKV.forEach(function (label) {
+            if (label.key) {
+              labels[label.key] = label.value;
+            }
+          });
+        }
+        return labels;
+      },
+    };
+  },
+]);
diff --git a/app/docker/helpers/logHelper/colors/colors.ts b/app/docker/helpers/logHelper/colors/colors.ts
new file mode 100644
index 0000000..f9183c2
--- /dev/null
+++ b/app/docker/helpers/logHelper/colors/colors.ts
@@ -0,0 +1,63 @@
+// original code comes from https://www.npmjs.com/package/x256
+// only picking the used parts as there is no type definition
+// package is unmaintained and repository doesn't exist anymore
+
+// colors scraped from
+// http://www.calmar.ws/vim/256-xterm-24bit-rgb-color-chart.html
+// %s/ *\d\+ \+#\([^ ]\+\)/\1\r/g
+
+import rawColors from './rawColors.json';
+
+export type RGBColor = [number, number, number];
+export type TextColor = string | undefined;
+
+function hexToRGB(hex: string): RGBColor {
+  const r = parseInt(hex.slice(0, 2), 16);
+  const g = parseInt(hex.slice(2, 4), 16);
+  const b = parseInt(hex.slice(4, 6), 16);
+  return [r, g, b];
+}
+
+export const colors = rawColors.map(hexToRGB);
+
+export const FOREGROUND_COLORS_BY_ANSI: {
+  [k: string]: RGBColor;
+} = {
+  black: colors[0],
+  red: colors[1],
+  green: colors[2],
+  yellow: colors[3],
+  blue: colors[4],
+  magenta: colors[5],
+  cyan: colors[6],
+  white: colors[7],
+  brightBlack: colors[8],
+  brightRed: colors[9],
+  brightGreen: colors[10],
+  brightYellow: colors[11],
+  brightBlue: colors[12],
+  brightMagenta: colors[13],
+  brightCyan: colors[14],
+  brightWhite: colors[15],
+};
+
+export const BACKGROUND_COLORS_BY_ANSI: {
+  [k: string]: RGBColor;
+} = {
+  bgBlack: colors[0],
+  bgRed: colors[1],
+  bgGreen: colors[2],
+  bgYellow: colors[3],
+  bgBlue: colors[4],
+  bgMagenta: colors[5],
+  bgCyan: colors[6],
+  bgWhite: colors[7],
+  bgBrightBlack: colors[8],
+  bgBrightRed: colors[9],
+  bgBrightGreen: colors[10],
+  bgBrightYellow: colors[11],
+  bgBrightBlue: colors[12],
+  bgBrightMagenta: colors[13],
+  bgBrightCyan: colors[14],
+  bgBrightWhite: colors[15],
+};
diff --git a/app/docker/helpers/logHelper/colors/index.ts b/app/docker/helpers/logHelper/colors/index.ts
new file mode 100644
index 0000000..25eed22
--- /dev/null
+++ b/app/docker/helpers/logHelper/colors/index.ts
@@ -0,0 +1,7 @@
+export {
+  type RGBColor,
+  type TextColor,
+  colors,
+  FOREGROUND_COLORS_BY_ANSI,
+  BACKGROUND_COLORS_BY_ANSI,
+} from './colors';
diff --git a/app/docker/helpers/logHelper/colors/rawColors.json b/app/docker/helpers/logHelper/colors/rawColors.json
new file mode 100644
index 0000000..b9bba82
--- /dev/null
+++ b/app/docker/helpers/logHelper/colors/rawColors.json
@@ -0,0 +1,258 @@
+[
+  "000000",
+  "800000",
+  "008000",
+  "808000",
+  "000080",
+  "800080",
+  "008080",
+  "c0c0c0",
+  "808080",
+  "ff0000",
+  "00ff00",
+  "ffff00",
+  "0000ff",
+  "ff00ff",
+  "00ffff",
+  "ffffff",
+  "000000",
+  "00005f",
+  "000087",
+  "0000af",
+  "0000d7",
+  "0000ff",
+  "005f00",
+  "005f5f",
+  "005f87",
+  "005faf",
+  "005fd7",
+  "005fff",
+  "008700",
+  "00875f",
+  "008787",
+  "0087af",
+  "0087d7",
+  "0087ff",
+  "00af00",
+  "00af5f",
+  "00af87",
+  "00afaf",
+  "00afd7",
+  "00afff",
+  "00d700",
+  "00d75f",
+  "00d787",
+  "00d7af",
+  "00d7d7",
+  "00d7ff",
+  "00ff00",
+  "00ff5f",
+  "00ff87",
+  "00ffaf",
+  "00ffd7",
+  "00ffff",
+  "5f0000",
+  "5f005f",
+  "5f0087",
+  "5f00af",
+  "5f00d7",
+  "5f00ff",
+  "5f5f00",
+  "5f5f5f",
+  "5f5f87",
+  "5f5faf",
+  "5f5fd7",
+  "5f5fff",
+  "5f8700",
+  "5f875f",
+  "5f8787",
+  "5f87af",
+  "5f87d7",
+  "5f87ff",
+  "5faf00",
+  "5faf5f",
+  "5faf87",
+  "5fafaf",
+  "5fafd7",
+  "5fafff",
+  "5fd700",
+  "5fd75f",
+  "5fd787",
+  "5fd7af",
+  "5fd7d7",
+  "5fd7ff",
+  "5fff00",
+  "5fff5f",
+  "5fff87",
+  "5fffaf",
+  "5fffd7",
+  "5fffff",
+  "870000",
+  "87005f",
+  "870087",
+  "8700af",
+  "8700d7",
+  "8700ff",
+  "875f00",
+  "875f5f",
+  "875f87",
+  "875faf",
+  "875fd7",
+  "875fff",
+  "878700",
+  "87875f",
+  "878787",
+  "8787af",
+  "8787d7",
+  "8787ff",
+  "87af00",
+  "87af5f",
+  "87af87",
+  "87afaf",
+  "87afd7",
+  "87afff",
+  "87d700",
+  "87d75f",
+  "87d787",
+  "87d7af",
+  "87d7d7",
+  "87d7ff",
+  "87ff00",
+  "87ff5f",
+  "87ff87",
+  "87ffaf",
+  "87ffd7",
+  "87ffff",
+  "af0000",
+  "af005f",
+  "af0087",
+  "af00af",
+  "af00d7",
+  "af00ff",
+  "af5f00",
+  "af5f5f",
+  "af5f87",
+  "af5faf",
+  "af5fd7",
+  "af5fff",
+  "af8700",
+  "af875f",
+  "af8787",
+  "af87af",
+  "af87d7",
+  "af87ff",
+  "afaf00",
+  "afaf5f",
+  "afaf87",
+  "afafaf",
+  "afafd7",
+  "afafff",
+  "afd700",
+  "afd75f",
+  "afd787",
+  "afd7af",
+  "afd7d7",
+  "afd7ff",
+  "afff00",
+  "afff5f",
+  "afff87",
+  "afffaf",
+  "afffd7",
+  "afffff",
+  "d70000",
+  "d7005f",
+  "d70087",
+  "d700af",
+  "d700d7",
+  "d700ff",
+  "d75f00",
+  "d75f5f",
+  "d75f87",
+  "d75faf",
+  "d75fd7",
+  "d75fff",
+  "d78700",
+  "d7875f",
+  "d78787",
+  "d787af",
+  "d787d7",
+  "d787ff",
+  "d7af00",
+  "d7af5f",
+  "d7af87",
+  "d7afaf",
+  "d7afd7",
+  "d7afff",
+  "d7d700",
+  "d7d75f",
+  "d7d787",
+  "d7d7af",
+  "d7d7d7",
+  "d7d7ff",
+  "d7ff00",
+  "d7ff5f",
+  "d7ff87",
+  "d7ffaf",
+  "d7ffd7",
+  "d7ffff",
+  "ff0000",
+  "ff005f",
+  "ff0087",
+  "ff00af",
+  "ff00d7",
+  "ff00ff",
+  "ff5f00",
+  "ff5f5f",
+  "ff5f87",
+  "ff5faf",
+  "ff5fd7",
+  "ff5fff",
+  "ff8700",
+  "ff875f",
+  "ff8787",
+  "ff87af",
+  "ff87d7",
+  "ff87ff",
+  "ffaf00",
+  "ffaf5f",
+  "ffaf87",
+  "ffafaf",
+  "ffafd7",
+  "ffafff",
+  "ffd700",
+  "ffd75f",
+  "ffd787",
+  "ffd7af",
+  "ffd7d7",
+  "ffd7ff",
+  "ffff00",
+  "ffff5f",
+  "ffff87",
+  "ffffaf",
+  "ffffd7",
+  "ffffff",
+  "080808",
+  "121212",
+  "1c1c1c",
+  "262626",
+  "303030",
+  "3a3a3a",
+  "444444",
+  "4e4e4e",
+  "585858",
+  "606060",
+  "666666",
+  "767676",
+  "808080",
+  "8a8a8a",
+  "949494",
+  "9e9e9e",
+  "a8a8a8",
+  "b2b2b2",
+  "bcbcbc",
+  "c6c6c6",
+  "d0d0d0",
+  "dadada",
+  "e4e4e4",
+  "eeeeee"
+]
diff --git a/app/docker/helpers/logHelper/concatLogsToString.ts b/app/docker/helpers/logHelper/concatLogsToString.ts
new file mode 100644
index 0000000..1640895
--- /dev/null
+++ b/app/docker/helpers/logHelper/concatLogsToString.ts
@@ -0,0 +1,14 @@
+import { NEW_LINE_BREAKER } from './constants';
+import { FormattedLine } from './types';
+
+type FormatFunc = (line: FormattedLine) => string;
+
+export function concatLogsToString(
+  logs: FormattedLine[],
+  formatFunc: FormatFunc = (line) => line.line
+) {
+  return logs.reduce(
+    (acc, formattedLine) => acc + formatFunc(formattedLine) + NEW_LINE_BREAKER,
+    ''
+  );
+}
diff --git a/app/docker/helpers/logHelper/constants.ts b/app/docker/helpers/logHelper/constants.ts
new file mode 100644
index 0000000..c0e22d2
--- /dev/null
+++ b/app/docker/helpers/logHelper/constants.ts
@@ -0,0 +1,3 @@
+import { BROWSER_OS_PLATFORM } from '@/react/constants';
+
+export const NEW_LINE_BREAKER = BROWSER_OS_PLATFORM === 'win' ? '\r\n' : '\n';
diff --git a/app/docker/helpers/logHelper/formatJSONLogs.ts b/app/docker/helpers/logHelper/formatJSONLogs.ts
new file mode 100644
index 0000000..7d0d74c
--- /dev/null
+++ b/app/docker/helpers/logHelper/formatJSONLogs.ts
@@ -0,0 +1,55 @@
+import { without } from 'lodash';
+
+import { FormattedLine, Span, JSONLogs, TIMESTAMP_LENGTH } from './types';
+import {
+  formatCaller,
+  formatKeyValuePair,
+  formatLevel,
+  formatMessage,
+  formatStackTrace,
+  formatTime,
+} from './formatters';
+
+function removeKnownKeys(keys: string[]) {
+  return without(keys, 'time', 'level', 'caller', 'message', 'stack_trace');
+}
+
+export function formatJSONLine(
+  rawText: string,
+  withTimestamps?: boolean
+): FormattedLine[] {
+  const spans: Span[] = [];
+  const lines: FormattedLine[] = [];
+  let line = '';
+
+  const text = withTimestamps ? rawText.substring(TIMESTAMP_LENGTH) : rawText;
+
+  const json: JSONLogs = JSON.parse(text);
+  const { time, level, caller, message, stack_trace: stackTrace } = json;
+  const keys = removeKnownKeys(Object.keys(json));
+
+  if (withTimestamps) {
+    const timestamp = rawText.substring(0, TIMESTAMP_LENGTH);
+    spans.push({ text: timestamp });
+    line += `${timestamp} `;
+  }
+  line += formatTime(time, spans, line);
+  line += formatLevel(level, spans, line);
+  line += formatCaller(caller, spans, line);
+  line += formatMessage(message, spans, line, !!keys.length);
+
+  keys.forEach((key, idx) => {
+    line += formatKeyValuePair(
+      key,
+      json[key],
+      spans,
+      line,
+      idx === keys.length - 1
+    );
+  });
+
+  lines.push({ line, spans });
+  formatStackTrace(stackTrace, lines);
+
+  return lines;
+}
diff --git a/app/docker/helpers/logHelper/formatLogs.ts b/app/docker/helpers/logHelper/formatLogs.ts
new file mode 100644
index 0000000..04d67aa
--- /dev/null
+++ b/app/docker/helpers/logHelper/formatLogs.ts
@@ -0,0 +1,156 @@
+import tokenize from '@nxmix/tokenize-ansi';
+import { FontWeight } from '@xterm/xterm';
+
+import {
+  colors,
+  BACKGROUND_COLORS_BY_ANSI,
+  FOREGROUND_COLORS_BY_ANSI,
+  RGBColor,
+} from './colors';
+import { formatJSONLine } from './formatJSONLogs';
+import { formatZerologLogs, ZerologRegex } from './formatZerologLogs';
+import { Token, Span, TIMESTAMP_LENGTH, FormattedLine } from './types';
+
+type FormatOptions = {
+  stripHeaders?: boolean;
+  withTimestamps?: boolean;
+  splitter?: string;
+};
+
+const defaultOptions: FormatOptions = {
+  splitter: '\n',
+};
+
+export function formatLogs(
+  rawLogs: string,
+  {
+    stripHeaders,
+    withTimestamps,
+    splitter = '\n',
+  }: FormatOptions = defaultOptions
+) {
+  let logs = rawLogs;
+  if (stripHeaders) {
+    logs = stripHeadersFunc(logs);
+  }
+  // if JSON logs come serialized 2 times, parse them once to unwrap them
+  if (logs.startsWith('"')) {
+    try {
+      logs = JSON.parse(logs);
+    } catch (error) {
+      // noop, throw error away if logs cannot be parsed
+    }
+  }
+
+  const tokens: Token[][] = tokenize(logs);
+  const formattedLogs: FormattedLine[] = [];
+
+  let fgColor: string | undefined;
+  let bgColor: string | undefined;
+  let fontWeight: FontWeight | undefined;
+  let line = '';
+  let spans: Span[] = [];
+
+  tokens.forEach((token) => {
+    const [type] = token;
+
+    const fgAnsi = FOREGROUND_COLORS_BY_ANSI[type];
+    const bgAnsi = BACKGROUND_COLORS_BY_ANSI[type];
+
+    if (fgAnsi) {
+      fgColor = cssColorFromRgb(fgAnsi);
+    } else if (type === 'moreColor') {
+      fgColor = extendedColorForToken(token);
+    } else if (type === 'fgDefault') {
+      fgColor = undefined;
+    } else if (bgAnsi) {
+      bgColor = cssColorFromRgb(bgAnsi);
+    } else if (type === 'bgMoreColor') {
+      bgColor = extendedColorForToken(token);
+    } else if (type === 'bgDefault') {
+      bgColor = undefined;
+    } else if (type === 'reset') {
+      fgColor = undefined;
+      bgColor = undefined;
+      fontWeight = undefined;
+    } else if (type === 'bold') {
+      fontWeight = 'bold';
+    } else if (type === 'normal') {
+      fontWeight = 'normal';
+    } else if (type === 'text') {
+      const tokenLines = (token[1] as string).split(splitter);
+
+      tokenLines.forEach((tokenLine, idx) => {
+        if (idx && line) {
+          formattedLogs.push({ line, spans });
+          line = '';
+          spans = [];
+        }
+
+        const text = stripEscapeCodes(tokenLine);
+        try {
+          if (
+            (!withTimestamps && text.startsWith('{')) ||
+            (withTimestamps && text.substring(TIMESTAMP_LENGTH).startsWith('{'))
+          ) {
+            const lines = formatJSONLine(text, withTimestamps);
+            formattedLogs.push(...lines);
+          } else if (
+            (!withTimestamps && ZerologRegex.test(text)) ||
+            (withTimestamps &&
+              ZerologRegex.test(text.substring(TIMESTAMP_LENGTH)))
+          ) {
+            const lines = formatZerologLogs(text, withTimestamps);
+            formattedLogs.push(...lines);
+          } else {
+            spans.push({ fgColor, bgColor, text, fontWeight });
+            line += text;
+          }
+        } catch (error) {
+          // in case parsing fails for whatever reason, push the raw logs and continue
+          spans.push({ fgColor, bgColor, text, fontWeight });
+          line += text;
+        }
+      });
+    }
+  });
+  if (line) {
+    formattedLogs.push({ line, spans });
+  }
+
+  return formattedLogs;
+}
+
+function stripHeadersFunc(logs: string) {
+  return logs.substring(8).replace(/\r?\n(.{8})/g, '\n');
+}
+
+function stripEscapeCodes(logs: string) {
+  return logs.replace(
+    // eslint-disable-next-line no-control-regex
+    /[\u001b\u009b][[()#;?]*(?:[0-9]{1,4}(?:;[0-9]{0,4})*)?[0-9A-ORZcf-nqry=><]/g,
+    ''
+  );
+}
+
+function cssColorFromRgb(rgb: RGBColor) {
+  const [r, g, b] = rgb;
+
+  return `rgb(${r}, ${g}, ${b})`;
+}
+
+// assuming types based on original JS implementation
+// there is not much type definitions for the tokenize library
+function extendedColorForToken(token: Token[]) {
+  const [, colorMode, colorRef] = token as [undefined, number, number];
+
+  if (colorMode === 2) {
+    return cssColorFromRgb(token.slice(2) as RGBColor);
+  }
+
+  if (colorMode === 5 && colors[colorRef]) {
+    return cssColorFromRgb(colors[colorRef]);
+  }
+
+  return '';
+}
diff --git a/app/docker/helpers/logHelper/formatZerologLogs.ts b/app/docker/helpers/logHelper/formatZerologLogs.ts
new file mode 100644
index 0000000..f43aeb3
--- /dev/null
+++ b/app/docker/helpers/logHelper/formatZerologLogs.ts
@@ -0,0 +1,125 @@
+import {
+  formatCaller,
+  formatKeyValuePair,
+  formatLevel,
+  formatMessage,
+  formatStackTrace,
+  formatTime,
+} from './formatters';
+import {
+  FormattedLine,
+  JSONStackTrace,
+  Level,
+  Span,
+  TIMESTAMP_LENGTH,
+} from './types';
+
+const dateRegex = /(\d{4}\/\d{2}\/\d{2} \d{2}:\d{2}[AP]M) /; // "2022/02/01 04:30AM "
+const levelRegex = /(\w{3}) /; // "INF " or "ERR "
+const callerRegex = /(.+?.go:\d+) /; // "path/to/file.go:line "
+const chevRegex = /> /; // "> "
+const messageAndPairsRegex = /(.*)/; // include the rest of the string in a separate group
+
+const keyRegex = /(\S+=)/g; // ""
+
+export const ZerologRegex = concatRegex(
+  dateRegex,
+  levelRegex,
+  callerRegex,
+  chevRegex,
+  messageAndPairsRegex
+);
+
+function concatRegex(...regs: RegExp[]) {
+  const flags = Array.from(
+    new Set(
+      regs
+        .map((r) => r.flags)
+        .join('')
+        .split('')
+    )
+  ).join('');
+  const source = regs.map((r) => r.source).join('');
+  return new RegExp(source, flags);
+}
+
+type Pair = {
+  key: string;
+  value: string;
+};
+
+export function formatZerologLogs(rawText: string, withTimestamps?: boolean) {
+  const spans: Span[] = [];
+  const lines: FormattedLine[] = [];
+  let line = '';
+
+  const text = withTimestamps ? rawText.substring(TIMESTAMP_LENGTH) : rawText;
+
+  if (withTimestamps) {
+    const timestamp = rawText.substring(0, TIMESTAMP_LENGTH);
+    spans.push({ text: timestamp });
+    line += `${timestamp} `;
+  }
+
+  const [, date, level, caller, messageAndPairs] =
+    text.match(ZerologRegex) || [];
+
+  const [message, pairs] = extractPairs(messageAndPairs);
+
+  line += formatTime(date, spans, line);
+  line += formatLevel(level as Level, spans, line);
+  line += formatCaller(caller, spans, line);
+  line += formatMessage(message, spans, line, !!pairs.length);
+
+  let stackTrace: JSONStackTrace | undefined;
+  const stackTraceIndex = pairs.findIndex((p) => p.key === 'stack_trace');
+
+  if (stackTraceIndex !== -1) {
+    stackTrace = JSON.parse(pairs[stackTraceIndex].value);
+    pairs.splice(stackTraceIndex);
+  }
+
+  pairs.forEach(({ key, value }, idx) => {
+    line += formatKeyValuePair(
+      key,
+      value,
+      spans,
+      line,
+      idx === pairs.length - 1
+    );
+  });
+  lines.push({ line, spans });
+
+  formatStackTrace(stackTrace, lines);
+
+  return lines;
+}
+
+function extractPairs(messageAndPairs: string): [string, Pair[]] {
+  const pairs: Pair[] = [];
+  let [message, rawPairs] = messageAndPairs.split('|');
+
+  if (!messageAndPairs.includes('|') && !rawPairs) {
+    rawPairs = message;
+    message = '';
+  }
+  message = message.trim();
+  rawPairs = rawPairs.trim();
+
+  const matches = [...rawPairs.matchAll(keyRegex)];
+
+  matches.forEach((m, idx) => {
+    const rawKey = m[0];
+    const key = rawKey.slice(0, -1);
+    const start = m.index || 0;
+    const end = idx !== matches.length - 1 ? matches[idx + 1].index : undefined;
+    const value = (
+      end
+        ? rawPairs.slice(start + rawKey.length, end)
+        : rawPairs.slice(start + rawKey.length)
+    ).trim();
+    pairs.push({ key, value });
+  });
+
+  return [message, pairs];
+}
diff --git a/app/docker/helpers/logHelper/formatters.ts b/app/docker/helpers/logHelper/formatters.ts
new file mode 100644
index 0000000..f48caae
--- /dev/null
+++ b/app/docker/helpers/logHelper/formatters.ts
@@ -0,0 +1,161 @@
+import { format } from 'date-fns';
+import { takeRight } from 'lodash';
+
+import { Span, Level, Colors, JSONStackTrace, FormattedLine } from './types';
+
+const spaceSpan: Span = { text: ' ' };
+
+function logLevelToSpan(level: Level): Span {
+  switch (level) {
+    case 'debug':
+    case 'DBG':
+      return {
+        fgColor: Colors.Grey,
+        text: 'DBG',
+        fontWeight: 'bold',
+      };
+    case 'info':
+    case 'INF':
+      return {
+        fgColor: Colors.Green,
+        text: 'INF',
+        fontWeight: 'bold',
+      };
+    case 'warn':
+    case 'WRN':
+      return {
+        fgColor: Colors.Yellow,
+        text: 'WRN',
+        fontWeight: 'bold',
+      };
+    case 'error':
+    case 'ERR':
+      return {
+        fgColor: Colors.Red,
+        text: 'ERR',
+        fontWeight: 'bold',
+      };
+    default:
+      return { text: level };
+  }
+}
+
+export function formatTime(
+  time: number | string | undefined,
+  spans: Span[],
+  line: string
+) {
+  let nl = line;
+  if (time) {
+    let date;
+    if (typeof time === 'number') {
+      // time is a number, so it is the number of seconds OR milliseconds since Unix Epoch (1970-01-01T00:00:00.000Z)
+      // we need to know if time's unit is second or millisecond
+      // 253402214400 is the numer of seconds between Unix Epoch and 9999-12-31T00:00:00.000Z
+      // if time is greater than 253402214400, then time unit cannot be second, so it is millisecond
+      const timestampInMilliseconds = time > 253402214400 ? time : time * 1000;
+      date = format(new Date(timestampInMilliseconds), 'Y/MM/dd hh:mmaa');
+    } else {
+      date = time;
+    }
+    spans.push({ fgColor: Colors.Grey, text: date }, spaceSpan);
+    nl += `${date} `;
+  }
+  return nl;
+}
+
+export function formatLevel(
+  level: Level | undefined,
+  spans: Span[],
+  line: string
+) {
+  let nl = line;
+  if (level) {
+    const levelSpan = logLevelToSpan(level);
+    spans.push(levelSpan, spaceSpan);
+    nl += `${levelSpan.text} `;
+  }
+  return nl;
+}
+
+export function formatCaller(
+  caller: string | undefined,
+  spans: Span[],
+  line: string
+) {
+  let nl = line;
+  if (caller) {
+    const trim = takeRight(caller.split('/'), 2).join('/');
+    spans.push(
+      { fgColor: Colors.Magenta, text: trim, fontWeight: 'bold' },
+      spaceSpan
+    );
+    spans.push({ fgColor: Colors.Blue, text: '>' }, spaceSpan);
+    nl += `${trim} > `;
+  }
+  return nl;
+}
+
+export function formatMessage(
+  message: string,
+  spans: Span[],
+  line: string,
+  hasKeys: boolean
+) {
+  let nl = line;
+  if (message) {
+    spans.push({ fgColor: Colors.Magenta, text: `${message}` }, spaceSpan);
+    nl += `${message} `;
+
+    if (hasKeys) {
+      spans.push({ fgColor: Colors.Magenta, text: `|` }, spaceSpan);
+      nl += '| ';
+    }
+  }
+  return nl;
+}
+
+export function formatKeyValuePair(
+  key: string,
+  value: unknown,
+  spans: Span[],
+  line: string,
+  isLastKey: boolean
+) {
+  let nl = line;
+
+  const strValue = typeof value !== 'string' ? JSON.stringify(value) : value;
+
+  spans.push(
+    { fgColor: Colors.Blue, text: `${key}=` },
+    {
+      fgColor: key === 'error' || key === 'ERR' ? Colors.Red : Colors.Magenta,
+      text: strValue,
+    }
+  );
+  if (!isLastKey) spans.push(spaceSpan);
+  nl += `${key}=${strValue}${!isLastKey ? ' ' : ''}`;
+
+  return nl;
+}
+
+export function formatStackTrace(
+  stackTrace: JSONStackTrace | undefined,
+  lines: FormattedLine[]
+) {
+  if (stackTrace) {
+    stackTrace.forEach(({ func, line: lineNumber, source }) => {
+      const line = `    at ${func} (${source}:${lineNumber})`;
+      const spans: Span[] = [
+        spaceSpan,
+        spaceSpan,
+        spaceSpan,
+        spaceSpan,
+        { text: 'at ', fgColor: Colors.Grey },
+        { text: func, fgColor: Colors.Red },
+        { text: `(${source}:${lineNumber})`, fgColor: Colors.Grey },
+      ];
+      lines.push({ line, spans });
+    });
+  }
+}
diff --git a/app/docker/helpers/logHelper/index.ts b/app/docker/helpers/logHelper/index.ts
new file mode 100644
index 0000000..9b9bfe1
--- /dev/null
+++ b/app/docker/helpers/logHelper/index.ts
@@ -0,0 +1,3 @@
+export { formatLogs } from './formatLogs';
+export { concatLogsToString } from './concatLogsToString';
+export { NEW_LINE_BREAKER } from './constants';
diff --git a/app/docker/helpers/logHelper/types.ts b/app/docker/helpers/logHelper/types.ts
new file mode 100644
index 0000000..4cf11f8
--- /dev/null
+++ b/app/docker/helpers/logHelper/types.ts
@@ -0,0 +1,53 @@
+import { FontWeight } from '@xterm/xterm';
+
+import { type TextColor } from './colors';
+
+export type Token = string | number;
+
+export type Level =
+  | 'debug'
+  | 'info'
+  | 'warn'
+  | 'error'
+  | 'DBG'
+  | 'INF'
+  | 'WRN'
+  | 'ERR';
+
+export type JSONStackTrace = {
+  func: string;
+  line: string;
+  source: string;
+}[];
+
+export type JSONLogs = {
+  [k: string]: unknown;
+  time: number;
+  level: Level;
+  caller: string;
+  message: string;
+  stack_trace?: JSONStackTrace;
+};
+
+export type Span = {
+  fgColor?: TextColor;
+  bgColor?: TextColor;
+  text: string;
+  fontWeight?: FontWeight;
+};
+
+export type FormattedLine = {
+  spans: Span[];
+  line: string;
+};
+
+export const TIMESTAMP_LENGTH = 31; // 30 for timestamp + 1 for trailing space
+
+export const Colors = {
+  Grey: 'var(--text-log-viewer-color-json-grey)',
+  Magenta: 'var(--text-log-viewer-color-json-magenta)',
+  Yellow: 'var(--text-log-viewer-color-json-yellow)',
+  Green: 'var(--text-log-viewer-color-json-green)',
+  Red: 'var(--text-log-viewer-color-json-red)',
+  Blue: 'var(--text-log-viewer-color-json-blue)',
+};
diff --git a/app/docker/helpers/networkHelper.js b/app/docker/helpers/networkHelper.js
new file mode 100644
index 0000000..09e4abe
--- /dev/null
+++ b/app/docker/helpers/networkHelper.js
@@ -0,0 +1,13 @@
+import _ from 'lodash-es';
+
+class DockerNetworkHelper {
+  static getIPV4Configs(configs) {
+    return _.filter(configs, (config) => /^([0-9]{1,3}\.){3}[0-9]{1,3}(\/([0-9]|[1-2][0-9]|3[0-2]))?$/.test(config.Subnet));
+  }
+
+  static getIPV6Configs(configs) {
+    return _.without(configs, ...DockerNetworkHelper.getIPV4Configs(configs));
+  }
+}
+
+export default DockerNetworkHelper;
diff --git a/app/docker/helpers/nodeHelper.js b/app/docker/helpers/nodeHelper.js
new file mode 100644
index 0000000..a97a7b8
--- /dev/null
+++ b/app/docker/helpers/nodeHelper.js
@@ -0,0 +1,15 @@
+angular.module('portainer.docker').factory('NodeHelper', [
+  function NodeHelperFactory() {
+    'use strict';
+    return {
+      nodeToConfig: function (node) {
+        return {
+          Name: node.Spec.Name,
+          Role: node.Spec.Role,
+          Labels: node.Spec.Labels,
+          Availability: node.Spec.Availability,
+        };
+      },
+    };
+  },
+]);
diff --git a/app/docker/helpers/secretHelper.js b/app/docker/helpers/secretHelper.js
new file mode 100644
index 0000000..9948f84
--- /dev/null
+++ b/app/docker/helpers/secretHelper.js
@@ -0,0 +1,35 @@
+angular.module('portainer.docker').factory('SecretHelper', [
+  function SecretHelperFactory() {
+    'use strict';
+    return {
+      flattenSecret: function (secret) {
+        if (secret) {
+          return {
+            Id: secret.SecretID,
+            Name: secret.SecretName,
+            FileName: secret.File.Name,
+            Uid: secret.File.UID,
+            Gid: secret.File.GID,
+            Mode: secret.File.Mode,
+          };
+        }
+        return {};
+      },
+      secretConfig: function (secret) {
+        if (secret) {
+          return {
+            SecretID: secret.Id,
+            SecretName: secret.Name,
+            File: {
+              Name: secret.FileName,
+              UID: secret.Uid || '0',
+              GID: secret.Gid || '0',
+              Mode: secret.Mode || 444,
+            },
+          };
+        }
+        return {};
+      },
+    };
+  },
+]);
diff --git a/app/docker/helpers/serviceHelper.js b/app/docker/helpers/serviceHelper.js
new file mode 100644
index 0000000..3ef5d8e
--- /dev/null
+++ b/app/docker/helpers/serviceHelper.js
@@ -0,0 +1,208 @@
+import moment from 'moment';
+
+angular.module('portainer.docker').factory('ServiceHelper', [
+  function ServiceHelperFactory() {
+    'use strict';
+
+    var helper = {};
+
+    helper.associateTasksToService = associateTasksToServiceAJS;
+
+    function associateTasksToServiceAJS(service, tasks) {
+      service.Tasks = [];
+      var otherServicesTasks = [];
+      for (var i = 0; i < tasks.length; i++) {
+        var task = tasks[i];
+        if (task.ServiceId === service.Id) {
+          service.Tasks.push(task);
+          task.ServiceName = service.Name;
+        } else {
+          otherServicesTasks.push(task);
+        }
+      }
+      tasks = otherServicesTasks;
+    }
+
+    helper.translateKeyValueToPlacementPreferences = function (keyValuePreferences) {
+      if (keyValuePreferences) {
+        var preferences = [];
+        keyValuePreferences.forEach(function (preference) {
+          if (preference.strategy && preference.strategy !== '' && preference.value && preference.value !== '') {
+            switch (preference.strategy.toLowerCase()) {
+              case 'spread':
+                preferences.push({
+                  Spread: {
+                    SpreadDescriptor: preference.value,
+                  },
+                });
+                break;
+            }
+          }
+        });
+        return preferences;
+      }
+      return [];
+    };
+
+    helper.translateKeyValueToPlacementConstraints = function (keyValueConstraints) {
+      if (keyValueConstraints) {
+        var constraints = [];
+        keyValueConstraints.forEach(function (constraint) {
+          if (constraint.key && constraint.key !== '' && constraint.value && constraint.value !== '') {
+            constraints.push(constraint.key + constraint.operator + constraint.value);
+          }
+        });
+        return constraints;
+      }
+      return [];
+    };
+
+    helper.translatePreferencesToKeyValue = function (preferences) {
+      if (preferences) {
+        var keyValuePreferences = [];
+        preferences.forEach(function (preference) {
+          if (preference.Spread) {
+            keyValuePreferences.push({
+              strategy: 'Spread',
+              value: preference.Spread.SpreadDescriptor,
+            });
+          }
+        });
+        return keyValuePreferences;
+      }
+      return [];
+    };
+
+    helper.translateConstraintsToKeyValue = function (constraints) {
+      function getOperator(constraint) {
+        var indexEquals = constraint.indexOf('==');
+        if (indexEquals >= 0) {
+          return [indexEquals, '=='];
+        }
+        return [constraint.indexOf('!='), '!='];
+      }
+      if (constraints) {
+        var keyValueConstraints = [];
+        constraints.forEach(function (constraint) {
+          var operatorIndices = getOperator(constraint);
+
+          var key = constraint.slice(0, operatorIndices[0]);
+          var operator = operatorIndices[1];
+          var value = constraint.slice(operatorIndices[0] + 2);
+
+          keyValueConstraints.push({
+            key: key,
+            value: value,
+            operator: operator,
+            originalKey: key,
+            originalValue: value,
+          });
+        });
+        return keyValueConstraints;
+      }
+    };
+
+    helper.translateHumanDurationToNanos = function (humanDuration) {
+      var nanos;
+      var regex = /^([0-9]+)(h|m|s|ms|us|ns)$/i;
+      var matches = humanDuration.match(regex);
+
+      if (matches !== null && matches.length === 3) {
+        var duration = parseInt(matches[1], 10);
+        var unit = matches[2];
+        // Moment.js cannot use micro or nanoseconds
+        switch (unit) {
+          case 'ns':
+            nanos = duration;
+            break;
+          case 'us':
+            nanos = duration * 1000;
+            break;
+          default:
+            nanos = moment.duration(duration, unit).asMilliseconds() * 1000000;
+        }
+      }
+      return nanos;
+    };
+
+    // Convert nanoseconds to the higher unit possible
+    // e.g 1840 nanoseconds = 1804ns
+    // e.g 300000000000 nanoseconds = 5m
+    // e.g 3510000000000 nanoseconds = 3510s
+    // e.g 3540000000000 nanoseconds = 59m
+    // e.g 3600000000000 nanoseconds = 1h
+
+    helper.translateNanosToHumanDuration = function (nanos) {
+      var humanDuration = '0s';
+      var conversionFromNano = {};
+      conversionFromNano['ns'] = 1;
+      conversionFromNano['us'] = conversionFromNano['ns'] * 1000;
+      conversionFromNano['ms'] = conversionFromNano['us'] * 1000;
+      conversionFromNano['s'] = conversionFromNano['ms'] * 1000;
+      conversionFromNano['m'] = conversionFromNano['s'] * 60;
+      conversionFromNano['h'] = conversionFromNano['m'] * 60;
+
+      Object.keys(conversionFromNano).forEach(function (unit) {
+        if (nanos % conversionFromNano[unit] === 0 && nanos / conversionFromNano[unit] > 0) {
+          humanDuration = nanos / conversionFromNano[unit] + unit;
+        }
+      });
+      return humanDuration;
+    };
+
+    helper.translateLogDriverOptsToKeyValue = function (logOptions) {
+      var options = [];
+      if (logOptions) {
+        Object.keys(logOptions).forEach(function (key) {
+          options.push({
+            key: key,
+            value: logOptions[key],
+            originalKey: key,
+            originalValue: logOptions[key],
+            added: true,
+          });
+        });
+      }
+      return options;
+    };
+
+    helper.translateKeyValueToLogDriverOpts = function (keyValueLogDriverOpts) {
+      var options = {};
+      if (keyValueLogDriverOpts) {
+        keyValueLogDriverOpts.forEach(function (option) {
+          if (option.key && option.key !== '' && option.value && option.value !== '') {
+            options[option.key] = option.value;
+          }
+        });
+      }
+      return options;
+    };
+
+    helper.translateHostsEntriesToHostnameIP = function (entries) {
+      var ipHostEntries = [];
+      if (entries) {
+        entries.forEach(function (entry) {
+          if (entry.indexOf(' ') && entry.split(' ').length === 2) {
+            var keyValue = entry.split(' ');
+            ipHostEntries.push({ hostname: keyValue[1], ip: keyValue[0] });
+          }
+        });
+      }
+      return ipHostEntries;
+    };
+
+    helper.translateHostnameIPToHostsEntries = function (entries) {
+      var ipHostEntries = [];
+      if (entries) {
+        entries.forEach(function (entry) {
+          if (entry.ip && entry.hostname) {
+            ipHostEntries.push(entry.ip + ' ' + entry.hostname);
+          }
+        });
+      }
+      return ipHostEntries;
+    };
+
+    return helper;
+  },
+]);
diff --git a/app/docker/helpers/splitargs.test.ts b/app/docker/helpers/splitargs.test.ts
new file mode 100644
index 0000000..dbdcc79
--- /dev/null
+++ b/app/docker/helpers/splitargs.test.ts
@@ -0,0 +1,68 @@
+/**
+ * Created by elgs on 7/2/14.
+ */
+
+import { splitargs } from './splitargs';
+
+describe('splitargs Suite', () => {
+  beforeEach(() => {});
+  afterEach(() => {});
+
+  it('should split double quoted string', () => {
+    const i = " I  said 'I am sorry.', and he said \"it doesn't matter.\" ";
+    const o = splitargs(i);
+    expect(7).toBe(o.length);
+    expect(o[0]).toBe('I');
+    expect(o[1]).toBe('said');
+    expect(o[2]).toBe('I am sorry.,');
+    expect(o[3]).toBe('and');
+    expect(o[4]).toBe('he');
+    expect(o[5]).toBe('said');
+    expect(o[6]).toBe("it doesn't matter.");
+  });
+
+  it('should split pure double quoted string', () => {
+    const i = 'I said "I am sorry.", and he said "it doesn\'t matter."';
+    const o = splitargs(i);
+    expect(o).toHaveLength(7);
+    expect(o[0]).toBe('I');
+    expect(o[1]).toBe('said');
+    expect(o[2]).toBe('I am sorry.,');
+    expect(o[3]).toBe('and');
+    expect(o[4]).toBe('he');
+    expect(o[5]).toBe('said');
+    expect(o[6]).toBe("it doesn't matter.");
+  });
+
+  it('should split single quoted string', () => {
+    const i = 'I said "I am sorry.", and he said "it doesn\'t matter."';
+    const o = splitargs(i);
+    expect(o).toHaveLength(7);
+    expect(o[0]).toBe('I');
+    expect(o[1]).toBe('said');
+    expect(o[2]).toBe('I am sorry.,');
+    expect(o[3]).toBe('and');
+    expect(o[4]).toBe('he');
+    expect(o[5]).toBe('said');
+    expect(o[6]).toBe("it doesn't matter.");
+  });
+
+  it('should split pure single quoted string', () => {
+    const i = "I said 'I am sorry.', and he said \"it doesn't matter.\"";
+    const o = splitargs(i);
+    expect(o).toHaveLength(7);
+    expect(o[0]).toBe('I');
+    expect(o[1]).toBe('said');
+    expect(o[2]).toBe('I am sorry.,');
+    expect(o[3]).toBe('and');
+    expect(o[4]).toBe('he');
+    expect(o[5]).toBe('said');
+    expect(o[6]).toBe("it doesn't matter.");
+  });
+
+  it('should split to 4 empty strings', () => {
+    const i = ',,,';
+    const o = splitargs(i, ',', true);
+    expect(o).toHaveLength(4);
+  });
+});
diff --git a/app/docker/helpers/splitargs.ts b/app/docker/helpers/splitargs.ts
new file mode 100644
index 0000000..9cbcc8c
--- /dev/null
+++ b/app/docker/helpers/splitargs.ts
@@ -0,0 +1,114 @@
+/**
+
+Splits strings into tokens by given separator except treating quoted part as a single token.
+
+
+#Usage
+```javascript
+var splitargs = require('splitargs');
+
+var i1 = "I said 'I am sorry.', and he said \"it doesn't matter.\"";
+var o1 = splitargs(i1);
+console.log(o1);
+
+[ 'I',
+  'said',
+  'I am sorry.,',
+  'and',
+  'he',
+  'said',
+  'it doesn\'t matter.' ]
+
+
+var i2 = "I said \"I am sorry.\", and he said \"it doesn't matter.\"";
+var o2 = splitargs(i2);
+console.log(o2);
+
+[ 'I',
+  'said',
+  'I am sorry.,',
+  'and',
+  'he',
+  'said',
+  'it doesn\'t matter.' ]
+
+
+var i3 = 'I said "I am sorry.", and he said "it doesn\'t matter."';
+var o3 = splitargs(i3);
+console.log(o3);
+
+[ 'I',
+  'said',
+  'I am sorry.,',
+  'and',
+  'he',
+  'said',
+  'it doesn\'t matter.' ]
+
+
+var i4 = 'I said \'I am sorry.\', and he said "it doesn\'t matter."';
+var o4 = splitargs(i4);
+console.log(o4);
+
+[ 'I',
+  'said',
+  'I am sorry.,',
+  'and',
+  'he',
+  'said',
+  'it doesn\'t matter.' ]
+ ```
+ */
+
+export function splitargs(
+  input: string,
+  sep?: RegExp | string,
+  keepQuotes = false
+) {
+  const separator = sep || /\s/g;
+  let singleQuoteOpen = false;
+  let doubleQuoteOpen = false;
+  let tokenBuffer = [];
+  const ret = [];
+
+  const arr = input.split('');
+  for (let i = 0; i < arr.length; ++i) {
+    const element = arr[i];
+    const matches = element.match(separator);
+    // TODO rewrite without continue
+    /* eslint-disable no-continue */
+    if (element === "'" && !doubleQuoteOpen) {
+      if (keepQuotes) {
+        tokenBuffer.push(element);
+      }
+      singleQuoteOpen = !singleQuoteOpen;
+      continue;
+    } else if (element === '"' && !singleQuoteOpen) {
+      if (keepQuotes) {
+        tokenBuffer.push(element);
+      }
+      doubleQuoteOpen = !doubleQuoteOpen;
+      continue;
+    }
+    /* eslint-enable no-continue */
+
+    if (!singleQuoteOpen && !doubleQuoteOpen && matches) {
+      if (tokenBuffer.length > 0) {
+        ret.push(tokenBuffer.join(''));
+        tokenBuffer = [];
+      } else if (sep) {
+        ret.push(element);
+      }
+    } else {
+      tokenBuffer.push(element);
+    }
+  }
+
+  if (tokenBuffer.length > 0) {
+    ret.push(tokenBuffer.join(''));
+  } else if (sep) {
+    ret.push('');
+  }
+
+  return ret;
+}
diff --git a/app/docker/helpers/taskHelper.js b/app/docker/helpers/taskHelper.js
new file mode 100644
index 0000000..6b7c7a9
--- /dev/null
+++ b/app/docker/helpers/taskHelper.js
@@ -0,0 +1,18 @@
+angular.module('portainer.docker').factory('TaskHelper', [
+  function TaskHelperFactory() {
+    'use strict';
+
+    var helper = {};
+
+    helper.associateContainerToTask = associateContainerToTaskAJS;
+
+    return helper;
+
+    function associateContainerToTaskAJS(task, containers) {
+      const container = containers.find((c) => c.Id === task.ContainerId);
+      if (container) {
+        task.Container = container;
+      }
+    }
+  },
+]);
diff --git a/app/docker/helpers/volumeHelper.js b/app/docker/helpers/volumeHelper.js
new file mode 100644
index 0000000..b856129
--- /dev/null
+++ b/app/docker/helpers/volumeHelper.js
@@ -0,0 +1,23 @@
+angular.module('portainer.docker').factory('VolumeHelper', [
+  function VolumeHelperFactory() {
+    'use strict';
+    var helper = {};
+
+    helper.isVolumeUsedByAService = function (volume, services) {
+      for (var i = 0; i < services.length; i++) {
+        var service = services[i];
+        var mounts = service.Mounts;
+        for (var j = 0; j < mounts.length; j++) {
+          var mount = mounts[j];
+          if (mount.Source === volume.Id) {
+            return true;
+          }
+        }
+      }
+
+      return false;
+    };
+
+    return helper;
+  },
+]);
diff --git a/app/docker/models/build.ts b/app/docker/models/build.ts
new file mode 100644
index 0000000..ac480f5
--- /dev/null
+++ b/app/docker/models/build.ts
@@ -0,0 +1,33 @@
+type Data = {
+  stream: string;
+  errorDetail: { message: string };
+};
+
+export class ImageBuildModel {
+  hasError: boolean = false;
+
+  buildLogs: string[];
+
+  constructor(data: Data[]) {
+    const buildLogs: string[] = [];
+
+    data.forEach((line) => {
+      if (line.stream) {
+        // convert unicode chars to readable chars
+        const logLine = line.stream.replace(
+          // eslint-disable-next-line no-control-regex
+          /[\u001b\u009b][[()#;?]*(?:[0-9]{1,4}(?:;[0-9]{0,4})*)?[0-9A-ORZcf-nqry=><]/g,
+          ''
+        );
+        buildLogs.push(logLine);
+      }
+
+      if (line.errorDetail) {
+        buildLogs.push(line.errorDetail.message);
+        this.hasError = true;
+      }
+    });
+
+    this.buildLogs = buildLogs;
+  }
+}
diff --git a/app/docker/models/config.ts b/app/docker/models/config.ts
new file mode 100644
index 0000000..13214ee
--- /dev/null
+++ b/app/docker/models/config.ts
@@ -0,0 +1,54 @@
+import { Config } from 'docker-types';
+
+import { IResource } from '@/react/docker/components/datatable/createOwnershipColumn';
+import { PortainerResponse } from '@/react/docker/types';
+import { ResourceControlViewModel } from '@/react/portainer/access-control/models/ResourceControlViewModel';
+
+export class ConfigViewModel implements IResource {
+  Id: string;
+
+  CreatedAt: string;
+
+  UpdatedAt: string;
+
+  Version: number;
+
+  Name: string;
+
+  Labels: Record<string, string>;
+
+  Data: string;
+
+  ResourceControl?: ResourceControlViewModel;
+
+  constructor(data: PortainerResponse<Config>) {
+    this.Id = data.ID || '';
+    this.CreatedAt = data.CreatedAt || '';
+    this.UpdatedAt = data.UpdatedAt || '';
+    this.Version = data.Version?.Index || 0;
+    this.Name = data.Spec?.Name || '';
+    this.Labels = data.Spec?.Labels || {};
+    this.Data = b64DecodeUnicode(data.Spec?.Data || '');
+
+    if (data.Portainer && data.Portainer.ResourceControl) {
+      this.ResourceControl = new ResourceControlViewModel(
+        data.Portainer.ResourceControl
+      );
+    }
+  }
+}
+
+function b64DecodeUnicode(str: string) {
+  try {
+    return decodeURIComponent(
+      window
+        .atob(str)
+        .toString()
+        .split('')
+        .map((c) => `%${`00${c.charCodeAt(0).toString(16)}`.slice(-2)}`)
+        .join('')
+    );
+  } catch (err) {
+    return window.atob(str);
+  }
+}
diff --git a/app/docker/models/containerDetails.ts b/app/docker/models/containerDetails.ts
new file mode 100644
index 0000000..e0f50dd
--- /dev/null
+++ b/app/docker/models/containerDetails.ts
@@ -0,0 +1,56 @@
+import { IResource } from '@/react/docker/components/datatable/createOwnershipColumn';
+import { ContainerDetailsResponse } from '@/react/docker/containers/queries/useContainer';
+import { PortainerResponse } from '@/react/docker/types';
+import { ResourceControlViewModel } from '@/react/portainer/access-control/models/ResourceControlViewModel';
+
+export class ContainerDetailsViewModel
+  implements IResource, Pick<PortainerResponse<unknown>, 'IsPortainer'>
+{
+  Model: ContainerDetailsResponse;
+
+  Id: ContainerDetailsResponse['Id'];
+
+  State: ContainerDetailsResponse['State'];
+
+  Created: ContainerDetailsResponse['Created'];
+
+  Name: ContainerDetailsResponse['Name'];
+
+  NetworkSettings: ContainerDetailsResponse['NetworkSettings'];
+
+  Args: ContainerDetailsResponse['Args'];
+
+  Image: ContainerDetailsResponse['Image'];
+
+  Config: ContainerDetailsResponse['Config'];
+
+  HostConfig: ContainerDetailsResponse['HostConfig'];
+
+  Mounts: ContainerDetailsResponse['Mounts'];
+
+  // IResource
+  ResourceControl?: ResourceControlViewModel;
+
+  // PortainerResponse
+  IsPortainer?: ContainerDetailsResponse['IsPortainer'];
+
+  constructor(data: ContainerDetailsResponse) {
+    this.Model = data;
+    this.Id = data.Id;
+    this.State = data.State;
+    this.Created = data.Created;
+    this.Name = data.Name;
+    this.NetworkSettings = data.NetworkSettings;
+    this.Args = data.Args;
+    this.Image = data.Image;
+    this.Config = data.Config;
+    this.HostConfig = data.HostConfig;
+    this.Mounts = data.Mounts;
+    if (data.Portainer && data.Portainer.ResourceControl) {
+      this.ResourceControl = new ResourceControlViewModel(
+        data.Portainer.ResourceControl
+      );
+    }
+    this.IsPortainer = data.IsPortainer;
+  }
+}
diff --git a/app/docker/models/containerStats.ts b/app/docker/models/containerStats.ts
new file mode 100644
index 0000000..5f0d9cf
--- /dev/null
+++ b/app/docker/models/containerStats.ts
@@ -0,0 +1,121 @@
+import { values } from 'lodash';
+
+import { ContainerStats } from '@/react/docker/containers/queries/useContainerStats';
+import { ValueOf } from '@/types';
+
+/**
+ * This type is arbitrary and only defined based on what we use / observed from the API responses.
+ */
+export class ContainerStatsViewModel {
+  read: string;
+
+  preread: string;
+
+  MemoryUsage: number;
+
+  MemoryCache: number = 0;
+
+  NumProcs: number = 0;
+
+  isWindows: boolean = false;
+
+  PreviousCPUTotalUsage: number;
+
+  PreviousCPUSystemUsage: number;
+
+  CurrentCPUTotalUsage: number;
+
+  CurrentCPUSystemUsage: number;
+
+  CPUCores: number;
+
+  Networks: ValueOf<NonNullable<ContainerStats['networks']>>[];
+
+  BytesRead: number = 0;
+
+  BytesWrite: number = 0;
+
+  noIOdata: boolean = false;
+
+  constructor(data: ContainerStats) {
+    this.read = data.read || '';
+    this.preread = data.preread || '';
+    if (data?.memory_stats?.privateworkingset !== undefined) {
+      // Windows
+      this.MemoryUsage = data?.memory_stats?.privateworkingset;
+      this.MemoryCache = 0;
+      this.NumProcs = data.num_procs || 0;
+      this.isWindows = true;
+    }
+    // Podman has memory limit and usage but not stats
+    else if (
+      data?.memory_stats?.usage !== undefined &&
+      data?.memory_stats?.stats === undefined
+    ) {
+      this.MemoryUsage = data.memory_stats.usage || 0;
+      this.MemoryCache = 0;
+    }
+    // Linux
+    else if (
+      data?.memory_stats?.stats === undefined ||
+      data?.memory_stats?.usage === undefined
+    ) {
+      this.MemoryUsage = 0;
+      this.MemoryCache = 0;
+    } else {
+      this.MemoryCache = 0;
+      if (data?.memory_stats?.stats?.cache !== undefined) {
+        // cgroups v1
+        this.MemoryCache = data.memory_stats.stats.cache;
+      }
+      this.MemoryUsage = data.memory_stats.usage - this.MemoryCache;
+    }
+    this.PreviousCPUTotalUsage =
+      data?.precpu_stats?.cpu_usage?.total_usage || 0;
+    this.PreviousCPUSystemUsage = data?.precpu_stats?.system_cpu_usage || 0;
+    this.CurrentCPUTotalUsage = data?.cpu_stats?.cpu_usage?.total_usage || 0;
+    this.CurrentCPUSystemUsage = data?.cpu_stats?.system_cpu_usage || 0;
+    this.CPUCores = 1;
+
+    this.CPUCores =
+      data?.cpu_stats?.cpu_usage?.percpu_usage?.length ??
+      data?.cpu_stats?.online_cpus ??
+      1;
+
+    this.Networks = values(data.networks);
+
+    if (
+      data.blkio_stats !== undefined &&
+      data.blkio_stats.io_service_bytes_recursive !== null
+    ) {
+      // TODO: take care of multiple block devices
+      let readData = data?.blkio_stats?.io_service_bytes_recursive?.find(
+        (d) => d.op === 'Read'
+      );
+      if (readData === undefined) {
+        // try the cgroups v2 version
+        readData = data?.blkio_stats?.io_service_bytes_recursive?.find(
+          (d) => d.op === 'read'
+        );
+      }
+      if (readData !== undefined) {
+        this.BytesRead = readData.value;
+      }
+      let writeData = data?.blkio_stats?.io_service_bytes_recursive?.find(
+        (d) => d.op === 'Write'
+      );
+      if (writeData === undefined) {
+        // try the cgroups v2 version
+        writeData = data?.blkio_stats?.io_service_bytes_recursive?.find(
+          (d) => d.op === 'write'
+        );
+      }
+      if (writeData !== undefined) {
+        this.BytesWrite = writeData.value;
+      }
+    } else {
+      // no IO related data is available
+      this.noIOdata = true;
+    }
+  }
+}
diff --git a/app/docker/models/image.ts b/app/docker/models/image.ts
new file mode 100644
index 0000000..7142a52
--- /dev/null
+++ b/app/docker/models/image.ts
@@ -0,0 +1,47 @@
+import { ImageSummary } from 'docker-types';
+
+import { PortainerResponse } from '@/react/docker/types';
+
+export type ImageId = ImageSummary['Id'];
+export type ImageName = string;
+
+/**
+ * Partial copy of ImageSummary
+ */
+export class ImageViewModel {
+  Id: ImageId;
+
+  Created: ImageSummary['Created'];
+
+  RepoTags: ImageSummary['RepoTags'];
+
+  Size: ImageSummary['Size'];
+
+  Labels: ImageSummary['Labels'];
+
+  // internal
+
+  NodeName: string;
+
+  Used: boolean = false;
+
+  constructor(data: PortainerResponse<ImageSummary>, used: boolean = false) {
+    this.Id = data.Id;
+    // this.Tag = data.Tag; // doesn't seem to be used?
+    // this.Repository = data.Repository; // doesn't seem to be used?
+    this.Created = data.Created;
+    this.RepoTags = data.RepoTags;
+    if ((!this.RepoTags || this.RepoTags.length === 0) && data.RepoDigests) {
+      this.RepoTags = [];
+      data.RepoDigests.forEach((digest) => {
+        const repository = digest.substring(0, digest.indexOf('@'));
+        this.RepoTags.push(`${repository}:<none>`);
+      });
+    }
+
+    this.Size = data.Size;
+    this.NodeName = data.Portainer?.Agent?.NodeName || '';
+    this.Labels = data.Labels;
+    this.Used = used;
+  }
+}
diff --git a/app/docker/models/imageDetails.ts b/app/docker/models/imageDetails.ts
new file mode 100644
index 0000000..9115311
--- /dev/null
+++ b/app/docker/models/imageDetails.ts
@@ -0,0 +1,69 @@
+import { ImageInspect } from 'docker-types';
+
+type ImageInspectConfig = NonNullable<ImageInspect['Config']>;
+
+export class ImageDetailsViewModel {
+  Id: ImageInspect['Id'];
+
+  Parent: ImageInspect['Parent'];
+
+  Created: ImageInspect['Created'];
+
+  RepoTags: ImageInspect['RepoTags'];
+
+  Size: ImageInspect['Size'];
+
+  DockerVersion: ImageInspect['DockerVersion'];
+
+  Os: ImageInspect['Os'];
+
+  Architecture: ImageInspect['Architecture'];
+
+  Author: ImageInspect['Author'];
+
+  // Config sub fields
+
+  Command: ImageInspectConfig['Cmd'];
+
+  Entrypoint: Required<ImageInspectConfig['Entrypoint']>;
+
+  ExposedPorts: Required<ImageInspectConfig['ExposedPorts']>;
+
+  Volumes: Required<ImageInspectConfig>['Volumes'];
+
+  Env: Required<ImageInspectConfig>['Env'];
+
+  Labels: ImageInspectConfig['Labels'];
+
+  // computed fields
+
+  Used: boolean = false;
+
+  constructor(data: ImageInspect) {
+    this.Id = data.Id;
+    // this.Tag = data.Tag; // doesn't seem to be used?
+    this.Parent = data.Parent;
+    this.Created = data.Created;
+    // this.Repository = data.Repository; // doesn't seem to be used?
+    this.RepoTags = data.RepoTags;
+    this.Size = data.Size;
+    this.DockerVersion = data.DockerVersion;
+    this.Os = data.Os;
+    this.Architecture = data.Architecture;
+    this.Author = data.Author;
+    this.Command = data.Config?.Cmd;
+
+    let config: ImageInspect['Config'] = {};
+    if (data.Config) {
+      config = data.Config; // this is part of OCI images-spec
+    }
+
+    this.Entrypoint = config.Entrypoint ?? [''];
+    this.ExposedPorts = config.ExposedPorts
+      ? Object.keys(config.ExposedPorts)
+      : [];
+    this.Volumes = config.Volumes ? Object.keys(config.Volumes) : [];
+    this.Env = config.Env ?? [];
+    this.Labels = config.Labels;
+  }
+}
diff --git a/app/docker/models/imageLayer.ts b/app/docker/models/imageLayer.ts
new file mode 100644
index 0000000..956ed36
--- /dev/null
+++ b/app/docker/models/imageLayer.ts
@@ -0,0 +1,27 @@
+import { ImageLayer } from '@/react/docker/proxy/queries/images/useImageHistory';
+
+export class ImageLayerViewModel implements ImageLayer {
+  Id: ImageLayer['Id'];
+
+  Created: ImageLayer['Created'];
+
+  CreatedBy: ImageLayer['CreatedBy'];
+
+  Size: ImageLayer['Size'];
+
+  Comment: ImageLayer['Comment'];
+
+  Tags: ImageLayer['Tags'];
+
+  constructor(
+    public Order: number,
+    data: ImageLayer
+  ) {
+    this.Id = data.Id;
+    this.Created = data.Created;
+    this.CreatedBy = data.CreatedBy;
+    this.Size = data.Size;
+    this.Comment = data.Comment;
+    this.Tags = data.Tags;
+  }
+}
diff --git a/app/docker/models/network.ts b/app/docker/models/network.ts
new file mode 100644
index 0000000..eded479
--- /dev/null
+++ b/app/docker/models/network.ts
@@ -0,0 +1,91 @@
+import { IPAM, Network, NetworkContainer } from 'docker-types';
+
+import { ResourceControlViewModel } from '@/react/portainer/access-control/models/ResourceControlViewModel';
+import { IResource } from '@/react/docker/components/datatable/createOwnershipColumn';
+import { PortainerResponse } from '@/react/docker/types';
+
+// TODO later: aggregate NetworkViewModel and DockerNetwork types
+//
+// type MacvlanNetwork = {
+//   ConfigFrom?: { Network: string };
+//   ConfigOnly?: boolean;
+// };
+//
+// type NetworkViewModel = Network & {
+//   StackName?: string;
+//   NodeName?: string;
+//   ResourceControl?: ResourceControlViewModel;
+// } & MacvlanNetwork;
+
+export class NetworkViewModel implements IResource {
+  Id: string;
+
+  Name: string;
+
+  Scope: string;
+
+  Driver: string;
+
+  Attachable: boolean;
+
+  Internal: boolean;
+
+  IPAM?: IPAM;
+
+  Containers?: Record<string, NetworkContainer>;
+
+  Options?: Record<string, string>;
+
+  Ingress: boolean;
+
+  Labels: Record<string, string>;
+
+  StackName?: string;
+
+  NodeName?: string;
+
+  ConfigFrom?: { Network: string };
+
+  ConfigOnly?: boolean;
+
+  ResourceControl?: ResourceControlViewModel;
+
+  constructor(
+    data: PortainerResponse<Network> & {
+      ConfigFrom?: { Network: string };
+      ConfigOnly?: boolean;
+    }
+  ) {
+    this.Id = data.Id || '';
+    this.Name = data.Name || '';
+    this.Scope = data.Scope || '';
+    this.Driver = data.Driver || '';
+    this.Attachable = data.Attachable || false;
+    this.Internal = data.Internal || false;
+    this.IPAM = data.IPAM;
+    this.Containers = data.Containers;
+    this.Options = data.Options;
+    this.Ingress = data.Ingress || false;
+
+    this.Labels = data.Labels || {};
+    if (this.Labels && this.Labels['com.docker.compose.project']) {
+      this.StackName = this.Labels['com.docker.compose.project'];
+    } else if (this.Labels && this.Labels['com.docker.stack.namespace']) {
+      this.StackName = this.Labels['com.docker.stack.namespace'];
+    }
+
+    if (data.Portainer) {
+      if (data.Portainer.ResourceControl) {
+        this.ResourceControl = new ResourceControlViewModel(
+          data.Portainer.ResourceControl
+        );
+      }
+      if (data.Portainer.Agent && data.Portainer.Agent.NodeName) {
+        this.NodeName = data.Portainer.Agent.NodeName;
+      }
+    }
+
+    this.ConfigFrom = data.ConfigFrom;
+    this.ConfigOnly = data.ConfigOnly;
+  }
+}
diff --git a/app/docker/models/node.ts b/app/docker/models/node.ts
new file mode 100644
index 0000000..ad84011
--- /dev/null
+++ b/app/docker/models/node.ts
@@ -0,0 +1,116 @@
+import {
+  Node,
+  EngineDescription,
+  ManagerStatus,
+  NodeDescription,
+  NodeSpec,
+  NodeStatus,
+  ObjectVersion,
+  Platform,
+  ResourceObject,
+} from 'docker-types';
+
+export class NodeViewModel {
+  Model: Node;
+
+  Id: Node['ID'];
+
+  Version: ObjectVersion['Index'];
+
+  Name: NodeSpec['Name'];
+
+  Role: NodeSpec['Role'];
+
+  CreatedAt: Node['CreatedAt'];
+
+  UpdatedAt: Node['UpdatedAt'];
+
+  Availability: NodeSpec['Availability'];
+
+  Labels: Array<{
+    key: string;
+    value: string;
+    originalKey: string;
+    originalValue: string;
+    added: boolean;
+  }>;
+
+  EngineLabels: Array<{ key: string; value: string }>;
+
+  Hostname: NodeDescription['Hostname'];
+
+  PlatformArchitecture: Platform['Architecture'];
+
+  PlatformOS: Platform['OS'];
+
+  CPUs: ResourceObject['NanoCPUs'];
+
+  Memory: ResourceObject['MemoryBytes'];
+
+  EngineVersion: EngineDescription['EngineVersion'];
+
+  Plugins: EngineDescription['Plugins'];
+
+  Status: NodeStatus['State'];
+
+  Addr: Required<NodeStatus>['Addr'] = '';
+
+  Leader: ManagerStatus['Leader'];
+
+  Reachability: ManagerStatus['Reachability'];
+
+  ManagerAddr: ManagerStatus['Addr'];
+
+  constructor(data: Node) {
+    this.Model = data;
+    this.Id = data.ID;
+    this.Version = data.Version?.Index;
+    this.Name = data.Spec?.Name;
+    this.Role = data.Spec?.Role;
+    this.CreatedAt = data.CreatedAt;
+    this.UpdatedAt = data.UpdatedAt;
+    this.Availability = data.Spec?.Availability;
+
+    const labels = data.Spec?.Labels;
+    if (labels) {
+      this.Labels = Object.keys(labels).map((key) => ({
+        key,
+        value: labels[key],
+        originalKey: key,
+        originalValue: labels[key],
+        added: true,
+      }));
+    } else {
+      this.Labels = [];
+    }
+
+    const engineLabels = data.Description?.Engine?.Labels;
+    if (engineLabels) {
+      this.EngineLabels = Object.keys(engineLabels).map((key) => ({
+        key,
+        value: engineLabels[key],
+      }));
+    } else {
+      this.EngineLabels = [];
+    }
+
+    this.Hostname = data.Description?.Hostname;
+    this.PlatformArchitecture = data.Description?.Platform?.Architecture;
+    this.PlatformOS = data.Description?.Platform?.OS;
+    this.CPUs = data.Description?.Resources?.NanoCPUs;
+    this.Memory = data.Description?.Resources?.MemoryBytes;
+    this.EngineVersion = data.Description?.Engine?.EngineVersion;
+    this.Plugins = data.Description?.Engine?.Plugins;
+    this.Status = data.Status?.State;
+
+    if (data.Status?.Addr) {
+      this.Addr = data.Status?.Addr;
+    }
+
+    if (data.ManagerStatus) {
+      this.Leader = data.ManagerStatus.Leader;
+      this.Reachability = data.ManagerStatus.Reachability;
+      this.ManagerAddr = data.ManagerStatus.Addr;
+    }
+  }
+}
diff --git a/app/docker/models/porImageRegistry.js b/app/docker/models/porImageRegistry.js
new file mode 100644
index 0000000..c34c318
--- /dev/null
+++ b/app/docker/models/porImageRegistry.js
@@ -0,0 +1,16 @@
+/**
+ * This model should be used with por-image-registry component
+ * And bound to the 'model' attribute
+ *
+ * // viewController.js
+ *
+ * this.imageModel = new PorImageRegistryModel();
+ *
+ * // view.html
+ * <por-image-registry model="$ctrl.imageModel" ... />
+ */
+export function PorImageRegistryModel() {
+  this.UseRegistry = true;
+  this.Registry = {};
+  this.Image = '';
+}
diff --git a/app/docker/models/secret.ts b/app/docker/models/secret.ts
new file mode 100644
index 0000000..4d0c042
--- /dev/null
+++ b/app/docker/models/secret.ts
@@ -0,0 +1,36 @@
+import { Secret } from 'docker-types';
+
+import { ResourceControlViewModel } from '@/react/portainer/access-control/models/ResourceControlViewModel';
+import { PortainerResponse } from '@/react/docker/types';
+import { IResource } from '@/react/docker/components/datatable/createOwnershipColumn';
+
+export class SecretViewModel implements IResource {
+  Id: string;
+
+  CreatedAt: string;
+
+  UpdatedAt: string;
+
+  Version: number;
+
+  Name: string;
+
+  Labels: Record<string, string>;
+
+  ResourceControl?: ResourceControlViewModel;
+
+  constructor(data: PortainerResponse<Secret>) {
+    this.Id = data.ID || '';
+    this.CreatedAt = data.CreatedAt || '';
+    this.UpdatedAt = data.UpdatedAt || '';
+    this.Version = data.Version?.Index || 0;
+    this.Name = data.Spec?.Name || '';
+    this.Labels = data.Spec?.Labels || {};
+
+    if (data.Portainer?.ResourceControl) {
+      this.ResourceControl = new ResourceControlViewModel(
+        data.Portainer.ResourceControl
+      );
+    }
+  }
+}
diff --git a/app/docker/models/service.ts b/app/docker/models/service.ts
new file mode 100644
index 0000000..3dd72e9
--- /dev/null
+++ b/app/docker/models/service.ts
@@ -0,0 +1,267 @@
+import {
+  EndpointPortConfig,
+  HealthConfig,
+  Mount,
+  Platform,
+  Service,
+  ServiceSpec,
+  TaskSpec,
+} from 'docker-types';
+
+import { ResourceControlViewModel } from '@/react/portainer/access-control/models/ResourceControlViewModel';
+import { PortainerResponse } from '@/react/docker/types';
+
+import { TaskViewModel } from './task';
+
+type ContainerSpec = Required<TaskSpec>['ContainerSpec'];
+
+export type ServiceId = string;
+
+export class ServiceViewModel {
+  Model: Service;
+
+  Id: string;
+
+  Tasks: TaskViewModel[];
+
+  Name: string;
+
+  CreatedAt: string | undefined;
+
+  UpdatedAt: string | undefined;
+
+  Image: string | undefined;
+
+  Version: number | undefined;
+
+  Mode: string;
+
+  Replicas: number | undefined;
+
+  Running?: number;
+
+  LimitNanoCPUs: number | undefined;
+
+  LimitMemoryBytes: number | undefined;
+
+  ReservationNanoCPUs: number | undefined;
+
+  ReservationMemoryBytes: number | undefined;
+
+  RestartCondition: string;
+
+  RestartDelay: number;
+
+  RestartMaxAttempts: number;
+
+  RestartWindow: number;
+
+  LogDriverName: string;
+
+  LogDriverOpts: never[] | Record<string, string>;
+
+  Constraints: string[];
+
+  Preferences: {
+    Spread?: { SpreadDescriptor?: string | undefined } | undefined;
+  }[];
+
+  Platforms?: Array<Platform>;
+
+  Labels: Record<string, string> | undefined;
+
+  StackName?: string;
+
+  ContainerLabels: Record<string, string> | undefined;
+
+  Command: string[] | undefined;
+
+  Arguments: string[] | undefined;
+
+  Hostname: string | undefined;
+
+  Env: string[] | undefined;
+
+  Dir: string | undefined;
+
+  User: string | undefined;
+
+  Groups: string[] | undefined;
+
+  TTY: boolean | undefined;
+
+  OpenStdin: boolean | undefined;
+
+  ReadOnly: boolean | undefined;
+
+  Mounts?: Array<Mount>;
+
+  StopSignal: string | undefined;
+
+  StopGracePeriod: number | undefined;
+
+  HealthCheck?: HealthConfig;
+
+  Hosts: string[] | undefined;
+
+  DNSConfig?: ContainerSpec['DNSConfig'];
+
+  Secrets?: ContainerSpec['Secrets'];
+
+  Configs: ContainerSpec['Configs'];
+
+  Ports?: Array<EndpointPortConfig>;
+
+  LogDriver: TaskSpec['LogDriver'];
+
+  Runtime: string | undefined;
+
+  VirtualIPs:
+    | { NetworkID?: string | undefined; Addr?: string | undefined }[]
+    | undefined;
+
+  UpdateParallelism: number;
+
+  UpdateDelay: number;
+
+  UpdateFailureAction: string;
+
+  UpdateOrder: string;
+
+  RollbackConfig: ServiceSpec['RollbackConfig'];
+
+  Checked: boolean;
+
+  Scale: boolean;
+
+  EditName: boolean;
+
+  ResourceControl?: ResourceControlViewModel;
+
+  constructor(data: PortainerResponse<Service>) {
+    this.Model = data;
+    this.Id = data.ID || '';
+    this.Tasks = [];
+    this.Name = data.Spec?.Name || '';
+    this.CreatedAt = data.CreatedAt;
+    this.UpdatedAt = data.UpdatedAt;
+    this.Image = data.Spec?.TaskTemplate?.ContainerSpec?.Image;
+    this.Version = data.Version?.Index;
+    if (data.Spec?.Mode?.Replicated) {
+      this.Mode = 'replicated';
+      this.Replicas = data.Spec.Mode.Replicated.Replicas;
+    } else {
+      this.Mode = 'global';
+    }
+
+    if (data.Spec?.TaskTemplate?.Resources) {
+      if (data.Spec.TaskTemplate.Resources.Limits) {
+        this.LimitNanoCPUs = data.Spec.TaskTemplate.Resources.Limits.NanoCPUs;
+        this.LimitMemoryBytes =
+          data.Spec.TaskTemplate.Resources.Limits.MemoryBytes;
+      }
+      if (data.Spec.TaskTemplate.Resources.Reservations) {
+        this.ReservationNanoCPUs =
+          data.Spec.TaskTemplate.Resources.Reservations.NanoCPUs;
+        this.ReservationMemoryBytes =
+          data.Spec.TaskTemplate.Resources.Reservations.MemoryBytes;
+      }
+    }
+
+    if (data.Spec?.TaskTemplate?.RestartPolicy) {
+      this.RestartCondition =
+        data.Spec.TaskTemplate.RestartPolicy.Condition || 'any';
+      this.RestartDelay =
+        data.Spec.TaskTemplate.RestartPolicy.Delay || 5000000000;
+      this.RestartMaxAttempts =
+        data.Spec.TaskTemplate.RestartPolicy.MaxAttempts || 0;
+      this.RestartWindow = data.Spec.TaskTemplate.RestartPolicy.Window || 0;
+    } else {
+      this.RestartCondition = 'any';
+      this.RestartDelay = 5000000000;
+      this.RestartMaxAttempts = 0;
+      this.RestartWindow = 0;
+    }
+
+    if (data.Spec?.TaskTemplate?.LogDriver) {
+      this.LogDriverName = data.Spec.TaskTemplate.LogDriver.Name || '';
+      this.LogDriverOpts = data.Spec.TaskTemplate.LogDriver.Options || [];
+    } else {
+      this.LogDriverName = '';
+      this.LogDriverOpts = [];
+    }
+
+    this.Constraints = data.Spec?.TaskTemplate?.Placement
+      ? data.Spec.TaskTemplate.Placement.Constraints || []
+      : [];
+    this.Preferences = data.Spec?.TaskTemplate?.Placement
+      ? data.Spec.TaskTemplate.Placement.Preferences || []
+      : [];
+    this.Platforms = data.Spec?.TaskTemplate?.Placement?.Platforms || [];
+    this.Labels = data.Spec?.Labels;
+    if (this.Labels && this.Labels['com.docker.stack.namespace']) {
+      this.StackName = this.Labels['com.docker.stack.namespace'];
+    }
+
+    const containerSpec = data.Spec?.TaskTemplate?.ContainerSpec;
+    if (containerSpec) {
+      this.ContainerLabels = containerSpec.Labels;
+      this.Command = containerSpec.Command;
+      this.Arguments = containerSpec.Args;
+      this.Hostname = containerSpec.Hostname;
+      this.Env = containerSpec.Env;
+      this.Dir = containerSpec.Dir;
+      this.User = containerSpec.User;
+      this.Groups = containerSpec.Groups;
+      this.TTY = containerSpec.TTY;
+      this.OpenStdin = containerSpec.OpenStdin;
+      this.ReadOnly = containerSpec.ReadOnly;
+      this.Mounts = containerSpec.Mounts || [];
+      this.StopSignal = containerSpec.StopSignal;
+      this.StopGracePeriod = containerSpec.StopGracePeriod;
+      this.HealthCheck = containerSpec.HealthCheck || {};
+      this.Hosts = containerSpec.Hosts;
+      this.DNSConfig = containerSpec.DNSConfig;
+      this.Secrets = containerSpec.Secrets;
+      this.Configs = containerSpec.Configs;
+    }
+    if (data.Endpoint) {
+      this.Ports = data.Endpoint.Ports;
+    }
+
+    this.LogDriver = data.Spec?.TaskTemplate?.LogDriver;
+    this.Runtime = data.Spec?.TaskTemplate?.Runtime;
+
+    this.VirtualIPs = data.Endpoint ? data.Endpoint.VirtualIPs : [];
+
+    if (data.Spec?.UpdateConfig) {
+      this.UpdateParallelism =
+        typeof data.Spec.UpdateConfig.Parallelism !== 'undefined'
+          ? data.Spec.UpdateConfig.Parallelism || 0
+          : 1;
+      this.UpdateDelay = data.Spec.UpdateConfig.Delay || 0;
+      this.UpdateFailureAction =
+        data.Spec.UpdateConfig.FailureAction || 'pause';
+      this.UpdateOrder = data.Spec.UpdateConfig.Order || 'stop-first';
+    } else {
+      this.UpdateParallelism = 1;
+      this.UpdateDelay = 0;
+      this.UpdateFailureAction = 'pause';
+      this.UpdateOrder = 'stop-first';
+    }
+
+    this.RollbackConfig = data.Spec?.RollbackConfig;
+
+    this.Checked = false;
+    this.Scale = false;
+    this.EditName = false;
+
+    if (data.Portainer) {
+      if (data.Portainer.ResourceControl) {
+        this.ResourceControl = new ResourceControlViewModel(
+          data.Portainer.ResourceControl
+        );
+      }
+    }
+  }
+}
diff --git a/app/docker/models/task.ts b/app/docker/models/task.ts
new file mode 100644
index 0000000..889560e
--- /dev/null
+++ b/app/docker/models/task.ts
@@ -0,0 +1,38 @@
+import { Task } from 'docker-types';
+
+import { DeepPick } from '@/types/deepPick';
+
+export class TaskViewModel {
+  Id: NonNullable<Task['ID']>;
+
+  Created: NonNullable<Task['CreatedAt']>;
+
+  Updated: NonNullable<Task['UpdatedAt']>;
+
+  Slot: NonNullable<Task['Slot']>;
+
+  Spec?: Task['Spec'];
+
+  Status?: Task['Status'];
+
+  DesiredState: NonNullable<Task['DesiredState']>;
+
+  ServiceId: NonNullable<Task['ServiceID']>;
+
+  NodeId: NonNullable<Task['NodeID']>;
+
+  ContainerId: DeepPick<Task, 'Status.ContainerStatus.ContainerID'>;
+
+  constructor(data: Task) {
+    this.Id = data.ID || '';
+    this.Created = data.CreatedAt || '';
+    this.Updated = data.UpdatedAt || '';
+    this.Slot = data.Slot || 0;
+    this.Spec = data.Spec;
+    this.Status = data.Status;
+    this.DesiredState = data.DesiredState || 'pending';
+    this.ServiceId = data.ServiceID || '';
+    this.NodeId = data.NodeID || '';
+    this.ContainerId = data.Status?.ContainerStatus?.ContainerID || '';
+  }
+}
diff --git a/app/docker/models/volume.ts b/app/docker/models/volume.ts
new file mode 100644
index 0000000..4b9fe84
--- /dev/null
+++ b/app/docker/models/volume.ts
@@ -0,0 +1,63 @@
+import { Volume } from 'docker-types';
+
+import { ResourceControlViewModel } from '@/react/portainer/access-control/models/ResourceControlViewModel';
+import { IResource } from '@/react/docker/components/datatable/createOwnershipColumn';
+import { PortainerResponse } from '@/react/docker/types';
+
+export class VolumeViewModel implements IResource {
+  Id: string;
+
+  Name: Volume['Name'];
+
+  CreatedAt?: Volume['CreatedAt'];
+
+  Driver: Volume['Driver'];
+
+  Options: Volume['Options'];
+
+  Labels: Volume['Labels'];
+
+  Mountpoint: Volume['Mountpoint'];
+
+  // Portainer properties
+
+  ResourceId?: string;
+
+  NodeName?: string;
+
+  StackName?: string;
+
+  ResourceControl?: ResourceControlViewModel;
+
+  constructor(data: PortainerResponse<Volume> & { ResourceID?: string }) {
+    this.Name = data.Name;
+    this.CreatedAt = data.CreatedAt;
+    this.Driver = data.Driver;
+    this.Options = data.Options;
+    this.Labels = data.Labels;
+    if (this.Labels && this.Labels['com.docker.compose.project']) {
+      this.StackName = this.Labels['com.docker.compose.project'];
+    } else if (this.Labels && this.Labels['com.docker.stack.namespace']) {
+      this.StackName = this.Labels['com.docker.stack.namespace'];
+    }
+    this.Mountpoint = data.Mountpoint;
+
+    this.ResourceId = data.ResourceID;
+
+    if (data.Portainer) {
+      if (data.Portainer.ResourceControl) {
+        this.ResourceControl = new ResourceControlViewModel(
+          data.Portainer.ResourceControl
+        );
+      }
+      if (data.Portainer.Agent && data.Portainer.Agent.NodeName) {
+        this.NodeName = data.Portainer.Agent.NodeName;
+      }
+    }
+
+    this.Id = data.Name;
+    if (this.NodeName) {
+      this.Id = `${data.Name}-${this.NodeName}`;
+    }
+  }
+}
diff --git a/app/docker/react/components/containers.ts b/app/docker/react/components/containers.ts
new file mode 100644
index 0000000..31da495
--- /dev/null
+++ b/app/docker/react/components/containers.ts
@@ -0,0 +1,6 @@
+import angular from 'angular';
+
+export const containersModule = angular.module(
+  'portainer.docker.react.components.containers',
+  []
+).name;
diff --git a/app/docker/react/components/index.ts b/app/docker/react/components/index.ts
new file mode 100644
index 0000000..df6aa7c
--- /dev/null
+++ b/app/docker/react/components/index.ts
@@ -0,0 +1,114 @@
+import angular from 'angular';
+
+import { r2a } from '@/react-tools/react2angular';
+import { withControlledInput } from '@/react-tools/withControlledInput';
+import { withCurrentUser } from '@/react-tools/withCurrentUser';
+import { withReactQuery } from '@/react-tools/withReactQuery';
+import { withUIRouter } from '@/react-tools/withUIRouter';
+import { DockerfileDetails } from '@/react/docker/images/ItemView/DockerfileDetails';
+import { HealthStatus } from '@/react/docker/containers/ItemView/HealthStatus';
+import { GpusList } from '@/react/docker/host/SetupView/GpusList';
+import { InsightsBox } from '@/react/components/InsightsBox';
+import { BetaAlert } from '@/react/portainer/environments/update-schedules/common/BetaAlert';
+import { EventsDatatable } from '@/react/docker/events/EventsDatatables';
+import { AgentHostBrowser } from '@/react/docker/host/BrowseView/AgentHostBrowser';
+import { AgentVolumeBrowser } from '@/react/docker/volumes/BrowseView/AgentVolumeBrowser';
+import { ProcessesDatatable } from '@/react/docker/containers/StatsView/ProcessesDatatable';
+import { SecretsDatatable } from '@/react/docker/secrets/ListView/SecretsDatatable';
+import { StacksDatatable } from '@/react/docker/stacks/ListView/StacksDatatable';
+import { HostDetailsPanel } from '@/react/docker/host/HostDetailsPanel/HostDetailsPanel';
+
+import { containersModule } from './containers';
+import { servicesModule } from './services';
+import { networksModule } from './networks';
+import { swarmModule } from './swarm';
+import { volumesModule } from './volumes';
+import { templatesModule } from './templates';
+
+const ngModule = angular
+  .module('portainer.docker.react.components', [
+    containersModule,
+    servicesModule,
+    networksModule,
+    swarmModule,
+    volumesModule,
+    templatesModule,
+  ])
+  .component('dockerfileDetails', r2a(DockerfileDetails, ['image']))
+  .component('dockerHealthStatus', r2a(HealthStatus, ['health']))
+  .component(
+    'gpusList',
+    r2a(withControlledInput(GpusList), ['value', 'onChange'])
+  )
+  .component(
+    'insightsBox',
+    r2a(InsightsBox, [
+      'header',
+      'content',
+      'insightCloseId',
+      'type',
+      'className',
+    ])
+  )
+  .component('betaAlert', r2a(BetaAlert, ['className', 'message', 'isHtml']))
+  .component(
+    'agentHostBrowserReact',
+    r2a(withUIRouter(withCurrentUser(AgentHostBrowser)), [
+      'dataset',
+      'isRoot',
+      'onBrowse',
+      'onDelete',
+      'onDownload',
+      'onFileSelectedForUpload',
+      'onGoToParent',
+      'onRename',
+      'relativePath',
+    ])
+  )
+  .component(
+    'agentVolumeBrowserReact',
+    r2a(withUIRouter(withCurrentUser(AgentVolumeBrowser)), [
+      'dataset',
+      'isRoot',
+      'isUploadAllowed',
+      'onBrowse',
+      'onDelete',
+      'onDownload',
+      'onFileSelectedForUpload',
+      'onGoToParent',
+      'onRename',
+      'relativePath',
+    ])
+  )
+  .component(
+    'dockerContainerProcessesDatatable',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(ProcessesDatatable))), [])
+  )
+  .component('dockerEventsDatatable', r2a(EventsDatatable, ['dataset']))
+  .component(
+    'dockerSecretsDatatable',
+    r2a(withUIRouter(withCurrentUser(SecretsDatatable)), [
+      'dataset',
+      'onRefresh',
+      'onRemove',
+    ])
+  )
+  .component(
+    'dockerStacksDatatable',
+    r2a(withUIRouter(withCurrentUser(StacksDatatable)), [
+      'dataset',
+      'isImageNotificationEnabled',
+      'onReload',
+      'onRemove',
+    ])
+  )
+  .component(
+    'hostDetailsPanel',
+    r2a(withUIRouter(withReactQuery(HostDetailsPanel)), [
+      'host',
+      'isBrowseEnabled',
+      'browseUrl',
+      'endpointId',
+    ])
+  );
+export const componentsModule = ngModule.name;
diff --git a/app/docker/react/components/networks.ts b/app/docker/react/components/networks.ts
new file mode 100644
index 0000000..eb6b4e7
--- /dev/null
+++ b/app/docker/react/components/networks.ts
@@ -0,0 +1,18 @@
+import angular from 'angular';
+
+import { r2a } from '@/react-tools/react2angular';
+import { MacvlanNodesSelector } from '@/react/docker/networks/CreateView/MacvlanNodesSelector/MacvlanNodesSelector';
+import { withUIRouter } from '@/react-tools/withUIRouter';
+
+export const networksModule = angular
+  .module('portainer.docker.react.components.networks', [])
+  .component(
+    'macvlanNodesSelector',
+    r2a(withUIRouter(MacvlanNodesSelector), [
+      'dataset',
+      'isIpColumnVisible',
+      'haveAccessToNode',
+      'value',
+      'onChange',
+    ])
+  ).name;
diff --git a/app/docker/react/components/services.ts b/app/docker/react/components/services.ts
new file mode 100644
index 0000000..d5abd06
--- /dev/null
+++ b/app/docker/react/components/services.ts
@@ -0,0 +1,46 @@
+import angular from 'angular';
+import { SchemaOf } from 'yup';
+
+import { r2a } from '@/react-tools/react2angular';
+import { withUIRouter } from '@/react-tools/withUIRouter';
+import { withCurrentUser } from '@/react-tools/withCurrentUser';
+import { ServicesDatatable } from '@/react/docker/services/ListView/ServicesDatatable';
+import { TasksDatatable } from '@/react/docker/services/ItemView/TasksDatatable';
+import {
+  PortsMappingField,
+  portsMappingUtils,
+  PortsMappingValues,
+} from '@/react/docker/services/ItemView/PortMappingField';
+import { withFormValidation } from '@/react-tools/withFormValidation';
+
+const ngModule = angular
+  .module('portainer.docker.react.components.services', [])
+  .component(
+    'dockerServiceTasksDatatable',
+    r2a(withUIRouter(withCurrentUser(TasksDatatable)), [
+      'serviceName',
+      'dataset',
+      'isSlotColumnVisible',
+    ])
+  )
+  .component(
+    'dockerServicesDatatable',
+    r2a(withUIRouter(withCurrentUser(ServicesDatatable)), [
+      'dataset',
+      'isAddActionVisible',
+      'isStackColumnVisible',
+      'onRefresh',
+      'titleIcon',
+      'tableKey',
+    ])
+  );
+
+export const servicesModule = ngModule.name;
+
+withFormValidation(
+  ngModule,
+  withUIRouter(withCurrentUser(PortsMappingField)),
+  'dockerServicePortsMappingField',
+  ['disabled', 'readOnly', 'hasChanges', 'onReset', 'onSubmit'],
+  portsMappingUtils.validation as unknown as () => SchemaOf<PortsMappingValues>
+);
diff --git a/app/docker/react/components/swarm.ts b/app/docker/react/components/swarm.ts
new file mode 100644
index 0000000..b96f9a6
--- /dev/null
+++ b/app/docker/react/components/swarm.ts
@@ -0,0 +1,17 @@
+import angular from 'angular';
+
+import { r2a } from '@/react-tools/react2angular';
+import { withUIRouter } from '@/react-tools/withUIRouter';
+import { NodesDatatable } from '@/react/docker/swarm/SwarmView/NodesDatatable';
+
+export const swarmModule = angular
+  .module('portainer.docker.react.components.swarm', [])
+  .component(
+    'nodesDatatable',
+    r2a(withUIRouter(NodesDatatable), [
+      'dataset',
+      'isIpColumnVisible',
+      'haveAccessToNode',
+      'onRefresh',
+    ])
+  ).name;
diff --git a/app/docker/react/components/templates.ts b/app/docker/react/components/templates.ts
new file mode 100644
index 0000000..f92e1a5
--- /dev/null
+++ b/app/docker/react/components/templates.ts
@@ -0,0 +1,6 @@
+import angular from 'angular';
+
+export const templatesModule = angular.module(
+  'portainer.docker.react.components.templates',
+  []
+).name;
diff --git a/app/docker/react/components/volumes.ts b/app/docker/react/components/volumes.ts
new file mode 100644
index 0000000..994e9ec
--- /dev/null
+++ b/app/docker/react/components/volumes.ts
@@ -0,0 +1,18 @@
+import angular from 'angular';
+
+import { r2a } from '@/react-tools/react2angular';
+import { withUIRouter } from '@/react-tools/withUIRouter';
+import { VolumesDatatable } from '@/react/docker/volumes/ListView/VolumesDatatable';
+import { withCurrentUser } from '@/react-tools/withCurrentUser';
+
+export const volumesModule = angular
+  .module('portainer.docker.react.components.volumes', [])
+  .component(
+    'volumesDatatable',
+    r2a(withUIRouter(withCurrentUser(VolumesDatatable)), [
+      'dataset',
+      'onRemove',
+      'onRefresh',
+      'isBrowseVisible',
+    ])
+  ).name;
diff --git a/app/docker/react/index.ts b/app/docker/react/index.ts
new file mode 100644
index 0000000..47b1009
--- /dev/null
+++ b/app/docker/react/index.ts
@@ -0,0 +1,9 @@
+import angular from 'angular';
+
+import { componentsModule } from './components';
+import { viewsModule } from './views';
+
+export const reactModule = angular.module('portainer.docker.react', [
+  viewsModule,
+  componentsModule,
+]).name;
diff --git a/app/docker/react/views/configs.ts b/app/docker/react/views/configs.ts
new file mode 100644
index 0000000..17ef0c0
--- /dev/null
+++ b/app/docker/react/views/configs.ts
@@ -0,0 +1,14 @@
+import angular from 'angular';
+
+import { r2a } from '@/react-tools/react2angular';
+import { withCurrentUser } from '@/react-tools/withCurrentUser';
+import { withReactQuery } from '@/react-tools/withReactQuery';
+import { withUIRouter } from '@/react-tools/withUIRouter';
+import { ListView } from '@/react/docker/configs/ListView/ListView';
+
+export const configsModule = angular
+  .module('portainer.docker.react.views.configs', [])
+  .component(
+    'configsListView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(ListView))), [])
+  ).name;
diff --git a/app/docker/react/views/containers.ts b/app/docker/react/views/containers.ts
new file mode 100644
index 0000000..442a726
--- /dev/null
+++ b/app/docker/react/views/containers.ts
@@ -0,0 +1,132 @@
+import { StateRegistry } from '@uirouter/angularjs';
+import angular from 'angular';
+
+import { r2a } from '@/react-tools/react2angular';
+import { ListView } from '@/react/docker/containers/ListView';
+import { withCurrentUser } from '@/react-tools/withCurrentUser';
+import { withReactQuery } from '@/react-tools/withReactQuery';
+import { withUIRouter } from '@/react-tools/withUIRouter';
+import { LogView } from '@/react/docker/containers/LogView';
+import { CreateView } from '@/react/docker/containers/CreateView';
+import { InspectView } from '@/react/docker/containers/InspectView/InspectView';
+import { ItemView } from '@/react/docker/containers/ItemView/ItemView';
+
+export const containersModule = angular
+  .module('portainer.docker.react.views.containers', [])
+  .component(
+    'createContainerView',
+    r2a(withUIRouter(withCurrentUser(CreateView)), [])
+  )
+  .component(
+    'containersView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(ListView))), ['endpoint'])
+  )
+  .component(
+    'containerItemView',
+    r2a(withUIRouter(withCurrentUser(ItemView)), [])
+  )
+  // the view only contains the information panel when logging is disabled
+  // this is a temporary solution to avoid creating a publicly exposed component
+  // or an AngularJS component until the logs view is migrated to React
+  .component(
+    'containerLogView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(LogView))), [])
+  )
+  .component(
+    'dockerContainerInspectView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(InspectView))), [])
+  )
+  .config(config).name;
+
+/* @ngInject */
+function config($stateRegistryProvider: StateRegistry) {
+  $stateRegistryProvider.register({
+    name: 'docker.containers',
+    url: '/containers',
+    views: {
+      'content@': {
+        component: 'containersView',
+      },
+    },
+    data: {
+      docs: '/user/docker/containers',
+    },
+  });
+
+  $stateRegistryProvider.register({
+    name: 'docker.containers.container',
+    url: '/:id?nodeName',
+    views: {
+      'content@': {
+        component: 'containerItemView',
+      },
+    },
+  });
+
+  $stateRegistryProvider.register({
+    name: 'docker.containers.container.attach',
+    url: '/attach',
+    views: {
+      'content@': {
+        templateUrl: '~@/docker/views/containers/console/attach.html',
+        controller: 'ContainerConsoleController',
+      },
+    },
+  });
+
+  $stateRegistryProvider.register({
+    name: 'docker.containers.container.exec',
+    url: '/exec',
+    views: {
+      'content@': {
+        templateUrl: '~@/docker/views/containers/console/exec.html',
+        controller: 'ContainerConsoleController',
+      },
+    },
+  });
+
+  $stateRegistryProvider.register({
+    name: 'docker.containers.new',
+    url: '/new?nodeName&from',
+    views: {
+      'content@': {
+        component: 'createContainerView',
+      },
+    },
+    data: {
+      docs: '/user/docker/containers/add',
+    },
+  });
+
+  $stateRegistryProvider.register({
+    name: 'docker.containers.container.inspect',
+    url: '/inspect',
+    views: {
+      'content@': {
+        component: 'dockerContainerInspectView',
+      },
+    },
+  });
+
+  $stateRegistryProvider.register({
+    name: 'docker.containers.container.logs',
+    url: '/logs',
+    views: {
+      'content@': {
+        templateUrl: '~@/docker/views/containers/logs/containerlogs.html',
+        controller: 'ContainerLogsController',
+      },
+    },
+  });
+
+  $stateRegistryProvider.register({
+    name: 'docker.containers.container.stats',
+    url: '/stats',
+    views: {
+      'content@': {
+        templateUrl: '~@/docker/views/containers/stats/containerstats.html',
+        controller: 'ContainerStatsController',
+      },
+    },
+  });
+}
diff --git a/app/docker/react/views/images.ts b/app/docker/react/views/images.ts
new file mode 100644
index 0000000..c486c11
--- /dev/null
+++ b/app/docker/react/views/images.ts
@@ -0,0 +1,13 @@
+import angular from 'angular';
+
+import { r2a } from '@/react-tools/react2angular';
+import { withCurrentUser } from '@/react-tools/withCurrentUser';
+import { withUIRouter } from '@/react-tools/withUIRouter';
+import { ListView } from '@/react/docker/images/ListView/ListView';
+
+export const imagesModule = angular
+  .module('portainer.docker.react.views.images', [])
+  .component(
+    'imagesListView',
+    r2a(withUIRouter(withCurrentUser(ListView)), [])
+  ).name;
diff --git a/app/docker/react/views/index.ts b/app/docker/react/views/index.ts
new file mode 100644
index 0000000..67d3ac6
--- /dev/null
+++ b/app/docker/react/views/index.ts
@@ -0,0 +1,32 @@
+import angular from 'angular';
+
+import { ItemView as NetworksItemView } from '@/react/docker/networks/ItemView';
+import { r2a } from '@/react-tools/react2angular';
+import { withCurrentUser } from '@/react-tools/withCurrentUser';
+import { withUIRouter } from '@/react-tools/withUIRouter';
+import { DashboardView } from '@/react/docker/DashboardView/DashboardView';
+import { ListView } from '@/react/docker/events/ListView';
+
+import { containersModule } from './containers';
+import { configsModule } from './configs';
+import { imagesModule } from './images';
+import { stacksModule } from './stacks';
+import { networksModule } from './networks';
+
+export const viewsModule = angular
+  .module('portainer.docker.react.views', [
+    containersModule,
+    configsModule,
+    imagesModule,
+    stacksModule,
+    networksModule,
+  ])
+  .component(
+    'dockerDashboardView',
+    r2a(withUIRouter(withCurrentUser(DashboardView)), [])
+  )
+  .component('eventsListView', r2a(withUIRouter(withCurrentUser(ListView)), []))
+  .component(
+    'networkDetailsView',
+    r2a(withUIRouter(withCurrentUser(NetworksItemView)), [])
+  ).name;
diff --git a/app/docker/react/views/networks.ts b/app/docker/react/views/networks.ts
new file mode 100644
index 0000000..d7d6c11
--- /dev/null
+++ b/app/docker/react/views/networks.ts
@@ -0,0 +1,13 @@
+import angular from 'angular';
+
+import { r2a } from '@/react-tools/react2angular';
+import { withCurrentUser } from '@/react-tools/withCurrentUser';
+import { withUIRouter } from '@/react-tools/withUIRouter';
+import { ListView } from '@/react/docker/networks/ListView/ListView';
+
+export const networksModule = angular
+  .module('portainer.docker.react.views.networks', [])
+  .component(
+    'networksListView',
+    r2a(withUIRouter(withCurrentUser(ListView)), [])
+  ).name;
diff --git a/app/docker/react/views/stacks.ts b/app/docker/react/views/stacks.ts
new file mode 100644
index 0000000..741a95f
--- /dev/null
+++ b/app/docker/react/views/stacks.ts
@@ -0,0 +1,19 @@
+import angular from 'angular';
+
+import { r2a } from '@/react-tools/react2angular';
+import { withCurrentUser } from '@/react-tools/withCurrentUser';
+import { withReactQuery } from '@/react-tools/withReactQuery';
+import { withUIRouter } from '@/react-tools/withUIRouter';
+import { ItemView } from '@/react/docker/stacks/ItemView/ItemView';
+import { CreateView } from '@/react/docker/stacks/CreateView/CreateView';
+
+export const stacksModule = angular
+  .module('portainer.docker.stacks', [])
+  .component(
+    'stackItemView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(ItemView))), [])
+  )
+  .component(
+    'createStackView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(CreateView))), [])
+  ).name;
diff --git a/app/docker/services/buildService.js b/app/docker/services/buildService.js
new file mode 100644
index 0000000..7cf41a9
--- /dev/null
+++ b/app/docker/services/buildService.js
@@ -0,0 +1,65 @@
+import {
+  buildImageFromDockerfileContent,
+  buildImageFromDockerfileContentAndFiles,
+  buildImageFromURL,
+  buildImageFromUpload,
+} from '@/react/docker/images/queries/useBuildImageMutation';
+
+import { ImageBuildModel } from '../models/build';
+
+angular.module('portainer.docker').factory('BuildService', BuildServiceFactory);
+
+/* @ngInject */
+function BuildServiceFactory(AngularToReact) {
+  const { useAxios } = AngularToReact;
+
+  return {
+    buildImageFromUpload: useAxios(buildImageFromUploadAngularJS), // build image
+    buildImageFromURL: useAxios(buildImageFromURLAngularJS), // build image
+    buildImageFromDockerfileContent: useAxios(buildImageFromDockerfileContentAngularJS), // build image
+    buildImageFromDockerfileContentAndFiles: useAxios(buildImageFromDockerfileContentAndFilesAngularJS), // build image
+  };
+
+  /**
+   * @param {EnvironmentId} environmentId
+   * @param {string[]} names
+   * @param {File} file
+   * @param {string} path
+   */
+  async function buildImageFromUploadAngularJS(environmentId, names, file, path) {
+    const data = await buildImageFromUpload(environmentId, names, file, path);
+    return new ImageBuildModel(data);
+  }
+
+  /**
+   * @param {EnvironmentId} environmentId
+   * @param {string[]} names
+   * @param {string} url
+   * @param {string} path
+   */
+  async function buildImageFromURLAngularJS(environmentId, names, url, path) {
+    const data = await buildImageFromURL(environmentId, names, url, path);
+    return new ImageBuildModel(data);
+  }
+
+  /**
+   * @param {EnvironmentId} environmentId
+   * @param {string[]} names
+   * @param {string} content
+   */
+  async function buildImageFromDockerfileContentAngularJS(environmentId, names, content) {
+    const data = await buildImageFromDockerfileContent(environmentId, names, content);
+    return new ImageBuildModel(data);
+  }
+
+  /**
+   * @param {EnvironmentId} environmentId
+   * @param {string[]} names
+   * @param {string} content
+   * @param {File[]} files
+   */
+  async function buildImageFromDockerfileContentAndFilesAngularJS(environmentId, names, content, files) {
+    const data = await buildImageFromDockerfileContentAndFiles(environmentId, names, content, files);
+    return new ImageBuildModel(data);
+  }
+}
diff --git a/app/docker/services/configService.js b/app/docker/services/configService.js
new file mode 100644
index 0000000..215841d
--- /dev/null
+++ b/app/docker/services/configService.js
@@ -0,0 +1,37 @@
+import { getConfig } from '@/react/docker/configs/queries/useConfig';
+import { getConfigs } from '@/react/docker/configs/queries/useConfigs';
+
+import { deleteConfig } from '@/react/docker/configs/queries/useDeleteConfigMutation';
+import { createConfig } from '@/react/docker/configs/queries/useCreateConfigMutation';
+import { ConfigViewModel } from '@/react/docker/configs/model';
+
+angular.module('portainer.docker').factory('ConfigService', ConfigServiceFactory);
+
+/* @ngInspect */
+function ConfigServiceFactory(AngularToReact) {
+  const { useAxios } = AngularToReact;
+
+  return {
+    configs: useAxios(listConfigsAngularJS), // config list + service create + service edit
+    config: useAxios(getConfigAngularJS), // config create + config edit
+    remove: useAxios(deleteConfig), // config list + config edit
+    create: useAxios(createConfig), // config create
+  };
+
+  /**
+   * @param {EnvironmentId} environmentId
+   */
+  async function listConfigsAngularJS(environmentId) {
+    const data = await getConfigs(environmentId);
+    return data.map((c) => new ConfigViewModel(c));
+  }
+
+  /**
+   * @param {EnvironmentId} environmentId
+   * @param {ConfigId} configId
+   */
+  async function getConfigAngularJS(environmentId, configId) {
+    const data = await getConfig(environmentId, configId);
+    return new ConfigViewModel(data);
+  }
+}
diff --git a/app/docker/services/containerService.js b/app/docker/services/containerService.js
new file mode 100644
index 0000000..2e284be
--- /dev/null
+++ b/app/docker/services/containerService.js
@@ -0,0 +1,118 @@
+import angular from 'angular';
+import {
+  killContainer,
+  pauseContainer,
+  removeContainer,
+  renameContainer,
+  restartContainer,
+  resumeContainer,
+  startContainer,
+  stopContainer,
+  recreateContainer,
+  getContainerLogs,
+} from '@/react/docker/containers/containers.service';
+import { getContainers } from '@/react/docker/containers/queries/useContainers';
+import { getContainer } from '@/react/docker/containers/queries/useContainer';
+import { resizeTTY } from '@/react/docker/containers/queries/useContainerResizeTTYMutation';
+import { updateContainer } from '@/react/docker/containers/queries/useUpdateContainer';
+import { createExec } from '@/react/docker/containers/queries/useCreateExecMutation';
+import { containerStats } from '@/react/docker/containers/queries/useContainerStats';
+import { getContainerTop } from '@/react/docker/containers/queries/useContainerTop';
+
+import { ContainerDetailsViewModel } from '../models/containerDetails';
+import { ContainerStatsViewModel } from '../models/containerStats';
+import { formatLogs } from '../helpers/logHelper';
+
+angular.module('portainer.docker').factory('ContainerService', ContainerServiceFactory);
+
+/* @ngInject */
+function ContainerServiceFactory(AngularToReact) {
+  const { useAxios } = AngularToReact;
+
+  return {
+    killContainer: useAxios(killContainer), // container edit
+    pauseContainer: useAxios(pauseContainer), // container edit
+    renameContainer: useAxios(renameContainer), // container edit
+    restartContainer: useAxios(restartContainer), // container edit
+    resumeContainer: useAxios(resumeContainer), // container edit
+    startContainer: useAxios(startContainer), // container edit
+    stopContainer: useAxios(stopContainer), // container edit
+    recreateContainer: useAxios(recreateContainer), // container edit
+    remove: useAxios(removeContainer), // container edit
+    container: useAxios(getContainerAngularJS), // container console  + container edit + container stats
+    containers: useAxios(getContainers), // dashboard + services list + service edit + voluem edit + stackservice + stack create + stack edit
+    resizeTTY: useAxios(resizeTTYAngularJS), // container console
+    updateRestartPolicy: useAxios(updateRestartPolicyAngularJS), // container edit
+    createExec: useAxios(createExec), // container console
+    containerStats: useAxios(containerStatsAngularJS), // container stats
+    containerTop: useAxios(getContainerTop), // container stats
+    inspect: useAxios(getContainer), // container inspect
+    logs: useAxios(containerLogsAngularJS), // container logs
+  };
+
+  /**
+   * @param {EnvironmentId} environmentId
+   * @param {ContainerId} id
+   * @param {*} param2
+   */
+  async function getContainerAngularJS(environmentId, id, { nodeName } = {}) {
+    const data = await getContainer(environmentId, id, { nodeName });
+    return new ContainerDetailsViewModel(data);
+  }
+
+  /**
+   * @param {EnvironmentId} environmentId
+   * @param {string} containerId
+   * @param {number} width
+   * @param {number} height
+   * @param timeout DEPRECATED: Previously used in pure AJS implementation
+   */
+  async function resizeTTYAngularJS(environmentId, containerId, width, height) {
+    return resizeTTY(environmentId, containerId, { width, height });
+  }
+
+  /**
+   * @param {EnvironmentId} environmentId
+   * @param {ContainerId} id
+   * @param {RestartPolicy['Name']} restartPolicy
+   * @param {RestartPolicy['MaximumRetryCount']} maximumRetryCounts
+   */
+  async function updateRestartPolicyAngularJS(environmentId, id, restartPolicy, maximumRetryCounts) {
+    return updateContainer(environmentId, id, {
+      RestartPolicy: {
+        Name: restartPolicy,
+        MaximumRetryCount: maximumRetryCounts,
+      },
+    });
+  }
+
+  /**
+   * @param {EnvironmentId} environmentId
+   * @param {ContainerId} id
+   */
+  async function containerStatsAngularJS(environmentId, id) {
+    const data = await containerStats(environmentId, id);
+    return new ContainerStatsViewModel(data);
+  }
+
+  /**
+   * @param {EnvironmentId} environmentId
+   * @param {Containerid} id
+   * @param {boolean?} stdout
+   * @param {boolean?} stderr
+   * @param {boolean?} timestamps
+   * @param {number?} since
+   * @param {number?} tail
+   * @param {boolean?} stripHeaders
+   */
+  async function containerLogsAngularJS(environmentId, id, stdout = false, stderr = false, timestamps = false, since = 0, tail = 'all', stripHeaders) {
+    const data = await getContainerLogs(environmentId, id, {
+      since,
+      stderr,
+      stdout,
+      tail,
+      timestamps,
+    });
+    return formatLogs(data, { stripHeaders, withTimestamps: !!timestamps });
+  }
+}
diff --git a/app/docker/services/execService.js b/app/docker/services/execService.js
new file mode 100644
index 0000000..8bc6cd4
--- /dev/null
+++ b/app/docker/services/execService.js
@@ -0,0 +1,23 @@
+import { resizeTTY } from '@/react/docker/proxy/queries/useExecResizeTTYMutation';
+
+angular.module('portainer.docker').factory('ExecService', ExecServiceFactory);
+
+/* @ngInject */
+function ExecServiceFactory(AngularToReact) {
+  const { useAxios, injectEnvironmentId } = AngularToReact;
+
+  return {
+    resizeTTY: useAxios(injectEnvironmentId(resizeTTYAngularJS)),
+  };
+
+  /**
+   * @param {EnvironmentId} environmentId Injected
+   * @param {string} execId
+   * @param {number} width
+   * @param {number} height
+   * @param timeout DEPRECATED: Previously used in pure AJS implementation
+   */
+  async function resizeTTYAngularJS(environmentId, execId, width, height) {
+    return resizeTTY(environmentId, execId, { width, height });
+  }
+}
diff --git a/app/docker/services/imageService.js b/app/docker/services/imageService.js
new file mode 100644
index 0000000..539fe64
--- /dev/null
+++ b/app/docker/services/imageService.js
@@ -0,0 +1,91 @@
+import { groupBy } from 'lodash';
+
+import { getUniqueTagListFromImages } from '@/react/docker/images/utils';
+import { getImage } from '@/react/docker/proxy/queries/images/useImage';
+import { parseAxiosError } from '@/react/portainer/services/axios/axios';
+import { getImages } from '@/react/docker/proxy/queries/images/useImages';
+import { getContainers } from '@/react/docker/containers/queries/useContainers';
+import { getImageHistory } from '@/react/docker/proxy/queries/images/useImageHistory';
+import { pullImage } from '@/react/docker/images/queries/usePullImageMutation';
+import { pushImage } from '@/react/docker/images/queries/usePushImageMutation';
+import { removeImage } from '@/react/docker/proxy/queries/images/useRemoveImageMutation';
+import { tagImage } from '@/react/docker/proxy/queries/images/useTagImageMutation';
+import { downloadImages } from '@/react/docker/proxy/queries/images/useDownloadImages';
+import { uploadImages } from '@/react/docker/proxy/queries/images/useUploadImageMutation';
+
+import { ImageViewModel } from '../models/image';
+import { ImageDetailsViewModel } from '../models/imageDetails';
+import { ImageLayerViewModel } from '../models/imageLayer';
+
+angular.module('portainer.docker').factory('ImageService', ImageServiceFactory);
+
+/* @ngInject */
+function ImageServiceFactory(AngularToReact) {
+  const { useAxios, injectEnvironmentId } = AngularToReact;
+
+  return {
+    image: useAxios(injectEnvironmentId(imageAngularJS)), // container console + image edit
+    images: useAxios(injectEnvironmentId(imagesAngularJS)), // por image registry controller + dashboard + service edit
+    history: useAxios(injectEnvironmentId(historyAngularJS)), // image edit
+    pushImage: useAxios(injectEnvironmentId(pushImageAngularJS)), // image edit
+    pullImage: useAxios(injectEnvironmentId(pullImageAngularJS)), // images list + image edit + templates list
+    tagImage: useAxios(injectEnvironmentId(tagImage)), // image edit + image import
+    downloadImages: useAxios(injectEnvironmentId(downloadImages)), // image list + image edit
+    uploadImage: useAxios(injectEnvironmentId(uploadImages)), // image import
+    deleteImage: useAxios(injectEnvironmentId(removeImage)), // image list + image edit
+    getUniqueTagListFromImages, // por image registry controller + service edit
+  };
+
+  async function imageAngularJS(environmentId, imageId) {
+    const image = await getImage(environmentId, imageId);
+    return new ImageDetailsViewModel(image);
+  }
+
+  async function imagesAngularJS(environmentId, withUsage) {
+    try {
+      const [containers, images] = await Promise.all([withUsage ? getContainers(environmentId) : [], getImages(environmentId)]);
+      const containerByImageId = groupBy(containers, 'ImageID');
+      return images.map((item) => new ImageViewModel(item, !!containerByImageId[item.Id] && containerByImageId[item.Id].length > 0));
+    } catch (e) {
+      throw parseAxiosError(e, 'Unable to retrieve images');
+    }
+  }
+
+  async function historyAngularJS(environmentId, imageId) {
+    try {
+      const layers = await getImageHistory(environmentId, imageId);
+      return layers.reverse().map((layer, idx) => new ImageLayerViewModel(idx, layer));
+    } catch (e) {
+      throw parseAxiosError(e, 'Unable to retrieve image history');
+    }
+  }
+
+  /**
+   * type PorImageRegistryModel = {
+   *   UseRegistry: bool;
+   *   Registry?: Registry;
+   *   Image: string;
+   * }
+   */
+
+  /**
+   * @param {EnvironmentId} environmentId Autofilled by AngularToReact
+   * @param {PorImageRegistryModel} registryModel
+   */
+  async function pushImageAngularJS(environmentId, registryModel) {
+    const { UseRegistry, Registry, Image } = registryModel;
+    const registry = UseRegistry ? Registry : undefined;
+    return pushImage({ environmentId, image: Image, registry });
+  }
+
+  /**
+   * @param {EnvironmentId} environmentId Autofilled by AngularToReact
+   * @param {PorImageRegistryModel} registryModel
+   * @param {string?} nodeName
+   */
+  async function pullImageAngularJS(environmentId, registryModel, nodeName) {
+    const { UseRegistry, Registry, Image } = registryModel;
+    const registry = UseRegistry ? Registry : undefined;
+    return pullImage({ environmentId, image: Image, nodeName, registry });
+  }
+}
diff --git a/app/docker/services/networkService.js b/app/docker/services/networkService.js
new file mode 100644
index 0000000..dc407d4
--- /dev/null
+++ b/app/docker/services/networkService.js
@@ -0,0 +1,55 @@
+import { createNetwork } from '@/react/docker/networks/queries/useCreateNetworkMutation';
+import { getNetwork } from '@/react/docker/networks/queries/useNetwork';
+import { getNetworks } from '@/react/docker/networks/queries/useNetworks';
+import { deleteNetwork } from '@/react/docker/networks/queries/useDeleteNetworkMutation';
+import { connectContainer } from '@/react/docker/networks/queries/useConnectContainerMutation';
+
+import { NetworkViewModel } from '../models/network';
+
+angular.module('portainer.docker').factory('NetworkService', NetworkServiceFactory);
+
+/* @ngInject */
+function NetworkServiceFactory(AngularToReact) {
+  const { useAxios, injectEnvironmentId } = AngularToReact;
+
+  return {
+    create: useAxios(injectEnvironmentId(createNetwork)), // create network
+    network: useAxios(injectEnvironmentId(networkAngularJS)), // service edit
+    networks: useAxios(injectEnvironmentId(networksAngularJS)), // macvlan form + container edit + dashboard + service create + service edit + custom templates list + templates list
+    remove: useAxios(injectEnvironmentId(deleteNetwork)), // networks list
+    connectContainer: useAxios(injectEnvironmentId(connectContainerAngularJS)), // container edit
+  };
+
+  /**
+   * @param {EnvironmentId} environmentId filled by AngularToReact
+   * @param {NetworkId} networkId
+   * @param {string?} nodeName
+   * @returns NetworkViewModel
+   */
+  async function networkAngularJS(environmentId, networkId, nodeName) {
+    const data = await getNetwork(environmentId, networkId, { nodeName });
+    return new NetworkViewModel(data);
+  }
+
+  /**
+   * @param {EnvironmentId} environmentId filled by AngularToReact
+   * @param {boolean?} localNetworks
+   * @param {boolean?} swarmNetworks
+   * @param {boolean?} swarmAttachableNetworks
+   * @param {*} filters
+   * @returns NetworkViewModel[]
+   */
+  async function networksAngularJS(environmentId, local, swarm, swarmAttachable, filters) {
+    const data = await getNetworks(environmentId, { local, swarm, swarmAttachable, filters });
+    return data.map((n) => new NetworkViewModel(n));
+  }
+
+  /**
+   * @param {EnvironmentId} environmentId filled by AngularToReact
+   * @param {NetworkId} networkId
+   * @param {ContainerId} containerId
+   */
+  async function connectContainerAngularJS(environmentId, networkId, containerId) {
+    return connectContainer({ environmentId, containerId, networkId });
+  }
+}
diff --git a/app/docker/services/nodeService.js b/app/docker/services/nodeService.js
new file mode 100644
index 0000000..201045e
--- /dev/null
+++ b/app/docker/services/nodeService.js
@@ -0,0 +1,43 @@
+import { getNode } from '@/react/docker/proxy/queries/nodes/useNode';
+import { getNodes } from '@/react/docker/proxy/queries/nodes/useNodes';
+import { updateNode } from '@/react/docker/proxy/queries/nodes/useUpdateNodeMutation';
+
+import { NodeViewModel } from '../models/node';
+
+angular.module('portainer.docker').factory('NodeService', NodeServiceFactory);
+
+/* @ngInject */
+function NodeServiceFactory(AngularToReact) {
+  const { useAxios, injectEnvironmentId } = AngularToReact;
+
+  return {
+    nodes: useAxios(injectEnvironmentId(nodesAngularJS)), // macvlan form + services list + service create + service edit + swarm visualizer + stack edit
+    node: useAxios(injectEnvironmentId(nodeAngularJS)), // node browser + node details
+    updateNode: useAxios(injectEnvironmentId(updateNodeAngularJS)), // swarm node details panel
+  };
+
+  /**
+   * @param {EnvironmentId} environmentId
+   * @param {NodeId} id
+   */
+  async function nodeAngularJS(environmentId, id) {
+    const data = await getNode(environmentId, id);
+    return new NodeViewModel(data);
+  }
+
+  /**
+   * @param {EnvironmentId} environmentId
+   */
+  async function nodesAngularJS(environmentId) {
+    const data = await getNodes(environmentId);
+    return data.map((n) => new NodeViewModel(n));
+  }
+
+  /**
+   * @param {EnvironmentId} environmentId
+   * @param {NodeSpec & { Id: string; Version: number }} nodeConfig
+   */
+  async function updateNodeAngularJS(environmentId, nodeConfig) {
+    return updateNode(environmentId, nodeConfig.Id, nodeConfig, nodeConfig.Version);
+  }
+}
diff --git a/app/docker/services/pluginService.js b/app/docker/services/pluginService.js
new file mode 100644
index 0000000..e1df43a
--- /dev/null
+++ b/app/docker/services/pluginService.js
@@ -0,0 +1,51 @@
+import { isFulfilled } from '@/portainer/helpers/promise-utils';
+import { getInfo } from '@/react/docker/proxy/queries/useInfo';
+import { aggregateData, getPlugins } from '@/react/docker/proxy/queries/usePlugins';
+
+angular.module('portainer.docker').factory('PluginService', PluginServiceFactory);
+
+/* @ngInject */
+function PluginServiceFactory(AngularToReact) {
+  const { useAxios, injectEnvironmentId } = AngularToReact;
+
+  return {
+    volumePlugins: useAxios(injectEnvironmentId(volumePlugins)), // volume create
+    networkPlugins: useAxios(injectEnvironmentId(networksPlugins)), // network create
+    loggingPlugins: useAxios(injectEnvironmentId(loggingPlugins)), // service create + service edit
+  };
+}
+
+/**
+ * @param {EnvironmentId} environmentId Injected
+ * @param {boolean} systemOnly
+ */
+async function volumePlugins(environmentId, systemOnly) {
+  const { systemPluginsData, pluginsData } = await getAllPlugins(environmentId);
+  return aggregateData(systemPluginsData, pluginsData, systemOnly, 'Volume');
+}
+
+/**
+ * @param {EnvironmentId} environmentId Injected
+ * @param {boolean} systemOnly
+ */
+async function networksPlugins(environmentId, systemOnly) {
+  const { systemPluginsData, pluginsData } = await getAllPlugins(environmentId);
+  return aggregateData(systemPluginsData, pluginsData, systemOnly, 'Network');
+}
+
+/**
+ * @param {EnvironmentId} environmentId Injected
+ * @param {boolean} systemOnly
+ */
+async function loggingPlugins(environmentId, systemOnly) {
+  const { systemPluginsData, pluginsData } = await getAllPlugins(environmentId);
+  return aggregateData(systemPluginsData, pluginsData, systemOnly, 'Log');
+}
+
+async function getAllPlugins(environmentId) {
+  const [system, plugins] = await Promise.allSettled([getInfo(environmentId), getPlugins(environmentId)]);
+  const systemPluginsData = isFulfilled(system) ? system.value.Plugins : undefined;
+  const pluginsData = isFulfilled(plugins) ? plugins.value : undefined;
+
+  return { systemPluginsData, pluginsData };
+}
diff --git a/app/docker/services/secretService.js b/app/docker/services/secretService.js
new file mode 100644
index 0000000..48b72c6
--- /dev/null
+++ b/app/docker/services/secretService.js
@@ -0,0 +1,37 @@
+import { getSecret } from '@/react/docker/proxy/queries/secrets/useSecret';
+import { getSecrets } from '@/react/docker/proxy/queries/secrets/useSecrets';
+import { removeSecret } from '@/react/docker/proxy/queries/secrets/useRemoveSecretMutation';
+import { createSecret } from '@/react/docker/proxy/queries/secrets/useCreateSecretMutation';
+
+import { SecretViewModel } from '../models/secret';
+
+angular.module('portainer.docker').factory('SecretService', SecretServiceFactory);
+
+/* @ngInject */
+function SecretServiceFactory(AngularToReact) {
+  const { useAxios, injectEnvironmentId } = AngularToReact;
+
+  return {
+    secret: useAxios(injectEnvironmentId(secretAngularJS)), // secret edit
+    secrets: useAxios(injectEnvironmentId(secretsAngularJS)), // secret list + service create + service edit
+    remove: useAxios(injectEnvironmentId(removeSecret)), // secret list + secret edit
+    create: useAxios(injectEnvironmentId(createSecret)), // secret create
+  };
+
+  /**
+   * @param {EnvironmentId} environmentId Injected
+   * @param {SecretId} id
+   */
+  async function secretAngularJS(environmentId, id) {
+    const data = await getSecret(environmentId, id);
+    return new SecretViewModel(data);
+  }
+
+  /**
+   * @param {EnvironmentId} environmentId Injected
+   */
+  async function secretsAngularJS(environmentId) {
+    const data = await getSecrets(environmentId);
+    return data.map((s) => new SecretViewModel(s));
+  }
+}
diff --git a/app/docker/services/serviceService.js b/app/docker/services/serviceService.js
new file mode 100644
index 0000000..a3146b7
--- /dev/null
+++ b/app/docker/services/serviceService.js
@@ -0,0 +1,98 @@
+import { removeService } from '@/react/docker/services/ListView/ServicesDatatable/useRemoveServicesMutation';
+import { createService } from '@/react/docker/services/queries/useCreateServiceMutation';
+import { getService } from '@/react/docker/services/queries/useService';
+import { getServices } from '@/react/docker/services/queries/useServices';
+import { updateService } from '@/react/docker/services/queries/useUpdateServiceMutation';
+import { getServiceLogs } from '@/react/docker/services/queries/useServiceLogs';
+
+import { ServiceViewModel } from '../models/service';
+import { formatLogs } from '../helpers/logHelper';
+
+angular.module('portainer.docker').factory('ServiceService', ServiceServiceFactory);
+
+/* @ngInject */
+function ServiceServiceFactory(AngularToReact) {
+  const { useAxios, injectEnvironmentId } = AngularToReact;
+
+  return {
+    services: useAxios(injectEnvironmentId(getServicesAngularJS)), // dashboard + service list + swarm visualizer + volume list + stackservice + stack edit
+    service: useAxios(injectEnvironmentId(getServiceAngularJS)), // service edit + task edit
+    remove: useAxios(injectEnvironmentId(removeServiceAngularJS)), // service edit
+    update: useAxios(injectEnvironmentId(updateServiceAngularJS)), // service edit
+    create: useAxios(injectEnvironmentId(createServiceAngularJS)), // service create
+    logs: useAxios(injectEnvironmentId(serviceLogsAngularJS)), // service logs
+  };
+
+  /**
+   * @param {EnvironmentId} environmentId Injected
+   * @param {*} filters
+   */
+  async function getServicesAngularJS(environmentId, filters) {
+    const data = await getServices(environmentId, filters);
+    return data.map((s) => new ServiceViewModel(s));
+  }
+
+  /**
+   * @param {EnvironmentId} environmentId Injected
+   * @param {ServiceId} serviceId
+   */
+  async function getServiceAngularJS(environmentId, serviceId) {
+    const data = await getService(environmentId, serviceId);
+    return new ServiceViewModel(data);
+  }
+
+  /**
+   * @param {EnvironmentId} environmentId Injected
+   * @param {ServiceViewModel} service
+   */
+  async function removeServiceAngularJS(environmentId, service) {
+    return removeService(environmentId, service.Id);
+  }
+
+  /**
+   * @param {EnvironmentId} environmentId Injected
+   * @param {ServiceViewModel} service
+   * @param {ServiceUpdateConfig} config
+   * @param {string?} rollback
+   */
+  async function updateServiceAngularJS(environmentId, service, config, rollback) {
+    const data = await getServiceAngularJS(environmentId, service.Id);
+    return updateService({
+      environmentId,
+      config,
+      serviceId: service.Id,
+      version: data.Version,
+      registryId: config.registryId,
+      rollback,
+    });
+  }
+
+  /**
+   * @param {EnvironmentId} environmentId Injected
+   * @param {Service} config
+   * @param {RegistryId} registryId
+   */
+  async function createServiceAngularJS(environmentId, config, registryId) {
+    return createService({ environmentId, config, registryId });
+  }
+
+  /**
+   * @param {EnvironmentId} environmentId Injected
+   * @param {ServiceId} id
+   * @param {boolean?} stdout
+   * @param {boolean?} stderr
+   * @param {boolean?} timestamps
+   * @param {number?} since
+   * @param {number?} tail
+   */
+  async function serviceLogsAngularJS(environmentId, id, stdout = false, stderr = false, timestamps = false, since = 0, tail = 'all') {
+    const data = await getServiceLogs(environmentId, id, {
+      since,
+      stderr,
+      stdout,
+      tail,
+      timestamps,
+    });
+    return formatLogs(data, { stripHeaders: true, withTimestamps: !!timestamps });
+  }
+}
diff --git a/app/docker/services/swarmService.js b/app/docker/services/swarmService.js
new file mode 100644
index 0000000..b6269b3
--- /dev/null
+++ b/app/docker/services/swarmService.js
@@ -0,0 +1,12 @@
+import { getSwarm } from '@/react/docker/proxy/queries/useSwarm';
+
+angular.module('portainer.docker').factory('SwarmService', SwarmServiceFactory);
+
+/* @ngInject */
+function SwarmServiceFactory(AngularToReact) {
+  const { useAxios } = AngularToReact;
+
+  return {
+    swarm: useAxios(getSwarm), // stack service
+  };
+}
diff --git a/app/docker/services/systemService.js b/app/docker/services/systemService.js
new file mode 100644
index 0000000..9c94552
--- /dev/null
+++ b/app/docker/services/systemService.js
@@ -0,0 +1,16 @@
+import { ping } from '@/react/docker/proxy/queries/usePing';
+import { getInfo } from '@/react/docker/proxy/queries/useInfo';
+import { getVersion } from '@/react/docker/proxy/queries/useVersion';
+
+angular.module('portainer.docker').factory('SystemService', SystemServiceFactory);
+
+/* @ngInject */
+function SystemServiceFactory(AngularToReact) {
+  const { useAxios, injectEnvironmentId } = AngularToReact;
+
+  return {
+    info: useAxios(injectEnvironmentId(getInfo)), // dashboard + docker host view + docker host browser + swarm inspect views + stateManager (update endpoint state)
+    ping: useAxios(ping), // docker/__module onEnter abstract /docker subpath
+    version: useAxios(injectEnvironmentId(getVersion)), // docker host view + swarm inspect view + stateManager (update endpoint state)
+  };
+}
diff --git a/app/docker/services/taskService.js b/app/docker/services/taskService.js
new file mode 100644
index 0000000..f779a11
--- /dev/null
+++ b/app/docker/services/taskService.js
@@ -0,0 +1,57 @@
+import { getTask } from '@/react/docker/tasks/queries/useTask';
+import { getTasks } from '@/react/docker/proxy/queries/tasks/useTasks';
+import { getTaskLogs } from '@/react/docker/tasks/queries/useTaskLogs';
+
+import { TaskViewModel } from '../models/task';
+import { formatLogs } from '../helpers/logHelper';
+
+angular.module('portainer.docker').factory('TaskService', TaskServiceFactory);
+
+/* @ngInject */
+function TaskServiceFactory(AngularToReact) {
+  const { useAxios, injectEnvironmentId } = AngularToReact;
+
+  return {
+    task: useAxios(injectEnvironmentId(taskAngularJS)), // task edit
+    tasks: useAxios(injectEnvironmentId(tasksAngularJS)), // services list + service edit + swarm visualizer + stack edit
+    logs: useAxios(injectEnvironmentId(taskLogsAngularJS)), // task logs
+  };
+
+  /**
+   * @param {EnvironmentId} environmentId Injected
+   * @param {TaskId} id
+   */
+  async function taskAngularJS(environmentId, id) {
+    const data = await getTask(environmentId, id);
+    return new TaskViewModel(data);
+  }
+
+  /**
+   * @param {EnvironmentId} environmentId Injected
+   * @param {*} filters
+   */
+  async function tasksAngularJS(environmentId, filters) {
+    const data = await getTasks(environmentId, filters);
+    return data.map((t) => new TaskViewModel(t));
+  }
+
+  /**
+   * @param {EnvironmentId} environmentId
+   * @param {TaskId} id
+   * @param {boolean?} stdout
+   * @param {boolean?} stderr
+   * @param {boolean?} timestamps
+   * @param {number?} since
+   * @param {number?} tail
+   */
+  async function taskLogsAngularJS(environmentId, id, stdout = false, stderr = false, timestamps = false, since = 0, tail = 'all') {
+    const data = await getTaskLogs(environmentId, id, {
+      since,
+      stderr,
+      stdout,
+      tail,
+      timestamps,
+    });
+    return formatLogs(data, { stripHeaders: true, withTimestamps: !!timestamps });
+  }
+}
diff --git a/app/docker/services/volumeService.js b/app/docker/services/volumeService.js
new file mode 100644
index 0000000..475b32d
--- /dev/null
+++ b/app/docker/services/volumeService.js
@@ -0,0 +1,79 @@
+import { getVolumes } from '@/react/docker/volumes/queries/useVolumes';
+import { getVolume } from '@/react/docker/volumes/queries/useVolume';
+import { removeVolume } from '@/react/docker/volumes/queries/useRemoveVolumeMutation';
+import { createVolume } from '@/react/docker/volumes/queries/useCreateVolumeMutation';
+
+import { VolumeViewModel } from '../models/volume';
+
+angular.module('portainer.docker').factory('VolumeService', VolumeServiceFactory);
+
+/* @ngInject */
+function VolumeServiceFactory(AngularToReact) {
+  const { useAxios, injectEnvironmentId } = AngularToReact;
+
+  return {
+    volumes: useAxios(injectEnvironmentId(volumesAngularJS)), // dashboard + service create + service edit + volume list
+    volume: useAxios(injectEnvironmentId(volumeAngularJS)), // volume edit
+    getVolumes: useAxios(injectEnvironmentId(getVolumesAngularJS)), // template list
+    remove: useAxios(injectEnvironmentId(removeAngularJS)), // volume list + volume edit
+    createVolume: useAxios(injectEnvironmentId(createAngularJS)), // volume create
+    createVolumeConfiguration, // volume create
+  };
+
+  /**
+   * @param {EnvironmentId} environmentId Injected
+   * @param {Filters} filters
+   */
+  async function volumesAngularJS(environmentId, filters) {
+    const data = await getVolumes(environmentId, filters);
+    return data.map((v) => new VolumeViewModel(v));
+  }
+
+  /**
+   * @param {EnvironmentId} environmentId Injected
+   * @param {string} id
+   */
+  async function volumeAngularJS(environmentId, id) {
+    const data = await getVolume(environmentId, id);
+    return new VolumeViewModel(data);
+  }
+
+  /**
+   * @param {EnvironmentId} environmentId Injected
+   */
+  async function getVolumesAngularJS(environmentId) {
+    return getVolumes(environmentId);
+  }
+
+  /**
+   * @param {EnvironmentId} environmentId Injected
+   * @param {string} name
+   * @param {string?} nodeName
+   */
+  async function removeAngularJS(environmentId, name, nodeName) {
+    return removeVolume(environmentId, name, { nodeName });
+  }
+
+  /**
+   * @param {string} name
+   * @param {string} driver
+   * @param {{name: string; value: string;}[]} driverOptions
+   */
+  function createVolumeConfiguration(name, driver, driverOptions) {
+    return {
+      Name: name,
+      Driver: driver,
+      DriverOpts: driverOptions.reduce((res, { name, value }) => ({ ...res, [name]: value }), {}),
+    };
+  }
+
+  /**
+   * @param {EnvironmentId} environmentId Injected
+   * @param {VolumeConfiguration} volumeConfiguration
+   * @param {string?} nodeName
+   */
+  async function createAngularJS(environmentId, volumeConfiguration, nodeName) {
+    const data = await createVolume(environmentId, volumeConfiguration, { nodeName });
+    return new VolumeViewModel(data);
+  }
+}
diff --git a/app/docker/views/configs/create/createConfigController.js b/app/docker/views/configs/create/createConfigController.js
new file mode 100644
index 0000000..edd74b0
--- /dev/null
+++ b/app/docker/views/configs/create/createConfigController.js
@@ -0,0 +1,157 @@
+import _ from 'lodash-es';
+import angular from 'angular';
+import { AccessControlFormData } from '@/portainer/components/accessControlForm/porAccessControlFormModel';
+import { confirmWebEditorDiscard } from '@@/modals/confirm';
+
+class CreateConfigController {
+  /* @ngInject */
+  constructor($async, $state, $transition$, $window, Notifications, ConfigService, Authentication, FormValidator, ResourceControlService, endpoint) {
+    this.$state = $state;
+    this.$transition$ = $transition$;
+    this.$window = $window;
+    this.Notifications = Notifications;
+    this.ConfigService = ConfigService;
+    this.Authentication = Authentication;
+    this.FormValidator = FormValidator;
+    this.ResourceControlService = ResourceControlService;
+    this.$async = $async;
+    this.endpoint = endpoint;
+
+    this.formValues = {
+      Name: '',
+      Labels: [],
+      AccessControlData: new AccessControlFormData(),
+      ConfigContent: '',
+    };
+
+    this.state = {
+      formValidationError: '',
+      isEditorDirty: false,
+    };
+
+    this.editorUpdate = this.editorUpdate.bind(this);
+    this.createAsync = this.createAsync.bind(this);
+  }
+
+  async $onInit() {
+    this.$window.onbeforeunload = () => {
+      if (this.formValues.displayCodeEditor && this.formValues.ConfigContent && this.state.isEditorDirty) {
+        return '';
+      }
+    };
+
+    if (!this.$transition$.params().id) {
+      this.formValues.displayCodeEditor = true;
+      return;
+    }
+
+    try {
+      let data = await this.ConfigService.config(this.endpoint.Id, this.$transition$.params().id);
+      this.formValues.Name = data.Name + '_copy';
+      this.formValues.ConfigContent = data.Data;
+      let labels = _.keys(data.Labels);
+      for (let i = 0; i < labels.length; i++) {
+        let labelName = labels[i];
+        let labelValue = data.Labels[labelName];
+        this.formValues.Labels.push({ name: labelName, value: labelValue });
+      }
+      this.formValues.displayCodeEditor = true;
+    } catch (err) {
+      this.formValues.displayCodeEditor = true;
+      this.Notifications.error('Failure', err, 'Unable to clone config');
+    }
+  }
+
+  $onDestroy() {
+    this.state.isEditorDirty = false;
+  }
+
+  async uiCanExit() {
+    if (this.formValues.displayCodeEditor && this.formValues.ConfigContent && this.state.isEditorDirty) {
+      return confirmWebEditorDiscard();
+    }
+  }
+
+  addLabel() {
+    this.formValues.Labels.push({ name: '', value: '' });
+  }
+
+  removeLabel(index) {
+    this.formValues.Labels.splice(index, 1);
+  }
+
+  prepareLabelsConfig(config) {
+    let labels = {};
+    this.formValues.Labels.forEach(function (label) {
+      if (label.name && label.value) {
+        labels[label.name] = label.value;
+      }
+    });
+    config.Labels = labels;
+  }
+
+  prepareConfigData(config) {
+    let configData = this.formValues.ConfigContent;
+    config.Data = btoa(unescape(encodeURIComponent(configData)));
+  }
+
+  prepareConfiguration() {
+    let config = {};
+    config.Name = this.formValues.Name;
+    this.prepareConfigData(config);
+    this.prepareLabelsConfig(config);
+    return config;
+  }
+
+  validateForm(accessControlData, isAdmin) {
+    this.state.formValidationError = '';
+    let error = this.FormValidator.validateAccessControl(accessControlData, isAdmin);
+
+    if (error) {
+      this.state.formValidationError = error;
+      return false;
+    }
+    return true;
+  }
+
+  create() {
+    return this.$async(this.createAsync);
+  }
+
+  async createAsync() {
+    const accessControlData = this.formValues.AccessControlData;
+    const userDetails = this.Authentication.getUserDetails();
+    const isAdmin = this.Authentication.isAdmin();
+
+    if (this.formValues.ConfigContent === '') {
+      this.state.formValidationError = 'Config content must not be empty';
+      return;
+    }
+
+    if (!this.validateForm(accessControlData, isAdmin)) {
+      return;
+    }
+
+    const config = this.prepareConfiguration();
+
+    try {
+      const data = await this.ConfigService.create(this.endpoint.Id, config);
+      const resourceControl = data.Portainer.ResourceControl;
+      const userId = userDetails.ID;
+      await this.ResourceControlService.applyResourceControl(userId, accessControlData, resourceControl);
+      this.Notifications.success('Success', 'Configuration successfully created');
+      this.state.isEditorDirty = false;
+      this.$state.go('docker.configs', {}, { reload: true });
+    } catch (err) {
+      this.Notifications.error('Failure', err, 'Unable to create config');
+    }
+  }
+
+  editorUpdate(value) {
+    this.formValues.ConfigContent = value;
+    this.state.isEditorDirty = true;
+  }
+}
+
+export default CreateConfigController;
+angular.module('portainer.docker').controller('CreateConfigController', CreateConfigController);
diff --git a/app/docker/views/configs/create/createconfig.html b/app/docker/views/configs/create/createconfig.html
new file mode 100644
index 0000000..6ac0bef
--- /dev/null
+++ b/app/docker/views/configs/create/createconfig.html
@@ -0,0 +1,72 @@
+<page-header title="'Create config'" breadcrumbs="[{label:'Configs', link:'docker.configs'}, 'Add config']"> </page-header>
+
+<div class="row">
+  <div class="col-lg-12 col-md-12 col-xs-12">
+    <rd-widget>
+      <rd-widget-body>
+        <form class="form-horizontal">
+          <!-- name-input -->
+          <div class="form-group">
+            <label for="config_name" class="col-sm-1 control-label text-left">Name</label>
+            <div class="col-sm-11">
+              <input type="text" class="form-control" ng-model="ctrl.formValues.Name" id="config_name" placeholder="e.g. myConfig" data-cy="config-name-input" />
+            </div>
+          </div>
+          <!-- !name-input -->
+          <!-- config-data -->
+          <div class="form-group">
+            <div class="col-sm-12" ng-if="ctrl.formValues.displayCodeEditor">
+              <web-editor-form
+                identifier="config-creation-editor"
+                text-tip="Define or paste the content of your config here"
+                yml="false"
+                on-change="(ctrl.editorUpdate)"
+                value="ctrl.formValues.ConfigContent"
+              ></web-editor-form>
+            </div>
+          </div>
+          <!-- !config-data -->
+          <!-- labels -->
+          <div class="form-group">
+            <div class="col-sm-12 mt-1">
+              <label class="control-label space-right text-left">Labels</label>
+              <span class="label label-default interactive vertical-center space-left" ng-click="ctrl.addLabel()"> <pr-icon icon="'plus'" mode="'alt'"></pr-icon> add label </span>
+            </div>
+            <!-- labels-input-list -->
+            <div class="col-sm-12 form-inline mt-2">
+              <div ng-repeat="label in ctrl.formValues.Labels" class="mt-1">
+                <div class="input-group col-sm-5 input-group-sm">
+                  <span class="input-group-addon">name</span>
+                  <input type="text" class="form-control" ng-model="label.name" placeholder="e.g. com.example.foo" data-cy="config-label-input_{{ $index }}" />
+                </div>
+                <div class="input-group col-sm-6 input-group-sm">
+                  <span class="input-group-addon">value</span>
+                  <input type="text" class="form-control" ng-model="label.value" placeholder="e.g. bar" data-cy="config-label-value_{{ $index }}" />
+                  <span class="input-group-btn">
+                    <button class="btn btn-dangerlight" type="button" ng-click="ctrl.removeLabel($index)">
+                      <pr-icon icon="'trash-2'" size="'md'"></pr-icon>
+                    </button>
+                  </span>
+                </div>
+              </div>
+            </div>
+            <!-- !labels-input-list -->
+          </div>
+          <!-- !labels-->
+          <!-- access-control -->
+          <por-access-control-form form-data="ctrl.formValues.AccessControlData"></por-access-control-form>
+          <!-- !access-control -->
+          <!-- actions -->
+          <div class="col-sm-12 form-section-title"> Actions </div>
+          <div class="form-group">
+            <div class="col-sm-12">
+              <button type="button" class="btn btn-primary btn-sm" ng-disabled="!ctrl.formValues.Name" ng-click="ctrl.create()">Create config</button>
+              <span class="text-danger" ng-if="ctrl.state.formValidationError" style="margin-left: 5px">{{ ctrl.state.formValidationError }}</span>
+            </div>
+          </div>
+          <!-- !actions -->
+        </form>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
diff --git a/app/docker/views/configs/edit/config.html b/app/docker/views/configs/edit/config.html
new file mode 100644
index 0000000..fe84f0f
--- /dev/null
+++ b/app/docker/views/configs/edit/config.html
@@ -0,0 +1,79 @@
+<page-header title="'Config details'" breadcrumbs="[{label:'Configs', link:'docker.configs'}, config.Name]" reload="true"> </page-header>
+
+<div class="row">
+  <div class="col-lg-12 col-md-12 col-xs-12">
+    <rd-widget>
+      <rd-widget-header icon="clipboard" title-text="Config details"></rd-widget-header>
+      <rd-widget-body classes="no-padding">
+        <table class="table">
+          <tbody>
+            <tr>
+              <td>Name</td>
+              <td>{{ config.Name }}</td>
+            </tr>
+            <tr>
+              <td>ID</td>
+              <td>
+                {{ config.Id }}
+                <button authorization="DockerConfigDelete" class="btn btn-xs btn-dangerlight" ng-click="removeConfig(config.Id)"
+                  ><pr-icon icon="'trash-2'"></pr-icon>Delete this config</button
+                >
+                <button authorization="DockerConfigCreate" class="btn btn-xs btn-secondary" ui-sref="docker.configs.new({id: config.Id})"
+                  ><pr-icon icon="'copy'"></pr-icon>Clone config</button
+                >
+              </td>
+            </tr>
+            <tr>
+              <td>Created</td>
+              <td>{{ config.CreatedAt | getisodate }}</td>
+            </tr>
+            <tr>
+              <td>Last updated</td>
+              <td>{{ config.UpdatedAt | getisodate }}</td>
+            </tr>
+            <tr ng-if="!(config.Labels | emptyobject)">
+              <td>Labels</td>
+              <td>
+                <table class="table-bordered table-condensed table">
+                  <tr ng-repeat="(k, v) in config.Labels">
+                    <td>{{ k }}</td>
+                    <td>{{ v }}</td>
+                  </tr>
+                </table>
+              </td>
+            </tr>
+          </tbody>
+        </table>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
+
+<!-- access-control-panel -->
+<access-control-panel
+  ng-if="config"
+  resource-id="config.Id"
+  resource-control="config.ResourceControl"
+  resource-type="resourceType"
+  on-update-success="(onUpdateResourceControlSuccess)"
+  environment-id="endpoint.Id"
+>
+</access-control-panel>
+<!-- !access-control-panel -->
+
+<div class="row" ng-if="config">
+  <div class="col-sm-12">
+    <rd-widget>
+      <rd-widget-header icon="code" title-text="Config content"></rd-widget-header>
+      <rd-widget-body>
+        <form class="form-horizontal">
+          <div class="form-group">
+            <div class="col-sm-12">
+              <code-editor identifier="config-editor" yml="false" read-only="true" value="config.Data"></code-editor>
+            </div>
+          </div>
+        </form>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
diff --git a/app/docker/views/configs/edit/configController.js b/app/docker/views/configs/edit/configController.js
new file mode 100644
index 0000000..3de5432
--- /dev/null
+++ b/app/docker/views/configs/edit/configController.js
@@ -0,0 +1,46 @@
+import { ResourceControlType } from '@/react/portainer/access-control/types';
+import { confirmDelete } from '@@/modals/confirm';
+
+angular.module('portainer.docker').controller('ConfigController', [
+  '$scope',
+  '$transition$',
+  '$state',
+  'ConfigService',
+  'Notifications',
+  'endpoint',
+  function ($scope, $transition$, $state, ConfigService, Notifications, endpoint) {
+    $scope.resourceType = ResourceControlType.Config;
+    $scope.endpoint = endpoint;
+
+    $scope.onUpdateResourceControlSuccess = function () {
+      $state.reload();
+    };
+
+    $scope.removeConfig = async function removeConfig(configId) {
+      if (!(await confirmDelete('Are you sure you want to delete this config?'))) {
+        return;
+      }
+
+      ConfigService.remove({ environmentId: endpoint.Id, configId })
+        .then(function success() {
+          Notifications.success('Success', 'Configuration successfully removed');
+          $state.go('docker.configs', {});
+        })
+        .catch(function error(err) {
+          Notifications.error('Failure', err, 'Unable to remove config');
+        });
+    };
+
+    function initView() {
+      ConfigService.config(endpoint.Id, $transition$.params().id)
+        .then(function success(data) {
+          $scope.config = data;
+        })
+        .catch(function error(err) {
+          Notifications.error('Failure', err, 'Unable to retrieve config details');
+        });
+    }
+
+    initView();
+  },
+]);
diff --git a/app/docker/views/containers/console/attach.html b/app/docker/views/containers/console/attach.html
new file mode 100644
index 0000000..6d3713b
--- /dev/null
+++ b/app/docker/views/containers/console/attach.html
@@ -0,0 +1,58 @@
+<page-header
+  title="'Container console'"
+  breadcrumbs="[
+    { label:'Containers', link:'docker.containers' },
+    {
+      label:(container.Name | trimcontainername),
+      link: 'docker.containers.container',
+      linkParams: { id: container.Id },
+    }, 'Console']"
+>
+</page-header>
+
+<div class="row" ng-init="autoconnectAttachView()" ng-show="loaded">
+  <div class="col-lg-12 col-md-12 col-xs-12">
+    <rd-widget>
+      <rd-widget-header icon="terminal" title-text="Attach"></rd-widget-header>
+      <rd-widget-body>
+        <div class="small text-warning" ng-if="!container.Config.OpenStdin">
+          <p>
+            <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon>
+            The interactive-flag is not set. You might not be able to use the console properly.
+          </p>
+        </div>
+
+        <div class="small text-warning" ng-if="!container.Config.Tty">
+          <p>
+            <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon>
+            The TTY-flag is not set. You might not be able to use the console properly.
+          </p>
+        </div>
+
+        <div class="small text-warning" ng-hide="container.State.Running">
+          <p>
+            <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon>
+            The container is not running.
+          </p>
+        </div>
+
+        <button
+          type="button"
+          class="btn btn-primary"
+          ng-disabled="state === states.connecting || !container.State.Running"
+          ng-click="state == states.disconnected ? connectAttach() : disconnect()"
+        >
+          <span ng-show="state === states.disconnected">Attach to Container</span>
+          <span ng-show="state === states.connected">Detach</span>
+          <span ng-show="state === states.connecting">Attaching...</span>
+        </button>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
+
+<div class="row">
+  <div class="col-lg-12 col-md-12 col-xs-12">
+    <shell-terminal url="shellUrl" connect="shellConnect" on-state-change="(onShellStateChange)" on-resize="(onShellResize)"></shell-terminal>
+  </div>
+</div>
diff --git a/app/docker/views/containers/console/containerConsoleController.js b/app/docker/views/containers/console/containerConsoleController.js
new file mode 100644
index 0000000..da64d7c
--- /dev/null
+++ b/app/docker/views/containers/console/containerConsoleController.js
@@ -0,0 +1,176 @@
+import { baseHref } from '@/portainer/helpers/pathHelper';
+import { commandStringToArray } from '@/docker/helpers/containers';
+import { isLinuxTerminalCommand, LINUX_SHELL_INIT_COMMANDS } from '@@/Terminal/Terminal';
+
+angular.module('portainer.docker').controller('ContainerConsoleController', [
+  '$scope',
+  '$state',
+  '$transition$',
+  'ContainerService',
+  'ExecService',
+  'ImageService',
+  'Notifications',
+  'HttpRequestHelper',
+  'CONSOLE_COMMANDS_LABEL_PREFIX',
+  'endpoint',
+  function ($scope, $state, $transition$, ContainerService, ExecService, ImageService, Notifications, HttpRequestHelper, CONSOLE_COMMANDS_LABEL_PREFIX, endpoint) {
+    const states = Object.freeze({
+      disconnected: 0,
+      connecting: 1,
+      connected: 2,
+    });
+
+    $scope.loaded = false;
+    $scope.states = states;
+    $scope.state = states.disconnected;
+    $scope.formValues = {};
+    $scope.containerCommands = [];
+
+    $scope.shellUrl = '';
+    $scope.shellConnect = false;
+    $scope.onShellResize = null;
+    $scope.shellInitCommands = null;
+
+    $scope.$on('$destroy', function () {
+      $scope.disconnect();
+    });
+
+    $scope.onShellStateChange = function (state) {
+      $scope.$evalAsync(function () {
+        if (state === 'connected') {
+          $scope.state = states.connected;
+        } else if (state === 'disconnected') {
+          $scope.state = states.disconnected;
+          $scope.shellConnect = false;
+        }
+      });
+    };
+
+    $scope.connectAttach = function () {
+      if ($scope.state > states.disconnected) {
+        return;
+      }
+
+      $scope.state = states.connecting;
+
+      const attachId = $transition$.params().id;
+
+      ContainerService.container(endpoint.Id, attachId)
+        .then((details) => {
+          if (!details.State.Running) {
+            Notifications.error('Failure', details, 'Container ' + attachId + ' is not running!');
+            $scope.disconnect();
+            return;
+          }
+
+          $scope.onShellResize = function ({ rows, cols }) {
+            ContainerService.resizeTTY(endpoint.Id, attachId, cols, rows);
+          };
+          $scope.shellUrl = buildShellUrl('api/websocket/attach', { endpointId: $state.params.endpointId, id: attachId });
+          $scope.shellConnect = true;
+        })
+        .catch(function (err) {
+          Notifications.error('Error', err, 'Unable to retrieve container details');
+          $scope.disconnect();
+        });
+    };
+
+    $scope.connectExec = function () {
+      if ($scope.state > states.disconnected) {
+        return;
+      }
+
+      $scope.state = states.connecting;
+
+      const command = $scope.formValues.isCustomCommand ? $scope.formValues.customCommand : $scope.formValues.command;
+      const execConfig = {
+        AttachStdin: true,
+        AttachStdout: true,
+        AttachStderr: true,
+        Tty: true,
+        User: $scope.formValues.user,
+        Cmd: commandStringToArray(command),
+      };
+
+      ContainerService.createExec(endpoint.Id, $transition$.params().id, execConfig)
+        .then(function (data) {
+          $scope.onShellResize = function ({ rows, cols }) {
+            ExecService.resizeTTY(data.Id, cols, rows);
+          };
+          if (isLinuxTerminalCommand(execConfig.Cmd[0])) {
+            $scope.shellInitCommands = LINUX_SHELL_INIT_COMMANDS;
+          }
+          $scope.shellUrl = buildShellUrl('api/websocket/exec', { endpointId: $state.params.endpointId, id: data.Id });
+          $scope.shellConnect = true;
+        })
+        .catch(function (err) {
+          Notifications.error('Failure', err, 'Unable to exec into container');
+          $scope.disconnect();
+        });
+    };
+
+    $scope.disconnect = function () {
+      $scope.shellConnect = false;
+      $scope.state = states.disconnected;
+      $scope.onShellResize = null;
+      $scope.shellInitCommands = null;
+    };
+
+    $scope.autoconnectAttachView = function () {
+      return $scope.initView().then(function () {
+        if ($scope.container.State.Running) {
+          $scope.connectAttach();
+        }
+      });
+    };
+
+    $scope.initView = function () {
+      HttpRequestHelper.setPortainerAgentTargetHeader($transition$.params().nodeName);
+      return ContainerService.container(endpoint.Id, $transition$.params().id)
+        .then(function (data) {
+          $scope.container = data;
+          return ImageService.image(data.Image);
+        })
+        .then(function (data) {
+          const containerLabels = $scope.container.Config.Labels;
+          $scope.imageOS = data.Os;
+          $scope.formValues.command = data.Os === 'windows' ? 'powershell' : 'bash';
+          $scope.containerCommands = Object.keys(containerLabels)
+            .filter(function (label) {
+              return label.indexOf(CONSOLE_COMMANDS_LABEL_PREFIX) === 0;
+            })
+            .map(function (label) {
+              return {
+                title: label.replace(CONSOLE_COMMANDS_LABEL_PREFIX, ''),
+                command: containerLabels[label],
+              };
+            });
+          $scope.loaded = true;
+        })
+        .catch(function (err) {
+          Notifications.error('Error', err, 'Unable to retrieve container details');
+        });
+    };
+
+    $scope.handleIsCustomCommandChange = function (enabled) {
+      $scope.$evalAsync(() => {
+        $scope.formValues.isCustomCommand = enabled;
+      });
+    };
+
+    function buildShellUrl(path, params) {
+      const base = window.location.origin.startsWith('http') ? `${window.location.origin}${baseHref()}` : baseHref();
+      let url =
+        base +
+        path +
+        '?' +
+        Object.keys(params)
+          .map((k) => k + '=' + params[k])
+          .join('&');
+      if ($transition$.params().nodeName) {
+        url += '&nodeName=' + $transition$.params().nodeName;
+      }
+      return url.startsWith('https') ? url.replace('https://', 'wss://') : url.replace('http://', 'ws://');
+    }
+  },
+]);
diff --git a/app/docker/views/containers/console/exec.html b/app/docker/views/containers/console/exec.html
new file mode 100644
index 0000000..025549f
--- /dev/null
+++ b/app/docker/views/containers/console/exec.html
@@ -0,0 +1,101 @@
+<page-header
+  title="'Container console'"
+  breadcrumbs="[
+    { label:'Containers', link:'docker.containers' },
+    {
+      label:(container.Name | trimcontainername),
+      link: 'docker.containers.container',
+      linkParams: { id: container.Id },
+    }, 'Console']"
+>
+</page-header>
+
+<div class="row" ng-init="initView()" ng-show="loaded">
+  <div class="col-lg-12 col-md-12 col-xs-12">
+    <rd-widget>
+      <rd-widget-header icon="terminal" title-text="Execute"></rd-widget-header>
+      <rd-widget-body>
+        <form class="form-horizontal">
+          <div ng-if="state === states.disconnected">
+            <!-- command-list -->
+            <div class="form-group">
+              <label for="command" class="col-lg-1 col-sm-2 control-label text-left">Command</label>
+              <div class="col-lg-11 col-sm-10">
+                <div class="input-group" ng-if="!formValues.isCustomCommand">
+                  <span class="input-group-addon">
+                    <pr-icon ng-if="imageOS == 'linux'" icon="'svg-linux'"></pr-icon>
+                    <pr-icon ng-if="imageOS == 'windows'" icon="'layout-grid'"></pr-icon>
+                  </span>
+                  <select class="form-control" ng-model="formValues.command" id="command" data-cy="command-select">
+                    <option value="ash" ng-if="imageOS == 'linux'">/bin/ash</option>
+                    <option value="bash" ng-if="imageOS == 'linux'">/bin/bash</option>
+                    <option value="dash" ng-if="imageOS == 'linux'">/bin/dash</option>
+                    <option value="sh" ng-if="imageOS == 'linux'">/bin/sh</option>
+                    <option value="powershell" ng-if="imageOS == 'windows'">powershell</option>
+                    <option value="cmd.exe" ng-if="imageOS == 'windows'">cmd.exe</option>
+                    <option ng-repeat="command in containerCommands" value="{{ command.command }}">{{ command.title }}: {{ command.command }}</option>
+                  </select>
+                </div>
+                <input
+                  class="form-control"
+                  ng-if="formValues.isCustomCommand"
+                  type="text"
+                  name="custom-command"
+                  ng-model="formValues.customCommand"
+                  placeholder="e.g. ps aux"
+                  data-cy="custom-command"
+                />
+              </div>
+            </div>
+            <!-- !command-list -->
+            <div class="form-group col-lg-12">
+              <por-switch-field
+                label-class="'col-sm-1'"
+                checked="formValues.isCustomCommand"
+                label="'Use custom command'"
+                on-change="(handleIsCustomCommandChange)"
+              ></por-switch-field>
+            </div>
+            <div class="form-group">
+              <label class="col-lg-1 col-sm-2 control-label text-left">
+                User
+                <portainer-tooltip message="'Format is one of: user, user:group, uid or uid:gid'"></portainer-tooltip>
+              </label>
+              <div class="col-lg-11 col-sm-10">
+                <input class="form-control" type="text" ng-model="formValues.user" placeholder="root" data-cy="container-exec-user" />
+              </div>
+            </div>
+            <div class="form-group">
+              <div class="col-sm-12">
+                <button type="button" class="btn btn-primary" ng-disabled="!container.State.Running" ng-click="connectExec()">
+                  <span>Connect</span>
+                </button>
+                <span class="small text-danger vertical-center" ng-hide="container.State.Running">
+                  <pr-icon icon="'alert-triangle'" mode="'danger'"></pr-icon>
+                  The container is not running.
+                </span>
+              </div>
+            </div>
+          </div>
+          <div ng-if="state !== states.disconnected">
+            <label
+              >Exec into container as <code class="align-baseline !text-sm">{{ ::formValues.user || 'default user' }}</code> using command
+              <code class="align-baseline !text-sm">{{ formValues.isCustomCommand ? formValues.customCommand : formValues.command }}</code>
+              <terminal-tooltip class="align-sub"> </terminal-tooltip>
+            </label>
+            <button type="button" class="btn btn-primary" ng-click="disconnect()">
+              <span ng-show="state === states.connected">Disconnect</span>
+              <span ng-show="state === states.connecting">Connecting...</span>
+            </button>
+          </div>
+        </form>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
+
+<div class="row">
+  <div class="col-lg-12 col-md-12 col-xs-12">
+    <shell-terminal url="shellUrl" connect="shellConnect" on-state-change="(onShellStateChange)" on-resize="(onShellResize)" initial-commands="shellInitCommands"></shell-terminal>
+  </div>
+</div>
diff --git a/app/docker/views/containers/logs/containerLogsController.js b/app/docker/views/containers/logs/containerLogsController.js
new file mode 100644
index 0000000..789d473
--- /dev/null
+++ b/app/docker/views/containers/logs/containerLogsController.js
@@ -0,0 +1,103 @@
+import moment from 'moment';
+
+angular.module('portainer.docker').controller('ContainerLogsController', [
+  '$scope',
+  '$transition$',
+  '$interval',
+  'ContainerService',
+  'Notifications',
+  'HttpRequestHelper',
+  'endpoint',
+  function ($scope, $transition$, $interval, ContainerService, Notifications, HttpRequestHelper, endpoint) {
+    $scope.state = {
+      refreshRate: 3,
+      lineCount: 100,
+      sinceTimestamp: '',
+      displayTimestamps: false,
+    };
+
+    $scope.changeLogCollection = function (logCollectionStatus) {
+      if (!logCollectionStatus) {
+        stopRepeater();
+      } else {
+        setUpdateRepeater(!$scope.container.Config.Tty);
+      }
+    };
+
+    $scope.$on('$destroy', function () {
+      stopRepeater();
+    });
+
+    function stopRepeater() {
+      var repeater = $scope.repeater;
+      if (angular.isDefined(repeater)) {
+        $interval.cancel(repeater);
+      }
+    }
+
+    function setUpdateRepeater(skipHeaders) {
+      var refreshRate = $scope.state.refreshRate;
+      $scope.repeater = $interval(function () {
+        ContainerService.logs(
+          endpoint.Id,
+          $transition$.params().id,
+          1,
+          1,
+          $scope.state.displayTimestamps ? 1 : 0,
+          moment($scope.state.sinceTimestamp).unix(),
+          $scope.state.lineCount,
+          skipHeaders
+        )
+          .then(function success(data) {
+            $scope.logs = data;
+          })
+          .catch(function error(err) {
+            stopRepeater();
+            Notifications.error('Failure', err, 'Unable to retrieve container logs');
+          });
+      }, refreshRate * 1000);
+    }
+
+    function startLogPolling(skipHeaders) {
+      ContainerService.logs(
+        endpoint.Id,
+        $transition$.params().id,
+        1,
+        1,
+        $scope.state.displayTimestamps ? 1 : 0,
+        moment($scope.state.sinceTimestamp).unix(),
+        $scope.state.lineCount,
+        skipHeaders
+      )
+        .then(function success(data) {
+          $scope.logs = data;
+          setUpdateRepeater(skipHeaders);
+        })
+        .catch(function error(err) {
+          stopRepeater();
+          Notifications.error('Failure', err, 'Unable to retrieve container logs');
+        });
+    }
+
+    function initView() {
+      HttpRequestHelper.setPortainerAgentTargetHeader($transition$.params().nodeName);
+      ContainerService.container(endpoint.Id, $transition$.params().id)
+        .then(function success(data) {
+          var container = data;
+          $scope.container = container;
+
+          const logsEnabled = container.HostConfig && container.HostConfig.LogConfig && container.HostConfig.LogConfig.Type && container.HostConfig.LogConfig.Type !== 'none';
+          $scope.logsEnabled = logsEnabled;
+
+          if (logsEnabled) {
+            startLogPolling(!container.Config.Tty);
+          }
+        })
+        .catch(function error(err) {
+          Notifications.error('Failure', err, 'Unable to retrieve container information');
+        });
+    }
+
+    initView();
+  },
+]);
diff --git a/app/docker/views/containers/logs/containerlogs.html b/app/docker/views/containers/logs/containerlogs.html
new file mode 100644
index 0000000..3e824e2
--- /dev/null
+++ b/app/docker/views/containers/logs/containerlogs.html
@@ -0,0 +1,23 @@
+<page-header
+  title="'Container logs'"
+  breadcrumbs="[
+    { label:'Containers', link:'docker.containers' },
+    { 
+      label:(container.Name | trimcontainername),
+      link: 'docker.containers.container', 
+      linkParams: { id: container.Id }
+    }, 'Logs']"
+>
+</page-header>
+
+<container-log-view ng-if="!logsEnabled"></container-log-view>
+
+<log-viewer
+  data="logs"
+  ng-if="logs && logsEnabled"
+  log-collection-change="changeLogCollection"
+  display-timestamps="state.displayTimestamps"
+  line-count="state.lineCount"
+  since-timestamp="state.sinceTimestamp"
+  resource-name="container.Name"
+></log-viewer>
diff --git a/app/docker/views/containers/stats/containerStatsController.js b/app/docker/views/containers/stats/containerStatsController.js
new file mode 100644
index 0000000..d9889cd
--- /dev/null
+++ b/app/docker/views/containers/stats/containerStatsController.js
@@ -0,0 +1,177 @@
+import moment from 'moment';
+
+angular.module('portainer.docker').controller('ContainerStatsController', [
+  '$q',
+  '$scope',
+  '$transition$',
+  '$document',
+  '$interval',
+  'ContainerService',
+  'ChartService',
+  'Notifications',
+  'HttpRequestHelper',
+  'endpoint',
+  function ($q, $scope, $transition$, $document, $interval, ContainerService, ChartService, Notifications, HttpRequestHelper, endpoint) {
+    $scope.state = {
+      refreshRate: '5',
+      networkStatsUnavailable: false,
+      ioStatsUnavailable: false,
+    };
+
+    $scope.$on('$destroy', function () {
+      stopRepeater();
+    });
+
+    function stopRepeater() {
+      var repeater = $scope.repeater;
+      if (angular.isDefined(repeater)) {
+        $interval.cancel(repeater);
+      }
+    }
+
+    function updateNetworkChart(stats, chart) {
+      if (stats.Networks.length > 0) {
+        var rx = stats.Networks[0].rx_bytes;
+        var tx = stats.Networks[0].tx_bytes;
+        var label = moment(stats.read).format('HH:mm:ss');
+
+        ChartService.UpdateNetworkChart(label, rx, tx, chart);
+      }
+    }
+
+    function updateMemoryChart(stats, chart) {
+      var label = moment(stats.read).format('HH:mm:ss');
+
+      ChartService.UpdateMemoryChart(label, stats.MemoryUsage, stats.MemoryCache, chart);
+    }
+
+    function updateIOChart(stats, chart) {
+      var label = moment(stats.read).format('HH:mm:ss');
+      if (stats.noIOData !== true) {
+        ChartService.UpdateIOChart(label, stats.BytesRead, stats.BytesWrite, chart);
+      }
+    }
+
+    function updateCPUChart(stats, chart) {
+      var label = moment(stats.read).format('HH:mm:ss');
+      var value = stats.isWindows ? calculateCPUPercentWindows(stats) : calculateCPUPercentUnix(stats);
+
+      ChartService.UpdateCPUChart(label, value, chart);
+    }
+
+    function calculateCPUPercentUnix(stats) {
+      var cpuPercent = 0.0;
+      var cpuDelta = stats.CurrentCPUTotalUsage - stats.PreviousCPUTotalUsage;
+      var systemDelta = stats.CurrentCPUSystemUsage - stats.PreviousCPUSystemUsage;
+
+      if (systemDelta > 0.0 && cpuDelta > 0.0) {
+        cpuPercent = (cpuDelta / systemDelta) * stats.CPUCores * 100.0;
+      }
+
+      return cpuPercent;
+    }
+
+    function calculateCPUPercentWindows(stats) {
+      var possIntervals =
+        stats.NumProcs * parseFloat(moment(stats.read, 'YYYY-MM-DDTHH:mm:ss.SSSSSSSSSZ').valueOf() - moment(stats.preread, 'YYYY-MM-DDTHH:mm:ss.SSSSSSSSSZ').valueOf());
+      var windowsCpuUsage = 0.0;
+      if (possIntervals > 0) {
+        windowsCpuUsage = parseFloat(stats.CurrentCPUTotalUsage - stats.PreviousCPUTotalUsage) / parseFloat(possIntervals * 100);
+      }
+      return windowsCpuUsage;
+    }
+
+    $scope.changeUpdateRepeater = function () {
+      var networkChart = $scope.networkChart;
+      var cpuChart = $scope.cpuChart;
+      var memoryChart = $scope.memoryChart;
+      var ioChart = $scope.ioChart;
+
+      stopRepeater();
+      setUpdateRepeater(networkChart, cpuChart, memoryChart, ioChart);
+      $('#refreshRateChange').show();
+      $('#refreshRateChange').fadeOut(1500);
+    };
+
+    function startChartUpdate(networkChart, cpuChart, memoryChart, ioChart) {
+      $q.all({
+        stats: ContainerService.containerStats(endpoint.Id, $transition$.params().id),
+      })
+        .then(function success(data) {
+          var stats = data.stats;
+          if (stats.Networks.length === 0) {
+            $scope.state.networkStatsUnavailable = true;
+          }
+          if (stats.noIOData === true) {
+            $scope.state.ioStatsUnavailable = true;
+          }
+          updateNetworkChart(stats, networkChart);
+          updateMemoryChart(stats, memoryChart);
+          updateCPUChart(stats, cpuChart);
+          updateIOChart(stats, ioChart);
+          setUpdateRepeater(networkChart, cpuChart, memoryChart, ioChart);
+        })
+        .catch(function error(err) {
+          stopRepeater();
+          Notifications.error('Failure', err, 'Unable to retrieve container statistics');
+        });
+    }
+
+    function setUpdateRepeater(networkChart, cpuChart, memoryChart, ioChart) {
+      var refreshRate = $scope.state.refreshRate;
+      $scope.repeater = $interval(function () {
+        $q.all({
+          stats: ContainerService.containerStats(endpoint.Id, $transition$.params().id),
+        })
+          .then(function success(data) {
+            var stats = data.stats;
+            updateNetworkChart(stats, networkChart);
+            updateMemoryChart(stats, memoryChart);
+            updateCPUChart(stats, cpuChart);
+            updateIOChart(stats, ioChart);
+          })
+          .catch(function error(err) {
+            stopRepeater();
+            Notifications.error('Failure', err, 'Unable to retrieve container statistics');
+          });
+      }, refreshRate * 1000);
+    }
+
+    function initCharts() {
+      var networkChartCtx = $('#networkChart');
+      var networkChart = ChartService.CreateNetworkChart(networkChartCtx);
+      $scope.networkChart = networkChart;
+
+      var cpuChartCtx = $('#cpuChart');
+      var cpuChart = ChartService.CreateCPUChart(cpuChartCtx);
+      $scope.cpuChart = cpuChart;
+
+      var memoryChartCtx = $('#memoryChart');
+      var memoryChart = ChartService.CreateMemoryChart(memoryChartCtx);
+      $scope.memoryChart = memoryChart;
+
+      var ioChartCtx = $('#ioChart');
+      var ioChart = ChartService.CreateIOChart(ioChartCtx);
+      $scope.ioChart = ioChart;
+
+      startChartUpdate(networkChart, cpuChart, memoryChart, ioChart);
+    }
+
+    function initView() {
+      HttpRequestHelper.setPortainerAgentTargetHeader($transition$.params().nodeName);
+      ContainerService.container(endpoint.Id, $transition$.params().id)
+        .then(function success(data) {
+          $scope.container = data;
+        })
+        .catch(function error(err) {
+          Notifications.error('Failure', err, 'Unable to retrieve container information');
+        });
+
+      $document.ready(function () {
+        initCharts();
+      });
+    }
+
+    initView();
+  },
+]);
diff --git a/app/docker/views/containers/stats/containerstats.html b/app/docker/views/containers/stats/containerstats.html
new file mode 100644
index 0000000..6429e31
--- /dev/null
+++ b/app/docker/views/containers/stats/containerstats.html
@@ -0,0 +1,111 @@
+<page-header
+  title="'Container statistics'"
+  breadcrumbs="[
+    { label:'Containers', link:'docker.containers' },
+    {
+      label:(container.Name | trimcontainername),
+      link: 'docker.containers.container',
+      linkParams: { id: container.Id },
+    }, 'Stats']"
+>
+</page-header>
+
+<div class="row">
+  <div class="col-md-12">
+    <rd-widget>
+      <rd-widget-header icon="info" title-text="About statistics"> </rd-widget-header>
+      <rd-widget-body>
+        <form class="form-horizontal">
+          <div class="form-group">
+            <div class="col-sm-12">
+              <span class="small text-muted">
+                This view displays real-time statistics about the container <b>{{ container.Name | trimcontainername }}</b> as well as a list of the running processes inside this
+                container.
+              </span>
+            </div>
+          </div>
+          <div class="form-group">
+            <label for="refreshRate" class="col-sm-3 col-md-2 col-lg-2 margin-sm-top control-label text-left"> Refresh rate </label>
+            <div class="col-sm-3 col-md-2">
+              <select id="refreshRate" ng-model="state.refreshRate" ng-change="changeUpdateRepeater()" class="form-control" data-cy="docker-containers-stats-refresh-rate">
+                <option value="1">1s</option>
+                <option value="3">3s</option>
+                <option value="5">5s</option>
+                <option value="10">10s</option>
+                <option value="30">30s</option>
+                <option value="60">60s</option>
+              </select>
+            </div>
+            <span>
+              <pr-icon id="refreshRateChange" icon="'check'" mode="'success'" style="display: none"></pr-icon>
+            </span>
+          </div>
+          <div class="form-group" ng-if="state.networkStatsUnavailable">
+            <div class="col-sm-12">
+              <span class="small text-muted">
+                <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon>
+                Network stats are unavailable for this container.
+              </span>
+            </div>
+          </div>
+          <div class="form-group" ng-if="state.ioStatsUnavailable">
+            <div class="col-sm-12">
+              <span class="small text-muted">
+                <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon>
+                I/O stats are unavailable for this container.
+              </span>
+            </div>
+          </div>
+        </form>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
+
+<div class="row">
+  <div class="col-lg-6 col-md-6 col-sm-12">
+    <rd-widget>
+      <rd-widget-header icon="bar-chart" title-text="Memory usage"></rd-widget-header>
+      <rd-widget-body>
+        <div class="chart-container" style="position: relative">
+          <canvas id="memoryChart" width="770" height="300"></canvas>
+        </div>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+
+  <div class="col-lg-6 col-md-6 col-sm-12">
+    <rd-widget>
+      <rd-widget-header icon="bar-chart" title-text="CPU usage"></rd-widget-header>
+      <rd-widget-body>
+        <div class="chart-container" style="position: relative">
+          <canvas id="cpuChart" width="770" height="300"></canvas>
+        </div>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+
+  <div class="col-lg-6 col-md-6 col-sm-12" ng-if="!state.networkStatsUnavailable">
+    <rd-widget>
+      <rd-widget-header icon="bar-chart" title-text="Network usage (aggregate)"></rd-widget-header>
+      <rd-widget-body>
+        <div class="chart-container" style="position: relative">
+          <canvas id="networkChart" width="770" height="300"></canvas>
+        </div>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+
+  <div class="col-lg-6 col-md-6 col-sm-12" ng-if="!state.ioStatsUnavailable">
+    <rd-widget>
+      <rd-widget-header icon="bar-chart" title-text="I/O usage (aggregate)"></rd-widget-header>
+      <rd-widget-body>
+        <div class="chart-container" style="position: relative">
+          <canvas id="ioChart" width="770" height="300"></canvas>
+        </div>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
+
+<docker-container-processes-datatable></docker-container-processes-datatable>
diff --git a/app/docker/views/docker-features-configuration/docker-features-configuration.controller.js b/app/docker/views/docker-features-configuration/docker-features-configuration.controller.js
new file mode 100644
index 0000000..e339626
--- /dev/null
+++ b/app/docker/views/docker-features-configuration/docker-features-configuration.controller.js
@@ -0,0 +1,176 @@
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+
+export default class DockerFeaturesConfigurationController {
+  /* @ngInject */
+  constructor($async, $scope, $state, EndpointService, SettingsService, Notifications, StateManager) {
+    this.$async = $async;
+    this.$scope = $scope;
+    this.$state = $state;
+    this.EndpointService = EndpointService;
+    this.SettingsService = SettingsService;
+    this.Notifications = Notifications;
+    this.StateManager = StateManager;
+
+    this.limitedFeatureAutoUpdate = FeatureId.HIDE_AUTO_UPDATE_WINDOW;
+    this.limitedFeatureUpToDateImage = FeatureId.IMAGE_UP_TO_DATE_INDICATOR;
+
+    this.formValues = {
+      enableHostManagementFeatures: false,
+      allowVolumeBrowserForRegularUsers: false,
+      disableBindMountsForRegularUsers: false,
+      disablePrivilegedModeForRegularUsers: false,
+      disableHostNamespaceForRegularUsers: false,
+      disableStackManagementForRegularUsers: false,
+      disableDeviceMappingForRegularUsers: false,
+      disableContainerCapabilitiesForRegularUsers: false,
+      disableSysctlSettingForRegularUsers: false,
+      disableSecurityOptForRegularUsers: false,
+    };
+
+    this.isAgent = false;
+
+    this.state = {
+      actionInProgress: false,
+      autoUpdateSettings: { Enabled: false },
+      timeZone: '',
+    };
+
+    this.save = this.save.bind(this);
+    this.onChangeField = this.onChangeField.bind(this);
+    this.onToggleAutoUpdate = this.onToggleAutoUpdate.bind(this);
+    this.onToggleGPUManagement = this.onToggleGPUManagement.bind(this);
+    this.onGpusChange = this.onGpusChange.bind(this);
+    this.onChangeEnableHostManagementFeatures = this.onChangeField('enableHostManagementFeatures');
+    this.onChangeAllowVolumeBrowserForRegularUsers = this.onChangeField('allowVolumeBrowserForRegularUsers');
+    this.onChangeDisableBindMountsForRegularUsers = this.onChangeField('disableBindMountsForRegularUsers');
+    this.onChangeDisablePrivilegedModeForRegularUsers = this.onChangeField('disablePrivilegedModeForRegularUsers');
+    this.onChangeDisableHostNamespaceForRegularUsers = this.onChangeField('disableHostNamespaceForRegularUsers');
+    this.onChangeDisableStackManagementForRegularUsers = this.onChangeField('disableStackManagementForRegularUsers');
+    this.onChangeDisableDeviceMappingForRegularUsers = this.onChangeField('disableDeviceMappingForRegularUsers');
+    this.onChangeDisableContainerCapabilitiesForRegularUsers = this.onChangeField('disableContainerCapabilitiesForRegularUsers');
+    this.onChangeDisableSysctlSettingForRegularUsers = this.onChangeField('disableSysctlSettingForRegularUsers');
+    this.onChangeDisableSecurityOptForRegularUsers = this.onChangeField('disableSecurityOptForRegularUsers');
+  }
+
+  onToggleAutoUpdate(value) {
+    return this.$scope.$evalAsync(() => {
+      this.state.autoUpdateSettings.Enabled = value;
+    });
+  }
+
+  onToggleGPUManagement(checked) {
+    this.$scope.$evalAsync(() => {
+      this.state.enableGPUManagement = checked;
+    });
+  }
+
+  onChange(values) {
+    return this.$scope.$evalAsync(() => {
+      this.formValues = {
+        ...this.formValues,
+        ...values,
+      };
+    });
+  }
+
+  onChangeField(field) {
+    return (value) => {
+      this.onChange({
+        [field]: value,
+      });
+    };
+  }
+
+  onGpusChange(value) {
+    return this.$async(async () => {
+      this.endpoint.Gpus = value;
+    });
+  }
+
+  isContainerEditDisabled() {
+    const {
+      disableBindMountsForRegularUsers,
+      disableHostNamespaceForRegularUsers,
+      disablePrivilegedModeForRegularUsers,
+      disableDeviceMappingForRegularUsers,
+      disableContainerCapabilitiesForRegularUsers,
+      disableSysctlSettingForRegularUsers,
+      disableSecurityOptForRegularUsers,
+    } = this.formValues;
+    return (
+      disableBindMountsForRegularUsers ||
+      disableHostNamespaceForRegularUsers ||
+      disablePrivilegedModeForRegularUsers ||
+      disableDeviceMappingForRegularUsers ||
+      disableContainerCapabilitiesForRegularUsers ||
+      disableSysctlSettingForRegularUsers ||
+      disableSecurityOptForRegularUsers
+    );
+  }
+
+  async save() {
+    return this.$async(async () => {
+      try {
+        this.state.actionInProgress = true;
+
+        const validGpus = this.endpoint.Gpus.filter((gpu) => gpu.name && gpu.value);
+        const gpus = this.state.enableGPUManagement ? validGpus : [];
+
+        const settings = {
+          enableHostManagementFeatures: this.formValues.enableHostManagementFeatures,
+          allowBindMountsForRegularUsers: !this.formValues.disableBindMountsForRegularUsers,
+          allowPrivilegedModeForRegularUsers: !this.formValues.disablePrivilegedModeForRegularUsers,
+          allowVolumeBrowserForRegularUsers: this.formValues.allowVolumeBrowserForRegularUsers,
+          allowHostNamespaceForRegularUsers: !this.formValues.disableHostNamespaceForRegularUsers,
+          allowDeviceMappingForRegularUsers: !this.formValues.disableDeviceMappingForRegularUsers,
+          allowStackManagementForRegularUsers: !this.formValues.disableStackManagementForRegularUsers,
+          allowContainerCapabilitiesForRegularUsers: !this.formValues.disableContainerCapabilitiesForRegularUsers,
+          allowSysctlSettingForRegularUsers: !this.formValues.disableSysctlSettingForRegularUsers,
+          allowSecurityOptForRegularUsers: !this.formValues.disableSecurityOptForRegularUsers,
+          enableGPUManagement: this.state.enableGPUManagement,
+          gpus,
+        };
+
+        this.initialGPUs = gpus;
+        this.initialEnableGPUManagement = this.state.enableGPUManagement;
+
+        await this.EndpointService.updateSecuritySettings(this.endpoint.Id, settings);
+
+        this.endpoint.SecuritySettings = settings;
+        this.Notifications.success('Success', 'Saved settings successfully');
+      } catch (e) {
+        this.Notifications.error('Failure', e, 'Failed saving settings');
+      }
+      this.state.actionInProgress = false;
+      this.$state.reload();
+    });
+  }
+
+  $onInit() {
+    const securitySettings = this.endpoint.SecuritySettings;
+
+    const applicationState = this.StateManager.getState();
+    this.isAgent = applicationState.endpoint.mode.agentProxy;
+
+    this.isDockerStandaloneEnv = applicationState.endpoint.mode.provider === 'DOCKER_STANDALONE';
+
+    this.formValues = {
+      enableHostManagementFeatures: this.isAgent && securitySettings.enableHostManagementFeatures,
+      allowVolumeBrowserForRegularUsers: this.isAgent && securitySettings.allowVolumeBrowserForRegularUsers,
+      disableBindMountsForRegularUsers: !securitySettings.allowBindMountsForRegularUsers,
+      disablePrivilegedModeForRegularUsers: !securitySettings.allowPrivilegedModeForRegularUsers,
+      disableHostNamespaceForRegularUsers: !securitySettings.allowHostNamespaceForRegularUsers,
+      disableDeviceMappingForRegularUsers: !securitySettings.allowDeviceMappingForRegularUsers,
+      disableStackManagementForRegularUsers: !securitySettings.allowStackManagementForRegularUsers,
+      disableContainerCapabilitiesForRegularUsers: !securitySettings.allowContainerCapabilitiesForRegularUsers,
+      disableSysctlSettingForRegularUsers: !securitySettings.allowSysctlSettingForRegularUsers,
+      disableSecurityOptForRegularUsers: !securitySettings.allowSecurityOptForRegularUsers,
+    };
+
+    // this.endpoint.Gpus could be null as it is Gpus: []Pair in the API
+    this.endpoint.Gpus = this.endpoint.Gpus || [];
+    this.state.enableGPUManagement = this.isDockerStandaloneEnv && (this.endpoint.EnableGPUManagement || this.endpoint.Gpus.length > 0);
+    this.initialGPUs = this.endpoint.Gpus;
+    this.initialEnableGPUManagement = this.endpoint.EnableGPUManagement;
+  }
+}
diff --git a/app/docker/views/docker-features-configuration/docker-features-configuration.html b/app/docker/views/docker-features-configuration/docker-features-configuration.html
new file mode 100644
index 0000000..ac325b4
--- /dev/null
+++ b/app/docker/views/docker-features-configuration/docker-features-configuration.html
@@ -0,0 +1,232 @@
+<page-header title="'Docker features configuration'" breadcrumbs="['Docker configuration']"> </page-header>
+
+<div class="row">
+  <div class="col-sm-12">
+    <rd-widget>
+      <rd-widget-body>
+        <form class="form-horizontal" name="$ctrl.form">
+          <div class="col-sm-12 form-section-title"> Host and filesystem </div>
+          <div class="form-group">
+            <span class="col-sm-12 text-muted small vertical-center">
+              <pr-icon icon="'info'" mode="'primary'" class-name="'space-right'"></pr-icon>
+              <span class="text-muted"
+                >The environment must be <a href="https://docs.portainer.io/start/agent">running the Portainer Agent</a> to use this functionality, and the root of the host must be
+                bind-mounted to <b>/host</b> in the agent deployment. Check
+                <a href="https://docs.portainer.io/user/docker/host/setup#enable-host-management-features">our documentation</a> for more information.</span
+              >
+            </span>
+          </div>
+          <div class="form-group">
+            <div class="col-sm-12">
+              <por-switch-field
+                checked="$ctrl.formValues.enableHostManagementFeatures"
+                name="'enableHostManagementFeatures'"
+                label="'Enable host management features'"
+                tooltip="'Enable host management features: host system browsing and advanced host details.'"
+                label-class="'col-sm-7 col-lg-4'"
+                disabled="!$ctrl.isAgent"
+                on-change="($ctrl.onChangeEnableHostManagementFeatures)"
+              ></por-switch-field>
+            </div>
+          </div>
+          <div class="form-group">
+            <div class="col-sm-12">
+              <por-switch-field
+                checked="$ctrl.formValues.allowVolumeBrowserForRegularUsers"
+                name="'allowVolumeBrowserForRegularUsers'"
+                label="'Enable volume management for non-administrators'"
+                tooltip="'When enabled, regular users will be able to use Portainer volume management features.'"
+                label-class="'col-sm-7 col-lg-4'"
+                on-change="($ctrl.onChangeAllowVolumeBrowserForRegularUsers)"
+                disabled="!$ctrl.isAgent"
+              ></por-switch-field>
+            </div>
+          </div>
+          <!-- auto update window -->
+          <div class="col-sm-12 form-section-title"> Change window setting </div>
+
+          <div class="form-group">
+            <div class="col-sm-12">
+              <por-switch-field
+                checked="$ctrl.state.autoUpdateSettings.Enabled"
+                name="'disableSysctlSettingForRegularUsers'"
+                label="'Enable Change Window'"
+                label-class="'col-sm-7 col-lg-4'"
+                feature-id="$ctrl.limitedFeatureAutoUpdate"
+                tooltip="'Specify a time-frame during which GitOps updates can occur in this environment.'"
+                on-change="($ctrl.onToggleAutoUpdate)"
+              >
+              </por-switch-field>
+            </div>
+          </div>
+
+          <!-- security -->
+          <div class="col-sm-12 form-section-title"> Docker security settings </div>
+          <div class="form-group">
+            <div class="col-sm-12">
+              <por-switch-field
+                checked="$ctrl.formValues.disableBindMountsForRegularUsers"
+                name="'disableBindMountsForRegularUsers'"
+                label="'Hide bind mounts for non-administrators'"
+                tooltip="'When enabled, regular users will not be able to use bind mounts when creating containers.'"
+                label-class="'col-sm-7 col-lg-4'"
+                on-change="($ctrl.onChangeDisableBindMountsForRegularUsers)"
+              ></por-switch-field>
+            </div>
+          </div>
+          <div class="form-group">
+            <div class="col-sm-12">
+              <por-switch-field
+                checked="$ctrl.formValues.disablePrivilegedModeForRegularUsers"
+                name="'disablePrivilegedModeForRegularUsers'"
+                label="'Hide privileged mode for non-administrators'"
+                tooltip="'When enabled, regular users will not be able to use privileged mode when creating containers.'"
+                label-class="'col-sm-7 col-lg-4'"
+                on-change="($ctrl.onChangeDisablePrivilegedModeForRegularUsers)"
+              ></por-switch-field>
+            </div>
+          </div>
+          <div class="form-group">
+            <div class="col-sm-12">
+              <por-switch-field
+                checked="$ctrl.formValues.disableHostNamespaceForRegularUsers"
+                name="'disableHostNamespaceForRegularUsers'"
+                label="'Hide the use of host PID 1 for non-administrators'"
+                tooltip="'Prevent users from accessing the host filesystem through the host PID namespace.'"
+                label-class="'col-sm-7 col-lg-4'"
+                on-change="($ctrl.onChangeDisableHostNamespaceForRegularUsers)"
+              ></por-switch-field>
+            </div>
+          </div>
+          <div class="form-group">
+            <div class="col-sm-12">
+              <por-switch-field
+                checked="$ctrl.formValues.disableStackManagementForRegularUsers"
+                name="'disableStackManagementForRegularUsers'"
+                label="'Hide the use of Stacks for non-administrators'"
+                label-class="'col-sm-7 col-lg-4'"
+                on-change="($ctrl.onChangeDisableStackManagementForRegularUsers)"
+              ></por-switch-field>
+            </div>
+          </div>
+          <div class="form-group">
+            <div class="col-sm-12">
+              <por-switch-field
+                checked="$ctrl.formValues.disableDeviceMappingForRegularUsers"
+                name="'disableDeviceMappingForRegularUsers'"
+                label="'Hide device mappings for non-administrators'"
+                label-class="'col-sm-7 col-lg-4'"
+                on-change="($ctrl.onChangeDisableDeviceMappingForRegularUsers)"
+              ></por-switch-field>
+            </div>
+          </div>
+          <div class="form-group">
+            <div class="col-sm-12">
+              <por-switch-field
+                checked="$ctrl.formValues.disableContainerCapabilitiesForRegularUsers"
+                name="'disableContainerCapabilitiesForRegularUsers'"
+                label="'Hide container capabilities for non-administrators'"
+                label-class="'col-sm-7 col-lg-4'"
+                on-change="($ctrl.onChangeDisableContainerCapabilitiesForRegularUsers)"
+              ></por-switch-field>
+            </div>
+          </div>
+          <div class="form-group">
+            <div class="col-sm-12">
+              <por-switch-field
+                checked="$ctrl.formValues.disableSysctlSettingForRegularUsers"
+                name="'disableSysctlSettingForRegularUsers'"
+                label="'Hide sysctl settings for non-administrators'"
+                label-class="'col-sm-7 col-lg-4'"
+                on-change="($ctrl.onChangeDisableSysctlSettingForRegularUsers)"
+              ></por-switch-field>
+            </div>
+          </div>
+          <div class="form-group">
+            <div class="col-sm-12">
+              <por-switch-field
+                checked="$ctrl.formValues.disableSecurityOptForRegularUsers"
+                name="'disableSecurityOptForRegularUsers'"
+                label="'Hide security-opt for non-administrators'"
+                label-class="'col-sm-7 col-lg-4'"
+                on-change="($ctrl.onChangeDisableSecurityOptForRegularUsers)"
+              ></por-switch-field>
+            </div>
+          </div>
+
+          <div class="form-group" ng-if="$ctrl.isContainerEditDisabled()">
+            <span class="col-sm-12 text-muted small">
+              <pr-icon icon="'info'" mode="'primary'" class-name="'mr-0.5'"></pr-icon>
+              Note: The recreate/duplicate/edit feature is currently hidden (for non-admin users) by one or more security settings.
+            </span>
+          </div>
+          <!-- !security -->
+
+          <!-- other -->
+          <div class="col-sm-12 form-section-title"> Other </div>
+          <div class="form-group">
+            <div class="col-sm-12" ng-if="!$ctrl.isDockerStandaloneEnv">
+              <text-tip children="'Showing GPU in the UI is currently only available with Docker Standalone and is limited to NVIDIA graphics cards.'" color="'blue'" />
+            </div>
+          </div>
+
+          <div class="form-group">
+            <div class="col-sm-12">
+              <por-switch-field
+                label="'Show GPU in the UI'"
+                tooltip="'This allows managing of GPUs for container/stack hardware acceleration via the Portainer UI.'"
+                checked="$ctrl.state.enableGPUManagement"
+                name="'enableGPUManagement'"
+                on-change="($ctrl.onToggleGPUManagement)"
+                label-class="'col-sm-7 col-lg-4'"
+                disabled="!$ctrl.isDockerStandaloneEnv"
+              ></por-switch-field>
+            </div>
+
+            <div ng-if="$ctrl.state.enableGPUManagement">
+              <div class="col-sm-12">
+                <text-tip children="'GPU support is currently limited to NVIDIA graphics cards only.'" color="'blue'" />
+              </div>
+              <div class="col-sm-12">
+                <div class="pl-4">
+                  <gpus-list ng-if="$ctrl.state.enableGPUManagement" value="$ctrl.endpoint.Gpus" on-change="($ctrl.onGpusChange)"></gpus-list>
+                </div>
+              </div>
+            </div>
+          </div>
+
+          <div class="form-group">
+            <div class="col-sm-12">
+              <por-switch-field
+                label="'Show image up to date indicators for Stacks, Services and Containers'"
+                checked="false"
+                name="'outOfDateImageToggle'"
+                label-class="'col-sm-7 col-lg-4'"
+                feature-id="$ctrl.limitedFeatureUpToDateImage"
+              ></por-switch-field>
+            </div>
+          </div>
+          <!-- !other -->
+
+          <!-- actions -->
+          <div class="col-sm-12 form-section-title"> Actions </div>
+          <div class="form-group">
+            <div class="col-sm-12">
+              <button
+                type="button"
+                class="btn btn-primary btn-sm !ml-0"
+                ng-click="$ctrl.save()"
+                ng-disabled="$ctrl.state.actionInProgress"
+                button-spinner="$ctrl.state.actionInProgress"
+              >
+                <span ng-hide="$ctrl.state.actionInProgress">Save configuration</span>
+                <span ng-show="$ctrl.state.actionInProgress">Saving...</span>
+              </button>
+            </div>
+          </div>
+          <!-- !actions -->
+        </form>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
diff --git a/app/docker/views/docker-features-configuration/index.js b/app/docker/views/docker-features-configuration/index.js
new file mode 100644
index 0000000..5aec215
--- /dev/null
+++ b/app/docker/views/docker-features-configuration/index.js
@@ -0,0 +1,11 @@
+import angular from 'angular';
+
+import controller from './docker-features-configuration.controller';
+
+angular.module('portainer.docker').component('dockerFeaturesConfigurationView', {
+  templateUrl: './docker-features-configuration.html',
+  controller,
+  bindings: {
+    endpoint: '<',
+  },
+});
diff --git a/app/docker/views/host/host-browser-view/host-browser-view-controller.js b/app/docker/views/host/host-browser-view/host-browser-view-controller.js
new file mode 100644
index 0000000..4024fd1
--- /dev/null
+++ b/app/docker/views/host/host-browser-view/host-browser-view-controller.js
@@ -0,0 +1,18 @@
+angular.module('portainer.docker').controller('HostBrowserViewController', [
+  'SystemService',
+  'Notifications',
+  function HostBrowserViewController(SystemService, Notifications) {
+    var ctrl = this;
+    ctrl.$onInit = $onInit;
+
+    function $onInit() {
+      SystemService.info()
+        .then(function onInfoLoaded(host) {
+          ctrl.host = host;
+        })
+        .catch(function onError(err) {
+          Notifications.error('Unable to retrieve host information', err);
+        });
+    }
+  },
+]);
diff --git a/app/docker/views/host/host-browser-view/host-browser-view.html b/app/docker/views/host/host-browser-view/host-browser-view.html
new file mode 100644
index 0000000..2f4958d
--- /dev/null
+++ b/app/docker/views/host/host-browser-view/host-browser-view.html
@@ -0,0 +1,3 @@
+<page-header title="'Host Browser'" breadcrumbs="['Host', {label:$ctrl.host.Name, link:'docker.host'},  'browse']"> </page-header>
+
+<host-browser ng-if="$ctrl.host" endpoint-id="$ctrl.endpoint.Id"></host-browser>
diff --git a/app/docker/views/host/host-browser-view/host-browser-view.js b/app/docker/views/host/host-browser-view/host-browser-view.js
new file mode 100644
index 0000000..94095ec
--- /dev/null
+++ b/app/docker/views/host/host-browser-view/host-browser-view.js
@@ -0,0 +1,7 @@
+angular.module('portainer.docker').component('hostBrowserView', {
+  templateUrl: './host-browser-view.html',
+  controller: 'HostBrowserViewController',
+  bindings: {
+    endpoint: '<',
+  },
+});
diff --git a/app/docker/views/host/host-view-controller.js b/app/docker/views/host/host-view-controller.js
new file mode 100644
index 0000000..759e7d3
--- /dev/null
+++ b/app/docker/views/host/host-view-controller.js
@@ -0,0 +1,79 @@
+angular.module('portainer.docker').controller('HostViewController', [
+  '$q',
+  'SystemService',
+  'Notifications',
+  'StateManager',
+  'AgentService',
+  'Authentication',
+  function HostViewController($q, SystemService, Notifications, StateManager, AgentService, Authentication) {
+    var ctrl = this;
+
+    this.$onInit = initView;
+
+    ctrl.state = {
+      isAgent: false,
+      isAdmin: false,
+    };
+
+    this.engineDetails = {};
+    this.hostDetails = {};
+    this.devices = undefined;
+    this.disks = null;
+
+    function initView() {
+      var applicationState = StateManager.getState();
+      ctrl.state.isAgent = applicationState.endpoint.mode.agentProxy;
+      ctrl.state.isAdmin = Authentication.isAdmin();
+      var agentApiVersion = applicationState.endpoint.agentApiVersion;
+      ctrl.state.agentApiVersion = agentApiVersion;
+      ctrl.state.enableHostManagementFeatures = ctrl.endpoint.SecuritySettings.enableHostManagementFeatures;
+
+      $q.all({
+        version: SystemService.version(),
+        info: SystemService.info(),
+      })
+        .then(function success(data) {
+          ctrl.engineDetails = buildEngineDetails(data);
+          ctrl.hostDetails = buildHostDetails(data.info);
+
+          if (ctrl.state.isAgent && agentApiVersion > 1 && ctrl.state.enableHostManagementFeatures) {
+            return AgentService.hostInfo(ctrl.endpoint.Id).then(function onHostInfoLoad(agentHostInfo) {
+              ctrl.devices = agentHostInfo.PCIDevices;
+              ctrl.disks = agentHostInfo.PhysicalDisks;
+            });
+          }
+        })
+        .catch(function error(err) {
+          Notifications.error('Failure', err, 'Unable to retrieve engine details');
+        });
+    }
+
+    function buildEngineDetails(data) {
+      var versionDetails = data.version;
+      var info = data.info;
+      return {
+        releaseVersion: versionDetails.Version,
+        apiVersion: versionDetails.ApiVersion,
+        rootDirectory: info.DockerRootDir,
+        storageDriver: info.Driver,
+        loggingDriver: info.LoggingDriver,
+        volumePlugins: info.Plugins.Volume,
+        networkPlugins: info.Plugins.Network,
+      };
+    }
+
+    function buildHostDetails(info) {
+      return {
+        os: {
+          arch: info.Architecture,
+          type: info.OSType,
+          name: info.OperatingSystem,
+        },
+        name: info.Name,
+        kernelVersion: info.KernelVersion,
+        totalCPU: info.NCPU,
+        totalMemory: info.MemTotal,
+      };
+    }
+  },
+]);
diff --git a/app/docker/views/host/host-view.html b/app/docker/views/host/host-view.html
new file mode 100644
index 0000000..ba39e51
--- /dev/null
+++ b/app/docker/views/host/host-view.html
@@ -0,0 +1,13 @@
+<host-overview
+  engine-details="$ctrl.engineDetails"
+  host-details="$ctrl.hostDetails"
+  is-agent="$ctrl.state.isAgent"
+  agent-api-version="$ctrl.state.agentApiVersion"
+  disks="$ctrl.disks"
+  devices="$ctrl.devices"
+  refresh-url="docker.host"
+  browse-url="docker.host.browser"
+  host-features-enabled="$ctrl.state.enableHostManagementFeatures"
+  is-admin="$ctrl.state.isAdmin"
+  endpoint-id="$ctrl.endpoint.Id"
+></host-overview>
diff --git a/app/docker/views/host/host-view.js b/app/docker/views/host/host-view.js
new file mode 100644
index 0000000..db3904b
--- /dev/null
+++ b/app/docker/views/host/host-view.js
@@ -0,0 +1,7 @@
+angular.module('portainer.docker').component('hostView', {
+  templateUrl: './host-view.html',
+  controller: 'HostViewController',
+  bindings: {
+    endpoint: '<',
+  },
+});
diff --git a/app/docker/views/images/build/buildImageController.js b/app/docker/views/images/build/buildImageController.js
new file mode 100644
index 0000000..553b150
--- /dev/null
+++ b/app/docker/views/images/build/buildImageController.js
@@ -0,0 +1,165 @@
+import { confirmWebEditorDiscard } from '@@/modals/confirm';
+import { editor, upload, url } from '@@/BoxSelector/common-options/build-methods';
+
+angular.module('portainer.docker').controller('BuildImageController', BuildImageController);
+
+/* @ngInject */
+function BuildImageController($scope, $async, $window, BuildService, Notifications, HttpRequestHelper, endpoint) {
+  $scope.endpoint = endpoint;
+  $scope.options = [editor, upload, url];
+
+  $scope.state = {
+    BuildType: 'editor',
+    actionInProgress: false,
+    activeTab: 0,
+    isEditorDirty: false,
+  };
+
+  $scope.formValues = {
+    ImageNames: [{ Name: '', Valid: false, Unique: true }],
+    UploadFile: null,
+    DockerFileContent: '',
+    AdditionalFiles: [],
+    URL: '',
+    Path: 'Dockerfile',
+    NodeName: null,
+  };
+
+  $window.onbeforeunload = () => {
+    if ($scope.state.BuildType === 'editor' && $scope.formValues.DockerFileContent && $scope.state.isEditorDirty) {
+      return '';
+    }
+  };
+
+  $scope.$on('$destroy', function () {
+    $scope.state.isEditorDirty = false;
+  });
+
+  $scope.onChangeBuildType = function (type) {
+    $scope.$evalAsync(() => {
+      $scope.state.BuildType = type;
+    });
+  };
+
+  $scope.checkName = function (index) {
+    var item = $scope.formValues.ImageNames[index];
+    item.Valid = true;
+    item.Unique = true;
+    if (item.Name !== '') {
+      // Check unique
+      $scope.formValues.ImageNames.forEach((element, idx) => {
+        if (idx != index && element.Name == item.Name) {
+          item.Valid = false;
+          item.Unique = false;
+        }
+      });
+      if (!item.Valid) {
+        return;
+      }
+    }
+    // Validation
+    const parts = item.Name.split('/');
+    const repository = parts[parts.length - 1];
+    const repositoryRegExp = RegExp('^[a-z0-9-_.]{2,255}(:[A-Za-z0-9-_.]{1,128})?$');
+    item.Valid = repositoryRegExp.test(repository);
+  };
+
+  $scope.addImageName = function () {
+    $scope.formValues.ImageNames.push({ Name: '', Valid: false, Unique: true });
+  };
+
+  $scope.removeImageName = function (index) {
+    $scope.formValues.ImageNames.splice(index, 1);
+    for (var i = 0; i < $scope.formValues.ImageNames.length; i++) {
+      $scope.checkName(i);
+    }
+  };
+
+  function buildImageBasedOnBuildType(method, names) {
+    var buildType = $scope.state.BuildType;
+    var dockerfilePath = $scope.formValues.Path;
+
+    if (buildType === 'upload') {
+      var file = $scope.formValues.UploadFile;
+      return BuildService.buildImageFromUpload(endpoint.Id, names, file, dockerfilePath);
+    } else if (buildType === 'url') {
+      var URL = $scope.formValues.URL;
+      return BuildService.buildImageFromURL(endpoint.Id, names, URL, dockerfilePath);
+    } else {
+      var dockerfileContent = $scope.formValues.DockerFileContent;
+      if ($scope.formValues.AdditionalFiles.length === 0) {
+        return BuildService.buildImageFromDockerfileContent(endpoint.Id, names, dockerfileContent);
+      } else {
+        var additionalFiles = $scope.formValues.AdditionalFiles;
+        return BuildService.buildImageFromDockerfileContentAndFiles(endpoint.Id, names, dockerfileContent, additionalFiles);
+      }
+    }
+  }
+
+  $scope.buildImage = buildImage;
+
+  async function buildImage() {
+    return $async(async () => {
+      var buildType = $scope.state.BuildType;
+
+      if (buildType === 'editor' && $scope.formValues.DockerFileContent === '') {
+        $scope.state.formValidationError = 'Dockerfile content must not be empty';
+        return;
+      }
+
+      $scope.state.actionInProgress = true;
+
+      var imageNames = $scope.formValues.ImageNames.filter(function filterNull(x) {
+        return x.Name;
+      }).map(function getNames(x) {
+        return x.Name;
+      });
+
+      var nodeName = $scope.formValues.NodeName;
+      HttpRequestHelper.setPortainerAgentTargetHeader(nodeName);
+
+      try {
+        const data = await buildImageBasedOnBuildType(buildType, imageNames);
+        $scope.buildLogs = data.buildLogs;
+        $scope.state.activeTab = 1;
+        if (data.hasError) {
+          Notifications.error('An error occurred during build', { msg: 'Please check build logs output' });
+        } else {
+          Notifications.success('Image successfully built');
+          $scope.state.isEditorDirty = false;
+        }
+      } catch (err) {
+        Notifications.error('Failure', err, 'Unable to build image');
+      } finally {
+        $scope.state.actionInProgress = false;
+      }
+    });
+  }
+
+  $scope.validImageNames = function () {
+    if ($scope.formValues.ImageNames.length == 0) {
+      return false;
+    }
+    for (var i = 0; i < $scope.formValues.ImageNames.length; i++) {
+      if (!$scope.formValues.ImageNames[i].Valid) {
+        return false;
+      }
+    }
+    return true;
+  };
+
+  $scope.editorUpdate = function (value) {
+    $scope.formValues.DockerFileContent = value;
+    $scope.state.isEditorDirty = true;
+  };
+
+  this.uiCanExit = async function () {
+    if ($scope.state.BuildType === 'editor' && $scope.formValues.DockerFileContent && $scope.state.isEditorDirty) {
+      return confirmWebEditorDiscard();
+    }
+  };
+
+  $scope.selectAdditionalFiles = function (files) {
+    $scope.formValues.AdditionalFiles = files;
+  };
+}
diff --git a/app/docker/views/images/build/buildimage.html b/app/docker/views/images/build/buildimage.html
new file mode 100644
index 0000000..20c5773
--- /dev/null
+++ b/app/docker/views/images/build/buildimage.html
@@ -0,0 +1,228 @@
+<page-header title="'Build image'" breadcrumbs="[{label:'Images', link:'docker.images'}, 'Build image']"> </page-header>
+
+<div class="row">
+  <div class="col-sm-12">
+    <rd-widget>
+      <rd-widget-body>
+        <uib-tabset active="state.activeTab">
+          <uib-tab index="0">
+            <uib-tab-heading class="vertical-center"> <pr-icon icon="'wrench'" class="leading-none"></pr-icon> Builder </uib-tab-heading>
+            <form class="form-horizontal">
+              <div class="col-sm-12 form-section-title"> Naming </div>
+              <!-- names -->
+              <div class="form-group">
+                <span class="col-sm-12 text-muted small"> You can specify multiple names to your image. </span>
+              </div>
+              <div class="form-group">
+                <div class="col-sm-12">
+                  <label class="control-label text-left">Names</label>
+                  <span class="label label-default interactive" class="ml-2.5" ng-click="addImageName()"> <pr-icon icon="'plus'" mode="'alt'"></pr-icon> add additional name </span>
+                </div>
+              </div>
+              <!-- !names -->
+              <div class="form-group" ng-if="formValues.ImageNames.length === 0">
+                <span class="col-sm-12 text-danger small">
+                  <p class="vertical-center"> <pr-icon icon="'alert-triangle'" mode="'danger'" size="'sm'"></pr-icon> You must specify at least one name for the image. </p>
+                </span>
+              </div>
+              <!-- name-input-list -->
+              <div ng-if="formValues.ImageNames.length > 0">
+                <div class="form-group">
+                  <span class="col-sm-12 text-muted small">
+                    A name must be specified in one of the following formats: <code>name:tag</code>, <code>repository/name:tag</code> or
+                    <code>registry:port/repository/name:tag</code> format. If you omit the tag the default <b>latest</b> value is assumed.
+                  </span>
+                </div>
+                <div class="form-group">
+                  <div class="col-sm-12">
+                    <div class="col-sm-12 form-inline" class="mt-2.5">
+                      <div ng-repeat="item in formValues.ImageNames track by $index" class="mt-1">
+                        <!-- name-input -->
+                        <div class="input-group col-sm-5 input-group-sm">
+                          <span class="input-group-addon">name</span>
+                          <input
+                            type="text"
+                            class="form-control"
+                            ng-model="item.Name"
+                            ng-change="checkName($index)"
+                            placeholder="e.g. my-image:my-tag"
+                            auto-focus
+                            data-cy="image-name-input"
+                          />
+                          <span class="input-group-addon" ng-if="!item.Valid">
+                            <pr-icon icon="'x'" mode="'danger'"></pr-icon>
+                          </span>
+                          <span class="input-group-addon" ng-if="item.Valid">
+                            <pr-icon icon="'check'" mode="'success'"></pr-icon>
+                          </span>
+                        </div>
+                        <!-- !name-input -->
+                        <!-- actions -->
+                        <div class="input-group col-sm-2 input-group-sm">
+                          <button class="btn btn-dangerlight btn-only-icon" type="button" ng-click="removeImageName($index)">
+                            <pr-icon icon="'trash-2'"></pr-icon>
+                          </button>
+                        </div>
+                        <!-- !actions -->
+                        <div class="small text-warning" ng-if="!item.Valid">
+                          <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon>
+                          <span ng-if="!item.Unique">The image name must be unique</span>
+                          <span ng-if="item.Unique"
+                            >The image name must consist of between 2 and 255 lowercase alphanumeric characters, '.', '_', or '-' (e.g. 'my-name', or 'abc-123').</span
+                          >
+                        </div>
+                      </div>
+                    </div>
+                  </div>
+                </div>
+              </div>
+              <!-- !name-input-list -->
+              <div class="col-sm-12 form-section-title"> Build method </div>
+              <box-selector options="options" slim="true" value="state.BuildType" on-change="(onChangeBuildType)"></box-selector>
+
+              <!-- web-editor -->
+              <!-- TODO use web-editor-form component -->
+              <div ng-show="state.BuildType === 'editor'">
+                <div class="col-sm-12 form-section-title"> Web editor </div>
+                <div class="form-group">
+                  <span class="col-sm-12 text-muted small">
+                    You can get more information about Dockerfile format in the
+                    <a href="https://docs.docker.com/engine/reference/builder/" target="_blank">official documentation</a>.
+                  </span>
+                </div>
+                <div class="form-group">
+                  <div class="col-sm-12">
+                    <code-editor
+                      identifier="image-build-editor"
+                      text-tip="Define or paste the content of your Dockerfile here"
+                      docker-file="true"
+                      on-change="(editorUpdate)"
+                    ></code-editor>
+                  </div>
+                </div>
+                <div class="col-sm-12 form-section-title"> Upload </div>
+                <div class="form-group">
+                  <div class="col-sm-12">
+                    <div class="form-group">
+                      <span class="col-sm-12 text-muted small">
+                        You can upload files from your local computer for referencing in your Dockerfile (using ADD filename) so they are included in your built image.
+                      </span>
+                    </div>
+                    <button class="btn btn-sm btn-primary" ngf-select="selectAdditionalFiles($files)" ngf-multiple="true">Select files</button>
+                    <span ng-repeat="item in formValues.AdditionalFiles track by $index" class="mx-2"> {{ item.name }} </span>
+                  </div>
+                </div>
+              </div>
+              <!-- !web-editor -->
+              <!-- upload -->
+              <div ng-show="state.BuildType === 'upload'">
+                <div class="col-sm-12 form-section-title"> Upload </div>
+                <div class="form-group">
+                  <span class="col-sm-12 text-muted small">
+                    You can upload a Dockerfile or a tar archive containing a Dockerfile from your computer. When using a tarball, the root folder will be used as the build
+                    context.
+                  </span>
+                </div>
+                <div class="form-group">
+                  <div class="col-sm-12 vertical-center">
+                    <button class="btn btn-sm btn-primary" ngf-select ngf-min-size="10" ng-model="formValues.UploadFile">Select file</button>
+                    <span class="space-left">
+                      {{ formValues.UploadFile.name }}
+                      <span ng-if="!formValues.UploadFile"><pr-icon icon="'x'" mode="'danger'" size="'md'"></pr-icon></span>
+                    </span>
+                  </div>
+                </div>
+                <div ng-if="formValues.UploadFile.type === 'application/gzip' || formValues.UploadFile.type === 'application/x-tar'">
+                  <div class="form-group">
+                    <span class="col-sm-12 text-muted small"> Indicate the path to the Dockerfile within the tarball. </span>
+                  </div>
+                  <div class="form-group">
+                    <label for="image_path" class="col-sm-2 control-label text-left">Dockerfile path</label>
+                    <div class="col-sm-10">
+                      <input type="text" class="form-control" ng-model="formValues.Path" id="image_path" placeholder="Dockerfile" data-cy="image-path-input" />
+                    </div>
+                  </div>
+                </div>
+              </div>
+              <!-- !upload -->
+              <!-- url -->
+              <div ng-show="state.BuildType === 'url'">
+                <div class="col-sm-12 form-section-title"> URL </div>
+                <div class="form-group">
+                  <span class="col-sm-12 small vertical-center">
+                    <pr-icon icon="'info'" mode="'primary'"></pr-icon>
+                    <span class="text-muted"
+                      >Specify the URL to a Dockerfile, a tarball or a public Git repository (suffixed by <b>.git</b>). When using a Git repository URL, build contexts can be
+                      specified as in the <a href="https://docs.docker.com/engine/reference/commandline/build/#git-repositories">Docker documentation.</a></span
+                    >
+                  </span>
+                </div>
+                <div class="form-group">
+                  <label for="image_url" class="col-sm-2 control-label text-left">URL</label>
+                  <div class="col-sm-10">
+                    <input
+                      type="text"
+                      data-cy="image-url-input"
+                      class="form-control"
+                      ng-model="formValues.URL"
+                      id="image_url"
+                      placeholder="https://myhost.mydomain/myimage.tar.gz or https://github.com/myname/myrepo.git#mybranch"
+                    />
+                  </div>
+                </div>
+                <div class="form-group">
+                  <span class="col-sm-12 text-muted small vertical-center">
+                    <pr-icon icon="'info'" mode="'primary'"></pr-icon>
+                    Indicate the path to the Dockerfile within the tarball/repository (ignored when using a Dockerfile).
+                  </span>
+                </div>
+                <div class="form-group">
+                  <label for="image_path" class="col-sm-2 control-label text-left">Dockerfile path</label>
+                  <div class="col-sm-10">
+                    <input type="text" class="form-control" ng-model="formValues.Path" id="image_path" placeholder="Dockerfile" data-cy="image-path-input" />
+                  </div>
+                </div>
+              </div>
+              <!-- !url -->
+              <div ng-if="applicationState.endpoint.mode.agentProxy && applicationState.endpoint.mode.provider === 'DOCKER_SWARM_MODE'">
+                <div class="col-sm-12 form-section-title"> Deployment </div>
+                <!-- node-selection -->
+                <node-selector model="formValues.NodeName" endpoint-id="endpoint.Id"> </node-selector>
+                <!-- !node-selection -->
+              </div>
+              <!-- actions -->
+              <div class="col-sm-12 form-section-title"> Actions </div>
+              <div class="form-group">
+                <div class="col-sm-12">
+                  <button
+                    type="button"
+                    class="btn btn-primary btn-sm"
+                    ng-disabled="state.actionInProgress
+                    || (state.BuildType === 'editor' && formValues.DockerFileContent === '')
+                    || (state.BuildType === 'upload' && (!formValues.UploadFile || !formValues.Path))
+                    || (state.BuildType === 'url' && (!formValues.URL || !formValues.Path))
+                    || (formValues.ImageNames.length === 0 || !validImageNames())"
+                    ng-click="buildImage()"
+                    button-spinner="state.actionInProgress"
+                  >
+                    <span ng-hide="state.actionInProgress">Build the image</span>
+                    <span ng-show="state.actionInProgress">Image building in progress...</span>
+                  </button>
+                  <span class="text-danger" ng-if="state.formValidationError" class="space-left">{{ state.formValidationError }}</span>
+                </div>
+              </div>
+              <!-- !actions -->
+            </form>
+          </uib-tab>
+          <uib-tab index="1" disable="!buildLogs">
+            <uib-tab-heading class="vertical-center"> <pr-icon icon="'file-text'" class="leading-none"></pr-icon> Output </uib-tab-heading>
+            <pre class="log_viewer" data-cy="logViewer">
+              <div ng-repeat="line in buildLogs track by $index" class="line"><p class="inner_line" ng-click="active=!active" ng-class="{'line_selected': active}">{{ line }}</p></div>
+              <div ng-if="!buildLogs.length" class="line"><p class="inner_line">No build output available.</p></div>
+            </pre>
+          </uib-tab>
+        </uib-tabset>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
diff --git a/app/docker/views/images/edit/image.html b/app/docker/views/images/edit/image.html
new file mode 100644
index 0000000..af37cd0
--- /dev/null
+++ b/app/docker/views/images/edit/image.html
@@ -0,0 +1,236 @@
+<page-header title="'Image details'" breadcrumbs="[{label:'Images', link:'docker.images'}, image.Id]"> </page-header>
+
+<div class="row" ng-if="image.RepoTags.length > 0">
+  <div class="col-lg-12 col-md-12 col-xs-12">
+    <rd-widget>
+      <rd-widget-header icon="tag" title-text="Image tags"></rd-widget-header>
+      <rd-widget-body>
+        <form class="form-horizontal">
+          <div class="form-group">
+            <div class="row">
+              <div class="pull-left" ng-repeat="tag in image.RepoTags" style="display: table">
+                <div class="input-group col-md-1 !pl-3.5 !pr-3.5">
+                  <span class="input-group-addon" style="border-right: 1px solid var(--border-input-group-addon-color); border-radius: 4px" data-cy="image-tag-{{ tag }}">{{
+                    tag
+                  }}</span>
+                  <span class="input-group-btn" style="padding: 0px 5px">
+                    <span style="margin: 0px 5px" authorization="DockerImagePush">
+                      <a data-toggle="tooltip" class="btn btn-primary interactive" title="Push to registry" ng-click="pushTag(tag)">
+                        <pr-icon icon="'upload'"></pr-icon>
+                      </a>
+                    </span>
+
+                    <span class="mx-1 my-0" authorization="DockerImageCreate">
+                      <a data-toggle="tooltip" class="btn btn-primary interactive" title="Pull from registry" ng-click="pullTag(tag)">
+                        <pr-icon icon="'download'"></pr-icon>
+                      </a>
+                    </span>
+
+                    <span class="mx-1 my-0" authorization="DockerImageDelete">
+                      <a data-toggle="tooltip" class="btn btn-primary interactive" title="Remove tag" ng-click="removeTag(tag)">
+                        <pr-icon icon="'trash-2'"></pr-icon>
+                      </a>
+                    </span>
+                  </span>
+                </div>
+              </div>
+            </div>
+          </div>
+          <div class="form-group">
+            <div class="col-sm-12">
+              <span class="small text-muted" authorization="DockerImageDelete">
+                Note: you can click on the upload icon <pr-icon icon="'upload'"></pr-icon> to push an image or on the download icon <pr-icon icon="'download'"></pr-icon> to pull an
+                image or on the trash icon <pr-icon icon="'trash-2'"></pr-icon> to delete a tag.
+              </span>
+            </div>
+            <div class="col-sm-12">
+              <span id="downloadResourceHint" class="createResource ml-0" style="display: none">
+                Download in progress...
+                <pr-icon icon="'loader-2'" class-name="'animate-spin-slow ml-0.5'"></pr-icon>
+              </span>
+              <span id="uploadResourceHint" class="createResource ml-0.5" style="display: none">
+                Upload in progress...
+                <pr-icon icon="'loader-2'" class-name="'animate-spin-slow ml-0.5'"></pr-icon>
+              </span>
+            </div>
+          </div>
+        </form>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
+
+<div class="row" authorization="DockerImageCreate">
+  <div class="col-lg-12 col-md-12 col-xs-12">
+    <rd-widget>
+      <rd-widget-header icon="tag" title-text="Tag the image"></rd-widget-header>
+      <rd-widget-body>
+        <form class="form-horizontal">
+          <!-- image-and-registry -->
+          <por-image-registry
+            model="formValues.RegistryModel"
+            label-class="col-sm-1"
+            input-class="col-sm-11"
+            endpoint="endpoint"
+            is-admin="isAdmin"
+            set-validity="setPullImageValidity"
+            check-rate-limits="true"
+          ></por-image-registry>
+          <!-- !image-and-registry -->
+          <!-- tag-note -->
+          <div class="form-group">
+            <div class="col-sm-12">
+              <span class="small text-muted">Note: if you don't specify the tag in the image name, <span class="label label-default">latest</span> will be used.</span>
+            </div>
+          </div>
+          <!-- !tag-note -->
+          <div class="form-group">
+            <div class="col-sm-12">
+              <button type="button" class="btn btn-primary btn-sm !ml-0" ng-disabled="!formValues.RegistryModel.Image" ng-click="tagImage()">Tag</button>
+            </div>
+          </div>
+        </form>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
+
+<div class="row">
+  <div class="col-lg-12 col-md-12 col-xs-12">
+    <rd-widget>
+      <rd-widget-header icon="list" title-text="Image details"></rd-widget-header>
+      <rd-widget-body classes="no-padding">
+        <table class="table">
+          <tbody>
+            <tr>
+              <td class="min-w-[80px]">ID</td>
+              <td>
+                {{ image.Id }}
+                <button authorization="DockerImageDelete" class="btn btn-xs btn-danger" ng-click="removeImage(image.Id)">
+                  <pr-icon icon="'trash-2'"></pr-icon> Delete this image
+                </button>
+                <button
+                  authorization="DockerImageGet"
+                  class="btn btn-xs btn-primary"
+                  ng-click="exportImage(image)"
+                  button-spinner="$ctrl.exportInProgress"
+                  ng-disabled="state.exportInProgress"
+                >
+                  <pr-icon icon="'download'"></pr-icon>
+                  <span ng-hide="state.exportInProgress">Export this image</span>
+                  <span ng-show="state.exportInProgress">Export in progress...</span>
+                </button>
+              </td>
+            </tr>
+            <tr ng-if="image.Parent">
+              <td>Parent</td>
+              <td
+                ><a ui-sref="docker.images.image({id: image.Parent})">{{ image.Parent }}</a></td
+              >
+            </tr>
+            <tr>
+              <td>Size</td>
+              <td>{{ image.Size | humansize }}</td>
+            </tr>
+            <tr>
+              <td>Created</td>
+              <td>{{ image.Created | getisodate }}</td>
+            </tr>
+            <tr>
+              <td>Build</td>
+              <td>Docker {{ image.DockerVersion }} on {{ image.Os }}, {{ image.Architecture }}</td>
+            </tr>
+            <tr ng-if="!(image.Labels | emptyobject)">
+              <td>Labels</td>
+              <td>
+                <table class="table-bordered table-condensed table">
+                  <tr ng-repeat="(k, v) in image.Labels">
+                    <td class="min-w-[80px]">{{ k }}</td>
+                    <td>{{ v }}</td>
+                  </tr>
+                </table>
+              </td>
+            </tr>
+            <tr ng-if="image.Author">
+              <td>Author</td>
+              <td>{{ image.Author }}</td>
+            </tr>
+          </tbody>
+        </table>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
+
+<dockerfile-details ng-if="image" image="image"></dockerfile-details>
+
+<div class="row" ng-if="history.length > 0">
+  <div class="col-lg-12 col-md-12 col-xs-12">
+    <rd-widget>
+      <rd-widget-header icon="list" title-text="Image layers"></rd-widget-header>
+      <rd-widget-body classes="no-padding">
+        <table id="image-layers" class="table">
+          <thead>
+            <th class="whitespace-nowrap">
+              <table-column-header
+                col-title="'Order'"
+                can-sort="true"
+                is-sorted="$ctrl.state.orderBy === 'Order'"
+                is-sorted-desc="$ctrl.state.orderBy === 'Order' && $ctrl.state.reverseOrder"
+                ng-click="$ctrl.changeOrderBy('Order')"
+              ></table-column-header>
+            </th>
+            <th>
+              <table-column-header
+                col-title="'Size'"
+                can-sort="true"
+                is-sorted="$ctrl.state.orderBy === 'Size'"
+                is-sorted-desc="$ctrl.state.orderBy === 'Size' && $ctrl.state.reverseOrder"
+                ng-click="$ctrl.changeOrderBy('Size')"
+              ></table-column-header>
+            </th>
+            <th>
+              <table-column-header
+                col-title="'Layer'"
+                can-sort="true"
+                is-sorted="$ctrl.state.orderBy === 'Layer'"
+                is-sorted-desc="$ctrl.state.orderBy === 'Layer' && $ctrl.state.reverseOrder"
+                ng-click="$ctrl.changeOrderBy('Layer')"
+              ></table-column-header>
+            </th>
+          </thead>
+          <tbody>
+            <tr ng-repeat="layer in history | orderBy:sortType:sortReverse">
+              <td class="whitespace-nowrap">
+                {{ layer.Order }}
+              </td>
+              <td class="whitespace-nowrap">
+                {{ layer.Size | humansize }}
+              </td>
+              <td class="expand">
+                <div ng-if="layer.CreatedBy.length > 130">
+                  <span id="layer-command-{{ $index }}-full" style="display: none">
+                    {{ layer.CreatedBy | imagelayercommand }}
+                  </span>
+                  <span id="layer-command-{{ $index }}-short">
+                    {{ layer.CreatedBy | imagelayercommand | truncate: 130 }}
+                    <span ng-if="layer.CreatedBy.length > 130" class="ml-1">
+                      <a id="layer-command-expander{{ $index }}" class="btn" ng-click="toggleLayerCommand($index)">
+                        <pr-icon icon="'plus'" mode="'alt'"></pr-icon>
+                      </a>
+                    </span>
+                  </span>
+                </div>
+                <div ng-if="layer.CreatedBy.length <= 130">
+                  <span id="layer-command-{{ $index }}-full">
+                    {{ layer.CreatedBy | imagelayercommand }}
+                  </span>
+                </div>
+              </td>
+            </tr>
+          </tbody>
+        </table>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
diff --git a/app/docker/views/images/edit/imageController.js b/app/docker/views/images/edit/imageController.js
new file mode 100644
index 0000000..aee6827
--- /dev/null
+++ b/app/docker/views/images/edit/imageController.js
@@ -0,0 +1,219 @@
+import _ from 'lodash-es';
+import { PorImageRegistryModel } from '@/docker/models/porImageRegistry';
+import { confirmImageExport } from '@/react/docker/images/common/ConfirmExportModal';
+import { confirmDelete } from '@@/modals/confirm';
+
+angular.module('portainer.docker').controller('ImageController', [
+  '$async',
+  '$q',
+  '$scope',
+  '$transition$',
+  '$state',
+  'Authentication',
+  'ImageService',
+  'ImageHelper',
+  'RegistryService',
+  'Notifications',
+  'HttpRequestHelper',
+  'FileSaver',
+  'Blob',
+  'endpoint',
+  'RegistryModalService',
+  function (
+    $async,
+    $q,
+    $scope,
+    $transition$,
+    $state,
+    Authentication,
+    ImageService,
+    ImageHelper,
+    RegistryService,
+    Notifications,
+    HttpRequestHelper,
+    FileSaver,
+    Blob,
+    endpoint,
+    RegistryModalService
+  ) {
+    $scope.endpoint = endpoint;
+    $scope.isAdmin = Authentication.isAdmin();
+
+    $scope.formValues = {
+      RegistryModel: new PorImageRegistryModel(),
+    };
+
+    $scope.state = {
+      exportInProgress: false,
+      pullImageValidity: false,
+    };
+
+    $scope.sortType = 'Order';
+    $scope.sortReverse = false;
+
+    $scope.order = function (sortType) {
+      $scope.sortReverse = $scope.sortType === sortType ? !$scope.sortReverse : false;
+      $scope.sortType = sortType;
+    };
+
+    $scope.toggleLayerCommand = function (layerId) {
+      $('#layer-command-expander' + layerId + ' span').toggleClass('glyphicon-plus-sign glyphicon-minus-sign');
+      $('#layer-command-' + layerId + '-short').toggle();
+      $('#layer-command-' + layerId + '-full').toggle();
+    };
+
+    $scope.setPullImageValidity = setPullImageValidity;
+    function setPullImageValidity(validity) {
+      $scope.state.pullImageValidity = validity;
+    }
+
+    $scope.tagImage = function () {
+      const registryModel = $scope.formValues.RegistryModel;
+
+      const { repo, tag } = ImageHelper.createImageConfigForContainer(registryModel);
+
+      ImageService.tagImage($transition$.params().id, repo, tag)
+        .then(function success() {
+          Notifications.success('Success', 'Image successfully tagged');
+          $state.go('docker.images.image', { id: $transition$.params().id }, { reload: true });
+        })
+        .catch(function error(err) {
+          Notifications.error('Failure', err, 'Unable to tag image');
+        });
+    };
+
+    $scope.pushTag = pushTag;
+
+    async function pushTag(repository) {
+      return $async(async () => {
+        try {
+          const registryModel = await RegistryModalService.registryModal(repository, $scope.registries);
+
+          if (registryModel) {
+            $('#uploadResourceHint').show();
+            await ImageService.pushImage(registryModel);
+            Notifications.success('Image successfully pushed', repository);
+          }
+        } catch (err) {
+          Notifications.error('Failure', err, 'Unable to push image to repository');
+        } finally {
+          $('#uploadResourceHint').hide();
+        }
+      });
+    }
+
+    $scope.pullTag = pullTag;
+    async function pullTag(repository) {
+      return $async(async () => {
+        try {
+          const registryModel = await RegistryModalService.registryModal(repository, $scope.registries);
+          if (registryModel) {
+            $('#downloadResourceHint').show();
+            await ImageService.pullImage(registryModel);
+            Notifications.success('Image successfully pulled', repository);
+          }
+        } catch (err) {
+          Notifications.error('Failure', err, 'Unable to pull image from repository');
+        } finally {
+          $('#downloadResourceHint').hide();
+        }
+      });
+    }
+
+    $scope.removeTag = function (repository) {
+      return $async(async () => {
+        if (!(await confirmDelete('Are you sure you want to delete this tag?'))) {
+          return;
+        }
+
+        ImageService.deleteImage(repository, false)
+          .then(function success() {
+            if ($scope.image.RepoTags.length === 1) {
+              Notifications.success('Image successfully deleted', repository);
+              $state.go('docker.images', {}, { reload: true });
+            } else {
+              Notifications.success('Tag successfully deleted', repository);
+              $state.go('docker.images.image', { id: $transition$.params().id }, { reload: true });
+            }
+          })
+          .catch(function error(err) {
+            Notifications.error('Failure', err, 'Unable to remove image');
+          });
+      });
+    };
+
+    $scope.removeImage = function (id) {
+      return $async(async () => {
+        if (!(await confirmDelete('Deleting this image will also delete all associated tags. Are you sure you want to delete this image?'))) {
+          return;
+        }
+
+        ImageService.deleteImage(id, false)
+          .then(function success() {
+            Notifications.success('Image successfully deleted', id);
+            $state.go('docker.images', {}, { reload: true });
+          })
+          .catch(function error(err) {
+            Notifications.error('Failure', err, 'Unable to remove image');
+          });
+      });
+    };
+
+    function exportImage(image) {
+      HttpRequestHelper.setPortainerAgentTargetHeader(image.NodeName);
+      $scope.state.exportInProgress = true;
+      ImageService.downloadImages([{ tags: image.RepoTags, id: image.Id }])
+        .then(function success(data) {
+          var downloadData = new Blob([data], { type: 'application/x-tar' });
+          FileSaver.saveAs(downloadData, 'images.tar');
+          Notifications.success('Success', 'Image successfully downloaded');
+        })
+        .catch(function error(err) {
+          Notifications.error('Failure', err, 'Unable to download image');
+        })
+        .finally(function final() {
+          $scope.state.exportInProgress = false;
+        });
+    }
+
+    $scope.exportImage = function (image) {
+      if (image.RepoTags.length === 0 || _.includes(image.RepoTags, '<none>')) {
+        Notifications.warning('', 'Cannot download a untagged image');
+        return;
+      }
+
+      confirmImageExport().then(function (confirmed) {
+        if (!confirmed) {
+          return;
+        }
+        exportImage(image);
+      });
+    };
+
+    async function initView() {
+      HttpRequestHelper.setPortainerAgentTargetHeader($transition$.params().nodeName);
+
+      try {
+        $scope.registries = await RegistryService.loadRegistriesForDropdown(endpoint.Id);
+      } catch (err) {
+        this.Notifications.error('Failure', err, 'Unable to load registries');
+      }
+
+      $q.all({
+        image: ImageService.image($transition$.params().id),
+        history: ImageService.history($transition$.params().id),
+      })
+        .then(function success(data) {
+          $scope.image = data.image;
+          $scope.history = data.history;
+          $scope.image.Env = _.sortBy($scope.image.Env, _.toLower);
+        })
+        .catch(function error(err) {
+          Notifications.error('Failure', err, 'Unable to retrieve image details');
+          $state.go('docker.images');
+        });
+    }
+
+    initView();
+  },
+]);
diff --git a/app/docker/views/images/import/importImageController.js b/app/docker/views/images/import/importImageController.js
new file mode 100644
index 0000000..b59c38c
--- /dev/null
+++ b/app/docker/views/images/import/importImageController.js
@@ -0,0 +1,78 @@
+import { PorImageRegistryModel } from '@/docker/models/porImageRegistry';
+
+angular.module('portainer.docker').controller('ImportImageController', [
+  '$scope',
+  '$state',
+  '$async',
+  'ImageService',
+  'Notifications',
+  'HttpRequestHelper',
+  'Authentication',
+  'ImageHelper',
+  'endpoint',
+  function ($scope, $state, $async, ImageService, Notifications, HttpRequestHelper, Authentication, ImageHelper, endpoint) {
+    $scope.state = {
+      actionInProgress: false,
+    };
+
+    $scope.endpoint = endpoint;
+
+    $scope.isAdmin = Authentication.isAdmin();
+
+    $scope.formValues = {
+      UploadFile: null,
+      NodeName: null,
+      RegistryModel: new PorImageRegistryModel(),
+    };
+
+    $scope.setPullImageValidity = setPullImageValidity;
+    function setPullImageValidity(validity) {
+      $scope.state.pullImageValidity = validity;
+    }
+
+    async function tagImage(id) {
+      const registryModel = $scope.formValues.RegistryModel;
+      if (registryModel.Image) {
+        const { repo, tag } = ImageHelper.createImageConfigForContainer(registryModel);
+        try {
+          await ImageService.tagImage(id, repo, tag);
+        } catch (err) {
+          Notifications.error('Failure', err, 'Unable to tag image');
+        }
+      }
+    }
+
+    $scope.uploadImage = function () {
+      return $async(uploadImageAsync);
+    };
+
+    async function uploadImageAsync() {
+      $scope.state.actionInProgress = true;
+
+      var nodeName = $scope.formValues.NodeName;
+      HttpRequestHelper.setPortainerAgentTargetHeader(nodeName);
+      var file = $scope.formValues.UploadFile;
+      try {
+        const { data } = await ImageService.uploadImage(file);
+        if (data.error) {
+          Notifications.error('Failure', data.error, 'Unable to upload image');
+        } else if (data.stream) {
+          // docker has /n at the end of the stream, podman doesn't
+          var regex = /Loaded.*?: (.*?)(?:\n|$)/g;
+          var imageIds = regex.exec(data.stream);
+          if (imageIds && imageIds.length == 2) {
+            await tagImage(imageIds[1]);
+            $state.go('docker.images.image', { id: imageIds[1] }, { reload: true });
+          }
+          Notifications.success('Success', 'Images successfully uploaded');
+        } else {
+          Notifications.success('Success', 'The uploaded tar file contained multiple images. The provided tag therefore has been ignored.');
+        }
+      } catch (err) {
+        Notifications.error('Failure', err, 'Unable to upload image');
+      } finally {
+        $scope.state.actionInProgress = false;
+      }
+    }
+  },
+]);
diff --git a/app/docker/views/images/import/importimage.html b/app/docker/views/images/import/importimage.html
new file mode 100644
index 0000000..9780dc9
--- /dev/null
+++ b/app/docker/views/images/import/importimage.html
@@ -0,0 +1,70 @@
+<page-header title="'Import image'" breadcrumbs="[{label:'Images', link:'docker.images'}, 'Import image']"> </page-header>
+
+<div class="row">
+  <div class="col-sm-12">
+    <rd-widget>
+      <rd-widget-body>
+        <form class="form-horizontal">
+          <!-- upload -->
+          <div class="col-sm-12 form-section-title"> Upload </div>
+          <div class="form-group">
+            <span class="col-sm-12 text-muted small"> You can upload a tar archive containing your images. </span>
+          </div>
+          <div class="form-group">
+            <div class="col-sm-12 vertical-center">
+              <button type="button" class="btn btn-sm btn-primary !ml-0" ngf-select ngf-min-size="10" ng-model="formValues.UploadFile">Select file</button>
+              <span class="ml-1">
+                {{ formValues.UploadFile.name }}
+                <pr-icon icon="'x'" mode="'danger'" ng-if="!formValues.UploadFile"></pr-icon>
+              </span>
+            </div>
+          </div>
+          <!-- !upload -->
+          <div ng-if="applicationState.endpoint.mode.agentProxy && applicationState.endpoint.mode.provider === 'DOCKER_SWARM_MODE'">
+            <div class="col-sm-12 form-section-title"> Deployment </div>
+            <!-- node-selection -->
+            <node-selector model="formValues.NodeName" endpoint-id="endpoint.Id"> </node-selector>
+            <!-- !node-selection -->
+          </div>
+          <div class="row" authorization="DockerImageCreate">
+            <div class="col-lg-12 col-md-12 col-xs-12 p-0">
+              <rd-widget>
+                <rd-widget-header icon="tag" title-text="Tag the image"></rd-widget-header>
+                <rd-widget-body>
+                  <!-- image-and-registry -->
+                  <por-image-registry
+                    model="formValues.RegistryModel"
+                    label-class="col-sm-1"
+                    input-class="col-sm-11"
+                    endpoint="endpoint"
+                    is-admin="isAdmin"
+                    set-validity="setPullImageValidity"
+                    check-rate-limits="true"
+                  ></por-image-registry>
+                </rd-widget-body>
+              </rd-widget>
+            </div>
+          </div>
+          <!-- actions -->
+          <div class="col-sm-12 form-section-title"> Actions </div>
+          <div class="form-group">
+            <div class="col-sm-12">
+              <button
+                type="button"
+                class="btn btn-primary btn-sm !ml-0"
+                ng-disabled="state.actionInProgress || !formValues.UploadFile"
+                ng-click="uploadImage()"
+                button-spinner="state.actionInProgress"
+              >
+                <span ng-hide="state.actionInProgress">Upload</span>
+                <span ng-show="state.actionInProgress">Images uploading in progress...</span>
+              </button>
+              <span class="text-danger ml-1" ng-if="state.formValidationError">{{ state.formValidationError }}</span>
+            </div>
+          </div>
+          <!-- !actions -->
+        </form>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
diff --git a/app/docker/views/networks/create/createNetworkController.js b/app/docker/views/networks/create/createNetworkController.js
new file mode 100644
index 0000000..5ef3dd4
--- /dev/null
+++ b/app/docker/views/networks/create/createNetworkController.js
@@ -0,0 +1,327 @@
+import _ from 'lodash-es';
+import { AccessControlFormData } from '../../../../portainer/components/accessControlForm/porAccessControlFormModel';
+import { MacvlanFormData } from '../../../components/network-macvlan-form/networkMacvlanFormModel';
+
+angular.module('portainer.docker').controller('CreateNetworkController', [
+  '$q',
+  '$scope',
+  '$state',
+  'PluginService',
+  'Notifications',
+  'NetworkService',
+  'LabelHelper',
+  'Authentication',
+  'ResourceControlService',
+  'FormValidator',
+  'HttpRequestHelper',
+  'endpoint',
+  function ($q, $scope, $state, PluginService, Notifications, NetworkService, LabelHelper, Authentication, ResourceControlService, FormValidator, HttpRequestHelper, endpoint) {
+    $scope.endpoint = endpoint;
+
+    $scope.formValues = {
+      DriverOptions: [],
+      IPV4: {
+        Subnet: '',
+        Gateway: '',
+        IPRange: '',
+        AuxiliaryAddresses: [],
+      },
+      IPV6: {
+        Subnet: '',
+        Gateway: '',
+        IPRange: '',
+        AuxiliaryAddresses: [],
+      },
+      Labels: [],
+      AccessControlData: new AccessControlFormData(),
+      NodeName: null,
+      Macvlan: new MacvlanFormData(),
+    };
+
+    $scope.state = {
+      formValidationError: '',
+      actionInProgress: false,
+    };
+
+    $scope.availableNetworkDrivers = [];
+
+    $scope.config = {
+      Driver: 'bridge',
+      CheckDuplicate: true,
+      Internal: false,
+      Attachable: false,
+      EnableIPv6: false,
+      // Force IPAM Driver to 'default', should not be required.
+      // See: https://github.com/docker/docker/issues/25735
+      IPAM: {
+        Driver: 'default',
+        Config: [],
+      },
+      Labels: {},
+    };
+
+    $scope.addDriverOption = function () {
+      $scope.formValues.DriverOptions.push({
+        name: '',
+        value: '',
+      });
+    };
+
+    $scope.removeDriverOption = function (index) {
+      $scope.formValues.DriverOptions.splice(index, 1);
+    };
+
+    $scope.addLabel = function () {
+      $scope.formValues.Labels.push({
+        key: '',
+        value: '',
+      });
+    };
+
+    $scope.removeLabel = function (index) {
+      $scope.formValues.Labels.splice(index, 1);
+    };
+
+    $scope.addIPV4AuxAddress = function () {
+      $scope.formValues.IPV4.AuxiliaryAddresses.push('');
+    };
+
+    $scope.addIPV6AuxAddress = function () {
+      $scope.formValues.IPV6.AuxiliaryAddresses.push('');
+    };
+
+    $scope.removeIPV4AuxAddress = function (index) {
+      $scope.formValues.IPV4.AuxiliaryAddresses.splice(index, 1);
+      $scope.state.IPV4AuxiliaryAddressesError.splice(index, 1);
+    };
+
+    $scope.removeIPV6AuxAddress = function (index) {
+      $scope.formValues.IPV6.AuxiliaryAddresses.splice(index, 1);
+      $scope.state.IPV6AuxiliaryAddressesError.splice(index, 1);
+    };
+
+    function checkAuxiliaryAddress(excludedIP, gateway) {
+      const split = _.split(excludedIP, '=');
+
+      if (split.length === 2) {
+        return split[1] === gateway;
+      }
+      return excludedIP === gateway;
+    }
+
+    $scope.checkIPV4AuxiliaryAddress = function (index) {
+      $scope.state.IPV4AuxiliaryAddressesError[index] = checkAuxiliaryAddress($scope.formValues.IPV4.AuxiliaryAddresses[index], $scope.formValues.IPV4.Gateway);
+    };
+
+    $scope.checkIPV6AuxiliaryAddress = function (index) {
+      $scope.state.IPV6AuxiliaryAddressesError[index] = checkAuxiliaryAddress($scope.formValues.IPV6.AuxiliaryAddresses[index], $scope.formValues.IPV6.Gateway);
+    };
+
+    $scope.isValid = function () {
+      const validIPV4 = !_.reduce($scope.state.IPV4AuxiliaryAddressesError, (acc, item) => acc || item, false);
+      const validIPV6 = !_.reduce($scope.state.IPV6AuxiliaryAddressesError, (acc, item) => acc || item, false);
+      return validIPV4 && validIPV6;
+    };
+
+    function prepareAuxiliaryAddresses(ipamConfig, ipFormValues) {
+      ipamConfig.AuxiliaryAddresses = {};
+      _.forEach(ipFormValues.AuxiliaryAddresses, (auxAddress, index) => {
+        const split = _.split(auxAddress, '=');
+        if (split.length === 2) {
+          ipamConfig.AuxiliaryAddresses[split[0]] = split[1];
+        } else {
+          ipamConfig.AuxiliaryAddresses['device' + index] = auxAddress;
+        }
+      });
+    }
+
+    function prepareIPAMConfiguration(config) {
+      if ($scope.formValues.IPV4.Subnet) {
+        let ipamConfig = {};
+        ipamConfig.Subnet = $scope.formValues.IPV4.Subnet;
+        if ($scope.formValues.IPV4.Gateway) {
+          ipamConfig.Gateway = $scope.formValues.IPV4.Gateway;
+        }
+        if ($scope.formValues.IPV4.IPRange) {
+          ipamConfig.IPRange = $scope.formValues.IPV4.IPRange;
+        }
+        if ($scope.formValues.IPV4.AuxiliaryAddresses.length) {
+          prepareAuxiliaryAddresses(ipamConfig, $scope.formValues.IPV4);
+        }
+        config.IPAM.Config.push(ipamConfig);
+      }
+      if ($scope.formValues.IPV6.Subnet) {
+        let ipamConfig = {};
+        ipamConfig.Subnet = $scope.formValues.IPV6.Subnet;
+        if ($scope.formValues.IPV6.Gateway) {
+          ipamConfig.Gateway = $scope.formValues.IPV6.Gateway;
+        }
+        if ($scope.formValues.IPV6.IPRange) {
+          ipamConfig.IPRange = $scope.formValues.IPV6.IPRange;
+        }
+        if ($scope.formValues.IPV6.AuxiliaryAddresses.length) {
+          prepareAuxiliaryAddresses(ipamConfig, $scope.formValues.IPV6);
+        }
+        config.EnableIPv6 = true;
+        config.IPAM.Config.push(ipamConfig);
+      }
+    }
+
+    function prepareDriverOptions(config) {
+      var options = {};
+      $scope.formValues.DriverOptions.forEach(function (option) {
+        options[option.name] = option.value;
+      });
+      config.Options = options;
+    }
+
+    function prepareLabelsConfig(config) {
+      config.Labels = LabelHelper.fromKeyValueToLabelHash($scope.formValues.Labels);
+    }
+
+    function prepareConfiguration() {
+      var config = angular.copy($scope.config);
+      prepareIPAMConfiguration(config);
+      prepareDriverOptions(config);
+      prepareLabelsConfig(config);
+      return config;
+    }
+
+    function modifyNetworkConfigurationForMacvlanConfigOnly(config) {
+      config.Internal = null;
+      config.Attachable = null;
+      config.ConfigOnly = true;
+      config.Options.parent = $scope.formValues.Macvlan.ParentNetworkCard;
+    }
+
+    function modifyNetworkConfigurationForMacvlanConfigFrom(config, selectedNetworkConfig) {
+      config.ConfigFrom = {
+        Network: selectedNetworkConfig.Name,
+      };
+      if ($scope.applicationState.endpoint.mode.provider === 'DOCKER_SWARM_MODE') {
+        config.Scope = 'swarm';
+      } else {
+        config.Scope = 'local';
+      }
+    }
+
+    $scope.onChangeInternal = function (enable) {
+      $scope.$evalAsync(() => {
+        $scope.config.Internal = enable;
+      });
+    };
+
+    $scope.onChangeAttachable = function (enable) {
+      $scope.$evalAsync(() => {
+        $scope.config.Attachable = enable;
+      });
+    };
+
+    function validateForm(accessControlData, isAdmin) {
+      $scope.state.formValidationError = '';
+      var error = FormValidator.validateAccessControl(accessControlData, isAdmin);
+
+      if (error) {
+        $scope.state.formValidationError = error;
+        return false;
+      }
+      return true;
+    }
+
+    function createNetwork(context) {
+      $scope.state.actionInProgress = true;
+      NetworkService.create(context.networkConfiguration, { nodeName: context.nodeName, agentManagerOperation: context.managerOperation })
+        .then(function success(data) {
+          const userId = context.userDetails.ID;
+          const accessControlData = context.accessControlData;
+          const resourceControl = data.Portainer.ResourceControl;
+          return ResourceControlService.applyResourceControl(userId, accessControlData, resourceControl);
+        })
+        .then(function success() {
+          Notifications.success('Success', 'Network successfully created');
+          if (context.reload) {
+            $state.go(
+              'docker.networks',
+              {},
+              {
+                reload: true,
+              }
+            );
+          }
+        })
+        .catch(function error(err) {
+          Notifications.error('Failure', err, 'An error occurred during network creation');
+        })
+        .finally(function final() {
+          $scope.state.actionInProgress = false;
+        });
+    }
+
+    $scope.create = function () {
+      var networkConfiguration = prepareConfiguration();
+      var accessControlData = $scope.formValues.AccessControlData;
+      var userDetails = Authentication.getUserDetails();
+      var isAdmin = Authentication.isAdmin();
+
+      if (!validateForm(accessControlData, isAdmin)) {
+        return;
+      }
+
+      var creationContext = {
+        nodeName: $scope.formValues.NodeName,
+        managerOperation: false,
+        networkConfiguration: networkConfiguration,
+        userDetails: userDetails,
+        accessControlData: accessControlData,
+        reload: true,
+      };
+
+      if ($scope.applicationState.endpoint.mode.agentProxy && $scope.applicationState.endpoint.mode.provider === 'DOCKER_SWARM_MODE' && $scope.config.Driver === 'overlay') {
+        creationContext.managerOperation = true;
+      }
+
+      if ($scope.config.Driver === 'macvlan') {
+        if ($scope.formValues.Macvlan.Scope === 'local') {
+          modifyNetworkConfigurationForMacvlanConfigOnly(networkConfiguration);
+        } else if ($scope.formValues.Macvlan.Scope === 'swarm') {
+          var selectedNetworkConfig = $scope.formValues.Macvlan.SelectedNetworkConfig;
+          modifyNetworkConfigurationForMacvlanConfigFrom(networkConfiguration, selectedNetworkConfig);
+          creationContext.nodeName = selectedNetworkConfig.NodeName;
+        }
+      }
+
+      if (
+        $scope.config.Driver === 'macvlan' &&
+        $scope.formValues.Macvlan.Scope === 'local' &&
+        $scope.applicationState.endpoint.mode.agentProxy &&
+        $scope.applicationState.endpoint.mode.provider === 'DOCKER_SWARM_MODE'
+      ) {
+        var selectedNodes = $scope.formValues.Macvlan.DatatableState.selectedItems;
+        selectedNodes.forEach(function (node, idx) {
+          creationContext.nodeName = node.Hostname;
+          creationContext.reload = idx === selectedNodes.length - 1 ? true : false;
+          createNetwork(creationContext);
+        });
+      } else {
+        createNetwork(creationContext);
+      }
+    };
+
+    function initView() {
+      var apiVersion = $scope.applicationState.endpoint.apiVersion;
+      $scope.state.IPV4AuxiliaryAddressesError = [];
+      $scope.state.IPV6AuxiliaryAddressesError = [];
+
+      PluginService.networkPlugins(apiVersion < 1.25)
+        .then(function success(data) {
+          $scope.availableNetworkDrivers = data;
+          $scope.availableNetworkDrivers = _.filter($scope.availableNetworkDrivers, (driver) => driver !== 'host' && driver !== 'null');
+        })
+        .catch(function error(err) {
+          Notifications.error('Failure', err, 'Unable to retrieve network drivers');
+        });
+    }
+
+    initView();
+  },
+]);
diff --git a/app/docker/views/networks/create/createnetwork.html b/app/docker/views/networks/create/createnetwork.html
new file mode 100644
index 0000000..71bf696
--- /dev/null
+++ b/app/docker/views/networks/create/createnetwork.html
@@ -0,0 +1,308 @@
+<page-header title="'Create network'" breadcrumbs="[{label:'Networks', link:'docker.networks'}, 'Add network']"> </page-header>
+
+<div class="row">
+  <div class="col-lg-12 col-md-12 col-xs-12">
+    <rd-widget>
+      <rd-widget-body>
+        <form class="form-horizontal" name="networkCreationForm">
+          <!-- name-input -->
+          <div class="form-group">
+            <label for="network_name" class="col-sm-2 col-lg-1 control-label text-left">Name</label>
+            <div class="col-sm-10 col-lg-11">
+              <input type="text" class="form-control" ng-model="config.Name" id="network_name" placeholder="e.g. myNetwork" data-cy="network-name-input" />
+            </div>
+          </div>
+          <!-- !name-input -->
+          <div class="col-sm-12 form-section-title"> Driver configuration </div>
+          <!-- driver-input -->
+          <div class="form-group">
+            <label for="network_driver" class="col-sm-2 col-lg-1 control-label text-left">Driver</label>
+            <div class="col-sm-10 col-lg-11">
+              <select
+                class="form-control"
+                ng-options="driver for driver in availableNetworkDrivers"
+                ng-model="config.Driver"
+                ng-if="availableNetworkDrivers.length > 0"
+                data-cy="network-driver-select"
+                id="network_driver"
+              >
+                <option disabled hidden value="">Select a driver</option>
+              </select>
+              <input
+                type="text"
+                class="form-control"
+                ng-model="config.Driver"
+                id="network_driver"
+                placeholder="e.g. driverName"
+                ng-if="availableNetworkDrivers.length === 0"
+                data-cy="network-driver-input"
+              />
+            </div>
+          </div>
+          <!-- !driver-input -->
+          <!-- driver-options -->
+          <div class="form-group">
+            <div class="col-sm-12 mt-1">
+              <label class="control-label text-left">
+                Driver options
+                <portainer-tooltip message="'Driver options are specific to the selected driver. Please refer to the selected driver documentation.'"></portainer-tooltip>
+              </label>
+            </div>
+            <!-- driver-options-input-list -->
+            <div class="col-sm-12 form-inline mt-2">
+              <div ng-repeat="option in formValues.DriverOptions" class="mt-1">
+                <div class="input-group col-sm-5 input-group-sm">
+                  <span class="input-group-addon">name</span>
+                  <input
+                    type="text"
+                    class="form-control"
+                    ng-model="option.name"
+                    placeholder="e.g. com.docker.network.bridge.enable_icc"
+                    data-cy="network-driver-option-name-input"
+                  />
+                </div>
+                <div class="input-group col-sm-6 input-group-sm">
+                  <span class="input-group-addon">value</span>
+                  <input type="text" class="form-control" ng-model="option.value" placeholder="e.g. true" data-cy="network-driver-option-value-input" />
+                  <span class="input-group-btn">
+                    <button class="btn btn-dangerlight" type="button" ng-click="removeDriverOption($index)">
+                      <pr-icon icon="'trash-2'" size="'md'"></pr-icon>
+                    </button>
+                  </span>
+                </div>
+              </div>
+              <div class="small interactive text-muted vertical-center mt-1" ng-click="addDriverOption()"> <pr-icon icon="'plus'" size="'md'"></pr-icon> Add driver option </div>
+            </div>
+            <!-- !driver-options-input-list -->
+          </div>
+          <!-- !driver-options -->
+          <!-- macvlan-management -->
+          <network-macvlan-form ng-show="config.Driver === 'macvlan'" data="formValues.Macvlan" application-state="applicationState"></network-macvlan-form>
+          <!-- !macvlan-management -->
+          <div ng-hide="config.Driver === 'macvlan' && formValues.Macvlan.Scope === 'swarm'">
+            <div class="col-sm-12 form-section-title"> IPV4 Network configuration </div>
+            <!-- subnet-gateway-inputs -->
+            <div class="form-group">
+              <label for="ipv4_network_subnet" class="col-sm-2 col-lg-1 control-label text-left">Subnet</label>
+              <div class="col-sm-4 col-lg-5">
+                <input
+                  type="text"
+                  class="form-control"
+                  ng-model="formValues.IPV4.Subnet"
+                  id="ipv4_network_subnet"
+                  placeholder="e.g. 172.20.0.0/16"
+                  data-cy="network-ipv4-subnet-input"
+                />
+              </div>
+              <label for="ipv4_network_gateway" class="col-sm-2 col-lg-1 control-label text-left">Gateway</label>
+              <div class="col-sm-4 col-lg-5">
+                <input
+                  type="text"
+                  class="form-control"
+                  ng-model="formValues.IPV4.Gateway"
+                  id="ipv4_network_gateway"
+                  placeholder="e.g. 172.20.10.11"
+                  data-cy="network-ipv4-gateway-input"
+                />
+              </div>
+            </div>
+            <!-- !subnet-gateway-inputs -->
+            <!-- iprange-auxaddr-inputs -->
+            <div class="form-group">
+              <label for="ipv4_network_iprange" class="col-sm-2 col-lg-1 control-label text-left">IP range</label>
+              <div class="col-sm-4 col-lg-5">
+                <input
+                  type="text"
+                  class="form-control"
+                  ng-model="formValues.IPV4.IPRange"
+                  id="ipv4_network_iprange"
+                  placeholder="e.g. 172.20.10.128/25"
+                  data-cy="network-ipv4-iprange-input"
+                />
+              </div>
+            </div>
+            <div ng-repeat="auxAddress in formValues.IPV4.AuxiliaryAddresses track by $index" class="form-group">
+              <label for="ipv4_network_auxaddr_{{ $index }}" class="col-sm-2 col-lg-1 control-label text-left">Exclude IP</label>
+              <div class="col-sm-4 col-lg-5">
+                <input
+                  type="text"
+                  data-cy="network-ipv4-auxaddr-input"
+                  class="form-control"
+                  ng-model="formValues.IPV4.AuxiliaryAddresses[$index]"
+                  ng-change="checkIPV4AuxiliaryAddress($index)"
+                  id="ipv4_network_auxaddr_{{ $index }}"
+                  placeholder="e.g. my-router=172.20.10.129"
+                />
+              </div>
+              <button class="btn btn-dangerlight" type="button" ng-click="removeIPV4AuxAddress($index)">
+                <pr-icon icon="'trash-2'" size="'md'"></pr-icon>
+              </button>
+              <div class="col-sm-12 small text-warning" ng-if="state.IPV4AuxiliaryAddressesError[$index]">
+                <p class="vertical-center"> <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon> Exclude ip cannot be the same as gateway.</p>
+              </div>
+            </div>
+            <!-- !iprange-auxaddr-inputs -->
+            <div class="form-group">
+              <div class="col-sm-12 small interactive text-muted vertical-center" ng-click="addIPV4AuxAddress()">
+                <pr-icon icon="'plus'" size="'md'"></pr-icon> Add excluded IP
+              </div>
+            </div>
+          </div>
+          <div ng-show="config.Driver === 'bridge' || config.Driver === 'ipvlan' || (config.Driver === 'macvlan' && formValues.Macvlan.Scope !== 'swarm')">
+            <div class="col-sm-12 form-section-title"> IPV6 Network configuration </div>
+            <!-- subnet-gateway-inputs -->
+            <div class="form-group">
+              <label for="ipv6_network_subnet" class="col-sm-2 col-lg-1 control-label text-left">Subnet</label>
+              <div class="col-sm-4 col-lg-5">
+                <input
+                  type="text"
+                  class="form-control"
+                  ng-model="formValues.IPV6.Subnet"
+                  id="ipv6_network_subnet"
+                  placeholder="e.g. 2001:db8::/48"
+                  data-cy="network-ipv6-subnet-input"
+                />
+              </div>
+              <label for="ipv6_network_gateway" class="col-sm-2 col-lg-1 control-label text-left">Gateway</label>
+              <div class="col-sm-4 col-lg-5">
+                <input
+                  type="text"
+                  class="form-control"
+                  ng-model="formValues.IPV6.Gateway"
+                  id="ipv6_network_gateway"
+                  placeholder="e.g. 2001:db8::1"
+                  data-cy="network-ipv6-gateway-input"
+                />
+              </div>
+            </div>
+            <!-- !subnet-gateway-inputs -->
+            <!-- iprange-auxaddr-inputs -->
+            <div class="form-group">
+              <label for="ipv6_network_iprange" class="col-sm-2 col-lg-1 control-label text-left">IP range</label>
+              <div class="col-sm-4 col-lg-5">
+                <input
+                  type="text"
+                  class="form-control"
+                  ng-model="formValues.IPV6.IPRange"
+                  id="ipv6_network_iprange"
+                  placeholder="e.g. 2001:db8::/64"
+                  data-cy="network-ipv6-iprange-input"
+                />
+              </div>
+            </div>
+            <div ng-repeat="auxAddress in formValues.IPV6.AuxiliaryAddresses track by $index" class="form-group">
+              <label for="ipv6_network_auxaddr_{{ $index }}" class="col-sm-2 col-lg-1 control-label text-left">Exclude IP</label>
+              <div class="col-sm-4 col-lg-5">
+                <input
+                  type="text"
+                  data-cy="network-ipv6-auxaddr-input"
+                  class="form-control"
+                  ng-model="formValues.IPV6.AuxiliaryAddresses[$index]"
+                  ng-change="checkIPV6AuxiliaryAddress($index)"
+                  id="ipv6_network_auxaddr_{{ $index }}"
+                  placeholder="e.g. my-router=2001:db8::1"
+                />
+              </div>
+              <button class="btn btn-dangerlight" type="button" ng-click="removeIPV6AuxAddress($index)">
+                <pr-icon icon="'trash-2'" size="'md'"></pr-icon>
+              </button>
+              <div class="col-sm-12 small text-warning" ng-show="state.IPV6AuxiliaryAddressesError[$index]">
+                <p class="vertical-center"> <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon> Exclude ip cannot be the same as gateway.</p>
+              </div>
+            </div>
+            <!-- !iprange-auxaddr-inputs -->
+            <div class="form-group">
+              <div class="col-sm-12 small interactive text-muted vertical-center" ng-click="addIPV6AuxAddress()">
+                <pr-icon icon="'plus'" size="'md'"></pr-icon> Add excluded IP
+              </div>
+            </div>
+          </div>
+          <div class="col-sm-12 form-section-title"> Advanced configuration </div>
+          <!-- labels -->
+          <div class="form-group">
+            <!-- labels-input-list -->
+            <div class="col-sm-12 form-inline">
+              <div ng-repeat="label in formValues.Labels" class="mt-1">
+                <div class="input-group col-sm-5 input-group-sm">
+                  <span class="input-group-addon">name</span>
+                  <input type="text" class="form-control" ng-model="label.key" placeholder="e.g. com.example.foo" data-cy="network-label-key-input" />
+                </div>
+                <div class="input-group col-sm-6 input-group-sm">
+                  <span class="input-group-addon">value</span>
+                  <input type="text" class="form-control" ng-model="label.value" placeholder="e.g. bar" data-cy="network-label-value-input" />
+                  <span class="input-group-btn">
+                    <button class="btn btn-dangerlight" type="button" ng-click="removeLabel($index)"> <pr-icon icon="'trash-2'" size="'md'"></pr-icon> </button
+                  ></span>
+                </div>
+              </div>
+              <div class="form-group">
+                <div class="col-sm-12 small interactive text-muted vertical-center mt-1" ng-click="addLabel()"> <pr-icon icon="'plus'" size="'md'"></pr-icon> Add label </div>
+              </div>
+            </div>
+            <!-- !labels-input-list -->
+          </div>
+          <!-- !labels-->
+          <!-- internal -->
+          <div class="form-group" ng-hide="config.Driver === 'macvlan' && formValues.Macvlan.Scope === 'local'">
+            <div class="col-sm-12">
+              <por-switch-field
+                label-class="'col-sm-2'"
+                checked="config.Internal"
+                label="'Isolated network'"
+                tooltip="'An isolated network has no inbound or outbound communications.'"
+                on-change="(onChangeInternal)"
+              ></por-switch-field>
+            </div>
+          </div>
+          <!-- !internal -->
+          <!-- attachable -->
+          <div class="form-group" ng-hide="config.Driver === 'macvlan' && formValues.Macvlan.Scope === 'local'">
+            <div class="col-sm-12">
+              <por-switch-field
+                label-class="'col-sm-2'"
+                checked="config.Attachable"
+                label="'Enable manual container attachment'"
+                on-change="(onChangeAttachable)"
+              ></por-switch-field>
+            </div>
+          </div>
+          <!-- !attachable -->
+          <div
+            ng-if="
+              applicationState.endpoint.mode.agentProxy &&
+              applicationState.endpoint.mode.provider === 'DOCKER_SWARM_MODE' &&
+              config.Driver !== 'overlay' &&
+              config.Driver !== 'macvlan'
+            "
+          >
+            <div class="col-sm-12 form-section-title"> Deployment </div>
+            <!-- node-selection -->
+            <node-selector model="formValues.NodeName" endpoint-id="endpoint.Id"> </node-selector>
+            <!-- !node-selection -->
+          </div>
+          <!-- access-control -->
+          <por-access-control-form form-data="formValues.AccessControlData"></por-access-control-form>
+          <!-- !access-control -->
+          <!-- actions -->
+          <div class="col-sm-12 form-section-title"> Actions </div>
+          <div class="form-group">
+            <div class="col-sm-12">
+              <button
+                type="button"
+                class="btn btn-primary btn-sm"
+                ng-disabled="state.actionInProgress || !config.Name || (config.Driver === 'macvlan' && networkCreationForm.$invalid) || !isValid()"
+                ng-click="create()"
+                button-spinner="state.actionInProgress"
+              >
+                <span ng-hide="state.actionInProgress">Create the network</span>
+                <span ng-show="state.actionInProgress">Creating network...</span>
+              </button>
+              <span class="text-danger space-left" ng-if="state.formValidationError">{{ state.formValidationError }}</span>
+            </div>
+          </div>
+          <!-- !actions -->
+        </form>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
diff --git a/app/docker/views/nodes/node-browser/node-browser-controller.js b/app/docker/views/nodes/node-browser/node-browser-controller.js
new file mode 100644
index 0000000..e34fcef
--- /dev/null
+++ b/app/docker/views/nodes/node-browser/node-browser-controller.js
@@ -0,0 +1,23 @@
+angular.module('portainer.docker').controller('NodeBrowserController', [
+  '$stateParams',
+  'NodeService',
+  'HttpRequestHelper',
+  'Notifications',
+  function NodeBrowserController($stateParams, NodeService, HttpRequestHelper, Notifications) {
+    var ctrl = this;
+    ctrl.$onInit = $onInit;
+
+    function $onInit() {
+      ctrl.nodeId = $stateParams.id;
+
+      NodeService.node(ctrl.nodeId)
+        .then(function onNodeLoaded(node) {
+          HttpRequestHelper.setPortainerAgentTargetHeader(node.Hostname);
+          ctrl.node = node;
+        })
+        .catch(function onError(err) {
+          Notifications.error('Unable to retrieve host information', err);
+        });
+    }
+  },
+]);
diff --git a/app/docker/views/nodes/node-browser/node-browser.html b/app/docker/views/nodes/node-browser/node-browser.html
new file mode 100644
index 0000000..d73f4d9
--- /dev/null
+++ b/app/docker/views/nodes/node-browser/node-browser.html
@@ -0,0 +1,18 @@
+<page-header
+  title="'Node Browser'"
+  breadcrumbs="[
+    {
+      label:'swarm',
+      link:'docker.swarm'
+    },
+    {
+      label: $ctrl.node.Hostname,
+      link: 'docker.nodes.node',
+      linkParams: { id: $ctrl.nodeId }
+    },
+    'browse'
+  ]"
+>
+</page-header>
+
+<host-browser ng-if="$ctrl.node" endpoint-id="$ctrl.endpoint.Id"></host-browser>
diff --git a/app/docker/views/nodes/node-browser/node-browser.js b/app/docker/views/nodes/node-browser/node-browser.js
new file mode 100644
index 0000000..dc7d60b
--- /dev/null
+++ b/app/docker/views/nodes/node-browser/node-browser.js
@@ -0,0 +1,7 @@
+angular.module('portainer.docker').component('nodeBrowserView', {
+  templateUrl: './node-browser.html',
+  controller: 'NodeBrowserController',
+  bindings: {
+    endpoint: '<',
+  },
+});
diff --git a/app/docker/views/nodes/node-details/node-details-view-controller.js b/app/docker/views/nodes/node-details/node-details-view-controller.js
new file mode 100644
index 0000000..d6002d4
--- /dev/null
+++ b/app/docker/views/nodes/node-details/node-details-view-controller.js
@@ -0,0 +1,95 @@
+angular.module('portainer.docker').controller('NodeDetailsViewController', [
+  '$q',
+  '$stateParams',
+  'NodeService',
+  'StateManager',
+  'AgentService',
+  'Authentication',
+  'Notifications',
+  function NodeDetailsViewController($q, $stateParams, NodeService, StateManager, AgentService, Authentication, Notifications) {
+    var ctrl = this;
+
+    ctrl.$onInit = initView;
+
+    ctrl.state = {
+      isAgent: false,
+      isAdmin: false,
+    };
+
+    function initView() {
+      var applicationState = StateManager.getState();
+      ctrl.state.isAgent = applicationState.endpoint.mode.agentProxy;
+      ctrl.state.isAdmin = Authentication.isAdmin();
+      ctrl.state.enableHostManagementFeatures = ctrl.endpoint.SecuritySettings.enableHostManagementFeatures;
+
+      var nodeId = $stateParams.id;
+      $q.all({
+        node: NodeService.node(nodeId),
+      })
+        .then(function (data) {
+          var node = data.node;
+          ctrl.originalNode = node;
+          ctrl.hostDetails = buildHostDetails(node);
+          ctrl.engineDetails = buildEngineDetails(node);
+          ctrl.nodeDetails = buildNodeDetails(node);
+          if (ctrl.state.isAgent) {
+            var agentApiVersion = applicationState.endpoint.agentApiVersion;
+            ctrl.state.agentApiVersion = agentApiVersion;
+            if (agentApiVersion < 2 || !ctrl.state.enableHostManagementFeatures) {
+              return;
+            }
+
+            AgentService.hostInfo(ctrl.endpoint.Id, node.Hostname).then(function onHostInfoLoad(agentHostInfo) {
+              ctrl.devices = agentHostInfo.PCIDevices;
+              ctrl.disks = agentHostInfo.PhysicalDisks;
+            });
+          }
+        })
+        .catch(function (err) {
+          Notifications.error('Failure', err, 'Unable to retrieve node details');
+        });
+    }
+
+    function buildHostDetails(node) {
+      return {
+        os: {
+          arch: node.PlatformArchitecture,
+          type: node.PlatformOS,
+        },
+        name: node.Hostname,
+        totalCPU: node.CPUs / 1e9,
+        totalMemory: node.Memory,
+      };
+    }
+
+    function buildEngineDetails(node) {
+      return {
+        releaseVersion: node.EngineVersion,
+        volumePlugins: transformPlugins(node.Plugins, 'Volume'),
+        networkPlugins: transformPlugins(node.Plugins, 'Network'),
+        engineLabels: node.EngineLabels,
+      };
+    }
+
+    function buildNodeDetails(node) {
+      return {
+        name: node.Name,
+        role: node.Role,
+        managerAddress: node.ManagerAddr,
+        availability: node.Availability,
+        status: node.Status,
+        nodeLabels: node.Labels,
+      };
+    }
+
+    function transformPlugins(pluginsList, type) {
+      return pluginsList
+        .filter(function (plugin) {
+          return plugin.Type === type;
+        })
+        .map(function (plugin) {
+          return plugin.Name;
+        });
+    }
+  },
+]);
diff --git a/app/docker/views/nodes/node-details/node-details-view.html b/app/docker/views/nodes/node-details/node-details-view.html
new file mode 100644
index 0000000..b868fd7
--- /dev/null
+++ b/app/docker/views/nodes/node-details/node-details-view.html
@@ -0,0 +1,14 @@
+<host-overview
+  agent-api-version="$ctrl.state.agentApiVersion"
+  is-agent="$ctrl.state.isAgent"
+  host-details="$ctrl.hostDetails"
+  engine-details="$ctrl.engineDetails"
+  disks="$ctrl.disks"
+  devices="$ctrl.devices"
+  refresh-url="docker.nodes.node"
+  browse-url="docker.nodes.node.browse"
+  host-features-enabled="$ctrl.state.enableHostManagementFeatures"
+  is-admin="$ctrl.state.isAdmin"
+>
+  <swarm-node-details-panel details="$ctrl.nodeDetails" original-node="$ctrl.originalNode"></swarm-node-details-panel>
+</host-overview>
diff --git a/app/docker/views/nodes/node-details/node-details-view.js b/app/docker/views/nodes/node-details/node-details-view.js
new file mode 100644
index 0000000..be55e2a
--- /dev/null
+++ b/app/docker/views/nodes/node-details/node-details-view.js
@@ -0,0 +1,7 @@
+angular.module('portainer.docker').component('nodeDetailsView', {
+  templateUrl: './node-details-view.html',
+  controller: 'NodeDetailsViewController',
+  bindings: {
+    endpoint: '<',
+  },
+});
diff --git a/app/docker/views/registries/access/registryAccess.html b/app/docker/views/registries/access/registryAccess.html
new file mode 100644
index 0000000..cdedd13
--- /dev/null
+++ b/app/docker/views/registries/access/registryAccess.html
@@ -0,0 +1,15 @@
+<div ng-if="$ctrl.registry">
+  <page-header title="'Registry access'" breadcrumbs="[{label:'Registries', link:$ctrl.registryTo,}, $ctrl.registry.Name, 'Access management']"> </page-header>
+
+  <registry-details registry="$ctrl.registry"></registry-details>
+
+  <por-access-management
+    ng-if="$ctrl.endpointGroup"
+    access-controlled-entity="$ctrl.registryEndpointAccesses"
+    entity-type="registry"
+    action-in-progress="$ctrl.state.actionInProgress"
+    update-access="$ctrl.updateAccess"
+    filter-users="$ctrl.filterUsers"
+  >
+  </por-access-management>
+</div>
diff --git a/app/docker/views/registries/access/registryAccess.js b/app/docker/views/registries/access/registryAccess.js
new file mode 100644
index 0000000..7ee0814
--- /dev/null
+++ b/app/docker/views/registries/access/registryAccess.js
@@ -0,0 +1,7 @@
+angular.module('portainer.docker').component('dockerRegistryAccessView', {
+  templateUrl: './registryAccess.html',
+  controller: 'DockerRegistryAccessController',
+  bindings: {
+    endpoint: '<',
+  },
+});
diff --git a/app/docker/views/registries/access/registryAccessController.js b/app/docker/views/registries/access/registryAccessController.js
new file mode 100644
index 0000000..51e8d6b
--- /dev/null
+++ b/app/docker/views/registries/access/registryAccessController.js
@@ -0,0 +1,70 @@
+import { TeamAccessViewModel, UserAccessViewModel } from '@/portainer/models/access';
+
+class DockerRegistryAccessController {
+  /* @ngInject */
+  constructor($async, $state, Notifications, EndpointService, GroupService, RegistryService) {
+    this.$async = $async;
+    this.$state = $state;
+    this.Notifications = Notifications;
+    this.EndpointService = EndpointService;
+    this.GroupService = GroupService;
+    this.RegistryService = RegistryService;
+
+    this.updateAccess = this.updateAccess.bind(this);
+    this.filterUsers = this.filterUsers.bind(this);
+  }
+
+  updateAccess() {
+    return this.$async(async () => {
+      this.state.actionInProgress = true;
+      try {
+        await this.EndpointService.updateRegistryAccess(this.state.endpointId, this.state.registryId, this.registryEndpointAccesses);
+        this.Notifications.success('Success', 'Access successfully updated');
+        this.$state.reload();
+      } catch (err) {
+        this.state.actionInProgress = false;
+        this.Notifications.error('Failure', err, 'Unable to update accesses');
+      }
+    });
+  }
+
+  filterUsers(users) {
+    const endpointUsers = this.endpoint.UserAccessPolicies || {};
+    const endpointTeams = this.endpoint.TeamAccessPolicies || {};
+
+    const endpointGroupUsers = this.endpointGroup.UserAccessPolicies || {};
+    const endpointGroupTeams = this.endpointGroup.TeamAccessPolicies || {};
+
+    return users.filter((userOrTeam) => {
+      const userAccess = userOrTeam instanceof UserAccessViewModel && (endpointUsers[userOrTeam.Id] || endpointGroupUsers[userOrTeam.Id]);
+      const teamAccess = userOrTeam instanceof TeamAccessViewModel && (endpointTeams[userOrTeam.Id] || endpointGroupTeams[userOrTeam.Id]);
+
+      return userAccess || teamAccess;
+    });
+  }
+
+  $onInit() {
+    return this.$async(async () => {
+      this.registryTo = window.location.hash.match(/#!\/\d+\/docker\/swarm\/registries/) ? 'docker.swarm.registries' : 'docker.host.registries';
+
+      try {
+        this.state = {
+          viewReady: false,
+          actionInProgress: false,
+          endpointId: this.$state.params.endpointId,
+          registryId: this.$state.params.id,
+        };
+        this.registry = await this.RegistryService.registry(this.state.registryId, this.state.endpointId);
+        this.registryEndpointAccesses = this.registry.RegistryAccesses[this.state.endpointId] || {};
+        this.endpointGroup = await this.GroupService.group(this.endpoint.GroupId);
+      } catch (err) {
+        this.Notifications.error('Failure', err, 'Unable to retrieve registry details');
+      } finally {
+        this.state.viewReady = true;
+      }
+    });
+  }
+}
+
+export default DockerRegistryAccessController;
+angular.module('portainer.docker').controller('DockerRegistryAccessController', DockerRegistryAccessController);
diff --git a/app/docker/views/secrets/create/createSecretController.js b/app/docker/views/secrets/create/createSecretController.js
new file mode 100644
index 0000000..3e79046
--- /dev/null
+++ b/app/docker/views/secrets/create/createSecretController.js
@@ -0,0 +1,102 @@
+import { AccessControlFormData } from '../../../../portainer/components/accessControlForm/porAccessControlFormModel';
+
+angular.module('portainer.docker').controller('CreateSecretController', [
+  '$scope',
+  '$state',
+  'Notifications',
+  'SecretService',
+  'LabelHelper',
+  'Authentication',
+  'ResourceControlService',
+  'FormValidator',
+  function ($scope, $state, Notifications, SecretService, LabelHelper, Authentication, ResourceControlService, FormValidator) {
+    $scope.formValues = {
+      Name: '',
+      Data: '',
+      Labels: [],
+      encodeSecret: true,
+      AccessControlData: new AccessControlFormData(),
+    };
+
+    $scope.state = {
+      formValidationError: '',
+      actionInProgress: false,
+    };
+
+    $scope.handleEncodeSecretChange = handleEncodeSecretChange;
+
+    function handleEncodeSecretChange(checked) {
+      return $scope.$evalAsync(() => {
+        $scope.formValues.encodeSecret = checked;
+      });
+    }
+
+    $scope.addLabel = function () {
+      $scope.formValues.Labels.push({ key: '', value: '' });
+    };
+
+    $scope.removeLabel = function (index) {
+      $scope.formValues.Labels.splice(index, 1);
+    };
+
+    function prepareLabelsConfig(config) {
+      config.Labels = LabelHelper.fromKeyValueToLabelHash($scope.formValues.Labels);
+    }
+
+    function prepareSecretData(config) {
+      if ($scope.formValues.encodeSecret) {
+        config.Data = btoa(unescape(encodeURIComponent($scope.formValues.Data)));
+      } else {
+        config.Data = $scope.formValues.Data;
+      }
+    }
+
+    function prepareConfiguration() {
+      var config = {};
+      config.Name = $scope.formValues.Name;
+      prepareSecretData(config);
+      prepareLabelsConfig(config);
+      return config;
+    }
+
+    function validateForm(accessControlData, isAdmin) {
+      $scope.state.formValidationError = '';
+      var error = FormValidator.validateAccessControl(accessControlData, isAdmin);
+
+      if (error) {
+        $scope.state.formValidationError = error;
+        return false;
+      }
+      return true;
+    }
+
+    $scope.create = function () {
+      const accessControlData = $scope.formValues.AccessControlData;
+      const userDetails = Authentication.getUserDetails();
+      const isAdmin = Authentication.isAdmin();
+
+      if (!validateForm(accessControlData, isAdmin)) {
+        return;
+      }
+
+      $scope.state.actionInProgress = true;
+      var secretConfiguration = prepareConfiguration();
+      SecretService.create(secretConfiguration)
+        .then(function success(data) {
+          const userId = userDetails.ID;
+          const resourceControl = data.Portainer.ResourceControl;
+          return ResourceControlService.applyResourceControl(userId, accessControlData, resourceControl);
+        })
+        .then(function success() {
+          Notifications.success('Success', 'Secret successfully created');
+          $state.go('docker.secrets', {}, { reload: true });
+        })
+        .catch(function error(err) {
+          Notifications.error('Failure', err, 'Unable to create secret');
+        })
+        .finally(function final() {
+          $scope.state.actionInProgress = false;
+        });
+    };
+  },
+]);
diff --git a/app/docker/views/secrets/create/createsecret.html b/app/docker/views/secrets/create/createsecret.html
new file mode 100644
index 0000000..886db49
--- /dev/null
+++ b/app/docker/views/secrets/create/createsecret.html
@@ -0,0 +1,89 @@
+<page-header title="'Create secret'" breadcrumbs="[{label:'Secrets', link:'docker.secrets'}, 'Add secret']"> </page-header>
+
+<div class="row">
+  <div class="col-lg-12 col-md-12 col-xs-12">
+    <rd-widget>
+      <rd-widget-body>
+        <form class="form-horizontal">
+          <!-- name-input -->
+          <div class="form-group">
+            <label for="secret_name" class="col-sm-2 control-label text-left">Name</label>
+            <div class="col-sm-10">
+              <input type="text" class="form-control" ng-model="formValues.Name" id="secret_name" placeholder="e.g. mySecret" data-cy="createSecret-nameInput" />
+            </div>
+          </div>
+          <!-- !name-input -->
+          <!-- secret-data -->
+          <div class="form-group">
+            <label for="secret_data" class="col-sm-2 control-label text-left">Secret</label>
+            <div class="col-sm-10">
+              <textarea class="form-control" rows="5" ng-model="formValues.Data" ng-trim="false" data-cy="createSecret-secretDataInput"></textarea>
+            </div>
+          </div>
+          <!-- !secret-data -->
+          <!-- encode-secret -->
+          <div class="form-group">
+            <div class="col-sm-12">
+              <por-switch-field
+                label-class="'col-sm-2'"
+                checked="formValues.encodeSecret"
+                label="'Encode secret'"
+                on-change="(handleEncodeSecretChange)"
+                tooltip="'Secrets need to be base64 encoded. Disable this if your secret is already base64 encoded.'"
+              ></por-switch-field>
+            </div>
+          </div>
+          <!-- !encode-secret -->
+          <!-- labels -->
+          <div class="form-group">
+            <div class="col-sm-12 mt-1">
+              <label class="control-label space-right text-left">Labels</label>
+              <span class="label label-default interactive vertical-center space-left" ng-click="addLabel()"> <pr-icon icon="'plus'" mode="'alt'"></pr-icon> add label </span>
+            </div>
+            <!-- labels-input-list -->
+            <div class="col-sm-12 form-inline mt-2">
+              <div ng-repeat="label in formValues.Labels" class="mt-1">
+                <div class="input-group col-sm-5 input-group-sm">
+                  <span class="input-group-addon">name</span>
+                  <input type="text" class="form-control" ng-model="label.key" placeholder="e.g. com.example.foo" data-cy="createSecret-labelNameInput" />
+                </div>
+                <div class="input-group col-sm-6 input-group-sm">
+                  <span class="input-group-addon">value</span>
+                  <input type="text" class="form-control" ng-model="label.value" placeholder="e.g. bar" data-cy="createSecret-labelValueInput" />
+                  <span class="input-group-btn">
+                    <button class="btn btn-dangerlight" type="button" ng-click="removeLabel($index)">
+                      <pr-icon icon="'trash-2'" size="'md'"></pr-icon>
+                    </button>
+                  </span>
+                </div>
+              </div>
+            </div>
+            <!-- !labels-input-list -->
+          </div>
+          <!-- !labels-->
+          <!-- access-control -->
+          <por-access-control-form form-data="formValues.AccessControlData"></por-access-control-form>
+          <!-- !access-control -->
+          <!-- actions -->
+          <div class="col-sm-12 form-section-title"> Actions </div>
+          <div class="form-group">
+            <div class="col-sm-12">
+              <button
+                type="button"
+                class="btn btn-primary btn-sm"
+                ng-disabled="state.actionInProgress || !formValues.Name || !formValues.Data"
+                ng-click="create()"
+                button-spinner="state.actionInProgress"
+              >
+                <span ng-hide="state.actionInProgress">Create the secret</span>
+                <span ng-show="state.actionInProgress">Creating secret...</span>
+              </button>
+              <span class="text-danger space-left" ng-if="state.formValidationError">{{ state.formValidationError }}</span>
+            </div>
+          </div>
+          <!-- !actions -->
+        </form>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
diff --git a/app/docker/views/secrets/edit/secret.html b/app/docker/views/secrets/edit/secret.html
new file mode 100644
index 0000000..524f481
--- /dev/null
+++ b/app/docker/views/secrets/edit/secret.html
@@ -0,0 +1,59 @@
+<page-header title="'Secret details'" breadcrumbs="[{label:'Secrets', link:'docker.secrets', linkParams:{ id: secret.Id }}, secret.Name]" reload="true"> </page-header>
+
+<div class="row">
+  <div class="col-lg-12 col-md-12 col-xs-12">
+    <rd-widget>
+      <rd-widget-header icon="lock" title-text="Secret details"></rd-widget-header>
+      <rd-widget-body classes="no-padding">
+        <table class="table">
+          <tbody>
+            <tr>
+              <td>Name</td>
+              <td>{{ secret.Name }}</td>
+            </tr>
+            <tr>
+              <td>ID</td>
+              <td>
+                {{ secret.Id }}
+                <button authorization="DockerSecretDelete" class="btn btn-xs btn-dangerlight" ng-click="removeSecret(secret.Id)"
+                  ><pr-icon icon="'trash-2'"></pr-icon>Delete this secret</button
+                >
+              </td>
+            </tr>
+            <tr>
+              <td>Created</td>
+              <td>{{ secret.CreatedAt | getisodate }}</td>
+            </tr>
+            <tr>
+              <td>Last updated</td>
+              <td>{{ secret.UpdatedAt | getisodate }}</td>
+            </tr>
+            <tr ng-if="!(secret.Labels | emptyobject)">
+              <td>Labels</td>
+              <td>
+                <table class="table-bordered table-condensed table">
+                  <tr ng-repeat="(k, v) in secret.Labels">
+                    <td>{{ k }}</td>
+                    <td>{{ v }}</td>
+                  </tr>
+                </table>
+              </td>
+            </tr>
+          </tbody>
+        </table>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
+
+<!-- access-control-panel -->
+<access-control-panel
+  ng-if="secret"
+  resource-id="secret.Id"
+  resource-control="secret.ResourceControl"
+  resource-type="resourceType"
+  on-update-success="(onUpdateResourceControlSuccess)"
+  environment-id="endpoint.Id"
+>
+</access-control-panel>
+<!-- !access-control-panel -->
diff --git a/app/docker/views/secrets/edit/secretController.js b/app/docker/views/secrets/edit/secretController.js
new file mode 100644
index 0000000..cc527f4
--- /dev/null
+++ b/app/docker/views/secrets/edit/secretController.js
@@ -0,0 +1,35 @@
+import { ResourceControlType } from '@/react/portainer/access-control/types';
+
+angular.module('portainer.docker').controller('SecretController', SecretController);
+
+/* @ngInject */
+function SecretController($scope, $transition$, $state, SecretService, Notifications, endpoint) {
+  $scope.resourceType = ResourceControlType.Secret;
+  $scope.endpoint = endpoint;
+  $scope.onUpdateResourceControlSuccess = function () {
+    $state.reload();
+  };
+
+  $scope.removeSecret = function removeSecret(secretId) {
+    SecretService.remove(secretId)
+      .then(function success() {
+        Notifications.success('Success', 'Secret successfully removed');
+        $state.go('docker.secrets', {});
+      })
+      .catch(function error(err) {
+        Notifications.error('Failure', err, 'Unable to remove secret');
+      });
+  };
+
+  function initView() {
+    SecretService.secret($transition$.params().id)
+      .then(function success(data) {
+        $scope.secret = data;
+      })
+      .catch(function error(err) {
+        Notifications.error('Failure', err, 'Unable to retrieve secret details');
+      });
+  }
+
+  initView();
+}
diff --git a/app/docker/views/secrets/secrets.html b/app/docker/views/secrets/secrets.html
new file mode 100644
index 0000000..d286ee2
--- /dev/null
+++ b/app/docker/views/secrets/secrets.html
@@ -0,0 +1,17 @@
+<page-header title="'Secrets list'" breadcrumbs="['Secrets']" reload="true"> </page-header>
+
+<docker-secrets-datatable dataset="secrets" on-remove="(removeAction)" on-refresh="(getSecrets)"> </docker-secrets-datatable>
+
+<div class="row">
+  <div class="col-sm-12">
+    <secrets-datatable
+      title-text="Secrets"
+      title-icon="lock"
+      dataset="secrets"
+      table-key="secrets"
+      order-by="Name"
+      remove-action="removeAction"
+      refresh-callback="getSecrets"
+    ></secrets-datatable>
+  </div>
+</div>
diff --git a/app/docker/views/secrets/secretsController.js b/app/docker/views/secrets/secretsController.js
new file mode 100644
index 0000000..f1d0696
--- /dev/null
+++ b/app/docker/views/secrets/secretsController.js
@@ -0,0 +1,45 @@
+import { processItemsInBatches } from '@/react/common/processItemsInBatches';
+
+angular.module('portainer.docker').controller('SecretsController', [
+  '$scope',
+  '$state',
+  'SecretService',
+  'Notifications',
+  function ($scope, $state, SecretService, Notifications) {
+    $scope.removeAction = async function (selectedItems) {
+      async function doRemove(secret) {
+        return SecretService.remove(secret.Id)
+          .then(function success() {
+            Notifications.success('Secret successfully removed', secret.Name);
+            var index = $scope.secrets.indexOf(secret);
+            $scope.secrets.splice(index, 1);
+          })
+          .catch(function error(err) {
+            Notifications.error('Failure', err, 'Unable to remove secret');
+          });
+      }
+
+      await processItemsInBatches(selectedItems, doRemove);
+      $state.reload();
+    };
+
+    $scope.getSecrets = getSecrets;
+
+    function getSecrets() {
+      SecretService.secrets()
+        .then(function success(data) {
+          $scope.secrets = data;
+        })
+        .catch(function error(err) {
+          $scope.secrets = [];
+          Notifications.error('Failure', err, 'Unable to retrieve secrets');
+        });
+    }
+
+    function initView() {
+      getSecrets();
+    }
+
+    initView();
+  },
+]);
diff --git a/app/docker/views/services/create/createServiceController.js b/app/docker/views/services/create/createServiceController.js
new file mode 100644
index 0000000..f95969d
--- /dev/null
+++ b/app/docker/views/services/create/createServiceController.js
@@ -0,0 +1,634 @@
+import _ from 'lodash-es';
+
+import * as envVarsUtils from '@/react/components/form-components/EnvironmentVariablesFieldset/utils';
+import { PorImageRegistryModel } from '@/docker/models/porImageRegistry';
+import { AccessControlFormData } from '../../../../portainer/components/accessControlForm/porAccessControlFormModel';
+
+require('./includes/update-restart.html');
+require('./includes/secret.html');
+require('./includes/config.html');
+require('./includes/resources-placement.html');
+
+angular.module('portainer.docker').controller('CreateServiceController', [
+  '$q',
+  '$scope',
+  '$state',
+  '$timeout',
+  'ServiceService',
+  'ServiceHelper',
+  'ConfigService',
+  'ConfigHelper',
+  'SecretHelper',
+  'SecretService',
+  'VolumeService',
+  'NetworkService',
+  'ImageHelper',
+  'LabelHelper',
+  'Authentication',
+  'ResourceControlService',
+  'Notifications',
+  'FormValidator',
+  'PluginService',
+  'NodeService',
+  'WebhookService',
+  'endpoint',
+  function (
+    $q,
+    $scope,
+    $state,
+    $timeout,
+    ServiceService,
+    ServiceHelper,
+    ConfigService,
+    ConfigHelper,
+    SecretHelper,
+    SecretService,
+    VolumeService,
+    NetworkService,
+    ImageHelper,
+    LabelHelper,
+    Authentication,
+    ResourceControlService,
+    Notifications,
+    FormValidator,
+    PluginService,
+    NodeService,
+    WebhookService,
+    endpoint
+  ) {
+    $scope.endpoint = endpoint;
+
+    $scope.formValues = {
+      Name: '',
+      RegistryModel: new PorImageRegistryModel(),
+      Mode: 'replicated',
+      Replicas: 1,
+      Command: '',
+      EntryPoint: '',
+      WorkingDir: '',
+      User: '',
+      Env: [],
+      Labels: [],
+      ContainerLabels: [],
+      Volumes: [],
+      Network: '',
+      ExtraNetworks: [],
+      HostsEntries: [],
+      Ports: [],
+      Parallelism: 1,
+      PlacementConstraints: [],
+      PlacementPreferences: [],
+      UpdateDelay: '0s',
+      UpdateOrder: 'stop-first',
+      FailureAction: 'pause',
+      Secrets: [],
+      Configs: [],
+      AccessControlData: new AccessControlFormData(),
+      CpuLimit: 0,
+      CpuReservation: 0,
+      MemoryLimit: 0,
+      MemoryReservation: 0,
+      MemoryLimitUnit: 'MB',
+      MemoryReservationUnit: 'MB',
+      RestartCondition: 'any',
+      RestartDelay: '5s',
+      RestartMaxAttempts: 0,
+      RestartWindow: '0s',
+      LogDriverName: '',
+      LogDriverOpts: [],
+      Webhook: false,
+    };
+
+    $scope.state = {
+      formValidationError: '',
+      actionInProgress: false,
+      pullImageValidity: false,
+    };
+
+    $scope.allowBindMounts = false;
+
+    $scope.handleWebHookChange = handleWebHookChange;
+
+    function handleWebHookChange(checked) {
+      return $scope.$evalAsync(() => {
+        $scope.formValues.Webhook = checked;
+      });
+    }
+
+    $scope.handleEnvVarChange = handleEnvVarChange;
+    function handleEnvVarChange(value) {
+      $scope.formValues.Env = value;
+    }
+
+    $scope.refreshSlider = function () {
+      $timeout(function () {
+        $scope.$broadcast('rzSliderForceRender');
+      });
+    };
+
+    $scope.setPullImageValidity = setPullImageValidity;
+    function setPullImageValidity(validity) {
+      $scope.state.pullImageValidity = validity;
+    }
+
+    $scope.addPortBinding = function () {
+      $scope.formValues.Ports.push({ PublishedPort: '', TargetPort: '', Protocol: 'tcp', PublishMode: 'ingress' });
+    };
+
+    $scope.removePortBinding = function (index) {
+      $scope.formValues.Ports.splice(index, 1);
+    };
+
+    $scope.addExtraNetwork = function () {
+      $scope.formValues.ExtraNetworks.push({ Name: '' });
+    };
+
+    $scope.removeExtraNetwork = function (index) {
+      $scope.formValues.ExtraNetworks.splice(index, 1);
+    };
+
+    $scope.addHostsEntry = function () {
+      $scope.formValues.HostsEntries.push({});
+    };
+
+    $scope.removeHostsEntry = function (index) {
+      $scope.formValues.HostsEntries.splice(index, 1);
+    };
+
+    $scope.addVolume = function () {
+      $scope.formValues.Volumes.push({ Source: null, Target: '', ReadOnly: false, Type: 'volume' });
+    };
+
+    $scope.removeVolume = function (index) {
+      $scope.formValues.Volumes.splice(index, 1);
+    };
+
+    $scope.addConfig = function () {
+      $scope.formValues.Configs.push({});
+    };
+
+    $scope.removeConfig = function (index) {
+      $scope.formValues.Configs.splice(index, 1);
+      $scope.checkIfConfigDuplicated();
+    };
+
+    $scope.addSecret = function () {
+      $scope.formValues.Secrets.push({ overrideTarget: false });
+    };
+
+    $scope.removeSecret = function (index) {
+      $scope.formValues.Secrets.splice(index, 1);
+      $scope.checkIfSecretDuplicated();
+    };
+
+    $scope.addPlacementConstraint = function () {
+      $scope.formValues.PlacementConstraints.push({ key: '', operator: '==', value: '' });
+    };
+
+    $scope.removePlacementConstraint = function (index) {
+      $scope.formValues.PlacementConstraints.splice(index, 1);
+    };
+
+    $scope.addPlacementPreference = function () {
+      $scope.formValues.PlacementPreferences.push({ strategy: 'spread', value: '' });
+    };
+
+    $scope.removePlacementPreference = function (index) {
+      $scope.formValues.PlacementPreferences.splice(index, 1);
+    };
+
+    $scope.addLabel = function () {
+      $scope.formValues.Labels.push({ key: '', value: '' });
+    };
+
+    $scope.removeLabel = function (index) {
+      $scope.formValues.Labels.splice(index, 1);
+    };
+
+    $scope.addContainerLabel = function () {
+      $scope.formValues.ContainerLabels.push({ key: '', value: '' });
+    };
+
+    $scope.removeContainerLabel = function (index) {
+      $scope.formValues.ContainerLabels.splice(index, 1);
+    };
+
+    $scope.addLogDriverOpt = function () {
+      $scope.formValues.LogDriverOpts.push({ name: '', value: '' });
+    };
+
+    $scope.removeLogDriverOpt = function (index) {
+      $scope.formValues.LogDriverOpts.splice(index, 1);
+    };
+
+    $scope.checkIfSecretDuplicated = function () {
+      $scope.formValues.Secrets.$invalid = false;
+      [...$scope.formValues.Secrets]
+        .sort((a, b) => a.model.Id.localeCompare(b.model.Id))
+        .sort((a, b) => {
+          if (a.model.Id === b.model.Id) {
+            $scope.formValues.Secrets.$invalid = true;
+            $scope.formValues.Secrets.$error = 'Secret ' + a.model.Name + ' cannot be assigned multiple times.';
+          }
+        });
+      if (!$scope.formValues.Secrets.$invalid) {
+        $scope.formValues.Secrets.$error = '';
+      }
+    };
+
+    $scope.checkIfConfigDuplicated = function () {
+      $scope.formValues.Configs.$invalid = false;
+      [...$scope.formValues.Configs]
+        .sort((a, b) => a.model.Id.localeCompare(b.model.Id))
+        .sort((a, b) => {
+          if (a.model.Id === b.model.Id) {
+            $scope.formValues.Configs.$invalid = true;
+            $scope.formValues.Configs.$error = 'Config ' + a.model.Name + ' cannot be assigned multiple times.';
+          }
+        });
+      if (!$scope.formValues.Configs.$invalid) {
+        $scope.formValues.Configs.$error = '';
+      }
+    };
+
+    function prepareImageConfig(config, input) {
+      var imageConfig = ImageHelper.createImageConfigForContainer(input.RegistryModel);
+      config.TaskTemplate.ContainerSpec.Image = imageConfig.fromImage;
+    }
+
+    function preparePortsConfig(config, input) {
+      let ports = [];
+      input.Ports.forEach(function (binding) {
+        const port = {
+          Protocol: binding.Protocol,
+          PublishMode: binding.PublishMode,
+        };
+        if (binding.TargetPort) {
+          port.TargetPort = +binding.TargetPort;
+          if (binding.PublishedPort) {
+            port.PublishedPort = +binding.PublishedPort;
+          }
+          ports.push(port);
+        }
+      });
+      config.EndpointSpec.Ports = ports;
+    }
+
+    function prepareSchedulingConfig(config, input) {
+      if (input.Mode === 'replicated') {
+        config.Mode.Replicated = {
+          Replicas: input.Replicas,
+        };
+      } else {
+        config.Mode.Global = {};
+      }
+    }
+
+    function commandToArray(cmd) {
+      var tokens = [].concat
+        .apply(
+          [],
+          cmd.split("'").map(function (v, i) {
+            return i % 2 ? v : v.split(' ');
+          })
+        )
+        .filter(Boolean);
+      return tokens;
+    }
+
+    function prepareCommandConfig(config, input) {
+      if (input.EntryPoint) {
+        config.TaskTemplate.ContainerSpec.Command = commandToArray(input.EntryPoint);
+      }
+      if (input.Command) {
+        config.TaskTemplate.ContainerSpec.Args = commandToArray(input.Command);
+      }
+      if (input.User) {
+        config.TaskTemplate.ContainerSpec.User = input.User;
+      }
+      if (input.WorkingDir) {
+        config.TaskTemplate.ContainerSpec.Dir = input.WorkingDir;
+      }
+    }
+
+    function prepareEnvConfig(config, input) {
+      config.TaskTemplate.ContainerSpec.Env = envVarsUtils.convertToArrayOfStrings(input.Env);
+    }
+
+    function prepareLabelsConfig(config, input) {
+      config.Labels = LabelHelper.fromKeyValueToLabelHash(input.Labels);
+      config.TaskTemplate.ContainerSpec.Labels = LabelHelper.fromKeyValueToLabelHash(input.ContainerLabels);
+    }
+
+    function createMountObjectFromVolume(volumeObject, target, readonly) {
+      return {
+        Target: target,
+        Source: volumeObject.Id,
+        Type: 'volume',
+        ReadOnly: readonly,
+        VolumeOptions: {
+          Labels: volumeObject.Labels,
+          DriverConfig: {
+            Name: volumeObject.Driver,
+            Options: volumeObject.Options,
+          },
+        },
+      };
+    }
+
+    function prepareVolumes(config, input) {
+      input.Volumes.forEach(function (volume) {
+        if (volume.Source && volume.Target) {
+          if (volume.Type !== 'volume') {
+            config.TaskTemplate.ContainerSpec.Mounts.push(volume);
+          } else {
+            var volumeObject = volume.Source;
+            var mount = createMountObjectFromVolume(volumeObject, volume.Target, volume.ReadOnly);
+            config.TaskTemplate.ContainerSpec.Mounts.push(mount);
+          }
+        }
+      });
+    }
+
+    function prepareNetworks(config, input) {
+      var networks = [];
+      if (input.Network) {
+        networks.push({ Target: input.Network });
+      }
+      input.ExtraNetworks.forEach(function (network) {
+        networks.push({ Target: network.Name });
+      });
+      config.TaskTemplate.Networks = _.uniqWith(networks, _.isEqual);
+    }
+
+    function prepareHostsEntries(config, input) {
+      var hostsEntries = [];
+      if (input.HostsEntries) {
+        input.HostsEntries.forEach(function (host_ip) {
+          if (host_ip.value && host_ip.value.indexOf(':') && host_ip.value.split(':').length === 2) {
+            var keyVal = host_ip.value.split(':');
+            // Hosts file format, IP_address canonical_hostname
+            hostsEntries.push(keyVal[1] + ' ' + keyVal[0]);
+          }
+        });
+        if (hostsEntries.length > 0) {
+          config.TaskTemplate.ContainerSpec.Hosts = hostsEntries;
+        }
+      }
+    }
+
+    function prepareUpdateConfig(config, input) {
+      config.UpdateConfig = {
+        Parallelism: input.Parallelism || 0,
+        Delay: ServiceHelper.translateHumanDurationToNanos(input.UpdateDelay) || 0,
+        FailureAction: input.FailureAction,
+        Order: input.UpdateOrder,
+      };
+    }
+
+    function prepareRestartPolicy(config, input) {
+      config.TaskTemplate.RestartPolicy = {
+        Condition: input.RestartCondition || 'any',
+        Delay: ServiceHelper.translateHumanDurationToNanos(input.RestartDelay) || 5000000000,
+        MaxAttempts: input.RestartMaxAttempts || 0,
+        Window: ServiceHelper.translateHumanDurationToNanos(input.RestartWindow) || 0,
+      };
+    }
+
+    function preparePlacementConfig(config, input) {
+      config.TaskTemplate.Placement.Constraints = ServiceHelper.translateKeyValueToPlacementConstraints(input.PlacementConstraints);
+      config.TaskTemplate.Placement.Preferences = ServiceHelper.translateKeyValueToPlacementPreferences(input.PlacementPreferences);
+    }
+
+    function prepareConfigConfig(config, input) {
+      if (input.Configs) {
+        var configs = [];
+        angular.forEach(input.Configs, function (config) {
+          if (config.model) {
+            var s = ConfigHelper.configConfig(config.model);
+            s.File.Name = config.FileName || s.File.Name;
+            configs.push(s);
+          }
+        });
+        config.TaskTemplate.ContainerSpec.Configs = configs;
+      }
+    }
+
+    function prepareSecretConfig(config, input) {
+      if (input.Secrets) {
+        var secrets = [];
+        angular.forEach(input.Secrets, function (secret) {
+          if (secret.model) {
+            var s = SecretHelper.secretConfig(secret.model);
+            s.File.Name = s.SecretName;
+            if (secret.overrideTarget && secret.target && secret.target !== '') {
+              s.File.Name = secret.target;
+            }
+            secrets.push(s);
+          }
+        });
+        config.TaskTemplate.ContainerSpec.Secrets = secrets;
+      }
+    }
+
+    function prepareResourcesCpuConfig(config, input) {
+      // CPU Limit
+      if (input.CpuLimit > 0) {
+        config.TaskTemplate.Resources.Limits.NanoCPUs = input.CpuLimit * 1000000000;
+      }
+      // CPU Reservation
+      if (input.CpuReservation > 0) {
+        config.TaskTemplate.Resources.Reservations.NanoCPUs = input.CpuReservation * 1000000000;
+      }
+    }
+
+    function prepareResourcesMemoryConfig(config, input) {
+      // Memory Limit - Round to 0.125
+      var memoryLimit = (Math.round(input.MemoryLimit * 8) / 8).toFixed(3);
+      memoryLimit *= 1024 * 1024;
+      if (input.MemoryLimitUnit === 'GB') {
+        memoryLimit *= 1024;
+      }
+      if (memoryLimit > 0) {
+        config.TaskTemplate.Resources.Limits.MemoryBytes = memoryLimit;
+      }
+      // Memory Resevation - Round to 0.125
+      var memoryReservation = (Math.round(input.MemoryReservation * 8) / 8).toFixed(3);
+      memoryReservation *= 1024 * 1024;
+      if (input.MemoryReservationUnit === 'GB') {
+        memoryReservation *= 1024;
+      }
+      if (memoryReservation > 0) {
+        config.TaskTemplate.Resources.Reservations.MemoryBytes = memoryReservation;
+      }
+    }
+
+    function prepareLogDriverConfig(config, input) {
+      var logOpts = {};
+      if (input.LogDriverName) {
+        config.TaskTemplate.LogDriver = { Name: input.LogDriverName };
+        if (input.LogDriverName !== 'none') {
+          input.LogDriverOpts.forEach(function (opt) {
+            if (opt.name) {
+              logOpts[opt.name] = opt.value;
+            }
+          });
+          if (Object.keys(logOpts).length !== 0 && logOpts.constructor === Object) {
+            config.TaskTemplate.LogDriver.Options = logOpts;
+          }
+        }
+      }
+    }
+
+    function prepareConfiguration() {
+      var input = $scope.formValues;
+      var config = {
+        Name: input.Name,
+        TaskTemplate: {
+          ContainerSpec: {
+            Mounts: [],
+          },
+          Placement: {},
+          Resources: {
+            Limits: {},
+            Reservations: {},
+          },
+        },
+        Mode: {},
+        EndpointSpec: {},
+      };
+      prepareSchedulingConfig(config, input);
+      prepareImageConfig(config, input);
+      preparePortsConfig(config, input);
+      prepareCommandConfig(config, input);
+      prepareEnvConfig(config, input);
+      prepareLabelsConfig(config, input);
+      prepareVolumes(config, input);
+      prepareNetworks(config, input);
+      prepareHostsEntries(config, input);
+      prepareUpdateConfig(config, input);
+      prepareConfigConfig(config, input);
+      prepareSecretConfig(config, input);
+      preparePlacementConfig(config, input);
+      prepareResourcesCpuConfig(config, input);
+      prepareResourcesMemoryConfig(config, input);
+      prepareRestartPolicy(config, input);
+      prepareLogDriverConfig(config, input);
+      return config;
+    }
+
+    function createNewService(config, accessControlData) {
+      const registryModel = $scope.formValues.RegistryModel;
+
+      ServiceService.create(config, registryModel.Registry.Authentication ? registryModel.Registry.Id : 0)
+        .then(function success(data) {
+          const serviceId = data.ID;
+          const resourceControl = data.Portainer.ResourceControl;
+          const userId = Authentication.getUserDetails().ID;
+          const rcPromise = ResourceControlService.applyResourceControl(userId, accessControlData, resourceControl);
+          const registryID = $scope.formValues.RegistryModel.Registry.Id;
+          const webhookPromise = $q.when(endpoint.Type !== 4 && $scope.formValues.Webhook && WebhookService.createServiceWebhook(serviceId, endpoint.Id, registryID));
+          return $q.all([rcPromise, webhookPromise]);
+        })
+        .then(function success() {
+          Notifications.success('Success', 'Service successfully created');
+          $state.go('docker.services', {}, { reload: true });
+        })
+        .catch(function error(err) {
+          Notifications.error('Failure', err, 'Unable to create service');
+        })
+        .finally(function final() {
+          $scope.state.actionInProgress = false;
+        });
+    }
+
+    function validateForm(accessControlData, isAdmin) {
+      $scope.state.formValidationError = '';
+      var error = FormValidator.validateAccessControl(accessControlData, isAdmin) || $scope.formValues.Secrets.$error || $scope.formValues.Configs.$error;
+
+      if (error) {
+        $scope.state.formValidationError = error;
+        return false;
+      }
+      return true;
+    }
+
+    $scope.volumesAreValid = volumesAreValid;
+    function volumesAreValid() {
+      const volumes = $scope.formValues.Volumes;
+      return volumes.every((volume) => volume.Target && volume.Source);
+    }
+
+    $scope.create = function createService() {
+      var accessControlData = $scope.formValues.AccessControlData;
+
+      if (!validateForm(accessControlData, $scope.isAdmin)) {
+        return;
+      }
+
+      $scope.state.actionInProgress = true;
+      var config = prepareConfiguration();
+      createNewService(config, accessControlData);
+    };
+
+    function initSlidersMaxValuesBasedOnNodeData(nodes) {
+      var maxCpus = 0;
+      var maxMemory = 0;
+      for (var n in nodes) {
+        if (nodes[n].CPUs && nodes[n].CPUs > maxCpus) {
+          maxCpus = nodes[n].CPUs;
+        }
+        if (nodes[n].Memory && nodes[n].Memory > maxMemory) {
+          maxMemory = nodes[n].Memory;
+        }
+      }
+      if (maxCpus > 0) {
+        $scope.state.sliderMaxCpu = maxCpus / 1000000000;
+      } else {
+        $scope.state.sliderMaxCpu = 32;
+      }
+      if (maxMemory > 0) {
+        $scope.state.sliderMaxMemory = Math.floor(maxMemory / 1000 / 1000);
+      } else {
+        $scope.state.sliderMaxMemory = 32768;
+      }
+    }
+
+    function initView() {
+      var apiVersion = $scope.applicationState.endpoint.apiVersion;
+
+      $q.all({
+        volumes: VolumeService.volumes(),
+        networks: NetworkService.networks(true, true, false),
+        secrets: apiVersion >= 1.25 ? SecretService.secrets() : [],
+        configs: apiVersion >= 1.3 ? ConfigService.configs(endpoint.Id) : [],
+        nodes: NodeService.nodes(),
+        availableLoggingDrivers: PluginService.loggingPlugins(apiVersion < 1.25),
+        allowBindMounts: checkIfAllowedBindMounts(),
+      })
+        .then(function success(data) {
+          $scope.availableVolumes = data.volumes;
+          $scope.availableNetworks = data.networks;
+          $scope.availableSecrets = data.secrets;
+          $scope.availableConfigs = data.configs;
+          $scope.availableLoggingDrivers = data.availableLoggingDrivers;
+          initSlidersMaxValuesBasedOnNodeData(data.nodes);
+          $scope.isAdmin = Authentication.isAdmin();
+          $scope.allowBindMounts = data.allowBindMounts;
+        })
+        .catch(function error(err) {
+          Notifications.error('Failure', err, 'Unable to initialize view');
+        });
+    }
+
+    initView();
+
+    async function checkIfAllowedBindMounts() {
+      const isAdmin = Authentication.isAdmin();
+
+      const { allowBindMountsForRegularUsers } = endpoint.SecuritySettings;
+
+      return isAdmin || allowBindMountsForRegularUsers;
+    }
+  },
+]);
diff --git a/app/docker/views/services/create/createservice.html b/app/docker/views/services/create/createservice.html
new file mode 100644
index 0000000..cbaf5c6
--- /dev/null
+++ b/app/docker/views/services/create/createservice.html
@@ -0,0 +1,505 @@
+<page-header title="'Create service'" breadcrumbs="[{label:'Services', link:'docker.services'}, 'Add service']"> </page-header>
+
+<div class="row">
+  <div class="col-lg-12 col-md-12 col-xs-12">
+    <rd-widget>
+      <rd-widget-body>
+        <form class="form-horizontal" autocomplete="off">
+          <!-- name-input -->
+          <div class="form-group">
+            <label for="service_name" class="col-sm-2 control-label text-left">Name</label>
+            <div class="col-sm-8">
+              <input type="text" class="form-control" ng-model="formValues.Name" id="service_name" placeholder="e.g. myService" data-cy="service-name-input" />
+            </div>
+          </div>
+          <!-- !name-input -->
+          <div class="col-sm-12 form-section-title"> Image configuration </div>
+          <!-- image-and-registry -->
+          <por-image-registry
+            model="formValues.RegistryModel"
+            auto-complete="true"
+            label-class="col-sm-2"
+            input-class="col-sm-8"
+            endpoint="endpoint"
+            is-admin="isAdmin"
+            check-rate-limits="true"
+            set-validity="setPullImageValidity"
+          >
+          </por-image-registry>
+          <!-- !image-and-registry -->
+          <div class="col-sm-12 form-section-title"> Scheduling </div>
+          <!-- scheduling-mode -->
+          <div class="form-group">
+            <div>
+              <label class="control-label col-sm-2 text-left"> Scheduling mode </label>
+              <div class="btn-group btn-group-sm col-sm-8">
+                <label class="btn btn-light" ng-model="formValues.Mode" uib-btn-radio="'global'">Global</label>
+                <label class="btn btn-light" ng-model="formValues.Mode" uib-btn-radio="'replicated'">Replicated</label>
+              </div>
+            </div>
+          </div>
+          <div class="form-group form-inline" ng-if="formValues.Mode === 'replicated'">
+            <div>
+              <label class="control-label col-sm-2 text-left"> Replicas </label>
+              <div class="col-sm-8">
+                <input type="number" class="form-control" ng-model="formValues.Replicas" id="replicas" placeholder="e.g. 3" data-cy="docker-service-create-replica-count-input" />
+              </div>
+            </div>
+          </div>
+          <!-- !scheduling-mode -->
+          <div class="col-sm-12 form-section-title"> Ports configuration </div>
+          <!-- port-mapping -->
+          <div class="form-group">
+            <label class="control-label col-sm-2 text-left">Port mapping</label>
+            <div class="col-sm-8 pt-2">
+              <span class="label label-default interactive vertical-center" ng-click="addPortBinding()"> <pr-icon icon="'plus'" mode="'alt'"></pr-icon> map additional port </span>
+            </div>
+            <div class="col-sm-12 form-inline mt-2">
+              <div ng-repeat="portBinding in formValues.Ports" class="mt-1">
+                <!-- host-port -->
+                <div class="input-group col-sm-3 input-group-sm">
+                  <span class="input-group-addon">host</span>
+                  <input type="text" class="form-control" ng-model="portBinding.PublishedPort" placeholder="e.g. 80 or 1.2.3.4:80 (optional)" data-cy="host-port-input" />
+                </div>
+                <!-- !host-port -->
+                <span style="margin: 0 10px 0 10px">
+                  <pr-icon icon="'arrow-right'"></pr-icon>
+                </span>
+                <!-- container-port -->
+                <div class="input-group col-sm-3 input-group-sm">
+                  <span class="input-group-addon">container</span>
+                  <input type="text" class="form-control" ng-model="portBinding.TargetPort" placeholder="e.g. 80" data-cy="container-port-input" />
+                </div>
+                <!-- !container-port -->
+                <!-- protocol-actions -->
+                <div class="input-group col-sm-5 input-group-sm">
+                  <div class="btn-group btn-group-sm">
+                    <label class="btn btn-light" ng-model="portBinding.Protocol" uib-btn-radio="'tcp'">TCP</label>
+                    <label class="btn btn-light" ng-model="portBinding.Protocol" uib-btn-radio="'udp'">UDP</label>
+                  </div>
+                  <div class="btn-group btn-group-sm">
+                    <label class="btn btn-light" ng-model="portBinding.PublishMode" uib-btn-radio="'ingress'">Ingress</label>
+                    <label class="btn btn-light" ng-model="portBinding.PublishMode" uib-btn-radio="'host'">Host</label>
+                  </div>
+                  <button class="btn btn-dangerlight" type="button" ng-click="removePortBinding($index)">
+                    <pr-icon icon="'trash-2'" size="'md'"></pr-icon>
+                  </button>
+                </div>
+                <!-- !protocol-actions -->
+              </div>
+            </div>
+            <!-- !port-mapping-input-list -->
+          </div>
+          <!-- !port-mapping -->
+          <!-- create-webhook -->
+          <div ng-if="endpoint.Type !== 4 && isAdmin">
+            <div class="col-sm-12 form-section-title"> Webhooks </div>
+            <div class="form-group">
+              <div class="col-sm-12">
+                <por-switch-field
+                  label-class="'col-sm-2'"
+                  checked="$ctrl.formValues.Webhook"
+                  label="'Create a service webhook'"
+                  on-change="(handleWebHookChange)"
+                  tooltip="'Create a webhook (or callback URI) to automate the update of this service. Sending a POST request to this callback URI (without requiring any authentication) will pull the most up-to-date version of the associated image and re-deploy this service.'"
+                ></por-switch-field>
+              </div>
+            </div>
+          </div>
+          <!-- !create-webhook  -->
+          <!-- access-control -->
+          <por-access-control-form form-data="formValues.AccessControlData"></por-access-control-form>
+          <!-- !access-control -->
+          <!-- actions -->
+          <div class="col-sm-12 form-section-title"> Actions </div>
+          <div class="form-group">
+            <div class="col-sm-12">
+              <button
+                type="button"
+                class="btn btn-primary btn-sm"
+                ng-disabled="state.actionInProgress || !formValues.RegistryModel.Image || !volumesAreValid()"
+                ng-click="create()"
+                button-spinner="state.actionInProgress"
+              >
+                <span ng-hide="state.actionInProgress">Create the service</span>
+                <span ng-show="state.actionInProgress">Creating service...</span>
+              </button>
+              <span class="text-danger" ng-if="state.formValidationError" style="margin-left: 5px">{{ state.formValidationError }}</span>
+            </div>
+          </div>
+          <!-- !actions -->
+        </form>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
+
+<div class="row">
+  <div class="col-lg-12 col-md-12 col-xs-12">
+    <rd-widget>
+      <rd-widget-body>
+        <ul class="nav nav-pills nav-justified">
+          <li class="active interactive"><a data-target="#command" data-toggle="tab">Command & Logging</a></li>
+          <li class="interactive"><a data-target="#volumes" data-toggle="tab">Volumes</a></li>
+          <li class="interactive"><a data-target="#network" data-toggle="tab">Network</a></li>
+          <li class="interactive"><a data-target="#env" data-toggle="tab">Env</a></li>
+          <li class="interactive"><a data-target="#labels" data-toggle="tab">Labels</a></li>
+          <li class="interactive"><a data-target="#update-config" data-toggle="tab">Update config & Restart</a></li>
+          <li class="interactive" ng-if="applicationState.endpoint.apiVersion >= 1.25"><a data-target="#secrets" data-toggle="tab">Secrets</a></li>
+          <li class="interactive"><a data-target="#configs" data-toggle="tab" ng-if="applicationState.endpoint.apiVersion >= 1.3">Configs</a></li>
+          <li class="interactive"><a data-target="#resources-placement" data-toggle="tab" ng-click="refreshSlider()">Resources & Placement</a></li>
+        </ul>
+        <!-- tab-content -->
+        <div class="tab-content">
+          <!-- tab-command -->
+          <div class="tab-pane active" id="command">
+            <form class="form-horizontal" style="margin-top: 15px">
+              <div class="col-sm-12 form-section-title"> Command </div>
+              <!-- command-input -->
+              <div class="form-group">
+                <label for="service_command" class="col-sm-2 col-lg-1 control-label text-left">Command</label>
+                <div class="col-sm-9">
+                  <input
+                    type="text"
+                    class="form-control"
+                    ng-model="formValues.Command"
+                    id="service_command"
+                    placeholder="e.g. /usr/bin/nginx -t -c /mynginx.conf"
+                    data-cy="service-command-input"
+                  />
+                </div>
+              </div>
+              <!-- !command-input -->
+              <!-- entrypoint-input -->
+              <div class="form-group">
+                <label for="service_entrypoint" class="col-sm-2 col-lg-1 control-label text-left">Entrypoint</label>
+                <div class="col-sm-9">
+                  <input
+                    type="text"
+                    class="form-control"
+                    ng-model="formValues.EntryPoint"
+                    id="service_entrypoint"
+                    placeholder="e.g. /bin/sh -c"
+                    data-cy="service-entrypoint-input"
+                  />
+                </div>
+              </div>
+              <!-- !entrypoint-input -->
+              <!-- workdir-user-input -->
+              <div class="form-group">
+                <label for="service_workingdir" class="col-sm-2 col-lg-1 control-label text-left">Working Dir</label>
+                <div class="col-sm-4">
+                  <input type="text" class="form-control" ng-model="formValues.WorkingDir" id="service_workingdir" placeholder="e.g. /myapp" data-cy="service-workingdir-input" />
+                </div>
+                <label for="service_user" class="col-sm-1 control-label text-left">User</label>
+                <div class="col-sm-4">
+                  <input type="text" class="form-control" ng-model="formValues.User" id="service_user" placeholder="e.g. nginx" data-cy="service-user-input" />
+                </div>
+              </div>
+              <!-- !workdir-user-input -->
+              <div class="col-sm-12 form-section-title"> Logging </div>
+              <!-- logging-driver -->
+              <div class="form-group">
+                <label for="log-driver" class="col-sm-2 col-lg-1 control-label text-left">Driver</label>
+                <div class="col-sm-4">
+                  <select class="form-control" ng-model="formValues.LogDriverName" id="log-driver" data-cy="service-creation-logging-driver">
+                    <option selected value="">Default logging driver</option>
+                    <option ng-repeat="driver in availableLoggingDrivers" ng-value="driver">{{ driver }}</option>
+                    <option value="none">none</option>
+                  </select>
+                </div>
+                <div class="col-sm-5">
+                  <p class="small text-muted">
+                    Logging driver for service that will override the default docker daemon driver. Select Default logging driver if you don't want to override it. Supported
+                    logging drivers can be found
+                    <a href="https://docs.docker.com/engine/admin/logging/overview/#supported-logging-drivers" target="_blank">in the Docker documentation</a>.
+                  </p>
+                </div>
+              </div>
+              <!-- !logging-driver -->
+              <!-- logging-opts -->
+              <div class="form-group">
+                <div class="col-sm-12 mt-1">
+                  <label class="control-label text-left">
+                    Options
+                    <portainer-tooltip
+                      position="'top'"
+                      message="'Add button is disabled unless a driver other than none or default is selected. Options are specific to the selected driver, refer to the driver documentation.'"
+                    ></portainer-tooltip>
+                  </label>
+                  <span
+                    class="label label-default interactive vertical-center"
+                    style="margin-left: 10px"
+                    ng-click="!formValues.LogDriverName || formValues.LogDriverName === 'none' || addLogDriverOpt(formValues.LogDriverName)"
+                  >
+                    <pr-icon icon="'plus'" mode="'alt'"></pr-icon> add logging driver option
+                  </span>
+                </div>
+                <!-- logging-opts-input-list -->
+                <div class="col-sm-12 form-inline mt-2">
+                  <div ng-repeat="opt in formValues.LogDriverOpts" class="mt-1">
+                    <div class="input-group col-sm-5 input-group-sm">
+                      <span class="input-group-addon">option</span>
+                      <input type="text" class="form-control" ng-model="opt.name" placeholder="e.g. FOO" data-cy="service-creation-logging-driver-option" />
+                    </div>
+                    <div class="input-group col-sm-5 input-group-sm">
+                      <span class="input-group-addon">value</span>
+                      <input type="text" class="form-control" ng-model="opt.value" placeholder="e.g. bar" data-cy="service-creation-logging-driver-option-value" />
+                    </div>
+                    <button class="btn btn-dangerlight" type="button" ng-click="removeLogDriverOpt($index)">
+                      <pr-icon icon="'trash-2'" size="'md'"></pr-icon>
+                    </button>
+                  </div>
+                </div>
+                <!-- logging-opts-input-list -->
+              </div>
+              <!-- !logging-opts -->
+            </form>
+          </div>
+          <!-- !tab-command -->
+          <!-- tab-volume -->
+          <div class="tab-pane" id="volumes">
+            <form class="form-horizontal" style="margin-top: 15px">
+              <!-- volumes -->
+              <div class="form-group">
+                <div class="col-sm-12" style="margin-top: 5px">
+                  <label class="control-label text-left">Volume mapping</label>
+                  <span class="label label-default interactive" style="margin-left: 10px" ng-click="addVolume()">
+                    <pr-icon icon="'plus'" mode="'alt'"></pr-icon> map additional volume
+                  </span>
+                </div>
+                <!-- volumes-input-list -->
+                <div class="col-sm-12 form-inline" style="margin-top: 10px">
+                  <div ng-repeat="volume in formValues.Volumes">
+                    <div class="col-sm-12" style="margin-top: 10px">
+                      <!-- volume-line1 -->
+                      <div class="col-sm-12 form-inline">
+                        <!-- container-path -->
+                        <div class="input-group col-sm-6">
+                          <div class="input-group input-group-sm w-full">
+                            <span class="input-group-addon">container</span>
+                            <input
+                              type="text"
+                              class="form-control"
+                              ng-model="volume.Target"
+                              placeholder="e.g. /path/in/container"
+                              data-cy="service-creation-volume-container-path"
+                            />
+                          </div>
+                          <div class="small text-warning" ng-show="!volume.Target"> <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon> Target is required. </div>
+                        </div>
+                        <!-- !container-path -->
+                        <!-- volume-type -->
+                        <div class="input-group col-sm-5" style="margin-left: 5px; vertical-align: top">
+                          <div class="btn-group btn-group-sm" ng-if="allowBindMounts">
+                            <label class="btn btn-light" ng-model="volume.Type" uib-btn-radio="'volume'" ng-click="volume.Source = null">Volume</label>
+                            <label class="btn btn-light" ng-model="volume.Type" uib-btn-radio="'bind'" ng-click="volume.Source = null">Bind</label>
+                          </div>
+                          <button class="btn btn-dangerlight" type="button" ng-click="removeVolume($index)">
+                            <pr-icon icon="'trash-2'" size="'md'"></pr-icon>
+                          </button>
+                        </div>
+                        <!-- !volume-type -->
+                      </div>
+                      <!-- !volume-line1 -->
+                      <!-- volume-line2 -->
+                      <div class="col-sm-12 form-inline" style="margin-top: 5px">
+                        <div style="height: 30px; display: inline-block; vertical-align: top; display: inline-flex; align-items: center">
+                          <pr-icon icon="'arrow-right'"></pr-icon>
+                        </div>
+                        <!-- volume -->
+                        <div class="col-sm-6 input-group" ng-if="volume.Type === 'volume'" style="float: none; padding: 0">
+                          <div class="input-group input-group-sm w-full">
+                            <span class="input-group-addon">volume</span>
+                            <select
+                              class="form-control"
+                              ng-model="volume.Source"
+                              ng-options="vol as ((vol.Id|truncate:30) + ' - ' + (vol.Driver|truncate:30)) for vol in availableVolumes"
+                              data-cy="volume-source-select"
+                            >
+                              <option selected disabled value="">Select a volume</option>
+                            </select>
+                          </div>
+                          <div class="small text-warning" ng-show="!volume.Source"> <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon> Source is required. </div>
+                        </div>
+                        <!-- !volume -->
+                        <!-- bind -->
+                        <div class="input-group input-group-sm col-sm-6" ng-if="volume.Type === 'bind'">
+                          <div class="input-group input-group-sm w-full">
+                            <span class="input-group-addon">host</span>
+                            <input type="text" class="form-control" ng-model="volume.Source" placeholder="e.g. /path/on/host" data-cy="service-creation-volume-host-path" />
+                          </div>
+                          <div class="small text-warning" ng-show="!volume.Source"> <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon> Source is required. </div>
+                        </div>
+                        <!-- !bind -->
+                        <!-- read-only -->
+                        <div class="input-group input-group-sm col-sm-5" style="margin-left: 5px; vertical-align: top">
+                          <div class="btn-group btn-group-sm">
+                            <label class="btn btn-light" ng-model="volume.ReadOnly" uib-btn-radio="false">Writable</label>
+                            <label class="btn btn-light" ng-model="volume.ReadOnly" uib-btn-radio="true">Read-only</label>
+                          </div>
+                        </div>
+                        <!-- !read-only -->
+                      </div>
+                      <!-- !volume-line2 -->
+                    </div>
+                  </div>
+                </div>
+                <!-- !volumes-input-list -->
+              </div>
+              <!-- !volumes -->
+            </form>
+          </div>
+          <!-- !tab-volume -->
+          <!-- tab-network -->
+          <div class="tab-pane" id="network">
+            <form class="form-horizontal" style="margin-top: 15px">
+              <!-- network-input -->
+              <div class="form-group">
+                <label for="container_network" class="col-sm-2 col-lg-1 control-label text-left">Network</label>
+                <div class="col-sm-9">
+                  <select class="form-control" ng-model="formValues.Network" data-cy="create-service-network-select">
+                    <option selected disabled hidden value="">Select a network</option>
+                    <option ng-repeat="net in availableNetworks | orderBy: 'Name'" ng-value="net.Name">{{ net.Name }}</option>
+                  </select>
+                </div>
+                <div class="col-sm-2"></div>
+              </div>
+              <!-- !network-input -->
+              <!-- extra-networks -->
+              <div class="form-group">
+                <div class="col-sm-12" style="margin-top: 5px">
+                  <label class="control-label text-left">Extra networks</label>
+                  <span class="label label-default interactive" style="margin-left: 10px" ng-click="addExtraNetwork()">
+                    <pr-icon icon="'plus'" mode="'alt'"></pr-icon> add extra network
+                  </span>
+                </div>
+                <!-- network-input-list -->
+                <div class="col-sm-12 form-inline" style="margin-top: 10px">
+                  <div ng-repeat="network in formValues.ExtraNetworks" style="margin-top: 2px">
+                    <select class="form-control" ng-model="network.Name" data-cy="create-service-extra-network-select-{{ $index }}">
+                      <option selected disabled hidden value="">Select a network</option>
+                      <option ng-repeat="net in availableNetworks" ng-value="net.Name">{{ net.Name }}</option>
+                    </select>
+                    <button class="btn btn-dangerlight" type="button" ng-click="removeExtraNetwork($index)">
+                      <pr-icon icon="'trash-2'" size="'md'"></pr-icon>
+                    </button>
+                  </div>
+                </div>
+                <!-- !network-input-list -->
+              </div>
+              <!-- !extra-networks -->
+              <!-- extra-hosts-variables -->
+              <div class="form-group" ng-if="applicationState.endpoint.apiVersion >= 1.25">
+                <div class="col-sm-12" style="margin-top: 5px">
+                  <label class="control-label text-left">Hosts file entries</label>
+                  <span class="label label-default interactive" style="margin-left: 10px" ng-click="addHostsEntry()">
+                    <pr-icon icon="'plus'" mode="'alt'"></pr-icon> add additional entry
+                  </span>
+                </div>
+                <!-- hosts-input-list -->
+                <div class="col-sm-12 form-inline" style="margin-top: 10px">
+                  <div ng-repeat="variable in formValues.HostsEntries" style="margin-top: 2px">
+                    <div class="input-group col-sm-5 input-group-sm">
+                      <span class="input-group-addon">value</span>
+                      <input type="text" class="form-control" ng-model="variable.value" placeholder="e.g. host:IP" data-cy="service-creation-hosts-entry" />
+                    </div>
+                    <button class="btn btn-dangerlight" type="button" ng-click="removeHostsEntry($index)">
+                      <pr-icon icon="'trash-2'" size="'md'"></pr-icon>
+                    </button>
+                  </div>
+                </div>
+                <!-- !hosts-input-list -->
+              </div>
+              <!-- !extra-hosts-variables -->
+            </form>
+          </div>
+          <!-- !tab-network -->
+          <!-- tab-env -->
+          <div class="tab-pane" id="env">
+            <div class="form-horizontal">
+              <environment-variables-panel
+                values="formValues.Env"
+                explanation="'These values will be applied to the service when created'"
+                on-change="(handleEnvVarChange)"
+              ></environment-variables-panel>
+            </div>
+          </div>
+          <!-- !tab-env -->
+          <!-- tab-labels -->
+          <div class="tab-pane" id="labels">
+            <form class="form-horizontal" style="margin-top: 15px">
+              <!-- labels -->
+              <div class="form-group">
+                <div class="col-sm-12" style="margin-top: 5px">
+                  <label class="control-label text-left">Service labels</label>
+                  <span class="label label-default interactive" style="margin-left: 10px" ng-click="addLabel()">
+                    <pr-icon icon="'plus'" mode="'alt'"></pr-icon> add service label
+                  </span>
+                </div>
+                <!-- labels-input-list -->
+                <div class="col-sm-12 form-inline" style="margin-top: 10px">
+                  <div ng-repeat="label in formValues.Labels" style="margin-top: 2px">
+                    <div class="input-group col-sm-5 input-group-sm">
+                      <span class="input-group-addon">name</span>
+                      <input type="text" class="form-control" ng-model="label.key" placeholder="e.g. com.example.foo" data-cy="service-creation-label" />
+                    </div>
+                    <div class="input-group col-sm-5 input-group-sm">
+                      <span class="input-group-addon">value</span>
+                      <input type="text" class="form-control" ng-model="label.value" placeholder="e.g. bar" data-cy="service-creation-label-value" />
+                    </div>
+                    <button class="btn btn-dangerlight" type="button" ng-click="removeLabel($index)">
+                      <pr-icon icon="'trash-2'" size="'md'"></pr-icon>
+                    </button>
+                  </div>
+                </div>
+                <!-- !labels-input-list -->
+              </div>
+              <!-- !labels-->
+              <!-- container-labels -->
+              <div class="form-group">
+                <div class="col-sm-12" style="margin-top: 5px">
+                  <label class="control-label text-left">Container labels</label>
+                  <span class="label label-default interactive" style="margin-left: 10px" ng-click="addContainerLabel()">
+                    <pr-icon icon="'plus'" mode="'alt'"></pr-icon> add container label
+                  </span>
+                </div>
+                <!-- container-labels-input-list -->
+                <div class="col-sm-12 form-inline" style="margin-top: 10px">
+                  <div ng-repeat="label in formValues.ContainerLabels" style="margin-top: 2px">
+                    <div class="input-group col-sm-5 input-group-sm">
+                      <span class="input-group-addon">name</span>
+                      <input type="text" class="form-control" ng-model="label.key" placeholder="e.g. com.example.foo" data-cy="service-creation-container-label" />
+                    </div>
+                    <div class="input-group col-sm-5 input-group-sm">
+                      <span class="input-group-addon">value</span>
+                      <input type="text" class="form-control" ng-model="label.value" placeholder="e.g. bar" data-cy="service-creation-container-label-value" />
+                    </div>
+                    <button class="btn btn-dangerlight" type="button" ng-click="removeContainerLabel($index)">
+                      <pr-icon icon="'trash-2'" size="'md'"></pr-icon>
+                    </button>
+                  </div>
+                </div>
+                <!-- !container-labels-input-list -->
+              </div>
+              <!-- !container-labels-->
+            </form>
+          </div>
+          <!-- !tab-labels -->
+          <!-- tab-update-config -->
+          <div class="tab-pane" id="update-config" ng-include="'app/docker/views/services/create/includes/update-restart.html'"></div>
+          <!-- !tab-update-config -->
+          <!-- tab-secrets -->
+          <div class="tab-pane" id="secrets" ng-if="applicationState.endpoint.apiVersion >= 1.25" ng-include="'app/docker/views/services/create/includes/secret.html'"></div>
+          <!-- !tab-secrets -->
+          <!-- tab-configs -->
+          <div class="tab-pane" id="configs" ng-if="applicationState.endpoint.apiVersion >= 1.3" ng-include="'app/docker/views/services/create/includes/config.html'"></div>
+          <!-- !tab-configs -->
+          <!-- tab-resources-placement -->
+          <div class="tab-pane" id="resources-placement" ng-include="'app/docker/views/services/create/includes/resources-placement.html'"></div>
+          <!-- !tab-resources-placement -->
+        </div>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
diff --git a/app/docker/views/services/create/includes/config.html b/app/docker/views/services/create/includes/config.html
new file mode 100644
index 0000000..3352690
--- /dev/null
+++ b/app/docker/views/services/create/includes/config.html
@@ -0,0 +1,37 @@
+<form class="form-horizontal" style="margin-top: 15px">
+  <div class="form-group">
+    <div class="col-sm-12" style="margin-top: 5px">
+      <label class="control-label text-left">Configs</label>
+      <span class="label label-default interactive" style="margin-left: 10px" ng-click="addConfig()"> <pr-icon icon="'plus'" mode="'alt'"></pr-icon> add a config </span>
+    </div>
+    <!-- info message -->
+    <div class="form-group" ng-show="formValues.Configs.$invalid" style="margin-bottom: 0px">
+      <div class="col-sm-12 small text-warning" style="padding-left: 35px; padding-top: 20px">
+        <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon> {{ formValues.Configs.$error }}
+      </div>
+    </div>
+    <div class="col-sm-12 form-inline" style="margin-top: 10px">
+      <div ng-repeat="config in formValues.Configs" style="margin-top: 2px">
+        <div class="input-group col-sm-4 input-group-sm">
+          <span class="input-group-addon">config</span>
+          <select
+            class="form-control"
+            ng-change="checkIfConfigDuplicated()"
+            ng-model="config.model"
+            ng-options="config.Name for config in availableConfigs | orderBy: 'Name'"
+            data-cy="docker-stack-configs-select"
+          >
+            <option value="" selected="selected">Select a config</option>
+          </select>
+        </div>
+        <div class="input-group col-sm-4 input-group-sm">
+          <span class="input-group-addon">Path in container</span>
+          <input class="form-control" ng-model="config.FileName" placeholder="e.g. /path/in/container" />
+        </div>
+        <button class="btn btn-dangerlight" type="button" ng-click="removeConfig($index)">
+          <pr-icon icon="'trash-2'" size="'md'"></pr-icon>
+        </button>
+      </div>
+    </div>
+  </div>
+</form>
diff --git a/app/docker/views/services/create/includes/resources-placement.html b/app/docker/views/services/create/includes/resources-placement.html
new file mode 100644
index 0000000..16cd4c7
--- /dev/null
+++ b/app/docker/views/services/create/includes/resources-placement.html
@@ -0,0 +1,152 @@
+<form class="form-horizontal" style="margin-top: 15px">
+  <div class="col-sm-12 form-section-title"> Resources </div>
+  <!-- memory-reservation-input -->
+  <div class="form-group">
+    <label for="memory-reservation" class="col-sm-3 col-lg-2 control-label text-left" style="margin-top: 20px"> Memory reservation </label>
+    <div class="col-sm-3">
+      <slider
+        model="formValues.MemoryReservation"
+        floor="0"
+        ceil="state.sliderMaxMemory"
+        step="256"
+        ng-if="state.sliderMaxMemory"
+        data-cy="docker-services-create-memory-reservation-slider"
+      ></slider>
+    </div>
+    <div class="col-sm-2">
+      <input type="number" data-cy="docker-services-create-memory-reservation-input" min="0" class="form-control" ng-model="formValues.MemoryReservation" />
+    </div>
+    <div class="col-sm-4">
+      <p class="small text-muted" style="margin-top: 7px"> Minimum memory available on a node to run a task (<b>MB</b>) </p>
+    </div>
+  </div>
+  <!-- !memory-reservation-input -->
+  <!-- memory-limit-input -->
+  <div class="form-group">
+    <label for="memory-limit" class="col-sm-3 col-lg-2 control-label text-left" style="margin-top: 20px"> Memory limit </label>
+    <div class="col-sm-3">
+      <slider
+        model="formValues.MemoryLimit"
+        floor="0"
+        ceil="state.sliderMaxMemory"
+        step="256"
+        ng-if="state.sliderMaxMemory"
+        data-cy="docker-services-create-memory-limit-slider"
+      ></slider>
+    </div>
+    <div class="col-sm-2">
+      <input type="number" data-cy="docker-services-create-memory-limit-input" min="0" class="form-control" ng-model="formValues.MemoryLimit" />
+    </div>
+    <div class="col-sm-4" style="margin-top: 7px">
+      <p class="small text-muted"> Maximum memory usage per task (<b>MB</b>) </p>
+    </div>
+  </div>
+  <!-- !memory-limit-input -->
+  <!-- cpu-reservation-input -->
+  <div class="form-group">
+    <label for="cpu-reservation" class="col-sm-3 col-lg-2 control-label text-left" style="margin-top: 20px"> CPU reservation </label>
+    <div class="col-sm-5">
+      <slider
+        model="formValues.CpuReservation"
+        floor="0"
+        ceil="state.sliderMaxCpu"
+        step="0.25"
+        precision="2"
+        ng-if="state.sliderMaxCpu"
+        data-cy="docker-services-create-cpu-reservation-slider"
+      ></slider>
+    </div>
+    <div class="col-sm-4" style="margin-top: 20px">
+      <p class="small text-muted"> Minimum CPU available on a node to run a task </p>
+    </div>
+  </div>
+  <!-- !cpu-reservation-input -->
+  <!-- cpu-limit-input -->
+  <div class="form-group">
+    <label for="cpu-limit" class="col-sm-3 col-lg-2 control-label text-left" style="margin-top: 20px"> CPU limit </label>
+    <div class="col-sm-5">
+      <slider
+        model="formValues.CpuLimit"
+        floor="0"
+        ceil="state.sliderMaxCpu"
+        step="0.25"
+        precision="2"
+        ng-if="state.sliderMaxCpu"
+        data-cy="docker-services-create-cpu-limit-slider"
+      ></slider>
+    </div>
+    <div class="col-sm-4" style="margin-top: 20px">
+      <p class="small text-muted"> Maximum CPU usage per task </p>
+    </div>
+  </div>
+  <!-- !cpu-limit-input -->
+  <div class="col-sm-12 form-section-title"> Placement </div>
+  <!-- placement-constraints -->
+  <div class="form-group">
+    <div class="col-sm-12" style="margin-top: 5px">
+      <label class="control-label text-left">Placement constraints</label>
+      <span class="label label-default interactive" style="margin-left: 10px" ng-click="addPlacementConstraint()">
+        <pr-icon icon="'plus'" mode="'alt'"></pr-icon> placement constraint
+      </span>
+    </div>
+    <div class="col-sm-12 form-inline" style="margin-top: 10px">
+      <div ng-repeat="constraint in formValues.PlacementConstraints" style="margin-top: 2px">
+        <div class="input-group col-sm-4 input-group-sm">
+          <span class="input-group-addon">name</span>
+          <input type="text" class="form-control" ng-model="constraint.key" placeholder="e.g. node.role" data-cy="docker-services-create-placement-constraint-name-{{ $index }}" />
+        </div>
+        <div class="input-group col-sm-1 input-group-sm">
+          <select name="constraintOperator" class="form-control" ng-model="constraint.operator" data-cy="docker-services-create-placement-constraint-operator-">
+            <option value="==">==</option>
+            <option value="!=">!=</option>
+          </select>
+        </div>
+        <div class="input-group col-sm-5 input-group-sm">
+          <span class="input-group-addon">value</span>
+          <input type="text" class="form-control" ng-model="constraint.value" placeholder="e.g. manager" data-cy="docker-services-create-placement-constraint-value-{{ $index }}" />
+        </div>
+        <button class="btn btn-dangerlight" type="button" ng-click="removePlacementConstraint($index)">
+          <pr-icon icon="'trash-2'" size="'md'"></pr-icon>
+        </button>
+      </div>
+    </div>
+  </div>
+  <!-- !placement-constraints -->
+  <!-- placement-preferences -->
+  <div class="form-group" ng-if="applicationState.endpoint.apiVersion >= 1.3">
+    <div class="col-sm-12" style="margin-top: 5px">
+      <label class="control-label text-left">Placement preferences</label>
+      <span class="label label-default interactive" style="margin-left: 10px" ng-click="addPlacementPreference()">
+        <pr-icon icon="'plus'" mode="'alt'"></pr-icon> placement preference
+      </span>
+    </div>
+    <div class="col-sm-12 form-inline" style="margin-top: 10px">
+      <div ng-repeat="preference in formValues.PlacementPreferences" style="margin-top: 2px">
+        <div class="input-group col-sm-4 input-group-sm">
+          <span class="input-group-addon">strategy</span>
+          <input
+            type="text"
+            class="form-control"
+            ng-model="preference.strategy"
+            placeholder="e.g. spread"
+            data-cy="docker-services-create-placement-preference-strategy-{{ $index }}"
+          />
+        </div>
+        <div class="input-group col-sm-5 input-group-sm">
+          <span class="input-group-addon">value</span>
+          <input
+            type="text"
+            class="form-control"
+            ng-model="preference.value"
+            placeholder="e.g. node.labels.datacenter"
+            data-cy="docker-services-create-placement-preference-value-{{ $index }}"
+          />
+        </div>
+        <button class="btn btn-dangerlight" type="button" ng-click="removePlacementPreference($index)">
+          <pr-icon icon="'trash-2'" size="'md'"></pr-icon>
+        </button>
+      </div>
+    </div>
+  </div>
+  <!-- !placement-preferences -->
+</form>
diff --git a/app/docker/views/services/create/includes/secret.html b/app/docker/views/services/create/includes/secret.html
new file mode 100644
index 0000000..a82cf25
--- /dev/null
+++ b/app/docker/views/services/create/includes/secret.html
@@ -0,0 +1,49 @@
+<form class="form-horizontal" style="margin-top: 15px">
+  <div class="form-group">
+    <div class="col-sm-12 small text-muted">
+      By default, secrets will be available under <code>/run/secrets/$SECRET_NAME</code> in containers (Linux) or
+      <code>C:\ProgramData\Docker\secrets\$SECRET_NAME</code> (Windows).</div
+    >
+  </div>
+  <div class="form-group">
+    <div class="col-sm-12" style="margin-top: 5px">
+      <label class="control-label text-left">Secrets</label>
+      <span class="label label-default interactive" style="margin-left: 10px" ng-click="addSecret()"> <pr-icon icon="'plus'" mode="'alt'"></pr-icon> add a secret </span>
+    </div>
+    <!-- info message -->
+    <div class="form-group" ng-show="formValues.Secrets.$invalid" style="margin-bottom: 0px">
+      <div class="col-sm-12 small text-warning" style="padding-left: 35px; padding-top: 20px">
+        <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon> {{ formValues.Secrets.$error }}
+      </div>
+    </div>
+    <div class="col-sm-12 form-inline" style="margin-top: 10px">
+      <div ng-repeat="secret in formValues.Secrets track by $index" style="margin-top: 4px">
+        <div class="input-group col-sm-4 input-group-sm">
+          <span class="input-group-addon">secret</span>
+          <select
+            class="form-control"
+            ng-model="secret.model"
+            ng-change="checkIfSecretDuplicated()"
+            ng-options="secret.Name for secret in availableSecrets | orderBy: 'Name'"
+            data-cy="docker-stack-secrets-select"
+          >
+            <option value="" selected="selected">Select a secret</option>
+          </select>
+        </div>
+        <div class="input-group col-sm-4 input-group-sm" ng-if="applicationState.endpoint.apiVersion >= 1.3 && secret.overrideTarget">
+          <span class="input-group-addon">target</span>
+          <input class="form-control" ng-model="secret.target" placeholder="/path/in/container" />
+        </div>
+        <div class="input-group col-sm-3 input-group-sm">
+          <div class="btn-group btn-group-sm" ng-if="applicationState.endpoint.apiVersion >= 1.3">
+            <label class="btn btn-light" ng-model="secret.overrideTarget" uib-btn-radio="false">Default location</label>
+            <label class="btn btn-light" ng-model="secret.overrideTarget" uib-btn-radio="true">Override</label>
+          </div>
+          <button class="btn btn-dangerlight" type="button" ng-click="removeSecret($index)">
+            <pr-icon icon="'trash-2'" size="'md'"></pr-icon>
+          </button>
+        </div>
+      </div>
+    </div>
+  </div>
+</form>
diff --git a/app/docker/views/services/create/includes/update-restart.html b/app/docker/views/services/create/includes/update-restart.html
new file mode 100644
index 0000000..c9f944f
--- /dev/null
+++ b/app/docker/views/services/create/includes/update-restart.html
@@ -0,0 +1,145 @@
+<form class="form-horizontal" style="margin-top: 15px">
+  <div class="col-sm-12 form-section-title"> Update config </div>
+  <!-- parallelism-input -->
+  <div class="form-group">
+    <label for="parallelism" class="col-sm-3 col-lg-2 control-label text-left">Update parallelism</label>
+    <div class="col-sm-4 col-lg-3">
+      <input type="number" data-cy="docker-service-update-parallelism-input" class="form-control" ng-model="formValues.Parallelism" id="parallelism" placeholder="e.g. 1" />
+    </div>
+    <div class="col-sm-5">
+      <p class="small text-muted"> Maximum number of tasks to be updated simultaneously (0 to update all at once). </p>
+    </div>
+  </div>
+  <!-- !parallelism-input -->
+  <!-- delay-input -->
+  <div class="form-group">
+    <label for="update-delay" class="col-sm-3 col-lg-2 control-label text-left">
+      Update delay
+      <portainer-tooltip message="'Supported format examples: 1h, 5m, 10s, 1000ms, 15us, 60ns.'"></portainer-tooltip>
+    </label>
+    <div class="col-sm-4 col-lg-3">
+      <input
+        type="text"
+        class="form-control"
+        ng-model="formValues.UpdateDelay"
+        id="update-delay"
+        placeholder="e.g. 1m"
+        ng-pattern="/^([0-9]+)(h|m|s|ms|us|ns)$/i"
+        data-cy="docker-service-update-delay-input"
+      />
+    </div>
+    <div class="col-sm-5">
+      <p class="small text-muted"> Amount of time between updates expressed by a number followed by unit (ns|us|ms|s|m|h). Default value is 0s, 0 seconds. </p>
+    </div>
+  </div>
+  <!-- !delay-input -->
+  <!-- failureAction-input -->
+  <div class="form-group">
+    <label for="failure-action" class="col-sm-3 col-lg-2 control-label text-left">Update failure action</label>
+    <div class="col-sm-4 col-lg-3">
+      <div class="btn-group btn-group-sm">
+        <label class="btn btn-light" ng-model="formValues.FailureAction" uib-btn-radio="'continue'">Continue</label>
+        <label class="btn btn-light" ng-model="formValues.FailureAction" uib-btn-radio="'pause'">Pause</label>
+      </div>
+    </div>
+    <div class="col-sm-5">
+      <p class="small text-muted"> Action taken on failure to start after update. </p>
+    </div>
+  </div>
+  <!-- !failureAction-input -->
+  <!-- order-input -->
+  <div class="form-group" ng-if="applicationState.endpoint.apiVersion >= 1.29">
+    <label for="update-order" class="col-sm-3 col-lg-2 control-label text-left">Update order</label>
+    <div class="col-sm-4 col-lg-3">
+      <div class="btn-group btn-group-sm">
+        <label class="btn btn-light" ng-model="formValues.UpdateOrder" uib-btn-radio="'start-first'">start-first</label>
+        <label class="btn btn-light" ng-model="formValues.UpdateOrder" uib-btn-radio="'stop-first'">stop-first</label>
+      </div>
+    </div>
+    <div class="col-sm-5">
+      <p class="small text-muted"> Operation order on failure. </p>
+    </div>
+  </div>
+  <!-- !order-input -->
+
+  <div class="col-sm-12 form-section-title"> Restart policy </div>
+  <!-- restartCondition-input -->
+  <div class="form-group">
+    <label for="restart-condition" class="col-sm-3 col-lg-2 control-label text-left">Restart condition</label>
+    <div class="col-sm-4 col-lg-3">
+      <div class="btn-group btn-group-sm">
+        <label class="btn btn-light" ng-model="formValues.RestartCondition" uib-btn-radio="'none'">None</label>
+        <label class="btn btn-light" ng-model="formValues.RestartCondition" uib-btn-radio="'on-failure'">On-failure</label>
+        <label class="btn btn-light" ng-model="formValues.RestartCondition" uib-btn-radio="'any'">Any</label>
+      </div>
+    </div>
+    <div class="col-sm-5">
+      <p class="small text-muted"> Restart when condition is met (default condition "any"). </p>
+    </div>
+  </div>
+  <!-- !restartCondition-input -->
+  <!-- restartDelay-input -->
+  <div class="form-group">
+    <label for="restart-delay" class="col-sm-3 col-lg-2 control-label text-left">
+      Restart delay
+      <portainer-tooltip message="'Supported format examples: 1h, 5m, 10s, 1000ms, 15us, 60ns.'"></portainer-tooltip>
+    </label>
+    <div class="col-sm-4 col-lg-3">
+      <input
+        type="text"
+        class="form-control"
+        ng-model="formValues.RestartDelay"
+        id="restart-delay"
+        placeholder="e.g. 1m"
+        ng-pattern="/^([0-9]+)(h|m|s|ms|us|ns)$/i"
+        data-cy="docker-service-restart-delay-input"
+      />
+    </div>
+    <div class="col-sm-5">
+      <p class="small text-muted"> Delay between restart attempts expressed by a number followed by unit (ns|us|ms|s|m|h). Default value is 5s, 5 seconds. </p>
+    </div>
+  </div>
+  <!-- !restartDelay-input -->
+  <!-- restartMaxAttempts-input -->
+  <div class="form-group">
+    <label for="restart-max-attempts" class="col-sm-3 col-lg-2 control-label text-left">Restart max attempts</label>
+    <div class="col-sm-4 col-lg-3">
+      <input
+        type="number"
+        data-cy="docker-service-restart-max-attempts-input"
+        class="form-control"
+        ng-model="formValues.RestartMaxAttempts"
+        id="restart-max-attempts"
+        placeholder="e.g. 0"
+      />
+    </div>
+    <div class="col-sm-5">
+      <p class="small text-muted"> Maximum attempts to restart a given task before giving up (default value is 0, which means unlimited). </p>
+    </div>
+  </div>
+  <!-- !restartMaxAttempts-input -->
+  <!-- restartWindow-input -->
+  <div class="form-group">
+    <label for="restart-window" class="col-sm-3 col-lg-2 control-label text-left">
+      Restart window
+      <portainer-tooltip message="'Supported format examples: 1h, 5m, 10s, 1000ms, 15us, 60ns.'"></portainer-tooltip>
+    </label>
+    <div class="col-sm-4 col-lg-3">
+      <input
+        type="text"
+        class="form-control"
+        ng-model="formValues.RestartWindow"
+        id="restart-window"
+        placeholder="e.g. 1m"
+        ng-pattern="/^([0-9]+)(h|m|s|ms|us|ns)$/i"
+        data-cy="docker-service-restart-window-input"
+      />
+    </div>
+    <div class="col-sm-5">
+      <p class="small text-muted">
+        Time window to evaluate restart attempts expressed by a number followed by unit (ns|us|ms|s|m|h). Default value is 0 seconds, which is unbounded.
+      </p>
+    </div>
+  </div>
+  <!-- !restartWindow-input -->
+</form>
diff --git a/app/docker/views/services/edit/includes/configs.html b/app/docker/views/services/edit/includes/configs.html
new file mode 100644
index 0000000..435e00b
--- /dev/null
+++ b/app/docker/views/services/edit/includes/configs.html
@@ -0,0 +1,75 @@
+<form ng-if="applicationState.endpoint.apiVersion >= 1.3" id="service-configs" ng-submit="updateService(service)">
+  <rd-widget>
+    <rd-widget-header icon="list" title-text="Configs"> </rd-widget-header>
+    <rd-widget-body classes="no-padding">
+      <div class="form-inline" style="padding: 10px 20px" authorization="DockerServiceUpdate">
+        Add a config:
+        <select
+          class="form-control !h-[30px] !text-[13px]"
+          ng-options="config.Name for config in filterConfigs(configs) | orderBy: 'Name'"
+          ng-model="newConfig"
+          data-cy="service-configs-select"
+        >
+          <option selected disabled hidden value="">Select a config</option>
+        </select>
+        <a class="btn btn-default btn-sm" ng-click="addConfig(service, newConfig)"> <pr-icon icon="'plus'"></pr-icon> Add config </a>
+      </div>
+      <table class="table" style="margin-top: 5px">
+        <thead>
+          <tr>
+            <th>Name</th>
+            <th>Path in container</th>
+            <th>UID</th>
+            <th>GID</th>
+            <th>Mode</th>
+            <th></th>
+          </tr>
+        </thead>
+        <tbody>
+          <tr ng-repeat="config in service.ServiceConfigs">
+            <td>
+              <a ui-sref="docker.configs.config({id: config.Id})">{{ config.Name }}</a>
+            </td>
+            <td ng-if="!config.credSpec">
+              <input
+                class="form-control"
+                ng-model="config.FileName"
+                ng-change="updateConfig(service)"
+                placeholder="e.g. /path/in/container"
+                required
+                disable-authorization="DockerServiceUpdate"
+                ng-disabled="config.credSpec"
+              />
+            </td>
+            <td ng-if="!config.credSpec">{{ config.Uid }}</td>
+            <td ng-if="!config.credSpec">{{ config.Gid }}</td>
+            <td ng-if="!config.credSpec">{{ config.Mode }}</td>
+            <td ng-if="config.credSpec" colspan="4">Credential Spec</td>
+            <td authorization="DockerServiceUpdate">
+              <button class="btn btn-dangerlight pull-right" type="button" ng-click="removeConfig(service, $index)" ng-disabled="isUpdating">
+                <pr-icon icon="'trash-2'" size="'md'"></pr-icon>
+              </button>
+            </td>
+          </tr>
+          <tr ng-if="service.ServiceConfigs.length === 0">
+            <td colspan="6" class="text-muted text-center">No configs associated to this service.</td>
+          </tr>
+        </tbody>
+      </table>
+    </rd-widget-body>
+    <rd-widget-footer authorization="DockerServiceUpdate">
+      <div class="btn-toolbar" role="toolbar">
+        <div class="btn-group" role="group">
+          <button type="submit" class="btn btn-primary btn-sm" ng-disabled="!hasChanges(service, ['ServiceConfigs'])">Apply changes</button>
+          <button type="button" class="btn btn-default btn-sm dropdown-toggle" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
+            <pr-icon icon="'chevron-down'"></pr-icon>
+          </button>
+          <ul class="dropdown-menu">
+            <li><a ng-click="cancelChanges(service, ['ServiceConfigs'])">Reset changes</a></li>
+            <li><a ng-click="cancelChanges(service)">Reset all changes</a></li>
+          </ul>
+        </div>
+      </div>
+    </rd-widget-footer>
+  </rd-widget>
+</form>
diff --git a/app/docker/views/services/edit/includes/constraints.html b/app/docker/views/services/edit/includes/constraints.html
new file mode 100644
index 0000000..b076558
--- /dev/null
+++ b/app/docker/views/services/edit/includes/constraints.html
@@ -0,0 +1,92 @@
+<div ng-if="service.ServiceConstraints" id="service-placement-constraints">
+  <rd-widget>
+    <rd-widget-header icon="list" title-text="Placement constraints">
+      <div class="nopadding" authorization="DockerServiceUpdate">
+        <a class="btn btn-secondary btn-sm pull-right" ng-click="isUpdating || addPlacementConstraint(service)" ng-disabled="isUpdating">
+          <pr-icon icon="'plus'"></pr-icon> placement constraint
+        </a>
+      </div>
+    </rd-widget-header>
+    <rd-widget-body ng-if="service.ServiceConstraints.length === 0">
+      <p>There are no placement constraints for this service.</p>
+    </rd-widget-body>
+    <rd-widget-body ng-if="service.ServiceConstraints.length > 0" classes="no-padding">
+      <table class="table">
+        <thead>
+          <tr>
+            <th>Name</th>
+            <th>Operator</th>
+            <th>Value</th>
+          </tr>
+        </thead>
+        <tbody>
+          <tr ng-repeat="constraint in service.ServiceConstraints">
+            <td>
+              <div class="input-group input-group-sm">
+                <input
+                  type="text"
+                  data-cy="placement-constraint-key-input-{{ $index }}"
+                  class="form-control"
+                  ng-model="constraint.key"
+                  placeholder="e.g. node.role"
+                  ng-change="updatePlacementConstraint(service, constraint)"
+                  ng-disabled="isUpdating"
+                  disable-authorization="DockerServiceUpdate"
+                />
+              </div>
+            </td>
+            <td>
+              <div class="input-group input-group-sm">
+                <select
+                  name="constraintOperator"
+                  class="form-control"
+                  ng-model="constraint.operator"
+                  ng-change="updatePlacementConstraint(service, constraint)"
+                  ng-disabled="isUpdating"
+                  disable-authorization="DockerServiceUpdate"
+                  data-cy="placement-constraint-operator=selectoer"
+                >
+                  <option value="==">==</option>
+                  <option value="!=">!=</option>
+                </select>
+              </div>
+            </td>
+            <td>
+              <div class="input-group input-group-sm">
+                <input
+                  type="text"
+                  data-cy="placement-constraint-value-input-{{ $index }}"
+                  class="form-control"
+                  ng-model="constraint.value"
+                  placeholder="e.g. manager"
+                  ng-change="updatePlacementConstraint(service, constraint)"
+                  ng-disabled="isUpdating"
+                  disable-authorization="DockerServiceUpdate"
+                />
+                <span class="input-group-btn" authorization="DockerServiceUpdate">
+                  <button class="btn btn-dangerlight" type="button" ng-click="removePlacementConstraint(service, $index)" ng-disabled="isUpdating">
+                    <pr-icon icon="'trash-2'" size="'md'"></pr-icon>
+                  </button>
+                </span>
+              </div>
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </rd-widget-body>
+    <rd-widget-footer authorization="DockerServiceUpdate">
+      <div class="btn-toolbar" role="toolbar">
+        <div class="btn-group" role="group">
+          <button type="button" class="btn btn-primary btn-sm" ng-disabled="!hasChanges(service, ['ServiceConstraints'])" ng-click="updateService(service)">Apply changes</button>
+          <button type="button" class="btn btn-default btn-sm dropdown-toggle" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
+            <pr-icon icon="'chevron-down'"></pr-icon>
+          </button>
+          <ul class="dropdown-menu">
+            <li><a ng-click="cancelChanges(service, ['ServiceConstraints'])">Reset changes</a></li>
+            <li><a ng-click="cancelChanges(service)">Reset all changes</a></li>
+          </ul>
+        </div>
+      </div>
+    </rd-widget-footer>
+  </rd-widget>
+</div>
diff --git a/app/docker/views/services/edit/includes/container-specs.html b/app/docker/views/services/edit/includes/container-specs.html
new file mode 100644
index 0000000..2b51e69
--- /dev/null
+++ b/app/docker/views/services/edit/includes/container-specs.html
@@ -0,0 +1,52 @@
+<div>
+  <rd-widget>
+    <rd-widget-header icon="list" title-text="Container spec"></rd-widget-header>
+    <rd-widget-body classes="no-padding">
+      <table class="!mb-0 table">
+        <tbody>
+          <tr>
+            <td class="w-1/5">CMD</td>
+            <td
+              ><code ng-if="service.Command">{{ service.Command | command }}</code></td
+            >
+            <td>
+              <p class="small text-muted" style="margin-top: 10px"> Command to execute. </p>
+            </td>
+          </tr>
+          <tr>
+            <td>Args</td>
+            <td
+              ><code ng-if="service.Arguments">{{ service.Arguments }}</code></td
+            >
+            <td>
+              <p class="small text-muted" style="margin-top: 10px"> Arguments passed to command in container. </p>
+            </td>
+          </tr>
+          <tr>
+            <td>User</td>
+            <td>{{ service.User }}</td>
+            <td>
+              <p class="small text-muted" style="margin-top: 10px"> Username or UID. </p>
+            </td>
+          </tr>
+          <tr>
+            <td>Working directory</td>
+            <td>{{ service.Dir }}</td>
+            <td>
+              <p class="small text-muted" style="margin-top: 10px"> Working directory inside the container. </p>
+            </td>
+          </tr>
+          <tr>
+            <td>Stop grace period</td>
+            <td>{{ service.StopGracePeriod }}</td>
+            <td>
+              <p class="small text-muted" style="margin-top: 10px">
+                The duration to wait before forcefully terminating a container (default: 10 seconds as defined by the Docker engine).
+              </p>
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </rd-widget-body>
+  </rd-widget>
+</div>
diff --git a/app/docker/views/services/edit/includes/containerlabels.html b/app/docker/views/services/edit/includes/containerlabels.html
new file mode 100644
index 0000000..a999fa2
--- /dev/null
+++ b/app/docker/views/services/edit/includes/containerlabels.html
@@ -0,0 +1,79 @@
+<div id="service-container-labels">
+  <rd-widget>
+    <rd-widget-header icon="list" title-text="Container labels">
+      <div class="nopadding" authorization="DockerServiceUpdate">
+        <a class="btn btn-secondary btn-sm pull-right" ng-click="isUpdating ||addContainerLabel(service)" ng-disabled="isUpdating">
+          <pr-icon icon="'plus'"></pr-icon> container label
+        </a>
+      </div>
+    </rd-widget-header>
+    <rd-widget-body ng-if="service.ServiceContainerLabels.length === 0">
+      <p>There are no container labels for this service.</p>
+    </rd-widget-body>
+    <rd-widget-body ng-if="service.ServiceContainerLabels.length > 0" classes="no-padding">
+      <table class="table">
+        <thead>
+          <tr>
+            <th>Label</th>
+            <th>Value</th>
+          </tr>
+        </thead>
+        <tbody>
+          <tr ng-repeat="label in service.ServiceContainerLabels">
+            <td>
+              <div class="input-group input-group-sm">
+                <span class="input-group-addon fit-text-size">name</span>
+                <input
+                  type="text"
+                  data-cy="container-label-key-{{ $index }}"
+                  class="form-control"
+                  ng-model="label.key"
+                  placeholder="e.g. com.example.foo"
+                  ng-change="updateContainerLabel(service, label)"
+                  ng-disabled="isUpdating"
+                  disable-authorization="DockerServiceUpdate"
+                />
+              </div>
+            </td>
+            <td>
+              <div class="input-group input-group-sm">
+                <span class="input-group-addon fit-text-size">value</span>
+                <input
+                  type="text"
+                  data-cy="container-label-value_{{ $index }}"
+                  class="form-control"
+                  ng-model="label.value"
+                  placeholder="e.g. bar"
+                  ng-change="updateContainerLabel(service, label)"
+                  ng-disabled="isUpdating"
+                  disable-authorization="DockerServiceUpdate"
+                />
+                <span class="input-group-btn" authorization="DockerServiceUpdate">
+                  <button class="btn btn-dangerlight" type="button" ng-click="removeContainerLabel(service, $index)" ng-disabled="isUpdating">
+                    <pr-icon icon="'trash-2'" size="'md'"></pr-icon>
+                  </button>
+                </span>
+              </div>
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </rd-widget-body>
+    <rd-widget-footer authorization="DockerServiceUpdate">
+      <div class="btn-toolbar" role="toolbar">
+        <div class="btn-group" role="group">
+          <button type="button" class="btn btn-primary btn-sm" ng-disabled="!hasChanges(service, ['ServiceContainerLabels'])" ng-click="updateService(service)"
+            >Apply changes</button
+          >
+          <button type="button" class="btn btn-default btn-sm dropdown-toggle" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
+            <pr-icon icon="'chevron-down'"></pr-icon>
+          </button>
+          <ul class="dropdown-menu">
+            <li><a ng-click="cancelChanges(service, ['ServiceContainerLabels'])">Reset changes</a></li>
+            <li><a ng-click="cancelChanges(service)">Reset all changes</a></li>
+          </ul>
+        </div>
+      </div>
+    </rd-widget-footer>
+  </rd-widget>
+</div>
diff --git a/app/docker/views/services/edit/includes/environmentvariables.html b/app/docker/views/services/edit/includes/environmentvariables.html
new file mode 100644
index 0000000..396ec6c
--- /dev/null
+++ b/app/docker/views/services/edit/includes/environmentvariables.html
@@ -0,0 +1,38 @@
+<ng-form ng-if="service.EnvironmentVariables" id="service-env-variables" name="serviceEnvForm" class="form-horizontal">
+  <rd-widget>
+    <rd-widget-header icon="list" title-text="Environment variables">
+      <div class="nopadding" authorization="DockerServiceUpdate">
+        <a class="btn btn-secondary btn-sm pull-right" ng-click="isUpdating || addEnvironmentVariable(service)" ng-disabled="isUpdating">
+          <pr-icon icon="'plus'"></pr-icon> environment variable
+        </a>
+      </div>
+    </rd-widget-header>
+    <rd-widget-body ng-if="service.EnvironmentVariables.length === 0">
+      <p>There are no environment variables for this service.</p>
+    </rd-widget-body>
+    <rd-widget-body ng-if="service.EnvironmentVariables.length > 0">
+      <environment-variables-fieldset values="service.EnvironmentVariables" on-change="(onChangeEnvVars)"></environment-variables-fieldset>
+    </rd-widget-body>
+    <rd-widget-footer authorization="DockerServiceUpdate">
+      <div class="btn-toolbar" role="toolbar">
+        <div class="btn-group" role="group">
+          <button
+            type="button"
+            class="btn btn-primary btn-sm"
+            ng-disabled="!hasChanges(service, ['EnvironmentVariables']) || serviceEnvForm.$invalid"
+            ng-click="updateService(service)"
+          >
+            Apply changes
+          </button>
+          <button type="button" class="btn btn-default btn-sm dropdown-toggle" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
+            <pr-icon icon="'chevron-down'"></pr-icon>
+          </button>
+          <ul class="dropdown-menu">
+            <li><a ng-click="cancelChanges(service, ['EnvironmentVariables'])">Reset changes</a></li>
+            <li><a ng-click="cancelChanges(service)">Reset all changes</a></li>
+          </ul>
+        </div>
+      </div>
+    </rd-widget-footer>
+  </rd-widget>
+</ng-form>
diff --git a/app/docker/views/services/edit/includes/hosts.html b/app/docker/views/services/edit/includes/hosts.html
new file mode 100644
index 0000000..5f12b79
--- /dev/null
+++ b/app/docker/views/services/edit/includes/hosts.html
@@ -0,0 +1,75 @@
+<div>
+  <rd-widget>
+    <rd-widget-header icon="list" title-text="Hosts file entries">
+      <div class="nopadding" authorization="DockerServiceUpdate">
+        <a class="btn btn-secondary btn-sm pull-right" ng-click="isUpdating ||addHostsEntry(service)" ng-disabled="isUpdating">
+          <pr-icon icon="'plus'"></pr-icon> add host entry
+        </a>
+      </div>
+    </rd-widget-header>
+    <rd-widget-body ng-if="!service.Hosts || service.Hosts.length === 0">
+      <p>The Hosts file has no extra entries.</p>
+    </rd-widget-body>
+    <rd-widget-body ng-if="service.Hosts.length > 0" classes="no-padding">
+      <table class="table">
+        <thead>
+          <tr>
+            <th>Hostname</th>
+            <th>IP</th>
+          </tr>
+        </thead>
+        <tbody>
+          <tr ng-repeat="entry in service.Hosts">
+            <td>
+              <div class="input-group input-group-sm">
+                <input
+                  type="text"
+                  class="form-control"
+                  data-cy="hosts-entry-hostname-input-{{ $index }}"
+                  ng-model="entry.hostname"
+                  placeholder="e.g. example.com"
+                  ng-change="updateHostsEntry(service, entry)"
+                  ng-disabled="isUpdating"
+                  disable-authorization="DockerServiceUpdate"
+                />
+              </div>
+            </td>
+            <td>
+              <div class="input-group input-group-sm">
+                <input
+                  type="text"
+                  data-cy="hosts-entry-ip-input-{{ $index }}"
+                  class="form-control"
+                  ng-model="entry.ip"
+                  placeholder="e.g. 10.0.1.1"
+                  ng-change="updateHostsEntry(service, entry)"
+                  ng-disabled="isUpdating"
+                  disable-authorization="DockerServiceUpdate"
+                />
+                <span class="input-group-btn" authorization="DockerServiceUpdate">
+                  <button class="btn btn-dangerlight" type="button" ng-click="removeHostsEntry(service, $index)" ng-disabled="isUpdating">
+                    <pr-icon icon="'trash-2'" size="'md'"></pr-icon>
+                  </button>
+                </span>
+              </div>
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </rd-widget-body>
+    <rd-widget-footer authorization="DockerServiceUpdate">
+      <div class="btn-toolbar" role="toolbar">
+        <div class="btn-group" role="group">
+          <button type="button" class="btn btn-primary btn-sm" ng-disabled="!hasChanges(service, ['Hosts'])" ng-click="updateService(service)">Apply changes</button>
+          <button type="button" class="btn btn-default btn-sm dropdown-toggle" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
+            <pr-icon icon="'chevron-down'"></pr-icon>
+          </button>
+          <ul class="dropdown-menu">
+            <li><a ng-click="cancelChanges(service, ['Hosts'])">Reset changes</a></li>
+            <li><a ng-click="cancelChanges(service)">Reset all changes</a></li>
+          </ul>
+        </div>
+      </div>
+    </rd-widget-footer>
+  </rd-widget>
+</div>
diff --git a/app/docker/views/services/edit/includes/image.html b/app/docker/views/services/edit/includes/image.html
new file mode 100644
index 0000000..39abe6b
--- /dev/null
+++ b/app/docker/views/services/edit/includes/image.html
@@ -0,0 +1,37 @@
+<div id="service-container-image" authorization="DockerServiceUpdate">
+  <rd-widget>
+    <rd-widget-header icon="list" title-text="Change container image"> </rd-widget-header>
+    <rd-widget-body ng-if="!isUpdating">
+      <form class="form-horizontal">
+        <por-image-registry
+          model="formValues.RegistryModel"
+          auto-complete="true"
+          label-class="col-sm-1"
+          input-class="col-sm-11"
+          endpoint="endpoint"
+          is-admin="isAdmin"
+          check-rate-limits="true"
+          set-validity="setPullImageValidity"
+        >
+        </por-image-registry>
+      </form>
+    </rd-widget-body>
+    <rd-widget-body ng-if="isUpdating">
+      <p>Image modification is disabled while service is updating.</p>
+    </rd-widget-body>
+    <rd-widget-footer authorization="DockerServiceUpdate">
+      <div class="btn-toolbar" role="toolbar">
+        <div class="btn-group" role="group">
+          <button type="button" class="btn btn-primary btn-sm" ng-disabled="!hasChanges(service, ['Image'])" ng-click="updateService(service)">Apply changes</button>
+          <button type="button" class="btn btn-default btn-sm dropdown-toggle" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
+            <pr-icon icon="'chevron-down'"></pr-icon>
+          </button>
+          <ul class="dropdown-menu">
+            <li><a ng-click="cancelChanges(service, ['Image'])">Reset changes</a></li>
+            <li><a ng-click="cancelChanges(service)">Reset all changes</a></li>
+          </ul>
+        </div>
+      </div>
+    </rd-widget-footer>
+  </rd-widget>
+</div>
diff --git a/app/docker/views/services/edit/includes/logging.html b/app/docker/views/services/edit/includes/logging.html
new file mode 100644
index 0000000..4f17720
--- /dev/null
+++ b/app/docker/views/services/edit/includes/logging.html
@@ -0,0 +1,88 @@
+<div id="service-logging-driver">
+  <rd-widget>
+    <rd-widget-header icon="list" title-text="Logging driver"> </rd-widget-header>
+    <rd-widget-body classes="no-padding">
+      <div class="form-inline" style="padding: 10px 20px" authorization="DockerServiceUpdate">
+        Driver:
+        <select
+          class="form-control !h-[30px] !text-[13px]"
+          ng-model="service.LogDriverName"
+          ng-change="updateLogDriverName(service)"
+          ng-disabled="isUpdating"
+          data-cy="logging-driver-selector"
+        >
+          <option selected value="">Default logging driver</option>
+          <option ng-repeat="driver in availableLoggingDrivers" ng-value="driver">{{ driver }}</option>
+          <option value="none">none</option>
+        </select>
+        <a class="btn btn-default btn-sm" ng-click="!service.LogDriverName || service.LogDriverName === 'none' || addLogDriverOpt(service)">
+          <pr-icon icon="'plus'"></pr-icon> Add logging driver option
+        </a>
+      </div>
+      <table class="table">
+        <thead>
+          <tr>
+            <th>Option</th>
+            <th>Value</th>
+          </tr>
+        </thead>
+        <tbody>
+          <tr ng-repeat="option in service.LogDriverOpts">
+            <td class="w-1/2">
+              <div class="input-group input-group-sm">
+                <span class="input-group-addon fit-text-size">name</span>
+                <input
+                  type="text"
+                  data-cy="service-logging-driver-option-name-input-{{ $index }}"
+                  class="form-control"
+                  ng-model="option.key"
+                  ng-disabled="option.added || isUpdating"
+                  placeholder="e.g. FOO"
+                />
+              </div>
+            </td>
+            <td>
+              <div class="input-group input-group-sm">
+                <span class="input-group-addon fit-text-size">value</span>
+                <input
+                  type="text"
+                  data-cy="service-logging-driver-option-value-input-{{ $index }}"
+                  class="form-control"
+                  ng-model="option.value"
+                  ng-change="updateLogDriverOpt(service, option)"
+                  placeholder="e.g. bar"
+                  ng-disabled="isUpdating"
+                  disable-authorization="DockerServiceUpdate"
+                />
+                <span class="input-group-btn" authorization="DockerServiceUpdate">
+                  <button class="btn btn-dangerlight" type="button" ng-click="removeLogDriverOpt(service, $index)" ng-disabled="isUpdating">
+                    <pr-icon icon="'trash-2'" size="'md'"></pr-icon>
+                  </button>
+                </span>
+              </div>
+            </td>
+          </tr>
+          <tr ng-if="service.LogDriverOpts.length === 0">
+            <td colspan="6" class="text-muted text-center">No options associated to this logging driver.</td>
+          </tr>
+        </tbody>
+      </table>
+    </rd-widget-body>
+    <rd-widget-footer authorization="DockerServiceUpdate">
+      <div class="btn-toolbar" role="toolbar">
+        <div class="btn-group" role="group">
+          <button type="button" class="btn btn-primary btn-sm" ng-disabled="!hasChanges(service, ['LogDriverName', 'LogDriverOpts'])" ng-click="updateService(service)"
+            >Apply changes</button
+          >
+          <button type="button" class="btn btn-default btn-sm dropdown-toggle" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
+            <pr-icon icon="'chevron-down'"></pr-icon>
+          </button>
+          <ul class="dropdown-menu">
+            <li><a ng-click="cancelChanges(service, ['LogDriverName', 'LogDriverOpts'])">Reset changes</a></li>
+            <li><a ng-click="cancelChanges(service)">Reset all changes</a></li>
+          </ul>
+        </div>
+      </div>
+    </rd-widget-footer>
+  </rd-widget>
+</div>
diff --git a/app/docker/views/services/edit/includes/mounts.html b/app/docker/views/services/edit/includes/mounts.html
new file mode 100644
index 0000000..1676bec
--- /dev/null
+++ b/app/docker/views/services/edit/includes/mounts.html
@@ -0,0 +1,113 @@
+<div ng-if="service.ServiceMounts" id="service-mounts">
+  <rd-widget>
+    <rd-widget-header icon="list" title-text="Mounts">
+      <div class="nopadding" authorization="DockerServiceUpdate">
+        <a class="btn btn-secondary btn-sm pull-right" ng-click="isUpdating ||addMount(service)" ng-disabled="isUpdating"> <pr-icon icon="'plus'"></pr-icon> mount </a>
+      </div>
+    </rd-widget-header>
+    <rd-widget-body ng-if="service.ServiceMounts.length === 0">
+      <p>There are no mounts for this service.</p>
+    </rd-widget-body>
+    <rd-widget-body ng-if="service.ServiceMounts.length > 0" classes="no-padding">
+      <table class="mb-0 table">
+        <thead>
+          <tr>
+            <th ng-if="isAdmin || allowBindMounts">Type</th>
+            <th>Source</th>
+            <th>Target</th>
+            <th authorization="DockerServiceUpdate">Read only</th>
+            <th authorization="DockerServiceUpdate">Actions</th>
+          </tr>
+        </thead>
+        <tbody>
+          <tr ng-repeat="(index, mount) in service.ServiceMounts">
+            <td class="!pt-6 !align-top" ng-if="isAdmin || allowBindMounts">
+              <select
+                name="mountType"
+                data-cy="mount-type-selector"
+                class="form-control !h-[30px] !text-[13px]"
+                ng-model="mount.Type"
+                ng-change="onChangeMountType(service, mount)"
+                ng-disabled="isUpdating"
+                disable-authorization="DockerServiceUpdate"
+              >
+                <option value="volume">Volume</option>
+                <option value="bind">Bind</option>
+              </select>
+            </td>
+            <td class="!pb-0 !pt-6 !align-top">
+              <div class="mb-6">
+                <select
+                  class="form-control !h-[30px] !text-[13px]"
+                  ng-model="mount.Source"
+                  ng-change="updateMount(service, mount)"
+                  ng-options="vol.Id as ((vol.Id|truncate:30) + ' - ' + (vol.Driver|truncate:30))  for vol in availableVolumes"
+                  ng-if="mount.Type === 'volume'"
+                  disable-authorization="DockerServiceUpdate"
+                  data-cy="volume-selector"
+                >
+                  <option selected disabled hidden value="">Select a volume</option>
+                </select>
+                <input
+                  type="text"
+                  data-cy="bind-mount-source-input-{{ index }}"
+                  class="form-control !h-[30px] !text-[13px]"
+                  name=""
+                  ng-model="mount.Source"
+                  placeholder="e.g. /tmp/portainer/data"
+                  ng-change="updateMount(service, mount)"
+                  ng-disabled="isUpdating || (!isAdmin && !allowBindMounts && mount.Type === 'bind')"
+                  ng-if="mount.Type === 'bind'"
+                />
+              </div>
+              <div class="small text-warning !-mt-6" ng-show="!mount.Source">
+                <div class="vertical-center"><pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon> Source is required. </div></div
+              >
+            </td>
+            <td class="!pb-0 !pt-6 !align-top">
+              <input
+                type="text"
+                data-cy="mount-target-input-{{ index }}"
+                class="form-control mb-6 !h-[30px] !text-[13px]"
+                ng-model="mount.Target"
+                placeholder="e.g. /tmp/portainer/data"
+                ng-change="updateMount(service, mount)"
+                ng-disabled="isUpdating"
+                disable-authorization="DockerServiceUpdate"
+              />
+              <div class="small text-warning !-mt-6" ng-show="!mount.Target">
+                <div class="vertical-center"><pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon> Target is required. </div></div
+              >
+            </td>
+            <td authorization="DockerServiceUpdate">
+              <por-switch-field checked="mount.ReadOnly" disabled="isUpdating" on-change="(toggleMountReadOnly)" index="index"></por-switch-field>
+            </td>
+            <td authorization="DockerServiceUpdate">
+              <span class="input-group-btn">
+                <button class="btn btn-dangerlight btn-sm" type="button" ng-click="removeMount(service, $index)" ng-disabled="isUpdating">
+                  <pr-icon icon="'trash-2'" size="'md'"></pr-icon>
+                </button>
+              </span>
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </rd-widget-body>
+    <rd-widget-footer authorization="DockerServiceUpdate">
+      <div class="btn-toolbar" role="toolbar">
+        <div class="btn-group" role="group">
+          <button type="button" class="btn btn-primary btn-sm" ng-disabled="!mountsAreValid() || !hasChanges(service, ['ServiceMounts'])" ng-click="updateService(service)">
+            Apply changes
+          </button>
+          <button type="button" class="btn btn-default btn-sm dropdown-toggle" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
+            <pr-icon icon="'chevron-down'"></pr-icon>
+          </button>
+          <ul class="dropdown-menu">
+            <li><a ng-click="cancelChanges(service, ['ServiceMounts'])">Reset changes</a></li>
+            <li><a ng-click="cancelChanges(service)">Reset all changes</a></li>
+          </ul>
+        </div>
+      </div>
+    </rd-widget-footer>
+  </rd-widget>
+</div>
diff --git a/app/docker/views/services/edit/includes/networks.html b/app/docker/views/services/edit/includes/networks.html
new file mode 100644
index 0000000..c8c1540
--- /dev/null
+++ b/app/docker/views/services/edit/includes/networks.html
@@ -0,0 +1,71 @@
+<div id="service-network-specs">
+  <rd-widget>
+    <rd-widget-header icon="list" title-text="Networks">
+      <div class="nopadding" authorization="DockerServiceUpdate">
+        <a class="btn btn-secondary btn-sm pull-right" ng-click="isUpdating || addNetwork(service)" ng-disabled="isUpdating"> <pr-icon icon="'plus'"></pr-icon> network </a>
+      </div>
+    </rd-widget-header>
+    <rd-widget-body ng-if="!service.Networks || service.Networks.length === 0">
+      <p>This service is not connected to any networks.</p>
+    </rd-widget-body>
+    <rd-widget-body ng-if="service.Networks && service.Networks.length > 0" classes="no-padding">
+      <table class="table">
+        <thead>
+          <tr>
+            <th>Name</th>
+            <th>ID</th>
+            <th>IP address</th>
+            <th>Actions</th>
+          </tr>
+        </thead>
+        <tbody>
+          <tr ng-repeat="network in service.Networks">
+            <td>
+              <select
+                ng-if="network.Editable"
+                class="form-control !h-[30px] !rounded !text-[13px]"
+                ng-model="network.Id"
+                ng-change="updateNetwork(service)"
+                ng-options="net.Id as net.Name for net in filterNetworks(swarmNetworks, network)"
+                disable-authorization="DockerServiceUpdate"
+                style="width: initial; min-width: 50%"
+                data-cy="network-selector_{{ network.Name }}"
+              >
+                <option disabled value="" selected>Select a network</option>
+              </select>
+              <span ng-if="!network.Editable">{{ network.Name }}</span>
+            </td>
+            <td>
+              <a ui-sref="docker.networks.network({id: network.Id})">{{ network.Id }}</a>
+            </td>
+            <td> {{ network.Addr }} </td>
+            <td ng-if="network.Editable" authorization="DockerServiceUpdate">
+              <span class="input-group-btn">
+                <button class="btn btn-sm btn-dangerlight" type="button" ng-click="removeNetwork(service, $index)" ng-disabled="isUpdating">
+                  <pr-icon icon="'trash-2'" size="'md'"></pr-icon>
+                </button>
+              </span>
+            </td>
+            <td ng-if="!network.Editable"></td>
+          </tr>
+        </tbody>
+      </table>
+    </rd-widget-body>
+    <rd-widget-footer authorization="DockerServiceUpdate">
+      <div class="btn-toolbar" role="toolbar">
+        <div class="btn-group" role="group">
+          <button type="button" class="btn btn-primary btn-sm" ng-disabled="isUpdating || !hasChanges(service, ['Networks'])" ng-click="updateService(service)">
+            Apply changes
+          </button>
+          <button type="button" class="btn btn-default btn-sm dropdown-toggle" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
+            <pr-icon icon="'chevron-down'"></pr-icon>
+          </button>
+          <ul class="dropdown-menu">
+            <li><a ng-click="cancelChanges(service, ['Networks'])">Reset changes</a></li>
+            <li><a ng-click="cancelChanges(service)">Reset all changes</a></li>
+          </ul>
+        </div>
+      </div>
+    </rd-widget-footer>
+  </rd-widget>
+</div>
diff --git a/app/docker/views/services/edit/includes/placementPreferences.html b/app/docker/views/services/edit/includes/placementPreferences.html
new file mode 100644
index 0000000..856dd6a
--- /dev/null
+++ b/app/docker/views/services/edit/includes/placementPreferences.html
@@ -0,0 +1,75 @@
+<div ng-if="service.ServicePreferences" id="service-placement-preferences">
+  <rd-widget>
+    <rd-widget-header icon="list" title-text="Placement preferences">
+      <div class="nopadding" authorization="DockerServiceUpdate">
+        <a class="btn btn-secondary btn-sm pull-right" ng-click="isUpdating || addPlacementPreference(service)" ng-disabled="isUpdating">
+          <pr-icon icon="'plus'"></pr-icon> placement preference
+        </a>
+      </div>
+    </rd-widget-header>
+    <rd-widget-body ng-if="service.ServicePreferences.length === 0">
+      <p>There are no placement preferences for this service.</p>
+    </rd-widget-body>
+    <rd-widget-body ng-if="service.ServicePreferences.length > 0" classes="no-padding">
+      <table class="table">
+        <thead>
+          <tr>
+            <th>Strategy</th>
+            <th>Value</th>
+          </tr>
+        </thead>
+        <tbody>
+          <tr ng-repeat="preference in service.ServicePreferences">
+            <td>
+              <div class="input-group input-group-sm">
+                <input
+                  type="text"
+                  data-cy="placement-preference-strategy-input-{{ $index }}"
+                  class="form-control"
+                  ng-model="preference.strategy"
+                  placeholder="e.g. node.role"
+                  ng-change="updatePlacementPreference(service, preference)"
+                  ng-disabled="isUpdating"
+                  disable-authorization="DockerServiceUpdate"
+                />
+              </div>
+            </td>
+            <td>
+              <div class="input-group input-group-sm">
+                <input
+                  type="text"
+                  data-cy="placement-preference-value-input-{{ $index }}"
+                  class="form-control"
+                  ng-model="preference.value"
+                  placeholder="e.g. manager"
+                  ng-change="updatePlacementPreference(service, preference)"
+                  ng-disabled="isUpdating"
+                  disable-authorization="DockerServiceUpdate"
+                />
+                <span class="input-group-btn" authorization="DockerServiceUpdate">
+                  <button class="btn btn-dangerlight" type="button" ng-click="removePlacementPreference(service, $index)" ng-disabled="isUpdating">
+                    <pr-icon icon="'trash-2'" size="'md'"></pr-icon>
+                  </button>
+                </span>
+              </div>
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </rd-widget-body>
+    <rd-widget-footer authorization="DockerServiceUpdate">
+      <div class="btn-toolbar" role="toolbar">
+        <div class="btn-group" role="group">
+          <button type="button" class="btn btn-primary btn-sm" ng-disabled="!hasChanges(service, ['ServicePreferences'])" ng-click="updateService(service)">Apply changes</button>
+          <button type="button" class="btn btn-default btn-sm dropdown-toggle" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
+            <pr-icon icon="'chevron-down'"></pr-icon>
+          </button>
+          <ul class="dropdown-menu">
+            <li><a ng-click="cancelChanges(service, ['ServicePreferences'])">Reset changes</a></li>
+            <li><a ng-click="cancelChanges(service)">Reset all changes</a></li>
+          </ul>
+        </div>
+      </div>
+    </rd-widget-footer>
+  </rd-widget>
+</div>
diff --git a/app/docker/views/services/edit/includes/resources.html b/app/docker/views/services/edit/includes/resources.html
new file mode 100644
index 0000000..edd7ce4
--- /dev/null
+++ b/app/docker/views/services/edit/includes/resources.html
@@ -0,0 +1,109 @@
+<div id="service-resources">
+  <rd-widget>
+    <rd-widget-header icon="list" title-text="Resource limits and reservations"> </rd-widget-header>
+    <rd-widget-body classes="no-padding">
+      <table class="table">
+        <tbody>
+          <tr>
+            <td style="vertical-align: middle"> Memory reservation (MB) </td>
+            <td>
+              <input
+                class="input-sm"
+                type="number"
+                data-cy="docker-service-memory-reservation-input"
+                step="0.125"
+                min="0"
+                ng-model="service.ReservationMemoryBytes"
+                ng-change="updateServiceAttribute(service, 'ReservationMemoryBytes')"
+                disable-authorization="DockerServiceUpdate"
+              />
+            </td>
+            <td style="vertical-align: middle">
+              <p class="small text-muted"> Minimum memory available on a node to run a task (set to 0 for unlimited) </p>
+            </td>
+          </tr>
+          <tr>
+            <td style="vertical-align: middle"> Memory limit (MB) </td>
+            <td>
+              <input
+                class="input-sm"
+                type="number"
+                data-cy="docker-service-memory-limit-input"
+                step="0.125"
+                min="0"
+                ng-model="service.LimitMemoryBytes"
+                ng-change="updateServiceAttribute(service, 'LimitMemoryBytes')"
+                disable-authorization="DockerServiceUpdate"
+              />
+            </td>
+            <td style="vertical-align: middle">
+              <p class="small text-muted"> Maximum memory usage per task (set to 0 for unlimited) </p>
+            </td>
+          </tr>
+          <tr>
+            <td style="vertical-align: middle">
+              <div> CPU reservation </div>
+            </td>
+            <td>
+              <slider
+                data-cy="docker-service-cpu-reservation-slider"
+                model="service.ReservationNanoCPUs"
+                floor="0"
+                ceil="state.sliderMaxCpu"
+                step="0.25"
+                precision="2"
+                ng-if="service && state.sliderMaxCpu"
+                on-change="updateServiceAttribute(service, 'ReservationNanoCPUs')"
+                disable-authorization="DockerServiceUpdate"
+              ></slider>
+            </td>
+            <td style="vertical-align: middle">
+              <p class="small text-muted"> Minimum CPU available on a node to run a task </p>
+            </td>
+          </tr>
+          <tr>
+            <td style="vertical-align: middle">
+              <div> CPU limit </div>
+            </td>
+            <td>
+              <slider
+                data-cy="docker-service-cpu-limit-slider"
+                model="service.LimitNanoCPUs"
+                floor="0"
+                ceil="state.sliderMaxCpu"
+                step="0.25"
+                precision="2"
+                ng-if="service && state.sliderMaxCpu"
+                on-change="updateServiceAttribute(service, 'LimitNanoCPUs')"
+                disable-authorization="DockerServiceUpdate"
+              ></slider>
+            </td>
+            <td style="vertical-align: middle">
+              <p class="small text-muted"> Maximum CPU usage per task </p>
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </rd-widget-body>
+    <rd-widget-footer authorization="DockerServiceUpdate">
+      <div class="btn-toolbar" role="toolbar">
+        <div class="btn-group" role="group">
+          <button
+            type="button"
+            class="btn btn-primary btn-sm"
+            ng-disabled="!hasChanges(service, ['LimitNanoCPUs', 'LimitMemoryBytes', 'ReservationNanoCPUs', 'ReservationMemoryBytes'])"
+            ng-click="updateService(service)"
+            >Apply changes</button
+          >
+          <button type="button" class="btn btn-default btn-sm dropdown-toggle" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
+            <pr-icon icon="'chevron-down'"></pr-icon>
+          </button>
+          <ul class="dropdown-menu">
+            <li><a ng-click="cancelChanges(service, ['LimitNanoCPUs', 'LimitMemoryBytes', 'ReservationNanoCPUs', 'ReservationMemoryBytes'])">Reset changes</a></li>
+            <li><a ng-click="cancelChanges(service)">Reset all changes</a></li>
+          </ul>
+        </div>
+      </div>
+    </rd-widget-footer>
+  </rd-widget>
+</div>
diff --git a/app/docker/views/services/edit/includes/restart.html b/app/docker/views/services/edit/includes/restart.html
new file mode 100644
index 0000000..566977d
--- /dev/null
+++ b/app/docker/views/services/edit/includes/restart.html
@@ -0,0 +1,106 @@
+<div id="service-restart-policy">
+  <rd-widget>
+    <rd-widget-header icon="list" title-text="Restart policy"> </rd-widget-header>
+    <rd-widget-body classes="no-padding">
+      <table class="table">
+        <tbody>
+          <tr>
+            <td>Restart condition</td>
+            <td>
+              <div class="input-group input-group-sm">
+                <select
+                  class="selectpicker form-control !rounded"
+                  data-cy="docker-service-restart-condition-select"
+                  ng-model="service.RestartCondition"
+                  ng-change="updateServiceAttribute(service, 'RestartCondition')"
+                  disable-authorization="DockerServiceUpdate"
+                >
+                  <option value="none">None</option>
+                  <option value="on-failure">On failure</option>
+                  <option value="any">Any</option>
+                </select>
+              </div>
+            </td>
+            <td>
+              <p class="small text-muted" style="margin-top: 10px"> Condition for restart. </p>
+            </td>
+          </tr>
+          <tr>
+            <td>Restart delay</td>
+            <td>
+              <input
+                class="input-sm"
+                type="text"
+                data-cy="docker-service-restart-delay-input"
+                ng-model="service.RestartDelay"
+                ng-change="updateServiceAttribute(service, 'RestartDelay')"
+                ng-pattern="/^([0-9]+)(h|m|s|ms|us|ns)$/i"
+                disable-authorization="DockerServiceUpdate"
+              />
+            </td>
+            <td>
+              <p class="small text-muted" style="margin-top: 10px">
+                Delay between restart attempts expressed by a number followed by unit (ns|us|ms|s|m|h). Default value is 5s, 5 seconds.
+              </p>
+            </td>
+          </tr>
+          <tr>
+            <td>Restart max attempts</td>
+            <td>
+              <input
+                class="input-sm"
+                type="number"
+                data-cy="docker-service-restart-max-attempts-input"
+                ng-model="service.RestartMaxAttempts"
+                ng-change="updateServiceAttribute(service, 'RestartMaxAttempts')"
+                disable-authorization="DockerServiceUpdate"
+              />
+            </td>
+            <td>
+              <p class="small text-muted" style="margin-top: 10px"> Maximum attempts to restart a given task before giving up (default value is 0, which means unlimited). </p>
+            </td>
+          </tr>
+          <tr>
+            <td>Restart window</td>
+            <td>
+              <input
+                class="input-sm"
+                type="text"
+                data-cy="docker-service-restart-window-input"
+                ng-model="service.RestartWindow"
+                ng-change="updateServiceAttribute(service, 'RestartWindow')"
+                ng-pattern="/^([0-9]+)(h|m|s|ms|us|ns)$/i"
+                disable-authorization="DockerServiceUpdate"
+              />
+            </td>
+            <td>
+              <p class="small text-muted" style="margin-top: 10px">
+                Time window to evaluate restart attempts expressed by a number followed by unit (ns|us|ms|s|m|h). Default value is 0 seconds, which is unbounded.
+              </p>
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </rd-widget-body>
+    <rd-widget-footer authorization="DockerServiceUpdate">
+      <div class="btn-toolbar" role="toolbar">
+        <div class="btn-group" role="group">
+          <button
+            type="button"
+            class="btn btn-primary btn-sm"
+            ng-disabled="!hasChanges(service, ['RestartCondition', 'RestartDelay', 'RestartMaxAttempts', 'RestartWindow'])"
+            ng-click="updateService(service)"
+            >Apply changes</button
+          >
+          <button type="button" class="btn btn-default btn-sm dropdown-toggle" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
+            <pr-icon icon="'chevron-down'"></pr-icon>
+          </button>
+          <ul class="dropdown-menu">
+            <li><a ng-click="cancelChanges(service, ['RestartCondition', 'RestartDelay', 'RestartMaxAttempts', 'RestartWindow'])">Reset changes</a></li>
+            <li><a ng-click="cancelChanges(service)">Reset all changes</a></li>
+          </ul>
+        </div>
+      </div>
+    </rd-widget-footer>
+  </rd-widget>
+</div>
diff --git a/app/docker/views/services/edit/includes/secrets.html b/app/docker/views/services/edit/includes/secrets.html
new file mode 100644
index 0000000..8f85e92
--- /dev/null
+++ b/app/docker/views/services/edit/includes/secrets.html
@@ -0,0 +1,72 @@
+<div ng-if="applicationState.endpoint.apiVersion >= 1.25" id="service-secrets">
+  <rd-widget>
+    <rd-widget-header icon="list" title-text="Secrets"> </rd-widget-header>
+    <rd-widget-body classes="no-padding">
+      <div class="form-inline" style="padding: 10px 20px" authorization="DockerServiceUpdate">
+        Add a secret:
+        <select
+          class="form-control !h-[30px] !text-[13px]"
+          ng-options="secret.Name for secret in secrets | orderBy: 'Name'"
+          ng-model="state.addSecret.secret"
+          data-cy="service-secrets-select"
+        >
+          <option selected disabled hidden value="">Select a secret</option>
+        </select>
+        <div class="form-group" ng-if="applicationState.endpoint.apiVersion >= 1.3 && state.addSecret.override">
+          Target:
+          <input class="form-control" ng-model="state.addSecret.target" placeholder="/path/in/container" />
+        </div>
+        <div class="btn-group btn-group-sm" ng-if="applicationState.endpoint.apiVersion >= 1.3">
+          <label class="btn btn-light" ng-model="state.addSecret.override" uib-btn-radio="false">Default location</label>
+          <label class="btn btn-light" ng-model="state.addSecret.override" uib-btn-radio="true">Override</label>
+        </div>
+        <a class="btn btn-default btn-sm" ng-click="addSecret(service, state.addSecret)"> <pr-icon icon="'plus'"></pr-icon> Add secret </a>
+      </div>
+      <table class="table" style="margin-top: 5px">
+        <thead>
+          <tr>
+            <th>Name</th>
+            <th>File name</th>
+            <th>UID</th>
+            <th>GID</th>
+            <th>Mode</th>
+            <th></th>
+          </tr>
+        </thead>
+        <tbody>
+          <tr ng-repeat="secret in service.ServiceSecrets">
+            <td
+              ><a ui-sref="docker.secrets.secret({id: secret.Id})">{{ secret.Name }}</a></td
+            >
+            <td>{{ secret.FileName }}</td>
+            <td>{{ secret.Uid }}</td>
+            <td>{{ secret.Gid }}</td>
+            <td>{{ secret.Mode }}</td>
+            <td authorization="DockerServiceUpdate">
+              <button class="btn btn-dangerlight pull-right" type="button" ng-click="removeSecret(service, $index)" ng-disabled="isUpdating">
+                <pr-icon icon="'trash-2'" size="'md'"></pr-icon>
+              </button>
+            </td>
+          </tr>
+          <tr ng-if="service.ServiceSecrets.length === 0">
+            <td colspan="6" class="text-muted text-center">No secrets associated to this service.</td>
+          </tr>
+        </tbody>
+      </table>
+    </rd-widget-body>
+    <rd-widget-footer authorization="DockerServiceUpdate">
+      <div class="btn-toolbar" role="toolbar">
+        <div class="btn-group" role="group">
+          <button type="button" class="btn btn-primary btn-sm" ng-disabled="!hasChanges(service, ['ServiceSecrets'])" ng-click="updateService(service)">Apply changes</button>
+          <button type="button" class="btn btn-default btn-sm dropdown-toggle" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
+            <pr-icon icon="'chevron-down'"></pr-icon>
+          </button>
+          <ul class="dropdown-menu">
+            <li><a ng-click="cancelChanges(service, ['ServiceSecrets'])">Reset changes</a></li>
+            <li><a ng-click="cancelChanges(service)">Reset all changes</a></li>
+          </ul>
+        </div>
+      </div>
+    </rd-widget-footer>
+  </rd-widget>
+</div>
diff --git a/app/docker/views/services/edit/includes/servicelabels.html b/app/docker/views/services/edit/includes/servicelabels.html
new file mode 100644
index 0000000..6a1a66d
--- /dev/null
+++ b/app/docker/views/services/edit/includes/servicelabels.html
@@ -0,0 +1,75 @@
+<div id="service-labels">
+  <rd-widget>
+    <rd-widget-header icon="list" title-text="Service labels">
+      <div class="nopadding" authorization="DockerServiceUpdate">
+        <a class="btn btn-secondary btn-sm pull-right" ng-click="isUpdating || addLabel(service)" ng-disabled="isUpdating"> <pr-icon icon="'plus'"></pr-icon> label </a>
+      </div>
+    </rd-widget-header>
+    <rd-widget-body ng-if="service.ServiceLabels.length === 0">
+      <p>There are no labels for this service.</p>
+    </rd-widget-body>
+    <rd-widget-body classes="no-padding" ng-if="service.ServiceLabels.length > 0">
+      <table class="table">
+        <thead>
+          <tr>
+            <th> Label </th>
+            <th> Value </th>
+          </tr>
+        </thead>
+        <tbody>
+          <tr ng-repeat="label in service.ServiceLabels">
+            <td>
+              <div class="input-group input-group-sm">
+                <span class="input-group-addon fit-text-size">name</span>
+                <input
+                  type="text"
+                  data-cy="service-label-key-{{ $index }}"
+                  class="form-control"
+                  ng-model="label.key"
+                  placeholder="e.g. com.example.foo"
+                  ng-change="updateLabel(service, label)"
+                  ng-disabled="isUpdating"
+                  disable-authorization="DockerServiceUpdate"
+                />
+              </div>
+            </td>
+            <td>
+              <div class="input-group input-group-sm">
+                <span class="input-group-addon fit-text-size">value</span>
+                <input
+                  type="text"
+                  data-cy="service-label-value_{{ $index }}"
+                  class="form-control"
+                  ng-model="label.value"
+                  placeholder="e.g. bar"
+                  ng-change="updateLabel(service, label)"
+                  ng-disabled="isUpdating"
+                  disable-authorization="DockerServiceUpdate"
+                />
+                <span class="input-group-btn" authorization="DockerServiceUpdate">
+                  <button class="btn btn-dangerlight" type="button" ng-click="removeLabel(service, $index)" ng-disabled="isUpdating">
+                    <pr-icon icon="'trash-2'" size="'md'"></pr-icon>
+                  </button>
+                </span>
+              </div>
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </rd-widget-body>
+    <rd-widget-footer authorization="DockerServiceUpdate">
+      <div class="btn-toolbar" role="toolbar">
+        <div class="btn-group" role="group">
+          <button type="button" class="btn btn-primary btn-sm" ng-disabled="!hasChanges(service, ['ServiceLabels'])" ng-click="updateService(service)">Apply changes</button>
+          <button type="button" class="btn btn-default btn-sm dropdown-toggle" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
+            <pr-icon icon="'chevron-down'"></pr-icon>
+          </button>
+          <ul class="dropdown-menu">
+            <li><a ng-click="cancelChanges(service, ['ServiceLabels'])">Reset changes</a></li>
+            <li><a ng-click="cancelChanges(service)">Reset all changes</a></li>
+          </ul>
+        </div>
+      </div>
+    </rd-widget-footer>
+  </rd-widget>
+</div>
diff --git a/app/docker/views/services/edit/includes/tasks.html b/app/docker/views/services/edit/includes/tasks.html
new file mode 100644
index 0000000..8a64277
--- /dev/null
+++ b/app/docker/views/services/edit/includes/tasks.html
@@ -0,0 +1,6 @@
+<docker-service-tasks-datatable
+  ng-if="tasks.length > 0"
+  dataset="tasks"
+  is-slot-column-visible="service.Mode !== 'global'"
+  service-name="service.Name"
+></docker-service-tasks-datatable>
diff --git a/app/docker/views/services/edit/includes/updateconfig.html b/app/docker/views/services/edit/includes/updateconfig.html
new file mode 100644
index 0000000..13ba971
--- /dev/null
+++ b/app/docker/views/services/edit/includes/updateconfig.html
@@ -0,0 +1,132 @@
+<div id="service-update-config">
+  <rd-widget>
+    <rd-widget-header icon="list" title-text="Update configuration"> </rd-widget-header>
+    <rd-widget-body classes="no-padding">
+      <table class="mb-0 table">
+        <tbody>
+          <tr>
+            <td>Update Parallelism</td>
+            <td>
+              <input
+                class="input-sm"
+                type="number"
+                data-cy="docker-service-update-parallelism-input"
+                ng-model="service.UpdateParallelism"
+                ng-change="updateServiceAttribute(service, 'UpdateParallelism')"
+                disable-authorization="DockerServiceUpdate"
+              />
+            </td>
+            <td>
+              <p class="small text-muted" style="margin-top: 10px"> Maximum number of tasks to be updated simultaneously (0 to update all at once). </p>
+            </td>
+          </tr>
+          <tr>
+            <td>Update Delay</td>
+            <td>
+              <input
+                class="input-sm"
+                type="text"
+                data-cy="docker-service-update-delay-input"
+                ng-model="service.UpdateDelay"
+                ng-change="updateServiceAttribute(service, 'UpdateDelay')"
+                ng-pattern="/^([0-9]+)(h|m|s|ms|us|ns)$/i"
+                disable-authorization="DockerServiceUpdate"
+              />
+            </td>
+            <td>
+              <p class="small text-muted" style="margin-top: 10px"> Amount of time between updates expressed by a number followed by unit (ns|us|ms|s|m|h). Example: 1m. </p>
+            </td>
+          </tr>
+          <tr>
+            <td>Update Failure Action</td>
+            <td>
+              <div class="form-group !mb-0">
+                <label class="radio-inline align-baseline">
+                  <input
+                    type="radio"
+                    name="failure_action"
+                    data-cy="update-failure-action-continue"
+                    ng-model="service.UpdateFailureAction"
+                    value="continue"
+                    ng-change="updateServiceAttribute(service, 'UpdateFailureAction')"
+                    disable-authorization="DockerServiceUpdate"
+                  />
+                  Continue
+                </label>
+                <label class="radio-inline align-baseline">
+                  <input
+                    type="radio"
+                    name="failure_action"
+                    data-cy="update-failure-action-pause"
+                    ng-model="service.UpdateFailureAction"
+                    value="pause"
+                    ng-change="updateServiceAttribute(service, 'UpdateFailureAction')"
+                    disable-authorization="DockerServiceUpdate"
+                  />
+                  Pause
+                </label>
+              </div>
+            </td>
+            <td>
+              <p class="small text-muted" style="margin-top: 10px"> Action taken on failure to start after update. </p>
+            </td>
+          </tr>
+          <tr ng-if="applicationState.endpoint.apiVersion >= 1.29">
+            <td>Order</td>
+            <td>
+              <div class="form-group !mb-0">
+                <label class="radio-inline">
+                  <input
+                    type="radio"
+                    name="updateconfig_order"
+                    data-cy="update-order-start-first"
+                    ng-model="service.UpdateOrder"
+                    value="start-first"
+                    ng-change="updateServiceAttribute(service, 'UpdateOrder')"
+                    disable-authorization="DockerServiceUpdate"
+                  />
+                  start-first
+                </label>
+                <label class="radio-inline">
+                  <input
+                    type="radio"
+                    name="updateconfig_order"
+                    data-cy="update-order-stop-first"
+                    ng-model="service.UpdateOrder"
+                    value="stop-first"
+                    ng-change="updateServiceAttribute(service, 'UpdateOrder')"
+                    disable-authorization="DockerServiceUpdate"
+                  />
+                  stop-first
+                </label>
+              </div>
+            </td>
+            <td>
+              <p class="small text-muted" style="margin-top: 10px"> Operation order on failure. </p>
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </rd-widget-body>
+    <rd-widget-footer authorization="DockerServiceUpdate">
+      <div class="btn-toolbar" role="toolbar">
+        <div class="btn-group" role="group">
+          <button
+            type="button"
+            class="btn btn-primary btn-sm"
+            ng-disabled="!hasChanges(service, ['UpdateFailureAction', 'UpdateDelay', 'UpdateParallelism', 'UpdateOrder'])"
+            ng-click="updateService(service)"
+            >Apply changes</button
+          >
+          <button type="button" class="btn btn-default btn-sm dropdown-toggle" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
+            <pr-icon icon="'chevron-down'"></pr-icon>
+          </button>
+          <ul class="dropdown-menu">
+            <li><a ng-click="cancelChanges(service, ['UpdateFailureAction', 'UpdateDelay', 'UpdateParallelism', 'UpdateOrder'])">Reset changes</a></li>
+            <li><a ng-click="cancelChanges(service)">Reset all changes</a></li>
+          </ul>
+        </div>
+      </div>
+    </rd-widget-footer>
+  </rd-widget>
+</div>
diff --git a/app/docker/views/services/edit/service.html b/app/docker/views/services/edit/service.html
new file mode 100644
index 0000000..b5bb5d5
--- /dev/null
+++ b/app/docker/views/services/edit/service.html
@@ -0,0 +1,281 @@
+<page-header title="'Service details'" breadcrumbs="[{label:'Services', link:'docker.services'}, service.Name]" reload="true"> </page-header>
+
+<div ng-if="!isLoading">
+  <div class="row">
+    <div ng-if="isUpdating" class="col-lg-12 col-md-12 col-xs-12">
+      <div class="alert alert-info" role="alert" id="service-update-alert">
+        <p>This service is being updated. Editing this service is currently disabled.</p>
+        <a ui-sref="docker.services.service({id: service.Id}, {reload: true})">Refresh to see if this service has finished updated.</a>
+      </div>
+    </div>
+  </div>
+  <div class="row">
+    <div class="col-lg-9 col-md-9 col-xs-9">
+      <rd-widget>
+        <rd-widget-header icon="shuffle" title-text="Service details"></rd-widget-header>
+        <rd-widget-body classes="no-padding">
+          <table class="table">
+            <tbody>
+              <tr>
+                <td class="w-1/5">Name</td>
+                <td ng-if="applicationState.endpoint.apiVersion <= 1.24">
+                  <input
+                    type="text"
+                    class="form-control"
+                    ng-model="service.Name"
+                    ng-change="updateServiceAttribute(service, 'Name')"
+                    ng-disabled="isUpdating"
+                    data-cy="docker-service-edit-name"
+                  />
+                </td>
+                <td ng-if="applicationState.endpoint.apiVersion >= 1.25"> {{ service.Name }} </td>
+              </tr>
+              <tr>
+                <td>ID</td>
+                <td> {{ service.Id }} </td>
+              </tr>
+              <tr ng-if="service.CreatedAt">
+                <td>Created at</td>
+                <td>{{ service.CreatedAt | getisodate }}</td>
+              </tr>
+              <tr ng-if="service.UpdatedAt">
+                <td>Last updated at</td>
+                <td>{{ service.UpdatedAt | getisodate }}</td>
+              </tr>
+              <tr ng-if="service.Version">
+                <td>Version</td>
+                <td>{{ service.Version }}</td>
+              </tr>
+              <tr>
+                <td>Scheduling mode</td>
+                <td>{{ service.Mode }}</td>
+              </tr>
+              <tr ng-if="service.Mode === 'replicated'">
+                <td>Replicas</td>
+                <td>
+                  <span ng-if="service.Mode === 'replicated'">
+                    <input
+                      class="input-sm"
+                      type="number"
+                      data-cy="docker-service-edit-replicas-input"
+                      ng-model="service.Replicas"
+                      ng-change="updateServiceAttribute(service, 'Replicas')"
+                      disable-authorization="DockerServiceUpdate"
+                    />
+                  </span>
+                </td>
+              </tr>
+              <tr>
+                <td>Image</td>
+                <td>{{ service.Image }}</td>
+              </tr>
+              <tr ng-if="isAdmin && applicationState.endpoint.type !== 4">
+                <td>
+                  <div class="inline-flex items-center">
+                    <div> Service webhook </div>
+                    <portainer-tooltip
+                      message="'Webhook (or callback URI) used to automate the update of this service. Sending a POST request to this callback URI (without requiring any authentication) will pull the most up-to-date version of the associated image and re-deploy this service.'"
+                    >
+                    </portainer-tooltip>
+                  </div>
+                </td>
+                <td>
+                  <div class="flex flex-wrap items-center">
+                    <por-switch-field
+                      label-class="'!mr-0'"
+                      checked="WebhookExists"
+                      disabled="disabledWebhookButton(WebhookExists)"
+                      on-change="(onWebhookChange)"
+                    ></por-switch-field>
+                    <span ng-if="webhookURL">
+                      <span class="text-muted">{{ webhookURL | truncatelr }}</span>
+                      <button type="button" class="btn btn-sm btn-primary btn-sm space-left" ng-if="webhookURL" ng-click="copyWebhook()">
+                        <pr-icon icon="'copy'" class-name="'mr-1'"></pr-icon>
+                        Copy link
+                      </button>
+                      <span>
+                        <pr-icon id="copyNotification" icon="'check'" mode="'success'" style="display: none"></pr-icon>
+                      </span>
+                    </span>
+                  </div>
+                </td>
+              </tr>
+              <tr authorization="DockerServiceLogs, DockerServiceUpdate, DockerServiceDelete">
+                <td colspan="2">
+                  <p class="small text-muted" authorization="DockerServiceUpdate">
+                    Note: you can only rollback one level of changes. Clicking the rollback button without making a new change will undo your previous rollback </p
+                  ><div class="flex flex-wrap gap-x-2 gap-y-1">
+                    <a
+                      authorization="DockerServiceLogs"
+                      ng-if="applicationState.endpoint.apiVersion >= 1.3"
+                      class="btn btn-primary btn-sm"
+                      type="button"
+                      ui-sref="docker.services.service.logs({id: service.Id})"
+                    >
+                      <pr-icon icon="'file-text'"></pr-icon>Service logs</a
+                    >
+                    <button
+                      authorization="DockerServiceUpdate"
+                      type="button"
+                      class="btn btn-primary btn-sm !ml-0"
+                      ng-disabled="state.updateInProgress || isUpdating"
+                      ng-click="forceUpdateService(service)"
+                      button-spinner="state.updateInProgress"
+                      ng-if="applicationState.endpoint.apiVersion >= 1.25"
+                    >
+                      <span ng-hide="state.updateInProgress" class="vertical-center">
+                        <pr-icon icon="'refresh-cw'"></pr-icon>
+                        Update the service</span
+                      >
+                      <span ng-show="state.updateInProgress">Update in progress...</span>
+                    </button>
+                    <button
+                      authorization="DockerServiceUpdate"
+                      type="button"
+                      class="btn btn-primary btn-sm !ml-0"
+                      ng-disabled="state.rollbackInProgress || isUpdating"
+                      ng-click="rollbackService(service)"
+                      button-spinner="state.rollbackInProgress"
+                      ng-if="applicationState.endpoint.apiVersion >= 1.25"
+                    >
+                      <span ng-hide="state.rollbackInProgress" class="vertical-center">
+                        <pr-icon icon="'rotate-ccw'"></pr-icon>
+                        Rollback the service</span
+                      >
+                      <span ng-show="state.rollbackInProgress">Rollback in progress...</span>
+                    </button>
+                    <button
+                      authorization="DockerServiceDelete"
+                      type="button"
+                      class="btn btn-danger btn-sm !ml-0"
+                      ng-disabled="state.deletionInProgress || isUpdating"
+                      ng-click="removeService()"
+                      button-spinner="state.deletionInProgress"
+                    >
+                      <span ng-hide="state.deletionInProgress" class="vertical-center">
+                        <pr-icon icon="'trash-2'"></pr-icon>
+                        Delete the service</span
+                      >
+                      <span ng-show="state.deletionInProgress">Deletion in progress...</span>
+                    </button>
+                  </div>
+                </td>
+              </tr>
+            </tbody>
+          </table>
+        </rd-widget-body>
+        <rd-widget-footer authorization="DockerServiceUpdate">
+          <p class="small text-muted">
+            Do you need help? View the Docker Service documentation <a href="https://docs.docker.com/engine/reference/commandline/service_update/" target="self">here</a>.
+          </p>
+          <div class="btn-toolbar" role="toolbar">
+            <div class="btn-group" role="group">
+              <button type="button" class="btn btn-primary" ng-disabled="!hasChanges(service, ['Mode', 'Replicas', 'Name', 'Webhooks'])" ng-click="updateService(service)"
+                >Apply changes</button
+              >
+              <button type="button" class="btn btn-default dropdown-toggle" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
+                <pr-icon icon="'chevron-down'"></pr-icon>
+              </button>
+              <ul class="dropdown-menu">
+                <li><a ng-click="cancelChanges(service, ['Mode', 'Replicas', 'Name'])">Reset changes</a></li>
+                <li><a ng-click="cancelChanges(service)">Reset all changes</a></li>
+              </ul>
+            </div>
+          </div>
+        </rd-widget-footer>
+      </rd-widget>
+    </div>
+
+    <div class="col-lg-3 col-md-3 col-xs-3">
+      <rd-widget>
+        <rd-widget-header icon="menu" title-text="Quick navigation"></rd-widget-header>
+        <rd-widget-body classes="no-padding">
+          <ul class="nav nav-pills nav-stacked">
+            <li><a href ng-click="goToItem('service-env-variables')">Environment variables</a></li>
+            <li><a href ng-click="goToItem('service-container-image')">Container image</a></li>
+            <li><a href ng-click="goToItem('service-container-labels')">Container labels</a></li>
+            <li><a href ng-click="goToItem('service-mounts')">Mounts</a></li>
+            <li><a href ng-click="goToItem('service-network-specs')">Network &amp; published ports</a></li>
+            <li><a href ng-click="goToItem('service-resources')">Resource limits &amp; reservations</a></li>
+            <li><a href ng-click="goToItem('service-placement-constraints')">Placement constraints</a></li>
+            <li ng-if="applicationState.endpoint.apiVersion >= 1.3"><a href ng-click="goToItem('service-placement-preferences')">Placement preferences</a></li>
+            <li><a href ng-click="goToItem('service-restart-policy')">Restart policy</a></li>
+            <li><a href ng-click="goToItem('service-update-config')">Update configuration</a></li>
+            <li><a href ng-click="goToItem('service-logging')">Logging</a></li>
+            <li><a href ng-click="goToItem('service-labels')">Service labels</a></li>
+            <li><a href ng-click="goToItem('service-configs')">Configs</a></li>
+            <li ng-if="applicationState.endpoint.apiVersion >= 1.25"><a href ng-click="goToItem('service-secrets')">Secrets</a></li>
+            <li><a href ng-click="goToItem('service-tasks')">Tasks</a></li>
+          </ul>
+        </rd-widget-body>
+      </rd-widget>
+    </div>
+  </div>
+
+  <!-- access-control-panel -->
+  <access-control-panel
+    ng-if="service"
+    resource-id="service.Id"
+    resource-control="service.ResourceControl"
+    resource-type="resourceType"
+    on-update-success="(onUpdateResourceControlSuccess)"
+    environment-id="endpoint.Id"
+  >
+  </access-control-panel>
+  <!-- !access-control-panel -->
+
+  <div class="row">
+    <hr />
+    <div class="col-lg-12 col-md-12 col-xs-12">
+      <h3 id="container-specs">Container specification</h3>
+      <div id="service-container-spec" class="padding-top" ng-include="'app/docker/views/services/edit/includes/container-specs.html'"></div>
+      <div id="service-container-image" class="padding-top" ng-include="'app/docker/views/services/edit/includes/image.html'"></div>
+      <div id="service-env-variables" class="padding-top" ng-include="'app/docker/views/services/edit/includes/environmentvariables.html'"></div>
+      <div id="service-container-labels" class="padding-top" ng-include="'app/docker/views/services/edit/includes/containerlabels.html'"></div>
+      <div id="service-mounts" class="padding-top" ng-include="'app/docker/views/services/edit/includes/mounts.html'"></div>
+    </div>
+  </div>
+
+  <div class="row">
+    <hr />
+    <div class="col-lg-12 col-md-12 col-xs-12">
+      <h3 id="service-network-specs">Networks &amp; ports</h3>
+      <div id="service-networks" class="padding-top" ng-include="'app/docker/views/services/edit/includes/networks.html'"></div>
+
+      <docker-service-ports-mapping-field
+        id="service-published-ports"
+        class="padding-top block"
+        values="formValues.ports"
+        on-change="(onChangePorts)"
+        has-changes="hasChanges(service, ['Ports'])"
+        on-reset="(onResetPorts)"
+        on-submit="(onSubmit)"
+      ></docker-service-ports-mapping-field>
+
+      <div id="service-hosts-entries" class="padding-top" ng-include="'app/docker/views/services/edit/includes/hosts.html'"></div>
+    </div>
+  </div>
+
+  <div class="row">
+    <hr />
+    <div class="col-lg-12 col-md-12 col-xs-12">
+      <h3 id="service-specs">Service specification</h3>
+      <div id="service-resources" class="padding-top" ng-include="'app/docker/views/services/edit/includes/resources.html'"></div>
+      <div id="service-placement-constraints" class="padding-top" ng-include="'app/docker/views/services/edit/includes/constraints.html'"></div>
+      <div
+        id="service-placement-preferences"
+        ng-if="applicationState.endpoint.apiVersion >= 1.3"
+        class="padding-top"
+        ng-include="'app/docker/views/services/edit/includes/placementPreferences.html'"
+      ></div>
+      <div id="service-restart-policy" class="padding-top" ng-include="'app/docker/views/services/edit/includes/restart.html'"></div>
+      <div id="service-update-config" class="padding-top" ng-include="'app/docker/views/services/edit/includes/updateconfig.html'"></div>
+      <div id="service-logging" class="padding-top" ng-include="'app/docker/views/services/edit/includes/logging.html'"></div>
+      <div id="service-labels" class="padding-top" ng-include="'app/docker/views/services/edit/includes/servicelabels.html'"></div>
+      <div id="service-configs" class="padding-top" ng-include="'app/docker/views/services/edit/includes/configs.html'"></div>
+      <div id="service-secrets" ng-if="applicationState.endpoint.apiVersion >= 1.25" class="padding-top" ng-include="'app/docker/views/services/edit/includes/secrets.html'"></div>
+    </div>
+  </div>
+
+  <div id="service-tasks" class="padding-top" ng-include="'app/docker/views/services/edit/includes/tasks.html'"></div>
+</div>
diff --git a/app/docker/views/services/edit/serviceController.js b/app/docker/views/services/edit/serviceController.js
new file mode 100644
index 0000000..227d47b
--- /dev/null
+++ b/app/docker/views/services/edit/serviceController.js
@@ -0,0 +1,893 @@
+require('./includes/configs.html');
+require('./includes/constraints.html');
+require('./includes/container-specs.html');
+require('./includes/containerlabels.html');
+require('./includes/environmentvariables.html');
+require('./includes/hosts.html');
+require('./includes/image.html');
+require('./includes/logging.html');
+require('./includes/mounts.html');
+require('./includes/networks.html');
+require('./includes/placementPreferences.html');
+require('./includes/resources.html');
+require('./includes/restart.html');
+require('./includes/secrets.html');
+require('./includes/servicelabels.html');
+require('./includes/tasks.html');
+require('./includes/updateconfig.html');
+
+import _ from 'lodash-es';
+
+import * as envVarsUtils from '@/react/components/form-components/EnvironmentVariablesFieldset/utils';
+import { PorImageRegistryModel } from '@/docker/models/porImageRegistry';
+import { ResourceControlType } from '@/react/portainer/access-control/types';
+import { confirmServiceForceUpdate } from '@/react/docker/services/common/update-service-modal';
+import { confirm, confirmDelete } from '@@/modals/confirm';
+import { ModalType } from '@@/modals';
+import { buildConfirmButton } from '@@/modals/utils';
+import { convertServiceToConfig } from '@/react/docker/services/common/convertServiceToConfig';
+import { portsMappingUtils } from '@/react/docker/services/ItemView/PortMappingField';
+
+angular.module('portainer.docker').controller('ServiceController', [
+  '$q',
+  '$scope',
+  '$transition$',
+  '$state',
+  '$location',
+  '$timeout',
+  '$anchorScroll',
+  'ServiceService',
+  'ConfigService',
+  'ConfigHelper',
+  'SecretService',
+  'ImageService',
+  'SecretHelper',
+  'ServiceHelper',
+  'LabelHelper',
+  'TaskService',
+  'NodeService',
+  'ContainerService',
+  'TaskHelper',
+  'Notifications',
+  'PluginService',
+  'Authentication',
+  'VolumeService',
+  'ImageHelper',
+  'WebhookService',
+  'clipboard',
+  'WebhookHelper',
+  'NetworkService',
+  'RegistryService',
+  'endpoint',
+  function (
+    $q,
+    $scope,
+    $transition$,
+    $state,
+    $location,
+    $timeout,
+    $anchorScroll,
+    ServiceService,
+    ConfigService,
+    ConfigHelper,
+    SecretService,
+    ImageService,
+    SecretHelper,
+    ServiceHelper,
+    LabelHelper,
+    TaskService,
+    NodeService,
+    ContainerService,
+    TaskHelper,
+    Notifications,
+    PluginService,
+    Authentication,
+    VolumeService,
+    ImageHelper,
+    WebhookService,
+    clipboard,
+    WebhookHelper,
+    NetworkService,
+    RegistryService,
+    endpoint
+  ) {
+    $scope.resourceType = ResourceControlType.Service;
+    $scope.WebhookExists = false;
+
+    $scope.onUpdateResourceControlSuccess = function () {
+      $state.reload();
+    };
+
+    $scope.endpoint = endpoint;
+
+    $scope.state = {
+      updateInProgress: false,
+      deletionInProgress: false,
+      rollbackInProgress: false,
+    };
+
+    $scope.formValues = {
+      RegistryModel: new PorImageRegistryModel(),
+      ports: [],
+    };
+
+    $scope.tasks = [];
+    $scope.availableImages = [];
+
+    $scope.lastVersion = 0;
+
+    var originalService = {};
+    var previousServiceValues = [];
+
+    $scope.goToItem = function (hash) {
+      if ($location.hash() !== hash) {
+        $location.hash(hash);
+      } else {
+        $anchorScroll();
+      }
+    };
+
+    $scope.addEnvironmentVariable = function addEnvironmentVariable(service) {
+      $scope.$evalAsync(() => {
+        service.EnvironmentVariables = service.EnvironmentVariables.concat({ name: '', value: '' });
+        updateServiceArray(service, 'EnvironmentVariables', service.EnvironmentVariables);
+      });
+    };
+
+    $scope.onChangeEnvVars = onChangeEnvVars;
+
+    function onChangeEnvVars(env) {
+      const service = $scope.service;
+
+      const orgEnv = service.EnvironmentVariables;
+      service.EnvironmentVariables = env.map((v) => {
+        const orgVar = orgEnv.find(({ name }) => v.name === name);
+        const added = orgVar && orgVar.added;
+        return { ...v, added };
+      });
+
+      updateServiceArray(service, 'EnvironmentVariables', service.EnvironmentVariables);
+    }
+
+    $scope.addConfig = function addConfig(service, config) {
+      if (
+        config &&
+        service.ServiceConfigs.filter(function (serviceConfig) {
+          return serviceConfig.Id === config.Id;
+        }).length === 0
+      ) {
+        service.ServiceConfigs.push({ Id: config.Id, Name: config.Name, FileName: config.Name, Uid: '0', Gid: '0', Mode: 292 });
+        updateServiceArray(service, 'ServiceConfigs', service.ServiceConfigs);
+      }
+    };
+    $scope.removeConfig = function removeSecret(service, index) {
+      var removedElement = service.ServiceConfigs.splice(index, 1);
+      if (removedElement !== null) {
+        updateServiceArray(service, 'ServiceConfigs', service.ServiceConfigs);
+      }
+    };
+    $scope.updateConfig = function updateConfig(service) {
+      updateServiceArray(service, 'ServiceConfigs', service.ServiceConfigs);
+    };
+    $scope.addSecret = function addSecret(service, newSecret) {
+      if (newSecret.secret) {
+        var filename = newSecret.secret.Name;
+        if (newSecret.override) {
+          filename = newSecret.target;
+        }
+        if (
+          service.ServiceSecrets.filter(function (serviceSecret) {
+            return serviceSecret.Id === newSecret.secret.Id && serviceSecret.FileName === filename;
+          }).length === 0
+        ) {
+          service.ServiceSecrets.push({ Id: newSecret.secret.Id, Name: newSecret.secret.Name, FileName: filename, Uid: '0', Gid: '0', Mode: 444 });
+          updateServiceArray(service, 'ServiceSecrets', service.ServiceSecrets);
+        }
+      }
+    };
+    $scope.removeSecret = function removeSecret(service, index) {
+      var removedElement = service.ServiceSecrets.splice(index, 1);
+      if (removedElement !== null) {
+        updateServiceArray(service, 'ServiceSecrets', service.ServiceSecrets);
+      }
+    };
+    $scope.addLabel = function addLabel(service) {
+      service.ServiceLabels.push({ key: '', value: '', originalValue: '' });
+      updateServiceArray(service, 'ServiceLabels', service.ServiceLabels);
+    };
+    $scope.removeLabel = function removeLabel(service, index) {
+      var removedElement = service.ServiceLabels.splice(index, 1);
+      if (removedElement !== null) {
+        updateServiceArray(service, 'ServiceLabels', service.ServiceLabels);
+      }
+    };
+    $scope.updateLabel = function updateLabel(service, label) {
+      if (label.value !== label.originalValue || label.key !== label.originalKey) {
+        updateServiceArray(service, 'ServiceLabels', service.ServiceLabels);
+      }
+    };
+    $scope.addContainerLabel = function addContainerLabel(service) {
+      service.ServiceContainerLabels.push({ key: '', value: '', originalValue: '' });
+      updateServiceArray(service, 'ServiceContainerLabels', service.ServiceContainerLabels);
+    };
+    $scope.removeContainerLabel = function removeLabel(service, index) {
+      var removedElement = service.ServiceContainerLabels.splice(index, 1);
+      if (removedElement !== null) {
+        updateServiceArray(service, 'ServiceContainerLabels', service.ServiceContainerLabels);
+      }
+    };
+    $scope.updateContainerLabel = function updateLabel(service, label) {
+      if (label.value !== label.originalValue || label.key !== label.originalKey) {
+        updateServiceArray(service, 'ServiceContainerLabels', service.ServiceContainerLabels);
+      }
+    };
+    $scope.addMount = function addMount(service) {
+      service.ServiceMounts.push({ Type: 'volume', Source: null, Target: '', ReadOnly: false });
+      updateServiceArray(service, 'ServiceMounts', service.ServiceMounts);
+    };
+    $scope.removeMount = function removeMount(service, index) {
+      var removedElement = service.ServiceMounts.splice(index, 1);
+      if (removedElement !== null) {
+        updateServiceArray(service, 'ServiceMounts', service.ServiceMounts);
+      }
+    };
+
+    $scope.onChangeMountType = function onChangeMountType(service, mount) {
+      mount.Source = null;
+      $scope.updateMount(service, mount);
+    };
+
+    $scope.updateMount = function updateMount(service) {
+      updateServiceArray(service, 'ServiceMounts', service.ServiceMounts);
+    };
+
+    $scope.toggleMountReadOnly = function toggleMountReadOnly(isReadOnly, index) {
+      $scope.$evalAsync(function () {
+        updateServiceArray($scope.service, 'ServiceMounts', $scope.service.ServiceMounts);
+        $scope.service.ServiceMounts[index].ReadOnly = isReadOnly;
+      });
+    };
+
+    $scope.addNetwork = function addNetwork(service) {
+      if (!service.Networks) {
+        service.Networks = [];
+      }
+      service.Networks.push({ Editable: true });
+    };
+
+    $scope.removeNetwork = function removeNetwork(service, index) {
+      var removedElement = service.Networks.splice(index, 1);
+      if (removedElement && removedElement.length && removedElement[0].Id) {
+        updateServiceArray(service, 'Networks', service.Networks);
+      }
+    };
+
+    $scope.updateNetwork = function updateNetwork(service) {
+      updateServiceArray(service, 'Networks', service.Networks);
+    };
+
+    $scope.addPlacementConstraint = function addPlacementConstraint(service) {
+      service.ServiceConstraints.push({ key: '', operator: '==', value: '' });
+      updateServiceArray(service, 'ServiceConstraints', service.ServiceConstraints);
+    };
+    $scope.removePlacementConstraint = function removePlacementConstraint(service, index) {
+      var removedElement = service.ServiceConstraints.splice(index, 1);
+      if (removedElement !== null) {
+        updateServiceArray(service, 'ServiceConstraints', service.ServiceConstraints);
+      }
+    };
+    $scope.updatePlacementConstraint = function (service) {
+      updateServiceArray(service, 'ServiceConstraints', service.ServiceConstraints);
+    };
+
+    $scope.addPlacementPreference = function (service) {
+      service.ServicePreferences.push({ strategy: 'spread', value: '' });
+      updateServiceArray(service, 'ServicePreferences', service.ServicePreferences);
+    };
+    $scope.removePlacementPreference = function (service, index) {
+      var removedElement = service.ServicePreferences.splice(index, 1);
+      if (removedElement !== null) {
+        updateServiceArray(service, 'ServicePreferences', service.ServicePreferences);
+      }
+    };
+    $scope.updatePlacementPreference = function (service) {
+      updateServiceArray(service, 'ServicePreferences', service.ServicePreferences);
+    };
+
+    $scope.addPublishedPort = function addPublishedPort(service) {
+      if (!service.Ports) {
+        service.Ports = [];
+      }
+      service.Ports.push({ PublishedPort: '', TargetPort: '', Protocol: 'tcp', PublishMode: 'ingress' });
+    };
+    $scope.updatePublishedPort = function updatePublishedPort(service) {
+      updateServiceArray(service, 'Ports', service.Ports);
+    };
+    $scope.removePortPublishedBinding = function removePortPublishedBinding(service, index) {
+      var removedElement = service.Ports.splice(index, 1);
+      if (removedElement !== null) {
+        updateServiceArray(service, 'Ports', service.Ports);
+      }
+    };
+
+    $scope.addLogDriverOpt = function addLogDriverOpt(service) {
+      service.LogDriverOpts.push({ key: '', value: '', originalValue: '' });
+      updateServiceArray(service, 'LogDriverOpts', service.LogDriverOpts);
+    };
+    $scope.removeLogDriverOpt = function removeLogDriverOpt(service, index) {
+      var removedElement = service.LogDriverOpts.splice(index, 1);
+      if (removedElement !== null) {
+        updateServiceArray(service, 'LogDriverOpts', service.LogDriverOpts);
+      }
+    };
+    $scope.updateLogDriverOpt = function updateLogDriverOpt(service, variable) {
+      if (variable.value !== variable.originalValue || variable.key !== variable.originalKey) {
+        updateServiceArray(service, 'LogDriverOpts', service.LogDriverOpts);
+      }
+    };
+    $scope.updateLogDriverName = function updateLogDriverName(service) {
+      updateServiceArray(service, 'LogDriverName', service.LogDriverName);
+    };
+
+    $scope.addHostsEntry = function (service) {
+      if (!service.Hosts) {
+        service.Hosts = [];
+      }
+      service.Hosts.push({ hostname: '', ip: '' });
+    };
+    $scope.removeHostsEntry = function (service, index) {
+      var removedElement = service.Hosts.splice(index, 1);
+      if (removedElement !== null) {
+        updateServiceArray(service, 'Hosts', service.Hosts);
+      }
+    };
+    $scope.updateHostsEntry = function (service) {
+      updateServiceArray(service, 'Hosts', service.Hosts);
+    };
+
+    $scope.onWebhookChange = function (enabled) {
+      enabled = enabled | '';
+      $scope.$evalAsync(() => {
+        $scope.updateWebhook($scope.service);
+        $scope.WebhookExists = enabled;
+        updateServiceAttribute($scope.service, 'Webhooks', enabled);
+      });
+    };
+
+    $scope.updateWebhook = function updateWebhook(service) {
+      if ($scope.WebhookExists) {
+        WebhookService.deleteWebhook($scope.webhookID)
+          .then(function success() {
+            $scope.webhookURL = null;
+            $scope.webhookID = null;
+            $scope.WebhookExists = false;
+          })
+          .catch(function error(err) {
+            Notifications.error('Failure', err, 'Unable to delete webhook');
+          });
+      } else {
+        WebhookService.createServiceWebhook(service.Id, endpoint.Id, $scope.initialRegistryID)
+          .then(function success(data) {
+            $scope.WebhookExists = true;
+            $scope.webhookID = data.Id;
+            $scope.webhookURL = WebhookHelper.returnWebhookUrl(data.Token);
+          })
+          .catch(function error(err) {
+            Notifications.error('Failure', err, 'Unable to create webhook');
+          });
+      }
+    };
+
+    $scope.updateWebhookRegistryId = function () {
+      const newRegistryID = _.get($scope.formValues.RegistryModel, 'Registry.Id', 0);
+      const registryChanged = $scope.initialRegistryID != newRegistryID;
+
+      if ($scope.WebhookExists && registryChanged) {
+        WebhookService.updateServiceWebhook($scope.webhookID, newRegistryID).catch(function error(err) {
+          Notifications.error('Failure', err, 'Unable to update webhook');
+        });
+      }
+    };
+
+    $scope.copyWebhook = function copyWebhook() {
+      clipboard.copyText($scope.webhookURL);
+      $('#copyNotification').show();
+      $('#copyNotification').fadeOut(2000);
+    };
+
+    $scope.cancelChanges = async function cancelChanges(service, keys) {
+      if (keys) {
+        // clean out the keys only from the list of modified keys
+        for (const key of keys) {
+          if (key === 'Image') {
+            $scope.formValues.RegistryModel = await RegistryService.retrievePorRegistryModelFromRepository(originalService.Image, endpoint.Id);
+          } else {
+            var index = previousServiceValues.indexOf(key);
+            if (index >= 0) {
+              previousServiceValues.splice(index, 1);
+            }
+          }
+        }
+      } else {
+        // clean out all changes
+        $scope.formValues.RegistryModel = await RegistryService.retrievePorRegistryModelFromRepository(originalService.Image, endpoint.Id);
+        keys = Object.keys(service);
+        previousServiceValues = [];
+      }
+      keys.forEach(function (attribute) {
+        service[attribute] = originalService[attribute]; // reset service values
+      });
+      service.hasChanges = false;
+    };
+
+    $scope.hasChanges = function (service, elements) {
+      var hasChanges = false;
+      elements.forEach(function (key) {
+        if (key === 'Image') {
+          const originalImage = service ? service.Model.Spec.TaskTemplate.ContainerSpec.Image : null;
+          const currentImage = ImageHelper.createImageConfigForContainer($scope.formValues.RegistryModel).fromImage;
+          hasChanges = hasChanges || originalImage !== currentImage;
+        } else {
+          hasChanges = hasChanges || previousServiceValues.indexOf(key) >= 0;
+        }
+      });
+      return hasChanges;
+    };
+
+    $scope.mountsAreValid = mountsAreValid;
+    function mountsAreValid() {
+      const mounts = $scope.service.ServiceMounts;
+      return mounts.every((mount) => mount.Source && mount.Target);
+    }
+
+    function buildChanges(service) {
+      var config = convertServiceToConfig(service.Model);
+      config.Name = service.Name;
+      config.Labels = LabelHelper.fromKeyValueToLabelHash(service.ServiceLabels);
+      config.TaskTemplate.ContainerSpec.Env = envVarsUtils.convertToArrayOfStrings(service.EnvironmentVariables);
+      config.TaskTemplate.ContainerSpec.Labels = LabelHelper.fromKeyValueToLabelHash(service.ServiceContainerLabels);
+
+      if ($scope.hasChanges(service, ['Image'])) {
+        const image = ImageHelper.createImageConfigForContainer($scope.formValues.RegistryModel);
+        config.TaskTemplate.ContainerSpec.Image = image.fromImage;
+        config.registryId = $scope.formValues.RegistryModel.Registry.Id;
+      } else {
+        config.TaskTemplate.ContainerSpec.Image = service.Image;
+      }
+
+      if ($scope.hasChanges(service, ['Networks'])) {
+        config.Networks = _.map(
+          _.filter(service.Networks, (item) => item.Id && item.Editable),
+          (item) => ({ Target: item.Id })
+        );
+        config.TaskTemplate.Networks = config.Networks;
+      }
+
+      config.TaskTemplate.ContainerSpec.Secrets = service.ServiceSecrets ? service.ServiceSecrets.map(SecretHelper.secretConfig) : [];
+      config.TaskTemplate.ContainerSpec.Configs = service.ServiceConfigs ? service.ServiceConfigs.map(ConfigHelper.configConfig) : [];
+
+      // support removal and (future) editing of credential specs
+      const credSpec = service.ServiceConfigs.find((config) => config.credSpec);
+      const credSpecId = credSpec ? credSpec.Id : '';
+      const oldCredSpecId =
+        (config.TaskTemplate.ContainerSpec.Privileges &&
+          config.TaskTemplate.ContainerSpec.Privileges.CredentialSpec &&
+          config.TaskTemplate.ContainerSpec.Privileges.CredentialSpec.Config) ||
+        '';
+      if (oldCredSpecId && !credSpecId) {
+        delete config.TaskTemplate.ContainerSpec.Privileges.CredentialSpec;
+      } else if (credSpec && oldCredSpecId !== credSpec) {
+        config.TaskTemplate.ContainerSpec.Privileges = {
+          ...(config.TaskTemplate.ContainerSpec.Privileges || {}),
+          CredentialSpec: {
+            ...((config.TaskTemplate.ContainerSpec.Privileges && config.TaskTemplate.ContainerSpec.Privileges.CredentialSpec) || {}),
+            Config: credSpec,
+          },
+        };
+      }
+
+      config.TaskTemplate.ContainerSpec.Hosts = service.Hosts ? ServiceHelper.translateHostnameIPToHostsEntries(service.Hosts) : [];
+
+      if (service.Mode === 'replicated') {
+        config.Mode.Replicated.Replicas = service.Replicas;
+      }
+      config.TaskTemplate.ContainerSpec.Mounts = service.ServiceMounts;
+      if (typeof config.TaskTemplate.Placement === 'undefined') {
+        config.TaskTemplate.Placement = {};
+      }
+      config.TaskTemplate.Placement.Constraints = ServiceHelper.translateKeyValueToPlacementConstraints(service.ServiceConstraints);
+      config.TaskTemplate.Placement.Preferences = ServiceHelper.translateKeyValueToPlacementPreferences(service.ServicePreferences);
+
+      if ($scope.hasChanges(service, ['LimitNanoCPUs', 'LimitMemoryBytes', 'ReservationNanoCPUs', 'ReservationMemoryBytes'])) {
+        // Round memory values to 0.125 and convert MB to B
+        var memoryLimit = (Math.round(service.LimitMemoryBytes * 8) / 8).toFixed(3);
+        memoryLimit *= 1024 * 1024;
+        var memoryReservation = (Math.round(service.ReservationMemoryBytes * 8) / 8).toFixed(3);
+        memoryReservation *= 1024 * 1024;
+        config.TaskTemplate.Resources = {
+          Limits: {
+            NanoCPUs: service.LimitNanoCPUs * 1000000000,
+            MemoryBytes: memoryLimit,
+          },
+          Reservations: {
+            NanoCPUs: service.ReservationNanoCPUs * 1000000000,
+            MemoryBytes: memoryReservation,
+          },
+        };
+      }
+
+      if ($scope.hasChanges(service, ['UpdateFailureAction', 'UpdateDelay', 'UpdateParallelism', 'UpdateOrder'])) {
+        config.UpdateConfig = {
+          Parallelism: service.UpdateParallelism,
+          Delay: ServiceHelper.translateHumanDurationToNanos(service.UpdateDelay) || 0,
+          FailureAction: service.UpdateFailureAction,
+          Order: service.UpdateOrder,
+        };
+      }
+
+      if ($scope.hasChanges(service, ['RestartCondition', 'RestartDelay', 'RestartMaxAttempts', 'RestartWindow'])) {
+        config.TaskTemplate.RestartPolicy = {
+          Condition: service.RestartCondition,
+          Delay: ServiceHelper.translateHumanDurationToNanos(service.RestartDelay) || 5000000000,
+          MaxAttempts: service.RestartMaxAttempts,
+          Window: ServiceHelper.translateHumanDurationToNanos(service.RestartWindow) || 0,
+        };
+      }
+
+      config.TaskTemplate.LogDriver = null;
+      if (service.LogDriverName) {
+        config.TaskTemplate.LogDriver = { Name: service.LogDriverName };
+        if (service.LogDriverName !== 'none') {
+          var logOpts = ServiceHelper.translateKeyValueToLogDriverOpts(service.LogDriverOpts);
+          if (Object.keys(logOpts).length !== 0 && logOpts.constructor === Object) {
+            config.TaskTemplate.LogDriver.Options = logOpts;
+          }
+        }
+      }
+
+      if ($scope.hasChanges(service, ['Ports'])) {
+        service.Ports = portsMappingUtils.toRequest($scope.formValues.ports);
+      }
+
+      config.EndpointSpec = {
+        Mode: (config.EndpointSpec && config.EndpointSpec.Mode) || 'vip',
+        Ports: service.Ports,
+      };
+      return config;
+    }
+
+    function rollbackService(service) {
+      $scope.state.rollbackInProgress = true;
+      const config = buildChanges(service);
+      ServiceService.update(service, config, 'previous')
+        .then(function (data) {
+          if (data.message && data.message.match(/^rpc error:/)) {
+            Notifications.error('Failure', data, 'Error');
+          } else {
+            Notifications.success('Success', 'Service successfully rolled back');
+            $scope.cancelChanges({});
+            initView();
+          }
+        })
+        .catch(function (e) {
+          if (e.data.message && e.data.message.includes('does not have a previous spec')) {
+            Notifications.error('Failure', { message: 'No previous config to rollback to.' });
+          } else {
+            Notifications.error('Failure', e, 'Unable to rollback service');
+          }
+        })
+        .finally(function () {
+          $scope.state.rollbackInProgress = false;
+        });
+    }
+
+    $scope.rollbackService = function (service) {
+      confirm({
+        title: 'Rollback service',
+        message: 'Are you sure you want to rollback?',
+        modalType: ModalType.Warn,
+        confirmButton: buildConfirmButton('Yes', 'danger'),
+      }).then((confirmed) => {
+        if (!confirmed) {
+          return;
+        }
+        rollbackService(service);
+      });
+    };
+
+    $scope.setPullImageValidity = setPullImageValidity;
+    function setPullImageValidity(validity) {
+      $scope.state.pullImageValidity = validity;
+    }
+
+    $scope.updateService = function updateService(service) {
+      const config = buildChanges(service);
+      ServiceService.update(service, config).then(
+        function (data) {
+          if (data.message && data.message.match(/^rpc error:/)) {
+            Notifications.error('Failure', data, 'Error');
+          } else {
+            Notifications.success('Service successfully updated', 'Service updated');
+            $scope.updateWebhookRegistryId();
+          }
+          $scope.cancelChanges({});
+          initView();
+        },
+        function (e) {
+          Notifications.error('Failure', e, 'Unable to update service');
+        }
+      );
+    };
+
+    $scope.removeService = function () {
+      confirmDelete('Do you want to remove this service? All the containers associated to this service will be removed too.').then((confirmed) => {
+        if (!confirmed) {
+          return;
+        }
+        removeService();
+      });
+    };
+
+    function removeService() {
+      $scope.state.deletionInProgress = true;
+      ServiceService.remove($scope.service)
+        .then(function success() {
+          return $q.when($scope.webhookID && WebhookService.deleteWebhook($scope.webhookID));
+        })
+        .then(function success() {
+          Notifications.success('Success', 'Service successfully deleted');
+          $state.go('docker.services', {});
+        })
+        .catch(function error(err) {
+          Notifications.error('Failure', err, 'Unable to remove service');
+        })
+        .finally(function final() {
+          $scope.state.deletionInProgress = false;
+        });
+    }
+
+    $scope.forceUpdateService = function (service) {
+      confirmServiceForceUpdate('Do you want to force an update of the service? All the tasks associated to the service will be recreated.').then(function (result) {
+        if (!result) {
+          return;
+        }
+
+        forceUpdateService(service, result.pullLatest);
+      });
+    };
+
+    function forceUpdateService(service, pullImage) {
+      var config = convertServiceToConfig(service.Model);
+      if (pullImage) {
+        config.TaskTemplate.ContainerSpec.Image = ImageHelper.removeDigestFromRepository(config.TaskTemplate.ContainerSpec.Image);
+      }
+
+      // As explained in https://github.com/docker/swarmkit/issues/2364 ForceUpdate can accept a random
+      // value or an increment of the counter value to force an update.
+      config.TaskTemplate.ForceUpdate++;
+      $scope.state.updateInProgress = true;
+      ServiceService.update(service, config)
+        .then(function success() {
+          Notifications.success('Service successfully updated', service.Name);
+          $scope.cancelChanges({});
+          initView();
+        })
+        .catch(function error(err) {
+          Notifications.error('Failure', err, 'Unable to force update service', service.Name);
+        })
+        .finally(function final() {
+          $scope.state.updateInProgress = false;
+        });
+    }
+
+    function translateServiceArrays(service) {
+      service.ServiceSecrets = service.Secrets ? service.Secrets.map(SecretHelper.flattenSecret) : [];
+      service.ServiceConfigs = service.Configs ? service.Configs.map(ConfigHelper.flattenConfig) : [];
+      service.EnvironmentVariables = envVarsUtils
+        .parseArrayOfStrings(service.Env)
+        .map((v) => ({ ...v, added: true }))
+        .sort((v1, v2) => (v1.name > v2.name ? 1 : -1));
+      service.LogDriverOpts = ServiceHelper.translateLogDriverOptsToKeyValue(service.LogDriverOpts);
+      service.ServiceLabels = LabelHelper.fromLabelHashToKeyValue(service.Labels);
+      service.ServiceContainerLabels = LabelHelper.fromLabelHashToKeyValue(service.ContainerLabels);
+      service.ServiceMounts = angular.copy(service.Mounts);
+      service.ServiceConstraints = ServiceHelper.translateConstraintsToKeyValue(service.Constraints);
+      service.ServicePreferences = ServiceHelper.translatePreferencesToKeyValue(service.Preferences);
+      service.Hosts = ServiceHelper.translateHostsEntriesToHostnameIP(service.Hosts);
+    }
+
+    function transformResources(service) {
+      service.LimitNanoCPUs = service.LimitNanoCPUs / 1000000000 || 0;
+      service.ReservationNanoCPUs = service.ReservationNanoCPUs / 1000000000 || 0;
+      service.LimitMemoryBytes = service.LimitMemoryBytes / 1024 / 1024 || 0;
+      service.ReservationMemoryBytes = service.ReservationMemoryBytes / 1024 / 1024 || 0;
+    }
+
+    function transformDurations(service) {
+      service.RestartDelay = ServiceHelper.translateNanosToHumanDuration(service.RestartDelay) || '5s';
+      service.RestartWindow = ServiceHelper.translateNanosToHumanDuration(service.RestartWindow) || '0s';
+      service.UpdateDelay = ServiceHelper.translateNanosToHumanDuration(service.UpdateDelay) || '0s';
+      service.StopGracePeriod = service.StopGracePeriod ? ServiceHelper.translateNanosToHumanDuration(service.StopGracePeriod) : '';
+    }
+
+    $scope.onChangePorts = function (ports) {
+      $scope.$evalAsync(() => {
+        $scope.formValues.ports = ports;
+        updateServiceArray($scope.service, 'Ports');
+      });
+    };
+
+    $scope.onResetPorts = function (all = false) {
+      $scope.$evalAsync(() => {
+        $scope.formValues.ports = portsMappingUtils.toViewModel($scope.service.Model.Spec.EndpointSpec?.Ports);
+
+        $scope.cancelChanges($scope.service, all ? undefined : ['Ports']);
+      });
+    };
+
+    $scope.onSubmit = function () {
+      $scope.updateService($scope.service);
+    };
+
+    function initView() {
+      $scope.isLoading = true;
+      var apiVersion = $scope.applicationState.endpoint.apiVersion;
+      var agentProxy = $scope.applicationState.endpoint.mode.agentProxy;
+
+      var service = null;
+      ServiceService.service($transition$.params().id)
+        .then(function success(data) {
+          service = data;
+          $scope.isUpdating = $scope.lastVersion >= service.Version;
+          if (!$scope.isUpdating) {
+            $scope.lastVersion = service.Version;
+          }
+
+          $scope.formValues.ports = portsMappingUtils.toViewModel(service.Model.Spec.EndpointSpec?.Ports);
+
+          transformResources(service);
+          translateServiceArrays(service);
+          transformDurations(service);
+          $scope.service = service;
+          originalService = angular.copy(service);
+
+          return $q.all({
+            volumes: VolumeService.volumes(),
+            tasks: TaskService.tasks({ service: [service.Name] }),
+            containers: agentProxy ? ContainerService.containers(endpoint.Id) : [],
+            nodes: NodeService.nodes(),
+            secrets: apiVersion >= 1.25 ? SecretService.secrets() : [],
+            configs: apiVersion >= 1.3 ? ConfigService.configs(endpoint.Id) : [],
+            availableImages: ImageService.images(),
+            availableLoggingDrivers: PluginService.loggingPlugins(apiVersion < 1.25),
+            availableNetworks: NetworkService.networks(true, true, apiVersion >= 1.25),
+            webhooks: WebhookService.webhooks(service.Id, endpoint.Id),
+          });
+        })
+        .then(async function success(data) {
+          $scope.nodes = data.nodes;
+          $scope.configs = data.configs;
+          $scope.secrets = data.secrets;
+          $scope.availableImages = ImageService.getUniqueTagListFromImages(data.availableImages);
+          $scope.availableLoggingDrivers = data.availableLoggingDrivers;
+          $scope.availableVolumes = data.volumes;
+          $scope.allowBindMounts = endpoint.SecuritySettings.allowBindMountsForRegularUsers;
+          $scope.isAdmin = Authentication.isAdmin();
+          $scope.availableNetworks = data.availableNetworks;
+          $scope.swarmNetworks = _.filter($scope.availableNetworks, (network) => network.Scope === 'swarm');
+
+          const serviceNetworks = _.uniqBy(_.concat($scope.service.Model.Spec.Networks || [], $scope.service.Model.Spec.TaskTemplate.Networks || []), 'Target');
+          const networks = _.filter(
+            _.map(serviceNetworks, ({ Target }) => _.find(data.availableNetworks, { Id: Target })),
+            Boolean
+          );
+
+          if (_.some($scope.service.Ports, (port) => port.PublishMode === 'ingress')) {
+            const ingressNetwork = _.find($scope.availableNetworks, (network) => network.Ingress);
+            if (ingressNetwork) {
+              networks.unshift(ingressNetwork);
+            }
+          }
+
+          $scope.service.Networks = await Promise.all(
+            _.map(networks, async (item) => {
+              let addr = '';
+              if (item.IPAM.Config.length) {
+                addr = item.IPAM.Config[0].Subnet;
+              } else {
+                const network = await NetworkService.network(item.Id);
+                addr = (network && network.IPAM && network.IPAM.Config && network.IPAM.Config.length && network.IPAM.Config[0].Subnet) || '';
+              }
+              return { Id: item.Id, Name: item.Name, Addr: addr, Editable: !item.Ingress };
+            })
+          );
+
+          originalService.Networks = angular.copy($scope.service.Networks);
+
+          if (data.webhooks.length > 0) {
+            var webhook = data.webhooks[0];
+            $scope.WebhookExists = true;
+            $scope.webhookID = webhook.Id;
+            $scope.webhookURL = WebhookHelper.returnWebhookUrl(webhook.Token);
+          }
+
+          var tasks = data.tasks;
+
+          if (agentProxy) {
+            var containers = data.containers;
+            for (var i = 0; i < tasks.length; i++) {
+              var task = tasks[i];
+              TaskHelper.associateContainerToTask(task, containers);
+            }
+          }
+
+          ServiceHelper.associateTasksToService(service, tasks);
+
+          $scope.tasks = data.tasks;
+
+          // Set max cpu value
+          var maxCpus = 0;
+          for (var n in data.nodes) {
+            if (data.nodes[n].CPUs && data.nodes[n].CPUs > maxCpus) {
+              maxCpus = data.nodes[n].CPUs;
+            }
+          }
+          if (maxCpus > 0) {
+            $scope.state.sliderMaxCpu = maxCpus / 1000000000;
+          } else {
+            $scope.state.sliderMaxCpu = 32;
+          }
+
+          const image = $scope.service.Model.Spec.TaskTemplate.ContainerSpec.Image;
+          RegistryService.retrievePorRegistryModelFromRepository(image, endpoint.Id).then((model) => {
+            $scope.formValues.RegistryModel = model;
+            $scope.initialRegistryID = _.get(model, 'Registry.Id', 0);
+          });
+
+          // Default values
+          $scope.state.addSecret = { override: false };
+
+          $timeout(function () {
+            $anchorScroll();
+          });
+        })
+        .catch(function error(err) {
+          $scope.secrets = [];
+          $scope.configs = [];
+          Notifications.error('Failure', err, 'Unable to retrieve service details');
+        })
+        .finally(() => {
+          $scope.isLoading = false;
+        });
+    }
+
+    $scope.updateServiceAttribute = updateServiceAttribute;
+    function updateServiceAttribute(service, name) {
+      if (service[name] !== originalService[name] || !(name in originalService)) {
+        service.hasChanges = true;
+      }
+      previousServiceValues.push(name);
+    }
+
+    $scope.filterNetworks = filterNetworks;
+    function filterNetworks(networks, current) {
+      return networks.filter((network) => !network.Ingress && (network.Id === current.Id || $scope.service.Networks.every((serviceNetwork) => network.Id !== serviceNetwork.Id)));
+    }
+
+    $scope.filterConfigs = filterConfigs;
+    function filterConfigs(configs) {
+      if (!configs) {
+        return [];
+      }
+
+      return configs.filter((config) => $scope.service.ServiceConfigs.every((serviceConfig) => config.Id !== serviceConfig.Id));
+    }
+
+    function updateServiceArray(service, name) {
+      previousServiceValues.push(name);
+      service.hasChanges = true;
+    }
+
+    initView();
+  },
+]);
diff --git a/app/docker/views/services/logs/serviceLogsController.js b/app/docker/views/services/logs/serviceLogsController.js
new file mode 100644
index 0000000..e0c56b7
--- /dev/null
+++ b/app/docker/views/services/logs/serviceLogsController.js
@@ -0,0 +1,75 @@
+import moment from 'moment';
+
+angular.module('portainer.docker').controller('ServiceLogsController', [
+  '$scope',
+  '$transition$',
+  '$interval',
+  'ServiceService',
+  'Notifications',
+  function ($scope, $transition$, $interval, ServiceService, Notifications) {
+    $scope.state = {
+      refreshRate: 3,
+      lineCount: 100,
+      sinceTimestamp: '',
+      displayTimestamps: false,
+    };
+
+    $scope.changeLogCollection = function (logCollectionStatus) {
+      if (!logCollectionStatus) {
+        stopRepeater();
+      } else {
+        setUpdateRepeater();
+      }
+    };
+
+    $scope.$on('$destroy', function () {
+      stopRepeater();
+    });
+
+    function stopRepeater() {
+      var repeater = $scope.repeater;
+      if (angular.isDefined(repeater)) {
+        $interval.cancel(repeater);
+      }
+    }
+
+    function setUpdateRepeater() {
+      var refreshRate = $scope.state.refreshRate;
+      $scope.repeater = $interval(function () {
+        ServiceService.logs($transition$.params().id, 1, 1, $scope.state.displayTimestamps ? 1 : 0, moment($scope.state.sinceTimestamp).unix(), $scope.state.lineCount)
+          .then(function success(data) {
+            $scope.logs = data;
+          })
+          .catch(function error(err) {
+            stopRepeater();
+            Notifications.error('Failure', err, 'Unable to retrieve service logs');
+          });
+      }, refreshRate * 1000);
+    }
+
+    function startLogPolling() {
+      ServiceService.logs($transition$.params().id, 1, 1, $scope.state.displayTimestamps ? 1 : 0, moment($scope.state.sinceTimestamp).unix(), $scope.state.lineCount)
+        .then(function success(data) {
+          $scope.logs = data;
+          setUpdateRepeater();
+        })
+        .catch(function error(err) {
+          stopRepeater();
+          Notifications.error('Failure', err, 'Unable to retrieve service logs');
+        });
+    }
+
+    function initView() {
+      ServiceService.service($transition$.params().id)
+        .then(function success(data) {
+          $scope.service = data;
+          startLogPolling();
+        })
+        .catch(function error(err) {
+          Notifications.error('Failure', err, 'Unable to retrieve service information');
+        });
+    }
+
+    initView();
+  },
+]);
diff --git a/app/docker/views/services/logs/servicelogs.html b/app/docker/views/services/logs/servicelogs.html
new file mode 100644
index 0000000..896b2a4
--- /dev/null
+++ b/app/docker/views/services/logs/servicelogs.html
@@ -0,0 +1,26 @@
+<page-header
+  title="'Service logs'"
+  breadcrumbs="[
+    {
+      label: 'Services',
+      link: 'docker.services'
+    },
+    {
+      label: service.Name,
+      link: 'docker.services.service',
+      linkParams: { id: service.Id }
+    },
+    'Logs'
+  ]"
+>
+</page-header>
+
+<log-viewer
+  data="logs"
+  ng-if="logs"
+  log-collection-change="changeLogCollection"
+  display-timestamps="state.displayTimestamps"
+  line-count="state.lineCount"
+  since-timestamp="state.sinceTimestamp"
+  resource-name="service.Name"
+></log-viewer>
diff --git a/app/docker/views/services/services.html b/app/docker/views/services/services.html
new file mode 100644
index 0000000..e1a7b8a
--- /dev/null
+++ b/app/docker/views/services/services.html
@@ -0,0 +1,10 @@
+<page-header title="'Service list'" breadcrumbs="['Services']" reload="true"> </page-header>
+
+<docker-services-datatable
+  dataset="services"
+  title-icon="shuffle"
+  on-refresh="(getServices)"
+  is-add-action-visible="true"
+  is-stack-column-visible="true"
+  table-key="'services'"
+></docker-services-datatable>
diff --git a/app/docker/views/services/servicesController.js b/app/docker/views/services/servicesController.js
new file mode 100644
index 0000000..bb4d192
--- /dev/null
+++ b/app/docker/views/services/servicesController.js
@@ -0,0 +1,59 @@
+angular.module('portainer.docker').controller('ServicesController', [
+  '$q',
+  '$scope',
+  'ServiceService',
+  'ServiceHelper',
+  'Notifications',
+  'TaskService',
+  'TaskHelper',
+  'NodeService',
+  'ContainerService',
+  'endpoint',
+  function ($q, $scope, ServiceService, ServiceHelper, Notifications, TaskService, TaskHelper, NodeService, ContainerService, endpoint) {
+    $scope.getServices = getServices;
+    $scope.endpoint = endpoint;
+
+    function getServices() {
+      var agentProxy = $scope.applicationState.endpoint.mode.agentProxy;
+
+      return $q
+        .all({
+          services: ServiceService.services(),
+          tasks: TaskService.tasks(),
+          containers: agentProxy ? ContainerService.containers(endpoint.Id, 1) : [],
+          nodes: NodeService.nodes(),
+        })
+        .then(function success(data) {
+          var services = data.services;
+          var tasks = data.tasks;
+
+          if (agentProxy) {
+            var containers = data.containers;
+            for (var j = 0; j < tasks.length; j++) {
+              var task = tasks[j];
+              TaskHelper.associateContainerToTask(task, containers);
+            }
+          }
+
+          for (var i = 0; i < services.length; i++) {
+            var service = services[i];
+            ServiceHelper.associateTasksToService(service, tasks);
+          }
+
+          $scope.nodes = data.nodes;
+          $scope.tasks = tasks;
+          $scope.services = services;
+        })
+        .catch(function error(err) {
+          $scope.services = [];
+          Notifications.error('Failure', err, 'Unable to retrieve services');
+        });
+    }
+
+    function initView() {
+      getServices();
+    }
+
+    initView();
+  },
+]);
diff --git a/app/docker/views/swarm/swarm.html b/app/docker/views/swarm/swarm.html
new file mode 100644
index 0000000..0aab190
--- /dev/null
+++ b/app/docker/views/swarm/swarm.html
@@ -0,0 +1,40 @@
+<page-header title="'Cluster overview'" breadcrumbs="['Swarm']" reload="true"> </page-header>
+
+<div class="row">
+  <div class="col-sm-12">
+    <rd-widget>
+      <rd-widget-header icon="trello" title-text="Cluster status"></rd-widget-header>
+      <rd-widget-body classes="no-padding">
+        <table class="table">
+          <tbody>
+            <tr>
+              <td>Nodes</td>
+              <td>{{ info.Swarm.Nodes }}</td>
+            </tr>
+            <tr>
+              <td>Docker API version</td>
+              <td>{{ docker.ApiVersion }}</td>
+            </tr>
+            <tr>
+              <td>Total CPU</td>
+              <td>{{ totalCPU }}</td>
+            </tr>
+            <tr>
+              <td>Total memory</td>
+              <td>{{ totalMemory | humansize: 2 }}</td>
+            </tr>
+            <tr>
+              <td colspan="2">
+                <div class="btn-group" role="group" aria-label="...">
+                  <a ui-sref="docker.swarm.visualizer" class="vertical-center"><pr-icon icon="'trello'" class-name="'icon'"></pr-icon>Go to cluster visualizer</a>
+                </div>
+              </td>
+            </tr>
+          </tbody>
+        </table>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
+
+<nodes-datatable dataset="nodes" is-ip-column-visible="applicationState.endpoint.apiVersion >= 1.25" have-access-to-node="isAdmin" on-refresh="(getNodes)"></nodes-datatable>
diff --git a/app/docker/views/swarm/swarmController.js b/app/docker/views/swarm/swarmController.js
new file mode 100644
index 0000000..ff4f7c4
--- /dev/null
+++ b/app/docker/views/swarm/swarmController.js
@@ -0,0 +1,108 @@
+angular.module('portainer.docker').controller('SwarmController', [
+  '$q',
+  '$scope',
+  'SystemService',
+  'NodeService',
+  'Notifications',
+  'StateManager',
+  'Authentication',
+  function ($q, $scope, SystemService, NodeService, Notifications, StateManager, Authentication) {
+    $scope.info = {};
+    $scope.docker = {};
+    $scope.swarm = {};
+    $scope.totalCPU = 0;
+    $scope.totalMemory = 0;
+
+    function extractSwarmInfo(info) {
+      // Swarm info is available in SystemStatus object
+      var systemStatus = info.SystemStatus;
+      // Swarm strategy
+      $scope.swarm[systemStatus[1][0]] = systemStatus[1][1];
+      // Swarm filters
+      $scope.swarm[systemStatus[2][0]] = systemStatus[2][1];
+      // Swarm node count
+      var nodes = systemStatus[0][1] === 'primary' ? systemStatus[3][1] : systemStatus[4][1];
+      var node_count = parseInt(nodes, 10);
+      $scope.swarm[systemStatus[3][0]] = node_count;
+
+      $scope.swarm.Status = [];
+      extractNodesInfo(systemStatus, node_count);
+    }
+
+    function extractNodesInfo(info, node_count) {
+      // First information for node1 available at element #4 of SystemStatus if connected to a primary
+      // If connected to a replica, information for node1 is available at element #5
+      // The next 10 elements are information related to the node
+      var node_offset = info[0][1] === 'primary' ? 4 : 5;
+      for (let i = 0; i < node_count; i++) {
+        extractNodeInfo(info, node_offset);
+        node_offset += 9;
+      }
+    }
+
+    function extractNodeInfo(info, offset) {
+      var node = {};
+      node.name = info[offset][0];
+      node.ip = info[offset][1];
+      node.Id = info[offset + 1][1];
+      node.status = info[offset + 2][1];
+      node.containers = info[offset + 3][1];
+      node.cpu = info[offset + 4][1].split('/')[1];
+      node.memory = info[offset + 5][1].split('/')[1];
+      node.labels = info[offset + 6][1];
+      node.version = info[offset + 8][1];
+      $scope.swarm.Status.push(node);
+    }
+
+    function processTotalCPUAndMemory(nodes) {
+      var CPU = 0,
+        memory = 0;
+      angular.forEach(nodes, function (node) {
+        CPU += node.CPUs;
+        memory += node.Memory;
+      });
+      $scope.totalCPU = CPU / 1000000000;
+      $scope.totalMemory = memory;
+    }
+
+    $scope.getNodes = getNodes;
+    function getNodes() {
+      var provider = $scope.applicationState.endpoint.mode.provider;
+      if (provider === 'DOCKER_SWARM_MODE') {
+        NodeService.nodes()
+          .then(function (data) {
+            var nodes = data;
+            processTotalCPUAndMemory(nodes);
+            $scope.nodes = nodes;
+          })
+          .catch(function error(err) {
+            Notifications.error('Failure', err, 'Unable to retrieve cluster details');
+          });
+      }
+    }
+
+    function initView() {
+      $scope.isAdmin = Authentication.isAdmin();
+
+      var provider = $scope.applicationState.endpoint.mode.provider;
+      $q.all({
+        version: SystemService.version(),
+        info: SystemService.info(),
+      })
+        .then(function success(data) {
+          $scope.docker = data.version;
+          $scope.info = data.info;
+          if (provider === 'DOCKER_SWARM_MODE') {
+            getNodes();
+          } else {
+            extractSwarmInfo(data.info);
+          }
+        })
+        .catch(function error(err) {
+          Notifications.error('Failure', err, 'Unable to retrieve cluster details');
+        });
+    }
+
+    initView();
+  },
+]);
diff --git a/app/docker/views/swarm/visualizer/swarmVisualizerController.js b/app/docker/views/swarm/visualizer/swarmVisualizerController.js
new file mode 100644
index 0000000..8293123
--- /dev/null
+++ b/app/docker/views/swarm/visualizer/swarmVisualizerController.js
@@ -0,0 +1,169 @@
+angular.module('portainer.docker').controller('SwarmVisualizerController', [
+  '$q',
+  '$scope',
+  '$document',
+  '$interval',
+  'NodeService',
+  'ServiceService',
+  'TaskService',
+  'Notifications',
+  'LocalStorage',
+  function ($q, $scope, $document, $interval, NodeService, ServiceService, TaskService, Notifications, LocalStorage) {
+    $scope.state = {
+      ShowInformationPanel: true,
+      DisplayOnlyRunningTasks: false,
+      DisplayNodeLabels: false,
+      refreshRate: '5',
+    };
+
+    $scope.handleChangeDisplayOnlyRunningTasks = function handleChangeDisplayOnlyRunningTasks(enabled) {
+      $scope.$evalAsync(() => {
+        $scope.state.DisplayOnlyRunningTasks = enabled;
+        $scope.changeDisplayOnlyRunningTasks();
+      });
+    };
+
+    $scope.handleChangeDisplayNodeLabels = function handleChangeDisplayNodeLabels(enabled) {
+      $scope.$evalAsync(() => {
+        $scope.state.DisplayNodeLabels = enabled;
+        $scope.changeDisplayNodeLabels();
+      });
+    };
+
+    $scope.$on('$destroy', function () {
+      stopRepeater();
+    });
+
+    $scope.changeShowInformationPanel = function (value) {
+      $scope.state.ShowInformationPanel = value;
+      LocalStorage.storeSwarmVisualizerSettings('show_info_panel', value);
+    };
+
+    $scope.changeDisplayOnlyRunningTasks = function () {
+      var value = $scope.state.DisplayOnlyRunningTasks;
+      LocalStorage.storeSwarmVisualizerSettings('display_only_running_tasks', value);
+    };
+
+    $scope.changeDisplayNodeLabels = function () {
+      var value = $scope.state.DisplayNodeLabels;
+      LocalStorage.storeSwarmVisualizerSettings('display_node_labels', value);
+    };
+
+    $scope.changeUpdateRepeater = function () {
+      stopRepeater();
+      setUpdateRepeater();
+      $('#refreshRateChange').show();
+      $('#refreshRateChange').fadeOut(1500);
+      LocalStorage.storeSwarmVisualizerSettings('refresh_rate', $scope.state.refreshRate);
+    };
+
+    function stopRepeater() {
+      var repeater = $scope.repeater;
+      if (angular.isDefined(repeater)) {
+        $interval.cancel(repeater);
+      }
+    }
+
+    function setUpdateRepeater() {
+      var refreshRate = $scope.state.refreshRate;
+      $scope.repeater = $interval(function () {
+        $q.all({
+          nodes: NodeService.nodes(),
+          services: ServiceService.services(),
+          tasks: TaskService.tasks(),
+        })
+          .then(function success(data) {
+            var nodes = data.nodes;
+            $scope.nodes = nodes;
+            var services = data.services;
+            $scope.services = services;
+            var tasks = data.tasks;
+            $scope.tasks = tasks;
+            prepareVisualizerData(nodes, services, tasks);
+          })
+          .catch(function error(err) {
+            stopRepeater();
+            Notifications.error('Failure', err, 'Unable to retrieve cluster information');
+          });
+      }, refreshRate * 1000);
+    }
+
+    function assignServiceInfo(services, tasks) {
+      for (var i = 0; i < services.length; i++) {
+        var service = services[i];
+
+        for (var j = 0; j < tasks.length; j++) {
+          var task = tasks[j];
+
+          if (task.ServiceId === service.Id) {
+            task.ServiceName = service.Name;
+          }
+        }
+      }
+    }
+
+    function assignTasksToNode(nodes, tasks) {
+      for (var i = 0; i < nodes.length; i++) {
+        var node = nodes[i];
+        node.Tasks = [];
+
+        for (var j = 0; j < tasks.length; j++) {
+          var task = tasks[j];
+
+          if (task.NodeId === node.Id) {
+            node.Tasks.push(task);
+          }
+        }
+      }
+    }
+
+    function prepareVisualizerData(nodes, services, tasks) {
+      var visualizerData = {};
+
+      assignServiceInfo(services, tasks);
+      assignTasksToNode(nodes, tasks);
+
+      visualizerData.nodes = nodes;
+      $scope.visualizerData = visualizerData;
+    }
+
+    function loadState() {
+      var showInfoPanel = LocalStorage.getSwarmVisualizerSettings('show_info_panel');
+      if (showInfoPanel !== undefined && showInfoPanel !== null) $scope.state.ShowInformationPanel = showInfoPanel;
+
+      var displayOnlyRunningTasks = LocalStorage.getSwarmVisualizerSettings('display_only_running_tasks');
+      if (displayOnlyRunningTasks !== undefined && displayOnlyRunningTasks !== null) $scope.state.DisplayOnlyRunningTasks = displayOnlyRunningTasks;
+
+      var displayNodeLabels = LocalStorage.getSwarmVisualizerSettings('display_node_labels');
+      if (displayNodeLabels !== undefined && displayNodeLabels !== null) $scope.state.DisplayNodeLabels = displayNodeLabels;
+
+      var refreshRate = LocalStorage.getSwarmVisualizerSettings('refresh_rate');
+      if (refreshRate !== undefined && refreshRate !== null) $scope.state.refreshRate = refreshRate;
+    }
+
+    function initView() {
+      $q.all({
+        nodes: NodeService.nodes(),
+        services: ServiceService.services(),
+        tasks: TaskService.tasks(),
+      })
+        .then(function success(data) {
+          var nodes = data.nodes;
+          $scope.nodes = nodes;
+          var services = data.services;
+          $scope.services = services;
+          var tasks = data.tasks;
+          $scope.tasks = tasks;
+          prepareVisualizerData(nodes, services, tasks);
+          setUpdateRepeater();
+        })
+        .catch(function error(err) {
+          Notifications.error('Failure', err, 'Unable to initialize cluster visualizer');
+        });
+
+      loadState();
+    }
+
+    initView();
+  },
+]);
diff --git a/app/docker/views/swarm/visualizer/swarmvisualizer.html b/app/docker/views/swarm/visualizer/swarmvisualizer.html
new file mode 100644
index 0000000..cd1a1d2
--- /dev/null
+++ b/app/docker/views/swarm/visualizer/swarmvisualizer.html
@@ -0,0 +1,124 @@
+<page-header title="'Swarm visualizer'" breadcrumbs="[{label:'Swarm', link:'docker.swarm'}, {label:'Cluster visualizer', link:'docker.swarm.visualizer'}]" reload="true">
+</page-header>
+
+<div class="row">
+  <div class="col-sm-12">
+    <rd-widget>
+      <rd-widget-header icon="trello" title-text="Cluster information">
+        <div class="pull-right">
+          <button type="button" class="btn btn-sm btn-primary" ng-click="changeShowInformationPanel(true)" ng-if="!state.ShowInformationPanel">Show</button>
+          <button type="button" class="btn btn-sm btn-primary" ng-click="changeShowInformationPanel(false)" ng-if="state.ShowInformationPanel">Hide</button>
+        </div>
+      </rd-widget-header>
+      <rd-widget-body ng-if="state.ShowInformationPanel">
+        <table class="table">
+          <tbody>
+            <tr>
+              <td>Nodes</td>
+              <td>{{ nodes.length }}</td>
+            </tr>
+            <tr>
+              <td>Services</td>
+              <td>{{ services.length }}</td>
+            </tr>
+            <tr>
+              <td>Tasks</td>
+              <td>{{ tasks.length }}</td>
+            </tr>
+          </tbody>
+        </table>
+        <form class="form-horizontal">
+          <div class="col-sm-12 form-section-title"> Options </div>
+          <div class="form-group">
+            <div class="col-sm-12">
+              <por-switch-field
+                label-class="'col-sm-2'"
+                checked="state.DisplayOnlyRunningTasks"
+                label="'Only display running tasks'"
+                on-change="(handleChangeDisplayOnlyRunningTasks)"
+              ></por-switch-field>
+            </div>
+          </div>
+          <div class="form-group">
+            <div class="col-sm-12">
+              <por-switch-field
+                label-class="'col-sm-2'"
+                checked="state.DisplayNodeLabels"
+                label="'Display node labels'"
+                on-change="(handleChangeDisplayNodeLabels)"
+              ></por-switch-field>
+            </div>
+          </div>
+        </form>
+        <form class="form-horizontal">
+          <div class="col-sm-12 form-section-title"> Refresh rate </div>
+          <div class="form-group">
+            <label for="refreshRate" class="col-sm-2 margin-sm-top control-label text-left">
+              <pr-icon id="refreshRateChange" icon="'check'" mode="'success'" size="'sm'" style="display: none"></pr-icon>
+            </label>
+            <div class="col-sm-2">
+              <select id="refreshRate" ng-model="state.refreshRate" ng-change="changeUpdateRepeater()" class="form-control" data-cy="swarm-refreshRate-select">
+                <option value="5">5s</option>
+                <option value="10">10s</option>
+                <option value="30">30s</option>
+                <option value="60">60s</option>
+              </select>
+            </div>
+          </div>
+        </form>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
+
+<div class="row" ng-if="visualizerData">
+  <div class="col-sm-12">
+    <rd-widget>
+      <rd-widget-header icon="trello" title-text="Cluster visualizer"></rd-widget-header>
+      <rd-widget-body>
+        <div class="visualizer_container">
+          <div class="node" ng-repeat="node in visualizerData.nodes | orderBy : ['Role', 'Hostname'] track by $index">
+            <div class="node_info">
+              <div>
+                <div>
+                  <b>{{ node.Name || node.Hostname }}</b>
+                  <span class="node_platform">
+                    <pr-icon ng-if="node.PlatformOS === 'linux'" icon="'svg-linux'"></pr-icon>
+                    <pr-icon ng-if="node.PlatformOS === 'windows'" icon="'layout-grid'"></pr-icon>
+                  </span>
+                </div>
+              </div>
+              <div>{{ node.Role }}</div>
+              <div>CPU: {{ node.CPUs / 1000000000 }}</div>
+              <div>Memory: {{ node.Memory | humansize: 2 }}</div>
+              <div
+                ><span class="label label-{{ node.Status | nodestatusbadge }}">{{ node.Status }}</span></div
+              >
+              <div class="node_labels" ng-if="node.Labels.length > 0 && state.DisplayNodeLabels">
+                <div>Labels</div>
+                <div class="node_label" ng-repeat="label in node.Labels">
+                  <span class="label_key"> {{ label.key }} </span>
+                  <span class="label_value" ng-if="label.value"> = {{ label.value }} </span>
+                </div>
+              </div>
+            </div>
+            <div class="tasks">
+              <div
+                class="task task_{{ task.Status.State | visualizerTask }}"
+                style="border: 2px solid {{ task.ServiceId | visualizerTaskBorderColor }}"
+                ng-repeat="task in node.Tasks | orderBy: 'ServiceName' | filter: (state.DisplayOnlyRunningTasks || '') && { Status: { State: 'running' } }"
+              >
+                <div class="service_name">{{ task.ServiceName }}</div>
+                <div>Image: {{ task.Spec.ContainerSpec.Image | hideshasum }}</div>
+                <div>Status: {{ task.Status.State }}</div>
+                <div>Update: {{ task.Updated | getisodate }}</div>
+                <div ng-if="task.Spec.Resources.Limits.MemoryBytes">Memory limit: {{ task.Spec.Resources.Limits.MemoryBytes | humansize: 2 : 2 }}</div>
+                <div ng-if="task.Spec.Resources.Limits.NanoCPUs">CPU limit: {{ task.Spec.Resources.Limits.NanoCPUs / 1000000000 }}</div>
+              </div>
+            </div>
+          </div>
+        </div>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
diff --git a/app/docker/views/tasks/edit/task.html b/app/docker/views/tasks/edit/task.html
new file mode 100644
index 0000000..c808ad6
--- /dev/null
+++ b/app/docker/views/tasks/edit/task.html
@@ -0,0 +1,69 @@
+<page-header
+  title="'Task details'"
+  breadcrumbs="[
+    { label:'Services', link:'docker.services' },
+    {
+      label: service.Name,
+      link: 'docker.services.service',
+      linkParams:{ id: service.Id }
+    }, task.Id]"
+>
+</page-header>
+
+<div class="row" ng-if="task && service">
+  <div class="col-lg-12 col-md-12 col-xs-12">
+    <rd-widget>
+      <rd-widget-header icon="list" title-text="Task status"></rd-widget-header>
+      <rd-widget-body classes="no-padding">
+        <table class="table">
+          <tbody>
+            <tr>
+              <td>ID</td>
+              <td>{{ task.Id }}</td>
+            </tr>
+            <tr>
+              <td>State</td>
+              <td
+                ><span class="label label-{{ task.Status.State | taskstatusbadge }}">{{ task.Status.State }}</span></td
+              >
+            </tr>
+            <tr>
+              <td>State Message</td>
+              <td>{{ task.Status.Message }}</td>
+            </tr>
+            <tr ng-if="task.Status.Err">
+              <td>Error message</td>
+              <td
+                ><code>{{ task.Status.Err }}</code></td
+              >
+            </tr>
+            <tr>
+              <td>Image</td>
+              <td>{{ task.Spec.ContainerSpec.Image | hideshasum }}</td>
+            </tr>
+            <tr ng-if="service.Mode !== 'global'">
+              <td>Slot</td>
+              <td>{{ task.Slot }}</td>
+            </tr>
+            <tr>
+              <td>Created</td>
+              <td>{{ task.Created | getisodate }}</td>
+            </tr>
+            <tr ng-if="task.Status.ContainerStatus.ContainerID">
+              <td>Container ID</td>
+              <td>{{ task.Status.ContainerStatus.ContainerID }}</td>
+            </tr>
+            <tr ng-if="applicationState.endpoint.apiVersion >= 1.3 && task.Status.State | taskhaslogs">
+              <td colspan="2"
+                ><a class="btn btn-primary btn-sm" type="button" ui-sref="docker.tasks.task.logs({id: task.Id})">
+                  <pr-icon icon="'file-text'"></pr-icon>
+                  Task logs</a
+                ></td
+              >
+            </tr>
+          </tbody>
+        </table>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
diff --git a/app/docker/views/tasks/edit/taskController.js b/app/docker/views/tasks/edit/taskController.js
new file mode 100644
index 0000000..53a31cb
--- /dev/null
+++ b/app/docker/views/tasks/edit/taskController.js
@@ -0,0 +1,26 @@
+angular.module('portainer.docker').controller('TaskController', [
+  '$scope',
+  '$transition$',
+  'TaskService',
+  'ServiceService',
+  'Notifications',
+  function ($scope, $transition$, TaskService, ServiceService, Notifications) {
+    function initView() {
+      TaskService.task($transition$.params().id)
+        .then(function success(data) {
+          var task = data;
+          $scope.task = task;
+          return ServiceService.service(task.ServiceId);
+        })
+        .then(function success(data) {
+          var service = data;
+          $scope.service = service;
+        })
+        .catch(function error(err) {
+          Notifications.error('Failure', err, 'Unable to retrieve task details');
+        });
+    }
+
+    initView();
+  },
+]);
diff --git a/app/docker/views/tasks/logs/taskLogsController.js b/app/docker/views/tasks/logs/taskLogsController.js
new file mode 100644
index 0000000..6112ed6
--- /dev/null
+++ b/app/docker/views/tasks/logs/taskLogsController.js
@@ -0,0 +1,82 @@
+import moment from 'moment';
+
+angular.module('portainer.docker').controller('TaskLogsController', [
+  '$scope',
+  '$transition$',
+  '$interval',
+  'TaskService',
+  'ServiceService',
+  'Notifications',
+  function ($scope, $transition$, $interval, TaskService, ServiceService, Notifications) {
+    $scope.state = {
+      refreshRate: 3,
+      lineCount: 100,
+      sinceTimestamp: '',
+      displayTimestamps: false,
+    };
+
+    $scope.changeLogCollection = function (logCollectionStatus) {
+      if (!logCollectionStatus) {
+        stopRepeater();
+      } else {
+        setUpdateRepeater();
+      }
+    };
+
+    $scope.$on('$destroy', function () {
+      stopRepeater();
+    });
+
+    function stopRepeater() {
+      var repeater = $scope.repeater;
+      if (angular.isDefined(repeater)) {
+        $interval.cancel(repeater);
+      }
+    }
+
+    function setUpdateRepeater() {
+      var refreshRate = $scope.state.refreshRate;
+      $scope.repeater = $interval(function () {
+        TaskService.logs($transition$.params().id, 1, 1, $scope.state.displayTimestamps ? 1 : 0, moment($scope.state.sinceTimestamp).unix(), $scope.state.lineCount)
+          .then(function success(data) {
+            $scope.logs = data;
+          })
+          .catch(function error(err) {
+            stopRepeater();
+            Notifications.error('Failure', err, 'Unable to retrieve task logs');
+          });
+      }, refreshRate * 1000);
+    }
+
+    function startLogPolling() {
+      TaskService.logs($transition$.params().id, 1, 1, $scope.state.displayTimestamps ? 1 : 0, moment($scope.state.sinceTimestamp).unix(), $scope.state.lineCount)
+        .then(function success(data) {
+          $scope.logs = data;
+          setUpdateRepeater();
+        })
+        .catch(function error(err) {
+          stopRepeater();
+          Notifications.error('Failure', err, 'Unable to retrieve task logs');
+        });
+    }
+
+    function initView() {
+      TaskService.task($transition$.params().id)
+        .then(function success(data) {
+          var task = data;
+          $scope.task = task;
+          return ServiceService.service(task.ServiceId);
+        })
+        .then(function success(data) {
+          var service = data;
+          $scope.service = service;
+          startLogPolling();
+        })
+        .catch(function error(err) {
+          Notifications.error('Failure', err, 'Unable to retrieve task details');
+        });
+    }
+
+    initView();
+  },
+]);
diff --git a/app/docker/views/tasks/logs/tasklogs.html b/app/docker/views/tasks/logs/tasklogs.html
new file mode 100644
index 0000000..1c09ea9
--- /dev/null
+++ b/app/docker/views/tasks/logs/tasklogs.html
@@ -0,0 +1,27 @@
+<page-header
+  title="'Task details'"
+  breadcrumbs="[
+    { label:'Services', link:'docker.services' },
+    { 
+      label:service.Name,
+      link:'docker.services.service', 
+      linkParams:{ id: service.Id }
+    }, 
+    { 
+      label:task.Id,
+      link:'docker.tasks.task', 
+      linkParams:{ id: task.Id }
+    },
+    'Logs']"
+>
+</page-header>
+
+<log-viewer
+  data="logs"
+  ng-if="logs"
+  log-collection-change="changeLogCollection"
+  display-timestamps="state.displayTimestamps"
+  line-count="state.lineCount"
+  since-timestamp="state.sinceTimestamp"
+  resource-name="task.Id"
+></log-viewer>
diff --git a/app/docker/views/volumes/browse/browseVolumeController.js b/app/docker/views/volumes/browse/browseVolumeController.js
new file mode 100644
index 0000000..6a53ce8
--- /dev/null
+++ b/app/docker/views/volumes/browse/browseVolumeController.js
@@ -0,0 +1,13 @@
+angular.module('portainer.docker').controller('BrowseVolumeController', BrowseVolumeController);
+
+/* @ngInject */
+function BrowseVolumeController($scope, $transition$, StateManager, endpoint) {
+  function initView() {
+    $scope.volumeId = $transition$.params().id;
+    $scope.nodeName = $transition$.params().nodeName;
+    $scope.agentApiVersion = StateManager.getAgentApiVersion();
+    $scope.endpointId = endpoint.Id;
+  }
+
+  initView();
+}
diff --git a/app/docker/views/volumes/browse/browsevolume.html b/app/docker/views/volumes/browse/browsevolume.html
new file mode 100644
index 0000000..4f431b1
--- /dev/null
+++ b/app/docker/views/volumes/browse/browsevolume.html
@@ -0,0 +1,13 @@
+<page-header
+  title="'Volume browser'"
+  breadcrumbs="[
+    { label:'Volumes', link:'docker.volumes' },
+    { 
+      label:volumeId,
+      link: 'docker.volumes.volume', 
+      linkParams:{ id: volumeId }
+    }, 'browse']"
+>
+</page-header>
+
+<volume-browser volume-id="volumeId" node-name="nodeName" is-upload-enabled="agentApiVersion > 1" endpoint-id="endpointId"></volume-browser>
diff --git a/app/docker/views/volumes/create/createVolumeController.js b/app/docker/views/volumes/create/createVolumeController.js
new file mode 100644
index 0000000..6e19484
--- /dev/null
+++ b/app/docker/views/volumes/create/createVolumeController.js
@@ -0,0 +1,160 @@
+import { AccessControlFormData } from '../../../../portainer/components/accessControlForm/porAccessControlFormModel';
+import { VolumesNFSFormData } from '../../../components/volumesNFSForm/volumesNFSFormModel';
+import { VolumesCIFSFormData } from '../../../components/volumesCIFSForm/volumesCifsFormModel';
+
+angular.module('portainer.docker').controller('CreateVolumeController', [
+  '$scope',
+  '$state',
+  'VolumeService',
+  'PluginService',
+  'ResourceControlService',
+  'Authentication',
+  'Notifications',
+  'FormValidator',
+  'endpoint',
+  function ($scope, $state, VolumeService, PluginService, ResourceControlService, Authentication, Notifications, FormValidator, endpoint) {
+    $scope.endpoint = endpoint;
+
+    $scope.formValues = {
+      Driver: 'local',
+      DriverOptions: [],
+      AccessControlData: new AccessControlFormData(),
+      NodeName: null,
+      NFSData: new VolumesNFSFormData(),
+      CIFSData: new VolumesCIFSFormData(),
+    };
+
+    $scope.state = {
+      formValidationError: '',
+      actionInProgress: false,
+    };
+
+    $scope.availableVolumeDrivers = [];
+
+    $scope.addDriverOption = function () {
+      $scope.formValues.DriverOptions.push({ name: '', value: '' });
+    };
+
+    $scope.removeDriverOption = function (index) {
+      $scope.formValues.DriverOptions.splice(index, 1);
+    };
+
+    $scope.onUseNFSChange = onUseNFSChange;
+
+    function onUseNFSChange(checked) {
+      return $scope.$evalAsync(() => {
+        $scope.formValues.NFSData.useNFS = checked;
+        $scope.formValues.CIFSData.useCIFS = false;
+      });
+    }
+
+    $scope.onUseCIFSChange = onUseCIFSChange;
+
+    function onUseCIFSChange(checked) {
+      return $scope.$evalAsync(() => {
+        $scope.formValues.CIFSData.useCIFS = checked;
+        $scope.formValues.NFSData.useNFS = false;
+      });
+    }
+
+    function validateForm(accessControlData, isAdmin) {
+      $scope.state.formValidationError = '';
+      var error = FormValidator.validateAccessControl(accessControlData, isAdmin);
+
+      if (error) {
+        $scope.state.formValidationError = error;
+        return false;
+      }
+      return true;
+    }
+
+    function prepareCIFSConfiguration(driverOptions) {
+      const data = $scope.formValues.CIFSData;
+
+      driverOptions.push({ name: 'type', value: 'cifs' });
+
+      let share = data.share.replace('\\', '/');
+      if (share[0] !== '/') {
+        share = '/' + share;
+      }
+      const device = '//' + data.serverAddress + share;
+      driverOptions.push({ name: 'device', value: device });
+
+      const versionNumber = data.versionsNumber[data.versions.indexOf(data.version)];
+      const options = 'addr=' + data.serverAddress + ',username=' + data.username + ',password=' + data.password + ',vers=' + versionNumber;
+      driverOptions.push({ name: 'o', value: options });
+    }
+
+    function prepareNFSConfiguration(driverOptions) {
+      var data = $scope.formValues.NFSData;
+
+      driverOptions.push({ name: 'type', value: 'nfs' });
+
+      var options = 'addr=' + data.serverAddress + ',' + data.options;
+      if (data.version === 'NFS4') {
+        options = options + ',nfsvers=4';
+      }
+      driverOptions.push({ name: 'o', value: options });
+
+      var mountPoint = data.mountPoint.indexOf(':') === -1 ? ':' + data.mountPoint : data.mountPoint;
+      driverOptions.push({ name: 'device', value: mountPoint });
+    }
+
+    $scope.create = function () {
+      var name = $scope.formValues.Name;
+      var driver = $scope.formValues.Driver;
+      var driverOptions = $scope.formValues.DriverOptions;
+
+      if ($scope.formValues.NFSData.useNFS) {
+        prepareNFSConfiguration(driverOptions);
+      }
+
+      if ($scope.formValues.CIFSData.useCIFS) {
+        prepareCIFSConfiguration(driverOptions);
+      }
+
+      var volumeConfiguration = VolumeService.createVolumeConfiguration(name, driver, driverOptions);
+      var accessControlData = $scope.formValues.AccessControlData;
+      var userDetails = Authentication.getUserDetails();
+      var isAdmin = Authentication.isAdmin();
+
+      if (!validateForm(accessControlData, isAdmin)) {
+        return;
+      }
+
+      var nodeName = $scope.formValues.NodeName;
+
+      $scope.state.actionInProgress = true;
+      VolumeService.createVolume(volumeConfiguration, nodeName)
+        .then(function success(data) {
+          const userId = userDetails.ID;
+          const resourceControl = data.ResourceControl;
+          return ResourceControlService.applyResourceControl(userId, accessControlData, resourceControl);
+        })
+        .then(function success() {
+          Notifications.success('Success', 'Volume successfully created');
+          $state.go('docker.volumes', {}, { reload: true });
+        })
+        .catch(function error(err) {
+          Notifications.error('Failure', err, 'An error occurred during volume creation');
+        })
+        .finally(function final() {
+          $scope.state.actionInProgress = false;
+        });
+    };
+
+    function initView() {
+      var apiVersion = $scope.applicationState.endpoint.apiVersion;
+
+      PluginService.volumePlugins(apiVersion < 1.25)
+        .then(function success(data) {
+          $scope.availableVolumeDrivers = data;
+        })
+        .catch(function error(err) {
+          Notifications.error('Failure', err, 'Unable to retrieve volume drivers');
+        });
+    }
+
+    initView();
+  },
+]);
diff --git a/app/docker/views/volumes/create/createvolume.html b/app/docker/views/volumes/create/createvolume.html
new file mode 100644
index 0000000..38686aa
--- /dev/null
+++ b/app/docker/views/volumes/create/createvolume.html
@@ -0,0 +1,117 @@
+<page-header title="'Create volume'" breadcrumbs="[{label:'Volumes', link:'docker.volumes'}, 'Add volume']"> </page-header>
+
+<div class="row">
+  <div class="col-sm-12">
+    <rd-widget>
+      <rd-widget-body>
+        <form class="form-horizontal" name="volumeCreationForm">
+          <!-- name-input -->
+          <div class="form-group">
+            <label for="volume_name" class="col-sm-2 col-md-1 control-label text-left">Name</label>
+            <div class="col-sm-10 col-md-11">
+              <input type="text" class="form-control" ng-model="formValues.Name" id="volume_name" placeholder="e.g. myVolume" data-cy="volume-name-input" />
+            </div>
+          </div>
+          <!-- !name-input -->
+          <div class="col-sm-12 form-section-title"> Driver configuration </div>
+          <!-- driver-input -->
+          <div class="form-group">
+            <label for="volume_driver" class="col-sm-2 col-md-1 control-label text-left">Driver</label>
+            <div class="col-sm-10 col-md-11">
+              <select
+                class="form-control"
+                ng-options="driver for driver in availableVolumeDrivers"
+                ng-model="formValues.Driver"
+                ng-if="availableVolumeDrivers.length > 0"
+                data-cy="volume-driver-select"
+              >
+                <option disabled hidden value="">Select a driver</option>
+              </select>
+              <input
+                type="text"
+                class="form-control"
+                ng-model="formValues.Driver"
+                id="volume_driver"
+                placeholder="e.g. driverName"
+                ng-if="availableVolumeDrivers.length === 0"
+                data-cy="volume-driver-input"
+              />
+            </div>
+          </div>
+          <!-- !driver-input -->
+          <!-- driver-options -->
+          <div class="form-group" ng-hide="formValues.CIFSData.useCIFS || formValues.NFSData.useNFS">
+            <div class="col-sm-12" style="margin-top: 5px">
+              <label class="control-label text-left">
+                Driver options
+                <portainer-tooltip message="'Driver options are specific to the selected driver. Please refer to the selected driver documentation.'"></portainer-tooltip>
+              </label>
+              <span class="label label-default interactive" style="margin-left: 10px" ng-click="addDriverOption()">
+                <pr-icon icon="'plus'" mode="'alt'"></pr-icon> add driver option
+              </span>
+            </div>
+            <!-- driver-options-input-list -->
+            <div class="col-sm-12 form-inline" style="margin-top: 10px">
+              <div ng-repeat="option in formValues.DriverOptions" style="margin-top: 2px">
+                <div class="input-group col-sm-5 input-group-sm">
+                  <span class="input-group-addon">name</span>
+                  <input type="text" class="form-control" ng-model="option.name" placeholder="e.g. mountpoint" data-cy="driver-option-name-input" />
+                </div>
+                <div class="input-group col-sm-5 input-group-sm">
+                  <span class="input-group-addon">value</span>
+                  <input type="text" class="form-control" ng-model="option.value" placeholder="e.g. /path/on/host" data-cy="driver-option-value-input" />
+                </div>
+                <button class="btn btn-sm btn-light" type="button" ng-click="removeDriverOption($index)">
+                  <pr-icon icon="'trash-2'" class-name="'icon-secondary icon-md'"></pr-icon>
+                </button>
+              </div>
+            </div>
+            <!-- !driver-options-input-list -->
+          </div>
+          <!-- !driver-options -->
+          <!-- nfs-management -->
+          <div class="form-group col-md-12">
+            <por-switch-field checked="formValues.NFSData.useNFS" label="'Use NFS volume'" on-change="(onUseNFSChange)"></por-switch-field>
+            <div ng-if="formValues.NFSData.useNFS" class="small text-muted" style="margin-top: 10px"> Ensure <code>nfs-utils</code> are installed on your hosts. </div>
+          </div>
+          <volumes-nfs-form data="formValues.NFSData" ng-show="formValues.Driver === 'local'"></volumes-nfs-form>
+          <!-- !nfs-management -->
+          <!-- cifs-management -->
+          <div class="form-group col-md-12">
+            <por-switch-field checked="formValues.CIFSData.useCIFS" label="'Use CIFS volume'" on-change="(onUseCIFSChange)"></por-switch-field>
+            <div ng-if="formValues.CIFSData.useCIFS" class="small text-muted" style="margin-top: 10px"> Ensure <code>cifs-utils</code> are installed on your hosts. </div>
+          </div>
+          <volumes-cifs-form data="formValues.CIFSData" ng-show="formValues.Driver === 'local'"></volumes-cifs-form>
+          <!-- !cifs-management -->
+          <div ng-if="applicationState.endpoint.mode.agentProxy && applicationState.endpoint.mode.provider === 'DOCKER_SWARM_MODE' && formValues.Driver === 'local'">
+            <div class="col-sm-12 form-section-title"> Deployment </div>
+            <!-- node-selection -->
+            <node-selector model="formValues.NodeName" endpoint-id="endpoint.Id"> </node-selector>
+            <!-- !node-selection -->
+          </div>
+          <!-- access-control -->
+          <por-access-control-form form-data="formValues.AccessControlData"></por-access-control-form>
+          <!-- !access-control -->
+          <!-- actions -->
+          <div class="col-sm-12 form-section-title"> Actions </div>
+          <div class="form-group">
+            <div class="col-sm-12">
+              <button
+                type="button"
+                class="btn btn-primary btn-sm"
+                ng-click="create()"
+                ng-disabled="state.actionInProgress || (formValues.NFSData.useNFS && !volumeCreationForm.nfsInformationForm.$valid) || (formValues.CIFSData.useCIFS && !volumeCreationForm.cifsInformationForm.$valid)"
+                button-spinner="state.actionInProgress"
+              >
+                <span ng-hide="state.actionInProgress">Create the volume</span>
+                <span ng-show="state.actionInProgress">Creating volume...</span>
+              </button>
+              <span class="text-danger" ng-if="state.formValidationError" style="margin-left: 5px">{{ state.formValidationError }}</span>
+            </div>
+          </div>
+          <!-- !actions -->
+        </form>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
diff --git a/app/docker/views/volumes/edit/volume.html b/app/docker/views/volumes/edit/volume.html
new file mode 100644
index 0000000..eb4a6a7
--- /dev/null
+++ b/app/docker/views/volumes/edit/volume.html
@@ -0,0 +1,111 @@
+<page-header title="'Volume details'" breadcrumbs="[{label:'Volumes', link:'docker.volumes'}, volume.Id]"> </page-header>
+
+<div class="row" ng-if="volume">
+  <div class="col-sm-12">
+    <rd-widget>
+      <rd-widget-header icon="database" title-text="Volume details"></rd-widget-header>
+      <rd-widget-body classes="no-padding">
+        <table class="table">
+          <tbody>
+            <tr>
+              <td>ID</td>
+              <td>
+                {{ volume.Id }}
+                <button
+                  ng-if="showBrowseAction"
+                  class="btn btn-xs btn-primary"
+                  ui-sref="docker.volumes.volume.browse({ id: volume.Name, nodeName: volume.NodeName })"
+                  authorization="DockerAgentBrowseList"
+                >
+                  <pr-icon icon="'search'" class="leading-none"></pr-icon>
+                  Browse
+                </button>
+                <button authorization="DockerVolumeDelete" class="btn btn-xs btn-danger" ng-click="removeVolume()"
+                  ><pr-icon icon="'trash-2'" class="leading-none"></pr-icon> Remove this volume</button
+                >
+              </td>
+            </tr>
+            <tr>
+              <td>Created</td>
+              <td>{{ volume.CreatedAt | getisodate }}</td>
+            </tr>
+            <tr>
+              <td>Mount path</td>
+              <td>{{ volume.Mountpoint }}</td>
+            </tr>
+            <tr>
+              <td>Driver</td>
+              <td>{{ volume.Driver }}</td>
+            </tr>
+            <tr ng-if="!(volume.Labels | emptyobject)">
+              <td>Labels</td>
+              <td>
+                <table class="table-bordered table-condensed table">
+                  <tr ng-repeat="(k, v) in volume.Labels">
+                    <td>{{ k }}</td>
+                    <td>{{ v }}</td>
+                  </tr>
+                </table>
+              </td>
+            </tr>
+          </tbody>
+        </table>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
+
+<!-- access-control-panel -->
+<access-control-panel
+  ng-if="volume"
+  resource-id="volume.ResourceId"
+  resource-control="volume.ResourceControl"
+  resource-type="resourceType"
+  on-update-success="(onUpdateResourceControlSuccess)"
+  environment-id="endpoint.Id"
+>
+</access-control-panel>
+<!-- !access-control-panel -->
+
+<div class="row" ng-if="!(volume.Options | emptyobject)">
+  <div class="col-lg-12 col-md-12 col-xs-12">
+    <rd-widget>
+      <rd-widget-header icon="settings" title-text="Volume options"></rd-widget-header>
+      <rd-widget-body classes="no-padding">
+        <table class="table">
+          <tbody>
+            <tr ng-repeat="(key, value) in volume.Options">
+              <td>{{ key }}</td>
+              <td>{{ value }}</td>
+            </tr>
+          </tbody>
+        </table>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
+<div class="row" ng-if="containersUsingVolume.length > 0">
+  <div class="col-lg-12 col-md-12 col-xs-12">
+    <rd-widget>
+      <rd-widget-header icon="box" title-text="Containers using volume"></rd-widget-header>
+      <rd-widget-body classes="no-padding">
+        <table class="table">
+          <thead>
+            <th>Container Name</th>
+            <th>Mounted At</th>
+            <th>Read-only</th>
+          </thead>
+          <tbody>
+            <tr ng-repeat="container in containersUsingVolume">
+              <td
+                ><a ui-sref="docker.containers.container({ id: container.Id, nodeName: container.NodeName })">{{ container | containername }}</a></td
+              >
+              <td>{{ container.volumeData.Destination }}</td>
+              <td>{{ !container.volumeData.RW }}</td>
+            </tr>
+          </tbody>
+        </table>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
diff --git a/app/docker/views/volumes/edit/volumeController.js b/app/docker/views/volumes/edit/volumeController.js
new file mode 100644
index 0000000..84ced26
--- /dev/null
+++ b/app/docker/views/volumes/edit/volumeController.js
@@ -0,0 +1,74 @@
+import { ResourceControlType } from '@/react/portainer/access-control/types';
+import { confirmDelete } from '@@/modals/confirm';
+
+angular.module('portainer.docker').controller('VolumeController', [
+  '$scope',
+  '$state',
+  '$transition$',
+  'VolumeService',
+  'ContainerService',
+  'Notifications',
+  'HttpRequestHelper',
+  'Authentication',
+  'endpoint',
+  function ($scope, $state, $transition$, VolumeService, ContainerService, Notifications, HttpRequestHelper, Authentication, endpoint) {
+    $scope.resourceType = ResourceControlType.Volume;
+    $scope.endpoint = endpoint;
+    $scope.showBrowseAction = false;
+
+    $scope.onUpdateResourceControlSuccess = function () {
+      $state.reload();
+    };
+
+    $scope.removeVolume = function removeVolume() {
+      confirmDelete('Do you want to remove this volume?').then((confirmed) => {
+        if (confirmed) {
+          VolumeService.remove($scope.volume.Id)
+            .then(function success() {
+              Notifications.success('Volume successfully removed', $transition$.params().id);
+              $state.go('docker.volumes', {});
+            })
+            .catch(function error(err) {
+              Notifications.error('Failure', err, 'Unable to remove volume');
+            });
+        }
+      });
+    };
+
+    function getVolumeDataFromContainer(container, volumeId) {
+      return container.Mounts.find(function (volume) {
+        return volume.Name === volumeId;
+      });
+    }
+
+    function initView() {
+      HttpRequestHelper.setPortainerAgentTargetHeader($transition$.params().nodeName);
+      $scope.showBrowseAction = $scope.applicationState.endpoint.mode.agentProxy && (Authentication.isAdmin() || endpoint.SecuritySettings.allowVolumeBrowserForRegularUsers);
+
+      VolumeService.volume($transition$.params().id)
+        .then(function success(data) {
+          var volume = data;
+          $scope.volume = volume;
+          var containerFilter = { volume: [volume.Id] };
+
+          return ContainerService.containers(endpoint.Id, 1, containerFilter);
+        })
+        .then(function success(data) {
+          var dataContainers = $scope.isCioDriver ? data.containers : data;
+
+          var containers = dataContainers.map(function (container) {
+            container.volumeData = getVolumeDataFromContainer(container, $scope.volume.Id);
+
+            $scope.volume.NodeName = container.NodeName || '';
+            return container;
+          });
+          $scope.containersUsingVolume = containers;
+        })
+        .catch(function error(err) {
+          Notifications.error('Failure', err, 'Unable to retrieve volume details');
+        });
+    }
+
+    initView();
+  },
+]);
diff --git a/app/docker/views/volumes/volumes.html b/app/docker/views/volumes/volumes.html
new file mode 100644
index 0000000..ffa186a
--- /dev/null
+++ b/app/docker/views/volumes/volumes.html
@@ -0,0 +1,3 @@
+<page-header title="'Volume list'" breadcrumbs="['Volumes']" reload="true"> </page-header>
+
+<volumes-datatable dataset="volumes" on-remove="(removeAction)" on-refresh="(getVolumes)" is-browse-visible="showBrowseAction"></volumes-datatable>
diff --git a/app/docker/views/volumes/volumesController.js b/app/docker/views/volumes/volumesController.js
new file mode 100644
index 0000000..b37a012
--- /dev/null
+++ b/app/docker/views/volumes/volumesController.js
@@ -0,0 +1,71 @@
+import { processItemsInBatches } from '@/react/common/processItemsInBatches';
+
+angular.module('portainer.docker').controller('VolumesController', [
+  '$q',
+  '$scope',
+  '$state',
+  'VolumeService',
+  'ServiceService',
+  'VolumeHelper',
+  'Notifications',
+  'Authentication',
+  'endpoint',
+  function ($q, $scope, $state, VolumeService, ServiceService, VolumeHelper, Notifications, Authentication, endpoint) {
+    $scope.removeAction = async function (selectedItems) {
+      async function doRemove(volume) {
+        return VolumeService.remove(volume.Name, volume.NodeName)
+          .then(function success() {
+            Notifications.success('Volume successfully removed', volume.Name);
+            var index = $scope.volumes.indexOf(volume);
+            $scope.volumes.splice(index, 1);
+          })
+          .catch(function error(err) {
+            Notifications.error('Failure', err, 'Unable to remove volume');
+          });
+      }
+
+      await processItemsInBatches(selectedItems, doRemove);
+      $state.reload();
+    };
+
+    $scope.getVolumes = getVolumes;
+    function getVolumes() {
+      var endpointProvider = $scope.applicationState.endpoint.mode.provider;
+      var endpointRole = $scope.applicationState.endpoint.mode.role;
+
+      $q.all({
+        attached: VolumeService.volumes({ dangling: ['false'] }),
+        dangling: VolumeService.volumes({ dangling: ['true'] }),
+        services: endpointProvider === 'DOCKER_SWARM_MODE' && endpointRole === 'MANAGER' ? ServiceService.services() : [],
+      })
+        .then(function success(data) {
+          var services = data.services;
+          $scope.volumes = data.attached
+            .map(function (volume) {
+              volume.dangling = false;
+              return volume;
+            })
+            .concat(
+              data.dangling.map(function (volume) {
+                volume.dangling = true;
+                if (VolumeHelper.isVolumeUsedByAService(volume, services)) {
+                  volume.dangling = false;
+                }
+                return volume;
+              })
+            );
+        })
+        .catch(function error(err) {
+          Notifications.error('Failure', err, 'Unable to retrieve volumes');
+        });
+    }
+
+    function initView() {
+      getVolumes();
+
+      $scope.showBrowseAction = $scope.applicationState.endpoint.mode.agentProxy && (Authentication.isAdmin() || endpoint.SecuritySettings.allowVolumeBrowserForRegularUsers);
+    }
+
+    initView();
+  },
+]);
diff --git a/app/edge/__module.js b/app/edge/__module.js
new file mode 100644
index 0000000..b5666a7
--- /dev/null
+++ b/app/edge/__module.js
@@ -0,0 +1,213 @@
+import angular from 'angular';
+
+import { AccessHeaders } from '@/portainer/authorization-guard';
+import { reactModule } from './react';
+
+angular
+  .module('portainer.edge', [reactModule])
+
+  .config(function config($stateRegistryProvider) {
+    const edge = {
+      name: 'edge',
+      url: '/edge',
+      parent: 'root',
+      abstract: true,
+      data: {
+        access: AccessHeaders.EdgeAdmin,
+      },
+    };
+
+    const groups = {
+      name: 'edge.groups',
+      url: '/groups',
+      views: {
+        'content@': {
+          component: 'edgeGroupsView',
+        },
+      },
+      data: {
+        docs: '/user/edge/groups',
+      },
+    };
+
+    const groupsNew = {
+      name: 'edge.groups.new',
+      url: '/new',
+      views: {
+        'content@': {
+          component: 'edgeGroupsCreateView',
+        },
+      },
+    };
+
+    const groupsEdit = {
+      name: 'edge.groups.edit',
+      url: '/:groupId',
+      views: {
+        'content@': {
+          component: 'edgeGroupsItemView',
+        },
+      },
+    };
+
+    const stacks = {
+      name: 'edge.stacks',
+      url: '/stacks',
+      views: {
+        'content@': {
+          component: 'edgeStacksView',
+        },
+      },
+      data: {
+        docs: '/user/edge/stacks',
+      },
+    };
+
+    const stacksNew = {
+      name: 'edge.stacks.new',
+      url: '/new?templateId&templateType',
+      views: {
+        'content@': {
+          component: 'edgeStacksCreateView',
+        },
+      },
+      data: {
+        docs: '/user/edge/stacks/add',
+      },
+      params: {
+        templateId: { dynamic: true },
+        templateType: { dynamic: true },
+      },
+    };
+
+    const stacksEdit = {
+      name: 'edge.stacks.edit',
+      url: '/:stackId?tab&status',
+      views: {
+        'content@': {
+          component: 'edgeStacksItemView',
+        },
+      },
+      params: {
+        status: {
+          dynamic: true,
+        },
+      },
+    };
+
+    const edgeJobs = {
+      name: 'edge.jobs',
+      url: '/jobs',
+      views: {
+        'content@': {
+          component: 'edgeJobsView',
+        },
+      },
+      data: {
+        docs: '/user/edge/jobs',
+      },
+    };
+
+    const edgeJob = {
+      name: 'edge.jobs.job',
+      url: '/:id?tab',
+      views: {
+        'content@': {
+          component: 'edgeJobsItemView',
+        },
+      },
+    };
+
+    const edgeJobCreation = {
+      name: 'edge.jobs.new',
+      url: '/new',
+      views: {
+        'content@': {
+          component: 'edgeJobsCreateView',
+        },
+      },
+    };
+
+    $stateRegistryProvider.register({
+      name: 'edge.devices',
+      url: '/devices',
+      abstract: true,
+    });
+
+    if (process.env.PORTAINER_EDITION === 'BE') {
+      $stateRegistryProvider.register({
+        name: 'edge.devices.waiting-room',
+        url: '/waiting-room',
+        views: {
+          'content@': {
+            component: 'waitingRoomView',
+          },
+        },
+        data: {
+          docs: '/user/edge/waiting-room',
+        },
+      });
+    }
+
+    $stateRegistryProvider.register({
+      name: 'edge.templates',
+      url: '/templates?template',
+      views: {
+        'content@': {
+          component: 'appTemplatesView',
+        },
+      },
+      data: {
+        docs: '/user/edge/templates/application',
+      },
+    });
+
+    $stateRegistryProvider.register({
+      name: 'edge.templates.custom',
+      url: '/custom',
+      views: {
+        'content@': {
+          component: 'customTemplatesView',
+        },
+      },
+      data: {
+        docs: '/user/edge/templates/custom',
+      },
+    });
+
+    $stateRegistryProvider.register({
+      name: 'edge.templates.custom.new',
+      url: '/new?appTemplateId&type',
+
+      views: {
+        'content@': {
+          component: 'createCustomTemplatesView',
+        },
+      },
+    });
+
+    $stateRegistryProvider.register({
+      name: 'edge.templates.custom.edit',
+      url: '/:id',
+
+      views: {
+        'content@': {
+          component: 'editCustomTemplatesView',
+        },
+      },
+    });
+
+    $stateRegistryProvider.register(edge);
+
+    $stateRegistryProvider.register(groups);
+    $stateRegistryProvider.register(groupsNew);
+    $stateRegistryProvider.register(groupsEdit);
+
+    $stateRegistryProvider.register(stacks);
+    $stateRegistryProvider.register(stacksNew);
+    $stateRegistryProvider.register(stacksEdit);
+
+    $stateRegistryProvider.register(edgeJobs);
+    $stateRegistryProvider.register(edgeJob);
+    $stateRegistryProvider.register(edgeJobCreation);
+  });
diff --git a/app/edge/components/edge-stack-status/edgeStackStatus.css b/app/edge/components/edge-stack-status/edgeStackStatus.css
new file mode 100644
index 0000000..95778ac
--- /dev/null
+++ b/app/edge/components/edge-stack-status/edgeStackStatus.css
@@ -0,0 +1,25 @@
+.status:not(:last-child) {
+  margin-right: 1em;
+}
+
+.status .icon {
+  padding: 0 !important;
+  margin-right: 1ch;
+  border-radius: 50%;
+  background-color: grey;
+  height: 10px;
+  width: 10px;
+  display: inline-block;
+}
+
+.status .error {
+  background-color: #ae2323;
+}
+
+.status .acknowledged {
+  background-color: #337ab7;
+}
+
+.status .ok {
+  background-color: #23ae89;
+}
diff --git a/app/edge/components/edge-stack-status/edgeStackStatus.html b/app/edge/components/edge-stack-status/edgeStackStatus.html
new file mode 100644
index 0000000..02c8a07
--- /dev/null
+++ b/app/edge/components/edge-stack-status/edgeStackStatus.html
@@ -0,0 +1,3 @@
+<span class="status" title="Acknowledged environments"><i class="acknowledged icon"></i>{{ $ctrl.status.acknowledged || 0 }}</span>
+<span class="status" title="Successful environments"><i class="ok icon"></i>{{ $ctrl.status.ok || 0 }}</span>
+<span class="status" title="Failed environments"><i class="error icon"></i>{{ $ctrl.status.error || 0 }}</span>
diff --git a/app/edge/components/edge-stack-status/edgeStackStatusController.js b/app/edge/components/edge-stack-status/edgeStackStatusController.js
new file mode 100644
index 0000000..002af88
--- /dev/null
+++ b/app/edge/components/edge-stack-status/edgeStackStatusController.js
@@ -0,0 +1,20 @@
+const statusMap = {
+  1: 'ok',
+  2: 'error',
+  3: 'acknowledged',
+};
+
+export class EdgeStackStatusController {
+  $onChanges({ stackStatus }) {
+    if (!stackStatus || !stackStatus.currentValue) {
+      return;
+    }
+    const aggregateStatus = { ok: 0, error: 0, acknowledged: 0 };
+    for (let endpointId in stackStatus.currentValue) {
+      const endpoint = stackStatus.currentValue[endpointId];
+      const endpointStatusKey = statusMap[endpoint.Type];
+      aggregateStatus[endpointStatusKey]++;
+    }
+    this.status = aggregateStatus;
+  }
+}
diff --git a/app/edge/components/edge-stack-status/index.js b/app/edge/components/edge-stack-status/index.js
new file mode 100644
index 0000000..11af093
--- /dev/null
+++ b/app/edge/components/edge-stack-status/index.js
@@ -0,0 +1,12 @@
+import angular from 'angular';
+
+import { EdgeStackStatusController } from './edgeStackStatusController';
+import './edgeStackStatus.css';
+
+angular.module('portainer.edge').component('edgeStackStatus', {
+  templateUrl: './edgeStackStatus.html',
+  controller: EdgeStackStatusController,
+  bindings: {
+    stackStatus: '<',
+  },
+});
diff --git a/app/edge/react/components/index.ts b/app/edge/react/components/index.ts
new file mode 100644
index 0000000..1902af6
--- /dev/null
+++ b/app/edge/react/components/index.ts
@@ -0,0 +1,76 @@
+import angular from 'angular';
+
+import { r2a } from '@/react-tools/react2angular';
+import { withReactQuery } from '@/react-tools/withReactQuery';
+import { withUIRouter } from '@/react-tools/withUIRouter';
+import { AssociatedEdgeEnvironmentsSelector } from '@/react/edge/components/AssociatedEdgeEnvironmentsSelector';
+import { EdgeAsyncIntervalsForm } from '@/react/edge/components/EdgeAsyncIntervalsForm';
+import { EdgeCheckinIntervalField } from '@/react/edge/components/EdgeCheckInIntervalField';
+import { EdgeScriptForm } from '@/react/edge/components/EdgeScriptForm';
+import { EdgeGroupsSelector } from '@/react/edge/edge-stacks/components/EdgeGroupsSelector';
+import { AssociatedEdgeGroupEnvironmentsSelector } from '@/react/edge/components/AssociatedEdgeGroupEnvironmentsSelector';
+
+const ngModule = angular
+  .module('portainer.edge.react.components', [])
+
+  .component(
+    'edgeGroupsSelector',
+    r2a(withUIRouter(withReactQuery(EdgeGroupsSelector)), [
+      'onChange',
+      'value',
+      'error',
+      'horizontal',
+      'isGroupVisible',
+      'required',
+    ])
+  )
+  .component(
+    'edgeScriptForm',
+    r2a(withReactQuery(EdgeScriptForm), [
+      'edgeInfo',
+      'commands',
+      'asyncMode',
+      'showMetaFields',
+    ])
+  )
+  .component(
+    'edgeCheckinIntervalField',
+    r2a(withReactQuery(EdgeCheckinIntervalField), [
+      'value',
+      'onChange',
+      'isDefaultHidden',
+      'tooltip',
+      'label',
+      'readonly',
+      'size',
+    ])
+  )
+  .component(
+    'edgeAsyncIntervalsForm',
+    r2a(withReactQuery(EdgeAsyncIntervalsForm), [
+      'values',
+      'onChange',
+      'isDefaultHidden',
+      'readonly',
+      'fieldSettings',
+    ])
+  )
+  .component(
+    'associatedEdgeEnvironmentsSelector',
+    r2a(withReactQuery(AssociatedEdgeEnvironmentsSelector), [
+      'onChange',
+      'value',
+      'error',
+    ])
+  )
+  .component(
+    'associatedEdgeGroupEnvironmentsSelector',
+    r2a(withReactQuery(AssociatedEdgeGroupEnvironmentsSelector), [
+      'onChange',
+      'value',
+      'error',
+      'edgeGroupId',
+    ])
+  );
+
+export const componentsModule = ngModule.name;
diff --git a/app/edge/react/index.ts b/app/edge/react/index.ts
new file mode 100644
index 0000000..802b971
--- /dev/null
+++ b/app/edge/react/index.ts
@@ -0,0 +1,9 @@
+import angular from 'angular';
+
+import { componentsModule } from './components';
+import { viewsModule } from './views';
+
+export const reactModule = angular.module('portainer.edge.react', [
+  viewsModule,
+  componentsModule,
+]).name;
diff --git a/app/edge/react/views/edge-stacks.ts b/app/edge/react/views/edge-stacks.ts
new file mode 100644
index 0000000..41cbeed
--- /dev/null
+++ b/app/edge/react/views/edge-stacks.ts
@@ -0,0 +1,23 @@
+import angular from 'angular';
+
+import { r2a } from '@/react-tools/react2angular';
+import { withCurrentUser } from '@/react-tools/withCurrentUser';
+import { withUIRouter } from '@/react-tools/withUIRouter';
+import { CreateView } from '@/react/edge/edge-stacks/CreateView/CreateView';
+import { ItemView } from '@/react/edge/edge-stacks/ItemView/ItemView';
+import { ListView } from '@/react/edge/edge-stacks/ListView';
+
+export const stacksModule = angular
+  .module('portainer.edge.react.views.stacks', [])
+  .component(
+    'edgeStacksCreateView',
+    r2a(withCurrentUser(withUIRouter(CreateView)), [])
+  )
+  .component(
+    'edgeStacksItemView',
+    r2a(withCurrentUser(withUIRouter(ItemView)), [])
+  )
+  .component(
+    'edgeStacksView',
+    r2a(withUIRouter(withCurrentUser(ListView)), [])
+  ).name;
diff --git a/app/edge/react/views/groups.ts b/app/edge/react/views/groups.ts
new file mode 100644
index 0000000..deb51b0
--- /dev/null
+++ b/app/edge/react/views/groups.ts
@@ -0,0 +1,20 @@
+import angular from 'angular';
+
+import { r2a } from '@/react-tools/react2angular';
+import { withCurrentUser } from '@/react-tools/withCurrentUser';
+import { withUIRouter } from '@/react-tools/withUIRouter';
+import { ListView } from '@/react/edge/edge-groups/ListView';
+import { CreateView } from '@/react/edge/edge-groups/CreateView/CreateView';
+import { ItemView } from '@/react/edge/edge-groups/ItemView/ItemView';
+
+export const groupsModule = angular
+  .module('portainer.edge.react.views.groups', [])
+  .component('edgeGroupsView', r2a(withUIRouter(withCurrentUser(ListView)), []))
+  .component(
+    'edgeGroupsCreateView',
+    r2a(withUIRouter(withCurrentUser(CreateView)), [])
+  )
+  .component(
+    'edgeGroupsItemView',
+    r2a(withUIRouter(withCurrentUser(ItemView)), [])
+  ).name;
diff --git a/app/edge/react/views/index.ts b/app/edge/react/views/index.ts
new file mode 100644
index 0000000..9b35040
--- /dev/null
+++ b/app/edge/react/views/index.ts
@@ -0,0 +1,24 @@
+import angular from 'angular';
+
+import { r2a } from '@/react-tools/react2angular';
+import { withCurrentUser } from '@/react-tools/withCurrentUser';
+import { withReactQuery } from '@/react-tools/withReactQuery';
+import { withUIRouter } from '@/react-tools/withUIRouter';
+import { WaitingRoomView } from '@/react/edge/edge-devices/WaitingRoomView';
+
+import { templatesModule } from './templates';
+import { jobsModule } from './jobs';
+import { stacksModule } from './edge-stacks';
+import { groupsModule } from './groups';
+
+export const viewsModule = angular
+  .module('portainer.edge.react.views', [
+    templatesModule,
+    jobsModule,
+    stacksModule,
+    groupsModule,
+  ])
+  .component(
+    'waitingRoomView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(WaitingRoomView))), [])
+  ).name;
diff --git a/app/edge/react/views/jobs.ts b/app/edge/react/views/jobs.ts
new file mode 100644
index 0000000..1b3aa26
--- /dev/null
+++ b/app/edge/react/views/jobs.ts
@@ -0,0 +1,20 @@
+import angular from 'angular';
+
+import { r2a } from '@/react-tools/react2angular';
+import { withCurrentUser } from '@/react-tools/withCurrentUser';
+import { withUIRouter } from '@/react-tools/withUIRouter';
+import { ListView } from '@/react/edge/edge-jobs/ListView';
+import { CreateView } from '@/react/edge/edge-jobs/CreateView/CreateView';
+import { ItemView } from '@/react/edge/edge-jobs/ItemView/ItemView';
+
+export const jobsModule = angular
+  .module('portainer.edge.react.views.jobs', [])
+  .component('edgeJobsView', r2a(withUIRouter(withCurrentUser(ListView)), []))
+  .component(
+    'edgeJobsItemView',
+    r2a(withUIRouter(withCurrentUser(ItemView)), [])
+  )
+  .component(
+    'edgeJobsCreateView',
+    r2a(withUIRouter(withCurrentUser(CreateView)), [])
+  ).name;
diff --git a/app/edge/react/views/templates.ts b/app/edge/react/views/templates.ts
new file mode 100644
index 0000000..b86345b
--- /dev/null
+++ b/app/edge/react/views/templates.ts
@@ -0,0 +1,6 @@
+import angular from 'angular';
+
+export const templatesModule = angular.module(
+  'portainer.edge.react.views.templates',
+  []
+).name;
diff --git a/app/edge/rest/edge-groups.js b/app/edge/rest/edge-groups.js
new file mode 100644
index 0000000..9c0a6cb
--- /dev/null
+++ b/app/edge/rest/edge-groups.js
@@ -0,0 +1,11 @@
+import angular from 'angular';
+
+angular.module('portainer.edge').factory('EdgeGroups', function EdgeGroupsFactory($resource, API_ENDPOINT_EDGE_GROUPS) {
+  return $resource(
+    API_ENDPOINT_EDGE_GROUPS + '/:id/:action',
+    {},
+    {
+      query: { method: 'GET', isArray: true },
+    }
+  );
+});
diff --git a/app/edge/rest/edge-stacks.js b/app/edge/rest/edge-stacks.js
new file mode 100644
index 0000000..9ae34b4
--- /dev/null
+++ b/app/edge/rest/edge-stacks.js
@@ -0,0 +1,16 @@
+import angular from 'angular';
+
+angular.module('portainer.edge').factory('EdgeStacks', function EdgeStacksFactory($resource, API_ENDPOINT_EDGE_STACKS) {
+  return $resource(
+    API_ENDPOINT_EDGE_STACKS + '/:id/:action',
+    {},
+    {
+      create: { method: 'POST', ignoreLoadingBar: true, params: { id: 'create', action: '@method' } },
+      query: { method: 'GET', isArray: true },
+      get: { method: 'GET', params: { id: '@id' } },
+      update: { method: 'PUT', params: { id: '@id' } },
+      remove: { method: 'DELETE', params: { id: '@id' } },
+      file: { method: 'GET', params: { id: '@id', action: 'file' } },
+    }
+  );
+});
diff --git a/app/edge/services/edge-group.js b/app/edge/services/edge-group.js
new file mode 100644
index 0000000..62f87db
--- /dev/null
+++ b/app/edge/services/edge-group.js
@@ -0,0 +1,11 @@
+import angular from 'angular';
+
+angular.module('portainer.edge').factory('EdgeGroupService', function EdgeGroupServiceFactory(EdgeGroups) {
+  var service = {};
+
+  service.groups = function groups() {
+    return EdgeGroups.query({}).$promise;
+  };
+
+  return service;
+});
diff --git a/app/edge/services/edge-stack.js b/app/edge/services/edge-stack.js
new file mode 100644
index 0000000..8210266
--- /dev/null
+++ b/app/edge/services/edge-stack.js
@@ -0,0 +1,69 @@
+import angular from 'angular';
+
+angular.module('portainer.edge').factory('EdgeStackService', function EdgeStackServiceFactory(EdgeStacks, FileUploadService) {
+  var service = {};
+
+  service.stack = function stack(id) {
+    return EdgeStacks.get({ id }).$promise;
+  };
+
+  service.stacks = function stacks() {
+    return EdgeStacks.query({}).$promise;
+  };
+
+  service.remove = function remove(id) {
+    return EdgeStacks.remove({ id }).$promise;
+  };
+
+  service.stackFile = async function stackFile(id) {
+    try {
+      const { StackFileContent } = await EdgeStacks.file({ id }).$promise;
+      return StackFileContent;
+    } catch (err) {
+      throw { msg: 'Unable to retrieve stack content', err };
+    }
+  };
+
+  service.updateStack = async function updateStack(id, stack) {
+    return EdgeStacks.update({ id }, stack).$promise;
+  };
+
+  service.createStackFromFileContent = async function createStackFromFileContent(payload) {
+    try {
+      return await EdgeStacks.create({}, { method: 'string', ...payload }).$promise;
+    } catch (err) {
+      throw { msg: 'Unable to create the stack', err };
+    }
+  };
+
+  service.createStackFromFileUpload = async function createStackFromFileUpload(payload, file) {
+    try {
+      return await FileUploadService.createEdgeStack(payload, file);
+    } catch (err) {
+      throw { msg: 'Unable to create the stack', err };
+    }
+  };
+
+  service.createStackFromGitRepository = async function createStackFromGitRepository(payload, repositoryOptions) {
+    try {
+      return await EdgeStacks.create(
+        {},
+        {
+          ...payload,
+          method: 'repository',
+          RepositoryURL: repositoryOptions.RepositoryURL,
+          RepositoryReferenceName: repositoryOptions.RepositoryReferenceName,
+          FilePathInRepository: repositoryOptions.FilePathInRepository,
+          RepositoryAuthentication: repositoryOptions.RepositoryAuthentication,
+          RepositoryUsername: repositoryOptions.RepositoryUsername,
+          RepositoryPassword: repositoryOptions.RepositoryPassword,
+          TLSSkipVerify: repositoryOptions.TLSSkipVerify,
+        }
+      ).$promise;
+    } catch (err) {
+      throw { msg: 'Unable to create the stack', err };
+    }
+  };
+
+  return service;
+});
diff --git a/app/global.d.ts b/app/global.d.ts
new file mode 100644
index 0000000..2b1a8c6
--- /dev/null
+++ b/app/global.d.ts
@@ -0,0 +1,88 @@
+declare module '*.jpg' {
+  export default '' as string;
+}
+declare module '*.png' {
+  export default '' as string;
+}
+
+declare module '*.svg' {
+  export default '' as string;
+}
+
+type SvgrComponent = React.StatelessComponent<React.SVGAttributes<SVGElement>>;
+
+declare module '*.svg?c' {
+  const value: SvgrComponent;
+  export default value;
+}
+
+declare module '*.css';
+
+declare module 'axios-progress-bar' {
+  import { AxiosInstance } from 'axios';
+  import { NProgressOptions } from 'nprogress';
+
+  export function loadProgressBar(
+    config?: Partial<NProgressOptions>,
+    instance?: AxiosInstance
+  ): void;
+}
+
+interface HubSpotCreateFormOptions {
+  /** User's portal ID */
+  portalId: string;
+  /** Unique ID of the form you wish to build */
+  formId: string;
+
+  region: string;
+  /**
+   * jQuery style selector specifying an existing element on the page into which the form will be placed once built.
+   *
+   * NOTE: If you're including multiple forms on the page, it is strongly recommended that you include a separate, specific target for each form.
+   */
+  target: string;
+  /**
+   * Callback that executes after form is validated, just before the data is actually sent.
+   * This is for any logic that needs to execute during the submit.
+   * Any changes will not be validated.
+   * Takes the jQuery form object as the argument: onFormSubmit($form).
+   *
+   * Note: Performing a browser redirect in this callback is not recommended and could prevent the form submission
+   */
+  onFormSubmit?: (form: JQuery<HTMLFormElement>) => void;
+  /**
+   * Callback when the data is actually sent.
+   * This allows you to perform an action when the submission is fully complete,
+   * such as displaying a confirmation or thank you message.
+   */
+  onFormSubmitted?: (form: JQuery<HTMLFormElement>) => void;
+  /**
+   * Callback that executes after form is built, placed in the DOM, and validation has been initialized.
+   * This is perfect for any logic that needs to execute when the form is on the page.
+   *
+   * Takes the jQuery form object as the argument: onFormReady($form)
+   */
+  onFormReady?: (form: JQuery<HTMLFormElement>) => void;
+}
+
+interface Window {
+  /**
+   * will be true if portainer is run as a Docker Desktop Extension
+   */
+  ddExtension?: boolean;
+  hbspt?: {
+    forms: {
+      create: (options: HubSpotCreateFormOptions) => void;
+    };
+  };
+}
+
+declare module 'process' {
+  global {
+    namespace NodeJS {
+      interface ProcessEnv {
+        PORTAINER_EDITION: 'BE' | 'CE';
+      }
+    }
+  }
+}
diff --git a/app/i18n.ts b/app/i18n.ts
new file mode 100644
index 0000000..5f00d03
--- /dev/null
+++ b/app/i18n.ts
@@ -0,0 +1,18 @@
+import i18n from 'i18next';
+import { initReactI18next } from 'react-i18next';
+import LanguageDetector from 'i18next-browser-languagedetector';
+import Backend from 'i18next-http-backend';
+
+i18n
+  .use(Backend)
+  .use(LanguageDetector)
+  .use(initReactI18next)
+  .init({
+    debug: true,
+    fallbackLng: 'en',
+    interpolation: {
+      escapeValue: false,
+    },
+  });
+
+export default i18n;
diff --git a/app/index.html b/app/index.html
new file mode 100644
index 0000000..a0d0b66
--- /dev/null
+++ b/app/index.html
@@ -0,0 +1,93 @@
+<!doctype html>
+<html lang="en" ng-app="portainer" ng-strict-di data-edition="<%= process.env.PORTAINER_EDITION %>">
+  <head>
+    <meta charset="utf-8" />
+    <title>Portainer</title>
+    <meta name="description" content="" />
+    <meta name="author" content="<%= author %>" />
+    <meta http-equiv="cache-control" content="no-cache" />
+    <meta http-equiv="expires" content="0" />
+    <meta http-equiv="pragma" content="no-cache" />
+    <meta name="robots" content="noindex" />
+    <base id="base" />
+
+    <!-- HTML5 shim, for IE6-8 support of HTML5 elements -->
+    <!--[if lt IE 9]>
+      <script src="//html5shim.googlecode.com/svn/trunk/html5.js"></script>
+    <![endif]-->
+
+    <!-- Fav and touch icons -->
+    <link rel="apple-touch-icon" sizes="180x180" href="<%=require('./assets/ico/apple-touch-icon.png')%>" />
+    <link rel="icon" type="image/png" sizes="32x32" href="<%=require('./assets/ico/favicon-32x32.png')%>" />
+    <link rel="icon" type="image/png" sizes="16x16" href="<%=require('./assets/ico/favicon-16x16.png')%>" />
+    <link rel="mask-icon" href="<%=require('./assets/ico/safari-pinned-tab.svg')%>" color="#000000" />
+    <link rel="shortcut icon" href="<%=require('./assets/ico/favicon.ico')%>" />
+    <meta name="msapplication-config" content="<%=require('./assets/ico/browserconfig.xml')%>" />
+    <meta name="theme-color" content="#ffffff" />
+  </head>
+
+  <body ng-controller="MainController">
+    <react-query-dev-tools></react-query-dev-tools>
+    <div
+      id="page-wrapper"
+      ng-class="{
+        open: isSidebarOpen() && ['portainer.auth', 'portainer.init.admin', 'kubernetes.kubectlshell'].indexOf($state.current.name) === -1,
+        nopadding: ['portainer.auth', 'portainer.init.admin', 'portainer.logout', 'kubernetes.kubectlshell'].indexOf($state.current.name) > -1 || applicationState.loading,
+      }"
+      ng-cloak
+    >
+      <div id="sideview" ui-view="sidebar" ng-if="!applicationState.loading"></div>
+
+      <div id="content-wrapper">
+        <div class="page-content">
+          <div class="page-wrapper" ng-if="applicationState.loading">
+            <!-- loading box -->
+            <div class="simple-box container">
+              <div class="col-md-6 col-md-offset-3 col-sm-6 col-sm-offset-3">
+                <!-- loading box logo -->
+                <div class="row">
+                  <img ng-if="logo" ng-src="{{ logo }}" class="simple-box-logo" />
+                  <div ng-if="!logo">
+                    <img src="<%=require('./assets/images/logo_alt.svg')%>" class="simple-box-logo hidden th-highcontrast:!block th-dark:!block" alt="Portainer" />
+                    <img src="<%=require('./assets/images/logo_alt_black.svg')%>" class="simple-box-logo block th-highcontrast:hidden th-dark:hidden" alt="Portainer" />
+                  </div>
+                </div>
+                <!-- !loading box logo -->
+                <!-- panel -->
+                <div class="ml-0 mr-0 flex items-center justify-center text-center">
+                  Loading Portainer...
+                  <!-- adding the svg inline means that the settings icon loads in time (vs pr-icon) and with the correct color (vs img) -->
+                  <svg
+                    xmlns="http://www.w3.org/2000/svg"
+                    width="14"
+                    height="14"
+                    viewBox="0 0 24 24"
+                    fill="none"
+                    stroke="currentColor"
+                    stroke-width="2"
+                    stroke-linecap="round"
+                    stroke-linejoin="round"
+                    class="!ml-1 inline animate-spin-slow"
+                  >
+                    <circle cx="12" cy="12" r="3"></circle>
+                    <path
+                      d="M19.4 15a1.65 1.65 0 0 0 .33 1.82l.06.06a2 2 0 0 1 0 2.83 2 2 0 0 1-2.83 0l-.06-.06a1.65 1.65 0 0 0-1.82-.33 1.65 1.65 0 0 0-1 1.51V21a2 2 0 0 1-2 2 2 2 0 0 1-2-2v-.09A1.65 1.65 0 0 0 9 19.4a1.65 1.65 0 0 0-1.82.33l-.06.06a2 2 0 0 1-2.83 0 2 2 0 0 1 0-2.83l.06-.06a1.65 1.65 0 0 0 .33-1.82 1.65 1.65 0 0 0-1.51-1H3a2 2 0 0 1-2-2 2 2 0 0 1 2-2h.09A1.65 1.65 0 0 0 4.6 9a1.65 1.65 0 0 0-.33-1.82l-.06-.06a2 2 0 0 1 0-2.83 2 2 0 0 1 2.83 0l.06.06a1.65 1.65 0 0 0 1.82.33H9a1.65 1.65 0 0 0 1-1.51V3a2 2 0 0 1 2-2 2 2 0 0 1 2 2v.09a1.65 1.65 0 0 0 1 1.51 1.65 1.65 0 0 0 1.82-.33l.06-.06a2 2 0 0 1 2.83 0 2 2 0 0 1 0 2.83l-.06.06a1.65 1.65 0 0 0-.33 1.82V9a1.65 1.65 0 0 0 1.51 1H21a2 2 0 0 1 2 2 2 2 0 0 1-2 2h-.09a1.65 1.65 0 0 0-1.51 1z"
+                    ></path>
+                  </svg>
+                </div>
+                <!-- !panel -->
+              </div>
+            </div>
+            <!-- !loading box -->
+          </div>
+
+          <!-- Main Content -->
+          <div id="view" ui-view="content" ng-if="!applicationState.loading"></div>
+        </div>
+        <!-- End Page Content -->
+      </div>
+      <!-- End Content Wrapper -->
+    </div>
+    <!-- End Page Wrapper -->
+  </body>
+</html>
diff --git a/app/index.js b/app/index.js
new file mode 100644
index 0000000..6b6a5c8
--- /dev/null
+++ b/app/index.js
@@ -0,0 +1,66 @@
+import './assets/css';
+
+import './i18n';
+
+import angular from 'angular';
+import { UI_ROUTER_REACT_HYBRID } from '@uirouter/react-hybrid';
+
+import { Edition } from '@/react/portainer/feature-flags/enums';
+import { init as initFeatureService } from '@/react/portainer/feature-flags/feature-flags.service';
+
+import './agent';
+import { azureModule } from './azure';
+import './docker/__module';
+import './edge/__module';
+import './portainer/__module';
+
+import { onStartupAngular } from './app';
+import { configApp } from './config';
+import { constantsModule } from './ng-constants';
+
+// http://localhost:49000 is a docker extension specific url (see /build/docker-extension/docker-compose.yml)
+if (window.origin == 'http://localhost:49000') {
+  // we are loading the app from a local file as in docker extension
+  document.getElementById('base').href = 'http://localhost:49000/';
+
+  window.ddExtension = true;
+} else {
+  var path = window.location.pathname.replace(/^\/+|\/+$/g, '');
+  var basePath = path ? '/' + path + '/' : '/';
+  document.getElementById('base').href = basePath;
+}
+
+initFeatureService(Edition[process.env.PORTAINER_EDITION]);
+
+angular
+  .module('portainer', [
+    'ui.bootstrap',
+    'ui.router',
+    UI_ROUTER_REACT_HYBRID,
+    'ngSanitize',
+    'ngFileUpload',
+    'ngMessages',
+    'ngResource',
+    'LocalStorageModule',
+    'angular-loading-bar',
+    'angular-clipboard',
+    'ngFileSaver',
+    'luegg.directives',
+    'portainer.app',
+    'portainer.agent',
+    azureModule,
+    'portainer.docker',
+    'portainer.kubernetes',
+    'portainer.edge',
+    'rzModule',
+    constantsModule,
+  ])
+  .run(onStartupAngular)
+  .config(configApp);
+
+if (require) {
+  const req = require.context('./', true, /^(?!.*\.test\.js$).*\.js$/im);
+  req.keys().forEach(function (key) {
+    req(key);
+  });
+}
diff --git a/app/kubernetes/__module.js b/app/kubernetes/__module.js
new file mode 100644
index 0000000..63838f2
--- /dev/null
+++ b/app/kubernetes/__module.js
@@ -0,0 +1,967 @@
+import { EnvironmentStatus } from '@/react/portainer/environments/types';
+
+import { updateAxiosAdapter } from '@/react/portainer/services/axios/axios';
+import { PortainerEndpointTypes } from '@/portainer/models/endpoint/models';
+import { cache } from '@/react/portainer/services/axios/axios';
+import { CACHE_REFRESH_EVENT, CACHE_DURATION } from '../portainer/services/http-request.helper';
+
+import registriesModule from './registries';
+import customTemplateModule from './custom-templates';
+import { reactModule } from './react';
+import './views/kubernetes.css';
+
+// The angular-cache npm package didn't have exclude options, so implement a custom cache
+// with an added check to only cache kubernetes requests
+class ExpirationCache {
+  constructor() {
+    this.store = new Map();
+    this.timeout = CACHE_DURATION;
+  }
+
+  get(key) {
+    return this.store.get(key);
+  }
+
+  put(key, val) {
+    // only cache requests with 'kubernetes' in the url
+    if (key.includes('kubernetes')) {
+      this.store.set(key, val);
+      // remove it once it's expired
+      setTimeout(() => {
+        this.remove(key);
+      }, this.timeout);
+    }
+  }
+
+  remove(key) {
+    this.store.delete(key);
+  }
+
+  removeAll() {
+    this.store = new Map();
+  }
+
+  delete() {
+    // skip because this is standalone, not a part of $cacheFactory
+  }
+}
+
+angular.module('portainer.kubernetes', ['portainer.app', registriesModule, customTemplateModule, reactModule]).config([
+  '$stateRegistryProvider',
+  function ($stateRegistryProvider) {
+    'use strict';
+
+    const kubernetes = {
+      name: 'kubernetes',
+      url: '/kubernetes',
+      parent: 'endpoint',
+      abstract: true,
+
+      onEnter: /* @ngInject */ function onEnter(
+        $async,
+        $state,
+        endpoint,
+        KubernetesHealthService,
+        Notifications,
+        StateManager,
+        $http,
+        Authentication,
+        UserService,
+        EndpointService,
+        EndpointProvider
+      ) {
+        return $async(async () => {
+          // if the user wants to use front end cache for performance, set the angular caching settings
+          const userDetails = Authentication.getUserDetails();
+          const user = await UserService.user(userDetails.ID);
+          updateAxiosAdapter(user.UseCache);
+          if (user.UseCache) {
+            $http.defaults.cache = new ExpirationCache();
+            window.addEventListener(CACHE_REFRESH_EVENT, () => {
+              $http.defaults.cache.removeAll();
+              cache.store.clear();
+            });
+          }
+
+          // EE-5842: do not redirect shell views when the env is removed
+          const nextTransition = $state.transition && $state.transition.to();
+          const nextTransitionName = nextTransition ? nextTransition.name : '';
+          if (nextTransitionName === 'kubernetes.kubectlshell' && !endpoint) {
+            return;
+          }
+
+          const kubeTypes = [
+            PortainerEndpointTypes.KubernetesLocalEnvironment,
+            PortainerEndpointTypes.AgentOnKubernetesEnvironment,
+            PortainerEndpointTypes.EdgeAgentOnKubernetesEnvironment,
+          ];
+
+          if (!kubeTypes.includes(endpoint.Type)) {
+            $state.go('portainer.home');
+            return;
+          }
+
+          try {
+            const status = await checkEndpointStatus(endpoint);
+
+            if (endpoint.Type !== PortainerEndpointTypes.EdgeAgentOnKubernetesEnvironment) {
+              await updateEndpointStatus(endpoint, status);
+            }
+            endpoint.Status = status;
+
+            if (endpoint.Status === EnvironmentStatus.Down) {
+              throw new Error(
+                endpoint.Type === PortainerEndpointTypes.EdgeAgentOnKubernetesEnvironment
+                  ? 'Unable to contact Edge agent, please ensure that the agent is properly running on the remote environment.'
+                  : `The environment named ${endpoint.Name} is unreachable.`
+              );
+            }
+
+            await StateManager.updateEndpointState(endpoint);
+          } catch (e) {
+            let params = {};
+
+            if (endpoint.Type == PortainerEndpointTypes.EdgeAgentOnKubernetesEnvironment) {
+              params = { redirect: true, environmentId: endpoint.Id, environmentName: endpoint.Name, route: 'kubernetes.dashboard' };
+            } else {
+              EndpointProvider.clean();
+              Notifications.error('Failed loading environment', e);
+            }
+            // Prevent redirect to home for shell views when environment is unreachable
+            // Show toast error instead (handled above in Notifications.error)
+            if (nextTransitionName === 'kubernetes.kubectlshell') {
+              return;
+            }
+            $state.go('portainer.home', params, { reload: true, inherit: false });
+            return false;
+          }
+
+          async function checkEndpointStatus(endpoint) {
+            try {
+              await KubernetesHealthService.ping(endpoint.Id);
+              return EnvironmentStatus.Up;
+            } catch (e) {
+              return EnvironmentStatus.Down;
+            }
+          }
+
+          async function updateEndpointStatus(endpoint, status) {
+            if (endpoint.Status === status) {
+              return;
+            }
+            await EndpointService.updateEndpoint(endpoint.Id, { Status: status });
+          }
+        });
+      },
+    };
+
+    const helmApplication = {
+      name: 'kubernetes.helm',
+      url: '/helm/:namespace/:name?revision&tab',
+      views: {
+        'content@': {
+          component: 'kubernetesHelmApplicationView',
+        },
+      },
+      data: {
+        docs: '/user/kubernetes/inspect-helm',
+      },
+    };
+
+    const helmInstall = {
+      name: 'kubernetes.helminstall',
+      url: '/helm?referrer',
+      views: {
+        'content@': {
+          component: 'helmInstallView',
+        },
+      },
+      params: {
+        yaml: '',
+      },
+      data: {
+        docs: '/user/kubernetes/applications/manifest/helm',
+      },
+    };
+
+    const services = {
+      name: 'kubernetes.services',
+      url: '/services',
+      views: {
+        'content@': {
+          component: 'kubernetesServicesView',
+        },
+      },
+      data: {
+        docs: '/user/kubernetes/networking/services',
+      },
+    };
+    const service = {
+      name: 'kubernetes.services.service',
+      url: '/:namespace/:name?tab',
+      views: {
+        'content@': {
+          component: 'kubernetesResourceDetailsYAMLView',
+        },
+      },
+      data: {
+        resourceConfig: {
+          title: 'Service details',
+          breadcrumbLabel: 'Services',
+          breadcrumbLink: 'kubernetes.services',
+          resourceType: 'service',
+          apiVersion: 'v1',
+          resourcePlural: 'services',
+          namespaced: true,
+          yamlIdentifier: 'service-yaml',
+          dataCy: 'service-yaml',
+        },
+      },
+    };
+
+    const ingresses = {
+      name: 'kubernetes.ingresses',
+      url: '/ingresses',
+      views: {
+        'content@': {
+          component: 'kubernetesIngressesView',
+        },
+      },
+      data: {
+        docs: '/user/kubernetes/networking/ingresses',
+      },
+    };
+
+    const ingressesCreate = {
+      name: 'kubernetes.ingresses.create',
+      url: '/add',
+      views: {
+        'content@': {
+          component: 'kubernetesIngressesCreateView',
+        },
+      },
+      data: {
+        docs: '/user/kubernetes/networking/ingresses/add',
+      },
+    };
+
+    const ingressesEdit = {
+      name: 'kubernetes.ingresses.edit',
+      url: '/:namespace/:name/edit',
+      views: {
+        'content@': {
+          component: 'kubernetesIngressesCreateView',
+        },
+      },
+    };
+
+    const applications = {
+      name: 'kubernetes.applications',
+      url: '/applications?tab',
+      views: {
+        'content@': {
+          component: 'kubernetesApplicationsView',
+        },
+      },
+      data: {
+        docs: '/user/kubernetes/applications',
+      },
+    };
+
+    const applicationCreation = {
+      name: 'kubernetes.applications.new',
+      url: '/new',
+      views: {
+        'content@': {
+          component: 'kubernetesCreateApplicationView',
+        },
+      },
+      data: {
+        docs: '/user/kubernetes/applications/add',
+      },
+    };
+
+    const application = {
+      name: 'kubernetes.applications.application',
+      url: '/:namespace/:name?resource-type',
+      params: {
+        openGitSettings: { value: null, dynamic: true },
+      },
+      views: {
+        'content@': {
+          component: 'applicationDetailsView',
+        },
+      },
+      data: {
+        docs: '/user/kubernetes/applications/inspect',
+      },
+    };
+
+    const applicationEdit = {
+      name: 'kubernetes.applications.application.edit',
+      url: '/edit',
+      views: {
+        'content@': {
+          component: 'kubernetesCreateApplicationView',
+        },
+      },
+      data: {
+        docs: '/user/kubernetes/applications/edit',
+      },
+    };
+
+    const applicationConsole = {
+      name: 'kubernetes.applications.application.console',
+      url: '/:pod/:container/console',
+      views: {
+        'content@': {
+          component: 'kubernetesConsoleView',
+        },
+      },
+    };
+
+    const applicationLogs = {
+      name: 'kubernetes.applications.application.logs',
+      url: '/:pod/:container/logs',
+      views: {
+        'content@': {
+          component: 'kubernetesApplicationLogsView',
+        },
+      },
+    };
+
+    const applicationStats = {
+      name: 'kubernetes.applications.application.stats',
+      url: '/:pod/:container/stats',
+      views: {
+        'content@': {
+          component: 'kubernetesApplicationStatsView',
+        },
+      },
+    };
+
+    const stacks = {
+      name: 'kubernetes.stacks',
+      url: '/stacks',
+      abstract: true,
+    };
+
+    const stack = {
+      name: 'kubernetes.stacks.stack',
+      url: '/:namespace/:name',
+      abstract: true,
+    };
+
+    const stackLogs = {
+      name: 'kubernetes.stacks.stack.logs',
+      url: '/logs',
+      views: {
+        'content@': {
+          component: 'kubernetesStackLogsView',
+        },
+      },
+    };
+
+    const configurations = {
+      name: 'kubernetes.configurations',
+      url: '/configurations?tab',
+      views: {
+        'content@': {
+          component: 'kubernetesConfigMapsAndSecretsView',
+        },
+      },
+      params: {
+        tab: null,
+      },
+      data: {
+        docs: '/user/kubernetes/configurations',
+      },
+    };
+    const configmaps = {
+      name: 'kubernetes.configmaps',
+      url: '/configmaps',
+      abstract: true,
+      data: {
+        docs: '/user/kubernetes/configurations',
+      },
+    };
+
+    const configMapCreation = {
+      name: 'kubernetes.configmaps.new',
+      url: '/new',
+      views: {
+        'content@': {
+          component: 'kubernetesCreateConfigMapView',
+        },
+      },
+      data: {
+        docs: '/user/kubernetes/configurations/add-configmap',
+      },
+    };
+
+    const configMap = {
+      name: 'kubernetes.configmaps.configmap',
+      url: '/:namespace/:name',
+      views: {
+        'content@': {
+          component: 'kubernetesConfigMapView',
+        },
+      },
+    };
+
+    const secrets = {
+      name: 'kubernetes.secrets',
+      url: '/secrets',
+      abstract: true,
+      data: {
+        docs: '/user/kubernetes/configurations',
+      },
+    };
+
+    const secretCreation = {
+      name: 'kubernetes.secrets.new',
+      url: '/new',
+      views: {
+        'content@': {
+          component: 'kubernetesCreateSecretView',
+        },
+      },
+      data: {
+        docs: '/user/kubernetes/configurations/add-secret',
+      },
+    };
+
+    const secret = {
+      name: 'kubernetes.secrets.secret',
+      url: '/:namespace/:name?tab',
+      params: {
+        tab: { dynamic: true },
+      },
+      views: {
+        'content@': {
+          component: 'kubernetesSecretView',
+        },
+      },
+    };
+
+    const cluster = {
+      name: 'kubernetes.cluster',
+      url: '/cluster',
+      views: {
+        'content@': {
+          component: 'kubernetesClusterView',
+        },
+      },
+      data: {
+        docs: '/user/kubernetes/cluster/details',
+      },
+    };
+
+    const node = {
+      name: 'kubernetes.cluster.node',
+      url: '/:nodeName?tab',
+      views: {
+        'content@': {
+          component: 'kubernetesNodeViewReact',
+        },
+      },
+    };
+
+    const nodeStats = {
+      name: 'kubernetes.cluster.node.stats',
+      url: '/stats',
+      views: {
+        'content@': {
+          component: 'kubernetesNodeStatsView',
+        },
+      },
+    };
+
+    const kubectlShell = {
+      name: 'kubernetes.kubectlshell',
+      url: '/kubectl-shell',
+      views: {
+        'content@': {
+          component: 'kubectlShellView',
+        },
+        'sidebar@': {},
+      },
+    };
+
+    const dashboard = {
+      name: 'kubernetes.dashboard',
+      url: '/dashboard',
+      views: {
+        'content@': {
+          component: 'kubernetesDashboardView',
+        },
+      },
+      data: {
+        docs: '/user/kubernetes/dashboard',
+      },
+    };
+
+    const deploy = {
+      name: 'kubernetes.deploy',
+      url: '/deploy?templateId&referrer&tab&buildMethod&chartName',
+      views: {
+        'content@': {
+          component: 'kubernetesDeployView',
+        },
+      },
+      data: {
+        docs: '/user/kubernetes/applications/manifest',
+      },
+    };
+
+    const namespaces = {
+      name: 'kubernetes.resourcePools',
+      url: '/namespaces',
+      views: {
+        'content@': {
+          component: 'kubernetesNamespacesView',
+        },
+      },
+      data: {
+        docs: '/user/kubernetes/namespaces',
+      },
+    };
+
+    const namespaceCreation = {
+      name: 'kubernetes.resourcePools.new',
+      url: '/new',
+      views: {
+        'content@': {
+          component: 'kubernetesCreateNamespaceView',
+        },
+      },
+      data: {
+        docs: '/user/kubernetes/namespaces/add',
+      },
+    };
+
+    const namespace = {
+      name: 'kubernetes.resourcePools.resourcePool',
+      url: '/:id?tab',
+      views: {
+        'content@': {
+          component: 'namespaceView',
+        },
+      },
+      data: {
+        docs: '/user/kubernetes/namespaces/manage',
+      },
+    };
+
+    const namespaceAccess = {
+      name: 'kubernetes.resourcePools.resourcePool.access',
+      url: '/access',
+      views: {
+        'content@': {
+          component: 'kubernetesNamespaceAccessView',
+        },
+      },
+      data: {
+        docs: '/user/kubernetes/namespaces/access',
+      },
+    };
+
+    const volumesBase = {
+      name: 'kubernetes.volumes',
+      url: '/volumes',
+      abstract: true,
+    };
+
+    const volumes = {
+      name: 'kubernetes.volumes.index',
+      url: '?tab',
+      views: {
+        'content@': {
+          component: 'kubernetesVolumesView',
+        },
+      },
+      data: {
+        docs: '/user/kubernetes/volumes',
+      },
+      params: {
+        tab: null,
+      },
+    };
+
+    const volume = {
+      name: 'kubernetes.volumes.volume',
+      url: '/:namespace/:name',
+      views: {
+        'content@': {
+          component: 'kubernetesVolumeView',
+        },
+      },
+    };
+
+    const persistentVolume = {
+      name: 'kubernetes.volumes.persistentVolume',
+      url: '/persistent-volumes/:name?tab',
+      views: {
+        'content@': {
+          component: 'kubernetesResourceDetailsYAMLView',
+        },
+      },
+      data: {
+        resourceConfig: {
+          title: 'Persistent Volume details',
+          breadcrumbLabel: 'Volumes',
+          breadcrumbLink: 'kubernetes.volumes.index',
+          breadcrumbTab: 'volumes',
+          resourceType: 'persistentvolume',
+          apiVersion: 'v1',
+          resourcePlural: 'persistentvolumes',
+          namespaced: false,
+          yamlIdentifier: 'persistent-volume-yaml',
+          dataCy: 'persistent-volume-yaml',
+        },
+      },
+    };
+
+    const storageClass = {
+      name: 'kubernetes.volumes.storageClass',
+      url: '/storage-classes/:name?tab',
+      views: {
+        'content@': {
+          component: 'kubernetesResourceDetailsYAMLView',
+        },
+      },
+      data: {
+        resourceConfig: {
+          title: 'Storage Class details',
+          breadcrumbLabel: 'Volumes',
+          breadcrumbLink: 'kubernetes.volumes.index',
+          breadcrumbTab: 'storage',
+          resourceType: 'storageclass',
+          apiVersion: 'storage.k8s.io/v1',
+          resourcePlural: 'storageclasses',
+          namespaced: false,
+          yamlIdentifier: 'storage-class-yaml',
+          dataCy: 'storage-class-yaml',
+        },
+      },
+    };
+
+    const registries = {
+      name: 'kubernetes.registries',
+      url: '/registries',
+      views: {
+        'content@': {
+          component: 'environmentRegistriesView',
+        },
+      },
+      data: {
+        docs: '/user/kubernetes/cluster/registries',
+      },
+    };
+
+    const registriesAccess = {
+      name: 'kubernetes.registries.access',
+      url: '/:id/access',
+      views: {
+        'content@': {
+          component: 'kubernetesRegistryAccessView',
+        },
+      },
+    };
+
+    const endpointKubernetesConfiguration = {
+      name: 'kubernetes.cluster.setup',
+      url: '/configure',
+      views: {
+        'content@': {
+          component: 'kubernetesConfigureView',
+        },
+      },
+      data: {
+        docs: '/user/kubernetes/cluster/setup',
+      },
+    };
+
+    const endpointKubernetesSecurityConstraint = {
+      name: 'kubernetes.cluster.securityConstraint',
+      url: '/securityConstraint',
+      views: {
+        'content@': {
+          templateUrl: '../kubernetes/views/security-constraint/constraint.html',
+          controller: 'KubernetesSecurityConstraintController',
+        },
+      },
+      data: {
+        docs: '/user/kubernetes/cluster/security',
+      },
+    };
+
+    const moreResources = {
+      name: 'kubernetes.moreResources',
+      url: '/moreResources',
+      abstract: true,
+    };
+
+    const jobs = {
+      name: 'kubernetes.moreResources.jobs',
+      url: '/jobs?tab',
+      views: {
+        'content@': {
+          component: 'jobsView',
+        },
+      },
+      data: {
+        docs: '/user/kubernetes/more-resources/jobs',
+      },
+    };
+    const job = {
+      name: 'kubernetes.moreResources.job',
+      url: '/jobs/:namespace/:name?tab',
+      views: {
+        'content@': {
+          component: 'kubernetesResourceDetailsYAMLView',
+        },
+      },
+      data: {
+        resourceConfig: {
+          title: 'Job details',
+          breadcrumbLabel: 'Cron Jobs & Jobs',
+          breadcrumbLink: 'kubernetes.moreResources.jobs',
+          breadcrumbTab: 'jobs',
+          resourceType: 'job',
+          apiVersion: 'batch/v1',
+          resourcePlural: 'jobs',
+          namespaced: true,
+          yamlIdentifier: 'job-yaml',
+          dataCy: 'job-yaml',
+        },
+      },
+    };
+    const cronJob = {
+      name: 'kubernetes.moreResources.cronJob',
+      url: '/cronjobs/:namespace/:name?tab',
+      views: {
+        'content@': {
+          component: 'kubernetesResourceDetailsYAMLView',
+        },
+      },
+      data: {
+        resourceConfig: {
+          title: 'Cron Job details',
+          breadcrumbLabel: 'Cron Jobs & Jobs',
+          breadcrumbLink: 'kubernetes.moreResources.jobs',
+          breadcrumbTab: 'cronJobs',
+          resourceType: 'cronjob',
+          apiVersion: 'batch/v1',
+          resourcePlural: 'cronjobs',
+          namespaced: true,
+          yamlIdentifier: 'cronjob-yaml',
+          dataCy: 'cronjob-yaml',
+        },
+      },
+    };
+
+    const serviceAccounts = {
+      name: 'kubernetes.moreResources.serviceAccounts',
+      url: '/serviceAccounts',
+      views: {
+        'content@': {
+          component: 'serviceAccountsView',
+        },
+      },
+      data: {
+        docs: '/user/kubernetes/more-resources/service-accounts',
+      },
+    };
+
+    const serviceAccount = {
+      name: 'kubernetes.moreResources.serviceAccounts.serviceAccount',
+      url: '/serviceAccounts/:namespace/:name?tab',
+      views: {
+        'content@': {
+          component: 'serviceAccountView',
+        },
+      },
+      data: {
+        docs: '/user/kubernetes/more-resources/service-accounts',
+      },
+    };
+
+    const clusterRoles = {
+      name: 'kubernetes.moreResources.clusterRoles',
+      url: '/clusterRoles?tab',
+      views: {
+        'content@': {
+          component: 'clusterRolesView',
+        },
+      },
+      data: {
+        docs: '/user/kubernetes/more-resources/cluster-roles',
+      },
+    };
+    const clusterRole = {
+      name: 'kubernetes.moreResources.clusterRole',
+      url: '/clusterRoles/:name?tab',
+      views: {
+        'content@': {
+          component: 'kubernetesResourceDetailsYAMLView',
+        },
+      },
+      data: {
+        resourceConfig: {
+          title: 'Cluster Role details',
+          breadcrumbLabel: 'Cluster Roles',
+          breadcrumbLink: 'kubernetes.moreResources.clusterRoles',
+          breadcrumbTab: 'clusterRoles',
+          resourceType: 'clusterrole',
+          apiVersion: 'rbac.authorization.k8s.io/v1',
+          resourcePlural: 'clusterroles',
+          namespaced: false,
+          yamlIdentifier: 'cluster-role-yaml',
+          dataCy: 'cluster-role-yaml',
+        },
+      },
+    };
+    const clusterRoleBinding = {
+      name: 'kubernetes.moreResources.clusterRoleBinding',
+      url: '/clusterRoleBindings/:name?tab',
+      views: {
+        'content@': {
+          component: 'kubernetesResourceDetailsYAMLView',
+        },
+      },
+      data: {
+        resourceConfig: {
+          title: 'Cluster Role Binding details',
+          breadcrumbLabel: 'Cluster Roles',
+          breadcrumbLink: 'kubernetes.moreResources.clusterRoles',
+          breadcrumbTab: 'clusterRoleBindings',
+          resourceType: 'clusterrolebinding',
+          apiVersion: 'rbac.authorization.k8s.io/v1',
+          resourcePlural: 'clusterrolebindings',
+          namespaced: false,
+          yamlIdentifier: 'cluster-role-binding-yaml',
+          dataCy: 'cluster-role-binding-yaml',
+        },
+      },
+    };
+
+    const roles = {
+      name: 'kubernetes.moreResources.roles',
+      url: '/roles?tab',
+      views: {
+        'content@': {
+          component: 'k8sRolesView',
+        },
+      },
+      data: {
+        docs: '/user/kubernetes/more-resources/namespace-roles',
+      },
+    };
+    const role = {
+      name: 'kubernetes.moreResources.role',
+      url: '/roles/:namespace/:name?tab',
+      views: {
+        'content@': {
+          component: 'kubernetesResourceDetailsYAMLView',
+        },
+      },
+      data: {
+        resourceConfig: {
+          title: 'Role details',
+          breadcrumbLabel: 'Roles',
+          breadcrumbLink: 'kubernetes.moreResources.roles',
+          breadcrumbTab: 'roles',
+          resourceType: 'role',
+          apiVersion: 'rbac.authorization.k8s.io/v1',
+          resourcePlural: 'roles',
+          namespaced: true,
+          yamlIdentifier: 'role-yaml',
+          dataCy: 'role-yaml',
+        },
+      },
+    };
+    const roleBinding = {
+      name: 'kubernetes.moreResources.roleBinding',
+      url: '/roleBindings/:namespace/:name?tab',
+      views: {
+        'content@': {
+          component: 'kubernetesResourceDetailsYAMLView',
+        },
+      },
+      data: {
+        resourceConfig: {
+          title: 'Role Binding details',
+          breadcrumbLabel: 'Roles',
+          breadcrumbLink: 'kubernetes.moreResources.roles',
+          breadcrumbTab: 'roleBindings',
+          resourceType: 'rolebinding',
+          apiVersion: 'rbac.authorization.k8s.io/v1',
+          resourcePlural: 'rolebindings',
+          namespaced: true,
+          yamlIdentifier: 'role-binding-yaml',
+          dataCy: 'role-binding-yaml',
+        },
+      },
+    };
+
+    $stateRegistryProvider.register(kubernetes);
+    $stateRegistryProvider.register(helmApplication);
+    $stateRegistryProvider.register(applications);
+    $stateRegistryProvider.register(applicationCreation);
+    $stateRegistryProvider.register(application);
+    $stateRegistryProvider.register(applicationEdit);
+    $stateRegistryProvider.register(applicationConsole);
+    $stateRegistryProvider.register(applicationLogs);
+    $stateRegistryProvider.register(applicationStats);
+    $stateRegistryProvider.register(stacks);
+    $stateRegistryProvider.register(stack);
+    $stateRegistryProvider.register(stackLogs);
+    $stateRegistryProvider.register(configurations);
+    $stateRegistryProvider.register(configmaps);
+    $stateRegistryProvider.register(configMapCreation);
+    $stateRegistryProvider.register(secrets);
+    $stateRegistryProvider.register(secretCreation);
+    $stateRegistryProvider.register(configMap);
+    $stateRegistryProvider.register(secret);
+    $stateRegistryProvider.register(cluster);
+    $stateRegistryProvider.register(dashboard);
+    $stateRegistryProvider.register(deploy);
+    $stateRegistryProvider.register(helmInstall);
+    $stateRegistryProvider.register(node);
+    $stateRegistryProvider.register(nodeStats);
+    $stateRegistryProvider.register(kubectlShell);
+    $stateRegistryProvider.register(namespaces);
+    $stateRegistryProvider.register(namespaceCreation);
+    $stateRegistryProvider.register(namespace);
+    $stateRegistryProvider.register(namespaceAccess);
+    $stateRegistryProvider.register(volumesBase);
+    $stateRegistryProvider.register(volumes);
+    $stateRegistryProvider.register(volume);
+    $stateRegistryProvider.register(persistentVolume);
+    $stateRegistryProvider.register(storageClass);
+    $stateRegistryProvider.register(registries);
+    $stateRegistryProvider.register(registriesAccess);
+    $stateRegistryProvider.register(endpointKubernetesConfiguration);
+    $stateRegistryProvider.register(endpointKubernetesSecurityConstraint);
+
+    $stateRegistryProvider.register(services);
+    $stateRegistryProvider.register(service);
+    $stateRegistryProvider.register(ingresses);
+    $stateRegistryProvider.register(ingressesCreate);
+    $stateRegistryProvider.register(ingressesEdit);
+
+    $stateRegistryProvider.register(moreResources);
+    $stateRegistryProvider.register(jobs);
+    $stateRegistryProvider.register(job);
+    $stateRegistryProvider.register(cronJob);
+    $stateRegistryProvider.register(serviceAccounts);
+    $stateRegistryProvider.register(serviceAccount);
+    $stateRegistryProvider.register(clusterRoles);
+    $stateRegistryProvider.register(clusterRole);
+    $stateRegistryProvider.register(clusterRoleBinding);
+    $stateRegistryProvider.register(roles);
+    $stateRegistryProvider.register(role);
+    $stateRegistryProvider.register(roleBinding);
+  },
+]);
diff --git a/app/kubernetes/components/kubernetes-configuration-data/kubernetesConfigurationData.html b/app/kubernetes/components/kubernetes-configuration-data/kubernetesConfigurationData.html
new file mode 100644
index 0000000..193ce8b
--- /dev/null
+++ b/app/kubernetes/components/kubernetes-configuration-data/kubernetesConfigurationData.html
@@ -0,0 +1,172 @@
+<ng-form name="kubernetesConfigurationDataCreationForm">
+  <div class="col-sm-12 form-section-title" style="margin-top: 10px"> Data </div>
+
+  <div class="form-group" ng-if="$ctrl.isCreation">
+    <div class="col-sm-12">
+      <button type="button" class="btn btn-link btn-sm !ml-0 p-0 hover:no-underline" ng-if="$ctrl.formValues.IsSimple" ng-click="$ctrl.showAdvancedMode()">
+        <pr-icon icon="'list'"></pr-icon> Advanced mode
+      </button>
+      <button type="button" class="btn btn-link btn-sm !ml-0 p-0 hover:no-underline" ng-if="!$ctrl.formValues.IsSimple" ng-click="$ctrl.showSimpleMode()">
+        <pr-icon icon="'edit'"></pr-icon> Simple mode
+      </button>
+    </div>
+    <div class="col-sm-12 small text-muted vertical-center" ng-if="$ctrl.formValues.IsSimple">
+      <pr-icon icon="'info'" mode="'primary'"></pr-icon>
+      Switch to advanced mode to copy and paste multiple key/values
+    </div>
+    <div class="col-sm-12 small text-muted vertical-center" ng-if="!$ctrl.formValues.IsSimple && $ctrl.type === 'configmap'">
+      <pr-icon icon="'info'" mode="'primary'"></pr-icon>
+      Generate a ConfigMap entry per line, use YAML format
+    </div>
+    <div class="col-sm-12 small text-muted vertical-center" ng-if="!$ctrl.formValues.IsSimple && $ctrl.type === 'secret'">
+      <pr-icon icon="'info'" mode="'primary'"></pr-icon>
+      Generate a Secret entry per line, use YAML format
+    </div>
+  </div>
+
+  <div class="form-group" ng-if="$ctrl.formValues.IsSimple">
+    <div class="col-sm-12 vertical-center">
+      <button type="button" class="btn btn-sm btn-default" style="margin-left: 0" ng-click="$ctrl.addEntry()" data-cy="k8sConfigCreate-createEntryButton">
+        <pr-icon class="vertical-center" icon="'plus'"></pr-icon> Create entry
+      </button>
+      <button
+        ng-if="
+          !(($ctrl.isDockerConfig || $ctrl.formValues.Type === $ctrl.KubernetesSecretTypeOptions.TLS.value) && $ctrl.formValues.Kind === $ctrl.KubernetesConfigurationKinds.SECRET)
+        "
+        type="button"
+        class="btn btn-sm btn-default ml-0"
+        ngf-select="$ctrl.addEntryFromFile($file)"
+        data-cy="k8sConfigCreate-createConfigsFromFileButton"
+      >
+        <pr-icon icon="'upload'" class="vertical-center"></pr-icon> Create key/value from file
+      </button>
+      <button
+        ng-if="$ctrl.isDockerConfig && $ctrl.formValues.Kind === $ctrl.KubernetesConfigurationKinds.SECRET"
+        type="button"
+        class="btn btn-sm btn-default ml-0"
+        ngf-select="$ctrl.addEntryFromFile($file)"
+        ngf-accept="'.json'"
+        data-cy="k8sConfigCreate-createConfigsFromFileButton"
+      >
+        <pr-icon icon="'upload'" class="vertical-center"></pr-icon> Upload docker config file
+      </button>
+      <button
+        ng-if="$ctrl.formValues.Type === $ctrl.KubernetesSecretTypeOptions.TLS.value && $ctrl.formValues.Kind === $ctrl.KubernetesConfigurationKinds.SECRET"
+        type="button"
+        class="btn btn-sm btn-default ml-0"
+        ngf-select="$ctrl.addEntryFromFile($file)"
+        data-cy="k8sConfigCreate-createConfigsFromFileButton"
+      >
+        <pr-icon icon="'upload'" class="vertical-center"></pr-icon> Upload TLS key/cert file
+      </button>
+      <portainer-tooltip message="'Maximum upload file size is 1MB'"></portainer-tooltip>
+    </div>
+  </div>
+
+  <div ng-repeat="(index, entry) in $ctrl.formValues.Data" ng-if="$ctrl.formValues.IsSimple">
+    <div class="form-group">
+      <label for="configuration_data_key_{{ index }}" class="col-sm-3 col-lg-2 control-label required text-left"
+        >Key
+        <portainer-tooltip message="'The key must consist of alphanumeric characters, \'-\', \'_\' or \'.\' and be up to 253 characters in length.'"></portainer-tooltip>
+      </label>
+      <div class="col-sm-8 col-lg-9">
+        <input
+          type="text"
+          data-cy="k8sConfigCreate-keyInput"
+          class="form-control"
+          maxlength="253"
+          id="configuration_data_key_{{ index }}"
+          name="configuration_data_key_{{ index }}"
+          ng-model="$ctrl.formValues.Data[index].Key"
+          ng-disabled="entry.Used || $ctrl.isRequiredKey(entry.Key)"
+          required
+          ng-change="$ctrl.onChangeKey(entry)"
+        />
+        <div
+          class="small text-warning mt-1"
+          ng-show="
+            kubernetesConfigurationDataCreationForm['configuration_data_key_' + index].$invalid ||
+            (!entry.Used && $ctrl.state.duplicateKeys[index] !== undefined) ||
+            $ctrl.state.invalidKeys[index]
+          "
+        >
+          <ng-messages for="kubernetesConfigurationDataCreationForm['configuration_data_key_' + index].$error">
+            <p ng-message="required" class="vertical-center"> <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon> This field is required. </p>
+          </ng-messages>
+          <div>
+            <p ng-if="$ctrl.state.duplicateKeys[index] !== undefined" class="vertical-center">
+              <pr-icon icon="'alert-triangle'" mode="'warning'" class="vertical-center"></pr-icon>This key is already defined.
+            </p>
+          </div>
+          <p ng-if="$ctrl.state.invalidKeys[index]" class="vertical-center">
+            <pr-icon icon="'alert-triangle'" mode="'warning'" class="vertical-center"></pr-icon> This key is invalid. A valid key must consist of alphanumeric characters, '-', '_'
+            or '.'
+          </p>
+        </div>
+      </div>
+      <div class="col-sm-3 col-lg-2"></div>
+    </div>
+
+    <div class="form-group" ng-if="$ctrl.formValues.IsSimple && !entry.IsBinary">
+      <label for="configuration_data_value_{{ index }}" class="col-sm-3 col-lg-2 control-label required text-left">Value</label>
+      <div class="col-sm-8 col-lg-9">
+        <textarea
+          class="form-control"
+          data-cy="k8sConfigCreate-configurationDataValue"
+          rows="5"
+          id="configuration_data_value_{{ index }}"
+          name="configuration_data_value_{{ index }}"
+          ng-model="$ctrl.formValues.Data[index].Value"
+          ng-trim="false"
+          required
+        ></textarea>
+        <div class="small text-warning" style="margin-top: 5px" ng-show="kubernetesConfigurationDataCreationForm['configuration_data_value_' + index].$invalid">
+          <ng-messages for="kubernetesConfigurationDataCreationForm['configuration_data_value_' + index].$error">
+            <p ng-message="required" class="vertical-center"><pr-icon class="vertical-center" icon="'alert-triangle'" mode="'warning'"></pr-icon> This field is required.</p>
+          </ng-messages>
+        </div>
+      </div>
+    </div>
+
+    <div class="form-group" ng-if="$ctrl.formValues.IsSimple && entry.IsBinary">
+      <label for="configuration_data_value_{{ index }}" class="col-sm-3 col-lg-2 control-label required text-left">Value</label>
+      <div class="col-sm-8 control-label small text-muted text-left"
+        >Binary data <portainer-tooltip message="'This key holds binary data and cannot be displayed.'"></portainer-tooltip
+      ></div>
+    </div>
+
+    <div class="form-group" ng-if="$ctrl.formValues.IsSimple">
+      <div class="col-sm-3 col-lg-2"></div>
+      <div class="col-sm-8">
+        <button
+          ng-if="!$ctrl.isRequiredKey(entry.Key) || $ctrl.state.duplicateKeys[index] !== undefined"
+          type="button"
+          class="btn btn-sm btn-dangerlight !ml-0"
+          style="margin-left: 0"
+          ng-disabled="entry.Used || $ctrl.isEntryRequired()"
+          ng-click="$ctrl.removeEntry(index, entry)"
+          data-cy="k8sConfigDetail-removeEntryButton{{ index }}"
+        >
+          <pr-icon class="vertical-center" icon="'trash-2'"></pr-icon> Remove entry
+        </button>
+        <span class="small text-muted" ng-if="entry.Used">
+          <pr-icon icon="'info'" mode="'primary'"></pr-icon>
+          This key is currently used by one or more applications
+        </span>
+      </div>
+    </div>
+  </div>
+
+  <div class="form-group !px-[15px]" ng-if="!$ctrl.formValues.IsSimple">
+    <input type="text" ng-model="$ctrl.formValues.DataYaml" required style="display: none" data-cy="k8sConfigCreate-configurationDataYaml" />
+
+    <web-editor-form
+      identifier="kubernetes-configuration-editor"
+      value="$ctrl.formValues.DataYaml"
+      on-change="($ctrl.editorUpdate)"
+      yml="true"
+      text-tip="Define or paste key-value pairs, one pair per line"
+    >
+    </web-editor-form>
+  </div>
+</ng-form>
diff --git a/app/kubernetes/components/kubernetes-configuration-data/kubernetesConfigurationData.js b/app/kubernetes/components/kubernetes-configuration-data/kubernetesConfigurationData.js
new file mode 100644
index 0000000..8c9289f
--- /dev/null
+++ b/app/kubernetes/components/kubernetes-configuration-data/kubernetesConfigurationData.js
@@ -0,0 +1,13 @@
+angular.module('portainer.kubernetes').component('kubernetesConfigurationData', {
+  templateUrl: './kubernetesConfigurationData.html',
+  controller: 'KubernetesConfigurationDataController',
+  bindings: {
+    formValues: '=',
+    isDockerConfig: '=',
+    onChangeValidation: '&',
+    isValid: '=',
+    isCreation: '=',
+    isEditorDirty: '=',
+    type: '<',
+  },
+});
diff --git a/app/kubernetes/components/kubernetes-configuration-data/kubernetesConfigurationDataController.js b/app/kubernetes/components/kubernetes-configuration-data/kubernetesConfigurationDataController.js
new file mode 100644
index 0000000..5203766
--- /dev/null
+++ b/app/kubernetes/components/kubernetes-configuration-data/kubernetesConfigurationDataController.js
@@ -0,0 +1,243 @@
+import { Buffer } from 'buffer';
+import angular from 'angular';
+import _ from 'lodash-es';
+import chardet from 'chardet';
+import { Base64 } from 'js-base64';
+import KubernetesFormValidationHelper from '@/kubernetes/helpers/formValidationHelper';
+import KubernetesConfigurationHelper from '@/kubernetes/helpers/configurationHelper';
+import { KubernetesConfigurationFormValuesEntry } from '@/kubernetes/models/configuration/formvalues';
+import { KubernetesConfigurationKinds, KubernetesSecretTypeOptions } from '@/kubernetes/models/configuration/models';
+
+class KubernetesConfigurationDataController {
+  /* @ngInject */
+  constructor($async, Notifications) {
+    Object.assign(this, { $async, Notifications });
+
+    this.editorUpdate = this.editorUpdate.bind(this);
+    this.editorUpdateAsync = this.editorUpdateAsync.bind(this);
+    this.onFileLoad = this.onFileLoad.bind(this);
+    this.onFileLoadAsync = this.onFileLoadAsync.bind(this);
+    this.showSimpleMode = this.showSimpleMode.bind(this);
+    this.showAdvancedMode = this.showAdvancedMode.bind(this);
+    this.KubernetesConfigurationKinds = KubernetesConfigurationKinds;
+    this.KubernetesSecretTypeOptions = KubernetesSecretTypeOptions;
+  }
+
+  onChangeKey(entry) {
+    if (entry && entry.Used) {
+      return;
+    }
+
+    this.onChangeValidation();
+
+    this.state.duplicateKeys = KubernetesFormValidationHelper.getDuplicates(_.map(this.formValues.Data, (data) => data.Key));
+    this.state.invalidKeys = KubernetesFormValidationHelper.getInvalidKeys(_.map(this.formValues.Data, (data) => data.Key));
+    this.isValid = Object.keys(this.state.duplicateKeys).length === 0 && Object.keys(this.state.invalidKeys).length === 0;
+  }
+
+  addEntry() {
+    this.formValues.Data.push(new KubernetesConfigurationFormValuesEntry());
+
+    // logic for setting required keys for new entries, based on the secret type
+    if (this.formValues.Kind === this.KubernetesConfigurationKinds.SECRET) {
+      const newDataIndex = this.formValues.Data.length - 1;
+      switch (this.formValues.Type) {
+        case this.KubernetesSecretTypeOptions.DOCKERCFG.value:
+          this.addMissingKeys(['dockercfg'], newDataIndex);
+          break;
+        case this.KubernetesSecretTypeOptions.DOCKERCONFIGJSON.value:
+          this.addMissingKeys(['.dockerconfigjson'], newDataIndex);
+          break;
+        case this.KubernetesSecretTypeOptions.BASICAUTH.value:
+          // only add a required key if there is no required key out of username and password
+          if (!this.formValues.Data.some((entry) => entry.Key === 'username' || entry.Key === 'password')) {
+            this.addMissingKeys(['username', 'password'], newDataIndex);
+          }
+          break;
+        case this.KubernetesSecretTypeOptions.SSHAUTH.value:
+          this.addMissingKeys(['ssh-privatekey'], newDataIndex);
+          break;
+        case this.KubernetesSecretTypeOptions.TLS.value:
+          this.addMissingKeys(['tls.crt', 'tls.key'], newDataIndex);
+          break;
+        case this.KubernetesSecretTypeOptions.BOOTSTRAPTOKEN.value:
+          this.addMissingKeys(['token-id', 'token-secret'], newDataIndex);
+          break;
+        default:
+          break;
+      }
+    }
+
+    this.onChangeValidation();
+  }
+
+  // addMissingKeys adds the keys in the keys array to the entry at the index provided and stops when the first one is added
+  addMissingKeys(keys, newDataIndex) {
+    for (let key of keys) {
+      if (this.formValues.Data.every((entry) => entry.Key !== key)) {
+        this.formValues.Data[newDataIndex].Key = key;
+        return;
+      }
+    }
+  }
+
+  isRequiredKey(key) {
+    if (this.formValues.Kind === this.KubernetesConfigurationKinds.SECRET) {
+      switch (this.formValues.Type) {
+        case this.KubernetesSecretTypeOptions.DOCKERCONFIGJSON.value:
+          if (key === '.dockerconfigjson') {
+            return true;
+          }
+          break;
+        case this.KubernetesSecretTypeOptions.DOCKERCFG.value:
+          if (key === '.dockercfg') {
+            return true;
+          }
+          break;
+        case this.KubernetesSecretTypeOptions.SSHAUTH.value:
+          if (key === 'ssh-privatekey') {
+            return true;
+          }
+          break;
+        case this.KubernetesSecretTypeOptions.TLS.value:
+          if (key === 'tls.crt' || key === 'tls.key') {
+            return true;
+          }
+          break;
+        case this.KubernetesSecretTypeOptions.BOOTSTRAPTOKEN.value:
+          if (key === 'token-id' || key === 'token-secret') {
+            return true;
+          }
+          break;
+        default:
+          break;
+      }
+    }
+    return false;
+  }
+
+  removeEntry(index, entry) {
+    if (entry.Used) {
+      return;
+    }
+
+    this.formValues.Data.splice(index, 1);
+    this.onChangeKey();
+  }
+
+  async editorUpdateAsync(value) {
+    if (this.formValues.DataYaml !== value) {
+      this.formValues.DataYaml = value;
+      this.isEditorDirty = true;
+    }
+  }
+
+  editorUpdate(value) {
+    return this.$async(this.editorUpdateAsync, value);
+  }
+
+  async onFileLoadAsync(event) {
+    // exit if the file is too big
+    const maximumFileSizeBytes = 1024 * 1024; // 1MB
+    if (event.target.result.byteLength > maximumFileSizeBytes) {
+      this.Notifications.error('File size is too big', 'File size is too big', 'Select a file that is 1MB or smaller.');
+      return;
+    }
+
+    const entry = new KubernetesConfigurationFormValuesEntry();
+    try {
+      const encoding = chardet.detect(Buffer.from(event.target.result));
+      const decoder = new TextDecoder(encoding);
+
+      entry.IsBinary = KubernetesConfigurationHelper.isBinary(encoding);
+
+      if (!entry.IsBinary) {
+        entry.Value = decoder.decode(event.target.result);
+      } else {
+        const stringValue = decoder.decode(event.target.result);
+        entry.Value = Base64.encode(stringValue);
+      }
+    } catch (error) {
+      this.Notifications.error('Failed to upload file', error, 'Failed to upload file');
+      return;
+    }
+
+    entry.Key = event.target.fileName;
+
+    if (this.formValues.Kind === this.KubernetesConfigurationKinds.SECRET) {
+      if (this.isDockerConfig) {
+        if (this.formValues.Type === this.KubernetesSecretTypeOptions.DOCKERCFG.value) {
+          entry.Key = '.dockercfg';
+        } else {
+          entry.Key = '.dockerconfigjson';
+        }
+      }
+
+      if (this.formValues.Type === this.KubernetesSecretTypeOptions.TLS.value) {
+        const isCrt = entry.Value.indexOf('BEGIN CERTIFICATE') !== -1;
+        if (isCrt) {
+          entry.Key = 'tls.crt';
+        }
+        const isKey = entry.Value.indexOf('PRIVATE KEY') !== -1;
+        if (isKey) {
+          entry.Key = 'tls.key';
+        }
+      }
+    }
+
+    // if this.formValues.Data has a key that matches an existing key, then replace it
+    const existingEntryIndex = this.formValues.Data.findIndex((data) => data.Key === entry.Key || (data.Value === '' && data.Key === ''));
+    if (existingEntryIndex !== -1) {
+      this.formValues.Data[existingEntryIndex] = entry;
+    } else {
+      this.formValues.Data.push(entry);
+    }
+
+    this.onChangeKey();
+  }
+
+  isEntryRequired() {
+    if (this.formValues.Kind === this.KubernetesConfigurationKinds.SECRET) {
+      if (this.formValues.Data.length === 1) {
+        if (this.formValues.Type !== this.KubernetesSecretTypeOptions.SERVICEACCOUNTTOKEN.value) {
+          return true;
+        }
+      }
+    }
+    return false;
+  }
+
+  onFileLoad(event) {
+    return this.$async(this.onFileLoadAsync, event);
+  }
+
+  addEntryFromFile(file) {
+    if (file) {
+      const temporaryFileReader = new FileReader();
+      temporaryFileReader.fileName = file.name;
+      temporaryFileReader.onload = this.onFileLoad;
+      temporaryFileReader.readAsArrayBuffer(file);
+    }
+  }
+
+  showSimpleMode() {
+    this.formValues.IsSimple = true;
+    this.formValues.Data = KubernetesConfigurationHelper.parseYaml(this.formValues);
+    this.onChangeKey();
+  }
+
+  showAdvancedMode() {
+    this.formValues.IsSimple = false;
+    this.formValues.DataYaml = KubernetesConfigurationHelper.parseData(this.formValues);
+  }
+
+  $onInit() {
+    this.state = {
+      duplicateKeys: [],
+      invalidKeys: {},
+    };
+  }
+}
+
+export default KubernetesConfigurationDataController;
+angular.module('portainer.kubernetes').controller('KubernetesConfigurationDataController', KubernetesConfigurationDataController);
diff --git a/app/kubernetes/components/resource-reservation/resourceReservation.html b/app/kubernetes/components/resource-reservation/resourceReservation.html
new file mode 100644
index 0000000..013ca27
--- /dev/null
+++ b/app/kubernetes/components/resource-reservation/resourceReservation.html
@@ -0,0 +1,37 @@
+<div class="row">
+  <div class="col-sm-12 form-section-title"> Resource reservation </div>
+  <div class="form-group">
+    <span class="col-sm-12 text-muted small vertical-center">
+      <pr-icon icon="'info'" mode="'primary'"></pr-icon>
+      {{ $ctrl.description }}
+    </span>
+  </div>
+  <div class="form-group" ng-if="$ctrl.memoryLimit !== 0">
+    <label for="memory-reservation" class="col-sm-3 col-lg-2 control-label text-left"> Memory reservation </label>
+    <div class="col-sm-9" style="margin-top: 4px" data-cy="k8sNamespaceDetail-memoryUsage">
+      <uib-progressbar animate="false" value="$ctrl.memoryReservationPercent" type="{{ $ctrl.memoryReservationPercent | kubernetesUsageLevelInfo }}"></uib-progressbar>
+      <span> {{ $ctrl.memoryReservation }} / {{ $ctrl.memoryLimit }} MB - {{ $ctrl.memoryReservationPercent }}% </span>
+    </div>
+  </div>
+  <div class="form-group" ng-if="$ctrl.displayUsage && $ctrl.memoryLimit !== 0">
+    <label for="memory-usage" class="col-sm-3 col-lg-2 control-label text-left"> Memory used </label>
+    <div class="col-sm-9" style="margin-top: 4px">
+      <uib-progressbar animate="false" value="$ctrl.memoryUsagePercent" type="{{ $ctrl.memoryUsagePercent | kubernetesUsageLevelInfo }}"></uib-progressbar>
+      <span> {{ $ctrl.memoryUsage }} / {{ $ctrl.memoryLimit }} MB - {{ $ctrl.memoryUsagePercent }}% </span>
+    </div>
+  </div>
+  <div class="form-group" ng-if="$ctrl.cpuLimit !== 0">
+    <label for="cpu-reservation" class="col-sm-3 col-lg-2 control-label text-left"> CPU reservation </label>
+    <div class="col-sm-9" style="margin-top: 4px">
+      <uib-progressbar animate="false" value="$ctrl.cpuReservationPercent" type="{{ $ctrl.cpuReservationPercent | kubernetesUsageLevelInfo }}"></uib-progressbar>
+      <span> {{ $ctrl.cpuReservation | kubernetesApplicationCPUValue }} / {{ $ctrl.cpuLimit }} - {{ $ctrl.cpuReservationPercent }}% </span>
+    </div>
+  </div>
+  <div class="form-group" ng-if="$ctrl.displayUsage && $ctrl.cpuLimit !== 0">
+    <label for="cpu-usage" class="col-sm-3 col-lg-2 control-label text-left"> CPU used </label>
+    <div class="col-sm-9" style="margin-top: 4px">
+      <uib-progressbar animate="false" value="$ctrl.cpuUsagePercent" type="{{ $ctrl.cpuUsagePercent | kubernetesUsageLevelInfo }}"></uib-progressbar>
+      <span> {{ $ctrl.cpuUsage | kubernetesApplicationCPUValue }} / {{ $ctrl.cpuLimit }} - {{ $ctrl.cpuUsagePercent }}% </span>
+    </div>
+  </div>
+</div>
diff --git a/app/kubernetes/components/resource-reservation/resourceReservation.js b/app/kubernetes/components/resource-reservation/resourceReservation.js
new file mode 100644
index 0000000..d104fda
--- /dev/null
+++ b/app/kubernetes/components/resource-reservation/resourceReservation.js
@@ -0,0 +1,14 @@
+angular.module('portainer.kubernetes').component('kubernetesResourceReservation', {
+  templateUrl: './resourceReservation.html',
+  controller: 'KubernetesResourceReservationController',
+  bindings: {
+    description: '@',
+    cpuReservation: '<',
+    cpuUsage: '<',
+    cpuLimit: '<',
+    memoryReservation: '<',
+    memoryUsage: '<',
+    memoryLimit: '<',
+    displayUsage: '<',
+  },
+});
diff --git a/app/kubernetes/components/view-loading/viewLoading.html b/app/kubernetes/components/view-loading/viewLoading.html
new file mode 100644
index 0000000..edf23b8
--- /dev/null
+++ b/app/kubernetes/components/view-loading/viewLoading.html
@@ -0,0 +1,8 @@
+<div class="loading-view-area" ng-if="!$ctrl.viewReady">
+  <div class="sk-fold sk-center">
+    <div class="sk-fold-cube"></div>
+    <div class="sk-fold-cube"></div>
+    <div class="sk-fold-cube"></div>
+    <div class="sk-fold-cube"></div>
+  </div>
+</div>
diff --git a/app/kubernetes/components/view-loading/viewLoading.js b/app/kubernetes/components/view-loading/viewLoading.js
new file mode 100644
index 0000000..0c4724b
--- /dev/null
+++ b/app/kubernetes/components/view-loading/viewLoading.js
@@ -0,0 +1,6 @@
+angular.module('portainer.kubernetes').component('kubernetesViewLoading', {
+  templateUrl: './viewLoading.html',
+  bindings: {
+    viewReady: '<',
+  },
+});
diff --git a/app/kubernetes/converters/application.js b/app/kubernetes/converters/application.js
new file mode 100644
index 0000000..fb25417
--- /dev/null
+++ b/app/kubernetes/converters/application.js
@@ -0,0 +1,380 @@
+import _ from 'lodash-es';
+import filesizeParser from 'filesize-parser';
+
+import { KubernetesApplicationDataAccessPolicies, KubernetesApplicationDeploymentTypes, KubernetesApplicationTypes } from '@/kubernetes/models/application/models/appConstants';
+import {
+  KubernetesApplication,
+  KubernetesApplicationConfigurationVolume,
+  KubernetesApplicationPersistedFolder,
+  KubernetesApplicationPort,
+  KubernetesPortainerApplicationNameLabel,
+  KubernetesPortainerApplicationNote,
+  KubernetesPortainerApplicationOwnerLabel,
+  KubernetesPortainerApplicationStackNameLabel,
+  KubernetesPortainerApplicationStackIdLabel,
+  KubernetesPortainerApplicationKindLabel,
+} from '@/kubernetes/models/application/models';
+import { KubernetesServiceTypes } from '@/kubernetes/models/service/models';
+import KubernetesResourceReservationHelper from '@/kubernetes/helpers/resourceReservationHelper';
+import { KubernetesApplicationFormValues } from '@/kubernetes/models/application/formValues';
+import KubernetesApplicationHelper from '@/kubernetes/helpers/application';
+import KubernetesDeploymentConverter from '@/kubernetes/converters/deployment';
+import KubernetesDaemonSetConverter from '@/kubernetes/converters/daemonSet';
+import KubernetesStatefulSetConverter from '@/kubernetes/converters/statefulSet';
+import KubernetesPodConverter from '@/kubernetes/pod/converter';
+import KubernetesServiceConverter from '@/kubernetes/converters/service';
+import KubernetesPersistentVolumeClaimConverter from '@/kubernetes/converters/persistentVolumeClaim';
+import PortainerError from '@/portainer/error';
+import { KubernetesIngressHelper } from '@/kubernetes/ingress/helper';
+import KubernetesCommonHelper from '@/kubernetes/helpers/commonHelper';
+import { KubernetesConfigurationKinds } from '@/kubernetes/models/configuration/models';
+import { parseCPU } from '@/react/kubernetes/utils';
+
+function _apiPortsToPublishedPorts(pList, pRefs) {
+  const ports = _.map(pList, (item) => {
+    const res = new KubernetesApplicationPort();
+    res.Port = item.port;
+    res.TargetPort = item.targetPort;
+    res.NodePort = item.nodePort;
+    res.Protocol = item.protocol;
+    return res;
+  });
+  _.forEach(ports, (port) => {
+    if (isNaN(port.TargetPort)) {
+      const targetPort = _.find(pRefs, { name: port.TargetPort });
+      if (targetPort) {
+        port.TargetPort = targetPort.containerPort;
+      }
+    }
+  });
+  return ports;
+}
+
+class KubernetesApplicationConverter {
+  static applicationCommon(res, data, pods, service, ingresses) {
+    const containers = data.spec.template ? _.without(_.concat(data.spec.template.spec.containers, data.spec.template.spec.initContainers), undefined) : data.spec.containers;
+    res.Id = data.metadata.uid;
+    res.Name = data.metadata.name;
+    res.Metadata = data.metadata;
+    res.ApplicationType = data.kind;
+    res.Labels = data.metadata.labels || {};
+
+    if (data.metadata.labels) {
+      const { labels } = data.metadata;
+      res.StackId = labels[KubernetesPortainerApplicationStackIdLabel] ? parseInt(labels[KubernetesPortainerApplicationStackIdLabel], 10) : null;
+      res.StackName = labels[KubernetesPortainerApplicationStackNameLabel] || '';
+      res.ApplicationKind = labels[KubernetesPortainerApplicationKindLabel] || '';
+      res.ApplicationOwner = labels[KubernetesPortainerApplicationOwnerLabel] || '';
+      res.ApplicationName = labels[KubernetesPortainerApplicationNameLabel] || res.Name;
+    }
+
+    res.Note = data.metadata.annotations ? data.metadata.annotations[KubernetesPortainerApplicationNote] || '' : '';
+    res.ResourcePool = data.metadata.namespace;
+    if (containers.length) {
+      res.Image = containers[0].image;
+    }
+    if (data.spec.template && data.spec.template.spec && data.spec.template.spec.imagePullSecrets && data.spec.template.spec.imagePullSecrets.length) {
+      res.RegistryId = parseInt(data.spec.template.spec.imagePullSecrets[0].name.replace('registry-', ''), 10);
+    }
+    res.CreationDate = data.metadata.creationTimestamp;
+    res.Env = _.without(_.flatMap(_.map(containers, 'env')), undefined);
+    res.Pods = data.spec.selector ? KubernetesApplicationHelper.associatePodsAndApplication(pods, data.spec.selector) : [data];
+
+    const limits = {
+      Cpu: 0,
+      Memory: 0,
+    };
+    res.Limits = _.reduce(
+      containers,
+      (acc, item) => {
+        if (item.resources.limits && item.resources.limits.cpu) {
+          acc.Cpu += parseCPU(item.resources.limits.cpu);
+        }
+        if (item.resources.limits && item.resources.limits.memory) {
+          acc.Memory += filesizeParser(item.resources.limits.memory, { base: 10 });
+        }
+        return acc;
+      },
+      limits
+    );
+
+    const requests = {
+      Cpu: 0,
+      Memory: 0,
+    };
+    res.Requests = _.reduce(
+      containers,
+      (acc, item) => {
+        if (item.resources.requests && item.resources.requests.cpu) {
+          acc.Cpu += parseCPU(item.resources.requests.cpu);
+        }
+        if (item.resources.requests && item.resources.requests.memory) {
+          acc.Memory += filesizeParser(item.resources.requests.memory, { base: 10 });
+        }
+        return acc;
+      },
+      requests
+    );
+
+    if (service) {
+      const serviceType = service.spec.type;
+      res.ServiceType = serviceType;
+      res.ServiceId = service.metadata.uid;
+      res.ServiceName = service.metadata.name;
+      res.ClusterIp = service.spec.clusterIP;
+      res.ExternalIp = service.spec.externalIP;
+
+      if (serviceType === KubernetesServiceTypes.LOAD_BALANCER) {
+        if (service.status.loadBalancer.ingress && service.status.loadBalancer.ingress.length > 0) {
+          res.LoadBalancerIPAddress = service.status.loadBalancer.ingress[0].ip || service.status.loadBalancer.ingress[0].hostname;
+        }
+      }
+
+      const portsRefs = _.concat(..._.map(containers, (container) => container.ports));
+      const ports = _apiPortsToPublishedPorts(service.spec.ports, portsRefs);
+      const rules = KubernetesIngressHelper.findSBoundServiceIngressesRules(ingresses, service.metadata.name);
+      _.forEach(ports, (port) => (port.IngressRules = _.filter(rules, (rule) => rule.Port === port.Port)));
+      res.PublishedPorts = ports;
+    }
+
+    if (data.spec.template) {
+      res.Volumes = data.spec.template.spec.volumes ? data.spec.template.spec.volumes : [];
+    } else {
+      res.Volumes = data.spec.volumes;
+    }
+
+    // TODO: review
+    // this if() fixs direct use of PVC reference inside spec.template.spec.containers[0].volumeMounts
+    // instead of referencing the PVC the "good way" using spec.template.spec.volumes array
+    // Basically it creates an "in-memory" reference for the PVC, as if it was saved in
+    // spec.template.spec.volumes and retrieved from here.
+    //
+    // FIX FOR SFS ONLY ; as far as we know it's not possible to do this with DEPLOYMENTS/DAEMONSETS
+    //
+    // This may lead to destructing behaviours when we will allow external apps to be edited.
+    // E.G. if we try to generate the formValues and patch the app, SFS reference will be created under
+    // spec.template.spec.volumes and not be referenced directly inside spec.template.spec.containers[0].volumeMounts
+    // As we preserve original SFS name and try to build around it, it SHOULD be fine, but we definitely need to test this
+    // before allowing external apps modification
+    if (data.spec.volumeClaimTemplates) {
+      const vcTemplates = _.map(data.spec.volumeClaimTemplates, (vc) => {
+        return {
+          name: vc.metadata.name,
+          persistentVolumeClaim: { claimName: vc.metadata.name },
+        };
+      });
+      const inexistingPVC = _.filter(vcTemplates, (vc) => {
+        return !_.find(res.Volumes, { persistentVolumeClaim: { claimName: vc.persistentVolumeClaim.claimName } });
+      });
+      res.Volumes = _.concat(res.Volumes, inexistingPVC);
+    }
+
+    const persistedFolders = _.filter(res.Volumes, (volume) => volume.persistentVolumeClaim || volume.hostPath);
+
+    res.PersistedFolders = _.map(persistedFolders, (volume) => {
+      const volumeMounts = _.uniq(_.flatMap(_.map(containers, 'volumeMounts')), 'name');
+      const matchingVolumeMount = _.find(volumeMounts, { name: volume.name });
+
+      if (matchingVolumeMount) {
+        const persistedFolder = new KubernetesApplicationPersistedFolder();
+        persistedFolder.MountPath = matchingVolumeMount.mountPath;
+
+        if (volume.persistentVolumeClaim) {
+          persistedFolder.persistentVolumeClaimName = volume.persistentVolumeClaim.claimName;
+        } else {
+          persistedFolder.HostPath = volume.hostPath.path;
+        }
+
+        return persistedFolder;
+      }
+    });
+
+    res.PersistedFolders = _.without(res.PersistedFolders, undefined);
+
+    res.ConfigurationVolumes = _.reduce(
+      res.Volumes,
+      (acc, volume) => {
+        if (volume.configMap || volume.secret) {
+          const matchingVolumeMount = _.find(_.flatMap(_.map(containers, 'volumeMounts')), { name: volume.name });
+
+          if (matchingVolumeMount) {
+            let items = [];
+            let configurationName = '';
+
+            if (volume.configMap) {
+              items = volume.configMap.items;
+              configurationName = volume.configMap.name;
+            } else {
+              items = volume.secret.items;
+              configurationName = volume.secret.secretName;
+            }
+
+            if (!items) {
+              const configurationVolume = new KubernetesApplicationConfigurationVolume();
+              configurationVolume.fileMountPath = matchingVolumeMount.mountPath;
+              configurationVolume.rootMountPath = matchingVolumeMount.mountPath;
+              configurationVolume.configurationName = configurationName;
+              configurationVolume.configurationType = volume.configMap ? KubernetesConfigurationKinds.CONFIGMAP : KubernetesConfigurationKinds.SECRET;
+
+              acc.push(configurationVolume);
+            } else {
+              _.forEach(items, (item) => {
+                const configurationVolume = new KubernetesApplicationConfigurationVolume();
+                configurationVolume.fileMountPath = matchingVolumeMount.mountPath + '/' + item.path;
+                configurationVolume.rootMountPath = matchingVolumeMount.mountPath;
+                configurationVolume.configurationKey = item.key;
+                configurationVolume.configurationName = configurationName;
+                configurationVolume.configurationType = volume.configMap ? KubernetesConfigurationKinds.CONFIGMAP : KubernetesConfigurationKinds.SECRET;
+
+                acc.push(configurationVolume);
+              });
+            }
+          }
+        }
+
+        return acc;
+      },
+      []
+    );
+  }
+
+  static apiPodToApplication(data, pods, service, ingresses) {
+    const res = new KubernetesApplication();
+    KubernetesApplicationConverter.applicationCommon(res, data, pods, service, ingresses);
+    res.ApplicationType = KubernetesApplicationTypes.Pod;
+    return res;
+  }
+
+  static apiDeploymentToApplication(data, pods, service, ingresses) {
+    const res = new KubernetesApplication();
+    KubernetesApplicationConverter.applicationCommon(res, data, pods, service, ingresses);
+    res.ApplicationType = KubernetesApplicationTypes.Deployment;
+    res.DeploymentType = KubernetesApplicationDeploymentTypes.Replicated;
+    res.DataAccessPolicy = KubernetesApplicationDataAccessPolicies.Shared;
+    res.RunningPodsCount = data.status.availableReplicas || data.status.replicas - data.status.unavailableReplicas || 0;
+    res.TotalPodsCount = data.spec.replicas;
+    return res;
+  }
+
+  static apiDaemonSetToApplication(data, pods, service, ingresses) {
+    const res = new KubernetesApplication();
+    KubernetesApplicationConverter.applicationCommon(res, data, pods, service, ingresses);
+    res.ApplicationType = KubernetesApplicationTypes.DaemonSet;
+    res.DeploymentType = KubernetesApplicationDeploymentTypes.Global;
+    res.DataAccessPolicy = KubernetesApplicationDataAccessPolicies.Shared;
+    res.RunningPodsCount = data.status.numberAvailable || data.status.desiredNumberScheduled - data.status.numberUnavailable || 0;
+    res.TotalPodsCount = data.status.desiredNumberScheduled;
+    return res;
+  }
+
+  static apiStatefulSetToapplication(data, pods, service, ingresses) {
+    const res = new KubernetesApplication();
+    KubernetesApplicationConverter.applicationCommon(res, data, pods, service, ingresses);
+    res.ApplicationType = KubernetesApplicationTypes.StatefulSet;
+    res.DeploymentType = KubernetesApplicationDeploymentTypes.Replicated;
+    res.DataAccessPolicy = KubernetesApplicationDataAccessPolicies.Isolated;
+    res.RunningPodsCount = data.status.readyReplicas || 0;
+    res.TotalPodsCount = data.spec.replicas;
+    res.HeadlessServiceName = data.spec.serviceName;
+    return res;
+  }
+
+  static applicationToFormValues(app, resourcePools, configurations, persistentVolumeClaims, nodesLabels, ingresses) {
+    const res = new KubernetesApplicationFormValues();
+    res.ApplicationType = app.ApplicationType;
+    res.ResourcePool = _.find(resourcePools, ['Namespace.Name', app.ResourcePool]);
+    res.Name = app.Name;
+    res.Labels = app.Labels;
+    res.Services = KubernetesApplicationHelper.generateServicesFormValuesFromServices(app, ingresses);
+    res.Selector = KubernetesApplicationHelper.generateSelectorFromService(app);
+    res.StackName = app.StackName;
+    res.ApplicationOwner = app.ApplicationOwner;
+    res.ImageModel.Image = app.Image;
+    res.ImageModel.Registry.Id = app.RegistryId;
+    res.ReplicaCount = app.TotalPodsCount;
+    res.MemoryLimit = KubernetesResourceReservationHelper.megaBytesValue(app.Limits.Memory);
+    res.CpuLimit = app.Limits.Cpu;
+    res.DeploymentType = app.DeploymentType;
+    res.DataAccessPolicy = app.DataAccessPolicy;
+    res.EnvironmentVariables = KubernetesApplicationHelper.generateEnvVariablesFromEnv(app.Env);
+    res.PersistedFolders = KubernetesApplicationHelper.generatePersistedFoldersFormValuesFromPersistedFolders(app.PersistedFolders, persistentVolumeClaims); // generate from PVC and app.PersistedFolders
+    res.Secrets = KubernetesApplicationHelper.generateConfigurationFormValuesFromEnvAndVolumes(
+      app.Env,
+      app.ConfigurationVolumes,
+      configurations,
+      KubernetesConfigurationKinds.SECRET
+    );
+    res.ConfigMaps = KubernetesApplicationHelper.generateConfigurationFormValuesFromEnvAndVolumes(
+      app.Env,
+      app.ConfigurationVolumes,
+      configurations,
+      KubernetesConfigurationKinds.CONFIGMAP
+    );
+    res.AutoScaler = KubernetesApplicationHelper.generateAutoScalerFormValueFromHorizontalPodAutoScaler(app.AutoScaler, res.ReplicaCount);
+    res.PublishedPorts = KubernetesApplicationHelper.generatePublishedPortsFormValuesFromPublishedPorts(app.ServiceType, app.PublishedPorts, ingresses);
+    res.Containers = app.Containers;
+
+    res.PublishingType = app.ServiceType;
+
+    if (app.Pods && app.Pods.length) {
+      KubernetesApplicationHelper.generatePlacementsFormValuesFromAffinity(res, app.Pods[0].Affinity);
+    }
+
+    return res;
+  }
+
+  static applicationFormValuesToApplication(formValues) {
+    formValues.ApplicationOwner = KubernetesCommonHelper.ownerToLabel(formValues.ApplicationOwner);
+
+    const claims = KubernetesPersistentVolumeClaimConverter.applicationFormValuesToVolumeClaims(formValues);
+    const rwx = KubernetesApplicationHelper.hasRWX(claims);
+
+    const deployment =
+      (formValues.DeploymentType === KubernetesApplicationDeploymentTypes.Replicated &&
+        (claims.length === 0 || (claims.length > 0 && formValues.DataAccessPolicy === KubernetesApplicationDataAccessPolicies.Shared))) ||
+      formValues.ApplicationType === KubernetesApplicationTypes.Deployment;
+
+    const statefulSet =
+      (formValues.DeploymentType === KubernetesApplicationDeploymentTypes.Replicated &&
+        claims.length > 0 &&
+        formValues.DataAccessPolicy === KubernetesApplicationDataAccessPolicies.Isolated) ||
+      formValues.ApplicationType === KubernetesApplicationTypes.StatefulSet;
+
+    const daemonSet =
+      (formValues.DeploymentType === KubernetesApplicationDeploymentTypes.Global &&
+        (claims.length === 0 || (claims.length > 0 && formValues.DataAccessPolicy === KubernetesApplicationDataAccessPolicies.Shared && rwx))) ||
+      formValues.ApplicationType === KubernetesApplicationTypes.DaemonSet;
+
+    const pod = formValues.ApplicationType === KubernetesApplicationTypes.Pod;
+
+    let app;
+    if (deployment) {
+      app = KubernetesDeploymentConverter.applicationFormValuesToDeployment(formValues, claims);
+    } else if (statefulSet) {
+      app = KubernetesStatefulSetConverter.applicationFormValuesToStatefulSet(formValues, claims);
+    } else if (daemonSet) {
+      app = KubernetesDaemonSetConverter.applicationFormValuesToDaemonSet(formValues, claims);
+    } else if (pod) {
+      app = KubernetesPodConverter.applicationFormValuesToPod(formValues, claims);
+    } else {
+      throw new PortainerError('Unable to determine which association to use to convert form');
+    }
+    app.ApplicationType = formValues.ApplicationType;
+
+    let headlessService;
+    if (statefulSet) {
+      headlessService = KubernetesServiceConverter.applicationFormValuesToHeadlessService(formValues);
+    }
+
+    let service = KubernetesServiceConverter.applicationFormValuesToService(formValues);
+    if (!service.Ports.length) {
+      service = undefined;
+    }
+
+    let services = KubernetesServiceConverter.applicationFormValuesToServices(formValues);
+
+    return [app, headlessService, services, service, claims];
+  }
+}
+
+export default KubernetesApplicationConverter;
diff --git a/app/kubernetes/converters/configMap.js b/app/kubernetes/converters/configMap.js
new file mode 100644
index 0000000..b1d1c5b
--- /dev/null
+++ b/app/kubernetes/converters/configMap.js
@@ -0,0 +1,124 @@
+import _ from 'lodash-es';
+import { KubernetesConfigMap, KubernetesPortainerAccessConfigMap } from '@/kubernetes/models/config-map/models';
+import { KubernetesConfigMapCreatePayload, KubernetesConfigMapUpdatePayload } from '@/kubernetes/models/config-map/payloads';
+import { KubernetesConfigurationFormValuesEntry } from '@/kubernetes/models/configuration/formvalues';
+import { ConfigurationOwnerUsernameLabel } from '@/react/kubernetes/configs/constants';
+class KubernetesConfigMapConverter {
+  static apiToPortainerAccessConfigMap(data) {
+    const res = new KubernetesPortainerAccessConfigMap();
+    res.Id = data.metadata.uid;
+    res.Data = data.data;
+    return res;
+  }
+
+  static createAccessPayload(data) {
+    const res = new KubernetesConfigMapCreatePayload();
+    _.unset(res, 'binaryData');
+    res.metadata.name = data.Name;
+    res.metadata.namespace = data.Namespace;
+    res.data = data.Data;
+    return res;
+  }
+
+  static updateAccessPayload(data) {
+    const res = KubernetesConfigMapConverter.createAccessPayload(data);
+    res.metadata.uid = data.Id;
+    return res;
+  }
+
+  /**
+   * API ConfigMap to front ConfigMap
+   */
+  static apiToConfigMap(data, yaml) {
+    const res = new KubernetesConfigMap();
+    res.Id = data.metadata.uid;
+    res.Name = data.metadata.name;
+    res.Namespace = data.metadata.namespace;
+    res.ConfigurationOwner = data.metadata.labels ? data.metadata.labels[ConfigurationOwnerUsernameLabel] : '';
+    res.CreationDate = data.metadata.creationTimestamp;
+    res.Yaml = yaml ? yaml.data : '';
+    res.Labels = data.metadata.labels;
+
+    res.Data = _.concat(
+      _.map(data.data, (value, key) => {
+        const entry = new KubernetesConfigurationFormValuesEntry();
+        entry.Key = key;
+        entry.Value = value;
+        return entry;
+      }),
+      _.map(data.binaryData, (value, key) => {
+        const entry = new KubernetesConfigurationFormValuesEntry();
+        entry.Key = key;
+        entry.Value = value;
+        entry.IsBinary = true;
+        return entry;
+      })
+    );
+
+    return res;
+  }
+
+  /**
+   * Generate a default ConfigMap Model
+   * with ID = 0 (showing it's a default)
+   * but setting his Namespace and Name
+   */
+  static defaultConfigMap(namespace, name) {
+    const res = new KubernetesConfigMap();
+    res.Name = name;
+    res.Namespace = namespace;
+    return res;
+  }
+
+  /**
+   * CREATE payload
+   */
+  static createPayload(data) {
+    const res = new KubernetesConfigMapCreatePayload();
+    res.metadata.name = data.Name;
+    res.metadata.namespace = data.Namespace.Namespace.Name;
+    const configurationOwner = _.truncate(data.ConfigurationOwner, { length: 63, omission: '' });
+    res.metadata.labels[ConfigurationOwnerUsernameLabel] = configurationOwner;
+
+    _.forEach(data.Data, (entry) => {
+      if (entry.IsBinary) {
+        res.binaryData[entry.Key] = entry.Value;
+      } else {
+        res.data[entry.Key] = entry.Value;
+      }
+    });
+    return res;
+  }
+
+  /**
+   * UPDATE payload
+   */
+  static updatePayload(data) {
+    const res = new KubernetesConfigMapUpdatePayload();
+    res.metadata.uid = data.Id;
+    res.metadata.name = data.Name;
+    res.metadata.namespace = data.Namespace;
+    res.metadata.labels = data.Labels || {};
+    res.metadata.labels[ConfigurationOwnerUsernameLabel] = data.ConfigurationOwner;
+    _.forEach(data.Data, (entry) => {
+      if (entry.IsBinary) {
+        res.binaryData[entry.Key] = entry.Value;
+      } else {
+        res.data[entry.Key] = entry.Value;
+      }
+    });
+    return res;
+  }
+
+  static configurationFormValuesToConfigMap(formValues) {
+    const res = new KubernetesConfigMap();
+    res.Id = formValues.Id;
+    res.Name = formValues.Name;
+    res.Namespace = formValues.ResourcePool;
+    res.ConfigurationOwner = formValues.ConfigurationOwner;
+    res.Data = formValues.Data;
+    return res;
+  }
+}
+
+export default KubernetesConfigMapConverter;
diff --git a/app/kubernetes/converters/configuration.js b/app/kubernetes/converters/configuration.js
new file mode 100644
index 0000000..a10010f
--- /dev/null
+++ b/app/kubernetes/converters/configuration.js
@@ -0,0 +1,57 @@
+import _ from 'lodash-es';
+import { KubernetesConfiguration, KubernetesConfigurationKinds } from '@/kubernetes/models/configuration/models';
+
+class KubernetesConfigurationConverter {
+  static secretToConfiguration(secret) {
+    const res = new KubernetesConfiguration();
+    res.Kind = KubernetesConfigurationKinds.SECRET;
+    res.kind = 'Secret';
+    res.Id = secret.Id;
+    res.Name = secret.Name;
+    res.Type = secret.Type;
+    res.Namespace = secret.Namespace;
+    res.CreationDate = secret.CreationDate;
+    res.Yaml = secret.Yaml;
+    _.forEach(secret.Data, (entry) => {
+      res.Data[entry.Key] = entry.Value;
+    });
+    res.data = res.Data;
+    res.ConfigurationOwner = secret.ConfigurationOwner;
+    res.IsRegistrySecret = secret.IsRegistrySecret;
+    res.SecretType = secret.SecretType;
+    if (secret.Annotations) {
+      const serviceAccountKey = 'kubernetes.io/service-account.name';
+      if (typeof secret.Annotations === 'object') {
+        res.ServiceAccountName = secret.Annotations[serviceAccountKey];
+      } else if (Array.isArray(secret.Annotations)) {
+        const serviceAccountAnnotation = secret.Annotations.find((a) => a.key === 'kubernetes.io/service-account.name');
+        res.ServiceAccountName = serviceAccountAnnotation ? serviceAccountAnnotation.value : undefined;
+      } else {
+        res.ServiceAccountName = undefined;
+      }
+    }
+    res.Annotations = secret.Annotations;
+    res.Labels = secret.Labels;
+    return res;
+  }
+
+  static configMapToConfiguration(configMap) {
+    const res = new KubernetesConfiguration();
+    res.Kind = KubernetesConfigurationKinds.CONFIGMAP;
+    res.kind = 'ConfigMap';
+    res.Id = configMap.Id;
+    res.Name = configMap.Name;
+    res.Namespace = configMap.Namespace;
+    res.CreationDate = configMap.CreationDate;
+    res.Yaml = configMap.Yaml;
+    _.forEach(configMap.Data, (entry) => {
+      res.Data[entry.Key] = entry.Value;
+    });
+    res.data = res.Data;
+    res.ConfigurationOwner = configMap.ConfigurationOwner;
+    res.Labels = configMap.Labels;
+    return res;
+  }
+}
+
+export default KubernetesConfigurationConverter;
diff --git a/app/kubernetes/converters/daemonSet.js b/app/kubernetes/converters/daemonSet.js
new file mode 100644
index 0000000..fb90622
--- /dev/null
+++ b/app/kubernetes/converters/daemonSet.js
@@ -0,0 +1,88 @@
+import * as JsonPatch from 'fast-json-patch';
+import { KubernetesDaemonSet } from '@/kubernetes/models/daemon-set/models';
+import { KubernetesDaemonSetCreatePayload } from '@/kubernetes/models/daemon-set/payloads';
+import {
+  KubernetesPortainerApplicationStackNameLabel,
+  KubernetesPortainerApplicationNameLabel,
+  KubernetesPortainerApplicationNote,
+  KubernetesPortainerApplicationOwnerLabel,
+} from '@/kubernetes/models/application/models';
+import KubernetesApplicationHelper from '@/kubernetes/helpers/application';
+import KubernetesResourceReservationHelper from '@/kubernetes/helpers/resourceReservationHelper';
+import KubernetesCommonHelper from '@/kubernetes/helpers/commonHelper';
+import { buildImageFullURIFromModel } from '@/react/docker/images/utils';
+
+class KubernetesDaemonSetConverter {
+  /**
+   * Generate KubernetesDaemonSet from KubernetesApplicationFormValues
+   * @param {KubernetesApplicationFormValues} formValues
+   */
+  static applicationFormValuesToDaemonSet(formValues, volumeClaims) {
+    const res = new KubernetesDaemonSet();
+    res.Namespace = formValues.ResourcePool.Namespace.Name;
+    res.Name = formValues.Name;
+    if (formValues.StackName) {
+      res.StackName = formValues.StackName;
+    }
+    res.ApplicationOwner = formValues.ApplicationOwner;
+    res.ApplicationName = formValues.Name;
+    res.ImageModel = formValues.ImageModel;
+    res.CpuLimit = formValues.CpuLimit;
+    res.MemoryLimit = KubernetesResourceReservationHelper.bytesValue(formValues.MemoryLimit);
+    res.Env = KubernetesApplicationHelper.generateEnvFromEnvVariables(formValues.EnvironmentVariables);
+    KubernetesApplicationHelper.generateVolumesFromPersistentVolumClaims(res, volumeClaims);
+    KubernetesApplicationHelper.generateEnvOrVolumesFromConfigurations(res, formValues.ConfigMaps, formValues.Secrets);
+    KubernetesApplicationHelper.generateAffinityFromPlacements(res, formValues);
+    return res;
+  }
+
+  /**
+   * Generate CREATE payload from DaemonSet
+   * @param {KubernetesDaemonSetPayload} model DaemonSet to generate payload from
+   */
+  static createPayload(daemonSet) {
+    const payload = new KubernetesDaemonSetCreatePayload();
+    payload.metadata.name = daemonSet.Name;
+    payload.metadata.namespace = daemonSet.Namespace;
+    if (daemonSet.StackName) {
+      payload.metadata.labels[KubernetesPortainerApplicationStackNameLabel] = daemonSet.StackName;
+    }
+    payload.metadata.labels[KubernetesPortainerApplicationNameLabel] = daemonSet.ApplicationName;
+    payload.metadata.labels[KubernetesPortainerApplicationOwnerLabel] = daemonSet.ApplicationOwner;
+    payload.metadata.annotations[KubernetesPortainerApplicationNote] = daemonSet.Note;
+    payload.spec.replicas = daemonSet.ReplicaCount;
+    payload.spec.selector.matchLabels.app = daemonSet.Name;
+    payload.spec.template.metadata.labels.app = daemonSet.Name;
+    payload.spec.template.metadata.labels[KubernetesPortainerApplicationNameLabel] = daemonSet.ApplicationName;
+    payload.spec.template.spec.containers[0].name = daemonSet.Name;
+    payload.spec.template.spec.containers[0].image = buildImageFullURIFromModel(daemonSet.ImageModel);
+    if (daemonSet.ImageModel.Registry && daemonSet.ImageModel.Registry.Authentication) {
+      payload.spec.template.spec.imagePullSecrets = [{ name: `registry-${daemonSet.ImageModel.Registry.Id}` }];
+    }
+    payload.spec.template.spec.affinity = daemonSet.Affinity;
+    KubernetesCommonHelper.assignOrDeleteIfEmpty(payload, 'spec.template.spec.containers[0].env', daemonSet.Env);
+    KubernetesCommonHelper.assignOrDeleteIfEmpty(payload, 'spec.template.spec.containers[0].volumeMounts', daemonSet.VolumeMounts);
+    KubernetesCommonHelper.assignOrDeleteIfEmpty(payload, 'spec.template.spec.volumes', daemonSet.Volumes);
+    if (daemonSet.MemoryLimit) {
+      payload.spec.template.spec.containers[0].resources.limits.memory = daemonSet.MemoryLimit;
+      payload.spec.template.spec.containers[0].resources.requests.memory = daemonSet.MemoryLimit;
+    }
+    if (daemonSet.CpuLimit) {
+      payload.spec.template.spec.containers[0].resources.limits.cpu = daemonSet.CpuLimit;
+      payload.spec.template.spec.containers[0].resources.requests.cpu = daemonSet.CpuLimit;
+    }
+    if (!daemonSet.CpuLimit && !daemonSet.MemoryLimit) {
+      delete payload.spec.template.spec.containers[0].resources;
+    }
+    return payload;
+  }
+
+  static patchPayload(oldDaemonSet, newDaemonSet) {
+    const oldPayload = KubernetesDaemonSetConverter.createPayload(oldDaemonSet);
+    const newPayload = KubernetesDaemonSetConverter.createPayload(newDaemonSet);
+    const payload = JsonPatch.compare(oldPayload, newPayload);
+    return payload;
+  }
+}
+
+export default KubernetesDaemonSetConverter;
diff --git a/app/kubernetes/converters/deployment.js b/app/kubernetes/converters/deployment.js
new file mode 100644
index 0000000..145f163
--- /dev/null
+++ b/app/kubernetes/converters/deployment.js
@@ -0,0 +1,96 @@
+import * as JsonPatch from 'fast-json-patch';
+import { KubernetesDeployment } from '@/kubernetes/models/deployment/models';
+import { KubernetesDeploymentCreatePayload } from '@/kubernetes/models/deployment/payloads';
+import {
+  KubernetesPortainerApplicationStackNameLabel,
+  KubernetesPortainerApplicationNameLabel,
+  KubernetesPortainerApplicationOwnerLabel,
+  KubernetesPortainerApplicationNote,
+} from '@/kubernetes/models/application/models';
+
+import KubernetesApplicationHelper from '@/kubernetes/helpers/application';
+import KubernetesResourceReservationHelper from '@/kubernetes/helpers/resourceReservationHelper';
+import KubernetesCommonHelper from '@/kubernetes/helpers/commonHelper';
+import { buildImageFullURIFromModel } from '@/react/docker/images/utils';
+
+class KubernetesDeploymentConverter {
+  /**
+   * Generate KubernetesDeployment from KubernetesApplicationFormValues
+   * @param {KubernetesApplicationFormValues} formValues
+   */
+  static applicationFormValuesToDeployment(formValues, volumeClaims) {
+    const res = new KubernetesDeployment();
+    res.Namespace = formValues.ResourcePool.Namespace.Name;
+    res.Name = formValues.Name;
+    if (formValues.StackName) {
+      res.StackName = formValues.StackName;
+    }
+    res.ApplicationOwner = formValues.ApplicationOwner;
+    res.ApplicationName = formValues.Name;
+    res.ReplicaCount = formValues.ReplicaCount;
+    res.ImageModel = formValues.ImageModel;
+    res.CpuLimit = formValues.CpuLimit;
+    res.MemoryLimit = KubernetesResourceReservationHelper.bytesValue(formValues.MemoryLimit);
+    res.Env = KubernetesApplicationHelper.generateEnvFromEnvVariables(formValues.EnvironmentVariables);
+    res.Containers = formValues.Containers;
+    KubernetesApplicationHelper.generateVolumesFromPersistentVolumClaims(res, volumeClaims);
+    KubernetesApplicationHelper.generateEnvOrVolumesFromConfigurations(res, formValues.ConfigMaps, formValues.Secrets);
+    KubernetesApplicationHelper.generateAffinityFromPlacements(res, formValues);
+    return res;
+  }
+
+  /**
+   * Generate CREATE payload from Deployment
+   * @param {KubernetesDeploymentPayload} model Deployment to genereate payload from
+   */
+  static createPayload(deployment) {
+    const payload = new KubernetesDeploymentCreatePayload();
+    payload.metadata.name = deployment.Name;
+    payload.metadata.namespace = deployment.Namespace;
+    if (deployment.StackName) {
+      payload.metadata.labels[KubernetesPortainerApplicationStackNameLabel] = deployment.StackName;
+    }
+    payload.metadata.labels[KubernetesPortainerApplicationNameLabel] = deployment.ApplicationName;
+    payload.metadata.labels[KubernetesPortainerApplicationOwnerLabel] = deployment.ApplicationOwner;
+    payload.metadata.annotations[KubernetesPortainerApplicationNote] = deployment.Note;
+    payload.spec.replicas = deployment.ReplicaCount;
+    payload.spec.selector.matchLabels.app = deployment.Name;
+    payload.spec.template.metadata.labels.app = deployment.Name;
+    payload.spec.template.metadata.labels[KubernetesPortainerApplicationNameLabel] = deployment.ApplicationName;
+    payload.spec.template.spec.containers[0].name = deployment.Name;
+
+    if (deployment.ImageModel) {
+      payload.spec.template.spec.containers[0].image = buildImageFullURIFromModel(deployment.ImageModel);
+
+      if (deployment.ImageModel.Registry && deployment.ImageModel.Registry.Authentication) {
+        payload.spec.template.spec.imagePullSecrets = [{ name: `registry-${deployment.ImageModel.Registry.Id}` }];
+      }
+    }
+
+    payload.spec.template.spec.affinity = deployment.Affinity;
+    KubernetesCommonHelper.assignOrDeleteIfEmpty(payload, 'spec.template.spec.containers[0].env', deployment.Env);
+    KubernetesCommonHelper.assignOrDeleteIfEmpty(payload, 'spec.template.spec.containers[0].volumeMounts', deployment.VolumeMounts);
+    KubernetesCommonHelper.assignOrDeleteIfEmpty(payload, 'spec.template.spec.volumes', deployment.Volumes);
+    if (deployment.MemoryLimit) {
+      payload.spec.template.spec.containers[0].resources.limits.memory = deployment.MemoryLimit;
+      payload.spec.template.spec.containers[0].resources.requests.memory = deployment.MemoryLimit;
+    }
+    if (deployment.CpuLimit) {
+      payload.spec.template.spec.containers[0].resources.limits.cpu = deployment.CpuLimit;
+      payload.spec.template.spec.containers[0].resources.requests.cpu = deployment.CpuLimit;
+    }
+    if (!deployment.CpuLimit && !deployment.MemoryLimit) {
+      delete payload.spec.template.spec.containers[0].resources;
+    }
+    return payload;
+  }
+
+  static patchPayload(oldDeployment, newDeployment) {
+    const oldPayload = KubernetesDeploymentConverter.createPayload(oldDeployment);
+    const newPayload = KubernetesDeploymentConverter.createPayload(newDeployment);
+    const payload = JsonPatch.compare(oldPayload, newPayload);
+    return payload;
+  }
+}
+
+export default KubernetesDeploymentConverter;
diff --git a/app/kubernetes/converters/event.js b/app/kubernetes/converters/event.js
new file mode 100644
index 0000000..fdc17e4
--- /dev/null
+++ b/app/kubernetes/converters/event.js
@@ -0,0 +1,15 @@
+import { KubernetesEvent } from '@/kubernetes/models/event/models';
+
+class KubernetesEventConverter {
+  static apiToEvent(data) {
+    const res = new KubernetesEvent();
+    res.Id = data.metadata.uid;
+    res.Date = data.lastTimestamp || data.eventTime;
+    res.Type = data.type;
+    res.Message = data.message;
+    res.Involved = data.involvedObject;
+    return res;
+  }
+}
+
+export default KubernetesEventConverter;
diff --git a/app/kubernetes/converters/namespace.js b/app/kubernetes/converters/namespace.js
new file mode 100644
index 0000000..1d85be8
--- /dev/null
+++ b/app/kubernetes/converters/namespace.js
@@ -0,0 +1,43 @@
+import _ from 'lodash-es';
+import { KubernetesNamespace } from '@/kubernetes/models/namespace/models';
+import { KubernetesNamespaceCreatePayload } from '@/kubernetes/models/namespace/payloads';
+import {
+  KubernetesPortainerResourcePoolNameLabel,
+  KubernetesPortainerResourcePoolOwnerLabel,
+  KubernetesPortainerNamespaceSystemLabel,
+} from '@/kubernetes/models/resource-pool/models';
+import KubernetesNamespaceHelper from '@/kubernetes/helpers/namespaceHelper';
+
+export default class KubernetesNamespaceConverter {
+  static apiToNamespace(data, yaml) {
+    const res = new KubernetesNamespace();
+    res.Id = data.metadata.uid;
+    res.Name = data.metadata.name;
+    res.CreationDate = data.metadata.creationTimestamp;
+    res.Status = data.status.phase;
+    res.Yaml = yaml ? yaml.data : '';
+    res.ResourcePoolName = data.metadata.labels ? data.metadata.labels[KubernetesPortainerResourcePoolNameLabel] : '';
+    res.ResourcePoolOwner = data.metadata.labels ? data.metadata.labels[KubernetesPortainerResourcePoolOwnerLabel] : '';
+
+    res.IsSystem = KubernetesNamespaceHelper.isDefaultSystemNamespace(data.metadata.name);
+    if (data.metadata.labels) {
+      const systemLabel = data.metadata.labels[KubernetesPortainerNamespaceSystemLabel];
+      if (!_.isEmpty(systemLabel)) {
+        res.IsSystem = systemLabel === 'true';
+      }
+    }
+    return res;
+  }
+
+  static createPayload(namespace) {
+    const res = new KubernetesNamespaceCreatePayload();
+    res.metadata.name = namespace.Name;
+    res.metadata.labels[KubernetesPortainerResourcePoolNameLabel] = namespace.ResourcePoolName;
+
+    if (namespace.ResourcePoolOwner) {
+      const resourcePoolOwner = _.truncate(namespace.ResourcePoolOwner, { length: 63, omission: '' });
+      res.metadata.labels[KubernetesPortainerResourcePoolOwnerLabel] = resourcePoolOwner;
+    }
+    return res;
+  }
+}
diff --git a/app/kubernetes/converters/persistentVolumeClaim.js b/app/kubernetes/converters/persistentVolumeClaim.js
new file mode 100644
index 0000000..06b502f
--- /dev/null
+++ b/app/kubernetes/converters/persistentVolumeClaim.js
@@ -0,0 +1,90 @@
+import _ from 'lodash-es';
+import * as JsonPatch from 'fast-json-patch';
+
+import { KubernetesPersistentVolumeClaim } from '@/kubernetes/models/volume/models';
+import { KubernetesPersistentVolumClaimCreatePayload } from '@/kubernetes/models/volume/payloads';
+import { KubernetesPortainerApplicationOwnerLabel, KubernetesPortainerApplicationNameLabel } from '@/kubernetes/models/application/models';
+
+const storageClassToPVCAccessModes = {
+  RWO: 'ReadWriteOnce',
+  RWX: 'ReadWriteMany',
+};
+
+class KubernetesPersistentVolumeClaimConverter {
+  static apiToPersistentVolumeClaim(data, storageClasses, yaml) {
+    const res = new KubernetesPersistentVolumeClaim();
+    res.Id = data.metadata.uid;
+    res.Name = data.metadata.name;
+    res.Namespace = data.metadata.namespace;
+    res.CreationDate = data.metadata.creationTimestamp;
+    res.Storage = `${data.spec.resources.requests.storage}B`;
+    res.AccessModes = data.spec.accessModes || [];
+    res.storageClass = _.find(storageClasses, { Name: data.spec.storageClassName });
+    res.Yaml = yaml ? yaml.data : '';
+    res.ApplicationOwner = data.metadata.labels ? data.metadata.labels[KubernetesPortainerApplicationOwnerLabel] : '';
+    res.ApplicationName = data.metadata.labels ? data.metadata.labels[KubernetesPortainerApplicationNameLabel] : '';
+    return res;
+  }
+
+  /**
+   * Generate KubernetesPersistentVolumeClaim list from KubernetesApplicationFormValues
+   * @param {KubernetesApplicationFormValues} formValues
+   */
+  static applicationFormValuesToVolumeClaims(formValues) {
+    _.remove(formValues.PersistedFolders, (item) => item.needsDeletion);
+    const res = _.map(formValues.PersistedFolders, (item) => {
+      const pvc = new KubernetesPersistentVolumeClaim();
+      if (!_.isEmpty(item.existingVolume)) {
+        const existantPVC = item.existingVolume.PersistentVolumeClaim;
+        pvc.Name = existantPVC.Name;
+        if (item.persistentVolumeClaimName) {
+          pvc.PreviousName = item.persistentVolumeClaimName;
+        }
+        pvc.storageClass = existantPVC.storageClass;
+        pvc.Storage = existantPVC.Storage.charAt(0);
+        pvc.CreationDate = existantPVC.CreationDate;
+        pvc.Id = existantPVC.Id;
+      } else {
+        if (item.persistentVolumeClaimName) {
+          pvc.Name = item.persistentVolumeClaimName;
+          if (!item.useNewVolume) {
+            pvc.PreviousName = item.persistentVolumeClaimName;
+          }
+        } else {
+          pvc.Name = formValues.Name + '-' + pvc.Name;
+        }
+        pvc.Storage = '' + item.size + item.sizeUnit.charAt(0);
+        pvc.storageClass = item.storageClass;
+      }
+      pvc.MountPath = item.containerPath;
+      pvc.Namespace = formValues.ResourcePool.Namespace.Name;
+      pvc.ApplicationOwner = formValues.ApplicationOwner;
+      pvc.ApplicationName = formValues.Name;
+      return pvc;
+    });
+    return res;
+  }
+
+  static createPayload(pvc) {
+    const res = new KubernetesPersistentVolumClaimCreatePayload();
+    res.metadata.name = pvc.Name;
+    res.metadata.namespace = pvc.Namespace;
+    res.spec.resources.requests.storage = pvc.Storage;
+    res.spec.storageClassName = pvc.storageClass ? pvc.storageClass.Name : '';
+    const accessModes = pvc.storageClass && pvc.storageClass.AccessModes ? pvc.storageClass.AccessModes.map((accessMode) => storageClassToPVCAccessModes[accessMode]) : [];
+    res.spec.accessModes = accessModes;
+    res.metadata.labels.app = pvc.ApplicationName;
+    res.metadata.labels[KubernetesPortainerApplicationOwnerLabel] = pvc.ApplicationOwner;
+    res.metadata.labels[KubernetesPortainerApplicationNameLabel] = pvc.ApplicationName;
+    return res;
+  }
+
+  static patchPayload(oldPVC, newPVC) {
+    const oldPayload = KubernetesPersistentVolumeClaimConverter.createPayload(oldPVC);
+    const newPayload = KubernetesPersistentVolumeClaimConverter.createPayload(newPVC);
+    const payload = JsonPatch.compare(oldPayload, newPayload);
+    return payload;
+  }
+}
+
+export default KubernetesPersistentVolumeClaimConverter;
diff --git a/app/kubernetes/converters/resourcePool.js b/app/kubernetes/converters/resourcePool.js
new file mode 100644
index 0000000..3c6498c
--- /dev/null
+++ b/app/kubernetes/converters/resourcePool.js
@@ -0,0 +1,45 @@
+import _ from 'lodash-es';
+
+import { KubernetesResourcePool } from '@/kubernetes/models/resource-pool/models';
+import { KubernetesNamespace } from '@/kubernetes/models/namespace/models';
+import { KubernetesIngressConverter } from '@/kubernetes/ingress/converter';
+import KubernetesResourceQuotaConverter from './resourceQuota';
+
+class KubernetesResourcePoolConverter {
+  static apiToResourcePool(namespace) {
+    const res = new KubernetesResourcePool();
+    res.Namespace = namespace;
+    res.Yaml = namespace.Yaml;
+    return res;
+  }
+
+  static formValuesToResourcePool(formValues) {
+    const namespace = new KubernetesNamespace();
+    namespace.Name = formValues.Name;
+    namespace.ResourcePoolName = formValues.Name;
+    namespace.ResourcePoolOwner = formValues.Owner;
+    namespace.IsSystem = formValues.IsSystem;
+
+    const quota = KubernetesResourceQuotaConverter.resourcePoolFormValuesToResourceQuota(formValues);
+
+    const ingMap = _.map(formValues.IngressClasses, (c) => {
+      if (c.Selected) {
+        c.Namespace = namespace.Name;
+        return KubernetesIngressConverter.resourcePoolIngressClassFormValueToIngress(c);
+      }
+    });
+    const ingresses = _.without(ingMap, undefined);
+    const registries = _.map(formValues.Registries, (r) => {
+      if (!r.RegistryAccesses[formValues.EndpointId]) {
+        r.RegistryAccesses[formValues.EndpointId] = { Namespaces: [] };
+      }
+      if (!_.includes(r.RegistryAccesses[formValues.EndpointId].Namespaces, formValues.Name)) {
+        r.RegistryAccesses[formValues.EndpointId].Namespaces = [...r.RegistryAccesses[formValues.EndpointId].Namespaces, formValues.Name];
+      }
+      return r;
+    });
+    return [namespace, quota, ingresses, registries];
+  }
+}
+
+export default KubernetesResourcePoolConverter;
diff --git a/app/kubernetes/converters/resourceQuota.js b/app/kubernetes/converters/resourceQuota.js
new file mode 100644
index 0000000..c3a0b3e
--- /dev/null
+++ b/app/kubernetes/converters/resourceQuota.js
@@ -0,0 +1,104 @@
+import * as JsonPatch from 'fast-json-patch';
+import filesizeParser from 'filesize-parser';
+
+import {
+  KubernetesResourceQuota,
+  KubernetesPortainerResourceQuotaCPULimit,
+  KubernetesPortainerResourceQuotaMemoryLimit,
+  KubernetesPortainerResourceQuotaCPURequest,
+  KubernetesPortainerResourceQuotaMemoryRequest,
+  KubernetesResourceQuotaDefaults,
+} from '@/kubernetes/models/resource-quota/models';
+import { KubernetesResourceQuotaCreatePayload } from '@/kubernetes/models/resource-quota/payloads';
+import KubernetesResourceQuotaHelper from '@/kubernetes/helpers/resourceQuotaHelper';
+import { KubernetesPortainerResourcePoolNameLabel, KubernetesPortainerResourcePoolOwnerLabel } from '@/kubernetes/models/resource-pool/models';
+import KubernetesResourceReservationHelper from '@/kubernetes/helpers/resourceReservationHelper';
+import KubernetesCommonHelper from '@/kubernetes/helpers/commonHelper';
+import { KubernetesResourcePoolFormValues } from '@/kubernetes/models/resource-pool/formValues';
+import { parseCPU } from '@/react/kubernetes/utils';
+
+class KubernetesResourceQuotaConverter {
+  static apiToResourceQuota(data, yaml) {
+    const res = new KubernetesResourceQuota();
+    res.Id = data.metadata.uid;
+    res.Namespace = data.metadata.namespace;
+    res.Name = data.metadata.name;
+    res.CpuLimit = 0;
+    res.MemoryLimit = 0;
+    if (data.spec.hard && data.spec.hard[KubernetesPortainerResourceQuotaCPULimit]) {
+      res.CpuLimit = parseCPU(data.spec.hard[KubernetesPortainerResourceQuotaCPULimit]);
+    }
+    if (data.spec.hard && data.spec.hard[KubernetesPortainerResourceQuotaMemoryLimit]) {
+      res.MemoryLimit = filesizeParser(data.spec.hard[KubernetesPortainerResourceQuotaMemoryLimit], { base: 10 });
+    }
+
+    res.MemoryLimitUsed = 0;
+    if (data.status.used && data.status.used[KubernetesPortainerResourceQuotaMemoryLimit]) {
+      res.MemoryLimitUsed = filesizeParser(data.status.used[KubernetesPortainerResourceQuotaMemoryLimit], { base: 10 });
+    }
+
+    res.CpuLimitUsed = 0;
+    if (data.status.used && data.status.used[KubernetesPortainerResourceQuotaCPULimit]) {
+      res.CpuLimitUsed = parseCPU(data.status.used[KubernetesPortainerResourceQuotaCPULimit]);
+    }
+    res.Yaml = yaml ? yaml.data : '';
+    res.ResourcePoolName = data.metadata.labels ? data.metadata.labels[KubernetesPortainerResourcePoolNameLabel] : '';
+    res.ResourcePoolOwner = data.metadata.labels ? data.metadata.labels[KubernetesPortainerResourcePoolOwnerLabel] : '';
+    return res;
+  }
+
+  static createPayload(quota) {
+    const res = new KubernetesResourceQuotaCreatePayload();
+    res.metadata.name = KubernetesResourceQuotaHelper.generateResourceQuotaName(quota.Namespace);
+    res.metadata.namespace = quota.Namespace;
+    KubernetesCommonHelper.assignOrDeleteIfEmptyOrZero(res, `spec.hard['${KubernetesPortainerResourceQuotaCPURequest}']`, quota.CpuLimit);
+    KubernetesCommonHelper.assignOrDeleteIfEmptyOrZero(res, `spec.hard['${KubernetesPortainerResourceQuotaMemoryRequest}']`, quota.MemoryLimit);
+    KubernetesCommonHelper.assignOrDeleteIfEmptyOrZero(res, `spec.hard['${KubernetesPortainerResourceQuotaCPULimit}']`, quota.CpuLimit);
+    KubernetesCommonHelper.assignOrDeleteIfEmptyOrZero(res, `spec.hard['${KubernetesPortainerResourceQuotaMemoryLimit}']`, quota.MemoryLimit);
+    res.metadata.labels[KubernetesPortainerResourcePoolNameLabel] = quota.ResourcePoolName;
+    if (quota.ResourcePoolOwner) {
+      res.metadata.labels[KubernetesPortainerResourcePoolOwnerLabel] = quota.ResourcePoolOwner;
+    }
+    return res;
+  }
+
+  static updatePayload(quota) {
+    const res = KubernetesResourceQuotaConverter.createPayload(quota);
+    res.metadata.uid = quota.Id;
+    return res;
+  }
+
+  static patchPayload(oldQuota, newQuota) {
+    const oldPayload = KubernetesResourceQuotaConverter.createPayload(oldQuota);
+    const newPayload = KubernetesResourceQuotaConverter.createPayload(newQuota);
+    const payload = JsonPatch.compare(oldPayload, newPayload);
+    return payload;
+  }
+
+  static quotaToResourcePoolFormValues(quota) {
+    const res = new KubernetesResourcePoolFormValues(KubernetesResourceQuotaDefaults);
+    res.Name = quota.Namespace;
+    res.CpuLimit = quota.CpuLimit;
+    res.MemoryLimit = KubernetesResourceReservationHelper.megaBytesValue(quota.MemoryLimit);
+    if (res.CpuLimit || res.MemoryLimit) {
+      res.HasQuota = true;
+    }
+    res.StorageClasses = quota.StorageRequests;
+    return res;
+  }
+
+  static resourcePoolFormValuesToResourceQuota(formValues) {
+    if (formValues.HasQuota) {
+      const quota = new KubernetesResourceQuota(formValues.Name);
+      if (formValues.HasQuota) {
+        quota.CpuLimit = formValues.CpuLimit;
+        quota.MemoryLimit = KubernetesResourceReservationHelper.bytesValue(formValues.MemoryLimit);
+      }
+      quota.ResourcePoolName = formValues.Name;
+      quota.ResourcePoolOwner = formValues.Owner;
+      return quota;
+    }
+  }
+}
+
+export default KubernetesResourceQuotaConverter;
diff --git a/app/kubernetes/converters/secret.js b/app/kubernetes/converters/secret.js
new file mode 100644
index 0000000..08da23f
--- /dev/null
+++ b/app/kubernetes/converters/secret.js
@@ -0,0 +1,121 @@
+import _ from 'lodash-es';
+import { KubernetesSecretCreatePayload, KubernetesSecretUpdatePayload } from '@/kubernetes/models/secret/payloads';
+import { KubernetesApplicationSecret } from '@/kubernetes/models/secret/models';
+import { KubernetesPortainerConfigurationDataAnnotation } from '@/kubernetes/models/configuration/models';
+import { ConfigurationOwnerUsernameLabel } from '@/react/kubernetes/configs/constants';
+import { KubernetesConfigurationFormValuesEntry } from '@/kubernetes/models/configuration/formvalues';
+import { KubernetesSecretTypeOptions } from '@/kubernetes/models/configuration/models';
+class KubernetesSecretConverter {
+  static createPayload(secret) {
+    const res = new KubernetesSecretCreatePayload();
+    res.metadata.name = secret.Name;
+    res.metadata.namespace = secret.Namespace.Namespace.Name;
+    res.type = secret.Type;
+    const configurationOwner = _.truncate(secret.ConfigurationOwner, { length: 63, omission: '' });
+    res.metadata.labels[ConfigurationOwnerUsernameLabel] = configurationOwner;
+
+    let annotation = '';
+    _.forEach(secret.Data, (entry) => {
+      if (entry.IsBinary) {
+        res.data[entry.Key] = entry.Value;
+        annotation += annotation !== '' ? '|' + entry.Key : entry.Key;
+      } else {
+        res.stringData[entry.Key] = entry.Value;
+      }
+    });
+    if (annotation !== '') {
+      res.metadata.annotations[KubernetesPortainerConfigurationDataAnnotation] = annotation;
+    }
+
+    _.forEach(secret.Annotations, (entry) => {
+      res.metadata.annotations[entry.name] = entry.value;
+    });
+
+    return res;
+  }
+
+  static updatePayload(secret) {
+    const res = new KubernetesSecretUpdatePayload();
+    res.metadata.name = secret.Name;
+    res.metadata.namespace = secret.Namespace;
+    res.type = secret.Type;
+    res.metadata.labels = secret.Labels || {};
+    res.metadata.labels[ConfigurationOwnerUsernameLabel] = secret.ConfigurationOwner;
+
+    let annotation = '';
+    _.forEach(secret.Data, (entry) => {
+      if (entry.IsBinary) {
+        res.data[entry.Key] = entry.Value;
+        annotation += annotation !== '' ? '|' + entry.Key : entry.Key;
+      } else {
+        res.stringData[entry.Key] = entry.Value;
+      }
+    });
+    if (annotation !== '') {
+      res.metadata.annotations[KubernetesPortainerConfigurationDataAnnotation] = annotation;
+    }
+
+    _.forEach(secret.Annotations, (entry) => {
+      res.metadata.annotations[entry.name] = entry.value;
+    });
+
+    return res;
+  }
+
+  static apiToSecret(payload, yaml) {
+    const res = new KubernetesApplicationSecret();
+    res.Id = payload.metadata.uid;
+    res.Name = payload.metadata.name;
+    res.Namespace = payload.metadata.namespace;
+    res.Type = payload.type;
+    res.Labels = payload.metadata.labels || {};
+    res.ConfigurationOwner = payload.metadata.labels ? payload.metadata.labels[ConfigurationOwnerUsernameLabel] : '';
+    res.CreationDate = payload.metadata.creationTimestamp;
+    res.Annotations = payload.metadata.annotations;
+
+    res.IsRegistrySecret = payload.metadata.annotations && !!payload.metadata.annotations['portainer.io/registry.id'];
+
+    res.Yaml = yaml ? yaml.data : '';
+
+    res.SecretType = payload.type;
+
+    res.Data = _.map(payload.data, (value, key) => {
+      const annotations = payload.metadata.annotations ? payload.metadata.annotations[KubernetesPortainerConfigurationDataAnnotation] : '';
+      const entry = new KubernetesConfigurationFormValuesEntry();
+      entry.Key = key;
+      entry.IsBinary = _.includes(annotations, entry.Key);
+
+      if (!entry.IsBinary) {
+        entry.Value = atob(value);
+      } else {
+        entry.Value = value;
+      }
+      return entry;
+    });
+    res.data = res.Data;
+
+    return res;
+  }
+
+  static configurationFormValuesToSecret(formValues) {
+    const res = new KubernetesApplicationSecret();
+    res.Name = formValues.Name;
+    res.Namespace = formValues.ResourcePool;
+    res.Type = formValues.Type;
+    res.ConfigurationOwner = formValues.ConfigurationOwner;
+    res.Data = formValues.Data;
+
+    if (formValues.Type === KubernetesSecretTypeOptions.CUSTOM.value) {
+      res.Type = formValues.customType;
+    }
+    if (formValues.Type === KubernetesSecretTypeOptions.SERVICEACCOUNTTOKEN.value) {
+      const serviceAccountAnnotation = formValues.Annotations.find((a) => a.key === 'kubernetes.io/service-account.name');
+      if (!serviceAccountAnnotation) {
+        res.Annotations.push({ key: 'kubernetes.io/service-account.name', value: formValues.ServiceAccountName });
+      }
+    }
+    return res;
+  }
+}
+
+export default KubernetesSecretConverter;
diff --git a/app/kubernetes/converters/service.js b/app/kubernetes/converters/service.js
new file mode 100644
index 0000000..61a9629
--- /dev/null
+++ b/app/kubernetes/converters/service.js
@@ -0,0 +1,131 @@
+import _ from 'lodash-es';
+import * as JsonPatch from 'fast-json-patch';
+
+import { KubernetesServiceCreatePayload } from '@/kubernetes/models/service/payloads';
+import {
+  KubernetesPortainerApplicationNameLabel,
+  KubernetesPortainerApplicationOwnerLabel,
+  KubernetesPortainerApplicationStackNameLabel,
+} from '@/kubernetes/models/application/models';
+import { KubernetesService, KubernetesServiceHeadlessClusterIP, KubernetesServicePort, KubernetesServiceTypes } from '@/kubernetes/models/service/models';
+import KubernetesServiceHelper from '@/kubernetes/helpers/serviceHelper';
+
+function _publishedPortToServicePort(formValues, publishedPort, type) {
+  if (publishedPort.IsNew || !publishedPort.NeedsDeletion) {
+    const name = formValues.Name;
+    const res = new KubernetesServicePort();
+    res.name = _.toLower(name + '-' + publishedPort.ContainerPort + '-' + publishedPort.Protocol);
+    res.port = type === KubernetesServiceTypes.LOAD_BALANCER ? publishedPort.LoadBalancerPort : publishedPort.ContainerPort;
+    res.targetPort = publishedPort.ContainerPort;
+    res.protocol = publishedPort.Protocol;
+    if (type === KubernetesServiceTypes.NODE_PORT && publishedPort.NodePort) {
+      res.nodePort = publishedPort.NodePort;
+    } else if (type === KubernetesServiceTypes.LOAD_BALANCER && publishedPort.LoadBalancerNodePort) {
+      res.nodePort = publishedPort.LoadBalancerNodePort;
+    } else {
+      delete res.nodePort;
+    }
+    return res;
+  }
+}
+
+class KubernetesServiceConverter {
+  /**
+   * Generate KubernetesService from KubernetesApplicationFormValues
+   * @param {KubernetesApplicationFormValues} formValues
+   */
+  static applicationFormValuesToService(formValues) {
+    const res = new KubernetesService();
+    res.Namespace = formValues.ResourcePool.Namespace.Name;
+    res.Name = formValues.Name;
+    res.StackName = formValues.StackName ? formValues.StackName : formValues.Name;
+    res.ApplicationOwner = formValues.ApplicationOwner;
+    res.ApplicationName = formValues.Name;
+    res.Type = formValues.PublishingType;
+    const ports = _.map(formValues.PublishedPorts, (item) => _publishedPortToServicePort(formValues, item, res.Type));
+    res.Ports = _.uniqBy(_.without(ports, undefined), (p) => p.targetPort + p.protocol);
+    return res;
+  }
+
+  static applicationFormValuesToServices(formValues) {
+    let services = [];
+    formValues.Services.forEach(function (service) {
+      const res = new KubernetesService();
+      res.Namespace = formValues.ResourcePool.Namespace.Name;
+      res.Name = service.Name;
+      res.StackName = formValues.StackName ? formValues.StackName : formValues.Name;
+      res.ApplicationOwner = formValues.ApplicationOwner;
+      res.ApplicationName = formValues.Name;
+      res.Type = service.Type;
+      res.Ingress = service.Ingress;
+
+      if (service.Selector !== undefined) {
+        res.Selector = service.Selector;
+      } else {
+        res.Selector = {
+          app: formValues.Name,
+        };
+      }
+
+      let ports = [];
+      service.Ports.forEach(function (port, index) {
+        const res = new KubernetesServicePort();
+        res.name = 'port-' + index;
+        res.port = port.port;
+        if (port.nodePort) {
+          res.nodePort = port.nodePort;
+        }
+        res.protocol = port.protocol;
+        res.targetPort = port.targetPort;
+        res.ingress = port.ingress;
+        ports.push(res);
+      });
+      res.Ports = ports;
+
+      services.push(res);
+    });
+    return services;
+  }
+
+  static applicationFormValuesToHeadlessService(formValues) {
+    const res = KubernetesServiceConverter.applicationFormValuesToService(formValues);
+    res.Name = KubernetesServiceHelper.generateHeadlessServiceName(formValues.Name);
+    res.Headless = true;
+    res.Selector = {
+      app: formValues.Name,
+    };
+    return res;
+  }
+
+  /**
+   * Generate CREATE payload from Service
+   * @param {KubernetesService} model Service to genereate payload from
+   */
+  static createPayload(service) {
+    const payload = new KubernetesServiceCreatePayload();
+    payload.metadata.name = service.Name;
+    payload.metadata.namespace = service.Namespace;
+    payload.metadata.labels[KubernetesPortainerApplicationStackNameLabel] = service.StackName;
+    payload.metadata.labels[KubernetesPortainerApplicationNameLabel] = service.ApplicationName;
+    payload.metadata.labels[KubernetesPortainerApplicationOwnerLabel] = service.ApplicationOwner;
+
+    payload.spec.ports = service.Ports;
+    payload.spec.selector = service.Selector;
+    if (service.Headless) {
+      payload.spec.clusterIP = KubernetesServiceHeadlessClusterIP;
+      delete payload.spec.ports;
+    } else if (service.Type) {
+      payload.spec.type = service.Type;
+    }
+    return payload;
+  }
+
+  static patchPayload(oldService, newService) {
+    const oldPayload = KubernetesServiceConverter.createPayload(oldService);
+    const newPayload = KubernetesServiceConverter.createPayload(newService);
+    const payload = JsonPatch.compare(oldPayload, newPayload);
+    return payload;
+  }
+}
+
+export default KubernetesServiceConverter;
diff --git a/app/kubernetes/converters/statefulSet.js b/app/kubernetes/converters/statefulSet.js
new file mode 100644
index 0000000..06430c6
--- /dev/null
+++ b/app/kubernetes/converters/statefulSet.js
@@ -0,0 +1,96 @@
+import _ from 'lodash-es';
+import * as JsonPatch from 'fast-json-patch';
+
+import { KubernetesStatefulSet } from '@/kubernetes/models/stateful-set/models';
+import { KubernetesStatefulSetCreatePayload } from '@/kubernetes/models/stateful-set/payloads';
+import {
+  KubernetesPortainerApplicationStackNameLabel,
+  KubernetesPortainerApplicationNameLabel,
+  KubernetesPortainerApplicationOwnerLabel,
+  KubernetesPortainerApplicationNote,
+} from '@/kubernetes/models/application/models';
+import KubernetesApplicationHelper from '@/kubernetes/helpers/application';
+import KubernetesResourceReservationHelper from '@/kubernetes/helpers/resourceReservationHelper';
+import KubernetesCommonHelper from '@/kubernetes/helpers/commonHelper';
+import { buildImageFullURIFromModel } from '@/react/docker/images/utils';
+import KubernetesPersistentVolumeClaimConverter from './persistentVolumeClaim';
+
+class KubernetesStatefulSetConverter {
+  /**
+   * Generate KubernetesStatefulSet from KubernetesApplicationFormValues
+   * @param {KubernetesApplicationFormValues} formValues
+   */
+  static applicationFormValuesToStatefulSet(formValues, volumeClaims) {
+    const res = new KubernetesStatefulSet();
+    res.Namespace = formValues.ResourcePool.Namespace.Name;
+    res.Name = formValues.Name;
+    if (formValues.StackName) {
+      res.StackName = formValues.StackName;
+    }
+    res.ApplicationOwner = formValues.ApplicationOwner;
+    res.ApplicationName = formValues.Name;
+    res.ReplicaCount = formValues.ReplicaCount;
+    res.ImageModel = formValues.ImageModel;
+    res.CpuLimit = formValues.CpuLimit;
+    res.MemoryLimit = KubernetesResourceReservationHelper.bytesValue(formValues.MemoryLimit);
+    res.Env = KubernetesApplicationHelper.generateEnvFromEnvVariables(formValues.EnvironmentVariables);
+    KubernetesApplicationHelper.generateVolumesFromPersistentVolumClaims(res, volumeClaims);
+    KubernetesApplicationHelper.generateEnvOrVolumesFromConfigurations(res, formValues.ConfigMaps, formValues.Secrets);
+    KubernetesApplicationHelper.generateAffinityFromPlacements(res, formValues);
+    return res;
+  }
+
+  /**
+   * Generate CREATE payload from StatefulSet
+   * @param {KubernetesStatefulSetPayload} model StatefulSet to genereate payload from
+   */
+  static createPayload(statefulSet) {
+    const payload = new KubernetesStatefulSetCreatePayload();
+    payload.metadata.name = statefulSet.Name;
+    payload.metadata.namespace = statefulSet.Namespace;
+    if (statefulSet.StackName) {
+      payload.metadata.labels[KubernetesPortainerApplicationStackNameLabel] = statefulSet.StackName;
+    }
+    payload.metadata.labels[KubernetesPortainerApplicationNameLabel] = statefulSet.ApplicationName;
+    payload.metadata.labels[KubernetesPortainerApplicationOwnerLabel] = statefulSet.ApplicationOwner;
+    payload.metadata.annotations[KubernetesPortainerApplicationNote] = statefulSet.Note;
+    payload.spec.replicas = statefulSet.ReplicaCount;
+    payload.spec.serviceName = statefulSet.ServiceName;
+    payload.spec.selector.matchLabels.app = statefulSet.Name;
+    payload.spec.volumeClaimTemplates = _.map(statefulSet.VolumeClaims, (item) => KubernetesPersistentVolumeClaimConverter.createPayload(item));
+    payload.spec.template.metadata.labels.app = statefulSet.Name;
+    payload.spec.template.metadata.labels[KubernetesPortainerApplicationNameLabel] = statefulSet.ApplicationName;
+    payload.spec.template.spec.containers[0].name = statefulSet.Name;
+    if (statefulSet.ImageModel.Image) {
+      payload.spec.template.spec.containers[0].image = buildImageFullURIFromModel(statefulSet.ImageModel);
+      if (statefulSet.ImageModel.Registry && statefulSet.ImageModel.Registry.Authentication) {
+        payload.spec.template.spec.imagePullSecrets = [{ name: `registry-${statefulSet.ImageModel.Registry.Id}` }];
+      }
+    }
+    payload.spec.template.spec.affinity = statefulSet.Affinity;
+    KubernetesCommonHelper.assignOrDeleteIfEmpty(payload, 'spec.template.spec.containers[0].env', statefulSet.Env);
+    KubernetesCommonHelper.assignOrDeleteIfEmpty(payload, 'spec.template.spec.containers[0].volumeMounts', statefulSet.VolumeMounts);
+    KubernetesCommonHelper.assignOrDeleteIfEmpty(payload, 'spec.template.spec.volumes', statefulSet.Volumes);
+    if (statefulSet.MemoryLimit) {
+      payload.spec.template.spec.containers[0].resources.limits.memory = statefulSet.MemoryLimit;
+      payload.spec.template.spec.containers[0].resources.requests.memory = statefulSet.MemoryLimit;
+    }
+    if (statefulSet.CpuLimit) {
+      payload.spec.template.spec.containers[0].resources.limits.cpu = statefulSet.CpuLimit;
+      payload.spec.template.spec.containers[0].resources.requests.cpu = statefulSet.CpuLimit;
+    }
+    if (!statefulSet.CpuLimit && !statefulSet.MemoryLimit) {
+      delete payload.spec.template.spec.containers[0].resources;
+    }
+    return payload;
+  }
+
+  static patchPayload(oldSFS, newSFS) {
+    const oldPayload = KubernetesStatefulSetConverter.createPayload(oldSFS);
+    const newPayload = KubernetesStatefulSetConverter.createPayload(newSFS);
+    const payload = JsonPatch.compare(oldPayload, newPayload);
+    return payload;
+  }
+}
+
+export default KubernetesStatefulSetConverter;
diff --git a/app/kubernetes/converters/storageClass.js b/app/kubernetes/converters/storageClass.js
new file mode 100644
index 0000000..f2a4daa
--- /dev/null
+++ b/app/kubernetes/converters/storageClass.js
@@ -0,0 +1,34 @@
+import * as JsonPatch from 'fast-json-patch';
+
+import { KubernetesStorageClass } from '@/kubernetes/models/storage-class/models';
+import { KubernetesStorageClassCreatePayload } from '@/kubernetes/models/storage-class/payload';
+
+class KubernetesStorageClassConverter {
+  /**
+   * API storageClass to front storageClass
+   */
+  static apiToStorageClass(data) {
+    const res = new KubernetesStorageClass();
+    res.Name = data.metadata.name;
+    res.Provisioner = data.provisioner;
+    res.AllowVolumeExpansion = data.allowVolumeExpansion;
+    return res;
+  }
+
+  static createPayload(storageClass) {
+    const res = new KubernetesStorageClassCreatePayload();
+    res.metadata.name = storageClass.Name;
+    res.provisioner = storageClass.Provisioner;
+    res.allowVolumeExpansion = storageClass.AllowVolumeExpansion;
+    return res;
+  }
+
+  static patchPayload(oldStorageClass, newStorageClass) {
+    const oldPayload = KubernetesStorageClassConverter.createPayload(oldStorageClass);
+    const newPayload = KubernetesStorageClassConverter.createPayload(newStorageClass);
+    const payload = JsonPatch.compare(oldPayload, newPayload);
+    return payload;
+  }
+}
+
+export default KubernetesStorageClassConverter;
diff --git a/app/kubernetes/converters/volume.js b/app/kubernetes/converters/volume.js
new file mode 100644
index 0000000..5edb932
--- /dev/null
+++ b/app/kubernetes/converters/volume.js
@@ -0,0 +1,12 @@
+import { KubernetesVolume } from '@/kubernetes/models/volume/models';
+
+class KubernetesVolumeConverter {
+  static pvcToVolume(claim, pool) {
+    const res = new KubernetesVolume();
+    res.PersistentVolumeClaim = claim;
+    res.ResourcePool = pool;
+    return res;
+  }
+}
+
+export default KubernetesVolumeConverter;
diff --git a/app/kubernetes/custom-templates/index.js b/app/kubernetes/custom-templates/index.js
new file mode 100644
index 0000000..01d8a32
--- /dev/null
+++ b/app/kubernetes/custom-templates/index.js
@@ -0,0 +1,58 @@
+import angular from 'angular';
+
+export default angular.module('portainer.kubernetes.custom-templates', []).config(config).name;
+
+function config($stateRegistryProvider) {
+  const templates = {
+    name: 'kubernetes.templates',
+    url: '/templates',
+    abstract: true,
+  };
+
+  const customTemplates = {
+    name: 'kubernetes.templates.custom',
+    url: '/custom',
+
+    views: {
+      'content@': {
+        component: 'customTemplatesView',
+      },
+    },
+    data: {
+      docs: '/user/kubernetes/templates',
+    },
+  };
+
+  const customTemplatesNew = {
+    name: 'kubernetes.templates.custom.new',
+    url: '/new?fileContent',
+
+    views: {
+      'content@': {
+        component: 'createCustomTemplatesView',
+      },
+    },
+    params: {
+      fileContent: '',
+    },
+    data: {
+      docs: '/user/kubernetes/templates/add',
+    },
+  };
+
+  const customTemplatesEdit = {
+    name: 'kubernetes.templates.custom.edit',
+    url: '/:id',
+
+    views: {
+      'content@': {
+        component: 'editCustomTemplatesView',
+      },
+    },
+  };
+
+  $stateRegistryProvider.register(templates);
+  $stateRegistryProvider.register(customTemplates);
+  $stateRegistryProvider.register(customTemplatesNew);
+  $stateRegistryProvider.register(customTemplatesEdit);
+}
diff --git a/app/kubernetes/endpoint/converter.js b/app/kubernetes/endpoint/converter.js
new file mode 100644
index 0000000..fdbe98b
--- /dev/null
+++ b/app/kubernetes/endpoint/converter.js
@@ -0,0 +1,30 @@
+import _ from 'lodash-es';
+import { KubernetesEndpoint, KubernetesEndpointAnnotationLeader, KubernetesEndpointSubset } from '@/kubernetes/endpoint/models';
+
+class KubernetesEndpointConverter {
+  static apiToEndpoint(data) {
+    const res = new KubernetesEndpoint();
+    res.Id = data.metadata.uid;
+    res.Name = data.metadata.name;
+    res.Namespace = data.metadata.namespace;
+    const leaderAnnotation = data.metadata.annotations ? data.metadata.annotations[KubernetesEndpointAnnotationLeader] : '';
+    if (leaderAnnotation) {
+      const parsedJson = JSON.parse(leaderAnnotation);
+      const split = _.split(parsedJson.holderIdentity, '_');
+      res.HolderIdentity = split[0];
+    }
+
+    if (data.subsets) {
+      res.Subsets = _.map(data.subsets, (item) => {
+        const subset = new KubernetesEndpointSubset();
+        subset.Ips = _.map(item.addresses, 'ip');
+        const port = _.find(item.ports, { name: 'https' });
+        subset.Port = port ? port.port : undefined;
+        return subset;
+      });
+    }
+    return res;
+  }
+}
+
+export default KubernetesEndpointConverter;
diff --git a/app/kubernetes/endpoint/models.js b/app/kubernetes/endpoint/models.js
new file mode 100644
index 0000000..506573a
--- /dev/null
+++ b/app/kubernetes/endpoint/models.js
@@ -0,0 +1,29 @@
+export const KubernetesEndpointAnnotationLeader = 'control-plane.alpha.kubernetes.io/leader';
+
+/**
+ * KubernetesEndpoint Model
+ */
+const _KubernetesEndpoint = Object.freeze({
+  Id: '',
+  Name: '',
+  Namespace: '',
+  HolderIdentity: '',
+  Subsets: [],
+});
+
+export class KubernetesEndpoint {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesEndpoint)));
+  }
+}
+
+const _KubernetesEndpointSubset = Object.freeze({
+  Ips: [],
+  Port: 0,
+});
+
+export class KubernetesEndpointSubset {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesEndpointSubset)));
+  }
+}
diff --git a/app/kubernetes/endpoint/rest.js b/app/kubernetes/endpoint/rest.js
new file mode 100644
index 0000000..68cf483
--- /dev/null
+++ b/app/kubernetes/endpoint/rest.js
@@ -0,0 +1,24 @@
+angular.module('portainer.kubernetes').factory('KubernetesEndpoints', [
+  '$resource',
+  'API_ENDPOINT_ENDPOINTS',
+  'EndpointProvider',
+  function KubernetesEndpointsFactory($resource, API_ENDPOINT_ENDPOINTS, EndpointProvider) {
+    'use strict';
+    return function (namespace) {
+      const url = API_ENDPOINT_ENDPOINTS + '/:endpointId/kubernetes/api/v1' + (namespace ? '/namespaces/:namespace' : '') + '/endpoints/:id';
+      return $resource(
+        url,
+        {
+          endpointId: EndpointProvider.endpointID,
+          namespace: namespace,
+        },
+        {
+          get: {
+            method: 'GET',
+            ignoreLoadingBar: true,
+          },
+        }
+      );
+    };
+  },
+]);
diff --git a/app/kubernetes/endpoint/service.js b/app/kubernetes/endpoint/service.js
new file mode 100644
index 0000000..6690feb
--- /dev/null
+++ b/app/kubernetes/endpoint/service.js
@@ -0,0 +1,33 @@
+import _ from 'lodash-es';
+import angular from 'angular';
+import PortainerError from '@/portainer/error';
+import KubernetesEndpointConverter from '@/kubernetes/endpoint/converter';
+
+class KubernetesEndpointService {
+  /* @ngInject */
+  constructor($async, KubernetesEndpoints) {
+    this.$async = $async;
+    this.KubernetesEndpoints = KubernetesEndpoints;
+
+    this.getAllAsync = this.getAllAsync.bind(this);
+  }
+
+  /**
+   * GET
+   */
+  async getAllAsync(namespace) {
+    try {
+      const data = await this.KubernetesEndpoints(namespace).get().$promise;
+      return _.map(data.items, (item) => KubernetesEndpointConverter.apiToEndpoint(item));
+    } catch (err) {
+      throw new PortainerError('Unable to retrieve environments', err);
+    }
+  }
+
+  get(namespace) {
+    return this.$async(this.getAllAsync, namespace);
+  }
+}
+
+export default KubernetesEndpointService;
+angular.module('portainer.kubernetes').service('KubernetesEndpointService', KubernetesEndpointService);
diff --git a/app/kubernetes/filters/application.ts b/app/kubernetes/filters/application.ts
new file mode 100644
index 0000000..1bb7033
--- /dev/null
+++ b/app/kubernetes/filters/application.ts
@@ -0,0 +1,33 @@
+import { KubernetesPodNodeAffinityNodeSelectorRequirementOperators } from '../pod/models';
+
+export function nodeAffinityValues(
+  values: string | string[],
+  operator: KubernetesPodNodeAffinityNodeSelectorRequirementOperators
+) {
+  if (
+    operator === KubernetesPodNodeAffinityNodeSelectorRequirementOperators.IN ||
+    operator ===
+      KubernetesPodNodeAffinityNodeSelectorRequirementOperators.NOT_IN
+  ) {
+    return values;
+  }
+
+  if (
+    operator ===
+      KubernetesPodNodeAffinityNodeSelectorRequirementOperators.EXISTS ||
+    operator ===
+      KubernetesPodNodeAffinityNodeSelectorRequirementOperators.DOES_NOT_EXIST
+  ) {
+    return '';
+  }
+
+  if (
+    operator ===
+      KubernetesPodNodeAffinityNodeSelectorRequirementOperators.GREATER_THAN ||
+    operator ===
+      KubernetesPodNodeAffinityNodeSelectorRequirementOperators.LOWER_THAN
+  ) {
+    return values[0];
+  }
+  return '';
+}
diff --git a/app/kubernetes/filters/applicationFilters.js b/app/kubernetes/filters/applicationFilters.js
new file mode 100644
index 0000000..c6c3543
--- /dev/null
+++ b/app/kubernetes/filters/applicationFilters.js
@@ -0,0 +1,56 @@
+import { cpuHumanValue } from '@/react/kubernetes/applications/utils/cpuHumanValue';
+import { nodeAffinityValues } from './application';
+
+angular
+  .module('portainer.kubernetes')
+  .filter('kubernetesApplicationCPUValue', function () {
+    'use strict';
+    return cpuHumanValue;
+  })
+  .filter('kubernetesApplicationDataAccessPolicyIcon', function () {
+    'use strict';
+    return function (value) {
+      switch (value) {
+        case 'Isolated':
+          return 'boxes';
+        case 'Shared':
+          return 'box';
+      }
+    };
+  })
+  .filter('kubernetesApplicationDataAccessPolicyTooltip', function () {
+    'use strict';
+    return function (value) {
+      switch (value) {
+        case 'Isolated':
+          return 'All the instances of this application are using their own data.';
+        case 'Shared':
+          return 'All the instances of this application are sharing the same data.';
+      }
+    };
+  })
+  .filter('kubernetesApplicationConstraintNodeAffinityValue', function () {
+    'use strict';
+    return nodeAffinityValues;
+  })
+  .filter('kubernetesNodeLabelHumanReadbleText', function () {
+    'use strict';
+    return function (text) {
+      const values = {
+        'kubernetes.io/os': 'Operating system',
+        'kubernetes.io/arch': 'Architecture',
+        'kubernetes.io/hostname': 'Node',
+      };
+      return values[text] || text;
+    };
+  })
+  .filter('kubernetesApplicationIngressEmptyHostname', function () {
+    'use strict';
+    return function (value) {
+      if (value === '') {
+        return '<use IP>';
+      } else {
+        return value;
+      }
+    };
+  });
diff --git a/app/kubernetes/filters/configurationFilters.js b/app/kubernetes/filters/configurationFilters.js
new file mode 100644
index 0000000..7758c9a
--- /dev/null
+++ b/app/kubernetes/filters/configurationFilters.js
@@ -0,0 +1,13 @@
+import { KubernetesConfigurationKinds } from '@/kubernetes/models/configuration/models';
+
+angular.module('portainer.kubernetes').filter('kubernetesConfigurationKindText', function () {
+  'use strict';
+  return function (type) {
+    switch (type) {
+      case KubernetesConfigurationKinds.SECRET:
+        return 'Secret';
+      case KubernetesConfigurationKinds.CONFIGMAP:
+        return 'ConfigMap';
+    }
+  };
+});
diff --git a/app/kubernetes/filters/eventFilters.js b/app/kubernetes/filters/eventFilters.js
new file mode 100644
index 0000000..8414894
--- /dev/null
+++ b/app/kubernetes/filters/eventFilters.js
@@ -0,0 +1,16 @@
+import _ from 'lodash-es';
+
+angular.module('portainer.kubernetes').filter('kubernetesEventTypeColor', function () {
+  'use strict';
+  return function (text) {
+    var status = _.toLower(text);
+    switch (status) {
+      case 'normal':
+        return 'info';
+      case 'warning':
+        return 'warning';
+      default:
+        return 'danger';
+    }
+  };
+});
diff --git a/app/kubernetes/filters/filters.js b/app/kubernetes/filters/filters.js
new file mode 100644
index 0000000..6fcb031
--- /dev/null
+++ b/app/kubernetes/filters/filters.js
@@ -0,0 +1,11 @@
+angular.module('portainer.kubernetes').filter('kubernetesUsageLevelInfo', function () {
+  return function (usage) {
+    if (usage >= 80) {
+      return 'danger';
+    } else if (usage > 50 && usage < 80) {
+      return 'warning';
+    } else {
+      return 'success';
+    }
+  };
+});
diff --git a/app/kubernetes/helm/rest.js b/app/kubernetes/helm/rest.js
new file mode 100644
index 0000000..2d87a52
--- /dev/null
+++ b/app/kubernetes/helm/rest.js
@@ -0,0 +1,50 @@
+import angular from 'angular';
+
+angular.module('portainer.kubernetes').factory('HelmFactory', HelmFactory);
+
+/* @ngInject */
+function HelmFactory($resource, API_ENDPOINT_ENDPOINTS, API_ENDPOINT_USERS) {
+  const helmUrl = API_ENDPOINT_ENDPOINTS + '/:endpointId/kubernetes/helm';
+  const templatesUrl = 'api/templates/helm';
+  const userHelmUrl = API_ENDPOINT_USERS + '/:userId/helm';
+
+  return $resource(
+    helmUrl,
+    {},
+    {
+      templates: {
+        url: templatesUrl,
+        method: 'GET',
+        params: { repo: '@repo' },
+        cache: true,
+      },
+      show: {
+        url: `${templatesUrl}/:type`,
+        method: 'GET',
+        params: { repo: '@repo', chart: '@chart' },
+        transformResponse: function (data) {
+          return { values: data };
+        },
+      },
+      getHelmRepositories: {
+        method: 'GET',
+        url: `${userHelmUrl}/repositories`,
+      },
+      addHelmRepository: {
+        method: 'POST',
+        url: `${userHelmUrl}/repositories`,
+      },
+      list: {
+        method: 'GET',
+        isArray: true,
+        params: { namespace: '@namespace', selector: '@selector', filter: '@filter', output: '@output' },
+      },
+      install: { method: 'POST' },
+      uninstall: {
+        url: `${helmUrl}/:release`,
+        method: 'DELETE',
+        params: { namespace: '@namespace' },
+      },
+    }
+  );
+}
diff --git a/app/kubernetes/helm/service.js b/app/kubernetes/helm/service.js
new file mode 100644
index 0000000..c7ff115
--- /dev/null
+++ b/app/kubernetes/helm/service.js
@@ -0,0 +1,102 @@
+import angular from 'angular';
+import PortainerError from '@/portainer/error';
+
+angular.module('portainer.kubernetes').factory('HelmService', HelmService);
+
+/* @ngInject */
+export function HelmService(HelmFactory) {
+  return {
+    search,
+    values,
+    getHelmRepositories,
+    addHelmRepository,
+    install,
+    uninstall,
+    listReleases,
+  };
+
+  /**
+   * @description: Searches for all helm charts in a helm repo
+   * @param {string} repo - repo url to search charts for
+   * @returns {Promise} - Resolves with `index.yaml` of helm charts for a repo
+   * @throws {PortainerError} - Rejects with error if searching for the `index.yaml` fails
+   */
+  async function search(repo) {
+    try {
+      return await HelmFactory.templates({ repo }).$promise;
+    } catch (err) {
+      throw new PortainerError('Unable to retrieve helm charts', err);
+    }
+  }
+
+  /**
+   * @description: Show values helm of a helm chart, this basically runs `helm show values`
+   * @param {string} repo - repo url to search charts values for
+   * @param {string} chart - chart within the repo to retrieve default values
+   * @returns {Promise} - Resolves with `values.yaml` of helm chart values for a repo
+   * @throws {PortainerError} - Rejects with error if helm show fails
+   */
+  async function values(repo, chart) {
+    try {
+      return await HelmFactory.show({ repo, chart, type: 'values' }).$promise;
+    } catch (err) {
+      throw new PortainerError('Unable to retrieve values from chart', err);
+    }
+  }
+
+  /**
+   * @description: Get a list of all the helm repositories available for the current user
+   * @returns {Promise} - Resolves with an object containing list of user helm repos and default/global settings helm repo
+   * @throws {PortainerError} - Rejects with error if helm show fails
+   */
+  async function getHelmRepositories(userId) {
+    return await HelmFactory.getHelmRepositories({ userId }).$promise;
+  }
+
+  /**
+   * @description: Adds a helm repo for the calling user
+   * @param {Object} payload - helm repo url to add for the user
+   * @returns {Promise} - Resolves with `values.yaml` of helm chart values for a repo
+   * @throws {PortainerError} - Rejects with error if helm show fails
+   */
+  async function addHelmRepository(endpointId, payload) {
+    return await HelmFactory.addHelmRepository({ endpointId }, payload).$promise;
+  }
+
+  /**
+   * @description: Installs a helm chart, this basically runs `helm install`
+   * @returns {Promise} - Resolves with `values.yaml` of helm chart values for a repo
+   * @throws {PortainerError} - Rejects with error if helm show fails
+   */
+  async function install(endpointId, payload) {
+    return await HelmFactory.install({ endpointId }, payload).$promise;
+  }
+
+  /**
+   * @description: Uninstall a helm chart, this basically runs `helm uninstall`
+   * @param {Object} options - Options object, release `Name` is the only required option
+   * @throws {PortainerError} - Rejects with error if helm show fails
+   */
+  async function uninstall(endpointId, { Name, ResourcePool }) {
+    try {
+      await HelmFactory.uninstall({ endpointId, release: Name, namespace: ResourcePool }).$promise;
+    } catch (err) {
+      throw new PortainerError('Unable to delete release', err);
+    }
+  }
+
+  /**
+   * @description: List all helm releases based on passed in options, this basically runs `helm list`
+   * @param {Object} options - Supported CLI flags to pass to Helm (binary) - flags to `helm list`
+   * @returns {Promise} - Resolves with list of helm releases
+   * @throws {PortainerError} - Rejects with error if helm list fails
+   */
+  async function listReleases(endpointId, { namespace, selector, filter, output }) {
+    try {
+      const releases = await HelmFactory.list({ endpointId, selector, namespace, filter, output }).$promise;
+      return releases;
+    } catch (err) {
+      throw new PortainerError('Unable to retrieve release list', err);
+    }
+  }
+}
diff --git a/app/kubernetes/helpers/application/index.js b/app/kubernetes/helpers/application/index.js
new file mode 100644
index 0000000..276d136
--- /dev/null
+++ b/app/kubernetes/helpers/application/index.js
@@ -0,0 +1,589 @@
+import _ from 'lodash-es';
+import { KubernetesPortMapping, KubernetesPortMappingPort } from '@/kubernetes/models/port/models';
+import { KubernetesService, KubernetesServicePort, KubernetesServiceTypes } from '@/kubernetes/models/service/models';
+import { KubernetesConfigurationKinds } from '@/kubernetes/models/configuration/models';
+import {
+  KubernetesApplicationAutoScalerFormValue,
+  KubernetesApplicationConfigurationFormValue,
+  KubernetesApplicationConfigurationFormValueOverridenKey,
+  KubernetesApplicationEnvironmentVariableFormValue,
+  KubernetesApplicationPersistedFolderFormValue,
+  KubernetesApplicationPlacementFormValue,
+  KubernetesApplicationPublishedPortFormValue,
+} from '@/kubernetes/models/application/formValues';
+import {
+  KubernetesApplicationEnvConfigMapPayload,
+  KubernetesApplicationEnvPayload,
+  KubernetesApplicationEnvSecretPayload,
+  KubernetesApplicationVolumeConfigMapPayload,
+  KubernetesApplicationVolumeEntryPayload,
+  KubernetesApplicationVolumeMountPayload,
+  KubernetesApplicationVolumePersistentPayload,
+  KubernetesApplicationVolumeSecretPayload,
+} from '@/kubernetes/models/application/payloads';
+import { generatedApplicationConfigVolumeName } from '@/react/kubernetes/volumes/utils';
+import { HelmApplication } from '@/kubernetes/models/application/models';
+import { KubernetesApplicationDeploymentTypes, KubernetesApplicationTypes } from '@/kubernetes/models/application/models/appConstants';
+import { KubernetesPodAffinity, KubernetesPodNodeAffinityNodeSelectorRequirementOperators } from '@/kubernetes/pod/models';
+import {
+  KubernetesNodeSelectorRequirementPayload,
+  KubernetesNodeSelectorTermPayload,
+  KubernetesPodNodeAffinityPayload,
+  KubernetesPreferredSchedulingTermPayload,
+} from '@/kubernetes/pod/payloads/affinities';
+import { PodKubernetesInstanceLabel, PodManagedByLabel } from '@/react/kubernetes/applications/constants';
+
+class KubernetesApplicationHelper {
+  /* #region  UTILITY FUNCTIONS */
+  static isExternalApplication(application) {
+    return !application.ApplicationOwner;
+  }
+
+  static associatePodsAndApplication(pods, selector) {
+    return _.filter(pods, ['metadata.labels', selector.matchLabels]);
+  }
+
+  static associateContainerPersistedFoldersAndConfigurations(app, containers) {
+    _.forEach(containers, (container) => {
+      container.PersistedFolders = _.without(
+        _.map(app.PersistedFolders, (pf) => {
+          if (pf.MountPath && _.includes(_.map(container.VolumeMounts, 'mountPath'), pf.MountPath)) {
+            return pf;
+          }
+        }),
+        undefined
+      );
+
+      container.ConfigurationVolumes = _.without(
+        _.map(app.ConfigurationVolumes, (cv) => {
+          if (cv.rootMountPath && _.includes(_.map(container.VolumeMounts, 'mountPath'), cv.rootMountPath)) {
+            return cv;
+          }
+        }),
+        undefined
+      );
+    });
+  }
+
+  static associateContainersAndApplication(app) {
+    if (!app.Pods || app.Pods.length === 0) {
+      return [];
+    }
+    const containers = app.Pods[0].Containers;
+    KubernetesApplicationHelper.associateContainerPersistedFoldersAndConfigurations(app, containers);
+    return containers;
+  }
+
+  static portMappingsFromApplications(applications) {
+    const res = _.reduce(
+      applications,
+      (acc, app) => {
+        if (app.PublishedPorts.length > 0) {
+          const mapping = new KubernetesPortMapping();
+          mapping.Name = app.Name;
+          mapping.ResourcePool = app.ResourcePool;
+          mapping.ServiceType = app.ServiceType;
+          mapping.LoadBalancerIPAddress = app.LoadBalancerIPAddress;
+          mapping.ApplicationOwner = app.ApplicationOwner;
+
+          mapping.Ports = _.map(app.PublishedPorts, (item) => {
+            const port = new KubernetesPortMappingPort();
+            port.Port = mapping.ServiceType === KubernetesServiceTypes.NODE_PORT ? item.NodePort : item.Port;
+            port.TargetPort = item.TargetPort;
+            port.Protocol = item.Protocol;
+            port.IngressRules = item.IngressRules;
+            return port;
+          });
+          acc.push(mapping);
+        }
+        return acc;
+      },
+      []
+    );
+    return res;
+  }
+  /* #endregion */
+
+  /* #region  ENV VARIABLES FV <> ENV */
+  static generateEnvFromEnvVariables(envVariables) {
+    _.remove(envVariables, (item) => item.needsDeletion);
+    const env = _.map(envVariables, (item) => {
+      const res = new KubernetesApplicationEnvPayload();
+      res.name = item.name;
+      if (item.value === undefined) {
+        delete res.value;
+      } else {
+        res.value = item.value;
+      }
+      return res;
+    });
+    return env;
+  }
+
+  static generateEnvVariablesFromEnv(env) {
+    const envVariables = _.map(env, (item) => {
+      if (item.valueFrom) {
+        return;
+      }
+      const res = new KubernetesApplicationEnvironmentVariableFormValue();
+      res.name = item.name;
+      res.value = item.value;
+      res.isNew = false;
+      res.nameIndex = item.name;
+      return res;
+    });
+    return _.without(envVariables, undefined);
+  }
+  /* #endregion */
+
+  /* #region  CONFIGURATIONS FV <> ENV & VOLUMES */
+  static generateConfigurationFormValuesFromEnvAndVolumes(env, volumes, configurations, configurationKind) {
+    const filterCondition = configurationKind === KubernetesConfigurationKinds.CONFIGMAP ? 'valueFrom.configMapKeyRef.name' : 'valueFrom.secretKeyRef.name';
+    const finalRes = _.flatMap(configurations, (cfg) => {
+      const cfgEnv = _.filter(env, [filterCondition, cfg.Name]);
+      const cfgVol = volumes.filter((volume) => volume.configurationName === cfg.Name && volume.configurationType === configurationKind);
+      if (!cfgEnv.length && !cfgVol.length) {
+        return;
+      }
+      const keys = _.reduce(
+        _.keys(cfg.Data),
+        (acc, k) => {
+          const keyEnv = _.filter(cfgEnv, { name: k });
+          const keyVol = _.filter(cfgVol, { configurationKey: k });
+          const key = {
+            Key: k,
+            Count: keyEnv.length + keyVol.length,
+            Sum: _.concat(keyEnv, keyVol),
+            EnvCount: keyEnv.length,
+            VolCount: keyVol.length,
+          };
+          acc.push(key);
+          return acc;
+        },
+        []
+      );
+
+      const max = _.max(_.map(keys, 'Count'));
+      const overrideThreshold = max - _.max(_.map(keys, 'VolCount'));
+      const res = _.map(new Array(max), () => new KubernetesApplicationConfigurationFormValue());
+      _.forEach(res, (item, index) => {
+        item.selectedConfiguration = cfg;
+        // workaround to load configurations in the app in the select inputs
+        // this should be removed when the edit parent view is migrated to react
+        item.selectedConfiguration.metadata = {};
+        item.selectedConfiguration.metadata.name = cfg.Name;
+        const overriden = index >= overrideThreshold;
+        if (overriden) {
+          item.overriden = true;
+          item.overridenKeys = _.map(keys, (k) => {
+            const fvKey = new KubernetesApplicationConfigurationFormValueOverridenKey();
+            fvKey.key = k.Key;
+            if (!k.Count) {
+              // !k.Count indicates k.key is new added to the configuration and has not been loaded to the application yet
+              fvKey.type = 'NONE';
+            } else if (index < k.EnvCount) {
+              fvKey.type = 'ENVIRONMENT';
+            } else {
+              fvKey.type = 'FILESYSTEM';
+              fvKey.path = k.Sum[index].rootMountPath;
+            }
+            return fvKey;
+          });
+        }
+      });
+      return res;
+    });
+    return _.without(finalRes, undefined);
+  }
+
+  static generateEnvOrVolumesFromConfigurations(app, configMaps, secrets) {
+    const configurations = [...configMaps, ...secrets];
+    let finalEnv = [];
+    let finalVolumes = [];
+    let finalMounts = [];
+
+    _.forEach(configurations, (config) => {
+      const isBasic = config.selectedConfiguration.kind === 'ConfigMap';
+
+      if (!config.overriden) {
+        const envKeys = _.keys(config.selectedConfiguration.data);
+        _.forEach(envKeys, (item) => {
+          const res = isBasic ? new KubernetesApplicationEnvConfigMapPayload() : new KubernetesApplicationEnvSecretPayload();
+          res.name = item;
+          if (isBasic) {
+            res.valueFrom.configMapKeyRef.name = config.selectedConfiguration.metadata.name;
+            res.valueFrom.configMapKeyRef.key = item;
+          } else {
+            res.valueFrom.secretKeyRef.name = config.selectedConfiguration.metadata.name;
+            res.valueFrom.secretKeyRef.key = item;
+          }
+          finalEnv.push(res);
+        });
+      } else {
+        const envKeys = _.filter(config.overridenKeys, (item) => item.type === 'ENVIRONMENT');
+        _.forEach(envKeys, (item) => {
+          const res = isBasic ? new KubernetesApplicationEnvConfigMapPayload() : new KubernetesApplicationEnvSecretPayload();
+          res.name = item.key;
+          if (isBasic) {
+            res.valueFrom.configMapKeyRef.name = config.selectedConfiguration.metadata.name;
+            res.valueFrom.configMapKeyRef.key = item.key;
+          } else {
+            res.valueFrom.secretKeyRef.name = config.selectedConfiguration.metadata.name;
+            res.valueFrom.secretKeyRef.key = item.key;
+          }
+          finalEnv.push(res);
+        });
+
+        const volKeys = _.filter(config.overridenKeys, (item) => item.type === 'FILESYSTEM');
+        const groupedVolKeys = _.groupBy(volKeys, 'path');
+        _.forEach(groupedVolKeys, (items, path) => {
+          const volumeName = generatedApplicationConfigVolumeName(app.Name);
+          const configurationName = config.selectedConfiguration.metadata.name;
+          const itemsMap = _.map(items, (item) => {
+            const entry = new KubernetesApplicationVolumeEntryPayload();
+            entry.key = item.key;
+            entry.path = item.key;
+            return entry;
+          });
+
+          const mount = isBasic ? new KubernetesApplicationVolumeMountPayload() : new KubernetesApplicationVolumeMountPayload(true);
+          const volume = isBasic ? new KubernetesApplicationVolumeConfigMapPayload() : new KubernetesApplicationVolumeSecretPayload();
+
+          mount.name = volumeName;
+          mount.mountPath = path;
+          volume.name = volumeName;
+          if (isBasic) {
+            volume.configMap.name = configurationName;
+            volume.configMap.items = itemsMap;
+          } else {
+            volume.secret.secretName = configurationName;
+            volume.secret.items = itemsMap;
+          }
+
+          finalMounts.push(mount);
+          finalVolumes.push(volume);
+        });
+      }
+    });
+    app.Env = _.concat(app.Env, finalEnv);
+    app.Volumes = _.concat(app.Volumes, finalVolumes);
+    app.VolumeMounts = _.concat(app.VolumeMounts, finalMounts);
+    return app;
+  }
+  /* #endregion */
+
+  /* #region  SERVICES -> SERVICES FORM VALUES */
+  static generateServicesFormValuesFromServices(app, ingresses) {
+    let services = [];
+    if (app.Services) {
+      app.Services.forEach(function (service) {
+        //skip generate formValues if service = headless service ( clusterIp === "None" )
+        if (service.spec.clusterIP !== 'None') {
+          const svc = new KubernetesService();
+          svc.Namespace = service.metadata.namespace;
+          svc.Name = service.metadata.name;
+          svc.StackName = service.StackName;
+          svc.ApplicationOwner = app.ApplicationOwner;
+          svc.ApplicationName = app.ApplicationName;
+          svc.Type = service.spec.type;
+
+          let ports = [];
+          service.spec.ports.forEach(function (port) {
+            const svcport = new KubernetesServicePort();
+            svcport.name = port.name;
+            svcport.port = port.port;
+            svcport.nodePort = port.nodePort || 0;
+            svcport.protocol = port.protocol;
+            svcport.targetPort = port.targetPort;
+            svcport.serviceName = service.metadata.name;
+            svcport.ingressPaths = [];
+
+            ingresses.forEach((ingress) => {
+              const matchingIngressPaths = ingress.Paths.filter((ingPath) => ingPath.ServiceName === service.metadata.name && ingPath.Port === port.port);
+              // only add ingress info to the port if the ingress serviceport and name matches
+              const newPaths = matchingIngressPaths.map((ingPath) => ({
+                IngressName: ingPath.IngressName,
+                Host: ingPath.Host,
+                Path: ingPath.Path,
+              }));
+              svcport.ingressPaths = [...svcport.ingressPaths, ...newPaths];
+              svc.Ingress = matchingIngressPaths.length > 0;
+            });
+
+            ports.push(svcport);
+          });
+          svc.Ports = ports;
+          // if the app is a pod (doesn't have a selector), then get the pod labels
+          if (app.Raw.spec.selector) {
+            svc.Selector = app.Raw.spec.selector.matchLabels;
+          } else {
+            svc.Selector = app.Raw.metadata.labels || { app: app.Name };
+          }
+          services.push(svc);
+        }
+      });
+
+      return services;
+    }
+  }
+  /* #endregion */
+  static generateSelectorFromService(app) {
+    if (app.Raw.kind !== 'Pod') {
+      const selector = app.Raw.spec.selector.matchLabels;
+      return selector;
+    }
+  }
+
+  /* #region  PUBLISHED PORTS FV <> PUBLISHED PORTS */
+  static generatePublishedPortsFormValuesFromPublishedPorts(serviceType, publishedPorts, ingress) {
+    const generatePort = (port, rule) => {
+      const res = new KubernetesApplicationPublishedPortFormValue();
+      res.IsNew = false;
+      if (rule) {
+        res.IngressName = rule.IngressName;
+        res.IngressRoute = rule.Path;
+        res.IngressHost = rule.Host;
+        res.IngressHosts = ingress && ingress.find((i) => i.Name === rule.IngressName).Hosts;
+      }
+      res.Protocol = port.Protocol;
+      res.ContainerPort = port.TargetPort;
+      if (serviceType === KubernetesServiceTypes.LOAD_BALANCER) {
+        res.LoadBalancerPort = port.Port;
+        res.LoadBalancerNodePort = port.NodePort;
+      } else if (serviceType === KubernetesServiceTypes.NODE_PORT) {
+        res.NodePort = port.NodePort;
+      }
+      return res;
+    };
+
+    const finalRes = _.flatMap(publishedPorts, (port) => {
+      if (port.IngressRules.length) {
+        return _.map(port.IngressRules, (rule) => generatePort(port, rule));
+      }
+      return generatePort(port);
+    });
+    return finalRes;
+  }
+  /* #endregion */
+
+  /* #region  AUTOSCALER FV <> HORIZONTAL POD AUTOSCALER */
+  static generateAutoScalerFormValueFromHorizontalPodAutoScaler(autoScaler, replicasCount) {
+    const res = new KubernetesApplicationAutoScalerFormValue();
+    if (autoScaler) {
+      res.isUsed = true;
+      res.minReplicas = autoScaler.MinReplicas;
+      res.maxReplicas = autoScaler.MaxReplicas;
+      res.targetCpuUtilizationPercentage = autoScaler.TargetCPUUtilization;
+      res.apiVersion = autoScaler.ApiVersion;
+    } else {
+      res.apiVersion = 'apps/v1';
+      res.minReplicas = replicasCount;
+      res.maxReplicas = replicasCount;
+    }
+    return res;
+  }
+
+  /* #endregion */
+
+  /* #region  PERSISTED FOLDERS FV <> VOLUMES */
+  static generatePersistedFoldersFormValuesFromPersistedFolders(persistedFolders, persistentVolumeClaims) {
+    const finalRes = _.map(persistedFolders, (folder) => {
+      const pvc = _.find(persistentVolumeClaims, (item) => _.startsWith(item.Name, folder.persistentVolumeClaimName));
+      const res = new KubernetesApplicationPersistedFolderFormValue(pvc.storageClass);
+      res.persistentVolumeClaimName = folder.persistentVolumeClaimName;
+      res.size = pvc.Storage.slice(0, -2); // remove trailing units
+      res.sizeUnit = pvc.Storage.slice(-2);
+      res.containerPath = folder.MountPath;
+      return res;
+    });
+    return finalRes;
+  }
+
+  static generateVolumesFromPersistentVolumClaims(app, volumeClaims) {
+    app.VolumeMounts = [];
+    app.Volumes = [];
+    _.forEach(volumeClaims, (item) => {
+      const volumeMount = new KubernetesApplicationVolumeMountPayload();
+      const name = item.Name;
+      volumeMount.name = name;
+      volumeMount.mountPath = item.MountPath;
+      app.VolumeMounts.push(volumeMount);
+
+      const volume = new KubernetesApplicationVolumePersistentPayload();
+      volume.name = name;
+      volume.persistentVolumeClaim.claimName = name;
+      app.Volumes.push(volume);
+    });
+  }
+
+  static hasRWOOnly(formValues) {
+    return _.find(formValues.PersistedFolders, (item) => item.storageClass && _.isEqual(item.storageClass.AccessModes, ['RWO']));
+  }
+
+  static hasRWX(claims) {
+    return _.find(claims, (item) => item.storageClass && _.includes(item.storageClass.AccessModes, 'RWX')) !== undefined;
+  }
+  /* #endregion */
+
+  /* #region  PLACEMENTS FV <> AFFINITY */
+  static generatePlacementsFormValuesFromAffinity(formValues, podAffinity) {
+    let placements = formValues.Placements;
+    let type = formValues.PlacementType;
+    const affinity = podAffinity.nodeAffinity;
+    if (affinity && affinity.requiredDuringSchedulingIgnoredDuringExecution) {
+      type = 'mandatory';
+      _.forEach(affinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms, (term) => {
+        _.forEach(term.matchExpressions, (exp) => {
+          const placement = new KubernetesApplicationPlacementFormValue();
+          placement.label = exp.key;
+          placement.value = exp.values[0];
+          placement.isNew = false;
+          placements.push(placement);
+        });
+      });
+    } else if (affinity && affinity.preferredDuringSchedulingIgnoredDuringExecution) {
+      type = 'preferred';
+      _.forEach(affinity.preferredDuringSchedulingIgnoredDuringExecution, (term) => {
+        _.forEach(term.preference.matchExpressions, (exp) => {
+          const placement = new KubernetesApplicationPlacementFormValue();
+          placement.label = exp.key;
+          placement.value = exp.values[0];
+          placement.isNew = false;
+          placements.push(placement);
+        });
+      });
+    }
+    formValues.Placements = placements;
+    formValues.PlacementType = type;
+  }
+
+  static generateAffinityFromPlacements(app, formValues) {
+    if (formValues.DeploymentType === KubernetesApplicationDeploymentTypes.Replicated) {
+      const placements = formValues.Placements;
+      const res = new KubernetesPodNodeAffinityPayload();
+      let expressions = _.map(placements, (p) => {
+        if (!p.needsDeletion) {
+          const exp = new KubernetesNodeSelectorRequirementPayload();
+          exp.key = p.label;
+          if (p.value) {
+            exp.operator = KubernetesPodNodeAffinityNodeSelectorRequirementOperators.IN;
+            exp.values = [p.value];
+          } else {
+            exp.operator = KubernetesPodNodeAffinityNodeSelectorRequirementOperators.EXISTS;
+            delete exp.values;
+          }
+          return exp;
+        }
+      });
+      expressions = _.without(expressions, undefined);
+      if (expressions.length) {
+        if (formValues.PlacementType === 'mandatory') {
+          const term = new KubernetesNodeSelectorTermPayload();
+          term.matchExpressions = expressions;
+          res.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms.push(term);
+          delete res.preferredDuringSchedulingIgnoredDuringExecution;
+        } else if (formValues.PlacementType === 'preferred') {
+          const term = new KubernetesPreferredSchedulingTermPayload();
+          term.preference = new KubernetesNodeSelectorTermPayload();
+          term.preference.matchExpressions = expressions;
+          res.preferredDuringSchedulingIgnoredDuringExecution.push(term);
+          delete res.requiredDuringSchedulingIgnoredDuringExecution;
+        }
+        app.Affinity = new KubernetesPodAffinity();
+        app.Affinity.nodeAffinity = res;
+      }
+    }
+  }
+  /* #endregion */
+
+  /**
+   * Get Helm managed applications
+   * @param {KubernetesApplication[]} applications Application list
+   * @returns {Object} { [releaseName]: [app1, app2, ...], [releaseName2]: [app3, app4, ...] }
+   */
+  static getHelmApplications(applications) {
+    // filter out all the applications that are managed by helm
+    // to identify the helm managed applications, we need to check if the applications pod labels include
+    // `app.kubernetes.io/instance` and `app.kubernetes.io/managed-by` = `helm`
+    const helmManagedApps = applications.filter(
+      (app) => app.Metadata.labels && app.Metadata.labels[PodKubernetesInstanceLabel] && app.Metadata.labels[PodManagedByLabel] === 'Helm'
+    );
+
+    // groups the helm managed applications by helm release name
+    // the release name is retrieved from the `app.kubernetes.io/instance` label on the pods within the apps
+    // `namespacedHelmReleases` object structure:
+    // {
+    //   [namespace1]: {
+    //     [releaseName]: [app1, app2, ...],
+    //   },
+    //   [namespace2]: {
+    //     [releaseName2]: [app1, app2, ...],
+    //   }
+    // }
+    const namespacedHelmReleases = {};
+    helmManagedApps.forEach((app) => {
+      const namespace = app.ResourcePool;
+      const instanceLabel = app.Metadata.labels[PodKubernetesInstanceLabel];
+      if (namespacedHelmReleases[namespace]) {
+        namespacedHelmReleases[namespace][instanceLabel] = [...(namespacedHelmReleases[namespace][instanceLabel] || []), app];
+      } else {
+        namespacedHelmReleases[namespace] = { [instanceLabel]: [app] };
+      }
+    });
+
+    // `helmAppsEntriesList` object structure:
+    // [
+    //   ["airflow-test", Array(5)],
+    //   ["traefik", Array(1)],
+    //   ["airflow-test", Array(2)],
+    //   ...,
+    // ]
+    const helmAppsEntriesList = Object.values(namespacedHelmReleases).flatMap((r) => Object.entries(r));
+    const helmAppsList = helmAppsEntriesList.map(([helmInstance, applications]) => {
+      const helmApp = new HelmApplication();
+      helmApp.Name = helmInstance;
+      helmApp.ApplicationType = KubernetesApplicationTypes.Helm;
+      helmApp.ApplicationOwner = applications[0].ApplicationOwner;
+      helmApp.KubernetesApplications = applications;
+
+      // the status of helm app is `Ready` based on whether the underlying RunningPodsCount of the k8s app
+      // reaches the TotalPodsCount of the app
+      const appsNotReady = applications.some((app) => app.RunningPodsCount < app.TotalPodsCount);
+      helmApp.Status = appsNotReady ? 'Not ready' : 'Ready';
+
+      // use earliest date
+      helmApp.CreationDate = applications.map((app) => app.CreationDate).sort((a, b) => new Date(a) - new Date(b))[0];
+
+      // use first app namespace as helm app namespace
+      helmApp.ResourcePool = applications[0].ResourcePool;
+
+      // required for persisting table expansion state and differenting same named helm apps across different namespaces
+      helmApp.Id = helmApp.ResourcePool + '-' + helmApp.Name.toLowerCase().replaceAll(' ', '-');
+
+      return helmApp;
+    });
+
+    return helmAppsList;
+  }
+
+  /**
+   * Get nested applications -
+   * @param {KubernetesApplication[]} applications Application list
+   * @returns {Object} { helmApplications: [app1, app2, ...], nonHelmApplications: [app3, app4, ...] }
+   */
+  static getNestedApplications(applications) {
+    const helmApplications = KubernetesApplicationHelper.getHelmApplications(applications);
+
+    // filter out helm managed applications
+    const helmAppNames = [...new Set(helmApplications.map((hma) => hma.Name))]; // distinct helm app names
+    const nonHelmApplications = applications.filter((app) => {
+      if (app.Metadata.labels) {
+        return !helmAppNames.includes(app.Metadata.labels[PodKubernetesInstanceLabel]);
+      }
+      return true;
+    });
+
+    return { helmApplications, nonHelmApplications };
+  }
+}
+export default KubernetesApplicationHelper;
diff --git a/app/kubernetes/helpers/commonHelper.js b/app/kubernetes/helpers/commonHelper.js
new file mode 100644
index 0000000..1ad2ba3
--- /dev/null
+++ b/app/kubernetes/helpers/commonHelper.js
@@ -0,0 +1,28 @@
+import _ from 'lodash-es';
+
+class KubernetesCommonHelper {
+  static assignOrDeleteIfEmpty(obj, path, value) {
+    if (!value || (value instanceof Array && !value.length)) {
+      _.unset(obj, path);
+    } else {
+      _.set(obj, path, value);
+    }
+  }
+
+  static ownerToLabel(owner) {
+    let label = _.replace(owner, /[^-A-Za-z0-9_.]/g, '.');
+    label = _.truncate(label, { length: 63, omission: '' });
+    label = _.replace(label, /^[-_.]*/g, '');
+    label = _.replace(label, /[-_.]*$/g, '');
+    return label;
+  }
+
+  static assignOrDeleteIfEmptyOrZero(obj, path, value) {
+    if (!value || value === 0 || (value instanceof Array && !value.length)) {
+      _.unset(obj, path);
+    } else {
+      _.set(obj, path, value);
+    }
+  }
+}
+export default KubernetesCommonHelper;
diff --git a/app/kubernetes/helpers/configMapHelper.js b/app/kubernetes/helpers/configMapHelper.js
new file mode 100644
index 0000000..a794905
--- /dev/null
+++ b/app/kubernetes/helpers/configMapHelper.js
@@ -0,0 +1,36 @@
+import _ from 'lodash-es';
+
+import { KubernetesPortainerConfigMapAccessKey } from '@/kubernetes/models/config-map/models';
+import { UserAccessViewModel, TeamAccessViewModel } from '@/portainer/models/access';
+
+class KubernetesConfigMapHelper {
+  static parseJSONData(configMap) {
+    _.forIn(configMap.Data, (value, key) => {
+      try {
+        configMap.Data[key] = JSON.parse(value);
+      } catch (err) {
+        configMap.Data[key] = value;
+      }
+    });
+    return configMap;
+  }
+
+  static modifiyNamespaceAccesses(configMap, namespace, accesses) {
+    configMap.Data[KubernetesPortainerConfigMapAccessKey][namespace] = {
+      UserAccessPolicies: {},
+      TeamAccessPolicies: {},
+    };
+    _.forEach(accesses, (item) => {
+      if (item instanceof UserAccessViewModel) {
+        configMap.Data[KubernetesPortainerConfigMapAccessKey][namespace].UserAccessPolicies[item.Id] = { RoleId: 0 };
+      } else if (item instanceof TeamAccessViewModel) {
+        configMap.Data[KubernetesPortainerConfigMapAccessKey][namespace].TeamAccessPolicies[item.Id] = { RoleId: 0 };
+      }
+    });
+    _.forIn(configMap.Data, (value, key) => {
+      configMap.Data[key] = JSON.stringify(value);
+    });
+    return configMap;
+  }
+}
+export default KubernetesConfigMapHelper;
diff --git a/app/kubernetes/helpers/configurationHelper.js b/app/kubernetes/helpers/configurationHelper.js
new file mode 100644
index 0000000..6bd7758
--- /dev/null
+++ b/app/kubernetes/helpers/configurationHelper.js
@@ -0,0 +1,87 @@
+import _ from 'lodash-es';
+import YAML from 'yaml';
+import { KubernetesConfigurationKinds } from '@/kubernetes/models/configuration/models';
+import { KubernetesConfigurationFormValuesEntry } from '@/kubernetes/models/configuration/formvalues';
+
+class KubernetesConfigurationHelper {
+  static getUsingApplications(config, applications) {
+    return _.filter(applications, (app) => {
+      let envFind;
+      let volumeFind;
+      if (config.Kind === KubernetesConfigurationKinds.CONFIGMAP) {
+        envFind = _.find(app.Env, { valueFrom: { configMapKeyRef: { name: config.Name } } });
+        volumeFind = _.find(app.Volumes, { configMap: { name: config.Name } });
+      } else {
+        envFind = _.find(app.Env, { valueFrom: { secretKeyRef: { name: config.Name } } });
+        volumeFind = _.find(app.Volumes, { secret: { secretName: config.Name } });
+      }
+      return envFind || volumeFind;
+    });
+  }
+
+  static isSystemToken(config) {
+    return _.startsWith(config.Name, 'default-token-');
+  }
+
+  static isBinary(encoding) {
+    return encoding !== '' && !_.includes(encoding, 'ISO') && !_.includes(encoding, 'UTF');
+  }
+
+  static setConfigurationUsed(config) {
+    config.Used = config.Applications && config.Applications.length !== 0;
+  }
+
+  static setConfigurationsUsed(configurations, applications) {
+    _.forEach(configurations, (config) => {
+      config.Applications = KubernetesConfigurationHelper.getUsingApplications(config, applications);
+      KubernetesConfigurationHelper.setConfigurationUsed(config);
+    });
+  }
+
+  static getApplicationConfigurations(applications, configurations) {
+    const configurationsUsed = configurations.filter((config) => KubernetesConfigurationHelper.getUsingApplications(config, applications).length !== 0);
+    // set the configurations used for each application in the list
+    const configuredApps = applications.map((app) => {
+      const configMappedByName = configurationsUsed.filter((config) => app.ApplicationName === config.Name && app.ResourcePool === config.Namespace);
+      const configMappedByVolume = configurationsUsed
+        .filter((config) => app.ConfigurationVolumes.some((cv) => cv.configurationName === config.Name))
+        .filter((config) => !configMappedByName.some((c) => c.Name === config.Name)); // filter out duplicates that are mapped by name
+      app.Configurations = [...configMappedByName, ...configMappedByVolume];
+      return app;
+    });
+    return configuredApps;
+  }
+
+  static parseYaml(formValues) {
+    YAML.defaultOptions.customTags = ['binary'];
+    const data = _.map(YAML.parse(formValues.DataYaml), (value, key) => {
+      const entry = new KubernetesConfigurationFormValuesEntry();
+      entry.Key = key;
+      entry.Value = value;
+      const oldEntry = _.find(formValues.Data, { Key: entry.Key });
+      entry.IsBinary = oldEntry ? oldEntry.IsBinary : false;
+      return entry;
+    });
+    return data;
+  }
+
+  static parseData(formValues) {
+    if (!formValues.Data.length) return '';
+
+    const data = _.reduce(
+      formValues.Data,
+      (acc, entry) => {
+        acc[entry.Key] = entry.Value;
+        return acc;
+      },
+      {}
+    );
+    return YAML.stringify(data);
+  }
+
+  static isExternalConfiguration(configuration) {
+    return !configuration.ConfigurationOwner;
+  }
+}
+
+export default KubernetesConfigurationHelper;
diff --git a/app/kubernetes/helpers/eventHelper.js b/app/kubernetes/helpers/eventHelper.js
new file mode 100644
index 0000000..7cc0cc8
--- /dev/null
+++ b/app/kubernetes/helpers/eventHelper.js
@@ -0,0 +1,10 @@
+import _ from 'lodash-es';
+
+class KubernetesEventHelper {
+  static warningCount(events) {
+    const warnings = _.filter(events, (event) => event.Type === 'Warning');
+    return warnings.length;
+  }
+}
+
+export default KubernetesEventHelper;
diff --git a/app/kubernetes/helpers/formValidationHelper.js b/app/kubernetes/helpers/formValidationHelper.js
new file mode 100644
index 0000000..01f6277
--- /dev/null
+++ b/app/kubernetes/helpers/formValidationHelper.js
@@ -0,0 +1,38 @@
+import _ from 'lodash-es';
+
+class KubernetesFormValidationHelper {
+  static getInvalidKeys(names) {
+    const res = {};
+    _.forEach(names, (name, index) => {
+      if (name) {
+        const valid = /^[-._a-zA-Z0-9]+$/.test(name);
+        if (!valid) {
+          res[index] = true;
+        }
+      }
+    });
+    return res;
+  }
+
+  static getDuplicates(names) {
+    const grouped = _.groupBy(names);
+    const res = {};
+    _.forEach(names, (name, index) => {
+      if (name && grouped[name].length > 1) {
+        res[index] = name;
+      }
+    });
+    return res;
+  }
+
+  static getDuplicateNodePorts(serviceNodePorts, allOtherNodePorts) {
+    const res = {};
+    serviceNodePorts.forEach((sNodePort, index) => {
+      if (allOtherNodePorts.includes(sNodePort) || serviceNodePorts.filter((snp) => snp === sNodePort).length > 1) {
+        res[index] = sNodePort;
+      }
+    });
+    return res;
+  }
+}
+export default KubernetesFormValidationHelper;
diff --git a/app/kubernetes/helpers/namespaceHelper.js b/app/kubernetes/helpers/namespaceHelper.js
new file mode 100644
index 0000000..538597d
--- /dev/null
+++ b/app/kubernetes/helpers/namespaceHelper.js
@@ -0,0 +1,34 @@
+import _ from 'lodash-es';
+
+import { KUBERNETES_DEFAULT_SYSTEM_NAMESPACES } from '@/kubernetes/models/namespace/models';
+import { isSystem } from '@/kubernetes/store/namespace';
+import { isDefaultNamespace } from '@/react/kubernetes/namespaces/isDefaultNamespace';
+
+export default class KubernetesNamespaceHelper {
+  /**
+   * Check if namespace is system or not
+   * @param {String} namespace Namespace (string name) to evaluate
+   * @returns Boolean
+   */
+  static isSystemNamespace(namespace) {
+    return isSystem(namespace);
+  }
+
+  /**
+   * Check if namespace is default or not
+   * @param {String} namespace Namespace (string name) to evaluate
+   * @returns Boolean
+   */
+  static isDefaultNamespace(namespace) {
+    return isDefaultNamespace(namespace);
+  }
+
+  /**
+   * Check if namespace is one of the default system namespaces
+   * @param {String} namespace Namespace (string name) to evaluate
+   * @returns Boolean
+   */
+  static isDefaultSystemNamespace(namespace) {
+    return _.includes(KUBERNETES_DEFAULT_SYSTEM_NAMESPACES, namespace);
+  }
+}
diff --git a/app/kubernetes/helpers/resourceQuotaHelper.js b/app/kubernetes/helpers/resourceQuotaHelper.js
new file mode 100644
index 0000000..c221e0c
--- /dev/null
+++ b/app/kubernetes/helpers/resourceQuotaHelper.js
@@ -0,0 +1,31 @@
+import { KubernetesPortainerResourceQuotaPrefix } from '@/kubernetes/models/resource-quota/models';
+
+class KubernetesResourceQuotaHelper {
+  static generateResourceQuotaName(name) {
+    return KubernetesPortainerResourceQuotaPrefix + name;
+  }
+
+  static formatBytes(bytes, decimals = 0, base10 = true) {
+    const res = {
+      size: 0,
+      sizeUnit: 'B',
+    };
+
+    if (bytes === 0) {
+      return res;
+    }
+
+    const k = base10 ? 1000 : 1024;
+    const dm = decimals < 0 ? 0 : decimals;
+    const sizes = ['B', 'KB', 'MB', 'GB', 'TB', 'PB', 'EB', 'ZB', 'YB'];
+
+    const i = Math.floor(Math.log(bytes) / Math.log(k));
+
+    return {
+      size: parseFloat((bytes / Math.pow(k, i)).toFixed(dm)),
+      sizeUnit: sizes[i],
+    };
+  }
+}
+
+export default KubernetesResourceQuotaHelper;
diff --git a/app/kubernetes/helpers/resourceReservationHelper.js b/app/kubernetes/helpers/resourceReservationHelper.js
new file mode 100644
index 0000000..d7782da
--- /dev/null
+++ b/app/kubernetes/helpers/resourceReservationHelper.js
@@ -0,0 +1,45 @@
+import _ from 'lodash-es';
+import filesizeParser from 'filesize-parser';
+import { KubernetesResourceReservation } from '@/kubernetes/models/resource-reservation/models';
+import { parseCPU } from '@/react/kubernetes/utils';
+
+class KubernetesResourceReservationHelper {
+  static computeResourceReservation(pods) {
+    const containers = _.reduce(pods, (acc, pod) => _.concat(acc, pod.Containers), []);
+
+    return _.reduce(
+      containers,
+      (acc, container) => {
+        if (container.Requests) {
+          if (container.Requests.memory) {
+            acc.Memory += safeFilesizeParser(container.Requests.memory, { base: 10 });
+          }
+
+          if (container.Requests.cpu) {
+            acc.CPU += parseCPU(container.Requests.cpu);
+          }
+        }
+
+        return acc;
+      },
+      new KubernetesResourceReservation()
+    );
+  }
+
+  static megaBytesValue(value) {
+    return Math.floor(safeFilesizeParser(value) / 1000 / 1000);
+  }
+
+  static bytesValue(mem) {
+    return safeFilesizeParser(mem) * 1000 * 1000;
+  }
+}
+export default KubernetesResourceReservationHelper;
+
+function safeFilesizeParser(value, options) {
+  if (!value || Number.isNaN(value)) {
+    return 0;
+  }
+
+  return filesizeParser(value, options);
+}
diff --git a/app/kubernetes/helpers/serviceHelper.js b/app/kubernetes/helpers/serviceHelper.js
new file mode 100644
index 0000000..ea86a6a
--- /dev/null
+++ b/app/kubernetes/helpers/serviceHelper.js
@@ -0,0 +1,25 @@
+import _ from 'lodash-es';
+import { KubernetesServiceHeadlessPrefix } from '@/kubernetes/models/service/models';
+
+class KubernetesServiceHelper {
+  static generateHeadlessServiceName(name) {
+    return KubernetesServiceHeadlessPrefix + name;
+  }
+
+  static findApplicationBoundService(services, rawApp) {
+    if (!rawApp.spec.template) {
+      return undefined;
+    }
+    return _.find(services, (item) => item.spec.selector && _.isMatch(rawApp.spec.template.metadata.labels, item.spec.selector));
+  }
+
+  static findApplicationBoundServices(services, rawApp) {
+    // if the app is a naked pod (doesn't have a template), then get the pod labels
+    const appLabels = rawApp.spec.template ? rawApp.spec.template.metadata.labels : rawApp.metadata.labels;
+    if (!appLabels) {
+      return undefined;
+    }
+    return _.filter(services, (item) => item.spec.selector && _.isMatch(appLabels, item.spec.selector));
+  }
+}
+export default KubernetesServiceHelper;
diff --git a/app/kubernetes/helpers/volumeHelper.js b/app/kubernetes/helpers/volumeHelper.js
new file mode 100644
index 0000000..e30bd24
--- /dev/null
+++ b/app/kubernetes/helpers/volumeHelper.js
@@ -0,0 +1,24 @@
+import _ from 'lodash-es';
+import { KubernetesApplicationTypes } from '@/kubernetes/models/application/models/appConstants';
+
+class KubernetesVolumeHelper {
+  // TODO: review
+  // the following condition
+  // && (app.ApplicationType === KubernetesApplicationTypes.StatefulSet ? _.includes(volume.PersistentVolumeClaim.Name, app.Name) : true);
+  // is made to enforce finding the good SFS when multiple SFS in the same namespace
+  // are referencing an internal PVC using the same internal name
+  // (PVC are not exposed to other apps so they can have the same name in differents SFS)
+  static getUsingApplications(volume, applications) {
+    return _.filter(applications, (app) => {
+      const names = _.without(_.map(app.Volumes, 'persistentVolumeClaim.claimName'), undefined);
+      const matchingNames = _.filter(names, (name) => _.startsWith(volume.PersistentVolumeClaim.Name, name));
+      return (
+        volume.ResourcePool.Namespace.Name === app.ResourcePool &&
+        matchingNames.length &&
+        (app.ApplicationType === KubernetesApplicationTypes.StatefulSet ? _.includes(volume.PersistentVolumeClaim.Name, app.Name) : true)
+      );
+    });
+  }
+}
+
+export default KubernetesVolumeHelper;
diff --git a/app/kubernetes/horizontal-pod-auto-scaler/converter.js b/app/kubernetes/horizontal-pod-auto-scaler/converter.js
new file mode 100644
index 0000000..2647cdd
--- /dev/null
+++ b/app/kubernetes/horizontal-pod-auto-scaler/converter.js
@@ -0,0 +1,59 @@
+import * as JsonPatch from 'fast-json-patch';
+import { KubernetesHorizontalPodAutoScaler } from './models';
+import { KubernetesHorizontalPodAutoScalerCreatePayload } from './payload';
+
+export class KubernetesHorizontalPodAutoScalerConverter {
+  /**
+   * Convert API data to KubernetesHorizontalPodAutoScaler model
+   */
+  static apiToModel(data, yaml) {
+    const res = new KubernetesHorizontalPodAutoScaler();
+    res.Id = data.metadata.uid;
+    res.Namespace = data.metadata.namespace;
+    res.Name = data.metadata.name;
+    res.MinReplicas = data.spec.minReplicas;
+    res.MaxReplicas = data.spec.maxReplicas;
+    res.TargetCPUUtilization = data.spec.targetCPUUtilizationPercentage;
+
+    if (data.spec.scaleTargetRef) {
+      res.TargetEntity.ApiVersion = data.spec.scaleTargetRef.apiVersion;
+      res.TargetEntity.Kind = data.spec.scaleTargetRef.kind;
+      res.TargetEntity.Name = data.spec.scaleTargetRef.name;
+    }
+    res.Yaml = yaml ? yaml.data : '';
+    return res;
+  }
+
+  static createPayload(data) {
+    const payload = new KubernetesHorizontalPodAutoScalerCreatePayload();
+    payload.metadata.namespace = data.Namespace;
+    payload.metadata.name = data.TargetEntity.Name;
+    payload.spec.minReplicas = data.MinReplicas;
+    payload.spec.maxReplicas = data.MaxReplicas;
+    payload.spec.targetCPUUtilizationPercentage = data.targetCpuUtilizationPercentage;
+    payload.spec.scaleTargetRef.apiVersion = data.TargetEntity.ApiVersion;
+    payload.spec.scaleTargetRef.kind = data.TargetEntity.Kind;
+    payload.spec.scaleTargetRef.name = data.TargetEntity.Name;
+    return payload;
+  }
+
+  static patchPayload(oldScaler, newScaler) {
+    const oldPayload = KubernetesHorizontalPodAutoScalerConverter.createPayload(oldScaler);
+    const newPayload = KubernetesHorizontalPodAutoScalerConverter.createPayload(newScaler);
+    const payload = JsonPatch.compare(oldPayload, newPayload);
+    return payload;
+  }
+
+  static applicationFormValuesToModel(formValues, kind) {
+    const res = new KubernetesHorizontalPodAutoScaler();
+    res.Name = formValues.Name;
+    res.Namespace = formValues.ResourcePool.Namespace.Name;
+    res.MinReplicas = formValues.AutoScaler.minReplicas;
+    res.MaxReplicas = formValues.AutoScaler.maxReplicas;
+    res.targetCpuUtilizationPercentage = formValues.AutoScaler.targetCpuUtilizationPercentage;
+    res.TargetEntity.Name = formValues.Name;
+    res.TargetEntity.Kind = kind;
+    res.TargetEntity.ApiVersion = formValues.AutoScaler.apiVersion;
+    return res;
+  }
+}
diff --git a/app/kubernetes/horizontal-pod-auto-scaler/helper.js b/app/kubernetes/horizontal-pod-auto-scaler/helper.js
new file mode 100644
index 0000000..43ce119
--- /dev/null
+++ b/app/kubernetes/horizontal-pod-auto-scaler/helper.js
@@ -0,0 +1,8 @@
+import _ from 'lodash-es';
+
+export class KubernetesHorizontalPodAutoScalerHelper {
+  static findApplicationBoundScaler(sList, app) {
+    const kind = app.ApplicationType;
+    return _.find(sList, (item) => item.TargetEntity.Kind === kind && item.TargetEntity.Name === app.Name);
+  }
+}
diff --git a/app/kubernetes/horizontal-pod-auto-scaler/models.js b/app/kubernetes/horizontal-pod-auto-scaler/models.js
new file mode 100644
index 0000000..0506183
--- /dev/null
+++ b/app/kubernetes/horizontal-pod-auto-scaler/models.js
@@ -0,0 +1,23 @@
+/**
+ * KubernetesHorizontalPodAutoScaler Model
+ */
+const _KubernetesHorizontalPodAutoScaler = Object.freeze({
+  Id: '',
+  Namespace: '',
+  Name: '',
+  MinReplicas: 1,
+  MaxReplicas: 1,
+  targetCpuUtilizationPercentage: 0,
+  TargetEntity: {
+    ApiVersion: '',
+    Kind: '',
+    Name: '',
+  },
+  Yaml: '',
+});
+
+export class KubernetesHorizontalPodAutoScaler {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesHorizontalPodAutoScaler)));
+  }
+}
diff --git a/app/kubernetes/horizontal-pod-auto-scaler/payload.js b/app/kubernetes/horizontal-pod-auto-scaler/payload.js
new file mode 100644
index 0000000..d6c67ed
--- /dev/null
+++ b/app/kubernetes/horizontal-pod-auto-scaler/payload.js
@@ -0,0 +1,86 @@
+/**
+ * KubernetesHorizontalPodAutoScaler Create Payload Model
+ */
+const _KubernetesHorizontalPodAutoScalerCreatePayload = Object.freeze({
+  metadata: {
+    namespace: '',
+    name: '',
+  },
+  spec: {
+    maxReplicas: 0,
+    minReplicas: 0,
+    targetCPUUtilizationPercentage: 0,
+    scaleTargetRef: {
+      kind: '',
+      name: '',
+    },
+  },
+});
+
+export class KubernetesHorizontalPodAutoScalerCreatePayload {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesHorizontalPodAutoScalerCreatePayload)));
+  }
+}
+
+/**
+ * KubernetesHorizontalPodAutoScaler Create Payload Model for v2beta2
+ * Include support of memory usage
+ */
+
+// const _KubernetesHorizontalPodAutoScalerCreatePayload = Object.freeze({
+//   metadata: {
+//     namespace: '',
+//     name: ''
+//   },
+//   spec: {
+//     maxReplicas: 0,
+//     minReplicas: 0,
+//     targetCPUUtilizationPercentage: 0,
+//     scaleTargetRef: {
+//       kind: '',
+//       name: ''
+//     },
+//     metrics: []
+//   }
+// });
+
+// export class KubernetesHorizontalPodAutoScalerCreatePayload {
+//   constructor() {
+//     Object.assign(this, JSON.parse(JSON.stringify(_KubernetesHorizontalPodAutoScalerCreatePayload)));
+//   }
+// }
+
+// const _KubernetesHorizontalPodAutoScalerCPUMetric = Object.freeze({
+//   type: 'Resource',
+//   resource: {
+//     name: 'cpu',
+//     target: {
+//       type: 'Utilization',
+//       averageUtilization: 0
+//     }
+//   }
+// });
+
+// export class KubernetesHorizontalPodAutoScalerCPUMetric {
+//   constructor() {
+//     Object.assign(this, JSON.parse(JSON.stringify(_KubernetesHorizontalPodAutoScalerCPUMetric)));
+//   }
+// }
+
+// const _KubernetesHorizontalPodAutoScalerMemoryMetric = Object.freeze({
+//   type: 'Resource',
+//   resource: {
+//     name: 'memory',
+//     target: {
+//       type: 'AverageValue',
+//       averageValue: ''
+//     }
+//   }
+// });
+
+// export class KubernetesHorizontalPodAutoScalerMemoryMetric {
+//   constructor() {
+//     Object.assign(this, JSON.parse(JSON.stringify(_KubernetesHorizontalPodAutoScalerMemoryMetric)));
+//   }
+// }
diff --git a/app/kubernetes/horizontal-pod-auto-scaler/rest.js b/app/kubernetes/horizontal-pod-auto-scaler/rest.js
new file mode 100644
index 0000000..787e2ec
--- /dev/null
+++ b/app/kubernetes/horizontal-pod-auto-scaler/rest.js
@@ -0,0 +1,49 @@
+import { rawResponse } from '@/kubernetes/rest/response/transform';
+
+angular.module('portainer.kubernetes').factory('KubernetesHorizontalPodAutoScalers', [
+  '$resource',
+  'API_ENDPOINT_ENDPOINTS',
+  'EndpointProvider',
+  function KubernetesHorizontalPodAutoScalersFactory($resource, API_ENDPOINT_ENDPOINTS, EndpointProvider) {
+    'use strict';
+    return function (namespace) {
+      const url = API_ENDPOINT_ENDPOINTS + '/:endpointId/kubernetes/apis/autoscaling/v1' + (namespace ? '/namespaces/:namespace' : '') + '/horizontalpodautoscalers/:id/:action';
+      return $resource(
+        url,
+        {
+          endpointId: EndpointProvider.endpointID,
+          namespace: namespace,
+        },
+        {
+          get: {
+            method: 'GET',
+            ignoreLoadingBar: true,
+          },
+          getYaml: {
+            method: 'GET',
+            headers: {
+              Accept: 'application/yaml',
+            },
+            transformResponse: rawResponse,
+            ignoreLoadingBar: true,
+          },
+          create: { method: 'POST' },
+          update: { method: 'PUT' },
+          patch: {
+            method: 'PATCH',
+            headers: {
+              'Content-Type': 'application/json-patch+json',
+            },
+          },
+          rollback: {
+            method: 'PATCH',
+            headers: {
+              'Content-Type': 'application/json-patch+json',
+            },
+          },
+          delete: { method: 'DELETE' },
+        }
+      );
+    };
+  },
+]);
diff --git a/app/kubernetes/horizontal-pod-auto-scaler/service.js b/app/kubernetes/horizontal-pod-auto-scaler/service.js
new file mode 100644
index 0000000..3df4dd3
--- /dev/null
+++ b/app/kubernetes/horizontal-pod-auto-scaler/service.js
@@ -0,0 +1,118 @@
+import angular from 'angular';
+import _ from 'lodash-es';
+import PortainerError from '@/portainer/error';
+import { KubernetesCommonParams } from '@/kubernetes/models/common/params';
+import { KubernetesHorizontalPodAutoScalerConverter } from './converter';
+
+class KubernetesHorizontalPodAutoScalerService {
+  /* @ngInject */
+  constructor($async, KubernetesHorizontalPodAutoScalers) {
+    this.$async = $async;
+    this.KubernetesHorizontalPodAutoScalers = KubernetesHorizontalPodAutoScalers;
+
+    this.getAsync = this.getAsync.bind(this);
+    this.getAllAsync = this.getAllAsync.bind(this);
+    this.createAsync = this.createAsync.bind(this);
+    this.patchAsync = this.patchAsync.bind(this);
+    // this.rollbackAsync = this.rollbackAsync.bind(this);
+    this.deleteAsync = this.deleteAsync.bind(this);
+  }
+
+  /**
+   * GET
+   */
+  async getAsync(namespace, name) {
+    try {
+      const params = new KubernetesCommonParams();
+      params.id = name;
+      const [raw, yaml] = await Promise.all([
+        this.KubernetesHorizontalPodAutoScalers(namespace).get(params).$promise,
+        this.KubernetesHorizontalPodAutoScalers(namespace).getYaml(params).$promise,
+      ]);
+      const res = KubernetesHorizontalPodAutoScalerConverter.apiToModel(raw, yaml);
+      return res;
+    } catch (err) {
+      throw new PortainerError('Unable to retrieve HorizontalPodAutoScaler', err);
+    }
+  }
+
+  async getAllAsync(namespace) {
+    try {
+      const data = await this.KubernetesHorizontalPodAutoScalers(namespace).get().$promise;
+      const res = _.map(data.items, (item) => KubernetesHorizontalPodAutoScalerConverter.apiToModel(item));
+      return res;
+    } catch (err) {
+      throw new PortainerError('Unable to retrieve HorizontalPodAutoScalers', err);
+    }
+  }
+
+  get(namespace, name) {
+    if (name) {
+      return this.$async(this.getAsync, namespace, name);
+    }
+    return this.$async(this.getAllAsync, namespace);
+  }
+
+  /**
+   * CREATE
+   */
+  async createAsync(horizontalPodAutoScaler) {
+    try {
+      const params = {};
+      const payload = KubernetesHorizontalPodAutoScalerConverter.createPayload(horizontalPodAutoScaler);
+      const namespace = payload.metadata.namespace;
+      const data = await this.KubernetesHorizontalPodAutoScalers(namespace).create(params, payload).$promise;
+      return data;
+    } catch (err) {
+      throw new PortainerError('Unable to create horizontalPodAutoScaler', err);
+    }
+  }
+
+  create(horizontalPodAutoScaler) {
+    return this.$async(this.createAsync, horizontalPodAutoScaler);
+  }
+
+  /**
+   * PATCH
+   */
+  async patchAsync(oldHorizontalPodAutoScaler, newHorizontalPodAutoScaler) {
+    try {
+      const params = new KubernetesCommonParams();
+      params.id = newHorizontalPodAutoScaler.Name;
+      const namespace = newHorizontalPodAutoScaler.Namespace;
+      const payload = KubernetesHorizontalPodAutoScalerConverter.patchPayload(oldHorizontalPodAutoScaler, newHorizontalPodAutoScaler);
+      if (!payload.length) {
+        return;
+      }
+      const data = await this.KubernetesHorizontalPodAutoScalers(namespace).patch(params, payload).$promise;
+      return data;
+    } catch (err) {
+      throw new PortainerError('Unable to patch horizontalPodAutoScaler', err);
+    }
+  }
+
+  patch(oldHorizontalPodAutoScaler, newHorizontalPodAutoScaler) {
+    return this.$async(this.patchAsync, oldHorizontalPodAutoScaler, newHorizontalPodAutoScaler);
+  }
+
+  /**
+   * DELETE
+   */
+  async deleteAsync(horizontalPodAutoScaler) {
+    try {
+      const params = new KubernetesCommonParams();
+      params.id = horizontalPodAutoScaler.Name;
+      const namespace = horizontalPodAutoScaler.Namespace;
+      await this.KubernetesHorizontalPodAutoScalers(namespace).delete(params).$promise;
+    } catch (err) {
+      throw new PortainerError('Unable to remove horizontalPodAutoScaler', err);
+    }
+  }
+
+  delete(horizontalPodAutoScaler) {
+    return this.$async(this.deleteAsync, horizontalPodAutoScaler);
+  }
+}
+
+export default KubernetesHorizontalPodAutoScalerService;
+angular.module('portainer.kubernetes').service('KubernetesHorizontalPodAutoScalerService', KubernetesHorizontalPodAutoScalerService);
diff --git a/app/kubernetes/ingress/constants.js b/app/kubernetes/ingress/constants.js
new file mode 100644
index 0000000..0539527
--- /dev/null
+++ b/app/kubernetes/ingress/constants.js
@@ -0,0 +1,26 @@
+export const KubernetesIngressClassAnnotation = 'kubernetes.io/ingress.class';
+
+// keys must match KubernetesIngressClassTypes values to map them quickly using the ingress type
+// KubernetesIngressClassRewriteTargetAnnotations[KubernetesIngressClassTypes.NGINX] for example
+
+export const KubernetesNginxRewriteTargetAnnotations = {
+  Key: 'nginx.ingress.kubernetes.io/rewrite-target',
+  Value: '/$1',
+};
+
+export const KubernetesTraefikRewriteTargetAnnotations = {
+  Key: 'traefik.ingress.kubernetes.io/rewrite-target',
+  Value: '/$1',
+};
+
+export const KubernetesNginxUseregexAnnotations = {
+  Key: 'nginx.ingress.kubernetes.io/use-regex',
+  Value: 'true',
+};
+
+export const KubernetesIngressClassTypes = Object.freeze({
+  NGINX: 'nginx',
+  TRAEFIK: 'traefik',
+});
+
+export const PortainerIngressClassTypes = 'ingress.portainer.io/ingress-type';
diff --git a/app/kubernetes/ingress/converter.js b/app/kubernetes/ingress/converter.js
new file mode 100644
index 0000000..69ee4fe
--- /dev/null
+++ b/app/kubernetes/ingress/converter.js
@@ -0,0 +1,230 @@
+import _ from 'lodash-es';
+import * as JsonPatch from 'fast-json-patch';
+
+import KubernetesCommonHelper from '@/kubernetes/helpers/commonHelper';
+import {
+  KubernetesResourcePoolIngressClassAnnotationFormValue,
+  KubernetesResourcePoolIngressClassFormValue,
+  KubernetesResourcePoolIngressClassHostFormValue,
+} from '@/kubernetes/models/resource-pool/formValues';
+import { KubernetesIngress, KubernetesIngressRule } from './models';
+import { KubernetesIngressCreatePayload, KubernetesIngressRuleCreatePayload, KubernetesIngressRulePathCreatePayload } from './payloads';
+import { KubernetesIngressClassAnnotation, PortainerIngressClassTypes } from './constants';
+
+export class KubernetesIngressConverter {
+  static apiToModel(data) {
+    const paths = _.flatMap(data.spec.rules, (rule) => {
+      return !rule.http
+        ? []
+        : _.map(rule.http.paths, (path) => {
+            const ingRule = new KubernetesIngressRule();
+            ingRule.IngressName = data.metadata.name;
+            ingRule.ServiceName = path.backend.service.name;
+            ingRule.Host = rule.host || '';
+            ingRule.IP = data.status.loadBalancer.ingress ? data.status.loadBalancer.ingress[0].ip : undefined;
+            ingRule.Port = path.backend.service.port.number;
+            ingRule.Path = path.path;
+            ingRule.TLS = data.spec.tls;
+            return ingRule;
+          });
+    });
+
+    const res = new KubernetesIngress();
+    res.Name = data.metadata.name;
+    res.Namespace = data.metadata.namespace;
+    res.Annotations = data.metadata.annotations || {};
+    res.IngressClassName =
+      data.metadata.annotations && data.metadata.annotations[KubernetesIngressClassAnnotation]
+        ? data.metadata.annotations[KubernetesIngressClassAnnotation]
+        : data.spec.ingressClassName;
+    res.Paths = paths;
+    res.Hosts = _.uniq(_.map(data.spec.rules, 'host'));
+    const idx = _.findIndex(res.Hosts, (h) => h === undefined);
+    if (idx >= 0) {
+      res.Hosts.splice(idx, 1, '');
+    }
+    res.TLS = data.spec.tls;
+    return res;
+  }
+
+  static applicationFormValuesToDeleteIngresses(formValues, application) {
+    const ingresses = angular.copy(formValues.OriginalIngresses);
+    application.Services.forEach((service) => {
+      ingresses.forEach((ingress) => {
+        const paths = _.filter(ingress.Paths, { ServiceName: service.metadata.name });
+        paths.forEach((path) => _.remove(ingress.Paths, path));
+      });
+    });
+    return ingresses;
+  }
+
+  static removeIngressesPaths(ingresses, services) {
+    const originalIngress = angular.copy(ingresses);
+    originalIngress.forEach((ingress) => {
+      services.forEach((service) => {
+        _.remove(ingress.Paths, { ServiceName: service.Name });
+      });
+    });
+    return originalIngress;
+  }
+
+  static generateNewIngresses(ingresses, services) {
+    const originalIngresses = angular.copy(ingresses);
+    services
+      .filter((s) => s.Ingress)
+      .forEach((service) => {
+        if (service.Ports.length !== 0) {
+          const matchedIngress = _.find(originalIngresses, { Name: service.Ports[0].ingress.IngressName });
+          if (matchedIngress) {
+            const rule = new KubernetesIngressRule();
+            rule.ServiceName = service.Name;
+            rule.IngressName = service.Ports[0].ingress.IngressName;
+            rule.Host = service.Ports[0].ingress.Host;
+            rule.Path = _.startsWith(service.Ports[0].ingress.Path, '/') ? service.Ports[0].ingress.Path : '/' + service.Ports[0].ingress.Path;
+            rule.Port = service.Ports[0].port;
+
+            matchedIngress.Paths.push(rule);
+          }
+        }
+      });
+    return originalIngresses;
+  }
+
+  // need this function for [ resource summary ] controller
+  static newApplicationFormValuesToIngresses(formValues, serviceName, servicePorts) {
+    const ingresses = angular.copy(formValues.OriginalIngresses);
+    servicePorts.forEach((port) => {
+      const ingress = port.ingress && _.find(ingresses, { Name: port.ingress.IngressName });
+      if (ingress) {
+        const rule = new KubernetesIngressRule();
+        rule.ServiceName = serviceName;
+        rule.IngressName = port.ingress.IngressName;
+        rule.Host = port.ingress.Host;
+        rule.Path = _.startsWith(port.ingress.Path, '/') ? port.ingress.Path : '/' + port.ingress.Path;
+        rule.Port = port.port;
+
+        ingress.Paths.push(rule);
+      }
+    });
+    return ingresses;
+  }
+
+  /**
+   *
+   * @param {KubernetesResourcePoolIngressClassFormValue[]} formValues
+   * @returns {KubernetesIngress} Ingress
+   */
+  static resourcePoolIngressClassFormValueToIngress(formValues) {
+    const res = new KubernetesIngress();
+    res.Name = formValues.IngressClass.Name;
+    res.Namespace = formValues.Namespace;
+    const pairs = _.map(formValues.Annotations, (a) => [a.key, a.value]);
+    res.Annotations = _.fromPairs(pairs);
+    res.Annotations[PortainerIngressClassTypes] = formValues.IngressClass.Name;
+    res.IngressClassName = formValues.IngressClass.Name;
+    res.Hosts = formValues.Hosts;
+    res.Paths = formValues.Paths;
+    return res;
+  }
+
+  /**
+   *
+   * @param {KubernetesIngressClass} ics Ingress classes (saved in Portainer DB)
+   * @param {KubernetesIngress[]} ingresses Existing Kubernetes ingresses. Must be empty for RP CREATE VIEW and filled for RP EDIT VIEW
+   */
+  static ingressClassesToFormValues(ics, ingresses) {
+    const res = _.map(ics, (ic) => {
+      const fv = new KubernetesResourcePoolIngressClassFormValue(ic);
+      const ingress = _.find(ingresses, { Name: ic.Name });
+      if (ingress) {
+        fv.Selected = true;
+        fv.WasSelected = true;
+        fv.Hosts = _.map(ingress.Hosts, (host) => {
+          const hfv = new KubernetesResourcePoolIngressClassHostFormValue();
+          hfv.Host = host;
+          hfv.PreviousHost = host;
+          hfv.IsNew = false;
+          return hfv;
+        });
+        const annotations = _.map(_.toPairs(ingress.Annotations), ([key, value]) => {
+          if (key !== PortainerIngressClassTypes) {
+            const annotation = new KubernetesResourcePoolIngressClassAnnotationFormValue();
+            annotation.key = key;
+            annotation.value = value;
+            return annotation;
+          }
+        });
+        fv.Annotations = _.without(annotations, undefined);
+        fv.AdvancedConfig = fv.Annotations.length > 0;
+        fv.Paths = ingress.Paths;
+      }
+      return fv;
+    });
+    return res;
+  }
+
+  static createPayload(data) {
+    const res = new KubernetesIngressCreatePayload();
+    res.metadata.name = data.Name;
+    res.metadata.namespace = data.Namespace;
+    res.metadata.annotations = data.Annotations;
+    res.spec.ingressClassName = data.IngressClassName;
+    if (data.Paths && data.Paths.length) {
+      _.forEach(data.Paths, (p) => {
+        if (p.Host === 'undefined' || p.Host === undefined) {
+          p.Host = '';
+        }
+      });
+      const hostsWithRules = [];
+      const groups = _.groupBy(data.Paths, 'Host');
+      let rules = _.map(groups, (paths, host) => {
+        const updatedHost = _.find(data.Hosts, (h) => {
+          return h === host || h.PreviousHost === host;
+        });
+        host = updatedHost.Host || updatedHost;
+        if (updatedHost.NeedsDeletion) {
+          return;
+        }
+        const rule = new KubernetesIngressRuleCreatePayload();
+        KubernetesCommonHelper.assignOrDeleteIfEmpty(rule, 'host', host);
+        rule.http.paths = _.map(paths, (p) => {
+          const path = new KubernetesIngressRulePathCreatePayload();
+          path.path = p.Path;
+          path.backend.service.name = p.ServiceName;
+          path.backend.service.port.number = p.Port;
+          return path;
+        });
+        hostsWithRules.push(host);
+        return rule;
+      });
+      rules = _.without(rules, undefined);
+      const keptHosts = _.without(
+        _.map(data.Hosts, (h) => (h.NeedsDeletion ? undefined : h.Host || h)),
+        undefined
+      );
+      const hostsWithoutRules = _.without(keptHosts, ...hostsWithRules);
+      const emptyRules = _.map(hostsWithoutRules, (host) => {
+        return { host: host };
+      });
+      rules = _.concat(rules, emptyRules);
+      KubernetesCommonHelper.assignOrDeleteIfEmpty(res, 'spec.rules', rules);
+    } else if (data.Hosts) {
+      res.spec.rules = [];
+      _.forEach(data.Hosts, (host) => {
+        if (!host.NeedsDeletion) {
+          res.spec.rules.push({ host: host.Host || host });
+        }
+      });
+    } else {
+      delete res.spec.rules;
+    }
+    return res;
+  }
+
+  static patchPayload(oldData, newData) {
+    const oldPayload = KubernetesIngressConverter.createPayload(oldData);
+    const newPayload = KubernetesIngressConverter.createPayload(newData);
+    const payload = JsonPatch.compare(oldPayload, newPayload);
+    return payload;
+  }
+}
diff --git a/app/kubernetes/ingress/helper.js b/app/kubernetes/ingress/helper.js
new file mode 100644
index 0000000..0c3e58c
--- /dev/null
+++ b/app/kubernetes/ingress/helper.js
@@ -0,0 +1,8 @@
+import _ from 'lodash-es';
+
+export class KubernetesIngressHelper {
+  static findSBoundServiceIngressesRules(ingresses, serviceName) {
+    const rules = _.flatMap(ingresses, 'Paths');
+    return _.filter(rules, { ServiceName: serviceName });
+  }
+}
diff --git a/app/kubernetes/ingress/models.js b/app/kubernetes/ingress/models.js
new file mode 100644
index 0000000..3b140df
--- /dev/null
+++ b/app/kubernetes/ingress/models.js
@@ -0,0 +1,37 @@
+export function KubernetesIngress() {
+  return {
+    Name: '',
+    Namespace: '',
+    Annotations: {},
+    // Host: undefined,
+    Hosts: [],
+    // PreviousHost: undefined, // only use for RP ingress host edit
+    Paths: [],
+    IngressClassName: '',
+    TLS: [],
+  };
+}
+
+// TODO: refactor @LP
+// rename this model to KubernetesIngressPath (and all it's references)
+// as it's conceptually not an ingress rule (element of ingress.spec.rules)
+// but a path (element of ingress.spec.rules[].paths)
+export function KubernetesIngressRule() {
+  return {
+    IngressName: '',
+    ServiceName: '',
+    Host: '',
+    IP: '',
+    Port: '',
+    Path: '',
+  };
+}
+
+export function KubernetesIngressClass() {
+  return {
+    Name: '',
+    Type: undefined,
+    NeedsDeletion: false,
+    IsNew: true,
+  };
+}
diff --git a/app/kubernetes/ingress/payloads.js b/app/kubernetes/ingress/payloads.js
new file mode 100644
index 0000000..8767c6d
--- /dev/null
+++ b/app/kubernetes/ingress/payloads.js
@@ -0,0 +1,35 @@
+import { KubernetesCommonMetadataPayload } from '@/kubernetes/models/common/payloads';
+
+export function KubernetesIngressCreatePayload() {
+  return {
+    metadata: new KubernetesCommonMetadataPayload(),
+    spec: {
+      ingressClassName: '',
+      rules: [],
+    },
+  };
+}
+
+export function KubernetesIngressRuleCreatePayload() {
+  return {
+    host: '',
+    http: {
+      paths: [],
+    },
+  };
+}
+
+export function KubernetesIngressRulePathCreatePayload() {
+  return {
+    path: '',
+    pathType: 'ImplementationSpecific',
+    backend: {
+      service: {
+        name: '',
+        port: {
+          number: 0,
+        },
+      },
+    },
+  };
+}
diff --git a/app/kubernetes/ingress/rest.js b/app/kubernetes/ingress/rest.js
new file mode 100644
index 0000000..872213d
--- /dev/null
+++ b/app/kubernetes/ingress/rest.js
@@ -0,0 +1,46 @@
+import { rawResponse } from '@/kubernetes/rest/response/transform';
+
+angular.module('portainer.kubernetes').factory('KubernetesIngresses', factory);
+
+function factory($resource, API_ENDPOINT_ENDPOINTS, EndpointProvider) {
+  'use strict';
+  return function (namespace) {
+    const url = `${API_ENDPOINT_ENDPOINTS}/:endpointId/kubernetes/apis/networking.k8s.io/v1${namespace ? '/namespaces/:namespace' : ''}/ingresses/:id/:action`;
+    return $resource(
+      url,
+      {
+        endpointId: EndpointProvider.endpointID,
+        namespace: namespace,
+      },
+      {
+        get: {
+          method: 'GET',
+          ignoreLoadingBar: true,
+        },
+        getYaml: {
+          method: 'GET',
+          headers: {
+            Accept: 'application/yaml',
+          },
+          transformResponse: rawResponse,
+          ignoreLoadingBar: true,
+        },
+        create: { method: 'POST' },
+        update: { method: 'PUT' },
+        patch: {
+          method: 'PATCH',
+          headers: {
+            'Content-Type': 'application/json-patch+json',
+          },
+        },
+        rollback: {
+          method: 'PATCH',
+          headers: {
+            'Content-Type': 'application/json-patch+json',
+          },
+        },
+        delete: { method: 'DELETE' },
+      }
+    );
+  };
+}
diff --git a/app/kubernetes/ingress/service.js b/app/kubernetes/ingress/service.js
new file mode 100644
index 0000000..6d2e2e1
--- /dev/null
+++ b/app/kubernetes/ingress/service.js
@@ -0,0 +1,93 @@
+import _ from 'lodash-es';
+import angular from 'angular';
+import PortainerError from '@/portainer/error';
+import { KubernetesCommonParams } from '@/kubernetes/models/common/params';
+import { KubernetesIngressConverter } from './converter';
+
+/* @ngInject */
+export function KubernetesIngressService($async, KubernetesIngresses) {
+  return {
+    get,
+    create,
+    patch,
+    delete: _delete,
+  };
+
+  async function getOne(namespace, name) {
+    try {
+      const params = new KubernetesCommonParams();
+      params.id = name;
+      const [raw, yaml] = await Promise.all([KubernetesIngresses(namespace).get(params).$promise, KubernetesIngresses(namespace).getYaml(params).$promise]);
+      const res = {
+        Raw: KubernetesIngressConverter.apiToModel(raw),
+        Yaml: yaml.data,
+      };
+      return res;
+    } catch (err) {
+      throw new PortainerError('Unable to retrieve Ingress', err);
+    }
+  }
+
+  async function getAll(namespace) {
+    try {
+      const data = await KubernetesIngresses(namespace).get().$promise;
+      const res = _.reduce(data.items, (arr, item) => _.concat(arr, KubernetesIngressConverter.apiToModel(item)), []);
+      return res;
+    } catch (err) {
+      throw new PortainerError('Unable to retrieve Ingresses', err);
+    }
+  }
+
+  function get(namespace, name) {
+    if (name) {
+      return $async(getOne, namespace, name);
+    }
+    return $async(getAll, namespace);
+  }
+
+  function create(ingress) {
+    return $async(async () => {
+      try {
+        const params = {};
+        const payload = KubernetesIngressConverter.createPayload(ingress);
+        const namespace = payload.metadata.namespace;
+        const data = await KubernetesIngresses(namespace).create(params, payload).$promise;
+        return data;
+      } catch (err) {
+        throw new PortainerError('Unable to create ingress', err);
+      }
+    });
+  }
+
+  function patch(oldIngress, newIngress) {
+    return $async(async () => {
+      try {
+        const params = new KubernetesCommonParams();
+        params.id = newIngress.Name;
+        const namespace = newIngress.Namespace;
+        const payload = KubernetesIngressConverter.patchPayload(oldIngress, newIngress);
+        if (!payload.length) {
+          return;
+        }
+        const data = await KubernetesIngresses(namespace).patch(params, payload).$promise;
+        return data;
+      } catch (err) {
+        throw new PortainerError('Unable to patch ingress', err);
+      }
+    });
+  }
+
+  function _delete(namespace, ingressClassName) {
+    return $async(async () => {
+      try {
+        const params = new KubernetesCommonParams();
+        params.id = ingressClassName;
+        await KubernetesIngresses(namespace).delete(params).$promise;
+      } catch (err) {
+        throw new PortainerError('Unable to delete ingress', err);
+      }
+    });
+  }
+}
+
+angular.module('portainer.kubernetes').service('KubernetesIngressService', KubernetesIngressService);
diff --git a/app/kubernetes/models/application/formValues.js b/app/kubernetes/models/application/formValues.js
new file mode 100644
index 0000000..783a36d
--- /dev/null
+++ b/app/kubernetes/models/application/formValues.js
@@ -0,0 +1,151 @@
+import { PorImageRegistryModel } from '@/docker/models/porImageRegistry';
+import { KubernetesApplicationTypes, KubernetesApplicationDeploymentTypes, KubernetesApplicationDataAccessPolicies } from '@/kubernetes/models/application/models/appConstants';
+
+/**
+ * KubernetesApplicationFormValues Model
+ */
+export function KubernetesApplicationFormValues() {
+  this.ApplicationType = KubernetesApplicationTypes.Deployment; // will only exist for formValues generated from Application (app edit situation;
+  this.ResourcePool = {};
+  this.Name = '';
+  this.StackName = '';
+  this.ApplicationOwner = '';
+  this.ImageModel = new PorImageRegistryModel();
+  this.Note = '';
+  this.MemoryLimit = 0;
+  this.CpuLimit = 0;
+  this.DeploymentType = KubernetesApplicationDeploymentTypes.Replicated;
+  this.ReplicaCount = 1;
+  this.AutoScaler = {};
+  this.Containers = [];
+  this.Services = [];
+  this.EnvironmentVariables = []; // KubernetesApplicationEnvironmentVariableFormValue lis;
+  this.DataAccessPolicy = KubernetesApplicationDataAccessPolicies.Isolated;
+  this.PersistedFolders = []; // KubernetesApplicationPersistedFolderFormValue lis;
+  this.ConfigMaps = [];
+  this.Secrets = [];
+  this.PublishedPorts = []; // KubernetesApplicationPublishedPortFormValue lis;
+  this.PlacementType = 'preferred';
+  this.Placements = []; // KubernetesApplicationPlacementFormValue lis;
+  this.OriginalIngresses = undefined;
+}
+
+/**
+ * KubernetesApplicationConfigurationFormValueOverridenKey Model
+ */
+const _KubernetesApplicationConfigurationFormValueOverridenKey = Object.freeze({
+  key: '',
+  path: '',
+  type: 'ENVIRONMENT',
+});
+
+export class KubernetesApplicationConfigurationFormValueOverridenKey {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesApplicationConfigurationFormValueOverridenKey)));
+  }
+}
+
+/**
+ * KubernetesApplicationConfigurationFormValue Model
+ */
+const _KubernetesApplicationConfigurationFormValue = Object.freeze({
+  selectedConfiguration: undefined,
+  overriden: false,
+  overridenKeys: [],
+});
+
+export class KubernetesApplicationConfigurationFormValue {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesApplicationConfigurationFormValue)));
+  }
+}
+
+/**
+ * KubernetesApplicationEnvironmentVariableFormValue Model
+ */
+const _KubernetesApplicationEnvironmentVariableFormValue = Object.freeze({
+  name: '',
+  value: '',
+  needsDeletion: false,
+  isNew: true,
+  nameIndex: '', // keep the original name for sorting
+});
+
+export class KubernetesApplicationEnvironmentVariableFormValue {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesApplicationEnvironmentVariableFormValue)));
+  }
+}
+
+/**
+ * KubernetesApplicationPersistedFolderFormValue Model
+ */
+const _KubernetesApplicationPersistedFolderFormValue = Object.freeze({
+  persistentVolumeClaimName: '', // will be empty for new volumes (create/edit app) and filled for existing ones (edit)
+  needsDeletion: false,
+  containerPath: '',
+  size: '',
+  sizeUnit: 'GB',
+  storageClass: {},
+  existingVolume: null,
+  useNewVolume: true,
+});
+
+export class KubernetesApplicationPersistedFolderFormValue {
+  constructor(storageClass) {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesApplicationPersistedFolderFormValue)));
+    this.storageClass = storageClass;
+  }
+}
+
+/**
+ * KubernetesApplicationPublishedPortFormValue Model
+ */
+export function KubernetesApplicationPublishedPortFormValue() {
+  return {
+    NeedsDeletion: false,
+    IsNew: true,
+    ContainerPort: '',
+    NodePort: '',
+    LoadBalancerPort: '',
+    LoadBalancerNodePort: undefined, // only filled to save existing loadbalancer nodePort and drop it when moving app exposure from LB to Internal/NodePort
+    Protocol: 'TCP',
+    IngressName: undefined,
+    IngressRoute: undefined,
+    IngressHost: undefined,
+    IngressHosts: [],
+  };
+}
+
+export function KubernetesApplicationPlacementFormValue() {
+  return {
+    label: {},
+    value: '',
+    needsDeletion: false,
+    isNew: true,
+  };
+}
+
+/**
+ * KubernetesApplicationAutoScalerFormValue Model
+ */
+const _KubernetesApplicationAutoScalerFormValue = Object.freeze({
+  minReplicas: 0,
+  maxReplicas: 0,
+  targetCpuUtilizationPercentage: 50,
+  apiVersion: '',
+  isUsed: false,
+});
+
+export class KubernetesApplicationAutoScalerFormValue {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesApplicationAutoScalerFormValue)));
+  }
+}
+
+export function KubernetesFormValidationReferences() {
+  return {
+    refs: {},
+    hasRefs: false,
+  };
+}
diff --git a/app/kubernetes/models/application/models/Application.ts b/app/kubernetes/models/application/models/Application.ts
new file mode 100644
index 0000000..c8e8aa2
--- /dev/null
+++ b/app/kubernetes/models/application/models/Application.ts
@@ -0,0 +1,128 @@
+import { ServiceType } from '@/react/kubernetes/applications/CreateView/application-services/types';
+import {
+  AppType,
+  DeploymentType,
+  AppDataAccessPolicy,
+  AppKind,
+} from '@/react/kubernetes/applications/types';
+
+import { ConfigurationVolume } from './ConfigurationVolume';
+import { PersistedFolder } from './PersistedFolder';
+
+export class Application {
+  Id: string;
+
+  Name: string;
+
+  StackName: string;
+
+  StackId: string;
+
+  ApplicationKind?: AppKind;
+
+  ApplicationOwner: string;
+
+  ApplicationName: string;
+
+  Annotations: Record<string, string> = {};
+
+  ResourcePool: string;
+
+  Image: string;
+
+  CreationDate: 0;
+
+  Pods: [];
+
+  Containers: [];
+
+  Metadata: {
+    labels?: Record<string, string>;
+    annotations?: Record<string, string>;
+  };
+
+  Resource?: {
+    cpuLimit?: number;
+    cpuRequest?: number;
+    memoryLimit?: number;
+    memoryRequest?: number;
+  };
+
+  ServiceType?: ServiceType;
+
+  ServiceId: string;
+
+  ServiceName: string;
+
+  HeadlessServiceName: undefined; // only used for StatefulSet
+
+  LoadBalancerIPAddress: undefined; // only filled when bound service is LoadBalancer and state is available
+
+  PublishedPorts: [];
+
+  Volumes: [];
+
+  Env: [];
+
+  PersistedFolders: Array<PersistedFolder>;
+
+  ConfigurationVolumes: Array<ConfigurationVolume>;
+
+  DeploymentType?: DeploymentType;
+
+  DataAccessPolicy?: AppDataAccessPolicy;
+
+  ApplicationType?: AppType;
+
+  RunningPodsCount: 0;
+
+  TotalPodsCount: 0;
+
+  Yaml: string;
+
+  Note: string;
+
+  Raw: undefined; // only filled when inspecting app details / create / edit view (never filled in multiple-apps views)
+
+  AutoScaler: undefined; // only filled if the application has an HorizontalPodAutoScaler bound to it
+
+  Conditions: Array<{
+    lastTransitionTime: string;
+    lastUpdateTime: string;
+    message: string;
+    reason: string;
+    status: string;
+    type: string;
+  }> = [];
+
+  constructor() {
+    this.Id = '';
+    this.Name = '';
+    this.StackName = '';
+    this.StackId = '';
+    this.ApplicationOwner = '';
+    this.ApplicationName = '';
+    this.ResourcePool = '';
+    this.Image = '';
+    this.CreationDate = 0;
+    this.Pods = [];
+    this.Containers = [];
+    this.Metadata = {};
+    this.Resource = {};
+    this.ServiceId = '';
+    this.ServiceName = '';
+    this.HeadlessServiceName = undefined;
+    this.LoadBalancerIPAddress = undefined;
+    this.PublishedPorts = [];
+    this.Volumes = [];
+    this.Env = [];
+    this.PersistedFolders = [];
+    this.ConfigurationVolumes = [];
+    this.RunningPodsCount = 0;
+    this.TotalPodsCount = 0;
+    this.Yaml = '';
+    this.Note = '';
+    this.Raw = undefined;
+    this.AutoScaler = undefined;
+  }
+}
diff --git a/app/kubernetes/models/application/models/ConfigurationVolume.ts b/app/kubernetes/models/application/models/ConfigurationVolume.ts
new file mode 100644
index 0000000..5296425
--- /dev/null
+++ b/app/kubernetes/models/application/models/ConfigurationVolume.ts
@@ -0,0 +1,9 @@
+export class ConfigurationVolume {
+  fileMountPath = '';
+
+  rootMountPath = '';
+
+  configurationKey = '';
+
+  configurationName = '';
+}
diff --git a/app/kubernetes/models/application/models/PersistedFolder.ts b/app/kubernetes/models/application/models/PersistedFolder.ts
new file mode 100644
index 0000000..f9cb782
--- /dev/null
+++ b/app/kubernetes/models/application/models/PersistedFolder.ts
@@ -0,0 +1,7 @@
+export class PersistedFolder {
+  MountPath = '';
+
+  persistentVolumeClaimName = '';
+
+  HostPath = '';
+}
diff --git a/app/kubernetes/models/application/models/appConstants.ts b/app/kubernetes/models/application/models/appConstants.ts
new file mode 100644
index 0000000..658fc30
--- /dev/null
+++ b/app/kubernetes/models/application/models/appConstants.ts
@@ -0,0 +1,41 @@
+import {
+  AppType,
+  AppDataAccessPolicy,
+  DeploymentType,
+} from '@/react/kubernetes/applications/types';
+import { ServiceType } from '@/react/kubernetes/services/types';
+
+// The following constants are used by angular views and can be removed once they are no longer referenced
+export const KubernetesApplicationTypes: Record<AppType, AppType> = {
+  Deployment: 'Deployment',
+  StatefulSet: 'StatefulSet',
+  DaemonSet: 'DaemonSet',
+  Pod: 'Pod',
+  Helm: 'Helm',
+} as const;
+
+export const KubernetesApplicationDeploymentTypes: Record<
+  DeploymentType,
+  DeploymentType
+> = {
+  Global: 'Global',
+  Replicated: 'Replicated',
+} as const;
+
+export const KubernetesApplicationDataAccessPolicies: Record<
+  AppDataAccessPolicy,
+  AppDataAccessPolicy
+> = {
+  Isolated: 'Isolated',
+  Shared: 'Shared',
+} as const;
+
+export const KubernetesApplicationServiceTypes: Record<
+  ServiceType,
+  ServiceType
+> = {
+  ClusterIP: 'ClusterIP',
+  NodePort: 'NodePort',
+  LoadBalancer: 'LoadBalancer',
+  ExternalName: 'ExternalName',
+} as const;
diff --git a/app/kubernetes/models/application/models/constants.js b/app/kubernetes/models/application/models/constants.js
new file mode 100644
index 0000000..74f9767
--- /dev/null
+++ b/app/kubernetes/models/application/models/constants.js
@@ -0,0 +1,16 @@
+export const KubernetesApplicationQuotaDefaults = {
+  CpuLimit: 0.1,
+  MemoryLimit: 128, // MB
+};
+
+export const KubernetesPortainerApplicationStackNameLabel = 'io.portainer.kubernetes.application.stack';
+
+export const KubernetesPortainerApplicationStackIdLabel = 'io.portainer.kubernetes.application.stackid';
+
+export const KubernetesPortainerApplicationKindLabel = 'io.portainer.kubernetes.application.kind';
+
+export const KubernetesPortainerApplicationNameLabel = 'io.portainer.kubernetes.application.name';
+
+export const KubernetesPortainerApplicationOwnerLabel = 'io.portainer.kubernetes.application.owner';
+
+export const KubernetesPortainerApplicationNote = 'io.portainer.kubernetes.application.note';
diff --git a/app/kubernetes/models/application/models/index.js b/app/kubernetes/models/application/models/index.js
new file mode 100644
index 0000000..20000bd
--- /dev/null
+++ b/app/kubernetes/models/application/models/index.js
@@ -0,0 +1,48 @@
+export * from './constants';
+
+export { Application as KubernetesApplication } from './Application';
+export { ConfigurationVolume as KubernetesApplicationConfigurationVolume } from './ConfigurationVolume';
+export { PersistedFolder as KubernetesApplicationPersistedFolder } from './PersistedFolder';
+
+/**
+ * HelmApplication Model (Composite)
+ */
+export class HelmApplication {
+  constructor() {
+    this.Id = '';
+    this.Name = '';
+    this.KubernetesApplications = [];
+    this.ApplicationOwner = '';
+    this.CreationDate = 0;
+    this.ApplicationType = 'Unknown';
+    this.Status = '';
+    this.StackName = '-';
+    this.ResourcePool = '-';
+    this.Image = '-';
+    this.PublishedPorts = [];
+  }
+}
+
+/**
+ * KubernetesApplicationPort Model
+ */
+const _KubernetesApplicationPort = Object.freeze({
+  IngressRules: [], // KubernetesIngressRule[]
+  NodePort: 0,
+  TargetPort: 0,
+  Port: 0,
+  Protocol: '',
+});
+
+export class KubernetesApplicationPort {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesApplicationPort)));
+  }
+}
+
+export const KubernetesDeploymentTypes = Object.freeze({
+  GIT: 'git',
+  CONTENT: 'content',
+  APPLICATION_FORM: 'application form',
+  URL: 'url',
+});
diff --git a/app/kubernetes/models/application/payloads.js b/app/kubernetes/models/application/payloads.js
new file mode 100644
index 0000000..4671e9b
--- /dev/null
+++ b/app/kubernetes/models/application/payloads.js
@@ -0,0 +1,142 @@
+/////////////////////////// VOLUME MOUNT ///////////////////////////////
+/**
+ * KubernetesApplicationVolumeMount Model
+ */
+const _KubernetesApplicationVolumeMount = Object.freeze({
+  name: '',
+  mountPath: '',
+  readOnly: false,
+});
+
+export class KubernetesApplicationVolumeMountPayload {
+  constructor(readOnly) {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesApplicationVolumeMount)));
+    if (readOnly) {
+      this.readOnly = true;
+    } else {
+      delete this.readOnly;
+    }
+  }
+}
+
+///////////////////////////////// PVC /////////////////////////////////
+/**
+ * KubernetesApplicationVolumePersistentPayload Model
+ */
+const _KubernetesApplicationVolumePersistentPayload = Object.freeze({
+  name: '',
+  persistentVolumeClaim: {
+    claimName: '',
+  },
+});
+
+export class KubernetesApplicationVolumePersistentPayload {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesApplicationVolumePersistentPayload)));
+  }
+}
+
+/////////////////////////////// CONFIG AS VOLUME ////////////////////////
+/**
+ * KubernetesApplicationVolumeConfigMapPayload Model
+ */
+const _KubernetesApplicationVolumeConfigMapPayload = Object.freeze({
+  name: '',
+  configMap: {
+    name: '',
+    items: [], // KubernetesApplicationVolumeEntryPayload
+  },
+});
+
+export class KubernetesApplicationVolumeConfigMapPayload {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesApplicationVolumeConfigMapPayload)));
+  }
+}
+
+//////////////////// SECRET AS VOLUME /////////////////////////////////////
+/**
+ * KubernetesApplicationVolumeSecretPayload Model
+ */
+const _KubernetesApplicationVolumeSecretPayload = Object.freeze({
+  name: '',
+  secret: {
+    secretName: '',
+    items: [], // KubernetesApplicationVolumeEntryPayload
+  },
+});
+
+export class KubernetesApplicationVolumeSecretPayload {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesApplicationVolumeSecretPayload)));
+  }
+}
+
+/**
+ * KubernetesApplicationVolumeEntryPayload Model
+ */
+const _KubernetesApplicationVolumeEntryPayload = Object.freeze({
+  key: '',
+  path: '',
+});
+
+export class KubernetesApplicationVolumeEntryPayload {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesApplicationVolumeEntryPayload)));
+  }
+}
+
+//////////////////////////// ENV ENTRY //////////////////////////////
+/**
+ * KubernetesApplicationEnvPayload Model
+ */
+const _KubernetesApplicationEnvPayload = Object.freeze({
+  name: '',
+  value: '',
+});
+
+export class KubernetesApplicationEnvPayload {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesApplicationEnvPayload)));
+  }
+}
+
+///////////////////////// CONFIG AS ENV ////////////////////////////////
+/**
+ * KubernetesApplicationEnvConfigMapPayload Model
+ */
+const _KubernetesApplicationEnvConfigMapPayload = Object.freeze({
+  name: '',
+  valueFrom: {
+    configMapKeyRef: {
+      name: '',
+      key: '',
+    },
+  },
+});
+
+export class KubernetesApplicationEnvConfigMapPayload {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesApplicationEnvConfigMapPayload)));
+  }
+}
+
+//////////////////////// SECRET AS ENV //////////////////////////////////
+/**
+ * KubernetesApplicationEnvSecretPayload Model
+ */
+const _KubernetesApplicationEnvSecretPayload = Object.freeze({
+  name: '',
+  valueFrom: {
+    secretKeyRef: {
+      name: '',
+      key: '',
+    },
+  },
+});
+
+export class KubernetesApplicationEnvSecretPayload {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesApplicationEnvSecretPayload)));
+  }
+}
diff --git a/app/kubernetes/models/common/params.js b/app/kubernetes/models/common/params.js
new file mode 100644
index 0000000..5c7de8d
--- /dev/null
+++ b/app/kubernetes/models/common/params.js
@@ -0,0 +1,8 @@
+/**
+ * Generic params
+ */
+export function KubernetesCommonParams() {
+  return {
+    id: '',
+  };
+}
diff --git a/app/kubernetes/models/common/payloads.js b/app/kubernetes/models/common/payloads.js
new file mode 100644
index 0000000..28909d3
--- /dev/null
+++ b/app/kubernetes/models/common/payloads.js
@@ -0,0 +1,15 @@
+/**
+ * Generic metadata payload
+ */
+const _KubernetesCommonMetadataPayload = Object.freeze({
+  uid: '',
+  name: '',
+  namespace: '',
+  labels: {},
+  annotations: {},
+});
+export class KubernetesCommonMetadataPayload {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesCommonMetadataPayload)));
+  }
+}
diff --git a/app/kubernetes/models/config-map/models.js b/app/kubernetes/models/config-map/models.js
new file mode 100644
index 0000000..bde4b85
--- /dev/null
+++ b/app/kubernetes/models/config-map/models.js
@@ -0,0 +1,31 @@
+export const KubernetesPortainerConfigMapNamespace = 'portainer';
+export const KubernetesPortainerConfigMapConfigName = 'portainer-config';
+export const KubernetesPortainerConfigMapAccessKey = 'NamespaceAccessPolicies';
+
+export function KubernetesPortainerAccessConfigMap() {
+  return {
+    Id: 0,
+    Name: KubernetesPortainerConfigMapConfigName,
+    Namespace: KubernetesPortainerConfigMapNamespace,
+    Data: {},
+  };
+}
+
+/**
+ * ConfigMap Model
+ */
+const _KubernetesConfigMap = Object.freeze({
+  Id: 0,
+  Name: '',
+  Namespace: '',
+  Yaml: '',
+  ConfigurationOwner: '',
+  Data: [],
+  Labels: {},
+});
+
+export class KubernetesConfigMap {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesConfigMap)));
+  }
+}
diff --git a/app/kubernetes/models/config-map/payloads.js b/app/kubernetes/models/config-map/payloads.js
new file mode 100644
index 0000000..587daf8
--- /dev/null
+++ b/app/kubernetes/models/config-map/payloads.js
@@ -0,0 +1,29 @@
+import { KubernetesCommonMetadataPayload } from '@/kubernetes/models/common/payloads';
+
+/**
+ * Payload for CREATE
+ */
+const _KubernetesConfigMapCreatePayload = Object.freeze({
+  metadata: new KubernetesCommonMetadataPayload(),
+  data: {},
+  binaryData: {},
+});
+export class KubernetesConfigMapCreatePayload {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesConfigMapCreatePayload)));
+  }
+}
+
+/**
+ * Payload for UPDATE
+ */
+const _KubernetesConfigMapUpdatePayload = Object.freeze({
+  metadata: new KubernetesCommonMetadataPayload(),
+  data: {},
+  binaryData: {},
+});
+export class KubernetesConfigMapUpdatePayload {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesConfigMapUpdatePayload)));
+  }
+}
diff --git a/app/kubernetes/models/configuration/formvalues.js b/app/kubernetes/models/configuration/formvalues.js
new file mode 100644
index 0000000..6679491
--- /dev/null
+++ b/app/kubernetes/models/configuration/formvalues.js
@@ -0,0 +1,37 @@
+import { KubernetesConfigurationKinds, KubernetesSecretTypeOptions } from './models';
+
+/**
+ * KubernetesConfigurationFormValues Model
+ */
+const _KubernetesConfigurationFormValues = Object.freeze({
+  Id: '',
+  ResourcePool: '',
+  Name: '',
+  ConfigurationOwner: '',
+  Kind: KubernetesConfigurationKinds.CONFIGMAP,
+  kind: 'ConfigMap',
+  Data: [],
+  DataYaml: '',
+  IsSimple: true,
+  ServiceAccountName: '',
+  Type: KubernetesSecretTypeOptions.OPAQUE.value,
+  Labels: {},
+});
+
+export class KubernetesConfigurationFormValues {
+  constructor() {
+    Object.assign(this, _KubernetesConfigurationFormValues);
+  }
+}
+
+const _KubernetesConfigurationFormValuesEntry = Object.freeze({
+  Key: '',
+  Value: '',
+  IsBinary: false,
+});
+
+export class KubernetesConfigurationFormValuesEntry {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesConfigurationFormValuesEntry)));
+  }
+}
diff --git a/app/kubernetes/models/configuration/models.js b/app/kubernetes/models/configuration/models.js
new file mode 100644
index 0000000..ec29ab6
--- /dev/null
+++ b/app/kubernetes/models/configuration/models.js
@@ -0,0 +1,41 @@
+export const KubernetesPortainerConfigurationOwnerLabel = 'io.portainer.kubernetes.configuration.owner';
+export const KubernetesPortainerConfigurationDataAnnotation = 'io.portainer.kubernetes.configuration.data';
+
+/**
+ * Configuration Model (Composite)
+ */
+const _KubernetesConfiguration = Object.freeze({
+  Id: 0,
+  Name: '',
+  Kind: '',
+  Namespace: '',
+  CreationDate: '',
+  ConfigurationOwner: '',
+  Used: false,
+  Applications: [],
+  Data: {},
+  SecretType: '',
+});
+
+export class KubernetesConfiguration {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesConfiguration)));
+  }
+}
+
+export const KubernetesConfigurationKinds = Object.freeze({
+  CONFIGMAP: 1,
+  SECRET: 2,
+});
+
+export const KubernetesSecretTypeOptions = Object.freeze({
+  OPAQUE: { name: 'Opaque', value: 'Opaque' },
+  SERVICEACCOUNTTOKEN: { name: 'Service account token', value: 'kubernetes.io/service-account-token' },
+  DOCKERCFG: { name: 'Dockercfg', value: 'kubernetes.io/dockercfg' },
+  DOCKERCONFIGJSON: { name: 'Dockerconfigjson', value: 'kubernetes.io/dockerconfigjson' },
+  BASICAUTH: { name: 'Basic auth', value: 'kubernetes.io/basic-auth' },
+  SSHAUTH: { name: 'SSH auth', value: 'kubernetes.io/ssh-auth' },
+  TLS: { name: 'TLS', value: 'kubernetes.io/tls' },
+  BOOTSTRAPTOKEN: { name: 'Bootstrap token', value: 'bootstrap.kubernetes.io/token' },
+  CUSTOM: { name: 'Custom', value: 'Custom' },
+});
diff --git a/app/kubernetes/models/daemon-set/models.js b/app/kubernetes/models/daemon-set/models.js
new file mode 100644
index 0000000..4f2f82e
--- /dev/null
+++ b/app/kubernetes/models/daemon-set/models.js
@@ -0,0 +1,25 @@
+/**
+ * KubernetesDaemonSet Model
+ */
+const _KubernetesDaemonSet = Object.freeze({
+  Namespace: '',
+  Name: '',
+  StackName: '',
+  ImageModel: null,
+  Env: [],
+  CpuLimit: 0,
+  MemoryLimit: 0,
+  VoluemMounts: [],
+  Volumes: [],
+  Secret: undefined,
+  ApplicationName: '',
+  ApplicationOwner: '',
+  Note: '',
+  Affinity: undefined, // KubernetesPodAffinity
+});
+
+export class KubernetesDaemonSet {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesDaemonSet)));
+  }
+}
diff --git a/app/kubernetes/models/daemon-set/payloads.js b/app/kubernetes/models/daemon-set/payloads.js
new file mode 100644
index 0000000..c6fb631
--- /dev/null
+++ b/app/kubernetes/models/daemon-set/payloads.js
@@ -0,0 +1,50 @@
+import { KubernetesCommonMetadataPayload } from '@/kubernetes/models/common/payloads';
+
+/**
+ * KubernetesDaemonSetCreatePayload Model
+ */
+const _KubernetesDaemonSetCreatePayload = Object.freeze({
+  metadata: new KubernetesCommonMetadataPayload(),
+  spec: {
+    replicas: 0,
+    selector: {
+      matchLabels: {
+        app: '',
+      },
+    },
+    updateStrategy: {
+      type: 'RollingUpdate',
+      rollingUpdate: {
+        maxUnavailable: 1,
+      },
+    },
+    template: {
+      metadata: {
+        labels: {
+          app: '',
+        },
+      },
+      spec: {
+        containers: [
+          {
+            name: '',
+            image: '',
+            env: [],
+            resources: {
+              limits: {},
+              requests: {},
+            },
+            volumeMounts: [],
+          },
+        ],
+        volumes: [],
+      },
+    },
+  },
+});
+
+export class KubernetesDaemonSetCreatePayload {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesDaemonSetCreatePayload)));
+  }
+}
diff --git a/app/kubernetes/models/deploy.js b/app/kubernetes/models/deploy.js
new file mode 100644
index 0000000..d4158f6
--- /dev/null
+++ b/app/kubernetes/models/deploy.js
@@ -0,0 +1,22 @@
+export const KubernetesDeployManifestTypes = Object.freeze({
+  KUBERNETES: 1,
+});
+
+export const KubernetesDeployBuildMethods = Object.freeze({
+  GIT: 1,
+  WEB_EDITOR: 2,
+  CUSTOM_TEMPLATE: 3,
+  URL: 4,
+  HELM: 5,
+});
+
+export const KubernetesDeployRequestMethods = Object.freeze({
+  REPOSITORY: 'repository',
+  STRING: 'string',
+  URL: 'url',
+});
+
+export const RepositoryMechanismTypes = Object.freeze({
+  WEBHOOK: 'Webhook',
+  INTERVAL: 'Interval',
+});
diff --git a/app/kubernetes/models/deployment/models.js b/app/kubernetes/models/deployment/models.js
new file mode 100644
index 0000000..05a6963
--- /dev/null
+++ b/app/kubernetes/models/deployment/models.js
@@ -0,0 +1,26 @@
+/**
+ * KubernetesDeployment Model
+ */
+const _KubernetesDeployment = Object.freeze({
+  Namespace: '',
+  Name: '',
+  StackName: '',
+  ReplicaCount: 0,
+  ImageModel: null,
+  Env: [],
+  CpuLimit: 0,
+  MemoryLimit: 0,
+  VolumeMounts: [],
+  Volumes: [],
+  Secret: undefined,
+  ApplicationName: '',
+  ApplicationOwner: '',
+  Note: '',
+  Affinity: undefined, // KubernetesPodAffinity
+});
+
+export class KubernetesDeployment {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesDeployment)));
+  }
+}
diff --git a/app/kubernetes/models/deployment/payloads.js b/app/kubernetes/models/deployment/payloads.js
new file mode 100644
index 0000000..920176f
--- /dev/null
+++ b/app/kubernetes/models/deployment/payloads.js
@@ -0,0 +1,52 @@
+import { KubernetesCommonMetadataPayload } from '@/kubernetes/models/common/payloads';
+
+/**
+ * KubernetesDeploymentCreatePayload Model
+ */
+const _KubernetesDeploymentCreatePayload = Object.freeze({
+  metadata: new KubernetesCommonMetadataPayload(),
+  spec: {
+    replicas: 0,
+    selector: {
+      matchLabels: {
+        app: '',
+      },
+    },
+    strategy: {
+      type: 'RollingUpdate',
+      rollingUpdate: {
+        maxSurge: 0,
+        maxUnavailable: '100%',
+      },
+    },
+    template: {
+      metadata: {
+        labels: {
+          app: '',
+        },
+      },
+      spec: {
+        affinity: {},
+        containers: [
+          {
+            name: '',
+            image: '',
+            env: [],
+            resources: {
+              limits: {},
+              requests: {},
+            },
+            volumeMounts: [],
+          },
+        ],
+        volumes: [],
+      },
+    },
+  },
+});
+
+export class KubernetesDeploymentCreatePayload {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesDeploymentCreatePayload)));
+  }
+}
diff --git a/app/kubernetes/models/event/models.js b/app/kubernetes/models/event/models.js
new file mode 100644
index 0000000..f79c8e4
--- /dev/null
+++ b/app/kubernetes/models/event/models.js
@@ -0,0 +1,16 @@
+/**
+ * KubernetesEvent Model
+ */
+const _KubernetesEvent = Object.freeze({
+  Id: '',
+  Date: 0,
+  Type: '',
+  Message: '',
+  Involved: {},
+});
+
+export class KubernetesEvent {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesEvent)));
+  }
+}
diff --git a/app/kubernetes/models/history/models.js b/app/kubernetes/models/history/models.js
new file mode 100644
index 0000000..026aaff
--- /dev/null
+++ b/app/kubernetes/models/history/models.js
@@ -0,0 +1,31 @@
+export const KubernetesSystem_DefaultDeploymentUniqueLabelKey = 'pod-template-hash';
+export const KubernetesSystem_RevisionAnnotation = 'deployment.kubernetes.io/revision';
+export const KubernetesSystem_RevisionHistoryAnnotation = 'deployment.kubernetes.io/revision-history';
+export const KubernetesSystem_DesiredReplicasAnnotation = 'deployment.kubernetes.io/desired-replicas';
+export const KubernetesSystem_MaxReplicasAnnotation = 'deployment.kubernetes.io/max-replicas';
+
+// annotationsToSkip lists the annotations that should be preserved from the deployment and not
+// copied from the replicaset when rolling a deployment back
+// var annotationsToSkip = map[string]bool{
+//   corev1.LastAppliedConfigAnnotation:       true,
+//   deploymentutil.RevisionAnnotation:        true,
+//   deploymentutil.RevisionHistoryAnnotation: true,
+//   deploymentutil.DesiredReplicasAnnotation: true,
+//   deploymentutil.MaxReplicasAnnotation:     true,
+//   appsv1.DeprecatedRollbackTo:              true,
+// }
+
+// LastAppliedConfigAnnotation is the annotation used to store the previous
+// configuration of a resource for use in a three way diff by UpdateApplyAnnotation.
+const LastAppliedConfigAnnotation = 'kubectl.kubernetes.io/last-applied-configuration';
+
+const DeprecatedRollbackTo = 'deprecated.deployment.rollback.to';
+
+export const KubernetesSystem_AnnotationsToSkip = {
+  [LastAppliedConfigAnnotation]: true,
+  [KubernetesSystem_RevisionAnnotation]: true,
+  [KubernetesSystem_RevisionHistoryAnnotation]: true,
+  [KubernetesSystem_DesiredReplicasAnnotation]: true,
+  [KubernetesSystem_MaxReplicasAnnotation]: true,
+  [DeprecatedRollbackTo]: true,
+};
diff --git a/app/kubernetes/models/namespace/models.js b/app/kubernetes/models/namespace/models.js
new file mode 100644
index 0000000..7888cdc
--- /dev/null
+++ b/app/kubernetes/models/namespace/models.js
@@ -0,0 +1,14 @@
+export class KubernetesNamespace {
+  constructor() {
+    this.Id = '';
+    this.Name = '';
+    this.CreationDate = '';
+    this.Status = '';
+    this.Yaml = '';
+    this.ResourcePoolName = '';
+    this.ResourcePoolOwner = '';
+    this.IsSystem = false;
+  }
+}
+
+export const KUBERNETES_DEFAULT_SYSTEM_NAMESPACES = ['kube-system', 'kube-public', 'kube-node-lease', 'portainer'];
diff --git a/app/kubernetes/models/namespace/payloads.js b/app/kubernetes/models/namespace/payloads.js
new file mode 100644
index 0000000..eb0d42f
--- /dev/null
+++ b/app/kubernetes/models/namespace/payloads.js
@@ -0,0 +1,14 @@
+import { KubernetesCommonMetadataPayload } from '../common/payloads';
+
+/**
+ * KubernetesNamespaceCreatePayload Model
+ */
+const _KubernetesNamespaceCreatePayload = Object.freeze({
+  metadata: new KubernetesCommonMetadataPayload(),
+});
+
+export class KubernetesNamespaceCreatePayload {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesNamespaceCreatePayload)));
+  }
+}
diff --git a/app/kubernetes/models/nodes-limits/models.js b/app/kubernetes/models/nodes-limits/models.js
new file mode 100644
index 0000000..b2f9425
--- /dev/null
+++ b/app/kubernetes/models/nodes-limits/models.js
@@ -0,0 +1,65 @@
+import _ from 'lodash-es';
+
+/**
+ * NodesLimits Model
+ */
+export class KubernetesNodesLimits {
+  constructor(nodesLimits) {
+    this.MaxCPU = 0;
+    this.MaxMemory = 0;
+    this.nodesLimits = this.convertCPU(nodesLimits);
+
+    this.calculateMaxCPUMemory();
+  }
+
+  convertCPU(nodesLimits) {
+    _.forEach(nodesLimits, (value) => {
+      if (value.CPU) {
+        value.CPU /= 1000.0;
+      }
+    });
+    return nodesLimits;
+  }
+
+  calculateMaxCPUMemory() {
+    const nodesLimitsArray = Object.values(this.nodesLimits);
+    this.MaxCPU = _.maxBy(nodesLimitsArray, 'CPU').CPU;
+    this.MaxMemory = _.maxBy(nodesLimitsArray, 'Memory').Memory;
+  }
+
+  // check if there is enough cpu and memory to allocate containers in replica mode
+  overflowForReplica(cpu, memory, instances) {
+    _.forEach(this.nodesLimits, (value) => {
+      instances -= Math.min(Math.floor(value.CPU / cpu), Math.floor(value.Memory / memory));
+    });
+
+    return instances > 0;
+  }
+
+  // check if there is enough cpu and memory to allocate containers in global mode
+  overflowForGlobal(cpu, memory) {
+    let overflow = false;
+
+    _.forEach(this.nodesLimits, (value) => {
+      if (cpu > value.CPU || memory > value.Memory) {
+        overflow = true;
+      }
+    });
+
+    return overflow;
+  }
+
+  excludesPods(pods, cpuLimit, memoryLimit) {
+    const nodesLimits = this.nodesLimits;
+
+    _.forEach(pods, (value) => {
+      const node = value.Node;
+      if (node && nodesLimits[node]) {
+        nodesLimits[node].CPU += cpuLimit;
+        nodesLimits[node].Memory += memoryLimit;
+      }
+    });
+
+    this.calculateMaxCPUMemory();
+  }
+}
diff --git a/app/kubernetes/models/port/models.js b/app/kubernetes/models/port/models.js
new file mode 100644
index 0000000..6b10040
--- /dev/null
+++ b/app/kubernetes/models/port/models.js
@@ -0,0 +1,34 @@
+/**
+ * PortMappingPort Model
+ */
+const _KubernetesPortMappingPort = Object.freeze({
+  Port: 0,
+  TargetPort: 0,
+  Protocol: '',
+  IngressRules: [], // KubernetesIngressRule[]
+});
+
+export class KubernetesPortMappingPort {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesPortMappingPort)));
+  }
+}
+
+/**
+ * PortMapping Model
+ */
+const _KubernetesPortMapping = Object.freeze({
+  Expanded: false,
+  Highlighted: false,
+  ResourcePool: '',
+  ServiceType: '',
+  ApplicationOwner: '',
+  LoadBalancerIPAddress: '',
+  Ports: [],
+});
+
+export class KubernetesPortMapping {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesPortMapping)));
+  }
+}
diff --git a/app/kubernetes/models/resource-pool/formValues.js b/app/kubernetes/models/resource-pool/formValues.js
new file mode 100644
index 0000000..9188658
--- /dev/null
+++ b/app/kubernetes/models/resource-pool/formValues.js
@@ -0,0 +1,57 @@
+import { KubernetesNginxRewriteTargetAnnotations, KubernetesNginxUseregexAnnotations, KubernetesTraefikRewriteTargetAnnotations } from '@/kubernetes/ingress/constants';
+
+export function KubernetesResourcePoolFormValues(defaults) {
+  this.Name = '';
+  this.MemoryLimit = defaults.MemoryLimit;
+  this.CpuLimit = defaults.CpuLimit;
+  this.HasQuota = false;
+  this.IngressClasses = []; // KubernetesResourcePoolIngressClassFormValue
+  this.Registries = []; // RegistryViewModel
+  this.EndpointId = 0;
+  this.IsSystem = false;
+}
+
+/**
+ * @param {KubernetesIngressClass} ingressClass
+ */
+export function KubernetesResourcePoolIngressClassFormValue(ingressClass) {
+  return {
+    Namespace: undefined, // will be filled inside ResourcePoolService.create
+    IngressClass: ingressClass,
+    RewriteTarget: false,
+    Annotations: [], // KubernetesResourcePoolIngressClassAnnotationFormValue
+    Hosts: [],
+    Selected: false,
+    WasSelected: false,
+    AdvancedConfig: false,
+    Paths: [], // will be filled to save IngressClass.Paths inside ingressClassesToFormValues() on RP EDIT
+  };
+}
+
+export function KubernetesResourcePoolIngressClassAnnotationFormValue() {
+  return {
+    Key: '',
+    Value: '',
+  };
+}
+
+export function KubernetesResourcePoolIngressClassHostFormValue() {
+  return {
+    Host: '',
+    PreviousHost: '',
+    NeedsDeletion: false,
+    IsNew: true,
+  };
+}
+
+export function KubernetesResourcePoolNginxRewriteAnnotationFormValue() {
+  return KubernetesNginxRewriteTargetAnnotations;
+}
+
+export function KubernetesResourcePoolNginxUseregexAnnotationFormValue() {
+  return KubernetesNginxUseregexAnnotations;
+}
+
+export function KubernetesResourcePoolTraefikRewriteAnnotationFormValue() {
+  return KubernetesTraefikRewriteTargetAnnotations;
+}
diff --git a/app/kubernetes/models/resource-pool/models.js b/app/kubernetes/models/resource-pool/models.js
new file mode 100644
index 0000000..b953cc5
--- /dev/null
+++ b/app/kubernetes/models/resource-pool/models.js
@@ -0,0 +1,17 @@
+export const KubernetesPortainerResourcePoolNameLabel = 'io.portainer.kubernetes.resourcepool.name';
+
+export const KubernetesPortainerResourcePoolOwnerLabel = 'io.portainer.kubernetes.resourcepool.owner';
+
+export const KubernetesPortainerNamespaceSystemLabel = 'io.portainer.kubernetes.namespace.system';
+
+/**
+ * KubernetesResourcePool Model
+ */
+export function KubernetesResourcePool() {
+  return {
+    Namespace: {}, // KubernetesNamespace
+    Quota: undefined, // KubernetesResourceQuota,
+    Ingresses: [], // KubernetesIngress[]
+    Yaml: '',
+  };
+}
diff --git a/app/kubernetes/models/resource-quota/models.js b/app/kubernetes/models/resource-quota/models.js
new file mode 100644
index 0000000..12a273d
--- /dev/null
+++ b/app/kubernetes/models/resource-quota/models.js
@@ -0,0 +1,27 @@
+import KubernetesResourceQuotaHelper from '@/kubernetes/helpers/resourceQuotaHelper';
+
+export const KubernetesPortainerResourceQuotaPrefix = 'portainer-rq-';
+export const KubernetesPortainerResourceQuotaCPULimit = 'limits.cpu';
+export const KubernetesPortainerResourceQuotaMemoryLimit = 'limits.memory';
+export const KubernetesPortainerResourceQuotaCPURequest = 'requests.cpu';
+export const KubernetesPortainerResourceQuotaMemoryRequest = 'requests.memory';
+
+export const KubernetesResourceQuotaDefaults = {
+  CpuLimit: 0,
+  MemoryLimit: 0,
+};
+
+export function KubernetesResourceQuota(namespace) {
+  return {
+    Id: '',
+    Namespace: namespace ? namespace : '',
+    Name: namespace ? KubernetesResourceQuotaHelper.generateResourceQuotaName(namespace) : '',
+    CpuLimit: KubernetesResourceQuotaDefaults.CpuLimit,
+    MemoryLimit: KubernetesResourceQuotaDefaults.MemoryLimit,
+    CpuLimitUsed: KubernetesResourceQuotaDefaults.CpuLimit,
+    MemoryLimitUsed: KubernetesResourceQuotaDefaults.MemoryLimit,
+    Yaml: '',
+    ResourcePoolName: '',
+    ResourcePoolOwner: '',
+  };
+}
diff --git a/app/kubernetes/models/resource-quota/payloads.js b/app/kubernetes/models/resource-quota/payloads.js
new file mode 100644
index 0000000..78f6fa8
--- /dev/null
+++ b/app/kubernetes/models/resource-quota/payloads.js
@@ -0,0 +1,21 @@
+import { KubernetesCommonMetadataPayload } from '@/kubernetes/models/common/payloads';
+import {
+  KubernetesPortainerResourceQuotaCPURequest,
+  KubernetesPortainerResourceQuotaMemoryRequest,
+  KubernetesPortainerResourceQuotaCPULimit,
+  KubernetesPortainerResourceQuotaMemoryLimit,
+} from './models';
+
+export function KubernetesResourceQuotaCreatePayload() {
+  return {
+    metadata: new KubernetesCommonMetadataPayload(),
+    spec: {
+      hard: {
+        [KubernetesPortainerResourceQuotaCPURequest]: 0,
+        [KubernetesPortainerResourceQuotaMemoryRequest]: 0,
+        [KubernetesPortainerResourceQuotaCPULimit]: 0,
+        [KubernetesPortainerResourceQuotaMemoryLimit]: 0,
+      },
+    },
+  };
+}
diff --git a/app/kubernetes/models/resource-reservation/models.js b/app/kubernetes/models/resource-reservation/models.js
new file mode 100644
index 0000000..ad13f6c
--- /dev/null
+++ b/app/kubernetes/models/resource-reservation/models.js
@@ -0,0 +1,13 @@
+/**
+ * KubernetesResourceReservation Model
+ */
+const _KubernetesResourceReservation = Object.freeze({
+  Memory: 0,
+  CPU: 0,
+});
+
+export class KubernetesResourceReservation {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesResourceReservation)));
+  }
+}
diff --git a/app/kubernetes/models/resource-types/models.js b/app/kubernetes/models/resource-types/models.js
new file mode 100644
index 0000000..4e73964
--- /dev/null
+++ b/app/kubernetes/models/resource-types/models.js
@@ -0,0 +1,19 @@
+export const KubernetesResourceTypes = Object.freeze({
+  NAMESPACE: 'Namespace',
+  RESOURCEQUOTA: 'ResourceQuota',
+  CONFIGMAP: 'ConfigMap',
+  SECRET: 'Secret',
+  DEPLOYMENT: 'Deployment',
+  STATEFULSET: 'StatefulSet',
+  DAEMONSET: 'Daemonset',
+  PERSISTENT_VOLUME_CLAIM: 'PersistentVolumeClaim',
+  SERVICE: 'Service',
+  INGRESS: 'Ingress',
+  HORIZONTAL_POD_AUTOSCALER: 'HorizontalPodAutoscaler',
+});
+
+export const KubernetesResourceActions = Object.freeze({
+  CREATE: 'Create',
+  UPDATE: 'Update',
+  DELETE: 'Delete',
+});
diff --git a/app/kubernetes/models/secret/models.js b/app/kubernetes/models/secret/models.js
new file mode 100644
index 0000000..7cababc
--- /dev/null
+++ b/app/kubernetes/models/secret/models.js
@@ -0,0 +1,22 @@
+/**
+ * KubernetesApplicationSecret Model
+ */
+const _KubernetesApplicationSecret = Object.freeze({
+  Id: 0,
+  Name: '',
+  Namespace: '',
+  Type: '',
+  CreationDate: '',
+  ConfigurationOwner: '',
+  Yaml: '',
+  Data: [],
+  SecretType: '',
+  Annotations: [],
+  Labels: {},
+});
+
+export class KubernetesApplicationSecret {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesApplicationSecret)));
+  }
+}
diff --git a/app/kubernetes/models/secret/payloads.js b/app/kubernetes/models/secret/payloads.js
new file mode 100644
index 0000000..90bf59a
--- /dev/null
+++ b/app/kubernetes/models/secret/payloads.js
@@ -0,0 +1,33 @@
+import { KubernetesCommonMetadataPayload } from '@/kubernetes/models/common/payloads';
+
+/**
+ * KubernetesSecretCreatePayload Model
+ */
+const _KubernetesSecretCreatePayload = Object.freeze({
+  metadata: new KubernetesCommonMetadataPayload(),
+  type: '',
+  data: {},
+  stringData: {},
+});
+
+export class KubernetesSecretCreatePayload {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesSecretCreatePayload)));
+  }
+}
+
+/**
+ * KubernetesSecretUpdatePayload Model
+ */
+const _KubernetesSecretUpdatePayload = Object.freeze({
+  metadata: new KubernetesCommonMetadataPayload(),
+  type: '',
+  data: {},
+  stringData: {},
+});
+
+export class KubernetesSecretUpdatePayload {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesSecretUpdatePayload)));
+  }
+}
diff --git a/app/kubernetes/models/service/models.js b/app/kubernetes/models/service/models.js
new file mode 100644
index 0000000..06dfb56
--- /dev/null
+++ b/app/kubernetes/models/service/models.js
@@ -0,0 +1,73 @@
+export const KubernetesServiceHeadlessPrefix = 'headless-';
+export const KubernetesServiceHeadlessClusterIP = 'None';
+export const KubernetesServiceTypes = Object.freeze({
+  LOAD_BALANCER: 'LoadBalancer',
+  NODE_PORT: 'NodePort',
+  CLUSTER_IP: 'ClusterIP',
+  INGRESS: 'Ingress',
+});
+
+/**
+ * KubernetesService Model
+ */
+const _KubernetesService = Object.freeze({
+  Headless: false,
+  Namespace: '',
+  Name: '',
+  StackName: '',
+  Ports: [],
+  Type: '',
+  ClusterIP: '',
+  ApplicationName: '',
+  ApplicationOwner: '',
+  Note: '',
+  Ingress: false,
+  Selector: {},
+  nodePortError: false,
+  servicePortError: false,
+});
+
+export class KubernetesService {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesService)));
+  }
+}
+
+const _KubernetesIngressService = Object.freeze({
+  Headless: false,
+  Namespace: '',
+  Name: '',
+  StackName: '',
+  Ports: [],
+  Type: '',
+  ClusterIP: '',
+  ApplicationName: '',
+  ApplicationOwner: '',
+  Note: '',
+  Ingress: true,
+  IngressRoute: [],
+});
+
+export class KubernetesIngressService {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesIngressService)));
+  }
+}
+
+/**
+ * KubernetesServicePort Model
+ */
+const _KubernetesServicePort = Object.freeze({
+  name: '',
+  port: 0,
+  targetPort: 0,
+  protocol: '',
+  nodePort: 0,
+  ingress: '',
+});
+
+export class KubernetesServicePort {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesServicePort)));
+  }
+}
diff --git a/app/kubernetes/models/service/payloads.js b/app/kubernetes/models/service/payloads.js
new file mode 100644
index 0000000..ea72a6e
--- /dev/null
+++ b/app/kubernetes/models/service/payloads.js
@@ -0,0 +1,22 @@
+import { KubernetesCommonMetadataPayload } from '@/kubernetes/models/common/payloads';
+
+/**
+ * KubernetesServiceCreatePayload Model
+ */
+const _KubernetesServiceCreatePayload = Object.freeze({
+  metadata: new KubernetesCommonMetadataPayload(),
+  spec: {
+    ports: [],
+    selector: {
+      app: '',
+    },
+    type: '',
+    clusterIP: '',
+  },
+});
+
+export class KubernetesServiceCreatePayload {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesServiceCreatePayload)));
+  }
+}
diff --git a/app/kubernetes/models/stack/models.js b/app/kubernetes/models/stack/models.js
new file mode 100644
index 0000000..1c9c274
--- /dev/null
+++ b/app/kubernetes/models/stack/models.js
@@ -0,0 +1,14 @@
+/**
+ * Stack Model
+ */
+const _KubernetesStack = Object.freeze({
+  Name: '',
+  ResourcePool: '',
+  Applications: [],
+});
+
+export class KubernetesStack {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesStack)));
+  }
+}
diff --git a/app/kubernetes/models/stateful-set/models.js b/app/kubernetes/models/stateful-set/models.js
new file mode 100644
index 0000000..fa44579
--- /dev/null
+++ b/app/kubernetes/models/stateful-set/models.js
@@ -0,0 +1,28 @@
+/**
+ * KubernetesStatefulSet Model
+ */
+const _KubernetesStatefulSet = Object.freeze({
+  Namespace: '',
+  Name: '',
+  StackName: '',
+  ReplicaCount: 0,
+  ImageModel: null,
+  Env: [],
+  CpuLimit: '',
+  MemoryLimit: '',
+  VolumeMounts: [],
+  Volumes: [],
+  Secret: undefined,
+  VolumeClaims: [],
+  ServiceName: '',
+  ApplicationName: '',
+  ApplicationOwner: '',
+  Note: '',
+  Affinity: undefined, // KubernetesPodAffinity
+});
+
+export class KubernetesStatefulSet {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesStatefulSet)));
+  }
+}
diff --git a/app/kubernetes/models/stateful-set/payloads.js b/app/kubernetes/models/stateful-set/payloads.js
new file mode 100644
index 0000000..d2cde94
--- /dev/null
+++ b/app/kubernetes/models/stateful-set/payloads.js
@@ -0,0 +1,52 @@
+import { KubernetesCommonMetadataPayload } from '@/kubernetes/models/common/payloads';
+
+/**
+ * KubernetesStatefulSetCreatePayload Model
+ */
+const _KubernetesStatefulSetCreatePayload = Object.freeze({
+  metadata: new KubernetesCommonMetadataPayload(),
+  spec: {
+    replicas: 0,
+    serviceName: '',
+    selector: {
+      matchLabels: {
+        app: '',
+      },
+    },
+    volumeClaimTemplates: [],
+    updateStrategy: {
+      type: 'RollingUpdate',
+      rollingUpdate: {
+        partition: 0,
+      },
+    },
+    template: {
+      metadata: {
+        labels: {
+          app: '',
+        },
+      },
+      spec: {
+        containers: [
+          {
+            name: '',
+            image: '',
+            env: [],
+            resources: {
+              limits: {},
+              requests: {},
+            },
+            volumeMounts: [],
+          },
+        ],
+        volumes: [],
+      },
+    },
+  },
+});
+
+export class KubernetesStatefulSetCreatePayload {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesStatefulSetCreatePayload)));
+  }
+}
diff --git a/app/kubernetes/models/storage-class/StorageClass.ts b/app/kubernetes/models/storage-class/StorageClass.ts
new file mode 100644
index 0000000..49d65bb
--- /dev/null
+++ b/app/kubernetes/models/storage-class/StorageClass.ts
@@ -0,0 +1,9 @@
+export class StorageClass {
+  Name: string = '';
+
+  Provisioner: string = '';
+
+  ReclaimPolicy: string = '';
+
+  AllowVolumeExpansion: boolean = false;
+}
diff --git a/app/kubernetes/models/storage-class/models.js b/app/kubernetes/models/storage-class/models.js
new file mode 100644
index 0000000..556f4c8
--- /dev/null
+++ b/app/kubernetes/models/storage-class/models.js
@@ -0,0 +1,21 @@
+export { StorageClass as KubernetesStorageClass } from './StorageClass';
+
+/**
+ * KubernetesStorageClassAccessPolicies Model
+ */
+const _KubernetesStorageClassAccessPolicies = Object.freeze([
+  {
+    Name: 'ReadWriteOnce',
+    Description: 'Allow read-write from a single pod only (RWO)',
+    selected: true,
+  },
+  {
+    Name: 'ReadWriteMany',
+    Description: 'Allow read-write access from one or more pods concurrently (RWX)',
+    selected: false,
+  },
+]);
+
+export function KubernetesStorageClassAccessPolicies() {
+  return JSON.parse(JSON.stringify(_KubernetesStorageClassAccessPolicies));
+}
diff --git a/app/kubernetes/models/storage-class/payload.js b/app/kubernetes/models/storage-class/payload.js
new file mode 100644
index 0000000..c0eced1
--- /dev/null
+++ b/app/kubernetes/models/storage-class/payload.js
@@ -0,0 +1,16 @@
+import { KubernetesCommonMetadataPayload } from '@/kubernetes/models/common/payloads';
+
+/**
+ * KubernetesStorageClassCreatePayload Model
+ */
+const _KubernetesStorageClassCreatePayload = Object.freeze({
+  metadata: new KubernetesCommonMetadataPayload(),
+  provisioner: '',
+  allowVolumeExpansion: false,
+});
+
+export class KubernetesStorageClassCreatePayload {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesStorageClassCreatePayload)));
+  }
+}
diff --git a/app/kubernetes/models/volume/PersistentVolumeClaim.ts b/app/kubernetes/models/volume/PersistentVolumeClaim.ts
new file mode 100644
index 0000000..5db4e0a
--- /dev/null
+++ b/app/kubernetes/models/volume/PersistentVolumeClaim.ts
@@ -0,0 +1,33 @@
+import uuidv4 from 'uuid/v4';
+
+import { StorageClass } from '../storage-class/StorageClass';
+
+export class PersistentVolumeClaim {
+  Id: string = uuidv4();
+
+  Name: string = '';
+
+  PreviousName: string = '';
+
+  Namespace: string = '';
+
+  Storage: number = 0;
+
+  storageClass?: StorageClass; // KubernetesStorageClass
+
+  CreationDate: string = '';
+
+  ApplicationOwner: string = '';
+
+  AccessModes: Array<unknown> = [];
+
+  ApplicationName: string = '';
+
+  /**
+   * used for Application creation from `ApplicationFormValues`
+   *  not used from API conversion
+   */
+  MountPath: string = '';
+
+  Yaml: string = '';
+}
diff --git a/app/kubernetes/models/volume/Volume.ts b/app/kubernetes/models/volume/Volume.ts
new file mode 100644
index 0000000..ae5e534
--- /dev/null
+++ b/app/kubernetes/models/volume/Volume.ts
@@ -0,0 +1,14 @@
+import { KubernetesApplication } from '../application/models';
+import { KubernetesResourcePool } from '../resource-pool/models';
+
+import { PersistentVolumeClaim } from './PersistentVolumeClaim';
+
+type VolumeResourcePool = ReturnType<typeof KubernetesResourcePool>;
+
+export class Volume {
+  ResourcePool?: VolumeResourcePool = {} as VolumeResourcePool;
+
+  PersistentVolumeClaim: PersistentVolumeClaim = {} as PersistentVolumeClaim;
+
+  Applications: KubernetesApplication[] = [];
+}
diff --git a/app/kubernetes/models/volume/models.js b/app/kubernetes/models/volume/models.js
new file mode 100644
index 0000000..4228cd9
--- /dev/null
+++ b/app/kubernetes/models/volume/models.js
@@ -0,0 +1,2 @@
+export { Volume as KubernetesVolume } from './Volume';
+export { PersistentVolumeClaim as KubernetesPersistentVolumeClaim } from './PersistentVolumeClaim';
diff --git a/app/kubernetes/models/volume/payloads.js b/app/kubernetes/models/volume/payloads.js
new file mode 100644
index 0000000..5c3a3ca
--- /dev/null
+++ b/app/kubernetes/models/volume/payloads.js
@@ -0,0 +1,23 @@
+import { KubernetesCommonMetadataPayload } from '@/kubernetes/models/common/payloads';
+
+/**
+ * KubernetesPersistentVolumClaimCreatePayload Model
+ */
+const _KubernetesPersistentVolumClaimCreatePayload = Object.freeze({
+  metadata: new KubernetesCommonMetadataPayload(),
+  spec: {
+    accessModes: ['ReadWriteOnce'],
+    resources: {
+      requests: {
+        storage: '',
+      },
+    },
+    storageClassName: '',
+  },
+});
+
+export class KubernetesPersistentVolumClaimCreatePayload {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesPersistentVolumClaimCreatePayload)));
+  }
+}
diff --git a/app/kubernetes/node/converter.js b/app/kubernetes/node/converter.js
new file mode 100644
index 0000000..de4fb0d
--- /dev/null
+++ b/app/kubernetes/node/converter.js
@@ -0,0 +1,172 @@
+import _ from 'lodash-es';
+
+import * as JsonPatch from 'fast-json-patch';
+import { KubernetesNode, KubernetesNodeDetails, KubernetesNodeTaint, KubernetesNodeAvailabilities, KubernetesPortainerNodeDrainLabel } from '@/kubernetes/node/models';
+import { KubernetesNodeFormValues, KubernetesNodeTaintFormValues, KubernetesNodeLabelFormValues } from '@/kubernetes/node/formValues';
+import { KubernetesNodeCreatePayload, KubernetesNodeTaintPayload } from '@/kubernetes/node/payload';
+import { parseCPU } from '@/react/kubernetes/utils';
+
+class KubernetesNodeConverter {
+  static apiToNode(data, res) {
+    if (!res) {
+      res = new KubernetesNode();
+    }
+    res.Id = data.metadata.uid;
+    const hostName = _.find(data.status.addresses, { type: 'Hostname' });
+    res.Name = data.metadata.name ? data.metadata.name : hostName.address;
+    res.Labels = data.metadata.labels;
+    // most kube clusters set control-plane label, older clusters set master, microk8s doesn't have either but instead sets microk8s-controlplane
+    let masters = ['node-role.kubernetes.io/control-plane', 'node-role.kubernetes.io/master', 'node.kubernetes.io/microk8s-controlplane'];
+    res.Role = _.some(masters, (master) => _.has(data.metadata.labels, master)) ? 'Master' : 'Worker';
+
+    const ready = _.find(data.status.conditions, { type: KubernetesNodeConditionTypes.READY });
+    const memoryPressure = _.find(data.status.conditions, { type: KubernetesNodeConditionTypes.MEMORY_PRESSURE });
+    const PIDPressure = _.find(data.status.conditions, { type: KubernetesNodeConditionTypes.PID_PRESSURE });
+    const diskPressure = _.find(data.status.conditions, { type: KubernetesNodeConditionTypes.DISK_PRESSURE });
+    const networkUnavailable = _.find(data.status.conditions, { type: KubernetesNodeConditionTypes.NETWORK_UNAVAILABLE });
+
+    res.Conditions = {
+      MemoryPressure: memoryPressure && memoryPressure.status === 'True',
+      PIDPressure: PIDPressure && PIDPressure.status === 'True',
+      DiskPressure: diskPressure && diskPressure.status === 'True',
+      NetworkUnavailable: networkUnavailable && networkUnavailable.status === 'True',
+    };
+
+    res.Availability = KubernetesNodeAvailabilities.ACTIVE;
+    if (data.spec.unschedulable === true) {
+      res.Availability = _.has(data.metadata.labels, KubernetesPortainerNodeDrainLabel) ? KubernetesNodeAvailabilities.DRAIN : KubernetesNodeAvailabilities.PAUSE;
+    }
+
+    if (ready.status === 'False') {
+      res.Status = 'Unhealthy';
+    } else if (ready.status === 'Unknown' || res.Conditions.MemoryPressure || res.Conditions.PIDPressure || res.Conditions.DiskPressure || res.Conditions.NetworkUnavailable) {
+      res.Status = 'Warning';
+    } else {
+      res.Status = 'Ready';
+    }
+
+    res.CPU = parseCPU(data.status.allocatable.cpu);
+    res.Memory = data.status.allocatable.memory;
+    res.Version = data.status.nodeInfo.kubeletVersion;
+    const internalIP = _.find(data.status.addresses, { type: 'InternalIP' });
+    res.IPAddress = internalIP ? internalIP.address : '-';
+    res.Taints = _.map(data.spec.taints, (taint) => {
+      const res = new KubernetesNodeTaint();
+      res.Key = taint.key;
+      res.Value = taint.value;
+      res.Effect = taint.effect;
+      return res;
+    });
+    return res;
+  }
+
+  static apiToNodeDetails(data, yaml) {
+    let res = new KubernetesNodeDetails();
+    res = KubernetesNodeConverter.apiToNode(data, res);
+    res.CreationDate = data.metadata.creationTimestamp;
+    res.OS.Architecture = data.status.nodeInfo.architecture;
+    res.OS.Platform = data.status.nodeInfo.operatingSystem;
+    res.OS.Image = data.status.nodeInfo.osImage;
+    res.Yaml = yaml ? yaml.data : '';
+    return res;
+  }
+
+  static nodeToFormValues(node) {
+    const res = new KubernetesNodeFormValues();
+
+    res.Availability = node.Availability;
+
+    res.Taints = _.map(node.Taints, (taint) => {
+      const res = new KubernetesNodeTaintFormValues();
+      res.Key = taint.Key;
+      res.Value = taint.Value;
+      res.Effect = taint.Effect;
+      res.NeedsDeletion = false;
+      res.IsNew = false;
+      return res;
+    });
+
+    res.Labels = _.map(node.Labels, (value, key) => {
+      const res = new KubernetesNodeLabelFormValues();
+      res.Key = key;
+      res.Value = value;
+      res.NeedsDeletion = false;
+      res.IsNew = false;
+      return res;
+    });
+
+    return res;
+  }
+
+  static formValuesToNode(node, formValues) {
+    const res = angular.copy(node);
+
+    res.Availability = formValues.Availability;
+
+    const filteredTaints = _.filter(formValues.Taints, (taint) => !taint.NeedsDeletion);
+    res.Taints = _.map(filteredTaints, (item) => {
+      const taint = new KubernetesNodeTaint();
+      taint.Key = item.Key;
+      taint.Value = item.Value;
+      taint.Effect = item.Effect;
+      return taint;
+    });
+
+    const filteredLabels = _.filter(formValues.Labels, (label) => !label.NeedsDeletion);
+    res.Labels = _.reduce(
+      filteredLabels,
+      (acc, item) => {
+        acc[item.Key] = item.Value ? item.Value : '';
+        return acc;
+      },
+      {}
+    );
+
+    return res;
+  }
+
+  static createPayload(node) {
+    const payload = new KubernetesNodeCreatePayload();
+    payload.metadata.name = node.Name;
+
+    const taints = _.map(node.Taints, (taint) => {
+      const res = new KubernetesNodeTaintPayload();
+      res.key = taint.Key;
+      res.value = taint.Value;
+      res.effect = taint.Effect;
+      return res;
+    });
+
+    payload.spec.taints = taints.length ? taints : undefined;
+
+    payload.metadata.labels = node.Labels;
+
+    if (node.Availability !== KubernetesNodeAvailabilities.ACTIVE) {
+      payload.spec.unschedulable = true;
+      if (node.Availability === KubernetesNodeAvailabilities.DRAIN) {
+        payload.metadata.labels[KubernetesPortainerNodeDrainLabel] = '';
+      } else {
+        delete payload.metadata.labels[KubernetesPortainerNodeDrainLabel];
+      }
+    }
+
+    return payload;
+  }
+
+  static patchPayload(oldNode, newNode) {
+    const oldPayload = KubernetesNodeConverter.createPayload(oldNode);
+    const newPayload = KubernetesNodeConverter.createPayload(newNode);
+    const payload = JsonPatch.compare(oldPayload, newPayload);
+    return payload;
+  }
+}
+
+export const KubernetesNodeConditionTypes = Object.freeze({
+  READY: 'Ready',
+  MEMORY_PRESSURE: 'MemoryPressure',
+  PID_PRESSURE: 'PIDPressure',
+  DISK_PRESSURE: 'DiskPressure',
+  NETWORK_UNAVAILABLE: 'NetworkUnavailable',
+});
+
+export default KubernetesNodeConverter;
diff --git a/app/kubernetes/node/filters.js b/app/kubernetes/node/filters.js
new file mode 100644
index 0000000..d848a95
--- /dev/null
+++ b/app/kubernetes/node/filters.js
@@ -0,0 +1,35 @@
+import _ from 'lodash-es';
+
+angular
+  .module('portainer.kubernetes')
+  .filter('kubernetesNodeStatusColor', function () {
+    'use strict';
+    return function (text) {
+      var status = _.toLower(text);
+      switch (status) {
+        case 'ready':
+          return 'success';
+        case 'warning':
+          return 'warning';
+        default:
+          return 'danger';
+      }
+    };
+  })
+  .filter('kubernetesNodeConditionsMessage', function () {
+    'use strict';
+    return function (conditions) {
+      if (conditions.MemoryPressure) {
+        return 'Node memory is running low';
+      }
+      if (conditions.PIDPressure) {
+        return 'Too many processes running on the node';
+      }
+      if (conditions.DiskPressure) {
+        return 'Node disk capacity is running low';
+      }
+      if (conditions.NetworkUnavailable) {
+        return 'Incorrect node network configuration';
+      }
+    };
+  });
diff --git a/app/kubernetes/node/formValues.js b/app/kubernetes/node/formValues.js
new file mode 100644
index 0000000..51e9cb4
--- /dev/null
+++ b/app/kubernetes/node/formValues.js
@@ -0,0 +1,41 @@
+const _KubernetesNodeFormValues = Object.freeze({
+  Taints: [],
+  Labels: [],
+  Availability: '',
+});
+
+export class KubernetesNodeFormValues {
+  constructor() {
+    Object.assign(JSON.parse(JSON.stringify(_KubernetesNodeFormValues)));
+  }
+}
+
+const _KubernetesNodeTaintFormValues = Object.freeze({
+  Key: '',
+  Values: '',
+  Effect: '',
+  NeedsDeletion: false,
+  IsNew: false,
+  IsChanged: false,
+});
+
+export class KubernetesNodeTaintFormValues {
+  constructor() {
+    Object.assign(JSON.parse(JSON.stringify(_KubernetesNodeTaintFormValues)));
+  }
+}
+
+const _KubernetesNodeLabelFormValues = Object.freeze({
+  Key: '',
+  Values: '',
+  NeedsDeletion: false,
+  IsNew: false,
+  IsUsed: false,
+  IsChanged: false,
+});
+
+export class KubernetesNodeLabelFormValues {
+  constructor() {
+    Object.assign(JSON.parse(JSON.stringify(_KubernetesNodeLabelFormValues)));
+  }
+}
diff --git a/app/kubernetes/node/helper.js b/app/kubernetes/node/helper.js
new file mode 100644
index 0000000..73ae999
--- /dev/null
+++ b/app/kubernetes/node/helper.js
@@ -0,0 +1,34 @@
+import _ from 'lodash-es';
+
+export class KubernetesNodeHelper {
+  static isSystemLabel(label) {
+    return !label.IsNew && (_.startsWith(label.Key, 'beta.kubernetes.io') || _.startsWith(label.Key, 'kubernetes.io') || label.Key === 'node-role.kubernetes.io/master');
+  }
+
+  static reorderLabels(labels) {
+    return _.sortBy(labels, (label) => {
+      return !KubernetesNodeHelper.isSystemLabel(label);
+    });
+  }
+
+  static computeUsedLabels(applications, labels) {
+    const pods = _.flatten(_.map(applications, 'Pods'));
+    const nodeSelectors = _.uniq(_.flatten(_.map(pods, 'NodeSelector')));
+
+    return _.map(labels, (label) => {
+      label.IsUsed = _.find(nodeSelectors, (ns) => ns && ns[label.Key] === label.Value) ? true : false;
+      return label;
+    });
+  }
+
+  static generateNodeLabelsFromNodes(nodes) {
+    const pairs = _.flatMap(nodes, (node) => {
+      return _.map(_.toPairs(node.Labels), ([k, v]) => {
+        return { key: k, value: v };
+      });
+    });
+    return _.map(_.groupBy(pairs, 'key'), (values, key) => {
+      return { Key: key, Values: _.uniq(_.map(values, 'value')) };
+    });
+  }
+}
diff --git a/app/kubernetes/node/models.js b/app/kubernetes/node/models.js
new file mode 100644
index 0000000..86bf8da
--- /dev/null
+++ b/app/kubernetes/node/models.js
@@ -0,0 +1,74 @@
+export const KubernetesPortainerNodeDrainLabel = 'io.portainer/node-status-drain';
+
+/**
+ * KubernetesNode Model
+ */
+const _KubernetesNode = Object.freeze({
+  Id: '',
+  Name: '',
+  Labels: {},
+  Role: '',
+  Status: '',
+  CPU: 0,
+  Memory: '',
+  Version: '',
+  IPAddress: '',
+  Api: false,
+  Taints: [],
+  Port: 0,
+  Availability: '',
+});
+
+export class KubernetesNode {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesNode)));
+  }
+}
+
+/**
+ * KubernetesNodeDetails Model
+ */
+const _KubernetesNodeDetails = Object.freeze({
+  CreationDate: '',
+  OS: {
+    Architecture: '',
+    Platform: '',
+    Image: '',
+  },
+  Conditions: [],
+  Yaml: '',
+});
+
+export class KubernetesNodeDetails {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesNode)));
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesNodeDetails)));
+  }
+}
+
+/**
+ * KubernetesNodeTaint Model
+ */
+const _KubernetesNodeTaint = Object.freeze({
+  Key: '',
+  Value: '',
+  Effect: '',
+});
+
+export class KubernetesNodeTaint {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesNodeTaint)));
+  }
+}
+
+export const KubernetesNodeAvailabilities = Object.freeze({
+  ACTIVE: 'Active',
+  PAUSE: 'Pause',
+  DRAIN: 'Drain',
+});
+
+export const KubernetesNodeTaintEffects = Object.freeze({
+  NOSCHEDULE: 'NoSchedule',
+  PREFERNOSCHEDULE: 'PreferNoSchedule',
+  NOEXECUTE: 'NoExecute',
+});
diff --git a/app/kubernetes/node/payload.js b/app/kubernetes/node/payload.js
new file mode 100644
index 0000000..fbd974f
--- /dev/null
+++ b/app/kubernetes/node/payload.js
@@ -0,0 +1,31 @@
+/**
+ * KubernetesNode Create Payload Model
+ * Note: The current payload is here just to create patch payload.
+ */
+const _KubernetesNodeCreatePayload = Object.freeze({
+  metadata: {
+    name: '',
+    labels: {},
+  },
+  spec: {
+    taints: undefined,
+  },
+});
+
+export class KubernetesNodeCreatePayload {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesNodeCreatePayload)));
+  }
+}
+
+const _KubernetesNodeTaintPayload = Object.freeze({
+  key: '',
+  value: '',
+  effect: '',
+});
+
+export class KubernetesNodeTaintPayload {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesNodeTaintPayload)));
+  }
+}
diff --git a/app/kubernetes/node/rest.js b/app/kubernetes/node/rest.js
new file mode 100644
index 0000000..7265156
--- /dev/null
+++ b/app/kubernetes/node/rest.js
@@ -0,0 +1,42 @@
+import { rawResponse } from '@/kubernetes/rest/response/transform';
+
+angular.module('portainer.kubernetes').factory('KubernetesNodes', [
+  '$resource',
+  'API_ENDPOINT_ENDPOINTS',
+  'EndpointProvider',
+  function KubernetesNodesFactory($resource, API_ENDPOINT_ENDPOINTS, EndpointProvider) {
+    'use strict';
+    return function () {
+      const url = API_ENDPOINT_ENDPOINTS + '/:endpointId/kubernetes/api/v1/nodes/:id/:action';
+      return $resource(
+        url,
+        {
+          endpointId: EndpointProvider.endpointID,
+        },
+        {
+          get: {
+            method: 'GET',
+            ignoreLoadingBar: true,
+          },
+          getYaml: {
+            method: 'GET',
+            headers: {
+              Accept: 'application/yaml',
+            },
+            transformResponse: rawResponse,
+            ignoreLoadingBar: true,
+          },
+          create: { method: 'POST' },
+          update: { method: 'PUT' },
+          patch: {
+            method: 'PATCH',
+            headers: {
+              'Content-Type': 'application/json-patch+json',
+            },
+          },
+          delete: { method: 'DELETE' },
+        }
+      );
+    };
+  },
+]);
diff --git a/app/kubernetes/node/service.js b/app/kubernetes/node/service.js
new file mode 100644
index 0000000..df9c4dc
--- /dev/null
+++ b/app/kubernetes/node/service.js
@@ -0,0 +1,75 @@
+import angular from 'angular';
+import _ from 'lodash-es';
+
+import PortainerError from '@/portainer/error';
+import KubernetesNodeConverter from '@/kubernetes/node/converter';
+import { KubernetesCommonParams } from '@/kubernetes/models/common/params';
+
+class KubernetesNodeService {
+  /* @ngInject */
+  constructor($async, KubernetesNodes) {
+    this.$async = $async;
+    this.KubernetesNodes = KubernetesNodes;
+
+    this.getAsync = this.getAsync.bind(this);
+    this.getAllAsync = this.getAllAsync.bind(this);
+    this.patchAsync = this.patchAsync.bind(this);
+  }
+
+  /**
+   * GET
+   */
+  async getAsync(name) {
+    try {
+      const params = new KubernetesCommonParams();
+      params.id = name;
+      const [details, yaml] = await Promise.all([this.KubernetesNodes().get(params).$promise, this.KubernetesNodes().getYaml(params).$promise]);
+      return KubernetesNodeConverter.apiToNodeDetails(details, yaml);
+    } catch (err) {
+      // changing the structure of error message to fix [object, Object] issue
+      const errData = err.data;
+      throw new PortainerError('Unable to retrieve node details', errData);
+    }
+  }
+
+  async getAllAsync() {
+    try {
+      const data = await this.KubernetesNodes().get().$promise;
+      return _.map(data.items, (item) => KubernetesNodeConverter.apiToNode(item));
+    } catch (err) {
+      throw { msg: 'Unable to retrieve nodes', err: err };
+    }
+  }
+
+  get(name) {
+    if (name) {
+      return this.$async(this.getAsync, name);
+    }
+    return this.$async(this.getAllAsync);
+  }
+
+  /**
+   * PATCH
+   */
+
+  async patchAsync(node, nodeFormValues) {
+    try {
+      const params = new KubernetesCommonParams();
+      params.id = node.Name;
+      const newNode = KubernetesNodeConverter.formValuesToNode(node, nodeFormValues);
+      const payload = KubernetesNodeConverter.patchPayload(node, newNode);
+      const data = await this.KubernetesNodes().patch(params, payload).$promise;
+      const patchedNode = KubernetesNodeConverter.apiToNodeDetails(data);
+      return patchedNode;
+    } catch (err) {
+      throw { msg: 'Unable to patch node', err: err };
+    }
+  }
+
+  patch(node, nodeFormValues) {
+    return this.$async(this.patchAsync, node, nodeFormValues);
+  }
+}
+
+export default KubernetesNodeService;
+angular.module('portainer.kubernetes').service('KubernetesNodeService', KubernetesNodeService);
diff --git a/app/kubernetes/pod/converter.js b/app/kubernetes/pod/converter.js
new file mode 100644
index 0000000..3b16f1d
--- /dev/null
+++ b/app/kubernetes/pod/converter.js
@@ -0,0 +1,207 @@
+import * as JsonPatch from 'fast-json-patch';
+import _ from 'lodash-es';
+
+import KubernetesCommonHelper from '@/kubernetes/helpers/commonHelper';
+import {
+  KubernetesPortainerApplicationStackNameLabel,
+  KubernetesPortainerApplicationNameLabel,
+  KubernetesPortainerApplicationOwnerLabel,
+  KubernetesPortainerApplicationNote,
+} from '@/kubernetes/models/application/models';
+
+import KubernetesResourceReservationHelper from '@/kubernetes/helpers/resourceReservationHelper';
+import { KubernetesPod, KubernetesPodToleration, KubernetesPodAffinity, KubernetesPodContainer, KubernetesPodContainerTypes, KubernetesPodEviction } from '@/kubernetes/pod/models';
+import KubernetesApplicationHelper from '@/kubernetes/helpers/application';
+import { createPayloadFactory } from './payloads/create';
+
+function computeStatus(statuses) {
+  const containerStatuses = _.map(statuses, 'state');
+  const running = _.filter(containerStatuses, (s) => s.running).length;
+  const waiting = _.filter(containerStatuses, (s) => s.waiting).length;
+  if (waiting) {
+    return 'Waiting';
+  } else if (!running) {
+    return 'Terminated';
+  }
+  return 'Running';
+}
+
+function computeContainerStatus(statuses, name) {
+  const status = _.find(statuses, { name: name });
+  if (!status) {
+    return 'Terminated';
+  }
+  const state = status.state;
+  if (state.waiting) {
+    return 'Waiting';
+  }
+  if (!state.running) {
+    return 'Terminated';
+  }
+  return 'Running';
+}
+
+function computeAffinity(affinity) {
+  const res = new KubernetesPodAffinity();
+  if (affinity) {
+    res.nodeAffinity = affinity.nodeAffinity || {};
+  }
+  return res;
+}
+
+function computeTolerations(tolerations) {
+  return _.map(tolerations, (item) => {
+    const res = new KubernetesPodToleration();
+    res.Key = item.key;
+    res.Operator = item.operator;
+    res.Value = item.value;
+    res.TolerationSeconds = item.tolerationSeconds;
+    res.Effect = item.effect;
+    return res;
+  });
+}
+
+function computeContainers(data) {
+  const containers = data.spec.containers;
+  const initContainers = data.spec.initContainers;
+
+  return _.concat(
+    _.map(containers, (item) => {
+      const res = new KubernetesPodContainer();
+      res.Type = KubernetesPodContainerTypes.APP;
+      res.PodName = data.metadata.name;
+      res.PodIP = data.status.podIP;
+      res.Name = item.name;
+      res.Image = item.image;
+      res.ImagePullPolicy = item.imagePullPolicy;
+      res.Node = data.spec.nodeName;
+      res.CreationDate = data.status.startTime;
+      res.Status = computeContainerStatus(data.status.containerStatuses, item.name);
+      res.Limits = item.resources.limits;
+      res.Requests = item.resources.requests;
+      res.VolumeMounts = item.volumeMounts;
+      res.Env = item.env;
+      return res;
+    }),
+    _.map(initContainers, (item) => {
+      const res = new KubernetesPodContainer();
+      res.Type = KubernetesPodContainerTypes.INIT;
+      res.PodName = data.metadata.name;
+      res.Name = item.name;
+      res.Image = item.image;
+      res.Node = data.spec.nodeName;
+      res.CreationDate = data.status.startTime;
+      res.Status = computeContainerStatus(data.status.containerStatuses, item.name);
+      res.Limits = item.resources.limits;
+      res.Requests = item.resources.requests;
+      res.VolumeMounts = item.volumeMounts;
+      res.Env = item.env;
+      return res;
+    })
+  );
+}
+
+export default class KubernetesPodConverter {
+  static applicationFormValuesToPod(formValues, volumeClaims) {
+    let serviceSelector = {};
+    if (formValues.Services.length) {
+      serviceSelector = formValues.Services[0].Selector || { app: formValues.Name };
+    }
+
+    const res = new KubernetesPod();
+    res.Namespace = formValues.ResourcePool.Namespace.Name;
+    res.Name = formValues.Name;
+    res.StackName = formValues.StackName ? formValues.StackName : formValues.Name;
+    res.ApplicationOwner = formValues.ApplicationOwner;
+    res.ApplicationName = formValues.Name;
+    res.ImageModel = formValues.ImageModel;
+    res.CpuLimit = formValues.CpuLimit;
+    res.MemoryLimit = KubernetesResourceReservationHelper.bytesValue(formValues.MemoryLimit);
+    res.Env = KubernetesApplicationHelper.generateEnvFromEnvVariables(formValues.EnvironmentVariables);
+    res.Containers = formValues.Containers;
+    res.ApplicationType = formValues.ApplicationType;
+    res.ServiceSelector = serviceSelector;
+    res.Labels = formValues.Labels;
+    KubernetesApplicationHelper.generateVolumesFromPersistentVolumClaims(res, volumeClaims);
+    KubernetesApplicationHelper.generateEnvOrVolumesFromConfigurations(res, formValues.ConfigMaps, formValues.Secrets);
+    KubernetesApplicationHelper.generateAffinityFromPlacements(res, formValues);
+    return res;
+  }
+
+  static apiToModel(data) {
+    const res = new KubernetesPod();
+    res.Id = data.metadata.uid;
+    res.Name = data.metadata.name;
+    res.Namespace = data.metadata.namespace;
+    res.Images = _.map(data.spec.containers, 'image');
+    res.Status = computeStatus(data.status.containerStatuses);
+    res.Restarts = _.sumBy(data.status.containerStatuses, 'restartCount');
+    res.Node = data.spec.nodeName;
+    res.CreationDate = data.status.startTime;
+    res.Containers = computeContainers(data);
+    res.Labels = data.metadata.labels;
+    res.Affinity = computeAffinity(data.spec.affinity);
+    res.NodeSelector = data.spec.nodeSelector;
+    res.Tolerations = computeTolerations(data.spec.tolerations);
+    res.Labels = data.metadata.labels;
+    return res;
+  }
+
+  static evictionPayload(pod) {
+    const res = new KubernetesPodEviction();
+    res.metadata.name = pod.Name;
+    res.metadata.namespace = pod.Namespace;
+    return res;
+  }
+
+  static patchPayload(oldPod, newPod) {
+    const oldPayload = createPayload(oldPod);
+    const newPayload = createPayload(newPod);
+    const payload = JsonPatch.compare(oldPayload, newPayload);
+    return payload;
+  }
+}
+
+function createPayload(pod) {
+  const payload = createPayloadFactory();
+  payload.metadata.name = pod.Name;
+  payload.metadata.namespace = pod.Namespace;
+  // it's possible for pods not to have labels. Keep labels empty in the oldpayload if there aren't any, otherwise patch will fail
+  // TODO: when migrating to react, the oldValues should just be the fetched manifest directly from the kube api
+  if (Object.keys(pod.Labels || {}).length || Object.keys(pod.ServiceSelector || {}).length) {
+    payload.metadata.labels[KubernetesPortainerApplicationStackNameLabel] = pod.StackName;
+    payload.metadata.labels[KubernetesPortainerApplicationNameLabel] = pod.ApplicationName;
+    payload.metadata.labels[KubernetesPortainerApplicationOwnerLabel] = pod.ApplicationOwner;
+    payload.metadata.labels = { ...(pod.Labels || {}), ...(pod.ServiceSelector || {}), ...payload.metadata.labels };
+  } else {
+    payload.metadata.labels = undefined;
+  }
+  if (pod.Note) {
+    payload.metadata.annotations[KubernetesPortainerApplicationNote] = pod.Note;
+  } else {
+    payload.metadata.annotations = undefined;
+  }
+
+  payload.spec.replicas = pod.ReplicaCount;
+  payload.spec.selector.matchLabels.app = pod.Name;
+  payload.spec.template.metadata.labels.app = pod.Name;
+  payload.spec.template.metadata.labels[KubernetesPortainerApplicationNameLabel] = pod.ApplicationName;
+  payload.spec.template.spec.containers[0].name = pod.Name;
+  payload.spec.template.spec.containers[0].image = pod.Image;
+  payload.spec.template.spec.affinity = pod.Affinity;
+  KubernetesCommonHelper.assignOrDeleteIfEmpty(payload, 'spec.template.spec.containers[0].env', pod.Env);
+  KubernetesCommonHelper.assignOrDeleteIfEmpty(payload, 'spec.template.spec.containers[0].volumeMounts', pod.VolumeMounts);
+  KubernetesCommonHelper.assignOrDeleteIfEmpty(payload, 'spec.template.spec.volumes', pod.Volumes);
+  if (pod.MemoryLimit) {
+    payload.spec.template.spec.containers[0].resources.limits.memory = pod.MemoryLimit;
+    payload.spec.template.spec.containers[0].resources.requests.memory = pod.MemoryLimit;
+  }
+  if (pod.CpuLimit) {
+    payload.spec.template.spec.containers[0].resources.limits.cpu = pod.CpuLimit;
+    payload.spec.template.spec.containers[0].resources.requests.cpu = pod.CpuLimit;
+  }
+  if (!pod.CpuLimit && !pod.MemoryLimit) {
+    delete payload.spec.template.spec.containers[0].resources;
+  }
+  return payload;
+}
diff --git a/app/kubernetes/pod/models/affinities.ts b/app/kubernetes/pod/models/affinities.ts
new file mode 100644
index 0000000..d2e2e60
--- /dev/null
+++ b/app/kubernetes/pod/models/affinities.ts
@@ -0,0 +1,22 @@
+export enum KubernetesPodNodeAffinityNodeSelectorRequirementOperators {
+  IN = 'In',
+  NOT_IN = 'NotIn',
+  EXISTS = 'Exists',
+  DOES_NOT_EXIST = 'DoesNotExist',
+  GREATER_THAN = 'Gt',
+  LOWER_THAN = 'Lt',
+}
+
+/**
+ * KubernetesPodAffinity Model
+ */
+// this model will contain non transformed data (raw payload data)
+// either during creation flow (model > api)
+// than during reading flow (api > model)
+export function KubernetesPodAffinity() {
+  return {
+    nodeAffinity: {}, // KubernetesPodNodeAffinityPayload
+    // podAffinity: {},
+    // podAntiAffinity: {},
+  };
+}
diff --git a/app/kubernetes/pod/models/index.js b/app/kubernetes/pod/models/index.js
new file mode 100644
index 0000000..d7a4950
--- /dev/null
+++ b/app/kubernetes/pod/models/index.js
@@ -0,0 +1,86 @@
+export * from './affinities';
+
+/**
+ * KubernetesPod Model
+ */
+const _KubernetesPod = Object.freeze({
+  Id: '',
+  Name: '',
+  Namespace: '',
+  Images: [],
+  Status: '',
+  Restarts: 0,
+  Node: '',
+  CreationDate: '',
+  Containers: [],
+  Labels: [],
+  Affinity: {}, // KubernetesPodAffinity
+  Tolerations: [], // KubernetesPodToleration[]
+  NodeSelector: undefined,
+});
+
+export class KubernetesPod {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesPod)));
+  }
+}
+
+/**
+ * KubernetesPodToleration Model
+ */
+const _KubernetesPodToleration = Object.freeze({
+  Key: '',
+  Operator: '',
+  Value: '',
+  TolerationSeconds: 0,
+  Effect: '',
+});
+
+export class KubernetesPodToleration {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesPodToleration)));
+  }
+}
+
+const _KubernetesPodContainer = Object.freeze({
+  Type: 0,
+  PodName: '',
+  Name: '',
+  Image: '',
+  ImagePullPolicy: '',
+  Node: '',
+  CreationDate: '',
+  Status: '',
+  Limits: {},
+  Requests: {},
+  VolumeMounts: {},
+  ConfigurationVolumes: [],
+  PersistedFolders: [],
+  Env: [],
+});
+
+export class KubernetesPodContainer {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesPodContainer)));
+  }
+}
+
+const _KubernetesPodEviction = Object.freeze({
+  apiVersion: 'policy/v1beta1',
+  kind: 'Eviction',
+  metadata: {
+    name: '',
+    namespace: '',
+  },
+});
+
+export class KubernetesPodEviction {
+  constructor() {
+    Object.assign(this, JSON.parse(JSON.stringify(_KubernetesPodEviction)));
+  }
+}
+
+export const KubernetesPodContainerTypes = {
+  INIT: 1,
+  APP: 2,
+};
diff --git a/app/kubernetes/pod/payloads/affinities.js b/app/kubernetes/pod/payloads/affinities.js
new file mode 100644
index 0000000..5517fab
--- /dev/null
+++ b/app/kubernetes/pod/payloads/affinities.js
@@ -0,0 +1,29 @@
+export function KubernetesPodNodeAffinityPayload() {
+  return {
+    requiredDuringSchedulingIgnoredDuringExecution: {
+      nodeSelectorTerms: [], // []KubernetesNodeSelectorTermPayload
+    },
+    preferredDuringSchedulingIgnoredDuringExecution: [], // []KubernetesPreferredSchedulingTermPayload
+  };
+}
+
+export function KubernetesPreferredSchedulingTermPayload() {
+  return {
+    weight: 1,
+    preference: {}, // KubernetesNodeSelectorTermPayload
+  };
+}
+
+export function KubernetesNodeSelectorTermPayload() {
+  return {
+    matchExpressions: [], // []KubernetesNodeSelectorRequirementPayload
+  };
+}
+
+export function KubernetesNodeSelectorRequirementPayload() {
+  return {
+    key: '', // string
+    operator: '', // KubernetesPodNodeAffinityNodeSelectorRequirementOperators
+    values: [], // []string
+  };
+}
diff --git a/app/kubernetes/pod/payloads/create.js b/app/kubernetes/pod/payloads/create.js
new file mode 100644
index 0000000..3d16884
--- /dev/null
+++ b/app/kubernetes/pod/payloads/create.js
@@ -0,0 +1,45 @@
+import { KubernetesCommonMetadataPayload } from '@/kubernetes/models/common/payloads';
+
+export function createPayloadFactory() {
+  return {
+    metadata: new KubernetesCommonMetadataPayload(),
+    spec: {
+      replicas: 0,
+      selector: {
+        matchLabels: {
+          app: '',
+        },
+      },
+      strategy: {
+        type: 'RollingUpdate',
+        rollingUpdate: {
+          maxSurge: 0,
+          maxUnavailable: '100%',
+        },
+      },
+      template: {
+        metadata: {
+          labels: {
+            app: '',
+          },
+        },
+        spec: {
+          affinity: {},
+          containers: [
+            {
+              name: '',
+              image: '',
+              env: [],
+              resources: {
+                limits: {},
+                requests: {},
+              },
+              volumeMounts: [],
+            },
+          ],
+          volumes: [],
+        },
+      },
+    },
+  };
+}
diff --git a/app/kubernetes/pod/service.js b/app/kubernetes/pod/service.js
new file mode 100644
index 0000000..cb6c4b9
--- /dev/null
+++ b/app/kubernetes/pod/service.js
@@ -0,0 +1,122 @@
+import angular from 'angular';
+import PortainerError from '@/portainer/error';
+
+import { KubernetesCommonParams } from '@/kubernetes/models/common/params';
+import KubernetesPodConverter from '@/kubernetes/pod/converter';
+
+class KubernetesPodService {
+  /* @ngInject */
+  constructor($async, KubernetesPods) {
+    this.$async = $async;
+    this.KubernetesPods = KubernetesPods;
+
+    this.getAsync = this.getAsync.bind(this);
+    this.getAllAsync = this.getAllAsync.bind(this);
+    this.logsAsync = this.logsAsync.bind(this);
+    this.deleteAsync = this.deleteAsync.bind(this);
+    this.patchAsync = this.patchAsync.bind(this);
+  }
+
+  async getAsync(namespace, name) {
+    try {
+      const params = new KubernetesCommonParams();
+      params.id = name;
+      const [raw, yaml] = await Promise.all([this.KubernetesPods(namespace).get(params).$promise, this.KubernetesPods(namespace).getYaml(params).$promise]);
+      const res = {
+        Raw: raw,
+        Yaml: yaml.data,
+      };
+      return res;
+    } catch (err) {
+      throw new PortainerError('Unable to retrieve pod', err);
+    }
+  }
+
+  /**
+   * GET ALL
+   */
+  async getAllAsync(namespace) {
+    try {
+      const data = await this.KubernetesPods(namespace).get().$promise;
+      return data.items;
+    } catch (err) {
+      throw new PortainerError('Unable to retrieve pods', err);
+    }
+  }
+
+  get(namespace, name) {
+    if (name) {
+      return this.$async(this.getAsync, namespace, name);
+    }
+    return this.$async(this.getAllAsync, namespace);
+  }
+
+  /**
+   * Logs
+   *
+   * @param {string} namespace
+   * @param {string} podName
+   * @param {string} containerName
+   */
+  async logsAsync(namespace, podName, containerName) {
+    try {
+      const params = new KubernetesCommonParams();
+      params.id = podName;
+      if (containerName) {
+        params.container = containerName;
+      }
+      const data = await this.KubernetesPods(namespace).logs(params).$promise;
+      return data.logs;
+    } catch (err) {
+      throw new PortainerError('Unable to retrieve pod logs', err);
+    }
+  }
+
+  logs(namespace, podName, containerName) {
+    return this.$async(this.logsAsync, namespace, podName, containerName);
+  }
+
+  /**
+   * PATCH
+   */
+  async patchAsync(oldPod, newPod) {
+    try {
+      const params = new KubernetesCommonParams();
+      params.id = newPod.Name;
+      const namespace = newPod.Namespace;
+      const payload = KubernetesPodConverter.patchPayload(oldPod, newPod);
+      if (!payload.length) {
+        return;
+      }
+      const data = await this.KubernetesPods(namespace).patch(params, payload).$promise;
+      return data;
+    } catch (err) {
+      throw new PortainerError('Unable to patch pod', err);
+    }
+  }
+
+  patch(oldPod, newPod) {
+    return this.$async(this.patchAsync, oldPod, newPod);
+  }
+
+  /**
+   * DELETE
+   */
+  async deleteAsync(pod) {
+    try {
+      const params = new KubernetesCommonParams();
+      params.id = pod.Name;
+      const namespace = pod.Namespace;
+      await this.KubernetesPods(namespace).delete(params).$promise;
+    } catch (err) {
+      throw new PortainerError('Unable to remove pod', err);
+    }
+  }
+
+  delete(pod) {
+    return this.$async(this.deleteAsync, pod);
+  }
+}
+
+export default KubernetesPodService;
+angular.module('portainer.kubernetes').service('KubernetesPodService', KubernetesPodService);
diff --git a/app/kubernetes/react/components/clusterManagement.ts b/app/kubernetes/react/components/clusterManagement.ts
new file mode 100644
index 0000000..48c1084
--- /dev/null
+++ b/app/kubernetes/react/components/clusterManagement.ts
@@ -0,0 +1,22 @@
+import angular from 'angular';
+
+import { r2a } from '@/react-tools/react2angular';
+import { withUIRouter } from '@/react-tools/withUIRouter';
+import { withCurrentUser } from '@/react-tools/withCurrentUser';
+import { NodeApplicationsDatatable } from '@/react/kubernetes/cluster/NodeView/NodeApplicationsDatatable/NodeApplicationsDatatable';
+import { ResourceEventsDatatable } from '@/react/kubernetes/components/EventsDatatable/ResourceEventsDatatable';
+import { withReactQuery } from '@/react-tools/withReactQuery';
+
+export const clusterManagementModule = angular
+  .module('portainer.kubernetes.react.components.clusterManagement', [])
+  .component(
+    'kubernetesNodeApplicationsDatatable',
+    r2a(withUIRouter(withCurrentUser(NodeApplicationsDatatable)), [])
+  )
+  .component(
+    'resourceEventsDatatable',
+    r2a(
+      withUIRouter(withReactQuery(withCurrentUser(ResourceEventsDatatable))),
+      ['resourceId', 'storageKey', 'namespace', 'noWidget', 'isLoading']
+    )
+  ).name;
diff --git a/app/kubernetes/react/components/index.ts b/app/kubernetes/react/components/index.ts
new file mode 100644
index 0000000..7137fcb
--- /dev/null
+++ b/app/kubernetes/react/components/index.ts
@@ -0,0 +1,408 @@
+import angular from 'angular';
+
+import { r2a } from '@/react-tools/react2angular';
+import { IngressClassDatatableAngular } from '@/react/kubernetes/cluster/ingressClass/IngressClassDatatable/IngressClassDatatableAngular';
+import { NamespacesSelector } from '@/react/kubernetes/cluster/RegistryAccessView/NamespacesSelector';
+import { NamespaceAccessUsersSelector } from '@/react/kubernetes/namespaces/AccessView/NamespaceAccessUsersSelector';
+import { KubeServicesForm } from '@/react/kubernetes/applications/CreateView/application-services/KubeServicesForm';
+import { kubeServicesValidation } from '@/react/kubernetes/applications/CreateView/application-services/kubeServicesValidation';
+import { withReactQuery } from '@/react-tools/withReactQuery';
+import { withUIRouter } from '@/react-tools/withUIRouter';
+import {
+  ApplicationSummaryWidget,
+  ApplicationDetailsWidget,
+  ApplicationEventsDatatable,
+} from '@/react/kubernetes/applications/DetailsView';
+import { ApplicationContainersDatatable } from '@/react/kubernetes/applications/DetailsView/ApplicationContainersDatatable';
+import {
+  PlacementFormSection,
+  placementValidation,
+} from '@/react/kubernetes/applications/components/PlacementFormSection';
+import { ApplicationSummarySection } from '@/react/kubernetes/applications/components/ApplicationSummarySection';
+import { withFormValidation } from '@/react-tools/withFormValidation';
+import { withCurrentUser } from '@/react-tools/withCurrentUser';
+import { YAMLInspector } from '@/react/kubernetes/components/YAMLInspector';
+import { NodesDatatable } from '@/react/kubernetes/cluster/HomeView/NodesDatatable';
+import { StackName } from '@/react/kubernetes/DeployView/StackName/StackName';
+import { StackNameLabelInsight } from '@/react/kubernetes/DeployView/StackName/StackNameLabelInsight';
+import { SecretsFormSection } from '@/react/kubernetes/applications/components/ConfigurationsFormSection/SecretsFormSection';
+import { configurationsValidationSchema } from '@/react/kubernetes/applications/components/ConfigurationsFormSection/configurationValidationSchema';
+import { ConfigMapsFormSection } from '@/react/kubernetes/applications/components/ConfigurationsFormSection/ConfigMapsFormSection';
+import { PersistedFoldersFormSection } from '@/react/kubernetes/applications/components/PersistedFoldersFormSection';
+import { DataAccessPolicyFormSection } from '@/react/kubernetes/applications/CreateView/DataAccessPolicyFormSection';
+import { persistedFoldersValidation } from '@/react/kubernetes/applications/components/PersistedFoldersFormSection/persistedFoldersValidation';
+import {
+  ResourceReservationFormSection,
+  resourceReservationValidation,
+} from '@/react/kubernetes/applications/components/ResourceReservationFormSection';
+import {
+  ReplicationFormSection,
+  replicationValidation,
+} from '@/react/kubernetes/applications/components/ReplicationFormSection';
+import {
+  AutoScalingFormSection,
+  autoScalingValidation,
+} from '@/react/kubernetes/applications/components/AutoScalingFormSection';
+import { withControlledInput } from '@/react-tools/withControlledInput';
+import {
+  NamespaceSelector,
+  namespaceSelectorValidation,
+} from '@/react/kubernetes/applications/components/NamespaceSelector';
+import { EditYamlFormSection } from '@/react/kubernetes/applications/components/EditYamlFormSection';
+import {
+  NameFormSection,
+  appNameValidation,
+} from '@/react/kubernetes/applications/components/NameFormSection';
+import { deploymentTypeValidation } from '@/react/kubernetes/applications/components/AppDeploymentTypeFormSection/deploymentTypeValidation';
+import { AppDeploymentTypeFormSection } from '@/react/kubernetes/applications/components/AppDeploymentTypeFormSection/AppDeploymentTypeFormSection';
+import { EnvironmentVariablesFormSection } from '@/react/kubernetes/applications/components/EnvironmentVariablesFormSection/EnvironmentVariablesFormSection';
+import { kubeEnvVarValidationSchema } from '@/react/kubernetes/applications/components/EnvironmentVariablesFormSection/kubeEnvVarValidationSchema';
+import { IntegratedAppsDatatable } from '@/react/kubernetes/components/IntegratedAppsDatatable/IntegratedAppsDatatable';
+import { K8sRegistryAccessNotice } from '@/react/kubernetes/components/K8sRegistryAccessNotice';
+import { HelmTemplates } from '@/react/kubernetes/helm/HelmTemplates/HelmTemplates';
+import { SecretDetailsTable } from '@/react/kubernetes/configs/secrets/ItemView/SecretDetailsTable';
+import { KubernetesSummaryView } from '@/react/kubernetes/summary/KubernetesSummaryView';
+import { SecretItemTabsWidget } from '@/react/kubernetes/configs/secrets/ItemView/SecretItemTabsWidget';
+
+import { namespacesModule } from './namespaces';
+import { clusterManagementModule } from './clusterManagement';
+import { registriesModule } from './registries';
+
+export const ngModule = angular
+  .module('portainer.kubernetes.react.components', [
+    namespacesModule,
+    clusterManagementModule,
+    registriesModule,
+  ])
+  .component(
+    'ingressClassDatatable',
+    r2a(IngressClassDatatableAngular, [
+      'onChangeControllers',
+      'description',
+      'ingressControllers',
+      'initialIngressControllers',
+      'allowNoneIngressClass',
+      'isLoading',
+      'view',
+    ])
+  )
+  .component(
+    'namespacesSelector',
+    r2a(NamespacesSelector, [
+      'dataCy',
+      'inputId',
+      'name',
+      'namespaces',
+      'onChange',
+      'placeholder',
+      'value',
+      'allowSelectAll',
+    ])
+  )
+  .component(
+    'namespaceAccessUsersSelector',
+    r2a(NamespaceAccessUsersSelector, [
+      'inputId',
+      'onChange',
+      'options',
+      'value',
+      'dataCy',
+      'placeholder',
+      'name',
+    ])
+  )
+  .component(
+    'kubeNodesDatatable',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(NodesDatatable))), [])
+  )
+  .component(
+    'accessPolicyFormSection',
+    r2a(DataAccessPolicyFormSection, [
+      'value',
+      'onChange',
+      'isEdit',
+      'persistedFoldersUseExistingVolumes',
+    ])
+  )
+  .component(
+    'kubeYamlInspector',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(YAMLInspector))), [
+      'identifier',
+      'data',
+      'hideMessage',
+      'data-cy',
+      'isLoading',
+      'isError',
+    ])
+  )
+  .component(
+    'kubeStackName',
+    r2a(
+      withControlledInput(
+        withUIRouter(
+          withReactQuery(withCurrentUser(withControlledInput(StackName)))
+        ),
+        { stackName: 'setStackName' }
+      ),
+      [
+        'setStackName',
+        'stackName',
+        'stacks',
+        'inputClassName',
+        'textTip',
+        'error',
+      ]
+    )
+  )
+  .component(
+    'stackNameLabelInsight',
+    r2a(withUIRouter(withCurrentUser(StackNameLabelInsight)), [])
+  )
+  .component(
+    'editYamlFormSection',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(EditYamlFormSection))), [
+      'values',
+      'onChange',
+      'isComposeFormat',
+    ])
+  )
+  .component(
+    'applicationSummaryWidget',
+    r2a(
+      withUIRouter(withReactQuery(withCurrentUser(ApplicationSummaryWidget))),
+      []
+    )
+  )
+  .component(
+    'applicationContainersDatatable',
+    r2a(
+      withUIRouter(
+        withReactQuery(withCurrentUser(ApplicationContainersDatatable))
+      ),
+      []
+    )
+  )
+  .component(
+    'applicationDetailsWidget',
+    r2a(
+      withUIRouter(withReactQuery(withCurrentUser(ApplicationDetailsWidget))),
+      []
+    )
+  )
+  .component(
+    'applicationEventsDatatable',
+    r2a(
+      withUIRouter(withReactQuery(withCurrentUser(ApplicationEventsDatatable))),
+      []
+    )
+  )
+  .component(
+    'applicationSummarySection',
+    r2a(
+      withUIRouter(withReactQuery(withCurrentUser(ApplicationSummarySection))),
+      ['formValues', 'oldFormValues']
+    )
+  )
+  .component(
+    'kubernetesIntegratedApplicationsDatatable',
+    r2a(withUIRouter(withCurrentUser(IntegratedAppsDatatable)), [
+      'dataset',
+      'isLoading',
+      'onRefresh',
+      'tableKey',
+      'tableTitle',
+      'dataCy',
+    ])
+  )
+  .component(
+    'helmTemplatesView',
+    r2a(withUIRouter(withCurrentUser(HelmTemplates)), [
+      'onSelectHelmChart',
+      'namespace',
+      'name',
+    ])
+  )
+  .component(
+    'secretDetailsTable',
+    r2a(withUIRouter(withCurrentUser(withReactQuery(SecretDetailsTable))), [
+      'name',
+      'namespace',
+      'secretTypeLabel',
+      'isSystem',
+      'registryId',
+    ])
+  )
+  .component(
+    'secretItemTabsWidget',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(SecretItemTabsWidget))), [
+      'name',
+      'namespace',
+      'secretTypeLabel',
+      'isSystem',
+      'registryId',
+      'resourceId',
+    ])
+  )
+  .component(
+    'kubernetesSummaryViewReact',
+    r2a(KubernetesSummaryView, ['actions', 'cpuLimit', 'memoryLimit'])
+  )
+  .component(
+    'k8sRegistryAccessNotice',
+    r2a(
+      withUIRouter(withReactQuery(withCurrentUser(K8sRegistryAccessNotice))),
+      ['namespace', 'manifestContent', 'environmentId']
+    )
+  );
+
+export const componentsModule = ngModule.name;
+
+withFormValidation(
+  ngModule,
+  withUIRouter(
+    withCurrentUser(
+      withReactQuery(
+        withControlledInput(KubeServicesForm, { values: 'onChange' })
+      )
+    )
+  ),
+  'kubeServicesForm',
+  ['values', 'onChange', 'appName', 'selector', 'isEditMode', 'namespace'],
+  kubeServicesValidation
+);
+
+withFormValidation(
+  ngModule,
+  withControlledInput(
+    withUIRouter(withCurrentUser(withReactQuery(ConfigMapsFormSection))),
+    { values: 'onChange' }
+  ),
+  'configMapsFormSection',
+  ['values', 'onChange', 'namespace'],
+  configurationsValidationSchema
+);
+
+withFormValidation(
+  ngModule,
+  withControlledInput(
+    withUIRouter(withCurrentUser(withReactQuery(SecretsFormSection))),
+    { values: 'onChange' }
+  ),
+  'secretsFormSection',
+  ['values', 'onChange', 'namespace'],
+  configurationsValidationSchema
+);
+
+withFormValidation(
+  ngModule,
+  withControlledInput(
+    withUIRouter(withCurrentUser(withReactQuery(PersistedFoldersFormSection))),
+    { values: 'onChange' }
+  ),
+  'persistedFoldersFormSection',
+  [
+    'isEdit',
+    'applicationValues',
+    'isAddPersistentFolderButtonShown',
+    'initialValues',
+    'availableVolumes',
+  ],
+  persistedFoldersValidation
+);
+
+withFormValidation(
+  ngModule,
+  withControlledInput(
+    withUIRouter(
+      withCurrentUser(withReactQuery(ResourceReservationFormSection))
+    ),
+    { values: 'onChange' }
+  ),
+  'resourceReservationFormSection',
+  [
+    'namespaceHasQuota',
+    'resourceQuotaCapacityExceeded',
+    'minMemoryLimit',
+    'minCpuLimit',
+    'maxMemoryLimit',
+    'maxCpuLimit',
+  ],
+  resourceReservationValidation
+);
+
+withFormValidation(
+  ngModule,
+  withControlledInput(
+    withUIRouter(withCurrentUser(withReactQuery(ReplicationFormSection))),
+    { values: 'onChange' }
+  ),
+  'replicationFormSection',
+  [
+    'supportScalableReplicaDeployment',
+    'cpuLimit',
+    'memoryLimit',
+    'resourceReservationsOverflow',
+  ],
+  replicationValidation
+);
+
+withFormValidation(
+  ngModule,
+  withControlledInput(
+    withUIRouter(withCurrentUser(withReactQuery(AutoScalingFormSection))),
+    { values: 'onChange' }
+  ),
+  'autoScalingFormSection',
+  ['isMetricsEnabled'],
+  autoScalingValidation
+);
+
+withFormValidation(
+  ngModule,
+  withUIRouter(withCurrentUser(withReactQuery(PlacementFormSection))),
+  'placementFormSection',
+  [],
+  placementValidation
+);
+
+withFormValidation(
+  ngModule,
+  withControlledInput(withUIRouter(withCurrentUser(NamespaceSelector)), {
+    values: 'onChange',
+  }),
+  'namespaceSelector',
+  ['isEdit'],
+  namespaceSelectorValidation,
+  true
+);
+
+withFormValidation(
+  ngModule,
+  withUIRouter(withCurrentUser(withReactQuery(NameFormSection))),
+  'nameFormSection',
+  ['isEdit'],
+  appNameValidation,
+  true
+);
+
+withFormValidation(
+  ngModule,
+  AppDeploymentTypeFormSection,
+  'appDeploymentTypeFormSection',
+  ['supportGlobalDeployment'],
+  deploymentTypeValidation,
+  true
+);
+
+withFormValidation(
+  ngModule,
+  withControlledInput(
+    withUIRouter(
+      withCurrentUser(withReactQuery(EnvironmentVariablesFormSection))
+    ),
+    { values: 'onChange' }
+  ),
+  'environmentVariablesFormSection',
+  [],
+  kubeEnvVarValidationSchema
+);
diff --git a/app/kubernetes/react/components/namespaces.ts b/app/kubernetes/react/components/namespaces.ts
new file mode 100644
index 0000000..c00b7b9
--- /dev/null
+++ b/app/kubernetes/react/components/namespaces.ts
@@ -0,0 +1,13 @@
+import angular from 'angular';
+
+import { r2a } from '@/react-tools/react2angular';
+import { withUIRouter } from '@/react-tools/withUIRouter';
+import { withCurrentUser } from '@/react-tools/withCurrentUser';
+import { NamespacesDatatable } from '@/react/kubernetes/namespaces/ListView/NamespacesDatatable';
+
+export const namespacesModule = angular
+  .module('portainer.kubernetes.react.components.namespaces', [])
+  .component(
+    'kubernetesNamespacesDatatable',
+    r2a(withUIRouter(withCurrentUser(NamespacesDatatable)), [])
+  ).name;
diff --git a/app/kubernetes/react/components/registries.tsx b/app/kubernetes/react/components/registries.tsx
new file mode 100644
index 0000000..4b28686
--- /dev/null
+++ b/app/kubernetes/react/components/registries.tsx
@@ -0,0 +1,11 @@
+import angular from 'angular';
+
+import { r2a } from '@/react-tools/react2angular';
+import { AccessTable } from '@/react/kubernetes/cluster/RegistryAccessView/AccessTable';
+
+export const registriesModule = angular
+  .module('portainer.kubernetes.react.components.registries', [])
+  .component(
+    'kubeRegistryAccessTable',
+    r2a(AccessTable, ['dataset', 'onRemove'])
+  ).name;
diff --git a/app/kubernetes/react/index.ts b/app/kubernetes/react/index.ts
new file mode 100644
index 0000000..3b1d288
--- /dev/null
+++ b/app/kubernetes/react/index.ts
@@ -0,0 +1,9 @@
+import angular from 'angular';
+
+import { componentsModule } from './components';
+import { viewsModule } from './views';
+
+export const reactModule = angular.module('portainer.kubernetes.react', [
+  viewsModule,
+  componentsModule,
+]).name;
diff --git a/app/kubernetes/react/views/index.ts b/app/kubernetes/react/views/index.ts
new file mode 100644
index 0000000..778d6f8
--- /dev/null
+++ b/app/kubernetes/react/views/index.ts
@@ -0,0 +1,146 @@
+import angular from 'angular';
+
+import { r2a } from '@/react-tools/react2angular';
+import { withCurrentUser } from '@/react-tools/withCurrentUser';
+import { withReactQuery } from '@/react-tools/withReactQuery';
+import { withUIRouter } from '@/react-tools/withUIRouter';
+import { IngressesDatatableView } from '@/react/kubernetes/ingresses/IngressDatatable';
+import { CreateIngressView } from '@/react/kubernetes/ingresses/CreateIngressView';
+import { DashboardView } from '@/react/kubernetes/dashboard/DashboardView';
+import { ServicesView } from '@/react/kubernetes/services/ServicesView';
+import { ConsoleView } from '@/react/kubernetes/applications/ConsoleView';
+import { ConfigmapsAndSecretsView } from '@/react/kubernetes/configs/ListView/ConfigmapsAndSecretsView';
+import { CreateNamespaceView } from '@/react/kubernetes/namespaces/CreateView/CreateNamespaceView';
+import { ApplicationsView } from '@/react/kubernetes/applications/ListView/ApplicationsView';
+import { ApplicationDetailsView } from '@/react/kubernetes/applications/DetailsView/ApplicationDetailsView';
+import { ConfigureView } from '@/react/kubernetes/cluster/ConfigureView';
+import { NamespacesView } from '@/react/kubernetes/namespaces/ListView/NamespacesView';
+import { ServiceAccountsView } from '@/react/kubernetes/more-resources/ServiceAccountsView/ServiceAccountsView';
+import { ServiceAccountView } from '@/react/kubernetes/more-resources/ServiceAccountsView/ItemView/ServiceAccountView';
+import { ClusterRolesView } from '@/react/kubernetes/more-resources/ClusterRolesView';
+import { RolesView } from '@/react/kubernetes/more-resources/RolesView';
+import { VolumesView } from '@/react/kubernetes/volumes/ListView/VolumesView';
+import { NamespaceView } from '@/react/kubernetes/namespaces/ItemView/NamespaceView';
+import { AccessView } from '@/react/kubernetes/namespaces/AccessView/AccessView';
+import { JobsView } from '@/react/kubernetes/more-resources/JobsView/JobsView';
+import { ClusterView } from '@/react/kubernetes/cluster/ClusterView';
+import { HelmApplicationView } from '@/react/kubernetes/helm/HelmApplicationView';
+import { HelmInstallView } from '@/react/kubernetes/helm/install/HelmInstallView';
+import { NodeView } from '@/react/kubernetes/cluster/NodeView/NodeView';
+import { KubectlShellView } from '@/react/kubernetes/cluster/KubectlShell/KubectlShellView';
+import { ResourceDetailsYAMLView } from '@/react/kubernetes/more-resources/ResourceDetailsYAMLView';
+
+export const viewsModule = angular
+  .module('portainer.kubernetes.react.views', [])
+  .component(
+    'kubernetesCreateNamespaceView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(CreateNamespaceView))), [])
+  )
+  .component(
+    'namespaceView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(NamespaceView))), [])
+  )
+  .component(
+    'kubernetesNamespacesView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(NamespacesView))), [])
+  )
+  .component(
+    'kubernetesNamespaceAccessView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(AccessView))), [])
+  )
+  .component(
+    'kubernetesServicesView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(ServicesView))), [])
+  )
+  .component(
+    'kubernetesVolumesView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(VolumesView))), [])
+  )
+  .component(
+    'kubernetesIngressesView',
+    r2a(
+      withUIRouter(withReactQuery(withCurrentUser(IngressesDatatableView))),
+      []
+    )
+  )
+  .component(
+    'kubernetesIngressesCreateView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(CreateIngressView))), [])
+  )
+  .component(
+    'kubernetesConfigMapsAndSecretsView',
+    r2a(
+      withUIRouter(withReactQuery(withCurrentUser(ConfigmapsAndSecretsView))),
+      []
+    )
+  )
+  .component(
+    'kubernetesApplicationsView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(ApplicationsView))), [])
+  )
+  .component(
+    'applicationDetailsView',
+    r2a(
+      withUIRouter(withReactQuery(withCurrentUser(ApplicationDetailsView))),
+      []
+    )
+  )
+  .component(
+    'kubernetesHelmApplicationView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(HelmApplicationView))), [])
+  )
+  .component(
+    'helmInstallView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(HelmInstallView))), [])
+  )
+  .component(
+    'kubectlShellView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(KubectlShellView))), [])
+  )
+  .component(
+    'kubernetesClusterView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(ClusterView))), [])
+  )
+  .component(
+    'kubernetesNodeViewReact',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(NodeView))), [])
+  )
+  .component(
+    'kubernetesConfigureView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(ConfigureView))), [])
+  )
+  .component(
+    'kubernetesDashboardView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(DashboardView))), [])
+  )
+  .component(
+    'kubernetesConsoleView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(ConsoleView))), [])
+  )
+  .component(
+    'jobsView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(JobsView))), [])
+  )
+  .component(
+    'serviceAccountsView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(ServiceAccountsView))), [])
+  )
+  .component(
+    'serviceAccountView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(ServiceAccountView))), [])
+  )
+  .component(
+    'clusterRolesView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(ClusterRolesView))), [])
+  )
+  .component(
+    'k8sRolesView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(RolesView))), [])
+  )
+  .component(
+    'kubernetesResourceDetailsYAMLView',
+    r2a(
+      withUIRouter(withReactQuery(withCurrentUser(ResourceDetailsYAMLView))),
+      []
+    )
+  ).name;
diff --git a/app/kubernetes/registries/index.js b/app/kubernetes/registries/index.js
new file mode 100644
index 0000000..5437382
--- /dev/null
+++ b/app/kubernetes/registries/index.js
@@ -0,0 +1,5 @@
+import angular from 'angular';
+
+import { kubernetesRegistryAccessView } from './kube-registry-access-view';
+
+export default angular.module('portainer.kubernetes.registries', []).component('kubernetesRegistryAccessView', kubernetesRegistryAccessView).name;
diff --git a/app/kubernetes/registries/kube-registry-access-view/index.js b/app/kubernetes/registries/kube-registry-access-view/index.js
new file mode 100644
index 0000000..bf51890
--- /dev/null
+++ b/app/kubernetes/registries/kube-registry-access-view/index.js
@@ -0,0 +1,9 @@
+import controller from './kube-registry-access-view.controller';
+
+export const kubernetesRegistryAccessView = {
+  templateUrl: './kube-registry-access-view.html',
+  controller,
+  bindings: {
+    endpoint: '<',
+  },
+};
diff --git a/app/kubernetes/registries/kube-registry-access-view/kube-registry-access-view.controller.js b/app/kubernetes/registries/kube-registry-access-view/kube-registry-access-view.controller.js
new file mode 100644
index 0000000..0c12f38
--- /dev/null
+++ b/app/kubernetes/registries/kube-registry-access-view/kube-registry-access-view.controller.js
@@ -0,0 +1,82 @@
+import KubernetesNamespaceHelper from '@/kubernetes/helpers/namespaceHelper';
+
+export default class KubernetesRegistryAccessController {
+  /* @ngInject */
+  constructor($async, $scope, $state, EndpointService, Notifications, RegistryService, KubernetesResourcePoolService) {
+    this.$async = $async;
+    this.$scope = $scope;
+    this.$state = $state;
+    this.Notifications = Notifications;
+    this.KubernetesResourcePoolService = KubernetesResourcePoolService;
+    this.RegistryService = RegistryService;
+    this.EndpointService = EndpointService;
+
+    this.state = {
+      actionInProgress: false,
+    };
+
+    this.selectedResourcePools = [];
+    this.resourcePools = [];
+    this.savedResourcePools = [];
+
+    this.handleRemove = this.handleRemove.bind(this);
+    this.onChangeResourcePools = this.onChangeResourcePools.bind(this);
+  }
+
+  async submit() {
+    return this.updateNamespaces([...this.savedResourcePools.map(({ value }) => value), ...this.selectedResourcePools]);
+  }
+
+  handleRemove(namespaces) {
+    const removeNamespaces = namespaces.map(({ value }) => value);
+    const nsToUpdate = this.savedResourcePools.map(({ value }) => value).filter((value) => !removeNamespaces.includes(value));
+
+    return this.updateNamespaces(nsToUpdate);
+  }
+
+  updateNamespaces(namespaces) {
+    return this.$async(async () => {
+      try {
+        await this.EndpointService.updateRegistryAccess(this.endpoint.Id, this.registry.Id, {
+          namespaces,
+        });
+        this.$state.reload(this.$state.current);
+        this.Notifications.success('Success', 'Registry access updated');
+      } catch (err) {
+        this.Notifications.error('Failure', err, 'Failed saving registry access');
+      }
+    });
+  }
+
+  onChangeResourcePools(resourcePools) {
+    return this.$scope.$evalAsync(() => {
+      this.selectedResourcePools = resourcePools;
+    });
+  }
+
+  $onInit() {
+    return this.$async(async () => {
+      try {
+        this.state = {
+          registryId: this.$state.params.id,
+        };
+        this.registry = await this.RegistryService.registry(this.state.registryId, this.endpoint.Id);
+        if (this.registry.RegistryAccesses && this.registry.RegistryAccesses[this.endpoint.Id]) {
+          this.savedResourcePools = this.registry.RegistryAccesses[this.endpoint.Id].Namespaces.map((value) => ({ value }));
+        }
+      } catch (err) {
+        this.Notifications.error('Failure', err, 'Unable to retrieve registry details');
+      }
+
+      try {
+        const resourcePools = await this.KubernetesResourcePoolService.get();
+
+        this.resourcePools = resourcePools
+          .filter((pool) => !KubernetesNamespaceHelper.isSystemNamespace(pool.Namespace.Name) && !this.savedResourcePools.find(({ value }) => value === pool.Namespace.Name))
+          .map((pool) => ({ name: pool.Namespace.Name, id: pool.Namespace.Id }));
+      } catch (err) {
+        this.Notifications.error('Failure', err, 'Unable to retrieve namespaces');
+      }
+    });
+  }
+}
diff --git a/app/kubernetes/registries/kube-registry-access-view/kube-registry-access-view.html b/app/kubernetes/registries/kube-registry-access-view/kube-registry-access-view.html
new file mode 100644
index 0000000..5c5e682
--- /dev/null
+++ b/app/kubernetes/registries/kube-registry-access-view/kube-registry-access-view.html
@@ -0,0 +1,53 @@
+<page-header title="'Registry access'" breadcrumbs="[{label:'Registries', link:'kubernetes.registries'}, $ctrl.registry.Name, 'Access management']" reload="true"> </page-header>
+
+<registry-details registry="$ctrl.registry" ng-if="$ctrl.registry"></registry-details>
+
+<div class="row">
+  <div class="col-sm-12">
+    <rd-widget>
+      <rd-widget-header icon="user-x" title-text="Create access"></rd-widget-header>
+      <rd-widget-body>
+        <form class="form-horizontal">
+          <div class="form-group">
+            <label class="col-sm-3 col-lg-2 control-label text-left" style="padding-top: 0"> Select namespaces </label>
+            <div class="col-sm-9 col-lg-4" style="margin-bottom: 15px">
+              <span class="small text-muted" ng-if="!$ctrl.resourcePools.length"> No namespaces available. </span>
+
+              <namespaces-selector
+                ng-if="$ctrl.resourcePools.length"
+                value="$ctrl.selectedResourcePools"
+                namespaces="$ctrl.resourcePools"
+                placeholder="'Select one or more namespaces'"
+                on-change="($ctrl.onChangeResourcePools)"
+                allow-select-all="true"
+              ></namespaces-selector>
+            </div>
+            <div class="col-sm-12 small text-muted vertical-center">
+              <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon>
+              Adding this registry will expose the registry credentials to all users of this namespace.
+            </div>
+          </div>
+
+          <!-- actions -->
+          <div class="form-group">
+            <div class="col-sm-12">
+              <button
+                type="submit"
+                class="btn btn-primary btn-sm !ml-0"
+                ng-disabled="$ctrl.selectedResourcePools.length === 0 || $ctrl.state.actionInProgress"
+                ng-click="$ctrl.submit()"
+                button-spinner="$ctrl.state.actionInProgress"
+              >
+                <span ng-hide="$ctrl.state.actionInProgress" class="vertical-center"><pr-icon icon="'plus'" size="'sm'"></pr-icon> Create access</span>
+                <span ng-show="$ctrl.state.actionInProgress">Creating access...</span>
+              </button>
+            </div>
+          </div>
+          <!-- !actions -->
+        </form>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
+
+<kube-registry-access-table dataset="$ctrl.savedResourcePools" on-remove="($ctrl.handleRemove)"></kube-registry-access-table>
diff --git a/app/kubernetes/rest/configMap.js b/app/kubernetes/rest/configMap.js
new file mode 100644
index 0000000..7946bb7
--- /dev/null
+++ b/app/kubernetes/rest/configMap.js
@@ -0,0 +1,37 @@
+import { rawResponse } from '@/kubernetes/rest/response/transform';
+
+angular.module('portainer.kubernetes').factory('KubernetesConfigMaps', [
+  '$resource',
+  'API_ENDPOINT_ENDPOINTS',
+  'EndpointProvider',
+  function KubernetesConfigMapsFactory($resource, API_ENDPOINT_ENDPOINTS, EndpointProvider) {
+    'use strict';
+    return function (namespace) {
+      const url = API_ENDPOINT_ENDPOINTS + '/:endpointId/kubernetes/api/v1' + (namespace ? '/namespaces/:namespace' : '') + '/configmaps/:id/:action';
+      return $resource(
+        url,
+        {
+          endpointId: EndpointProvider.endpointID,
+          namespace: namespace,
+        },
+        {
+          get: {
+            method: 'GET',
+            ignoreLoadingBar: true,
+          },
+          getYaml: {
+            method: 'GET',
+            headers: {
+              Accept: 'application/yaml',
+            },
+            transformResponse: rawResponse,
+            ignoreLoadingBar: true,
+          },
+          create: { method: 'POST' },
+          update: { method: 'PUT' },
+          delete: { method: 'DELETE' },
+        }
+      );
+    };
+  },
+]);
diff --git a/app/kubernetes/rest/controllerRevision.js b/app/kubernetes/rest/controllerRevision.js
new file mode 100644
index 0000000..d0c3388
--- /dev/null
+++ b/app/kubernetes/rest/controllerRevision.js
@@ -0,0 +1,43 @@
+import { rawResponse } from '@/kubernetes/rest/response/transform';
+
+angular.module('portainer.kubernetes').factory('KubernetesControllerRevisions', [
+  '$resource',
+  'API_ENDPOINT_ENDPOINTS',
+  'EndpointProvider',
+  function KubernetesControllerRevisionsFactory($resource, API_ENDPOINT_ENDPOINTS, EndpointProvider) {
+    'use strict';
+    return function (namespace) {
+      const url = API_ENDPOINT_ENDPOINTS + '/:endpointId/kubernetes/apis/apps/v1' + (namespace ? '/namespaces/:namespace' : '') + '/controllerrevisions/:id/:action';
+      return $resource(
+        url,
+        {
+          endpointId: EndpointProvider.endpointID,
+          namespace: namespace,
+        },
+        {
+          get: {
+            method: 'GET',
+            ignoreLoadingBar: true,
+          },
+          getYaml: {
+            method: 'GET',
+            headers: {
+              Accept: 'application/yaml',
+            },
+            transformResponse: rawResponse,
+            ignoreLoadingBar: true,
+          },
+          create: { method: 'POST' },
+          update: { method: 'PUT' },
+          patch: {
+            method: 'PATCH',
+            headers: {
+              'Content-Type': 'application/json-patch+json',
+            },
+          },
+          delete: { method: 'DELETE' },
+        }
+      );
+    };
+  },
+]);
diff --git a/app/kubernetes/rest/daemonSet.js b/app/kubernetes/rest/daemonSet.js
new file mode 100644
index 0000000..20cb5c4
--- /dev/null
+++ b/app/kubernetes/rest/daemonSet.js
@@ -0,0 +1,49 @@
+import { rawResponse } from '@/kubernetes/rest/response/transform';
+
+angular.module('portainer.kubernetes').factory('KubernetesDaemonSets', [
+  '$resource',
+  'API_ENDPOINT_ENDPOINTS',
+  'EndpointProvider',
+  function KubernetesDaemonSetsFactory($resource, API_ENDPOINT_ENDPOINTS, EndpointProvider) {
+    'use strict';
+    return function (namespace) {
+      const url = API_ENDPOINT_ENDPOINTS + '/:endpointId/kubernetes/apis/apps/v1' + (namespace ? '/namespaces/:namespace' : '') + '/daemonsets/:id/:action';
+      return $resource(
+        url,
+        {
+          endpointId: EndpointProvider.endpointID,
+          namespace: namespace,
+        },
+        {
+          get: {
+            method: 'GET',
+            ignoreLoadingBar: true,
+          },
+          getYaml: {
+            method: 'GET',
+            headers: {
+              Accept: 'application/yaml',
+            },
+            transformResponse: rawResponse,
+            ignoreLoadingBar: true,
+          },
+          create: { method: 'POST' },
+          update: { method: 'PUT' },
+          patch: {
+            method: 'PATCH',
+            headers: {
+              'Content-Type': 'application/json-patch+json',
+            },
+          },
+          rollback: {
+            method: 'PATCH',
+            headers: {
+              'Content-Type': 'application/strategic-merge-patch+json',
+            },
+          },
+          delete: { method: 'DELETE' },
+        }
+      );
+    };
+  },
+]);
diff --git a/app/kubernetes/rest/deployment.js b/app/kubernetes/rest/deployment.js
new file mode 100644
index 0000000..e12a054
--- /dev/null
+++ b/app/kubernetes/rest/deployment.js
@@ -0,0 +1,49 @@
+import { rawResponse } from '@/kubernetes/rest/response/transform';
+
+angular.module('portainer.kubernetes').factory('KubernetesDeployments', [
+  '$resource',
+  'API_ENDPOINT_ENDPOINTS',
+  'EndpointProvider',
+  function KubernetesDeploymentsFactory($resource, API_ENDPOINT_ENDPOINTS, EndpointProvider) {
+    'use strict';
+    return function (namespace) {
+      const url = API_ENDPOINT_ENDPOINTS + '/:endpointId/kubernetes/apis/apps/v1' + (namespace ? '/namespaces/:namespace' : '') + '/deployments/:id/:action';
+      return $resource(
+        url,
+        {
+          endpointId: EndpointProvider.endpointID,
+          namespace: namespace,
+        },
+        {
+          get: {
+            method: 'GET',
+            ignoreLoadingBar: true,
+          },
+          getYaml: {
+            method: 'GET',
+            headers: {
+              Accept: 'application/yaml',
+            },
+            transformResponse: rawResponse,
+            ignoreLoadingBar: true,
+          },
+          create: { method: 'POST' },
+          update: { method: 'PUT' },
+          patch: {
+            method: 'PATCH',
+            headers: {
+              'Content-Type': 'application/json-patch+json',
+            },
+          },
+          rollback: {
+            method: 'PATCH',
+            headers: {
+              'Content-Type': 'application/json-patch+json',
+            },
+          },
+          delete: { method: 'DELETE' },
+        }
+      );
+    };
+  },
+]);
diff --git a/app/kubernetes/rest/endpoint.js b/app/kubernetes/rest/endpoint.js
new file mode 100644
index 0000000..71fde10
--- /dev/null
+++ b/app/kubernetes/rest/endpoint.js
@@ -0,0 +1,19 @@
+angular.module('portainer.kubernetes').factory('KubernetesEndpoints', function KubernetesEndpointsFactory($resource, API_ENDPOINT_ENDPOINTS, EndpointProvider) {
+  'use strict';
+  return function (namespace) {
+    const url = API_ENDPOINT_ENDPOINTS + '/:endpointId/kubernetes/api/v1' + (namespace ? '/namespaces/:namespace' : '') + '/endpoints/:id';
+    return $resource(
+      url,
+      {
+        endpointId: EndpointProvider.endpointID,
+        namespace: namespace,
+      },
+      {
+        get: {
+          method: 'GET',
+          ignoreLoadingBar: true,
+        },
+      }
+    );
+  };
+});
diff --git a/app/kubernetes/rest/event.js b/app/kubernetes/rest/event.js
new file mode 100644
index 0000000..78354d3
--- /dev/null
+++ b/app/kubernetes/rest/event.js
@@ -0,0 +1,37 @@
+import { rawResponse } from '@/kubernetes/rest/response/transform';
+
+angular.module('portainer.kubernetes').factory('KubernetesEvents', [
+  '$resource',
+  'API_ENDPOINT_ENDPOINTS',
+  'EndpointProvider',
+  function KubernetesEventsFactory($resource, API_ENDPOINT_ENDPOINTS, EndpointProvider) {
+    'use strict';
+    return function (namespace) {
+      const url = API_ENDPOINT_ENDPOINTS + '/:endpointId/kubernetes/api/v1' + (namespace ? '/namespaces/:namespace' : '') + '/events/:id/:action';
+      return $resource(
+        url,
+        {
+          endpointId: EndpointProvider.endpointID,
+          namespace: namespace,
+        },
+        {
+          get: {
+            method: 'GET',
+            ignoreLoadingBar: true,
+          },
+          getYaml: {
+            method: 'GET',
+            headers: {
+              Accept: 'application/yaml',
+            },
+            transformResponse: rawResponse,
+            ignoreLoadingBar: true,
+          },
+          create: { method: 'POST' },
+          update: { method: 'PUT' },
+          delete: { method: 'DELETE' },
+        }
+      );
+    };
+  },
+]);
diff --git a/app/kubernetes/rest/health.js b/app/kubernetes/rest/health.js
new file mode 100644
index 0000000..bc41be4
--- /dev/null
+++ b/app/kubernetes/rest/health.js
@@ -0,0 +1,14 @@
+angular.module('portainer.kubernetes').factory('KubernetesHealth', [
+  '$resource',
+  'API_ENDPOINT_ENDPOINTS',
+  function KubernetesHealthFactory($resource, API_ENDPOINT_ENDPOINTS) {
+    'use strict';
+    return $resource(
+      API_ENDPOINT_ENDPOINTS + '/:id/kubernetes/healthz',
+      {},
+      {
+        ping: { method: 'GET', params: { id: 'id' } },
+      }
+    );
+  },
+]);
diff --git a/app/kubernetes/rest/namespace.js b/app/kubernetes/rest/namespace.js
new file mode 100644
index 0000000..c594ef4
--- /dev/null
+++ b/app/kubernetes/rest/namespace.js
@@ -0,0 +1,49 @@
+import { rawResponse } from '@/kubernetes/rest/response/transform';
+
+angular.module('portainer.kubernetes').factory('KubernetesNamespaces', [
+  '$resource',
+  'API_ENDPOINT_ENDPOINTS',
+  'EndpointProvider',
+  function KubernetesNamespacesFactory($resource, API_ENDPOINT_ENDPOINTS, EndpointProvider) {
+    'use strict';
+    return function () {
+      const url = API_ENDPOINT_ENDPOINTS + '/:endpointId/kubernetes/api/v1/namespaces/:id/:action';
+      return $resource(
+        url,
+        {
+          endpointId: EndpointProvider.endpointID,
+        },
+        {
+          get: {
+            method: 'GET',
+            ignoreLoadingBar: true,
+          },
+          getYaml: {
+            method: 'GET',
+            headers: {
+              Accept: 'application/yaml',
+            },
+            transformResponse: rawResponse,
+            ignoreLoadingBar: true,
+          },
+          getJSON: {
+            method: 'GET',
+            headers: {
+              Accept: 'application/json',
+            },
+            transformResponse: rawResponse,
+            ignoreLoadingBar: true,
+          },
+          create: { method: 'POST' },
+          update: { method: 'PUT' },
+          delete: { method: 'DELETE' },
+          status: {
+            method: 'GET',
+            params: { action: 'status' },
+            ignoreLoadingBar: true,
+          },
+        }
+      );
+    };
+  },
+]);
diff --git a/app/kubernetes/rest/nodesLimits.js b/app/kubernetes/rest/nodesLimits.js
new file mode 100644
index 0000000..d8eb59d
--- /dev/null
+++ b/app/kubernetes/rest/nodesLimits.js
@@ -0,0 +1,21 @@
+import angular from 'angular';
+
+angular.module('portainer.kubernetes').factory('KubernetesNodesLimits', KubernetesNodesLimitsFactory);
+
+/* @ngInject */
+function KubernetesNodesLimitsFactory($resource, API_ENDPOINT_KUBERNETES, EndpointProvider) {
+  const url = API_ENDPOINT_KUBERNETES + '/:endpointId/nodes_limits';
+  return $resource(
+    url,
+    {
+      endpointId: EndpointProvider.endpointID,
+    },
+    {
+      get: {
+        method: 'GET',
+        ignoreLoadingBar: true,
+        transformResponse: (data) => ({ data: JSON.parse(data) }),
+      },
+    }
+  );
+}
diff --git a/app/kubernetes/rest/persistentVolumeClaim.js b/app/kubernetes/rest/persistentVolumeClaim.js
new file mode 100644
index 0000000..329d73d
--- /dev/null
+++ b/app/kubernetes/rest/persistentVolumeClaim.js
@@ -0,0 +1,43 @@
+import { rawResponse } from '@/kubernetes/rest/response/transform';
+
+angular.module('portainer.kubernetes').factory('KubernetesPersistentVolumeClaims', [
+  '$resource',
+  'API_ENDPOINT_ENDPOINTS',
+  'EndpointProvider',
+  function KubernetesPersistentVolumeClaimsFactory($resource, API_ENDPOINT_ENDPOINTS, EndpointProvider) {
+    'use strict';
+    return function (namespace) {
+      const url = API_ENDPOINT_ENDPOINTS + '/:endpointId/kubernetes/api/v1' + (namespace ? '/namespaces/:namespace' : '') + '/persistentvolumeclaims/:id/:action';
+      return $resource(
+        url,
+        {
+          endpointId: EndpointProvider.endpointID,
+          namespace: namespace,
+        },
+        {
+          get: {
+            method: 'GET',
+            ignoreLoadingBar: true,
+          },
+          getYaml: {
+            method: 'GET',
+            headers: {
+              Accept: 'application/yaml',
+            },
+            transformResponse: rawResponse,
+            ignoreLoadingBar: true,
+          },
+          create: { method: 'POST' },
+          update: { method: 'PUT' },
+          patch: {
+            method: 'PATCH',
+            headers: {
+              'Content-Type': 'application/json-patch+json',
+            },
+          },
+          delete: { method: 'DELETE' },
+        }
+      );
+    };
+  },
+]);
diff --git a/app/kubernetes/rest/pod.js b/app/kubernetes/rest/pod.js
new file mode 100644
index 0000000..46cfe95
--- /dev/null
+++ b/app/kubernetes/rest/pod.js
@@ -0,0 +1,57 @@
+import { rawResponse } from '@/kubernetes/rest/response/transform';
+
+angular.module('portainer.kubernetes').factory('KubernetesPods', [
+  '$resource',
+  'API_ENDPOINT_ENDPOINTS',
+  'EndpointProvider',
+  function KubernetesPodsFactory($resource, API_ENDPOINT_ENDPOINTS, EndpointProvider) {
+    'use strict';
+    return function (namespace) {
+      const url = API_ENDPOINT_ENDPOINTS + '/:endpointId/kubernetes/api/v1' + (namespace ? '/namespaces/:namespace' : '') + '/pods/:id/:action';
+      return $resource(
+        url,
+        {
+          endpointId: EndpointProvider.endpointID,
+          namespace: namespace,
+        },
+        {
+          get: {
+            method: 'GET',
+            ignoreLoadingBar: true,
+          },
+          getYaml: {
+            method: 'GET',
+            headers: {
+              Accept: 'application/yaml',
+            },
+            transformResponse: rawResponse,
+            ignoreLoadingBar: true,
+          },
+          create: { method: 'POST' },
+          update: { method: 'PUT' },
+          delete: { method: 'DELETE' },
+          patch: {
+            method: 'PATCH',
+            headers: {
+              'Content-Type': 'application/json-patch+json',
+            },
+          },
+          logs: {
+            method: 'GET',
+            params: { action: 'log' },
+            transformResponse: logsHandler,
+          },
+          evict: { method: 'POST' },
+        }
+      );
+    };
+  },
+]);
+
+// The Docker API returns the logs as a single string.
+// This handler wraps the data in a JSON object under the "logs" property.
+function logsHandler(data) {
+  return {
+    logs: data,
+  };
+}
diff --git a/app/kubernetes/rest/portainer-namespace.js b/app/kubernetes/rest/portainer-namespace.js
new file mode 100644
index 0000000..ee54f3f
--- /dev/null
+++ b/app/kubernetes/rest/portainer-namespace.js
@@ -0,0 +1,12 @@
+angular.module('portainer.kubernetes').factory('KubernetesPortainerNamespaces', KubernetesPortainerNamespacesFactory);
+
+function KubernetesPortainerNamespacesFactory($resource) {
+  const url = '/api/kubernetes/:endpointId/namespaces/:namespaceName/:action';
+  return $resource(
+    url,
+    {},
+    {
+      toggleSystem: { method: 'PUT', params: { action: 'system' } },
+    }
+  );
+}
diff --git a/app/kubernetes/rest/replicaSet.js b/app/kubernetes/rest/replicaSet.js
new file mode 100644
index 0000000..bc42d00
--- /dev/null
+++ b/app/kubernetes/rest/replicaSet.js
@@ -0,0 +1,43 @@
+import { rawResponse } from '@/kubernetes/rest/response/transform';
+
+angular.module('portainer.kubernetes').factory('KubernetesReplicaSets', [
+  '$resource',
+  'API_ENDPOINT_ENDPOINTS',
+  'EndpointProvider',
+  function KubernetesReplicaSetsFactory($resource, API_ENDPOINT_ENDPOINTS, EndpointProvider) {
+    'use strict';
+    return function (namespace) {
+      const url = API_ENDPOINT_ENDPOINTS + '/:endpointId/kubernetes/apis/apps/v1' + (namespace ? '/namespaces/:namespace' : '') + '/replicasets/:id/:action';
+      return $resource(
+        url,
+        {
+          endpointId: EndpointProvider.endpointID,
+          namespace: namespace,
+        },
+        {
+          get: {
+            method: 'GET',
+            ignoreLoadingBar: true,
+          },
+          getYaml: {
+            method: 'GET',
+            headers: {
+              Accept: 'application/yaml',
+            },
+            transformResponse: rawResponse,
+            ignoreLoadingBar: true,
+          },
+          create: { method: 'POST' },
+          update: { method: 'PUT' },
+          patch: {
+            method: 'PATCH',
+            headers: {
+              'Content-Type': 'application/json-patch+json',
+            },
+          },
+          delete: { method: 'DELETE' },
+        }
+      );
+    };
+  },
+]);
diff --git a/app/kubernetes/rest/resourceQuota.js b/app/kubernetes/rest/resourceQuota.js
new file mode 100644
index 0000000..55d111c
--- /dev/null
+++ b/app/kubernetes/rest/resourceQuota.js
@@ -0,0 +1,43 @@
+import { rawResponse } from '@/kubernetes/rest/response/transform';
+
+angular.module('portainer.kubernetes').factory('KubernetesResourceQuotas', [
+  '$resource',
+  'API_ENDPOINT_ENDPOINTS',
+  'EndpointProvider',
+  function KubernetesResourceQuotasFactory($resource, API_ENDPOINT_ENDPOINTS, EndpointProvider) {
+    'use strict';
+    return function (namespace) {
+      const url = API_ENDPOINT_ENDPOINTS + '/:endpointId/kubernetes/api/v1' + (namespace ? '/namespaces/:namespace' : '') + '/resourcequotas/:id/:action';
+      return $resource(
+        url,
+        {
+          endpointId: EndpointProvider.endpointID,
+          namespace: namespace,
+        },
+        {
+          get: {
+            method: 'GET',
+            ignoreLoadingBar: true,
+          },
+          getYaml: {
+            method: 'GET',
+            headers: {
+              Accept: 'application/yaml',
+            },
+            transformResponse: rawResponse,
+            ignoreLoadingBar: true,
+          },
+          create: { method: 'POST' },
+          update: { method: 'PUT' },
+          patch: {
+            method: 'PATCH',
+            headers: {
+              'Content-Type': 'application/json-patch+json',
+            },
+          },
+          delete: { method: 'DELETE' },
+        }
+      );
+    };
+  },
+]);
diff --git a/app/kubernetes/rest/response/transform.js b/app/kubernetes/rest/response/transform.js
new file mode 100644
index 0000000..d4a0db0
--- /dev/null
+++ b/app/kubernetes/rest/response/transform.js
@@ -0,0 +1,7 @@
+// Returns the raw response without JSON parsing
+export function rawResponse(data) {
+  const response = {
+    data: data,
+  };
+  return response;
+}
diff --git a/app/kubernetes/rest/secret.js b/app/kubernetes/rest/secret.js
new file mode 100644
index 0000000..74931a4
--- /dev/null
+++ b/app/kubernetes/rest/secret.js
@@ -0,0 +1,37 @@
+import { rawResponse } from '@/kubernetes/rest/response/transform';
+
+angular.module('portainer.kubernetes').factory('KubernetesSecrets', [
+  '$resource',
+  'API_ENDPOINT_ENDPOINTS',
+  'EndpointProvider',
+  function KubernetesSecretsFactory($resource, API_ENDPOINT_ENDPOINTS, EndpointProvider) {
+    'use strict';
+    return function (namespace) {
+      const url = API_ENDPOINT_ENDPOINTS + '/:endpointId/kubernetes/api/v1' + (namespace ? '/namespaces/:namespace' : '') + '/secrets/:id/:action';
+      return $resource(
+        url,
+        {
+          endpointId: EndpointProvider.endpointID,
+          namespace: namespace,
+        },
+        {
+          get: {
+            method: 'GET',
+            ignoreLoadingBar: true,
+          },
+          getYaml: {
+            method: 'GET',
+            headers: {
+              Accept: 'application/yaml',
+            },
+            transformResponse: rawResponse,
+            ignoreLoadingBar: true,
+          },
+          create: { method: 'POST' },
+          update: { method: 'PUT' },
+          delete: { method: 'DELETE' },
+        }
+      );
+    };
+  },
+]);
diff --git a/app/kubernetes/rest/service.js b/app/kubernetes/rest/service.js
new file mode 100644
index 0000000..16acc97
--- /dev/null
+++ b/app/kubernetes/rest/service.js
@@ -0,0 +1,43 @@
+import { rawResponse } from '@/kubernetes/rest/response/transform';
+
+angular.module('portainer.kubernetes').factory('KubernetesServices', [
+  '$resource',
+  'API_ENDPOINT_ENDPOINTS',
+  'EndpointProvider',
+  function KubernetesServicesFactory($resource, API_ENDPOINT_ENDPOINTS, EndpointProvider) {
+    'use strict';
+    return function (namespace) {
+      const url = API_ENDPOINT_ENDPOINTS + '/:endpointId/kubernetes/api/v1' + (namespace ? '/namespaces/:namespace' : '') + '/services/:id/:action';
+      return $resource(
+        url,
+        {
+          endpointId: EndpointProvider.endpointID,
+          namespace: namespace,
+        },
+        {
+          get: {
+            method: 'GET',
+            ignoreLoadingBar: true,
+          },
+          getYaml: {
+            method: 'GET',
+            headers: {
+              Accept: 'application/yaml',
+            },
+            transformResponse: rawResponse,
+            ignoreLoadingBar: true,
+          },
+          create: { method: 'POST' },
+          update: { method: 'PUT' },
+          patch: {
+            method: 'PATCH',
+            headers: {
+              'Content-Type': 'application/json-patch+json',
+            },
+          },
+          delete: { method: 'DELETE' },
+        }
+      );
+    };
+  },
+]);
diff --git a/app/kubernetes/rest/serviceAccount.js b/app/kubernetes/rest/serviceAccount.js
new file mode 100644
index 0000000..e0b36f8
--- /dev/null
+++ b/app/kubernetes/rest/serviceAccount.js
@@ -0,0 +1,16 @@
+import axios, { parseAxiosError } from '@/react/portainer/services/axios/axios';
+
+export async function getServiceAccounts(environmentId, namespaceId) {
+  try {
+    const {
+      data: { items },
+    } = await axios.get(urlBuilder(environmentId, namespaceId));
+    return items;
+  } catch (error) {
+    throw parseAxiosError(error);
+  }
+}
+
+function urlBuilder(environmentId, namespaceId) {
+  return `endpoints/${environmentId}/kubernetes/api/v1/namespaces/${namespaceId}/serviceaccounts`;
+}
diff --git a/app/kubernetes/rest/statefulSet.js b/app/kubernetes/rest/statefulSet.js
new file mode 100644
index 0000000..d4ef7ee
--- /dev/null
+++ b/app/kubernetes/rest/statefulSet.js
@@ -0,0 +1,49 @@
+import { rawResponse } from '@/kubernetes/rest/response/transform';
+
+angular.module('portainer.kubernetes').factory('KubernetesStatefulSets', [
+  '$resource',
+  'API_ENDPOINT_ENDPOINTS',
+  'EndpointProvider',
+  function KubernetesStatefulSetsFactory($resource, API_ENDPOINT_ENDPOINTS, EndpointProvider) {
+    'use strict';
+    return function (namespace) {
+      const url = API_ENDPOINT_ENDPOINTS + '/:endpointId/kubernetes/apis/apps/v1' + (namespace ? '/namespaces/:namespace' : '') + '/statefulsets/:id/:action';
+      return $resource(
+        url,
+        {
+          endpointId: EndpointProvider.endpointID,
+          namespace: namespace,
+        },
+        {
+          get: {
+            method: 'GET',
+            ignoreLoadingBar: true,
+          },
+          getYaml: {
+            method: 'GET',
+            headers: {
+              Accept: 'application/yaml',
+            },
+            transformResponse: rawResponse,
+            ignoreLoadingBar: true,
+          },
+          create: { method: 'POST' },
+          update: { method: 'PUT' },
+          patch: {
+            method: 'PATCH',
+            headers: {
+              'Content-Type': 'application/json-patch+json',
+            },
+          },
+          rollback: {
+            method: 'PATCH',
+            headers: {
+              'Content-Type': 'application/strategic-merge-patch+json',
+            },
+          },
+          delete: { method: 'DELETE' },
+        }
+      );
+    };
+  },
+]);
diff --git a/app/kubernetes/rest/storage.js b/app/kubernetes/rest/storage.js
new file mode 100644
index 0000000..496ff55
--- /dev/null
+++ b/app/kubernetes/rest/storage.js
@@ -0,0 +1,42 @@
+import { rawResponse } from '@/kubernetes/rest/response/transform';
+
+angular.module('portainer.kubernetes').factory('KubernetesStorage', [
+  '$resource',
+  'API_ENDPOINT_ENDPOINTS',
+  'EndpointProvider',
+  function KubernetesStorageFactory($resource, API_ENDPOINT_ENDPOINTS, EndpointProvider) {
+    'use strict';
+    return function () {
+      const url = API_ENDPOINT_ENDPOINTS + '/:endpointId/kubernetes/apis/storage.k8s.io/v1/storageclasses/:id/:action';
+      return $resource(
+        url,
+        {
+          endpointId: EndpointProvider.endpointID,
+        },
+        {
+          get: {
+            method: 'GET',
+            ignoreLoadingBar: true,
+          },
+          getYaml: {
+            method: 'GET',
+            headers: {
+              Accept: 'application/yaml',
+            },
+            transformResponse: rawResponse,
+            ignoreLoadingBar: true,
+          },
+          create: { method: 'POST' },
+          update: { method: 'PUT' },
+          patch: {
+            method: 'PATCH',
+            headers: {
+              'Content-Type': 'application/json-patch+json',
+            },
+          },
+          delete: { method: 'DELETE' },
+        }
+      );
+    };
+  },
+]);
diff --git a/app/kubernetes/services/applicationService.js b/app/kubernetes/services/applicationService.js
new file mode 100644
index 0000000..97db6da
--- /dev/null
+++ b/app/kubernetes/services/applicationService.js
@@ -0,0 +1,475 @@
+import _ from 'lodash-es';
+import angular from 'angular';
+import PortainerError from '@/portainer/error';
+
+import { KubernetesApplicationDeploymentTypes, KubernetesApplicationTypes } from '@/kubernetes/models/application/models/appConstants';
+import KubernetesApplicationHelper from '@/kubernetes/helpers/application';
+import KubernetesApplicationConverter from '@/kubernetes/converters/application';
+import { KubernetesStatefulSet } from '@/kubernetes/models/stateful-set/models';
+import KubernetesServiceHelper from '@/kubernetes/helpers/serviceHelper';
+import { KubernetesHorizontalPodAutoScalerHelper } from '@/kubernetes/horizontal-pod-auto-scaler/helper';
+import { KubernetesHorizontalPodAutoScalerConverter } from '@/kubernetes/horizontal-pod-auto-scaler/converter';
+import KubernetesPodConverter from '@/kubernetes/pod/converter';
+import { notifyError } from '@/portainer/services/notifications';
+import { KubernetesIngressConverter } from '@/kubernetes/ingress/converter';
+import { generateNewIngressesFromFormPaths } from '@/react/kubernetes/applications/CreateView/application-services/utils';
+import { KubernetesPod } from '../pod/models';
+
+class KubernetesApplicationService {
+  /* #region  CONSTRUCTOR */
+  /* @ngInject */
+  constructor(
+    $async,
+    Authentication,
+    KubernetesDeploymentService,
+    KubernetesDaemonSetService,
+    KubernetesStatefulSetService,
+    KubernetesServiceService,
+    KubernetesSecretService,
+    KubernetesPersistentVolumeClaimService,
+    KubernetesNamespaceService,
+    KubernetesPodService,
+    KubernetesHorizontalPodAutoScalerService,
+    KubernetesIngressService
+  ) {
+    this.$async = $async;
+    this.Authentication = Authentication;
+    this.KubernetesDeploymentService = KubernetesDeploymentService;
+    this.KubernetesDaemonSetService = KubernetesDaemonSetService;
+    this.KubernetesStatefulSetService = KubernetesStatefulSetService;
+    this.KubernetesServiceService = KubernetesServiceService;
+    this.KubernetesSecretService = KubernetesSecretService;
+    this.KubernetesPersistentVolumeClaimService = KubernetesPersistentVolumeClaimService;
+    this.KubernetesNamespaceService = KubernetesNamespaceService;
+    this.KubernetesPodService = KubernetesPodService;
+    this.KubernetesHorizontalPodAutoScalerService = KubernetesHorizontalPodAutoScalerService;
+    this.KubernetesIngressService = KubernetesIngressService;
+
+    this.getAsync = this.getAsync.bind(this);
+    this.getAllAsync = this.getAllAsync.bind(this);
+    this.createAsync = this.createAsync.bind(this);
+    this.patchAsync = this.patchAsync.bind(this);
+    this.patchPartialAsync = this.patchPartialAsync.bind(this);
+    this.deleteAsync = this.deleteAsync.bind(this);
+  }
+  /* #endregion */
+
+  /* #region  UTILS */
+  _getApplicationApiService(app) {
+    let apiService;
+    if (app.ApplicationType === KubernetesApplicationTypes.Deployment) {
+      apiService = this.KubernetesDeploymentService;
+    } else if (app.ApplicationType === KubernetesApplicationTypes.DaemonSet) {
+      apiService = this.KubernetesDaemonSetService;
+    } else if (app.ApplicationType === KubernetesApplicationTypes.StatefulSet) {
+      apiService = this.KubernetesStatefulSetService;
+    } else if (app instanceof KubernetesPod || KubernetesApplicationTypes.Pod) {
+      apiService = this.KubernetesPodService;
+    } else {
+      throw new PortainerError('Unable to determine which association to use to retrieve API Service');
+    }
+    return apiService;
+  }
+
+  _generateIngressPatchPromises(oldIngresses, newIngresses) {
+    return _.map(newIngresses, (newIng) => {
+      const oldIng = _.find(oldIngresses, { Name: newIng.Name });
+      return this.KubernetesIngressService.patch(oldIng, newIng);
+    });
+  }
+  /* #endregion */
+
+  /* #region  GET */
+  async getAsync(namespace, name) {
+    const [deployment, daemonSet, statefulSet, pod, pods, autoScalers, ingresses] = await Promise.allSettled([
+      this.KubernetesDeploymentService.get(namespace, name),
+      this.KubernetesDaemonSetService.get(namespace, name),
+      this.KubernetesStatefulSetService.get(namespace, name),
+      this.KubernetesPodService.get(namespace, name),
+      this.KubernetesPodService.get(namespace),
+      this.KubernetesHorizontalPodAutoScalerService.get(namespace),
+      this.KubernetesIngressService.get(namespace),
+    ]);
+
+    let rootItem;
+    let converterFunc;
+    if (deployment.status === 'fulfilled') {
+      rootItem = deployment;
+      converterFunc = KubernetesApplicationConverter.apiDeploymentToApplication;
+    } else if (daemonSet.status === 'fulfilled') {
+      rootItem = daemonSet;
+      converterFunc = KubernetesApplicationConverter.apiDaemonSetToApplication;
+    } else if (statefulSet.status === 'fulfilled') {
+      rootItem = statefulSet;
+      converterFunc = KubernetesApplicationConverter.apiStatefulSetToapplication;
+    } else if (pod.status === 'fulfilled') {
+      rootItem = pod;
+      converterFunc = KubernetesApplicationConverter.apiPodToApplication;
+    } else {
+      throw new PortainerError('Unable to determine which association to use to convert application');
+    }
+
+    const services = await this.KubernetesServiceService.get(namespace);
+    const boundService = KubernetesServiceHelper.findApplicationBoundService(services, rootItem.value.Raw);
+    const service = boundService ? await this.KubernetesServiceService.get(namespace, boundService.metadata.name) : {};
+    const boundServices = KubernetesServiceHelper.findApplicationBoundServices(services, rootItem.value.Raw);
+
+    const application = converterFunc(rootItem.value.Raw, pods.value, service.Raw, ingresses.value);
+    application.Yaml = rootItem.value.Yaml;
+    application.Raw = rootItem.value.Raw;
+    application.Pods = _.map(application.Pods, (item) => KubernetesPodConverter.apiToModel(item));
+    application.Containers = KubernetesApplicationHelper.associateContainersAndApplication(application);
+    application.Services = boundServices;
+
+    const boundScaler = KubernetesHorizontalPodAutoScalerHelper.findApplicationBoundScaler(autoScalers.value, application);
+    const scaler = boundScaler ? await this.KubernetesHorizontalPodAutoScalerService.get(namespace, boundScaler.Name) : undefined;
+    application.AutoScaler = scaler;
+
+    if (service.Yaml) {
+      application.Yaml += '---\n' + service.Yaml;
+    }
+    if (scaler && scaler.Yaml) {
+      application.Yaml += '---\n' + scaler.Yaml;
+    }
+    // TODO: refactor @LP
+    // append ingress yaml ?
+    return application;
+  }
+
+  async getAllAsync(namespace) {
+    const namespaces = namespace ? [namespace] : _.map(await this.KubernetesNamespaceService.get(), 'Name');
+
+    const convertToApplication = (item, converterFunc, services, pods, ingresses) => {
+      const service = KubernetesServiceHelper.findApplicationBoundService(services, item);
+      const servicesFound = KubernetesServiceHelper.findApplicationBoundServices(services, item);
+      const application = converterFunc(item, pods, service, ingresses);
+      application.Containers = KubernetesApplicationHelper.associateContainersAndApplication(application);
+      application.Services = servicesFound;
+      return application;
+    };
+
+    const res = await Promise.all(
+      _.map(namespaces, async (ns) => {
+        const [deployments, daemonSets, statefulSets, services, pods, ingresses, autoScalers] = await Promise.all([
+          this.KubernetesDeploymentService.get(ns),
+          this.KubernetesDaemonSetService.get(ns),
+          this.KubernetesStatefulSetService.get(ns),
+          this.KubernetesServiceService.get(ns),
+          this.KubernetesPodService.get(ns),
+          this.KubernetesIngressService.get(ns),
+          this.KubernetesHorizontalPodAutoScalerService.get(ns),
+        ]);
+
+        const deploymentApplications = _.map(deployments, (item) =>
+          convertToApplication(item, KubernetesApplicationConverter.apiDeploymentToApplication, services, pods, ingresses)
+        );
+        const daemonSetApplications = _.map(daemonSets, (item) => convertToApplication(item, KubernetesApplicationConverter.apiDaemonSetToApplication, services, pods, ingresses));
+        const statefulSetApplications = _.map(statefulSets, (item) =>
+          convertToApplication(item, KubernetesApplicationConverter.apiStatefulSetToapplication, services, pods, ingresses)
+        );
+
+        const boundPods = _.concat(_.flatMap(deploymentApplications, 'Pods'), _.flatMap(daemonSetApplications, 'Pods'), _.flatMap(statefulSetApplications, 'Pods'));
+        const unboundPods = _.without(pods, ...boundPods);
+        const nakedPodsApplications = _.map(unboundPods, (item) => convertToApplication(item, KubernetesApplicationConverter.apiPodToApplication, services, pods, ingresses));
+
+        const applications = _.concat(deploymentApplications, daemonSetApplications, statefulSetApplications, nakedPodsApplications);
+        _.forEach(applications, (app) => {
+          app.Pods = _.map(app.Pods, (item) => KubernetesPodConverter.apiToModel(item));
+        });
+        await Promise.all(
+          _.forEach(applications, async (application) => {
+            const boundScaler = KubernetesHorizontalPodAutoScalerHelper.findApplicationBoundScaler(autoScalers, application);
+            const scaler = boundScaler ? await this.KubernetesHorizontalPodAutoScalerService.get(ns, boundScaler.Name) : undefined;
+            application.AutoScaler = scaler;
+          })
+        );
+        return applications;
+      })
+    );
+    return _.flatten(res);
+  }
+
+  get(namespace, name) {
+    if (name) {
+      return this.$async(this.getAsync, namespace, name);
+    }
+    return this.$async(this.getAllAsync, namespace);
+  }
+  /* #endregion */
+
+  /* #region  CREATE */
+  // TODO: review
+  // resource creation flow
+  // should we keep formValues > Resource_1 || Resource_2
+  // or should we switch to formValues > Composite > Resource_1 || Resource_2
+  /**
+   * NOTE: Keep this method flow in sync with `getCreatedApplicationResources` method in the `applicationService` file
+   *    To synchronise with kubernetes resource creation summary output, any new resources created in this method should
+   *    also be displayed in the summary output (getCreatedApplicationResources)
+   */
+  async createAsync(formValues, hideStacks) {
+    // formValues -> Application
+    let [app, headlessService, services, , claims] = KubernetesApplicationConverter.applicationFormValuesToApplication(formValues);
+
+    if (hideStacks) {
+      app.StackName = '';
+    }
+
+    if (services) {
+      services.forEach(async (service) => {
+        try {
+          await this.KubernetesServiceService.create(service);
+        } catch (error) {
+          notifyError('Unable to create service', error);
+        }
+      });
+
+      try {
+        //Generate all ingresses from current form by passing services object
+        const newServicePorts = formValues.Services.flatMap((service) => service.Ports);
+        const newIngresses = generateNewIngressesFromFormPaths(formValues.OriginalIngresses, newServicePorts);
+        if (newIngresses) {
+          //Update original ingress with current ingress
+          await Promise.all(this._generateIngressPatchPromises(formValues.OriginalIngresses, newIngresses));
+        }
+      } catch (error) {
+        notifyError('Unable to update service', error);
+      }
+    }
+
+    const apiService = this._getApplicationApiService(app);
+
+    if (app instanceof KubernetesStatefulSet) {
+      app.VolumeClaims = claims;
+      try {
+        headlessService = await this.KubernetesServiceService.create(headlessService);
+      } catch (error) {
+        notifyError('Unable to create service', error);
+      }
+      app.ServiceName = headlessService.metadata.name;
+    } else {
+      const claimPromises = _.map(claims, (item) => {
+        if (!item.PreviousName && !item.Id) {
+          return this.KubernetesPersistentVolumeClaimService.create(item);
+        }
+      });
+      await Promise.all(_.without(claimPromises, undefined));
+    }
+
+    if (formValues.AutoScaler.isUsed && formValues.DeploymentType !== KubernetesApplicationDeploymentTypes.Global) {
+      const kind = app.ApplicationType;
+      const autoScaler = KubernetesHorizontalPodAutoScalerConverter.applicationFormValuesToModel(formValues, kind);
+      await this.KubernetesHorizontalPodAutoScalerService.create(autoScaler);
+    }
+
+    await apiService.create(app);
+  }
+
+  create(formValues, _, hideStacks) {
+    return this.$async(this.createAsync, formValues, hideStacks);
+  }
+  /* #endregion */
+
+  /* #region  PATCH */
+  // this function accepts KubernetesApplicationFormValues as parameters
+  /**
+   * NOTE: Keep this method flow in sync with `getUpdatedApplicationResources` method in the `applicationService` file
+   *    To synchronise with kubernetes resource creation, update and delete summary output, any new resources created
+   *    in this method should also be displayed in the summary output (getUpdatedApplicationResources)
+   */
+  async patchAsync(oldFormValues, newFormValues, originalServicePorts) {
+    const [oldApp, oldHeadlessService, oldServices, , oldClaims] = KubernetesApplicationConverter.applicationFormValuesToApplication(oldFormValues);
+    const [newApp, newHeadlessService, newServices, , newClaims] = KubernetesApplicationConverter.applicationFormValuesToApplication(newFormValues);
+    const oldApiService = this._getApplicationApiService(oldApp);
+    const newApiService = this._getApplicationApiService(newApp);
+
+    if (oldApiService !== newApiService) {
+      // delete services first
+      if (oldServices) {
+        await this.KubernetesServiceService.delete(oldServices);
+      }
+
+      // delete the app
+      await this.delete(oldApp);
+
+      // sleep for 5 seconds to allow the app/services to be deleted
+      await new Promise((r) => setTimeout(r, 5000));
+
+      // create the app
+      return await this.create(newFormValues);
+    }
+
+    if (newApp instanceof KubernetesStatefulSet) {
+      try {
+        await this.KubernetesServiceService.patch(oldHeadlessService, newHeadlessService);
+      } catch (error) {
+        notifyError('Unable to update service', error);
+      }
+    } else {
+      const claimPromises = _.map(newClaims, (newClaim) => {
+        if (!newClaim.PreviousName && !newClaim.Id) {
+          return this.KubernetesPersistentVolumeClaimService.create(newClaim);
+        } else if (!newClaim.Id) {
+          const oldClaim = _.find(oldClaims, { Name: newClaim.PreviousName });
+          return this.KubernetesPersistentVolumeClaimService.patch(oldClaim, newClaim);
+        }
+      });
+      await Promise.all(claimPromises);
+    }
+
+    await newApiService.patch(oldApp, newApp);
+
+    // Create services
+    if (oldServices.length === 0 && newServices.length !== 0) {
+      newServices.forEach(async (service) => {
+        try {
+          await this.KubernetesServiceService.create(service);
+        } catch (error) {
+          notifyError('Unable to create service', error);
+        }
+      });
+    }
+
+    // Delete services ( only called when all services been deleted )
+    if (oldServices.length !== 0 && newServices.length === 0) {
+      await this.KubernetesServiceService.deleteAll(oldServices);
+    }
+
+    // Patch services ( Action including: Delete, Update, Create )
+    if (oldServices.length !== 0 && newServices.length !== 0) {
+      oldServices.forEach(async (oldService) => {
+        const newServiceMatched = _.find(newServices, { Name: oldService.Name });
+        if (!newServiceMatched) {
+          await this.KubernetesServiceService.deleteSingle(oldService);
+        }
+      });
+
+      newServices.forEach(async (newService) => {
+        const oldServiceMatched = _.find(oldServices, { Name: newService.Name });
+        if (oldServiceMatched) {
+          try {
+            await this.KubernetesServiceService.patch(oldServiceMatched, newService);
+          } catch (error) {
+            notifyError('Unable to update service', error);
+          }
+        } else {
+          try {
+            await this.KubernetesServiceService.create(newService);
+          } catch (error) {
+            notifyError('Unable to create service', error);
+          }
+        }
+      });
+    }
+
+    // Update ingresses
+    if (newServices) {
+      try {
+        //Generate all ingresses from current form by passing services object
+        const newServicePorts = newFormValues.Services.flatMap((service) => service.Ports);
+        const newIngresses = generateNewIngressesFromFormPaths(newFormValues.OriginalIngresses, newServicePorts, originalServicePorts);
+        if (newIngresses) {
+          //Update original ingress with current ingress
+          await Promise.all(this._generateIngressPatchPromises(newFormValues.OriginalIngresses, newIngresses));
+        }
+      } catch (error) {
+        notifyError('Unable to update service', error);
+      }
+    }
+
+    const newKind = newApp.ApplicationType;
+    const newAutoScaler = KubernetesHorizontalPodAutoScalerConverter.applicationFormValuesToModel(newFormValues, newKind);
+    if (!oldFormValues.AutoScaler.isUsed) {
+      if (newFormValues.AutoScaler.isUsed) {
+        await this.KubernetesHorizontalPodAutoScalerService.create(newAutoScaler);
+      }
+    } else {
+      const oldKind = oldApp.ApplicationType;
+      const oldAutoScaler = KubernetesHorizontalPodAutoScalerConverter.applicationFormValuesToModel(oldFormValues, oldKind);
+      if (newFormValues.AutoScaler.isUsed) {
+        await this.KubernetesHorizontalPodAutoScalerService.patch(oldAutoScaler, newAutoScaler);
+      } else {
+        await this.KubernetesHorizontalPodAutoScalerService.delete(oldAutoScaler);
+      }
+    }
+  }
+
+  // this function accepts KubernetesApplication as parameters
+  async patchPartialAsync(oldApp, newApp) {
+    const oldAppPayload = {
+      Name: oldApp.Name,
+      Namespace: oldApp.ResourcePool,
+      StackName: oldApp.StackName,
+      Note: oldApp.Note,
+    };
+    const newAppPayload = {
+      Name: newApp.Name,
+      Namespace: newApp.ResourcePool,
+      StackName: newApp.StackName,
+      Note: newApp.Note,
+    };
+    const apiService = this._getApplicationApiService(oldApp);
+    await apiService.patch(oldAppPayload, newAppPayload);
+  }
+
+  // accept either formValues or applications as parameters depending on partial value
+  // true = KubernetesApplication
+  // false = KubernetesApplicationFormValues
+  //
+  // e.g. signatures are
+  //
+  // patch(oldValues: KubernetesApplication, newValues: KubernetesApplication, partial: (undefined | false)): Promise<unknown>
+  // patch(oldValues: KubernetesApplicationFormValues, newValues: KubernetesApplicationFormValues, partial: true): Promise<unknown>
+  patch(oldValues, newValues, partial = false, originalServicePorts) {
+    if (partial) {
+      return this.$async(this.patchPartialAsync, oldValues, newValues);
+    }
+    return this.$async(this.patchAsync, oldValues, newValues, originalServicePorts);
+  }
+  /* #endregion */
+
+  /* #region  DELETE */
+  async deleteAsync(application) {
+    const payload = {
+      Namespace: application.ResourcePool || application.Namespace,
+      Name: application.Name,
+    };
+    const servicePayload = angular.copy(payload);
+    servicePayload.Name = application.Name;
+
+    const apiService = this._getApplicationApiService(application);
+    await apiService.delete(payload);
+
+    if (apiService === this.KubernetesStatefulSetService) {
+      const headlessServicePayload = angular.copy(payload);
+      headlessServicePayload.Name = application instanceof KubernetesStatefulSet ? application.ServiceName : application.HeadlessServiceName;
+    }
+
+    if (application.ServiceType) {
+      // delete headless service && non-headless service
+      await this.KubernetesServiceService.delete(application.Services);
+      const appHasIngressPath = application.PublishedPorts && application.PublishedPorts.flatMap((pp) => pp.IngressRules).length >= 1;
+      if (appHasIngressPath) {
+        const originalIngresses = await this.KubernetesIngressService.get(payload.Namespace);
+        const formValues = {
+          OriginalIngresses: originalIngresses,
+          PublishedPorts: KubernetesApplicationHelper.generatePublishedPortsFormValuesFromPublishedPorts(application.ServiceType, application.PublishedPorts),
+        };
+        const ingresses = KubernetesIngressConverter.applicationFormValuesToDeleteIngresses(formValues, application);
+
+        await Promise.all(this._generateIngressPatchPromises(formValues.OriginalIngresses, ingresses));
+      }
+    }
+    if (!_.isEmpty(application.AutoScaler)) {
+      await this.KubernetesHorizontalPodAutoScalerService.delete(application.AutoScaler);
+    }
+  }
+
+  delete(application) {
+    return this.$async(this.deleteAsync, application);
+  }
+  /* #endregion */
+}
+
+export default KubernetesApplicationService;
+angular.module('portainer.kubernetes').service('KubernetesApplicationService', KubernetesApplicationService);
diff --git a/app/kubernetes/services/configMapService.js b/app/kubernetes/services/configMapService.js
new file mode 100644
index 0000000..f7bfb8f
--- /dev/null
+++ b/app/kubernetes/services/configMapService.js
@@ -0,0 +1,161 @@
+import angular from 'angular';
+import _ from 'lodash-es';
+import PortainerError from '@/portainer/error';
+import KubernetesConfigMapConverter from '@/kubernetes/converters/configMap';
+import { KubernetesCommonParams } from '@/kubernetes/models/common/params';
+
+class KubernetesConfigMapService {
+  /* @ngInject */
+  constructor($async, KubernetesConfigMaps) {
+    this.$async = $async;
+    this.KubernetesConfigMaps = KubernetesConfigMaps;
+
+    this.getAsync = this.getAsync.bind(this);
+    this.getAllAsync = this.getAllAsync.bind(this);
+    this.createAsync = this.createAsync.bind(this);
+    this.updateAsync = this.updateAsync.bind(this);
+    this.deleteAsync = this.deleteAsync.bind(this);
+  }
+
+  createAccess(config) {
+    return this.$async(async () => {
+      try {
+        const payload = KubernetesConfigMapConverter.createAccessPayload(config);
+        const params = {};
+        const namespace = payload.metadata.namespace;
+        const data = await this.KubernetesConfigMaps(namespace).create(params, payload).$promise;
+        return KubernetesConfigMapConverter.apiToPortainerAccessConfigMap(data);
+      } catch (err) {
+        throw new PortainerError('Unable to create Portainer accesses', err);
+      }
+    });
+  }
+
+  updateAccess(config) {
+    return this.$async(async () => {
+      try {
+        if (!config.Id) {
+          return await this.createAccess(config);
+        }
+        const payload = KubernetesConfigMapConverter.updateAccessPayload(config);
+        const params = new KubernetesCommonParams();
+        params.id = payload.metadata.name;
+        const namespace = payload.metadata.namespace;
+        const data = await this.KubernetesConfigMaps(namespace).update(params, payload).$promise;
+        return KubernetesConfigMapConverter.apiToPortainerAccessConfigMap(data);
+      } catch (err) {
+        throw new PortainerError('Unable to update Portainer accesses', err);
+      }
+    });
+  }
+
+  /**
+   * GET
+   */
+  async getAsync(namespace, name) {
+    try {
+      const params = new KubernetesCommonParams();
+      params.id = name;
+      const [rawPromise, yamlPromise] = await Promise.allSettled([
+        this.KubernetesConfigMaps(namespace).get(params).$promise,
+        this.KubernetesConfigMaps(namespace).getYaml(params).$promise,
+      ]);
+
+      if (_.get(rawPromise, 'reason.status') === 404 && _.get(yamlPromise, 'reason.status') === 404) {
+        return KubernetesConfigMapConverter.defaultConfigMap(namespace, name);
+      }
+
+      // Saving binary data to 'data' field in configMap Object is not allowed by kubernetes and getYaml() may get
+      // an error. We should keep binary data to 'binaryData' field instead of 'data'. Before that, we
+      // use response from get() and ignore 500 error as a workaround.
+      if (rawPromise.value) {
+        return KubernetesConfigMapConverter.apiToConfigMap(rawPromise.value, yamlPromise.value);
+      }
+
+      throw new PortainerError('Unable to retrieve config map ', name);
+    } catch (err) {
+      if (err.status === 404) {
+        return KubernetesConfigMapConverter.defaultConfigMap(namespace, name);
+      }
+      throw new PortainerError('Unable to retrieve config map', err);
+    }
+  }
+
+  async getAllAsync(namespace) {
+    try {
+      const data = await this.KubernetesConfigMaps(namespace).get().$promise;
+      return _.map(data.items, (item) => KubernetesConfigMapConverter.apiToConfigMap(item));
+    } catch (err) {
+      throw new PortainerError('Unable to retrieve config maps', err);
+    }
+  }
+
+  get(namespace, name) {
+    if (name) {
+      return this.$async(this.getAsync, namespace, name);
+    }
+    return this.$async(this.getAllAsync, namespace);
+  }
+
+  /**
+   * CREATE
+   */
+  async createAsync(config) {
+    try {
+      const payload = KubernetesConfigMapConverter.createPayload(config);
+      const params = {};
+      const namespace = payload.metadata.namespace;
+      const data = await this.KubernetesConfigMaps(namespace).create(params, payload).$promise;
+      return KubernetesConfigMapConverter.apiToConfigMap(data);
+    } catch (err) {
+      throw new PortainerError('Unable to create config map', err);
+    }
+  }
+
+  create(config) {
+    return this.$async(this.createAsync, config);
+  }
+
+  /**
+   * UPDATE
+   */
+  async updateAsync(config) {
+    try {
+      if (!config.Id) {
+        return await this.create(config);
+      }
+      const payload = KubernetesConfigMapConverter.updatePayload(config);
+      const params = new KubernetesCommonParams();
+      params.id = payload.metadata.name;
+      const namespace = payload.metadata.namespace;
+      const data = await this.KubernetesConfigMaps(namespace).update(params, payload).$promise;
+      return KubernetesConfigMapConverter.apiToConfigMap(data);
+    } catch (err) {
+      throw new PortainerError('Unable to update config map', err);
+    }
+  }
+  update(config) {
+    return this.$async(this.updateAsync, config);
+  }
+
+  /**
+   * DELETE
+   */
+  async deleteAsync(config) {
+    try {
+      const params = new KubernetesCommonParams();
+      params.id = config.Name;
+      const namespace = config.Namespace;
+      await this.KubernetesConfigMaps(namespace).delete(params).$promise;
+    } catch (err) {
+      throw new PortainerError('Unable to delete config map', err);
+    }
+  }
+
+  delete(config) {
+    return this.$async(this.deleteAsync, config);
+  }
+}
+
+export default KubernetesConfigMapService;
+angular.module('portainer.kubernetes').service('KubernetesConfigMapService', KubernetesConfigMapService);
diff --git a/app/kubernetes/services/configurationService.js b/app/kubernetes/services/configurationService.js
new file mode 100644
index 0000000..d35910f
--- /dev/null
+++ b/app/kubernetes/services/configurationService.js
@@ -0,0 +1,116 @@
+import angular from 'angular';
+import _ from 'lodash-es';
+import KubernetesConfigurationConverter from '@/kubernetes/converters/configuration';
+import KubernetesConfigMapConverter from '@/kubernetes/converters/configMap';
+import KubernetesSecretConverter from '@/kubernetes/converters/secret';
+import { KubernetesConfigurationKinds } from '@/kubernetes/models/configuration/models';
+import KubernetesCommonHelper from '@/kubernetes/helpers/commonHelper';
+
+class KubernetesConfigurationService {
+  /* @ngInject */
+  constructor($async, Authentication, KubernetesNamespaceService, KubernetesConfigMapService, KubernetesSecretService) {
+    this.$async = $async;
+    this.Authentication = Authentication;
+    this.KubernetesNamespaceService = KubernetesNamespaceService;
+    this.KubernetesConfigMapService = KubernetesConfigMapService;
+    this.KubernetesSecretService = KubernetesSecretService;
+
+    this.getAsync = this.getAsync.bind(this);
+    this.getAllAsync = this.getAllAsync.bind(this);
+    this.createAsync = this.createAsync.bind(this);
+    this.updateAsync = this.updateAsync.bind(this);
+    this.deleteAsync = this.deleteAsync.bind(this);
+  }
+
+  /**
+   * GET
+   */
+  async getAsync(namespace, name) {
+    const [configMap, secret] = await Promise.allSettled([this.KubernetesConfigMapService.get(namespace, name), this.KubernetesSecretService.get(namespace, name)]);
+    let configuration;
+    if (secret.status === 'fulfilled') {
+      configuration = KubernetesConfigurationConverter.secretToConfiguration(secret.value);
+      return configuration;
+    }
+    configuration = KubernetesConfigurationConverter.configMapToConfiguration(configMap.value);
+    return configuration;
+  }
+
+  async getAllAsync(namespace) {
+    const namespaces = namespace ? [namespace] : _.map(await this.KubernetesNamespaceService.get(), 'Name');
+    const res = await Promise.all(
+      _.map(namespaces, async (ns) => {
+        const [configMaps, secrets] = await Promise.all([this.KubernetesConfigMapService.get(ns), this.KubernetesSecretService.get(ns)]);
+        const secretsConfigurations = _.map(secrets, (secret) => KubernetesConfigurationConverter.secretToConfiguration(secret));
+        const configMapsConfigurations = _.map(configMaps, (configMap) => KubernetesConfigurationConverter.configMapToConfiguration(configMap));
+        return _.concat(configMapsConfigurations, secretsConfigurations);
+      })
+    );
+    return _.flatten(res);
+  }
+
+  get(namespace, name) {
+    if (name) {
+      return this.$async(this.getAsync, namespace, name);
+    }
+    return this.$async(this.getAllAsync, namespace);
+  }
+
+  /**
+   * CREATE
+   */
+  async createAsync(formValues) {
+    formValues.ConfigurationOwner = KubernetesCommonHelper.ownerToLabel(formValues.ConfigurationOwner);
+
+    if (formValues.Kind === KubernetesConfigurationKinds.CONFIGMAP) {
+      const configMap = KubernetesConfigMapConverter.configurationFormValuesToConfigMap(formValues);
+      await this.KubernetesConfigMapService.create(configMap);
+    } else {
+      const secret = KubernetesSecretConverter.configurationFormValuesToSecret(formValues);
+      await this.KubernetesSecretService.create(secret);
+    }
+  }
+
+  create(formValues) {
+    return this.$async(this.createAsync, formValues);
+  }
+
+  /**
+   * UPDATE
+   */
+  async updateAsync(formValues, configuration) {
+    if (formValues.Kind === KubernetesConfigurationKinds.CONFIGMAP) {
+      const configMap = KubernetesConfigMapConverter.configurationFormValuesToConfigMap(formValues);
+      configMap.ConfigurationOwner = configuration.ConfigurationOwner;
+      configMap.Labels = configuration.Labels;
+      await this.KubernetesConfigMapService.update(configMap);
+    } else {
+      const secret = KubernetesSecretConverter.configurationFormValuesToSecret(formValues);
+      secret.ConfigurationOwner = configuration.ConfigurationOwner;
+      secret.Labels = configuration.Labels;
+      await this.KubernetesSecretService.update(secret);
+    }
+  }
+
+  update(formValues, configuration) {
+    return this.$async(this.updateAsync, formValues, configuration);
+  }
+
+  /**
+   * DELETE
+   */
+  async deleteAsync(config) {
+    if (config.Kind == KubernetesConfigurationKinds.CONFIGMAP) {
+      await this.KubernetesConfigMapService.delete(config);
+    } else {
+      await this.KubernetesSecretService.delete(config);
+    }
+  }
+
+  delete(config) {
+    return this.$async(this.deleteAsync, config);
+  }
+}
+
+export default KubernetesConfigurationService;
+angular.module('portainer.kubernetes').service('KubernetesConfigurationService', KubernetesConfigurationService);
diff --git a/app/kubernetes/services/controllerRevisionService.js b/app/kubernetes/services/controllerRevisionService.js
new file mode 100644
index 0000000..eda1b37
--- /dev/null
+++ b/app/kubernetes/services/controllerRevisionService.js
@@ -0,0 +1,31 @@
+import angular from 'angular';
+import PortainerError from '@/portainer/error';
+
+class KubernetesControllerRevisionService {
+  /* @ngInject */
+  constructor($async, KubernetesControllerRevisions) {
+    this.$async = $async;
+    this.KubernetesControllerRevisions = KubernetesControllerRevisions;
+
+    this.getAllAsync = this.getAllAsync.bind(this);
+  }
+
+  /**
+   * GET
+   */
+  async getAllAsync(namespace) {
+    try {
+      const data = await this.KubernetesControllerRevisions(namespace).get().$promise;
+      return data.items;
+    } catch (err) {
+      throw new PortainerError('Unable to retrieve ControllerRevisions', err);
+    }
+  }
+
+  get(namespace) {
+    return this.$async(this.getAllAsync, namespace);
+  }
+}
+
+export default KubernetesControllerRevisionService;
+angular.module('portainer.kubernetes').service('KubernetesControllerRevisionService', KubernetesControllerRevisionService);
diff --git a/app/kubernetes/services/daemonSetService.js b/app/kubernetes/services/daemonSetService.js
new file mode 100644
index 0000000..5532729
--- /dev/null
+++ b/app/kubernetes/services/daemonSetService.js
@@ -0,0 +1,115 @@
+import angular from 'angular';
+import PortainerError from '@/portainer/error';
+import { KubernetesCommonParams } from '@/kubernetes/models/common/params';
+import KubernetesDaemonSetConverter from '@/kubernetes/converters/daemonSet';
+
+class KubernetesDaemonSetService {
+  /* @ngInject */
+  constructor($async, KubernetesDaemonSets) {
+    this.$async = $async;
+    this.KubernetesDaemonSets = KubernetesDaemonSets;
+
+    this.getAsync = this.getAsync.bind(this);
+    this.getAllAsync = this.getAllAsync.bind(this);
+    this.createAsync = this.createAsync.bind(this);
+    this.patchAsync = this.patchAsync.bind(this);
+    this.deleteAsync = this.deleteAsync.bind(this);
+  }
+
+  /**
+   * GET
+   */
+  async getAsync(namespace, name) {
+    try {
+      const params = new KubernetesCommonParams();
+      params.id = name;
+      const [raw, yaml] = await Promise.all([this.KubernetesDaemonSets(namespace).get(params).$promise, this.KubernetesDaemonSets(namespace).getYaml(params).$promise]);
+      const res = {
+        Raw: raw,
+        Yaml: yaml.data,
+      };
+      return res;
+    } catch (err) {
+      throw new PortainerError('Unable to retrieve DaemonSet', err);
+    }
+  }
+
+  async getAllAsync(namespace) {
+    try {
+      const data = await this.KubernetesDaemonSets(namespace).get().$promise;
+      return data.items;
+    } catch (err) {
+      throw new PortainerError('Unable to retrieve DaemonSets', err);
+    }
+  }
+
+  get(namespace, name) {
+    if (name) {
+      return this.$async(this.getAsync, namespace, name);
+    }
+    return this.$async(this.getAllAsync, namespace);
+  }
+
+  /**
+   * CREATE
+   */
+  async createAsync(daemonSet) {
+    try {
+      const params = {};
+      const payload = KubernetesDaemonSetConverter.createPayload(daemonSet);
+      const namespace = payload.metadata.namespace;
+      const data = await this.KubernetesDaemonSets(namespace).create(params, payload).$promise;
+      return data;
+    } catch (err) {
+      throw new PortainerError('Unable to create daemonset', err);
+    }
+  }
+
+  create(daemonSet) {
+    return this.$async(this.createAsync, daemonSet);
+  }
+
+  /**
+   * PATCH
+   */
+  async patchAsync(oldDaemonSet, newDaemonSet) {
+    try {
+      const params = new KubernetesCommonParams();
+      params.id = newDaemonSet.Name;
+      const namespace = newDaemonSet.Namespace;
+      const payload = KubernetesDaemonSetConverter.patchPayload(oldDaemonSet, newDaemonSet);
+      if (!payload.length) {
+        return;
+      }
+      const data = await this.KubernetesDaemonSets(namespace).patch(params, payload).$promise;
+      return data;
+    } catch (err) {
+      throw new PortainerError('Unable to patch daemonSet', err);
+    }
+  }
+
+  patch(oldDaemonSet, newDaemonSet) {
+    return this.$async(this.patchAsync, oldDaemonSet, newDaemonSet);
+  }
+
+  /**
+   * DELETE
+   */
+  async deleteAsync(daemonSet) {
+    try {
+      const params = new KubernetesCommonParams();
+      params.id = daemonSet.Name;
+      const namespace = daemonSet.Namespace;
+      await this.KubernetesDaemonSets(namespace).delete(params).$promise;
+    } catch (err) {
+      throw new PortainerError('Unable to remove daemonset', err);
+    }
+  }
+
+  delete(daemonSet) {
+    return this.$async(this.deleteAsync, daemonSet);
+  }
+}
+
+export default KubernetesDaemonSetService;
+angular.module('portainer.kubernetes').service('KubernetesDaemonSetService', KubernetesDaemonSetService);
diff --git a/app/kubernetes/services/deploymentService.js b/app/kubernetes/services/deploymentService.js
new file mode 100644
index 0000000..ee0ea68
--- /dev/null
+++ b/app/kubernetes/services/deploymentService.js
@@ -0,0 +1,115 @@
+import angular from 'angular';
+import PortainerError from '@/portainer/error';
+import { KubernetesCommonParams } from '@/kubernetes/models/common/params';
+import KubernetesDeploymentConverter from '@/kubernetes/converters/deployment';
+
+class KubernetesDeploymentService {
+  /* @ngInject */
+  constructor($async, KubernetesDeployments) {
+    this.$async = $async;
+    this.KubernetesDeployments = KubernetesDeployments;
+
+    this.getAsync = this.getAsync.bind(this);
+    this.getAllAsync = this.getAllAsync.bind(this);
+    this.createAsync = this.createAsync.bind(this);
+    this.patchAsync = this.patchAsync.bind(this);
+    this.deleteAsync = this.deleteAsync.bind(this);
+  }
+
+  /**
+   * GET
+   */
+  async getAsync(namespace, name) {
+    try {
+      const params = new KubernetesCommonParams();
+      params.id = name;
+      const [raw, yaml] = await Promise.all([this.KubernetesDeployments(namespace).get(params).$promise, this.KubernetesDeployments(namespace).getYaml(params).$promise]);
+      const res = {
+        Raw: raw,
+        Yaml: yaml.data,
+      };
+      return res;
+    } catch (err) {
+      throw new PortainerError('Unable to retrieve Deployment', err);
+    }
+  }
+
+  async getAllAsync(namespace) {
+    try {
+      const data = await this.KubernetesDeployments(namespace).get().$promise;
+      return data.items;
+    } catch (err) {
+      throw new PortainerError('Unable to retrieve Deployments', err);
+    }
+  }
+
+  get(namespace, name) {
+    if (name) {
+      return this.$async(this.getAsync, namespace, name);
+    }
+    return this.$async(this.getAllAsync, namespace);
+  }
+
+  /**
+   * CREATE
+   */
+  async createAsync(deployment) {
+    try {
+      const params = {};
+      const payload = KubernetesDeploymentConverter.createPayload(deployment);
+      const namespace = payload.metadata.namespace;
+      const data = await this.KubernetesDeployments(namespace).create(params, payload).$promise;
+      return data;
+    } catch (err) {
+      throw new PortainerError('Unable to create deployment', err);
+    }
+  }
+
+  create(deployment) {
+    return this.$async(this.createAsync, deployment);
+  }
+
+  /**
+   * PATCH
+   */
+  async patchAsync(oldDeployment, newDeployment) {
+    try {
+      const params = new KubernetesCommonParams();
+      params.id = newDeployment.Name;
+      const namespace = newDeployment.Namespace;
+      const payload = KubernetesDeploymentConverter.patchPayload(oldDeployment, newDeployment);
+      if (!payload.length) {
+        return;
+      }
+      const data = await this.KubernetesDeployments(namespace).patch(params, payload).$promise;
+      return data;
+    } catch (err) {
+      throw new PortainerError('Unable to patch deployment', err);
+    }
+  }
+
+  patch(oldDeployment, newDeployment) {
+    return this.$async(this.patchAsync, oldDeployment, newDeployment);
+  }
+
+  /**
+   * DELETE
+   */
+  async deleteAsync(deployment) {
+    try {
+      const params = new KubernetesCommonParams();
+      params.id = deployment.Name;
+      const namespace = deployment.Namespace;
+      await this.KubernetesDeployments(namespace).delete(params).$promise;
+    } catch (err) {
+      throw new PortainerError('Unable to remove deployment', err);
+    }
+  }
+
+  delete(deployment) {
+    return this.$async(this.deleteAsync, deployment);
+  }
+}
+
+export default KubernetesDeploymentService;
+angular.module('portainer.kubernetes').service('KubernetesDeploymentService', KubernetesDeploymentService);
diff --git a/app/kubernetes/services/eventService.js b/app/kubernetes/services/eventService.js
new file mode 100644
index 0000000..ac84c18
--- /dev/null
+++ b/app/kubernetes/services/eventService.js
@@ -0,0 +1,34 @@
+import _ from 'lodash-es';
+import angular from 'angular';
+import PortainerError from '@/portainer/error';
+import KubernetesEventConverter from '@/kubernetes/converters/event';
+
+class KubernetesEventService {
+  /* @ngInject */
+  constructor($async, KubernetesEvents) {
+    this.$async = $async;
+    this.KubernetesEvents = KubernetesEvents;
+
+    this.getAllAsync = this.getAllAsync.bind(this);
+  }
+
+  /**
+   * GET
+   */
+  async getAllAsync(namespace) {
+    try {
+      const data = await this.KubernetesEvents(namespace).get().$promise;
+      const res = _.map(data.items, (item) => KubernetesEventConverter.apiToEvent(item));
+      return res;
+    } catch (err) {
+      throw new PortainerError('Unable to retrieve events', err);
+    }
+  }
+
+  get(namespace) {
+    return this.$async(this.getAllAsync, namespace);
+  }
+}
+
+export default KubernetesEventService;
+angular.module('portainer.kubernetes').service('KubernetesEventService', KubernetesEventService);
diff --git a/app/kubernetes/services/healthService.js b/app/kubernetes/services/healthService.js
new file mode 100644
index 0000000..deaea4c
--- /dev/null
+++ b/app/kubernetes/services/healthService.js
@@ -0,0 +1,30 @@
+import angular from 'angular';
+import PortainerError from '@/portainer/error';
+
+class KubernetesHealthService {
+  /* @ngInject */
+  constructor($async, KubernetesHealth) {
+    this.$async = $async;
+    this.KubernetesHealth = KubernetesHealth;
+
+    this.pingAsync = this.pingAsync.bind(this);
+  }
+
+  /**
+   * PING
+   */
+  async pingAsync(endpointID) {
+    try {
+      return await this.KubernetesHealth.ping({ id: endpointID }).$promise;
+    } catch (err) {
+      throw new PortainerError('Unable to retrieve environment health', err);
+    }
+  }
+
+  ping(endpointID) {
+    return this.$async(this.pingAsync, endpointID);
+  }
+}
+
+export default KubernetesHealthService;
+angular.module('portainer.kubernetes').service('KubernetesHealthService', KubernetesHealthService);
diff --git a/app/kubernetes/services/namespaceService.js b/app/kubernetes/services/namespaceService.js
new file mode 100644
index 0000000..284b9ff
--- /dev/null
+++ b/app/kubernetes/services/namespaceService.js
@@ -0,0 +1,129 @@
+import angular from 'angular';
+import PortainerError from '@/portainer/error';
+import { KubernetesCommonParams } from '@/kubernetes/models/common/params';
+import KubernetesNamespaceConverter from '@/kubernetes/converters/namespace';
+import KubernetesNamespaceHelper from '@/kubernetes/helpers/namespaceHelper';
+import { updateNamespaces } from '@/kubernetes/store/namespace';
+
+class KubernetesNamespaceService {
+  /* @ngInject */
+  constructor($async, KubernetesNamespaces, Authentication, LocalStorage, $state) {
+    this.$async = $async;
+    this.$state = $state;
+    this.KubernetesNamespaces = KubernetesNamespaces;
+    this.LocalStorage = LocalStorage;
+    this.Authentication = Authentication;
+
+    this.getAsync = this.getAsync.bind(this);
+    this.getAllAsync = this.getAllAsync.bind(this);
+    this.createAsync = this.createAsync.bind(this);
+    this.deleteAsync = this.deleteAsync.bind(this);
+    this.getJSONAsync = this.getJSONAsync.bind(this);
+    this.updateFinalizeAsync = this.updateFinalizeAsync.bind(this);
+  }
+
+  /**
+   * GET
+   */
+  async getAsync(name) {
+    try {
+      const params = new KubernetesCommonParams();
+      params.id = name;
+      await this.KubernetesNamespaces().status(params).$promise;
+      const [raw, yaml] = await Promise.all([this.KubernetesNamespaces().get(params).$promise, this.KubernetesNamespaces().getYaml(params).$promise]);
+      const ns = KubernetesNamespaceConverter.apiToNamespace(raw, yaml);
+      updateNamespaces([ns]);
+      return ns;
+    } catch (err) {
+      throw new PortainerError('Unable to retrieve namespace', err);
+    }
+  }
+
+  /**
+   * GET namesspace in JSON format
+   */
+  async getJSONAsync(name) {
+    try {
+      const params = new KubernetesCommonParams();
+      params.id = name;
+      await this.KubernetesNamespaces().status(params).$promise;
+      return await this.KubernetesNamespaces().getJSON(params).$promise;
+    } catch (err) {
+      throw new PortainerError('Unable to retrieve namespace', err);
+    }
+  }
+
+  /**
+   * Update finalize
+   */
+  async updateFinalizeAsync(namespace) {
+    try {
+      return await this.KubernetesNamespaces().update({ id: namespace.metadata.name, action: 'finalize' }, namespace).$promise;
+    } catch (err) {
+      throw new PortainerError('Unable to update namespace', err);
+    }
+  }
+
+  async getAllAsync() {
+    try {
+      // get the list of all namespaces (RBAC allows users to see the list of namespaces)
+      const data = await this.KubernetesNamespaces().get().$promise;
+      // get the list of all namespaces with isAccessAllowed flags
+      const hasK8sAccessSystemNamespaces = this.Authentication.hasAuthorizations(['K8sAccessSystemNamespaces']);
+      const namespaces = data.items.filter((item) => !KubernetesNamespaceHelper.isSystemNamespace(item.metadata.name) || hasK8sAccessSystemNamespaces);
+      // parse the namespaces
+      const visibleNamespaces = namespaces.map((item) => KubernetesNamespaceConverter.apiToNamespace(item));
+      updateNamespaces(visibleNamespaces);
+      return visibleNamespaces;
+    } catch (err) {
+      throw new PortainerError('Unable to retrieve namespaces', err);
+    }
+  }
+
+  async get(name) {
+    if (name) {
+      return this.$async(this.getAsync, name);
+    }
+    const allowedNamespaces = await this.getAllAsync();
+    updateNamespaces(allowedNamespaces);
+    return allowedNamespaces;
+  }
+
+  /**
+   * CREATE
+   */
+  async createAsync(namespace) {
+    try {
+      const payload = KubernetesNamespaceConverter.createPayload(namespace);
+      const params = {};
+      const data = await this.KubernetesNamespaces().create(params, payload).$promise;
+      return data;
+    } catch (err) {
+      throw new PortainerError('Unable to create namespace', err);
+    }
+  }
+
+  create(namespace) {
+    return this.$async(this.createAsync, namespace);
+  }
+
+  /**
+   * DELETE
+   */
+  async deleteAsync(namespace) {
+    try {
+      const params = new KubernetesCommonParams();
+      params.id = namespace.Name;
+      await this.KubernetesNamespaces().delete(params).$promise;
+    } catch (err) {
+      throw new PortainerError('Unable to delete namespace', err);
+    }
+  }
+
+  delete(namespace) {
+    return this.$async(this.deleteAsync, namespace);
+  }
+}
+
+export default KubernetesNamespaceService;
+angular.module('portainer.kubernetes').service('KubernetesNamespaceService', KubernetesNamespaceService);
diff --git a/app/kubernetes/services/nodesLimitsService.js b/app/kubernetes/services/nodesLimitsService.js
new file mode 100644
index 0000000..110bb2c
--- /dev/null
+++ b/app/kubernetes/services/nodesLimitsService.js
@@ -0,0 +1,25 @@
+import angular from 'angular';
+import PortainerError from '@/portainer/error';
+import { KubernetesNodesLimits } from '@/kubernetes/models/nodes-limits/models';
+
+class KubernetesNodesLimitsService {
+  /* @ngInject */
+  constructor(KubernetesNodesLimits) {
+    this.KubernetesNodesLimits = KubernetesNodesLimits;
+  }
+
+  /**
+   * GET
+   */
+  async get() {
+    try {
+      const nodesLimits = await this.KubernetesNodesLimits.get().$promise;
+      return new KubernetesNodesLimits(nodesLimits.data);
+    } catch (err) {
+      throw new PortainerError('Unable to retrieve nodes limits', err);
+    }
+  }
+}
+
+export default KubernetesNodesLimitsService;
+angular.module('portainer.kubernetes').service('KubernetesNodesLimitsService', KubernetesNodesLimitsService);
diff --git a/app/kubernetes/services/persistentVolumeClaimService.js b/app/kubernetes/services/persistentVolumeClaimService.js
new file mode 100644
index 0000000..8dcf6fb
--- /dev/null
+++ b/app/kubernetes/services/persistentVolumeClaimService.js
@@ -0,0 +1,114 @@
+import angular from 'angular';
+import _ from 'lodash-es';
+import PortainerError from '@/portainer/error';
+import KubernetesPersistentVolumeClaimConverter from '@/kubernetes/converters/persistentVolumeClaim';
+import { KubernetesCommonParams } from '@/kubernetes/models/common/params';
+
+class KubernetesPersistentVolumeClaimService {
+  /* @ngInject */
+  constructor($async, KubernetesPersistentVolumeClaims) {
+    this.$async = $async;
+    this.KubernetesPersistentVolumeClaims = KubernetesPersistentVolumeClaims;
+
+    this.getAsync = this.getAsync.bind(this);
+    this.getAllAsync = this.getAllAsync.bind(this);
+    this.createAsync = this.createAsync.bind(this);
+    this.patchAsync = this.patchAsync.bind(this);
+    this.deleteAsync = this.deleteAsync.bind(this);
+  }
+
+  async getAsync(namespace, storageClasses, name) {
+    try {
+      const params = new KubernetesCommonParams();
+      params.id = name;
+      const [raw, yaml] = await Promise.all([
+        this.KubernetesPersistentVolumeClaims(namespace).get(params).$promise,
+        this.KubernetesPersistentVolumeClaims(namespace).getYaml(params).$promise,
+      ]);
+
+      return KubernetesPersistentVolumeClaimConverter.apiToPersistentVolumeClaim(raw, storageClasses, yaml);
+    } catch (err) {
+      throw new PortainerError('Unable to retrieve persistent volume claim', err);
+    }
+  }
+
+  async getAllAsync(namespace, storageClasses) {
+    try {
+      const data = await this.KubernetesPersistentVolumeClaims(namespace).get().$promise;
+
+      return _.map(data.items, (item) => KubernetesPersistentVolumeClaimConverter.apiToPersistentVolumeClaim(item, storageClasses));
+    } catch (err) {
+      throw new PortainerError('Unable to retrieve persistent volume claims', err);
+    }
+  }
+
+  get(namespace, storageClasses, name) {
+    if (name) {
+      return this.$async(this.getAsync, namespace, storageClasses, name);
+    }
+    return this.$async(this.getAllAsync, namespace, storageClasses);
+  }
+
+  /**
+   * CREATE
+   */
+  async createAsync(claim) {
+    try {
+      const params = {};
+      const payload = KubernetesPersistentVolumeClaimConverter.createPayload(claim);
+      const namespace = payload.metadata.namespace;
+      const data = await this.KubernetesPersistentVolumeClaims(namespace).create(params, payload).$promise;
+      return data;
+    } catch (err) {
+      throw new PortainerError('Unable to create persistent volume claim', err);
+    }
+  }
+
+  create(claim) {
+    return this.$async(this.createAsync, claim);
+  }
+
+  /**
+   * PATCH
+   */
+  async patchAsync(oldPVC, newPVC) {
+    try {
+      const params = new KubernetesCommonParams();
+      params.id = newPVC.Name;
+      const namespace = newPVC.Namespace;
+      const payload = KubernetesPersistentVolumeClaimConverter.patchPayload(oldPVC, newPVC);
+      if (!payload.length) {
+        return;
+      }
+      const data = await this.KubernetesPersistentVolumeClaims(namespace).patch(params, payload).$promise;
+      return data;
+    } catch (err) {
+      throw new PortainerError('Unable to patch persistent volume claim', err);
+    }
+  }
+
+  patch(oldPVC, newPVC) {
+    return this.$async(this.patchAsync, oldPVC, newPVC);
+  }
+
+  /**
+   * DELETE
+   */
+  async deleteAsync(pvc) {
+    try {
+      const params = new KubernetesCommonParams();
+      params.id = pvc.Name;
+      const namespace = pvc.Namespace;
+      await this.KubernetesPersistentVolumeClaims(namespace).delete(params).$promise;
+    } catch (err) {
+      throw new PortainerError('Unable to delete persistent volume claim', err);
+    }
+  }
+
+  delete(pvc) {
+    return this.$async(this.deleteAsync, pvc);
+  }
+}
+
+export default KubernetesPersistentVolumeClaimService;
+angular.module('portainer.kubernetes').service('KubernetesPersistentVolumeClaimService', KubernetesPersistentVolumeClaimService);
diff --git a/app/kubernetes/services/resourcePoolService.js b/app/kubernetes/services/resourcePoolService.js
new file mode 100644
index 0000000..909bed7
--- /dev/null
+++ b/app/kubernetes/services/resourcePoolService.js
@@ -0,0 +1,143 @@
+import _ from 'lodash-es';
+
+import angular from 'angular';
+import KubernetesResourcePoolConverter from '@/kubernetes/converters/resourcePool';
+import KubernetesResourceQuotaHelper from '@/kubernetes/helpers/resourceQuotaHelper';
+import { getNamespaces } from '@/react/kubernetes/namespaces/queries/useNamespacesQuery';
+
+/* @ngInject */
+export function KubernetesResourcePoolService(
+  $async,
+  EndpointService,
+  KubernetesNamespaceService,
+  KubernetesResourceQuotaService,
+  KubernetesIngressService,
+  KubernetesPortainerNamespaces,
+  EndpointProvider
+) {
+  return {
+    get,
+    create,
+    patch,
+    delete: _delete,
+    toggleSystem,
+  };
+
+  // getting quota isn't a costly operation for one namespace, so we can get it by default
+  async function getOne(name, { getQuota = true }) {
+    const namespace = await KubernetesNamespaceService.get(name);
+    const pool = KubernetesResourcePoolConverter.apiToResourcePool(namespace);
+    if (getQuota) {
+      const [quotaAttempt] = await Promise.allSettled([KubernetesResourceQuotaService.get(name, KubernetesResourceQuotaHelper.generateResourceQuotaName(name))]);
+      if (quotaAttempt.status === 'fulfilled') {
+        pool.Quota = quotaAttempt.value;
+        pool.Yaml += '---\n' + quotaAttempt.value.Yaml;
+      }
+    }
+    return pool;
+  }
+
+  // getting the quota for all namespaces is costly by default, so disable getting it by default
+  async function getAll({ getQuota = false }) {
+    const namespaces = await getNamespaces(EndpointProvider.endpointID());
+    // there is a lot of downstream logic using the angular namespace type with a '.Status' field (not '.Status.phase'), so format the status here to match this logic
+    const namespacesFormattedStatus = namespaces.map((namespace) => ({
+      ...namespace,
+      Status: namespace.Status.phase,
+    }));
+    const pools = await Promise.all(
+      _.map(namespacesFormattedStatus, async (namespace) => {
+        const name = namespace.Name;
+        const pool = KubernetesResourcePoolConverter.apiToResourcePool(namespace);
+        if (getQuota) {
+          const [quotaAttempt] = await Promise.allSettled([KubernetesResourceQuotaService.get(name, KubernetesResourceQuotaHelper.generateResourceQuotaName(name))]);
+          if (quotaAttempt.status === 'fulfilled') {
+            pool.Quota = quotaAttempt.value;
+            pool.Yaml += '---\n' + quotaAttempt.value.Yaml;
+          }
+        }
+        return pool;
+      })
+    );
+    return pools;
+  }
+
+  function get(name, options = {}) {
+    if (name) {
+      return $async(getOne, name, options);
+    }
+    return $async(getAll, options);
+  }
+
+  function create(formValues) {
+    return $async(async () => {
+      const [namespace, quota, ingresses, registries] = KubernetesResourcePoolConverter.formValuesToResourcePool(formValues);
+      await KubernetesNamespaceService.create(namespace);
+
+      if (quota) {
+        await KubernetesResourceQuotaService.create(quota);
+      }
+      const ingressPromises = _.map(ingresses, (i) => KubernetesIngressService.create(i));
+      await Promise.all(ingressPromises);
+
+      const endpointId = formValues.EndpointId;
+      const registriesPromises = _.map(registries, (r) => EndpointService.updateRegistryAccess(endpointId, r.Id, r.RegistryAccesses[endpointId]));
+      await Promise.all(registriesPromises);
+    });
+  }
+
+  function patch(oldFormValues, newFormValues) {
+    return $async(async () => {
+      const [, oldQuota, oldIngresses, oldRegistries] = KubernetesResourcePoolConverter.formValuesToResourcePool(oldFormValues);
+      const [, newQuota, newIngresses, newRegistries] = KubernetesResourcePoolConverter.formValuesToResourcePool(newFormValues);
+
+      if (oldQuota && newQuota) {
+        await KubernetesResourceQuotaService.patch(oldQuota, newQuota);
+      } else if (!oldQuota && newQuota) {
+        await KubernetesResourceQuotaService.create(newQuota);
+      } else if (oldQuota && !newQuota) {
+        await KubernetesResourceQuotaService.delete(oldQuota);
+      }
+
+      const create = _.filter(newIngresses, (ing) => !_.find(oldIngresses, { Name: ing.Name }));
+      const del = _.filter(oldIngresses, (ing) => !_.find(newIngresses, { Name: ing.Name }));
+      const patch = _.without(newIngresses, ...create);
+
+      const createPromises = _.map(create, (i) => KubernetesIngressService.create(i));
+      const delPromises = _.map(del, (i) => KubernetesIngressService.delete(i.Namespace, i.Name));
+      const patchPromises = _.map(patch, (ing) => {
+        const old = _.find(oldIngresses, { Name: ing.Name });
+        ing.Paths = angular.copy(old.Paths);
+        ing.PreviousHost = old.Host;
+        return KubernetesIngressService.patch(old, ing);
+      });
+
+      const promises = _.flatten([createPromises, delPromises, patchPromises]);
+      await Promise.all(promises);
+
+      const endpointId = newFormValues.EndpointId;
+      const keptRegistries = _.intersectionBy(oldRegistries, newRegistries, 'Id');
+      const removedRegistries = _.without(oldRegistries, ...keptRegistries);
+
+      const newRegistriesPromises = _.map(newRegistries, (r) => EndpointService.updateRegistryAccess(endpointId, r.Id, r.RegistryAccesses[endpointId]));
+      const removedRegistriesPromises = _.map(removedRegistries, (r) => {
+        _.pull(r.RegistryAccesses[endpointId].Namespaces, newFormValues.Name);
+        return EndpointService.updateRegistryAccess(endpointId, r.Id, r.RegistryAccesses[endpointId]);
+      });
+
+      await Promise.all(_.concat(newRegistriesPromises, removedRegistriesPromises));
+    });
+  }
+
+  function _delete(pool) {
+    return $async(async () => {
+      await KubernetesNamespaceService.delete(pool.Namespace);
+    });
+  }
+
+  function toggleSystem(endpointId, namespaceName, system) {
+    return KubernetesPortainerNamespaces.toggleSystem({ namespaceName, endpointId }, { system }).$promise;
+  }
+}
+
+angular.module('portainer.kubernetes').service('KubernetesResourcePoolService', KubernetesResourcePoolService);
diff --git a/app/kubernetes/services/resourceQuotaService.js b/app/kubernetes/services/resourceQuotaService.js
new file mode 100644
index 0000000..019c29d
--- /dev/null
+++ b/app/kubernetes/services/resourceQuotaService.js
@@ -0,0 +1,89 @@
+import _ from 'lodash-es';
+
+import angular from 'angular';
+import PortainerError from '@/portainer/error';
+import { KubernetesCommonParams } from '@/kubernetes/models/common/params';
+import KubernetesResourceQuotaConverter from '@/kubernetes/converters/resourceQuota';
+
+/* @ngInject */
+export function KubernetesResourceQuotaService($async, KubernetesResourceQuotas) {
+  return {
+    get,
+    create,
+    patch,
+    delete: _delete,
+  };
+
+  async function getOne(namespace, name) {
+    try {
+      const params = new KubernetesCommonParams();
+      params.id = name;
+      const [raw, yaml] = await Promise.all([KubernetesResourceQuotas(namespace).get(params).$promise, KubernetesResourceQuotas(namespace).getYaml(params).$promise]);
+      return KubernetesResourceQuotaConverter.apiToResourceQuota(raw, yaml);
+    } catch (err) {
+      throw new PortainerError('Unable to retrieve resource quota', err);
+    }
+  }
+
+  async function getAll(namespace) {
+    try {
+      const data = await KubernetesResourceQuotas(namespace).get().$promise;
+      return _.map(data.items, (item) => KubernetesResourceQuotaConverter.apiToResourceQuota(item));
+    } catch (err) {
+      throw new PortainerError('Unable to retrieve resource quotas', err);
+    }
+  }
+
+  function get(namespace, name) {
+    if (name) {
+      return $async(getOne, namespace, name);
+    }
+    return $async(getAll, namespace);
+  }
+
+  function create(quota) {
+    return $async(async () => {
+      try {
+        const payload = KubernetesResourceQuotaConverter.createPayload(quota);
+        const namespace = payload.metadata.namespace;
+        const params = {};
+        const data = await KubernetesResourceQuotas(namespace).create(params, payload).$promise;
+        return KubernetesResourceQuotaConverter.apiToResourceQuota(data);
+      } catch (err) {
+        throw new PortainerError('Unable to create quota', err);
+      }
+    });
+  }
+
+  function patch(oldQuota, newQuota) {
+    return $async(async () => {
+      try {
+        const params = new KubernetesCommonParams();
+        params.id = newQuota.Name;
+        const namespace = newQuota.Namespace;
+        const payload = KubernetesResourceQuotaConverter.patchPayload(oldQuota, newQuota);
+        if (!payload.length) {
+          return;
+        }
+        const data = await KubernetesResourceQuotas(namespace).patch(params, payload).$promise;
+        return data;
+      } catch (err) {
+        throw new PortainerError('Unable to update resource quota', err);
+      }
+    });
+  }
+
+  function _delete(quota) {
+    return $async(async () => {
+      try {
+        const params = new KubernetesCommonParams();
+        params.id = quota.Name;
+        await KubernetesResourceQuotas(quota.Namespace).delete(params).$promise;
+      } catch (err) {
+        throw new PortainerError('Unable to delete quota', err);
+      }
+    });
+  }
+}
+
+angular.module('portainer.kubernetes').service('KubernetesResourceQuotaService', KubernetesResourceQuotaService);
diff --git a/app/kubernetes/services/secretService.js b/app/kubernetes/services/secretService.js
new file mode 100644
index 0000000..7283142
--- /dev/null
+++ b/app/kubernetes/services/secretService.js
@@ -0,0 +1,110 @@
+import angular from 'angular';
+import _ from 'lodash-es';
+import PortainerError from '@/portainer/error';
+import KubernetesSecretConverter from '@/kubernetes/converters/secret';
+import { KubernetesCommonParams } from '@/kubernetes/models/common/params';
+
+class KubernetesSecretService {
+  /* @ngInject */
+  constructor($async, KubernetesSecrets) {
+    this.$async = $async;
+    this.KubernetesSecrets = KubernetesSecrets;
+
+    this.getAsync = this.getAsync.bind(this);
+    this.getAllAsync = this.getAllAsync.bind(this);
+    this.createAsync = this.createAsync.bind(this);
+    this.updateAsync = this.updateAsync.bind(this);
+    this.deleteAsync = this.deleteAsync.bind(this);
+  }
+
+  /**
+   * GET
+   */
+  async getAsync(namespace, name) {
+    try {
+      const params = new KubernetesCommonParams();
+      params.id = name;
+      const [raw, yaml] = await Promise.all([this.KubernetesSecrets(namespace).get(params).$promise, this.KubernetesSecrets(namespace).getYaml(params).$promise]);
+      const secret = KubernetesSecretConverter.apiToSecret(raw, yaml);
+      return secret;
+    } catch (err) {
+      throw new PortainerError('Unable to retrieve secret', err);
+    }
+  }
+
+  async getAllAsync(namespace) {
+    try {
+      const data = await this.KubernetesSecrets(namespace).get().$promise;
+      return _.map(data.items, (item) => KubernetesSecretConverter.apiToSecret(item));
+    } catch (err) {
+      throw new PortainerError('Unable to retrieve secrets', err);
+    }
+  }
+
+  get(namespace, name) {
+    if (name) {
+      return this.$async(this.getAsync, namespace, name);
+    }
+    return this.$async(this.getAllAsync, namespace);
+  }
+
+  /**
+   * CREATE
+   */
+  async createAsync(secret) {
+    try {
+      const payload = KubernetesSecretConverter.createPayload(secret);
+      const namespace = payload.metadata.namespace;
+      const params = {};
+      const data = await this.KubernetesSecrets(namespace).create(params, payload).$promise;
+      return data;
+    } catch (err) {
+      throw new PortainerError('Unable to create secret', err);
+    }
+  }
+
+  create(secret) {
+    return this.$async(this.createAsync, secret);
+  }
+
+  /**
+   * UPDATE
+   */
+  async updateAsync(secret) {
+    try {
+      const payload = KubernetesSecretConverter.updatePayload(secret);
+      const params = new KubernetesCommonParams();
+      params.id = payload.metadata.name;
+      const namespace = payload.metadata.namespace;
+      const data = await this.KubernetesSecrets(namespace).update(params, payload).$promise;
+      return KubernetesSecretConverter.apiToSecret(data);
+    } catch (err) {
+      throw new PortainerError('Unable to update secret', err);
+    }
+  }
+
+  update(secret) {
+    return this.$async(this.updateAsync, secret);
+  }
+
+  /**
+   * DELETE
+   */
+  async deleteAsync(secret) {
+    try {
+      const params = new KubernetesCommonParams();
+      params.id = secret.Name;
+      const namespace = secret.Namespace;
+      await this.KubernetesSecrets(namespace).delete(params).$promise;
+    } catch (err) {
+      throw new PortainerError('Unable to delete secret', err);
+    }
+  }
+
+  delete(secret) {
+    return this.$async(this.deleteAsync, secret);
+  }
+}
+
+export default KubernetesSecretService;
+angular.module('portainer.kubernetes').service('KubernetesSecretService', KubernetesSecretService);
diff --git a/app/kubernetes/services/serviceService.js b/app/kubernetes/services/serviceService.js
new file mode 100644
index 0000000..297380d
--- /dev/null
+++ b/app/kubernetes/services/serviceService.js
@@ -0,0 +1,154 @@
+import angular from 'angular';
+import PortainerError from '@/portainer/error';
+import { KubernetesCommonParams } from '@/kubernetes/models/common/params';
+import KubernetesServiceConverter from '@/kubernetes/converters/service';
+
+class KubernetesServiceService {
+  /* @ngInject */
+  constructor($async, KubernetesServices) {
+    this.$async = $async;
+    this.KubernetesServices = KubernetesServices;
+
+    this.getAsync = this.getAsync.bind(this);
+    this.getAllAsync = this.getAllAsync.bind(this);
+    this.createAsync = this.createAsync.bind(this);
+    this.patchAsync = this.patchAsync.bind(this);
+    this.deleteAsync = this.deleteAsync.bind(this);
+    this.deleteSingleAsync = this.deleteSingleAsync.bind(this);
+    this.deleteAllAsync = this.deleteAllAsync.bind(this);
+  }
+
+  /**
+   * GET
+   */
+  async getAsync(namespace, name) {
+    try {
+      const params = new KubernetesCommonParams();
+      params.id = name;
+      const [raw, yaml] = await Promise.all([this.KubernetesServices(namespace).get(params).$promise, this.KubernetesServices(namespace).getYaml(params).$promise]);
+      const res = {
+        Raw: raw,
+        Yaml: yaml.data,
+      };
+      return res;
+    } catch (err) {
+      throw new PortainerError('Unable to retrieve service', err);
+    }
+  }
+
+  async getAllAsync(namespace) {
+    try {
+      const data = await this.KubernetesServices(namespace).get().$promise;
+      return data.items;
+    } catch (err) {
+      throw new PortainerError('Unable to retrieve services', err);
+    }
+  }
+
+  get(namespace, name) {
+    if (name) {
+      return this.$async(this.getAsync, namespace, name);
+    }
+    return this.$async(this.getAllAsync, namespace);
+  }
+
+  /**
+   * CREATE
+   */
+  async createAsync(service) {
+    try {
+      const params = {};
+      const payload = KubernetesServiceConverter.createPayload(service);
+      const namespace = payload.metadata.namespace;
+      const data = await this.KubernetesServices(namespace).create(params, payload).$promise;
+      return data;
+    } catch (err) {
+      throw new PortainerError('Unable to create service', err);
+    }
+  }
+
+  create(service) {
+    return this.$async(this.createAsync, service);
+  }
+
+  /**
+   * PATCH
+   */
+  async patchAsync(oldService, newService) {
+    try {
+      const params = new KubernetesCommonParams();
+      params.id = newService.Name;
+      const namespace = newService.Namespace;
+      const payload = KubernetesServiceConverter.patchPayload(oldService, newService);
+      if (!payload.length) {
+        return;
+      }
+      const data = await this.KubernetesServices(namespace).patch(params, payload).$promise;
+      return data;
+    } catch (err) {
+      throw new PortainerError('Unable to patch service', err);
+    }
+  }
+
+  patch(oldService, newService) {
+    return this.$async(this.patchAsync, oldService, newService);
+  }
+
+  /**
+   * DELETE
+   */
+  async deleteAsync(services) {
+    services.forEach(async (service) => {
+      try {
+        const params = new KubernetesCommonParams();
+        params.id = (service.metadata && service.metadata.name) || service.Name;
+        const namespace = (service.metadata && service.metadata.namespace) || service.Namespace;
+        await this.KubernetesServices(namespace).delete(params).$promise;
+      } catch (err) {
+        // eslint-disable-next-line no-console
+        console.error('unable to remove service', err);
+      }
+    });
+  }
+
+  delete(services) {
+    return this.$async(this.deleteAsync, services);
+  }
+
+  async deleteAllAsync(formValuesServices) {
+    formValuesServices.forEach(async (service) => {
+      try {
+        const params = new KubernetesCommonParams();
+        params.id = service.Name;
+        const namespace = service.Namespace;
+        await this.KubernetesServices(namespace).delete(params).$promise;
+      } catch (err) {
+        // eslint-disable-next-line no-console
+        console.error('unable to remove service', err);
+      }
+    });
+  }
+
+  deleteAll(formValuesServices) {
+    return this.$async(this.deleteAllAsync, formValuesServices);
+  }
+
+  async deleteSingleAsync(service) {
+    try {
+      const params = new KubernetesCommonParams();
+      params.id = service.Name;
+      const namespace = service.Namespace;
+      await this.KubernetesServices(namespace).delete(params).$promise;
+    } catch (err) {
+      // eslint-disable-next-line no-console
+      console.error('unable to remove service', err);
+    }
+  }
+
+  deleteSingle(service) {
+    return this.$async(this.deleteSingleAsync, service);
+  }
+}
+
+export default KubernetesServiceService;
+angular.module('portainer.kubernetes').service('KubernetesServiceService', KubernetesServiceService);
diff --git a/app/kubernetes/services/stackService.js b/app/kubernetes/services/stackService.js
new file mode 100644
index 0000000..de0e6a6
--- /dev/null
+++ b/app/kubernetes/services/stackService.js
@@ -0,0 +1,28 @@
+import _ from 'lodash-es';
+import angular from 'angular';
+
+class KubernetesStackService {
+  /* @ngInject */
+  constructor($async, KubernetesApplicationService) {
+    this.$async = $async;
+    this.KubernetesApplicationService = KubernetesApplicationService;
+
+    this.getAllAsync = this.getAllAsync.bind(this);
+  }
+
+  /**
+   * GET
+   */
+  async getAllAsync(namespace) {
+    const applications = await this.KubernetesApplicationService.get(namespace);
+    const stacks = _.map(applications, (item) => item.StackName);
+    return _.uniq(_.without(stacks, '-', ''));
+  }
+
+  get(namespace) {
+    return this.$async(this.getAllAsync, namespace);
+  }
+}
+
+export default KubernetesStackService;
+angular.module('portainer.kubernetes').service('KubernetesStackService', KubernetesStackService);
diff --git a/app/kubernetes/services/statefulSetService.js b/app/kubernetes/services/statefulSetService.js
new file mode 100644
index 0000000..197929d
--- /dev/null
+++ b/app/kubernetes/services/statefulSetService.js
@@ -0,0 +1,127 @@
+import angular from 'angular';
+import PortainerError from '@/portainer/error';
+import { KubernetesCommonParams } from '@/kubernetes/models/common/params';
+import KubernetesStatefulSetConverter from '@/kubernetes/converters/statefulSet';
+
+class KubernetesStatefulSetService {
+  /* @ngInject */
+  constructor($async, KubernetesStatefulSets, KubernetesServiceService) {
+    this.$async = $async;
+    this.KubernetesStatefulSets = KubernetesStatefulSets;
+    this.KubernetesServiceService = KubernetesServiceService;
+
+    this.getAsync = this.getAsync.bind(this);
+    this.getAllAsync = this.getAllAsync.bind(this);
+    this.createAsync = this.createAsync.bind(this);
+    this.patchAsync = this.patchAsync.bind(this);
+    this.deleteAsync = this.deleteAsync.bind(this);
+  }
+
+  /**
+   * GET
+   */
+  async getAsync(namespace, name) {
+    try {
+      const params = new KubernetesCommonParams();
+      params.id = name;
+      const [raw, yaml] = await Promise.all([this.KubernetesStatefulSets(namespace).get(params).$promise, this.KubernetesStatefulSets(namespace).getYaml(params).$promise]);
+      const res = {
+        Raw: raw,
+        Yaml: yaml.data,
+      };
+      const headlessServiceName = raw.spec.serviceName;
+      if (headlessServiceName) {
+        try {
+          const headlessService = await this.KubernetesServiceService.get(namespace, headlessServiceName);
+          res.Yaml += '---\n' + headlessService.Yaml;
+        } catch (error) {
+          // if has error means headless service does not exist
+          // skip error as we don't care in this case
+        }
+      }
+      return res;
+    } catch (err) {
+      throw new PortainerError('Unable to retrieve StatefulSet', err);
+    }
+  }
+
+  async getAllAsync(namespace) {
+    try {
+      const data = await this.KubernetesStatefulSets(namespace).get().$promise;
+      return data.items;
+    } catch (err) {
+      throw new PortainerError('Unable to retrieve StatefulSets', err);
+    }
+  }
+
+  get(namespace, name) {
+    if (name) {
+      return this.$async(this.getAsync, namespace, name);
+    }
+    return this.$async(this.getAllAsync, namespace);
+  }
+
+  /**
+   * CREATE
+   */
+  async createAsync(statefulSet) {
+    try {
+      const params = {};
+      const payload = KubernetesStatefulSetConverter.createPayload(statefulSet);
+      const namespace = payload.metadata.namespace;
+      const data = await this.KubernetesStatefulSets(namespace).create(params, payload).$promise;
+      return data;
+    } catch (err) {
+      throw new PortainerError('Unable to create statefulSet', err);
+    }
+  }
+
+  create(statefulSet) {
+    return this.$async(this.createAsync, statefulSet);
+  }
+
+  /**
+   * PATCH
+   */
+  async patchAsync(oldStatefulSet, newStatefulSet) {
+    try {
+      const params = new KubernetesCommonParams();
+      params.id = newStatefulSet.Name;
+      const namespace = newStatefulSet.Namespace;
+      const payload = KubernetesStatefulSetConverter.patchPayload(oldStatefulSet, newStatefulSet);
+      if (!payload.length) {
+        return;
+      }
+
+      const data = await this.KubernetesStatefulSets(namespace).patch(params, payload).$promise;
+      return data;
+    } catch (err) {
+      throw new PortainerError('Unable to patch statefulSet', err);
+    }
+  }
+
+  patch(oldStatefulSet, newStatefulSet) {
+    return this.$async(this.patchAsync, oldStatefulSet, newStatefulSet);
+  }
+
+  /**
+   * DELETE
+   */
+  async deleteAsync(statefulSet) {
+    try {
+      const params = new KubernetesCommonParams();
+      params.id = statefulSet.Name;
+      const namespace = statefulSet.Namespace;
+      await this.KubernetesStatefulSets(namespace).delete(params).$promise;
+    } catch (err) {
+      throw new PortainerError('Unable to remove statefulSet', err);
+    }
+  }
+
+  delete(statefulSet) {
+    return this.$async(this.deleteAsync, statefulSet);
+  }
+}
+
+export default KubernetesStatefulSetService;
+angular.module('portainer.kubernetes').service('KubernetesStatefulSetService', KubernetesStatefulSetService);
diff --git a/app/kubernetes/services/storageService.js b/app/kubernetes/services/storageService.js
new file mode 100644
index 0000000..312f397
--- /dev/null
+++ b/app/kubernetes/services/storageService.js
@@ -0,0 +1,58 @@
+import angular from 'angular';
+import _ from 'lodash-es';
+import PortainerError from '@/portainer/error';
+import KubernetesStorageClassConverter from '@/kubernetes/converters/storageClass';
+import { KubernetesCommonParams } from '@/kubernetes/models/common/params';
+
+class KubernetesStorageService {
+  /* @ngInject */
+  constructor($async, KubernetesStorage) {
+    this.$async = $async;
+    this.KubernetesStorage = KubernetesStorage;
+
+    this.getAsync = this.getAsync.bind(this);
+    this.patchAsync = this.patchAsync.bind(this);
+  }
+
+  /**
+   * GET
+   */
+  async getAsync(endpointId) {
+    try {
+      const params = {
+        endpointId: endpointId,
+      };
+      const classes = await this.KubernetesStorage().get(params).$promise;
+      const res = _.map(classes.items, (item) => KubernetesStorageClassConverter.apiToStorageClass(item));
+      return res;
+    } catch (err) {
+      throw new PortainerError('Unable to retrieve storage classes', err);
+    }
+  }
+
+  get(endpointId) {
+    return this.$async(this.getAsync, endpointId);
+  }
+
+  /**
+   * PATCH
+   */
+  async patchAsync(endpointId, oldStorageClass, newStorageClass) {
+    try {
+      const params = new KubernetesCommonParams();
+      params.id = newStorageClass.Name;
+      params.endpointId = endpointId;
+      const payload = KubernetesStorageClassConverter.patchPayload(oldStorageClass, newStorageClass);
+      await this.KubernetesStorage().patch(params, payload).$promise;
+    } catch (err) {
+      throw new PortainerError('Unable to patch storage class', err);
+    }
+  }
+
+  patch(endpointId, oldStorageClass, newStorageClass) {
+    return this.$async(this.patchAsync, endpointId, oldStorageClass, newStorageClass);
+  }
+}
+
+export default KubernetesStorageService;
+angular.module('portainer.kubernetes').service('KubernetesStorageService', KubernetesStorageService);
diff --git a/app/kubernetes/services/volumeService.js b/app/kubernetes/services/volumeService.js
new file mode 100644
index 0000000..7b9bf0d
--- /dev/null
+++ b/app/kubernetes/services/volumeService.js
@@ -0,0 +1,59 @@
+import angular from 'angular';
+import _ from 'lodash-es';
+
+import KubernetesVolumeConverter from '@/kubernetes/converters/volume';
+
+class KubernetesVolumeService {
+  /* @ngInject */
+  constructor($async, KubernetesResourcePoolService, KubernetesApplicationService, KubernetesPersistentVolumeClaimService) {
+    this.$async = $async;
+    this.KubernetesResourcePoolService = KubernetesResourcePoolService;
+    this.KubernetesApplicationService = KubernetesApplicationService;
+    this.KubernetesPersistentVolumeClaimService = KubernetesPersistentVolumeClaimService;
+
+    this.getAsync = this.getAsync.bind(this);
+    this.getAllAsync = this.getAllAsync.bind(this);
+    this.deleteAsync = this.deleteAsync.bind(this);
+  }
+
+  /**
+   * GET
+   */
+  async getAsync(namespace, storageClasses, name) {
+    const [pvc, pool] = await Promise.all([this.KubernetesPersistentVolumeClaimService.get(namespace, storageClasses, name), this.KubernetesResourcePoolService.get(namespace)]);
+    return KubernetesVolumeConverter.pvcToVolume(pvc, pool);
+  }
+
+  async getAllAsync(namespace, storageClasses) {
+    const data = await this.KubernetesResourcePoolService.get(namespace);
+    const pools = data instanceof Array ? data : [data];
+    const res = await Promise.all(
+      _.map(pools, async (pool) => {
+        const pvcs = await this.KubernetesPersistentVolumeClaimService.get(pool.Namespace.Name, storageClasses);
+        return _.map(pvcs, (pvc) => KubernetesVolumeConverter.pvcToVolume(pvc, pool));
+      })
+    );
+    return _.flatten(res);
+  }
+
+  get(namespace, storageClasses, name) {
+    if (name) {
+      return this.$async(this.getAsync, namespace, storageClasses, name);
+    }
+    return this.$async(this.getAllAsync, namespace, storageClasses);
+  }
+
+  /**
+   * DELETE
+   */
+  async deleteAsync(volume) {
+    await this.KubernetesPersistentVolumeClaimService.delete(volume.PersistentVolumeClaim);
+  }
+
+  delete(volume) {
+    return this.$async(this.deleteAsync, volume);
+  }
+}
+
+export default KubernetesVolumeService;
+angular.module('portainer.kubernetes').service('KubernetesVolumeService', KubernetesVolumeService);
diff --git a/app/kubernetes/store/namespace.js b/app/kubernetes/store/namespace.js
new file mode 100644
index 0000000..456b427
--- /dev/null
+++ b/app/kubernetes/store/namespace.js
@@ -0,0 +1,21 @@
+// singleton pattern as:
+// * we don't want to use AngularJS DI to fetch the single instance
+// * we need to use the Store in static functions / non-instanciated classes
+const storeNamespaces = {};
+
+/**
+ * Check if a namespace of the store is system or not
+ * @param {String} name Namespace name
+ * @returns Boolean
+ */
+export function isSystem(name) {
+  return storeNamespaces[name] && storeNamespaces[name].IsSystem;
+}
+
+/**
+ * Called from KubernetesNamespaceService.get()
+ * @param {KubernetesNamespace[]} namespaces list of namespaces to update in Store
+ */
+export function updateNamespaces(namespaces) {
+  namespaces.forEach((ns) => (storeNamespaces[ns.Name] = ns));
+}
diff --git a/app/kubernetes/views/applications/create/createApplication.html b/app/kubernetes/views/applications/create/createApplication.html
new file mode 100644
index 0000000..ba32499
--- /dev/null
+++ b/app/kubernetes/views/applications/create/createApplication.html
@@ -0,0 +1,409 @@
+<page-header
+  ng-if="!ctrl.state.isEdit && !ctrl.stack.IsComposeFormat && ctrl.state.viewReady"
+  title="'Create application'"
+  breadcrumbs="[
+    { label:'Applications', link:'kubernetes.applications' },
+     'Create an application'
+     ]"
+  reload="true"
+>
+</page-header>
+
+<page-header
+  ng-if="ctrl.state.isEdit && !ctrl.stack.IsComposeFormat && ctrl.state.viewReady"
+  title="'Edit application'"
+  breadcrumbs="[
+    { label:'Namespaces', link:'kubernetes.resourcePools' },
+    {
+      label:ctrl.application.ResourcePool,
+      link: 'kubernetes.resourcePools.resourcePool',
+      linkParams:{ id: ctrl.application.ResourcePool }
+    },
+    { label:'Applications', link:'kubernetes.applications' },
+    {
+      label:ctrl.application.Name,
+      link: 'kubernetes.applications.application',
+      linkParams:{ name: ctrl.application.Name, namespace: ctrl.application.ResourcePool }
+    },
+     'Edit',
+     ]"
+  reload="true"
+>
+</page-header>
+
+<page-header
+  ng-if="ctrl.stack.IsComposeFormat"
+  title="'View application'"
+  breadcrumbs="[
+    { label:'Namespaces', link:'kubernetes.resourcePools' },
+    {
+      label:ctrl.application.ResourcePool,
+      link: 'kubernetes.resourcePools.resourcePool',
+      linkParams:{ id: ctrl.application.ResourcePool }
+    },
+    { label:'Applications', link:'kubernetes.applications' },
+    {
+      label:ctrl.application.Name,
+      link: 'kubernetes.applications.application',
+      linkParams:{ name: ctrl.application.Name, namespace: ctrl.application.ResourcePool }
+    },
+     'View',
+     ]"
+  reload="true"
+>
+</page-header>
+
+<kubernetes-view-loading view-ready="ctrl.state.viewReady"></kubernetes-view-loading>
+<div ng-if="ctrl.state.viewReady">
+  <div class="row kubernetes-create">
+    <div class="col-xs-12">
+      <rd-widget>
+        <rd-widget-body>
+          <form class="form-horizontal mt-4" name="kubernetesApplicationCreationForm" autocomplete="off" novalidate>
+            <div ng-if="ctrl.isExternalApplication()">
+              <div class="col-sm-12 form-section-title" ng-if="ctrl.state.appType === ctrl.KubernetesDeploymentTypes.APPLICATION_FORM"> Namespace </div>
+              <!-- #region NAMESPACE -->
+              <namespace-selector
+                values="ctrl.formValues.ResourcePool.Namespace.Name"
+                on-change="(ctrl.onChangeNamespaceName)"
+                validation-data="{hasQuota: ctrl.state.resourcePoolHasQuota, isResourceQuotaCapacityExceeded: ctrl.resourceQuotaCapacityExceeded(), namespaceOptionCount: ctrl.resourcePools.length, isEnvironmentAdmin: ctrl.isAdmin}"
+                is-edit="ctrl.state.isEdit"
+              ></namespace-selector>
+              <!-- kubernetes services options -->
+              <div ng-if="ctrl.formValues.ResourcePool">
+                <kube-services-form
+                  on-change="(ctrl.onServicesChange)"
+                  values="ctrl.formValues.Services"
+                  app-name="ctrl.formValues.Name"
+                  selector="ctrl.formValues.Selector"
+                  validation-data="{nodePortServices: ctrl.state.nodePortServices, formServices: ctrl.formValues.Services, ingressPaths: ctrl.ingressPaths, originalIngressPaths: ctrl.originalIngressPaths}"
+                  is-edit-mode="ctrl.state.isEdit"
+                  namespace="ctrl.formValues.ResourcePool.Namespace.Name"
+                ></kube-services-form>
+              </div>
+              <!-- kubernetes services options -->
+
+              <!-- kubernetes summary for external application -->
+              <!--  below workaround is needed because we wanted react to render it again 
+                by hiding/showing it, but the page was fluctuating. so we added two blocks for both the conditions -->
+              <div ng-if="!ctrl.isTemporaryRefresh">
+                <application-summary-section
+                  application-kind="ctrl.formValues.ApplicationType"
+                  form-values="ctrl.formValues"
+                  old-form-values="ctrl.savedFormValues"
+                  ng-if="kubernetesApplicationCreationForm.$valid && ctrl.isExternalApplication()"
+                ></application-summary-section>
+              </div>
+              <div ng-if="ctrl.isTemporaryRefresh">
+                <application-summary-section
+                  application-kind="ctrl.formValues.ApplicationType"
+                  form-values="ctrl.formValues"
+                  old-form-values="ctrl.savedFormValues"
+                  ng-if="kubernetesApplicationCreationForm.$valid && ctrl.isExternalApplication()"
+                ></application-summary-section>
+              </div>
+              <!-- kubernetes summary for external application -->
+              <div class="col-sm-12 form-section-title !mt-6" ng-hide="ctrl.stack.IsComposeFormat"> Actions </div>
+              <!-- #region ACTIONS -->
+              <div class="form-group" ng-hide="ctrl.stack.IsComposeFormat">
+                <div class="col-sm-12">
+                  <button
+                    ng-if="ctrl.state.appType === ctrl.KubernetesDeploymentTypes.APPLICATION_FORM"
+                    type="button"
+                    class="btn btn-primary btn-sm !ml-0"
+                    ng-disabled="!kubernetesApplicationCreationForm.$valid || ctrl.isDeployUpdateButtonDisabled() || !ctrl.imageValidityIsValid() || ctrl.hasPortErrors() || !ctrl.formValues.ResourcePool"
+                    ng-click="ctrl.deployApplication()"
+                    button-spinner="ctrl.state.actionInProgress"
+                    data-cy="k8sAppCreate-deployButton"
+                  >
+                    <span ng-show="!ctrl.state.isEdit && !ctrl.state.actionInProgress">Deploy application</span>
+                    <span ng-show="!ctrl.state.isEdit && ctrl.state.actionInProgress">Deployment in progress...</span>
+                    <span ng-show="ctrl.state.isEdit && !ctrl.state.actionInProgress">Update application</span>
+                    <span ng-show="ctrl.state.isEdit && ctrl.state.actionInProgress">Update in progress...</span>
+                  </button>
+                  <button
+                    ng-if="ctrl.state.isEdit && !ctrl.state.actionInProgress && ctrl.state.appType === ctrl.KubernetesDeploymentTypes.APPLICATION_FORM"
+                    type="button"
+                    class="btn btn-sm btn-default"
+                    ui-sref="kubernetes.applications.application({ name: ctrl.application.Name, namespace: ctrl.application.ResourcePool })"
+                    data-cy="k8sAppCreate-appCancelButton"
+                  >
+                    Cancel
+                  </button>
+                  <!-- #Web editor buttons -->
+                  <button
+                    class="btn btn-sm btn-primary"
+                    ng-click="ctrl.updateApplicationViaWebEditor()"
+                    ng-if="ctrl.state.appType === ctrl.KubernetesDeploymentTypes.CONTENT || ctrl.state.updateWebEditorInProgress"
+                    ng-disabled="ctrl.isUpdateApplicationViaWebEditorButtonDisabled() || !kubernetesApplicationCreationForm.$valid"
+                    style="margin-top: 7px; margin-left: 0"
+                    button-spinner="ctrl.state.updateWebEditorInProgress"
+                  >
+                    <span ng-show="!ctrl.state.updateWebEditorInProgress">Update application</span>
+                    <span ng-show="ctrl.state.updateWebEditorInProgress">Update in progress...</span>
+                  </button>
+                </div>
+              </div>
+              <!-- #endregion -->
+            </div>
+            <div ng-if="!ctrl.isExternalApplication()">
+              <!-- #region NAMESPACE -->
+              <namespace-selector
+                values="ctrl.formValues.ResourcePool.Namespace.Name"
+                on-change="(ctrl.onChangeNamespaceName)"
+                validation-data="{hasQuota: ctrl.state.resourcePoolHasQuota, isResourceQuotaCapacityExceeded: ctrl.resourceQuotaCapacityExceeded(), namespaceOptionCount: ctrl.resourcePools.length, isEnvironmentAdmin: ctrl.isAdmin}"
+                is-edit="ctrl.state.isEdit"
+              ></namespace-selector>
+              <!-- #endregion -->
+
+              <!-- #region STACK -->
+              <kube-stack-name
+                ng-if="!ctrl.deploymentOptions.hideStacksFunctionality && ctrl.state.appType !== ctrl.KubernetesDeploymentTypes.APPLICATION_FORM"
+                stack-name="ctrl.formValues.StackName"
+                set-stack-name="(ctrl.onChangeStackName)"
+                text-tip="'Enter or select a \'stack\' name to group multiple deployments together, or else leave empty to ignore.'"
+                stacks="ctrl.stacks"
+                input-class-name="'col-lg-10 col-sm-9'"
+                error="ctrl.state.stackNameError"
+              ></kube-stack-name>
+              <!-- #endregion -->
+
+              <!-- #region web editor -->
+              <edit-yaml-form-section
+                ng-if="ctrl.state.appType === ctrl.KubernetesDeploymentTypes.CONTENT"
+                values="ctrl.stackFileContent"
+                on-change="(ctrl.onChangeFileContent)"
+                is-compose-format="ctrl.stack.IsComposeFormat"
+              ></edit-yaml-form-section>
+              <!-- #endregion -->
+              <div ng-if="ctrl.state.appType === ctrl.KubernetesDeploymentTypes.APPLICATION_FORM">
+                <!-- #region NAME FIELD -->
+                <name-form-section
+                  values="ctrl.formValues.Name"
+                  on-change="(ctrl.onChangeAppName)"
+                  is-edit="ctrl.state.isEdit"
+                  validation-data="{existingNames: ctrl.applicationNames, isEdit: ctrl.state.isEdit, originalName: ctrl.application.Name}"
+                ></name-form-section>
+                <!-- #endregion -->
+
+                <!-- #region IMAGE FIELD -->
+                <div class="form-group mb-2">
+                  <div class="col-sm-12">
+                    <por-image-registry
+                      model="ctrl.formValues.ImageModel"
+                      ng-if="ctrl.formValues.ResourcePool"
+                      auto-complete="false"
+                      label-class="col-sm-3 col-lg-2"
+                      input-class="col-sm-9 col-lg-10"
+                      namespace="ctrl.formValues.ResourcePool.Namespace.Name"
+                      endpoint="ctrl.endpoint"
+                      is-admin="ctrl.isAdmin"
+                      check-rate-limits="true"
+                      set-validity="ctrl.setPullImageValidity"
+                    ></por-image-registry>
+                  </div>
+                </div>
+                <!-- #end region IMAGE FIELD -->
+
+                <div class="col-sm-12 mb-4 !p-0">
+                  <annotations-be-teaser></annotations-be-teaser>
+                </div>
+
+                <div ng-if="ctrl.formValues.ResourcePool">
+                  <!-- #region STACK -->
+                  <kube-stack-name
+                    ng-if="!ctrl.deploymentOptions.hideStacksFunctionality"
+                    stack-name="ctrl.formValues.StackName"
+                    set-stack-name="(ctrl.onChangeStackName)"
+                    text-tip="'Enter or select a \'stack\' name to group multiple deployments together, or else leave empty to ignore.'"
+                    stacks="ctrl.stacks"
+                    input-class-name="'col-lg-10 col-sm-9'"
+                    error="ctrl.state.stackNameError"
+                  ></kube-stack-name>
+                  <!-- #endregion -->
+
+                  <!-- #region ENVIRONMENT VARIABLES -->
+                  <environment-variables-form-section
+                    values="ctrl.formValues.EnvironmentVariables"
+                    on-change="(ctrl.onEnvironmentVariableChange)"
+                  ></environment-variables-form-section>
+                  <!-- #endregion -->
+
+                  <!-- #region CONFIGMAPS -->
+                  <config-maps-form-section
+                    values="ctrl.formValues.ConfigMaps"
+                    on-change="(ctrl.onConfigMapsChange)"
+                    namespace="ctrl.formValues.ResourcePool.Namespace.Name"
+                    validation-data="ctrl.formValues.ConfigMaps"
+                  ></config-maps-form-section>
+
+                  <!-- #region SECRETS -->
+                  <secrets-form-section
+                    values="ctrl.formValues.Secrets"
+                    on-change="(ctrl.onSecretsChange)"
+                    namespace="ctrl.formValues.ResourcePool.Namespace.Name"
+                    validation-data="ctrl.formValues.Secrets"
+                  ></secrets-form-section>
+                  <!-- #endregion -->
+
+                  <persisted-folders-form-section
+                    values="ctrl.formValues.PersistedFolders"
+                    initial-values="ctrl.formValues.OriginalPersistedFolders"
+                    on-change="(ctrl.onChangePersistedFolder)"
+                    is-edit="ctrl.state.isEdit"
+                    application-values="ctrl.formValues"
+                    is-add-persistent-folder-button-shown="ctrl.isAddPersistentFolderButtonShown()"
+                    available-volumes="ctrl.availableVolumes"
+                    validation-data="{ namespaceQuotas: ctrl.formValues.ResourcePool.Quota, persistedFolders: ctrl.formValues.PersistedFolders, storageAvailabilities: ctrl.state.storages.availabilities }"
+                  ></persisted-folders-form-section>
+
+                  <!-- #region DATA ACCESS POLICY -->
+                  <access-policy-form-section
+                    ng-if="ctrl.showDataAccessPolicySection()"
+                    value="ctrl.formValues.DataAccessPolicy"
+                    on-change="(ctrl.onDataAccessPolicyChange)"
+                    is-edit="ctrl.state.isEdit"
+                    persisted-folders-use-existing-volumes="ctrl.state.persistedFoldersUseExistingVolumes"
+                  ></access-policy-form-section>
+                  <!-- #endregion -->
+
+                  <resource-reservation-form-section
+                    values="{memoryLimit: ctrl.formValues.MemoryLimit, cpuLimit: ctrl.formValues.CpuLimit}"
+                    on-change="(ctrl.onChangeResourceReservation)"
+                    namespace-has-quota="ctrl.state.resourcePoolHasQuota"
+                    min-memory-limit="ctrl.state.sliders.memory.min"
+                    min-cpu-limit="ctrl.state.sliders.cpu.min"
+                    max-memory-limit="ctrl.state.sliders.memory.max"
+                    max-cpu-limit="ctrl.state.sliders.cpu.max"
+                    validation-data="{isExistingCPUReservationUnchanged: ctrl.state.isExistingCPUReservationUnchanged, isExistingMemoryReservationUnchanged: ctrl.state.isExistingMemoryReservationUnchanged, maxMemoryLimit: ctrl.state.sliders.memory.max, maxCpuLimit: ctrl.state.sliders.cpu.max, isEnvironmentAdmin: ctrl.isAdmin, nodeLimits: ctrl.nodesLimits.nodesLimits}"
+                    resource-quota-capacity-exceeded="ctrl.resourceQuotaCapacityExceeded()"
+                  ></resource-reservation-form-section>
+
+                  <!-- deployment options -->
+                  <app-deployment-type-form-section
+                    values="ctrl.formValues.DeploymentType"
+                    on-change="(ctrl.onChangeDeploymentType)"
+                    support-global-deployment="ctrl.supportGlobalDeployment()"
+                    radio-name="'deploymentType'"
+                    validation-data="{isQuotaExceeded: ctrl.resourceReservationsOverflow()}"
+                  ></app-deployment-type-form-section>
+
+                  <!-- replica count -->
+                  <div ng-if="ctrl.formValues.DeploymentType === ctrl.ApplicationDeploymentTypes.Replicated">
+                    <replication-form-section
+                      values="{replicaCount: ctrl.formValues.ReplicaCount}"
+                      on-change="(ctrl.onChangeReplicaCount)"
+                      support-scalable-replica-deployment="ctrl.supportScalableReplicaDeployment()"
+                      memory-limit="ctrl.formValues.MemoryLimit"
+                      cpu-limit="ctrl.formValues.CpuLimit"
+                      resource-reservations-overflow="ctrl.resourceReservationsOverflow()"
+                      non-scalable-storage="ctrl.getNonScalableStorage()"
+                      validation-data="{resourceReservationsOverflow: ctrl.resourceReservationsOverflow(), quotaExceeded: ctrl.state.storages.quotaExceeded, nonScalableStorage: ctrl.getNonScalableStorage(), supportScalableReplicaDeployment: ctrl.supportScalableReplicaDeployment()}"
+                    ></replication-form-section>
+                  </div>
+                  <!-- #endregion -->
+
+                  <!-- #region AUTO SCALING -->
+                  <div ng-if="ctrl.formValues.DeploymentType !== ctrl.ApplicationDeploymentTypes.Global">
+                    <auto-scaling-form-section
+                      values="ctrl.formValues.AutoScaler"
+                      on-change="(ctrl.onAutoScaleChange)"
+                      validation-data="{autoScalerOverflow: ctrl.autoScalerOverflow()}"
+                      is-metrics-enabled="ctrl.state.useServerMetrics"
+                    ></auto-scaling-form-section>
+                  </div>
+                  <!-- #endregion -->
+                </div>
+
+                <div class="mb-8" ng-if="ctrl.formValues.ResourcePool">
+                  <placement-form-section
+                    ng-show="ctrl.formValues.DeploymentType === ctrl.ApplicationDeploymentTypes.Replicated"
+                    values="{placements: ctrl.formValues.Placements, placementType: ctrl.formValues.PlacementType}"
+                    on-change="(ctrl.onChangePlacements)"
+                  ></placement-form-section>
+
+                  <!-- kubernetes services options -->
+                  <kube-services-form
+                    on-change="(ctrl.onServicesChange)"
+                    values="ctrl.formValues.Services"
+                    load-balancer-enabled="ctrl.publishViaLoadBalancerEnabled()"
+                    app-name="ctrl.formValues.Name"
+                    selector="ctrl.formValues.Selector"
+                    validation-data="{nodePortServices: ctrl.state.nodePortServices, formServices: ctrl.formValues.Services, ingressPaths: ctrl.ingressPaths, originalIngressPaths: ctrl.originalIngressPaths}"
+                    is-edit-mode="ctrl.state.isEdit"
+                    namespace="ctrl.formValues.ResourcePool.Namespace.Name"
+                  ></kube-services-form>
+                </div>
+                <!-- kubernetes services options -->
+
+                <!-- application summary start -->
+                <!--  below workaround is needed because we wanted react to render it again 
+                  by hiding/showing it, but the page was fluctuating. so we added two blocks for both the conditions -->
+                <div ng-if="!ctrl.isTemporaryRefresh">
+                  <!-- summary -->
+                  <application-summary-section
+                    application-kind="ctrl.formValues.ApplicationType"
+                    ng-if="!(!kubernetesApplicationCreationForm.$valid || ctrl.isDeployUpdateButtonDisabled() || !ctrl.state.pullImageValidity)"
+                    form-values="ctrl.formValues"
+                    old-form-values="ctrl.savedFormValues"
+                  ></application-summary-section>
+                </div>
+                <div ng-if="ctrl.isTemporaryRefresh">
+                  <!-- summary -->
+                  <application-summary-section
+                    application-kind="ctrl.formValues.ApplicationType"
+                    ng-if="!(!kubernetesApplicationCreationForm.$valid || ctrl.isDeployUpdateButtonDisabled() || !ctrl.state.pullImageValidity)"
+                    form-values="ctrl.formValues"
+                    old-form-values="ctrl.savedFormValues"
+                  ></application-summary-section>
+                </div>
+                <!-- application summary end -->
+              </div>
+              <!-- #region ACTIONS -->
+              <div class="col-sm-12 form-section-title !mt-6" ng-hide="ctrl.stack.IsComposeFormat"> Actions </div>
+              <div class="form-group" ng-hide="ctrl.stack.IsComposeFormat">
+                <div class="col-sm-12">
+                  <button
+                    ng-if="ctrl.state.appType === ctrl.KubernetesDeploymentTypes.APPLICATION_FORM"
+                    type="button"
+                    class="btn btn-primary btn-sm !ml-0"
+                    ng-disabled="!kubernetesApplicationCreationForm.$valid || ctrl.isDeployUpdateButtonDisabled() || !ctrl.imageValidityIsValid() || ctrl.hasPortErrors() || !ctrl.formValues.ResourcePool"
+                    ng-click="ctrl.deployApplication()"
+                    button-spinner="ctrl.state.actionInProgress"
+                    data-cy="k8sAppCreate-deployButton"
+                  >
+                    <span ng-show="!ctrl.state.isEdit && !ctrl.state.actionInProgress">Deploy application</span>
+                    <span ng-show="!ctrl.state.isEdit && ctrl.state.actionInProgress">Deployment in progress...</span>
+                    <span ng-show="ctrl.state.isEdit && !ctrl.state.actionInProgress">Update application</span>
+                    <span ng-show="ctrl.state.isEdit && ctrl.state.actionInProgress">Update in progress...</span>
+                  </button>
+                  <button
+                    ng-if="ctrl.state.isEdit && !ctrl.state.actionInProgress && ctrl.state.appType === ctrl.KubernetesDeploymentTypes.APPLICATION_FORM"
+                    type="button"
+                    class="btn btn-sm btn-default"
+                    ui-sref="kubernetes.applications.application({ name: ctrl.application.Name, namespace: ctrl.application.ResourcePool })"
+                    data-cy="k8sAppCreate-appCancelButton"
+                  >
+                    Cancel
+                  </button>
+                  <!-- #Web editor buttons -->
+                  <button
+                    class="btn btn-sm btn-primary"
+                    ng-click="ctrl.updateApplicationViaWebEditor()"
+                    ng-if="ctrl.state.appType === ctrl.KubernetesDeploymentTypes.CONTENT || ctrl.state.updateWebEditorInProgress"
+                    ng-disabled="ctrl.isUpdateApplicationViaWebEditorButtonDisabled() || !kubernetesApplicationCreationForm.$valid"
+                    style="margin-top: 7px; margin-left: 0"
+                    button-spinner="ctrl.state.updateWebEditorInProgress"
+                  >
+                    <span ng-show="!ctrl.state.updateWebEditorInProgress">Update application</span>
+                    <span ng-show="ctrl.state.updateWebEditorInProgress">Update in progress...</span>
+                  </button>
+                </div>
+              </div>
+            </div>
+          </form>
+        </rd-widget-body>
+      </rd-widget>
+    </div>
+  </div>
+</div>
diff --git a/app/kubernetes/views/applications/create/createApplication.js b/app/kubernetes/views/applications/create/createApplication.js
new file mode 100644
index 0000000..c5c8df1
--- /dev/null
+++ b/app/kubernetes/views/applications/create/createApplication.js
@@ -0,0 +1,8 @@
+angular.module('portainer.kubernetes').component('kubernetesCreateApplicationView', {
+  templateUrl: './createApplication.html',
+  controller: 'KubernetesCreateApplicationController',
+  controllerAs: 'ctrl',
+  bindings: {
+    endpoint: '<',
+  },
+});
diff --git a/app/kubernetes/views/applications/create/createApplicationController.js b/app/kubernetes/views/applications/create/createApplicationController.js
new file mode 100644
index 0000000..d943860
--- /dev/null
+++ b/app/kubernetes/views/applications/create/createApplicationController.js
@@ -0,0 +1,1184 @@
+import angular from 'angular';
+import _ from 'lodash-es';
+import filesizeParser from 'filesize-parser';
+import * as JsonPatch from 'fast-json-patch';
+import { RegistryTypes } from '@/portainer/models/registryTypes';
+import { getServices } from '@/react/kubernetes/services/useNamespaceServices';
+import { KubernetesConfigurationKinds } from '@/kubernetes/models/configuration/models';
+import { getGlobalDeploymentOptions } from '@/react/portainer/settings/settings.service';
+
+import {
+  KubernetesApplicationDataAccessPolicies,
+  KubernetesApplicationDeploymentTypes,
+  KubernetesApplicationServiceTypes,
+  KubernetesApplicationTypes,
+} from '@/kubernetes/models/application/models/appConstants';
+import { KubernetesApplicationQuotaDefaults, KubernetesDeploymentTypes } from '@/kubernetes/models/application/models';
+import { KubernetesApplicationEnvironmentVariableFormValue, KubernetesApplicationFormValues, KubernetesFormValidationReferences } from '@/kubernetes/models/application/formValues';
+import KubernetesFormValidationHelper from '@/kubernetes/helpers/formValidationHelper';
+import KubernetesApplicationConverter from '@/kubernetes/converters/application';
+import KubernetesResourceReservationHelper from '@/kubernetes/helpers/resourceReservationHelper';
+import { KubernetesServiceTypes } from '@/kubernetes/models/service/models';
+import KubernetesApplicationHelper from '@/kubernetes/helpers/application/index';
+import KubernetesVolumeHelper from '@/kubernetes/helpers/volumeHelper';
+import KubernetesNamespaceHelper from '@/kubernetes/helpers/namespaceHelper';
+import { KubernetesNodeHelper } from '@/kubernetes/node/helper';
+import { updateIngress, getIngresses } from '@/react/kubernetes/ingresses/service';
+import { confirmUpdateAppIngress } from '@/react/kubernetes/applications/CreateView/UpdateIngressPrompt';
+import { KUBE_STACK_NAME_VALIDATION_REGEX } from '@/react/kubernetes/DeployView/StackName/constants';
+import { isVolumeUsed } from '@/react/kubernetes/volumes/utils';
+import { confirm, confirmUpdate, confirmWebEditorDiscard } from '@@/modals/confirm';
+import { buildConfirmButton } from '@@/modals/utils';
+import { ModalType } from '@@/modals';
+
+class KubernetesCreateApplicationController {
+  /* #region  CONSTRUCTOR */
+
+  /* @ngInject */
+  constructor(
+    $scope,
+    $async,
+    $state,
+    $timeout,
+    $window,
+    Notifications,
+    Authentication,
+    KubernetesResourcePoolService,
+    KubernetesApplicationService,
+    KubernetesStackService,
+    KubernetesConfigurationService,
+    KubernetesNodeService,
+    KubernetesIngressService,
+    KubernetesPersistentVolumeClaimService,
+    KubernetesVolumeService,
+    RegistryService,
+    StackService,
+    KubernetesNodesLimitsService,
+    EndpointService,
+    StateManager
+  ) {
+    this.$scope = $scope;
+    this.$async = $async;
+    this.$state = $state;
+    this.$timeout = $timeout;
+    this.$window = $window;
+    this.Notifications = Notifications;
+    this.Authentication = Authentication;
+    this.KubernetesResourcePoolService = KubernetesResourcePoolService;
+    this.KubernetesApplicationService = KubernetesApplicationService;
+    this.KubernetesStackService = KubernetesStackService;
+    this.KubernetesConfigurationService = KubernetesConfigurationService;
+    this.KubernetesNodeService = KubernetesNodeService;
+    this.KubernetesVolumeService = KubernetesVolumeService;
+    this.KubernetesIngressService = KubernetesIngressService;
+    this.KubernetesPersistentVolumeClaimService = KubernetesPersistentVolumeClaimService;
+    this.RegistryService = RegistryService;
+    this.StackService = StackService;
+    this.KubernetesNodesLimitsService = KubernetesNodesLimitsService;
+    this.EndpointService = EndpointService;
+    this.StateManager = StateManager;
+
+    this.ApplicationDeploymentTypes = KubernetesApplicationDeploymentTypes;
+    this.ApplicationDataAccessPolicies = KubernetesApplicationDataAccessPolicies;
+    this.KubernetesApplicationServiceTypes = KubernetesApplicationServiceTypes;
+    this.ApplicationTypes = KubernetesApplicationTypes;
+    this.ServiceTypes = KubernetesServiceTypes;
+    this.KubernetesDeploymentTypes = KubernetesDeploymentTypes;
+
+    this.state = {
+      appType: this.KubernetesDeploymentTypes.APPLICATION_FORM,
+      updateWebEditorInProgress: false,
+      actionInProgress: false,
+      useLoadBalancer: false,
+      useServerMetrics: false,
+      sliders: {
+        cpu: {
+          min: 0,
+          max: 0,
+        },
+        memory: {
+          min: 0,
+          max: 0,
+        },
+      },
+      nodes: {
+        memory: 0,
+        cpu: 0,
+      },
+      namespaceLimits: {
+        memory: 0,
+        cpu: 0,
+      },
+      resourcePoolHasQuota: false,
+      viewReady: false,
+      availableSizeUnits: ['MB', 'GB', 'TB'],
+      alreadyExists: false,
+      duplicates: {
+        environmentVariables: new KubernetesFormValidationReferences(),
+        persistedFolders: new KubernetesFormValidationReferences(),
+        configMapPaths: new KubernetesFormValidationReferences(),
+        secretPaths: new KubernetesFormValidationReferences(),
+        existingVolumes: new KubernetesFormValidationReferences(),
+        placements: new KubernetesFormValidationReferences(),
+      },
+      isEdit: this.$state.params.namespace && this.$state.params.name,
+      persistedFoldersUseExistingVolumes: false,
+      pullImageValidity: false,
+      nodePortServices: [],
+      // when the namespace available resources changes, and the existing app not has a resource limit that exceeds whats available,
+      // a validation message will be shown. isExistingCPUReservationUnchanged and isExistingMemoryReservationUnchanged (with available resources being exceeded) is used to decide whether to show the message or not.
+      isExistingCPUReservationUnchanged: false,
+      isExistingMemoryReservationUnchanged: false,
+      stackNameError: '',
+    };
+
+    this.isAdmin = this.Authentication.isAdmin();
+
+    this.editChanges = [];
+
+    this.storageClasses = [];
+    this.state.useLoadBalancer = false;
+    this.state.useServerMetrics = false;
+
+    this.formValues = new KubernetesApplicationFormValues();
+
+    this.updateApplicationAsync = this.updateApplicationAsync.bind(this);
+    this.deployApplicationAsync = this.deployApplicationAsync.bind(this);
+    this.setPullImageValidity = this.setPullImageValidity.bind(this);
+    this.onChangeFileContent = this.onChangeFileContent.bind(this);
+    this.checkIngressesToUpdate = this.checkIngressesToUpdate.bind(this);
+    this.confirmUpdateApplicationAsync = this.confirmUpdateApplicationAsync.bind(this);
+    this.onDataAccessPolicyChange = this.onDataAccessPolicyChange.bind(this);
+    this.onChangeDeploymentType = this.onChangeDeploymentType.bind(this);
+    this.supportGlobalDeployment = this.supportGlobalDeployment.bind(this);
+    this.onServicesChange = this.onServicesChange.bind(this);
+    this.onEnvironmentVariableChange = this.onEnvironmentVariableChange.bind(this);
+    this.onConfigMapsChange = this.onConfigMapsChange.bind(this);
+    this.onSecretsChange = this.onSecretsChange.bind(this);
+    this.onChangePersistedFolder = this.onChangePersistedFolder.bind(this);
+    this.onChangeResourceReservation = this.onChangeResourceReservation.bind(this);
+    this.onChangeReplicaCount = this.onChangeReplicaCount.bind(this);
+    this.onAutoScaleChange = this.onAutoScaleChange.bind(this);
+    this.onChangePlacements = this.onChangePlacements.bind(this);
+    this.updateApplicationType = this.updateApplicationType.bind(this);
+    this.getAppType = this.getAppType.bind(this);
+    this.showDataAccessPolicySection = this.showDataAccessPolicySection.bind(this);
+    this.refreshReactComponent = this.refreshReactComponent.bind(this);
+    this.onChangeNamespaceName = this.onChangeNamespaceName.bind(this);
+    this.canSupportSharedAccess = this.canSupportSharedAccess.bind(this);
+    this.isUpdateApplicationViaWebEditorButtonDisabled = this.isUpdateApplicationViaWebEditorButtonDisabled.bind(this);
+
+    this.$scope.$watch(
+      () => this.formValues,
+      () => {
+        this.refreshReactComponent();
+      },
+      _.isEqual
+    );
+  }
+  /* #endregion */
+
+  refreshReactComponent() {
+    this.isTemporaryRefresh = true;
+
+    this.$timeout(() => {
+      this.isTemporaryRefresh = false;
+    }, 10);
+    this.onChangeStackName = this.onChangeStackName.bind(this);
+    this.onChangeAppName = this.onChangeAppName.bind(this);
+  }
+  /* #endregion */
+
+  onChangeStackName(name) {
+    return this.$async(async () => {
+      if (KUBE_STACK_NAME_VALIDATION_REGEX.test(name) || name === '') {
+        this.state.stackNameError = '';
+      } else {
+        this.state.stackNameError =
+          "Stack must consist of alphanumeric characters, '-', '_' or '.', must start and end with an alphanumeric character and must be 63 characters or less (e.g. 'my-name', or 'abc-123').";
+      }
+
+      this.formValues.StackName = name;
+    });
+  }
+
+  onChangePlacements(values) {
+    return this.$async(async () => {
+      this.formValues.Placements = values.placements;
+      this.formValues.PlacementType = values.placementType;
+    });
+  }
+
+  onChangeDeploymentType(value) {
+    this.$scope.$evalAsync(() => {
+      this.formValues.DeploymentType = value;
+    });
+    this.updateApplicationType();
+  }
+
+  getAppType() {
+    if (this.formValues.DeploymentType === this.ApplicationDeploymentTypes.Global) {
+      return this.ApplicationTypes.DaemonSet;
+    }
+    const persistedFolders = this.formValues.PersistedFolders && this.formValues.PersistedFolders.filter((pf) => !pf.NeedsDeletion);
+    if (persistedFolders && persistedFolders.length && this.formValues.DataAccessPolicy === this.ApplicationDataAccessPolicies.Isolated) {
+      return this.ApplicationTypes.StatefulSet;
+    }
+    return this.ApplicationTypes.Deployment;
+  }
+
+  // keep the application type up to date
+  updateApplicationType() {
+    return this.$scope.$evalAsync(() => {
+      this.formValues.ApplicationType = this.getAppType();
+      this.validatePersistedFolders();
+    });
+  }
+
+  onChangeFileContent(value) {
+    this.$scope.$evalAsync(() => {
+      if (this.oldStackFileContent.replace(/(\r\n|\n|\r)/gm, '') !== value.replace(/(\r\n|\n|\r)/gm, '')) {
+        this.state.isEditorDirty = true;
+      } else {
+        this.state.isEditorDirty = false;
+      }
+      this.stackFileContent = value;
+    });
+  }
+
+  onDataAccessPolicyChange(value) {
+    this.$scope.$evalAsync(() => {
+      this.formValues.DataAccessPolicy = value;
+      this.resetDeploymentType();
+      this.updateApplicationType();
+    });
+  }
+
+  async updateApplicationViaWebEditor() {
+    return this.$async(async () => {
+      try {
+        const confirmed = await confirm({
+          title: 'Are you sure?',
+          message: 'Any changes to this application will be overridden and may cause a service interruption. Do you wish to continue?',
+          confirmButton: buildConfirmButton('Update', 'warning'),
+          modalType: ModalType.Warn,
+        });
+        if (!confirmed) {
+          return;
+        }
+
+        this.state.updateWebEditorInProgress = true;
+        await this.StackService.updateKubeStack(
+          { EndpointId: this.endpoint.Id, Id: this.application.StackId },
+          { stackFile: this.stackFileContent, stackName: this.formValues.StackName }
+        );
+        this.state.isEditorDirty = false;
+        this.Notifications.success('Success', 'Request to update application successfully submitted');
+        this.$state.go(
+          'kubernetes.applications.application',
+          { name: this.application.Name, namespace: this.application.ResourcePool, endpointId: this.endpoint.Id },
+          { inherit: false }
+        );
+      } catch (err) {
+        this.Notifications.error('Failure', err, 'Failed redeploying application');
+      } finally {
+        this.state.updateWebEditorInProgress = false;
+      }
+    });
+  }
+
+  async uiCanExit() {
+    if (this.stackFileContent && this.state.isEditorDirty) {
+      return confirmWebEditorDiscard();
+    }
+  }
+
+  setPullImageValidity(validity) {
+    this.state.pullImageValidity = validity;
+  }
+
+  imageValidityIsValid() {
+    return (
+      this.isExternalApplication() || this.state.pullImageValidity || (this.formValues.registryDetails && this.formValues.registryDetails.Registry.Type !== RegistryTypes.DOCKERHUB)
+    );
+  }
+
+  onChangeAppName(appName) {
+    return this.$async(async () => {
+      this.formValues.Name = appName;
+    });
+  }
+
+  /* #region  AUTO SCALER UI MANAGEMENT */
+  onAutoScaleChange(values) {
+    return this.$async(async () => {
+      this.formValues.AutoScaler = values;
+
+      // reset it to previous form values if the user disables the auto scaler
+      if (!this.oldFormValues.AutoScaler.isUsed && !values.isUsed) {
+        this.formValues.AutoScaler = this.oldFormValues.AutoScaler;
+      }
+    });
+  }
+  /* #endregion */
+
+  /* #region CONFIGMAP UI MANAGEMENT */
+  onConfigMapsChange(configMaps) {
+    return this.$async(async () => {
+      this.formValues.ConfigMaps = configMaps;
+    });
+  }
+
+  clearConfigMaps() {
+    this.formValues.ConfigMaps = [];
+  }
+  /* #endregion */
+
+  /* #region SECRET UI MANAGEMENT */
+  onSecretsChange(secrets) {
+    return this.$async(async () => {
+      this.formValues.Secrets = secrets;
+    });
+  }
+
+  clearSecrets() {
+    this.formValues.Secrets = [];
+  }
+  /* #endregion */
+
+  /* #region  ENVIRONMENT UI MANAGEMENT */
+  onEnvironmentVariableChange(enviromnentVariables) {
+    return this.$async(async () => {
+      const newEnvVars = enviromnentVariables.map((envVar) => {
+        const newEnvVar = new KubernetesApplicationEnvironmentVariableFormValue();
+        return { newEnvVar, ...envVar };
+      });
+      this.formValues.EnvironmentVariables = newEnvVars;
+    });
+  }
+  /* #endregion */
+
+  /* #region  PERSISTENT FOLDERS UI MANAGEMENT */
+  resetPersistedFolders() {
+    this.formValues.PersistedFolders = _.forEach(this.formValues.PersistedFolders, (persistedFolder) => {
+      persistedFolder.existingVolume = null;
+      persistedFolder.useNewVolume = true;
+    });
+    this.validatePersistedFolders();
+    this.updateApplicationType();
+  }
+  /* #endregion */
+
+  /* #region  PERSISTENT FOLDERS ON CHANGE VALIDATION */
+  validatePersistedFolders() {
+    this.onChangePersistedFolderPath();
+    this.onChangeExistingVolumeSelection();
+  }
+
+  onChangePersistedFolderPath() {
+    this.state.duplicates.persistedFolders.refs = KubernetesFormValidationHelper.getDuplicates(
+      _.map(this.formValues.PersistedFolders, (persistedFolder) => {
+        if (persistedFolder.needsDeletion) {
+          return undefined;
+        }
+        return persistedFolder.containerPath;
+      })
+    );
+    this.state.duplicates.persistedFolders.hasRefs = Object.keys(this.state.duplicates.persistedFolders.refs).length > 0;
+  }
+
+  onChangePersistedFolder(values) {
+    this.$scope.$evalAsync(() => {
+      this.state.persistedFoldersUseExistingVolumes = values.some((pf) => pf.existingVolume);
+      if (!this.state.isEdit && this.state.persistedFoldersUseExistingVolumes) {
+        this.formValues.DataAccessPolicy = this.ApplicationDataAccessPolicies.Shared;
+      }
+      this.formValues.PersistedFolders = values;
+      if (values && values.length && !this.supportGlobalDeployment()) {
+        this.onChangeDeploymentType(this.ApplicationDeploymentTypes.Replicated);
+      }
+      this.updateApplicationType();
+    });
+  }
+
+  onChangeExistingVolumeSelection() {
+    this.state.duplicates.existingVolumes.refs = KubernetesFormValidationHelper.getDuplicates(
+      _.map(this.formValues.PersistedFolders, (persistedFolder) => {
+        if (persistedFolder.needsDeletion) {
+          return undefined;
+        }
+        return persistedFolder.existingVolume ? persistedFolder.existingVolume.PersistentVolumeClaim.Name : '';
+      })
+    );
+    this.state.duplicates.existingVolumes.hasRefs = Object.keys(this.state.duplicates.existingVolumes.refs).length > 0;
+  }
+  /* #endregion */
+
+  /* #region SERVICES UI MANAGEMENT */
+  onServicesChange(services) {
+    return this.$async(async () => {
+      // if the ingress isn't found in the currently loaded ingresses, then refresh the ingresses
+      const ingressNamesUsed = services.flatMap((s) => s.Ports.flatMap((p) => (p.ingressPaths ? p.ingressPaths.flatMap((ip) => ip.IngressName || []) : [])));
+      if (ingressNamesUsed.length) {
+        const uniqueIngressNamesUsed = Array.from(new Set(ingressNamesUsed)); // get the unique ingress names used
+        const ingressNamesLoaded = this.ingresses.map((i) => i.Name);
+        const areAllIngressesLoaded = uniqueIngressNamesUsed.every((ingressNameUsed) => ingressNamesLoaded.includes(ingressNameUsed));
+        if (!areAllIngressesLoaded) {
+          this.refreshIngresses(this.application.ResourcePool);
+        }
+      }
+      // update the services
+      this.formValues.Services = services;
+    });
+  }
+  /* #endregion */
+
+  /* #region  STATE VALIDATION FUNCTIONS */
+  isValid() {
+    return (
+      !this.state.duplicates.environmentVariables.hasRefs &&
+      !this.state.duplicates.persistedFolders.hasRefs &&
+      !this.state.duplicates.configMapPaths.hasRefs &&
+      !this.state.duplicates.secretPaths.hasRefs &&
+      !this.state.duplicates.existingVolumes.hasRefs
+    );
+  }
+
+  storageClassAvailable() {
+    return this.storageClasses && this.storageClasses.length > 0;
+  }
+
+  resetDeploymentType() {
+    this.formValues.DeploymentType = this.ApplicationDeploymentTypes.Replicated;
+  }
+
+  // // The data access policy panel is shown when a persisted folder is specified
+  showDataAccessPolicySection() {
+    return this.formValues.PersistedFolders.length > 0;
+  }
+
+  // A global deployment is not available when either:
+  // * For each persisted folder specified, if one of the storage object only supports the RWO access mode
+  // * The data access policy is set to ISOLATED
+  supportGlobalDeployment() {
+    const hasFolders = this.formValues.PersistedFolders.length !== 0;
+    const hasRWOOnly = KubernetesApplicationHelper.hasRWOOnly(this.formValues);
+    const isIsolated = this.formValues.DataAccessPolicy === this.ApplicationDataAccessPolicies.Isolated;
+
+    if (hasFolders && (hasRWOOnly || isIsolated)) {
+      return false;
+    }
+
+    return true;
+  }
+
+  // from the pvcs in the form values, get all selected storage classes and find if they are all support RWX
+  canSupportSharedAccess() {
+    const formStorageClasses = this.formValues.PersistedFolders.map((pf) => pf.storageClass);
+    const isRWXSupported = formStorageClasses.every((sc) => sc.AccessModes.includes('RWX'));
+    return isRWXSupported;
+  }
+
+  // A StatefulSet is defined by DataAccessPolicy === 'Isolated'
+  isEditAndStatefulSet() {
+    return this.state.isEdit && this.formValues.DataAccessPolicy === this.ApplicationDataAccessPolicies.Isolated;
+  }
+
+  // A scalable deployment is available when either:
+  // * No persisted folders are specified
+  // * The access policy is set to shared and for each persisted folders specified, all the associated
+  //   storage objects support at least RWX access mode (no RWO only)
+  // * The access policy is set to isolated
+  supportScalableReplicaDeployment() {
+    const hasFolders = this.formValues.PersistedFolders.length !== 0;
+    const hasRWOOnly = KubernetesApplicationHelper.hasRWOOnly(this.formValues);
+    const isIsolated = this.formValues.DataAccessPolicy === this.ApplicationDataAccessPolicies.Isolated;
+
+    if (!hasFolders || isIsolated || (hasFolders && !hasRWOOnly)) {
+      return true;
+    }
+    return false;
+  }
+
+  onChangeReplicaCount(values) {
+    return this.$async(async () => {
+      this.formValues.ReplicaCount = values.replicaCount;
+    });
+  }
+
+  // For each persisted folders, returns the non scalable deployments options (storage class that only supports RWO)
+  getNonScalableStorage() {
+    let storageOptions = [];
+
+    for (let i = 0; i < this.formValues.PersistedFolders.length; i++) {
+      const folder = this.formValues.PersistedFolders[i];
+
+      if (folder.storageClass && _.isEqual(folder.storageClass.AccessModes, ['RWO'])) {
+        storageOptions.push(folder.storageClass.Name);
+      } else {
+        storageOptions.push('<no storage option available>');
+      }
+    }
+
+    return _.uniq(storageOptions).join(', ');
+  }
+
+  enforceReplicaCountMinimum() {
+    if (this.formValues.ReplicaCount === null) {
+      this.formValues.ReplicaCount = 1;
+    }
+  }
+
+  onChangeResourceReservation(values) {
+    return this.$async(async () => {
+      this.formValues.MemoryLimit = values.memoryLimit;
+      this.formValues.CpuLimit = values.cpuLimit;
+
+      if (this.oldFormValues.CpuLimit !== this.formValues.CpuLimit && this.state.isExistingCPUReservationUnchanged) {
+        this.state.isExistingCPUReservationUnchanged = false;
+      }
+      if (this.oldFormValues.MemoryLimit !== this.formValues.MemoryLimit && this.state.isExistingMemoryReservationUnchanged) {
+        this.state.isExistingMemoryReservationUnchanged = false;
+      }
+    });
+  }
+
+  resourceQuotaCapacityExceeded() {
+    return !this.state.sliders.memory.max || !this.state.sliders.cpu.max;
+  }
+
+  nodeLimitsOverflow() {
+    const cpu = this.formValues.CpuLimit;
+    const memory = KubernetesResourceReservationHelper.bytesValue(this.formValues.MemoryLimit);
+
+    const overflow = this.nodesLimits.overflowForReplica(cpu, memory, 1);
+
+    return overflow;
+  }
+
+  effectiveInstances() {
+    return this.formValues.DeploymentType === this.ApplicationDeploymentTypes.Global ? this.nodeNumber : this.formValues.ReplicaCount;
+  }
+
+  hasPortErrors() {
+    const portError = this.formValues.Services.some((service) => service.nodePortError || service.servicePortError);
+    return portError;
+  }
+
+  resourceReservationsOverflow() {
+    const instances = this.effectiveInstances();
+    const cpu = this.formValues.CpuLimit;
+    const maxCpu = this.state.namespaceLimits.cpu;
+    const memory = KubernetesResourceReservationHelper.bytesValue(this.formValues.MemoryLimit);
+    const maxMemory = this.state.namespaceLimits.memory;
+
+    // multiply 1000 can avoid 0.1 * 3 > 0.3
+    if (cpu * 1000 * instances > maxCpu * 1000) {
+      return true;
+    }
+
+    if (memory * instances > maxMemory) {
+      return true;
+    }
+
+    if (this.formValues.DeploymentType === this.ApplicationDeploymentTypes.Replicated) {
+      return this.nodesLimits.overflowForReplica(cpu, memory, instances);
+    }
+
+    // DeploymentType == 'Global'
+    return this.nodesLimits.overflowForGlobal(cpu, memory);
+  }
+
+  autoScalerOverflow() {
+    const instances = this.formValues.AutoScaler.MaxReplicas;
+    const cpu = this.formValues.CpuLimit;
+    const maxCpu = this.state.namespaceLimits.cpu;
+    const memory = KubernetesResourceReservationHelper.bytesValue(this.formValues.MemoryLimit);
+    const maxMemory = this.state.namespaceLimits.memory;
+
+    // multiply 1000 can avoid 0.1 * 3 > 0.3
+    if (cpu * 1000 * instances > maxCpu * 1000) {
+      return true;
+    }
+
+    if (memory * instances > maxMemory) {
+      return true;
+    }
+
+    return this.nodesLimits.overflowForReplica(cpu, memory, instances);
+  }
+
+  publishViaIngressEnabled() {
+    return this.ingresses.length;
+  }
+
+  isEditAndNoChangesMade() {
+    if (!this.state.isEdit) return false;
+    const changes = JsonPatch.compare(this.savedFormValues, this.formValues);
+    this.editChanges = _.filter(changes, (change) => !_.includes(change.path, '$$hashKey') && change.path !== '/ApplicationType');
+    return !this.editChanges.length;
+  }
+
+  /* #region  PERSISTED FOLDERS */
+  /* #region  BUTTONS STATES */
+  isAddPersistentFolderButtonShown() {
+    return !this.isEditAndStatefulSet() && this.formValues.Containers.length <= 1;
+  }
+
+  isNewVolumeButtonDisabled(index) {
+    return this.isEditAndExistingPersistedFolder(index);
+  }
+
+  isExistingVolumeButtonDisabled() {
+    return !this.hasAvailableVolumes() || (this.isEdit && this.application.ApplicationType === this.ApplicationTypes.StatefulSet);
+  }
+  /* #endregion */
+
+  hasAvailableVolumes() {
+    return this.availableVolumes.length > 0;
+  }
+
+  isEditAndExistingPersistedFolder(index) {
+    return this.state.isEdit && this.formValues.PersistedFolders[index].persistentVolumeClaimName;
+  }
+  /* #endregion */
+
+  isNonScalable() {
+    const scalable = this.supportScalableReplicaDeployment();
+    const global = this.supportGlobalDeployment();
+    const replica = this.formValues.ReplicaCount > 1;
+    const replicated = this.formValues.DeploymentType === this.ApplicationDeploymentTypes.Replicated;
+    const res = (replicated && !scalable && replica) || (!replicated && !global);
+    return res;
+  }
+
+  isDeployUpdateButtonDisabled() {
+    const overflow = this.resourceReservationsOverflow();
+    const autoScalerOverflow = this.autoScalerOverflow();
+    const inProgress = this.state.actionInProgress;
+    const invalid = !this.isValid();
+    const hasNoChanges = this.isEditAndNoChangesMade();
+    const nonScalable = this.isNonScalable();
+    const stackNameInvalid = this.state.stackNameError !== '';
+    return overflow || autoScalerOverflow || inProgress || invalid || hasNoChanges || nonScalable || stackNameInvalid;
+  }
+
+  isUpdateApplicationViaWebEditorButtonDisabled() {
+    return (this.savedFormValues.StackName === this.formValues.StackName && !this.state.isEditorDirty) || this.state.updateWebEditorInProgress;
+  }
+
+  isExternalApplication() {
+    if (this.application) {
+      return KubernetesApplicationHelper.isExternalApplication(this.application);
+    } else {
+      return false;
+    }
+  }
+  /* #endregion */
+
+  /* #region  DATA AUTO REFRESH */
+  updateSliders(namespaceWithQuota) {
+    const quota = namespaceWithQuota.Quota;
+    let minCpu = 0,
+      minMemory = 0,
+      maxCpu = this.state.namespaceLimits.cpu,
+      maxMemory = this.state.namespaceLimits.memory;
+
+    if (quota) {
+      if (quota.CpuLimit) {
+        minCpu = KubernetesApplicationQuotaDefaults.CpuLimit;
+      }
+      if (quota.MemoryLimit) {
+        minMemory = KubernetesResourceReservationHelper.bytesValue(KubernetesApplicationQuotaDefaults.MemoryLimit);
+      }
+    }
+
+    maxCpu = Math.min(maxCpu, this.nodesLimits.MaxCPU);
+    maxMemory = Math.min(maxMemory, this.nodesLimits.MaxMemory);
+
+    if (maxMemory < minMemory) {
+      minMemory = 0;
+      maxMemory = 0;
+    }
+
+    this.state.sliders.memory.min = KubernetesResourceReservationHelper.megaBytesValue(minMemory);
+    this.state.sliders.memory.max = KubernetesResourceReservationHelper.megaBytesValue(maxMemory);
+    this.state.sliders.cpu.min = minCpu;
+    this.state.sliders.cpu.max = _.floor(maxCpu, 2);
+    if (!this.state.isEdit) {
+      this.formValues.CpuLimit = minCpu;
+      this.formValues.MemoryLimit = KubernetesResourceReservationHelper.megaBytesValue(minMemory);
+    }
+  }
+
+  updateNamespaceLimits(namespaceWithQuota) {
+    return this.$async(async () => {
+      let maxCpu = this.state.nodes.cpu;
+      let maxMemory = this.state.nodes.memory;
+
+      const quota = namespaceWithQuota.Quota;
+
+      this.state.resourcePoolHasQuota = false;
+
+      if (quota) {
+        if (quota.CpuLimit) {
+          this.state.resourcePoolHasQuota = true;
+          maxCpu = quota.CpuLimit - quota.CpuLimitUsed;
+          if (this.state.isEdit && this.savedFormValues.CpuLimit) {
+            maxCpu += this.savedFormValues.CpuLimit * this.effectiveInstances();
+          }
+        }
+
+        if (quota.MemoryLimit) {
+          this.state.resourcePoolHasQuota = true;
+          maxMemory = quota.MemoryLimit - quota.MemoryLimitUsed;
+          if (this.state.isEdit && this.savedFormValues.MemoryLimit) {
+            maxMemory += KubernetesResourceReservationHelper.bytesValue(this.savedFormValues.MemoryLimit) * this.effectiveInstances();
+          }
+        }
+      }
+
+      this.state.namespaceLimits.cpu = maxCpu;
+      this.state.namespaceLimits.memory = maxMemory;
+    });
+  }
+
+  refreshStacks(namespace) {
+    return this.$async(async () => {
+      try {
+        this.stacks = await this.KubernetesStackService.get(namespace);
+      } catch (err) {
+        this.Notifications.error('Failure', err, 'Unable to retrieve stacks');
+      }
+    });
+  }
+
+  refreshConfigurations(namespace) {
+    return this.$async(async () => {
+      try {
+        this.configurations = await this.KubernetesConfigurationService.get(namespace);
+        this.configMaps = this.configurations.filter((configuration) => configuration.Kind === KubernetesConfigurationKinds.CONFIGMAP);
+        this.secrets = this.configurations.filter((configuration) => configuration.Kind === KubernetesConfigurationKinds.SECRET);
+      } catch (err) {
+        this.Notifications.error('Failure', err, 'Unable to retrieve configurations');
+      }
+    });
+  }
+
+  refreshApplications(namespace) {
+    return this.$async(async () => {
+      try {
+        this.applications = await this.KubernetesApplicationService.get(namespace);
+        this.applicationNames = _.map(this.applications, 'Name');
+      } catch (err) {
+        this.Notifications.error('Failure', err, 'Unable to retrieve applications');
+      }
+    });
+  }
+
+  refreshVolumes(namespace) {
+    return this.$async(async () => {
+      try {
+        const storageClasses = this.endpoint.Kubernetes.Configuration.StorageClasses;
+        const volumes = await this.KubernetesVolumeService.get(namespace, storageClasses);
+        _.forEach(volumes, (volume) => {
+          volume.Applications = KubernetesVolumeHelper.getUsingApplications(volume, this.applications);
+        });
+        this.volumes = volumes;
+        const filteredVolumes = _.filter(this.volumes, (volume) => {
+          const isUnused = !isVolumeUsed(volume);
+          const isRWX = volume.PersistentVolumeClaim.storageClass && _.includes(volume.PersistentVolumeClaim.storageClass.AccessModes, 'RWX');
+          return isUnused || isRWX;
+        });
+        this.availableVolumes = filteredVolumes;
+      } catch (err) {
+        this.Notifications.error('Failure', err, 'Unable to retrieve volumes');
+      }
+    });
+  }
+
+  refreshIngresses(namespace) {
+    return this.$async(async () => {
+      try {
+        this.ingresses = await this.KubernetesIngressService.get(namespace);
+        this.ingressPaths = this.ingresses.flatMap((ingress) => ingress.Paths);
+        this.ingressHostnames = this.ingresses.length ? this.ingresses[0].Hosts : [];
+        if (!this.publishViaIngressEnabled()) {
+          if (this.savedFormValues) {
+            this.formValues.PublishingType = this.savedFormValues.PublishingType;
+          } else {
+            this.formValues.PublishingType = this.KubernetesApplicationServiceTypes.ClusterIP;
+          }
+        }
+        this.formValues.OriginalIngresses = this.ingresses;
+      } catch (err) {
+        this.Notifications.error('Failure', err, 'Unable to retrieve ingresses');
+      }
+    });
+  }
+
+  refreshNamespaceData(namespace) {
+    return this.$async(async () => {
+      await Promise.all([
+        this.refreshStacks(namespace),
+        this.refreshConfigurations(namespace),
+        this.refreshApplications(namespace),
+        this.refreshIngresses(namespace),
+        this.refreshVolumes(namespace),
+      ]);
+    });
+  }
+
+  resetFormValues() {
+    this.clearConfigMaps();
+    this.clearSecrets();
+    this.resetPersistedFolders();
+  }
+
+  onChangeNamespaceName(namespaceName) {
+    return this.$async(async () => {
+      this.formValues.ResourcePool.Namespace.Name = namespaceName;
+      const namespaceWithQuota = await this.KubernetesResourcePoolService.get(namespaceName);
+      this.updateNamespaceLimits(namespaceWithQuota);
+      this.updateSliders(namespaceWithQuota);
+      await this.refreshNamespaceData(namespaceName);
+      this.resetFormValues();
+    });
+  }
+  /* #endregion */
+
+  /* #region  ACTIONS */
+  async deployApplicationAsync() {
+    this.state.actionInProgress = true;
+    try {
+      this.formValues.ApplicationOwner = this.Authentication.getUserDetails().username;
+      // combine the secrets and configmap form values when submitting the form
+      _.remove(this.formValues.Configurations, (item) => item.selectedConfiguration === undefined);
+      await this.KubernetesApplicationService.create(this.formValues, this.originalServicePorts, this.deploymentOptions.hideStacksFunctionality);
+      this.Notifications.success('Request to deploy application successfully submitted', this.formValues.Name);
+      this.$state.go('kubernetes.applications');
+    } catch (err) {
+      this.Notifications.error('Failure', err, 'Unable to create application');
+    } finally {
+      this.state.actionInProgress = false;
+    }
+  }
+
+  async updateApplicationAsync(ingressesToUpdate) {
+    if (ingressesToUpdate.length) {
+      try {
+        await Promise.all(ingressesToUpdate.map((ing) => updateIngress(this.endpoint.Id, ing)));
+        this.Notifications.success('Success', `Ingress ${ingressesToUpdate.length > 1 ? 'rules' : 'rule'} successfully updated`);
+      } catch (error) {
+        this.Notifications.error('Failure', error, 'Unable to update ingress');
+      }
+    }
+
+    try {
+      this.state.actionInProgress = true;
+      await this.KubernetesApplicationService.patch(this.savedFormValues, this.formValues, false, this.originalServicePorts);
+      this.Notifications.success('Success', 'Request to update application successfully submitted');
+      this.$state.go(
+        'kubernetes.applications.application',
+        { name: this.application.Name, namespace: this.application.ResourcePool, endpointId: this.endpoint.Id },
+        { inherit: false }
+      );
+    } catch (err) {
+      this.Notifications.error('Failure', err, 'Unable to update application');
+    } finally {
+      this.state.actionInProgress = false;
+    }
+  }
+
+  async confirmUpdateApplicationAsync() {
+    const [ingressesToUpdate, servicePortsToUpdate] = await this.checkIngressesToUpdate();
+    // if there is an ingressesToUpdate, then show a warning modal with asking if they want to update the ingresses
+    if (ingressesToUpdate.length) {
+      const result = await confirmUpdateAppIngress(ingressesToUpdate, servicePortsToUpdate);
+      if (!result) {
+        return;
+      }
+
+      const { noMatch } = result;
+      if (!noMatch) {
+        return this.$async(this.updateApplicationAsync, []);
+      }
+      if (noMatch) {
+        return this.$async(this.updateApplicationAsync, ingressesToUpdate);
+      }
+    } else {
+      confirmUpdate('Updating the application may cause a service interruption. Do you wish to continue?', (confirmed) => {
+        if (confirmed) {
+          return this.$async(this.updateApplicationAsync, []);
+        }
+      });
+    }
+  }
+
+  // check if service ports with ingresses have changed and allow the user to update the ingress to the new port values with a modal
+  async checkIngressesToUpdate() {
+    let ingressesToUpdate = [];
+    let servicePortsToUpdate = [];
+    const fullIngresses = await getIngresses(this.endpoint.Id);
+    this.formValues.Services.forEach((updatedService) => {
+      const oldServiceIndex = this.oldFormValues.Services.findIndex((oldService) => oldService.Name === updatedService.Name);
+      const numberOfPortsInOldService = this.oldFormValues.Services[oldServiceIndex] && this.oldFormValues.Services[oldServiceIndex].Ports.length;
+      // if the service has an ingress and there is the same number of ports or more in the updated service
+      if (updatedService.Ingress && numberOfPortsInOldService && numberOfPortsInOldService <= updatedService.Ports.length) {
+        const updatedOldPorts = updatedService.Ports.slice(0, numberOfPortsInOldService);
+        const ingressesForService = fullIngresses.filter((ing) => {
+          if (ing.Paths) {
+            const ingServiceNames = ing.Paths.map((path) => path.ServiceName);
+            if (ingServiceNames.includes(updatedService.Name)) {
+              return true;
+            }
+          }
+        });
+        ingressesForService.forEach((ingressForService) => {
+          updatedOldPorts.forEach((servicePort, pIndex) => {
+            if (servicePort.ingressPaths) {
+              // if there isn't a ingress path that has a matching service name and port
+              const doesIngressPathMatchServicePort = ingressForService.Paths.find((ingPath) => ingPath.ServiceName === updatedService.Name && ingPath.Port === servicePort.port);
+              if (!doesIngressPathMatchServicePort) {
+                // then find the ingress path index to update by looking for the matching port in the old form values
+                const oldServicePort = this.oldFormValues.Services[oldServiceIndex].Ports[pIndex].port;
+                const newServicePort = servicePort.port;
+
+                const ingressPathIndex = ingressForService.Paths.findIndex((ingPath) => {
+                  return ingPath.ServiceName === updatedService.Name && ingPath.Port === oldServicePort;
+                });
+                if (ingressPathIndex !== -1) {
+                  // if the ingress to update isn't in the ingressesToUpdate list
+                  const ingressUpdateIndex = ingressesToUpdate.findIndex((ing) => ing.Name === ingressForService.Name);
+                  if (ingressUpdateIndex === -1) {
+                    // then add it to the list with the new port
+                    const ingressToUpdate = angular.copy(ingressForService);
+                    ingressToUpdate.Paths[ingressPathIndex].Port = newServicePort;
+                    ingressesToUpdate.push(ingressToUpdate);
+                  } else {
+                    // if the ingress is already in the list, then update the path with the new port
+                    ingressesToUpdate[ingressUpdateIndex].Paths[ingressPathIndex].Port = newServicePort;
+                  }
+                  if (!servicePortsToUpdate.includes(newServicePort)) {
+                    servicePortsToUpdate.push(newServicePort);
+                  }
+                }
+              }
+            }
+          });
+        });
+      }
+    });
+    return [ingressesToUpdate, servicePortsToUpdate];
+  }
+
+  deployApplication() {
+    if (this.state.isEdit) {
+      return this.$async(this.confirmUpdateApplicationAsync);
+    } else {
+      return this.$async(this.deployApplicationAsync);
+    }
+  }
+  /* #endregion */
+
+  /* #region  APPLICATION - used on edit context only */
+  getApplication() {
+    return this.$async(async () => {
+      try {
+        const namespace = this.$state.params.namespace;
+        const storageClasses = this.endpoint.Kubernetes.Configuration.StorageClasses;
+
+        [this.application, this.persistentVolumeClaims] = await Promise.all([
+          this.KubernetesApplicationService.get(namespace, this.$state.params.name),
+          this.KubernetesPersistentVolumeClaimService.get(namespace, storageClasses),
+        ]);
+      } catch (err) {
+        this.Notifications.error('Failure', err, 'Unable to retrieve application details');
+      }
+    });
+  }
+
+  async parseImageConfiguration(imageModel) {
+    return this.$async(async () => {
+      try {
+        return await this.RegistryService.retrievePorRegistryModelFromRepository(imageModel.Image, this.endpoint.Id, imageModel.Registry.Id, this.$state.params.namespace);
+      } catch (err) {
+        this.Notifications.error('Failure', err, 'Unable to retrieve registry');
+        return imageModel;
+      }
+    });
+  }
+  /* #endregion */
+
+  /* #region  ON INIT */
+  $onInit() {
+    return this.$async(async () => {
+      try {
+        this.endpoint = await this.EndpointService.endpoint(this.endpoint.Id);
+        await this.StateManager.updateEndpointState(this.endpoint);
+
+        this.storageClasses = this.endpoint.Kubernetes.Configuration.StorageClasses;
+        this.state.useLoadBalancer = this.endpoint.Kubernetes.Configuration.UseLoadBalancer;
+        this.state.useServerMetrics = this.endpoint.Kubernetes.Configuration.UseServerMetrics;
+
+        this.deploymentOptions = await getGlobalDeploymentOptions();
+
+        const [resourcePools, nodes, nodesLimits] = await Promise.all([
+          this.KubernetesResourcePoolService.get(),
+          this.KubernetesNodeService.get(),
+          this.KubernetesNodesLimitsService.get(),
+        ]);
+        this.nodesLimits = nodesLimits;
+
+        const nonSystemNamespaces = _.filter(
+          resourcePools,
+          (resourcePool) => !KubernetesNamespaceHelper.isSystemNamespace(resourcePool.Namespace.Name) && resourcePool.Namespace.Status === 'Active'
+        );
+
+        this.allNamespaces = resourcePools.map(({ Namespace }) => Namespace.Name);
+        this.resourcePools = _.sortBy(nonSystemNamespaces, ({ Namespace }) => (Namespace.Name === 'default' ? 0 : 1));
+
+        // this.state.nodes.memory and this.state.nodes.cpu are used to calculate the slider limits, so set them before calling updateSliders()
+        _.forEach(nodes, (item) => {
+          this.state.nodes.memory += filesizeParser(item.Memory);
+          this.state.nodes.cpu += item.CPU;
+        });
+
+        var namespace = '';
+        this.formValues.ResourcePool = this.resourcePools[0];
+
+        if (this.resourcePools.length) {
+          if (this.state.isEdit) {
+            namespace = this.$state.params.namespace;
+            this.formValues.ResourcePool = _.find(this.resourcePools, ['Namespace.Name', namespace]);
+          }
+
+          namespace = this.formValues.ResourcePool.Namespace.Name;
+          this.namespaceWithQuota = await this.KubernetesResourcePoolService.get(namespace);
+          this.formValues.ResourcePool.Quota = this.namespaceWithQuota.Quota;
+
+          // this.savedFormValues is being used in updateNamespaceLimits behind a check to see isEdit
+          if (this.state.isEdit) {
+            this.savedFormValues = angular.copy(this.formValues);
+          }
+
+          this.updateNamespaceLimits(this.namespaceWithQuota);
+          this.updateSliders(this.namespaceWithQuota);
+        }
+
+        if (!this.formValues.ResourcePool) {
+          return;
+        }
+
+        this.nodesLabels = KubernetesNodeHelper.generateNodeLabelsFromNodes(nodes);
+        this.nodeNumber = nodes.length;
+
+        await this.refreshNamespaceData(namespace);
+
+        if (this.state.isEdit) {
+          await this.getApplication();
+          this.formValues = KubernetesApplicationConverter.applicationToFormValues(
+            this.application,
+            this.resourcePools,
+            this.configurations,
+            this.persistentVolumeClaims,
+            this.nodesLabels,
+            this.ingresses
+          );
+
+          this.formValues.Services = this.formValues.Services || [];
+          this.originalServicePorts = structuredClone(this.formValues.Services.flatMap((service) => service.Ports));
+          this.originalIngressPaths = structuredClone(this.originalServicePorts.flatMap((port) => port.ingressPaths).filter((ingressPath) => ingressPath.Host));
+
+          if (this.formValues.CpuLimit) {
+            this.state.isExistingCPUReservationUnchanged = true;
+          }
+          if (this.formValues.MemoryLimit) {
+            this.state.isExistingMemoryReservationUnchanged = true;
+          }
+
+          if (this.application.ApplicationKind) {
+            this.state.appType = KubernetesDeploymentTypes[this.application.ApplicationKind.toUpperCase()];
+            if (this.application.ApplicationKind === KubernetesDeploymentTypes.URL) {
+              this.state.appType = KubernetesDeploymentTypes.CONTENT;
+            }
+
+            if (this.application.StackId) {
+              this.stack = await this.StackService.stack(this.application.StackId);
+              if (this.state.appType === KubernetesDeploymentTypes.CONTENT) {
+                this.stackFileContent = await this.StackService.getStackFile(this.application.StackId);
+                this.oldStackFileContent = this.stackFileContent;
+              }
+            }
+
+            if (this.application.ApplicationKind === KubernetesDeploymentTypes.GIT) {
+              this.$state.go(
+                'kubernetes.applications.application',
+                {
+                  name: this.application.Name,
+                  namespace: this.application.ResourcePool,
+                  endpointId: this.endpoint.Id,
+                  openGitSettings: true,
+                },
+                { inherit: false }
+              );
+              return;
+            }
+          }
+
+          this.formValues.OriginalIngresses = this.ingresses;
+          this.formValues.ImageModel = await this.parseImageConfiguration(this.formValues.ImageModel);
+
+          if (this.application.ApplicationType !== KubernetesApplicationTypes.StatefulSet) {
+            _.forEach(this.formValues.PersistedFolders, (persistedFolder) => {
+              const volume = _.find(this.availableVolumes, ['PersistentVolumeClaim.Name', persistedFolder.persistentVolumeClaimName]);
+              if (volume) {
+                persistedFolder.useNewVolume = false;
+                persistedFolder.existingVolume = volume;
+              }
+            });
+          }
+          this.formValues.OriginalPersistedFolders = this.formValues.PersistedFolders;
+          await this.refreshNamespaceData(namespace);
+
+          this.savedFormValues = angular.copy(this.formValues);
+          this.updateNamespaceLimits(this.namespaceWithQuota);
+          this.updateSliders(this.namespaceWithQuota);
+        } else {
+          this.formValues.AutoScaler = KubernetesApplicationHelper.generateAutoScalerFormValueFromHorizontalPodAutoScaler(null, this.formValues.ReplicaCount);
+        }
+
+        if (this.state.isEdit) {
+          this.nodesLimits.excludesPods(this.application.Pods, this.formValues.CpuLimit, KubernetesResourceReservationHelper.bytesValue(this.formValues.MemoryLimit));
+
+          // Workaround for EE-6118
+          if (this.stack && !this.stack.EndpointId) {
+            this.stack.EndpointId = this.endpoint.Id;
+          }
+        }
+
+        this.oldFormValues = angular.copy(this.formValues);
+        this.savedFormValues = angular.copy(this.formValues);
+        this.updateNamespaceLimits(this.namespaceWithQuota);
+        this.updateSliders(this.namespaceWithQuota);
+      } catch (err) {
+        this.Notifications.error('Failure', err, 'Unable to load view data');
+      } finally {
+        this.state.viewReady = true;
+      }
+      // get all nodeport services in the cluster, to validate unique nodeports in the form
+      // this is below the try catch, to not block the page rendering
+      const allSettledServices = await Promise.allSettled(this.resourcePools.map((namespace) => getServices(this.endpoint.Id, namespace.Namespace.Name)));
+      const allServices = allSettledServices
+        .filter((settledService) => settledService.status === 'fulfilled' && settledService.value)
+        .map((fulfilledService) => fulfilledService.value)
+        .flat();
+      this.state.nodePortServices = allServices.filter((service) => service.Type === 'NodePort');
+    });
+  }
+
+  /* #endregion */
+}
+
+export default KubernetesCreateApplicationController;
+angular.module('portainer.kubernetes').controller('KubernetesCreateApplicationController', KubernetesCreateApplicationController);
diff --git a/app/kubernetes/views/applications/logs/logs.html b/app/kubernetes/views/applications/logs/logs.html
new file mode 100644
index 0000000..06d45ec
--- /dev/null
+++ b/app/kubernetes/views/applications/logs/logs.html
@@ -0,0 +1,84 @@
+<page-header
+  ng-if="ctrl.state.viewReady"
+  title="'Application logs'"
+  breadcrumbs="[
+    { label:'Namespaces', link:'kubernetes.resourcePools' },
+    {
+      label:ctrl.application.ResourcePool,
+      link: 'kubernetes.resourcePools.resourcePool',
+      linkParams:{ id: ctrl.application.ResourcePool }
+    },
+    { label:'Applications', link:'kubernetes.applications' },
+    {
+      label:ctrl.application.Name,
+      link: 'kubernetes.applications.application',
+      linkParams:{ name: ctrl.application.Name, namespace: ctrl.application.ResourcePool }
+    },
+     'Pods',
+     ctrl.podName,
+     'Containers',
+     ctrl.containerName,
+     'Logs'
+     ]"
+  reload="true"
+>
+</page-header>
+
+<kubernetes-view-loading view-ready="ctrl.state.viewReady"></kubernetes-view-loading>
+
+<div ng-if="ctrl.state.viewReady">
+  <div class="row">
+    <div class="col-sm-12">
+      <rd-widget>
+        <rd-widget-body>
+          <form class="form-horizontal row" autocomplete="off">
+            <div class="col-sm-12 form-section-title"> Actions </div>
+            <!-- auto-refresh -->
+            <div class="form-group">
+              <label class="col-sm-3 col-lg-2 control-label text-left">
+                Auto-refresh
+                <portainer-tooltip message="'Automatically refresh logs every 5 seconds'"></portainer-tooltip>
+              </label>
+              <div class="col-sm-8">
+                <label class="switch"> <input type="checkbox" ng-model="ctrl.state.autoRefresh" ng-change="ctrl.updateAutoRefresh()" /><span class="slider round"></span> </label>
+              </div>
+            </div>
+            <!-- !auto-refresh -->
+            <!-- search -->
+            <div class="form-group">
+              <label for="logs_search" class="col-sm-3 col-lg-2 control-label text-left"> Search </label>
+              <div class="col-sm-8">
+                <input
+                  class="form-control"
+                  type="text"
+                  name="logs_search"
+                  ng-model="ctrl.state.search"
+                  ng-change="ctrl.state.selectedLines.length = 0;"
+                  placeholder="Filter..."
+                  auto-focus
+                />
+              </div>
+            </div>
+            <!-- !search -->
+            <!-- actions -->
+            <div class="form-group">
+              <div class="col-sm-12">
+                <button class="btn btn-primary btn-sm !ml-0" type="button" ng-click="ctrl.downloadLogs()"> <pr-icon icon="'download'"></pr-icon> Download logs </button>
+              </div>
+            </div>
+            <!-- !actions -->
+          </form>
+        </rd-widget-body>
+      </rd-widget>
+    </div>
+  </div>
+
+  <div class="row">
+    <div class="col-sm-12 h-[max(400px,calc(100vh-380px))]">
+      <pre class="log_viewer widget">
+        <div ng-repeat="log in ctrl.state.filteredLogs = (ctrl.applicationLogs | filter:{ 'line': ctrl.state.search }) track by $index" class="line" ng-if="log.line"><p class="inner_line"><span ng-repeat="span in log.spans track by $index" ng-style="{ 'color': span.fgColor, 'background-color': span.bgColor, 'font-weight': span.fontWeight }">{{ span.text }}</span></p></div>
+        <div ng-if="ctrl.applicationLogs.length && !ctrl.state.filteredLogs.length" class="line"><p class="inner_line">No log line matching the '{{ ctrl.state.search }}' filter</p></div>
+        <div ng-if="ctrl.applicationLogs.length === 0" class="line"><p class="inner_line">No logs available</p></div></pre>
+    </div>
+  </div>
+</div>
diff --git a/app/kubernetes/views/applications/logs/logs.js b/app/kubernetes/views/applications/logs/logs.js
new file mode 100644
index 0000000..513bf92
--- /dev/null
+++ b/app/kubernetes/views/applications/logs/logs.js
@@ -0,0 +1,8 @@
+angular.module('portainer.kubernetes').component('kubernetesApplicationLogsView', {
+  templateUrl: './logs.html',
+  controller: 'KubernetesApplicationLogsController',
+  controllerAs: 'ctrl',
+  bindings: {
+    $transition$: '<',
+  },
+});
diff --git a/app/kubernetes/views/applications/logs/logsController.js b/app/kubernetes/views/applications/logs/logsController.js
new file mode 100644
index 0000000..37cae6c
--- /dev/null
+++ b/app/kubernetes/views/applications/logs/logsController.js
@@ -0,0 +1,96 @@
+import angular from 'angular';
+
+import { concatLogsToString, formatLogs } from '@/docker/helpers/logHelper';
+
+class KubernetesApplicationLogsController {
+  /* @ngInject */
+  constructor($async, $state, $interval, Notifications, KubernetesApplicationService, KubernetesPodService, Blob, FileSaver) {
+    this.$async = $async;
+    this.$state = $state;
+    this.$interval = $interval;
+    this.Notifications = Notifications;
+    this.KubernetesApplicationService = KubernetesApplicationService;
+    this.KubernetesPodService = KubernetesPodService;
+    this.Blob = Blob;
+    this.FileSaver = FileSaver;
+
+    this.onInit = this.onInit.bind(this);
+    this.stopRepeater = this.stopRepeater.bind(this);
+    this.getApplicationLogsAsync = this.getApplicationLogsAsync.bind(this);
+  }
+
+  updateAutoRefresh() {
+    if (this.state.autoRefresh) {
+      this.setUpdateRepeater();
+      return;
+    }
+
+    this.stopRepeater();
+  }
+
+  stopRepeater() {
+    if (angular.isDefined(this.repeater)) {
+      this.$interval.cancel(this.repeater);
+      this.repeater = null;
+    }
+  }
+
+  setUpdateRepeater() {
+    this.repeater = this.$interval(this.getApplicationLogsAsync, this.state.refreshRate);
+  }
+
+  downloadLogs() {
+    const logsAsString = concatLogsToString(this.applicationLogs);
+    const data = new this.Blob([logsAsString]);
+    this.FileSaver.saveAs(data, this.podName + '_logs.txt');
+  }
+
+  async getApplicationLogsAsync() {
+    try {
+      const rawLogs = await this.KubernetesPodService.logs(this.application.ResourcePool, this.podName, this.containerName);
+      this.applicationLogs = formatLogs(rawLogs);
+    } catch (err) {
+      this.stopRepeater();
+      this.Notifications.error('Failure', err, 'Unable to retrieve application logs');
+    }
+  }
+
+  async onInit() {
+    this.state = {
+      autoRefresh: false,
+      refreshRate: 5000, // 5 seconds
+      search: '',
+      viewReady: false,
+    };
+
+    const podName = this.$transition$.params().pod;
+    const applicationName = this.$transition$.params().name;
+    const namespace = this.$transition$.params().namespace;
+    const containerName = this.$transition$.params().container;
+
+    this.applicationLogs = [];
+    this.podName = podName;
+    this.containerName = containerName;
+
+    try {
+      this.application = await this.KubernetesApplicationService.get(namespace, applicationName);
+      await this.getApplicationLogsAsync();
+    } catch (err) {
+      this.Notifications.error('Failure', err, 'Unable to retrieve application logs');
+      this.stopRepeater();
+    } finally {
+      this.state.viewReady = true;
+    }
+  }
+
+  $onInit() {
+    return this.$async(this.onInit);
+  }
+
+  $onDestroy() {
+    this.stopRepeater();
+  }
+}
+
+export default KubernetesApplicationLogsController;
+angular.module('portainer.kubernetes').controller('KubernetesApplicationLogsController', KubernetesApplicationLogsController);
diff --git a/app/kubernetes/views/applications/stats/stats.html b/app/kubernetes/views/applications/stats/stats.html
new file mode 100644
index 0000000..1d39851
--- /dev/null
+++ b/app/kubernetes/views/applications/stats/stats.html
@@ -0,0 +1,118 @@
+<page-header
+  ng-if="ctrl.state.viewReady"
+  title="'Application stats'"
+  breadcrumbs="[
+    { label:'Namespaces', link:'kubernetes.resourcePools' },
+    {
+      label:ctrl.state.transition.namespace,
+      link: 'kubernetes.resourcePools.resourcePool',
+      linkParams:{ id: ctrl.state.transition.namespace }
+    },
+    { label:'Applications', link:'kubernetes.applications' },
+    {
+      label:ctrl.state.transition.applicationName,
+      link: 'kubernetes.applications.application',
+      linkParams:{ name: ctrl.state.transition.applicationName, namespace: ctrl.state.transition.namespace }
+    },
+     'Pods',
+     ctrl.state.transition.podName,
+     'Containers',
+     ctrl.state.transition.containerName,
+     'Stats'
+     ]"
+  reload="true"
+>
+</page-header>
+
+<kubernetes-view-loading view-ready="ctrl.state.viewReady"></kubernetes-view-loading>
+
+<information-panel ng-if="!ctrl.state.getMetrics" title-text="Unable to retrieve container metrics">
+  <span class="small text-warning vertical-center">
+    <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon>
+    Portainer was unable to retrieve any metrics associated to that container. Please contact your administrator to ensure that the Kubernetes metrics feature is properly
+    configured.
+  </span>
+</information-panel>
+<div class="row" ng-if="ctrl.state.getMetrics">
+  <div class="col-md-12">
+    <rd-widget>
+      <div class="toolBar px-5 pt-5">
+        <div class="toolBarTitle flex">
+          <div class="widget-icon space-right">
+            <pr-icon icon="'info'"></pr-icon>
+          </div>
+          <span class="vertical-center"> About statistics </span>
+        </div>
+      </div>
+      <rd-widget-body>
+        <form class="form-horizontal">
+          <div class="form-group">
+            <div class="col-sm-12">
+              <span class="small text-warning">
+                This view displays real-time statistics about the container <b>{{ ctrl.state.transition.containerName | trimcontainername }}</b
+                >.
+              </span>
+            </div>
+          </div>
+          <div class="form-group">
+            <label for="refreshRate" class="col-sm-3 col-md-2 col-lg-2 margin-sm-top control-label text-left"> Refresh rate </label>
+            <div class="col-sm-3 col-md-2">
+              <select id="refreshRate" ng-model="ctrl.state.refreshRate" ng-change="ctrl.changeUpdateRepeater()" class="form-control" data-cy="app-stats-refresh-rate">
+                <option value="30">30s</option>
+                <option value="60">60s</option>
+              </select>
+            </div>
+            <span>
+              <pr-icon id="refreshRateChange" icon="'check'" mode="'success'" size="'sm'"></pr-icon>
+            </span>
+          </div>
+          <div class="form-group" ng-if="ctrl.state.networkStatsUnavailable">
+            <div class="col-sm-12">
+              <span class="small text-muted">
+                <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon>
+                Network stats are unavailable for this container.
+              </span>
+            </div>
+          </div>
+        </form>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
+
+<div class="row" ng-if="ctrl.state.getMetrics">
+  <div class="col-lg-6 col-md-12 col-sm-12">
+    <rd-widget>
+      <div class="toolBar px-5 pt-5">
+        <div class="toolBarTitle flex">
+          <div class="widget-icon space-right">
+            <pr-icon icon="'svg-memory'"></pr-icon>
+          </div>
+          <span class="vertical-center"> Memory usage </span>
+        </div>
+      </div>
+      <rd-widget-body>
+        <div class="chart-container" style="position: relative">
+          <canvas id="memoryChart" width="770" height="300"></canvas>
+        </div>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+  <div class="col-lg-6 col-md-12 col-sm-12" ng-if="!ctrl.state.networkStatsUnavailable">
+    <rd-widget>
+      <div class="toolBar px-5 pt-5">
+        <div class="toolBarTitle flex">
+          <div class="widget-icon space-right">
+            <pr-icon icon="'cpu'"></pr-icon>
+          </div>
+          <span class="vertical-center"> CPU usage </span>
+        </div>
+      </div>
+      <rd-widget-body>
+        <div class="chart-container" style="position: relative">
+          <canvas id="cpuChart" width="770" height="300"></canvas>
+        </div>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
diff --git a/app/kubernetes/views/applications/stats/stats.js b/app/kubernetes/views/applications/stats/stats.js
new file mode 100644
index 0000000..01496a9
--- /dev/null
+++ b/app/kubernetes/views/applications/stats/stats.js
@@ -0,0 +1,8 @@
+angular.module('portainer.kubernetes').component('kubernetesApplicationStatsView', {
+  templateUrl: './stats.html',
+  controller: 'KubernetesApplicationStatsController',
+  controllerAs: 'ctrl',
+  bindings: {
+    $transition$: '<',
+  },
+});
diff --git a/app/kubernetes/views/applications/stats/statsController.js b/app/kubernetes/views/applications/stats/statsController.js
new file mode 100644
index 0000000..6c70520
--- /dev/null
+++ b/app/kubernetes/views/applications/stats/statsController.js
@@ -0,0 +1,173 @@
+import angular from 'angular';
+import moment from 'moment';
+import _ from 'lodash-es';
+import filesizeParser from 'filesize-parser';
+import KubernetesPodConverter from '@/kubernetes/pod/converter';
+import { getMetricsForPod } from '@/react/kubernetes/metrics/metrics.ts';
+import { parseCPU } from '@/react/kubernetes/utils';
+
+class KubernetesApplicationStatsController {
+  /* @ngInject */
+  constructor($async, $state, $interval, $document, Notifications, KubernetesPodService, KubernetesNodeService, ChartService) {
+    this.$async = $async;
+    this.$state = $state;
+    this.$interval = $interval;
+    this.$document = $document;
+    this.Notifications = Notifications;
+    this.KubernetesPodService = KubernetesPodService;
+    this.KubernetesNodeService = KubernetesNodeService;
+    this.ChartService = ChartService;
+
+    this.onInit = this.onInit.bind(this);
+    this.initCharts = this.initCharts.bind(this);
+  }
+
+  changeUpdateRepeater() {
+    var cpuChart = this.cpuChart;
+    var memoryChart = this.memoryChart;
+
+    this.stopRepeater();
+    this.setUpdateRepeater(cpuChart, memoryChart);
+    $('#refreshRateChange').show();
+    $('#refreshRateChange').fadeOut(1500);
+  }
+
+  updateCPUChart() {
+    const label = moment(this.stats.read).format('HH:mm:ss');
+
+    this.ChartService.UpdateCPUChart(label, this.stats.CPUUsage, this.cpuChart);
+  }
+
+  updateMemoryChart() {
+    const label = moment(this.stats.read).format('HH:mm:ss');
+
+    this.ChartService.UpdateMemoryChart(label, this.stats.MemoryUsage, this.stats.MemoryCache, this.memoryChart);
+  }
+
+  stopRepeater() {
+    var repeater = this.repeater;
+    if (angular.isDefined(repeater)) {
+      this.$interval.cancel(repeater);
+    }
+  }
+
+  setUpdateRepeater() {
+    const refreshRate = this.state.refreshRate;
+
+    this.repeater = this.$interval(async () => {
+      try {
+        await this.getStats();
+
+        this.updateCPUChart();
+        this.updateMemoryChart();
+      } catch (error) {
+        this.stopRepeater();
+        this.Notifications.error('Failure', error);
+      }
+    }, refreshRate * 1000);
+  }
+
+  initCharts() {
+    let i = 0;
+    const findCharts = setInterval(() => {
+      let cpuChartCtx = $('#cpuChart');
+      let memoryChartCtx = $('#memoryChart');
+      if (cpuChartCtx.length !== 0 && memoryChartCtx.length !== 0) {
+        const cpuChart = this.ChartService.CreateCPUChart(cpuChartCtx);
+        this.cpuChart = cpuChart;
+        const memoryChart = this.ChartService.CreateMemoryChart(memoryChartCtx);
+        this.memoryChart = memoryChart;
+        this.updateCPUChart();
+        this.updateMemoryChart();
+        this.setUpdateRepeater();
+        clearInterval(findCharts);
+        return;
+      }
+      i++;
+      if (i >= 10) {
+        clearInterval(findCharts);
+      }
+    }, 200);
+  }
+
+  getStats() {
+    return this.$async(async () => {
+      try {
+        const stats = await getMetricsForPod(this.$state.params.endpointId, this.state.transition.namespace, this.state.transition.podName);
+        const container = _.find(stats.containers, { name: this.state.transition.containerName });
+        if (container) {
+          const memory = filesizeParser(container.usage.memory);
+          const cpu = parseCPU(container.usage.cpu);
+          this.stats = {
+            read: stats.timestamp,
+            preread: '',
+            MemoryCache: 0,
+            MemoryUsage: memory,
+            NumProcs: '',
+            isWindows: false,
+            PreviousCPUTotalUsage: 0,
+            CPUUsage: (cpu / this.nodeCPU) * 100,
+            CPUCores: 0,
+          };
+        }
+      } catch (err) {
+        this.Notifications.error('Failure', err, 'Unable to retrieve application stats');
+      }
+    });
+  }
+
+  $onDestroy() {
+    this.stopRepeater();
+  }
+
+  async onInit() {
+    this.state = {
+      autoRefresh: false,
+      refreshRate: '30',
+      viewReady: false,
+      transition: {
+        podName: this.$transition$.params().pod,
+        containerName: this.$transition$.params().container,
+        namespace: this.$transition$.params().namespace,
+        applicationName: this.$transition$.params().name,
+      },
+      getMetrics: false,
+    };
+
+    try {
+      await getMetricsForPod(this.$state.params.endpointId, this.state.transition.namespace, this.state.transition.podName);
+    } catch (error) {
+      this.state.getMetrics = false;
+      this.state.viewReady = true;
+      return;
+    }
+
+    try {
+      const podRaw = await this.KubernetesPodService.get(this.state.transition.namespace, this.state.transition.podName);
+      const pod = KubernetesPodConverter.apiToModel(podRaw.Raw);
+      if (pod) {
+        const node = await this.KubernetesNodeService.get(pod.Node);
+        this.nodeCPU = node.CPU;
+      } else {
+        throw new Error('Unable to find pod');
+      }
+      await this.getStats();
+      this.state.getMetrics = true;
+
+      this.$document.ready(() => {
+        this.initCharts();
+      });
+    } catch (err) {
+      this.Notifications.error('Failure', err, 'Unable to retrieve application stats');
+    } finally {
+      this.state.viewReady = true;
+    }
+  }
+
+  $onInit() {
+    return this.$async(this.onInit);
+  }
+}
+
+export default KubernetesApplicationStatsController;
+angular.module('portainer.kubernetes').controller('KubernetesApplicationStatsController', KubernetesApplicationStatsController);
diff --git a/app/kubernetes/views/cluster/node/stats/stats.html b/app/kubernetes/views/cluster/node/stats/stats.html
new file mode 100644
index 0000000..7cd0412
--- /dev/null
+++ b/app/kubernetes/views/cluster/node/stats/stats.html
@@ -0,0 +1,98 @@
+<page-header
+  ng-if="ctrl.state.viewReady"
+  title="'Node stats'"
+  breadcrumbs="[
+{ label:'Cluster', link:'kubernetes.cluster' },
+{
+  label:ctrl.state.transition.nodeName,
+  link: 'kubernetes.cluster.node',
+  linkParams:{nodeName: ctrl.state.transition.nodeName}
+},
+ ctrl.state.transition.nodeName,
+ ]"
+  reload="true"
+></page-header>
+
+<kubernetes-view-loading view-ready="ctrl.state.viewReady"></kubernetes-view-loading>
+
+<information-panel ng-if="!ctrl.state.getMetrics" title-text="Unable to retrieve node metrics">
+  <span class="small text-muted vertical-center">
+    <pr-icon icon="'alert-triangle'" mode="'primary'"></pr-icon>
+    Portainer was unable to retrieve any metrics associated to that node. Please contact your administrator to ensure that the Kubernetes metrics feature is properly configured.
+  </span>
+</information-panel>
+<div class="row" ng-if="ctrl.state.getMetrics">
+  <div class="col-md-12">
+    <rd-widget>
+      <div class="toolBar px-5 pt-5">
+        <div class="toolBarTitle flex">
+          <div class="widget-icon space-right">
+            <pr-icon icon="'info'"></pr-icon>
+          </div>
+          <span class="vertical-center"> About statistics </span>
+        </div>
+      </div>
+      <rd-widget-body>
+        <form class="form-horizontal">
+          <div class="form-group">
+            <div class="col-sm-12">
+              <span class="small text-muted">
+                This view displays real-time statistics about the node <b>{{ ctrl.state.transition.nodeName }}</b
+                >.
+              </span>
+            </div>
+          </div>
+          <div class="form-group">
+            <label for="refreshRate" class="col-sm-3 col-md-2 col-lg-2 margin-sm-top control-label text-left"> Refresh rate </label>
+            <div class="col-sm-3 col-md-2">
+              <select id="refreshRate" ng-model="ctrl.state.refreshRate" ng-change="ctrl.changeUpdateRepeater()" class="form-control" data-cy="node-stats-refresh-rate">
+                <option value="30">30s</option>
+                <option value="60">60s</option>
+              </select>
+            </div>
+            <span>
+              <pr-icon id="refreshRateChange" icon="'check'" mode="'success'" style="display: none"></pr-icon>
+            </span>
+          </div>
+        </form>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
+
+<div class="row" ng-show="ctrl.state.getMetrics">
+  <div class="col-lg-6 col-md-12 col-sm-12">
+    <rd-widget>
+      <div class="toolBar px-5 pt-5">
+        <div class="toolBarTitle flex">
+          <div class="widget-icon space-right">
+            <pr-icon icon="'svg-memory'"></pr-icon>
+          </div>
+          <span class="vertical-center"> Memory usage </span>
+        </div>
+      </div>
+      <rd-widget-body>
+        <div class="chart-node" style="position: relative">
+          <canvas id="memoryChart" width="770" height="300"></canvas>
+        </div>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+  <div class="col-lg-6 col-md-12 col-sm-12">
+    <rd-widget>
+      <div class="toolBar px-5 pt-5">
+        <div class="toolBarTitle flex">
+          <div class="widget-icon space-right">
+            <pr-icon icon="'cpu'"></pr-icon>
+          </div>
+          <span class="vertical-center"> CPU usage </span>
+        </div>
+      </div>
+      <rd-widget-body>
+        <div class="chart-node" style="position: relative">
+          <canvas id="cpuChart" width="770" height="300"></canvas>
+        </div>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
diff --git a/app/kubernetes/views/cluster/node/stats/stats.js b/app/kubernetes/views/cluster/node/stats/stats.js
new file mode 100644
index 0000000..98e3627
--- /dev/null
+++ b/app/kubernetes/views/cluster/node/stats/stats.js
@@ -0,0 +1,8 @@
+angular.module('portainer.kubernetes').component('kubernetesNodeStatsView', {
+  templateUrl: './stats.html',
+  controller: 'KubernetesNodeStatsController',
+  controllerAs: 'ctrl',
+  bindings: {
+    $transition$: '<',
+  },
+});
diff --git a/app/kubernetes/views/cluster/node/stats/statsController.js b/app/kubernetes/views/cluster/node/stats/statsController.js
new file mode 100644
index 0000000..7142951
--- /dev/null
+++ b/app/kubernetes/views/cluster/node/stats/statsController.js
@@ -0,0 +1,147 @@
+import angular from 'angular';
+import moment from 'moment';
+import filesizeParser from 'filesize-parser';
+import { PORTAINER_FADEOUT } from '@/constants';
+import { getMetricsForNode } from '@/react/kubernetes/metrics/queries/useNodeMetricsQuery';
+import { parseCPU } from '@/react/kubernetes/utils';
+
+class KubernetesNodeStatsController {
+  /* @ngInject */
+  constructor($async, $state, $interval, $document, Notifications, KubernetesNodeService, ChartService) {
+    this.$async = $async;
+    this.$state = $state;
+    this.$interval = $interval;
+    this.$document = $document;
+    this.Notifications = Notifications;
+    this.KubernetesNodeService = KubernetesNodeService;
+    this.ChartService = ChartService;
+
+    this.onInit = this.onInit.bind(this);
+    this.initCharts = this.initCharts.bind(this);
+  }
+
+  changeUpdateRepeater() {
+    var cpuChart = this.cpuChart;
+    var memoryChart = this.memoryChart;
+
+    this.stopRepeater();
+    this.setUpdateRepeater(cpuChart, memoryChart);
+    $('#refreshRateChange').show();
+    $('#refreshRateChange').fadeOut(PORTAINER_FADEOUT);
+  }
+
+  updateCPUChart() {
+    const label = moment(this.stats.read).format('HH:mm:ss');
+    this.ChartService.UpdateCPUChart(label, this.stats.CPUUsage, this.cpuChart);
+  }
+
+  updateMemoryChart() {
+    const label = moment(this.stats.read).format('HH:mm:ss');
+    this.ChartService.UpdateMemoryChart(label, this.stats.MemoryUsage, 0, this.memoryChart);
+  }
+
+  stopRepeater() {
+    var repeater = this.repeater;
+    if (angular.isDefined(repeater)) {
+      this.$interval.cancel(repeater);
+      this.repeater = undefined;
+    }
+  }
+
+  setUpdateRepeater() {
+    const refreshRate = this.state.refreshRate;
+
+    this.repeater = this.$interval(async () => {
+      try {
+        await this.getStats();
+        this.updateCPUChart();
+        this.updateMemoryChart();
+      } catch (error) {
+        this.stopRepeater();
+        this.Notifications.error('Failure', error);
+      }
+    }, refreshRate * 1000);
+  }
+
+  initCharts() {
+    const findCharts = setInterval(() => {
+      let cpuChartCtx = $('#cpuChart');
+      let memoryChartCtx = $('#memoryChart');
+      if (cpuChartCtx.length !== 0 && memoryChartCtx.length !== 0) {
+        const cpuChart = this.ChartService.CreateCPUChart(cpuChartCtx);
+        this.cpuChart = cpuChart;
+        const memoryChart = this.ChartService.CreateMemoryChart(memoryChartCtx);
+        this.memoryChart = memoryChart;
+        this.updateCPUChart();
+        this.updateMemoryChart();
+        this.setUpdateRepeater();
+        clearInterval(findCharts);
+      }
+    }, 200);
+  }
+
+  getStats() {
+    return this.$async(async () => {
+      try {
+        const stats = await getMetricsForNode(this.$state.params.endpointId, this.state.transition.nodeName);
+        if (stats) {
+          const memory = filesizeParser(stats.usage.memory);
+          const cpu = parseCPU(stats.usage.cpu);
+          this.stats = {
+            read: stats.metadata.creationTimestamp,
+            MemoryUsage: memory,
+            CPUUsage: (cpu / this.nodeCPU) * 100,
+          };
+        }
+      } catch (err) {
+        this.Notifications.error('Failure', err, 'Unable to retrieve node stats');
+      }
+    });
+  }
+
+  $onDestroy() {
+    this.stopRepeater();
+  }
+
+  async onInit() {
+    this.state = {
+      autoRefresh: false,
+      refreshRate: '30',
+      viewReady: false,
+      transition: {
+        nodeName: this.$transition$.params().nodeName,
+      },
+      getMetrics: true,
+    };
+
+    try {
+      const nodeMetrics = await getMetricsForNode(this.$state.params.endpointId, this.state.transition.nodeName);
+
+      if (nodeMetrics) {
+        const node = await this.KubernetesNodeService.get(this.state.transition.nodeName);
+        this.nodeCPU = node.CPU || 1;
+
+        await this.getStats();
+      } else {
+        this.state.getMetrics = false;
+      }
+    } catch (err) {
+      this.state.getMetrics = false;
+      this.Notifications.error('Failure', err, 'Unable to retrieve node stats');
+    } finally {
+      this.state.viewReady = true;
+      if (this.state.getMetrics) {
+        this.$document.ready(() => {
+          this.initCharts();
+        });
+      }
+    }
+  }
+
+  $onInit() {
+    return this.$async(this.onInit);
+  }
+}
+
+export default KubernetesNodeStatsController;
+angular.module('portainer.kubernetes').controller('KubernetesNodeStatsController', KubernetesNodeStatsController);
diff --git a/app/kubernetes/views/configurations/configmap/create/createConfigMap.html b/app/kubernetes/views/configurations/configmap/create/createConfigMap.html
new file mode 100644
index 0000000..1dc37cf
--- /dev/null
+++ b/app/kubernetes/views/configurations/configmap/create/createConfigMap.html
@@ -0,0 +1,125 @@
+<page-header
+  ng-if="ctrl.state.viewReady"
+  title="'Create ConfigMap'"
+  breadcrumbs="[{ label:'ConfigMaps and Secrets', link:'kubernetes.configurations', linkParams:{ tab: 'configmaps' } }, 'Create a ConfigMap']"
+  reload="true"
+></page-header>
+
+<kubernetes-view-loading view-ready="ctrl.state.viewReady"></kubernetes-view-loading>
+
+<div ng-if="ctrl.state.viewReady">
+  <div class="row">
+    <div class="col-xs-12">
+      <rd-widget>
+        <rd-widget-body>
+          <form class="form-horizontal" name="kubernetesConfigurationCreationForm" autocomplete="off">
+            <!-- resource-pool -->
+            <div class="form-group" ng-if="ctrl.formValues.ResourcePool">
+              <label for="resource-pool-selector" class="col-sm-3 col-lg-2 control-label text-left">Namespace</label>
+              <div class="col-sm-8 col-lg-9">
+                <select
+                  class="form-control"
+                  id="resource-pool-selector"
+                  ng-model="ctrl.formValues.ResourcePool"
+                  ng-options="resourcePool.Namespace.Name for resourcePool in ctrl.resourcePools"
+                  ng-change="ctrl.onResourcePoolSelectionChange()"
+                  data-cy="k8sConfigCreate-namespaceDropdown"
+                ></select>
+              </div>
+            </div>
+            <div class="form-group" ng-if="ctrl.state.resourcePoolHasQuota && ctrl.resourceQuotaCapacityExceeded() && ctrl.formValues.ResourcePool">
+              <div class="col-sm-12 small text-warning vertical-center">
+                <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon>
+                This namespace has exhausted its resource capacity and you will not be able to deploy the configuration. Contact your administrator to expand the capacity of the
+                namespace.
+              </div>
+            </div>
+            <div class="form-group" ng-if="!ctrl.formValues.ResourcePool">
+              <div class="col-sm-12 small text-warning vertical-center">
+                <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon>
+                You do not have access to any namespace. Contact your administrator to get access to a namespace.
+              </div>
+            </div>
+            <!-- !resource-pool -->
+
+            <!-- name -->
+            <div class="form-group">
+              <label for="configuration_name" class="col-sm-3 col-lg-2 control-label required text-left">Name</label>
+              <div class="col-sm-8 col-lg-9 mb-0">
+                <input
+                  type="text"
+                  class="form-control"
+                  name="configuration_name"
+                  ng-model="ctrl.formValues.Name"
+                  ng-pattern="/^[a-z0-9]([a-z0-9-.]{0,61}[a-z0-9])?$/"
+                  ng-change="ctrl.onChangeName()"
+                  placeholder="my-configmap"
+                  auto-focus
+                  required
+                  data-cy="k8sConfigCreate-nameInput"
+                />
+                <div ng-show="kubernetesConfigurationCreationForm.configuration_name.$invalid || ctrl.state.alreadyExist">
+                  <div class="help-block small text-warning">
+                    <div ng-messages="kubernetesConfigurationCreationForm.configuration_name.$error">
+                      <p ng-message="required" class="vertical-center"><pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon> This field is required.</p>
+                      <p ng-message="pattern" class="vertical-center"
+                        ><pr-icon icon="'alert-triangle'" mode="'warning'" class="vertical-center"></pr-icon> This field must consist of lower case alphanumeric characters, '-' or
+                        '.', and contain at most 63 characters, and must start and end with an alphanumeric character.</p
+                      >
+                    </div>
+                    <p ng-if="ctrl.state.alreadyExist" class="vertical-center"
+                      ><pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon> A configuration with the same name already exists inside the selected namespace.</p
+                    >
+                  </div>
+                </div>
+              </div>
+            </div>
+            <!-- !name -->
+
+            <div class="col-sm-12 !p-0">
+              <annotations-be-teaser></annotations-be-teaser>
+            </div>
+
+            <div ng-if="ctrl.formValues.ResourcePool">
+              <kubernetes-configuration-data
+                ng-if="ctrl.formValues"
+                form-values="ctrl.formValues"
+                is-docker-config="ctrl.state.isDockerConfig"
+                is-valid="ctrl.state.isDataValid"
+                on-change-validation="ctrl.isFormValid()"
+                is-creation="true"
+                type="'configmap'"
+                is-editor-dirty="ctrl.state.isEditorDirty"
+              ></kubernetes-configuration-data>
+            </div>
+
+            <!-- summary -->
+            <kubernetes-summary-view
+              ng-if="!(!kubernetesConfigurationCreationForm.$valid || !ctrl.isFormValid() || ctrl.state.actionInProgress)"
+              form-values="ctrl.formValues"
+            ></kubernetes-summary-view>
+
+            <!-- actions -->
+            <div class="col-sm-12 form-section-title" style="margin-top: 10px"> Actions </div>
+            <div class="form-group">
+              <div class="col-sm-12">
+                <button
+                  type="button"
+                  class="btn btn-primary btn-sm !ml-0"
+                  ng-disabled="!kubernetesConfigurationCreationForm.$valid || !ctrl.isFormValid() || ctrl.state.actionInProgress || !ctrl.formValues.ResourcePool"
+                  ng-click="ctrl.createConfiguration()"
+                  button-spinner="ctrl.state.actionInProgress"
+                  data-cy="k8sConfigCreate-CreateConfigButton"
+                >
+                  <span ng-hide="ctrl.state.actionInProgress">Create {{ ctrl.formValues.Kind | kubernetesConfigurationKindText }}</span>
+                  <span ng-show="ctrl.state.actionInProgress">Creation in progress...</span>
+                </button>
+              </div>
+            </div>
+            <!-- !actions -->
+          </form>
+        </rd-widget-body>
+      </rd-widget>
+    </div>
+  </div>
+</div>
diff --git a/app/kubernetes/views/configurations/configmap/create/createConfigMap.js b/app/kubernetes/views/configurations/configmap/create/createConfigMap.js
new file mode 100644
index 0000000..a3f14f4
--- /dev/null
+++ b/app/kubernetes/views/configurations/configmap/create/createConfigMap.js
@@ -0,0 +1,5 @@
+angular.module('portainer.kubernetes').component('kubernetesCreateConfigMapView', {
+  templateUrl: './createConfigMap.html',
+  controller: 'KubernetesCreateConfigMapController',
+  controllerAs: 'ctrl',
+});
diff --git a/app/kubernetes/views/configurations/configmap/create/createConfigMapController.js b/app/kubernetes/views/configurations/configmap/create/createConfigMapController.js
new file mode 100644
index 0000000..91198d1
--- /dev/null
+++ b/app/kubernetes/views/configurations/configmap/create/createConfigMapController.js
@@ -0,0 +1,165 @@
+import angular from 'angular';
+import _ from 'lodash-es';
+import { KubernetesConfigurationFormValues, KubernetesConfigurationFormValuesEntry } from '@/kubernetes/models/configuration/formvalues';
+import { KubernetesConfigurationKinds } from '@/kubernetes/models/configuration/models';
+import KubernetesConfigurationHelper from '@/kubernetes/helpers/configurationHelper';
+import KubernetesNamespaceHelper from '@/kubernetes/helpers/namespaceHelper';
+import { getServiceAccounts } from '@/kubernetes/rest/serviceAccount';
+
+import { confirmWebEditorDiscard } from '@@/modals/confirm';
+import { isConfigurationFormValid } from '../../validation';
+
+class KubernetesCreateConfigMapController {
+  /* @ngInject */
+  constructor($async, $state, $scope, $window, Notifications, Authentication, KubernetesConfigurationService, KubernetesResourcePoolService, EndpointProvider) {
+    this.$async = $async;
+    this.$state = $state;
+    this.$scope = $scope;
+    this.$window = $window;
+    this.EndpointProvider = EndpointProvider;
+    this.Notifications = Notifications;
+    this.Authentication = Authentication;
+    this.KubernetesConfigurationService = KubernetesConfigurationService;
+    this.KubernetesResourcePoolService = KubernetesResourcePoolService;
+    this.KubernetesConfigurationKinds = KubernetesConfigurationKinds;
+
+    this.onInit = this.onInit.bind(this);
+    this.createConfigurationAsync = this.createConfigurationAsync.bind(this);
+    this.getConfigurationsAsync = this.getConfigurationsAsync.bind(this);
+    this.onResourcePoolSelectionChangeAsync = this.onResourcePoolSelectionChangeAsync.bind(this);
+  }
+
+  onChangeName() {
+    const filteredConfigurations = _.filter(
+      this.configurations,
+      (config) => config.Namespace === this.formValues.ResourcePool.Namespace.Name && config.Kind === this.formValues.Kind
+    );
+    this.state.alreadyExist = _.find(filteredConfigurations, (config) => config.Name === this.formValues.Name) !== undefined;
+  }
+
+  async onResourcePoolSelectionChangeAsync() {
+    try {
+      this.onChangeName();
+      this.availableServiceAccounts = await getServiceAccounts(this.environmentId, this.formValues.ResourcePool.Namespace.Name);
+      this.formValues.ServiceAccountName = this.availableServiceAccounts.length > 0 ? this.availableServiceAccounts[0].metadata.name : '';
+    } catch (err) {
+      this.Notifications.error('Failure', err, 'Unable to load service accounts');
+    }
+  }
+  onResourcePoolSelectionChange() {
+    this.$async(this.onResourcePoolSelectionChangeAsync);
+  }
+
+  addRequiredKeysToForm(keys) {
+    // remove data entries that have an empty value
+    this.formValues.Data = this.formValues.Data.filter((entry) => entry.Value);
+
+    keys.forEach((key) => {
+      // if the key doesn't exist on the form, add a new formValues.Data entry
+      if (!this.formValues.Data.some((data) => data.Key === key)) {
+        this.formValues.Data.push(new KubernetesConfigurationFormValuesEntry());
+        const index = this.formValues.Data.length - 1;
+        this.formValues.Data[index].Key = key;
+      }
+    });
+  }
+
+  isFormValid() {
+    const [isValid] = isConfigurationFormValid(this.state.alreadyExist, this.state.isDataValid, this.formValues);
+    return isValid;
+  }
+
+  async createConfigurationAsync() {
+    try {
+      this.state.actionInProgress = true;
+      this.formValues.ConfigurationOwner = this.Authentication.getUserDetails().username;
+      if (!this.formValues.IsSimple) {
+        this.formValues.Data = KubernetesConfigurationHelper.parseYaml(this.formValues);
+      }
+
+      await this.KubernetesConfigurationService.create(this.formValues);
+      this.Notifications.success('Success', `ConfigMap successfully created`);
+      this.state.isEditorDirty = false;
+      this.$state.go('kubernetes.configurations', { tab: 'configmaps' });
+    } catch (err) {
+      this.Notifications.error('Failure', err, `Unable to create ConfigMap`);
+    } finally {
+      this.state.actionInProgress = false;
+    }
+  }
+
+  createConfiguration() {
+    return this.$async(this.createConfigurationAsync);
+  }
+
+  async getConfigurationsAsync() {
+    try {
+      this.configurations = await this.KubernetesConfigurationService.get();
+    } catch (err) {
+      this.Notifications.error('Failure', err, 'Unable to retrieve ConfigMaps');
+    }
+  }
+
+  getConfigurations() {
+    return this.$async(this.getConfigurationsAsync);
+  }
+
+  async uiCanExit() {
+    if (!this.formValues.IsSimple && this.formValues.DataYaml && this.state.isEditorDirty) {
+      return confirmWebEditorDiscard();
+    }
+  }
+
+  async onInit() {
+    this.state = {
+      actionInProgress: false,
+      viewReady: false,
+      alreadyExist: false,
+      isDataValid: true,
+      isEditorDirty: false,
+      isDockerConfig: false,
+    };
+
+    this.formValues = new KubernetesConfigurationFormValues();
+    this.formValues.Kind = KubernetesConfigurationKinds.CONFIGMAP;
+    this.formValues.Data = [new KubernetesConfigurationFormValuesEntry()];
+
+    try {
+      const resourcePools = await this.KubernetesResourcePoolService.get();
+      this.resourcePools = _.filter(
+        resourcePools,
+        (resourcePool) => !KubernetesNamespaceHelper.isSystemNamespace(resourcePool.Namespace.Name) && resourcePool.Namespace.Status === 'Active'
+      );
+
+      this.formValues.ResourcePool = this.resourcePools[0];
+      if (!this.formValues.ResourcePool) {
+        return;
+      }
+
+      this.environmentId = this.EndpointProvider.endpointID();
+      this.availableServiceAccounts = await getServiceAccounts(this.environmentId, this.resourcePools[0].Namespace.Name);
+      this.formValues.ServiceAccountName = this.availableServiceAccounts.length > 0 ? this.availableServiceAccounts[0].metadata.name : '';
+    } catch (err) {
+      this.Notifications.error('Failure', err, 'Unable to load view data');
+    } finally {
+      this.state.viewReady = true;
+    }
+
+    this.$window.onbeforeunload = () => {
+      if (!this.formValues.IsSimple && this.formValues.DataYaml && this.state.isEditorDirty) {
+        return '';
+      }
+    };
+  }
+
+  $onDestroy() {
+    this.state.isEditorDirty = false;
+  }
+
+  $onInit() {
+    return this.$async(this.onInit);
+  }
+}
+
+export default KubernetesCreateConfigMapController;
+angular.module('portainer.kubernetes').controller('KubernetesCreateConfigMapController', KubernetesCreateConfigMapController);
diff --git a/app/kubernetes/views/configurations/configmap/edit/configMap.html b/app/kubernetes/views/configurations/configmap/edit/configMap.html
new file mode 100644
index 0000000..70a2d4f
--- /dev/null
+++ b/app/kubernetes/views/configurations/configmap/edit/configMap.html
@@ -0,0 +1,162 @@
+<page-header
+  ng-if="ctrl.state.viewReady"
+  title="'ConfigMap details'"
+  breadcrumbs="[
+    { label:'Namespaces', link:'kubernetes.resourcePools' },
+    {
+      label:ctrl.configuration.Namespace,
+      link: 'kubernetes.resourcePools.resourcePool',
+      linkParams:{ id: ctrl.configuration.Namespace }
+    },
+    { label:'ConfigMaps and Secrets', link:'kubernetes.configurations', linkParams:{ tab: 'configmaps' } },
+    ctrl.configuration.Name,
+     ]"
+  reload="true"
+>
+</page-header>
+
+<kubernetes-view-loading view-ready="ctrl.state.viewReady"></kubernetes-view-loading>
+
+<div ng-if="ctrl.state.viewReady">
+  <div class="row">
+    <div class="col-sm-12">
+      <rd-widget>
+        <rd-widget-body classes="no-padding">
+          <uib-tabset active="ctrl.state.activeTab" justified="true" type="pills">
+            <uib-tab index="0" classes="btn-sm" select="ctrl.selectTab(0)" data-cy="k8sConfigDetail-configTab">
+              <uib-tab-heading>
+                <pr-icon icon="'file-code'"></pr-icon>
+                ConfigMap
+              </uib-tab-heading>
+              <div class="widget-body">
+                <table class="table" data-cy="k8sConfigDetail-configTable">
+                  <tbody>
+                    <tr>
+                      <td class="w-[40%] !border-none">Name</td>
+                      <td class="!border-none"> {{ ctrl.configuration.Name }} </td>
+                    </tr>
+                    <tr>
+                      <td>Namespace</td>
+                      <td>
+                        <a ui-sref="kubernetes.resourcePools.resourcePool({ id: ctrl.configuration.Namespace })">{{ ctrl.configuration.Namespace }}</a>
+                        <span style="margin-left: 5px" class="label label-info image-tag" ng-if="ctrl.isSystemNamespace()">system</span>
+                      </td>
+                    </tr>
+                  </tbody>
+                </table>
+              </div>
+            </uib-tab>
+            <uib-tab index="1" classes="btn-sm" select="ctrl.selectTab(1)" data-cy="k8sConfigDetail-eventsTab">
+              <uib-tab-heading>
+                <pr-icon icon="'history'"></pr-icon>
+                Events
+                <div ng-if="ctrl.hasEventWarnings()">
+                  <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon>
+                  {{ ctrl.state.eventWarningCount }} warning(s)
+                </div>
+              </uib-tab-heading>
+              <resource-events-datatable
+                resource-id="ctrl.configuration.Id"
+                storage-key="'kubernetes.configmap.events'"
+                namespace="ctrl.configuration.Namespace"
+              ></resource-events-datatable>
+            </uib-tab>
+            <uib-tab index="2" ng-if="ctrl.configuration.Yaml" classes="btn-sm" select="ctrl.showEditor()" data-cy="k8sConfigDetail-yamlTab">
+              <uib-tab-heading>
+                <pr-icon icon="'code'"></pr-icon>
+                YAML
+              </uib-tab-heading>
+              <div class="px-5 !pt-5" ng-if="ctrl.state.showEditorTab">
+                <kube-yaml-inspector data-cy="k8sConfigDetail-yamlInspector" identifier="'configuration-yaml'" data="ctrl.configuration.Yaml" hide-message="true" />
+              </div>
+            </uib-tab>
+          </uib-tabset>
+        </rd-widget-body>
+      </rd-widget>
+    </div>
+  </div>
+
+  <div class="row">
+    <div class="col-sm-12">
+      <rd-widget>
+        <rd-widget-body>
+          <form ng-if="!ctrl.isSystemConfig()" class="form-horizontal" name="kubernetesConfigurationCreationForm" autocomplete="off">
+            <div class="col-sm-12 !p-0">
+              <annotations-be-teaser></annotations-be-teaser>
+            </div>
+
+            <kubernetes-configuration-data
+              ng-if="ctrl.formValues"
+              form-values="ctrl.formValues"
+              is-docker-config="false"
+              is-valid="ctrl.state.isDataValid"
+              on-change-validation="ctrl.isFormValid()"
+              is-creation="false"
+              type="'configmap'"
+              is-editor-dirty="ctrl.state.isEditorDirty"
+            ></kubernetes-configuration-data>
+
+            <!-- summary -->
+            <kubernetes-summary-view
+              ng-if="!(!ctrl.isFormValid() || !kubernetesConfigurationCreationForm.$valid || ctrl.state.actionInProgress)"
+              form-values="ctrl.formValues"
+            ></kubernetes-summary-view>
+
+            <!-- actions -->
+            <div class="col-sm-12 form-section-title" style="margin-top: 10px"> Actions </div>
+            <div class="form-group">
+              <div class="col-sm-12">
+                <button
+                  type="button"
+                  class="btn btn-primary btn-sm !ml-0"
+                  ng-disabled="!ctrl.isFormValid() || !kubernetesConfigurationCreationForm.$valid || ctrl.state.actionInProgress"
+                  ng-click="ctrl.updateConfiguration()"
+                  button-spinner="ctrl.state.actionInProgress"
+                  data-cy="k8sConfigDetail-updateConfig"
+                >
+                  <span ng-hide="ctrl.state.actionInProgress">Update {{ ctrl.configuration.Kind | kubernetesConfigurationKindText }}</span>
+                  <span ng-show="ctrl.state.actionInProgress">Update in progress...</span>
+                </button>
+              </div>
+            </div>
+            <!-- !actions -->
+          </form>
+          <div ng-if="ctrl.isSystemConfig()">
+            <div class="col-sm-12 form-section-title" style="margin-top: 10px"> Data </div>
+            <table class="table">
+              <tbody>
+                <tr class="text-muted">
+                  <td style="width: 10%; border-top: none">Key</td>
+                  <td style="width: 90%; border-top: none">Value</td>
+                </tr>
+
+                <tr ng-repeat="item in ctrl.formValues.Data track by $index">
+                  <td>{{ item.Key }}</td>
+                  <td>
+                    <div style="white-space: pre-wrap">{{ item.Value }}</div>
+                    <div style="margin-top: 2px">
+                      <span class="btn btn-primary btn-xs" ng-click="ctrl.copyConfigurationValue($index)"> <pr-icon icon="'copy'" class-name="'mr-0.5'"></pr-icon>Copy </span>
+                      <span id="copyValueNotification_{{ $index }}" style="display: none; color: #23ae89; margin-left: 5px" class="small">
+                        <pr-icon icon="'check'"></pr-icon> copied
+                      </span>
+                    </div>
+                  </td>
+                </tr>
+              </tbody>
+            </table>
+          </div>
+        </rd-widget-body>
+      </rd-widget>
+    </div>
+  </div>
+
+  <kubernetes-integrated-applications-datatable
+    ng-if="ctrl.configuration.Used"
+    dataset="ctrl.configuration.Applications"
+    is-loading="ctrl.state.applicationsLoading"
+    table-key="'kubernetes.configurations.applications'"
+    on-refresh="(ctrl.getApplications)"
+    table-title="'Applications using this ConfigMap'"
+  >
+  </kubernetes-integrated-applications-datatable>
+</div>
diff --git a/app/kubernetes/views/configurations/configmap/edit/configMap.js b/app/kubernetes/views/configurations/configmap/edit/configMap.js
new file mode 100644
index 0000000..b96433b
--- /dev/null
+++ b/app/kubernetes/views/configurations/configmap/edit/configMap.js
@@ -0,0 +1,8 @@
+angular.module('portainer.kubernetes').component('kubernetesConfigMapView', {
+  templateUrl: './configMap.html',
+  controller: 'KubernetesConfigMapController',
+  controllerAs: 'ctrl',
+  bindings: {
+    $transition$: '<',
+  },
+});
diff --git a/app/kubernetes/views/configurations/configmap/edit/configMapController.js b/app/kubernetes/views/configurations/configmap/edit/configMapController.js
new file mode 100644
index 0000000..7ee1e4d
--- /dev/null
+++ b/app/kubernetes/views/configurations/configmap/edit/configMapController.js
@@ -0,0 +1,298 @@
+import angular from 'angular';
+import _ from 'lodash-es';
+
+import { KubernetesConfigurationFormValues } from '@/kubernetes/models/configuration/formvalues';
+import { KubernetesConfigurationKinds } from '@/kubernetes/models/configuration/models';
+import KubernetesConfigurationHelper from '@/kubernetes/helpers/configurationHelper';
+import KubernetesConfigurationConverter from '@/kubernetes/converters/configuration';
+import KubernetesEventHelper from '@/kubernetes/helpers/eventHelper';
+import KubernetesNamespaceHelper from '@/kubernetes/helpers/namespaceHelper';
+import { pluralize } from '@/portainer/helpers/strings';
+
+import { confirmUpdate, confirmWebEditorDiscard } from '@@/modals/confirm';
+import { isConfigurationFormValid } from '../../validation';
+
+class KubernetesConfigMapController {
+  /* @ngInject */
+  constructor(
+    $async,
+    $state,
+    $window,
+    clipboard,
+    EndpointProvider,
+    Notifications,
+    LocalStorage,
+    Authentication,
+    KubernetesConfigurationService,
+    KubernetesConfigMapService,
+    KubernetesResourcePoolService,
+    KubernetesApplicationService,
+    KubernetesEventService
+  ) {
+    this.$async = $async;
+    this.$state = $state;
+    this.$window = $window;
+    this.clipboard = clipboard;
+    this.EndpointProvider = EndpointProvider;
+    this.Notifications = Notifications;
+    this.LocalStorage = LocalStorage;
+    this.Authentication = Authentication;
+    this.KubernetesConfigurationService = KubernetesConfigurationService;
+    this.KubernetesConfigMapService = KubernetesConfigMapService;
+    this.KubernetesResourcePoolService = KubernetesResourcePoolService;
+    this.KubernetesApplicationService = KubernetesApplicationService;
+    this.KubernetesEventService = KubernetesEventService;
+    this.KubernetesConfigurationKinds = KubernetesConfigurationKinds;
+
+    this.onInit = this.onInit.bind(this);
+    this.getConfigurationAsync = this.getConfigurationAsync.bind(this);
+    this.getEvents = this.getEvents.bind(this);
+    this.getEventsAsync = this.getEventsAsync.bind(this);
+    this.getApplications = this.getApplications.bind(this);
+    this.getApplicationsAsync = this.getApplicationsAsync.bind(this);
+    this.getConfigurationsAsync = this.getConfigurationsAsync.bind(this);
+    this.updateConfiguration = this.updateConfiguration.bind(this);
+    this.updateConfigurationAsync = this.updateConfigurationAsync.bind(this);
+  }
+
+  isSystemNamespace() {
+    return KubernetesNamespaceHelper.isSystemNamespace(this.configuration.Namespace);
+  }
+
+  isSystemConfig() {
+    return this.isSystemNamespace();
+  }
+
+  selectTab(index) {
+    this.LocalStorage.storeActiveTab('configuration', index);
+  }
+
+  showEditor() {
+    this.state.showEditorTab = true;
+    this.selectTab(2);
+  }
+
+  copyConfigurationValue(idx) {
+    this.clipboard.copyText(this.formValues.Data[idx].Value);
+    $('#copyValueNotification_' + idx)
+      .show()
+      .fadeOut(2500);
+  }
+
+  isFormValid() {
+    const [isValid] = isConfigurationFormValid(this.state.alreadyExist, this.state.isDataValid, this.formValues);
+    return isValid;
+  }
+
+  // TODO: refactor
+  // It looks like we're still doing a create/delete process but we've decided to get rid of this
+  // approach.
+  async updateConfigurationAsync() {
+    try {
+      this.state.actionInProgress = true;
+      if (this.formValues.Kind !== this.configuration.Kind || this.formValues.ResourcePool !== this.configuration.Namespace || this.formValues.Name !== this.configuration.Name) {
+        await this.KubernetesConfigurationService.create(this.formValues);
+        await this.KubernetesConfigurationService.delete(this.configuration);
+        this.Notifications.success('Success', `ConfigMap successfully updated`);
+        this.$state.go(
+          'kubernetes.configurations.configmap',
+          {
+            namespace: this.formValues.ResourcePool,
+            name: this.formValues.Name,
+          },
+          { reload: true }
+        );
+      } else {
+        await this.KubernetesConfigurationService.update(this.formValues, this.configuration);
+        this.Notifications.success('Success', `ConfigMap successfully updated`);
+        this.$state.reload(this.$state.current);
+      }
+    } catch (err) {
+      this.Notifications.error('Failure', err, `Unable to update ConfigMap`);
+    } finally {
+      this.state.actionInProgress = false;
+    }
+  }
+
+  updateConfiguration() {
+    if (this.configuration.Used) {
+      confirmUpdate(
+        `The changes will be propagated to ${this.configuration.Applications.length} running ${pluralize(
+          this.configuration.Applications.length,
+          'application'
+        )}. Are you sure you want to update this ConfigMap?`,
+        (confirmed) => {
+          if (confirmed) {
+            return this.$async(this.updateConfigurationAsync);
+          }
+        }
+      );
+    } else {
+      return this.$async(this.updateConfigurationAsync);
+    }
+  }
+
+  async getConfigurationAsync() {
+    try {
+      this.state.configurationLoading = true;
+      const name = this.$transition$.params().name;
+      const namespace = this.$transition$.params().namespace;
+
+      try {
+        const configMap = await this.KubernetesConfigMapService.get(namespace, name);
+        this.configuration = KubernetesConfigurationConverter.configMapToConfiguration(configMap);
+        this.formValues.Data = configMap.Data;
+      } catch (err) {
+        if (err.status === 403) {
+          this.$state.go('kubernetes.configurations', { tab: 'configmaps' });
+          throw new Error('Not authorized to edit ConfigMap', { cause: err });
+        }
+      }
+
+      this.formValues.ResourcePool = this.configuration.Namespace;
+      this.formValues.Id = this.configuration.Id;
+      this.formValues.Name = this.configuration.Name;
+      this.formValues.Type = this.configuration.Type;
+      this.formValues.Kind = this.configuration.Kind;
+      this.oldDataYaml = this.formValues.DataYaml;
+      this.formValues.Labels = this.configuration.Labels;
+
+      return this.configuration;
+    } catch (err) {
+      this.Notifications.error('Failure', err, 'Unable to retrieve ConfigMap');
+    } finally {
+      this.state.configurationLoading = false;
+    }
+  }
+
+  getConfiguration() {
+    return this.$async(this.getConfigurationAsync);
+  }
+
+  async getApplicationsAsync(namespace) {
+    try {
+      this.state.applicationsLoading = true;
+      const applications = await this.KubernetesApplicationService.get(namespace);
+      this.configuration.Applications = KubernetesConfigurationHelper.getUsingApplications(this.configuration, applications);
+      KubernetesConfigurationHelper.setConfigurationUsed(this.configuration);
+    } catch (err) {
+      this.Notifications.error('Failure', err, 'Unable to retrieve applications');
+    } finally {
+      this.state.applicationsLoading = false;
+    }
+  }
+
+  getApplications(namespace) {
+    return this.$async(this.getApplicationsAsync, namespace);
+  }
+
+  hasEventWarnings() {
+    return this.state.eventWarningCount;
+  }
+
+  async getEventsAsync(namespace) {
+    try {
+      this.state.eventsLoading = true;
+      this.events = await this.KubernetesEventService.get(namespace);
+      this.events = _.filter(this.events, (event) => event.Involved.uid === this.configuration.Id);
+      this.state.eventWarningCount = KubernetesEventHelper.warningCount(this.events);
+    } catch (err) {
+      this.Notifications('Failure', err, 'Unable to retrieve events');
+    } finally {
+      this.state.eventsLoading = false;
+    }
+  }
+
+  getEvents(namespace) {
+    return this.$async(this.getEventsAsync, namespace);
+  }
+
+  async getConfigurationsAsync() {
+    try {
+      this.configurations = await this.KubernetesConfigurationService.get();
+    } catch (err) {
+      this.Notifications.error('Failure', err, 'Unable to retrieve configurations');
+    }
+  }
+
+  getConfigurations() {
+    return this.$async(this.getConfigurationsAsync);
+  }
+
+  tagUsedDataKeys() {
+    const configName = this.$transition$.params().name;
+    const usedDataKeys = _.uniq(
+      this.configuration.Applications.flatMap((app) =>
+        app.Env.filter((e) => e.valueFrom && e.valueFrom.configMapKeyRef && e.valueFrom.configMapKeyRef.name === configName).map((e) => e.name)
+      )
+    );
+
+    this.formValues.Data = this.formValues.Data.map((variable) => {
+      if (!usedDataKeys.includes(variable.Key)) {
+        return variable;
+      }
+
+      return { ...variable, Used: true };
+    });
+  }
+
+  async uiCanExit() {
+    if (!this.formValues.IsSimple && this.formValues.DataYaml !== this.oldDataYaml && this.state.isEditorDirty) {
+      return confirmWebEditorDiscard();
+    }
+  }
+
+  async onInit() {
+    try {
+      this.state = {
+        actionInProgress: false,
+        configurationLoading: true,
+        applicationsLoading: true,
+        eventsLoading: true,
+        showEditorTab: false,
+        viewReady: false,
+        eventWarningCount: 0,
+        activeTab: 0,
+        currentName: this.$state.$current.name,
+        isDataValid: true,
+        isEditorDirty: false,
+      };
+
+      this.state.activeTab = this.LocalStorage.getActiveTab('configuration');
+
+      this.formValues = new KubernetesConfigurationFormValues();
+
+      const configuration = await this.getConfiguration();
+      if (configuration) {
+        await this.getApplications(this.configuration.Namespace);
+        await this.getEvents(this.configuration.Namespace);
+      }
+
+      this.tagUsedDataKeys();
+    } catch (err) {
+      this.Notifications.error('Failure', err, 'Unable to load view data');
+    } finally {
+      this.state.viewReady = true;
+    }
+
+    this.$window.onbeforeunload = () => {
+      if (!this.formValues.IsSimple && this.formValues.DataYaml !== this.oldDataYaml && this.state.isEditorDirty) {
+        return '';
+      }
+    };
+  }
+
+  $onInit() {
+    return this.$async(this.onInit);
+  }
+
+  $onDestroy() {
+    if (this.state.currentName !== this.$state.$current.name) {
+      this.LocalStorage.storeActiveTab('configuration', 0);
+    }
+    this.state.isEditorDirty = false;
+  }
+}
+
+export default KubernetesConfigMapController;
+angular.module('portainer.kubernetes').controller('KubernetesConfigMapController', KubernetesConfigMapController);
diff --git a/app/kubernetes/views/configurations/configurationsController.js b/app/kubernetes/views/configurations/configurationsController.js
new file mode 100644
index 0000000..bcfd5bf
--- /dev/null
+++ b/app/kubernetes/views/configurations/configurationsController.js
@@ -0,0 +1,112 @@
+import angular from 'angular';
+import { confirmDelete } from '@@/modals/confirm';
+import KubernetesConfigurationHelper from '@/kubernetes/helpers/configurationHelper';
+
+class KubernetesConfigurationsController {
+  /* @ngInject */
+  constructor($async, $state, Notifications, Authentication, KubernetesConfigurationService, KubernetesApplicationService) {
+    this.$async = $async;
+    this.$state = $state;
+    this.Notifications = Notifications;
+    this.Authentication = Authentication;
+    this.KubernetesConfigurationService = KubernetesConfigurationService;
+    this.KubernetesApplicationService = KubernetesApplicationService;
+
+    this.onInit = this.onInit.bind(this);
+    this.getConfigurations = this.getConfigurations.bind(this);
+    this.getConfigurationsAsync = this.getConfigurationsAsync.bind(this);
+    this.getApplicationsAsync = this.getApplicationsAsync.bind(this);
+    this.removeAction = this.removeAction.bind(this);
+    this.removeActionAsync = this.removeActionAsync.bind(this);
+    this.refreshCallback = this.refreshCallback.bind(this);
+    this.refreshCallbackAsync = this.refreshCallbackAsync.bind(this);
+  }
+
+  async getConfigurationsAsync() {
+    try {
+      this.state.configurationsLoading = true;
+      this.configurations = await this.KubernetesConfigurationService.get();
+      KubernetesConfigurationHelper.setConfigurationsUsed(this.configurations, this.applications);
+    } catch (err) {
+      this.Notifications.error('Failure', err, 'Unable to retrieve ConfigMaps & Secrets');
+    } finally {
+      this.state.configurationsLoading = false;
+    }
+  }
+
+  getConfigurations() {
+    return this.$async(this.getConfigurationsAsync);
+  }
+
+  async removeActionAsync(selectedItems) {
+    let actionCount = selectedItems.length;
+    for (const configuration of selectedItems) {
+      try {
+        await this.KubernetesConfigurationService.delete(configuration);
+        this.Notifications.success('ConfigMaps/Secrets successfully removed', configuration.Name);
+        const index = this.configurations.indexOf(configuration);
+        this.configurations.splice(index, 1);
+      } catch (err) {
+        this.Notifications.error('Failure', err, 'Unable to remove ConfigMaps/Secrets');
+      } finally {
+        --actionCount;
+        if (actionCount === 0) {
+          this.$state.reload(this.$state.current);
+        }
+      }
+    }
+  }
+
+  removeAction(selectedItems) {
+    confirmDelete('Do you want to remove the selected ConfigMap(s) & Secret(s)?').then((confirmed) => {
+      if (confirmed) {
+        return this.$async(this.removeActionAsync, selectedItems);
+      }
+    });
+  }
+
+  async getApplicationsAsync() {
+    try {
+      this.state.applicationsLoading = true;
+      this.applications = await this.KubernetesApplicationService.get();
+    } catch (err) {
+      this.Notifications.error('Failure', err, 'Unable to retrieve applications');
+    } finally {
+      this.state.applicationsLoading = false;
+    }
+  }
+
+  getApplications() {
+    return this.$async(this.getApplicationsAsync);
+  }
+
+  async refreshCallbackAsync() {
+    await this.getConfigurations();
+    await this.getApplications();
+  }
+
+  refreshCallback() {
+    return this.$async(this.refreshCallbackAsync);
+  }
+
+  async onInit() {
+    this.state = {
+      configurationsLoading: true,
+      applicationsLoading: true,
+      viewReady: false,
+      isAdmin: this.Authentication.isAdmin(),
+    };
+
+    await this.getApplications();
+    await this.getConfigurations();
+
+    this.state.viewReady = true;
+  }
+
+  $onInit() {
+    return this.$async(this.onInit);
+  }
+}
+
+export default KubernetesConfigurationsController;
+angular.module('portainer.kubernetes').controller('KubernetesConfigurationsController', KubernetesConfigurationsController);
diff --git a/app/kubernetes/views/configurations/secret/create/createSecret.html b/app/kubernetes/views/configurations/secret/create/createSecret.html
new file mode 100644
index 0000000..f34bc5d
--- /dev/null
+++ b/app/kubernetes/views/configurations/secret/create/createSecret.html
@@ -0,0 +1,233 @@
+<page-header
+  ng-if="ctrl.state.viewReady"
+  title="'Create Secret'"
+  breadcrumbs="[{ label:'ConfigMaps and Secrets', link:'kubernetes.configurations', linkParams:{ tab: 'secrets' } }, 'Create a Secret']"
+  reload="true"
+></page-header>
+
+<kubernetes-view-loading view-ready="ctrl.state.viewReady"></kubernetes-view-loading>
+
+<div ng-if="ctrl.state.viewReady">
+  <div class="row">
+    <div class="col-xs-12">
+      <rd-widget>
+        <rd-widget-body>
+          <form class="form-horizontal" name="kubernetesConfigurationCreationForm" autocomplete="off">
+            <!-- resource-pool -->
+            <div class="form-group" ng-if="ctrl.formValues.ResourcePool">
+              <label for="resource-pool-selector" class="col-sm-3 col-lg-2 control-label text-left">Namespace</label>
+              <div class="col-sm-8 col-lg-9">
+                <select
+                  class="form-control"
+                  id="resource-pool-selector"
+                  ng-model="ctrl.formValues.ResourcePool"
+                  ng-options="resourcePool.Namespace.Name for resourcePool in ctrl.resourcePools"
+                  ng-change="ctrl.onResourcePoolSelectionChange()"
+                  data-cy="k8sConfigCreate-namespaceDropdown"
+                ></select>
+              </div>
+            </div>
+            <div class="form-group" ng-if="ctrl.state.resourcePoolHasQuota && ctrl.resourceQuotaCapacityExceeded() && ctrl.formValues.ResourcePool">
+              <div class="col-sm-12 small text-warning vertical-center">
+                <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon>
+                This namespace has exhausted its resource capacity and you will not be able to deploy the configuration. Contact your administrator to expand the capacity of the
+                namespace.
+              </div>
+            </div>
+            <div class="form-group" ng-if="!ctrl.formValues.ResourcePool">
+              <div class="col-sm-12 small text-warning vertical-center">
+                <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon>
+                You do not have access to any namespace. Contact your administrator to get access to a namespace.
+              </div>
+            </div>
+            <!-- !resource-pool -->
+
+            <!-- name -->
+            <div class="form-group">
+              <label for="configuration_name" class="col-sm-3 col-lg-2 control-label required text-left">Name</label>
+              <div class="col-sm-8 col-lg-9 mb-0">
+                <input
+                  type="text"
+                  data-cy="k8sConfigCreate-nameInput"
+                  class="form-control"
+                  id="configuration_name"
+                  name="configuration_name"
+                  ng-model="ctrl.formValues.Name"
+                  ng-pattern="/^[a-z0-9]([a-z0-9-.]{0,61}[a-z0-9])?$/"
+                  ng-change="ctrl.onChangeName()"
+                  placeholder="my-secret"
+                  auto-focus
+                  required
+                />
+                <div ng-show="kubernetesConfigurationCreationForm.configuration_name.$invalid || ctrl.state.alreadyExist">
+                  <div class="help-block small text-warning">
+                    <div ng-messages="kubernetesConfigurationCreationForm.configuration_name.$error">
+                      <p ng-message="required" class="vertical-center"><pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon> This field is required.</p>
+                      <p ng-message="pattern" class="vertical-center"
+                        ><pr-icon icon="'alert-triangle'" mode="'warning'" class="vertical-center"></pr-icon> This field must consist of lower case alphanumeric characters, '-' or
+                        '.', and contain at most 63 characters, and must start and end with an alphanumeric character.</p
+                      >
+                    </div>
+                    <p ng-if="ctrl.state.alreadyExist" class="vertical-center"
+                      ><pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon> A configuration with the same name already exists inside the selected namespace.</p
+                    >
+                  </div>
+                </div>
+              </div>
+            </div>
+            <!-- !name -->
+
+            <div class="col-sm-12 !p-0">
+              <annotations-be-teaser></annotations-be-teaser>
+            </div>
+
+            <div ng-if="ctrl.formValues.ResourcePool">
+              <div class="col-sm-12 form-section-title"> Information </div>
+              <div class="form-group">
+                <div class="col-sm-12 small text-muted vertical-center">
+                  <pr-icon icon="'info'" mode="'primary'"></pr-icon>
+                  <span>
+                    More information about types of secret can be found in the official
+                    <a class="hyperlink" href="https://kubernetes.io/docs/concepts/configuration/secret/#secret-types" target="_blank">Kubernetes documentation</a>.
+                  </span>
+                </div>
+              </div>
+
+              <div class="form-group">
+                <label for="configuration_data_type" class="col-sm-3 col-lg-2 control-label text-left">Type</label>
+                <div class="col-sm-8 col-lg-9">
+                  <select
+                    class="form-control"
+                    id="configuration_data_type"
+                    ng-model="ctrl.formValues.Type"
+                    ng-options="value.value as value.name for (name, value) in ctrl.KubernetesSecretTypeOptions"
+                    ng-change="ctrl.onSecretTypeChange()"
+                    data-cy="k8sConfigCreate-typeDropdown"
+                  ></select>
+
+                  <div class="col-sm-3 col-lg-2"></div>
+                </div>
+                <div ng-if="ctrl.formValues.Type === ctrl.KubernetesSecretTypeOptions.SERVICEACCOUNTTOKEN.value" class="col-sm-12 small text-warning vertical-center pt-5">
+                  <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon>
+                  <span
+                    >You should only create a service account token Secret object if you can't use the TokenRequest API to obtain a token, and the security exposure of persisting a
+                    non-expiring token credential in a readable API object is acceptable to you. <br />See
+                    <a href="https://kubernetes.io/docs/concepts/configuration/secret/#service-account-token-secrets" target="_blank">service account token secrets</a> in the
+                    kubernetes documentation.</span
+                  >
+                </div>
+                <div ng-if="ctrl.formValues.Type === ctrl.KubernetesSecretTypeOptions.DOCKERCFG.value" class="col-sm-12 small text-muted vertical-center pt-5">
+                  <pr-icon icon="'info'" mode="'primary'"></pr-icon>
+                  <span>Ensure the Secret data field contains a <code>.dockercfg</code> key whose value is content of a legacy <code>~/.dockercfg</code> file.</span>
+                </div>
+                <div ng-if="ctrl.formValues.Type === ctrl.KubernetesSecretTypeOptions.DOCKERCONFIGJSON.value" class="col-sm-12 small text-muted vertical-center pt-5">
+                  <pr-icon icon="'info'" mode="'primary'"></pr-icon>
+                  <span>Ensure the Secret data field contains a <code>.dockerconfigjson</code> key whose value is content of a <code>~/.docker/config.json</code> file.</span>
+                </div>
+                <div ng-if="ctrl.formValues.Type === ctrl.KubernetesSecretTypeOptions.TLS.value" class="col-sm-12 small text-muted vertical-center pt-5">
+                  <pr-icon icon="'info'" mode="'primary'"></pr-icon>
+                  <span>Ensure the Secret data field contains a <code>tls.key</code> key and a <code>tls.crt</code> key.</span>
+                </div>
+                <div ng-if="ctrl.formValues.Type === ctrl.KubernetesSecretTypeOptions.BOOTSTRAPTOKEN.value" class="col-sm-12 small text-muted vertical-center pt-5">
+                  <pr-icon icon="'info'" mode="'primary'"></pr-icon>
+                  <span
+                    >Ensure the Secret data field contains a <code>token-id</code> key and a <code>token-secret</code> key. See
+                    <a href="https://kubernetes.io/docs/concepts/configuration/secret/#bootstrap-token-secrets" target="_blank">bootstrap token secrets</a> in the kubernetes
+                    documentation for optional keys.</span
+                  >
+                </div>
+              </div>
+              <div class="form-group" ng-if="ctrl.formValues.Type === ctrl.KubernetesSecretTypeOptions.CUSTOM.value">
+                <label for="configuration_data_customtype" class="col-sm-3 col-lg-2 control-label required text-left">Custom Type</label>
+                <div class="col-sm-8 col-lg-9">
+                  <input
+                    type="text"
+                    data-cy="k8sConfigCreate-customType-input"
+                    name="custom_type"
+                    class="form-control"
+                    id="configuration_data_customtype"
+                    ng-model="ctrl.formValues.customType"
+                    ng-pattern="/^[a-z0-9]([a-z0-9-.]{0,61}[a-z0-9])?$/"
+                    required
+                  />
+                  <div ng-show="kubernetesConfigurationCreationForm.custom_type.$invalid">
+                    <div class="help-block small text-warning">
+                      <div ng-messages="kubernetesConfigurationCreationForm.custom_type.$error">
+                        <p ng-message="required" class="vertical-center"><pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon> This field is required.</p>
+                        <p ng-message="pattern" class="vertical-center"
+                          ><pr-icon icon="'alert-triangle'" mode="'warning'" class="vertical-center"></pr-icon> This field must consist of lower case alphanumeric characters, '-'
+                          or '.', and contain at most 63 characters, and must start and end with an alphanumeric character.</p
+                        >
+                      </div>
+                    </div>
+                  </div>
+                </div>
+              </div>
+              <div class="form-group" ng-if="ctrl.formValues.Type === ctrl.KubernetesSecretTypeOptions.SERVICEACCOUNTTOKEN.value">
+                <label for="service_account" class="col-sm-3 col-lg-2 control-label required text-left">Service Account</label>
+                <div class="col-sm-8 col-lg-9">
+                  <select
+                    class="form-control"
+                    id="service_account"
+                    ng-selected="$first"
+                    ng-model="ctrl.formValues.ServiceAccountName"
+                    ng-options="value.metadata.name as value.metadata.name for (name, value) in ctrl.availableServiceAccounts"
+                    data-cy="k8sConfigCreate-serviceAccountDropdown"
+                    ng-change="ctrl.onChangeServiceAccount()"
+                    required
+                  ></select>
+                  <div class="help-block small text-warning" ng-messages="kubernetesConfigurationCreationForm.service_account.$error">
+                    <p class="vertical-center" ng-message="required"> <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon>This field is required.</p>
+                  </div>
+                </div>
+              </div>
+
+              <kubernetes-configuration-data
+                ng-if="ctrl.formValues"
+                form-values="ctrl.formValues"
+                is-docker-config="ctrl.state.isDockerConfig"
+                is-valid="ctrl.state.isDataValid"
+                on-change-validation="ctrl.isFormValid()"
+                is-creation="true"
+                type="'secret'"
+                is-editor-dirty="ctrl.state.isEditorDirty"
+              ></kubernetes-configuration-data>
+
+              <div class="form-group" ng-if="ctrl.state.secretWarningMessage">
+                <div class="col-sm-12 small text-warning vertical-center pt-5">
+                  <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon>
+                  <span>{{ ctrl.state.secretWarningMessage }}</span>
+                </div>
+              </div>
+            </div>
+
+            <!-- summary -->
+            <kubernetes-summary-view
+              ng-if="!(!kubernetesConfigurationCreationForm.$valid || !ctrl.isFormValid() || ctrl.state.actionInProgress)"
+              form-values="ctrl.formValues"
+            ></kubernetes-summary-view>
+
+            <!-- actions -->
+            <div class="col-sm-12 form-section-title" style="margin-top: 10px"> Actions </div>
+            <div class="form-group">
+              <div class="col-sm-12">
+                <button
+                  type="button"
+                  class="btn btn-primary btn-sm !ml-0"
+                  ng-disabled="!kubernetesConfigurationCreationForm.$valid || !ctrl.isFormValid() || ctrl.state.actionInProgress || !ctrl.formValues.ResourcePool"
+                  ng-click="ctrl.createConfiguration()"
+                  button-spinner="ctrl.state.actionInProgress"
+                  data-cy="k8sConfigCreate-CreateConfigButton"
+                >
+                  <span ng-hide="ctrl.state.actionInProgress">Create {{ ctrl.formValues.Kind | kubernetesConfigurationKindText }}</span>
+                  <span ng-show="ctrl.state.actionInProgress">Creation in progress...</span>
+                </button>
+              </div>
+            </div>
+            <!-- !actions -->
+          </form>
+        </rd-widget-body>
+      </rd-widget>
+    </div>
+  </div>
+</div>
diff --git a/app/kubernetes/views/configurations/secret/create/createSecret.js b/app/kubernetes/views/configurations/secret/create/createSecret.js
new file mode 100644
index 0000000..54e9e05
--- /dev/null
+++ b/app/kubernetes/views/configurations/secret/create/createSecret.js
@@ -0,0 +1,5 @@
+angular.module('portainer.kubernetes').component('kubernetesCreateSecretView', {
+  templateUrl: './createSecret.html',
+  controller: 'KubernetesCreateSecretController',
+  controllerAs: 'ctrl',
+});
diff --git a/app/kubernetes/views/configurations/secret/create/createSecretController.js b/app/kubernetes/views/configurations/secret/create/createSecretController.js
new file mode 100644
index 0000000..4dbfe4f
--- /dev/null
+++ b/app/kubernetes/views/configurations/secret/create/createSecretController.js
@@ -0,0 +1,212 @@
+import angular from 'angular';
+import _ from 'lodash-es';
+import { KubernetesConfigurationFormValues, KubernetesConfigurationFormValuesEntry } from '@/kubernetes/models/configuration/formvalues';
+import { KubernetesConfigurationKinds, KubernetesSecretTypeOptions } from '@/kubernetes/models/configuration/models';
+import KubernetesConfigurationHelper from '@/kubernetes/helpers/configurationHelper';
+import KubernetesNamespaceHelper from '@/kubernetes/helpers/namespaceHelper';
+import { getServiceAccounts } from '@/kubernetes/rest/serviceAccount';
+
+import { confirmWebEditorDiscard } from '@@/modals/confirm';
+import { isConfigurationFormValid } from '../../validation';
+
+class KubernetesCreateSecretController {
+  /* @ngInject */
+  constructor($async, $state, $scope, $window, Notifications, Authentication, KubernetesConfigurationService, KubernetesResourcePoolService, EndpointProvider) {
+    this.$async = $async;
+    this.$state = $state;
+    this.$scope = $scope;
+    this.$window = $window;
+    this.EndpointProvider = EndpointProvider;
+    this.Notifications = Notifications;
+    this.Authentication = Authentication;
+    this.KubernetesConfigurationService = KubernetesConfigurationService;
+    this.KubernetesResourcePoolService = KubernetesResourcePoolService;
+    this.KubernetesConfigurationKinds = KubernetesConfigurationKinds;
+    this.KubernetesSecretTypeOptions = KubernetesSecretTypeOptions;
+
+    this.onInit = this.onInit.bind(this);
+    this.createConfigurationAsync = this.createConfigurationAsync.bind(this);
+    this.getConfigurationsAsync = this.getConfigurationsAsync.bind(this);
+    this.onResourcePoolSelectionChangeAsync = this.onResourcePoolSelectionChangeAsync.bind(this);
+    this.onSecretTypeChange = this.onSecretTypeChange.bind(this);
+  }
+
+  onChangeName() {
+    const filteredConfigurations = _.filter(
+      this.configurations,
+      (config) => config.Namespace === this.formValues.ResourcePool.Namespace.Name && config.Kind === this.formValues.Kind
+    );
+    this.state.alreadyExist = _.find(filteredConfigurations, (config) => config.Name === this.formValues.Name) !== undefined;
+  }
+
+  async onResourcePoolSelectionChangeAsync() {
+    try {
+      this.onChangeName();
+      this.availableServiceAccounts = await getServiceAccounts(this.environmentId, this.formValues.ResourcePool.Name);
+      this.formValues.ServiceAccountName = this.availableServiceAccounts.length > 0 ? this.availableServiceAccounts[0].metadata.name : '';
+    } catch (err) {
+      this.Notifications.error('Failure', err, 'Unable to load service accounts');
+    }
+  }
+  onResourcePoolSelectionChange() {
+    this.$async(this.onResourcePoolSelectionChangeAsync);
+  }
+
+  onSecretTypeChange() {
+    switch (this.formValues.Type) {
+      case KubernetesSecretTypeOptions.OPAQUE.value:
+      case KubernetesSecretTypeOptions.CUSTOM.value:
+        this.formValues.Data = this.formValues.Data.filter((entry) => entry.Value !== '');
+        if (this.formValues.Data.length === 0) {
+          this.addRequiredKeysToForm(['']);
+        }
+        this.state.isDockerConfig = false;
+        break;
+      case KubernetesSecretTypeOptions.SERVICEACCOUNTTOKEN.value:
+        // data isn't required for service account tokens, so remove the data fields if they are empty
+        this.addRequiredKeysToForm([]);
+        this.state.isDockerConfig = false;
+        break;
+      case KubernetesSecretTypeOptions.DOCKERCONFIGJSON.value:
+        this.addRequiredKeysToForm(['.dockerconfigjson']);
+        this.state.isDockerConfig = true;
+        break;
+      case KubernetesSecretTypeOptions.DOCKERCFG.value:
+        this.addRequiredKeysToForm(['.dockercfg']);
+        this.state.isDockerConfig = true;
+        break;
+      case KubernetesSecretTypeOptions.BASICAUTH.value:
+        this.addRequiredKeysToForm(['username', 'password']);
+        this.state.isDockerConfig = false;
+        break;
+      case KubernetesSecretTypeOptions.SSHAUTH.value:
+        this.addRequiredKeysToForm(['ssh-privatekey']);
+        this.state.isDockerConfig = false;
+        break;
+      case KubernetesSecretTypeOptions.TLS.value:
+        this.addRequiredKeysToForm(['tls.crt', 'tls.key']);
+        this.state.isDockerConfig = false;
+        break;
+      case KubernetesSecretTypeOptions.BOOTSTRAPTOKEN.value:
+        this.addRequiredKeysToForm(['token-id', 'token-secret']);
+        this.state.isDockerConfig = false;
+        break;
+      default:
+        this.state.isDockerConfig = false;
+        break;
+    }
+    this.isFormValid();
+  }
+
+  addRequiredKeysToForm(keys) {
+    // remove data entries that have an empty value
+    this.formValues.Data = this.formValues.Data.filter((entry) => entry.Value);
+
+    keys.forEach((key) => {
+      // if the key doesn't exist on the form, add a new formValues.Data entry
+      if (!this.formValues.Data.some((data) => data.Key === key)) {
+        this.formValues.Data.push(new KubernetesConfigurationFormValuesEntry());
+        const index = this.formValues.Data.length - 1;
+        this.formValues.Data[index].Key = key;
+      }
+    });
+  }
+
+  isFormValid() {
+    const [isValid, warningMessage] = isConfigurationFormValid(this.state.alreadyExist, this.state.isDataValid, this.formValues);
+    this.state.secretWarningMessage = warningMessage;
+    return isValid;
+  }
+
+  async createConfigurationAsync() {
+    try {
+      this.state.actionInProgress = true;
+      this.formValues.ConfigurationOwner = this.Authentication.getUserDetails().username;
+      if (!this.formValues.IsSimple) {
+        this.formValues.Data = KubernetesConfigurationHelper.parseYaml(this.formValues);
+      }
+
+      await this.KubernetesConfigurationService.create(this.formValues);
+
+      this.Notifications.success('Success', `Secret successfully created`);
+      this.state.isEditorDirty = false;
+      this.$state.go('kubernetes.configurations', { tab: 'secrets' });
+    } catch (err) {
+      this.Notifications.error('Failure', err, `Unable to create secret`);
+    } finally {
+      this.state.actionInProgress = false;
+    }
+  }
+
+  createConfiguration() {
+    return this.$async(this.createConfigurationAsync);
+  }
+
+  async getConfigurationsAsync() {
+    try {
+      this.configurations = await this.KubernetesConfigurationService.get();
+    } catch (err) {
+      this.Notifications.error('Failure', err, 'Unable to retrieve Secrets');
+    }
+  }
+
+  getConfigurations() {
+    return this.$async(this.getConfigurationsAsync);
+  }
+
+  async uiCanExit() {
+    if (!this.formValues.IsSimple && this.formValues.DataYaml && this.state.isEditorDirty) {
+      return confirmWebEditorDiscard();
+    }
+  }
+
+  async onInit() {
+    this.state = {
+      actionInProgress: false,
+      viewReady: false,
+      alreadyExist: false,
+      isDataValid: true,
+      isEditorDirty: false,
+      isDockerConfig: false,
+      secretWarningMessage: '',
+    };
+
+    this.formValues = new KubernetesConfigurationFormValues();
+    this.formValues.Kind = KubernetesConfigurationKinds.SECRET;
+    this.formValues.Data = [new KubernetesConfigurationFormValuesEntry()];
+
+    try {
+      const resourcePools = await this.KubernetesResourcePoolService.get();
+      this.resourcePools = _.filter(
+        resourcePools,
+        (resourcePool) => !KubernetesNamespaceHelper.isSystemNamespace(resourcePool.Namespace.Name) && resourcePool.Namespace.Status === 'Active'
+      );
+
+      this.formValues.ResourcePool = this.resourcePools[0];
+      this.environmentId = this.EndpointProvider.endpointID();
+      this.availableServiceAccounts = await getServiceAccounts(this.environmentId, this.resourcePools[0].Namespace.Name);
+      this.formValues.ServiceAccountName = this.availableServiceAccounts.length > 0 ? this.availableServiceAccounts[0].metadata.name : '';
+    } catch (err) {
+      this.Notifications.error('Failure', err, 'Unable to load view data');
+    } finally {
+      this.state.viewReady = true;
+    }
+
+    this.$window.onbeforeunload = () => {
+      if (!this.formValues.IsSimple && this.formValues.DataYaml && this.state.isEditorDirty) {
+        return '';
+      }
+    };
+  }
+
+  $onInit() {
+    return this.$async(this.onInit);
+  }
+
+  $onDestroy() {
+    this.state.isEditorDirty = false;
+  }
+}
+
+export default KubernetesCreateSecretController;
+angular.module('portainer.kubernetes').controller('KubernetesCreateSecretController', KubernetesCreateSecretController);
diff --git a/app/kubernetes/views/configurations/secret/edit/secret.html b/app/kubernetes/views/configurations/secret/edit/secret.html
new file mode 100644
index 0000000..6b0ec77
--- /dev/null
+++ b/app/kubernetes/views/configurations/secret/edit/secret.html
@@ -0,0 +1,120 @@
+<page-header
+  ng-if="ctrl.state.viewReady"
+  title="'Secret details'"
+  breadcrumbs="[
+    { label:'Namespaces', link:'kubernetes.resourcePools' },
+    {
+      label:ctrl.configuration.Namespace,
+      link: 'kubernetes.resourcePools.resourcePool',
+      linkParams:{ id: ctrl.configuration.Namespace }
+    },
+    { label:'ConfigMaps and Secrets', link:'kubernetes.configurations', linkParams:{ tab: 'secrets' } },
+    ctrl.configuration.Name,
+     ]"
+  reload="true"
+>
+</page-header>
+
+<kubernetes-view-loading view-ready="ctrl.state.viewReady"></kubernetes-view-loading>
+
+<div ng-if="ctrl.state.viewReady">
+  <secret-item-tabs-widget
+    name="ctrl.configuration.Name"
+    namespace="ctrl.configuration.Namespace"
+    secret-type-label="ctrl.secretTypeName"
+    is-system="ctrl.isSystemNamespace()"
+    registry-id="ctrl.getRegistryId()"
+    resource-id="ctrl.configuration.Id"
+  ></secret-item-tabs-widget>
+
+  <div class="row">
+    <div class="col-sm-12">
+      <rd-widget>
+        <rd-widget-body>
+          <form ng-if="!ctrl.isSystemConfig()" class="form-horizontal" name="kubernetesConfigurationCreationForm" autocomplete="off">
+            <div class="col-sm-12 !p-0">
+              <annotations-be-teaser></annotations-be-teaser>
+            </div>
+
+            <kubernetes-configuration-data
+              ng-if="ctrl.formValues"
+              form-values="ctrl.formValues"
+              is-docker-config="ctrl.state.isDockerConfig"
+              is-valid="ctrl.state.isDataValid"
+              on-change-validation="ctrl.isFormValid()"
+              is-creation="false"
+              type="'secret'"
+              is-editor-dirty="ctrl.state.isEditorDirty"
+            ></kubernetes-configuration-data>
+
+            <div class="form-group" ng-if="ctrl.state.secretWarningMessage">
+              <div class="col-sm-12 small text-warning vertical-center pt-5">
+                <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon>
+                <span>{{ ctrl.state.secretWarningMessage }}</span>
+              </div>
+            </div>
+
+            <!-- summary -->
+            <kubernetes-summary-view-react
+              ng-if="!(!ctrl.isFormValid() || !kubernetesConfigurationCreationForm.$valid || ctrl.state.actionInProgress)"
+              actions="ctrl.state.summaryActions"
+            ></kubernetes-summary-view-react>
+
+            <!-- actions -->
+            <div class="col-sm-12 form-section-title" style="margin-top: 10px"> Actions </div>
+            <div class="form-group">
+              <div class="col-sm-12">
+                <button
+                  type="button"
+                  class="btn btn-primary btn-sm !ml-0"
+                  ng-disabled="!ctrl.isFormValid() || !kubernetesConfigurationCreationForm.$valid || ctrl.state.actionInProgress"
+                  ng-click="ctrl.updateConfiguration()"
+                  button-spinner="ctrl.state.actionInProgress"
+                  data-cy="k8sConfigDetail-updateConfig"
+                >
+                  <span ng-hide="ctrl.state.actionInProgress">Update {{ ctrl.configuration.Kind | kubernetesConfigurationKindText }}</span>
+                  <span ng-show="ctrl.state.actionInProgress">Update in progress...</span>
+                </button>
+              </div>
+            </div>
+            <!-- !actions -->
+          </form>
+          <div ng-if="ctrl.isSystemConfig()">
+            <div class="col-sm-12 form-section-title" style="margin-top: 10px"> Data </div>
+            <table class="table">
+              <tbody>
+                <tr class="text-muted">
+                  <td style="width: 10%; border-top: none">Key</td>
+                  <td style="width: 90%; border-top: none">Value</td>
+                </tr>
+
+                <tr ng-repeat="item in ctrl.formValues.Data track by $index">
+                  <td>{{ item.Key }}</td>
+                  <td>
+                    <div style="white-space: pre-wrap">{{ item.Value }}</div>
+                    <div style="margin-top: 2px">
+                      <span class="btn btn-primary btn-xs" ng-click="ctrl.copyConfigurationValue($index)"> <pr-icon icon="'copy'" class-name="'mr-0.5'"></pr-icon>Copy </span>
+                      <span id="copyValueNotification_{{ $index }}" style="display: none; color: #23ae89; margin-left: 5px" class="small">
+                        <pr-icon icon="'check'"></pr-icon> copied
+                      </span>
+                    </div>
+                  </td>
+                </tr>
+              </tbody>
+            </table>
+          </div>
+        </rd-widget-body>
+      </rd-widget>
+    </div>
+  </div>
+
+  <kubernetes-integrated-applications-datatable
+    ng-if="ctrl.configuration.Used"
+    dataset="ctrl.configuration.Applications"
+    is-loading="ctrl.state.applicationsLoading"
+    table-key="'kubernetes.secrets.applications'"
+    on-refresh="(ctrl.getApplications)"
+    table-title="'Applications using this secret'"
+  >
+  </kubernetes-integrated-applications-datatable>
+</div>
diff --git a/app/kubernetes/views/configurations/secret/edit/secret.js b/app/kubernetes/views/configurations/secret/edit/secret.js
new file mode 100644
index 0000000..f59157d
--- /dev/null
+++ b/app/kubernetes/views/configurations/secret/edit/secret.js
@@ -0,0 +1,8 @@
+angular.module('portainer.kubernetes').component('kubernetesSecretView', {
+  templateUrl: './secret.html',
+  controller: 'KubernetesSecretController',
+  controllerAs: 'ctrl',
+  bindings: {
+    $transition$: '<',
+  },
+});
diff --git a/app/kubernetes/views/configurations/secret/edit/secretController.js b/app/kubernetes/views/configurations/secret/edit/secretController.js
new file mode 100644
index 0000000..6e02e0b
--- /dev/null
+++ b/app/kubernetes/views/configurations/secret/edit/secretController.js
@@ -0,0 +1,326 @@
+import angular from 'angular';
+import _ from 'lodash-es';
+
+import { KubernetesConfigurationFormValues } from '@/kubernetes/models/configuration/formvalues';
+import { KubernetesConfigurationKinds, KubernetesSecretTypeOptions } from '@/kubernetes/models/configuration/models';
+import KubernetesConfigurationHelper from '@/kubernetes/helpers/configurationHelper';
+import KubernetesConfigurationConverter from '@/kubernetes/converters/configuration';
+import KubernetesEventHelper from '@/kubernetes/helpers/eventHelper';
+import KubernetesNamespaceHelper from '@/kubernetes/helpers/namespaceHelper';
+
+import { pluralize } from '@/portainer/helpers/strings';
+
+import { confirmUpdate, confirmWebEditorDiscard } from '@@/modals/confirm';
+import { isConfigurationFormValid } from '../../validation';
+import { getConfigurationActions } from '../../../../../react/kubernetes/configs/secrets/summary-utils';
+
+class KubernetesSecretController {
+  /* @ngInject */
+  constructor(
+    $async,
+    $scope,
+    $state,
+    $window,
+    clipboard,
+    Notifications,
+    LocalStorage,
+    KubernetesConfigurationService,
+    KubernetesSecretService,
+    KubernetesResourcePoolService,
+    KubernetesApplicationService,
+    KubernetesEventService
+  ) {
+    this.$async = $async;
+    this.$scope = $scope;
+    this.$state = $state;
+    this.$window = $window;
+    this.clipboard = clipboard;
+    this.Notifications = Notifications;
+    this.LocalStorage = LocalStorage;
+    this.KubernetesConfigurationService = KubernetesConfigurationService;
+    this.KubernetesResourcePoolService = KubernetesResourcePoolService;
+    this.KubernetesApplicationService = KubernetesApplicationService;
+    this.KubernetesEventService = KubernetesEventService;
+    this.KubernetesConfigurationKinds = KubernetesConfigurationKinds;
+    this.KubernetesSecretTypeOptions = KubernetesSecretTypeOptions;
+    this.KubernetesSecretService = KubernetesSecretService;
+
+    this.onInit = this.onInit.bind(this);
+    this.getConfigurationAsync = this.getConfigurationAsync.bind(this);
+    this.getEvents = this.getEvents.bind(this);
+    this.getEventsAsync = this.getEventsAsync.bind(this);
+    this.getApplications = this.getApplications.bind(this);
+    this.getApplicationsAsync = this.getApplicationsAsync.bind(this);
+    this.updateConfiguration = this.updateConfiguration.bind(this);
+    this.updateConfigurationAsync = this.updateConfigurationAsync.bind(this);
+  }
+
+  isSystemNamespace() {
+    return KubernetesNamespaceHelper.isSystemNamespace(this.configuration.Namespace);
+  }
+
+  getRegistryId() {
+    const id = this.configuration?.Annotations?.['portainer.io/registry.id'];
+    return id ? parseInt(id, 10) || undefined : undefined;
+  }
+
+  isSystemConfig() {
+    return this.isSystemNamespace() || this.configuration.IsRegistrySecret;
+  }
+
+  selectTab(index) {
+    this.LocalStorage.storeActiveTab('configuration', index);
+  }
+
+  showEditor() {
+    this.state.showEditorTab = true;
+    this.selectTab(2);
+  }
+
+  copyConfigurationValue(idx) {
+    this.clipboard.copyText(this.formValues.Data[idx].Value);
+    $('#copyValueNotification_' + idx)
+      .show()
+      .fadeOut(2500);
+  }
+
+  isFormValid() {
+    const [isValid, warningMessage] = isConfigurationFormValid(this.state.alreadyExist, this.state.isDataValid, this.formValues);
+    this.state.secretWarningMessage = warningMessage;
+    return isValid;
+  }
+
+  // TODO: refactor
+  // It looks like we're still doing a create/delete process but we've decided to get rid of this
+  // approach.
+  async updateConfigurationAsync() {
+    try {
+      this.state.actionInProgress = true;
+      if (this.formValues.Kind !== this.configuration.Kind || this.formValues.ResourcePool !== this.configuration.Namespace || this.formValues.Name !== this.configuration.Name) {
+        await this.KubernetesConfigurationService.create(this.formValues);
+        await this.KubernetesConfigurationService.delete(this.configuration);
+        this.Notifications.success('Success', `Secret successfully updated`);
+        this.$state.go(
+          'kubernetes.secrets.secret',
+          {
+            namespace: this.formValues.ResourcePool,
+            name: this.formValues.Name,
+          },
+          { reload: true }
+        );
+      } else {
+        await this.KubernetesConfigurationService.update(this.formValues, this.configuration);
+        this.Notifications.success('Success', `Secret successfully updated`);
+        this.$state.reload(this.$state.current);
+      }
+    } catch (err) {
+      this.Notifications.error('Failure', err, `Unable to update Secret`);
+    } finally {
+      this.state.actionInProgress = false;
+    }
+  }
+
+  updateConfiguration() {
+    if (this.configuration.Used) {
+      confirmUpdate(
+        `The changes will be propagated to ${this.configuration.Applications.length} running ${pluralize(
+          this.configuration.Applications.length,
+          'application'
+        )}. Are you sure you want to update this Secret?`,
+        (confirmed) => {
+          if (confirmed) {
+            return this.$async(this.updateConfigurationAsync);
+          }
+        }
+      );
+    } else {
+      return this.$async(this.updateConfigurationAsync);
+    }
+  }
+
+  async getConfigurationAsync() {
+    try {
+      this.state.configurationLoading = true;
+      const name = this.$transition$.params().name;
+      const namespace = this.$transition$.params().namespace;
+      try {
+        const secret = await this.KubernetesSecretService.get(namespace, name);
+        this.configuration = KubernetesConfigurationConverter.secretToConfiguration(secret);
+        this.formValues.Data = secret.Data;
+      } catch (err) {
+        if (err.status === 403) {
+          this.$state.go('kubernetes.configurations', { tab: 'secrets' });
+          throw new Error('Not authorized to edit secret', { cause: err });
+        }
+      }
+      this.formValues.ResourcePool = this.configuration.Namespace;
+      this.formValues.Id = this.configuration.Id;
+      this.formValues.Name = this.configuration.Name;
+      this.formValues.Type = this.configuration.Type;
+      this.formValues.Kind = this.configuration.Kind;
+      this.oldDataYaml = this.formValues.DataYaml;
+      this.formValues.Labels = this.configuration.Labels;
+
+      return this.configuration;
+    } catch (err) {
+      this.Notifications.error('Failure', err, 'Unable to retrieve secret');
+    } finally {
+      this.state.configurationLoading = false;
+    }
+  }
+
+  getConfiguration() {
+    return this.$async(this.getConfigurationAsync);
+  }
+
+  async getApplicationsAsync(namespace) {
+    try {
+      this.state.applicationsLoading = true;
+      const applications = await this.KubernetesApplicationService.get(namespace);
+      this.configuration.Applications = KubernetesConfigurationHelper.getUsingApplications(this.configuration, applications);
+      KubernetesConfigurationHelper.setConfigurationUsed(this.configuration);
+    } catch (err) {
+      this.Notifications.error('Failure', err, 'Unable to retrieve applications');
+    } finally {
+      this.state.applicationsLoading = false;
+    }
+  }
+
+  getApplications(namespace) {
+    return this.$async(this.getApplicationsAsync, namespace);
+  }
+
+  hasEventWarnings() {
+    return this.state.eventWarningCount;
+  }
+
+  async getEventsAsync(namespace) {
+    try {
+      this.state.eventsLoading = true;
+      this.events = await this.KubernetesEventService.get(namespace);
+      this.events = _.filter(this.events, (event) => event.Involved.uid === this.configuration.Id);
+      this.state.eventWarningCount = KubernetesEventHelper.warningCount(this.events);
+    } catch (err) {
+      this.Notifications('Failure', err, 'Unable to retrieve events');
+    } finally {
+      this.state.eventsLoading = false;
+    }
+  }
+
+  getEvents(namespace) {
+    return this.$async(this.getEventsAsync, namespace);
+  }
+
+  tagUsedDataKeys() {
+    const configName = this.$transition$.params().name;
+    const usedDataKeys = _.uniq(
+      this.configuration.Applications.flatMap((app) =>
+        app.Env.filter((e) => e.valueFrom && e.valueFrom.configMapKeyRef && e.valueFrom.configMapKeyRef.name === configName).map((e) => e.name)
+      )
+    );
+
+    this.formValues.Data = this.formValues.Data.map((variable) => {
+      if (!usedDataKeys.includes(variable.Key)) {
+        return variable;
+      }
+
+      return { ...variable, Used: true };
+    });
+  }
+
+  async uiCanExit() {
+    if (!this.formValues.IsSimple && this.formValues.DataYaml !== this.oldDataYaml && this.state.isEditorDirty) {
+      return confirmWebEditorDiscard();
+    }
+  }
+
+  async onInit() {
+    try {
+      this.state = {
+        actionInProgress: false,
+        configurationLoading: true,
+        applicationsLoading: true,
+        eventsLoading: true,
+        showEditorTab: false,
+        viewReady: false,
+        eventWarningCount: 0,
+        activeTab: 0,
+        currentName: this.$state.$current.name,
+        isDataValid: true,
+        isEditorDirty: false,
+        isDockerConfig: false,
+        secretWarningMessage: '',
+        summaryActions: [],
+      };
+
+      this.state.activeTab = this.LocalStorage.getActiveTab('configuration');
+
+      this.formValues = new KubernetesConfigurationFormValues();
+
+      const configuration = await this.getConfiguration();
+      if (configuration) {
+        await this.getApplications(this.configuration.Namespace);
+        await this.getEvents(this.configuration.Namespace);
+      }
+
+      // after loading the configuration, check if it is a docker config secret type
+      if (
+        this.formValues.Kind === this.KubernetesConfigurationKinds.SECRET &&
+        (this.formValues.Type === this.KubernetesSecretTypeOptions.DOCKERCONFIGJSON.value || this.formValues.Type === this.KubernetesSecretTypeOptions.DOCKERCFG.value)
+      ) {
+        this.state.isDockerConfig = true;
+      }
+      // convert the secret type to a human readable value
+      if (this.formValues.Type) {
+        const secretTypeValues = Object.values(this.KubernetesSecretTypeOptions);
+        const secretType = secretTypeValues.find((secretType) => secretType.value === this.formValues.Type);
+        this.secretTypeName = secretType ? secretType.name : this.formValues.Type;
+      } else {
+        this.secretTypeName = '';
+      }
+
+      if (this.formValues.Type === this.KubernetesSecretTypeOptions.SERVICEACCOUNTTOKEN.value) {
+        this.formValues.ServiceAccountName = configuration.ServiceAccountName;
+      }
+
+      this.tagUsedDataKeys();
+
+      // Watch formValues for changes and cache the computed summary actions
+      // Use $watchCollection to avoid infinite digest loops
+      this.$scope.$watchCollection(
+        () => this.formValues?.Data,
+        () => {
+          this.state.summaryActions = getConfigurationActions({
+            isCreate: !this.configuration.Id,
+            secretName: this.formValues.Name,
+            secretType: this.formValues.Type,
+          });
+        }
+      );
+    } catch (err) {
+      this.Notifications.error('Failure', err, 'Unable to load view data');
+    } finally {
+      this.state.viewReady = true;
+    }
+
+    this.$window.onbeforeunload = () => {
+      if (!this.formValues.IsSimple && this.formValues.DataYaml !== this.oldDataYaml && this.state.isEditorDirty) {
+        return '';
+      }
+    };
+  }
+
+  $onInit() {
+    return this.$async(this.onInit);
+  }
+
+  $onDestroy() {
+    if (this.state.currentName !== this.$state.$current.name) {
+      this.LocalStorage.storeActiveTab('configuration', 0);
+    }
+    this.state.isEditorDirty = false;
+  }
+}
+
+export default KubernetesSecretController;
+angular.module('portainer.kubernetes').controller('KubernetesSecretController', KubernetesSecretController);
diff --git a/app/kubernetes/views/configurations/validation.js b/app/kubernetes/views/configurations/validation.js
new file mode 100644
index 0000000..4702aa1
--- /dev/null
+++ b/app/kubernetes/views/configurations/validation.js
@@ -0,0 +1,58 @@
+import { KubernetesSecretTypeOptions } from '@/kubernetes/models/configuration/models';
+import { KubernetesConfigurationKinds } from '@/kubernetes/models/configuration/models';
+
+export function isConfigurationFormValid(alreadyExist, isDataValid, formValues) {
+  const uniqueCheck = !alreadyExist && isDataValid;
+  let secretWarningMessage = '';
+  let isFormValid = false;
+
+  if (formValues.IsSimple) {
+    if (formValues.Kind === KubernetesConfigurationKinds.SECRET) {
+      let isSecretDataValid = true;
+
+      switch (formValues.Type) {
+        case KubernetesSecretTypeOptions.SERVICEACCOUNTTOKEN.value:
+          // data isn't required for service account tokens
+          isFormValid = uniqueCheck && formValues.ResourcePool;
+          return [isFormValid, ''];
+        case KubernetesSecretTypeOptions.DOCKERCFG.value:
+          // needs to contain a .dockercfg key
+          isSecretDataValid = formValues.Data.some((entry) => entry.Key === '.dockercfg');
+          secretWarningMessage = isSecretDataValid ? '' : 'A data entry with a .dockercfg key is required.';
+          break;
+        case KubernetesSecretTypeOptions.DOCKERCONFIGJSON.value:
+          // needs to contain a .dockerconfigjson key
+          isSecretDataValid = formValues.Data.some((entry) => entry.Key === '.dockerconfigjson');
+          secretWarningMessage = isSecretDataValid ? '' : 'A data entry with a .dockerconfigjson key. is required.';
+          break;
+        case KubernetesSecretTypeOptions.BASICAUTH.value:
+          isSecretDataValid = formValues.Data.some((entry) => entry.Key === 'username' || entry.Key === 'password');
+          secretWarningMessage = isSecretDataValid ? '' : 'A data entry with a username or password key is required.';
+          break;
+        case KubernetesSecretTypeOptions.SSHAUTH.value:
+          isSecretDataValid = formValues.Data.some((entry) => entry.Key === 'ssh-privatekey');
+          secretWarningMessage = isSecretDataValid ? '' : `A data entry with a 'ssh-privatekey' key is required.`;
+          break;
+        case KubernetesSecretTypeOptions.TLS.value:
+          isSecretDataValid = formValues.Data.some((entry) => entry.Key === 'tls.crt') && formValues.Data.some((entry) => entry.Key === 'tls.key');
+          secretWarningMessage = isSecretDataValid ? '' : `Data entries containing a 'tls.crt' key and a 'tls.key' key are required.`;
+          break;
+        case KubernetesSecretTypeOptions.BOOTSTRAPTOKEN.value:
+          isSecretDataValid = formValues.Data.some((entry) => entry.Key === 'token-id') && formValues.Data.some((entry) => entry.Key === 'token-secret');
+          secretWarningMessage = isSecretDataValid ? '' : `Data entries containing a 'token-id' key and a 'token-secret' key are required.`;
+          break;
+        default:
+          break;
+      }
+
+      isFormValid = uniqueCheck && formValues.ResourcePool && formValues.Data.length >= 1 && isSecretDataValid;
+      return [isFormValid, secretWarningMessage];
+    }
+
+    isFormValid = formValues.Data.length > 0 && uniqueCheck && formValues.ResourcePool;
+    return [isFormValid, secretWarningMessage];
+  }
+
+  isFormValid = uniqueCheck && formValues.ResourcePool;
+  return [isFormValid, secretWarningMessage];
+}
diff --git a/app/kubernetes/views/deploy/deploy.html b/app/kubernetes/views/deploy/deploy.html
new file mode 100644
index 0000000..b5b057c
--- /dev/null
+++ b/app/kubernetes/views/deploy/deploy.html
@@ -0,0 +1,216 @@
+<page-header ng-if="ctrl.state.viewReady" title="'Create from code'" breadcrumbs="['Deploy Kubernetes resources']" reload="true"></page-header>
+
+<kubernetes-view-loading view-ready="ctrl.state.viewReady"></kubernetes-view-loading>
+
+<div ng-if="ctrl.state.viewReady">
+  <kubernetes-feedback-panel></kubernetes-feedback-panel>
+
+  <div class="row kubernetes-deploy">
+    <div class="col-sm-12">
+      <rd-widget>
+        <rd-widget-body>
+          <uib-tabset active="ctrl.state.activeTab" justified="true" type="pills">
+            <uib-tab index="0">
+              <uib-tab-heading> <pr-icon icon="'code'"></pr-icon> Deploy </uib-tab-heading>
+              <form class="form-horizontal mt-6" name="ctrl.deploymentForm">
+                <div class="col-sm-12 form-section-title"> Deploy from </div>
+                <box-selector
+                  slim="true"
+                  radio-name="'method'"
+                  value="ctrl.state.BuildMethod"
+                  options="ctrl.methodOptions"
+                  data-cy="k8sAppDeploy-buildSelector"
+                  on-change="(ctrl.onChangeMethod)"
+                ></box-selector>
+
+                <!-- namespace -->
+                <div class="col-sm-12 form-section-title !mt-4"> Deploy to </div>
+                <div class="form-group" ng-if="ctrl.formValues.Namespace">
+                  <label for="toggle_logo" class="col-lg-2 col-sm-3 control-label text-left">
+                    Use namespace(s) specified from manifest
+                    <portainer-tooltip message="'If you have defined namespaces in your deployment file turning this on will enforce the use of those only in the deployment'">
+                    </portainer-tooltip>
+                  </label>
+                  <div class="col-sm-9 col-lg-10 vertical-center pt-1">
+                    <label class="switch">
+                      <input type="checkbox" name="toggle_logo" ng-model="ctrl.formValues.namespace_toggle" data-cy="use-namespce-from-menifest" />
+                      <span class="slider round"></span>
+                    </label>
+                  </div>
+                </div>
+
+                <div ng-if="!ctrl.formValues.namespace_toggle">
+                  <div class="form-group" ng-if="ctrl.formValues.Namespace">
+                    <div class="col-sm-12">
+                      <k8s-registry-access-notice namespace="ctrl.formValues.Namespace"></k8s-registry-access-notice>
+                    </div>
+                  </div>
+                  <namespace-selector
+                    values="ctrl.formValues.Namespace"
+                    on-change="(ctrl.onChangeNamespace)"
+                    validation-data="{namespaceOptionCount: ctrl.namespaces.length}"
+                  ></namespace-selector>
+                </div>
+                <div class="form-group" ng-if="ctrl.formValues.namespace_toggle">
+                  <label class="col-lg-2 col-sm-3 control-label text-left">Namespace</label>
+                  <div class="col-sm-9 col-lg-10">
+                    <span class="small text-muted pt-[7px]">Namespaces specified in the manifest will be used</span>
+                  </div>
+                </div>
+
+                <div class="form-group">
+                  <label for="name" class="col-lg-2 col-sm-3 control-label text-left">Name</label>
+                  <div class="col-sm-9 col-lg-10 text-muted small pt-[7px]"> Resource names specified in the manifest will be used </div>
+                </div>
+
+                <div ng-if="!ctrl.deploymentOptions.hideStacksFunctionality">
+                  <div class="mb-4 w-fit">
+                    <stack-name-label-insight></stack-name-label-insight>
+                  </div>
+                  <kube-stack-name
+                    stack-name="ctrl.formValues.StackName"
+                    set-stack-name="(ctrl.setStackName)"
+                    stacks="ctrl.stacks"
+                    error="ctrl.state.stackNameError"
+                  ></kube-stack-name>
+                </div>
+                <!-- !namespace -->
+
+                <!-- repository -->
+                <git-form
+                  ng-if="ctrl.state.BuildMethod === ctrl.BuildMethods.GIT"
+                  value="ctrl.formValues"
+                  on-change="(ctrl.onChangeFormValues)"
+                  environment-type="KUBERNETES"
+                  is-force-pull-visible="false"
+                  is-additional-files-field-visible="true"
+                  is-auth-explanation-visible="true"
+                  is-source-selection-visible="true"
+                  deploy-method="{{ ctrl.state.DeployType === ctrl.ManifestDeployTypes.COMPOSE ? 'compose' : 'manifest' }}"
+                  base-webhook-url="{{ ctrl.state.baseWebhookUrl }}"
+                  webhook-id="{{ ctrl.state.webhookId }}"
+                  webhooks-docs="/user/kubernetes/applications/webhooks"
+                ></git-form>
+                <!-- !repository -->
+
+                <div ng-show="ctrl.state.BuildMethod === ctrl.BuildMethods.CUSTOM_TEMPLATE">
+                  <div class="col-sm-12 form-section-title !mt-4"> Custom template </div>
+
+                  <custom-template-selector
+                    new-template-path="kubernetes.templates.custom.new"
+                    stack-type="3"
+                    on-change="(ctrl.onChangeTemplateId)"
+                    value="ctrl.state.templateId"
+                    is-load-failed="ctrl.state.BuildMethod === ctrl.BuildMethods.CUSTOM_TEMPLATE && ctrl.state.templateId && ctrl.state.templateLoadFailed"
+                  ></custom-template-selector>
+
+                  <custom-templates-variables-field
+                    ng-if="ctrl.isTemplateVariablesEnabled && ctrl.state.template"
+                    definitions="ctrl.state.template.Variables"
+                    value="ctrl.formValues.Variables"
+                    on-change="(ctrl.onChangeTemplateVariables)"
+                  ></custom-templates-variables-field>
+                </div>
+
+                <!-- editor -->
+                <div class="mt-4">
+                  <div class="mb-1">
+                    <k8s-registry-access-notice
+                      ng-if="
+                        ctrl.formValues.namespace_toggle &&
+                        (ctrl.state.BuildMethod === ctrl.BuildMethods.WEB_EDITOR || (ctrl.state.BuildMethod === ctrl.BuildMethods.CUSTOM_TEMPLATE && ctrl.state.templateId))
+                      "
+                      manifest-content="ctrl.formValues.EditorContent"
+                    ></k8s-registry-access-notice>
+                  </div>
+                  <web-editor-form
+                    ng-if="ctrl.state.BuildMethod === ctrl.BuildMethods.WEB_EDITOR || (ctrl.state.BuildMethod === ctrl.BuildMethods.CUSTOM_TEMPLATE && ctrl.state.templateId)"
+                    identifier="kubernetes-deploy-editor"
+                    value="ctrl.formValues.EditorContent"
+                    on-change="(ctrl.onChangeFileContent)"
+                    ng-required="true"
+                    yml="true"
+                    placeholder="Define or paste the content of your manifest file here"
+                    read-only="ctrl.state.isEditorReadOnly"
+                  >
+                    <editor-description>
+                      <p class="vertical-center">
+                        <pr-icon icon="'info'" mode="'primary'"></pr-icon>
+                        This feature allows you to deploy any kind of Kubernetes resource in this environment (Deployment, Secret, ConfigMap...).
+                      </p>
+                      <p>
+                        You can get more information about Kubernetes file format in the
+                        <a href="https://kubernetes.io/docs/concepts/overview/working-with-objects/kubernetes-objects/" target="_blank">official documentation</a>.
+                      </p>
+                    </editor-description>
+                  </web-editor-form>
+                </div>
+                <!-- !editor -->
+
+                <!-- url -->
+                <div ng-show="ctrl.state.BuildMethod === ctrl.BuildMethods.URL">
+                  <div class="col-sm-12 form-section-title"> URL </div>
+                  <div class="form-group">
+                    <div class="col-sm-12 small vertical-center pt-[7px]">
+                      <pr-icon icon="'info'" mode="'primary'"></pr-icon>
+                      Specify the URL to the
+                      <a href="https://kubernetes.io/docs/concepts/overview/working-with-objects/kubernetes-objects/" target="_blank">Kubernetes manifest.</a>
+                    </div>
+                  </div>
+                  <div class="form-group">
+                    <label for="manifest_url" class="col-sm-3 col-lg-2 control-label required text-left">URL</label>
+                    <div class="col-sm-9 col-lg-10">
+                      <input
+                        type="text"
+                        data-cy="k8sAppDeploy-urlFileUrl"
+                        class="form-control"
+                        ng-model="ctrl.formValues.ManifestURL"
+                        id="manifest_url"
+                        placeholder="https://raw.githubusercontent.com/kubernetes/website/main/content/en/examples/controllers/nginx-deployment.yaml"
+                      />
+                    </div>
+                  </div>
+                </div>
+                <!-- !url -->
+
+                <!-- actions -->
+                <div class="col-sm-12 form-section-title !mt-4"> Actions </div>
+                <div class="form-group">
+                  <div class="col-sm-12">
+                    <button
+                      type="button"
+                      class="btn btn-primary btn-sm !ml-0"
+                      ng-disabled="!ctrl.deploymentForm.$valid || ctrl.disableDeploy()"
+                      ng-click="ctrl.deploy()"
+                      button-spinner="ctrl.state.actionInProgress"
+                      data-cy="k8sAppDeploy-deployButton"
+                      analytics-on
+                      analytics-category="kubernetes"
+                      analytics-event="kubernetes-application-advanced-deployment"
+                      analytics-properties="ctrl.buildAnalyticsProperties()"
+                    >
+                      <span ng-hide="ctrl.state.actionInProgress">Deploy</span>
+                      <span ng-show="ctrl.state.actionInProgress">Deployment in progress...</span>
+                    </button>
+                  </div>
+                </div>
+                <!-- !actions -->
+              </form>
+            </uib-tab>
+
+            <uib-tab index="1" disable="ctrl.state.tabLogsDisabled">
+              <uib-tab-heading> <pr-icon icon="'file-text'"></pr-icon> Logs </uib-tab-heading>
+              <form class="form-horizontal mt-3">
+                <div class="form-group" ng-if="ctrl.state.activeTab === 1">
+                  <div class="col-sm-12">
+                    <code-editor identifier="kubernetes-deploy-logs" yml="true" read-only="true" value="ctrl.errorLog"></code-editor>
+                  </div>
+                </div>
+              </form>
+            </uib-tab>
+          </uib-tabset>
+        </rd-widget-body>
+      </rd-widget>
+    </div>
+  </div>
+</div>
diff --git a/app/kubernetes/views/deploy/deploy.js b/app/kubernetes/views/deploy/deploy.js
new file mode 100644
index 0000000..d7e45f4
--- /dev/null
+++ b/app/kubernetes/views/deploy/deploy.js
@@ -0,0 +1,8 @@
+angular.module('portainer.kubernetes').component('kubernetesDeployView', {
+  templateUrl: './deploy.html',
+  controller: 'KubernetesDeployController',
+  controllerAs: 'ctrl',
+  bindings: {
+    endpoint: '<',
+  },
+});
diff --git a/app/kubernetes/views/deploy/deployController.js b/app/kubernetes/views/deploy/deployController.js
new file mode 100644
index 0000000..96d9899
--- /dev/null
+++ b/app/kubernetes/views/deploy/deployController.js
@@ -0,0 +1,430 @@
+import angular from 'angular';
+import _ from 'lodash-es';
+import stripAnsi from 'strip-ansi';
+
+import PortainerError from '@/portainer/error';
+import { KubernetesDeployManifestTypes, KubernetesDeployBuildMethods, KubernetesDeployRequestMethods, RepositoryMechanismTypes } from '@/kubernetes/models/deploy';
+import { isTemplateVariablesEnabled, renderTemplate } from '@/react/portainer/custom-templates/components/utils';
+import { getDeploymentOptions } from '@/react/portainer/environments/environment.service';
+import { parseAutoUpdateResponse, transformAutoUpdateViewModel } from '@/react/portainer/gitops/AutoUpdateFieldset/utils';
+import { baseStackWebhookUrl, createWebhookId } from '@/portainer/helpers/webhookHelper';
+import { getVariablesFieldDefaultValues } from '@/react/portainer/custom-templates/components/CustomTemplatesVariablesField';
+import { KUBE_STACK_NAME_VALIDATION_REGEX } from '@/react/kubernetes/DeployView/StackName/constants';
+import { confirmWebEditorDiscard } from '@@/modals/confirm';
+import { editor, git, customTemplate, url } from '@@/BoxSelector/common-options/build-methods';
+import { kubernetes } from '@@/BoxSelector/common-options/deployment-methods';
+
+class KubernetesDeployController {
+  /* @ngInject */
+  constructor($scope, $async, $state, $window, Authentication, Notifications, KubernetesResourcePoolService, StackService, CustomTemplateService, KubernetesApplicationService) {
+    this.$scope = $scope;
+    this.$async = $async;
+    this.$state = $state;
+    this.$window = $window;
+    this.Authentication = Authentication;
+    this.Notifications = Notifications;
+    this.KubernetesResourcePoolService = KubernetesResourcePoolService;
+    this.StackService = StackService;
+    this.CustomTemplateService = CustomTemplateService;
+    this.KubernetesApplicationService = KubernetesApplicationService;
+
+    this.isTemplateVariablesEnabled = isTemplateVariablesEnabled;
+
+    this.deployOptions = [{ ...kubernetes, value: KubernetesDeployManifestTypes.KUBERNETES }];
+
+    this.methodOptions = [
+      { ...git, value: KubernetesDeployBuildMethods.GIT },
+      { ...editor, value: KubernetesDeployBuildMethods.WEB_EDITOR },
+      { ...url, value: KubernetesDeployBuildMethods.URL },
+      { ...customTemplate, value: KubernetesDeployBuildMethods.CUSTOM_TEMPLATE },
+    ];
+
+    let buildMethod = Number(this.$state.params.buildMethod) || KubernetesDeployBuildMethods.GIT;
+    if (buildMethod > Object.keys(KubernetesDeployBuildMethods).length) {
+      buildMethod = KubernetesDeployBuildMethods.GIT;
+    }
+
+    this.state = {
+      DeployType: buildMethod,
+      BuildMethod: KubernetesDeployBuildMethods.GIT,
+      tabLogsDisabled: true,
+      activeTab: 0,
+      viewReady: false,
+      isEditorDirty: false,
+      templateId: null,
+      template: null,
+      baseWebhookUrl: baseStackWebhookUrl(),
+      webhookId: createWebhookId(),
+      templateLoadFailed: false,
+      isEditorReadOnly: false,
+      selectedHelmChart: '',
+      stackNameError: '',
+    };
+
+    this.currentUser = {
+      isAdmin: false,
+      id: null,
+    };
+
+    this.formValues = {
+      StackName: '',
+      SourceId: undefined,
+      RepositoryURL: '',
+      RepositoryReferenceName: '',
+      RepositoryAuthentication: false,
+      RepositoryUsername: '',
+      RepositoryPassword: '',
+      AdditionalFiles: [],
+      ComposeFilePathInRepository: '',
+      Variables: [],
+      AutoUpdate: parseAutoUpdateResponse(),
+      TLSSkipVerify: false,
+      Name: '',
+    };
+
+    this.stacks = [];
+
+    this.ManifestDeployTypes = KubernetesDeployManifestTypes;
+    this.BuildMethods = KubernetesDeployBuildMethods;
+
+    this.onSelectHelmChart = this.onSelectHelmChart.bind(this);
+    this.onChangeTemplateId = this.onChangeTemplateId.bind(this);
+    this.deployAsync = this.deployAsync.bind(this);
+    this.onChangeFileContent = this.onChangeFileContent.bind(this);
+    this.getNamespacesAsync = this.getNamespacesAsync.bind(this);
+    this.onChangeFormValues = this.onChangeFormValues.bind(this);
+    this.buildAnalyticsProperties = this.buildAnalyticsProperties.bind(this);
+    this.onChangeMethod = this.onChangeMethod.bind(this);
+    this.onChangeDeployType = this.onChangeDeployType.bind(this);
+    this.onChangeTemplateVariables = this.onChangeTemplateVariables.bind(this);
+    this.setStackName = this.setStackName.bind(this);
+    this.onChangeNamespace = this.onChangeNamespace.bind(this);
+  }
+
+  onChangeNamespace(namespaceName) {
+    return this.$async(async () => {
+      this.formValues.Namespace = namespaceName;
+      const applications = await this.KubernetesApplicationService.get(namespaceName);
+      const stacks = _.map(applications, (item) => item.StackName).filter((item) => item !== '');
+      this.stacks = _.uniq(stacks);
+    });
+  }
+
+  onSelectHelmChart(chart) {
+    this.state.selectedHelmChart = chart;
+
+    // Force a digest cycle to ensure the change is reflected in the UI
+    this.$scope.$apply();
+  }
+
+  onChangeTemplateVariables(value) {
+    this.onChangeFormValues({ Variables: value });
+
+    this.renderTemplate();
+  }
+
+  setStackName(name) {
+    return this.$async(async () => {
+      if (KUBE_STACK_NAME_VALIDATION_REGEX.test(name) || name === '') {
+        this.state.stackNameError = '';
+      } else {
+        this.state.stackNameError =
+          "Stack must consist of alphanumeric characters, '-', '_' or '.', must start and end with an alphanumeric character and must be 63 characters or less (e.g. 'my-name', or 'abc-123').";
+      }
+
+      this.formValues.StackName = name;
+    });
+  }
+
+  renderTemplate() {
+    if (!this.isTemplateVariablesEnabled) {
+      return;
+    }
+
+    const rendered = renderTemplate(this.state.templateContent, this.formValues.Variables, this.state.template.Variables);
+    this.onChangeFormValues({ EditorContent: rendered });
+  }
+
+  buildAnalyticsProperties() {
+    const metadata = {
+      type: buildLabel(this.state.BuildMethod),
+      format: formatLabel(this.state.DeployType),
+      role: roleLabel(this.currentUser.isAdmin),
+      'automatic-updates': automaticUpdatesLabel(this.formValues.RepositoryAutomaticUpdates, this.formValues.RepositoryMechanism),
+    };
+
+    if (this.state.BuildMethod === KubernetesDeployBuildMethods.GIT) {
+      metadata.auth = this.formValues.RepositoryAuthentication;
+    }
+
+    return { metadata };
+
+    function automaticUpdatesLabel(repositoryAutomaticUpdates, repositoryMechanism) {
+      switch (repositoryAutomaticUpdates && repositoryMechanism) {
+        case RepositoryMechanismTypes.INTERVAL:
+          return 'polling';
+        case RepositoryMechanismTypes.WEBHOOK:
+          return 'webhook';
+        default:
+          return 'off';
+      }
+    }
+
+    function roleLabel(isAdmin) {
+      if (isAdmin) {
+        return 'admin';
+      }
+
+      return 'standard';
+    }
+
+    function buildLabel(buildMethod) {
+      switch (buildMethod) {
+        case KubernetesDeployBuildMethods.GIT:
+          return 'git';
+        case KubernetesDeployBuildMethods.WEB_EDITOR:
+          return 'web-editor';
+      }
+    }
+
+    function formatLabel(format) {
+      switch (format) {
+        case KubernetesDeployManifestTypes.COMPOSE:
+          return 'compose';
+        case KubernetesDeployManifestTypes.KUBERNETES:
+          return 'manifest';
+      }
+    }
+  }
+
+  onChangeMethod(method) {
+    return this.$async(async () => {
+      this.state.BuildMethod = method;
+    });
+  }
+
+  onChangeDeployType(type) {
+    return this.$async(async () => {
+      this.state.DeployType = type;
+    });
+  }
+
+  disableDeploy() {
+    const isWebEditorInvalid = this.state.BuildMethod === KubernetesDeployBuildMethods.WEB_EDITOR && _.isEmpty(this.formValues.EditorContent);
+    const isURLFormInvalid = this.state.BuildMethod === KubernetesDeployBuildMethods.URL && _.isEmpty(this.formValues.ManifestURL);
+    const isCustomTemplateInvalid = this.state.BuildMethod === KubernetesDeployBuildMethods.CUSTOM_TEMPLATE && _.isEmpty(this.formValues.EditorContent);
+    const isNamespaceInvalid = _.isEmpty(this.formValues.Namespace);
+    const isStackNameInvalid = this.state.stackNameError !== '';
+    return isWebEditorInvalid || isURLFormInvalid || isCustomTemplateInvalid || this.state.actionInProgress || isNamespaceInvalid || isStackNameInvalid;
+  }
+
+  onChangeFormValues(newValues) {
+    return this.$async(async () => {
+      this.formValues = {
+        ...this.formValues,
+        ...newValues,
+      };
+    });
+  }
+
+  onChangeTemplateId(templateId, template) {
+    return this.$async(async () => {
+      if (!template || (this.state.templateId === templateId && this.state.template === template)) {
+        return;
+      }
+
+      this.state.templateId = templateId;
+      this.state.template = template;
+
+      try {
+        try {
+          this.state.templateContent = await this.CustomTemplateService.customTemplateFile(templateId, template.GitConfig !== null);
+          this.onChangeFileContent(this.state.templateContent);
+
+          this.state.isEditorReadOnly = false;
+        } catch (err) {
+          this.state.templateLoadFailed = true;
+          throw err;
+        }
+
+        if (template.Variables && template.Variables.length > 0) {
+          const variables = getVariablesFieldDefaultValues(template.Variables);
+          this.onChangeTemplateVariables(variables);
+        }
+      } catch (err) {
+        this.Notifications.error('Failure', err, 'Unable to load template file');
+      }
+    });
+  }
+
+  onChangeFileContent(value) {
+    this.formValues.EditorContent = value;
+    this.state.isEditorDirty = true;
+  }
+
+  displayErrorLog(log) {
+    this.errorLog = stripAnsi(log);
+    this.state.tabLogsDisabled = false;
+    this.state.activeTab = 1;
+  }
+
+  async deployAsync() {
+    this.errorLog = '';
+    this.state.actionInProgress = true;
+
+    try {
+      let method;
+      let composeFormat = this.state.DeployType === this.ManifestDeployTypes.COMPOSE;
+
+      switch (this.state.BuildMethod) {
+        case this.BuildMethods.GIT:
+          method = KubernetesDeployRequestMethods.REPOSITORY;
+          break;
+        case this.BuildMethods.WEB_EDITOR:
+          method = KubernetesDeployRequestMethods.STRING;
+          break;
+        case KubernetesDeployBuildMethods.CUSTOM_TEMPLATE:
+          method = KubernetesDeployRequestMethods.STRING;
+          composeFormat = false;
+          break;
+        case this.BuildMethods.URL:
+          method = KubernetesDeployRequestMethods.URL;
+          break;
+        default:
+          throw new PortainerError('Unable to determine build method');
+      }
+
+      let deployNamespace = '';
+
+      if (this.formValues.namespace_toggle) {
+        deployNamespace = '';
+      } else {
+        deployNamespace = this.formValues.Namespace;
+      }
+
+      const payload = {
+        ComposeFormat: composeFormat,
+        Namespace: deployNamespace,
+        StackName: this.formValues.StackName,
+      };
+
+      if (method === KubernetesDeployRequestMethods.REPOSITORY) {
+        payload.RepositoryReferenceName = this.formValues.RepositoryReferenceName;
+        if (this.formValues.SourceId) {
+          payload.SourceId = this.formValues.SourceId;
+        } else {
+          payload.TLSSkipVerify = this.formValues.TLSSkipVerify;
+          payload.RepositoryURL = this.formValues.RepositoryURL;
+          payload.RepositoryAuthentication = this.formValues.RepositoryAuthentication ? true : false;
+          if (payload.RepositoryAuthentication) {
+            payload.RepositoryUsername = this.formValues.RepositoryUsername;
+            payload.RepositoryPassword = this.formValues.RepositoryPassword;
+          }
+        }
+        payload.ManifestFile = this.formValues.ComposeFilePathInRepository;
+        payload.AdditionalFiles = this.formValues.AdditionalFiles;
+        payload.AutoUpdate = transformAutoUpdateViewModel(this.formValues.AutoUpdate, this.state.webhookId);
+      } else if (method === KubernetesDeployRequestMethods.STRING) {
+        payload.StackFileContent = this.formValues.EditorContent;
+      } else {
+        payload.ManifestURL = this.formValues.ManifestURL;
+      }
+
+      await this.StackService.kubernetesDeploy(this.endpoint.Id, method, payload);
+
+      this.Notifications.success('Success', 'Request to deploy manifest successfully submitted');
+      this.state.isEditorDirty = false;
+
+      if (this.$state.params.referrer && this.$state.params.tab) {
+        this.$state.go(this.$state.params.referrer, { tab: this.$state.params.tab });
+        return;
+      }
+
+      if (this.$state.params.referrer) {
+        this.$state.go(this.$state.params.referrer);
+        return;
+      }
+
+      this.$state.go('kubernetes.applications');
+    } catch (err) {
+      this.Notifications.error('Unable to deploy manifest', err, 'Unable to deploy resources');
+      this.displayErrorLog(err.err.data.details);
+    } finally {
+      this.state.actionInProgress = false;
+    }
+  }
+
+  deploy() {
+    return this.$async(this.deployAsync);
+  }
+
+  async getNamespacesAsync() {
+    try {
+      const pools = await this.KubernetesResourcePoolService.get();
+      let namespaces = pools.filter((pool) => pool.Namespace.Status === 'Active');
+      namespaces = _.map(namespaces, 'Namespace').sort((a, b) => {
+        if (a.Name === 'default') {
+          return -1;
+        }
+        if (b.Name === 'default') {
+          return 1;
+        }
+        return 0;
+      });
+
+      this.namespaces = namespaces;
+      if (this.namespaces.length > 0) {
+        this.formValues.Namespace = this.namespaces[0].Name;
+      }
+    } catch (err) {
+      this.Notifications.error('Failure', err, 'Unable to load namespaces data');
+    }
+  }
+
+  getNamespaces() {
+    return this.$async(this.getNamespacesAsync);
+  }
+
+  async uiCanExit() {
+    if (this.formValues.EditorContent && this.state.isEditorDirty) {
+      return confirmWebEditorDiscard();
+    }
+  }
+
+  $onInit() {
+    return this.$async(async () => {
+      this.currentUser.isAdmin = this.Authentication.isAdmin();
+      this.currentUser.id = this.Authentication.getUserDetails().ID;
+
+      this.formValues.namespace_toggle = false;
+      await this.getNamespaces();
+
+      this.deploymentOptions = await getDeploymentOptions(this.endpoint.Id);
+
+      if (this.$state.params.templateId) {
+        const templateId = parseInt(this.$state.params.templateId, 10);
+        if (templateId && !Number.isNaN(templateId)) {
+          this.state.BuildMethod = KubernetesDeployBuildMethods.CUSTOM_TEMPLATE;
+          this.state.templateId = templateId;
+        }
+      }
+
+      this.onChangeNamespace(this.formValues.Namespace);
+
+      this.state.viewReady = true;
+
+      this.$window.onbeforeunload = () => {
+        if (this.formValues.EditorContent && this.state.isEditorDirty) {
+          return '';
+        }
+      };
+    });
+  }
+
+  $onDestroy() {
+    this.state.isEditorDirty = false;
+  }
+}
+
+export default KubernetesDeployController;
+angular.module('portainer.kubernetes').controller('KubernetesDeployController', KubernetesDeployController);
diff --git a/app/kubernetes/views/kubernetes.css b/app/kubernetes/views/kubernetes.css
new file mode 100644
index 0000000..de5aefd
--- /dev/null
+++ b/app/kubernetes/views/kubernetes.css
@@ -0,0 +1,23 @@
+.service-form .form-group {
+  vertical-align: top;
+}
+
+.service-form .form-group .input-group {
+  width: 100%;
+}
+
+.service-form .clear-both {
+  clear: both;
+}
+
+.service-form .form-group {
+  vertical-align: top;
+}
+
+.service-form .form-group .input-group {
+  width: 100%;
+}
+
+.service-form .clear-both {
+  clear: both;
+}
diff --git a/app/kubernetes/views/security-constraint/constraint.html b/app/kubernetes/views/security-constraint/constraint.html
new file mode 100644
index 0000000..42834ac
--- /dev/null
+++ b/app/kubernetes/views/security-constraint/constraint.html
@@ -0,0 +1,40 @@
+<page-header
+  ng-if="state.viewReady"
+  title="'Security constraints'"
+  breadcrumbs="[
+{ label:'Environments', link:'portainer.endpoints' }, 
+{ label:endpoint.Name, link:'portainer.endpoints.endpoint', linkParams:{id: endpoint.Id} }, 
+'Security constraints'
+]"
+  reload="true"
+></page-header>
+
+<kubernetes-view-loading view-ready="state.viewReady"></kubernetes-view-loading>
+
+<div ng-if="state.viewReady">
+  <div class="row">
+    <div class="col-sm-12">
+      <rd-widget>
+        <rd-widget-header icon="shield" title-text="Pod security constraints"></rd-widget-header>
+        <rd-widget-body>
+          <form class="form-horizontal" name="kubernetesSecurityConstraintForm">
+            <!--  main toggle  -->
+            <div class="form-group">
+              <div class="col-sm-12">
+                <por-switch-field
+                  checked="formValues.enabled"
+                  name="'disableSysctlSettingForRegularUsers'"
+                  label="'Enable pod security constraints'"
+                  feature-id="limitedFeaturePodSecurityPolicy"
+                  label-class="'col-sm-3 col-lg-2 px-0'"
+                  switch-class="'col-sm-8'"
+                >
+                </por-switch-field>
+              </div>
+            </div>
+          </form>
+        </rd-widget-body>
+      </rd-widget>
+    </div>
+  </div>
+</div>
diff --git a/app/kubernetes/views/security-constraint/constraintController.js b/app/kubernetes/views/security-constraint/constraintController.js
new file mode 100644
index 0000000..d8a8b94
--- /dev/null
+++ b/app/kubernetes/views/security-constraint/constraintController.js
@@ -0,0 +1,25 @@
+import angular from 'angular';
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+
+angular.module('portainer.kubernetes').controller('KubernetesSecurityConstraintController', [
+  '$scope',
+  'EndpointProvider',
+  'EndpointService',
+  function ($scope, EndpointProvider, EndpointService) {
+    $scope.limitedFeaturePodSecurityPolicy = FeatureId.POD_SECURITY_POLICY_CONSTRAINT;
+    $scope.state = {
+      viewReady: false,
+      actionInProgress: false,
+    };
+
+    async function initView() {
+      const endpointID = EndpointProvider.endpointID();
+      EndpointService.endpoint(endpointID).then((endpoint) => {
+        $scope.endpoint = endpoint;
+        $scope.state.viewReady = true;
+      });
+    }
+
+    initView();
+  },
+]);
diff --git a/app/kubernetes/views/stacks/logs/logs.html b/app/kubernetes/views/stacks/logs/logs.html
new file mode 100644
index 0000000..9d744d1
--- /dev/null
+++ b/app/kubernetes/views/stacks/logs/logs.html
@@ -0,0 +1,79 @@
+<page-header
+  ng-if="ctrl.state.viewReady"
+  title="'Stacks logs'"
+  breadcrumbs="[
+{ label:'Namespaces', link:'kubernetes.resourcePools' },
+{ label:ctrl.state.transition.namespace, link:'kubernetes.resourcePools.resourcePool', linkParams:{ id: ctrl.state.transition.namespace } },
+{ label:'Applications', link:'kubernetes.applications' },
+'Stacks',
+ctrl.state.transition.name,
+'Logs'
+]"
+  reload="true"
+></page-header>
+
+<kubernetes-view-loading view-ready="ctrl.state.viewReady"></kubernetes-view-loading>
+
+<div ng-if="ctrl.state.viewReady">
+  <div class="row">
+    <div class="col-sm-12">
+      <rd-widget>
+        <rd-widget-body>
+          <form class="form-horizontal" autocomplete="off">
+            <div class="col-sm-12 form-section-title"> Actions </div>
+            <!-- auto-refresh -->
+            <div class="form-group">
+              <label class="control-label col-sm-3 col-lg-2 vertical-center !py-2 text-left">
+                Auto-refresh
+                <portainer-tooltip message="'Automatically refresh logs every 30 seconds'"></portainer-tooltip>
+              </label>
+              <div class="col-sm-8 col-sm-9 vertical-center">
+                <label class="switch col-sm-8 col-sm-9 vertical-center !mb-0">
+                  <input type="checkbox" ng-model="ctrl.state.autoRefresh" ng-change="ctrl.updateAutoRefresh()" />
+                  <span class="slider round"></span>
+                </label>
+              </div>
+            </div>
+            <!-- !auto-refresh -->
+            <!-- search -->
+            <div class="form-group">
+              <label for="logs_search" class="col-sm-3 col-lg-2 control-label text-left"> Search </label>
+              <div class="col-sm-8 col-lg-9">
+                <input
+                  class="form-control"
+                  type="text"
+                  name="logs_search"
+                  ng-model="ctrl.state.search"
+                  ng-change="ctrl.state.selectedLines.length = 0;"
+                  placeholder="Filter..."
+                  auto-focus
+                />
+              </div>
+            </div>
+            <!-- !search -->
+            <!-- actions -->
+            <div class="form-group">
+              <div class="col-sm-12">
+                <button class="btn btn-primary btn-sm vertical-center !ml-0" type="button" ng-click="ctrl.downloadLogs()">
+                  <pr-icon icon="'download'"></pr-icon>
+                  Download logs
+                </button>
+              </div>
+            </div>
+            <!-- !actions -->
+          </form>
+        </rd-widget-body>
+      </rd-widget>
+    </div>
+  </div>
+
+  <div class="row">
+    <div class="col-sm-12 h-[max(400px,calc(100vh-380px))]">
+      <pre class="log_viewer">
+        <div ng-repeat="log in ctrl.state.filteredLogs = (ctrl.stackLogs | filter:{ 'line': ctrl.state.search }) track by $index" class="line" ng-if="log.line"><p class="inner_line"><span ng-style="{'color': log.appColor, 'font-weight': 'bold'};">{{ log.appName }}</span> <span ng-repeat="span in log.spans track by $index" ng-style="{ 'color': span.fgColor, 'background-color': span.bgColor, 'font-weight': span.fontWeight }">{{ span.text }}</span></p></div>
+        <div ng-if="ctrl.stackLogs.length && !ctrl.state.filteredLogs.length" class="line"><p class="inner_line">No log line matching the '{{ ctrl.state.search }}' filter</p></div>
+        <div ng-if="ctrl.stackLogs.length === 0" class="line"><p class="inner_line">No logs available</p></div>
+    </pre>
+    </div>
+  </div>
+</div>
diff --git a/app/kubernetes/views/stacks/logs/logs.js b/app/kubernetes/views/stacks/logs/logs.js
new file mode 100644
index 0000000..bd8a1dc
--- /dev/null
+++ b/app/kubernetes/views/stacks/logs/logs.js
@@ -0,0 +1,8 @@
+angular.module('portainer.kubernetes').component('kubernetesStackLogsView', {
+  templateUrl: './logs.html',
+  controller: 'KubernetesStackLogsController',
+  controllerAs: 'ctrl',
+  bindings: {
+    $transition$: '<',
+  },
+});
diff --git a/app/kubernetes/views/stacks/logs/logsController.js b/app/kubernetes/views/stacks/logs/logsController.js
new file mode 100644
index 0000000..e176e99
--- /dev/null
+++ b/app/kubernetes/views/stacks/logs/logsController.js
@@ -0,0 +1,123 @@
+import { filter, flatMap, map } from 'lodash';
+import angular from 'angular';
+import $allSettled from '@/portainer/services/allSettled';
+import { concatLogsToString, formatLogs } from '@/docker/helpers/logHelper';
+
+const colors = ['red', 'orange', 'lime', 'green', 'darkgreen', 'cyan', 'turquoise', 'teal', 'deepskyblue', 'blue', 'darkblue', 'slateblue', 'magenta', 'darkviolet'];
+
+class KubernetesStackLogsController {
+  /* @ngInject */
+  constructor($async, $state, $interval, Notifications, KubernetesApplicationService, KubernetesPodService, FileSaver, Blob) {
+    this.$async = $async;
+    this.$state = $state;
+    this.$interval = $interval;
+    this.Notifications = Notifications;
+    this.KubernetesApplicationService = KubernetesApplicationService;
+    this.KubernetesPodService = KubernetesPodService;
+    this.Blob = Blob;
+    this.FileSaver = FileSaver;
+
+    this.onInit = this.onInit.bind(this);
+    this.stopRepeater = this.stopRepeater.bind(this);
+    this.generateLogsPromise = this.generateLogsPromise.bind(this);
+    this.generateAppPromise = this.generateAppPromise.bind(this);
+    this.getStackLogsAsync = this.getStackLogsAsync.bind(this);
+  }
+
+  updateAutoRefresh() {
+    if (this.state.autoRefresh) {
+      this.setUpdateRepeater();
+      return;
+    }
+
+    this.stopRepeater();
+  }
+
+  stopRepeater() {
+    if (angular.isDefined(this.repeater)) {
+      this.$interval.cancel(this.repeater);
+      this.repeater = null;
+    }
+  }
+
+  setUpdateRepeater() {
+    this.repeater = this.$interval(this.getStackLogsAsync, this.state.refreshRate);
+  }
+
+  async generateLogsPromise(pod, container) {
+    const res = {
+      Pod: pod,
+      Logs: [],
+    };
+    res.Logs = await this.KubernetesPodService.logs(pod.Namespace, pod.Name, container.Name);
+    return res;
+  }
+
+  async generateAppPromise(app) {
+    const res = {
+      Application: app,
+      Pods: [],
+    };
+
+    const promises = flatMap(map(app.Pods, (pod) => map(pod.Containers, (container) => this.generateLogsPromise(pod, container))));
+    const result = await $allSettled(promises);
+    res.Pods = result.fulfilled;
+    return res;
+  }
+
+  async getStackLogsAsync() {
+    try {
+      const applications = await this.KubernetesApplicationService.get(this.state.transition.namespace);
+      const filteredApplications = filter(applications, (app) => app.StackName === this.state.transition.name);
+      const logsPromises = map(filteredApplications, this.generateAppPromise);
+      const data = await Promise.all(logsPromises);
+      const logs = flatMap(data, (app, index) =>
+        flatMap(app.Pods, (pod) => formatLogs(pod.Logs).map((line) => ({ ...line, appColor: colors[index % colors.length], appName: pod.Pod.Name })))
+      );
+      this.stackLogs = logs;
+    } catch (err) {
+      this.stopRepeater();
+      this.Notifications.error('Failure', err, 'Unable to retrieve application logs');
+    }
+  }
+
+  downloadLogs() {
+    const logsAsString = concatLogsToString(this.state.filteredLogs, (line) => `${line.appName} ${line.line}`);
+    const data = new this.Blob([logsAsString]);
+    this.FileSaver.saveAs(data, this.state.transition.name + '_logs.txt');
+  }
+
+  async onInit() {
+    this.state = {
+      autoRefresh: false,
+      refreshRate: 30000, // 30 seconds
+      search: '',
+      viewReady: false,
+      transition: {
+        namespace: this.$transition$.params().namespace,
+        name: this.$transition$.params().name,
+      },
+    };
+
+    this.stackLogs = [];
+    try {
+      await this.getStackLogsAsync();
+    } catch (err) {
+      this.Notifications.error('Failure', err, 'Unable to retrieve stack logs');
+      this.stopRepeater();
+    } finally {
+      this.state.viewReady = true;
+    }
+  }
+
+  $onInit() {
+    return this.$async(this.onInit);
+  }
+
+  $onDestroy() {
+    this.stopRepeater();
+  }
+}
+
+export default KubernetesStackLogsController;
+angular.module('portainer.kubernetes').controller('KubernetesStackLogsController', KubernetesStackLogsController);
diff --git a/app/kubernetes/views/summary/resources/applicationResources.js b/app/kubernetes/views/summary/resources/applicationResources.js
new file mode 100644
index 0000000..325deb0
--- /dev/null
+++ b/app/kubernetes/views/summary/resources/applicationResources.js
@@ -0,0 +1,253 @@
+import _ from 'lodash-es';
+import { KubernetesResourceTypes, KubernetesResourceActions } from '@/kubernetes/models/resource-types/models';
+import { KubernetesApplicationFormValues } from '@/kubernetes/models/application/formValues';
+import { KubernetesStatefulSet } from '@/kubernetes/models/stateful-set/models';
+import { KubernetesService, KubernetesServiceTypes } from '@/kubernetes/models/service/models';
+import { KubernetesApplicationDeploymentTypes } from '@/kubernetes/models/application/models/appConstants';
+import { KubernetesHorizontalPodAutoScalerConverter } from '@/kubernetes/horizontal-pod-auto-scaler/converter';
+import KubernetesApplicationConverter from '@/kubernetes/converters/application';
+import KubernetesServiceConverter from '@/kubernetes/converters/service';
+import { KubernetesIngressConverter } from '@/kubernetes/ingress/converter';
+import KubernetesPersistentVolumeClaimConverter from '@/kubernetes/converters/persistentVolumeClaim';
+import { generateNewIngressesFromFormPaths } from '@/react/kubernetes/applications/CreateView/application-services/utils';
+
+const { CREATE, UPDATE, DELETE } = KubernetesResourceActions;
+
+/**
+ * Get summary of Kubernetes resources to be created, updated or deleted
+ * @param {KubernetesApplicationFormValues} formValues
+ */
+export function getApplicationResources(formValues, oldFormValues = {}) {
+  if (oldFormValues instanceof KubernetesApplicationFormValues) {
+    const resourceSummary = getUpdatedApplicationResources(oldFormValues, formValues);
+    return resourceSummary;
+  }
+  const resourceSummary = getCreatedApplicationResources(formValues);
+  return resourceSummary;
+}
+
+/**
+ * Get summary of Kubernetes resources to be created
+ * @param {KubernetesApplicationFormValues} formValues
+ */
+export function getCreatedApplicationResources(formValues) {
+  const resources = [];
+
+  let [app, headlessService, services, service, claims] = KubernetesApplicationConverter.applicationFormValuesToApplication(formValues);
+
+  if (services) {
+    services.forEach((service) => {
+      resources.push({ action: CREATE, kind: KubernetesResourceTypes.SERVICE, name: service.Name, type: service.Type || KubernetesServiceTypes.CLUSTER_IP });
+      // Ingress
+      const newServicePorts = formValues.Services.flatMap((service) => service.Ports);
+      const newIngresses = generateNewIngressesFromFormPaths(formValues.OriginalIngresses, newServicePorts);
+      resources.push(...getIngressUpdateSummary(formValues.OriginalIngresses, newIngresses));
+    });
+  }
+
+  if (service) {
+    // Service
+    resources.push({ action: CREATE, kind: KubernetesResourceTypes.SERVICE, name: service.Name, type: service.Type || KubernetesServiceTypes.CLUSTER_IP });
+  }
+
+  if (app instanceof KubernetesStatefulSet) {
+    // Service
+    resources.push({ action: CREATE, kind: KubernetesResourceTypes.SERVICE, name: headlessService.Name, type: headlessService.Type || KubernetesServiceTypes.CLUSTER_IP });
+  } else {
+    // Persistent volume claims
+    const persistentVolumeClaimResources = claims
+      .filter((pvc) => !pvc.PreviousName && !pvc.Id)
+      .map((pvc) => ({ action: CREATE, kind: KubernetesResourceTypes.PERSISTENT_VOLUME_CLAIM, name: pvc.Name }));
+    resources.push(...persistentVolumeClaimResources);
+  }
+
+  // Horizontal pod autoscalers
+  if (formValues.AutoScaler.IsUsed && formValues.DeploymentType !== KubernetesApplicationDeploymentTypes.Global) {
+    const kind = app.ApplicationType;
+    const autoScaler = KubernetesHorizontalPodAutoScalerConverter.applicationFormValuesToModel(formValues, kind);
+    resources.push({ action: CREATE, kind: KubernetesResourceTypes.HORIZONTAL_POD_AUTOSCALER, name: autoScaler.Name });
+  }
+
+  // Deployment
+  const appResourceType = app.ApplicationType;
+  if (appResourceType !== null) {
+    resources.push({ action: CREATE, kind: appResourceType, name: app.Name });
+  }
+
+  return resources;
+}
+
+/**
+ * Get summary of Kubernetes resources to be created, updated and/or deleted
+ * @param {KubernetesApplicationFormValues} oldFormValues
+ * @param {KubernetesApplicationFormValues} newFormValues
+ */
+export function getUpdatedApplicationResources(oldFormValues, newFormValues) {
+  const resources = [];
+
+  const [oldApp, oldHeadlessService, oldServices, oldService, oldClaims] = KubernetesApplicationConverter.applicationFormValuesToApplication(oldFormValues);
+  const [newApp, newHeadlessService, newServices, newService, newClaims] = KubernetesApplicationConverter.applicationFormValuesToApplication(newFormValues);
+  const oldAppResourceType = oldApp.ApplicationType;
+  const newAppResourceType = newApp.ApplicationType;
+
+  if (oldAppResourceType !== newAppResourceType) {
+    // Deployment
+    resources.push({ action: DELETE, kind: oldAppResourceType, name: oldApp.Name });
+    if (oldService && oldServices) {
+      // Service
+      resources.push({ action: DELETE, kind: KubernetesResourceTypes.SERVICE, name: oldService.Name, type: oldService.Type || KubernetesServiceTypes.CLUSTER_IP });
+    }
+    // re-creation of resources
+    const createdApplicationResourceSummary = getCreatedApplicationResources(newFormValues);
+    resources.push(...createdApplicationResourceSummary);
+    return resources;
+  }
+
+  if (newApp instanceof KubernetesStatefulSet) {
+    const headlessServiceUpdateResourceSummary = getServiceUpdateResourceSummary(oldHeadlessService, newHeadlessService);
+    if (headlessServiceUpdateResourceSummary) {
+      resources.push(headlessServiceUpdateResourceSummary);
+    }
+  } else {
+    // Persistent volume claims
+    const claimSummaries = newClaims
+      .map((pvc) => {
+        if (!pvc.PreviousName && !pvc.Id) {
+          return { action: CREATE, kind: KubernetesResourceTypes.PERSISTENT_VOLUME_CLAIM, name: pvc.Name };
+        } else if (!pvc.Id) {
+          const oldClaim = _.find(oldClaims, { Name: pvc.PreviousName });
+          return getVolumeClaimUpdateResourceSummary(oldClaim, pvc);
+        }
+      })
+      .filter((pvc) => pvc); // remove nulls
+    resources.push(...claimSummaries);
+  }
+
+  // Deployment
+  resources.push({ action: UPDATE, kind: oldAppResourceType, name: oldApp.Name });
+
+  if (oldServices && newServices) {
+    // Service
+    const serviceUpdateResourceSummary = getServiceUpdateResourceSummary(oldServices, newServices);
+    if (serviceUpdateResourceSummary !== null) {
+      serviceUpdateResourceSummary.forEach((updateSummary) => {
+        resources.push(updateSummary);
+      });
+    }
+
+    // Ingress
+    const oldServicePorts = oldFormValues.Services.flatMap((service) => service.Ports);
+    const oldIngresses = generateNewIngressesFromFormPaths(oldFormValues.OriginalIngresses, oldServicePorts, oldServicePorts);
+    const newServicePorts = newFormValues.Services.flatMap((service) => service.Ports);
+    const newIngresses = generateNewIngressesFromFormPaths(newFormValues.OriginalIngresses, newServicePorts, oldServicePorts);
+    resources.push(...getIngressUpdateSummary(oldIngresses, newIngresses));
+  } else if (!oldService && newService) {
+    // Service
+    resources.push({ action: CREATE, kind: KubernetesResourceTypes.SERVICE, name: newService.Name, type: newService.Type || KubernetesServiceTypes.CLUSTER_IP });
+  } else if (oldService && !newService) {
+    // Service
+    resources.push({ action: DELETE, kind: KubernetesResourceTypes.SERVICE, name: oldService.Name, type: oldService.Type || KubernetesServiceTypes.CLUSTER_IP });
+  }
+
+  const newKind = newApp.ApplicationType;
+  const newAutoScaler = KubernetesHorizontalPodAutoScalerConverter.applicationFormValuesToModel(newFormValues, newKind);
+  if (!oldFormValues.AutoScaler.IsUsed) {
+    if (newFormValues.AutoScaler.IsUsed) {
+      // Horizontal pod autoscalers
+      resources.push({ action: CREATE, kind: KubernetesResourceTypes.HORIZONTAL_POD_AUTOSCALER, name: newAutoScaler.Name });
+    }
+  } else {
+    // Horizontal pod autoscalers
+    const oldKind = oldApp.ApplicationType;
+    const oldAutoScaler = KubernetesHorizontalPodAutoScalerConverter.applicationFormValuesToModel(oldFormValues, oldKind);
+    if (newFormValues.AutoScaler.IsUsed) {
+      const hpaUpdateSummary = getHorizontalPodAutoScalerUpdateResourceSummary(oldAutoScaler, newAutoScaler);
+      if (hpaUpdateSummary) {
+        resources.push(hpaUpdateSummary);
+      }
+    } else {
+      resources.push({ action: DELETE, kind: KubernetesResourceTypes.HORIZONTAL_POD_AUTOSCALER, name: oldAutoScaler.Name });
+    }
+  }
+
+  return resources;
+}
+
+function getIngressUpdateSummary(oldIngresses, newIngresses) {
+  const ingressesSummaries = newIngresses
+    .map((newIng) => {
+      const oldIng = oldIngresses.find((oldIng) => oldIng.Name === newIng.Name);
+      return getIngressUpdateResourceSummary(oldIng, newIng);
+    })
+    .filter((s) => s); // remove nulls
+  return ingressesSummaries;
+}
+
+// getIngressUpdateResourceSummary replicates KubernetesIngressService.patch
+function getIngressUpdateResourceSummary(oldIngress, newIngress) {
+  const payload = KubernetesIngressConverter.patchPayload(oldIngress, newIngress);
+  if (payload.length) {
+    return { action: UPDATE, kind: KubernetesResourceTypes.INGRESS, name: oldIngress.Name };
+  }
+  return null;
+}
+
+// getVolumeClaimUpdateResourceSummary replicates KubernetesPersistentVolumeClaimService.patch
+function getVolumeClaimUpdateResourceSummary(oldPVC, newPVC) {
+  const payload = KubernetesPersistentVolumeClaimConverter.patchPayload(oldPVC, newPVC);
+  if (payload.length) {
+    return { action: UPDATE, kind: KubernetesResourceTypes.PERSISTENT_VOLUME_CLAIM, name: oldPVC.Name };
+  }
+  return null;
+}
+
+// getServiceUpdateResourceSummary replicates KubernetesServiceService.patch
+function getServiceUpdateResourceSummary(oldServices, newServices) {
+  let summary = [];
+  // skip update summary when service is headless service
+  if (!oldServices.Headless) {
+    newServices.forEach((newService) => {
+      const oldServiceMatched = _.find(oldServices, { Name: newService.Name });
+      if (oldServiceMatched) {
+        const payload = KubernetesServiceConverter.patchPayload(oldServiceMatched, newService);
+        if (payload.length) {
+          const serviceUpdate = {
+            action: UPDATE,
+            kind: KubernetesResourceTypes.SERVICE,
+            name: oldServiceMatched.Name,
+            type: oldServiceMatched.Type || KubernetesServiceTypes.CLUSTER_IP,
+          };
+          summary.push(serviceUpdate);
+        }
+      } else {
+        const emptyService = new KubernetesService();
+        const payload = KubernetesServiceConverter.patchPayload(emptyService, newService);
+        if (payload.length) {
+          const serviceCreate = { action: CREATE, kind: KubernetesResourceTypes.SERVICE, name: newService.Name, type: newService.Type || KubernetesServiceTypes.CLUSTER_IP };
+          summary.push(serviceCreate);
+        }
+      }
+    });
+
+    oldServices.forEach((oldService) => {
+      const newServiceMatched = _.find(newServices, { Name: oldService.Name });
+      if (!newServiceMatched) {
+        const serviceDelete = { action: DELETE, kind: KubernetesResourceTypes.SERVICE, name: oldService.Name, type: oldService.Type || KubernetesServiceTypes.CLUSTER_IP };
+        summary.push(serviceDelete);
+      }
+    });
+  }
+  if (summary.length !== 0) {
+    return summary;
+  }
+  return null;
+}
+
+// getHorizontalPodAutoScalerUpdateResourceSummary replicates KubernetesHorizontalPodAutoScalerService.patch
+function getHorizontalPodAutoScalerUpdateResourceSummary(oldHorizontalPodAutoScaler, newHorizontalPodAutoScaler) {
+  const payload = KubernetesHorizontalPodAutoScalerConverter.patchPayload(oldHorizontalPodAutoScaler, newHorizontalPodAutoScaler);
+  if (payload.length) {
+    return { action: UPDATE, kind: KubernetesResourceTypes.HORIZONTAL_POD_AUTOSCALER, name: oldHorizontalPodAutoScaler.Name };
+  }
+  return null;
+}
diff --git a/app/kubernetes/views/summary/resources/configurationResources.js b/app/kubernetes/views/summary/resources/configurationResources.js
new file mode 100644
index 0000000..3dabcbc
--- /dev/null
+++ b/app/kubernetes/views/summary/resources/configurationResources.js
@@ -0,0 +1,17 @@
+import { KubernetesResourceTypes, KubernetesResourceActions } from '@/kubernetes/models/resource-types/models';
+import { KubernetesConfigurationKinds } from '@/kubernetes/models/configuration/models';
+
+const { CREATE, UPDATE } = KubernetesResourceActions;
+
+export default function (formValues) {
+  const action = formValues.Id ? UPDATE : CREATE;
+  if (formValues.Kind === KubernetesConfigurationKinds.CONFIGMAP) {
+    return [{ action, kind: KubernetesResourceTypes.CONFIGMAP, name: formValues.Name }];
+  } else if (formValues.Kind === KubernetesConfigurationKinds.SECRET) {
+    let type = formValues.Type;
+    if (formValues.customType) {
+      type = formValues.customType;
+    }
+    return [{ action, kind: KubernetesResourceTypes.SECRET, name: formValues.Name, type }];
+  }
+}
diff --git a/app/kubernetes/views/summary/resources/helpers.js b/app/kubernetes/views/summary/resources/helpers.js
new file mode 100644
index 0000000..15b2fc6
--- /dev/null
+++ b/app/kubernetes/views/summary/resources/helpers.js
@@ -0,0 +1,54 @@
+import _ from 'lodash-es';
+import * as JsonPatch from 'fast-json-patch';
+import { KubernetesResourceActions } from '@/kubernetes/models/resource-types/models';
+
+function findCreateResources(newResources, oldResources) {
+  return _.differenceBy(newResources, oldResources, 'Name');
+}
+
+function findDeleteResources(newResources, oldResources) {
+  return _.differenceBy(oldResources, newResources, 'Name');
+}
+
+function findUpdateResources(newResources, oldResources) {
+  const updateResources = _.intersectionWith(newResources, oldResources, (newResource, oldResource) => {
+    // find out resources with same name but content changed
+    if (newResource.Name != oldResource.Name) {
+      return false;
+    }
+    return !isEqual(newResource, oldResource);
+  });
+
+  return updateResources;
+}
+
+function isEqual(newResource, oldResource) {
+  let patches = JsonPatch.compare(newResource, oldResource);
+  patches = _.filter(patches, (change) => {
+    return !_.includes(change.path, '$$hashKey') && !_.includes(change.path, 'Duplicate');
+  });
+
+  return !patches.length;
+}
+
+function doGetResourcesSummary(newResources, oldResources, kind, action, actionFilter) {
+  const filteredResources = actionFilter(newResources, oldResources);
+  const summary = filteredResources.map((resource) => ({ name: resource.Name, action, kind }));
+
+  return summary;
+}
+
+export function getResourcesSummary(newResources, oldResources, kind) {
+  if (!Array.isArray(newResources)) {
+    newResources = newResources ? [newResources] : [];
+    oldResources = oldResources ? [oldResources] : [];
+  }
+
+  const summary = [
+    ...doGetResourcesSummary(newResources, oldResources, kind, KubernetesResourceActions.CREATE, findCreateResources),
+    ...doGetResourcesSummary(newResources, oldResources, kind, KubernetesResourceActions.UPDATE, findUpdateResources),
+    ...doGetResourcesSummary(newResources, oldResources, kind, KubernetesResourceActions.DELETE, findDeleteResources),
+  ];
+
+  return summary;
+}
diff --git a/app/kubernetes/views/summary/resources/namespaceResources.js b/app/kubernetes/views/summary/resources/namespaceResources.js
new file mode 100644
index 0000000..01a6c8d
--- /dev/null
+++ b/app/kubernetes/views/summary/resources/namespaceResources.js
@@ -0,0 +1,23 @@
+import KubernetesResourcePoolConverter from '@/kubernetes/converters/resourcePool';
+import { KubernetesResourcePoolFormValues } from '@/kubernetes/models/resource-pool/formValues';
+import { KubernetesResourceQuotaDefaults } from '@/kubernetes/models/resource-quota/models';
+import { KubernetesResourceTypes } from '@/kubernetes/models/resource-types/models';
+import { getResourcesSummary } from '@/kubernetes/views/summary/resources/helpers';
+
+export default function (newFormValues, oldFormValues) {
+  const [newNamespace, newQuota, newIngresses] = KubernetesResourcePoolConverter.formValuesToResourcePool(newFormValues);
+
+  if (!(oldFormValues instanceof KubernetesResourcePoolFormValues)) {
+    oldFormValues = new KubernetesResourcePoolFormValues(KubernetesResourceQuotaDefaults);
+  }
+
+  const [oldNamespace, oldQuota, oldIngresses] = KubernetesResourcePoolConverter.formValuesToResourcePool(oldFormValues);
+
+  const resources = [
+    ...getResourcesSummary(newNamespace, oldNamespace, KubernetesResourceTypes.NAMESPACE),
+    ...getResourcesSummary(newQuota, oldQuota, KubernetesResourceTypes.RESOURCEQUOTA),
+    ...getResourcesSummary(newIngresses, oldIngresses, KubernetesResourceTypes.INGRESS),
+  ];
+
+  return resources;
+}
diff --git a/app/kubernetes/views/summary/summary.html b/app/kubernetes/views/summary/summary.html
new file mode 100644
index 0000000..685310e
--- /dev/null
+++ b/app/kubernetes/views/summary/summary.html
@@ -0,0 +1 @@
+<kubernetes-summary-view-react actions="$ctrl.state.resources" cpu-limit="$ctrl.state.limits.cpu" memory-limit="$ctrl.state.limits.memory"></kubernetes-summary-view-react>
diff --git a/app/kubernetes/views/summary/summary.js b/app/kubernetes/views/summary/summary.js
new file mode 100644
index 0000000..841a9f4
--- /dev/null
+++ b/app/kubernetes/views/summary/summary.js
@@ -0,0 +1,9 @@
+angular.module('portainer.kubernetes').component('kubernetesSummaryView', {
+  templateUrl: './summary.html',
+  controller: 'KubernetesSummaryController',
+  controllerAs: '$ctrl',
+  bindings: {
+    formValues: '<',
+    oldFormValues: '<',
+  },
+});
diff --git a/app/kubernetes/views/summary/summaryController.js b/app/kubernetes/views/summary/summaryController.js
new file mode 100644
index 0000000..ceb9d5b
--- /dev/null
+++ b/app/kubernetes/views/summary/summaryController.js
@@ -0,0 +1,89 @@
+import angular from 'angular';
+import { KubernetesConfigurationFormValues } from '@/kubernetes/models/configuration/formvalues';
+import { KubernetesResourcePoolFormValues } from '@/kubernetes/models/resource-pool/formValues';
+import { KubernetesApplicationFormValues } from '@/kubernetes/models/application/formValues';
+import { KubernetesResourceActions, KubernetesResourceTypes } from '@/kubernetes/models/resource-types/models';
+import { getApplicationResources } from './resources/applicationResources';
+import getNamespaceResources from './resources/namespaceResources';
+import getConfigurationResources from './resources/configurationResources';
+
+class KubernetesSummaryController {
+  /* @ngInject */
+  constructor($scope, LocalStorage, KubernetesResourcePoolService) {
+    this.LocalStorage = LocalStorage;
+    this.KubernetesResourcePoolService = KubernetesResourcePoolService;
+
+    this.toggleSummary = this.toggleSummary.bind(this);
+    this.generateResourceSummaryList = this.generateResourceSummaryList.bind(this);
+
+    // Deep-watch changes on formValues property
+    $scope.$watch(
+      '$ctrl.formValues',
+      (formValues) => {
+        this.state.resources = this.generateResourceSummaryList(angular.copy(formValues));
+      },
+      true
+    );
+  }
+
+  getArticle(resourceType, resourceAction) {
+    let article = 'a';
+    if (resourceAction === KubernetesResourceActions.CREATE) {
+      if (resourceType === KubernetesResourceTypes.INGRESS) {
+        article = 'an';
+      }
+    } else {
+      article = 'the';
+    }
+
+    return article;
+  }
+
+  /**
+   * toggleSummary toggles the summary panel state and persists it to browser localstorage
+   */
+  toggleSummary() {
+    this.state.expandedTemplate = !this.state.expandedTemplate;
+    this.LocalStorage.storeKubernetesSummaryToggle(this.state.expandedTemplate);
+  }
+
+  /**
+   * generateResourceSummaryList maps formValues to custom object
+   * @param {object} formValues
+   * @returns {object} => { action: "string", kind: "string", name: "string" }
+   */
+  generateResourceSummaryList(formValues) {
+    const oldFormValues = this.oldFormValues;
+
+    if (formValues instanceof KubernetesConfigurationFormValues) {
+      // Configuration
+      return getConfigurationResources(formValues);
+    } else if (formValues instanceof KubernetesResourcePoolFormValues) {
+      // Namespaces
+      return getNamespaceResources(formValues, oldFormValues);
+    } else if (formValues instanceof KubernetesApplicationFormValues) {
+      // Applications
+
+      // extract cpu and memory requests & limits for pod
+      this.state.limits = { cpu: formValues.CpuLimit, memory: formValues.MemoryLimit };
+
+      return getApplicationResources(formValues, oldFormValues);
+    }
+
+    return [];
+  }
+
+  $onInit() {
+    const toggleValue = this.LocalStorage.getKubernetesSummaryToggle();
+    const expanded = typeof toggleValue === 'boolean' ? toggleValue : true;
+
+    this.state = {
+      expandedTemplate: expanded,
+      resources: [],
+      limits: { cpu: null, memory: null },
+    };
+  }
+}
+
+export default KubernetesSummaryController;
+angular.module('portainer.kubernetes').controller('KubernetesSummaryController', KubernetesSummaryController);
diff --git a/app/kubernetes/views/volumes/edit/volume.html b/app/kubernetes/views/volumes/edit/volume.html
new file mode 100644
index 0000000..5e83682
--- /dev/null
+++ b/app/kubernetes/views/volumes/edit/volume.html
@@ -0,0 +1,188 @@
+<page-header
+  ng-if="ctrl.state.viewReady"
+  title="'Volume details'"
+  breadcrumbs="[
+    { label:'Namespaces', link:'kubernetes.resourcePools' },
+    {
+      label:ctrl.volume.ResourcePool.Namespace.Name,
+      link: 'kubernetes.resourcePools.resourcePool',
+      linkParams:{ id: ctrl.volume.ResourcePool.Namespace.Name }
+    },
+    { label:'Volumes', link:'kubernetes.volumes.index' },
+     ctrl.volume.PersistentVolumeClaim.Name,
+     ]"
+  reload="true"
+>
+</page-header>
+
+<kubernetes-view-loading view-ready="ctrl.state.viewReady"></kubernetes-view-loading>
+
+<div ng-if="ctrl.state.viewReady">
+  <div class="row">
+    <div class="col-sm-12">
+      <rd-widget>
+        <rd-widget-body classes="no-padding">
+          <uib-tabset active="ctrl.state.activeTab" justified="true" type="pills">
+            <uib-tab index="0" classes="btn-sm" select="ctrl.selectTab(0)">
+              <uib-tab-heading class="vertical-center" data-cy="k8sVolDetail-volTab">
+                <pr-icon icon="'database'"></pr-icon>
+                Volume
+              </uib-tab-heading>
+              <div class="widget-body">
+                <table class="table">
+                  <tbody>
+                    <tr>
+                      <td>Name</td>
+                      <td data-cy="k8sVolDetail-volName">
+                        {{ ctrl.volume.PersistentVolumeClaim.Name }}
+                        <span class="label label-primary image-tag label-margins" ng-if="!ctrl.isSystemNamespace() && ctrl.isExternalVolume()">external</span>
+                        <span class="label label-warning image-tag label-margins" ng-if="!ctrl.isSystemNamespace() && !ctrl.isUsed()">unused</span>
+                      </td>
+                    </tr>
+                    <tr>
+                      <td>Namespace</td>
+                      <td>
+                        <a ui-sref="kubernetes.resourcePools.resourcePool({ id: ctrl.volume.ResourcePool.Namespace.Name })" data-cy="k8sVolDetail-volNamespace">{{
+                          ctrl.volume.ResourcePool.Namespace.Name
+                        }}</a>
+                        <span style="margin-left: 5px" class="label label-info image-tag" ng-if="ctrl.isSystemNamespace()">system</span>
+                      </td>
+                    </tr>
+                    <tr>
+                      <td>Storage Class</td>
+                      <td data-cy="k8sVolDetail-volStorageClassname">{{ ctrl.volume.PersistentVolumeClaim.storageClass.Name }}</td>
+                    </tr>
+                    <tr>
+                      <td>Access Modes</td>
+                      <td data-cy="k8sVolDetail-volAccessPolicy">
+                        <div ng-repeat="(index, accessPolicy) in ctrl.state.volumeSharedAccessPolicies" class="flex flex-col gap-y-1">
+                          <div class="flex items-center gap-x-1">
+                            {{ accessPolicy }}
+                            <portainer-tooltip
+                              ng-if="ctrl.state.volumeSharedAccessPolicyTooltips[index]"
+                              message="ctrl.state.volumeSharedAccessPolicyTooltips[index]"
+                            ></portainer-tooltip>
+                          </div>
+                        </div>
+                      </td>
+                    </tr>
+                    <tr>
+                      <td>Provisioner</td>
+                      <td data-cy="k8sVolDetail-volProvisioner">{{
+                        ctrl.volume.PersistentVolumeClaim.storageClass.Provisioner ? ctrl.volume.PersistentVolumeClaim.storageClass.Provisioner : '-'
+                      }}</td>
+                    </tr>
+                    <tr>
+                      <td>Creation date</td>
+                      <td data-cy="k8sVolDetail-volCreatedAt">{{ ctrl.volume.PersistentVolumeClaim.CreationDate | getisodate }}</td>
+                    </tr>
+                    <tr>
+                      <td>size</td>
+                      <td ng-if="!ctrl.state.increaseSize">
+                        {{ ctrl.volume.PersistentVolumeClaim.Storage }}
+                        <button
+                          type="button"
+                          class="btn btn-sm btn-primary"
+                          ng-click="ctrl.state.increaseSize = true"
+                          ng-if="ctrl.volume.PersistentVolumeClaim.storageClass.AllowVolumeExpansion"
+                          data-cy="k8sVolDetail-increaseSizeButton"
+                          >Increase size</button
+                        >
+                      </td>
+                      <td ng-if="ctrl.state.increaseSize">
+                        <form name="kubernetesVolumeUpdateForm">
+                          <div class="form-inline">
+                            <div class="input-group input-group-sm">
+                              <input
+                                type="number"
+                                data-cy="k8sVolDetail-increaseSizeInput"
+                                class="form-control"
+                                name="size"
+                                ng-model="ctrl.state.volumeSize"
+                                placeholder="20"
+                                ng-min="0"
+                                min="0"
+                                ng-change="ctrl.onChangeSize()"
+                                required
+                                data-cy="k8sVolDetail-increaseSizeInput"
+                              />
+                              <span class="input-group-addon" style="padding: 0">
+                                <select
+                                  ng-model="ctrl.state.volumeSizeUnit"
+                                  ng-change="ctrl.onChangeSize()"
+                                  ng-options="unit for unit in ctrl.state.availableSizeUnits"
+                                  style="width: 100%; height: 100%"
+                                  data-cy="k8sVolDetail-increaseSizeUnits"
+                                ></select>
+                              </span>
+                            </div>
+                            <button
+                              type="button"
+                              class="btn btn-sm btn-primary"
+                              ng-disabled="!ctrl.sizeIsValid()"
+                              ng-click="ctrl.updateVolume()"
+                              data-cy="k8sVolDetail-updateSizeConfirm"
+                            >
+                              Update size
+                            </button>
+                            <button type="button" class="btn btn-sm btn-default" ng-click="ctrl.state.increaseSize = false" data-cy="k8sVolDetail-cancelUpdateSize">
+                              Cancel
+                            </button>
+                          </div>
+
+                          <div class="form-inline">
+                            <div class="small text-warning" style="margin-top: 5px" ng-show="ctrl.state.errors.volumeSize || kubernetesVolumeUpdateForm.size.$invalid">
+                              <div class="vertical-center" ng-messages="kubernetesVolumeUpdateForm.size.$error">
+                                <p ng-message="required"><pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon> This field is required.</p>
+                              </div>
+                              <p class="vertical-center" ng-show="ctrl.state.errors.volumeSize"
+                                ><pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon> The new size must be greater than the actual size.</p
+                              >
+                            </div>
+                          </div>
+                        </form>
+                      </td>
+                    </tr>
+                  </tbody>
+                </table>
+              </div>
+            </uib-tab>
+
+            <uib-tab index="1" classes="btn-sm" select="ctrl.selectTab(1)">
+              <uib-tab-heading class="vertical-center" data-cy="k8sVolDetail-volEventsTab">
+                <pr-icon icon="'history'"></pr-icon> Events
+                <div ng-if="ctrl.hasEventWarnings()">
+                  <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon>
+                  {{ ctrl.state.eventWarningCount }} warning(s)
+                </div>
+              </uib-tab-heading>
+              <resource-events-datatable
+                namespace="ctrl.volume.ResourcePool.Namespace.Name"
+                storage-key="'kubernetes.volume.events'"
+                resource-id="ctrl.volume.PersistentVolumeClaim.Id"
+              >
+              </resource-events-datatable>
+            </uib-tab>
+
+            <uib-tab index="2" ng-if="ctrl.volume.PersistentVolumeClaim.Yaml" select="ctrl.showEditor()" classes="btn-sm">
+              <uib-tab-heading class="vertical-center" data-cy="k8sVolDetail-volYamlTab"> <pr-icon icon="'code'"></pr-icon> YAML </uib-tab-heading>
+              <div class="px-5" ng-if="ctrl.state.showEditorTab">
+                <kube-yaml-inspector data-cy="k8sVolDetail-volYaml" identifier="'volume-yaml'" data="ctrl.volume.PersistentVolumeClaim.Yaml" hide-message="true" />
+              </div>
+            </uib-tab>
+          </uib-tabset>
+        </rd-widget-body>
+      </rd-widget>
+    </div>
+  </div>
+
+  <kubernetes-integrated-applications-datatable
+    ng-if="ctrl.isUsed(item)"
+    dataset="ctrl.volume.Applications"
+    is-loading="!ctrl.volume.Applications"
+    table-key="'kubernetes.volume.applications'"
+    on-refresh="(ctrl.getVolume)"
+    table-title="'Applications using this volume'"
+  >
+  </kubernetes-integrated-applications-datatable>
+</div>
diff --git a/app/kubernetes/views/volumes/edit/volume.js b/app/kubernetes/views/volumes/edit/volume.js
new file mode 100644
index 0000000..d46ee39
--- /dev/null
+++ b/app/kubernetes/views/volumes/edit/volume.js
@@ -0,0 +1,9 @@
+angular.module('portainer.kubernetes').component('kubernetesVolumeView', {
+  templateUrl: './volume.html',
+  controller: 'KubernetesVolumeController',
+  controllerAs: 'ctrl',
+  bindings: {
+    $transition$: '<',
+    endpoint: '<',
+  },
+});
diff --git a/app/kubernetes/views/volumes/edit/volumeController.js b/app/kubernetes/views/volumes/edit/volumeController.js
new file mode 100644
index 0000000..1fa26eb
--- /dev/null
+++ b/app/kubernetes/views/volumes/edit/volumeController.js
@@ -0,0 +1,217 @@
+import angular from 'angular';
+import _ from 'lodash-es';
+import filesizeParser from 'filesize-parser';
+import KubernetesVolumeHelper from '@/kubernetes/helpers/volumeHelper';
+import KubernetesEventHelper from '@/kubernetes/helpers/eventHelper';
+import { KubernetesStorageClassAccessPolicies } from '@/kubernetes/models/storage-class/models';
+import KubernetesNamespaceHelper from '@/kubernetes/helpers/namespaceHelper';
+import { confirmRedeploy } from '@/react/kubernetes/volumes/ItemView/ConfirmRedeployModal';
+import { isVolumeUsed } from '@/react/kubernetes/volumes/utils';
+
+class KubernetesVolumeController {
+  /* @ngInject */
+  constructor(
+    $async,
+    $state,
+    Notifications,
+    LocalStorage,
+    KubernetesVolumeService,
+    KubernetesEventService,
+    KubernetesApplicationService,
+    KubernetesPersistentVolumeClaimService,
+    KubernetesPodService
+  ) {
+    this.$async = $async;
+    this.$state = $state;
+    this.Notifications = Notifications;
+    this.LocalStorage = LocalStorage;
+
+    this.KubernetesVolumeService = KubernetesVolumeService;
+    this.KubernetesEventService = KubernetesEventService;
+    this.KubernetesApplicationService = KubernetesApplicationService;
+    this.KubernetesPersistentVolumeClaimService = KubernetesPersistentVolumeClaimService;
+    this.KubernetesPodService = KubernetesPodService;
+
+    this.onInit = this.onInit.bind(this);
+    this.getVolume = this.getVolume.bind(this);
+    this.getVolumeAsync = this.getVolumeAsync.bind(this);
+    this.updateVolumeAsync = this.updateVolumeAsync.bind(this);
+    this.getEvents = this.getEvents.bind(this);
+    this.getEventsAsync = this.getEventsAsync.bind(this);
+  }
+
+  selectTab(index) {
+    this.LocalStorage.storeActiveTab('volume', index);
+  }
+
+  showEditor() {
+    this.state.showEditorTab = true;
+    this.selectTab(2);
+  }
+
+  isExternalVolume() {
+    return !this.volume.PersistentVolumeClaim.ApplicationOwner;
+  }
+
+  isSystemNamespace() {
+    return KubernetesNamespaceHelper.isSystemNamespace(this.volume.ResourcePool.Namespace.Name);
+  }
+
+  isUsed() {
+    return isVolumeUsed(this.volume);
+  }
+
+  onChangeSize() {
+    if (this.state.volumeSize) {
+      const size = filesizeParser(this.state.volumeSize + this.state.volumeSizeUnit, { base: 10 });
+      if (this.state.oldVolumeSize > size) {
+        this.state.errors.volumeSize = true;
+      } else {
+        this.state.errors.volumeSize = false;
+      }
+    }
+  }
+
+  sizeIsValid() {
+    return !this.state.errors.volumeSize && this.state.volumeSize && this.state.oldVolumeSize !== filesizeParser(this.state.volumeSize + this.state.volumeSizeUnit, { base: 10 });
+  }
+
+  /**
+   * VOLUME
+   */
+
+  async updateVolumeAsync(redeploy) {
+    try {
+      this.volume.PersistentVolumeClaim.Storage = this.state.volumeSize + this.state.volumeSizeUnit.charAt(0);
+      await this.KubernetesPersistentVolumeClaimService.patch(this.oldVolume.PersistentVolumeClaim, this.volume.PersistentVolumeClaim);
+      this.Notifications.success('Success', 'Volume successfully updated');
+
+      if (redeploy) {
+        const promises = _.flatten(
+          _.map(this.volume.Applications, (app) => {
+            return _.map(app.Pods, (item) => this.KubernetesPodService.delete(item));
+          })
+        );
+        await Promise.all(promises);
+        this.Notifications.success('Success', 'Applications successfully redeployed');
+      }
+
+      this.$state.reload(this.$state.current);
+    } catch (err) {
+      this.Notifications.error('Failure', err, 'Unable to update volume.');
+    }
+  }
+
+  updateVolume() {
+    if (isVolumeUsed(this.volume)) {
+      confirmRedeploy().then((redeploy) => {
+        return this.$async(this.updateVolumeAsync, redeploy);
+      });
+    } else {
+      return this.$async(this.updateVolumeAsync, false);
+    }
+  }
+
+  async getVolumeAsync() {
+    const storageClasses = this.endpoint.Kubernetes.Configuration.StorageClasses;
+    try {
+      const [volume, applications] = await Promise.all([
+        this.KubernetesVolumeService.get(this.state.namespace, storageClasses, this.state.name),
+        this.KubernetesApplicationService.get(this.state.namespace),
+      ]);
+      volume.Applications = KubernetesVolumeHelper.getUsingApplications(volume, applications);
+      this.volume = volume;
+      this.oldVolume = angular.copy(volume);
+      this.state.volumeSize = parseInt(volume.PersistentVolumeClaim.Storage.slice(0, -2), 10);
+      this.state.volumeSizeUnit = volume.PersistentVolumeClaim.Storage.slice(-2);
+      this.state.oldVolumeSize = filesizeParser(volume.PersistentVolumeClaim.Storage, { base: 10 });
+    } catch (err) {
+      this.Notifications.error('Failure', err, 'Unable to retrieve volume');
+    }
+  }
+
+  getVolume() {
+    return this.$async(this.getVolumeAsync);
+  }
+
+  /**
+   * EVENTS
+   */
+  hasEventWarnings() {
+    return this.state.eventWarningCount;
+  }
+
+  async getEventsAsync() {
+    try {
+      this.state.eventsLoading = true;
+      const events = await this.KubernetesEventService.get(this.state.namespace);
+      this.events = _.filter(events, (event) => event.Involved.uid === this.volume.PersistentVolumeClaim.Id);
+      this.state.eventWarningCount = KubernetesEventHelper.warningCount(this.events);
+    } catch (err) {
+      this.Notifications.error('Failure', err, 'Unable to retrieve application related events');
+    } finally {
+      this.state.eventsLoading = false;
+    }
+  }
+
+  getEvents() {
+    return this.$async(this.getEventsAsync);
+  }
+
+  /**
+   * ON INIT
+   */
+  async onInit() {
+    this.state = {
+      activeTab: 0,
+      currentName: this.$state.$current.name,
+      showEditorTab: false,
+      eventsLoading: true,
+      viewReady: false,
+      namespace: this.$transition$.params().namespace,
+      name: this.$transition$.params().name,
+      eventWarningCount: 0,
+      availableSizeUnits: ['MB', 'GB', 'TB'],
+      increaseSize: false,
+      volumeSize: 0,
+      volumeSizeUnit: 'GB',
+      volumeSharedAccessPolicies: [],
+      volumeSharedAccessPolicyTooltips: '',
+      errors: {
+        volumeSize: false,
+      },
+    };
+
+    this.state.activeTab = this.LocalStorage.getActiveTab('volume');
+
+    try {
+      await this.getVolume();
+      await this.getEvents();
+      if (this.volume.PersistentVolumeClaim.storageClass !== undefined) {
+        this.state.volumeSharedAccessPolicies = this.volume.PersistentVolumeClaim.AccessModes;
+        let policies = KubernetesStorageClassAccessPolicies();
+        this.state.volumeSharedAccessPolicyTooltips = this.state.volumeSharedAccessPolicies.map((policy) => {
+          const matchingPolicy = policies.find((p) => p.Name === policy);
+          return matchingPolicy ? matchingPolicy.Description : undefined;
+        });
+      }
+    } catch (err) {
+      this.Notifications.error('Failure', err, 'Unable to load view data');
+    } finally {
+      this.state.viewReady = true;
+    }
+  }
+
+  $onInit() {
+    return this.$async(this.onInit);
+  }
+
+  $onDestroy() {
+    if (this.state.currentName !== this.$state.$current.name) {
+      this.LocalStorage.storeActiveTab('volume', 0);
+    }
+  }
+}
+
+export default KubernetesVolumeController;
+angular.module('portainer.kubernetes').controller('KubernetesVolumeController', KubernetesVolumeController);
diff --git a/app/ng-constants.ts b/app/ng-constants.ts
new file mode 100644
index 0000000..87fa45b
--- /dev/null
+++ b/app/ng-constants.ts
@@ -0,0 +1,63 @@
+import angular from 'angular';
+
+import {
+  API_ENDPOINT_AUTH,
+  API_ENDPOINT_BACKUP,
+  API_ENDPOINT_CUSTOM_TEMPLATES,
+  API_ENDPOINT_EDGE_GROUPS,
+  API_ENDPOINT_EDGE_JOBS,
+  API_ENDPOINT_EDGE_STACKS,
+  API_ENDPOINT_ENDPOINTS,
+  API_ENDPOINT_ENDPOINT_GROUPS,
+  API_ENDPOINT_KUBERNETES,
+  API_ENDPOINT_MOTD,
+  API_ENDPOINT_REGISTRIES,
+  API_ENDPOINT_RESOURCE_CONTROLS,
+  API_ENDPOINT_SETTINGS,
+  API_ENDPOINT_STACKS,
+  API_ENDPOINT_SUPPORT,
+  API_ENDPOINT_USERS,
+  API_ENDPOINT_TAGS,
+  API_ENDPOINT_TEAMS,
+  API_ENDPOINT_TEAM_MEMBERSHIPS,
+  API_ENDPOINT_TEMPLATES,
+  API_ENDPOINT_WEBHOOKS,
+  PAGINATION_MAX_ITEMS,
+  APPLICATION_CACHE_VALIDITY,
+  CONSOLE_COMMANDS_LABEL_PREFIX,
+  PREDEFINED_NETWORKS,
+} from './constants';
+import { BROWSER_OS_PLATFORM } from './react/constants';
+
+// don't declare new constants, either:
+// - if only used in one file or module, declare in that file or module (as a regular js constant)
+// - if needed across modules, declare like in `./constants` and use es6 import for that
+
+export const constantsModule = angular
+  .module('portainer.app.constants', [])
+  .constant('API_ENDPOINT_AUTH', API_ENDPOINT_AUTH)
+  .constant('API_ENDPOINT_BACKUP', API_ENDPOINT_BACKUP)
+  .constant('API_ENDPOINT_CUSTOM_TEMPLATES', API_ENDPOINT_CUSTOM_TEMPLATES)
+  .constant('API_ENDPOINT_EDGE_GROUPS', API_ENDPOINT_EDGE_GROUPS)
+  .constant('API_ENDPOINT_EDGE_JOBS', API_ENDPOINT_EDGE_JOBS)
+  .constant('API_ENDPOINT_EDGE_STACKS', API_ENDPOINT_EDGE_STACKS)
+  .constant('API_ENDPOINT_ENDPOINTS', API_ENDPOINT_ENDPOINTS)
+  .constant('API_ENDPOINT_ENDPOINT_GROUPS', API_ENDPOINT_ENDPOINT_GROUPS)
+  .constant('API_ENDPOINT_KUBERNETES', API_ENDPOINT_KUBERNETES)
+  .constant('API_ENDPOINT_MOTD', API_ENDPOINT_MOTD)
+  .constant('API_ENDPOINT_REGISTRIES', API_ENDPOINT_REGISTRIES)
+  .constant('API_ENDPOINT_RESOURCE_CONTROLS', API_ENDPOINT_RESOURCE_CONTROLS)
+  .constant('API_ENDPOINT_SETTINGS', API_ENDPOINT_SETTINGS)
+  .constant('API_ENDPOINT_STACKS', API_ENDPOINT_STACKS)
+  .constant('API_ENDPOINT_SUPPORT', API_ENDPOINT_SUPPORT)
+  .constant('API_ENDPOINT_USERS', API_ENDPOINT_USERS)
+  .constant('API_ENDPOINT_TAGS', API_ENDPOINT_TAGS)
+  .constant('API_ENDPOINT_TEAMS', API_ENDPOINT_TEAMS)
+  .constant('API_ENDPOINT_TEAM_MEMBERSHIPS', API_ENDPOINT_TEAM_MEMBERSHIPS)
+  .constant('API_ENDPOINT_TEMPLATES', API_ENDPOINT_TEMPLATES)
+  .constant('API_ENDPOINT_WEBHOOKS', API_ENDPOINT_WEBHOOKS)
+  .constant('PAGINATION_MAX_ITEMS', PAGINATION_MAX_ITEMS)
+  .constant('APPLICATION_CACHE_VALIDITY', APPLICATION_CACHE_VALIDITY)
+  .constant('CONSOLE_COMMANDS_LABEL_PREFIX', CONSOLE_COMMANDS_LABEL_PREFIX)
+  .constant('PREDEFINED_NETWORKS', PREDEFINED_NETWORKS)
+  .constant('BROWSER_OS_PLATFORM', BROWSER_OS_PLATFORM).name;
diff --git a/app/portainer/__module.js b/app/portainer/__module.js
new file mode 100644
index 0000000..2ac17d1
--- /dev/null
+++ b/app/portainer/__module.js
@@ -0,0 +1,523 @@
+import featureFlagModule from '@/react/portainer/feature-flags';
+
+import './rbac';
+
+import componentsModule from './components';
+import settingsModule from './settings';
+import userActivityModule from './user-activity';
+import servicesModule from './services';
+import { reactModule } from './react';
+import { sidebarModule } from './react/views/sidebar';
+import environmentsModule from './environments';
+import { helpersModule } from './helpers';
+import { AccessHeaders, requiresAuthHook } from './authorization-guard';
+import { filterParam, paginationParams } from './helpers/stateParamHelper';
+
+async function initAuthentication(Authentication) {
+  return await Authentication.init();
+}
+
+angular
+  .module('portainer.app', [
+    'portainer.oauth',
+    'portainer.rbac',
+    'portainer.registrymanagement',
+    componentsModule,
+    settingsModule,
+    featureFlagModule,
+    userActivityModule,
+    servicesModule,
+    reactModule,
+    sidebarModule,
+    environmentsModule,
+    helpersModule,
+  ])
+  .config([
+    '$stateRegistryProvider',
+    function ($stateRegistryProvider) {
+      var root = {
+        name: 'root',
+        abstract: true,
+        onEnter: /* @ngInject */ function onEnter($async, StateManager, Authentication, Notifications, $state) {
+          return $async(async () => {
+            const appState = StateManager.getState();
+            if (!appState.loading) {
+              return;
+            }
+            try {
+              const loggedIn = await initAuthentication(Authentication);
+              await StateManager.initialize();
+              if (!loggedIn && isTransitionRequiresAuthentication($state.transition)) {
+                $state.go('portainer.logout');
+                return Promise.reject('Unauthenticated');
+              }
+            } catch (err) {
+              Notifications.error('Failure', err, 'Unable to retrieve application settings');
+              throw err;
+            }
+          });
+        },
+        views: {
+          'sidebar@': {
+            component: 'sidebar',
+          },
+        },
+        data: {
+          access: AccessHeaders.Restricted,
+        },
+      };
+
+      var endpointRoot = {
+        name: 'endpoint',
+        url: '/:endpointId',
+        parent: 'root',
+        abstract: true,
+        resolve: {
+          endpoint: /* @ngInject */ function endpoint($async, $state, $transition$, EndpointProvider, EndpointService, Notifications) {
+            return $async(async () => {
+              try {
+                const endpointId = +$transition$.params().endpointId;
+
+                const endpoint = await EndpointService.endpoint(endpointId);
+                if ((endpoint.Type === 4 || endpoint.Type === 7) && !endpoint.EdgeID) {
+                  $state.go('portainer.endpoints.endpoint', { id: endpoint.Id });
+                  return;
+                }
+
+                EndpointProvider.setCurrentEndpoint(endpoint);
+
+                return endpoint;
+              } catch (e) {
+                Notifications.error('Failed loading environment', e);
+                $state.go('portainer.home', {}, { reload: true });
+                return;
+              }
+            });
+          },
+        },
+      };
+
+      var portainer = {
+        name: 'portainer',
+        parent: 'root',
+        abstract: true,
+      };
+
+      var account = {
+        name: 'portainer.account',
+        url: '/account',
+        views: {
+          'content@': {
+            templateUrl: './views/account/account.html',
+            controller: 'AccountController',
+          },
+        },
+        data: {
+          docs: '/user/account-settings',
+        },
+      };
+
+      const tokenCreation = {
+        name: 'portainer.account.new-access-token',
+        url: '/tokens/new',
+        views: {
+          'content@': {
+            component: 'createUserAccessToken',
+          },
+        },
+      };
+
+      const createHelmRepository = {
+        name: 'portainer.account.createHelmRepository',
+        url: '/helm-repository/new',
+        views: {
+          'content@': {
+            component: 'createHelmRepositoryView',
+          },
+        },
+      };
+
+      var authentication = {
+        name: 'portainer.auth',
+        url: '/auth',
+        params: {
+          reload: false,
+        },
+        views: {
+          'content@': {
+            templateUrl: './views/auth/auth.html',
+            controller: 'AuthenticationController',
+            controllerAs: 'ctrl',
+          },
+          'sidebar@': {},
+        },
+        data: {
+          access: undefined,
+        },
+      };
+
+      const logout = {
+        name: 'portainer.logout',
+        url: '/logout',
+        params: {
+          error: '',
+        },
+        views: {
+          'content@': {
+            templateUrl: './views/logout/logout.html',
+            controller: 'LogoutController',
+            controllerAs: 'ctrl',
+          },
+          'sidebar@': {},
+        },
+        data: {
+          access: undefined,
+        },
+      };
+
+      var endpoints = {
+        name: 'portainer.endpoints',
+        url: '/endpoints',
+        views: {
+          'content@': {
+            component: 'environmentsListView',
+          },
+        },
+        data: {
+          docs: '/admin/environments/environments',
+        },
+      };
+
+      var endpoint = {
+        name: 'portainer.endpoints.endpoint',
+        url: '/:id?redirectTo',
+        params: {
+          redirectTo: '',
+        },
+        views: {
+          'content@': {
+            component: 'environmentsItemView',
+          },
+        },
+      };
+
+      const edgeAutoCreateScript = {
+        name: 'portainer.endpoints.edgeAutoCreateScript',
+        url: '/aeec',
+        views: {
+          'content@': {
+            component: 'edgeAutoCreateScriptView',
+          },
+        },
+        data: {
+          docs: '/admin/environments/aeec',
+        },
+      };
+
+      var endpointAccess = {
+        name: 'portainer.endpoints.endpoint.access',
+        url: '/access',
+        views: {
+          'content@': {
+            templateUrl: './views/endpoints/access/endpointAccess.html',
+            controller: 'EndpointAccessController',
+            controllerAs: 'ctrl',
+          },
+        },
+      };
+
+      var groups = {
+        name: 'portainer.groups',
+        url: '/groups',
+        views: {
+          'content@': {
+            component: 'environmentGroupsListView',
+          },
+        },
+        data: {
+          docs: '/admin/environments/groups',
+          access: AccessHeaders.Admin,
+        },
+      };
+
+      var group = {
+        name: 'portainer.groups.group',
+        url: '/:id',
+        views: {
+          'content@': {
+            component: 'environmentGroupEditView',
+          },
+        },
+        params: {
+          id: {
+            type: 'int',
+          },
+          tab: {
+            dynamic: true,
+          },
+        },
+      };
+
+      var groupCreation = {
+        name: 'portainer.groups.new',
+        url: '/new',
+        views: {
+          'content@': {
+            component: 'environmentGroupCreateView',
+          },
+        },
+      };
+
+      var home = {
+        name: 'portainer.home',
+        url: '/home?redirect&environmentId&environmentName&route&groupBy&groupFilter&search&order',
+        params: {
+          ...paginationParams(),
+          sort: filterParam(),
+          order: filterParam(),
+          groupBy: filterParam(),
+          groupFilter: filterParam(),
+        },
+        views: {
+          'content@': {
+            component: 'homeView',
+          },
+        },
+        data: {
+          docs: '/user/home',
+        },
+      };
+
+      var gitopsBase = {
+        name: 'portainer.gitops',
+        url: '/gitops',
+        abstract: true,
+      };
+
+      var workflows = {
+        name: 'portainer.gitops.workflows',
+        url: '/workflows?search&sort&order&page&pageSize&status&type&platform&groupBy&groupFilter',
+        data: { docs: '/user/app-delivery/workflows' },
+        params: {
+          ...paginationParams(),
+          sort: filterParam(),
+          order: filterParam(),
+          status: filterParam(),
+          type: filterParam(),
+          platform: filterParam(),
+          groupBy: filterParam(),
+          groupFilter: filterParam(),
+        },
+        views: {
+          'content@': {
+            component: 'workflowsView',
+          },
+        },
+      };
+
+      var gitopsWorkflowDetail = {
+        name: 'portainer.gitops.workflows.item',
+        url: '/:workflowId?tab',
+        params: {
+          tab: filterParam('overview'),
+        },
+        views: {
+          'content@': {
+            component: 'workflowItemView',
+          },
+        },
+      };
+
+      var gitopsSources = {
+        name: 'portainer.gitops.sources',
+        url: '/sources?search&sort&order&page&pageSize&status&type',
+        data: { docs: '/user/app-delivery/sources' },
+        params: {
+          ...paginationParams(),
+          sort: filterParam(),
+          order: filterParam(),
+          status: filterParam(),
+          type: filterParam(),
+        },
+        views: {
+          'content@': {
+            component: 'sourcesListView',
+          },
+        },
+      };
+
+      var gitopsSourceDetail = {
+        name: 'portainer.gitops.sources.item',
+        url: '/:sourceId?tab',
+        params: {
+          tab: filterParam('settings'),
+        },
+        views: {
+          'content@': {
+            component: 'sourceItemView',
+          },
+        },
+      };
+
+      const gitopsSourceCreate = {
+        name: 'portainer.gitops.sources.new',
+        url: '/new',
+        views: {
+          'content@': {
+            component: 'sourceCreateView',
+          },
+        },
+      };
+
+      var init = {
+        name: 'portainer.init',
+        abstract: true,
+        url: '/init',
+        views: {
+          'sidebar@': {},
+        },
+        data: {
+          access: undefined,
+        },
+      };
+
+      var initAdmin = {
+        name: 'portainer.init.admin',
+        url: '/admin',
+        views: {
+          'content@': {
+            templateUrl: './views/init/admin/initAdmin.html',
+            controller: 'InitAdminController',
+          },
+        },
+      };
+
+      var settings = {
+        name: 'portainer.settings',
+        url: '/settings',
+        views: {
+          'content@': {
+            component: 'settingsView',
+          },
+        },
+        data: {
+          docs: '/admin/settings',
+          access: AccessHeaders.Admin,
+        },
+      };
+
+      var settingsAuthentication = {
+        name: 'portainer.settings.authentication',
+        url: '/auth',
+        views: {
+          'content@': {
+            templateUrl: './views/settings/authentication/settingsAuthentication.html',
+            controller: 'SettingsAuthenticationController',
+          },
+        },
+        data: {
+          docs: '/admin/settings/authentication',
+        },
+      };
+
+      var settingsEdgeCompute = {
+        name: 'portainer.settings.edgeCompute',
+        url: '/edge',
+        views: {
+          'content@': {
+            component: 'settingsEdgeComputeView',
+          },
+        },
+        data: {
+          docs: '/admin/settings/edge',
+        },
+      };
+
+      var tags = {
+        name: 'portainer.tags',
+        url: '/tags',
+        views: {
+          'content@': {
+            templateUrl: './views/tags/tags.html',
+            controller: 'TagsController',
+          },
+        },
+        data: {
+          docs: '/admin/environments/tags',
+          access: AccessHeaders.Admin,
+        },
+      };
+
+      var users = {
+        name: 'portainer.users',
+        url: '/users',
+        views: {
+          'content@': {
+            component: 'usersListView',
+          },
+        },
+        data: {
+          docs: '/admin/user/users',
+          access: AccessHeaders.Restricted, // allow for team leaders
+        },
+      };
+
+      var user = {
+        name: 'portainer.users.user',
+        url: '/:id',
+        views: {
+          'content@': {
+            templateUrl: './views/users/edit/user.html',
+            controller: 'UserController',
+          },
+        },
+      };
+
+      $stateRegistryProvider.register(root);
+      $stateRegistryProvider.register(endpointRoot);
+      $stateRegistryProvider.register(portainer);
+      $stateRegistryProvider.register(account);
+      $stateRegistryProvider.register(tokenCreation);
+      $stateRegistryProvider.register(authentication);
+      $stateRegistryProvider.register(logout);
+      $stateRegistryProvider.register(endpoints);
+      $stateRegistryProvider.register(endpoint);
+      $stateRegistryProvider.register(endpointAccess);
+      $stateRegistryProvider.register(edgeAutoCreateScript);
+      $stateRegistryProvider.register(groups);
+      $stateRegistryProvider.register(group);
+      $stateRegistryProvider.register(groupCreation);
+      $stateRegistryProvider.register(home);
+      $stateRegistryProvider.register(gitopsBase);
+      $stateRegistryProvider.register(workflows);
+      $stateRegistryProvider.register(gitopsWorkflowDetail);
+      $stateRegistryProvider.register(gitopsSources);
+      $stateRegistryProvider.register(gitopsSourceDetail);
+      $stateRegistryProvider.register(gitopsSourceCreate);
+      $stateRegistryProvider.register(init);
+      $stateRegistryProvider.register(initAdmin);
+      $stateRegistryProvider.register(settings);
+      $stateRegistryProvider.register(settingsAuthentication);
+      $stateRegistryProvider.register(settingsEdgeCompute);
+      $stateRegistryProvider.register(tags);
+      $stateRegistryProvider.register(users);
+      $stateRegistryProvider.register(user);
+      $stateRegistryProvider.register(createHelmRepository);
+    },
+  ])
+  .run(run);
+
+function isTransitionRequiresAuthentication(transition) {
+  const UNAUTHENTICATED_ROUTES = ['portainer.logout', 'portainer.auth'];
+  if (!transition) {
+    return true;
+  }
+  const nextTransition = transition && transition.to();
+  const nextTransitionName = nextTransition ? nextTransition.name : '';
+  return !UNAUTHENTICATED_ROUTES.some((route) => nextTransitionName.startsWith(route));
+}
+
+/* @ngInject */
+function run($transitions) {
+  requiresAuthHook($transitions);
+}
diff --git a/app/portainer/authorization-guard.test.ts b/app/portainer/authorization-guard.test.ts
new file mode 100644
index 0000000..a89199c
--- /dev/null
+++ b/app/portainer/authorization-guard.test.ts
@@ -0,0 +1,139 @@
+import {
+  StateDeclaration,
+  StateService,
+  Transition,
+} from '@uirouter/angularjs';
+
+import { get, keyBuilder } from '@/react/hooks/useLocalStorage';
+
+import { checkAuthorizations } from './authorization-guard';
+import { IAuthenticationService } from './services/types';
+
+describe('checkAuthorizations', () => {
+  let authService = {
+    init: vi.fn(),
+    isPureAdmin: vi.fn(),
+    isAdmin: vi.fn(),
+    hasAuthorizations: vi.fn(),
+    getUserDetails: vi.fn(),
+    isAuthenticated: vi.fn(),
+  } satisfies IAuthenticationService;
+  let transition: Transition;
+  const stateTo: StateDeclaration = {
+    data: {
+      access: 'restricted',
+    },
+  };
+  const $state = {
+    target: vi.fn((t) => t),
+  } as unknown as StateService;
+
+  beforeEach(() => {
+    authService = {
+      init: vi.fn(),
+      isPureAdmin: vi.fn(),
+      isAdmin: vi.fn(),
+      hasAuthorizations: vi.fn(),
+      getUserDetails: vi.fn(),
+      isAuthenticated: vi.fn(),
+    };
+
+    transition = {
+      injector: vi.fn().mockReturnValue({
+        get: vi.fn().mockReturnValue(authService),
+      }),
+      to: vi.fn().mockReturnValue(stateTo),
+      router: {
+        stateService: $state,
+      } as Transition['router'],
+    } as unknown as Transition;
+
+    stateTo.data.access = 'restricted';
+    localStorage.removeItem(keyBuilder('RETURN_URL'));
+  });
+
+  afterEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('should return undefined if access is not defined', async () => {
+    stateTo.data.access = undefined;
+    const result = await checkAuthorizations(transition);
+
+    expect(result).toBeUndefined();
+  });
+
+  it('should return undefined if user is not authenticated and route access is defined', async () => {
+    stateTo.data.access = 'something';
+    authService.init.mockResolvedValue(false);
+
+    const result = await checkAuthorizations(transition);
+    expect(result).toBeUndefined();
+  });
+
+  it('should return logout if access is "restricted"', async () => {
+    const result = await checkAuthorizations(transition);
+
+    expect(result).toBeDefined();
+    expect($state.target).toHaveBeenCalledWith('portainer.logout');
+  });
+
+  it('should store the current URL in localStorage when the user is not authenticated', async () => {
+    authService.init.mockResolvedValue(false);
+
+    await checkAuthorizations(transition);
+
+    expect(get('RETURN_URL', null)).toBe(
+      window.location.pathname + window.location.search + window.location.hash
+    );
+  });
+
+  it('should not store a returnUrl when the user is authenticated', async () => {
+    authService.init.mockResolvedValue(true);
+
+    await checkAuthorizations(transition);
+
+    expect(get('RETURN_URL', null)).toBeNull();
+  });
+
+  it('should return undefined if user is an admin and access is "admin"', async () => {
+    authService.init.mockResolvedValue(true);
+    authService.isPureAdmin.mockReturnValue(true);
+    stateTo.data.access = 'admin';
+
+    const result = await checkAuthorizations(transition);
+
+    expect(result).toBeUndefined();
+  });
+
+  it('should return undefined if user is an admin and access is "edge-admin"', async () => {
+    authService.init.mockResolvedValue(true);
+    authService.isAdmin.mockReturnValue(true);
+    stateTo.data.access = 'edge-admin';
+
+    const result = await checkAuthorizations(transition);
+
+    expect(result).toBeUndefined();
+  });
+
+  it('should return undefined if user has the required authorizations', async () => {
+    authService.init.mockResolvedValue(true);
+    authService.hasAuthorizations.mockReturnValue(true);
+    stateTo.data.access = ['permission1', 'permission2'];
+
+    const result = await checkAuthorizations(transition);
+
+    expect(result).toBeUndefined();
+  });
+
+  it('should redirect to home if user does not have the required authorizations', async () => {
+    authService.init.mockResolvedValue(true);
+    authService.hasAuthorizations.mockReturnValue(false);
+    stateTo.data.access = ['permission1', 'permission2'];
+
+    const result = await checkAuthorizations(transition);
+
+    expect(result).toBeDefined();
+    expect($state.target).toHaveBeenCalledWith('portainer.home');
+  });
+});
diff --git a/app/portainer/authorization-guard.ts b/app/portainer/authorization-guard.ts
new file mode 100644
index 0000000..c942195
--- /dev/null
+++ b/app/portainer/authorization-guard.ts
@@ -0,0 +1,104 @@
+import { Transition, TransitionService } from '@uirouter/angularjs';
+
+import { storeReturnUrl } from '@/react/portainer/helpers/returnUrl';
+
+import { IAuthenticationService } from './services/types';
+
+export enum AccessHeaders {
+  Restricted = 'restricted',
+  Admin = 'admin',
+  EdgeAdmin = 'edge-admin',
+}
+
+type Authorizations = string[];
+type Access =
+  | AccessHeaders.Restricted
+  | AccessHeaders.Admin
+  | AccessHeaders.EdgeAdmin
+  | Authorizations;
+
+export function requiresAuthHook(transitionService: TransitionService) {
+  transitionService.onBefore({}, checkAuthorizations);
+}
+
+// exported for tests
+export async function checkAuthorizations(transition: Transition) {
+  const authService: IAuthenticationService = transition
+    .injector()
+    .get('Authentication');
+  const stateTo = transition.to();
+  const $state = transition.router.stateService;
+
+  const { access } = stateTo.data || {};
+  if (!isAccess(access)) {
+    return undefined;
+  }
+
+  const isLoggedIn = await authService.init();
+
+  if (!isLoggedIn) {
+    // eslint-disable-next-line no-console
+    console.info(
+      'User is not authenticated, redirecting to login, access:',
+      access
+    );
+    const currentUrl =
+      window.location.pathname + window.location.search + window.location.hash;
+    storeReturnUrl(currentUrl);
+    return $state.target('portainer.logout');
+  }
+
+  if (typeof access === 'string') {
+    if (access === 'restricted') {
+      return undefined;
+    }
+
+    if (access === 'admin') {
+      if (authService.isPureAdmin()) {
+        return undefined;
+      }
+
+      // eslint-disable-next-line no-console
+      console.info(
+        'User is not an admin, redirecting to home, access:',
+        access
+      );
+      return $state.target('portainer.home');
+    }
+
+    if (access === 'edge-admin') {
+      if (authService.isAdmin(true)) {
+        return undefined;
+      }
+
+      // eslint-disable-next-line no-console
+      console.info(
+        'User is not an edge admin, redirecting to home, access:',
+        access
+      );
+      return $state.target('portainer.home');
+    }
+  }
+
+  if (access.length > 0 && !authService.hasAuthorizations(access)) {
+    // eslint-disable-next-line no-console
+    console.info(
+      'User does not have the required authorizations, redirecting to home'
+    );
+    return $state.target('portainer.home');
+  }
+
+  return undefined;
+}
+
+function isAccess(access: unknown): access is Access {
+  if (!access || (typeof access !== 'string' && !Array.isArray(access))) {
+    return false;
+  }
+
+  if (Array.isArray(access)) {
+    return access.every((a) => typeof a === 'string');
+  }
+
+  return ['restricted', 'admin', 'edge-admin'].includes(access);
+}
diff --git a/app/portainer/components/BEFeatureIndicator/BEFeatureIndicator.controller.ts b/app/portainer/components/BEFeatureIndicator/BEFeatureIndicator.controller.ts
new file mode 100644
index 0000000..79f9b50
--- /dev/null
+++ b/app/portainer/components/BEFeatureIndicator/BEFeatureIndicator.controller.ts
@@ -0,0 +1,24 @@
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+
+import { getFeatureDetails } from '@@/BEFeatureIndicator/utils';
+
+export default class BeIndicatorController {
+  limitedToBE?: boolean;
+
+  url?: string;
+
+  feature?: FeatureId;
+
+  /* @ngInject */
+  constructor() {
+    this.limitedToBE = false;
+    this.url = '';
+  }
+
+  $onInit() {
+    const { url, limitedToBE } = getFeatureDetails(this.feature);
+
+    this.limitedToBE = limitedToBE;
+    this.url = url;
+  }
+}
diff --git a/app/portainer/components/BEFeatureIndicator/BEFeatureIndicator.html b/app/portainer/components/BEFeatureIndicator/BEFeatureIndicator.html
new file mode 100644
index 0000000..64a23c1
--- /dev/null
+++ b/app/portainer/components/BEFeatureIndicator/BEFeatureIndicator.html
@@ -0,0 +1,5 @@
+<a class="vertical-center be-indicator ml-5" href="{{ $ctrl.url }}" target="_blank" rel="noopener" ng-if="$ctrl.limitedToBE">
+  <ng-transclude></ng-transclude>
+  <pr-icon icon="'briefcase'" class-name="'space-right be-indicator-icon'"></pr-icon>
+  <span class="be-indicator-label">Business Feature</span>
+</a>
diff --git a/app/portainer/components/BEFeatureIndicator/index.ts b/app/portainer/components/BEFeatureIndicator/index.ts
new file mode 100644
index 0000000..4d253c1
--- /dev/null
+++ b/app/portainer/components/BEFeatureIndicator/index.ts
@@ -0,0 +1,10 @@
+import controller from './BEFeatureIndicator.controller';
+
+export const beFeatureIndicator = {
+  templateUrl: './BEFeatureIndicator.html',
+  controller,
+  bindings: {
+    feature: '<',
+  },
+  transclude: true,
+};
diff --git a/app/portainer/components/BoxSelector/BoxSelectorAngular.ts b/app/portainer/components/BoxSelector/BoxSelectorAngular.ts
new file mode 100644
index 0000000..71279d6
--- /dev/null
+++ b/app/portainer/components/BoxSelector/BoxSelectorAngular.ts
@@ -0,0 +1,53 @@
+import {
+  IComponentOptions,
+  IComponentController,
+  IFormController,
+  IScope,
+} from 'angular';
+
+class BoxSelectorController implements IComponentController {
+  formCtrl!: IFormController;
+
+  onChange!: (value: string | number) => void;
+
+  radioName!: string;
+
+  $scope: IScope;
+
+  /* @ngInject */
+  constructor($scope: IScope) {
+    this.handleChange = this.handleChange.bind(this);
+
+    this.$scope = $scope;
+  }
+
+  handleChange(value: string | number, limitedToBE: boolean) {
+    this.$scope.$evalAsync(() => {
+      this.formCtrl.$setValidity(this.radioName, !limitedToBE, this.formCtrl);
+      this.onChange(value);
+    });
+  }
+}
+
+export const BoxSelectorAngular: IComponentOptions = {
+  template: `<box-selector-react
+    value="$ctrl.value"
+    on-change="$ctrl.handleChange"
+    options="$ctrl.options"
+    radio-name="$ctrl.radioName"
+    slim="$ctrl.slim"
+    label="$ctrl.label"
+  ></box-selector-react>`,
+  bindings: {
+    value: '<',
+    onChange: '<',
+    options: '<',
+    radioName: '<',
+    slim: '<',
+    label: '<',
+  },
+  require: {
+    formCtrl: '^form',
+  },
+  controller: BoxSelectorController,
+};
diff --git a/app/portainer/components/BoxSelector/index.ts b/app/portainer/components/BoxSelector/index.ts
new file mode 100644
index 0000000..764f177
--- /dev/null
+++ b/app/portainer/components/BoxSelector/index.ts
@@ -0,0 +1,27 @@
+import angular from 'angular';
+
+import { react2angular } from '@/react-tools/react2angular';
+
+import { BoxSelector } from '@@/BoxSelector';
+
+import { BoxSelectorAngular } from './BoxSelectorAngular';
+
+export { buildOption } from './utils';
+const BoxSelectorReact = react2angular(BoxSelector, [
+  'isMulti',
+  'value',
+  'onChange',
+  'options',
+  'radioName',
+  'slim',
+  'hiddenSpacingCount',
+  'error',
+  'useGridLayout',
+  'className',
+  'label',
+]);
+
+export const boxSelectorModule = angular
+  .module('app.portainer.component.box-selector', [])
+  .component('boxSelectorReact', BoxSelectorReact)
+  .component('boxSelector', BoxSelectorAngular).name;
diff --git a/app/portainer/components/BoxSelector/utils.ts b/app/portainer/components/BoxSelector/utils.ts
new file mode 100644
index 0000000..8a6afc4
--- /dev/null
+++ b/app/portainer/components/BoxSelector/utils.ts
@@ -0,0 +1,15 @@
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+
+import { BoxSelectorOption } from '@@/BoxSelector/types';
+import { IconProps } from '@@/Icon';
+
+export function buildOption<T extends number | string>(
+  id: BoxSelectorOption<T>['id'],
+  icon: IconProps['icon'],
+  label: BoxSelectorOption<T>['label'],
+  description: BoxSelectorOption<T>['description'],
+  value: BoxSelectorOption<T>['value'],
+  feature?: FeatureId
+): BoxSelectorOption<T> {
+  return { id, icon, label, description, value, feature };
+}
diff --git a/app/portainer/components/InformationPanel/InformationPanelAngular.html b/app/portainer/components/InformationPanel/InformationPanelAngular.html
new file mode 100644
index 0000000..ad7e53d
--- /dev/null
+++ b/app/portainer/components/InformationPanel/InformationPanelAngular.html
@@ -0,0 +1,22 @@
+<div class="row">
+  <div class="col-sm-12">
+    <rd-widget>
+      <rd-widget-body>
+        <div class="col-sm-12 form-section-title">
+          <span style="float: left">
+            {{ $ctrl.titleText }}
+          </span>
+          <span class="small" style="float: right" ng-if="$ctrl.dismissAction">
+            <a ng-click="$ctrl.dismissAction()">
+              <pr-icon icon="'x'"></pr-icon>
+              dismiss</a
+            >
+          </span>
+        </div>
+        <div class="form-group">
+          <ng-transclude></ng-transclude>
+        </div>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
diff --git a/app/portainer/components/InformationPanel/InformationPanelAngular.js b/app/portainer/components/InformationPanel/InformationPanelAngular.js
new file mode 100644
index 0000000..acbf9e7
--- /dev/null
+++ b/app/portainer/components/InformationPanel/InformationPanelAngular.js
@@ -0,0 +1,8 @@
+export const InformationPanelAngular = {
+  templateUrl: './InformationPanelAngular.html',
+  bindings: {
+    titleText: '@',
+    dismissAction: '&?',
+  },
+  transclude: true,
+};
diff --git a/app/portainer/components/InformationPanel/index.ts b/app/portainer/components/InformationPanel/index.ts
new file mode 100644
index 0000000..68b1a80
--- /dev/null
+++ b/app/portainer/components/InformationPanel/index.ts
@@ -0,0 +1 @@
+export { InformationPanelAngular } from './InformationPanelAngular';
diff --git a/app/portainer/components/accessControlForm/por-access-control-form.js b/app/portainer/components/accessControlForm/por-access-control-form.js
new file mode 100644
index 0000000..d757220
--- /dev/null
+++ b/app/portainer/components/accessControlForm/por-access-control-form.js
@@ -0,0 +1,13 @@
+angular.module('portainer.app').component('porAccessControlForm', {
+  templateUrl: './porAccessControlForm.html',
+  controller: 'porAccessControlFormController',
+  bindings: {
+    // This object will be populated with the form data.
+    // Model reference in porAccessControlFromModel.js
+    formData: '=',
+    // Optional. An existing resource control object that will be used to set
+    // the default values of the component.
+    resourceControl: '<',
+    hideTitle: '<',
+  },
+});
diff --git a/app/portainer/components/accessControlForm/porAccessControlForm.html b/app/portainer/components/accessControlForm/porAccessControlForm.html
new file mode 100644
index 0000000..d20223d
--- /dev/null
+++ b/app/portainer/components/accessControlForm/porAccessControlForm.html
@@ -0,0 +1,89 @@
+<div>
+  <div ng-if="!$ctrl.hideTitle" class="col-sm-12 form-section-title"> Access control </div>
+  <!-- access-control-switch -->
+  <div class="form-group">
+    <div class="col-sm-12">
+      <por-switch-field
+        label-class="'col-sm-2'"
+        checked="$ctrl.formData.AccessControlEnabled"
+        label="'Enable access control'"
+        tooltip="'When enabled, you can restrict the access and management of this resource.'"
+        on-change="($ctrl.onChangeEnablement)"
+        data-cy="portainer-accessMgmtToggle"
+      ></por-switch-field>
+    </div>
+  </div>
+  <!-- !access-control-switch -->
+  <!-- restricted-access -->
+
+  <access-type-selector
+    ng-if="$ctrl.formData.AccessControlEnabled"
+    value="$ctrl.formData.Ownership"
+    on-change="($ctrl.onChangeOwnership)"
+    is-admin="$ctrl.isAdmin"
+    name="Ownership"
+    teams="$ctrl.availableTeams"
+  ></access-type-selector>
+
+  <!-- restricted-access -->
+  <!-- authorized-teams -->
+  <div
+    class="form-group mt-4"
+    ng-if="$ctrl.formData.AccessControlEnabled && $ctrl.formData.Ownership === $ctrl.RCO.RESTRICTED && ($ctrl.isAdmin || (!$ctrl.isAdmin && $ctrl.availableTeams.length > 1))"
+  >
+    <div class="vertical-center w-full">
+      <label for="teams-selector" class="control-label col-sm-3 col-lg-2 !pt-0 text-left">
+        Authorized teams
+        <portainer-tooltip
+          ng-if="$ctrl.isAdmin && $ctrl.availableTeams.length > 0"
+          message="'You can select which teams(s) will be able to manage this resource.'"
+        ></portainer-tooltip>
+        <portainer-tooltip
+          ng-if="!$ctrl.isAdmin && $ctrl.availableTeams.length > 1"
+          message="'As you are a member of multiple teams, you can select which teams(s) will be able to manage this resource.'"
+        ></portainer-tooltip>
+      </label>
+      <div class="col-sm-9 col-lg-10">
+        <span ng-if="$ctrl.isAdmin && $ctrl.availableTeams.length === 0" class="small text-muted">
+          You have not yet created any teams. Head over to the <a ui-sref="portainer.teams">Teams view</a> to manage teams.
+        </span>
+
+        <por-access-control-form-team-selector
+          ng-if="($ctrl.isAdmin && $ctrl.availableTeams.length > 0) || (!$ctrl.isAdmin && $ctrl.availableTeams.length > 1)"
+          options="$ctrl.availableTeams"
+          value="$ctrl.formData.AuthorizedTeams"
+          input-id="'teams-selector'"
+          on-change="($ctrl.onAuthorizedTeamsChange)"
+        ></por-access-control-form-team-selector>
+      </div>
+    </div>
+  </div>
+
+  <!-- !authorized-teams -->
+  <!-- authorized-users -->
+  <div class="form-group" ng-if="$ctrl.formData.AccessControlEnabled && $ctrl.formData.Ownership === $ctrl.RCO.RESTRICTED && $ctrl.isAdmin">
+    <div class="vertical-center w-full">
+      <label for="users-selector" class="control-label col-sm-3 col-lg-2 !pt-0 text-left">
+        Authorized users
+        <portainer-tooltip
+          ng-if="$ctrl.isAdmin && $ctrl.availableUsers.length > 0"
+          message="'You can select which user(s) will be able to manage this resource.'"
+        ></portainer-tooltip>
+      </label>
+      <div class="col-sm-9 col-lg-10">
+        <span ng-if="$ctrl.availableUsers.length === 0" class="small text-muted">
+          You have not yet created any users. Head over to the <a ui-sref="portainer.users">Users view</a> to manage users.
+        </span>
+
+        <por-access-control-form-user-selector
+          ng-if="$ctrl.availableUsers.length > 0"
+          options="$ctrl.availableUsers"
+          value="$ctrl.formData.AuthorizedUsers"
+          input-id="'users-selector'"
+          on-change="($ctrl.onAuthorizedUsersChange)"
+        ></por-access-control-form-user-selector>
+      </div>
+    </div>
+  </div>
+  <!-- !authorized-users -->
+</div>
diff --git a/app/portainer/components/accessControlForm/porAccessControlFormController.js b/app/portainer/components/accessControlForm/porAccessControlFormController.js
new file mode 100644
index 0000000..d8d247e
--- /dev/null
+++ b/app/portainer/components/accessControlForm/porAccessControlFormController.js
@@ -0,0 +1,105 @@
+import _ from 'lodash-es';
+import { ResourceControlOwnership as RCO } from '@/react/portainer/access-control/types';
+
+angular.module('portainer.app').controller('porAccessControlFormController', [
+  '$q',
+  '$scope',
+  '$state',
+  'UserService',
+  'TeamService',
+  'Notifications',
+  'Authentication',
+  'ResourceControlService',
+  function ($q, $scope, $state, UserService, TeamService, Notifications, Authentication, ResourceControlService) {
+    var ctrl = this;
+
+    ctrl.RCO = RCO;
+
+    this.onAuthorizedTeamsChange = onAuthorizedTeamsChange.bind(this);
+    this.onAuthorizedUsersChange = onAuthorizedUsersChange.bind(this);
+
+    ctrl.availableTeams = [];
+    ctrl.availableUsers = [];
+
+    ctrl.onChangeEnablement = onChangeEnablement;
+    ctrl.onChangeOwnership = onChangeOwnership;
+
+    function onChangeOwnership(ownership) {
+      onChange({ Ownership: ownership });
+    }
+
+    function setOwnership(resourceControl, isAdmin) {
+      if (isAdmin && resourceControl.Ownership === RCO.PRIVATE) {
+        ctrl.formData.Ownership = RCO.RESTRICTED;
+      } else {
+        ctrl.formData.Ownership = resourceControl.Ownership;
+      }
+
+      if (ctrl.formData.Ownership === RCO.PUBLIC) {
+        ctrl.formData.AccessControlEnabled = false;
+      }
+    }
+
+    function setAuthorizedUsersAndTeams(authorizedUsers, authorizedTeams) {
+      ctrl.formData.AuthorizedTeams = authorizedTeams;
+      ctrl.formData.AuthorizedUsers = authorizedUsers;
+    }
+
+    function onAuthorizedTeamsChange(AuthorizedTeams) {
+      onChange({ AuthorizedTeams });
+    }
+
+    function onAuthorizedUsersChange(AuthorizedUsers) {
+      onChange({ AuthorizedUsers });
+    }
+
+    function onChange(formData) {
+      $scope.$evalAsync(() => {
+        ctrl.formData = {
+          ...ctrl.formData,
+          ...formData,
+        };
+      });
+    }
+
+    this.$onInit = $onInit;
+    function $onInit() {
+      var isAdmin = Authentication.isPureAdmin();
+      ctrl.isAdmin = isAdmin;
+
+      if (isAdmin) {
+        ctrl.formData.Ownership = ctrl.RCO.ADMINISTRATORS;
+      }
+
+      const environmentId = $state.params.endpointId;
+      $q.all({
+        availableTeams: TeamService.teams(environmentId),
+        availableUsers: isAdmin ? UserService.users(false, environmentId) : [],
+      })
+        .then(function success(data) {
+          ctrl.availableUsers = _.orderBy(data.availableUsers, 'Username', 'asc');
+          ctrl.availableTeams = _.orderBy(data.availableTeams, 'Name', 'asc');
+          if (!isAdmin && ctrl.availableTeams.length === 1) {
+            ctrl.formData.AuthorizedTeams = ctrl.availableTeams;
+          }
+          return $q.when(ctrl.resourceControl && ResourceControlService.retrieveOwnershipDetails(ctrl.resourceControl));
+        })
+        .then(function success(data) {
+          if (data) {
+            const authorizedTeams = !isAdmin && ctrl.availableTeams.length === 1 ? ctrl.availableTeams : data.authorizedTeams;
+            const authorizedUsers = !isAdmin && authorizedTeams.length === 1 ? [] : data.authorizedUsers;
+            setOwnership(ctrl.resourceControl, isAdmin);
+            setAuthorizedUsersAndTeams(authorizedUsers, authorizedTeams);
+          }
+        })
+        .catch(function error(err) {
+          Notifications.error('Failure', err, 'Unable to retrieve access control information');
+        });
+    }
+
+    function onChangeEnablement(enable) {
+      const isAdmin = Authentication.isAdmin();
+      onChange({ AccessControlEnabled: enable, Ownership: isAdmin ? RCO.ADMINISTRATORS : RCO.PRIVATE });
+    }
+  },
+]);
diff --git a/app/portainer/components/accessControlForm/porAccessControlFormModel.js b/app/portainer/components/accessControlForm/porAccessControlFormModel.js
new file mode 100644
index 0000000..e4c77d9
--- /dev/null
+++ b/app/portainer/components/accessControlForm/porAccessControlFormModel.js
@@ -0,0 +1,11 @@
+import { ResourceControlOwnership as RCO } from '@/react/portainer/access-control/types';
+
+/**
+ * @deprecated use only for angularjs components. For react components use ./model.ts
+ */
+export function AccessControlFormData() {
+  this.AccessControlEnabled = true;
+  this.Ownership = RCO.PRIVATE;
+  this.AuthorizedUsers = [];
+  this.AuthorizedTeams = [];
+}
diff --git a/app/portainer/components/accessManagement/index.js b/app/portainer/components/accessManagement/index.js
new file mode 100644
index 0000000..35afc02
--- /dev/null
+++ b/app/portainer/components/accessManagement/index.js
@@ -0,0 +1,5 @@
+import angular from 'angular';
+
+import { porAccessManagement } from './por-access-management';
+
+export default angular.module('portainer.app.component.access-management', []).component('porAccessManagement', porAccessManagement).name;
diff --git a/app/portainer/components/accessManagement/por-access-management.js b/app/portainer/components/accessManagement/por-access-management.js
new file mode 100644
index 0000000..0ab8670
--- /dev/null
+++ b/app/portainer/components/accessManagement/por-access-management.js
@@ -0,0 +1,14 @@
+export const porAccessManagement = {
+  templateUrl: './porAccessManagement.html',
+  controller: 'porAccessManagementController',
+  controllerAs: 'ctrl',
+  bindings: {
+    accessControlledEntity: '<',
+    inheritFrom: '<',
+    entityType: '@',
+    updateAccess: '<',
+    actionInProgress: '<',
+    filterUsers: '<',
+    limitedFeature: '<',
+  },
+};
diff --git a/app/portainer/components/accessManagement/porAccessManagement.html b/app/portainer/components/accessManagement/porAccessManagement.html
new file mode 100644
index 0000000..9a93a82
--- /dev/null
+++ b/app/portainer/components/accessManagement/porAccessManagement.html
@@ -0,0 +1,78 @@
+<div class="row">
+  <div class="col-sm-12">
+    <rd-widget ng-if="ctrl.availableUsersAndTeams && ctrl.accessControlledEntity">
+      <rd-widget-header icon="user-check" title-text="Create access"></rd-widget-header>
+      <rd-widget-body>
+        <form class="form-horizontal">
+          <div ng-if="ctrl.entityType !== 'registry'" class="form-group">
+            <span class="col-sm-12 small text-warning">
+              <p class="vertical-center">
+                <pr-icon icon="'alert-circle'" mode="'warning'"></pr-icon>
+                Adding user access will require the affected user(s) to logout and login for the changes to be taken into account.
+              </p>
+            </span>
+          </div>
+
+          <por-access-management-users-selector
+            options="ctrl.availableUsersAndTeams"
+            value="ctrl.formValues.multiselectOutput"
+            on-change="(ctrl.onChangeUsersAndTeams)"
+          ></por-access-management-users-selector>
+
+          <div class="form-group" ng-if="ctrl.entityType !== 'registry'">
+            <label class="col-sm-3 col-lg-2 control-label text-left"> Role </label>
+            <div class="col-sm-9 col-lg-6">
+              <div class="flex items-center">
+                <div>
+                  <select
+                    class="form-control"
+                    data-cy="access-management-role-select"
+                    ng-model="ctrl.formValues.selectedRole"
+                    ng-options="role as ctrl.roleLabel(role) disable when ctrl.isRoleLimitedToBE(role) for role in ctrl.roles"
+                  >
+                  </select>
+                </div>
+                <be-feature-indicator feature="ctrl.limitedFeature" class="space-left"></be-feature-indicator>
+              </div>
+            </div>
+          </div>
+
+          <!-- actions -->
+          <div class="form-group">
+            <div class="col-sm-12">
+              <button
+                type="submit"
+                class="btn btn-primary btn-sm vertical-center"
+                ng-disabled="ctrl.availableUsersAndTeams.length === 0 || ctrl.formValues.multiselectOutput.length === 0 || ctrl.actionInProgress"
+                ng-click="ctrl.authorizeAccess()"
+                button-spinner="ctrl.actionInProgress"
+                data-cy="access-createAccess"
+              >
+                <span ng-hide="ctrl.state.actionInProgress" class="vertical-center">
+                  <pr-icon icon="'plus'"></pr-icon>
+                  Create access
+                </span>
+                <span ng-show="ctrl.state.actionInProgress">Creating access...</span>
+              </button>
+            </div>
+          </div>
+          <!-- !actions -->
+        </form>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
+
+<access-datatable
+  ng-if="ctrl.authorizedUsersAndTeams"
+  table-key="'access_' + ctrl.entityType"
+  show-warning="ctrl.entityType !== 'registry'"
+  is-update-enabled="ctrl.entityType !== 'registry'"
+  show-roles="ctrl.entityType !== 'registry'"
+  roles="ctrl.roles"
+  inherit-from="ctrl.inheritFrom"
+  dataset="ctrl.authorizedUsersAndTeams"
+  on-update="(ctrl.updateAction)"
+  on-remove="(ctrl.unauthorizeAccess)"
+>
+</access-datatable>
diff --git a/app/portainer/components/accessManagement/porAccessManagementController.js b/app/portainer/components/accessManagement/porAccessManagementController.js
new file mode 100644
index 0000000..096d86c
--- /dev/null
+++ b/app/portainer/components/accessManagement/porAccessManagementController.js
@@ -0,0 +1,117 @@
+import _ from 'lodash-es';
+import angular from 'angular';
+
+import { RoleTypes } from '@/portainer/rbac/models/role';
+import { isLimitedToBE } from '@/react/portainer/feature-flags/feature-flags.service';
+
+class PorAccessManagementController {
+  /* @ngInject */
+  constructor($scope, $state, Notifications, AccessService, RoleService) {
+    Object.assign(this, { $scope, $state, Notifications, AccessService, RoleService });
+
+    this.limitedToBE = false;
+    this.$state = $state;
+
+    this.unauthorizeAccess = this.unauthorizeAccess.bind(this);
+    this.updateAction = this.updateAction.bind(this);
+    this.onChangeUsersAndTeams = this.onChangeUsersAndTeams.bind(this);
+  }
+
+  onChangeUsersAndTeams(value) {
+    this.$scope.$evalAsync(() => {
+      this.formValues.multiselectOutput = value;
+    });
+  }
+
+  updateAction(updatedUserAccesses, updatedTeamAccesses) {
+    const entity = this.accessControlledEntity;
+    const oldUserAccessPolicies = entity.UserAccessPolicies;
+    const oldTeamAccessPolicies = entity.TeamAccessPolicies;
+
+    const accessPolicies = this.AccessService.generateAccessPolicies(oldUserAccessPolicies, oldTeamAccessPolicies, updatedUserAccesses, updatedTeamAccesses);
+    this.accessControlledEntity.UserAccessPolicies = accessPolicies.userAccessPolicies;
+    this.accessControlledEntity.TeamAccessPolicies = accessPolicies.teamAccessPolicies;
+    this.updateAccess();
+  }
+
+  authorizeAccess() {
+    const entity = this.accessControlledEntity;
+    const oldUserAccessPolicies = entity.UserAccessPolicies;
+    const oldTeamAccessPolicies = entity.TeamAccessPolicies;
+    const selectedRoleId = this.formValues.selectedRole.Id;
+    const selectedUserAccesses = _.filter(this.formValues.multiselectOutput, (access) => access.Type === 'user');
+    const selectedTeamAccesses = _.filter(this.formValues.multiselectOutput, (access) => access.Type === 'team');
+
+    const accessPolicies = this.AccessService.generateAccessPolicies(oldUserAccessPolicies, oldTeamAccessPolicies, selectedUserAccesses, selectedTeamAccesses, selectedRoleId);
+    this.accessControlledEntity.UserAccessPolicies = accessPolicies.userAccessPolicies;
+    this.accessControlledEntity.TeamAccessPolicies = accessPolicies.teamAccessPolicies;
+    this.updateAccess();
+  }
+
+  unauthorizeAccess(selectedAccesses) {
+    const entity = this.accessControlledEntity;
+    const userAccessPolicies = entity.UserAccessPolicies;
+    const teamAccessPolicies = entity.TeamAccessPolicies;
+    const selectedUserAccesses = _.filter(selectedAccesses, (access) => access.Type === 'user');
+    const selectedTeamAccesses = _.filter(selectedAccesses, (access) => access.Type === 'team');
+
+    _.forEach(selectedUserAccesses, (access) => delete userAccessPolicies[access.Id]);
+    _.forEach(selectedTeamAccesses, (access) => delete teamAccessPolicies[access.Id]);
+    this.updateAccess();
+  }
+
+  isRoleLimitedToBE(role) {
+    if (!this.limitedToBE) {
+      return false;
+    }
+
+    return role.ID !== RoleTypes.STANDARD;
+  }
+
+  roleLabel(role) {
+    if (!this.limitedToBE) {
+      return role.Name;
+    }
+
+    if (this.isRoleLimitedToBE(role)) {
+      return `${role.Name} (Business Feature)`;
+    }
+
+    return `${role.Name} (Default)`;
+  }
+
+  async $onInit() {
+    try {
+      if (this.limitedFeature) {
+        this.limitedToBE = isLimitedToBE(this.limitedFeature);
+      }
+
+      const entity = this.accessControlledEntity;
+      const parent = this.inheritFrom;
+
+      const roles = await this.RoleService.roles();
+      this.roles = _.orderBy(roles, 'Priority', 'asc');
+      this.formValues = {
+        multiselectOutput: [],
+        selectedRole: this.roles.find((role) => !this.isRoleLimitedToBE(role)),
+      };
+
+      const data = await this.AccessService.accesses(entity, parent, this.roles);
+
+      if (this.filterUsers) {
+        data.availableUsersAndTeams = this.filterUsers(data.availableUsersAndTeams);
+      }
+
+      this.availableUsersAndTeams = _.orderBy(data.availableUsersAndTeams, 'Name', 'asc');
+      this.authorizedUsersAndTeams = data.authorizedUsersAndTeams;
+    } catch (err) {
+      this.$state.go('portainer.home');
+      this.availableUsersAndTeams = [];
+      this.authorizedUsersAndTeams = [];
+      this.Notifications.error('Failure', err, 'Unable to retrieve accesses');
+    }
+  }
+}
+
+export default PorAccessManagementController;
+angular.module('portainer.app').controller('porAccessManagementController', PorAccessManagementController);
diff --git a/app/portainer/components/autofocus.js b/app/portainer/components/autofocus.js
new file mode 100644
index 0000000..5a468a6
--- /dev/null
+++ b/app/portainer/components/autofocus.js
@@ -0,0 +1,15 @@
+angular.module('portainer.app').directive('autoFocus', [
+  '$timeout',
+  function porAutoFocus($timeout) {
+    var directive = {
+      restrict: 'A',
+      link: function (scope, element) {
+        $timeout(function () {
+          element[0].focus();
+        });
+      },
+    };
+
+    return directive;
+  },
+]);
diff --git a/app/portainer/components/buttonSpinner.js b/app/portainer/components/buttonSpinner.js
new file mode 100644
index 0000000..b1a43fb
--- /dev/null
+++ b/app/portainer/components/buttonSpinner.js
@@ -0,0 +1,12 @@
+angular.module('portainer.app').directive('buttonSpinner', function buttonSpinner() {
+  var directive = {
+    restrict: 'A',
+    scope: {
+      spinning: '=buttonSpinner',
+    },
+    transclude: true,
+    template: '<ng-transclude></ng-transclude><span ng-show="spinning"><pr-icon icon="\'loader-2\'" class-name="\'animate-spin-slow ml-0.5\'"></pr-icon>&nbsp;</span>',
+  };
+
+  return directive;
+});
diff --git a/app/portainer/components/code-editor/code-editor.controller.js b/app/portainer/components/code-editor/code-editor.controller.js
new file mode 100644
index 0000000..55a4457
--- /dev/null
+++ b/app/portainer/components/code-editor/code-editor.controller.js
@@ -0,0 +1,27 @@
+/* @ngInject */
+export default function CodeEditorController($scope) {
+  this.type = '';
+
+  this.handleChange = (value) => {
+    $scope.$evalAsync(() => {
+      this.onChange(value);
+    });
+  };
+
+  this.$onInit = () => {
+    this.type = getType({ yaml: this.yml, dockerFile: this.dockerFile, shell: this.shell });
+  };
+}
+
+function getType({ yaml, dockerFile, shell }) {
+  if (yaml) {
+    return 'yaml';
+  }
+  if (dockerFile) {
+    return 'dockerfile';
+  }
+  if (shell) {
+    return 'shell';
+  }
+  return undefined;
+}
diff --git a/app/portainer/components/code-editor/code-editor.html b/app/portainer/components/code-editor/code-editor.html
new file mode 100644
index 0000000..446da5d
--- /dev/null
+++ b/app/portainer/components/code-editor/code-editor.html
@@ -0,0 +1,10 @@
+<react-code-editor
+  id="$ctrl.identifier"
+  text-tip="$ctrl.textTip"
+  type="$ctrl.type"
+  readonly="$ctrl.readOnly"
+  on-change="($ctrl.handleChange)"
+  value="$ctrl.value"
+  height="$ctrl.height || undefined"
+  schema="$ctrl.schema"
+></react-code-editor>
diff --git a/app/portainer/components/code-editor/code-editor.js b/app/portainer/components/code-editor/code-editor.js
new file mode 100644
index 0000000..25a77c3
--- /dev/null
+++ b/app/portainer/components/code-editor/code-editor.js
@@ -0,0 +1,18 @@
+import controller from './code-editor.controller';
+
+angular.module('portainer.app').component('codeEditor', {
+  templateUrl: './code-editor.html',
+  controller,
+  bindings: {
+    identifier: '@',
+    textTip: '@',
+    yml: '<',
+    dockerFile: '<',
+    shell: '<',
+    readOnly: '<',
+    onChange: '<',
+    value: '<',
+    height: '@',
+    schema: '<',
+  },
+});
diff --git a/app/portainer/components/code-editor/codeEditorController.js b/app/portainer/components/code-editor/codeEditorController.js
new file mode 100644
index 0000000..73e7734
--- /dev/null
+++ b/app/portainer/components/code-editor/codeEditorController.js
@@ -0,0 +1,33 @@
+angular.module('portainer.app').controller('CodeEditorController', function CodeEditorController($document, CodeMirrorService, $scope) {
+  var ctrl = this;
+
+  this.$onChanges = function $onChanges({ value, readOnly }) {
+    if (!ctrl.editor) {
+      return;
+    }
+
+    if (readOnly && typeof readOnly.currentValue === 'boolean' && ctrl.editor.getValue('readOnly') !== ctrl.readOnly) {
+      ctrl.editor.setOption('readOnly', ctrl.readOnly);
+    }
+    if (value && value.currentValue && ctrl.editor.getValue() !== value.currentValue) {
+      ctrl.editor.setValue(value.currentValue);
+    }
+
+    if (ctrl.editor) {
+      ctrl.editor.setOption('readOnly', ctrl.readOnly);
+    }
+  };
+
+  this.$onInit = function () {
+    $document.ready(function () {
+      var editorElement = $document[0].getElementById(ctrl.identifier);
+      ctrl.editor = CodeMirrorService.applyCodeMirrorOnElement(editorElement, ctrl.yml, ctrl.readOnly);
+      if (ctrl.onChange) {
+        ctrl.editor.on('change', (...args) => $scope.$evalAsync(() => ctrl.onChange(...args)));
+      }
+      if (ctrl.value) {
+        ctrl.editor.setValue(ctrl.value);
+      }
+    });
+  };
+});
diff --git a/app/portainer/components/custom-template-selector/custom-template-selector.controller.js b/app/portainer/components/custom-template-selector/custom-template-selector.controller.js
new file mode 100644
index 0000000..c7b82b5
--- /dev/null
+++ b/app/portainer/components/custom-template-selector/custom-template-selector.controller.js
@@ -0,0 +1,36 @@
+class CustomTemplateSelectorController {
+  /* @ngInject */
+  constructor($async, CustomTemplateService, Notifications) {
+    Object.assign(this, { $async, CustomTemplateService, Notifications });
+
+    this.selectedTemplate = null;
+    this.templates = null;
+  }
+
+  async handleChangeTemplate(templateId) {
+    this.selectedTemplate = this.templates.find((t) => t.Id === templateId);
+    this.onChange(templateId, this.selectedTemplate);
+  }
+
+  $onChanges({ value }) {
+    if (value && value.currentValue && this.templates) {
+      this.handleChangeTemplate(value.currentValue);
+    }
+  }
+
+  $onInit() {
+    return this.$async(async () => {
+      try {
+        const templates = await this.CustomTemplateService.customTemplates(this.stackType);
+        this.templates = templates.map((template) => ({ ...template, label: `${template.Title} - ${template.Description}` }));
+        if (this.value) {
+          this.handleChangeTemplate(this.value);
+        }
+      } catch (err) {
+        this.Notifications.error('Failure', err, 'Unable to retrieve Custom Templates');
+      }
+    });
+  }
+}
+
+export default CustomTemplateSelectorController;
diff --git a/app/portainer/components/custom-template-selector/custom-template-selector.html b/app/portainer/components/custom-template-selector/custom-template-selector.html
new file mode 100644
index 0000000..cde665d
--- /dev/null
+++ b/app/portainer/components/custom-template-selector/custom-template-selector.html
@@ -0,0 +1,40 @@
+<div>
+  <div class="form-group pt-3">
+    <label for="stack_template" class="col-sm-3 col-lg-2 control-label text-left"> Template </label>
+    <div class="col-sm-9 col-lg-10 flex flex-col gap-y-1">
+      <select
+        ng-if="$ctrl.templates.length"
+        data-cy="custom-template-selector"
+        class="form-control"
+        ng-model="$ctrl.value"
+        ng-options="template.Id as template.label for template in $ctrl.templates"
+        ng-change="$ctrl.handleChangeTemplate($ctrl.value)"
+      >
+        <option value="" label="Select a Custom Template" disabled selected="selected"> </option>
+      </select>
+      <span ng-if="$ctrl.isLoadFailed">
+        <p class="text-warning mb-5 !inline-flex gap-1 !align-top text-xs" ng-if="ctrl.currentUser.isAdmin || ctrl.currentUser.id === ctrl.state.template.CreatedByUserId">
+          <pr-icon icon="'alert-triangle'" mode="'warning'" size="'sm'"></pr-icon>Custom template could not be loaded, please
+          <a ui-sref="kubernetes.templates.custom.edit({id: ctrl.state.templateId})">click here</a> for configuration.</p
+        >
+        <p class="text-warning mb-5 !inline-flex gap-1 !align-top text-xs" ng-if="!(ctrl.currentUser.isAdmin || ctrl.currentUser.id === ctrl.state.template.CreatedByUserId)">
+          <pr-icon icon="'alert-triangle'" mode="'warning'" size="'sm'"></pr-icon>Custom template could not be loaded, please contact your administrator.</p
+        >
+      </span>
+      <span class="small text-muted pt-[7px]" ng-if="!$ctrl.templates.length">
+        No custom templates are available. Head over to the <a ui-state="$ctrl.newTemplatePath">custom template view</a> to create one.
+      </span>
+    </div>
+  </div>
+
+  <!-- description -->
+  <div ng-if="$ctrl.selectedTemplate.note">
+    <div class="col-sm-12 form-section-title"> Information </div>
+    <div class="form-group">
+      <div class="col-sm-12">
+        <div class="template-note" ng-bind-html="$ctrl.selectedTemplate.note"></div>
+      </div>
+    </div>
+  </div>
+  <!-- !description -->
+</div>
diff --git a/app/portainer/components/custom-template-selector/index.js b/app/portainer/components/custom-template-selector/index.js
new file mode 100644
index 0000000..9b5e5c0
--- /dev/null
+++ b/app/portainer/components/custom-template-selector/index.js
@@ -0,0 +1,17 @@
+import angular from 'angular';
+import controller from './custom-template-selector.controller.js';
+
+export const customTemplateSelector = {
+  templateUrl: './custom-template-selector.html',
+  controller,
+  bindings: {
+    newTemplatePath: '@',
+    stackType: '<',
+    isLoadFailed: '<',
+
+    value: '<',
+    onChange: '<',
+  },
+};
+
+angular.module('portainer.app').component('customTemplateSelector', customTemplateSelector);
diff --git a/app/portainer/components/endpointSecurity/por-endpoint-security.js b/app/portainer/components/endpointSecurity/por-endpoint-security.js
new file mode 100644
index 0000000..7b9c54f
--- /dev/null
+++ b/app/portainer/components/endpointSecurity/por-endpoint-security.js
@@ -0,0 +1,12 @@
+angular.module('portainer.app').component('porEndpointSecurity', {
+  templateUrl: './porEndpointSecurity.html',
+  controller: 'porEndpointSecurityController',
+  bindings: {
+    // This object will be populated with the form data.
+    // Model reference in endpointSecurityModel.js
+    formData: '=',
+    // The component will use this object to initialize the default values
+    // if present.
+    endpoint: '<',
+  },
+});
diff --git a/app/portainer/components/endpointSecurity/porEndpointSecurity.html b/app/portainer/components/endpointSecurity/porEndpointSecurity.html
new file mode 100644
index 0000000..b76955b
--- /dev/null
+++ b/app/portainer/components/endpointSecurity/porEndpointSecurity.html
@@ -0,0 +1,83 @@
+<div>
+  <!-- tls-checkbox -->
+  <div class="form-group">
+    <div class="col-sm-12">
+      <por-switch-field
+        label="'TLS'"
+        label-class="'col-sm-2'"
+        checked="$ctrl.formData.TLS"
+        on-change="($ctrl.onToggleTLS)"
+        tooltip="'Enable this option if you need to connect to the Docker environment with TLS.'"
+      ></por-switch-field>
+    </div>
+  </div>
+  <!-- !tls-checkbox -->
+  <div class="col-sm-12 form-section-title" ng-if="$ctrl.formData.TLS"> TLS mode </div>
+  <!-- note -->
+  <div class="form-group" ng-if="$ctrl.formData.TLS">
+    <div class="col-sm-12">
+      <span class="small text-muted">
+        You can find out more information about how to protect a Docker environment with TLS in the
+        <a href="https://docs.docker.com/engine/security/https/" target="_blank">Docker documentation</a>.
+      </span>
+    </div>
+  </div>
+
+  <box-selector
+    ng-if="$ctrl.formData.TLS"
+    slim="true"
+    radio-name="'tls_mode'"
+    options="$ctrl.tlsOptions"
+    value="$ctrl.formData.TLSMode"
+    on-change="($ctrl.onChangeTLSMode)"
+  ></box-selector>
+
+  <div class="col-sm-12 form-section-title" ng-if="$ctrl.formData.TLS && $ctrl.formData.TLSMode !== 'tls_only'"> Required TLS files </div>
+  <!-- tls-file-upload -->
+  <div ng-if="$ctrl.formData.TLS">
+    <!-- tls-file-ca -->
+    <div class="form-group" ng-if="$ctrl.formData.TLSMode === 'tls_client_ca' || $ctrl.formData.TLSMode === 'tls_ca'">
+      <label class="col-sm-3 col-lg-2 control-label text-left">TLS CA certificate</label>
+      <div class="col-sm-9 col-lg-10">
+        <button type="button" class="btn btn-sm btn-primary" ngf-select ng-model="$ctrl.formData.TLSCACert">Select file</button>
+        <span class="space-left">
+          {{ $ctrl.formData.TLSCACert.name }}
+          <pr-icon icon="'check'" ng-if="$ctrl.formData.TLSCACert && $ctrl.formData.TLSCACert === $ctrl.endpoint.TLSConfig.TLSCACert" mode="'success'"></pr-icon>
+          <pr-icon icon="'x'" ng-if="!$ctrl.formData.TLSCACert" mode="'danger'"></pr-icon>
+        </span>
+      </div>
+    </div>
+    <!-- !tls-file-ca -->
+    <!-- tls-files-cert-key -->
+    <div ng-if="$ctrl.formData.TLSMode === 'tls_client_ca' || $ctrl.formData.TLSMode === 'tls_client_noca'">
+      <!-- tls-file-cert -->
+      <div class="form-group">
+        <label for="tls_cert" class="col-sm-3 col-lg-2 control-label text-left">TLS certificate</label>
+        <div class="col-sm-9 col-lg-10">
+          <button type="button" class="btn btn-sm btn-primary" ngf-select ng-model="$ctrl.formData.TLSCert">Select file</button>
+          <span class="space-left">
+            {{ $ctrl.formData.TLSCert.name }}
+            <pr-icon icon="'check'" ng-if="$ctrl.formData.TLSCert && $ctrl.formData.TLSCert === $ctrl.endpoint.TLSConfig.TLSCert" mode="'success'"></pr-icon>
+            <pr-icon icon="'x'" ng-if="!$ctrl.formData.TLSCert" mode="'danger'"></pr-icon>
+          </span>
+        </div>
+      </div>
+      <!-- !tls-file-cert -->
+      <!-- tls-file-key -->
+      <div class="form-group">
+        <label class="col-sm-3 col-lg-2 control-label text-left">TLS key</label>
+        <div class="col-sm-9 col-lg-10">
+          <button type="button" class="btn btn-sm btn-primary" ngf-select ng-model="$ctrl.formData.TLSKey">Select file</button>
+          <span class="space-left">
+            {{ $ctrl.formData.TLSKey.name }}
+            <pr-icon icon="'check'" ng-if="$ctrl.formData.TLSKey && $ctrl.formData.TLSKey === $ctrl.endpoint.TLSConfig.TLSKey" mode="'success'"></pr-icon>
+            <pr-icon icon="'x'" ng-if="!$ctrl.formData.TLSKey" mode="'danger'"></pr-icon>
+          </span>
+        </div>
+      </div>
+      <!-- !tls-file-key -->
+    </div>
+    <!-- tls-files-cert-key -->
+  </div>
+  <!-- !tls-file-upload -->
+</div>
diff --git a/app/portainer/components/endpointSecurity/porEndpointSecurityController.js b/app/portainer/components/endpointSecurity/porEndpointSecurityController.js
new file mode 100644
index 0000000..56d11a5
--- /dev/null
+++ b/app/portainer/components/endpointSecurity/porEndpointSecurityController.js
@@ -0,0 +1,56 @@
+import { tlsOptions } from '@/react/portainer/environments/ItemView/tls-options';
+
+angular.module('portainer.app').controller('porEndpointSecurityController', [
+  '$scope',
+  function ($scope) {
+    var ctrl = this;
+
+    this.tlsOptions = tlsOptions;
+
+    function onChange(values) {
+      $scope.$evalAsync(() => {
+        ctrl.formData = {
+          ...ctrl.formData,
+          ...values,
+        };
+      });
+    }
+
+    ctrl.onChangeTLSMode = onChangeTLSMode;
+    function onChangeTLSMode(mode) {
+      onChange({ TLSMode: mode });
+    }
+
+    ctrl.onToggleTLS = onToggleTLS;
+    function onToggleTLS(newValue) {
+      onChange({ TLS: newValue });
+    }
+
+    this.$onInit = $onInit;
+    function $onInit() {
+      if (ctrl.endpoint) {
+        var endpoint = ctrl.endpoint;
+        var TLS = endpoint.TLSConfig.TLS;
+        ctrl.formData.TLS = TLS;
+        var CACert = endpoint.TLSConfig.TLSCACert;
+        ctrl.formData.TLSCACert = CACert;
+        var cert = endpoint.TLSConfig.TLSCert;
+        ctrl.formData.TLSCert = cert;
+        var key = endpoint.TLSConfig.TLSKey;
+        ctrl.formData.TLSKey = key;
+
+        if (TLS) {
+          if (CACert && cert && key) {
+            ctrl.formData.TLSMode = 'tls_client_ca';
+          } else if (cert && key) {
+            ctrl.formData.TLSMode = 'tls_client_noca';
+          } else if (CACert) {
+            ctrl.formData.TLSMode = 'tls_ca';
+          } else {
+            ctrl.formData.TLSMode = 'tls_only';
+          }
+        }
+      }
+    }
+  },
+]);
diff --git a/app/portainer/components/endpointSecurity/porEndpointSecurityModel.js b/app/portainer/components/endpointSecurity/porEndpointSecurityModel.js
new file mode 100644
index 0000000..795bdb7
--- /dev/null
+++ b/app/portainer/components/endpointSecurity/porEndpointSecurityModel.js
@@ -0,0 +1,7 @@
+export function EndpointSecurityFormData() {
+  this.TLS = false;
+  this.TLSMode = 'tls_client_ca';
+  this.TLSCACert = null;
+  this.TLSCert = null;
+  this.TLSKey = null;
+}
diff --git a/app/portainer/components/focusIf.js b/app/portainer/components/focusIf.js
new file mode 100644
index 0000000..6a8650e
--- /dev/null
+++ b/app/portainer/components/focusIf.js
@@ -0,0 +1,25 @@
+import angular from 'angular';
+// ng-focus-if pkg from: https://github.com/hiebj/ng-focus-if
+angular.module('portainer.app').directive('focusIf', function ($timeout) {
+  return {
+    restrict: 'A',
+    link: function ($scope, $element, $attrs) {
+      var dom = $element[0];
+      if ($attrs.focusIf) {
+        $scope.$watch($attrs.focusIf, focus);
+      } else {
+        focus(true);
+      }
+      function focus(condition) {
+        if (condition) {
+          $timeout(
+            function () {
+              dom.focus();
+            },
+            $scope.$eval($attrs.focusDelay) || 0
+          );
+        }
+      }
+    },
+  };
+});
diff --git a/app/portainer/components/form-components/file-upload-form/file-upload-form.html b/app/portainer/components/form-components/file-upload-form/file-upload-form.html
new file mode 100644
index 0000000..d6dddc7
--- /dev/null
+++ b/app/portainer/components/form-components/file-upload-form/file-upload-form.html
@@ -0,0 +1,11 @@
+<ng-form class="file-upload-form" name="$ctrl.fileUploadForm">
+  <div class="col-sm-12 form-section-title"> Upload </div>
+  <div class="form-group">
+    <span class="col-sm-12 text-muted small" ng-transclude="description"> </span>
+  </div>
+  <div class="form-group">
+    <div class="col-sm-12">
+      <file-upload-field on-change="($ctrl.onChange)" required="($ctrl.ngRequired)" value="($ctrl.file)"></file-upload-field>
+    </div>
+  </div>
+</ng-form>
diff --git a/app/portainer/components/form-components/file-upload-form/index.js b/app/portainer/components/form-components/file-upload-form/index.js
new file mode 100644
index 0000000..8a3afeb
--- /dev/null
+++ b/app/portainer/components/form-components/file-upload-form/index.js
@@ -0,0 +1,13 @@
+export const fileUploadForm = {
+  templateUrl: './file-upload-form.html',
+
+  bindings: {
+    file: '<',
+    ngRequired: '<',
+    onChange: '<',
+  },
+
+  transclude: {
+    description: '?fileUploadDescription',
+  },
+};
diff --git a/app/portainer/components/form-components/index.js b/app/portainer/components/form-components/index.js
new file mode 100644
index 0000000..a60a755
--- /dev/null
+++ b/app/portainer/components/form-components/index.js
@@ -0,0 +1,6 @@
+import angular from 'angular';
+
+import { webEditorForm } from './web-editor-form';
+import { fileUploadForm } from './file-upload-form';
+
+export default angular.module('portainer.app.components.form', []).component('webEditorForm', webEditorForm).component('fileUploadForm', fileUploadForm).name;
diff --git a/app/portainer/components/form-components/web-editor-form/index.js b/app/portainer/components/form-components/web-editor-form/index.js
new file mode 100644
index 0000000..804966f
--- /dev/null
+++ b/app/portainer/components/form-components/web-editor-form/index.js
@@ -0,0 +1,22 @@
+import controller from './web-editor-form.controller.js';
+
+export const webEditorForm = {
+  templateUrl: './web-editor-form.html',
+  controller,
+
+  bindings: {
+    identifier: '@',
+    textTip: '@',
+    yml: '<',
+    value: '<',
+    readOnly: '<',
+    onChange: '<',
+    hideTitle: '<',
+    height: '@',
+    schema: '<',
+  },
+
+  transclude: {
+    description: '?editorDescription',
+  },
+};
diff --git a/app/portainer/components/form-components/web-editor-form/web-editor-form.controller.js b/app/portainer/components/form-components/web-editor-form/web-editor-form.controller.js
new file mode 100644
index 0000000..09c2e4c
--- /dev/null
+++ b/app/portainer/components/form-components/web-editor-form/web-editor-form.controller.js
@@ -0,0 +1,8 @@
+class WebEditorFormController {
+  /* @ngInject */
+  constructor(BROWSER_OS_PLATFORM) {
+    this.BROWSER_OS_PLATFORM = BROWSER_OS_PLATFORM;
+  }
+}
+
+export default WebEditorFormController;
diff --git a/app/portainer/components/form-components/web-editor-form/web-editor-form.html b/app/portainer/components/form-components/web-editor-form/web-editor-form.html
new file mode 100644
index 0000000..336da3b
--- /dev/null
+++ b/app/portainer/components/form-components/web-editor-form/web-editor-form.html
@@ -0,0 +1,56 @@
+<ng-form name="$ctrl.webEditorForm">
+  <div class="web-editor overflow-x-hidden">
+    <div ng-if="!$ctrl.hideTitle" class="col-sm-12 form-section-title pr-0"
+      >Web editor
+      <div class="text-muted small vertical-center float-right mt-0">
+        <span ng-if="$ctrl.BROWSER_OS_PLATFORM !== 'mac'" class="vertical-center">Ctrl+F for search</span>
+        <span ng-if="$ctrl.BROWSER_OS_PLATFORM === 'mac'" class="vertical-center">Cmd+F for search</span>
+        <portainer-tooltip
+          ng-if="$ctrl.BROWSER_OS_PLATFORM !== 'mac'"
+          message="'Ctrl+F - Start searching <br />
+              Ctrl+G - Find next <br />
+              Ctrl+Shift+G - Find previous <br />
+              Ctrl+Shift+F - Replace <br />
+              Ctrl+Shift+R - Replace all <br />
+              Alt+G - Jump to line <br />
+              Alt+F - Persistent search: <br />
+              &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Enter - Find next <br />
+              &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Shift+Enter - Find previous <br />'"
+          class-name="'[&>span]:!text-left'"
+          set-html-message="true"
+        >
+        </portainer-tooltip>
+        <portainer-tooltip
+          ng-if="$ctrl.BROWSER_OS_PLATFORM === 'mac'"
+          message="'Cmd+F - Start searching <br />
+              Cmd+G - Find next <br />
+              Cmd+Shift+G - Find previous <br />
+              Cmd+Option+F - Replace <br />
+              Cmd+Option+R - Replace all <br />
+              Option+G - Jump to line <br />
+              Option+F - Persistent search: <br />
+              &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Enter - Find next <br />
+              &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Shift+Enter - Find previous <br />'"
+          class-name="'[&>span]:!text-left'"
+          set-html-message="true"
+        >
+        </portainer-tooltip>
+      </div>
+    </div>
+    <div class="trancluded-item form-group col-sm-9 col-lg-10 text-muted small" ng-transclude="description"></div>
+    <div class="form-group">
+      <div class="col-sm-12 col-lg-12">
+        <code-editor
+          identifier="{{ $ctrl.identifier }}"
+          text-tip="{{ $ctrl.textTip }}"
+          read-only="$ctrl.readOnly"
+          yml="$ctrl.yml"
+          value="$ctrl.value"
+          on-change="($ctrl.onChange)"
+          height="{{ $ctrl.height }}"
+          schema="$ctrl.schema"
+        ></code-editor>
+      </div>
+    </div>
+  </div>
+</ng-form>
diff --git a/app/portainer/components/forms/git-form/git-form.controller.ts b/app/portainer/components/forms/git-form/git-form.controller.ts
new file mode 100644
index 0000000..43a5295
--- /dev/null
+++ b/app/portainer/components/forms/git-form/git-form.controller.ts
@@ -0,0 +1,65 @@
+import { IFormController } from 'angular';
+import { FormikErrors } from 'formik';
+
+import { DeployMethod, GitFormModel } from '@/react/portainer/gitops/types';
+import { validateGitForm } from '@/react/portainer/gitops/GitForm';
+
+export default class GitFormController {
+  errors?: FormikErrors<GitFormModel>;
+
+  $async: <T>(fn: () => Promise<T>) => Promise<T>;
+
+  gitForm?: IFormController;
+
+  value?: GitFormModel;
+
+  onChange?: (value: GitFormModel) => void;
+
+  createdFromCustomTemplateId?: number;
+
+  deployMethod?: DeployMethod;
+
+  /* @ngInject */
+  constructor($async: <T>(fn: () => Promise<T>) => Promise<T>) {
+    this.$async = $async;
+
+    this.handleChange = this.handleChange.bind(this);
+    this.runGitFormValidation = this.runGitFormValidation.bind(this);
+  }
+
+  async handleChange(newValues: Partial<GitFormModel>) {
+    // this should never happen, but just in case
+    if (!this.value) {
+      throw new Error('GitFormController: value is required');
+    }
+
+    const value = {
+      ...this.value,
+      ...newValues,
+    };
+    this.onChange?.(value);
+
+    await this.runGitFormValidation(value);
+  }
+
+  async runGitFormValidation(value: GitFormModel) {
+    return this.$async(async () => {
+      this.errors = {};
+      this.gitForm?.$setValidity('gitForm', true, this.gitForm);
+
+      this.errors = await validateGitForm(value, this.deployMethod);
+      if (this.errors && Object.keys(this.errors).length > 0) {
+        this.gitForm?.$setValidity('gitForm', false, this.gitForm);
+      }
+    });
+  }
+
+  async $onInit() {
+    // this should never happen, but just in case
+    if (!this.value) {
+      throw new Error('GitFormController: value is required');
+    }
+
+    await this.runGitFormValidation(this.value);
+  }
+}
diff --git a/app/portainer/components/forms/git-form/git-form.ts b/app/portainer/components/forms/git-form/git-form.ts
new file mode 100644
index 0000000..20eca21
--- /dev/null
+++ b/app/portainer/components/forms/git-form/git-form.ts
@@ -0,0 +1,39 @@
+import { IComponentOptions } from 'angular';
+
+import controller from './git-form.controller';
+
+export const gitForm: IComponentOptions = {
+  template: `
+<ng-form name="$ctrl.gitForm">
+  <react-git-form
+    value="$ctrl.value"
+    on-change="$ctrl.handleChange"
+    environment-type="$ctrl.environmentType"
+    is-docker-standalone="$ctrl.isDockerStandalone"
+    deploy-method="$ctrl.deployMethod"
+    is-additional-files-field-visible="$ctrl.isAdditionalFilesFieldVisible"
+    is-force-pull-visible="$ctrl.isForcePullVisible"
+    is-auth-explanation-visible="$ctrl.isAuthExplanationVisible"
+    base-webhook-url="$ctrl.baseWebhookUrl"
+    webhook-id="$ctrl.webhookId"
+    webhooks-docs="$ctrl.webhooksDocs"
+    created-from-custom-template-id="$ctrl.createdFromCustomTemplateId"
+    errors="$ctrl.errors">
+  </react-git-form>
+</ng-form>`,
+  bindings: {
+    value: '<',
+    onChange: '<',
+    environmentType: '@',
+    isDockerStandalone: '<',
+    deployMethod: '@',
+    baseWebhookUrl: '@',
+    isAdditionalFilesFieldVisible: '<',
+    isForcePullVisible: '<',
+    isAuthExplanationVisible: '<',
+    webhookId: '@',
+    webhooksDocs: '@',
+    createdFromCustomTemplateId: '<',
+  },
+  controller,
+};
diff --git a/app/portainer/components/forms/git-form/index.ts b/app/portainer/components/forms/git-form/index.ts
new file mode 100644
index 0000000..b6b4cc4
--- /dev/null
+++ b/app/portainer/components/forms/git-form/index.ts
@@ -0,0 +1,7 @@
+import angular from 'angular';
+
+import { gitForm } from './git-form';
+
+export const gitFormModule = angular
+  .module('portainer.app.components.git-form', [])
+  .component('gitForm', gitForm).name;
diff --git a/app/portainer/components/forms/group-form/groupForm.html b/app/portainer/components/forms/group-form/groupForm.html
new file mode 100644
index 0000000..cee7bde
--- /dev/null
+++ b/app/portainer/components/forms/group-form/groupForm.html
@@ -0,0 +1,69 @@
+<form class="form-horizontal" name="endpointGroupForm" ng-if="$ctrl.model">
+  <!-- name-input -->
+  <div class="form-group">
+    <label for="group_name" class="col-sm-3 col-lg-2 control-label required text-left">Name</label>
+    <div class="col-sm-9 col-lg-10">
+      <input type="text" class="form-control" name="group_name" ng-model="$ctrl.model.Name" placeholder="e.g. my-group" required auto-focus data-cy="group-name-input" />
+      <div class="help-block" ng-show="endpointGroupForm.group_name.$invalid">
+        <div class="small text-warning">
+          <div ng-messages="endpointGroupForm.group_name.$error">
+            <p ng-message="required" class="vertical-center">
+              <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon>
+              This field is required.
+            </p>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>
+  <!-- !name-input -->
+  <!-- description-input -->
+  <div class="form-group">
+    <label for="group_description" class="col-sm-3 col-lg-2 control-label text-left">Description</label>
+    <div class="col-sm-9 col-lg-10">
+      <input
+        type="text"
+        class="form-control"
+        id="group_description"
+        ng-model="$ctrl.model.Description"
+        placeholder="e.g. production environments..."
+        data-cy="group-description-input"
+      />
+    </div>
+  </div>
+  <!-- !description-input -->
+  <div class="col-sm-12 form-section-title"> Metadata </div>
+
+  <tag-selector ng-if="$ctrl.model.TagIds" value="$ctrl.model.TagIds" on-change="($ctrl.onChangeTags)" allow-create="$ctrl.state.allowCreateTag"> </tag-selector>
+
+  <div class="form-group" ng-if="$ctrl.model.Id !== 1">
+    <associated-endpoints-selector value="$ctrl.associatedEndpoints" on-change="($ctrl.onChangeEnvironments)"></associated-endpoints-selector>
+  </div>
+
+  <div class="-mx-[15px]">
+    <group-association-table
+      ng-if="$ctrl.model.Id === 1"
+      title="'Unassociated environments'"
+      empty-content-message="'No environment available'"
+      query="$ctrl.unassociatedQuery"
+    ></group-association-table>
+  </div>
+
+  <!-- actions -->
+  <div class="col-sm-12 form-section-title"> Actions </div>
+  <div class="form-group">
+    <div class="col-sm-12">
+      <button
+        type="button"
+        class="btn btn-primary btn-sm"
+        ng-click="$ctrl.formAction()"
+        ng-disabled="$ctrl.actionInProgress || !endpointGroupForm.$valid"
+        button-spinner="$ctrl.actionInProgress"
+      >
+        <span ng-hide="$ctrl.actionInProgress">{{ $ctrl.formActionLabel }}</span>
+        <span ng-show="$ctrl.actionInProgress">In progress...</span>
+      </button>
+    </div>
+  </div>
+  <!-- !actions -->
+</form>
diff --git a/app/portainer/components/forms/group-form/groupFormController.js b/app/portainer/components/forms/group-form/groupFormController.js
new file mode 100644
index 0000000..b7675ac
--- /dev/null
+++ b/app/portainer/components/forms/group-form/groupFormController.js
@@ -0,0 +1,31 @@
+import angular from 'angular';
+
+class GroupFormController {
+  /* @ngInject */
+  constructor($async, $scope, GroupService, Notifications, Authentication) {
+    this.$async = $async;
+    this.$scope = $scope;
+    this.GroupService = GroupService;
+    this.Notifications = Notifications;
+    this.Authentication = Authentication;
+
+    this.state = {
+      allowCreateTag: this.Authentication.isAdmin(),
+    };
+
+    this.unassociatedQuery = {
+      groupIds: [1],
+    };
+
+    this.onChangeTags = this.onChangeTags.bind(this);
+  }
+
+  onChangeTags(value) {
+    return this.$scope.$evalAsync(() => {
+      this.model.TagIds = value;
+    });
+  }
+}
+
+angular.module('portainer.app').controller('GroupFormController', GroupFormController);
+export default GroupFormController;
diff --git a/app/portainer/components/forms/registry-form-aws-ecr/registry-form-ecr.html b/app/portainer/components/forms/registry-form-aws-ecr/registry-form-ecr.html
new file mode 100644
index 0000000..6f930db
--- /dev/null
+++ b/app/portainer/components/forms/registry-form-aws-ecr/registry-form-ecr.html
@@ -0,0 +1,184 @@
+<form class="form-horizontal" name="$ctrl.registryFormEcr" ng-submit="$ctrl.formAction()">
+  <div class="col-sm-12 form-section-title"> Important notice </div>
+  <div class="form-group">
+    <span class="col-sm-12 text-muted small">
+      For information on how to generate an Access Key, follow the
+      <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html#id_users_create_console" target="_blank">AWS guide</a>.
+    </span>
+  </div>
+
+  <div class="col-sm-12 form-section-title"> ECR connection details </div>
+
+  <!-- name-input -->
+  <div class="form-group">
+    <label for="registry_name" class="col-sm-3 col-lg-2 control-label required text-left">Name</label>
+    <div class="col-sm-9 col-lg-10">
+      <input
+        type="text"
+        class="form-control"
+        id="registry_name"
+        name="registry_name"
+        ng-model="$ctrl.model.Name"
+        placeholder="my-ecr-registry"
+        required
+        auto-focus
+        data-cy="registry-name-input"
+      />
+      <div class="help-block" ng-show="$ctrl.registryFormEcr.registry_name.$invalid">
+        <div class="small text-warning">
+          <div ng-messages="$ctrl.registryFormEcr.registry_name.$error">
+            <p ng-message="required" class="vertical-center">
+              <pr-icon icon="'alert-triangle'"></pr-icon>
+              This field is required.
+            </p>
+            <p ng-message="used" class="vertical-center">
+              <pr-icon icon="'alert-triangle'"></pr-icon>
+              A registry with the same name already exists.
+            </p>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>
+  <!-- !name-input -->
+
+  <!-- url-input -->
+  <div class="form-group">
+    <label for="registry_url" class="col-sm-3 col-lg-2 control-label text-left">
+      <span class="required">Registry URL</span>
+      <portainer-tooltip message="'URL of an Amazon Elastic Container Registry, which contains an account id and region.'"></portainer-tooltip>
+    </label>
+    <div class="col-sm-9 col-lg-10">
+      <input
+        type="text"
+        data-cy="registry-url-input"
+        class="form-control"
+        id="registry_url"
+        name="registry_url"
+        ng-model="$ctrl.model.URL"
+        placeholder="aws-account-id.dkr.ecr.us-east-1.amazonaws.com/"
+        required
+      />
+      <div class="help-block" ng-show="$ctrl.registryFormEcr.registry_url.$invalid">
+        <div class="small text-warning">
+          <div ng-messages="$ctrl.registryFormEcr.registry_url.$error">
+            <p ng-message="required" class="vertical-center">
+              <pr-icon icon="'alert-triangle'"></pr-icon>
+              This field is required.
+            </p>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>
+  <!-- url-input -->
+
+  <!-- authentication-checkbox -->
+  <div class="form-group">
+    <div class="col-sm-12">
+      <por-switch-field
+        label="'Authentication'"
+        label-class="'col-sm-3 col-lg-2'"
+        tooltip="'Enable this option if you need to specify credentials to connect to a private registry.'"
+        name="'administrator'"
+        checked="$ctrl.model.Authentication"
+        on-change="($ctrl.toggleAuthentication)"
+        label-class="'col-sm-2'"
+      ></por-switch-field>
+    </div>
+  </div>
+  <!-- !authentication-checkbox -->
+
+  <div ng-if="$ctrl.model.Authentication">
+    <!-- aws-access-key -->
+    <div class="form-group">
+      <label for="registry_access_key" class="col-sm-3 col-lg-2 control-label required text-left">AWS Access Key</label>
+      <div class="col-sm-9 col-lg-10">
+        <input type="text" class="form-control" id="registry_access_key" name="registry_access_key" ng-model="$ctrl.model.Username" required data-cy="registry-access-key-input" />
+        <div class="help-block" ng-show="$ctrl.registryFormEcr.registry_access_key.$invalid">
+          <div class="small text-warning">
+            <div ng-messages="$ctrl.registryFormEcr.registry_access_key.$error">
+              <p ng-message="required" class="vertical-center">
+                <pr-icon icon="'alert-triangle'"></pr-icon>
+                This field is required.
+              </p>
+            </div>
+          </div>
+        </div>
+      </div>
+    </div>
+    <!-- !aws-access-key -->
+
+    <!-- aws-secret-access-key -->
+    <div class="form-group">
+      <label for="registry_secret_access_key" class="col-sm-3 col-lg-2 control-label required text-left">AWS Secret Access Key</label>
+      <div class="col-sm-9 col-lg-10">
+        <input type="password" class="form-control" id="registry_secret_access_key" name="registry_secret_access_key" ng-model="$ctrl.model.Password" required />
+        <div class="help-block" ng-show="$ctrl.registryFormEcr.registry_secret_access_key.$invalid">
+          <div class="small text-warning">
+            <div ng-messages="$ctrl.registryFormEcr.registry_secret_access_key.$error">
+              <p ng-message="required" class="vertical-center">
+                <pr-icon icon="'alert-triangle'"></pr-icon>
+                This field is required.
+              </p>
+            </div>
+          </div>
+        </div>
+      </div>
+    </div>
+    <!-- !aws-secret-access-key -->
+
+    <!-- region -->
+    <div class="form-group">
+      <label for="registry_region" class="col-sm-3 col-lg-2 control-label required text-left">Region</label>
+      <div class="col-sm-9 col-lg-10">
+        <input
+          type="text"
+          class="form-control"
+          id="registry_region"
+          name="registry_region"
+          placeholder="us-west-1"
+          ng-model="$ctrl.model.Ecr.Region"
+          required
+          data-cy="registry-region-input"
+        />
+        <div class="help-block" ng-show="$ctrl.registryFormEcr.registry_region.$invalid">
+          <div class="small text-warning">
+            <div ng-messages="$ctrl.registryFormEcr.registry_region.$error">
+              <p ng-message="required" class="vertical-center">
+                <pr-icon icon="'alert-triangle'"></pr-icon>
+                This field is required.
+              </p>
+              <p ng-message="used" class="vertical-center">
+                <pr-icon icon="'alert-triangle'"></pr-icon>
+                A registry with the same name already exists.
+              </p>
+            </div>
+          </div>
+        </div>
+      </div>
+    </div>
+    <!-- !region -->
+  </div>
+
+  <!-- actions -->
+  <div class="col-sm-12 form-section-title"> Actions </div>
+  <div class="form-group">
+    <div class="col-sm-12">
+      <button
+        type="submit"
+        class="btn btn-primary btn-sm"
+        ng-disabled="$ctrl.actionInProgress || !$ctrl.registryFormEcr.$valid"
+        button-spinner="$ctrl.actionInProgress"
+        analytics-on
+        analytics-category="portainer"
+        analytics-event="portainer-registry-creation"
+        analytics-properties="{ metadata: { type: 'ecr' } }"
+      >
+        <span ng-hide="$ctrl.actionInProgress">{{ $ctrl.formActionLabel }}</span>
+        <span ng-show="$ctrl.actionInProgress">In progress...</span>
+      </button>
+    </div>
+  </div>
+  <!-- !actions -->
+</form>
diff --git a/app/portainer/components/forms/registry-form-aws-ecr/registry-form-ecr.js b/app/portainer/components/forms/registry-form-aws-ecr/registry-form-ecr.js
new file mode 100644
index 0000000..2eba888
--- /dev/null
+++ b/app/portainer/components/forms/registry-form-aws-ecr/registry-form-ecr.js
@@ -0,0 +1,28 @@
+class controller {
+  constructor($scope) {
+    this.$scope = $scope;
+    this.toggleAuthentication = this.toggleAuthentication.bind(this);
+  }
+
+  $postLink() {
+    this.registryFormEcr.registry_name.$validators.used = (modelValue) => !this.nameIsUsed(modelValue);
+  }
+
+  toggleAuthentication(newValue) {
+    this.$scope.$evalAsync(() => {
+      this.model.Authentication = newValue;
+    });
+  }
+}
+
+angular.module('portainer.app').component('registryFormEcr', {
+  templateUrl: './registry-form-ecr.html',
+  bindings: {
+    model: '=',
+    formAction: '<',
+    formActionLabel: '@',
+    actionInProgress: '<',
+    nameIsUsed: '<',
+  },
+  controller,
+});
diff --git a/app/portainer/components/forms/registry-form-azure/registry-form-azure.html b/app/portainer/components/forms/registry-form-azure/registry-form-azure.html
new file mode 100644
index 0000000..478c831
--- /dev/null
+++ b/app/portainer/components/forms/registry-form-azure/registry-form-azure.html
@@ -0,0 +1,121 @@
+<form class="form-horizontal" name="$ctrl.registryFormAzure" ng-submit="$ctrl.formAction()">
+  <div class="col-sm-12 form-section-title"> Azure registry details </div>
+  <!-- name-input -->
+  <div class="form-group">
+    <label for="registry_name" class="col-sm-3 col-lg-2 control-label required text-left">Name</label>
+    <div class="col-sm-9 col-lg-10">
+      <input
+        type="text"
+        class="form-control"
+        id="registry_name"
+        name="registry_name"
+        ng-model="$ctrl.model.Name"
+        placeholder="my-azure-registry"
+        required
+        auto-focus
+        data-cy="registry-name-input"
+      />
+      <div class="help-block" ng-show="$ctrl.registryFormAzure.registry_name.$invalid">
+        <div class="small text-warning">
+          <div ng-messages="$ctrl.registryFormAzure.registry_name.$error">
+            <p ng-message="required" class="vertical-center">
+              <pr-icon icon="'alert-triangle'"></pr-icon>
+              This field is required.
+            </p>
+            <p ng-message="used" class="vertical-center">
+              <pr-icon icon="'alert-triangle'"></pr-icon>
+              A registry with the same name already exists.
+            </p>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>
+  <!-- !name-input -->
+  <!-- url-input -->
+  <div class="form-group">
+    <label for="registry_url" class="col-sm-3 col-lg-2 control-label text-left">
+      <span class="required">Registry URL</span>
+      <portainer-tooltip message="'URL of an Azure Container Registry. Any protocol will be stripped.'"></portainer-tooltip>
+    </label>
+    <div class="col-sm-9 col-lg-10">
+      <input
+        type="text"
+        class="form-control"
+        id="registry_url"
+        name="registry_url"
+        ng-model="$ctrl.model.URL"
+        placeholder="myproject.azurecr.io"
+        required
+        data-cy="registry-url-input"
+      />
+      <div class="help-block" ng-show="$ctrl.registryFormAzure.registry_url.$invalid">
+        <div class="small text-warning">
+          <div ng-messages="$ctrl.registryFormAzure.registry_url.$error">
+            <p ng-message="required" class="vertical-center">
+              <pr-icon icon="'alert-triangle'"></pr-icon>
+              This field is required.
+            </p>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>
+  <!-- url-input -->
+  <!-- credentials-user -->
+  <div class="form-group">
+    <label for="registry_username" class="col-sm-3 col-lg-2 control-label required text-left">Username</label>
+    <div class="col-sm-9 col-lg-10">
+      <input type="text" class="form-control" id="registry_username" name="registry_username" ng-model="$ctrl.model.Username" required data-cy="registry-username-input" />
+      <div class="help-block" ng-show="$ctrl.registryFormAzure.registry_username.$invalid">
+        <div class="small text-warning">
+          <div ng-messages="$ctrl.registryFormAzure.registry_username.$error">
+            <p ng-message="required" class="vertical-center">
+              <pr-icon icon="'alert-triangle'"></pr-icon>
+              This field is required.
+            </p>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>
+  <!-- !credentials-user -->
+  <!-- credentials-password -->
+  <div class="form-group">
+    <label for="registry_password" class="col-sm-3 col-lg-2 control-label required text-left">Password</label>
+    <div class="col-sm-9 col-lg-10">
+      <input type="password" class="form-control" id="registry_password" name="registry_password" ng-model="$ctrl.model.Password" required />
+      <div class="help-block" ng-show="$ctrl.registryFormAzure.registry_password.$invalid">
+        <div class="small text-warning">
+          <div ng-messages="$ctrl.registryFormAzure.registry_password.$error">
+            <p ng-message="required" class="vertical-center">
+              <pr-icon icon="'alert-triangle'"></pr-icon>
+              This field is required.
+            </p>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>
+  <!-- !credentials-password -->
+  <!-- actions -->
+  <div class="col-sm-12 form-section-title"> Actions </div>
+  <div class="form-group">
+    <div class="col-sm-12">
+      <button
+        type="submit"
+        class="btn btn-primary btn-sm"
+        ng-disabled="$ctrl.actionInProgress || !$ctrl.registryFormAzure.$valid"
+        button-spinner="$ctrl.actionInProgress"
+        analytics-on
+        analytics-category="portainer"
+        analytics-event="portainer-registry-creation"
+        analytics-properties="{ metadata: { type: 'azure' } }"
+      >
+        <span ng-hide="$ctrl.actionInProgress">{{ $ctrl.formActionLabel }}</span>
+        <span ng-show="$ctrl.actionInProgress">In progress...</span>
+      </button>
+    </div>
+  </div>
+  <!-- !actions -->
+</form>
diff --git a/app/portainer/components/forms/registry-form-azure/registry-form-azure.js b/app/portainer/components/forms/registry-form-azure/registry-form-azure.js
new file mode 100644
index 0000000..c8305da
--- /dev/null
+++ b/app/portainer/components/forms/registry-form-azure/registry-form-azure.js
@@ -0,0 +1,17 @@
+class controller {
+  $postLink() {
+    this.registryFormAzure.registry_name.$validators.used = (modelValue) => !this.nameIsUsed(modelValue);
+  }
+}
+
+angular.module('portainer.app').component('registryFormAzure', {
+  templateUrl: './registry-form-azure.html',
+  bindings: {
+    model: '=',
+    formAction: '<',
+    formActionLabel: '@',
+    actionInProgress: '<',
+    nameIsUsed: '<',
+  },
+  controller,
+});
diff --git a/app/portainer/components/forms/registry-form-custom/registry-form-custom.html b/app/portainer/components/forms/registry-form-custom/registry-form-custom.html
new file mode 100644
index 0000000..0095450
--- /dev/null
+++ b/app/portainer/components/forms/registry-form-custom/registry-form-custom.html
@@ -0,0 +1,153 @@
+<form class="form-horizontal" name="$ctrl.registryFormCustom" ng-submit="$ctrl.formAction()">
+  <div class="col-sm-12 form-section-title"> Important notice </div>
+  <div class="form-group">
+    <span class="col-sm-12 text-muted small">
+      Docker requires you to connect to a <a href="https://docs.docker.com/registry/deploying/#running-a-domain-registry" target="_blank">secure registry</a>. You can find more
+      information about how to connect to an insecure registry <a href="https://docs.docker.com/registry/insecure/" target="_blank">in the Docker documentation</a>.
+    </span>
+  </div>
+  <div class="col-sm-12 form-section-title"> Custom registry details </div>
+  <!-- name-input -->
+  <div class="form-group">
+    <label for="registry_name" class="col-sm-3 col-lg-2 control-label required text-left">Name</label>
+    <div class="col-sm-9 col-lg-10">
+      <input
+        type="text"
+        class="form-control"
+        id="registry_name"
+        name="registry_name"
+        ng-model="$ctrl.model.Name"
+        placeholder="my-custom-registry"
+        required
+        auto-focus
+        data-cy="component-registryNameInput"
+      />
+      <div class="help-block" ng-show="$ctrl.registryFormCustom.registry_name.$invalid">
+        <div class="small text-warning">
+          <div ng-messages="$ctrl.registryFormCustom.registry_name.$error">
+            <p ng-message="required" class="vertical-center">
+              <pr-icon icon="'alert-triangle'"></pr-icon>
+              This field is required.
+            </p>
+            <p ng-message="used" class="vertical-center">
+              <pr-icon icon="'alert-triangle'"></pr-icon>
+              A registry with the same name already exists.
+            </p>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>
+  <!-- !name-input -->
+  <!-- url-input -->
+  <div class="form-group">
+    <label for="registry_url" class="col-sm-3 col-lg-2 control-label required text-left">
+      Registry URL
+      <portainer-tooltip message="'URL or IP address of a Docker registry. Any protocol and trailing slash will be stripped if present.'"></portainer-tooltip>
+    </label>
+    <div class="col-sm-9 col-lg-10">
+      <input
+        type="text"
+        class="form-control"
+        id="registry_url"
+        name="registry_url"
+        ng-model="$ctrl.model.URL"
+        placeholder="10.0.0.10:5000 or myregistry.domain.tld"
+        required
+        data-cy="component-registryUrlInput"
+      />
+      <div class="help-block" ng-show="$ctrl.registryFormCustom.registry_url.$invalid">
+        <div class="small text-warning">
+          <div ng-messages="$ctrl.registryFormCustom.registry_url.$error">
+            <p ng-message="required" class="vertical-center">
+              <pr-icon icon="'alert-triangle'"></pr-icon>
+              This field is required.
+            </p>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>
+  <!-- url-input -->
+  <!-- authentication-checkbox -->
+  <div class="form-group">
+    <div class="col-sm-12">
+      <por-switch-field
+        label="'Authentication'"
+        label-class="'col-sm-3 col-lg-2'"
+        tooltip="'Enable this option if you need to specify credentials to connect to this registry.'"
+        name="'administrator'"
+        checked="$ctrl.model.Authentication"
+        on-change="($ctrl.toggleAuthentication)"
+        label-class="'col-sm-2'"
+      ></por-switch-field>
+    </div>
+  </div>
+  <!-- !authentication-checkbox -->
+  <div ng-if="$ctrl.model.Authentication">
+    <!-- credentials-user -->
+    <div class="form-group">
+      <label for="registry_username" class="col-sm-3 col-lg-2 control-label required text-left">Username</label>
+      <div class="col-sm-9 col-lg-10">
+        <input
+          type="text"
+          class="form-control"
+          id="registry_username"
+          name="registry_username"
+          ng-model="$ctrl.model.Username"
+          required
+          data-cy="component-registryUsernameInput"
+        />
+        <div class="help-block" ng-show="$ctrl.registryFormCustom.registry_username.$invalid">
+          <div class="small text-warning">
+            <div ng-messages="$ctrl.registryFormCustom.registry_username.$error">
+              <p ng-message="required" class="vertical-center">
+                <pr-icon icon="'alert-triangle'"></pr-icon>
+                This field is required.
+              </p>
+            </div>
+          </div>
+        </div>
+      </div>
+    </div>
+    <!-- !credentials-user -->
+    <!-- credentials-password -->
+    <div class="form-group">
+      <label for="registry_password" class="col-sm-3 col-lg-2 control-label required text-left">Password</label>
+      <div class="col-sm-9 col-lg-10">
+        <input type="password" class="form-control" id="registry_password" name="registry_password" ng-model="$ctrl.model.Password" required />
+        <div class="help-block" ng-show="$ctrl.registryFormCustom.registry_password.$invalid">
+          <div class="small text-warning">
+            <div ng-messages="$ctrl.registryFormCustom.registry_password.$error">
+              <p ng-message="required" class="vertical-center">
+                <pr-icon icon="'alert-triangle'"></pr-icon>
+                This field is required.
+              </p>
+            </div>
+          </div>
+        </div>
+      </div>
+    </div>
+    <!-- !credentials-password -->
+  </div>
+  <!-- actions -->
+  <div class="col-sm-12 form-section-title"> Actions </div>
+  <div class="form-group">
+    <div class="col-sm-12">
+      <button
+        type="submit"
+        class="btn btn-primary btn-sm"
+        ng-disabled="$ctrl.actionInProgress || !$ctrl.registryFormCustom.$valid"
+        button-spinner="$ctrl.actionInProgress"
+        analytics-on
+        analytics-category="portainer"
+        analytics-event="portainer-registry-creation"
+        analytics-properties="{ metadata: { type: 'custom' }}"
+      >
+        <span ng-hide="$ctrl.actionInProgress">{{ $ctrl.formActionLabel }}</span>
+        <span ng-show="$ctrl.actionInProgress">In progress...</span>
+      </button>
+    </div>
+  </div>
+  <!-- !actions -->
+</form>
diff --git a/app/portainer/components/forms/registry-form-custom/registry-form-custom.js b/app/portainer/components/forms/registry-form-custom/registry-form-custom.js
new file mode 100644
index 0000000..c0e56e7
--- /dev/null
+++ b/app/portainer/components/forms/registry-form-custom/registry-form-custom.js
@@ -0,0 +1,28 @@
+class controller {
+  constructor($scope) {
+    this.$scope = $scope;
+    this.toggleAuthentication = this.toggleAuthentication.bind(this);
+  }
+
+  $postLink() {
+    this.registryFormCustom.registry_name.$validators.used = (modelValue) => !this.nameIsUsed(modelValue);
+  }
+
+  toggleAuthentication(newValue) {
+    this.$scope.$evalAsync(() => {
+      this.model.Authentication = newValue;
+    });
+  }
+}
+
+angular.module('portainer.app').component('registryFormCustom', {
+  templateUrl: './registry-form-custom.html',
+  bindings: {
+    model: '=',
+    formAction: '<',
+    formActionLabel: '@',
+    actionInProgress: '<',
+    nameIsUsed: '<',
+  },
+  controller,
+});
diff --git a/app/portainer/components/forms/registry-form-gitlab/registry-form-gitlab.controller.js b/app/portainer/components/forms/registry-form-gitlab/registry-form-gitlab.controller.js
new file mode 100644
index 0000000..1b83bbd
--- /dev/null
+++ b/app/portainer/components/forms/registry-form-gitlab/registry-form-gitlab.controller.js
@@ -0,0 +1,12 @@
+/* @ngInject */
+export default function RegistryFormGitlab($scope) {
+  this.selectedRegistries = [];
+
+  this.onChangeRegistries = onChangeRegistries.bind(this);
+
+  function onChangeRegistries(value) {
+    $scope.$evalAsync(() => {
+      this.selectedRegistries = value;
+    });
+  }
+}
diff --git a/app/portainer/components/forms/registry-form-gitlab/registry-form-gitlab.html b/app/portainer/components/forms/registry-form-gitlab/registry-form-gitlab.html
new file mode 100644
index 0000000..370498c
--- /dev/null
+++ b/app/portainer/components/forms/registry-form-gitlab/registry-form-gitlab.html
@@ -0,0 +1,172 @@
+<form class="form-horizontal" name="registryFormGitlab" ng-submit="$ctrl.retrieveRegistries()">
+  <div class="col-sm-12 form-section-title"> Important notice </div>
+  <div class="form-group">
+    <span class="col-sm-12 text-muted small">
+      <p>
+        For information on how to generate a GitLab Personal Access Token, follow the
+        <a href="https://gitlab.com/help/user/profile/personal_access_tokens.md" target="_blank">GitLab guide</a>.
+      </p>
+    </span>
+  </div>
+  <div class="col-sm-12 form-section-title"> GitLab registry connection details </div>
+  <!-- credentials-user -->
+  <div class="form-group">
+    <label for="registry_username" class="col-sm-3 col-lg-2 control-label required text-left">Username</label>
+    <div class="col-sm-9 col-lg-10">
+      <input type="text" class="form-control" id="registry_username" name="registry_username" ng-model="$ctrl.model.Username" required data-cy="registry-username-input" />
+      <div class="help-block" ng-show="registryFormGitlab.registry_username.$invalid">
+        <div class="small text-warning">
+          <div ng-messages="registryFormGitlab.registry_username.$error">
+            <p ng-message="required" class="vertical-center">
+              <pr-icon icon="'alert-triangle'"></pr-icon>
+              This field is required.
+            </p>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>
+  <!-- !credentials-user -->
+  <!-- credentials-pat -->
+  <div class="form-group">
+    <label for="registry_perso_acc_token" class="col-sm-3 col-lg-2 control-label required text-left">Personal Access Token </label>
+    <div class="col-sm-9 col-lg-10">
+      <input type="password" class="form-control" id="registry_perso_acc_token" name="registry_perso_acc_token" ng-model="$ctrl.model.Token" required />
+      <div class="help-block" ng-show="registryFormGitlab.registry_perso_acc_token.$invalid">
+        <div class="small text-warning">
+          <div ng-messages="registryFormGitlab.registry_perso_acc_token.$error">
+            <p ng-message="required" class="vertical-center">
+              <pr-icon icon="'alert-triangle'"></pr-icon>
+              This field is required.
+            </p>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>
+  <!-- !credentials-pat -->
+
+  <div class="form-group">
+    <div class="col-sm-12">
+      <button
+        type="button"
+        class="btn btn-link btn-sm !ml-0 p-0 hover:no-underline"
+        ng-if="!$ctrl.state.overrideConfiguration"
+        ng-click="$ctrl.state.overrideConfiguration = true;"
+      >
+        <pr-icon icon="'wrench'"></pr-icon>
+        Override default configuration
+      </button>
+      <button
+        type="button"
+        class="btn btn-link btn-sm !ml-0 p-0 hover:no-underline"
+        ng-if="$ctrl.state.overrideConfiguration"
+        ng-click="$ctrl.state.overrideConfiguration = false; $ctrl.resetDefaults()"
+      >
+        <pr-icon icon="'settings'"></pr-icon>
+        Use default configuration
+      </button>
+    </div>
+  </div>
+
+  <!-- url-input -->
+  <div class="form-group" ng-if="$ctrl.state.overrideConfiguration">
+    <label for="instance_url" class="col-sm-3 col-lg-2 control-label required text-left">
+      Instance URL
+      <portainer-tooltip message="'URL of Gitlab instance.'"></portainer-tooltip>
+    </label>
+    <div class="col-sm-9 col-lg-10">
+      <input
+        type="text"
+        class="form-control"
+        id="instance_url"
+        name="instance_url"
+        ng-model="$ctrl.model.Gitlab.InstanceURL"
+        placeholder="https://gitlab.com"
+        required
+        data-cy="instance-url-input"
+      />
+      <div class="help-block" ng-show="registryFormGitlab.instance_url.$invalid">
+        <div class="small text-warning">
+          <div ng-messages="registryFormGitlab.instance_url.$error">
+            <p ng-message="required" class="vertical-center">
+              <pr-icon icon="'alert-triangle'"></pr-icon>
+              This field is required.
+            </p>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>
+  <!-- !url-input -->
+  <!-- url-input -->
+  <div class="form-group" ng-if="$ctrl.state.overrideConfiguration">
+    <label for="registry_url" class="col-sm-3 col-lg-2 control-label required text-left">
+      Registry URL
+      <portainer-tooltip message="'URL of Gitlab registry instance.'"></portainer-tooltip>
+    </label>
+    <div class="col-sm-9 col-lg-10">
+      <input
+        type="text"
+        class="form-control"
+        id="registry_url"
+        name="registry_url"
+        ng-model="$ctrl.model.URL"
+        placeholder="https://registry.gitlab.com"
+        required
+        data-cy="registry-url-input"
+      />
+      <div class="help-block" ng-show="registryFormGitlab.registry_url.$invalid">
+        <div class="small text-warning">
+          <div ng-messages="registryFormGitlab.registry_url.$error">
+            <p ng-message="required" class="vertical-center">
+              <pr-icon icon="'alert-triangle'"></pr-icon>
+              This field is required.
+            </p>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>
+  <!-- !url-input -->
+
+  <div class="form-group">
+    <div class="col-sm-12">
+      <button type="submit" class="btn btn-primary btn-sm" ng-disabled="$ctrl.actionInProgress || !registryFormGitlab.$valid" button-spinner="$ctrl.actionInProgress">
+        <span ng-hide="$ctrl.actionInProgress">Retrieve projects</span>
+        <span ng-show="$ctrl.actionInProgress">In progress...</span>
+      </button>
+    </div>
+  </div>
+</form>
+<div class="form-horizontal" ng-if="$ctrl.projects">
+  <div class="col-sm-12 form-section-title"> GitLab projects </div>
+  <div class="form-group">
+    <span class="col-sm-12 text-muted small"> Select the project's registries you want to manage. Portainer will create one registry for each selected project. </span>
+    <span class="col-sm-12 text-muted small vertical-center">
+      <pr-icon icon="'alert-triangle'" class-name="'icon-warning'"></pr-icon>
+      If you can't select a project, make sure that registry feature is activated on it.
+    </span>
+  </div>
+
+  <gitlab-project-selector dataset="$ctrl.projects" value="$ctrl.selectedRegistries" on-change="($ctrl.onChangeRegistries)"></gitlab-project-selector>
+
+  <div class="form-group">
+    <div class="col-sm-12">
+      <button
+        ng-click="$ctrl.createRegistries($ctrl.selectedRegistries)"
+        class="btn btn-primary btn-sm"
+        ng-disabled="$ctrl.actionInProgress || !$ctrl.selectedRegistries.length"
+        button-spinner="$ctrl.actionInProgress"
+        analytics-on
+        analytics-category="portainer"
+        analytics-event="portainer-registry-creation"
+        analytics-properties="{ metadata: { type: 'gitlab' } }"
+      >
+        <span ng-hide="$ctrl.actionInProgress">Create registries</span>
+        <span ng-show="$ctrl.actionInProgress">In progress...</span>
+      </button>
+    </div>
+  </div>
+  <!-- !actions -->
+</div>
diff --git a/app/portainer/components/forms/registry-form-gitlab/registry-form-gitlab.js b/app/portainer/components/forms/registry-form-gitlab/registry-form-gitlab.js
new file mode 100644
index 0000000..13a78fb
--- /dev/null
+++ b/app/portainer/components/forms/registry-form-gitlab/registry-form-gitlab.js
@@ -0,0 +1,15 @@
+import controller from './registry-form-gitlab.controller';
+
+angular.module('portainer.app').component('registryFormGitlab', {
+  templateUrl: './registry-form-gitlab.html',
+  controller,
+  bindings: {
+    model: '=',
+    retrieveRegistries: '<',
+    createRegistries: '<',
+    actionInProgress: '<',
+    projects: '=',
+    state: '=',
+    resetDefaults: '<',
+  },
+});
diff --git a/app/portainer/components/forms/registry-form-proget/registry-form-proget.html b/app/portainer/components/forms/registry-form-proget/registry-form-proget.html
new file mode 100644
index 0000000..3da38e1
--- /dev/null
+++ b/app/portainer/components/forms/registry-form-proget/registry-form-proget.html
@@ -0,0 +1,160 @@
+<form class="form-horizontal" name="$ctrl.registryFormProGet" ng-submit="$ctrl.formAction()">
+  <div class="col-sm-12 form-section-title"> Important notice </div>
+  <div class="form-group">
+    <div class="col-sm-12 text-muted small">
+      Any Portainer user that has access to this registry will be able to use the Registry Manager features against the content of any Feed in the ProGet registry that the ProGet
+      user has access to.
+    </div>
+  </div>
+  <div class="col-sm-12 form-section-title"> ProGet registry details </div>
+  <!-- name-input -->
+  <div class="form-group">
+    <label for="registry_name" class="col-sm-3 col-lg-2 control-label required text-left">Name</label>
+    <div class="col-sm-9 col-lg-10">
+      <input
+        type="text"
+        class="form-control"
+        id="registry_name"
+        name="registry_name"
+        ng-model="$ctrl.model.Name"
+        placeholder="proget-registry"
+        required
+        auto-focus
+        data-cy="registry-name-input"
+      />
+      <div class="help-block" ng-show="$ctrl.registryFormProGet.registry_name.$invalid">
+        <div class="small text-warning">
+          <div ng-messages="$ctrl.registryFormProGet.registry_name.$error">
+            <p ng-message="required" class="vertical-center">
+              <pr-icon icon="'alert-triangle'"></pr-icon>
+              This field is required.
+            </p>
+            <p ng-message="used" class="vertical-center">
+              <pr-icon icon="'alert-triangle'"></pr-icon>
+              A registry with the same name already exists.
+            </p>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>
+  <!-- !name-input -->
+  <!-- url-input -->
+  <div class="form-group">
+    <label for="registry_url" class="col-sm-3 col-lg-2 control-label text-left">
+      <span class="required">Registry URL</span>
+      <portainer-tooltip message="'The URL of the ProGet registry including the Feed name'"></portainer-tooltip>
+    </label>
+    <div class="col-sm-9 col-lg-10">
+      <input
+        type="text"
+        class="form-control"
+        id="registry_url"
+        name="registry_url"
+        ng-model="$ctrl.model.URL"
+        placeholder="proget.example.com/example-registry"
+        required
+        data-cy="registry-url-input"
+      />
+      <div class="help-block" ng-show="$ctrl.registryFormProGet.registry_url.$invalid">
+        <div class="small text-warning">
+          <div ng-messages="$ctrl.registryFormProGet.registry_url.$error">
+            <p ng-message="required" class="vertical-center">
+              <pr-icon icon="'alert-triangle'"></pr-icon>
+              This field is required.
+            </p>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>
+  <!-- url-input -->
+  <!-- base-url-input -->
+  <div class="form-group">
+    <label for="registry_base_url" class="col-sm-3 col-lg-2 control-label text-left">
+      <span class="required">Base URL</span>
+      <portainer-tooltip message="'The base URL of the ProGet registry'"></portainer-tooltip>
+    </label>
+    <div class="col-sm-9 col-lg-10">
+      <input
+        type="text"
+        class="form-control"
+        id="registry_base_url"
+        name="registry_base_url"
+        ng-model="$ctrl.model.BaseURL"
+        placeholder="proget.example.com"
+        required
+        data-cy="registry-base-url-input"
+      />
+      <div class="help-block" ng-show="$ctrl.registryFormProGet.registry_base_url.$invalid">
+        <div class="small text-warning">
+          <div ng-messages="$ctrl.registryFormProGet.registry_base_url.$error">
+            <p ng-message="required" class="vertical-center">
+              <pr-icon icon="'alert-triangle'"></pr-icon>
+              This field is required.
+            </p>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>
+  <!-- !base-url-input -->
+  <div>
+    <!-- credentials-user -->
+    <div class="form-group">
+      <label for="registry_username" class="col-sm-3 col-lg-2 control-label required text-left">Username</label>
+      <div class="col-sm-9 col-lg-10">
+        <input type="text" class="form-control" id="registry_username" name="registry_username" ng-model="$ctrl.model.Username" required data-cy="registry-username-input" />
+        <div class="help-block" ng-show="$ctrl.registryFormProGet.registry_username.$invalid">
+          <div class="small text-warning">
+            <div ng-messages="$ctrl.registryFormProGet.registry_username.$error">
+              <p ng-message="required" class="vertical-center">
+                <pr-icon icon="'alert-triangle'"></pr-icon>
+                This field is required.
+              </p>
+            </div>
+          </div>
+        </div>
+      </div>
+    </div>
+    <!-- !credentials-user -->
+    <!-- credentials-password -->
+    <div class="form-group">
+      <label for="registry_password" class="col-sm-3 col-lg-2 control-label required text-left">Password</label>
+      <div class="col-sm-9 col-lg-10">
+        <input type="password" class="form-control" id="registry_password" name="registry_password" ng-model="$ctrl.model.Password" required />
+        <div class="help-block" ng-show="$ctrl.registryFormProGet.registry_password.$invalid">
+          <div class="small text-warning">
+            <div ng-messages="$ctrl.registryFormProGet.registry_password.$error">
+              <p ng-message="required" class="vertical-center">
+                <pr-icon icon="'alert-triangle'"></pr-icon>
+                This field is required.
+              </p>
+            </div>
+          </div>
+        </div>
+      </div>
+    </div>
+    <!-- !credentials-password -->
+  </div>
+  <!-- actions -->
+  <div class="col-sm-12 form-section-title"> Actions </div>
+  <div class="form-group">
+    <div class="col-sm-12">
+      <button
+        type="submit"
+        class="btn btn-primary btn-sm"
+        ng-disabled="$ctrl.actionInProgress || !$ctrl.registryFormProGet.$valid"
+        button-spinner="$ctrl.actionInProgress"
+        analytics-on
+        analytics-category="portainer"
+        analytics-event="portainer-registry-creation"
+        analytics-properties="{ metadata: { type: 'proget' } }"
+      >
+        <span ng-hide="$ctrl.actionInProgress">{{ $ctrl.formActionLabel }}</span>
+        <span ng-show="$ctrl.actionInProgress">In progress...</span>
+      </button>
+    </div>
+  </div>
+  <!-- !actions -->
+</form>
diff --git a/app/portainer/components/forms/registry-form-proget/registry-form-proget.js b/app/portainer/components/forms/registry-form-proget/registry-form-proget.js
new file mode 100644
index 0000000..46df5ac
--- /dev/null
+++ b/app/portainer/components/forms/registry-form-proget/registry-form-proget.js
@@ -0,0 +1,17 @@
+class controller {
+  $postLink() {
+    this.registryFormProGet.registry_name.$validators.used = (modelValue) => !this.nameIsUsed(modelValue);
+  }
+}
+
+angular.module('portainer.app').component('registryFormProget', {
+  templateUrl: './registry-form-proget.html',
+  bindings: {
+    model: '=',
+    formAction: '<',
+    formActionLabel: '@',
+    actionInProgress: '<',
+    nameIsUsed: '<',
+  },
+  controller,
+});
diff --git a/app/portainer/components/forms/registry-form-quay/registry-form-quay.html b/app/portainer/components/forms/registry-form-quay/registry-form-quay.html
new file mode 100644
index 0000000..6253eee
--- /dev/null
+++ b/app/portainer/components/forms/registry-form-quay/registry-form-quay.html
@@ -0,0 +1,132 @@
+<form class="form-horizontal" name="$ctrl.registryFormQuay" ng-submit="$ctrl.formAction()">
+  <div class="col-sm-12 form-section-title"> Quay account details </div>
+  <!-- name-input -->
+  <div class="form-group">
+    <label for="registry_name" class="col-sm-3 col-lg-2 control-label required text-left">Name</label>
+    <div class="col-sm-9 col-lg-10">
+      <input type="text" class="form-control" id="registry_name" name="registry_name" ng-model="$ctrl.model.Name" placeholder="Quay" required data-cy="registry-name-input" />
+      <div class="help-block" ng-show="$ctrl.registryFormQuay.registry_name.$invalid">
+        <div class="small text-warning">
+          <div ng-messages="$ctrl.registryFormQuay.registry_name.$error">
+            <p ng-message="required" class="vertical-center">
+              <pr-icon icon="'alert-triangle'"></pr-icon>
+              This field is required.
+            </p>
+            <p ng-message="used" class="vertical-center">
+              <pr-icon icon="'alert-triangle'"></pr-icon>
+              A registry with the same name already exists.
+            </p>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>
+  <!-- !name-input -->
+  <!-- credentials-user -->
+  <div class="form-group">
+    <label for="registry_username" class="col-sm-3 col-lg-2 control-label required text-left">Username</label>
+    <div class="col-sm-9 col-lg-10">
+      <input
+        type="text"
+        class="form-control"
+        id="registry_username"
+        name="registry_username"
+        ng-model="$ctrl.model.Username"
+        required
+        auto-focus
+        data-cy="registry-username-input"
+      />
+      <div class="help-block" ng-show="$ctrl.registryFormQuay.registry_username.$invalid">
+        <div class="small text-warning">
+          <div ng-messages="$ctrl.registryFormQuay.registry_username.$error">
+            <p ng-message="required" class="vertical-center">
+              <pr-icon icon="'alert-triangle'"></pr-icon>
+              This field is required.
+            </p>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>
+  <!-- !credentials-user -->
+  <!-- credentials-password -->
+  <div class="form-group">
+    <label for="registry_password" class="col-sm-3 col-lg-2 control-label required text-left">Password</label>
+    <div class="col-sm-9 col-lg-10">
+      <input type="password" class="form-control" id="registry_password" name="registry_password" ng-model="$ctrl.model.Password" required />
+      <div class="help-block" ng-show="$ctrl.registryFormQuay.registry_password.$invalid">
+        <div class="small text-warning">
+          <div ng-messages="$ctrl.registryFormQuay.registry_password.$error">
+            <p ng-message="required" class="vertical-center">
+              <pr-icon icon="'alert-triangle'"></pr-icon>
+              This field is required.
+            </p>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>
+  <!-- !credentials-password -->
+
+  <!-- organization-checkbox -->
+  <div class="form-group">
+    <div class="col-sm-12">
+      <por-switch-field
+        label="'Use organization registry'"
+        checked="$ctrl.model.Quay.useOrganisation"
+        on-change="($ctrl.toggleOrganisation)"
+        label-class="'col-sm-2'"
+      ></por-switch-field>
+    </div>
+  </div>
+  <!-- !organisation-checkbox -->
+  <div ng-if="$ctrl.model.Quay.useOrganisation">
+    <!-- organisation_name -->
+    <div class="form-group">
+      <label for="organisation_name" class="col-sm-3 col-lg-2 control-label required text-left">Organization name</label>
+      <div class="col-sm-9 col-lg-10">
+        <input
+          type="text"
+          class="form-control"
+          id="organisation_name"
+          name="organisation_name"
+          ng-model="$ctrl.model.Quay.organisationName"
+          required
+          data-cy="registry-organisation-name-input"
+        />
+        <div class="help-block" ng-show="$ctrl.registryFormQuay.organisation_name.$invalid">
+          <div class="small text-warning">
+            <div ng-messages="$ctrl.registryFormQuay.organisation_name.$error">
+              <p ng-message="required" class="vertical-center">
+                <pr-icon icon="'alert-triangle'"></pr-icon>
+                This field is required.
+              </p>
+            </div>
+          </div>
+        </div>
+      </div>
+    </div>
+    <!-- !organisation_name -->
+  </div>
+
+  <!-- actions -->
+  <div class="col-sm-12 form-section-title"> Actions </div>
+  <div class="form-group">
+    <div class="col-sm-12">
+      <button
+        type="submit"
+        class="btn btn-primary btn-sm"
+        ng-disabled="$ctrl.actionInProgress || !$ctrl.registryFormQuay.$valid"
+        button-spinner="$ctrl.actionInProgress"
+        analytics-on
+        analytics-category="portainer"
+        analytics-event="portainer-registry-creation"
+        analytics-properties="{ metadata: { type: 'quay' } }"
+      >
+        <span ng-hide="$ctrl.actionInProgress">{{ $ctrl.formActionLabel }}</span>
+        <span ng-show="$ctrl.actionInProgress">In progress...</span>
+      </button>
+    </div>
+  </div>
+  <!-- !actions -->
+</form>
diff --git a/app/portainer/components/forms/registry-form-quay/registry-form-quay.js b/app/portainer/components/forms/registry-form-quay/registry-form-quay.js
new file mode 100644
index 0000000..24869cf
--- /dev/null
+++ b/app/portainer/components/forms/registry-form-quay/registry-form-quay.js
@@ -0,0 +1,28 @@
+class controller {
+  constructor($scope) {
+    this.$scope = $scope;
+    this.toggleOrganisation = this.toggleOrganisation.bind(this);
+  }
+
+  $postLink() {
+    this.registryFormQuay.registry_name.$validators.used = (modelValue) => !this.nameIsUsed(modelValue);
+  }
+
+  toggleOrganisation(newValue) {
+    this.$scope.$evalAsync(() => {
+      this.model.Quay.useOrganisation = newValue;
+    });
+  }
+}
+
+angular.module('portainer.app').component('registryFormQuay', {
+  templateUrl: './registry-form-quay.html',
+  bindings: {
+    model: '=',
+    formAction: '<',
+    formActionLabel: '@',
+    actionInProgress: '<',
+    nameIsUsed: '<',
+  },
+  controller,
+});
diff --git a/app/portainer/components/index.js b/app/portainer/components/index.js
new file mode 100644
index 0000000..033af9f
--- /dev/null
+++ b/app/portainer/components/index.js
@@ -0,0 +1,16 @@
+import angular from 'angular';
+
+import formComponentsModule from './form-components';
+import porAccessManagementModule from './accessManagement';
+import widgetModule from './widget';
+import { boxSelectorModule } from './BoxSelector';
+
+import { beFeatureIndicator } from './BEFeatureIndicator';
+import { InformationPanelAngular } from './InformationPanel';
+import { gitFormModule } from './forms/git-form';
+import { tlsFieldsetModule } from './tls-fieldset';
+
+export default angular
+  .module('portainer.app.components', [boxSelectorModule, widgetModule, gitFormModule, porAccessManagementModule, formComponentsModule, tlsFieldsetModule])
+  .component('informationPanel', InformationPanelAngular)
+  .component('beFeatureIndicator', beFeatureIndicator).name;
diff --git a/app/portainer/components/onEnterKey.js b/app/portainer/components/onEnterKey.js
new file mode 100644
index 0000000..d02e6d7
--- /dev/null
+++ b/app/portainer/components/onEnterKey.js
@@ -0,0 +1,19 @@
+angular.module('portainer.app').directive('onEnterKey', [
+  function porOnEnterKey() {
+    var directive = {
+      restrict: 'A',
+      link: function (scope, element, attrs) {
+        element.bind('keydown keypress', function (e) {
+          if (e.which === 13) {
+            e.preventDefault();
+            scope.$apply(function () {
+              scope.$eval(attrs.onEnterKey);
+            });
+          }
+        });
+      },
+    };
+
+    return directive;
+  },
+]);
diff --git a/app/portainer/components/option-panel/index.js b/app/portainer/components/option-panel/index.js
new file mode 100644
index 0000000..f06f27a
--- /dev/null
+++ b/app/portainer/components/option-panel/index.js
@@ -0,0 +1,13 @@
+import angular from 'angular';
+
+import controller from './option-panel.controller.js';
+
+angular.module('portainer.app').component('optionPanel', {
+  templateUrl: './option-panel.html',
+  controller,
+  bindings: {
+    ngModel: '<',
+    explanation: '@',
+    onChange: '<',
+  },
+});
diff --git a/app/portainer/components/option-panel/option-panel.controller.js b/app/portainer/components/option-panel/option-panel.controller.js
new file mode 100644
index 0000000..f1b8fed
--- /dev/null
+++ b/app/portainer/components/option-panel/option-panel.controller.js
@@ -0,0 +1,10 @@
+export default class OptionPanelController {
+  /* @ngInject */
+  constructor() {
+    this.switchPruneService = this.switchPruneService.bind(this);
+  }
+
+  switchPruneService() {
+    this.onChange(this.ngModel);
+  }
+}
diff --git a/app/portainer/components/option-panel/option-panel.html b/app/portainer/components/option-panel/option-panel.html
new file mode 100644
index 0000000..d52cea9
--- /dev/null
+++ b/app/portainer/components/option-panel/option-panel.html
@@ -0,0 +1,15 @@
+<ng-form class="form-horizontal" name="$ctrl.optionForm">
+  <div class="form-group">
+    <div class="col-sm-12 form-section-title" style="margin-top: 10px; margin-left: 15px; width: 98%"> Options </div>
+
+    <!-- Prune service -->
+    <div class="col-sm-12">
+      <label class="control-label text-left">
+        Prune services
+        <portainer-tooltip position="'top'" message="'Prune services that are no longer referenced.'"></portainer-tooltip>
+      </label>
+      <label class="switch" style="margin-left: 20px"> <input type="checkbox" ng-model="$ctrl.ngModel.Prune" ng-change="$ctrl.switchPruneService()" /><i></i> </label>
+    </div>
+    <!-- !Prune service -->
+  </div>
+</ng-form>
diff --git a/app/portainer/components/product-list/product-item/product-item.js b/app/portainer/components/product-list/product-item/product-item.js
new file mode 100644
index 0000000..fd0fe06
--- /dev/null
+++ b/app/portainer/components/product-list/product-item/product-item.js
@@ -0,0 +1,7 @@
+angular.module('portainer.app').component('productItem', {
+  templateUrl: './productItem.html',
+  bindings: {
+    model: '<',
+    goTo: '<',
+  },
+});
diff --git a/app/portainer/components/product-list/product-item/productItem.html b/app/portainer/components/product-list/product-item/productItem.html
new file mode 100644
index 0000000..9e48829
--- /dev/null
+++ b/app/portainer/components/product-list/product-item/productItem.html
@@ -0,0 +1,34 @@
+<!-- extension -->
+<div class="blocklist-item" ng-click="$ctrl.goTo($ctrl.model)">
+  <div class="blocklist-item-box">
+    <!-- extension-image -->
+    <span class="blocklist-item-logo">
+      <img class="blocklist-item-logo" ng-if="$ctrl.model.Id == 1 || $ctrl.model.Id == 2 || $ctrl.model.Id == 3" src="~@/assets/images/support_1.png" />
+      <img class="blocklist-item-logo" ng-if="$ctrl.model.Id == 4 || $ctrl.model.Id == 5" src="~@/assets/images/support_2.png" />
+    </span>
+    <!-- !extension-image -->
+    <!-- extension-details -->
+    <span class="col-sm-12">
+      <!-- blocklist-item-line1 -->
+      <div class="blocklist-item-line">
+        <span>
+          <span class="blocklist-item-title">
+            {{ $ctrl.model.Name }}
+          </span>
+        </span>
+      </div>
+      <!-- !blocklist-item-line1 -->
+      <!-- blocklist-item-line2 -->
+      <div class="blocklist-item-line">
+        <span>
+          <span class="blocklist-item-desc">
+            {{ $ctrl.model.ShortDescription }}
+          </span>
+        </span>
+      </div>
+      <!-- !blocklist-item-line2 -->
+    </span>
+    <!-- !extension-details -->
+  </div>
+  <!-- !extension -->
+</div>
diff --git a/app/portainer/components/product-list/product-list.js b/app/portainer/components/product-list/product-list.js
new file mode 100644
index 0000000..ac3a6b5
--- /dev/null
+++ b/app/portainer/components/product-list/product-list.js
@@ -0,0 +1,8 @@
+angular.module('portainer.app').component('productList', {
+  templateUrl: './productList.html',
+  bindings: {
+    titleText: '@',
+    products: '<',
+    goTo: '<',
+  },
+});
diff --git a/app/portainer/components/product-list/productList.html b/app/portainer/components/product-list/productList.html
new file mode 100644
index 0000000..5bdb44e
--- /dev/null
+++ b/app/portainer/components/product-list/productList.html
@@ -0,0 +1,16 @@
+<div class="datatable">
+  <rd-widget>
+    <rd-widget-body classes="no-padding">
+      <div class="toolBar">
+        <div class="toolBarTitle">
+          <pr-icon icon="'zap'" class-name="'mr-0.5'"></pr-icon>
+          {{ $ctrl.titleText }}
+        </div>
+      </div>
+
+      <div class="blocklist">
+        <product-item ng-repeat="product in $ctrl.products" model="product" go-to="$ctrl.goTo"></product-item>
+      </div>
+    </rd-widget-body>
+  </rd-widget>
+</div>
diff --git a/app/portainer/components/registry-details/index.js b/app/portainer/components/registry-details/index.js
new file mode 100644
index 0000000..418c487
--- /dev/null
+++ b/app/portainer/components/registry-details/index.js
@@ -0,0 +1,10 @@
+import angular from 'angular';
+
+export const registryDetails = {
+  templateUrl: './registry-details.html',
+  bindings: {
+    registry: '<',
+  },
+};
+
+angular.module('portainer.app').component('registryDetails', registryDetails);
diff --git a/app/portainer/components/registry-details/registry-details.html b/app/portainer/components/registry-details/registry-details.html
new file mode 100644
index 0000000..3c53bca
--- /dev/null
+++ b/app/portainer/components/registry-details/registry-details.html
@@ -0,0 +1,25 @@
+<div class="row" ng-if="$ctrl.registry">
+  <div class="col-lg-12 col-md-12 col-xs-12">
+    <rd-widget>
+      <rd-widget-header icon="radio" title-text="Registry"></rd-widget-header>
+      <rd-widget-body classes="no-padding">
+        <table class="table">
+          <tbody>
+            <tr>
+              <td>Name</td>
+              <td>
+                {{ $ctrl.registry.Name }}
+              </td>
+            </tr>
+            <tr>
+              <td>URL</td>
+              <td>
+                {{ $ctrl.registry.URL }}
+              </td>
+            </tr>
+          </tbody>
+        </table>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
diff --git a/app/portainer/components/slider/slider.html b/app/portainer/components/slider/slider.html
new file mode 100644
index 0000000..94cb04a
--- /dev/null
+++ b/app/portainer/components/slider/slider.html
@@ -0,0 +1,3 @@
+<div>
+  <rzslider rz-slider-options="$ctrl.options" rz-slider-model="$ctrl.model"></rzslider>
+</div>
diff --git a/app/portainer/components/slider/slider.js b/app/portainer/components/slider/slider.js
new file mode 100644
index 0000000..c57f040
--- /dev/null
+++ b/app/portainer/components/slider/slider.js
@@ -0,0 +1,12 @@
+angular.module('portainer.app').component('slider', {
+  templateUrl: './slider.html',
+  controller: 'SliderController',
+  bindings: {
+    model: '=',
+    onChange: '<',
+    floor: '<',
+    ceil: '<',
+    step: '<',
+    precision: '<',
+  },
+});
diff --git a/app/portainer/components/slider/sliderController.js b/app/portainer/components/slider/sliderController.js
new file mode 100644
index 0000000..4ac47d9
--- /dev/null
+++ b/app/portainer/components/slider/sliderController.js
@@ -0,0 +1,45 @@
+// TODO: k8s merge - TEST WITH EXISTING SLIDERS !
+// Not sure if this is not breaking existing sliders on docker views
+// Or sliders with onChange call (docker service update view)
+import angular from 'angular';
+
+class SliderController {
+  /* @ngInject */
+  constructor($scope) {
+    this.$scope = $scope;
+
+    this.buildOptions = this.buildOptions.bind(this);
+    this.translate = this.translate.bind(this);
+  }
+
+  $onChanges() {
+    this.buildOptions();
+  }
+
+  translate(value, sliderId, label) {
+    if ((label === 'floor' && this.floor === 0) || value === 0) {
+      return 'unlimited';
+    }
+    return value;
+  }
+
+  buildOptions() {
+    this.options = {
+      floor: this.floor,
+      ceil: this.ceil,
+      step: this.step,
+      precision: this.precision,
+      showSelectionBar: true,
+      enforceStep: false,
+      translate: this.translate,
+      onChange: () => this.onChange(),
+    };
+  }
+
+  $onInit() {
+    this.buildOptions();
+  }
+}
+
+export default SliderController;
+angular.module('portainer.app').controller('SliderController', SliderController);
diff --git a/app/portainer/components/template-widget.js b/app/portainer/components/template-widget.js
new file mode 100644
index 0000000..fb989fd
--- /dev/null
+++ b/app/portainer/components/template-widget.js
@@ -0,0 +1,11 @@
+angular.module('portainer.app').directive('rdTemplateWidget', function rdWidget() {
+  var directive = {
+    scope: {
+      ngModel: '=',
+    },
+    transclude: true,
+    template: '<div class="widget template-widget" id="template-widget" ng-transclude></div>',
+    restrict: 'EA',
+  };
+  return directive;
+});
diff --git a/app/portainer/components/theme/theme-settings.controller.js b/app/portainer/components/theme/theme-settings.controller.js
new file mode 100644
index 0000000..bb614d7
--- /dev/null
+++ b/app/portainer/components/theme/theme-settings.controller.js
@@ -0,0 +1,61 @@
+import { notifyError, notifySuccess } from '@/portainer/services/notifications';
+import { userQueryKeys } from '@/portainer/users/queries/queryKeys';
+import { queryClient } from '@/react-tools/react-query';
+import { options } from '@/react/portainer/account/AccountView/theme-options';
+
+export default class ThemeSettingsController {
+  /* @ngInject */
+  constructor($async, Authentication, ThemeManager, StateManager, UserService) {
+    this.$async = $async;
+    this.Authentication = Authentication;
+    this.ThemeManager = ThemeManager;
+    this.StateManager = StateManager;
+    this.UserService = UserService;
+
+    this.setThemeColor = this.setThemeColor.bind(this);
+  }
+
+  async setThemeColor(color) {
+    return this.$async(async () => {
+      if (color === 'auto' || !color) {
+        this.ThemeManager.autoTheme();
+      } else {
+        this.ThemeManager.setTheme(color);
+      }
+
+      this.state.themeColor = color;
+      this.updateThemeSettings({ color });
+    });
+  }
+
+  async updateThemeSettings(theme) {
+    try {
+      await this.UserService.updateUserTheme(this.state.userId, theme);
+      await queryClient.invalidateQueries(userQueryKeys.user(this.state.userId));
+
+      notifySuccess('Success', 'User theme settings successfully updated');
+    } catch (err) {
+      notifyError('Failure', err, 'Unable to update user theme settings');
+    }
+  }
+
+  $onInit() {
+    return this.$async(async () => {
+      this.state = {
+        userId: null,
+        themeColor: 'auto',
+      };
+
+      this.state.availableThemes = options;
+
+      try {
+        this.state.userId = await this.Authentication.getUserDetails().ID;
+        const user = await this.UserService.user(this.state.userId);
+
+        this.state.themeColor = user.ThemeSettings.color || this.state.themeColor;
+      } catch (err) {
+        notifyError('Failure', err, 'Unable to get user details');
+      }
+    });
+  }
+}
diff --git a/app/portainer/components/theme/theme-settings.html b/app/portainer/components/theme/theme-settings.html
new file mode 100644
index 0000000..6c3065d
--- /dev/null
+++ b/app/portainer/components/theme/theme-settings.html
@@ -0,0 +1,10 @@
+<div class="mt-6">
+  <rd-widget>
+    <rd-widget-header icon="sliders" title-text="User theme"></rd-widget-header>
+    <rd-widget-body>
+      <form class="form-horizontal">
+        <box-selector radio-name="'theme'" value="$ctrl.state.themeColor" options="$ctrl.state.availableThemes" on-change="($ctrl.setThemeColor)"></box-selector>
+      </form>
+    </rd-widget-body>
+  </rd-widget>
+</div>
diff --git a/app/portainer/components/theme/theme-settings.js b/app/portainer/components/theme/theme-settings.js
new file mode 100644
index 0000000..d8d57be
--- /dev/null
+++ b/app/portainer/components/theme/theme-settings.js
@@ -0,0 +1,7 @@
+import angular from 'angular';
+import controller from './theme-settings.controller';
+
+angular.module('portainer.app').component('themeSettings', {
+  templateUrl: './theme-settings.html',
+  controller,
+});
diff --git a/app/portainer/components/tls-fieldset/index.ts b/app/portainer/components/tls-fieldset/index.ts
new file mode 100644
index 0000000..32ab1f8
--- /dev/null
+++ b/app/portainer/components/tls-fieldset/index.ts
@@ -0,0 +1,22 @@
+import angular from 'angular';
+
+import {
+  TLSFieldset,
+  tlsConfigValidation,
+} from '@/react/components/TLSFieldset';
+import { withFormValidation } from '@/react-tools/withFormValidation';
+
+export const ngModule = angular.module(
+  'portainer.app.components.tls-fieldset',
+  []
+);
+
+export const tlsFieldsetModule = ngModule.name;
+
+withFormValidation(
+  ngModule,
+  TLSFieldset,
+  'tlsFieldset',
+  [],
+  tlsConfigValidation
+);
diff --git a/app/portainer/components/widget/index.ts b/app/portainer/components/widget/index.ts
new file mode 100644
index 0000000..eed2348
--- /dev/null
+++ b/app/portainer/components/widget/index.ts
@@ -0,0 +1,17 @@
+import angular from 'angular';
+
+import { rdWidgetBody } from './rd-widget-body';
+import { rdWidget } from './rd-widget';
+import { rdWidgetCustomHeader } from './rd-widget-custom-header';
+import { rdWidgetFooter } from './rd-widget-footer';
+import { rdWidgetTaskbar } from './rd-widget-taskbar';
+import { rdWidgetTitle } from './rd-widget-title';
+
+export default angular
+  .module('portainer.app.components.widget', [])
+  .component('rdWidget', rdWidget)
+  .component('rdWidgetBody', rdWidgetBody)
+  .component('rdWidgetCustomHeader', rdWidgetCustomHeader)
+  .component('rdWidgetFooter', rdWidgetFooter)
+  .component('rdWidgetHeader', rdWidgetTitle)
+  .component('rdWidgetTaskbar', rdWidgetTaskbar).name;
diff --git a/app/portainer/components/widget/rd-widget-body.ts b/app/portainer/components/widget/rd-widget-body.ts
new file mode 100644
index 0000000..7b7370f
--- /dev/null
+++ b/app/portainer/components/widget/rd-widget-body.ts
@@ -0,0 +1,14 @@
+export const rdWidgetBody = {
+  requires: '^rdWidget',
+  bindings: {
+    loading: '@?',
+    classes: '@?',
+  },
+  transclude: true,
+  template: `
+    <div class="widget-body" ng-class="$ctrl.classes">
+      <rd-loading ng-show="$ctrl.loading"></rd-loading>
+      <div ng-hide="$ctrl.loading" class="widget-content" ng-transclude></div>
+    </div>
+  `,
+};
diff --git a/app/portainer/components/widget/rd-widget-custom-header.ts b/app/portainer/components/widget/rd-widget-custom-header.ts
new file mode 100644
index 0000000..c15b2f4
--- /dev/null
+++ b/app/portainer/components/widget/rd-widget-custom-header.ts
@@ -0,0 +1,22 @@
+export const rdWidgetCustomHeader = {
+  requires: '^rdWidget',
+  bindings: {
+    titleText: '=',
+    icon: '=',
+  },
+  transclude: true,
+  template: `
+    <div class="widget-header">
+      <div class="row">
+        <span class="pull-left">
+          <img class="custom-header-ico space-right" ng-src="{{$ctrl.icon}}" ng-if="$ctrl.icon" alt="header-icon"></img>
+          <pr-icon ng-if="!$ctrl.icon" icon="'rocket'"></pr-icon>
+          <span class="text-muted"> {{$ctrl.titleText}} </span>
+        </span>
+        <span class="pull-right col-xs-6 col-sm-4" ng-transclude></span>
+      </div>
+    </div>
+  `,
+};
+
+// a react component wasn't created because WidgetTitle were adjusted to support a custom image
diff --git a/app/portainer/components/widget/rd-widget-footer.ts b/app/portainer/components/widget/rd-widget-footer.ts
new file mode 100644
index 0000000..153d843
--- /dev/null
+++ b/app/portainer/components/widget/rd-widget-footer.ts
@@ -0,0 +1,7 @@
+export const rdWidgetFooter = {
+  requires: '^rdWidget',
+  transclude: true,
+  template: `
+    <div class="widget-footer" ng-transclude></div>
+  `,
+};
diff --git a/app/portainer/components/widget/rd-widget-taskbar.ts b/app/portainer/components/widget/rd-widget-taskbar.ts
new file mode 100644
index 0000000..ac0e1d1
--- /dev/null
+++ b/app/portainer/components/widget/rd-widget-taskbar.ts
@@ -0,0 +1,14 @@
+export const rdWidgetTaskbar = {
+  requires: '^rdWidget',
+  bindings: {
+    classes: '@?',
+  },
+  transclude: true,
+  template: `
+    <div class="widget-header">
+      <div class="row">
+        <div ng-class="$ctrl.classes" ng-transclude></div>
+      </div>
+    </div>
+  `,
+};
diff --git a/app/portainer/components/widget/rd-widget-title.ts b/app/portainer/components/widget/rd-widget-title.ts
new file mode 100644
index 0000000..5f0bb19
--- /dev/null
+++ b/app/portainer/components/widget/rd-widget-title.ts
@@ -0,0 +1,25 @@
+export const rdWidgetTitle = {
+  requires: '^rdWidget',
+  bindings: {
+    titleText: '@',
+    icon: '@',
+    classes: '@?',
+    parentClasses: '@?',
+  },
+  transclude: {
+    title: '?headerTitle',
+  },
+  template: `
+    <div class="widget-header" ng-class="$ctrl.parentClasses">
+      <div class="row">
+        <span ng-class="$ctrl.classes" class="pull-left vertical-center">
+          <div class="widget-icon space-right">
+            <pr-icon icon="$ctrl.icon"></pr-icon>
+          </div>
+          <span ng-transclude="title">{{ $ctrl.titleText }}</span>
+        </span>
+        <span ng-class="$ctrl.classes" class="pull-right" ng-transclude></span>
+      </div>
+    </div>
+`,
+};
diff --git a/app/portainer/components/widget/rd-widget.ts b/app/portainer/components/widget/rd-widget.ts
new file mode 100644
index 0000000..d4cbffc
--- /dev/null
+++ b/app/portainer/components/widget/rd-widget.ts
@@ -0,0 +1,4 @@
+export const rdWidget = {
+  transclude: true,
+  template: `<div class="widget" ng-transclude></div>`,
+};
diff --git a/app/portainer/environments/index.ts b/app/portainer/environments/index.ts
new file mode 100644
index 0000000..d454599
--- /dev/null
+++ b/app/portainer/environments/index.ts
@@ -0,0 +1,3 @@
+import angular from 'angular';
+
+export default angular.module('portainer.environments', []).name;
diff --git a/app/portainer/error.ts b/app/portainer/error.ts
new file mode 100644
index 0000000..806eac0
--- /dev/null
+++ b/app/portainer/error.ts
@@ -0,0 +1,19 @@
+export default class PortainerError extends Error {
+  err?: unknown;
+
+  isPortainerError = true;
+
+  constructor(msg: string, err?: unknown) {
+    super(msg);
+    this.err = err;
+  }
+}
+
+export function isPortainerError(error: unknown): error is PortainerError {
+  return (
+    !!error &&
+    typeof error === 'object' &&
+    'isPortainerError' in error &&
+    (error as PortainerError).isPortainerError
+  );
+}
diff --git a/app/portainer/filters/filters.js b/app/portainer/filters/filters.js
new file mode 100644
index 0000000..2fc52c9
--- /dev/null
+++ b/app/portainer/filters/filters.js
@@ -0,0 +1,112 @@
+import moment from 'moment';
+import _ from 'lodash-es';
+import { filesize } from 'filesize';
+
+export function truncateLeftRight(text, max, left, right) {
+  max = isNaN(max) ? 50 : max;
+  left = isNaN(left) ? 25 : left;
+  right = isNaN(right) ? 25 : right;
+
+  if (text.length <= max) {
+    return text;
+  } else {
+    return text.substring(0, left) + '[...]' + text.substring(text.length - right, text.length);
+  }
+}
+
+export function humanize(bytes, round, base) {
+  if (!round) {
+    round = 1;
+  }
+  if (!base) {
+    base = 10;
+  }
+  if (bytes || bytes === 0) {
+    return filesize(bytes, { base: base, round: round });
+  }
+}
+export const TIME_FORMAT = 'YYYY-MM-DD HH:mm:ss';
+
+export function isoDateFromTimestamp(timestamp) {
+  return moment.unix(timestamp).format(TIME_FORMAT);
+}
+
+export function isoDate(date, format = TIME_FORMAT) {
+  return moment(date).format(format);
+}
+
+export function parseIsoDate(date, format = TIME_FORMAT) {
+  return moment(date, format).toDate();
+}
+
+export function formatDate(date, strFormat = 'YYYY-MM-DD HH:mm:ss Z', outFormat = TIME_FORMAT) {
+  return moment(date, strFormat).format(outFormat);
+}
+
+export function getPairKey(pair, separator) {
+  if (!pair.includes(separator)) {
+    return pair;
+  }
+
+  return pair.slice(0, pair.indexOf(separator));
+}
+
+export function getPairValue(pair, separator) {
+  if (!pair.includes(separator)) {
+    return '';
+  }
+
+  return pair.slice(pair.indexOf(separator) + 1);
+}
+
+export function ipAddress(ip) {
+  return ip.slice(0, ip.indexOf('/'));
+}
+
+export function arrayToStr(arr, separator) {
+  if (arr) {
+    return _.join(arr, separator);
+  }
+  return '';
+}
+
+export function labelsToStr(arr, separator) {
+  if (arr) {
+    return _.join(
+      arr.map((item) => item.key + ':' + item.value),
+      separator
+    );
+  }
+  return '';
+}
+
+export function endpointTypeName(type) {
+  if (type === 1) {
+    return 'Docker';
+  } else if (type === 2 || type === 6) {
+    return 'Agent';
+  } else if (type === 3) {
+    return 'Azure ACI';
+  } else if (type === 5) {
+    return 'Kubernetes';
+  } else if (type === 4 || type === 7) {
+    return 'Edge Agent';
+  }
+  return '';
+}
+
+export function truncate(text, length, end) {
+  if (isNaN(length)) {
+    length = 10;
+  }
+
+  if (end === undefined) {
+    end = '...';
+  }
+
+  if (text.length <= length || text.length - end.length <= length) {
+    return text;
+  } else {
+    return String(text).substring(0, length - end.length) + end;
+  }
+}
diff --git a/app/portainer/filters/index.js b/app/portainer/filters/index.js
new file mode 100644
index 0000000..c8cec82
--- /dev/null
+++ b/app/portainer/filters/index.js
@@ -0,0 +1,24 @@
+import angular from 'angular';
+import _ from 'lodash-es';
+
+import { ownershipIcon } from '@/react/docker/components/datatable/createOwnershipColumn';
+import { stripProtocol } from '@/react/common/string-utils';
+import { arrayToStr, endpointTypeName, getPairKey, getPairValue, humanize, ipAddress, isoDate, isoDateFromTimestamp, labelsToStr, truncate, truncateLeftRight } from './filters';
+
+angular
+  .module('portainer.app')
+  .filter('truncate', () => truncate)
+  .filter('truncatelr', () => truncateLeftRight)
+  .filter('capitalize', () => _.capitalize)
+  .filter('stripprotocol', () => stripProtocol)
+  .filter('humansize', () => humanize)
+  .filter('getisodatefromtimestamp', () => isoDateFromTimestamp)
+  .filter('getisodate', () => isoDate)
+  .filter('key', () => getPairKey)
+  .filter('value', () => getPairValue)
+  .filter('emptyobject', () => _.isEmpty)
+  .filter('ipaddress', () => ipAddress)
+  .filter('arraytostr', () => arrayToStr)
+  .filter('labelsToStr', () => labelsToStr)
+  .filter('endpointtypename', () => endpointTypeName)
+  .filter('ownershipicon', () => ownershipIcon);
diff --git a/app/portainer/helpers/array.ts b/app/portainer/helpers/array.ts
new file mode 100644
index 0000000..f3eec36
--- /dev/null
+++ b/app/portainer/helpers/array.ts
@@ -0,0 +1,15 @@
+export function getValueAsArrayOfStrings(value: unknown): string[] {
+  if (Array.isArray(value)) {
+    return value;
+  }
+
+  if (!value || (typeof value !== 'string' && typeof value !== 'number')) {
+    return [];
+  }
+
+  if (typeof value === 'number') {
+    return [value.toString()];
+  }
+
+  return [value];
+}
diff --git a/app/portainer/helpers/endpointHelper.js b/app/portainer/helpers/endpointHelper.js
new file mode 100644
index 0000000..9e43fbb
--- /dev/null
+++ b/app/portainer/helpers/endpointHelper.js
@@ -0,0 +1,37 @@
+import _ from 'lodash-es';
+import { PortainerEndpointTypes } from '@/portainer/models/endpoint/models';
+
+function findAssociatedGroup(endpoint, groups) {
+  return _.find(groups, function (group) {
+    return group.Id === endpoint.GroupId;
+  });
+}
+
+export default class EndpointHelper {
+  static isDockerEndpoint(endpoint) {
+    return [PortainerEndpointTypes.DockerEnvironment, PortainerEndpointTypes.AgentOnDockerEnvironment, PortainerEndpointTypes.EdgeAgentOnDockerEnvironment].includes(endpoint.Type);
+  }
+
+  static isAgentEndpoint(endpoint) {
+    return [
+      PortainerEndpointTypes.AgentOnDockerEnvironment,
+      PortainerEndpointTypes.EdgeAgentOnDockerEnvironment,
+      PortainerEndpointTypes.AgentOnKubernetesEnvironment,
+      PortainerEndpointTypes.EdgeAgentOnKubernetesEnvironment,
+    ].includes(endpoint.Type);
+  }
+
+  static isEdgeEndpoint(endpoint) {
+    return [PortainerEndpointTypes.EdgeAgentOnDockerEnvironment, PortainerEndpointTypes.EdgeAgentOnKubernetesEnvironment].includes(endpoint.Type);
+  }
+
+  static mapGroupNameToEndpoint(endpoints, groups) {
+    for (var i = 0; i < endpoints.length; i++) {
+      var endpoint = endpoints[i];
+      var group = findAssociatedGroup(endpoint, groups);
+      if (group) {
+        endpoint.GroupName = group.Name;
+      }
+    }
+  }
+}
diff --git a/app/portainer/helpers/formHelper.js b/app/portainer/helpers/formHelper.js
new file mode 100644
index 0000000..dc7d195
--- /dev/null
+++ b/app/portainer/helpers/formHelper.js
@@ -0,0 +1,19 @@
+angular.module('portainer.app').factory('FormHelper', [
+  function FormHelperFactory() {
+    'use strict';
+    var helper = {};
+
+    helper.removeInvalidEnvVars = function (env) {
+      for (var i = env.length - 1; i >= 0; i--) {
+        var envvar = env[i];
+        if (!envvar.name) {
+          env.splice(i, 1);
+        }
+      }
+
+      return env;
+    };
+
+    return helper;
+  },
+]);
diff --git a/app/portainer/helpers/index.ts b/app/portainer/helpers/index.ts
new file mode 100644
index 0000000..ac6cf0a
--- /dev/null
+++ b/app/portainer/helpers/index.ts
@@ -0,0 +1,7 @@
+import angular from 'angular';
+
+import { WebhookHelperFactory } from './webhookHelper';
+
+export const helpersModule = angular
+  .module('portainer.app.helpers', [])
+  .factory('WebhookHelper', WebhookHelperFactory).name;
diff --git a/app/portainer/helpers/json.test.ts b/app/portainer/helpers/json.test.ts
new file mode 100644
index 0000000..6ecf295
--- /dev/null
+++ b/app/portainer/helpers/json.test.ts
@@ -0,0 +1,46 @@
+import { json2formData } from './json';
+
+describe('json2formData', () => {
+  it('should handle undefined and null values', () => {
+    const json = { key1: undefined, key2: null };
+    const formData = json2formData(json);
+    expect(formData.has('key1')).toBe(false);
+    expect(formData.has('key2')).toBe(false);
+  });
+
+  it('should handle File instances', () => {
+    const file = new File([''], 'filename');
+    const json = { key: file };
+    const formData = json2formData(json);
+    expect(formData.get('key')).toBe(file);
+  });
+
+  it('should handle arrays', () => {
+    const json = { key: [1, 2, 3] };
+    const formData = json2formData(json);
+    expect(formData.get('key')).toBe('[1,2,3]');
+  });
+
+  it('should handle objects', () => {
+    const json = { key: { subkey: 'value' } };
+    const formData = json2formData(json);
+    expect(formData.get('key')).toBe('{"subkey":"value"}');
+  });
+
+  it('should handle other types of values', () => {
+    const json = { key1: 'value', key2: 123, key3: true };
+    const formData = json2formData(json);
+    expect(formData.get('key1')).toBe('value');
+    expect(formData.get('key2')).toBe('123');
+    expect(formData.get('key3')).toBe('true');
+  });
+
+  it('should fail when handling circular references', () => {
+    const circularReference = { self: undefined };
+
+    // @ts-expect-error test
+    circularReference.self = circularReference;
+    const json = { key: circularReference };
+    expect(() => json2formData(json)).toThrow();
+  });
+});
diff --git a/app/portainer/helpers/json.ts b/app/portainer/helpers/json.ts
new file mode 100644
index 0000000..d85ee0d
--- /dev/null
+++ b/app/portainer/helpers/json.ts
@@ -0,0 +1,51 @@
+export function arrayToJson<T>(arr?: Array<T>) {
+  if (!arr) {
+    return '';
+  }
+
+  return JSON.stringify(arr);
+}
+
+export function json2formData(json: Record<string, unknown>) {
+  const formData = new FormData();
+
+  Object.entries(json).forEach(([key, value]) => {
+    if (typeof value === 'undefined' || value === null) {
+      return;
+    }
+
+    if (value instanceof File) {
+      formData.append(key, value);
+      return;
+    }
+
+    if (Array.isArray(value)) {
+      formData.append(key, arrayToJson(value));
+      return;
+    }
+
+    if (typeof value === 'object') {
+      formData.append(key, JSON.stringify(value));
+      return;
+    }
+
+    formData.append(key, value.toString());
+  });
+
+  return formData;
+}
+
+/**
+ * The Docker API often returns a list of JSON object.
+ * This handler wrap the JSON objects in an array.
+ * @param data Raw docker API response (stream of objects in a single string)
+ * @returns An array of parsed objects
+ */
+export function jsonObjectsToArrayHandler(data: string): unknown[] {
+  // catching empty data helps the function not to fail and prevents unwanted error message to user.
+  if (!data) {
+    return [];
+  }
+  const str = `[${data.replace(/\n/g, ' ').replace(/\}\s*\{/g, '}, {')}]`;
+  return JSON.parse(str);
+}
diff --git a/app/portainer/helpers/networkHelper.js b/app/portainer/helpers/networkHelper.js
new file mode 100644
index 0000000..e3a15f6
--- /dev/null
+++ b/app/portainer/helpers/networkHelper.js
@@ -0,0 +1,16 @@
+import _ from 'lodash-es';
+import angular from 'angular';
+
+class NetworkHelper {
+  /* @ngInject */
+  constructor(PREDEFINED_NETWORKS) {
+    this.PREDEFINED_NETWORKS = PREDEFINED_NETWORKS;
+  }
+
+  isSystemNetwork(item) {
+    return _.includes(this.PREDEFINED_NETWORKS, item.Name);
+  }
+}
+
+export default NetworkHelper;
+angular.module('portainer.app').service('NetworkHelper', NetworkHelper);
diff --git a/app/portainer/helpers/pathHelper.js b/app/portainer/helpers/pathHelper.js
new file mode 100644
index 0000000..9dfea3f
--- /dev/null
+++ b/app/portainer/helpers/pathHelper.js
@@ -0,0 +1,10 @@
+/**
+ * calculates baseHref
+ *
+ * return [string]
+ *
+ */
+export function baseHref() {
+  const base = document.getElementById('base');
+  return base ? base.getAttribute('href') || '/' : '/';
+}
diff --git a/app/portainer/helpers/promise-utils.test.ts b/app/portainer/helpers/promise-utils.test.ts
new file mode 100644
index 0000000..ccaeb21
--- /dev/null
+++ b/app/portainer/helpers/promise-utils.test.ts
@@ -0,0 +1,24 @@
+import { promiseSequence } from './promise-utils';
+
+describe('promiseSequence', () => {
+  it('should run successfully for an empty list', async () => {
+    await expect(promiseSequence([])).resolves.toBeUndefined();
+  });
+
+  it('provided two promise functions, the second should run after the first', async () => {
+    const callback = vi.fn();
+
+    function first() {
+      return Promise.resolve(callback(1));
+    }
+
+    function second() {
+      return Promise.resolve(callback(2));
+    }
+
+    await promiseSequence([first, second]);
+    expect(callback).toHaveBeenCalledTimes(2);
+    expect(callback).toHaveBeenNthCalledWith(1, 1);
+    expect(callback).toHaveBeenNthCalledWith(2, 2);
+  });
+});
diff --git a/app/portainer/helpers/promise-utils.ts b/app/portainer/helpers/promise-utils.ts
new file mode 100644
index 0000000..98c7731
--- /dev/null
+++ b/app/portainer/helpers/promise-utils.ts
@@ -0,0 +1,69 @@
+/**
+ * runs the provided promises in a sequence, and returns a promise that resolves when all promises have resolved
+ *
+ * @param promises a list of functions that return promises
+ */
+export function promiseSequence(promises: (() => Promise<unknown>)[]) {
+  return promises.reduce(
+    (promise, nextPromise) => promise.then(nextPromise),
+    Promise.resolve(undefined as unknown)
+  );
+}
+
+type AllSettledItems<T> = {
+  fulfilledItems: T[];
+  rejectedItems: { item: T; reason?: string }[];
+};
+
+/**
+ * Separates a list of items into successful and rejected items based on the results of asynchronous operations.
+ * This function is useful for deleting in parallel, or other requests where the response doesn't have much information.
+ *
+ * @template T - The type of the items in the list.
+ * @param {T[]} items - The list of items to process.
+ * @param {(item: T) => Promise<void>} asyncFn - An asynchronous function that takes the item and performs an operation on it.
+ * @returns {Promise<AllSettledItems<T>>} - A promise that resolves to an object containing arrays of successful and rejected items.
+ */
+export async function getAllSettledItems<T>(
+  items: T[],
+  asyncFn: (item: T) => Promise<void>
+): Promise<AllSettledItems<T>> {
+  const results = await Promise.allSettled(items.map((item) => asyncFn(item)));
+
+  // make an array of successful items and an array of rejected items
+  const separatedItems = results.reduce<AllSettledItems<T>>(
+    (acc, result, index) => {
+      if (result.status === 'fulfilled') {
+        acc.fulfilledItems.push(items[index]);
+      } else {
+        const reason =
+          result.reason instanceof Error
+            ? result.reason.message
+            : String(result.reason);
+        acc.rejectedItems.push({ item: items[index], reason });
+      }
+      return acc;
+    },
+    { fulfilledItems: [], rejectedItems: [] }
+  );
+
+  return separatedItems;
+}
+
+export function isFulfilled<T>(
+  result: PromiseSettledResult<T>
+): result is PromiseFulfilledResult<T> {
+  return result.status === 'fulfilled';
+}
+
+export function isRejected<T>(
+  result: PromiseSettledResult<T>
+): result is PromiseRejectedResult {
+  return result.status === 'rejected';
+}
+
+export function getFulfilledResults<T>(
+  results: Array<PromiseSettledResult<T>>
+) {
+  return results.filter(isFulfilled).map((result) => result.value);
+}
diff --git a/app/portainer/helpers/resourceControlHelper.js b/app/portainer/helpers/resourceControlHelper.js
new file mode 100644
index 0000000..08382db
--- /dev/null
+++ b/app/portainer/helpers/resourceControlHelper.js
@@ -0,0 +1,95 @@
+import _ from 'lodash-es';
+import angular from 'angular';
+import { ResourceControlOwnership as RCO } from '@/react/portainer/access-control/types';
+import { ResourceControlOwnershipParameters } from '../models/resourceControl/resourceControlOwnershipParameters';
+
+class ResourceControlHelper {
+  /**
+   * Transform ResourceControlViewModel to ResourceControlOwnershipParameters
+   * @param {int} userId ID of User performing the action
+   * @param {ResourceControlViewModel} resourceControl ResourceControl view model
+   */
+  RCViewModelToOwnershipParameters(userId, resourceControl) {
+    if (!resourceControl) {
+      return new ResourceControlOwnershipParameters(true);
+    }
+    let adminOnly = false;
+    let publicOnly = false;
+    let users = [];
+    let teams = [];
+    switch (resourceControl.Ownership) {
+      case RCO.PUBLIC:
+        publicOnly = true;
+        break;
+      case RCO.PRIVATE:
+        users = [userId];
+        break;
+      case RCO.RESTRICTED:
+        users = _.map(resourceControl.UserAccesses, (user) => user.UserId);
+        teams = _.map(resourceControl.TeamAccesses, (team) => team.TeamId);
+        break;
+      default:
+        adminOnly = true;
+        break;
+    }
+    return new ResourceControlOwnershipParameters(adminOnly, publicOnly, users, teams);
+  }
+
+  /**
+   * Transform AccessControlFormData to ResourceControlOwnershipParameters
+   * @param {int} userId ID of user performing the operation
+   * @param {AccessControlFormData} formValues Form data (generated by AccessControlForm)
+   * @param {int[]} subResources Sub Resources restricted by the ResourceControl
+   */
+  RCFormDataToOwnershipParameters(userId, formValues, subResources = []) {
+    if (!formValues.AccessControlEnabled) {
+      formValues.Ownership = RCO.PUBLIC;
+    }
+
+    let adminOnly = false;
+    let publicOnly = false;
+    let users = [];
+    let teams = [];
+    switch (formValues.Ownership) {
+      case RCO.PUBLIC:
+        publicOnly = true;
+        break;
+      case RCO.PRIVATE:
+        users.push(userId);
+        break;
+      case RCO.RESTRICTED:
+        users = _.map(formValues.AuthorizedUsers, (user) => user.Id);
+        teams = _.map(formValues.AuthorizedTeams, (team) => team.Id);
+        break;
+      default:
+        adminOnly = true;
+        break;
+    }
+    return new ResourceControlOwnershipParameters(adminOnly, publicOnly, users, teams, subResources);
+  }
+
+  retrieveAuthorizedUsers(resourceControl, users) {
+    const authorizedUsers = [];
+    _.forEach(resourceControl.UserAccesses, (access) => {
+      const user = _.find(users, { Id: access.UserId });
+      if (user) {
+        authorizedUsers.push(user);
+      }
+    });
+    return authorizedUsers;
+  }
+
+  retrieveAuthorizedTeams(resourceControl, teams) {
+    const authorizedTeams = [];
+    _.forEach(resourceControl.TeamAccesses, (access) => {
+      const team = _.find(teams, { Id: access.TeamId });
+      if (team) {
+        authorizedTeams.push(team);
+      }
+    });
+    return authorizedTeams;
+  }
+}
+
+export default ResourceControlHelper;
+angular.module('portainer.app').service('ResourceControlHelper', ResourceControlHelper);
diff --git a/app/portainer/helpers/stackHelper.js b/app/portainer/helpers/stackHelper.js
new file mode 100644
index 0000000..cbace44
--- /dev/null
+++ b/app/portainer/helpers/stackHelper.js
@@ -0,0 +1,29 @@
+import _ from 'lodash-es';
+import { ExternalStackViewModel } from '@/react/docker/stacks/view-models/external-stack';
+import { validateYAML } from '@/react/docker/stacks/common/stackYamlValidation';
+
+angular.module('portainer.app').factory('StackHelper', [
+  function StackHelperFactory() {
+    'use strict';
+    var helper = {};
+
+    helper.getExternalStacksFromContainers = function (containers) {
+      return getExternalStacksFromLabel(containers, 'com.docker.compose.project', 2);
+    };
+
+    helper.getExternalStacksFromServices = function (services) {
+      return getExternalStacksFromLabel(services, 'com.docker.stack.namespace', 1);
+    };
+
+    function getExternalStacksFromLabel(items, label, type) {
+      return _.uniqBy(
+        items.filter((item) => item.Labels && item.Labels[label]).map((item) => new ExternalStackViewModel(item.Labels[label], type, item.Created)),
+        'Name'
+      );
+    }
+
+    helper.validateYAML = validateYAML;
+
+    return helper;
+  },
+]);
diff --git a/app/portainer/helpers/stateParamHelper.js b/app/portainer/helpers/stateParamHelper.js
new file mode 100644
index 0000000..2588f45
--- /dev/null
+++ b/app/portainer/helpers/stateParamHelper.js
@@ -0,0 +1,13 @@
+export function filterParam(defaultValue = null) {
+  return { value: defaultValue, squash: true, dynamic: true };
+}
+
+export function paginationParams(defaultSort = 'name') {
+  return {
+    search: filterParam(),
+    sort: filterParam(defaultSort),
+    order: filterParam('asc'),
+    page: filterParam('0'),
+    pageSize: filterParam(),
+  };
+}
diff --git a/app/portainer/helpers/strings.ts b/app/portainer/helpers/strings.ts
new file mode 100644
index 0000000..fb8d69b
--- /dev/null
+++ b/app/portainer/helpers/strings.ts
@@ -0,0 +1,7 @@
+// Re-exporting so we don't have to update one meeeeellion files that are already importing these
+// functions from here.
+export {
+  pluralize,
+  addPlural,
+  grammaticallyJoin,
+} from '@/react/common/string-utils';
diff --git a/app/portainer/helpers/tagHelper.js b/app/portainer/helpers/tagHelper.js
new file mode 100644
index 0000000..555a3ff
--- /dev/null
+++ b/app/portainer/helpers/tagHelper.js
@@ -0,0 +1,7 @@
+import _ from 'lodash';
+
+export function idsToTagNames(tags, ids) {
+  const filteredTags = _.filter(tags, (tag) => _.includes(ids, tag.ID));
+  const tagNames = _.map(filteredTags, 'Name');
+  return tagNames;
+}
diff --git a/app/portainer/helpers/url-utils.test.ts b/app/portainer/helpers/url-utils.test.ts
new file mode 100644
index 0000000..5d6143e
--- /dev/null
+++ b/app/portainer/helpers/url-utils.test.ts
@@ -0,0 +1,51 @@
+import { isValidReturnUrl } from './url-utils';
+
+describe('isValidReturnUrl', () => {
+  const origin = 'http://localhost:9000';
+
+  it('returns false for empty string', () => {
+    expect(isValidReturnUrl('', origin)).toBe(false);
+  });
+
+  it('returns false for cross-origin URLs', () => {
+    expect(isValidReturnUrl('https://evil.com', origin)).toBe(false);
+    expect(isValidReturnUrl('http://evil.com/path', origin)).toBe(false);
+    expect(isValidReturnUrl('//evil.com', origin)).toBe(false);
+    expect(isValidReturnUrl('javascript:alert(1)', origin)).toBe(false);
+  });
+
+  it('rejects backslash / mixed slash-backslash authority tricks', () => {
+    // Browsers (WHATWG URL) treat backslashes as forward slashes in the
+    // authority, so these all resolve to evil.com and must be rejected.
+    expect(isValidReturnUrl('/\\evil.com', origin)).toBe(false);
+    expect(isValidReturnUrl('\\/evil.com', origin)).toBe(false);
+    expect(isValidReturnUrl('\\\\evil.com', origin)).toBe(false);
+    expect(isValidReturnUrl('/\\/evil.com', origin)).toBe(false);
+    expect(isValidReturnUrl('https:\\\\evil.com', origin)).toBe(false);
+  });
+
+  it('treats percent-encoded slashes and single backslash as same-origin paths (not open redirects)', () => {
+    // %2f stays encoded, so the origin remains the app origin — navigating to
+    // http://localhost:9000/%2f%2fevil.com, never to evil.com.
+    expect(isValidReturnUrl('%2f%2fevil.com', origin)).toBe(true);
+    expect(isValidReturnUrl('/%2f%2fevil.com', origin)).toBe(true);
+    // A single leading backslash resolves to /evil.com on the app origin.
+    expect(isValidReturnUrl('\\evil.com', origin)).toBe(true);
+  });
+
+  it('returns true for same-origin paths', () => {
+    expect(isValidReturnUrl('/home', origin)).toBe(true);
+    expect(isValidReturnUrl('/run/page?foo=bar', origin)).toBe(true);
+    expect(isValidReturnUrl('/run/page?foo=bar#section', origin)).toBe(true);
+    expect(isValidReturnUrl('/home?redirect=https://example.com', origin)).toBe(
+      true
+    );
+    expect(isValidReturnUrl('http://localhost:9000/run/page', origin)).toBe(
+      true
+    );
+    expect(isValidReturnUrl('#!/home', origin)).toBe(true);
+    expect(isValidReturnUrl('#!/environments/1/docker/dashboard', origin)).toBe(
+      true
+    );
+  });
+});
diff --git a/app/portainer/helpers/url-utils.ts b/app/portainer/helpers/url-utils.ts
new file mode 100644
index 0000000..1e38132
--- /dev/null
+++ b/app/portainer/helpers/url-utils.ts
@@ -0,0 +1,12 @@
+export function isValidReturnUrl(
+  url: string,
+  origin = window.location.origin
+): boolean {
+  if (!url) return false;
+  try {
+    const parsed = new URL(url, origin);
+    return parsed.origin === origin;
+  } catch {
+    return false;
+  }
+}
diff --git a/app/portainer/helpers/urlHelper.js b/app/portainer/helpers/urlHelper.js
new file mode 100644
index 0000000..1f2902d
--- /dev/null
+++ b/app/portainer/helpers/urlHelper.js
@@ -0,0 +1,32 @@
+angular.module('portainer.app').factory('URLHelper', [
+  '$window',
+  function URLHelperFactory($window) {
+    'use strict';
+    var helper = {};
+
+    helper.getParameter = getParameter;
+    helper.cleanParameters = cleanParameters;
+
+    function getParameter(param) {
+      var parameters = extractParameters();
+      return parameters[param];
+    }
+
+    function extractParameters() {
+      var queryString = $window.location.search.replace(/.*?\?/, '').split('&');
+      return queryString.reduce(function (acc, keyValStr) {
+        var keyVal = keyValStr.split('=');
+        var key = keyVal[0];
+        var val = keyVal[1];
+        acc[key] = val;
+        return acc;
+      }, {});
+    }
+
+    function cleanParameters() {
+      $window.location.replace($window.location.origin + $window.location.pathname + $window.location.hash);
+    }
+
+    return helper;
+  },
+]);
diff --git a/app/portainer/helpers/webhookHelper.ts b/app/portainer/helpers/webhookHelper.ts
new file mode 100644
index 0000000..b0ff5f6
--- /dev/null
+++ b/app/portainer/helpers/webhookHelper.ts
@@ -0,0 +1,58 @@
+import uuid from 'uuid';
+
+import {
+  API_ENDPOINT_EDGE_STACKS,
+  API_ENDPOINT_STACKS,
+  API_ENDPOINT_WEBHOOKS,
+} from '@/constants';
+
+import { baseHref } from './pathHelper';
+
+const baseUrl = getBaseUrl();
+
+export function dockerWebhookUrl(token: string) {
+  return `${baseUrl}${API_ENDPOINT_WEBHOOKS}/${token}`;
+}
+
+export function baseStackWebhookUrl() {
+  return `${baseUrl}${API_ENDPOINT_STACKS}/webhooks`;
+}
+
+export function stackWebhookUrl(token: string) {
+  return `${baseStackWebhookUrl()}/${token}`;
+}
+
+export function createWebhookId() {
+  return uuid();
+}
+
+export function baseEdgeStackWebhookUrl() {
+  return `${baseUrl}${API_ENDPOINT_EDGE_STACKS}/webhooks`;
+}
+
+/* @ngInject */
+export function WebhookHelperFactory() {
+  return {
+    returnWebhookUrl: dockerWebhookUrl,
+    getBaseStackWebhookUrl: baseStackWebhookUrl,
+    returnStackWebhookUrl: stackWebhookUrl,
+  };
+}
+
+function getBaseUrl() {
+  const protocol = window.location.protocol.toLowerCase().replace(':', '');
+
+  if (protocol === 'file') {
+    return baseHref();
+  }
+
+  const { hostname } = window.location;
+  const port = parseInt(window.location.port, 10);
+  const displayPort =
+    (protocol === 'http' && port === 80) ||
+    (protocol === 'https' && port === 443) ||
+    Number.isNaN(port)
+      ? ''
+      : `:${port}`;
+  return `${protocol}://${hostname}${displayPort}${baseHref()}`;
+}
diff --git a/app/portainer/license-management/license.service.ts b/app/portainer/license-management/license.service.ts
new file mode 100644
index 0000000..3385062
--- /dev/null
+++ b/app/portainer/license-management/license.service.ts
@@ -0,0 +1,20 @@
+import {
+  getLicenses,
+  attachLicense,
+  removeLicense,
+  getLicenseInfo,
+  unsubscribe,
+  subscribe,
+} from '@/react/portainer/licenses/license.service';
+
+/* @ngInject */
+export function LicenseService() {
+  return {
+    licenses: getLicenses,
+    attach: attachLicense,
+    remove: removeLicense,
+    info: getLicenseInfo,
+    subscribe,
+    unsubscribe,
+  };
+}
diff --git a/app/portainer/models/access.js b/app/portainer/models/access.js
new file mode 100644
index 0000000..02cd31f
--- /dev/null
+++ b/app/portainer/models/access.js
@@ -0,0 +1,19 @@
+// create UserAccessViewModel from UserViewModel
+export function UserAccessViewModel(data) {
+  this.Id = data.Id;
+  this.Name = data.Username;
+  this.Type = 'user';
+  this.Inherited = false;
+  this.Override = false;
+  this.Role = { Id: 0, Name: '-' };
+}
+
+// create TeamAccessViewModel from TeamViewModel
+export function TeamAccessViewModel(data) {
+  this.Id = data.Id;
+  this.Name = data.Name;
+  this.Type = 'team';
+  this.Inherited = false;
+  this.Override = false;
+  this.Role = { Id: 0, Name: '-' };
+}
diff --git a/app/portainer/models/dockerhub.js b/app/portainer/models/dockerhub.js
new file mode 100644
index 0000000..cc8aeed
--- /dev/null
+++ b/app/portainer/models/dockerhub.js
@@ -0,0 +1,8 @@
+import { RegistryTypes } from './registryTypes';
+
+export function DockerHubViewModel() {
+  this.Id = 0;
+  this.Type = RegistryTypes.ANONYMOUS;
+  this.Name = 'Docker Hub (anonymous)';
+  this.URL = 'docker.io';
+}
diff --git a/app/portainer/models/endpoint/formValues.js b/app/portainer/models/endpoint/formValues.js
new file mode 100644
index 0000000..3c4a284
--- /dev/null
+++ b/app/portainer/models/endpoint/formValues.js
@@ -0,0 +1,18 @@
+import { PortainerEndpointConnectionTypes } from '@/portainer/models/endpoint/models';
+
+export class PortainerEndpointInitFormValues {
+  constructor() {
+    this.ConnectionType = PortainerEndpointConnectionTypes.KUBERNETES_LOCAL;
+    this.Name = '';
+    this.URL = '';
+    this.TLS = false;
+    this.TLSSkipVerify = false;
+    this.TLSSKipClientVerify = false;
+    this.TLSCACert = null;
+    this.TLSCert = null;
+    this.TLSKey = null;
+    this.AzureApplicationId = '';
+    this.AzureTenantId = '';
+    this.AzureAuthenticationKey = '';
+  }
+}
diff --git a/app/portainer/models/endpoint/models.js b/app/portainer/models/endpoint/models.js
new file mode 100644
index 0000000..cdeb9a7
--- /dev/null
+++ b/app/portainer/models/endpoint/models.js
@@ -0,0 +1,39 @@
+/**
+ * JS reference of portainer.go#EndpointType iota
+ */
+export const PortainerEndpointTypes = Object.freeze({
+  // DockerEnvironment represents an endpoint connected to a Docker environment
+  DockerEnvironment: 1,
+  // AgentOnDockerEnvironment represents an endpoint connected to a Portainer agent deployed on a Docker environment
+  AgentOnDockerEnvironment: 2,
+  // AzureEnvironment represents an endpoint connected to an Azure environment
+  AzureEnvironment: 3,
+  // EdgeAgentOnDockerEnvironment represents an endpoint connected to an Edge agent deployed on a Docker environment
+  EdgeAgentOnDockerEnvironment: 4,
+  // KubernetesLocalEnvironment represents an endpoint connected to a local Kubernetes environment
+  KubernetesLocalEnvironment: 5,
+  // AgentOnKubernetesEnvironment represents an endpoint connected to a Portainer agent deployed on a Kubernetes environment
+  AgentOnKubernetesEnvironment: 6,
+  // EdgeAgentOnKubernetesEnvironment represents an endpoint connected to an Edge agent deployed on a Kubernetes environment
+  EdgeAgentOnKubernetesEnvironment: 7,
+});
+
+/**
+ * JS reference of endpoint_create.go#EndpointCreationType iota
+ */
+export const PortainerEndpointCreationTypes = Object.freeze({
+  LocalDockerEnvironment: 1,
+  AgentEnvironment: 2,
+  AzureEnvironment: 3,
+  EdgeAgentEnvironment: 4,
+  LocalKubernetesEnvironment: 5,
+});
+
+export const PortainerEndpointConnectionTypes = Object.freeze({
+  DOCKER_LOCAL: 1,
+  KUBERNETES_LOCAL: 2,
+  REMOTE: 3,
+  AZURE: 4,
+  AGENT: 5,
+  EDGE: 6,
+});
diff --git a/app/portainer/models/group.js b/app/portainer/models/group.js
new file mode 100644
index 0000000..3cf1dc1
--- /dev/null
+++ b/app/portainer/models/group.js
@@ -0,0 +1,34 @@
+export function EndpointGroupDefaultModel() {
+  this.Name = '';
+  this.Description = '';
+  this.TagIds = [];
+  this.AssociatedEndpoints = [];
+}
+
+export function EndpointGroupModel(data) {
+  this.Id = data.Id;
+  this.Name = data.Name;
+  this.Description = data.Description;
+  this.TagIds = data.TagIds;
+  this.AuthorizedUsers = data.AuthorizedUsers;
+  this.AuthorizedTeams = data.AuthorizedTeams;
+  this.UserAccessPolicies = data.UserAccessPolicies || {};
+  this.TeamAccessPolicies = data.TeamAccessPolicies || {};
+}
+
+export function EndpointGroupCreateRequest(model, endpoints) {
+  this.Name = model.Name;
+  this.Description = model.Description;
+  this.TagIds = model.TagIds;
+  this.AssociatedEndpoints = endpoints;
+}
+
+export function EndpointGroupUpdateRequest(model, endpoints) {
+  this.id = model.Id;
+  this.Name = model.Name;
+  this.Description = model.Description;
+  this.TagIds = model.TagIds;
+  this.AssociatedEndpoints = endpoints;
+  this.UserAccessPolicies = model.UserAccessPolicies;
+  this.TeamAccessPolicies = model.TeamAccessPolicies;
+}
diff --git a/app/portainer/models/registry.js b/app/portainer/models/registry.js
new file mode 100644
index 0000000..509521b
--- /dev/null
+++ b/app/portainer/models/registry.js
@@ -0,0 +1,91 @@
+import _ from 'lodash-es';
+import { RegistryTypes } from './registryTypes';
+
+export function RegistryViewModel(data) {
+  this.Id = data.Id;
+  this.Type = data.Type;
+  this.Name = data.Name;
+  this.URL = data.URL;
+  this.BaseURL = data.BaseURL;
+  this.Authentication = data.Authentication;
+  this.Username = data.Username;
+  this.Password = data.Password;
+  this.RegistryAccesses = data.RegistryAccesses; // map[EndpointID]{UserAccessPolicies, TeamAccessPolicies, NamespaceAccessPolicies}
+  this.Checked = false;
+  this.Gitlab = data.Gitlab;
+  this.Quay = data.Quay;
+  this.Ecr = data.Ecr;
+  this.ManagementConfiguration = data.ManagementConfiguration;
+}
+
+export function RegistryManagementConfigurationDefaultModel(registry) {
+  this.Authentication = registry.Authentication;
+  this.Username = registry.Username;
+  this.Password = '';
+  this.TLS = (registry.ManagementConfiguration && registry.ManagementConfiguration.TLSConfig && registry.ManagementConfiguration.TLSConfig.TLS) || false;
+  this.TLSSkipVerify = (registry.ManagementConfiguration && registry.ManagementConfiguration.TLSConfig && registry.ManagementConfiguration.TLSConfig.TLSSkipVerify) || false;
+  this.TLSCACertFile = null;
+  this.TLSCertFile = null;
+  this.TLSKeyFile = null;
+
+  if (registry.Type === RegistryTypes.ECR) {
+    this.Region = registry.Ecr.Region;
+  }
+
+  if (registry.Type === RegistryTypes.QUAY || registry.Type === RegistryTypes.ECR) {
+    this.Authentication = true;
+    this.Username = registry.Username;
+    this.TLS = true;
+  }
+
+  if ((registry.Type === RegistryTypes.CUSTOM || registry.Type === RegistryTypes.PROGET || registry.Type === RegistryTypes.AZURE) && registry.Authentication) {
+    this.Authentication = true;
+    this.Username = registry.Username;
+  }
+}
+
+export function RegistryCreateFormValues() {
+  this.Type = RegistryTypes.CUSTOM;
+  this.URL = '';
+  this.Name = '';
+  this.Authentication = false;
+  this.Username = '';
+  this.Password = '';
+}
+
+export function RegistryCreateRequest(model) {
+  this.Name = model.Name;
+  this.Type = model.Type;
+  this.URL = _.replace(model.URL, /^https?\:\/\//i, '');
+  this.URL = _.replace(this.URL, /\/$/, '');
+  this.Authentication = model.Authentication;
+  // default TLS based on URL scheme: enable TLS unless explicitly http://
+  const isHttp = /^http:\/\//i.test(model.URL);
+  if (!isHttp) {
+    this.TLS = true;
+  }
+  if (model.Authentication) {
+    this.Username = model.Username;
+    this.Password = model.Password;
+  }
+  if (model.Type === RegistryTypes.GITLAB) {
+    this.Gitlab = {
+      ProjectId: model.Gitlab.ProjectId,
+      InstanceURL: model.Gitlab.InstanceURL,
+      ProjectPath: model.Gitlab.ProjectPath,
+    };
+  }
+  if (model.Type === RegistryTypes.ECR) {
+    this.Ecr = model.Ecr;
+  }
+  if (model.Type === RegistryTypes.QUAY) {
+    this.Quay = {
+      useOrganisation: model.Quay.useOrganisation,
+      organisationName: model.Quay.organisationName,
+    };
+  }
+  if (model.Type === RegistryTypes.PROGET) {
+    this.BaseURL = _.replace(model.BaseURL, /^https?\:\/\//i, '');
+    this.BaseURL = _.replace(this.BaseURL, /\/$/, '');
+  }
+}
diff --git a/app/portainer/models/registryRepository.js b/app/portainer/models/registryRepository.js
new file mode 100644
index 0000000..eb723bd
--- /dev/null
+++ b/app/portainer/models/registryRepository.js
@@ -0,0 +1,16 @@
+import _ from 'lodash-es';
+
+export function RegistryRepositoryViewModel(item) {
+  if (item.name && item.tags) {
+    this.Name = item.name;
+    this.TagsCount = _.without(item.tags, null).length;
+  } else {
+    this.Name = item;
+    this.TagsCount = 0;
+  }
+}
+
+export function RegistryRepositoryGitlabViewModel(data) {
+  this.Name = data.path;
+  this.TagsCount = data.tags.length;
+}
diff --git a/app/portainer/models/registryTypes.js b/app/portainer/models/registryTypes.js
new file mode 100644
index 0000000..1d4057a
--- /dev/null
+++ b/app/portainer/models/registryTypes.js
@@ -0,0 +1,10 @@
+export const RegistryTypes = Object.freeze({
+  ANONYMOUS: 0, // not backend replicated, only for frontend
+  QUAY: 1,
+  AZURE: 2,
+  CUSTOM: 3,
+  GITLAB: 4,
+  PROGET: 5,
+  DOCKERHUB: 6,
+  ECR: 7,
+});
diff --git a/app/portainer/models/resourceControl/resourceControlCreatePayload.js b/app/portainer/models/resourceControl/resourceControlCreatePayload.js
new file mode 100644
index 0000000..4e4825c
--- /dev/null
+++ b/app/portainer/models/resourceControl/resourceControlCreatePayload.js
@@ -0,0 +1,17 @@
+/**
+ * Payload for resourceControleCreate operation
+ * @param {string} resourceId ID of involved Resource
+ * @param {ResourceControlResourceType} resourceType Type of involved Resource
+ * @param {ResourceControlOwnershipParameters} data Transcient type from view data to payload
+ */
+export function ResourceControlCreatePayload(resourceId, resourceType, data) {
+  void data;
+
+  this.ResourceID = resourceId;
+  this.Type = resourceType;
+  this.Public = data.Public;
+  this.AdministratorsOnly = data.AdministratorsOnly;
+  this.Users = data.Users;
+  this.Teams = data.Teams;
+  this.SubResourceIDs = data.SubResourceIDs;
+}
diff --git a/app/portainer/models/resourceControl/resourceControlOwnershipParameters.js b/app/portainer/models/resourceControl/resourceControlOwnershipParameters.js
new file mode 100644
index 0000000..e150425
--- /dev/null
+++ b/app/portainer/models/resourceControl/resourceControlOwnershipParameters.js
@@ -0,0 +1,15 @@
+/**
+ * Transcient type from view data to payload
+ * @param {bool} adminOnly is ResourceControl restricted to admin only
+ * @param {bool} publicOnly is ResourceControl exposed to public
+ * @param {[]int} users Authorized UserIDs array
+ * @param {[]int} teams Authorized TeamIDs array
+ * @param {[]int} subResources subResourceIDs array
+ */
+export function ResourceControlOwnershipParameters(adminOnly = false, publicOnly = false, users = [], teams = [], subResources = []) {
+  this.AdministratorsOnly = adminOnly;
+  this.Public = publicOnly;
+  this.Users = users;
+  this.Teams = teams;
+  this.SubResourceIDs = subResources;
+}
diff --git a/app/portainer/models/schedule.js b/app/portainer/models/schedule.js
new file mode 100644
index 0000000..572f4be
--- /dev/null
+++ b/app/portainer/models/schedule.js
@@ -0,0 +1,19 @@
+export function ScheduleCreateRequest(model) {
+  this.Name = model.Name;
+  this.Recurring = model.Recurring;
+  this.CronExpression = model.CronExpression;
+  this.Endpoints = model.Endpoints;
+  this.FileContent = model.FileContent;
+  this.File = model.File;
+  this.EdgeGroups = model.EdgeGroups;
+}
+
+export function ScheduleUpdateRequest(model) {
+  this.id = model.Id;
+  this.Name = model.Name;
+  this.Recurring = model.Recurring;
+  this.CronExpression = model.CronExpression;
+  this.Endpoints = model.Endpoints;
+  this.FileContent = model.FileContent;
+  this.EdgeGroups = model.EdgeGroups;
+}
diff --git a/app/portainer/models/settings.js b/app/portainer/models/settings.js
new file mode 100644
index 0000000..6795e14
--- /dev/null
+++ b/app/portainer/models/settings.js
@@ -0,0 +1,84 @@
+export function SettingsViewModel(data) {
+  this.LogoURL = data.LogoURL;
+  this.BlackListedLabels = data.BlackListedLabels;
+  this.AuthenticationMethod = data.AuthenticationMethod;
+  this.InternalAuthSettings = data.InternalAuthSettings;
+  this.LDAPSettings = data.LDAPSettings;
+  this.OAuthSettings = new OAuthSettingsViewModel(data.OAuthSettings);
+  this.SnapshotInterval = data.SnapshotInterval;
+  this.TemplatesURL = data.TemplatesURL;
+  this.EdgeAgentCheckinInterval = data.EdgeAgentCheckinInterval;
+  this.EnableEdgeComputeFeatures = data.EnableEdgeComputeFeatures;
+  this.FeatureFlagSettings = data.FeatureFlagSettings;
+  this.UserSessionTimeout = data.UserSessionTimeout;
+  this.KubeconfigExpiry = data.KubeconfigExpiry;
+  this.HelmRepositoryURL = data.HelmRepositoryURL;
+  this.TrustOnFirstConnect = data.TrustOnFirstConnect;
+  this.EnforceEdgeID = data.EnforceEdgeID;
+  this.AgentSecret = data.AgentSecret;
+  this.EdgePortainerUrl = data.EdgePortainerUrl;
+}
+
+export function PublicSettingsViewModel(settings) {
+  this.AuthenticationMethod = settings.AuthenticationMethod;
+  this.TeamSync = settings.TeamSync;
+  this.RequiredPasswordLength = settings.RequiredPasswordLength;
+  this.EnableEdgeComputeFeatures = settings.EnableEdgeComputeFeatures;
+  this.EnforceEdgeID = settings.EnforceEdgeID;
+  this.LogoURL = settings.LogoURL;
+  this.OAuthLoginURI = settings.OAuthLoginURI;
+  this.OAuthLogoutURI = settings.OAuthLogoutURI;
+  this.KubeconfigExpiry = settings.KubeconfigExpiry;
+  this.Features = settings.Features;
+  this.Edge = new EdgeSettingsViewModel(settings.Edge);
+  this.DefaultRegistry = settings.DefaultRegistry;
+  this.RequiresSetupToken = settings.RequiresSetupToken;
+}
+
+export function InternalAuthSettingsViewModel(data) {
+  this.RequiredPasswordLength = data.RequiredPasswordLength;
+}
+
+export function LDAPSettingsViewModel(data) {
+  this.ReaderDN = data.ReaderDN;
+  this.Password = data.Password;
+  this.URL = data.URL;
+  this.SearchSettings = data.SearchSettings;
+  this.GroupSearchSettings = data.GroupSearchSettings;
+  this.AutoCreateUsers = data.AutoCreateUsers;
+}
+
+export function LDAPSearchSettings(BaseDN, UsernameAttribute, Filter) {
+  this.BaseDN = BaseDN;
+  this.UsernameAttribute = UsernameAttribute;
+  this.Filter = Filter;
+}
+
+export function LDAPGroupSearchSettings(GroupBaseDN, GroupAttribute, GroupFilter) {
+  this.GroupBaseDN = GroupBaseDN;
+  this.GroupAttribute = GroupAttribute;
+  this.GroupFilter = GroupFilter;
+}
+
+export function OAuthSettingsViewModel(data) {
+  this.ClientID = data.ClientID;
+  this.ClientSecret = data.ClientSecret;
+  this.AccessTokenURI = data.AccessTokenURI;
+  this.AuthorizationURI = data.AuthorizationURI;
+  this.ResourceURI = data.ResourceURI;
+  this.RedirectURI = data.RedirectURI;
+  this.UserIdentifier = data.UserIdentifier;
+  this.Scopes = data.Scopes;
+  this.OAuthAutoCreateUsers = data.OAuthAutoCreateUsers;
+  this.DefaultTeamID = data.DefaultTeamID;
+  this.SSO = data.SSO;
+  this.LogoutURI = data.LogoutURI;
+  this.AuthStyle = data.AuthStyle;
+}
+
+export function EdgeSettingsViewModel(data = {}) {
+  this.CheckinInterval = data.CheckinInterval;
+  this.PingInterval = data.PingInterval;
+  this.SnapshotInterval = data.SnapshotInterval;
+  this.CommandInterval = data.CommandInterval;
+}
diff --git a/app/portainer/models/status.js b/app/portainer/models/status.js
new file mode 100644
index 0000000..7046092
--- /dev/null
+++ b/app/portainer/models/status.js
@@ -0,0 +1,12 @@
+export function StatusViewModel(data) {
+  this.Authentication = data.Authentication;
+  this.Snapshot = data.Snapshot;
+  this.Version = data.Version;
+  this.Edition = data.Edition;
+  this.InstanceID = data.InstanceID;
+}
+
+export function StatusVersionViewModel(data) {
+  this.UpdateAvailable = data.UpdateAvailable;
+  this.LatestVersion = data.LatestVersion;
+}
diff --git a/app/portainer/models/tag.js b/app/portainer/models/tag.js
new file mode 100644
index 0000000..ee3660c
--- /dev/null
+++ b/app/portainer/models/tag.js
@@ -0,0 +1,6 @@
+import _ from 'lodash-es';
+
+export function TagViewModel(data) {
+  this.Id = data.ID;
+  this.Name = _.escape(data.Name);
+}
diff --git a/app/portainer/models/team.js b/app/portainer/models/team.js
new file mode 100644
index 0000000..617b36c
--- /dev/null
+++ b/app/portainer/models/team.js
@@ -0,0 +1,7 @@
+import _ from 'lodash-es';
+
+export function TeamViewModel(data) {
+  this.Id = data.Id;
+  this.Name = _.escape(data.Name);
+  this.Checked = false;
+}
diff --git a/app/portainer/models/teamMembership.js b/app/portainer/models/teamMembership.js
new file mode 100644
index 0000000..43aad61
--- /dev/null
+++ b/app/portainer/models/teamMembership.js
@@ -0,0 +1,6 @@
+export function TeamMembershipModel(data) {
+  this.Id = data.Id;
+  this.UserId = data.UserID;
+  this.TeamId = data.TeamID;
+  this.Role = data.Role;
+}
diff --git a/app/portainer/models/user.js b/app/portainer/models/user.js
new file mode 100644
index 0000000..a8979a0
--- /dev/null
+++ b/app/portainer/models/user.js
@@ -0,0 +1,25 @@
+export function UserViewModel(data) {
+  this.Id = data.Id;
+  this.Username = data.Username;
+  this.Role = data.Role;
+  this.ThemeSettings = data.ThemeSettings;
+  this.EndpointAuthorizations = data.EndpointAuthorizations;
+  this.PortainerAuthorizations = data.PortainerAuthorizations;
+  if (data.Role === 1) {
+    this.RoleName = 'administrator';
+  } else {
+    this.RoleName = 'user';
+  }
+  this.AuthenticationMethod = data.AuthenticationMethod;
+  this.Checked = false;
+  this.UseCache = data.UseCache;
+}
+
+export function UserTokenModel(data) {
+  this.id = data.id;
+  this.userId = data.userId;
+  this.description = data.description;
+  this.prefix = data.prefix;
+  this.dateCreated = data.dateCreated;
+  this.lastUsed = data.lastUsed;
+}
diff --git a/app/portainer/models/webhook.js b/app/portainer/models/webhook.js
new file mode 100644
index 0000000..8f63ee3
--- /dev/null
+++ b/app/portainer/models/webhook.js
@@ -0,0 +1,7 @@
+export function WebhookViewModel(data) {
+  this.Id = data.Id;
+  this.Token = data.Token;
+  this.ResourceId = data.ResourceID;
+  this.EndpointId = data.EndpointID;
+  this.WebhookType = data.WebhookType;
+}
diff --git a/app/portainer/oauth/__module.js b/app/portainer/oauth/__module.js
new file mode 100644
index 0000000..f6b1192
--- /dev/null
+++ b/app/portainer/oauth/__module.js
@@ -0,0 +1 @@
+angular.module('portainer.oauth', ['ngResource']).constant('API_ENDPOINT_OAUTH', 'api/auth/oauth');
diff --git a/app/portainer/oauth/components/oauth-providers-selector/index.js b/app/portainer/oauth/components/oauth-providers-selector/index.js
new file mode 100644
index 0000000..000f869
--- /dev/null
+++ b/app/portainer/oauth/components/oauth-providers-selector/index.js
@@ -0,0 +1,11 @@
+import angular from 'angular';
+import controller from './oauth-provider-selector.controller';
+
+angular.module('portainer.oauth').component('oauthProvidersSelector', {
+  templateUrl: './oauth-providers-selector.html',
+  bindings: {
+    onChange: '<',
+    value: '<',
+  },
+  controller,
+});
diff --git a/app/portainer/oauth/components/oauth-providers-selector/oauth-provider-selector.controller.js b/app/portainer/oauth/components/oauth-providers-selector/oauth-provider-selector.controller.js
new file mode 100644
index 0000000..f7dceab
--- /dev/null
+++ b/app/portainer/oauth/components/oauth-providers-selector/oauth-provider-selector.controller.js
@@ -0,0 +1,7 @@
+import { options } from '@/react/portainer/settings/AuthenticationView/oauth-options';
+
+export default class OAuthProviderSelectorController {
+  constructor() {
+    this.options = options;
+  }
+}
diff --git a/app/portainer/oauth/components/oauth-providers-selector/oauth-providers-selector.html b/app/portainer/oauth/components/oauth-providers-selector/oauth-providers-selector.html
new file mode 100644
index 0000000..af7c823
--- /dev/null
+++ b/app/portainer/oauth/components/oauth-providers-selector/oauth-providers-selector.html
@@ -0,0 +1 @@
+<box-selector value="$ctrl.value" options="$ctrl.options" on-change="($ctrl.onChange)" radio-name="'oauth_provider'" label="'Provider'"></box-selector>
diff --git a/app/portainer/oauth/components/oauth-settings/index.js b/app/portainer/oauth/components/oauth-settings/index.js
new file mode 100644
index 0000000..fb452d8
--- /dev/null
+++ b/app/portainer/oauth/components/oauth-settings/index.js
@@ -0,0 +1,13 @@
+import angular from 'angular';
+import controller from './oauth-settings.controller';
+
+angular.module('portainer.oauth').component('oauthSettings', {
+  templateUrl: './oauth-settings.html',
+  bindings: {
+    settings: '=',
+    teams: '<',
+    onSaveSettings: '<',
+    saveButtonState: '<',
+  },
+  controller,
+});
diff --git a/app/portainer/oauth/components/oauth-settings/oauth-settings.controller.js b/app/portainer/oauth/components/oauth-settings/oauth-settings.controller.js
new file mode 100644
index 0000000..87ab600
--- /dev/null
+++ b/app/portainer/oauth/components/oauth-settings/oauth-settings.controller.js
@@ -0,0 +1,181 @@
+import { baseHref } from '@/portainer/helpers/pathHelper';
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+import { isLimitedToBE } from '@/react/portainer/feature-flags/feature-flags.service';
+import { ModalType } from '@@/modals';
+import { confirm } from '@@/modals/confirm';
+import { buildConfirmButton } from '@@/modals/utils';
+import providers, { getProviderByUrl } from './providers';
+
+const MS_TENANT_ID_PLACEHOLDER = 'TENANT_ID';
+
+export default class OAuthSettingsController {
+  /* @ngInject */
+  constructor($scope, $async) {
+    Object.assign(this, { $scope, $async });
+
+    this.limitedFeature = FeatureId.HIDE_INTERNAL_AUTH;
+    this.limitedFeatureClass = 'limited-be';
+
+    this.state = {
+      provider: 'custom',
+      overrideConfiguration: false,
+      microsoftTenantID: '',
+    };
+
+    this.$onInit = this.$onInit.bind(this);
+    this.onSelectProvider = this.onSelectProvider.bind(this);
+    this.onMicrosoftTenantIDChange = this.onMicrosoftTenantIDChange.bind(this);
+    this.useDefaultProviderConfiguration = this.useDefaultProviderConfiguration.bind(this);
+    this.updateSSO = this.updateSSO.bind(this);
+    this.addTeamMembershipMapping = this.addTeamMembershipMapping.bind(this);
+    this.removeTeamMembership = this.removeTeamMembership.bind(this);
+    this.onToggleAutoTeamMembership = this.onToggleAutoTeamMembership.bind(this);
+    this.onChangeAuthStyle = this.onChangeAuthStyle.bind(this);
+    this.onAutoUserProvisionChange = this.onAutoUserProvisionChange.bind(this);
+  }
+
+  onAutoUserProvisionChange(value) {
+    this.$scope.$evalAsync(() => {
+      this.settings.OAuthAutoCreateUsers = value;
+    });
+  }
+
+  onMicrosoftTenantIDChange() {
+    const tenantID = this.state.microsoftTenantID || MS_TENANT_ID_PLACEHOLDER;
+
+    this.settings.AuthorizationURI = `https://login.microsoftonline.com/${tenantID}/oauth2/v2.0/authorize`;
+    this.settings.AccessTokenURI = `https://login.microsoftonline.com/${tenantID}/oauth2/v2.0/token`;
+    this.settings.ResourceURI = `https://graph.microsoft.com/v1.0/me`;
+    this.settings.LogoutURI = `https://login.microsoftonline.com/${tenantID}/oauth2/v2.0/logout`;
+  }
+
+  useDefaultProviderConfiguration(providerId) {
+    const provider = providers[providerId];
+
+    this.state.overrideConfiguration = false;
+
+    if (!this.isLimitedToBE || providerId === 'custom') {
+      this.settings.AuthorizationURI = provider.authUrl;
+      this.settings.AccessTokenURI = provider.accessTokenUrl;
+      this.settings.ResourceURI = provider.resourceUrl;
+      this.settings.LogoutURI = provider.logoutUrl;
+      this.settings.UserIdentifier = provider.userIdentifier;
+      this.settings.Scopes = provider.scopes;
+      this.settings.AuthStyle = provider.authStyle;
+
+      if (providerId === 'microsoft' && this.state.microsoftTenantID !== '') {
+        this.onMicrosoftTenantIDChange();
+      }
+    } else {
+      this.settings.ClientID = '';
+      this.settings.ClientSecret = '';
+    }
+  }
+
+  onSelectProvider(provider) {
+    this.state.provider = provider;
+
+    this.useDefaultProviderConfiguration(provider);
+  }
+
+  updateSSO(checked) {
+    this.$scope.$evalAsync(() => {
+      this.settings.SSO = checked;
+      this.settings.HideInternalAuth = false;
+    });
+  }
+
+  onChangeAuthStyle(val) {
+    this.$scope.$evalAsync(() => {
+      this.settings.AuthStyle = val;
+    });
+  }
+
+  async onChangeHideInternalAuth(checked) {
+    this.$async(async () => {
+      if (this.isLimitedToBE) {
+        return;
+      }
+
+      if (checked) {
+        const confirmed = await confirm({
+          title: 'Hide internal authentication prompt',
+          message: 'By hiding internal authentication prompt, you will only be able to login via SSO. Are you sure?',
+          confirmButton: buildConfirmButton('Confirm', 'danger'),
+          modalType: ModalType.Warn,
+        });
+
+        if (!confirmed) {
+          return;
+        }
+      }
+
+      this.settings.HideInternalAuth = checked;
+    });
+  }
+
+  onToggleAutoTeamMembership(checked) {
+    this.$scope.$evalAsync(() => {
+      this.settings.OAuthAutoMapTeamMemberships = checked;
+    });
+  }
+
+  addTeamMembershipMapping() {
+    this.settings.TeamMemberships.OAuthClaimMappings.push({ ClaimValRegex: '', Team: this.settings.DefaultTeamID });
+  }
+
+  removeTeamMembership(index) {
+    this.settings.TeamMemberships.OAuthClaimMappings.splice(index, 1);
+  }
+
+  isOAuthTeamMembershipFormValid() {
+    if (this.settings.OAuthAutoMapTeamMemberships && this.settings.TeamMemberships) {
+      if (!this.settings.TeamMemberships.OAuthClaimName) {
+        return false;
+      }
+
+      const hasInvalidMapping = this.settings.TeamMemberships.OAuthClaimMappings.some((m) => !(m.ClaimValRegex && m.Team));
+      if (hasInvalidMapping) {
+        return false;
+      }
+    }
+    return true;
+  }
+
+  $onInit() {
+    this.isLimitedToBE = isLimitedToBE(this.limitedFeature);
+
+    if (this.isLimitedToBE) {
+      return;
+    }
+
+    if (this.settings.RedirectURI === '') {
+      this.settings.RedirectURI = window.location.origin + baseHref();
+    }
+
+    if (this.settings.AuthorizationURI) {
+      const authUrl = this.settings.AuthorizationURI;
+
+      this.state.provider = getProviderByUrl(authUrl);
+      if (this.state.provider === 'microsoft') {
+        const tenantID = authUrl.match(/login.microsoftonline.com\/(.*?)\//)[1];
+        if (tenantID !== MS_TENANT_ID_PLACEHOLDER) {
+          this.state.microsoftTenantID = tenantID;
+          this.onMicrosoftTenantIDChange();
+        }
+      }
+    }
+
+    if (this.settings.DefaultTeamID === 0) {
+      this.settings.DefaultTeamID = null;
+    }
+
+    if (this.settings.TeamMemberships == null) {
+      this.settings.TeamMemberships = {};
+    }
+
+    if (this.settings.TeamMemberships.OAuthClaimMappings === null) {
+      this.settings.TeamMemberships.OAuthClaimMappings = [];
+    }
+  }
+}
diff --git a/app/portainer/oauth/components/oauth-settings/oauth-settings.html b/app/portainer/oauth/components/oauth-settings/oauth-settings.html
new file mode 100644
index 0000000..4f445e9
--- /dev/null
+++ b/app/portainer/oauth/components/oauth-settings/oauth-settings.html
@@ -0,0 +1,455 @@
+<ng-form name="oauthSettingsForm">
+  <div class="col-sm-12 form-section-title"> Single Sign-On </div>
+
+  <!-- SSO -->
+  <div class="form-group">
+    <div class="col-sm-12">
+      <por-switch-field
+        label="'Use SSO'"
+        tooltip="'When using SSO the OAuth provider is not forced to prompt for credentials.'"
+        name="'use-sso'"
+        checked="$ctrl.settings.SSO"
+        on-change="($ctrl.updateSSO)"
+      ></por-switch-field>
+    </div>
+  </div>
+  <!-- !SSO -->
+
+  <!-- HideInternalAuth -->
+  <div class="form-group" ng-if="$ctrl.settings.SSO">
+    <div class="col-sm-12">
+      <por-switch-field
+        label="'Hide internal authentication prompt'"
+        name="'hide-internal-auth'"
+        feature-id="$ctrl.limitedFeature"
+        checked="$ctrl.settings.HideInternalAuth"
+        on-change="($ctrl.onChangeHideInternalAuth)"
+      ></por-switch-field>
+    </div>
+  </div>
+  <!-- !HideInternalAuth -->
+
+  <auto-user-provision-toggle
+    value="$ctrl.settings.OAuthAutoCreateUsers"
+    on-change="($ctrl.onAutoUserProvisionChange)"
+    description="'With automatic user provisioning enabled, Portainer will create user(s) automatically with the standard user role. If disabled, users must be created beforehand in Portainer in order to login.'"
+  ></auto-user-provision-toggle>
+
+  <div ng-if="$ctrl.settings.OAuthAutoCreateUsers">
+    <div class="form-group">
+      <span class="col-sm-12 text-muted small">
+        <p>The users created by the automatic provisioning feature can be added to a default team on creation.</p>
+        <p>
+          By assigning newly created users to a team, they will be able to access the environments associated to that team. This setting is optional and if not set, newly created
+          users won't be able to access any environments.
+        </p>
+      </span>
+    </div>
+    <div class="form-group">
+      <label class="col-sm-3 col-lg-2 control-label text-left">Default team</label>
+      <span class="small text-muted" style="margin-left: 20px" ng-if="$ctrl.teams.length === 0">
+        You have not yet created any teams. Head over to the <a ui-sref="portainer.teams">Teams view</a> to manage teams.
+      </span>
+
+      <div class="col-sm-9" ng-if="$ctrl.teams.length > 0">
+        <div class="col-sm-12 small text-muted">
+          <p class="vertical-center">
+            <pr-icon icon="'info'" mode="'primary'"></pr-icon>
+            The default team option will be disabled when automatic team membership is enabled
+          </p>
+        </div>
+        <div class="col-xs-12 vertical-center">
+          <select
+            class="form-control"
+            ng-disabled="$ctrl.settings.OAuthAutoMapTeamMemberships"
+            ng-model="$ctrl.settings.DefaultTeamID"
+            ng-options="team.Id as team.Name for team in $ctrl.teams"
+            data-cy="default-team-select"
+          >
+            <option value="">No team</option>
+          </select>
+          <button
+            type="button"
+            class="btn btn-md btn-danger"
+            ng-click="$ctrl.settings.DefaultTeamID = null"
+            ng-disabled="!$ctrl.settings.DefaultTeamID || $ctrl.settings.OAuthAutoMapTeamMemberships"
+            ng-if="$ctrl.teams.length > 0"
+          >
+            <pr-icon icon="'x'" size="'md'"></pr-icon>
+          </button>
+        </div>
+      </div>
+    </div>
+  </div>
+
+  <div class="col-sm-12 form-section-title"> Team membership </div>
+  <div class="form-group">
+    <div class="col-sm-12 text-muted small"> Automatic team membership synchronizes the team membership based on a custom claim in the token from the OAuth provider. </div>
+  </div>
+  <div class="form-group">
+    <div class="col-sm-12">
+      <por-switch-field
+        label="'Automatic team membership'"
+        name="'tls'"
+        feature-id="$ctrl.limitedFeature"
+        checked="$ctrl.settings.OAuthAutoMapTeamMemberships"
+        on-change="($ctrl.onToggleAutoTeamMembership)"
+      ></por-switch-field>
+    </div>
+  </div>
+
+  <div ng-if="$ctrl.settings.OAuthAutoMapTeamMemberships">
+    <div class="form-group">
+      <label class="col-sm-3 col-lg-2 control-label text-left" for="oauth_token_claim_name">
+        Claim name
+        <portainer-tooltip message="'The OpenID Connect UserInfo Claim name that contains the team identifier the user belongs to.'"></portainer-tooltip>
+      </label>
+      <div class="col-sm-9 col-lg-10">
+        <div class="col-xs-11 col-lg-10">
+          <input
+            type="text"
+            class="form-control"
+            id="oauth_token_claim_name"
+            ng-model="$ctrl.settings.TeamMemberships.OAuthClaimName"
+            placeholder="groups"
+            data-cy="oauth-token-claim-name"
+          />
+        </div>
+      </div>
+    </div>
+
+    <div class="form-group">
+      <label class="col-sm-3 col-lg-2 control-label text-left"> Statically assigned teams </label>
+      <div class="col-sm-9 col-lg-10">
+        <span class="label label-default interactive vertical-center ml-4" ng-click="$ctrl.addTeamMembershipMapping()">
+          <pr-icon icon="'plus-circle'"></pr-icon>
+          add team mapping
+        </span>
+
+        <div class="col-sm-12 form-inline" ng-repeat="mapping in $ctrl.settings.TeamMemberships.OAuthClaimMappings" style="margin-top: 0.75em">
+          <div class="input-group input-group-sm col-sm-5">
+            <span class="input-group-addon">claim value regex</span>
+            <input type="text" class="form-control" ng-model="mapping.ClaimValRegex" data-cy="claim-value-regex" />
+          </div>
+          <span style="margin: 0px 0.5em">maps to</span>
+          <div class="input-group input-group-sm col-sm-3 col-lg-4">
+            <span class="input-group-addon">team</span>
+            <select
+              class="form-control"
+              data-cy="team-select"
+              ng-init="mapping.Team = mapping.Team || $ctrl.settings.DefaultTeamID"
+              ng-model="mapping.Team"
+              ng-options="team.Id as team.Name for team in $ctrl.teams"
+            >
+              <option selected value="">Select a team</option>
+            </select>
+          </div>
+          <button type="button" class="btn btn-md btn-danger" ng-click="$ctrl.removeTeamMembership($index)">
+            <pr-icon icon="'trash-2'" size="'md'"></pr-icon>
+          </button>
+
+          <div>
+            <div class="small text-warning vertical-center mt-1" ng-show="!mapping.ClaimValRegex">
+              <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon>
+              Claim value regex is required.
+            </div>
+          </div>
+        </div>
+      </div>
+    </div>
+
+    <div class="form-group">
+      <div class="col-sm-12 text-muted small" style="margin-bottom: 0.5em"> The default team will be assigned when the user does not belong to any other team </div>
+      <label class="col-sm-3 col-lg-2 control-label text-left">Default team</label>
+      <span class="small text-muted" style="margin-left: 20px" ng-if="$ctrl.teams.length === 0">
+        You have not yet created any teams. Head over to the <a ui-sref="portainer.teams">Teams view</a> to manage teams.
+      </span>
+
+      <div class="col-sm-9" ng-if="$ctrl.teams.length > 0">
+        <div class="col-xs-11">
+          <select class="form-control" ng-model="$ctrl.settings.DefaultTeamID" ng-options="team.Id as team.Name for team in $ctrl.teams" data-cy="default-team-select">
+            <option value="">No team</option>
+          </select>
+        </div>
+      </div>
+    </div>
+  </div>
+
+  <oauth-providers-selector on-change="($ctrl.onSelectProvider)" value="$ctrl.state.provider"></oauth-providers-selector>
+
+  <div ng-if="$ctrl.state.provider == 'custom' || $ctrl.state.overrideConfiguration">
+    <div class="col-sm-12 form-section-title">OAuth Configuration</div>
+
+    <div class="form-group">
+      <label for="oauth_client_id" class="col-sm-3 col-lg-2 control-label text-left">
+        {{ $ctrl.state.provider == 'microsoft' ? 'Application ID' : 'Client ID' }}
+        <portainer-tooltip message="'Public identifier of the OAuth application'"></portainer-tooltip>
+      </label>
+      <div class="col-sm-9 col-lg-10">
+        <input
+          type="text"
+          id="oauth_client_id"
+          ng-model="$ctrl.settings.ClientID"
+          placeholder="xxxxxxxxxxxxxxxxxxxx"
+          ng-class="['form-control', { 'limited-be': $ctrl.isLimitedToBE && $ctrl.state.provider !== 'custom' }]"
+          ng-disabled="$ctrl.isLimitedToBE && $ctrl.state.provider !== 'custom'"
+          tabindex="{{ $ctrl.isLimitedToBE && $ctrl.state.provider !== 'custom' ? -1 : 0 }}"
+        />
+      </div>
+    </div>
+
+    <div class="form-group">
+      <label for="oauth_client_secret" class="col-sm-3 col-lg-2 control-label text-left"> {{ $ctrl.state.provider == 'microsoft' ? 'Application key' : 'Client secret' }} </label>
+      <div class="col-sm-9 col-lg-10">
+        <input
+          type="password"
+          class="form-control"
+          id="oauth_client_secret"
+          ng-model="$ctrl.settings.ClientSecret"
+          placeholder="xxxxxxxxxxxxxxxxxxxx"
+          autocomplete="new-password"
+          ng-class="['form-control', { 'limited-be': $ctrl.isLimitedToBE && $ctrl.state.provider !== 'custom' }]"
+          ng-disabled="$ctrl.isLimitedToBE && $ctrl.state.provider !== 'custom'"
+          tabindex="{{ $ctrl.isLimitedToBE && $ctrl.state.provider !== 'custom' ? -1 : 0 }}"
+        />
+      </div>
+    </div>
+
+    <div class="form-group">
+      <label for="oauth_authorization_uri" class="col-sm-3 col-lg-2 control-label text-left">
+        Authorization URL
+        <portainer-tooltip message="'URL used to authenticate against the OAuth provider. Will redirect the user to the OAuth provider login view'"></portainer-tooltip>
+      </label>
+      <div class="col-sm-9 col-lg-10">
+        <input
+          type="text"
+          data-cy="oauth-authorization-uri"
+          class="form-control"
+          id="oauth_authorization_uri"
+          ng-model="$ctrl.settings.AuthorizationURI"
+          placeholder="https://example.com/oauth/authorize"
+          ng-class="['form-control', { 'limited-be': $ctrl.isLimitedToBE && $ctrl.state.provider !== 'custom' }]"
+          ng-disabled="$ctrl.isLimitedToBE && $ctrl.state.provider !== 'custom'"
+        />
+      </div>
+    </div>
+
+    <div class="form-group">
+      <label for="oauth_access_token_uri" class="col-sm-3 col-lg-2 control-label text-left">
+        Access token URL
+        <portainer-tooltip message="'URL used by Portainer to exchange a valid OAuth authentication code for an access token'"></portainer-tooltip>
+      </label>
+      <div class="col-sm-9 col-lg-10">
+        <input
+          type="text"
+          data-cy="oauth-access-token-uri"
+          class="form-control"
+          id="oauth_access_token_uri"
+          ng-model="$ctrl.settings.AccessTokenURI"
+          placeholder="https://example.com/oauth/token"
+          ng-class="['form-control', { 'limited-be': $ctrl.isLimitedToBE && $ctrl.state.provider !== 'custom' }]"
+          ng-disabled="$ctrl.isLimitedToBE && $ctrl.state.provider !== 'custom'"
+        />
+      </div>
+    </div>
+
+    <div class="form-group">
+      <label for="oauth_resource_uri" class="col-sm-3 col-lg-2 control-label text-left">
+        Resource URL
+        <portainer-tooltip message="'URL used by Portainer to retrieve information about the authenticated user'"></portainer-tooltip>
+      </label>
+      <div class="col-sm-9 col-lg-10">
+        <input
+          type="text"
+          data-cy="oauth-resource-uri"
+          class="form-control"
+          id="oauth_resource_uri"
+          ng-model="$ctrl.settings.ResourceURI"
+          placeholder="https://example.com/user"
+          ng-class="['form-control', { 'limited-be': $ctrl.isLimitedToBE && $ctrl.state.provider !== 'custom' }]"
+          ng-disabled="$ctrl.isLimitedToBE && $ctrl.state.provider !== 'custom'"
+        />
+      </div>
+    </div>
+
+    <div class="form-group">
+      <label for="oauth_redirect_uri" class="col-sm-3 col-lg-2 control-label text-left">
+        Redirect URL
+        <portainer-tooltip
+          message="'URL used by the OAuth provider to redirect the user after successful authentication. Should be set to your Portainer instance URL'"
+        ></portainer-tooltip>
+      </label>
+      <div class="col-sm-9 col-lg-10">
+        <input
+          type="text"
+          data-cy="oauth-redirect-uri"
+          class="form-control"
+          id="oauth_redirect_uri"
+          ng-model="$ctrl.settings.RedirectURI"
+          placeholder="http://yourportainer.com/"
+          ng-class="['form-control', { 'limited-be': $ctrl.isLimitedToBE && $ctrl.state.provider !== 'custom' }]"
+          ng-disabled="$ctrl.isLimitedToBE && $ctrl.state.provider !== 'custom'"
+        />
+      </div>
+    </div>
+
+    <div class="form-group">
+      <label for="oauth_logout_url" class="col-sm-3 col-lg-2 control-label text-left">
+        Logout URL
+        <portainer-tooltip
+          message="'URL used by Portainer to redirect the user to the OAuth provider in order to log the user out of the identity provider session.'"
+        ></portainer-tooltip>
+      </label>
+      <div class="col-sm-9 col-lg-10">
+        <input
+          type="text"
+          data-cy="oauth-logout-url"
+          class="form-control"
+          id="oauth_logout_url"
+          ng-model="$ctrl.settings.LogoutURI"
+          ng-class="['form-control', { 'limited-be': $ctrl.isLimitedToBE && $ctrl.state.provider !== 'custom' }]"
+          ng-disabled="$ctrl.isLimitedToBE && $ctrl.state.provider !== 'custom'"
+        />
+      </div>
+    </div>
+
+    <div class="form-group">
+      <label for="oauth_user_identifier" class="col-sm-3 col-lg-2 control-label text-left">
+        User identifier
+        <portainer-tooltip
+          message="'Identifier that will be used by Portainer to create an account for the authenticated user. Retrieved from the resource server specified via the Resource URL field'"
+        ></portainer-tooltip>
+      </label>
+      <div class="col-sm-9 col-lg-10">
+        <input
+          type="text"
+          data-cy="oauth-user-identifier"
+          class="form-control"
+          id="oauth_user_identifier"
+          ng-model="$ctrl.settings.UserIdentifier"
+          placeholder="id"
+          ng-class="['form-control', { 'limited-be': $ctrl.isLimitedToBE && $ctrl.state.provider !== 'custom' }]"
+          ng-disabled="$ctrl.isLimitedToBE && $ctrl.state.provider !== 'custom'"
+        />
+      </div>
+    </div>
+
+    <div class="form-group">
+      <label for="oauth_scopes" class="col-sm-3 col-lg-2 control-label text-left">
+        Scopes
+        <portainer-tooltip
+          message="'Space-separated list of scopes the OAuth provider requires to return information about the authenticated user (for example, openid profile email). The required scopes depend on your provider; refer to your OAuth provider documentation.'"
+        ></portainer-tooltip>
+      </label>
+      <div class="col-sm-9 col-lg-10">
+        <input
+          type="text"
+          data-cy="oauth-scopes"
+          class="form-control"
+          id="oauth_scopes"
+          ng-model="$ctrl.settings.Scopes"
+          placeholder="id email name"
+          ng-class="['form-control', { 'limited-be': $ctrl.isLimitedToBE && $ctrl.state.provider !== 'custom' }]"
+          ng-disabled="$ctrl.isLimitedToBE && $ctrl.state.provider !== 'custom'"
+        />
+      </div>
+    </div>
+
+    <oauth-auth-style value="$ctrl.settings.AuthStyle" on-change="($ctrl.onChangeAuthStyle)"></oauth-auth-style>
+    <save-auth-settings-button
+      on-save-settings="($ctrl.onSaveSettings)"
+      save-button-state="($ctrl.saveButtonState)"
+      save-button-disabled="!$ctrl.isOAuthTeamMembershipFormValid() || oauthSettingsForm.$invalid"
+      limited-feature-id="$ctrl.limitedFeature"
+      limited-feature-class="$ctrl.limitedFeatureClass"
+      class-name="'oauth-save-settings-button'"
+    ></save-auth-settings-button>
+  </div>
+
+  <div ng-if="$ctrl.state.provider != 'custom'" class="limited-be be-indicator-container">
+    <div class="limited-be-link vertical-center"><be-feature-indicator feature="$ctrl.limitedFeature"></be-feature-indicator></div>
+    <div class="limited-be-content">
+      <div class="col-sm-12 form-section-title">OAuth Configuration</div>
+
+      <div class="form-group" ng-if="$ctrl.state.provider == 'microsoft'">
+        <label for="oauth_microsoft_tenant_id" class="col-sm-3 col-lg-2 control-label text-left">
+          Tenant ID
+          <portainer-tooltip message="'ID of the Azure Directory you wish to authenticate against. Also known as the Directory ID'"></portainer-tooltip>
+        </label>
+        <div class="col-sm-9 col-lg-10">
+          <input
+            type="text"
+            data-cy="oauth-microsoft-tenant-id"
+            class="form-control"
+            id="oauth_microsoft_tenant_id"
+            placeholder="xxxxxxxxxxxxxxxxxxxx"
+            ng-model="$ctrl.state.microsoftTenantID"
+            ng-change="$ctrl.onMicrosoftTenantIDChange()"
+            limited-feature-dir="{{::$ctrl.limitedFeature}}"
+            limited-feature-class="limited-be"
+            limited-feature-disabled
+            limited-feature-tabindex="-1"
+            required
+          />
+        </div>
+      </div>
+
+      <div class="form-group">
+        <label for="oauth_client_id" class="col-sm-3 col-lg-2 control-label text-left">
+          {{ $ctrl.state.provider == 'microsoft' ? 'Application ID' : 'Client ID' }}
+          <portainer-tooltip message="'Public identifier of the OAuth application'"></portainer-tooltip>
+        </label>
+        <div class="col-sm-9 col-lg-10">
+          <input
+            type="text"
+            data-cy="oauth-client-id"
+            id="oauth_client_id"
+            ng-model="$ctrl.settings.ClientID"
+            placeholder="xxxxxxxxxxxxxxxxxxxx"
+            ng-class="['form-control', { 'limited-be': $ctrl.isLimitedToBE && $ctrl.state.provider !== 'custom' }]"
+            ng-disabled="$ctrl.isLimitedToBE && $ctrl.state.provider !== 'custom'"
+            tabindex="{{ $ctrl.isLimitedToBE && $ctrl.state.provider !== 'custom' ? -1 : 0 }}"
+          />
+        </div>
+      </div>
+
+      <div class="form-group">
+        <label for="oauth_client_secret" class="col-sm-3 col-lg-2 control-label text-left"> {{ $ctrl.state.provider == 'microsoft' ? 'Application key' : 'Client secret' }} </label>
+        <div class="col-sm-9 col-lg-10">
+          <input
+            type="password"
+            class="form-control"
+            id="oauth_client_secret"
+            ng-model="$ctrl.settings.ClientSecret"
+            placeholder="*******"
+            autocomplete="new-password"
+            ng-class="['form-control', { 'limited-be': $ctrl.isLimitedToBE && $ctrl.state.provider !== 'custom' }]"
+            ng-disabled="$ctrl.isLimitedToBE && $ctrl.state.provider !== 'custom'"
+            tabindex="{{ $ctrl.isLimitedToBE && $ctrl.state.provider !== 'custom' ? -1 : 0 }}"
+          />
+        </div>
+      </div>
+
+      <div class="form-group">
+        <div class="col-sm-12">
+          <a class="small interactive vertical-center" ng-if="!$ctrl.state.overrideConfiguration" ng-click="$ctrl.state.overrideConfiguration = true;">
+            <pr-icon icon="'wrench'"></pr-icon>
+            Override default configuration
+          </a>
+          <a class="small interactive vertical-center" ng-if="$ctrl.state.overrideConfiguration" ng-click="$ctrl.useDefaultProviderConfiguration($ctrl.state.provider)">
+            <pr-icon icon="'settings'"></pr-icon>
+            Use default configuration
+          </a>
+        </div>
+      </div>
+      <save-auth-settings-button
+        on-save-settings="($ctrl.onSaveSettings)"
+        save-button-state="($ctrl.saveButtonState)"
+        save-button-disabled="!$ctrl.isOAuthTeamMembershipFormValid() || oauthSettingsForm.$invalid"
+        limited-feature-id="$ctrl.limitedFeature"
+        limited-feature-class="$ctrl.limitedFeatureClass"
+        class-name="'oauth-save-settings-button'"
+      ></save-auth-settings-button>
+    </div>
+  </div>
+</ng-form>
diff --git a/app/portainer/oauth/components/oauth-settings/providers.js b/app/portainer/oauth/components/oauth-settings/providers.js
new file mode 100644
index 0000000..124bf35
--- /dev/null
+++ b/app/portainer/oauth/components/oauth-settings/providers.js
@@ -0,0 +1,49 @@
+import { baseHref } from '@/portainer/helpers/pathHelper';
+import { OAuthStyle } from '@/react/portainer/settings/types';
+
+export default {
+  microsoft: {
+    authUrl: 'https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/authorize',
+    accessTokenUrl: 'https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/token',
+    resourceUrl: 'https://graph.microsoft.com/v1.0/me',
+    logoutUrl: `https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/logout`,
+    userIdentifier: 'userPrincipalName',
+    scopes: 'profile openid',
+    authStyle: OAuthStyle.InParams,
+  },
+  google: {
+    authUrl: 'https://accounts.google.com/o/oauth2/auth',
+    accessTokenUrl: 'https://accounts.google.com/o/oauth2/token',
+    resourceUrl: 'https://www.googleapis.com/oauth2/v1/userinfo?alt=json',
+    logoutUrl: `https://www.google.com/accounts/Logout?continue=https://appengine.google.com/_ah/logout?continue=${window.location.origin}${baseHref()}#!/auth`,
+    userIdentifier: 'email',
+    scopes: 'profile email',
+    authStyle: OAuthStyle.InParams,
+  },
+  github: {
+    authUrl: 'https://github.com/login/oauth/authorize',
+    accessTokenUrl: 'https://github.com/login/oauth/access_token',
+    resourceUrl: 'https://api.github.com/user',
+    logoutUrl: `https://github.com/logout`,
+    userIdentifier: 'login',
+    scopes: 'id email name',
+    authStyle: OAuthStyle.AutoDetect,
+  },
+  custom: { authUrl: '', accessTokenUrl: '', resourceUrl: '', logoutUrl: '', userIdentifier: '', scopes: '', authStyle: OAuthStyle.AutoDetect },
+};
+
+export function getProviderByUrl(providerAuthURL = '') {
+  if (providerAuthURL.includes('login.microsoftonline.com')) {
+    return 'microsoft';
+  }
+
+  if (providerAuthURL.includes('accounts.google.com')) {
+    return 'google';
+  }
+
+  if (providerAuthURL.includes('github.com')) {
+    return 'github';
+  }
+
+  return 'custom';
+}
diff --git a/app/portainer/oauth/services/rest/oauth.js b/app/portainer/oauth/services/rest/oauth.js
new file mode 100644
index 0000000..b221f7d
--- /dev/null
+++ b/app/portainer/oauth/services/rest/oauth.js
@@ -0,0 +1,20 @@
+angular.module('portainer.oauth').factory('OAuth', [
+  '$resource',
+  'API_ENDPOINT_OAUTH',
+  function OAuthFactory($resource, API_ENDPOINT_OAUTH) {
+    'use strict';
+    return $resource(
+      API_ENDPOINT_OAUTH + '/:action',
+      {},
+      {
+        validate: {
+          method: 'POST',
+          ignoreLoadingBar: true,
+          params: {
+            action: 'validate',
+          },
+        },
+      }
+    );
+  },
+]);
diff --git a/app/portainer/rbac/components/access-viewer/access-viewer.controller.js b/app/portainer/rbac/components/access-viewer/access-viewer.controller.js
new file mode 100644
index 0000000..b42bd37
--- /dev/null
+++ b/app/portainer/rbac/components/access-viewer/access-viewer.controller.js
@@ -0,0 +1,69 @@
+import _ from 'lodash-es';
+
+import { isLimitedToBE } from '@/react/portainer/feature-flags/feature-flags.service';
+
+export default class AccessViewerController {
+  /* @ngInject */
+  constructor($scope, Notifications, UserService, TeamMembershipService, Authentication) {
+    this.$scope = $scope;
+    this.Notifications = Notifications;
+    this.UserService = UserService;
+    this.TeamMembershipService = TeamMembershipService;
+    this.Authentication = Authentication;
+
+    this.limitedFeature = 'rbac-roles';
+    this.users = [];
+    this.selectedUserId = null;
+
+    this.onUserSelect = this.onUserSelect.bind(this);
+  }
+
+  onUserSelect(selectedUserId) {
+    this.$scope.$evalAsync(() => {
+      this.selectedUserId = selectedUserId;
+    });
+  }
+
+  // for admin, returns all users
+  // for team leader, only return all his/her team member users
+  async teamMemberUsers(users, teamMemberships) {
+    if (this.isAdmin) {
+      return users;
+    }
+
+    const filteredUsers = [];
+    const userId = this.Authentication.getUserDetails().ID;
+    const leadingTeams = await this.UserService.userLeadingTeams(userId);
+
+    const isMember = (userId, teamId) => {
+      return !!_.find(teamMemberships, { UserId: userId, TeamId: teamId });
+    };
+
+    for (const user of users) {
+      for (const leadingTeam of leadingTeams) {
+        if (isMember(user.Id, leadingTeam.Id)) {
+          filteredUsers.push(user);
+          break;
+        }
+      }
+    }
+
+    return filteredUsers;
+  }
+
+  async $onInit() {
+    try {
+      if (isLimitedToBE(this.limitedFeature)) {
+        return;
+      }
+
+      this.isAdmin = this.Authentication.isAdmin();
+      const allUsers = await this.UserService.users();
+      const teamMemberships = await this.TeamMembershipService.memberships();
+      const teamUsers = await this.teamMemberUsers(allUsers, teamMemberships);
+      this.users = teamUsers.map((user) => ({ label: user.Username, value: user.Id }));
+    } catch (err) {
+      this.Notifications.error('Failure', err, 'Unable to retrieve users');
+    }
+  }
+}
diff --git a/app/portainer/rbac/components/access-viewer/access-viewer.html b/app/portainer/rbac/components/access-viewer/access-viewer.html
new file mode 100644
index 0000000..3d5ac0c
--- /dev/null
+++ b/app/portainer/rbac/components/access-viewer/access-viewer.html
@@ -0,0 +1,26 @@
+<div class="col-sm-12 !mb-4">
+  <div class="be-indicator-container limited-be">
+    <div class="limited-be-link vertical-center"><be-feature-indicator feature="$ctrl.limitedFeature"></be-feature-indicator></div>
+    <div class="limited-be-content">
+      <rd-widget>
+        <rd-widget-header icon="user-x">
+          <header-title> Effective access viewer </header-title>
+        </rd-widget-header>
+        <rd-widget-body>
+          <form class="form-horizontal">
+            <div class="col-sm-12 form-section-title"> User </div>
+            <div class="form-group">
+              <div class="col-sm-12">
+                <span class="small text-muted" ng-if="$ctrl.users.length === 0"> No user available </span>
+
+                <por-select ng-if="$ctrl.users.length > 0" value="$ctrl.selectedUserId" options="$ctrl.users" on-change="($ctrl.onUserSelect)" placeholder="'Select a user'">
+                </por-select>
+              </div>
+            </div>
+            <effective-access-viewer user-id="$ctrl.selectedUserId"></effective-access-viewer>
+          </form>
+        </rd-widget-body>
+      </rd-widget>
+    </div>
+  </div>
+</div>
diff --git a/app/portainer/rbac/components/access-viewer/index.js b/app/portainer/rbac/components/access-viewer/index.js
new file mode 100644
index 0000000..334f0f0
--- /dev/null
+++ b/app/portainer/rbac/components/access-viewer/index.js
@@ -0,0 +1,6 @@
+import controller from './access-viewer.controller';
+
+export const accessViewer = {
+  templateUrl: './access-viewer.html',
+  controller,
+};
diff --git a/app/portainer/rbac/index.js b/app/portainer/rbac/index.js
new file mode 100644
index 0000000..7638c33
--- /dev/null
+++ b/app/portainer/rbac/index.js
@@ -0,0 +1,34 @@
+import { AccessHeaders } from '../authorization-guard';
+import { rolesView } from './views/roles';
+import { accessViewer } from './components/access-viewer';
+
+import { RoleService } from './services/role.service';
+import { RolesFactory } from './services/role.rest';
+
+angular
+  .module('portainer.rbac', ['ngResource'])
+  .constant('API_ENDPOINT_ROLES', 'api/roles')
+  .component('accessViewer', accessViewer)
+  .component('rolesView', rolesView)
+  .factory('RoleService', RoleService)
+  .factory('Roles', RolesFactory)
+  .config(config);
+
+/* @ngInject */
+function config($stateRegistryProvider) {
+  const roles = {
+    name: 'portainer.roles',
+    url: '/roles',
+    views: {
+      'content@': {
+        component: 'rolesView',
+      },
+    },
+    data: {
+      docs: '/admin/user/roles',
+      access: AccessHeaders.Admin,
+    },
+  };
+
+  $stateRegistryProvider.register(roles);
+}
diff --git a/app/portainer/rbac/models/role.js b/app/portainer/rbac/models/role.js
new file mode 100644
index 0000000..44cb4a3
--- /dev/null
+++ b/app/portainer/rbac/models/role.js
@@ -0,0 +1,14 @@
+export function RoleViewModel(id, name, description, authorizations) {
+  this.ID = id;
+  this.Name = name;
+  this.Description = description;
+  this.Authorizations = authorizations;
+}
+
+export const RoleTypes = Object.freeze({
+  ENDPOINT_ADMIN: 1,
+  HELPDESK: 2,
+  STANDARD: 3,
+  READ_ONLY: 4,
+  OPERATOR: 5,
+});
diff --git a/app/portainer/rbac/services/role.rest.js b/app/portainer/rbac/services/role.rest.js
new file mode 100644
index 0000000..1213609
--- /dev/null
+++ b/app/portainer/rbac/services/role.rest.js
@@ -0,0 +1,14 @@
+/* @ngInject */
+export function RolesFactory($resource, API_ENDPOINT_ROLES) {
+  return $resource(
+    API_ENDPOINT_ROLES + '/:id',
+    {},
+    {
+      create: { method: 'POST', ignoreLoadingBar: true },
+      query: { method: 'GET', isArray: true },
+      get: { method: 'GET', params: { id: '@id' } },
+      update: { method: 'PUT', params: { id: '@id' } },
+      remove: { method: 'DELETE', params: { id: '@id' } },
+    }
+  );
+}
diff --git a/app/portainer/rbac/services/role.service.js b/app/portainer/rbac/services/role.service.js
new file mode 100644
index 0000000..14b763b
--- /dev/null
+++ b/app/portainer/rbac/services/role.service.js
@@ -0,0 +1,19 @@
+import { RoleViewModel, RoleTypes } from '../models/role';
+
+export function RoleService() {
+  const rolesData = [
+    new RoleViewModel(RoleTypes.ENDPOINT_ADMIN, 'Environment administrator', 'Full control of all resources in an environment', []),
+    new RoleViewModel(RoleTypes.OPERATOR, 'Operator', 'Operational Control of all existing resources in an environment', []),
+    new RoleViewModel(RoleTypes.HELPDESK, 'Helpdesk', 'Read-only access of all resources in an environment', []),
+    new RoleViewModel(RoleTypes.READ_ONLY, 'Read-only user', 'Read-only access of assigned resources in an environment', []),
+    new RoleViewModel(RoleTypes.STANDARD, 'Standard user', 'Full control of assigned resources in an environment', []),
+  ];
+
+  return {
+    roles,
+  };
+
+  function roles() {
+    return rolesData;
+  }
+}
diff --git a/app/portainer/rbac/views/roles/index.js b/app/portainer/rbac/views/roles/index.js
new file mode 100644
index 0000000..c1e91cf
--- /dev/null
+++ b/app/portainer/rbac/views/roles/index.js
@@ -0,0 +1,6 @@
+import controller from './roles.controller';
+
+export const rolesView = {
+  templateUrl: './roles.html',
+  controller,
+};
diff --git a/app/portainer/rbac/views/roles/roles.controller.js b/app/portainer/rbac/views/roles/roles.controller.js
new file mode 100644
index 0000000..742c243
--- /dev/null
+++ b/app/portainer/rbac/views/roles/roles.controller.js
@@ -0,0 +1,20 @@
+import _ from 'lodash-es';
+
+export default class RolesController {
+  /* @ngInject */
+  constructor(Notifications, RoleService) {
+    this.Notifications = Notifications;
+    this.RoleService = RoleService;
+  }
+
+  async $onInit() {
+    this.roles = [];
+
+    try {
+      this.roles = await this.RoleService.roles();
+      this.roles = _.orderBy(this.roles, 'Priority', 'asc');
+    } catch (err) {
+      this.Notifications.error('Failure', err, 'Unable to retrieve roles');
+    }
+  }
+}
diff --git a/app/portainer/rbac/views/roles/roles.html b/app/portainer/rbac/views/roles/roles.html
new file mode 100644
index 0000000..ac32d08
--- /dev/null
+++ b/app/portainer/rbac/views/roles/roles.html
@@ -0,0 +1,7 @@
+<page-header title="'Roles'" breadcrumbs="['Role management']" reload="true"> </page-header>
+
+<rbac-roles-datatable dataset="$ctrl.roles"></rbac-roles-datatable>
+
+<div class="row">
+  <access-viewer> </access-viewer>
+</div>
diff --git a/app/portainer/react/components/access-control.ts b/app/portainer/react/components/access-control.ts
new file mode 100644
index 0000000..ce36739
--- /dev/null
+++ b/app/portainer/react/components/access-control.ts
@@ -0,0 +1,65 @@
+import angular from 'angular';
+
+import { r2a } from '@/react-tools/react2angular';
+import { withCurrentUser } from '@/react-tools/withCurrentUser';
+import { withReactQuery } from '@/react-tools/withReactQuery';
+import { withUIRouter } from '@/react-tools/withUIRouter';
+import { PorAccessControlFormTeamSelector } from '@/react/portainer/access-control/PorAccessControlForm/TeamsSelector';
+import { PorAccessControlFormUserSelector } from '@/react/portainer/access-control/PorAccessControlForm/UsersSelector';
+import { PorAccessManagementUsersSelector } from '@/react/portainer/access-control/AccessManagement/PorAccessManagementUsersSelector';
+import { AccessTypeSelector } from '@/react/portainer/access-control/EditDetails/AccessTypeSelector';
+import { AccessControlPanel } from '@/react/portainer/access-control';
+
+export const accessControlModule = angular
+  .module('portainer.app.react.components.access-control', [])
+  .component(
+    'accessControlPanel',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(AccessControlPanel))), [
+      'disableOwnershipChange',
+      'onUpdateSuccess',
+      'resourceControl',
+      'resourceId',
+      'resourceType',
+      'environmentId',
+      'resourceName',
+    ])
+  )
+  .component(
+    'accessTypeSelector',
+    r2a(AccessTypeSelector, [
+      'isAdmin',
+      'isPublicVisible',
+      'name',
+      'onChange',
+      'value',
+      'teams',
+      'resourceName',
+    ])
+  )
+  .component(
+    'porAccessControlFormTeamSelector',
+    r2a(PorAccessControlFormTeamSelector, [
+      'inputId',
+      'onChange',
+      'options',
+      'value',
+    ])
+  )
+  .component(
+    'porAccessControlFormUserSelector',
+    r2a(PorAccessControlFormUserSelector, [
+      'inputId',
+      'onChange',
+      'options',
+      'value',
+    ])
+  )
+  .component(
+    'porAccessManagementUsersSelector',
+    r2a(PorAccessManagementUsersSelector, [
+      'onChange',
+      'options',
+      'value',
+      'isLoading',
+    ])
+  ).name;
diff --git a/app/portainer/react/components/account.ts b/app/portainer/react/components/account.ts
new file mode 100644
index 0000000..ad96c99
--- /dev/null
+++ b/app/portainer/react/components/account.ts
@@ -0,0 +1,33 @@
+import angular from 'angular';
+
+import { r2a } from '@/react-tools/react2angular';
+import { withCurrentUser } from '@/react-tools/withCurrentUser';
+import { withUIRouter } from '@/react-tools/withUIRouter';
+import { withReactQuery } from '@/react-tools/withReactQuery';
+import { HelmRepositoryDatatable } from '@/react/portainer/account/AccountView/HelmRepositoryDatatable';
+import { AccessTokensDatatable } from '@/react/portainer/account/AccountView/AccessTokensDatatable';
+import { ApplicationSettingsWidget } from '@/react/portainer/account/AccountView/ApplicationSettings';
+
+export const accountModule = angular
+  .module('portainer.app.react.components.account', [])
+  .component(
+    'applicationSettingsWidget',
+    r2a(
+      withUIRouter(withReactQuery(withCurrentUser(ApplicationSettingsWidget))),
+      []
+    )
+  )
+  .component(
+    'helmRepositoryDatatable',
+    r2a(
+      withUIRouter(withReactQuery(withCurrentUser(HelmRepositoryDatatable))),
+      []
+    )
+  )
+  .component(
+    'accessTokensDatatable',
+    r2a(
+      withUIRouter(withReactQuery(withCurrentUser(AccessTokensDatatable))),
+      []
+    )
+  ).name;
diff --git a/app/portainer/react/components/activity-logs.ts b/app/portainer/react/components/activity-logs.ts
new file mode 100644
index 0000000..4c83725
--- /dev/null
+++ b/app/portainer/react/components/activity-logs.ts
@@ -0,0 +1,24 @@
+import angular from 'angular';
+
+import { r2a } from '@/react-tools/react2angular';
+import { withUIRouter } from '@/react-tools/withUIRouter';
+import { withReactQuery } from '@/react-tools/withReactQuery';
+import { AuthenticationLogsTable } from '@/react/portainer/logs/AuthenticationLogsView/AuthenticationLogsTable';
+
+export const activityLogsModule = angular
+  .module('portainer.app.react.components.activity-logs', [])
+  .component(
+    'authenticationLogsTable',
+    r2a(withUIRouter(withReactQuery(AuthenticationLogsTable)), [
+      'currentPage',
+      'dataset',
+      'keyword',
+      'limit',
+      'totalItems',
+      'sort',
+      'onChangeSort',
+      'onChangePage',
+      'onChangeLimit',
+      'onChangeKeyword',
+    ])
+  ).name;
diff --git a/app/portainer/react/components/auth.ts b/app/portainer/react/components/auth.ts
new file mode 100644
index 0000000..fede9ba
--- /dev/null
+++ b/app/portainer/react/components/auth.ts
@@ -0,0 +1,8 @@
+import angular from 'angular';
+
+import { r2a } from '@/react-tools/react2angular';
+import { SetupTokenTextTip } from '@/react/portainer/init/InitAdminView/SetupTokenTextTip';
+
+export const authModule = angular
+  .module('portainer.app.react.components.auth', [])
+  .component('setupTokenTextTip', r2a(SetupTokenTextTip, [])).name;
diff --git a/app/portainer/react/components/custom-templates/index.ts b/app/portainer/react/components/custom-templates/index.ts
new file mode 100644
index 0000000..46f8172
--- /dev/null
+++ b/app/portainer/react/components/custom-templates/index.ts
@@ -0,0 +1,32 @@
+import angular from 'angular';
+
+import { r2a } from '@/react-tools/react2angular';
+import { CustomTemplatesVariablesDefinitionField } from '@/react/portainer/custom-templates/components/CustomTemplatesVariablesDefinitionField';
+import { CustomTemplatesVariablesField } from '@/react/portainer/custom-templates/components/CustomTemplatesVariablesField';
+import { withControlledInput } from '@/react-tools/withControlledInput';
+
+import { VariablesFieldAngular } from './variables-field';
+
+export const ngModule = angular
+  .module('portainer.app.react.components.custom-templates', [])
+  .component(
+    'customTemplatesVariablesFieldReact',
+    r2a(withControlledInput(CustomTemplatesVariablesField), [
+      'value',
+      'onChange',
+      'definitions',
+      'errors',
+    ])
+  )
+  .component('customTemplatesVariablesField', VariablesFieldAngular)
+  .component(
+    'customTemplatesVariablesDefinitionField',
+    r2a(withControlledInput(CustomTemplatesVariablesDefinitionField), [
+      'onChange',
+      'value',
+      'errors',
+      'isVariablesNamesFromParent',
+    ])
+  );
+
+export const customTemplatesModule = ngModule.name;
diff --git a/app/portainer/react/components/custom-templates/variables-field.ts b/app/portainer/react/components/custom-templates/variables-field.ts
new file mode 100644
index 0000000..3058041
--- /dev/null
+++ b/app/portainer/react/components/custom-templates/variables-field.ts
@@ -0,0 +1,71 @@
+import {
+  IComponentOptions,
+  IComponentController,
+  IFormController,
+  IScope,
+  IOnChangesObject,
+} from 'angular';
+
+import { VariableDefinition } from '@/react/portainer/custom-templates/components/CustomTemplatesVariablesDefinitionField/CustomTemplatesVariablesDefinitionField';
+
+class VariablesFieldController implements IComponentController {
+  formCtrl!: IFormController;
+
+  value!: Record<string, string>;
+
+  definitions!: VariableDefinition[];
+
+  onChange!: (value: Record<string, string>) => void;
+
+  $scope: IScope;
+
+  /* @ngInject */
+  constructor($scope: IScope) {
+    this.handleChange = this.handleChange.bind(this);
+
+    this.$scope = $scope;
+  }
+
+  handleChange(value: Record<string, string>) {
+    this.$scope.$evalAsync(() => {
+      this.onChange(value);
+    });
+  }
+
+  $onChanges({ value }: IOnChangesObject) {
+    if (value?.currentValue) {
+      this.checkValidity(value.currentValue);
+    }
+  }
+
+  checkValidity(value: Record<string, string>) {
+    this.formCtrl.$setValidity(
+      'templateVariables',
+      Object.entries(value).every(
+        ([name, value]) =>
+          !!value ||
+          this.definitions.some(
+            (def) => def.name === name && !!def.defaultValue
+          )
+      ),
+      this.formCtrl
+    );
+  }
+}
+
+export const VariablesFieldAngular: IComponentOptions = {
+  template: `<custom-templates-variables-field-react
+    value="$ctrl.value"
+    on-change="$ctrl.handleChange"
+    definitions="$ctrl.definitions"
+  ></custom-templates-variables-field-react>`,
+  bindings: {
+    value: '<',
+    definitions: '<',
+    onChange: '<',
+  },
+  require: {
+    formCtrl: '^form',
+  },
+  controller: VariablesFieldController,
+};
diff --git a/app/portainer/react/components/environments.ts b/app/portainer/react/components/environments.ts
new file mode 100644
index 0000000..f6b831d
--- /dev/null
+++ b/app/portainer/react/components/environments.ts
@@ -0,0 +1,8 @@
+import angular from 'angular';
+
+import { r2a } from '@/react-tools/react2angular';
+import { TagsDatatable } from '@/react/portainer/environments/TagsView/TagsDatatable';
+
+export const environmentsModule = angular
+  .module('portainer.app.react.components.environments', [])
+  .component('tagsDatatable', r2a(TagsDatatable, ['dataset', 'onRemove'])).name;
diff --git a/app/portainer/react/components/file-upload-field.ts b/app/portainer/react/components/file-upload-field.ts
new file mode 100644
index 0000000..7c12a42
--- /dev/null
+++ b/app/portainer/react/components/file-upload-field.ts
@@ -0,0 +1,20 @@
+import { r2a } from '@/react-tools/react2angular';
+
+import { FileUploadField } from '@@/form-components/FileUpload';
+
+export const fileUploadField = r2a(FileUploadField, [
+  'onChange',
+  'value',
+  'title',
+  'required',
+  'accept',
+  'inputId',
+  'data-cy',
+  'className',
+  'color',
+  'name',
+  'hideFilename',
+  'tooltip',
+  'disabled',
+  'state',
+]);
diff --git a/app/portainer/react/components/git-form.ts b/app/portainer/react/components/git-form.ts
new file mode 100644
index 0000000..74dbf14
--- /dev/null
+++ b/app/portainer/react/components/git-form.ts
@@ -0,0 +1,27 @@
+import angular from 'angular';
+
+import { r2a } from '@/react-tools/react2angular';
+import { withCurrentUser } from '@/react-tools/withCurrentUser';
+import { withReactQuery } from '@/react-tools/withReactQuery';
+import { withUIRouter } from '@/react-tools/withUIRouter';
+import { GitForm } from '@/react/portainer/gitops/GitForm';
+
+export const gitFormModule = angular
+  .module('portainer.app.components.forms.git', [])
+  .component(
+    'reactGitForm',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(GitForm))), [
+      'value',
+      'onChange',
+      'environmentType',
+      'isDockerStandalone',
+      'deployMethod',
+      'isAdditionalFilesFieldVisible',
+      'isForcePullVisible',
+      'errors',
+      'baseWebhookUrl',
+      'webhookId',
+      'webhooksDocs',
+      'isAutoUpdateVisible',
+    ])
+  ).name;
diff --git a/app/portainer/react/components/index.ts b/app/portainer/react/components/index.ts
new file mode 100644
index 0000000..f0b3017
--- /dev/null
+++ b/app/portainer/react/components/index.ts
@@ -0,0 +1,306 @@
+import angular from 'angular';
+
+import { r2a } from '@/react-tools/react2angular';
+import { withCurrentUser } from '@/react-tools/withCurrentUser';
+import { withReactQuery } from '@/react-tools/withReactQuery';
+import { withUIRouter } from '@/react-tools/withUIRouter';
+import { AnnotationsBeTeaser } from '@/react/kubernetes/annotations/AnnotationsBeTeaser';
+import { withFormValidation } from '@/react-tools/withFormValidation';
+import { withControlledInput } from '@/react-tools/withControlledInput';
+
+import {
+  EnvironmentVariablesFieldset,
+  EnvironmentVariablesPanel,
+  StackEnvironmentVariablesPanel,
+  envVarValidation,
+} from '@@/form-components/EnvironmentVariablesFieldset';
+import { Icon } from '@@/Icon';
+import { ReactQueryDevtoolsWrapper } from '@@/ReactQueryDevtoolsWrapper';
+import { PageHeader } from '@@/PageHeader';
+import { TagSelector } from '@@/TagSelector';
+import { Loading } from '@@/Widget/Loading';
+import { PasswordCheckHint } from '@@/PasswordCheckHint';
+import { Tooltip } from '@@/Tip/Tooltip';
+import { TableColumnHeaderAngular } from '@@/datatables/TableHeaderCell';
+import { DashboardItem } from '@@/DashboardItem';
+import { SearchBar } from '@@/datatables/SearchBar';
+import { FallbackImage } from '@@/FallbackImage';
+import { BadgeIcon } from '@@/BadgeIcon';
+import { TeamsSelector } from '@@/TeamsSelector';
+import { TerminalTooltip } from '@@/TerminalTooltip';
+import { Terminal } from '@@/Terminal/Terminal';
+import { PortainerSelect } from '@@/form-components/PortainerSelect';
+import { Slider } from '@@/form-components/Slider';
+import { TagButton } from '@@/TagButton';
+import { BETeaserButton } from '@@/BETeaserButton';
+import { CodeEditor } from '@@/CodeEditor';
+import { HelpLink } from '@@/HelpLink';
+import { TextTip } from '@@/Tip/TextTip';
+import { InlineLoader } from '@@/InlineLoader/InlineLoader';
+
+import { fileUploadField } from './file-upload-field';
+import { switchField } from './switch-field';
+import { customTemplatesModule } from './custom-templates';
+import { gitFormModule } from './git-form';
+import { settingsModule } from './settings';
+import { accessControlModule } from './access-control';
+import { environmentsModule } from './environments';
+import { registriesModule } from './registries';
+import { accountModule } from './account';
+import { usersModule } from './users';
+import { activityLogsModule } from './activity-logs';
+import { rbacModule } from './rbac';
+import { stacksModule } from './stacks';
+import { authModule } from './auth';
+
+export const ngModule = angular
+  .module('portainer.app.react.components', [
+    authModule,
+    accessControlModule,
+    customTemplatesModule,
+    environmentsModule,
+    gitFormModule,
+    registriesModule,
+    settingsModule,
+    accountModule,
+    usersModule,
+    activityLogsModule,
+    rbacModule,
+    stacksModule,
+  ])
+  .component(
+    'tagSelector',
+    r2a(withUIRouter(withReactQuery(TagSelector)), [
+      'allowCreate',
+      'onChange',
+      'value',
+      'errors',
+    ])
+  )
+  .component(
+    'beTeaserButton',
+    r2a(BETeaserButton, [
+      'featureId',
+      'heading',
+      'message',
+      'buttonText',
+      'className',
+      'buttonClassName',
+      'data-cy',
+    ])
+  )
+  .component(
+    'tagButton',
+    r2a(TagButton, ['value', 'label', 'title', 'onRemove'])
+  )
+
+  .component(
+    'portainerTooltip',
+    r2a(Tooltip, ['message', 'position', 'className', 'setHtmlMessage', 'size'])
+  )
+  .component('terminalTooltip', r2a(TerminalTooltip, []))
+  .component('fileUploadField', fileUploadField)
+  .component('porSwitchField', switchField)
+  .component(
+    'passwordCheckHint',
+    r2a(withReactQuery(PasswordCheckHint), [
+      'forceChangePassword',
+      'passwordValid',
+    ])
+  )
+  .component('rdLoading', r2a(Loading, []))
+  .component(
+    'tableColumnHeader',
+    r2a(TableColumnHeaderAngular, [
+      'colTitle',
+      'canSort',
+      'isSorted',
+      'isSortedDesc',
+    ])
+  )
+  .component(
+    'pageHeader',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(PageHeader))), [
+      'title',
+      'breadcrumbs',
+      'loading',
+      'onReload',
+      'reload',
+      'id',
+      'showTitle',
+    ])
+  )
+  .component(
+    'fallbackImage',
+    r2a(FallbackImage, ['src', 'fallbackIcon', 'alt', 'className'])
+  )
+  .component('prIcon', r2a(Icon, ['className', 'icon', 'mode', 'size', 'spin']))
+  .component(
+    'reactQueryDevTools',
+    r2a(withReactQuery(ReactQueryDevtoolsWrapper), [])
+  )
+  .component(
+    'helpLink',
+    r2a(withUIRouter(withReactQuery(HelpLink)), [
+      'docLink',
+      'target',
+      'children',
+    ])
+  )
+  .component(
+    'dashboardItem',
+    r2a(DashboardItem, [
+      'icon',
+      'type',
+      'value',
+      'to',
+      'params',
+      'children',
+      'pluralType',
+      'isLoading',
+      'isRefetching',
+      'data-cy',
+      'iconClass',
+    ])
+  )
+  .component(
+    'datatableSearchbar',
+    r2a(SearchBar, [
+      'data-cy',
+      'onChange',
+      'value',
+      'placeholder',
+      'children',
+      'className',
+    ])
+  )
+  .component('badgeIcon', r2a(BadgeIcon, ['icon', 'size', 'iconClass']))
+  .component(
+    'teamsSelector',
+    r2a(TeamsSelector, [
+      'onChange',
+      'value',
+      'dataCy',
+      'inputId',
+      'name',
+      'placeholder',
+      'teams',
+      'disabled',
+    ])
+  )
+  .component(
+    'porSelect',
+    r2a(PortainerSelect, [
+      'name',
+      'inputId',
+      'placeholder',
+      'disabled',
+      'data-cy',
+      'bindToBody',
+      'value',
+      'onChange',
+      'options',
+      'isMulti',
+      'filterOption',
+      'isClearable',
+      'components',
+      'isLoading',
+      'noOptionsMessage',
+      'aria-label',
+      'size',
+      'loadingMessage',
+      'getOptionValue',
+      'onBlur',
+    ])
+  )
+  .component(
+    'porSlider',
+    r2a(Slider, [
+      'min',
+      'max',
+      'step',
+      'value',
+      'onChange',
+      'visibleTooltip',
+      'dataCy',
+      'disabled',
+    ])
+  )
+  .component(
+    'reactCodeEditor',
+    r2a(CodeEditor, [
+      'id',
+      'textTip',
+      'type',
+      'readonly',
+      'onChange',
+      'value',
+      'height',
+      'data-cy',
+      'versions',
+      'onVersionChange',
+      'schema',
+      'fileName',
+      'placeholder',
+      'showToolbar',
+      'aria-label',
+    ])
+  )
+  .component(
+    'textTip',
+    r2a(TextTip, [
+      'className',
+      'color',
+      'icon',
+      'inline',
+      'children',
+      'childrenWrapperClassName',
+    ])
+  )
+  .component(
+    'inlineLoader',
+    r2a(InlineLoader, ['children', 'className', 'size'])
+  )
+  .component('annotationsBeTeaser', r2a(AnnotationsBeTeaser, []))
+  .component(
+    'shellTerminal',
+    r2a(Terminal, [
+      'url',
+      'connect',
+      'onStateChange',
+      'onResize',
+      'initialCommands',
+    ])
+  );
+
+export const componentsModule = ngModule.name;
+
+withFormValidation(
+  ngModule,
+  withControlledInput(EnvironmentVariablesFieldset, { values: 'onChange' }),
+  'environmentVariablesFieldset',
+  ['canUndoDelete'],
+  envVarValidation
+);
+
+withFormValidation(
+  ngModule,
+  withControlledInput(EnvironmentVariablesPanel, { values: 'onChange' }),
+  'environmentVariablesPanel',
+  ['explanation', 'showHelpMessage', 'isFoldable'],
+  envVarValidation
+);
+
+withFormValidation(
+  ngModule,
+  withUIRouter(
+    withReactQuery(
+      withControlledInput(StackEnvironmentVariablesPanel, {
+        values: 'onChange',
+      })
+    )
+  ),
+  'stackEnvironmentVariablesPanel',
+  ['showHelpMessage', 'isFoldable'],
+  envVarValidation
+);
diff --git a/app/portainer/react/components/rbac.ts b/app/portainer/react/components/rbac.ts
new file mode 100644
index 0000000..24e80c5
--- /dev/null
+++ b/app/portainer/react/components/rbac.ts
@@ -0,0 +1,24 @@
+import angular from 'angular';
+
+import { r2a } from '@/react-tools/react2angular';
+import { withReactQuery } from '@/react-tools/withReactQuery';
+import { withUIRouter } from '@/react-tools/withUIRouter';
+import { AccessDatatable } from '@/react/portainer/access-control/AccessManagement/AccessDatatable/AccessDatatable';
+
+export const rbacModule = angular
+  .module('portainer.app.react.components.rbac', [])
+  .component(
+    'accessDatatable',
+    r2a(withUIRouter(withReactQuery(AccessDatatable)), [
+      'dataset',
+      'inheritFrom',
+      'isUpdateEnabled',
+      'onRemove',
+      'onUpdate',
+      'showRoles',
+      'showWarning',
+      'tableKey',
+      'isUpdatingAccess',
+      'isLoading',
+    ])
+  ).name;
diff --git a/app/portainer/react/components/registries.ts b/app/portainer/react/components/registries.ts
new file mode 100644
index 0000000..2ac733c
--- /dev/null
+++ b/app/portainer/react/components/registries.ts
@@ -0,0 +1,39 @@
+import angular from 'angular';
+
+import { r2a } from '@/react-tools/react2angular';
+import { withReactQuery } from '@/react-tools/withReactQuery';
+import { withUIRouter } from '@/react-tools/withUIRouter';
+import { RepositoriesDatatable } from '@/react/portainer/registries/repositories/ListView/RepositoriesDatatable';
+import { TagsDatatable } from '@/react/portainer/registries/repositories/ItemView/TagsDatatable/TagsDatatable';
+import { GitlabProjectTable } from '@/react/portainer/registries/CreateView/GitlabProjectsTable/GitlabProjectsTable';
+import { RegistryFormDockerhub } from '@/react/portainer/registries/CreateView/RegistryFormDockerhub/RegistryFormDockerhub';
+
+export const registriesModule = angular
+  .module('portainer.app.react.components.registries', [])
+  .component(
+    'registryRepositoriesDatatable',
+    r2a(withUIRouter(withReactQuery(RepositoriesDatatable)), ['dataset'])
+  )
+  .component(
+    'registriesRepositoryTagsDatatable',
+    r2a(withUIRouter(withReactQuery(TagsDatatable)), [
+      'dataset',
+      'advancedFeaturesAvailable',
+      'onRemove',
+      'onRetag',
+    ])
+  )
+  .component(
+    'gitlabProjectSelector',
+    r2a(GitlabProjectTable, ['dataset', 'onChange', 'value'])
+  )
+  .component(
+    'registryFormDockerhub',
+    r2a(withReactQuery(RegistryFormDockerhub), [
+      'initialValues',
+      'onSubmit',
+      'submitLabel',
+      'isLoading',
+      'nameIsUsed',
+    ])
+  ).name;
diff --git a/app/portainer/react/components/settings.ts b/app/portainer/react/components/settings.ts
new file mode 100644
index 0000000..1745592
--- /dev/null
+++ b/app/portainer/react/components/settings.ts
@@ -0,0 +1,134 @@
+import angular from 'angular';
+
+import { InternalAuth } from '@/react/portainer/settings/AuthenticationView/InternalAuth';
+import { AuthenticationMethodSelector } from '@/react/portainer/settings/AuthenticationView/AuthenticationMethodSelector';
+import { r2a } from '@/react-tools/react2angular';
+import { withReactQuery } from '@/react-tools/withReactQuery';
+import { withUIRouter } from '@/react-tools/withUIRouter';
+import { LDAPUsersTable } from '@/react/portainer/settings/AuthenticationView/LDAPAuth/LDAPUsersTable';
+import { LDAPGroupsTable } from '@/react/portainer/settings/AuthenticationView/LDAPAuth/LDAPGroupsTable';
+import { ApplicationSettingsPanel } from '@/react/portainer/settings/SettingsView/ApplicationSettingsPanel';
+import { KubeSettingsPanel } from '@/react/portainer/settings/SettingsView/KubeSettingsPanel';
+import { HelmCertPanel } from '@/react/portainer/settings/SettingsView/HelmCertPanel';
+import { HiddenContainersPanel } from '@/react/portainer/settings/SettingsView/HiddenContainersPanel/HiddenContainersPanel';
+import { SSLSettingsPanelWrapper } from '@/react/portainer/settings/SettingsView/SSLSettingsPanel/SSLSettingsPanel';
+import { AuthStyleField } from '@/react/portainer/settings/AuthenticationView/OAuth';
+import { AutoUserProvisionToggle } from '@/react/portainer/settings/AuthenticationView/AutoUserProvisionToggle/AutoUserProvisionToggle';
+import { LdapSettingsTestLogin } from '@/react/portainer/settings/AuthenticationView/LDAPAuth/LdapSettingsTestLogin/LdapSettingsTestLogin';
+import { SessionLifetimeSelect } from '@/react/portainer/settings/AuthenticationView/SessionLifetimeSelect';
+import { LdapSecurityFieldset } from '@/react/portainer/settings/AuthenticationView/LDAPAuth/LdapSecurityFieldset/LdapSecurityFieldset';
+import { DnBuilder } from '@/react/portainer/settings/AuthenticationView/LDAPAuth/DnEntriesField/DnBuilder';
+import { GroupDnBuilder } from '@/react/portainer/settings/AuthenticationView/LDAPAuth/DnEntriesField/GroupDnBuilder';
+import { withControlledInput } from '@/react-tools/withControlledInput';
+import { AdminGroupsSectionCE } from '@/react/portainer/settings/AuthenticationView/LDAPAuth/AdminGroupsSection';
+
+export const settingsModule = angular
+  .module('portainer.app.react.components.settings', [])
+  .component(
+    'sessionLifetimeSelect',
+    r2a(SessionLifetimeSelect, ['value', 'onChange'])
+  )
+  .component(
+    'internalAuth',
+    r2a(InternalAuth, ['onSaveSettings', 'isLoading', 'value', 'onChange'])
+  )
+  .component(
+    'authenticationMethodSelector',
+    r2a(AuthenticationMethodSelector, ['value', 'onChange'])
+  )
+  .component('ldapUsersDatatable', r2a(LDAPUsersTable, ['dataset']))
+  .component('ldapGroupsDatatable', r2a(LDAPGroupsTable, ['dataset']))
+  .component(
+    'ldapSettingsDnBuilder',
+    r2a(DnBuilder, ['value', 'onChange', 'suffix', 'label', 'limitedFeatureId'])
+  )
+  .component(
+    'ldapSettingsGroupDnBuilder',
+    r2a(GroupDnBuilder, [
+      'value',
+      'onChange',
+      'suffix',
+      'index',
+      'onRemoveClick',
+      'limitedFeatureId',
+    ])
+  )
+  .component(
+    'applicationSettingsPanel',
+    r2a(withReactQuery(ApplicationSettingsPanel), ['onSuccess', 'settings'])
+  )
+  .component(
+    'sslSettingsPanel',
+    r2a(withReactQuery(SSLSettingsPanelWrapper), [])
+  )
+  .component('helmCertPanel', r2a(withReactQuery(HelmCertPanel), []))
+  .component(
+    'hiddenContainersPanel',
+    r2a(withUIRouter(withReactQuery(HiddenContainersPanel)), [])
+  )
+  .component(
+    'kubeSettingsPanel',
+    r2a(withUIRouter(withReactQuery(KubeSettingsPanel)), ['settings'])
+  )
+  .component(
+    'oauthAuthStyle',
+    r2a(AuthStyleField, [
+      'value',
+      'onChange',
+      'label',
+      'tooltip',
+      'readonly',
+      'size',
+    ])
+  )
+  .component(
+    'autoUserProvisionToggle',
+    r2a(AutoUserProvisionToggle, [
+      'value',
+      'onChange',
+      'description',
+      'data-cy',
+    ])
+  )
+  .component(
+    'ldapSettingsTestLogin',
+    r2a(withReactQuery(LdapSettingsTestLogin), [
+      'settings',
+      'limitedFeatureId',
+      'showBeIndicatorIfNeeded',
+      'isLimitedFeatureSelfContained',
+    ])
+  )
+  .component(
+    'ldapSecurityFieldset',
+    r2a(LdapSecurityFieldset, [
+      'values',
+      'onChange',
+      'errors',
+      'uploadState',
+      'limitedFeatureId',
+      'title',
+    ])
+  )
+  .component(
+    'ldapCustomAdminGroup',
+    r2a(
+      withReactQuery(
+        withControlledInput(AdminGroupsSectionCE, {
+          searchSettings: 'onSearchSettingsChange',
+          autoPopulate: 'onAutoPopulateChange',
+          selectedAdminGroups: 'onSelectedAdminGroupsChange',
+        })
+      ),
+      [
+        'searchSettings',
+        'onSearchSettingsChange',
+        'autoPopulate',
+        'onAutoPopulateChange',
+        'selectedAdminGroups',
+        'onSelectedAdminGroupsChange',
+        'limitedFeatureId',
+        'isLimitedFeatureSelfContained',
+      ]
+    )
+  ).name;
diff --git a/app/portainer/react/components/stacks.ts b/app/portainer/react/components/stacks.ts
new file mode 100644
index 0000000..9b1099f
--- /dev/null
+++ b/app/portainer/react/components/stacks.ts
@@ -0,0 +1,6 @@
+import angular from 'angular';
+
+export const stacksModule = angular.module(
+  'portainer.app.react.components.stacks',
+  []
+).name;
diff --git a/app/portainer/react/components/switch-field.ts b/app/portainer/react/components/switch-field.ts
new file mode 100644
index 0000000..4f8b721
--- /dev/null
+++ b/app/portainer/react/components/switch-field.ts
@@ -0,0 +1,20 @@
+import { r2a } from '@/react-tools/react2angular';
+
+import { SwitchField } from '@@/form-components/SwitchField';
+
+export const switchField = r2a(SwitchField, [
+  'tooltip',
+  'checked',
+  'index',
+  'label',
+  'name',
+  'labelClass',
+  'fieldClass',
+  'data-cy',
+  'disabled',
+  'onChange',
+  'featureId',
+  'switchClass',
+  'setTooltipHtmlMessage',
+  'valueExplanation',
+]);
diff --git a/app/portainer/react/components/users.ts b/app/portainer/react/components/users.ts
new file mode 100644
index 0000000..018ed8e
--- /dev/null
+++ b/app/portainer/react/components/users.ts
@@ -0,0 +1,25 @@
+import angular from 'angular';
+
+import { r2a } from '@/react-tools/react2angular';
+import { withUIRouter } from '@/react-tools/withUIRouter';
+import { withReactQuery } from '@/react-tools/withReactQuery';
+import { withCurrentUser } from '@/react-tools/withCurrentUser';
+import { EffectiveAccessViewerDatatable } from '@/react/portainer/users/RolesView/AccessViewer/EffectiveAccessViewerDatatable';
+import { EffectiveAccessViewer } from '@/react/portainer/users/RolesView/AccessViewer/EffectiveAccessViewer';
+import { RbacRolesDatatable } from '@/react/portainer/users/RolesView/RbacRolesDatatable';
+
+export const usersModule = angular
+  .module('portainer.app.react.components.users', [])
+  .component(
+    'effectiveAccessViewerDatatable',
+    r2a(withUIRouter(withCurrentUser(EffectiveAccessViewerDatatable)), [
+      'dataset',
+    ])
+  )
+  .component(
+    'effectiveAccessViewer',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(EffectiveAccessViewer))), [
+      'userId',
+    ])
+  )
+  .component('rbacRolesDatatable', r2a(RbacRolesDatatable, ['dataset'])).name;
diff --git a/app/portainer/react/index.ts b/app/portainer/react/index.ts
new file mode 100644
index 0000000..ddbcc47
--- /dev/null
+++ b/app/portainer/react/index.ts
@@ -0,0 +1,9 @@
+import angular from 'angular';
+
+import { componentsModule } from './components';
+import { viewsModule } from './views';
+
+export const reactModule = angular.module('portainer.app.react', [
+  viewsModule,
+  componentsModule,
+]).name;
diff --git a/app/portainer/react/views/activity-logs.ts b/app/portainer/react/views/activity-logs.ts
new file mode 100644
index 0000000..e742767
--- /dev/null
+++ b/app/portainer/react/views/activity-logs.ts
@@ -0,0 +1,13 @@
+import angular from 'angular';
+
+import { r2a } from '@/react-tools/react2angular';
+import { withUIRouter } from '@/react-tools/withUIRouter';
+import { ActivityLogsView } from '@/react/portainer/logs/ActivityLogsView/ActivityLogsView';
+import { withCurrentUser } from '@/react-tools/withCurrentUser';
+
+export const activityLogsModule = angular
+  .module('portainer.app.react.views.activity-logs', [])
+  .component(
+    'activityLogsView',
+    r2a(withUIRouter(withCurrentUser(ActivityLogsView)), [])
+  ).name;
diff --git a/app/portainer/react/views/env-groups.ts b/app/portainer/react/views/env-groups.ts
new file mode 100644
index 0000000..7237789
--- /dev/null
+++ b/app/portainer/react/views/env-groups.ts
@@ -0,0 +1,24 @@
+import angular from 'angular';
+
+import { r2a } from '@/react-tools/react2angular';
+import { withCurrentUser } from '@/react-tools/withCurrentUser';
+import { withReactQuery } from '@/react-tools/withReactQuery';
+import { withUIRouter } from '@/react-tools/withUIRouter';
+import { ListView } from '@/react/portainer/environments/environment-groups/ListView';
+import { EditGroupView } from '@/react/portainer/environments/environment-groups/ItemView/EditGroupView';
+import { CreateGroupView } from '@/react/portainer/environments/environment-groups/CreateView/CreateGroupView';
+
+export const environmentGroupModule = angular
+  .module('portainer.app.react.views.environment-groups', [])
+  .component(
+    'environmentGroupsListView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(ListView))), [])
+  )
+  .component(
+    'environmentGroupEditView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(EditGroupView))), [])
+  )
+  .component(
+    'environmentGroupCreateView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(CreateGroupView))), [])
+  ).name;
diff --git a/app/portainer/react/views/environments.ts b/app/portainer/react/views/environments.ts
new file mode 100644
index 0000000..d06b242
--- /dev/null
+++ b/app/portainer/react/views/environments.ts
@@ -0,0 +1,23 @@
+import angular from 'angular';
+
+import { r2a } from '@/react-tools/react2angular';
+import { withCurrentUser } from '@/react-tools/withCurrentUser';
+import { withUIRouter } from '@/react-tools/withUIRouter';
+import { ListView } from '@/react/portainer/environments/ListView';
+import { EdgeAutoCreateScriptViewWrapper } from '@/react/portainer/environments/EdgeAutoCreateScriptView/EdgeAutoCreateScriptView';
+import { ItemView } from '@/react/portainer/environments/ItemView/ItemView';
+
+export const environmentsModule = angular
+  .module('portainer.app.react.views.environments', [])
+  .component(
+    'environmentsListView',
+    r2a(withUIRouter(withCurrentUser(ListView)), [])
+  )
+  .component(
+    'environmentsItemView',
+    r2a(withUIRouter(withCurrentUser(ItemView)), [])
+  )
+  .component(
+    'edgeAutoCreateScriptView',
+    r2a(withUIRouter(withCurrentUser(EdgeAutoCreateScriptViewWrapper)), [])
+  ).name;
diff --git a/app/portainer/react/views/gitops.ts b/app/portainer/react/views/gitops.ts
new file mode 100644
index 0000000..f95194f
--- /dev/null
+++ b/app/portainer/react/views/gitops.ts
@@ -0,0 +1,33 @@
+import angular from 'angular';
+
+import { ListView as WorkflowsListView } from '@/react/portainer/gitops/workflows/ListView/ListView';
+import { ItemView as WorkflowItemView } from '@/react/portainer/gitops/workflows/ItemView/ItemView';
+import { ListView as SourcesListView } from '@/react/portainer/gitops/sources/ListView/ListView';
+import { ItemView as SourceItemView } from '@/react/portainer/gitops/sources/ItemView/ItemView';
+import { CreateView as SourceCreateView } from '@/react/portainer/gitops/sources/CreateView/CreateView';
+import { r2a } from '@/react-tools/react2angular';
+import { withCurrentUser } from '@/react-tools/withCurrentUser';
+import { withUIRouter } from '@/react-tools/withUIRouter';
+
+export const gitopsViewsModule = angular
+  .module('portainer.app.react.views.gitops', [])
+  .component(
+    'workflowsView',
+    r2a(withUIRouter(withCurrentUser(WorkflowsListView)), [])
+  )
+  .component(
+    'workflowItemView',
+    r2a(withUIRouter(withCurrentUser(WorkflowItemView)), [])
+  )
+  .component(
+    'sourcesListView',
+    r2a(withUIRouter(withCurrentUser(SourcesListView)), [])
+  )
+  .component(
+    'sourceItemView',
+    r2a(withUIRouter(withCurrentUser(SourceItemView)), [])
+  )
+  .component(
+    'sourceCreateView',
+    r2a(withUIRouter(withCurrentUser(SourceCreateView)), [])
+  ).name;
diff --git a/app/portainer/react/views/index.ts b/app/portainer/react/views/index.ts
new file mode 100644
index 0000000..566e510
--- /dev/null
+++ b/app/portainer/react/views/index.ts
@@ -0,0 +1,71 @@
+import angular from 'angular';
+
+import { HomeView } from '@/react/portainer/HomeView';
+import { withCurrentUser } from '@/react-tools/withCurrentUser';
+import { r2a } from '@/react-tools/react2angular';
+import { withReactQuery } from '@/react-tools/withReactQuery';
+import { withUIRouter } from '@/react-tools/withUIRouter';
+import { CreateUserAccessToken } from '@/react/portainer/account/CreateAccessTokenView';
+import { EdgeComputeSettingsView } from '@/react/portainer/settings/EdgeComputeView/EdgeComputeSettingsView';
+import { BackupSettingsPanel } from '@/react/portainer/settings/SettingsView/BackupSettingsView/BackupSettingsPanel';
+import { SettingsView } from '@/react/portainer/settings/SettingsView/SettingsView';
+import { CreateHelmRepositoriesView } from '@/react/portainer/account/helm-repositories/CreateHelmRepositoryView';
+
+import { wizardModule } from './wizard';
+import { teamsModule } from './teams';
+import { updateSchedulesModule } from './update-schedules';
+import { environmentGroupModule } from './env-groups';
+import { registriesModule } from './registries';
+import { activityLogsModule } from './activity-logs';
+import { templatesModule } from './templates';
+import { usersModule } from './users';
+import { environmentsModule } from './environments';
+import { gitopsViewsModule } from './gitops';
+
+export const viewsModule = angular
+  .module('portainer.app.react.views', [
+    wizardModule,
+    teamsModule,
+    updateSchedulesModule,
+    environmentGroupModule,
+    registriesModule,
+    activityLogsModule,
+    templatesModule,
+    usersModule,
+    environmentsModule,
+    gitopsViewsModule,
+  ])
+  .component(
+    'homeView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(HomeView))), [])
+  )
+  .component(
+    'createUserAccessToken',
+    r2a(
+      withReactQuery(withCurrentUser(withUIRouter(CreateUserAccessToken))),
+      []
+    )
+  )
+  .component(
+    'settingsEdgeCompute',
+    r2a(
+      withUIRouter(withReactQuery(withCurrentUser(EdgeComputeSettingsView))),
+      ['onSubmit', 'settings']
+    )
+  )
+
+  .component(
+    'backupSettingsPanel',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(BackupSettingsPanel))), [])
+  )
+  .component(
+    'settingsView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(SettingsView))), [])
+  )
+  .component(
+    'createHelmRepositoryView',
+    r2a(
+      withUIRouter(withReactQuery(withCurrentUser(CreateHelmRepositoriesView))),
+      []
+    )
+  ).name;
diff --git a/app/portainer/react/views/registries.ts b/app/portainer/react/views/registries.ts
new file mode 100644
index 0000000..7b4cfdd
--- /dev/null
+++ b/app/portainer/react/views/registries.ts
@@ -0,0 +1,19 @@
+import angular from 'angular';
+
+import { r2a } from '@/react-tools/react2angular';
+import { withCurrentUser } from '@/react-tools/withCurrentUser';
+import { withReactQuery } from '@/react-tools/withReactQuery';
+import { withUIRouter } from '@/react-tools/withUIRouter';
+import { ListView } from '@/react/portainer/registries/ListView';
+import { ListView as EnvironmentListView } from '@/react/portainer/registries/environments/ListView';
+
+export const registriesModule = angular
+  .module('portainer.app.react.views.registries', [])
+  .component(
+    'registriesView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(ListView))), [])
+  )
+  .component(
+    'environmentRegistriesView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(EnvironmentListView))), [])
+  ).name;
diff --git a/app/portainer/react/views/sidebar.ts b/app/portainer/react/views/sidebar.ts
new file mode 100644
index 0000000..623e244
--- /dev/null
+++ b/app/portainer/react/views/sidebar.ts
@@ -0,0 +1,16 @@
+import angular from 'angular';
+
+import { AngularSidebarService } from '@/react/sidebar/useSidebarState';
+import { Sidebar } from '@/react/sidebar/Sidebar';
+import { r2a } from '@/react-tools/react2angular';
+import { withCurrentUser } from '@/react-tools/withCurrentUser';
+import { withReactQuery } from '@/react-tools/withReactQuery';
+import { withUIRouter } from '@/react-tools/withUIRouter';
+
+export const sidebarModule = angular
+  .module('portainer.app.sidebar', [])
+  .component(
+    'sidebar',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(Sidebar))), [])
+  )
+  .factory('SidebarService', AngularSidebarService).name;
diff --git a/app/portainer/react/views/teams.ts b/app/portainer/react/views/teams.ts
new file mode 100644
index 0000000..9d8c34c
--- /dev/null
+++ b/app/portainer/react/views/teams.ts
@@ -0,0 +1,48 @@
+import angular from 'angular';
+import { StateRegistry } from '@uirouter/angularjs';
+
+import { ItemView, ListView } from '@/react/portainer/users/teams';
+import { r2a } from '@/react-tools/react2angular';
+import { withCurrentUser } from '@/react-tools/withCurrentUser';
+import { withReactQuery } from '@/react-tools/withReactQuery';
+import { withUIRouter } from '@/react-tools/withUIRouter';
+import { AccessHeaders } from '@/portainer/authorization-guard';
+
+export const teamsModule = angular
+  .module('portainer.app.teams', [])
+  .config(config)
+  .component(
+    'teamView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(ItemView))), [])
+  )
+  .component(
+    'teamsView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(ListView))), [])
+  ).name;
+
+/* @ngInject */
+function config($stateRegistryProvider: StateRegistry) {
+  $stateRegistryProvider.register({
+    name: 'portainer.teams',
+    url: '/teams',
+    views: {
+      'content@': {
+        component: 'teamsView',
+      },
+    },
+    data: {
+      docs: '/admin/user/teams',
+      access: AccessHeaders.Restricted, // allow for team leaders
+    },
+  });
+
+  $stateRegistryProvider.register({
+    name: 'portainer.teams.team',
+    url: '/:id',
+    views: {
+      'content@': {
+        component: 'teamView',
+      },
+    },
+  });
+}
diff --git a/app/portainer/react/views/templates.ts b/app/portainer/react/views/templates.ts
new file mode 100644
index 0000000..5b79de9
--- /dev/null
+++ b/app/portainer/react/views/templates.ts
@@ -0,0 +1,28 @@
+import angular from 'angular';
+
+import { r2a } from '@/react-tools/react2angular';
+import { withCurrentUser } from '@/react-tools/withCurrentUser';
+import { withUIRouter } from '@/react-tools/withUIRouter';
+import { CreateView } from '@/react/portainer/templates/custom-templates/CreateView';
+import { EditView } from '@/react/portainer/templates/custom-templates/EditView';
+import { AppTemplatesView } from '@/react/portainer/templates/app-templates/AppTemplatesView';
+import { ListView } from '@/react/portainer/templates/custom-templates/ListView/ListView';
+
+export const templatesModule = angular
+  .module('portainer.app.react.views.templates', [])
+  .component(
+    'appTemplatesView',
+    r2a(withCurrentUser(withUIRouter(AppTemplatesView)), [])
+  )
+  .component(
+    'customTemplatesView',
+    r2a(withCurrentUser(withUIRouter(ListView)), [])
+  )
+  .component(
+    'createCustomTemplatesView',
+    r2a(withCurrentUser(withUIRouter(CreateView)), [])
+  )
+  .component(
+    'editCustomTemplatesView',
+    r2a(withCurrentUser(withUIRouter(EditView)), [])
+  ).name;
diff --git a/app/portainer/react/views/update-schedules.ts b/app/portainer/react/views/update-schedules.ts
new file mode 100644
index 0000000..73c684d
--- /dev/null
+++ b/app/portainer/react/views/update-schedules.ts
@@ -0,0 +1,63 @@
+import angular from 'angular';
+import { StateRegistry } from '@uirouter/angularjs';
+
+import { r2a } from '@/react-tools/react2angular';
+import {
+  ListView,
+  CreateView,
+  ItemView,
+} from '@/react/portainer/environments/update-schedules';
+import { withUIRouter } from '@/react-tools/withUIRouter';
+import { withReactQuery } from '@/react-tools/withReactQuery';
+import { withCurrentUser } from '@/react-tools/withCurrentUser';
+
+export const updateSchedulesModule = angular
+  .module('portainer.edge.updateSchedules', [])
+  .component(
+    'updateSchedulesListView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(ListView))), [])
+  )
+  .component(
+    'updateSchedulesCreateView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(CreateView))), [])
+  )
+  .component(
+    'updateSchedulesItemView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(ItemView))), [])
+  )
+  .config(config).name;
+
+function config($stateRegistryProvider: StateRegistry) {
+  $stateRegistryProvider.register({
+    name: 'portainer.endpoints.updateSchedules',
+    url: '/update-schedules',
+    views: {
+      'content@': {
+        component: 'updateSchedulesListView',
+      },
+    },
+    data: {
+      docs: '/admin/environments/update',
+    },
+  });
+
+  $stateRegistryProvider.register({
+    name: 'portainer.endpoints.updateSchedules.create',
+    url: '/update-schedules/new',
+    views: {
+      'content@': {
+        component: 'updateSchedulesCreateView',
+      },
+    },
+  });
+
+  $stateRegistryProvider.register({
+    name: 'portainer.endpoints.updateSchedules.item',
+    url: '/update-schedules/:id',
+    views: {
+      'content@': {
+        component: 'updateSchedulesItemView',
+      },
+    },
+  });
+}
diff --git a/app/portainer/react/views/users.ts b/app/portainer/react/views/users.ts
new file mode 100644
index 0000000..22991e9
--- /dev/null
+++ b/app/portainer/react/views/users.ts
@@ -0,0 +1,15 @@
+import angular from 'angular';
+
+import { ListView } from '@/react/portainer/users/ListView/ListView';
+import { r2a } from '@/react-tools/react2angular';
+import { withCurrentUser } from '@/react-tools/withCurrentUser';
+import { withReactQuery } from '@/react-tools/withReactQuery';
+import { withUIRouter } from '@/react-tools/withUIRouter';
+
+export const usersModule = angular
+  .module('portainer.app.react.views.users', [])
+
+  .component(
+    'usersListView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(ListView))), [])
+  ).name;
diff --git a/app/portainer/react/views/wizard.ts b/app/portainer/react/views/wizard.ts
new file mode 100644
index 0000000..6387583
--- /dev/null
+++ b/app/portainer/react/views/wizard.ts
@@ -0,0 +1,80 @@
+import angular from 'angular';
+import { StateRegistry } from '@uirouter/angularjs';
+
+import { r2a } from '@/react-tools/react2angular';
+import {
+  EnvironmentCreationView,
+  EnvironmentTypeSelectView,
+  HomeView,
+} from '@/react/portainer/environments/wizard';
+import { withCurrentUser } from '@/react-tools/withCurrentUser';
+import { withReactQuery } from '@/react-tools/withReactQuery';
+import { withUIRouter } from '@/react-tools/withUIRouter';
+import { AccessHeaders } from '@/portainer/authorization-guard';
+
+export const wizardModule = angular
+  .module('portainer.app.react.views.wizard', [])
+  .component(
+    'wizardEnvironmentCreationView',
+    r2a(
+      withUIRouter(withReactQuery(withCurrentUser(EnvironmentCreationView))),
+      []
+    )
+  )
+  .component(
+    'wizardEnvironmentTypeSelectView',
+    r2a(
+      withUIRouter(withReactQuery(withCurrentUser(EnvironmentTypeSelectView))),
+      []
+    )
+  )
+  .component(
+    'wizardMainView',
+    r2a(withUIRouter(withReactQuery(withCurrentUser(HomeView))), [])
+  )
+  .config(config).name;
+
+function config($stateRegistryProvider: StateRegistry) {
+  $stateRegistryProvider.register({
+    name: 'portainer.wizard',
+    url: '/wizard',
+    views: {
+      'content@': {
+        component: 'wizardMainView',
+      },
+    },
+    data: {
+      access: AccessHeaders.Admin,
+    },
+  });
+
+  $stateRegistryProvider.register({
+    name: 'portainer.wizard.endpoints',
+    url: '/endpoints?referrer',
+    views: {
+      'content@': {
+        component: 'wizardEnvironmentTypeSelectView',
+      },
+    },
+    params: {
+      localEndpointId: 0,
+    },
+    data: {
+      docs: '/admin/environments/add',
+    },
+  });
+
+  $stateRegistryProvider.register({
+    name: 'portainer.wizard.endpoints.create',
+    url: '/create?envType&step',
+    views: {
+      'content@': {
+        component: 'wizardEnvironmentCreationView',
+      },
+    },
+    params: {
+      envType: '',
+      step: { value: null, squash: true },
+    },
+  });
+}
diff --git a/app/portainer/registry-management/index.js b/app/portainer/registry-management/index.js
new file mode 100644
index 0000000..9afb351
--- /dev/null
+++ b/app/portainer/registry-management/index.js
@@ -0,0 +1,50 @@
+import { AccessHeaders } from '../authorization-guard';
+
+angular.module('portainer.registrymanagement', []).config(config);
+
+/* @ngInject */
+function config($stateRegistryProvider) {
+  const registries = {
+    name: 'portainer.registries',
+    url: '/registries',
+    views: {
+      'content@': {
+        component: 'registriesView',
+      },
+    },
+    data: {
+      docs: '/admin/registries',
+      access: AccessHeaders.Admin,
+    },
+  };
+
+  const registryCreation = {
+    name: 'portainer.registries.new',
+    url: '/new',
+    views: {
+      'content@': {
+        component: 'createRegistry',
+      },
+    },
+    data: {
+      docs: '/admin/registries/add',
+    },
+  };
+
+  const registry = {
+    name: 'portainer.registries.registry',
+    url: '/:id',
+    views: {
+      'content@': {
+        component: 'editRegistry',
+      },
+    },
+    data: {
+      docs: '/admin/registries/edit',
+    },
+  };
+
+  $stateRegistryProvider.register(registries);
+  $stateRegistryProvider.register(registry);
+  $stateRegistryProvider.register(registryCreation);
+}
diff --git a/app/portainer/registry-management/views/create/createRegistry.html b/app/portainer/registry-management/views/create/createRegistry.html
new file mode 100644
index 0000000..7d24562
--- /dev/null
+++ b/app/portainer/registry-management/views/create/createRegistry.html
@@ -0,0 +1,80 @@
+<page-header title="'Create registry'" breadcrumbs="[{label:'Registries', link:'portainer.registries'}, 'Add registry']" reload="true"> </page-header>
+
+<div class="row">
+  <div class="col-sm-12">
+    <rd-widget>
+      <rd-widget-body>
+        <form class="form-horizontal">
+          <div class="col-sm-12 form-section-title"> Registry provider </div>
+
+          <box-selector radio-name="'availableRegistry'" value="$ctrl.state.registryValue" options="$ctrl.state.availableRegistry" on-change="($ctrl.setRegistry)"></box-selector>
+
+          <registry-form-quay
+            ng-if="$ctrl.model.Type === $ctrl.RegistryTypes.QUAY"
+            model="$ctrl.model"
+            form-action="$ctrl.createRegistry"
+            form-action-label="Add registry"
+            action-in-progress="$ctrl.state.actionInProgress"
+            name-is-used="($ctrl.nameIsUsed)"
+          ></registry-form-quay>
+
+          <registry-form-azure
+            ng-if="$ctrl.model.Type === $ctrl.RegistryTypes.AZURE"
+            model="$ctrl.model"
+            form-action="$ctrl.createRegistry"
+            form-action-label="Add registry"
+            action-in-progress="$ctrl.state.actionInProgress"
+            name-is-used="($ctrl.nameIsUsed)"
+          ></registry-form-azure>
+
+          <registry-form-custom
+            ng-if="$ctrl.model.Type === $ctrl.RegistryTypes.CUSTOM"
+            model="$ctrl.model"
+            form-action="$ctrl.createRegistry"
+            form-action-label="Add registry"
+            action-in-progress="$ctrl.state.actionInProgress"
+            name-is-used="($ctrl.nameIsUsed)"
+          ></registry-form-custom>
+
+          <registry-form-ecr
+            ng-if="$ctrl.model.Type === $ctrl.RegistryTypes.ECR"
+            model="$ctrl.model"
+            form-action="$ctrl.createRegistry"
+            form-action-label="Add registry"
+            action-in-progress="$ctrl.state.actionInProgress"
+            name-is-used="($ctrl.nameIsUsed)"
+          ></registry-form-ecr>
+
+          <registry-form-proget
+            ng-if="$ctrl.model.Type === $ctrl.RegistryTypes.PROGET"
+            model="$ctrl.model"
+            form-action="$ctrl.createRegistry"
+            form-action-label="Add registry"
+            action-in-progress="$ctrl.state.actionInProgress"
+            name-is-used="($ctrl.nameIsUsed)"
+          ></registry-form-proget>
+
+          <registry-form-gitlab
+            ng-if="$ctrl.model.Type === $ctrl.RegistryTypes.GITLAB"
+            model="$ctrl.model"
+            retrieve-registries="$ctrl.retrieveGitlabRegistries"
+            create-registries="$ctrl.createGitlabRegistries"
+            projects="$ctrl.gitlabProjects"
+            state="$ctrl.state"
+            action-in-progress="$ctrl.state.actionInProgress"
+            reset-defaults="$ctrl.useDefaultGitlabConfiguration"
+          ></registry-form-gitlab>
+
+          <registry-form-dockerhub
+            ng-if="$ctrl.model.Type === $ctrl.RegistryTypes.DOCKERHUB"
+            initial-values="$ctrl.model"
+            on-submit="($ctrl.onSubmitDocker)"
+            submit-label="'Add registry'"
+            is-loading="$ctrl.state.actionInProgress"
+            name-is-used="($ctrl.nameIsUsed)"
+          ></registry-form-dockerhub>
+        </form>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
diff --git a/app/portainer/registry-management/views/create/createRegistry.js b/app/portainer/registry-management/views/create/createRegistry.js
new file mode 100644
index 0000000..e935fee
--- /dev/null
+++ b/app/portainer/registry-management/views/create/createRegistry.js
@@ -0,0 +1,10 @@
+import angular from 'angular';
+import CreateRegistryController from './createRegistryController';
+
+angular.module('portainer.app').component('createRegistry', {
+  templateUrl: './createRegistry.html',
+  controller: CreateRegistryController,
+  bindings: {
+    $transition$: '<',
+  },
+});
diff --git a/app/portainer/registry-management/views/create/createRegistryController.js b/app/portainer/registry-management/views/create/createRegistryController.js
new file mode 100644
index 0000000..3f26221
--- /dev/null
+++ b/app/portainer/registry-management/views/create/createRegistryController.js
@@ -0,0 +1,220 @@
+import _ from 'lodash';
+import { RegistryTypes } from '@/portainer/models/registryTypes';
+import { RegistryCreateFormValues } from '@/portainer/models/registry';
+import { options } from '@/react/portainer/registries/CreateView/options';
+
+class CreateRegistryController {
+  /* @ngInject */
+  constructor($async, $state, Notifications, RegistryService, RegistryGitlabService) {
+    Object.assign(this, { $async, $state, Notifications, RegistryService, RegistryGitlabService });
+
+    this.RegistryTypes = RegistryTypes;
+    this.state = {
+      actionInProgress: false,
+      overrideConfiguration: false,
+      originViewReference: 'portainer.registries',
+      originalEndpointId: null,
+    };
+
+    this.createRegistry = this.createRegistry.bind(this);
+    this.onSubmitDocker = this.onSubmitDocker.bind(this);
+    this.getRegistries = this.getRegistries.bind(this);
+    this.nameIsUsed = this.nameIsUsed.bind(this);
+    this.retrieveGitlabRegistries = this.retrieveGitlabRegistries.bind(this);
+    this.createGitlabRegistries = this.createGitlabRegistries.bind(this);
+
+    this.selectDockerHub = this.selectDockerHub.bind(this);
+    this.selectEcr = this.selectEcr.bind(this);
+    this.selectQuayRegistry = this.selectQuayRegistry.bind(this);
+    this.selectProGetRegistry = this.selectProGetRegistry.bind(this);
+    this.selectAzureRegistry = this.selectAzureRegistry.bind(this);
+    this.selectGitlabRegistry = this.selectGitlabRegistry.bind(this);
+    this.selectCustomRegistry = this.selectCustomRegistry.bind(this);
+
+    this.setRegistry = this.setRegistry.bind(this);
+  }
+
+  useDefaultQuayConfiguration() {
+    this.model.Quay.useOrganisation = false;
+    this.model.Quay.organisationName = '';
+  }
+
+  selectQuayRegistry() {
+    this.model.Name = 'Quay';
+    this.model.URL = 'quay.io';
+    this.model.Authentication = true;
+    this.model.Quay = {};
+    this.useDefaultQuayConfiguration();
+    this.model.Type = RegistryTypes.QUAY;
+  }
+
+  useDefaultGitlabConfiguration() {
+    this.model.URL = 'https://registry.gitlab.com';
+    this.model.Gitlab.InstanceURL = 'https://gitlab.com';
+  }
+
+  selectGitlabRegistry() {
+    this.model.Name = '';
+    this.model.Authentication = true;
+    this.model.Gitlab = {};
+    this.useDefaultGitlabConfiguration();
+    this.model.Type = RegistryTypes.GITLAB;
+  }
+
+  selectAzureRegistry() {
+    this.model.Name = '';
+    this.model.URL = '';
+    this.model.Authentication = true;
+    this.model.Type = RegistryTypes.AZURE;
+  }
+
+  selectProGetRegistry() {
+    this.model.Name = '';
+    this.model.URL = '';
+    this.model.BaseURL = '';
+    this.model.Authentication = true;
+    this.model.Type = RegistryTypes.PROGET;
+  }
+
+  selectCustomRegistry() {
+    this.model.Name = '';
+    this.model.URL = '';
+    this.model.Authentication = false;
+    this.model.Type = RegistryTypes.CUSTOM;
+  }
+
+  selectDockerHub() {
+    this.model.Name = '';
+    this.model.URL = 'docker.io';
+    this.model.Authentication = true;
+    this.model.Type = RegistryTypes.DOCKERHUB;
+  }
+
+  useDefaultEcrConfiguration() {
+    this.model.Ecr.Region = '';
+  }
+
+  selectEcr() {
+    this.model.Name = '';
+    this.model.URL = '';
+    this.model.Authentication = false;
+    this.model.Ecr = {};
+    this.useDefaultEcrConfiguration();
+    this.model.Type = RegistryTypes.ECR;
+  }
+
+  retrieveGitlabRegistries() {
+    return this.$async(async () => {
+      this.state.actionInProgress = true;
+      try {
+        this.gitlabProjects = await this.RegistryGitlabService.projects(this.model.Gitlab.InstanceURL, this.model.Token);
+      } catch (err) {
+        this.Notifications.error('Failure', err, 'Unable to retrieve projects');
+      } finally {
+        this.state.actionInProgress = false;
+      }
+    });
+  }
+
+  createGitlabRegistries(registries) {
+    return this.$async(async () => {
+      try {
+        this.state.actionInProgress = true;
+        await this.RegistryService.createGitlabRegistries(this.model, registries);
+        this.Notifications.success('Success', 'Registries successfully created');
+        this.$state.go(this.state.originViewReference, { endpointId: this.state.originalEndpointId });
+      } catch (err) {
+        this.Notifications.error('Failure', err, 'Unable to create registries');
+        this.state.actionInProgress = false;
+      }
+    });
+  }
+
+  createRegistry() {
+    return this.$async(async () => {
+      try {
+        this.state.actionInProgress = true;
+        await this.RegistryService.createRegistry(this.model);
+        this.Notifications.success('Success', 'Registry successfully created');
+        this.$state.go(this.state.originViewReference, { endpointId: this.state.originalEndpointId });
+      } catch (err) {
+        this.Notifications.error('Failure', err, 'Unable to create registry');
+        this.state.actionInProgress = false;
+      }
+    });
+  }
+
+  /**
+   *
+   * @param {import('@/react/portainer/registries/CreateView/RegistryFormDockerhub/RegistryFormDockerhub').RegistryFormDockerhubValues} model
+   */
+  onSubmitDocker(model) {
+    this.model = model;
+    this.createRegistry();
+  }
+
+  nameIsUsed(name) {
+    return _.includes(this.registriesNames, name);
+  }
+
+  getRegistries() {
+    return this.$async(async () => {
+      try {
+        const registries = await this.RegistryService.registries();
+        this.registriesNames = _.map(registries, 'Name');
+      } catch (err) {
+        this.Notifications.error('Failure', err, 'Unable to fetch existing registries');
+      }
+    });
+  }
+
+  setRegistry(registry) {
+    this.state.registryValue = registry;
+
+    switch (registry) {
+      case '6':
+        this.selectDockerHub();
+        break;
+      case '7':
+        this.selectEcr();
+        break;
+      case '1':
+        this.selectQuayRegistry();
+        break;
+      case '5':
+        this.selectProGetRegistry();
+        break;
+      case '2':
+        this.selectAzureRegistry();
+        break;
+      case '4':
+        this.selectGitlabRegistry();
+        break;
+      case '3':
+        this.selectCustomRegistry();
+        break;
+    }
+  }
+
+  $onInit() {
+    return this.$async(async () => {
+      this.model = new RegistryCreateFormValues();
+      this.model.Type = RegistryTypes.DOCKERHUB;
+      this.selectDockerHub();
+      this.state.availableRegistry = options;
+      // Default registryValue is DockerHub, which is 6
+      this.state.registryValue = '6';
+
+      const from = this.$transition$.from();
+      const params = this.$transition$.params('from');
+
+      if (from.name && /^[a-z]+\.registries$/.test(from.name)) {
+        this.state.originViewReference = from;
+        this.state.originalEndpointId = params.endpointId || null;
+      }
+      await this.getRegistries();
+    });
+  }
+}
+
+export default CreateRegistryController;
diff --git a/app/portainer/registry-management/views/edit/registry.html b/app/portainer/registry-management/views/edit/registry.html
new file mode 100644
index 0000000..864c890
--- /dev/null
+++ b/app/portainer/registry-management/views/edit/registry.html
@@ -0,0 +1,289 @@
+<page-header title="'Registry details'" breadcrumbs="[{label:'Registries', link:'portainer.registries'}, $ctrl.registry.Name]" reload="true"> </page-header>
+
+<div class="row" ng-if="!$ctrl.state.loading">
+  <div class="col-sm-12">
+    <rd-widget>
+      <rd-widget-body>
+        <form class="form-horizontal" name="editRegistry">
+          <!-- provider -->
+          <div class="form-group">
+            <label for="registry_name" class="col-sm-3 col-lg-2 control-label text-left">Provider</label>
+            <div class="col-sm-9 col-lg-10">
+              <input type="text" class="form-control" ng-model="$ctrl.provider" disabled data-cy="registries-provider-input" />
+            </div>
+          </div>
+
+          <!-- name-input -->
+          <div class="form-group">
+            <label for="registry_name" class="col-sm-3 col-lg-2 control-label required text-left">Name</label>
+            <div class="col-sm-9 col-lg-10">
+              <input
+                type="text"
+                data-cy="registry-name-input"
+                class="form-control"
+                id="registry_name"
+                name="registry_name"
+                ng-model="$ctrl.registry.Name"
+                placeholder="e.g. my-registry"
+                ng-change="$ctrl.onChangeName()"
+                required
+              />
+            </div>
+          </div>
+          <div class="form-group" ng-show="$ctrl.state.nameAlreadyExists">
+            <div class="col-sm-12 small text-warning">
+              <div>
+                <p class="vertical-center">
+                  <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon>
+                  A registry with the same name already exists.
+                </p>
+              </div>
+            </div>
+          </div>
+          <div class="form-group" ng-show="editRegistry.registry_name.$invalid">
+            <div class="col-sm-12 small text-warning">
+              <div ng-messages="editRegistry.registry_name.$error">
+                <p ng-message="required" class="vertical-center">
+                  <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon>
+                  This field is required.
+                </p>
+              </div>
+            </div>
+          </div>
+          <!-- !name-input -->
+          <!-- registry-url-input -->
+          <div class="form-group">
+            <label for="registry_url" class="col-sm-3 col-lg-2 control-label text-left">
+              <span class="required">Registry URL</span>
+              <portainer-tooltip message="'URL or IP address of a Docker registry. Any protocol or trailing slash will be stripped if present.'"> </portainer-tooltip>
+            </label>
+            <div class="col-sm-9 col-lg-10">
+              <input
+                type="text"
+                data-cy="registry-url-input"
+                class="form-control"
+                id="registry_url"
+                name="registry_url"
+                ng-model="$ctrl.registry.URL"
+                placeholder="e.g. 10.0.0.10:5000 or myregistry.domain.tld"
+                ng-disabled="$ctrl.registry.Type === $ctrl.RegistryTypes.DOCKERHUB || $ctrl.registry.Type === $ctrl.RegistryTypes.QUAY || $ctrl.registry.Type === $ctrl.RegistryTypes.GITLAB"
+                required
+              />
+            </div>
+          </div>
+          <div class="form-group" ng-show="editRegistry.registry_url.$invalid">
+            <div class="col-sm-12 small text-warning">
+              <div ng-messages="editRegistry.registry_url.$error">
+                <p ng-message="required" class="vertical-center">
+                  <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon>
+                  This field is required.
+                </p>
+              </div>
+            </div>
+          </div>
+
+          <!-- base-url-input -->
+          <div ng-if="$ctrl.registry.Type === $ctrl.RegistryTypes.PROGET">
+            <div class="form-group">
+              <label for="registry_base_url" class="col-sm-3 col-lg-2 control-label text-left">
+                <span class="required">Base URL</span>
+                <portainer-tooltip message="'The base URL of the ProGet registry.'"> </portainer-tooltip>
+              </label>
+              <div class="col-sm-9 col-lg-10">
+                <input
+                  type="text"
+                  data-cy="registry-base-url-input"
+                  class="form-control"
+                  id="registry_base_url"
+                  name="registry_base_url"
+                  ng-model="$ctrl.registry.BaseURL"
+                  placeholder="e.g. 10.0.0.10:5000 or myregistry.domain.tld"
+                  required
+                />
+              </div>
+            </div>
+            <div class="form-group" ng-show="editRegistry.registry_base_url.$invalid">
+              <div class="col-sm-12 small text-warning">
+                <div ng-messages="editRegistry.registry_base_url.$error">
+                  <p ng-message="required" class="vertical-center">
+                    <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon>
+                    This field is required.
+                  </p>
+                </div>
+              </div>
+            </div>
+          </div>
+          <!-- !registry-url-input -->
+
+          <!-- authentication-checkbox -->
+          <div
+            class="form-group"
+            ng-if="
+              $ctrl.registry.Type !== $ctrl.RegistryTypes.DOCKERHUB &&
+              $ctrl.registry.Type !== $ctrl.RegistryTypes.QUAY &&
+              $ctrl.registry.Type !== $ctrl.RegistryTypes.PROGET &&
+              $ctrl.registry.Type !== $ctrl.RegistryTypes.AZURE &&
+              $ctrl.registry.Type !== $ctrl.RegistryTypes.GITLAB
+            "
+          >
+            <label for="registry_auth" class="col-sm-3 col-lg-2 control-label text-left">
+              Authentication
+              <portainer-tooltip message="'Enable this option if you need to specify credentials to connect to this registry.'"> </portainer-tooltip>
+            </label>
+            <div class="col-sm-9 col-lg-10">
+              <por-switch-field checked="$ctrl.registry.Authentication" on-change="($ctrl.toggleAuthentication)" switch-values="{on:'Yes',off:'No'}"></por-switch-field>
+            </div>
+          </div>
+          <!-- !authentication-checkbox -->
+
+          <!-- authentication-credentials -->
+          <div ng-if="$ctrl.registry.Authentication">
+            <!-- credentials-user -->
+            <div class="form-group">
+              <label for="credentials_username" class="col-sm-3 col-lg-2 control-label required text-left">
+                {{ $ctrl.registry.Type === $ctrl.RegistryTypes.ECR ? 'AWS Access Key' : 'Username' }}
+              </label>
+              <div class="col-sm-9 col-lg-10">
+                <input
+                  type="text"
+                  class="form-control"
+                  id="credentials_username"
+                  name="credentials_username"
+                  ng-model="$ctrl.registry.Username"
+                  required
+                  data-cy="registries-username-credential-input"
+                />
+              </div>
+            </div>
+            <div class="form-group" ng-show="editRegistry.credentials_username.$invalid">
+              <div class="col-sm-12 small text-warning">
+                <div ng-messages="editRegistry.credentials_username.$error">
+                  <p ng-message="required" class="vertical-center">
+                    <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon>
+                    This field is required.
+                  </p>
+                </div>
+              </div>
+            </div>
+            <!-- !credentials-user -->
+            <!-- credentials-password -->
+            <div class="form-group">
+              <label for="credentials_password" class="col-sm-3 col-lg-2 control-label text-left"> {{ $ctrl.passwordLabel() }} </label>
+              <div class="col-sm-9 col-lg-10">
+                <input
+                  type="password"
+                  class="form-control"
+                  id="credentials_password"
+                  name="credentials_password"
+                  placeholder="*******"
+                  ng-model="$ctrl.Password"
+                  autocomplete="off"
+                />
+              </div>
+            </div>
+            <div class="form-group" ng-show="editRegistry.credentials_password.$invalid">
+              <div class="col-sm-12 small text-warning">
+                <div ng-messages="editRegistry.credentials_password.$error">
+                  <p ng-message="required" class="vertical-center">
+                    <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon>
+                    This field is required.
+                  </p>
+                </div>
+              </div>
+            </div>
+            <!-- region -->
+            <div ng-if="$ctrl.registry.Type == $ctrl.RegistryTypes.ECR">
+              <div class="form-group">
+                <label for="registry_region" class="col-sm-3 col-lg-2 control-label required text-left">Region</label>
+                <div class="col-sm-9 col-lg-10">
+                  <input
+                    type="text"
+                    class="form-control"
+                    id="registry_region"
+                    name="registry_region"
+                    ng-model="$ctrl.registry.Ecr.Region"
+                    placeholder="us-west-1"
+                    required
+                    data-cy="registries-region-credential-input"
+                  />
+                </div>
+              </div>
+              <div class="form-group" ng-show="editRegistry.registry_region.$invalid">
+                <div class="col-sm-12 small text-warning">
+                  <div ng-messages="editRegistry.registry_region.$error">
+                    <p ng-message="required" class="vertical-center">
+                      <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon>
+                      This field is required.
+                    </p>
+                  </div>
+                </div>
+              </div>
+            </div>
+            <!-- !region -->
+            <!-- !credentials-password -->
+          </div>
+          <!-- !authentication-credentials -->
+
+          <div ng-if="$ctrl.registry.Type == $ctrl.RegistryTypes.QUAY">
+            <!-- organisation-checkbox -->
+            <div class="form-group">
+              <label class="col-sm-3 col-lg-2 control-label text-left"> Use organization registry </label>
+              <div class="col-sm-9 col-lg-10">
+                <por-switch-field
+                  checked="$ctrl.registry.Quay.UseOrganisation"
+                  on-change="($ctrl.toggleQuayUseOrganisation)"
+                  switch-values="{on:'Yes',off:'No'}"
+                ></por-switch-field>
+              </div>
+            </div>
+            <!-- !organisation-checkbox -->
+            <div ng-if="$ctrl.registry.Quay.UseOrganisation">
+              <!-- organisation_name -->
+              <div class="form-group">
+                <label for="organisation_name" class="col-sm-3 col-lg-2 control-label required text-left">Organization name</label>
+                <div class="col-sm-9 col-lg-10">
+                  <input
+                    type="text"
+                    class="form-control"
+                    id="organisation_name"
+                    name="organisation_name"
+                    ng-model="$ctrl.registry.Quay.OrganisationName"
+                    required
+                    data-cy="registries-organisation-credential-input"
+                  />
+                </div>
+              </div>
+              <div class="form-group" ng-show="editRegistry.organisation_name.$invalid">
+                <div class="col-sm-12 small text-warning">
+                  <div ng-messages="editRegistry.organisation_name.$error">
+                    <p ng-message="required" class="vertical-center">
+                      <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon>
+                      This field is required.
+                    </p>
+                  </div>
+                </div>
+              </div>
+              <!-- !organisation_name -->
+            </div>
+          </div>
+
+          <div class="form-group">
+            <div class="col-sm-12">
+              <button
+                type="button"
+                class="btn btn-primary btn-sm !ml-0"
+                ng-disabled="$ctrl.isUpdateButtonDisabled() || editRegistry.$invalid"
+                ng-click="$ctrl.updateRegistry()"
+                button-spinner="$ctrl.state.actionInProgress"
+              >
+                <span ng-hide="$ctrl.state.actionInProgress">Update registry</span>
+                <span ng-show="$ctrl.state.actionInProgress">Updating registry...</span>
+              </button>
+              <a type="button" class="btn btn-default btn-sm" ui-sref="portainer.registries">Cancel</a>
+            </div>
+          </div>
+        </form>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
diff --git a/app/portainer/registry-management/views/edit/registry.js b/app/portainer/registry-management/views/edit/registry.js
new file mode 100644
index 0000000..c09ea41
--- /dev/null
+++ b/app/portainer/registry-management/views/edit/registry.js
@@ -0,0 +1,10 @@
+import angular from 'angular';
+import controller from './registryController';
+
+angular.module('portainer.app').component('editRegistry', {
+  templateUrl: './registry.html',
+  controller,
+  bindings: {
+    $transition$: '<',
+  },
+});
diff --git a/app/portainer/registry-management/views/edit/registryController.js b/app/portainer/registry-management/views/edit/registryController.js
new file mode 100644
index 0000000..97e3129
--- /dev/null
+++ b/app/portainer/registry-management/views/edit/registryController.js
@@ -0,0 +1,119 @@
+import _ from 'lodash';
+import { RegistryTypes } from '@/portainer/models/registryTypes';
+
+export default class RegistryController {
+  /* @ngInject */
+  constructor($scope, $async, $state, RegistryService, Notifications) {
+    this.$scope = $scope;
+    Object.assign(this, { $async, $state, RegistryService, Notifications });
+
+    this.RegistryTypes = RegistryTypes;
+
+    this.state = {
+      actionInProgress: false,
+      loading: false,
+    };
+
+    this.Password = '';
+
+    this.toggleAuthentication = this.toggleAuthentication.bind(this);
+    this.toggleQuayUseOrganisation = this.toggleQuayUseOrganisation.bind(this);
+  }
+
+  toggleAuthentication(newValue) {
+    this.$scope.$evalAsync(() => {
+      this.registry.Authentication = newValue;
+    });
+  }
+
+  toggleQuayUseOrganisation(newValue) {
+    this.$scope.$evalAsync(() => {
+      this.registry.Quay.UseOrganisation = newValue;
+    });
+  }
+
+  passwordLabel() {
+    const type = this.registry.Type;
+    switch (type) {
+      case RegistryTypes.ECR:
+        return 'AWS Secret Access Key';
+      case RegistryTypes.DOCKERHUB:
+        return 'Access token';
+      case RegistryTypes.GITLAB:
+        return 'Personal Access Token';
+      default:
+        return 'Password';
+    }
+  }
+
+  updateRegistry() {
+    return this.$async(async () => {
+      try {
+        this.state.actionInProgress = true;
+        const registry = this.registry;
+        registry.Password = this.Password;
+
+        await this.RegistryService.updateRegistry(registry);
+        this.Notifications.success('Success', 'Registry successfully updated');
+        this.$state.go('portainer.registries');
+      } catch (err) {
+        this.Notifications.error('Failure', err, 'Unable to update registry');
+      } finally {
+        this.state.actionInProgress = false;
+      }
+    });
+  }
+
+  onChangeName() {
+    this.state.nameAlreadyExists = _.includes(this.registriesNames, this.registry.Name);
+  }
+
+  isUpdateButtonDisabled() {
+    return (
+      this.state.actionInProgress ||
+      this.state.nameAlreadyExists ||
+      !this.registry.Name ||
+      !this.registry.URL ||
+      (this.registry.Type == this.RegistryTypes.QUAY && this.registry.Quay.UseOrganisation && !this.registry.Quay.OrganisationName)
+    );
+  }
+
+  getRegistryProvider(registryType) {
+    switch (registryType) {
+      case RegistryTypes.QUAY:
+        return 'Quay.io';
+      case RegistryTypes.AZURE:
+        return 'Azure';
+      case RegistryTypes.CUSTOM:
+        return 'Custom';
+      case RegistryTypes.GITLAB:
+        return 'Gitlab';
+      case RegistryTypes.PROGET:
+        return 'ProGet';
+      case RegistryTypes.DOCKERHUB:
+        return 'Docker Hub';
+      case RegistryTypes.ECR:
+        return 'AWS ECR';
+      default:
+        return '';
+    }
+  }
+  async $onInit() {
+    try {
+      this.state.loading = true;
+
+      const registryId = this.$state.params.id;
+      const registry = await this.RegistryService.registry(registryId);
+      this.registry = registry;
+      this.provider = this.getRegistryProvider(registry.Type);
+
+      const registries = await this.RegistryService.registries();
+      _.pullAllBy(registries, [registry], 'Id');
+      this.registriesNames = _.map(registries, 'Name');
+    } catch (err) {
+      this.Notifications.error('Failure', err, 'Unable to retrieve registry details');
+    } finally {
+      this.state.loading = false;
+    }
+  }
+}
diff --git a/app/portainer/rest/auth.js b/app/portainer/rest/auth.js
new file mode 100644
index 0000000..1723ccd
--- /dev/null
+++ b/app/portainer/rest/auth.js
@@ -0,0 +1,15 @@
+angular.module('portainer.app').factory('Auth', [
+  '$resource',
+  'API_ENDPOINT_AUTH',
+  function AuthFactory($resource, API_ENDPOINT_AUTH) {
+    'use strict';
+    return $resource(
+      API_ENDPOINT_AUTH + '/:action',
+      {},
+      {
+        login: { method: 'POST', ignoreLoadingBar: true },
+        logout: { method: 'POST', params: { action: 'logout' }, ignoreLoadingBar: true },
+      }
+    );
+  },
+]);
diff --git a/app/portainer/rest/backup.js b/app/portainer/rest/backup.js
new file mode 100644
index 0000000..6cc8539
--- /dev/null
+++ b/app/portainer/rest/backup.js
@@ -0,0 +1,34 @@
+angular.module('portainer.app').factory('Backup', [
+  '$resource',
+  'API_ENDPOINT_BACKUP',
+  function BackupFactory($resource, API_ENDPOINT_BACKUP) {
+    'use strict';
+    return $resource(
+      API_ENDPOINT_BACKUP + '/:subResource/:action',
+      {},
+      {
+        download: {
+          method: 'POST',
+          responseType: 'arraybuffer',
+          ignoreLoadingBar: true,
+          transformResponse: (data, headersGetter, status) => {
+            if (status !== 200) {
+              const decoder = new TextDecoder('utf-8');
+              const str = decoder.decode(data);
+              return JSON.parse(str);
+            }
+
+            return {
+              file: data,
+              name: headersGetter('Content-Disposition').replace('attachment; filename=', ''),
+            };
+          },
+        },
+        getS3Settings: { method: 'GET', params: { subResource: 's3', action: 'settings' } },
+        saveS3Settings: { method: 'POST', params: { subResource: 's3', action: 'settings' } },
+        exportS3Backup: { method: 'POST', params: { subResource: 's3', action: 'execute' } },
+        restoreS3Backup: { method: 'POST', params: { subResource: 's3', action: 'restore' } },
+      }
+    );
+  },
+]);
diff --git a/app/portainer/rest/customTemplate.js b/app/portainer/rest/customTemplate.js
new file mode 100644
index 0000000..f712355
--- /dev/null
+++ b/app/portainer/rest/customTemplate.js
@@ -0,0 +1,19 @@
+import angular from 'angular';
+
+angular.module('portainer.app').factory('CustomTemplates', CustomTemplatesFactory);
+
+function CustomTemplatesFactory($resource, API_ENDPOINT_CUSTOM_TEMPLATES) {
+  return $resource(
+    API_ENDPOINT_CUSTOM_TEMPLATES + '/:id/:action',
+    {},
+    {
+      create: { method: 'POST', ignoreLoadingBar: true, params: { id: 'create', action: '@method' } },
+      query: { method: 'GET', isArray: true },
+      get: { method: 'GET', params: { id: '@id' } },
+      update: { method: 'PUT', params: { id: '@id' } },
+      remove: { method: 'DELETE', params: { id: '@id' } },
+      file: { method: 'GET', params: { id: '@id', action: 'file' } },
+      gitFetch: { method: 'PUT', params: { id: '@id', action: 'git_fetch' } },
+    }
+  );
+}
diff --git a/app/portainer/rest/endpoint.js b/app/portainer/rest/endpoint.js
new file mode 100644
index 0000000..4f0d4c7
--- /dev/null
+++ b/app/portainer/rest/endpoint.js
@@ -0,0 +1,44 @@
+import getEndpointsTotalCount from './transform/getEndpointsTotalCount';
+
+angular.module('portainer.app').factory('Endpoints', [
+  '$resource',
+  'API_ENDPOINT_ENDPOINTS',
+  function EndpointsFactory($resource, API_ENDPOINT_ENDPOINTS) {
+    'use strict';
+    return $resource(
+      API_ENDPOINT_ENDPOINTS + '/:id/:action',
+      {},
+      {
+        query: {
+          method: 'GET',
+          params: { start: '@start', limit: '@limit', search: '@search', groupId: '@groupId' },
+          transformResponse: getEndpointsTotalCount,
+        },
+        get: { method: 'GET', params: { id: '@id' } },
+        update: { method: 'PUT', params: { id: '@id' } },
+        disassociate: { method: 'DELETE', params: { id: '@id', action: 'association' } },
+        updateAccess: { method: 'PUT', params: { id: '@id', action: 'access' } },
+        remove: { method: 'DELETE', params: { id: '@id' } },
+        snapshots: { method: 'POST', params: { action: 'snapshot' } },
+        snapshot: { method: 'POST', params: { id: '@id', action: 'snapshot' } },
+        status: { method: 'GET', params: { id: '@id', action: 'status' } },
+        updateSecuritySettings: { method: 'PUT', params: { id: '@id', action: 'settings' } },
+        dockerhubLimits: {
+          method: 'GET',
+          url: `${API_ENDPOINT_ENDPOINTS}/:id/dockerhub/:registryId`,
+        },
+        registries: {
+          method: 'GET',
+          url: `${API_ENDPOINT_ENDPOINTS}/:id/registries`,
+          params: { id: '@id', namespace: '@namespace' },
+          isArray: true,
+        },
+        updateRegistryAccess: {
+          method: 'PUT',
+          url: `${API_ENDPOINT_ENDPOINTS}/:id/registries/:registryId`,
+          params: { id: '@id', registryId: '@registryId' },
+        },
+      }
+    );
+  },
+]);
diff --git a/app/portainer/rest/gitlab.js b/app/portainer/rest/gitlab.js
new file mode 100644
index 0000000..1418a4c
--- /dev/null
+++ b/app/portainer/rest/gitlab.js
@@ -0,0 +1,38 @@
+import gitlabResponseGetLink from './transform/gitlabResponseGetLink';
+
+angular.module('portainer.app').factory('Gitlab', [
+  '$resource',
+  'API_ENDPOINT_REGISTRIES',
+  function GitlabFactory($resource, API_ENDPOINT_REGISTRIES) {
+    'use strict';
+    return function (env) {
+      const headers = {};
+      if (env) {
+        headers['Private-Token'] = env.token;
+        headers['X-Gitlab-Domain'] = env.url;
+      }
+
+      const baseUrl = API_ENDPOINT_REGISTRIES + '/:id/proxies/gitlab/api/v4/projects';
+
+      return $resource(
+        baseUrl,
+        { id: '@id' },
+        {
+          projects: {
+            method: 'GET',
+            params: { membership: 'true' },
+            transformResponse: gitlabResponseGetLink,
+            headers: headers,
+          },
+          repositories: {
+            method: 'GET',
+            url: baseUrl + '/:projectId/registry/repositories',
+            params: { tags: true },
+            headers: headers,
+            transformResponse: gitlabResponseGetLink,
+          },
+        }
+      );
+    };
+  },
+]);
diff --git a/app/portainer/rest/group.js b/app/portainer/rest/group.js
new file mode 100644
index 0000000..f652656
--- /dev/null
+++ b/app/portainer/rest/group.js
@@ -0,0 +1,21 @@
+angular.module('portainer.app').factory('EndpointGroups', [
+  '$resource',
+  'API_ENDPOINT_ENDPOINT_GROUPS',
+  function EndpointGroupsFactory($resource, API_ENDPOINT_ENDPOINT_GROUPS) {
+    'use strict';
+    return $resource(
+      API_ENDPOINT_ENDPOINT_GROUPS + '/:id/:action',
+      {},
+      {
+        create: { method: 'POST', ignoreLoadingBar: true },
+        query: { method: 'GET', isArray: true },
+        get: { method: 'GET', params: { id: '@id' } },
+        update: { method: 'PUT', params: { id: '@id' } },
+        updateAccess: { method: 'PUT', params: { id: '@id', action: 'access' } },
+        addEndpoint: { method: 'PUT', params: { id: '@id', action: '@action' } },
+        removeEndpoint: { method: 'DELETE', params: { id: '@id', action: '@action' } },
+        remove: { method: 'DELETE', params: { id: '@id' } },
+      }
+    );
+  },
+]);
diff --git a/app/portainer/rest/registry.js b/app/portainer/rest/registry.js
new file mode 100644
index 0000000..706c56a
--- /dev/null
+++ b/app/portainer/rest/registry.js
@@ -0,0 +1,19 @@
+angular.module('portainer.app').factory('Registries', [
+  '$resource',
+  'API_ENDPOINT_REGISTRIES',
+  function RegistriesFactory($resource, API_ENDPOINT_REGISTRIES) {
+    'use strict';
+    return $resource(
+      API_ENDPOINT_REGISTRIES + '/:id/:action',
+      {},
+      {
+        create: { method: 'POST', ignoreLoadingBar: true },
+        query: { method: 'GET', isArray: true },
+        get: { method: 'GET', params: { id: '@id', action: '', endpointId: '@endpointId' } },
+        update: { method: 'PUT', params: { id: '@id' } },
+        remove: { method: 'DELETE', params: { id: '@id' } },
+        configure: { method: 'POST', params: { id: '@id', action: 'configure' } },
+      }
+    );
+  },
+]);
diff --git a/app/portainer/rest/resourceControl.js b/app/portainer/rest/resourceControl.js
new file mode 100644
index 0000000..24ba913
--- /dev/null
+++ b/app/portainer/rest/resourceControl.js
@@ -0,0 +1,14 @@
+angular.module('portainer.app').factory('ResourceControl', [
+  '$resource',
+  'API_ENDPOINT_RESOURCE_CONTROLS',
+  function ResourceControlFactory($resource, API_ENDPOINT_RESOURCE_CONTROLS) {
+    'use strict';
+    return $resource(
+      API_ENDPOINT_RESOURCE_CONTROLS + '/:id',
+      {},
+      {
+        update: { method: 'PUT', params: { id: '@id' } },
+      }
+    );
+  },
+]);
diff --git a/app/portainer/rest/settings.js b/app/portainer/rest/settings.js
new file mode 100644
index 0000000..c25a799
--- /dev/null
+++ b/app/portainer/rest/settings.js
@@ -0,0 +1,17 @@
+angular.module('portainer.app').factory('Settings', [
+  '$resource',
+  'API_ENDPOINT_SETTINGS',
+  function SettingsFactory($resource, API_ENDPOINT_SETTINGS) {
+    'use strict';
+    return $resource(
+      API_ENDPOINT_SETTINGS + '/:subResource/:action',
+      {},
+      {
+        get: { method: 'GET' },
+        update: { method: 'PUT', ignoreLoadingBar: true },
+        publicSettings: { method: 'GET', params: { subResource: 'public' }, ignoreLoadingBar: true },
+        checkLDAPConnectivity: { method: 'PUT', params: { subResource: 'authentication', action: 'checkLDAP' } },
+      }
+    );
+  },
+]);
diff --git a/app/portainer/rest/ssl.js b/app/portainer/rest/ssl.js
new file mode 100644
index 0000000..d70be50
--- /dev/null
+++ b/app/portainer/rest/ssl.js
@@ -0,0 +1,17 @@
+import angular from 'angular';
+
+const API_ENDPOINT_SSL = 'api/ssl';
+
+angular.module('portainer.app').factory('SSL', SSLFactory);
+
+/* @ngInject */
+function SSLFactory($resource) {
+  return $resource(
+    API_ENDPOINT_SSL,
+    {},
+    {
+      get: { method: 'GET' },
+      upload: { method: 'PUT' },
+    }
+  );
+}
diff --git a/app/portainer/rest/stack.js b/app/portainer/rest/stack.js
new file mode 100644
index 0000000..85803ca
--- /dev/null
+++ b/app/portainer/rest/stack.js
@@ -0,0 +1,35 @@
+import angular from 'angular';
+
+angular.module('portainer.app').factory('Stack', StackFactory);
+angular.module('portainer.app').factory('StackByName', StackByNameFactory);
+
+/* @ngInject */
+function StackFactory($resource, API_ENDPOINT_STACKS) {
+  return $resource(
+    API_ENDPOINT_STACKS + '/:id/:action/:subaction',
+    {},
+    {
+      get: { method: 'GET', params: { id: '@id' } },
+      query: { method: 'GET', isArray: true },
+      create: { method: 'POST', ignoreLoadingBar: true, params: { id: 'create', subaction: '@method', action: '@type' } },
+      update: { method: 'PUT', params: { id: '@id' }, ignoreLoadingBar: true },
+      associate: { method: 'PUT', params: { id: '@id', swarmId: '@swarmId', endpointId: '@endpointId', orphanedRunning: '@orphanedRunning', action: 'associate' } },
+      remove: { method: 'DELETE', params: { id: '@id', external: '@external', endpointId: '@endpointId' } },
+      getStackFile: { method: 'GET', params: { id: '@id', action: 'file' } },
+      start: { method: 'POST', params: { id: '@id', action: 'start', endpointId: '@endpointId' } },
+      stop: { method: 'POST', params: { id: '@id', action: 'stop', endpointId: '@endpointId' } },
+      updateGit: { method: 'PUT', params: { id: '@id', action: 'git', subaction: 'redeploy' } },
+      updateGitStackSettings: { method: 'POST', params: { id: '@id', action: 'git' }, ignoreLoadingBar: true },
+    }
+  );
+}
+
+function StackByNameFactory($resource, API_ENDPOINT_STACKS) {
+  return $resource(
+    API_ENDPOINT_STACKS + '/name/:name',
+    {},
+    {
+      remove: { method: 'DELETE', params: { name: '@name', external: '@external', endpointId: '@endpointId', namespace: '@namespace' } },
+    }
+  );
+}
diff --git a/app/portainer/rest/support.js b/app/portainer/rest/support.js
new file mode 100644
index 0000000..386810b
--- /dev/null
+++ b/app/portainer/rest/support.js
@@ -0,0 +1,14 @@
+angular.module('portainer.app').factory('Support', [
+  '$resource',
+  'API_ENDPOINT_SUPPORT',
+  function SupportFactory($resource, API_ENDPOINT_SUPPORT) {
+    'use strict';
+    return $resource(
+      API_ENDPOINT_SUPPORT,
+      {},
+      {
+        get: { method: 'GET', isArray: true },
+      }
+    );
+  },
+]);
diff --git a/app/portainer/rest/tag.js b/app/portainer/rest/tag.js
new file mode 100644
index 0000000..b741614
--- /dev/null
+++ b/app/portainer/rest/tag.js
@@ -0,0 +1,16 @@
+angular.module('portainer.app').factory('Tags', [
+  '$resource',
+  'API_ENDPOINT_TAGS',
+  function TagsFactory($resource, API_ENDPOINT_TAGS) {
+    'use strict';
+    return $resource(
+      API_ENDPOINT_TAGS + '/:id',
+      {},
+      {
+        create: { method: 'POST' },
+        query: { method: 'GET', isArray: true },
+        remove: { method: 'DELETE', params: { id: '@id' } },
+      }
+    );
+  },
+]);
diff --git a/app/portainer/rest/team.js b/app/portainer/rest/team.js
new file mode 100644
index 0000000..b17a9ec
--- /dev/null
+++ b/app/portainer/rest/team.js
@@ -0,0 +1,18 @@
+angular.module('portainer.app').factory('Teams', [
+  '$resource',
+  'API_ENDPOINT_TEAMS',
+  function TeamsFactory($resource, API_ENDPOINT_TEAMS) {
+    'use strict';
+    return $resource(
+      API_ENDPOINT_TEAMS + '/:id/:entity/:entityId',
+      {},
+      {
+        create: { method: 'POST', ignoreLoadingBar: true },
+        query: { method: 'GET', isArray: true, params: { environmentId: '@environmentId' } },
+        get: { method: 'GET', params: { id: '@id' } },
+        remove: { method: 'DELETE', params: { id: '@id' } },
+        queryMemberships: { method: 'GET', isArray: true, params: { id: '@id', entity: 'memberships' } },
+      }
+    );
+  },
+]);
diff --git a/app/portainer/rest/teamMembership.js b/app/portainer/rest/teamMembership.js
new file mode 100644
index 0000000..7d9ee4f
--- /dev/null
+++ b/app/portainer/rest/teamMembership.js
@@ -0,0 +1,17 @@
+angular.module('portainer.app').factory('TeamMemberships', [
+  '$resource',
+  'API_ENDPOINT_TEAM_MEMBERSHIPS',
+  function TeamMembershipsFactory($resource, API_ENDPOINT_TEAM_MEMBERSHIPS) {
+    'use strict';
+    return $resource(
+      API_ENDPOINT_TEAM_MEMBERSHIPS + '/:id/:action',
+      {},
+      {
+        create: { method: 'POST', ignoreLoadingBar: true },
+        query: { method: 'GET', isArray: true },
+        update: { method: 'PUT', params: { id: '@id' } },
+        remove: { method: 'DELETE', params: { id: '@id' } },
+      }
+    );
+  },
+]);
diff --git a/app/portainer/rest/template.js b/app/portainer/rest/template.js
new file mode 100644
index 0000000..f628f7f
--- /dev/null
+++ b/app/portainer/rest/template.js
@@ -0,0 +1,14 @@
+angular.module('portainer.app').factory('Templates', [
+  '$resource',
+  'API_ENDPOINT_TEMPLATES',
+  function TemplatesFactory($resource, API_ENDPOINT_TEMPLATES) {
+    return $resource(
+      API_ENDPOINT_TEMPLATES + '/:action',
+      {},
+      {
+        query: { method: 'GET' },
+        file: { method: 'POST', params: { action: 'file' } },
+      }
+    );
+  },
+]);
diff --git a/app/portainer/rest/transform/getEndpointsTotalCount.js b/app/portainer/rest/transform/getEndpointsTotalCount.js
new file mode 100644
index 0000000..a689ee0
--- /dev/null
+++ b/app/portainer/rest/transform/getEndpointsTotalCount.js
@@ -0,0 +1,6 @@
+export default function getEndpointsTotalCount(data, headers) {
+  const response = {};
+  response.value = angular.fromJson(data);
+  response.totalCount = headers('X-Total-Count');
+  return response;
+}
diff --git a/app/portainer/rest/transform/gitlabResponseGetLink.js b/app/portainer/rest/transform/gitlabResponseGetLink.js
new file mode 100644
index 0000000..7513d7a
--- /dev/null
+++ b/app/portainer/rest/transform/gitlabResponseGetLink.js
@@ -0,0 +1,10 @@
+export default function gitlabResponseGetLink(data, headers) {
+  let response = {};
+  try {
+    response.data = angular.fromJson(data);
+    response.next = headers('X-Next-Page');
+  } catch (error) {
+    response = data;
+  }
+  return response;
+}
diff --git a/app/portainer/rest/user.js b/app/portainer/rest/user.js
new file mode 100644
index 0000000..9b749c3
--- /dev/null
+++ b/app/portainer/rest/user.js
@@ -0,0 +1,25 @@
+angular.module('portainer.app').factory('Users', [
+  '$resource',
+  'API_ENDPOINT_USERS',
+  function UsersFactory($resource, API_ENDPOINT_USERS) {
+    'use strict';
+    return $resource(
+      API_ENDPOINT_USERS + '/:id/:entity/:entityId',
+      {},
+      {
+        create: { method: 'POST', ignoreLoadingBar: true },
+        query: { method: 'GET', isArray: true },
+        get: { method: 'GET', params: { id: '@id' } },
+        update: { method: 'PUT', params: { id: '@id' }, ignoreLoadingBar: true },
+        updatePassword: { method: 'PUT', params: { id: '@id', entity: 'passwd' } },
+        updateTheme: { method: 'PUT', params: { id: '@id' } },
+        remove: { method: 'DELETE', params: { id: '@id' } },
+        queryMemberships: { method: 'GET', isArray: true, params: { id: '@id', entity: 'memberships' } },
+        checkAdminUser: { method: 'GET', params: { id: 'admin', entity: 'check' }, isArray: true, ignoreLoadingBar: true },
+        initAdminUser: { method: 'POST', params: { id: 'admin', entity: 'init' }, ignoreLoadingBar: true },
+        getAccessTokens: { method: 'GET', params: { id: '@id', entity: 'tokens' }, isArray: true },
+        deleteAccessToken: { url: `${API_ENDPOINT_USERS}/:id/tokens/:tokenId`, method: 'DELETE', params: { id: '@id', entityId: '@tokenId' } },
+      }
+    );
+  },
+]);
diff --git a/app/portainer/rest/webhooks.js b/app/portainer/rest/webhooks.js
new file mode 100644
index 0000000..8e32ff1
--- /dev/null
+++ b/app/portainer/rest/webhooks.js
@@ -0,0 +1,17 @@
+angular.module('portainer.app').factory('Webhooks', [
+  '$resource',
+  'API_ENDPOINT_WEBHOOKS',
+  function WebhooksFactory($resource, API_ENDPOINT_WEBHOOKS) {
+    'use strict';
+    return $resource(
+      API_ENDPOINT_WEBHOOKS + '/:id',
+      {},
+      {
+        query: { method: 'GET', isArray: true },
+        create: { method: 'POST' },
+        update: { method: 'PUT', params: { id: '@id' } },
+        remove: { method: 'DELETE', params: { id: '@id' } },
+      }
+    );
+  },
+]);
diff --git a/app/portainer/services/allSettled.js b/app/portainer/services/allSettled.js
new file mode 100644
index 0000000..020869d
--- /dev/null
+++ b/app/portainer/services/allSettled.js
@@ -0,0 +1,34 @@
+import _ from 'lodash-es';
+
+/**
+ *
+ * @param {any[]} promises
+ */
+export default async function $allSettled(promises) {
+  const res = {
+    fulfilled: [],
+    rejected: [],
+  };
+  const data = await Promise.allSettled(promises);
+  res.fulfilled = _.reduce(
+    data,
+    (acc, item) => {
+      if (item.status === 'fulfilled') {
+        acc.push(item.value);
+      }
+      return acc;
+    },
+    []
+  );
+  res.rejected = _.reduce(
+    data,
+    (acc, item) => {
+      if (item.status === 'rejected') {
+        acc.push(item.reason);
+      }
+      return acc;
+    },
+    []
+  );
+  return res;
+}
diff --git a/app/portainer/services/angularToReact.ts b/app/portainer/services/angularToReact.ts
new file mode 100644
index 0000000..b6b0809
--- /dev/null
+++ b/app/portainer/services/angularToReact.ts
@@ -0,0 +1,116 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { EndpointProviderInterface } from './endpointProvider';
+
+// see async.js
+type AsyncInterface = (
+  asyncFunc: AsyncFunction,
+  ...args: unknown[]
+) => Promise<unknown>;
+
+type AsyncFunction = (...params: unknown[]) => Promise<unknown>;
+type AxiosFunction = (
+  environmentId: EnvironmentId | undefined,
+  ...params: unknown[]
+) => Promise<unknown>;
+
+/* @ngInject */
+export function AngularToReact(
+  EndpointProvider: EndpointProviderInterface,
+  $async: AsyncInterface
+) {
+  return { useAxios, injectEnvironmentId };
+
+  /**
+   * Wraps the async axios function with `$async` to ensures the request runs inside the AngularJS digest cycle
+   *
+   * See `$async` (async.js) implementation and notes
+   *
+   * See `AngularToReact.injectEnvironmentId` to solve `environmentId` injection for services functions relying
+   * on `EndpointProvider.endpointID()` in their `$resource()` definition
+   *
+   * @example
+   * **Old AngularJS service**
+   * ```
+   * // file:: AngularJS service.js
+   *
+   * // ngInject
+   * function ServiceServiceFactory($q, Service) {
+   *   return { getService };
+   *
+   *   // the original signature doesn't have environmentId passed to it
+   *   // it relies on EndpointProvider in $resource() definition
+   *   // we will inject it on refactor
+   *   // the function uses $q, which internally triggers a redraw of the UI when it resolves/rejects
+   *   function getService(serviceId) {
+   *     var deferred = $q.defer();
+   *     [...]
+   *     return deferred.promise;
+   *   };
+   *
+   *   // the original signature has environmentId passed to it
+   *   // it doesn't rely on EndpointProvider in $resource() definition
+   *   // we won't inject environmentId on refactor
+   *   // the function uses $q, which internally triggers a redraw of the UI when it resolves/rejects
+   *   function listServices(environmentId) {
+   *     var deferred = $q.defer();
+   *     [...]
+   *     return deferred.promise;
+   *   };
+   * }
+   * ```
+   *
+   * **New format**
+   * ```
+   * // file:: '@/react/.../useService.ts'
+   * // this function has `environmentId` as first parameter, which doesn't match the old AngularJS service signature
+   * export async function getService(environmentId: EnvironmentId, serviceId: ServiceId) {
+   *   // axios.get()
+   * }
+   * // file:: '@/react/.../useServices.ts'
+   * // this function has `environmentId` as first parameter, which matches the old AngularJS service signature
+   * export async function listServices(environmentId: EnvironmentId, serviceId: ServiceId) {
+   *   // axios.get()
+   * }
+   * // file:: AngularJS service.js
+   * import { getService } from '@/react/.../useService.ts';
+   * import { listServices } from '@/react/.../useServices.ts';
+   *
+   * // ngInject
+   * function ServiceServiceFactory(AngularToReact) {
+   *   const { useAxios, injectEnvironmentId } = AngularToReact;
+   *   return {
+   *     // ask to inject environmentId to maintain the old signature
+   *     getService: useAxios(injectEnvironmentId(getService)),
+   *     // do not ask to inject environmentId as it was already in the old signature
+   *     // and is already passed by the caller
+   *     listServices: useAxios(listServices),
+   *   };
+   * }
+   * ```
+   */
+  function useAxios(axiosFunc: AxiosFunction) {
+    return (...params: unknown[]) =>
+      $async(axiosFunc as AsyncFunction, ...params);
+  }
+
+  /**
+   * Wraps the Axios function taking `endpointId` as first param to expose the old service format.
+   *
+   * Leverage injected `EndpointProvider` that was used in the rest file - `$resource()` definition.
+   *
+   * The axios function params **MUST** match the old AngularJS-service ones to use this helper without changing the service calls
+   *
+   * Should be used in conjunction with `AngularToReact.useAxios`
+   *
+   * @example
+   * See `AngularToReact.useAxios`
+   *
+   * @param {(environmentId: EnvironmentId, ...params: unknown[]) => Promise<unknown>} axiosFunc Axios function taking `environmentId` as first param
+   * @returns a function with the old AngularJS signature
+   */
+  function injectEnvironmentId(axiosFunc: AxiosFunction) {
+    return async (...params: unknown[]) =>
+      axiosFunc(EndpointProvider.endpointID(), ...params);
+  }
+}
diff --git a/app/portainer/services/api/accessService.js b/app/portainer/services/api/accessService.js
new file mode 100644
index 0000000..711f052
--- /dev/null
+++ b/app/portainer/services/api/accessService.js
@@ -0,0 +1,117 @@
+import _ from 'lodash-es';
+import { UserAccessViewModel } from '../../models/access';
+import { TeamAccessViewModel } from '../../models/access';
+
+angular.module('portainer.app').factory('AccessService', [
+  '$q',
+  '$async',
+  'UserService',
+  'TeamService',
+  function AccessServiceFactory($q, $async, UserService, TeamService) {
+    'use strict';
+    return {
+      accesses,
+      generateAccessPolicies,
+    };
+
+    function _mapAccessData(accesses, authorizedPolicies, inheritedPolicies) {
+      var availableAccesses = [];
+      var authorizedAccesses = [];
+
+      for (var i = 0; i < accesses.length; i++) {
+        const access = accesses[i];
+
+        const authorized = authorizedPolicies && authorizedPolicies[access.Id];
+        const inherited = inheritedPolicies && inheritedPolicies[access.Id];
+
+        if (authorized && inherited) {
+          access.Override = true;
+          authorizedAccesses.push(access);
+        } else if (authorized && !inherited) {
+          authorizedAccesses.push(access);
+        } else if (!authorized && inherited) {
+          access.Inherited = true;
+          authorizedAccesses.push(access);
+          availableAccesses.push(access);
+        } else {
+          availableAccesses.push(access);
+        }
+      }
+
+      return {
+        available: availableAccesses,
+        authorized: authorizedAccesses,
+      };
+    }
+
+    function getAccesses(authorizedUserPolicies, authorizedTeamPolicies, inheritedUserPolicies, inheritedTeamPolicies) {
+      var deferred = $q.defer();
+
+      $q.all({
+        users: UserService.users(false),
+        teams: TeamService.teams(),
+      })
+        .then(function success(data) {
+          var userAccesses = data.users.map(function (user) {
+            return new UserAccessViewModel(user);
+          });
+          var teamAccesses = data.teams.map(function (team) {
+            return new TeamAccessViewModel(team);
+          });
+
+          var userAccessData = _mapAccessData(userAccesses, authorizedUserPolicies, inheritedUserPolicies);
+          var teamAccessData = _mapAccessData(teamAccesses, authorizedTeamPolicies, inheritedTeamPolicies);
+
+          var accessData = {
+            availableUsersAndTeams: userAccessData.available.concat(teamAccessData.available),
+            authorizedUsersAndTeams: userAccessData.authorized.concat(teamAccessData.authorized),
+          };
+
+          deferred.resolve(accessData);
+        })
+        .catch(function error(err) {
+          deferred.reject({ msg: 'Unable to retrieve users and teams', err: err });
+        });
+
+      return deferred.promise;
+    }
+
+    async function accessesAsync(entity, parent) {
+      if (!entity) {
+        throw new Error('Unable to retrieve accesses');
+      }
+      if (!entity.UserAccessPolicies) {
+        entity.UserAccessPolicies = {};
+      }
+      if (!entity.TeamAccessPolicies) {
+        entity.TeamAccessPolicies = {};
+      }
+      if (parent && !parent.UserAccessPolicies) {
+        parent.UserAccessPolicies = {};
+      }
+      if (parent && !parent.TeamAccessPolicies) {
+        parent.TeamAccessPolicies = {};
+      }
+      return await getAccesses(entity.UserAccessPolicies, entity.TeamAccessPolicies, parent ? parent.UserAccessPolicies : {}, parent ? parent.TeamAccessPolicies : {});
+    }
+
+    function accesses(entity, parent) {
+      return $async(accessesAsync, entity, parent);
+    }
+
+    function generateAccessPolicies(userAccessPolicies, teamAccessPolicies, selectedUserAccesses, selectedTeamAccesses, selectedRoleId) {
+      const newUserPolicies = _.clone(userAccessPolicies);
+      const newTeamPolicies = _.clone(teamAccessPolicies);
+
+      _.forEach(selectedUserAccesses, (access) => (newUserPolicies[access.Id] = { RoleId: selectedRoleId ? selectedRoleId : access.Role.Id }));
+      _.forEach(selectedTeamAccesses, (access) => (newTeamPolicies[access.Id] = { RoleId: selectedRoleId ? selectedRoleId : access.Role.Id }));
+
+      const accessPolicies = {
+        userAccessPolicies: newUserPolicies,
+        teamAccessPolicies: newTeamPolicies,
+      };
+
+      return accessPolicies;
+    }
+  },
+]);
diff --git a/app/portainer/services/api/backup.service.ts b/app/portainer/services/api/backup.service.ts
new file mode 100644
index 0000000..d45c9ff
--- /dev/null
+++ b/app/portainer/services/api/backup.service.ts
@@ -0,0 +1,29 @@
+import axios, { parseAxiosError } from '../axios/axios';
+
+interface StatusResponse {
+  Failed: boolean;
+  TimestampUTC: string;
+}
+
+export async function getBackupStatus() {
+  try {
+    const { data } = await axios.get<StatusResponse>(buildUrl('s3', 'status'));
+    return data;
+  } catch (error) {
+    throw parseAxiosError(error as Error, 'Unable to retrieve backup status');
+  }
+}
+
+function buildUrl(resource?: string, action?: string) {
+  let url = '/backup';
+
+  if (resource) {
+    url += `/${resource}`;
+  }
+
+  if (action) {
+    url += `/${action}`;
+  }
+
+  return url;
+}
diff --git a/app/portainer/services/api/backupService.js b/app/portainer/services/api/backupService.js
new file mode 100644
index 0000000..026328a
--- /dev/null
+++ b/app/portainer/services/api/backupService.js
@@ -0,0 +1,76 @@
+angular.module('portainer.app').factory('BackupService', [
+  '$q',
+  '$async',
+  'Backup',
+  'FileUploadService',
+  function BackupServiceFactory($q, $async, Backup, FileUploadService) {
+    'use strict';
+    const service = {};
+
+    service.downloadBackup = function (payload) {
+      return Backup.download({}, payload).$promise;
+    };
+
+    service.uploadBackup = function (file, password, setupToken) {
+      return FileUploadService.uploadBackup(file, password, setupToken);
+    };
+
+    service.getS3Settings = function () {
+      var deferred = $q.defer();
+
+      Backup.getS3Settings()
+        .$promise.then(function success(data) {
+          deferred.resolve(data);
+        })
+        .catch(function error(err) {
+          deferred.reject({ msg: 'Unable to retrieve backup S3 settings', err: err });
+        });
+
+      return deferred.promise;
+    };
+
+    service.saveS3Settings = function (payload) {
+      var deferred = $q.defer();
+
+      Backup.saveS3Settings({}, payload)
+        .$promise.then(function success(data) {
+          deferred.resolve(data);
+        })
+        .catch(function error(err) {
+          deferred.reject({ msg: 'Unable to save backup S3 settings', err: err });
+        });
+
+      return deferred.promise;
+    };
+
+    service.exportBackup = function (payload) {
+      var deferred = $q.defer();
+
+      Backup.exportS3Backup({}, payload)
+        .$promise.then(function success(data) {
+          deferred.resolve(data);
+        })
+        .catch(function error(err) {
+          deferred.reject({ msg: 'Unable to export backup', err: err });
+        });
+
+      return deferred.promise;
+    };
+
+    service.restoreFromS3 = function (payload) {
+      var deferred = $q.defer();
+
+      Backup.restoreS3Backup({}, payload)
+        .$promise.then(function success(data) {
+          deferred.resolve(data);
+        })
+        .catch(function error(err) {
+          deferred.reject({ msg: 'Unable to restore backup from S3', err: err });
+        });
+
+      return deferred.promise;
+    };
+
+    return service;
+  },
+]);
diff --git a/app/portainer/services/api/customTemplate.js b/app/portainer/services/api/customTemplate.js
new file mode 100644
index 0000000..3bfe3e6
--- /dev/null
+++ b/app/portainer/services/api/customTemplate.js
@@ -0,0 +1,67 @@
+import angular from 'angular';
+import PortainerError from '@/portainer/error';
+
+angular.module('portainer.app').factory('CustomTemplateService', CustomTemplateServiceFactory);
+
+/* @ngInject */
+function CustomTemplateServiceFactory($sanitize, CustomTemplates, FileUploadService) {
+  var service = {};
+
+  service.customTemplate = function customTemplate(id) {
+    return CustomTemplates.get({ id }).$promise;
+  };
+
+  service.customTemplates = async function customTemplates(type, edge = false) {
+    const templates = await CustomTemplates.query({ type, edge }).$promise;
+    templates.forEach((template) => {
+      if (template.Note) {
+        template.Note = $('<p>').html($sanitize(template.Note)).find('img').remove().end().html();
+      }
+    });
+    return templates;
+  };
+
+  service.remove = function remove(id) {
+    return CustomTemplates.remove({ id }).$promise;
+  };
+
+  service.customTemplateFile = async function customTemplateFile(id, remote = false) {
+    try {
+      const { FileContent } = remote ? await CustomTemplates.gitFetch({ id }).$promise : await CustomTemplates.file({ id }).$promise;
+      return FileContent;
+    } catch (err) {
+      throw new PortainerError('Unable to retrieve custom template content', err);
+    }
+  };
+
+  service.updateCustomTemplate = async function updateCustomTemplate(id, customTemplate) {
+    return CustomTemplates.update({ id }, customTemplate).$promise;
+  };
+
+  service.createCustomTemplateFromFileContent = async function createCustomTemplateFromFileContent(payload) {
+    try {
+      return await CustomTemplates.create({}, { method: 'string', ...payload }).$promise;
+    } catch (err) {
+      throw { msg: 'Unable to create the customTemplate', err };
+    }
+  };
+
+  service.createCustomTemplateFromFileUpload = async function createCustomTemplateFromFileUpload(payload) {
+    try {
+      const { data } = await FileUploadService.createCustomTemplate(payload);
+      return data;
+    } catch (err) {
+      throw { msg: 'Unable to create the customTemplate', err };
+    }
+  };
+
+  service.createCustomTemplateFromGitRepository = async function createCustomTemplateFromGitRepository(payload) {
+    try {
+      return await CustomTemplates.create({}, { method: 'repository', ...payload }).$promise;
+    } catch (err) {
+      throw { msg: 'Unable to create the customTemplate', err };
+    }
+  };
+
+  return service;
+}
diff --git a/app/portainer/services/api/dockerhubService.js b/app/portainer/services/api/dockerhubService.js
new file mode 100644
index 0000000..b49c7eb
--- /dev/null
+++ b/app/portainer/services/api/dockerhubService.js
@@ -0,0 +1,27 @@
+import { PortainerEndpointTypes } from '@/portainer/models/endpoint/models';
+import { isLocalEnvironment } from '@/react/portainer/environments/utils';
+
+angular.module('portainer.app').factory('DockerHubService', DockerHubService);
+
+/* @ngInject */
+function DockerHubService(Endpoints, AgentDockerhub) {
+  return {
+    checkRateLimits,
+  };
+
+  function checkRateLimits(endpoint, registryId) {
+    if (isLocalEnvironment(endpoint)) {
+      return Endpoints.dockerhubLimits({ id: endpoint.Id, registryId }).$promise;
+    }
+
+    switch (endpoint.Type) {
+      case PortainerEndpointTypes.AgentOnDockerEnvironment:
+      case PortainerEndpointTypes.EdgeAgentOnDockerEnvironment:
+        return AgentDockerhub.limits({ endpointId: endpoint.Id, endpointType: 'docker', registryId }).$promise;
+
+      case PortainerEndpointTypes.AgentOnKubernetesEnvironment:
+      case PortainerEndpointTypes.EdgeAgentOnKubernetesEnvironment:
+        return AgentDockerhub.limits({ endpointId: endpoint.Id, endpointType: 'kubernetes', registryId }).$promise;
+    }
+  }
+}
diff --git a/app/portainer/services/api/endpointService.js b/app/portainer/services/api/endpointService.js
new file mode 100644
index 0000000..b4ef12d
--- /dev/null
+++ b/app/portainer/services/api/endpointService.js
@@ -0,0 +1,173 @@
+import { PortainerEndpointCreationTypes } from '@/portainer/models/endpoint/models';
+
+angular.module('portainer.app').factory('EndpointService', [
+  '$q',
+  'Endpoints',
+  'FileUploadService',
+  function EndpointServiceFactory($q, Endpoints, FileUploadService) {
+    'use strict';
+    var service = {
+      updateSecuritySettings,
+      registries,
+      updateRegistryAccess,
+    };
+
+    service.endpoint = function (endpointID) {
+      return Endpoints.get({ id: endpointID }).$promise;
+    };
+
+    service.snapshotEndpoints = function () {
+      return Endpoints.snapshots({}, {}).$promise;
+    };
+
+    service.snapshotEndpoint = function (endpointID) {
+      return Endpoints.snapshot({ id: endpointID }, {}).$promise;
+    };
+
+    service.updateAccess = function (id, userAccessPolicies, teamAccessPolicies) {
+      return Endpoints.updateAccess({ id: id }, { UserAccessPolicies: userAccessPolicies, TeamAccessPolicies: teamAccessPolicies }).$promise;
+    };
+
+    service.disassociateEndpoint = function (endpointID) {
+      return Endpoints.disassociate({ id: endpointID }).$promise;
+    };
+
+    service.updateEndpoint = function (id, payload) {
+      var deferred = $q.defer();
+      FileUploadService.uploadTLSFilesForEndpoint(id, payload.TLSCACert, payload.TLSCert, payload.TLSKey)
+        .then(function success() {
+          deferred.notify({ upload: false });
+          return Endpoints.update({ id: id }, payload).$promise;
+        })
+        .then(function success(data) {
+          deferred.resolve(data);
+        })
+        .catch(function error(err) {
+          deferred.notify({ upload: false });
+          deferred.reject({ msg: 'Unable to update environment', err: err });
+        });
+      return deferred.promise;
+    };
+
+    service.deleteEndpoint = function (endpointID) {
+      return Endpoints.remove({ id: endpointID }).$promise;
+    };
+
+    service.createLocalEndpoint = function (name = 'local', URL = '', PublicURL = '', groupID = 1, tagIds = []) {
+      var deferred = $q.defer();
+
+      var endpointURL = URL;
+      if (endpointURL !== '') {
+        if (endpointURL.indexOf('//./pipe/') == 0) {
+          // Windows named pipe
+          endpointURL = 'npipe://' + URL;
+        } else {
+          endpointURL = 'unix://' + URL;
+        }
+      }
+
+      FileUploadService.createEndpoint(name, PortainerEndpointCreationTypes.LocalDockerEnvironment, endpointURL, PublicURL, groupID, tagIds, false)
+        .then(function success(response) {
+          deferred.resolve(response.data);
+        })
+        .catch(function error(err) {
+          deferred.reject({ msg: 'Unable to create environment', err: err });
+        });
+
+      return deferred.promise;
+    };
+
+    service.createRemoteEndpoint = function (
+      name,
+      creationType,
+      URL,
+      PublicURL,
+      groupID,
+      tagIds,
+      TLS,
+      TLSSkipVerify,
+      TLSSkipClientVerify,
+      TLSCAFile,
+      TLSCertFile,
+      TLSKeyFile,
+      checkinInterval
+    ) {
+      var deferred = $q.defer();
+
+      var endpointURL = URL;
+      if (creationType !== PortainerEndpointCreationTypes.EdgeAgentEnvironment) {
+        endpointURL = 'tcp://' + URL;
+      }
+
+      FileUploadService.createEndpoint(
+        name,
+        creationType,
+        endpointURL,
+        PublicURL,
+        groupID,
+        tagIds,
+        TLS,
+        TLSSkipVerify,
+        TLSSkipClientVerify,
+        TLSCAFile,
+        TLSCertFile,
+        TLSKeyFile,
+        checkinInterval
+      )
+        .then(function success(response) {
+          deferred.resolve(response.data);
+        })
+        .catch(function error(err) {
+          deferred.reject({ msg: 'Unable to create environment', err: err });
+        });
+
+      return deferred.promise;
+    };
+
+    service.createLocalKubernetesEndpoint = function (name = 'local', tagIds = []) {
+      var deferred = $q.defer();
+
+      FileUploadService.createEndpoint(name, PortainerEndpointCreationTypes.LocalKubernetesEnvironment, '', '', 1, tagIds, true, true, true)
+        .then(function success(response) {
+          deferred.resolve(response.data);
+        })
+        .catch(function error(err) {
+          deferred.reject({ msg: 'Unable to create environment', err: err });
+        });
+
+      return deferred.promise;
+    };
+
+    service.createAzureEndpoint = function (name, applicationId, tenantId, authenticationKey, groupId, tagIds) {
+      var deferred = $q.defer();
+
+      FileUploadService.createAzureEndpoint(name, applicationId, tenantId, authenticationKey, groupId, tagIds)
+        .then(function success(response) {
+          deferred.resolve(response.data);
+        })
+        .catch(function error(err) {
+          deferred.reject({ msg: 'Unable to connect to Azure', err: err });
+        });
+
+      return deferred.promise;
+    };
+
+    service.trust = function (id) {
+      Endpoints.updateEndpoint({ id }, { UserTrusted: true }).$promise;
+    };
+
+    function updateRegistryAccess(id, registryId, endpointAccesses) {
+      return Endpoints.updateRegistryAccess({ registryId, id }, endpointAccesses).$promise;
+    }
+
+    function registries(id, namespace) {
+      return Endpoints.registries({ namespace, id }).$promise;
+    }
+
+    return service;
+
+    function updateSecuritySettings(id, securitySettings) {
+      return Endpoints.updateSecuritySettings({ id }, securitySettings).$promise;
+    }
+  },
+]);
diff --git a/app/portainer/services/api/groupService.js b/app/portainer/services/api/groupService.js
new file mode 100644
index 0000000..acc823f
--- /dev/null
+++ b/app/portainer/services/api/groupService.js
@@ -0,0 +1,57 @@
+import { EndpointGroupCreateRequest, EndpointGroupModel, EndpointGroupUpdateRequest } from '../../models/group';
+
+angular.module('portainer.app').factory('GroupService', [
+  '$q',
+  'EndpointGroups',
+  function GroupService($q, EndpointGroups) {
+    'use strict';
+    var service = {};
+
+    service.group = function (groupId) {
+      var deferred = $q.defer();
+
+      EndpointGroups.get({ id: groupId })
+        .$promise.then(function success(data) {
+          var group = new EndpointGroupModel(data);
+          deferred.resolve(group);
+        })
+        .catch(function error(err) {
+          deferred.reject({ msg: 'Unable to retrieve group', err: err });
+        });
+
+      return deferred.promise;
+    };
+
+    service.groups = function () {
+      return EndpointGroups.query({}).$promise;
+    };
+
+    service.createGroup = function (model, endpoints) {
+      var payload = new EndpointGroupCreateRequest(model, endpoints);
+      return EndpointGroups.create(payload).$promise;
+    };
+
+    service.updateGroup = function (model, endpoints) {
+      var payload = new EndpointGroupUpdateRequest(model, endpoints);
+      return EndpointGroups.update(payload).$promise;
+    };
+
+    service.updateAccess = function (groupId, userAccessPolicies, teamAccessPolicies) {
+      return EndpointGroups.updateAccess({ id: groupId }, { UserAccessPolicies: userAccessPolicies, TeamAccessPolicies: teamAccessPolicies }).$promise;
+    };
+
+    service.addEndpoint = function (groupId, endpointId) {
+      return EndpointGroups.addEndpoint({ id: groupId, action: 'endpoints/' + endpointId }).$promise;
+    };
+
+    service.removeEndpoint = function (groupId, endpointId) {
+      return EndpointGroups.removeEndpoint({ id: groupId, action: 'endpoints/' + endpointId }).$promise;
+    };
+
+    service.deleteGroup = function (groupId) {
+      return EndpointGroups.remove({ id: groupId }).$promise;
+    };
+
+    return service;
+  },
+]);
diff --git a/app/portainer/services/api/index.ts b/app/portainer/services/api/index.ts
new file mode 100644
index 0000000..7caf483
--- /dev/null
+++ b/app/portainer/services/api/index.ts
@@ -0,0 +1,7 @@
+import angular from 'angular';
+
+import { UserService } from './userService';
+
+export const apiServicesModule = angular
+  .module('portainer.app.services.api', [])
+  .factory('UserService', UserService).name;
diff --git a/app/portainer/services/api/registryService.js b/app/portainer/services/api/registryService.js
new file mode 100644
index 0000000..a05401e
--- /dev/null
+++ b/app/portainer/services/api/registryService.js
@@ -0,0 +1,203 @@
+import _ from 'lodash-es';
+import { PorImageRegistryModel } from '@/docker/models/porImageRegistry';
+import { RegistryTypes } from '@/portainer/models/registryTypes';
+import { RegistryCreateRequest, RegistryViewModel } from '@/portainer/models/registry';
+import { DockerHubViewModel } from '@/portainer/models/dockerhub';
+
+angular.module('portainer.app').factory('RegistryService', [
+  '$q',
+  '$async',
+  'EndpointService',
+  'Registries',
+  'ImageHelper',
+  'FileUploadService',
+  function RegistryServiceFactory($q, $async, EndpointService, Registries, ImageHelper, FileUploadService) {
+    return {
+      registries,
+      registry,
+      encodedCredentials,
+      deleteRegistry,
+      updateRegistry,
+      configureRegistry,
+      createRegistry,
+      createGitlabRegistries,
+      retrievePorRegistryModelFromRepository,
+      retrievePorRegistryModelFromRepositoryWithRegistries,
+      loadRegistriesForDropdown,
+    };
+
+    function registries() {
+      var deferred = $q.defer();
+
+      Registries.query()
+        .$promise.then(function success(data) {
+          var registries = data.map(function (item) {
+            return new RegistryViewModel(item);
+          });
+          deferred.resolve(registries);
+        })
+        .catch(function error(err) {
+          deferred.reject({ msg: 'Unable to retrieve registries', err: err });
+        });
+
+      return deferred.promise;
+    }
+
+    function registry(id, endpointId) {
+      var deferred = $q.defer();
+
+      Registries.get({ id, endpointId })
+        .$promise.then(function success(data) {
+          var registry = new RegistryViewModel(data);
+          deferred.resolve(registry);
+        })
+        .catch(function error(err) {
+          deferred.reject({ msg: 'Unable to retrieve registry details', err: err });
+        });
+
+      return deferred.promise;
+    }
+
+    function encodedCredentials(registry) {
+      var credentials = {
+        registryId: registry.Id,
+      };
+      return btoa(JSON.stringify(credentials));
+    }
+
+    function deleteRegistry(id) {
+      return Registries.remove({ id: id }).$promise;
+    }
+
+    function updateRegistry(registry) {
+      registry.URL = _.replace(registry.URL, /^https?\:\/\//i, '');
+      registry.URL = _.replace(registry.URL, /\/$/, '');
+      return Registries.update({ id: registry.Id }, registry).$promise;
+    }
+
+    function configureRegistry(id, registryManagementConfigurationModel) {
+      return FileUploadService.configureRegistry(id, registryManagementConfigurationModel);
+    }
+
+    function createRegistry(model) {
+      var payload = new RegistryCreateRequest(model);
+      return Registries.create(payload).$promise;
+    }
+
+    /**
+     * @param {import('@/portainer/models/registry').RegistryCreateFormValues} model
+     * @param {Array<import('@/react/portainer/registries/types/gitlabProject').RegistryGitlabProject>} projects
+     */
+    function createGitlabRegistries(model, projects) {
+      const promises = [];
+      _.forEach(projects, (p) => {
+        const m = model;
+        m.Name = p.PathWithNamespace;
+        m.Gitlab.ProjectPath = _.toLower(p.PathWithNamespace);
+        m.Gitlab.ProjectId = p.Id;
+        m.Password = m.Token;
+        const payload = new RegistryCreateRequest(m);
+        promises.push(Registries.create(payload).$promise);
+      });
+      return $q.all(promises);
+    }
+
+    function getURL(reg) {
+      let url = reg.URL;
+      if (reg.Type === RegistryTypes.GITLAB) {
+        url = reg.URL + '/' + reg.Gitlab.ProjectPath;
+      } else if (reg.Type === RegistryTypes.QUAY) {
+        const name = reg.Quay.UseOrganisation ? reg.Quay.OrganisationName : reg.Username;
+        url = reg.URL + '/' + name;
+      }
+      return url;
+    }
+
+    // findBestMatchRegistry finds out the best match registry for repository
+    // matching precedence:
+    // 1. registryId matched
+    // 2. both domain name and username matched (for dockerhub only)
+    // 3. only URL matched
+    // 4. pick up the first dockerhub registry
+    function findBestMatchRegistry(repository, registries, registryId) {
+      let match2, match3, match4;
+
+      for (const registry of registries) {
+        if (registry.Id == registryId) {
+          return registry;
+        }
+
+        if (registry.Type === RegistryTypes.DOCKERHUB) {
+          // try to match repository examples:
+          //   <USERNAME>/nginx:latest
+          //   docker.io/<USERNAME>/nginx:latest
+          if (repository.startsWith(registry.Username + '/') || repository.startsWith(getURL(registry) + '/' + registry.Username + '/')) {
+            match2 = registry;
+          }
+
+          // try to match repository examples:
+          //   portainer/portainer-ee:latest
+          //   <NON-USERNAME>/portainer-ee:latest
+          match4 = match4 || registry;
+        }
+
+        if (repository.startsWith(getURL(registry))) {
+          match3 = registry;
+        }
+      }
+
+      return match2 || match3 || match4;
+    }
+
+    function retrievePorRegistryModelFromRepositoryWithRegistries(repository, registries, registryId) {
+      const model = new PorImageRegistryModel();
+      const registry = findBestMatchRegistry(repository, registries, registryId);
+      if (registry) {
+        const url = getURL(registry);
+        let lastIndex = repository.lastIndexOf(url);
+        lastIndex = lastIndex === -1 ? 0 : lastIndex + url.length;
+        let image = repository.substring(lastIndex);
+        if (_.startsWith(image, '/')) {
+          image = image.substring(1);
+        }
+        model.Registry = registry;
+        model.Image = image;
+      } else {
+        if (ImageHelper.imageContainsURL(repository)) {
+          model.UseRegistry = false;
+        }
+        model.Registry = new DockerHubViewModel();
+        model.Image = repository;
+      }
+      return model;
+    }
+
+    function retrievePorRegistryModelFromRepository(repository, endpointId, registryId, namespace) {
+      return $async(async () => {
+        try {
+          const regs = await EndpointService.registries(endpointId, namespace);
+          return retrievePorRegistryModelFromRepositoryWithRegistries(repository, regs, registryId);
+        } catch (err) {
+          throw { msg: 'Unable to retrieve the registry associated to the repository', err: err };
+        }
+      });
+    }
+
+    function loadRegistriesForDropdown(endpointId, namespace) {
+      return $async(async () => {
+        try {
+          const registries = await EndpointService.registries(endpointId, namespace);
+
+          // hide default(anonymous) dockerhub registry if user has an authenticated one
+          if (!registries.some((registry) => registry.Type === RegistryTypes.DOCKERHUB)) {
+            registries.push(new DockerHubViewModel());
+          }
+
+          return registries;
+        } catch (err) {
+          throw { msg: 'Unable to retrieve the registries', err: err };
+        }
+      });
+    }
+  },
+]);
diff --git a/app/portainer/services/api/resourceControlService.js b/app/portainer/services/api/resourceControlService.js
new file mode 100644
index 0000000..50408d4
--- /dev/null
+++ b/app/portainer/services/api/resourceControlService.js
@@ -0,0 +1,100 @@
+angular.module('portainer.app').factory('ResourceControlService', [
+  '$q',
+  'ResourceControl',
+  'UserService',
+  'TeamService',
+  'ResourceControlHelper',
+  function ResourceControlServiceFactory($q, ResourceControl, UserService, TeamService, ResourceControlHelper) {
+    'use strict';
+    const service = {};
+
+    service.duplicateResourceControl = duplicateResourceControl;
+    service.applyResourceControl = applyResourceControl;
+    service.retrieveOwnershipDetails = retrieveOwnershipDetails;
+
+    /**
+     * PRIVATE SECTION
+     */
+
+    /**
+     * Update a ResourceControl
+     * @param {String} rcID ID of involved resource
+     * @param {ResourceControlOwnershipParameters} ownershipParameters Transcient type from view data to payload
+     */
+    function updateResourceControl(rcID, ownershipParameters) {
+      const payload = {
+        AdministratorsOnly: ownershipParameters.AdministratorsOnly,
+        Public: ownershipParameters.Public,
+        Users: ownershipParameters.Users,
+        Teams: ownershipParameters.Teams,
+      };
+
+      return ResourceControl.update({ id: rcID }, payload).$promise;
+    }
+
+    /**
+     * END PRIVATE SECTION
+     */
+
+    /**
+     * PUBLIC SECTION
+     */
+
+    /**
+     * Apply a ResourceControl after Resource creation
+     * @param {int} userId ID of User performing the action
+     * @param {AccessControlFormData} accessControlData ResourceControl to apply
+     * @param {ResourceControlViewModel} resourceControl ResourceControl to update
+     * @param {[]int} subResources SubResources managed by the ResourceControl
+     */
+    function applyResourceControl(userId, accessControlData, resourceControl, subResources = []) {
+      const ownershipParameters = ResourceControlHelper.RCFormDataToOwnershipParameters(userId, accessControlData, subResources);
+      return updateResourceControl(resourceControl.Id, ownershipParameters);
+    }
+
+    /**
+     * Duplicate an existing ResourceControl (default to AdministratorsOnly if undefined)
+     * @param {int} userId ID of User performing the action
+     * @param {ResourceControlViewModel} oldResourceControl ResourceControl to duplicate
+     * @param {ResourceControlViewModel} newResourceControl ResourceControl to apply duplication to
+     */
+    function duplicateResourceControl(userId, oldResourceControl, newResourceControl) {
+      const ownershipParameters = ResourceControlHelper.RCViewModelToOwnershipParameters(userId, oldResourceControl);
+      return updateResourceControl(newResourceControl.Id, ownershipParameters);
+    }
+
+    /**
+     * Retrieve users and team details for ResourceControlViewModel
+     * @param {ResourceControlViewModel} resourceControl ResourceControl view model
+     */
+    function retrieveOwnershipDetails(resourceControl) {
+      var deferred = $q.defer();
+
+      if (!resourceControl) {
+        deferred.resolve({ authorizedUsers: [], authorizedTeams: [] });
+        return deferred.promise;
+      }
+
+      $q.all({
+        users: resourceControl.UserAccesses.length > 0 ? UserService.users(false) : [],
+        teams: resourceControl.TeamAccesses.length > 0 ? TeamService.teams() : [],
+      })
+        .then(function success(data) {
+          var authorizedUsers = ResourceControlHelper.retrieveAuthorizedUsers(resourceControl, data.users);
+          var authorizedTeams = ResourceControlHelper.retrieveAuthorizedTeams(resourceControl, data.teams);
+          deferred.resolve({ authorizedUsers: authorizedUsers, authorizedTeams: authorizedTeams });
+        })
+        .catch(function error(err) {
+          deferred.reject({ msg: 'Unable to retrieve user and team information', err: err });
+        });
+
+      return deferred.promise;
+    }
+
+    /**
+     * END PUBLIC SECTION
+     */
+
+    return service;
+  },
+]);
diff --git a/app/portainer/services/api/settingsService.js b/app/portainer/services/api/settingsService.js
new file mode 100644
index 0000000..1933c0b
--- /dev/null
+++ b/app/portainer/services/api/settingsService.js
@@ -0,0 +1,50 @@
+import { SettingsViewModel, PublicSettingsViewModel } from '../../models/settings';
+
+angular.module('portainer.app').factory('SettingsService', [
+  '$q',
+  'Settings',
+  function SettingsServiceFactory($q, Settings) {
+    'use strict';
+    var service = {};
+
+    service.settings = function () {
+      var deferred = $q.defer();
+
+      Settings.get()
+        .$promise.then(function success(data) {
+          var settings = new SettingsViewModel(data);
+          deferred.resolve(settings);
+        })
+        .catch(function error(err) {
+          deferred.reject({ msg: 'Unable to retrieve application settings', err: err });
+        });
+
+      return deferred.promise;
+    };
+
+    service.update = function (settings) {
+      return Settings.update({}, settings).$promise;
+    };
+
+    service.publicSettings = function () {
+      var deferred = $q.defer();
+
+      Settings.publicSettings()
+        .$promise.then(function success(data) {
+          var settings = new PublicSettingsViewModel(data);
+          deferred.resolve(settings);
+        })
+        .catch(function error(err) {
+          deferred.reject({ msg: 'Unable to retrieve application settings', err: err });
+        });
+
+      return deferred.promise;
+    };
+
+    service.checkLDAPConnectivity = function (settings) {
+      return Settings.checkLDAPConnectivity({}, settings).$promise;
+    };
+
+    return service;
+  },
+]);
diff --git a/app/portainer/services/api/sslService.js b/app/portainer/services/api/sslService.js
new file mode 100644
index 0000000..387b289
--- /dev/null
+++ b/app/portainer/services/api/sslService.js
@@ -0,0 +1,19 @@
+import angular from 'angular';
+
+angular.module('portainer.app').service('SSLService', SSLServiceFactory);
+
+/* @ngInject */
+function SSLServiceFactory(SSL) {
+  return {
+    upload,
+    get,
+  };
+
+  function get() {
+    return SSL.get().$promise;
+  }
+
+  function upload(SSLPayload) {
+    return SSL.upload(SSLPayload).$promise;
+  }
+}
diff --git a/app/portainer/services/api/stackService.js b/app/portainer/services/api/stackService.js
new file mode 100644
index 0000000..22a228c
--- /dev/null
+++ b/app/portainer/services/api/stackService.js
@@ -0,0 +1,446 @@
+import _ from 'lodash-es';
+import { transformAutoUpdateViewModel } from '@/react/portainer/gitops/AutoUpdateFieldset/utils';
+import { StackViewModel } from '@/react/docker/stacks/view-models/stack';
+
+angular.module('portainer.app').factory('StackService', [
+  '$q',
+  '$async',
+  'Stack',
+  'StackByName',
+  'FileUploadService',
+  'StackHelper',
+  'ServiceService',
+  'ContainerService',
+  'SwarmService',
+  function StackServiceFactory($q, $async, Stack, StackByName, FileUploadService, StackHelper, ServiceService, ContainerService, SwarmService) {
+    'use strict';
+    var service = {
+      updateGit,
+      updateKubeGit,
+    };
+
+    service.stack = function (id) {
+      var deferred = $q.defer();
+
+      Stack.get({ id: id })
+        .$promise.then(function success(data) {
+          var stack = new StackViewModel(data);
+          deferred.resolve(stack);
+        })
+        .catch(function error(err) {
+          deferred.reject({ msg: 'Unable to retrieve stack details', err: err });
+        });
+
+      return deferred.promise;
+    };
+
+    service.getStackFile = function (id) {
+      var deferred = $q.defer();
+
+      Stack.getStackFile({ id: id })
+        .$promise.then(function success(data) {
+          deferred.resolve(data.StackFileContent);
+        })
+        .catch(function error(err) {
+          deferred.reject({ msg: 'Unable to retrieve stack content', err: err });
+        });
+
+      return deferred.promise;
+    };
+
+    service.stacks = function (compose, swarm, endpointId, includeOrphanedStacks = false) {
+      var deferred = $q.defer();
+
+      var queries = [];
+      if (compose) {
+        queries.push(service.composeStacks(endpointId, true, { EndpointID: endpointId, IncludeOrphanedStacks: includeOrphanedStacks }));
+      }
+      if (swarm) {
+        queries.push(service.swarmStacks(endpointId, true, { IncludeOrphanedStacks: includeOrphanedStacks }));
+      }
+
+      $q.all(queries)
+        .then(function success(data) {
+          var stacks = [];
+          if (data[0]) {
+            stacks = stacks.concat(data[0]);
+          }
+          if (data[1]) {
+            stacks = stacks.concat(data[1]);
+          }
+          deferred.resolve(stacks);
+        })
+        .catch(function error(err) {
+          deferred.reject({ msg: 'Unable to retrieve stacks', err: err });
+        });
+
+      return deferred.promise;
+    };
+
+    service.externalSwarmStacks = function () {
+      var deferred = $q.defer();
+
+      ServiceService.services()
+        .then(function success(services) {
+          deferred.resolve(StackHelper.getExternalStacksFromServices(services));
+        })
+        .catch(function error(err) {
+          deferred.reject({ msg: 'Unable to retrieve external stacks', err: err });
+        });
+
+      return deferred.promise;
+    };
+
+    service.externalComposeStacks = function (environmentId) {
+      var deferred = $q.defer();
+
+      ContainerService.containers(environmentId, 1)
+        .then(function success(containers) {
+          deferred.resolve(StackHelper.getExternalStacksFromContainers(containers));
+        })
+        .catch(function error(err) {
+          deferred.reject({ msg: 'Unable to retrieve external stacks', err: err });
+        });
+
+      return deferred.promise;
+    };
+
+    service.unionStacks = function (stacks, externalStacks) {
+      stacks.forEach((stack) => {
+        externalStacks.forEach((externalStack) => {
+          if (stack.Orphaned && stack.Name == externalStack.Name) {
+            stack.OrphanedRunning = true;
+          }
+        });
+      });
+      const result = _.unionWith(stacks, externalStacks, function (a, b) {
+        return a.Name === b.Name;
+      });
+
+      return result;
+    };
+
+    service.composeStacks = function (endpointId, includeExternalStacks, filters) {
+      var deferred = $q.defer();
+
+      $q.all({
+        stacks: Stack.query({ filters: filters }).$promise,
+        externalStacks: includeExternalStacks ? service.externalComposeStacks(endpointId) : [],
+      })
+        .then(function success(data) {
+          var stacks = data.stacks.map(function (item) {
+            return new StackViewModel(item, item.EndpointId != endpointId);
+          });
+
+          var externalStacks = data.externalStacks;
+          const result = service.unionStacks(stacks, externalStacks);
+          deferred.resolve(result);
+        })
+        .catch(function error(err) {
+          deferred.reject({ msg: 'Unable to retrieve stacks', err: err });
+        });
+
+      return deferred.promise;
+    };
+
+    service.swarmStacks = function (endpointId, includeExternalStacks, filters = {}) {
+      var deferred = $q.defer();
+
+      SwarmService.swarm(endpointId)
+        .then(function success(data) {
+          var swarm = data;
+          filters = { SwarmID: swarm.ID, ...filters };
+
+          return $q.all({
+            stacks: Stack.query({ filters: filters }).$promise,
+            externalStacks: includeExternalStacks ? service.externalSwarmStacks() : [],
+          });
+        })
+        .then(function success(data) {
+          var stacks = data.stacks.map(function (item) {
+            return new StackViewModel(item, item.EndpointId != endpointId);
+          });
+
+          var externalStacks = data.externalStacks;
+          const result = service.unionStacks(stacks, externalStacks);
+          deferred.resolve(result);
+        })
+        .catch(function error(err) {
+          deferred.reject({ msg: 'Unable to retrieve stacks', err: err });
+        });
+
+      return deferred.promise;
+    };
+
+    service.remove = function (stack, external, endpointId) {
+      var deferred = $q.defer();
+
+      Stack.remove({ id: stack.Id ? stack.Id : stack.Name, external: external, endpointId: endpointId })
+        .$promise.then(function success() {
+          deferred.resolve();
+        })
+        .catch(function error(err) {
+          deferred.reject({ msg: 'Unable to remove the stack', err: err });
+        });
+
+      return deferred.promise;
+    };
+
+    service.removeKubernetesStacksByName = function (name, namespace, external, endpointId) {
+      var deferred = $q.defer();
+      StackByName.remove({ name: name, external: external, endpointId: endpointId, namespace: namespace })
+        .$promise.then(function success() {
+          deferred.resolve();
+        })
+        .catch(function error(err) {
+          deferred.reject({ msg: 'Unable to remove the stack', err: err });
+        });
+
+      return deferred.promise;
+    };
+
+    service.associate = function (stack, endpointId, orphanedRunning) {
+      var deferred = $q.defer();
+
+      if (stack.Type == 1) {
+        SwarmService.swarm(endpointId)
+          .then(function success(data) {
+            const swarm = data;
+            return Stack.associate({ id: stack.Id, endpointId: endpointId, swarmId: swarm.ID, orphanedRunning }).$promise;
+          })
+          .then(function success(data) {
+            deferred.resolve(data);
+          })
+          .catch(function error(err) {
+            deferred.reject({ msg: 'Unable to associate the stack', err: err });
+          });
+      } else {
+        Stack.associate({ id: stack.Id, endpointId: endpointId, orphanedRunning })
+          .$promise.then(function success(data) {
+            deferred.resolve(data);
+          })
+          .catch(function error(err) {
+            deferred.reject({ msg: 'Unable to associate the stack', err: err });
+          });
+      }
+
+      return deferred.promise;
+    };
+
+    service.updateStack = function (stack, stackFile, env, prune, repullImageAndRedeploy) {
+      return Stack.update(
+        { endpointId: stack.EndpointId },
+        {
+          id: stack.Id,
+          StackFileContent: stackFile,
+          Env: env,
+          Prune: prune,
+          RepullImageAndRedeploy: repullImageAndRedeploy,
+        }
+      ).$promise;
+    };
+
+    service.updateKubeStack = function (stack, { stackFile, gitConfig, webhookId, stackName }) {
+      let payload = {};
+
+      if (stackFile) {
+        payload = {
+          StackFileContent: stackFile,
+          StackName: stackName,
+        };
+      } else {
+        payload = {
+          AutoUpdate: transformAutoUpdateViewModel(gitConfig.AutoUpdate, webhookId),
+          RepositoryReferenceName: gitConfig.RefName,
+          RepositoryAuthentication: gitConfig.RepositoryAuthentication,
+          RepositoryUsername: gitConfig.RepositoryUsername,
+          RepositoryPassword: gitConfig.RepositoryPassword,
+          TLSSkipVerify: gitConfig.TLSSkipVerify,
+        };
+      }
+
+      return Stack.update({ id: stack.Id, endpointId: stack.EndpointId }, payload).$promise;
+    };
+
+    service.createComposeStackFromFileUpload = function (name, stackFile, env, endpointId) {
+      return FileUploadService.createComposeStack(name, stackFile, env, endpointId);
+    };
+
+    service.createSwarmStackFromFileUpload = function (name, stackFile, env, endpointId) {
+      var deferred = $q.defer();
+
+      SwarmService.swarm(endpointId)
+        .then(function success(data) {
+          var swarm = data;
+          return FileUploadService.createSwarmStack(name, swarm.ID, stackFile, env, endpointId);
+        })
+        .then(function success(data) {
+          deferred.resolve(data.data);
+        })
+        .catch(function error(err) {
+          deferred.reject({ msg: 'Unable to create the stack', err: err });
+        });
+
+      return deferred.promise;
+    };
+    service.createComposeStackFromFileContent = function (name, stackFileContent, env, endpointId) {
+      var payload = {
+        Name: name,
+        StackFileContent: stackFileContent,
+        Env: env,
+      };
+      return Stack.create({ endpointId: endpointId }, { method: 'string', type: 'standalone', ...payload }).$promise;
+    };
+
+    service.createSwarmStackFromFileContent = function (name, stackFileContent, env, endpointId) {
+      var deferred = $q.defer();
+
+      SwarmService.swarm(endpointId)
+        .then(function success(swarm) {
+          var payload = {
+            Name: name,
+            SwarmID: swarm.ID,
+            StackFileContent: stackFileContent,
+            Env: env,
+          };
+          return Stack.create({ endpointId: endpointId }, { method: 'string', type: 'swarm', ...payload }).$promise;
+        })
+        .then(function success(data) {
+          deferred.resolve(data);
+        })
+        .catch(function error(err) {
+          deferred.reject({ msg: 'Unable to create the stack', err: err });
+        });
+
+      return deferred.promise;
+    };
+
+    service.createComposeStackFromGitRepository = function (name, repositoryOptions, env, endpointId) {
+      var payload = {
+        Name: name,
+        RepositoryURL: repositoryOptions.RepositoryURL,
+        RepositoryReferenceName: repositoryOptions.RepositoryReferenceName,
+        ComposeFile: repositoryOptions.ComposeFilePathInRepository,
+        AdditionalFiles: repositoryOptions.AdditionalFiles,
+        RepositoryAuthentication: repositoryOptions.RepositoryAuthentication,
+        RepositoryUsername: repositoryOptions.RepositoryUsername,
+        RepositoryPassword: repositoryOptions.RepositoryPassword,
+        Env: env,
+        FromAppTemplate: repositoryOptions.FromAppTemplate,
+        TLSSkipVerify: repositoryOptions.TLSSkipVerify,
+      };
+
+      if (repositoryOptions.AutoUpdate) {
+        payload.AutoUpdate = repositoryOptions.AutoUpdate;
+      }
+
+      return Stack.create({ endpointId: endpointId }, { method: 'repository', type: 'standalone', ...payload }).$promise;
+    };
+
+    service.createSwarmStackFromGitRepository = function (name, repositoryOptions, env, endpointId) {
+      var deferred = $q.defer();
+
+      SwarmService.swarm(endpointId)
+        .then(function success(data) {
+          var swarm = data;
+          var payload = {
+            Name: name,
+            SwarmID: swarm.ID,
+            RepositoryURL: repositoryOptions.RepositoryURL,
+            RepositoryReferenceName: repositoryOptions.RepositoryReferenceName,
+            ComposeFile: repositoryOptions.ComposeFilePathInRepository,
+            AdditionalFiles: repositoryOptions.AdditionalFiles,
+            RepositoryAuthentication: repositoryOptions.RepositoryAuthentication,
+            RepositoryUsername: repositoryOptions.RepositoryUsername,
+            RepositoryPassword: repositoryOptions.RepositoryPassword,
+            Env: env,
+            FromAppTemplate: repositoryOptions.FromAppTemplate,
+            TLSSkipVerify: repositoryOptions.TLSSkipVerify,
+          };
+
+          if (repositoryOptions.AutoUpdate) {
+            payload.AutoUpdate = repositoryOptions.AutoUpdate;
+          }
+
+          return Stack.create({ endpointId: endpointId }, { method: 'repository', type: 'swarm', ...payload }).$promise;
+        })
+        .then(function success(data) {
+          deferred.resolve(data);
+        })
+        .catch(function error(err) {
+          deferred.reject({ msg: 'Unable to create the stack', err: err });
+        });
+
+      return deferred.promise;
+    };
+
+    async function kubernetesDeployAsync(endpointId, method, payload) {
+      try {
+        await Stack.create({ endpointId: endpointId }, { method, type: 'kubernetes', ...payload }).$promise;
+      } catch (err) {
+        throw { err: err };
+      }
+    }
+
+    service.kubernetesDeploy = function (endpointId, method, payload) {
+      return $async(kubernetesDeployAsync, endpointId, method, payload);
+    };
+
+    service.start = start;
+    function start(endpointId, id) {
+      return Stack.start({ id, endpointId }).$promise;
+    }
+
+    service.stop = stop;
+    function stop(endpointId, id) {
+      return Stack.stop({ endpointId, id }).$promise;
+    }
+
+    function updateGit(id, endpointId, env, prune, gitConfig, pullImage) {
+      return Stack.updateGit(
+        { endpointId, id },
+        {
+          env,
+          prune,
+          RepositoryReferenceName: gitConfig.RefName,
+          RepositoryAuthentication: gitConfig.RepositoryAuthentication,
+          RepositoryUsername: gitConfig.RepositoryUsername,
+          RepositoryPassword: gitConfig.RepositoryPassword,
+          PullImage: pullImage,
+        }
+      ).$promise;
+    }
+
+    function updateKubeGit(id, endpointId, namespace, gitConfig) {
+      return Stack.updateGit(
+        { endpointId, id },
+        {
+          Namespace: namespace,
+          RepositoryReferenceName: gitConfig.RefName,
+          RepositoryAuthentication: gitConfig.RepositoryAuthentication,
+          RepositoryUsername: gitConfig.RepositoryUsername,
+          RepositoryPassword: gitConfig.RepositoryPassword,
+          StackName: gitConfig.StackName,
+        }
+      ).$promise;
+    }
+
+    service.updateGitStackSettings = function (id, endpointId, env, gitConfig, webhookId) {
+      return Stack.updateGitStackSettings(
+        { endpointId, id },
+        {
+          AutoUpdate: transformAutoUpdateViewModel(gitConfig.AutoUpdate, webhookId),
+          Env: env,
+          RepositoryReferenceName: gitConfig.RefName,
+          RepositoryAuthentication: gitConfig.RepositoryAuthentication,
+          RepositoryUsername: gitConfig.RepositoryUsername,
+          RepositoryPassword: gitConfig.RepositoryPassword,
+          Prune: gitConfig.Option.Prune,
+          TLSSkipVerify: gitConfig.TLSSkipVerify,
+        }
+      ).$promise;
+    };
+
+    return service;
+  },
+]);
diff --git a/app/portainer/services/api/statusService.js b/app/portainer/services/api/statusService.js
new file mode 100644
index 0000000..a91d71f
--- /dev/null
+++ b/app/portainer/services/api/statusService.js
@@ -0,0 +1,27 @@
+import { getSystemStatus } from '@/react/portainer/system/useSystemStatus';
+import { StatusViewModel } from '../../models/status';
+
+angular.module('portainer.app').factory('StatusService', StatusServiceFactory);
+
+/* @ngInject */
+function StatusServiceFactory($q) {
+  'use strict';
+  var service = {};
+
+  service.status = function () {
+    var deferred = $q.defer();
+
+    getSystemStatus()
+      .then(function success(data) {
+        var status = new StatusViewModel(data);
+        deferred.resolve(status);
+      })
+      .catch(function error(err) {
+        deferred.reject({ msg: 'Unable to retrieve application status', err: err });
+      });
+
+    return deferred.promise;
+  };
+
+  return service;
+}
diff --git a/app/portainer/services/api/supportService.js b/app/portainer/services/api/supportService.js
new file mode 100644
index 0000000..00a3c1d
--- /dev/null
+++ b/app/portainer/services/api/supportService.js
@@ -0,0 +1,24 @@
+angular.module('portainer.app').factory('SupportService', [
+  '$q',
+  'Support',
+  function SupportServiceFactory($q, Support) {
+    'use strict';
+    var service = {};
+
+    service.supportProducts = function () {
+      var deferred = $q.defer();
+
+      Support.get()
+        .$promise.then(function success(data) {
+          deferred.resolve(data);
+        })
+        .catch(function error(err) {
+          deferred.reject({ msg: 'Unable to retrieve support options', err: err });
+        });
+
+      return deferred.promise;
+    };
+
+    return service;
+  },
+]);
diff --git a/app/portainer/services/api/tagService.js b/app/portainer/services/api/tagService.js
new file mode 100644
index 0000000..ccc4551
--- /dev/null
+++ b/app/portainer/services/api/tagService.js
@@ -0,0 +1,64 @@
+import { TagViewModel } from '../../models/tag';
+
+angular.module('portainer.app').factory('TagService', [
+  '$q',
+  '$async',
+  'Tags',
+  function TagServiceFactory($q, $async, Tags) {
+    'use strict';
+    var service = {};
+
+    service.tags = function () {
+      var deferred = $q.defer();
+      Tags.query()
+        .$promise.then(function success(data) {
+          var tags = data.map(function (item) {
+            return new TagViewModel(item);
+          });
+          deferred.resolve(tags);
+        })
+        .catch(function error(err) {
+          deferred.reject({ msg: 'Unable to retrieve tags', err: err });
+        });
+      return deferred.promise;
+    };
+
+    service.tagNames = function () {
+      var deferred = $q.defer();
+      Tags.query()
+        .$promise.then(function success(data) {
+          var tags = data.map(function (item) {
+            return item.Name;
+          });
+          deferred.resolve(tags);
+        })
+        .catch(function error(err) {
+          deferred.reject({ msg: 'Unable to retrieve tags', err: err });
+        });
+      return deferred.promise;
+    };
+
+    async function createTagAsync(name) {
+      var payload = {
+        Name: name,
+      };
+      try {
+        const tag = await Tags.create({}, payload).$promise;
+        return new TagViewModel(tag);
+      } catch (err) {
+        throw { msg: 'Unable to create tag', err };
+      }
+    }
+
+    function createTag(name) {
+      return $async(createTagAsync, name);
+    }
+    service.createTag = createTag;
+
+    service.deleteTag = function (id) {
+      return Tags.remove({ id: id }).$promise;
+    };
+
+    return service;
+  },
+]);
diff --git a/app/portainer/services/api/teamMembershipService.js b/app/portainer/services/api/teamMembershipService.js
new file mode 100644
index 0000000..b2d74d5
--- /dev/null
+++ b/app/portainer/services/api/teamMembershipService.js
@@ -0,0 +1,49 @@
+import { TeamMembershipModel } from '../../models/teamMembership';
+
+angular.module('portainer.app').factory('TeamMembershipService', [
+  '$q',
+  'TeamMemberships',
+  function TeamMembershipFactory($q, TeamMemberships) {
+    'use strict';
+    var service = {};
+
+    service.memberships = function () {
+      var deferred = $q.defer();
+      TeamMemberships.query()
+        .$promise.then(function success(data) {
+          var memberships = data.map(function (item) {
+            return new TeamMembershipModel(item);
+          });
+          deferred.resolve(memberships);
+        })
+        .catch(function error(err) {
+          deferred.reject({ msg: 'Unable to retrieve team memberships', err: err });
+        });
+      return deferred.promise;
+    };
+
+    service.createMembership = function (userId, teamId, role) {
+      var payload = {
+        UserID: userId,
+        TeamID: teamId,
+        Role: role,
+      };
+      return TeamMemberships.create({}, payload).$promise;
+    };
+
+    service.deleteMembership = function (id) {
+      return TeamMemberships.remove({ id: id }).$promise;
+    };
+
+    service.updateMembership = function (id, userId, teamId, role) {
+      var payload = {
+        UserID: userId,
+        TeamID: teamId,
+        Role: role,
+      };
+      return TeamMemberships.update({ id: id }, payload).$promise;
+    };
+
+    return service;
+  },
+]);
diff --git a/app/portainer/services/api/teamService.js b/app/portainer/services/api/teamService.js
new file mode 100644
index 0000000..b42ffca
--- /dev/null
+++ b/app/portainer/services/api/teamService.js
@@ -0,0 +1,76 @@
+import { TeamViewModel } from '../../models/team';
+import { TeamMembershipModel } from '../../models/teamMembership';
+
+angular.module('portainer.app').factory('TeamService', [
+  '$q',
+  'Teams',
+  function TeamServiceFactory($q, Teams) {
+    'use strict';
+    var service = {};
+
+    service.teams = function (environmentId) {
+      var deferred = $q.defer();
+      Teams.query({ environmentId: environmentId })
+        .$promise.then(function success(data) {
+          var teams = data.map(function (item) {
+            return new TeamViewModel(item);
+          });
+          deferred.resolve(teams);
+        })
+        .catch(function error(err) {
+          deferred.reject({ msg: 'Unable to retrieve teams', err: err });
+        });
+      return deferred.promise;
+    };
+
+    service.team = function (id) {
+      var deferred = $q.defer();
+      Teams.get({ id: id })
+        .$promise.then(function success(data) {
+          var team = new TeamViewModel(data);
+          deferred.resolve(team);
+        })
+        .catch(function error(err) {
+          deferred.reject({ msg: 'Unable to retrieve team details', err: err });
+        });
+      return deferred.promise;
+    };
+
+    service.createTeam = function (name, leaderIds) {
+      var deferred = $q.defer();
+      var payload = {
+        Name: name,
+        TeamLeaders: leaderIds,
+      };
+      Teams.create({}, payload)
+        .$promise.then(function success() {
+          deferred.resolve();
+        })
+        .catch(function error(err) {
+          deferred.reject({ msg: 'Unable to create team', err: err });
+        });
+      return deferred.promise;
+    };
+
+    service.deleteTeam = function (id) {
+      return Teams.remove({ id: id }).$promise;
+    };
+
+    service.userMemberships = function (id) {
+      var deferred = $q.defer();
+      Teams.queryMemberships({ id: id })
+        .$promise.then(function success(data) {
+          var memberships = data.map(function (item) {
+            return new TeamMembershipModel(item);
+          });
+          deferred.resolve(memberships);
+        })
+        .catch(function error(err) {
+          deferred.reject({ msg: 'Unable to retrieve user memberships for the team', err: err });
+        });
+      return deferred.promise;
+    };
+
+    return service;
+  },
+]);
diff --git a/app/portainer/services/api/templateService.js b/app/portainer/services/api/templateService.js
new file mode 100644
index 0000000..2a40752
--- /dev/null
+++ b/app/portainer/services/api/templateService.js
@@ -0,0 +1,48 @@
+import { TemplateViewModel } from '@/react/portainer/templates/app-templates/view-model';
+import { DockerHubViewModel } from '@/portainer/models/dockerhub';
+
+angular.module('portainer.app').factory('TemplateService', TemplateServiceFactory);
+
+/* @ngInject */
+function TemplateServiceFactory($q, Templates, EndpointService) {
+  var service = {
+    templates,
+  };
+
+  function templates(endpointId) {
+    const deferred = $q.defer();
+
+    $q.all({
+      templates: Templates.query().$promise,
+      registries: EndpointService.registries(endpointId),
+    })
+      .then(function success({ templates, registries }) {
+        const version = templates.version;
+        deferred.resolve(
+          templates.templates.map((item) => {
+            try {
+              const template = new TemplateViewModel(item, version);
+              const registryURL = template.RegistryModel.Registry.URL;
+              const registry = registryURL ? registries.find((reg) => reg.URL === registryURL) : new DockerHubViewModel();
+              template.RegistryModel.Registry = registry;
+              return template;
+            } catch (err) {
+              deferred.reject({ msg: 'Unable to retrieve templates', err: err });
+            }
+          })
+        );
+      })
+      .catch(function error(err) {
+        deferred.reject({ msg: 'Unable to retrieve templates', err: err });
+      });
+
+    return deferred.promise;
+  }
+
+  service.templateFile = templateFile;
+  function templateFile(repositoryUrl, composeFilePathInRepository) {
+    return Templates.file({ repositoryUrl, composeFilePathInRepository }).$promise;
+  }
+
+  return service;
+}
diff --git a/app/portainer/services/api/userService.js b/app/portainer/services/api/userService.js
new file mode 100644
index 0000000..2d1102f
--- /dev/null
+++ b/app/portainer/services/api/userService.js
@@ -0,0 +1,113 @@
+import _ from 'lodash-es';
+import { UserViewModel } from '@/portainer/models/user';
+import { getUsers } from '@/portainer/users/user.service';
+import { getUser } from '@/portainer/users/queries/useUser';
+import { userAdminInit } from '@api/sdk.gen';
+
+import { TeamMembershipModel } from '../../models/teamMembership';
+
+/* @ngInject */
+export function UserService($q, Users, TeamService) {
+  'use strict';
+  var service = {};
+
+  service.users = async function (includeAdministrators, environmentId) {
+    const users = await getUsers(includeAdministrators, environmentId);
+
+    return users.map((u) => new UserViewModel(u));
+  };
+
+  service.user = async function (userId) {
+    const user = await getUser(userId);
+
+    return new UserViewModel(user);
+  };
+
+  service.deleteUser = function (id) {
+    return Users.remove({ id: id }).$promise;
+  };
+
+  service.updateUser = function (id, { newPassword, role, username }) {
+    return Users.update({ id }, { newPassword, role, username }).$promise;
+  };
+
+  service.updateUserPassword = function (id, currentPassword, newPassword) {
+    var payload = {
+      Password: currentPassword,
+      NewPassword: newPassword,
+    };
+
+    return Users.updatePassword({ id: id }, payload).$promise;
+  };
+
+  service.updateUserTheme = function (id, theme) {
+    return Users.updateTheme({ id }, { theme }).$promise;
+  };
+
+  service.userMemberships = function (id) {
+    var deferred = $q.defer();
+
+    Users.queryMemberships({ id: id })
+      .$promise.then(function success(data) {
+        var memberships = data.map(function (item) {
+          return new TeamMembershipModel(item);
+        });
+        deferred.resolve(memberships);
+      })
+      .catch(function error(err) {
+        deferred.reject({ msg: 'Unable to retrieve user memberships', err: err });
+      });
+
+    return deferred.promise;
+  };
+
+  service.userLeadingTeams = function (id) {
+    var deferred = $q.defer();
+
+    $q.all({
+      teams: TeamService.teams(),
+      memberships: service.userMemberships(id),
+    })
+      .then(function success(data) {
+        var memberships = data.memberships;
+        var teams = data.teams.filter(function (team) {
+          var membership = _.find(memberships, { TeamId: team.Id });
+          if (membership && membership.Role === 1) {
+            return team;
+          }
+        });
+        deferred.resolve(teams);
+      })
+      .catch(function error(err) {
+        deferred.reject({ msg: 'Unable to retrieve user teams', err: err });
+      });
+
+    return deferred.promise;
+  };
+
+  service.initAdministrator = function (username, password, setupToken) {
+    return userAdminInit({
+      body: { Username: username, Password: password },
+      ...(setupToken && { headers: { 'X-Setup-Token': setupToken } }),
+    });
+  };
+
+  service.administratorExists = function () {
+    var deferred = $q.defer();
+
+    Users.checkAdminUser({})
+      .$promise.then(function success() {
+        deferred.resolve(true);
+      })
+      .catch(function error(err) {
+        if (err.status === 404) {
+          deferred.resolve(false);
+        }
+        deferred.reject({ msg: 'Unable to verify administrator account existence', err: err });
+      });
+
+    return deferred.promise;
+  };
+
+  return service;
+}
diff --git a/app/portainer/services/api/webhookService.js b/app/portainer/services/api/webhookService.js
new file mode 100644
index 0000000..b615be7
--- /dev/null
+++ b/app/portainer/services/api/webhookService.js
@@ -0,0 +1,42 @@
+import { WebhookViewModel } from '../../models/webhook';
+
+angular.module('portainer.app').factory('WebhookService', [
+  '$q',
+  'Webhooks',
+  function WebhookServiceFactory($q, Webhooks) {
+    'use strict';
+    var service = {};
+
+    service.webhooks = function (serviceID, endpointID) {
+      var deferred = $q.defer();
+      var filters = { ResourceID: serviceID, EndpointID: endpointID };
+
+      Webhooks.query({ filters: filters })
+        .$promise.then(function success(data) {
+          var webhooks = data.map(function (item) {
+            return new WebhookViewModel(item);
+          });
+          deferred.resolve(webhooks);
+        })
+        .catch(function error(err) {
+          deferred.reject({ msg: 'Unable to retrieve webhooks', err: err });
+        });
+
+      return deferred.promise;
+    };
+
+    service.createServiceWebhook = function (serviceID, endpointID, registryID) {
+      return Webhooks.create({ ResourceID: serviceID, EndpointID: endpointID, WebhookType: 1, registryID }).$promise;
+    };
+
+    service.updateServiceWebhook = function (id, registryID) {
+      return Webhooks.update({ id, registryID }).$promise;
+    };
+
+    service.deleteWebhook = function (id) {
+      return Webhooks.remove({ id: id }).$promise;
+    };
+
+    return service;
+  },
+]);
diff --git a/app/portainer/services/async.js b/app/portainer/services/async.js
new file mode 100644
index 0000000..b88e619
--- /dev/null
+++ b/app/portainer/services/async.js
@@ -0,0 +1,24 @@
+/**
+ * Look a the following PR for how to use the wrapper
+ * and documentation about it
+ * https://github.com/portainer/portainer/pull/2945
+ */
+
+angular.module('portainer').factory('$async', [
+  '$q',
+  function ($q) {
+    return function (asyncFunc, ...args) {
+      const def = $q.defer();
+      const wrapper = function (params) {
+        const deferred = $q.defer();
+        asyncFunc(...params)
+          .then(deferred.resolve)
+          .catch(deferred.reject);
+        return deferred.promise;
+      };
+
+      wrapper(args).then(def.resolve).catch(def.reject);
+      return def.promise;
+    };
+  },
+]);
diff --git a/app/portainer/services/authentication.js b/app/portainer/services/authentication.js
new file mode 100644
index 0000000..3825aff
--- /dev/null
+++ b/app/portainer/services/authentication.js
@@ -0,0 +1,177 @@
+import { hasAuthorizations as useUserHasAuthorization } from '@/react/hooks/useUser';
+import { getCurrentUser } from '../users/queries/useLoadCurrentUser';
+import * as userHelpers from '../users/user.helpers';
+import { clear as clearSessionStorage } from './session-storage';
+const DEFAULT_USER = 'admin';
+const DEFAULT_PASSWORD = 'K7yJPP5qNK4hf1QsRnfV';
+
+angular.module('portainer.app').factory('Authentication', [
+  '$async',
+  '$state',
+  'Auth',
+  'OAuth',
+  'LocalStorage',
+  'StateManager',
+  'EndpointProvider',
+  'ThemeManager',
+  function AuthenticationFactory($async, $state, Auth, OAuth, LocalStorage, StateManager, EndpointProvider, ThemeManager) {
+    'use strict';
+
+    var user = {};
+    if (process.env.NODE_ENV === 'development') {
+      window.login = loginAsync;
+    }
+
+    return {
+      init,
+      OAuthLogin,
+      login,
+      logout,
+      isAuthenticated,
+      getUserDetails,
+      isAdmin,
+      isEdgeAdmin,
+      isPureAdmin,
+      hasAuthorizations,
+      redirectIfUnauthorized,
+    };
+
+    async function initAsync() {
+      try {
+        const userId = LocalStorage.getUserId();
+        if (userId && user.ID === userId) {
+          return true;
+        }
+        await tryAutoLoginExtension();
+        await loadUserData();
+        return true;
+      } catch (error) {
+        return tryAutoLoginExtension();
+      }
+    }
+
+    async function logoutAsync() {
+      if (isAuthenticated()) {
+        await Auth.logout().$promise;
+      }
+
+      clearSessionStorage();
+      StateManager.clean();
+      EndpointProvider.clean();
+      LocalStorage.cleanAuthData();
+      LocalStorage.storeLoginStateUUID('');
+      tryAutoLoginExtension();
+      cleanUserData();
+    }
+
+    function logout() {
+      return $async(logoutAsync);
+    }
+
+    function init() {
+      return $async(initAsync);
+    }
+
+    async function OAuthLoginAsync(code) {
+      await OAuth.validate({ code: code }).$promise;
+      await loadUserData();
+    }
+
+    function OAuthLogin(code) {
+      return $async(OAuthLoginAsync, code);
+    }
+
+    async function loginAsync(username, password) {
+      await Auth.login({ username: username, password: password }).$promise;
+      await loadUserData();
+    }
+
+    function login(username, password) {
+      return $async(loginAsync, username, password);
+    }
+
+    function isAuthenticated() {
+      return !!user.ID;
+    }
+
+    function getUserDetails() {
+      return user;
+    }
+
+    function cleanUserData() {
+      user = {};
+    }
+
+    async function loadUserData() {
+      const userData = await getCurrentUser();
+      user.username = userData.Username;
+      user.ID = userData.Id;
+      user.role = userData.Role;
+      user.forceChangePassword = userData.forceChangePassword;
+      user.endpointAuthorizations = userData.EndpointAuthorizations;
+      user.portainerAuthorizations = userData.PortainerAuthorizations;
+
+      // Initialize user theme base on UserTheme from database
+      const userTheme = userData.ThemeSettings ? userData.ThemeSettings.color : 'auto';
+      if (userTheme === 'auto' || !userTheme) {
+        ThemeManager.autoTheme();
+      } else {
+        ThemeManager.setTheme(userTheme);
+      }
+
+      LocalStorage.storeUserId(userData.Id);
+    }
+
+    function tryAutoLoginExtension() {
+      if (!window.ddExtension) {
+        return false;
+      }
+
+      return login(DEFAULT_USER, DEFAULT_PASSWORD);
+    }
+
+    // To avoid creating divergence between CE and EE
+    // isAdmin checks if the user is a portainer admin or edge admin
+
+    function isEdgeAdmin(noEnvScope = false) {
+      const environment = EndpointProvider.currentEndpoint();
+      return userHelpers.isEdgeAdmin({ Role: user.role }, noEnvScope ? undefined : environment);
+    }
+
+    /**
+     * @deprecated use Authentication.isAdmin instead
+     */
+    function isAdmin(noEnvScope = false) {
+      return isEdgeAdmin(noEnvScope);
+    }
+
+    // To avoid creating divergence between CE and EE
+    // isPureAdmin checks if the user is portainer admin only
+    function isPureAdmin() {
+      return userHelpers.isPureAdmin({ Role: user.role });
+    }
+
+    function hasAuthorizations(authorizations) {
+      const endpointId = EndpointProvider.endpointID();
+
+      if (isEdgeAdmin()) {
+        return true;
+      }
+
+      return useUserHasAuthorization(
+        {
+          EndpointAuthorizations: user.endpointAuthorizations,
+        },
+        authorizations,
+        endpointId
+      );
+    }
+
+    function redirectIfUnauthorized(authorizations) {
+      const authorized = hasAuthorizations(authorizations);
+      if (!authorized) {
+        $state.go('portainer.home');
+      }
+    }
+  },
+]);
diff --git a/app/portainer/services/axios/axios.ts b/app/portainer/services/axios/axios.ts
new file mode 100644
index 0000000..80cf741
--- /dev/null
+++ b/app/portainer/services/axios/axios.ts
@@ -0,0 +1,3 @@
+export * from '@/react/portainer/services/axios/axios';
+// eslint-disable-next-line no-restricted-exports
+export { default } from '@/react/portainer/services/axios/axios';
diff --git a/app/portainer/services/axios/index.ts b/app/portainer/services/axios/index.ts
new file mode 100644
index 0000000..8c902d8
--- /dev/null
+++ b/app/portainer/services/axios/index.ts
@@ -0,0 +1,3 @@
+export * from './axios';
+// eslint-disable-next-line no-restricted-exports
+export { default } from './axios';
diff --git a/app/portainer/services/axios/utils/isAxiosError.ts b/app/portainer/services/axios/utils/isAxiosError.ts
new file mode 100644
index 0000000..b6bfa47
--- /dev/null
+++ b/app/portainer/services/axios/utils/isAxiosError.ts
@@ -0,0 +1 @@
+export * from '@/react/portainer/services/axios/utils/isAxiosError';
diff --git a/app/portainer/services/chartService.js b/app/portainer/services/chartService.js
new file mode 100644
index 0000000..3cb3f1d
--- /dev/null
+++ b/app/portainer/services/chartService.js
@@ -0,0 +1,277 @@
+import Chart from 'chart.js';
+import { filesize } from 'filesize';
+
+angular.module('portainer.app').factory('ChartService', [
+  function ChartService() {
+    'use strict';
+
+    // Max. number of items to display on a chart
+    var CHART_LIMIT = 600;
+
+    var service = {};
+
+    function defaultChartOptions(pos, tooltipCallback, scalesCallback, isStacked) {
+      return {
+        animation: { duration: 0 },
+        responsiveAnimationDuration: 0,
+        responsive: true,
+        tooltips: {
+          mode: 'index',
+          intersect: false,
+          position: pos,
+          callbacks: {
+            label: function (tooltipItem, data) {
+              var datasetLabel = data.datasets[tooltipItem.datasetIndex].label;
+              return tooltipCallback(datasetLabel, tooltipItem.yLabel);
+            },
+          },
+        },
+        layout: {
+          padding: {
+            left: 15,
+          },
+        },
+        hover: { animationDuration: 0 },
+        scales: {
+          yAxes: [
+            {
+              stacked: isStacked,
+              ticks: {
+                beginAtZero: true,
+                callback: scalesCallback,
+                precision: 0,
+              },
+            },
+          ],
+        },
+      };
+    }
+
+    function CreateChart(context, label, tooltipCallback, scalesCallback) {
+      return new Chart(context, {
+        type: 'line',
+        data: {
+          labels: [],
+          datasets: [
+            {
+              label: label,
+              data: [],
+              fill: true,
+              backgroundColor: 'rgba(151,187,205,0.4)',
+              borderColor: 'rgba(151,187,205,0.6)',
+              pointBackgroundColor: 'rgba(151,187,205,1)',
+              pointBorderColor: 'rgba(151,187,205,1)',
+              pointRadius: 2,
+              borderWidth: 2,
+            },
+          ],
+        },
+        options: defaultChartOptions('nearest', tooltipCallback, scalesCallback),
+      });
+    }
+
+    function CreateMemoryChart(context, tooltipCallback, scalesCallback) {
+      return new Chart(context, {
+        type: 'line',
+        data: {
+          labels: [],
+          datasets: [
+            {
+              label: 'Memory',
+              data: [],
+              fill: true,
+              backgroundColor: 'rgba(151,187,205,0.4)',
+              borderColor: 'rgba(151,187,205,0.6)',
+              pointBackgroundColor: 'rgba(151,187,205,1)',
+              pointBorderColor: 'rgba(151,187,205,1)',
+              pointRadius: 2,
+              borderWidth: 2,
+            },
+            {
+              label: 'Cache',
+              data: [],
+              fill: true,
+              backgroundColor: 'rgba(255,180,174,0.4)',
+              borderColor: 'rgba(255,180,174,0.6)',
+              pointBackgroundColor: 'rgba(255,180,174,1)',
+              pointBorderColor: 'rgba(255,180,174,1)',
+              pointRadius: 2,
+              borderWidth: 2,
+            },
+          ],
+        },
+        options: defaultChartOptions('nearest', tooltipCallback, scalesCallback, true),
+      });
+    }
+
+    function CreateIOChart(context, tooltipCallback, scalesCallback) {
+      return new Chart(context, {
+        type: 'line',
+        data: {
+          labels: [],
+          datasets: [
+            {
+              label: 'Read (Aggregate)',
+              data: [],
+              fill: true,
+              backgroundColor: 'rgba(151,187,205,0.4)',
+              borderColor: 'rgba(151,187,205,0.6)',
+              pointBackgroundColor: 'rgba(151,187,205,1)',
+              pointBorderColor: 'rgba(151,187,205,1)',
+              pointRadius: 2,
+              borderWidth: 2,
+            },
+            {
+              label: 'Write (Aggregate)',
+              data: [],
+              fill: true,
+              backgroundColor: 'rgba(255,180,174,0.4)',
+              borderColor: 'rgba(255,180,174,0.6)',
+              pointBackgroundColor: 'rgba(255,180,174,1)',
+              pointBorderColor: 'rgba(255,180,174,1)',
+              pointRadius: 2,
+              borderWidth: 2,
+            },
+          ],
+        },
+        options: defaultChartOptions('nearest', tooltipCallback, scalesCallback, true),
+      });
+    }
+
+    service.CreateCPUChart = function (context) {
+      return CreateChart(context, 'CPU', percentageBasedTooltipLabel, percentageBasedAxisLabel);
+    };
+
+    service.CreateIOChart = function (context) {
+      return CreateIOChart(context, byteBasedTooltipLabel, byteBasedAxisLabel);
+    };
+
+    service.CreateMemoryChart = function (context) {
+      return CreateMemoryChart(context, byteBasedTooltipLabel, byteBasedAxisLabel);
+    };
+
+    service.CreateNetworkChart = function (context) {
+      return new Chart(context, {
+        type: 'line',
+        data: {
+          labels: [],
+          datasets: [
+            {
+              label: 'RX on eth0',
+              data: [],
+              fill: false,
+              backgroundColor: 'rgba(151,187,205,0.4)',
+              borderColor: 'rgba(151,187,205,0.6)',
+              pointBackgroundColor: 'rgba(151,187,205,1)',
+              pointBorderColor: 'rgba(151,187,205,1)',
+              pointRadius: 2,
+              borderWidth: 2,
+            },
+            {
+              label: 'TX on eth0',
+              data: [],
+              fill: false,
+              backgroundColor: 'rgba(255,180,174,0.4)',
+              borderColor: 'rgba(255,180,174,0.6)',
+              pointBackgroundColor: 'rgba(255,180,174,1)',
+              pointBorderColor: 'rgba(255,180,174,1)',
+              pointRadius: 2,
+              borderWidth: 2,
+            },
+          ],
+        },
+        options: defaultChartOptions('average', byteBasedTooltipLabel, byteBasedAxisLabel),
+      });
+    };
+
+    function LimitChartItems(chart, CHART_LIMIT) {
+      if (chart.data.datasets[0].data.length > CHART_LIMIT) {
+        chart.data.labels.pop();
+        chart.data.datasets[0].data.pop();
+        chart.data.datasets[1].data.pop();
+      }
+    }
+
+    function UpdateChart(label, value, chart) {
+      chart.data.labels.push(label);
+      chart.data.datasets[0].data.push(value);
+
+      if (chart.data.datasets[0].data.length > CHART_LIMIT) {
+        chart.data.labels.pop();
+        chart.data.datasets[0].data.pop();
+      }
+
+      chart.update(0);
+    }
+
+    service.UpdateMemoryChart = function UpdateChart(label, memoryValue, cacheValue, chart) {
+      chart.data.labels.push(label);
+      chart.data.datasets[0].data.push(memoryValue);
+
+      if (cacheValue) {
+        chart.data.datasets[1].data.push(cacheValue);
+      } else {
+        // cache values are not available for Windows
+        chart.data.datasets.splice(1, 1);
+      }
+
+      LimitChartItems(chart);
+
+      chart.update(0);
+    };
+    service.UpdateCPUChart = UpdateChart;
+    service.UpdateIOChart = function (label, read, write, chart) {
+      chart.data.labels.push(label);
+      chart.data.datasets[0].data.push(read);
+      chart.data.datasets[1].data.push(write);
+      LimitChartItems(chart);
+      chart.update(0);
+    };
+
+    service.UpdateNetworkChart = function (label, rx, tx, chart) {
+      chart.data.labels.push(label);
+      chart.data.datasets[0].data.push(rx);
+      chart.data.datasets[1].data.push(tx);
+
+      LimitChartItems(chart);
+
+      chart.update(0);
+    };
+
+    function byteBasedTooltipLabel(label, value) {
+      var processedValue = 0;
+      if (value > 5) {
+        processedValue = filesize(value, { base: 10, round: 1 });
+      } else {
+        processedValue = value.toFixed(1) + 'B';
+      }
+      return label + ': ' + processedValue;
+    }
+
+    function byteBasedAxisLabel(value) {
+      if (value > 5) {
+        return filesize(value, { base: 10, round: 1 });
+      }
+      return value.toFixed(1) + 'B';
+    }
+
+    function percentageBasedAxisLabel(value) {
+      if (value > 1) {
+        return Math.round(value) + '%';
+      }
+      return value.toFixed(1) + '%';
+    }
+
+    function percentageBasedTooltipLabel(label, value) {
+      var processedValue = 0;
+      if (value > 1) {
+        processedValue = Math.round(value);
+      } else {
+        processedValue = value.toFixed(1);
+      }
+      return label + ': ' + processedValue + '%';
+    }
+
+    return service;
+  },
+]);
diff --git a/app/portainer/services/dockerMaxApiVersion.ts b/app/portainer/services/dockerMaxApiVersion.ts
new file mode 100644
index 0000000..80ff7ec
--- /dev/null
+++ b/app/portainer/services/dockerMaxApiVersion.ts
@@ -0,0 +1,2 @@
+// this is the version we are using with the generated API types
+export const MAX_DOCKER_API_VERSION = 1.47;
diff --git a/app/portainer/services/dockerMaxApiVersionInterceptor.ts b/app/portainer/services/dockerMaxApiVersionInterceptor.ts
new file mode 100644
index 0000000..ba3da40
--- /dev/null
+++ b/app/portainer/services/dockerMaxApiVersionInterceptor.ts
@@ -0,0 +1,58 @@
+import { SystemVersion } from 'docker-types';
+import Axios, { InternalAxiosRequestConfig } from 'axios';
+import { setupCache, buildMemoryStorage } from 'axios-cache-interceptor';
+
+import { buildDockerProxyUrl } from '@/react/docker/proxy/queries/buildDockerProxyUrl';
+
+import { MAX_DOCKER_API_VERSION } from './dockerMaxApiVersion';
+
+const envVersionAxios = Axios.create({
+  baseURL: 'api',
+});
+
+// setup a cache for the intermediary request sent by the interceptor
+const envVersionCache = buildMemoryStorage();
+setupCache(envVersionAxios, {
+  storage: envVersionCache,
+  ttl: 5 * 60 * 1000,
+  methods: ['get'],
+});
+
+export async function dockerMaxAPIVersionInterceptor(
+  rawConfig: InternalAxiosRequestConfig
+) {
+  try {
+    const config = rawConfig;
+    const found = config.url?.match(
+      /endpoints\/(?<environmentId>\d+)\/docker\//
+    );
+
+    if (found && found.groups) {
+      const { environmentId } = found.groups;
+      const envId = parseInt(environmentId, 10);
+
+      // if we cannot parse the env ID, don't send a request that will fail,
+      // exit the interceptor and let the original request config pass through
+      if (Number.isNaN(envId)) {
+        return config;
+      }
+
+      const { data } = await envVersionAxios.get<SystemVersion>(
+        buildDockerProxyUrl(envId, 'version')
+      );
+
+      const apiVersion = parseFloat(data.ApiVersion ?? '0');
+
+      if (apiVersion > MAX_DOCKER_API_VERSION) {
+        config.url = config.url?.replace(
+          /docker/,
+          `docker/v${MAX_DOCKER_API_VERSION}`
+        );
+      }
+    }
+    return config;
+  } catch {
+    // if the interceptor errors, return the original config
+    return rawConfig;
+  }
+}
diff --git a/app/portainer/services/endpointProvider.ts b/app/portainer/services/endpointProvider.ts
new file mode 100644
index 0000000..3c562e2
--- /dev/null
+++ b/app/portainer/services/endpointProvider.ts
@@ -0,0 +1,69 @@
+import { ping } from '@/react/docker/proxy/queries/usePing';
+import { environmentStore } from '@/react/hooks/current-environment-store';
+import {
+  Environment,
+  EnvironmentType,
+} from '@/react/portainer/environments/types';
+
+interface State {
+  currentEndpoint: Environment | null;
+  pingInterval: NodeJS.Timeout | null;
+}
+
+const DEFAULT_TITLE = 'Portainer';
+
+/* @ngInject */
+export function EndpointProvider() {
+  const state: State = {
+    currentEndpoint: null,
+    pingInterval: null,
+  };
+
+  environmentStore.subscribe(
+    (state) => state.environmentId,
+    (environmentId) => {
+      if (!environmentId) {
+        setCurrentEndpoint(null);
+      }
+    }
+  );
+
+  return { endpointID, setCurrentEndpoint, currentEndpoint, clean };
+
+  function endpointID() {
+    return state.currentEndpoint?.Id;
+  }
+
+  function setCurrentEndpoint(endpoint: Environment | null) {
+    state.currentEndpoint = endpoint;
+
+    if (state.pingInterval) {
+      clearInterval(state.pingInterval);
+      state.pingInterval = null;
+    }
+
+    if (endpoint && endpoint.Type === EnvironmentType.EdgeAgentOnDocker) {
+      state.pingInterval = setInterval(() => ping(endpoint.Id), 60 * 1000);
+    }
+
+    if (endpoint === null) {
+      sessionStorage.setItem(
+        'portainer.environmentId',
+        JSON.stringify(undefined)
+      );
+    }
+
+    document.title = endpoint ? `${endpoint.Name}` : `${DEFAULT_TITLE}`;
+  }
+
+  function currentEndpoint() {
+    return state.currentEndpoint;
+  }
+
+  function clean() {
+    setCurrentEndpoint(null);
+    environmentStore.getState().clear();
+  }
+}
+
+export type EndpointProviderInterface = ReturnType<typeof EndpointProvider>;
diff --git a/app/portainer/services/fileUpload.js b/app/portainer/services/fileUpload.js
new file mode 100644
index 0000000..c0f9e82
--- /dev/null
+++ b/app/portainer/services/fileUpload.js
@@ -0,0 +1,197 @@
+import { PortainerEndpointCreationTypes } from '@/portainer/models/endpoint/models';
+
+angular.module('portainer.app').factory('FileUploadService', FileUploadFactory);
+
+/* @ngInject */
+function FileUploadFactory($q, Upload) {
+  var service = {
+    // createSchedule, // edge jobs service
+    // uploadBackup, // backup service
+    // createSwarmStack, // stack service
+    // createComposeStack, // stack service
+    // createEdgeStack, // edge stack service
+    // createCustomTemplate, // custom template service
+    // configureRegistry, // registry service
+    // createEndpoint, // endpoint service
+    // createAzureEndpoint, // endpoint service
+    // uploadLDAPTLSFiles, // auth settings controller
+    // uploadTLSFilesForEndpoint, // endpoint service
+    // uploadOwnershipVoucher, // import device controller
+  };
+
+  function uploadFile(url, file) {
+    return Upload.upload({ url: url, data: { file: file } });
+  }
+
+  service.createSchedule = function (payload) {
+    return Upload.upload({
+      url: 'api/edge_jobs/create/file',
+      data: {
+        file: payload.File,
+        Name: payload.Name,
+        CronExpression: payload.CronExpression,
+        Image: payload.Image,
+        Endpoints: Upload.json(payload.Endpoints),
+        RetryCount: payload.RetryCount,
+        RetryInterval: payload.RetryInterval,
+      },
+    });
+  };
+
+  service.uploadBackup = function (file, password, setupToken) {
+    return Upload.upload({
+      url: 'api/restore',
+      data: { file, password },
+      headers: setupToken ? { 'X-Setup-Token': setupToken } : {},
+    });
+  };
+
+  service.createSwarmStack = function (stackName, swarmId, file, env, endpointId, webhook) {
+    return Upload.upload({
+      url: `api/stacks/create/swarm/file?endpointId=${endpointId}`,
+      data: {
+        file: file,
+        Name: stackName,
+        SwarmID: swarmId,
+        Env: Upload.json(env),
+        Webhook: webhook,
+      },
+      ignoreLoadingBar: true,
+    });
+  };
+
+  service.createComposeStack = function (stackName, file, env, endpointId, webhook) {
+    return Upload.upload({
+      url: `api/stacks/create/standalone/file?endpointId=${endpointId}`,
+      data: {
+        file: file,
+        Name: stackName,
+        Env: Upload.json(env),
+        Webhook: webhook,
+      },
+      ignoreLoadingBar: true,
+    });
+  };
+
+  service.createEdgeStack = function createEdgeStack({ EdgeGroups, Registries, envVars, staggerConfig, ...payload }, file, dryrun) {
+    return Upload.upload({
+      url: `api/edge_stacks/create/file?dryrun=${dryrun}`,
+      data: {
+        file,
+        EdgeGroups: Upload.json(EdgeGroups),
+        Registries: Upload.json(Registries),
+        EnvVars: Upload.json(envVars),
+        StaggerConfig: Upload.json(staggerConfig),
+        ...payload,
+      },
+      ignoreLoadingBar: true,
+    });
+  };
+
+  service.createCustomTemplate = function createCustomTemplate(data) {
+    return Upload.upload({
+      url: 'api/custom_templates/create/file',
+      data,
+      ignoreLoadingBar: true,
+    });
+  };
+
+  service.configureRegistry = function (registryId, registryManagementConfigurationModel) {
+    return Upload.upload({
+      url: 'api/registries/' + registryId + '/configure',
+      data: registryManagementConfigurationModel,
+    });
+  };
+
+  service.createEndpoint = function (
+    name,
+    creationType,
+    URL,
+    PublicURL,
+    groupID,
+    tagIds,
+    TLS,
+    TLSSkipVerify,
+    TLSSkipClientVerify,
+    TLSCAFile,
+    TLSCertFile,
+    TLSKeyFile,
+    checkinInterval,
+    EdgePingInterval,
+    EdgeSnapshotInterval,
+    EdgeCommandInterval
+  ) {
+    return Upload.upload({
+      url: 'api/endpoints',
+      data: {
+        Name: name,
+        EndpointCreationType: creationType,
+        URL: URL,
+        PublicURL: PublicURL,
+        GroupID: groupID,
+        TagIds: Upload.json(tagIds),
+        TLS: TLS,
+        TLSSkipVerify: TLSSkipVerify,
+        TLSSkipClientVerify: TLSSkipClientVerify,
+        TLSCACertFile: TLSCAFile,
+        TLSCertFile: TLSCertFile,
+        TLSKeyFile: TLSKeyFile,
+        CheckinInterval: checkinInterval,
+        EdgePingInterval: EdgePingInterval,
+        EdgeSnapshotInterval: EdgeSnapshotInterval,
+        EdgeCommandInterval: EdgeCommandInterval,
+      },
+      ignoreLoadingBar: true,
+    });
+  };
+
+  service.createAzureEndpoint = function (name, applicationId, tenantId, authenticationKey, groupId, tagIds) {
+    return Upload.upload({
+      url: 'api/endpoints',
+      data: {
+        Name: name,
+        EndpointCreationType: PortainerEndpointCreationTypes.AzureEnvironment,
+        GroupID: groupId,
+        TagIds: Upload.json(tagIds),
+        AzureApplicationID: applicationId,
+        AzureTenantID: tenantId,
+        AzureAuthenticationKey: authenticationKey,
+      },
+      ignoreLoadingBar: true,
+    });
+  };
+
+  service.uploadLDAPTLSFiles = function (TLSCAFile, TLSCertFile, TLSKeyFile) {
+    var queue = [];
+
+    if (TLSCAFile) {
+      queue.push(uploadFile('api/upload/tls/ca?folder=ldap', TLSCAFile));
+    }
+    if (TLSCertFile) {
+      queue.push(uploadFile('api/upload/tls/cert?folder=ldap', TLSCertFile));
+    }
+    if (TLSKeyFile) {
+      queue.push(uploadFile('api/upload/tls/key?folder=ldap', TLSKeyFile));
+    }
+
+    return $q.all(queue);
+  };
+
+  service.uploadTLSFilesForEndpoint = function (endpointID, TLSCAFile, TLSCertFile, TLSKeyFile) {
+    var queue = [];
+
+    if (TLSCAFile) {
+      queue.push(uploadFile('api/upload/tls/ca?folder=' + endpointID, TLSCAFile));
+    }
+    if (TLSCertFile) {
+      queue.push(uploadFile('api/upload/tls/cert?folder=' + endpointID, TLSCertFile));
+    }
+    if (TLSKeyFile) {
+      queue.push(uploadFile('api/upload/tls/key?folder=' + endpointID, TLSKeyFile));
+    }
+
+    return $q.all(queue);
+  };
+
+  return service;
+}
diff --git a/app/portainer/services/fileUploadReact.ts b/app/portainer/services/fileUploadReact.ts
new file mode 100644
index 0000000..f8b50a3
--- /dev/null
+++ b/app/portainer/services/fileUploadReact.ts
@@ -0,0 +1,25 @@
+export function readFileAsArrayBuffer(file: File): Promise<ArrayBuffer | null> {
+  return new Promise((resolve, reject) => {
+    const reader = new FileReader();
+    reader.readAsArrayBuffer(file);
+    reader.onload = () => {
+      if (reader.result instanceof ArrayBuffer) {
+        resolve(reader.result);
+      }
+    };
+    reader.onerror = (error) => reject(error);
+  });
+}
+
+export function readFileAsText(file: File): Promise<string | null> {
+  return new Promise((resolve, reject) => {
+    const reader = new FileReader();
+    reader.readAsText(file);
+    reader.onload = () => {
+      if (typeof reader.result === 'string') {
+        resolve(reader.result);
+      }
+    };
+    reader.onerror = (error) => reject(error);
+  });
+}
diff --git a/app/portainer/services/formValidator.js b/app/portainer/services/formValidator.js
new file mode 100644
index 0000000..7cac122
--- /dev/null
+++ b/app/portainer/services/formValidator.js
@@ -0,0 +1,24 @@
+import { ResourceControlOwnership as RCO } from '@/react/portainer/access-control/types';
+
+angular.module('portainer.app').factory('FormValidator', [
+  function FormValidatorFactory() {
+    'use strict';
+
+    var validator = {};
+
+    validator.validateAccessControl = function (accessControlData, isAdmin) {
+      if (!accessControlData.AccessControlEnabled) {
+        return '';
+      }
+
+      if (isAdmin && accessControlData.Ownership === RCO.RESTRICTED && accessControlData.AuthorizedUsers.length === 0 && accessControlData.AuthorizedTeams.length === 0) {
+        return 'You must specify at least one team or user.';
+      } else if (!isAdmin && accessControlData.Ownership === RCO.RESTRICTED && accessControlData.AuthorizedTeams.length === 0) {
+        return 'You must specify at least a team.';
+      }
+      return '';
+    };
+
+    return validator;
+  },
+]);
diff --git a/app/portainer/services/http-request.helper.test.ts b/app/portainer/services/http-request.helper.test.ts
new file mode 100644
index 0000000..703b7bf
--- /dev/null
+++ b/app/portainer/services/http-request.helper.test.ts
@@ -0,0 +1,69 @@
+import {
+  registryAuthenticationHeader,
+  setRegistryAuthenticationHeader,
+  portainerAgentTargetHeader,
+  setPortainerAgentTargetHeader,
+  setPortainerAgentManagerOperation,
+  portainerAgentManagerOperation,
+  resetAgentHeaders,
+} from './http-request.helper';
+
+afterEach(() => {
+  resetAgentHeaders();
+});
+
+test('registryAuthenticationHeader', () => {
+  const header = 'header';
+
+  expect(registryAuthenticationHeader()).toBeUndefined();
+
+  setRegistryAuthenticationHeader(header);
+
+  expect(registryAuthenticationHeader()).toBe(header);
+
+  resetAgentHeaders();
+
+  expect(registryAuthenticationHeader()).toBeUndefined();
+});
+
+test('portainerAgentTargetHeader', () => {
+  const header = 'header';
+
+  expect(portainerAgentTargetHeader()).toBe('');
+
+  setPortainerAgentTargetHeader(header);
+
+  expect(portainerAgentTargetHeader()).toBe(header);
+
+  resetAgentHeaders();
+
+  expect(portainerAgentTargetHeader()).toBe('');
+});
+
+test('when setting portainerAgentTargetHeader more than once, should return headers in fifo, until the last one then it should be the last one', () => {
+  const headers = Array.from({ length: 5 }).map((_, i) => `header${i}`);
+
+  expect(portainerAgentTargetHeader()).toBe('');
+
+  headers.forEach((header) => setPortainerAgentTargetHeader(header));
+
+  headers.forEach((_, i) =>
+    expect(portainerAgentTargetHeader()).toBe(`header${i}`)
+  );
+
+  expect(portainerAgentTargetHeader()).toBe('header4');
+  expect(portainerAgentTargetHeader()).toBe('header4');
+  expect(portainerAgentTargetHeader()).toBe('header4');
+});
+
+test('portainerAgentManagerOperation', () => {
+  expect(portainerAgentManagerOperation()).toBe(false);
+
+  setPortainerAgentManagerOperation(true);
+
+  expect(portainerAgentManagerOperation()).toBe(true);
+
+  resetAgentHeaders();
+
+  expect(portainerAgentManagerOperation()).toBe(false);
+});
diff --git a/app/portainer/services/http-request.helper.ts b/app/portainer/services/http-request.helper.ts
new file mode 100644
index 0000000..19e244c
--- /dev/null
+++ b/app/portainer/services/http-request.helper.ts
@@ -0,0 +1,102 @@
+import { AxiosRequestConfig } from 'axios';
+
+export const CACHE_DURATION = 5 * 60 * 1000; // 5m in ms
+// event emitted when cache need to be refreshed
+// used to sync $http + axios cache clear
+export const CACHE_REFRESH_EVENT = '__cache__refresh__event__';
+
+// utility function to dispatch catch refresh event
+export function dispatchCacheRefreshEvent() {
+  dispatchEvent(new CustomEvent(CACHE_REFRESH_EVENT, {}));
+}
+
+// perform checks on config.method and config.url
+// to dispatch event in only specific scenarios
+export function dispatchCacheRefreshEventIfNeeded(req: AxiosRequestConfig) {
+  if (
+    req.method &&
+    ['post', 'patch', 'put', 'delete'].includes(req.method.toLowerCase()) &&
+    // don't clear cache when we try to check for namespaces accesses
+    // otherwise we will clear it on every page
+    req.url &&
+    !req.url.includes('selfsubjectaccessreviews') &&
+    req.url.includes('kubernetes')
+  ) {
+    dispatchCacheRefreshEvent();
+  }
+}
+
+interface Headers {
+  agentTargetQueue: string[];
+  agentManagerOperation: boolean;
+  registryAuthentication?: string;
+  agentTargetLastValue: string;
+}
+
+const headers: Headers = {
+  agentTargetQueue: [],
+  agentManagerOperation: false,
+  agentTargetLastValue: '',
+};
+
+export function registryAuthenticationHeader() {
+  return headers.registryAuthentication;
+}
+
+export function setRegistryAuthenticationHeader(headerValue: string) {
+  headers.registryAuthentication = headerValue;
+}
+
+// Due to the fact that async HTTP requests are decorated using an interceptor
+// we need to store and retrieve the headers using a first-in-first-out (FIFO) data structure.
+// Otherwise, sequential HTTP requests might end up using the same header value (incorrect in the case
+// of starting multiple containers on different nodes for example).
+// To prevent having to use the HttpRequestHelper.setPortainerAgentTargetHeader before EACH request,
+// we re-use the latest available header in the data structure (handy in thee case of multiple requests affecting
+// the same node in the same view).
+export function portainerAgentTargetHeader() {
+  if (headers.agentTargetQueue.length === 0) {
+    return headers.agentTargetLastValue;
+  }
+
+  if (headers.agentTargetQueue.length === 1) {
+    const [lastValue] = headers.agentTargetQueue;
+    headers.agentTargetLastValue = lastValue;
+  }
+
+  return headers.agentTargetQueue.shift() || '';
+}
+
+export function setPortainerAgentTargetHeader(headerValue: string) {
+  if (headerValue) {
+    headers.agentTargetQueue.push(headerValue);
+  }
+}
+
+export function setPortainerAgentManagerOperation(set: boolean) {
+  headers.agentManagerOperation = set;
+}
+
+export function portainerAgentManagerOperation() {
+  return headers.agentManagerOperation;
+}
+
+export function resetAgentHeaders() {
+  headers.agentTargetQueue = [];
+  headers.agentTargetLastValue = '';
+  headers.agentManagerOperation = false;
+  delete headers.registryAuthentication;
+}
+
+/* @ngInject */
+export function HttpRequestHelperAngular() {
+  return {
+    registryAuthenticationHeader,
+    setRegistryAuthenticationHeader,
+    portainerAgentTargetHeader,
+    setPortainerAgentTargetHeader,
+    setPortainerAgentManagerOperation,
+    portainerAgentManagerOperation,
+    resetAgentHeaders,
+  };
+}
diff --git a/app/portainer/services/index.ts b/app/portainer/services/index.ts
new file mode 100644
index 0000000..1d05092
--- /dev/null
+++ b/app/portainer/services/index.ts
@@ -0,0 +1,14 @@
+import angular from 'angular';
+
+import { apiServicesModule } from './api';
+import { Notifications } from './notifications';
+import { HttpRequestHelperAngular } from './http-request.helper';
+import { EndpointProvider } from './endpointProvider';
+import { AngularToReact } from './angularToReact';
+
+export default angular
+  .module('portainer.app.services', [apiServicesModule])
+  .factory('Notifications', Notifications)
+  .factory('EndpointProvider', EndpointProvider)
+  .factory('HttpRequestHelper', HttpRequestHelperAngular)
+  .factory('AngularToReact', AngularToReact).name;
diff --git a/app/portainer/services/localStorage.js b/app/portainer/services/localStorage.js
new file mode 100644
index 0000000..038c752
--- /dev/null
+++ b/app/portainer/services/localStorage.js
@@ -0,0 +1,132 @@
+angular.module('portainer.app').factory('LocalStorage', [
+  'localStorageService',
+  function LocalStorageFactory(localStorageService) {
+    return {
+      storeLoginStateUUID: function (uuid) {
+        localStorageService.set('LOGIN_STATE_UUID', uuid);
+      },
+      getLoginStateUUID: function () {
+        return localStorageService.get('LOGIN_STATE_UUID');
+      },
+      storeEndpointState: function (state) {
+        localStorageService.set('ENDPOINT_STATE', state);
+      },
+      getEndpointState: function () {
+        return localStorageService.get('ENDPOINT_STATE');
+      },
+      cleanEndpointState() {
+        localStorageService.remove('ENDPOINT_STATE');
+      },
+      storeApplicationState: function (state) {
+        localStorageService.set('APPLICATION_STATE', state);
+      },
+      getApplicationState: function () {
+        return localStorageService.get('APPLICATION_STATE');
+      },
+      storeUIState: function (state) {
+        localStorageService.set('UI_STATE', state);
+      },
+      getUIState: function () {
+        return localStorageService.get('UI_STATE');
+      },
+      getUserId() {
+        return localStorageService.get('USER_ID');
+      },
+      storeUserId: function (userId) {
+        localStorageService.set('USER_ID', userId);
+      },
+      deleteUserId: function () {
+        localStorageService.remove('USER_ID');
+      },
+      storePaginationLimit: function (key, count) {
+        localStorageService.set('datatable_pagination_' + key, count);
+      },
+      getPaginationLimit: function (key) {
+        return localStorageService.get('datatable_pagination_' + key);
+      },
+      getDataTableOrder: function (key) {
+        return localStorageService.get('datatable_order_' + key);
+      },
+      storeDataTableOrder: function (key, data) {
+        localStorageService.set('datatable_order_' + key, data);
+      },
+      getDataTableTextFilters: function (key) {
+        return localStorageService.get('datatable_text_filter_' + key);
+      },
+      storeDataTableTextFilters: function (key, data) {
+        localStorageService.set('datatable_text_filter_' + key, data);
+      },
+      getDataTableFilters: function (key) {
+        return localStorageService.get('datatable_filters_' + key);
+      },
+      storeDataTableFilters: function (key, data) {
+        localStorageService.set('datatable_filters_' + key, data);
+      },
+      getDataTableSettings: function (key) {
+        return localStorageService.get('datatable_settings_' + key);
+      },
+      storeDataTableSettings: function (key, data) {
+        localStorageService.set('datatable_settings_' + key, data);
+      },
+      getDataTableExpandedItems: function (key) {
+        return localStorageService.get('datatable_expandeditems_' + key);
+      },
+      storeDataTableExpandedItems: function (key, data) {
+        localStorageService.set('datatable_expandeditems_' + key, data);
+      },
+      getDataTableSelectedItems: function (key) {
+        return localStorageService.get('datatable_selecteditems_' + key);
+      },
+      storeDataTableSelectedItems: function (key, data) {
+        localStorageService.set('datatable_selecteditems_' + key, data);
+      },
+      storeSwarmVisualizerSettings: function (key, data) {
+        localStorageService.set('swarmvisualizer_' + key, data);
+      },
+      getSwarmVisualizerSettings: function (key) {
+        return localStorageService.get('swarmvisualizer_' + key);
+      },
+      storeColumnVisibilitySettings: function (key, data) {
+        localStorageService.set('col_visibility_' + key, data);
+      },
+      getColumnVisibilitySettings: function (key) {
+        return localStorageService.get('col_visibility_' + key);
+      },
+      storeJobImage: function (data) {
+        localStorageService.set('job_image', data);
+      },
+      getJobImage: function () {
+        return localStorageService.get('job_image');
+      },
+      storeActiveTab: function (key, index) {
+        return localStorageService.set('active_tab_' + key, index);
+      },
+      getActiveTab: function (key) {
+        const activeTab = localStorageService.get('active_tab_' + key);
+        return activeTab === null ? 0 : activeTab;
+      },
+      storeNamespaceFilter: function (environmentId, userID, data) {
+        // store one filter per environment
+        localStorageService.set(`kubernetes_namespace_filter_${environmentId}_${userID}`, data);
+      },
+      getNamespaceFilter: function (environmentId, userID) {
+        return localStorageService.get(`kubernetes_namespace_filter_${environmentId}_${userID}`);
+      },
+      storeLogoutReason: (reason) => localStorageService.set('logout_reason', reason),
+      getLogoutReason: () => localStorageService.get('logout_reason'),
+      cleanLogoutReason: () => localStorageService.remove('logout_reason'),
+      clean: function () {
+        localStorageService.clearAll();
+      },
+      cleanAuthData() {
+        localStorageService.remove('USER_ID', 'APPLICATION_STATE', 'LOGIN_STATE_UUID', 'ALLOWED_NAMESPACES');
+      },
+      storeKubernetesSummaryToggle(value) {
+        localStorageService.set('kubernetes_summary_expanded', value);
+      },
+      getKubernetesSummaryToggle() {
+        return localStorageService.get('kubernetes_summary_expanded');
+      },
+    };
+  },
+]);
diff --git a/app/portainer/services/nameValidator.js b/app/portainer/services/nameValidator.js
new file mode 100644
index 0000000..bf3ca58
--- /dev/null
+++ b/app/portainer/services/nameValidator.js
@@ -0,0 +1,19 @@
+import angular from 'angular';
+import { getEnvironments } from '@/react/portainer/environments/environment.service';
+
+angular.module('portainer.app').factory('NameValidator', NameValidatorFactory);
+/* @ngInject */
+function NameValidatorFactory(Notifications) {
+  return {
+    validateEnvironmentName,
+  };
+
+  async function validateEnvironmentName(name) {
+    try {
+      const endpoints = await getEnvironments({ limit: 1, name });
+      return endpoints.value.length > 0;
+    } catch (err) {
+      Notifications.error('Failure', err, 'Unable to retrieve environment details');
+    }
+  }
+}
diff --git a/app/portainer/services/notifications.test.ts b/app/portainer/services/notifications.test.ts
new file mode 100644
index 0000000..01d85ae
--- /dev/null
+++ b/app/portainer/services/notifications.test.ts
@@ -0,0 +1,60 @@
+import toastr from 'toastr';
+
+import { notifyError, notifySuccess, notifyWarning } from './notifications';
+
+vi.spyOn(console, 'error').mockImplementation(() => vi.fn());
+
+afterEach(() => {
+  vi.resetAllMocks();
+});
+
+it('calling success should show success message', () => {
+  const title = 'title';
+  const text = 'text';
+
+  notifySuccess(title, text);
+
+  expect(toastr.success).toHaveBeenCalledWith(text, title);
+});
+
+it('calling error with Error should show error message', () => {
+  const consoleErrorFn = vi
+    .spyOn(console, 'error')
+    .mockImplementation(() => vi.fn());
+  const title = 'title';
+  const errorMessage = 'message';
+  const fallback = 'fallback';
+
+  notifyError(title, new Error(errorMessage), fallback);
+
+  expect(toastr.error).toHaveBeenCalledWith(
+    errorMessage,
+    title,
+    expect.anything()
+  );
+
+  consoleErrorFn.mockRestore();
+});
+
+it('calling error without Error should show fallback message', () => {
+  const consoleErrorFn = vi
+    .spyOn(console, 'error')
+    .mockImplementation(() => vi.fn());
+  const title = 'title';
+
+  const fallback = 'fallback';
+
+  notifyError(title, undefined, fallback);
+
+  expect(toastr.error).toHaveBeenCalledWith(fallback, title, expect.anything());
+  consoleErrorFn.mockRestore();
+});
+
+it('calling warning should show warning message', () => {
+  const title = 'title';
+  const text = 'text';
+
+  notifyWarning(title, text);
+
+  expect(toastr.warning).toHaveBeenCalledWith(text, title, expect.anything());
+});
diff --git a/app/portainer/services/notifications.ts b/app/portainer/services/notifications.ts
new file mode 100644
index 0000000..77d6e92
--- /dev/null
+++ b/app/portainer/services/notifications.ts
@@ -0,0 +1,115 @@
+import _ from 'lodash';
+import toastr from 'toastr';
+import sanitize from 'sanitize-html';
+import { v4 as uuid } from 'uuid';
+
+import { get as localStorageGet } from '@/react/hooks/useLocalStorage';
+import { notificationsStore } from '@/react/portainer/notifications/notifications-store';
+import { ToastNotification } from '@/react/portainer/notifications/types';
+
+const { addNotification } = notificationsStore.getState();
+
+toastr.options = {
+  timeOut: 3000,
+  closeButton: true,
+  progressBar: true,
+  tapToDismiss: false,
+  escapeHtml: true,
+  // custom button, using the lucide icon x.svg inside
+  closeHtml: `<button type="button"><svg
+  xmlns="http://www.w3.org/2000/svg"
+  width="18"
+  height="18"
+  viewBox="0 0 24 24"
+  fill="none"
+  stroke="currentColor"
+  stroke-width="2"
+  stroke-linecap="round"
+  stroke-linejoin="round"
+>
+  <line x1="18" y1="6" x2="6" y2="18" />
+  <line x1="6" y1="6" x2="18" y2="18" />
+</svg></button>`,
+};
+
+export function notifySuccess(title: string, text: string) {
+  saveNotification(title, text, 'success');
+  toastr.success(sanitize(_.escape(text)), sanitize(_.escape(title)));
+}
+
+export function notifyWarning(title: string, text: string) {
+  saveNotification(title, text, 'warning');
+  toastr.warning(sanitize(_.escape(text)), sanitize(title), { timeOut: 6000 });
+}
+
+export function notifyError(title: string, e?: unknown, fallbackText = '') {
+  const msg = pickErrorMsg(e) || fallbackText;
+  saveNotification(title, msg, 'error');
+
+  if (!_.get(e, 'resource.password')) {
+    // eslint-disable-next-line no-console
+    console.error(e);
+  }
+
+  if (msg !== 'Invalid JWT token') {
+    toastr.error(sanitize(_.escape(msg)), sanitize(title), { timeOut: 6000 });
+  }
+}
+
+export const success = notifySuccess;
+export const error = notifyError;
+export const warning = notifyWarning;
+
+/* @ngInject */
+export function Notifications() {
+  return {
+    success: notifySuccess,
+    warning: notifyWarning,
+    error: notifyError,
+  };
+}
+
+function pickErrorMsg(e?: unknown) {
+  if (!e) {
+    return '';
+  }
+
+  const props = [
+    'err.data.details',
+    'err.data.message',
+    'data.details',
+    'data.message',
+    'data.content',
+    'data.error',
+    'message',
+    'err.data[0].message',
+    'err.data.err',
+    'data.err',
+    'msg',
+  ];
+
+  let msg = '';
+
+  props.forEach((prop) => {
+    const val = _.get(e, prop);
+    if (typeof val === 'string') {
+      msg = msg || val;
+    }
+  });
+
+  return msg;
+}
+
+function saveNotification(title: string, text: string, type: string) {
+  const notif: ToastNotification = {
+    id: uuid(),
+    title,
+    details: text,
+    type,
+    timeStamp: new Date(),
+  };
+  const userId = localStorageGet('USER_ID', '');
+  if (userId !== '') {
+    addNotification(userId, notif);
+  }
+}
diff --git a/app/portainer/services/pagination.js b/app/portainer/services/pagination.js
new file mode 100644
index 0000000..02204bd
--- /dev/null
+++ b/app/portainer/services/pagination.js
@@ -0,0 +1,25 @@
+angular.module('portainer.app').factory('PaginationService', [
+  'LocalStorage',
+  'PAGINATION_MAX_ITEMS',
+  function PaginationServiceFactory(LocalStorage, PAGINATION_MAX_ITEMS) {
+    'use strict';
+
+    var service = {};
+
+    service.getPaginationLimit = function (key) {
+      var paginationLimit = PAGINATION_MAX_ITEMS;
+
+      var storedLimit = LocalStorage.getPaginationLimit(key);
+      if (storedLimit !== null) {
+        paginationLimit = storedLimit;
+      }
+      return '' + paginationLimit;
+    };
+
+    service.setPaginationLimit = function (key, limit) {
+      LocalStorage.storePaginationLimit(key, limit);
+    };
+
+    return service;
+  },
+]);
diff --git a/app/portainer/services/registryGitlabService.js b/app/portainer/services/registryGitlabService.js
new file mode 100644
index 0000000..f6fb306
--- /dev/null
+++ b/app/portainer/services/registryGitlabService.js
@@ -0,0 +1,88 @@
+import _ from 'lodash-es';
+import { RegistryGitlabProject } from '@/react/portainer/registries/types/gitlabProject';
+import { RegistryRepositoryGitlabViewModel } from '../models/registryRepository';
+
+angular.module('portainer.app').factory('RegistryGitlabService', [
+  '$async',
+  'Gitlab',
+  function RegistryGitlabServiceFactory($async, Gitlab) {
+    'use strict';
+    var service = {};
+
+    /**
+     * PROJECTS
+     */
+
+    async function _getProjectsPage(env, params, projects) {
+      const response = await Gitlab(env).projects(params).$promise;
+      projects = _.concat(projects, response.data);
+      if (response.next) {
+        params.page = response.next;
+        projects = await _getProjectsPage(env, params, projects);
+      }
+      return projects;
+    }
+
+    async function projectsAsync(url, token) {
+      try {
+        const data = await _getProjectsPage({ url: url, token: token }, { page: 1 }, []);
+        return _.map(data, (project) => new RegistryGitlabProject(project));
+      } catch (error) {
+        throw { msg: 'Unable to retrieve projects', err: error };
+      }
+    }
+
+    /**
+     * END PROJECTS
+     */
+
+    /**
+     * REPOSITORIES
+     */
+
+    async function _getRepositoriesPage(params, repositories) {
+      const response = await Gitlab().repositories(params).$promise;
+      repositories = _.concat(repositories, response.data);
+      if (response.next) {
+        params.page = response.next;
+        repositories = await _getRepositoriesPage(params, repositories);
+      }
+      return repositories;
+    }
+
+    async function repositoriesAsync(registry, endpointId) {
+      try {
+        const params = {
+          id: registry.Id,
+          endpointId: endpointId,
+          projectId: registry.Gitlab.ProjectId,
+          page: 1,
+        };
+        const data = await _getRepositoriesPage(params, []);
+        return _.map(data, (r) => new RegistryRepositoryGitlabViewModel(r));
+      } catch (error) {
+        throw { msg: 'Unable to retrieve repositories', err: error };
+      }
+    }
+
+    /**
+     * END REPOSITORIES
+     */
+
+    /**
+     * SERVICE FUNCTIONS DECLARATION
+     */
+
+    function projects(url, token) {
+      return $async(projectsAsync, url, token);
+    }
+
+    function repositories(registry, endpointId) {
+      return $async(repositoriesAsync, registry, endpointId);
+    }
+
+    service.projects = projects;
+    service.repositories = repositories;
+    return service;
+  },
+]);
diff --git a/app/portainer/services/registryModalService.js b/app/portainer/services/registryModalService.js
new file mode 100644
index 0000000..de4caa8
--- /dev/null
+++ b/app/portainer/services/registryModalService.js
@@ -0,0 +1,22 @@
+import _ from 'lodash';
+import { selectRegistry } from '@/react/docker/images/ItemView/RegistrySelectPrompt';
+
+angular.module('portainer.app').factory('RegistryModalService', RegistryModalService);
+
+function RegistryModalService(RegistryService) {
+  const service = {};
+
+  service.registryModal = async function (repository, registries) {
+    const registryModel = RegistryService.retrievePorRegistryModelFromRepositoryWithRegistries(repository, registries);
+    const defaultValue = _.get(registryModel, 'Registry.Id', 0);
+
+    const registryId = await selectRegistry(registries, defaultValue);
+    if (registryId === undefined) {
+      return null;
+    }
+
+    return RegistryService.retrievePorRegistryModelFromRepositoryWithRegistries(repository, registries, registryId);
+  };
+
+  return service;
+}
diff --git a/app/portainer/services/session-storage.js b/app/portainer/services/session-storage.js
new file mode 100644
index 0000000..3a5c77d
--- /dev/null
+++ b/app/portainer/services/session-storage.js
@@ -0,0 +1,31 @@
+/**
+ * clears the sessionStorage
+ */
+export function clear() {
+  sessionStorage.clear();
+}
+
+/**
+ * stores `value` as string in `sessionStorage[key]`
+ *
+ * @param {string} key the key to store value at
+ * @param {any} value the value to store - will be stringified using JSON.stringify
+ *
+ */
+export function save(key, value) {
+  sessionStorage.setItem(key, JSON.stringify(value));
+}
+
+/**
+ * get parses the value stored in sessionStorage[key], if it's not available returns undefined
+ *
+ * @param {string} key
+ */
+export function get(key) {
+  try {
+    const value = sessionStorage.getItem(key);
+    return JSON.parse(value);
+  } catch (e) {
+    return;
+  }
+}
diff --git a/app/portainer/services/stateManager.js b/app/portainer/services/stateManager.js
new file mode 100644
index 0000000..5bf6ef9
--- /dev/null
+++ b/app/portainer/services/stateManager.js
@@ -0,0 +1,210 @@
+import moment from 'moment';
+
+angular.module('portainer.app').factory('StateManager', StateManagerFactory);
+
+/* @ngInject */
+function StateManagerFactory($async, $q, SystemService, InfoHelper, LocalStorage, SettingsService, StatusService, APPLICATION_CACHE_VALIDITY, AgentPingService, EndpointProvider) {
+  var manager = {};
+
+  var state = {
+    loading: true,
+    application: {},
+    endpoint: {},
+    UI: {
+      dismissedInfoPanels: {},
+      dismissedInfoHash: '',
+      timesPasswordChangeSkipped: {},
+      dismissedUpdateVersion: '',
+    },
+  };
+
+  manager.dismissInformationPanel = function (id) {
+    state.UI.dismissedInfoPanels[id] = true;
+    LocalStorage.storeUIState(state.UI);
+  };
+
+  manager.dismissImportantInformation = function (hash) {
+    state.UI.dismissedInfoHash = hash;
+    LocalStorage.storeUIState(state.UI);
+  };
+
+  manager.setRequiredPasswordLength = function (length) {
+    state.UI.requiredPasswordLength = length;
+    LocalStorage.storeUIState(state.UI);
+  };
+
+  manager.setPasswordChangeSkipped = function (userID) {
+    state.UI.instanceId = state.UI.instanceId || state.application.instanceId;
+    state.UI.timesPasswordChangeSkipped[userID] = state.UI.timesPasswordChangeSkipped[userID] + 1 || 1;
+    LocalStorage.storeUIState(state.UI);
+  };
+
+  manager.resetPasswordChangeSkips = function (userID) {
+    if (!state.UI.timesPasswordChangeSkipped) {
+      return;
+    }
+    if (state.UI.timesPasswordChangeSkipped[userID]) state.UI.timesPasswordChangeSkipped[userID] = 0;
+    LocalStorage.storeUIState(state.UI);
+  };
+
+  manager.clearPasswordChangeSkips = function () {
+    state.UI.timesPasswordChangeSkipped = {};
+    LocalStorage.storeUIState(state.UI);
+  };
+
+  manager.getState = function () {
+    return state;
+  };
+
+  manager.clean = function () {
+    manager.cleanEndpoint();
+    state.application = {};
+  };
+
+  manager.cleanEndpoint = function () {
+    state.endpoint = {};
+    EndpointProvider.clean();
+    LocalStorage.cleanEndpointState();
+  };
+
+  manager.updateLogo = function (logoURL) {
+    state.application.logo = logoURL;
+    LocalStorage.storeApplicationState(state.application);
+  };
+
+  manager.updateSnapshotInterval = function (interval) {
+    state.application.snapshotInterval = interval;
+    LocalStorage.storeApplicationState(state.application);
+  };
+
+  manager.updateEnableEdgeComputeFeatures = function updateEnableEdgeComputeFeatures(enableEdgeComputeFeatures) {
+    state.application.enableEdgeComputeFeatures = enableEdgeComputeFeatures;
+    LocalStorage.storeApplicationState(state.application);
+  };
+
+  function assignStateFromStatusAndSettings(status, settings) {
+    state.application.version = status.Version;
+    state.application.edition = status.Edition;
+    state.application.instanceId = status.InstanceID;
+
+    state.application.logo = settings.LogoURL;
+    state.application.snapshotInterval = settings.SnapshotInterval;
+    state.application.enableEdgeComputeFeatures = settings.EnableEdgeComputeFeatures;
+    state.application.validity = moment().unix();
+  }
+
+  function loadApplicationState() {
+    var deferred = $q.defer();
+
+    $q.all({
+      settings: SettingsService.publicSettings(),
+      status: StatusService.status(),
+    })
+      .then(function success(data) {
+        var status = data.status;
+        var settings = data.settings;
+        assignStateFromStatusAndSettings(status, settings);
+        LocalStorage.storeApplicationState(state.application);
+        deferred.resolve(state);
+      })
+      .catch(function error(err) {
+        deferred.reject({ msg: 'Unable to retrieve server settings and status', err: err });
+      });
+
+    return deferred.promise;
+  }
+
+  manager.initialize = initialize;
+  async function initialize() {
+    return $async(async () => {
+      const endpointState = LocalStorage.getEndpointState();
+      if (endpointState) {
+        state.endpoint = endpointState;
+      }
+
+      const applicationState = LocalStorage.getApplicationState();
+      if (isAppStateValid(applicationState)) {
+        state.application = applicationState;
+      } else {
+        await loadApplicationState();
+      }
+
+      const UIState = LocalStorage.getUIState();
+      if (UIState) {
+        state.UI = UIState;
+        if (state.UI.instanceId && state.UI.instanceId !== state.application.instanceId) {
+          state.UI.instanceId = state.application.instanceId;
+          state.UI.timesPasswordChangeSkipped = {};
+          LocalStorage.storeUIState(state.UI);
+        }
+      }
+
+      state.loading = false;
+      return state;
+    });
+  }
+
+  function isAppStateValid(appState) {
+    if (!appState || !appState.validity) {
+      return false;
+    }
+    const now = moment().unix();
+    const cacheValidity = now - appState.validity;
+    return cacheValidity < APPLICATION_CACHE_VALIDITY;
+  }
+
+  manager.updateEndpointState = function (endpoint) {
+    var deferred = $q.defer();
+
+    if (endpoint.Type === 3) {
+      state.endpoint.name = endpoint.Name;
+      state.endpoint.mode = { provider: 'AZURE' };
+      LocalStorage.storeEndpointState(state.endpoint);
+      deferred.resolve();
+      return deferred.promise;
+    } else if (endpoint.Type === 5 || endpoint.Type === 6 || endpoint.Type === 7) {
+      state.endpoint.name = endpoint.Name;
+      state.endpoint.mode = { provider: 'KUBERNETES' };
+      LocalStorage.storeEndpointState(state.endpoint);
+      deferred.resolve();
+      return deferred.promise;
+    }
+
+    $q.all({
+      version: SystemService.version(),
+      info: SystemService.info(),
+    })
+      .then(function success(data) {
+        var endpointMode = InfoHelper.determineEndpointMode(data.info, endpoint.Type);
+        var endpointAPIVersion = parseFloat(data.version.ApiVersion);
+        state.endpoint.mode = endpointMode;
+        state.endpoint.name = endpoint.Name;
+        state.endpoint.type = endpoint.Type;
+        state.endpoint.apiVersion = endpointAPIVersion;
+
+        if (endpointMode.agentProxy && endpoint.Status === 1) {
+          return AgentPingService.ping(endpoint.Id).then(function onPingSuccess(data) {
+            state.endpoint.agentApiVersion = data.version;
+          });
+        }
+      })
+      .then(function () {
+        LocalStorage.storeEndpointState(state.endpoint);
+        deferred.resolve();
+      })
+      .catch(function error(err) {
+        deferred.reject({ msg: 'Unable to connect to the Docker environment', err: err });
+      })
+      .finally(function final() {
+        state.loading = false;
+      });
+
+    return deferred.promise;
+  };
+
+  manager.getAgentApiVersion = function getAgentApiVersion() {
+    return state.endpoint.agentApiVersion;
+  };
+
+  return manager;
+}
diff --git a/app/portainer/services/terminal-window.ts b/app/portainer/services/terminal-window.ts
new file mode 100644
index 0000000..ffbaffb
--- /dev/null
+++ b/app/portainer/services/terminal-window.ts
@@ -0,0 +1,20 @@
+const terminalHeight = 495;
+
+export function terminalClose() {
+  update('100%', 'initial');
+}
+
+export function terminalResize() {
+  const contentWrapperHeight = window.innerHeight;
+  const newContentWrapperHeight = contentWrapperHeight - terminalHeight;
+  update(`${newContentWrapperHeight}px`, 'auto');
+}
+
+function update(height: string, overflowY: string) {
+  const pageWrapper = document.getElementById('pageWrapper-wrapper');
+
+  if (pageWrapper) {
+    pageWrapper.style.height = height;
+    pageWrapper.style.overflowY = overflowY;
+  }
+}
diff --git a/app/portainer/services/themeManager.js b/app/portainer/services/themeManager.js
new file mode 100644
index 0000000..e84ab35
--- /dev/null
+++ b/app/portainer/services/themeManager.js
@@ -0,0 +1,24 @@
+import { applyTheme } from '@/react/portainer/services/applyTheme';
+
+angular.module('portainer.app').service('ThemeManager', ThemeManager);
+
+// @deprecated use applyTheme instead
+export function ThemeManager() {
+  return {
+    setTheme,
+    autoTheme,
+    defaultTheme,
+  };
+
+  function setTheme(theme) {
+    applyTheme(theme);
+  }
+
+  function autoTheme() {
+    applyTheme('auto');
+  }
+
+  function defaultTheme() {
+    document.documentElement.removeAttribute('theme');
+  }
+}
diff --git a/app/portainer/services/types.ts b/app/portainer/services/types.ts
new file mode 100644
index 0000000..12978fc
--- /dev/null
+++ b/app/portainer/services/types.ts
@@ -0,0 +1,24 @@
+import { Environment } from '@/react/portainer/environments/types';
+
+export interface StateManager {
+  updateEndpointState(endpoint: Environment): Promise<void>;
+  updateLogo(logo: string): void;
+  updateSnapshotInterval(interval: string): void;
+}
+
+export interface IAuthenticationService {
+  getUserDetails(): { ID: number };
+  isAuthenticated(): boolean;
+  isAdmin(noEnvScope?: boolean): boolean;
+  isPureAdmin(): boolean;
+  hasAuthorizations(authorizations: string[]): boolean;
+
+  init(): Promise<boolean>;
+  //     OAuthLogin,
+  //     login,
+  //     logout,
+
+  //     redirectIfUnauthorized,
+}
+
+export type AsyncService = <T>(fn: () => Promise<T>) => Promise<T>;
diff --git a/app/portainer/settings/authentication/auth-method-constants.js b/app/portainer/settings/authentication/auth-method-constants.js
new file mode 100644
index 0000000..dc9bf0a
--- /dev/null
+++ b/app/portainer/settings/authentication/auth-method-constants.js
@@ -0,0 +1,11 @@
+export const authenticationMethodTypesMap = {
+  INTERNAL: 1,
+  LDAP: 2,
+  OAUTH: 3,
+};
+
+export const authenticationMethodTypesLabels = {
+  [authenticationMethodTypesMap.INTERNAL]: 'Internal',
+  [authenticationMethodTypesMap.LDAP]: 'LDAP',
+  [authenticationMethodTypesMap.OAUTH]: 'OAuth',
+};
diff --git a/app/portainer/settings/authentication/auth-type-constants.js b/app/portainer/settings/authentication/auth-type-constants.js
new file mode 100644
index 0000000..84de1d9
--- /dev/null
+++ b/app/portainer/settings/authentication/auth-type-constants.js
@@ -0,0 +1,11 @@
+export const authenticationActivityTypesMap = {
+  AuthSuccess: 1,
+  AuthFailure: 2,
+  Logout: 3,
+};
+
+export const authenticationActivityTypesLabels = {
+  [authenticationActivityTypesMap.AuthSuccess]: 'Authentication success',
+  [authenticationActivityTypesMap.AuthFailure]: 'Authentication failure',
+  [authenticationActivityTypesMap.Logout]: 'Logout',
+};
diff --git a/app/portainer/settings/authentication/index.js b/app/portainer/settings/authentication/index.js
new file mode 100644
index 0000000..fff63a0
--- /dev/null
+++ b/app/portainer/settings/authentication/index.js
@@ -0,0 +1,8 @@
+import angular from 'angular';
+import ldapModule from './ldap';
+import { saveAuthSettingsButton } from './save-auth-settings-button';
+
+export default angular
+  .module('portainer.settings.authentication', [ldapModule])
+
+  .component('saveAuthSettingsButton', saveAuthSettingsButton).name;
diff --git a/app/portainer/settings/authentication/ldap/ad-settings/ad-settings.controller.js b/app/portainer/settings/authentication/ldap/ad-settings/ad-settings.controller.js
new file mode 100644
index 0000000..a43a07f
--- /dev/null
+++ b/app/portainer/settings/authentication/ldap/ad-settings/ad-settings.controller.js
@@ -0,0 +1,77 @@
+import _ from 'lodash-es';
+
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+import { isLimitedToBE } from '@/react/portainer/feature-flags/feature-flags.service';
+
+export default class AdSettingsController {
+  /* @ngInject */
+  constructor(LDAPService, $scope) {
+    this.LDAPService = LDAPService;
+    this.$scope = $scope;
+
+    this.domainSuffix = '';
+    this.limitedFeatureId = FeatureId.HIDE_INTERNAL_AUTH;
+    this.onTlscaCertChange = this.onTlscaCertChange.bind(this);
+    this.searchUsers = this.searchUsers.bind(this);
+    this.searchGroups = this.searchGroups.bind(this);
+    this.parseDomainName = this.parseDomainName.bind(this);
+    this.onAccountChange = this.onAccountChange.bind(this);
+    this.onAutoUserProvisionChange = this.onAutoUserProvisionChange.bind(this);
+    this.onAutoUserProvisionChange = this.onAutoUserProvisionChange.bind(this);
+  }
+
+  onAutoUserProvisionChange(value) {
+    this.$scope.$evalAsync(() => {
+      this.settings.AutoCreateUsers = value;
+    });
+  }
+
+  parseDomainName(account) {
+    this.domainName = '';
+
+    if (!account || !account.includes('@')) {
+      return;
+    }
+
+    const [, domainName] = account.split('@');
+    if (!domainName) {
+      return;
+    }
+
+    const parts = _.compact(domainName.split('.'));
+    this.domainSuffix = parts.map((part) => `dc=${part}`).join(',');
+  }
+
+  onAccountChange(account) {
+    this.parseDomainName(account);
+  }
+
+  searchUsers() {
+    return this.LDAPService.users(this.settings);
+  }
+
+  searchGroups() {
+    return this.LDAPService.groups(this.settings);
+  }
+
+  onTlscaCertChange(file) {
+    this.tlscaCert = file;
+  }
+
+  addLDAPUrl() {
+    this.settings.URLs.push('');
+  }
+
+  removeLDAPUrl(index) {
+    this.settings.URLs.splice(index, 1);
+  }
+
+  isSaveSettingButtonDisabled() {
+    return isLimitedToBE(this.limitedFeatureId) || !this.isLdapFormValid();
+  }
+
+  $onInit() {
+    this.tlscaCert = this.settings.TLSCACert;
+    this.parseDomainName(this.settings.ReaderDN);
+  }
+}
diff --git a/app/portainer/settings/authentication/ldap/ad-settings/ad-settings.html b/app/portainer/settings/authentication/ldap/ad-settings/ad-settings.html
new file mode 100644
index 0000000..7a1207d
--- /dev/null
+++ b/app/portainer/settings/authentication/ldap/ad-settings/ad-settings.html
@@ -0,0 +1,174 @@
+<ng-form class="ad-settings" limited-feature-dir="{{::$ctrl.limitedFeatureId}}" limited-feature-class="limited-be">
+  <div class="be-indicator-container">
+    <div class="limited-be-link vertical-center"><be-feature-indicator feature="$ctrl.limitedFeatureId"></be-feature-indicator></div>
+    <div class="limited-be-content">
+      <auto-user-provision-toggle
+        value="$ctrl.settings.AutoCreateUsers"
+        on-change="($ctrl.onAutoUserProvisionChange)"
+        description="'With automatic user provisioning enabled, Portainer will create user(s) automatically with standard user role and assign them to team(s) which matches to LDAP group name(s). If disabled, users must be created in Portainer beforehand.'"
+      ></auto-user-provision-toggle>
+
+      <div>
+        <div class="col-sm-12 form-section-title"> Information </div>
+        <div class="form-group col-sm-12 text-muted small">
+          When using Microsoft AD authentication, Portainer will delegate user authentication to the Domain Controller(s) configured below; if there is no connectivity, Portainer
+          will fallback to internal authentication.
+        </div>
+      </div>
+
+      <div class="col-sm-12 form-section-title"> AD configuration </div>
+
+      <div class="form-group">
+        <div class="col-sm-12 small text-muted">
+          <p class="vertical-center">
+            <pr-icon icon="'info'" mode="'primary'"></pr-icon>
+            You can configure multiple AD Controllers for authentication fallback. Make sure all servers are using the same configuration (i.e. if TLS is enabled, they should all
+            use the same certificates).
+          </p>
+        </div>
+      </div>
+
+      <div class="form-group">
+        <label for="ldap_url" class="col-sm-3 col-lg-2 control-label text-left" style="display: flex; flex-wrap: wrap">
+          AD Controller
+          <button
+            type="button"
+            class="label label-default interactive vertical-center"
+            style="border: 0"
+            ng-click="$ctrl.addLDAPUrl()"
+            limited-feature-dir="{{::$ctrl.limitedFeatureId}}"
+            limited-feature-tabindex="-1"
+          >
+            <pr-icon icon="'plus-circle'"></pr-icon>
+            Add additional server
+          </button>
+        </label>
+        <div class="col-sm-9 col-lg-10">
+          <div ng-repeat="url in $ctrl.settings.URLs track by $index" style="display: flex; margin-bottom: 10px">
+            <input
+              type="text"
+              data-cy="ldap-url"
+              class="form-control"
+              id="ldap_url"
+              ng-model="$ctrl.settings.URLs[$index]"
+              placeholder="e.g. 10.0.0.10:389 or myldap.domain.tld:389"
+              limited-feature-dir="{{::$ctrl.limitedFeatureId}}"
+              limited-feature-tabindex="-1"
+            />
+            <button
+              ng-if="$index > 0"
+              class="btn btn-sm btn-danger"
+              type="button"
+              ng-click="$ctrl.removeLDAPUrl($index)"
+              limited-feature-dir="{{::$ctrl.limitedFeatureId}}"
+              limited-feature-tabindex="-1"
+            >
+              <pr-icon icon="'trash-2'"></pr-icon>
+            </button>
+          </div>
+        </div>
+      </div>
+
+      <div class="form-group">
+        <label for="ldap_username" class="col-sm-3 control-label text-left">
+          Service Account
+          <portainer-tooltip message="'Account that will be used to search for users.'"></portainer-tooltip>
+        </label>
+        <div class="col-sm-9">
+          <input
+            type="text"
+            data-cy="ldap-username"
+            class="form-control"
+            id="ldap_username"
+            ng-model="$ctrl.settings.ReaderDN"
+            placeholder="reader@domain.tld"
+            ng-change="$ctrl.onAccountChange($ctrl.settings.ReaderDN)"
+            limited-feature-dir="{{::$ctrl.limitedFeatureId}}"
+            limited-feature-tabindex="-1"
+          />
+        </div>
+      </div>
+
+      <div class="form-group">
+        <label for="ldap_password" class="col-sm-3 control-label text-left">
+          Service Account Password
+          <portainer-tooltip message="'If you do not enter a password, Portainer will leave the current password unchanged.'"></portainer-tooltip>
+        </label>
+        <div class="col-sm-9">
+          <input
+            type="password"
+            class="form-control"
+            id="ldap_password"
+            ng-model="$ctrl.settings.Password"
+            placeholder="password"
+            autocomplete="new-password"
+            limited-feature-dir="{{::$ctrl.limitedFeatureId}}"
+            limited-feature-tabindex="-1"
+          />
+        </div>
+      </div>
+
+      <ldap-connectivity-check
+        ng-if="!$ctrl.settings.TLSConfig.TLS && !$ctrl.settings.StartTLS"
+        settings="$ctrl.settings"
+        state="$ctrl.state"
+        connectivity-check="$ctrl.connectivityCheck"
+        limited-feature-id="$ctrl.limitedFeatureId"
+      ></ldap-connectivity-check>
+
+      <ldap-settings-security
+        title="AD Connectivity Security"
+        settings="$ctrl.settings"
+        tlsca-cert="$ctrl.tlscaCert"
+        upload-in-progress="$ctrl.state.uploadInProgress"
+        on-tlsca-cert-change="($ctrl.onTlscaCertChange)"
+        limited-feature-id="$ctrl.limitedFeatureId"
+      ></ldap-settings-security>
+
+      <ldap-connectivity-check
+        ng-if="$ctrl.settings.TLSConfig.TLS || $ctrl.settings.StartTLS"
+        settings="$ctrl.settings"
+        state="$ctrl.state"
+        connectivity-check="$ctrl.connectivityCheck"
+        limited-feature-id="$ctrl.limitedFeatureId"
+      ></ldap-connectivity-check>
+
+      <ldap-user-search
+        style="margin-top: 5px"
+        show-username-format="true"
+        settings="$ctrl.settings.SearchSettings"
+        domain-suffix="{{ $ctrl.domainSuffix }}"
+        base-filter="(objectClass=user)"
+        on-search-click="($ctrl.searchUsers)"
+        limited-feature-id="$ctrl.limitedFeatureId"
+      ></ldap-user-search>
+
+      <ldap-group-search
+        style="margin-top: 5px"
+        settings="$ctrl.settings.GroupSearchSettings"
+        domain-suffix="{{ $ctrl.domainSuffix }}"
+        base-filter="(objectClass=group)"
+        on-search-click="($ctrl.searchGroups)"
+        limited-feature-id="$ctrl.limitedFeatureId"
+      ></ldap-group-search>
+
+      <ldap-custom-admin-group
+        style="margin-top: 5px"
+        settings="$ctrl.settings"
+        on-search-click="($ctrl.onSearchAdminGroupsClick)"
+        selected-admin-groups="$ctrl.selectedAdminGroups"
+        default-admin-group-search-filter="'(objectClass=groupOfNames)'"
+        limited-feature-id="$ctrl.limitedFeatureId"
+        is-limited-feature-self-contained="false"
+      ></ldap-custom-admin-group>
+
+      <ldap-settings-test-login settings="$ctrl.settings" limited-feature-id="$ctrl.limitedFeatureId" is-limited-feature-self-contained="false"></ldap-settings-test-login>
+      <save-auth-settings-button
+        on-save-settings="($ctrl.onSaveSettings)"
+        save-button-state="($ctrl.saveButtonState)"
+        limited-feature-id="$ctrl.limitedFeatureId"
+        save-button-disabled="($ctrl.isSaveSettingButtonDisabled())"
+      ></save-auth-settings-button>
+    </div>
+  </div>
+</ng-form>
diff --git a/app/portainer/settings/authentication/ldap/ad-settings/index.js b/app/portainer/settings/authentication/ldap/ad-settings/index.js
new file mode 100644
index 0000000..5308496
--- /dev/null
+++ b/app/portainer/settings/authentication/ldap/ad-settings/index.js
@@ -0,0 +1,15 @@
+import controller from './ad-settings.controller';
+
+export const adSettings = {
+  templateUrl: './ad-settings.html',
+  controller,
+  bindings: {
+    settings: '=',
+    tlscaCert: '=',
+    state: '=',
+    connectivityCheck: '<',
+    onSaveSettings: '<',
+    saveButtonState: '<',
+    isLdapFormValid: '&?',
+  },
+};
diff --git a/app/portainer/settings/authentication/ldap/index.js b/app/portainer/settings/authentication/ldap/index.js
new file mode 100644
index 0000000..1cd8587
--- /dev/null
+++ b/app/portainer/settings/authentication/ldap/index.js
@@ -0,0 +1,34 @@
+import angular from 'angular';
+
+import { adSettings } from './ad-settings';
+import { ldapSettings } from './ldap-settings';
+import { ldapSettingsCustom } from './ldap-settings-custom';
+import { ldapSettingsOpenLdap } from './ldap-settings-openldap';
+
+import { ldapConnectivityCheck } from './ldap-connectivity-check';
+import { ldapGroupSearch } from './ldap-group-search';
+import { ldapGroupSearchItem } from './ldap-group-search-item';
+import { ldapUserSearch } from './ldap-user-search';
+import { ldapUserSearchItem } from './ldap-user-search-item';
+import { ldapCustomGroupSearch } from './ldap-custom-group-search';
+import { ldapSettingsSecurity } from './ldap-settings-security';
+import { ldapCustomUserSearch } from './ldap-custom-user-search';
+import { LDAPService } from './ldap.service';
+import { LDAP } from './ldap.rest';
+
+export default angular
+  .module('portainer.settings.authentication.ldap', [])
+  .service('LDAPService', LDAPService)
+  .service('LDAP', LDAP)
+  .component('ldapConnectivityCheck', ldapConnectivityCheck)
+  .component('ldapSettings', ldapSettings)
+  .component('adSettings', adSettings)
+  .component('ldapGroupSearch', ldapGroupSearch)
+  .component('ldapGroupSearchItem', ldapGroupSearchItem)
+  .component('ldapUserSearch', ldapUserSearch)
+  .component('ldapUserSearchItem', ldapUserSearchItem)
+  .component('ldapSettingsCustom', ldapSettingsCustom)
+  .component('ldapCustomGroupSearch', ldapCustomGroupSearch)
+  .component('ldapSettingsOpenLdap', ldapSettingsOpenLdap)
+  .component('ldapSettingsSecurity', ldapSettingsSecurity)
+  .component('ldapCustomUserSearch', ldapCustomUserSearch).name;
diff --git a/app/portainer/settings/authentication/ldap/ldap-connectivity-check/index.js b/app/portainer/settings/authentication/ldap/ldap-connectivity-check/index.js
new file mode 100644
index 0000000..93784cb
--- /dev/null
+++ b/app/portainer/settings/authentication/ldap/ldap-connectivity-check/index.js
@@ -0,0 +1,9 @@
+export const ldapConnectivityCheck = {
+  templateUrl: './ldap-connectivity-check.html',
+  bindings: {
+    settings: '<',
+    state: '<',
+    connectivityCheck: '<',
+    limitedFeatureId: '<',
+  },
+};
diff --git a/app/portainer/settings/authentication/ldap/ldap-connectivity-check/ldap-connectivity-check.html b/app/portainer/settings/authentication/ldap/ldap-connectivity-check/ldap-connectivity-check.html
new file mode 100644
index 0000000..9ac8de8
--- /dev/null
+++ b/app/portainer/settings/authentication/ldap/ldap-connectivity-check/ldap-connectivity-check.html
@@ -0,0 +1,21 @@
+<div class="form-group">
+  <label class="col-sm-3 col-lg-2 control-label vertical-center text-left">
+    Connectivity check
+    <pr-icon icon="'check'" mode="'success'" ng-if="$ctrl.state.successfulConnectivityCheck"></pr-icon>
+    <pr-icon icon="'x'" mode="'danger'" ng-if="$ctrl.state.failedConnectivityCheck"></pr-icon>
+  </label>
+  <div class="col-sm-9 col-lg-10">
+    <button
+      type="button"
+      class="btn btn-primary btn-sm"
+      ng-disabled="($ctrl.state.connectivityCheckInProgress) || (!$ctrl.settings.URLs.length) || ((!$ctrl.settings.ReaderDN || !$ctrl.settings.Password) && !$ctrl.settings.AnonymousMode)"
+      ng-click="$ctrl.connectivityCheck()"
+      button-spinner="$ctrl.state.connectivityCheckInProgress"
+      limited-feature-dir="{{::$ctrl.limitedFeatureId}}"
+      limited-feature-tabindex="-1"
+    >
+      <span ng-hide="$ctrl.state.connectivityCheckInProgress">Test connectivity</span>
+      <span ng-show="$ctrl.state.connectivityCheckInProgress">Testing connectivity...</span>
+    </button>
+  </div>
+</div>
diff --git a/app/portainer/settings/authentication/ldap/ldap-custom-group-search/index.js b/app/portainer/settings/authentication/ldap/ldap-custom-group-search/index.js
new file mode 100644
index 0000000..1f51f32
--- /dev/null
+++ b/app/portainer/settings/authentication/ldap/ldap-custom-group-search/index.js
@@ -0,0 +1,11 @@
+import controller from './ldap-custom-group-search.controller';
+
+export const ldapCustomGroupSearch = {
+  templateUrl: './ldap-custom-group-search.html',
+  controller,
+  bindings: {
+    settings: '=',
+    onSearchClick: '<',
+    limitedFeatureId: '<',
+  },
+};
diff --git a/app/portainer/settings/authentication/ldap/ldap-custom-group-search/ldap-custom-group-search.controller.js b/app/portainer/settings/authentication/ldap/ldap-custom-group-search/ldap-custom-group-search.controller.js
new file mode 100644
index 0000000..4c746f5
--- /dev/null
+++ b/app/portainer/settings/authentication/ldap/ldap-custom-group-search/ldap-custom-group-search.controller.js
@@ -0,0 +1,34 @@
+export default class LdapCustomGroupSearchController {
+  /* @ngInject */
+  constructor($async, Notifications) {
+    Object.assign(this, { $async, Notifications });
+
+    this.groups = null;
+    this.showTable = false;
+
+    this.onRemoveClick = this.onRemoveClick.bind(this);
+    this.onAddClick = this.onAddClick.bind(this);
+    this.search = this.search.bind(this);
+  }
+
+  onAddClick() {
+    this.settings.push({ GroupBaseDN: '', GroupAttribute: '', GroupFilter: '' });
+  }
+
+  onRemoveClick(index) {
+    this.settings.splice(index, 1);
+  }
+
+  search() {
+    return this.$async(async () => {
+      try {
+        this.groups = null;
+        this.showTable = true;
+        this.groups = await this.onSearchClick();
+      } catch (error) {
+        this.showTable = false;
+        this.Notifications.error('Failure', error, 'Failed to search users');
+      }
+    });
+  }
+}
diff --git a/app/portainer/settings/authentication/ldap/ldap-custom-group-search/ldap-custom-group-search.html b/app/portainer/settings/authentication/ldap/ldap-custom-group-search/ldap-custom-group-search.html
new file mode 100644
index 0000000..367f2a1
--- /dev/null
+++ b/app/portainer/settings/authentication/ldap/ldap-custom-group-search/ldap-custom-group-search.html
@@ -0,0 +1,86 @@
+<section aria-label="Group search configurations">
+  <div class="col-sm-12 form-section-title" style="float: initial"> Group search configurations </div>
+
+  <rd-widget ng-repeat="config in $ctrl.settings | limitTo: (1 - $ctrl.settings)" style="display: block; margin-bottom: 10px" data-cy="ldap-custom-group-search-config">
+    <rd-widget-body>
+      <div class="form-group" ng-if="$index > 0" style="margin-bottom: 10px">
+        <span class="col-sm-12 text-muted small"> Extra search configuration </span>
+      </div>
+
+      <div class="form-group">
+        <label for="ldap_group_basedn_{{ $index }}" class="col-sm-4 col-md-2 control-label text-left">
+          Group Base DN
+          <portainer-tooltip message="'The distinguished name of the element from which the LDAP server will search for groups.'"></portainer-tooltip>
+        </label>
+        <div class="col-sm-8 col-md-4">
+          <input
+            type="text"
+            class="form-control"
+            id="ldap_group_basedn_{{ $index }}"
+            ng-model="config.GroupBaseDN"
+            placeholder="dc=ldap,dc=domain,dc=tld"
+            data-cy="ldap-group-basedn-input"
+          />
+        </div>
+
+        <label for="ldap_group_att_{{ $index }}" class="col-sm-4 col-md-2 control-label text-left">
+          Group Membership Attribute
+          <portainer-tooltip message="'LDAP attribute which denotes the group membership.'"></portainer-tooltip>
+        </label>
+        <div class="col-sm-8 col-md-4">
+          <input type="text" class="form-control" id="ldap_group_att_{{ $index }}" ng-model="config.GroupAttribute" placeholder="member" data-cy="ldap-group-attribute-input" />
+        </div>
+      </div>
+      <div class="form-group">
+        <label for="ldap_group_filter_{{ $index }}" class="col-sm-4 col-md-2 control-label text-left">
+          Group Filter
+          <portainer-tooltip message="'The LDAP search filter used to select group elements, optional.'"></portainer-tooltip>
+        </label>
+        <div class="col-sm-8 col-md-10 vertical-center">
+          <input
+            type="text"
+            class="form-control"
+            id="ldap_group_filter_{{ $index }}"
+            ng-model="config.GroupFilter"
+            placeholder="(objectClass=account)"
+            data-cy="ldap-group-filter-input"
+          />
+          <button class="btn btn-md btn-danger" type="button" ng-click="$ctrl.onRemoveClick($index)" ng-if="$index > 0">
+            <pr-icon icon="'trash-2'" size="'md'"></pr-icon>
+          </button>
+        </div>
+      </div>
+      <div class="form-group">
+        <span class="col-sm-12 small" style="color: #ffa719">
+          <pr-icon icon="'briefcase'" class-name="'icon icon-xs vertical-center'"></pr-icon>
+          Users removal synchronize between groups and teams only available in
+          <a href="https://www.portainer.io/features?from=custom-login-banner" target="_blank">business edition.</a>
+          <portainer-tooltip
+            class="text-muted align-bottom"
+            message="'Groups allows users to automatically be added to Portainer teams. However, automatically removing users from teams to keep it fully in sync is available in the Business Edition.'"
+          ></portainer-tooltip>
+        </span>
+      </div>
+    </rd-widget-body>
+  </rd-widget>
+
+  <div class="form-group" style="margin-top: 10px">
+    <div class="col-sm-12">
+      <button class="btn btn-sm btn-light vertical-center !ml-0" ng-click="$ctrl.onAddClick()">
+        <pr-icon icon="'plus'"></pr-icon>
+        Add group search configuration
+      </button>
+    </div>
+    <div class="col-sm-12" style="margin-top: 10px">
+      <be-teaser-button
+        feature-id="$ctrl.limitedFeatureId"
+        heading="'Display User/Group matching'"
+        message="'Show the list of users and groups that match the Portainer search configurations.'"
+        button-text="'Display User/Group matching'"
+        button-class-name="'!ml-0'"
+      ></be-teaser-button>
+    </div>
+  </div>
+
+  <ldap-groups-datatable ng-if="$ctrl.showTable" dataset="$ctrl.groups"></ldap-groups-datatable>
+</section>
diff --git a/app/portainer/settings/authentication/ldap/ldap-custom-user-search/index.js b/app/portainer/settings/authentication/ldap/ldap-custom-user-search/index.js
new file mode 100644
index 0000000..06fdedd
--- /dev/null
+++ b/app/portainer/settings/authentication/ldap/ldap-custom-user-search/index.js
@@ -0,0 +1,11 @@
+import controller from './ldap-custom-user-search.controller';
+
+export const ldapCustomUserSearch = {
+  templateUrl: './ldap-custom-user-search.html',
+  controller,
+  bindings: {
+    settings: '=',
+    onSearchClick: '<',
+    limitedFeatureId: '<',
+  },
+};
diff --git a/app/portainer/settings/authentication/ldap/ldap-custom-user-search/ldap-custom-user-search.controller.js b/app/portainer/settings/authentication/ldap/ldap-custom-user-search/ldap-custom-user-search.controller.js
new file mode 100644
index 0000000..e672e9e
--- /dev/null
+++ b/app/portainer/settings/authentication/ldap/ldap-custom-user-search/ldap-custom-user-search.controller.js
@@ -0,0 +1,33 @@
+export default class LdapCustomUserSearchController {
+  /* @ngInject */
+  constructor($async, Notifications) {
+    Object.assign(this, { $async, Notifications });
+
+    this.users = null;
+
+    this.onRemoveClick = this.onRemoveClick.bind(this);
+    this.onAddClick = this.onAddClick.bind(this);
+    this.search = this.search.bind(this);
+  }
+
+  onAddClick() {
+    this.settings.push({ BaseDN: '', UserNameAttribute: '', Filter: '' });
+  }
+
+  onRemoveClick(index) {
+    this.settings.splice(index, 1);
+  }
+
+  search() {
+    return this.$async(async () => {
+      try {
+        this.users = null;
+        this.showTable = true;
+        this.users = await this.onSearchClick();
+      } catch (error) {
+        this.showTable = false;
+        this.Notifications.error('Failure', error, 'Failed to search users');
+      }
+    });
+  }
+}
diff --git a/app/portainer/settings/authentication/ldap/ldap-custom-user-search/ldap-custom-user-search.html b/app/portainer/settings/authentication/ldap/ldap-custom-user-search/ldap-custom-user-search.html
new file mode 100644
index 0000000..319c345
--- /dev/null
+++ b/app/portainer/settings/authentication/ldap/ldap-custom-user-search/ldap-custom-user-search.html
@@ -0,0 +1,68 @@
+<section aria-label="User search configurations">
+  <div class="col-sm-12 form-section-title" style="float: initial"> User search configurations </div>
+
+  <rd-widget ng-repeat="config in $ctrl.settings | limitTo: (1 - $ctrl.settings)" style="display: block; margin-bottom: 10px" data-cy="ldap-custom-user-search-config">
+    <rd-widget-body>
+      <div class="form-group" ng-if="$index > 0" style="margin-bottom: 10px">
+        <span class="col-sm-12 text-muted small"> Extra search configuration </span>
+      </div>
+
+      <div class="form-group">
+        <label for="ldap_basedn_{{ $index }}" class="col-sm-4 col-md-2 control-label text-left">
+          Base DN
+          <portainer-tooltip message="'The distinguished name of the element from which the LDAP server will search for users.'"></portainer-tooltip>
+        </label>
+        <div class="col-sm-8 col-md-4">
+          <input type="text" class="form-control" id="ldap_basedn_{{ $index }}" ng-model="config.BaseDN" placeholder="dc=ldap,dc=domain,dc=tld" data-cy="ldap-basedn-input" />
+        </div>
+
+        <label for="ldap_username_att_{{ $index }}" class="col-sm-4 col-md-3 col-lg-2 control-label text-left">
+          Username attribute
+          <portainer-tooltip message="'LDAP attribute which denotes the username.'"></portainer-tooltip>
+        </label>
+        <div class="col-sm-8 col-md-3 col-lg-4">
+          <input
+            type="text"
+            class="form-control"
+            id="ldap_username_att_{{ $index }}"
+            ng-model="config.UserNameAttribute"
+            placeholder="uid"
+            data-cy="ldap-username-attribute-input"
+          />
+        </div>
+      </div>
+      <div class="form-group">
+        <label for="ldap_filter_{{ $index }}" class="col-sm-4 col-md-2 control-label text-left">
+          Filter
+          <portainer-tooltip message="'The LDAP search filter used to select user elements, optional.'"></portainer-tooltip>
+        </label>
+        <div class="col-sm-8 col-md-10 vertical-center">
+          <input type="text" class="form-control" id="ldap_filter_{{ $index }}" ng-model="config.Filter" placeholder="(objectClass=account)" data-cy="ldap-filter-input" />
+          <button class="btn btn-md btn-danger" type="button" ng-click="$ctrl.onRemoveClick($index)" ng-if="$index > 0">
+            <pr-icon icon="'trash-2'" size="'md'"></pr-icon>
+          </button>
+        </div>
+      </div>
+    </rd-widget-body>
+  </rd-widget>
+
+  <div class="form-group" style="margin-top: 10px">
+    <div class="col-sm-12">
+      <button class="btn btn-sm btn-light vertical-center !ml-0" ng-click="$ctrl.onAddClick()">
+        <pr-icon icon="'plus'"></pr-icon>
+        Add user search configuration
+      </button>
+    </div>
+    <div class="col-sm-12" style="margin-top: 10px">
+      <be-teaser-button
+        feature-id="$ctrl.limitedFeatureId"
+        heading="'Display Users'"
+        message="'Allows you to display users from your LDAP server.'"
+        button-text="'Display Users'"
+        button-class-name="'!ml-0'"
+      ></be-teaser-button>
+    </div>
+  </div>
+
+  <ldap-users-datatable ng-if="$ctrl.showTable" dataset="$ctrl.users"></ldap-users-datatable>
+</section>
diff --git a/app/portainer/settings/authentication/ldap/ldap-group-search-item/index.js b/app/portainer/settings/authentication/ldap/ldap-group-search-item/index.js
new file mode 100644
index 0000000..62fcd5b
--- /dev/null
+++ b/app/portainer/settings/authentication/ldap/ldap-group-search-item/index.js
@@ -0,0 +1,15 @@
+import controller from './ldap-group-search-item.controller';
+
+export const ldapGroupSearchItem = {
+  templateUrl: './ldap-group-search-item.html',
+  controller,
+  bindings: {
+    config: '=',
+    index: '<',
+    domainSuffix: '@',
+    baseFilter: '@',
+
+    onRemoveClick: '<',
+    limitedFeatureId: '<',
+  },
+};
diff --git a/app/portainer/settings/authentication/ldap/ldap-group-search-item/ldap-group-search-item.controller.js b/app/portainer/settings/authentication/ldap/ldap-group-search-item/ldap-group-search-item.controller.js
new file mode 100644
index 0000000..8483615
--- /dev/null
+++ b/app/portainer/settings/authentication/ldap/ldap-group-search-item/ldap-group-search-item.controller.js
@@ -0,0 +1,53 @@
+export default class LdapSettingsAdGroupSearchItemController {
+  /* @ngInject */
+  constructor(Notifications, $scope) {
+    Object.assign(this, { Notifications, $scope });
+
+    this.groups = [];
+
+    this.onChangeBaseDN = this.onChangeBaseDN.bind(this);
+  }
+
+  onChangeBaseDN(baseDN) {
+    return this.$scope.$evalAsync(() => {
+      this.config.GroupBaseDN = baseDN;
+    });
+  }
+
+  addGroup() {
+    this.groups.push({ type: 'ou', value: '' });
+  }
+
+  removeGroup($index) {
+    this.groups.splice($index, 1);
+    this.onGroupsChange();
+  }
+
+  onGroupsChange() {
+    const groupsFilter = this.groups.map(({ type, value }) => `(${type}=${value})`).join('');
+    this.onFilterChange(groupsFilter ? `(&${this.baseFilter}(|${groupsFilter}))` : `${this.baseFilter}`);
+  }
+
+  onFilterChange(filter) {
+    this.config.GroupFilter = filter;
+  }
+
+  parseGroupFilter() {
+    const match = this.config.GroupFilter.match(/^\(&\(objectClass=(\w+)\)\(\|((\(\w+=.+\))+)\)\)$/);
+    if (!match) {
+      return;
+    }
+
+    const [, , groupFilter = ''] = match;
+
+    this.groups = groupFilter
+      .slice(1, -1)
+      .split(')(')
+      .map((str) => str.split('='))
+      .map(([type, value]) => ({ type, value }));
+  }
+
+  $onInit() {
+    this.parseGroupFilter();
+  }
+}
diff --git a/app/portainer/settings/authentication/ldap/ldap-group-search-item/ldap-group-search-item.html b/app/portainer/settings/authentication/ldap/ldap-group-search-item/ldap-group-search-item.html
new file mode 100644
index 0000000..c503a25
--- /dev/null
+++ b/app/portainer/settings/authentication/ldap/ldap-group-search-item/ldap-group-search-item.html
@@ -0,0 +1,81 @@
+<div class="w-full px-5 pt-3" data-cy="ldap-group-search-config">
+  <div ng-if="$ctrl.index > 0" style="margin-bottom: 10px">
+    <span class="text-muted small"> Extra search configuration </span>
+    <button
+      class="btn btn-sm btn-danger"
+      type="button"
+      ng-click="$ctrl.onRemoveClick($ctrl.index)"
+      limited-feature-dir="{{::$ctrl.limitedFeatureId}}"
+      limited-feature-tabindex="-1"
+    >
+      <pr-icon icon="'trash-2'"></pr-icon>
+    </button>
+  </div>
+
+  <ldap-settings-dn-builder
+    label="'Group Search Path (optional)'"
+    suffix="$ctrl.domainSuffix"
+    value="$ctrl.config.GroupBaseDN"
+    on-change="($ctrl.onChangeBaseDN)"
+    limited-feature-id="$ctrl.limitedFeatureId"
+  ></ldap-settings-dn-builder>
+
+  <div class="form-group">
+    <label class="col-sm-4 col-md-2 control-label text-left"> Group Base DN </label>
+    <div class="col-sm-8 col-md-10"> {{ $ctrl.config.GroupBaseDN }} </div>
+  </div>
+
+  <div class="form-group">
+    <div class="col-sm-12 vertical-center" style="margin-bottom: 5px">
+      <label class="control-label !pt-0 text-left">Groups</label>
+      <button class="label label-default interactive vertical-center border-0" style="margin-left: 10px" ng-click="$ctrl.addGroup()">
+        <pr-icon icon="'plus-circle'"></pr-icon>
+        add another group
+      </button>
+    </div>
+    <div class="col-sm-12" ng-if="$ctrl.groups.length">
+      <div class="w-full px-5 pt-3">
+        <div class="form-group no-margin-last-child" ng-repeat="entry in $ctrl.groups">
+          <div class="col-sm-4">
+            <select
+              class="form-control"
+              data-cy="ldap-group-search-item-select"
+              ng-model="entry.type"
+              ng-change="$ctrl.onGroupsChange()"
+              limited-feature-dir="{{::$ctrl.limitedFeatureId}}"
+              limited-feature-tabindex="-1"
+            >
+              <option value="ou">OU Name</option>
+              <option value="cn">Folder Name</option>
+            </select>
+          </div>
+          <div class="col-sm-5">
+            <input
+              class="form-control"
+              ng-model="entry.value"
+              ng-change="$ctrl.onGroupsChange()"
+              limited-feature-dir="{{::$ctrl.limitedFeatureId}}"
+              limited-feature-tabindex="-1"
+            />
+          </div>
+          <div class="col-sm-3 text-right">
+            <button
+              class="btn btn-md btn-danger"
+              type="button"
+              ng-click="$ctrl.removeGroup($index)"
+              limited-feature-dir="{{::$ctrl.limitedFeatureId}}"
+              limited-feature-tabindex="-1"
+            >
+              <pr-icon icon="'trash-2'" size="'md'"></pr-icon>
+            </button>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>
+
+  <div class="form-group no-margin-last-child">
+    <label class="col-sm-4 col-md-2 control-label text-left"> Group Filter </label>
+    <div class="col-sm-8 col-md-10" data-cy="ldap-group-filter-display"> {{ $ctrl.config.GroupFilter }} </div>
+  </div>
+</div>
diff --git a/app/portainer/settings/authentication/ldap/ldap-group-search/index.js b/app/portainer/settings/authentication/ldap/ldap-group-search/index.js
new file mode 100644
index 0000000..8b610dd
--- /dev/null
+++ b/app/portainer/settings/authentication/ldap/ldap-group-search/index.js
@@ -0,0 +1,14 @@
+import controller from './ldap-group-search.controller';
+
+export const ldapGroupSearch = {
+  templateUrl: './ldap-group-search.html',
+  controller,
+  bindings: {
+    settings: '=',
+    domainSuffix: '@',
+    baseFilter: '@',
+
+    onSearchClick: '<',
+    limitedFeatureId: '<',
+  },
+};
diff --git a/app/portainer/settings/authentication/ldap/ldap-group-search/ldap-group-search.controller.js b/app/portainer/settings/authentication/ldap/ldap-group-search/ldap-group-search.controller.js
new file mode 100644
index 0000000..c431bb2
--- /dev/null
+++ b/app/portainer/settings/authentication/ldap/ldap-group-search/ldap-group-search.controller.js
@@ -0,0 +1,36 @@
+import _ from 'lodash-es';
+
+export default class LdapGroupSearchController {
+  /* @ngInject */
+  constructor($async, Notifications) {
+    Object.assign(this, { $async, Notifications });
+
+    this.groups = null;
+
+    this.onRemoveClick = this.onRemoveClick.bind(this);
+    this.onAddClick = this.onAddClick.bind(this);
+    this.search = this.search.bind(this);
+  }
+
+  onAddClick() {
+    const lastSetting = _.last(this.settings);
+    this.settings.push({ GroupBaseDN: this.domainSuffix, GroupAttribute: lastSetting.GroupAttribute, GroupFilter: this.baseFilter });
+  }
+
+  onRemoveClick(index) {
+    this.settings.splice(index, 1);
+  }
+
+  search() {
+    return this.$async(async () => {
+      try {
+        this.groups = null;
+        this.showTable = true;
+        this.groups = await this.onSearchClick();
+      } catch (error) {
+        this.showTable = false;
+        this.Notifications.error('Failure', error, 'Failed to search users');
+      }
+    });
+  }
+}
diff --git a/app/portainer/settings/authentication/ldap/ldap-group-search/ldap-group-search.html b/app/portainer/settings/authentication/ldap/ldap-group-search/ldap-group-search.html
new file mode 100644
index 0000000..a285857
--- /dev/null
+++ b/app/portainer/settings/authentication/ldap/ldap-group-search/ldap-group-search.html
@@ -0,0 +1,30 @@
+<section aria-label="Group search configurations">
+  <div class="col-sm-12 form-section-title" style="float: initial"> Group search configurations </div>
+
+  <div style="margin-top: 10px" ng-repeat="config in $ctrl.settings | limitTo: (1 - $ctrl.settings)">
+    <ldap-group-search-item
+      config="config"
+      domain-suffix="{{ $ctrl.domainSuffix }}"
+      index="$index"
+      base-filter="{{ $ctrl.baseFilter }}"
+      on-remove-click="($ctrl.onRemoveClick)"
+      limited-feature-id="$ctrl.limitedFeatureId"
+    ></ldap-group-search-item>
+  </div>
+
+  <div class="form-group" style="margin-top: 10px">
+    <div class="col-sm-12">
+      <button class="btn btn-sm btn-light vertical-center !ml-0" ng-click="$ctrl.onAddClick()" limited-feature-dir="{{::$ctrl.limitedFeatureId}}" limited-feature-tabindex="-1">
+        <pr-icon icon="'plus'"></pr-icon>
+        Add group search configuration
+      </button>
+    </div>
+    <div class="col-sm-12" style="margin-top: 10px">
+      <button class="btn btm-sm btn-primary !ml-0" type="button" ng-click="$ctrl.search()" limited-feature-dir="{{::$ctrl.limitedFeatureId}}" limited-feature-tabindex="-1">
+        Display User/Group matching
+      </button>
+    </div>
+  </div>
+
+  <ldap-groups-datatable ng-if="$ctrl.showTable" dataset="$ctrl.groups"></ldap-groups-datatable>
+</section>
diff --git a/app/portainer/settings/authentication/ldap/ldap-settings-custom/index.js b/app/portainer/settings/authentication/ldap/ldap-settings-custom/index.js
new file mode 100644
index 0000000..20aab44
--- /dev/null
+++ b/app/portainer/settings/authentication/ldap/ldap-settings-custom/index.js
@@ -0,0 +1,19 @@
+import './ldap-settings-custom.css';
+import controller from './ldap-settings-custom.controller';
+
+export const ldapSettingsCustom = {
+  templateUrl: './ldap-settings-custom.html',
+  controller,
+  bindings: {
+    settings: '=',
+    tlscaCert: '=',
+    state: '=',
+    onTlscaCertChange: '<',
+    connectivityCheck: '<',
+    onSearchUsersClick: '<',
+    onSearchGroupsClick: '<',
+    onSaveSettings: '<',
+    saveButtonState: '<',
+    saveButtonDisabled: '<',
+  },
+};
diff --git a/app/portainer/settings/authentication/ldap/ldap-settings-custom/ldap-settings-custom.controller.js b/app/portainer/settings/authentication/ldap/ldap-settings-custom/ldap-settings-custom.controller.js
new file mode 100644
index 0000000..1098b75
--- /dev/null
+++ b/app/portainer/settings/authentication/ldap/ldap-settings-custom/ldap-settings-custom.controller.js
@@ -0,0 +1,39 @@
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+
+export default class LdapSettingsCustomController {
+  /* @ngInject */
+  constructor($scope) {
+    this.$scope = $scope;
+    this.limitedFeatureId = FeatureId.EXTERNAL_AUTH_LDAP;
+
+    this.onAdminGroupSearchSettingsChange = this.onAdminGroupSearchSettingsChange.bind(this);
+    this.onAutoPopulateChange = this.onAutoPopulateChange.bind(this);
+    this.onSelectedAdminGroupsChange = this.onSelectedAdminGroupsChange.bind(this);
+  }
+
+  addLDAPUrl() {
+    this.settings.URLs.push('');
+  }
+
+  removeLDAPUrl(index) {
+    this.settings.URLs.splice(index, 1);
+  }
+
+  onAdminGroupSearchSettingsChange(settings) {
+    this.$scope.$evalAsync(() => {
+      this.settings.AdminGroupSearchSettings = settings;
+    });
+  }
+
+  onAutoPopulateChange(value) {
+    this.$scope.$evalAsync(() => {
+      this.settings.AdminAutoPopulate = value;
+    });
+  }
+
+  onSelectedAdminGroupsChange(groups) {
+    this.$scope.$evalAsync(() => {
+      this.selectedAdminGroups = groups;
+    });
+  }
+}
diff --git a/app/portainer/settings/authentication/ldap/ldap-settings-custom/ldap-settings-custom.css b/app/portainer/settings/authentication/ldap/ldap-settings-custom/ldap-settings-custom.css
new file mode 100644
index 0000000..5bff756
--- /dev/null
+++ b/app/portainer/settings/authentication/ldap/ldap-settings-custom/ldap-settings-custom.css
@@ -0,0 +1,3 @@
+label[for='anonymous_mode'].control-label {
+  padding-top: 0;
+}
diff --git a/app/portainer/settings/authentication/ldap/ldap-settings-custom/ldap-settings-custom.html b/app/portainer/settings/authentication/ldap/ldap-settings-custom/ldap-settings-custom.html
new file mode 100644
index 0000000..573650d
--- /dev/null
+++ b/app/portainer/settings/authentication/ldap/ldap-settings-custom/ldap-settings-custom.html
@@ -0,0 +1,155 @@
+<div>
+  <div class="col-sm-12 form-section-title"> Information </div>
+  <div class="form-group col-sm-12 text-muted small">
+    When using LDAP authentication, Portainer will delegate user authentication to a LDAP server and fallback to internal authentication if LDAP authentication fails.
+  </div>
+</div>
+
+<div class="col-sm-12 form-section-title"> LDAP configuration </div>
+
+<div class="form-group">
+  <div class="col-sm-12 small text-muted">
+    <p class="vertical-center">
+      <pr-icon icon="'info'" mode="'primary'"></pr-icon>
+      You can configure multiple LDAP Servers for authentication fallback. Make sure all servers are using the same configuration (i.e. if TLS is enabled, they should all use the
+      same certificates).
+    </p>
+  </div>
+</div>
+
+<div class="form-group">
+  <label for="ldap_url" class="col-sm-3 col-lg-2 control-label flex flex-wrap text-left"> LDAP Server </label>
+  <div class="col-sm-9 col-lg-10">
+    <div class="mb-3 flex" ng-repeat="url in $ctrl.settings.URLs track by $index">
+      <input
+        type="text"
+        class="form-control"
+        id="ldap_url"
+        ng-model="$ctrl.settings.URLs[$index]"
+        placeholder="e.g. 10.0.0.10:389 or myldap.domain.tld:389"
+        required
+        data-cy="ldap-url-input"
+      />
+      <button ng-if="$index > 0" class="btn btn-sm btn-danger" type="button" ng-click="$ctrl.removeLDAPUrl($index)">
+        <pr-icon icon="'trash-2'" size="'md'"></pr-icon>
+      </button>
+    </div>
+  </div>
+  <div class="col-sm-12">
+    <be-teaser-button
+      feature-id="$ctrl.limitedFeatureId"
+      heading="'Add additional server'"
+      message="'Allows you to add an additional LDAP server.'"
+      button-text="'Add additional server'"
+      button-class-name="'!ml-0'"
+    ></be-teaser-button>
+  </div>
+</div>
+
+<div class="form-group">
+  <label for="anonymous_mode" class="control-label col-sm-3 col-lg-2 text-left">
+    Anonymous mode
+    <portainer-tooltip message="'Enable this option if the server is configured for Anonymous access.'"></portainer-tooltip>
+  </label>
+  <div class="col-sm-9 col-lg-10">
+    <label class="switch">
+      <input
+        type="checkbox"
+        id="anonymous_mode"
+        ng-model="$ctrl.settings.AnonymousMode"
+        limited-feature-dir="{{::$ctrl.limitedFeatureId}}"
+        limited-feature-tabindex="-1"
+        data-cy="anonymous-mode-checkbox"
+      />
+      <span class="slider round"></span>
+    </label>
+  </div>
+</div>
+<!-- !Anonymous mode-->
+
+<div ng-if="!$ctrl.settings.AnonymousMode">
+  <div class="form-group">
+    <label for="ldap_username" class="col-sm-3 col-lg-2 control-label text-left">
+      Reader DN
+      <portainer-tooltip message="'Account that will be used to search for users.'"></portainer-tooltip>
+    </label>
+    <div class="col-sm-9 col-lg-10">
+      <input type="text" class="form-control" id="ldap_username" ng-model="$ctrl.settings.ReaderDN" placeholder="cn=user,dc=domain,dc=tld" data-cy="ldap-username-input" />
+    </div>
+  </div>
+
+  <div class="form-group">
+    <label for="ldap_password" class="col-sm-3 col-lg-2 control-label text-left">
+      Password
+      <portainer-tooltip message="'If you do not enter a password, Portainer will leave the current password unchanged.'"></portainer-tooltip>
+    </label>
+    <div class="col-sm-9 col-lg-10">
+      <input type="password" class="form-control" id="ldap_password" ng-model="$ctrl.settings.Password" placeholder="password" autocomplete="new-password" />
+    </div>
+  </div>
+</div>
+
+<ldap-connectivity-check
+  ng-if="!$ctrl.settings.TLSConfig.TLS && !$ctrl.settings.StartTLS"
+  settings="$ctrl.settings"
+  state="$ctrl.state"
+  connectivity-check="$ctrl.connectivityCheck"
+></ldap-connectivity-check>
+
+<ldap-settings-security
+  settings="$ctrl.settings"
+  tlsca-cert="$ctrl.tlscaCert"
+  upload-in-progress="$ctrl.state.uploadInProgress"
+  on-tlsca-cert-change="($ctrl.onTlscaCertChange)"
+></ldap-settings-security>
+
+<ldap-connectivity-check
+  ng-if="$ctrl.settings.TLSConfig.TLS || $ctrl.settings.StartTLS"
+  settings="$ctrl.settings"
+  state="$ctrl.state"
+  connectivity-check="$ctrl.connectivityCheck"
+></ldap-connectivity-check>
+
+<div class="space-y-10">
+  <ldap-custom-user-search
+    class="block"
+    settings="$ctrl.settings.SearchSettings"
+    on-search-click="($ctrl.onSearchUsersClick)"
+    limited-feature-id="$ctrl.limitedFeatureId"
+  ></ldap-custom-user-search>
+
+  <ldap-custom-group-search
+    class="block"
+    settings="$ctrl.settings.GroupSearchSettings"
+    on-search-click="($ctrl.onSearchGroupsClick)"
+    limited-feature-id="$ctrl.limitedFeatureId"
+  ></ldap-custom-group-search>
+
+  <ldap-custom-admin-group
+    class="block"
+    ldap-settings="$ctrl.settings"
+    search-settings="$ctrl.settings.AdminGroupSearchSettings"
+    on-search-settings-change="($ctrl.onAdminGroupSearchSettingsChange)"
+    auto-populate="$ctrl.settings.AdminAutoPopulate"
+    on-auto-populate-change="($ctrl.onAutoPopulateChange)"
+    selected-admin-groups="$ctrl.selectedAdminGroups"
+    on-selected-admin-groups-change="($ctrl.onSelectedAdminGroupsChange)"
+    limited-feature-id="$ctrl.limitedFeatureId"
+    is-limited-feature-self-contained="true"
+  ></ldap-custom-admin-group>
+
+  <ldap-settings-test-login
+    class="block"
+    settings="$ctrl.settings"
+    limited-feature-id="$ctrl.limitedFeatureId"
+    show-be-indicator-if-needed="true"
+    is-limited-feature-self-contained="true"
+  ></ldap-settings-test-login>
+</div>
+
+<save-auth-settings-button
+  on-save-settings="($ctrl.onSaveSettings)"
+  save-button-state="($ctrl.saveButtonState)"
+  save-button-disabled="!$ctrl.saveButtonDisabled()"
+  limited-feature-dir="{{ $ctrl.limitedFeatureId }}"
+></save-auth-settings-button>
diff --git a/app/portainer/settings/authentication/ldap/ldap-settings-openldap/index.js b/app/portainer/settings/authentication/ldap/ldap-settings-openldap/index.js
new file mode 100644
index 0000000..1ae314b
--- /dev/null
+++ b/app/portainer/settings/authentication/ldap/ldap-settings-openldap/index.js
@@ -0,0 +1,18 @@
+import controller from './ldap-settings-openldap.controller';
+
+export const ldapSettingsOpenLdap = {
+  templateUrl: './ldap-settings-openldap.html',
+  controller,
+  bindings: {
+    settings: '=',
+    tlscaCert: '=',
+    state: '=',
+    connectivityCheck: '<',
+    onTlscaCertChange: '<',
+    onSearchUsersClick: '<',
+    onSearchGroupsClick: '<',
+    onSaveSettings: '<',
+    saveButtonState: '<',
+    saveButtonDisabled: '<',
+  },
+};
diff --git a/app/portainer/settings/authentication/ldap/ldap-settings-openldap/ldap-settings-openldap.controller.js b/app/portainer/settings/authentication/ldap/ldap-settings-openldap/ldap-settings-openldap.controller.js
new file mode 100644
index 0000000..6fb83ca
--- /dev/null
+++ b/app/portainer/settings/authentication/ldap/ldap-settings-openldap/ldap-settings-openldap.controller.js
@@ -0,0 +1,45 @@
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+
+export default class LdapSettingsOpenLDAPController {
+  /* @ngInject */
+  constructor() {
+    this.domainSuffix = '';
+    this.limitedFeatureId = FeatureId.EXTERNAL_AUTH_LDAP;
+
+    this.findDomainSuffix = this.findDomainSuffix.bind(this);
+    this.parseDomainSuffix = this.parseDomainSuffix.bind(this);
+    this.onAccountChange = this.onAccountChange.bind(this);
+  }
+
+  findDomainSuffix() {
+    const serviceAccount = this.settings.ReaderDN;
+    let domainSuffix = this.parseDomainSuffix(serviceAccount);
+    if (!domainSuffix && this.settings.SearchSettings.length > 0) {
+      const searchSettings = this.settings.SearchSettings[0];
+      domainSuffix = this.parseDomainSuffix(searchSettings.BaseDN);
+    }
+
+    this.domainSuffix = domainSuffix;
+  }
+
+  parseDomainSuffix(string = '') {
+    const index = string.toLowerCase().indexOf('dc=');
+    return index !== -1 ? string.substring(index) : '';
+  }
+
+  onAccountChange(serviceAccount) {
+    this.domainSuffix = this.parseDomainSuffix(serviceAccount);
+  }
+
+  addLDAPUrl() {
+    this.settings.URLs.push('');
+  }
+
+  removeLDAPUrl(index) {
+    this.settings.URLs.splice(index, 1);
+  }
+
+  $onInit() {
+    this.findDomainSuffix();
+  }
+}
diff --git a/app/portainer/settings/authentication/ldap/ldap-settings-openldap/ldap-settings-openldap.html b/app/portainer/settings/authentication/ldap/ldap-settings-openldap/ldap-settings-openldap.html
new file mode 100644
index 0000000..b43ba1a
--- /dev/null
+++ b/app/portainer/settings/authentication/ldap/ldap-settings-openldap/ldap-settings-openldap.html
@@ -0,0 +1,199 @@
+<ng-form limited-feature-dir="{{::$ctrl.limitedFeatureId}}" limited-feature-class="limited-be" class="ldap-settings-openldap">
+  <div class="be-indicator-container">
+    <div class="limited-be-link vertical-center"><be-feature-indicator feature="$ctrl.limitedFeatureId"></be-feature-indicator></div>
+    <div class="limited-be-content">
+      <div>
+        <div class="col-sm-12 form-section-title"> Information </div>
+        <div class="form-group col-sm-12 text-muted small">
+          When using LDAP authentication, Portainer will delegate user authentication to a LDAP server and fallback to internal authentication if LDAP authentication fails.
+        </div>
+      </div>
+
+      <div class="col-sm-12 form-section-title"> LDAP configuration </div>
+
+      <div class="form-group">
+        <div class="col-sm-12 small text-muted">
+          <p class="vertical-center">
+            <pr-icon icon="'info'" mode="'primary'"></pr-icon>
+            You can configure multiple LDAP Servers for authentication fallback. Make sure all servers are using the same configuration (i.e. if TLS is enabled, they should all use
+            the same certificates).
+          </p>
+        </div>
+      </div>
+
+      <div class="form-group">
+        <label for="ldap_url" class="col-sm-3 col-lg-2 control-label text-left" style="display: flex; flex-wrap: wrap">
+          LDAP Server
+          <button
+            type="button"
+            class="label label-default interactive vertical-center"
+            style="border: 0"
+            ng-click="$ctrl.addLDAPUrl()"
+            limited-feature-dir="{{::$ctrl.limitedFeatureId}}"
+            limited-feature-tabindex="-1"
+          >
+            <pr-icon icon="'plus-circle'"></pr-icon>
+            Add additional server
+          </button>
+        </label>
+        <div class="col-sm-9 col-lg-10">
+          <div ng-repeat="url in $ctrl.settings.URLs track by $index" style="display: flex; margin-bottom: 10px">
+            <input
+              type="text"
+              data-cy="ldap-url"
+              class="form-control"
+              id="ldap_url"
+              ng-model="$ctrl.settings.URLs[$index]"
+              placeholder="e.g. 10.0.0.10:389 or myldap.domain.tld:389"
+              limited-feature-dir="{{::$ctrl.limitedFeatureId}}"
+              limited-feature-tabindex="-1"
+            />
+            <button
+              ng-if="$index > 0"
+              class="btn btn-sm btn-danger"
+              type="button"
+              ng-click="$ctrl.removeLDAPUrl($index)"
+              limited-feature-dir="{{::$ctrl.limitedFeatureId}}"
+              limited-feature-tabindex="-1"
+            >
+              <pr-icon icon="'trash-2'" size="'md'"></pr-icon>
+            </button>
+          </div>
+        </div>
+      </div>
+
+      <!-- Anonymous mode-->
+      <div class="form-group">
+        <div class="col-sm-12">
+          <label for="anonymous_mode" class="control-label col-sm-3 col-lg-2 text-left">
+            Anonymous mode
+            <portainer-tooltip message="'Enable this option if the server is configured for Anonymous access.'"></portainer-tooltip>
+          </label>
+
+          <div class="col-sm-9 col-lg-10">
+            <label class="switch">
+              <input
+                type="checkbox"
+                id="anonymous_mode"
+                ng-model="$ctrl.settings.AnonymousMode"
+                limited-feature-dir="{{::$ctrl.limitedFeatureId}}"
+                limited-feature-tabindex="-1"
+                data-cy="ldap-anonymous-mode"
+              />
+              <span class="slider round"></span>
+            </label>
+          </div>
+        </div>
+      </div>
+      <!-- !Anonymous mode-->
+
+      <div ng-if="!$ctrl.settings.AnonymousMode">
+        <div class="form-group">
+          <label for="ldap_username" class="col-sm-3 col-lg-2 control-label text-left">
+            Reader DN
+            <portainer-tooltip message="'Account that will be used to search for users.'"></portainer-tooltip>
+          </label>
+          <div class="col-sm-9 col-lg-10">
+            <input
+              type="text"
+              data-cy="ldap-reader-dn"
+              class="form-control"
+              id="ldap_username"
+              ng-model="$ctrl.settings.ReaderDN"
+              placeholder="cn=user,dc=domain,dc=tld"
+              ng-change="$ctrl.onAccountChange($ctrl.settings.ReaderDN)"
+              limited-feature-dir="{{::$ctrl.limitedFeatureId}}"
+              limited-feature-tabindex="-1"
+            />
+          </div>
+        </div>
+
+        <div class="form-group">
+          <label for="ldap_password" class="col-sm-3 col-lg-2 control-label text-left">
+            Password
+            <portainer-tooltip message="'If you do not enter a password, Portainer will leave the current password unchanged.'"></portainer-tooltip>
+          </label>
+          <div class="col-sm-9">
+            <input
+              type="password"
+              class="form-control"
+              id="ldap_password"
+              ng-model="$ctrl.settings.Password"
+              placeholder="password"
+              autocomplete="new-password"
+              limited-feature-dir="{{::$ctrl.limitedFeatureId}}"
+              limited-feature-tabindex="-1"
+            />
+          </div>
+        </div>
+      </div>
+
+      <div class="form-group" ng-if="$ctrl.settings.AnonymousMode">
+        <label for="ldap_domain_root" class="col-sm-3 col-lg-2 control-label text-left"> Domain root </label>
+        <div class="col-sm-9">
+          <input
+            type="text"
+            data-cy="ldap-domain-root"
+            class="form-control"
+            id="ldap_domain_root"
+            ng-model="$ctrl.domainSuffix"
+            placeholder="dc=domain,dc=tld"
+            limited-feature-dir="{{::$ctrl.limitedFeatureId}}"
+            limited-feature-tabindex="-1"
+          />
+        </div>
+      </div>
+
+      <ldap-connectivity-check
+        ng-if="!$ctrl.settings.TLSConfig.TLS && !$ctrl.settings.StartTLS"
+        settings="$ctrl.settings"
+        state="$ctrl.state"
+        connectivity-check="$ctrl.connectivityCheck"
+        limited-feature-id="$ctrl.limitedFeatureId"
+      ></ldap-connectivity-check>
+
+      <ldap-settings-security
+        title="Connectivity Security"
+        settings="$ctrl.settings"
+        tlsca-cert="$ctrl.tlscaCert"
+        upload-in-progress="$ctrl.state.uploadInProgress"
+        on-tlsca-cert-change="($ctrl.onTlscaCertChange)"
+        limited-feature-id="$ctrl.limitedFeatureId"
+      ></ldap-settings-security>
+
+      <ldap-connectivity-check
+        ng-if="$ctrl.settings.TLSConfig.TLS || $ctrl.settings.StartTLS"
+        settings="$ctrl.settings"
+        state="$ctrl.state"
+        connectivity-check="$ctrl.connectivityCheck"
+        limited-feature-id="$ctrl.limitedFeatureId"
+      ></ldap-connectivity-check>
+
+      <ldap-user-search
+        style="margin-top: 5px"
+        settings="$ctrl.settings.SearchSettings"
+        domain-suffix="{{ $ctrl.domainSuffix }}"
+        base-filter="(objectClass=inetOrgPerson)"
+        on-search-click="($ctrl.onSearchUsersClick)"
+        limited-feature-id="$ctrl.limitedFeatureId"
+      ></ldap-user-search>
+
+      <ldap-group-search
+        style="margin-top: 5px"
+        settings="$ctrl.settings.GroupSearchSettings"
+        domain-suffix="{{ $ctrl.domainSuffix }}"
+        base-filter="(objectClass=groupOfNames)"
+        on-search-click="($ctrl.onSearchGroupsClick)"
+        limited-feature-id="$ctrl.limitedFeatureId"
+      ></ldap-group-search>
+
+      <ldap-settings-test-login settings="$ctrl.settings" limited-feature-id="$ctrl.limitedFeatureId"></ldap-settings-test-login>
+      <save-auth-settings-button
+        on-save-settings="($ctrl.onSaveSettings)"
+        save-button-state="($ctrl.saveButtonState)"
+        save-button-disabled="!$ctrl.saveButtonDisabled()"
+        limited-feature-id="$ctrl.limitedFeatureId"
+      ></save-auth-settings-button>
+    </div>
+  </div>
+</ng-form>
diff --git a/app/portainer/settings/authentication/ldap/ldap-settings-security/index.js b/app/portainer/settings/authentication/ldap/ldap-settings-security/index.js
new file mode 100644
index 0000000..35930bf
--- /dev/null
+++ b/app/portainer/settings/authentication/ldap/ldap-settings-security/index.js
@@ -0,0 +1,89 @@
+export const ldapSettingsSecurity = {
+  templateUrl: './ldap-settings-security.html',
+  bindings: {
+    settings: '=',
+    tlscaCert: '<',
+    onTlscaCertChange: '<',
+    uploadInProgress: '<',
+    title: '@',
+    limitedFeatureId: '<',
+  },
+  controller: LdapController,
+};
+
+// temp controller until the parent component is in react
+/* @ngInject */
+function LdapController($scope) {
+  const self = this;
+  self.reactValues = { startTLS: false, tls: false, tlsSkipVerify: false, caCertFile: null };
+
+  self.$onInit = $onInit;
+  self.$onChanges = $onChanges;
+  self.getUploadState = getUploadState;
+  self.onChangeReactValues = onChangeReactValues;
+
+  function $onInit() {
+    updateReactValuesFile(self.tlscaCert || null);
+    updateReactValuesFromSettings(self.settings);
+  }
+
+  function getUploadState() {
+    if (self.uploadInProgress) {
+      return 'uploading';
+    }
+
+    if (self.tlscaCert && self.tlscaCert === self.settings.TLSConfig.TLSCACert) {
+      return 'success';
+    }
+
+    return undefined;
+  }
+
+  function updateReactValuesFromSettings(settings) {
+    self.reactValues = {
+      ...self.reactValues,
+      startTLS: settings.StartTLS,
+      tls: settings.TLSConfig.TLS,
+      tlsSkipVerify: settings.TLSConfig.TLSSkipVerify,
+    };
+  }
+
+  function updateReactValuesFile(file) {
+    self.reactValues = {
+      ...self.reactValues,
+      caCertFile: file,
+    };
+  }
+
+  function onChangeReactValues(values) {
+    $scope.$evalAsync(() => {
+      self.reactValues = { ...self.reactValues, ...values };
+
+      if ('startTLS' in values) {
+        self.settings.StartTLS = values.startTLS;
+      }
+
+      if ('tls' in values) {
+        self.settings.TLSConfig.TLS = values.tls;
+      }
+
+      if ('tlsSkipVerify' in values) {
+        self.settings.TLSConfig.TLSSkipVerify = values.tlsSkipVerify;
+      }
+
+      if ('caCertFile' in values) {
+        self.tlscaCert = values.caCertFile;
+        self.onTlscaCertChange(values.caCertFile);
+      }
+    });
+  }
+
+  function $onChanges({ settings, tlscaCert }) {
+    if (settings && settings.currentValue) {
+      updateReactValuesFromSettings(settings.currentValue);
+    }
+    if (tlscaCert) {
+      updateReactValuesFile(tlscaCert.currentValue || null);
+    }
+  }
+}
diff --git a/app/portainer/settings/authentication/ldap/ldap-settings-security/ldap-settings-security.html b/app/portainer/settings/authentication/ldap/ldap-settings-security/ldap-settings-security.html
new file mode 100644
index 0000000..2fdba96
--- /dev/null
+++ b/app/portainer/settings/authentication/ldap/ldap-settings-security/ldap-settings-security.html
@@ -0,0 +1,7 @@
+<ldap-security-fieldset
+  values="$ctrl.reactValues"
+  on-change="($ctrl.onChangeReactValues)"
+  upload-state="$ctrl.getUploadState()"
+  title="$ctrl.title"
+  limited-feature-id="$ctrl.limitedFeatureId"
+></ldap-security-fieldset>
diff --git a/app/portainer/settings/authentication/ldap/ldap-settings.model.js b/app/portainer/settings/authentication/ldap/ldap-settings.model.js
new file mode 100644
index 0000000..9334a6a
--- /dev/null
+++ b/app/portainer/settings/authentication/ldap/ldap-settings.model.js
@@ -0,0 +1,61 @@
+export function buildLdapSettingsModel() {
+  return {
+    AnonymousMode: true,
+    ReaderDN: '',
+    URLs: [''],
+    ServerType: 0,
+    TLSConfig: {
+      TLS: false,
+      TLSSkipVerify: false,
+    },
+    StartTLS: false,
+    SearchSettings: [
+      {
+        BaseDN: '',
+        Filter: '',
+        UserNameAttribute: '',
+      },
+    ],
+    GroupSearchSettings: [
+      {
+        GroupBaseDN: '',
+        GroupFilter: '',
+        GroupAttribute: '',
+      },
+    ],
+    AdminGroupSearchSettings: [
+      {
+        GroupBaseDN: '',
+        GroupFilter: '',
+        GroupAttribute: '',
+      },
+    ],
+    AutoCreateUsers: true,
+  };
+}
+
+export function buildAdSettingsModel() {
+  const settings = buildLdapSettingsModel();
+
+  settings.ServerType = 2;
+  settings.AnonymousMode = false;
+  settings.SearchSettings[0].UserNameAttribute = 'sAMAccountName';
+  settings.SearchSettings[0].Filter = '(objectClass=user)';
+  settings.GroupSearchSettings[0].GroupAttribute = 'member';
+  settings.GroupSearchSettings[0].GroupFilter = '(objectClass=group)';
+
+  return settings;
+}
+
+export function buildOpenLDAPSettingsModel() {
+  const settings = buildLdapSettingsModel();
+
+  settings.ServerType = 1;
+  settings.AnonymousMode = false;
+  settings.SearchSettings[0].UserNameAttribute = 'uid';
+  settings.SearchSettings[0].Filter = '(objectClass=inetOrgPerson)';
+  settings.GroupSearchSettings[0].GroupAttribute = 'member';
+  settings.GroupSearchSettings[0].GroupFilter = '(objectClass=groupOfNames)';
+
+  return settings;
+}
diff --git a/app/portainer/settings/authentication/ldap/ldap-settings/index.js b/app/portainer/settings/authentication/ldap/ldap-settings/index.js
new file mode 100644
index 0000000..f0072f1
--- /dev/null
+++ b/app/portainer/settings/authentication/ldap/ldap-settings/index.js
@@ -0,0 +1,15 @@
+import controller from './ldap-settings.controller';
+
+export const ldapSettings = {
+  templateUrl: './ldap-settings.html',
+  controller,
+  bindings: {
+    settings: '=',
+    tlscaCert: '=',
+    state: '<',
+    connectivityCheck: '<',
+    onSaveSettings: '<',
+    saveButtonState: '<',
+    isLdapFormValid: '<',
+  },
+};
diff --git a/app/portainer/settings/authentication/ldap/ldap-settings/ldap-settings.controller.js b/app/portainer/settings/authentication/ldap/ldap-settings/ldap-settings.controller.js
new file mode 100644
index 0000000..322b3ee
--- /dev/null
+++ b/app/portainer/settings/authentication/ldap/ldap-settings/ldap-settings.controller.js
@@ -0,0 +1,77 @@
+import { buildLdapSettingsModel, buildOpenLDAPSettingsModel } from '@/portainer/settings/authentication/ldap/ldap-settings.model';
+import { options } from '@/react/portainer/settings/AuthenticationView/ldap-options';
+
+const SERVER_TYPES = {
+  CUSTOM: 0,
+  OPEN_LDAP: 1,
+  AD: 2,
+};
+
+const DEFAULT_GROUP_FILTER = '(objectClass=groupOfNames)';
+const DEFAULT_USER_FILTER = '(objectClass=inetOrgPerson)';
+
+export default class LdapSettingsController {
+  /* @ngInject */
+  constructor(LDAPService, $scope) {
+    Object.assign(this, { LDAPService, SERVER_TYPES, $scope });
+
+    this.tlscaCert = null;
+    this.settingsDrafts = {};
+
+    this.boxSelectorOptions = options;
+
+    this.onTlscaCertChange = this.onTlscaCertChange.bind(this);
+    this.searchUsers = this.searchUsers.bind(this);
+    this.searchGroups = this.searchGroups.bind(this);
+    this.onChangeServerType = this.onChangeServerType.bind(this);
+    this.onAutoUserProvisionChange = this.onAutoUserProvisionChange.bind(this);
+    this.onAutoUserProvisionChange = this.onAutoUserProvisionChange.bind(this);
+  }
+
+  onAutoUserProvisionChange(value) {
+    this.$scope.$evalAsync(() => {
+      this.settings.AutoCreateUsers = value;
+    });
+  }
+  onTlscaCertChange(file) {
+    this.tlscaCert = file;
+  }
+
+  $onInit() {
+    this.tlscaCert = this.settings.TLSConfig.TLSCACert;
+  }
+
+  onChangeServerType(serverType) {
+    this.settingsDrafts[this.settings.ServerType] = this.settings;
+
+    if (this.settingsDrafts[serverType]) {
+      this.settings = this.settingsDrafts[serverType];
+      return;
+    }
+
+    switch (serverType) {
+      case SERVER_TYPES.OPEN_LDAP:
+        this.settings = buildOpenLDAPSettingsModel();
+        break;
+      case SERVER_TYPES.CUSTOM:
+        this.settings = buildLdapSettingsModel();
+        break;
+    }
+  }
+
+  searchUsers() {
+    const settings = {
+      ...this.settings,
+      SearchSettings: this.settings.SearchSettings.map((search) => ({ ...search, Filter: search.Filter || DEFAULT_USER_FILTER })),
+    };
+    return this.LDAPService.users(settings);
+  }
+
+  searchGroups() {
+    const settings = {
+      ...this.settings,
+      GroupSearchSettings: this.settings.GroupSearchSettings.map((search) => ({ ...search, GroupFilter: search.GroupFilter || DEFAULT_GROUP_FILTER })),
+    };
+    return this.LDAPService.groups(settings);
+  }
+}
diff --git a/app/portainer/settings/authentication/ldap/ldap-settings/ldap-settings.html b/app/portainer/settings/authentication/ldap/ldap-settings/ldap-settings.html
new file mode 100644
index 0000000..da5b690
--- /dev/null
+++ b/app/portainer/settings/authentication/ldap/ldap-settings/ldap-settings.html
@@ -0,0 +1,44 @@
+<div>
+  <auto-user-provision-toggle
+    value="$ctrl.settings.AutoCreateUsers"
+    on-change="($ctrl.onAutoUserProvisionChange)"
+    description="'With automatic user provisioning enabled, Portainer will create user(s) automatically with standard user role and assign them to team(s) which matches to LDAP group name(s). If disabled, users must be created in Portainer beforehand.'"
+  ></auto-user-provision-toggle>
+
+  <box-selector
+    style="margin-bottom: 0"
+    radio-name="'ldap-server-type-selector'"
+    value="$ctrl.settings.ServerType"
+    options="$ctrl.boxSelectorOptions"
+    on-change="($ctrl.onChangeServerType)"
+    slim="true"
+    label="'Server Type'"
+  ></box-selector>
+
+  <ldap-settings-custom
+    ng-if="$ctrl.settings.ServerType === $ctrl.SERVER_TYPES.CUSTOM"
+    settings="$ctrl.settings"
+    tlsca-cert="$ctrl.tlscaCert"
+    state="$ctrl.state"
+    on-tlsca-cert-change="($ctrl.onTlscaCertChange)"
+    connectivity-check="$ctrl.connectivityCheck"
+    on-search-users-click="($ctrl.searchUsers)"
+    on-search-groups-click="($ctrl.searchGroups)"
+    on-save-settings="($ctrl.onSaveSettings)"
+    save-button-state="($ctrl.saveButtonState)"
+    save-button-disabled="$ctrl.isLdapFormValid"
+  ></ldap-settings-custom>
+  <ldap-settings-open-ldap
+    ng-if="$ctrl.settings.ServerType === $ctrl.SERVER_TYPES.OPEN_LDAP"
+    settings="$ctrl.settings"
+    tlsca-cert="$ctrl.tlscaCert"
+    state="$ctrl.state"
+    on-tlsca-cert-change="($ctrl.onTlscaCertChange)"
+    connectivity-check="$ctrl.connectivityCheck"
+    on-search-users-click="($ctrl.searchUsers)"
+    on-search-groups-click="($ctrl.searchGroups)"
+    on-save-settings="($ctrl.onSaveSettings)"
+    save-button-state="($ctrl.saveButtonState)"
+    save-button-disabled="$ctrl.isLdapFormValid"
+  ></ldap-settings-open-ldap>
+</div>
diff --git a/app/portainer/settings/authentication/ldap/ldap-user-search-item/index.js b/app/portainer/settings/authentication/ldap/ldap-user-search-item/index.js
new file mode 100644
index 0000000..32dd367
--- /dev/null
+++ b/app/portainer/settings/authentication/ldap/ldap-user-search-item/index.js
@@ -0,0 +1,15 @@
+import controller from './ldap-user-search-item.controller';
+
+export const ldapUserSearchItem = {
+  templateUrl: './ldap-user-search-item.html',
+  controller,
+  bindings: {
+    config: '=',
+    index: '<',
+    showUsernameFormat: '<',
+    domainSuffix: '@',
+    baseFilter: '@',
+    onRemoveClick: '<',
+    limitedFeatureId: '<',
+  },
+};
diff --git a/app/portainer/settings/authentication/ldap/ldap-user-search-item/ldap-user-search-item.controller.js b/app/portainer/settings/authentication/ldap/ldap-user-search-item/ldap-user-search-item.controller.js
new file mode 100644
index 0000000..8b6f599
--- /dev/null
+++ b/app/portainer/settings/authentication/ldap/ldap-user-search-item/ldap-user-search-item.controller.js
@@ -0,0 +1,72 @@
+export default class LdapUserSearchItemController {
+  /* @ngInject */
+  constructor($scope) {
+    this.$scope = $scope;
+    this.groups = [];
+
+    this.onBaseDNChange = this.onBaseDNChange.bind(this);
+    this.onGroupChange = this.onGroupChange.bind(this);
+    this.onGroupsChange = this.onGroupsChange.bind(this);
+    this.removeGroup = this.removeGroup.bind(this);
+  }
+
+  onBaseDNChange(baseDN) {
+    this.$scope.$evalAsync(() => {
+      this.config.BaseDN = baseDN;
+    });
+  }
+
+  onGroupChange(index, group) {
+    this.$scope.$evalAsync(() => {
+      this.groups = this.groups.map((g, i) => (i === index ? group : g));
+      this.onGroupsChange(this.groups);
+    });
+  }
+
+  onGroupsChange(groups) {
+    this.config.Filter = this.generateUserFilter(groups);
+  }
+
+  removeGroup(index) {
+    this.groups.splice(index, 1);
+    this.onGroupsChange(this.groups);
+  }
+
+  addGroup() {
+    this.groups.push(this.domainSuffix ? `cn=,${this.domainSuffix}` : 'cn=');
+  }
+
+  generateUserFilter(groups) {
+    const filteredGroups = groups.filter((group) => group !== this.domainSuffix);
+
+    if (!filteredGroups.length) {
+      return this.baseFilter;
+    }
+
+    const groupsFilter = filteredGroups.map((group) => `(memberOf=${group})`);
+
+    return `(&${this.baseFilter}${groupsFilter.length > 1 ? `(|${groupsFilter.join('')})` : groupsFilter[0]})`;
+  }
+
+  parseFilter() {
+    const filter = this.config.Filter;
+    if (filter === this.baseFilter) {
+      return;
+    }
+
+    if (!filter.includes('|')) {
+      const index = filter.indexOf('memberOf=');
+      if (index > -1) {
+        this.groups = [filter.slice(index + 9, -2)];
+      }
+      return;
+    }
+
+    const members = filter.slice(filter.indexOf('|') + 2, -3);
+    this.groups = members.split(')(').map((member) => member.replace('memberOf=', ''));
+  }
+
+  $onInit() {
+    this.parseFilter();
+  }
+}
diff --git a/app/portainer/settings/authentication/ldap/ldap-user-search-item/ldap-user-search-item.html b/app/portainer/settings/authentication/ldap/ldap-user-search-item/ldap-user-search-item.html
new file mode 100644
index 0000000..8e83957
--- /dev/null
+++ b/app/portainer/settings/authentication/ldap/ldap-user-search-item/ldap-user-search-item.html
@@ -0,0 +1,99 @@
+<div class="w-full px-5 pt-3" data-cy="ldap-user-search-config">
+  <div ng-if="$ctrl.index > 0" style="margin-bottom: 10px">
+    <span class="text-muted small"> Extra search configuration </span>
+    <button
+      ng-if="$ctrl.index > 0"
+      class="btn btn-sm btn-danger"
+      type="button"
+      ng-click="$ctrl.onRemoveClick($ctrl.index)"
+      limited-feature-dir="{{::$ctrl.limitedFeatureId}}"
+      limited-feature-tabindex="-1"
+    >
+      <pr-icon icon="'trash-2'"></pr-icon>
+    </button>
+  </div>
+
+  <div class="form-group" ng-if="$ctrl.showUsernameFormat">
+    <div class="col-sm-4" style="margin-bottom: 5px">
+      <label class="control-label text-left">Username Format</label>
+    </div>
+    <div class="col-sm-8">
+      <div class="input-group">
+        <div class="input-group-btn">
+          <button
+            class="btn btn-primary"
+            ng-model="$ctrl.config.UserNameAttribute"
+            uib-btn-radio="'sAMAccountName'"
+            style="margin-left: 0px"
+            limited-feature-dir="{{::$ctrl.limitedFeatureId}}"
+            limited-feature-tabindex="-1"
+            >username</button
+          >
+          <button
+            class="btn btn-primary"
+            ng-model="$ctrl.config.UserNameAttribute"
+            uib-btn-radio="'userPrincipalName'"
+            limited-feature-dir="{{::$ctrl.limitedFeatureId}}"
+            limited-feature-tabindex="-1"
+            >user@domainname</button
+          >
+        </div>
+      </div>
+    </div>
+  </div>
+
+  <div class="form-group">
+    <label class="col-sm-4 control-label text-left"> Root Domain </label>
+    <div class="col-sm-8">
+      {{ $ctrl.config.BaseDN }}
+    </div>
+  </div>
+
+  <ldap-settings-dn-builder
+    value="$ctrl.config.BaseDN"
+    label="'User Search Path (optional)'"
+    suffix="$ctrl.domainSuffix"
+    on-change="($ctrl.onBaseDNChange)"
+    limited-feature-id="$ctrl.limitedFeatureId"
+  ></ldap-settings-dn-builder>
+
+  <div class="form-group no-margin-last-child">
+    <div class="col-sm-12" style="margin-bottom: 5px">
+      <label class="control-label text-left">Allowed Groups (optional)</label>
+      <button
+        type="button"
+        class="label label-default interactive vertical-center"
+        style="margin-left: 10px; border: 0"
+        ng-click="$ctrl.addGroup()"
+        limited-feature-dir="{{::$ctrl.limitedFeatureId}}"
+        limited-feature-tabindex="-1"
+      >
+        <pr-icon icon="'plus-circle'"></pr-icon>
+        add another group
+      </button>
+    </div>
+    <div class="col-sm-12">
+      <div ng-repeat="group in $ctrl.groups track by $index" style="margin-bottom: 10px">
+        <rd-widget>
+          <rd-widget-body>
+            <ldap-settings-group-dn-builder
+              value="group"
+              index="$index"
+              suffix="$ctrl.domainSuffix"
+              on-change="($ctrl.onGroupChange)"
+              on-remove-click="($ctrl.removeGroup)"
+              limited-feature-id="$ctrl.limitedFeatureId"
+            ></ldap-settings-group-dn-builder>
+          </rd-widget-body>
+        </rd-widget>
+      </div>
+    </div>
+  </div>
+
+  <div class="form-group">
+    <label class="col-sm-4 control-label text-left"> User Filter </label>
+    <div class="col-sm-8" data-cy="ldap-user-filter-display">
+      {{ $ctrl.config.Filter }}
+    </div>
+  </div>
+</div>
diff --git a/app/portainer/settings/authentication/ldap/ldap-user-search/index.js b/app/portainer/settings/authentication/ldap/ldap-user-search/index.js
new file mode 100644
index 0000000..380ddcf
--- /dev/null
+++ b/app/portainer/settings/authentication/ldap/ldap-user-search/index.js
@@ -0,0 +1,15 @@
+import controller from './ldap-user-search.controller';
+
+export const ldapUserSearch = {
+  templateUrl: './ldap-user-search.html',
+  controller,
+  bindings: {
+    settings: '=',
+    domainSuffix: '@',
+    showUsernameFormat: '<',
+    baseFilter: '@',
+    limitedFeatureId: '<',
+
+    onSearchClick: '<',
+  },
+};
diff --git a/app/portainer/settings/authentication/ldap/ldap-user-search/ldap-user-search.controller.js b/app/portainer/settings/authentication/ldap/ldap-user-search/ldap-user-search.controller.js
new file mode 100644
index 0000000..6d5ff11
--- /dev/null
+++ b/app/portainer/settings/authentication/ldap/ldap-user-search/ldap-user-search.controller.js
@@ -0,0 +1,38 @@
+import _ from 'lodash';
+
+export default class LdapUserSearchController {
+  /* @ngInject */
+  constructor($async, Notifications) {
+    Object.assign(this, { $async, Notifications });
+
+    this.users = null;
+    this.showTable = false;
+
+    this.onRemoveClick = this.onRemoveClick.bind(this);
+    this.onAddClick = this.onAddClick.bind(this);
+    this.search = this.search.bind(this);
+  }
+
+  onAddClick() {
+    const lastSetting = _.last(this.settings);
+    this.settings.push({ BaseDN: this.domainSuffix, UserNameAttribute: lastSetting.UserNameAttribute, Filter: this.baseFilter });
+  }
+
+  onRemoveClick(index) {
+    this.settings.splice(index, 1);
+  }
+
+  search() {
+    return this.$async(async () => {
+      try {
+        this.users = null;
+        this.showTable = true;
+        const users = await this.onSearchClick();
+        this.users = _.compact(users);
+      } catch (error) {
+        this.Notifications.error('Failure', error, 'Failed to search users');
+        this.showTable = false;
+      }
+    });
+  }
+}
diff --git a/app/portainer/settings/authentication/ldap/ldap-user-search/ldap-user-search.html b/app/portainer/settings/authentication/ldap/ldap-user-search/ldap-user-search.html
new file mode 100644
index 0000000..fd42564
--- /dev/null
+++ b/app/portainer/settings/authentication/ldap/ldap-user-search/ldap-user-search.html
@@ -0,0 +1,37 @@
+<section aria-label="User search configurations">
+  <div class="col-sm-12 form-section-title" style="float: initial"> User search configurations </div>
+
+  <div style="margin-top: 10px" ng-repeat="config in $ctrl.settings | limitTo: (1 - $ctrl.settings)">
+    <ldap-user-search-item
+      index="$index"
+      config="config"
+      domain-suffix="{{ $ctrl.domainSuffix }}"
+      show-username-format="$ctrl.showUsernameFormat"
+      base-filter="{{ $ctrl.baseFilter }}"
+      on-remove-click="($ctrl.onRemoveClick)"
+      limited-feature-id="$ctrl.limitedFeatureId"
+    ></ldap-user-search-item>
+  </div>
+
+  <div class="form-group" style="margin-top: 10px">
+    <div class="col-sm-12">
+      <button
+        class="label label-default interactive vertical-center"
+        style="border: 0"
+        ng-click="$ctrl.onAddClick()"
+        limited-feature-dir="{{::$ctrl.limitedFeatureId}}"
+        limited-feature-tabindex="-1"
+      >
+        <pr-icon icon="'plus-circle'"></pr-icon>
+        Add user search configuration
+      </button>
+    </div>
+    <div class="col-sm-12" style="margin-top: 10px">
+      <button class="btn btm-sm btn-primary" type="button" ng-click="$ctrl.search()" limited-feature-dir="{{::$ctrl.limitedFeatureId}}" limited-feature-tabindex="-1">
+        Display Users
+      </button>
+    </div>
+  </div>
+
+  <ldap-users-datatable ng-if="$ctrl.showTable" dataset="$ctrl.users"></ldap-users-datatable>
+</section>
diff --git a/app/portainer/settings/authentication/ldap/ldap.rest.js b/app/portainer/settings/authentication/ldap/ldap.rest.js
new file mode 100644
index 0000000..e93d527
--- /dev/null
+++ b/app/portainer/settings/authentication/ldap/ldap.rest.js
@@ -0,0 +1,15 @@
+const API_ENDPOINT_LDAP = 'api/ldap';
+
+/* @ngInject */
+export function LDAP($resource) {
+  return $resource(
+    `${API_ENDPOINT_LDAP}/:action`,
+    {},
+    {
+      check: { method: 'POST', params: { action: 'check' } },
+      users: { method: 'POST', isArray: true, params: { action: 'users' } },
+      groups: { method: 'POST', isArray: true, params: { action: 'groups' } },
+      testLogin: { method: 'POST', params: { action: 'test' } },
+    }
+  );
+}
diff --git a/app/portainer/settings/authentication/ldap/ldap.service.js b/app/portainer/settings/authentication/ldap/ldap.service.js
new file mode 100644
index 0000000..875f83a
--- /dev/null
+++ b/app/portainer/settings/authentication/ldap/ldap.service.js
@@ -0,0 +1,29 @@
+/* @ngInject */
+export function LDAPService(LDAP) {
+  return { users, groups, check, testLogin };
+
+  function users(ldapSettings) {
+    return LDAP.users({ ldapSettings }).$promise;
+  }
+
+  async function groups(ldapSettings) {
+    const userGroups = await LDAP.groups({ ldapSettings }).$promise;
+    return userGroups.map(({ Name, Groups }) => {
+      let name = Name;
+      if (Name.includes(',') && Name.includes('=')) {
+        const [cnName] = Name.split(',');
+        const split = cnName.split('=');
+        name = split[1];
+      }
+      return { Groups, Name: name };
+    });
+  }
+
+  function check(ldapSettings) {
+    return LDAP.check({ ldapSettings }).$promise;
+  }
+
+  function testLogin(ldapSettings, username, password) {
+    return LDAP.testLogin({ ldapSettings, username, password }).$promise;
+  }
+}
diff --git a/app/portainer/settings/authentication/save-auth-settings-button/index.js b/app/portainer/settings/authentication/save-auth-settings-button/index.js
new file mode 100644
index 0000000..6aa7c94
--- /dev/null
+++ b/app/portainer/settings/authentication/save-auth-settings-button/index.js
@@ -0,0 +1,11 @@
+export const saveAuthSettingsButton = {
+  templateUrl: './save-auth-settings-button.html',
+  bindings: {
+    onSaveSettings: '<',
+    saveButtonDisabled: '<',
+    saveButtonState: '<',
+    limitedFeatureId: '<',
+    limitedFeatureClass: '<',
+    className: '<',
+  },
+};
diff --git a/app/portainer/settings/authentication/save-auth-settings-button/save-auth-settings-button.html b/app/portainer/settings/authentication/save-auth-settings-button/save-auth-settings-button.html
new file mode 100644
index 0000000..5e797f2
--- /dev/null
+++ b/app/portainer/settings/authentication/save-auth-settings-button/save-auth-settings-button.html
@@ -0,0 +1,17 @@
+<div class="col-sm-12 form-section-title"> Actions </div>
+<div class="form-group">
+  <div class="col-sm-12">
+    <button
+      type="button"
+      ng-class="[$ctrl.className, 'btn btn-primary btn-sm !ml-0']"
+      ng-click="$ctrl.onSaveSettings()"
+      ng-disabled="$ctrl.saveButtonDisabled || $ctrl.saveButtonState"
+      button-spinner="$ctrl.saveButtonState"
+      limited-feature-dir="{{::$ctrl.limitedFeatureId}}"
+      limited-feature-class="{{::$ctrl.limitedFeatureClass}}"
+    >
+      <span ng-hide="$ctrl.saveButtonState">Save settings</span>
+      <span ng-show="$ctrl.saveButtonState">Saving...</span>
+    </button>
+  </div>
+</div>
diff --git a/app/portainer/settings/general/index.js b/app/portainer/settings/general/index.js
new file mode 100644
index 0000000..82d992c
--- /dev/null
+++ b/app/portainer/settings/general/index.js
@@ -0,0 +1,3 @@
+import angular from 'angular';
+
+export default angular.module('portainer.settings.general', []).name;
diff --git a/app/portainer/settings/index.js b/app/portainer/settings/index.js
new file mode 100644
index 0000000..629f9b5
--- /dev/null
+++ b/app/portainer/settings/index.js
@@ -0,0 +1,6 @@
+import angular from 'angular';
+
+import authenticationModule from './authentication';
+import generalModule from './general';
+
+export default angular.module('portainer.settings', [authenticationModule, generalModule]).name;
diff --git a/app/portainer/tags/queries.ts b/app/portainer/tags/queries.ts
new file mode 100644
index 0000000..fe4bac3
--- /dev/null
+++ b/app/portainer/tags/queries.ts
@@ -0,0 +1,48 @@
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
+
+import {
+  mutationOptions,
+  withError,
+  withInvalidate,
+} from '@/react-tools/react-query';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { createTag, getTags } from './tags.service';
+import { Tag, TagId } from './types';
+
+export const tagKeys = {
+  all: ['tags'] as const,
+  tag: (id: TagId) => [...tagKeys.all, id] as const,
+};
+
+export function useTags<T = Tag[]>({
+  select,
+  enabled = true,
+}: { select?: (tags: Tag[]) => T; enabled?: boolean } = {}) {
+  return useQuery(tagKeys.all, () => getTags(), {
+    staleTime: 50,
+    select,
+    enabled,
+    ...withError('Failed to retrieve tags'),
+  });
+}
+
+export function useTagsForEnvironment(environmentId: EnvironmentId) {
+  const { data: tags, isLoading } = useTags({
+    select: (tags) => tags.filter((tag) => tag.Endpoints[environmentId]),
+  });
+
+  return { tags, isLoading };
+}
+
+export function useCreateTagMutation() {
+  const queryClient = useQueryClient();
+
+  return useMutation(
+    createTag,
+    mutationOptions(
+      withError('Unable to create tag'),
+      withInvalidate(queryClient, [tagKeys.all])
+    )
+  );
+}
diff --git a/app/portainer/tags/tags.service.ts b/app/portainer/tags/tags.service.ts
new file mode 100644
index 0000000..f5efaf4
--- /dev/null
+++ b/app/portainer/tags/tags.service.ts
@@ -0,0 +1,38 @@
+import axios, { parseAxiosError } from '../services/axios/axios';
+
+import { Tag, TagId } from './types';
+
+export async function getTags() {
+  try {
+    const { data } = await axios.get<Tag[]>(buildUrl());
+    return data;
+  } catch (err) {
+    throw parseAxiosError(err as Error, 'Unable to retrieve tags');
+  }
+}
+
+export async function createTag(name: string) {
+  try {
+    const { data: tag } = await axios.post<Tag>(buildUrl(), { name });
+    return tag;
+  } catch (err) {
+    throw parseAxiosError(err as Error, 'Unable to create tag');
+  }
+}
+
+export async function deleteTag(id: TagId) {
+  try {
+    await axios.delete(buildUrl(id));
+  } catch (err) {
+    throw parseAxiosError(err as Error, 'Unable to delte tag');
+  }
+}
+
+function buildUrl(id?: TagId) {
+  let url = '/tags';
+  if (id) {
+    url += `/${id}`;
+  }
+
+  return url;
+}
diff --git a/app/portainer/tags/types.ts b/app/portainer/tags/types.ts
new file mode 100644
index 0000000..3440871
--- /dev/null
+++ b/app/portainer/tags/types.ts
@@ -0,0 +1,7 @@
+export type TagId = number;
+
+export interface Tag {
+  ID: TagId;
+  Name: string;
+  Endpoints: Record<number, boolean>;
+}
diff --git a/app/portainer/user-activity/auth-logs-view/auth-logs-view.controller.js b/app/portainer/user-activity/auth-logs-view/auth-logs-view.controller.js
new file mode 100644
index 0000000..35744f4
--- /dev/null
+++ b/app/portainer/user-activity/auth-logs-view/auth-logs-view.controller.js
@@ -0,0 +1,106 @@
+import moment from 'moment';
+
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+
+export default class AuthLogsViewController {
+  /* @ngInject */
+  constructor($async, Notifications) {
+    this.$async = $async;
+    this.Notifications = Notifications;
+
+    this.limitedFeature = FeatureId.ACTIVITY_AUDIT;
+    this.state = {
+      keyword: '',
+      date: {
+        from: 0,
+        to: 0,
+      },
+      sort: {
+        key: 'Timestamp',
+        desc: true,
+      },
+      contextFilter: [1, 2, 3],
+      typeFilter: [1, 2, 3],
+      page: 1,
+      limit: 10,
+      totalItems: 0,
+      logs: null,
+    };
+
+    this.today = moment().endOf('day');
+    this.minValidDate = moment().subtract(7, 'd').startOf('day');
+
+    this.onChangeDate = this.onChangeDate.bind(this);
+    this.onChangeKeyword = this.onChangeKeyword.bind(this);
+    this.onChangeSort = this.onChangeSort.bind(this);
+    this.onChangeContextFilter = this.onChangeContextFilter.bind(this);
+    this.onChangeTypeFilter = this.onChangeTypeFilter.bind(this);
+    this.loadLogs = this.loadLogs.bind(this);
+    this.onChangePage = this.onChangePage.bind(this);
+    this.onChangeLimit = this.onChangeLimit.bind(this);
+  }
+
+  onChangePage(page) {
+    this.state.page = page;
+    this.loadLogs();
+  }
+
+  onChangeLimit(limit) {
+    this.state.page = 1;
+    this.state.limit = limit;
+    this.loadLogs();
+  }
+
+  onChangeSort(sort) {
+    this.state.page = 1;
+    this.state.sort = sort;
+    this.loadLogs();
+  }
+
+  onChangeContextFilter(filterKey, filterState) {
+    this.state.contextFilter = filterState;
+    this.loadLogs();
+  }
+
+  onChangeTypeFilter(filterKey, filterState) {
+    this.state.typeFilter = filterState;
+    this.loadLogs();
+  }
+
+  onChangeKeyword(keyword) {
+    return this.$scope.$evalAsync(() => {
+      this.state.page = 1;
+      this.state.keyword = keyword;
+      this.loadLogs();
+    });
+  }
+
+  onChangeDate({ startDate, endDate }) {
+    this.state.page = 1;
+    this.state.date = { to: endDate, from: startDate };
+    this.loadLogs();
+  }
+
+  async loadLogs() {
+    return this.$async(async () => {
+      this.state.logs = null;
+      try {
+        const { logs, totalCount } = { logs: [], totalCount: 0 };
+        this.state.logs = decorateLogs(logs);
+        this.state.totalItems = totalCount;
+      } catch (err) {
+        this.Notifications.error('Failure', err, 'Failed loading auth activity logs');
+      }
+    });
+  }
+
+  $onInit() {
+    return this.$async(async () => {
+      this.loadLogs();
+    });
+  }
+}
+
+function decorateLogs(logs) {
+  return logs;
+}
diff --git a/app/portainer/user-activity/auth-logs-view/auth-logs-view.html b/app/portainer/user-activity/auth-logs-view/auth-logs-view.html
new file mode 100644
index 0000000..020ff76
--- /dev/null
+++ b/app/portainer/user-activity/auth-logs-view/auth-logs-view.html
@@ -0,0 +1,52 @@
+<page-header title="'User authentication logs'" breadcrumbs="['User authentication logs']" reload="true"> </page-header>
+
+<div class="mx-4">
+  <div class="be-indicator-container limited-be">
+    <div class="limited-be-link vertical-center m-4"><be-feature-indicator feature="$ctrl.limitedFeature"></be-feature-indicator></div>
+    <!-- 15px matches the padding for col-sm-12 for the widget and table -->
+    <div class="limited-be-content !p-0 !pt-[15px]">
+      <div class="row">
+        <div class="col-sm-12">
+          <rd-widget>
+            <rd-widget-body>
+              <div class="form-horizontal">
+                <div class="form-group">
+                  <label for="dateRangeInput" class="col-sm-2 control-label text-left">Date range</label>
+                  <div class="col-sm-6">
+                    <input type="text" class="form-control" disabled />
+                  </div>
+                </div>
+              </div>
+              <p class="text-muted small vertical-center">
+                <pr-icon icon="'info'" class-name="'icon icon-sm icon-primary'"></pr-icon>
+                Portainer user authentication logs have a maximum retention of 7 days.
+              </p>
+              <div>
+                <button type="button" class="btn btn-sm btn-primary" limited-feature-dir="{{::$ctrl.limitedFeature}}" limited-feature-class="limited-be" limited-feature-disabled
+                  ><pr-icon icon="'download'" class-name="'icon icon-sm'"></pr-icon>Export as CSV
+                </button>
+              </div>
+            </rd-widget-body>
+          </rd-widget>
+        </div>
+      </div>
+      <authentication-logs-table
+        dataset="$ctrl.state.logs"
+        keyword="$ctrl.state.keyword"
+        sort="$ctrl.state.sort"
+        limit="$ctrl.state.limit"
+        context-filter="$ctrl.state.contextFilter"
+        type-filter="$ctrl.state.typeFilter"
+        total-items="$ctrl.state.totalItems"
+        current-page="$ctrl.state.currentPage"
+        feature="{{:: $ctrl.limitedFeature}}"
+        on-change-context-filter="($ctrl.onChangeContextFilter)"
+        on-change-type-filter="($ctrl.onChangeTypeFilter)"
+        on-change-keyword="($ctrl.onChangeKeyword)"
+        on-change-sort="($ctrl.onChangeSort)"
+        on-change-limit="($ctrl.onChangeLimit)"
+        on-change-page="($ctrl.onChangePage)"
+      ></authentication-logs-table>
+    </div>
+  </div>
+</div>
diff --git a/app/portainer/user-activity/auth-logs-view/auth-logs-view.js b/app/portainer/user-activity/auth-logs-view/auth-logs-view.js
new file mode 100644
index 0000000..c5cd52b
--- /dev/null
+++ b/app/portainer/user-activity/auth-logs-view/auth-logs-view.js
@@ -0,0 +1,6 @@
+import controller from './auth-logs-view.controller.js';
+
+export const authLogsView = {
+  templateUrl: './auth-logs-view.html',
+  controller,
+};
diff --git a/app/portainer/user-activity/auth-logs-view/index.js b/app/portainer/user-activity/auth-logs-view/index.js
new file mode 100644
index 0000000..5b17122
--- /dev/null
+++ b/app/portainer/user-activity/auth-logs-view/index.js
@@ -0,0 +1,5 @@
+import angular from 'angular';
+
+import { authLogsView } from './auth-logs-view';
+
+export default angular.module('portainer.app.user-activity.auth-logs-view', []).component('authLogsView', authLogsView).name;
diff --git a/app/portainer/user-activity/index.js b/app/portainer/user-activity/index.js
new file mode 100644
index 0000000..0a04640
--- /dev/null
+++ b/app/portainer/user-activity/index.js
@@ -0,0 +1,61 @@
+import angular from 'angular';
+
+import { NotificationsViewAngular } from '@/react/portainer/notifications/NotificationsView';
+import { AccessHeaders } from '../authorization-guard';
+import authLogsViewModule from './auth-logs-view';
+import { UserActivityService } from './user-activity.service';
+import { UserActivity } from './user-activity.rest';
+
+export default angular
+  .module('portainer.app.user-activity', [authLogsViewModule])
+  .service('UserActivity', UserActivity)
+  .service('UserActivityService', UserActivityService)
+  .component('notifications', NotificationsViewAngular)
+  .config(config).name;
+
+/* @ngInject */
+function config($stateRegistryProvider) {
+  $stateRegistryProvider.register({
+    name: 'portainer.authLogs',
+    url: '/auth-logs',
+    views: {
+      'content@': {
+        component: 'authLogsView',
+      },
+    },
+    data: {
+      docs: '/admin/logs',
+      access: AccessHeaders.Admin,
+    },
+  });
+
+  $stateRegistryProvider.register({
+    name: 'portainer.activityLogs',
+    url: '/activity-logs',
+    views: {
+      'content@': {
+        component: 'activityLogsView',
+      },
+    },
+    data: {
+      docs: '/admin/logs/activity',
+      access: AccessHeaders.Admin,
+    },
+  });
+
+  $stateRegistryProvider.register({
+    name: 'portainer.notifications',
+    url: '/notifications',
+    views: {
+      'content@': {
+        component: 'notifications',
+      },
+    },
+    params: {
+      id: '',
+    },
+    data: {
+      docs: '/admin/notifications',
+    },
+  });
+}
diff --git a/app/portainer/user-activity/user-activity.rest.js b/app/portainer/user-activity/user-activity.rest.js
new file mode 100644
index 0000000..4ed527e
--- /dev/null
+++ b/app/portainer/user-activity/user-activity.rest.js
@@ -0,0 +1,28 @@
+import { baseHref } from '@/portainer/helpers/pathHelper';
+
+/* @ngInject */
+export function UserActivity($resource, $http) {
+  const BASE_URL = baseHref() + 'api/useractivity';
+
+  const resource = $resource(
+    `${BASE_URL}/:action`,
+    {},
+    {
+      authLogs: { method: 'GET', params: { action: 'authlogs' } },
+    }
+  );
+
+  return { authLogsAsCSV, ...resource };
+
+  async function authLogsAsCSV(params) {
+    return $http({
+      method: 'GET',
+      url: `${BASE_URL}/authlogs.csv`,
+      params,
+      responseType: 'blob',
+      headers: {
+        'Content-type': 'text/csv',
+      },
+    });
+  }
+}
diff --git a/app/portainer/user-activity/user-activity.service.js b/app/portainer/user-activity/user-activity.service.js
new file mode 100644
index 0000000..5c3c454
--- /dev/null
+++ b/app/portainer/user-activity/user-activity.service.js
@@ -0,0 +1,13 @@
+/* @ngInject */
+export function UserActivityService(FileSaver, UserActivity) {
+  return { authLogs, saveAuthLogsAsCSV };
+
+  function authLogs(offset, limit, sort, keyword, date, contexts, types) {
+    return UserActivity.authLogs({ offset, limit, keyword, before: date.to, after: date.from, sortBy: sort.key, sortDesc: sort.desc, contexts, types }).$promise;
+  }
+
+  async function saveAuthLogsAsCSV(sort, keyword, date, contexts, types) {
+    const response = await UserActivity.authLogsAsCSV({ keyword, before: date.to, after: date.from, sortBy: sort.key, sortDesc: sort.desc, limit: 2000, contexts, types });
+    return FileSaver.saveAs(response.data, 'logs.csv');
+  }
+}
diff --git a/app/portainer/users/queries.ts b/app/portainer/users/queries.ts
new file mode 100644
index 0000000..96fd5f5
--- /dev/null
+++ b/app/portainer/users/queries.ts
@@ -0,0 +1,61 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { TeamRole, TeamMembership } from '@/react/portainer/users/teams/types';
+import { useCurrentUser, useIsEdgeAdmin } from '@/react/hooks/useUser';
+
+import { User, UserId } from './types';
+import { getUserMemberships, getUsers } from './user.service';
+
+interface UseUserMembershipOptions<TSelect> {
+  select?(userMemberships: TeamMembership[]): TSelect;
+  enabled?: boolean;
+}
+
+export function useUserMembership<TSelect = TeamMembership[]>(
+  userId: UserId,
+  { enabled, select }: UseUserMembershipOptions<TSelect> = {}
+) {
+  return useQuery(
+    ['users', userId, 'memberships'],
+    () => getUserMemberships(userId),
+    { select, enabled }
+  );
+}
+
+export function useIsCurrentUserTeamLeader() {
+  const { user } = useCurrentUser();
+  const isAdminQuery = useIsEdgeAdmin();
+
+  const query = useUserMembership(user.Id, {
+    enabled: !isAdminQuery.isLoading && !isAdminQuery.isAdmin,
+    select: (memberships) =>
+      memberships.some((membership) => membership.Role === TeamRole.Leader),
+  });
+
+  if (isAdminQuery.isLoading) {
+    return false;
+  }
+
+  return isAdminQuery.isAdmin ? true : !!query.data;
+}
+
+export function useUsers<T = User[]>(
+  includeAdministrator = false,
+  environmentId = 0,
+  enabled = true,
+  select: (data: User[]) => T = (data) => data as unknown as T
+) {
+  const users = useQuery(
+    ['users', { includeAdministrator, environmentId }],
+    () => getUsers(includeAdministrator, environmentId),
+    {
+      meta: {
+        error: { title: 'Failure', message: 'Unable to load users' },
+      },
+      enabled,
+      select,
+    }
+  );
+
+  return users;
+}
diff --git a/app/portainer/users/queries/queryKeys.ts b/app/portainer/users/queries/queryKeys.ts
new file mode 100644
index 0000000..a31f07f
--- /dev/null
+++ b/app/portainer/users/queries/queryKeys.ts
@@ -0,0 +1,7 @@
+import { UserId } from '../types';
+
+export const userQueryKeys = {
+  base: () => ['users'] as const,
+  user: (id: UserId) => [...userQueryKeys.base(), id] as const,
+  me: () => [...userQueryKeys.base(), 'me'] as const,
+};
diff --git a/app/portainer/users/queries/useLoadCurrentUser.ts b/app/portainer/users/queries/useLoadCurrentUser.ts
new file mode 100644
index 0000000..a2547f9
--- /dev/null
+++ b/app/portainer/users/queries/useLoadCurrentUser.ts
@@ -0,0 +1,28 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios from '@/react/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+
+import { buildUrl } from '../user.service';
+import { User } from '../types';
+
+import { userQueryKeys } from './queryKeys';
+
+export interface CurrentUserResponse extends User {
+  forceChangePassword?: boolean;
+}
+
+export function useLoadCurrentUser({ staleTime }: { staleTime?: number } = {}) {
+  return useQuery(userQueryKeys.me(), () => getCurrentUser(), {
+    ...withError('Unable to retrieve user details'),
+    staleTime,
+  });
+}
+
+export async function getCurrentUser() {
+  const { data: user } = await axios.get<CurrentUserResponse>(
+    buildUrl(undefined, 'me')
+  );
+
+  return user;
+}
diff --git a/app/portainer/users/queries/useUser.ts b/app/portainer/users/queries/useUser.ts
new file mode 100644
index 0000000..c8e58e9
--- /dev/null
+++ b/app/portainer/users/queries/useUser.ts
@@ -0,0 +1,29 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/react/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+
+import { buildUrl } from '../user.service';
+import { User, UserId } from '../types';
+
+import { userQueryKeys } from './queryKeys';
+
+export function useUser(
+  id: UserId,
+  { staleTime }: { staleTime?: number } = {}
+) {
+  return useQuery(userQueryKeys.user(id), () => getUser(id), {
+    ...withError('Unable to retrieve user details'),
+    staleTime,
+  });
+}
+
+export async function getUser(id: UserId) {
+  try {
+    const { data: user } = await axios.get<User>(buildUrl(id));
+
+    return user;
+  } catch (e) {
+    throw parseAxiosError(e as Error, 'Unable to retrieve user details');
+  }
+}
diff --git a/app/portainer/users/types.ts b/app/portainer/users/types.ts
new file mode 100644
index 0000000..0b7d991
--- /dev/null
+++ b/app/portainer/users/types.ts
@@ -0,0 +1,33 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { AuthorizationMap } from '@/react/portainer/users/RolesView/types';
+
+import { type UserId } from './types/user-id';
+
+export { type UserId };
+
+export enum Role {
+  Admin = 1,
+  Standard,
+  EdgeAdmin,
+}
+
+export const RoleNames: { [key in Role]: string } = {
+  [Role.Admin]: 'administrator',
+  [Role.Standard]: 'user',
+  [Role.EdgeAdmin]: 'edge administrator',
+};
+
+export type ThemeColor = 'dark' | 'light' | 'highcontrast' | 'auto';
+
+export type User = {
+  Id: UserId;
+  Username: string;
+  Role: Role;
+  EndpointAuthorizations: {
+    [endpointId: EnvironmentId]: AuthorizationMap;
+  };
+  UseCache: boolean;
+  ThemeSettings: {
+    color: ThemeColor;
+  };
+};
diff --git a/app/portainer/users/types/user-id.ts b/app/portainer/users/types/user-id.ts
new file mode 100644
index 0000000..048cd89
--- /dev/null
+++ b/app/portainer/users/types/user-id.ts
@@ -0,0 +1 @@
+export type UserId = number;
diff --git a/app/portainer/users/user.helpers.ts b/app/portainer/users/user.helpers.ts
new file mode 100644
index 0000000..c087d4d
--- /dev/null
+++ b/app/portainer/users/user.helpers.ts
@@ -0,0 +1,34 @@
+import { Environment } from '@/react/portainer/environments/types';
+import { isEdgeEnvironment } from '@/react/portainer/environments/utils';
+
+import { Role, User } from './types';
+
+export function filterNonAdministratorUsers(users: User[]) {
+  return users.filter((user) => !isPureAdmin(user));
+}
+
+type UserLike = Pick<User, 'Role'>;
+
+// To avoid creating divergence between CE and EE
+/**
+ * isEdgeAdmin checks if the user is edge admin or admin
+ */
+export function isEdgeAdmin(
+  user: UserLike | undefined,
+  environment?: Pick<Environment, 'Type'> | null
+): boolean {
+  return (
+    isPureAdmin(user) ||
+    (user?.Role === Role.EdgeAdmin &&
+      (!environment || isEdgeEnvironment(environment.Type)))
+  );
+}
+
+// To avoid creating divergence between CE and EE
+/**
+ * isPureAdmin checks if the user is portainer admin.
+ * See bouncer.IsAdmin and bouncer.PureAdminAccess
+ */
+export function isPureAdmin(user?: UserLike): boolean {
+  return !!user && user.Role === Role.Admin;
+}
diff --git a/app/portainer/users/user.service.ts b/app/portainer/users/user.service.ts
new file mode 100644
index 0000000..2a93863
--- /dev/null
+++ b/app/portainer/users/user.service.ts
@@ -0,0 +1,45 @@
+import axios, { parseAxiosError } from '@/react/portainer/services/axios/axios';
+import { TeamMembership } from '@/react/portainer/users/teams/types';
+
+import { User, UserId } from './types';
+import { filterNonAdministratorUsers } from './user.helpers';
+
+export async function getUsers(
+  includeAdministrators = false,
+  environmentId = 0
+) {
+  try {
+    const { data } = await axios.get<User[]>(buildUrl(), {
+      params: { environmentId },
+    });
+
+    return includeAdministrators ? data : filterNonAdministratorUsers(data);
+  } catch (e) {
+    throw parseAxiosError(e as Error, 'Unable to retrieve users');
+  }
+}
+
+export async function getUserMemberships(id: UserId) {
+  try {
+    const { data } = await axios.get<TeamMembership[]>(
+      buildUrl(id, 'memberships')
+    );
+    return data;
+  } catch (err) {
+    throw parseAxiosError(err as Error, 'Unable to retrieve user memberships');
+  }
+}
+
+export function buildUrl(id?: UserId, entity?: string) {
+  let url = '/users';
+
+  if (id) {
+    url += `/${id}`;
+  }
+
+  if (entity) {
+    url += `/${entity}`;
+  }
+
+  return url;
+}
diff --git a/app/portainer/views/account/account.html b/app/portainer/views/account/account.html
new file mode 100644
index 0000000..6631fbf
--- /dev/null
+++ b/app/portainer/views/account/account.html
@@ -0,0 +1,91 @@
+<page-header title="'User settings'" breadcrumbs="['User settings']" reload="true"> </page-header>
+
+<div class="row">
+  <div class="col-lg-12 col-md-12 col-xs-12">
+    <theme-settings></theme-settings>
+  </div>
+</div>
+
+<div class="row">
+  <div class="col-lg-12 col-md-12 col-xs-12">
+    <rd-widget>
+      <rd-widget-header icon="lock" title-text="Change user password"></rd-widget-header>
+      <rd-widget-body>
+        <form name="form" class="form-horizontal" style="margin-top: 15px">
+          <!-- current-password-input -->
+          <div class="form-group">
+            <label for="current_password" class="col-sm-3 col-lg-2 control-label required text-left">Current password</label>
+            <div class="col-sm-9 col-lg-10">
+              <input type="password" class="form-control" ng-model="formValues.currentPassword" id="current_password" />
+            </div>
+          </div>
+          <!-- !current-password-input -->
+          <!-- new-password-input -->
+          <div class="form-group">
+            <label for="new_password" class="col-sm-3 col-lg-2 control-label required text-left">New password</label>
+            <div class="col-sm-9 col-lg-10">
+              <input type="password" class="form-control" ng-model="formValues.newPassword" ng-minlength="requiredPasswordLength" id="new_password" name="new_password" />
+            </div>
+          </div>
+          <!-- !new-password-input -->
+
+          <!-- confirm-password-input -->
+          <div class="form-group">
+            <label for="confirm_password" class="col-sm-3 col-lg-2 control-label required text-left">Confirm password</label>
+            <div class="col-sm-9 col-lg-10">
+              <div class="input-group">
+                <input type="password" class="form-control" ng-model="formValues.confirmPassword" id="confirm_password" />
+                <span class="input-group-addon">
+                  <pr-icon icon="'check'" class="icon-success" ng-if="formValues.newPassword === formValues.confirmPassword"></pr-icon>
+                  <pr-icon icon="'x'" class="icon-danger" ng-if="!(formValues.newPassword === formValues.confirmPassword)"></pr-icon>
+                </span>
+              </div>
+            </div>
+          </div>
+          <div class="form-group">
+            <div class="col-sm-3 col-lg-2"></div>
+            <div class="col-sm-8">
+              <password-check-hint password-valid="form.new_password.$valid && formValues.newPassword" force-change-password="forceChangePassword"></password-check-hint>
+            </div>
+          </div>
+          <!-- !confirm-password-input -->
+          <div class="form-group">
+            <div class="col-sm-12">
+              <button
+                type="submit"
+                class="btn btn-primary btn-sm"
+                ng-disabled="(AuthenticationMethod !== 1 && !isInitialAdmin) || !formValues.currentPassword || !formValues.newPassword || form.$invalid || formValues.newPassword !== formValues.confirmPassword"
+                ng-click="updatePassword()"
+              >
+                Update password
+              </button>
+              <button type="submit" class="btn btn-primary btn-sm" ng-click="skipPasswordChange()" ng-if="forceChangePassword && timesPasswordChangeSkipped < 2">
+                Remind me later
+              </button>
+              <span class="text-muted small vertical-center" style="margin-left: 5px" ng-if="AuthenticationMethod === 2 && !isInitialAdmin">
+                <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon>
+                You cannot change your password when using LDAP authentication.
+              </span>
+              <span class="text-muted small vertical-center" style="margin-left: 5px" ng-if="AuthenticationMethod === 3 && !isInitialAdmin">
+                <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon>
+                You cannot change your password when using OAuth authentication.
+              </span>
+            </div>
+          </div>
+          <div ng-if="userRole === 1">
+            <p class="text-muted vertical-center">
+              <pr-icon icon="'alert-circle'" class-name="'icon-primary'"></pr-icon>
+              Minimum password length is set <a ui-sref="portainer.settings.authentication">here.</a>
+            </p>
+          </div>
+        </form>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
+
+<application-settings-widget></application-settings-widget>
+
+<access-tokens-datatable ui-can-exit="uiCanExit()"></access-tokens-datatable>
+
+<helm-repository-datatable></helm-repository-datatable>
diff --git a/app/portainer/views/account/accountController.js b/app/portainer/views/account/accountController.js
new file mode 100644
index 0000000..8982baa
--- /dev/null
+++ b/app/portainer/views/account/accountController.js
@@ -0,0 +1,109 @@
+import { confirmChangePassword } from '@@/modals/confirm';
+import { openDialog } from '@@/modals/Dialog';
+import { buildConfirmButton } from '@@/modals/utils';
+
+angular.module('portainer.app').controller('AccountController', [
+  '$scope',
+  '$state',
+  'Authentication',
+  'UserService',
+  'Notifications',
+  'SettingsService',
+  'StateManager',
+  function ($scope, $state, Authentication, UserService, Notifications, SettingsService, StateManager) {
+    $scope.formValues = {
+      currentPassword: '',
+      newPassword: '',
+      confirmPassword: '',
+    };
+
+    $scope.updatePassword = async function () {
+      const confirmed = await confirmChangePassword();
+      if (confirmed) {
+        try {
+          await UserService.updateUserPassword($scope.userID, $scope.formValues.currentPassword, $scope.formValues.newPassword);
+          Notifications.success('Success', 'Password successfully updated');
+          StateManager.resetPasswordChangeSkips($scope.userID.toString());
+          $scope.forceChangePassword = false;
+          $state.go('portainer.logout');
+        } catch (err) {
+          Notifications.error('Failure', err, err.msg);
+        }
+      }
+    };
+
+    $scope.skipPasswordChange = async function () {
+      try {
+        if ($scope.userCanSkip()) {
+          StateManager.setPasswordChangeSkipped($scope.userID.toString());
+          $scope.forceChangePassword = false;
+          $state.go('portainer.home');
+        }
+      } catch (err) {
+        Notifications.error('Failure', err, err.msg);
+      }
+    };
+
+    $scope.userCanSkip = function () {
+      return $scope.timesPasswordChangeSkipped < 2;
+    };
+
+    this.uiCanExit = (newTransition) => {
+      if (newTransition) {
+        if ($scope.userRole === 1 && newTransition.to().name === 'portainer.settings.authentication') {
+          return true;
+        }
+        if (newTransition.to().name === 'portainer.logout') {
+          return true;
+        }
+      }
+
+      if ($scope.forceChangePassword) {
+        confirmForceChangePassword();
+      }
+      return !$scope.forceChangePassword;
+    };
+
+    $scope.uiCanExit = () => {
+      return this.uiCanExit();
+    };
+
+    function initView() {
+      const state = StateManager.getState();
+      const userDetails = Authentication.getUserDetails();
+      $scope.userID = userDetails.ID;
+      $scope.userRole = Authentication.getUserDetails().role;
+      $scope.forceChangePassword = userDetails.forceChangePassword;
+      $scope.isInitialAdmin = userDetails.ID === 1;
+
+      SettingsService.publicSettings()
+        .then(function success(data) {
+          $scope.AuthenticationMethod = data.AuthenticationMethod;
+
+          if (state.UI.requiredPasswordLength && state.UI.requiredPasswordLength !== data.RequiredPasswordLength) {
+            StateManager.clearPasswordChangeSkips();
+          }
+
+          $scope.timesPasswordChangeSkipped =
+            state.UI.timesPasswordChangeSkipped && state.UI.timesPasswordChangeSkipped[$scope.userID.toString()]
+              ? state.UI.timesPasswordChangeSkipped[$scope.userID.toString()]
+              : 0;
+
+          $scope.requiredPasswordLength = data.RequiredPasswordLength;
+          StateManager.setRequiredPasswordLength(data.RequiredPasswordLength);
+        })
+        .catch(function error(err) {
+          Notifications.error('Failure', err, 'Unable to retrieve application settings');
+        });
+    }
+
+    initView();
+  },
+]);
+
+function confirmForceChangePassword() {
+  return openDialog({
+    message: 'Please update your password to a stronger password to continue using Portainer',
+    buttons: [buildConfirmButton('OK')],
+  });
+}
diff --git a/app/portainer/views/auth/auth.html b/app/portainer/views/auth/auth.html
new file mode 100644
index 0000000..527b48b
--- /dev/null
+++ b/app/portainer/views/auth/auth.html
@@ -0,0 +1,145 @@
+<div class="page-wrapper">
+  <!-- login box -->
+  <div class="simple-box container">
+    <div class="col-sm-4 col-sm-offset-4">
+      <!-- login box logo -->
+      <div class="row">
+        <div ng-if="!ctrl.logo">
+          <img src="~@/assets/images/logo_alt.svg" class="simple-box-logo hidden th-highcontrast:!block th-dark:!block" alt="Portainer" />
+          <img src="~@/assets/images/logo_alt_black.svg" class="simple-box-logo block th-highcontrast:hidden th-dark:hidden" alt="Portainer" />
+        </div>
+        <img ng-if="ctrl.logo" ng-src="{{ ctrl.logo }}" class="simple-box-logo" />
+      </div>
+      <!-- !login box logo -->
+
+      <div class="row p-5 text-center">
+        <p class="text-xl">Log in to your account</p>
+        <p class="text-md text-muted fw-bold">Welcome back! Please enter your details</p>
+      </div>
+
+      <!-- login panel -->
+      <div class="panel panel-default" ng-if="!ctrl.state.loginInProgress">
+        <div class="panel-body">
+          <!-- login form -->
+          <form class="simple-box-form form-horizontal">
+            <div class="form-group">
+              <div class="col-sm-12" style="display: flex; justify-content: center" ng-if="ctrl.state.showOAuthLogin">
+                <a ng-href="{{ ctrl.OAuthLoginURI }}">
+                  <div class="btn btn-primary btn-lg btn-block" ng-if="ctrl.state.OAuthProvider === 'Microsoft'">
+                    <pr-icon icon="'svg-microsoft'"></pr-icon>
+                    Login with Microsoft
+                  </div>
+                  <div class="btn btn-primary btn-lg btn-block" ng-if="ctrl.state.OAuthProvider === 'Google'">
+                    <pr-icon icon="'svg-google'"></pr-icon>
+                    Login with Google
+                  </div>
+                  <div class="btn btn-primary btn-lg btn-block" ng-if="ctrl.state.OAuthProvider === 'Github'">
+                    <pr-icon icon="'svg-github'"></pr-icon>
+                    Login with GitHub
+                  </div>
+                  <div class="btn btn-primary btn-lg btn-block" ng-if="ctrl.state.OAuthProvider === 'OAuth'">
+                    <pr-icon icon="'log-in'"></pr-icon>
+                    Login with OAuth
+                  </div>
+                </a>
+              </div>
+            </div>
+
+            <!-- divider -->
+            <div class="form-group" ng-if="ctrl.state.showOAuthLogin">
+              <div class="col-sm-12" style="display: flex; align-items: center; justify-content: center">
+                <div class="striketext small text-muted" style="display: flex; align-items: center; justify-content: center; width: 90%">or</div>
+              </div>
+            </div>
+
+            <!-- use internal auth button -->
+            <div class="form-group" ng-if="ctrl.state.showOAuthLogin && !ctrl.state.showStandardLogin">
+              <div class="col-sm-12" style="display: flex; justify-content: center">
+                <div class="btn btn-primary btn-md btn-block" style="margin-left: 2px" ng-click="ctrl.toggleStandardLogin()"> Use internal authentication </div>
+              </div>
+            </div>
+
+            <!-- !username input -->
+            <div ng-if="ctrl.state.showStandardLogin">
+              <div class="pb-2">Username</div>
+              <input
+                id="username"
+                type="text"
+                data-cy="auth-usernameInput"
+                class="form-control"
+                name="username"
+                ng-model="ctrl.formValues.Username"
+                auto-focus
+                placeholder="Enter your username"
+              />
+            </div>
+
+            <!-- password input -->
+            <div ng-if="ctrl.state.showStandardLogin">
+              <div class="pb-2">Password</div>
+              <div class="relative">
+                <input
+                  id="password"
+                  ng-attr-type="{{ ctrl.state.passwordInputType }}"
+                  class="form-control pr-10"
+                  name="password"
+                  ng-model="ctrl.formValues.Password"
+                  autocomplete="off"
+                  data-cy="auth-passwordInput"
+                  placeholder="Enter your password"
+                  ng-trim="false"
+                />
+                <button
+                  data-cy="auth-passwordInputToggle"
+                  type="button"
+                  ng-click="ctrl.toggleShowPassword()"
+                  class="absolute right-0 top-0 flex h-[34px] w-[50px] items-center justify-center border-none bg-transparent"
+                  tooltip-append-to-body="true"
+                  tooltip-placement="top"
+                  tooltip-class="portainer-tooltip"
+                  uib-tooltip="{{ ctrl.state.passwordInputType === 'password' ? 'Show password' : 'Hide password' }}"
+                >
+                  <pr-icon icon="ctrl.state.passwordInputType === 'password' ? 'eye-off' : 'eye'" size="'md'"></pr-icon>
+                </button>
+              </div>
+            </div>
+
+            <div class="form-group overflow-auto" ng-if="ctrl.state.showStandardLogin">
+              <!-- login button -->
+              <div class="col-sm-12 d-flex py-1">
+                <button
+                  type="submit"
+                  class="btn btn-primary btn-lg btn-block"
+                  ng-click="ctrl.authenticateUser()"
+                  button-spinner="ctrl.state.loginInProgress"
+                  ng-disabled="ctrl.state.loginInProgress"
+                  data-cy="auth-loginButton"
+                >
+                  <span ng-hide="ctrl.state.loginInProgress">Login</span>
+                  <span ng-show="ctrl.state.loginInProgress">Login in progress...</span>
+                </button>
+              </div>
+            </div>
+          </form>
+          <!-- !login form -->
+
+          <!-- error message -->
+          <div class="pull-right" ng-if="ctrl.state.AuthenticationError">
+            <pr-icon icon="'alert-triangle'" mode="'danger'"></pr-icon>
+            <span class="small text-danger">{{ ctrl.state.AuthenticationError }}</span>
+          </div>
+        </div>
+      </div>
+
+      <!-- !login panel -->
+      <div class="panel panel-default" ng-show="ctrl.state.loginInProgress">
+        <div class="panel-body">
+          <div class="form-group text-center">
+            <span class="small text-muted">Authentication in progress... <span button-spinner="true"></span></span>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>
+  <!-- !login box -->
+</div>
diff --git a/app/portainer/views/auth/authController.js b/app/portainer/views/auth/authController.js
new file mode 100644
index 0000000..0a84f44
--- /dev/null
+++ b/app/portainer/views/auth/authController.js
@@ -0,0 +1,284 @@
+import angular from 'angular';
+import uuidv4 from 'uuid/v4';
+import { getEnvironments } from '@/react/portainer/environments/environment.service';
+import { dispatchCacheRefreshEvent } from '@/portainer/services/http-request.helper';
+import { isValidReturnUrl } from '@/portainer/helpers/url-utils';
+import { storeReturnUrl, getReturnUrl, cleanReturnUrl } from '@/react/portainer/helpers/returnUrl';
+
+class AuthenticationController {
+  /* @ngInject */
+  constructor($async, $scope, $state, $stateParams, $window, Authentication, UserService, StateManager, Notifications, SettingsService, URLHelper, LocalStorage, StatusService) {
+    this.$async = $async;
+    this.$scope = $scope;
+    this.$state = $state;
+    this.$stateParams = $stateParams;
+    this.$window = $window;
+    this.Authentication = Authentication;
+    this.UserService = UserService;
+    this.StateManager = StateManager;
+    this.Notifications = Notifications;
+    this.SettingsService = SettingsService;
+    this.URLHelper = URLHelper;
+    this.LocalStorage = LocalStorage;
+    this.StatusService = StatusService;
+
+    this.logo = this.StateManager.getState().application.logo;
+    this.formValues = {
+      Username: '',
+      Password: '',
+    };
+    this.state = {
+      passwordInputType: 'password',
+      showOAuthLogin: false,
+      showStandardLogin: false,
+      AuthenticationError: '',
+      loginInProgress: true,
+      OAuthProvider: '',
+    };
+
+    this.checkForEndpointsAsync = this.checkForEndpointsAsync.bind(this);
+    this.postLoginSteps = this.postLoginSteps.bind(this);
+
+    this.oAuthLoginAsync = this.oAuthLoginAsync.bind(this);
+    this.internalLoginAsync = this.internalLoginAsync.bind(this);
+
+    this.authenticateUserAsync = this.authenticateUserAsync.bind(this);
+
+    this.manageOauthCodeReturn = this.manageOauthCodeReturn.bind(this);
+    this.authEnabledFlowAsync = this.authEnabledFlowAsync.bind(this);
+    this.onInit = this.onInit.bind(this);
+  }
+
+  /**
+   * UTILS FUNCTIONS SECTION
+   */
+
+  toggleShowPassword() {
+    this.state.passwordInputType = this.state.passwordInputType === 'text' ? 'password' : 'text';
+  }
+
+  // set the password input type to password, so that browser autofills don't treat the input as text
+  setPasswordInputType(inputType) {
+    this.state.passwordInputType = inputType;
+    document.getElementById('password').setAttribute('type', inputType);
+  }
+
+  logout(error) {
+    this.Authentication.logout();
+    this.state.loginInProgress = false;
+    this.generateOAuthLoginURI();
+    this.LocalStorage.storeLogoutReason(error);
+    this.$window.location.reload();
+  }
+
+  error(err, message) {
+    this.state.AuthenticationError = message;
+    if (!err) {
+      err = {};
+    }
+    this.Notifications.error('Failure', err, message);
+    this.state.loginInProgress = false;
+  }
+
+  determineOauthProvider(LoginURI) {
+    if (LoginURI.indexOf('login.microsoftonline.com') !== -1) {
+      return 'Microsoft';
+    } else if (LoginURI.indexOf('accounts.google.com') !== -1) {
+      return 'Google';
+    } else if (LoginURI.indexOf('github.com') !== -1) {
+      return 'Github';
+    }
+    return 'OAuth';
+  }
+
+  generateState() {
+    const uuid = uuidv4();
+    this.LocalStorage.storeLoginStateUUID(uuid);
+    return '&state=' + uuid;
+  }
+
+  generateOAuthLoginURI() {
+    this.OAuthLoginURI = this.state.OAuthLoginURI + this.generateState();
+  }
+
+  hasValidState(state) {
+    const savedUUID = this.LocalStorage.getLoginStateUUID();
+    return savedUUID && state && savedUUID === state;
+  }
+
+  /**
+   * END UTILS FUNCTIONS SECTION
+   */
+
+  /**
+   * POST LOGIN STEPS SECTION
+   */
+
+  async checkForEndpointsAsync() {
+    try {
+      const isAdmin = this.Authentication.isAdmin();
+      const endpoints = await getEnvironments({ limit: 1, query: { excludeSnapshots: true } });
+
+      if (this.Authentication.getUserDetails().forceChangePassword) {
+        return this.$state.go('portainer.account');
+      }
+
+      if (endpoints.value.length === 0 && isAdmin) {
+        return this.$state.go('portainer.wizard');
+      }
+
+      const returnUrl = getReturnUrl();
+      cleanReturnUrl();
+      if (returnUrl && isValidReturnUrl(returnUrl)) {
+        this.$window.location.href = returnUrl;
+        return;
+      }
+
+      return this.$state.go('portainer.home');
+    } catch (err) {
+      this.error(err, 'Unable to retrieve environments');
+    }
+  }
+
+  async postLoginSteps() {
+    await this.StateManager.initialize();
+
+    await this.checkForEndpointsAsync();
+  }
+  /**
+   * END POST LOGIN STEPS SECTION
+   */
+
+  /**
+   * LOGIN METHODS SECTION
+   */
+
+  async oAuthLoginAsync(code) {
+    try {
+      await this.Authentication.OAuthLogin(code);
+      this.URLHelper.cleanParameters();
+    } catch (err) {
+      this.error(err, 'Unable to login via OAuth');
+    }
+  }
+
+  async internalLoginAsync(username, password) {
+    await this.Authentication.login(username, password);
+    await this.postLoginSteps();
+  }
+
+  /**
+   * END LOGIN METHODS SECTION
+   */
+
+  /**
+   * AUTHENTICATE USER SECTION
+   */
+
+  async authenticateUserAsync() {
+    try {
+      var username = this.formValues.Username;
+      var password = this.formValues.Password;
+      this.state.loginInProgress = true;
+      await this.internalLoginAsync(username, password);
+    } catch (err) {
+      this.error(err, 'Unable to login');
+    }
+  }
+
+  authenticateUser() {
+    this.setPasswordInputType('password');
+    return this.$async(this.authenticateUserAsync);
+  }
+
+  /**
+   * END AUTHENTICATE USER SECTION
+   */
+
+  /**
+   * ON INIT SECTION
+   */
+  async manageOauthCodeReturn(code, state) {
+    if (this.hasValidState(state)) {
+      await this.oAuthLoginAsync(code);
+    } else {
+      this.error(null, 'Invalid OAuth state, try again.');
+    }
+  }
+
+  async authEnabledFlowAsync() {
+    try {
+      const exists = await this.UserService.administratorExists();
+      if (!exists) {
+        this.$state.go('portainer.init.admin');
+      }
+    } catch (err) {
+      this.error(err, 'Unable to verify administrator account existence');
+    }
+  }
+
+  toggleStandardLogin() {
+    this.state.showStandardLogin = !this.state.showStandardLogin;
+  }
+
+  async onInit() {
+    try {
+      const settings = await this.SettingsService.publicSettings();
+      this.state.showOAuthLogin = settings.AuthenticationMethod === 3;
+      this.state.showStandardLogin = !this.state.showOAuthLogin;
+      this.state.OAuthLoginURI = settings.OAuthLoginURI;
+      this.state.OAuthProvider = this.determineOauthProvider(settings.OAuthLoginURI);
+
+      const returnUrl = new URLSearchParams(this.$window.location.search).get('returnUrl');
+      if (returnUrl && isValidReturnUrl(returnUrl)) {
+        storeReturnUrl(returnUrl);
+      }
+
+      const code = this.URLHelper.getParameter('code');
+      const state = this.URLHelper.getParameter('state');
+      if (code && state) {
+        await this.manageOauthCodeReturn(code, state);
+        this.generateOAuthLoginURI();
+        return;
+      }
+      if (!this.logo) {
+        await this.StateManager.initialize();
+        this.logo = this.StateManager.getState().application.logo;
+      }
+      this.generateOAuthLoginURI();
+
+      if (this.$stateParams.logout || this.$stateParams.error) {
+        this.logout(this.$stateParams.error);
+        return;
+      }
+      const error = this.LocalStorage.getLogoutReason();
+      if (error) {
+        this.state.AuthenticationError = error;
+        this.LocalStorage.cleanLogoutReason();
+      }
+
+      // always clear the kubernetes cache on login
+      dispatchCacheRefreshEvent();
+
+      if (this.Authentication.isAuthenticated()) {
+        await this.postLoginSteps();
+      }
+      this.state.loginInProgress = false;
+
+      await this.authEnabledFlowAsync();
+    } catch (err) {
+      this.Notifications.error('Failure', err, 'Unable to retrieve public settings');
+    }
+  }
+
+  $onInit() {
+    return this.$async(this.onInit);
+  }
+
+  /**
+   * END ON INIT SECTION
+   */
+}
+
+export default AuthenticationController;
+angular.module('portainer.app').controller('AuthenticationController', AuthenticationController);
diff --git a/app/portainer/views/endpoints/access/endpointAccess.html b/app/portainer/views/endpoints/access/endpointAccess.html
new file mode 100644
index 0000000..47027f2
--- /dev/null
+++ b/app/portainer/views/endpoints/access/endpointAccess.html
@@ -0,0 +1,55 @@
+<page-header
+  title="'Environment access'"
+  breadcrumbs="[
+    { label:'Environments', link:'portainer.endpoints' },
+    {
+      label:ctrl.endpoint.Name,
+      link: 'portainer.endpoints.endpoint',
+      linkParams:{id: ctrl.endpoint.Id}
+    }, 'Access management']"
+  reload="true"
+>
+</page-header>
+
+<div class="row" ng-if="ctrl.endpoint">
+  <div class="col-sm-12">
+    <rd-widget>
+      <rd-widget-header icon="hard-drive" title-text="Environment"></rd-widget-header>
+      <rd-widget-body classes="no-padding">
+        <table class="table">
+          <tbody>
+            <tr>
+              <td>Name</td>
+              <td>
+                {{ ctrl.endpoint.Name }}
+              </td>
+            </tr>
+            <tr>
+              <td>URL</td>
+              <td>
+                {{ ctrl.endpoint.URL | stripprotocol }}
+              </td>
+            </tr>
+            <tr>
+              <td>Group</td>
+              <td>
+                <a ui-sref="portainer.groups.group({ id: ctrl.group.Id })">{{ ctrl.group.Name }}</a>
+              </td>
+            </tr>
+          </tbody>
+        </table>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
+
+<por-access-management
+  ng-if="ctrl.endpoint && ctrl.group"
+  access-controlled-entity="ctrl.endpoint"
+  action-in-progress="ctrl.state.actionInProgress"
+  entity-type="endpoint"
+  inherit-from="ctrl.group"
+  update-access="ctrl.updateAccess"
+  limited-feature="ctrl.limitedFeature"
+>
+</por-access-management>
diff --git a/app/portainer/views/endpoints/access/endpointAccessController.js b/app/portainer/views/endpoints/access/endpointAccessController.js
new file mode 100644
index 0000000..0cdbbe7
--- /dev/null
+++ b/app/portainer/views/endpoints/access/endpointAccessController.js
@@ -0,0 +1,49 @@
+import angular from 'angular';
+
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+
+class EndpointAccessController {
+  /* @ngInject */
+  constructor($state, $transition$, Notifications, EndpointService, GroupService, $async) {
+    this.$state = $state;
+    this.$transition$ = $transition$;
+    this.Notifications = Notifications;
+    this.EndpointService = EndpointService;
+    this.GroupService = GroupService;
+    this.$async = $async;
+
+    this.limitedFeature = FeatureId.RBAC_ROLES;
+
+    this.updateAccess = this.updateAccess.bind(this);
+    this.updateAccessAsync = this.updateAccessAsync.bind(this);
+  }
+
+  async $onInit() {
+    this.state = { actionInProgress: false };
+    try {
+      this.endpoint = await this.EndpointService.endpoint(this.$transition$.params().id);
+      this.group = await this.GroupService.group(this.endpoint.GroupId);
+    } catch (err) {
+      this.Notifications.error('Failure', err, 'Unable to retrieve environment information');
+    }
+  }
+
+  updateAccess() {
+    return this.$async(this.updateAccessAsync);
+  }
+
+  async updateAccessAsync() {
+    try {
+      this.state.actionInProgress = true;
+      await this.EndpointService.updateEndpoint(this.$transition$.params().id, this.endpoint);
+      this.Notifications.success('Success', 'Access successfully updated');
+      this.$state.reload(this.$state.current);
+    } catch (err) {
+      this.state.actionInProgress = false;
+      this.Notifications.error('Failure', err, 'Unable to update accesses');
+    }
+  }
+}
+
+export default EndpointAccessController;
+angular.module('portainer.app').controller('EndpointAccessController', EndpointAccessController);
diff --git a/app/portainer/views/endpoints/helpers.js b/app/portainer/views/endpoints/helpers.js
new file mode 100644
index 0000000..45c7bae
--- /dev/null
+++ b/app/portainer/views/endpoints/helpers.js
@@ -0,0 +1,4 @@
+export function getAgentShortVersion(agentVersion) {
+  const numbers = agentVersion.split('.');
+  return numbers[0] + '-' + numbers[1];
+}
diff --git a/app/portainer/views/init/admin/initAdmin.html b/app/portainer/views/init/admin/initAdmin.html
new file mode 100644
index 0000000..cd62767
--- /dev/null
+++ b/app/portainer/views/init/admin/initAdmin.html
@@ -0,0 +1,329 @@
+<div class="page-wrapper">
+  <!-- simple box -->
+  <div class="simple-box container">
+    <div class="col-md-8 col-md-offset-2 col-sm-10 col-sm-offset-1">
+      <!-- simple box logo -->
+      <div class="row">
+        <img ng-if="logo" ng-src="{{ logo }}" class="simple-box-logo" />
+        <div ng-if="!ctrl.logo">
+          <img src="~@/assets/images/logo_alt.svg" class="simple-box-logo hidden th-highcontrast:!block th-dark:!block" alt="Portainer" />
+          <img src="~@/assets/images/logo_alt_black.svg" class="simple-box-logo block th-highcontrast:hidden th-dark:hidden" alt="Portainer" />
+        </div>
+      </div>
+      <!-- !simple box logo -->
+      <!-- init password panel -->
+      <div class="panel panel-default">
+        <div class="panel-body">
+          <!-- toggle -->
+          <div>
+            <a ng-click="togglePanel()" class="vertical-center">
+              <span>
+                <pr-icon icon="'chevron-down'" ng-if="state.showInitPassword" size="'lg'" class-name="'icon-primary'"></pr-icon>
+                <pr-icon icon="'chevron-right'" ng-if="!state.showInitPassword" size="'lg'" class-name="'icon-primary'"></pr-icon>
+              </span>
+              <span class="form-section-title">New Portainer installation</span>
+            </a>
+          </div>
+          <!-- !toggle -->
+
+          <!-- init password form -->
+          <form name="form" class="simple-box-form form-horizontal padding-top" ng-if="state.showInitPassword">
+            <!-- note -->
+            <div class="form-group">
+              <div class="col-sm-12">
+                <span class="small text-muted"> Please create the initial administrator user. </span>
+              </div>
+            </div>
+            <!-- !note -->
+            <!-- username-input -->
+            <div class="form-group">
+              <label for="username" class="col-sm-4 control-label text-left"> Username </label>
+              <div class="col-sm-8">
+                <input type="text" class="form-control" id="username" ng-model="formValues.Username" placeholder="e.g. admin" data-cy="init-username" />
+              </div>
+            </div>
+            <!-- !username-input -->
+            <!-- new-password-input -->
+            <div class="form-group">
+              <label for="password" class="col-sm-4 control-label text-left">Password</label>
+              <div class="col-sm-8">
+                <input type="password" class="form-control" ng-model="formValues.Password" id="password" name="password" ng-minlength="requiredPasswordLength" auto-focus />
+              </div>
+            </div>
+            <!-- !new-password-input -->
+            <!-- confirm-password-input -->
+            <div class="form-group">
+              <label for="confirm_password" class="col-sm-4 control-label text-left">Confirm password</label>
+              <div class="col-sm-8">
+                <div class="input-group">
+                  <input type="password" class="form-control" ng-model="formValues.ConfirmPassword" id="confirm_password" />
+                  <span class="input-group-addon !rounded-r-[5px]">
+                    <pr-icon ng-if="form.password.$viewValue !== '' && form.password.$viewValue === formValues.ConfirmPassword" icon="'check'" mode="'success'"></pr-icon>
+                    <pr-icon ng-if="form.password.$viewValue === '' || form.password.$viewValue !== formValues.ConfirmPassword" icon="'x'" mode="'danger'"></pr-icon>
+                  </span>
+                </div>
+              </div>
+            </div>
+            <!-- !confirm-password-input -->
+            <!-- setup-token-input -->
+            <div class="form-group" ng-if="requiresSetupToken">
+              <label for="setup_token" class="col-sm-4 control-label text-left">
+                Setup token
+                <portainer-tooltip message="'Find this token in the Portainer server logs'"></portainer-tooltip>
+              </label>
+              <div class="col-sm-8">
+                <input type="text" class="form-control" ng-model="formValues.SetupToken" id="setup_token" data-cy="init-adminSetupToken" />
+                <setup-token-text-tip></setup-token-text-tip>
+              </div>
+            </div>
+            <!-- !setup-token-input -->
+            <!-- note -->
+            <div class="form-group">
+              <div class="col-sm-12 text-warning">
+                <p class="vertical-center">
+                  <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon>
+                  <span>The password must be at least {{ requiredPasswordLength }} characters long.</span>
+                  <pr-icon mode="'success'" icon="'check'" ng-if="form.password.$valid && formValues.Password"></pr-icon>
+                </p>
+              </div>
+            </div>
+            <!-- !note -->
+            <!-- actions -->
+            <div class="form-group">
+              <div class="col-sm-12">
+                <button
+                  type="submit"
+                  class="btn btn-primary btn-sm"
+                  ng-disabled="state.actionInProgress || form.$invalid || !formValues.Password || !formValues.ConfirmPassword || form.password.$viewValue !== formValues.ConfirmPassword || (requiresSetupToken && !formValues.SetupToken)"
+                  ng-click="createAdminUser()"
+                  button-spinner="state.actionInProgress"
+                >
+                  <span ng-hide="state.actionInProgress">Create user</span>
+                  <span ng-show="state.actionInProgress">Creating user...</span>
+                </button>
+              </div>
+            </div>
+            <!-- !actions -->
+          </form>
+          <!-- !init password form -->
+        </div>
+      </div>
+      <!-- !init password panel -->
+
+      <!-- restore backup panel -->
+      <div class="panel panel-default">
+        <div class="panel-body">
+          <!-- toggle -->
+          <div>
+            <a ng-click="togglePanel()" data-cy="init-installPortainerFromBackup" class="vertical-center">
+              <span
+                ><pr-icon icon="'chevron-down'" ng-if="state.showRestorePortainer" size="'lg'" class-name="'icon-primary'"></pr-icon>
+                <pr-icon icon="'chevron-right'" ng-if="!state.showRestorePortainer" size="'lg'" class-name="'icon-primary'"></pr-icon
+              ></span>
+              <span class="form-section-title">Restore Portainer from backup</span>
+            </a>
+          </div>
+          <!-- !toggle -->
+
+          <!-- restore form -->
+          <form class="simple-box-form form-horizontal padding-top" ng-if="state.showRestorePortainer">
+            <!-- note -->
+            <div class="form-group">
+              <div class="col-sm-9">
+                <span class="small text-muted">
+                  This will restore the Portainer metadata which contains information about the environments, stacks and applications, as well as the configured users.
+                </span>
+              </div>
+            </div>
+            <!-- !note -->
+
+            <box-selector slim="true" options="restoreOptions" value="formValues.restoreFormType" on-change="(onChangeRestoreType)" radio-name="'restore-type'"></box-selector>
+
+            <div ng-if="formValues.restoreFormType === RESTORE_FORM_TYPES.FILE">
+              <!-- note -->
+              <div class="form-group">
+                <div class="col-sm-12">
+                  <span class="small text-muted"> You can upload a backup file from your computer. </span>
+                </div>
+              </div>
+              <!-- !note -->
+              <!-- select-file-input -->
+              <div class="form-group">
+                <div class="col-sm-12 vertical-center">
+                  <button
+                    class="btn btn-sm btn-primary"
+                    ngf-select
+                    accept=".gz,.encrypted"
+                    ngf-accept="'application/x-tar,application/x-gzip'"
+                    ng-model="formValues.BackupFile"
+                    auto-focus
+                    data-cy="init-selectBackupFileButton"
+                    >Select file</button
+                  >
+                  <span class="space-left vertical-center">
+                    {{ formValues.BackupFile.name }}
+                    <pr-icon icon="'x-circle'" class-name="'icon-danger'" ng-if="!formValues.BackupFile"></pr-icon>
+                  </span>
+                </div>
+              </div>
+              <!-- password-input -->
+              <div class="form-group">
+                <label for="password" class="col-sm-3 control-label text-left">
+                  Password
+                  <portainer-tooltip
+                    message="'If the backup is password protected, provide the password in order to extract the backup file, otherwise this field can be left empty.'"
+                  ></portainer-tooltip>
+                </label>
+                <div class="col-sm-4">
+                  <input type="password" class="form-control" ng-model="formValues.Password" id="password" data-cy="init-backupPasswordInput" />
+                </div>
+              </div>
+              <!-- !password-input -->
+            </div>
+            <!-- !select-file-input -->
+            <div class="limited-be-content" ng-if="formValues.restoreFormType === RESTORE_FORM_TYPES.S3">
+              <!-- Access key id  -->
+              <div class="form-group">
+                <label for="access_key_id" class="col-sm-3 control-label text-left">Access key ID</label>
+                <div class="col-sm-9">
+                  <input type="text" class="form-control" id="access_key_id" name="access_key_id" ng-model="formValues.AccessKeyId" required data-cy="init-accessKeyIdInput" />
+                </div>
+              </div>
+              <!-- !Access key id  -->
+              <!-- Secret access key -->
+              <div class="form-group">
+                <label for="secret_access_key" class="col-sm-3 control-label text-left">Secret access key</label>
+                <div class="col-sm-9">
+                  <input
+                    type="password"
+                    data-cy="init-secretAccessKeyInput"
+                    class="form-control"
+                    id="secret_access_key"
+                    name="secret_access_key"
+                    ng-model="formValues.SecretAccessKey"
+                    required
+                  />
+                </div>
+              </div>
+              <!-- !Secret access key -->
+              <!-- Region -->
+              <div class="form-group">
+                <label for="backup-s3-region" class="col-sm-3 control-label text-left">Region</label>
+                <div class="col-sm-9">
+                  <input
+                    type="text"
+                    data-cy="init-s3RegionInput"
+                    class="form-control"
+                    placeholder="default region is us-east-1 if left empty"
+                    id="backup-s3-region"
+                    name="backup-s3-region"
+                    ng-model="formValues.Region"
+                  />
+                </div>
+              </div>
+              <!-- !Region -->
+              <!-- Bucket name -->
+              <div class="form-group">
+                <label for="bucket_name" class="col-sm-3 control-label text-left">Bucket name</label>
+                <div class="col-sm-9">
+                  <input type="text" class="form-control" id="bucket_name" name="bucket_name" ng-model="formValues.BucketName" required data-cy="init-bucketNameInput" />
+                </div>
+              </div>
+              <!-- !Bucket name -->
+              <!-- S3 Compatible Host -->
+              <div class="form-group">
+                <label for="s3-compatible-host" class="col-sm-3 control-label text-left">
+                  S3 Compatible Host
+                  <portainer-tooltip message="'Hostname of a S3 service'"></portainer-tooltip>
+                </label>
+                <div class="col-sm-9">
+                  <input
+                    type="text"
+                    data-cy="init-s3CompatibleHostInput"
+                    class="form-control"
+                    id="s3-compatible-host"
+                    name="s3-compatible-host"
+                    ng-model="formValues.S3CompatibleHost"
+                    placeholder="leave empty for AWS S3"
+                  />
+                </div>
+              </div>
+              <!-- !S3 Compatible Host -->
+              <!-- Filename -->
+              <div class="form-group">
+                <label for="backup-s3-filename" class="col-sm-3 control-label text-left">Filename</label>
+                <div class="col-sm-9">
+                  <input
+                    type="text"
+                    data-cy="init-backupFilenameInput"
+                    class="form-control"
+                    id="backup-s3-filename"
+                    name="backup-s3-filename"
+                    ng-model="formValues.Filename"
+                    required
+                  />
+                </div>
+              </div>
+              <!-- !Filename -->
+              <!-- password-input -->
+              <div class="form-group">
+                <label for="password" class="col-sm-3 control-label text-left">
+                  Password
+                  <portainer-tooltip
+                    message="'If the backup is password protected, provide the password in order to extract the backup file, otherwise this field can be left empty.'"
+                  ></portainer-tooltip>
+                </label>
+                <div class="col-sm-4">
+                  <input type="password" class="form-control" ng-model="formValues.Password" id="password" data-cy="init-backupPasswordInput" />
+                </div>
+              </div>
+              <!-- !password-input -->
+            </div>
+            <!-- note -->
+            <div class="form-group">
+              <div class="col-sm-12">
+                <span class="small text-muted"> You are about to restore Portainer from this backup. </span>
+              </div>
+              <div class="col-sm-12">
+                <span class="small text-muted"> After restoring has completed, please log in as a user that was known by the Portainer that was restored. </span>
+              </div>
+            </div>
+            <!-- !note -->
+            <!-- setup-token-input -->
+            <div class="form-group" ng-if="requiresSetupToken">
+              <label for="restore_setup_token" class="col-sm-3 control-label text-left">
+                Setup token
+                <portainer-tooltip message="'Find this token in the Portainer server logs (docker logs &lt;container&gt;).'"></portainer-tooltip>
+              </label>
+              <div class="col-sm-4">
+                <input type="text" class="form-control" ng-model="formValues.SetupToken" id="restore_setup_token" data-cy="init-restoreSetupToken" />
+                <setup-token-text-tip></setup-token-text-tip>
+              </div>
+            </div>
+            <!-- !setup-token-input -->
+            <!-- actions -->
+            <div class="form-group">
+              <div class="col-sm-12">
+                <button
+                  type="submit"
+                  class="btn btn-primary btn-sm"
+                  ng-disabled="!formValues.BackupFile || state.backupInProgress || (requiresSetupToken && !formValues.SetupToken)"
+                  ng-click="uploadBackup()"
+                  button-spinner="state.backupInProgress"
+                  data-cy="init-restorePortainerButton"
+                >
+                  <span ng-hide="state.backupInProgress">Restore Portainer</span>
+                  <span ng-show="state.backupInProgress">Restoring Portainer...</span>
+                </button>
+              </div>
+            </div>
+            <!-- !actions -->
+          </form>
+          <!-- !restore backup form -->
+        </div>
+      </div>
+      <!-- !restore backup panel -->
+    </div>
+  </div>
+  <!-- !simple box -->
+</div>
diff --git a/app/portainer/views/init/admin/initAdminController.js b/app/portainer/views/init/admin/initAdminController.js
new file mode 100644
index 0000000..fc1bef4
--- /dev/null
+++ b/app/portainer/views/init/admin/initAdminController.js
@@ -0,0 +1,176 @@
+import { getEnvironments } from '@/react/portainer/environments/environment.service';
+import { restoreOptions } from '@/react/portainer/init/InitAdminView/restore-options';
+
+const REDIRECT_REASON_TIMEOUT = 'AdminInitTimeout';
+
+angular.module('portainer.app').controller('InitAdminController', [
+  '$scope',
+  '$state',
+  'Notifications',
+  'Authentication',
+  'StateManager',
+  'SettingsService',
+  'UserService',
+  'BackupService',
+  'StatusService',
+  function ($scope, $state, Notifications, Authentication, StateManager, SettingsService, UserService, BackupService, StatusService) {
+    $scope.restoreOptions = restoreOptions;
+
+    $scope.uploadBackup = uploadBackup;
+
+    $scope.logo = StateManager.getState().application.logo;
+    $scope.RESTORE_FORM_TYPES = { S3: 's3', FILE: 'file' };
+
+    $scope.formValues = {
+      Username: 'admin',
+      Password: '',
+      ConfirmPassword: '',
+      SetupToken: '',
+      restoreFormType: $scope.RESTORE_FORM_TYPES.FILE,
+    };
+
+    $scope.state = {
+      actionInProgress: false,
+      showInitPassword: true,
+      showRestorePortainer: false,
+    };
+
+    createAdministratorFlow();
+
+    $scope.togglePanel = function () {
+      $scope.state.showInitPassword = !$scope.state.showInitPassword;
+      $scope.state.showRestorePortainer = !$scope.state.showRestorePortainer;
+    };
+
+    $scope.onChangeRestoreType = onChangeRestoreType;
+    function onChangeRestoreType(value) {
+      $scope.$evalAsync(() => {
+        $scope.formValues.restoreFormType = value;
+      });
+    }
+
+    $scope.createAdminUser = function () {
+      var username = $scope.formValues.Username;
+      var password = $scope.formValues.Password;
+
+      $scope.state.actionInProgress = true;
+      UserService.initAdministrator(username, password, $scope.formValues.SetupToken)
+        .then(function success() {
+          return Authentication.login(username, password);
+        })
+        .then(() => {
+          return StateManager.initialize();
+        })
+        .then(function () {
+          return getEnvironments({ limit: 100 });
+        })
+        .then(function success(data) {
+          if (data.value.length === 0) {
+            $state.go('portainer.wizard');
+          } else {
+            $state.go('portainer.home');
+          }
+        })
+        .catch(function error(err) {
+          if (!handleError(err)) {
+            Notifications.error('Failure', err, 'Unable to create administrator user');
+          }
+        })
+        .finally(function final() {
+          $scope.state.actionInProgress = false;
+        });
+    };
+
+    function handleError(err) {
+      if (err.status === 303) {
+        const headers = err.response?.headers ?? {};
+        if (headers['redirect-reason'] === REDIRECT_REASON_TIMEOUT) {
+          window.location.href = '/timeout.html';
+        }
+        return true;
+      }
+      if (err.status === 403) {
+        Notifications.error('Failure', err, 'Setup token is missing or invalid. Find the current token in the Portainer server logs.');
+        return true;
+      }
+      return false;
+    }
+
+    function createAdministratorFlow() {
+      SettingsService.publicSettings()
+        .then(function success(data) {
+          $scope.requiredPasswordLength = data.RequiredPasswordLength;
+          $scope.requiresSetupToken = data.RequiresSetupToken;
+        })
+        .catch(function error(err) {
+          Notifications.error('Failure', err, 'Unable to retrieve application settings');
+        });
+
+      UserService.administratorExists()
+        .then(function success(exists) {
+          if (exists) {
+            $state.go('portainer.wizard');
+          }
+        })
+        .catch(function error(err) {
+          Notifications.error('Failure', err, 'Unable to verify administrator account existence');
+        });
+    }
+
+    async function uploadBackup() {
+      $scope.state.backupInProgress = true;
+
+      const file = $scope.formValues.BackupFile;
+      const password = $scope.formValues.Password;
+
+      restoreAndRefresh(() => BackupService.uploadBackup(file, password, $scope.formValues.SetupToken));
+    }
+
+    async function restoreAndRefresh(restoreAsyncFn) {
+      $scope.state.backupInProgress = true;
+
+      try {
+        await restoreAsyncFn();
+      } catch (err) {
+        if (!handleError(err)) {
+          Notifications.error('Failure', err, 'Unable to restore the backup');
+        }
+        $scope.state.backupInProgress = false;
+
+        return;
+      }
+
+      try {
+        await waitPortainerRestart();
+        Notifications.success('Success', 'The backup has successfully been restored');
+        $state.go('portainer.auth');
+      } catch (err) {
+        handleError(err);
+        Notifications.error('Failure', err, 'Unable to check for status');
+        await wait(2);
+        location.reload();
+      }
+
+      $scope.state.backupInProgress = false;
+    }
+
+    async function waitPortainerRestart() {
+      for (let i = 0; i < 10; i++) {
+        await wait(5);
+        try {
+          const status = await StatusService.status();
+          if (status && status.Version) {
+            return;
+          }
+        } catch (e) {
+          // pass
+        }
+      }
+      throw new Error('Timeout to wait for Portainer restarting');
+    }
+  },
+]);
+
+function wait(seconds = 0) {
+  return new Promise((resolve) => setTimeout(resolve, seconds * 1000));
+}
diff --git a/app/portainer/views/logout/logout.html b/app/portainer/views/logout/logout.html
new file mode 100644
index 0000000..32d55e7
--- /dev/null
+++ b/app/portainer/views/logout/logout.html
@@ -0,0 +1,19 @@
+<div class="page-wrapper">
+  <!-- login box -->
+  <div class="simple-box container">
+    <div class="col-md-6 col-md-offset-3 col-sm-6 col-sm-offset-3">
+      <!-- login box logo -->
+      <div class="row">
+        <div ng-if="!ctrl.logo">
+          <img src="~@/assets/images/logo_alt.svg" class="simple-box-logo hidden th-highcontrast:!block th-dark:!block" alt="Portainer" />
+          <img src="~@/assets/images/logo_alt_black.svg" class="simple-box-logo block th-highcontrast:hidden th-dark:hidden" alt="Portainer" />
+        </div>
+        <img ng-if="ctrl.logo" ng-src="{{ ctrl.logo }}" class="simple-box-logo" />
+      </div>
+      <div class="row text-center">
+        Logout in progress...
+        <pr-icon icon="'settings'" class-name="'animate-spin-slow space-left'"></pr-icon>
+      </div>
+    </div>
+  </div>
+</div>
diff --git a/app/portainer/views/logout/logoutController.js b/app/portainer/views/logout/logoutController.js
new file mode 100644
index 0000000..51b35fb
--- /dev/null
+++ b/app/portainer/views/logout/logoutController.js
@@ -0,0 +1,74 @@
+import angular from 'angular';
+import { dispatchCacheRefreshEvent } from '@/portainer/services/http-request.helper';
+import { cleanReturnUrl } from '@/react/portainer/helpers/returnUrl';
+
+class LogoutController {
+  /* @ngInject */
+  constructor($async, $state, $transition$, $window, Authentication, StateManager, Notifications, LocalStorage, SettingsService) {
+    this.$async = $async;
+    this.$state = $state;
+    this.$transition$ = $transition$;
+    this.$window = $window;
+
+    this.Authentication = Authentication;
+    this.StateManager = StateManager;
+    this.Notifications = Notifications;
+    this.LocalStorage = LocalStorage;
+    this.SettingsService = SettingsService;
+
+    this.logo = this.StateManager.getState().application.logo;
+    this.logoutAsync = this.logoutAsync.bind(this);
+
+    this.onInit = this.onInit.bind(this);
+  }
+
+  /**
+   * UTILS FUNCTIONS SECTION
+   */
+  async logoutAsync() {
+    const error = this.$transition$.params().error;
+    const settings = await this.SettingsService.publicSettings();
+
+    try {
+      await this.Authentication.logout();
+    } finally {
+      // always clear the kubernetes cache
+      dispatchCacheRefreshEvent();
+
+      cleanReturnUrl();
+      this.LocalStorage.storeLogoutReason(error);
+      if (settings.OAuthLogoutURI && this.Authentication.getUserDetails().ID !== 1) {
+        this.$window.location.href = settings.OAuthLogoutURI;
+      } else {
+        this.$state.go('portainer.auth', { reload: true });
+      }
+    }
+  }
+
+  logout() {
+    return this.$async(this.logoutAsync);
+  }
+
+  /**
+   * END UTILS FUNCTIONS SECTION
+   */
+
+  async onInit() {
+    try {
+      await this.logout();
+    } catch (err) {
+      this.Notifications.error('Failure', err, 'An error occurred during logout');
+    }
+  }
+
+  $onInit() {
+    return this.$async(this.onInit);
+  }
+
+  /**
+   * END ON INIT SECTION
+   */
+}
+
+export default LogoutController;
+angular.module('portainer.app').controller('LogoutController', LogoutController);
diff --git a/app/portainer/views/main/mainController.js b/app/portainer/views/main/mainController.js
new file mode 100644
index 0000000..355fa9c
--- /dev/null
+++ b/app/portainer/views/main/mainController.js
@@ -0,0 +1,14 @@
+angular.module('portainer.app').controller('MainController', MainController);
+
+/* @ngInject */
+function MainController($scope, StateManager, ThemeManager, SidebarService) {
+  /**
+   * Sidebar Toggle & Cookie Control
+   */
+
+  $scope.applicationState = StateManager.getState();
+
+  $scope.isSidebarOpen = SidebarService.isSidebarOpen;
+
+  ThemeManager.autoTheme();
+}
diff --git a/app/portainer/views/settings/authentication/MIGRATION_PLAN.md b/app/portainer/views/settings/authentication/MIGRATION_PLAN.md
new file mode 100644
index 0000000..794a02d
--- /dev/null
+++ b/app/portainer/views/settings/authentication/MIGRATION_PLAN.md
@@ -0,0 +1,241 @@
+# Migration Plan: Authentication Settings
+
+**Linear Issue**: [BE-6604](https://linear.app/portainer/issue/BE-6604/migrate-portainersettingsauthentication)
+**Project**: Migrate portainer/settings views to react
+**Estimate**: 5 Points
+**Status**: Draft → Planning
+**Strategy**: See `.claude/skills/angular-react-migration-strategy/SKILL.md`
+**Original Component Path**: `package/[ce|ee]/app/portainer/views/settings/authentication/`
+**Target Migration Path**: `app/react/portainer/settings/AuthenticationView/`
+
+## Current Structure Visualization
+
+```
+PageHeader ✅ React component
+Widget ✅ React component
+  Form
+    SessionLifetimeSection
+      Select (dropdown) - needs wrapper
+      WarningMessage ✅ React component (Icon + text)
+
+    AuthenticationMethodSection
+      BoxSelector ✅ React component
+
+      InternalAuth ✅ React component (already exists!)
+        PasswordLengthSlider ✅
+        SaveAuthSettingsButton ✅
+
+      LdapSettings (Angular - needs migration)
+        AutoUserProvisionToggle (Angular - needs component)
+        BoxSelector ✅ React component
+        LdapSettingsCustom (Angular - needs migration)
+          Multiple input fields, TLS config, connectivity check
+          LdapSettingsDnBuilder (Angular - needs component)
+          LdapSettingsGroupDnBuilder (Angular - needs component)
+          LdapSettingsSecurity (Angular - needs component)
+          LdapSettingsTestLogin (Angular - needs component)
+        LdapSettingsOpenLdap (Angular - needs migration)
+          Similar structure to Custom
+        [EE] AdminGroupsMultiSelect (needs component)
+
+      AdSettings (Angular - needs migration)
+        Similar to LdapSettings with AD-specific fields
+        [EE] BindTypeSelector (kerberos vs simple)
+        [EE] KerberosConfig (needs component)
+
+      OAuthSettings (Angular - needs migration)
+        SwitchField ✅ React component
+        TeamSelector (Angular - needs component)
+        ClaimMappingsTable (Angular - needs component)
+        [EE] AdminAutoPopulate (needs component)
+```
+
+## EE vs CE Differences
+
+**EE-specific features:**
+
+- LDAP: `selected-admin-groups` binding (line 50, 62 in EE template)
+- LDAP: Admin auto-populate with group selection
+- AD: Kerberos bind type (simple vs kerberos)
+- AD: Kerberos configuration fields (Realm, Username, Password, Configuration)
+- OAuth: Admin group claims regex list mapping
+- OAuth: Admin auto-populate toggle
+
+**Controller differences:**
+
+- EE has additional validation: `isOAuthAdminMappingFormValid()` (lines 270-281)
+- EE has Kerberos initialization logic (lines 299-308)
+- EE has admin groups handling in `prepareLDAPSettings()` (lines 207-215)
+- EE has Kerberos settings cleanup (lines 190-203)
+- EE has OAuth admin settings cleanup (lines 135-137)
+
+## Migration Strategy
+
+This is a **complex, multi-step migration** with the following phases:
+
+### Phase 1: Session Lifetime Section (Simple)
+
+- Migrate session lifetime dropdown to React
+- Reuse existing React Select component
+- Keep warning message as-is (already using React Icon component)
+
+### Phase 2: LDAP Settings (Most Complex)
+
+LDAP has deeply nested Angular components that need systematic migration:
+
+- Break down into smallest possible units
+- Migrate shared subcomponents first (DN builders, security config)
+- Then migrate LDAP Custom and OpenLDAP variants
+- Handle EE-specific admin groups last
+
+### Phase 3: AD Settings (Complex with EE divergence)
+
+- Similar to LDAP but with AD-specific fields
+- EE has additional Kerberos configuration
+- Reuse components from Phase 2 where possible
+
+### Phase 4: OAuth Settings (Moderate)
+
+- Has team membership mappings
+- EE has admin auto-populate
+- Table-based claim mappings
+
+### Phase 5: Final Integration
+
+- Create container component with Formik
+- Wire up all authentication methods
+- Handle switching between auth methods
+- Update routing
+
+## Issue Hierarchy
+
+```
+BE-6604 (Parent: Authentication Settings Migration)
+├── Session & Page (Parallel)
+│   ├── BE-12583: SessionLifetimeSelect
+│   └── BE-12584: AuthenticationMethodSelector
+│
+├── BE-12585: AutoUserProvisionToggle (Shared by LDAP/AD/OAuth)
+│
+├── BE-12593: LdapSettings Container ⚠️ PARENT ISSUE
+│   ├── BE-12586: LdapSettingsDnBuilder
+│   ├── BE-12587: LdapSettingsGroupDnBuilder
+│   ├── BE-12588: Extend TLSFieldset with StartTLS
+│   ├── BE-12589: LdapSettingsTestLogin
+│   ├── BE-12590: LdapSettingsCustom (🔒 blocked by 12586-89)
+│   ├── BE-12591: LdapSettingsOpenLdap (🔒 blocked by 12586-89)
+│   └── BE-12592: [EE] AdminGroupsMultiSelect
+│
+├── BE-12596: AdSettings Container ⚠️ PARENT ISSUE (🔒 blocked by LDAP shared)
+│   ├── BE-12594: [EE] BindTypeSelector
+│   └── BE-12595: [EE] KerberosConfigFields
+│
+├── BE-12600: OAuthSettings Container ⚠️ PARENT ISSUE
+│   ├── BE-12597: TeamSelector
+│   ├── BE-12598: ClaimMappingsTable
+│   └── BE-12599: [EE] AdminAutoPopulateSection
+│
+├── BE-12601: AuthenticationView Formik Container (🔒 blocked by 12593, 12596, 12600)
+│
+└── BE-12602: Final Cleanup (🔒 blocked by 12601)
+```
+
+## PRs (Nested Structure)
+
+### Session & Page Structure (Parallel - No Dependencies)
+
+- [x] PR 1: [BE-12583](https://linear.app/portainer/issue/BE-12583) SessionLifetimeSelect → react2angular bridge
+- [x] PR 2: [BE-12584](https://linear.app/portainer/issue/BE-12584) AuthenticationMethodSelector wrapper (BoxSelector is already React)
+
+### Internal Auth (Already Done!)
+
+- [x] ✅ Internal Auth is already fully migrated to React
+
+### [BE-12593: LDAP Settings](https://linear.app/portainer/issue/BE-12593) (Parent Issue)
+
+- [x] PR 3: [BE-12585](https://linear.app/portainer/issue/BE-12585) AutoUserProvisionToggle → shared component
+- **LDAP Shared Components** (Parallel - No Dependencies)
+  - [x] PR 4: [BE-12586](https://linear.app/portainer/issue/BE-12586) LdapSettingsDnBuilder
+  - [x] PR 5: [BE-12587](https://linear.app/portainer/issue/BE-12587) LdapSettingsGroupDnBuilder
+  - [x] PR 6: [BE-12588](https://linear.app/portainer/issue/BE-12588) Extend TLSFieldset with StartTLS
+  - [x] PR 7: [BE-12589](https://linear.app/portainer/issue/BE-12589) LdapSettingsTestLogin
+- **LDAP Variants** (Blocked by PR 4-7)
+  - [ ] PR 8: [BE-12590](https://linear.app/portainer/issue/BE-12590) LdapSettingsCustom
+  - [ ] PR 9: [BE-12591](https://linear.app/portainer/issue/BE-12591) LdapSettingsOpenLdap
+- **EE Features**
+  - [x] PR 10: [BE-12592](https://linear.app/portainer/issue/BE-12592) [EE] AdminGroupsMultiSelect
+- **Container** (Blocked by PR 3, 8, 9, 10)
+  - [ ] PR 11: [BE-12593](https://linear.app/portainer/issue/BE-12593) LdapSettings container
+
+### [BE-12596: AD Settings](https://linear.app/portainer/issue/BE-12596) (Parent Issue, Blocked by LDAP shared components)
+
+- **AD-Specific Components** (Parallel)
+  - [ ] PR 12: [BE-12594](https://linear.app/portainer/issue/BE-12594) [EE] BindTypeSelector
+  - [ ] PR 13: [BE-12595](https://linear.app/portainer/issue/BE-12595) [EE] KerberosConfigFields
+- **Container** (Blocked by PR 3, 6, 7, 10, 12, 13)
+  - [ ] PR 14: [BE-12596](https://linear.app/portainer/issue/BE-12596) AdSettings container
+
+### [BE-12600: OAuth Settings](https://linear.app/portainer/issue/BE-12600) (Parent Issue)
+
+- **OAuth Components** (Parallel)
+  - [ ] PR 3: [BE-12585](https://linear.app/portainer/issue/BE-12585) AutoUserProvisionToggle (reused)
+  - [ ] PR 15: [BE-12597](https://linear.app/portainer/issue/BE-12597) TeamSelector
+  - [ ] PR 16: [BE-12598](https://linear.app/portainer/issue/BE-12598) ClaimMappingsTable
+  - [ ] PR 17: [BE-12599](https://linear.app/portainer/issue/BE-12599) [EE] AdminAutoPopulateSection
+- **Container** (Blocked by PR 3, 15, 16, 17)
+  - [ ] PR 18: [BE-12600](https://linear.app/portainer/issue/BE-12600) OAuthSettings container
+
+### Final Integration (Blocked by All Parent Issues)
+
+- [ ] PR 19: [BE-12601](https://linear.app/portainer/issue/BE-12601) AuthenticationView container (Formik) - **Blocked by BE-12593, BE-12596, BE-12600**
+- [ ] PR 20: [BE-12602](https://linear.app/portainer/issue/BE-12602) Complete React migration - **Blocked by PR 19**
+
+## Linear Issue Comparison
+
+The Linear issue BE-6604 provides a detailed breakdown of the component structure. Our migration plan aligns with it:
+
+**Linear's structure notes:**
+
+- ✅ PageHeader - already React
+- ✅ Widget - already React
+- ✅ InternalAuth - already React
+- 📋 Need to migrate: ldap-settings, ad-settings, oauth-settings
+- 📋 Need to create: oauth-team-memberships-fieldset, microsoft/google/github/custom-settings
+- 📋 Shared components: auto-user-provision-toggle, ldap-connectivity-check, ldap-settings-security, ldap-settings-test-login
+
+**Our approach difference:**
+
+- Linear suggests creating vs migrating OAuth provider settings (microsoft, google, github, custom)
+- We'll determine during implementation if these exist in Angular and need migration
+- Our plan emphasizes bottom-up approach: migrate shared components first (DN builders, security, test login) before composing larger components
+
+## Decisions
+
+- **InternalAuth**: Already fully migrated to React, can reuse as-is ✅
+- **BoxSelector**: Already React component, can reuse ✅
+- **TLSFieldset**: Existing component can be extended/wrapped to add StartTLS support ✅
+  - LDAP needs: StartTLS toggle + TLS toggle + skip verify + CA cert only (not cert/key)
+  - Existing TLSFieldset has: TLS + skip verify + CA cert + cert + key with validation
+  - Solution: Extend TLSFieldset with optional StartTLS prop, make cert/key optional
+- **Bottom-up approach**: Start with smallest components (DN builders, toggles) before composing into larger components
+- **EE handling**: Each PR must work in both CE and EE builds
+- **Form validation**: Complex validation logic in controller needs to move into React components (each component exports its validation schema)
+- **File upload**: LDAP TLS certificate upload needs special handling
+- **Testing**: Focus on unit tests for each component (1-2 tests per file)
+
+## Key Challenges
+
+1. **Deep nesting**: LDAP settings has 3-4 levels of nested components
+2. **Shared logic**: DN builders and security config shared between LDAP variants
+3. **EE divergence**: Significant differences in LDAP/AD/OAuth between CE and EE
+4. **Validation complexity**: Form validation depends on multiple interdependent fields
+5. **State management**: Auth method switching, form state, and validation state
+6. **File upload**: TLS certificate upload for LDAP
+
+## Technical Notes
+
+- **Validation**: `isLDAPFormValid()` has complex logic checking URLs, auth mode, TLS config, admin groups
+- **Password handling**: Special logic for edit mode to avoid requiring password re-entry
+- **URL formatting**: Automatically adds port (389 or 636) if not specified
+- **Server type switching**: Switching between LDAP and AD affects which fields are shown/validated
+- **Kerberos (EE)**: Bind type selector determines which credential fields are shown
diff --git a/app/portainer/views/settings/authentication/settingsAuthentication.html b/app/portainer/views/settings/authentication/settingsAuthentication.html
new file mode 100644
index 0000000..925e9fc
--- /dev/null
+++ b/app/portainer/views/settings/authentication/settingsAuthentication.html
@@ -0,0 +1,63 @@
+<page-header title="'Authentication settings'" breadcrumbs="[{label:'Settings', link:'portainer.settings'}, 'Authentication']" reload="true"> </page-header>
+
+<div class="row" ng-if="settings">
+  <div class="col-sm-12">
+    <rd-widget>
+      <rd-widget-header icon="users" title-text="Authentication"></rd-widget-header>
+      <rd-widget-body>
+        <form class="form-horizontal" name="authSettingsForm">
+          <div class="col-sm-12 form-section-title"> Configuration </div>
+
+          <session-lifetime-select value="settings.UserSessionTimeout" on-change="(onChangeSessionLifetime)"> </session-lifetime-select>
+
+          <div class="form-group">
+            <span class="col-sm-12 text-muted small vertical-center">
+              <pr-icon icon="'alert-triangle'" class-name="'icon-sm icon-yellow'"></pr-icon>
+              Changing from default is only recommended if you have additional layers of authentication in front of Portainer.
+            </span>
+          </div>
+
+          <authentication-method-selector value="authMethod" on-change="(onChangeAuthMethod)"></authentication-method-selector>
+
+          <internal-auth
+            ng-if="authenticationMethodSelected(1)"
+            on-save-settings="(saveSettings)"
+            is-loading="state.actionInProgress"
+            value="settings.InternalAuthSettings"
+            on-change="(onChangePasswordLength)"
+          ></internal-auth>
+
+          <ldap-settings
+            ng-if="authenticationMethodSelected(2)"
+            settings="formValues.ldap.ldapSettings"
+            tlsca-cert="formValues.TLSCACert"
+            state="state"
+            connectivity-check="LDAPConnectivityCheck"
+            on-save-settings="(saveSettings)"
+            save-button-state="state.actionInProgress"
+            is-ldap-form-valid="isLDAPFormValid"
+          ></ldap-settings>
+
+          <ad-settings
+            ng-if="authenticationMethodSelected(4)"
+            settings="formValues.ldap.adSettings"
+            tlsca-cert="formValues.TLSCACert"
+            state="state"
+            connectivity-check="LDAPConnectivityCheck"
+            on-save-settings="(saveSettings)"
+            save-button-state="state.actionInProgress"
+            is-ldap-form-valid="isLDAPFormValid()"
+          ></ad-settings>
+
+          <oauth-settings
+            ng-if="authenticationMethodSelected(3)"
+            settings="OAuthSettings"
+            teams="teams"
+            on-save-settings="(saveSettings)"
+            save-button-state="state.actionInProgress"
+          ></oauth-settings>
+        </form>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
diff --git a/app/portainer/views/settings/authentication/settingsAuthenticationController.js b/app/portainer/views/settings/authentication/settingsAuthenticationController.js
new file mode 100644
index 0000000..611139f
--- /dev/null
+++ b/app/portainer/views/settings/authentication/settingsAuthenticationController.js
@@ -0,0 +1,253 @@
+import angular from 'angular';
+import _ from 'lodash-es';
+
+import { buildLdapSettingsModel, buildAdSettingsModel } from '@/portainer/settings/authentication/ldap/ldap-settings.model';
+import { SERVER_TYPES } from '@/react/portainer/settings/AuthenticationView/ldap-options';
+import { AuthenticationMethod } from '@/react/portainer/settings/types';
+import { getDefaultValue as getDefaultSessionValue } from '@/react/portainer/settings/AuthenticationView/SessionLifetimeSelect';
+
+angular.module('portainer.app').controller('SettingsAuthenticationController', SettingsAuthenticationController);
+
+function SettingsAuthenticationController($q, $scope, $state, Notifications, SettingsService, FileUploadService, TeamService, LDAPService) {
+  $scope.authMethod = 1;
+
+  $scope.state = {
+    uploadInProgress: false,
+    actionInProgress: false,
+  };
+
+  $scope.formValues = {
+    UserSessionTimeout: getDefaultSessionValue(),
+    TLSCACert: '',
+    ldap: {
+      serverType: 0,
+      adSettings: buildAdSettingsModel(),
+      ldapSettings: buildLdapSettingsModel(),
+    },
+  };
+
+  $scope.onChangeAuthMethod = function onChangeAuthMethod(value) {
+    $scope.$evalAsync(() => {
+      $scope.authMethod = value;
+
+      if (value === 4) {
+        $scope.settings.AuthenticationMethod = AuthenticationMethod.LDAP;
+        $scope.formValues.ldap.serverType = SERVER_TYPES.AD;
+        return;
+      }
+
+      if (value === 2) {
+        $scope.settings.AuthenticationMethod = AuthenticationMethod.LDAP;
+        $scope.formValues.ldap.serverType = $scope.formValues.ldap.ldapSettings.ServerType;
+        return;
+      }
+      $scope.settings.AuthenticationMethod = value;
+    });
+  };
+
+  $scope.onChangePasswordLength = function onChangePasswordLength(value) {
+    $scope.$evalAsync(() => {
+      $scope.settings.InternalAuthSettings = { RequiredPasswordLength: value };
+    });
+  };
+
+  $scope.onChangeSessionLifetime = function onChangeSessionLifetime(value) {
+    $scope.$evalAsync(() => {
+      $scope.settings.UserSessionTimeout = value;
+    });
+  };
+
+  $scope.authenticationMethodSelected = function authenticationMethodSelected(value) {
+    if (!$scope.settings) {
+      return false;
+    }
+
+    if (value === AuthenticationMethod.AD) {
+      return $scope.settings.AuthenticationMethod === AuthenticationMethod.LDAP && $scope.formValues.ldap.serverType === SERVER_TYPES.AD;
+    }
+
+    if (value === AuthenticationMethod.LDAP) {
+      return $scope.settings.AuthenticationMethod === AuthenticationMethod.LDAP && $scope.formValues.ldap.serverType !== SERVER_TYPES.AD;
+    }
+
+    return $scope.settings.AuthenticationMethod === value;
+  };
+
+  $scope.isOauthEnabled = function isOauthEnabled() {
+    return $scope.settings && $scope.settings.AuthenticationMethod === AuthenticationMethod.OAuth;
+  };
+
+  $scope.LDAPConnectivityCheck = LDAPConnectivityCheck;
+  function LDAPConnectivityCheck() {
+    const settings = angular.copy($scope.settings);
+
+    const { settings: ldapSettings, uploadRequired, tlscaFile } = prepareLDAPSettings();
+    settings.LDAPSettings = ldapSettings;
+    $scope.state.uploadInProgress = uploadRequired;
+
+    $scope.state.connectivityCheckInProgress = true;
+
+    $q.when(!uploadRequired || FileUploadService.uploadLDAPTLSFiles(tlscaFile, null, null))
+      .then(function success() {
+        return LDAPService.check(settings.LDAPSettings);
+      })
+      .then(function success() {
+        $scope.state.failedConnectivityCheck = false;
+        $scope.state.successfulConnectivityCheck = true;
+        Notifications.success('Success', 'Connection to LDAP successful');
+      })
+      .catch(function error(err) {
+        $scope.state.failedConnectivityCheck = true;
+        $scope.state.successfulConnectivityCheck = false;
+        Notifications.error('Failure', err, 'Connection to LDAP failed');
+      })
+      .finally(function final() {
+        $scope.state.uploadInProgress = false;
+        $scope.state.connectivityCheckInProgress = false;
+      });
+  }
+
+  $scope.saveSettings = function () {
+    const settings = angular.copy($scope.settings);
+
+    const { settings: ldapSettings, uploadRequired, tlscaFile } = prepareLDAPSettings();
+    settings.LDAPSettings = ldapSettings;
+    $scope.state.uploadInProgress = uploadRequired;
+
+    $scope.state.actionInProgress = true;
+
+    $q.when(!uploadRequired || FileUploadService.uploadLDAPTLSFiles(tlscaFile, null, null))
+      .then(function success() {
+        return SettingsService.update(settings);
+      })
+      .then(function success() {
+        Notifications.success('Success', 'Authentication settings updated');
+      })
+      .catch(function error(err) {
+        Notifications.error('Failure', err, 'Unable to update authentication settings');
+      })
+      .finally(function final() {
+        $scope.state.uploadInProgress = false;
+        $scope.state.actionInProgress = false;
+      });
+  };
+
+  function prepareLDAPSettings() {
+    const tlscaCert = $scope.formValues.TLSCACert;
+
+    const tlscaFile = tlscaCert !== $scope.settings.LDAPSettings.TLSConfig.TLSCACert ? tlscaCert : null;
+
+    const isADServer = $scope.formValues.ldap.serverType === SERVER_TYPES.AD;
+
+    const settings = isADServer ? $scope.formValues.ldap.adSettings : $scope.formValues.ldap.ldapSettings;
+
+    if (settings.AnonymousMode && !isADServer) {
+      settings.ReaderDN = '';
+      settings.Password = '';
+    }
+
+    if (isADServer) {
+      settings.AnonymousMode = false;
+    }
+
+    settings.URLs = settings.URLs.map((url) => {
+      if (url === undefined || url === '') {
+        return;
+      }
+
+      if (url.includes(':')) {
+        return url;
+      }
+      return url + (settings.TLSConfig.TLS ? ':636' : ':389');
+    });
+
+    const uploadRequired = (settings.TLSConfig.TLS || settings.StartTLS) && !settings.TLSConfig.TLSSkipVerify;
+
+    settings.URL = settings.URLs[0];
+
+    return { settings, uploadRequired, tlscaFile };
+  }
+
+  $scope.isLDAPFormValid = isLDAPFormValid;
+  function isLDAPFormValid() {
+    const ldapSettings = $scope.formValues.ldap.serverType === SERVER_TYPES.AD ? $scope.formValues.ldap.adSettings : $scope.formValues.ldap.ldapSettings;
+    const isTLSMode = ldapSettings.TLSConfig.TLS || ldapSettings.StartTLS;
+
+    return (
+      _.compact(ldapSettings.URLs).length &&
+      (ldapSettings.AnonymousMode || (ldapSettings.ReaderDN && isLDAPPasswordValid(ldapSettings.Password))) &&
+      (!isTLSMode || (isTLSMode && $scope.formValues.TLSCACert) || ldapSettings.TLSConfig.TLSSkipVerify) &&
+      (!$scope.settings.LDAPSettings.AdminAutoPopulate || ($scope.settings.LDAPSettings.AdminAutoPopulate && $scope.formValues.selectedAdminGroups.length > 0))
+    );
+  }
+
+  // isLDAPPasswordValid is used to validate the password field in the LDAP settings form, and avoids the password field to be required when the form is in edit mode
+  function isLDAPPasswordValid(password) {
+    // if isEdit and it doesn't switch between AD and LDAP, then an empty password is valid
+    if ($scope.state.isEditLDAP && $scope.state.initialServerType === $scope.formValues.ldap.serverType) {
+      return true;
+    }
+    // otherwise the password is required
+    return !!password;
+  }
+
+  $scope.isOAuthTeamMembershipFormValid = isOAuthTeamMembershipFormValid;
+  function isOAuthTeamMembershipFormValid() {
+    if ($scope.settings && $scope.settings.OAuthSettings.OAuthAutoMapTeamMemberships && $scope.settings.OAuthSettings.TeamMemberships) {
+      if (!$scope.settings.OAuthSettings.TeamMemberships.OAuthClaimName) {
+        return false;
+      }
+
+      const hasInvalidMapping = $scope.settings.OAuthSettings.TeamMemberships.OAuthClaimMappings.some((m) => !(m.ClaimValRegex && m.Team));
+      if (hasInvalidMapping) {
+        return false;
+      }
+    }
+    return true;
+  }
+
+  function initView() {
+    $q.all({
+      settings: SettingsService.settings(),
+      teams: TeamService.teams(),
+    })
+      .then(function success(data) {
+        var settings = data.settings;
+        $scope.teams = data.teams;
+        $scope.settings = settings;
+
+        $scope.OAuthSettings = settings.OAuthSettings;
+        $scope.authMethod = settings.AuthenticationMethod;
+        if (settings.AuthenticationMethod === AuthenticationMethod.LDAP && settings.LDAPSettings.ServerType === SERVER_TYPES.AD) {
+          $scope.authMethod = AuthenticationMethod.AD;
+        }
+
+        if (settings.LDAPSettings.URL) {
+          settings.LDAPSettings.URLs = [settings.LDAPSettings.URL];
+        }
+        if (!settings.LDAPSettings.URLs) {
+          settings.LDAPSettings.URLs = [];
+        }
+        if (!settings.LDAPSettings.URLs.length) {
+          settings.LDAPSettings.URLs.push('');
+        }
+        if (!settings.LDAPSettings.ServerType) {
+          settings.LDAPSettings.ServerType = SERVER_TYPES.CUSTOM;
+        }
+
+        $scope.formValues.ldap.serverType = settings.LDAPSettings.ServerType;
+        if (settings.LDAPSettings.ServerType === SERVER_TYPES.AD) {
+          $scope.formValues.ldap.adSettings = settings.LDAPSettings;
+        } else {
+          $scope.formValues.ldap.ldapSettings = Object.assign($scope.formValues.ldap.ldapSettings, settings.LDAPSettings);
+        }
+        $scope.state.isEditLDAP = settings.LDAPSettings.ServerType === SERVER_TYPES.AD || settings.LDAPSettings.ServerType === SERVER_TYPES.LDAP;
+        $scope.state.initialServerType = settings.LDAPSettings.ServerType;
+      })
+      .catch(function error(err) {
+        Notifications.error('Failure', err, 'Unable to retrieve application settings');
+      });
+  }
+
+  initView();
+}
diff --git a/app/portainer/views/settings/edge-compute/index.js b/app/portainer/views/settings/edge-compute/index.js
new file mode 100644
index 0000000..e9c9e52
--- /dev/null
+++ b/app/portainer/views/settings/edge-compute/index.js
@@ -0,0 +1,7 @@
+import angular from 'angular';
+import controller from './settingsEdgeComputeController';
+
+angular.module('portainer.app').component('settingsEdgeComputeView', {
+  templateUrl: './settingsEdgeCompute.html',
+  controller,
+});
diff --git a/app/portainer/views/settings/edge-compute/settingsEdgeCompute.html b/app/portainer/views/settings/edge-compute/settingsEdgeCompute.html
new file mode 100644
index 0000000..e3462b6
--- /dev/null
+++ b/app/portainer/views/settings/edge-compute/settingsEdgeCompute.html
@@ -0,0 +1,7 @@
+<page-header title="'Settings'" breadcrumbs="[{label:'Settings', link:'portainer.settings'}, 'Edge Compute']" reload="true"> </page-header>
+
+<div class="row">
+  <div class="col-sm-12" ng-if="$ctrl.settings">
+    <settings-edge-compute on-submit="($ctrl.onSubmitEdgeCompute)" settings="($ctrl.settings)"></settings-edge-compute>
+  </div>
+</div>
diff --git a/app/portainer/views/settings/edge-compute/settingsEdgeComputeController.js b/app/portainer/views/settings/edge-compute/settingsEdgeComputeController.js
new file mode 100644
index 0000000..f5abcf4
--- /dev/null
+++ b/app/portainer/views/settings/edge-compute/settingsEdgeComputeController.js
@@ -0,0 +1,47 @@
+import _ from 'lodash-es';
+import angular from 'angular';
+
+angular.module('portainer.app').controller('SettingsEdgeComputeController', SettingsEdgeComputeController);
+
+/* @ngInject */
+export default function SettingsEdgeComputeController($q, $async, $state, Notifications, SettingsService, StateManager) {
+  var ctrl = this;
+
+  this.onSubmitEdgeCompute = async function (settings) {
+    try {
+      await SettingsService.update(settings);
+      Notifications.success('Success', 'Settings updated');
+      StateManager.updateEnableEdgeComputeFeatures(settings.EnableEdgeComputeFeatures);
+      $state.reload();
+    } catch (err) {
+      Notifications.error('Failure', err, 'Unable to update settings');
+    }
+  };
+
+  function initView() {
+    $async(async () => {
+      try {
+        const settings = await SettingsService.settings();
+
+        const defaultMTLS = {
+          ..._.get(settings, 'Edge.MTLS', {}),
+          UseSeparateCert: _.get(settings, 'Edge.MTLS.UseSeparateCert', false),
+        };
+
+        ctrl.settings = {
+          ...settings,
+          EnableEdgeComputeFeatures: !!settings.EnableEdgeComputeFeatures,
+          EnforceEdgeID: !!settings.EnforceEdgeID,
+          Edge: {
+            ...settings.Edge,
+            MTLS: defaultMTLS,
+          },
+        };
+      } catch (err) {
+        Notifications.error('Failure', err, 'Unable to retrieve application settings');
+      }
+    });
+  }
+
+  initView();
+}
diff --git a/app/portainer/views/stacks/stacks.html b/app/portainer/views/stacks/stacks.html
new file mode 100644
index 0000000..a0ebe45
--- /dev/null
+++ b/app/portainer/views/stacks/stacks.html
@@ -0,0 +1,9 @@
+<page-header title="'Stacks list'" breadcrumbs="['Stacks']" reload="true"> </page-header>
+
+<docker-stacks-datatable
+  ng-if="stacks"
+  dataset="stacks"
+  is-image-notification-enabled="enableImageNotification"
+  on-remove="(removeAction)"
+  on-refresh="(getStacks)"
+></docker-stacks-datatable>
diff --git a/app/portainer/views/stacks/stacksController.js b/app/portainer/views/stacks/stacksController.js
new file mode 100644
index 0000000..287e817
--- /dev/null
+++ b/app/portainer/views/stacks/stacksController.js
@@ -0,0 +1,63 @@
+import { processItemsInBatches } from '@/react/common/processItemsInBatches';
+
+angular.module('portainer.app').controller('StacksController', StacksController);
+
+/* @ngInject */
+function StacksController($scope, $state, Notifications, StackService, Authentication, endpoint) {
+  $scope.removeAction = function (selectedItems) {
+    return deleteSelectedStacks(selectedItems);
+  };
+
+  async function deleteSelectedStacks(selectedItems) {
+    const endpointId = endpoint.Id;
+
+    async function doRemove(stack) {
+      return StackService.remove(stack, stack.External, endpointId)
+        .then(function success() {
+          Notifications.success('Stack successfully removed', stack.Name);
+          var index = $scope.stacks.indexOf(stack);
+          $scope.stacks.splice(index, 1);
+        })
+        .catch(function error(err) {
+          Notifications.error('Failure', err, 'Unable to remove stack ' + stack.Name);
+        });
+    }
+
+    await processItemsInBatches(selectedItems, doRemove);
+    $state.reload();
+  }
+
+  $scope.createEnabled = false;
+
+  $scope.getStacks = getStacks;
+
+  function getStacks() {
+    const endpointMode = $scope.applicationState.endpoint.mode;
+    const endpointId = endpoint.Id;
+
+    const includeOrphanedStacks = Authentication.isAdmin();
+    StackService.stacks(true, endpointMode.provider === 'DOCKER_SWARM_MODE' && endpointMode.role === 'MANAGER', endpointId, includeOrphanedStacks)
+      .then(function success(stacks) {
+        $scope.stacks = stacks;
+      })
+      .catch(function error(err) {
+        $scope.stacks = [];
+        Notifications.error('Failure', err, 'Unable to retrieve stacks');
+      });
+  }
+
+  async function canManageStacks() {
+    return endpoint.SecuritySettings.allowStackManagementForRegularUsers || Authentication.isAdmin();
+  }
+
+  async function initView() {
+    // if the user is not an admin, and stack management is disabled for non admins, then take the user to the dashboard
+    $scope.createEnabled = await canManageStacks();
+    if (!$scope.createEnabled) {
+      $state.go('docker.dashboard');
+    }
+    getStacks();
+  }
+
+  initView();
+}
diff --git a/app/portainer/views/tags/tags.html b/app/portainer/views/tags/tags.html
new file mode 100644
index 0000000..fbbd65c
--- /dev/null
+++ b/app/portainer/views/tags/tags.html
@@ -0,0 +1,64 @@
+<page-header title="'Tags'" breadcrumbs="['Tag management']" reload="true"> </page-header>
+
+<div class="row">
+  <div class="col-sm-12">
+    <rd-widget>
+      <rd-widget-header icon="plus" title-text="Add a new tag"> </rd-widget-header>
+      <rd-widget-body>
+        <form class="form-horizontal" name="tagCreationForm" ng-submit="createTag()">
+          <!-- name-input -->
+          <div class="form-group">
+            <label for="name" class="col-sm-2 control-label required text-left"> Name </label>
+            <div class="col-sm-10">
+              <input
+                type="text"
+                data-cy="tag-name-input"
+                class="form-control"
+                name="name"
+                ng-model="formValues.Name"
+                ng-change="checkNameValidity(tagCreationForm)"
+                placeholder="org/acme"
+                required
+                auto-focus
+              />
+              <div class="help-block" ng-show="tagCreationForm.name.$invalid">
+                <div class="small text-warning">
+                  <div ng-messages="tagCreationForm.name.$error">
+                    <p ng-message="required" class="vertical-center">
+                      <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon>
+                      This field is required.
+                    </p>
+                    <p ng-message="validName" class="vertical-center">
+                      <pr-icon icon="'alert-triangle'" mode="'warning'"></pr-icon>
+                      This tag already exists.
+                    </p>
+                  </div>
+                </div>
+              </div>
+            </div>
+          </div>
+          <!-- !name-input -->
+          <div class="form-group">
+            <div class="col-sm-12">
+              <button
+                type="button"
+                class="btn btn-primary btn-sm"
+                ng-disabled="state.actionInProgress || !tagCreationForm.$valid"
+                ng-click="createTag()"
+                button-spinner="state.actionInProgress"
+              >
+                <span ng-hide="state.actionInProgress" class="vertical-center">
+                  <pr-icon icon="'plus'"></pr-icon>
+                  Create tag
+                </span>
+                <span ng-show="state.actionInProgress">Creating tag...</span>
+              </button>
+            </div>
+          </div>
+        </form>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
+
+<tags-datatable dataset="tags" on-remove="(removeAction)"></tags-datatable>
diff --git a/app/portainer/views/tags/tagsController.js b/app/portainer/views/tags/tagsController.js
new file mode 100644
index 0000000..ae86039
--- /dev/null
+++ b/app/portainer/views/tags/tagsController.js
@@ -0,0 +1,71 @@
+import angular from 'angular';
+import _ from 'lodash-es';
+
+angular.module('portainer.app').controller('TagsController', TagsController);
+
+function TagsController($scope, $state, $async, TagService, Notifications) {
+  $scope.state = {
+    actionInProgress: false,
+  };
+
+  $scope.formValues = {
+    Name: '',
+  };
+
+  $scope.checkNameValidity = function (form) {
+    var valid = true;
+    for (var i = 0; i < $scope.tags.length; i++) {
+      if ($scope.formValues.Name === $scope.tags[i].Name) {
+        valid = false;
+        break;
+      }
+    }
+    form.name.$setValidity('validName', valid);
+  };
+
+  $scope.removeAction = removeAction;
+
+  function removeAction(tags) {
+    return $async(removeActionAsync, tags);
+  }
+
+  async function removeActionAsync(tags) {
+    for (let tag of tags) {
+      try {
+        await TagService.deleteTag(tag.Id);
+
+        Notifications.success('Tag successfully removed', tag.Name);
+        _.remove($scope.tags, tag);
+      } catch (err) {
+        Notifications.error('Failure', err, 'Unable to remove tag');
+      }
+    }
+
+    $state.reload();
+  }
+
+  $scope.createTag = function () {
+    var tagName = $scope.formValues.Name;
+    TagService.createTag(tagName)
+      .then(function success() {
+        Notifications.success('Tag successfully created', tagName);
+        $state.reload();
+      })
+      .catch(function error(err) {
+        Notifications.error('Failure', err, 'Unable to create tag');
+      });
+  };
+
+  function initView() {
+    TagService.tags()
+      .then(function success(data) {
+        $scope.tags = data;
+      })
+      .catch(function error(err) {
+        Notifications.error('Failure', err, 'Unable to retrieve tags');
+        $scope.tags = [];
+      });
+  }
+
+  initView();
+}
diff --git a/app/portainer/views/users/edit/user.html b/app/portainer/views/users/edit/user.html
new file mode 100644
index 0000000..b51c9be
--- /dev/null
+++ b/app/portainer/views/users/edit/user.html
@@ -0,0 +1,86 @@
+<page-header title="'User details'" breadcrumbs="[{label:'Users', link:'portainer.users'}, formValues.username]" reload="true"> </page-header>
+
+<div class="row">
+  <div class="col-lg-12 col-md-12 col-xs-12">
+    <rd-widget>
+      <rd-widget-header icon="user" title-text="User details"></rd-widget-header>
+      <rd-widget-body>
+        <form class="form-horizontal" style="margin-top: 15px">
+          <div class="form-group">
+            <label for="username_field" class="col-sm-2 control-label required text-left">Username</label>
+            <div class="col-sm-8">
+              <input class="form-control" ng-model="formValues.username" id="username_field" />
+            </div>
+          </div>
+
+          <div class="form-group" ng-if="isAdmin">
+            <div class="col-sm-12">
+              <por-switch-field
+                label-class="'col-sm-3 col-lg-2 control-label text-left'"
+                checked="formValues.Administrator"
+                label="'Administrator'"
+                tooltip="'Administrators have access to Portainer settings management as well as full control over all defined environments and their resources.'"
+                on-change="(handleAdministratorChange)"
+              ></por-switch-field>
+            </div>
+          </div>
+
+          <div class="form-group">
+            <div class="col-sm-4">
+              <button class="btn btn-primary btn-sm" ng-disabled="!isSubmitEnabled()" ng-click="updateUser()">Save</button>
+              <button class="btn btn-danger btn-sm vertical-center" ng-disabled="isDeleteDisabled()" ng-click="deleteUser()">
+                <pr-icon icon="'trash-2'" size="'sm'" class="vertical-center"></pr-icon>Delete this user
+              </button>
+            </div>
+          </div>
+        </form>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
+
+<div class="row" ng-if="AuthenticationMethod === 1">
+  <div class="col-lg-12 col-md-12 col-xs-12">
+    <rd-widget>
+      <rd-widget-header icon="lock" title-text="Change user password"></rd-widget-header>
+      <rd-widget-body>
+        <form name="form" class="form-horizontal" style="margin-top: 15px">
+          <!-- new-password-input -->
+          <div class="form-group">
+            <label for="new_password" class="col-sm-2 control-label required text-left">New password</label>
+            <div class="col-sm-8">
+              <input type="password" class="form-control" ng-model="formValues.newPassword" id="new_password" name="new_password" ng-minlength="requiredPasswordLength" />
+            </div>
+          </div>
+          <!-- !new-password-input -->
+          <!-- confirm-password-input -->
+          <div class="form-group">
+            <label for="confirm_password" class="col-sm-2 control-label required text-left">Confirm password</label>
+            <div class="col-sm-8">
+              <div class="input-group">
+                <input type="password" class="form-control" ng-model="formValues.confirmPassword" id="confirm_password" />
+                <span class="input-group-addon">
+                  <pr-icon icon="'check'" class="icon-success" ng-if="form.new_password.$viewValue !== '' && form.new_password.$viewValue === formValues.confirmPassword"></pr-icon>
+                  <pr-icon icon="'x'" class="icon-danger" ng-if="!(form.new_password.$viewValue !== '' && form.new_password.$viewValue === formValues.confirmPassword)"></pr-icon>
+                </span>
+              </div>
+            </div>
+          </div>
+          <!-- !confirm-password-input -->
+          <password-check-hint password-valid="form.new_password.$valid && formValues.newPassword"></password-check-hint>
+          <div class="form-group">
+            <div class="col-sm-2">
+              <button
+                type="submit"
+                class="btn btn-primary btn-sm"
+                ng-disabled="form.new_password.$viewValue === '' || form.$invalid || !formValues.newPassword || !formValues.confirmPassword || form.new_password.$viewValue !== formValues.confirmPassword"
+                ng-click="updatePassword()"
+                >Update password</button
+              >
+            </div>
+          </div>
+        </form>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
diff --git a/app/portainer/views/users/edit/userController.js b/app/portainer/views/users/edit/userController.js
new file mode 100644
index 0000000..e27667c
--- /dev/null
+++ b/app/portainer/views/users/edit/userController.js
@@ -0,0 +1,135 @@
+import { ModalType } from '@@/modals';
+import { buildConfirmButton } from '@@/modals/utils';
+import { confirm, confirmChangePassword, confirmDelete } from '@@/modals/confirm';
+
+angular.module('portainer.app').controller('UserController', [
+  '$q',
+  '$scope',
+  '$state',
+  '$transition$',
+  'UserService',
+  'Notifications',
+  'SettingsService',
+  'Authentication',
+  function ($q, $scope, $state, $transition$, UserService, Notifications, SettingsService, Authentication) {
+    $scope.state = {
+      updatePasswordError: '',
+    };
+
+    $scope.formValues = {
+      username: '',
+      newPassword: '',
+      confirmPassword: '',
+      Administrator: false,
+    };
+
+    $scope.handleAdministratorChange = function (checked) {
+      return $scope.$evalAsync(() => {
+        $scope.formValues.Administrator = checked;
+      });
+    };
+
+    $scope.deleteUser = function () {
+      confirmDelete('Do you want to remove this user? This user will not be able to login into Portainer anymore.').then((confirmed) => {
+        if (!confirmed) {
+          return;
+        }
+        deleteUser();
+      });
+    };
+
+    $scope.updateUser = async function () {
+      const role = $scope.formValues.Administrator ? 1 : 2;
+      const oldUsername = $scope.user.Username;
+      const username = $scope.formValues.username;
+
+      if (username != oldUsername) {
+        const confirmed = await confirm({
+          title: 'Are you sure?',
+          modalType: ModalType.Warn,
+          message: `Are you sure you want to rename the user ${oldUsername} to ${username}?`,
+          confirmButton: buildConfirmButton('Update'),
+        });
+
+        if (!confirmed) {
+          return;
+        }
+      }
+
+      UserService.updateUser($scope.user.Id, { role, username })
+        .then(function success() {
+          Notifications.success('Success', 'User successfully updated');
+          $state.reload();
+        })
+        .catch(function error(err) {
+          Notifications.error('Failure', err, 'Unable to update user permissions');
+        });
+    };
+
+    $scope.updatePassword = async function () {
+      const isCurrentUser = Authentication.getUserDetails().ID === $scope.user.Id;
+      const confirmed = !isCurrentUser || (await confirmChangePassword());
+      if (!confirmed) {
+        return;
+      }
+      UserService.updateUser($scope.user.Id, { newPassword: $scope.formValues.newPassword })
+        .then(function success() {
+          Notifications.success('Success', 'Password successfully updated');
+
+          if (isCurrentUser) {
+            $state.go('portainer.logout');
+          } else {
+            $state.reload();
+          }
+        })
+        .catch(function error(err) {
+          Notifications.error('Failure', err, 'Unable to update user password');
+        });
+    };
+
+    function deleteUser() {
+      UserService.deleteUser($scope.user.Id)
+        .then(function success() {
+          Notifications.success('User successfully deleted', $scope.user.Username);
+          $state.go('portainer.users');
+        })
+        .catch(function error(err) {
+          Notifications.error('Failure', err, 'Unable to remove user');
+        });
+    }
+
+    $scope.isSubmitEnabled = isSubmitEnabled;
+    function isSubmitEnabled() {
+      const { user, formValues } = $scope;
+      return user && (user.Username !== formValues.username || (formValues.Administrator && user.Role !== 1) || (!formValues.Administrator && user.Role === 1));
+    }
+
+    $scope.isDeleteDisabled = isDeleteDisabled;
+    function isDeleteDisabled() {
+      const { user } = $scope;
+      return user && user.Id === 1;
+    }
+
+    function initView() {
+      $scope.isAdmin = Authentication.isAdmin();
+
+      $q.all({
+        user: UserService.user($transition$.params().id),
+        settings: SettingsService.publicSettings(),
+      })
+        .then(function success(data) {
+          var user = data.user;
+          $scope.user = user;
+          $scope.formValues.Administrator = user.Role === 1;
+          $scope.formValues.username = user.Username;
+          $scope.AuthenticationMethod = data.settings.AuthenticationMethod;
+          $scope.requiredPasswordLength = data.settings.RequiredPasswordLength;
+        })
+        .catch(function error(err) {
+          Notifications.error('Failure', err, 'Unable to retrieve user information');
+        });
+    }
+
+    initView();
+  },
+]);
diff --git a/app/react-table-config.d.ts b/app/react-table-config.d.ts
new file mode 100644
index 0000000..276e9ba
--- /dev/null
+++ b/app/react-table-config.d.ts
@@ -0,0 +1,10 @@
+import '@tanstack/react-table';
+
+declare module '@tanstack/react-table' {
+  interface ColumnMeta<TData extends RowData, TValue> {
+    className?: string;
+    filter?: Filter<TData, TValue>;
+    width?: number | 'auto' | string;
+    minWidth?: string;
+  }
+}
diff --git a/app/react-tools/apply-set-state-action.ts b/app/react-tools/apply-set-state-action.ts
new file mode 100644
index 0000000..5c84bff
--- /dev/null
+++ b/app/react-tools/apply-set-state-action.ts
@@ -0,0 +1,12 @@
+import { SetStateAction } from 'react';
+
+export function applySetStateAction<T>(applier: SetStateAction<T>, values: T) {
+  if (isFunction(applier)) {
+    return applier(values);
+  }
+  return applier;
+
+  function isFunction(value: unknown): value is (prevState: T) => T {
+    return typeof value === 'function';
+  }
+}
diff --git a/app/react-tools/react-query.ts b/app/react-tools/react-query.ts
new file mode 100644
index 0000000..2156b36
--- /dev/null
+++ b/app/react-tools/react-query.ts
@@ -0,0 +1,124 @@
+import {
+  MutationCache,
+  MutationOptions,
+  QueryCache,
+  QueryClient,
+  QueryKey,
+  QueryOptions,
+} from '@tanstack/react-query';
+
+import { notifyError } from '@/portainer/services/notifications';
+import { isAxiosError } from '@/react/portainer/services/axios/utils/isAxiosError';
+import { parseAxiosError } from '@/react/portainer/services/axios/utils/parseAxiosError';
+
+export function withError(fallbackMessage?: string, title = 'Failure') {
+  return {
+    meta: {
+      error: { message: fallbackMessage, title },
+    },
+  };
+}
+
+type OptionalReadonly<T> = T | Readonly<T>;
+
+export function withInvalidate(
+  queryClient: QueryClient,
+  queryKeysToInvalidate: Array<OptionalReadonly<Array<unknown>>>,
+  // skipRefresh will set the mutation state to success without waiting for the invalidated queries to refresh
+  // see the following for info: https://tkdodo.eu/blog/mastering-mutations-in-react-query#awaited-promises
+  { skipRefresh }: { skipRefresh?: boolean } = {}
+) {
+  return {
+    onSuccess() {
+      const promise = Promise.all(
+        queryKeysToInvalidate.map((keys) => queryClient.invalidateQueries(keys))
+      );
+      return skipRefresh
+        ? undefined // don't wait for queries to refresh before setting state to success
+        : promise; // stay loading until all queries are refreshed
+    },
+  };
+}
+
+export function mutationOptions<
+  TData = unknown,
+  TError = unknown,
+  TVariables = void,
+  TContext = unknown,
+>(...options: MutationOptions<TData, TError, TVariables, TContext>[]) {
+  return mergeOptions(options);
+}
+
+export function queryOptions<
+  TQueryFnData = unknown,
+  TError = unknown,
+  TData = TQueryFnData,
+  TQueryKey extends QueryKey = QueryKey,
+>(...options: QueryOptions<TQueryFnData, TError, TData, TQueryKey>[]) {
+  return mergeOptions(options);
+}
+
+function mergeOptions<T>(options: T[]) {
+  return options.reduce(
+    (acc, option) => ({
+      ...acc,
+      ...option,
+    }),
+    {} as T
+  );
+}
+
+export function createQueryClient() {
+  return new QueryClient({
+    defaultOptions: {
+      queries: {
+        networkMode: 'offlineFirst',
+        staleTime: 20,
+      },
+    },
+    mutationCache: new MutationCache({
+      onError: (error, variable, context, mutation) => {
+        handleError(error, mutation.meta?.error);
+      },
+    }),
+    queryCache: new QueryCache({
+      onError: (error, mutation) => {
+        handleError(error, mutation.meta?.error);
+      },
+    }),
+  });
+}
+
+function handleError(error: unknown, errorMeta?: unknown) {
+  const meta = extractErrorMeta(errorMeta);
+
+  // suppress error when `meta.error` is falsy
+  if (!meta) {
+    return;
+  }
+
+  const parsedError = isAxiosError(error)
+    ? parseAxiosError(error, meta?.message ?? '')
+    : error;
+
+  notifyError(meta?.title || 'Failure', parsedError, meta?.message);
+}
+
+function extractErrorMeta(errorMeta?: unknown) {
+  if (!errorMeta || typeof errorMeta !== 'object') {
+    return undefined;
+  }
+
+  let title = '';
+  if ('title' in errorMeta && typeof errorMeta.title === 'string') {
+    title = errorMeta.title;
+  }
+  let message = '';
+  if ('message' in errorMeta && typeof errorMeta.message === 'string') {
+    message = errorMeta.message;
+  }
+
+  return { title, message };
+}
+
+export const queryClient = createQueryClient();
diff --git a/app/react-tools/react2angular.tsx b/app/react-tools/react2angular.tsx
new file mode 100644
index 0000000..f00ebb5
--- /dev/null
+++ b/app/react-tools/react2angular.tsx
@@ -0,0 +1,81 @@
+import ReactDOM from 'react-dom';
+import { IComponentOptions, IController } from 'angular';
+import { StrictMode } from 'react';
+import _ from 'lodash';
+
+function toProps(
+  propNames: string[],
+  controller: IController,
+  $q: ng.IQService
+) {
+  return Object.fromEntries(
+    propNames.map((key) => {
+      const prop = controller[key];
+      if (typeof prop !== 'function') {
+        return [key, prop];
+      }
+
+      return [
+        key,
+        (...args: unknown[]) =>
+          $q((resolve) => resolve(controller[key](...args))),
+      ];
+    })
+  );
+}
+
+export type PropNames<T> = Exclude<keyof T, number | symbol>;
+
+/**
+ * react2angular is used to bind a React component to an AngularJS component
+ * it used in an AngularJS module definition:
+ *
+ * `.component('componentName', react2angular(ComponentName, ['prop1', 'prop2']))`
+ *
+ * if the second parameter has any ts errors check that the component has the correct props
+ */
+export function react2angular<T, U extends PropNames<T>[]>(
+  Component: React.ComponentType<T & JSX.IntrinsicAttributes>,
+  propNames: U & ([PropNames<T>] extends [U[number]] ? unknown : PropNames<T>)
+): IComponentOptions & { name: string } {
+  const bindings = Object.fromEntries(propNames.map((key) => [key, '<']));
+
+  return {
+    bindings,
+    controller: Controller,
+    name: _.camelCase(Component.displayName || Component.name),
+  };
+
+  /* @ngInject */
+  function Controller(
+    this: IController,
+    $element: HTMLElement[],
+    $q: ng.IQService
+  ) {
+    let isDestroyed = false;
+    const el = $element[0];
+
+    this.$onChanges = () => {
+      if (!isDestroyed) {
+        const props = toProps(propNames, this, $q);
+        ReactDOM.render(
+          <StrictMode>
+            {/* eslint-disable-next-line react/jsx-props-no-spreading */}
+            <Component {...(props as T & JSX.IntrinsicAttributes)} />
+          </StrictMode>,
+
+          el
+        );
+      }
+    };
+
+    this.$onDestroy = () => {
+      if (!isDestroyed) {
+        isDestroyed = true;
+        ReactDOM.unmountComponentAtNode(el);
+      }
+    };
+  }
+}
+
+export const r2a = react2angular;
diff --git a/app/react-tools/test-mocks.ts b/app/react-tools/test-mocks.ts
new file mode 100644
index 0000000..90c3b12
--- /dev/null
+++ b/app/react-tools/test-mocks.ts
@@ -0,0 +1,294 @@
+import _ from 'lodash';
+import { QueryObserverResult } from '@tanstack/react-query';
+
+import { Team } from '@/react/portainer/users/teams/types';
+import { Role, User, UserId } from '@/portainer/users/types';
+import {
+  ContainerEngine,
+  Environment,
+} from '@/react/portainer/environments/types';
+import { Stack, StackStatus, StackType } from '@/react/common/stacks/types';
+import { ContainerDetailsViewModel } from '@/docker/models/containerDetails';
+import { EnvironmentGroup } from '@/react/portainer/environments/environment-groups/types';
+
+export function createMockUser(overrides: Partial<User> = {}) {
+  return {
+    Id: 1,
+    Username: 'user',
+    RoleName: '',
+    AuthenticationMethod: '',
+    Checked: false,
+    EndpointAuthorizations: {},
+    PortainerAuthorizations: {},
+    UseCache: false,
+    ThemeSettings: {
+      color: 'auto',
+      subtleUpgradeButton: false,
+      ...overrides.ThemeSettings,
+    },
+    ...overrides,
+  } as User;
+}
+
+export function createMockUsers(
+  count: number,
+  roles: Role | Role[] | ((id: UserId) => Role)
+): User[] {
+  return _.range(1, count + 1).map((value) =>
+    createMockUser({
+      Id: value,
+      Username: `user${value}`,
+      Role: getRoles(roles, value),
+    })
+  );
+}
+
+function getRoles(
+  roles: Role | Role[] | ((id: UserId) => Role),
+  id: UserId
+): Role {
+  if (typeof roles === 'function') {
+    return roles(id);
+  }
+
+  if (typeof roles === 'number') {
+    return roles;
+  }
+
+  // Roles is an array
+  if (roles.length === 0) {
+    throw new Error('No roles provided');
+  }
+
+  // The number of roles is not necessarily the same length as the number of users
+  // so we need to distribute the roles evenly and consistently
+  return roles[(id - 1) % roles.length];
+}
+
+export function createMockTeams(count: number): Team[] {
+  return _.range(1, count + 1).map((value) => ({
+    Id: value,
+    Name: `team${value}`,
+  }));
+}
+
+export function createMockSubscriptions(count: number) {
+  const subscriptions = _.range(1, count + 1).map((x) => ({
+    id: `/subscriptions/subscription-${x}`,
+    subscriptionId: `subscription-${x}`,
+  }));
+
+  return { value: subscriptions };
+}
+
+export function createMockResourceGroups(subscription: string, count: number) {
+  const resourceGroups = _.range(1, count + 1).map((x) => ({
+    id: `/subscriptions/${subscription}/resourceGroups/resourceGroup-${x}`,
+    name: `resourcegroup-${x}`,
+  }));
+
+  return { value: resourceGroups };
+}
+
+export function createMockEnvironment(
+  overrides: Partial<Environment> = {}
+): Environment {
+  return {
+    TagIds: [],
+    GroupId: 1,
+    Type: 1,
+    ContainerEngine: ContainerEngine.Docker,
+    Name: 'environment',
+    Status: 1,
+    URL: 'url',
+    Snapshots: [],
+    Kubernetes: {
+      Flags: {
+        IsServerMetricsDetected: true,
+        IsServerIngressClassDetected: true,
+        IsServerStorageDetected: true,
+      },
+      Snapshots: [],
+      Configuration: {
+        IngressClasses: [],
+        IngressAvailabilityPerNamespace: false,
+        AllowNoneIngressClass: false,
+      },
+    },
+    UserAccessPolicies: {},
+    TeamAccessPolicies: {},
+    ComposeSyntaxMaxVersion: '0',
+    EdgeKey: '',
+    EnableGPUManagement: false,
+    Id: 3,
+    UserTrusted: false,
+    Edge: {
+      AsyncMode: false,
+      PingInterval: 0,
+      CommandInterval: 0,
+      SnapshotInterval: 0,
+    },
+    SecuritySettings: {
+      allowBindMountsForRegularUsers: false,
+      allowPrivilegedModeForRegularUsers: false,
+      allowContainerCapabilitiesForRegularUsers: false,
+      allowDeviceMappingForRegularUsers: false,
+      allowHostNamespaceForRegularUsers: false,
+      allowStackManagementForRegularUsers: false,
+      allowSysctlSettingForRegularUsers: false,
+      allowSecurityOptForRegularUsers: false,
+      allowVolumeBrowserForRegularUsers: false,
+      enableHostManagementFeatures: false,
+    },
+    DeploymentOptions: {
+      overrideGlobalOptions: false,
+      hideAddWithForm: true,
+      hideWebEditor: false,
+      hideFileUpload: false,
+    },
+    Gpus: [],
+    Agent: { Version: '1.0.0' },
+    EnableImageNotification: false,
+    ChangeWindow: {
+      Enabled: false,
+      EndTime: '',
+      StartTime: '',
+    },
+    StatusMessage: {
+      detail: '',
+      summary: '',
+    },
+    AzureCredentials: {
+      ApplicationID: '',
+      AuthenticationKey: '',
+      TenantID: '',
+    },
+    EdgeCheckinInterval: 0,
+    PublicURL: '',
+    TLSConfig: {
+      TLS: false,
+      TLSSkipVerify: false,
+    },
+    LastCheckInDate: 0,
+    ...overrides,
+  };
+}
+
+export function createMockEnvironmentGroup(
+  overrides: Partial<EnvironmentGroup> = {}
+): EnvironmentGroup {
+  return {
+    Id: 1,
+    Name: 'Unassigned',
+    Description: '',
+    ...overrides,
+  };
+}
+
+export function createMockQueryResult<TData, TError = unknown>(
+  data: TData,
+  overrides?: Partial<QueryObserverResult<TData, TError>>
+) {
+  const defaultResult = {
+    data,
+    dataUpdatedAt: 0,
+    error: null,
+    errorUpdatedAt: 0,
+    failureCount: 0,
+    errorUpdateCount: 0,
+    failureReason: null,
+    isError: false,
+    isFetched: true,
+    isFetchedAfterMount: true,
+    isFetching: false,
+    isInitialLoading: false,
+    isLoading: false,
+    isLoadingError: false,
+    isPaused: false,
+    isPlaceholderData: false,
+    isPreviousData: false,
+    isRefetchError: false,
+    isRefetching: false,
+    isStale: false,
+    isSuccess: true,
+    refetch: async () => defaultResult,
+    remove: () => {},
+    status: 'success',
+    fetchStatus: 'idle',
+  };
+
+  return { ...defaultResult, ...overrides };
+}
+
+export function createMockStack(overrides?: Partial<Stack>): Stack {
+  return {
+    Id: 1,
+    Name: 'test-stack',
+    Type: StackType.DockerCompose,
+    EndpointId: 1,
+    SwarmId: '',
+    EntryPoint: 'docker-compose.yml',
+    Env: [],
+    Status: StackStatus.Active,
+    ProjectPath: '/data/compose/1',
+    CreationDate: Date.now(),
+    CreatedBy: 'admin',
+    UpdateDate: Date.now(),
+    UpdatedBy: 'admin',
+    FromAppTemplate: false,
+    IsComposeFormat: true,
+    SupportRelativePath: false,
+    FilesystemPath: '/data/compose/1',
+    StackFileVersion: 1,
+    PreviousDeploymentInfo: undefined,
+    ...overrides,
+  };
+}
+
+export function createMockContainer(
+  overrides?: Partial<ContainerDetailsViewModel>
+): ContainerDetailsViewModel {
+  return _.merge(
+    {
+      Id: 'container-id-123',
+      Image: 'sha256:abcd1234',
+      State: {
+        Status: 'running',
+        Running: true,
+        Paused: false,
+        Restarting: false,
+        OOMKilled: false,
+        Dead: false,
+        Pid: 1234,
+        ExitCode: 0,
+        Error: '',
+        StartedAt: '2024-01-01T00:00:00Z',
+        FinishedAt: '0001-01-01T00:00:00Z',
+        Health: undefined,
+      },
+      Created: '2024-01-01T00:00:00Z',
+      Name: '/test-container',
+      NetworkSettings: {
+        Ports: {
+          '80/tcp': [{ HostIp: '0.0.0.0', HostPort: '8080' }],
+        },
+      },
+      Args: [],
+      Config: {
+        Image: 'nginx:latest',
+        Cmd: ['nginx', '-g', 'daemon off;'],
+        Entrypoint: [],
+        Env: ['PATH=/usr/local/bin', 'NODE_ENV=production'],
+        Labels: { 'com.example.label': 'value' },
+      },
+      HostConfig: {
+        RestartPolicy: { Name: 'always', MaximumRetryCount: 0 },
+        Sysctls: { 'net.ipv4.ip_forward': '1' },
+        DeviceRequests: [],
+      },
+      Mounts: [],
+      Model: {} as ContainerDetailsViewModel['Model'],
+    },
+    overrides
+  ) as ContainerDetailsViewModel;
+}
diff --git a/app/react-tools/useDebugPropChanges.ts b/app/react-tools/useDebugPropChanges.ts
new file mode 100644
index 0000000..80d133e
--- /dev/null
+++ b/app/react-tools/useDebugPropChanges.ts
@@ -0,0 +1,54 @@
+/* eslint-disable react-hooks/refs */
+/* eslint-disable no-console */
+import { intersection } from 'lodash';
+import { useEffect, useRef } from 'react';
+
+function logPropDifferences(
+  newProps: Record<string, unknown>,
+  lastProps: Record<string, unknown>,
+  verbose: boolean
+) {
+  const allKeys = intersection(Object.keys(newProps), Object.keys(lastProps));
+
+  const changedKeys: string[] = [];
+
+  allKeys.forEach((key) => {
+    const newValue = newProps[key];
+    const lastValue = lastProps[key];
+    if (newValue !== lastValue) {
+      changedKeys.push(key);
+    }
+  });
+
+  if (changedKeys.length) {
+    if (verbose) {
+      changedKeys.forEach((key) => {
+        const newValue = newProps[key];
+        const lastValue = lastProps[key];
+        console.log('Key [', key, '] changed');
+        console.log('From: ', lastValue);
+        console.log('To:   ', newValue);
+        console.log('------');
+      });
+    } else {
+      console.log('Changed keys: ', changedKeys.join());
+    }
+  }
+}
+
+export function useDebugPropChanges(
+  newProps: Record<string, unknown>,
+  verbose: boolean = true
+) {
+  const lastProps = useRef<Record<string, unknown>>();
+  // Should only run when the component re-mounts
+  useEffect(() => {
+    console.log('Mounted');
+  }, []);
+  if (lastProps.current) {
+    logPropDifferences(newProps, lastProps.current, verbose);
+  }
+  lastProps.current = newProps;
+}
+/* eslint-enable react-hooks/refs */
+/* eslint-enable no-console */
diff --git a/app/react-tools/withControlledInput.tsx b/app/react-tools/withControlledInput.tsx
new file mode 100644
index 0000000..7ef5226
--- /dev/null
+++ b/app/react-tools/withControlledInput.tsx
@@ -0,0 +1,137 @@
+import { ComponentType, useEffect, useMemo, useState } from 'react';
+
+type KeyRecord<T> = Record<keyof T, T[keyof T]>;
+
+type KeysOfFunctions<T> = keyof {
+  [K in keyof T as T[K] extends (v: never) => void ? K : never]: never;
+};
+
+type KeysWithoutFunctions<T> = Exclude<keyof T, KeysOfFunctions<T>>;
+
+/**
+ * React component wrapper that will sync AngularJS bound variables in React state.
+ * This wrapper is mandatory to allow the binding of AngularJS variables directly in controlled components.
+ *
+ * Without this the component will be redrawn everytime the value changes in AngularJS (outside of React control)
+ * and the redraw will create issues when typing in the inputs.
+ *
+ * Examples
+ * ---
+ * SINGLE PAIR
+ * ```tsx
+ * type Props = {
+ *  value: unknown;
+ *  onChange: (v: unknown) => void;
+ * }
+ *
+ * function ReactComponent({ value, onChange }: Props) {
+ *  return <input value={value} onChange={onChange} />
+ * }
+ *
+ * r2a(withControlledInput(ReactComponent), ['value', 'onChange']);
+ *
+ * ```
+ * ---
+ * MULTIPLE PAIRS
+ * ```tsx
+ * type Props = {
+ *  valueStr: string;
+ *  onChangeStr: (v: string) => void;
+ *  valueNum: number;
+ *  onChangeNum: (v: number) => void;
+ * }
+ *
+ * function ReactComponent({ valueStr, onChangeStr, valueNum, onChangeNum }: Props) {
+ *  return (
+ *    <>
+ *      <input type="text" value={valueStr} onChange={onChangeStr} />
+ *      <input type="number" value={valueNum} onChange={onChangeNum} />
+ *    </>
+ *  );
+ * }
+ *
+ * r2a(withControlledInput(ReactComponent, {
+ *    valueStr: 'onChangeStr',
+ *    valueNum: 'onChangeNum'
+ *  }),
+ *  ['valueStr', 'onChangeStr', 'valueNum', 'onChangeNum']
+ * )
+ *
+ * ```
+ *
+ * @param WrappedComponent The React component to wrap
+ * @param controlledValueOnChangePairs A map of `(value:onChange)-like` pairs.
+ * @returns WrappedComponent
+ */
+export function withControlledInput<T>(
+  WrappedComponent: ComponentType<T>,
+  controlledValueOnChangePairs:
+    | {
+        [Key in KeysWithoutFunctions<T>]?: KeysOfFunctions<T>;
+      }
+    | { value?: 'onChange' } = { value: 'onChange' }
+): ComponentType<T> {
+  // Try to create a nice displayName for React Dev Tools.
+  const displayName =
+    WrappedComponent.displayName || WrappedComponent.name || 'Component';
+
+  // extract keys of values that will be updated outside of React lifecycle and their handler functions
+  const keysToControl = Object.entries(controlledValueOnChangePairs) as [
+    keyof T,
+    keyof T,
+  ][];
+
+  function WrapperComponent(props: T) {
+    // map of key = value for all tracked values that will be changed outside of React lifecycle
+    // e.g. save in React state the values that will be changed in AngularJS
+    const [controlledValues, setControlledValues] = useState<KeyRecord<T>>(
+      {} as KeyRecord<T>
+    );
+
+    // generate a map of `funckey = (v: typeof props[value_key]) => void` to wrapp all handler functions.
+    // each wrapped handler is referencing the key of the value it is changing so we can't use a single sync func
+    const handlers = useMemo(
+      () =>
+        Object.fromEntries(
+          keysToControl.map(([valueKey, onChangeKey]) => [
+            onChangeKey,
+            // generate and save a func that uses the key of the updated value
+            (value: T[keyof T]) => {
+              // update the state with the value coming from WrappedComponent
+              setControlledValues(
+                (c) =>
+                  ({
+                    ...c,
+                    [valueKey]: value,
+                  }) as KeyRecord<T>
+              );
+
+              // call the bound handler func to update the value outside of React
+
+              const onChange = props[onChangeKey];
+              if (typeof onChange === 'function') {
+                onChange(value);
+              }
+            },
+          ])
+        ),
+      [props]
+    );
+
+    // update the React state when a prop changes from outside of React lifecycle
+    // limit keys to update to only tracked values ; ignore untracked props and handler functions
+    useEffect(() => {
+      const toUpdate = Object.fromEntries(
+        keysToControl.map(([key]) => [key, props[key]])
+      ) as KeyRecord<T>;
+
+      setControlledValues(toUpdate);
+    }, [props]);
+
+    return <WrappedComponent {...props} {...handlers} {...controlledValues} />;
+  }
+
+  WrapperComponent.displayName = `withControlledInput(${displayName})`;
+
+  return WrapperComponent;
+}
diff --git a/app/react-tools/withCurrentUser.tsx b/app/react-tools/withCurrentUser.tsx
new file mode 100644
index 0000000..41a48f1
--- /dev/null
+++ b/app/react-tools/withCurrentUser.tsx
@@ -0,0 +1,27 @@
+import { ComponentType } from 'react';
+
+import { UserProvider } from '@/react/hooks/useUser';
+
+import { withReactQuery } from './withReactQuery';
+
+export function withCurrentUser<T>(
+  WrappedComponent: ComponentType<T & JSX.IntrinsicAttributes>
+): ComponentType<T & JSX.IntrinsicAttributes> {
+  // Try to create a nice displayName for React Dev Tools.
+  const displayName =
+    WrappedComponent.displayName || WrappedComponent.name || 'Component';
+
+  function WrapperComponent(props: T & JSX.IntrinsicAttributes) {
+    return (
+      <UserProvider>
+        <WrappedComponent {...props} />
+      </UserProvider>
+    );
+  }
+
+  WrapperComponent.displayName = `withCurrentUser(${displayName})`;
+
+  // User provider makes a call to the API to get the current user.
+  // We need to wrap it with React Query to make that call.
+  return withReactQuery(WrapperComponent);
+}
diff --git a/app/react-tools/withFormValidation.ts b/app/react-tools/withFormValidation.ts
new file mode 100644
index 0000000..90ab642
--- /dev/null
+++ b/app/react-tools/withFormValidation.ts
@@ -0,0 +1,164 @@
+import { IFormController, IComponentOptions, IModule } from 'angular';
+import { FormikErrors } from 'formik';
+import { SchemaOf, object } from 'yup';
+import _ from 'lodash';
+import { ComponentType } from 'react';
+
+import { PropNames, r2a } from '@/react-tools/react2angular';
+
+import { validateForm } from '@@/form-components/validate-form';
+import { ArrayError } from '@@/form-components/InputList/InputList';
+
+interface FormFieldProps<TValue> {
+  onChange(values: TValue): void; // update the values for the entire form object used in yup validation, not just one input.
+  values: TValue; // current values
+  errors?: FormikErrors<TValue> | ArrayError<TValue>;
+}
+
+type WithFormFieldProps<TProps, TValue> = TProps & FormFieldProps<TValue>;
+
+type ValidationResult<T> = FormikErrors<T> | undefined;
+
+/**
+ * This utility function is used for wrapping React components with form validation.
+ * When used inside an Angular form, it sets the form to invalid if the component values are invalid.
+ * This function registers two AngularJS components:
+ * 1. The React component with r2a wrapping:
+ *   - `onChange` and `values` must be manually passed to the React component from an Angular view.
+ *   - `errors` will be automatically passed to the React component and updated by the validation component.
+ * 2. An AngularJS component that handles form validation, based on a yup validation schema:
+ *   - `validationData` can optionally be passed to the React component from an Angular view, which can be used in validation.
+ *
+ * @example
+ * // Usage in Angular view
+ * <component
+ *   values="ctrl.values"
+ *   on-change="ctrl.handleChange"
+ *   validation-data="ctrl.validationData">
+ * </component>
+ */
+export function withFormValidation<TProps, TValue, TData = never>(
+  ngModule: IModule,
+  Component: ComponentType<WithFormFieldProps<TProps, TValue>>,
+  componentName: string,
+  propNames: PropNames<TProps>[],
+  schemaBuilder: (validationData?: TData) => SchemaOf<TValue>,
+  isPrimitive = false
+) {
+  const reactComponentName = `react${_.upperFirst(componentName)}`;
+
+  ngModule
+    .component(
+      reactComponentName,
+      r2a(Component, ['errors', 'onChange', 'values', ...propNames])
+    )
+    .component(
+      componentName,
+      createFormValidationComponent(
+        reactComponentName,
+        propNames,
+        schemaBuilder,
+        isPrimitive
+      )
+    );
+}
+
+export function createFormValidationComponent<TFormModel, TData = never>(
+  componentName: string,
+  propNames: Array<string>,
+  schemaBuilder: (validationData?: TData) => SchemaOf<TFormModel>,
+  isPrimitive = false
+): IComponentOptions {
+  const kebabName = _.kebabCase(componentName);
+  const propsWithErrors = [...propNames, 'errors', 'values'];
+
+  return {
+    template: `<ng-form name="$ctrl.form">
+      <${kebabName} ${propsWithErrors
+        .filter((p) => p !== 'onChange')
+        .map((p) => `${_.kebabCase(p)}="$ctrl.${p}"`)
+        .join(' ')}
+        on-change="($ctrl.handleChange)"
+      ></${kebabName}>
+    </ng-form>`,
+    controller: createFormValidatorController(schemaBuilder, isPrimitive),
+    bindings: Object.fromEntries(
+      [...propsWithErrors, 'validationData', 'onChange'].map((p) => [p, '<'])
+    ),
+  };
+}
+
+function createFormValidatorController<TFormModel, TData = never>(
+  schemaBuilder: (validationData?: TData) => SchemaOf<TFormModel>,
+  isPrimitive = false
+) {
+  return class FormValidatorController {
+    errors?: FormikErrors<TFormModel>;
+
+    $async: <T>(fn: () => Promise<T>) => Promise<T>;
+
+    form?: IFormController;
+
+    values?: TFormModel;
+
+    validationData?: TData;
+
+    onChange?: (value: TFormModel) => void;
+
+    /* @ngInject */
+    constructor($async: <T>(fn: () => Promise<T>) => Promise<T>) {
+      this.$async = $async;
+
+      this.handleChange = this.handleChange.bind(this);
+      this.runValidation = this.runValidation.bind(this);
+    }
+
+    async handleChange(newValues: TFormModel) {
+      return this.$async(async () => {
+        this.onChange?.(newValues);
+        await this.runValidation(newValues);
+      });
+    }
+
+    async runValidation(value: TFormModel) {
+      return this.$async(async () => {
+        this.form?.$setValidity('form', true, this.form);
+
+        const schema = schemaBuilder(this.validationData);
+        this.errors = await validate<TFormModel>(schema, value, isPrimitive);
+
+        if (this.errors && Object.keys(this.errors).length > 0) {
+          this.form?.$setValidity('form', false, this.form);
+        }
+      });
+    }
+
+    async $onChanges(changes: {
+      values?: { currentValue: TFormModel };
+      validationData?: { currentValue: TData };
+    }) {
+      if (changes.values) {
+        await this.runValidation(changes.values.currentValue);
+      }
+      // also run validation if validationData changes
+      if (changes.validationData) {
+        await this.runValidation(this.values!);
+      }
+    }
+  };
+}
+
+async function validate<TFormModel>(
+  schema: SchemaOf<TFormModel>,
+  value: TFormModel,
+  isPrimitive: boolean
+): Promise<ValidationResult<TFormModel>> {
+  if (isPrimitive) {
+    const result = await validateForm<{ value: TFormModel }>(
+      () => object({ value: schema }),
+      { value }
+    );
+    return result?.value as ValidationResult<TFormModel>;
+  }
+  return validateForm<TFormModel>(() => schema, value);
+}
diff --git a/app/react-tools/withI18nSuspense.tsx b/app/react-tools/withI18nSuspense.tsx
new file mode 100644
index 0000000..c704149
--- /dev/null
+++ b/app/react-tools/withI18nSuspense.tsx
@@ -0,0 +1,21 @@
+import { ComponentType, Suspense } from 'react';
+
+export function withI18nSuspense<T>(
+  WrappedComponent: ComponentType<T>
+): ComponentType<T> {
+  // Try to create a nice displayName for React Dev Tools.
+  const displayName =
+    WrappedComponent.displayName || WrappedComponent.name || 'Component';
+
+  function WrapperComponent(props: T & JSX.IntrinsicAttributes) {
+    return (
+      <Suspense fallback="Loading translations...">
+        <WrappedComponent {...props} />
+      </Suspense>
+    );
+  }
+
+  WrapperComponent.displayName = `withI18nSuspense(${displayName})`;
+
+  return WrapperComponent;
+}
diff --git a/app/react-tools/withReactQuery.tsx b/app/react-tools/withReactQuery.tsx
new file mode 100644
index 0000000..e574a5f
--- /dev/null
+++ b/app/react-tools/withReactQuery.tsx
@@ -0,0 +1,25 @@
+import { ComponentType } from 'react';
+import { QueryClientProvider } from '@tanstack/react-query';
+
+import { queryClient as defaultQueryClient } from './react-query';
+
+export function withReactQuery<T>(
+  WrappedComponent: ComponentType<T & JSX.IntrinsicAttributes>,
+  queryClient = defaultQueryClient
+): ComponentType<T & JSX.IntrinsicAttributes> {
+  // Try to create a nice displayName for React Dev Tools.
+  const displayName =
+    WrappedComponent.displayName || WrappedComponent.name || 'Component';
+
+  function WrapperComponent(props: T & JSX.IntrinsicAttributes) {
+    return (
+      <QueryClientProvider client={queryClient}>
+        <WrappedComponent {...props} />
+      </QueryClientProvider>
+    );
+  }
+
+  WrapperComponent.displayName = `withReactQuery(${displayName})`;
+
+  return WrapperComponent;
+}
diff --git a/app/react-tools/withUIRouter.tsx b/app/react-tools/withUIRouter.tsx
new file mode 100644
index 0000000..3046d98
--- /dev/null
+++ b/app/react-tools/withUIRouter.tsx
@@ -0,0 +1,22 @@
+import { ComponentType } from 'react';
+import { UIRouterContextComponent } from '@uirouter/react-hybrid';
+
+export function withUIRouter<T>(
+  WrappedComponent: ComponentType<T>
+): ComponentType<T> {
+  // Try to create a nice displayName for React Dev Tools.
+  const displayName =
+    WrappedComponent.displayName || WrappedComponent.name || 'Component';
+
+  function WrapperComponent(props: T & JSX.IntrinsicAttributes) {
+    return (
+      <UIRouterContextComponent>
+        <WrappedComponent {...props} />
+      </UIRouterContextComponent>
+    );
+  }
+
+  WrapperComponent.displayName = `withUIRouter(${displayName})`;
+
+  return WrapperComponent;
+}
diff --git a/app/react-tools/yup-schemas.ts b/app/react-tools/yup-schemas.ts
new file mode 100644
index 0000000..4f614e2
--- /dev/null
+++ b/app/react-tools/yup-schemas.ts
@@ -0,0 +1,19 @@
+import { NumberSchema, number } from 'yup';
+
+/**
+ * Returns a Yup schema for a number that can also be NaN.
+ *
+ * This function is a workaround for a known issue in Yup where it throws type errors
+ * when the number input is empty, having a value NaN. Yup doesn't like NaN values.
+ * More details can be found in these GitHub issues:
+ * https://github.com/jquense/yup/issues/1330
+ * https://github.com/jquense/yup/issues/211
+ *
+ * @param errorMessage The custom error message to display when the value is required.
+ * @returns A Yup number schema with a custom type error message.
+ */
+export function nanNumberSchema(
+  errorMessage = 'Value is required'
+): NumberSchema {
+  return number().typeError(errorMessage);
+}
diff --git a/app/react/auth/.keep b/app/react/auth/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/auth/InternalLoginView/.keep b/app/react/auth/InternalLoginView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/auth/LoginView/.keep b/app/react/auth/LoginView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/azure/DashboardView/DashboardView.test.tsx b/app/react/azure/DashboardView/DashboardView.test.tsx
new file mode 100644
index 0000000..58bc892
--- /dev/null
+++ b/app/react/azure/DashboardView/DashboardView.test.tsx
@@ -0,0 +1,152 @@
+import { http, HttpResponse } from 'msw';
+import { render, within } from '@testing-library/react';
+
+import { UserViewModel } from '@/portainer/models/user';
+import { server } from '@/setup-tests/server';
+import {
+  createMockEnvironment,
+  createMockResourceGroups,
+  createMockSubscriptions,
+} from '@/react-tools/test-mocks';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+
+import { DashboardView } from './DashboardView';
+
+vi.mock('@uirouter/react', async (importOriginal: () => Promise<object>) => ({
+  ...(await importOriginal()),
+  useCurrentStateAndParams: vi.fn(() => ({
+    params: { endpointId: 1 },
+  })),
+}));
+
+test('dashboard items should render correctly', async () => {
+  const { findByLabelText } = await renderComponent();
+
+  const subscriptionsItem = await findByLabelText('Subscription');
+  expect(subscriptionsItem).toBeVisible();
+
+  const subscriptionElements = within(subscriptionsItem);
+  expect(subscriptionElements.getByLabelText('value')).toBeVisible();
+
+  expect(subscriptionElements.getByLabelText('resourceType')).toHaveTextContent(
+    'Subscriptions'
+  );
+
+  const resourceGroupsItem = await findByLabelText('Resource group');
+  expect(resourceGroupsItem).toBeVisible();
+
+  const resourceGroupElements = within(resourceGroupsItem);
+  expect(resourceGroupElements.getByLabelText('value')).toBeVisible();
+
+  expect(
+    resourceGroupElements.getByLabelText('resourceType')
+  ).toHaveTextContent('Resource groups');
+});
+
+test('when there are no subscriptions, should show 0 subscriptions and 0 resource groups', async () => {
+  const { findByLabelText } = await renderComponent();
+
+  const subscriptionElements = within(await findByLabelText('Subscription'));
+  expect(subscriptionElements.getByLabelText('value')).toHaveTextContent('0');
+
+  const resourceGroupElements = within(await findByLabelText('Resource group'));
+  expect(resourceGroupElements.getByLabelText('value')).toHaveTextContent('0');
+});
+
+test('when there is subscription & resource group data, should display these', async () => {
+  const { findByLabelText } = await renderComponent(1, { 'subscription-1': 2 });
+
+  const subscriptionElements = within(await findByLabelText('Subscription'));
+  expect(subscriptionElements.getByLabelText('value')).toHaveTextContent('1');
+
+  const resourceGroupElements = within(await findByLabelText('Resource group'));
+  expect(resourceGroupElements.getByLabelText('value')).toHaveTextContent('2');
+});
+
+test('should correctly show total number of resource groups across multiple subscriptions', async () => {
+  const { findByLabelText } = await renderComponent(2, {
+    'subscription-1': 2,
+    'subscription-2': 3,
+  });
+
+  const resourceGroupElements = within(await findByLabelText('Resource group'));
+  expect(resourceGroupElements.getByLabelText('value')).toHaveTextContent('5');
+});
+
+test("when only subscriptions fail to load, don't show the dashboard", async () => {
+  vi.spyOn(console, 'error').mockImplementation(() => {});
+
+  const { queryByLabelText } = await renderComponent(
+    1,
+    { 'subscription-1': 1 },
+    500,
+    200
+  );
+  expect(queryByLabelText('Subscription')).not.toBeInTheDocument();
+  expect(queryByLabelText('Resource group')).not.toBeInTheDocument();
+});
+
+test('when only resource groups fail to load, still show the subscriptions', async () => {
+  vi.spyOn(console, 'error').mockImplementation(() => {});
+
+  const { queryByLabelText, findByLabelText } = await renderComponent(
+    1,
+    { 'subscription-1': 1 },
+    200,
+    500
+  );
+  await expect(findByLabelText('Subscription')).resolves.toBeInTheDocument();
+  expect(queryByLabelText('Resource group')).not.toBeInTheDocument();
+});
+
+async function renderComponent(
+  subscriptionsCount = 0,
+  resourceGroups: Record<string, number> = {},
+  subscriptionsStatus = 200,
+  resourceGroupsStatus = 200
+) {
+  const user = new UserViewModel({ Username: 'user' });
+
+  server.use(
+    http.get('/api/endpoints/1', () =>
+      HttpResponse.json(createMockEnvironment())
+    ),
+
+    http.get('/api/endpoints/:endpointId/azure/subscriptions', () =>
+      HttpResponse.json(createMockSubscriptions(subscriptionsCount), {
+        status: subscriptionsStatus,
+      })
+    ),
+    http.get(
+      '/api/endpoints/:endpointId/azure/subscriptions/:subscriptionId/resourcegroups',
+      ({ params }) => {
+        if (typeof params.subscriptionId !== 'string') {
+          throw new Error("Provided subscriptionId must be of type: 'string'");
+        }
+
+        const { subscriptionId } = params;
+        return HttpResponse.json(
+          createMockResourceGroups(
+            subscriptionId,
+            resourceGroups[subscriptionId] || 0
+          ),
+          {
+            status: resourceGroupsStatus,
+          }
+        );
+      }
+    )
+  );
+
+  const Wrapped = withTestQueryProvider(
+    withUserProvider(withTestRouter(DashboardView), user)
+  );
+
+  const renderResult = render(<Wrapped />);
+
+  await expect(renderResult.findByText(/Home/)).resolves.toBeVisible();
+
+  return renderResult;
+}
diff --git a/app/react/azure/DashboardView/DashboardView.tsx b/app/react/azure/DashboardView/DashboardView.tsx
new file mode 100644
index 0000000..05ebc0a
--- /dev/null
+++ b/app/react/azure/DashboardView/DashboardView.tsx
@@ -0,0 +1,57 @@
+import { Package } from 'lucide-react';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import Subscription from '@/assets/ico/subscription.svg?c';
+
+import { PageHeader } from '@@/PageHeader';
+import { DashboardItem } from '@@/DashboardItem';
+import { DashboardGrid } from '@@/DashboardItem/DashboardGrid';
+
+import { useResourceGroups } from '../queries/useResourceGroups';
+import { useSubscriptions } from '../queries/useSubscriptions';
+
+export function DashboardView() {
+  const environmentId = useEnvironmentId();
+
+  const subscriptionsQuery = useSubscriptions(environmentId);
+
+  const resourceGroupsQuery = useResourceGroups(
+    environmentId,
+    subscriptionsQuery.data
+  );
+
+  const subscriptionsCount = subscriptionsQuery.data?.length;
+  const resourceGroupsCount = Object.values(
+    resourceGroupsQuery.resourceGroups
+  ).flatMap((x) => Object.values(x)).length;
+
+  return (
+    <>
+      <PageHeader title="Home" breadcrumbs={[{ label: 'Dashboard' }]} reload />
+
+      <div className="mx-4">
+        {subscriptionsQuery.data && (
+          <DashboardGrid>
+            <DashboardItem
+              value={subscriptionsCount as number}
+              data-cy="subscriptions-count"
+              isLoading={subscriptionsQuery.isLoading}
+              isRefetching={subscriptionsQuery.isRefetching}
+              icon={Subscription}
+              type="Subscription"
+            />
+            {!resourceGroupsQuery.isError && !resourceGroupsQuery.isLoading && (
+              <DashboardItem
+                value={resourceGroupsCount}
+                data-cy="resource-groups-count"
+                isLoading={resourceGroupsQuery.isLoading}
+                icon={Package}
+                type="Resource group"
+              />
+            )}
+          </DashboardGrid>
+        )}
+      </div>
+    </>
+  );
+}
diff --git a/app/react/azure/DashboardView/index.ts b/app/react/azure/DashboardView/index.ts
new file mode 100644
index 0000000..ea829db
--- /dev/null
+++ b/app/react/azure/DashboardView/index.ts
@@ -0,0 +1 @@
+export { DashboardView } from './DashboardView';
diff --git a/app/react/azure/container-instances/CreateView/CreateContainerInstanceForm.test.tsx b/app/react/azure/container-instances/CreateView/CreateContainerInstanceForm.test.tsx
new file mode 100644
index 0000000..d55d808
--- /dev/null
+++ b/app/react/azure/container-instances/CreateView/CreateContainerInstanceForm.test.tsx
@@ -0,0 +1,71 @@
+import userEvent from '@testing-library/user-event';
+import { HttpResponse, http } from 'msw';
+import { render, screen } from '@testing-library/react';
+
+import { UserViewModel } from '@/portainer/models/user';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { server } from '@/setup-tests/server';
+import { createMockEnvironment } from '@/react-tools/test-mocks';
+
+import { CreateContainerInstanceForm } from './CreateContainerInstanceForm';
+
+vi.mock('@uirouter/react', async (importOriginal: () => Promise<object>) => ({
+  ...(await importOriginal()),
+  useCurrentStateAndParams: vi.fn(() => ({
+    params: { endpointId: 5 },
+  })),
+}));
+
+function renderComponent() {
+  const user = new UserViewModel({ Username: 'user' });
+  const Wrapped = withTestQueryProvider(
+    withUserProvider(withTestRouter(CreateContainerInstanceForm), user)
+  );
+
+  return render(<Wrapped />);
+}
+
+describe('CreateContainerInstanceForm', () => {
+  beforeEach(() => {
+    server.use(
+      http.get('/api/endpoints/5', () =>
+        HttpResponse.json(createMockEnvironment())
+      )
+    );
+  });
+
+  // TODO: from R8S-730 - enable this test once it passes
+  it.skip('should not display any visible error messages on initial load', async () => {
+    renderComponent();
+
+    const errors = await screen.findByRole('alert');
+
+    // Check that no error messages (role="alert") are visible
+    expect(errors).not.toBeInTheDocument();
+  });
+
+  it('submit button should be disabled when name or image is missing', async () => {
+    const { findByText, getByText, getByLabelText } = renderComponent();
+
+    await expect(findByText(/Azure settings/)).resolves.toBeVisible();
+
+    const button = getByText(/Deploy the container/);
+    expect(button).toBeVisible();
+    expect(button).toBeDisabled();
+
+    const nameInput = getByLabelText(/name/i, { selector: 'input' });
+    await userEvent.type(nameInput, 'name');
+
+    const imageInput = getByLabelText(/image/i, { selector: 'input' });
+    await userEvent.type(imageInput, 'image');
+
+    await expect(findByText(/Deploy the container/)).resolves.toBeEnabled();
+
+    expect(nameInput).toHaveValue('name');
+    await userEvent.clear(nameInput);
+
+    await expect(findByText(/Deploy the container/)).resolves.toBeDisabled();
+  });
+});
diff --git a/app/react/azure/container-instances/CreateView/CreateContainerInstanceForm.tsx b/app/react/azure/container-instances/CreateView/CreateContainerInstanceForm.tsx
new file mode 100644
index 0000000..b5e3ebe
--- /dev/null
+++ b/app/react/azure/container-instances/CreateView/CreateContainerInstanceForm.tsx
@@ -0,0 +1,74 @@
+import { Formik } from 'formik';
+import { useRouter } from '@uirouter/react';
+
+import { ContainerInstanceFormValues } from '@/react/azure/types';
+import * as notifications from '@/portainer/services/notifications';
+import { useCurrentUser } from '@/react/hooks/useUser';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+
+import { validationSchema } from './CreateContainerInstanceForm.validation';
+import { useFormState, useLoadFormState } from './useLoadFormState';
+import { useCreateInstanceMutation } from './useCreateInstanceMutation';
+import { CreateContainerInstanceInnerForm } from './CreateContainerInstanceInnerForm';
+
+export function CreateContainerInstanceForm({
+  defaultValues,
+}: {
+  defaultValues?: Partial<ContainerInstanceFormValues>;
+}) {
+  const environmentId = useEnvironmentId();
+  const { isPureAdmin } = useCurrentUser();
+
+  const { providers, subscriptions, resourceGroups, isLoading } =
+    useLoadFormState(environmentId);
+
+  const { initialValues, subscriptionOptions } = useFormState(
+    subscriptions,
+    resourceGroups,
+    providers,
+    defaultValues
+  );
+
+  const router = useRouter();
+
+  const { mutateAsync } = useCreateInstanceMutation(
+    resourceGroups,
+    environmentId
+  );
+
+  if (isLoading) {
+    return null;
+  }
+
+  return (
+    <Formik<ContainerInstanceFormValues>
+      initialValues={initialValues}
+      validationSchema={() => validationSchema(isPureAdmin)}
+      onSubmit={onSubmit}
+      validateOnMount
+      validateOnChange
+      enableReinitialize
+    >
+      {(formikProps) => (
+        <CreateContainerInstanceInnerForm
+          // eslint-disable-next-line react/jsx-props-no-spreading
+          {...formikProps}
+          subscriptionOptions={subscriptionOptions}
+          environmentId={environmentId}
+          resourceGroups={resourceGroups}
+          providers={providers}
+        />
+      )}
+    </Formik>
+  );
+
+  async function onSubmit(values: ContainerInstanceFormValues) {
+    try {
+      await mutateAsync(values);
+      notifications.success('Container successfully created', values.name);
+      router.stateService.go('azure.containerinstances');
+    } catch (e) {
+      notifications.error('Failure', e as Error, 'Unable to create container');
+    }
+  }
+}
diff --git a/app/react/azure/container-instances/CreateView/CreateContainerInstanceForm.validation.ts b/app/react/azure/container-instances/CreateView/CreateContainerInstanceForm.validation.ts
new file mode 100644
index 0000000..ddf2c98
--- /dev/null
+++ b/app/react/azure/container-instances/CreateView/CreateContainerInstanceForm.validation.ts
@@ -0,0 +1,38 @@
+import { object, string, number, boolean, array } from 'yup';
+
+import { validationSchema as accessControlSchema } from '@/react/portainer/access-control/AccessControlForm/AccessControlForm.validation';
+
+import { buildUniquenessTest } from '@@/form-components/validate-unique';
+
+import { validationSchema as portsSchema } from './PortsMappingField.validation';
+
+export function validationSchema(isAdmin: boolean) {
+  return object().shape({
+    name: string().required('Name is required.'),
+    image: string().required('Image is required.'),
+    subscription: string().required('Subscription is required.'),
+    resourceGroup: string().required('Resource group is required.'),
+    location: string().required('Location is required.'),
+    os: string().oneOf(['Linux', 'Windows']),
+    cpu: number().positive(),
+    memory: number().positive(),
+    allocatePublicIP: boolean(),
+    ports: portsSchema(),
+    accessControl: accessControlSchema(isAdmin),
+    env: array()
+      .of(
+        object().shape({
+          name: string().required('Environment variable name is required.'),
+          value: string().required('Environment variable value is required.'),
+        })
+      )
+      .test(
+        'unique',
+        'This environment variable is already defined',
+        buildUniquenessTest(
+          () => 'This environment variable is already defined',
+          'name'
+        )
+      ),
+  });
+}
diff --git a/app/react/azure/container-instances/CreateView/CreateContainerInstanceInnerForm.tsx b/app/react/azure/container-instances/CreateView/CreateContainerInstanceInnerForm.tsx
new file mode 100644
index 0000000..7dc00a8
--- /dev/null
+++ b/app/react/azure/container-instances/CreateView/CreateContainerInstanceInnerForm.tsx
@@ -0,0 +1,182 @@
+import { Field, Form, FormikProps } from 'formik';
+import { Plus } from 'lucide-react';
+
+import {
+  ContainerInstanceFormValues,
+  ProviderViewModel,
+  ResourceGroup,
+} from '@/react/azure/types';
+import {
+  getSubscriptionLocations,
+  getSubscriptionResourceGroups,
+} from '@/react/azure/container-instances/CreateView/utils';
+import { PortsMappingField } from '@/react/azure/container-instances/CreateView/PortsMappingField';
+import { AccessControlForm } from '@/react/portainer/access-control';
+
+import { FormSectionTitle } from '@@/form-components/FormSectionTitle';
+import { FormControl } from '@@/form-components/FormControl';
+import { Input, Select } from '@@/form-components/Input';
+import { EnvironmentVariablesPanel } from '@@/form-components/EnvironmentVariablesFieldset';
+import { LoadingButton } from '@@/buttons';
+import { Option } from '@@/form-components/PortainerSelect';
+
+type Props = FormikProps<ContainerInstanceFormValues> & {
+  subscriptionOptions: Option<string>[];
+  environmentId: number;
+  resourceGroups: Record<string, ResourceGroup[]>;
+  providers: Record<string, ProviderViewModel | undefined>;
+};
+
+export function CreateContainerInstanceInnerForm({
+  errors,
+  handleSubmit,
+  isSubmitting,
+  isValid,
+  values,
+  setFieldValue,
+  environmentId,
+  subscriptionOptions,
+  resourceGroups,
+  providers,
+}: Props) {
+  return (
+    <Form className="form-horizontal" onSubmit={handleSubmit} noValidate>
+      <FormSectionTitle>Azure settings</FormSectionTitle>
+      <FormControl
+        label="Subscription"
+        inputId="subscription-input"
+        errors={errors.subscription}
+      >
+        <Field
+          name="subscription"
+          as={Select}
+          id="subscription-input"
+          options={subscriptionOptions}
+        />
+      </FormControl>
+
+      <FormControl
+        label="Resource group"
+        inputId="resourceGroup-input"
+        errors={errors.resourceGroup}
+      >
+        <Field
+          name="resourceGroup"
+          as={Select}
+          id="resourceGroup-input"
+          options={getSubscriptionResourceGroups(
+            values.subscription,
+            resourceGroups
+          )}
+        />
+      </FormControl>
+
+      <FormControl
+        label="Location"
+        inputId="location-input"
+        errors={errors.location}
+      >
+        <Field
+          name="location"
+          as={Select}
+          id="location-input"
+          options={getSubscriptionLocations(values.subscription, providers)}
+        />
+      </FormControl>
+
+      <FormSectionTitle>Container configuration</FormSectionTitle>
+
+      <FormControl label="Name" inputId="name-input" errors={errors.name}>
+        <Field
+          name="name"
+          as={Input}
+          id="name-input"
+          placeholder="e.g. myContainer"
+        />
+      </FormControl>
+
+      <FormControl label="Image" inputId="image-input" errors={errors.image}>
+        <Field
+          name="image"
+          as={Input}
+          id="image-input"
+          placeholder="e.g. nginx:alpine"
+        />
+      </FormControl>
+
+      <FormControl label="OS" inputId="os-input" errors={errors.os}>
+        <Field
+          name="os"
+          as={Select}
+          id="os-input"
+          options={[
+            { label: 'Linux', value: 'Linux' },
+            { label: 'Windows', value: 'Windows' },
+          ]}
+        />
+      </FormControl>
+
+      <PortsMappingField
+        value={values.ports}
+        onChange={(value) => setFieldValue('ports', value)}
+        errors={errors.ports}
+      />
+
+      <EnvironmentVariablesPanel
+        values={values.env}
+        onChange={(env) => setFieldValue('env', env)}
+        errors={errors.env}
+      />
+
+      <div className="form-group">
+        <div className="col-sm-12 small text-muted">
+          This will automatically deploy a container with a public IP address
+        </div>
+      </div>
+
+      <FormSectionTitle>Container Resources</FormSectionTitle>
+
+      <FormControl label="CPU" inputId="cpu-input" errors={errors.cpu}>
+        <Field
+          name="cpu"
+          as={Input}
+          id="cpu-input"
+          type="number"
+          placeholder="1"
+        />
+      </FormControl>
+
+      <FormControl label="Memory" inputId="cpu-input" errors={errors.memory}>
+        <Field
+          name="memory"
+          as={Input}
+          id="memory-input"
+          type="number"
+          placeholder="1"
+        />
+      </FormControl>
+
+      <AccessControlForm
+        formNamespace="accessControl"
+        onChange={(values) => setFieldValue('accessControl', values)}
+        values={values.accessControl}
+        errors={errors.accessControl}
+        environmentId={environmentId}
+      />
+
+      <div className="form-group">
+        <div className="col-sm-12">
+          <LoadingButton
+            disabled={!isValid}
+            isLoading={isSubmitting}
+            loadingText="Deployment in progress..."
+            icon={Plus}
+            data-cy="aci-create-button"
+          >
+            Deploy the container
+          </LoadingButton>
+        </div>
+      </div>
+    </Form>
+  );
+}
diff --git a/app/react/azure/container-instances/CreateView/CreateView.tsx b/app/react/azure/container-instances/CreateView/CreateView.tsx
new file mode 100644
index 0000000..be1d66a
--- /dev/null
+++ b/app/react/azure/container-instances/CreateView/CreateView.tsx
@@ -0,0 +1,29 @@
+import { PageHeader } from '@@/PageHeader';
+import { Widget, WidgetBody } from '@@/Widget';
+
+import { CreateContainerInstanceForm } from './CreateContainerInstanceForm';
+
+export function CreateView() {
+  return (
+    <>
+      <PageHeader
+        title="Create container instance"
+        breadcrumbs={[
+          { link: 'azure.containerinstances', label: 'Container instances' },
+          { label: 'Add container' },
+        ]}
+        reload
+      />
+
+      <div className="row">
+        <div className="col-sm-12">
+          <Widget>
+            <WidgetBody>
+              <CreateContainerInstanceForm />
+            </WidgetBody>
+          </Widget>
+        </div>
+      </div>
+    </>
+  );
+}
diff --git a/app/react/azure/container-instances/CreateView/PortsMappingField.module.css b/app/react/azure/container-instances/CreateView/PortsMappingField.module.css
new file mode 100644
index 0000000..101ea17
--- /dev/null
+++ b/app/react/azure/container-instances/CreateView/PortsMappingField.module.css
@@ -0,0 +1,13 @@
+.item {
+  display: flex;
+  flex-direction: column;
+  position: relative;
+}
+
+.item .inputs {
+}
+
+.item .errors {
+  position: absolute;
+  bottom: -20px;
+}
diff --git a/app/react/azure/container-instances/CreateView/PortsMappingField.tsx b/app/react/azure/container-instances/CreateView/PortsMappingField.tsx
new file mode 100644
index 0000000..c6e5fa2
--- /dev/null
+++ b/app/react/azure/container-instances/CreateView/PortsMappingField.tsx
@@ -0,0 +1,127 @@
+import { FormikErrors } from 'formik';
+import { ArrowRight } from 'lucide-react';
+
+import { ButtonSelector } from '@@/form-components/ButtonSelector/ButtonSelector';
+import { FormError } from '@@/form-components/FormError';
+import { InputGroup } from '@@/form-components/InputGroup';
+import { InputList } from '@@/form-components/InputList';
+import { ItemProps } from '@@/form-components/InputList/InputList';
+import { Icon } from '@@/Icon';
+
+import styles from './PortsMappingField.module.css';
+
+type Protocol = 'TCP' | 'UDP';
+
+export interface PortMapping {
+  host?: number;
+  container?: number;
+  protocol: Protocol;
+}
+
+interface Props {
+  value: PortMapping[];
+  onChange?(value: PortMapping[]): void;
+  errors?: FormikErrors<PortMapping>[] | string | string[];
+  disabled?: boolean;
+  readOnly?: boolean;
+}
+
+export function PortsMappingField({
+  value,
+  onChange = () => {},
+  errors,
+  disabled,
+  readOnly,
+}: Props) {
+  return (
+    <>
+      <InputList<PortMapping>
+        label="Port mapping"
+        value={value}
+        onChange={onChange}
+        addLabel="map additional port"
+        itemBuilder={() => ({
+          host: 0,
+          container: 0,
+          protocol: 'TCP',
+        })}
+        item={Item}
+        errors={errors}
+        disabled={disabled}
+        readOnly={readOnly}
+        data-cy="aci-ports-mapping"
+      />
+      {typeof errors === 'string' && (
+        <div className="form-group col-md-12">
+          <FormError>{errors}</FormError>
+        </div>
+      )}
+    </>
+  );
+}
+
+function Item({
+  onChange,
+  item,
+  error,
+  disabled,
+  readOnly,
+  index,
+}: ItemProps<PortMapping>) {
+  return (
+    <div className={styles.item}>
+      <div className="flex items-center gap-2">
+        <InputGroup size="small">
+          <InputGroup.Addon>host</InputGroup.Addon>
+          <InputGroup.Input
+            placeholder="e.g. 80"
+            value={item.host}
+            onChange={(e) =>
+              handleChange('host', parseInt(e.target.value || '0', 10))
+            }
+            disabled={disabled}
+            readOnly={readOnly}
+            type="number"
+            data-cy={`aci-ports-mapping-host-input_${index}`}
+          />
+        </InputGroup>
+
+        <span className="mx-3">
+          <Icon icon={ArrowRight} />
+        </span>
+
+        <InputGroup size="small">
+          <InputGroup.Addon>container</InputGroup.Addon>
+          <InputGroup.Input
+            placeholder="e.g. 80"
+            value={item.container}
+            onChange={(e) =>
+              handleChange('container', parseInt(e.target.value || '0', 10))
+            }
+            disabled={disabled}
+            readOnly={readOnly}
+            type="number"
+            data-cy={`aci-ports-mapping-container-port-input_${index}`}
+          />
+        </InputGroup>
+
+        <ButtonSelector<Protocol>
+          onChange={(value) => handleChange('protocol', value)}
+          value={item.protocol}
+          options={[{ value: 'TCP' }, { value: 'UDP' }]}
+          disabled={disabled}
+          readOnly={readOnly}
+        />
+      </div>
+      {!!error && (
+        <div className={styles.errors}>
+          <FormError>{Object.values(error)[0]}</FormError>
+        </div>
+      )}
+    </div>
+  );
+
+  function handleChange(name: keyof PortMapping, value: string | number) {
+    onChange({ ...item, [name]: value });
+  }
+}
diff --git a/app/react/azure/container-instances/CreateView/PortsMappingField.validation.ts b/app/react/azure/container-instances/CreateView/PortsMappingField.validation.ts
new file mode 100644
index 0000000..e872889
--- /dev/null
+++ b/app/react/azure/container-instances/CreateView/PortsMappingField.validation.ts
@@ -0,0 +1,11 @@
+import { array, object, string } from 'yup';
+
+export function validationSchema() {
+  return array(
+    object().shape({
+      host: string().required('host is required'),
+      container: string().required('container is required'),
+      protocol: string().oneOf(['TCP', 'UDP']),
+    })
+  ).min(1, 'At least one port binding is required');
+}
diff --git a/app/react/azure/container-instances/CreateView/index.ts b/app/react/azure/container-instances/CreateView/index.ts
new file mode 100644
index 0000000..74e5921
--- /dev/null
+++ b/app/react/azure/container-instances/CreateView/index.ts
@@ -0,0 +1 @@
+export { CreateView } from './CreateView';
diff --git a/app/react/azure/container-instances/CreateView/useCreateInstanceMutation.tsx b/app/react/azure/container-instances/CreateView/useCreateInstanceMutation.tsx
new file mode 100644
index 0000000..74c78f4
--- /dev/null
+++ b/app/react/azure/container-instances/CreateView/useCreateInstanceMutation.tsx
@@ -0,0 +1,62 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { createContainerGroup } from '@/react/azure/services/container-groups.service';
+import { queryKeys } from '@/react/azure/queries/query-keys';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import PortainerError from '@/portainer/error';
+import {
+  ContainerGroup,
+  ContainerInstanceFormValues,
+  ResourceGroup,
+} from '@/react/azure/types';
+import { applyResourceControl } from '@/react/portainer/access-control/access-control.service';
+
+import { getSubscriptionResourceGroups } from './utils';
+
+export function useCreateInstanceMutation(
+  resourceGroups: {
+    [k: string]: ResourceGroup[];
+  },
+  environmentId: EnvironmentId
+) {
+  const queryClient = useQueryClient();
+  return useMutation<ContainerGroup, unknown, ContainerInstanceFormValues>(
+    (values) => {
+      if (!values.subscription) {
+        throw new PortainerError('subscription is required');
+      }
+
+      const subscriptionResourceGroup = getSubscriptionResourceGroups(
+        values.subscription,
+        resourceGroups
+      );
+      const resourceGroup = subscriptionResourceGroup.find(
+        (r) => r.value === values.resourceGroup
+      );
+      if (!resourceGroup) {
+        throw new PortainerError('resource group not found');
+      }
+
+      return createContainerGroup(
+        values,
+        environmentId,
+        values.subscription,
+        resourceGroup.label
+      );
+    },
+    {
+      async onSuccess(containerGroup, values) {
+        const resourceControl = containerGroup.Portainer?.ResourceControl;
+        if (!resourceControl) {
+          throw new PortainerError('resource control expected after creation');
+        }
+
+        const accessControlData = values.accessControl;
+        await applyResourceControl(accessControlData, resourceControl.Id);
+        return queryClient.invalidateQueries(
+          queryKeys.subscriptions(environmentId)
+        );
+      },
+    }
+  );
+}
diff --git a/app/react/azure/container-instances/CreateView/useLoadFormState.ts b/app/react/azure/container-instances/CreateView/useLoadFormState.ts
new file mode 100644
index 0000000..b4629f6
--- /dev/null
+++ b/app/react/azure/container-instances/CreateView/useLoadFormState.ts
@@ -0,0 +1,88 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import {
+  ContainerInstanceFormValues,
+  ProviderViewModel,
+  ResourceGroup,
+  Subscription,
+} from '@/react/azure/types';
+import { parseAccessControlFormData } from '@/react/portainer/access-control/utils';
+import { useCurrentUser } from '@/react/hooks/useUser';
+import { useProvider } from '@/react/azure/queries/useProvider';
+import { useResourceGroups } from '@/react/azure/queries/useResourceGroups';
+import { useSubscriptions } from '@/react/azure/queries/useSubscriptions';
+
+import {
+  getSubscriptionLocations,
+  getSubscriptionResourceGroups,
+} from './utils';
+
+export function useLoadFormState(environmentId: EnvironmentId) {
+  const { data: subscriptions, isLoading: isLoadingSubscriptions } =
+    useSubscriptions(environmentId);
+  const { resourceGroups, isLoading: isLoadingResourceGroups } =
+    useResourceGroups(environmentId, subscriptions);
+  const { providers, isLoading: isLoadingProviders } = useProvider(
+    environmentId,
+    subscriptions
+  );
+
+  const isLoading =
+    isLoadingSubscriptions || isLoadingResourceGroups || isLoadingProviders;
+
+  return { isLoading, subscriptions, resourceGroups, providers };
+}
+
+export function useFormState(
+  subscriptions: Subscription[] = [],
+  resourceGroups: Record<string, ResourceGroup[]> = {},
+  providers: Record<string, ProviderViewModel> = {},
+  defaultValues?: Partial<ContainerInstanceFormValues>
+) {
+  const { user, isPureAdmin } = useCurrentUser();
+
+  const subscriptionOptions = subscriptions.map((s) => ({
+    value: s.subscriptionId,
+    label: s.displayName,
+  }));
+
+  const initSubscriptionId = getFirstValue(subscriptionOptions);
+
+  const subscriptionResourceGroups = getSubscriptionResourceGroups(
+    initSubscriptionId,
+    resourceGroups
+  );
+
+  const subscriptionLocations = getSubscriptionLocations(
+    initSubscriptionId,
+    providers
+  );
+
+  const initialValues: ContainerInstanceFormValues = {
+    name: '',
+    location: getFirstValue(subscriptionLocations),
+    subscription: initSubscriptionId,
+    resourceGroup: getFirstValue(subscriptionResourceGroups),
+    image: '',
+    os: 'Linux',
+    memory: 1,
+    cpu: 1,
+    ports: [{ container: 80, host: 80, protocol: 'TCP' }],
+    allocatePublicIP: true,
+    accessControl: parseAccessControlFormData(isPureAdmin, user.Id),
+    env: [],
+    ...defaultValues,
+  };
+
+  return {
+    initialValues,
+    subscriptionOptions,
+  };
+
+  function getFirstValue<T>(arr: { value: T }[]) {
+    if (arr.length === 0) {
+      return undefined;
+    }
+
+    return arr[0].value;
+  }
+}
diff --git a/app/react/azure/container-instances/CreateView/utils.ts b/app/react/azure/container-instances/CreateView/utils.ts
new file mode 100644
index 0000000..ff5e27d
--- /dev/null
+++ b/app/react/azure/container-instances/CreateView/utils.ts
@@ -0,0 +1,34 @@
+import { ProviderViewModel, ResourceGroup } from '@/react/azure/types';
+
+export function getSubscriptionResourceGroups(
+  subscriptionId?: string,
+  resourceGroups?: Record<string, ResourceGroup[]>
+) {
+  if (!subscriptionId || !resourceGroups || !resourceGroups[subscriptionId]) {
+    return [];
+  }
+
+  return resourceGroups[subscriptionId].map(({ name, id }) => ({
+    value: id,
+    label: name,
+  }));
+}
+
+export function getSubscriptionLocations(
+  subscriptionId?: string,
+  containerInstanceProviders?: Record<string, ProviderViewModel | undefined>
+) {
+  if (!subscriptionId || !containerInstanceProviders) {
+    return [];
+  }
+
+  const provider = containerInstanceProviders[subscriptionId];
+  if (!provider) {
+    return [];
+  }
+
+  return provider.locations.map((location) => ({
+    value: location,
+    label: location,
+  }));
+}
diff --git a/app/react/azure/container-instances/ItemView/ItemView.tsx b/app/react/azure/container-instances/ItemView/ItemView.tsx
new file mode 100644
index 0000000..a9c5177
--- /dev/null
+++ b/app/react/azure/container-instances/ItemView/ItemView.tsx
@@ -0,0 +1,306 @@
+import { useCurrentStateAndParams } from '@uirouter/react';
+import { useQueryClient } from '@tanstack/react-query';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { AccessControlPanel } from '@/react/portainer/access-control/AccessControlPanel/AccessControlPanel';
+import { ResourceControlViewModel } from '@/react/portainer/access-control/models/ResourceControlViewModel';
+import { ResourceControlType } from '@/react/portainer/access-control/types';
+import {
+  ContainerGroup,
+  ResourceGroup,
+  Subscription,
+} from '@/react/azure/types';
+import { useContainerGroup } from '@/react/azure/queries/useContainerGroup';
+import { useResourceGroup } from '@/react/azure/queries/useResourceGroup';
+import { useSubscription } from '@/react/azure/queries/useSubscription';
+
+import { Input } from '@@/form-components/Input';
+import { Widget, WidgetBody } from '@@/Widget';
+import { PageHeader } from '@@/PageHeader';
+import { FormSectionTitle } from '@@/form-components/FormSectionTitle';
+import { FormControl } from '@@/form-components/FormControl';
+
+import { PortsMappingField } from '../CreateView/PortsMappingField';
+
+export function ItemView() {
+  const {
+    params: { id },
+  } = useCurrentStateAndParams();
+  const { subscriptionId, resourceGroupId, containerGroupId } = parseId(id);
+
+  const environmentId = useEnvironmentId();
+
+  const queryClient = useQueryClient();
+
+  const subscriptionQuery = useSubscription(environmentId, subscriptionId);
+  const resourceGroupQuery = useResourceGroup(
+    environmentId,
+    subscriptionId,
+    resourceGroupId
+  );
+
+  const containerQuery = useContainerGroup(
+    environmentId,
+    subscriptionId,
+    resourceGroupId,
+    containerGroupId
+  );
+
+  if (
+    !subscriptionQuery.isSuccess ||
+    !resourceGroupQuery.isSuccess ||
+    !containerQuery.isSuccess
+  ) {
+    return null;
+  }
+
+  const container = aggregateContainerData(
+    subscriptionQuery.data,
+    resourceGroupQuery.data,
+    containerQuery.data
+  );
+
+  return (
+    <>
+      <PageHeader
+        title="Container Instance"
+        breadcrumbs={[
+          { link: 'azure.containerinstances', label: 'Container instances' },
+          { label: container.name },
+        ]}
+        reload
+      />
+
+      <div className="row">
+        <div className="col-sm-12">
+          <Widget>
+            <WidgetBody className="form-horizontal">
+              <FormSectionTitle>Azure settings</FormSectionTitle>
+              <FormControl label="Subscription" inputId="subscription-input">
+                <Input
+                  name="subscription"
+                  id="subscription-input"
+                  value={container.subscriptionName}
+                  readOnly
+                  data-cy="aci-container-subscription-input"
+                />
+              </FormControl>
+
+              <FormControl label="Resource group" inputId="resourceGroup-input">
+                <Input
+                  name="resourceGroup"
+                  id="resourceGroup-input"
+                  value={container.resourceGroupName}
+                  readOnly
+                  data-cy="aci-container-resourceGroup-input"
+                />
+              </FormControl>
+
+              <FormControl label="Location" inputId="location-input">
+                <Input
+                  name="location"
+                  id="location-input"
+                  value={container.location}
+                  readOnly
+                  data-cy="aci-container-location-input"
+                />
+              </FormControl>
+
+              <FormSectionTitle>Container configuration</FormSectionTitle>
+
+              <FormControl label="Name" inputId="name-input">
+                <Input
+                  name="name"
+                  id="name-input"
+                  readOnly
+                  value={container.name}
+                  data-cy="aci-container-name-input"
+                />
+              </FormControl>
+
+              <FormControl label="Image" inputId="image-input">
+                <Input
+                  name="image"
+                  id="image-input"
+                  value={container.imageName}
+                  readOnly
+                  data-cy="aci-container-image-input"
+                />
+              </FormControl>
+
+              <FormControl label="OS" inputId="os-input">
+                <Input
+                  name="os"
+                  id="os-input"
+                  readOnly
+                  value={container.osType}
+                  data-cy="aci-container-os-input"
+                />
+              </FormControl>
+
+              <PortsMappingField value={container.ports} readOnly />
+
+              <FormControl label="Public IP" inputId="public-ip">
+                <Input
+                  name="public-ip"
+                  id="public-ip"
+                  readOnly
+                  value={container.ipAddress}
+                  data-cy="aci-container-public-ip"
+                />
+              </FormControl>
+
+              <FormSectionTitle>Container Resources</FormSectionTitle>
+
+              <FormControl label="CPU" inputId="cpu-input">
+                <Input
+                  name="cpu"
+                  id="cpu-input"
+                  type="number"
+                  placeholder="1"
+                  readOnly
+                  value={container.cpu}
+                  data-cy="aci-container-cpu-input"
+                />
+              </FormControl>
+
+              <FormControl label="Memory" inputId="cpu-input">
+                <Input
+                  name="memory"
+                  id="memory-input"
+                  type="number"
+                  placeholder="1"
+                  readOnly
+                  value={container.memory}
+                  data-cy="aci-container-memory-input"
+                />
+              </FormControl>
+              {container.environmentVariables &&
+                container.environmentVariables.length > 0 && (
+                  <>
+                    <FormSectionTitle>Environment Variables</FormSectionTitle>
+                    <FormControl
+                      label="Environment variables"
+                      inputId="env-vars-input"
+                    >
+                      <div data-cy="aci-container-env-vars-input">
+                        {container.environmentVariables.map((env) => (
+                          <>
+                            {/* show redacted values for secure values and values */}
+                            {/* when I add secure values in azure, the 'secureValue' and 'value' fields are ommitted (tested on current and latest, 2025-09-01 api versions) */}
+                            {env.secureValue || env.value === undefined ? (
+                              <div key={env.name}>{env.name} = ********</div>
+                            ) : (
+                              <div key={env.name}>
+                                {env.name} = {env.value}
+                              </div>
+                            )}
+                          </>
+                        ))}
+                      </div>
+                    </FormControl>
+                  </>
+                )}
+            </WidgetBody>
+          </Widget>
+        </div>
+      </div>
+
+      <AccessControlPanel
+        onUpdateSuccess={() =>
+          queryClient.invalidateQueries([
+            'azure',
+            environmentId,
+            'subscriptions',
+            subscriptionId,
+            'resourceGroups',
+            resourceGroupQuery.data.name,
+            'containerGroups',
+            containerQuery.data.name,
+          ])
+        }
+        resourceId={id}
+        resourceControl={container.resourceControl}
+        resourceType={ResourceControlType.ContainerGroup}
+        environmentId={environmentId}
+      />
+    </>
+  );
+}
+
+function parseId(id: string) {
+  const match = id.match(
+    /^\/subscriptions\/(.+)\/resourceGroups\/(.+)\/providers\/(.+)\/containerGroups\/(.+)$/
+  );
+
+  if (!match) {
+    throw new Error('container id is missing details');
+  }
+
+  const [, subscriptionId, resourceGroupId, , containerGroupId] = match;
+
+  return { subscriptionId, resourceGroupId, containerGroupId };
+}
+
+function aggregateContainerData(
+  subscription: Subscription,
+  resourceGroup: ResourceGroup,
+  containerGroup: ContainerGroup
+) {
+  const containerInstanceData = aggregateContainerInstance();
+
+  const resourceControl = containerGroup.Portainer?.ResourceControl
+    ? new ResourceControlViewModel(containerGroup.Portainer.ResourceControl)
+    : undefined;
+
+  return {
+    name: containerGroup.name,
+    subscriptionName: subscription.displayName,
+    resourceGroupName: resourceGroup.name,
+    location: containerGroup.location,
+    osType: containerGroup.properties.osType,
+    ipAddress: containerGroup.properties.ipAddress.ip,
+    resourceControl,
+    ...containerInstanceData,
+  };
+
+  function aggregateContainerInstance() {
+    const containerInstanceData = containerGroup.properties.containers[0];
+
+    if (!containerInstanceData) {
+      return {
+        ports: [],
+      };
+    }
+
+    const containerInstanceProperties = containerInstanceData.properties;
+
+    const containerPorts = containerInstanceProperties.ports;
+
+    const imageName = containerInstanceProperties.image;
+
+    const ports = containerGroup.properties.ipAddress.ports.map(
+      (binding, index) => {
+        const port =
+          containerPorts && containerPorts[index]
+            ? containerPorts[index].port
+            : undefined;
+        return {
+          container: port,
+          host: binding.port,
+          protocol: binding.protocol,
+        };
+      }
+    );
+
+    const { environmentVariables } = containerInstanceProperties;
+
+    return {
+      imageName,
+      ports,
+      cpu: containerInstanceProperties.resources.cpu,
+      memory: containerInstanceProperties.resources.memoryInGB,
+      environmentVariables,
+    };
+  }
+}
diff --git a/app/react/azure/container-instances/ItemView/index.ts b/app/react/azure/container-instances/ItemView/index.ts
new file mode 100644
index 0000000..a09ab2d
--- /dev/null
+++ b/app/react/azure/container-instances/ItemView/index.ts
@@ -0,0 +1 @@
+export { ItemView } from './ItemView';
diff --git a/app/react/azure/container-instances/ListView/ContainersDatatable.tsx b/app/react/azure/container-instances/ListView/ContainersDatatable.tsx
new file mode 100644
index 0000000..59f07de
--- /dev/null
+++ b/app/react/azure/container-instances/ListView/ContainersDatatable.tsx
@@ -0,0 +1,58 @@
+import { Box } from 'lucide-react';
+
+import { ContainerGroup } from '@/react/azure/types';
+import { Authorized } from '@/react/hooks/useUser';
+
+import { Datatable } from '@@/datatables';
+import { AddButton } from '@@/buttons';
+import { createPersistedStore } from '@@/datatables/types';
+import { useTableState } from '@@/datatables/useTableState';
+import { DeleteButton } from '@@/buttons/DeleteButton';
+
+import { columns } from './columns';
+
+const tableKey = 'containergroups';
+
+const settingsStore = createPersistedStore(tableKey, 'name');
+export interface Props {
+  dataset: ContainerGroup[];
+  onRemoveClick(containerIds: string[]): void;
+}
+
+export function ContainersDatatable({ dataset, onRemoveClick }: Props) {
+  const tableState = useTableState(settingsStore, tableKey);
+
+  return (
+    <Datatable
+      dataset={dataset}
+      columns={columns}
+      settingsManager={tableState}
+      title="Containers"
+      titleIcon={Box}
+      getRowId={(container) => container.id}
+      data-cy="containers-datatable"
+      renderTableActions={(selectedRows) => (
+        <div className="flex gap-2">
+          <Authorized authorizations="AzureContainerGroupDelete">
+            <DeleteButton
+              disabled={selectedRows.length === 0}
+              data-cy="remove-containers-button"
+              onConfirmed={() =>
+                handleRemoveClick(selectedRows.map((r) => r.id))
+              }
+              confirmMessage="Are you sure you want to delete the selected containers?"
+            />
+          </Authorized>
+
+          <Authorized authorizations="AzureContainerGroupCreate">
+            <AddButton data-cy="add-container-button">Add container</AddButton>
+          </Authorized>
+        </div>
+      )}
+    />
+  );
+
+  async function handleRemoveClick(containerIds: string[]) {
+    return onRemoveClick(containerIds);
+  }
+}
diff --git a/app/react/azure/container-instances/ListView/ListView.tsx b/app/react/azure/container-instances/ListView/ListView.tsx
new file mode 100644
index 0000000..78ac058
--- /dev/null
+++ b/app/react/azure/container-instances/ListView/ListView.tsx
@@ -0,0 +1,86 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { deleteContainerGroup } from '@/react/azure/services/container-groups.service';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { notifyError, notifySuccess } from '@/portainer/services/notifications';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { promiseSequence } from '@/portainer/helpers/promise-utils';
+import { useContainerGroups } from '@/react/azure/queries/useContainerGroups';
+import { useSubscriptions } from '@/react/azure/queries/useSubscriptions';
+
+import { PageHeader } from '@@/PageHeader';
+
+import { ContainersDatatable } from './ContainersDatatable';
+
+export function ListView() {
+  const environmentId = useEnvironmentId();
+
+  const subscriptionsQuery = useSubscriptions(environmentId);
+
+  const groupsQuery = useContainerGroups(
+    environmentId,
+    subscriptionsQuery.data,
+    subscriptionsQuery.isSuccess
+  );
+
+  const { handleRemove } = useRemoveMutation(environmentId);
+
+  if (groupsQuery.isLoading || subscriptionsQuery.isLoading) {
+    return null;
+  }
+
+  return (
+    <>
+      <PageHeader
+        title="Container list"
+        breadcrumbs="Container instances"
+        reload
+      />
+
+      <ContainersDatatable
+        dataset={groupsQuery.containerGroups}
+        onRemoveClick={handleRemove}
+      />
+    </>
+  );
+}
+
+function useRemoveMutation(environmentId: EnvironmentId) {
+  const queryClient = useQueryClient();
+
+  const deleteMutation = useMutation(
+    (containerGroupIds: string[]) =>
+      promiseSequence(
+        containerGroupIds.map(
+          (id) => () => deleteContainerGroup(environmentId, id)
+        )
+      ),
+
+    {
+      onSuccess() {
+        return queryClient.invalidateQueries([
+          'azure',
+          environmentId,
+          'subscriptions',
+        ]);
+      },
+      onError(err) {
+        notifyError(
+          'Failure',
+          err as Error,
+          'Unable to remove container groups'
+        );
+      },
+    }
+  );
+
+  return { handleRemove };
+
+  async function handleRemove(groupIds: string[]) {
+    deleteMutation.mutate(groupIds, {
+      onSuccess: () => {
+        notifySuccess('Success', 'Container groups successfully removed');
+      },
+    });
+  }
+}
diff --git a/app/react/azure/container-instances/ListView/columns/helper.ts b/app/react/azure/container-instances/ListView/columns/helper.ts
new file mode 100644
index 0000000..0090f07
--- /dev/null
+++ b/app/react/azure/container-instances/ListView/columns/helper.ts
@@ -0,0 +1,5 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { ContainerGroup } from '@/react/azure/types';
+
+export const columnHelper = createColumnHelper<ContainerGroup>();
diff --git a/app/react/azure/container-instances/ListView/columns/index.ts b/app/react/azure/container-instances/ListView/columns/index.ts
new file mode 100644
index 0000000..835b816
--- /dev/null
+++ b/app/react/azure/container-instances/ListView/columns/index.ts
@@ -0,0 +1,6 @@
+import { name } from './name';
+import { location } from './location';
+import { ports } from './ports';
+import { ownership } from './ownership';
+
+export const columns = [name, location, ports, ownership];
diff --git a/app/react/azure/container-instances/ListView/columns/location.ts b/app/react/azure/container-instances/ListView/columns/location.ts
new file mode 100644
index 0000000..ddeffe5
--- /dev/null
+++ b/app/react/azure/container-instances/ListView/columns/location.ts
@@ -0,0 +1,5 @@
+import { columnHelper } from './helper';
+
+export const location = columnHelper.accessor('location', {
+  header: 'Location',
+});
diff --git a/app/react/azure/container-instances/ListView/columns/name.tsx b/app/react/azure/container-instances/ListView/columns/name.tsx
new file mode 100644
index 0000000..bb4ed33
--- /dev/null
+++ b/app/react/azure/container-instances/ListView/columns/name.tsx
@@ -0,0 +1,29 @@
+import { CellContext } from '@tanstack/react-table';
+
+import { ContainerGroup } from '@/react/azure/types';
+
+import { Link } from '@@/Link';
+
+import { columnHelper } from './helper';
+
+export const name = columnHelper.accessor('name', {
+  header: 'Name',
+  cell: NameCell,
+});
+
+export function NameCell({
+  getValue,
+  row: { original: container },
+}: CellContext<ContainerGroup, string>) {
+  const name = getValue();
+  return (
+    <Link
+      to="azure.containerinstances.container"
+      params={{ id: container.id }}
+      className="hover:underline"
+      data-cy={`aci-container-${container.id}`}
+    >
+      {name}
+    </Link>
+  );
+}
diff --git a/app/react/azure/container-instances/ListView/columns/ownership.tsx b/app/react/azure/container-instances/ListView/columns/ownership.tsx
new file mode 100644
index 0000000..29843b3
--- /dev/null
+++ b/app/react/azure/container-instances/ListView/columns/ownership.tsx
@@ -0,0 +1,37 @@
+import clsx from 'clsx';
+import { CellContext } from '@tanstack/react-table';
+
+import { ResourceControlOwnership } from '@/react/portainer/access-control/types';
+import { ContainerGroup } from '@/react/azure/types';
+import { determineOwnership } from '@/react/portainer/access-control/models/ResourceControlViewModel';
+import { ownershipIcon } from '@/react/docker/components/datatable/createOwnershipColumn';
+
+import { columnHelper } from './helper';
+
+export const ownership = columnHelper.accessor(
+  (row) =>
+    row.Portainer && row.Portainer.ResourceControl
+      ? determineOwnership(row.Portainer.ResourceControl)
+      : ResourceControlOwnership.ADMINISTRATORS,
+  {
+    header: 'Ownership',
+    cell: OwnershipCell,
+    id: 'ownership',
+  }
+);
+
+function OwnershipCell({
+  getValue,
+}: CellContext<ContainerGroup, ResourceControlOwnership>) {
+  const value = getValue();
+
+  return (
+    <>
+      <i
+        className={clsx(ownershipIcon(value), 'space-right')}
+        aria-hidden="true"
+      />
+      {value}
+    </>
+  );
+}
diff --git a/app/react/azure/container-instances/ListView/columns/ports.tsx b/app/react/azure/container-instances/ListView/columns/ports.tsx
new file mode 100644
index 0000000..11d4d84
--- /dev/null
+++ b/app/react/azure/container-instances/ListView/columns/ports.tsx
@@ -0,0 +1,44 @@
+import { ExternalLink } from 'lucide-react';
+import { CellContext } from '@tanstack/react-table';
+
+import { ContainerGroup } from '@/react/azure/types';
+import { getPorts } from '@/react/azure/utils';
+import { getSchemeFromPort } from '@/react/common/network-utils';
+
+import { Icon } from '@@/Icon';
+
+import { columnHelper } from './helper';
+
+export const ports = columnHelper.accessor(getPorts, {
+  header: 'Published Ports',
+  cell: PortsCell,
+  id: 'ports',
+});
+
+function PortsCell({
+  getValue,
+  row: { original: container },
+}: CellContext<ContainerGroup, ReturnType<typeof getPorts>>) {
+  const ports = getValue();
+
+  const ip = container.properties.ipAddress
+    ? container.properties.ipAddress.ip
+    : '';
+  if (ports.length === 0 || !ip) {
+    return '-';
+  }
+
+  return ports.map((port) => {
+    const scheme = getSchemeFromPort(port.host);
+    return (
+      <a
+        className="image-tag"
+        href={`${scheme}://${ip}:${port.host}`}
+        key={port.host}
+      >
+        <Icon icon={ExternalLink} className="mr-1" />
+        {ip}:{port.host}
+      </a>
+    );
+  });
+}
diff --git a/app/react/azure/container-instances/ListView/index.ts b/app/react/azure/container-instances/ListView/index.ts
new file mode 100644
index 0000000..dd06dfd
--- /dev/null
+++ b/app/react/azure/container-instances/ListView/index.ts
@@ -0,0 +1 @@
+export { ListView } from './ListView';
diff --git a/app/react/azure/queries/query-keys.ts b/app/react/azure/queries/query-keys.ts
new file mode 100644
index 0000000..bd52880
--- /dev/null
+++ b/app/react/azure/queries/query-keys.ts
@@ -0,0 +1,47 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+export const queryKeys = {
+  subscriptions: (environmentId: EnvironmentId) =>
+    ['azure', environmentId, 'subscriptions'] as const,
+  subscription: (environmentId: EnvironmentId, subscriptionId: string) =>
+    [...queryKeys.subscriptions(environmentId), subscriptionId] as const,
+  resourceGroups: (environmentId: EnvironmentId, subscriptionId: string) =>
+    [
+      ...queryKeys.subscription(environmentId, subscriptionId),
+      'resourceGroups',
+    ] as const,
+  resourceGroup: (
+    environmentId: EnvironmentId,
+    subscriptionId: string,
+    resourceGroupName: string
+  ) =>
+    [
+      ...queryKeys.resourceGroups(environmentId, subscriptionId),
+      resourceGroupName,
+    ] as const,
+  provider: (environmentId: EnvironmentId, subscriptionId: string) =>
+    [
+      ...queryKeys.subscription(environmentId, subscriptionId),
+      'provider',
+    ] as const,
+  containerGroups: (environmentId: EnvironmentId, subscriptionId: string) =>
+    [
+      ...queryKeys.subscription(environmentId, subscriptionId),
+      'containerGroups',
+    ] as const,
+  containerGroup: (
+    environmentId: EnvironmentId,
+    subscriptionId: string,
+    resourceGroupName: string,
+    containerGroupName: string
+  ) =>
+    [
+      ...queryKeys.resourceGroup(
+        environmentId,
+        subscriptionId,
+        resourceGroupName
+      ),
+      'containerGroups',
+      containerGroupName,
+    ] as const,
+};
diff --git a/app/react/azure/queries/useContainerGroup.ts b/app/react/azure/queries/useContainerGroup.ts
new file mode 100644
index 0000000..85abc0f
--- /dev/null
+++ b/app/react/azure/queries/useContainerGroup.ts
@@ -0,0 +1,59 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { withError } from '@/react-tools/react-query';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { ContainerGroup } from '../types';
+
+import { queryKeys } from './query-keys';
+import { buildContainerGroupUrl } from './utils';
+
+export function useContainerGroup(
+  environmentId: EnvironmentId,
+  subscriptionId: string,
+  resourceGroupName: string,
+  containerGroupName: string
+) {
+  return useQuery(
+    queryKeys.containerGroup(
+      environmentId,
+      subscriptionId,
+      resourceGroupName,
+      containerGroupName
+    ),
+    () =>
+      getContainerGroup(
+        environmentId,
+        subscriptionId,
+        resourceGroupName,
+        containerGroupName
+      ),
+    {
+      ...withError('Unable to retrieve Azure container group'),
+    }
+  );
+}
+
+async function getContainerGroup(
+  environmentId: EnvironmentId,
+  subscriptionId: string,
+  resourceGroupName: string,
+  containerGroupName: string
+) {
+  try {
+    const { data } = await axios.get<ContainerGroup>(
+      buildContainerGroupUrl(
+        environmentId,
+        subscriptionId,
+        resourceGroupName,
+        containerGroupName
+      ),
+      { params: { 'api-version': '2018-04-01' } }
+    );
+
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e as Error);
+  }
+}
diff --git a/app/react/azure/queries/useContainerGroups.ts b/app/react/azure/queries/useContainerGroups.ts
new file mode 100644
index 0000000..f761e78
--- /dev/null
+++ b/app/react/azure/queries/useContainerGroups.ts
@@ -0,0 +1,59 @@
+import _ from 'lodash';
+import { useMemo } from 'react';
+import { useQueries } from '@tanstack/react-query';
+
+import { withError } from '@/react-tools/react-query';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { Subscription, ContainerGroup } from '../types';
+
+import { queryKeys } from './query-keys';
+import { buildContainerGroupUrl } from './utils';
+
+export function useContainerGroups(
+  environmentId: EnvironmentId,
+  subscriptions: Subscription[] = [],
+  enabled?: boolean
+) {
+  const queries = useQueries({
+    queries: useMemo(
+      () =>
+        subscriptions.map((subscription) => ({
+          queryKey: queryKeys.containerGroups(
+            environmentId,
+            subscription.subscriptionId
+          ),
+          queryFn: async () =>
+            getContainerGroups(environmentId, subscription.subscriptionId),
+          ...withError('Unable to retrieve Azure container groups'),
+          enabled,
+        })),
+      [subscriptions, enabled, environmentId]
+    ),
+  });
+
+  return useMemo(
+    () => ({
+      containerGroups: _.flatMap(_.compact(queries.map((q) => q.data))),
+      isLoading: queries.some((q) => q.isLoading),
+    }),
+    [queries]
+  );
+}
+
+export async function getContainerGroups(
+  environmentId: EnvironmentId,
+  subscriptionId: string
+) {
+  try {
+    const { data } = await axios.get<{ value: ContainerGroup[] }>(
+      buildContainerGroupUrl(environmentId, subscriptionId),
+      { params: { 'api-version': '2018-04-01' } }
+    );
+
+    return data.value;
+  } catch (e) {
+    throw parseAxiosError(e as Error, 'Unable to retrieve container groups');
+  }
+}
diff --git a/app/react/azure/queries/useProvider.ts b/app/react/azure/queries/useProvider.ts
new file mode 100644
index 0000000..f79cef1
--- /dev/null
+++ b/app/react/azure/queries/useProvider.ts
@@ -0,0 +1,89 @@
+import _ from 'lodash';
+import { useQueries } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+
+import { ProviderViewModel, Subscription } from '../types';
+import { azureErrorParser } from '../services/utils';
+
+import { queryKeys } from './query-keys';
+
+export function useProvider(
+  environmentId: EnvironmentId,
+  subscriptions: Subscription[] = []
+) {
+  const queries = useQueries({
+    queries: subscriptions.map((subscription) => ({
+      queryKey: queryKeys.provider(environmentId, subscription.subscriptionId),
+
+      queryFn: async () => {
+        const provider = await getContainerInstanceProvider(
+          environmentId,
+          subscription.subscriptionId
+        );
+        return [subscription.subscriptionId, provider] as const;
+      },
+
+      ...withError('Unable to retrieve Azure providers'),
+    })),
+  });
+
+  return {
+    providers: Object.fromEntries(
+      _.compact(
+        queries.map((q) => {
+          if (q.data) {
+            return q.data;
+          }
+
+          return null;
+        })
+      )
+    ),
+    isLoading: queries.some((q) => q.isLoading),
+  };
+}
+
+interface ResourceType {
+  resourceType: 'containerGroups' | string;
+  locations: string[];
+}
+
+interface ProviderResponse {
+  id: string;
+  namespace: string;
+  resourceTypes: ResourceType[];
+}
+
+async function getContainerInstanceProvider(
+  environmentId: EnvironmentId,
+  subscriptionId: string
+) {
+  try {
+    const url = `/endpoints/${environmentId}/azure/subscriptions/${subscriptionId}/providers/Microsoft.ContainerInstance`;
+    const { data } = await axios.get<ProviderResponse>(url, {
+      params: { 'api-version': '2018-02-01' },
+    });
+
+    return parseViewModel(data);
+  } catch (error) {
+    throw parseAxiosError(
+      error as Error,
+      'Unable to retrieve provider',
+      azureErrorParser
+    );
+  }
+}
+function parseViewModel({
+  id,
+  namespace,
+  resourceTypes,
+}: ProviderResponse): ProviderViewModel {
+  const containerGroupType = _.find(resourceTypes, {
+    resourceType: 'containerGroups',
+  });
+  const { locations = [] } = containerGroupType || {};
+  return { id, namespace, locations };
+}
diff --git a/app/react/azure/queries/useResourceGroup.ts b/app/react/azure/queries/useResourceGroup.ts
new file mode 100644
index 0000000..f88e24b
--- /dev/null
+++ b/app/react/azure/queries/useResourceGroup.ts
@@ -0,0 +1,46 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+
+import { azureErrorParser } from '../services/utils';
+import { ResourceGroup } from '../types';
+
+import { queryKeys } from './query-keys';
+import { buildResourceGroupUrl } from './utils';
+
+export function useResourceGroup(
+  environmentId: EnvironmentId,
+  subscriptionId: string,
+  resourceGroupName: string
+) {
+  return useQuery(
+    queryKeys.resourceGroup(environmentId, subscriptionId, resourceGroupName),
+    () => getResourceGroup(environmentId, subscriptionId, resourceGroupName),
+    {
+      ...withError('Unable to retrieve Azure resource group'),
+    }
+  );
+}
+
+export async function getResourceGroup(
+  environmentId: EnvironmentId,
+  subscriptionId: string,
+  resourceGroupName: string
+) {
+  try {
+    const { data } = await axios.get<ResourceGroup>(
+      buildResourceGroupUrl(environmentId, subscriptionId, resourceGroupName),
+      { params: { 'api-version': '2018-02-01' } }
+    );
+
+    return data;
+  } catch (err) {
+    throw parseAxiosError(
+      err as Error,
+      'Unable to retrieve resource group',
+      azureErrorParser
+    );
+  }
+}
diff --git a/app/react/azure/queries/useResourceGroups.ts b/app/react/azure/queries/useResourceGroups.ts
new file mode 100644
index 0000000..dbef990
--- /dev/null
+++ b/app/react/azure/queries/useResourceGroups.ts
@@ -0,0 +1,74 @@
+import _ from 'lodash';
+import { useQueries } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+
+import { azureErrorParser } from '../services/utils';
+import { Subscription, ResourceGroup } from '../types';
+
+import { queryKeys } from './query-keys';
+import { buildResourceGroupUrl } from './utils';
+
+export function useResourceGroups(
+  environmentId: EnvironmentId,
+  subscriptions: Subscription[] = []
+) {
+  const queries = useQueries({
+    queries: subscriptions.map((subscription) => ({
+      queryKey: queryKeys.resourceGroups(
+        environmentId,
+        subscription.subscriptionId
+      ),
+
+      queryFn: async () => {
+        const groups = await getResourceGroups(
+          environmentId,
+          subscription.subscriptionId
+        );
+        return [subscription.subscriptionId, groups] as const;
+      },
+
+      ...withError('Unable to retrieve Azure resource groups'),
+    })),
+  });
+
+  return {
+    resourceGroups: Object.fromEntries(
+      _.compact(
+        queries.map((q) => {
+          if (q.data) {
+            return q.data;
+          }
+
+          return null;
+        })
+      )
+    ),
+    isLoading: queries.some((q) => q.isLoading),
+    isError: queries.some((q) => q.isError),
+  };
+}
+
+async function getResourceGroups(
+  environmentId: EnvironmentId,
+  subscriptionId: string
+) {
+  try {
+    const {
+      data: { value },
+    } = await axios.get<{ value: ResourceGroup[] }>(
+      buildResourceGroupUrl(environmentId, subscriptionId),
+      { params: { 'api-version': '2018-02-01' } }
+    );
+
+    return value;
+  } catch (err) {
+    throw parseAxiosError(
+      err as Error,
+      'Unable to retrieve resource groups',
+      azureErrorParser
+    );
+  }
+}
diff --git a/app/react/azure/queries/useSubscription.ts b/app/react/azure/queries/useSubscription.ts
new file mode 100644
index 0000000..759a22e
--- /dev/null
+++ b/app/react/azure/queries/useSubscription.ts
@@ -0,0 +1,44 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+
+import { Subscription } from '../types';
+import { azureErrorParser } from '../services/utils';
+
+import { queryKeys } from './query-keys';
+import { buildSubscriptionsUrl } from './utils';
+
+export function useSubscription(
+  environmentId: EnvironmentId,
+  subscriptionId: string
+) {
+  return useQuery(
+    queryKeys.subscription(environmentId, subscriptionId),
+    () => getSubscription(environmentId, subscriptionId),
+    {
+      ...withError('Unable to retrieve Azure subscription'),
+    }
+  );
+}
+
+async function getSubscription(
+  environmentId: EnvironmentId,
+  subscriptionId: string
+) {
+  try {
+    const { data } = await axios.get<Subscription>(
+      buildSubscriptionsUrl(environmentId, subscriptionId),
+      { params: { 'api-version': '2016-06-01' } }
+    );
+
+    return data;
+  } catch (e) {
+    throw parseAxiosError(
+      e as Error,
+      'Unable to retrieve subscription',
+      azureErrorParser
+    );
+  }
+}
diff --git a/app/react/azure/queries/useSubscriptions.ts b/app/react/azure/queries/useSubscriptions.ts
new file mode 100644
index 0000000..e0a5b56
--- /dev/null
+++ b/app/react/azure/queries/useSubscriptions.ts
@@ -0,0 +1,37 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { withError } from '@/react-tools/react-query';
+
+import { azureErrorParser } from '../services/utils';
+import { Subscription } from '../types';
+
+import { queryKeys } from './query-keys';
+import { buildSubscriptionsUrl } from './utils';
+
+export function useSubscriptions(environmentId: EnvironmentId) {
+  return useQuery(
+    queryKeys.subscriptions(environmentId),
+    () => getSubscriptions(environmentId),
+    {
+      ...withError('Unable to retrieve Azure subscriptions'),
+    }
+  );
+}
+
+async function getSubscriptions(environmentId: EnvironmentId) {
+  try {
+    const { data } = await axios.get<{ value: Subscription[] }>(
+      buildSubscriptionsUrl(environmentId),
+      { params: { 'api-version': '2016-06-01' } }
+    );
+    return data.value;
+  } catch (e) {
+    throw parseAxiosError(
+      e,
+      'Unable to retrieve subscriptions',
+      azureErrorParser
+    );
+  }
+}
diff --git a/app/react/azure/queries/utils.ts b/app/react/azure/queries/utils.ts
new file mode 100644
index 0000000..c16495d
--- /dev/null
+++ b/app/react/azure/queries/utils.ts
@@ -0,0 +1,51 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+export function buildSubscriptionsUrl(
+  environmentId: EnvironmentId,
+  id?: string
+) {
+  let url = `/endpoints/${environmentId}/azure/subscriptions`;
+  if (id) {
+    url += `/${id}`;
+  }
+
+  return url;
+}
+
+export function buildResourceGroupUrl(
+  environmentId: EnvironmentId,
+  subscriptionId: string,
+  resourceGroupName?: string
+) {
+  let url = `${buildSubscriptionsUrl(
+    environmentId,
+    subscriptionId
+  )}/resourcegroups`;
+
+  if (resourceGroupName) {
+    url += `/${resourceGroupName}`;
+  }
+
+  return url;
+}
+
+export function buildContainerGroupUrl(
+  environmentId: EnvironmentId,
+  subscriptionId: string,
+  resourceGroupName?: string,
+  containerGroupName?: string
+) {
+  let url = buildSubscriptionsUrl(environmentId, subscriptionId);
+
+  if (resourceGroupName) {
+    url += `/resourceGroups/${resourceGroupName}`;
+  }
+
+  url += `/providers/Microsoft.ContainerInstance/containerGroups`;
+
+  if (containerGroupName) {
+    url += `/${containerGroupName}`;
+  }
+
+  return url;
+}
diff --git a/app/react/azure/services/container-groups.service.test.ts b/app/react/azure/services/container-groups.service.test.ts
new file mode 100644
index 0000000..5037216
--- /dev/null
+++ b/app/react/azure/services/container-groups.service.test.ts
@@ -0,0 +1,112 @@
+import { ContainerInstanceFormValues } from '@/react/azure/types';
+import { ResourceControlOwnership } from '@/react/portainer/access-control/types';
+
+import { transformToPayload } from './container-groups.service';
+
+describe('transformToPayload', () => {
+  const baseFormValues: ContainerInstanceFormValues = {
+    name: 'test-container',
+    location: 'eastus',
+    subscription: 'sub1',
+    resourceGroup: 'rg1',
+    image: 'nginx:latest',
+    os: 'Linux',
+    memory: 1,
+    cpu: 1,
+    ports: [{ container: 80, host: 80, protocol: 'TCP' }],
+    allocatePublicIP: true,
+    accessControl: {
+      authorizedTeams: [],
+      authorizedUsers: [],
+      ownership: ResourceControlOwnership.PRIVATE,
+    },
+    env: [],
+  };
+
+  test('should include empty environment variables array when no env vars provided', () => {
+    const payload = transformToPayload(baseFormValues);
+
+    expect(
+      payload.properties.containers[0].properties.environmentVariables
+    ).toEqual([]);
+  });
+
+  test('should include single environment variable in payload', () => {
+    const formValues = {
+      ...baseFormValues,
+      env: [{ name: 'TEST_VAR', value: 'test-value' }],
+    };
+
+    const payload = transformToPayload(formValues);
+
+    expect(
+      payload.properties.containers[0].properties.environmentVariables
+    ).toEqual([{ name: 'TEST_VAR', value: 'test-value' }]);
+  });
+
+  test('should include multiple environment variables in payload', () => {
+    const formValues = {
+      ...baseFormValues,
+      env: [
+        { name: 'VAR1', value: 'value1' },
+        { name: 'VAR2', value: 'value2' },
+        { name: 'VAR3', value: 'value3' },
+      ],
+    };
+
+    const payload = transformToPayload(formValues);
+
+    expect(
+      payload.properties.containers[0].properties.environmentVariables
+    ).toEqual([
+      { name: 'VAR1', value: 'value1' },
+      { name: 'VAR2', value: 'value2' },
+      { name: 'VAR3', value: 'value3' },
+    ]);
+  });
+
+  test('should preserve other container properties when adding env vars', () => {
+    const formValues: ContainerInstanceFormValues = {
+      ...baseFormValues,
+      env: [{ name: 'APP_ENV', value: 'production' }],
+      ports: [
+        { container: 80, host: 80, protocol: 'TCP' },
+        { container: 443, host: 443, protocol: 'TCP' },
+      ],
+    };
+
+    const payload = transformToPayload(formValues);
+    const containerProps = payload.properties.containers[0].properties;
+
+    expect(containerProps.image).toBe('nginx:latest');
+    expect(containerProps.ports).toHaveLength(2);
+    expect(containerProps.environmentVariables).toEqual([
+      { name: 'APP_ENV', value: 'production' },
+    ]);
+  });
+
+  test('should handle env vars with special characters', () => {
+    const formValues = {
+      ...baseFormValues,
+      env: [
+        {
+          name: 'DB_CONNECTION_STRING',
+          value: 'Server=localhost;User=admin;Password=P@ss123',
+        },
+        { name: 'API_KEY', value: 'abc123!@#$%^&*()' },
+      ],
+    };
+
+    const payload = transformToPayload(formValues);
+
+    expect(
+      payload.properties.containers[0].properties.environmentVariables
+    ).toEqual([
+      {
+        name: 'DB_CONNECTION_STRING',
+        value: 'Server=localhost;User=admin;Password=P@ss123',
+      },
+      { name: 'API_KEY', value: 'abc123!@#$%^&*()' },
+    ]);
+  });
+});
diff --git a/app/react/azure/services/container-groups.service.ts b/app/react/azure/services/container-groups.service.ts
new file mode 100644
index 0000000..6e93585
--- /dev/null
+++ b/app/react/azure/services/container-groups.service.ts
@@ -0,0 +1,94 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { buildContainerGroupUrl } from '../queries/utils';
+import { ContainerGroup, ContainerInstanceFormValues } from '../types';
+
+export async function createContainerGroup(
+  model: ContainerInstanceFormValues,
+  environmentId: EnvironmentId,
+  subscriptionId: string,
+  resourceGroupName: string
+) {
+  const payload = transformToPayload(model);
+  try {
+    const { data } = await axios.put<ContainerGroup>(
+      buildContainerGroupUrl(
+        environmentId,
+        subscriptionId,
+        resourceGroupName,
+        model.name
+      ),
+      payload,
+      { params: { 'api-version': '2018-04-01' } }
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e as Error);
+  }
+}
+
+export async function deleteContainerGroup(
+  environmentId: EnvironmentId,
+  containerGroupId: string
+) {
+  try {
+    await axios.delete(`/endpoints/${environmentId}/azure${containerGroupId}`, {
+      params: { 'api-version': '2018-04-01' },
+    });
+  } catch (e) {
+    throw parseAxiosError(e as Error, 'Unable to remove container group');
+  }
+}
+
+export function transformToPayload(model: ContainerInstanceFormValues) {
+  const containerPorts = [];
+  const addressPorts = [];
+
+  const ports = model.ports.filter((p) => p.container && p.host);
+
+  for (let i = 0; i < ports.length; i += 1) {
+    const binding = ports[i];
+
+    containerPorts.push({
+      port: binding.container,
+    });
+
+    addressPorts.push({
+      port: binding.host,
+      protocol: binding.protocol,
+    });
+  }
+
+  const environmentVariables = model.env.map(({ name, value }) => ({
+    name,
+    value,
+  }));
+
+  return {
+    location: model.location,
+    properties: {
+      osType: model.os,
+      containers: [
+        {
+          name: model.name,
+          properties: {
+            image: model.image,
+            ports: containerPorts,
+            environmentVariables,
+            resources: {
+              requests: {
+                cpu: model.cpu,
+                memoryInGB: model.memory,
+              },
+            },
+          },
+        },
+      ],
+      ipAddress: {
+        type: model.allocatePublicIP ? 'Public' : 'Private',
+        ports: addressPorts,
+      },
+    },
+  };
+}
diff --git a/app/react/azure/services/utils.ts b/app/react/azure/services/utils.ts
new file mode 100644
index 0000000..eb2898c
--- /dev/null
+++ b/app/react/azure/services/utils.ts
@@ -0,0 +1,25 @@
+import { AxiosError } from 'axios';
+
+export function azureErrorParser(axiosError: AxiosError) {
+  if (!axiosError.response) {
+    const error = new Error('Failed azure request');
+    return {
+      error,
+      details: axiosError.message,
+    };
+  }
+
+  const responseData = axiosError.response.data;
+  const message =
+    responseData &&
+    typeof responseData === 'object' &&
+    'error' in responseData &&
+    typeof responseData.error === 'string'
+      ? responseData.error
+      : `Failed azure request: ${axiosError.response?.statusText}`;
+
+  return {
+    error: new Error(message),
+    details: message,
+  };
+}
diff --git a/app/react/azure/types.ts b/app/react/azure/types.ts
new file mode 100644
index 0000000..c4c6c84
--- /dev/null
+++ b/app/react/azure/types.ts
@@ -0,0 +1,79 @@
+import { AccessControlFormData } from '@/react/portainer/access-control/types';
+import { PortainerResponse } from '@/react/docker/types';
+
+import { PortMapping } from './container-instances/CreateView/PortsMappingField';
+
+type OS = 'Linux' | 'Windows';
+
+export interface ContainerInstanceFormValues {
+  name: string;
+  location?: string;
+  subscription?: string;
+  resourceGroup?: string;
+  image: string;
+  os: OS;
+  memory: number;
+  cpu: number;
+  ports: PortMapping[];
+  allocatePublicIP: boolean;
+  accessControl: AccessControlFormData;
+  env: { name: string; value: string }[];
+}
+
+interface Container {
+  name: string;
+  properties: {
+    environmentVariables?: {
+      name: string;
+      value: string;
+      secureValue?: string;
+    }[];
+    image: string;
+    ports: { port: number }[];
+    resources: {
+      cpu: number;
+      memoryInGB: number;
+    };
+  };
+}
+
+interface ContainerGroupProperties {
+  containers: (Container | undefined)[];
+  instanceView: {
+    events: unknown[];
+    state: 'pending' | string;
+  };
+  ipAddress: {
+    dnsNameLabelReusePolicy: string;
+    ports: { port: number; protocol: 'TCP' | 'UDP' }[];
+    type: 'Public' | 'Private';
+    ip: string;
+  };
+  osType: OS;
+}
+
+export type ContainerGroup = PortainerResponse<{
+  id: string;
+  name: string;
+  location: string;
+  type: string;
+  properties: ContainerGroupProperties;
+}>;
+
+export interface Subscription {
+  subscriptionId: string;
+  displayName: string;
+}
+
+export interface ResourceGroup {
+  id: string;
+  name: string;
+  location: string;
+  subscriptionId: string;
+}
+
+export interface ProviderViewModel {
+  id: string;
+  namespace: string;
+  locations: string[];
+}
diff --git a/app/react/azure/utils.ts b/app/react/azure/utils.ts
new file mode 100644
index 0000000..1f98b13
--- /dev/null
+++ b/app/react/azure/utils.ts
@@ -0,0 +1,20 @@
+import { ContainerGroup } from './types';
+
+export function getPorts(containerGroup: ContainerGroup) {
+  const addressPorts = containerGroup.properties.ipAddress
+    ? containerGroup.properties.ipAddress.ports
+    : [];
+  const container = containerGroup.properties.containers.length
+    ? containerGroup.properties.containers[0]
+    : null;
+  const containerPorts = container ? container.properties.ports : [];
+
+  return addressPorts.map((binding, index) => {
+    const port = containerPorts[index] ? containerPorts[index].port : undefined;
+    return {
+      container: port,
+      host: binding.port,
+      protocol: binding.protocol,
+    };
+  });
+}
diff --git a/app/react/common/api/common.test.ts b/app/react/common/api/common.test.ts
new file mode 100644
index 0000000..97d22c2
--- /dev/null
+++ b/app/react/common/api/common.test.ts
@@ -0,0 +1,117 @@
+import {
+  queryOptionsFromTableState,
+  queryParamsFromQueryOptions,
+} from './listQueryParams';
+import {
+  withPaginationHeaders,
+  withPaginationQueryParams,
+} from './pagination.types';
+import {
+  makeIsSortTypeFunc,
+  sortOptionsFromColumns,
+  withSortQuery,
+} from './sort.types';
+
+const sortOptions = sortOptionsFromColumns([
+  { enableSorting: true },
+  { id: 'one' },
+  { id: 'two', enableSorting: true },
+  { accessorKey: 'three', enableSorting: true },
+  { id: 'four', enableSorting: true, accessorKey: 'four_key' },
+]);
+
+describe('listQueryParams', () => {
+  test('queryOptionsFromTableState', () => {
+    const fns = {
+      setPageSize: () => {},
+      setSearch: () => {},
+      setSortBy: () => {},
+    };
+
+    expect(
+      queryOptionsFromTableState(
+        {
+          page: 5,
+          pageSize: 10,
+          search: 'something',
+          sortBy: { id: 'one', desc: false },
+          ...fns,
+        },
+        sortOptions
+      )
+    ).toStrictEqual({
+      search: 'something',
+      sort: 'one',
+      order: 'asc',
+      page: 5,
+      pageLimit: 10,
+    });
+  });
+
+  test('queryParamsFromQueryOptions', () => {
+    expect(
+      queryParamsFromQueryOptions({
+        search: 'something',
+        page: 5,
+        pageLimit: 10,
+        sort: 'one',
+        order: 'asc',
+      })
+    ).toStrictEqual({
+      search: 'something',
+      sort: 'one',
+      order: 'asc',
+      start: 50,
+      limit: 10,
+    });
+  });
+});
+
+describe('pagination.types', () => {
+  test('withPaginationQueryParams', () => {
+    expect(withPaginationQueryParams({ page: 5, pageLimit: 10 })).toStrictEqual(
+      {
+        start: 50,
+        limit: 10,
+      }
+    );
+  });
+
+  test('withPaginationHeaders', () => {
+    expect(
+      withPaginationHeaders({
+        data: [],
+        headers: { 'x-total-count': 10, 'x-total-available': 100 },
+      })
+    ).toStrictEqual({
+      data: [],
+      totalCount: 10,
+      totalAvailable: 100,
+    });
+  });
+});
+
+describe('sort.types', () => {
+  test('makeIsSortType', () => {
+    const isSortType = makeIsSortTypeFunc(sortOptions);
+    expect(typeof isSortType).toBe('function');
+    expect(isSortType('one')).toBe(true);
+    expect(isSortType('something_else')).toBe(false);
+  });
+
+  test('withSortQuery', () => {
+    expect(
+      withSortQuery({ id: 'one', desc: false }, sortOptions)
+    ).toStrictEqual({ sort: 'one', order: 'asc' });
+    expect(
+      withSortQuery({ id: 'three', desc: true }, sortOptions)
+    ).toStrictEqual({ sort: 'three', order: 'desc' });
+    expect(
+      withSortQuery({ id: 'something_else', desc: true }, sortOptions)
+    ).toStrictEqual({ sort: undefined, order: 'desc' });
+  });
+
+  test('sortOptionsFromColumns', () => {
+    expect(sortOptions).toEqual(['one', 'two', 'three', 'four']);
+  });
+});
diff --git a/app/react/common/api/listQueryParams.ts b/app/react/common/api/listQueryParams.ts
new file mode 100644
index 0000000..dc2101c
--- /dev/null
+++ b/app/react/common/api/listQueryParams.ts
@@ -0,0 +1,65 @@
+import { BasicTableSettings } from '@@/datatables/types';
+import { TableState } from '@@/datatables/useTableState';
+
+import {
+  PaginationQuery,
+  PaginationQueryParams,
+  withPaginationQueryParams,
+} from './pagination.types';
+import { SearchQuery, SearchQueryParams } from './search.types';
+import {
+  SortOptions,
+  SortQuery,
+  SortQueryParams,
+  withSortQuery,
+} from './sort.types';
+
+export type BaseQueryOptions<T extends SortOptions> = SearchQuery &
+  SortQuery<T> &
+  PaginationQuery;
+
+/**
+ * Utility function to transform a TableState (base form) to a query options object
+ * Used to unify backend pagination common cases
+ *
+ * @param tableState TableState {search, sortBy: {id:string, desc:bool }, page, pageSize}
+ * @param sortOptions SortOptions (generated from columns)
+ * @returns BaseQuery {search, sort, order, page, pageLimit}
+ */
+export function queryOptionsFromTableState<T extends SortOptions>(
+  tableState: TableState<BasicTableSettings> & { page: number },
+  sortOptions: T
+): BaseQueryOptions<T> {
+  return {
+    // search/filter
+    search: tableState.search,
+    // sorting
+    ...withSortQuery(tableState.sortBy, sortOptions),
+    // pagination
+    page: tableState.page,
+    pageLimit: tableState.pageSize,
+  };
+}
+
+export type BaseQueryParams<T extends SortOptions> = SearchQueryParams &
+  SortQueryParams<T> &
+  PaginationQueryParams;
+
+/**
+ *
+ * @param query BaseQueryOptions
+ * @returns BaseQueryParams {search, sort, order, start, limit}
+ */
+export function queryParamsFromQueryOptions<T extends SortOptions>(
+  query: BaseQueryOptions<T>
+): BaseQueryParams<T> {
+  return {
+    // search/filter
+    search: query.search,
+    // sorting
+    sort: query.sort,
+    order: query.order,
+    // paginattion
+    ...withPaginationQueryParams(query),
+  };
+}
diff --git a/app/react/common/api/pagination.types.ts b/app/react/common/api/pagination.types.ts
new file mode 100644
index 0000000..f0e49b0
--- /dev/null
+++ b/app/react/common/api/pagination.types.ts
@@ -0,0 +1,114 @@
+import { AxiosResponse } from 'axios';
+
+/**
+ * Used to define axios query functions parameters for queries that support backend pagination
+ *
+ * **Example**
+ *
+ * ```ts
+ *  type QueryParams = PaginationQueryParams;
+ *
+ *  async function getSomething({ start, limit }: QueryParams = {}) {
+ *    try {
+ *      const { data } = await axios.get<APIType>(
+ *        buildUrl(),
+ *        { params: { start, limit } },
+ *      );
+ *      return data;
+ *    } catch (err) {
+ *      throw parseAxiosError(err as Error, 'Unable to retrieve something');
+ *    }
+ *  }
+ *```
+ */
+export type PaginationQueryParams = {
+  start?: number;
+  limit?: number;
+};
+
+/**
+ * Used to define react-query query functions parameters for queries that support backend pagination
+ *
+ * Example:
+ *
+ * ```ts
+ * type Query = PaginationQuery;
+ *
+ * function useSomething({
+ *    page = 0,
+ *    pageLimit = 10,
+ *    ...query
+ *   }: Query = {}) {
+ *     return useQuery(
+ *     [ ...queryKeys.base(), { page, pageLimit, ...query } ],
+ *     async () => {
+ *       const start = (page - 1) * pageLimit + 1;
+ *       return getSomething({ start, limit: pageLimit, ...query });
+ *     },
+ *     {
+ *       ...withError('Failure retrieving something'),
+ *     }
+ *   );
+ * }
+ * ```
+ */
+export type PaginationQuery = {
+  page?: number;
+  pageLimit?: number;
+};
+
+/**
+ * Utility function to convert PaginationQuery to PaginationQueryParams
+ *
+ * **Example**
+ *
+ * ```ts
+ * function getSomething(params: PaginationQueryParams) {...}
+ *
+ * function useSomething(query: PaginationQuery) {
+ *   return useQuery(
+ *     [ ...queryKeys.base(), query ],
+ *     async () => getSomething({ ...query, ...withPaginationQueryParams(query) })
+ *   )
+ * }
+ * ```
+ */
+export function withPaginationQueryParams({
+  page = 0,
+  pageLimit = 10,
+}: PaginationQuery): PaginationQueryParams {
+  const start = page * pageLimit;
+  return {
+    start,
+    limit: pageLimit,
+  };
+}
+
+export type PaginatedResults<T> = {
+  data: T | null;
+  totalCount: number;
+  totalAvailable: number;
+};
+
+/**
+ * Utility function to extract total count from AxiosResponse headers
+ *
+ * @param param0 AxiosReponse-like object {data, headers}
+ * @returns PaginatedResults {data, totalCount, totalAvailable}
+ */
+export function withPaginationHeaders<T = unknown>({
+  data,
+  headers,
+}: {
+  data: AxiosResponse<T>['data'];
+  headers: AxiosResponse<T>['headers'];
+}): PaginatedResults<T> {
+  const totalCount = parseInt(headers['x-total-count'], 10);
+  const totalAvailable = parseInt(headers['x-total-available'], 10);
+
+  return {
+    data,
+    totalCount,
+    totalAvailable,
+  };
+}
diff --git a/app/react/common/api/search.types.ts b/app/react/common/api/search.types.ts
new file mode 100644
index 0000000..e146bd8
--- /dev/null
+++ b/app/react/common/api/search.types.ts
@@ -0,0 +1,47 @@
+/**
+ * Used to define axios query functions parameters for queries that support backend filtering by search
+ *
+ * **Example**
+ *
+ * ```ts
+ *  type QueryParams = SearchQueryParams;
+ *
+ *  async function getSomething({ search }: QueryParams = {}) {
+ *    try {
+ *      const { data } = await axios.get<APIType>(
+ *        buildUrl(),
+ *        { params: { search } },
+ *      );
+ *      return data;
+ *    } catch (err) {
+ *      throw parseAxiosError(err as Error, 'Unable to retrieve something');
+ *    }
+ *  }
+ *```
+ */
+export type SearchQueryParams = {
+  search?: string;
+};
+
+/**
+ * Used to define react-query query functions parameters for queries that support backend filtering by search
+ *
+ * Example:
+ *
+ * ```ts
+ * type Query = SearchQuery;
+ *
+ * function useSomething({ search, ...query }: Query = {}) {
+ *   return useQuery(
+ *     [ ...queryKeys.base(), { search, ...query } ],
+ *     async () => getSomething({ search, ...query }),
+ *     {
+ *       ...withError('Failure retrieving something'),
+ *     }
+ *   );
+ * }
+ * ```
+ */
+export type SearchQuery = {
+  search?: string;
+};
diff --git a/app/react/common/api/sort.types.ts b/app/react/common/api/sort.types.ts
new file mode 100644
index 0000000..78607ae
--- /dev/null
+++ b/app/react/common/api/sort.types.ts
@@ -0,0 +1,139 @@
+import { compact } from 'lodash';
+
+import { SortableTableSettings } from '@@/datatables/types';
+
+export type SortOptions = readonly string[];
+export type SortType<T extends SortOptions> = T[number];
+
+/**
+ * Used to generate the validation function that allows to check if the sort key is supported or not
+ *
+ * **Example**
+ *
+ * ```ts
+ * export const sortOptions: SortOptions = ['Id', 'Name'] as const;
+ * export const isSortType = makeIsSortTypeFunc(sortOptions)
+ * ```
+ *
+ * **Usage**
+ *
+ * ```ts
+ * // react-query hook definition
+ * export function useSomething({ sort, order }: SortQuery<typeof sortOptions>) { ... }
+ *
+ * // component using the react-query hook, validating the parameters used by the query
+ * function MyComponent() {
+ *   const tableState = useTableState(settingsStore, tableKey);
+ *   const { data } = useSomething(
+ *     {
+ *       sort: isSortType(tableState.sortBy.id) ? tableState.sortBy.id : undefined,
+ *       order: tableState.sortBy.desc ? 'desc' : 'asc',
+ *     },
+ *   );
+ *   ...
+ * }
+ * ```
+ *
+ * @param sortOptions list of supported keys
+ * @returns validation function
+ */
+export function makeIsSortTypeFunc<T extends SortOptions>(sortOptions: T) {
+  return (value?: string): value is SortType<T> =>
+    sortOptions.includes(value as SortType<T>);
+}
+
+/**
+ * Used to define axios query functions parameters for queries that support backend sorting
+ *
+ * **Example**
+ *
+ * ```ts
+ *  const sortOptions: SortOptions = ['Id', 'Name'] as const; // or generated with `sortOptionsFromColumns`
+ *  type QueryParams = SortQueryParams<typeof sortOptions>;
+ *
+ *  async function getSomething({ sort, order = 'asc' }: QueryParams = {}) {
+ *    try {
+ *      const { data } = await axios.get<APIType>(
+ *        buildUrl(),
+ *        { params: { sort, order } },
+ *      );
+ *      return data;
+ *    } catch (err) {
+ *      throw parseAxiosError(err as Error, 'Unable to retrieve something');
+ *    }
+ *  }
+ *```
+ */
+export type SortQueryParams<T extends SortOptions> = {
+  sort?: SortType<T>;
+  order?: 'asc' | 'desc';
+};
+
+/**
+ * Used to define react-query query functions parameters for queries that support backend sorting
+ *
+ * Example:
+ *
+ * ```ts
+ *  const sortOptions: SortOptions = ['Id', 'Name'] as const;
+ *  type Query = SortQuery<typeof sortOptions>;
+ *
+ *  function useSomething({
+ *    sort,
+ *    order = 'asc',
+ *    ...query
+ *  }: Query = {}) {
+ *    return useQuery(
+ *      [ ...queryKeys.base(), { ...query, sort, order } ],
+ *      async () => getSomething({ ...query, sort, order }),
+ *      {
+ *        ...withError('Failure retrieving something'),
+ *      }
+ *    );
+ *  }
+ * ```
+ */
+export type SortQuery<T extends SortOptions> = {
+  sort?: SortType<T>;
+  order?: 'asc' | 'desc';
+};
+
+/**
+ * Utility function to convert react-table `sortBy` state to `SortQuery` query parameter
+ *
+ * @param sortBy tableState.sortBy
+ * @param sortOptions SortOptions - either defined manually, or generated with `sortOptionsFromColumns`
+ * @returns SortQuery - object usable by react-query functions that have params extending SortQuery
+ */
+export function withSortQuery<T extends SortOptions>(
+  sortBy: SortableTableSettings['sortBy'],
+  sortOptions: T
+): SortQuery<T> {
+  if (!sortBy) {
+    return {
+      sort: undefined,
+      order: 'asc',
+    };
+  }
+
+  const isSortType = makeIsSortTypeFunc(sortOptions);
+  return {
+    sort: isSortType(sortBy.id) ? sortBy.id : undefined,
+    order: sortBy.desc ? 'desc' : 'asc',
+  };
+}
+
+/**
+ * Utility function to generate SortOptions from columns definitions
+ * @param columns Column-like objects { id?:string; enableSorting?:boolean } to extract SortOptions from
+ * @returns SortOptions
+ */
+export function sortOptionsFromColumns(
+  columns: { id?: string; enableSorting?: boolean; accessorKey?: string }[]
+): SortOptions {
+  return compact(
+    columns.map((c) =>
+      c.enableSorting === false ? undefined : (c.id ?? c.accessorKey)
+    )
+  );
+}
diff --git a/app/react/common/date-utils.ts b/app/react/common/date-utils.ts
new file mode 100644
index 0000000..608400a
--- /dev/null
+++ b/app/react/common/date-utils.ts
@@ -0,0 +1,16 @@
+/**
+ * Format a date to a human-readable string based on the user's locale.
+ */
+export function localizeDate(date: Date) {
+  return date
+    .toLocaleString(undefined, {
+      year: 'numeric',
+      month: 'short',
+      day: 'numeric',
+      hour: 'numeric',
+      minute: '2-digit',
+      hour12: true,
+    })
+    .replace('am', 'AM')
+    .replace('pm', 'PM');
+}
diff --git a/app/react/common/network-utils.ts b/app/react/common/network-utils.ts
new file mode 100644
index 0000000..426dc4b
--- /dev/null
+++ b/app/react/common/network-utils.ts
@@ -0,0 +1,8 @@
+export function getSchemeFromPort(port?: number): 'http' | 'https' {
+  if (!port) {
+    return 'http';
+  }
+
+  const hostPort = String(port);
+  return hostPort.endsWith('443') ? 'https' : 'http';
+}
diff --git a/app/react/common/processItemsInBatches.ts b/app/react/common/processItemsInBatches.ts
new file mode 100644
index 0000000..adeaaa0
--- /dev/null
+++ b/app/react/common/processItemsInBatches.ts
@@ -0,0 +1,30 @@
+/**
+ * Type definition for the callback function used in processItemsInBatches.
+ * It should accept an item from the array as its first argument
+ * and additional arguments (if any) as its second argument, and should return a Promise.
+ */
+type ProcessItemsCallback<T, Args extends never[]> = (
+  item: T,
+  ...args: Args
+) => Promise<void>;
+
+/**
+ * Asynchronously processes an array of items in batches.
+ * @param items An array of items to be processed.
+ * @param processor A callback function of type ProcessItemsCallback that will be called for each item in the array.
+ * @param batchSize The maximum number of items to process in each batch. Defaults to 100 if not provided.
+ * @param args Additional arguments to be passed to the callback function for each item.
+ */
+export async function processItemsInBatches<T, Args extends never[]>(
+  items: T[],
+  processor: ProcessItemsCallback<T, Args>,
+  batchSize = 100,
+  ...args: Args
+): Promise<void> {
+  while (items.length) {
+    const batch = items.splice(0, batchSize);
+    const batchPromises = batch.map((item) => processor(item, ...args));
+
+    await Promise.all(batchPromises);
+  }
+}
diff --git a/app/react/common/semver-utils.test.ts b/app/react/common/semver-utils.test.ts
new file mode 100644
index 0000000..0f8ae1a
--- /dev/null
+++ b/app/react/common/semver-utils.test.ts
@@ -0,0 +1,78 @@
+import { semverCompare } from './semver-utils';
+
+describe('semverCompare', () => {
+  test('sort array', () => {
+    const versions = [
+      '1.2.3',
+      '4.11.6',
+      '4.2.0',
+      '1.5.19',
+      '1.5.5',
+      '4.1.3',
+      '2.3.1',
+      '10.5.5',
+      '11.3.0',
+    ];
+    expect(versions.sort(semverCompare)).toStrictEqual([
+      '1.2.3',
+      '1.5.5',
+      '1.5.19',
+      '2.3.1',
+      '4.1.3',
+      '4.2.0',
+      '4.11.6',
+      '10.5.5',
+      '11.3.0',
+    ]);
+  });
+
+  test('compare versions', () => {
+    // 1.0.0 < 2.0.0 < 2.1.0 < 2.1.1
+    expect(semverCompare('1.0.0', '2.0.0')).toBe(-1);
+    expect(semverCompare('2.0.0', '2.1.0')).toBe(-1);
+    expect(semverCompare('2.1.0', '2.1.1')).toBe(-1);
+
+    // 1.0.0-alpha < 1.0.0
+    expect(semverCompare('1.0.0-alpha', '1.0.0')).toBe(-1);
+
+    // 1.0.0-alpha < 1.0.0-alpha.1 < 1.0.0-alpha.beta < 1.0.0-beta < 1.0.0-beta.2 < 1.0.0-beta.11 < 1.0.0-rc.1 < 1.0.0
+    expect(semverCompare('1.0.0-alpha', '1.0.0-alpha.1')).toBe(-1);
+    expect(semverCompare('1.0.0-alpha.1', '1.0.0-alpha.beta')).toBe(-1);
+    expect(semverCompare('1.0.0-alpha.beta', '1.0.0-beta')).toBe(-1);
+    expect(semverCompare('1.0.0-beta', '1.0.0-beta.2')).toBe(-1);
+    expect(semverCompare('1.0.0-beta.2', '1.0.0-beta.11')).toBe(-1);
+    expect(semverCompare('1.0.0-beta.11', '1.0.0-rc.1')).toBe(-1);
+    expect(semverCompare('1.0.0-rc.1', '1.0.0')).toBe(-1);
+
+    // Build metadata MUST be ignored when determining version precedence.
+    // expect(semverCompare("1.0.0", "=", "1.0.0+asdf") // ❌ exp: =, got: <).toBe(-1)
+    // expect(semverCompare("1.0.0+qwer", "=", "1.0.0+asdf") // ❌ exp: =, got: >).toBe(-1)
+
+    // Workaround via `v.replace(/\+.*/, "")`
+    // expect(semverCompare("1.0.0", "=", "1.0.0+asdf".replace(/\+.*/, ""))).toBe(-1)
+    // expect(semverCompare("1.0.0+qwer".replace(/\+.*/, ""), "=", "1.0.0+asdf".replace(/\+.*/, ""))).toBe(-1)
+
+    expect(semverCompare('0.0.0', '0.0.0-foo')).toBe(1);
+    expect(semverCompare('0.0.1', '0.0.0')).toBe(1);
+    expect(semverCompare('1.0.0', '0.9.9')).toBe(1);
+    expect(semverCompare('0.10.0', '0.9.0')).toBe(1);
+    expect(semverCompare('0.99.0', '0.10.0')).toBe(1);
+    expect(semverCompare('2.0.0', '1.2.3')).toBe(1);
+    expect(semverCompare('1.2.3', '1.2.3-asdf')).toBe(1);
+    expect(semverCompare('1.2.3', '1.2.3-4')).toBe(1);
+    expect(semverCompare('1.2.3', '1.2.3-4-foo')).toBe(1);
+    // expect(semverCompare("1.2.3-5-foo", ">", "1.2.3-5").toBe(1) // ❌ exp: >, got: <)
+    expect(semverCompare('1.2.3-5', '1.2.3-4')).toBe(1);
+    expect(semverCompare('1.2.3-5-foo', '1.2.3-5-Foo')).toBe(1);
+    expect(semverCompare('3.0.0', '2.7.2+asdf')).toBe(1);
+    expect(semverCompare('1.2.3-a.10', '1.2.3-a.5')).toBe(1);
+    expect(semverCompare('1.2.3-a.b', '1.2.3-a.5')).toBe(1);
+    expect(semverCompare('1.2.3-a.b', '1.2.3-a')).toBe(1);
+    expect(semverCompare('1.2.3-a.b.c.10.d.5', '1.2.3-a.b.c.5.d.100')).toBe(1);
+    // expect(semverCompare("1.2.3-r2", "1.2.3-r100").toBe(1) // ❌ exp: >, got: <)
+    expect(semverCompare('1.2.3-r100', '1.2.3-R2')).toBe(1);
+
+    expect(semverCompare('1.0.0', '1.0.0')).toBe(0);
+    expect(semverCompare('1.2.3', '1.2.3')).toBe(0);
+  });
+});
diff --git a/app/react/common/semver-utils.ts b/app/react/common/semver-utils.ts
new file mode 100644
index 0000000..364d267
--- /dev/null
+++ b/app/react/common/semver-utils.ts
@@ -0,0 +1,27 @@
+/**
+ * Compares two semver strings.
+ *
+ * returns:
+ * - `-1` if `a < b`
+ * - `0` if `a == b`
+ * - `1` if `a > b`
+ */
+export function semverCompare(a: string, b: string) {
+  if (a.startsWith(`${b}-`)) {
+    return -1;
+  }
+
+  if (b.startsWith(`${a}-`)) {
+    return 1;
+  }
+
+  return a.localeCompare(b, undefined, {
+    numeric: true,
+    sensitivity: 'case',
+    caseFirst: 'upper',
+  });
+}
+
+export function isVersionSmaller(a: string, b: string) {
+  return semverCompare(a, b) < 0;
+}
diff --git a/app/react/common/stacks/CreateView/.keep b/app/react/common/stacks/CreateView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/common/stacks/EditGitSettings/EditGitSettingsModal.test.tsx b/app/react/common/stacks/EditGitSettings/EditGitSettingsModal.test.tsx
new file mode 100644
index 0000000..b574bba
--- /dev/null
+++ b/app/react/common/stacks/EditGitSettings/EditGitSettingsModal.test.tsx
@@ -0,0 +1,173 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { vi } from 'vitest';
+
+import { server } from '@/setup-tests/server';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { createMockStack } from '@/react-tools/test-mocks';
+import { notifyError, notifySuccess } from '@/portainer/services/notifications';
+import { confirmStackUpdate } from '@/react/common/stacks/common/confirm-stack-update';
+
+import { EditGitSettingsModal } from './EditGitSettingsModal';
+
+vi.mock('@/react/hooks/useEnvironmentId', () => ({
+  useEnvironmentId: vi.fn(() => 1),
+}));
+
+vi.mock('@/react/common/stacks/common/confirm-stack-update', () => ({
+  confirmStackUpdate: vi.fn(),
+}));
+
+vi.mock('@/portainer/services/notifications', () => ({
+  notifyError: vi.fn(),
+  notifySuccess: vi.fn(),
+}));
+
+const mockStack = createMockStack({
+  Id: 1,
+  EndpointId: 1,
+  GitSourceId: 1,
+  GitConfig: {
+    URL: 'https://github.com/test/repo',
+    ReferenceName: 'main',
+    ConfigFilePath: 'docker-compose.yml',
+    ConfigHash: '',
+    TLSSkipVerify: false,
+  },
+});
+
+afterEach(() => {
+  vi.clearAllMocks();
+});
+
+describe('EditGitSettingsModal', () => {
+  test('saves settings only (no redeploy) — calls POST /stacks/{id}/git and shows success notification', async () => {
+    const onClose = vi.fn();
+    let settingsApiCalled = false;
+    let redeployApiCalled = false;
+
+    server.use(
+      http.post('/api/stacks/:id/git', () => {
+        settingsApiCalled = true;
+        return HttpResponse.json({});
+      }),
+      http.put('/api/stacks/:id/git/redeploy', () => {
+        redeployApiCalled = true;
+        return HttpResponse.json({});
+      })
+    );
+
+    const user = userEvent.setup();
+    renderComponent(onClose);
+
+    await user.click(screen.getByRole('button', { name: /save settings/i }));
+
+    await waitFor(() => {
+      expect(settingsApiCalled).toBe(true);
+      expect(redeployApiCalled).toBe(false);
+      expect(notifySuccess).toHaveBeenCalledWith(
+        'Success',
+        'Stack settings saved successfully'
+      );
+      expect(onClose).toHaveBeenCalled();
+    });
+  });
+
+  test('saves settings and redeploys when Redeploy is checked and confirmed — calls both endpoints and shows deploy success notification', async () => {
+    const onClose = vi.fn();
+    let settingsApiCalled = false;
+    let redeployApiCalled = false;
+
+    vi.mocked(confirmStackUpdate).mockResolvedValue({
+      repullImageAndRedeploy: false,
+    });
+
+    server.use(
+      http.post('/api/stacks/:id/git', () => {
+        settingsApiCalled = true;
+        return HttpResponse.json({});
+      }),
+      http.put('/api/stacks/:id/git/redeploy', () => {
+        redeployApiCalled = true;
+        return HttpResponse.json({});
+      })
+    );
+
+    const user = userEvent.setup();
+    renderComponent(onClose);
+
+    await user.click(screen.getByRole('checkbox', { name: /redeploy/i }));
+    await user.click(screen.getByRole('button', { name: /save settings/i }));
+
+    await waitFor(() => {
+      expect(confirmStackUpdate).toHaveBeenCalled();
+      expect(settingsApiCalled).toBe(true);
+      expect(redeployApiCalled).toBe(true);
+      expect(notifySuccess).toHaveBeenCalledWith(
+        'Success',
+        'Stack deployed successfully'
+      );
+      expect(onClose).toHaveBeenCalled();
+    });
+  });
+
+  test('shows error notification when settings save succeeds but redeploy fails', async () => {
+    const onClose = vi.fn();
+
+    vi.mocked(confirmStackUpdate).mockResolvedValue({
+      repullImageAndRedeploy: false,
+    });
+
+    server.use(
+      http.post('/api/stacks/:id/git', () => HttpResponse.json({})),
+      http.put('/api/stacks/:id/git/redeploy', () =>
+        HttpResponse.json({ message: 'Redeploy failed' }, { status: 500 })
+      )
+    );
+
+    const user = userEvent.setup();
+    renderComponent(onClose);
+
+    await user.click(screen.getByRole('checkbox', { name: /redeploy/i }));
+    await user.click(screen.getByRole('button', { name: /save settings/i }));
+
+    await waitFor(() => {
+      expect(notifyError).toHaveBeenCalledWith(
+        'Failure',
+        expect.any(Error),
+        'Stack settings saved but redeploy failed'
+      );
+      expect(onClose).toHaveBeenCalled();
+    });
+  });
+});
+
+function renderComponent(onClose = vi.fn()) {
+  server.use(
+    http.get('/api/gitops/sources', () =>
+      HttpResponse.json([
+        {
+          id: 1,
+          name: 'test-source',
+          type: 'git',
+          url: 'https://github.com/test/repo',
+          status: 'valid',
+          usedBy: 0,
+          environments: 0,
+          lastSync: 0,
+        },
+      ])
+    ),
+    http.post('/api/gitops/repo/refs', () => HttpResponse.json([])),
+    http.post('/api/gitops/repo/files/search', () => HttpResponse.json([]))
+  );
+
+  const Wrapped = withTestQueryProvider(
+    withTestRouter(withUserProvider(EditGitSettingsModal))
+  );
+
+  return render(<Wrapped stack={mockStack} onClose={onClose} />);
+}
diff --git a/app/react/common/stacks/EditGitSettings/EditGitSettingsModal.tsx b/app/react/common/stacks/EditGitSettings/EditGitSettingsModal.tsx
new file mode 100644
index 0000000..77c4534
--- /dev/null
+++ b/app/react/common/stacks/EditGitSettings/EditGitSettingsModal.tsx
@@ -0,0 +1,103 @@
+import { useState } from 'react';
+import { Formik } from 'formik';
+
+import { Stack, StackType } from '@/react/common/stacks/types';
+import { toGitFormModel } from '@/react/portainer/gitops/types';
+import { parseAutoUpdateResponse } from '@/react/portainer/gitops/AutoUpdateFieldset/utils';
+import { createWebhookId } from '@/portainer/helpers/webhookHelper';
+import { notifyError, notifySuccess } from '@/portainer/services/notifications';
+import { confirmStackUpdate } from '@/react/common/stacks/common/confirm-stack-update';
+
+import { useUpdateGitStack } from './useUpdateGitStack';
+import { FormValues } from './types';
+import { InnerForm } from './InnerForm';
+import { useValidationSchema } from './validation';
+
+interface Props {
+  onClose: () => void;
+  stack: Stack;
+}
+
+export function EditGitSettingsModal({ stack, onClose }: Props) {
+  const validationSchema = useValidationSchema(stack.Type);
+  const [webhookId] = useState(
+    () => stack.AutoUpdate?.Webhook || createWebhookId()
+  );
+
+  const mutation = useUpdateGitStack(stack);
+
+  const gitModel = toGitFormModel(
+    stack.GitSourceId,
+    {
+      ReferenceName: stack.GitConfig?.ReferenceName ?? '',
+      ConfigFilePath: stack.GitConfig?.ConfigFilePath ?? '',
+    },
+    parseAutoUpdateResponse(stack.AutoUpdate)
+  );
+
+  const initialValues: FormValues = {
+    kube: { name: stack.Name },
+    git: {
+      ...gitModel,
+      AdditionalFiles: stack.AdditionalFiles || [],
+      SourceId: stack.GitSourceId,
+    },
+    env: stack.Env || [],
+    prune: stack.Option?.Prune || false,
+    redeployNow: false,
+  };
+
+  return (
+    <Formik
+      initialValues={initialValues}
+      onSubmit={handleSubmit}
+      validationSchema={validationSchema}
+    >
+      <InnerForm
+        stackName={stack.Name}
+        stackType={stack.Type}
+        webhookId={webhookId}
+        onDismiss={onClose}
+        isSubmitting={mutation.isLoading}
+      />
+    </Formik>
+  );
+
+  async function handleSubmit(values: FormValues) {
+    let repullImageAndRedeploy: boolean | undefined;
+    if (values.redeployNow) {
+      const result = await confirmStackUpdate(
+        'Any changes to this stack or application made locally in Portainer will be overridden, which may cause service interruption. Do you wish to continue?',
+        stack.Type === StackType.DockerSwarm
+      );
+      if (!result) {
+        return;
+      }
+      repullImageAndRedeploy = result.repullImageAndRedeploy;
+    }
+
+    mutation.mutate(
+      {
+        values,
+        repullImageAndRedeploy,
+        webhookId,
+      },
+      {
+        onSuccess({ redeployAttempted, redeployFailed, redeployError }) {
+          if (redeployFailed) {
+            notifyError(
+              'Failure',
+              redeployError,
+              'Stack settings saved but redeploy failed'
+            );
+          } else if (redeployAttempted) {
+            notifySuccess('Success', 'Stack deployed successfully');
+          } else {
+            notifySuccess('Success', 'Stack settings saved successfully');
+          }
+          onClose();
+        },
+      }
+    );
+  }
+}
diff --git a/app/react/common/stacks/EditGitSettings/InnerForm.tsx b/app/react/common/stacks/EditGitSettings/InnerForm.tsx
new file mode 100644
index 0000000..9bd64a6
--- /dev/null
+++ b/app/react/common/stacks/EditGitSettings/InnerForm.tsx
@@ -0,0 +1,181 @@
+import { Settings } from 'lucide-react';
+import { Form, useFormikContext } from 'formik';
+
+import { StackType } from '@/react/common/stacks/types';
+import { baseStackWebhookUrl } from '@/portainer/helpers/webhookHelper';
+import { GitForm } from '@/react/portainer/gitops/GitForm';
+import { useIsStandalone } from '@/react/docker/proxy/queries/useInfo';
+import { useCurrentEnvironment } from '@/react/hooks/useCurrentEnvironment';
+import { getPlatformType } from '@/react/portainer/environments/utils';
+import { PlatformType } from '@/react/portainer/environments/types';
+import { StackName } from '@/react/kubernetes/DeployView/StackName/StackName';
+
+import { Modal } from '@@/modals/Modal';
+import { TextTip } from '@@/Tip/TextTip';
+import { Button, LoadingButton } from '@@/buttons';
+import { WidgetIcon } from '@@/Widget/WidgetIcon';
+import { Checkbox } from '@@/form-components/Checkbox';
+import { StackEnvironmentVariablesPanel } from '@@/form-components/EnvironmentVariablesFieldset';
+
+import { PruneField } from '../PruneField';
+
+import { FormValues } from './types';
+
+export function InnerForm({
+  stackName,
+  stackType,
+  onDismiss,
+  isSubmitting,
+  webhookId,
+}: {
+  stackName: string;
+  stackType: StackType;
+  onDismiss: () => void;
+  isSubmitting: boolean;
+  webhookId: string;
+}) {
+  const environmentQuery = useCurrentEnvironment();
+  const platform = environmentQuery.data
+    ? getPlatformType(environmentQuery.data.Type)
+    : null;
+  const isDocker = platform === PlatformType.Docker;
+  const isDockerStandalone = useIsStandalone(environmentQuery.data?.Id, {
+    enabled: isDocker,
+  });
+  const { values, setFieldValue, submitForm, errors } =
+    useFormikContext<FormValues>();
+
+  return (
+    <Form>
+      <Modal
+        onDismiss={onDismiss}
+        aria-label="edit-git-settings"
+        size="xl"
+        className="flex h-[80vh] flex-col px-0"
+      >
+        <Modal.Header
+          title={
+            <div className="inline-flex items-center gap-1 px-5">
+              <WidgetIcon icon={Settings} />
+              <h2 className="m-0 ml-1 text-base">
+                Edit Git settings — {stackName}
+              </h2>
+            </div>
+          }
+        />
+        <div className="flex-1 overflow-y-auto px-5">
+          <Modal.Body>
+            <div className="form-horizontal">
+              {stackType === StackType.Kubernetes && (
+                <>
+                  <StackName
+                    stackName={values.kube?.name ?? ''}
+                    setStackName={(value) => {
+                      setFieldValue('kube.name', value);
+                      if (value && value !== stackName) {
+                        setFieldValue('redeployNow', true);
+                      }
+                    }}
+                    error={errors.kube?.name}
+                  />
+                  <TextTip color="blue" className="mb-4">
+                    Changing the stack name requires a redeploy to update the
+                    deployed resources.
+                  </TextTip>
+                </>
+              )}
+
+              <GitForm
+                value={values.git}
+                onChange={(partial) => {
+                  Object.entries(partial).forEach(([key, val]) => {
+                    setFieldValue(`git.${key}`, val);
+                  });
+                }}
+                environmentType={getPlatformNameForGitForm()}
+                isForcePullVisible={stackType !== StackType.Kubernetes}
+                baseWebhookUrl={baseStackWebhookUrl()}
+                webhookId={webhookId}
+                webhooksDocs="/user/docker/stacks/webhooks"
+                isAdditionalFilesFieldVisible
+                isAutoUpdateVisible
+                errors={errors.git}
+                deployMethod={
+                  stackType === StackType.Kubernetes ? 'manifest' : 'compose'
+                }
+                isDockerStandalone={isDockerStandalone}
+              />
+
+              <StackEnvironmentVariablesPanel
+                values={values.env}
+                onChange={(value) => setFieldValue('env', value)}
+                showHelpMessage
+                isFoldable
+                errors={errors.env}
+              />
+
+              {isDocker && (
+                <PruneField
+                  stackType={stackType}
+                  checked={values.prune}
+                  onChange={(value) => setFieldValue('prune', value)}
+                />
+              )}
+            </div>
+          </Modal.Body>
+        </div>
+        <div className="border-0 border-t border-solid border-gray-5 px-5 th-highcontrast:border-white th-dark:border-gray-7">
+          <Modal.Footer>
+            <div className="flex flex-1 justify-between">
+              <Button
+                onClick={onDismiss}
+                color="secondary"
+                key="cancel-button"
+                size="medium"
+                data-cy="cancel-button"
+              >
+                Cancel
+              </Button>
+              <div className="flex items-center gap-4">
+                <span className="flex items-center">
+                  <Checkbox
+                    id="redeploy-checkbox"
+                    label="Redeploy"
+                    checked={values.redeployNow}
+                    onChange={(e) =>
+                      setFieldValue('redeployNow', e.target.checked)
+                    }
+                    data-cy="redeploy-now-checkbox"
+                  />
+                </span>
+                <LoadingButton
+                  color="primary"
+                  key="save-button"
+                  size="medium"
+                  onClick={submitForm}
+                  isLoading={isSubmitting}
+                  loadingText="Saving..."
+                  data-cy="save-git-settings-button"
+                >
+                  Save settings
+                </LoadingButton>
+              </div>
+            </div>
+          </Modal.Footer>
+        </div>
+      </Modal>
+    </Form>
+  );
+
+  function getPlatformNameForGitForm(): 'DOCKER' | 'KUBERNETES' | undefined {
+    if (platform === PlatformType.Docker) {
+      return 'DOCKER';
+    }
+
+    if (platform === PlatformType.Kubernetes) {
+      return 'KUBERNETES';
+    }
+
+    return undefined;
+  }
+}
diff --git a/app/react/common/stacks/EditGitSettings/types.ts b/app/react/common/stacks/EditGitSettings/types.ts
new file mode 100644
index 0000000..6275685
--- /dev/null
+++ b/app/react/common/stacks/EditGitSettings/types.ts
@@ -0,0 +1,11 @@
+import { GitFormModel } from '@/react/portainer/gitops/types';
+
+import { EnvVarValues } from '@@/form-components/EnvironmentVariablesFieldset';
+
+export interface FormValues {
+  kube: { name: string };
+  git: GitFormModel;
+  env: EnvVarValues;
+  prune: boolean;
+  redeployNow: boolean;
+}
diff --git a/app/react/common/stacks/EditGitSettings/useUpdateGitStack.ts b/app/react/common/stacks/EditGitSettings/useUpdateGitStack.ts
new file mode 100644
index 0000000..21d4572
--- /dev/null
+++ b/app/react/common/stacks/EditGitSettings/useUpdateGitStack.ts
@@ -0,0 +1,73 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { Stack } from '@/react/common/stacks/types';
+import { updateGitStack } from '@/react/portainer/gitops/queries/useUpdateGitStack';
+import { updateGitStackSettings } from '@/react/portainer/gitops/queries/useUpdateGitStackSettings';
+import { queryKeys } from '@/react/common/stacks/queries/query-keys';
+import { transformAutoUpdateViewModel } from '@/react/portainer/gitops/AutoUpdateFieldset/utils';
+import { withError } from '@/react-tools/react-query';
+
+import { FormValues } from './types';
+
+interface MutationArgs {
+  values: FormValues;
+  repullImageAndRedeploy?: boolean;
+  webhookId: string;
+}
+
+export function useUpdateGitStack(stack: Stack) {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: async ({
+      values,
+      repullImageAndRedeploy,
+      webhookId,
+    }: MutationArgs) => {
+      const autoUpdate = transformAutoUpdateViewModel(
+        values.git.AutoUpdate,
+        webhookId
+      );
+
+      await updateGitStackSettings(stack.Id, stack.EndpointId, {
+        ConfigFilePath: values.git.ComposeFilePathInRepository,
+        RepositoryReferenceName: values.git.RepositoryReferenceName,
+        AutoUpdate: autoUpdate,
+        AdditionalFiles: values.git.AdditionalFiles,
+        env: values.env,
+        prune: values.prune,
+        SourceID: values.git.SourceId,
+      });
+
+      if (repullImageAndRedeploy === undefined) {
+        return { redeployAttempted: false, redeployFailed: false };
+      }
+
+      try {
+        await updateGitStack(stack.Id, stack.EndpointId, {
+          Env: values.env,
+          Prune: values.prune,
+          StackName: values.kube.name.trim() || undefined,
+          RepullImageAndRedeploy: repullImageAndRedeploy,
+        });
+        return { redeployAttempted: true, redeployFailed: false };
+      } catch (error) {
+        return {
+          redeployAttempted: true,
+          redeployFailed: true,
+          redeployError: error,
+        };
+      }
+    },
+    onSuccess: () => {
+      queryClient.removeQueries({
+        queryKey: queryKeys.stackFile(stack.Id, {
+          commitHash: stack?.GitConfig?.ConfigHash,
+        }),
+      });
+      return queryClient.invalidateQueries({
+        queryKey: queryKeys.stack(stack.Id),
+      });
+    },
+    ...withError('Unable to save stack settings'),
+  });
+}
diff --git a/app/react/common/stacks/EditGitSettings/validation.ts b/app/react/common/stacks/EditGitSettings/validation.ts
new file mode 100644
index 0000000..7c26300
--- /dev/null
+++ b/app/react/common/stacks/EditGitSettings/validation.ts
@@ -0,0 +1,32 @@
+import { useMemo } from 'react';
+import { boolean, object, SchemaOf, string } from 'yup';
+
+import { StackType } from '@/react/common/stacks/types';
+import { buildGitValidationSchema } from '@/react/portainer/gitops/GitForm';
+
+import { envVarValidation } from '@@/form-components/EnvironmentVariablesFieldset';
+
+import { FormValues } from './types';
+
+export function useValidationSchema(
+  stackType: StackType
+): SchemaOf<FormValues> {
+  const isKubernetes = stackType === StackType.Kubernetes;
+
+  return useMemo(
+    () =>
+      object({
+        kube: isKubernetes
+          ? object({
+              name: string().default(''),
+            }).required()
+          : object({ name: string().default('') }).optional(),
+        git: buildGitValidationSchema(isKubernetes ? 'manifest' : 'compose'),
+
+        env: envVarValidation(),
+        prune: boolean().default(false),
+        redeployNow: boolean().default(false),
+      }),
+    [isKubernetes]
+  );
+}
diff --git a/app/react/common/stacks/EditGitSettingsButton.tsx b/app/react/common/stacks/EditGitSettingsButton.tsx
new file mode 100644
index 0000000..9ea6ddf
--- /dev/null
+++ b/app/react/common/stacks/EditGitSettingsButton.tsx
@@ -0,0 +1,34 @@
+import { useState } from 'react';
+import { PencilIcon } from 'lucide-react';
+import { useCurrentStateAndParams } from '@uirouter/react';
+
+import { Stack } from '@/react/common/stacks/types';
+import { Authorized } from '@/react/hooks/useUser';
+
+import { Button } from '@@/buttons';
+
+import { EditGitSettingsModal } from './EditGitSettings/EditGitSettingsModal';
+
+export function EditGitSettingsButton({ stack }: { stack: Stack }) {
+  const {
+    params: { openGitSettings },
+  } = useCurrentStateAndParams();
+  const [isOpen, setIsOpen] = useState(!!openGitSettings);
+
+  return (
+    <Authorized authorizations="PortainerStackUpdate">
+      <Button
+        size="small"
+        color="default"
+        onClick={() => setIsOpen(true)}
+        data-cy="edit-git-settings-button"
+        icon={PencilIcon}
+      >
+        Edit Git settings
+      </Button>
+      {isOpen && (
+        <EditGitSettingsModal stack={stack} onClose={() => setIsOpen(false)} />
+      )}
+    </Authorized>
+  );
+}
diff --git a/app/react/common/stacks/GitPullButton.tsx b/app/react/common/stacks/GitPullButton.tsx
new file mode 100644
index 0000000..28d6619
--- /dev/null
+++ b/app/react/common/stacks/GitPullButton.tsx
@@ -0,0 +1,66 @@
+import { capitalize } from 'lodash';
+import { GitMerge } from 'lucide-react';
+import { useRouter } from '@uirouter/react';
+
+import { Stack, StackType } from '@/react/common/stacks/types';
+import { Authorized } from '@/react/hooks/useUser';
+import { useUpdateGitStack } from '@/react/portainer/gitops/queries/useUpdateGitStack';
+import { notifyError, notifySuccess } from '@/portainer/services/notifications';
+import { confirmStackUpdate } from '@/react/common/stacks/common/confirm-stack-update';
+
+import { Button } from '@@/buttons';
+import { Icon } from '@@/Icon';
+
+export function GitPullButton({ stack }: { stack: Stack }) {
+  const router = useRouter();
+  const mutation = useUpdateGitStack(stack.Id, stack.EndpointId);
+
+  return (
+    <Authorized authorizations="PortainerStackUpdate">
+      <Button
+        type="button"
+        size="small"
+        color="light"
+        className="!ml-0"
+        disabled={mutation.isLoading}
+        onClick={handleClick}
+        data-cy="git-pull-button"
+      >
+        <Icon icon={GitMerge} className="mr-1" />
+        Pull and redeploy
+      </Button>
+    </Authorized>
+  );
+
+  async function handleClick() {
+    const stackLabel =
+      stack.Type === StackType.Kubernetes ? 'application' : 'stack';
+    const result = await confirmStackUpdate(
+      `Pulling from git will override any local changes to this ${stackLabel} and may cause a service interruption. Do you wish to continue?`,
+      false
+    );
+    if (!result) {
+      return;
+    }
+
+    mutation.mutate(
+      {
+        RepullImageAndRedeploy: result.repullImageAndRedeploy,
+        Env: stack.Env || [],
+        Prune: stack.Option?.Prune,
+      },
+      {
+        onSuccess: () => {
+          notifySuccess(
+            'Success',
+            `${capitalize(stackLabel)} successfully pulled and redeployed`
+          );
+          router.stateService.reload();
+        },
+        onError: (err) => {
+          notifyError('Failure', err, 'Unable to pull and redeploy');
+        },
+      }
+    );
+  }
+}
diff --git a/app/react/common/stacks/ListView/.keep b/app/react/common/stacks/ListView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/common/stacks/PruneField.tsx b/app/react/common/stacks/PruneField.tsx
new file mode 100644
index 0000000..16a5661
--- /dev/null
+++ b/app/react/common/stacks/PruneField.tsx
@@ -0,0 +1,43 @@
+import { StackType } from '@/react/common/stacks/types';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useApiVersion } from '@/react/docker/proxy/queries/useVersion';
+
+import { SwitchField } from '@@/form-components/SwitchField';
+import { FormSection } from '@@/form-components/FormSection';
+
+interface Props {
+  stackType: StackType | undefined;
+  checked: boolean;
+  onChange: (value: boolean) => void;
+}
+
+export function PruneField({ stackType, checked, onChange }: Props) {
+  const envId = useEnvironmentId();
+  const apiVersion = useApiVersion(envId);
+
+  if (
+    (stackType !== StackType.DockerSwarm &&
+      stackType !== StackType.DockerCompose) ||
+    apiVersion < 1.27
+  ) {
+    return null;
+  }
+
+  return (
+    <FormSection title="Options">
+      <div className="form-group">
+        <div className="col-sm-12">
+          <SwitchField
+            name="prune"
+            checked={checked}
+            tooltip="Prune services that are no longer referenced."
+            labelClass="col-sm-3 col-lg-2"
+            label="Prune services"
+            onChange={onChange}
+            data-cy="stack-prune-services-switch"
+          />
+        </div>
+      </div>
+    </FormSection>
+  );
+}
diff --git a/app/react/common/stacks/common/confirm-stack-update.ts b/app/react/common/stacks/common/confirm-stack-update.ts
new file mode 100644
index 0000000..5d67a67
--- /dev/null
+++ b/app/react/common/stacks/common/confirm-stack-update.ts
@@ -0,0 +1,22 @@
+import { openSwitchPrompt } from '@@/modals/SwitchPrompt';
+import { ModalType } from '@@/modals';
+import { buildConfirmButton } from '@@/modals/utils';
+
+export async function confirmStackUpdate(
+  message: string,
+  defaultValue: boolean
+) {
+  const result = await openSwitchPrompt(
+    'Are you sure?',
+    'Re-pull image and redeploy',
+    {
+      message,
+      confirmButton: buildConfirmButton('Update'),
+      modalType: ModalType.Warn,
+      defaultValue,
+      'data-cy': 'confirm-stack-update',
+    }
+  );
+
+  return result ? { repullImageAndRedeploy: result.value } : undefined;
+}
diff --git a/app/react/common/stacks/common/form-texts.tsx b/app/react/common/stacks/common/form-texts.tsx
new file mode 100644
index 0000000..3ccf829
--- /dev/null
+++ b/app/react/common/stacks/common/form-texts.tsx
@@ -0,0 +1,51 @@
+import { StackType } from '../types';
+
+const dockerTexts = {
+  editor: {
+    placeholder: 'Define or paste the content of your docker compose file here',
+    description: (
+      <p>
+        You can get more information about Compose file format in the{' '}
+        <a
+          href="https://docs.docker.com/compose/compose-file/"
+          target="_blank"
+          rel="noreferrer"
+        >
+          official documentation
+        </a>
+        .
+      </p>
+    ),
+  },
+  upload: 'You can upload a Compose file from your computer.',
+} as const;
+
+export const textByType = {
+  [StackType.DockerCompose]: dockerTexts,
+  [StackType.DockerSwarm]: dockerTexts,
+  [StackType.Kubernetes]: {
+    editor: {
+      placeholder: 'Define or paste the content of your manifest file here',
+      description: (
+        <>
+          <p>
+            Templates allow deploying any kind of Kubernetes resource
+            (Deployment, Secret, ConfigMap...)
+          </p>
+          <p>
+            You can get more information about Kubernetes file format in the{' '}
+            <a
+              href="https://kubernetes.io/docs/concepts/overview/working-with-objects/kubernetes-objects/"
+              target="_blank"
+              rel="noreferrer"
+            >
+              official documentation
+            </a>
+            .
+          </p>
+        </>
+      ),
+    },
+    upload: 'You can upload a Manifest file from your computer.',
+  },
+} as const;
diff --git a/app/react/common/stacks/queries/buildUrl.ts b/app/react/common/stacks/queries/buildUrl.ts
new file mode 100644
index 0000000..b56a3b9
--- /dev/null
+++ b/app/react/common/stacks/queries/buildUrl.ts
@@ -0,0 +1,7 @@
+import { Stack } from '../types';
+
+export function buildStackUrl(id?: Stack['Id'], action?: string) {
+  const baseUrl = '/stacks';
+  const url = id ? `${baseUrl}/${id}` : baseUrl;
+  return action ? `${url}/${action}` : url;
+}
diff --git a/app/react/common/stacks/queries/query-keys.ts b/app/react/common/stacks/queries/query-keys.ts
new file mode 100644
index 0000000..4ccdd66
--- /dev/null
+++ b/app/react/common/stacks/queries/query-keys.ts
@@ -0,0 +1,8 @@
+import { StackId } from '../types';
+
+export const queryKeys = {
+  base: () => ['stacks'] as const,
+  stack: (stackId?: StackId) => [...queryKeys.base(), stackId] as const,
+  stackFile: (stackId?: StackId, params?: unknown) =>
+    [...queryKeys.stack(stackId), 'file', params] as const,
+};
diff --git a/app/react/common/stacks/queries/useCreateStack/buildUrl.ts b/app/react/common/stacks/queries/useCreateStack/buildUrl.ts
new file mode 100644
index 0000000..5c7da25
--- /dev/null
+++ b/app/react/common/stacks/queries/useCreateStack/buildUrl.ts
@@ -0,0 +1,14 @@
+import { buildStackUrl } from '../buildUrl';
+
+export function buildCreateUrl(
+  stackType: 'kubernetes',
+  method: 'repository' | 'url' | 'string'
+): string;
+
+export function buildCreateUrl(
+  stackType: 'swarm' | 'standalone',
+  method: 'repository' | 'string' | 'file'
+): string;
+export function buildCreateUrl(stackType: string, method: string) {
+  return buildStackUrl(undefined, `create/${stackType}/${method}`);
+}
diff --git a/app/react/common/stacks/queries/useCreateStack/createKubernetesStackFromFileContent.ts b/app/react/common/stacks/queries/useCreateStack/createKubernetesStackFromFileContent.ts
new file mode 100644
index 0000000..d9b31bd
--- /dev/null
+++ b/app/react/common/stacks/queries/useCreateStack/createKubernetesStackFromFileContent.ts
@@ -0,0 +1,36 @@
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { Stack } from '../../types';
+
+import { buildCreateUrl } from './buildUrl';
+
+export interface KubernetesFileContentPayload {
+  /** Name of the stack */
+  stackName: string;
+  /** Content of the Stack file */
+  stackFileContent: string;
+  composeFormat: boolean;
+  namespace: string;
+  /** Whether the stack is from an app template */
+  fromAppTemplate?: boolean;
+  environmentId: EnvironmentId;
+}
+
+export async function createKubernetesStackFromFileContent({
+  environmentId,
+  ...payload
+}: KubernetesFileContentPayload) {
+  try {
+    const { data } = await axios.post<Stack>(
+      buildCreateUrl('kubernetes', 'string'),
+      payload,
+      {
+        params: { endpointId: environmentId },
+      }
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e as Error);
+  }
+}
diff --git a/app/react/common/stacks/queries/useCreateStack/createKubernetesStackFromGit.ts b/app/react/common/stacks/queries/useCreateStack/createKubernetesStackFromGit.ts
new file mode 100644
index 0000000..46f1287
--- /dev/null
+++ b/app/react/common/stacks/queries/useCreateStack/createKubernetesStackFromGit.ts
@@ -0,0 +1,47 @@
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { AutoUpdateResponse } from '@/react/portainer/gitops/types';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { Stack } from '../../types';
+
+import { buildCreateUrl } from './buildUrl';
+
+export type KubernetesGitRepositoryPayload = {
+  /** Name of the stack */
+  stackName: string;
+  composeFormat: boolean;
+  namespace: string;
+
+  /** When set, URL and auth are resolved from the stored Source record */
+  sourceId?: number;
+
+  /** Reference name of a Git repository hosting the Stack file */
+  repositoryReferenceName?: string;
+
+  /** Path to the Stack file inside the Git repository */
+  manifestFile?: string;
+
+  additionalFiles?: Array<string>;
+
+  /** Optional GitOps update configuration */
+  autoUpdate?: AutoUpdateResponse | null;
+  environmentId: EnvironmentId;
+};
+
+export async function createKubernetesStackFromGit({
+  environmentId,
+  ...payload
+}: KubernetesGitRepositoryPayload) {
+  try {
+    const { data } = await axios.post<Stack>(
+      buildCreateUrl('kubernetes', 'repository'),
+      payload,
+      {
+        params: { endpointId: environmentId },
+      }
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e as Error);
+  }
+}
diff --git a/app/react/common/stacks/queries/useCreateStack/createKubernetesStackFromUrl.ts b/app/react/common/stacks/queries/useCreateStack/createKubernetesStackFromUrl.ts
new file mode 100644
index 0000000..46c03f3
--- /dev/null
+++ b/app/react/common/stacks/queries/useCreateStack/createKubernetesStackFromUrl.ts
@@ -0,0 +1,32 @@
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { Stack } from '../../types';
+
+import { buildCreateUrl } from './buildUrl';
+
+export interface KubernetesUrlPayload {
+  stackName: string;
+  composeFormat: boolean;
+  namespace: string;
+  manifestURL: string;
+  environmentId: EnvironmentId;
+}
+
+export async function createKubernetesStackFromUrl({
+  environmentId,
+  ...payload
+}: KubernetesUrlPayload) {
+  try {
+    const { data } = await axios.post<Stack>(
+      buildCreateUrl('kubernetes', 'url'),
+      payload,
+      {
+        params: { endpointId: environmentId },
+      }
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e as Error);
+  }
+}
diff --git a/app/react/common/stacks/queries/useCreateStack/createStandaloneStackFromFile.ts b/app/react/common/stacks/queries/useCreateStack/createStandaloneStackFromFile.ts
new file mode 100644
index 0000000..0b96e0a
--- /dev/null
+++ b/app/react/common/stacks/queries/useCreateStack/createStandaloneStackFromFile.ts
@@ -0,0 +1,44 @@
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { Pair } from '@/react/portainer/settings/types';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { RegistryId } from '@/react/portainer/registries/types/registry';
+import { json2formData } from '@/portainer/helpers/json';
+
+import { Stack } from '../../types';
+
+import { buildCreateUrl } from './buildUrl';
+
+export type StandaloneFileUploadPayload = {
+  /** Name of the stack */
+  Name: string;
+
+  file: File;
+  /** List of environment variables */
+  Env?: Array<Pair>;
+
+  /** A UUID to identify a webhook. The stack will be force updated and pull the latest image when the webhook was invoked. */
+  Webhook?: string;
+  environmentId: EnvironmentId;
+  Registries?: Array<RegistryId>;
+};
+
+export async function createStandaloneStackFromFile({
+  environmentId,
+  ...payload
+}: StandaloneFileUploadPayload) {
+  try {
+    const { data } = await axios.post<Stack>(
+      buildCreateUrl('standalone', 'file'),
+      json2formData(payload),
+      {
+        headers: {
+          'Content-Type': 'multipart/form-data',
+        },
+        params: { endpointId: environmentId },
+      }
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e as Error);
+  }
+}
diff --git a/app/react/common/stacks/queries/useCreateStack/createStandaloneStackFromFileContent.ts b/app/react/common/stacks/queries/useCreateStack/createStandaloneStackFromFileContent.ts
new file mode 100644
index 0000000..3b4d3ea
--- /dev/null
+++ b/app/react/common/stacks/queries/useCreateStack/createStandaloneStackFromFileContent.ts
@@ -0,0 +1,42 @@
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { Pair } from '@/react/portainer/settings/types';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { RegistryId } from '@/react/portainer/registries/types/registry';
+
+import { Stack } from '../../types';
+
+import { buildCreateUrl } from './buildUrl';
+
+export interface StandaloneFileContentPayload {
+  /** Name of the stack */
+  name: string;
+
+  stackFileContent: string;
+  /** List of environment variables */
+  env?: Array<Pair> | null;
+
+  /** Whether the stack is from an app template */
+  fromAppTemplate?: boolean;
+  /** A UUID to identify a webhook. The stack will be force updated and pull the latest image when the webhook was invoked. */
+  webhook?: string;
+  environmentId: EnvironmentId;
+  registries?: Array<RegistryId>;
+}
+
+export async function createStandaloneStackFromFileContent({
+  environmentId,
+  ...payload
+}: StandaloneFileContentPayload) {
+  try {
+    const { data } = await axios.post<Stack>(
+      buildCreateUrl('standalone', 'string'),
+      payload,
+      {
+        params: { endpointId: environmentId },
+      }
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e as Error);
+  }
+}
diff --git a/app/react/common/stacks/queries/useCreateStack/createStandaloneStackFromGit.ts b/app/react/common/stacks/queries/useCreateStack/createStandaloneStackFromGit.ts
new file mode 100644
index 0000000..76957d1
--- /dev/null
+++ b/app/react/common/stacks/queries/useCreateStack/createStandaloneStackFromGit.ts
@@ -0,0 +1,59 @@
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { Pair } from '@/react/portainer/settings/types';
+import { AutoUpdateResponse } from '@/react/portainer/gitops/types';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { RegistryId } from '@/react/portainer/registries/types/registry';
+
+import { Stack } from '../../types';
+
+import { buildCreateUrl } from './buildUrl';
+
+export type StandaloneGitRepositoryPayload = {
+  /** Name of the stack */
+  name: string;
+  /** List of environment variables */
+  env?: Array<Pair>;
+  /** Whether the stack is from an app template */
+  fromAppTemplate?: boolean;
+
+  /** URL of a Git repository hosting the Stack file (used for app templates) */
+  repositoryUrl?: string;
+  /** Reference name of a Git repository hosting the Stack file */
+  repositoryReferenceName?: string;
+
+  /** Path to the Stack file inside the Git repository */
+  composeFile?: string;
+
+  additionalFiles?: Array<string>;
+
+  /** Optional GitOps update configuration */
+  autoUpdate?: AutoUpdateResponse | null;
+
+  /** Whether the stack supports relative path volume */
+  supportRelativePath?: boolean;
+  /** Local filesystem path */
+  filesystemPath?: string;
+
+  /** ID of an existing Source. When set, repositoryUrl and authentication fields are ignored. */
+  sourceId?: number;
+  environmentId: EnvironmentId;
+  registries?: Array<RegistryId>;
+};
+
+export async function createStandaloneStackFromGit({
+  environmentId,
+  ...payload
+}: StandaloneGitRepositoryPayload) {
+  try {
+    const { data } = await axios.post<Stack>(
+      buildCreateUrl('standalone', 'repository'),
+      payload,
+      {
+        params: { endpointId: environmentId },
+      }
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e as Error);
+  }
+}
diff --git a/app/react/common/stacks/queries/useCreateStack/createSwarmStackFromFile.ts b/app/react/common/stacks/queries/useCreateStack/createSwarmStackFromFile.ts
new file mode 100644
index 0000000..87cc0ed
--- /dev/null
+++ b/app/react/common/stacks/queries/useCreateStack/createSwarmStackFromFile.ts
@@ -0,0 +1,51 @@
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { Pair } from '@/react/portainer/settings/types';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { RegistryId } from '@/react/portainer/registries/types/registry';
+import { json2formData } from '@/portainer/helpers/json';
+
+import { Stack } from '../../types';
+
+import { buildCreateUrl } from './buildUrl';
+
+export type SwarmFileUploadPayload = {
+  /** Name of the stack */
+  Name: string;
+
+  /** List of environment variables */
+  Env?: Array<Pair>;
+
+  /** A UUID to identify a webhook. The stack will be force updated and pull the latest image when the webhook was invoked. */
+  Webhook?: string;
+
+  /** Swarm cluster identifier */
+  SwarmID: string;
+
+  file: File;
+  environmentId: EnvironmentId;
+
+  Registries?: Array<RegistryId>;
+};
+
+export async function createSwarmStackFromFile({
+  environmentId,
+  ...payload
+}: SwarmFileUploadPayload) {
+  try {
+    const { data } = await axios.post<Stack>(
+      buildCreateUrl('swarm', 'file'),
+      json2formData(payload),
+      {
+        headers: {
+          'Content-Type': 'multipart/form-data',
+        },
+        params: {
+          endpointId: environmentId,
+        },
+      }
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e as Error);
+  }
+}
diff --git a/app/react/common/stacks/queries/useCreateStack/createSwarmStackFromFileContent.ts b/app/react/common/stacks/queries/useCreateStack/createSwarmStackFromFileContent.ts
new file mode 100644
index 0000000..996fb4f
--- /dev/null
+++ b/app/react/common/stacks/queries/useCreateStack/createSwarmStackFromFileContent.ts
@@ -0,0 +1,45 @@
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { Pair } from '@/react/portainer/settings/types';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { RegistryId } from '@/react/portainer/registries/types/registry';
+
+import { Stack } from '../../types';
+
+import { buildCreateUrl } from './buildUrl';
+
+export interface SwarmFileContentPayload {
+  /** Name of the stack */
+  name: string;
+
+  stackFileContent: string;
+  /** List of environment variables */
+  env?: Array<Pair> | null;
+
+  /** Whether the stack is from an app template */
+  fromAppTemplate?: boolean;
+  /** A UUID to identify a webhook. The stack will be force updated and pull the latest image when the webhook was invoked. */
+  webhook?: string;
+
+  /** Swarm cluster identifier */
+  swarmID: string;
+  environmentId: EnvironmentId;
+  registries?: Array<RegistryId>;
+}
+
+export async function createSwarmStackFromFileContent({
+  environmentId,
+  ...payload
+}: SwarmFileContentPayload) {
+  try {
+    const { data } = await axios.post<Stack>(
+      buildCreateUrl('swarm', 'string'),
+      payload,
+      {
+        params: { endpointId: environmentId },
+      }
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e as Error);
+  }
+}
diff --git a/app/react/common/stacks/queries/useCreateStack/createSwarmStackFromGit.ts b/app/react/common/stacks/queries/useCreateStack/createSwarmStackFromGit.ts
new file mode 100644
index 0000000..f4ca507
--- /dev/null
+++ b/app/react/common/stacks/queries/useCreateStack/createSwarmStackFromGit.ts
@@ -0,0 +1,61 @@
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { Pair } from '@/react/portainer/settings/types';
+import { AutoUpdateResponse } from '@/react/portainer/gitops/types';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { RegistryId } from '@/react/portainer/registries/types/registry';
+
+import { Stack } from '../../types';
+
+import { buildCreateUrl } from './buildUrl';
+
+export type SwarmGitRepositoryPayload = {
+  /** Name of the stack */
+  name: string;
+  /** List of environment variables */
+  env?: Array<Pair>;
+  /** Whether the stack is from an app template */
+  fromAppTemplate?: boolean;
+  /** Swarm cluster identifier */
+  swarmID: string;
+
+  /** URL of a Git repository hosting the Stack file (used for app templates) */
+  repositoryUrl?: string;
+  /** Reference name of a Git repository hosting the Stack file */
+  repositoryReferenceName?: string;
+
+  /** Path to the Stack file inside the Git repository */
+  composeFile?: string;
+
+  additionalFiles?: Array<string>;
+
+  /** Optional GitOps update configuration */
+  autoUpdate?: AutoUpdateResponse | null;
+
+  /** Whether the stack supports relative path volume */
+  supportRelativePath?: boolean;
+  /** Local filesystem path */
+  filesystemPath?: string;
+
+  /** ID of an existing Source. When set, repositoryUrl and authentication fields are ignored. */
+  sourceId?: number;
+  environmentId: EnvironmentId;
+  registries?: Array<RegistryId>;
+};
+
+export async function createSwarmStackFromGit({
+  environmentId,
+  ...payload
+}: SwarmGitRepositoryPayload) {
+  try {
+    const { data } = await axios.post<Stack>(
+      buildCreateUrl('swarm', 'repository'),
+      payload,
+      {
+        params: { endpointId: environmentId },
+      }
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e as Error);
+  }
+}
diff --git a/app/react/common/stacks/queries/useCreateStack/useCreateStack.ts b/app/react/common/stacks/queries/useCreateStack/useCreateStack.ts
new file mode 100644
index 0000000..09ef627
--- /dev/null
+++ b/app/react/common/stacks/queries/useCreateStack/useCreateStack.ts
@@ -0,0 +1,312 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { Pair } from '@/react/portainer/settings/types';
+import {
+  GitFormModel,
+  RelativePathModel,
+} from '@/react/portainer/gitops/types';
+import { applyResourceControl } from '@/react/portainer/access-control/access-control.service';
+import { AccessControlFormData } from '@/react/portainer/access-control/types';
+import PortainerError from '@/portainer/error';
+import { withError, withInvalidate } from '@/react-tools/react-query';
+import { transformAutoUpdateViewModel } from '@/react/portainer/gitops/AutoUpdateFieldset/utils';
+import { RegistryId } from '@/react/portainer/registries/types/registry';
+
+import { queryKeys } from '../query-keys';
+
+import { createSwarmStackFromFile } from './createSwarmStackFromFile';
+import { createSwarmStackFromGit } from './createSwarmStackFromGit';
+import { createSwarmStackFromFileContent } from './createSwarmStackFromFileContent';
+import { createStandaloneStackFromFile } from './createStandaloneStackFromFile';
+import { createStandaloneStackFromGit } from './createStandaloneStackFromGit';
+import { createStandaloneStackFromFileContent } from './createStandaloneStackFromFileContent';
+import { createKubernetesStackFromUrl } from './createKubernetesStackFromUrl';
+import { createKubernetesStackFromGit } from './createKubernetesStackFromGit';
+import { createKubernetesStackFromFileContent } from './createKubernetesStackFromFileContent';
+
+export function useCreateStack() {
+  const queryClient = useQueryClient();
+  return useMutation(createStack, {
+    ...withError('Failed to create stack'),
+    ...withInvalidate(queryClient, [queryKeys.base()]),
+  });
+}
+
+type BasePayload = {
+  name: string;
+  environmentId: EnvironmentId;
+  registries?: Array<RegistryId>;
+};
+
+type DockerBasePayload = BasePayload & {
+  env?: Array<Pair>;
+  accessControl: AccessControlFormData;
+};
+
+type SwarmBasePayload = DockerBasePayload & {
+  swarmId: string;
+};
+
+type KubernetesBasePayload = BasePayload & {
+  namespace: string;
+  composeFormat: boolean;
+};
+
+export type SwarmCreatePayload =
+  | {
+      method: 'file';
+      payload: SwarmBasePayload & {
+        /** File to upload */
+        file: File;
+        /** Optional webhook configuration */
+        webhook?: string;
+      };
+    }
+  | {
+      method: 'string';
+      payload: SwarmBasePayload & {
+        /** Content of the Stack file */
+        fileContent: string;
+        /** Optional webhook configuration */
+        webhook?: string;
+        fromAppTemplate?: boolean;
+      };
+    }
+  | {
+      method: 'git';
+      payload: SwarmBasePayload & {
+        git: GitFormModel;
+        relativePathSettings?: RelativePathModel;
+        fromAppTemplate?: boolean;
+        webhook?: string;
+      };
+    };
+
+type StandaloneCreatePayload =
+  | {
+      method: 'file';
+      payload: DockerBasePayload & {
+        /** File to upload */
+        file: File;
+        /** Optional webhook configuration */
+        webhook?: string;
+      };
+    }
+  | {
+      method: 'string';
+      payload: DockerBasePayload & {
+        /** Content of the Stack file */
+        fileContent: string;
+        /** Optional webhook configuration */
+        webhook?: string;
+        fromAppTemplate?: boolean;
+      };
+    }
+  | {
+      method: 'git';
+      payload: DockerBasePayload & {
+        git: GitFormModel;
+        relativePathSettings?: RelativePathModel;
+        fromAppTemplate?: boolean;
+        webhook?: string;
+      };
+    };
+
+type KubernetesCreatePayload =
+  | {
+      method: 'string';
+      payload: KubernetesBasePayload & {
+        /** Content of the Stack file */
+        fileContent: string;
+        /** Optional webhook configuration */
+        webhook?: string;
+      };
+    }
+  | {
+      method: 'git';
+      payload: KubernetesBasePayload & {
+        git: GitFormModel;
+        relativePathSettings?: RelativePathModel;
+        webhook?: string;
+      };
+    }
+  | {
+      method: 'url';
+      payload: KubernetesBasePayload & {
+        manifestUrl: string;
+      };
+    };
+
+export type CreateStackPayload =
+  | ({ type: 'swarm' } & SwarmCreatePayload)
+  | ({ type: 'standalone' } & StandaloneCreatePayload)
+  | ({ type: 'kubernetes' } & KubernetesCreatePayload);
+
+async function createStack(payload: CreateStackPayload) {
+  const stack = await createActualStack(payload);
+
+  if (payload.type === 'standalone' || payload.type === 'swarm') {
+    const resourceControl = stack.ResourceControl;
+
+    // Portainer will always return a resource control, but since types mark it as optional, we need to check it.
+    // Ignoring the missing value will result with bugs, hence it's better to throw an error
+    if (!resourceControl) {
+      throw new PortainerError('resource control expected after creation');
+    }
+
+    await applyResourceControl(
+      payload.payload.accessControl,
+      resourceControl.Id
+    );
+  }
+
+  return stack;
+}
+
+function createActualStack(payload: CreateStackPayload) {
+  switch (payload.type) {
+    case 'swarm':
+      return createSwarmStack(payload);
+    case 'standalone':
+      return createStandaloneStack(payload);
+    case 'kubernetes':
+      return createKubernetesStack(payload);
+    default:
+      throw new Error('Invalid type');
+  }
+}
+
+function createSwarmStack({ method, payload }: SwarmCreatePayload) {
+  switch (method) {
+    case 'file':
+      return createSwarmStackFromFile({
+        environmentId: payload.environmentId,
+        file: payload.file,
+        Name: payload.name,
+        SwarmID: payload.swarmId,
+        Env: payload.env,
+        Webhook: payload.webhook,
+        Registries: payload.registries,
+      });
+    case 'git':
+      return createSwarmStackFromGit({
+        name: payload.name,
+        env: payload.env,
+        repositoryUrl: payload.git.RepositoryURL,
+        repositoryReferenceName: payload.git.RepositoryReferenceName,
+        composeFile: payload.git.ComposeFilePathInRepository,
+        filesystemPath: payload.relativePathSettings?.FilesystemPath,
+        supportRelativePath: payload.relativePathSettings?.SupportRelativePath,
+        sourceId: payload.git.SourceId,
+        autoUpdate: transformAutoUpdateViewModel(
+          payload.git.AutoUpdate,
+          payload.webhook
+        ),
+        environmentId: payload.environmentId,
+        swarmID: payload.swarmId,
+        additionalFiles: payload.git.AdditionalFiles,
+        fromAppTemplate: payload.fromAppTemplate,
+        registries: payload.registries,
+      });
+    case 'string':
+      return createSwarmStackFromFileContent({
+        name: payload.name,
+        env: payload.env,
+        environmentId: payload.environmentId,
+        stackFileContent: payload.fileContent,
+        webhook: payload.webhook,
+        swarmID: payload.swarmId,
+        fromAppTemplate: payload.fromAppTemplate,
+        registries: payload.registries,
+      });
+    default:
+      throw new Error('Invalid method');
+  }
+}
+
+function createStandaloneStack({ method, payload }: StandaloneCreatePayload) {
+  switch (method) {
+    case 'file':
+      return createStandaloneStackFromFile({
+        environmentId: payload.environmentId,
+        file: payload.file,
+        Name: payload.name,
+        Env: payload.env,
+        Webhook: payload.webhook,
+        Registries: payload.registries,
+      });
+    case 'git':
+      return createStandaloneStackFromGit({
+        name: payload.name,
+        env: payload.env,
+        repositoryUrl: payload.git.RepositoryURL,
+        repositoryReferenceName: payload.git.RepositoryReferenceName,
+        composeFile: payload.git.ComposeFilePathInRepository,
+        filesystemPath: payload.relativePathSettings?.FilesystemPath,
+        supportRelativePath: payload.relativePathSettings?.SupportRelativePath,
+        sourceId: payload.git.SourceId,
+        autoUpdate: transformAutoUpdateViewModel(
+          payload.git.AutoUpdate,
+          payload.webhook
+        ),
+        environmentId: payload.environmentId,
+        additionalFiles: payload.git.AdditionalFiles,
+        fromAppTemplate: payload.fromAppTemplate,
+        registries: payload.registries,
+      });
+    case 'string':
+      return createStandaloneStackFromFileContent({
+        name: payload.name,
+        env: payload.env,
+        environmentId: payload.environmentId,
+        stackFileContent: payload.fileContent,
+        webhook: payload.webhook,
+        fromAppTemplate: payload.fromAppTemplate,
+        registries: payload.registries,
+      });
+    default:
+      throw new Error('Invalid method');
+  }
+}
+
+function createKubernetesStack({ method, payload }: KubernetesCreatePayload) {
+  switch (method) {
+    case 'string':
+      return createKubernetesStackFromFileContent({
+        stackName: payload.name,
+
+        environmentId: payload.environmentId,
+        stackFileContent: payload.fileContent,
+        composeFormat: payload.composeFormat,
+        namespace: payload.namespace,
+      });
+    case 'git':
+      return createKubernetesStackFromGit({
+        stackName: payload.name,
+
+        sourceId: payload.git.SourceId,
+        repositoryReferenceName: payload.git.RepositoryReferenceName,
+        manifestFile: payload.git.ComposeFilePathInRepository,
+
+        autoUpdate: transformAutoUpdateViewModel(
+          payload.git.AutoUpdate,
+          payload.webhook
+        ),
+        environmentId: payload.environmentId,
+        additionalFiles: payload.git.AdditionalFiles,
+        composeFormat: payload.composeFormat,
+        namespace: payload.namespace,
+      });
+    case 'url':
+      return createKubernetesStackFromUrl({
+        stackName: payload.name,
+        composeFormat: payload.composeFormat,
+        environmentId: payload.environmentId,
+        manifestURL: payload.manifestUrl,
+        namespace: payload.namespace,
+      });
+    default:
+      throw new Error('Invalid method');
+  }
+}
diff --git a/app/react/common/stacks/queries/useDeleteStackByNameMutation.ts b/app/react/common/stacks/queries/useDeleteStackByNameMutation.ts
new file mode 100644
index 0000000..7957049
--- /dev/null
+++ b/app/react/common/stacks/queries/useDeleteStackByNameMutation.ts
@@ -0,0 +1,50 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+
+import { StackId } from '../types';
+
+import { queryKeys } from './query-keys';
+
+interface DeleteStackParams {
+  stackId: StackId;
+  stackName: string;
+  environmentId: EnvironmentId;
+  namespace: string;
+}
+
+export function useDeleteStackByNameMutation() {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: deleteStackByName,
+    onSuccess: (_, variables) => {
+      // Invalidate the specific stack query
+      queryClient.invalidateQueries(queryKeys.stack(variables.stackId));
+      // Invalidate all stacks queries
+      queryClient.invalidateQueries(queryKeys.base());
+    },
+    ...withError('Unable to delete stack'),
+  });
+}
+
+async function deleteStackByName({
+  environmentId,
+  namespace,
+  stackName,
+}: DeleteStackParams) {
+  try {
+    await axios.delete(`/stacks/name/${stackName}`, {
+      params: {
+        external: false,
+        name: stackName,
+        endpointId: environmentId,
+        namespace,
+      },
+    });
+  } catch (error) {
+    throw parseAxiosError(error, 'Unable to delete stack');
+  }
+}
diff --git a/app/react/common/stacks/queries/useDeleteStackMutation.ts b/app/react/common/stacks/queries/useDeleteStackMutation.ts
new file mode 100644
index 0000000..56146fc
--- /dev/null
+++ b/app/react/common/stacks/queries/useDeleteStackMutation.ts
@@ -0,0 +1,55 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+
+import { StackId } from '../types';
+
+import { queryKeys } from './query-keys';
+
+interface DeleteStackParams {
+  id?: StackId;
+  name?: string;
+  external: boolean;
+  environmentId: EnvironmentId;
+}
+
+export function useDeleteStackMutation() {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: deleteStack,
+    onSuccess: (_, variables) => {
+      // Remove the deleted stack's query data to prevent refetch attempts
+      if (variables.id) {
+        queryClient.removeQueries(queryKeys.stack(variables.id));
+        queryClient.removeQueries(queryKeys.stackFile(variables.id));
+      }
+
+      queryClient.invalidateQueries({
+        queryKey: queryKeys.base(),
+        // exact: true,
+      });
+    },
+    ...withError('Unable to delete stack'),
+  });
+}
+
+async function deleteStack({
+  id,
+  name,
+  external,
+  environmentId,
+}: DeleteStackParams) {
+  try {
+    await axios.delete(`/stacks/${id || name}`, {
+      params: {
+        external,
+        endpointId: environmentId,
+      },
+    });
+  } catch (error) {
+    throw parseAxiosError(error, 'Unable to delete stack');
+  }
+}
diff --git a/app/react/common/stacks/queries/useStack.ts b/app/react/common/stacks/queries/useStack.ts
new file mode 100644
index 0000000..bc261b7
--- /dev/null
+++ b/app/react/common/stacks/queries/useStack.ts
@@ -0,0 +1,34 @@
+import { useQuery, UseQueryOptions } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+
+import { Stack, StackId } from '../types';
+
+import { queryKeys } from './query-keys';
+import { buildStackUrl } from './buildUrl';
+
+export function useStack<T = Stack>(
+  stackId?: StackId,
+  queryOptions?: UseQueryOptions<Stack, unknown, T>
+) {
+  return useQuery({
+    queryKey: queryKeys.stack(stackId),
+    queryFn: () => getStack(stackId),
+    enabled: !!stackId,
+    ...withError('Unable to retrieve stack'),
+    ...queryOptions,
+  });
+}
+
+async function getStack(stackId?: StackId) {
+  if (!stackId) {
+    throw new Error('Stack ID is required');
+  }
+  try {
+    const { data } = await axios.get<Stack>(buildStackUrl(stackId));
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to retrieve stack');
+  }
+}
diff --git a/app/react/common/stacks/queries/useStackFile.ts b/app/react/common/stacks/queries/useStackFile.ts
new file mode 100644
index 0000000..901a0cb
--- /dev/null
+++ b/app/react/common/stacks/queries/useStackFile.ts
@@ -0,0 +1,50 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+
+import { StackFile, StackId } from '../types';
+
+import { queryKeys } from './query-keys';
+
+export function useStackFile(
+  stackId?: StackId,
+  { version, commitHash }: { version?: number; commitHash?: string } = {},
+  { enabled }: { enabled?: boolean } = {}
+) {
+  return useQuery({
+    queryKey: queryKeys.stackFile(stackId, { version, commitHash }),
+    queryFn: ({ signal }) =>
+      getStackFile({
+        stackId: stackId!,
+        version,
+        commitHash,
+        options: { signal },
+      }),
+
+    ...withError('Unable to retrieve stack'),
+    enabled: !!stackId && enabled,
+  });
+}
+
+export async function getStackFile({
+  stackId,
+  version,
+  commitHash,
+  options = {},
+}: {
+  stackId: StackId;
+  version?: number;
+  commitHash?: string;
+  options?: { signal?: AbortSignal };
+}) {
+  try {
+    const { data } = await axios.get<StackFile>(`/stacks/${stackId}/file`, {
+      params: { version, commitHash },
+      signal: options.signal,
+    });
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to retrieve stack file');
+  }
+}
diff --git a/app/react/common/stacks/queries/useStacks.ts b/app/react/common/stacks/queries/useStacks.ts
new file mode 100644
index 0000000..71c31a1
--- /dev/null
+++ b/app/react/common/stacks/queries/useStacks.ts
@@ -0,0 +1,23 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { withError } from '@/react-tools/react-query';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { Stack } from '@/react/common/stacks/types';
+
+import { buildStackUrl } from './buildUrl';
+import { queryKeys } from './query-keys';
+
+export function useStacks() {
+  return useQuery(queryKeys.base(), () => getStacks(), {
+    ...withError('Failed loading stack'),
+  });
+}
+
+export async function getStacks() {
+  try {
+    const { data } = await axios.get<Stack[]>(buildStackUrl());
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e as Error);
+  }
+}
diff --git a/app/react/common/stacks/readme.md b/app/react/common/stacks/readme.md
new file mode 100644
index 0000000..020ff14
--- /dev/null
+++ b/app/react/common/stacks/readme.md
@@ -0,0 +1 @@
+Stacks are placed in the `/app/react/common` folder, because they are used by both Kubernetes and Docker environments and are saved locally to the Portainer database.
diff --git a/app/react/common/stacks/types.ts b/app/react/common/stacks/types.ts
new file mode 100644
index 0000000..33c8d20
--- /dev/null
+++ b/app/react/common/stacks/types.ts
@@ -0,0 +1,120 @@
+import { ResourceControlResponse } from '@/react/portainer/access-control/types';
+import { AuthTypeOption } from '@/react/portainer/account/git-credentials/types';
+import {
+  AutoUpdateResponse,
+  RepoConfigResponse,
+} from '@/react/portainer/gitops/types';
+
+import { EnvVar } from '@@/form-components/EnvironmentVariablesFieldset/types';
+
+export type StackId = number;
+
+export enum StackType {
+  /**
+   * Represents a stack managed via docker stack
+   */
+  DockerSwarm = 1,
+  /**
+   * Represents a stack managed via docker-compose
+   */
+  DockerCompose,
+  /**
+   * Represents a stack managed via kubectl
+   */
+  Kubernetes,
+}
+
+export enum StackStatus {
+  Active = 1,
+  Inactive,
+  Deploying,
+  Error,
+}
+
+export interface StackDeploymentStatus {
+  Status: StackStatus;
+  Time: number;
+  Message?: string;
+}
+
+/**
+ * Records the deployment information of a stack, including version tracking and git configuration details
+ */
+export interface StackDeploymentInfo {
+  /**
+   * Version of the stack and also the deployed version in edge agent
+   */
+  Version: number;
+  /**
+   * Version of the stack file, used to detect changes
+   */
+  FileVersion: number;
+  /**
+   * Commit hash of the git repository used for deploying the stack
+   */
+  ConfigHash?: string;
+  RepositoryURL?: string;
+  ReferenceName?: string;
+  ConfigFilePath?: string;
+  AdditionalFiles?: string[];
+  /**
+   * Source used for deploying the stack
+   */
+  SourceID?: number;
+}
+
+export interface Stack {
+  Id: number;
+  Name: string;
+  Type: StackType;
+  EndpointId: number;
+  SwarmId: string;
+  EntryPoint: string;
+  Env: EnvVar[] | null;
+  ResourceControl?: ResourceControlResponse;
+  Status: StackStatus;
+  DeploymentStatus?: StackDeploymentStatus[];
+  ProjectPath: string;
+  CreationDate: number;
+  CreatedBy: string;
+  UpdateDate: number;
+  UpdatedBy: string;
+  AdditionalFiles?: string[] | null;
+  AutoUpdate?: AutoUpdateResponse | null;
+  Option?: {
+    Prune: boolean;
+    Force: boolean;
+  };
+  GitConfig?: RepoConfigResponse;
+  GitSourceId?: number;
+  FromAppTemplate: boolean;
+  Namespace?: string;
+  IsComposeFormat: boolean;
+  Webhook?: string;
+  SupportRelativePath: boolean;
+  FilesystemPath: string;
+  StackFileVersion: number;
+  PreviousDeploymentInfo?: StackDeploymentInfo;
+  CurrentDeploymentInfo?: StackDeploymentInfo;
+}
+
+export type StackFile = {
+  StackFileContent: string;
+};
+
+export interface GitStackPayload {
+  env: Array<EnvVar>;
+  prune?: boolean;
+  RepositoryReferenceName?: string;
+  RepositoryAuthentication?: boolean;
+  RepositoryUsername?: string;
+  RepositoryPassword?: string;
+  RepositoryAuthorizationType?: AuthTypeOption;
+  RepullImageAndRedeploy?: boolean;
+  AutoUpdate?: AutoUpdateResponse | null;
+  TLSSkipVerify?: boolean;
+  Registries?: number[];
+  HelmChartPath?: string;
+  HelmValuesFiles?: string[];
+  Atomic?: boolean;
+}
diff --git a/app/react/common/string-utils.test.ts b/app/react/common/string-utils.test.ts
new file mode 100644
index 0000000..7f855c0
--- /dev/null
+++ b/app/react/common/string-utils.test.ts
@@ -0,0 +1,165 @@
+import {
+  capitalize,
+  pluralize,
+  addPlural,
+  grammaticallyJoin,
+  stripProtocol,
+} from './string-utils';
+
+describe('capitalize', () => {
+  it('capitalizes the first letter of a string', () => {
+    expect(capitalize('hello')).toBe('Hello');
+  });
+
+  it('handles already capitalized strings', () => {
+    expect(capitalize('Hello')).toBe('Hello');
+  });
+
+  it('handles single character strings', () => {
+    expect(capitalize('a')).toBe('A');
+  });
+
+  it('handles empty strings', () => {
+    expect(capitalize('')).toBe('');
+  });
+
+  it('preserves the rest of the string', () => {
+    expect(capitalize('hELLO')).toBe('HELLO');
+  });
+});
+
+describe('pluralize', () => {
+  it('returns singular for 1', () => {
+    expect(pluralize(1, 'dog')).toBe('dog');
+  });
+
+  it('returns singular for -1', () => {
+    expect(pluralize(-1, 'dog')).toBe('dog');
+  });
+
+  it('returns plural for 0', () => {
+    expect(pluralize(0, 'dog')).toBe('dogs');
+  });
+
+  it('returns plural for 2', () => {
+    expect(pluralize(2, 'dog')).toBe('dogs');
+  });
+
+  it('returns plural for negative numbers other than -1', () => {
+    expect(pluralize(-5, 'dog')).toBe('dogs');
+  });
+
+  it('uses custom plural form when provided', () => {
+    expect(pluralize(5, 'child', 'children')).toBe('children');
+    expect(pluralize(1, 'child', 'children')).toBe('child');
+  });
+
+  it('handles irregular plurals', () => {
+    expect(pluralize(2, 'mouse', 'mice')).toBe('mice');
+    expect(pluralize(1, 'mouse', 'mice')).toBe('mouse');
+  });
+});
+
+describe('addPlural', () => {
+  it('combines number with singular word for 1', () => {
+    expect(addPlural(1, 'dog')).toBe('1 dog');
+  });
+
+  it('combines number with plural word for 2', () => {
+    expect(addPlural(2, 'dog')).toBe('2 dogs');
+  });
+
+  it('combines number with plural word for 0', () => {
+    expect(addPlural(0, 'dog')).toBe('0 dogs');
+  });
+
+  it('uses custom plural form when provided', () => {
+    expect(addPlural(5, 'child', 'children')).toBe('5 children');
+    expect(addPlural(1, 'child', 'children')).toBe('1 child');
+  });
+
+  it('handles negative numbers', () => {
+    expect(addPlural(-1, 'dog')).toBe('-1 dog');
+    expect(addPlural(-5, 'dog')).toBe('-5 dogs');
+  });
+});
+
+describe('grammaticallyJoin', () => {
+  it('returns empty string for empty array', () => {
+    expect(grammaticallyJoin([])).toBe('');
+  });
+
+  it('returns single item as is', () => {
+    expect(grammaticallyJoin(['apple'])).toBe('apple');
+  });
+
+  it('joins two items with "and"', () => {
+    expect(grammaticallyJoin(['apple', 'orange'])).toBe('apple and orange');
+  });
+
+  it('joins three items with commas and "and"', () => {
+    expect(grammaticallyJoin(['apple', 'orange', 'banana'])).toBe(
+      'apple, orange and banana'
+    );
+  });
+
+  it('joins multiple items correctly', () => {
+    expect(grammaticallyJoin(['apple', 'orange', 'banana', 'grape'])).toBe(
+      'apple, orange, banana and grape'
+    );
+  });
+
+  it('uses both custom separators together', () => {
+    expect(grammaticallyJoin(['a', 'b', 'c'], ' - ', ' & ')).toBe('a - b & c');
+  });
+});
+
+describe('stripProtocol', () => {
+  it('removes http:// protocol', () => {
+    expect(stripProtocol('http://example.com')).toBe('example.com');
+  });
+
+  it('removes https:// protocol', () => {
+    expect(stripProtocol('https://example.com')).toBe('example.com');
+  });
+
+  it('removes ftp:// protocol', () => {
+    expect(stripProtocol('ftp://files.example.com')).toBe('files.example.com');
+  });
+
+  it('handles URLs with paths', () => {
+    expect(stripProtocol('https://example.com/path/to/page')).toBe(
+      'example.com/path/to/page'
+    );
+  });
+
+  it('returns empty string when undefined', () => {
+    expect(stripProtocol(undefined)).toBe('');
+  });
+
+  it('returns the string as is if no protocol', () => {
+    expect(stripProtocol('example.com')).toBe('example.com');
+  });
+
+  it('handles custom protocols', () => {
+    expect(stripProtocol('custom://protocol.com')).toBe('protocol.com');
+  });
+
+  it('handles URLs with ports and credentials', () => {
+    expect(stripProtocol('https://user:pass@example.com:8080')).toBe(
+      'user:pass@example.com:8080'
+    );
+  });
+
+  it('preserves protocols in query params', () => {
+    expect(stripProtocol('http://example.com?redirect=http://other.com')).toBe(
+      'example.com?redirect=http://other.com'
+    );
+  });
+
+  it('preserves protocols in paths', () => {
+    expect(stripProtocol('http://example.com/file://path/to/resource')).toBe(
+      'example.com/file://path/to/resource'
+    );
+  });
+});
diff --git a/app/react/common/string-utils.ts b/app/react/common/string-utils.ts
new file mode 100644
index 0000000..d14f608
--- /dev/null
+++ b/app/react/common/string-utils.ts
@@ -0,0 +1,34 @@
+export function capitalize(s: string) {
+  return s.slice(0, 1).toUpperCase() + s.slice(1);
+}
+
+export function pluralize(val: number, word: string, plural = `${word}s`) {
+  return [1, -1].includes(Number(val)) ? word : plural;
+}
+
+export function addPlural(value: number, word: string, plural = `${word}s`) {
+  return `${value} ${pluralize(value, word, plural)}`;
+}
+
+/**
+ * Joins an array of strings into a grammatically correct sentence.
+ */
+export function grammaticallyJoin(
+  values: string[],
+  separator = ', ',
+  lastSeparator = ' and '
+) {
+  if (values.length === 0) return '';
+  if (values.length === 1) return values[0];
+
+  const allButLast = values.slice(0, -1);
+  const last = values[values.length - 1];
+  return `${allButLast.join(separator)}${lastSeparator}${last}`;
+}
+
+/**
+ * Strips the protocol from a URL. If the URL is not provided, returns an empty string.
+ */
+export function stripProtocol(url?: string) {
+  return url?.replace(/^.*?:\/\//, '') ?? '';
+}
diff --git a/app/react/common/utils/numbers.test.ts b/app/react/common/utils/numbers.test.ts
new file mode 100644
index 0000000..c17f623
--- /dev/null
+++ b/app/react/common/utils/numbers.test.ts
@@ -0,0 +1,74 @@
+/* eslint-disable no-loss-of-precision */
+import { abbreviateNumber } from './numbers';
+
+describe('abbreviateNumber', () => {
+  test('errors', () => {
+    expect(() => abbreviateNumber(Number.NaN)).toThrowError();
+    expect(() => abbreviateNumber(1, -1)).toThrowError();
+    expect(() => abbreviateNumber(1, 21)).toThrowError();
+  });
+
+  test('zero', () => {
+    expect(abbreviateNumber(0)).toBe('0');
+    expect(abbreviateNumber(-0)).toBe('0');
+  });
+
+  test('decimals=0', () => {
+    const cases: [number, string][] = [
+      [123, '123'],
+      [123_123, '123k'],
+      [123_123_123, '123M'],
+      [123_123_123_123, '123G'],
+      [123_123_123_123_123, '123T'],
+      [123_123_123_123_123_123, '123P'],
+      [123_123_123_123_123_123_123, '123E'],
+      [123_123_123_123_123_123_123_123, '123Z'],
+      [123_123_123_123_123_123_123_123_123, '123Y'],
+      [123_123_123_123_123_123_123_123_123_123, '123123Y'],
+    ];
+    cases.forEach(([num, str]) => {
+      expect(abbreviateNumber(num, 0)).toBe(str);
+      expect(abbreviateNumber(-num, 0)).toBe(`-${str}`);
+    });
+  });
+
+  test('decimals=1 (default)', () => {
+    const cases: [number, string][] = [
+      [123, '123'],
+      [123_123, '123.1k'],
+      [123_123_123, '123.1M'],
+      [123_123_123_123, '123.1G'],
+      [123_123_123_123_123, '123.1T'],
+      [123_123_123_123_123_123, '123.1P'],
+      [123_123_123_123_123_123_123, '123.1E'],
+      [123_123_123_123_123_123_123_123, '123.1Z'],
+      [123_123_123_123_123_123_123_123_123, '123.1Y'],
+      [123_123_123_123_123_123_123_123_123_123, '123123.1Y'],
+    ];
+    cases.forEach(([num, str]) => {
+      expect(abbreviateNumber(num)).toBe(str);
+      expect(abbreviateNumber(-num)).toBe(`-${str}`);
+    });
+  });
+
+  test('decimals=10', () => {
+    const cases: [number, string][] = [
+      [123, '123'],
+      [123_123, '123.123k'],
+      [123_123_123, '123.123123M'],
+      [123_123_123_123, '123.123123123G'],
+      [123_123_123_123_123, '123.1231231231T'],
+      [123_123_123_123_123_123, '123.1231231231P'],
+      [123_123_123_123_123_123_123, '123.1231231231E'],
+      [123_123_123_123_123_123_123_123, '123.1231231231Z'],
+      [123_123_123_123_123_123_123_123_123, '123.1231231231Y'],
+      [123_123_123_123_123_123_123_123_123_123, '123123.1231231231Y'],
+    ];
+    cases.forEach(([num, str]) => {
+      expect(abbreviateNumber(num, 10)).toBe(str);
+      expect(abbreviateNumber(-num, 10)).toBe(`-${str}`);
+    });
+  });
+});
+
+/* eslint-enable no-loss-of-precision */
diff --git a/app/react/common/utils/numbers.ts b/app/react/common/utils/numbers.ts
new file mode 100644
index 0000000..617da47
--- /dev/null
+++ b/app/react/common/utils/numbers.ts
@@ -0,0 +1,45 @@
+const suffixes = ['', 'k', 'M', 'G', 'T', 'P', 'E', 'Z', 'Y'];
+
+/**
+ * Converts a number to a human-readable abbreviated format
+ * Uses base 10 and standard SI prefixes
+ *
+ * @param num - The number to abbreviate
+ * @param decimals - Number of decimal places (default: 1)
+ * @returns Abbreviated number as string (e.g., "90k", "123M")
+ */
+export function abbreviateNumber(num: number, decimals: number = 1): string {
+  if (Number.isNaN(num)) {
+    throw new Error('Invalid number');
+  }
+
+  if (decimals < 0 || decimals > 20) {
+    throw new Error('Invalid decimals. Must be in [0;20] range');
+  }
+
+  const isNegative = num < 0;
+  const absNum = Math.abs(num);
+
+  if (absNum === 0) {
+    return '0';
+  }
+
+  let exponent = Math.floor(Math.log10(absNum) / 3);
+
+  if (exponent > suffixes.length - 1) {
+    exponent = suffixes.length - 1;
+  }
+
+  if (exponent < 0) {
+    exponent = 0;
+  }
+
+  const value = absNum / 1000 ** exponent;
+
+  const roundedValue =
+    exponent > 0 ? Number(value.toFixed(decimals)) : Math.floor(value);
+
+  const finalValue = isNegative ? -roundedValue : roundedValue;
+
+  return `${finalValue}${suffixes[exponent]}`;
+}
diff --git a/app/react/components/Alert/Alert.stories.tsx b/app/react/components/Alert/Alert.stories.tsx
new file mode 100644
index 0000000..06c1282
--- /dev/null
+++ b/app/react/components/Alert/Alert.stories.tsx
@@ -0,0 +1,43 @@
+import { Meta, StoryFn } from '@storybook/react-webpack5';
+
+import { Alert } from './Alert';
+
+export default {
+  component: Alert,
+  title: 'Components/Alert',
+} as Meta;
+
+interface Args {
+  color: 'success' | 'error' | 'info';
+  title: string;
+  text: string;
+}
+
+function Template({ text, color, title }: Args) {
+  return (
+    <Alert color={color} title={title}>
+      {text}
+    </Alert>
+  );
+}
+
+export const Success: StoryFn<Args> = Template.bind({});
+Success.args = {
+  color: 'success',
+  title: 'Success',
+  text: 'This is a success alert. Very long text, Very long text,Very long text ,Very long text ,Very long text, Very long text',
+};
+
+export const Error: StoryFn<Args> = Template.bind({});
+Error.args = {
+  color: 'error',
+  title: 'Error',
+  text: 'This is an error alert',
+};
+
+export const Info: StoryFn<Args> = Template.bind({});
+Info.args = {
+  color: 'info',
+  title: 'Info',
+  text: 'This is an info alert',
+};
diff --git a/app/react/components/Alert/Alert.tsx b/app/react/components/Alert/Alert.tsx
new file mode 100644
index 0000000..e83b9ff
--- /dev/null
+++ b/app/react/components/Alert/Alert.tsx
@@ -0,0 +1,149 @@
+import clsx from 'clsx';
+import {
+  AlertCircle,
+  AlertTriangle,
+  CheckCircle,
+  Info,
+  XCircle,
+} from 'lucide-react';
+import { PropsWithChildren, ReactNode } from 'react';
+
+import { Icon } from '@@/Icon';
+
+type AlertType = 'success' | 'error' | 'info' | 'warn' | 'default';
+
+export const alertSettings: Record<
+  AlertType,
+  { container: string; header: string; body: string; icon: ReactNode }
+> = {
+  success: {
+    container:
+      'border-green-4 bg-green-2 th-dark:bg-green-10 th-dark:border-green-8 th-highcontrast:bg-green-10 th-highcontrast:border-white',
+    header: 'text-green-8 th-dark:text-white th-highcontrast:text-white',
+    body: 'text-green-7 th-dark:text-white th-highcontrast:text-white',
+    icon: CheckCircle,
+  },
+  error: {
+    container:
+      'border-error-4 bg-error-2 th-dark:bg-error-10 th-dark:border-error-8 th-highcontrast:bg-error-10 th-highcontrast:border-white',
+    header: 'text-error-8 th-dark:text-white th-highcontrast:text-white',
+    body: 'text-error-7 th-dark:text-white th-highcontrast:text-white',
+    icon: XCircle,
+  },
+  info: {
+    container:
+      'border-blue-4 bg-blue-2 th-dark:bg-blue-10 th-dark:border-blue-8 th-highcontrast:bg-blue-10 th-highcontrast:border-white',
+    header: 'text-blue-8 th-dark:text-white th-highcontrast:text-white',
+    body: 'text-blue-7 th-dark:text-white th-highcontrast:text-white',
+    icon: AlertCircle,
+  },
+  warn: {
+    container:
+      'border-warning-4 bg-warning-2 th-dark:bg-warning-10 th-dark:border-warning-8 th-highcontrast:bg-warning-10 th-highcontrast:border-white',
+    header: 'text-warning-8 th-dark:text-white th-highcontrast:text-white',
+    body: 'text-warning-7 th-dark:text-white th-highcontrast:text-white',
+    icon: AlertTriangle,
+  },
+  default: {
+    container:
+      'border-graphite-200 bg-graphite-50 th-dark:bg-graphite-700 th-dark:border-graphite-500 th-highcontrast:bg-graphite-800 th-highcontrast:border-white',
+    header: 'text-graphite-600 th-dark:text-white th-highcontrast:text-white',
+    body: 'text-graphite-500 th-dark:text-white th-highcontrast:text-white',
+    icon: Info,
+  },
+};
+
+const roleMap: Record<AlertType, 'alert' | 'status'> = {
+  error: 'alert',
+  warn: 'alert',
+  success: 'status',
+  info: 'status',
+  default: 'status',
+};
+
+export function Alert({
+  color,
+  title,
+  className,
+  children,
+}: PropsWithChildren<{
+  color: AlertType;
+  title?: string;
+  className?: string;
+}>) {
+  const { container, header, body, icon } = alertSettings[color];
+
+  return (
+    <AlertContainer
+      role={roleMap[color]}
+      className={clsx(container, className)}
+    >
+      {title ? (
+        <>
+          <AlertHeader className={header}>
+            <Icon icon={icon} />
+            {title}
+          </AlertHeader>
+          <AlertBody className={body} hasTitle={!!title}>
+            {children}
+          </AlertBody>
+        </>
+      ) : (
+        <AlertBody
+          className={clsx(body, 'flex items-start gap-2')}
+          hasTitle={!!title}
+        >
+          <Icon icon={icon} className="!mt-0.5 flex-none" /> {children}
+        </AlertBody>
+      )}
+    </AlertContainer>
+  );
+}
+
+export function AlertContainer({
+  className,
+  children,
+  role,
+}: PropsWithChildren<{ className?: string; role?: 'alert' | 'status' }>) {
+  return (
+    <div
+      role={role}
+      className={clsx(
+        'rounded-xl border border-solid [&_ul]:ps-8',
+        'p-3',
+        className
+      )}
+    >
+      {children}
+    </div>
+  );
+}
+
+function AlertHeader({
+  className,
+  children,
+}: PropsWithChildren<{ className?: string }>) {
+  return (
+    <h4
+      className={clsx(
+        'text-base',
+        '!m-0 mb-2 flex items-center gap-2',
+        className
+      )}
+    >
+      {children}
+    </h4>
+  );
+}
+
+function AlertBody({
+  className,
+  hasTitle,
+  children,
+}: PropsWithChildren<{ className?: string; hasTitle: boolean }>) {
+  return (
+    <div className={clsx('text-sm', className, { 'ml-6': hasTitle })}>
+      {children}
+    </div>
+  );
+}
diff --git a/app/react/components/Alert/index.ts b/app/react/components/Alert/index.ts
new file mode 100644
index 0000000..5adeb5a
--- /dev/null
+++ b/app/react/components/Alert/index.ts
@@ -0,0 +1 @@
+export { Alert } from './Alert';
diff --git a/app/react/components/BEFeatureIndicator/BEFeatureIndicator.css b/app/react/components/BEFeatureIndicator/BEFeatureIndicator.css
new file mode 100644
index 0000000..69734ad
--- /dev/null
+++ b/app/react/components/BEFeatureIndicator/BEFeatureIndicator.css
@@ -0,0 +1,27 @@
+.be-indicator {
+  @apply border border-solid border-gray-6;
+  @apply text-xs text-gray-6;
+  border-radius: 15px;
+  padding: 5px 10px;
+  font-weight: 400;
+  touch-action: all;
+  pointer-events: all;
+  white-space: nowrap;
+}
+
+.be-indicator .be-indicator-icon {
+  @apply text-inherit;
+}
+
+.be-indicator:hover {
+  @apply underline;
+  @apply border-blue-9 text-blue-9;
+}
+
+.be-indicator:hover .be-indicator-label {
+  @apply underline;
+}
+
+.be-indicator-container {
+  @apply relative;
+}
diff --git a/app/react/components/BEFeatureIndicator/BEFeatureIndicator.stories.tsx b/app/react/components/BEFeatureIndicator/BEFeatureIndicator.stories.tsx
new file mode 100644
index 0000000..8d62d4f
--- /dev/null
+++ b/app/react/components/BEFeatureIndicator/BEFeatureIndicator.stories.tsx
@@ -0,0 +1,25 @@
+import { Meta } from '@storybook/react-webpack5';
+
+import { Edition, FeatureId } from '@/react/portainer/feature-flags/enums';
+import { init as initFeatureService } from '@/react/portainer/feature-flags/feature-flags.service';
+
+import { BEFeatureIndicator, Props } from './BEFeatureIndicator';
+
+export default {
+  component: BEFeatureIndicator,
+  title: 'Components/BEFeatureIndicator',
+  argTypes: {
+    featureId: {
+      control: { type: 'select', options: Object.values(FeatureId) },
+    },
+  },
+} as Meta<Props>;
+
+// : JSX.IntrinsicAttributes & PropsWithChildren<Props>
+function Template({ featureId }: Props) {
+  initFeatureService(Edition.CE);
+
+  return <BEFeatureIndicator featureId={featureId} />;
+}
+
+export const Example = Template.bind({});
diff --git a/app/react/components/BEFeatureIndicator/BEFeatureIndicator.tsx b/app/react/components/BEFeatureIndicator/BEFeatureIndicator.tsx
new file mode 100644
index 0000000..47ff2e7
--- /dev/null
+++ b/app/react/components/BEFeatureIndicator/BEFeatureIndicator.tsx
@@ -0,0 +1,49 @@
+import { ReactNode } from 'react';
+import clsx from 'clsx';
+import { Briefcase } from 'lucide-react';
+
+import './BEFeatureIndicator.css';
+
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+
+import { Icon } from '@@/Icon';
+
+import { getFeatureDetails } from './utils';
+
+export interface Props {
+  featureId: FeatureId;
+  showIcon?: boolean;
+  className?: string;
+  children?: (isLimited: boolean) => ReactNode;
+}
+
+export function BEFeatureIndicator({
+  featureId,
+  children = () => null,
+  showIcon = true,
+  className = '',
+}: Props) {
+  const { url, limitedToBE = false } = getFeatureDetails(featureId);
+
+  return (
+    <>
+      {limitedToBE && (
+        <a
+          className={clsx('be-indicator vertical-center text-xs', className)}
+          href={url}
+          target="_blank"
+          rel="noopener noreferrer"
+        >
+          {showIcon && (
+            <Icon icon={Briefcase} className="be-indicator-icon mr-1" />
+          )}
+          <span className="be-indicator-label break-words">
+            Business Feature
+          </span>
+        </a>
+      )}
+
+      {children(limitedToBE)}
+    </>
+  );
+}
diff --git a/app/react/components/BEFeatureIndicator/BEOverlay.tsx b/app/react/components/BEFeatureIndicator/BEOverlay.tsx
new file mode 100644
index 0000000..fcdddd9
--- /dev/null
+++ b/app/react/components/BEFeatureIndicator/BEOverlay.tsx
@@ -0,0 +1,66 @@
+import clsx from 'clsx';
+
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+import { isLimitedToBE } from '@/react/portainer/feature-flags/feature-flags.service';
+
+import { BEFeatureIndicator } from './BEFeatureIndicator';
+
+type Variants = 'form-section' | 'widget' | 'multi-widget';
+
+type OverlayClasses = {
+  beLinkContainerClassName: string;
+  contentClassName: string;
+};
+
+const variantClassNames: Record<Variants, OverlayClasses> = {
+  'form-section': {
+    beLinkContainerClassName: '',
+    contentClassName: '',
+  },
+  widget: {
+    beLinkContainerClassName: '',
+    // no padding so that the border overlaps the widget border
+    contentClassName: '!p-0',
+  },
+  'multi-widget': {
+    beLinkContainerClassName: 'm-4',
+    // widgets have a mx of 15px and mb of 15px - match this at the top with padding
+    contentClassName: '!p-0 !pt-[15px]',
+  },
+};
+
+export function BEOverlay({
+  featureId,
+  children,
+  variant = 'form-section',
+}: {
+  featureId: FeatureId;
+  children: React.ReactNode;
+  variant?: 'form-section' | 'widget' | 'multi-widget';
+}) {
+  const isLimited = isLimitedToBE(featureId);
+  if (!isLimited) {
+    return <>{children}</>;
+  }
+
+  return (
+    <div className="be-indicator-container limited-be">
+      <div
+        className={clsx(
+          'limited-be-link vertical-center',
+          variantClassNames[variant].beLinkContainerClassName
+        )}
+      >
+        <BEFeatureIndicator featureId={featureId} />
+      </div>
+      <div
+        className={clsx(
+          'limited-be-content',
+          variantClassNames[variant].contentClassName
+        )}
+      >
+        {children}
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/components/BEFeatureIndicator/index.ts b/app/react/components/BEFeatureIndicator/index.ts
new file mode 100644
index 0000000..de5e2b7
--- /dev/null
+++ b/app/react/components/BEFeatureIndicator/index.ts
@@ -0,0 +1 @@
+export { BEFeatureIndicator } from './BEFeatureIndicator';
diff --git a/app/react/components/BEFeatureIndicator/utils.ts b/app/react/components/BEFeatureIndicator/utils.ts
new file mode 100644
index 0000000..2e210bd
--- /dev/null
+++ b/app/react/components/BEFeatureIndicator/utils.ts
@@ -0,0 +1,15 @@
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+import { isLimitedToBE } from '@/react/portainer/feature-flags/feature-flags.service';
+
+const BE_URL = 'https://www.portainer.io/business-upsell?from=';
+
+export function getFeatureDetails(featureId?: FeatureId) {
+  if (!featureId) {
+    return {};
+  }
+  const url = `${BE_URL}${featureId}`;
+
+  const limitedToBE = isLimitedToBE(featureId);
+
+  return { url, limitedToBE };
+}
diff --git a/app/react/components/BETeaserButton.tsx b/app/react/components/BETeaserButton.tsx
new file mode 100644
index 0000000..80c43a4
--- /dev/null
+++ b/app/react/components/BETeaserButton.tsx
@@ -0,0 +1,50 @@
+import { Briefcase } from 'lucide-react';
+
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+import { AutomationTestingProps } from '@/types';
+
+import { Button } from '@@/buttons';
+import { TooltipWithChildren } from '@@/Tip/TooltipWithChildren';
+
+interface Props extends AutomationTestingProps {
+  featureId: FeatureId;
+  heading: string;
+  message: string;
+  buttonText: string;
+  className?: string;
+  buttonClassName?: string;
+}
+
+export function BETeaserButton({
+  featureId,
+  heading,
+  message,
+  buttonText,
+  className,
+  buttonClassName,
+  'data-cy': dataCy,
+}: Props) {
+  return (
+    <TooltipWithChildren
+      className={className}
+      heading={heading}
+      BEFeatureID={featureId}
+      message={message}
+    >
+      <span>
+        <Button
+          className={buttonClassName}
+          icon={Briefcase}
+          type="button"
+          color="default"
+          size="small"
+          onClick={() => {}}
+          disabled
+          data-cy={dataCy}
+        >
+          {buttonText}
+        </Button>
+      </span>
+    </TooltipWithChildren>
+  );
+}
diff --git a/app/react/components/Badge/Badge.stories.tsx b/app/react/components/Badge/Badge.stories.tsx
new file mode 100644
index 0000000..ca9af50
--- /dev/null
+++ b/app/react/components/Badge/Badge.stories.tsx
@@ -0,0 +1,102 @@
+import { Meta, StoryFn } from '@storybook/react-webpack5';
+
+import { Badge, Props } from './Badge';
+
+export default {
+  component: Badge,
+  title: 'Design System/Badge',
+  argTypes: {
+    type: {
+      control: {
+        type: 'select',
+        options: [
+          'success',
+          'danger',
+          'warn',
+          'info',
+          'successSecondary',
+          'dangerSecondary',
+          'warnSecondary',
+          'infoSecondary',
+          'muted',
+          'accent',
+          'custom',
+        ],
+      },
+    },
+    shape: {
+      control: { type: 'radio', options: ['pill', 'rect'] },
+    },
+    size: {
+      control: { type: 'radio', options: ['sm', 'md'] },
+    },
+  },
+} as Meta<Props>;
+
+export const Default: StoryFn<Props> = () => (
+  <div className="flex gap-2">
+    <Badge type="success" shape="pill">
+      success
+    </Badge>
+    <Badge type="danger" shape="pill">
+      danger
+    </Badge>
+    <Badge type="info" shape="pill">
+      info
+    </Badge>
+    <Badge type="accent" shape="pill">
+      accent
+    </Badge>
+  </div>
+);
+
+export const RectShape: StoryFn<Props> = () => (
+  <div className="flex gap-2">
+    <Badge type="success" shape="rect">
+      success
+    </Badge>
+    <Badge type="danger" shape="rect">
+      danger
+    </Badge>
+    <Badge type="info" shape="rect">
+      info
+    </Badge>
+    <Badge type="accent" shape="rect">
+      accent
+    </Badge>
+  </div>
+);
+
+export const SmallSize: StoryFn<Props> = () => (
+  <div className="flex items-center gap-2">
+    <Badge type="success" size="sm">
+      success
+    </Badge>
+    <Badge type="danger" size="sm">
+      danger
+    </Badge>
+    <Badge type="info" size="sm">
+      info
+    </Badge>
+    <Badge type="muted" size="sm">
+      muted
+    </Badge>
+  </div>
+);
+
+export const CustomClass: StoryFn<Props> = () => (
+  <div className="flex gap-2">
+    <Badge
+      type="custom"
+      className="bg-purple-2 text-purple-9 th-dark:bg-purple-10 th-dark:text-purple-3"
+    >
+      purple
+    </Badge>
+    <Badge
+      type="custom"
+      className="bg-yellow-2 text-yellow-9 th-dark:bg-yellow-10 th-dark:text-yellow-3"
+    >
+      yellow
+    </Badge>
+  </div>
+);
diff --git a/app/react/components/Badge/Badge.test.tsx b/app/react/components/Badge/Badge.test.tsx
new file mode 100644
index 0000000..a327e0b
--- /dev/null
+++ b/app/react/components/Badge/Badge.test.tsx
@@ -0,0 +1,26 @@
+import { render } from '@testing-library/react';
+
+import { Badge } from './Badge';
+
+test('should render a Badge component with default type', () => {
+  const { getByText } = render(<Badge>Default Badge</Badge>);
+  const badgeElement = getByText('Default Badge');
+  expect(badgeElement).toBeInTheDocument();
+  expect(badgeElement).toHaveClass('text-blue-9 bg-blue-2');
+});
+
+test('should render a Badge component with custom type', () => {
+  const { getByText } = render(<Badge type="success">Success Badge</Badge>);
+  const badgeElement = getByText('Success Badge');
+  expect(badgeElement).toBeInTheDocument();
+  expect(badgeElement).toHaveClass('text-success-9 bg-success-2');
+});
+
+test('should render a Badge component with custom className', () => {
+  const { getByText } = render(
+    <Badge className="custom-class">Custom Badge</Badge>
+  );
+  const badgeElement = getByText('Custom Badge');
+  expect(badgeElement).toBeInTheDocument();
+  expect(badgeElement).toHaveClass('custom-class');
+});
diff --git a/app/react/components/Badge/Badge.tsx b/app/react/components/Badge/Badge.tsx
new file mode 100644
index 0000000..5546163
--- /dev/null
+++ b/app/react/components/Badge/Badge.tsx
@@ -0,0 +1,122 @@
+import { cva, type VariantProps } from 'class-variance-authority';
+import { PropsWithChildren } from 'react';
+
+import { AutomationTestingProps } from '@/types';
+
+import { Icon, IconProps } from '@@/Icon';
+
+const badge = cva(
+  'inline-flex w-fit items-center gap-1 font-medium [&>a]:hover:text-inherit [&>a]:text-inherit',
+  {
+    variants: {
+      type: {
+        success:
+          'bg-success-2 text-success-9 th-dark:bg-success-10 th-dark:text-success-3 th-highcontrast:bg-success-10 th-highcontrast:text-success-3',
+        warn: 'bg-warning-2 text-warning-9 th-dark:bg-warning-10 th-dark:text-warning-3 th-highcontrast:bg-warning-10 th-highcontrast:text-warning-3',
+        danger:
+          'bg-error-2 text-error-9 th-dark:bg-error-10 th-dark:text-error-3 th-highcontrast:bg-error-10 th-highcontrast:text-error-3',
+        info: 'bg-blue-2 text-blue-9 th-dark:bg-blue-10 th-dark:text-blue-3 th-highcontrast:bg-blue-10 th-highcontrast:text-blue-3',
+        // the secondary classes are a bit darker in light mode and a bit lighter in dark mode
+        successSecondary:
+          'bg-success-3 text-success-9 th-dark:bg-success-9 th-dark:text-success-3 th-highcontrast:bg-success-9 th-highcontrast:text-success-3',
+        warnSecondary:
+          'bg-warning-3 text-warning-9 th-dark:bg-warning-9 th-dark:text-warning-3 th-highcontrast:bg-warning-9 th-highcontrast:text-warning-3',
+        dangerSecondary:
+          'bg-error-3 text-error-9 th-dark:bg-error-9 th-dark:text-error-3 th-highcontrast:bg-error-9 th-highcontrast:text-error-3',
+        infoSecondary:
+          'bg-blue-3 text-blue-9 th-dark:bg-blue-9 th-dark:text-blue-3 th-highcontrast:bg-blue-9 th-highcontrast:text-blue-3',
+        muted:
+          'bg-gray-3 text-gray-9 th-dark:bg-gray-9 th-dark:text-gray-3 th-highcontrast:bg-gray-9 th-highcontrast:text-gray-3',
+        accent:
+          'bg-indigo-2 text-indigo-9 th-dark:bg-indigo-10 th-dark:text-indigo-3 th-highcontrast:bg-indigo-10 th-highcontrast:text-indigo-3',
+        custom: '',
+      },
+      shape: {
+        pill: 'rounded-full',
+        rect: 'rounded',
+      },
+      size: {
+        sm: 'px-1.5 py-px text-[10px]',
+        md: '!text-xs px-2 py-0.5',
+      },
+      bordered: {
+        true: '!border border-solid th-highcontrast:border-white',
+      },
+    },
+    compoundVariants: [
+      {
+        type: ['success', 'successSecondary'],
+        bordered: true,
+        className: 'border-success-4 th-dark:border-success-8',
+      },
+      {
+        type: ['warn', 'warnSecondary'],
+        bordered: true,
+        className: 'border-warning-4 th-dark:border-warning-8',
+      },
+      {
+        type: ['danger', 'dangerSecondary'],
+        bordered: true,
+        className: 'border-error-4 th-dark:border-error-8',
+      },
+      {
+        type: ['info', 'infoSecondary'],
+        bordered: true,
+        className: 'border-blue-4 th-dark:border-blue-8',
+      },
+      {
+        type: 'muted',
+        bordered: true,
+        className: 'border-gray-4 th-dark:border-gray-8',
+      },
+      {
+        type: 'accent',
+        bordered: true,
+        className: 'border-indigo-4 th-dark:border-indigo-8',
+      },
+    ],
+    defaultVariants: {
+      type: 'info',
+      shape: 'pill',
+      size: 'md',
+    },
+  }
+);
+
+export type BadgeType = NonNullable<
+  Exclude<VariantProps<typeof badge>['type'], 'custom'>
+>;
+export type BadgeShape = NonNullable<VariantProps<typeof badge>['shape']>;
+export type BadgeSize = NonNullable<VariantProps<typeof badge>['size']>;
+
+export type Props = {
+  shape?: BadgeShape;
+  size?: BadgeSize;
+  bordered?: boolean;
+  icon?: IconProps['icon'];
+} & (
+  | { type?: BadgeType; className?: string }
+  | { type: 'custom'; className: string }
+);
+
+export function Badge({
+  type = 'info',
+  shape,
+  size,
+  className,
+  bordered,
+  icon,
+  children,
+  'data-cy': dataCy,
+}: PropsWithChildren<Props> & Partial<AutomationTestingProps>) {
+  return (
+    <span
+      className={badge({ type, shape, size, bordered, className })}
+      role="status"
+      data-cy={dataCy}
+    >
+      {icon && <Icon icon={icon} />}
+      {children}
+    </span>
+  );
+}
diff --git a/app/react/components/Badge/ExternalBadge.tsx b/app/react/components/Badge/ExternalBadge.tsx
new file mode 100644
index 0000000..e49afd0
--- /dev/null
+++ b/app/react/components/Badge/ExternalBadge.tsx
@@ -0,0 +1,9 @@
+import { Badge } from '@@/Badge';
+
+export function ExternalBadge({ className }: { className?: string }) {
+  return (
+    <Badge type="info" className={className}>
+      External
+    </Badge>
+  );
+}
diff --git a/app/react/components/Badge/SystemBadge.tsx b/app/react/components/Badge/SystemBadge.tsx
new file mode 100644
index 0000000..204d01b
--- /dev/null
+++ b/app/react/components/Badge/SystemBadge.tsx
@@ -0,0 +1,9 @@
+import { Badge } from '@@/Badge';
+
+export function SystemBadge({ className }: { className?: string }) {
+  return (
+    <Badge type="success" className={className}>
+      System
+    </Badge>
+  );
+}
diff --git a/app/react/components/Badge/UnusedBadge.tsx b/app/react/components/Badge/UnusedBadge.tsx
new file mode 100644
index 0000000..743f8e8
--- /dev/null
+++ b/app/react/components/Badge/UnusedBadge.tsx
@@ -0,0 +1,5 @@
+import { Badge } from '@@/Badge';
+
+export function UnusedBadge() {
+  return <Badge type="warn">Unused</Badge>;
+}
diff --git a/app/react/components/Badge/index.ts b/app/react/components/Badge/index.ts
new file mode 100644
index 0000000..1deb737
--- /dev/null
+++ b/app/react/components/Badge/index.ts
@@ -0,0 +1,2 @@
+export { Badge } from './Badge';
+export type { BadgeType } from './Badge';
diff --git a/app/react/components/BadgeIcon/BadgeIcon.stories.tsx b/app/react/components/BadgeIcon/BadgeIcon.stories.tsx
new file mode 100644
index 0000000..a507b74
--- /dev/null
+++ b/app/react/components/BadgeIcon/BadgeIcon.stories.tsx
@@ -0,0 +1,35 @@
+import { Meta } from '@storybook/react-webpack5';
+
+import { BadgeIcon, BadgeSize, Props } from './BadgeIcon';
+
+export default {
+  component: BadgeIcon,
+  title: 'Components/BadgeIcon',
+  argTypes: {
+    size: {
+      control: {
+        type: 'select',
+        options: ['md', 'lg', 'xl', '2xl', '3xl'],
+      },
+    },
+    icon: {
+      control: {
+        type: 'select',
+        options: ['edit', 'info', 'smile', 'users'],
+      },
+    },
+  },
+} as Meta<Props>;
+
+// : JSX.IntrinsicAttributes & PropsWithChildren<Props>
+function Template({
+  size = '3xl',
+  icon = 'edit',
+}: {
+  size?: BadgeSize;
+  icon: string;
+}) {
+  return <BadgeIcon icon={icon} size={size} />;
+}
+
+export const Example = Template.bind({});
diff --git a/app/react/components/BadgeIcon/BadgeIcon.tsx b/app/react/components/BadgeIcon/BadgeIcon.tsx
new file mode 100644
index 0000000..dea966d
--- /dev/null
+++ b/app/react/components/BadgeIcon/BadgeIcon.tsx
@@ -0,0 +1,40 @@
+import clsx from 'clsx';
+
+import { Icon, IconProps } from '@@/Icon';
+
+export type BadgeSize = 'md' | 'lg' | 'xl' | '2xl' | '3xl';
+
+export interface Props extends IconProps {
+  size?: BadgeSize;
+}
+
+export function BadgeIcon({ icon, size = '3xl', iconClass }: Props) {
+  const sizeClasses = iconSizeToClasses(size);
+  return (
+    <div
+      className={clsx(
+        sizeClasses,
+        `badge-icon inline-flex items-center justify-center rounded-full bg-blue-3 text-blue-8 th-dark:bg-gray-9 th-dark:text-blue-3`
+      )}
+    >
+      <Icon icon={icon} className={clsx('!flex', iconClass)} />
+    </div>
+  );
+}
+
+function iconSizeToClasses(size: BadgeSize) {
+  switch (size) {
+    case 'md':
+      return 'h-6 w-6 text-md';
+    case 'lg':
+      return 'h-8 w-8 text-lg';
+    case 'xl':
+      return 'h-10 w-10 text-xl';
+    case '2xl':
+      return 'h-12 w-12 text-2xl';
+    case '3xl':
+      return 'h-14 w-14 text-3xl';
+    default:
+      return 'h-14 w-14 text-3xl';
+  }
+}
diff --git a/app/react/components/BadgeIcon/index.ts b/app/react/components/BadgeIcon/index.ts
new file mode 100644
index 0000000..e0138de
--- /dev/null
+++ b/app/react/components/BadgeIcon/index.ts
@@ -0,0 +1 @@
+export { BadgeIcon } from './BadgeIcon';
diff --git a/app/react/components/Blocklist/BlocklistItem.stories.tsx b/app/react/components/Blocklist/BlocklistItem.stories.tsx
new file mode 100644
index 0000000..9cade17
--- /dev/null
+++ b/app/react/components/Blocklist/BlocklistItem.stories.tsx
@@ -0,0 +1,75 @@
+import type { Meta, StoryObj } from '@storybook/react-webpack5';
+
+import { localizeDate } from '@/react/common/date-utils';
+
+import { Badge } from '@@/Badge';
+
+import { BlocklistItem } from './BlocklistItem';
+
+const meta: Meta<typeof BlocklistItem> = {
+  title: 'Components/Blocklist/BlocklistItem',
+  component: BlocklistItem,
+  parameters: {
+    layout: 'centered',
+  },
+  tags: ['autodocs'],
+  decorators: [
+    (Story) => (
+      <div className="blocklist">
+        <Story />
+      </div>
+    ),
+  ],
+};
+
+export default meta;
+type Story = StoryObj<typeof BlocklistItem>;
+
+export const Default: Story = {
+  args: {
+    children: 'Default Blocklist Item',
+  },
+};
+
+export const Selected: Story = {
+  args: {
+    children: 'Selected Blocklist Item',
+    isSelected: true,
+  },
+};
+
+export const AsDiv: Story = {
+  args: {
+    children: 'Blocklist Item as div',
+    as: 'div',
+  },
+};
+
+export const WithCustomContent: Story = {
+  args: {
+    children: (
+      <div className="flex w-full flex-col gap-2">
+        <div className="flex flex-wrap justify-between gap-1">
+          <Badge type="success">Deployed</Badge>
+          <span className="text-muted text-xs">Revision #4</span>
+        </div>
+        <div className="flex flex-wrap justify-between gap-1">
+          <span className="text-muted text-xs">my-app-1.0.0</span>
+          <span className="text-muted text-xs">
+            {localizeDate(new Date('2000-01-01'))}
+          </span>
+        </div>
+      </div>
+    ),
+  },
+};
+
+export const MultipleItems: Story = {
+  render: () => (
+    <div className="blocklist">
+      <BlocklistItem>First Item</BlocklistItem>
+      <BlocklistItem isSelected>Second Item (Selected)</BlocklistItem>
+      <BlocklistItem>Third Item</BlocklistItem>
+    </div>
+  ),
+};
diff --git a/app/react/components/Blocklist/BlocklistItem.tsx b/app/react/components/Blocklist/BlocklistItem.tsx
new file mode 100644
index 0000000..96ba28a
--- /dev/null
+++ b/app/react/components/Blocklist/BlocklistItem.tsx
@@ -0,0 +1,38 @@
+import clsx from 'clsx';
+import { ComponentProps, ComponentType, ElementType } from 'react';
+
+export type AsComponentProps<E extends ElementType = ElementType> =
+  ComponentProps<E> & {
+    as?: E;
+  };
+
+export function BlocklistItem<T extends ElementType>({
+  className,
+  isSelected,
+  children,
+  as = 'button',
+  ...props
+}: AsComponentProps & {
+  isSelected?: boolean;
+  as?: ComponentType<T>;
+}) {
+  const Component = as as 'button';
+
+  return (
+    <Component
+      type="button"
+      className={clsx(
+        className,
+        'blocklist-item no-link !ml-0 flex w-full items-stretch overflow-hidden bg-transparent text-left',
+        {
+          'blocklist-item--selected': isSelected,
+        }
+      )}
+      role="listitem"
+      // eslint-disable-next-line react/jsx-props-no-spreading
+      {...props}
+    >
+      {children}
+    </Component>
+  );
+}
diff --git a/app/react/components/BoxSelector/BoxOption.module.css b/app/react/components/BoxSelector/BoxOption.module.css
new file mode 100644
index 0000000..6ced5fb
--- /dev/null
+++ b/app/react/components/BoxSelector/BoxOption.module.css
@@ -0,0 +1,48 @@
+.root label {
+  @apply border border-solid;
+  @apply border-gray-5 bg-gray-2 text-black;
+  @apply th-dark:border-gray-neutral-8 th-dark:bg-gray-iron-10 th-dark:text-white;
+  @apply th-highcontrast:text-white;
+
+  font-weight: normal;
+  font-size: 12px;
+  display: block;
+  border-radius: 8px;
+
+  padding: 20px 15px;
+  text-align: left;
+  box-shadow: var(--shadow-boxselector-color);
+  position: relative;
+  margin-bottom: 0;
+
+  text-align: left;
+  height: 100%;
+}
+
+/* not disabled */
+.root input:not(:disabled) ~ label {
+  @apply bg-gray-2;
+  @apply th-dark:bg-gray-iron-10;
+  @apply th-highcontrast:bg-black;
+
+  box-shadow: none;
+  cursor: pointer;
+}
+
+/* disabled */
+.root input:disabled + label {
+  @apply bg-white;
+  @apply th-dark:bg-gray-7;
+  @apply th-highcontrast:bg-black;
+  filter: opacity(0.3) grayscale(1);
+
+  cursor: not-allowed;
+}
+
+.root input:checked + label {
+  @apply border-blue-6 bg-blue-2;
+  @apply th-dark:border-blue-7 th-dark:bg-blue-10;
+  @apply th-highcontrast:border-blue-7 th-highcontrast:bg-blue-10;
+
+  box-shadow: none;
+}
diff --git a/app/react/components/BoxSelector/BoxOption.tsx b/app/react/components/BoxSelector/BoxOption.tsx
new file mode 100644
index 0000000..82e7236
--- /dev/null
+++ b/app/react/components/BoxSelector/BoxOption.tsx
@@ -0,0 +1,78 @@
+import clsx from 'clsx';
+import { PropsWithChildren } from 'react';
+import type { LucideIcon } from 'lucide-react';
+
+import { TooltipWithChildren } from '@@/Tip/TooltipWithChildren';
+
+import styles from './BoxOption.module.css';
+import { BoxSelectorOption, Value } from './types';
+
+interface Props<T extends Value> {
+  radioName: string;
+  option: BoxSelectorOption<T>;
+  onSelect?(value: T): void;
+  isSelected(value: T): boolean;
+  disabled?: boolean;
+  tooltip?: string;
+  className?: string;
+  type?: 'radio' | 'checkbox';
+  checkIcon: LucideIcon;
+}
+
+export function BoxOption<T extends Value>({
+  radioName,
+  option,
+  onSelect = () => {},
+  isSelected,
+  disabled,
+  tooltip,
+  className,
+  type = 'radio',
+  children,
+  checkIcon: Check,
+}: PropsWithChildren<Props<T>>) {
+  const selected = isSelected(option.value);
+
+  const item = (
+    <div className={clsx(styles.root, className)}>
+      <input
+        type={type}
+        name={radioName}
+        id={option.id}
+        checked={selected}
+        value={option.value.toString()}
+        disabled={disabled}
+        onChange={() => onSelect(option.value)}
+        className="sr-only"
+      />
+
+      <label htmlFor={option.id} data-cy={`${radioName}_${option.value}`}>
+        {children}
+
+        {!disabled && (
+          <div
+            className={clsx(
+              'absolute right-4 top-4 flex h-4 w-4 items-center justify-center border border-solid font-bold text-white',
+              {
+                'border-gray-6 bg-white': !selected,
+                'border-blue-8 bg-blue-8': selected,
+              },
+              {
+                'rounded-full': type === 'radio',
+                'rounded-sm': type === 'checkbox',
+              }
+            )}
+          >
+            {selected && <Check className="lucide" strokeWidth={3} />}
+          </div>
+        )}
+      </label>
+    </div>
+  );
+
+  if (tooltip) {
+    return <TooltipWithChildren message={tooltip}>{item}</TooltipWithChildren>;
+  }
+
+  return item;
+}
diff --git a/app/react/components/BoxSelector/BoxSelector.stories.tsx b/app/react/components/BoxSelector/BoxSelector.stories.tsx
new file mode 100644
index 0000000..5d5609e
--- /dev/null
+++ b/app/react/components/BoxSelector/BoxSelector.stories.tsx
@@ -0,0 +1,170 @@
+import { Meta } from '@storybook/react-webpack5';
+import { useState } from 'react';
+import { Anchor, Briefcase } from 'lucide-react';
+
+import Docker from '@/assets/ico/vendor/docker.svg?c';
+import { init as initFeatureService } from '@/react/portainer/feature-flags/feature-flags.service';
+import { Edition, FeatureId } from '@/react/portainer/feature-flags/enums';
+
+import { BoxSelector } from './BoxSelector';
+import { BoxSelectorOption } from './types';
+
+const meta: Meta = {
+  title: 'Components/BoxSelector',
+  component: BoxSelector,
+};
+
+export default meta;
+
+export { Example, LimitedFeature };
+
+function Example() {
+  const [value, setValue] = useState(3);
+  const options: BoxSelectorOption<number>[] = [
+    {
+      description: 'description 1',
+      icon: Anchor,
+      iconType: 'badge',
+      id: '1',
+      value: 3,
+      label: 'option 1',
+    },
+    {
+      description: 'description 2',
+      icon: Briefcase,
+      iconType: 'badge',
+      id: '2',
+      value: 4,
+      label: 'option 2',
+    },
+  ];
+
+  return (
+    <BoxSelector
+      radioName="name"
+      onChange={(value: number) => {
+        setValue(value);
+      }}
+      value={value}
+      options={options}
+    />
+  );
+}
+
+function LimitedFeature() {
+  initFeatureService(Edition.CE);
+  const [value, setValue] = useState(3);
+  const options: BoxSelectorOption<number>[] = [
+    {
+      description: 'description 1',
+      icon: Anchor,
+      iconType: 'badge',
+      id: '1',
+      value: 3,
+      label: 'option 1',
+    },
+    {
+      description: 'description 2',
+      icon: Briefcase,
+      iconType: 'badge',
+      id: '2',
+      value: 4,
+      label: 'option 2',
+      feature: FeatureId.ACTIVITY_AUDIT,
+    },
+  ];
+
+  return (
+    <BoxSelector
+      radioName="name"
+      onChange={(value: number) => {
+        setValue(value);
+      }}
+      value={value}
+      options={options}
+    />
+  );
+}
+
+export function MultiSelect() {
+  const [value, setValue] = useState([3]);
+  const options: BoxSelectorOption<number>[] = [
+    {
+      description: 'description 1',
+      icon: Anchor,
+      iconType: 'badge',
+      id: '1',
+      value: 1,
+      label: 'option 1',
+    },
+    {
+      description: 'description 2',
+      icon: Briefcase,
+      iconType: 'badge',
+      id: '2',
+      value: 2,
+      label: 'option 2',
+    },
+    {
+      description: 'description 3',
+      icon: Docker,
+      id: '3',
+      value: 3,
+      label: 'option 2',
+    },
+  ];
+
+  return (
+    <BoxSelector
+      isMulti
+      radioName="name"
+      onChange={(value: number[]) => {
+        setValue(value);
+      }}
+      value={value}
+      options={options}
+    />
+  );
+}
+
+export function SlimMultiSelect() {
+  const [value, setValue] = useState([3]);
+  const options: BoxSelectorOption<number>[] = [
+    {
+      description: 'description 1',
+      icon: Anchor,
+      iconType: 'badge',
+      id: '1',
+      value: 1,
+      label: 'option 1',
+    },
+    {
+      description: 'description 2',
+      icon: Briefcase,
+      iconType: 'badge',
+      id: '2',
+      value: 2,
+      label: 'option 2',
+    },
+    {
+      description: 'description 3',
+      icon: Docker,
+      id: '3',
+      value: 3,
+      label: 'option 2',
+    },
+  ];
+
+  return (
+    <BoxSelector
+      isMulti
+      radioName="name"
+      onChange={(value: number[]) => {
+        setValue(value);
+      }}
+      value={value}
+      options={options}
+      slim
+    />
+  );
+}
diff --git a/app/react/components/BoxSelector/BoxSelector.test.tsx b/app/react/components/BoxSelector/BoxSelector.test.tsx
new file mode 100644
index 0000000..265ce87
--- /dev/null
+++ b/app/react/components/BoxSelector/BoxSelector.test.tsx
@@ -0,0 +1,65 @@
+import { Rocket } from 'lucide-react';
+import { render, fireEvent } from '@testing-library/react';
+
+import { BoxSelector } from './BoxSelector';
+import { BoxSelectorOption, Value } from './types';
+
+function renderDefault<T extends Value>({
+  options = [],
+  onChange = () => {},
+  radioName = 'radio',
+  value,
+}: {
+  options?: BoxSelectorOption<T>[];
+  onChange?: (value: T) => void;
+  radioName?: string;
+  value: T;
+}) {
+  return render(
+    <BoxSelector
+      options={options}
+      onChange={onChange}
+      radioName={radioName}
+      value={value}
+    />
+  );
+}
+
+test('should render with the initial value selected and call onChange when clicking a different value', async () => {
+  const options: BoxSelectorOption<number>[] = [
+    {
+      description: 'description 1',
+      icon: Rocket,
+      id: '1',
+      value: 3,
+      label: 'option 1',
+    },
+    {
+      description: 'description 2',
+      icon: Rocket,
+      id: '2',
+      value: 4,
+      label: 'option 2',
+    },
+  ];
+
+  const onChange = vi.fn();
+  const { getByLabelText } = renderDefault({
+    options,
+    onChange,
+    value: options[0].value,
+  });
+
+  const item1 = getByLabelText(options[0].label, {
+    exact: false,
+  }) as HTMLInputElement;
+  expect(item1.checked).toBeTruthy();
+
+  const item2 = getByLabelText(options[1].label, {
+    exact: false,
+  }) as HTMLInputElement;
+  expect(item2.checked).toBeFalsy();
+
+  fireEvent.click(item2);
+  expect(onChange).toHaveBeenCalledWith(options[1].value, false);
+});
diff --git a/app/react/components/BoxSelector/BoxSelector.tsx b/app/react/components/BoxSelector/BoxSelector.tsx
new file mode 100644
index 0000000..f7af4f1
--- /dev/null
+++ b/app/react/components/BoxSelector/BoxSelector.tsx
@@ -0,0 +1,113 @@
+import clsx from 'clsx';
+
+import { FormError } from '@@/form-components/FormError';
+import { FormSectionTitle } from '@@/form-components/FormSectionTitle';
+
+import { BoxSelectorItem } from './BoxSelectorItem';
+import { BoxSelectorOption, Value } from './types';
+
+interface IsMultiProps<T extends Value> {
+  isMulti: true;
+  value: T[];
+  onChange(value: T[], limitedToBE: boolean): void;
+}
+
+interface SingleProps<T extends Value> {
+  isMulti?: never;
+  value: T;
+  onChange(value: T, limitedToBE: boolean): void;
+}
+
+type Union<T extends Value> = IsMultiProps<T> | SingleProps<T>;
+
+export type Props<T extends Value> = Union<T> & {
+  radioName: string;
+  options: ReadonlyArray<BoxSelectorOption<T>> | Array<BoxSelectorOption<T>>;
+  slim?: boolean;
+  hiddenSpacingCount?: number;
+  error?: string;
+  useGridLayout?: boolean;
+  className?: string;
+  label?: string;
+};
+
+export function BoxSelector<T extends Value>({
+  radioName,
+  options,
+  slim = false,
+  hiddenSpacingCount,
+  error,
+  useGridLayout,
+  className,
+  label,
+  ...props
+}: Props<T>) {
+  const rootClassName = clsx(
+    useGridLayout
+      ? 'grid grid-cols-1 gap-2.5 sm:grid-cols-2 lg:grid-cols-3 xl:grid-cols-4'
+      : 'mb-1 mt-1 flex w-full flex-wrap gap-2.5 overflow-hidden',
+    className
+  );
+
+  return (
+    <>
+      {!!label && <FormSectionTitle>{label}</FormSectionTitle>}
+      <div className='form-group after:clear-both after:table after:content-[""]'>
+        <div className="col-sm-12">
+          <div
+            className={rootClassName}
+            role={props.isMulti ? 'group' : 'radiogroup'}
+            aria-label={label}
+          >
+            {options
+              .filter((option) => !option.hide)
+              .map(({ disabled, ...option }) => (
+                <BoxSelectorItem
+                  key={option.id}
+                  radioName={radioName}
+                  option={option}
+                  onSelect={handleSelect}
+                  disabled={
+                    typeof disabled === 'function' ? disabled() : disabled
+                  }
+                  tooltip={option.tooltip && option.tooltip()}
+                  type={props.isMulti ? 'checkbox' : 'radio'}
+                  isSelected={isSelected}
+                  slim={slim}
+                />
+              ))}
+            {hiddenSpacingCount &&
+              Array.from(Array(hiddenSpacingCount)).map((_, index) => (
+                <div key={index} className="flex-1" />
+              ))}
+          </div>
+          {!!error && <FormError>{error}</FormError>}
+        </div>
+      </div>
+    </>
+  );
+
+  function handleSelect(optionValue: T, limitedToBE: boolean) {
+    if (props.isMulti) {
+      const newValue = isSelected(optionValue)
+        ? props.value.filter((v) => v !== optionValue)
+        : [...props.value, optionValue];
+      props.onChange(newValue, limitedToBE);
+      return;
+    }
+
+    if (isSelected(optionValue)) {
+      return;
+    }
+
+    props.onChange(optionValue, limitedToBE);
+  }
+
+  function isSelected(optionValue: T) {
+    if (props.isMulti) {
+      return props.value.includes(optionValue);
+    }
+
+    return props.value === optionValue;
+  }
+}
diff --git a/app/react/components/BoxSelector/BoxSelectorItem.module.css b/app/react/components/BoxSelector/BoxSelectorItem.module.css
new file mode 100644
index 0000000..1bb2192
--- /dev/null
+++ b/app/react/components/BoxSelector/BoxSelectorItem.module.css
@@ -0,0 +1,49 @@
+.box-selector-item {
+  flex: 1;
+}
+
+.box-selector-item .header {
+  @apply text-black;
+  @apply th-dark:text-white;
+  @apply th-highcontrast:text-white;
+
+  font-size: 18px;
+  font-weight: bold;
+  user-select: none;
+}
+
+.image-container {
+  margin-bottom: 0;
+  text-align: left;
+}
+
+.icon,
+.icon img {
+  font-size: 90px;
+}
+
+.slim .icon {
+  font-size: 56px;
+}
+
+.icon > svg {
+  margin-left: -5px;
+}
+
+.header pr-icon {
+  margin-right: 5px;
+}
+
+.content {
+  padding-left: 20px;
+}
+
+/* used for BE teaser */
+.box-selector-item.limited.business label,
+.box-selector-item.limited.business input:checked + label {
+  @apply border-gray-6 bg-gray-6 bg-opacity-10;
+  @apply th-dark:border-gray-6 th-dark:bg-gray-6 th-dark:bg-opacity-10;
+  @apply th-highcontrast:border-gray-6 th-highcontrast:bg-gray-6 th-highcontrast:bg-opacity-10;
+
+  filter: none;
+}
diff --git a/app/react/components/BoxSelector/BoxSelectorItem.stories.tsx b/app/react/components/BoxSelector/BoxSelectorItem.stories.tsx
new file mode 100644
index 0000000..1e47109
--- /dev/null
+++ b/app/react/components/BoxSelector/BoxSelectorItem.stories.tsx
@@ -0,0 +1,115 @@
+import { Meta } from '@storybook/react-webpack5';
+import { ReactNode } from 'react';
+import { Briefcase } from 'lucide-react';
+
+import { init as initFeatureService } from '@/react/portainer/feature-flags/feature-flags.service';
+import { Edition, FeatureId } from '@/react/portainer/feature-flags/enums';
+import Docker from '@/assets/ico/vendor/docker.svg?c';
+
+import { IconProps } from '@@/Icon';
+
+import { BoxSelectorItem } from './BoxSelectorItem';
+import { BoxSelectorOption } from './types';
+
+const meta: Meta = {
+  title: 'Components/BoxSelector/Item',
+  args: {
+    selected: false,
+    description: 'description',
+    icon: Briefcase,
+    label: 'label',
+  },
+};
+
+export default meta;
+
+interface ExampleProps {
+  selected?: boolean;
+  description?: string;
+  icon?: IconProps['icon'];
+  label?: string;
+  feature?: FeatureId;
+}
+
+function Template({
+  selected = false,
+  description = 'description',
+  icon,
+  label = 'label',
+  feature,
+}: ExampleProps) {
+  const option: BoxSelectorOption<number> = {
+    description,
+    icon,
+    id: 'id',
+    label,
+    value: 1,
+    feature,
+  };
+
+  return (
+    <div className="boxselector_wrapper">
+      <BoxSelectorItem
+        onSelect={() => {}}
+        option={option}
+        radioName="radio"
+        isSelected={() => selected}
+      />
+    </div>
+  );
+}
+
+export const Example = Template.bind({});
+
+export function SelectedItem() {
+  return <Template selected />;
+}
+
+SelectedItem.args = {
+  selected: true,
+};
+
+export function LimitedFeatureItem() {
+  initFeatureService(Edition.CE);
+
+  return <Template feature={FeatureId.ACTIVITY_AUDIT} />;
+}
+
+export function SelectedLimitedFeatureItem() {
+  initFeatureService(Edition.CE);
+
+  return <Template feature={FeatureId.ACTIVITY_AUDIT} selected />;
+}
+
+function IconTemplate({
+  icon,
+  iconType,
+}: {
+  icon: ReactNode;
+  iconType: 'raw' | 'logo' | 'badge';
+}) {
+  return (
+    <BoxSelectorItem
+      onSelect={() => {}}
+      option={{
+        description: 'description',
+        icon,
+        iconType,
+        label: 'label',
+        id: 'id',
+        value: 'value',
+      }}
+      isSelected={() => false}
+      radioName="radio"
+      slim
+    />
+  );
+}
+
+export function LogoItem() {
+  return <IconTemplate icon={Docker} iconType="logo" />;
+}
+
+export function BadgeItem() {
+  return <IconTemplate icon={Briefcase} iconType="badge" />;
+}
diff --git a/app/react/components/BoxSelector/BoxSelectorItem.tsx b/app/react/components/BoxSelector/BoxSelectorItem.tsx
new file mode 100644
index 0000000..6a501f9
--- /dev/null
+++ b/app/react/components/BoxSelector/BoxSelectorItem.tsx
@@ -0,0 +1,109 @@
+import clsx from 'clsx';
+import { type LucideIcon, Check } from 'lucide-react';
+import { Fragment } from 'react';
+
+import { Icon } from '@/react/components/Icon';
+
+import { BadgeIcon } from '@@/BadgeIcon';
+import { getFeatureDetails } from '@@/BEFeatureIndicator/utils';
+
+import styles from './BoxSelectorItem.module.css';
+import { BoxSelectorOption, Value } from './types';
+import { LimitedToBeBoxSelectorIndicator } from './LimitedToBeBoxSelectorIndicator';
+import { BoxOption } from './BoxOption';
+import { LogoIcon } from './LogoIcon';
+
+type Props<T extends Value> = {
+  option: BoxSelectorOption<T>;
+  radioName: string;
+  disabled?: boolean;
+  tooltip?: string;
+  onSelect(value: T, limitedToBE: boolean): void;
+  isSelected(value: T): boolean;
+  type?: 'radio' | 'checkbox';
+  slim?: boolean;
+  checkIcon?: LucideIcon;
+};
+
+export function BoxSelectorItem<T extends Value>({
+  radioName,
+  option,
+  onSelect = () => {},
+  disabled,
+  tooltip,
+  type = 'radio',
+  isSelected,
+  slim = false,
+  checkIcon = Check,
+}: Props<T>) {
+  const { limitedToBE = false, url: featureUrl } = getFeatureDetails(
+    option.feature
+  );
+
+  const ContentBox = slim ? 'div' : Fragment;
+
+  return (
+    <BoxOption
+      className={clsx(styles.boxSelectorItem, {
+        [styles.business]: limitedToBE,
+        [styles.limited]: limitedToBE,
+      })}
+      radioName={radioName}
+      option={option}
+      isSelected={isSelected}
+      disabled={isDisabled()}
+      onSelect={(value) => onSelect(value, limitedToBE)}
+      tooltip={tooltip}
+      type={type}
+      checkIcon={checkIcon}
+    >
+      {limitedToBE && (
+        <LimitedToBeBoxSelectorIndicator
+          url={featureUrl}
+          // show tooltip only for radio type options because be-only checkbox options can't be selected
+          showTooltip={type === 'radio'}
+        />
+      )}
+      <div
+        className={clsx('flex min-w-[140px] gap-2', {
+          'opacity-30': limitedToBE,
+          'h-full flex-col justify-start': !slim,
+          'slim items-center': slim,
+        })}
+      >
+        <div className={clsx(styles.imageContainer, 'flex items-start')}>
+          {renderIcon()}
+        </div>
+        <ContentBox>
+          <div className={styles.header}>{option.label}</div>
+          <div className="mb-0">{option.description}</div>
+        </ContentBox>
+      </div>
+    </BoxOption>
+  );
+
+  function isDisabled() {
+    return disabled || (limitedToBE && option.disabledWhenLimited);
+  }
+
+  function renderIcon() {
+    if (!option.icon) {
+      return null;
+    }
+
+    if (option.iconType === 'badge') {
+      return <BadgeIcon icon={option.icon} iconClass={option.iconClass} />;
+    }
+
+    if (option.iconType === 'raw') {
+      return (
+        <Icon
+          icon={option.icon}
+          className={clsx(styles.icon, option.iconClass, '!flex items-center')}
+        />
+      );
+    }
+
+    return <LogoIcon icon={option.icon} iconClass={option.iconClass} />;
+  }
+}
diff --git a/app/react/components/BoxSelector/LimitedToBeBoxSelectorIndicator.tsx b/app/react/components/BoxSelector/LimitedToBeBoxSelectorIndicator.tsx
new file mode 100644
index 0000000..1418e08
--- /dev/null
+++ b/app/react/components/BoxSelector/LimitedToBeBoxSelectorIndicator.tsx
@@ -0,0 +1,36 @@
+import { Briefcase } from 'lucide-react';
+
+import { Icon } from '@@/Icon';
+import { Tooltip } from '@@/Tip/Tooltip';
+
+interface Props {
+  url?: string;
+  showTooltip?: boolean;
+}
+
+export function LimitedToBeBoxSelectorIndicator({
+  url,
+  showTooltip = true,
+}: Props) {
+  return (
+    <div className="absolute left-0 top-0 w-full">
+      <div className="mx-auto flex max-w-fit items-center rounded-b-lg border border-t-0 border-solid border-gray-6 bg-transparent px-3 py-1 text-gray-6">
+        <a
+          className="inline-flex items-center text-xs text-gray-6"
+          href={url}
+          target="_blank"
+          rel="noreferrer"
+        >
+          <Icon icon={Briefcase} className="!mr-1" />
+          <span>Business Feature</span>
+        </a>
+        {showTooltip && (
+          <Tooltip
+            size="sm"
+            message="Select this option to preview this business feature."
+          />
+        )}
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/components/BoxSelector/LogoIcon.tsx b/app/react/components/BoxSelector/LogoIcon.tsx
new file mode 100644
index 0000000..acbfecf
--- /dev/null
+++ b/app/react/components/BoxSelector/LogoIcon.tsx
@@ -0,0 +1,13 @@
+import clsx from 'clsx';
+
+import { Icon, IconProps } from '@@/Icon';
+
+type Props = IconProps;
+
+export function LogoIcon({ icon, iconClass }: Props) {
+  return (
+    <div className="inline-flex h-14 w-14 items-center justify-center text-7xl">
+      <Icon icon={icon} className={clsx('!flex', iconClass)} />
+    </div>
+  );
+}
diff --git a/app/react/components/BoxSelector/common-options/build-methods.tsx b/app/react/components/BoxSelector/common-options/build-methods.tsx
new file mode 100644
index 0000000..9c6366a
--- /dev/null
+++ b/app/react/components/BoxSelector/common-options/build-methods.tsx
@@ -0,0 +1,63 @@
+import { Edit, FileText, Globe, UploadCloud } from 'lucide-react';
+
+import GitIcon from '@/assets/ico/git.svg?c';
+import Helm from '@/assets/ico/helm.svg?c';
+
+import { BoxSelectorOption } from '../types';
+
+export const editor: BoxSelectorOption<'editor'> = {
+  id: 'method_editor',
+  icon: Edit,
+  iconType: 'badge',
+  label: 'Web editor',
+  value: 'editor',
+};
+
+export const upload: BoxSelectorOption<'upload'> = {
+  id: 'method_upload',
+  icon: UploadCloud,
+  iconType: 'badge',
+  label: 'Upload',
+  value: 'upload',
+};
+
+export const git: BoxSelectorOption<'repository'> = {
+  id: 'method_repository',
+  icon: GitIcon,
+  iconType: 'logo',
+  label: 'Repository',
+  value: 'repository',
+};
+
+export const edgeStackTemplate: BoxSelectorOption<'template'> = {
+  id: 'method_template',
+  icon: FileText,
+  iconType: 'badge',
+  label: 'Template',
+  description: 'Use an Edge stack app or custom template',
+  value: 'template',
+};
+
+export const customTemplate: BoxSelectorOption<'template'> = {
+  id: 'method_template',
+  icon: FileText,
+  iconType: 'badge',
+  label: 'Custom template',
+  value: 'template',
+};
+
+export const helm: BoxSelectorOption<'helm'> = {
+  id: 'method_helm',
+  icon: Helm,
+  label: 'Helm chart',
+  value: 'helm',
+  iconClass: '!text-[#0f1689] th-dark:!text-white th-highcontrast:!text-white',
+};
+
+export const url: BoxSelectorOption<'url'> = {
+  id: 'method_url',
+  icon: Globe,
+  iconType: 'badge',
+  label: 'URL',
+  value: 'url',
+};
diff --git a/app/react/components/BoxSelector/common-options/deployment-methods.tsx b/app/react/components/BoxSelector/common-options/deployment-methods.tsx
new file mode 100644
index 0000000..676ea7a
--- /dev/null
+++ b/app/react/components/BoxSelector/common-options/deployment-methods.tsx
@@ -0,0 +1,22 @@
+import Kubernetes from '@/assets/ico/vendor/kubernetes.svg?c';
+import DockerCompose from '@/assets/ico/vendor/docker-compose.svg?c';
+
+import { BoxSelectorOption } from '../types';
+
+export const kubernetes: BoxSelectorOption<'kubernetes'> = {
+  id: 'method_kubernetes',
+  icon: Kubernetes,
+  label: 'Kubernetes',
+  description: 'Kubernetes manifest format',
+  value: 'kubernetes',
+  iconType: 'logo',
+};
+
+export const compose: BoxSelectorOption<'compose'> = {
+  id: 'method_compose',
+  icon: DockerCompose,
+  label: 'Compose',
+  description: 'docker-compose format',
+  value: 'compose',
+  iconType: 'logo',
+};
diff --git a/app/react/components/BoxSelector/index.ts b/app/react/components/BoxSelector/index.ts
new file mode 100644
index 0000000..6563fb6
--- /dev/null
+++ b/app/react/components/BoxSelector/index.ts
@@ -0,0 +1,2 @@
+export { BoxSelector } from './BoxSelector';
+export type { BoxSelectorOption } from './types';
diff --git a/app/react/components/BoxSelector/types.ts b/app/react/components/BoxSelector/types.ts
new file mode 100644
index 0000000..6cbd1cf
--- /dev/null
+++ b/app/react/components/BoxSelector/types.ts
@@ -0,0 +1,21 @@
+import { ReactNode } from 'react';
+
+import type { FeatureId } from '@/react/portainer/feature-flags/enums';
+
+import { IconProps } from '@@/Icon';
+
+export type Value = number | string | boolean;
+
+export interface BoxSelectorOption<T extends Value> extends IconProps {
+  readonly id: string;
+  readonly label: string;
+  readonly description?: ReactNode;
+  readonly value: T;
+  readonly disabled?: boolean | (() => boolean);
+  readonly tooltip?: () => string;
+  readonly feature?: FeatureId;
+  readonly disabledWhenLimited?: boolean;
+  readonly hide?: boolean;
+  readonly iconType?: 'raw' | 'badge' | 'logo';
+  readonly iconClass?: string;
+}
diff --git a/app/react/components/Code/Code.module.css b/app/react/components/Code/Code.module.css
new file mode 100644
index 0000000..f5e5da4
--- /dev/null
+++ b/app/react/components/Code/Code.module.css
@@ -0,0 +1,19 @@
+.code {
+  display: block;
+  white-space: pre-wrap;
+  word-break: break-word;
+  padding: 20px;
+}
+
+.root {
+  position: relative;
+}
+
+.copy-button {
+  position: absolute;
+  top: min(20px, 25%);
+  right: 20px;
+  padding: 0;
+  outline: none !important;
+  margin: 0;
+}
diff --git a/app/react/components/Code/Code.stories.tsx b/app/react/components/Code/Code.stories.tsx
new file mode 100644
index 0000000..afcc625
--- /dev/null
+++ b/app/react/components/Code/Code.stories.tsx
@@ -0,0 +1,34 @@
+import { Meta, StoryFn } from '@storybook/react-webpack5';
+
+import { Code } from './Code';
+
+export default {
+  component: Code,
+  title: 'Components/Code',
+} as Meta;
+
+interface Args {
+  text: string;
+  showCopyButton?: boolean;
+}
+
+function Template({ text, showCopyButton }: Args) {
+  return <Code showCopyButton={showCopyButton}>{text}</Code>;
+}
+
+export const Primary: StoryFn<Args> = Template.bind({});
+Primary.args = {
+  text: 'curl -X GET http://ultra-sound-money.eth',
+  showCopyButton: true,
+};
+
+export const MultiLine: StoryFn<Args> = Template.bind({});
+MultiLine.args = {
+  text: 'curl -X\n GET http://example-with-children.crypto',
+};
+
+export const MultiLineWithIcon: StoryFn<Args> = Template.bind({});
+MultiLineWithIcon.args = {
+  text: 'curl -X\n GET http://example-with-children.crypto',
+  showCopyButton: true,
+};
diff --git a/app/react/components/Code/Code.test.tsx b/app/react/components/Code/Code.test.tsx
new file mode 100644
index 0000000..48e5efd
--- /dev/null
+++ b/app/react/components/Code/Code.test.tsx
@@ -0,0 +1,11 @@
+import { render } from '@testing-library/react';
+
+import { Code } from './Code';
+
+test('should display a Code with children', async () => {
+  const children = 'test text code component';
+  const { findByText } = render(<Code>{children}</Code>);
+
+  const heading = await findByText(children);
+  expect(heading).toBeTruthy();
+});
diff --git a/app/react/components/Code/Code.tsx b/app/react/components/Code/Code.tsx
new file mode 100644
index 0000000..72db4ad
--- /dev/null
+++ b/app/react/components/Code/Code.tsx
@@ -0,0 +1,37 @@
+import { Check, Copy } from 'lucide-react';
+
+import { Button } from '@@/buttons';
+import { useCopy } from '@@/buttons/CopyButton/useCopy';
+import { Icon } from '@@/Icon';
+
+import styles from './Code.module.css';
+
+interface Props {
+  showCopyButton?: boolean;
+  children: string;
+}
+
+export function Code({ children, showCopyButton }: Props) {
+  const { handleCopy, copiedSuccessfully } = useCopy(children);
+
+  return (
+    <div className={styles.root}>
+      <code className={styles.code}>{children}</code>
+
+      {showCopyButton && (
+        <Button
+          color="link"
+          className={styles.copyButton}
+          onClick={handleCopy}
+          data-cy="code-copy-button"
+        >
+          <Icon
+            icon={copiedSuccessfully ? Check : Copy}
+            className="!ml-1"
+            mode={copiedSuccessfully ? 'success' : undefined}
+          />
+        </Button>
+      )}
+    </div>
+  );
+}
diff --git a/app/react/components/Code/index.ts b/app/react/components/Code/index.ts
new file mode 100644
index 0000000..dddc751
--- /dev/null
+++ b/app/react/components/Code/index.ts
@@ -0,0 +1 @@
+export { Code } from './Code';
diff --git a/app/react/components/CodeEditor/CodeEditor.module.css b/app/react/components/CodeEditor/CodeEditor.module.css
new file mode 100644
index 0000000..e31773b
--- /dev/null
+++ b/app/react/components/CodeEditor/CodeEditor.module.css
@@ -0,0 +1,209 @@
+.root {
+  --text-cm-default-color: var(--blue-1);
+  --text-cm-meta-color: var(--black-color);
+  --text-cm-string-color: var(--red-3);
+  --text-cm-number-color: var(--green-1);
+  --text-cm-keyword-color: var(--ui-blue-dark-9);
+  --text-cm-comment-color: var(--ui-orange-6);
+  --text-cm-variable-name-color: var(--ui-green-8);
+  --text-codemirror-color: var(--black-color);
+  --bg-codemirror-color: var(--white-color);
+  --bg-codemirror-gutters-color: var(--grey-17);
+  --bg-codemirror-selected-color: var(--grey-22);
+  --border-codemirror-cursor-color: var(--black-color);
+  --bg-tooltip-color: var(--white-color);
+  --text-tooltip-color: var(--black-color);
+}
+
+:global([theme='dark']) .root {
+  --text-cm-default-color: var(--blue-10);
+  --text-cm-meta-color: var(--white-color);
+  --text-cm-string-color: var(--red-5);
+  --text-cm-number-color: var(--green-2);
+  --text-cm-keyword-color: var(--ui-purple-6);
+  --text-codemirror-color: var(--white-color);
+  --bg-codemirror-color: var(--grey-2);
+  --bg-codemirror-gutters-color: var(--grey-3);
+  --bg-codemirror-selected-color: var(--grey-3);
+  --border-codemirror-cursor-color: var(--white-color);
+  --bg-tooltip-color: var(--grey-3);
+  --text-tooltip-color: var(--white-color);
+}
+
+:global([theme='highcontrast']) .root {
+  --text-cm-default-color: var(--blue-9);
+  --text-cm-meta-color: var(--white-color);
+  --text-cm-string-color: var(--red-7);
+  --text-cm-number-color: var(--green-2);
+  --text-cm-keyword-color: var(--ui-purple-6);
+  --text-codemirror-color: var(--white-color);
+  --bg-codemirror-color: var(--black-color);
+  --bg-codemirror-gutters-color: var(--ui-gray-warm-11);
+  --bg-codemirror-selected-color: var(--grey-3);
+  --border-codemirror-cursor-color: var(--white-color);
+  --bg-tooltip-color: var(--black-color);
+  --text-tooltip-color: var(--white-color);
+}
+
+.root :global(.cm-editor .cm-gutters) {
+  border-right: 0px;
+  @apply bg-gray-2 th-highcontrast:bg-black th-dark:bg-gray-10;
+}
+
+.root :global(.cm-merge-b) {
+  @apply border-0 border-l border-solid border-l-gray-5 th-highcontrast:border-l-gray-2 th-dark:border-l-gray-7;
+}
+
+.root :global(.cm-editor .cm-gutters .cm-lineNumbers .cm-gutterElement) {
+  text-align: left;
+}
+
+.codeEditor :global(.cm-editor),
+.codeEditor :global(.cm-editor .cm-scroller) {
+  border-radius: 8px;
+}
+
+/* code mirror merge side-by-side editor */
+.root :global(.cm-merge-a),
+.root :global(.cm-merge-a .cm-scroller) {
+  @apply !rounded-r-none;
+}
+
+.root :global(.cm-merge-b),
+.root :global(.cm-merge-b .cm-scroller) {
+  @apply !rounded-l-none;
+}
+
+/*  Search Panel  */
+/* Ideally we would use a react component for that, but this is the easy solution for onw */
+
+.root :global(.cm-panels.cm-panels-bottom) {
+  background-color: var(--bg-codemirror-gutters-color);
+  border-top-color: transparent;
+  color: var(--text-codemirror-color);
+  z-index: inherit;
+}
+
+.root :global(.cm-button) {
+  background-image: none;
+  border-radius: 4px;
+  gap: 5px;
+}
+
+.root :global(.cm-button[name='next']),
+.root :global(.cm-button[name='replace']) {
+  @apply border-blue-8 bg-blue-8 text-white;
+  @apply hover:border-blue-9 hover:bg-blue-9 hover:text-white;
+  @apply th-dark:hover:border-blue-7 th-dark:hover:bg-blue-7;
+}
+
+.root :global(.cm-button[name='prev']),
+.root :global(.cm-button[name='replaceAll']) {
+  @apply border border-solid;
+
+  @apply border-blue-8 bg-blue-2 text-blue-9;
+  @apply hover:bg-blue-3;
+
+  @apply th-dark:border-blue-7 th-dark:bg-gray-10 th-dark:text-blue-3;
+  @apply th-dark:hover:bg-blue-11;
+}
+
+.root :global(.cm-button[name='select']) {
+  @apply border-gray-5 bg-white text-gray-9;
+  @apply hover:border-gray-5 hover:bg-gray-3 hover:text-gray-10;
+
+  /* dark mode */
+  @apply th-dark:border-gray-warm-7 th-dark:bg-gray-iron-10 th-dark:text-gray-warm-4;
+  @apply th-dark:hover:border-gray-6 th-dark:hover:bg-gray-iron-9 th-dark:hover:text-gray-warm-4;
+
+  @apply th-highcontrast:border-gray-2 th-highcontrast:bg-black th-highcontrast:text-white;
+  @apply th-highcontrast:hover:border-gray-6 th-highcontrast:hover:bg-gray-9 th-highcontrast:hover:text-gray-warm-4;
+}
+
+.root :global(.cm-search) label {
+  font-weight: 400;
+  @apply text-gray-7;
+  @apply th-dark:text-gray-warm-3;
+  @apply th-highcontrast:text-white;
+}
+
+.root :global(.cm-search) input {
+  border-radius: 4px;
+}
+
+.root :global(.cm-textfield) {
+  border: 1px solid var(--border-form-control-color);
+  background-color: var(--bg-inputbox);
+  color: var(--text-form-control-color);
+}
+
+.root :global(.cm-content[contenteditable='true']) {
+  min-height: 100%;
+}
+
+.root :global(.cm-content[aria-readonly='true']) {
+  /* make sure the bg has transparency, so that the selected text is visible */
+  /* https://discuss.codemirror.net/t/how-do-i-get-selected-text-to-highlight/7115/2 */
+  @apply bg-gray-3/50;
+  @apply th-dark:bg-gray-iron-10/50;
+  @apply th-highcontrast:bg-black/50;
+}
+
+.root :global(.cm-textfield) {
+  border: 1px solid var(--border-form-control-color);
+  background-color: var(--bg-inputbox);
+  color: var(--text-form-control-color);
+  @apply text-xs;
+}
+
+.root :global(.cm-button) {
+  @apply text-xs;
+}
+
+.root :global(.cm-panel.cm-search label) {
+  @apply text-xs;
+}
+
+/* Tooltip styles for all themes */
+.root :global(.cm-tooltip) {
+  @apply h-min rounded border border-solid border-gray-5 bg-white text-xs shadow-md;
+  @apply th-dark:border-gray-7 th-dark:bg-gray-9 th-dark:text-white;
+  @apply th-highcontrast:border-gray-7 th-highcontrast:bg-black th-highcontrast:text-white;
+}
+
+/* Hide the completionInfo tooltip when it's empty */
+/* note: I only chose the complicated selector because the simple selector `.cm-tooltip.cm-completionInfo:empty` didn't work */
+.root :global(.cm-tooltip.cm-completionInfo:not(:has(*:not(:empty)))) {
+  display: none;
+}
+
+/* Active line gutter styles for all themes */
+.root :global(.cm-activeLineGutter) {
+  @apply bg-inherit;
+}
+
+/* Collapsed lines gutter styles for all themes */
+.root :global(.cm-editor .cm-collapsedLines) {
+  /* inherit bg, instead of using styles from library */
+  background: inherit;
+  @apply bg-blue-2 th-highcontrast:bg-white th-highcontrast:text-black th-dark:bg-blue-10 th-dark:text-white;
+}
+.root :global(.cm-editor .cm-collapsedLines):hover {
+  @apply bg-blue-3 th-highcontrast:bg-white th-highcontrast:text-black th-dark:bg-blue-9 th-dark:text-white;
+}
+
+.root :global(.cm-editor .cm-collapsedLines:before) {
+  content: '↧ Expand all';
+  background: var(--bg-tooltip-color);
+  color: var(--text-tooltip-color);
+  padding: 4px 8px;
+  border-radius: 4px;
+  font-size: 12px;
+  white-space: nowrap;
+  z-index: 1000;
+  margin-left: 4px;
+}
+/* override the default content */
+.root :global(.cm-editor .cm-collapsedLines:after) {
+  content: '';
+}
diff --git a/app/react/components/CodeEditor/CodeEditor.test.tsx b/app/react/components/CodeEditor/CodeEditor.test.tsx
new file mode 100644
index 0000000..8db57da
--- /dev/null
+++ b/app/react/components/CodeEditor/CodeEditor.test.tsx
@@ -0,0 +1,135 @@
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { Extension } from '@codemirror/state';
+
+import { mockClipboard } from '@/react/test-utils/clipboard';
+
+import { CodeEditor } from './CodeEditor';
+
+const mockExtension: Extension = { extension: [] };
+vi.mock('yaml-schema', () => ({
+  // yamlSchema has 5 return values (all extensions)
+  yamlSchema: () => [
+    mockExtension,
+    mockExtension,
+    mockExtension,
+    mockExtension,
+    mockExtension,
+  ],
+  yamlCompletion: () => () => ({}),
+}));
+
+const defaultProps = {
+  id: 'test-editor',
+  onChange: vi.fn(),
+  value: '',
+  'data-cy': 'test-editor',
+};
+
+beforeEach(() => {
+  vi.clearAllMocks();
+});
+
+test('should render with basic props', () => {
+  render(<CodeEditor {...defaultProps} />);
+  expect(screen.getByRole('textbox')).toBeInTheDocument();
+});
+
+test('should display placeholder when provided', async () => {
+  const placeholder = 'Enter your code here';
+  const { findByText } = render(
+    <CodeEditor {...defaultProps} textTip={placeholder} />
+  );
+
+  const placeholderText = await findByText(placeholder);
+  expect(placeholderText).toBeVisible();
+});
+
+test('should show copy button and copy content', async () => {
+  const testValue = 'test content';
+  const { writeText } = mockClipboard();
+
+  const { findByText } = render(
+    <CodeEditor {...defaultProps} value={testValue} />
+  );
+
+  const copyButton = await findByText('Copy');
+  expect(copyButton).toBeVisible();
+
+  await userEvent.click(copyButton);
+  expect(writeText).toHaveBeenCalledWith(testValue);
+});
+
+test('should handle read-only mode', async () => {
+  const { findByRole } = render(<CodeEditor {...defaultProps} readonly />);
+  const editor = await findByRole('textbox');
+  // the editor should not editable
+  await userEvent.type(editor, 'test');
+  expect(editor).not.toHaveValue('test');
+});
+
+test('should show version selector when versions are provided', async () => {
+  const versions = [1, 2, 3];
+  const onVersionChange = vi.fn();
+  const { findByRole } = render(
+    <CodeEditor
+      {...defaultProps}
+      versions={versions}
+      onVersionChange={onVersionChange}
+    />
+  );
+
+  const selector = await findByRole('combobox');
+  expect(selector).toBeVisible();
+});
+
+test('should handle YAML indentation correctly', async () => {
+  const onChange = vi.fn();
+  const yamlContent = 'services:';
+
+  const { findByRole } = render(
+    <CodeEditor
+      {...defaultProps}
+      value={yamlContent}
+      onChange={onChange}
+      type="yaml"
+    />
+  );
+
+  const editor = await findByRole('textbox');
+  await userEvent.type(editor, '{enter}');
+  await userEvent.keyboard('database:');
+  await userEvent.keyboard('{enter}');
+  await userEvent.keyboard('image: nginx');
+  await userEvent.keyboard('{enter}');
+  await userEvent.keyboard('name: database');
+
+  // Wait for the debounced onChange to be called
+  setTimeout(() => {
+    expect(onChange).toHaveBeenCalledWith(
+      'services:\n  database:\n    image: nginx\n    name: database'
+    );
+    // debounce timeout is 300ms, so 500ms is enough
+  }, 500);
+});
+
+test('should apply custom height', async () => {
+  const customHeight = '300px';
+  const { findByRole } = render(
+    <CodeEditor {...defaultProps} height={customHeight} />
+  );
+
+  const editor = await findByRole('textbox');
+  expect(editor).toHaveStyle({ height: customHeight });
+});
+
+test('should render with file name header when provided', async () => {
+  const fileName = 'example.yaml';
+  const testValue = 'file content';
+  const { findByText } = render(
+    <CodeEditor {...defaultProps} fileName={fileName} value={testValue} />
+  );
+
+  expect(await findByText(fileName)).toBeInTheDocument();
+  expect(await findByText(testValue)).toBeInTheDocument();
+});
diff --git a/app/react/components/CodeEditor/CodeEditor.tsx b/app/react/components/CodeEditor/CodeEditor.tsx
new file mode 100644
index 0000000..1bf4bc0
--- /dev/null
+++ b/app/react/components/CodeEditor/CodeEditor.tsx
@@ -0,0 +1,168 @@
+import CodeMirror from '@uiw/react-codemirror';
+import { AriaAttributes, useCallback, useState } from 'react';
+import { createTheme } from '@uiw/codemirror-themes';
+import { tags as highlightTags } from '@lezer/highlight';
+import type { JSONSchema7 } from 'json-schema';
+import clsx from 'clsx';
+
+import { AutomationTestingProps } from '@/types';
+
+import { CopyButton } from '@@/buttons/CopyButton';
+
+import { useDebounce } from '../../hooks/useDebounce';
+import { TextTip } from '../Tip/TextTip';
+import { StackVersionSelector } from '../StackVersionSelector';
+
+import styles from './CodeEditor.module.css';
+import {
+  useCodeEditorExtensions,
+  CodeEditorType,
+} from './useCodeEditorExtensions';
+import { FileNameHeader, FileNameHeaderRow } from './FileNameHeader';
+
+interface Props extends AutomationTestingProps {
+  id: string;
+  textTip?: string;
+  type?: CodeEditorType;
+  readonly?: boolean;
+  onChange?: (value: string) => void;
+  value: string;
+  height?: string;
+  versions?: number[];
+  onVersionChange?: (version: number) => void;
+  schema?: JSONSchema7;
+  fileName?: string;
+  placeholder?: string;
+  showToolbar?: boolean;
+}
+
+export const theme = createTheme({
+  theme: 'light',
+  settings: {
+    background: 'var(--bg-codemirror-color)',
+    foreground: 'var(--text-codemirror-color)',
+    caret: 'var(--border-codemirror-cursor-color)',
+    selection: 'var(--bg-codemirror-selected-color)',
+    selectionMatch: 'var(--bg-codemirror-selected-color)',
+  },
+  styles: [
+    {
+      tag: [highlightTags.propertyName, highlightTags.attributeName],
+      color: 'var(--text-cm-default-color)',
+    },
+    { tag: highlightTags.atom, color: 'var(--text-cm-default-color)' },
+    { tag: highlightTags.meta, color: 'var(--text-cm-meta-color)' },
+    {
+      tag: [highlightTags.string, highlightTags.special(highlightTags.brace)],
+      color: 'var(--text-cm-string-color)',
+    },
+    { tag: highlightTags.number, color: 'var(--text-cm-number-color)' },
+    { tag: highlightTags.keyword, color: 'var(--text-cm-keyword-color)' },
+    { tag: highlightTags.comment, color: 'var(--text-cm-comment-color)' },
+    {
+      tag: highlightTags.variableName,
+      color: 'var(--text-cm-variable-name-color)',
+    },
+  ],
+});
+
+export function CodeEditor({
+  id,
+  onChange = () => {},
+  textTip,
+  readonly,
+  value,
+  versions,
+  onVersionChange,
+  height = '500px',
+  type,
+  schema,
+  'data-cy': dataCy,
+  fileName,
+  placeholder,
+  showToolbar = true,
+  'aria-label': ariaLabel,
+}: Props & Pick<AriaAttributes, 'aria-label'>) {
+  const [isRollback, setIsRollback] = useState(false);
+
+  const extensions = useCodeEditorExtensions(type, schema);
+
+  const handleVersionChange = useCallback(
+    (version: number) => {
+      if (versions && versions.length > 1) {
+        setIsRollback(version < versions[0]);
+      }
+      onVersionChange?.(version);
+    },
+    [onVersionChange, versions]
+  );
+
+  const [debouncedValue, debouncedOnChange] = useDebounce(value, onChange);
+
+  return (
+    <>
+      {showToolbar && (
+        <div className="mb-2 flex flex-col">
+          <div className="flex items-center justify-between">
+            <div className="flex items-center">
+              {!!textTip && <TextTip color="blue">{textTip}</TextTip>}
+            </div>
+            {/* the copy button is in the file name header, when fileName is provided */}
+            {!fileName && (
+              <div className="flex-2 ml-auto mr-2 flex items-center gap-x-2">
+                <CopyButton
+                  data-cy={`copy-code-button-${id}`}
+                  fadeDelay={2500}
+                  copyText={value}
+                  color="link"
+                  className="!pr-0 !text-sm !font-medium hover:no-underline focus:no-underline"
+                  indicatorPosition="left"
+                >
+                  Copy
+                </CopyButton>
+              </div>
+            )}
+          </div>
+          {versions && (
+            <div className="mt-2 flex">
+              <div className="ml-auto mr-2">
+                <StackVersionSelector
+                  versions={versions}
+                  onChange={handleVersionChange}
+                />
+              </div>
+            </div>
+          )}
+        </div>
+      )}
+      <div className="overflow-hidden rounded-lg border border-solid border-gray-5 th-highcontrast:border-gray-2 th-dark:border-gray-7">
+        {fileName && (
+          <FileNameHeaderRow>
+            <FileNameHeader
+              fileName={fileName}
+              copyText={value}
+              data-cy={`copy-code-button-${id}`}
+            />
+          </FileNameHeaderRow>
+        )}
+        <CodeMirror
+          className={clsx(styles.root, styles.codeEditor)}
+          theme={theme}
+          value={debouncedValue}
+          onChange={debouncedOnChange}
+          readOnly={readonly || isRollback}
+          id={id}
+          extensions={extensions}
+          height={height}
+          basicSetup={{
+            highlightSelectionMatches: false,
+            autocompletion: !!schema,
+          }}
+          data-cy={dataCy}
+          placeholder={placeholder}
+          aria-label={ariaLabel || 'Code Editor'}
+        />
+      </div>
+    </>
+  );
+}
diff --git a/app/react/components/CodeEditor/DiffViewer.test.tsx b/app/react/components/CodeEditor/DiffViewer.test.tsx
new file mode 100644
index 0000000..9e8b1b8
--- /dev/null
+++ b/app/react/components/CodeEditor/DiffViewer.test.tsx
@@ -0,0 +1,101 @@
+import { render } from '@testing-library/react';
+import { vi, describe, it, expect, beforeEach } from 'vitest';
+
+import { DiffViewer } from './DiffViewer';
+
+// Mock CodeMirror
+vi.mock('@uiw/react-codemirror', () => ({
+  __esModule: true,
+  default: () => <div data-cy="mock-editor" />,
+  oneDarkHighlightStyle: {},
+  keymap: {
+    of: () => ({}),
+  },
+}));
+
+// Mock react-codemirror-merge
+vi.mock('react-codemirror-merge', () => {
+  function CodeMirrorMerge({ children }: { children: React.ReactNode }) {
+    return <div data-cy="mock-code-mirror-merge">{children}</div>;
+  }
+  function Original({ value }: { value: string }) {
+    return <div data-cy="mock-original">{value}</div>;
+  }
+  function Modified({ value }: { value: string }) {
+    return <div data-cy="mock-modified">{value}</div>;
+  }
+
+  CodeMirrorMerge.Original = Original;
+  CodeMirrorMerge.Modified = Modified;
+
+  return {
+    __esModule: true,
+    default: CodeMirrorMerge,
+    CodeMirrorMerge,
+  };
+});
+
+describe('DiffViewer', () => {
+  beforeEach(() => {
+    // Clear any mocks or state before each test
+    vi.clearAllMocks();
+  });
+
+  it('should render with basic props', () => {
+    const { getByText } = render(
+      <DiffViewer
+        originalCode="Original text"
+        newCode="New text"
+        id="test-diff-viewer"
+        data-cy="test-diff-viewer"
+      />
+    );
+
+    // Check if the component renders with the expected content
+    expect(getByText('Original text')).toBeInTheDocument();
+    expect(getByText('New text')).toBeInTheDocument();
+  });
+
+  it('should render with file name headers when provided', () => {
+    const { getByText } = render(
+      <DiffViewer
+        originalCode="Original text"
+        newCode="New text"
+        id="test-diff-viewer"
+        data-cy="test-diff-viewer"
+        fileNames={{
+          original: 'Original File',
+          modified: 'Modified File',
+        }}
+      />
+    );
+
+    // Look for elements with the expected class structure
+    const headerOriginal = getByText('Original File');
+    const headerModified = getByText('Modified File');
+    expect(headerOriginal).toBeInTheDocument();
+    expect(headerModified).toBeInTheDocument();
+  });
+
+  it('should apply custom height when provided', () => {
+    const customHeight = '800px';
+    const { container } = render(
+      <DiffViewer
+        originalCode="Original text"
+        newCode="New text"
+        id="test-diff-viewer"
+        data-cy="test-diff-viewer"
+        height={customHeight}
+      />
+    );
+
+    // Find the element with the style containing the height
+    const divWithStyle = container.querySelector('[style*="height"]');
+    expect(divWithStyle).toBeInTheDocument();
+
+    // Check that the style contains the expected height
+    expect(divWithStyle?.getAttribute('style')).toContain(
+      `height: ${customHeight}`
+    );
+  });
+});
diff --git a/app/react/components/CodeEditor/DiffViewer.tsx b/app/react/components/CodeEditor/DiffViewer.tsx
new file mode 100644
index 0000000..2b13f02
--- /dev/null
+++ b/app/react/components/CodeEditor/DiffViewer.tsx
@@ -0,0 +1,138 @@
+import CodeMirrorMerge from 'react-codemirror-merge';
+import clsx from 'clsx';
+
+import { AutomationTestingProps } from '@/types';
+
+import { FileNameHeader, FileNameHeaderRow } from './FileNameHeader';
+import styles from './CodeEditor.module.css';
+import {
+  CodeEditorType,
+  useCodeEditorExtensions,
+} from './useCodeEditorExtensions';
+import { theme } from './CodeEditor';
+
+const { Original } = CodeMirrorMerge;
+const { Modified } = CodeMirrorMerge;
+
+type Props = {
+  originalCode: string;
+  newCode: string;
+  id: string;
+  type?: CodeEditorType;
+  placeholder?: string;
+  height?: string;
+  fileNames?: {
+    original: string;
+    modified: string;
+  };
+  className?: string;
+} & AutomationTestingProps;
+
+const defaultCollapseUnchanged = {
+  margin: 10,
+  minSize: 10,
+};
+
+export function DiffViewer({
+  originalCode,
+  newCode,
+  id,
+  'data-cy': dataCy,
+  type,
+  placeholder = 'No values found',
+
+  height = '500px',
+  fileNames,
+  className,
+}: Props) {
+  const extensions = useCodeEditorExtensions(type);
+  const hasFileNames = !!fileNames?.original && !!fileNames?.modified;
+  return (
+    <div
+      className={clsx(
+        'overflow-hidden rounded-lg border border-solid border-gray-5 th-highcontrast:border-gray-2 th-dark:border-gray-7',
+        className
+      )}
+    >
+      {hasFileNames && (
+        <DiffFileNameHeaders
+          originalCopyText={originalCode}
+          modifiedCopyText={newCode}
+          originalFileName={fileNames.original}
+          modifiedFileName={fileNames.modified}
+        />
+      )}
+      {/* additional div, so that the scroll gutter doesn't overlap with the rounded border, and always show scrollbar, so that the file name headers align */}
+      <div
+        style={
+          {
+            // tailwind doesn't like dynamic class names, so use a custom css variable for the height
+            // https://v3.tailwindcss.com/docs/content-configuration#dynamic-class-names
+            '--editor-min-height': height,
+            height,
+          } as React.CSSProperties
+        }
+        className="h-full overflow-y-scroll [scrollbar-gutter:stable]"
+      >
+        <CodeMirrorMerge
+          theme={theme}
+          className={clsx(
+            styles.root,
+            // to give similar sizing to CodeEditor
+            '[&_.cm-content]:!min-h-[var(--editor-min-height)] [&_.cm-editor>.cm-scroller]:!min-h-[var(--editor-min-height)] [&_.cm-gutters]:!min-h-[var(--editor-min-height)]'
+          )}
+          id={id}
+          data-cy={dataCy}
+          collapseUnchanged={defaultCollapseUnchanged}
+        >
+          <Original
+            value={originalCode}
+            extensions={extensions}
+            readOnly
+            editable={false}
+            placeholder={placeholder}
+          />
+          <Modified
+            value={newCode}
+            extensions={extensions}
+            readOnly
+            editable={false}
+            placeholder={placeholder}
+          />
+        </CodeMirrorMerge>
+      </div>
+    </div>
+  );
+}
+
+function DiffFileNameHeaders({
+  originalCopyText,
+  modifiedCopyText,
+  originalFileName,
+  modifiedFileName,
+}: {
+  originalCopyText: string;
+  modifiedCopyText: string;
+  originalFileName: string;
+  modifiedFileName: string;
+}) {
+  return (
+    <FileNameHeaderRow>
+      <div className="w-1/2">
+        <FileNameHeader
+          fileName={originalFileName}
+          copyText={originalCopyText}
+          data-cy="original"
+        />
+      </div>
+      <div className="w-px bg-gray-5 th-highcontrast:bg-gray-2 th-dark:bg-gray-7" />
+      <div className="flex-1">
+        <FileNameHeader
+          fileName={modifiedFileName}
+          copyText={modifiedCopyText}
+          data-cy="modified"
+        />
+      </div>
+    </FileNameHeaderRow>
+  );
+}
diff --git a/app/react/components/CodeEditor/FileNameHeader.tsx b/app/react/components/CodeEditor/FileNameHeader.tsx
new file mode 100644
index 0000000..aae605f
--- /dev/null
+++ b/app/react/components/CodeEditor/FileNameHeader.tsx
@@ -0,0 +1,71 @@
+import clsx from 'clsx';
+
+import { AutomationTestingProps } from '@/types';
+
+import { CopyButton } from '@@/buttons/CopyButton';
+
+type FileNameHeaderProps = {
+  fileName: string;
+  copyText: string;
+  className?: string;
+  style?: React.CSSProperties;
+} & AutomationTestingProps;
+
+/**
+ * FileNameHeaderRow: Outer container for file name headers (single or multiple columns).
+ * Use this to wrap one or more <FileNameHeader> components (and optional dividers).
+ */
+export function FileNameHeaderRow({
+  children,
+  className,
+  style,
+}: {
+  children: React.ReactNode;
+  className?: string;
+  style?: React.CSSProperties;
+}) {
+  return (
+    <div
+      className={clsx(
+        'text-muted flex w-full overflow-auto border-0 border-b border-solid border-b-gray-5 bg-gray-2 text-sm [scrollbar-gutter:stable] th-highcontrast:border-b-gray-2 th-highcontrast:bg-black th-dark:border-b-gray-7 th-dark:bg-gray-10',
+        className
+      )}
+      style={style}
+    >
+      {children}
+    </div>
+  );
+}
+
+/**
+ * FileNameHeader: Renders a file name with a copy button, styled for use above a code editor or diff viewer.
+ * Should be used inside FileNameHeaderRow.
+ */
+export function FileNameHeader({
+  fileName,
+  copyText,
+  className = '',
+  style,
+  'data-cy': dataCy,
+}: FileNameHeaderProps) {
+  return (
+    <div
+      className={clsx(
+        'text-muted flex w-full items-center justify-between gap-x-2 overflow-auto px-4 py-1 text-sm',
+        className
+      )}
+      style={style}
+    >
+      {fileName}
+      <CopyButton
+        data-cy={dataCy}
+        copyText={copyText}
+        color="link"
+        className="!pr-0 !text-sm !font-medium hover:no-underline focus:no-underline"
+        indicatorPosition="left"
+      >
+        Copy
+      </CopyButton>
+    </div>
+  );
+}
diff --git a/app/react/components/CodeEditor/ShortcutsTooltip.tsx b/app/react/components/CodeEditor/ShortcutsTooltip.tsx
new file mode 100644
index 0000000..e04cda2
--- /dev/null
+++ b/app/react/components/CodeEditor/ShortcutsTooltip.tsx
@@ -0,0 +1,52 @@
+import { BROWSER_OS_PLATFORM } from '@/react/constants';
+
+import { Tooltip } from '@@/Tip/Tooltip';
+
+const otherEditorConfig = {
+  tooltip: (
+    <>
+      <div>Ctrl+F - Start searching</div>
+      <div>Ctrl+G - Find next</div>
+      <div>Ctrl+Shift+G - Find previous</div>
+      <div>Ctrl+Shift+F - Replace</div>
+      <div>Ctrl+Shift+R - Replace all</div>
+      <div>Alt+G - Jump to line</div>
+      <div>Persistent search:</div>
+      <div className="ml-5">Enter - Find next</div>
+      <div className="ml-5">Shift+Enter - Find previous</div>
+    </>
+  ),
+  searchCmdLabel: 'Ctrl+F for search',
+} as const;
+
+export const editorConfig = {
+  mac: {
+    tooltip: (
+      <>
+        <div>Cmd+F - Start searching</div>
+        <div>Cmd+G - Find next</div>
+        <div>Cmd+Shift+G - Find previous</div>
+        <div>Cmd+Option+F - Replace</div>
+        <div>Cmd+Option+R - Replace all</div>
+        <div>Option+G - Jump to line</div>
+        <div>Persistent search:</div>
+        <div className="ml-5">Enter - Find next</div>
+        <div className="ml-5">Shift+Enter - Find previous</div>
+      </>
+    ),
+    searchCmdLabel: 'Cmd+F for search',
+  },
+
+  lin: otherEditorConfig,
+  win: otherEditorConfig,
+} as const;
+
+export function ShortcutsTooltip() {
+  return (
+    <div className="text-muted small vertical-center ml-auto">
+      {editorConfig[BROWSER_OS_PLATFORM].searchCmdLabel}
+
+      <Tooltip message={editorConfig[BROWSER_OS_PLATFORM].tooltip} />
+    </div>
+  );
+}
diff --git a/app/react/components/CodeEditor/index.ts b/app/react/components/CodeEditor/index.ts
new file mode 100644
index 0000000..aa4b203
--- /dev/null
+++ b/app/react/components/CodeEditor/index.ts
@@ -0,0 +1 @@
+export * from './CodeEditor';
diff --git a/app/react/components/CodeEditor/useCodeEditorExtensions.ts b/app/react/components/CodeEditor/useCodeEditorExtensions.ts
new file mode 100644
index 0000000..2cfbe75
--- /dev/null
+++ b/app/react/components/CodeEditor/useCodeEditorExtensions.ts
@@ -0,0 +1,93 @@
+import { useMemo } from 'react';
+import {
+  StreamLanguage,
+  LanguageSupport,
+  indentService,
+} from '@codemirror/language';
+import { dockerFile } from '@codemirror/legacy-modes/mode/dockerfile';
+import { shell } from '@codemirror/legacy-modes/mode/shell';
+import { keymap, Extension } from '@uiw/react-codemirror';
+import { highlightSpecialChars, lineNumbers } from '@codemirror/view';
+import type { JSONSchema7 } from 'json-schema';
+import { lintKeymap, lintGutter } from '@codemirror/lint';
+import { defaultKeymap } from '@codemirror/commands';
+import { autocompletion, completionKeymap } from '@codemirror/autocomplete';
+import { yamlCompletion, yamlSchema } from 'yaml-schema';
+import { compact } from 'lodash';
+
+export type CodeEditorType = 'yaml' | 'shell' | 'dockerfile';
+
+// Extends the default special-char set with invisible Unicode characters that
+// are hard to spot (non-breaking spaces, zero-width joiners, word joiner, etc.)
+export const extendedHighlightSpecialChars = highlightSpecialChars({
+  // eslint-disable-next-line no-misleading-character-class
+  addSpecialChars: /[\u00a0\u200c\u200d\u202f\u2060]/,
+});
+
+// Custom indentation service for YAML
+const yamlIndentExtension = indentService.of((context, pos) => {
+  const prevLine = context.lineAt(pos, -1);
+  const prevIndent = /^\s*/.exec(prevLine.text)?.[0].length || 0;
+  if (/:\s*$/.test(prevLine.text)) {
+    return prevIndent + 2;
+  }
+  return prevIndent;
+});
+
+const dockerFileLanguage = new LanguageSupport(
+  StreamLanguage.define(dockerFile)
+);
+const shellLanguage = new LanguageSupport(StreamLanguage.define(shell));
+
+function yamlLanguage(schema?: JSONSchema7) {
+  const [yaml, linter, , , stateExtensions] = yamlSchema(schema);
+
+  return compact([
+    yaml,
+    linter,
+    stateExtensions,
+    yamlIndentExtension,
+    // explicitly setting lineNumbers() as an extension ensures that the gutter order is the same between the diff viewer and the code editor
+    lineNumbers(),
+    !!schema && lintGutter(),
+    keymap.of([...defaultKeymap, ...completionKeymap, ...lintKeymap]),
+    // only show completions when a schema is provided
+    !!schema &&
+      autocompletion({
+        icons: false,
+        activateOnTypingDelay: 300,
+        selectOnOpen: true,
+        activateOnTyping: true,
+        override: [
+          (ctx) => {
+            const getCompletions = yamlCompletion();
+            const completions = getCompletions(ctx);
+            if (Array.isArray(completions)) {
+              return null;
+            }
+            completions.validFor = /^\w*$/;
+            return completions;
+          },
+        ],
+      }),
+  ]);
+}
+
+export function useCodeEditorExtensions(
+  type?: CodeEditorType,
+  schema?: JSONSchema7
+): Extension[] {
+  return useMemo(() => {
+    const baseExtensions = [extendedHighlightSpecialChars];
+    switch (type) {
+      case 'dockerfile':
+        return [...baseExtensions, dockerFileLanguage];
+      case 'shell':
+        return [...baseExtensions, shellLanguage];
+      case 'yaml':
+        return [...baseExtensions, ...yamlLanguage(schema)];
+      default:
+        return baseExtensions;
+    }
+  }, [type, schema]);
+}
diff --git a/app/react/components/CollapseExpandButton.test.tsx b/app/react/components/CollapseExpandButton.test.tsx
new file mode 100644
index 0000000..6ea1460
--- /dev/null
+++ b/app/react/components/CollapseExpandButton.test.tsx
@@ -0,0 +1,68 @@
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+
+import { CollapseExpandButton } from './CollapseExpandButton';
+
+it('should render the button with the correct icon and title', () => {
+  renderCollapseExpandButton();
+  const button = screen.getByRole('button');
+
+  expect(button).toBeInTheDocument();
+  expect(button).toHaveAttribute('title', 'Expand');
+  expect(button).toHaveAttribute('aria-label', 'Expand');
+  expect(button).toHaveAttribute('aria-expanded', 'false');
+  expect(button.querySelector('svg')).toBeInTheDocument();
+});
+
+it('should call the onClick handler when the button is clicked', async () => {
+  const onClick = vi.fn();
+  const { user } = renderCollapseExpandButton({ onClick });
+  const button = screen.getByRole('button');
+
+  await user.click(button);
+
+  expect(onClick).toHaveBeenCalledTimes(1);
+});
+
+it('should prevent default and stop propagation when the button is clicked', async () => {
+  const user = userEvent.setup();
+  const onClick = vi.fn();
+  const onOuterClick = vi.fn();
+
+  render(
+    // eslint-disable-next-line jsx-a11y/click-events-have-key-events, jsx-a11y/no-static-element-interactions
+    <div onClick={onOuterClick}>
+      <CollapseExpandButton
+        onClick={onClick}
+        isExpanded={false}
+        data-cy="nothing"
+      />
+    </div>
+  );
+
+  const button = screen.getByLabelText('Expand');
+
+  await user.click(button);
+
+  expect(onOuterClick).not.toHaveBeenCalled();
+  expect(onClick).toHaveBeenCalled();
+});
+
+function renderCollapseExpandButton({
+  isExpanded = false,
+  onClick = vi.fn(),
+}: {
+  isExpanded?: boolean;
+  onClick?(): void;
+} = {}) {
+  const user = userEvent.setup();
+
+  render(
+    <CollapseExpandButton
+      isExpanded={isExpanded}
+      data-cy="random"
+      onClick={onClick}
+    />
+  );
+  return { user };
+}
diff --git a/app/react/components/CollapseExpandButton.tsx b/app/react/components/CollapseExpandButton.tsx
new file mode 100644
index 0000000..10e24d3
--- /dev/null
+++ b/app/react/components/CollapseExpandButton.tsx
@@ -0,0 +1,48 @@
+import { ChevronDown } from 'lucide-react';
+import { ComponentProps } from 'react';
+import clsx from 'clsx';
+
+import { Icon } from './Icon';
+
+export function CollapseExpandButton({
+  onClick,
+  isExpanded,
+  quarterRotation = false,
+  ...props
+}: {
+  isExpanded: boolean;
+  quarterRotation?: boolean;
+} & ComponentProps<'button'>) {
+  return (
+    <button
+      onClick={(e) => {
+        e.preventDefault();
+        e.stopPropagation();
+
+        onClick?.(e);
+      }}
+      color="none"
+      title={isExpanded ? 'Collapse' : 'Expand'}
+      aria-label={isExpanded ? 'Collapse' : 'Expand'}
+      aria-expanded={isExpanded}
+      type="button"
+      className="group !ml-0 flex flex-none items-center border-none bg-transparent p-0"
+      // eslint-disable-next-line react/jsx-props-no-spreading
+      {...props}
+    >
+      <div className="flex items-center rounded-full p-[3px] transition ease-in-out group-hover:bg-blue-5 group-hover:bg-opacity-10 be:group-hover:bg-gray-5 be:group-hover:bg-opacity-10 group-hover:th-dark:bg-gray-true-7">
+        <Icon
+          icon={ChevronDown}
+          size="md"
+          className={clsx('transition ease-in-out', {
+            'rotate-180': isExpanded && !quarterRotation,
+            '-rotate-90': !isExpanded && quarterRotation,
+            'rotate-0':
+              (!isExpanded && !quarterRotation) ||
+              (isExpanded && quarterRotation),
+          })}
+        />
+      </div>
+    </button>
+  );
+}
diff --git a/app/react/components/CommandPalette/CommandPalette.stories.tsx b/app/react/components/CommandPalette/CommandPalette.stories.tsx
new file mode 100644
index 0000000..2e11c92
--- /dev/null
+++ b/app/react/components/CommandPalette/CommandPalette.stories.tsx
@@ -0,0 +1,121 @@
+import { Meta } from '@storybook/react-webpack5';
+import { useRef, useState } from 'react';
+import { createPortal } from 'react-dom';
+
+import { CommandPalette } from './CommandPalette';
+
+export default {
+  component: CommandPalette,
+  title: 'Components/CommandPalette',
+} as Meta;
+
+const samplePaths = [
+  'src/index.ts',
+  'src/app.ts',
+  'src/components/Button.tsx',
+  'src/components/Input.tsx',
+  'src/utils/string.ts',
+  'src/utils/number.ts',
+  'docker-compose.yml',
+  'docker-compose.dev.yml',
+  '.github/workflows/ci.yml',
+  'package.json',
+  'tsconfig.json',
+  'README.md',
+];
+
+export function Default() {
+  const [value, setValue] = useState('');
+
+  return (
+    <div className="relative w-[480px] rounded-md border border-solid border-gray-4 th-highcontrast:border-white th-dark:border-gray-7">
+      <div className="flex items-center px-3 py-2">
+        <CommandPalette
+          value={value}
+          onChange={setValue}
+          onCompletion={() => {}}
+          allFilePaths={samplePaths}
+        />
+      </div>
+    </div>
+  );
+}
+
+export function DropdownOnType() {
+  const [value, setValue] = useState('');
+
+  return (
+    <div className="relative w-[480px] rounded-md border border-solid border-gray-4 th-highcontrast:border-white th-dark:border-gray-7">
+      <div className="flex items-center px-3 py-2">
+        <CommandPalette
+          value={value}
+          onChange={setValue}
+          onCompletion={() => {}}
+          allFilePaths={samplePaths}
+          openDropdownOnFocus={false}
+        />
+      </div>
+    </div>
+  );
+}
+
+export function WithPortal() {
+  const [value, setValue] = useState('');
+  const [isDropdownVisible, setIsDropdownVisible] = useState(false);
+  const portalTargetRef = useRef<HTMLDivElement>(null);
+
+  return (
+    <div
+      className="w-[480px] overflow-hidden rounded-lg border border-solid border-gray-4 th-highcontrast:border-white th-dark:border-gray-7"
+      onFocusCapture={() => setIsDropdownVisible(true)}
+      onBlurCapture={(e) => {
+        if (!e.currentTarget.contains(e.relatedTarget as Node)) {
+          setIsDropdownVisible(false);
+        }
+      }}
+    >
+      <div className="flex items-center border-b border-l-0 border-r-0 border-t-0 border-solid border-gray-4 px-3 py-2 th-highcontrast:border-white th-dark:border-gray-7">
+        <CommandPalette
+          value={value}
+          onChange={setValue}
+          onCompletion={() => {}}
+          allFilePaths={samplePaths}
+          renderDropdown={(paths) => {
+            if (!portalTargetRef.current) return null;
+            return createPortal(
+              paths.length === 0 ? (
+                <p className="px-3 py-4 text-center text-xs text-gray-6 th-highcontrast:text-gray-5 th-dark:text-gray-5">
+                  No matching files
+                </p>
+              ) : (
+                <>
+                  {paths.map((path) => (
+                    <div
+                      key={path}
+                      className="flex h-8 items-center px-3 hover:bg-gray-3 th-highcontrast:hover:bg-gray-iron-10 th-dark:hover:bg-gray-iron-10"
+                    >
+                      <span className="truncate font-mono text-[13px] text-gray-11 th-highcontrast:text-white th-dark:text-white">
+                        /{path}
+                      </span>
+                    </div>
+                  ))}
+                </>
+              ),
+              portalTargetRef.current
+            );
+          }}
+        />
+      </div>
+      <div
+        ref={portalTargetRef}
+        className="min-h-[120px] overflow-y-auto bg-white th-highcontrast:bg-black th-dark:bg-gray-iron-10"
+      >
+        {!isDropdownVisible && (
+          <p className="px-3 py-4 text-center text-xs text-gray-6 th-highcontrast:text-gray-5 th-dark:text-gray-5">
+            Portal target — type above to filter files; matches render here
+          </p>
+        )}
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/components/CommandPalette/CommandPalette.test.tsx b/app/react/components/CommandPalette/CommandPalette.test.tsx
new file mode 100644
index 0000000..7904088
--- /dev/null
+++ b/app/react/components/CommandPalette/CommandPalette.test.tsx
@@ -0,0 +1,146 @@
+import { type ReactNode } from 'react';
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+
+import { CommandPalette } from './CommandPalette';
+
+const allFilePaths = ['foo.yml', 'bar.yml', 'baz.ts'];
+
+function renderSearchBar({
+  value = '',
+  onChange = vi.fn(),
+  addExpression = vi.fn(),
+  filePaths = allFilePaths,
+  renderDropdown,
+}: {
+  value?: string;
+  onChange?: (value: string) => void;
+  addExpression?: (pattern: string) => void;
+  filePaths?: string[];
+  renderDropdown?: (paths: string[]) => ReactNode;
+} = {}) {
+  const user = userEvent.setup();
+  render(
+    <CommandPalette
+      value={value}
+      onChange={onChange}
+      onCompletion={addExpression}
+      allFilePaths={filePaths}
+      renderDropdown={renderDropdown}
+    />
+  );
+  return { user, onChange, addExpression };
+}
+
+describe('CommandPalette', () => {
+  it('shows a live match count when the filter is active', async () => {
+    // *.yml matches foo.yml and bar.yml → 2 matches
+    const { user } = renderSearchBar({ value: '*.yml' });
+    const inputElement = screen.getByTestId('command-palette-search-input');
+    await user.click(inputElement);
+    expect(screen.getByText(/2 matches/)).toBeVisible();
+  });
+
+  it('shows singular "match" for exactly one result', async () => {
+    // *.ts matches only baz.ts → 1 match
+    const { user } = renderSearchBar({ value: '*.ts' });
+    const inputElement = screen.getByTestId('command-palette-search-input');
+    await user.click(inputElement);
+    expect(screen.getByText(/1 match/)).toBeVisible();
+  });
+
+  it('calls addExpression with the glob pattern unchanged when Enter is pressed', async () => {
+    const addExpression = vi.fn();
+    const onChange = vi.fn();
+    const { user } = renderSearchBar({
+      value: '*.yml',
+      addExpression,
+      onChange,
+    });
+    const inputElement = screen.getByTestId('command-palette-search-input');
+    await user.click(inputElement);
+    await user.keyboard('{Enter}');
+    expect(addExpression).toHaveBeenCalledWith('*.yml');
+    expect(onChange).toHaveBeenCalledWith('');
+  });
+
+  it('wraps plain text in wildcards when added as an expression', async () => {
+    const addExpression = vi.fn();
+    const { user } = renderSearchBar({ value: 'foo', addExpression });
+    await user.click(screen.getByRole('textbox'));
+    await user.keyboard('{Enter}');
+    expect(addExpression).toHaveBeenCalledWith('*foo*');
+  });
+
+  it('does not call addExpression when Enter is pressed with an empty filter', async () => {
+    const addExpression = vi.fn();
+    const { user } = renderSearchBar({ value: '', addExpression });
+    await user.click(screen.getByRole('textbox'));
+    await user.keyboard('{Enter}');
+    expect(addExpression).not.toHaveBeenCalled();
+  });
+
+  it('clears the filter when Escape is pressed', async () => {
+    const onChange = vi.fn();
+    const { user } = renderSearchBar({ value: 'some text', onChange });
+    await user.click(screen.getByRole('textbox'));
+    await user.keyboard('{Escape}');
+    expect(onChange).toHaveBeenCalledWith('');
+  });
+
+  it('clears the filter when the clear (X) button is clicked', async () => {
+    const onChange = vi.fn();
+    const { user } = renderSearchBar({ value: 'test', onChange });
+    await user.click(screen.getByRole('button', { name: /clear search/i }));
+    expect(onChange).toHaveBeenCalledWith('');
+  });
+
+  it('calls addExpression when the Add expression button is clicked', async () => {
+    const addExpression = vi.fn();
+    const onChange = vi.fn();
+    const { user } = renderSearchBar({
+      value: 'src/**',
+      addExpression,
+      onChange,
+    });
+    await user.click(screen.getByRole('button', { name: /add expression/i }));
+    expect(addExpression).toHaveBeenCalledWith('src/**');
+    expect(onChange).toHaveBeenCalledWith('');
+  });
+
+  it('calls onChange when typing in the input', async () => {
+    const onChange = vi.fn();
+    const { user } = renderSearchBar({ onChange });
+    await user.type(screen.getByRole('textbox'), 'a');
+    expect(onChange).toHaveBeenCalled();
+  });
+
+  it('shows matching file paths in the dropdown when the filter is active', async () => {
+    const { user } = renderSearchBar({ value: '*.yml' });
+    const inputElement = screen.getByTestId('command-palette-search-input');
+    await user.click(inputElement);
+    expect(screen.getByText('/foo.yml')).toBeVisible();
+    expect(screen.getByText('/bar.yml')).toBeVisible();
+    expect(screen.queryByText('/baz.ts')).not.toBeInTheDocument();
+  });
+
+  it('does not show the dropdown when the filter is empty', () => {
+    renderSearchBar({ value: '' });
+    expect(screen.queryByText('/foo.yml')).not.toBeInTheDocument();
+  });
+
+  it('calls renderDropdown with matching paths instead of rendering the default dropdown', async () => {
+    const renderDropdown = vi.fn(() => null);
+    const { user } = renderSearchBar({ value: '*.yml', renderDropdown });
+    const inputElement = screen.getByTestId('command-palette-search-input');
+    await user.click(inputElement);
+    expect(renderDropdown).toHaveBeenCalledWith(['foo.yml', 'bar.yml']);
+    expect(screen.queryByRole('list')).not.toBeInTheDocument();
+  });
+
+  it('does not call renderDropdown when the filter is empty', () => {
+    const renderDropdown = vi.fn(() => null);
+    renderSearchBar({ value: '', renderDropdown });
+    expect(renderDropdown).not.toHaveBeenCalled();
+  });
+});
diff --git a/app/react/components/CommandPalette/CommandPalette.tsx b/app/react/components/CommandPalette/CommandPalette.tsx
new file mode 100644
index 0000000..3f49e86
--- /dev/null
+++ b/app/react/components/CommandPalette/CommandPalette.tsx
@@ -0,0 +1,144 @@
+import { Search, X } from 'lucide-react';
+import { type ReactNode, forwardRef, useMemo, useRef, useState } from 'react';
+
+import { pluralize } from '@/react/common/string-utils';
+
+import { Button } from '@@/buttons';
+
+import { filterToPattern } from '../form-components/FilePicker/utils';
+
+import { globToRegex } from './utils';
+
+interface Props {
+  value: string;
+  onChange: (value: string) => void;
+  onCompletion: (pattern: string) => void;
+  allFilePaths: string[];
+  renderDropdown?: (paths: string[]) => ReactNode;
+  openDropdownOnFocus?: boolean;
+}
+
+export const CommandPalette = forwardRef<HTMLInputElement, Props>(
+  function CommandPalette(
+    {
+      value,
+      onChange,
+      onCompletion,
+      allFilePaths,
+      renderDropdown,
+      openDropdownOnFocus = true,
+    },
+    forwardedRef
+  ) {
+    const [isFocused, setIsFocused] = useState(false);
+    const inputRef = useRef<HTMLInputElement | null>(null);
+
+    function setRefs(node: HTMLInputElement | null) {
+      inputRef.current = node;
+      if (typeof forwardedRef === 'function') {
+        forwardedRef(node);
+      } else if (forwardedRef) {
+        // eslint-disable-next-line no-param-reassign
+        forwardedRef.current = node;
+      }
+    }
+
+    const filterTrimmed = value.trim();
+    const filterActive = filterTrimmed.length > 0;
+
+    const matchingPaths = useMemo(() => {
+      if (openDropdownOnFocus && !isFocused) return [];
+      if (!filterActive) return allFilePaths;
+      const re = globToRegex(filterToPattern(filterTrimmed));
+      return allFilePaths.filter((p) => re.test(p));
+    }, [
+      openDropdownOnFocus,
+      isFocused,
+      filterActive,
+      allFilePaths,
+      filterTrimmed,
+    ]);
+
+    return (
+      <div className="relative z-10 flex min-h-[30px] flex-1 items-center gap-2">
+        <Search
+          size={14}
+          className="shrink-0 text-gray-7 th-highcontrast:text-white th-dark:text-gray-5"
+        />
+        <input
+          ref={setRefs}
+          type="text"
+          value={value}
+          onChange={(e) => onChange(e.target.value)}
+          onFocus={() => setIsFocused(true)}
+          onBlur={() => setIsFocused(false)}
+          onKeyDown={(e) => {
+            if (e.key === 'Enter' && filterActive) handleAddExpression();
+            if (e.key === 'Escape') {
+              setIsFocused(false);
+              inputRef.current?.blur();
+              onChange('');
+            }
+          }}
+          placeholder="Filter or add expression, e.g. *.yml, src/**/*.ts"
+          className="flex-1 border-0 bg-transparent text-sm text-gray-11 outline-none placeholder:text-gray-6 th-highcontrast:text-white th-dark:text-white"
+          data-cy="command-palette-search-input"
+        />
+        {filterActive && (
+          <>
+            <Button
+              color="primary"
+              onClick={() => handleAddExpression()}
+              className="shrink-0 border-0 bg-transparent text-gray-7 hover:text-gray-11 th-highcontrast:text-white th-dark:text-gray-5"
+              aria-label="Add expression"
+              data-cy="command-palette-search-add-expression"
+            >
+              Add expression
+            </Button>
+            <span className="shrink-0 text-xs text-gray-7 th-highcontrast:text-gray-5 th-dark:text-gray-5">
+              {matchingPaths.length}{' '}
+              {pluralize(matchingPaths.length, 'match', 'matches')}
+            </span>
+          </>
+        )}
+        {value && (
+          <button
+            type="button"
+            onClick={() => onChange('')}
+            className="shrink-0 border-0 bg-transparent text-gray-7 hover:text-gray-11 th-highcontrast:text-white th-dark:text-gray-5"
+            aria-label="Clear search"
+            data-cy="command-palette-search-clear-expression"
+          >
+            <X size={12} />
+          </button>
+        )}
+        {(isFocused || !openDropdownOnFocus) &&
+          (openDropdownOnFocus || filterActive) &&
+          (renderDropdown
+            ? renderDropdown(matchingPaths)
+            : matchingPaths.length > 0 && (
+                <ul
+                  style={{ top: 'calc(100% + 8px)' }}
+                  className="absolute -left-2 -right-2 z-10 max-h-48 overflow-y-auto rounded-b-md border border-solid border-gray-4 bg-white px-0 th-highcontrast:border-white th-highcontrast:bg-black th-dark:border-gray-7 th-dark:bg-gray-iron-10"
+                >
+                  {matchingPaths.map((path) => (
+                    <li
+                      key={path}
+                      className="list-none px-3 py-1.5 font-mono text-xs text-gray-11 th-highcontrast:text-white th-dark:text-white"
+                    >
+                      /{path}
+                    </li>
+                  ))}
+                </ul>
+              ))}
+      </div>
+    );
+
+    function handleAddExpression() {
+      onCompletion(filterToPattern(filterTrimmed));
+      setIsFocused(false);
+      inputRef.current?.blur();
+      onChange('');
+    }
+  }
+);
diff --git a/app/react/components/CommandPalette/utils.test.ts b/app/react/components/CommandPalette/utils.test.ts
new file mode 100644
index 0000000..800c3dc
--- /dev/null
+++ b/app/react/components/CommandPalette/utils.test.ts
@@ -0,0 +1,53 @@
+import { globToRegex } from './utils';
+
+describe('globToRegex', () => {
+  it('matches a file by extension using *', () => {
+    const re = globToRegex('*.yml');
+    expect(re.test('foo.yml')).toBe(true);
+    expect(re.test('foo.ts')).toBe(false);
+  });
+
+  it('wraps pattern in "*" when not explicitly used', () => {
+    const re = globToRegex('yml');
+    expect(re.test('foo.yml')).toBe(true);
+    expect(re.test('foo.ts')).toBe(false);
+  });
+
+  it('matches nested paths with **', () => {
+    const re = globToRegex('src/**');
+    expect(re.test('src/foo.ts')).toBe(true);
+    expect(re.test('src/nested/bar.ts')).toBe(true);
+    expect(re.test('lib/foo.ts')).toBe(false);
+  });
+
+  it('is case-insensitive', () => {
+    const re = globToRegex('*.YML');
+    expect(re.test('foo.yml')).toBe(true);
+    expect(re.test('FOO.YML')).toBe(true);
+  });
+
+  it('escapes dots so they match only literal dots', () => {
+    const re = globToRegex('file.ts');
+    expect(re.test('file.ts')).toBe(true);
+    expect(re.test('fileXts')).toBe(false);
+  });
+
+  it('matches exact paths with no wildcards', () => {
+    const re = globToRegex('src/foo.ts');
+    expect(re.test('src/foo.ts')).toBe(true);
+    expect(re.test('src/bar.ts')).toBe(false);
+  });
+
+  it('matches any path with a bare wildcard', () => {
+    const re = globToRegex('*');
+    expect(re.test('anything')).toBe(true);
+  });
+
+  it('matches exactly one character with ?', () => {
+    const re = globToRegex('te?t');
+    expect(re.test('testy')).toBe(true);
+    expect(re.test('text')).toBe(true);
+    expect(re.test('tesst')).toBe(false);
+    expect(re.test('tet')).toBe(false);
+  });
+});
diff --git a/app/react/components/CommandPalette/utils.ts b/app/react/components/CommandPalette/utils.ts
new file mode 100644
index 0000000..40aeaea
--- /dev/null
+++ b/app/react/components/CommandPalette/utils.ts
@@ -0,0 +1,18 @@
+/**
+ * Converts a glob pattern to a case-insensitive RegExp.
+ *
+ * Patterns without `*` are wrapped in `*...*` for substring matching
+ * `*` matches any sequence of characters
+ * `?` matches exactly one character
+ */
+export function globToRegex(pattern: string): RegExp {
+  let glob = pattern;
+  if (!pattern.includes('*')) {
+    glob = `*${pattern}*`;
+  }
+  const escaped = glob
+    .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+    .replace(/\*+/g, '.*')
+    .replace(/\?/g, '.');
+  return new RegExp(`^${escaped}$`, 'i');
+}
diff --git a/app/react/components/CustomTemplateSelector.test.tsx b/app/react/components/CustomTemplateSelector.test.tsx
new file mode 100644
index 0000000..e4121f3
--- /dev/null
+++ b/app/react/components/CustomTemplateSelector.test.tsx
@@ -0,0 +1,130 @@
+import { http, HttpResponse } from 'msw';
+import { render, waitFor } from '@testing-library/react';
+import { Mock } from 'vitest';
+
+import { server } from '@/setup-tests/server';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { CustomTemplate } from '@/react/portainer/templates/custom-templates/types';
+import { StackType } from '@/react/common/stacks/types';
+
+import { CustomTemplateSelector } from './CustomTemplateSelector';
+
+const mockCustomTemplates: CustomTemplate[] = [
+  {
+    Id: 1,
+    Title: 'Nginx Template',
+    Description: 'Web server template',
+    ProjectPath: '/data/custom_template/1',
+    EntryPoint: 'docker-compose.yml',
+    CreatedByUserId: 1,
+    Note: 'Nginx note',
+    Platform: 1,
+    Logo: '',
+    Type: StackType.DockerCompose,
+    Variables: [],
+    IsComposeFormat: false,
+    EdgeTemplate: false,
+  },
+  {
+    Id: 2,
+    Title: 'Redis Template',
+    Description: '',
+    ProjectPath: '/data/custom_template/2',
+    EntryPoint: 'docker-compose.yml',
+    CreatedByUserId: 1,
+    Note: '',
+    Platform: 1,
+    Logo: '',
+    Type: StackType.DockerCompose,
+    Variables: [],
+    IsComposeFormat: false,
+    EdgeTemplate: false,
+  },
+];
+
+test('should render the component with label', async () => {
+  const { getByText } = await renderComponent({}, []);
+
+  expect(getByText('Template')).toBeInTheDocument();
+});
+
+test('should show message when no templates are available', async () => {
+  const queries = await renderComponent({}, []);
+
+  await waitFor(() => {
+    expect(
+      queries.getByText('No custom templates are available.')
+    ).toBeInTheDocument();
+  });
+});
+
+test('should show link to create template when newTemplatePath is provided', async () => {
+  const queries = await renderComponent(
+    { newTemplatePath: '/templates/new' },
+    []
+  );
+
+  await waitFor(() => {
+    const link = queries.getByRole('link', { name: /custom template view/i });
+    expect(link).toBeInTheDocument();
+    expect(link).toHaveAttribute('href', '/templates/new');
+  });
+});
+
+test('should render select with templates', async () => {
+  const queries = await renderComponent({}, mockCustomTemplates);
+
+  await waitFor(() => {
+    const combobox = queries.getByRole('combobox');
+    expect(combobox).toBeInTheDocument();
+  });
+});
+
+test('should display error message when provided', async () => {
+  const queries = await renderComponent(
+    { error: 'This field is required' },
+    mockCustomTemplates
+  );
+
+  await waitFor(() => {
+    expect(queries.getByText('This field is required')).toBeInTheDocument();
+  });
+});
+
+async function renderComponent(
+  {
+    value,
+    onChange = vi.fn(),
+    error,
+    stackType,
+    newTemplatePath,
+  }: {
+    value?: number;
+    onChange?: Mock;
+    error?: string;
+    stackType?: StackType;
+    newTemplatePath?: string;
+  } = {},
+  templates: CustomTemplate[] = []
+) {
+  server.use(
+    http.get('/api/custom_templates', () => HttpResponse.json(templates))
+  );
+
+  const Component = withTestQueryProvider(CustomTemplateSelector);
+
+  const queries = render(
+    <Component
+      value={value}
+      onChange={onChange}
+      error={error}
+      stackType={stackType}
+      newTemplatePath={newTemplatePath}
+    />
+  );
+
+  const labelElement = await queries.findByText('Template');
+  expect(labelElement).toBeInTheDocument();
+
+  return queries;
+}
diff --git a/app/react/components/CustomTemplateSelector.tsx b/app/react/components/CustomTemplateSelector.tsx
new file mode 100644
index 0000000..706e79d
--- /dev/null
+++ b/app/react/components/CustomTemplateSelector.tsx
@@ -0,0 +1,86 @@
+import { useMemo } from 'react';
+
+import { useCustomTemplates } from '@/react/portainer/templates/custom-templates/queries/useCustomTemplates';
+import { CustomTemplate } from '@/react/portainer/templates/custom-templates/types';
+import { StackType } from '@/react/common/stacks/types';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { PortainerSelect } from '@@/form-components/PortainerSelect';
+
+interface Props {
+  value: CustomTemplate['Id'] | undefined;
+  onChange: (template: CustomTemplate['Id'] | undefined) => void;
+
+  error?: string;
+  stackType?: StackType;
+  newTemplatePath?: string;
+}
+
+export function CustomTemplateSelector({
+  value,
+  onChange,
+  error,
+  stackType,
+  newTemplatePath,
+}: Props) {
+  const inputId = 'custom-template-selector';
+
+  const customTemplatesQuery = useCustomTemplates({
+    params: stackType ? { type: [stackType] } : {},
+  });
+
+  const templateOptions = useMemo(() => {
+    if (!customTemplatesQuery.data) {
+      return [];
+    }
+
+    return customTemplatesQuery.data.map((template) => ({
+      label: `${template.Title}${
+        template.Description ? ` - ${template.Description}` : ''
+      }`,
+      value: template.Id,
+    }));
+  }, [customTemplatesQuery]);
+
+  const { isLoading } = customTemplatesQuery;
+  const hasTemplates = templateOptions.length > 0;
+
+  return (
+    <FormControl
+      label="Template"
+      inputId={inputId}
+      errors={error}
+      tooltip="Select a custom template to deploy as a stack"
+    >
+      {hasTemplates && (
+        <PortainerSelect
+          placeholder="Select a custom template"
+          options={templateOptions}
+          value={value}
+          onChange={handleChange}
+          isClearable
+          isLoading={isLoading}
+          data-cy={inputId}
+          inputId={inputId}
+        />
+      )}
+
+      {!isLoading && !hasTemplates && (
+        <span className="small text-muted">
+          No custom templates are available.
+          {newTemplatePath && (
+            <>
+              {' '}
+              Head over to the{' '}
+              <a href={newTemplatePath}>custom template view</a> to create one.
+            </>
+          )}
+        </span>
+      )}
+    </FormControl>
+  );
+
+  function handleChange(templateId: number | undefined) {
+    onChange(templateId);
+  }
+}
diff --git a/app/react/components/DashboardItem/DashboardGrid.tsx b/app/react/components/DashboardItem/DashboardGrid.tsx
new file mode 100644
index 0000000..bf2b954
--- /dev/null
+++ b/app/react/components/DashboardItem/DashboardGrid.tsx
@@ -0,0 +1,5 @@
+import { PropsWithChildren } from 'react';
+
+export function DashboardGrid({ children }: PropsWithChildren<unknown>) {
+  return <div className="grid grid-cols-2 gap-3">{children}</div>;
+}
diff --git a/app/react/components/DashboardItem/DashboardItem.stories.tsx b/app/react/components/DashboardItem/DashboardItem.stories.tsx
new file mode 100644
index 0000000..ad7e35d
--- /dev/null
+++ b/app/react/components/DashboardItem/DashboardItem.stories.tsx
@@ -0,0 +1,63 @@
+import { Meta, StoryFn } from '@storybook/react-webpack5';
+import { List } from 'lucide-react';
+
+import { Link } from '@@/Link';
+import { IconProps } from '@@/Icon';
+
+import { DashboardItem } from './DashboardItem';
+
+const meta: Meta = {
+  title: 'Components/DashboardItem',
+  component: DashboardItem,
+};
+export default meta;
+
+interface StoryProps {
+  value: number;
+  icon: IconProps['icon'];
+  type: string;
+}
+
+function Template({ value, icon, type }: StoryProps) {
+  return (
+    <DashboardItem
+      value={value}
+      icon={icon}
+      type={type}
+      data-cy="data-cy-example"
+    />
+  );
+}
+
+export const Primary: StoryFn<StoryProps> = Template.bind({});
+Primary.args = {
+  value: 1,
+  icon: List,
+  type: 'Example resource',
+};
+
+export function WithLink() {
+  return (
+    <Link to="example.page" data-cy="data-cy-example">
+      <DashboardItem
+        value={1}
+        icon={List}
+        type="Example resource"
+        data-cy="data-cy-example"
+      />
+    </Link>
+  );
+}
+
+export function WithChildren() {
+  return (
+    <DashboardItem
+      value={1}
+      icon={List}
+      type="Example resource"
+      data-cy="data-cy-example"
+    >
+      <div>Children</div>
+    </DashboardItem>
+  );
+}
diff --git a/app/react/components/DashboardItem/DashboardItem.test.tsx b/app/react/components/DashboardItem/DashboardItem.test.tsx
new file mode 100644
index 0000000..a3b6534
--- /dev/null
+++ b/app/react/components/DashboardItem/DashboardItem.test.tsx
@@ -0,0 +1,32 @@
+import { User } from 'lucide-react';
+import { render } from '@testing-library/react';
+
+import { DashboardItem } from './DashboardItem';
+
+test('should show provided resource value', async () => {
+  const { getByLabelText } = renderComponent(1);
+  const value = getByLabelText('value');
+
+  expect(value).toBeVisible();
+  expect(value).toHaveTextContent('1');
+});
+
+test('should show provided resource type', async () => {
+  const { getByLabelText } = renderComponent(0, User, 'Test');
+  const title = getByLabelText('resourceType');
+
+  expect(title).toBeVisible();
+  expect(title).toHaveTextContent('Test');
+});
+
+test('should have accessibility label created from the provided resource type', async () => {
+  const { getByLabelText } = renderComponent(0, User, 'testLabel');
+
+  expect(getByLabelText('testLabel')).toBeTruthy();
+});
+
+function renderComponent(value = 0, icon = User, type = '') {
+  return render(
+    <DashboardItem value={value} icon={icon} type={type} data-cy="example" />
+  );
+}
diff --git a/app/react/components/DashboardItem/DashboardItem.tsx b/app/react/components/DashboardItem/DashboardItem.tsx
new file mode 100644
index 0000000..0f2ce26
--- /dev/null
+++ b/app/react/components/DashboardItem/DashboardItem.tsx
@@ -0,0 +1,117 @@
+import { ReactNode } from 'react';
+import clsx from 'clsx';
+import { Loader2 } from 'lucide-react';
+
+import { Icon, IconProps } from '@/react/components/Icon';
+import { pluralize } from '@/portainer/helpers/strings';
+import { AutomationTestingProps } from '@/types';
+
+import { Link } from '@@/Link';
+
+interface Props extends IconProps, AutomationTestingProps {
+  type: string;
+  pluralType?: string; // in case the pluralise function isn't suitable
+  isLoading?: boolean;
+  isRefetching?: boolean;
+  value?: number;
+  to?: string;
+  params?: object;
+  children?: ReactNode;
+}
+
+export function DashboardItem({
+  icon,
+  type,
+  pluralType,
+  isLoading,
+  isRefetching,
+  value,
+  to,
+  params,
+  children,
+  'data-cy': dataCy,
+}: Props) {
+  const Item = (
+    <div
+      className={clsx(
+        'relative rounded-lg border border-solid p-3',
+        'border-gray-5 bg-gray-2 hover:border-blue-7 hover:bg-blue-2',
+        'th-dark:border-gray-neutral-8 th-dark:bg-gray-iron-10 th-dark:hover:border-blue-8 th-dark:hover:bg-gray-10',
+        'th-highcontrast:border-white th-highcontrast:bg-black th-highcontrast:hover:border-blue-8 th-highcontrast:hover:bg-gray-11'
+      )}
+      data-cy={dataCy}
+    >
+      <div
+        className={clsx(
+          'text-muted absolute right-2 top-2 flex items-center text-xs transition-opacity',
+          isRefetching ? 'opacity-100' : 'opacity-0'
+        )}
+      >
+        Refreshing total
+        <Loader2 className="ml-1 h-4 animate-spin-slow" />
+      </div>
+      <div
+        className={clsx(
+          'text-muted absolute right-2 top-2 flex items-center text-xs transition-opacity',
+          isLoading ? 'opacity-100' : 'opacity-0'
+        )}
+      >
+        Loading total
+        <Loader2 className="ml-1 h-4 animate-spin-slow" />
+      </div>
+      <div className="flex items-center" aria-label={type}>
+        <div
+          className={clsx(
+            'icon-badge mr-4 !p-2 text-2xl',
+            'bg-blue-3 text-blue-8',
+            'th-dark:bg-blue-3 th-dark:text-blue-8',
+            'th-highcontrast:bg-blue-3 th-highcontrast:text-blue-8'
+          )}
+        >
+          <Icon icon={icon} />
+        </div>
+
+        <div className="flex flex-col justify-around">
+          <div
+            className={clsx(
+              'text-2xl font-medium',
+              'text-gray-9',
+              'th-dark:text-white',
+              'th-highcontrast:text-white'
+            )}
+            aria-label="value"
+          >
+            {typeof value === 'undefined' ? '-' : value}
+          </div>
+          <div
+            className={clsx(
+              'text-xl',
+              'text-gray-7',
+              'th-dark:text-gray-warm-5',
+              'th-highcontrast:text-gray-warm-5'
+            )}
+            aria-label="resourceType"
+          >
+            {pluralize(value || 0, type, pluralType)}
+          </div>
+        </div>
+
+        <div className="ml-auto">{children}</div>
+      </div>
+    </div>
+  );
+
+  if (to) {
+    return (
+      <Link
+        to={to}
+        className="!no-underline"
+        params={params}
+        data-cy={`${dataCy}-link`}
+      >
+        {Item}
+      </Link>
+    );
+  }
+  return Item;
+}
diff --git a/app/react/components/DashboardItem/index.ts b/app/react/components/DashboardItem/index.ts
new file mode 100644
index 0000000..57116e0
--- /dev/null
+++ b/app/react/components/DashboardItem/index.ts
@@ -0,0 +1 @@
+export { DashboardItem } from './DashboardItem';
diff --git a/app/react/components/DateTimeField.tsx b/app/react/components/DateTimeField.tsx
new file mode 100644
index 0000000..d697f79
--- /dev/null
+++ b/app/react/components/DateTimeField.tsx
@@ -0,0 +1,57 @@
+import DateTimePicker from 'react-datetime-picker';
+import { Calendar, X } from 'lucide-react';
+
+import { isoDate } from '@/portainer/filters/filters';
+import { AutomationTestingProps } from '@/types';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+
+import 'react-datetime-picker/dist/DateTimePicker.css';
+import 'react-calendar/dist/Calendar.css';
+
+export const FORMAT = 'YYYY-MM-DD HH:mm';
+
+export function DateTimeField({
+  error,
+  label,
+  disabled,
+  name,
+  value,
+  onChange,
+  minDate,
+  'data-cy': dataCy,
+}: {
+  error?: string;
+  disabled?: boolean;
+  name: string;
+  value: Date | null;
+  onChange: (date: Date | null) => void;
+  label: string;
+  minDate?: Date;
+} & AutomationTestingProps) {
+  return (
+    <FormControl label={label} errors={error}>
+      {!disabled ? (
+        <DateTimePicker
+          format="y-MM-dd HH:mm"
+          className="form-control [&>div]:border-0"
+          name={name}
+          value={value}
+          onChange={onChange}
+          calendarIcon={<Calendar className="lucide" />}
+          clearIcon={<X className="lucide" />}
+          disableClock
+          data-cy={dataCy}
+          minDate={minDate}
+        />
+      ) : (
+        <Input
+          defaultValue={isoDate(value?.valueOf(), FORMAT)}
+          disabled
+          data-cy={`${dataCy}-disabled-value`}
+        />
+      )}
+    </FormControl>
+  );
+}
diff --git a/app/react/components/DetailsTable/DetailsRow.tsx b/app/react/components/DetailsTable/DetailsRow.tsx
new file mode 100644
index 0000000..3d20140
--- /dev/null
+++ b/app/react/components/DetailsTable/DetailsRow.tsx
@@ -0,0 +1,35 @@
+import clsx from 'clsx';
+import { ReactNode } from 'react';
+
+interface Props {
+  children: ReactNode;
+  label: ReactNode;
+  colClassName?: string;
+  className?: string;
+  columns?: Array<ReactNode>;
+  ariaLabel?: string;
+}
+
+export function DetailsRow({
+  label,
+  children,
+  colClassName,
+  className,
+  columns,
+  ariaLabel,
+}: Props) {
+  const labelString = typeof label === 'string' ? label : undefined;
+  return (
+    <tr className={className} aria-label={ariaLabel ?? labelString}>
+      <td className={clsx(colClassName, '!break-normal')}>{label}</td>
+      <td className={colClassName} data-cy={`detailsTable-${label}Value`}>
+        {children}
+      </td>
+      {columns?.map((column, index) => (
+        <td key={index} className={colClassName}>
+          {column}
+        </td>
+      ))}
+    </tr>
+  );
+}
diff --git a/app/react/components/DetailsTable/DetailsTable.stories.tsx b/app/react/components/DetailsTable/DetailsTable.stories.tsx
new file mode 100644
index 0000000..c95436d
--- /dev/null
+++ b/app/react/components/DetailsTable/DetailsTable.stories.tsx
@@ -0,0 +1,33 @@
+import { Meta, StoryFn } from '@storybook/react-webpack5';
+
+import { DetailsTable } from './DetailsTable';
+import { DetailsRow } from './DetailsRow';
+
+type Args = {
+  key1: string;
+  val1: string;
+  key2: string;
+  val2: string;
+};
+
+export default {
+  component: DetailsTable,
+  title: 'Components/Tables/DetailsTable',
+} as Meta;
+
+function Template({ key1, val1, key2, val2 }: Args) {
+  return (
+    <DetailsTable dataCy="details-table">
+      <DetailsRow label={key1}>{val1}</DetailsRow>
+      <DetailsRow label={key2}>{val2}</DetailsRow>
+    </DetailsTable>
+  );
+}
+
+export const Default: StoryFn<Args> = Template.bind({});
+Default.args = {
+  key1: 'Name',
+  val1: 'My Cool App',
+  key2: 'Id',
+  val2: 'dmsjs1532',
+};
diff --git a/app/react/components/DetailsTable/DetailsTable.test.tsx b/app/react/components/DetailsTable/DetailsTable.test.tsx
new file mode 100644
index 0000000..a4ede2f
--- /dev/null
+++ b/app/react/components/DetailsTable/DetailsTable.test.tsx
@@ -0,0 +1,24 @@
+import { render } from '@testing-library/react';
+
+import { DetailsTable } from './index';
+
+// should display child row elements
+test('should display child row elements', () => {
+  const person = {
+    name: 'Bob',
+    id: 'dmsjs1532',
+  };
+
+  const { queryByText } = render(
+    <DetailsTable dataCy="details-table">
+      <DetailsTable.Row label="Name">{person.name}</DetailsTable.Row>
+      <DetailsTable.Row label="Id">{person.id}</DetailsTable.Row>
+    </DetailsTable>
+  );
+
+  const nameRow = queryByText(person.name);
+  expect(nameRow).toBeVisible();
+
+  const idRow = queryByText(person.id);
+  expect(idRow).toBeVisible();
+});
diff --git a/app/react/components/DetailsTable/DetailsTable.tsx b/app/react/components/DetailsTable/DetailsTable.tsx
new file mode 100644
index 0000000..766bddd
--- /dev/null
+++ b/app/react/components/DetailsTable/DetailsTable.tsx
@@ -0,0 +1,42 @@
+import clsx from 'clsx';
+import { Children, PropsWithChildren } from 'react';
+
+type Props = {
+  dataCy: string;
+  headers?: string[];
+  className?: string;
+  emptyMessage?: string;
+};
+
+export function DetailsTable({
+  headers = [],
+  dataCy,
+  className,
+  emptyMessage,
+  children,
+}: PropsWithChildren<Props>) {
+  return (
+    <table className={clsx('table', className)} data-cy={dataCy}>
+      {headers.length > 0 && (
+        <thead>
+          <tr>
+            {headers.map((header) => (
+              <th key={header}>{header}</th>
+            ))}
+          </tr>
+        </thead>
+      )}
+      <tbody>
+        {Children.count(children) > 0 ? (
+          children
+        ) : (
+          <tr>
+            <td colSpan={headers.length} className="text-muted text-center">
+              {emptyMessage}
+            </td>
+          </tr>
+        )}
+      </tbody>
+    </table>
+  );
+}
diff --git a/app/react/components/DetailsTable/index.tsx b/app/react/components/DetailsTable/index.tsx
new file mode 100644
index 0000000..24ce102
--- /dev/null
+++ b/app/react/components/DetailsTable/index.tsx
@@ -0,0 +1,13 @@
+import { DetailsTable as MainComponent } from './DetailsTable';
+import { DetailsRow } from './DetailsRow';
+
+interface DetailsTableSubcomponents {
+  Row: typeof DetailsRow;
+}
+
+const DetailsTable = MainComponent as typeof MainComponent &
+  DetailsTableSubcomponents;
+
+DetailsTable.Row = DetailsRow;
+
+export { DetailsTable };
diff --git a/app/react/components/DropdownMenu/DropdownMenu.stories.tsx b/app/react/components/DropdownMenu/DropdownMenu.stories.tsx
new file mode 100644
index 0000000..31dbd7f
--- /dev/null
+++ b/app/react/components/DropdownMenu/DropdownMenu.stories.tsx
@@ -0,0 +1,57 @@
+import { Meta } from '@storybook/react-webpack5';
+import { useState } from 'react';
+import { Server, Cloud } from 'lucide-react';
+
+import { Icon } from '@@/Icon';
+
+import { DropdownMenu } from './DropdownMenu';
+
+export default {
+  component: DropdownMenu,
+  title: 'Components/DropdownMenu',
+} as Meta;
+
+const options = [
+  { key: 'Production', count: 12, icon: <Icon icon={Server} /> },
+  { key: 'Staging', count: 5, icon: <Icon icon={Cloud} /> },
+  { key: 'Development', count: 8 },
+];
+
+export function Interactive() {
+  const [selected, setSelected] = useState<string | null>(null);
+
+  return (
+    <DropdownMenu
+      label="Group"
+      options={options}
+      selected={selected}
+      onSelect={setSelected}
+      data-cy="dropdown-menu"
+    />
+  );
+}
+
+export function WithBadge() {
+  return (
+    <DropdownMenu
+      label="Group"
+      options={options}
+      selected="Production"
+      onSelect={() => {}}
+      badge="Production"
+      data-cy="dropdown-menu-badge"
+    />
+  );
+}
+
+export function WithoutCounts() {
+  return (
+    <DropdownMenu
+      label="Status"
+      options={[{ key: 'Online' }, { key: 'Offline' }, { key: 'Unknown' }]}
+      selected={null}
+      onSelect={() => {}}
+      data-cy="dropdown-menu-no-counts"
+    />
+  );
+}
diff --git a/app/react/components/DropdownMenu/DropdownMenu.test.tsx b/app/react/components/DropdownMenu/DropdownMenu.test.tsx
new file mode 100644
index 0000000..97e9bbf
--- /dev/null
+++ b/app/react/components/DropdownMenu/DropdownMenu.test.tsx
@@ -0,0 +1,167 @@
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+
+import { DropdownMenu } from './DropdownMenu';
+
+const defaultOptions = [
+  { key: 'Docker', count: 3 },
+  { key: 'Kubernetes', count: 2 },
+];
+
+function renderDropdown(
+  overrides: Partial<React.ComponentProps<typeof DropdownMenu>> = {}
+) {
+  const props = {
+    label: 'Group',
+    options: defaultOptions,
+    selected: null as string | null,
+    onSelect: vi.fn(),
+    ...overrides,
+  };
+
+  return {
+    ...render(<DropdownMenu {...props} />),
+    props,
+  };
+}
+
+describe('DropdownMenu', () => {
+  test('renders the trigger button with the label', () => {
+    renderDropdown({ label: 'Platform' });
+
+    expect(
+      screen.getByRole('button', { name: /Platform/i })
+    ).toBeInTheDocument();
+  });
+
+  test('opens the menu on click showing All and all options', async () => {
+    const user = userEvent.setup();
+    renderDropdown();
+
+    await user.click(screen.getByRole('button', { name: /Group/i }));
+
+    expect(screen.getByRole('menu', { name: /Group/i })).toBeVisible();
+    expect(screen.getByRole('menuitem', { name: /All/ })).toBeVisible();
+    expect(screen.getByRole('menuitem', { name: /Docker/ })).toBeVisible();
+    expect(screen.getByRole('menuitem', { name: /Kubernetes/ })).toBeVisible();
+  });
+
+  test('displays counts for each option', async () => {
+    const user = userEvent.setup();
+    renderDropdown();
+
+    await user.click(screen.getByRole('button', { name: /Group/i }));
+
+    const menu = screen.getByRole('menu', { name: /Group/i });
+    expect(menu).toHaveTextContent('3');
+    expect(menu).toHaveTextContent('2');
+  });
+
+  test('renders option icons when provided', async () => {
+    const user = userEvent.setup();
+    renderDropdown({
+      options: [
+        { key: 'Docker', count: 3, icon: <span data-testid="docker-icon" /> },
+      ],
+    });
+
+    await user.click(screen.getByRole('button', { name: /Group/i }));
+
+    expect(
+      document.querySelector('[data-testid="docker-icon"]')
+    ).toBeInTheDocument();
+  });
+
+  test('renders option label when provided instead of key', async () => {
+    const user = userEvent.setup();
+    renderDropdown({
+      options: [{ key: 'docker', label: 'Docker Engine', count: 5 }],
+    });
+
+    await user.click(screen.getByRole('button', { name: /Group/i }));
+
+    expect(screen.getByText('Docker Engine')).toBeInTheDocument();
+  });
+
+  test('shows badge when badge is provided', () => {
+    renderDropdown({ badge: 'Docker' });
+
+    const button = screen.getByRole('button', { name: /Group/i });
+    expect(button).toHaveTextContent('Docker');
+  });
+
+  test('does not show badge when badge is not provided', () => {
+    renderDropdown({ badge: undefined });
+
+    const button = screen.getByRole('button', { name: /Group/i });
+    expect(button).not.toHaveTextContent('Docker');
+  });
+
+  test('calls onClick when trigger button is clicked', async () => {
+    const user = userEvent.setup();
+    const onClick = vi.fn();
+    renderDropdown({ onClick });
+
+    await user.click(screen.getByRole('button', { name: /Group/i }));
+
+    expect(onClick).toHaveBeenCalled();
+  });
+
+  test('closes the menu when clicking outside', async () => {
+    const user = userEvent.setup();
+    renderDropdown();
+
+    await user.click(screen.getByRole('button', { name: /Group/i }));
+    expect(screen.getByRole('menu', { name: /Group/i })).toBeVisible();
+
+    await user.click(document.body);
+    expect(screen.queryByRole('menu')).not.toBeInTheDocument();
+  });
+
+  test('highlights the selected option', async () => {
+    const user = userEvent.setup();
+    renderDropdown({ selected: 'Docker' });
+
+    await user.click(screen.getByRole('button', { name: /Group/i }));
+
+    const dockerItem = screen.getByRole('menuitem', { name: /Docker/ });
+    expect(dockerItem.className).toContain('bg-blue-2');
+  });
+
+  test('highlights All when nothing is selected', async () => {
+    const user = userEvent.setup();
+    renderDropdown({ selected: null });
+
+    await user.click(screen.getByRole('button', { name: /Group/i }));
+
+    const allItem = screen.getByRole('menuitem', { name: /All/ });
+    expect(allItem.className).toContain('bg-blue-2');
+  });
+
+  test('applies custom className to trigger button', () => {
+    renderDropdown({ className: 'custom-class' });
+
+    expect(screen.getByRole('button', { name: /Group/i })).toHaveClass(
+      'custom-class'
+    );
+  });
+
+  test('shows loading spinner and hides menu items when options is undefined', async () => {
+    const user = userEvent.setup();
+    renderDropdown({ options: undefined });
+
+    await user.click(screen.getByRole('button', { name: /Group/i }));
+
+    expect(screen.getByText('Loading...')).toBeVisible();
+    expect(screen.queryByRole('menuitem')).not.toBeInTheDocument();
+  });
+
+  test('applies data-cy to trigger button', () => {
+    renderDropdown({ 'data-cy': 'sort-by-group-button' });
+
+    expect(screen.getByRole('button', { name: /Group/i })).toHaveAttribute(
+      'data-cy',
+      'sort-by-group-button'
+    );
+  });
+});
diff --git a/app/react/components/DropdownMenu/DropdownMenu.tsx b/app/react/components/DropdownMenu/DropdownMenu.tsx
new file mode 100644
index 0000000..94db5e8
--- /dev/null
+++ b/app/react/components/DropdownMenu/DropdownMenu.tsx
@@ -0,0 +1,133 @@
+import React from 'react';
+import { ChevronDown, Loader2 } from 'lucide-react';
+import {
+  Menu,
+  MenuButton as ReachMenuButton,
+  MenuList,
+  MenuItem,
+} from '@reach/menu-button';
+import clsx from 'clsx';
+
+export interface DropdownOption {
+  key: string;
+  label?: string;
+  count?: number;
+  icon?: React.ReactNode;
+}
+
+interface Props {
+  label: string;
+  options: DropdownOption[] | undefined;
+  selected: string | null;
+  onSelect: (key: string | null) => void;
+  badge?: string | null;
+  onClick?: () => void;
+  className?: string;
+  'aria-pressed'?: boolean;
+  'data-cy'?: string;
+}
+
+const menuListStyles =
+  'mt-1 overflow-hidden rounded-lg ' +
+  'shadow-[0_6px_12px_rgba(0,0,0,0.18)] ' +
+  '!border !border-solid !border-gray-5 th-dark:!border-gray-8 th-highcontrast:!border-gray-7 ' +
+  'bg-white th-dark:bg-gray-iron-11 th-highcontrast:bg-black';
+
+const menuItemBase =
+  'flex items-center gap-2 w-full border-none px-3 py-1.5 text-left text-sm whitespace-nowrap bg-transparent cursor-pointer';
+
+const menuItemSelected =
+  '!bg-blue-2 text-blue-8 [&[data-selected]]:!bg-blue-2 [&[data-selected]]:!text-blue-8 ' +
+  'th-dark:!bg-blue-8 th-dark:text-blue-4 th-dark:[&[data-selected]]:!bg-blue-8 th-dark:[&[data-selected]]:!text-blue-4 ' +
+  'th-highcontrast:!bg-blue-8 th-highcontrast:!text-white th-highcontrast:[&[data-selected]]:!bg-blue-8 th-highcontrast:[&[data-selected]]:!text-white';
+
+const menuItemUnselected =
+  'hover:bg-gray-3 [&[data-selected]]:!bg-gray-3 [&[data-selected]]:!text-gray-9 ' +
+  'th-dark:hover:bg-gray-8 th-dark:[&[data-selected]]:!bg-gray-8 th-dark:[&[data-selected]]:!text-white ' +
+  'th-highcontrast:text-white th-highcontrast:hover:bg-white th-highcontrast:hover:text-black th-highcontrast:[&[data-selected]]:!bg-white th-highcontrast:[&[data-selected]]:!text-black';
+
+const countBadge =
+  'inline-flex items-center justify-center min-w-[1.25rem] h-5 rounded-full px-1 text-xs font-normal ' +
+  'bg-gray-4 text-gray-9 ' +
+  'th-dark:bg-gray-7 th-dark:text-gray-3 ' +
+  'th-highcontrast:bg-blue-8 th-highcontrast:text-white';
+
+export function DropdownMenu({
+  label,
+  options,
+  selected,
+  onSelect,
+  badge,
+  onClick,
+  className,
+  'aria-pressed': ariaPressed,
+  'data-cy': dataCy,
+}: Props) {
+  return (
+    <Menu>
+      <ReachMenuButton
+        className={clsx('group flex gap-1', className)}
+        onClick={() => onClick?.()}
+        aria-pressed={ariaPressed}
+        data-cy={dataCy}
+      >
+        {label}
+        {badge && (
+          <span className="py-0.2 ml-1 rounded-md bg-blue-7 px-1 text-[10px] font-normal text-white">
+            {badge}
+          </span>
+        )}
+        <ChevronDown
+          className="ml-1 h-3 w-3 self-center transition-transform group-[[aria-expanded=true]]:rotate-180"
+          aria-hidden="true"
+        />
+      </ReachMenuButton>
+      <MenuList className={menuListStyles}>
+        {typeof options === 'undefined' ? (
+          <div className="flex items-center justify-center gap-2 px-3 py-3 text-sm text-gray-6">
+            <Loader2 className="h-3.5 w-3.5 animate-spin" />
+            Loading...
+          </div>
+        ) : (
+          <>
+            <MenuItem
+              onSelect={() => onSelect(null)}
+              className={clsx(
+                menuItemBase,
+                !selected ? menuItemSelected : menuItemUnselected
+              )}
+            >
+              <span className="flex-1">All</span>
+            </MenuItem>
+            <div
+              className="h-px bg-gray-4 th-highcontrast:bg-gray-7 th-dark:bg-gray-8"
+              role="separator"
+            />
+            {options.map((option) => (
+              <MenuItem
+                key={option.key}
+                onSelect={() => onSelect(option.key)}
+                className={clsx(
+                  menuItemBase,
+                  selected === option.key
+                    ? menuItemSelected
+                    : menuItemUnselected
+                )}
+              >
+                {option.icon && (
+                  <span className="flex h-4 w-4 shrink-0 items-center justify-center">
+                    {option.icon}
+                  </span>
+                )}
+                <span className="flex-1">{option.label ?? option.key}</span>
+                {option.count !== undefined && (
+                  <span className={countBadge}>{option.count}</span>
+                )}
+              </MenuItem>
+            ))}
+          </>
+        )}
+      </MenuList>
+    </Menu>
+  );
+}
diff --git a/app/react/components/EdgeIndicator.test.tsx b/app/react/components/EdgeIndicator.test.tsx
new file mode 100644
index 0000000..4832264
--- /dev/null
+++ b/app/react/components/EdgeIndicator.test.tsx
@@ -0,0 +1,43 @@
+import { render } from '@testing-library/react';
+
+import { createMockEnvironment } from '@/react-tools/test-mocks';
+
+import { withTestQueryProvider } from '../test-utils/withTestQuery';
+
+import { EdgeIndicator } from './EdgeIndicator';
+
+test('when edge id is not set, should show unassociated label', async () => {
+  const { queryByLabelText } = await renderComponent();
+
+  const unassociatedLabel = queryByLabelText('unassociated');
+
+  expect(unassociatedLabel).toBeVisible();
+});
+
+test('given edge id and last checkin is set, should show heartbeat', async () => {
+  const { queryByLabelText } = await renderComponent('id', 1);
+
+  expect(queryByLabelText('edge-last-checkin')).toBeVisible();
+});
+
+async function renderComponent(
+  edgeId = '',
+  lastCheckInDate = 0,
+  checkInInterval = 0
+) {
+  const environment = createMockEnvironment();
+
+  environment.EdgeID = edgeId;
+  environment.LastCheckInDate = lastCheckInDate;
+  environment.EdgeCheckinInterval = checkInInterval;
+
+  const Wrapped = withTestQueryProvider(EdgeIndicator);
+
+  const queries = render(
+    <Wrapped environment={environment} showLastCheckInDate />
+  );
+
+  await expect(queries.findByRole('status')).resolves.toBeVisible();
+
+  return queries;
+}
diff --git a/app/react/components/EdgeIndicator.tsx b/app/react/components/EdgeIndicator.tsx
new file mode 100644
index 0000000..f383c31
--- /dev/null
+++ b/app/react/components/EdgeIndicator.tsx
@@ -0,0 +1,46 @@
+import { Activity } from 'lucide-react';
+
+import { isoDateFromTimestamp } from '@/portainer/filters/filters';
+import { Environment } from '@/react/portainer/environments/types';
+
+import { EnvironmentStatusBadgeItem } from './EnvironmentStatusBadgeItem';
+
+interface Props {
+  showLastCheckInDate?: boolean;
+  environment: Environment;
+}
+
+export function EdgeIndicator({
+  environment,
+  showLastCheckInDate = false,
+}: Props) {
+  const associated = !!environment.EdgeID;
+  if (!associated) {
+    return (
+      <span role="status" aria-label="edge-status">
+        <EnvironmentStatusBadgeItem aria-label="unassociated">
+          <span className="whitespace-nowrap">Not associated</span>
+        </EnvironmentStatusBadgeItem>
+      </span>
+    );
+  }
+
+  return (
+    <span
+      role="status"
+      aria-label="edge-status"
+      className="flex items-center gap-1"
+    >
+      {showLastCheckInDate && !!environment.LastCheckInDate && (
+        <span
+          className="small text-muted vertical-center"
+          aria-label="edge-last-checkin"
+          title="Last edge check-in"
+        >
+          <Activity className="icon icon-sm space-right" aria-hidden="true" />
+          {isoDateFromTimestamp(environment.LastCheckInDate)}
+        </span>
+      )}
+    </span>
+  );
+}
diff --git a/app/react/components/EnvironmentStatusBadge.tsx b/app/react/components/EnvironmentStatusBadge.tsx
new file mode 100644
index 0000000..80679b7
--- /dev/null
+++ b/app/react/components/EnvironmentStatusBadge.tsx
@@ -0,0 +1,67 @@
+import clsx from 'clsx';
+
+import {
+  Environment,
+  EnvironmentStatus,
+} from '@/react/portainer/environments/types';
+import { isEdgeEnvironment } from '@/react/portainer/environments/utils';
+
+interface Props {
+  environment: Environment;
+}
+
+export function EnvironmentStatusBadge({ environment }: Props) {
+  if (isEdgeEnvironment(environment.Type)) {
+    return (
+      <EnvironmentStatusBadgeComponent
+        color={environment.Heartbeat ? 'success' : 'danger'}
+        text={environment.Heartbeat ? 'Heartbeat' : 'Down'}
+        heartbeat={environment.Heartbeat}
+      />
+    );
+  }
+
+  return environment.Status === EnvironmentStatus.Up ? (
+    <EnvironmentStatusBadgeComponent color="success" text="Up" />
+  ) : (
+    <EnvironmentStatusBadgeComponent color="danger" text="Down" />
+  );
+}
+
+function EnvironmentStatusBadgeComponent({
+  color,
+  text,
+  heartbeat,
+}: {
+  color: 'danger' | 'success';
+  text: string;
+  heartbeat?: boolean;
+}) {
+  return (
+    <span
+      className={clsx(
+        'flex items-center gap-2 rounded-xl',
+        'w-fit px-2 py-px',
+        'text-xs font-bold',
+        {
+          'bg-success-7/20 text-success-7': color === 'success',
+          'bg-error-7/20 text-error-7': color === 'danger',
+        }
+      )}
+      aria-label="status-badge"
+    >
+      <span
+        aria-hidden="true"
+        className={clsx(
+          'block h-2 w-2 rounded-full',
+          { 'animate-pulse': heartbeat },
+          {
+            'bg-success-7': color === 'success',
+            'bg-error-7': color === 'danger',
+          }
+        )}
+      />
+      <span>{text}</span>
+    </span>
+  );
+}
diff --git a/app/react/components/EnvironmentStatusBadgeItem.tsx b/app/react/components/EnvironmentStatusBadgeItem.tsx
new file mode 100644
index 0000000..ec63a52
--- /dev/null
+++ b/app/react/components/EnvironmentStatusBadgeItem.tsx
@@ -0,0 +1,48 @@
+import clsx from 'clsx';
+import { AriaAttributes, PropsWithChildren } from 'react';
+
+import { Icon, IconProps } from '@@/Icon';
+
+export function EnvironmentStatusBadgeItem({
+  className,
+  children,
+  color = 'default',
+  icon,
+  ...aria
+}: PropsWithChildren<
+  {
+    className?: string;
+    color?: 'success' | 'danger' | 'default';
+    icon?: IconProps['icon'];
+  } & AriaAttributes
+>) {
+  return (
+    <span
+      className={clsx(
+        'flex items-center gap-1',
+        'rounded border-2 border-solid',
+        'w-fit px-1 py-px',
+        'text-xs font-semibold text-gray-7',
+        {
+          'border-green-3 bg-green-2': color === 'success',
+          'border-error-3 bg-error-2': color === 'danger',
+        },
+        className
+      )}
+      // eslint-disable-next-line react/jsx-props-no-spreading
+      {...aria}
+    >
+      {icon && (
+        <Icon
+          icon={icon}
+          className={clsx({
+            '!text-green-7': color === 'success',
+            '!text-error-7': color === 'danger',
+          })}
+        />
+      )}
+
+      {children}
+    </span>
+  );
+}
diff --git a/app/react/components/ExpandableMessageByLines.stories.tsx b/app/react/components/ExpandableMessageByLines.stories.tsx
new file mode 100644
index 0000000..4cbe330
--- /dev/null
+++ b/app/react/components/ExpandableMessageByLines.stories.tsx
@@ -0,0 +1,115 @@
+import { Meta, StoryObj } from '@storybook/react-webpack5';
+
+import { ExpandableMessageByLines } from './ExpandableMessageByLines';
+
+export default {
+  component: ExpandableMessageByLines,
+  title: 'Components/ExpandableMessageByLines',
+  argTypes: {
+    maxLines: {
+      control: {
+        type: 'select',
+        options: [2, 5, 10, 20, 50],
+      },
+      description: 'Maximum number of lines to show before truncating',
+    },
+    children: {
+      control: 'text',
+      description: 'The text content to display',
+    },
+  },
+} as Meta;
+
+interface Args {
+  children: string;
+  maxLines?: 2 | 5 | 10 | 20 | 50;
+}
+
+// Short text that won't be truncated
+export const ShortText: StoryObj<Args> = {
+  args: {
+    children: 'This is a short message that should not be truncated.',
+    maxLines: 10,
+  },
+};
+
+// Long text that will be truncated
+export const LongText: StoryObj<Args> = {
+  args: {
+    children: `This is a very long message that should be truncated after the specified number of lines.
+It contains multiple lines of text to demonstrate the expandable functionality.
+The component will show a "Show more" button when the content exceeds the maxLines limit.
+When clicked, it will expand to show the full content and change to "Show less".
+This is useful for displaying long error messages, logs, or any text content that might be too long for the UI.`,
+    maxLines: 5,
+  },
+};
+
+// Text with line breaks
+export const TextWithLineBreaks: StoryObj<Args> = {
+  args: {
+    children: `Line 1: This is the first line
+Line 2: This is the second line
+Line 3: This is the third line
+Line 4: This is the fourth line
+Line 5: This is the fifth line
+Line 6: This is the sixth line
+Line 7: This is the seventh line
+Line 8: This is the eighth line
+Line 9: This is the ninth line
+Line 10: This is the tenth line`,
+    maxLines: 5,
+  },
+};
+
+// Very short maxLines
+export const VeryShortMaxLines: StoryObj<Args> = {
+  args: {
+    children: `This text will be truncated after just 2 lines.
+This is the second line.
+This is the third line that should be hidden initially.
+This is the fourth line that should also be hidden.`,
+    maxLines: 2,
+  },
+};
+
+// Error message example
+export const ErrorMessage: StoryObj<Args> = {
+  args: {
+    children: `Error: Failed to connect to the Docker daemon at unix:///var/run/docker.sock.
+Is the docker daemon running?
+
+This error typically occurs when:
+1. Docker daemon is not running
+2. User doesn't have permission to access the Docker socket
+3. Docker socket path is incorrect
+4. Docker service has crashed
+
+To resolve this issue:
+1. Start the Docker daemon: sudo systemctl start docker
+2. Add user to docker group: sudo usermod -aG docker $USER
+3. Verify Docker is running: docker ps
+4. Check Docker socket permissions: ls -la /var/run/docker.sock`,
+    maxLines: 5,
+  },
+};
+
+// Log output example
+export const LogOutput: StoryObj<Args> = {
+  args: {
+    children: `2024-01-15T10:30:45.123Z INFO  [ContainerService] Starting container nginx:latest
+2024-01-15T10:30:45.234Z DEBUG [ContainerService] Container ID: abc123def456
+2024-01-15T10:30:45.345Z INFO  [ContainerService] Container started successfully
+2024-01-15T10:30:45.456Z DEBUG [NetworkService] Creating network bridge
+2024-01-15T10:30:45.567Z INFO  [NetworkService] Network created: portainer_network
+2024-01-15T10:30:45.678Z DEBUG [VolumeService] Mounting volume /data
+2024-01-15T10:30:45.789Z INFO  [VolumeService] Volume mounted successfully
+2024-01-15T10:30:45.890Z DEBUG [ContainerService] Setting up port mapping 80:80
+2024-01-15T10:30:45.901Z INFO  [ContainerService] Port mapping configured
+2024-01-15T10:30:45.912Z DEBUG [ContainerService] Setting environment variables
+2024-01-15T10:30:45.923Z INFO  [ContainerService] Environment variables set
+2024-01-15T10:30:45.934Z DEBUG [ContainerService] Starting container process
+2024-01-15T10:30:45.945Z INFO  [ContainerService] Container process started`,
+    maxLines: 10,
+  },
+};
diff --git a/app/react/components/ExpandableMessageByLines.test.tsx b/app/react/components/ExpandableMessageByLines.test.tsx
new file mode 100644
index 0000000..d403fcb
--- /dev/null
+++ b/app/react/components/ExpandableMessageByLines.test.tsx
@@ -0,0 +1,137 @@
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { vi } from 'vitest';
+
+import { ExpandableMessageByLines } from '@@/ExpandableMessageByLines';
+
+describe('ExpandableMessageByLines', () => {
+  // Mock scrollHeight and clientHeight for testing truncation
+  const mockScrollHeight = vi.fn();
+  const mockClientHeight = vi.fn();
+
+  beforeEach(() => {
+    // Mock the properties on HTMLDivElement prototype
+    Object.defineProperty(HTMLDivElement.prototype, 'scrollHeight', {
+      get: mockScrollHeight,
+      configurable: true,
+    });
+
+    Object.defineProperty(HTMLDivElement.prototype, 'clientHeight', {
+      get: mockClientHeight,
+      configurable: true,
+    });
+  });
+
+  afterEach(() => {
+    vi.clearAllMocks();
+  });
+
+  describe('Basic Rendering', () => {
+    it('should render text content', () => {
+      const text = 'This is test content';
+      // Mock non-truncated content (scrollHeight === clientHeight)
+      mockScrollHeight.mockReturnValue(100);
+      mockClientHeight.mockReturnValue(100);
+
+      render(<ExpandableMessageByLines>{text}</ExpandableMessageByLines>);
+
+      expect(screen.getByText(text)).toBeInTheDocument();
+    });
+
+    it('should show expand button only when text is truncated', () => {
+      const text = 'This is test content that should be truncated';
+      // Mock truncated content (scrollHeight > clientHeight)
+      mockScrollHeight.mockReturnValue(300);
+      mockClientHeight.mockReturnValue(200);
+
+      render(<ExpandableMessageByLines>{text}</ExpandableMessageByLines>);
+
+      expect(
+        screen.getByRole('button', { name: 'Show more' })
+      ).toBeInTheDocument();
+      expect(
+        screen.getByTestId('expandable-message-lines-button')
+      ).toBeInTheDocument();
+    });
+
+    it('should hide expand button when text is not truncated', () => {
+      const text = 'Short text';
+      // Mock non-truncated content (scrollHeight === clientHeight)
+      mockScrollHeight.mockReturnValue(50);
+      mockClientHeight.mockReturnValue(50);
+
+      render(<ExpandableMessageByLines>{text}</ExpandableMessageByLines>);
+
+      expect(screen.queryByRole('button')).not.toBeInTheDocument();
+      expect(
+        screen.queryByTestId('expandable-message-lines-button')
+      ).not.toBeInTheDocument();
+    });
+  });
+
+  describe('Expand/Collapse Functionality', () => {
+    it('should toggle between Show more and Show less when button is clicked', async () => {
+      const user = userEvent.setup();
+      const text =
+        'This is a long text that should be truncated and show the expand button';
+
+      // Mock truncated content (scrollHeight > clientHeight)
+      mockScrollHeight.mockReturnValue(400);
+      mockClientHeight.mockReturnValue(200);
+
+      render(<ExpandableMessageByLines>{text}</ExpandableMessageByLines>);
+
+      const button = screen.getByRole('button');
+
+      // Initially should show "Show more"
+      expect(screen.getByText('Show more')).toBeInTheDocument();
+
+      // Click to expand
+      await user.click(button);
+      expect(screen.getByText('Show less')).toBeInTheDocument();
+
+      // Click to collapse
+      await user.click(button);
+      expect(screen.getByText('Show more')).toBeInTheDocument();
+    });
+  });
+
+  describe('Text Content Handling', () => {
+    it('should not show button for single space strings when not truncated', () => {
+      // Mock non-truncated content (scrollHeight === clientHeight)
+      mockScrollHeight.mockReturnValue(20);
+      mockClientHeight.mockReturnValue(20);
+
+      render(<ExpandableMessageByLines> </ExpandableMessageByLines>);
+
+      expect(screen.queryByRole('button')).not.toBeInTheDocument();
+    });
+
+    it('should show button for single space strings when truncated', () => {
+      // Mock truncated content (scrollHeight > clientHeight)
+      mockScrollHeight.mockReturnValue(100);
+      mockClientHeight.mockReturnValue(50);
+
+      render(<ExpandableMessageByLines> </ExpandableMessageByLines>);
+
+      expect(screen.getByRole('button')).toBeInTheDocument();
+    });
+
+    it('should handle different maxLines values', () => {
+      const longText =
+        'Line 1\nLine 2\nLine 3\nLine 4\nLine 5\nLine 6\nLine 7\nLine 8\nLine 9\nLine 10\nLine 11\nLine 12';
+      // Mock truncated content for 5 lines (scrollHeight > clientHeight)
+      mockScrollHeight.mockReturnValue(240);
+      mockClientHeight.mockReturnValue(100);
+
+      render(
+        <ExpandableMessageByLines maxLines={5}>
+          {longText}
+        </ExpandableMessageByLines>
+      );
+
+      expect(screen.getByRole('button')).toBeInTheDocument();
+      expect(screen.getByText('Show more')).toBeInTheDocument();
+    });
+  });
+});
diff --git a/app/react/components/ExpandableMessageByLines.tsx b/app/react/components/ExpandableMessageByLines.tsx
new file mode 100644
index 0000000..57c5cc7
--- /dev/null
+++ b/app/react/components/ExpandableMessageByLines.tsx
@@ -0,0 +1,76 @@
+import { useRef, useState, useEffect, useCallback } from 'react';
+
+import { Button } from '@@/buttons';
+
+// use enum so that the tailwind classes aren't interpolated
+type MaxLines = 2 | 5 | 10 | 20 | 50;
+const lineClampClasses: Record<MaxLines, string> = {
+  2: 'line-clamp-[2]',
+  5: 'line-clamp-[5]',
+  10: 'line-clamp-[10]',
+  20: 'line-clamp-[20]',
+  50: 'line-clamp-[50]',
+};
+
+interface LineBasedProps {
+  children: string;
+  maxLines?: MaxLines;
+}
+
+export function ExpandableMessageByLines({
+  children,
+  maxLines = 10,
+}: LineBasedProps) {
+  const [isExpanded, setIsExpanded] = useState(false);
+  const [isTruncated, setIsTruncated] = useState(false);
+  const contentRef = useRef<HTMLDivElement>(null);
+
+  const checkTruncation = useCallback(() => {
+    const el = contentRef.current;
+    if (el) {
+      setIsTruncated(el.scrollHeight > el.clientHeight);
+    }
+  }, []);
+
+  useEffect(() => {
+    checkTruncation();
+
+    // Use requestAnimationFrame for better performance
+    let rafId: number;
+    function handleResize() {
+      if (rafId) cancelAnimationFrame(rafId);
+      rafId = requestAnimationFrame(checkTruncation);
+    }
+
+    window.addEventListener('resize', handleResize);
+
+    return () => {
+      window.removeEventListener('resize', handleResize);
+      if (rafId) cancelAnimationFrame(rafId);
+    };
+  }, [children, maxLines, checkTruncation, isExpanded]);
+
+  return (
+    <div className="flex flex-col items-start">
+      <div
+        ref={contentRef}
+        className={`overflow-hidden whitespace-pre-wrap break-words ${
+          isExpanded ? '' : lineClampClasses[maxLines]
+        }`}
+      >
+        {children}
+      </div>
+      {(isTruncated || isExpanded) && (
+        <Button
+          color="link"
+          size="xsmall"
+          onClick={() => setIsExpanded(!isExpanded)}
+          className="!ml-0 mt-1 !p-0"
+          data-cy="expandable-message-lines-button"
+        >
+          {isExpanded ? 'Show less' : 'Show more'}
+        </Button>
+      )}
+    </div>
+  );
+}
diff --git a/app/react/components/ExternalLink.tsx b/app/react/components/ExternalLink.tsx
new file mode 100644
index 0000000..1bd839c
--- /dev/null
+++ b/app/react/components/ExternalLink.tsx
@@ -0,0 +1,32 @@
+import { ArrowUpRight } from 'lucide-react';
+import { PropsWithChildren } from 'react';
+import clsx from 'clsx';
+
+import { AutomationTestingProps } from '@/types';
+
+interface Props {
+  to: string;
+  className?: string;
+  showIcon?: boolean;
+}
+
+export function ExternalLink({
+  to,
+  className,
+  children,
+  showIcon = true,
+  'data-cy': dataCy,
+}: PropsWithChildren<Props & AutomationTestingProps>) {
+  return (
+    <a
+      href={to}
+      target="_blank"
+      rel="noreferrer"
+      data-cy={dataCy}
+      className={clsx('inline-flex align-baseline', className)}
+    >
+      {children}
+      {showIcon && <ArrowUpRight className="align-top" />}
+    </a>
+  );
+}
diff --git a/app/react/components/FallbackImage.tsx b/app/react/components/FallbackImage.tsx
new file mode 100644
index 0000000..eaa4f12
--- /dev/null
+++ b/app/react/components/FallbackImage.tsx
@@ -0,0 +1,31 @@
+import { ReactNode, useEffect, useState } from 'react';
+
+interface Props {
+  // props for the image to load
+  src?: string; // a link to an external image
+  fallbackIcon: ReactNode;
+  alt?: string;
+  className?: string;
+}
+
+export function FallbackImage({ src, fallbackIcon, alt, className }: Props) {
+  const [error, setError] = useState(false);
+
+  useEffect(() => {
+    setError(false);
+  }, [src]);
+
+  if (!error && src) {
+    return (
+      <img
+        className={className}
+        src={src}
+        alt={alt}
+        onError={() => setError(true)}
+      />
+    );
+  }
+
+  // fallback icon if there is an error loading the image
+  return <div className={className}>{fallbackIcon}</div>;
+}
diff --git a/app/react/components/HelpLink/HelpLink.tsx b/app/react/components/HelpLink/HelpLink.tsx
new file mode 100644
index 0000000..8596baf
--- /dev/null
+++ b/app/react/components/HelpLink/HelpLink.tsx
@@ -0,0 +1,23 @@
+import { ReactNode } from 'react';
+
+import { useDocsUrl } from '@@/PageHeader/ContextHelp';
+
+type HelpLinkProps = {
+  docLink: string;
+  target?: string;
+  children?: ReactNode;
+};
+
+export function HelpLink({
+  docLink,
+  target = '_blank',
+  children,
+}: HelpLinkProps) {
+  const docsUrl = useDocsUrl(docLink);
+
+  return (
+    <a href={docsUrl} target={target} rel="noopener noreferrer">
+      {children}
+    </a>
+  );
+}
diff --git a/app/react/components/HelpLink/index.ts b/app/react/components/HelpLink/index.ts
new file mode 100644
index 0000000..c3473f1
--- /dev/null
+++ b/app/react/components/HelpLink/index.ts
@@ -0,0 +1 @@
+export { HelpLink } from './HelpLink';
diff --git a/app/react/components/HubspotForm.tsx b/app/react/components/HubspotForm.tsx
new file mode 100644
index 0000000..74ac8de
--- /dev/null
+++ b/app/react/components/HubspotForm.tsx
@@ -0,0 +1,112 @@
+import { ReactNode, useRef } from 'react';
+import { useQuery } from '@tanstack/react-query';
+
+let globalId = 0;
+
+interface Props {
+  portalId: HubSpotCreateFormOptions['portalId'];
+  formId: HubSpotCreateFormOptions['formId'];
+  region: HubSpotCreateFormOptions['region'];
+
+  onSubmitted: () => void;
+
+  loading?: ReactNode;
+}
+
+export function HubspotForm({
+  loading,
+  portalId,
+  region,
+  formId,
+  onSubmitted,
+}: Props) {
+  const elRef = useRef<HTMLDivElement>(null);
+  const id = useRef(`reactHubspotForm${globalId++}`);
+  const { isLoading } = useHubspotForm({
+    elId: id.current,
+    formId,
+    portalId,
+    region,
+    onSubmitted,
+  });
+
+  return (
+    <>
+      <div
+        ref={elRef}
+        id={id.current}
+        style={{ display: isLoading ? 'none' : 'block' }}
+      />
+      {isLoading && loading}
+    </>
+  );
+}
+
+function useHubspotForm({
+  elId,
+  formId,
+  portalId,
+  region,
+  onSubmitted,
+}: {
+  elId: string;
+  portalId: HubSpotCreateFormOptions['portalId'];
+  formId: HubSpotCreateFormOptions['formId'];
+  region: HubSpotCreateFormOptions['region'];
+
+  onSubmitted: () => void;
+}) {
+  return useQuery(
+    ['hubspot', { elId, formId, portalId, region }],
+    async () => {
+      await loadHubspot();
+      await createForm(`#${elId}`, {
+        formId,
+        portalId,
+        region,
+        onFormSubmitted: onSubmitted,
+      });
+    },
+    {
+      refetchOnWindowFocus: false,
+    }
+  );
+}
+
+async function loadHubspot() {
+  return new Promise<void>((resolve) => {
+    if (window.hbspt) {
+      resolve();
+      return;
+    }
+
+    const script = document.createElement(`script`);
+
+    script.defer = true;
+    script.onload = () => {
+      resolve();
+    };
+    script.src = `//js.hsforms.net/forms/v2.js`;
+    document.head.appendChild(script);
+  });
+}
+
+async function createForm(
+  target: string,
+  options: Omit<HubSpotCreateFormOptions, 'target'>
+) {
+  return new Promise<void>((resolve) => {
+    if (!window.hbspt) {
+      throw new Error('hbspt object is missing');
+    }
+
+    window.hbspt.forms.create({
+      ...options,
+      target,
+      onFormReady(...rest) {
+        options.onFormReady?.(...rest);
+        resolve();
+      },
+    });
+  });
+}
diff --git a/app/react/components/Icon.tsx b/app/react/components/Icon.tsx
new file mode 100644
index 0000000..6d8e0bc
--- /dev/null
+++ b/app/react/components/Icon.tsx
@@ -0,0 +1,83 @@
+import clsx from 'clsx';
+import { ComponentType, ReactNode } from 'react';
+import * as lucideIcons from 'lucide-react';
+import { isValidElementType } from 'react-is';
+
+import Svg, { SvgIcons } from './Svg';
+
+export interface IconProps {
+  icon: ReactNode | ComponentType<unknown>;
+  iconClass?: string;
+}
+
+export type IconMode =
+  | 'alt'
+  | 'primary'
+  | 'primary-alt'
+  | 'secondary'
+  | 'secondary-alt'
+  | 'warning'
+  | 'warning-alt'
+  | 'danger'
+  | 'danger-alt'
+  | 'success'
+  | 'success-alt';
+
+export type IconSize = 'xs' | 'sm' | 'md' | 'lg' | 'xl';
+
+interface Props {
+  icon: ReactNode | ComponentType<{ size?: string | number }>;
+  className?: string;
+  size?: IconSize;
+  mode?: IconMode;
+  spin?: boolean;
+}
+
+export function Icon({ icon, className, mode, size, spin }: Props) {
+  const classes = clsx(className, 'icon inline-flex', {
+    [`icon-${mode}`]: mode,
+    [`icon-${size}`]: size,
+    'animate-spin-slow': spin,
+  });
+
+  if (typeof icon !== 'string') {
+    const Icon = isValidElementType(icon) ? icon : null;
+
+    if (Icon) {
+      return <Icon className={classes} aria-hidden="true" role="img" />;
+    }
+
+    return (
+      <span className={classes} aria-hidden="true" role="img">
+        {icon}
+      </span>
+    );
+  }
+
+  if (icon.indexOf('svg-') === 0) {
+    const svgIcon = icon.replace('svg-', '');
+    return (
+      <Svg
+        icon={svgIcon as keyof typeof SvgIcons}
+        className={classes}
+        aria-hidden="true"
+      />
+    );
+  }
+
+  const iconName = icon
+    .split('-')
+    .map((s) => s.slice(0, 1).toUpperCase() + s.slice(1))
+    .join('') as keyof typeof lucideIcons;
+  const IconComponent = lucideIcons[iconName] as React.FC<
+    React.SVGProps<SVGSVGElement>
+  >;
+  if (!IconComponent) {
+    // console error so that the error is logged but no functionality is broken
+    // eslint-disable-next-line no-console
+    console.error(`Icon not found: '${icon}'`);
+    return null;
+  }
+
+  return <IconComponent className={classes} aria-hidden="true" />;
+}
diff --git a/app/react/components/ImageConfigFieldset/AdvancedForm.tsx b/app/react/components/ImageConfigFieldset/AdvancedForm.tsx
new file mode 100644
index 0000000..a1a2175
--- /dev/null
+++ b/app/react/components/ImageConfigFieldset/AdvancedForm.tsx
@@ -0,0 +1,42 @@
+import { FormikErrors } from 'formik';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+import { TextTip } from '@@/Tip/TextTip';
+
+import { Values } from './types';
+
+export function AdvancedForm({
+  values,
+  errors,
+  onChangeImage,
+  setFieldValue,
+}: {
+  values: Values;
+  errors?: FormikErrors<Values>;
+  onChangeImage?: (name: string) => void;
+  setFieldValue: <T>(field: string, value: T) => void;
+}) {
+  return (
+    <>
+      <TextTip color="blue">
+        When using advanced mode, image and repository <b>must be</b> publicly
+        available.
+      </TextTip>
+      <FormControl label="Image" inputId="image-field" errors={errors?.image}>
+        <Input
+          id="image-field"
+          value={values.image}
+          onChange={(e) => {
+            const { value } = e.target;
+            setFieldValue('image', value);
+            setTimeout(() => onChangeImage?.(value), 0);
+          }}
+          placeholder="e.g. registry:port/my-image:my-tag"
+          required
+          data-cy="image-config-advanced-input"
+        />
+      </FormControl>
+    </>
+  );
+}
diff --git a/app/react/components/ImageConfigFieldset/ImageConfigFieldset.test.tsx b/app/react/components/ImageConfigFieldset/ImageConfigFieldset.test.tsx
new file mode 100644
index 0000000..58b80a9
--- /dev/null
+++ b/app/react/components/ImageConfigFieldset/ImageConfigFieldset.test.tsx
@@ -0,0 +1,96 @@
+import { FormikErrors } from 'formik';
+import { ComponentProps } from 'react';
+import { HttpResponse } from 'msw';
+import { render, fireEvent } from '@testing-library/react';
+
+import { http, server } from '@/setup-tests/server';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { createMockEnvironment } from '@/react-tools/test-mocks';
+
+import { ImageConfigFieldset } from './ImageConfigFieldset';
+import { Values } from './types';
+
+vi.mock('@uirouter/react', async (importOriginal: () => Promise<object>) => ({
+  ...(await importOriginal()),
+  useCurrentStateAndParams: vi.fn(() => ({
+    params: { endpointId: 1 },
+  })),
+}));
+
+it('should render SimpleForm when useRegistry is true', () => {
+  const { getByText } = renderComponent({ values: { useRegistry: true } });
+
+  expect(getByText('Advanced mode')).toBeInTheDocument();
+});
+
+it('should render AdvancedForm when useRegistry is false', () => {
+  const { getByText } = renderComponent({ values: { useRegistry: false } });
+
+  expect(getByText('Simple mode')).toBeInTheDocument();
+});
+
+it('should call setFieldValue with useRegistry set to false when "Advanced mode" button is clicked', () => {
+  const setFieldValue = vi.fn();
+  const { getByText } = renderComponent({
+    values: { useRegistry: true },
+    setFieldValue,
+  });
+
+  fireEvent.click(getByText('Advanced mode'));
+
+  expect(setFieldValue).toHaveBeenCalledWith('useRegistry', false);
+});
+
+it('should call setFieldValue with useRegistry set to true when "Simple mode" button is clicked', () => {
+  const setFieldValue = vi.fn();
+  const { getByText } = renderComponent({
+    values: { useRegistry: false },
+    setFieldValue,
+  });
+
+  fireEvent.click(getByText('Simple mode'));
+
+  expect(setFieldValue).toHaveBeenCalledWith('useRegistry', true);
+});
+
+function renderComponent({
+  values = {
+    useRegistry: true,
+    registryId: 123,
+    image: '',
+  },
+  errors = {},
+  setFieldValue = vi.fn(),
+  onChangeImage = vi.fn(),
+  onRateLimit = vi.fn(),
+}: {
+  values?: Partial<Values>;
+  errors?: FormikErrors<Values>;
+  setFieldValue?: ComponentProps<typeof ImageConfigFieldset>['setFieldValue'];
+  onChangeImage?: ComponentProps<typeof ImageConfigFieldset>['onChangeImage'];
+  onRateLimit?: ComponentProps<typeof ImageConfigFieldset>['onRateLimit'];
+} = {}) {
+  server.use(
+    http.get('/api/registries/:id', () => HttpResponse.json({})),
+    http.get('/api/endpoints/:id', () =>
+      HttpResponse.json(createMockEnvironment())
+    )
+  );
+
+  const Wrapped = withTestQueryProvider(ImageConfigFieldset);
+
+  return render(
+    <Wrapped
+      values={{
+        useRegistry: true,
+        registryId: 123,
+        image: '',
+        ...values,
+      }}
+      errors={errors}
+      setFieldValue={setFieldValue}
+      onChangeImage={onChangeImage}
+      onRateLimit={onRateLimit}
+    />
+  );
+}
diff --git a/app/react/components/ImageConfigFieldset/ImageConfigFieldset.tsx b/app/react/components/ImageConfigFieldset/ImageConfigFieldset.tsx
new file mode 100644
index 0000000..bb0c383
--- /dev/null
+++ b/app/react/components/ImageConfigFieldset/ImageConfigFieldset.tsx
@@ -0,0 +1,75 @@
+import { Database, Globe } from 'lucide-react';
+import { FormikErrors } from 'formik';
+import { PropsWithChildren } from 'react';
+
+import { Button } from '@@/buttons';
+
+import { SimpleForm } from './SimpleForm';
+import { Values } from './types';
+import { AdvancedForm } from './AdvancedForm';
+import { RateLimits } from './RateLimits';
+
+export function ImageConfigFieldset({
+  onRateLimit,
+  children,
+  autoComplete,
+  values,
+  errors,
+  onChangeImage,
+  setFieldValue,
+}: PropsWithChildren<{
+  values: Values;
+  errors?: FormikErrors<Values>;
+  autoComplete?: boolean;
+  onRateLimit?: (limited?: boolean) => void;
+  onChangeImage?: (name: string) => void;
+  setFieldValue: <T>(field: string, value: T) => void;
+}>) {
+  const Component = values.useRegistry ? SimpleForm : AdvancedForm;
+
+  return (
+    <div className="row">
+      <Component
+        autoComplete={autoComplete}
+        values={values}
+        errors={errors}
+        onChangeImage={onChangeImage}
+        setFieldValue={setFieldValue}
+      />
+
+      <div className="form-group">
+        <div className="col-sm-12">
+          {values.useRegistry ? (
+            <Button
+              size="small"
+              color="link"
+              icon={Globe}
+              className="!ml-0 p-0 hover:no-underline"
+              onClick={() => setFieldValue('useRegistry', false)}
+              data-cy="image-config-advanced-button"
+            >
+              Advanced mode
+            </Button>
+          ) : (
+            <Button
+              size="small"
+              color="link"
+              icon={Database}
+              className="!ml-0 p-0 hover:no-underline"
+              onClick={() => setFieldValue('useRegistry', true)}
+              data-cy="image-config-simple-button"
+            >
+              Simple mode
+            </Button>
+          )}
+        </div>
+      </div>
+
+      {children}
+
+      {onRateLimit && values.useRegistry && (
+        <RateLimits registryId={values.registryId} onRateLimit={onRateLimit} />
+      )}
+    </div>
+  );
+}
diff --git a/app/react/components/ImageConfigFieldset/InputSearch.tsx b/app/react/components/ImageConfigFieldset/InputSearch.tsx
new file mode 100644
index 0000000..fbda3ce
--- /dev/null
+++ b/app/react/components/ImageConfigFieldset/InputSearch.tsx
@@ -0,0 +1,41 @@
+import { useMemo } from 'react';
+
+import { AutomationTestingProps } from '@/types';
+
+import { AutocompleteSelect } from '@@/form-components/AutocompleteSelect';
+import { Option } from '@@/form-components/PortainerSelect';
+
+export function InputSearch({
+  value,
+  onChange,
+  options,
+  placeholder,
+  inputId,
+  'data-cy': dataCy,
+}: {
+  value: string;
+  onChange: (value: string) => void;
+  options: Option<string>[];
+  placeholder?: string;
+  inputId: string;
+} & AutomationTestingProps) {
+  const searchResults = useMemo(() => {
+    if (!value) {
+      return [];
+    }
+    return options.filter((option) =>
+      option.value.toLowerCase().includes(value.toLowerCase())
+    );
+  }, [options, value]);
+
+  return (
+    <AutocompleteSelect
+      searchResults={searchResults}
+      value={value}
+      onChange={onChange}
+      placeholder={placeholder}
+      inputId={inputId}
+      data-cy={dataCy}
+    />
+  );
+}
diff --git a/app/react/components/ImageConfigFieldset/RateLimits.tsx b/app/react/components/ImageConfigFieldset/RateLimits.tsx
new file mode 100644
index 0000000..aba1951
--- /dev/null
+++ b/app/react/components/ImageConfigFieldset/RateLimits.tsx
@@ -0,0 +1,233 @@
+import { useQuery } from '@tanstack/react-query';
+import { useEffect } from 'react';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { useCurrentEnvironment } from '@/react/hooks/useCurrentEnvironment';
+import { useCurrentUser } from '@/react/hooks/useUser';
+import { buildUrl } from '@/react/portainer/environments/environment.service/utils';
+import {
+  Environment,
+  EnvironmentType,
+} from '@/react/portainer/environments/types';
+import {
+  isAgentEnvironment,
+  isLocalEnvironment,
+} from '@/react/portainer/environments/utils';
+import { RegistryId } from '@/react/portainer/registries/types/registry';
+import { useRegistry } from '@/react/portainer/registries/queries/useRegistry';
+
+import { Link } from '@@/Link';
+import { TextTip } from '@@/Tip/TextTip';
+
+import { getIsDockerHubRegistry } from './utils';
+
+export function RateLimits({
+  registryId,
+  onRateLimit,
+}: {
+  registryId?: RegistryId;
+  onRateLimit: (limited?: boolean) => void;
+}) {
+  const registryQuery = useRegistry(registryId);
+
+  const registry = registryQuery.data;
+
+  const isDockerHubRegistry = getIsDockerHubRegistry(registry);
+
+  const environmentQuery = useCurrentEnvironment();
+
+  if (
+    !environmentQuery.data ||
+    registryQuery.isInitialLoading ||
+    !isDockerHubRegistry
+  ) {
+    return null;
+  }
+
+  return (
+    <RateLimitsInner
+      isAuthenticated={registry?.Authentication}
+      registryId={registryId}
+      onRateLimit={onRateLimit}
+      environment={environmentQuery.data}
+    />
+  );
+}
+
+function RateLimitsInner({
+  isAuthenticated = false,
+  registryId = 0,
+  onRateLimit,
+  environment,
+}: {
+  isAuthenticated?: boolean;
+  registryId?: RegistryId;
+  onRateLimit: (limited?: boolean) => void;
+  environment: Environment;
+}) {
+  const pullRateLimits = useRateLimits(registryId, environment, onRateLimit);
+  const { isPureAdmin } = useCurrentUser();
+
+  if (!pullRateLimits) {
+    return null;
+  }
+
+  return (
+    <div className="form-group">
+      <div className="col-sm-12">
+        {pullRateLimits.remaining > 0 ? (
+          <TextTip color="blue">
+            {isAuthenticated ? (
+              <>
+                You are currently using a free account to pull images from
+                DockerHub and will be limited to 200 pulls every 6 hours.
+                Remaining pulls:{' '}
+                <span className="font-bold">
+                  {pullRateLimits.remaining}/{pullRateLimits.limit}
+                </span>
+              </>
+            ) : (
+              <>
+                {isPureAdmin ? (
+                  <>
+                    You are currently using an anonymous account to pull images
+                    from DockerHub and will be limited to 100 pulls every 6
+                    hours. You can configure DockerHub authentication in the{' '}
+                    <Link
+                      to="portainer.registries"
+                      data-cy="image-registry-rate-limits-registries-view-link"
+                    >
+                      Registries View
+                    </Link>
+                    . Remaining pulls:{' '}
+                    <span className="font-bold">
+                      {pullRateLimits.remaining}/{pullRateLimits.limit}
+                    </span>
+                  </>
+                ) : (
+                  <>
+                    You are currently using an anonymous account to pull images
+                    from DockerHub and will be limited to 100 pulls every 6
+                    hours. Contact your administrator to configure DockerHub
+                    authentication. Remaining pulls:{' '}
+                    <span className="font-bold">
+                      {pullRateLimits.remaining}/{pullRateLimits.limit}
+                    </span>
+                  </>
+                )}
+              </>
+            )}
+          </TextTip>
+        ) : (
+          <TextTip>
+            {isAuthenticated ? (
+              <>
+                Your authorized pull count quota as a free user is now exceeded.
+                You will not be able to pull any image from the DockerHub
+                registry.
+              </>
+            ) : (
+              <>
+                Your authorized pull count quota as an anonymous user is now
+                exceeded. You will not be able to pull any image from the
+                DockerHub registry.
+              </>
+            )}
+          </TextTip>
+        )}
+      </div>
+    </div>
+  );
+}
+
+interface PullRateLimits {
+  remaining: number;
+  limit: number;
+}
+
+function useRateLimits(
+  registryId: RegistryId,
+  environment: Environment,
+  onRateLimit: (limited?: boolean) => void
+) {
+  const isValidForPull =
+    isAgentEnvironment(environment.Type) || isLocalEnvironment(environment);
+
+  const query = useQuery(
+    ['dockerhub', environment.Id, registryId],
+    () => getRateLimits(environment, registryId),
+    {
+      enabled: isValidForPull,
+    }
+  );
+
+  useEffect(() => {
+    if (!isValidForPull || query.isError) {
+      onRateLimit();
+    }
+
+    if (query.data) {
+      onRateLimit(query.data.limit > 0 && query.data.remaining === 0);
+    }
+  }, [isValidForPull, onRateLimit, query.data, query.isError]);
+
+  return isValidForPull ? query.data : undefined;
+}
+
+function getRateLimits(environment: Environment, registryId: RegistryId) {
+  if (isLocalEnvironment(environment)) {
+    return getLocalEnvironmentRateLimits(environment.Id, registryId);
+  }
+
+  const envType = getEnvType(environment.Type);
+
+  return getAgentEnvironmentRateLimits(environment.Id, envType, registryId);
+}
+
+async function getLocalEnvironmentRateLimits(
+  environmentId: Environment['Id'],
+  registryId: RegistryId
+) {
+  try {
+    const { data } = await axios.get<PullRateLimits>(
+      buildUrl(environmentId, `dockerhub/${registryId}`)
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(
+      e as Error,
+      'Unable to retrieve DockerHub pull rate limits'
+    );
+  }
+}
+
+function getEnvType(type: Environment['Type']) {
+  switch (type) {
+    case EnvironmentType.AgentOnKubernetes:
+    case EnvironmentType.EdgeAgentOnKubernetes:
+      return 'kubernetes';
+
+    case EnvironmentType.AgentOnDocker:
+    case EnvironmentType.EdgeAgentOnDocker:
+    default:
+      return 'docker';
+  }
+}
+
+async function getAgentEnvironmentRateLimits(
+  environmentId: Environment['Id'],
+  envType: 'kubernetes' | 'docker',
+  registryId: RegistryId
+) {
+  try {
+    const { data } = await axios.get<PullRateLimits>(
+      buildUrl(environmentId, `${envType}/v2/dockerhub/${registryId}`)
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(
+      e as Error,
+      'Unable to retrieve DockerHub pull rate limits'
+    );
+  }
+}
diff --git a/app/react/components/ImageConfigFieldset/SimpleForm.tsx b/app/react/components/ImageConfigFieldset/SimpleForm.tsx
new file mode 100644
index 0000000..2a586ac
--- /dev/null
+++ b/app/react/components/ImageConfigFieldset/SimpleForm.tsx
@@ -0,0 +1,269 @@
+import { FormikErrors } from 'formik';
+import _ from 'lodash';
+import { useMemo } from 'react';
+
+import { trimSHA, trimVersionTag } from '@/docker/filters/utils';
+import DockerIcon from '@/assets/ico/vendor/docker.svg?c';
+import { useImages } from '@/react/docker/proxy/queries/images/useImages';
+import {
+  imageContainsURL,
+  getUniqueTagListFromImages,
+} from '@/react/docker/images/utils';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useEnvironmentRegistries } from '@/react/portainer/environments/queries/useEnvironmentRegistries';
+import {
+  Registry,
+  RegistryId,
+  RegistryTypes,
+} from '@/react/portainer/registries/types/registry';
+import { useRegistry } from '@/react/portainer/registries/queries/useRegistry';
+
+import { Button } from '@@/buttons';
+import { FormControl } from '@@/form-components/FormControl';
+import { InputGroup } from '@@/form-components/InputGroup';
+import { PortainerSelect } from '@@/form-components/PortainerSelect';
+import { Input } from '@@/form-components/Input';
+
+import { Values } from './types';
+import { InputSearch } from './InputSearch';
+import { getIsDockerHubRegistry } from './utils';
+
+export function SimpleForm({
+  autoComplete,
+  values,
+  errors,
+  onChangeImage,
+  setFieldValue,
+}: {
+  autoComplete?: boolean;
+  values: Values;
+  errors?: FormikErrors<Values>;
+  onChangeImage?: (name: string) => void;
+  setFieldValue: <T>(field: string, value: T) => void;
+}) {
+  const registryQuery = useRegistry(values.registryId);
+
+  const registry = registryQuery.data;
+
+  const registryUrl = getRegistryURL(registry) || 'docker.io';
+  const isDockerHubRegistry = getIsDockerHubRegistry(registry);
+
+  return (
+    <>
+      <FormControl
+        label="Registry"
+        inputId="registry-field"
+        errors={errors?.registryId}
+      >
+        <RegistrySelector
+          onChange={(value) => setFieldValue('registryId', value)}
+          value={values.registryId}
+          inputId="registry-field"
+        />
+      </FormControl>
+
+      <FormControl label="Image" inputId="image-field" errors={errors?.image}>
+        <InputGroup>
+          <InputGroup.Addon>{registryUrl}</InputGroup.Addon>
+
+          <ImageField
+            onChange={(value) => {
+              setFieldValue('image', value);
+              onChangeImage?.(value);
+            }}
+            value={values.image}
+            registry={registry}
+            autoComplete={autoComplete}
+            inputId="image-field"
+          />
+
+          {isDockerHubRegistry && (
+            <InputGroup.ButtonWrapper>
+              <Button
+                as="a"
+                title="Search image on Docker Hub"
+                color="default"
+                props={{
+                  href: `https://hub.docker.com/search?type=image&q=${trimVersionTag(
+                    trimSHA(values.image)
+                  )}`,
+                  target: '_blank',
+                  rel: 'noreferrer',
+                }}
+                icon={DockerIcon}
+                data-cy="component-dockerHubSearchButton"
+              >
+                Search
+              </Button>
+            </InputGroup.ButtonWrapper>
+          )}
+        </InputGroup>
+      </FormControl>
+    </>
+  );
+}
+
+function getImagesForRegistry(
+  images: string[],
+  registries: Array<Registry>,
+  registry?: Registry
+) {
+  if (isKnownRegistry(registry)) {
+    const url = getRegistryURL(registry);
+    const registryImages = images.filter((image) => image.includes(url));
+    return registryImages.map((image) =>
+      image.replace(new RegExp(`${url}/?`), '')
+    );
+  }
+
+  const knownRegistries = registries.filter((reg) => isKnownRegistry(reg));
+  const registryImages = knownRegistries.flatMap((registry) =>
+    images.filter((image) => image.includes(registry.URL))
+  );
+  return _.difference(images, registryImages).filter(
+    (image) => !imageContainsURL(image)
+  );
+}
+
+function RegistrySelector({
+  value,
+  onChange,
+  inputId,
+}: {
+  value: RegistryId | undefined;
+  onChange: (value: RegistryId | undefined) => void;
+  inputId?: string;
+}) {
+  const environmentId = useEnvironmentId();
+
+  const registriesQuery = useEnvironmentRegistries(environmentId, {
+    select: (registries) =>
+      registries
+        .sort((a, b) => a.Name.localeCompare(b.Name))
+        .map((registry) => ({
+          label: registry.Name,
+          value: registry.Id,
+        })),
+    onSuccess: (options) => {
+      if (options && options.length) {
+        const idx = options.findIndex((v) => v.value === value);
+        if (idx === -1) {
+          onChange(options[0].value);
+        }
+      }
+    },
+  });
+
+  return (
+    <PortainerSelect
+      inputId={inputId}
+      options={registriesQuery.data || []}
+      value={value}
+      onChange={onChange}
+      data-cy="component-registrySelect"
+    />
+  );
+}
+
+function ImageField({
+  value,
+  onChange,
+  registry,
+  autoComplete,
+  inputId,
+}: {
+  value: string;
+  onChange: (value: string) => void;
+  registry?: Registry;
+  autoComplete?: boolean;
+  inputId: string;
+}) {
+  return autoComplete ? (
+    <ImageFieldAutoComplete
+      value={value}
+      onChange={onChange}
+      registry={registry}
+      inputId={inputId}
+    />
+  ) : (
+    <Input
+      value={value}
+      onChange={(e) => onChange(e.target.value)}
+      id={inputId}
+      data-cy="image-field-simple-input"
+    />
+  );
+}
+
+function ImageFieldAutoComplete({
+  value,
+  onChange,
+  registry,
+  inputId,
+}: {
+  value: string;
+  onChange: (value: string) => void;
+  registry?: Registry;
+  inputId: string;
+}) {
+  const environmentId = useEnvironmentId();
+
+  const registriesQuery = useEnvironmentRegistries(environmentId);
+
+  const imagesQuery = useImages(environmentId, {
+    select: (images) => getUniqueTagListFromImages(images),
+  });
+
+  const imageOptions = useMemo(() => {
+    const images = getImagesForRegistry(
+      imagesQuery.data || [],
+      registriesQuery.data || [],
+      registry
+    );
+    return images.map((image) => ({
+      label: image,
+      value: image,
+    }));
+  }, [registry, imagesQuery.data, registriesQuery.data]);
+
+  return (
+    <InputSearch
+      value={value}
+      onChange={(value) => onChange(value)}
+      data-cy="component-imageInput"
+      placeholder="e.g. my-image:my-tag"
+      options={imageOptions}
+      inputId={inputId}
+    />
+  );
+}
+
+function isKnownRegistry(registry?: Registry) {
+  return registry && registry.Type !== RegistryTypes.ANONYMOUS && registry.URL;
+}
+
+function getRegistryURL(registry?: Registry) {
+  if (!registry) {
+    return '';
+  }
+
+  if (
+    registry.Type !== RegistryTypes.GITLAB &&
+    registry.Type !== RegistryTypes.GITHUB
+  ) {
+    return registry.URL;
+  }
+
+  if (registry.Type === RegistryTypes.GITLAB) {
+    return `${registry.URL}/${registry.Gitlab?.ProjectPath}`;
+  }
+
+  if (registry.Type === RegistryTypes.GITHUB) {
+    const namespace = registry.Github?.UseOrganisation
+      ? registry.Github?.OrganisationName
+      : registry.Username;
+    return `${registry.URL}/${namespace}`;
+  }
+
+  return '';
+}
diff --git a/app/react/components/ImageConfigFieldset/findRegistryMatch.test.ts b/app/react/components/ImageConfigFieldset/findRegistryMatch.test.ts
new file mode 100644
index 0000000..0a54e34
--- /dev/null
+++ b/app/react/components/ImageConfigFieldset/findRegistryMatch.test.ts
@@ -0,0 +1,85 @@
+import {
+  Registry,
+  RegistryId,
+  RegistryTypes,
+} from '../../portainer/registries/types/registry';
+
+import { findBestMatchRegistry } from './findRegistryMatch';
+
+function buildTestRegistry(
+  id: RegistryId,
+  type: RegistryTypes,
+  name: string,
+  url: string
+): Registry {
+  return {
+    Id: id,
+    Type: type,
+    URL: url,
+    Name: name,
+    Username: '',
+    Authentication: false,
+    BaseURL: '',
+    Ecr: { Region: '' },
+    Github: { OrganisationName: '', UseOrganisation: false },
+    Quay: { OrganisationName: '', UseOrganisation: false },
+    Gitlab: { InstanceURL: '', ProjectId: 0, ProjectPath: '' },
+    RegistryAccesses: {},
+  };
+}
+
+describe('findBestMatchRegistry', () => {
+  const registries: Array<Registry> = [
+    buildTestRegistry(
+      1,
+      RegistryTypes.DOCKERHUB,
+      'DockerHub',
+      'hub.docker.com'
+    ),
+    buildTestRegistry(
+      2,
+      RegistryTypes.DOCKERHUB,
+      'DockerHub2',
+      'https://registry2.com'
+    ),
+    buildTestRegistry(
+      3,
+      RegistryTypes.GITHUB,
+      'GitHub',
+      'https://registry3.com'
+    ),
+  ];
+
+  it('should return the registry with the given ID', () => {
+    const registryId = 2;
+    const result = findBestMatchRegistry('repository', registries, registryId);
+    expect(result).toEqual(registries[1]);
+  });
+
+  it('should return the DockerHub registry with matching username and URL', () => {
+    const repository = 'user1/repository';
+    const result = findBestMatchRegistry(repository, registries);
+    expect(result).toEqual(registries[0]);
+  });
+
+  it('should return the registry with a matching URL', () => {
+    const repository = 'https://registry2.com/repository';
+    const result = findBestMatchRegistry(repository, registries);
+    expect(result).toEqual(registries[1]);
+  });
+
+  it('should return the default DockerHub registry if no matches are found', () => {
+    const repository = 'repository';
+    const result = findBestMatchRegistry(repository, registries);
+    expect(result).toEqual(registries[0]);
+  });
+
+  it('when using something:latest, shouldn\'t choose "tes" docker', () => {
+    const repository = 'something:latest';
+    const result = findBestMatchRegistry(repository, [
+      ...registries,
+      buildTestRegistry(4, RegistryTypes.CUSTOM, 'Test', 'tes'),
+    ]);
+    expect(result).toEqual(registries[0]);
+  });
+});
diff --git a/app/react/components/ImageConfigFieldset/findRegistryMatch.ts b/app/react/components/ImageConfigFieldset/findRegistryMatch.ts
new file mode 100644
index 0000000..145585a
--- /dev/null
+++ b/app/react/components/ImageConfigFieldset/findRegistryMatch.ts
@@ -0,0 +1,43 @@
+import {
+  Registry,
+  RegistryId,
+  RegistryTypes,
+} from '../../portainer/registries/types/registry';
+import { getURL } from '../../portainer/registries/utils/getUrl';
+
+/**
+ *  findBestMatchRegistry finds out the best match registry for repository
+ * matching precedence:
+ * 1. registryId matched
+ * 2. both domain name and username matched (for dockerhub only)
+ * 3. only URL matched
+ * 4. pick up the first dockerhub registry
+ */
+export function findBestMatchRegistry(
+  repository: string,
+  registries: Array<Registry>,
+  registryId?: RegistryId
+) {
+  if (registryId) {
+    return registries.find((r) => r.Id === registryId);
+  }
+
+  const matchDockerByUserAndUrl = registries.find(
+    (r) =>
+      r.Type === RegistryTypes.DOCKERHUB &&
+      (repository.startsWith(`${r.Username}/`) ||
+        repository.startsWith(`${getURL(r)}/${r.Username}/`))
+  );
+
+  if (matchDockerByUserAndUrl) {
+    return matchDockerByUserAndUrl;
+  }
+
+  const matchByUrl = registries.find((r) => repository.startsWith(getURL(r)));
+
+  if (matchByUrl) {
+    return matchByUrl;
+  }
+
+  return registries.find((r) => r.Type === RegistryTypes.DOCKERHUB);
+}
diff --git a/app/react/components/ImageConfigFieldset/getImageConfig.ts b/app/react/components/ImageConfigFieldset/getImageConfig.ts
new file mode 100644
index 0000000..e431c67
--- /dev/null
+++ b/app/react/components/ImageConfigFieldset/getImageConfig.ts
@@ -0,0 +1,45 @@
+import { imageContainsURL } from '@/react/docker/images/utils';
+import {
+  Registry,
+  RegistryId,
+} from '@/react/portainer/registries/types/registry';
+import { getURL } from '@/react/portainer/registries/utils/getUrl';
+
+import { ImageConfigValues } from '@@/ImageConfigFieldset';
+
+import { findBestMatchRegistry } from './findRegistryMatch';
+
+export function getDefaultImageConfig(): ImageConfigValues {
+  return {
+    registryId: 0,
+    image: '',
+    useRegistry: true,
+  };
+}
+
+export function getImageConfig(
+  repository: string,
+  registries: Registry[],
+  registryId?: RegistryId
+): ImageConfigValues {
+  const registry = findBestMatchRegistry(repository, registries, registryId);
+  if (registry) {
+    const url = getURL(registry);
+    let lastIndex = repository.lastIndexOf(url);
+    lastIndex = lastIndex === -1 ? 0 : lastIndex + url.length;
+    let image = repository.substring(lastIndex);
+    if (image.startsWith('/')) {
+      image = image.substring(1);
+    }
+
+    return {
+      useRegistry: true,
+      image,
+      registryId: registry.Id,
+    };
+  }
+  return {
+    image: repository,
+    useRegistry: imageContainsURL(repository),
+  };
+}
diff --git a/app/react/components/ImageConfigFieldset/index.ts b/app/react/components/ImageConfigFieldset/index.ts
new file mode 100644
index 0000000..5d13e2d
--- /dev/null
+++ b/app/react/components/ImageConfigFieldset/index.ts
@@ -0,0 +1,3 @@
+export { ImageConfigFieldset } from './ImageConfigFieldset';
+export { type Values as ImageConfigValues } from './types';
+export { validation as imageConfigValidation } from './validation';
diff --git a/app/react/components/ImageConfigFieldset/types.ts b/app/react/components/ImageConfigFieldset/types.ts
new file mode 100644
index 0000000..5fed9db
--- /dev/null
+++ b/app/react/components/ImageConfigFieldset/types.ts
@@ -0,0 +1,7 @@
+import { Registry } from '@/react/portainer/registries/types/registry';
+
+export interface Values {
+  useRegistry: boolean;
+  registryId?: Registry['Id'];
+  image: string;
+}
diff --git a/app/react/components/ImageConfigFieldset/utils.ts b/app/react/components/ImageConfigFieldset/utils.ts
new file mode 100644
index 0000000..8e056ec
--- /dev/null
+++ b/app/react/components/ImageConfigFieldset/utils.ts
@@ -0,0 +1,12 @@
+import {
+  Registry,
+  RegistryTypes,
+} from '@/react/portainer/registries/types/registry';
+
+export function getIsDockerHubRegistry(registry?: Registry | null) {
+  return (
+    !registry ||
+    registry.Type === RegistryTypes.DOCKERHUB ||
+    registry.Type === RegistryTypes.ANONYMOUS
+  );
+}
diff --git a/app/react/components/ImageConfigFieldset/validation.ts b/app/react/components/ImageConfigFieldset/validation.ts
new file mode 100644
index 0000000..550e4ef
--- /dev/null
+++ b/app/react/components/ImageConfigFieldset/validation.ts
@@ -0,0 +1,11 @@
+import { bool, number, object, SchemaOf, string } from 'yup';
+
+import { Values } from './types';
+
+export function validation(): SchemaOf<Values> {
+  return object({
+    image: string().required('Image is required'),
+    registryId: number().default(0),
+    useRegistry: bool().default(false),
+  });
+}
diff --git a/app/react/components/InformationPanel.tsx b/app/react/components/InformationPanel.tsx
new file mode 100644
index 0000000..f25afad
--- /dev/null
+++ b/app/react/components/InformationPanel.tsx
@@ -0,0 +1,47 @@
+import { PropsWithChildren } from 'react';
+import { X } from 'lucide-react';
+
+import { Widget, WidgetBody } from './Widget';
+import { Button } from './buttons';
+
+interface Props {
+  title?: string;
+  onDismiss?(): void;
+  bodyClassName?: string;
+  wrapperStyle?: Record<string, string>;
+}
+
+export function InformationPanel({
+  title,
+  onDismiss,
+  wrapperStyle,
+  bodyClassName,
+  children,
+}: PropsWithChildren<Props>) {
+  return (
+    <Widget className="border-none">
+      <WidgetBody className={bodyClassName}>
+        <div style={wrapperStyle}>
+          {title && (
+            <div className="form-section-title">
+              <span>{title}</span>
+              {!!onDismiss && (
+                <span className="small" style={{ float: 'right' }}>
+                  <Button
+                    color="link"
+                    icon={X}
+                    onClick={() => onDismiss()}
+                    data-cy="dismiss-information-panel-button"
+                  >
+                    dismiss
+                  </Button>
+                </span>
+              )}
+            </div>
+          )}
+          <div>{children}</div>
+        </div>
+      </WidgetBody>
+    </Widget>
+  );
+}
diff --git a/app/react/components/InlineLoader/InlineLoader.stories.tsx b/app/react/components/InlineLoader/InlineLoader.stories.tsx
new file mode 100644
index 0000000..c573414
--- /dev/null
+++ b/app/react/components/InlineLoader/InlineLoader.stories.tsx
@@ -0,0 +1,19 @@
+import { StoryFn, Meta } from '@storybook/react-webpack5';
+import { PropsWithChildren } from 'react';
+
+import { InlineLoader, Props } from './InlineLoader';
+
+export default {
+  title: 'Components/InlineLoader',
+  component: InlineLoader,
+} as Meta;
+
+function Template({ className, children }: PropsWithChildren<Props>) {
+  return <InlineLoader className={className}>{children}</InlineLoader>;
+}
+
+export const Primary: StoryFn<PropsWithChildren<Props>> = Template.bind({});
+Primary.args = {
+  className: 'test-class',
+  children: 'Loading...',
+};
diff --git a/app/react/components/InlineLoader/InlineLoader.tsx b/app/react/components/InlineLoader/InlineLoader.tsx
new file mode 100644
index 0000000..e25c8ff
--- /dev/null
+++ b/app/react/components/InlineLoader/InlineLoader.tsx
@@ -0,0 +1,34 @@
+import { Loader2 } from 'lucide-react';
+import { ReactNode } from 'react';
+import clsx from 'clsx';
+
+import { Icon } from '@@/Icon';
+
+type Size = 'xs' | 'sm' | 'md';
+
+export type Props = {
+  children: ReactNode;
+  className?: string;
+  size?: Size;
+};
+
+const sizeStyles: Record<Size, string> = {
+  xs: 'text-xs gap-1',
+  sm: 'text-sm gap-2',
+  md: 'text-md gap-2',
+};
+
+export function InlineLoader({ children, className, size = 'sm' }: Props) {
+  return (
+    <div
+      className={clsx(
+        'text-muted flex items-center',
+        className,
+        sizeStyles[size]
+      )}
+    >
+      <Icon icon={Loader2} className="flex-none animate-spin-slow" />
+      {children}
+    </div>
+  );
+}
diff --git a/app/react/components/InlineLoader/index.ts b/app/react/components/InlineLoader/index.ts
new file mode 100644
index 0000000..ba0a169
--- /dev/null
+++ b/app/react/components/InlineLoader/index.ts
@@ -0,0 +1 @@
+export { InlineLoader } from './InlineLoader';
diff --git a/app/react/components/InsightsBox/InsightsBox.stories.tsx b/app/react/components/InsightsBox/InsightsBox.stories.tsx
new file mode 100644
index 0000000..d819c45
--- /dev/null
+++ b/app/react/components/InsightsBox/InsightsBox.stories.tsx
@@ -0,0 +1,18 @@
+import { Meta, StoryFn } from '@storybook/react-webpack5';
+
+import { InsightsBox, Props } from './InsightsBox';
+
+export default {
+  component: InsightsBox,
+  header: 'Components/InsightsBox',
+} as Meta;
+
+function Template({ header, content }: Props) {
+  return <InsightsBox header={header} content={content} />;
+}
+
+export const Primary: StoryFn<Props> = Template.bind({});
+Primary.args = {
+  header: 'Insights box header',
+  content: 'This is the content of the insights box',
+};
diff --git a/app/react/components/InsightsBox/InsightsBox.test.tsx b/app/react/components/InsightsBox/InsightsBox.test.tsx
new file mode 100644
index 0000000..5fbc9bb
--- /dev/null
+++ b/app/react/components/InsightsBox/InsightsBox.test.tsx
@@ -0,0 +1,16 @@
+import { render } from '@testing-library/react';
+
+import { InsightsBox } from './InsightsBox';
+
+test('should display a InsightsBox with a header and content', async () => {
+  const header = 'test header';
+  const content = 'test content';
+  const { findByText } = render(
+    <InsightsBox header={header} content={content} />
+  );
+
+  const headerFound = await findByText(header);
+  expect(headerFound).toBeTruthy();
+  const contentFound = await findByText(content);
+  expect(contentFound).toBeTruthy();
+});
diff --git a/app/react/components/InsightsBox/InsightsBox.tsx b/app/react/components/InsightsBox/InsightsBox.tsx
new file mode 100644
index 0000000..81db52d
--- /dev/null
+++ b/app/react/components/InsightsBox/InsightsBox.tsx
@@ -0,0 +1,78 @@
+import clsx from 'clsx';
+import { Lightbulb, X } from 'lucide-react';
+import { ReactNode } from 'react';
+import { useStore } from 'zustand';
+
+import { Button } from '@@/buttons';
+
+import { insightStore } from './insights-store';
+
+export type Props = {
+  header?: string;
+  content?: ReactNode;
+  insightCloseId?: string; // set if you want to be able to close the box and not show it again
+  type?: 'default' | 'slim';
+  className?: string;
+};
+
+export function InsightsBox({
+  header,
+  content,
+  insightCloseId,
+  type = 'default',
+  className,
+}: Props) {
+  // allow to close the box and not show it again in local storage with zustand
+  const { addInsightIDClosed, isClosed } = useStore(insightStore);
+  const isInsightClosed = isClosed(insightCloseId);
+
+  if (isInsightClosed) {
+    return null;
+  }
+
+  return (
+    <div
+      className={clsx(
+        'relative flex w-full gap-1 rounded-lg bg-gray-modern-3 p-4 text-sm th-highcontrast:bg-legacy-grey-3 th-dark:bg-legacy-grey-3',
+        type === 'slim' && 'p-2',
+        className
+      )}
+    >
+      <div className="mt-0.5 shrink-0">
+        <Lightbulb className="h-4 text-warning-7 th-highcontrast:text-warning-6 th-dark:text-warning-6" />
+      </div>
+      <div>
+        {header && (
+          <p
+            className={clsx(
+              // text-[0.9em] matches .form-horizontal .control-label font-size used in many labels in portainer
+              'align-middle text-[0.9em] font-medium',
+              insightCloseId && 'pr-10',
+              content ? 'mb-2' : 'mb-0'
+            )}
+          >
+            {header}
+          </p>
+        )}
+        {content && (
+          <div className={clsx('small', !header && insightCloseId && 'pr-6')}>
+            {content}
+          </div>
+        )}
+      </div>
+      {insightCloseId && (
+        <Button
+          icon={X}
+          data-cy={`insight-close-${insightCloseId}`}
+          className={clsx(
+            'absolute right-2 top-3 flex !text-gray-7 hover:!text-gray-8 th-highcontrast:!text-gray-6 th-highcontrast:hover:!text-gray-5 th-dark:!text-gray-6 th-dark:hover:!text-gray-5',
+            type === 'slim' && insightCloseId && 'top-1'
+          )}
+          color="link"
+          size="medium"
+          onClick={() => addInsightIDClosed(insightCloseId)}
+        />
+      )}
+    </div>
+  );
+}
diff --git a/app/react/components/InsightsBox/index.ts b/app/react/components/InsightsBox/index.ts
new file mode 100644
index 0000000..c02dcaf
--- /dev/null
+++ b/app/react/components/InsightsBox/index.ts
@@ -0,0 +1 @@
+export { InsightsBox } from './InsightsBox';
diff --git a/app/react/components/InsightsBox/insights-store.ts b/app/react/components/InsightsBox/insights-store.ts
new file mode 100644
index 0000000..a358811
--- /dev/null
+++ b/app/react/components/InsightsBox/insights-store.ts
@@ -0,0 +1,35 @@
+import { createStore } from 'zustand';
+import { persist } from 'zustand/middleware';
+
+import { keyBuilder } from '@/react/hooks/useLocalStorage';
+
+interface InsightsStore {
+  insightIDsClosed: string[];
+  addInsightIDClosed: (insightIDClosed: string) => void;
+  isClosed: (insightID?: string) => boolean;
+}
+
+export const insightStore = createStore<InsightsStore>()(
+  persist(
+    (set, get) => ({
+      insightIDsClosed: [],
+      addInsightIDClosed: (insightIDClosed: string) => {
+        set((state) => {
+          const currentIDsClosed = state.insightIDsClosed || [];
+          return { insightIDsClosed: [...currentIDsClosed, insightIDClosed] };
+        });
+      },
+      isClosed: (insightID?: string) => {
+        if (!insightID) {
+          return false;
+        }
+        const currentIDsClosed = get().insightIDsClosed || [];
+        return currentIDsClosed.includes(insightID);
+      },
+    }),
+    {
+      name: keyBuilder('insightIDsClosed'),
+      getStorage: () => localStorage,
+    }
+  )
+);
diff --git a/app/react/components/JsonTree.module.css b/app/react/components/JsonTree.module.css
new file mode 100644
index 0000000..f170919
--- /dev/null
+++ b/app/react/components/JsonTree.module.css
@@ -0,0 +1,25 @@
+/* json-tree override */
+.json-tree {
+  font-size: 13px;
+  color: var(--blue-5);
+}
+
+.json-tree .key {
+  color: var(--text-json-tree-color);
+  padding-right: 4px;
+}
+
+.json-tree .chevronIcon {
+  color: var(--text-json-tree-color);
+}
+
+.json-tree .branch-preview {
+  color: var(--text-json-tree-branch-preview-color);
+  font-style: normal;
+  font-size: 11px;
+  opacity: 0.5;
+}
+
+.json-tree .leaf-value {
+  color: var(--text-json-tree-leaf-color);
+}
diff --git a/app/react/components/JsonTree.tsx b/app/react/components/JsonTree.tsx
new file mode 100644
index 0000000..b540954
--- /dev/null
+++ b/app/react/components/JsonTree.tsx
@@ -0,0 +1,44 @@
+import { ComponentProps } from 'react';
+import { JsonView, defaultStyles } from 'react-json-view-lite';
+import 'react-json-view-lite/dist/index.css';
+import clsx from 'clsx';
+
+import styles from './JsonTree.module.css';
+
+export function JsonTree({ style, ...props }: ComponentProps<typeof JsonView>) {
+  const currentStyle = getCurrentStyle(style);
+  return (
+    <JsonView
+      // eslint-disable-next-line react/jsx-props-no-spreading
+      {...props}
+      style={currentStyle}
+    />
+  );
+}
+
+type StyleProps = ComponentProps<typeof JsonView>['style'];
+
+function getCurrentStyle(style: StyleProps | undefined): StyleProps {
+  if (style) {
+    return style;
+  }
+
+  return {
+    ...defaultStyles,
+    container: styles.jsonTree,
+    booleanValue: styles.leafValue,
+    nullValue: styles.leafValue,
+    otherValue: styles.leafValue,
+    numberValue: styles.leafValue,
+    stringValue: styles.leafValue,
+    undefinedValue: styles.leafValue,
+    label: styles.key,
+    punctuation: styles.leafValue,
+    collapseIcon: clsx(defaultStyles.collapseIcon, styles.chevronIcon),
+    expandIcon: clsx(defaultStyles.expandIcon, styles.chevronIcon),
+    collapsedContent: clsx(
+      defaultStyles.collapsedContent,
+      styles.branchPreview
+    ),
+  };
+}
diff --git a/app/react/components/Link.tsx b/app/react/components/Link.tsx
new file mode 100644
index 0000000..e1348bb
--- /dev/null
+++ b/app/react/components/Link.tsx
@@ -0,0 +1,25 @@
+import { PropsWithChildren, AnchorHTMLAttributes } from 'react';
+import { UISrefProps, useSref } from '@uirouter/react';
+
+interface Props extends AnchorHTMLAttributes<HTMLAnchorElement> {
+  'data-cy': string;
+}
+
+export function Link({
+  children,
+  'data-cy': dataCy,
+  to,
+  params,
+  options,
+  title,
+  ...props
+}: PropsWithChildren<Props> & UISrefProps) {
+  const { onClick, href } = useSref(to, params, options);
+
+  return (
+    // eslint-disable-next-line react/jsx-props-no-spreading
+    <a onClick={onClick} href={href} data-cy={dataCy} title={title} {...props}>
+      {children}
+    </a>
+  );
+}
diff --git a/app/react/components/LinkButton.tsx b/app/react/components/LinkButton.tsx
new file mode 100644
index 0000000..f4e63ad
--- /dev/null
+++ b/app/react/components/LinkButton.tsx
@@ -0,0 +1,34 @@
+import clsx from 'clsx';
+import { ComponentProps } from 'react';
+
+import { Button } from './buttons';
+import { Link } from './Link';
+
+export function LinkButton({
+  to,
+  params,
+  disabled,
+  className,
+  children,
+  title = '',
+  'data-cy': dataCy,
+  ...props
+}: ComponentProps<typeof Button> & ComponentProps<typeof Link>) {
+  return (
+    <Button
+      title={title}
+      // eslint-disable-next-line react/jsx-props-no-spreading
+      {...props}
+      className={clsx(className, 'no-link !m-0')}
+      disabled={disabled}
+      as={disabled ? 'span' : Link}
+      props={{
+        to,
+        params,
+      }}
+      data-cy={dataCy}
+    >
+      {children}
+    </Button>
+  );
+}
diff --git a/app/react/components/NavTabs/NavContainer.tsx b/app/react/components/NavTabs/NavContainer.tsx
new file mode 100644
index 0000000..5c316b2
--- /dev/null
+++ b/app/react/components/NavTabs/NavContainer.tsx
@@ -0,0 +1,17 @@
+import clsx from 'clsx';
+import { PropsWithChildren } from 'react';
+
+export function NavContainer({ children }: PropsWithChildren<unknown>) {
+  return (
+    <div
+      className={clsx(
+        'rounded-lg border border-solid p-2',
+        'border-gray-5 bg-gray-2',
+        'th-dark:border-gray-neutral-8 th-dark:bg-gray-iron-10',
+        'th-highcontrast:border-white th-highcontrast:bg-black'
+      )}
+    >
+      {children}
+    </div>
+  );
+}
diff --git a/app/react/components/NavTabs/NavTabs.module.css b/app/react/components/NavTabs/NavTabs.module.css
new file mode 100644
index 0000000..bbcaaea
--- /dev/null
+++ b/app/react/components/NavTabs/NavTabs.module.css
@@ -0,0 +1,32 @@
+.parent {
+  background: var(--blue-4);
+  border-radius: 4px 4px 0 0;
+  padding-top: 5px;
+  margin-top: -5px;
+}
+
+.parent a {
+  background-color: initial;
+  border: 1px solid transparent;
+  cursor: inherit;
+}
+
+.parent {
+  background-color: var(--blue-4);
+}
+:global(:root[theme='dark']) .parent {
+  background-color: var(--grey-40);
+}
+:global(:root[theme='highcontrast']) .parent {
+  background-color: var(--white-color);
+}
+
+.parent a {
+  color: var(--white-color);
+}
+:global([theme='dark']) .parent a {
+  color: var(--black-color);
+}
+:global([theme='highcontrast']) .parent a {
+  color: var(--black-color);
+}
diff --git a/app/react/components/NavTabs/NavTabs.stories.tsx b/app/react/components/NavTabs/NavTabs.stories.tsx
new file mode 100644
index 0000000..4b5d1ec
--- /dev/null
+++ b/app/react/components/NavTabs/NavTabs.stories.tsx
@@ -0,0 +1,35 @@
+import { Meta, StoryFn } from '@storybook/react-webpack5';
+import { useState } from 'react';
+
+import { NavTabs, type Option } from './NavTabs';
+
+export default {
+  title: 'Components/NavTabs',
+  component: NavTabs,
+} as Meta<typeof NavTabs>;
+
+type Args = {
+  options: Option[];
+};
+
+function Template({ options = [] }: Args) {
+  const [selected, setSelected] = useState(
+    options.length ? options[0].id : undefined
+  );
+
+  return (
+    <NavTabs
+      options={options}
+      selectedId={selected}
+      onSelect={(value) => setSelected(value)}
+    />
+  );
+}
+
+export const Example: StoryFn<Args> = Template.bind({});
+Example.args = {
+  options: [
+    { children: 'Content 1', id: 'option1', label: 'Option 1' },
+    { children: 'Content 2', id: 'option2', label: 'Option 2' },
+  ],
+};
diff --git a/app/react/components/NavTabs/NavTabs.test.tsx b/app/react/components/NavTabs/NavTabs.test.tsx
new file mode 100644
index 0000000..3427a77
--- /dev/null
+++ b/app/react/components/NavTabs/NavTabs.test.tsx
@@ -0,0 +1,63 @@
+import userEvent from '@testing-library/user-event';
+import { render } from '@testing-library/react';
+
+import { withTestRouter } from '@/react/test-utils/withRouter';
+
+import { NavTabs, Option } from './NavTabs';
+
+test('should show titles', async () => {
+  const options = [
+    { children: 'Content 1', id: 'option1', label: 'Option 1' },
+    { children: 'Content 2', id: 'option2', label: 'Option 2' },
+  ];
+  const { findByText } = renderComponent(options);
+
+  const heading = await findByText(options[0].label);
+  expect(heading).toBeTruthy();
+
+  const heading2 = await findByText(options[1].label);
+  expect(heading2).toBeTruthy();
+});
+
+test('should show selected id content', async () => {
+  const options = [
+    { children: 'Content 1', id: 'option1', label: 'Option 1' },
+    { children: 'Content 2', id: 'option2', label: 'Option 2' },
+  ];
+
+  const selected = options[1];
+
+  const { findByText } = renderComponent(options, selected.id);
+
+  const content = await findByText(selected.children);
+  expect(content).toBeTruthy();
+});
+
+test('should call onSelect when clicked with id', async () => {
+  const user = userEvent.setup();
+  const options = [
+    { children: 'Content 1', id: 'option1', label: 'Option 1' },
+    { children: 'Content 2', id: 'option2', label: 'Option 2' },
+  ];
+
+  const onSelect = vi.fn();
+
+  const { findByText } = renderComponent(options, options[1].id, onSelect);
+
+  const heading = await findByText(options[0].label);
+  await user.click(heading);
+
+  expect(onSelect).toHaveBeenCalledWith(options[0].id);
+});
+
+function renderComponent(
+  options: Option[] = [],
+  selectedId?: string | number,
+  onSelect?: (id: string | number) => void
+) {
+  const Wrapped = withTestRouter(NavTabs);
+
+  return render(
+    <Wrapped options={options} selectedId={selectedId} onSelect={onSelect} />
+  );
+}
diff --git a/app/react/components/NavTabs/NavTabs.tsx b/app/react/components/NavTabs/NavTabs.tsx
new file mode 100644
index 0000000..2f00a3d
--- /dev/null
+++ b/app/react/components/NavTabs/NavTabs.tsx
@@ -0,0 +1,80 @@
+import clsx from 'clsx';
+import { ComponentProps, ReactNode } from 'react';
+
+import { Button } from '@@/buttons';
+
+import styles from './NavTabs.module.css';
+
+export interface Option<T extends string | number = string> {
+  label: ReactNode;
+  children?: ReactNode;
+  id: T;
+  hidden?: boolean;
+  icon?: ComponentProps<typeof Button>['icon'];
+}
+
+interface Props<T extends string | number> {
+  options: Array<Option<T>> | ReadonlyArray<Option<T>>;
+  selectedId?: T;
+  onSelect?(id: T): void;
+  disabled?: boolean;
+  type?: 'tabs' | 'pills';
+  justified?: boolean;
+}
+
+export function NavTabs<T extends string | number = string>({
+  options,
+  selectedId,
+  onSelect = () => {},
+  disabled,
+  type = 'tabs',
+  justified = false,
+}: Props<T>) {
+  const selected = options.find((option) => option.id === selectedId);
+
+  return (
+    <div>
+      <ul
+        className={clsx('nav', `nav-${type}`, { 'nav-justified': justified })}
+      >
+        {options.map(
+          (option) =>
+            !option.hidden && (
+              <li
+                className={clsx({
+                  active: option.id === selectedId,
+                  [styles.parent]: !option.children,
+                  disabled,
+                })}
+                key={option.id}
+              >
+                {/* rule disabled because `nav-tabs` requires an anchor */}
+                <Button
+                  color="none"
+                  onClick={() => handleSelect(option)}
+                  as="a"
+                  data-cy="nav-tab-button"
+                  className="!flex"
+                  icon={option.icon}
+                  props={{ role: 'button' }}
+                >
+                  {option.label}
+                </Button>
+              </li>
+            )
+        )}
+      </ul>
+      {selected && selected.children && (
+        <div className="tab-content mt-3">{selected.children}</div>
+      )}
+    </div>
+  );
+
+  function handleSelect(option: Option<T>) {
+    if (disabled) {
+      return;
+    }
+
+    onSelect(option.id);
+  }
+}
diff --git a/app/react/components/NavTabs/index.ts b/app/react/components/NavTabs/index.ts
new file mode 100644
index 0000000..cacdb47
--- /dev/null
+++ b/app/react/components/NavTabs/index.ts
@@ -0,0 +1,2 @@
+export { NavTabs } from './NavTabs';
+export type { Option } from './NavTabs';
diff --git a/app/react/components/Note/Note.tsx b/app/react/components/Note/Note.tsx
new file mode 100644
index 0000000..e0998b6
--- /dev/null
+++ b/app/react/components/Note/Note.tsx
@@ -0,0 +1,89 @@
+import { useEffect, useState } from 'react';
+import clsx from 'clsx';
+import { ChevronUp, ChevronRight, Edit } from 'lucide-react';
+
+import { Button } from '@@/buttons';
+import { FormError } from '@@/form-components/FormError';
+
+export type Props = {
+  onChange: (value: string) => void;
+  defaultIsOpen?: boolean;
+  value?: string;
+  labelClass?: string;
+  inputClass?: string;
+  isRequired?: boolean;
+  minLength?: number;
+  isExpandable?: boolean;
+};
+
+export function Note({
+  onChange,
+  defaultIsOpen,
+  value,
+  labelClass = 'col-sm-12 mb-2',
+  inputClass = 'col-sm-12',
+  isRequired,
+  minLength,
+  isExpandable,
+}: Props) {
+  const [isNoteOpen, setIsNoteOpen] = useState(defaultIsOpen || isRequired);
+
+  useEffect(() => {
+    setIsNoteOpen(defaultIsOpen || isRequired);
+  }, [defaultIsOpen, isRequired]);
+
+  let error = '';
+  if (isRequired && minLength && (!value || value.length < minLength)) {
+    error = `You have entered ${value ? value.length : 0} of the ${minLength} ${
+      minLength === 1 ? 'character' : 'characters'
+    } minimum required.`;
+  }
+
+  return (
+    <div className="form-group">
+      <div className={clsx('vertical-center', labelClass)}>
+        {isExpandable && (
+          <Button
+            size="small"
+            type="button"
+            color="none"
+            data-cy="k8sAppDetail-expandNoteButton"
+            onClick={() => setIsNoteOpen(!isNoteOpen)}
+            className="!m-0 !p-0"
+          >
+            {isNoteOpen ? <ChevronUp /> : <ChevronRight />} <Edit />
+            <span className={isRequired ? 'required' : ''}>Note</span>
+          </Button>
+        )}
+        {!isExpandable && (
+          <span
+            className={clsx(
+              'control-label text-left',
+              isRequired ? 'required' : ''
+            )}
+          >
+            Note
+          </span>
+        )}
+      </div>
+
+      {isNoteOpen && (
+        <div className={inputClass}>
+          <textarea
+            className="form-control resize-y"
+            name="application_note"
+            id="application_note"
+            value={value}
+            onChange={(e) => onChange(e.target.value)}
+            rows={5}
+            placeholder="Enter a note about this application..."
+            minLength={minLength}
+          />
+          {error && (
+            <FormError className="error-inline mt-2">{error}</FormError>
+          )}
+        </div>
+      )}
+    </div>
+  );
+}
diff --git a/app/react/components/Note/index.ts b/app/react/components/Note/index.ts
new file mode 100644
index 0000000..3ef304b
--- /dev/null
+++ b/app/react/components/Note/index.ts
@@ -0,0 +1 @@
+export { Note, type Props } from './Note';
diff --git a/app/react/components/PageHeader/AskAILink.tsx b/app/react/components/PageHeader/AskAILink.tsx
new file mode 100644
index 0000000..0c040dd
--- /dev/null
+++ b/app/react/components/PageHeader/AskAILink.tsx
@@ -0,0 +1,29 @@
+import { BotMessageSquare } from 'lucide-react';
+import clsx from 'clsx';
+
+import headerStyles from './HeaderTitle.module.css';
+
+const docsUrl = 'https://www.portainer.io/ask-the-ai';
+
+export function AskAILink() {
+  return (
+    <div className={headerStyles.menuButton}>
+      <a
+        href={docsUrl}
+        target="_blank"
+        color="none"
+        className={clsx(
+          headerStyles.menuIcon,
+          'icon-badge mr-1 cursor-pointer !p-2 text-lg',
+          'text-gray-8',
+          'th-dark:text-gray-warm-7'
+        )}
+        title="Ask AI"
+        rel="noreferrer"
+        data-cy="ask-ai-button"
+      >
+        <BotMessageSquare className="lucide" />
+      </a>
+    </div>
+  );
+}
diff --git a/app/react/components/PageHeader/Breadcrumbs/Breadcrumbs.stories.tsx b/app/react/components/PageHeader/Breadcrumbs/Breadcrumbs.stories.tsx
new file mode 100644
index 0000000..9b8cbb5
--- /dev/null
+++ b/app/react/components/PageHeader/Breadcrumbs/Breadcrumbs.stories.tsx
@@ -0,0 +1,31 @@
+import { Meta } from '@storybook/react-webpack5';
+import { UIRouter, pushStateLocationPlugin } from '@uirouter/react';
+
+import { Breadcrumbs } from './Breadcrumbs';
+
+const meta: Meta = {
+  title: 'Components/PageHeader/Breadcrumbs',
+  component: Breadcrumbs,
+};
+
+export default meta;
+
+export { Example };
+
+function Example() {
+  return (
+    <UIRouter plugins={[pushStateLocationPlugin]}>
+      <Breadcrumbs
+        breadcrumbs={[
+          { link: 'portainer.endpoints', label: 'Environments' },
+          {
+            label: 'endpointName',
+            link: 'portainer.endpoints.endpoint',
+            linkParams: { id: 5 },
+          },
+          { label: 'String item' },
+        ]}
+      />
+    </UIRouter>
+  );
+}
diff --git a/app/react/components/PageHeader/Breadcrumbs/Breadcrumbs.test.tsx b/app/react/components/PageHeader/Breadcrumbs/Breadcrumbs.test.tsx
new file mode 100644
index 0000000..bc97fdb
--- /dev/null
+++ b/app/react/components/PageHeader/Breadcrumbs/Breadcrumbs.test.tsx
@@ -0,0 +1,56 @@
+import { render, screen } from '@testing-library/react';
+
+import { withTestRouter } from '@/react/test-utils/withRouter';
+
+import { Breadcrumbs } from './Breadcrumbs';
+
+function renderBreadcrumbs(
+  breadcrumbs: React.ComponentProps<typeof Breadcrumbs>['breadcrumbs']
+) {
+  const Wrapped = withTestRouter(() => (
+    <Breadcrumbs breadcrumbs={breadcrumbs} />
+  ));
+  return render(<Wrapped />);
+}
+
+describe('Breadcrumbs', () => {
+  it('should render a home link', () => {
+    renderBreadcrumbs([{ label: 'Settings' }]);
+
+    expect(screen.getByTestId('breadcrumb-home')).toBeInTheDocument();
+  });
+
+  it('should render each breadcrumb label', () => {
+    renderBreadcrumbs([
+      { label: 'Settings' },
+      { label: 'Environment Groups' },
+      { label: 'Production' },
+    ]);
+
+    expect(screen.getByText('Settings')).toBeVisible();
+    expect(screen.getByText('Environment Groups')).toBeVisible();
+    expect(screen.getByText('Production')).toBeVisible();
+  });
+
+  it('should render string breadcrumbs', () => {
+    renderBreadcrumbs(['Settings', 'Tags']);
+
+    expect(screen.getByText('Settings')).toBeVisible();
+    expect(screen.getByText('Tags')).toBeVisible();
+  });
+
+  it('should render a single string breadcrumb', () => {
+    renderBreadcrumbs('Environments');
+
+    expect(screen.getByText('Environments')).toBeVisible();
+  });
+
+  it('should render linked breadcrumbs with data-cy', () => {
+    renderBreadcrumbs([
+      { label: 'Settings', link: 'portainer.settings' },
+      { label: 'Groups' },
+    ]);
+
+    expect(screen.getByTestId('breadcrumb-Settings')).toBeInTheDocument();
+  });
+});
diff --git a/app/react/components/PageHeader/Breadcrumbs/Breadcrumbs.tsx b/app/react/components/PageHeader/Breadcrumbs/Breadcrumbs.tsx
new file mode 100644
index 0000000..ead567c
--- /dev/null
+++ b/app/react/components/PageHeader/Breadcrumbs/Breadcrumbs.tsx
@@ -0,0 +1,65 @@
+import { Fragment } from 'react';
+import { Home, ChevronRight } from 'lucide-react';
+
+import { Link } from '@@/Link';
+
+export interface Crumb {
+  label: string;
+  link?: string;
+  linkParams?: Record<string, unknown>;
+}
+interface Props {
+  breadcrumbs: (Crumb | string)[] | string;
+}
+
+export function Breadcrumbs({ breadcrumbs }: Props) {
+  const breadcrumbsArray = Array.isArray(breadcrumbs)
+    ? breadcrumbs
+    : [breadcrumbs];
+
+  return (
+    <div className="flex items-center gap-2 text-sm font-medium text-gray-8 th-highcontrast:text-white th-dark:text-gray-5">
+      <Link
+        to="portainer.home"
+        className="text-gray-8 hover:text-blue-11 th-highcontrast:text-white th-dark:text-gray-5 th-dark:hover:text-blue-9"
+        data-cy="breadcrumb-home"
+      >
+        <Home className="h-4 w-4" />
+      </Link>
+      <ChevronRight className="h-3 w-3" aria-hidden="true" />
+      {breadcrumbsArray.map((crumb, index) => (
+        <Fragment key={index}>
+          <span>{renderCrumb(crumb)}</span>
+          {index !== breadcrumbsArray.length - 1 && (
+            <ChevronRight className="h-3 w-3" aria-hidden="true" />
+          )}
+        </Fragment>
+      ))}
+    </div>
+  );
+}
+
+function renderCrumb(crumb: Crumb | string) {
+  if (!crumb) {
+    return '';
+  }
+
+  if (typeof crumb === 'string') {
+    return crumb;
+  }
+
+  if (crumb.link) {
+    return (
+      <Link
+        to={crumb.link}
+        params={crumb.linkParams}
+        className="text-blue-9 hover:text-blue-11 hover:underline th-highcontrast:text-blue-5 th-dark:text-blue-7 th-dark:hover:text-blue-9"
+        data-cy={`breadcrumb-${crumb.label}`}
+      >
+        {crumb.label}
+      </Link>
+    );
+  }
+
+  return crumb.label;
+}
diff --git a/app/react/components/PageHeader/Breadcrumbs/index.ts b/app/react/components/PageHeader/Breadcrumbs/index.ts
new file mode 100644
index 0000000..28140a2
--- /dev/null
+++ b/app/react/components/PageHeader/Breadcrumbs/index.ts
@@ -0,0 +1 @@
+export { Breadcrumbs } from './Breadcrumbs';
diff --git a/app/react/components/PageHeader/ContextHelp.tsx b/app/react/components/PageHeader/ContextHelp.tsx
new file mode 100644
index 0000000..88cc8a7
--- /dev/null
+++ b/app/react/components/PageHeader/ContextHelp.tsx
@@ -0,0 +1,64 @@
+import { HelpCircle } from 'lucide-react';
+import clsx from 'clsx';
+import { useCurrentStateAndParams } from '@uirouter/react';
+
+import { useSystemVersion } from '@/react/portainer/system/useSystemVersion';
+
+import headerStyles from './HeaderTitle.module.css';
+
+export function ContextHelp() {
+  const docsUrl = useDocsUrl();
+
+  return (
+    <div className={headerStyles.menuButton}>
+      <a
+        href={docsUrl}
+        target="_blank"
+        color="none"
+        className={clsx(
+          headerStyles.menuIcon,
+          'icon-badge mr-1 cursor-pointer !p-2 text-lg',
+          'text-gray-8',
+          'th-dark:text-gray-warm-7'
+        )}
+        title="Documentation"
+        rel="noreferrer"
+        data-cy="context-help-button"
+      >
+        <HelpCircle className="lucide" />
+      </a>
+    </div>
+  );
+}
+
+export function useDocsUrl(doc?: string): string {
+  const { state } = useCurrentStateAndParams();
+  const versionQuery = useSystemVersion();
+
+  if (!doc && !state) {
+    return '';
+  }
+
+  let url = 'https://docs.portainer.io/';
+
+  // Add LTS or STS version if we have it
+  if (versionQuery.data?.VersionSupport) {
+    url += versionQuery.data.VersionSupport.toLowerCase();
+  }
+
+  if (doc) {
+    return url + doc;
+  }
+
+  const { data } = state;
+  if (
+    data &&
+    typeof data === 'object' &&
+    'docs' in data &&
+    typeof data.docs === 'string'
+  ) {
+    return url + data.docs;
+  }
+
+  return url;
+}
diff --git a/app/react/components/PageHeader/HeaderContainer.stories.tsx b/app/react/components/PageHeader/HeaderContainer.stories.tsx
new file mode 100644
index 0000000..d73a7e4
--- /dev/null
+++ b/app/react/components/PageHeader/HeaderContainer.stories.tsx
@@ -0,0 +1,47 @@
+import { Meta, StoryFn } from '@storybook/react-webpack5';
+import { useMemo } from 'react';
+
+import { UserContext } from '@/react/hooks/useUser';
+import { UserViewModel } from '@/portainer/models/user';
+
+import { HeaderContainer } from './HeaderContainer';
+import { Breadcrumbs } from './Breadcrumbs';
+import { HeaderTitle } from './HeaderTitle';
+import { PageTitle } from './PageTitle';
+
+export default {
+  component: HeaderContainer,
+  title: 'Components/PageHeader/HeaderContainer',
+} as Meta;
+
+interface StoryProps {
+  title: string;
+}
+
+function Template({ title }: StoryProps) {
+  const state = useMemo(
+    () => ({ user: new UserViewModel({ Username: 'test' }) }),
+    []
+  );
+
+  return (
+    <UserContext.Provider value={state}>
+      <HeaderContainer>
+        <Breadcrumbs
+          breadcrumbs={[
+            { link: 'example', label: 'crumb1' },
+            { label: 'crumb2' },
+          ]}
+        />
+
+        <HeaderTitle />
+      </HeaderContainer>
+      <PageTitle title={title} />
+    </UserContext.Provider>
+  );
+}
+
+export const Primary: StoryFn<StoryProps> = Template.bind({});
+Primary.args = {
+  title: 'Container details',
+};
diff --git a/app/react/components/PageHeader/HeaderContainer.tsx b/app/react/components/PageHeader/HeaderContainer.tsx
new file mode 100644
index 0000000..6856f1c
--- /dev/null
+++ b/app/react/components/PageHeader/HeaderContainer.tsx
@@ -0,0 +1,33 @@
+import { PropsWithChildren, createContext, useContext } from 'react';
+
+const Context = createContext<null | boolean>(null);
+Context.displayName = 'PageHeaderContext';
+
+export function useHeaderContext() {
+  const context = useContext(Context);
+
+  if (context == null) {
+    throw new Error('Should be nested inside a HeaderContainer component');
+  }
+}
+interface Props {
+  id?: string;
+}
+
+export function HeaderContainer({ id, children }: PropsWithChildren<Props>) {
+  return (
+    <Context.Provider value>
+      <div
+        id={id}
+        className="row !mb-[5px] min-h-[60px] !rounded-none !border-0 !border-b !border-solid !border-b-[var(--border-widget)] bg-[var(--bg-widget-color)] !shadow-none"
+      >
+        <div id="loadingbar-placeholder" />
+        <div className="col-xs-12">
+          <div className="flex items-center justify-between [&_div]:truncate">
+            {children}
+          </div>
+        </div>
+      </div>
+    </Context.Provider>
+  );
+}
diff --git a/app/react/components/PageHeader/HeaderTitle.module.css b/app/react/components/PageHeader/HeaderTitle.module.css
new file mode 100644
index 0000000..2ce0920
--- /dev/null
+++ b/app/react/components/PageHeader/HeaderTitle.module.css
@@ -0,0 +1,55 @@
+.menu-button {
+  border: 0px;
+  font-size: 17px;
+  background: none;
+  margin-right: 8px;
+  display: flex;
+  align-items: center;
+}
+
+.menu-icon {
+  background: var(--user-menu-icon-color);
+  position: relative;
+  flex-shrink: 0;
+}
+
+.menu-icon:hover {
+  /* keep the links and button icon colors consistent on hover */
+  @apply text-gray-8 th-dark:text-gray-warm-7;
+}
+
+.menu-list {
+  background: var(--bg-dropdown-menu-color);
+  border-radius: 8px;
+  border: 1px solid var(--ui-gray-5) !important;
+  min-width: 180px;
+  padding: 5px !important;
+  box-shadow: 0 6px 12px rgb(0 0 0 / 18%);
+  @apply th-dark:!border-none;
+  @apply th-highcontrast:!border-none;
+  z-index: 9999;
+  position: relative;
+}
+
+.menu-link {
+  display: block;
+  padding: 5px 20px;
+  font-weight: 500;
+  line-height: 1.42857143;
+  white-space: nowrap;
+  font-size: 14px;
+  color: var(--text-dropdown-menu-color) !important;
+  text-decoration: none !important;
+  border-radius: 5px;
+}
+
+.arrow-down {
+  width: 18px;
+  height: 18px;
+  margin-left: 10px;
+}
+
+.menu-link:hover {
+  background: var(--bg-dropdown-hover);
+  color: var(--text-dropdown-menu-color);
+}
diff --git a/app/react/components/PageHeader/HeaderTitle.test.tsx b/app/react/components/PageHeader/HeaderTitle.test.tsx
new file mode 100644
index 0000000..02f9a0b
--- /dev/null
+++ b/app/react/components/PageHeader/HeaderTitle.test.tsx
@@ -0,0 +1,38 @@
+import { render } from '@testing-library/react';
+
+import { UserViewModel } from '@/portainer/models/user';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+
+import { HeaderContainer } from './HeaderContainer';
+import { HeaderTitle } from './HeaderTitle';
+import { PageTitle } from './PageTitle';
+
+test('should display the page title via PageTitle and the user menu via HeaderTitle', async () => {
+  const username = 'username';
+  const user = new UserViewModel({ Username: username });
+
+  const title = 'title';
+
+  const Wrapped = withTestQueryProvider(
+    withUserProvider(
+      withTestRouter(() => (
+        <>
+          <HeaderContainer>
+            <HeaderTitle />
+          </HeaderContainer>
+          <PageTitle title={title} />
+        </>
+      )),
+      user
+    )
+  );
+
+  const { queryByText } = render(<Wrapped />);
+
+  const heading = queryByText(title);
+  expect(heading).toBeVisible();
+
+  expect(queryByText(username)).toBeVisible();
+});
diff --git a/app/react/components/PageHeader/HeaderTitle.tsx b/app/react/components/PageHeader/HeaderTitle.tsx
new file mode 100644
index 0000000..4c9a79e
--- /dev/null
+++ b/app/react/components/PageHeader/HeaderTitle.tsx
@@ -0,0 +1,21 @@
+import { isBE } from '@/react/portainer/feature-flags/feature-flags.service';
+
+import { ContextHelp } from '@@/PageHeader/ContextHelp';
+
+import { useHeaderContext } from './HeaderContainer';
+import { NotificationsMenu } from './NotificationsMenu';
+import { UserMenu } from './UserMenu';
+import { AskAILink } from './AskAILink';
+
+export function HeaderTitle() {
+  useHeaderContext();
+
+  return (
+    <div className="flex items-center">
+      {isBE && <AskAILink />}
+      <NotificationsMenu />
+      <ContextHelp />
+      {!window.ddExtension && <UserMenu />}
+    </div>
+  );
+}
diff --git a/app/react/components/PageHeader/NotificationsMenu.module.css b/app/react/components/PageHeader/NotificationsMenu.module.css
new file mode 100644
index 0000000..60c5cba
--- /dev/null
+++ b/app/react/components/PageHeader/NotificationsMenu.module.css
@@ -0,0 +1,78 @@
+.root {
+  width: 500px;
+}
+
+.badge {
+  position: absolute;
+  top: 8px;
+  right: 10px;
+  width: 6px;
+  height: 6px;
+  background: red;
+  color: #ffffff;
+  display: flex;
+  justify-content: center;
+  align-items: center;
+  border-radius: 50%;
+}
+
+.notification-container {
+  display: flex;
+  border-bottom: 1px solid var(--ui-gray-4);
+  padding: 5px 10px;
+  margin-bottom: 15px;
+}
+
+.item-last {
+  margin-left: auto;
+}
+
+.notifications {
+  max-height: 80vh;
+  overflow-y: auto;
+}
+
+.notification {
+  border-bottom: 1px solid var(--ui-gray-3);
+  border-radius: 0;
+}
+
+.container {
+  display: flex;
+}
+.notificationIcon {
+  flex-basis: 5rem;
+  width: 5rem;
+}
+.notificationBody {
+  flex-basis: 80rem;
+}
+.deleteButton {
+  flex-basis: 5rem;
+}
+
+.notification-details {
+  word-break: break-all;
+  white-space: normal;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  display: -webkit-box;
+  -webkit-line-clamp: 5;
+  line-clamp: 5;
+  -webkit-box-orient: vertical;
+}
+
+.container > div {
+  padding: 0px 10px;
+  margin: auto;
+}
+
+.notification-title {
+  font-weight: 700;
+}
+
+.notification-link {
+  border-top: 1px solid var(--ui-gray-4);
+  padding: 10px;
+  text-align: center;
+}
diff --git a/app/react/components/PageHeader/NotificationsMenu.tsx b/app/react/components/PageHeader/NotificationsMenu.tsx
new file mode 100644
index 0000000..9e668e4
--- /dev/null
+++ b/app/react/components/PageHeader/NotificationsMenu.tsx
@@ -0,0 +1,211 @@
+import clsx from 'clsx';
+import {
+  Menu,
+  MenuButton,
+  MenuList,
+  MenuLink as ReachMenuLink,
+} from '@reach/menu-button';
+import { UISrefProps, useSref } from '@uirouter/react';
+import Moment from 'moment';
+import { useStore } from 'zustand';
+import { AlertCircle, Bell, CheckCircle, Trash2 } from 'lucide-react';
+
+import { AutomationTestingProps } from '@/types';
+import { useUser } from '@/react/hooks/useUser';
+import { ToastNotification } from '@/react/portainer/notifications/types';
+
+import { Icon } from '@@/Icon';
+import { Link } from '@@/Link';
+import { Button } from '@@/buttons';
+
+import { notificationsStore } from '../../portainer/notifications/notifications-store';
+
+import headerStyles from './HeaderTitle.module.css';
+import notificationStyles from './NotificationsMenu.module.css';
+
+export function NotificationsMenu() {
+  const notificationsStoreState = useStore(notificationsStore);
+  const { removeNotification } = notificationsStoreState;
+  const { clearUserNotifications } = notificationsStoreState;
+
+  const { user } = useUser();
+  const userNotifications: ToastNotification[] = useStore(
+    notificationsStore,
+    (state) => state.userNotifications[user.Id]
+  );
+  const reducedNotifications = userNotifications?.slice(0, 50);
+
+  return (
+    <Menu>
+      <MenuButton
+        className={clsx(
+          'ml-auto flex items-center gap-1 self-start',
+          headerStyles.menuButton
+        )}
+        data-cy="notificationsMenu-button"
+        aria-label="Notifications menu toggle"
+      >
+        <div
+          className={clsx(
+            headerStyles.menuIcon,
+            'icon-badge mr-1 !p-2 text-lg',
+            'text-gray-8',
+            'th-dark:text-gray-warm-7'
+          )}
+        >
+          <Icon icon={Bell} />
+          <span
+            className={
+              reducedNotifications?.length > 0 ? notificationStyles.badge : ''
+            }
+          />
+        </div>
+      </MenuButton>
+
+      <MenuList
+        className={clsx(headerStyles.menuList, notificationStyles.root)}
+        aria-label="Notifications Menu"
+        data-cy="notificationsMenu"
+      >
+        <div>
+          <div
+            className={clsx(
+              notificationStyles.notificationContainer,
+              'vertical-center'
+            )}
+          >
+            <div>
+              <h4>Notifications</h4>
+            </div>
+            <div className={notificationStyles.itemLast}>
+              {reducedNotifications?.length > 0 && (
+                <Button
+                  color="none"
+                  onClick={(e) => {
+                    e.stopPropagation();
+                    e.preventDefault();
+                    onClear();
+                  }}
+                  data-cy="notification-deleteButton"
+                >
+                  Clear all
+                </Button>
+              )}
+            </div>
+          </div>
+        </div>
+        {reducedNotifications?.length > 0 ? (
+          <>
+            <div className={notificationStyles.notifications}>
+              {reducedNotifications.map((notification, index) => (
+                <MenuLink
+                  to="portainer.notifications"
+                  params={{ id: notification.id }}
+                  notification={notification}
+                  key={notification.id}
+                  onDelete={() => onDelete(notification.id)}
+                  data-cy={`notification-delete-button_${index}`}
+                />
+              ))}
+            </div>
+
+            <div className={notificationStyles.notificationLink}>
+              <Link
+                to="portainer.notifications"
+                data-cy="notifications-see-all-link"
+              >
+                View all notifications
+              </Link>
+            </div>
+          </>
+        ) : (
+          <div className="flex flex-col items-center">
+            <Icon icon={Bell} size="xl" />
+            <p className="my-5">You have no notifications yet.</p>
+          </div>
+        )}
+      </MenuList>
+    </Menu>
+  );
+
+  function onDelete(notificationId: string) {
+    removeNotification(user.Id, notificationId);
+  }
+
+  function onClear() {
+    clearUserNotifications(user.Id);
+  }
+}
+
+interface MenuLinkProps extends AutomationTestingProps, UISrefProps {
+  notification: ToastNotification;
+  onDelete: () => void;
+}
+
+function MenuLink({ to, params, notification, onDelete }: MenuLinkProps) {
+  const anchorProps = useSref(to, params);
+
+  return (
+    <ReachMenuLink
+      href={anchorProps.href}
+      onClick={anchorProps.onClick}
+      className={clsx(headerStyles.menuLink, notificationStyles.notification)}
+    >
+      <div className={notificationStyles.container}>
+        <div className={notificationStyles.notificationIcon}>
+          {notification.type === 'success' ? (
+            <Icon icon={CheckCircle} size="lg" mode="success" />
+          ) : (
+            <Icon icon={AlertCircle} size="lg" mode="danger" />
+          )}
+        </div>
+        <div className={notificationStyles.notificationBody}>
+          <p className={notificationStyles.notificationTitle}>
+            {notification.title}
+          </p>
+          <p className={notificationStyles.notificationDetails}>
+            {notification.details}
+          </p>
+          <p className="small text-muted">
+            {formatTime(notification.timeStamp)}
+          </p>
+        </div>
+        <div className={notificationStyles.deleteButton}>
+          <Button
+            color="none"
+            onClick={(e) => {
+              e.stopPropagation();
+              e.preventDefault();
+              onDelete();
+            }}
+            data-cy="notification-deleteButton"
+            size="large"
+            icon={Trash2}
+          />
+        </div>
+      </div>
+    </ReachMenuLink>
+  );
+}
+
+function formatTime(timeCreated: Date) {
+  const timeStamp = new Date(timeCreated).valueOf().toString();
+
+  const diff = Math.floor((Date.now() - parseInt(timeStamp, 10)) / 1000);
+
+  if (diff <= 86400) {
+    let interval = Math.floor(diff / 3600);
+    if (interval >= 1) {
+      return `${interval} hours ago`;
+    }
+    interval = Math.floor(diff / 60);
+    if (interval >= 1) {
+      return `${interval} min ago`;
+    }
+  }
+  if (diff > 86400) {
+    const formatDate = Moment(timeCreated).format('YYYY-MM-DD h:mm:ss');
+    return formatDate;
+  }
+  return 'Just now';
+}
diff --git a/app/react/components/PageHeader/PageHeader.stories.tsx b/app/react/components/PageHeader/PageHeader.stories.tsx
new file mode 100644
index 0000000..4039705
--- /dev/null
+++ b/app/react/components/PageHeader/PageHeader.stories.tsx
@@ -0,0 +1,43 @@
+import { Meta, StoryFn } from '@storybook/react-webpack5';
+import { useMemo } from 'react';
+
+import { UserContext } from '@/react/hooks/useUser';
+import { UserViewModel } from '@/portainer/models/user';
+
+import { PageHeader } from './PageHeader';
+
+export default {
+  component: PageHeader,
+  title: 'Components/PageHeader',
+} as Meta;
+
+interface StoryProps {
+  title: string;
+}
+
+function Template({ title }: StoryProps) {
+  const state = useMemo(
+    () => ({ user: new UserViewModel({ Username: 'test' }) }),
+    []
+  );
+
+  return (
+    <UserContext.Provider value={state}>
+      <PageHeader
+        title={title}
+        breadcrumbs={[
+          { link: 'example', label: 'bread1' },
+          { link: 'example2', label: 'bread2' },
+          { label: 'bread3' },
+          { label: 'bread4' },
+        ]}
+        reload
+      />
+    </UserContext.Provider>
+  );
+}
+
+export const Primary: StoryFn<StoryProps> = Template.bind({});
+Primary.args = {
+  title: 'Container details',
+};
diff --git a/app/react/components/PageHeader/PageHeader.test.tsx b/app/react/components/PageHeader/PageHeader.test.tsx
new file mode 100644
index 0000000..f6bd1f9
--- /dev/null
+++ b/app/react/components/PageHeader/PageHeader.test.tsx
@@ -0,0 +1,25 @@
+import { render } from '@testing-library/react';
+
+import { UserViewModel } from '@/portainer/models/user';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+
+import { PageHeader } from './PageHeader';
+
+test('should display a PageHeader', async () => {
+  const username = 'username';
+  const user = new UserViewModel({ Username: username });
+
+  const Wrapped = withTestQueryProvider(
+    withUserProvider(withTestRouter(PageHeader), user)
+  );
+
+  const title = 'title';
+  const { queryByText } = render(<Wrapped title={title} />);
+
+  const heading = queryByText(title);
+  expect(heading).toBeVisible();
+
+  expect(queryByText(username)).toBeVisible();
+});
diff --git a/app/react/components/PageHeader/PageHeader.tsx b/app/react/components/PageHeader/PageHeader.tsx
new file mode 100644
index 0000000..108996d
--- /dev/null
+++ b/app/react/components/PageHeader/PageHeader.tsx
@@ -0,0 +1,82 @@
+import { useRouter } from '@uirouter/react';
+import { PropsWithChildren } from 'react';
+import { RefreshCw } from 'lucide-react';
+
+import { dispatchCacheRefreshEvent } from '@/portainer/services/http-request.helper';
+
+import { VerticalSeparator } from '../VerticalSeparator';
+import { Button } from '../buttons';
+
+import { Breadcrumbs } from './Breadcrumbs';
+import { Crumb } from './Breadcrumbs/Breadcrumbs';
+import { HeaderContainer } from './HeaderContainer';
+import { HeaderTitle } from './HeaderTitle';
+import { PageTitle } from './PageTitle';
+import { SidebarToggleButton } from './SidebarToggleButton';
+
+interface Props {
+  id?: string;
+  reload?: boolean;
+  loading?: boolean;
+  onReload?(): Promise<void> | void;
+  breadcrumbs?: (Crumb | string)[] | string;
+  title?: string;
+  /** Render the visible page title row. Defaults to true when title is provided.
+   * Set to false on screens that display the title via another component (e.g.
+   * `ResourceDetailHeader`) to avoid showing it twice. */
+  showTitle?: boolean;
+}
+
+export function PageHeader({
+  id,
+  title,
+  breadcrumbs = [],
+  reload,
+  loading,
+  onReload,
+  showTitle = !!title,
+  children,
+}: PropsWithChildren<Props>) {
+  const router = useRouter();
+
+  return (
+    <>
+      <HeaderContainer id={id}>
+        <div className="flex min-w-0 items-center">
+          <SidebarToggleButton />
+          <VerticalSeparator />
+          <Breadcrumbs breadcrumbs={breadcrumbs} />
+        </div>
+        <HeaderTitle />
+      </HeaderContainer>
+
+      {showTitle && title && (
+        <PageTitle title={title}>
+          {(reload || children) && (
+            <div className="ml-auto flex items-center gap-2">
+              {reload && (
+                <Button
+                  color="none"
+                  size="large"
+                  onClick={onClickedRefresh}
+                  className="m-0 p-0 focus:text-inherit"
+                  disabled={loading}
+                  title="Refresh page"
+                  data-cy="refresh-page-button"
+                >
+                  <RefreshCw className="icon" />
+                </Button>
+              )}
+              {children}
+            </div>
+          )}
+        </PageTitle>
+      )}
+    </>
+  );
+
+  function onClickedRefresh() {
+    dispatchCacheRefreshEvent();
+    return onReload ? onReload() : router.stateService.reload();
+  }
+}
diff --git a/app/react/components/PageHeader/PageTitle.stories.tsx b/app/react/components/PageHeader/PageTitle.stories.tsx
new file mode 100644
index 0000000..467187f
--- /dev/null
+++ b/app/react/components/PageHeader/PageTitle.stories.tsx
@@ -0,0 +1,34 @@
+import { Meta, StoryFn } from '@storybook/react-webpack5';
+
+import { PageTitle } from './PageTitle';
+
+export default {
+  component: PageTitle,
+  title: 'Components/PageHeader/PageTitle',
+} as Meta;
+
+interface StoryProps {
+  title: string;
+}
+
+function Template({ title }: StoryProps) {
+  return <PageTitle title={title} />;
+}
+
+export const Primary: StoryFn<StoryProps> = Template.bind({});
+Primary.args = {
+  title: 'Container details',
+};
+
+function WithChildrenTemplate({ title }: StoryProps) {
+  return (
+    <PageTitle title={title}>
+      <span className="text-muted text-sm">additional content</span>
+    </PageTitle>
+  );
+}
+
+export const WithChildren: StoryFn<StoryProps> = WithChildrenTemplate.bind({});
+WithChildren.args = {
+  title: 'Container details',
+};
diff --git a/app/react/components/PageHeader/PageTitle.test.tsx b/app/react/components/PageHeader/PageTitle.test.tsx
new file mode 100644
index 0000000..1da4448
--- /dev/null
+++ b/app/react/components/PageHeader/PageTitle.test.tsx
@@ -0,0 +1,40 @@
+import { render } from '@testing-library/react';
+
+import { PageTitle } from './PageTitle';
+
+test('should display the title text', () => {
+  const title = 'Dashboard';
+
+  const { getByText } = render(<PageTitle title={title} />);
+
+  expect(getByText(title)).toBeVisible();
+});
+
+test('should render the title as an h1 element', () => {
+  const title = 'Settings';
+
+  const { getByRole } = render(<PageTitle title={title} />);
+
+  const heading = getByRole('heading', { level: 1 });
+  expect(heading).toHaveTextContent(title);
+});
+
+test('should render children alongside the title', () => {
+  const title = 'Containers';
+  const childText = 'extra content';
+
+  const { getByText } = render(
+    <PageTitle title={title}>
+      <span>{childText}</span>
+    </PageTitle>
+  );
+
+  expect(getByText(title)).toBeVisible();
+  expect(getByText(childText)).toBeVisible();
+});
+
+test('should have the page-title data-cy attribute', () => {
+  const { getByText } = render(<PageTitle title="Test" />);
+
+  expect(getByText('Test')).toHaveAttribute('data-cy', 'page-title');
+});
diff --git a/app/react/components/PageHeader/PageTitle.tsx b/app/react/components/PageHeader/PageTitle.tsx
new file mode 100644
index 0000000..8832fa9
--- /dev/null
+++ b/app/react/components/PageHeader/PageTitle.tsx
@@ -0,0 +1,18 @@
+import { PropsWithChildren } from 'react';
+
+export function PageTitle({
+  title,
+  children,
+}: PropsWithChildren<{ title: string }>) {
+  return (
+    <div className="mx-4 mb-2 flex items-center gap-2">
+      <h1
+        className="m-0 text-lg font-medium text-gray-11 th-highcontrast:text-white th-dark:text-white"
+        data-cy="page-title"
+      >
+        {title}
+      </h1>
+      {children}
+    </div>
+  );
+}
diff --git a/app/react/components/PageHeader/SidebarToggleButton.tsx b/app/react/components/PageHeader/SidebarToggleButton.tsx
new file mode 100644
index 0000000..149ed41
--- /dev/null
+++ b/app/react/components/PageHeader/SidebarToggleButton.tsx
@@ -0,0 +1,23 @@
+import { PanelLeftClose, PanelLeftOpen } from 'lucide-react';
+
+import { sidebarStore } from '@/react/sidebar/sidebarStore';
+
+import { TooltipWithChildren } from '@@/Tip/TooltipWithChildren';
+
+export function SidebarToggleButton() {
+  const { isOpen, toggle } = sidebarStore();
+
+  return (
+    <TooltipWithChildren message={`${isOpen ? 'Collapse' : 'Expand'} sidebar`}>
+      <button
+        type="button"
+        onClick={toggle}
+        className="flex h-6 w-6 shrink-0 items-center justify-center rounded border-0 bg-transparent text-sm text-gray-7 transition-colors duration-200 hover:text-blue-11 th-highcontrast:text-white th-dark:text-gray-5 th-dark:hover:text-blue-9"
+        aria-label="Toggle Sidebar"
+        title="Toggle Sidebar"
+      >
+        {isOpen ? <PanelLeftClose /> : <PanelLeftOpen />}
+      </button>
+    </TooltipWithChildren>
+  );
+}
diff --git a/app/react/components/PageHeader/UserMenu.tsx b/app/react/components/PageHeader/UserMenu.tsx
new file mode 100644
index 0000000..40f5a63
--- /dev/null
+++ b/app/react/components/PageHeader/UserMenu.tsx
@@ -0,0 +1,97 @@
+import {
+  Menu,
+  MenuButton,
+  MenuList,
+  MenuLink as ReachMenuLink,
+} from '@reach/menu-button';
+import { UISrefProps, useSref } from '@uirouter/react';
+import clsx from 'clsx';
+import { UserIcon, ChevronDown } from 'lucide-react';
+
+import { queryClient } from '@/react-tools/react-query';
+import { AutomationTestingProps } from '@/types';
+import { useCurrentUser } from '@/react/hooks/useUser';
+
+import styles from './HeaderTitle.module.css';
+import { ThemeSelector } from './UserMenuThemeSelector';
+
+export function UserMenu() {
+  const { user } = useCurrentUser();
+
+  return (
+    <Menu>
+      <MenuButton
+        className={clsx(
+          'ml-auto flex items-center gap-1 self-start',
+          styles.menuButton
+        )}
+        data-cy="userMenu-button"
+        aria-label="User menu toggle"
+      >
+        <div
+          className={clsx(
+            styles.menuIcon,
+            'icon-badge mr-1 !p-2 text-lg',
+            'text-gray-8',
+            'th-dark:text-gray-warm-7'
+          )}
+        >
+          <UserIcon className="lucide" />
+        </div>
+        {user && <span>{user.Username}</span>}
+        <ChevronDown className={styles.arrowDown} />
+      </MenuButton>
+
+      <MenuList
+        className={styles.menuList}
+        aria-label="User Menu"
+        data-cy="userMenu"
+      >
+        <MenuLink
+          to="portainer.account"
+          label="My account"
+          data-cy="userMenu-myAccount"
+        />
+
+        <MenuLink
+          to="portainer.logout"
+          label="Log out"
+          data-cy="userMenu-logOut"
+        />
+
+        <hr className="my-1 border-t border-gray-5 th-highcontrast:border-gray-7 th-dark:border-gray-7" />
+
+        <ThemeSelector user={user} />
+      </MenuList>
+    </Menu>
+  );
+}
+
+interface MenuLinkProps extends AutomationTestingProps, UISrefProps {
+  label: string;
+}
+
+function MenuLink({
+  to,
+  label,
+  params,
+  options,
+  'data-cy': dataCy,
+}: MenuLinkProps) {
+  const anchorProps = useSref(to, params, options);
+
+  return (
+    <ReachMenuLink
+      href={anchorProps.href}
+      onClick={(e: React.MouseEvent) => {
+        queryClient.clear();
+        anchorProps.onClick(e);
+      }}
+      className={styles.menuLink}
+      aria-label={label}
+      data-cy={dataCy}
+    >
+      {label}
+    </ReachMenuLink>
+  );
+}
diff --git a/app/react/components/PageHeader/UserMenuThemeSelector.tsx b/app/react/components/PageHeader/UserMenuThemeSelector.tsx
new file mode 100644
index 0000000..f581437
--- /dev/null
+++ b/app/react/components/PageHeader/UserMenuThemeSelector.tsx
@@ -0,0 +1,47 @@
+import { Eye, Moon, RefreshCw, Sun } from 'lucide-react';
+import { ReactNode } from 'react';
+
+import { User, ThemeColor } from '@/portainer/users/types';
+import { applyTheme } from '@/react/portainer/services/applyTheme';
+import { useUpdateUserMutation } from '@/react/portainer/account/useUpdateUserMutation';
+import { options as themeOptions } from '@/react/portainer/account/AccountView/theme-options';
+
+import {
+  SegmentItem,
+  SegmentedControl,
+} from '@@/form-components/SegmentedControl';
+import { Icon } from '@@/Icon';
+
+const themeIconMap: Record<ThemeColor, ReactNode> = {
+  light: <Icon icon={Sun} />,
+  dark: <Icon icon={Moon} />,
+  highcontrast: <Icon icon={Eye} />,
+  auto: <Icon icon={RefreshCw} />,
+};
+
+const themeSegmentItems: SegmentItem[] = themeOptions.map((option) => ({
+  id: option.id,
+  label: themeIconMap[option.id],
+  title: option.label,
+}));
+
+export function ThemeSelector({ user }: { user: User }) {
+  const updateMutation = useUpdateUserMutation();
+  const activeTheme = user?.ThemeSettings?.color ?? 'auto';
+
+  function handleThemeSelect(id: string) {
+    const color = id as ThemeColor;
+    applyTheme(color);
+    updateMutation.mutate({ theme: { color } });
+  }
+
+  return (
+    <SegmentedControl
+      label="Theme"
+      items={themeSegmentItems}
+      activeId={activeTheme}
+      onChange={handleThemeSelect}
+      size="md"
+    />
+  );
+}
diff --git a/app/react/components/PageHeader/index.ts b/app/react/components/PageHeader/index.ts
new file mode 100644
index 0000000..71767e1
--- /dev/null
+++ b/app/react/components/PageHeader/index.ts
@@ -0,0 +1 @@
+export { PageHeader } from './PageHeader';
diff --git a/app/react/components/PaginationControls/ItemsPerPageSelector.tsx b/app/react/components/PaginationControls/ItemsPerPageSelector.tsx
new file mode 100644
index 0000000..a2744f9
--- /dev/null
+++ b/app/react/components/PaginationControls/ItemsPerPageSelector.tsx
@@ -0,0 +1,36 @@
+import _ from 'lodash';
+import { useState } from 'react';
+
+interface Props {
+  value: number;
+  onChange(value: number): void;
+  showAll?: boolean;
+}
+
+export function ItemsPerPageSelector({ value, onChange, showAll }: Props) {
+  const [id] = useState(() => `${_.uniqueId()}-items-per-page`);
+  return (
+    <span className="limitSelector">
+      <label
+        className="space-right text-xs font-normal text-[--text-main-color]"
+        htmlFor={id}
+      >
+        Items per page
+      </label>
+      <select
+        id={id}
+        className="form-control"
+        value={value}
+        onChange={(e) => onChange(Number(e.target.value))}
+        data-cy="paginationSelect"
+      >
+        {showAll ? <option value={Number.MAX_SAFE_INTEGER}>All</option> : null}
+        {[10, 25, 50, 100].map((v) => (
+          <option value={v} key={v}>
+            {v}
+          </option>
+        ))}
+      </select>
+    </span>
+  );
+}
diff --git a/app/react/components/PaginationControls/PageButton.tsx b/app/react/components/PaginationControls/PageButton.tsx
new file mode 100644
index 0000000..6bcd6a7
--- /dev/null
+++ b/app/react/components/PaginationControls/PageButton.tsx
@@ -0,0 +1,30 @@
+import clsx from 'clsx';
+import { ReactNode } from 'react';
+
+interface Props {
+  active?: boolean;
+  children: ReactNode;
+  disabled?: boolean;
+  onPageChange(page: number): void;
+  page: number | '...';
+}
+
+export function PageButton({
+  children,
+  page,
+  disabled,
+  active,
+  onPageChange,
+}: Props) {
+  return (
+    <li className={clsx({ disabled, active })}>
+      <button
+        type="button"
+        onClick={() => typeof page === 'number' && onPageChange(page)}
+        disabled={disabled}
+      >
+        {children}
+      </button>
+    </li>
+  );
+}
diff --git a/app/react/components/PaginationControls/PageInput.tsx b/app/react/components/PaginationControls/PageInput.tsx
new file mode 100644
index 0000000..56d0e1e
--- /dev/null
+++ b/app/react/components/PaginationControls/PageInput.tsx
@@ -0,0 +1,63 @@
+import { useFormik } from 'formik';
+import { ChangeEvent, KeyboardEvent } from 'react';
+import { object, number } from 'yup';
+
+import { Button } from '@@/buttons';
+import { Input } from '@@/form-components/Input';
+
+interface Values {
+  page: number | '';
+}
+
+interface Props {
+  onChange(page: number): void;
+  totalPages: number;
+}
+
+export function PageInput({ onChange, totalPages }: Props) {
+  const { handleSubmit, setFieldValue, values, isValid } = useFormik<Values>({
+    initialValues: { page: '' },
+    onSubmit: async ({ page }) => page && onChange(page),
+    validateOnMount: true,
+    validationSchema: () =>
+      object({ page: number().required().max(totalPages).min(1) }),
+  });
+
+  return (
+    <form className="mx-3" onSubmit={handleSubmit}>
+      <label className="small m-0 mr-2 font-normal" htmlFor="go-to-page-input">
+        Go to page
+      </label>
+      <Input
+        id="go-to-page-input"
+        className="!w-32"
+        type="number"
+        value={values.page}
+        max={totalPages}
+        min={1}
+        step={1}
+        onChange={handleChange}
+        onKeyPress={preventNotNumber}
+        data-cy="pagination-go-to-page-input"
+      />
+      <Button
+        type="submit"
+        disabled={!isValid}
+        data-cy="pagination-go-to-page-button"
+      >
+        Go
+      </Button>
+    </form>
+  );
+
+  function preventNotNumber(e: KeyboardEvent<HTMLInputElement>) {
+    if (e.key.match(/^\D$/)) {
+      e.preventDefault();
+    }
+  }
+
+  function handleChange(e: ChangeEvent<HTMLInputElement>) {
+    const value = parseInt(e.target.value, 10);
+    setFieldValue('page', Number.isNaN(value) ? '' : value);
+  }
+}
diff --git a/app/react/components/PaginationControls/PageSelector.tsx b/app/react/components/PaginationControls/PageSelector.tsx
new file mode 100644
index 0000000..4099610
--- /dev/null
+++ b/app/react/components/PaginationControls/PageSelector.tsx
@@ -0,0 +1,93 @@
+import './pagination-controls.css';
+
+import { generatePagesArray } from './generatePagesArray';
+import { PageButton } from './PageButton';
+import { PageInput } from './PageInput';
+
+interface Props {
+  boundaryLinks?: boolean;
+  currentPage: number;
+  directionLinks?: boolean;
+  onPageChange(page: number): void;
+  pageCount: number;
+  maxSize: number;
+  isInputVisible?: boolean;
+}
+
+export function PageSelector({
+  currentPage,
+  pageCount,
+  onPageChange,
+  maxSize = 5,
+  directionLinks = true,
+  boundaryLinks = false,
+  isInputVisible = false,
+}: Props) {
+  const pages = generatePagesArray(currentPage, pageCount, maxSize);
+  const last = pages[pages.length - 1];
+
+  if (pages.length <= 1) {
+    return null;
+  }
+
+  return (
+    <>
+      {isInputVisible && (
+        <PageInput
+          onChange={(page) => onPageChange(page)}
+          totalPages={pageCount}
+        />
+      )}
+      <ul className="pagination">
+        {boundaryLinks ? (
+          <PageButton
+            onPageChange={onPageChange}
+            page={1}
+            disabled={currentPage === 1}
+          >
+            &laquo;
+          </PageButton>
+        ) : null}
+        {directionLinks ? (
+          <PageButton
+            onPageChange={onPageChange}
+            page={currentPage - 1}
+            disabled={currentPage === 1}
+          >
+            &lsaquo;
+          </PageButton>
+        ) : null}
+        {pages.map((pageNumber, index) => (
+          <PageButton
+            onPageChange={onPageChange}
+            page={pageNumber}
+            disabled={pageNumber === '...'}
+            active={currentPage === pageNumber}
+            key={index}
+          >
+            {pageNumber}
+          </PageButton>
+        ))}
+
+        {directionLinks ? (
+          <PageButton
+            onPageChange={onPageChange}
+            page={currentPage + 1}
+            disabled={currentPage === last}
+          >
+            &rsaquo;
+          </PageButton>
+        ) : null}
+        {boundaryLinks ? (
+          <PageButton
+            disabled={currentPage === last}
+            onPageChange={onPageChange}
+            page={last}
+          >
+            &raquo;
+          </PageButton>
+        ) : null}
+      </ul>
+    </>
+  );
+}
diff --git a/app/react/components/PaginationControls/PaginationControls.tsx b/app/react/components/PaginationControls/PaginationControls.tsx
new file mode 100644
index 0000000..889fb18
--- /dev/null
+++ b/app/react/components/PaginationControls/PaginationControls.tsx
@@ -0,0 +1,53 @@
+import clsx from 'clsx';
+
+import { ItemsPerPageSelector } from './ItemsPerPageSelector';
+import { PageSelector } from './PageSelector';
+
+interface Props {
+  onPageChange(page: number): void;
+  onPageLimitChange(value: number): void;
+  page: number;
+  pageLimit: number;
+  showAll?: boolean;
+  pageCount: number;
+  isPageInputVisible?: boolean;
+  className?: string;
+}
+
+export function PaginationControls({
+  pageLimit,
+  page,
+  onPageLimitChange,
+  showAll,
+  onPageChange,
+  pageCount,
+  isPageInputVisible,
+  className,
+}: Props) {
+  return (
+    <div className={clsx('paginationControls', className)}>
+      <div className="form-inline flex">
+        <ItemsPerPageSelector
+          value={pageLimit}
+          onChange={handlePageLimitChange}
+          showAll={showAll}
+        />
+
+        {pageLimit !== 0 && (
+          <PageSelector
+            maxSize={5}
+            onPageChange={onPageChange}
+            currentPage={page}
+            pageCount={pageCount}
+            isInputVisible={isPageInputVisible}
+          />
+        )}
+      </div>
+    </div>
+  );
+
+  function handlePageLimitChange(value: number) {
+    onPageLimitChange(value);
+    onPageChange(1);
+  }
+}
diff --git a/app/react/components/PaginationControls/calculatePageNumber.ts b/app/react/components/PaginationControls/calculatePageNumber.ts
new file mode 100644
index 0000000..2557290
--- /dev/null
+++ b/app/react/components/PaginationControls/calculatePageNumber.ts
@@ -0,0 +1,37 @@
+/**
+ * Given the position in the sequence of pagination links, figure out what page number corresponds to that position.
+ *
+ * @param position
+ * @param currentPage
+ * @param paginationRange
+ * @param totalPages
+ */
+export function calculatePageNumber(
+  position: number,
+  currentPage: number,
+  paginationRange: number,
+  totalPages: number
+) {
+  const halfWay = Math.ceil(paginationRange / 2);
+  if (position === paginationRange) {
+    return totalPages;
+  }
+
+  if (position === 1) {
+    return position;
+  }
+
+  if (paginationRange < totalPages) {
+    if (totalPages - halfWay < currentPage) {
+      return totalPages - paginationRange + position;
+    }
+
+    if (halfWay < currentPage) {
+      return currentPage - halfWay + position;
+    }
+
+    return position;
+  }
+
+  return position;
+}
diff --git a/app/react/components/PaginationControls/generatePagesArray.ts b/app/react/components/PaginationControls/generatePagesArray.ts
new file mode 100644
index 0000000..8bdb386
--- /dev/null
+++ b/app/react/components/PaginationControls/generatePagesArray.ts
@@ -0,0 +1,53 @@
+import { calculatePageNumber } from './calculatePageNumber';
+
+export /**
+ * Generate an array of page numbers (or the '...' string) which is used in an ng-repeat to generate the
+ * links used in pagination
+ *
+ * @param currentPage
+ * @param rowsPerPage
+ * @param paginationRange
+ * @param collectionLength
+ * @returns {Array}
+ */
+function generatePagesArray(
+  currentPage: number,
+  totalPages: number,
+  paginationRange: number
+): (number | '...')[] {
+  const pages: (number | '...')[] = [];
+  const halfWay = Math.ceil(paginationRange / 2);
+
+  let position;
+  if (currentPage <= halfWay) {
+    position = 'start';
+  } else if (totalPages - halfWay < currentPage) {
+    position = 'end';
+  } else {
+    position = 'middle';
+  }
+
+  const ellipsesNeeded = paginationRange < totalPages;
+
+  for (let i = 1; i <= totalPages && i <= paginationRange; i += 1) {
+    const pageNumber = calculatePageNumber(
+      i,
+      currentPage,
+      paginationRange,
+      totalPages
+    );
+
+    const openingEllipsesNeeded =
+      i === 2 && (position === 'middle' || position === 'end');
+    const closingEllipsesNeeded =
+      i === paginationRange - 1 &&
+      (position === 'middle' || position === 'start');
+    if (ellipsesNeeded && (openingEllipsesNeeded || closingEllipsesNeeded)) {
+      pages.push('...');
+    } else {
+      pages.push(pageNumber);
+    }
+  }
+
+  return pages;
+}
diff --git a/app/react/components/PaginationControls/index.ts b/app/react/components/PaginationControls/index.ts
new file mode 100644
index 0000000..73d59f3
--- /dev/null
+++ b/app/react/components/PaginationControls/index.ts
@@ -0,0 +1,3 @@
+import './pagination-controls.css';
+
+export { PaginationControls } from './PaginationControls';
diff --git a/app/react/components/PaginationControls/pagination-controls.css b/app/react/components/PaginationControls/pagination-controls.css
new file mode 100644
index 0000000..4be0cf9
--- /dev/null
+++ b/app/react/components/PaginationControls/pagination-controls.css
@@ -0,0 +1,75 @@
+.pagination-controls {
+  margin-left: 10px;
+}
+
+.paginationControls form.form-inline {
+  display: flex;
+}
+
+.pagination > li:first-child > button {
+  margin-left: 0;
+  border-top-left-radius: 4px;
+  border-bottom-left-radius: 4px;
+}
+
+.pagination > .disabled > span,
+.pagination > .disabled > span:hover,
+.pagination > .disabled > span:focus,
+.pagination > .disabled > button,
+.pagination > .disabled > button:hover,
+.pagination > .disabled > button:focus,
+.pagination > .disabled > a,
+.pagination > .disabled > a:hover,
+.pagination > .disabled > a:focus {
+  color: var(--text-pagination-color);
+  background-color: var(--bg-pagination-disabled-color);
+  border-color: var(--border-pagination-color);
+}
+
+.pagination > li > button {
+  position: relative;
+  float: left;
+  padding: 6px 12px;
+  margin-left: -1px !important;
+  line-height: 1.42857143;
+  text-decoration: none;
+  border: 1px solid var(--ui-white);
+}
+
+.pagination > li > a,
+.pagination > li > button,
+.pagination > li > span {
+  background-color: var(--bg-pagination-span-color);
+  border-color: var(--border-pagination-span-color);
+  color: var(--text-pagination-span-color) !important;
+}
+
+.pagination > li > a:hover,
+.pagination > li > button:hover,
+.pagination > li > span:hover,
+.pagination > li > a:focus,
+.pagination > li > button:focus,
+.pagination > li > span:focus {
+  background-color: var(--bg-pagination-hover-color);
+  border-color: var(--border-pagination-hover-color);
+  color: var(--text-pagination-span-hover-color);
+  border-radius: 8px;
+}
+
+.pagination > .active > a,
+.pagination > .active > span,
+.pagination > .active > button,
+.pagination > .active > a:hover,
+.pagination > .active > span:hover,
+.pagination > .active > button:hover,
+.pagination > .active > a:focus,
+.pagination > .active > span:focus,
+.pagination > .active > button:focus {
+  @apply text-blue-7;
+  cursor: default;
+  /* background-color: var(--text-pagination-span-color); */
+  background-color: var(--bg-pagination-color);
+  border-radius: 8px;
+  color: var(--text-pagination-span-hover-color) !important;
+  border-color: var(--border-pagination-span-color);
+}
diff --git a/app/react/components/PasswordCheckHint.tsx b/app/react/components/PasswordCheckHint.tsx
new file mode 100644
index 0000000..a1b5ab3
--- /dev/null
+++ b/app/react/components/PasswordCheckHint.tsx
@@ -0,0 +1,32 @@
+import { AlertTriangle, Check } from 'lucide-react';
+
+import { usePublicSettings } from '@/react/portainer/settings/queries';
+
+import { Icon } from '@@/Icon';
+
+interface Props {
+  passwordValid: boolean;
+  forceChangePassword?: boolean;
+}
+
+export function PasswordCheckHint({
+  passwordValid,
+  forceChangePassword,
+}: Props) {
+  const settingsQuery = usePublicSettings();
+  const minPasswordLength = settingsQuery.data?.RequiredPasswordLength;
+
+  return (
+    <div>
+      <p className="text-warning vertical-center">
+        <Icon icon={AlertTriangle} className="icon-warning" />
+        {forceChangePassword &&
+          'An administrator has changed your password requirements, '}
+        The password must be at least {minPasswordLength} characters long.
+        {passwordValid && (
+          <Icon icon={Check} className="!ml-1" mode="success" />
+        )}
+      </p>
+    </div>
+  );
+}
diff --git a/app/react/components/ProgressBar/ProgressBar.tsx b/app/react/components/ProgressBar/ProgressBar.tsx
new file mode 100644
index 0000000..e1bb48f
--- /dev/null
+++ b/app/react/components/ProgressBar/ProgressBar.tsx
@@ -0,0 +1,66 @@
+import clsx from 'clsx';
+
+type Step = { value: number; color?: string; className?: string };
+type StepWithPercent = Step & { percent: number };
+interface Props {
+  steps: Array<Step>;
+  total: number;
+  className?: string;
+}
+
+export function ProgressBar({ steps, total, className }: Props) {
+  const { steps: reducedSteps } = steps.reduce<{
+    steps: Array<StepWithPercent>;
+    total: number;
+    totalPercent: number;
+  }>(
+    (acc, cur) => {
+      const value =
+        acc.total + cur.value > total ? total - acc.total : cur.value;
+      // If the remaining acc.total + the current value adds up to the total, then make sure the percentage will fill the remaining bar space
+      const percent =
+        acc.total + value === total
+          ? 100 - acc.totalPercent
+          : Math.floor((value / total) * 100);
+      return {
+        steps: [
+          ...acc.steps,
+          {
+            ...cur,
+            value,
+            percent,
+          },
+        ],
+        total: acc.total + value,
+        totalPercent: acc.totalPercent + percent,
+      };
+    },
+    { steps: [], total: 0, totalPercent: 0 }
+  );
+
+  const sum = steps.reduce((sum, s) => sum + s.value, 0);
+
+  return (
+    <div
+      className={clsx(
+        'progress h-2.5 rounded-full shadow-none',
+        sum > 100 ? 'text-blue-8' : 'text-error-7',
+        className
+      )}
+      aria-valuemin={0}
+      aria-valuemax={100}
+      role="progressbar"
+    >
+      {reducedSteps.map((step, index) => (
+        <div
+          key={index}
+          className={clsx('progress-bar shadow-none', step.className)}
+          style={{
+            width: `${step.percent}%`,
+            backgroundColor: step.color,
+          }}
+        />
+      ))}
+    </div>
+  );
+}
diff --git a/app/react/components/ProgressBar/index.ts b/app/react/components/ProgressBar/index.ts
new file mode 100644
index 0000000..d702dcf
--- /dev/null
+++ b/app/react/components/ProgressBar/index.ts
@@ -0,0 +1 @@
+export { ProgressBar } from './ProgressBar';
diff --git a/app/react/components/RadioGroup/RadioGroup.tsx b/app/react/components/RadioGroup/RadioGroup.tsx
new file mode 100644
index 0000000..f230db4
--- /dev/null
+++ b/app/react/components/RadioGroup/RadioGroup.tsx
@@ -0,0 +1,53 @@
+import { ReactNode } from 'react';
+
+// allow custom labels
+export interface RadioGroupOption<TValue> {
+  value: TValue;
+  label: ReactNode;
+  disabled?: boolean;
+}
+
+interface Props<T extends string | number> {
+  options: Array<RadioGroupOption<T>> | ReadonlyArray<RadioGroupOption<T>>;
+  selectedOption: T;
+  name: string;
+  onOptionChange: (value: T) => void;
+  groupClassName?: string;
+  itemClassName?: string;
+}
+
+export function RadioGroup<T extends string | number = string>({
+  options,
+  selectedOption,
+  name,
+  onOptionChange,
+  groupClassName,
+  itemClassName,
+}: Props<T>) {
+  return (
+    <div className={groupClassName ?? 'flex flex-wrap gap-x-2 gap-y-1'}>
+      {options.map((option) => (
+        <label
+          key={option.value}
+          className={
+            itemClassName ??
+            'col-sm-3 col-lg-2 control-label cursor-pointer !p-0 text-left font-normal'
+          }
+        >
+          <input
+            type="radio"
+            name={name}
+            value={option.value}
+            checked={selectedOption === option.value}
+            onChange={() => onOptionChange(option.value)}
+            style={{ margin: '0 4px 0 0' }}
+            data-cy={`radio-${option.value}`}
+            disabled={option.disabled}
+            className="cursor-pointer"
+          />
+          {option.label}
+        </label>
+      ))}
+    </div>
+  );
+}
diff --git a/app/react/components/ReactQueryDevtoolsWrapper.tsx b/app/react/components/ReactQueryDevtoolsWrapper.tsx
new file mode 100644
index 0000000..386bd21
--- /dev/null
+++ b/app/react/components/ReactQueryDevtoolsWrapper.tsx
@@ -0,0 +1,8 @@
+import { ReactQueryDevtools } from '@tanstack/react-query-devtools';
+
+export function ReactQueryDevtoolsWrapper() {
+  const showReactQueryDevtools =
+    process.env.SHOW_REACT_QUERY_DEV_TOOLS === 'true';
+
+  return <>{showReactQueryDevtools && <ReactQueryDevtools />}</>;
+}
diff --git a/app/react/components/Redirect.tsx b/app/react/components/Redirect.tsx
new file mode 100644
index 0000000..13d5d52
--- /dev/null
+++ b/app/react/components/Redirect.tsx
@@ -0,0 +1,10 @@
+import { useRouter } from '@uirouter/react';
+import { useEffect } from 'react';
+
+export function Redirect({ to, params = {} }: { to: string; params?: object }) {
+  const router = useRouter();
+  useEffect(() => {
+    router.stateService.go(to, params);
+  }, [params, router.stateService, to]);
+  return null;
+}
diff --git a/app/react/components/ResourceDetailHeader/ActionBarButton.tsx b/app/react/components/ResourceDetailHeader/ActionBarButton.tsx
new file mode 100644
index 0000000..e616e17
--- /dev/null
+++ b/app/react/components/ResourceDetailHeader/ActionBarButton.tsx
@@ -0,0 +1,26 @@
+import { ComponentProps } from 'react';
+import clsx from 'clsx';
+
+import { Button } from '@@/buttons';
+
+type Props = Omit<ComponentProps<typeof Button>, 'size'>;
+
+export function ActionBarButton({
+  className,
+  color = 'none',
+  ...props
+}: Props) {
+  return (
+    <Button
+      color={color}
+      size="small"
+      className={clsx(
+        '!ml-0 rounded-md !px-3 !py-1.5 transition-colors',
+        'hover:bg-[var(--bg-blocklist-hover-color)] hover:text-[var(--text-blocklist-hover-color)]',
+        className
+      )}
+      // eslint-disable-next-line react/jsx-props-no-spreading
+      {...props}
+    />
+  );
+}
diff --git a/app/react/components/ResourceDetailHeader/ActionBarShell.tsx b/app/react/components/ResourceDetailHeader/ActionBarShell.tsx
new file mode 100644
index 0000000..fd619da
--- /dev/null
+++ b/app/react/components/ResourceDetailHeader/ActionBarShell.tsx
@@ -0,0 +1,24 @@
+import { ReactNode } from 'react';
+import clsx from 'clsx';
+
+interface Props {
+  children: ReactNode;
+  className?: string;
+}
+
+export function ActionBarShell({ children, className }: Props) {
+  return (
+    <div
+      className={clsx(
+        'flex items-center justify-between gap-2',
+        'rounded-b-xl border-0 border-t border-solid',
+        'border-t-[var(--border-widget)] bg-gray-2 px-6 py-2',
+        'th-dark:bg-gray-iron-10',
+        'th-highcontrast:bg-transparent',
+        className
+      )}
+    >
+      {children}
+    </div>
+  );
+}
diff --git a/app/react/components/ResourceDetailHeader/HeaderStats.tsx b/app/react/components/ResourceDetailHeader/HeaderStats.tsx
new file mode 100644
index 0000000..b4045bc
--- /dev/null
+++ b/app/react/components/ResourceDetailHeader/HeaderStats.tsx
@@ -0,0 +1,9 @@
+import { ReactNode } from 'react';
+
+interface Props {
+  children: ReactNode;
+}
+
+export function HeaderStats({ children }: Props) {
+  return <div className="flex items-stretch gap-3">{children}</div>;
+}
diff --git a/app/react/components/ResourceDetailHeader/ResourceDetailHeader.stories.tsx b/app/react/components/ResourceDetailHeader/ResourceDetailHeader.stories.tsx
new file mode 100644
index 0000000..88c3a83
--- /dev/null
+++ b/app/react/components/ResourceDetailHeader/ResourceDetailHeader.stories.tsx
@@ -0,0 +1,383 @@
+import { Meta, StoryObj } from '@storybook/react-webpack5';
+import {
+  LayoutGrid,
+  Shield,
+  Database,
+  AlertCircle,
+  Plus,
+  RefreshCw,
+  Trash2,
+} from 'lucide-react';
+
+import KubernetesLogo from '@/assets/ico/vendor/kubernetes.svg';
+import DockerLogo from '@/assets/ico/vendor/docker.svg';
+import PodmanLogo from '@/assets/ico/vendor/podman.svg';
+
+import { ResourceDetailHeaderSkeleton } from './ResourceDetailHeaderSkeleton';
+import { ResourceDetailHeader } from './ResourceDetailHeader';
+import { ActionBarButton } from './ActionBarButton';
+import { ActionBarShell } from './ActionBarShell';
+import { HeaderStats } from './HeaderStats';
+import { ResourceStatBlock } from './ResourceStatBlock';
+
+// Mirrors the env-group platform breakdown used by GroupHeader on
+// feat/R8S-813. Vertical stack of engine-icon + count + name rows so
+// mixed-platform groups stay scannable in the right column.
+const platformBreakdown = (
+  <span className="flex flex-col gap-1.5 text-xs font-normal">
+    <span className="flex items-center gap-2">
+      <img src={KubernetesLogo} alt="" className="h-4 w-4" />
+      <span>
+        <b className="font-bold">3</b> Kubernetes
+      </span>
+    </span>
+    <span className="flex items-center gap-2">
+      <img src={DockerLogo} alt="" className="h-4 w-4" />
+      <span>
+        <b className="font-bold">1</b> Docker
+      </span>
+    </span>
+    <span className="flex items-center gap-2">
+      <img src={PodmanLogo} alt="" className="h-4 w-4" />
+      <span>
+        <b className="font-bold">1</b> Podman
+      </span>
+    </span>
+  </span>
+);
+
+const meta: Meta<typeof ResourceDetailHeader> = {
+  title: 'Design System/ResourceDetailHeader',
+  component: ResourceDetailHeader,
+  tags: ['autodocs'],
+};
+
+export default meta;
+type Story = StoryObj<typeof ResourceDetailHeader>;
+
+/**
+ * Demonstrates the optional `actionBar` slot.
+ *
+ * Wrap content in `<ActionBarShell>` to get the standard bottom-segment
+ * styling (rounded bottom, border, tint). Children inside the shell
+ * naturally split left/right because `ActionBarShell` is `justify-between`.
+ * Pass a custom element to `actionBar` directly if you need a different
+ * layout.
+ */
+export const ActionBar: Story = {
+  args: {
+    title: 'Production Cluster',
+    icon: (
+      <LayoutGrid className="!text-group-accent-8 th-dark:!text-group-accent-2" />
+    ),
+    subtitleLabel: 'Environment Group',
+    description: 'Resource detail header with the action bar slot in use',
+  },
+  render: (args) => (
+    <ResourceDetailHeader
+      {...args}
+      actionBar={
+        <ActionBarShell>
+          <div className="flex items-center gap-2">
+            <ActionBarButton
+              icon={Plus}
+              onClick={() => {}}
+              data-cy="action-bar-add-environments"
+            >
+              Add Environments
+            </ActionBarButton>
+            <ActionBarButton
+              icon={RefreshCw}
+              onClick={() => {}}
+              data-cy="action-bar-sync"
+            >
+              Sync
+            </ActionBarButton>
+          </div>
+          <div className="flex items-center gap-2">
+            <ActionBarButton
+              icon={Trash2}
+              onClick={() => {}}
+              data-cy="action-bar-delete"
+            >
+              Delete
+            </ActionBarButton>
+          </div>
+        </ActionBarShell>
+      }
+    />
+  ),
+};
+
+/**
+ * Demonstrates the optional `rightInfo` slot with `HeaderStats` and
+ * `ResourceStatBlock` — the standard pattern for showing health/status cards
+ * on the right of the header.
+ */
+export const StatBlocks: Story = {
+  args: {
+    title: 'orders-api',
+    icon: (
+      <LayoutGrid className="!text-group-accent-8 th-dark:!text-group-accent-2" />
+    ),
+    subtitleLabel: 'GitOps Source',
+    description: 'Synced from origin/main · 14 services',
+    rightInfo: (
+      <HeaderStats>
+        <ResourceStatBlock status="success">
+          <ResourceStatBlock.Label>Sync Status</ResourceStatBlock.Label>
+          <ResourceStatBlock.Value dot>Synced</ResourceStatBlock.Value>
+          <ResourceStatBlock.Meta>
+            Last reconciled 2 min ago
+          </ResourceStatBlock.Meta>
+        </ResourceStatBlock>
+        <ResourceStatBlock status="success">
+          <ResourceStatBlock.Label>Health</ResourceStatBlock.Label>
+          <ResourceStatBlock.Value suffix="healthy">
+            3/3
+          </ResourceStatBlock.Value>
+        </ResourceStatBlock>
+      </HeaderStats>
+    ),
+  },
+};
+
+/**
+ * The full env-group detail-header pattern, mirroring how GroupHeader uses
+ * `ResourceDetailHeader` in the environment-group ItemView: a vertical
+ * platform breakdown stat block, a centred policies count stat block, and
+ * a borderless Refresh / Add environments / Delete action bar.
+ */
+export const WithStatBlocksAndActionBar: Story = {
+  args: {
+    title: 'Production Cluster',
+    icon: (
+      <LayoutGrid className="!text-group-accent-8 th-dark:!text-group-accent-2" />
+    ),
+    subtitleLabel: 'Environment Group',
+    description: 'Main production environment group',
+  },
+  render: (args) => (
+    <ResourceDetailHeader
+      {...args}
+      rightInfo={
+        <HeaderStats>
+          <ResourceStatBlock>
+            <ResourceStatBlock.Label>Environments</ResourceStatBlock.Label>
+            <ResourceStatBlock.Value>
+              {platformBreakdown}
+            </ResourceStatBlock.Value>
+          </ResourceStatBlock>
+          <ResourceStatBlock>
+            <ResourceStatBlock.Label icon={<Shield className="h-3 w-3" />}>
+              Policies
+            </ResourceStatBlock.Label>
+            <ResourceStatBlock.Value align="center" size="lg">
+              3
+            </ResourceStatBlock.Value>
+          </ResourceStatBlock>
+        </HeaderStats>
+      }
+      actionBar={
+        <ActionBarShell>
+          <div className="flex items-center gap-3">
+            <ActionBarButton
+              icon={RefreshCw}
+              onClick={() => {}}
+              data-cy="combined-example-refresh"
+            >
+              Refresh
+            </ActionBarButton>
+            <ActionBarButton
+              icon={Plus}
+              onClick={() => {}}
+              data-cy="combined-example-add"
+            >
+              Add environments
+            </ActionBarButton>
+          </div>
+          <div className="flex items-center gap-1">
+            <ActionBarButton
+              icon={Trash2}
+              onClick={() => {}}
+              data-cy="combined-example-delete"
+            >
+              Delete
+            </ActionBarButton>
+          </div>
+        </ActionBarShell>
+      }
+    />
+  ),
+};
+
+export const Default: Story = {
+  args: {
+    title: 'Production Cluster',
+    icon: <LayoutGrid className="text-blue-9 th-dark:text-blue-3" />,
+    subtitleLabel: 'Environment Group',
+    description: 'Main production environment group',
+  },
+};
+
+export const WithBadge: Story = {
+  args: {
+    ...Default.args,
+    badge: (
+      <span className="inline-block rounded-full bg-blue-1 px-2 py-1 text-xs font-medium text-blue-9 th-dark:bg-blue-11 th-dark:text-blue-2">
+        Multi-platform
+      </span>
+    ),
+  },
+};
+
+export const MinimalUsage: Story = {
+  args: {
+    title: 'Simple Group',
+    icon: <LayoutGrid className="text-blue-8" />,
+  },
+};
+
+export const LoadingState: Story = {
+  render: () => (
+    <ResourceDetailHeaderSkeleton statBlockCount={2} hasActionBar />
+  ),
+};
+
+export const LoadingStateNoActionBar: Story = {
+  render: () => (
+    <ResourceDetailHeaderSkeleton statBlockCount={1} hasActionBar={false} />
+  ),
+};
+
+export const CustomIconBackground: Story = {
+  args: {
+    ...Default.args,
+    icon: <Database className="text-warning-8 th-dark:text-warning-2" />,
+    iconBackgroundClassName: 'bg-warning-3 th-dark:bg-warning-10',
+  },
+};
+
+export const WithoutDescription: Story = {
+  args: {
+    ...Default.args,
+    description: undefined,
+  },
+};
+
+export const WithoutStats: Story = {
+  args: {
+    ...Default.args,
+    rightInfo: undefined,
+  },
+};
+
+export const LongTitle: Story = {
+  args: {
+    ...Default.args,
+    title:
+      'Very Long Environment Group Name That Might Wrap to Multiple Lines in Some Contexts',
+    description:
+      'This group contains multiple types of container engines including Docker, Kubernetes, and Podman installations',
+  },
+};
+
+export const DevelopmentGroup: Story = {
+  args: {
+    title: 'Development Environments',
+    icon: <LayoutGrid className="text-success-8 th-dark:text-success-2" />,
+    iconBackgroundClassName: 'bg-success-3 th-dark:bg-success-10',
+    subtitleLabel: 'Environment Group',
+    description: 'Development and testing environments for team collaboration',
+    badge: (
+      <span className="inline-block rounded-full bg-success-1 px-2 py-1 text-xs font-medium text-success-9 th-dark:bg-success-11 th-dark:text-success-2">
+        Dev
+      </span>
+    ),
+  },
+};
+
+export const StagingGroup: Story = {
+  args: {
+    title: 'Staging Environment',
+    icon: <LayoutGrid className="text-orange-8 th-dark:text-orange-2" />,
+    iconBackgroundClassName: 'bg-orange-3 th-dark:bg-orange-10',
+    subtitleLabel: 'Environment Group',
+    description: 'Staging and pre-production validation environment',
+    badge: (
+      <span className="inline-block rounded-full bg-orange-1 px-2 py-1 text-xs font-medium text-orange-9 th-dark:bg-orange-11 th-dark:text-orange-2">
+        Staging
+      </span>
+    ),
+  },
+};
+
+export const PolicyExample: Story = {
+  args: {
+    title: 'Security Policy',
+    icon: <Shield className="h-6 w-6 text-blue-9 th-dark:text-blue-3" />,
+    iconBackgroundClassName: 'bg-blue-3 th-dark:bg-blue-9',
+    subtitleLabel: 'Policy',
+    subtitleClassName: 'text-blue-10 th-dark:text-blue-8',
+    badge: (
+      <span className="inline-block rounded bg-blue-2 px-2 py-1 text-xs font-medium text-blue-9 th-dark:bg-blue-11 th-dark:text-blue-2">
+        Docker
+      </span>
+    ),
+    rightInfo: (
+      <div className="text-muted text-sm">
+        <b>12</b> environments targeted
+      </div>
+    ),
+  },
+};
+
+export const CustomSubtitleColor: Story = {
+  args: {
+    title: 'Custom Entity',
+    icon: <AlertCircle className="text-purple-8" />,
+    iconBackgroundClassName: 'bg-purple-3 th-dark:bg-purple-9',
+    subtitleLabel: 'Custom Type',
+    subtitleClassName: 'text-purple-10 th-dark:text-purple-8',
+    description:
+      'Demonstrates custom subtitle color for different entity types',
+  },
+};
+
+export const EnvironmentGroup: Story = {
+  args: {
+    title: 'Production Cluster',
+    icon: (
+      <LayoutGrid className="!text-group-accent-8 th-dark:!text-group-accent-2" />
+    ),
+    subtitleLabel: 'Environment Group',
+    description: 'Main production environment group',
+  },
+  render: (args) => (
+    <ResourceDetailHeader
+      {...args}
+      actionBar={
+        <ActionBarShell>
+          <div className="flex items-center gap-2">
+            <ActionBarButton
+              icon={Plus}
+              onClick={() => {}}
+              data-cy="add-environments-button"
+            >
+              Add Environments
+            </ActionBarButton>
+          </div>
+          <div className="flex items-center gap-2">
+            <ActionBarButton
+              icon={Trash2}
+              onClick={() => {}}
+              data-cy="delete-environment-group-button"
+            >
+              Delete
+            </ActionBarButton>
+          </div>
+        </ActionBarShell>
+      }
+    />
+  ),
+};
diff --git a/app/react/components/ResourceDetailHeader/ResourceDetailHeader.test.tsx b/app/react/components/ResourceDetailHeader/ResourceDetailHeader.test.tsx
new file mode 100644
index 0000000..ca7843f
--- /dev/null
+++ b/app/react/components/ResourceDetailHeader/ResourceDetailHeader.test.tsx
@@ -0,0 +1,93 @@
+import { ComponentProps } from 'react';
+import { render, screen } from '@testing-library/react';
+
+import { ResourceDetailHeader } from './ResourceDetailHeader';
+import { HeaderStats } from './HeaderStats';
+import { ResourceStatBlock } from './ResourceStatBlock';
+
+function renderComponent(
+  props: Partial<ComponentProps<typeof ResourceDetailHeader>> = {}
+) {
+  const defaultProps: ComponentProps<typeof ResourceDetailHeader> = {
+    title: 'Test Group',
+    icon: <span data-cy="test-icon">icon</span>,
+    ...props,
+  };
+
+  return render(<ResourceDetailHeader {...defaultProps} />);
+}
+
+describe('ResourceDetailHeader', () => {
+  it('should render title and icon', () => {
+    renderComponent();
+
+    expect(screen.getByText('Test Group')).toBeVisible();
+    expect(screen.getByTestId('test-icon')).toBeVisible();
+  });
+
+  it('should render subtitle when provided', () => {
+    renderComponent({ subtitleLabel: 'Environment Group' });
+
+    expect(screen.getByText('Environment Group')).toBeVisible();
+  });
+
+  it('should render description when provided', () => {
+    renderComponent({ description: 'A test description' });
+
+    expect(screen.getByText('A test description')).toBeVisible();
+  });
+
+  it('should render badge when provided', () => {
+    renderComponent({ badge: <span>Multi-platform</span> });
+
+    expect(screen.getByText('Multi-platform')).toBeVisible();
+  });
+
+  it('should render rightInfo when provided', () => {
+    renderComponent({ rightInfo: <span>5 environments</span> });
+
+    expect(screen.getByText('5 environments')).toBeVisible();
+  });
+
+  it('should render stat blocks supplied via rightInfo', () => {
+    renderComponent({
+      rightInfo: (
+        <HeaderStats>
+          <ResourceStatBlock>
+            <ResourceStatBlock.Label>Sync Status</ResourceStatBlock.Label>
+            <ResourceStatBlock.Value>Synced</ResourceStatBlock.Value>
+          </ResourceStatBlock>
+          <ResourceStatBlock>
+            <ResourceStatBlock.Label>Health</ResourceStatBlock.Label>
+            <ResourceStatBlock.Value>Healthy</ResourceStatBlock.Value>
+          </ResourceStatBlock>
+        </HeaderStats>
+      ),
+    });
+
+    expect(screen.getByText('Sync Status')).toBeVisible();
+    expect(screen.getByText('Synced')).toBeVisible();
+    expect(screen.getByText('Health')).toBeVisible();
+    expect(screen.getByText('Healthy')).toBeVisible();
+  });
+
+  it('should render the action bar segment when provided', () => {
+    renderComponent({
+      actionBar: (
+        <>
+          <span>Add Environment</span>
+          <span>Delete</span>
+        </>
+      ),
+    });
+
+    expect(screen.getByText('Add Environment')).toBeVisible();
+    expect(screen.getByText('Delete')).toBeVisible();
+  });
+
+  it('should not render the action bar segment when omitted', () => {
+    renderComponent();
+
+    expect(screen.queryByText('Add Environment')).not.toBeInTheDocument();
+  });
+});
diff --git a/app/react/components/ResourceDetailHeader/ResourceDetailHeader.tsx b/app/react/components/ResourceDetailHeader/ResourceDetailHeader.tsx
new file mode 100644
index 0000000..6bb5ee7
--- /dev/null
+++ b/app/react/components/ResourceDetailHeader/ResourceDetailHeader.tsx
@@ -0,0 +1,115 @@
+import { ReactNode } from 'react';
+import clsx from 'clsx';
+
+import { Widget } from '@@/Widget';
+import { Alert } from '@@/Alert';
+
+interface Props {
+  icon: ReactNode;
+  iconBackgroundClassName?: string;
+
+  subtitleLabel?: string;
+  subtitleClassName?: string;
+  title: string;
+  badge?: ReactNode;
+  description?: ReactNode;
+
+  rightInfo?: ReactNode;
+  actionBar?: ReactNode;
+
+  isLoading?: boolean;
+  errorMessage?: string;
+}
+
+export function ResourceDetailHeader({
+  icon,
+  iconBackgroundClassName = 'bg-group-accent-3 th-dark:bg-group-accent-10 th-highcontrast:bg-transparent',
+  subtitleLabel,
+  subtitleClassName = 'text-group-accent-10 th-dark:text-group-accent-8 th-highcontrast:text-white',
+  title,
+  badge,
+  description,
+  rightInfo,
+  actionBar,
+  isLoading,
+  errorMessage,
+}: Props) {
+  return (
+    <Widget>
+      <Widget.Body loading={isLoading}>
+        {errorMessage && (
+          <Alert color="error" title="Error">
+            {errorMessage}
+          </Alert>
+        )}
+        {!errorMessage && (
+          <div className="flex items-center gap-4">
+            <HeaderIcon
+              icon={icon}
+              iconBackgroundClassName={iconBackgroundClassName}
+            />
+            <HeaderInfo
+              subtitleLabel={subtitleLabel}
+              subtitleClassName={subtitleClassName}
+              title={title}
+              badge={badge}
+              description={description}
+            />
+            {rightInfo}
+          </div>
+        )}
+      </Widget.Body>
+
+      {!isLoading && !errorMessage && actionBar}
+    </Widget>
+  );
+}
+
+interface HeaderIconProps {
+  icon: ReactNode;
+  iconBackgroundClassName: string;
+}
+
+function HeaderIcon({ icon, iconBackgroundClassName }: HeaderIconProps) {
+  return (
+    <div
+      className={clsx(
+        'flex h-14 w-14 shrink-0 items-center justify-center rounded-lg text-3xl',
+        iconBackgroundClassName
+      )}
+    >
+      {icon}
+    </div>
+  );
+}
+
+interface HeaderInfoProps {
+  subtitleLabel?: string;
+  subtitleClassName: string;
+  title: string;
+  badge?: ReactNode;
+  description?: ReactNode;
+}
+
+function HeaderInfo({
+  subtitleLabel,
+  subtitleClassName,
+  title,
+  badge,
+  description,
+}: HeaderInfoProps) {
+  return (
+    <div className="flex flex-1 flex-col">
+      {subtitleLabel && (
+        <span className={clsx('text-xs font-medium', subtitleClassName)}>
+          {subtitleLabel}
+        </span>
+      )}
+      <div className="flex items-center gap-2">
+        <h2 className="m-0 text-lg font-bold">{title}</h2>
+        {badge && <div className="flex flex-wrap gap-1">{badge}</div>}
+      </div>
+      {description && <span className="text-muted text-xs">{description}</span>}
+    </div>
+  );
+}
diff --git a/app/react/components/ResourceDetailHeader/ResourceDetailHeaderSkeleton.stories.tsx b/app/react/components/ResourceDetailHeader/ResourceDetailHeaderSkeleton.stories.tsx
new file mode 100644
index 0000000..f7ba0e3
--- /dev/null
+++ b/app/react/components/ResourceDetailHeader/ResourceDetailHeaderSkeleton.stories.tsx
@@ -0,0 +1,24 @@
+import { Meta, StoryObj } from '@storybook/react-webpack5';
+
+import { ResourceDetailHeaderSkeleton } from './ResourceDetailHeaderSkeleton';
+
+export default {
+  component: ResourceDetailHeaderSkeleton,
+  title: 'Design System/ResourceDetailHeader/Skeleton',
+} as Meta;
+
+type Story = StoryObj<typeof ResourceDetailHeaderSkeleton>;
+
+export const Default: Story = {};
+
+export const WithStatBlocks: Story = {
+  args: { statBlockCount: 2 },
+};
+
+export const WithActionBar: Story = {
+  args: { hasActionBar: true },
+};
+
+export const Full: Story = {
+  args: { statBlockCount: 2, hasActionBar: true },
+};
diff --git a/app/react/components/ResourceDetailHeader/ResourceDetailHeaderSkeleton.tsx b/app/react/components/ResourceDetailHeader/ResourceDetailHeaderSkeleton.tsx
new file mode 100644
index 0000000..b7ae0ca
--- /dev/null
+++ b/app/react/components/ResourceDetailHeader/ResourceDetailHeaderSkeleton.tsx
@@ -0,0 +1,50 @@
+import { Widget } from '@@/Widget';
+
+import { ActionBarShell } from './ActionBarShell';
+
+interface Props {
+  statBlockCount?: 0 | 1 | 2;
+  hasActionBar?: boolean;
+}
+
+export function ResourceDetailHeaderSkeleton({
+  statBlockCount = 0,
+  hasActionBar = true,
+}: Props) {
+  return (
+    <Widget className="widget-body animate-pulse">
+      <div className="flex items-center gap-4 p-6">
+        <div className="h-14 w-14 shrink-0 rounded-lg bg-gray-3 th-dark:bg-gray-8" />
+
+        <div className="flex flex-1 flex-col gap-2">
+          <div className="h-3 w-24 rounded bg-gray-3 th-dark:bg-gray-8" />
+          <div className="h-5 w-48 rounded bg-gray-3 th-dark:bg-gray-8" />
+          <div className="h-3 w-64 rounded bg-gray-2 th-dark:bg-gray-9" />
+        </div>
+
+        {statBlockCount > 0 && (
+          <div className="flex items-stretch gap-3">
+            {Array.from({ length: statBlockCount }).map((_, i) => (
+              <div
+                key={i}
+                className="flex min-w-[6rem] flex-col gap-2 rounded-md border border-solid border-gray-3 px-3 py-2 th-dark:border-gray-8"
+              >
+                <div className="h-3 w-12 rounded bg-gray-3 th-dark:bg-gray-8" />
+                <div className="h-4 w-8 rounded bg-gray-2 th-dark:bg-gray-9" />
+              </div>
+            ))}
+          </div>
+        )}
+      </div>
+
+      {hasActionBar && (
+        <ActionBarShell>
+          <div className="flex gap-2">
+            <div className="h-8 w-28 rounded bg-gray-3 th-dark:bg-gray-8" />
+            <div className="h-8 w-20 rounded bg-gray-3 th-dark:bg-gray-8" />
+          </div>
+        </ActionBarShell>
+      )}
+    </Widget>
+  );
+}
diff --git a/app/react/components/ResourceDetailHeader/ResourceStatBlock.stories.tsx b/app/react/components/ResourceDetailHeader/ResourceStatBlock.stories.tsx
new file mode 100644
index 0000000..3c84cdc
--- /dev/null
+++ b/app/react/components/ResourceDetailHeader/ResourceStatBlock.stories.tsx
@@ -0,0 +1,137 @@
+import { Meta, StoryObj } from '@storybook/react-webpack5';
+
+import KubernetesLogo from '@/assets/ico/vendor/kubernetes.svg';
+import DockerLogo from '@/assets/ico/vendor/docker.svg';
+import PodmanLogo from '@/assets/ico/vendor/podman.svg';
+
+import { ResourceStatBlock } from './ResourceStatBlock';
+
+const meta: Meta<typeof ResourceStatBlock> = {
+  title: 'Design System/ResourceDetailHeader/ResourceStatBlock',
+  component: ResourceStatBlock,
+  tags: ['autodocs'],
+  decorators: [
+    (Story) => (
+      <div className="w-fit">
+        <Story />
+      </div>
+    ),
+  ],
+};
+
+export default meta;
+type Story = StoryObj<typeof ResourceStatBlock>;
+
+export const Default: Story = {
+  render: () => (
+    <ResourceStatBlock>
+      <ResourceStatBlock.Label>Health</ResourceStatBlock.Label>
+      <ResourceStatBlock.Value>Healthy</ResourceStatBlock.Value>
+    </ResourceStatBlock>
+  ),
+};
+
+export const SuccessWithDot: Story = {
+  render: () => (
+    <ResourceStatBlock status="success">
+      <ResourceStatBlock.Label>Sync Status</ResourceStatBlock.Label>
+      <ResourceStatBlock.Value dot>Synced</ResourceStatBlock.Value>
+      <ResourceStatBlock.Meta>Last reconciled 2 min ago</ResourceStatBlock.Meta>
+    </ResourceStatBlock>
+  ),
+};
+
+export const ValueWithSuffix: Story = {
+  render: () => (
+    <ResourceStatBlock status="success">
+      <ResourceStatBlock.Label>Health</ResourceStatBlock.Label>
+      <ResourceStatBlock.Value suffix="healthy">3/3</ResourceStatBlock.Value>
+    </ResourceStatBlock>
+  ),
+};
+
+export const Danger: Story = {
+  render: () => (
+    <ResourceStatBlock status="danger">
+      <ResourceStatBlock.Label>Sync Status</ResourceStatBlock.Label>
+      <ResourceStatBlock.Value dot>Out of sync</ResourceStatBlock.Value>
+      <ResourceStatBlock.Meta>
+        Drift detected on origin/main
+      </ResourceStatBlock.Meta>
+    </ResourceStatBlock>
+  ),
+};
+
+export const Warning: Story = {
+  render: () => (
+    <ResourceStatBlock status="warning">
+      <ResourceStatBlock.Label>Reconciler</ResourceStatBlock.Label>
+      <ResourceStatBlock.Value dot>Degraded</ResourceStatBlock.Value>
+      <ResourceStatBlock.Meta>Last attempt failed</ResourceStatBlock.Meta>
+    </ResourceStatBlock>
+  ),
+};
+
+export const Pending: Story = {
+  render: () => (
+    <ResourceStatBlock status="pending">
+      <ResourceStatBlock.Label>Sync Status</ResourceStatBlock.Label>
+      <ResourceStatBlock.Value dot>Syncing</ResourceStatBlock.Value>
+      <ResourceStatBlock.Meta>Applying changes…</ResourceStatBlock.Meta>
+    </ResourceStatBlock>
+  ),
+};
+
+/**
+ * When an environment group only contains one engine type, surface that
+ * engine's icon next to the count for instant recognition.
+ */
+export const SingleEnvironmentType: Story = {
+  render: () => (
+    <ResourceStatBlock>
+      <ResourceStatBlock.Label>Environments</ResourceStatBlock.Label>
+      <ResourceStatBlock.Value>
+        <span className="flex items-center gap-2 text-xs font-normal">
+          <img src={KubernetesLogo} alt="" className="h-4 w-4" />
+          <span>
+            <b className="font-bold">3</b> Kubernetes
+          </span>
+        </span>
+      </ResourceStatBlock.Value>
+    </ResourceStatBlock>
+  ),
+};
+
+/**
+ * For mixed-platform groups the breakdown stacks vertically with each
+ * engine's icon aligned to the left margin of the row.
+ */
+export const MixedEnvironmentTypes: Story = {
+  render: () => (
+    <ResourceStatBlock>
+      <ResourceStatBlock.Label>Environments</ResourceStatBlock.Label>
+      <ResourceStatBlock.Value>
+        <span className="flex flex-col gap-1.5 text-xs font-normal">
+          <span className="flex items-center gap-2">
+            <img src={KubernetesLogo} alt="" className="h-4 w-4" />
+            <span>
+              <b className="font-bold">3</b> Kubernetes
+            </span>
+          </span>
+          <span className="flex items-center gap-2">
+            <img src={DockerLogo} alt="" className="h-4 w-4" />
+            <span>
+              <b className="font-bold">1</b> Docker
+            </span>
+          </span>
+          <span className="flex items-center gap-2">
+            <img src={PodmanLogo} alt="" className="h-4 w-4" />
+            <span>
+              <b className="font-bold">1</b> Podman
+            </span>
+          </span>
+        </span>
+      </ResourceStatBlock.Value>
+    </ResourceStatBlock>
+  ),
+};
diff --git a/app/react/components/ResourceDetailHeader/ResourceStatBlock.test.tsx b/app/react/components/ResourceDetailHeader/ResourceStatBlock.test.tsx
new file mode 100644
index 0000000..6c4fc9d
--- /dev/null
+++ b/app/react/components/ResourceDetailHeader/ResourceStatBlock.test.tsx
@@ -0,0 +1,200 @@
+import { ComponentProps, ReactNode } from 'react';
+import { render, screen } from '@testing-library/react';
+
+import {
+  ResourceStatBlock,
+  ResourceStatBlockStatus,
+} from './ResourceStatBlock';
+
+type ValueProps = ComponentProps<typeof ResourceStatBlock.Value>;
+type ValueSize = NonNullable<ValueProps['size']>;
+type ValueAlign = NonNullable<ValueProps['align']>;
+
+interface RenderOptions {
+  status?: ResourceStatBlockStatus;
+  labelIcon?: ReactNode;
+  value?: ReactNode;
+  valueSuffix?: ReactNode;
+  valueDot?: boolean;
+  valueSize?: ValueSize;
+  valueAlign?: ValueAlign;
+  meta?: ReactNode;
+}
+
+function renderComponent({
+  status,
+  labelIcon,
+  value = 'Synced',
+  valueSuffix,
+  valueDot,
+  valueSize,
+  valueAlign,
+  meta,
+}: RenderOptions = {}) {
+  return render(
+    <ResourceStatBlock status={status} data-cy="stat-block">
+      <ResourceStatBlock.Label icon={labelIcon}>
+        Sync Status
+      </ResourceStatBlock.Label>
+      <ResourceStatBlock.Value
+        dot={valueDot}
+        suffix={valueSuffix}
+        size={valueSize}
+        align={valueAlign}
+      >
+        {value}
+      </ResourceStatBlock.Value>
+      {meta && <ResourceStatBlock.Meta>{meta}</ResourceStatBlock.Meta>}
+    </ResourceStatBlock>
+  );
+}
+
+describe('ResourceStatBlock', () => {
+  it('should render the label and value', () => {
+    renderComponent();
+
+    expect(screen.getByText('Sync Status')).toBeVisible();
+    expect(screen.getByText('Synced')).toBeVisible();
+  });
+
+  it('should render the icon when provided to Label', () => {
+    renderComponent({ labelIcon: <span data-cy="stat-icon">i</span> });
+
+    expect(screen.getByTestId('stat-icon')).toBeInTheDocument();
+  });
+
+  it('should render the suffix when provided to Value', () => {
+    renderComponent({ valueSuffix: 'healthy' });
+
+    expect(screen.getByText('healthy')).toBeVisible();
+  });
+
+  it('should omit the suffix when not provided', () => {
+    renderComponent();
+
+    expect(screen.queryByText('healthy')).not.toBeInTheDocument();
+  });
+
+  it('should render the meta line when provided', () => {
+    renderComponent({ meta: 'Last reconciled 2 min ago' });
+
+    expect(screen.getByText('Last reconciled 2 min ago')).toBeVisible();
+  });
+
+  it('should omit the meta line when not provided', () => {
+    renderComponent();
+
+    expect(
+      screen.queryByText('Last reconciled 2 min ago')
+    ).not.toBeInTheDocument();
+  });
+
+  describe('dot', () => {
+    it('should not render a dot by default', () => {
+      renderComponent();
+
+      expect(screen.queryByTestId('stat-block-dot')).not.toBeInTheDocument();
+    });
+
+    it('should render a dot inheriting the container status when dot is true', () => {
+      renderComponent({ valueDot: true, status: 'success' });
+
+      const wrapper = screen.getByTestId('stat-block-dot');
+      expect(wrapper.firstElementChild).toHaveClass('bg-success-7');
+    });
+  });
+
+  describe('status variants', () => {
+    const containerCases: Array<[ResourceStatBlockStatus, string]> = [
+      ['success', 'border-green-4'],
+      ['danger', 'border-error-4'],
+      ['warning', 'border-warning-4'],
+      ['pending', 'border-blue-4'],
+      ['muted', 'border-gray-4'],
+    ];
+
+    it.each(containerCases)(
+      'should apply the %s container styling',
+      (status, expectedClass) => {
+        renderComponent({ status });
+
+        expect(screen.getByTestId('stat-block')).toHaveClass(expectedClass);
+      }
+    );
+
+    const valueCases: Array<[ResourceStatBlockStatus, string]> = [
+      ['success', 'text-green-8'],
+      ['danger', 'text-error-8'],
+      ['warning', 'text-warning-8'],
+      ['pending', 'text-blue-8'],
+      ['muted', 'text-graphite-700'],
+    ];
+
+    it.each(valueCases)(
+      'should apply the %s value text color',
+      (status, expectedClass) => {
+        renderComponent({ status });
+
+        expect(screen.getByText('Synced')).toHaveClass(expectedClass);
+      }
+    );
+
+    it('should default to muted styling when status is omitted', () => {
+      renderComponent();
+
+      expect(screen.getByTestId('stat-block')).toHaveClass('border-gray-4');
+      expect(screen.getByText('Synced')).toHaveClass('text-graphite-700');
+    });
+  });
+
+  describe('Value align', () => {
+    const cases: Array<[ValueAlign, string]> = [
+      ['start', 'justify-start'],
+      ['center', 'justify-center'],
+      ['end', 'justify-end'],
+    ];
+
+    it.each(cases)(
+      'should align the value row to %s',
+      (align, expectedClass) => {
+        renderComponent({ valueAlign: align });
+
+        expect(screen.getByText('Synced').parentElement).toHaveClass(
+          expectedClass
+        );
+      }
+    );
+
+    it('should default to start alignment', () => {
+      renderComponent();
+
+      expect(screen.getByText('Synced').parentElement).toHaveClass(
+        'justify-start'
+      );
+    });
+  });
+
+  describe('Value size', () => {
+    const cases: Array<[ValueSize, string]> = [
+      ['xs', 'text-xs'],
+      ['sm', 'text-sm'],
+      ['base', 'text-base'],
+      ['lg', 'text-lg'],
+    ];
+
+    it.each(cases)(
+      'should size the value text as %s',
+      (size, expectedClass) => {
+        renderComponent({ valueSize: size });
+
+        expect(screen.getByText('Synced')).toHaveClass(expectedClass);
+      }
+    );
+
+    it('should default to xs sizing', () => {
+      renderComponent();
+
+      expect(screen.getByText('Synced')).toHaveClass('text-xs');
+    });
+  });
+});
diff --git a/app/react/components/ResourceDetailHeader/ResourceStatBlock.tsx b/app/react/components/ResourceDetailHeader/ResourceStatBlock.tsx
new file mode 100644
index 0000000..7d1fe14
--- /dev/null
+++ b/app/react/components/ResourceDetailHeader/ResourceStatBlock.tsx
@@ -0,0 +1,151 @@
+import { ReactNode, createContext, useContext } from 'react';
+import clsx from 'clsx';
+import { cva, type VariantProps } from 'class-variance-authority';
+
+import { StatusDot, type StatusDotColor } from '@@/primitives/StatusDot';
+
+const containerVariants = cva(
+  'flex min-w-[6rem] flex-col gap-1 rounded-md border border-solid px-3 py-2',
+  {
+    variants: {
+      status: {
+        success:
+          'border-green-4 bg-green-2 th-dark:border-green-8 th-dark:bg-green-10 th-highcontrast:border-white th-highcontrast:bg-green-10',
+        danger:
+          'border-error-4 bg-error-2 th-dark:border-error-8 th-dark:bg-error-10 th-highcontrast:border-white th-highcontrast:bg-error-10',
+        warning:
+          'border-warning-4 bg-warning-2 th-dark:border-warning-8 th-dark:bg-warning-10 th-highcontrast:border-white th-highcontrast:bg-warning-10',
+        pending:
+          'border-blue-4 bg-blue-2 th-dark:border-blue-8 th-dark:bg-blue-10 th-highcontrast:border-white th-highcontrast:bg-blue-10',
+        muted:
+          'border-gray-4 bg-gray-2 th-dark:border-gray-8 th-dark:bg-gray-iron-10 th-highcontrast:border-gray-11 th-highcontrast:bg-transparent',
+      },
+    },
+    defaultVariants: { status: 'muted' },
+  }
+);
+
+const valueVariants = cva('font-semibold leading-tight', {
+  variants: {
+    status: {
+      success: 'text-green-8 th-dark:text-white th-highcontrast:text-white',
+      danger: 'text-error-8 th-dark:text-white th-highcontrast:text-white',
+      warning: 'text-warning-8 th-dark:text-white th-highcontrast:text-white',
+      pending: 'text-blue-8 th-dark:text-white th-highcontrast:text-white',
+      muted: 'text-graphite-700 th-dark:text-white th-highcontrast:text-white',
+    },
+    size: {
+      xs: 'text-xs',
+      sm: 'text-sm',
+      base: 'text-base',
+      lg: 'text-lg',
+    },
+  },
+  defaultVariants: { status: 'muted', size: 'xs' },
+});
+
+const statusToColor: Record<ResourceStatBlockStatus, StatusDotColor> = {
+  success: 'success',
+  danger: 'danger',
+  warning: 'warn',
+  pending: 'info',
+  muted: 'muted',
+};
+
+export type ResourceStatBlockStatus = NonNullable<
+  VariantProps<typeof containerVariants>['status']
+>;
+
+const StatusContext = createContext<ResourceStatBlockStatus>('muted');
+
+interface RootProps {
+  status?: ResourceStatBlockStatus;
+  children: ReactNode;
+  'data-cy'?: string;
+}
+
+export function ResourceStatBlock({
+  status = 'muted',
+  children,
+  'data-cy': dataCy,
+}: RootProps) {
+  return (
+    <StatusContext.Provider value={status}>
+      <div className={containerVariants({ status })} data-cy={dataCy}>
+        {children}
+      </div>
+    </StatusContext.Provider>
+  );
+}
+
+interface LabelProps {
+  icon?: ReactNode;
+  children: ReactNode;
+}
+
+function StatBlockLabel({ icon, children }: LabelProps) {
+  return (
+    <div className="flex items-center gap-1.5 text-xs font-normal uppercase tracking-wide text-gray-6 th-highcontrast:text-white th-dark:text-gray-6">
+      {icon && <span aria-hidden="true">{icon}</span>}
+      <span>{children}</span>
+    </div>
+  );
+}
+
+const valueAlignClasses = {
+  start: 'justify-start',
+  center: 'justify-center',
+  end: 'justify-end',
+} as const;
+
+interface ValueProps {
+  dot?: boolean;
+  suffix?: ReactNode;
+  size?: NonNullable<VariantProps<typeof valueVariants>['size']>;
+  align?: keyof typeof valueAlignClasses;
+  children: ReactNode;
+}
+
+function StatBlockValue({
+  dot,
+  suffix,
+  size = 'xs',
+  align = 'start',
+  children,
+}: ValueProps) {
+  const status = useContext(StatusContext);
+
+  return (
+    <div
+      className={clsx('flex items-baseline gap-2', valueAlignClasses[align])}
+    >
+      {dot && (
+        <span data-cy="stat-block-dot">
+          <StatusDot color={statusToColor[status]} size="sm" />
+        </span>
+      )}
+      <span className={valueVariants({ status, size })}>{children}</span>
+      {suffix && (
+        <span className="text-sm font-normal text-gray-9 th-highcontrast:text-white th-dark:text-gray-5">
+          {suffix}
+        </span>
+      )}
+    </div>
+  );
+}
+
+interface MetaProps {
+  children: ReactNode;
+}
+
+function StatBlockMeta({ children }: MetaProps) {
+  return (
+    <span className="text-xs text-gray-7 th-highcontrast:text-white th-dark:text-gray-5">
+      {children}
+    </span>
+  );
+}
+
+ResourceStatBlock.Label = StatBlockLabel;
+ResourceStatBlock.Value = StatBlockValue;
+ResourceStatBlock.Meta = StatBlockMeta;
diff --git a/app/react/components/Sheet.tsx b/app/react/components/Sheet.tsx
new file mode 100644
index 0000000..aee4815
--- /dev/null
+++ b/app/react/components/Sheet.tsx
@@ -0,0 +1,160 @@
+import {
+  ComponentPropsWithoutRef,
+  forwardRef,
+  ElementRef,
+  PropsWithChildren,
+} from 'react';
+import * as SheetPrimitive from '@radix-ui/react-dialog';
+import { cva, type VariantProps } from 'class-variance-authority';
+import clsx from 'clsx';
+import { RefreshCw, X } from 'lucide-react';
+
+import { Button } from './buttons';
+
+// modified from shadcn sheet component
+const Sheet = SheetPrimitive.Root;
+
+const SheetTrigger = SheetPrimitive.Trigger;
+
+const SheetClose = SheetPrimitive.Close;
+
+const SheetPortal = SheetPrimitive.Portal;
+
+const SheetDescription = SheetPrimitive.Description;
+
+type SheetTitleProps = {
+  title: string;
+  onReload?(): Promise<void> | void;
+};
+
+// similar to the PageHeader component with simplified props and no breadcrumbs
+function SheetHeader({
+  onReload,
+  title,
+  children,
+}: PropsWithChildren<SheetTitleProps>) {
+  return (
+    <div className="row">
+      <div className="col-sm-12 flex justify-between gap-2 pt-3">
+        <div className="flex items-center gap-2">
+          <SheetPrimitive.DialogTitle className="m-0 text-2xl font-medium text-gray-11 th-highcontrast:text-white th-dark:text-white">
+            {title}
+          </SheetPrimitive.DialogTitle>
+          {onReload ? (
+            <Button
+              color="none"
+              size="large"
+              onClick={onReload}
+              className="m-0 p-0 focus:text-inherit"
+              title="Refresh drawer content"
+              data-cy="sheet-refreshButton"
+            >
+              <RefreshCw className="icon" />
+            </Button>
+          ) : null}
+        </div>
+        {children}
+      </div>
+    </div>
+  );
+}
+
+const SheetOverlay = forwardRef<
+  ElementRef<typeof SheetPrimitive.Overlay>,
+  ComponentPropsWithoutRef<typeof SheetPrimitive.Overlay>
+>(({ className, ...props }, ref) => (
+  <SheetPrimitive.Overlay
+    className={clsx(
+      'fixed inset-0 z-50 bg-black/80 data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0',
+      className
+    )}
+    // eslint-disable-next-line react/jsx-props-no-spreading
+    {...props}
+    ref={ref}
+  />
+));
+SheetOverlay.displayName = SheetPrimitive.Overlay.displayName;
+
+const sheetVariants = cva(
+  'fixed z-50 bg-widget-color p-5 shadow-lg transition ease-in-out data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:duration-300 data-[state=open]:duration-500',
+  {
+    variants: {
+      side: {
+        top: 'inset-x-0 top-0 border-b data-[state=closed]:slide-out-to-top data-[state=open]:slide-in-from-top',
+        bottom:
+          'inset-x-0 bottom-0 border-t data-[state=closed]:slide-out-to-bottom data-[state=open]:slide-in-from-bottom',
+        left: 'inset-y-0 left-0 h-full w-[70vw] lg:w-[50vw] border-r data-[state=closed]:slide-out-to-left data-[state=open]:slide-in-from-left max-w-2xl',
+        right:
+          'inset-y-0 right-0 h-full w-[70vw] lg:w-[50vw] border-l data-[state=closed]:slide-out-to-right data-[state=open]:slide-in-from-right max-w-2xl',
+      },
+    },
+    defaultVariants: {
+      side: 'right',
+    },
+  }
+);
+
+interface SheetContentProps
+  extends
+    ComponentPropsWithoutRef<typeof SheetPrimitive.Content>,
+    VariantProps<typeof sheetVariants> {
+  showCloseButton?: boolean;
+}
+
+const SheetContent = forwardRef<
+  ElementRef<typeof SheetPrimitive.Content>,
+  SheetContentProps
+>(
+  (
+    {
+      side = 'right',
+      className,
+      children,
+      title,
+      showCloseButton = true,
+      ...props
+    },
+    ref
+  ) => (
+    <SheetPortal>
+      <SheetOverlay />
+      <SheetPrimitive.Content
+        ref={ref}
+        className={clsx(sheetVariants({ side }), className)}
+        // eslint-disable-next-line react/jsx-props-no-spreading
+        {...props}
+      >
+        {title ? <SheetHeader title={title} /> : null}
+        {children}
+        {showCloseButton && (
+          <SheetPrimitive.Close
+            asChild
+            className="close-button absolute right-9 top-8 disabled:pointer-events-none"
+          >
+            <Button
+              icon={X}
+              color="none"
+              className="btn-only-icon"
+              size="medium"
+              data-cy="sheet-closeButton"
+            >
+              <span className="sr-only">Close</span>
+            </Button>
+          </SheetPrimitive.Close>
+        )}
+      </SheetPrimitive.Content>
+    </SheetPortal>
+  )
+);
+SheetContent.displayName = SheetPrimitive.Content.displayName;
+
+export {
+  Sheet,
+  SheetPortal,
+  SheetOverlay,
+  SheetTrigger,
+  SheetClose,
+  SheetContent,
+  SheetDescription,
+  SheetHeader,
+};
diff --git a/app/react/components/SnapshotBadge.tsx b/app/react/components/SnapshotBadge.tsx
new file mode 100644
index 0000000..f6b6051
--- /dev/null
+++ b/app/react/components/SnapshotBadge.tsx
@@ -0,0 +1,22 @@
+import clsx from 'clsx';
+
+export function SnapshotBadge() {
+  return (
+    <span
+      className={clsx(
+        'flex items-center gap-2 rounded-xl',
+        'w-fit px-2 py-px',
+        'text-xs font-bold',
+        'bg-warning-7/20 text-warning-7'
+      )}
+      aria-label="status-badge"
+    >
+      <span
+        aria-hidden="true"
+        aria-label="edge-heartbeat"
+        className={clsx('block h-2 w-2 rounded-full', 'bg-warning-7')}
+      />
+      <span>Snapshot available</span>
+    </span>
+  );
+}
diff --git a/app/react/components/SortableList/SortByGroup.test.tsx b/app/react/components/SortableList/SortByGroup.test.tsx
new file mode 100644
index 0000000..7b22f2b
--- /dev/null
+++ b/app/react/components/SortableList/SortByGroup.test.tsx
@@ -0,0 +1,131 @@
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+
+import { SortByGroup, SortOption } from './SortByGroup';
+
+vi.mock('@reach/menu-button');
+
+const sortOptions: SortOption[] = [
+  { key: 'Group', label: 'Group', grouped: true },
+  { key: 'Platform', label: 'Platform', grouped: true },
+  { key: 'Name', label: 'Name' },
+];
+
+const groupOptions = {
+  Group: [
+    { key: 'GroupA', label: 'GroupA' },
+    { key: 'GroupB', label: 'GroupB' },
+  ],
+  Platform: [
+    { key: 'Docker', label: 'Docker' },
+    { key: 'Kubernetes', label: 'Kubernetes' },
+  ],
+};
+
+function renderComponent({
+  group = 'Group' as string,
+  groupValue = null as string | null,
+  onChange = vi.fn(),
+} = {}) {
+  const Wrapped = withTestQueryProvider(
+    withTestRouter(() => (
+      <SortByGroup
+        value={{ group, groupValue }}
+        onChange={onChange}
+        sortOptions={sortOptions}
+        groupOptions={groupOptions}
+        sortDesc={false}
+        dataCy="test"
+      />
+    ))
+  );
+  return { ...render(<Wrapped />), onChange };
+}
+
+describe('SortByGroup', () => {
+  describe('grouped: false option', () => {
+    test('clicking an inactive button calls onChange with { group, groupValue: null }', async () => {
+      const user = userEvent.setup();
+      const { onChange } = renderComponent({ group: 'Group' });
+
+      await user.click(screen.getByRole('button', { name: /^Name$/i }));
+
+      expect(onChange).toHaveBeenCalledExactlyOnceWith({
+        group: 'Name',
+        groupValue: null,
+      });
+    });
+
+    test('clicking the already-active button does calls onChange', async () => {
+      const user = userEvent.setup();
+      const { onChange } = renderComponent({ group: 'Name' });
+
+      await user.click(screen.getByRole('button', { name: /^Name Asc/i }));
+
+      expect(onChange).toHaveBeenCalledExactlyOnceWith({
+        group: 'Name',
+        groupValue: null,
+      });
+    });
+  });
+
+  describe('grouped: true option', () => {
+    test('clicking the dropdown button to open it does not call onChange', async () => {
+      const user = userEvent.setup();
+      const { onChange } = renderComponent({ group: 'Group' });
+
+      await user.click(screen.getByRole('button', { name: /^Platform$/i }));
+
+      expect(onChange).not.toHaveBeenCalled();
+      expect(screen.getByRole('menu')).toBeVisible();
+    });
+
+    test('selecting a filter from an inactive grouped option calls onChange with both keys', async () => {
+      const user = userEvent.setup();
+      const { onChange } = renderComponent({ group: 'Group' });
+
+      await user.click(screen.getByRole('button', { name: /^Platform$/i }));
+      await user.click(screen.getByRole('menuitem', { name: /Docker/ }));
+
+      expect(onChange).toHaveBeenCalledExactlyOnceWith({
+        group: 'Platform',
+        groupValue: 'Docker',
+      });
+    });
+
+    test('selecting a filter from the already-active grouped option calls onChange', async () => {
+      const user = userEvent.setup();
+      const { onChange } = renderComponent({
+        group: 'Group',
+        groupValue: null,
+      });
+
+      await user.click(screen.getByRole('button', { name: /^Group$/i }));
+      await user.click(screen.getByRole('menuitem', { name: /GroupA/ }));
+
+      expect(onChange).toHaveBeenCalledExactlyOnceWith({
+        group: 'Group',
+        groupValue: 'GroupA',
+      });
+    });
+
+    test('selecting All from a grouped dropdown calls onChange with (key, null)', async () => {
+      const user = userEvent.setup();
+      const { onChange } = renderComponent({
+        group: 'Group',
+        groupValue: 'GroupA',
+      });
+
+      await user.click(screen.getByRole('button', { name: /^Group/i }));
+      await user.click(screen.getByRole('menuitem', { name: /^All$/ }));
+
+      expect(onChange).toHaveBeenCalledWith({
+        group: 'Group',
+        groupValue: null,
+      });
+    });
+  });
+});
diff --git a/app/react/components/SortableList/SortByGroup.tsx b/app/react/components/SortableList/SortByGroup.tsx
new file mode 100644
index 0000000..8b952d8
--- /dev/null
+++ b/app/react/components/SortableList/SortByGroup.tsx
@@ -0,0 +1,176 @@
+import clsx from 'clsx';
+
+import { DropdownMenu, DropdownOption } from '../DropdownMenu/DropdownMenu';
+
+export interface SortOption<TSortKey extends string = string> {
+  key: TSortKey;
+  label: string;
+  grouped?: boolean;
+  descendingLabel?: string;
+  ascendingLabel?: string;
+}
+
+type Value<TSortKey> = {
+  group: TSortKey;
+  groupValue: string | null;
+};
+
+export interface SortByGroupProps<TSortKey extends string> {
+  value: Value<TSortKey>;
+  sortDesc: boolean;
+  onChange: (value: Value<TSortKey>) => void;
+  sortOptions: SortOption<TSortKey>[];
+  groupOptions?: Record<string, DropdownOption[]>;
+  dataCy?: string;
+}
+
+export function SortByGroup<TSortKey extends string>({
+  value,
+  sortDesc,
+  onChange,
+  sortOptions,
+  groupOptions,
+  dataCy,
+}: SortByGroupProps<TSortKey>) {
+  return (
+    <div className="flex items-center gap-3">
+      <span
+        className="text-xs font-semibold tracking-wider text-gray-11 th-highcontrast:text-white th-dark:text-white"
+        data-cy="sort-by-label"
+      >
+        SORT BY:
+      </span>
+      <div
+        className={clsx(
+          'flex',
+          'bg-gray-4 th-highcontrast:bg-black th-dark:bg-gray-iron-11',
+          'gap-1 rounded-md p-1 th-highcontrast:border th-highcontrast:border-solid th-highcontrast:border-white'
+        )}
+        role="group"
+        aria-label="Sort by"
+      >
+        {sortOptions.map((option, index) => (
+          <SortOptionItem
+            key={option.key}
+            option={option}
+            isActive={value.group === option.key}
+            sortDesc={sortDesc}
+            isFirst={index === 0}
+            isLast={index === sortOptions.length - 1}
+            value={value}
+            onChange={(value) => onChange(value)}
+            groupOptions={groupOptions}
+            dataCy={dataCy}
+          />
+        ))}
+      </div>
+    </div>
+  );
+}
+
+const baseBtn = clsx(
+  'px-4 py-1.5 align-middle text-xs font-medium transition-colors'
+);
+const activeBtn = clsx(
+  'z-10 rounded-md border-none font-medium',
+  'bg-white text-gray-8',
+  'th-dark:bg-gray-iron-10 th-dark:text-white',
+  'th-highcontrast:border th-highcontrast:border-solid th-highcontrast:bg-transparent th-highcontrast:text-white'
+);
+const inactiveBtn = clsx(
+  'text-muted rounded-md border-none',
+  'bg-gray-4 hover:bg-gray-2',
+  'th-dark:bg-gray-iron-11 th-dark:text-white th-dark:hover:bg-gray-iron-9',
+  'th-highcontrast:bg-black th-highcontrast:text-white th-highcontrast:hover:bg-white th-highcontrast:hover:text-black'
+);
+
+interface SortOptionItemProps<TSortKey extends string> {
+  option: SortOption<TSortKey>;
+  isActive: boolean;
+  sortDesc: boolean;
+  isFirst: boolean;
+  isLast: boolean;
+  value: Value<TSortKey>;
+  onChange: (value: Value<TSortKey>) => void;
+  groupOptions?: Record<string, DropdownOption[]>;
+  dataCy?: string;
+}
+
+function SortOptionItem<TSortKey extends string>({
+  option,
+  isActive,
+  sortDesc,
+  isFirst,
+  isLast,
+  value,
+  onChange,
+  groupOptions,
+  dataCy,
+}: SortOptionItemProps<TSortKey>) {
+  const className = clsx(
+    baseBtn,
+    isActive ? activeBtn : inactiveBtn,
+    isFirst && 'rounded-l-md',
+    isLast && 'rounded-r-md'
+  );
+
+  if (option.grouped) {
+    return (
+      <DropdownMenu
+        label={option.label}
+        options={groupOptions?.[option.key]}
+        selected={isActive ? (value.groupValue ?? null) : null}
+        onSelect={(selected) => {
+          onChange({ group: option.key, groupValue: selected });
+        }}
+        badge={
+          isActive
+            ? getFilterBadge(groupOptions, option.key, value.groupValue ?? null)
+            : undefined
+        }
+        className={className}
+        aria-pressed={isActive}
+        data-cy={`${dataCy}-sort-by-${option.key.toLowerCase()}-button`}
+      />
+    );
+  }
+
+  const badge = isActive
+    ? sortDesc
+      ? option.descendingLabel || 'Desc'
+      : option.ascendingLabel || 'Asc'
+    : null;
+
+  return (
+    <button
+      type="button"
+      className={className}
+      aria-pressed={isActive}
+      onClick={() => {
+        onChange({ group: option.key, groupValue: null });
+      }}
+      data-cy={`${dataCy}-sort-by-${option.key.toLowerCase()}-button`}
+    >
+      {option.label}
+      {badge && (
+        <span className="py-0.2 ml-1 rounded-md bg-blue-7 px-1 text-[10px] font-normal text-white">
+          {badge}
+        </span>
+      )}
+    </button>
+  );
+}
+
+function getFilterBadge(
+  groupOptions: Record<string, DropdownOption[]> | undefined,
+  groupKey: string,
+  filter: string | null
+): string | null {
+  if (!filter) {
+    return null;
+  }
+
+  const option = groupOptions?.[groupKey]?.find((o) => o.key === filter);
+  if (!option) return null;
+  return option.label ?? option.key;
+}
diff --git a/app/react/components/SortableList/SortableList.stories.tsx b/app/react/components/SortableList/SortableList.stories.tsx
new file mode 100644
index 0000000..d8d3b62
--- /dev/null
+++ b/app/react/components/SortableList/SortableList.stories.tsx
@@ -0,0 +1,434 @@
+import { useQuery } from '@tanstack/react-query';
+import { Meta } from '@storybook/react-webpack5';
+
+import { DropdownOption } from '../DropdownMenu/DropdownMenu';
+
+import { SortableList, SortableGroup, SortableListState } from './SortableList';
+import {
+  useGroupOptions,
+  useGroups,
+  computePagedGroups,
+} from './sortable-list.story-utils';
+import { SortableListItem } from './SortableListItem';
+import { useSortableListState } from './sortable-list.store';
+
+export default {
+  component: SortableList,
+  title: 'Design System/SortableList',
+} as Meta;
+
+export function ClientSidePagination() {
+  const data = getData();
+  const storageKey = 'fruits-veggies';
+  const tableState = useSortableListState(storageKey, 'color');
+
+  const colorOptions = useGroupOptions(
+    'color',
+    data,
+    getProduceGroupKeys,
+    getProduceGroupKey,
+    getProduceGroupLabel
+  );
+  const categoryOptions = useGroupOptions(
+    'category',
+    data,
+    getProduceGroupKeys,
+    getProduceGroupKey,
+    getProduceGroupLabel
+  );
+
+  const { groups, totalCount } = useGroups(
+    tableState,
+    data,
+    'color',
+    getProduceGroupKeys,
+    getProduceGroupKey,
+    getProduceGroupLabel,
+    (i) => `${i.name} ${i.color} ${i.category} ${i.description}`,
+    getProduceGroupIcon
+  );
+
+  return (
+    <ProduceList
+      groupOptions={{ color: colorOptions, category: categoryOptions }}
+      groups={groups}
+      tableState={tableState}
+      totalCount={totalCount}
+    />
+  );
+}
+
+export function ServerSidePagination() {
+  const allData = getData();
+  const storageKey = 'fruits-veggies-latency-demo';
+  const tableState = useSortableListState(storageKey, 'color');
+  const sortBy = tableState.groupBy ?? tableState.sortBy?.id ?? 'color';
+
+  const colorOptions = useGroupOptions(
+    'color',
+    allData,
+    getProduceGroupKeys,
+    getProduceGroupKey,
+    getProduceGroupLabel
+  );
+  const categoryOptions = useGroupOptions(
+    'category',
+    allData,
+    getProduceGroupKeys,
+    getProduceGroupKey,
+    getProduceGroupLabel
+  );
+
+  const { data, isPreviousData } = useQuery(
+    [
+      storageKey,
+      sortBy,
+      tableState.page,
+      tableState.pageSize,
+      tableState.groupFilter,
+      tableState.search,
+    ],
+    async () => {
+      await new Promise((resolve) => {
+        setTimeout(resolve, 800);
+      });
+      return computePagedGroups({
+        items: allData,
+        sortBy,
+        page: tableState.page,
+        pageSize: tableState.pageSize,
+        groupFilter: tableState.groupFilter,
+        search: tableState.search,
+        getGroupKeys: getProduceGroupKeys,
+        getGroupKey: getProduceGroupKey,
+        getGroupLabel: getProduceGroupLabel,
+        getSearchText: (i) =>
+          `${i.name} ${i.color} ${i.category} ${i.description}`,
+        getGroupIcon: getProduceGroupIcon,
+      });
+    },
+    { keepPreviousData: true, staleTime: 0 }
+  );
+
+  return (
+    <ProduceList
+      groupOptions={{ color: colorOptions, category: categoryOptions }}
+      groups={data?.groups ?? []}
+      tableState={tableState}
+      totalCount={data?.totalCount ?? 0}
+      isLoading={isPreviousData || !data}
+    />
+  );
+}
+
+interface Produce {
+  id: string;
+  name: string;
+  color: string;
+  category: Category;
+  description: string;
+}
+
+function getData(): Produce[] {
+  return [
+    {
+      id: '1',
+      name: 'Apple',
+      color: 'Red',
+      category: 'fruit',
+      description: 'Crisp, sweet or tart; great for snacking and pies.',
+    },
+    {
+      id: '2',
+      name: 'Banana',
+      color: 'Yellow',
+      category: 'fruit',
+      description: 'Soft, creamy, and high in potassium.',
+    },
+    {
+      id: '3',
+      name: 'Beet',
+      color: 'Purple',
+      category: 'veggie',
+      description: 'Earthy root vegetable; excellent roasted or in salads.',
+    },
+    {
+      id: '4',
+      name: 'Blueberry',
+      color: 'Blue',
+      category: 'fruit',
+      description: 'Small, antioxidant-rich berries for baking and smoothies.',
+    },
+    {
+      id: '5',
+      name: 'Broccoli',
+      color: 'Green',
+      category: 'veggie',
+      description: 'Nutritious green florets; steam or roast.',
+    },
+    {
+      id: '6',
+      name: 'Carrot',
+      color: 'Orange',
+      category: 'veggie',
+      description: 'Crunchy, sweet root; raw or cooked.',
+    },
+    {
+      id: '7',
+      name: 'Cherry',
+      color: 'Red',
+      category: 'fruit',
+      description: 'Sweet or sour stone fruit; summer favorite.',
+    },
+    {
+      id: '8',
+      name: 'Cucumber',
+      color: 'Green',
+      category: 'veggie',
+      description: 'Cool, crisp, and hydrating; perfect in salads.',
+    },
+    {
+      id: '9',
+      name: 'Grape',
+      color: 'Purple',
+      category: 'fruit',
+      description: 'Juicy clusters; eaten fresh or turned into wine.',
+    },
+    {
+      id: '10',
+      name: 'Kale',
+      color: 'Green',
+      category: 'veggie',
+      description: 'Leafy green superfood; hearty in salads and soups.',
+    },
+    {
+      id: '11',
+      name: 'Lemon',
+      color: 'Yellow',
+      category: 'fruit',
+      description: 'Tangy citrus; juice, zest, or slice for drinks.',
+    },
+    {
+      id: '12',
+      name: 'Lettuce',
+      color: 'Green',
+      category: 'veggie',
+      description: 'Mild leafy base for salads and wraps.',
+    },
+    {
+      id: '13',
+      name: 'Onion',
+      color: 'Yellow',
+      category: 'veggie',
+      description: 'Pungent allium; foundational in savory cooking.',
+    },
+    {
+      id: '14',
+      name: 'Orange',
+      color: 'Orange',
+      category: 'fruit',
+      description: 'Sweet citrus; juice or eat segments.',
+    },
+    {
+      id: '15',
+      name: 'Pear',
+      color: 'Green',
+      category: 'fruit',
+      description: 'Sweet, grainy texture; good fresh or poached.',
+    },
+    {
+      id: '16',
+      name: 'Pepper',
+      color: 'Red',
+      category: 'veggie',
+      description: 'Sweet or hot; bell or chili varieties.',
+    },
+    {
+      id: '17',
+      name: 'Plum',
+      color: 'Purple',
+      category: 'fruit',
+      description: 'Stone fruit; sweet when ripe, great for jam.',
+    },
+    {
+      id: '18',
+      name: 'Radish',
+      color: 'Red',
+      category: 'veggie',
+      description: 'Peppery crunch; slice into salads or eat whole.',
+    },
+    {
+      id: '19',
+      name: 'Raspberry',
+      color: 'Red',
+      category: 'fruit',
+      description: 'Delicate, tart berries; fresh or in desserts.',
+    },
+    {
+      id: '20',
+      name: 'Spinach',
+      color: 'Green',
+      category: 'veggie',
+      description: 'Tender leaves; salads, smoothies, or cooked.',
+    },
+    {
+      id: '21',
+      name: 'Strawberry',
+      color: 'Red',
+      category: 'fruit',
+      description: 'Classic red berry; summer staple.',
+    },
+    {
+      id: '22',
+      name: 'Sweet potato',
+      color: 'Orange',
+      category: 'veggie',
+      description: 'Naturally sweet tuber; bake, mash, or fry.',
+    },
+    {
+      id: '23',
+      name: 'Tomato',
+      color: 'Red',
+      category: 'veggie',
+      description: 'Juicy and versatile; salads, sauce, or cooked.',
+    },
+    {
+      id: '24',
+      name: 'Watermelon',
+      color: 'Green',
+      category: 'fruit',
+      description: 'Refreshing, watery summer melon.',
+    },
+    {
+      id: '25',
+      name: 'Zucchini',
+      color: 'Green',
+      category: 'veggie',
+      description: 'Mild summer squash; grill, spiralize, or bake.',
+    },
+  ];
+}
+
+const COLOR_ORDER = [
+  'Red',
+  'Orange',
+  'Yellow',
+  'Green',
+  'Blue',
+  'Purple',
+] as const;
+const CATEGORY_ORDER: Category[] = ['fruit', 'veggie'] as const;
+
+const COLOR_DOT_CLASSES: Record<string, string> = {
+  Red: 'bg-error-7',
+  Orange: 'bg-warning-7',
+  Yellow: 'bg-yellow-7',
+  Green: 'bg-success-7',
+  Blue: 'bg-blue-7',
+  Purple: 'bg-purple-7',
+};
+
+type Category = 'fruit' | 'veggie';
+
+const PRODUCE_SORT_OPTIONS = [
+  { key: 'name', label: 'Name' },
+  { key: 'color', label: 'Color', grouped: true },
+  { key: 'category', label: 'Category', grouped: true },
+] as const;
+
+const GRID_COLS =
+  '44px minmax(80px, 1fr) minmax(60px, 0.6fr) minmax(120px, 2fr)';
+
+function ProduceList({
+  tableState,
+  groupOptions,
+  groups,
+  totalCount,
+  isLoading,
+}: {
+  tableState: SortableListState;
+  groupOptions?: Record<string, DropdownOption[]>;
+  groups: Array<SortableGroup<Produce>>;
+  totalCount: number;
+  isLoading?: boolean;
+}) {
+  return (
+    <SortableList
+      tableState={tableState}
+      sortOptions={[...PRODUCE_SORT_OPTIONS]}
+      groupOptions={groupOptions}
+      groups={groups}
+      totalCount={totalCount}
+      isLoading={isLoading}
+      getItemKey={(item) => item.id}
+      showGroupHeaders
+      emptyMessage="No items found"
+      searchPlaceholder="Filter fruits & veggies..."
+      renderColumnHeaders={() => (
+        <div
+          className="grid items-center border-b border-solid border-gray-3 px-5 py-2 text-xs uppercase tracking-wide text-gray-6 th-dark:border-gray-8"
+          style={{ gridTemplateColumns: GRID_COLS, gap: 12 }}
+        >
+          <span className="text-center">Color</span>
+          <span>Name</span>
+          <span>Category</span>
+          <span>Description</span>
+        </div>
+      )}
+      data-cy="produce"
+      renderItem={(item) => (
+        <SortableListItem>
+          <div
+            className="grid items-center"
+            style={{ gridTemplateColumns: GRID_COLS, gap: 12 }}
+          >
+            <div className="flex items-center justify-center">
+              <span
+                className={`inline-block h-3 w-3 rounded-full ${
+                  COLOR_DOT_CLASSES[item.color] ?? 'bg-gray-5'
+                }`}
+                title={item.color}
+              />
+            </div>
+            <span className="text-sm font-semibold text-gray-9 th-dark:text-white">
+              {item.name}
+            </span>
+            <span className="text-sm text-gray-7 th-dark:text-gray-4">
+              {item.category}
+            </span>
+            <span className="text-xs leading-relaxed text-gray-6">
+              {item.description}
+            </span>
+          </div>
+        </SortableListItem>
+      )}
+    />
+  );
+}
+
+function getProduceGroupLabel(sortBy: string, key: string): string {
+  if (sortBy === 'category') {
+    return key === 'fruit' ? 'Fruit' : 'Veggies';
+  }
+  return key;
+}
+
+function getProduceGroupKey(item: Produce, sortBy: string): string {
+  return sortBy === 'color' ? item.color : item.category;
+}
+
+function getProduceGroupKeys(sortBy: string): string[] {
+  if (sortBy === 'color') return [...COLOR_ORDER];
+  if (sortBy === 'category') return [...CATEGORY_ORDER];
+  return [];
+}
+
+function getProduceGroupIcon(key: string): JSX.Element {
+  return (
+    <span
+      className={`inline-block h-2.5 w-2.5 rounded-full ${
+        COLOR_DOT_CLASSES[key] ?? 'bg-gray-5'
+      }`}
+    />
+  );
+}
diff --git a/app/react/components/SortableList/SortableList.test.tsx b/app/react/components/SortableList/SortableList.test.tsx
new file mode 100644
index 0000000..67691a1
--- /dev/null
+++ b/app/react/components/SortableList/SortableList.test.tsx
@@ -0,0 +1,328 @@
+import { type ReactNode } from 'react';
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { describe, it, expect, vi } from 'vitest';
+
+import { SortableList, SortableListState, SortableGroup } from './SortableList';
+
+interface Item {
+  id: number;
+  name: string;
+  status: string;
+}
+
+const ITEMS: Item[] = [
+  { id: 1, name: 'Alpha', status: 'healthy' },
+  { id: 2, name: 'Beta', status: 'error' },
+  { id: 3, name: 'Gamma', status: 'healthy' },
+  { id: 4, name: 'Delta', status: 'syncing' },
+  { id: 5, name: 'Epsilon', status: 'healthy' },
+  { id: 6, name: 'Zeta', status: 'error' },
+  { id: 7, name: 'Eta', status: 'healthy' },
+  { id: 8, name: 'Theta', status: 'syncing' },
+];
+
+const SORT_OPTIONS = [
+  { key: 'name', label: 'Name' },
+  { key: 'status', label: 'Status' },
+];
+
+describe('SortableList', () => {
+  it('renders items in groups', () => {
+    renderList();
+
+    expect(screen.getByText('Alpha')).toBeInTheDocument();
+    expect(screen.getByText('Theta')).toBeInTheDocument();
+  });
+
+  it('calls setGroupFilter when a sort option is clicked', async () => {
+    const user = userEvent.setup();
+    const setGroupFilter = vi.fn();
+    renderList({ state: { setGroupFilter } });
+
+    await user.click(screen.getByText('Status'));
+
+    expect(setGroupFilter).toHaveBeenCalledWith({
+      group: 'status',
+      groupValue: null,
+    });
+  });
+
+  it('shows group headers when showGroupHeaders=true and multiple groups', () => {
+    renderList({
+      groups: makeStatusGroups(ITEMS),
+      state: { sortBy: { id: 'status', desc: false } },
+      groupOptions: {
+        status: [{ key: 'healthy' }, { key: 'error' }, { key: 'syncing' }],
+      },
+      showGroupHeaders: true,
+    });
+
+    expect(screen.getByText('Healthy')).toBeInTheDocument();
+    expect(screen.getByText('Error')).toBeInTheDocument();
+  });
+
+  it('hides group header when there is only one group', () => {
+    renderList({
+      groups: makeGroups(ITEMS, 'SingleGroup'),
+      showGroupHeaders: true,
+    });
+
+    expect(screen.queryByText('SingleGroup')).not.toBeInTheDocument();
+  });
+
+  it('shows empty message when groups is empty', () => {
+    renderList({ groups: [], totalCount: 0 });
+
+    expect(screen.getByText('No items found')).toBeInTheDocument();
+  });
+
+  it('shows custom empty message', () => {
+    renderList({
+      groups: [],
+      totalCount: 0,
+      emptyMessage: 'No workflows match your search',
+    });
+
+    expect(
+      screen.getByText('No workflows match your search')
+    ).toBeInTheDocument();
+  });
+
+  it('shows pagination info when totalCount exceeds pageSize', () => {
+    renderList({
+      groups: makeGroups(ITEMS.slice(0, 5)),
+      totalCount: 20,
+      state: { pageSize: 5, page: 0 },
+    });
+
+    expect(screen.getByText(/Showing/)).toBeInTheDocument();
+    expect(screen.getByText(/of/)).toBeInTheDocument();
+  });
+
+  it('calls setPage when next-page button is clicked', async () => {
+    const user = userEvent.setup();
+    const setPage = vi.fn();
+    renderList({
+      state: { pageSize: 5, page: 0, setPage },
+      groups: makeGroups(ITEMS.slice(0, 5)),
+      totalCount: 20,
+    });
+
+    await user.click(screen.getByTitle('Next page'));
+
+    expect(setPage).toHaveBeenCalledWith(1);
+  });
+
+  it('calls setPage(0) when first-page button is clicked from page 2', async () => {
+    const user = userEvent.setup();
+    const setPage = vi.fn();
+    renderList({
+      state: { pageSize: 5, page: 1, setPage },
+      groups: makeGroups(ITEMS.slice(5, 10)),
+      totalCount: 20,
+    });
+
+    await user.click(screen.getByTitle('First page'));
+
+    expect(setPage).toHaveBeenCalledWith(0);
+  });
+
+  it('renders column headers for each group when renderColumnHeaders is provided', () => {
+    const groups = makeStatusGroups(ITEMS);
+    renderList({
+      groups,
+      showGroupHeaders: true,
+      renderColumnHeaders: () => <div>col-header</div>,
+    });
+
+    expect(screen.getAllByText('col-header')).toHaveLength(groups.length);
+  });
+
+  it('calls renderColumnHeaders with the group key and items', () => {
+    const groups = makeStatusGroups(ITEMS);
+    const renderColumnHeaders = vi.fn(() => null);
+    renderList({ groups, showGroupHeaders: true, renderColumnHeaders });
+
+    groups.forEach((g) =>
+      expect(renderColumnHeaders).toHaveBeenCalledWith(g.key, g.items)
+    );
+  });
+
+  it('renders the group icon in the group header', () => {
+    const groups: SortableGroup<Item>[] = [
+      {
+        key: 'a',
+        label: 'Group A',
+        icon: <span>★</span>,
+        items: ITEMS.slice(0, 2),
+      },
+      { key: 'b', label: 'Group B', items: ITEMS.slice(2, 4) },
+    ];
+    renderList({
+      groups,
+      groupOptions: { name: [{ key: 'a' }, { key: 'b' }] },
+      totalCount: 4,
+      showGroupHeaders: true,
+    });
+
+    expect(screen.getByText('★')).toBeInTheDocument();
+  });
+
+  describe('sortBy case-insensitive normalisation', () => {
+    it('shows group headers when sortBy.id is uppercased', () => {
+      renderList({
+        groups: makeStatusGroups(ITEMS),
+        state: { sortBy: { id: 'STATUS', desc: false } },
+        groupOptions: {
+          status: [{ key: 'healthy' }, { key: 'error' }, { key: 'syncing' }],
+        },
+        showGroupHeaders: true,
+      });
+
+      expect(screen.getByText('Healthy')).toBeInTheDocument();
+    });
+
+    it('shows group headers when sortBy.id is mixed-case', () => {
+      renderList({
+        groups: makeStatusGroups(ITEMS),
+        state: { sortBy: { id: 'Status', desc: false } },
+        groupOptions: {
+          status: [{ key: 'healthy' }, { key: 'error' }, { key: 'syncing' }],
+        },
+        showGroupHeaders: true,
+      });
+
+      expect(screen.getByText('Healthy')).toBeInTheDocument();
+    });
+
+    it('highlights the sort option whose key matches case-insensitively', () => {
+      renderList({
+        state: { sortBy: { id: 'STATUS', desc: false } },
+      });
+
+      expect(screen.getByRole('button', { name: /Status/i })).toHaveTextContent(
+        'Asc'
+      );
+    });
+
+    it('shows no active sort option when sortBy.id has no match', () => {
+      renderList({
+        state: { sortBy: { id: 'unknown', desc: false } },
+      });
+
+      expect(
+        screen.getByRole('button', { name: /Name/i })
+      ).not.toHaveTextContent('Asc');
+      expect(
+        screen.getByRole('button', { name: /Status/i })
+      ).not.toHaveTextContent('Asc');
+    });
+  });
+
+  it('renders the group description in the group header', () => {
+    const groups: SortableGroup<Item>[] = [
+      {
+        key: 'a',
+        label: 'Group A',
+        description: 'hint text',
+        items: ITEMS.slice(0, 2),
+      },
+      { key: 'b', label: 'Group B', items: ITEMS.slice(2, 4) },
+    ];
+    renderList({
+      groups,
+      groupOptions: { name: [{ key: 'a' }, { key: 'b' }] },
+      totalCount: 4,
+      showGroupHeaders: true,
+    });
+
+    expect(screen.getByText('hint text')).toBeInTheDocument();
+  });
+});
+
+function renderList({
+  state = createMockState(),
+  groups = makeGroups(ITEMS),
+  totalCount = ITEMS.length,
+  renderItem = (item: Item) => <div key={item.id}>{item.name}</div>,
+  groupOptions,
+  showGroupHeaders,
+  emptyMessage,
+  renderColumnHeaders,
+  getItemKey,
+  searchPlaceholder,
+  actionButton,
+  isLoading,
+}: {
+  state?: Partial<SortableListState>;
+  groups?: SortableGroup<Item>[];
+  totalCount?: number;
+  renderItem?: (item: Item, index: number) => ReactNode;
+  groupOptions?: Record<string, { key: string; label?: string }[]>;
+  showGroupHeaders?: boolean;
+  emptyMessage?: string;
+  renderColumnHeaders?: (groupKey: string, items: Item[]) => ReactNode;
+  getItemKey?: (item: Item, index: number) => string | number;
+  searchPlaceholder?: string;
+  actionButton?: ReactNode;
+  isLoading?: boolean;
+} = {}) {
+  const tableState = createMockState(state);
+
+  render(
+    <SortableList
+      tableState={tableState}
+      sortOptions={SORT_OPTIONS}
+      groups={groups}
+      totalCount={totalCount}
+      renderItem={renderItem}
+      groupOptions={groupOptions}
+      showGroupHeaders={showGroupHeaders}
+      emptyMessage={emptyMessage}
+      renderColumnHeaders={renderColumnHeaders}
+      getItemKey={getItemKey}
+      searchPlaceholder={searchPlaceholder}
+      actionButton={actionButton}
+      isLoading={isLoading}
+      data-cy="sortable-list"
+    />
+  );
+}
+
+function makeGroups(items: Item[], label = 'Items'): SortableGroup<Item>[] {
+  if (items.length === 0) return [];
+  return [{ key: 'items', label, items }];
+}
+
+function makeStatusGroups(items: Item[]): SortableGroup<Item>[] {
+  const byStatus = items.reduce<Record<string, Item[]>>((acc, item) => {
+    const group = acc[item.status] ?? [];
+    return { ...acc, [item.status]: [...group, item] };
+  }, {});
+  return Object.entries(byStatus).map(([status, statusItems]) => ({
+    key: status,
+    label: status.charAt(0).toUpperCase() + status.slice(1),
+    items: statusItems,
+  }));
+}
+
+function createMockState(
+  overrides?: Partial<SortableListState>
+): SortableListState {
+  return {
+    sortBy: { id: 'name', desc: false },
+    setSortBy: vi.fn(),
+    pageSize: 10,
+    setPageSize: vi.fn(),
+    page: 0,
+    setPage: vi.fn(),
+    groupBy: null,
+    setGroupBy: vi.fn(),
+    groupFilter: null,
+    setGroupFilter: vi.fn(),
+    search: '',
+    setSearch: vi.fn(),
+    ...overrides,
+  };
+}
diff --git a/app/react/components/SortableList/SortableList.tsx b/app/react/components/SortableList/SortableList.tsx
new file mode 100644
index 0000000..c67c246
--- /dev/null
+++ b/app/react/components/SortableList/SortableList.tsx
@@ -0,0 +1,119 @@
+import '@@/datatables/datatable.css';
+
+import { ReactNode } from 'react';
+
+import { AutomationTestingProps } from '@/types';
+
+import { DropdownOption } from '../DropdownMenu/DropdownMenu';
+
+import { SortOption, SortableListHeader } from './SortableListHeader';
+import { SortableGroup } from './SortableListGroup';
+import { SortableListBody } from './SortableListBody';
+import { SortableListCard } from './SortableListCard';
+import { SortableListPager } from './SortableListPager';
+import { SortableListState } from './sortable-list.store';
+
+export type { SortableGroup };
+export type { SortableListState };
+export type { SortOption };
+
+interface Props<T> extends AutomationTestingProps {
+  tableState: SortableListState;
+  sortOptions: SortOption[];
+  groupOptions?: Record<string, DropdownOption[]>;
+  groups: SortableGroup<T>[];
+  totalCount: number;
+  renderItem: (item: T, index: number) => ReactNode;
+  renderColumnHeaders?: (groupKey: string, items: T[]) => ReactNode;
+  getItemKey?: (item: T, index: number) => string | number;
+  showGroupHeaders?: boolean;
+  emptyMessage?: string;
+  searchPlaceholder?: string;
+  headerButtons?: ReactNode;
+  actionButton?: ReactNode;
+  isLoading?: boolean;
+}
+
+export function SortableList<T>({
+  tableState,
+  sortOptions,
+  groupOptions,
+  groups,
+  totalCount,
+  renderItem,
+  renderColumnHeaders,
+  getItemKey,
+  showGroupHeaders = true,
+  emptyMessage = 'No items found',
+  searchPlaceholder,
+  headerButtons,
+  actionButton,
+  isLoading = false,
+  'data-cy': dataCy,
+}: Props<T>) {
+  const activeKey = getSortKey(
+    sortOptions,
+    tableState.groupBy ?? tableState.sortBy?.id ?? ''
+  );
+
+  return (
+    <SortableListCard>
+      <SortableListHeader
+        value={{
+          group: activeKey,
+          groupValue: tableState.groupFilter,
+        }}
+        onChange={({ group, groupValue }) => {
+          tableState.setGroupFilter({
+            group,
+            groupValue,
+          });
+        }}
+        sortDesc={tableState.sortBy?.desc ?? false}
+        searchTerm={tableState.search}
+        onSearchChange={tableState.setSearch}
+        groupOptions={groupOptions}
+        sortOptions={sortOptions}
+        searchPlaceholder={searchPlaceholder}
+        headerButtons={headerButtons}
+        actionButton={actionButton}
+        data-cy={`${dataCy}-header`}
+      />
+
+      <div className="overflow-y-auto">
+        <SortableListBody
+          isLoading={isLoading}
+          groups={groups}
+          showGroupHeaders={
+            showGroupHeaders && (groupOptions?.[activeKey]?.length ?? 0) > 0
+          }
+          renderItem={renderItem}
+          renderColumnHeaders={renderColumnHeaders}
+          getItemKey={getItemKey}
+          emptyMessage={emptyMessage}
+          data-cy={`${dataCy}-body`}
+        />
+      </div>
+
+      <SortableListPager
+        page={tableState.page}
+        pageSize={tableState.pageSize}
+        totalCount={totalCount}
+        onPageChange={tableState.setPage}
+        onPageSizeChange={tableState.setPageSize}
+      />
+    </SortableListCard>
+  );
+}
+
+function getSortKey(sortOptions: SortOption[], sortKey: string | undefined) {
+  if (!sortKey) {
+    return '';
+  }
+
+  const sortOption = sortOptions.find(
+    (opt) => opt.key.toLowerCase() === sortKey.toLowerCase()
+  );
+
+  return sortOption?.key ?? '';
+}
diff --git a/app/react/components/SortableList/SortableListBody.tsx b/app/react/components/SortableList/SortableListBody.tsx
new file mode 100644
index 0000000..f5bb28b
--- /dev/null
+++ b/app/react/components/SortableList/SortableListBody.tsx
@@ -0,0 +1,108 @@
+import { Loader2, Search } from 'lucide-react';
+import { ReactNode } from 'react';
+
+import { Icon } from '@@/Icon';
+
+import { SortableGroup, SortableListGroup } from './SortableListGroup';
+import { SortableListSkeleton } from './SortableListSkeleton';
+
+interface Props<T> {
+  isLoading: boolean;
+  groups: SortableGroup<T>[];
+  showGroupHeaders: boolean;
+  renderItem: (item: T, index: number) => ReactNode;
+  renderColumnHeaders?: (groupKey: string, items: T[]) => ReactNode;
+  getItemKey?: (item: T, index: number) => string | number;
+  emptyMessage: string;
+  'data-cy'?: string;
+}
+
+export function SortableListBody<T>({
+  isLoading,
+  groups,
+  showGroupHeaders,
+  renderItem,
+  renderColumnHeaders,
+  getItemKey,
+  emptyMessage,
+  'data-cy': dataCy,
+}: Props<T>) {
+  if (isLoading) {
+    if (groups.length === 0) {
+      return <SortableListSkeleton />;
+    }
+
+    return (
+      <div className="relative">
+        <div className="pointer-events-none blur-sm">
+          <Groups
+            groups={groups}
+            showGroupHeaders={showGroupHeaders}
+            renderItem={renderItem}
+            renderColumnHeaders={renderColumnHeaders}
+            getItemKey={getItemKey}
+          />
+        </div>
+        <div className="absolute inset-0 flex items-center justify-center">
+          <Icon
+            icon={Loader2}
+            className="h-8 w-8 animate-spin-slow text-gray-6 th-dark:text-gray-4"
+          />
+        </div>
+      </div>
+    );
+  }
+
+  if (groups.length > 0) {
+    return (
+      <Groups
+        groups={groups}
+        showGroupHeaders={showGroupHeaders}
+        renderItem={renderItem}
+        renderColumnHeaders={renderColumnHeaders}
+        getItemKey={getItemKey}
+        data-cy={dataCy}
+      />
+    );
+  }
+
+  return (
+    <div className="flex flex-col items-center gap-3 py-12 text-gray-6">
+      <Search className="h-8 w-8" />
+      <p className="text-sm">{emptyMessage}</p>
+    </div>
+  );
+}
+
+interface GroupsProps<T> {
+  groups: SortableGroup<T>[];
+  showGroupHeaders: boolean;
+  renderItem: (item: T, index: number) => ReactNode;
+  renderColumnHeaders?: (groupKey: string, items: T[]) => ReactNode;
+  getItemKey?: (item: T, index: number) => string | number;
+  'data-cy'?: string;
+}
+
+function Groups<T>({
+  groups,
+  showGroupHeaders,
+  renderItem,
+  renderColumnHeaders,
+  getItemKey,
+  'data-cy': dataCy,
+}: GroupsProps<T>) {
+  return (
+    <div data-cy={dataCy}>
+      {groups.map((group) => (
+        <SortableListGroup
+          key={group.key}
+          group={group}
+          showHeader={showGroupHeaders}
+          renderItem={renderItem}
+          renderColumnHeaders={renderColumnHeaders}
+          getItemKey={getItemKey}
+        />
+      ))}
+    </div>
+  );
+}
diff --git a/app/react/components/SortableList/SortableListCard.tsx b/app/react/components/SortableList/SortableListCard.tsx
new file mode 100644
index 0000000..3054e8b
--- /dev/null
+++ b/app/react/components/SortableList/SortableListCard.tsx
@@ -0,0 +1,12 @@
+import { PropsWithChildren } from 'react';
+
+import { WidgetBody } from '@@/Widget';
+import { Widget } from '@@/Widget/Widget';
+
+export function SortableListCard({ children }: PropsWithChildren<unknown>) {
+  return (
+    <Widget className="th-dark:!border-gray-8">
+      <WidgetBody className="overflow-hidden !p-0">{children}</WidgetBody>
+    </Widget>
+  );
+}
diff --git a/app/react/components/SortableList/SortableListGroup.tsx b/app/react/components/SortableList/SortableListGroup.tsx
new file mode 100644
index 0000000..e9a20b9
--- /dev/null
+++ b/app/react/components/SortableList/SortableListGroup.tsx
@@ -0,0 +1,87 @@
+import { Fragment, ReactNode } from 'react';
+import clsx from 'clsx';
+
+export interface SortableGroup<T> {
+  key: string;
+  label: string;
+  description?: string;
+  icon?: ReactNode;
+  items: T[];
+}
+
+interface Props<T> {
+  group: SortableGroup<T>;
+  showHeader: boolean;
+  renderItem: (item: T, index: number) => ReactNode;
+  renderColumnHeaders?: (groupKey: string, items: T[]) => ReactNode;
+  getItemKey?: (item: T, index: number) => string | number;
+}
+
+export function SortableListGroup<T>({
+  group,
+  showHeader,
+  renderItem,
+  renderColumnHeaders,
+  getItemKey,
+}: Props<T>) {
+  return (
+    <div>
+      {showHeader && <SortableListGroupHeader group={group} />}
+
+      {renderColumnHeaders && (
+        <div>{renderColumnHeaders(group.key, group.items)}</div>
+      )}
+
+      <div>
+        {group.items.map((item, index) => (
+          <Fragment key={getItemKey ? getItemKey(item, index) : index}>
+            {renderItem(item, index)}
+          </Fragment>
+        ))}
+      </div>
+    </div>
+  );
+}
+
+interface HeaderProps<T> {
+  group: SortableGroup<T>;
+}
+
+function SortableListGroupHeader<T>({ group }: HeaderProps<T>) {
+  const groupName = group.label ? group.label : group.key;
+  const groupIcon = group.icon;
+  const count = group.items.length;
+  const groupDescription = group.description;
+
+  return (
+    <div
+      className={clsx(
+        'flex items-center gap-3 bg-gray-2 px-4 py-3 th-highcontrast:bg-black th-dark:bg-gray-iron-10',
+        'border-0 border-b border-solid border-gray-5 th-highcontrast:border-white th-dark:border-gray-9'
+      )}
+    >
+      {groupIcon && (
+        <div className="flex h-8 w-8 shrink-0 items-center justify-center">
+          {groupIcon}
+        </div>
+      )}
+      <div className="flex min-w-0 flex-col gap-0.5">
+        <div className="flex items-center gap-2">
+          <span className="truncate text-sm font-semibold text-gray-11 th-highcontrast:text-white th-dark:text-white">
+            {groupName}
+          </span>
+          {count !== undefined && (
+            <span className="inline-flex items-center justify-center rounded-full bg-gray-4 px-2 py-0.5 text-xs font-medium text-gray-9 th-highcontrast:bg-black th-highcontrast:text-white th-dark:bg-gray-7 th-dark:text-gray-3">
+              {count}
+            </span>
+          )}
+        </div>
+        {groupDescription && (
+          <span className="truncate text-xs text-gray-7 th-highcontrast:text-white th-dark:text-gray-5">
+            {groupDescription}
+          </span>
+        )}
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/components/SortableList/SortableListHeader.stories.tsx b/app/react/components/SortableList/SortableListHeader.stories.tsx
new file mode 100644
index 0000000..71b1fcb
--- /dev/null
+++ b/app/react/components/SortableList/SortableListHeader.stories.tsx
@@ -0,0 +1,123 @@
+import { Meta } from '@storybook/react-webpack5';
+import { useState } from 'react';
+import { Server, Cloud } from 'lucide-react';
+
+import { Icon } from '@@/Icon';
+
+import { SortableListHeader } from './SortableListHeader';
+
+export default {
+  component: SortableListHeader,
+  title: 'Components/Tables/GroupSortTableHeader',
+} as Meta;
+
+const groupOptions = {
+  group: [
+    { key: 'Production', count: 12, icon: <Icon icon={Server} /> },
+    { key: 'Staging', count: 5, icon: <Icon icon={Cloud} /> },
+    { key: 'Development', count: 8 },
+  ],
+};
+
+const sortOptions = [
+  { key: 'name', label: 'Name' },
+  { key: 'status', label: 'Status' },
+  { key: 'group', label: 'Group', grouped: true },
+] as const;
+
+type SortKey = (typeof sortOptions)[number]['key'];
+
+export function Interactive() {
+  const [sortDesc, setSortDesc] = useState(false);
+
+  const [value, setValue] = useState<{
+    group: SortKey;
+    groupValue: string | null;
+  }>({
+    group: 'name',
+    groupValue: null,
+  });
+  const [searchTerm, setSearchTerm] = useState('');
+
+  return (
+    <SortableListHeader
+      sortDesc={sortDesc}
+      value={value}
+      onChange={(newValue) => {
+        setSortDesc((prev) => (value.group === newValue.group ? !prev : false));
+        setValue(newValue);
+      }}
+      searchTerm={searchTerm}
+      onSearchChange={setSearchTerm}
+      sortOptions={[...sortOptions]}
+      groupOptions={groupOptions}
+      searchPlaceholder="Search environments..."
+      data-cy="group-sort"
+    />
+  );
+}
+
+export function WithGroupFilter() {
+  const [sortDesc, setSortDesc] = useState(false);
+  const [searchTerm, setSearchTerm] = useState('');
+  const [value, setValue] = useState<{
+    group: SortKey;
+    groupValue: string | null;
+  }>({
+    group: 'group',
+    groupValue: 'Production',
+  });
+
+  return (
+    <SortableListHeader
+      sortDesc={sortDesc}
+      value={value}
+      onChange={(newValue) => {
+        setSortDesc((prev) => (value.group === newValue.group ? !prev : false));
+        setValue(newValue);
+      }}
+      searchTerm={searchTerm}
+      onSearchChange={setSearchTerm}
+      sortOptions={[...sortOptions]}
+      groupOptions={groupOptions}
+      searchPlaceholder="Search environments..."
+      data-cy="group-sort"
+    />
+  );
+}
+
+export function WithActionButton() {
+  const [sortDesc, setSortDesc] = useState(false);
+  const [value, setValue] = useState<{
+    group: SortKey;
+    groupValue: string | null;
+  }>({
+    group: 'name',
+    groupValue: null,
+  });
+  const [searchTerm, setSearchTerm] = useState('');
+
+  return (
+    <SortableListHeader
+      sortDesc={sortDesc}
+      value={value}
+      onChange={(newValue) => {
+        setSortDesc((prev) => (value.group === newValue.group ? !prev : false));
+        setValue(newValue);
+      }}
+      searchTerm={searchTerm}
+      onSearchChange={setSearchTerm}
+      sortOptions={[...sortOptions]}
+      groupOptions={groupOptions}
+      actionButton={
+        <button
+          type="button"
+          className="rounded bg-blue-8 px-3 py-1.5 text-sm text-white"
+        >
+          Add environment
+        </button>
+      }
+      data-cy="group-sort"
+    />
+  );
+}
diff --git a/app/react/components/SortableList/SortableListHeader.test.tsx b/app/react/components/SortableList/SortableListHeader.test.tsx
new file mode 100644
index 0000000..2a27fb0
--- /dev/null
+++ b/app/react/components/SortableList/SortableListHeader.test.tsx
@@ -0,0 +1,199 @@
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+
+import { SortableListHeader } from './SortableListHeader';
+
+vi.mock('@reach/menu-button');
+
+const defaultSortOptions = [
+  { key: 'Group' as const, label: 'Group', grouped: true },
+  { key: 'Platform' as const, label: 'Platform', grouped: true },
+  { key: 'Health' as const, label: 'Health' },
+];
+
+const defaultGroups = [
+  { key: 'Docker', count: 3 },
+  { key: 'Kubernetes', count: 2 },
+];
+
+function renderHeader(
+  overrides: Partial<
+    React.ComponentProps<typeof SortableListHeader<string>>
+  > = {}
+) {
+  const props = {
+    value: { group: 'Group' as string, groupValue: null as string | null },
+    onChange: vi.fn(),
+    searchTerm: '',
+    onSearchChange: vi.fn(),
+    sortOptions: defaultSortOptions,
+    groupOptions: { Group: defaultGroups, Platform: defaultGroups },
+    sortDesc: false,
+    'data-cy': 'cy',
+    ...overrides,
+  };
+
+  return {
+    ...render(<SortableListHeader {...props} />),
+    props,
+  };
+}
+
+describe('GroupSortTableHeader', () => {
+  test('clicking the active sort button opens the dropdown with group options', async () => {
+    const user = userEvent.setup();
+    renderHeader();
+
+    const groupBtn = screen.getByRole('button', { name: /Group/i });
+    await user.click(groupBtn);
+
+    expect(screen.getByRole('menu', { name: /Group/i })).toBeVisible();
+    expect(screen.getByRole('menuitem', { name: /All/ })).toBeVisible();
+    expect(screen.getByRole('menuitem', { name: /Docker/ })).toBeVisible();
+    expect(screen.getByRole('menuitem', { name: /Kubernetes/ })).toBeVisible();
+  });
+
+  test('clicking an inactive grouped sort button opens the dropdown without calling onChange', async () => {
+    const user = userEvent.setup();
+    const onChange = vi.fn();
+    renderHeader({ onChange, value: { group: 'Group', groupValue: null } });
+
+    await user.click(screen.getByRole('button', { name: /Platform/i }));
+
+    expect(onChange).not.toHaveBeenCalled();
+    expect(screen.getByRole('menu', { name: /Platform/i })).toBeVisible();
+  });
+
+  test('dropdown shows group options when opened', async () => {
+    const user = userEvent.setup();
+    renderHeader({
+      value: { group: 'Group', groupValue: null },
+      sortOptions: [{ key: 'Group' as const, label: 'Group', grouped: true }],
+    });
+
+    await user.click(screen.getByRole('button', { name: /Group/i }));
+
+    expect(screen.getByRole('menuitem', { name: /Docker/ })).toBeVisible();
+    expect(screen.getByRole('menuitem', { name: /Kubernetes/ })).toBeVisible();
+    expect(screen.getByRole('menuitem', { name: /All/ })).toBeVisible();
+  });
+
+  test('active group filter is shown as a badge inside the active sort button', () => {
+    renderHeader({ value: { group: 'Group', groupValue: 'Docker' } });
+
+    const groupBtn = screen.getByRole('button', { name: /Group/i });
+    expect(groupBtn).toHaveTextContent('Docker');
+  });
+
+  test('clicking outside the dropdown closes it', async () => {
+    const user = userEvent.setup();
+    renderHeader({ value: { group: 'Group', groupValue: null } });
+
+    await user.click(screen.getByRole('button', { name: /Group/i }));
+    expect(screen.getByRole('menu', { name: /Group/i })).toBeVisible();
+
+    await user.click(document.body);
+    expect(screen.queryByRole('menu')).not.toBeInTheDocument();
+  });
+
+  test('search input renders with the correct placeholder', () => {
+    renderHeader();
+
+    expect(screen.getByPlaceholderText('Filter...')).toBeInTheDocument();
+  });
+
+  test('search input accepts user input', async () => {
+    const user = userEvent.setup();
+    renderHeader();
+
+    const searchInput = screen.getByPlaceholderText('Filter...');
+    await user.type(searchInput, 'test');
+
+    expect(searchInput).toHaveValue('test');
+  });
+
+  test('renders custom search placeholder', () => {
+    renderHeader({ searchPlaceholder: 'Search environments...' });
+
+    expect(
+      screen.getByPlaceholderText('Search environments...')
+    ).toBeInTheDocument();
+  });
+
+  test('renders action button when provided', () => {
+    renderHeader({
+      actionButton: <button type="button">Add item</button>,
+    });
+
+    expect(
+      screen.getByRole('button', { name: /Add item/i })
+    ).toBeInTheDocument();
+  });
+
+  test('All option is present in dropdown menu', async () => {
+    const user = userEvent.setup();
+    renderHeader({
+      value: { group: 'Group', groupValue: 'Docker' },
+      sortOptions: [{ key: 'Group' as const, label: 'Group', grouped: true }],
+    });
+
+    await user.click(screen.getByRole('button', { name: /Group/i }));
+
+    expect(screen.getByRole('menuitem', { name: /All/ })).toBeVisible();
+  });
+
+  test('displays group counts in dropdown', async () => {
+    const user = userEvent.setup();
+    renderHeader({
+      value: { group: 'Group', groupValue: null },
+      sortOptions: [{ key: 'Group' as const, label: 'Group', grouped: true }],
+    });
+
+    await user.click(screen.getByRole('button', { name: /Group/i }));
+
+    const menu = screen.getByRole('menu', { name: /Group/i });
+    expect(menu).toHaveTextContent('3');
+    expect(menu).toHaveTextContent('2');
+  });
+
+  test('renders all sort option buttons', () => {
+    renderHeader();
+
+    expect(screen.getByRole('button', { name: /Group/i })).toBeInTheDocument();
+    expect(
+      screen.getByRole('button', { name: /Platform/i })
+    ).toBeInTheDocument();
+    expect(screen.getByRole('button', { name: /Health/i })).toBeInTheDocument();
+  });
+
+  test('selecting a group option calls onChange with the sort key and selected value', async () => {
+    const user = userEvent.setup();
+    const onChange = vi.fn();
+    renderHeader({ onChange });
+
+    await user.click(screen.getByRole('button', { name: /Group/i }));
+    await user.click(screen.getByRole('menuitem', { name: /Docker/ }));
+
+    expect(onChange).toHaveBeenCalledWith({
+      group: 'Group',
+      groupValue: 'Docker',
+    });
+  });
+
+  test('selecting All calls onChange with the sort key and null', async () => {
+    const user = userEvent.setup();
+    const onChange = vi.fn();
+    renderHeader({
+      value: { group: 'Group', groupValue: 'Docker' },
+      onChange,
+    });
+
+    await user.click(screen.getByRole('button', { name: /Group/i }));
+    await user.click(screen.getByRole('menuitem', { name: /All/ }));
+
+    expect(onChange).toHaveBeenCalledWith({
+      group: 'Group',
+      groupValue: null,
+    });
+  });
+});
diff --git a/app/react/components/SortableList/SortableListHeader.tsx b/app/react/components/SortableList/SortableListHeader.tsx
new file mode 100644
index 0000000..4be6c9c
--- /dev/null
+++ b/app/react/components/SortableList/SortableListHeader.tsx
@@ -0,0 +1,74 @@
+import { ReactNode } from 'react';
+import clsx from 'clsx';
+
+import { AutomationTestingProps } from '@/types';
+
+import { SearchBar } from '@@/datatables/SearchBar';
+
+import { DropdownOption } from '../DropdownMenu/DropdownMenu';
+
+import { SortByGroup, SortOption } from './SortByGroup';
+
+export type { SortOption };
+
+interface Props<TSortKey extends string> {
+  sortDesc: boolean;
+  value: { group: TSortKey; groupValue: string | null };
+  onChange: (value: { group: TSortKey; groupValue: string | null }) => void;
+  searchTerm: string;
+  onSearchChange: (term: string) => void;
+  sortOptions: SortOption<TSortKey>[];
+  searchPlaceholder?: string;
+  actionButton?: ReactNode;
+  groupOptions?: Record<string, DropdownOption[]>;
+  headerButtons?: ReactNode;
+}
+
+export function SortableListHeader<TSortKey extends string>({
+  sortDesc,
+  value,
+  onChange,
+  searchTerm,
+  onSearchChange,
+  sortOptions,
+  searchPlaceholder = 'Filter...',
+  actionButton,
+  groupOptions,
+  headerButtons,
+  'data-cy': dataCy,
+}: Props<TSortKey> & AutomationTestingProps) {
+  return (
+    <div
+      className={clsx(
+        'flex flex-wrap items-center justify-between gap-3 px-5 py-3',
+        'bg-gray-2 th-highcontrast:bg-black th-dark:bg-gray-iron-10'
+      )}
+    >
+      <SortByGroup
+        value={value}
+        sortDesc={sortDesc}
+        onChange={onChange}
+        sortOptions={sortOptions}
+        groupOptions={groupOptions}
+        dataCy={`${dataCy}-sort`}
+      />
+      <div className="ml-auto flex items-center gap-2">
+        {headerButtons}
+        <SearchBar
+          value={searchTerm}
+          placeholder={searchPlaceholder}
+          onChange={onSearchChange}
+          data-cy={`${dataCy}-search`}
+          className={clsx(
+            'rounded-md border border-solid border-gray-4',
+            'bg-white py-2 pl-9 pr-3 text-sm text-gray-10 placeholder-gray-6',
+            'focus:border-blue-6 focus:outline-none',
+            'th-dark:border-gray-7 th-dark:bg-gray-iron-10 th-dark:text-white th-dark:placeholder-gray-7',
+            'th-highcontrast:border-white th-highcontrast:bg-black th-highcontrast:text-white th-highcontrast:placeholder-gray-4 th-highcontrast:focus:border-blue-8'
+          )}
+        />
+        {actionButton}
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/components/SortableList/SortableListItem.tsx b/app/react/components/SortableList/SortableListItem.tsx
new file mode 100644
index 0000000..4e3aacd
--- /dev/null
+++ b/app/react/components/SortableList/SortableListItem.tsx
@@ -0,0 +1,13 @@
+import { ReactNode } from 'react';
+
+interface Props {
+  children: ReactNode;
+}
+
+export function SortableListItem({ children }: Props) {
+  return (
+    <div className="border-0 border-b border-solid border-gray-5 px-5 py-3 th-dark:border-gray-9">
+      {children}
+    </div>
+  );
+}
diff --git a/app/react/components/SortableList/SortableListPager.tsx b/app/react/components/SortableList/SortableListPager.tsx
new file mode 100644
index 0000000..955e4fa
--- /dev/null
+++ b/app/react/components/SortableList/SortableListPager.tsx
@@ -0,0 +1,38 @@
+import { SortableListPagerInfo } from './SortableListPagerInfo';
+import { SortableListPagerNav } from './SortableListPagerNav';
+
+interface Props {
+  page: number;
+  pageSize: number;
+  totalCount: number;
+  onPageChange: (page: number) => void;
+  onPageSizeChange: (pageSize: number) => void;
+}
+
+export function SortableListPager({
+  page,
+  pageSize,
+  totalCount,
+  onPageChange,
+  onPageSizeChange,
+}: Props) {
+  const totalPages = Math.max(1, Math.ceil(totalCount / pageSize));
+  const safePage = Math.min(page, totalPages - 1);
+
+  return (
+    <div className="flex items-center justify-between px-5 py-3 text-xs text-gray-7 th-highcontrast:text-gray-4 th-dark:text-gray-4">
+      <SortableListPagerInfo
+        page={safePage}
+        totalCount={totalCount}
+        pageSize={pageSize}
+        onPageSizeChange={onPageSizeChange}
+        onPageChange={onPageChange}
+      />
+      <SortableListPagerNav
+        safePage={safePage}
+        totalPages={totalPages}
+        onPageChange={onPageChange}
+      />
+    </div>
+  );
+}
diff --git a/app/react/components/SortableList/SortableListPagerInfo.tsx b/app/react/components/SortableList/SortableListPagerInfo.tsx
new file mode 100644
index 0000000..19442f8
--- /dev/null
+++ b/app/react/components/SortableList/SortableListPagerInfo.tsx
@@ -0,0 +1,60 @@
+import clsx from 'clsx';
+
+const PAGE_SIZE_OPTIONS = [10, 25, 50, 100] as const;
+
+interface Props {
+  page: number;
+  pageSize: number;
+  totalCount: number;
+  onPageSizeChange: (pageSize: number) => void;
+  onPageChange: (page: number) => void;
+}
+
+export function SortableListPagerInfo({
+  page,
+  pageSize,
+  totalCount,
+  onPageSizeChange,
+  onPageChange,
+}: Props) {
+  if (totalCount === 0) return null;
+
+  const start = page * pageSize + 1;
+  const end = Math.min((page + 1) * pageSize, totalCount);
+
+  return (
+    <div className="flex items-center gap-3">
+      <span>
+        Showing{' '}
+        <strong>
+          {start}–{end}
+        </strong>{' '}
+        of <strong>{totalCount}</strong>
+      </span>
+
+      <select
+        className={clsx(
+          'rounded border border-solid border-gray-4 bg-transparent px-2 py-1',
+          'text-xs text-gray-7 th-highcontrast:text-gray-4 th-dark:border-gray-7 th-dark:text-gray-4',
+          'th-highcontrast:bg-black th-dark:bg-gray-iron-10',
+          'cursor-pointer focus:outline-none'
+        )}
+        value={pageSize}
+        onChange={(e) => {
+          onPageSizeChange(Number(e.target.value));
+          onPageChange(0);
+        }}
+      >
+        {PAGE_SIZE_OPTIONS.map((size) => (
+          <option
+            key={size}
+            value={size}
+            className="th-highcontrast:bg-black th-dark:bg-gray-iron-10"
+          >
+            {size}
+          </option>
+        ))}
+      </select>
+    </div>
+  );
+}
diff --git a/app/react/components/SortableList/SortableListPagerNav.tsx b/app/react/components/SortableList/SortableListPagerNav.tsx
new file mode 100644
index 0000000..9f163c3
--- /dev/null
+++ b/app/react/components/SortableList/SortableListPagerNav.tsx
@@ -0,0 +1,139 @@
+import { ReactNode } from 'react';
+import {
+  ChevronsLeft,
+  ChevronLeft,
+  ChevronRight,
+  ChevronsRight,
+} from 'lucide-react';
+import clsx from 'clsx';
+
+interface Props {
+  safePage: number;
+  totalPages: number;
+  onPageChange: (page: number) => void;
+}
+
+export function SortableListPagerNav({
+  safePage,
+  totalPages,
+  onPageChange,
+}: Props) {
+  if (totalPages <= 1) return null;
+
+  const pageNumbers = buildPageNumbers(totalPages, safePage);
+
+  return (
+    <div className="flex items-center gap-1">
+      <PagerButton
+        disabled={safePage === 0}
+        onClick={() => onPageChange(0)}
+        title="First page"
+      >
+        <ChevronsLeft className="h-3.5 w-3.5" />
+      </PagerButton>
+      <PagerButton
+        disabled={safePage === 0}
+        onClick={() => onPageChange(safePage - 1)}
+        title="Previous page"
+      >
+        <ChevronLeft className="h-3.5 w-3.5" />
+      </PagerButton>
+      {pageNumbers.map((p, i) =>
+        p === '...' ? (
+          <span key={`ellipsis-${i}`} className="px-1">
+            …
+          </span>
+        ) : (
+          <PagerButton
+            key={p}
+            active={p === safePage}
+            onClick={() => onPageChange(p as number)}
+          >
+            {(p as number) + 1}
+          </PagerButton>
+        )
+      )}
+      <PagerButton
+        disabled={safePage >= totalPages - 1}
+        onClick={() => onPageChange(safePage + 1)}
+        title="Next page"
+      >
+        <ChevronRight className="h-3.5 w-3.5" />
+      </PagerButton>
+      <PagerButton
+        disabled={safePage >= totalPages - 1}
+        onClick={() => onPageChange(totalPages - 1)}
+        title="Last page"
+      >
+        <ChevronsRight className="h-3.5 w-3.5" />
+      </PagerButton>
+    </div>
+  );
+}
+
+function buildPageNumbers(
+  totalPages: number,
+  current: number
+): Array<number | '...'> {
+  if (totalPages <= 7) {
+    return Array.from({ length: totalPages }, (_, i) => i);
+  }
+  const pages: Array<number | '...'> = [0];
+  if (current > 2) pages.push('...');
+  for (
+    let i = Math.max(1, current - 1);
+    i <= Math.min(totalPages - 2, current + 1);
+    i++
+  ) {
+    pages.push(i);
+  }
+  if (current < totalPages - 3) pages.push('...');
+  pages.push(totalPages - 1);
+  return pages;
+}
+
+const btnBase = clsx(
+  'flex h-7 w-7 items-center justify-center rounded',
+  'border border-solid border-gray-4 th-highcontrast:border-white th-dark:border-gray-7',
+  'text-sm text-gray-7 th-highcontrast:text-white th-highcontrast:hover:text-black th-dark:text-gray-4',
+  'transition-colors hover:bg-gray-3 th-highcontrast:bg-black th-highcontrast:hover:bg-white th-dark:hover:bg-gray-iron-9',
+  'disabled:cursor-not-allowed disabled:opacity-40'
+);
+
+const btnActivePage = clsx(
+  'border-blue-7 bg-blue-7 text-white hover:!bg-blue-6',
+  'th-dark:border-blue-7 th-dark:bg-blue-7 th-dark:text-white',
+  'th-highcontrast:bg-white th-highcontrast:!text-black hover:th-highcontrast:!bg-white'
+);
+
+interface PagerButtonProps {
+  onClick: () => void;
+  disabled?: boolean;
+  title?: string;
+  active?: boolean;
+  children: ReactNode;
+}
+
+function PagerButton({
+  onClick,
+  disabled,
+  title,
+  active,
+  children,
+}: PagerButtonProps) {
+  return (
+    <button
+      type="button"
+      className={clsx(
+        btnBase,
+        active && btnActivePage,
+        disabled && 'cursor-not-allowed'
+      )}
+      disabled={disabled}
+      onClick={onClick}
+      title={title}
+    >
+      {children}
+    </button>
+  );
+}
diff --git a/app/react/components/SortableList/SortableListSkeleton.tsx b/app/react/components/SortableList/SortableListSkeleton.tsx
new file mode 100644
index 0000000..9cf0309
--- /dev/null
+++ b/app/react/components/SortableList/SortableListSkeleton.tsx
@@ -0,0 +1,30 @@
+const ROWS = [
+  { primary: 'w-2/5', secondary: 'w-16' },
+  { primary: 'w-3/5', secondary: 'w-20' },
+  { primary: 'w-1/3', secondary: 'w-14' },
+  { primary: 'w-1/2', secondary: 'w-16' },
+  { primary: 'w-2/5', secondary: 'w-12' },
+];
+
+export function SortableListSkeleton({ rows = 5 }: { rows?: number }) {
+  return (
+    <div className="animate-pulse">
+      {Array.from({ length: rows }).map((_, i) => {
+        const { primary, secondary } = ROWS[i % ROWS.length];
+        return (
+          <div
+            key={i}
+            className="flex items-center gap-4 border-b border-solid border-gray-3 px-5 py-3 th-dark:border-gray-8"
+          >
+            <div
+              className={`h-4 rounded bg-gray-3 ${primary} th-dark:bg-gray-8`}
+            />
+            <div
+              className={`h-4 rounded bg-gray-2 ${secondary} th-dark:bg-gray-9`}
+            />
+          </div>
+        );
+      })}
+    </div>
+  );
+}
diff --git a/app/react/components/SortableList/StatusFilteredList.stories.tsx b/app/react/components/SortableList/StatusFilteredList.stories.tsx
new file mode 100644
index 0000000..2474122
--- /dev/null
+++ b/app/react/components/SortableList/StatusFilteredList.stories.tsx
@@ -0,0 +1,356 @@
+// This story demonstrates how StatusSummaryBar and SortableList integrate:
+// the summary bar filter and the group-sort dimension filter share state so
+// that selecting a status from either control keeps both in sync.
+import type { Meta, StoryObj } from '@storybook/react-webpack5';
+import { userEvent, within, expect } from 'storybook/test';
+import { useState } from 'react';
+
+import { buildGroupSortExtras } from '@@/datatables/groupSortState';
+import {
+  StatusSummaryBar,
+  StatusSegment,
+} from '@@/StatusSummaryBar/StatusSummaryBar';
+
+import { SortableList, SortableGroup, SortableListState } from './SortableList';
+
+type Item = {
+  id: number;
+  name: string;
+  status: string;
+  type: string;
+  platform: string;
+};
+
+const ITEMS: Item[] = [
+  { id: 1, name: 'Alpha', status: 'error', type: 'stack', platform: 'linux' },
+  { id: 2, name: 'Beta', status: 'healthy', type: 'stack', platform: 'linux' },
+  { id: 3, name: 'Gamma', status: 'error', type: 'edge', platform: 'windows' },
+  {
+    id: 4,
+    name: 'Delta',
+    status: 'healthy',
+    type: 'edge',
+    platform: 'windows',
+  },
+  { id: 5, name: 'Eta', status: 'outdated', type: 'stack', platform: 'mac' },
+];
+
+const SEGMENTS: StatusSegment<string>[] = [
+  { key: 'error', label: 'Error', count: 2, color: 'error' },
+  { key: 'healthy', label: 'Healthy', count: 2, color: 'success' },
+  { key: 'outdated', label: 'Outdated', count: 1, color: 'warning' },
+];
+
+const SORT_OPTIONS = [
+  { key: 'name', label: 'Name' },
+  { key: 'status', label: 'Status', grouped: true },
+  { key: 'type', label: 'Type', grouped: true },
+  { key: 'platform', label: 'Platform', grouped: true },
+];
+
+const GROUP_OPTIONS: Record<string, Array<{ key: string; label: string }>> = {
+  status: SEGMENTS,
+  type: [
+    { key: 'stack', label: 'Stack' },
+    { key: 'edge', label: 'Edge' },
+  ],
+  platform: [
+    { key: 'linux', label: 'Linux' },
+    { key: 'windows', label: 'Windows' },
+    { key: 'mac', label: 'Mac' },
+  ],
+};
+
+const SORT_KEYS = ['name', 'status', 'type', 'platform'] as const;
+const DIMENSIONS = [{ key: 'status' }, { key: 'type' }, { key: 'platform' }];
+
+type Params = {
+  sort: string;
+  order: 'asc' | 'desc';
+  status: string | null;
+  type: string | null;
+  platform: string | null;
+  page: number;
+  pageSize: number;
+  search: string;
+};
+
+function buildGroups(items: Item[], sortBy: string): SortableGroup<Item>[] {
+  const options = GROUP_OPTIONS[sortBy];
+  if (!options) {
+    return items.length > 0 ? [{ key: 'all', label: 'All', items }] : [];
+  }
+  return options
+    .map(({ key, label }) => ({
+      key,
+      label,
+      items: items.filter((item) => item[sortBy as keyof Item] === key),
+    }))
+    .filter((g) => g.items.length > 0);
+}
+
+function Demo() {
+  const [params, setParams] = useState<Params>({
+    sort: 'name',
+    order: 'asc',
+    status: null,
+    type: null,
+    platform: null,
+    page: 0,
+    pageSize: 10,
+    search: '',
+  });
+
+  function patchParams(update: Record<string, unknown>) {
+    setParams((prev) => {
+      const next = { ...prev } as Record<string, unknown>;
+      for (const [k, v] of Object.entries(update)) {
+        next[k] = v ?? null;
+      }
+      return next as Params;
+    });
+  }
+
+  const { groupFilter, setGroupFilter } = buildGroupSortExtras({
+    urlState: params,
+    setUrlState: patchParams,
+    defaultSort: 'name',
+    sortKeys: SORT_KEYS,
+    dimensions: DIMENSIONS,
+  });
+
+  const isDimension = DIMENSIONS.some((d) => d.key === params.sort);
+
+  const tableState: SortableListState = {
+    sortBy: { id: params.sort, desc: params.order === 'desc' },
+    setSortBy: (id, desc) =>
+      patchParams({
+        sort: id ?? 'name',
+        order: desc ? 'desc' : 'asc',
+        page: 0,
+      }),
+    pageSize: params.pageSize,
+    setPageSize: (pageSize) => patchParams({ pageSize, page: 0 }),
+    page: params.page,
+    setPage: (page) => patchParams({ page }),
+    groupBy: isDimension ? params.sort : null,
+    setGroupBy: (groupBy) => patchParams({ sort: groupBy ?? 'name' }),
+    groupFilter,
+    setGroupFilter,
+    search: params.search,
+    setSearch: (search) => patchParams({ search, page: 0 }),
+  };
+
+  const filterValue = params.status;
+  function setFilter(v: string | null) {
+    patchParams({ status: v, page: 0 });
+  }
+
+  // Apply filters: summary-bar status filter + active dimension group filter
+  let filteredItems = ITEMS;
+  if (filterValue != null) {
+    filteredItems = filteredItems.filter((i) => i.status === filterValue);
+  }
+  const dimKey = isDimension && params.sort !== 'status' ? params.sort : null;
+  const dimFilter = dimKey
+    ? (params[dimKey as keyof Params] as string | null)
+    : null;
+  if (dimKey && dimFilter != null) {
+    filteredItems = filteredItems.filter(
+      (i) => i[dimKey as keyof Item] === dimFilter
+    );
+  }
+
+  return (
+    <div className="flex flex-col gap-4">
+      <StatusSummaryBar
+        total={ITEMS.length}
+        segments={SEGMENTS}
+        value={filterValue}
+        onChange={setFilter}
+        data-cy="status-bar"
+      />
+      <SortableList
+        tableState={tableState}
+        sortOptions={SORT_OPTIONS}
+        groupOptions={GROUP_OPTIONS}
+        groups={buildGroups(filteredItems, params.sort)}
+        totalCount={filteredItems.length}
+        renderItem={(item) => (
+          <div className="px-4 py-2 text-sm">{item.name}</div>
+        )}
+        showGroupHeaders
+        data-cy="list"
+      />
+    </div>
+  );
+}
+
+const meta = {
+  title: 'Design System/SortableList/StatusFilteredList',
+  component: Demo,
+  parameters: { layout: 'padded' },
+} satisfies Meta<typeof Demo>;
+
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+// Click "Error" in summary bar → filter=error, sort=Name unchanged
+export const SummaryBarFiltersToError: Story = {
+  play: async ({ canvasElement }) => {
+    const canvas = within(canvasElement);
+    await clickSummaryBarOption(canvas, 'error');
+    expectFilterChecked(canvas, 'error');
+    expectSortActive(canvas, 'Name');
+  },
+};
+
+// Click "Error" again (active) → filter clears back to total
+export const SummaryBarTogglesOff: Story = {
+  play: async ({ canvasElement }) => {
+    const canvas = within(canvasElement);
+    await clickSummaryBarOption(canvas, 'error');
+    await clickSummaryBarOption(canvas, 'error');
+    expectFilterChecked(canvas, 'total');
+  },
+};
+
+// Summary bar active, click sort "Status" → status filter clears, sort=Status
+export const SortStatusClearsSummaryBarFilter: Story = {
+  play: async ({ canvasElement }) => {
+    const canvas = within(canvasElement);
+    await clickSummaryBarOption(canvas, 'error');
+    await clickSortOption(canvas, 'Status', 'All');
+    expectFilterChecked(canvas, 'total');
+    expectSortActive(canvas, 'Status');
+  },
+};
+
+// Summary bar active, click sort "Type" → status filter persists, sort=Type
+export const SortTypePersistsSummaryBarFilter: Story = {
+  play: async ({ canvasElement }) => {
+    const canvas = within(canvasElement);
+    await clickSummaryBarOption(canvas, 'error');
+    await clickSortOption(canvas, 'Type', 'Stack');
+    expectFilterChecked(canvas, 'error');
+    expectSortActive(canvas, 'Type');
+  },
+};
+
+// Switching to a non-grouped sort clears the group-set filter
+export const SwitchToNameClearsGroupFilter: Story = {
+  play: async ({ canvasElement }) => {
+    const canvas = within(canvasElement);
+    await clickSortOption(canvas, 'Status', 'Error');
+    expectFilterChecked(canvas, 'error');
+    await clickSortOption(canvas, 'Name');
+    expectFilterChecked(canvas, 'total');
+    expectSortActive(canvas, 'Name');
+  },
+};
+
+// Click "Error" in Status group sort → sort=Status, summary bar shows "Error"
+export const StatusGroupFilterSyncsSummaryBar: Story = {
+  play: async ({ canvasElement }) => {
+    const canvas = within(canvasElement);
+    await clickSortOption(canvas, 'Status', 'Error');
+    expectFilterChecked(canvas, 'error');
+    expectSortActive(canvas, 'Status');
+  },
+};
+
+// Summary bar filter persists when switching to a different dimension
+export const SummaryBarFilterPersistsAcrossDimensions: Story = {
+  play: async ({ canvasElement }) => {
+    const canvas = within(canvasElement);
+    await clickSummaryBarOption(canvas, 'error');
+    await clickSortOption(canvas, 'Type', 'Stack');
+    expectFilterChecked(canvas, 'error');
+    expectSortActive(canvas, 'Type');
+  },
+};
+
+// Second group switch clears the old dimension, summary bar filter persists
+export const SecondGroupSwitchClearsOldDimension: Story = {
+  play: async ({ canvasElement }) => {
+    const canvas = within(canvasElement);
+    await clickSummaryBarOption(canvas, 'error');
+    await clickSortOption(canvas, 'Type', 'Stack');
+    await clickSortOption(canvas, 'Platform', 'Linux');
+    expectFilterChecked(canvas, 'error');
+    expectSortActive(canvas, 'Platform');
+  },
+};
+
+// Deselecting a group value keeps the sort, clears the filter
+export const DeselectGroupValueClearsFilter: Story = {
+  play: async ({ canvasElement }) => {
+    const canvas = within(canvasElement);
+    await clickSortOption(canvas, 'Status', 'Error');
+    expectFilterChecked(canvas, 'error');
+    await clickSortOption(canvas, 'Status', 'All');
+    expectFilterChecked(canvas, 'total');
+    expectSortActive(canvas, 'Status');
+  },
+};
+
+// Summary bar overrides a group-set filter
+export const SummaryBarOverridesGroupFilter: Story = {
+  play: async ({ canvasElement }) => {
+    const canvas = within(canvasElement);
+    await clickSortOption(canvas, 'Status', 'Error');
+    expectFilterChecked(canvas, 'error');
+    await clickSummaryBarOption(canvas, 'healthy');
+    expectFilterChecked(canvas, 'healthy');
+  },
+};
+
+// Group value overrides a summary bar filter; summary bar updates
+export const GroupFilterOverridesSummaryBar: Story = {
+  play: async ({ canvasElement }) => {
+    const canvas = within(canvasElement);
+    await clickSummaryBarOption(canvas, 'healthy');
+    expectFilterChecked(canvas, 'healthy');
+    await clickSortOption(canvas, 'Status', 'Outdated');
+    expectFilterChecked(canvas, 'outdated');
+  },
+};
+
+// Helpers shared across play functions
+async function clickSummaryBarOption(
+  canvas: ReturnType<typeof within>,
+  label: string
+) {
+  await userEvent.click(
+    canvas.getByRole('radio', { name: new RegExp(`filter by ${label}`, 'i') })
+  );
+}
+
+async function clickSortOption(
+  canvas: ReturnType<typeof within>,
+  sortLabel: string,
+  itemLabel?: string
+) {
+  await userEvent.click(
+    canvas.getByRole('button', { name: new RegExp(`^${sortLabel}`, 'i') })
+  );
+  if (itemLabel) {
+    await userEvent.click(
+      canvas.getByRole('menuitem', { name: new RegExp(itemLabel, 'i') })
+    );
+  }
+}
+
+function expectFilterChecked(canvas: ReturnType<typeof within>, label: string) {
+  expect(
+    canvas.getByRole('radio', { name: new RegExp(`filter by ${label}`, 'i') })
+  ).toBeChecked();
+}
+
+function expectSortActive(canvas: ReturnType<typeof within>, label: string) {
+  expect(
+    canvas.getByRole('button', { name: new RegExp(`^${label}`, 'i') })
+  ).toHaveAttribute('aria-pressed', 'true');
+}
diff --git a/app/react/components/SortableList/StatusFilteredList.test.tsx b/app/react/components/SortableList/StatusFilteredList.test.tsx
new file mode 100644
index 0000000..2e7791f
--- /dev/null
+++ b/app/react/components/SortableList/StatusFilteredList.test.tsx
@@ -0,0 +1,394 @@
+// This story demonstrates how StatusSummaryBar and SortableList integrate:
+// the summary bar filter and the group-sort dimension filter share state so
+// that selecting a status from either control keeps both in sync.
+import { useState } from 'react';
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+
+import {
+  useTableStateFromUrl,
+  asEnum,
+} from '@@/datatables/useTableStateFromUrl';
+import { buildGroupSortExtras } from '@@/datatables/groupSortState';
+import {
+  StatusSummaryBar,
+  StatusSegment,
+} from '@@/StatusSummaryBar/StatusSummaryBar';
+
+import { SortableList } from './SortableList';
+import { SortableGroup } from './SortableListGroup';
+
+describe('StatusFilteredList', () => {
+  it('Click "Error" in summary bar → list shows only error items, sort unchanged, summary bar highlights "Error"', async () => {
+    const user = userEvent.setup();
+    renderList();
+    expectDefaultValues();
+
+    await selectSummaryBarOption(user, 'error');
+
+    expectFilterChecked('error');
+    expect(screen.getByRole('status')).toBeInTheDocument();
+
+    expectSortActive('Name');
+  });
+
+  it('Click "Error" again (active) → filter clears, all items shown', async () => {
+    const user = userEvent.setup();
+    renderList();
+    expectDefaultValues();
+
+    await selectSummaryBarOption(user, 'error');
+    await selectSummaryBarOption(user, 'error');
+
+    expectFilterChecked('total');
+    expect(screen.queryByRole('status')).not.toBeInTheDocument();
+  });
+
+  it('Summary bar active, click sort header "Status" → status filter clears', async () => {
+    const user = userEvent.setup();
+    renderList();
+
+    await selectSummaryBarOption(user, 'error');
+    await selectSortByFilter(user, 'Status', 'All');
+
+    expectFilterChecked('total');
+    expectSortActive('Status');
+  });
+
+  it('Summary bar active, click sort header "Type" → status persists', async () => {
+    const user = userEvent.setup();
+    renderList();
+
+    await selectSummaryBarOption(user, 'error');
+    await selectSortByFilter(user, 'Type', 'Stack');
+
+    expectFilterChecked('error');
+    expectSortActive('Type');
+  });
+
+  it('switching to a non-grouped sort clears a group-set filter', async () => {
+    const user = userEvent.setup();
+    renderList();
+
+    await selectSortByFilter(user, 'Status', 'Error');
+    expectFilterChecked('error');
+
+    await selectSortByFilter(user, 'Name');
+
+    expectFilterChecked('total');
+    expectSortActive('Name');
+  });
+
+  it('Click "Error" in status group → sort=Status, filter=Error, summary bar also shows "Error"', async () => {
+    const user = userEvent.setup();
+    renderList();
+
+    await selectSortByFilter(user, 'Status', 'Error');
+
+    expectFilterChecked('error');
+    expectSortActive('Status');
+  });
+
+  it('summary bar filter persists when switching to a different dimension', async () => {
+    const user = userEvent.setup();
+    renderList();
+
+    await selectSummaryBarOption(user, 'error');
+    await selectSortByFilter(user, 'Type', 'Stack');
+
+    expectFilterChecked('error');
+    expectSortActive('Type');
+  });
+
+  it('second group switch clears old dimension, summary bar filter persists', async () => {
+    const user = userEvent.setup();
+    renderList();
+
+    await selectSummaryBarOption(user, 'error');
+    await selectSortByFilter(user, 'Type', 'Stack');
+    expectFilterChecked('error');
+
+    await selectSortByFilter(user, 'Platform', 'Linux');
+
+    expectFilterChecked('error');
+    expectSortActive('Platform');
+  });
+
+  it('deselecting a group value keeps sort, clears filter', async () => {
+    const user = userEvent.setup();
+    renderList();
+
+    await selectSortByFilter(user, 'Status', 'Error');
+    expectFilterChecked('error');
+
+    await selectSortByFilter(user, 'Status', 'All');
+
+    expectFilterChecked('total');
+    expectSortActive('Status');
+  });
+
+  it('summary bar overrides a group-set filter', async () => {
+    const user = userEvent.setup();
+    renderList();
+
+    await selectSortByFilter(user, 'Status', 'Error');
+    expectFilterChecked('error');
+
+    await selectSummaryBarOption(user, 'healthy');
+
+    expectFilterChecked('healthy');
+  });
+
+  it('group value overrides a summary bar filter; summary bar updates', async () => {
+    const user = userEvent.setup();
+    renderList();
+
+    await selectSummaryBarOption(user, 'healthy');
+    expectFilterChecked('healthy');
+
+    await selectSortByFilter(user, 'Status', 'Outdated');
+
+    expectFilterChecked('outdated');
+  });
+
+  it('summary bar filter is preserved when switching dimensions after overriding a group-set filter', async () => {
+    const user = userEvent.setup();
+    renderList();
+
+    await selectSortByFilter(user, 'Status', 'Error');
+    expectFilterChecked('error');
+
+    await selectSummaryBarOption(user, 'healthy');
+    expectFilterChecked('healthy');
+
+    await selectSortByFilter(user, 'Type', 'Stack');
+
+    expectFilterChecked('healthy');
+    expectSortActive('Type');
+  });
+});
+
+type Item = {
+  id: number;
+  name: string;
+  status: string;
+  type: string;
+  platform: string;
+};
+
+const ITEMS: Item[] = [
+  { id: 1, name: 'Alpha', status: 'error', type: 'stack', platform: 'linux' },
+  {
+    id: 2,
+    name: 'Beta',
+    status: 'healthy',
+    type: 'stack',
+    platform: 'linux',
+  },
+  {
+    id: 3,
+    name: 'Gamma',
+    status: 'error',
+    type: 'edge',
+    platform: 'windows',
+  },
+  {
+    id: 4,
+    name: 'Delta',
+    status: 'healthy',
+    type: 'edge',
+    platform: 'windows',
+  },
+  { id: 5, name: 'Eta', status: 'outdated', type: 'stack', platform: 'mac' },
+];
+
+const SEGMENTS: StatusSegment<string>[] = [
+  { key: 'error', label: 'Error', count: 2, color: 'error' },
+  { key: 'healthy', label: 'Healthy', count: 2, color: 'success' },
+  { key: 'outdated', label: 'Outdated', count: 1, color: 'warning' },
+];
+
+const SORT_OPTIONS = [
+  { key: 'name', label: 'Name' },
+  { key: 'status', label: 'Status', grouped: true },
+  { key: 'type', label: 'Type', grouped: true },
+  { key: 'platform', label: 'Platform', grouped: true },
+];
+
+const GROUP_OPTIONS: Record<string, Array<{ key: string; label: string }>> = {
+  status: SEGMENTS,
+  type: [
+    { key: 'stack', label: 'Stack' },
+    { key: 'edge', label: 'Edge' },
+  ],
+  platform: [
+    { key: 'linux', label: 'Linux' },
+    { key: 'windows', label: 'Windows' },
+    { key: 'mac', label: 'Mac' },
+  ],
+};
+
+const FILTER_SET = new Set(['error', 'healthy', 'outdated']);
+const TYPE_SET = new Set(['stack', 'edge']);
+const PLATFORM_SET = new Set(['linux', 'windows', 'mac']);
+const SORT_KEYS = ['name', 'status', 'type', 'platform'] as const;
+const DIMENSIONS = [{ key: 'status' }, { key: 'type' }, { key: 'platform' }];
+
+function buildGroups(items: Item[], sortBy: string): SortableGroup<Item>[] {
+  const options = GROUP_OPTIONS[sortBy];
+  if (!options) {
+    return items.length > 0 ? [{ key: 'all', label: 'All', items }] : [];
+  }
+  function getField(item: Item) {
+    return item[sortBy as keyof Item] as string;
+  }
+  return options
+    .map(({ key, label }) => ({
+      key,
+      label,
+      items: items.filter((item) => getField(item) === key),
+    }))
+    .filter((g) => g.items.length > 0);
+}
+
+function TestList() {
+  const tableState = useTableStateFromUrl({
+    localStorageKey: 'test-status-filtered-list',
+    defaultSort: 'name',
+    parseExtra: (p) => ({
+      status: asEnum(p.status, FILTER_SET),
+      type: asEnum(p.type, TYPE_SET),
+      platform: asEnum(p.platform, PLATFORM_SET),
+    }),
+    buildExtra: (urlState, setUrlState) => ({
+      filterValue: urlState.status,
+      setFilter: (v: string | null) =>
+        setUrlState({
+          status: v,
+          page: 0,
+          ...(urlState.sort === 'status' ? { sort: 'name' } : {}),
+        }),
+      ...buildGroupSortExtras({
+        urlState,
+        setUrlState,
+        defaultSort: 'name',
+        sortKeys: SORT_KEYS,
+        dimensions: DIMENSIONS,
+      }),
+    }),
+  });
+
+  const sortBy = tableState.sortBy?.id ?? 'name';
+
+  return (
+    <>
+      <StatusSummaryBar
+        total={ITEMS.length}
+        segments={SEGMENTS}
+        value={tableState.filterValue}
+        onChange={tableState.setFilter}
+        data-cy="test-list-status-bar"
+      />
+      <SortableList
+        tableState={tableState}
+        sortOptions={SORT_OPTIONS}
+        groupOptions={GROUP_OPTIONS}
+        groups={buildGroups(ITEMS, sortBy)}
+        totalCount={ITEMS.length}
+        renderItem={(item) => <div>{item.name}</div>}
+        showGroupHeaders
+        data-cy="test-list-list"
+      />
+    </>
+  );
+}
+
+function renderList() {
+  return render(<TestList />);
+}
+
+async function selectSummaryBarOption(
+  user: ReturnType<typeof userEvent.setup>,
+  label: string
+) {
+  await user.click(
+    screen.getByRole('radio', { name: new RegExp(`filter by ${label}`, 'i') })
+  );
+}
+
+async function selectSortByFilter(
+  user: ReturnType<typeof userEvent.setup>,
+  sortLabel: string,
+  itemLabel?: string
+) {
+  await user.click(
+    screen.getByRole('button', { name: new RegExp(`^${sortLabel}`, 'i') })
+  );
+  if (itemLabel) {
+    await user.click(
+      screen.getByRole('menuitem', { name: new RegExp(itemLabel, 'i') })
+    );
+  }
+}
+
+function expectFilterChecked(label: string) {
+  expect(
+    screen.getByRole('radio', { name: new RegExp(`filter by ${label}`, 'i') })
+  ).toBeChecked();
+}
+
+function expectSortActive(label: string) {
+  expect(
+    screen.getByRole('button', { name: new RegExp(`^${label}`, 'i') })
+  ).toHaveAttribute('aria-pressed', 'true');
+}
+
+function expectDefaultValues() {
+  expectSortActive('Name');
+  expect(screen.queryByRole('status')).not.toBeInTheDocument();
+}
+
+vi.mock('@reach/menu-button');
+
+vi.mock('@/react/hooks/useParamState', () => ({
+  useParamsState: <T extends Record<string, unknown>>(
+    parseParams: (params: Record<string, string | undefined>) => T
+  ) => {
+    const [params, setParams] = useState<Record<string, string | undefined>>(
+      {}
+    );
+    function setState(newState: Partial<T>) {
+      setParams((prev) => {
+        const next = { ...prev };
+        for (const [k, v] of Object.entries(newState)) {
+          if (v === null || v === undefined) {
+            delete next[k];
+          } else {
+            next[k] = String(v);
+          }
+        }
+        return next;
+      });
+    }
+    return [parseParams(params), setState] as const;
+  },
+  usePersistedParamsState: <T extends Record<string, unknown>>(
+    parseParams: (params: Record<string, unknown>) => T
+  ) => {
+    const [params, setParams] = useState<Record<string, unknown>>({});
+    function setState(newState: Partial<T>) {
+      setParams((prev) => {
+        const next = { ...prev };
+        for (const [k, v] of Object.entries(newState)) {
+          if (v === null || v === undefined) {
+            delete next[k];
+          } else {
+            next[k] = v;
+          }
+        }
+        return next;
+      });
+    }
+    return [parseParams(params), setState] as const;
+  },
+}));
diff --git a/app/react/components/SortableList/sortable-list.store.ts b/app/react/components/SortableList/sortable-list.store.ts
new file mode 100644
index 0000000..583ab8a
--- /dev/null
+++ b/app/react/components/SortableList/sortable-list.store.ts
@@ -0,0 +1,77 @@
+import { useState } from 'react';
+
+import {
+  BasicTableSettings,
+  BackendPaginationTableSettings,
+  backendPaginationSettings,
+  createPersistedStore,
+  createTableStore,
+  ZustandSetFunc,
+} from '@@/datatables/types';
+import { useTableState, TableState } from '@@/datatables/useTableState';
+
+interface SortableListSettings
+  extends BasicTableSettings, BackendPaginationTableSettings {
+  groupBy: string | null;
+  setGroupBy: (group: string | null) => void;
+  groupFilter: string | null;
+  setGroupFilter: (value: { group: string; groupValue: string | null }) => void;
+}
+
+export type SortableListState = TableState<SortableListSettings>;
+
+function sortableListExtras(
+  set: ZustandSetFunc<SortableListSettings>
+): Partial<SortableListSettings> {
+  return {
+    ...backendPaginationSettings<SortableListSettings>(set),
+    groupBy: null,
+    setGroupBy: (group) => set((s) => ({ ...s, groupBy: group })),
+    groupFilter: null,
+    setGroupFilter: ({
+      group,
+      groupValue,
+    }: {
+      group: string;
+      groupValue: string | null;
+    }) =>
+      set((s) => ({
+        ...s,
+        sortBy: {
+          id: group,
+          desc: s.sortBy?.id === group ? !s.sortBy.desc : false,
+        },
+        groupBy: group,
+        groupFilter: groupValue,
+        page: 0,
+      })),
+  };
+}
+
+export function createSortableListStore(
+  storageKey: string,
+  defaultSort?: string
+) {
+  return createPersistedStore<SortableListSettings>(
+    storageKey,
+    defaultSort,
+    sortableListExtras
+  );
+}
+
+export function createSortableListStoreUnpersisted(defaultSort?: string) {
+  return createTableStore<SortableListSettings>(
+    defaultSort,
+    sortableListExtras
+  );
+}
+
+export function useSortableListState(
+  storageKey: string,
+  defaultSort?: string
+): SortableListState {
+  const [store] = useState(() =>
+    createSortableListStore(storageKey, defaultSort)
+  );
+  return useTableState(store, storageKey);
+}
diff --git a/app/react/components/SortableList/sortable-list.story-utils.ts b/app/react/components/SortableList/sortable-list.story-utils.ts
new file mode 100644
index 0000000..bc94b3a
--- /dev/null
+++ b/app/react/components/SortableList/sortable-list.story-utils.ts
@@ -0,0 +1,184 @@
+import { useMemo, ReactNode } from 'react';
+
+import { DropdownOption } from '../DropdownMenu/DropdownMenu';
+
+import { SortableGroup, SortableListState } from './SortableList';
+
+export function useGroupOptions<T>(
+  sortBy: string,
+  items: T[],
+  getGroupKeys: (sortBy: string) => string[],
+  getGroupKey: (item: T, sortBy: string) => string,
+  getGroupLabel: (sortBy: string, key: string) => string
+): DropdownOption[] {
+  return useMemo(() => {
+    const groupKeys = getGroupKeys(sortBy);
+    function key(item: T) {
+      return getGroupKey(item, sortBy);
+    }
+    return buildGroupFilterOptions(items, groupKeys, key, (k) =>
+      getGroupLabel(sortBy, k)
+    );
+  }, [getGroupKey, getGroupKeys, getGroupLabel, items, sortBy]);
+}
+
+export interface ComputePagedGroupsParams<T> {
+  items: T[];
+  sortBy: string;
+  page: number;
+  pageSize: number;
+  groupFilter: string | null;
+  search: string;
+  getGroupKeys: (sortBy: string) => string[];
+  getGroupKey: (item: T, sortBy: string) => string;
+  getGroupLabel: (sortBy: string, key: string) => string;
+  getSearchText: (item: T) => string;
+  getGroupIcon?: (key: string) => ReactNode;
+}
+
+export function computePagedGroups<T>({
+  items,
+  sortBy,
+  page,
+  pageSize,
+  groupFilter,
+  search,
+  getGroupKeys,
+  getGroupKey,
+  getGroupLabel,
+  getSearchText,
+  getGroupIcon,
+}: ComputePagedGroupsParams<T>): {
+  groups: SortableGroup<T>[];
+  totalCount: number;
+} {
+  const groupKeys = getGroupKeys(sortBy);
+
+  const filtered = filterByGroupAndSearch(
+    items,
+    groupFilter,
+    key,
+    search,
+    getSearchText
+  );
+  const sorted = sortItemsByGroup(filtered, groupKeys, key);
+  const paginated = sorted.slice(page * pageSize, (page + 1) * pageSize);
+  return {
+    groups: buildSortableGroups(
+      paginated,
+      groupKeys,
+      key,
+      (k) => getGroupLabel(sortBy, k),
+      getGroupIcon
+    ),
+    totalCount: filtered.length,
+  };
+
+  function key(item: T) {
+    return getGroupKey(item, sortBy);
+  }
+}
+
+export function useGroups<T>(
+  tableState: SortableListState,
+  items: T[],
+  defaultSortKey: string,
+  getGroupKeys: (sortBy: string) => string[],
+  getGroupKey: (item: T, sortBy: string) => string,
+  getGroupLabel: (sortBy: string, key: string) => string,
+  getSearchText: (item: T) => string,
+  getGroupIcon?: (key: string) => ReactNode
+): { groups: SortableGroup<T>[]; totalCount: number } {
+  const sortBy = tableState.groupBy ?? tableState.sortBy?.id ?? defaultSortKey;
+  return useMemo(
+    () =>
+      computePagedGroups({
+        items,
+        sortBy,
+        page: tableState.page,
+        pageSize: tableState.pageSize,
+        groupFilter: tableState.groupFilter,
+        search: tableState.search,
+        getGroupKeys,
+        getGroupKey,
+        getGroupLabel,
+        getSearchText,
+        getGroupIcon,
+      }),
+    [
+      getGroupKeys,
+      sortBy,
+      items,
+      tableState.groupFilter,
+      tableState.search,
+      tableState.page,
+      tableState.pageSize,
+      getSearchText,
+      getGroupIcon,
+      getGroupKey,
+      getGroupLabel,
+    ]
+  );
+}
+
+function filterByGroupAndSearch<T>(
+  items: T[],
+  groupFilter: string | null,
+  getGroupKey: (item: T) => string,
+  search: string,
+  getSearchText: (item: T) => string
+): T[] {
+  const q = search.toLowerCase().trim();
+  return items.filter((item) => {
+    if (groupFilter && getGroupKey(item) !== groupFilter) return false;
+    if (q) return getSearchText(item).toLowerCase().includes(q);
+    return true;
+  });
+}
+
+function buildGroupFilterOptions<T>(
+  allItems: T[],
+  groupKeys: string[],
+  getGroupKey: (item: T) => string,
+  getLabel: (key: string) => string
+): DropdownOption[] {
+  return groupKeys.map((k) => ({
+    key: k,
+    label: getLabel(k),
+    count: allItems.filter((item) => getGroupKey(item) === k).length,
+  }));
+}
+
+function sortItemsByGroup<T>(
+  items: T[],
+  groupKeys: string[],
+  getGroupKey: (item: T) => string
+): T[] {
+  if (groupKeys.length === 0) return items;
+  return [...items].sort(
+    (a, b) =>
+      groupKeys.indexOf(getGroupKey(a)) - groupKeys.indexOf(getGroupKey(b))
+  );
+}
+
+function buildSortableGroups<T>(
+  paginated: T[],
+  groupKeys: string[],
+  getGroupKey: (item: T) => string,
+  getLabel: (key: string) => string,
+  getIcon?: (key: string) => ReactNode
+): SortableGroup<T>[] {
+  if (groupKeys.length === 0) {
+    return paginated.length > 0
+      ? [{ key: 'all', label: 'All', items: paginated }]
+      : [];
+  }
+  return groupKeys
+    .map((k) => ({
+      key: k,
+      label: getLabel(k),
+      icon: getIcon?.(k),
+      items: paginated.filter((item) => getGroupKey(item) === k),
+    }))
+    .filter((g) => g.items.length > 0);
+}
diff --git a/app/react/components/StackVersionSelector/StackVersionSelector.tsx b/app/react/components/StackVersionSelector/StackVersionSelector.tsx
new file mode 100644
index 0000000..093ae49
--- /dev/null
+++ b/app/react/components/StackVersionSelector/StackVersionSelector.tsx
@@ -0,0 +1,59 @@
+interface Props {
+  versions?: number[];
+  onChange(value: number): void;
+}
+
+export function StackVersionSelector({ versions, onChange }: Props) {
+  if (!versions || versions.length === 0) {
+    return null;
+  }
+
+  const showSelector = versions.length > 1;
+
+  const versionOptions = versions.map((version) => ({
+    value: version,
+    label: version.toString(),
+  }));
+
+  return (
+    <div className="flex">
+      {!showSelector && (
+        <>
+          <label className="text-muted mr-2" htmlFor="version_id">
+            <span>Version:</span>
+          </label>
+          <span className="text-muted" id="version_id">
+            {versions[0]}
+          </span>
+        </>
+      )}
+
+      {showSelector && (
+        <div className="text-muted">
+          <label className="mr-2" htmlFor="version_id">
+            <span>Version:</span>
+          </label>
+          <select
+            className="form-select"
+            data-cy="version-selector"
+            id="version_id"
+            style={{
+              width: '60px',
+              height: '24px',
+              borderRadius: '4px',
+              borderColor: 'hsl(0, 0%, 80%)',
+              padding: '2px 8px',
+            }}
+            onChange={(e) => onChange(parseInt(e.target.value, 10))}
+          >
+            {versionOptions.map((option) => (
+              <option key={option.value} value={option.value}>
+                {option.value}
+              </option>
+            ))}
+          </select>
+        </div>
+      )}
+    </div>
+  );
+}
diff --git a/app/react/components/StackVersionSelector/index.ts b/app/react/components/StackVersionSelector/index.ts
new file mode 100644
index 0000000..2cc6697
--- /dev/null
+++ b/app/react/components/StackVersionSelector/index.ts
@@ -0,0 +1 @@
+export { StackVersionSelector } from './StackVersionSelector';
diff --git a/app/react/components/StatsItem.test.tsx b/app/react/components/StatsItem.test.tsx
new file mode 100644
index 0000000..e9a922b
--- /dev/null
+++ b/app/react/components/StatsItem.test.tsx
@@ -0,0 +1,57 @@
+import { render, screen } from '@testing-library/react';
+
+import {
+  ContainerStats,
+  CPUStats,
+  GpuStats,
+  MemoryStats,
+  NodeStats,
+} from './StatsItem';
+
+describe('StatsItem', () => {
+  describe('NodeStats', () => {
+    it('renders node count with NODES label', () => {
+      render(<NodeStats value={3} />);
+      expect(screen.getByText('3')).toBeVisible();
+      expect(screen.getByText('NODES')).toBeVisible();
+    });
+  });
+
+  describe('CPUStats', () => {
+    it('renders CPU count with cores label', () => {
+      render(<CPUStats value={8} />);
+      expect(screen.getByText('8')).toBeVisible();
+      expect(screen.getByText('cores')).toBeVisible();
+    });
+  });
+
+  describe('MemoryStats', () => {
+    it('renders memory value with MEMORY label', () => {
+      render(<MemoryStats value="8 GB" />);
+      expect(screen.getByText('8 GB')).toBeVisible();
+      expect(screen.getByText('MEMORY')).toBeVisible();
+    });
+  });
+
+  describe('GpuStats', () => {
+    it('renders GPU count with GPUS label', () => {
+      render(<GpuStats value={4} />);
+      expect(screen.getByText('4')).toBeVisible();
+      expect(screen.getByText('GPUS')).toBeVisible();
+    });
+  });
+
+  describe('ContainerStats', () => {
+    it('renders running/total containers with a progress bar', () => {
+      render(<ContainerStats total={5} running={3} stopped={2} />);
+      expect(screen.getByText('3')).toBeVisible();
+      expect(screen.getByText('/ 5')).toBeVisible();
+      expect(screen.getByRole('progressbar')).toBeVisible();
+    });
+
+    it('renders a progress bar when total is zero', () => {
+      render(<ContainerStats total={0} running={0} stopped={0} />);
+      expect(screen.getByRole('progressbar')).toBeInTheDocument();
+    });
+  });
+});
diff --git a/app/react/components/StatsItem.tsx b/app/react/components/StatsItem.tsx
new file mode 100644
index 0000000..3555de1
--- /dev/null
+++ b/app/react/components/StatsItem.tsx
@@ -0,0 +1,104 @@
+import clsx from 'clsx';
+import { PropsWithChildren } from 'react';
+import { Cpu, Gpu, Hexagon, LaptopMinimal, MemoryStick } from 'lucide-react';
+
+import { Icon, IconProps } from '@/react/components/Icon';
+
+interface Props extends IconProps {
+  title?: string;
+  icon: IconProps['icon'];
+  iconClass?: string;
+}
+
+export function StatsItem({
+  title,
+  icon,
+  children,
+  iconClass,
+}: PropsWithChildren<Props>) {
+  return (
+    <div
+      className={clsx(
+        'flex flex-col items-center',
+        'h-full gap-1 rounded-lg p-2',
+        'bg-gray-2 th-highcontrast:bg-transparent th-dark:bg-gray-iron-10',
+        'border border-solid border-gray-4 th-dark:border-gray-8'
+      )}
+    >
+      <div className="flex items-center gap-1 text-[10px]">
+        <Icon className={clsx('icon icon-sm', iconClass)} icon={icon} />
+        <span>{title}</span>
+      </div>
+      <div className="flex w-full items-baseline gap-1">{children}</div>
+    </div>
+  );
+}
+
+interface StatsProps {
+  value: string | number | undefined;
+}
+
+export function NodeStats({ value }: StatsProps) {
+  return (
+    <StatsItem icon={LaptopMinimal} title="NODES">
+      <span className="text-left font-bold leading-none">{value}</span>
+    </StatsItem>
+  );
+}
+
+export function CPUStats({ value }: StatsProps) {
+  return (
+    <StatsItem icon={Cpu} title="CPUS">
+      <span className="min-w-[2ch] text-right font-bold tabular-nums leading-none">
+        {value}
+      </span>
+      <span className="align-baseline text-xs leading-none">cores</span>
+    </StatsItem>
+  );
+}
+
+export function MemoryStats({ value }: StatsProps) {
+  return (
+    <StatsItem icon={MemoryStick} title="MEMORY">
+      <span className="text-left font-bold leading-none">{value}</span>
+    </StatsItem>
+  );
+}
+
+export function GpuStats({ value }: StatsProps) {
+  return (
+    <StatsItem icon={Gpu} title="GPUS">
+      <span className="text-left font-bold leading-none">{value}</span>
+    </StatsItem>
+  );
+}
+
+interface ContainerStatsProps {
+  total: number;
+  running: number;
+  stopped: number;
+}
+
+export function ContainerStats({
+  total,
+  running,
+  stopped,
+}: ContainerStatsProps) {
+  const actualTotal = total || running + stopped;
+  return (
+    <StatsItem title="CONTAINERS" icon={Hexagon}>
+      <div className="flex w-full flex-col">
+        <div>
+          <span className="text-base font-bold leading-none">{running}</span>
+          <span> / {actualTotal}</span>
+        </div>
+        <progress
+          className="h-[4px] w-auto rounded bg-gray-4 th-dark:bg-white/10"
+          value={running}
+          max={Math.max(actualTotal, 1)}
+          aria-label={`${running} of ${actualTotal} containers running`}
+        />
+      </div>
+    </StatsItem>
+  );
+}
diff --git a/app/react/components/StatusBadge.stories.tsx b/app/react/components/StatusBadge.stories.tsx
new file mode 100644
index 0000000..21486a2
--- /dev/null
+++ b/app/react/components/StatusBadge.stories.tsx
@@ -0,0 +1,60 @@
+import { Meta, StoryObj } from '@storybook/react-webpack5';
+import { Check } from 'lucide-react';
+
+import { StatusBadge } from './StatusBadge';
+
+const meta: Meta<typeof StatusBadge> = {
+  title: 'Components/StatusBadge',
+  component: StatusBadge,
+};
+
+export default meta;
+
+type Story = StoryObj<typeof StatusBadge>;
+
+export const Default: Story = {
+  args: {
+    children: 'Default',
+  },
+};
+
+export const WithIcon: Story = {
+  args: {
+    icon: Check,
+    children: 'With Icon',
+  },
+};
+
+export const Success: Story = {
+  args: {
+    color: 'success',
+    children: 'Success',
+  },
+};
+
+export const Warning: Story = {
+  args: {
+    color: 'warning',
+    children: 'Warning',
+  },
+};
+
+export const Danger: Story = {
+  args: {
+    color: 'danger',
+    children: 'Danger',
+  },
+};
+
+export const WithChildren: Story = {
+  args: {
+    children: (
+      <>
+        <span role="img" aria-label="Star">
+          ⭐️
+        </span>
+        With Children
+      </>
+    ),
+  },
+};
diff --git a/app/react/components/StatusBadge.tsx b/app/react/components/StatusBadge.tsx
new file mode 100644
index 0000000..0a53f3f
--- /dev/null
+++ b/app/react/components/StatusBadge.tsx
@@ -0,0 +1,52 @@
+import { PropsWithChildren } from 'react';
+
+import { IconProps } from '@@/Icon';
+import { Badge, BadgeType } from '@@/Badge';
+
+export type StatusBadgeType =
+  | 'success'
+  | 'danger'
+  | 'warning'
+  | 'info'
+  | 'successLite'
+  | 'dangerLite'
+  | 'warningLite'
+  | 'mutedLite'
+  | 'infoLite'
+  | 'default';
+
+const typeToBadgeType: Record<StatusBadgeType, BadgeType | 'custom'> = {
+  success: 'success',
+  warning: 'warn',
+  danger: 'danger',
+  info: 'info',
+  successLite: 'successSecondary',
+  warningLite: 'warnSecondary',
+  dangerLite: 'dangerSecondary',
+  mutedLite: 'muted',
+  infoLite: 'infoSecondary',
+  default: 'custom',
+};
+
+/** @deprecated Use Badge directly */
+export function StatusBadge({
+  className,
+  children,
+  color = 'default',
+  icon,
+}: PropsWithChildren<{
+  className?: string;
+  color?: StatusBadgeType;
+  icon?: IconProps['icon'];
+}>) {
+  return (
+    <Badge
+      type={typeToBadgeType[color]}
+      shape="rect"
+      icon={icon}
+      className={className ?? ''}
+    >
+      {children}
+    </Badge>
+  );
+}
diff --git a/app/react/components/StatusSummaryBar/FilterBarActiveIndicator.stories.tsx b/app/react/components/StatusSummaryBar/FilterBarActiveIndicator.stories.tsx
new file mode 100644
index 0000000..e8f307c
--- /dev/null
+++ b/app/react/components/StatusSummaryBar/FilterBarActiveIndicator.stories.tsx
@@ -0,0 +1,51 @@
+import { useState } from 'react';
+import { Meta } from '@storybook/react-webpack5';
+
+import { FilterBarActiveIndicator } from './FilterBarActiveIndicator';
+
+export default {
+  component: FilterBarActiveIndicator,
+  title: 'Design System/StatusSummaryBar/FilterBarActiveIndicator',
+} as Meta;
+
+export function Example() {
+  const [activeFilter, setActiveFilter] = useState<string | null>('Running');
+
+  if (!activeFilter) {
+    return (
+      <div className="flex flex-col gap-3">
+        <p className="text-sm text-[var(--text-muted-color)]">
+          Filter cleared. Pick one to bring the indicator back.
+        </p>
+        <div className="flex gap-2">
+          {['Running', 'Stopped', 'Outdated'].map((label) => (
+            <button
+              key={label}
+              type="button"
+              className="rounded-md border border-solid border-gray-4 bg-transparent px-3 py-1 text-sm"
+              onClick={() => setActiveFilter(label)}
+            >
+              {label}
+            </button>
+          ))}
+        </div>
+      </div>
+    );
+  }
+
+  return (
+    <FilterBarActiveIndicator
+      label={activeFilter}
+      onClear={() => setActiveFilter(null)}
+    />
+  );
+}
+
+export function LongLabel() {
+  return (
+    <FilterBarActiveIndicator
+      label="Outdated agents in production environments"
+      onClear={() => {}}
+    />
+  );
+}
diff --git a/app/react/components/StatusSummaryBar/FilterBarActiveIndicator.tsx b/app/react/components/StatusSummaryBar/FilterBarActiveIndicator.tsx
new file mode 100644
index 0000000..8cc6cda
--- /dev/null
+++ b/app/react/components/StatusSummaryBar/FilterBarActiveIndicator.tsx
@@ -0,0 +1,30 @@
+interface Props {
+  label: string;
+  onClear: () => void;
+}
+
+export function FilterBarActiveIndicator({ label, onClear }: Props) {
+  return (
+    <div
+      role="status"
+      className="flex items-center gap-4 whitespace-nowrap bg-gray-2 px-5 th-highcontrast:bg-transparent th-dark:bg-gray-iron-10"
+      data-cy="active-filter-indicator"
+    >
+      <span className="text-sm text-[var(--text-muted-color)]">
+        Showing:{' '}
+        <span className="font-semibold text-[var(--text-summary-color)]">
+          {label}
+        </span>
+      </span>
+      <button
+        type="button"
+        className="cursor-pointer border-0 bg-transparent p-0 text-xl font-bold leading-none text-[var(--button-close-color)] opacity-[var(--button-opacity)] hover:opacity-[var(--button-opacity-hover)]"
+        onClick={onClear}
+        aria-label="Clear filter"
+        data-cy="clear-filter-button"
+      >
+        &times;
+      </button>
+    </div>
+  );
+}
diff --git a/app/react/components/StatusSummaryBar/FilterBarButton.stories.tsx b/app/react/components/StatusSummaryBar/FilterBarButton.stories.tsx
new file mode 100644
index 0000000..6894a05
--- /dev/null
+++ b/app/react/components/StatusSummaryBar/FilterBarButton.stories.tsx
@@ -0,0 +1,44 @@
+import { useState } from 'react';
+import { Meta } from '@storybook/react-webpack5';
+
+import { FilterBarButton, Color } from './FilterBarButton';
+
+export default {
+  component: FilterBarButton,
+  title: 'Design System/StatusSummaryBar/FilterBarButton',
+} as Meta;
+
+export function Example() {
+  const [selected, setSelected] = useState('');
+
+  const buttons: Array<{
+    label: string;
+    count: number;
+    color?: Color;
+  }> = [
+    { label: 'Total', count: 18 },
+    { label: 'Running', count: 12, color: 'success' },
+    { label: 'Stopped', count: 4, color: 'error' },
+    { label: 'Outdated', count: 2, color: 'warning' },
+    { label: 'Hidden', count: 0, color: 'gray' },
+  ];
+
+  return (
+    <div className="flex items-center gap-1">
+      {buttons.map((btn) => (
+        <FilterBarButton
+          key={btn.label}
+          name="status-filter"
+          label={btn.label}
+          count={btn.count}
+          color={btn.color}
+          isSelected={selected === btn.label}
+          onClick={() =>
+            setSelected((prev) => (prev === btn.label ? '' : btn.label))
+          }
+          data-cy={`filter-${btn.label.toLowerCase()}`}
+        />
+      ))}
+    </div>
+  );
+}
diff --git a/app/react/components/StatusSummaryBar/FilterBarButton.test.tsx b/app/react/components/StatusSummaryBar/FilterBarButton.test.tsx
new file mode 100644
index 0000000..b4bec1c
--- /dev/null
+++ b/app/react/components/StatusSummaryBar/FilterBarButton.test.tsx
@@ -0,0 +1,45 @@
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+
+import { FilterBarButton } from './FilterBarButton';
+
+function renderComponent(
+  props: Partial<React.ComponentProps<typeof FilterBarButton>> = {}
+) {
+  const defaultProps: React.ComponentProps<typeof FilterBarButton> = {
+    count: 5,
+    label: 'Running',
+    isSelected: false,
+    onClick: vi.fn(),
+    name: 'status-filter',
+    'data-cy': 'filter-bar-button',
+    ...props,
+  };
+
+  return {
+    ...render(<FilterBarButton {...defaultProps} />),
+    props: defaultProps,
+  };
+}
+
+describe('FilterBarButton', () => {
+  it('should render count and label, and call onClick when clicked', async () => {
+    const user = userEvent.setup();
+    const onClick = vi.fn();
+    renderComponent({ onClick, color: 'success' });
+
+    expect(screen.getByText('5')).toBeVisible();
+    expect(screen.getByText('Running')).toBeVisible();
+    expect(
+      screen.getByRole('radio', { name: /filter by running/i })
+    ).toBeVisible();
+
+    await user.click(screen.getByText('Running'));
+    expect(onClick).toHaveBeenCalledOnce();
+  });
+
+  it('should return null when count is 0', () => {
+    const { container } = renderComponent({ count: 0 });
+    expect(container).toBeEmptyDOMElement();
+  });
+});
diff --git a/app/react/components/StatusSummaryBar/FilterBarButton.tsx b/app/react/components/StatusSummaryBar/FilterBarButton.tsx
new file mode 100644
index 0000000..f92d861
--- /dev/null
+++ b/app/react/components/StatusSummaryBar/FilterBarButton.tsx
@@ -0,0 +1,105 @@
+import clsx from 'clsx';
+
+import { AutomationTestingProps } from '@/types';
+
+export type Color = 'success' | 'error' | 'warning' | 'blue' | 'gray';
+
+const colorStyles: Record<Color, { dot: string; text: string }> = {
+  success: { dot: 'bg-success-7', text: 'text-success-7' },
+  error: { dot: 'bg-error-7', text: 'text-error-7' },
+  warning: { dot: 'bg-warning-7', text: 'text-warning-7' },
+  blue: { dot: 'bg-blue-7', text: 'text-blue-7' },
+  gray: { dot: 'bg-gray-7', text: 'text-gray-7' },
+};
+
+interface Props extends AutomationTestingProps {
+  count: number;
+  label: string;
+  isSelected: boolean;
+  onClick: () => void;
+  name: string;
+  color?: Color;
+  isLoading?: boolean;
+}
+
+export function FilterBarButton({
+  count,
+  label,
+  isSelected,
+  onClick,
+  name,
+  color,
+  isLoading = false,
+  'data-cy': dataCy,
+}: Props) {
+  if (!isLoading && count === 0) {
+    return null;
+  }
+
+  const colors = color ? colorStyles[color] : undefined;
+  return (
+    <label
+      className={clsx(
+        'relative mb-0 flex items-center gap-2',
+        'px-8 py-3',
+        'cursor-pointer border-0',
+        'text-sm font-medium',
+        'text-[var(--text-muted-color)]',
+        'hover:bg-[var(--bg-blocklist-item-selected-color)]',
+        'transition-colors duration-150',
+        'has-[:focus-visible]:ring-2 has-[:focus-visible]:ring-blue-5 has-[:focus-visible]:ring-inset',
+        isSelected && 'bg-[var(--bg-blocklist-item-selected-color)]'
+      )}
+      data-cy={dataCy}
+    >
+      <input
+        type="radio"
+        className="sr-only"
+        name={name}
+        value={label}
+        checked={isSelected}
+        onClick={onClick}
+        readOnly
+        aria-label={`Filter by ${label}`}
+        tabIndex={0}
+      />
+      {colors && (
+        <span
+          className={clsx('h-2.5 w-2.5 shrink-0 rounded-full', colors.dot)}
+          aria-hidden="true"
+        />
+      )}
+      {colors && (
+        <span className="flex flex-col leading-tight">
+          <span className={clsx('text-2xl font-bold', colors.text)}>
+            {count}
+          </span>
+          <span className="text-xs uppercase tracking-wide text-[var(--text-muted-color)]">
+            {label}
+          </span>
+        </span>
+      )}
+      {!colors && (
+        <span className="flex items-baseline gap-2">
+          {isLoading ? (
+            <span className="h-8 w-8 animate-pulse rounded bg-gray-3 th-dark:bg-gray-8" />
+          ) : (
+            <span className="text-2xl font-bold">{count}</span>
+          )}
+          <span className="text-base uppercase tracking-wide text-[var(--text-muted-color)]">
+            {label}
+          </span>
+        </span>
+      )}
+      {isSelected && (
+        <span
+          className={clsx(
+            'absolute bottom-0 left-0 right-0 h-1',
+            colors?.dot || 'bg-blue-7'
+          )}
+          aria-hidden="true"
+        />
+      )}
+    </label>
+  );
+}
diff --git a/app/react/components/StatusSummaryBar/StatusSummaryBar.stories.tsx b/app/react/components/StatusSummaryBar/StatusSummaryBar.stories.tsx
new file mode 100644
index 0000000..6359109
--- /dev/null
+++ b/app/react/components/StatusSummaryBar/StatusSummaryBar.stories.tsx
@@ -0,0 +1,83 @@
+import { useState } from 'react';
+import { Meta } from '@storybook/react-webpack5';
+
+import { StatusSummaryBar, StatusSegment } from './StatusSummaryBar';
+
+export default {
+  component: StatusSummaryBar,
+  title: 'Design System/StatusSummaryBar',
+} as Meta;
+
+const environmentSegments: StatusSegment[] = [
+  { key: 'up', label: 'Up', count: 12, color: 'success' },
+  { key: 'down', label: 'Down', count: 3, color: 'error' },
+  { key: 'outdated', label: 'Outdated', count: 2, color: 'warning' },
+  { key: 'unassigned', label: 'Unassigned', count: 5, color: 'gray' },
+];
+
+export function Environments() {
+  const [filter, setFilter] = useState<string | null>(null);
+
+  return (
+    <div className="flex flex-col gap-4">
+      <StatusSummaryBar
+        total={22}
+        segments={environmentSegments}
+        value={filter}
+        onChange={setFilter}
+        data-cy="environment-status-bar"
+        ariaLabel="Filter by environment status"
+      />
+      <div className="rounded-lg border border-solid border-gray-4 p-4 text-sm">
+        Active filter: <strong>{filter}</strong>
+      </div>
+    </div>
+  );
+}
+
+const containerSegments: StatusSegment[] = [
+  { key: 'running', label: 'Running', count: 45, color: 'success' },
+  { key: 'stopped', label: 'Stopped', count: 8, color: 'error' },
+  { key: 'healthy', label: 'Healthy', count: 40, color: 'blue' },
+  { key: 'unhealthy', label: 'Unhealthy', count: 5, color: 'warning' },
+];
+
+export function Containers() {
+  const [filter, setFilter] = useState<string | null>(null);
+
+  return (
+    <div className="flex flex-col gap-4">
+      <StatusSummaryBar
+        total={53}
+        segments={containerSegments}
+        value={filter}
+        onChange={setFilter}
+        data-cy="container-status-bar"
+        ariaLabel="Filter by container status"
+      />
+      <div className="rounded-lg border border-solid border-gray-4 p-4 text-sm">
+        Active filter: <strong>{filter}</strong>
+      </div>
+    </div>
+  );
+}
+
+export function WithZeroCounts() {
+  const [filter, setFilter] = useState<string | null>(null);
+
+  const segments: StatusSegment[] = [
+    { key: 'up', label: 'Up', count: 5, color: 'success' },
+    { key: 'down', label: 'Down', count: 0, color: 'error' },
+    { key: 'outdated', label: 'Outdated', count: 0, color: 'warning' },
+  ];
+
+  return (
+    <StatusSummaryBar
+      total={5}
+      segments={segments}
+      value={filter}
+      onChange={setFilter}
+      ariaLabel="Filter with zero counts"
+    />
+  );
+}
diff --git a/app/react/components/StatusSummaryBar/StatusSummaryBar.test.tsx b/app/react/components/StatusSummaryBar/StatusSummaryBar.test.tsx
new file mode 100644
index 0000000..f717c5c
--- /dev/null
+++ b/app/react/components/StatusSummaryBar/StatusSummaryBar.test.tsx
@@ -0,0 +1,106 @@
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+
+import { StatusSummaryBar, StatusSegment } from './StatusSummaryBar';
+
+const defaultSegments: StatusSegment[] = [
+  { key: 'up', label: 'Up', count: 7, color: 'success' },
+  { key: 'down', label: 'Down', count: 2, color: 'error' },
+  { key: 'outdated', label: 'Outdated', count: 1, color: 'warning' },
+  { key: 'unassigned', label: 'Unassigned', count: 0, color: 'gray' },
+];
+
+function renderComponent(
+  props: Partial<React.ComponentProps<typeof StatusSummaryBar>> = {}
+) {
+  const defaultProps: React.ComponentProps<typeof StatusSummaryBar> = {
+    total: 10,
+    segments: defaultSegments,
+    value: null,
+    onChange: vi.fn(),
+    ...props,
+  };
+
+  return {
+    ...render(<StatusSummaryBar {...defaultProps} />),
+    props: defaultProps,
+  };
+}
+
+describe('StatusSummaryBar', () => {
+  it('should render total and each non-zero segment', () => {
+    renderComponent();
+
+    expect(
+      screen.getByRole('radio', { name: /filter by total/i })
+    ).toBeVisible();
+    expect(screen.getByRole('radio', { name: /filter by up/i })).toBeVisible();
+    expect(
+      screen.getByRole('radio', { name: /filter by down/i })
+    ).toBeVisible();
+    expect(
+      screen.getByRole('radio', { name: /filter by outdated/i })
+    ).toBeVisible();
+    // Unassigned has count 0, FilterBarButton returns null
+    expect(
+      screen.queryByRole('radio', { name: /filter by unassigned/i })
+    ).not.toBeInTheDocument();
+  });
+
+  it('should call onChange with segment key when clicked', async () => {
+    const user = userEvent.setup();
+    const onChange = vi.fn();
+    renderComponent({ onChange });
+
+    await user.click(screen.getByRole('radio', { name: /filter by up/i }));
+    expect(onChange).toHaveBeenCalledWith('up');
+  });
+
+  it('should toggle back to all when clicking the active segment', async () => {
+    const user = userEvent.setup();
+    const onChange = vi.fn();
+    renderComponent({ value: 'up', onChange });
+
+    await user.click(screen.getByRole('radio', { name: /filter by up/i }));
+    expect(onChange).toHaveBeenCalledWith(null);
+  });
+
+  it('should reset to all when Total is clicked', async () => {
+    const user = userEvent.setup();
+    const onChange = vi.fn();
+    renderComponent({ value: 'down', onChange });
+
+    await user.click(screen.getByRole('radio', { name: /filter by total/i }));
+    expect(onChange).toHaveBeenCalledWith(null);
+  });
+
+  it('should show the active filter indicator with a clear button', async () => {
+    const user = userEvent.setup();
+    const onChange = vi.fn();
+    renderComponent({ value: 'down', onChange });
+
+    expect(screen.getByRole('status')).toBeVisible();
+    expect(
+      screen.getByRole('button', { name: /clear filter/i })
+    ).toBeInTheDocument();
+
+    await user.click(screen.getByRole('button', { name: /clear filter/i }));
+    expect(onChange).toHaveBeenCalledWith(null);
+  });
+
+  it('should not show the active filter indicator when no filter is active', () => {
+    renderComponent({ value: null });
+
+    expect(
+      screen.queryByRole('button', { name: /clear filter/i })
+    ).not.toBeInTheDocument();
+  });
+
+  it('should have radiogroup role with the provided aria label', () => {
+    renderComponent({ ariaLabel: 'Filter environments' });
+
+    expect(
+      screen.getByRole('radiogroup', { name: 'Filter environments' })
+    ).toBeVisible();
+  });
+});
diff --git a/app/react/components/StatusSummaryBar/StatusSummaryBar.tsx b/app/react/components/StatusSummaryBar/StatusSummaryBar.tsx
new file mode 100644
index 0000000..36ee494
--- /dev/null
+++ b/app/react/components/StatusSummaryBar/StatusSummaryBar.tsx
@@ -0,0 +1,108 @@
+import { ReactNode } from 'react';
+import clsx from 'clsx';
+
+import { FilterBarButton, Color } from './FilterBarButton';
+import { FilterBarActiveIndicator } from './FilterBarActiveIndicator';
+
+export interface StatusSegment<TValue = string> {
+  key: TValue;
+  label: string;
+  count: number;
+  color: Color;
+}
+
+interface Props<TValue> {
+  total: number;
+  segments: Array<StatusSegment<TValue>>;
+  value: TValue | null;
+  onChange: (filter: TValue | null) => void;
+  radioGroupName?: string;
+  ariaLabel?: string;
+  isLoading?: boolean;
+  'data-cy'?: string;
+  rightSlot?: ReactNode;
+}
+
+export function StatusSummaryBar<TValue extends string = string>({
+  total,
+  segments,
+  value,
+  onChange,
+  radioGroupName = 'status-summary-filter',
+  ariaLabel = 'Filter by status',
+  isLoading = false,
+  'data-cy': dataCy = 'status-summary-bar',
+  rightSlot,
+}: Props<TValue>) {
+  const isAllSelected = !value || value === 'all' || value === 'custom';
+  const activeLabel = segments.find((s) => s.key === value)?.label;
+
+  function handleSegmentClick(key: TValue) {
+    onChange(value === key ? null : key);
+  }
+
+  return (
+    <div
+      className={clsx(
+        'relative flex flex-wrap items-stretch',
+        'border border-solid',
+        'border-gray-5 th-highcontrast:border-white th-dark:border-gray-8',
+        'overflow-y-hidden rounded-lg',
+        'bg-white th-highcontrast:bg-transparent th-dark:bg-graphite-800'
+      )}
+      data-cy={dataCy}
+      role="radiogroup"
+      aria-label={ariaLabel}
+    >
+      <FilterBarButton
+        count={total}
+        label="Total"
+        isSelected={isAllSelected}
+        onClick={() => onChange(null)}
+        name={radioGroupName}
+        isLoading={isLoading}
+        data-cy={`${dataCy}-total`}
+      />
+
+      <Separator />
+
+      {segments.map(({ key, label, count, color }) => (
+        <FilterBarButton
+          key={key}
+          color={color}
+          count={count}
+          label={label}
+          isSelected={value === key}
+          onClick={() => handleSegmentClick(key)}
+          name={radioGroupName}
+          data-cy={`${dataCy}-${key}`}
+        />
+      ))}
+
+      {rightSlot ? (
+        <div className="ml-auto flex items-center">
+          <div className="flex items-center px-3">{rightSlot}</div>
+        </div>
+      ) : (
+        activeLabel && (
+          <div className="ml-auto hidden xl:!flex">
+            <Separator />
+            <FilterBarActiveIndicator
+              label={activeLabel}
+              onClear={() => onChange(null)}
+            />
+          </div>
+        )
+      )}
+    </div>
+  );
+}
+
+function Separator() {
+  return (
+    <div
+      className="w-px shrink-0 self-stretch bg-[var(--border-widget)]"
+      aria-hidden="true"
+    />
+  );
+}
diff --git a/app/react/components/Stepper/Step.tsx b/app/react/components/Stepper/Step.tsx
new file mode 100644
index 0000000..9af3cd5
--- /dev/null
+++ b/app/react/components/Stepper/Step.tsx
@@ -0,0 +1,165 @@
+import clsx from 'clsx';
+import { Check } from 'lucide-react';
+
+import { Icon } from '@@/Icon';
+
+export interface StepData {
+  label: string;
+  /** Allow this step to be clicked even when it hasn't been reached yet */
+  enabled?: boolean;
+}
+
+interface Props {
+  step: StepData;
+  index: number;
+  currentStepIndex: number;
+  isLast: boolean;
+  onStepClick?: (stepIndex: number) => void;
+}
+
+type StepStateLabel = 'completed' | 'current' | 'upcoming';
+
+interface StepState {
+  isActive: boolean;
+  isCompleted: boolean;
+  isClickable?: boolean;
+}
+
+export function Step({
+  step,
+  index,
+  currentStepIndex,
+  isLast,
+  onStepClick,
+}: Props) {
+  const isActive = index === currentStepIndex;
+  const isCompleted = index < currentStepIndex;
+  const isClickable = !!onStepClick && (isCompleted || !!step.enabled);
+  const displayNumber = index + 1;
+  const stepState = getStepState({ isActive, isCompleted });
+
+  return (
+    <div className="flex items-center gap-2">
+      <button
+        type="button"
+        onClick={() => isClickable && onStepClick?.(index)}
+        disabled={!isClickable}
+        className={getButtonClasses({
+          isActive,
+          isCompleted,
+          isClickable,
+        })}
+        aria-label={`Step ${displayNumber}: ${step.label}, ${stepState}`}
+        aria-current={isActive ? 'step' : undefined}
+        data-cy={`stepper-step-${index}`}
+        data-step-state={stepState}
+      >
+        <span className={getBadgeClasses({ isCompleted })} aria-hidden="true">
+          {isCompleted ? <Icon icon={Check} size="xs" /> : displayNumber}
+        </span>
+        <span className="whitespace-nowrap text-sm">{step.label}</span>
+      </button>
+
+      {!isLast && (
+        <div
+          className={getConnectorClasses({ isCompleted })}
+          aria-hidden="true"
+        />
+      )}
+    </div>
+  );
+}
+
+function getStepState({
+  isActive,
+  isCompleted,
+}: Pick<StepState, 'isActive' | 'isCompleted'>): StepStateLabel {
+  if (isCompleted) {
+    return 'completed';
+  }
+  if (isActive) {
+    return 'current';
+  }
+  return 'upcoming';
+}
+
+function getButtonClasses({ isActive, isCompleted, isClickable }: StepState) {
+  return clsx(
+    'flex items-center gap-2 rounded-lg border border-solid px-3 py-2 font-medium text-inherit transition-all',
+    getButtonStateClasses({ isActive, isCompleted }),
+    isClickable
+      ? clsx(
+          'cursor-pointer hover:border-blue-6 hover:bg-blue-3',
+          'th-dark:hover:border-blue-5 th-dark:hover:bg-blue-9/30',
+          'th-highcontrast:hover:border-blue-4 th-highcontrast:hover:bg-blue-9/40'
+        )
+      : 'cursor-default'
+  );
+}
+
+function getButtonStateClasses({
+  isActive,
+  isCompleted,
+}: Omit<StepState, 'isClickable'>) {
+  if (isActive) {
+    return clsx(
+      'border-blue-6 bg-blue-2',
+      'th-dark:border-blue-7 th-dark:bg-blue-10',
+      'th-highcontrast:border-blue-7 th-highcontrast:bg-blue-10'
+    );
+  }
+
+  if (isCompleted) {
+    return clsx(
+      'border-graphite-700 bg-graphite-700/5',
+      'th-dark:border-gray-warm-5 th-dark:bg-gray-warm-9',
+      'th-highcontrast:border-gray-4 th-highcontrast:bg-gray-9'
+    );
+  }
+
+  return clsx(
+    'border-gray-5 bg-white',
+    'th-dark:border-gray-warm-7 th-dark:bg-gray-iron-10',
+    'th-highcontrast:border-gray-2 th-highcontrast:bg-black'
+  );
+}
+
+function getBadgeClasses({ isCompleted }: Pick<StepState, 'isCompleted'>) {
+  const base = 'flex h-6 w-6 items-center justify-center rounded-full text-xs';
+
+  if (isCompleted) {
+    return clsx(
+      base,
+      'bg-graphite-700 text-mist-100',
+      'th-dark:bg-gray-warm-5 th-dark:text-gray-iron-10',
+      'th-highcontrast:bg-gray-4 th-highcontrast:text-black'
+    );
+  }
+
+  return clsx(
+    base,
+    'bg-gray-4 text-gray-7',
+    'th-dark:bg-gray-warm-7 th-dark:text-white',
+    'th-highcontrast:bg-gray-8 th-highcontrast:text-white'
+  );
+}
+
+function getConnectorClasses({ isCompleted }: Pick<StepState, 'isCompleted'>) {
+  const base = 'h-0.5 w-8 transition-colors';
+
+  if (isCompleted) {
+    return clsx(
+      base,
+      'bg-graphite-700',
+      'th-dark:bg-gray-warm-5',
+      'th-highcontrast:bg-gray-4'
+    );
+  }
+
+  return clsx(
+    base,
+    'bg-gray-5',
+    'th-dark:bg-gray-warm-7',
+    'th-highcontrast:bg-gray-6'
+  );
+}
diff --git a/app/react/components/Stepper/Stepper.stories.tsx b/app/react/components/Stepper/Stepper.stories.tsx
new file mode 100644
index 0000000..14b08e4
--- /dev/null
+++ b/app/react/components/Stepper/Stepper.stories.tsx
@@ -0,0 +1,81 @@
+import { Meta, StoryObj } from '@storybook/react-webpack5';
+import { useState } from 'react';
+
+import { Button } from '@@/buttons';
+
+import { Step, Stepper } from './Stepper';
+
+export default {
+  component: Stepper,
+  title: 'Components/Stepper',
+} as Meta;
+
+interface Args {
+  totalSteps: number;
+}
+
+function Template({ totalSteps = 5 }: Args) {
+  const steps: Array<Step> = Array.from({ length: totalSteps }).map(
+    (_, index) => ({
+      label: `Step ${index + 1}`,
+    })
+  );
+
+  const [currentStepIndex, setCurrentStepIndex] = useState(0);
+
+  return (
+    <div className="flex flex-col gap-4">
+      <Stepper currentStepIndex={currentStepIndex} steps={steps} />
+      <div className="flex gap-2">
+        <Button
+          onClick={() => setCurrentStepIndex(currentStepIndex - 1)}
+          data-cy="previous-button"
+          disabled={currentStepIndex <= 0}
+        >
+          Previous
+        </Button>
+        <Button
+          onClick={() => setCurrentStepIndex(currentStepIndex + 1)}
+          data-cy="next-button"
+          disabled={currentStepIndex >= steps.length - 1}
+        >
+          Next
+        </Button>
+      </div>
+    </div>
+  );
+}
+
+export { Template };
+
+function ClickableTemplate({ totalSteps = 4 }: Args) {
+  const steps: Array<Step> = [
+    { label: 'Select Environment' },
+    { label: 'Configure' },
+    { label: 'Review' },
+    { label: 'Deploy' },
+  ].slice(0, totalSteps);
+
+  const [currentStepIndex, setCurrentStepIndex] = useState(2);
+
+  return (
+    <div className="flex flex-col gap-4">
+      <Stepper
+        currentStepIndex={currentStepIndex}
+        steps={steps}
+        onStepClick={(stepIndex) => setCurrentStepIndex(stepIndex)}
+      />
+      <p className="text-sm text-gray-6">
+        Click on completed or current steps to navigate. Current step:{' '}
+        {currentStepIndex + 1}
+      </p>
+    </div>
+  );
+}
+
+export const Clickable: StoryObj<Args> = {
+  render: ClickableTemplate,
+  args: {
+    totalSteps: 4,
+  },
+};
diff --git a/app/react/components/Stepper/Stepper.tsx b/app/react/components/Stepper/Stepper.tsx
new file mode 100644
index 0000000..1755e83
--- /dev/null
+++ b/app/react/components/Stepper/Stepper.tsx
@@ -0,0 +1,31 @@
+import { Step, StepData } from './Step';
+
+export type { StepData as Step };
+
+interface Props {
+  /** 0-based index of the current step */
+  currentStepIndex: number;
+  steps: Array<StepData>;
+  /** Callback with 0-based step index */
+  onStepClick?: (stepIndex: number) => void;
+}
+
+export function Stepper({ currentStepIndex, steps, onStepClick }: Props) {
+  return (
+    <nav
+      aria-label="Progress steps"
+      className="flex flex-wrap items-center gap-2"
+    >
+      {steps.map((step, index) => (
+        <Step
+          key={step.label}
+          step={step}
+          index={index}
+          currentStepIndex={currentStepIndex}
+          isLast={index === steps.length - 1}
+          onStepClick={onStepClick}
+        />
+      ))}
+    </nav>
+  );
+}
diff --git a/app/react/components/Stepper/useWizardSteps.test.ts b/app/react/components/Stepper/useWizardSteps.test.ts
new file mode 100644
index 0000000..0a1fb95
--- /dev/null
+++ b/app/react/components/Stepper/useWizardSteps.test.ts
@@ -0,0 +1,149 @@
+import { renderHook, act } from '@testing-library/react-hooks';
+
+import { useWizardSteps, StepConfig } from './useWizardSteps';
+
+const testSteps: Array<StepConfig> = [
+  { id: 'step-1', label: 'First Step' },
+  { id: 'step-2', label: 'Second Step' },
+  { id: 'step-3', label: 'Third Step' },
+];
+
+describe('useWizardSteps', () => {
+  describe('initial state', () => {
+    it('should start at the first step by default', () => {
+      const { result } = renderHook(() => useWizardSteps({ steps: testSteps }));
+
+      expect(result.current.currentStep).toEqual(testSteps[0]);
+      expect(result.current.currentStepIndex).toBe(0);
+      expect(result.current.isFirstStep).toBe(true);
+      expect(result.current.isLastStep).toBe(false);
+      expect(result.current.canGoBack).toBe(false);
+      expect(result.current.canGoForward).toBe(true);
+    });
+
+    it('should start at the specified initial step', () => {
+      const { result } = renderHook(() =>
+        useWizardSteps({ steps: testSteps, initialStepId: 'step-2' })
+      );
+
+      expect(result.current.currentStep).toEqual(testSteps[1]);
+      expect(result.current.currentStepIndex).toBe(1);
+      expect(result.current.isFirstStep).toBe(false);
+      expect(result.current.isLastStep).toBe(false);
+    });
+
+    it('should default to first step if initialStepId is invalid', () => {
+      const { result } = renderHook(() =>
+        useWizardSteps({ steps: testSteps, initialStepId: 'invalid-id' })
+      );
+
+      expect(result.current.currentStepIndex).toBe(0);
+      expect(result.current.currentStep).toEqual(testSteps[0]);
+    });
+  });
+
+  describe('goToNextStep', () => {
+    it('should advance to the next step', () => {
+      const { result } = renderHook(() => useWizardSteps({ steps: testSteps }));
+
+      act(() => {
+        result.current.goToNextStep();
+      });
+
+      expect(result.current.currentStepIndex).toBe(1);
+      expect(result.current.currentStep).toEqual(testSteps[1]);
+    });
+
+    it('should not advance past the last step', () => {
+      const { result } = renderHook(() =>
+        useWizardSteps({ steps: testSteps, initialStepId: 'step-3' })
+      );
+      expect(result.current.isLastStep).toBe(true);
+
+      act(() => {
+        result.current.goToNextStep();
+      });
+
+      expect(result.current.currentStepIndex).toBe(2);
+      expect(result.current.isLastStep).toBe(true);
+    });
+  });
+
+  describe('goToPreviousStep', () => {
+    it('should go back to the previous step', () => {
+      const { result } = renderHook(() =>
+        useWizardSteps({ steps: testSteps, initialStepId: 'step-2' })
+      );
+
+      act(() => {
+        result.current.goToPreviousStep();
+      });
+
+      expect(result.current.currentStepIndex).toBe(0);
+      expect(result.current.currentStep).toEqual(testSteps[0]);
+    });
+
+    it('should not go back before the first step', () => {
+      const { result } = renderHook(() => useWizardSteps({ steps: testSteps }));
+
+      act(() => {
+        result.current.goToPreviousStep();
+      });
+
+      expect(result.current.currentStepIndex).toBe(0);
+      expect(result.current.isFirstStep).toBe(true);
+    });
+  });
+
+  describe('goToStep', () => {
+    it('should navigate to a step by id', () => {
+      const { result } = renderHook(() => useWizardSteps({ steps: testSteps }));
+
+      act(() => {
+        result.current.goToStep('step-3');
+      });
+
+      expect(result.current.currentStepIndex).toBe(2);
+      expect(result.current.currentStep).toEqual(testSteps[2]);
+    });
+
+    it('should not change step if id is invalid', () => {
+      const { result } = renderHook(() => useWizardSteps({ steps: testSteps }));
+
+      act(() => {
+        result.current.goToStep('invalid-id');
+      });
+
+      expect(result.current.currentStepIndex).toBe(0);
+    });
+  });
+
+  describe('goToStepByIndex', () => {
+    it('should navigate to a step by index', () => {
+      const { result } = renderHook(() => useWizardSteps({ steps: testSteps }));
+
+      act(() => {
+        result.current.goToStepByIndex(2);
+      });
+
+      expect(result.current.currentStepIndex).toBe(2);
+      expect(result.current.currentStep).toEqual(testSteps[2]);
+    });
+
+    it('should not change step if index is out of bounds', () => {
+      const { result } = renderHook(() => useWizardSteps({ steps: testSteps }));
+
+      act(() => {
+        result.current.goToStepByIndex(10);
+      });
+
+      expect(result.current.currentStepIndex).toBe(0);
+
+      act(() => {
+        result.current.goToStepByIndex(-1);
+      });
+
+      expect(result.current.currentStepIndex).toBe(0);
+    });
+  });
+});
diff --git a/app/react/components/Stepper/useWizardSteps.ts b/app/react/components/Stepper/useWizardSteps.ts
new file mode 100644
index 0000000..e06b4c0
--- /dev/null
+++ b/app/react/components/Stepper/useWizardSteps.ts
@@ -0,0 +1,81 @@
+import { useState, useCallback, useMemo } from 'react';
+
+export interface StepConfig {
+  id: string;
+  label: string;
+}
+
+interface UseWizardStepsOptions<T extends StepConfig = StepConfig> {
+  steps: Array<T>;
+  initialStepId?: string;
+}
+
+export interface WizardStepState<T extends StepConfig = StepConfig> {
+  currentStep: T;
+  currentStepIndex: number;
+  isFirstStep: boolean;
+  isLastStep: boolean;
+  canGoBack: boolean;
+  canGoForward: boolean;
+  goToNextStep: () => void;
+  goToPreviousStep: () => void;
+  goToStep: (stepId: string) => void;
+  goToStepByIndex: (index: number) => void;
+}
+
+export function useWizardSteps<T extends StepConfig = StepConfig>({
+  steps,
+  initialStepId,
+}: UseWizardStepsOptions<T>): WizardStepState<T> {
+  const initialIndex = useMemo(() => {
+    if (!initialStepId) return 0;
+    const index = steps.findIndex((s) => s.id === initialStepId);
+    return Math.max(0, index);
+  }, [initialStepId, steps]);
+
+  const [stepIndex, setStepIndex] = useState(initialIndex);
+
+  const currentStep = steps[stepIndex];
+  const isFirstStep = stepIndex === 0;
+  const isLastStep = stepIndex === steps.length - 1;
+
+  const goToNextStep = useCallback(() => {
+    setStepIndex((i) => (i < steps.length - 1 ? i + 1 : i));
+  }, [steps.length]);
+
+  const goToPreviousStep = useCallback(() => {
+    setStepIndex((i) => (i > 0 ? i - 1 : i));
+  }, []);
+
+  const goToStep = useCallback(
+    (stepId: string) => {
+      const index = steps.findIndex((s) => s.id === stepId);
+      if (index !== -1) {
+        setStepIndex(index);
+      }
+    },
+    [steps]
+  );
+
+  const goToStepByIndex = useCallback(
+    (index: number) => {
+      if (index >= 0 && index < steps.length) {
+        setStepIndex(index);
+      }
+    },
+    [steps.length]
+  );
+
+  return {
+    currentStep,
+    currentStepIndex: stepIndex,
+    isFirstStep,
+    isLastStep,
+    canGoBack: !isFirstStep,
+    canGoForward: !isLastStep,
+    goToNextStep,
+    goToPreviousStep,
+    goToStep,
+    goToStepByIndex,
+  };
+}
diff --git a/app/react/components/StickyFooter/StickyFooter.module.css b/app/react/components/StickyFooter/StickyFooter.module.css
new file mode 100644
index 0000000..d088081
--- /dev/null
+++ b/app/react/components/StickyFooter/StickyFooter.module.css
@@ -0,0 +1,13 @@
+.actionBar {
+  /* Match the sidebar offset - uses the same CSS variable as the page-wrapper */
+  left: var(--sidebar-closed-width, 72px);
+
+  /* Must match sidebar transition exactly: all 0.4s ease 0s */
+  transition: all 0.4s ease 0s;
+  border-top: 1px solid var(--border-widget);
+}
+
+/* When sidebar is open, adjust the left position using global class */
+:global(#page-wrapper.open) .actionBar {
+  left: var(--sidebar-width, 300px);
+}
diff --git a/app/react/components/StickyFooter/StickyFooter.stories.tsx b/app/react/components/StickyFooter/StickyFooter.stories.tsx
new file mode 100644
index 0000000..b124d27
--- /dev/null
+++ b/app/react/components/StickyFooter/StickyFooter.stories.tsx
@@ -0,0 +1,129 @@
+import { Meta, StoryObj } from '@storybook/react-webpack5';
+
+import { Button } from '@@/buttons';
+
+import { StickyFooter } from './StickyFooter';
+
+export default {
+  component: StickyFooter,
+  title: 'Components/StickyActionBar',
+  parameters: {
+    layout: 'fullscreen',
+  },
+  decorators: [
+    (Story) => (
+      <StickyFooter.Container>
+        <div
+          className="h-[200vh] pt-12"
+          // adding eslint and ts ignore errors because style type doesn't support css variables
+          // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+          // @ts-expect-error
+          style={{ '--sidebar-closed-width': 0 }}
+        >
+          <p className="px-6">
+            Scroll down to see the sticky action bar at the bottom of the
+            viewport.
+          </p>
+          <Story />
+        </div>
+      </StickyFooter.Container>
+    ),
+  ],
+} as Meta<typeof StickyFooter>;
+
+type Story = StoryObj<typeof StickyFooter>;
+
+export function SpaceBetween() {
+  return (
+    <StickyFooter className="justify-between">
+      <Button color="default" onClick={() => {}} data-cy="cancel-button">
+        Cancel
+      </Button>
+      <Button color="primary" onClick={() => {}} data-cy="save-button">
+        Save
+      </Button>
+    </StickyFooter>
+  );
+}
+
+export function RightAligned() {
+  return (
+    <StickyFooter className="justify-end gap-3">
+      <Button color="default" onClick={() => {}} data-cy="cancel-button">
+        Cancel
+      </Button>
+      <Button color="primary" onClick={() => {}} data-cy="save-button">
+        Save
+      </Button>
+    </StickyFooter>
+  );
+}
+
+export function LeftAligned() {
+  return (
+    <StickyFooter className="justify-start gap-3">
+      <Button color="default" onClick={() => {}} data-cy="back-button">
+        Back
+      </Button>
+      <Button color="primary" onClick={() => {}} data-cy="next-button">
+        Next
+      </Button>
+    </StickyFooter>
+  );
+}
+
+export function Centered() {
+  return (
+    <StickyFooter className="justify-center gap-3">
+      <Button color="default" onClick={() => {}} data-cy="cancel-button">
+        Cancel
+      </Button>
+      <Button color="primary" onClick={() => {}} data-cy="submit-button">
+        Submit
+      </Button>
+    </StickyFooter>
+  );
+}
+
+export function ComplexLayout() {
+  return (
+    <StickyFooter className="justify-between">
+      <div className="flex items-center gap-3">
+        <Button color="default" onClick={() => {}} data-cy="cancel-button">
+          Cancel
+        </Button>
+        <Button color="dangerlight" onClick={() => {}} data-cy="delete-button">
+          Delete
+        </Button>
+      </div>
+      <div className="flex items-center gap-3">
+        <Button
+          color="default"
+          onClick={() => {}}
+          data-cy="save-as-draft-button"
+        >
+          Save as Draft
+        </Button>
+        <Button color="primary" onClick={() => {}} data-cy="publish-button">
+          Publish
+        </Button>
+      </div>
+    </StickyFooter>
+  );
+}
+
+export const Default: Story = {
+  args: {
+    className: 'justify-end gap-3',
+    children: (
+      <>
+        <Button color="default" data-cy="cancel-button">
+          Cancel
+        </Button>
+        <Button color="primary" data-cy="save-button">
+          Save
+        </Button>
+      </>
+    ),
+  },
+};
diff --git a/app/react/components/StickyFooter/StickyFooter.test.tsx b/app/react/components/StickyFooter/StickyFooter.test.tsx
new file mode 100644
index 0000000..1eeec6c
--- /dev/null
+++ b/app/react/components/StickyFooter/StickyFooter.test.tsx
@@ -0,0 +1,35 @@
+import { render, screen } from '@testing-library/react';
+
+import { StickyFooter } from './StickyFooter';
+
+test('should render children', () => {
+  render(
+    <StickyFooter>
+      <span>Content</span>
+    </StickyFooter>
+  );
+
+  expect(screen.getByText('Content')).toBeInTheDocument();
+});
+
+test('should apply custom className', () => {
+  const { container } = render(
+    <StickyFooter className="custom-class">
+      <span>Test</span>
+    </StickyFooter>
+  );
+
+  expect(container.firstChild).toHaveClass('custom-class');
+});
+
+test('should render multiple children', () => {
+  render(
+    <StickyFooter>
+      <button type="button">Cancel</button>
+      <button type="button">Save</button>
+    </StickyFooter>
+  );
+
+  expect(screen.getByText('Cancel')).toBeInTheDocument();
+  expect(screen.getByText('Save')).toBeInTheDocument();
+});
diff --git a/app/react/components/StickyFooter/StickyFooter.tsx b/app/react/components/StickyFooter/StickyFooter.tsx
new file mode 100644
index 0000000..6887e9c
--- /dev/null
+++ b/app/react/components/StickyFooter/StickyFooter.tsx
@@ -0,0 +1,57 @@
+import { PropsWithChildren } from 'react';
+import clsx from 'clsx';
+
+import styles from './StickyFooter.module.css';
+
+interface Props {
+  className?: string;
+}
+
+/**
+ * Fixed action bar pinned to the bottom of the viewport.
+ *
+ * Wrap the page content in `StickyFooter.Container` so the footer never
+ * obscures the last element:
+ *
+ * ```tsx
+ * <StickyFooter.Container>
+ *   <form>
+ *     ...
+ *     <StickyFooter>
+ *       <Button>Cancel</Button>
+ *       <Button>Save</Button>
+ *     </StickyFooter>
+ *   </form>
+ * </StickyFooter.Container>
+ * ```
+ */
+export function StickyFooter({
+  className,
+  children,
+}: PropsWithChildren<Props>) {
+  return (
+    <div
+      className={clsx(
+        styles.actionBar,
+        'fixed bottom-0 right-0 z-40 h-16',
+        'flex items-center px-6',
+        'border-t border-[var(--border-widget-color)] bg-[var(--bg-widget-color)]',
+        'shadow-[0_-2px_5px_rgba(0,0,0,0.1)]',
+        className
+      )}
+    >
+      {children}
+    </div>
+  );
+}
+
+/**
+ * Wraps page content to prevent `StickyFooter` from overlapping the bottom
+ * of the page. Always use this as the outermost wrapper when rendering a
+ * `StickyFooter` inside a page or form.
+ */
+function Container({ children }: PropsWithChildren<unknown>) {
+  return <div className="pb-20">{children}</div>;
+}
+
+StickyFooter.Container = Container;
diff --git a/app/react/components/Svg.tsx b/app/react/components/Svg.tsx
new file mode 100644
index 0000000..5c12aef
--- /dev/null
+++ b/app/react/components/Svg.tsx
@@ -0,0 +1,95 @@
+// general icons
+
+import dataflow from '@/assets/ico/dataflow-1.svg?c';
+import git from '@/assets/ico/git.svg?c';
+import kube from '@/assets/ico/kube.svg?c';
+import ldap from '@/assets/ico/ldap.svg?c';
+import linux from '@/assets/ico/linux.svg?c';
+import memory from '@/assets/ico/memory.svg?c';
+import restorewindow from '@/assets/ico/restore-window.svg?c';
+import route from '@/assets/ico/route.svg?c';
+import sort from '@/assets/ico/sort.svg?c';
+import subscription from '@/assets/ico/subscription.svg?c';
+import Placeholder from '@/assets/ico/placeholder.svg?c'; // Placeholder is used when an icon name cant be matched
+// vendor icons
+import aws from '@/assets/ico/vendor/aws.svg?c';
+import azure from '@/assets/ico/vendor/azure.svg?c';
+import civo from '@/assets/ico/vendor/civo.svg?c';
+import digitalocean from '@/assets/ico/vendor/digitalocean.svg?c';
+import docker from '@/assets/ico/vendor/docker.svg?c';
+import dockericon from '@/assets/ico/vendor/docker-icon.svg?c';
+import dockercompose from '@/assets/ico/vendor/docker-compose.svg?c';
+import ecr from '@/assets/ico/vendor/ecr.svg?c';
+import github from '@/assets/ico/vendor/github.svg?c';
+import gitlab from '@/assets/ico/vendor/gitlab.svg?c';
+import google from '@/assets/ico/vendor/google.svg?c';
+import googlecloud from '@/assets/ico/vendor/googlecloud.svg?c';
+import kubernetes from '@/assets/ico/vendor/kubernetes.svg?c';
+import helm from '@/assets/ico/vendor/helm.svg?c';
+import akamai from '@/assets/ico/vendor/akamai.svg?c';
+import microsoft from '@/assets/ico/vendor/microsoft.svg?c';
+import microsofticon from '@/assets/ico/vendor/microsoft-icon.svg?c';
+import openldap from '@/assets/ico/vendor/openldap.svg?c';
+import proget from '@/assets/ico/vendor/proget.svg?c';
+import quay from '@/assets/ico/vendor/quay.svg?c';
+
+const placeholder = Placeholder;
+
+export const SvgIcons = {
+  dataflow,
+  dockericon,
+  git,
+  ldap,
+  linux,
+  memory,
+  placeholder,
+  restorewindow,
+  route,
+  sort,
+  subscription,
+  aws,
+  azure,
+  civo,
+  digitalocean,
+  docker,
+  dockercompose,
+  ecr,
+  github,
+  gitlab,
+  google,
+  googlecloud,
+  kubernetes,
+  helm,
+  akamai,
+  microsoft,
+  microsofticon,
+  openldap,
+  proget,
+  quay,
+  kube,
+};
+
+interface SvgProps {
+  icon: keyof typeof SvgIcons;
+  className?: string;
+}
+
+function Svg({ icon, className }: SvgProps) {
+  const SvgIcon = SvgIcons[icon];
+
+  if (!SvgIcon) {
+    return (
+      <span className={className} aria-hidden="true">
+        <Placeholder />
+      </span>
+    );
+  }
+
+  return (
+    <span className={className} aria-hidden="true">
+      <SvgIcon />
+    </span>
+  );
+}
+
+export default Svg;
diff --git a/app/react/components/TLSFieldset/TLSFieldset.tsx b/app/react/components/TLSFieldset/TLSFieldset.tsx
new file mode 100644
index 0000000..d3d0019
--- /dev/null
+++ b/app/react/components/TLSFieldset/TLSFieldset.tsx
@@ -0,0 +1,115 @@
+import { FormikErrors } from 'formik';
+import { SchemaOf, boolean, object } from 'yup';
+
+import { file, withFileSize } from '@@/form-components/yup-file-validation';
+import { FileUploadField } from '@@/form-components/FileUpload';
+import { SwitchField } from '@@/form-components/SwitchField';
+import { FormControl } from '@@/form-components/FormControl';
+
+import { TLSConfig } from './types';
+
+interface Props {
+  values: TLSConfig;
+  onChange: (value: Partial<TLSConfig>) => void;
+  errors?: FormikErrors<TLSConfig>;
+}
+
+export function TLSFieldset({ values, onChange, errors }: Props) {
+  return (
+    <>
+      <div className="form-group">
+        <div className="col-sm-12">
+          <SwitchField
+            label="TLS"
+            data-cy="enable-tls-switch"
+            checked={values.tls}
+            onChange={(checked) => handleChange({ tls: checked })}
+            labelClass="col-sm-3 col-lg-2"
+          />
+        </div>
+      </div>
+
+      {values.tls && (
+        <>
+          <div className="form-group">
+            <div className="col-sm-12">
+              <SwitchField
+                label="Skip Certification Verification"
+                data-cy="skip-verify-switch"
+                checked={!!values.skipVerify}
+                onChange={(checked) => handleChange({ skipVerify: checked })}
+                labelClass="col-sm-3 col-lg-2"
+              />
+            </div>
+          </div>
+
+          {!values.skipVerify && (
+            <>
+              <FormControl
+                label="TLS CA certificate"
+                inputId="ca-cert-field"
+                errors={errors?.caCertFile}
+              >
+                <FileUploadField
+                  inputId="ca-cert-field"
+                  data-cy="ca-cert-file-upload"
+                  onChange={(file) => handleChange({ caCertFile: file })}
+                  value={values.caCertFile}
+                />
+              </FormControl>
+              <FormControl
+                label="TLS certificate"
+                inputId="cert-field"
+                errors={errors?.certFile}
+              >
+                <FileUploadField
+                  inputId="cert-field"
+                  data-cy="cert-file-upload"
+                  onChange={(file) => handleChange({ certFile: file })}
+                  value={values.certFile}
+                />
+              </FormControl>
+              <FormControl
+                label="TLS key"
+                inputId="tls-key-field"
+                errors={errors?.keyFile}
+              >
+                <FileUploadField
+                  inputId="tls-key-field"
+                  data-cy="tls-key-file-upload"
+                  onChange={(file) => handleChange({ keyFile: file })}
+                  value={values.keyFile}
+                />
+              </FormControl>
+            </>
+          )}
+        </>
+      )}
+    </>
+  );
+
+  function handleChange(partialValue: Partial<TLSConfig>) {
+    onChange(partialValue);
+  }
+}
+
+const MAX_FILE_SIZE = 5_242_880; // 5MB
+
+function certValidation(optional?: boolean) {
+  return withFileSize(file(), MAX_FILE_SIZE).when(['tls', 'skipVerify'], {
+    is: (tls: boolean, skipVerify: boolean) => tls && !skipVerify && !optional,
+    then: (schema) => schema.required('File is required'),
+  });
+}
+
+export function tlsConfigValidation({
+  optionalCert,
+}: { optionalCert?: boolean } = {}): SchemaOf<TLSConfig> {
+  return object({
+    tls: boolean().default(false),
+    skipVerify: boolean().default(false),
+    caCertFile: certValidation(optionalCert),
+    certFile: certValidation(optionalCert),
+    keyFile: certValidation(optionalCert),
+  });
+}
diff --git a/app/react/components/TLSFieldset/index.ts b/app/react/components/TLSFieldset/index.ts
new file mode 100644
index 0000000..f74cc85
--- /dev/null
+++ b/app/react/components/TLSFieldset/index.ts
@@ -0,0 +1 @@
+export { TLSFieldset, tlsConfigValidation } from './TLSFieldset';
diff --git a/app/react/components/TLSFieldset/types.ts b/app/react/components/TLSFieldset/types.ts
new file mode 100644
index 0000000..9929cb9
--- /dev/null
+++ b/app/react/components/TLSFieldset/types.ts
@@ -0,0 +1,7 @@
+export interface TLSConfig {
+  tls: boolean;
+  skipVerify?: boolean;
+  caCertFile?: File;
+  certFile?: File;
+  keyFile?: File;
+}
diff --git a/app/react/components/TagButton/TagButton.module.css b/app/react/components/TagButton/TagButton.module.css
new file mode 100644
index 0000000..c65627d
--- /dev/null
+++ b/app/react/components/TagButton/TagButton.module.css
@@ -0,0 +1,4 @@
+.remove-tag-btn {
+  border: 0;
+  background: transparent;
+}
diff --git a/app/react/components/TagButton/TagButton.tsx b/app/react/components/TagButton/TagButton.tsx
new file mode 100644
index 0000000..e649e98
--- /dev/null
+++ b/app/react/components/TagButton/TagButton.tsx
@@ -0,0 +1,33 @@
+import clsx from 'clsx';
+import { Trash2 } from 'lucide-react';
+
+import { Icon } from '@/react/components/Icon';
+
+import styles from './TagButton.module.css';
+
+interface Props {
+  value: number;
+  label: string;
+  title: string;
+  onRemove(): void;
+}
+
+export function TagButton({ value, label, title, onRemove }: Props) {
+  return (
+    <button
+      type="button"
+      title={title}
+      className={clsx(
+        styles.removeTagBtn,
+        'space-left',
+        'tag',
+        'vertical-center'
+      )}
+      onClick={() => onRemove()}
+      key={value}
+    >
+      {label}
+      <Icon icon={Trash2} />
+    </button>
+  );
+}
diff --git a/app/react/components/TagButton/index.ts b/app/react/components/TagButton/index.ts
new file mode 100644
index 0000000..ed32cb1
--- /dev/null
+++ b/app/react/components/TagButton/index.ts
@@ -0,0 +1 @@
+export { TagButton } from './TagButton';
diff --git a/app/react/components/TagSelector/TagSelector.stories.tsx b/app/react/components/TagSelector/TagSelector.stories.tsx
new file mode 100644
index 0000000..24f07c4
--- /dev/null
+++ b/app/react/components/TagSelector/TagSelector.stories.tsx
@@ -0,0 +1,25 @@
+import { Meta } from '@storybook/react-webpack5';
+import { useState } from 'react';
+
+import { TagId } from '@/portainer/tags/types';
+
+import { TagSelector } from './TagSelector';
+
+export default {
+  component: TagSelector,
+  title: 'Components/TagSelector',
+} as Meta;
+
+function Example() {
+  const [value, setValue] = useState<TagId[]>([]);
+
+  return <TagSelector value={value} onChange={setValue} />;
+}
+
+function ExampleWithCreate() {
+  const [value, setValue] = useState<TagId[]>([]);
+
+  return <TagSelector value={value} onChange={setValue} allowCreate />;
+}
+
+export { Example, ExampleWithCreate };
diff --git a/app/react/components/TagSelector/TagSelector.test.tsx b/app/react/components/TagSelector/TagSelector.test.tsx
new file mode 100644
index 0000000..59eec5e
--- /dev/null
+++ b/app/react/components/TagSelector/TagSelector.test.tsx
@@ -0,0 +1,70 @@
+import { http, HttpResponse } from 'msw';
+import { Mock } from 'vitest';
+import { render } from '@testing-library/react';
+
+import { Tag, TagId } from '@/portainer/tags/types';
+import { server } from '@/setup-tests/server';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+
+import { TagSelector } from './TagSelector';
+
+test('should show a message when no tags and allowCreate is false', async () => {
+  const { getByText } = await renderComponent({ allowCreate: false }, []);
+
+  expect(
+    getByText('No tags available. Head over to the', {
+      exact: false,
+    })
+  ).toBeInTheDocument();
+});
+
+test('should show the selected tags', async () => {
+  const tags: Tag[] = [
+    {
+      ID: 1,
+      Name: 'tag1',
+      Endpoints: {},
+    },
+    {
+      ID: 2,
+      Name: 'tag2',
+      Endpoints: {},
+    },
+  ];
+
+  const selectedTags = [tags[1]];
+
+  const { getByText } = await renderComponent(
+    { value: selectedTags.map((t) => t.ID) },
+    tags
+  );
+
+  expect(getByText(selectedTags[0].Name)).toBeInTheDocument();
+});
+async function renderComponent(
+  {
+    value = [],
+    allowCreate = false,
+    onChange = vi.fn(),
+  }: {
+    value?: TagId[];
+    allowCreate?: boolean;
+    onChange?: Mock;
+  } = {},
+  tags: Tag[] = []
+) {
+  server.use(http.get('/api/tags', () => HttpResponse.json(tags)));
+
+  const Wrapped = withTestQueryProvider(withTestRouter(TagSelector));
+
+  const queries = render(
+    <Wrapped value={value} allowCreate={allowCreate} onChange={onChange} />
+  );
+
+  const tagElement = await queries.findAllByText('tags', { exact: false });
+
+  expect(tagElement.length).toBeGreaterThanOrEqual(1);
+
+  return queries;
+}
diff --git a/app/react/components/TagSelector/TagSelector.tsx b/app/react/components/TagSelector/TagSelector.tsx
new file mode 100644
index 0000000..80726e0
--- /dev/null
+++ b/app/react/components/TagSelector/TagSelector.tsx
@@ -0,0 +1,140 @@
+import _ from 'lodash';
+
+import { TagId } from '@/portainer/tags/types';
+import { useCreateTagMutation, useTags } from '@/portainer/tags/queries';
+
+import { Creatable, Select } from '@@/form-components/ReactSelect';
+import { FormControl } from '@@/form-components/FormControl';
+import { Link } from '@@/Link';
+import { ArrayError } from '@@/form-components/InputList/InputList';
+
+import { TagButton } from '../TagButton';
+
+interface Props {
+  value: TagId[];
+  allowCreate?: boolean;
+  onChange(value: TagId[]): void;
+  errors?: ArrayError<TagId[]>;
+}
+
+interface Option {
+  value: TagId;
+  label: string;
+}
+
+export function TagSelector({
+  value,
+  allowCreate = false,
+  onChange,
+  errors,
+}: Props) {
+  // change the struct because react-select has a bug with Creatable (https://github.com/JedWatson/react-select/issues/3417#issuecomment-461868989)
+  const tagsQuery = useTags({
+    select: (tags) => tags?.map((opt) => ({ label: opt.Name, value: opt.ID })),
+  });
+
+  const createTagMutation = useCreateTagMutation();
+
+  if (!tagsQuery.data) {
+    return null;
+  }
+
+  const { data: tags } = tagsQuery;
+
+  const selectedTags = _.compact(
+    value.map((id) => tags.find((tag) => tag.value === id))
+  );
+
+  const SelectComponent = allowCreate ? Creatable : Select;
+
+  if (!tags.length && !allowCreate) {
+    return (
+      <div className="form-group">
+        <div className="col-sm-12 small text-muted">
+          No tags available. Head over to the
+          <Link
+            to="portainer.tags"
+            className="space-right space-left"
+            data-cy="environment-tags-view-link"
+          >
+            Tags view
+          </Link>
+          to add tags
+        </div>
+      </div>
+    );
+  }
+
+  return (
+    <>
+      {value.length > 0 && (
+        <FormControl label="Selected tags">
+          <div data-cy="selected-tags">
+            {selectedTags.map((tag) => (
+              <TagButton
+                key={tag.value}
+                title="Remove tag"
+                value={tag.value}
+                label={tag.label}
+                onRemove={() => handleRemove(tag.value)}
+              />
+            ))}
+          </div>
+        </FormControl>
+      )}
+
+      <FormControl
+        label="Tags"
+        inputId="tags-selector"
+        errors={
+          typeof errors === 'string'
+            ? errors
+            : errors?.map((e) => e?.toString())
+        }
+      >
+        <SelectComponent
+          inputId="tags-selector"
+          value={[] as { label: string; value: number }[]}
+          hideSelectedOptions
+          options={tags.filter((tag) => !value.includes(tag.value))}
+          closeMenuOnSelect={false}
+          onChange={handleAdd}
+          noOptionsMessage={() => 'No tags available'}
+          formatCreateLabel={(inputValue) => `Create "${inputValue}"`}
+          onCreateOption={handleCreateOption}
+          aria-label="Tags"
+          data-cy="environment-tags-selector"
+          id="environment-tags-selector"
+        />
+      </FormControl>
+    </>
+  );
+
+  function handleAdd(tag?: Option | null) {
+    if (!tag) {
+      return;
+    }
+    onChange([...value, tag.value]);
+  }
+
+  function handleRemove(tagId: TagId) {
+    onChange(value.filter((id) => id !== tagId));
+  }
+
+  function handleCreateOption(inputValue: string) {
+    if (!allowCreate) {
+      return;
+    }
+
+    // Prevent the new tag composed of space from being added
+    if (!inputValue.replace(/\s/g, '').length) {
+      return;
+    }
+
+    createTagMutation.mutate(inputValue, {
+      onSuccess(tag) {
+        handleAdd({ label: tag.Name, value: tag.ID });
+      },
+    });
+  }
+}
diff --git a/app/react/components/TagSelector/index.ts b/app/react/components/TagSelector/index.ts
new file mode 100644
index 0000000..6f3060a
--- /dev/null
+++ b/app/react/components/TagSelector/index.ts
@@ -0,0 +1 @@
+export { TagSelector } from './TagSelector';
diff --git a/app/react/components/TeamsSelector/TeamsSelector.mocks.ts b/app/react/components/TeamsSelector/TeamsSelector.mocks.ts
new file mode 100644
index 0000000..477c145
--- /dev/null
+++ b/app/react/components/TeamsSelector/TeamsSelector.mocks.ts
@@ -0,0 +1,9 @@
+import { TeamViewModel } from '@/portainer/models/team';
+
+export function createMockTeam(id: number, name: string): TeamViewModel {
+  return {
+    Id: id,
+    Name: name,
+    Checked: false,
+  };
+}
diff --git a/app/react/components/TeamsSelector/TeamsSelector.stories.tsx b/app/react/components/TeamsSelector/TeamsSelector.stories.tsx
new file mode 100644
index 0000000..91a819c
--- /dev/null
+++ b/app/react/components/TeamsSelector/TeamsSelector.stories.tsx
@@ -0,0 +1,29 @@
+import { Meta } from '@storybook/react-webpack5';
+import { useState } from 'react';
+
+import { TeamsSelector } from './TeamsSelector';
+import { createMockTeam } from './TeamsSelector.mocks';
+
+const meta: Meta = {
+  title: 'Components/TeamsSelector',
+  component: TeamsSelector,
+};
+
+export default meta;
+export { Example };
+
+function Example() {
+  const [selectedTeams, setSelectedTeams] = useState<readonly number[]>([1]);
+
+  const teams = [createMockTeam(1, 'team1'), createMockTeam(2, 'team2')];
+
+  return (
+    <TeamsSelector
+      value={selectedTeams}
+      onChange={(value) => setSelectedTeams(value)}
+      teams={teams}
+      placeholder="Select one or more teams"
+      dataCy="teams-selector"
+    />
+  );
+}
diff --git a/app/react/components/TeamsSelector/TeamsSelector.tsx b/app/react/components/TeamsSelector/TeamsSelector.tsx
new file mode 100644
index 0000000..7758114
--- /dev/null
+++ b/app/react/components/TeamsSelector/TeamsSelector.tsx
@@ -0,0 +1,41 @@
+import { Team, TeamId } from '@/react/portainer/users/teams/types';
+
+import { PortainerSelect } from '@@/form-components/PortainerSelect';
+
+interface Props {
+  name?: string;
+  value: TeamId[] | readonly TeamId[];
+  onChange(value: TeamId[]): void;
+  teams: Team[];
+  dataCy: string;
+  inputId?: string;
+  placeholder?: string;
+  disabled?: boolean;
+}
+
+export function TeamsSelector({
+  name,
+  value,
+  onChange,
+  teams,
+  dataCy,
+  inputId,
+  placeholder,
+  disabled,
+}: Props) {
+  const options = teams.map((team) => ({ label: team.Name, value: team.Id }));
+
+  return (
+    <PortainerSelect<number>
+      name={name}
+      isMulti
+      options={options}
+      value={value}
+      onChange={(value) => onChange(value)}
+      data-cy={dataCy}
+      inputId={inputId}
+      placeholder={placeholder}
+      disabled={disabled}
+    />
+  );
+}
diff --git a/app/react/components/TeamsSelector/index.ts b/app/react/components/TeamsSelector/index.ts
new file mode 100644
index 0000000..e309c28
--- /dev/null
+++ b/app/react/components/TeamsSelector/index.ts
@@ -0,0 +1 @@
+export { TeamsSelector } from './TeamsSelector';
diff --git a/app/react/components/Terminal/Terminal.stories.tsx b/app/react/components/Terminal/Terminal.stories.tsx
new file mode 100644
index 0000000..7ca5051
--- /dev/null
+++ b/app/react/components/Terminal/Terminal.stories.tsx
@@ -0,0 +1,186 @@
+import { Meta } from '@storybook/react-webpack5';
+import { ws } from 'msw';
+import { useState } from 'react';
+
+import { Button } from '@@/buttons';
+
+import { Terminal } from './Terminal';
+import type { ShellState } from './Terminal';
+
+// Computed at module load so the handler URL matches whatever port Storybook runs on
+const wsProtocol = window.location.protocol === 'https:' ? 'wss://' : 'ws://';
+const SHELL_WS_URL = `${wsProtocol}${window.location.host}/api/websocket/test-shell`;
+
+const shellHandler = ws.link(SHELL_WS_URL);
+
+const PROMPT = '\r\n\x1b[32muser@portainer\x1b[0m:\x1b[34m~\x1b[0m$ ';
+
+const COMMANDS: Record<string, (args: string[]) => string> = {
+  help: () =>
+    'Available commands: clear, date, echo, exit, help, ls, pwd, whoami',
+  echo: (args) => args.join(' '),
+  ls: () =>
+    '\x1b[34mbin\x1b[0m  \x1b[34metc\x1b[0m  \x1b[34mhome\x1b[0m  \x1b[32mapp\x1b[0m  \x1b[32mserver\x1b[0m  README.md',
+  pwd: () => '/home/user',
+  whoami: () => 'user',
+  date: () => new Date().toString(),
+};
+
+function createBashHandler() {
+  return shellHandler.addEventListener('connection', ({ client }) => {
+    let buffer = '';
+
+    client.send(
+      'Portainer MSW shell — type \x1b[1mhelp\x1b[0m for available commands'
+    );
+    client.send(PROMPT);
+
+    client.addEventListener('message', ({ data }) => {
+      const str = String(data);
+
+      // Escape sequences (arrow keys etc.) — ignore
+      if (str.startsWith('\x1b')) {
+        return;
+      }
+
+      str.split('').forEach((char) => {
+        if (char === '\r') {
+          onEnter();
+        } else if (char === '\x7f' || char === '\b') {
+          onBackspace();
+        } else if (char === '\x03') {
+          onCtrlC();
+        } else if (char === '\x04') {
+          onCtrlD();
+        } else if (char === '\x0c') {
+          onCtrlL();
+        } else if (char.charCodeAt(0) >= 32) {
+          buffer += char;
+          client.send(char);
+        }
+      });
+    });
+
+    function onEnter() {
+      const cmd = buffer.trim();
+      buffer = '';
+      client.send('\r\n');
+
+      if (!cmd) {
+        client.send(PROMPT);
+        return;
+      }
+
+      const [command, ...args] = cmd.split(/\s+/);
+
+      if (command === 'exit') {
+        client.send('logout\r\n');
+        setTimeout(() => client.close(), 200);
+        return;
+      }
+
+      if (command === 'clear') {
+        client.send('\x1b[2J\x1b[H');
+        client.send(PROMPT);
+        return;
+      }
+
+      const handler = COMMANDS[command];
+      if (handler) {
+        client.send(handler(args));
+      } else {
+        client.send(`\x1b[31mbash: ${command}: command not found\x1b[0m`);
+      }
+
+      client.send(PROMPT);
+    }
+
+    function onBackspace() {
+      if (buffer.length === 0) return;
+      buffer = buffer.slice(0, -1);
+      client.send('\b \b');
+    }
+
+    function onCtrlC() {
+      buffer = '';
+      client.send('^C');
+      client.send(PROMPT);
+    }
+
+    function onCtrlD() {
+      client.send('\r\nlogout\r\n');
+      client.close();
+    }
+
+    function onCtrlL() {
+      buffer = '';
+      client.send('\x1b[2J\x1b[H');
+      client.send(PROMPT);
+    }
+  });
+}
+
+const meta: Meta = {
+  title: 'Components/Terminal',
+  component: Terminal,
+};
+export default meta;
+
+export function AutoConnect() {
+  return (
+    <div className="h-[400px]">
+      <Terminal url={SHELL_WS_URL} connect />
+    </div>
+  );
+}
+AutoConnect.parameters = {
+  msw: { handlers: [createBashHandler()] },
+};
+
+export function WithConnectButton() {
+  const [connect, setConnect] = useState(false);
+  const [state, setState] = useState<ShellState>('idle');
+
+  return (
+    <div className="flex flex-col gap-2">
+      <div className="flex items-center gap-3">
+        <Button
+          onClick={() => setConnect((c) => !c)}
+          disabled={state === 'connecting'}
+          data-cy="connect button"
+        >
+          {state === 'connected' ? 'Disconnect' : 'Connect'}
+        </Button>
+        <span className="text-gray-500 text-sm">state: {state}</span>
+      </div>
+      <div className="h-[400px]">
+        <Terminal
+          url={SHELL_WS_URL}
+          connect={connect}
+          onStateChange={setState}
+        />
+      </div>
+    </div>
+  );
+}
+WithConnectButton.parameters = {
+  msw: { handlers: [createBashHandler()] },
+};
+
+export function ServerDisconnects() {
+  return (
+    <div className="h-[400px]">
+      <Terminal url={SHELL_WS_URL} connect />
+    </div>
+  );
+}
+ServerDisconnects.parameters = {
+  msw: {
+    handlers: [
+      shellHandler.addEventListener('connection', ({ client }) => {
+        client.send('# Closing in 2s...\r\n');
+        setTimeout(() => client.close(), 2000);
+      }),
+    ],
+  },
+};
diff --git a/app/react/components/Terminal/Terminal.test.tsx b/app/react/components/Terminal/Terminal.test.tsx
new file mode 100644
index 0000000..976d029
--- /dev/null
+++ b/app/react/components/Terminal/Terminal.test.tsx
@@ -0,0 +1,345 @@
+import { render, waitFor } from '@testing-library/react';
+import { vi } from 'vitest';
+import { Terminal as XTerm } from '@xterm/xterm';
+import { FitAddon } from '@xterm/addon-fit';
+
+import { error as notifyError } from '@/portainer/services/notifications';
+import { server, ws } from '@/setup-tests/server';
+
+import { Terminal } from './Terminal';
+
+type WSConnection = Parameters<
+  Parameters<ReturnType<typeof ws.link>['addEventListener']>[1]
+>[0];
+type ClientConnection = WSConnection['client'];
+
+const wssLink = ws.link('wss://*/*');
+
+vi.mock('@xterm/xterm', () => ({
+  Terminal: vi.fn(
+    class {
+      open = vi.fn();
+
+      options = {};
+
+      focus = vi.fn();
+
+      loadAddon = vi.fn();
+
+      write = vi.fn();
+
+      onData = vi.fn();
+
+      onKey = vi.fn();
+
+      dispose = vi.fn();
+    }
+  ),
+}));
+
+vi.mock('@xterm/addon-fit', () => ({
+  FitAddon: vi.fn(
+    class {
+      fit = vi.fn();
+    }
+  ),
+}));
+
+vi.mock('@/portainer/services/notifications', () => ({
+  error: vi.fn(),
+}));
+
+let mockTerminalInstance: Partial<XTerm>;
+let mockFitAddonInstance: Partial<FitAddon>;
+let mockResizeObserverObserve: ReturnType<typeof vi.fn>;
+let mockResizeObserverDisconnect: ReturnType<typeof vi.fn>;
+let mockResizeObserverCallback: ResizeObserverCallback;
+
+beforeEach(() => {
+  vi.clearAllMocks();
+
+  mockFitAddonInstance = { fit: vi.fn() };
+
+  mockTerminalInstance = {
+    open: vi.fn(),
+    options: {},
+    focus: vi.fn(),
+    loadAddon: vi.fn(),
+    write: vi.fn(),
+    onData: vi.fn(),
+    onKey: vi.fn(),
+    dispose: vi.fn(),
+    rows: 24,
+    cols: 80,
+  };
+
+  vi.mocked(XTerm).mockImplementation(function XTerm(this: XTerm) {
+    Object.assign(this, mockTerminalInstance);
+  });
+
+  vi.mocked(FitAddon).mockImplementation(function FitAddon(this: FitAddon) {
+    Object.assign(this, mockFitAddonInstance);
+  });
+
+  mockResizeObserverObserve = vi.fn();
+  mockResizeObserverDisconnect = vi.fn();
+  globalThis.ResizeObserver = vi
+    .fn()
+    .mockImplementation(function ResizeObserver(
+      this: ResizeObserver,
+      callback: ResizeObserverCallback
+    ) {
+      mockResizeObserverCallback = callback;
+      return {
+        observe: mockResizeObserverObserve,
+        disconnect: mockResizeObserverDisconnect,
+      };
+    });
+
+  server.use(
+    wssLink.addEventListener('connection', ({ client, server }) => {
+      client.addEventListener('message', (event) => {
+        server.send(event.data);
+      });
+    })
+  );
+});
+
+const TEST_URL = 'wss://localhost:3000/api/test';
+
+describe('Terminal', () => {
+  describe('connection lifecycle', () => {
+    it('does not create terminal when connect=false', () => {
+      render(<Terminal url={TEST_URL} connect={false} />);
+      expect(vi.mocked(XTerm)).not.toHaveBeenCalled();
+    });
+
+    it('calls onStateChange with connecting immediately when connect=true', () => {
+      const onStateChange = vi.fn();
+      render(<Terminal url={TEST_URL} connect onStateChange={onStateChange} />);
+      expect(onStateChange).toHaveBeenCalledWith('connecting');
+    });
+
+    it('calls onStateChange with connected when socket opens', async () => {
+      const onStateChange = vi.fn();
+
+      render(<Terminal url={TEST_URL} connect onStateChange={onStateChange} />);
+
+      // Wait for the terminal to open (same event that triggers 'connected')
+      await waitFor(() => expect(mockTerminalInstance.open).toHaveBeenCalled());
+      expect(onStateChange).toHaveBeenCalledWith('connected');
+    });
+
+    it('calls onStateChange with disconnected when socket closes', async () => {
+      const onStateChange = vi.fn();
+      let clientConnection: ClientConnection | undefined;
+
+      server.use(
+        wssLink.addEventListener('connection', ({ client }) => {
+          clientConnection = client;
+        })
+      );
+
+      render(<Terminal url={TEST_URL} connect onStateChange={onStateChange} />);
+
+      await waitFor(() => expect(clientConnection).toBeDefined());
+      clientConnection!.close();
+
+      await waitFor(() => {
+        expect(onStateChange).toHaveBeenCalledWith('disconnected');
+      });
+    });
+  });
+
+  describe('terminal initialization', () => {
+    it('opens on socket open', async () => {
+      render(<Terminal url={TEST_URL} connect />);
+
+      await waitFor(() => {
+        expect(mockTerminalInstance.open).toHaveBeenCalled();
+      });
+    });
+
+    it('registers resize observer on container element', async () => {
+      render(<Terminal url={TEST_URL} connect />);
+
+      await waitFor(() => expect(mockTerminalInstance.open).toHaveBeenCalled());
+
+      expect(mockResizeObserverObserve).toHaveBeenCalledWith(
+        expect.any(HTMLElement)
+      );
+    });
+
+    it('fits terminal when container resizes', async () => {
+      render(<Terminal url={TEST_URL} connect />);
+
+      await waitFor(() => expect(mockTerminalInstance.open).toHaveBeenCalled());
+
+      mockResizeObserverCallback([], {} as ResizeObserver);
+
+      expect(mockFitAddonInstance.fit).toHaveBeenCalled();
+    });
+  });
+
+  describe('data flow', () => {
+    it('forwards terminal input to WebSocket', async () => {
+      let receivedData: string | undefined;
+
+      server.use(
+        wssLink.addEventListener('connection', ({ client }) => {
+          client.addEventListener('message', (event) => {
+            receivedData = event.data as string;
+          });
+        })
+      );
+
+      render(<Terminal url={TEST_URL} connect />);
+
+      await waitFor(() =>
+        expect(mockTerminalInstance.onData).toHaveBeenCalled()
+      );
+
+      const onDataCallback = vi.mocked(mockTerminalInstance.onData!).mock
+        .calls[0]![0] as (data: string) => void;
+
+      onDataCallback('kubectl get pods');
+
+      await waitFor(() => expect(receivedData).toBe('kubectl get pods'));
+    });
+
+    it('writes WebSocket messages to terminal as Uint8Array', async () => {
+      server.use(
+        wssLink.addEventListener('connection', ({ client }) => {
+          client.send('server output');
+        })
+      );
+
+      render(<Terminal url={TEST_URL} connect />);
+
+      await waitFor(() =>
+        expect(mockTerminalInstance.write).toHaveBeenCalled()
+      );
+
+      const [data] = vi.mocked(mockTerminalInstance.write!).mock.calls[0];
+      expect(new TextDecoder().decode(data as Uint8Array)).toBe(
+        'server output'
+      );
+    });
+  });
+
+  describe('cleanup', () => {
+    it('disposes terminal and disconnects resize observer when socket closes', async () => {
+      let clientConnection: ClientConnection | undefined;
+
+      server.use(
+        wssLink.addEventListener('connection', ({ client }) => {
+          clientConnection = client;
+        })
+      );
+
+      render(<Terminal url={TEST_URL} connect />);
+
+      await waitFor(() => expect(clientConnection).toBeDefined());
+      await waitFor(() => expect(mockTerminalInstance.open).toHaveBeenCalled());
+
+      clientConnection!.close();
+
+      await waitFor(() =>
+        expect(mockTerminalInstance.dispose).toHaveBeenCalled()
+      );
+      expect(mockResizeObserverDisconnect).toHaveBeenCalled();
+    });
+
+    it('disposes terminal and disconnects resize observer on unmount', async () => {
+      let clientConnection: ClientConnection | undefined;
+
+      server.use(
+        wssLink.addEventListener('connection', ({ client }) => {
+          clientConnection = client;
+        })
+      );
+
+      const { unmount } = render(<Terminal url={TEST_URL} connect />);
+
+      await waitFor(() => expect(clientConnection).toBeDefined());
+      await waitFor(() => expect(mockTerminalInstance.open).toHaveBeenCalled());
+
+      unmount();
+
+      expect(mockTerminalInstance.dispose).toHaveBeenCalled();
+      expect(mockResizeObserverDisconnect).toHaveBeenCalled();
+    });
+  });
+
+  describe('onResize', () => {
+    it('calls onResize with terminal dimensions after initial connection', async () => {
+      const onResize = vi.fn();
+
+      render(<Terminal url={TEST_URL} connect onResize={onResize} />);
+
+      await waitFor(() =>
+        expect(onResize).toHaveBeenCalledWith({ rows: 24, cols: 80 })
+      );
+    });
+
+    it('calls onResize with terminal dimensions when connect changes to true', async () => {
+      const onResize = vi.fn();
+
+      const { rerender } = render(
+        <Terminal url={TEST_URL} connect={false} onResize={onResize} />
+      );
+      expect(onResize).not.toHaveBeenCalled();
+
+      rerender(<Terminal url={TEST_URL} connect onResize={onResize} />);
+
+      await waitFor(() =>
+        expect(onResize).toHaveBeenCalledWith({ rows: 24, cols: 80 })
+      );
+    });
+
+    // mockResizeObserver doesn't trigger resize
+    it.todo(
+      'calls onResize with terminal dimensions when container resizes',
+      async () => {
+        const onResize = vi.fn();
+
+        render(<Terminal url={TEST_URL} connect onResize={onResize} />);
+
+        await waitFor(() =>
+          expect(mockTerminalInstance.open).toHaveBeenCalled()
+        );
+        onResize.mockClear();
+
+        mockResizeObserverCallback([], {} as ResizeObserver);
+
+        expect(onResize).toHaveBeenCalledWith({ rows: 24, cols: 80 });
+      }
+    );
+
+    it('does not call onResize when connect=false', () => {
+      const onResize = vi.fn();
+
+      render(<Terminal url={TEST_URL} connect={false} onResize={onResize} />);
+
+      expect(onResize).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('error handling', () => {
+    it('does not show error notification when socket closes cleanly', async () => {
+      server.use(
+        wssLink.addEventListener('connection', ({ client }) => {
+          client.close();
+        })
+      );
+
+      const onStateChange = vi.fn();
+      render(<Terminal url={TEST_URL} connect onStateChange={onStateChange} />);
+
+      await waitFor(() => {
+        expect(onStateChange).toHaveBeenCalledWith('disconnected');
+      });
+      expect(vi.mocked(notifyError)).not.toHaveBeenCalled();
+    });
+  });
+});
diff --git a/app/react/components/Terminal/Terminal.tsx b/app/react/components/Terminal/Terminal.tsx
new file mode 100644
index 0000000..4e463aa
--- /dev/null
+++ b/app/react/components/Terminal/Terminal.tsx
@@ -0,0 +1,172 @@
+import { Terminal as XTerm } from '@xterm/xterm';
+import '@xterm/xterm/css/xterm.css';
+import { FitAddon } from '@xterm/addon-fit';
+import { useEffect, useRef } from 'react';
+
+import { error as notifyError } from '@/portainer/services/notifications';
+
+export type ShellState = 'idle' | 'connecting' | 'connected' | 'disconnected';
+
+export interface TerminalDimensions {
+  rows: number;
+  cols: number;
+}
+
+export const LINUX_SHELL_INIT_COMMANDS = [
+  'export LANG=C.UTF-8\n',
+  'export LC_ALL=C.UTF-8\n',
+  'export TERM="xterm-256color"\n',
+  'alias ls="ls --color=auto"\n',
+  'clear\n',
+];
+
+export function isLinuxTerminalCommand(command: string): boolean {
+  const LINUX_SHELLS = [
+    'bash',
+    'sh',
+    'zsh',
+    'ash',
+    'dash',
+    'fish',
+    'csh',
+    'ksh',
+  ];
+  const basename = command.split('/').pop() ?? command;
+  return LINUX_SHELLS.includes(basename);
+}
+
+interface Props {
+  url: string;
+  connect: boolean;
+  onStateChange?: (state: ShellState) => void;
+  onResize?: ((dimensions: TerminalDimensions) => void) | 'socket' | null;
+  initialCommands?: string[];
+}
+
+export function Terminal({
+  url,
+  connect,
+  onStateChange = () => {},
+  onResize,
+  initialCommands,
+}: Props) {
+  const terminalRef = useRef<HTMLDivElement>(null);
+  const socketRef = useRef<WebSocket | null>(null);
+  const termRef = useRef<XTerm | null>(null);
+
+  useEffect(() => {
+    if (!connect) {
+      return () => {};
+    }
+
+    let fitAddon: FitAddon | null = null;
+    let cleaned = false;
+    let lastSentSize: { rows: number; cols: number } | null = null;
+
+    onStateChange('connecting');
+
+    const socket = new WebSocket(url);
+    socketRef.current = socket;
+
+    const resizeObserver = new ResizeObserver(() => {
+      handleResize();
+    });
+
+    socket.addEventListener('open', onOpen);
+    socket.addEventListener('message', onMessage);
+    socket.addEventListener('close', onClose);
+    socket.addEventListener('error', onError);
+
+    return cleanup;
+
+    function onOpen() {
+      if (!terminalRef.current) {
+        return;
+      }
+      const term = new XTerm();
+      termRef.current = term;
+      fitAddon = new FitAddon();
+      term.loadAddon(fitAddon);
+      term.open(terminalRef.current);
+      term.options.cursorBlink = true;
+      term.focus();
+      setTimeout(() => {
+        handleResize();
+      }, 0);
+      term.onData((data) => {
+        if (socket.readyState === WebSocket.OPEN) {
+          socket.send(data);
+        }
+      });
+      term.onKey(({ domEvent }) => {
+        if (domEvent.ctrlKey && domEvent.key === 'd') {
+          cleanup();
+        }
+      });
+      resizeObserver.observe(terminalRef.current);
+      initialCommands?.forEach((cmd) => socket.send(cmd));
+      onStateChange('connected');
+    }
+
+    function onMessage(e: MessageEvent) {
+      const encoded = new TextEncoder().encode(e.data);
+      termRef.current?.write(encoded);
+    }
+
+    function onClose() {
+      cleanup();
+    }
+
+    function onError(e: Event) {
+      if (socket.readyState !== WebSocket.CLOSED) {
+        notifyError('Failure', e, 'Websocket connection error');
+      }
+      cleanup();
+    }
+
+    function cleanup() {
+      if (cleaned) return;
+      cleaned = true;
+      socket.removeEventListener('open', onOpen);
+      socket.removeEventListener('message', onMessage);
+      socket.removeEventListener('close', onClose);
+      socket.removeEventListener('error', onError);
+      resizeObserver.disconnect();
+      socket.close();
+      termRef.current?.dispose();
+      termRef.current = null;
+      socketRef.current = null;
+      fitAddon = null;
+      onStateChange('disconnected');
+    }
+
+    function handleResize() {
+      fitAddon?.fit();
+      if (termRef.current) {
+        const { rows, cols } = termRef.current;
+        if (lastSentSize?.rows === rows && lastSentSize?.cols === cols) {
+          return;
+        }
+
+        lastSentSize = { rows, cols };
+        if (typeof onResize === 'function') {
+          onResize({ rows, cols });
+        } else if (
+          onResize === 'socket' &&
+          socket.readyState === WebSocket.OPEN
+        ) {
+          socket.send(
+            JSON.stringify({
+              type: 'resize',
+              data: { width: cols, height: rows },
+            })
+          );
+        }
+      }
+    }
+    // onStateChange, onResize, and initialCommands intentionally excluded — callers pass stable refs
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [connect, url]);
+
+  return <div ref={terminalRef} className="h-full" />;
+}
diff --git a/app/react/components/TerminalTooltip/TerminalTooltip.tsx b/app/react/components/TerminalTooltip/TerminalTooltip.tsx
new file mode 100644
index 0000000..33745cd
--- /dev/null
+++ b/app/react/components/TerminalTooltip/TerminalTooltip.tsx
@@ -0,0 +1,42 @@
+import { BROWSER_OS_PLATFORM } from '@/react/constants';
+
+import { Tooltip } from '@@/Tip/Tooltip';
+
+const editorConfig = {
+  mac: {
+    tooltip: (
+      <>
+        <div>Within the console:</div>
+        <div>Cmd+C - Copy</div>
+        <div>Cmd+V - Paste</div>
+        <div>or right-click -&gt; Copy/Paste</div>
+      </>
+    ),
+  },
+
+  lin: {
+    tooltip: (
+      <>
+        <div>Within the console:</div>
+        <div>Ctrl+Insert - Copy</div>
+        <div>Shift+Insert - Paste</div>
+        <div>or right-click -&gt; Copy/Paste</div>
+      </>
+    ),
+  },
+
+  win: {
+    tooltip: (
+      <>
+        <div>Within the console:</div>
+        <div>Ctrl+Insert - Copy</div>
+        <div>Shift+Insert - Paste</div>
+        <div>or right-click -&gt; Copy/Paste</div>
+      </>
+    ),
+  },
+} as const;
+
+export function TerminalTooltip() {
+  return <Tooltip message={editorConfig[BROWSER_OS_PLATFORM].tooltip} />;
+}
diff --git a/app/react/components/TerminalTooltip/index.ts b/app/react/components/TerminalTooltip/index.ts
new file mode 100644
index 0000000..e9a67ba
--- /dev/null
+++ b/app/react/components/TerminalTooltip/index.ts
@@ -0,0 +1 @@
+export { TerminalTooltip } from './TerminalTooltip';
diff --git a/app/react/components/Tip/SliderTooltip/SliderTooltip.module.css b/app/react/components/Tip/SliderTooltip/SliderTooltip.module.css
new file mode 100644
index 0000000..b9e9ea4
--- /dev/null
+++ b/app/react/components/Tip/SliderTooltip/SliderTooltip.module.css
@@ -0,0 +1,34 @@
+:global(portainer-tooltip) {
+  @apply inline-flex;
+}
+
+.tooltip {
+  background-color: var(--bg-tooltip-color) !important;
+  color: var(--text-tooltip-color) !important;
+  border-radius: 10px !important;
+  box-shadow:
+    0 2px 4px 0 rgba(34, 36, 38, 0.12),
+    0 2px 10px 0 rgba(34, 36, 38, 0.15) !important;
+  max-width: 400px;
+  min-width: 50px;
+  font-size: 1rem !important;
+  font-weight: 400;
+  text-align: left;
+  width: max-content;
+}
+
+.tooltip-container {
+  line-height: 18px;
+  padding: 8px 10px !important;
+  font-size: 12px !important;
+  user-select: none;
+}
+
+.tooltip-centered .tooltip-container {
+  text-align: center;
+  user-select: none;
+}
+
+.tooltip-message a {
+  color: var(--blue-15) !important;
+}
diff --git a/app/react/components/Tip/SliderTooltip/SliderTooltip.tsx b/app/react/components/Tip/SliderTooltip/SliderTooltip.tsx
new file mode 100644
index 0000000..4038fd3
--- /dev/null
+++ b/app/react/components/Tip/SliderTooltip/SliderTooltip.tsx
@@ -0,0 +1,42 @@
+import Tippy from '@tippyjs/react';
+import clsx from 'clsx';
+
+import 'tippy.js/dist/tippy.css';
+
+import styles from './SliderTooltip.module.css';
+
+export interface Props {
+  value: string;
+  child: React.ReactElement;
+  delay: number;
+  zIndex?: number;
+}
+
+export function SliderTooltip({ value, child, delay, zIndex = 50 }: Props) {
+  return (
+    <Tippy
+      appendTo="parent"
+      zIndex={zIndex} // make the z index lower than the dialog
+      className={clsx(styles.tooltipCentered, styles.tooltip)}
+      content={messageHTML(value)}
+      placement="top"
+      showOnCreate
+      hideOnClick={false}
+      trigger="manual"
+      delay={delay}
+      arrow
+      allowHTML
+    >
+      {child}
+    </Tippy>
+  );
+}
+
+function messageHTML(value: string) {
+  let message = value;
+  if (message === '0') {
+    message = 'unlimited';
+  }
+
+  return <div className={styles.tooltipContainer}>{message}</div>;
+}
diff --git a/app/react/components/Tip/SliderTooltip/index.ts b/app/react/components/Tip/SliderTooltip/index.ts
new file mode 100644
index 0000000..12e70a1
--- /dev/null
+++ b/app/react/components/Tip/SliderTooltip/index.ts
@@ -0,0 +1 @@
+export { SliderTooltip } from './SliderTooltip';
diff --git a/app/react/components/Tip/TextTip/TextTip.stories.tsx b/app/react/components/Tip/TextTip/TextTip.stories.tsx
new file mode 100644
index 0000000..8b7a133
--- /dev/null
+++ b/app/react/components/Tip/TextTip/TextTip.stories.tsx
@@ -0,0 +1,20 @@
+import { Meta, StoryFn } from '@storybook/react-webpack5';
+import { PropsWithChildren } from 'react';
+
+import { TextTip } from './TextTip';
+
+export default {
+  component: TextTip,
+  title: 'Components/Tip/TextTip',
+} as Meta;
+
+function Template({
+  children,
+}: JSX.IntrinsicAttributes & PropsWithChildren<unknown>) {
+  return <TextTip>{children}</TextTip>;
+}
+
+export const Primary: StoryFn<PropsWithChildren<unknown>> = Template.bind({});
+Primary.args = {
+  children: 'This is a text tip with children',
+};
diff --git a/app/react/components/Tip/TextTip/TextTip.test.tsx b/app/react/components/Tip/TextTip/TextTip.test.tsx
new file mode 100644
index 0000000..cc6ac10
--- /dev/null
+++ b/app/react/components/Tip/TextTip/TextTip.test.tsx
@@ -0,0 +1,11 @@
+import { render } from '@testing-library/react';
+
+import { TextTip } from './TextTip';
+
+test('should display a TextTip with children', async () => {
+  const children = 'test text tip';
+  const { findByText } = render(<TextTip>{children}</TextTip>);
+
+  const heading = await findByText(children);
+  expect(heading).toBeTruthy();
+});
diff --git a/app/react/components/Tip/TextTip/TextTip.tsx b/app/react/components/Tip/TextTip/TextTip.tsx
new file mode 100644
index 0000000..9f492f2
--- /dev/null
+++ b/app/react/components/Tip/TextTip/TextTip.tsx
@@ -0,0 +1,54 @@
+import { ReactNode } from 'react';
+import { AlertCircle } from 'lucide-react';
+import clsx from 'clsx';
+
+import { Icon, IconMode } from '@@/Icon';
+
+type Color = 'orange' | 'blue' | 'red' | 'green';
+
+export interface Props {
+  icon?: React.ReactNode;
+  color?: Color;
+  className?: string;
+  childrenWrapperClassName?: string;
+  /** Whether the tip should be displayed inline or as a block. Defaults to inline. */
+  inline?: boolean;
+  children: ReactNode;
+}
+
+export function TextTip({
+  color = 'orange',
+  icon = AlertCircle,
+  inline = true,
+  className,
+  children,
+  childrenWrapperClassName,
+}: Props) {
+  return (
+    <div
+      className={clsx(
+        className,
+        'small gap-1 align-top text-xs',
+        inline ? 'inline-flex' : 'flex'
+      )}
+      role="status"
+    >
+      <Icon icon={icon} mode={getMode(color)} className="!mt-0.5 flex-none" />
+      <span className={childrenWrapperClassName}>{children}</span>
+    </div>
+  );
+}
+
+function getMode(color: Color): IconMode {
+  switch (color) {
+    case 'blue':
+      return 'primary';
+    case 'red':
+      return 'danger';
+    case 'green':
+      return 'success';
+    case 'orange':
+    default:
+      return 'warning';
+  }
+}
diff --git a/app/react/components/Tip/TextTip/index.ts b/app/react/components/Tip/TextTip/index.ts
new file mode 100644
index 0000000..e156930
--- /dev/null
+++ b/app/react/components/Tip/TextTip/index.ts
@@ -0,0 +1 @@
+export { TextTip } from './TextTip';
diff --git a/app/react/components/Tip/Tooltip/Tooltip.stories.tsx b/app/react/components/Tip/Tooltip/Tooltip.stories.tsx
new file mode 100644
index 0000000..81dfd0e
--- /dev/null
+++ b/app/react/components/Tip/Tooltip/Tooltip.stories.tsx
@@ -0,0 +1,23 @@
+import { Meta, StoryFn } from '@storybook/react-webpack5';
+
+import { Tooltip, Props } from './Tooltip';
+
+export default {
+  component: Tooltip,
+  title: 'Components/Tip/Tooltip',
+} as Meta;
+
+function Template({ message, position }: JSX.IntrinsicAttributes & Props) {
+  return (
+    <div className="col-sm-3 col-lg-2">
+      Example tooltip
+      <Tooltip message={message} position={position} />
+    </div>
+  );
+}
+
+export const Primary: StoryFn<Props> = Template.bind({});
+Primary.args = {
+  message: 'Tooltip example',
+  position: 'bottom',
+};
diff --git a/app/react/components/Tip/Tooltip/Tooltip.tsx b/app/react/components/Tip/Tooltip/Tooltip.tsx
new file mode 100644
index 0000000..92b76f5
--- /dev/null
+++ b/app/react/components/Tip/Tooltip/Tooltip.tsx
@@ -0,0 +1,53 @@
+import { HelpCircle } from 'lucide-react';
+import { ReactNode, useMemo } from 'react';
+import sanitize from 'sanitize-html';
+import clsx from 'clsx';
+
+import { TooltipWithChildren, Position } from '../TooltipWithChildren';
+
+type Size = 'xs' | 'sm' | 'md' | 'lg' | 'xl';
+
+const sizeClasses: Record<Size, string> = {
+  xs: 'text-xs',
+  sm: 'text-sm',
+  md: 'text-base',
+  lg: 'text-lg',
+  xl: 'text-xl',
+};
+
+export interface Props {
+  position?: Position;
+  message: ReactNode;
+  className?: string;
+  setHtmlMessage?: boolean;
+  size?: Size;
+}
+
+export function Tooltip({
+  message,
+  position = 'bottom',
+  className,
+  setHtmlMessage,
+  size = 'md',
+}: Props) {
+  // allow angular views to set html messages for the tooltip
+  const htmlMessage = useMemo(() => {
+    if (setHtmlMessage && typeof message === 'string') {
+      // eslint-disable-next-line react/no-danger
+      return <div dangerouslySetInnerHTML={{ __html: sanitize(message) }} />;
+    }
+    return null;
+  }, [setHtmlMessage, message]);
+
+  return (
+    <span className={clsx('ml-1 inline-flex items-center', sizeClasses[size])}>
+      <TooltipWithChildren
+        message={htmlMessage || message}
+        position={position}
+        className={className}
+      >
+        <HelpCircle className="lucide" />
+      </TooltipWithChildren>
+    </span>
+  );
+}
diff --git a/app/react/components/Tip/Tooltip/index.ts b/app/react/components/Tip/Tooltip/index.ts
new file mode 100644
index 0000000..b44d466
--- /dev/null
+++ b/app/react/components/Tip/Tooltip/index.ts
@@ -0,0 +1 @@
+export { Tooltip } from './Tooltip';
diff --git a/app/react/components/Tip/TooltipWithChildren/TooltipWithChildren.module.css b/app/react/components/Tip/TooltipWithChildren/TooltipWithChildren.module.css
new file mode 100644
index 0000000..39a11b6
--- /dev/null
+++ b/app/react/components/Tip/TooltipWithChildren/TooltipWithChildren.module.css
@@ -0,0 +1,45 @@
+:global(portainer-tooltip) {
+  @apply inline-flex;
+}
+
+.tooltip {
+  background-color: var(--bg-tooltip-color) !important;
+  color: var(--text-tooltip-color) !important;
+  border-radius: 10px !important;
+  box-shadow:
+    0 2px 4px 0 rgba(34, 36, 38, 0.12),
+    0 2px 10px 0 rgba(34, 36, 38, 0.15) !important;
+  min-width: 50px;
+  font-size: 1rem !important;
+  text-align: left;
+  font-weight: 400;
+  width: max-content;
+}
+
+.tooltip:hover {
+  visibility: visible !important;
+  opacity: 1 !important;
+}
+
+[theme='highcontrast'] .tooltip {
+  border: 1px solid var(--border-widget);
+  border-color: var(--white-color) !important;
+}
+
+.tooltip-container {
+  line-height: 18px;
+  padding: 8px 10px !important;
+  font-size: 12px !important;
+}
+
+.tooltip-message a {
+  color: var(--blue-15) !important;
+}
+
+.tooltip-heading {
+  font-weight: 500;
+}
+
+.tooltip-beteaser {
+  @apply text-blue-8 hover:text-blue-9;
+}
diff --git a/app/react/components/Tip/TooltipWithChildren/TooltipWithChildren.tsx b/app/react/components/Tip/TooltipWithChildren/TooltipWithChildren.tsx
new file mode 100644
index 0000000..819cd47
--- /dev/null
+++ b/app/react/components/Tip/TooltipWithChildren/TooltipWithChildren.tsx
@@ -0,0 +1,94 @@
+import React, { MouseEvent } from 'react';
+import Tippy, { type TippyProps } from '@tippyjs/react';
+import clsx from 'clsx';
+import _ from 'lodash';
+
+import 'tippy.js/dist/tippy.css';
+
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+
+import { getFeatureDetails } from '@@/BEFeatureIndicator/utils';
+
+import styles from './TooltipWithChildren.module.css';
+
+export type Position = 'top' | 'right' | 'bottom' | 'left';
+
+export interface Props {
+  position?: Position;
+  message: React.ReactNode;
+  className?: string;
+  children: React.ReactElement;
+  heading?: string;
+  BEFeatureID?: FeatureId;
+  appendTo?: TippyProps['appendTo'];
+}
+
+export function TooltipWithChildren({
+  message,
+  position = 'bottom',
+  className,
+  children,
+  heading,
+  BEFeatureID,
+  appendTo,
+}: Props) {
+  const id = _.uniqueId('tooltip-');
+
+  const { url, limitedToBE } = BEFeatureID
+    ? getFeatureDetails(BEFeatureID)
+    : { url: '', limitedToBE: false };
+
+  const messageHTML = (
+    // eslint-disable-next-line jsx-a11y/click-events-have-key-events, jsx-a11y/no-static-element-interactions
+    <div
+      className={styles.tooltipContainer}
+      onClick={onClickHandler}
+      onMouseDown={onMouseDownHandler}
+    >
+      {(heading || (BEFeatureID && limitedToBE)) && (
+        <div className="mb-3 inline-flex w-full justify-between">
+          <span>{heading}</span>
+          {BEFeatureID && limitedToBE && (
+            <a
+              href={url}
+              target="_blank"
+              rel="noreferrer"
+              className={styles.tooltipBeteaser}
+            >
+              Business Feature
+            </a>
+          )}
+        </div>
+      )}
+      <div className={styles.tooltipMessage}>{message}</div>
+    </div>
+  );
+
+  return (
+    <Tippy
+      className={clsx(id, styles.tooltip, className)}
+      content={messageHTML}
+      delay={[50, 500]} // 50ms to open, 500ms to hide
+      zIndex={1000}
+      placement={position}
+      maxWidth={400}
+      appendTo={appendTo}
+      arrow
+      allowHTML
+      interactive
+      disabled={!message}
+    >
+      <span>{children}</span>
+    </Tippy>
+  );
+}
+
+// Preventing click bubbling to the parent as it is affecting
+// mainly toggles when full row is clickable.
+function onClickHandler(e: MouseEvent) {
+  e.stopPropagation();
+}
+
+function onMouseDownHandler(e: MouseEvent) {
+  e.stopPropagation();
+}
diff --git a/app/react/components/Tip/TooltipWithChildren/index.ts b/app/react/components/Tip/TooltipWithChildren/index.ts
new file mode 100644
index 0000000..435a2cb
--- /dev/null
+++ b/app/react/components/Tip/TooltipWithChildren/index.ts
@@ -0,0 +1,2 @@
+export { TooltipWithChildren } from './TooltipWithChildren';
+export type { Position } from './TooltipWithChildren';
diff --git a/app/react/components/UsersSelector/UsersSelector.mocks.ts b/app/react/components/UsersSelector/UsersSelector.mocks.ts
new file mode 100644
index 0000000..d7ae9ab
--- /dev/null
+++ b/app/react/components/UsersSelector/UsersSelector.mocks.ts
@@ -0,0 +1,32 @@
+import { UserViewModel } from '@/portainer/models/user';
+
+export function createMockUser(id: number, username: string): UserViewModel {
+  return {
+    Id: id,
+    Username: username,
+    Role: 2,
+    EndpointAuthorizations: {},
+    UseCache: false,
+    PortainerAuthorizations: {
+      PortainerDockerHubInspect: true,
+      PortainerEndpointGroupInspect: true,
+      PortainerEndpointGroupList: true,
+      PortainerEndpointInspect: true,
+      PortainerEndpointList: true,
+      PortainerMOTD: true,
+      PortainerRoleList: true,
+      PortainerTeamList: true,
+      PortainerTemplateInspect: true,
+      PortainerTemplateList: true,
+      PortainerUserInspect: true,
+      PortainerUserList: true,
+      PortainerUserMemberships: true,
+    },
+    RoleName: 'user',
+    Checked: false,
+    AuthenticationMethod: '',
+    ThemeSettings: {
+      color: 'auto',
+    },
+  };
+}
diff --git a/app/react/components/UsersSelector/UsersSelector.stories.tsx b/app/react/components/UsersSelector/UsersSelector.stories.tsx
new file mode 100644
index 0000000..c9160e1
--- /dev/null
+++ b/app/react/components/UsersSelector/UsersSelector.stories.tsx
@@ -0,0 +1,30 @@
+import { Meta } from '@storybook/react-webpack5';
+import { useState } from 'react';
+
+import { UsersSelector } from './UsersSelector';
+import { createMockUser } from './UsersSelector.mocks';
+
+const meta: Meta = {
+  title: 'Components/UsersSelector',
+  component: UsersSelector,
+};
+
+export default meta;
+
+export { Example };
+
+function Example() {
+  const [selectedUsers, setSelectedUsers] = useState([1]);
+
+  const users = [createMockUser(1, 'user1'), createMockUser(2, 'user2')];
+
+  return (
+    <UsersSelector
+      value={selectedUsers}
+      onChange={setSelectedUsers}
+      users={users}
+      placeholder="Select one or more users"
+      dataCy="users-selector"
+    />
+  );
+}
diff --git a/app/react/components/UsersSelector/UsersSelector.tsx b/app/react/components/UsersSelector/UsersSelector.tsx
new file mode 100644
index 0000000..99068c2
--- /dev/null
+++ b/app/react/components/UsersSelector/UsersSelector.tsx
@@ -0,0 +1,45 @@
+import { User, UserId } from '@/portainer/users/types';
+
+import { Select } from '@@/form-components/ReactSelect';
+
+interface Props {
+  name?: string;
+  value: UserId[];
+  onChange(value: UserId[]): void;
+  users: User[];
+  dataCy: string;
+  inputId?: string;
+  placeholder?: string;
+  disabled?: boolean;
+}
+
+export function UsersSelector({
+  name,
+  value,
+  onChange,
+  users,
+  dataCy,
+  inputId,
+  placeholder,
+  disabled,
+}: Props) {
+  return (
+    <Select
+      isMulti
+      name={name}
+      getOptionLabel={(user) => user.Username}
+      getOptionValue={(user) => `${user.Id}`}
+      options={users}
+      value={users.filter((user) => value.includes(user.Id))}
+      closeMenuOnSelect={false}
+      onChange={(selectedUsers) =>
+        onChange(selectedUsers.map((user) => user.Id))
+      }
+      data-cy={dataCy}
+      id={dataCy}
+      inputId={inputId}
+      placeholder={placeholder}
+      isDisabled={disabled}
+    />
+  );
+}
diff --git a/app/react/components/UsersSelector/index.ts b/app/react/components/UsersSelector/index.ts
new file mode 100644
index 0000000..2406aa6
--- /dev/null
+++ b/app/react/components/UsersSelector/index.ts
@@ -0,0 +1 @@
+export { UsersSelector } from './UsersSelector';
diff --git a/app/react/components/VerticalSeparator.tsx b/app/react/components/VerticalSeparator.tsx
new file mode 100644
index 0000000..34434ff
--- /dev/null
+++ b/app/react/components/VerticalSeparator.tsx
@@ -0,0 +1,17 @@
+import clsx from 'clsx';
+
+interface Props {
+  className?: string;
+}
+
+export function VerticalSeparator({ className }: Props) {
+  return (
+    <div
+      className={clsx(
+        'mx-2 h-6 w-px shrink-0 bg-[var(--border-widget)]',
+        className
+      )}
+      aria-hidden="true"
+    />
+  );
+}
diff --git a/app/react/components/ViewLoading/ViewLoading.module.css b/app/react/components/ViewLoading/ViewLoading.module.css
new file mode 100644
index 0000000..09cd87d
--- /dev/null
+++ b/app/react/components/ViewLoading/ViewLoading.module.css
@@ -0,0 +1,13 @@
+.root {
+  width: 100%;
+  height: 100%;
+  text-align: center;
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+}
+
+.message {
+  margin-top: 25px;
+}
diff --git a/app/react/components/ViewLoading/ViewLoading.stories.tsx b/app/react/components/ViewLoading/ViewLoading.stories.tsx
new file mode 100644
index 0000000..c69b48a
--- /dev/null
+++ b/app/react/components/ViewLoading/ViewLoading.stories.tsx
@@ -0,0 +1,21 @@
+import { Meta, StoryFn } from '@storybook/react-webpack5';
+
+import { ViewLoading } from './ViewLoading';
+
+export default {
+  component: ViewLoading,
+  title: 'Components/ViewLoading',
+} as Meta;
+
+interface Args {
+  message: string;
+}
+
+function Template({ message }: Args) {
+  return <ViewLoading message={message} />;
+}
+
+export const Example: StoryFn<Args> = Template.bind({});
+Example.args = {
+  message: 'Loading...',
+};
diff --git a/app/react/components/ViewLoading/ViewLoading.tsx b/app/react/components/ViewLoading/ViewLoading.tsx
new file mode 100644
index 0000000..139c676
--- /dev/null
+++ b/app/react/components/ViewLoading/ViewLoading.tsx
@@ -0,0 +1,21 @@
+import clsx from 'clsx';
+
+import styles from './ViewLoading.module.css';
+
+interface Props {
+  message?: string;
+}
+
+export function ViewLoading({ message }: Props) {
+  return (
+    <div className={clsx('row', styles.root)}>
+      <div className="sk-fold">
+        <div className="sk-fold-cube" />
+        <div className="sk-fold-cube" />
+        <div className="sk-fold-cube" />
+        <div className="sk-fold-cube" />
+      </div>
+      {message && <span className={styles.message}>{message}</span>}
+    </div>
+  );
+}
diff --git a/app/react/components/ViewLoading/index.ts b/app/react/components/ViewLoading/index.ts
new file mode 100644
index 0000000..2658cde
--- /dev/null
+++ b/app/react/components/ViewLoading/index.ts
@@ -0,0 +1 @@
+export { ViewLoading } from './ViewLoading';
diff --git a/app/react/components/WebEditorForm.tsx b/app/react/components/WebEditorForm.tsx
new file mode 100644
index 0000000..1cd92e1
--- /dev/null
+++ b/app/react/components/WebEditorForm.tsx
@@ -0,0 +1,86 @@
+import { ReactNode, ComponentProps, PropsWithChildren, useMemo } from 'react';
+import { JSONSchema7 } from 'json-schema';
+
+import { CodeEditor } from '@@/CodeEditor';
+
+import { FormSectionTitle } from './form-components/FormSectionTitle';
+import { FormError } from './form-components/FormError';
+import { usePreventFormExit } from './form-components/usePreventFormExit';
+import { confirmWebEditorDiscard } from './modals/confirm';
+import { ShortcutsTooltip } from './CodeEditor/ShortcutsTooltip';
+
+type CodeEditorProps = ComponentProps<typeof CodeEditor>;
+
+interface Props extends CodeEditorProps {
+  titleContent?: ReactNode;
+  hideTitle?: boolean;
+  error?: string;
+  schema?: JSONSchema7;
+}
+
+export function WebEditorForm({
+  id,
+  titleContent = 'Web editor',
+  hideTitle,
+  children,
+  error,
+  schema,
+  textTip,
+  ...props
+}: PropsWithChildren<Props>) {
+  return (
+    <div>
+      <div className="web-editor overflow-x-hidden">
+        {!hideTitle && (
+          <DefaultTitle id={id}>{titleContent ?? null}</DefaultTitle>
+        )}
+        {children && (
+          <div className="form-group text-muted small">
+            <div className="col-sm-12 col-lg-12">{children}</div>
+          </div>
+        )}
+
+        {error && <FormError>{error}</FormError>}
+
+        <div className="form-group">
+          <div className="col-sm-12 col-lg-12">
+            <CodeEditor
+              id={id}
+              type="yaml"
+              schema={schema as JSONSchema7}
+              textTip={textTip}
+              // eslint-disable-next-line react/jsx-props-no-spreading
+              {...props}
+            />
+          </div>
+        </div>
+      </div>
+    </div>
+  );
+}
+
+function DefaultTitle({ id, children }: { id: string; children?: ReactNode }) {
+  return (
+    <FormSectionTitle htmlFor={id}>
+      {children}
+      <ShortcutsTooltip />
+    </FormSectionTitle>
+  );
+}
+
+export function usePreventExit(
+  initialValue: string,
+  value: string,
+  check: boolean
+) {
+  const isChanged = useMemo(
+    () => cleanText(initialValue) !== cleanText(value),
+    [initialValue, value]
+  );
+
+  usePreventFormExit(() => isChanged, check, confirmWebEditorDiscard);
+}
+
+function cleanText(value: string) {
+  return value.replace(/(\r\n|\n|\r)/gm, '');
+}
diff --git a/app/react/components/Widget/Loading.tsx b/app/react/components/Widget/Loading.tsx
new file mode 100644
index 0000000..40b433c
--- /dev/null
+++ b/app/react/components/Widget/Loading.tsx
@@ -0,0 +1,8 @@
+export function Loading() {
+  return (
+    <div className="loading">
+      <div className="double-bounce1" />
+      <div className="double-bounce2" />
+    </div>
+  );
+}
diff --git a/app/react/components/Widget/Widget.stories.tsx b/app/react/components/Widget/Widget.stories.tsx
new file mode 100644
index 0000000..7bdd2e3
--- /dev/null
+++ b/app/react/components/Widget/Widget.stories.tsx
@@ -0,0 +1,97 @@
+import { ReactNode } from 'react';
+import type { Meta } from '@storybook/react-webpack5';
+import { User } from 'lucide-react';
+
+import { Widget } from './Widget';
+import { WidgetBody } from './WidgetBody';
+import { WidgetTitle } from './WidgetTitle';
+import { WidgetFooter } from './WidgetFooter';
+import { WidgetTaskbar } from './WidgetTaskbar';
+
+interface WidgetProps {
+  loading: boolean;
+  title: string;
+  icon: ReactNode;
+  bodyText: string;
+  footerText: string;
+}
+
+const meta: Meta<WidgetProps> = {
+  title: 'Components/Widget',
+  component: Widget,
+  args: {
+    loading: false,
+    title: 'Title',
+    icon: User,
+    bodyText: 'Body',
+    footerText: 'Footer',
+  },
+};
+
+export default meta;
+
+export { Default, WidgetWithCustomImage, WidgetWithTaskBar };
+
+function Default({ loading, bodyText, footerText, icon, title }: WidgetProps) {
+  return (
+    <Widget>
+      <WidgetTitle title={title} icon={icon} />
+      <WidgetBody loading={loading}>{bodyText}</WidgetBody>
+      <WidgetFooter>{footerText}</WidgetFooter>
+    </Widget>
+  );
+}
+
+function WidgetWithCustomImage({
+  loading,
+  bodyText,
+  footerText,
+  icon,
+  title,
+}: WidgetProps) {
+  return (
+    <Widget>
+      <WidgetTitle
+        title={title}
+        icon={
+          typeof icon === 'string' ? (
+            <img
+              className="custom-header-ico space-right"
+              src={icon}
+              alt="header-icon"
+            />
+          ) : (
+            icon
+          )
+        }
+      />
+      <WidgetBody loading={loading}>{bodyText}</WidgetBody>
+      <WidgetFooter>{footerText}</WidgetFooter>
+    </Widget>
+  );
+}
+
+WidgetWithCustomImage.args = {
+  icon: 'https://via.placeholder.com/150',
+};
+
+function WidgetWithTaskBar({
+  loading,
+  bodyText,
+  footerText,
+  icon,
+  title,
+}: WidgetProps) {
+  return (
+    <Widget>
+      <WidgetTitle title={title} icon={icon} />
+      <WidgetTaskbar>
+        <button type="button" className="btn btn-primary">
+          Button
+        </button>
+      </WidgetTaskbar>
+      <WidgetBody loading={loading}>{bodyText}</WidgetBody>
+      <WidgetFooter>{footerText}</WidgetFooter>
+    </Widget>
+  );
+}
diff --git a/app/react/components/Widget/Widget.tsx b/app/react/components/Widget/Widget.tsx
new file mode 100644
index 0000000..25ea97f
--- /dev/null
+++ b/app/react/components/Widget/Widget.tsx
@@ -0,0 +1,61 @@
+import clsx from 'clsx';
+import {
+  createContext,
+  PropsWithChildren,
+  Ref,
+  useContext,
+  useMemo,
+} from 'react';
+
+import { useId } from '@/react/hooks/useId';
+
+interface WidgetContextValue {
+  titleId: string | undefined;
+}
+
+const Context = createContext<null | WidgetContextValue>(null);
+Context.displayName = 'WidgetContext';
+
+export function useWidgetContext() {
+  const context = useContext(Context);
+
+  if (context == null) {
+    throw new Error('Should be inside a Widget component');
+  }
+
+  return context;
+}
+
+export function Widget({
+  children,
+  className,
+  mRef,
+  id,
+  'aria-label': ariaLabel,
+  'data-cy': dataCy,
+}: PropsWithChildren<{
+  className?: string;
+  mRef?: Ref<HTMLDivElement>;
+  id?: string;
+  'aria-label'?: string;
+  'data-cy'?: string;
+}>) {
+  const generatedId = useId();
+  const titleId = ariaLabel ? undefined : `widget-title-${generatedId}`;
+  const contextValue = useMemo(() => ({ titleId }), [titleId]);
+
+  return (
+    <Context.Provider value={contextValue}>
+      <section
+        id={id}
+        className={clsx('widget', className)}
+        ref={mRef}
+        aria-label={ariaLabel}
+        aria-labelledby={titleId}
+        data-cy={dataCy}
+      >
+        {children}
+      </section>
+    </Context.Provider>
+  );
+}
diff --git a/app/react/components/Widget/WidgetBody.tsx b/app/react/components/Widget/WidgetBody.tsx
new file mode 100644
index 0000000..56d3194
--- /dev/null
+++ b/app/react/components/Widget/WidgetBody.tsx
@@ -0,0 +1,24 @@
+import clsx from 'clsx';
+import { PropsWithChildren } from 'react';
+
+import { useWidgetContext } from './Widget';
+import { Loading } from './Loading';
+
+interface Props {
+  loading?: boolean;
+  className?: string;
+}
+
+export function WidgetBody({
+  loading,
+  className,
+  children,
+}: PropsWithChildren<Props>) {
+  useWidgetContext();
+
+  return (
+    <div className={clsx(className, 'widget-body')}>
+      {loading ? <Loading /> : <div className="widget-content">{children}</div>}
+    </div>
+  );
+}
diff --git a/app/react/components/Widget/WidgetFooter.tsx b/app/react/components/Widget/WidgetFooter.tsx
new file mode 100644
index 0000000..cf59c5b
--- /dev/null
+++ b/app/react/components/Widget/WidgetFooter.tsx
@@ -0,0 +1,9 @@
+import { PropsWithChildren } from 'react';
+
+import { useWidgetContext } from './Widget';
+
+export function WidgetFooter({ children }: PropsWithChildren<unknown>) {
+  useWidgetContext();
+
+  return <div className="widget-footer">{children}</div>;
+}
diff --git a/app/react/components/Widget/WidgetIcon.tsx b/app/react/components/Widget/WidgetIcon.tsx
new file mode 100644
index 0000000..c91ec5e
--- /dev/null
+++ b/app/react/components/Widget/WidgetIcon.tsx
@@ -0,0 +1,11 @@
+import { ReactNode } from 'react';
+
+import { Icon } from '@@/Icon';
+
+export function WidgetIcon({ icon }: { icon: ReactNode }) {
+  return (
+    <div className="inline-flex items-center rounded-full bg-blue-3 p-2 text-lg text-blue-8 th-dark:bg-gray-9 th-dark:text-blue-3">
+      <Icon icon={icon} />
+    </div>
+  );
+}
diff --git a/app/react/components/Widget/WidgetTabs.stories.tsx b/app/react/components/Widget/WidgetTabs.stories.tsx
new file mode 100644
index 0000000..5aa39ea
--- /dev/null
+++ b/app/react/components/Widget/WidgetTabs.stories.tsx
@@ -0,0 +1,142 @@
+import type { Meta, StoryFn } from '@storybook/react-webpack5';
+import { Box, Settings, Users } from 'lucide-react';
+import {
+  ReactStateDeclaration,
+  UIRouter,
+  UIRouterReact,
+  UIView,
+  hashLocationPlugin,
+  servicesPlugin,
+} from '@uirouter/react';
+
+import { WidgetTabs, Tab } from './WidgetTabs';
+
+// Create a UIRouter instance with a dummy state so `Link to="."` works
+function withRouter(Story: () => JSX.Element) {
+  const router = new UIRouterReact();
+  router.plugin(servicesPlugin);
+  router.plugin(hashLocationPlugin);
+
+  // Register a dummy state that renders the Story
+  const storyState: ReactStateDeclaration = {
+    name: 'storybook',
+    url: '/?tab',
+    component: Story,
+  };
+  router.stateRegistry.register(storyState);
+
+  // Set initial state (UIRouter component calls start() automatically)
+  router.urlService.rules.initial({ state: 'storybook' });
+  router.urlService.rules.otherwise({ state: 'storybook' });
+
+  return (
+    <UIRouter router={router}>
+      <UIView />
+    </UIRouter>
+  );
+}
+
+const meta: Meta<typeof WidgetTabs> = {
+  title: 'Components/Widget/WidgetTabs',
+  component: WidgetTabs,
+  decorators: [withRouter],
+};
+
+export default meta;
+
+const defaultTabs: Tab[] = [
+  {
+    name: 'Overview',
+    widget: <div>Overview content</div>,
+    selectedTabParam: 'overview',
+  },
+  {
+    name: 'Settings',
+    widget: <div>Settings content</div>,
+    selectedTabParam: 'settings',
+  },
+  {
+    name: 'Users',
+    widget: <div>Users content</div>,
+    selectedTabParam: 'users',
+  },
+];
+
+const tabsWithIcons: Tab[] = [
+  {
+    name: 'Overview',
+    icon: Box,
+    widget: <div>Overview content</div>,
+    selectedTabParam: 'overview',
+  },
+  {
+    name: 'Settings',
+    icon: Settings,
+    widget: <div>Settings content</div>,
+    selectedTabParam: 'settings',
+  },
+  {
+    name: 'Users',
+    icon: Users,
+    widget: <div>Users content</div>,
+    selectedTabParam: 'users',
+  },
+];
+
+interface StoryArgs {
+  currentTabIndex: number;
+  tabs: Tab[];
+  useContainer?: boolean;
+}
+
+function Template({ currentTabIndex, tabs, useContainer }: StoryArgs) {
+  return (
+    <WidgetTabs
+      currentTabIndex={currentTabIndex}
+      tabs={tabs}
+      useContainer={useContainer}
+    />
+  );
+}
+
+export const Default: StoryFn<StoryArgs> = Template.bind({});
+Default.args = {
+  currentTabIndex: 0,
+  tabs: defaultTabs,
+};
+
+export const WithIcons: StoryFn<StoryArgs> = Template.bind({});
+WithIcons.args = {
+  currentTabIndex: 0,
+  tabs: tabsWithIcons,
+};
+
+export const SecondTabSelected: StoryFn<StoryArgs> = Template.bind({});
+SecondTabSelected.args = {
+  currentTabIndex: 1,
+  tabs: tabsWithIcons,
+};
+
+export const WithoutContainer: StoryFn<StoryArgs> = Template.bind({});
+WithoutContainer.args = {
+  currentTabIndex: 0,
+  tabs: tabsWithIcons,
+  useContainer: false,
+};
+
+export const TwoTabs: StoryFn<StoryArgs> = Template.bind({});
+TwoTabs.args = {
+  currentTabIndex: 0,
+  tabs: [
+    {
+      name: 'Tab 1',
+      widget: <div>Tab 1 content</div>,
+      selectedTabParam: 'tab1',
+    },
+    {
+      name: 'Tab 2',
+      widget: <div>Tab 2 content</div>,
+      selectedTabParam: 'tab2',
+    },
+  ],
+};
diff --git a/app/react/components/Widget/WidgetTabs.test.tsx b/app/react/components/Widget/WidgetTabs.test.tsx
new file mode 100644
index 0000000..4c4af17
--- /dev/null
+++ b/app/react/components/Widget/WidgetTabs.test.tsx
@@ -0,0 +1,173 @@
+import { render, screen } from '@testing-library/react';
+import { Layers } from 'lucide-react';
+import { ReactNode } from 'react';
+import { vi } from 'vitest';
+
+import { findSelectedTabIndex, Tab, WidgetTabs } from './WidgetTabs';
+
+// Mock Link component to avoid ui-router relative state resolution in tests
+vi.mock('@@/Link', () => ({
+  Link: ({
+    children,
+    'data-cy': dataCy,
+    'aria-current': ariaCurrent,
+    className,
+  }: {
+    children: ReactNode;
+    'data-cy'?: string;
+    'aria-current'?: 'page' | undefined;
+    className?: string;
+  }) => (
+    <a
+      data-cy={dataCy}
+      aria-current={ariaCurrent}
+      className={className}
+      href="/"
+    >
+      {children}
+    </a>
+  ),
+}));
+
+const mockTabs: Tab[] = [
+  {
+    name: 'Overview',
+    widget: <div>Overview content</div>,
+    selectedTabParam: 'overview',
+  },
+  {
+    name: 'Details',
+    widget: <div>Details content</div>,
+    selectedTabParam: 'details',
+  },
+  {
+    name: 'Settings',
+    widget: <div>Settings content</div>,
+    selectedTabParam: 'settings',
+  },
+];
+
+function renderWidgetTabs(
+  props: Partial<React.ComponentProps<typeof WidgetTabs>> = {}
+) {
+  const defaultProps = {
+    currentTabIndex: 0,
+    tabs: mockTabs,
+  };
+
+  return render(<WidgetTabs {...defaultProps} {...props} />);
+}
+
+describe('WidgetTabs', () => {
+  describe('rendering', () => {
+    it('renders all tabs and highlights the current tab', () => {
+      renderWidgetTabs({ currentTabIndex: 1 });
+
+      // All tabs should be visible
+      expect(screen.getByRole('link', { name: 'Overview' })).toBeVisible();
+      expect(screen.getByRole('link', { name: 'Details' })).toBeVisible();
+      expect(screen.getByRole('link', { name: 'Settings' })).toBeVisible();
+
+      // Only the selected tab should have aria-current="page"
+      expect(screen.getByRole('link', { name: 'Details' })).toHaveAttribute(
+        'aria-current',
+        'page'
+      );
+      expect(
+        screen.getByRole('link', { name: 'Overview' })
+      ).not.toHaveAttribute('aria-current');
+      expect(
+        screen.getByRole('link', { name: 'Settings' })
+      ).not.toHaveAttribute('aria-current');
+    });
+
+    it('renders tab icons when provided', () => {
+      const tabsWithIcons: Tab[] = [
+        {
+          name: 'Tab 1',
+          icon: Layers,
+          widget: <div />,
+          selectedTabParam: 'tab1',
+        },
+        { name: 'Tab 2', widget: <div />, selectedTabParam: 'tab2' },
+      ];
+
+      renderWidgetTabs({ tabs: tabsWithIcons, currentTabIndex: 0 });
+
+      // Tab with icon should contain an svg (lucide icon)
+      const tab1 = screen.getByRole('link', { name: 'Tab 1' });
+      expect(tab1.querySelector('svg')).toBeVisible();
+
+      // Tab without icon should not contain an svg
+      const tab2 = screen.getByRole('link', { name: 'Tab 2' });
+      expect(tab2.querySelector('svg')).toBeNull();
+    });
+
+    it('renders without container when useContainer is false', () => {
+      const { container } = renderWidgetTabs({ useContainer: false });
+
+      // Should not have the bootstrap row/col wrapper
+      expect(container.querySelector('.row')).toBeNull();
+      expect(container.querySelector('.col-sm-12')).toBeNull();
+    });
+
+    it('renders with container wrapper by default', () => {
+      const { container } = renderWidgetTabs();
+
+      // Should have the bootstrap row/col wrapper
+      expect(container.querySelector('.row')).toBeVisible();
+      expect(container.querySelector('.col-sm-12')).toBeVisible();
+    });
+  });
+
+  describe('error handling', () => {
+    it('throws an error when any tab has an invalid URL-encodable param value', () => {
+      // Tabs with characters that change when URL-encoded
+      const invalidTabs: Tab[] = [
+        {
+          name: 'Tab A',
+          widget: <div />,
+          selectedTabParam: 'param with spaces',
+        },
+        { name: 'Tab B', widget: <div />, selectedTabParam: 'good-param' },
+      ];
+
+      expect(() =>
+        renderWidgetTabs({ tabs: invalidTabs, currentTabIndex: 1 })
+      ).toThrow('Invalid query param value for tab');
+    });
+  });
+
+  describe('accessibility', () => {
+    it('has accessible navigation landmark with label', () => {
+      renderWidgetTabs();
+
+      const nav = screen.getByRole('navigation', {
+        name: 'Section navigation',
+      });
+      expect(nav).toBeVisible();
+    });
+  });
+});
+
+describe('findSelectedTabIndex', () => {
+  it('returns the correct index when tab param matches', () => {
+    const result = findSelectedTabIndex({ tab: 'details' }, mockTabs);
+    expect(result).toBe(1);
+  });
+
+  it('returns 0 when tab param does not match any tab', () => {
+    const result = findSelectedTabIndex({ tab: 'nonexistent' }, mockTabs);
+    expect(result).toBe(0);
+  });
+
+  it('returns 0 when params.tab is undefined', () => {
+    const result = findSelectedTabIndex({}, mockTabs);
+    expect(result).toBe(0);
+  });
+
+  it('returns the index of the first tab when params.tab matches first tab', () => {
+    const result = findSelectedTabIndex({ tab: 'overview' }, mockTabs);
+    expect(result).toBe(0);
+  });
+});
diff --git a/app/react/components/Widget/WidgetTabs.tsx b/app/react/components/Widget/WidgetTabs.tsx
new file mode 100644
index 0000000..5127bd6
--- /dev/null
+++ b/app/react/components/Widget/WidgetTabs.tsx
@@ -0,0 +1,81 @@
+import { RawParams, useCurrentStateAndParams } from '@uirouter/react';
+import { ReactNode } from 'react';
+
+import { Icon } from '@@/Icon';
+import { Link } from '@@/Link';
+import { Tabs } from '@@/primitives/Tabs/Tabs';
+
+export interface Tab {
+  name: ReactNode;
+  icon?: ReactNode;
+  widget: ReactNode;
+  selectedTabParam: string;
+}
+
+interface Props {
+  currentTabIndex: number;
+  tabs: Tab[];
+  useContainer?: boolean;
+  ariaLabel?: string;
+}
+
+export function WidgetTabs({
+  currentTabIndex,
+  tabs,
+  useContainer = true,
+  ariaLabel = 'Section navigation',
+}: Props) {
+  const invalidQueryParamValue = tabs.some(
+    (tab) => encodeURIComponent(tab.selectedTabParam) !== tab.selectedTabParam
+  );
+  if (invalidQueryParamValue) {
+    throw new Error('Invalid query param value for tab');
+  }
+
+  const tabsComponent = (
+    <Tabs.Container as="nav" aria-label={ariaLabel}>
+      {tabs.map(({ name, icon }, index) => (
+        <Tabs.Item key={index} asChild isActive={currentTabIndex === index}>
+          <Link
+            to="."
+            params={{ tab: tabs[index].selectedTabParam }}
+            data-cy={`tab-${index}`}
+            aria-current={currentTabIndex === index ? 'page' : undefined}
+          >
+            {icon && <Icon icon={icon} />}
+            {name}
+          </Link>
+        </Tabs.Item>
+      ))}
+    </Tabs.Container>
+  );
+
+  if (useContainer) {
+    return (
+      <div className="row">
+        <div className="col-sm-12">{tabsComponent}</div>
+      </div>
+    );
+  }
+
+  return tabsComponent;
+}
+
+// findSelectedTabIndex returns the index of the tab, or 0 if none is selected
+export function findSelectedTabIndex(params: RawParams, tabs: Tab[]) {
+  const selectedTabParam = params.tab || tabs[0].selectedTabParam;
+  const currentTabIndex = tabs.findIndex(
+    (tab) => tab.selectedTabParam === selectedTabParam
+  );
+  if (currentTabIndex === -1) {
+    return 0;
+  }
+  return currentTabIndex;
+}
+
+export function useCurrentTabIndex(tabs: Tab[]) {
+  const params = useCurrentStateAndParams();
+  const currentTabIndex = findSelectedTabIndex(params.params, tabs);
+
+  return currentTabIndex;
+}
diff --git a/app/react/components/Widget/WidgetTaskbar.tsx b/app/react/components/Widget/WidgetTaskbar.tsx
new file mode 100644
index 0000000..f718df6
--- /dev/null
+++ b/app/react/components/Widget/WidgetTaskbar.tsx
@@ -0,0 +1,22 @@
+import { PropsWithChildren } from 'react';
+
+import { useWidgetContext } from './Widget';
+
+interface Props {
+  className?: string;
+}
+
+export function WidgetTaskbar({
+  children,
+  className,
+}: PropsWithChildren<Props>) {
+  useWidgetContext();
+
+  return (
+    <div className="widget-header">
+      <div className="row">
+        <div className={className}>{children}</div>
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/components/Widget/WidgetTitle.tsx b/app/react/components/Widget/WidgetTitle.tsx
new file mode 100644
index 0000000..5d0652c
--- /dev/null
+++ b/app/react/components/Widget/WidgetTitle.tsx
@@ -0,0 +1,37 @@
+import clsx from 'clsx';
+import { PropsWithChildren, ReactNode } from 'react';
+
+import { WidgetIcon } from './WidgetIcon';
+import { useWidgetContext } from './Widget';
+
+interface Props {
+  title: ReactNode;
+  icon?: ReactNode;
+  className?: string;
+  subtitle?: string;
+}
+
+export function WidgetTitle({
+  title,
+  icon,
+  className,
+  children,
+  subtitle,
+}: PropsWithChildren<Props>) {
+  const { titleId } = useWidgetContext();
+
+  return (
+    <div className="widget-header">
+      <div className="flex items-center justify-between">
+        <span className={clsx('inline-flex items-center gap-1', className)}>
+          {icon && <WidgetIcon icon={icon} />}
+          <h2 id={titleId} className={clsx('m-0 text-base', icon && 'ml-1')}>
+            {title}
+          </h2>
+        </span>
+        <span className={clsx('flex items-center', className)}>{children}</span>
+      </div>
+      {subtitle && <span className="text-muted small">{subtitle}</span>}
+    </div>
+  );
+}
diff --git a/app/react/components/Widget/index.ts b/app/react/components/Widget/index.ts
new file mode 100644
index 0000000..accc92b
--- /dev/null
+++ b/app/react/components/Widget/index.ts
@@ -0,0 +1,35 @@
+import { Widget as MainComponent } from './Widget';
+import { WidgetBody } from './WidgetBody';
+import { WidgetFooter } from './WidgetFooter';
+import { WidgetTitle } from './WidgetTitle';
+import { WidgetTaskbar } from './WidgetTaskbar';
+import { Loading } from './Loading';
+import { WidgetTabs } from './WidgetTabs';
+
+interface WithSubcomponents {
+  Body: typeof WidgetBody;
+  Footer: typeof WidgetFooter;
+  Title: typeof WidgetTitle;
+  Tabs: typeof WidgetTabs;
+  Taskbar: typeof WidgetTaskbar;
+  Loading: typeof Loading;
+}
+
+const Widget = MainComponent as typeof MainComponent & WithSubcomponents;
+
+Widget.Body = WidgetBody;
+Widget.Footer = WidgetFooter;
+Widget.Title = WidgetTitle;
+Widget.Tabs = WidgetTabs;
+Widget.Taskbar = WidgetTaskbar;
+Widget.Loading = Loading;
+
+export {
+  Widget,
+  WidgetBody,
+  WidgetFooter,
+  WidgetTitle,
+  WidgetTabs,
+  WidgetTaskbar,
+  Loading,
+};
diff --git a/app/react/components/buttons/AddButton.stories.tsx b/app/react/components/buttons/AddButton.stories.tsx
new file mode 100644
index 0000000..edd7d99
--- /dev/null
+++ b/app/react/components/buttons/AddButton.stories.tsx
@@ -0,0 +1,21 @@
+import { Meta, StoryFn } from '@storybook/react-webpack5';
+
+import { AddButton } from './AddButton';
+
+export default {
+  component: AddButton,
+  title: 'Components/Buttons/AddButton',
+} as Meta;
+
+type Args = {
+  label: string;
+};
+
+function Template({ label }: Args) {
+  return <AddButton data-cy="add-">{label}</AddButton>;
+}
+
+export const Primary: StoryFn<Args> = Template.bind({});
+Primary.args = {
+  label: 'Create new container',
+};
diff --git a/app/react/components/buttons/AddButton.test.tsx b/app/react/components/buttons/AddButton.test.tsx
new file mode 100644
index 0000000..12abb76
--- /dev/null
+++ b/app/react/components/buttons/AddButton.test.tsx
@@ -0,0 +1,45 @@
+import { UIView } from '@uirouter/react';
+import { render } from '@testing-library/react';
+
+import { withTestRouter } from '@/react/test-utils/withRouter';
+
+import { AddButton } from './AddButton';
+
+function renderDefault({
+  label = 'default label',
+}: Partial<{ label: string }> = {}) {
+  const Wrapped = withTestRouter(AddButton, {
+    stateConfig: [
+      {
+        name: 'root',
+        url: '/',
+
+        component: () => (
+          <>
+            <div>Root</div>
+            <UIView />
+          </>
+        ),
+      },
+      {
+        name: 'root.new',
+        url: 'new',
+      },
+    ],
+    route: 'root',
+  });
+  return render(
+    <Wrapped to="" data-cy="wrapped">
+      {label}
+    </Wrapped>
+  );
+}
+
+test('should display a AddButton component', async () => {
+  const label = 'test label';
+
+  const { findByText } = renderDefault({ label });
+
+  const buttonLabel = await findByText(label);
+  expect(buttonLabel).toBeTruthy();
+});
diff --git a/app/react/components/buttons/AddButton.tsx b/app/react/components/buttons/AddButton.tsx
new file mode 100644
index 0000000..9891839
--- /dev/null
+++ b/app/react/components/buttons/AddButton.tsx
@@ -0,0 +1,38 @@
+import { Plus } from 'lucide-react';
+import { ComponentProps, PropsWithChildren } from 'react';
+
+import { AutomationTestingProps } from '@/types';
+
+import { Link } from '@@/Link';
+
+import { Button } from './Button';
+
+export function AddButton({
+  to = '.new',
+  params,
+  children,
+  color = 'primary',
+  disabled,
+  'data-cy': dataCy,
+}: PropsWithChildren<
+  {
+    to?: string;
+    params?: object;
+    color?: ComponentProps<typeof Button>['color'];
+    disabled?: boolean;
+  } & AutomationTestingProps
+>) {
+  return (
+    <Button
+      as={Link}
+      props={{ to, params }}
+      icon={Plus}
+      className="!m-0"
+      data-cy={dataCy}
+      color={color}
+      disabled={disabled}
+    >
+      {children || 'Add'}
+    </Button>
+  );
+}
diff --git a/app/react/components/buttons/Button.css b/app/react/components/buttons/Button.css
new file mode 100644
index 0000000..4358fe8
--- /dev/null
+++ b/app/react/components/buttons/Button.css
@@ -0,0 +1,32 @@
+.btn-blue {
+  @apply border-blue-8 bg-blue-8 text-white;
+  @apply hover:border-blue-9 hover:bg-blue-9 hover:text-white;
+  @apply th-dark:border-blue-7 th-dark:bg-blue-7 th-dark:text-white th-dark:hover:border-blue-6 th-dark:hover:bg-blue-6 th-dark:hover:text-white;
+  @apply th-highcontrast:border th-highcontrast:border-solid th-highcontrast:border-white th-highcontrast:bg-blue-8 th-highcontrast:text-white th-highcontrast:hover:bg-blue-9 th-highcontrast:hover:text-white;
+}
+
+.btn-none {
+  padding: 0;
+  margin: 0;
+  background-color: transparent;
+  border: 0;
+}
+
+.btn-none:focus {
+  outline: none;
+  color: inherit;
+}
+
+/* used for BE teaser. Dark theme specs defined by EE-5621 */
+.btn-warninglight {
+  @apply border-warning-5 bg-warning-2 text-black;
+  @apply th-dark:border-blue-8 th-dark:bg-blue-8 th-dark:bg-opacity-10 th-dark:text-white;
+  @apply th-highcontrast:bg-warning-5 th-highcontrast:bg-opacity-10 th-highcontrast:text-white;
+}
+
+.btn-none:active {
+  outline: none;
+  background-color: transparent;
+  box-shadow: none;
+  -webkit-box-shadow: none;
+}
diff --git a/app/react/components/buttons/Button.stories.tsx b/app/react/components/buttons/Button.stories.tsx
new file mode 100644
index 0000000..0dc5c9f
--- /dev/null
+++ b/app/react/components/buttons/Button.stories.tsx
@@ -0,0 +1,202 @@
+import { Meta, StoryFn } from '@storybook/react-webpack5';
+import { PropsWithChildren } from 'react';
+import { Download } from 'lucide-react';
+
+import { Button, Props } from './Button';
+
+export default {
+  component: Button,
+  title: 'Components/Buttons/Button',
+} as Meta;
+
+export function DifferentTheme() {
+  const colors = [
+    'primary',
+    'secondary',
+    'danger',
+    'dangerlight',
+    'light',
+    'link',
+  ] as const;
+
+  const themes = ['light', 'dark', 'highcontrast'] as const;
+  const states = ['', 'disabled'] as const;
+  return (
+    <table>
+      <thead>
+        <tr>
+          <th>Color/Theme</th>
+          {themes.map((theme) => (
+            <th key={theme} className="text-center">
+              {theme}
+            </th>
+          ))}
+        </tr>
+      </thead>
+      <tbody>
+        {colors.map((color) => (
+          <tr key={color}>
+            <td>{color}</td>
+            {themes.map((theme) => (
+              <td
+                key={theme}
+                // eslint-disable-next-line @typescript-eslint/ban-ts-comment,
+                // @ts-ignore
+                // eslint-disable-next-line react/no-unknown-property
+                theme={theme}
+                className="p-5"
+                style={{ background: 'var(--bg-body-color)' }}
+              >
+                {states.map((state) => (
+                  <Button
+                    color={color}
+                    data-cy="button"
+                    key={state}
+                    disabled={state === 'disabled'}
+                  >
+                    {state} {color} button
+                  </Button>
+                ))}
+              </td>
+            ))}
+          </tr>
+        ))}
+      </tbody>
+    </table>
+  );
+}
+
+function Template({
+  onClick,
+  color,
+  size,
+  disabled,
+}: JSX.IntrinsicAttributes & PropsWithChildren<Props>) {
+  return (
+    <Button
+      onClick={onClick}
+      color={color}
+      size={size}
+      disabled={disabled}
+      data-cy="button"
+    >
+      Primary Button
+    </Button>
+  );
+}
+
+export const Primary: StoryFn<PropsWithChildren<Props>> = Template.bind({});
+Primary.args = {
+  color: 'primary',
+  size: 'small',
+  disabled: false,
+  onClick: () => {
+    alert('Hello Button!');
+  },
+};
+
+export function Disabled() {
+  return (
+    <Button color="primary" onClick={() => {}} disabled data-cy="button">
+      Disabled Button
+    </Button>
+  );
+}
+
+export function Danger() {
+  return (
+    <Button color="danger" onClick={() => {}} data-cy="button">
+      Danger Button
+    </Button>
+  );
+}
+
+export function ButtonIcon() {
+  return (
+    <Button color="primary" onClick={() => {}} icon={Download} data-cy="button">
+      Button with an icon
+    </Button>
+  );
+}
+
+export function ButtonIconLarge() {
+  return (
+    <Button
+      color="primary"
+      onClick={() => {}}
+      icon={Download}
+      size="large"
+      data-cy="button"
+    >
+      Button with an icon
+    </Button>
+  );
+}
+
+export function ButtonIconMedium() {
+  return (
+    <Button
+      color="primary"
+      onClick={() => {}}
+      icon={Download}
+      size="medium"
+      data-cy="button"
+    >
+      Button with an icon
+    </Button>
+  );
+}
+
+export function ButtonIconXSmall() {
+  return (
+    <Button
+      color="primary"
+      onClick={() => {}}
+      icon={Download}
+      size="xsmall"
+      data-cy="button"
+    >
+      Button with an icon
+    </Button>
+  );
+}
+
+export function Default() {
+  return (
+    <Button color="default" onClick={() => {}} data-cy="button">
+      Default
+    </Button>
+  );
+}
+
+export function Link() {
+  return (
+    <Button color="link" onClick={() => {}} data-cy="button">
+      Link Button
+    </Button>
+  );
+}
+
+export function XSmall() {
+  return (
+    <Button color="primary" onClick={() => {}} size="xsmall" data-cy="button">
+      XSmall Button
+    </Button>
+  );
+}
+
+export function Small() {
+  return (
+    <Button color="primary" onClick={() => {}} size="small" data-cy="button">
+      Small Button
+    </Button>
+  );
+}
+
+export function Large() {
+  return (
+    <Button color="primary" onClick={() => {}} size="large" data-cy="button">
+      Large Button
+    </Button>
+  );
+}
diff --git a/app/react/components/buttons/Button.test.tsx b/app/react/components/buttons/Button.test.tsx
new file mode 100644
index 0000000..a1a6812
--- /dev/null
+++ b/app/react/components/buttons/Button.test.tsx
@@ -0,0 +1,38 @@
+import { PropsWithChildren } from 'react';
+import { fireEvent, render } from '@testing-library/react';
+
+import { Button, Props } from './Button';
+
+function renderDefault({
+  type = 'button',
+  color = 'primary',
+  size = 'small',
+  disabled = false,
+  onClick = () => {},
+  children = null,
+}: Partial<PropsWithChildren<Props>> = {}) {
+  return render(
+    <Button
+      type={type}
+      data-cy="button"
+      color={color}
+      size={size}
+      disabled={disabled}
+      onClick={onClick}
+    >
+      {children}
+    </Button>
+  );
+}
+
+test('should display a Button component and allow onClick', async () => {
+  const children = 'test label';
+  const onClick = vi.fn();
+  const { findByText } = renderDefault({ children, onClick });
+
+  const buttonLabel = await findByText(children);
+  expect(buttonLabel).toBeTruthy();
+
+  fireEvent.click(buttonLabel);
+  expect(onClick).toHaveBeenCalled();
+});
diff --git a/app/react/components/buttons/Button.tsx b/app/react/components/buttons/Button.tsx
new file mode 100644
index 0000000..d37525e
--- /dev/null
+++ b/app/react/components/buttons/Button.tsx
@@ -0,0 +1,124 @@
+import {
+  AriaAttributes,
+  ComponentType,
+  forwardRef,
+  MouseEventHandler,
+  PropsWithChildren,
+  ReactNode,
+} from 'react';
+import clsx from 'clsx';
+
+import { AutomationTestingProps } from '@/types';
+
+import { Icon } from '@@/Icon';
+import './Button.css';
+
+type Type = 'submit' | 'button' | 'reset';
+type Color =
+  | 'default'
+  | 'primary'
+  | 'secondary'
+  | 'danger'
+  | 'link'
+  | 'light'
+  | 'dangerlight'
+  | 'warninglight'
+  | 'warning'
+  | 'success'
+  | 'blue'
+  | 'none';
+type Size = 'xsmall' | 'small' | 'medium' | 'large';
+
+export interface Props<TasProps = unknown>
+  extends AriaAttributes, AutomationTestingProps {
+  icon?: ReactNode | ComponentType<unknown>;
+
+  color?: Color;
+  size?: Size;
+  disabled?: boolean;
+  title?: string;
+  className?: string;
+  type?: Type;
+  as?: ComponentType<TasProps> | string;
+  onClick?: MouseEventHandler<HTMLButtonElement>;
+  mRef?: React.ForwardedRef<HTMLButtonElement>;
+  props?: Omit<TasProps, keyof Props>;
+}
+
+export const ButtonWithRef = forwardRef<
+  HTMLButtonElement,
+  PropsWithChildren<Omit<Props, 'mRef'>>
+>((props, ref) => (
+  // eslint-disable-next-line react/jsx-props-no-spreading
+  <Button {...props} mRef={ref} />
+));
+
+ButtonWithRef.displayName = 'ButtonWithRef';
+
+export function Button<TasProps = unknown>({
+  type = 'button',
+  color = 'primary',
+  size = 'small',
+  disabled = false,
+  className,
+  onClick,
+  title,
+  icon,
+  children,
+  as = 'button',
+  props,
+  mRef,
+  ...ariaProps
+}: PropsWithChildren<Props<TasProps>>) {
+  const Component = as as 'button';
+  return (
+    <Component
+      ref={mRef}
+      type={type}
+      disabled={disabled}
+      className={clsx(`btn btn-${color}`, sizeClass(size), className, {
+        disabled,
+      })}
+      onClick={(e) => {
+        if (!disabled) {
+          onClick?.(e);
+        }
+      }}
+      title={title}
+      // eslint-disable-next-line react/jsx-props-no-spreading
+      {...ariaProps}
+      // eslint-disable-next-line react/jsx-props-no-spreading
+      {...props}
+    >
+      {icon && <Icon icon={icon} size={getIconSize(size)} />}
+      {children}
+    </Component>
+  );
+}
+
+function getIconSize(size: Size) {
+  switch (size) {
+    case 'xsmall':
+      return 'xs';
+    case 'medium':
+      return 'md';
+    case 'large':
+      return 'lg';
+    case 'small':
+    default:
+      return 'sm';
+  }
+}
+
+function sizeClass(size?: Size) {
+  switch (size) {
+    case 'large':
+      return 'btn-lg';
+    case 'medium':
+      return 'btn-md';
+    case 'xsmall':
+      return 'btn-xs';
+    default:
+      return 'btn-sm';
+  }
+}
diff --git a/app/react/components/buttons/ButtonGroup.stories.tsx b/app/react/components/buttons/ButtonGroup.stories.tsx
new file mode 100644
index 0000000..acad7a1
--- /dev/null
+++ b/app/react/components/buttons/ButtonGroup.stories.tsx
@@ -0,0 +1,123 @@
+import { Meta, StoryFn } from '@storybook/react-webpack5';
+import { PropsWithChildren } from 'react';
+import { Play, RefreshCw, Square, Trash2 } from 'lucide-react';
+
+import { Button } from './Button';
+import { ButtonGroup, Props } from './ButtonGroup';
+
+export default {
+  component: ButtonGroup,
+  title: 'Components/Buttons/ButtonGroup',
+} as Meta;
+
+function Template({
+  size,
+}: JSX.IntrinsicAttributes & PropsWithChildren<Props>) {
+  return (
+    <ButtonGroup size={size}>
+      <Button icon={Play} color="primary" onClick={() => {}} data-cy="button">
+        Start
+      </Button>
+      <Button icon={Square} color="danger" onClick={() => {}} data-cy="button">
+        Stop
+      </Button>
+      <Button
+        icon={RefreshCw}
+        color="primary"
+        onClick={() => {}}
+        data-cy="button"
+      >
+        Restart
+      </Button>
+      <Button
+        icon={Play}
+        color="primary"
+        disabled
+        onClick={() => {}}
+        data-cy="button"
+      >
+        Resume
+      </Button>
+      <Button icon={Trash2} color="danger" onClick={() => {}} data-cy="button">
+        Remove
+      </Button>
+    </ButtonGroup>
+  );
+}
+
+export const Primary: StoryFn<PropsWithChildren<Props>> = Template.bind({});
+Primary.args = {
+  size: 'small',
+};
+
+export function Xsmall() {
+  return (
+    <ButtonGroup size="xsmall">
+      <Button icon={Play} color="primary" onClick={() => {}} data-cy="button">
+        Start
+      </Button>
+      <Button icon={Square} color="danger" onClick={() => {}} data-cy="button">
+        Stop
+      </Button>
+      <Button icon={Play} color="primary" onClick={() => {}} data-cy="button">
+        Start
+      </Button>
+      <Button
+        icon={RefreshCw}
+        color="primary"
+        onClick={() => {}}
+        data-cy="button"
+      >
+        Restart
+      </Button>
+    </ButtonGroup>
+  );
+}
+
+export function Small() {
+  return (
+    <ButtonGroup size="small">
+      <Button icon={Play} color="primary" onClick={() => {}} data-cy="button">
+        Start
+      </Button>
+      <Button icon={Square} color="danger" onClick={() => {}} data-cy="button">
+        Stop
+      </Button>
+      <Button icon={Play} color="primary" onClick={() => {}} data-cy="button">
+        Start
+      </Button>
+      <Button
+        icon={RefreshCw}
+        color="primary"
+        onClick={() => {}}
+        data-cy="button"
+      >
+        Restart
+      </Button>
+    </ButtonGroup>
+  );
+}
+
+export function Large() {
+  return (
+    <ButtonGroup size="large">
+      <Button icon={Play} color="primary" onClick={() => {}} data-cy="button">
+        Start
+      </Button>
+      <Button icon={Square} color="danger" onClick={() => {}} data-cy="button">
+        Stop
+      </Button>
+      <Button icon={Play} color="light" onClick={() => {}} data-cy="button">
+        Start
+      </Button>
+      <Button
+        icon={RefreshCw}
+        color="primary"
+        onClick={() => {}}
+        data-cy="button"
+      >
+        Restart
+      </Button>
+    </ButtonGroup>
+  );
+}
diff --git a/app/react/components/buttons/ButtonGroup.test.tsx b/app/react/components/buttons/ButtonGroup.test.tsx
new file mode 100644
index 0000000..bcd6384
--- /dev/null
+++ b/app/react/components/buttons/ButtonGroup.test.tsx
@@ -0,0 +1,18 @@
+import { PropsWithChildren } from 'react';
+import { render } from '@testing-library/react';
+
+import { ButtonGroup, Props } from './ButtonGroup';
+
+function renderDefault({
+  size = 'small',
+  children = 'null',
+}: Partial<PropsWithChildren<Props>> = {}) {
+  return render(<ButtonGroup size={size}>{children}</ButtonGroup>);
+}
+
+test('should display a ButtonGroup component', async () => {
+  const { findByRole } = renderDefault({});
+
+  const element = await findByRole('group');
+  expect(element).toBeTruthy();
+});
diff --git a/app/react/components/buttons/ButtonGroup.tsx b/app/react/components/buttons/ButtonGroup.tsx
new file mode 100644
index 0000000..eb197f7
--- /dev/null
+++ b/app/react/components/buttons/ButtonGroup.tsx
@@ -0,0 +1,39 @@
+import { PropsWithChildren } from 'react';
+import clsx from 'clsx';
+
+export type Size = 'xsmall' | 'small' | 'large';
+export interface Props {
+  size?: Size;
+  className?: string;
+  'aria-label'?: string;
+}
+
+export function ButtonGroup({
+  size,
+  children,
+  className,
+  'aria-label': ariaLabel,
+}: PropsWithChildren<Props>) {
+  return (
+    <div
+      className={clsx('btn-group', sizeClass(size), className)}
+      role="group"
+      aria-label={ariaLabel}
+    >
+      {children}
+    </div>
+  );
+}
+
+function sizeClass(size: Size | undefined) {
+  switch (size) {
+    case 'small':
+      return 'btn-group-sm';
+    case 'xsmall':
+      return 'btn-group-xs';
+    case 'large':
+      return 'btn-group-lg';
+    default:
+      return '';
+  }
+}
diff --git a/app/react/components/buttons/CopyButton/CopyButton.module.css b/app/react/components/buttons/CopyButton/CopyButton.module.css
new file mode 100644
index 0000000..94607ae
--- /dev/null
+++ b/app/react/components/buttons/CopyButton/CopyButton.module.css
@@ -0,0 +1,43 @@
+.fadeout {
+  animation: fadeOut 2.5s;
+  animation-fill-mode: forwards;
+}
+
+.container {
+  display: flex;
+  align-items: baseline;
+}
+
+.copy-button {
+  opacity: 0;
+  color: #23ae89;
+}
+
+@-webkit-keyframes fadeOut {
+  0% {
+    opacity: 1;
+  }
+  50% {
+    opacity: 0.8;
+  }
+  99% {
+    opacity: 0.01;
+  }
+  100% {
+    opacity: 0;
+  }
+}
+@keyframes fadeOut {
+  0% {
+    opacity: 1;
+  }
+  50% {
+    opacity: 0.8;
+  }
+  99% {
+    opacity: 0.01;
+  }
+  100% {
+    opacity: 0;
+  }
+}
diff --git a/app/react/components/buttons/CopyButton/CopyButton.stories.tsx b/app/react/components/buttons/CopyButton/CopyButton.stories.tsx
new file mode 100644
index 0000000..f8778ab
--- /dev/null
+++ b/app/react/components/buttons/CopyButton/CopyButton.stories.tsx
@@ -0,0 +1,38 @@
+import { Meta, StoryFn } from '@storybook/react-webpack5';
+import { PropsWithChildren } from 'react';
+
+import { CopyButton, Props } from './CopyButton';
+
+export default {
+  component: CopyButton,
+  title: 'Components/Buttons/CopyButton',
+} as Meta;
+
+function Template({
+  copyText,
+  displayText,
+  children,
+}: JSX.IntrinsicAttributes & PropsWithChildren<Props>) {
+  return (
+    <CopyButton
+      copyText={copyText}
+      displayText={displayText}
+      data-cy="copy-button"
+    >
+      {children}
+    </CopyButton>
+  );
+}
+
+export const Primary: StoryFn<PropsWithChildren<Props>> = Template.bind({});
+Primary.args = {
+  children: 'Copy',
+  copyText: 'this will be copied to clipboard',
+};
+
+export const NoCopyText: StoryFn<PropsWithChildren<Props>> = Template.bind({});
+NoCopyText.args = {
+  children: 'Copy without copied text',
+  copyText: 'clipboard override',
+  displayText: '',
+};
diff --git a/app/react/components/buttons/CopyButton/CopyButton.test.tsx b/app/react/components/buttons/CopyButton/CopyButton.test.tsx
new file mode 100644
index 0000000..8ac3fc9
--- /dev/null
+++ b/app/react/components/buttons/CopyButton/CopyButton.test.tsx
@@ -0,0 +1,35 @@
+import { fireEvent, render } from '@testing-library/react';
+
+import { mockClipboard } from '@/react/test-utils/clipboard';
+
+import { CopyButton } from './CopyButton';
+
+test('should display a CopyButton with children', async () => {
+  const children = 'test button children';
+  const { findByText } = render(
+    <CopyButton copyText="" data-cy="copy-button">
+      {children}
+    </CopyButton>
+  );
+
+  const button = await findByText(children);
+  expect(button).toBeTruthy();
+});
+
+test('CopyButton should copy text to clipboard', async () => {
+  const { writeText } = mockClipboard();
+
+  const children = 'button';
+  const copyText = 'text successfully copied to clipboard';
+  const { findByText } = render(
+    <CopyButton copyText={copyText} data-cy="copy-button">
+      {children}
+    </CopyButton>
+  );
+
+  const button = await findByText(children);
+  expect(button).toBeTruthy();
+
+  fireEvent.click(button);
+  expect(writeText).toHaveBeenCalledWith(copyText);
+});
diff --git a/app/react/components/buttons/CopyButton/CopyButton.tsx b/app/react/components/buttons/CopyButton/CopyButton.tsx
new file mode 100644
index 0000000..1be9029
--- /dev/null
+++ b/app/react/components/buttons/CopyButton/CopyButton.tsx
@@ -0,0 +1,70 @@
+import { ComponentProps, PropsWithChildren } from 'react';
+import clsx from 'clsx';
+import { Check, Copy } from 'lucide-react';
+
+import { AutomationTestingProps } from '@/types';
+
+import { Icon } from '@@/Icon';
+
+import { Button } from '../Button';
+
+import styles from './CopyButton.module.css';
+import { useCopy } from './useCopy';
+
+export interface Props extends AutomationTestingProps {
+  copyText: string;
+  fadeDelay?: number;
+  displayText?: string;
+  className?: string;
+  color?: ComponentProps<typeof Button>['color'];
+  indicatorPosition?: 'left' | 'right';
+}
+
+export function CopyButton({
+  copyText,
+  fadeDelay = 1000,
+  displayText = 'copied',
+  className,
+  color = 'default',
+  indicatorPosition = 'right',
+  children,
+  'data-cy': dataCy,
+}: PropsWithChildren<Props>) {
+  const { handleCopy, copiedSuccessfully } = useCopy(copyText, fadeDelay);
+
+  function copiedIndicator() {
+    return (
+      <span
+        className={clsx(
+          copiedSuccessfully && styles.fadeout,
+          styles.copyButton,
+          'mx-1',
+          'vertical-center'
+        )}
+      >
+        <Icon icon={Check} />
+        {displayText && <span className="space-left">{displayText}</span>}
+      </span>
+    );
+  }
+
+  return (
+    <div className={styles.container}>
+      {indicatorPosition === 'left' && copiedIndicator()}
+      <Button
+        className={clsx(className, '!ml-0')}
+        color={color}
+        size="small"
+        onClick={handleCopy}
+        title="Copy Value"
+        type="button"
+        icon={Copy}
+        disabled={!copyText}
+        data-cy={dataCy}
+      >
+        {children}
+      </Button>
+      {indicatorPosition === 'right' && copiedIndicator()}
+    </div>
+  );
+}
diff --git a/app/react/components/buttons/CopyButton/index.ts b/app/react/components/buttons/CopyButton/index.ts
new file mode 100644
index 0000000..983aa36
--- /dev/null
+++ b/app/react/components/buttons/CopyButton/index.ts
@@ -0,0 +1 @@
+export { CopyButton } from './CopyButton';
diff --git a/app/react/components/buttons/CopyButton/useCopy.ts b/app/react/components/buttons/CopyButton/useCopy.ts
new file mode 100644
index 0000000..ef5f55b
--- /dev/null
+++ b/app/react/components/buttons/CopyButton/useCopy.ts
@@ -0,0 +1,50 @@
+import { useEffect, useState } from 'react';
+
+export type CopyTextType = string | (() => string);
+
+export function useCopy(
+  copyText: CopyTextType,
+  fadeDelay = 1000,
+  context: HTMLElement = document.body
+) {
+  const [copiedSuccessfully, setCopiedSuccessfully] = useState(false);
+
+  useEffect(() => {
+    const fadeoutTime = setTimeout(
+      () => setCopiedSuccessfully(false),
+      fadeDelay
+    );
+    // clear timeout when component unmounts
+    return () => {
+      clearTimeout(fadeoutTime);
+    };
+  }, [copiedSuccessfully, fadeDelay]);
+
+  function handleCopy() {
+    const text = typeof copyText === 'function' ? copyText() : copyText;
+
+    if (!text) {
+      return;
+    }
+
+    // https://developer.mozilla.org/en-US/docs/Web/API/Clipboard
+    // https://caniuse.com/?search=clipboard
+    // eslint-disable-next-line no-restricted-properties -- this file IS the approved secure-context-safe wrapper; consumers must use useCopy or CopyButton
+    if (window.isSecureContext && navigator.clipboard) {
+      // eslint-disable-next-line no-restricted-properties -- see above
+      navigator.clipboard.writeText(text);
+    } else {
+      // https://stackoverflow.com/a/57192718
+      const inputEl = document.createElement('textarea');
+      inputEl.value = text;
+      context.appendChild(inputEl);
+      inputEl.select();
+      document.execCommand('copy');
+      inputEl.hidden = true;
+      context.removeChild(inputEl);
+    }
+    setCopiedSuccessfully(true);
+  }
+
+  return { handleCopy, copiedSuccessfully };
+}
diff --git a/app/react/components/buttons/DeleteButton.tsx b/app/react/components/buttons/DeleteButton.tsx
new file mode 100644
index 0000000..6041c43
--- /dev/null
+++ b/app/react/components/buttons/DeleteButton.tsx
@@ -0,0 +1,93 @@
+import { Trash2 } from 'lucide-react';
+import { ComponentProps, PropsWithChildren, ReactNode } from 'react';
+import clsx from 'clsx';
+
+import { AutomationTestingProps } from '@/types';
+
+import { confirmDelete } from '@@/modals/confirm';
+
+import { LoadingButton } from './LoadingButton';
+import { Button } from './Button';
+
+type ConfirmOrClick =
+  | {
+      confirmMessage: ReactNode;
+      onConfirmed(): Promise<void> | void;
+      onClick?: never;
+    }
+  | {
+      confirmMessage?: never;
+      onConfirmed?: never;
+      /** if onClick is set, will skip confirmation (confirmation should be done on the parent) */
+      onClick(): void;
+    };
+
+export function DeleteButton({
+  disabled,
+  size,
+  children,
+  isLoading,
+  text = 'Remove',
+  loadingText = 'Removing...',
+  icon = false,
+  type,
+  'data-cy': dataCy,
+  ...props
+}: PropsWithChildren<
+  AutomationTestingProps &
+    ConfirmOrClick & {
+      size?: ComponentProps<typeof Button>['size'];
+      disabled?: boolean;
+      isLoading?: boolean;
+      text?: string;
+      loadingText?: string;
+      icon?: boolean;
+      type?: ComponentProps<typeof Button>['type'];
+    }
+>) {
+  if (isLoading === undefined) {
+    return (
+      <Button
+        size={size}
+        color="dangerlight"
+        disabled={disabled}
+        onClick={() => handleClick()}
+        icon={Trash2}
+        className={clsx(icon ? 'btn-icon' : '')}
+        data-cy={dataCy}
+        type={type}
+      >
+        {children || text}
+      </Button>
+    );
+  }
+
+  return (
+    <LoadingButton
+      size={size}
+      color="dangerlight"
+      disabled={disabled}
+      onClick={() => handleClick()}
+      icon={Trash2}
+      data-cy={dataCy}
+      isLoading={isLoading}
+      loadingText={loadingText}
+      type={type}
+    >
+      {children || 'Remove'}
+    </LoadingButton>
+  );
+
+  async function handleClick() {
+    const { confirmMessage, onConfirmed, onClick } = props;
+    if (onClick) {
+      return onClick();
+    }
+
+    if (!(await confirmDelete(confirmMessage))) {
+      return undefined;
+    }
+
+    return onConfirmed();
+  }
+}
diff --git a/app/react/components/buttons/LoadingButton.stories.tsx b/app/react/components/buttons/LoadingButton.stories.tsx
new file mode 100644
index 0000000..967e472
--- /dev/null
+++ b/app/react/components/buttons/LoadingButton.stories.tsx
@@ -0,0 +1,47 @@
+import { Meta } from '@storybook/react-webpack5';
+import { Download } from 'lucide-react';
+
+import { LoadingButton } from './LoadingButton';
+
+export default {
+  component: LoadingButton,
+  title: 'Components/Buttons/LoadingButton',
+} as Meta;
+
+interface Args {
+  loadingText: string;
+  isLoading: boolean;
+}
+
+function Template({ loadingText, isLoading }: Args) {
+  return (
+    <LoadingButton
+      loadingText={loadingText}
+      data-cy="loading-button"
+      isLoading={isLoading}
+      icon={Download}
+    >
+      Download
+    </LoadingButton>
+  );
+}
+
+Template.args = {
+  loadingText: 'loading',
+  isLoading: false,
+};
+
+export const Example = Template.bind({});
+
+export function IsLoading() {
+  return (
+    <LoadingButton
+      loadingText="loading"
+      isLoading
+      icon={Download}
+      data-cy="loading-button"
+    >
+      Download
+    </LoadingButton>
+  );
+}
diff --git a/app/react/components/buttons/LoadingButton.test.tsx b/app/react/components/buttons/LoadingButton.test.tsx
new file mode 100644
index 0000000..fe564c6
--- /dev/null
+++ b/app/react/components/buttons/LoadingButton.test.tsx
@@ -0,0 +1,47 @@
+import { render } from '@testing-library/react';
+
+import { LoadingButton } from './LoadingButton';
+
+test('when isLoading is true should show spinner and loading text', async () => {
+  const loadingText = 'loading';
+  const children = 'not visible';
+
+  const { queryByText, findByText, container } = render(
+    <LoadingButton loadingText={loadingText} isLoading data-cy="loading-button">
+      {children}
+    </LoadingButton>
+  );
+
+  const spinner = container.querySelector('svg');
+  expect(spinner).toBeVisible();
+
+  const buttonLabel = queryByText(children);
+  expect(buttonLabel).toBeNull();
+
+  const loadingTextElem = await findByText(loadingText);
+  expect(loadingTextElem).toBeVisible();
+});
+
+test('should show children when false', async () => {
+  const loadingText = 'loading';
+  const children = 'visible';
+
+  const { queryByText, container } = render(
+    <LoadingButton
+      loadingText={loadingText}
+      isLoading={false}
+      data-cy="loading-button"
+    >
+      {children}
+    </LoadingButton>
+  );
+
+  const buttonLabel = queryByText(children);
+  expect(buttonLabel).toBeVisible();
+
+  const spinner = container.querySelector('svg');
+  expect(spinner).toBeNull();
+
+  const loadingTextElem = queryByText(loadingText);
+  expect(loadingTextElem).toBeNull();
+});
diff --git a/app/react/components/buttons/LoadingButton.tsx b/app/react/components/buttons/LoadingButton.tsx
new file mode 100644
index 0000000..ec602a0
--- /dev/null
+++ b/app/react/components/buttons/LoadingButton.tsx
@@ -0,0 +1,44 @@
+import { PropsWithChildren, ReactNode } from 'react';
+import { Loader2 } from 'lucide-react';
+
+import { Icon } from '@@/Icon';
+
+import { type Props as ButtonProps, Button } from './Button';
+
+interface Props extends ButtonProps {
+  loadingText: string;
+  isLoading: boolean;
+}
+
+export function LoadingButton({
+  loadingText,
+  isLoading,
+  disabled,
+  type = 'submit',
+  children,
+  icon,
+  ...buttonProps
+}: PropsWithChildren<Props>) {
+  return (
+    <Button
+      // eslint-disable-next-line react/jsx-props-no-spreading
+      {...buttonProps}
+      type={type}
+      disabled={disabled || isLoading}
+      icon={loadingButtonIcon(isLoading, icon)}
+    >
+      {isLoading ? loadingText : children}
+    </Button>
+  );
+}
+
+function loadingButtonIcon(isLoading: boolean, defaultIcon: ReactNode) {
+  if (!isLoading) {
+    return defaultIcon;
+  }
+  return (
+    <span className="flex items-center" role="status" aria-label="loading">
+      <Icon icon={Loader2} className="ml-1 animate-spin-slow" />
+    </span>
+  );
+}
diff --git a/app/react/components/buttons/MenuButton.stories.tsx b/app/react/components/buttons/MenuButton.stories.tsx
new file mode 100644
index 0000000..283764e
--- /dev/null
+++ b/app/react/components/buttons/MenuButton.stories.tsx
@@ -0,0 +1,174 @@
+import { Meta, StoryObj } from '@storybook/react-webpack5';
+import { PropsWithChildren } from 'react';
+import { Plus, Edit, Download, Settings } from 'lucide-react';
+
+import { MenuButton, MenuButtonLink, MenuButtonProps } from './MenuButton';
+
+const meta: Meta<PropsWithChildren<MenuButtonProps>> = {
+  component: MenuButton,
+  title: 'Components/Buttons/MenuButton',
+  render: (args) => <MenuButton {...args}>{args.children}</MenuButton>,
+  argTypes: {
+    color: {
+      control: 'select',
+      options: ['primary', 'secondary', 'danger', 'default', 'light'],
+    },
+    size: {
+      control: 'select',
+      options: ['xsmall', 'small', 'medium', 'large'],
+    },
+    dropdownPosition: {
+      control: 'select',
+      options: ['left', 'right'],
+    },
+    disabled: {
+      control: 'boolean',
+    },
+    // Hide props that don't make sense to control
+    items: { table: { disable: true } },
+    menuClassName: { table: { disable: true } },
+    className: { table: { disable: true } },
+    'data-cy': { table: { disable: true } },
+    icon: { table: { disable: true } },
+    title: { table: { disable: true } },
+  },
+};
+
+export default meta;
+
+function basicItems() {
+  return [
+    <>
+      <MenuButtonLink data-cy="test" key="create" to="create">
+        <div className="flex items-center gap-2">
+          <Plus />
+          Create new
+        </div>
+      </MenuButtonLink>
+      <MenuButtonLink data-cy="test" key="edit" to="edit">
+        <div className="flex items-center gap-2">
+          <Edit />
+          Edit existing
+        </div>
+      </MenuButtonLink>
+      <MenuButtonLink data-cy="test" key="download" to="download">
+        <div className="flex items-center gap-2">
+          <Download />
+          Download
+        </div>
+      </MenuButtonLink>
+    </>,
+  ];
+}
+
+type Story = StoryObj<PropsWithChildren<MenuButtonProps>>;
+
+export const Primary: Story = {
+  args: {
+    items: basicItems(),
+    children: 'Actions',
+    color: 'primary',
+    size: 'small',
+  },
+};
+
+export const WithIcon: Story = {
+  args: {
+    items: basicItems(),
+    children: 'Settings',
+    color: 'primary',
+    icon: Settings,
+    'data-cy': 'menu-button-with-icon',
+  },
+};
+
+export const Large: Story = {
+  args: {
+    items: basicItems(),
+    children: 'Large Menu Button',
+    color: 'primary',
+    size: 'large',
+    icon: Settings,
+    'data-cy': 'menu-button-large',
+  },
+};
+
+export const Small: Story = {
+  args: {
+    items: basicItems(),
+    children: 'Small',
+    color: 'primary',
+    size: 'small',
+    'data-cy': 'menu-button-small',
+  },
+};
+
+export const XSmall: Story = {
+  args: {
+    items: basicItems(),
+    children: 'XS',
+    color: 'primary',
+    size: 'xsmall',
+    'data-cy': 'menu-button-xsmall',
+  },
+};
+
+export const DropdownRight: Story = {
+  args: {
+    items: basicItems(),
+    children: 'Right Aligned',
+    color: 'primary',
+    dropdownPosition: 'right',
+    'data-cy': 'menu-button-right',
+  },
+  decorators: [
+    (Story) => (
+      <div className="flex justify-end">
+        <Story />
+      </div>
+    ),
+  ],
+};
+
+export const Disabled: Story = {
+  args: {
+    items: basicItems(),
+    children: 'Disabled Menu',
+    color: 'primary',
+    disabled: true,
+    'data-cy': 'menu-button-disabled',
+  },
+};
+
+export const WithLinks: Story = {
+  args: {
+    items: [
+      <MenuButtonLink
+        key="external"
+        to="portainer.home"
+        label="External link"
+        data-cy="menu-button-link-external"
+        className="flex items-center gap-2"
+      >
+        <div className="flex items-center gap-2">
+          <Download />
+          External link
+        </div>
+      </MenuButtonLink>,
+    ],
+    children: 'Mixed Actions',
+    color: 'primary',
+    'data-cy': 'menu-button-links',
+  },
+};
+
+export const CustomStyling: Story = {
+  args: {
+    items: basicItems(),
+    children: 'Custom Styled',
+    color: 'primary',
+    className: 'border-2 border-blue-5',
+    menuClassName: 'border-2 border-green-5',
+    'data-cy': 'menu-button-custom',
+  },
+};
diff --git a/app/react/components/buttons/MenuButton.test.tsx b/app/react/components/buttons/MenuButton.test.tsx
new file mode 100644
index 0000000..6ed5b39
--- /dev/null
+++ b/app/react/components/buttons/MenuButton.test.tsx
@@ -0,0 +1,477 @@
+import {
+  ComponentType,
+  ReactNode,
+  PropsWithChildren,
+  useState,
+  useEffect,
+  useRef,
+  useContext,
+  createContext,
+} from 'react';
+import { fireEvent, render, screen } from '@testing-library/react';
+import { Plus, Edit } from 'lucide-react';
+import { MenuItem } from '@reach/menu-button';
+import { UIRouter } from '@uirouter/react';
+
+import { MenuButton, MenuButtonLink, MenuButtonProps } from './MenuButton';
+
+type MockCommonProps = Record<string, unknown>;
+type MockWithChildren = { children?: ReactNode };
+type MockMenuButtonProps = MockWithChildren & {
+  as?: ComponentType<MockCommonProps>;
+  onClick?: () => void;
+} & MockCommonProps;
+type MockMenuItemProps = MockWithChildren & {
+  onSelect?: () => void;
+  disabled?: boolean;
+} & MockCommonProps;
+type MockMenuLinkProps = MockWithChildren & {
+  onClick?: () => void;
+  href?: string;
+  className?: string;
+} & MockCommonProps;
+
+type MockMenuProps = MockWithChildren;
+
+type MockMenuFns = {
+  Menu: (props: MockMenuProps) => ReactNode;
+  MenuButton: (props: MockMenuButtonProps) => ReactNode;
+  MenuPopover: (props: MockWithChildren) => ReactNode;
+  MenuItem: (props: MockMenuItemProps) => ReactNode;
+  MenuLink: (props: MockMenuLinkProps) => ReactNode;
+  MenuList: (props: MockWithChildren) => ReactNode;
+};
+
+const mockUseSref = vi.hoisted(() => vi.fn());
+
+vi.mock('@uirouter/react', () => ({
+  UIRouter: ({ children }: MockWithChildren) => children,
+  useSref: mockUseSref,
+}));
+
+vi.mock('@reach/menu-button', () => {
+  type Ctx = {
+    isOpen: boolean;
+    setOpen: (v: boolean) => void;
+    menuRef: React.RefObject<HTMLDivElement>;
+  };
+  const MenuCtx = createContext<Ctx | null>(null);
+
+  function Menu({ children }: MockWithChildren) {
+    const [isOpen, setOpen] = useState(false);
+    const menuRef = useRef<HTMLDivElement>(null);
+
+    useEffect(() => {
+      function handleDocDown(e: MouseEvent) {
+        const target = e.target as Node | null;
+        if (
+          isOpen &&
+          menuRef.current &&
+          target &&
+          !menuRef.current.contains(target)
+        ) {
+          setOpen(false);
+        }
+      }
+      document.addEventListener('mousedown', handleDocDown);
+      return () => document.removeEventListener('mousedown', handleDocDown);
+    }, [isOpen]);
+
+    return (
+      <MenuCtx.Provider value={{ isOpen, setOpen, menuRef }}>
+        <div data-cy="menu" ref={menuRef}>
+          {children}
+        </div>
+      </MenuCtx.Provider>
+    );
+  }
+
+  function MenuButton({
+    children,
+    as: Component,
+    onClick: externalOnClick,
+    ...props
+  }: MockMenuButtonProps) {
+    const ctx = useContext(MenuCtx);
+    function handleClick() {
+      externalOnClick?.();
+      ctx?.setOpen(!ctx.isOpen);
+    }
+    if (Component) {
+      return (
+        <Component data-cy="menu-button" onClick={handleClick} {...props}>
+          {children}
+        </Component>
+      );
+    }
+    return (
+      <button
+        data-cy="menu-button"
+        type="button"
+        onClick={handleClick}
+        {...props}
+      >
+        {children}
+      </button>
+    );
+  }
+
+  function MenuPopover({ children }: MockWithChildren) {
+    const ctx = useContext(MenuCtx);
+    if (!ctx?.isOpen) return null;
+    return <div data-cy="menu-popover">{children}</div>;
+  }
+
+  function MenuItem({
+    children,
+    onSelect,
+    disabled,
+    ...props
+  }: MockMenuItemProps) {
+    const ctx = useContext(MenuCtx);
+    function handleClick() {
+      if (!disabled) {
+        onSelect?.();
+        ctx?.setOpen(false);
+      }
+    }
+    return (
+      <button
+        data-cy="menu-item"
+        role="menuitem"
+        type="button"
+        onClick={handleClick}
+        disabled={Boolean(disabled)}
+        style={{ opacity: disabled ? 0.5 : 1 }}
+        {...props}
+      >
+        {children}
+      </button>
+    );
+  }
+
+  function MenuLink({
+    children,
+    onClick,
+    href,
+    className,
+    ...props
+  }: MockMenuLinkProps) {
+    const ctx = useContext(MenuCtx);
+    function handleClick() {
+      onClick?.();
+      ctx?.setOpen(false);
+    }
+    return (
+      <a
+        data-cy="menu-item"
+        role="menuitem"
+        href={href || '#'}
+        className={className}
+        onClick={(e) => {
+          e.preventDefault();
+          handleClick();
+        }}
+        {...props}
+      >
+        {children}
+      </a>
+    );
+  }
+
+  function MenuList({ children }: MockWithChildren) {
+    const ctx = useContext(MenuCtx);
+    if (!ctx?.isOpen) return null;
+    return <div data-cy="menu-list">{children}</div>;
+  }
+
+  const exported: MockMenuFns = {
+    Menu,
+    MenuButton,
+    MenuPopover,
+    MenuItem,
+    MenuLink,
+    MenuList,
+  };
+
+  return exported;
+});
+
+function mapItems(items: Array<MockMenuButtonItem>) {
+  return items.map((item) => item.element);
+}
+
+type MockMenuButtonItem = {
+  id: string;
+  element: ReactNode;
+  handler?: () => void;
+};
+
+function createMockMenuItem({
+  id,
+  label,
+  icon,
+  onClick,
+  disabled,
+}: {
+  id: string;
+  label: string;
+  icon?: ComponentType<unknown>;
+  onClick?: () => void;
+  disabled?: boolean;
+}): MockMenuButtonItem {
+  const IconComponent = icon;
+  const handler = onClick;
+
+  return {
+    id,
+    handler,
+    element: (
+      <MenuItem key={id} disabled={disabled} onSelect={handler ?? (() => {})}>
+        {IconComponent ? <IconComponent /> : null}
+        {label}
+      </MenuItem>
+    ),
+  };
+}
+
+const mockItems: Array<MockMenuButtonItem> = [
+  createMockMenuItem({
+    id: 'create',
+    label: 'Create new',
+    icon: Plus,
+    onClick: vi.fn(),
+  }),
+  createMockMenuItem({
+    id: 'edit',
+    label: 'Edit existing',
+    icon: Edit,
+    onClick: vi.fn(),
+  }),
+];
+
+type RenderOptions = Omit<
+  Partial<PropsWithChildren<MenuButtonProps>>,
+  'items'
+> & {
+  items?: Array<MockMenuButtonItem>;
+};
+
+function renderDefault({
+  items = mockItems,
+  children = 'Test Menu',
+  color = 'primary',
+  size = 'small',
+  disabled = false,
+  ...props
+}: RenderOptions = {}) {
+  return render(
+    <MenuButton
+      items={mapItems(items)}
+      color={color}
+      size={size}
+      disabled={disabled}
+      data-cy="menu-button"
+      {...props}
+    >
+      {children}
+    </MenuButton>
+  );
+}
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  // Set default mock implementation
+  mockUseSref.mockReturnValue({
+    href: '#default',
+    onClick: vi.fn(),
+  });
+});
+
+test('should display MenuButton with correct text and chevron icon', async () => {
+  const children = 'Test Actions';
+  renderDefault({ children });
+
+  const button = await screen.findByText(children);
+  expect(button).toBeTruthy();
+
+  // Check for chevron down icon (it should be in the DOM)
+  const chevronIcon = button.closest('button')?.querySelector('svg');
+  expect(chevronIcon).toBeTruthy();
+});
+
+test('should not show menu items by default', async () => {
+  renderDefault();
+  expect(screen.queryByRole('menuitem')).toBeNull();
+});
+
+test('should show menu items when clicked', async () => {
+  renderDefault();
+  const trigger = await screen.findByText('Test Menu');
+  fireEvent.click(trigger);
+  expect(await screen.findByText('Create new')).toBeTruthy();
+  expect(await screen.findByText('Edit existing')).toBeTruthy();
+});
+
+test('should hide menu items when something else is clicked', async () => {
+  renderDefault();
+  const trigger = await screen.findByText('Test Menu');
+  fireEvent.click(trigger);
+  expect(await screen.findByText('Create new')).toBeTruthy();
+
+  // click outside
+  fireEvent.mouseDown(document.body);
+  // items should disappear
+  expect(screen.queryByText('Create new')).toBeNull();
+  expect(screen.queryByText('Edit existing')).toBeNull();
+});
+
+test('should call onClick when menu item is clicked', async () => {
+  renderDefault();
+
+  const trigger = await screen.findByText('Test Menu');
+  fireEvent.click(trigger);
+
+  const createItem = await screen.findByText('Create new');
+  fireEvent.click(createItem);
+
+  expect(mockItems[0].handler).toHaveBeenCalled();
+});
+
+test('should not call onClick when disabled item is clicked', async () => {
+  const disabledItemMock = createMockMenuItem({
+    id: 'disabled',
+    label: 'Disabled action',
+    disabled: true,
+    onClick: vi.fn(),
+  });
+
+  renderDefault({ items: [disabledItemMock] });
+
+  const trigger = await screen.findByText('Test Menu');
+  fireEvent.click(trigger);
+
+  const disabledItem = await screen.findByText('Disabled action');
+  fireEvent.click(disabledItem);
+
+  expect(disabledItemMock.handler).not.toHaveBeenCalled();
+});
+
+test('should support link items', async () => {
+  const mockOnClick = vi.fn();
+
+  // Set up the mock to return our test onClick function
+  mockUseSref.mockReturnValue({
+    href: '#kubernetes.deploy',
+    onClick: mockOnClick,
+  });
+
+  render(
+    <UIRouter>
+      <MenuButton
+        items={[
+          <MenuButtonLink
+            key="docs"
+            to="kubernetes.deploy"
+            params={{}}
+            options={{}}
+            label="Docs"
+            data-cy="menu-button-link-docs"
+          >
+            Deploy
+          </MenuButtonLink>,
+        ]}
+        color="primary"
+        data-cy="menu-button-link"
+      >
+        Mixed
+      </MenuButton>
+    </UIRouter>
+  );
+
+  const trigger = await screen.findByText('Mixed');
+  fireEvent.click(trigger);
+
+  const link = await screen.findByText('Deploy');
+  fireEvent.click(link);
+  expect(mockOnClick).toHaveBeenCalled();
+});
+
+test('should be disabled when disabled prop is true', async () => {
+  renderDefault({ disabled: true });
+
+  const button = await screen.findByText('Test Menu');
+  expect(button.closest('button')).toBeDisabled();
+  expect(button.closest('button')).toHaveClass('disabled');
+});
+
+test('should render menu items with icons', async () => {
+  renderDefault();
+
+  const trigger = await screen.findByText('Test Menu');
+  fireEvent.click(trigger);
+
+  // Check that menu items have icons (SVG elements)
+  const createItem = await screen.findByText('Create new');
+  const editItem = await screen.findByText('Edit existing');
+
+  expect(
+    createItem.closest('[role="menuitem"]')?.querySelector('svg')
+  ).toBeTruthy();
+  expect(
+    editItem.closest('[role="menuitem"]')?.querySelector('svg')
+  ).toBeTruthy();
+});
+
+test('should render with custom className', async () => {
+  renderDefault({ className: 'custom-class' });
+
+  const button = await screen.findByText('Test Menu');
+  expect(button.closest('button')).toHaveClass('custom-class');
+});
+
+test('should have proper accessibility attributes for screen readers', async () => {
+  const mockOnClick = vi.fn();
+
+  // Set up the mock to return our test onClick function
+  mockUseSref.mockReturnValue({
+    href: '#kubernetes.deploy',
+    onClick: mockOnClick,
+  });
+
+  render(
+    <UIRouter>
+      <MenuButton
+        items={[
+          <MenuButtonLink
+            key="docs"
+            to="kubernetes.deploy"
+            params={{}}
+            options={{}}
+            label="Deploy"
+            data-cy="menu-button-link-docs"
+          >
+            Deploy
+          </MenuButtonLink>,
+        ]}
+        color="primary"
+        data-cy="menu-button-keyboard"
+      >
+        Accessibility Test
+      </MenuButton>
+    </UIRouter>
+  );
+
+  const trigger = await screen.findByText('Accessibility Test');
+
+  // Open menu to reveal the link
+  fireEvent.click(trigger);
+
+  const link = await screen.findByText('Deploy');
+  expect(link).toBeVisible();
+
+  // Test that the link has proper accessibility attributes
+  expect(link).toHaveAttribute('aria-label', 'Deploy'); // Screen reader support
+  expect(link).toHaveAttribute('role', 'menuitem'); // Proper ARIA role
+  expect(link).toHaveAttribute('href'); // Has navigation href
+});
diff --git a/app/react/components/buttons/MenuButton.tsx b/app/react/components/buttons/MenuButton.tsx
new file mode 100644
index 0000000..0946bd5
--- /dev/null
+++ b/app/react/components/buttons/MenuButton.tsx
@@ -0,0 +1,102 @@
+import { PropsWithChildren, ReactNode } from 'react';
+import { ChevronDown } from 'lucide-react';
+import {
+  Menu,
+  MenuButton as ReachMenuButton,
+  MenuLink as ReachMenuLink,
+  MenuList,
+} from '@reach/menu-button';
+import clsx from 'clsx';
+import { UISrefProps, useSref } from '@uirouter/react';
+
+import { AutomationTestingProps } from '@/types';
+
+import { Icon } from '@@/Icon';
+
+import { Props as ButtonProps, ButtonWithRef } from './Button';
+
+export interface MenuButtonProps
+  extends Omit<ButtonProps, 'onClick'>, AutomationTestingProps {
+  items: Array<ReactNode>;
+  menuClassName?: string;
+  dropdownPosition?: 'left' | 'right';
+  children: ReactNode;
+  onClick?: () => void;
+}
+
+export function MenuButton({
+  items,
+  children,
+  color = 'primary',
+  size = 'small',
+  disabled = false,
+  className,
+  title,
+  icon,
+  menuClassName,
+  dropdownPosition = 'right',
+  'data-cy': dataCy,
+  onClick,
+}: PropsWithChildren<MenuButtonProps>) {
+  return (
+    <Menu>
+      <ReachMenuButton
+        as={ButtonWithRef}
+        color={color}
+        size={size}
+        disabled={disabled}
+        className={clsx('flex items-center gap-1', className)}
+        title={title}
+        icon={icon}
+        data-cy={dataCy}
+        onClick={onClick}
+      >
+        {children}
+        <Icon icon={ChevronDown} size="xs" className="ml-1" />
+      </ReachMenuButton>
+
+      <MenuList
+        className={clsx(
+          'dropdown-menu relative rounded-lg !p-1',
+          'border !border-solid border-gray-6 shadow-[0_6px_12px_rgba(0,0,0,0.18)] th-highcontrast:border-gray-2 th-dark:border-gray-warm-8',
+          {
+            'right-0 origin-top-right': dropdownPosition === 'right',
+            'left-0 origin-top-left': dropdownPosition === 'left',
+          },
+          menuClassName
+        )}
+      >
+        {items}
+      </MenuList>
+    </Menu>
+  );
+}
+
+interface MenuLinkProps extends AutomationTestingProps, UISrefProps {
+  children: ReactNode;
+  label?: string;
+}
+
+export function MenuButtonLink({
+  to,
+  children,
+  label,
+  params,
+  options,
+  'data-cy': dataCy,
+}: MenuLinkProps) {
+  const anchorProps = useSref(to, params, options);
+  return (
+    <ReachMenuLink
+      href={anchorProps.href}
+      onClick={anchorProps.onClick}
+      className={clsx(
+        'decoration-none hover:decoration-none whitespace-nowrap rounded-md px-5 py-1 text-sm leading-5 text-[var(--text-dropdown-menu-color)] hover:bg-[var(--bg-dropdown-hover)] hover:text-[var(--text-dropdown-menu-color)] hover:no-underline focus:bg-[var(--bg-dropdown-hover)] focus:text-[var(--text-dropdown-menu-color)] focus-visible:outline-none focus-visible:ring-0 th-highcontrast:text-[var(--text-dropdown-menu-color)] th-highcontrast:hover:text-[var(--text-dropdown-menu-color)] th-highcontrast:focus:text-[var(--text-dropdown-menu-color)] th-dark:text-[var(--text-dropdown-menu-color)] th-dark:hover:text-[var(--text-dropdown-menu-color)] th-dark:focus:text-[var(--text-dropdown-menu-color)]'
+      )}
+      aria-label={label}
+      data-cy={dataCy}
+    >
+      {children}
+    </ReachMenuLink>
+  );
+}
diff --git a/app/react/components/buttons/index.ts b/app/react/components/buttons/index.ts
new file mode 100644
index 0000000..2fcff28
--- /dev/null
+++ b/app/react/components/buttons/index.ts
@@ -0,0 +1,6 @@
+export { Button } from './Button';
+export { AddButton } from './AddButton';
+export { ButtonGroup } from './ButtonGroup';
+export { LoadingButton } from './LoadingButton';
+export { CopyButton } from './CopyButton';
+export { MenuButton, MenuButtonLink } from './MenuButton';
diff --git a/app/react/components/datatables/BasicTable.tsx b/app/react/components/datatables/BasicTable.tsx
new file mode 100644
index 0000000..14474ad
--- /dev/null
+++ b/app/react/components/datatables/BasicTable.tsx
@@ -0,0 +1,124 @@
+import {
+  flexRender,
+  getCoreRowModel,
+  getSortedRowModel,
+  TableOptions,
+  useReactTable,
+} from '@tanstack/react-table';
+import { ComponentType, ReactNode } from 'react';
+
+import { AutomationTestingProps } from '@/types';
+
+import { Icon } from '@@/Icon';
+
+import { defaultGetRowId } from './defaultGetRowId';
+import { DefaultType } from './types';
+
+interface Props<D extends DefaultType> extends AutomationTestingProps {
+  dataset: D[];
+  columns: TableOptions<D>['columns'];
+  getRowId?(row: D): string;
+  emptyContentLabel?: string;
+  title?: ReactNode;
+  titleIcon?: ComponentType<{ className?: string; size?: number | string }>;
+  initialSortBy?: { id: string; desc: boolean };
+  'aria-label'?: string;
+}
+
+export function BasicTable<D extends DefaultType>({
+  dataset,
+  columns,
+  getRowId = defaultGetRowId,
+  emptyContentLabel = 'No items.',
+  title,
+  titleIcon,
+  initialSortBy,
+  'data-cy': dataCy,
+  'aria-label': ariaLabel,
+}: Props<D>) {
+  const tableInstance = useReactTable<D>({
+    columns,
+    data: dataset,
+    getRowId,
+    initialState: {
+      sorting: initialSortBy ? [initialSortBy] : [],
+    },
+    defaultColumn: {
+      enableColumnFilter: false,
+      enableHiding: false,
+    },
+    getCoreRowModel: getCoreRowModel(),
+    getSortedRowModel: getSortedRowModel(),
+  });
+
+  const headerGroups = tableInstance.getHeaderGroups();
+  const { rows } = tableInstance.getRowModel();
+
+  return (
+    <div className="w-full" data-cy={dataCy}>
+      {title && (
+        <div className="flex items-center gap-2 px-4 pb-2 text-sm font-medium text-[color:var(--text-main-color)]">
+          {titleIcon && <Icon icon={titleIcon} size="md" />}
+          <span>{title}</span>
+        </div>
+      )}
+      <table
+        className="w-full border-collapse"
+        aria-label={
+          ariaLabel ?? (typeof title === 'string' ? title : undefined)
+        }
+      >
+        <thead>
+          {headerGroups.map((hg) => (
+            <tr
+              key={hg.id}
+              className="border-b border-solid border-[color:var(--border-widget)]"
+            >
+              {hg.headers.map((header) => (
+                <th
+                  key={header.id}
+                  className="px-4 py-2 text-left text-xs font-semibold uppercase text-[color:var(--text-summary-color,var(--text-main-color))]"
+                >
+                  {header.isPlaceholder
+                    ? null
+                    : flexRender(
+                        header.column.columnDef.header,
+                        header.getContext()
+                      )}
+                </th>
+              ))}
+            </tr>
+          ))}
+        </thead>
+        <tbody>
+          {rows.length === 0 ? (
+            <tr>
+              <td
+                colSpan={Number.MAX_SAFE_INTEGER}
+                className="py-4 text-center text-sm text-[color:var(--text-summary-color,var(--text-main-color))]"
+              >
+                {emptyContentLabel}
+              </td>
+            </tr>
+          ) : (
+            rows.map((row) => (
+              <tr
+                key={row.id}
+                className="border-b border-solid border-[color:var(--border-widget)] last:border-b-0"
+              >
+                {row.getVisibleCells().map((cell) => (
+                  <td
+                    key={cell.id}
+                    className="px-4 py-2 align-middle text-sm text-[color:var(--text-main-color)]"
+                  >
+                    {flexRender(cell.column.columnDef.cell, cell.getContext())}
+                  </td>
+                ))}
+              </tr>
+            ))
+          )}
+        </tbody>
+      </table>
+    </div>
+  );
+}
diff --git a/app/react/components/datatables/CardExpandableList.tsx b/app/react/components/datatables/CardExpandableList.tsx
new file mode 100644
index 0000000..b9b4095
--- /dev/null
+++ b/app/react/components/datatables/CardExpandableList.tsx
@@ -0,0 +1,352 @@
+import {
+  Column,
+  Row,
+  Table as TableInstance,
+  TableOptions,
+  TableState,
+  getCoreRowModel,
+  getExpandedRowModel,
+  getFacetedMinMaxValues,
+  getFacetedRowModel,
+  getFacetedUniqueValues,
+  getFilteredRowModel,
+  getPaginationRowModel,
+  getSortedRowModel,
+  useReactTable,
+} from '@tanstack/react-table';
+import { ComponentType, ReactNode, useMemo } from 'react';
+import _ from 'lodash';
+import clsx from 'clsx';
+
+import { AutomationTestingProps } from '@/types';
+
+import { Widget, WidgetBody } from '@@/Widget';
+import { Icon } from '@@/Icon';
+import { PaginationControls } from '@@/PaginationControls';
+
+import { CardExpandableListRow } from './CardExpandableListRow';
+import { defaultGetRowId } from './defaultGetRowId';
+import { SearchBar } from './SearchBar';
+import { SelectedRowsCount } from './SelectedRowsCount';
+import { createSelectColumn } from './select-column';
+import { BasicTableSettings, DefaultType } from './types';
+import { type TableState as GlobalTableState } from './useTableState';
+
+export type PaginationProps =
+  | {
+      isServerSidePagination?: false;
+      totalCount?: never;
+      page?: never;
+      onPageChange?: never;
+    }
+  | {
+      isServerSidePagination: true;
+      totalCount: number;
+      page: number;
+      onPageChange(page: number): void;
+    };
+
+export interface Props<D extends DefaultType> extends AutomationTestingProps {
+  dataset: D[];
+  columns: TableOptions<D>['columns'];
+  settingsManager: GlobalTableState<BasicTableSettings>;
+  renderSubRow(row: Row<D>): ReactNode;
+  getRowCanExpand?(row: Row<D>): boolean;
+  expandOnRowClick?: boolean;
+  getRowId?(row: D): string;
+  isRowSelectable?(row: Row<D>): boolean;
+  disableSelect?: boolean;
+  emptyContentLabel?: string;
+  isLoading?: boolean;
+  description?: ReactNode;
+  title?: ReactNode;
+  titleId?: string;
+  titleIcon?: ComponentType<{ className?: string; size?: number | string }>;
+  initialTableState?: Partial<TableState>;
+  renderTableSettings?(instance: TableInstance<D>): ReactNode;
+  renderTableActions?(selectedRows: D[]): ReactNode;
+  extendTableOptions?: (options: TableOptions<D>) => TableOptions<D>;
+  onSearchChange?: (search: string) => void;
+  includeSearch?: boolean;
+  ariaLabel?: string;
+  id?: string;
+}
+
+export function CardExpandableList<D extends DefaultType>({
+  dataset,
+  columns,
+  settingsManager: settings,
+  renderSubRow,
+  getRowCanExpand = () => true,
+  expandOnRowClick,
+  getRowId = defaultGetRowId,
+  isRowSelectable = () => true,
+  disableSelect,
+  emptyContentLabel = 'No items.',
+  isLoading,
+  description,
+  title,
+  titleId,
+  titleIcon,
+  initialTableState = {},
+  renderTableSettings,
+  renderTableActions,
+  extendTableOptions = (value) => value,
+  onSearchChange = _.noop,
+  includeSearch,
+  ariaLabel,
+  id,
+  page,
+  totalCount = dataset.length,
+  isServerSidePagination = false,
+  onPageChange = _.noop,
+  'data-cy': dataCy,
+}: Props<D> & PaginationProps) {
+  const pageCount = useMemo(
+    () => Math.ceil(totalCount / settings.pageSize),
+    [settings.pageSize, totalCount]
+  );
+
+  const enableRowSelection = getIsSelectionEnabled(
+    disableSelect,
+    isRowSelectable
+  );
+
+  const allColumns = useMemo(
+    () =>
+      _.compact([
+        !disableSelect && createSelectColumn<D>(dataCy ?? ''),
+        ...columns,
+      ]),
+    [disableSelect, dataCy, columns]
+  );
+
+  const tableInstance = useReactTable<D>(
+    extendTableOptions({
+      columns: allColumns,
+      data: dataset,
+      initialState: {
+        pagination: {
+          pageSize: settings.pageSize,
+          pageIndex: page || 0,
+        },
+        sorting: settings.sortBy ? [settings.sortBy] : [],
+        ...initialTableState,
+        globalFilter: {
+          search: settings.search,
+          ...initialTableState.globalFilter,
+        },
+      },
+      defaultColumn: {
+        enableColumnFilter: false,
+        enableHiding: true,
+        sortingFn: 'alphanumeric',
+      },
+      enableRowSelection,
+      autoResetExpanded: false,
+      globalFilterFn: cardListGlobalFilterFn,
+      getRowId,
+      getCoreRowModel: getCoreRowModel(),
+      getFilteredRowModel: getFilteredRowModel(),
+      getPaginationRowModel: getPaginationRowModel(),
+      getFacetedRowModel: getFacetedRowModel(),
+      getFacetedUniqueValues: getFacetedUniqueValues(),
+      getFacetedMinMaxValues: getFacetedMinMaxValues(),
+      getExpandedRowModel: getExpandedRowModel(),
+      getRowCanExpand,
+      getColumnCanGlobalFilter,
+      ...(isServerSidePagination
+        ? {
+            pageCount,
+            manualPagination: true,
+            manualFiltering: true,
+            manualSorting: true,
+          }
+        : {
+            getSortedRowModel: getSortedRowModel(),
+          }),
+    })
+  );
+
+  const tableState = tableInstance.getState();
+  const selectedItems = tableInstance
+    .getSelectedRowModel()
+    .rows.map((row) => row.original);
+  const filteredItems = tableInstance
+    .getFilteredRowModel()
+    .rows.map((row) => row.original);
+  const hiddenSelectedItems = useMemo(
+    () => _.difference(selectedItems, filteredItems),
+    [selectedItems, filteredItems]
+  );
+  const visibleRows = tableInstance.getPaginationRowModel().rows;
+
+  const includeSearchBar = includeSearch ?? !!title;
+
+  function handleSearch(value: string) {
+    tableInstance.setGlobalFilter({ search: value });
+    settings.setSearch(value);
+    onSearchChange(value);
+  }
+
+  function handlePageChange(newPage: number) {
+    tableInstance.setPageIndex(newPage);
+    onPageChange(newPage);
+  }
+
+  function handlePageSizeChange(pageSize: number) {
+    tableInstance.setPageSize(pageSize);
+    settings.setPageSize(pageSize);
+  }
+
+  const ariaLabelValue =
+    ariaLabel ??
+    (typeof title === 'string' ? title : titleId ? titleId : 'list');
+
+  return (
+    <Widget aria-label={ariaLabelValue} id={id}>
+      <WidgetBody className="!p-0">
+        {(title ||
+          includeSearchBar ||
+          renderTableActions ||
+          renderTableSettings) && (
+          <div
+            className="flex flex-wrap items-center gap-2 rounded-t-xl bg-[color:var(--bg-card-color)] px-5 py-4 text-base"
+            data-cy={dataCy ? `${dataCy}-header` : undefined}
+          >
+            {title && (
+              <h2
+                id={titleId}
+                className="m-0 flex flex-auto items-center gap-1 text-base font-medium text-[color:var(--text-widget-header-color)]"
+              >
+                {titleIcon && <Icon icon={titleIcon} className="space-right" />}
+                {title}
+              </h2>
+            )}
+            {includeSearchBar && (
+              <SearchBar
+                value={settings.search}
+                onChange={handleSearch}
+                data-cy={`${dataCy ?? 'card-expandable-list'}-search-input`}
+              />
+            )}
+            {renderTableActions && (
+              <div className="actionBar inline-flex items-center gap-2">
+                {renderTableActions(selectedItems)}
+              </div>
+            )}
+            {renderTableSettings && (
+              <div className="settings inline-flex items-center">
+                {renderTableSettings(tableInstance)}
+              </div>
+            )}
+          </div>
+        )}
+        {description && (
+          <div className="bg-[color:var(--bg-card-color)] px-5 pb-3 text-sm">
+            {description}
+          </div>
+        )}
+        <div
+          className={clsx(
+            'flex flex-col gap-2 bg-[color:var(--bg-card-color)] px-4 py-2'
+          )}
+          aria-label={ariaLabelValue}
+          data-cy={dataCy}
+        >
+          {isLoading ? (
+            <div className="py-8 text-center text-sm text-[color:var(--text-summary-color,var(--text-main-color))]">
+              Loading...
+            </div>
+          ) : visibleRows.length === 0 ? (
+            <div className="py-8 text-center text-sm text-[color:var(--text-summary-color,var(--text-main-color))]">
+              {emptyContentLabel}
+            </div>
+          ) : (
+            visibleRows.map((row) => (
+              <CardExpandableListRow<D>
+                key={row.id}
+                row={row}
+                renderSubRow={renderSubRow}
+                expandOnClick={expandOnRowClick}
+              />
+            ))
+          )}
+        </div>
+        <div className="flex flex-wrap items-center justify-between gap-2 rounded-b-xl border-t border-solid border-[color:var(--border-datatable-top-color,var(--border-widget))] bg-[color:var(--bg-card-color)] px-4 py-2 pb-3 text-[color:var(--text-main-color)]">
+          <SelectedRowsCount
+            value={selectedItems.length}
+            hidden={hiddenSelectedItems.length}
+          />
+          <div className="ml-auto">
+            <PaginationControls
+              showAll
+              pageLimit={tableState.pagination.pageSize}
+              page={
+                (typeof page === 'number'
+                  ? page
+                  : tableState.pagination.pageIndex) + 1
+              }
+              onPageChange={(p) => handlePageChange(p - 1)}
+              pageCount={tableInstance.getPageCount()}
+              onPageLimitChange={handlePageSizeChange}
+            />
+          </div>
+        </div>
+      </WidgetBody>
+    </Widget>
+  );
+}
+
+function getIsSelectionEnabled<D extends DefaultType>(
+  disabledSelect?: boolean,
+  isRowSelectable?: Props<D>['isRowSelectable']
+) {
+  if (disabledSelect) {
+    return false;
+  }
+  if (isRowSelectable) {
+    return isRowSelectable;
+  }
+  return true;
+}
+
+function getColumnCanGlobalFilter<D>(column: Column<D>): boolean {
+  return column.id !== 'select';
+}
+
+function cardListGlobalFilterFn<D, TFilter extends { search: string }>(
+  row: Row<D>,
+  columnId: string,
+  filterValue: null | TFilter
+): boolean {
+  const value = row.getValue(columnId);
+
+  if (filterValue === null || !filterValue.search) {
+    return true;
+  }
+  if (value == null) {
+    return false;
+  }
+  const filterValueLower = filterValue.search.toLowerCase();
+  if (typeof value === 'object') {
+    return Object.values(value as Record<string, unknown>).some((item) =>
+      filterPrimitive(item, filterValueLower)
+    );
+  }
+  if (Array.isArray(value)) {
+    return value.some((item) => filterPrimitive(item, filterValueLower));
+  }
+  return filterPrimitive(value, filterValueLower);
+}
+
+function filterPrimitive(value: unknown, filterValueLower: string) {
+  if (
+    typeof value === 'string' ||
+    typeof value === 'number' ||
+    typeof value === 'boolean'
+  ) {
+    return value.toString().toLowerCase().includes(filterValueLower);
+  }
+  return false;
+}
diff --git a/app/react/components/datatables/CardExpandableListRow.tsx b/app/react/components/datatables/CardExpandableListRow.tsx
new file mode 100644
index 0000000..371713f
--- /dev/null
+++ b/app/react/components/datatables/CardExpandableListRow.tsx
@@ -0,0 +1,201 @@
+import { ReactNode } from 'react';
+import { Cell, Row, flexRender } from '@tanstack/react-table';
+import clsx from 'clsx';
+import { ChevronDown } from 'lucide-react';
+
+import { Icon } from '@@/Icon';
+
+import { DefaultType } from './types';
+
+interface Props<D extends DefaultType> {
+  row: Row<D>;
+  renderSubRow(row: Row<D>): ReactNode;
+  expandOnClick?: boolean;
+}
+
+export function CardExpandableListRow<D extends DefaultType>({
+  row,
+  renderSubRow,
+  expandOnClick,
+}: Props<D>) {
+  const cells = row.getVisibleCells();
+  const canExpand = row.getCanExpand();
+  const isExpanded = canExpand && row.getIsExpanded();
+
+  const { selectCell, dataCells } = groupCells(cells);
+  const { titleCell, actionCells, metaCells } = splitDataCells(dataCells);
+
+  const isCardClickable = !!expandOnClick && canExpand;
+  function handleCardClick(e: React.MouseEvent | React.KeyboardEvent) {
+    if (!isCardClickable) return;
+    const target = e.target as HTMLElement;
+    if (target.closest('[data-card-expandable-stop]')) {
+      return;
+    }
+    row.toggleExpanded();
+  }
+
+  return (
+    <div
+      className={clsx(
+        'flex flex-col overflow-hidden rounded-lg border border-solid border-[color:var(--border-widget)] bg-[color:var(--bg-card-color)] transition-colors',
+        {
+          'hover:border-[color:var(--ui-blue-3,#338ddd)]': !isExpanded,
+        }
+      )}
+    >
+      <div
+        className={clsx('flex flex-col gap-2 px-4 py-3', {
+          'cursor-pointer': isCardClickable,
+          'border-b border-solid border-[color:var(--border-widget)]':
+            isExpanded,
+        })}
+        onClick={isCardClickable ? handleCardClick : undefined}
+        onKeyDown={
+          isCardClickable
+            ? (e) => {
+                if (e.key === 'Enter' || e.key === ' ') {
+                  e.preventDefault();
+                  handleCardClick(e);
+                }
+              }
+            : undefined
+        }
+        role={isCardClickable ? 'button' : undefined}
+        tabIndex={isCardClickable ? 0 : undefined}
+      >
+        <div className="flex flex-wrap items-center gap-3">
+          {selectCell && (
+            <div className="flex items-center" data-card-expandable-stop>
+              {flexRender(
+                selectCell.column.columnDef.cell,
+                selectCell.getContext()
+              )}
+            </div>
+          )}
+          {canExpand && (
+            <button
+              type="button"
+              className="inline-flex items-center justify-center rounded-full border-none bg-transparent p-1 text-[color:var(--text-main-color)] hover:bg-[color:var(--bg-hover-table-color,rgba(51,141,221,0.1))]"
+              onClick={(e) => {
+                e.stopPropagation();
+                row.toggleExpanded();
+              }}
+              aria-expanded={isExpanded}
+              aria-label={isExpanded ? 'Collapse' : 'Expand'}
+            >
+              <Icon
+                icon={ChevronDown}
+                size="md"
+                className={clsx('transition-transform', {
+                  'rotate-180': isExpanded,
+                })}
+              />
+            </button>
+          )}
+          {titleCell && (
+            <div className="flex min-w-0 flex-auto items-center gap-2 font-medium text-[color:var(--text-main-color)]">
+              {flexRender(
+                titleCell.column.columnDef.cell,
+                titleCell.getContext()
+              )}
+            </div>
+          )}
+          {actionCells.length > 0 && (
+            <div
+              className="ml-auto flex items-center gap-2"
+              data-card-expandable-stop
+            >
+              {actionCells.map((cell) => (
+                <div key={cell.id} className="flex items-center">
+                  {flexRender(cell.column.columnDef.cell, cell.getContext())}
+                </div>
+              ))}
+            </div>
+          )}
+        </div>
+        {metaCells.length > 0 && (
+          <div className="flex flex-wrap gap-x-6 gap-y-2 pl-9 text-xs text-[color:var(--text-summary-color,var(--text-main-color))]">
+            {metaCells.map((cell) => {
+              const label = getColumnHeaderText(cell);
+              return (
+                <div
+                  key={cell.id}
+                  className="inline-flex items-center gap-1.5 whitespace-nowrap"
+                >
+                  {label && <span className="opacity-70">{label}</span>}
+                  <span className="inline-flex items-center gap-1 text-[color:var(--text-main-color)]">
+                    {flexRender(cell.column.columnDef.cell, cell.getContext())}
+                  </span>
+                </div>
+              );
+            })}
+          </div>
+        )}
+      </div>
+      {isExpanded && (
+        <div className="bg-[color:var(--bg-card-color)] py-3">
+          {renderSubRow(row)}
+        </div>
+      )}
+    </div>
+  );
+}
+
+function groupCells<D extends DefaultType>(cells: Cell<D, unknown>[]) {
+  let selectCell: Cell<D, unknown> | undefined;
+  const dataCells: Cell<D, unknown>[] = [];
+  for (const cell of cells) {
+    if (cell.column.id === 'select') {
+      selectCell = cell;
+    } else if (cell.column.id !== 'expand') {
+      dataCells.push(cell);
+    }
+  }
+  return { selectCell, dataCells };
+}
+
+function splitDataCells<D extends DefaultType>(cells: Cell<D, unknown>[]) {
+  if (cells.length === 0) {
+    return {
+      titleCell: undefined,
+      actionCells: [] as Cell<D, unknown>[],
+      metaCells: [] as Cell<D, unknown>[],
+    };
+  }
+  const titleCell = cells[0];
+  const remaining = cells.slice(1);
+  let actionStart = remaining.length;
+  for (let i = remaining.length - 1; i >= 0; i--) {
+    if (isActionLikeColumn(remaining[i])) {
+      actionStart = i;
+    } else {
+      break;
+    }
+  }
+  return {
+    titleCell,
+    metaCells: remaining.slice(0, actionStart),
+    actionCells: remaining.slice(actionStart),
+  };
+}
+
+function isActionLikeColumn<D extends DefaultType>(cell: Cell<D, unknown>) {
+  const { id } = cell.column;
+  if (id === 'actions' || id.endsWith('-actions') || id.endsWith('_actions')) {
+    return true;
+  }
+  const header = cell.column.columnDef.header;
+  if (header == null) {
+    return true;
+  }
+  if (typeof header === 'string' && header.trim() === '') {
+    return true;
+  }
+  return false;
+}
+
+function getColumnHeaderText<D extends DefaultType>(cell: Cell<D, unknown>) {
+  const header = cell.column.columnDef.header;
+  return typeof header === 'string' && header.trim() !== '' ? header : null;
+}
diff --git a/app/react/components/datatables/ColumnVisibilityMenu.tsx b/app/react/components/datatables/ColumnVisibilityMenu.tsx
new file mode 100644
index 0000000..af8a905
--- /dev/null
+++ b/app/react/components/datatables/ColumnVisibilityMenu.tsx
@@ -0,0 +1,92 @@
+import _ from 'lodash';
+import clsx from 'clsx';
+import { Menu, MenuButton, MenuList } from '@reach/menu-button';
+import { Columns } from 'lucide-react';
+import { Table } from '@tanstack/react-table';
+
+import { Checkbox } from '@@/form-components/Checkbox';
+
+interface Props<D extends object> {
+  onChange: (value: string[]) => void;
+  value: string[];
+  table: Table<D>;
+}
+
+export function ColumnVisibilityMenu<D extends object>({
+  onChange,
+  value,
+  table,
+}: Props<D>) {
+  const columnsToHide = table.getAllColumns().filter((col) => col.getCanHide());
+  if (!columnsToHide.length) {
+    return null;
+  }
+
+  return (
+    <Menu className="setting">
+      {({ isExpanded }) => (
+        <>
+          <MenuButton
+            className={clsx('table-setting-menu-btn', {
+              'setting-active': isExpanded,
+            })}
+          >
+            <Columns
+              size="13"
+              className="space-right"
+              strokeWidth="3px"
+              aria-hidden="true"
+              aria-label="Columns"
+            />
+          </MenuButton>
+          <MenuList>
+            <div className="tableMenu">
+              <div className="menuHeader">Show / Hide Columns</div>
+              <div className="menuContent">
+                {columnsToHide.map((column) => (
+                  <div key={column.id}>
+                    <Checkbox
+                      checked={column.getIsVisible()}
+                      data-cy="column-visibility-checkbox"
+                      label={
+                        typeof column.columnDef.header === 'string'
+                          ? column.columnDef.header
+                          : _.capitalize(column.columnDef.id)
+                      }
+                      id={`visibility_${column.id}`}
+                      onChange={(e) =>
+                        handleChangeColumnVisibility(
+                          column.id,
+                          e.target.checked
+                        )
+                      }
+                    />
+                  </div>
+                ))}
+              </div>
+            </div>
+          </MenuList>
+        </>
+      )}
+    </Menu>
+  );
+
+  function handleChangeColumnVisibility(colId: string, visible: boolean) {
+    const newValue = visible
+      ? value.filter((id) => id !== colId)
+      : [...value, colId];
+
+    table.setColumnVisibility(
+      Object.fromEntries(newValue.map((col) => [col, false]))
+    );
+    onChange(newValue);
+  }
+}
+
+export function getColumnVisibilityState(hiddenColumns: string[]) {
+  return {
+    columnVisibility: Object.fromEntries(
+      hiddenColumns.map((col) => [col, false])
+    ),
+  };
+}
diff --git a/app/react/components/datatables/Datatable.stories.tsx b/app/react/components/datatables/Datatable.stories.tsx
new file mode 100644
index 0000000..6739a82
--- /dev/null
+++ b/app/react/components/datatables/Datatable.stories.tsx
@@ -0,0 +1,69 @@
+import { Meta, StoryFn } from '@storybook/react-webpack5';
+import { Clock } from 'lucide-react';
+import { createColumnHelper, TableOptions } from '@tanstack/react-table';
+
+import { BasicTableSettings } from './types';
+import { TableState } from './useTableState';
+import { Datatable } from './Datatable';
+
+interface BasicRow {
+  id: number;
+  Name: string;
+  Created: string;
+}
+
+type Args = {
+  isLoading: boolean;
+  data: BasicRow[];
+  settings: TableState<BasicTableSettings>;
+  columns: TableOptions<BasicRow>['columns'];
+};
+
+export default {
+  component: Datatable,
+  title: 'Components/Tables/Datatable',
+} as Meta;
+
+function Template({ isLoading, data, settings, columns }: Args) {
+  return (
+    <Datatable
+      columns={columns}
+      isLoading={isLoading}
+      dataset={data}
+      settingsManager={settings}
+      title="Edge Jobs"
+      titleIcon={Clock}
+      data-cy="edge-jobs-datatable"
+    />
+  );
+}
+
+const columnHelper = createColumnHelper<BasicRow>();
+
+export const Default: StoryFn<Args> = Template.bind({});
+const defaultColumns = [
+  columnHelper.accessor('Name', {
+    header: 'Name',
+  }),
+  columnHelper.accessor('Created', {
+    header: 'Created',
+  }),
+];
+Default.args = {
+  isLoading: false,
+  data: [
+    { id: 1, Name: 'Juan', Created: '2021-01-21' },
+    { id: 2, Name: 'Ji Hee', Created: '2023-03-01' },
+    { id: 3, Name: 'Saki', Created: '2023-08-16' },
+    { id: 4, Name: 'Eve', Created: '2017-11-06' },
+  ],
+  columns: defaultColumns,
+  settings: {
+    sortBy: { id: '', desc: true },
+    setSortBy: () => {},
+    search: '',
+    setSearch: () => {},
+    pageSize: 10,
+    setPageSize: () => {},
+  },
+};
diff --git a/app/react/components/datatables/Datatable.test.tsx b/app/react/components/datatables/Datatable.test.tsx
new file mode 100644
index 0000000..effe321
--- /dev/null
+++ b/app/react/components/datatables/Datatable.test.tsx
@@ -0,0 +1,381 @@
+import { render, screen, fireEvent } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { describe, it, expect } from 'vitest';
+import {
+  createColumnHelper,
+  createTable,
+  getCoreRowModel,
+} from '@tanstack/react-table';
+
+import { Datatable, defaultGlobalFilterFn, Props } from './Datatable';
+import {
+  createPersistedStore,
+  refreshableSettings,
+  TableSettingsWithRefreshable,
+} from './types';
+import { useTableState } from './useTableState';
+
+// Mock data and dependencies
+type MockData = { id: string; name: string; age: number };
+const mockData = [
+  { id: '1', name: 'John Doe', age: 30 },
+  { id: '2', name: 'Jane Smith', age: 25 },
+  { id: '3', name: 'Bob Johnson', age: 35 },
+];
+
+const mockColumns = [
+  { accessorKey: 'name', header: 'Name' },
+  { accessorKey: 'age', header: 'Age' },
+];
+
+// mock table settings / state
+function createStore(storageKey: string) {
+  return createPersistedStore<TableSettingsWithRefreshable>(
+    storageKey,
+    'name',
+    (set) => ({
+      ...refreshableSettings(set),
+    })
+  );
+}
+const storageKey = 'test-table';
+const settingsStore = createStore(storageKey);
+const mockSettingsManager = {
+  pageSize: 10,
+  search: '',
+  sortBy: undefined,
+  setSearch: vitest.fn(),
+  setSortBy: vitest.fn(),
+  setPageSize: vitest.fn(),
+};
+
+function DatatableWithStore(props: Omit<Props<MockData>, 'settingsManager'>) {
+  const tableState = useTableState(settingsStore, storageKey);
+  return (
+    <Datatable {...props} settingsManager={tableState} data-cy="test-table" />
+  );
+}
+
+describe('Datatable', () => {
+  it('renders the table with correct data', () => {
+    render(
+      <DatatableWithStore
+        dataset={mockData}
+        columns={mockColumns}
+        data-cy="test-table"
+      />
+    );
+
+    expect(screen.getByText('John Doe')).toBeInTheDocument();
+    expect(screen.getByText('Jane Smith')).toBeInTheDocument();
+    expect(screen.getByText('Bob Johnson')).toBeInTheDocument();
+  });
+
+  it('renders the table with a title', () => {
+    render(
+      <DatatableWithStore
+        dataset={mockData}
+        columns={mockColumns}
+        title="Test Table"
+        data-cy="test-table"
+      />
+    );
+
+    expect(screen.getByText('Test Table')).toBeInTheDocument();
+  });
+
+  it('handles row selection when not disabled', () => {
+    render(
+      <DatatableWithStore
+        dataset={mockData}
+        columns={mockColumns}
+        data-cy="test-table"
+      />
+    );
+
+    const checkboxes = screen.getAllByRole('checkbox');
+    fireEvent.click(checkboxes[1]); // Select the first row
+
+    // Check if the row is selected (you might need to adapt this based on your implementation)
+    expect(checkboxes[1]).toBeChecked();
+  });
+
+  it('disables row selection when disableSelect is true', () => {
+    render(
+      <DatatableWithStore
+        dataset={mockData}
+        columns={mockColumns}
+        disableSelect
+        data-cy="test-table"
+      />
+    );
+
+    const checkboxes = screen.queryAllByRole('checkbox');
+    expect(checkboxes.length).toBe(0);
+  });
+
+  it('handles sorting', () => {
+    render(
+      <Datatable
+        dataset={mockData}
+        columns={mockColumns}
+        settingsManager={mockSettingsManager}
+        data-cy="test-table"
+      />
+    );
+
+    const nameHeader = screen.getByText('Name');
+    fireEvent.click(nameHeader);
+
+    // Check if setSortBy was called with the correct arguments
+    expect(mockSettingsManager.setSortBy).toHaveBeenCalledWith('name', true);
+  });
+
+  it('renders loading state', () => {
+    render(
+      <DatatableWithStore
+        dataset={mockData}
+        columns={mockColumns}
+        isLoading
+        data-cy="test-table"
+      />
+    );
+
+    expect(screen.getByText('Loading...')).toBeInTheDocument();
+  });
+
+  it('renders empty state', () => {
+    render(
+      <DatatableWithStore
+        dataset={[]}
+        columns={mockColumns}
+        emptyContentLabel="No data available"
+        data-cy="test-table"
+      />
+    );
+
+    expect(screen.getByText('No data available')).toBeInTheDocument();
+    const selectAllCheckbox: HTMLInputElement =
+      screen.getByLabelText('Select all rows');
+    expect(selectAllCheckbox.checked).toBe(false);
+  });
+
+  it('selects/deselects only page rows when select all is clicked', () => {
+    render(
+      <Datatable
+        dataset={mockData}
+        columns={mockColumns}
+        settingsManager={{ ...mockSettingsManager, pageSize: 2 }}
+        data-cy="test-table"
+      />
+    );
+
+    const selectAllCheckbox = screen.getByLabelText('Select all rows');
+    fireEvent.click(selectAllCheckbox);
+
+    // Check if all rows on the page are selected
+    expect(screen.getByText('2 items selected')).toBeInTheDocument();
+
+    // Deselect
+    fireEvent.click(selectAllCheckbox);
+    const checkboxes: HTMLInputElement[] = screen.queryAllByRole('checkbox');
+    expect(checkboxes.filter((checkbox) => checkbox.checked).length).toBe(0);
+  });
+
+  it('selects/deselects all rows including other pages when select all is clicked with shift key', () => {
+    render(
+      <Datatable
+        dataset={mockData}
+        columns={mockColumns}
+        settingsManager={{ ...mockSettingsManager, pageSize: 2 }}
+        data-cy="test-table"
+      />
+    );
+
+    const selectAllCheckbox = screen.getByLabelText('Select all rows');
+    fireEvent.click(selectAllCheckbox, { shiftKey: true });
+
+    // Check if all rows on the page are selected
+    expect(screen.getByText('3 items selected')).toBeInTheDocument();
+
+    // Deselect
+    fireEvent.click(selectAllCheckbox, { shiftKey: true });
+    const checkboxes: HTMLInputElement[] = screen.queryAllByRole('checkbox');
+    expect(checkboxes.filter((checkbox) => checkbox.checked).length).toBe(0);
+  });
+
+  it('shows indeterminate state and correct footer text when hidden rows are selected', async () => {
+    const user = userEvent.setup();
+    render(
+      <DatatableWithStore
+        dataset={mockData}
+        columns={mockColumns}
+        data-cy="test-table"
+        title="Test table with search"
+      />
+    );
+
+    // Select Jane
+    const checkboxes = screen.getAllByRole('checkbox');
+    await user.click(checkboxes[2]); // Select the second row
+
+    // Search for John (will hide selected Jane)
+    const searchInput = screen.getByPlaceholderText('Search...');
+    await user.type(searchInput, 'John');
+
+    // Check if the footer text is correct
+    expect(
+      await screen.findByText('1 item selected (1 hidden by filters)')
+    ).toBeInTheDocument();
+
+    // Check if the checkbox is indeterminate
+    const selectAllCheckbox: HTMLInputElement =
+      screen.getByLabelText('Select all rows');
+    expect(selectAllCheckbox.indeterminate).toBe(true);
+    expect(selectAllCheckbox.checked).toBe(false);
+  });
+});
+
+// Test the defaultGlobalFilterFn used in searches
+type Person = {
+  id: string;
+  name: string;
+  age: number;
+  isEmployed: boolean;
+  tags?: string[];
+  city?: string;
+  family?: { sister: string; uncles?: string[] };
+};
+const data: Person[] = [
+  {
+    // searching primitives should be supported
+    id: '1',
+    name: 'Alice',
+    age: 30,
+    isEmployed: true,
+    // supporting arrays of primitives should be supported
+    tags: ['music', 'likes-pixar'],
+    // supporting objects of primitives should be supported (values only).
+    // but shouldn't be support nested objects / arrays
+    family: { sister: 'sophie', uncles: ['john', 'david'] },
+  },
+];
+const columnHelper = createColumnHelper<Person>();
+const columns = [
+  columnHelper.accessor('name', {
+    id: 'name',
+  }),
+  columnHelper.accessor('isEmployed', {
+    id: 'isEmployed',
+  }),
+  columnHelper.accessor('age', {
+    id: 'age',
+  }),
+  columnHelper.accessor('tags', {
+    id: 'tags',
+  }),
+  columnHelper.accessor('family', {
+    id: 'family',
+  }),
+];
+const mockTable = createTable({
+  columns,
+  data,
+  getCoreRowModel: getCoreRowModel(),
+  state: {},
+  onStateChange() {},
+  renderFallbackValue: undefined,
+  getRowId: (row) => row.id,
+});
+const mockRow = mockTable.getRow('1');
+
+describe('defaultGlobalFilterFn', () => {
+  it('should return true when filterValue is null', () => {
+    const result = defaultGlobalFilterFn(mockRow, 'name', null);
+    expect(result).toBe(true);
+  });
+
+  it('should return true when filterValue.search is empty', () => {
+    const result = defaultGlobalFilterFn(mockRow, 'name', {
+      search: '',
+    });
+    expect(result).toBe(true);
+  });
+
+  it('should filter string values correctly', () => {
+    expect(
+      defaultGlobalFilterFn(mockRow, 'name', {
+        search: 'hello',
+      })
+    ).toBe(false);
+    expect(
+      defaultGlobalFilterFn(mockRow, 'name', {
+        search: 'ALICE',
+      })
+    ).toBe(true);
+    expect(
+      defaultGlobalFilterFn(mockRow, 'name', {
+        search: 'Alice',
+      })
+    ).toBe(true);
+  });
+
+  it('should filter number values correctly', () => {
+    expect(defaultGlobalFilterFn(mockRow, 'age', { search: '123' })).toBe(
+      false
+    );
+    expect(defaultGlobalFilterFn(mockRow, 'age', { search: '30' })).toBe(true);
+    expect(defaultGlobalFilterFn(mockRow, 'age', { search: '67' })).toBe(false);
+  });
+
+  it('should filter boolean values correctly', () => {
+    expect(
+      defaultGlobalFilterFn(mockRow, 'isEmployed', { search: 'true' })
+    ).toBe(true);
+    expect(
+      defaultGlobalFilterFn(mockRow, 'isEmployed', { search: 'false' })
+    ).toBe(false);
+  });
+
+  it('should filter object values correctly', () => {
+    expect(defaultGlobalFilterFn(mockRow, 'family', { search: 'sophie' })).toBe(
+      true
+    );
+    expect(defaultGlobalFilterFn(mockRow, 'family', { search: '30' })).toBe(
+      false
+    );
+  });
+
+  it('should filter array values correctly', () => {
+    expect(defaultGlobalFilterFn(mockRow, 'tags', { search: 'music' })).toBe(
+      true
+    );
+    expect(
+      defaultGlobalFilterFn(mockRow, 'tags', { search: 'Likes-Pixar' })
+    ).toBe(true);
+    expect(defaultGlobalFilterFn(mockRow, 'tags', { search: 'grape' })).toBe(
+      false
+    );
+    expect(defaultGlobalFilterFn(mockRow, 'tags', { search: 'likes' })).toBe(
+      true
+    );
+  });
+
+  it('should handle complex nested structures', () => {
+    expect(defaultGlobalFilterFn(mockRow, 'family', { search: 'sophie' })).toBe(
+      true
+    );
+    expect(defaultGlobalFilterFn(mockRow, 'family', { search: 'mason' })).toBe(
+      false
+    );
+  });
+
+  it('should not filter non-primitive values within objects and arrays', () => {
+    expect(defaultGlobalFilterFn(mockRow, 'family', { search: 'john' })).toBe(
+      false
+    );
+    expect(defaultGlobalFilterFn(mockRow, 'family', { search: 'david' })).toBe(
+      false
+    );
+  });
+});
diff --git a/app/react/components/datatables/Datatable.tsx b/app/react/components/datatables/Datatable.tsx
new file mode 100644
index 0000000..04b8e3c
--- /dev/null
+++ b/app/react/components/datatables/Datatable.tsx
@@ -0,0 +1,349 @@
+import './datatable.css';
+
+import {
+  Table as TableInstance,
+  TableState,
+  useReactTable,
+  Row,
+  Column,
+  getCoreRowModel,
+  getPaginationRowModel,
+  getFilteredRowModel,
+  getSortedRowModel,
+  getFacetedRowModel,
+  getFacetedUniqueValues,
+  getFacetedMinMaxValues,
+  getExpandedRowModel,
+  TableOptions,
+} from '@tanstack/react-table';
+import { ReactNode, useMemo } from 'react';
+import clsx from 'clsx';
+import _ from 'lodash';
+
+import { AutomationTestingProps } from '@/types';
+
+import { IconProps } from '@@/Icon';
+
+import { DatatableHeader } from './DatatableHeader';
+import { DatatableFooter } from './DatatableFooter';
+import { defaultGetRowId } from './defaultGetRowId';
+import { Table } from './Table';
+import { useGoToHighlightedRow } from './useGoToHighlightedRow';
+import { BasicTableSettings, DefaultType } from './types';
+import { DatatableContent } from './DatatableContent';
+import { createSelectColumn } from './select-column';
+import { TableRow } from './TableRow';
+import { type TableState as GlobalTableState } from './useTableState';
+
+export type PaginationProps =
+  | {
+      isServerSidePagination?: false;
+      totalCount?: never;
+      page?: never;
+      onPageChange?: never;
+    }
+  | {
+      isServerSidePagination: true;
+      totalCount: number;
+      page: number;
+      onPageChange(page: number): void;
+    };
+
+export interface Props<D extends DefaultType> extends AutomationTestingProps {
+  dataset: D[];
+  columns: TableOptions<D>['columns'];
+  renderTableSettings?(instance: TableInstance<D>): ReactNode;
+  renderTableActions?(selectedRows: D[]): ReactNode;
+  disableSelect?: boolean;
+  getRowId?(row: D): string;
+  isRowSelectable?(row: Row<D>): boolean;
+  emptyContentLabel?: string;
+  title?: ReactNode;
+  titleId?: string;
+  titleIcon?: IconProps['icon'];
+  initialTableState?: Partial<TableState>;
+  isLoading?: boolean;
+  description?: ReactNode;
+  highlightedItemId?: string;
+  settingsManager: GlobalTableState<BasicTableSettings>;
+  renderRow?(row: Row<D>, highlightedItemId?: string): ReactNode;
+  getRowCanExpand?(row: Row<D>): boolean;
+  noWidget?: boolean;
+  extendTableOptions?: (options: TableOptions<D>) => TableOptions<D>;
+  onSearchChange?: (search: string) => void;
+  includeSearch?: boolean;
+  ariaLabel?: string;
+  id?: string;
+}
+
+export function Datatable<D extends DefaultType>({
+  columns,
+  dataset,
+  renderTableSettings = () => null,
+  renderTableActions = () => null,
+  disableSelect,
+  getRowId = defaultGetRowId,
+  isRowSelectable = () => true,
+  title,
+  titleIcon,
+  titleId,
+  emptyContentLabel,
+  initialTableState = {},
+  isLoading,
+  description,
+  settingsManager: settings,
+  renderRow = defaultRenderRow,
+  highlightedItemId,
+  noWidget,
+  getRowCanExpand,
+  'data-cy': dataCy,
+  onPageChange = () => {},
+  onSearchChange = () => {},
+  page,
+  totalCount = dataset.length,
+  isServerSidePagination = false,
+  extendTableOptions = (value) => value,
+  includeSearch,
+  ariaLabel,
+  id,
+}: Props<D> & PaginationProps) {
+  const pageCount = useMemo(
+    () => Math.ceil(totalCount / settings.pageSize),
+    [settings.pageSize, totalCount]
+  );
+
+  const enableRowSelection = getIsSelectionEnabled(
+    disableSelect,
+    isRowSelectable
+  );
+
+  const allColumns = useMemo(
+    () =>
+      _.compact([!disableSelect && createSelectColumn<D>(dataCy), ...columns]),
+    [disableSelect, dataCy, columns]
+  );
+
+  const tableInstance = useReactTable<D>(
+    extendTableOptions({
+      columns: allColumns,
+      data: dataset,
+      initialState: {
+        pagination: {
+          pageSize: settings.pageSize,
+          pageIndex: page || 0,
+        },
+        sorting: settings.sortBy ? [settings.sortBy] : [],
+
+        ...initialTableState,
+
+        globalFilter: {
+          search: settings.search,
+          ...initialTableState.globalFilter,
+        },
+      },
+      defaultColumn: {
+        enableColumnFilter: false,
+        enableHiding: true,
+        sortingFn: 'alphanumeric',
+      },
+      enableRowSelection,
+      autoResetExpanded: false,
+      globalFilterFn: defaultGlobalFilterFn,
+      getRowId,
+      getCoreRowModel: getCoreRowModel(),
+      getFilteredRowModel: getFilteredRowModel(),
+      getPaginationRowModel: getPaginationRowModel(),
+      getFacetedRowModel: getFacetedRowModel(),
+      getFacetedUniqueValues: getFacetedUniqueValues(),
+      getFacetedMinMaxValues: getFacetedMinMaxValues(),
+      getExpandedRowModel: getExpandedRowModel(),
+      getRowCanExpand,
+      getColumnCanGlobalFilter,
+      ...(isServerSidePagination
+        ? {
+            pageCount,
+            manualPagination: true,
+            manualFiltering: true,
+            manualSorting: true,
+          }
+        : {
+            getSortedRowModel: getSortedRowModel(),
+          }),
+    })
+  );
+
+  const tableState = tableInstance.getState();
+
+  useGoToHighlightedRow(
+    isServerSidePagination,
+    tableState.pagination.pageSize,
+    tableInstance.getCoreRowModel().rows,
+    handlePageChange,
+    highlightedItemId
+  );
+
+  const selectedRowModel = tableInstance.getSelectedRowModel();
+  const selectedItems = selectedRowModel.rows.map((row) => row.original);
+  const filteredItems = tableInstance
+    .getFilteredRowModel()
+    .rows.map((row) => row.original);
+
+  const hiddenSelectedItems = useMemo(
+    () => _.difference(selectedItems, filteredItems),
+    [selectedItems, filteredItems]
+  );
+  const { titleAriaLabel, contentAriaLabel } = getAriaLabels(
+    ariaLabel,
+    title,
+    titleId
+  );
+
+  return (
+    <Table.Container noWidget={noWidget} aria-label={titleAriaLabel} id={id}>
+      <DatatableHeader
+        onSearchChange={handleSearchBarChange}
+        searchValue={settings.search}
+        title={title}
+        titleId={titleId}
+        titleIcon={titleIcon}
+        description={description}
+        renderTableActions={() => renderTableActions(selectedItems)}
+        renderTableSettings={() => renderTableSettings(tableInstance)}
+        data-cy={`${dataCy}-header`}
+        includeSearch={includeSearch}
+      />
+
+      <DatatableContent<D>
+        tableInstance={tableInstance}
+        renderRow={(row) => renderRow(row, highlightedItemId)}
+        emptyContentLabel={emptyContentLabel}
+        isLoading={isLoading}
+        onSortChange={handleSortChange}
+        data-cy={dataCy}
+        aria-label={contentAriaLabel}
+      />
+
+      <DatatableFooter
+        onPageChange={handlePageChange}
+        onPageSizeChange={handlePageSizeChange}
+        page={typeof page === 'number' ? page : tableState.pagination.pageIndex}
+        pageSize={tableState.pagination.pageSize}
+        pageCount={tableInstance.getPageCount()}
+        totalSelected={selectedItems.length}
+        totalHiddenSelected={hiddenSelectedItems.length}
+      />
+    </Table.Container>
+  );
+
+  function handleSearchBarChange(search: string) {
+    tableInstance.setGlobalFilter({ search });
+    settings.setSearch(search);
+    onSearchChange(search);
+  }
+
+  function handlePageChange(page: number) {
+    tableInstance.setPageIndex(page);
+    onPageChange(page);
+  }
+
+  function handleSortChange(colId: string, desc: boolean) {
+    settings.setSortBy(colId, desc);
+  }
+
+  function handlePageSizeChange(pageSize: number) {
+    tableInstance.setPageSize(pageSize);
+    settings.setPageSize(pageSize);
+  }
+}
+
+function getAriaLabels(
+  titleAriaLabel?: string,
+  title?: ReactNode,
+  titleId?: string
+) {
+  if (titleAriaLabel) {
+    return { titleAriaLabel, contentAriaLabel: `${titleAriaLabel} table` };
+  }
+  if (typeof title === 'string') {
+    return { titleAriaLabel: title, contentAriaLabel: `${title} table` };
+  }
+  if (titleId) {
+    return { titleAriaLabel: titleId, contentAriaLabel: `${titleId} table` };
+  }
+  return { titleAriaLabel: 'table', contentAriaLabel: 'table' };
+}
+
+function defaultRenderRow<D extends DefaultType>(
+  row: Row<D>,
+  highlightedItemId?: string
+) {
+  return (
+    <TableRow<D>
+      cells={row.getVisibleCells()}
+      className={clsx({
+        active: highlightedItemId === row.id,
+      })}
+    />
+  );
+}
+
+function getIsSelectionEnabled<D extends DefaultType>(
+  disabledSelect?: boolean,
+  isRowSelectable?: Props<D>['isRowSelectable']
+) {
+  if (disabledSelect) {
+    return false;
+  }
+
+  if (isRowSelectable) {
+    return isRowSelectable;
+  }
+
+  return true;
+}
+
+export function defaultGlobalFilterFn<D, TFilter extends { search: string }>(
+  row: Row<D>,
+  columnId: string,
+  filterValue: null | TFilter
+): boolean {
+  const value = row.getValue(columnId);
+
+  if (filterValue === null || !filterValue.search) {
+    return true;
+  }
+
+  if (value == null) {
+    return false;
+  }
+
+  const filterValueLower = filterValue.search.toLowerCase();
+
+  if (typeof value === 'object') {
+    return Object.values(value).some((item) =>
+      filterPrimitive(item, filterValueLower)
+    );
+  }
+
+  if (Array.isArray(value)) {
+    return value.some((item) => filterPrimitive(item, filterValueLower));
+  }
+
+  return filterPrimitive(value, filterValueLower);
+}
+
+// only filter primitive values within objects and arrays, to avoid searching nested objects
+function filterPrimitive(value: unknown, filterValueLower: string) {
+  if (
+    typeof value === 'string' ||
+    typeof value === 'number' ||
+    typeof value === 'boolean'
+  ) {
+    return value.toString().toLowerCase().includes(filterValueLower);
+  }
+  return false;
+}
+
+function getColumnCanGlobalFilter<D>(column: Column<D>): boolean {
+  return column.id !== 'select';
+}
diff --git a/app/react/components/datatables/DatatableContent.tsx b/app/react/components/datatables/DatatableContent.tsx
new file mode 100644
index 0000000..7450782
--- /dev/null
+++ b/app/react/components/datatables/DatatableContent.tsx
@@ -0,0 +1,51 @@
+import { Row, Table as TableInstance } from '@tanstack/react-table';
+
+import { AutomationTestingProps } from '@/types';
+
+import { Table } from './Table';
+import { DefaultType } from './types';
+
+interface Props<D extends DefaultType> extends AutomationTestingProps {
+  tableInstance: TableInstance<D>;
+  renderRow(row: Row<D>): React.ReactNode;
+  onSortChange?(colId: string, desc: boolean): void;
+  isLoading?: boolean;
+  emptyContentLabel?: string;
+  'aria-label'?: string;
+}
+
+export function DatatableContent<D extends DefaultType>({
+  tableInstance,
+  renderRow,
+  onSortChange,
+  isLoading,
+  emptyContentLabel,
+  'data-cy': dataCy,
+  'aria-label': ariaLabel,
+}: Props<D>) {
+  const headerGroups = tableInstance.getHeaderGroups();
+  const pageRowModel = tableInstance.getPaginationRowModel();
+
+  return (
+    <Table data-cy={dataCy} className="nowrap-cells" aria-label={ariaLabel}>
+      <thead>
+        {headerGroups.map((headerGroup) => (
+          <Table.HeaderRow<D>
+            key={headerGroup.id}
+            headers={headerGroup.headers}
+            onSortChange={onSortChange}
+            tableMeta={tableInstance.options.meta}
+          />
+        ))}
+      </thead>
+      <tbody>
+        <Table.Content<D>
+          rows={pageRowModel.rows}
+          isLoading={isLoading}
+          emptyContent={emptyContentLabel}
+          renderRow={renderRow}
+        />
+      </tbody>
+    </Table>
+  );
+}
diff --git a/app/react/components/datatables/DatatableFooter.tsx b/app/react/components/datatables/DatatableFooter.tsx
new file mode 100644
index 0000000..0907ae2
--- /dev/null
+++ b/app/react/components/datatables/DatatableFooter.tsx
@@ -0,0 +1,38 @@
+import { PaginationControls } from '@@/PaginationControls';
+
+import { Table } from './Table';
+import { SelectedRowsCount } from './SelectedRowsCount';
+
+interface Props {
+  totalSelected: number;
+  totalHiddenSelected: number;
+  pageSize: number;
+  page: number;
+  onPageChange(page: number): void;
+  pageCount: number;
+  onPageSizeChange(pageSize: number): void;
+}
+
+export function DatatableFooter({
+  totalSelected,
+  totalHiddenSelected,
+  pageSize,
+  page,
+  onPageChange,
+  pageCount,
+  onPageSizeChange,
+}: Props) {
+  return (
+    <Table.Footer>
+      <SelectedRowsCount value={totalSelected} hidden={totalHiddenSelected} />
+      <PaginationControls
+        showAll
+        pageLimit={pageSize}
+        page={page + 1}
+        onPageChange={(page) => onPageChange(page - 1)}
+        pageCount={pageCount}
+        onPageLimitChange={onPageSizeChange}
+      />
+    </Table.Footer>
+  );
+}
diff --git a/app/react/components/datatables/DatatableHeader.tsx b/app/react/components/datatables/DatatableHeader.tsx
new file mode 100644
index 0000000..bc0f567
--- /dev/null
+++ b/app/react/components/datatables/DatatableHeader.tsx
@@ -0,0 +1,65 @@
+import { ReactNode } from 'react';
+
+import { AutomationTestingProps } from '@/types';
+
+import { IconProps } from '@@/Icon';
+
+import { SearchBar } from './SearchBar';
+import { Table } from './Table';
+
+type Props = {
+  title?: React.ReactNode;
+  titleIcon?: IconProps['icon'];
+  searchValue: string;
+  onSearchChange(value: string): void;
+  renderTableSettings?(): ReactNode;
+  renderTableActions?(): ReactNode;
+  description?: ReactNode;
+  titleId?: string;
+  includeSearch?: boolean;
+} & AutomationTestingProps;
+
+export function DatatableHeader({
+  onSearchChange,
+  renderTableActions,
+  renderTableSettings,
+  searchValue,
+  title,
+  titleIcon,
+  description,
+  titleId,
+  'data-cy': dataCy,
+  includeSearch = !!title,
+}: Props) {
+  if (!title && !includeSearch) {
+    return null;
+  }
+
+  const searchBar = (
+    <SearchBar
+      value={searchValue}
+      onChange={onSearchChange}
+      data-cy={`${dataCy}-search-input`}
+    />
+  );
+  const tableActions = !!renderTableActions && (
+    <Table.Actions>{renderTableActions()}</Table.Actions>
+  );
+  const tableTitleSettings = !!renderTableSettings && (
+    <Table.TitleActions>{renderTableSettings()}</Table.TitleActions>
+  );
+
+  return (
+    <Table.Title
+      id={titleId}
+      label={title}
+      icon={titleIcon}
+      description={description}
+      data-cy={dataCy}
+    >
+      {includeSearch && searchBar}
+      {tableActions}
+      {tableTitleSettings}
+    </Table.Title>
+  );
+}
diff --git a/app/react/components/datatables/ExpandableDatatable.tsx b/app/react/components/datatables/ExpandableDatatable.tsx
new file mode 100644
index 0000000..e8e35f7
--- /dev/null
+++ b/app/react/components/datatables/ExpandableDatatable.tsx
@@ -0,0 +1,40 @@
+import { Row } from '@tanstack/react-table';
+import { ReactNode } from 'react';
+
+import { ExpandableDatatableTableRow } from './ExpandableDatatableRow';
+import {
+  Datatable,
+  Props as DatatableProps,
+  PaginationProps,
+} from './Datatable';
+import { DefaultType } from './types';
+
+interface Props<D extends DefaultType> extends Omit<
+  DatatableProps<D>,
+  'renderRow' | 'expandable'
+> {
+  renderSubRow(row: Row<D>): ReactNode;
+  expandOnRowClick?: boolean;
+}
+
+export function ExpandableDatatable<D extends DefaultType>({
+  renderSubRow,
+  getRowCanExpand = () => true,
+  expandOnRowClick,
+  ...props
+}: Props<D> & PaginationProps) {
+  return (
+    <Datatable<D>
+      // eslint-disable-next-line react/jsx-props-no-spreading
+      {...props}
+      getRowCanExpand={getRowCanExpand}
+      renderRow={(row) => (
+        <ExpandableDatatableTableRow<D>
+          row={row}
+          renderSubRow={renderSubRow}
+          expandOnClick={expandOnRowClick}
+        />
+      )}
+    />
+  );
+}
diff --git a/app/react/components/datatables/ExpandableDatatableRow.tsx b/app/react/components/datatables/ExpandableDatatableRow.tsx
new file mode 100644
index 0000000..3193967
--- /dev/null
+++ b/app/react/components/datatables/ExpandableDatatableRow.tsx
@@ -0,0 +1,29 @@
+import { ReactNode } from 'react';
+import { Row } from '@tanstack/react-table';
+
+import { TableRow } from './TableRow';
+import { DefaultType } from './types';
+
+interface Props<D extends DefaultType> {
+  row: Row<D>;
+  renderSubRow(row: Row<D>): ReactNode;
+  expandOnClick?: boolean;
+}
+
+export function ExpandableDatatableTableRow<D extends DefaultType>({
+  row,
+  renderSubRow,
+  expandOnClick,
+}: Props<D>) {
+  const cells = row.getVisibleCells();
+
+  return (
+    <>
+      <TableRow<D>
+        cells={cells}
+        onClick={expandOnClick ? () => row.toggleExpanded() : undefined}
+      />
+      {row.getIsExpanded() && row.getCanExpand() && renderSubRow(row)}
+    </>
+  );
+}
diff --git a/app/react/components/datatables/Filter.test.tsx b/app/react/components/datatables/Filter.test.tsx
new file mode 100644
index 0000000..9979cde
--- /dev/null
+++ b/app/react/components/datatables/Filter.test.tsx
@@ -0,0 +1,288 @@
+import { render, screen, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+
+import { MultipleSelectionFilter } from './Filter';
+
+function renderDefault({
+  options = ['Option 1', 'Option 2', 'Option 3'],
+  value = [],
+  filterKey = 'test-filter',
+  onChange = vi.fn(),
+  menuTitle = 'Filter by state',
+}: Partial<Parameters<typeof MultipleSelectionFilter>[0]> = {}) {
+  return render(
+    <MultipleSelectionFilter
+      options={options}
+      value={value}
+      filterKey={filterKey}
+      onChange={onChange}
+      menuTitle={menuTitle}
+    />
+  );
+}
+
+describe('MultipleSelectionFilter', () => {
+  it('should render the filter button', () => {
+    renderDefault();
+
+    const button = screen.getByRole('button', { name: /filter/i });
+    expect(button).toBeInTheDocument();
+  });
+
+  it.each([
+    { value: [], hasActiveClass: false, description: 'no filters' },
+    {
+      value: ['Option 1'],
+      hasActiveClass: true,
+      description: 'filters active',
+    },
+  ])(
+    'should apply filter-active class based on selection state: $description',
+    ({ value, hasActiveClass }) => {
+      renderDefault({ value });
+
+      const button = screen.getByRole('button', { name: /filter/i });
+      if (hasActiveClass) {
+        expect(button).toHaveClass('filter-active');
+      } else {
+        expect(button).not.toHaveClass('filter-active');
+      }
+    }
+  );
+
+  it('should open the filter menu when button is clicked', async () => {
+    const user = userEvent.setup();
+    renderDefault();
+
+    const button = screen.getByRole('button', { name: /filter/i });
+    await user.click(button);
+
+    expect(screen.getByText('Filter by state')).toBeInTheDocument();
+  });
+
+  it('should render all filter options', async () => {
+    const user = userEvent.setup();
+    const options = ['Running', 'Stopped', 'Paused'];
+    renderDefault({ options });
+
+    const button = screen.getByRole('button', { name: /filter/i });
+    await user.click(button);
+
+    options.forEach((option) => {
+      expect(screen.getByLabelText(option)).toBeInTheDocument();
+    });
+  });
+
+  it('should render custom menu title', async () => {
+    const user = userEvent.setup();
+    const menuTitle = 'Filter by custom state';
+    renderDefault({ menuTitle });
+
+    const button = screen.getByRole('button', { name: /filter/i });
+    await user.click(button);
+
+    expect(screen.getByText(menuTitle)).toBeInTheDocument();
+  });
+
+  it('should check the boxes for selected values', async () => {
+    const user = userEvent.setup();
+    const options = ['Running', 'Stopped', 'Paused'];
+    const value = ['Running', 'Paused'];
+    renderDefault({ options, value });
+
+    const button = screen.getByRole('button', { name: /filter/i });
+    await user.click(button);
+
+    const runningCheckbox = screen.getByLabelText<HTMLInputElement>('Running');
+    const stoppedCheckbox = screen.getByLabelText<HTMLInputElement>('Stopped');
+    const pausedCheckbox = screen.getByLabelText<HTMLInputElement>('Paused');
+
+    expect(runningCheckbox.checked).toBe(true);
+    expect(stoppedCheckbox.checked).toBe(false);
+    expect(pausedCheckbox.checked).toBe(true);
+  });
+
+  it.each([
+    {
+      description: 'adding a value',
+      initialValue: ['Running'],
+      clickOption: 'Stopped',
+      expectedValue: ['Running', 'Stopped'],
+    },
+    {
+      description: 'removing a value',
+      initialValue: ['Running', 'Stopped'],
+      clickOption: 'Running',
+      expectedValue: ['Stopped'],
+    },
+  ])(
+    'should call onChange when $description',
+    async ({ initialValue, clickOption, expectedValue }) => {
+      const user = userEvent.setup();
+      const options = ['Running', 'Stopped', 'Paused'];
+      const onChange = vi.fn();
+      renderDefault({ options, value: initialValue, onChange });
+
+      const button = screen.getByRole('button', { name: /filter/i });
+      await user.click(button);
+
+      const checkbox = screen.getByLabelText(clickOption);
+      await user.click(checkbox);
+
+      expect(onChange).toHaveBeenCalledWith(expectedValue);
+    }
+  );
+
+  it('should call onChange only once per click', async () => {
+    const user = userEvent.setup();
+    const options = ['Running', 'Stopped'];
+    const onChange = vi.fn();
+    renderDefault({ options, onChange });
+
+    const button = screen.getByRole('button', { name: /filter/i });
+    await user.click(button);
+
+    const runningCheckbox = screen.getByLabelText('Running');
+    await user.click(runningCheckbox);
+
+    expect(onChange).toHaveBeenCalledTimes(1);
+  });
+
+  it('should render checkboxes with correct data-cy attributes', async () => {
+    const user = userEvent.setup();
+    const options = ['Running', 'Stopped'];
+    const filterKey = 'status';
+    renderDefault({ options, filterKey });
+
+    const button = screen.getByRole('button', { name: /filter/i });
+    await user.click(button);
+
+    expect(screen.getByTestId('filter_status_0')).toBeInTheDocument();
+    expect(screen.getByTestId('filter_status_1')).toBeInTheDocument();
+  });
+
+  it('should preserve values that are not in the options list', async () => {
+    const user = userEvent.setup();
+    const options = ['Running', 'Stopped'];
+    const value = ['Running', 'Paused']; // 'Paused' is not in options
+    renderDefault({ options, value });
+
+    const button = screen.getByRole('button', { name: /filter/i });
+    await user.click(button);
+
+    // Should render all unique values from both options and value
+    expect(screen.getByLabelText('Running')).toBeInTheDocument();
+    expect(screen.getByLabelText('Stopped')).toBeInTheDocument();
+    expect(screen.getByLabelText('Paused')).toBeInTheDocument();
+
+    // Check that 'Running' and 'Paused' are checked
+    const runningCheckbox = screen.getByLabelText<HTMLInputElement>('Running');
+    const pausedCheckbox = screen.getByLabelText<HTMLInputElement>('Paused');
+    expect(runningCheckbox.checked).toBe(true);
+    expect(pausedCheckbox.checked).toBe(true);
+  });
+
+  it('should handle empty options array', async () => {
+    const user = userEvent.setup();
+    renderDefault({ options: [] });
+
+    const button = screen.getByRole('button', { name: /filter/i });
+    await user.click(button);
+
+    const menuContent = screen.getByText('Filter by state').parentElement;
+    const checkboxes = menuContent?.querySelectorAll('input[type="checkbox"]');
+    expect(checkboxes?.length).toBe(0);
+  });
+
+  it('should handle selecting all options', async () => {
+    const user = userEvent.setup();
+    const options = ['Running', 'Stopped'];
+    const onChange = vi.fn();
+    renderDefault({ options, value: [], onChange });
+
+    const button = screen.getByRole('button', { name: /filter/i });
+    await user.click(button);
+
+    // Click all options
+    await user.click(screen.getByLabelText('Running'));
+    await user.click(screen.getByLabelText('Stopped'));
+
+    expect(onChange).toHaveBeenNthCalledWith(1, ['Running']);
+    expect(onChange).toHaveBeenNthCalledWith(2, ['Stopped']);
+  });
+
+  it('should handle deselecting all options', async () => {
+    const user = userEvent.setup();
+    const options = ['Running', 'Stopped'];
+    const value = ['Running', 'Stopped'];
+    const onChange = vi.fn();
+    renderDefault({ options, value, onChange });
+
+    const button = screen.getByRole('button', { name: /filter/i });
+    await user.click(button);
+
+    // Uncheck first option
+    await user.click(screen.getByLabelText('Running'));
+    expect(onChange).toHaveBeenNthCalledWith(1, ['Stopped']);
+
+    // Uncheck second option (note: the component still has the original value)
+    await user.click(screen.getByLabelText('Stopped'));
+    expect(onChange).toHaveBeenNthCalledWith(2, ['Running']);
+  });
+
+  it('should remove duplicates from combined options and values', async () => {
+    const user = userEvent.setup();
+    const options = ['Running', 'Stopped', 'Running']; // duplicate 'Running'
+    const value = ['Running', 'Paused', 'Running']; // duplicate 'Running'
+    renderDefault({ options, value });
+
+    const button = screen.getByRole('button', { name: /filter/i });
+    await user.click(button);
+
+    const menuContent = screen.getByText('Filter by state').parentElement;
+    const checkboxes = within(menuContent!).getAllByRole('checkbox');
+
+    // Should only have 3 unique options: Running, Stopped, Paused
+    expect(checkboxes.length).toBe(3);
+  });
+
+  it('should maintain correct checked state after multiple interactions', async () => {
+    const user = userEvent.setup();
+    const options = ['Running', 'Stopped', 'Paused'];
+    const onChange = vi.fn();
+
+    const { rerender } = renderDefault({
+      options,
+      value: ['Running'],
+      onChange,
+    });
+
+    // Open menu and click 'Stopped'
+    let button = screen.getByRole('button', { name: /filter/i });
+    await user.click(button);
+    await user.click(screen.getByLabelText('Stopped'));
+
+    // Rerender with new value
+    rerender(
+      <MultipleSelectionFilter
+        options={options}
+        value={['Running', 'Stopped']}
+        filterKey="test-filter"
+        onChange={onChange}
+        menuTitle="Filter by state"
+      />
+    );
+
+    // Open menu again and verify state
+    button = screen.getByRole('button', { name: /filter/i });
+    await user.click(button);
+
+    const runningCheckbox = screen.getByLabelText<HTMLInputElement>('Running');
+    const stoppedCheckbox = screen.getByLabelText<HTMLInputElement>('Stopped');
+    const pausedCheckbox = screen.getByLabelText<HTMLInputElement>('Paused');
+
+    expect(runningCheckbox.checked).toBe(true);
+    expect(stoppedCheckbox.checked).toBe(true);
+    expect(pausedCheckbox.checked).toBe(false);
+  });
+});
diff --git a/app/react/components/datatables/Filter.tsx b/app/react/components/datatables/Filter.tsx
new file mode 100644
index 0000000..9b42ca1
--- /dev/null
+++ b/app/react/components/datatables/Filter.tsx
@@ -0,0 +1,135 @@
+import clsx from 'clsx';
+import { useMemo } from 'react';
+import { Menu, MenuButton, MenuPopover } from '@reach/menu-button';
+import { Column, Row, TableMeta } from '@tanstack/react-table';
+import { Check, Filter } from 'lucide-react';
+import _ from 'lodash';
+
+import { getValueAsArrayOfStrings } from '@/portainer/helpers/array';
+
+import { Icon } from '@@/Icon';
+
+import { DefaultType } from './types';
+
+interface MultipleSelectionFilterProps {
+  options: Array<string> | ReadonlyArray<string>;
+  value: string[];
+  filterKey: string;
+  onChange: (value: string[]) => void;
+  menuTitle?: string;
+}
+
+export function MultipleSelectionFilter({
+  options,
+  value = [],
+  filterKey,
+  onChange,
+  menuTitle = 'Filter by state',
+}: MultipleSelectionFilterProps) {
+  const enabled = value.length > 0;
+
+  // This will make sure that if the current value has options that are not in the options list,
+  // they will still be displayed in the filter menu.
+  const optionsWithValues = useMemo(
+    () => _.uniq([...options, ...value]),
+    [options, value]
+  );
+
+  return (
+    <div>
+      <Menu>
+        <MenuButton
+          className={clsx('table-filter flex items-center gap-1', {
+            'filter-active': enabled,
+          })}
+        >
+          Filter
+          <Icon icon={enabled ? Check : Filter} />
+        </MenuButton>
+        <MenuPopover className="dropdown-menu">
+          <div className="tableMenu">
+            <div className="menuHeader">{menuTitle}</div>
+            <div className="menuContent">
+              {optionsWithValues.map((option, index) => (
+                <div className="md-checkbox" key={index}>
+                  <input
+                    id={`filter_${filterKey}_${index}`}
+                    type="checkbox"
+                    checked={value.includes(option)}
+                    onChange={() => handleChange(option)}
+                    data-cy={`filter_${filterKey}_${index}`}
+                  />
+                  <label htmlFor={`filter_${filterKey}_${index}`}>
+                    {option}
+                  </label>
+                </div>
+              ))}
+            </div>
+          </div>
+        </MenuPopover>
+      </Menu>
+    </div>
+  );
+
+  function handleChange(option: string) {
+    if (value.includes(option)) {
+      onChange(value.filter((o) => o !== option));
+
+      return;
+    }
+
+    onChange([...value, option]);
+  }
+}
+
+export type FilterOptionsTransformer<TData extends DefaultType> = (
+  rows: Row<TData>[],
+  id: string,
+  tableMeta: TableMeta<TData>
+) => string[];
+
+export function filterHOC<TData extends DefaultType>(
+  menuTitle: string,
+  filterOptionsTransformer: FilterOptionsTransformer<TData> = defaultFilterOptionsTransformer
+) {
+  return function Filter({
+    column: { getFilterValue, setFilterValue, getFacetedRowModel, id },
+    tableMeta,
+  }: {
+    column: Column<TData>;
+    tableMeta: TableMeta<TData>;
+  }) {
+    const { flatRows } = getFacetedRowModel();
+
+    const options = useMemo(
+      () => filterOptionsTransformer(flatRows, id, tableMeta),
+      [flatRows, id, tableMeta]
+    );
+
+    const value = getFilterValue();
+
+    const valueAsArray = getValueAsArrayOfStrings(value);
+
+    return (
+      <MultipleSelectionFilter
+        options={options}
+        filterKey={id}
+        value={valueAsArray}
+        onChange={setFilterValue}
+        menuTitle={menuTitle}
+      />
+    );
+  };
+}
+
+function defaultFilterOptionsTransformer<TData extends DefaultType>(
+  rows: Row<TData>[],
+  id: string
+) {
+  const options = new Set<string>();
+  rows.forEach(({ getValue }) => {
+    const value = getValue<string>(id);
+    options.add(value);
+  });
+  return Array.from(options);
+}
diff --git a/app/react/components/datatables/NestedDatatable.tsx b/app/react/components/datatables/NestedDatatable.tsx
new file mode 100644
index 0000000..fc6cf22
--- /dev/null
+++ b/app/react/components/datatables/NestedDatatable.tsx
@@ -0,0 +1,119 @@
+import { useMemo } from 'react';
+import { difference } from 'lodash';
+import {
+  getCoreRowModel,
+  getFilteredRowModel,
+  getPaginationRowModel,
+  getSortedRowModel,
+  TableOptions,
+  TableState,
+  useReactTable,
+} from '@tanstack/react-table';
+
+import { AutomationTestingProps } from '@/types';
+
+import { IconProps } from '@@/Icon';
+
+import { defaultGetRowId } from './defaultGetRowId';
+import { Table } from './Table';
+import { NestedTable } from './NestedTable';
+import { DatatableContent } from './DatatableContent';
+import { DatatableFooter } from './DatatableFooter';
+import { BasicTableSettings, DefaultType } from './types';
+
+interface Props<D extends DefaultType> extends AutomationTestingProps {
+  dataset: D[];
+  columns: TableOptions<D>['columns'];
+
+  getRowId?(row: D): string;
+  emptyContentLabel?: string;
+  initialTableState?: Partial<TableState>;
+  isLoading?: boolean;
+  initialSortBy?: BasicTableSettings['sortBy'];
+  enablePagination?: boolean;
+  title?: React.ReactNode;
+  titleIcon?: IconProps['icon'];
+  /**
+   * keyword to filter by
+   */
+  search?: string;
+
+  'aria-label'?: string;
+}
+
+export function NestedDatatable<D extends DefaultType>({
+  columns,
+  dataset,
+  getRowId = defaultGetRowId,
+  emptyContentLabel,
+  initialTableState = {},
+  isLoading,
+  initialSortBy,
+  enablePagination = true,
+  title,
+  titleIcon,
+  search,
+  'data-cy': dataCy,
+  'aria-label': ariaLabel,
+}: Props<D>) {
+  const tableInstance = useReactTable<D>({
+    columns,
+    data: dataset,
+    initialState: {
+      sorting: initialSortBy ? [initialSortBy] : [],
+      ...initialTableState,
+    },
+    defaultColumn: {
+      enableColumnFilter: false,
+      enableHiding: false,
+    },
+    state: {
+      globalFilter: search,
+    },
+    getRowId,
+    autoResetExpanded: false,
+    getCoreRowModel: getCoreRowModel(),
+    getFilteredRowModel: getFilteredRowModel(),
+    getSortedRowModel: getSortedRowModel(),
+    ...(enablePagination && { getPaginationRowModel: getPaginationRowModel() }),
+  });
+
+  const tableState = tableInstance.getState();
+  const selectedRowModel = tableInstance.getSelectedRowModel();
+  const selectedItems = selectedRowModel.rows.map((row) => row.original);
+  const filteredItems = tableInstance
+    .getFilteredRowModel()
+    .rows.map((row) => row.original);
+
+  const hiddenSelectedItems = useMemo(
+    () => difference(selectedItems, filteredItems),
+    [selectedItems, filteredItems]
+  );
+
+  return (
+    <NestedTable>
+      <Table.Container noWidget>
+        {title && <Table.Title label={title} icon={titleIcon} />}
+        <DatatableContent<D>
+          tableInstance={tableInstance}
+          isLoading={isLoading}
+          emptyContentLabel={emptyContentLabel}
+          renderRow={(row) => <Table.Row<D> cells={row.getVisibleCells()} />}
+          aria-label={ariaLabel}
+          data-cy={dataCy}
+        />
+        {enablePagination && (
+          <DatatableFooter
+            onPageChange={tableInstance.setPageIndex}
+            onPageSizeChange={tableInstance.setPageSize}
+            page={tableState.pagination.pageIndex}
+            pageSize={tableState.pagination.pageSize}
+            pageCount={tableInstance.getPageCount()}
+            totalSelected={selectedItems.length}
+            totalHiddenSelected={hiddenSelectedItems.length}
+          />
+        )}
+      </Table.Container>
+    </NestedTable>
+  );
+}
diff --git a/app/react/components/datatables/NestedTable.css b/app/react/components/datatables/NestedTable.css
new file mode 100644
index 0000000..3c6d032
--- /dev/null
+++ b/app/react/components/datatables/NestedTable.css
@@ -0,0 +1,22 @@
+.inner-datatable .widget {
+  border: 0 !important;
+}
+
+.inner-datatable {
+  @apply rounded-md border border-solid border-gray-5 th-dark:border-gray-9;
+  overflow: hidden;
+}
+
+.inner-datatable table thead {
+  border-top: none !important;
+}
+
+.inner-datatable tr > th:first-child,
+.inner-datatable tr > td:first-child {
+  padding-left: 20px;
+}
+
+.inner-datatable tr > th:last-child,
+.inner-datatable tr > td:last-child {
+  padding-right: 20px;
+}
diff --git a/app/react/components/datatables/NestedTable.tsx b/app/react/components/datatables/NestedTable.tsx
new file mode 100644
index 0000000..54a2f6e
--- /dev/null
+++ b/app/react/components/datatables/NestedTable.tsx
@@ -0,0 +1,7 @@
+import { PropsWithChildren } from 'react';
+
+import './NestedTable.css';
+
+export function NestedTable({ children }: PropsWithChildren<unknown>) {
+  return <div className="inner-datatable">{children}</div>;
+}
diff --git a/app/react/components/datatables/QuickActionsSettings.tsx b/app/react/components/datatables/QuickActionsSettings.tsx
new file mode 100644
index 0000000..73acca3
--- /dev/null
+++ b/app/react/components/datatables/QuickActionsSettings.tsx
@@ -0,0 +1,51 @@
+import {
+  SettableQuickActionsTableSettings,
+  QuickAction,
+} from '@/react/docker/containers/ListView/ContainersDatatable/types';
+
+import { Checkbox } from '@@/form-components/Checkbox';
+
+import { useTableSettings } from './useTableSettings';
+
+export interface Action {
+  id: QuickAction;
+  label: string;
+}
+
+interface Props {
+  actions: Action[];
+}
+
+export function QuickActionsSettings({ actions }: Props) {
+  const settings =
+    useTableSettings<SettableQuickActionsTableSettings<QuickAction>>();
+
+  return (
+    <>
+      {actions.map(({ id, label }) => (
+        <Checkbox
+          key={id}
+          data-cy="quick-actions-checkbox"
+          label={label}
+          id={`quick-actions-${id}`}
+          checked={!settings.hiddenQuickActions.includes(id)}
+          onChange={(e) => toggleAction(id, e.target.checked)}
+        />
+      ))}
+    </>
+  );
+
+  function toggleAction(key: QuickAction, visible: boolean) {
+    if (!visible) {
+      settings.setHiddenQuickActions([...settings.hiddenQuickActions, key]);
+    } else {
+      settings.setHiddenQuickActions(
+        settings.hiddenQuickActions.filter((action) => action !== key)
+      );
+    }
+  }
+}
+
+export function buildAction(id: QuickAction, label: string): Action {
+  return { id, label };
+}
diff --git a/app/react/components/datatables/RowContext.tsx b/app/react/components/datatables/RowContext.tsx
new file mode 100644
index 0000000..f737188
--- /dev/null
+++ b/app/react/components/datatables/RowContext.tsx
@@ -0,0 +1,24 @@
+import { createContext, PropsWithChildren, useContext } from 'react';
+
+export function createRowContext<TContext>() {
+  const Context = createContext<TContext | null>(null);
+  Context.displayName = 'RowContext';
+
+  return { RowProvider, useRowContext };
+
+  function RowProvider({
+    children,
+    context,
+  }: PropsWithChildren<{ context: TContext }>) {
+    return <Context.Provider value={context}>{children}</Context.Provider>;
+  }
+
+  function useRowContext() {
+    const context = useContext(Context);
+    if (!context) {
+      throw new Error('should be nested under RowProvider');
+    }
+
+    return context;
+  }
+}
diff --git a/app/react/components/datatables/SearchBar.tsx b/app/react/components/datatables/SearchBar.tsx
new file mode 100644
index 0000000..2042c65
--- /dev/null
+++ b/app/react/components/datatables/SearchBar.tsx
@@ -0,0 +1,70 @@
+import { ReactNode } from 'react';
+import { Search, X } from 'lucide-react';
+import clsx from 'clsx';
+
+import { useLocalStorage } from '@/react/hooks/useLocalStorage';
+import { AutomationTestingProps } from '@/types';
+import { useDebounce } from '@/react/hooks/useDebounce';
+
+import { Button } from '@@/buttons';
+
+interface Props extends AutomationTestingProps {
+  value: string;
+  placeholder?: string;
+  onChange(value: string): void;
+  className?: string;
+  children?: ReactNode;
+}
+
+export function SearchBar({
+  value,
+  placeholder = 'Search...',
+  onChange,
+  'data-cy': dataCy,
+  className,
+  children,
+}: Props) {
+  const [searchValue, setSearchValue] = useDebounce(value, onChange);
+
+  function onClear() {
+    setSearchValue('');
+  }
+
+  return (
+    <div
+      className={clsx('searchBar flex min-w-[90px] items-center', className)}
+    >
+      <Search className="searchIcon lucide shrink-0" />
+      <input
+        type="text"
+        data-cy={dataCy}
+        className="searchInput"
+        value={searchValue}
+        onChange={(e) => setSearchValue(e.target.value)}
+        placeholder={placeholder}
+        aria-label="Search input"
+      />
+      {children}
+      <Button
+        onClick={onClear}
+        icon={X}
+        color="none"
+        disabled={!searchValue}
+        data-cy={`${dataCy}-clear-button`}
+      />
+    </div>
+  );
+}
+
+export function useSearchBarState(
+  key: string
+): [string, (value: string) => void] {
+  const filterKey = keyBuilder(key);
+  const [value, setValue] = useLocalStorage(filterKey, '', sessionStorage);
+
+  return [value, setValue];
+
+  function keyBuilder(key: string) {
+    return `datatable_text_filter_${key}`;
+  }
+}
diff --git a/app/react/components/datatables/SelectedRowsCount.tsx b/app/react/components/datatables/SelectedRowsCount.tsx
new file mode 100644
index 0000000..5028691
--- /dev/null
+++ b/app/react/components/datatables/SelectedRowsCount.tsx
@@ -0,0 +1,15 @@
+import { addPlural } from '@/react/common/string-utils';
+
+interface SelectedRowsCountProps {
+  value: number;
+  hidden: number;
+}
+
+export function SelectedRowsCount({ value, hidden }: SelectedRowsCountProps) {
+  return value !== 0 ? (
+    <div className="infoBar">
+      {addPlural(value, 'item')} selected
+      {hidden !== 0 && ` (${hidden} hidden by filters)`}
+    </div>
+  ) : null;
+}
diff --git a/app/react/components/datatables/Table.tsx b/app/react/components/datatables/Table.tsx
new file mode 100644
index 0000000..f0444aa
--- /dev/null
+++ b/app/react/components/datatables/Table.tsx
@@ -0,0 +1,66 @@
+import clsx from 'clsx';
+import { AriaAttributes, PropsWithChildren } from 'react';
+
+import { AutomationTestingProps } from '@/types';
+
+import { TableContainer } from './TableContainer';
+import { TableActions } from './TableActions';
+import { TableFooter } from './TableFooter';
+import { TableTitleActions } from './TableTitleActions';
+import { TableSettingsMenu } from './TableSettingsMenu';
+import { TableTitle } from './TableTitle';
+import { TableContent } from './TableContent';
+import { TableHeaderCell } from './TableHeaderCell';
+import { TableHeaderRow } from './TableHeaderRow';
+import { TableRow } from './TableRow';
+
+interface Props extends AutomationTestingProps, AriaAttributes {
+  className?: string;
+}
+
+function MainComponent({
+  children,
+  className,
+  ...props
+}: PropsWithChildren<Props>) {
+  return (
+    <div className="table-responsive">
+      <table
+        // eslint-disable-next-line react/jsx-props-no-spreading
+        {...props}
+        className={clsx('table-hover table-filters table', className)}
+      >
+        {children}
+      </table>
+    </div>
+  );
+}
+
+MainComponent.displayName = 'Table';
+
+interface SubComponents {
+  Container: typeof TableContainer;
+  Actions: typeof TableActions;
+  TitleActions: typeof TableTitleActions;
+  HeaderCell: typeof TableHeaderCell;
+  SettingsMenu: typeof TableSettingsMenu;
+  Title: typeof TableTitle;
+  Row: typeof TableRow;
+  HeaderRow: typeof TableHeaderRow;
+  Content: typeof TableContent;
+  Footer: typeof TableFooter;
+}
+
+export const Table: typeof MainComponent & SubComponents =
+  MainComponent as typeof MainComponent & SubComponents;
+
+Table.Actions = TableActions;
+Table.TitleActions = TableTitleActions;
+Table.Container = TableContainer;
+Table.HeaderCell = TableHeaderCell;
+Table.SettingsMenu = TableSettingsMenu;
+Table.Title = TableTitle;
+Table.Row = TableRow;
+Table.HeaderRow = TableHeaderRow;
+Table.Content = TableContent;
+Table.Footer = TableFooter;
diff --git a/app/react/components/datatables/TableActions.tsx b/app/react/components/datatables/TableActions.tsx
new file mode 100644
index 0000000..b42947e
--- /dev/null
+++ b/app/react/components/datatables/TableActions.tsx
@@ -0,0 +1,19 @@
+import clsx from 'clsx';
+import { Children, PropsWithChildren } from 'react';
+
+interface Props {
+  className?: string;
+}
+
+export function TableActions({
+  children,
+  className,
+}: PropsWithChildren<Props>) {
+  if (Children.count(children) === 0) {
+    return null;
+  }
+
+  return (
+    <div className={clsx('flex items-center gap-2', className)}>{children}</div>
+  );
+}
diff --git a/app/react/components/datatables/TableContainer.tsx b/app/react/components/datatables/TableContainer.tsx
new file mode 100644
index 0000000..83f937e
--- /dev/null
+++ b/app/react/components/datatables/TableContainer.tsx
@@ -0,0 +1,33 @@
+import { PropsWithChildren } from 'react';
+
+import { Widget, WidgetBody } from '@@/Widget';
+
+interface Props {
+  // workaround to remove the widget, ideally we should have a different component to wrap the table with a widget
+  noWidget?: boolean;
+  'aria-label'?: string;
+  id?: string;
+}
+
+export function TableContainer({
+  children,
+  noWidget = false,
+  'aria-label': ariaLabel,
+  id,
+}: PropsWithChildren<Props>) {
+  if (noWidget) {
+    return (
+      <section className="datatable" aria-label={ariaLabel}>
+        {children}
+      </section>
+    );
+  }
+
+  return (
+    <div className="datatable mx-4">
+      <Widget aria-label={ariaLabel} id={id}>
+        <WidgetBody className="no-padding">{children}</WidgetBody>
+      </Widget>
+    </div>
+  );
+}
diff --git a/app/react/components/datatables/TableContent.tsx b/app/react/components/datatables/TableContent.tsx
new file mode 100644
index 0000000..7aee09d
--- /dev/null
+++ b/app/react/components/datatables/TableContent.tsx
@@ -0,0 +1,45 @@
+import { Fragment, PropsWithChildren } from 'react';
+import { Row } from '@tanstack/react-table';
+
+import { DefaultType } from './types';
+
+interface Props<T extends DefaultType = DefaultType> {
+  isLoading?: boolean;
+  rows: Row<T>[];
+  emptyContent?: string;
+  renderRow(row: Row<T>): React.ReactNode;
+}
+
+export function TableContent<T extends DefaultType = DefaultType>({
+  isLoading = false,
+  rows,
+  emptyContent = 'No items available.',
+  renderRow,
+}: Props<T>) {
+  if (isLoading) {
+    return <TableContentOneColumn>Loading...</TableContentOneColumn>;
+  }
+
+  if (!rows.length) {
+    return <TableContentOneColumn>{emptyContent}</TableContentOneColumn>;
+  }
+
+  return (
+    <>
+      {rows.map((row, index) => (
+        <Fragment key={`${row.id}-${index}`}>{renderRow(row)}</Fragment>
+      ))}
+    </>
+  );
+}
+
+function TableContentOneColumn({ children }: PropsWithChildren<unknown>) {
+  // using MAX_SAFE_INTEGER to make sure the single column will be the size of the table
+  return (
+    <tr>
+      <td colSpan={Number.MAX_SAFE_INTEGER} className="text-muted text-center">
+        {children}
+      </td>
+    </tr>
+  );
+}
diff --git a/app/react/components/datatables/TableFooter.tsx b/app/react/components/datatables/TableFooter.tsx
new file mode 100644
index 0000000..e398e78
--- /dev/null
+++ b/app/react/components/datatables/TableFooter.tsx
@@ -0,0 +1,9 @@
+import clsx from 'clsx';
+import { PropsWithChildren } from 'react';
+
+export function TableFooter({
+  children,
+  className,
+}: PropsWithChildren<unknown> & { className?: string }) {
+  return <footer className={clsx('footer', className)}>{children}</footer>;
+}
diff --git a/app/react/components/datatables/TableHeaderCell.module.css b/app/react/components/datatables/TableHeaderCell.module.css
new file mode 100644
index 0000000..188d15e
--- /dev/null
+++ b/app/react/components/datatables/TableHeaderCell.module.css
@@ -0,0 +1,4 @@
+/* highlight the sort icons for columns that aren't actively sorting */
+.sortable:not(.sortingActive):hover path {
+  fill: var(--sort-icon-hover);
+}
diff --git a/app/react/components/datatables/TableHeaderCell.tsx b/app/react/components/datatables/TableHeaderCell.tsx
new file mode 100644
index 0000000..29d6938
--- /dev/null
+++ b/app/react/components/datatables/TableHeaderCell.tsx
@@ -0,0 +1,110 @@
+import clsx from 'clsx';
+import { CSSProperties, PropsWithChildren, ReactNode } from 'react';
+
+import { TableHeaderSortIcons } from './TableHeaderSortIcons';
+
+interface Props {
+  canSort: boolean;
+  isSorted: boolean;
+  isSortedDesc?: boolean;
+  onSortClick: (desc: boolean) => void;
+  render: () => ReactNode;
+  renderFilter?: () => ReactNode;
+  className?: string;
+  style?: CSSProperties;
+}
+
+export function TableHeaderCell({
+  canSort,
+  render,
+  onSortClick,
+  isSorted,
+  isSortedDesc = true,
+
+  renderFilter,
+  className,
+  style,
+}: Props) {
+  return (
+    <th style={style} className={className}>
+      <div className="flex h-full flex-row flex-nowrap items-center gap-1">
+        <SortWrapper
+          canSort={canSort}
+          onClick={onSortClick}
+          isSorted={isSorted}
+          isSortedDesc={isSortedDesc}
+        >
+          {render()}
+        </SortWrapper>
+        {renderFilter ? renderFilter() : null}
+      </div>
+    </th>
+  );
+}
+
+interface SortWrapperProps {
+  canSort: boolean;
+  isSorted: boolean;
+  isSortedDesc?: boolean;
+  onClick?: (desc: boolean) => void;
+}
+
+function SortWrapper({
+  canSort,
+  children,
+  onClick = () => {},
+  isSorted,
+  isSortedDesc = true,
+}: PropsWithChildren<SortWrapperProps>) {
+  if (!canSort) {
+    return <>{children}</>;
+  }
+
+  return (
+    <button
+      type="button"
+      onClick={() => onClick(!isSortedDesc)}
+      className={clsx(
+        '!ml-0 h-full border-none !bg-transparent !px-0 focus:border-none',
+        !isSorted && 'group'
+      )}
+      aria-label="Sort column"
+    >
+      <div className="flex h-full w-full flex-row items-center justify-start">
+        {children}
+        <TableHeaderSortIcons
+          sorted={isSorted}
+          descending={isSorted && !!isSortedDesc}
+        />
+      </div>
+    </button>
+  );
+}
+
+export interface TableColumnHeaderAngularProps {
+  colTitle: string;
+  canSort: boolean;
+  isSorted?: boolean;
+  isSortedDesc?: boolean;
+}
+
+export function TableColumnHeaderAngular({
+  canSort,
+  isSorted,
+  colTitle,
+  isSortedDesc = true,
+  children,
+}: PropsWithChildren<TableColumnHeaderAngularProps>) {
+  return (
+    <div className="flex h-full flex-row flex-nowrap">
+      <SortWrapper
+        canSort={canSort}
+        isSorted={!!isSorted}
+        isSortedDesc={isSortedDesc}
+      >
+        {colTitle}
+        {children}
+      </SortWrapper>
+    </div>
+  );
+}
diff --git a/app/react/components/datatables/TableHeaderRow.test.tsx b/app/react/components/datatables/TableHeaderRow.test.tsx
new file mode 100644
index 0000000..4dcb6bf
--- /dev/null
+++ b/app/react/components/datatables/TableHeaderRow.test.tsx
@@ -0,0 +1,376 @@
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { describe, it, expect, vi } from 'vitest';
+import {
+  createColumnHelper,
+  getCoreRowModel,
+  useReactTable,
+  getSortedRowModel,
+  getFilteredRowModel,
+  TableOptions,
+} from '@tanstack/react-table';
+
+import { TableHeaderRow } from './TableHeaderRow';
+import { filterHOC } from './Filter';
+
+type MockData = {
+  id: string;
+  name: string;
+  age: number;
+  status: string;
+};
+
+const columnHelper = createColumnHelper<MockData>();
+
+describe('Basic rendering', () => {
+  it('renders header row with all columns', () => {
+    const columns = [
+      columnHelper.accessor('name', {
+        id: 'name',
+        header: 'Name',
+      }),
+      columnHelper.accessor('age', {
+        id: 'age',
+        header: 'Age',
+      }),
+      columnHelper.accessor('status', {
+        id: 'status',
+        header: 'Status',
+      }),
+    ];
+
+    renderTableHeaderRow(columns);
+
+    expect(
+      screen.getByRole('columnheader', { name: /Name/ })
+    ).toBeInTheDocument();
+    expect(
+      screen.getByRole('columnheader', { name: /Age/ })
+    ).toBeInTheDocument();
+    expect(
+      screen.getByRole('columnheader', { name: /Status/ })
+    ).toBeInTheDocument();
+  });
+
+  it('renders empty header row when no headers provided', () => {
+    const { container } = render(
+      <table>
+        <thead>
+          <TableHeaderRow headers={[]} tableMeta={{}} />
+        </thead>
+      </table>
+    );
+
+    const row = container.querySelector('tr');
+    expect(row).toBeInTheDocument();
+    expect(row?.children.length).toBe(0);
+  });
+});
+
+describe('Column metadata', () => {
+  it('applies custom className from column meta', () => {
+    const columns = [
+      columnHelper.accessor('name', {
+        id: 'name',
+        header: 'Name',
+        meta: {
+          className: 'custom-header-class',
+        },
+      }),
+    ];
+
+    renderTableHeaderRow(columns);
+    const headerCell = screen.getByRole('columnheader', { name: /Name/ });
+    expect(headerCell).toHaveClass('custom-header-class');
+  });
+
+  it('applies custom width from column meta', () => {
+    const columns = [
+      columnHelper.accessor('name', {
+        id: 'name',
+        header: 'Name',
+        meta: {
+          width: '200px',
+        },
+      }),
+    ];
+
+    renderTableHeaderRow(columns);
+    const headerCell = screen.getByRole('columnheader', { name: /Name/ });
+    expect(headerCell).toHaveStyle({ width: '200px' });
+  });
+
+  it('handles missing column meta gracefully', () => {
+    const columns = [
+      columnHelper.accessor('name', {
+        id: 'name',
+        header: 'Name',
+        // no meta provided
+      }),
+    ];
+
+    renderTableHeaderRow(columns);
+    expect(screen.getByText('Name')).toBeInTheDocument();
+  });
+});
+
+describe('Sorting functionality', () => {
+  it('renders sortable columns with sort icons', () => {
+    const columns = [
+      columnHelper.accessor('name', {
+        id: 'name',
+        header: 'Name',
+        enableSorting: true,
+      }),
+    ];
+
+    renderTableHeaderRow(columns);
+    const sortButton = screen.getByRole('button', { name: /Sort column/ });
+    expect(sortButton).toBeInTheDocument();
+  });
+
+  it('calls onSortChange callback when provided', async () => {
+    const user = userEvent.setup();
+    const columns = [
+      columnHelper.accessor('name', {
+        id: 'name',
+        header: 'Name',
+        enableSorting: true,
+      }),
+    ];
+
+    const onSortChange = vi.fn();
+
+    renderTableHeaderRow(columns, onSortChange);
+    const sortButton = screen.getByRole('button', { name: /Sort column/ });
+
+    expect(sortButton).toBeInTheDocument();
+    await user.click(sortButton!);
+
+    // First click - sort descending
+    await user.click(sortButton!);
+    expect(onSortChange).toHaveBeenCalledWith('name', true);
+
+    // Second click - sort ascending
+    await user.click(sortButton!);
+    expect(onSortChange).toHaveBeenCalledWith('name', false);
+  });
+
+  it('does not render sort button for non-sortable columns', () => {
+    const columns = [
+      columnHelper.accessor('name', {
+        id: 'name',
+        header: 'Name',
+        enableSorting: false,
+        enableColumnFilter: false,
+      }),
+    ];
+
+    renderTableHeaderRow(columns);
+    const sortButton = screen.queryByRole('button', { name: /Sort column/ });
+
+    expect(sortButton).not.toBeInTheDocument();
+  });
+});
+
+describe('Filtering functionality', () => {
+  it('renders filter when column is filterable', () => {
+    const columns = [
+      columnHelper.accessor('status', {
+        id: 'status',
+        header: 'Status',
+        enableColumnFilter: true,
+        meta: {
+          filter: filterHOC('Filter by status'),
+        },
+      }),
+    ];
+
+    renderTableHeaderRow(columns);
+    expect(screen.getByText('Filter')).toBeInTheDocument();
+  });
+
+  it('does not render filter when column is not filterable', () => {
+    const columns = [
+      columnHelper.accessor('name', {
+        id: 'name',
+        header: 'Name',
+        enableColumnFilter: false,
+      }),
+    ];
+
+    renderTableHeaderRow(columns);
+    expect(screen.queryByText('Filter')).not.toBeInTheDocument();
+  });
+
+  it('uses custom filter component from meta', () => {
+    function CustomFilter() {
+      return <div>Custom Filter Component</div>;
+    }
+
+    const columns = [
+      columnHelper.accessor('status', {
+        id: 'status',
+        header: 'Status',
+        enableColumnFilter: true,
+        meta: {
+          filter: CustomFilter,
+        },
+      }),
+    ];
+
+    renderTableHeaderRow(columns);
+    expect(screen.getByText('Custom Filter Component')).toBeInTheDocument();
+  });
+
+  it('renders filter with options derived from data', async () => {
+    const user = userEvent.setup();
+    const columns = [
+      columnHelper.accessor('status', {
+        id: 'status',
+        header: 'Status',
+        enableColumnFilter: true,
+        meta: {
+          filter: filterHOC('Filter by status'),
+        },
+      }),
+    ];
+
+    renderTableHeaderRow(columns);
+
+    // Open the filter menu
+    const filterButton = screen.getByText('Filter');
+    await user.click(filterButton);
+
+    // Verify the filter options are derived from the actual data
+    // mockData has 'active' and 'inactive' statuses
+    expect(screen.getByLabelText('active')).toBeInTheDocument();
+    expect(screen.getByLabelText('inactive')).toBeInTheDocument();
+  });
+
+  it('provides filter options from table meta via custom transformer', async () => {
+    const user = userEvent.setup();
+
+    const columns = [
+      columnHelper.accessor('status', {
+        id: 'status',
+        header: 'Status',
+        enableColumnFilter: true,
+        meta: {
+          filter: filterHOC('Filter by status', () => [
+            'pending',
+            'approved',
+            'rejected',
+          ]),
+        },
+      }),
+    ];
+
+    renderTableHeaderRow(columns);
+
+    // Open the filter menu
+    const filterButton = screen.getByText('Filter');
+    await user.click(filterButton);
+
+    // Verify the custom filter options from the transformer are rendered
+    expect(screen.getByLabelText('pending')).toBeInTheDocument();
+    expect(screen.getByLabelText('approved')).toBeInTheDocument();
+    expect(screen.getByLabelText('rejected')).toBeInTheDocument();
+
+    // Verify the default data-derived options are NOT present
+    expect(screen.queryByLabelText('active')).not.toBeInTheDocument();
+    expect(screen.queryByLabelText('inactive')).not.toBeInTheDocument();
+  });
+});
+
+describe('Edge cases', () => {
+  it('handles columns with function headers', () => {
+    const columns = [
+      columnHelper.accessor('name', {
+        id: 'name',
+        header: () => <span>Dynamic Header</span>,
+      }),
+    ];
+
+    renderTableHeaderRow(columns);
+    expect(screen.getByText('Dynamic Header')).toBeInTheDocument();
+  });
+
+  it('handles columns with complex header content', () => {
+    const columns = [
+      columnHelper.accessor('name', {
+        id: 'name',
+        header: () => (
+          <div>
+            <span>Name</span>
+            <span className="badge">Required</span>
+          </div>
+        ),
+      }),
+    ];
+
+    renderTableHeaderRow(columns);
+    expect(screen.getByText('Name')).toBeInTheDocument();
+    expect(screen.getByText('Required')).toBeInTheDocument();
+  });
+
+  it('handles rapid sort clicks without errors', async () => {
+    const user = userEvent.setup();
+    const columns = [
+      columnHelper.accessor('name', {
+        id: 'name',
+        header: 'Name',
+        enableSorting: true,
+      }),
+    ];
+
+    renderTableHeaderRow(columns);
+    const sortButton = screen.getByRole('button', { name: /Sort column/ });
+
+    // Click multiple times rapidly
+    await user.click(sortButton!);
+    await user.click(sortButton!);
+    await user.click(sortButton!);
+
+    // Should not throw and component should still be rendered
+    expect(screen.getByText('Name')).toBeInTheDocument();
+  });
+});
+
+const mockData: MockData[] = [
+  { id: '1', name: 'John Doe', age: 30, status: 'active' },
+  { id: '2', name: 'Jane Smith', age: 25, status: 'inactive' },
+  { id: '3', name: 'Bob Johnson', age: 35, status: 'active' },
+];
+
+// Helper function to render TableHeaderRow with a table
+function renderTableHeaderRow(
+  columns: TableOptions<MockData>['columns'],
+  onSortChange?: (colId: string, desc: boolean) => void
+) {
+  function TestComponent() {
+    const table = useReactTable({
+      data: mockData,
+      columns,
+      getCoreRowModel: getCoreRowModel(),
+      getSortedRowModel: getSortedRowModel(),
+      getFilteredRowModel: getFilteredRowModel(),
+    });
+
+    const headerGroup = table.getHeaderGroups()[0];
+
+    return (
+      <table>
+        <thead>
+          <TableHeaderRow
+            headers={headerGroup.headers}
+            onSortChange={onSortChange}
+            tableMeta={undefined}
+          />
+        </thead>
+      </table>
+    );
+  }
+
+  return render(<TestComponent />);
+}
diff --git a/app/react/components/datatables/TableHeaderRow.tsx b/app/react/components/datatables/TableHeaderRow.tsx
new file mode 100644
index 0000000..9a046c0
--- /dev/null
+++ b/app/react/components/datatables/TableHeaderRow.tsx
@@ -0,0 +1,89 @@
+import {
+  Header,
+  flexRender,
+  TableMeta,
+  ColumnMeta,
+} from '@tanstack/react-table';
+
+import { filterHOC } from './Filter';
+import { TableHeaderCell } from './TableHeaderCell';
+import { DefaultType } from './types';
+
+interface Props<D extends DefaultType = DefaultType> {
+  headers: Header<D, unknown>[];
+  onSortChange?(colId: string, desc: boolean): void;
+  tableMeta: TableMeta<D> | undefined;
+}
+
+export function TableHeaderRow<D extends DefaultType = DefaultType>({
+  headers,
+  onSortChange,
+  tableMeta,
+}: Props<D>) {
+  return (
+    <tr>
+      {headers.map((header) => {
+        const sortDirection = header.column.getIsSorted();
+        const { className, filter, width } = parseMeta(
+          header.column.columnDef.meta
+        );
+
+        return (
+          <TableHeaderCell
+            className={className}
+            style={{
+              width,
+            }}
+            key={header.id}
+            canSort={header.column.getCanSort()}
+            onSortClick={(desc) => {
+              header.column.toggleSorting(desc);
+              if (onSortChange) {
+                onSortChange(header.id, desc);
+              }
+            }}
+            isSorted={!!sortDirection}
+            isSortedDesc={sortDirection ? sortDirection === 'desc' : false}
+            render={() =>
+              flexRender(header.column.columnDef.header, header.getContext())
+            }
+            renderFilter={
+              header.column.getCanFilter()
+                ? () =>
+                    flexRender(filter, {
+                      column: header.column,
+                      tableMeta,
+                    })
+                : undefined
+            }
+          />
+        );
+      })}
+    </tr>
+  );
+}
+
+function parseMeta<D extends DefaultType = DefaultType>(
+  meta: ColumnMeta<D, unknown> | undefined
+) {
+  if (!meta) {
+    return {
+      className: '',
+      width: undefined,
+      filter: filterHOC('Filter'),
+    };
+  }
+
+  const className =
+    'className' in meta && typeof meta.className === 'string'
+      ? meta.className
+      : undefined;
+  const width =
+    'width' in meta && typeof meta.width === 'string' ? meta.width : undefined;
+  const filter =
+    'filter' in meta && typeof meta.filter === 'function'
+      ? meta.filter
+      : filterHOC('Filter');
+
+  return { className, width, filter };
+}
diff --git a/app/react/components/datatables/TableHeaderSortIcons.module.css b/app/react/components/datatables/TableHeaderSortIcons.module.css
new file mode 100644
index 0000000..6c37f4a
--- /dev/null
+++ b/app/react/components/datatables/TableHeaderSortIcons.module.css
@@ -0,0 +1,12 @@
+.sort-icon > path {
+  fill: var(--sort-icon-muted);
+}
+
+.active-sort-icon > path {
+  fill: var(--sort-icon);
+}
+
+.sort-icon {
+  display: inline-block;
+  font-size: 12px !important;
+}
diff --git a/app/react/components/datatables/TableHeaderSortIcons.tsx b/app/react/components/datatables/TableHeaderSortIcons.tsx
new file mode 100644
index 0000000..0ce6a44
--- /dev/null
+++ b/app/react/components/datatables/TableHeaderSortIcons.tsx
@@ -0,0 +1,34 @@
+import clsx from 'clsx';
+
+import SortDownIcon from './sort-arrow-down.svg?c';
+import SortUpIcon from './sort-arrow-up.svg?c';
+import styles from './TableHeaderSortIcons.module.css';
+
+interface Props {
+  sorted: boolean;
+  descending: boolean;
+  className?: string;
+}
+
+export function TableHeaderSortIcons({ sorted, descending, className }: Props) {
+  return (
+    <div className="no-wrap w-min-max flex flex-row align-middle">
+      <SortDownIcon
+        className={clsx(
+          className,
+          sorted && !descending && styles.activeSortIcon,
+          styles.sortIcon
+        )}
+        aria-hidden="true"
+      />
+      <SortUpIcon
+        className={clsx(
+          '-ml-1', // shift closer to SortDownIcon to match the mockup
+          sorted && descending && styles.activeSortIcon,
+          styles.sortIcon
+        )}
+        aria-hidden="true"
+      />
+    </div>
+  );
+}
diff --git a/app/react/components/datatables/TableRow.tsx b/app/react/components/datatables/TableRow.tsx
new file mode 100644
index 0000000..c5f6373
--- /dev/null
+++ b/app/react/components/datatables/TableRow.tsx
@@ -0,0 +1,49 @@
+import { Cell, ColumnMeta, flexRender } from '@tanstack/react-table';
+import clsx from 'clsx';
+
+import { DefaultType } from './types';
+
+interface Props<D extends DefaultType = DefaultType> {
+  cells: Cell<D, unknown>[];
+  className?: string;
+  onClick?: () => void;
+  'aria-selected'?: boolean;
+}
+
+export function TableRow<D extends DefaultType = DefaultType>({
+  cells,
+  className,
+  onClick,
+  'aria-selected': ariaSelected,
+}: Props<D>) {
+  return (
+    <tr
+      className={clsx(className, { 'cursor-pointer': !!onClick })}
+      onClick={onClick}
+      aria-selected={ariaSelected}
+    >
+      {cells.map((cell) => {
+        const { className, width } = parseMeta(cell.column.columnDef.meta);
+        return (
+          <td key={cell.id} className={className} style={{ width }}>
+            {flexRender(cell.column.columnDef.cell, cell.getContext())}
+          </td>
+        );
+      })}
+    </tr>
+  );
+}
+
+function parseMeta<D extends DefaultType = DefaultType>(
+  meta: ColumnMeta<D, unknown> | undefined
+) {
+  const className =
+    !!meta && 'className' in meta && typeof meta.className === 'string'
+      ? meta.className
+      : '';
+  const width =
+    !!meta && 'width' in meta && typeof meta.width === 'string'
+      ? meta.width
+      : undefined;
+  return { className, width };
+}
diff --git a/app/react/components/datatables/TableSettingsMenu.tsx b/app/react/components/datatables/TableSettingsMenu.tsx
new file mode 100644
index 0000000..07e738e
--- /dev/null
+++ b/app/react/components/datatables/TableSettingsMenu.tsx
@@ -0,0 +1,48 @@
+import clsx from 'clsx';
+import { Menu, MenuButton, MenuList } from '@reach/menu-button';
+import { PropsWithChildren, ReactNode } from 'react';
+import { MoreVertical } from 'lucide-react';
+
+interface Props {
+  quickActions?: ReactNode;
+}
+
+export function TableSettingsMenu({
+  quickActions,
+  children,
+}: PropsWithChildren<Props>) {
+  return (
+    <Menu className="setting">
+      {({ isExpanded }) => (
+        <>
+          <MenuButton
+            className={clsx('table-setting-menu-btn', {
+              'setting-active': isExpanded,
+            })}
+            aria-label="Settings"
+            title="Settings"
+          >
+            <MoreVertical
+              size="13"
+              className="space-right"
+              strokeWidth="3px"
+              aria-hidden="true"
+            />
+          </MenuButton>
+          <MenuList>
+            <div className="tableMenu">
+              <div className="menuHeader">Table settings</div>
+              <div className="menuContent">{children}</div>
+              {quickActions && (
+                <div>
+                  <div className="menuHeader">Quick actions</div>
+                  <div className="menuContent">{quickActions}</div>
+                </div>
+              )}
+            </div>
+          </MenuList>
+        </>
+      )}
+    </Menu>
+  );
+}
diff --git a/app/react/components/datatables/TableSettingsMenuAutoRefresh.module.css b/app/react/components/datatables/TableSettingsMenuAutoRefresh.module.css
new file mode 100644
index 0000000..415d209
--- /dev/null
+++ b/app/react/components/datatables/TableSettingsMenuAutoRefresh.module.css
@@ -0,0 +1,9 @@
+.alert-visible {
+  opacity: 1;
+  transition: all 250ms linear;
+}
+
+.alert-hidden {
+  opacity: 0;
+  transition: all 250ms ease-out 2s;
+}
diff --git a/app/react/components/datatables/TableSettingsMenuAutoRefresh.tsx b/app/react/components/datatables/TableSettingsMenuAutoRefresh.tsx
new file mode 100644
index 0000000..a8206f5
--- /dev/null
+++ b/app/react/components/datatables/TableSettingsMenuAutoRefresh.tsx
@@ -0,0 +1,64 @@
+import clsx from 'clsx';
+import { useState } from 'react';
+import { Check } from 'lucide-react';
+
+import { Checkbox } from '@@/form-components/Checkbox';
+import { Icon } from '@@/Icon';
+
+import styles from './TableSettingsMenuAutoRefresh.module.css';
+
+interface Props {
+  onChange(value: number): void;
+  value: number;
+}
+
+export function TableSettingsMenuAutoRefresh({ onChange, value }: Props) {
+  const [isCheckVisible, setIsCheckVisible] = useState(false);
+
+  const isEnabled = value > 0;
+
+  return (
+    <>
+      <Checkbox
+        id="settings-auto-refresh"
+        data-cy="settings-auto-refresh"
+        label="Auto refresh"
+        checked={isEnabled}
+        onChange={(e) => onChange(e.target.checked ? 10 : 0)}
+      />
+
+      {isEnabled && (
+        <div>
+          <label htmlFor="settings_refresh_rate">Refresh rate</label>
+          <select
+            data-cy="settings-refresh-rate"
+            id="settings_refresh_rate"
+            className="small-select"
+            value={value}
+            onChange={(e) => handleChange(e.target.value)}
+          >
+            <option value={10}>10s</option>
+            <option value={30}>30s</option>
+            <option value={60}>1min</option>
+            <option value={120}>2min</option>
+            <option value={300}>5min</option>
+          </select>
+          <span
+            className={clsx(
+              isCheckVisible ? styles.alertVisible : styles.alertHidden,
+              styles.check
+            )}
+            onTransitionEnd={() => setIsCheckVisible(false)}
+          >
+            <Icon icon={Check} className="!ml-1" mode="success" />
+          </span>
+        </div>
+      )}
+    </>
+  );
+
+  function handleChange(value: string) {
+    onChange(Number(value));
+    setIsCheckVisible(true);
+  }
+}
diff --git a/app/react/components/datatables/TableTitle.tsx b/app/react/components/datatables/TableTitle.tsx
new file mode 100644
index 0000000..feaf529
--- /dev/null
+++ b/app/react/components/datatables/TableTitle.tsx
@@ -0,0 +1,41 @@
+import { ComponentType, PropsWithChildren, ReactNode } from 'react';
+import clsx from 'clsx';
+
+import { Icon } from '@@/Icon';
+
+interface Props {
+  icon?: ReactNode | ComponentType<unknown>;
+  label: React.ReactNode;
+  description?: ReactNode;
+  className?: string;
+  id?: string;
+}
+
+export function TableTitle({
+  icon,
+  label,
+  children,
+  description,
+  className,
+  id,
+}: PropsWithChildren<Props>) {
+  return (
+    <>
+      <div className={clsx('toolBar flex-col', className)} id={id}>
+        <div className="flex w-full items-center gap-1 p-0">
+          <h2 className="toolBarTitle m-0 text-base">
+            {icon && (
+              <div className="widget-icon">
+                <Icon icon={icon} className="space-right" />
+              </div>
+            )}
+
+            {label}
+          </h2>
+          {children}
+        </div>
+      </div>
+      {!!description && <div className="toolBar !pt-0">{description}</div>}
+    </>
+  );
+}
diff --git a/app/react/components/datatables/TableTitleActions.tsx b/app/react/components/datatables/TableTitleActions.tsx
new file mode 100644
index 0000000..710a9e1
--- /dev/null
+++ b/app/react/components/datatables/TableTitleActions.tsx
@@ -0,0 +1,9 @@
+import { Children, PropsWithChildren } from 'react';
+
+export function TableTitleActions({ children }: PropsWithChildren<unknown>) {
+  if (Children.count(children) === 0) {
+    return null;
+  }
+
+  return <div className="settings">{children}</div>;
+}
diff --git a/app/react/components/datatables/buildNameColumn.tsx b/app/react/components/datatables/buildNameColumn.tsx
new file mode 100644
index 0000000..c159b15
--- /dev/null
+++ b/app/react/components/datatables/buildNameColumn.tsx
@@ -0,0 +1,78 @@
+import { ColumnDef, CellContext } from '@tanstack/react-table';
+import { UISrefProps } from '@uirouter/react';
+
+import { Link } from '@@/Link';
+
+import { DefaultType } from './types';
+import { defaultGetRowId } from './defaultGetRowId';
+
+/**
+ * @deprecated Use `buildNameColumnFromObject` instead
+ * @todo Replace `buildNameColumnFromObject` and rename to `buildNameColumn`
+ */
+export function buildNameColumn<T extends DefaultType>(
+  nameKey: keyof T,
+  path: string,
+  dataCy: string,
+  idParam = 'id',
+  idGetter: (row: T) => string = defaultGetRowId<T>
+): ColumnDef<T> {
+  return buildNameColumnFromObject({
+    nameKey,
+    path,
+    dataCy,
+    idParam,
+    idGetter,
+  });
+}
+
+export function buildNameColumnFromObject<T extends DefaultType>({
+  nameKey,
+  path,
+  dataCy,
+  idParam = 'id',
+  idGetter = defaultGetRowId<T>,
+  linkParamsBuilder = () => ({}),
+}: {
+  nameKey: keyof T;
+  path: string;
+  dataCy: string;
+  idParam?: string;
+  idGetter?: (row: T) => string;
+  linkParamsBuilder?: (row: T) => UISrefProps['params'];
+}): ColumnDef<T> {
+  const cell = createCell();
+
+  return {
+    header: 'Name',
+    accessorKey: nameKey,
+    id: 'name',
+    cell,
+    enableSorting: true,
+    enableHiding: false,
+  };
+
+  function createCell() {
+    return function NameCell({ renderValue, row }: CellContext<T, unknown>) {
+      const name = renderValue() || '';
+
+      if (typeof name !== 'string') {
+        return null;
+      }
+
+      return (
+        <Link
+          to={path}
+          params={{
+            ...linkParamsBuilder(row.original),
+            [idParam]: idGetter(row.original),
+          }}
+          title={name}
+          data-cy={`${dataCy}_${name}`}
+        >
+          {name}
+        </Link>
+      );
+    };
+  }
+}
diff --git a/app/react/components/datatables/datatable.css b/app/react/components/datatables/datatable.css
new file mode 100644
index 0000000..b6e1733
--- /dev/null
+++ b/app/react/components/datatables/datatable.css
@@ -0,0 +1,364 @@
+.datatable .toolBar {
+  background-color: var(--bg-card-color);
+  overflow: auto;
+  padding: 20px;
+  font-size: 16px;
+  border-top-left-radius: 12px;
+  border-top-right-radius: 12px;
+
+  display: flex;
+  align-items: center;
+  gap: 5px;
+}
+
+.datatable .actionBar {
+  padding: 0;
+}
+
+.datatable .toolBar .toolBarTitle {
+  @apply items-center gap-1;
+  float: left;
+  color: var(--text-widget-header-color);
+  font-weight: 500;
+
+  flex: auto;
+  display: inline-flex;
+  flex-wrap: nowrap;
+}
+
+.datatable .toolBar .settings {
+  float: right;
+  margin-top: 5px;
+}
+
+.datatable .toolBar .setting {
+  cursor: pointer;
+  margin-right: 5px;
+}
+
+.datatable .toolBar .setting-active {
+  @apply text-blue-7;
+}
+
+.toolBar .actionBar {
+  display: inline-flex;
+}
+
+.toolBar .settings {
+  text-align: right;
+  display: inline-flex;
+}
+
+.searchBar {
+  border: 1px solid var(--border-searchbar);
+  background: var(--bg-searchbar);
+  border-radius: 5px;
+  padding: 4px 10px;
+  font-size: 14px;
+}
+
+.toolBar .searchBar {
+  margin-right: 10px;
+  display: inline-flex;
+  min-height: 30px;
+  flex-basis: 7rem;
+  flex-grow: 1;
+  flex-shrink: 1;
+  align-items: center;
+  min-width: 7rem;
+  max-width: 14rem;
+}
+
+.searchBar .searchInput {
+  background: none;
+  border: none;
+  width: 90%;
+}
+
+.searchBar .searchIcon {
+  @apply text-gray-7;
+  @apply th-dark:text-gray-warm-5;
+  margin-right: 5px;
+}
+
+.searchBar .searchInput:active,
+.searchBar .searchInput:focus {
+  outline: none;
+}
+
+.datatable .pagination-controls {
+  margin-right: 15px;
+}
+
+.datatable .table {
+  margin-bottom: 0;
+}
+
+.datatable .footer {
+  background-color: var(--bg-card-color);
+  color: var(--text-main-color);
+  overflow: auto;
+  border-top: 1px solid var(--border-datatable-top-color);
+
+  border-bottom-left-radius: 12px;
+  border-bottom-right-radius: 12px;
+  padding-bottom: 10px;
+}
+
+.datatable .footer .infoBar {
+  float: left;
+  font-size: 12px;
+  margin: 15px 0 0 10px;
+}
+
+.datatable .footer .paginationControls {
+  float: right;
+  margin: 10px 10px 5px 0;
+}
+
+.datatable .footer .paginationControls .limitSelector {
+  font-size: 12px;
+}
+
+.datatable .footer .paginationControls .pagination {
+  margin: 0;
+}
+
+.datatable .pagination > li.disabled > a,
+.datatable .pagination > li.disabled > button {
+  pointer-events: none;
+  cursor: not-allowed;
+}
+
+.datatable .pagination > li.disabled {
+  cursor: not-allowed;
+}
+
+.datatable .pagination > li > a,
+.datatable .pagination > li > button,
+.pagination > li > span {
+  user-select: none;
+  float: none;
+}
+
+.datatable.datatable-empty .table > tbody > tr > td {
+  padding: 15px 0;
+}
+
+.table > tbody > tr > td {
+  vertical-align: middle;
+}
+
+.table > tbody > tr {
+  height: 50px;
+  vertical-align: middle;
+}
+
+.datatable thead tr > th {
+  white-space: nowrap;
+  vertical-align: middle;
+}
+
+.widget .widget-body table thead th .table-filter {
+  color: #767676;
+  cursor: pointer;
+  font-size: 12px !important;
+  background: none;
+  border: none;
+  padding: 0;
+  margin: 0;
+}
+
+.widget .widget-body table thead th .filter-active {
+  color: #f0ad4e;
+  font-size: 12px !important;
+}
+
+.datatable .filterbar > th {
+  border: none;
+  font-size: 12px !important;
+  padding: 0;
+}
+
+.md-checkbox {
+  margin: 1px 0;
+  position: relative;
+}
+
+.md-checkbox label {
+  cursor: pointer;
+}
+
+.md-checkbox label:before,
+.md-checkbox label:after {
+  content: '';
+  left: 0;
+  position: absolute;
+  top: 0;
+  pointer-events: none;
+}
+
+.md-checkbox label:before {
+  background: var(--bg-main-color);
+  border: 2px solid var(--bg-checkbox-border-color);
+  border-radius: 2px;
+  cursor: pointer;
+  height: 16px;
+  transition: background 0.3s;
+  width: 16px;
+}
+
+.md-checkbox input[type='checkbox'] {
+  margin-right: 5px;
+  opacity: 0;
+  outline: 0;
+}
+
+.md-checkbox input[type='checkbox']:checked + label:before {
+  background: #337ab7;
+  border: none;
+}
+
+.md-checkbox input[type='checkbox']:disabled + label:before {
+  background: #ececec;
+  border: 2px solid #ddd;
+  cursor: auto;
+}
+
+.md-checkbox input[type='checkbox']:checked + label:after {
+  border: 2px solid #fff;
+  border-right-style: none;
+  border-top-style: none;
+  height: 4px;
+  left: 4px;
+  top: 5px;
+  transform: rotate(-45deg);
+  width: 9px;
+}
+
+.md-radio {
+  margin: 6px 0;
+}
+
+.md-radio .md-radio-inline {
+  display: inline-block;
+}
+
+.md-radio input[type='radio'] {
+  display: none;
+}
+
+.md-radio input[type='radio']:checked + label:before {
+  animation: ripple 0.2s linear forwards;
+  border-color: #337ab7;
+}
+
+.md-radio input[type='radio']:checked + label:after {
+  transform: scale(1);
+}
+
+.md-radio label {
+  cursor: pointer;
+  display: inline-block;
+  height: 16px;
+  margin-bottom: 0;
+  padding: 0 22px;
+  position: relative;
+  vertical-align: bottom;
+}
+
+.md-radio label:before,
+.md-radio label:after {
+  border-radius: 50%;
+  content: '';
+  position: absolute;
+  transition: all 0.3s ease;
+  transition-property: transform, border-color;
+}
+
+.md-radio label:before {
+  border: 2px solid black;
+  border: 2px solid rgba(0, 0, 0, 0.54);
+  height: 16px;
+  left: 0;
+  top: 0;
+  width: 16px;
+}
+
+.md-radio label:after {
+  background: #337ab7;
+  height: 8px;
+  left: 4px;
+  top: 4px;
+  transform: scale(0);
+  width: 8px;
+}
+
+.table th.selection,
+.table td.selection {
+  width: 30px;
+}
+
+.table-responsive tr > th:first-child,
+.table-responsive tr > td:first-child {
+  padding-left: 20px;
+}
+
+.table-responsive tr > th:last-child,
+.table-responsive tr > last-child {
+  padding-right: 20px;
+}
+
+.datatable .table-setting-menu-btn {
+  border: none;
+  background: none;
+}
+
+/* Multiple Tables in a row */
+.table-row-container {
+  display: flex;
+  flex-direction: row;
+  justify-content: space-between;
+  gap: 10px;
+}
+.table-in-row {
+  border: 1px solid var(--border-widget);
+  border-radius: 8px;
+  flex-grow: 2;
+}
+
+/* Databatle Setting Menu */
+
+.tableMenu {
+  border: 1px solid var(--border-bootbox);
+  border-radius: 8px;
+
+  color: var(--text-dropdown-menu-color);
+  padding: 15px;
+  background-color: var(--bg-dropdown-menu-color) !important;
+}
+
+[data-reach-menu-list],
+[data-reach-menu-items] {
+  padding: 0px;
+  border-radius: 8px;
+  border: 1px var(--bg-dropdown-menu-color);
+  background-color: var(--bg-dropdown-menu-color);
+}
+
+.dropdown-menu .tableMenu {
+  border: 0px;
+}
+
+.tableMenu .menuHeader {
+  font-size: 16px;
+}
+
+.tableMenu .menuContent {
+  font-size: 12px;
+  margin: 10px 0;
+}
+
+.tableMenu .menuContent .md-radio:first-child {
+  margin: 0;
+}
diff --git a/app/react/components/datatables/defaultGetRowId.ts b/app/react/components/datatables/defaultGetRowId.ts
new file mode 100644
index 0000000..1c2f637
--- /dev/null
+++ b/app/react/components/datatables/defaultGetRowId.ts
@@ -0,0 +1,18 @@
+import { DefaultType } from './types';
+
+/**
+ * gets row id by looking for one of id, Id, or ID keys on the object
+ */
+export function defaultGetRowId<D extends DefaultType>(row: D): string {
+  const key = ['id', 'Id', 'ID'].find((key) =>
+    Object.hasOwn(row, key)
+  ) as keyof D;
+
+  const value = row[key];
+
+  if (typeof value === 'string' || typeof value === 'number') {
+    return value.toString();
+  }
+
+  return '';
+}
diff --git a/app/react/components/datatables/editable/EditableDatatable.stories.tsx b/app/react/components/datatables/editable/EditableDatatable.stories.tsx
new file mode 100644
index 0000000..0884d54
--- /dev/null
+++ b/app/react/components/datatables/editable/EditableDatatable.stories.tsx
@@ -0,0 +1,88 @@
+import { Meta, StoryFn } from '@storybook/react-webpack5';
+import { Clock } from 'lucide-react';
+import { createColumnHelper, TableOptions } from '@tanstack/react-table';
+
+import { isEditableTableMeta } from '@@/datatables/editable/isEditableTableMeta';
+import { EditableDatatable } from '@@/datatables/editable/EditableDatatable';
+
+import { BasicTableSettings } from '../types';
+import { TableState } from '../useTableState';
+
+import { actionsColumn } from './actionsColumn';
+
+interface BasicRow {
+  id: number;
+  Name: string;
+  Created: string;
+}
+
+type Args = {
+  isLoading: boolean;
+  data: BasicRow[];
+  settings: TableState<BasicTableSettings>;
+  columns: TableOptions<BasicRow>['columns'];
+};
+
+export default {
+  component: EditableDatatable,
+  title: 'Components/Tables/EditableDatatable',
+} as Meta;
+
+function Template({ isLoading, data, settings, columns }: Args) {
+  return (
+    <EditableDatatable
+      columns={columns}
+      isLoading={isLoading}
+      dataset={data}
+      settingsManager={settings}
+      title="Edge Jobs"
+      titleIcon={Clock}
+      data-cy="edge-jobs-datatable"
+      acceptRow={() => {}}
+      revertRow={() => {}}
+    />
+  );
+}
+
+const columnHelper = createColumnHelper<BasicRow>();
+
+export const Default: StoryFn<Args> = Template.bind({});
+const editableColumns = [
+  columnHelper.accessor('Name', {
+    header: 'Name',
+    cell: ({ row: { original, index }, table }) => {
+      if (!isEditableTableMeta(table.options.meta)) {
+        return null;
+      }
+
+      const editableRowIndex = table.options.meta.getEditableRow();
+      return index === editableRowIndex ? (
+        <input type="text" name="name" value={original.Name} />
+      ) : (
+        <div>{original.Name}</div>
+      );
+    },
+  }),
+  columnHelper.accessor('Created', {
+    header: 'Created',
+  }),
+  actionsColumn<BasicRow>(() => {}),
+];
+Default.args = {
+  isLoading: false,
+  data: [
+    { id: 1, Name: 'Juan', Created: '2021-01-21' },
+    { id: 2, Name: 'Ji Hee', Created: '2023-03-01' },
+    { id: 3, Name: 'Saki', Created: '2023-08-16' },
+    { id: 4, Name: 'Eve', Created: '2017-11-06' },
+  ],
+  columns: editableColumns,
+  settings: {
+    sortBy: { id: '', desc: true },
+    setSortBy: () => {},
+    search: '',
+    setSearch: () => {},
+    pageSize: 10,
+    setPageSize: () => {},
+  },
+};
diff --git a/app/react/components/datatables/editable/EditableDatatable.tsx b/app/react/components/datatables/editable/EditableDatatable.tsx
new file mode 100644
index 0000000..b1ddcb4
--- /dev/null
+++ b/app/react/components/datatables/editable/EditableDatatable.tsx
@@ -0,0 +1,84 @@
+import { useCallback, useEffect, useRef, useState } from 'react';
+
+import { mergeOptions } from '@@/datatables/extend-options/mergeOptions';
+import { withMeta } from '@@/datatables/extend-options/withMeta';
+
+import {
+  Datatable,
+  Props as DatatableProps,
+  PaginationProps,
+} from '../Datatable';
+import { DefaultType } from '../types';
+
+export const NEW_ROW_ID = -1;
+export const UNSET_EDITABLE_ROW = -1;
+
+interface Props<D extends DefaultType> extends Omit<DatatableProps<D>, 'meta'> {
+  revertRow(rowIndex: number): void;
+  acceptRow(rowIndex: number): void;
+}
+
+export function EditableDatatable<D extends DefaultType>({
+  dataset,
+  revertRow,
+  acceptRow,
+  ...props
+}: Props<D> & PaginationProps) {
+  const [autoResetPageIndex, skipAutoResetPageIndex] = useSkipper();
+  const [data, setData] = useState(dataset);
+  const [editableRow, setEditableRow] = useState(-1);
+  const [editableRowOriginalData, setEditableRowOriginalData] = useState<
+    D | undefined
+  >();
+
+  useEffect(() => {
+    setData(dataset);
+  }, [dataset]);
+
+  return (
+    <Datatable<D>
+      // eslint-disable-next-line react/jsx-props-no-spreading
+      {...props}
+      dataset={data}
+      extendTableOptions={mergeOptions(
+        (options) => ({
+          ...options,
+          autoResetPageIndex,
+        }),
+        withMeta({
+          getEditableRow: () => editableRow,
+          getEditableRowOriginalData: () => editableRowOriginalData,
+          editRow: (rowIndex: number, row: D) => {
+            setEditableRow(rowIndex);
+            setEditableRowOriginalData(row);
+          },
+          updateRow: (rowIndex: number, value: D) => {
+            // Skip page index reset until after next rerender
+            skipAutoResetPageIndex();
+            setData((old: D[]) =>
+              old.map((row, index) => (index === rowIndex ? value : row))
+            );
+          },
+          revertRow,
+          acceptRow,
+        })
+      )}
+    />
+  );
+}
+
+function useSkipper() {
+  const shouldSkipRef = useRef(true);
+  const shouldSkip = shouldSkipRef.current;
+
+  // Wrap a function with this to skip a pagination reset temporarily
+  const skip = useCallback(() => {
+    shouldSkipRef.current = false;
+  }, []);
+
+  useEffect(() => {
+    shouldSkipRef.current = true;
+  });
+
+  return [shouldSkip, skip] as const;
+}
diff --git a/app/react/components/datatables/editable/actionsColumn.tsx b/app/react/components/datatables/editable/actionsColumn.tsx
new file mode 100644
index 0000000..5077f8c
--- /dev/null
+++ b/app/react/components/datatables/editable/actionsColumn.tsx
@@ -0,0 +1,152 @@
+import { createColumnHelper } from '@tanstack/react-table';
+import { Trash2 } from 'lucide-react';
+
+import { Button } from '@@/buttons';
+import {
+  NEW_ROW_ID,
+  UNSET_EDITABLE_ROW,
+} from '@@/datatables/editable/EditableDatatable';
+import { isEditableTableMeta } from '@@/datatables/editable/isEditableTableMeta';
+
+function defaultIsNewRow(row: unknown): boolean {
+  if (
+    !row ||
+    typeof row !== 'object' ||
+    !('Id' in row) ||
+    typeof row.Id !== 'number'
+  ) {
+    // set custom isNewRow function if object does not use `Id`
+    return false;
+  }
+  return isIdForNewRow(row.Id);
+}
+
+export function isIdForNewRow(id: number) {
+  return id <= NEW_ROW_ID;
+}
+
+export function actionsColumn<T>(
+  onRemove: (item: T) => void,
+  isNewRow: (row: T) => boolean = defaultIsNewRow
+) {
+  const columnHelper = createColumnHelper<T>();
+
+  return columnHelper.accessor(() => '', {
+    header: 'Actions',
+    id: 'actions',
+    enableSorting: false,
+    cell: ({ row: { original, index }, table }) => {
+      if (!isEditableTableMeta(table.options.meta)) {
+        throw new Error(
+          'actionsColumn() should be used within the EditableDatatable component'
+        );
+      }
+
+      const {
+        editRow,
+        updateRow,
+        getEditableRow,
+        getEditableRowOriginalData,
+        revertRow,
+        acceptRow,
+      } = table.options.meta;
+      const editableRowIndex = getEditableRow();
+
+      return index === editableRowIndex || isNewRow(original) ? (
+        <EditActionsCell
+          acceptRow={() => {
+            if (isNewRow(original)) {
+              acceptRow(index);
+            } else {
+              editRow(UNSET_EDITABLE_ROW, undefined);
+            }
+          }}
+          revertRow={() => {
+            if (isNewRow(original)) {
+              revertRow(index);
+            } else {
+              updateRow(index, getEditableRowOriginalData());
+              editRow(UNSET_EDITABLE_ROW, undefined);
+            }
+          }}
+        />
+      ) : (
+        <ActionsCell<T>
+          onRemove={onRemove}
+          editableRow={editableRowIndex}
+          editRow={editRow}
+          row={original}
+          rowIndex={index}
+        />
+      );
+    },
+  });
+}
+
+function ActionsCell<T>({
+  onRemove,
+  editRow,
+  editableRow,
+  row,
+  rowIndex,
+}: {
+  onRemove: (item: T) => void;
+  editRow: (index: number, original: T | undefined) => void;
+  editableRow: number;
+  row: T;
+  rowIndex: number;
+}) {
+  return (
+    <div className="flex justify-center gap-x-2">
+      <Button
+        color="light"
+        size="small"
+        onClick={() => {
+          editRow(rowIndex, row);
+        }}
+        disabled={editableRow !== -1}
+        data-cy="edit-access-button"
+      >
+        Edit
+      </Button>
+      <Button
+        color="dangerlight"
+        size="small"
+        icon={Trash2}
+        onClick={() => onRemove(row)}
+        data-cy="remove-access-button"
+      >
+        Remove
+      </Button>
+    </div>
+  );
+}
+
+function EditActionsCell({
+  acceptRow,
+  revertRow,
+}: {
+  acceptRow: () => void;
+  revertRow: () => void;
+}) {
+  return (
+    <div className="flex justify-center gap-x-2">
+      <Button
+        color="light"
+        size="small"
+        onClick={() => acceptRow()}
+        data-cy="edit-access-button"
+      >
+        Accept
+      </Button>
+      <Button
+        color="dangerlight"
+        size="small"
+        onClick={() => revertRow()}
+        data-cy="remove-access-button"
+      >
+        Revert
+      </Button>
+    </div>
+  );
+}
diff --git a/app/react/components/datatables/editable/isEditableTableMeta.ts b/app/react/components/datatables/editable/isEditableTableMeta.ts
new file mode 100644
index 0000000..1dd1720
--- /dev/null
+++ b/app/react/components/datatables/editable/isEditableTableMeta.ts
@@ -0,0 +1,25 @@
+import { RowData } from '@tanstack/react-table';
+
+interface EditableTableMeta<TData extends RowData> {
+  getEditableRow: () => number;
+  getEditableRowOriginalData: () => TData | undefined;
+  editRow: (rowIndex: number, row: TData | undefined) => void;
+  updateRow: (rowIndex: number, row: TData | undefined) => void;
+  revertRow: (rowIndex: number) => void;
+  acceptRow: (rowIndex: number) => void;
+}
+
+export function isEditableTableMeta<TData extends RowData>(
+  meta?: unknown
+): meta is EditableTableMeta<TData> {
+  return (
+    !!meta &&
+    typeof meta === 'object' &&
+    'getEditableRow' in meta &&
+    'getEditableRowOriginalData' in meta &&
+    'editRow' in meta &&
+    'updateRow' in meta &&
+    'revertRow' in meta &&
+    'acceptRow' in meta
+  );
+}
diff --git a/app/react/components/datatables/expand-column.tsx b/app/react/components/datatables/expand-column.tsx
new file mode 100644
index 0000000..3f09aaf
--- /dev/null
+++ b/app/react/components/datatables/expand-column.tsx
@@ -0,0 +1,43 @@
+import { ColumnDef } from '@tanstack/react-table';
+
+import { CollapseExpandButton } from '../CollapseExpandButton';
+
+import { DefaultType } from './types';
+
+export function buildExpandColumn<T extends DefaultType>(): ColumnDef<T> {
+  return {
+    id: 'expand',
+    header: ({ table }) => {
+      const hasExpandableItems = table.getCanSomeRowsExpand();
+
+      return (
+        hasExpandableItems && (
+          <CollapseExpandButton
+            isExpanded={table.getIsAllRowsExpanded()}
+            onClick={table.getToggleAllRowsExpandedHandler()}
+            data-cy="expand-all-rows-button"
+            aria-label={
+              table.getIsAllRowsExpanded()
+                ? 'Collapse all rows'
+                : 'Expand all rows'
+            }
+          />
+        )
+      );
+    },
+    cell: ({ row }) =>
+      row.getCanExpand() && (
+        <CollapseExpandButton
+          isExpanded={row.getIsExpanded()}
+          onClick={row.getToggleExpandedHandler()}
+          data-cy={`expand-row-button_${row.index}`}
+        />
+      ),
+    enableColumnFilter: false,
+    enableGlobalFilter: false,
+    enableHiding: false,
+    meta: {
+      width: 40,
+    },
+  };
+}
diff --git a/app/react/components/datatables/extend-options/mergeOptions.ts b/app/react/components/datatables/extend-options/mergeOptions.ts
new file mode 100644
index 0000000..b005ab9
--- /dev/null
+++ b/app/react/components/datatables/extend-options/mergeOptions.ts
@@ -0,0 +1,10 @@
+import { TableOptions } from '@tanstack/react-table';
+
+import { OptionsExtension } from './types';
+
+export function mergeOptions<D>(
+  ...extenders: Array<OptionsExtension<D>>
+): OptionsExtension<D> {
+  return (options: TableOptions<D>) =>
+    extenders.reduce((acc, option) => option(acc), options);
+}
diff --git a/app/react/components/datatables/extend-options/types.ts b/app/react/components/datatables/extend-options/types.ts
new file mode 100644
index 0000000..abe6761
--- /dev/null
+++ b/app/react/components/datatables/extend-options/types.ts
@@ -0,0 +1,3 @@
+import { TableOptions } from '@tanstack/react-table';
+
+export type OptionsExtension<D> = (options: TableOptions<D>) => TableOptions<D>;
diff --git a/app/react/components/datatables/extend-options/withColumnFilters.ts b/app/react/components/datatables/extend-options/withColumnFilters.ts
new file mode 100644
index 0000000..a55705b
--- /dev/null
+++ b/app/react/components/datatables/extend-options/withColumnFilters.ts
@@ -0,0 +1,29 @@
+import { ColumnFiltersState, TableOptions } from '@tanstack/react-table';
+
+import { applySetStateAction } from '@/react-tools/apply-set-state-action';
+
+import { DefaultType } from '../types';
+
+import { OptionsExtension } from './types';
+
+export function withColumnFilters<D extends DefaultType>(
+  filters: ColumnFiltersState,
+  onChange: (filters: ColumnFiltersState) => void
+): OptionsExtension<D> {
+  return function extendOptions(options: TableOptions<D>) {
+    return {
+      ...options,
+      state: {
+        ...options.state,
+        columnFilters: filters,
+      },
+      onColumnFiltersChange: (updater) => {
+        onChange(applySetStateAction(updater, filters));
+      },
+      initialState: {
+        ...options.initialState,
+        columnFilters: filters,
+      },
+    };
+  };
+}
diff --git a/app/react/components/datatables/extend-options/withControlledSelected.tsx b/app/react/components/datatables/extend-options/withControlledSelected.tsx
new file mode 100644
index 0000000..f00f5f5
--- /dev/null
+++ b/app/react/components/datatables/extend-options/withControlledSelected.tsx
@@ -0,0 +1,39 @@
+import {
+  RowSelectionState,
+  TableOptions,
+  Updater,
+} from '@tanstack/react-table';
+
+import { DefaultType } from '../types';
+
+import { OptionsExtension } from './types';
+
+export function withControlledSelected<D extends DefaultType>(
+  onChange?: (value: string[]) => void,
+  value?: string[]
+): OptionsExtension<D> {
+  return function extendTableOptions(options: TableOptions<D>) {
+    if (!onChange || !value) {
+      return options;
+    }
+
+    return {
+      ...options,
+      state: {
+        ...options.state,
+        rowSelection: Object.fromEntries(value.map((i) => [i, true])),
+      },
+      onRowSelectionChange(updater: Updater<RowSelectionState>) {
+        const newValue =
+          typeof updater !== 'function'
+            ? updater
+            : updater(Object.fromEntries(value.map((i) => [i, true])));
+        onChange(
+          Object.entries(newValue)
+            .filter(([, selected]) => selected)
+            .map(([id]) => id)
+        );
+      },
+    };
+  };
+}
diff --git a/app/react/components/datatables/extend-options/withGlobalFilter.ts b/app/react/components/datatables/extend-options/withGlobalFilter.ts
new file mode 100644
index 0000000..59d29be
--- /dev/null
+++ b/app/react/components/datatables/extend-options/withGlobalFilter.ts
@@ -0,0 +1,20 @@
+import { TableOptions } from '@tanstack/react-table';
+
+import { defaultGlobalFilterFn } from '../Datatable';
+import { DefaultType } from '../types';
+
+import { OptionsExtension } from './types';
+
+export function withGlobalFilter<
+  D extends DefaultType,
+  TFilter extends {
+    search: string;
+  },
+>(filterFn: typeof defaultGlobalFilterFn<D, TFilter>): OptionsExtension<D> {
+  return function extendOptions(options: TableOptions<D>) {
+    return {
+      ...options,
+      globalFilterFn: filterFn,
+    };
+  };
+}
diff --git a/app/react/components/datatables/extend-options/withMeta.ts b/app/react/components/datatables/extend-options/withMeta.ts
new file mode 100644
index 0000000..9434993
--- /dev/null
+++ b/app/react/components/datatables/extend-options/withMeta.ts
@@ -0,0 +1,19 @@
+import { TableOptions } from '@tanstack/react-table';
+
+import { DefaultType } from '../types';
+
+import { OptionsExtension } from './types';
+
+export function withMeta<D extends DefaultType>(
+  meta: Record<string, unknown>
+): OptionsExtension<D> {
+  return function extendOptions(options: TableOptions<D>) {
+    return {
+      ...options,
+      meta: {
+        ...options.meta,
+        ...meta,
+      },
+    };
+  };
+}
diff --git a/app/react/components/datatables/filter-types.ts b/app/react/components/datatables/filter-types.ts
new file mode 100644
index 0000000..4be2bf2
--- /dev/null
+++ b/app/react/components/datatables/filter-types.ts
@@ -0,0 +1,17 @@
+import { Row } from '@tanstack/react-table';
+
+import { DefaultType } from './types';
+
+export function multiple<D extends DefaultType = DefaultType>(
+  { getValue }: Row<D>,
+  columnId: string,
+  filterValue: string[]
+): boolean {
+  if (filterValue.length === 0) {
+    return true;
+  }
+
+  const value = getValue(columnId) as string;
+
+  return filterValue.includes(value);
+}
diff --git a/app/react/components/datatables/groupSortState.test.ts b/app/react/components/datatables/groupSortState.test.ts
new file mode 100644
index 0000000..c98a039
--- /dev/null
+++ b/app/react/components/datatables/groupSortState.test.ts
@@ -0,0 +1,207 @@
+import { describe, it, expect, vi } from 'vitest';
+
+import { buildGroupSortExtras } from './groupSortState';
+
+describe('buildGroupSortExtras — summary bar scenarios', () => {
+  it('switching to status sort clears status set via summary bar', () => {
+    // sort='name', status='error' (set via summary bar) → setSortBy('status')
+    // → status cleared (entering grouped-by-status mode resets the filter)
+    const setUrlState = vi.fn();
+    const extras = makeExtras({ sort: 'name', status: 'error' }, setUrlState);
+    extras.setSortBy('status', false);
+    expect(setUrlState).toHaveBeenCalledWith({
+      groupBy: null,
+      groupFilter: null,
+      sort: 'status',
+      order: 'asc',
+      page: 0,
+      status: null,
+    });
+  });
+
+  it('switching to a different sort preserves status set via summary bar', () => {
+    // sort='name', status='error' (set via summary bar) → setSortBy('type')
+    // → status persists (cross-dimension, type cleared, status untouched)
+    const setUrlState = vi.fn();
+    const extras = makeExtras({ sort: 'name', status: 'error' }, setUrlState);
+    extras.setSortBy('type', false);
+    expect(setUrlState).toHaveBeenCalledWith({
+      groupBy: null,
+      groupFilter: null,
+      sort: 'type',
+      order: 'asc',
+      page: 0,
+      type: null,
+    });
+  });
+});
+
+describe('buildGroupSortExtras — sort bar group scenarios', () => {
+  it('leaving status sort clears status set via sort bar group', () => {
+    // sort='status', status='error' (set via sort bar group) → setSortBy('name')
+    // → status cleared (leaving grouped-by-status mode)
+    const setUrlState = vi.fn();
+    const extras = makeExtras({ sort: 'status', status: 'error' }, setUrlState);
+    extras.setSortBy('name', false);
+    expect(setUrlState).toHaveBeenCalledWith({
+      groupBy: null,
+      groupFilter: null,
+      sort: 'name',
+      order: 'asc',
+      page: 0,
+      status: null,
+    });
+  });
+
+  it('clicking a sort bar group value sets sort and filter together', () => {
+    // sort='name' → setGroupFilter('status', 'error')
+    // → sort=status, status=error
+    const setUrlState = vi.fn();
+    const extras = makeExtras({ sort: 'name' }, setUrlState);
+    extras.setGroupFilter({ group: 'status', groupValue: 'error' });
+    expect(setUrlState).toHaveBeenCalledWith({
+      groupBy: null,
+      groupFilter: null,
+      sort: 'status',
+      order: 'asc',
+      page: 0,
+      status: 'error',
+    });
+  });
+
+  it('deselecting a sort bar group value keeps sort, clears filter, changes order', () => {
+    // sort='status', status='error' (set via sort bar group) → setGroupFilter('status', null)
+    // → sort stays status, status cleared, order toggles
+    const setUrlState = vi.fn();
+    const extras = makeExtras(
+      { sort: 'status', status: 'error', order: 'asc' },
+      setUrlState
+    );
+    extras.setGroupFilter({ group: 'status', groupValue: null });
+    expect(setUrlState).toHaveBeenCalledWith({
+      groupBy: null,
+      groupFilter: null,
+      sort: 'status',
+      order: 'desc',
+      page: 0,
+      status: null,
+    });
+  });
+});
+
+describe('buildGroupSortExtras — cross-dimension AND filter scenarios', () => {
+  it('status set via summary bar persists when switching to a different sort bar group option', () => {
+    // sort='name', status='error' (set via summary bar) → setGroupFilter('type', 'stack')
+    // → sort=type, type=stack, status=error preserved (AND filter)
+    const setUrlState = vi.fn();
+    const extras = makeExtras({ sort: 'name', status: 'error' }, setUrlState);
+    extras.setGroupFilter({ group: 'type', groupValue: 'stack' });
+    expect(setUrlState).toHaveBeenCalledWith({
+      groupBy: null,
+      groupFilter: null,
+      sort: 'type',
+      order: 'asc',
+      page: 0,
+      type: 'stack',
+    });
+  });
+
+  it('status set via summary bar persists through a second sort bar group switch, old group dimension clears', () => {
+    // sort='type', type='stack', status='error' (set via summary bar, AND filter)
+    // → setGroupFilter('platform', 'docker')
+    // → sort=platform, type cleared, status still persists
+    const setUrlState = vi.fn();
+    const extras = makeExtrasWithPlatform(
+      { sort: 'type', type: 'stack', status: 'error' },
+      setUrlState
+    );
+    extras.setGroupFilter({ group: 'platform', groupValue: 'docker' });
+    expect(setUrlState).toHaveBeenCalledWith({
+      groupBy: null,
+      groupFilter: null,
+      sort: 'platform',
+      order: 'asc',
+      page: 0,
+      platform: 'docker',
+      type: null,
+    });
+  });
+
+  it('status set via sort bar group clears when switching to a different sort bar group option', () => {
+    // sort='status', status='error' (set via sort bar group) → setGroupFilter('type', 'stack')
+    // → status cleared (was the old sort dimension)
+    const setUrlState = vi.fn();
+    const extras = makeExtras({ sort: 'status', status: 'error' }, setUrlState);
+    extras.setGroupFilter({ group: 'type', groupValue: 'stack' });
+    expect(setUrlState).toHaveBeenCalledWith({
+      sort: 'type',
+      order: 'asc',
+      page: 0,
+      type: 'stack',
+      status: null,
+      groupBy: null,
+      groupFilter: null,
+    });
+  });
+});
+
+describe('buildGroupSortExtras — override scenarios', () => {
+  it('summary bar overrides status set via sort bar group (last write wins)', () => {
+    // setStatus is handled by the view, not buildGroupSortExtras.
+    // Verify that groupFilter reflects the current URL status when sort=status.
+    const extras = makeExtras({ sort: 'status', status: 'healthy' });
+    expect(extras.groupFilter).toBe('healthy');
+  });
+
+  it('toggling sort direction preserves the active sort bar group filter', () => {
+    const setUrlState = vi.fn();
+    const extras = makeExtras({ sort: 'status', status: 'error' }, setUrlState);
+    extras.setSortBy('status', true);
+    expect(setUrlState).toHaveBeenCalledWith({
+      groupBy: null,
+      groupFilter: null,
+      sort: 'status',
+      order: 'desc',
+      page: 0,
+    });
+  });
+});
+
+function makeExtras(
+  urlState: {
+    sort: string;
+    status?: string | null;
+    type?: string | null;
+    order?: 'desc' | 'asc';
+  },
+  setUrlState = vi.fn()
+) {
+  const order = urlState.order || 'asc';
+  return buildGroupSortExtras({
+    urlState: { status: null, type: null, order, ...urlState },
+    setUrlState,
+    defaultSort: 'name',
+    sortKeys: ['name', 'status', 'type'] as const,
+    dimensions: [{ key: 'status' }, { key: 'type' }],
+  });
+}
+
+function makeExtrasWithPlatform(
+  urlState: {
+    sort: string;
+    status?: string | null;
+    type?: string | null;
+    platform?: string | null;
+    order?: 'asc' | 'desc';
+  },
+  setUrlState = vi.fn()
+) {
+  const order = urlState.order || 'asc';
+  return buildGroupSortExtras({
+    urlState: { status: null, type: null, platform: null, order, ...urlState },
+    setUrlState,
+    defaultSort: 'name',
+    sortKeys: ['name', 'status', 'type', 'platform'] as const,
+    dimensions: [{ key: 'status' }, { key: 'type' }, { key: 'platform' }],
+  });
+}
diff --git a/app/react/components/datatables/groupSortState.ts b/app/react/components/datatables/groupSortState.ts
new file mode 100644
index 0000000..b9d047c
--- /dev/null
+++ b/app/react/components/datatables/groupSortState.ts
@@ -0,0 +1,98 @@
+interface DimensionConfig {
+  key: string;
+}
+
+type UrlState = { sort: string; order: 'asc' | 'desc' } & Record<
+  string,
+  unknown
+>;
+type SetUrlState = (update: Record<string, unknown>) => void;
+
+interface GroupSortConfig {
+  urlState: UrlState;
+  setUrlState: SetUrlState;
+  defaultSort: string;
+  sortKeys: readonly string[];
+  dimensions: DimensionConfig[];
+}
+
+export function buildGroupSortExtras({
+  urlState,
+  setUrlState,
+  defaultSort,
+  sortKeys,
+  dimensions,
+}: GroupSortConfig) {
+  const sortKey = toSortKey(urlState.sort, sortKeys, defaultSort);
+
+  return {
+    groupFilter: dimensions.some((d) => d.key === sortKey)
+      ? (urlState[sortKey] as string | null)
+      : null,
+
+    setGroupFilter: ({
+      group,
+      groupValue,
+    }: {
+      group: string;
+      groupValue: string | null;
+    }) => {
+      const newKey = toSortKey(group, sortKeys, defaultSort);
+      const currentKey = toSortKey(urlState.sort, sortKeys, defaultSort);
+      const isLeavingDimension =
+        currentKey !== newKey && dimensions.some((d) => d.key === currentKey);
+      setUrlState({
+        sort: newKey,
+        order: newOrder(sortKey, newKey, urlState.order, groupValue),
+        page: 0,
+        groupBy: null,
+        groupFilter: null,
+        [newKey]: groupValue,
+        ...(isLeavingDimension ? { [currentKey]: null } : {}),
+      });
+    },
+
+    setSortBy: (id: string, desc: boolean) => {
+      const newKey = toSortKey(id ?? defaultSort, sortKeys, defaultSort);
+      const currentKey = toSortKey(urlState.sort, sortKeys, defaultSort);
+      const dimsToClear =
+        newKey !== currentKey
+          ? dimensions.filter((d) => d.key === newKey || d.key === currentKey)
+          : [];
+      setUrlState({
+        sort: newKey,
+        order: desc ? 'desc' : 'asc',
+        page: 0,
+        groupBy: null,
+        groupFilter: null,
+        ...Object.fromEntries(dimsToClear.map((d) => [d.key, null])),
+      });
+    },
+  };
+}
+
+function toSortKey(
+  sort: string,
+  sortKeys: readonly string[],
+  defaultSort: string
+): string {
+  return sortKeys.includes(sort) ? sort : defaultSort;
+}
+
+function newOrder(
+  currentSortKey: string,
+  newSortKey: string,
+  currentOrder: 'asc' | 'desc',
+  groupValue: string | null = null
+): 'asc' | 'desc' {
+  if (currentSortKey !== newSortKey) {
+    return 'asc';
+  }
+
+  // Only toggle sort order when clearing the group filter (groupValue is null)
+  if (groupValue !== null) {
+    return currentOrder;
+  }
+
+  return currentOrder === 'asc' ? 'desc' : 'asc';
+}
diff --git a/app/react/components/datatables/index.ts b/app/react/components/datatables/index.ts
new file mode 100644
index 0000000..3ab4208
--- /dev/null
+++ b/app/react/components/datatables/index.ts
@@ -0,0 +1,14 @@
+export { Datatable } from './Datatable';
+
+export { Table } from './Table';
+export { TableActions } from './TableActions';
+export { TableTitleActions } from './TableTitleActions';
+export { TableHeaderCell } from './TableHeaderCell';
+export { TableSettingsMenu } from './TableSettingsMenu';
+export { TableTitle } from './TableTitle';
+export { TableContainer } from './TableContainer';
+export { TableHeaderRow } from './TableHeaderRow';
+export { TableRow } from './TableRow';
+export { TableContent } from './TableContent';
+export { TableFooter } from './TableFooter';
+export { TableSettingsMenuAutoRefresh } from './TableSettingsMenuAutoRefresh';
diff --git a/app/react/components/datatables/select-column.tsx b/app/react/components/datatables/select-column.tsx
new file mode 100644
index 0000000..b181b0b
--- /dev/null
+++ b/app/react/components/datatables/select-column.tsx
@@ -0,0 +1,100 @@
+import { ColumnDef, Row, Table } from '@tanstack/react-table';
+
+import { Checkbox } from '@@/form-components/Checkbox';
+
+function allRowsSelected<T>(table: Table<T>) {
+  const { rows } = table.getCoreRowModel();
+  return rows.length > 0 && rows.every((row) => row.getIsSelected());
+}
+
+function someRowsSelected<T>(table: Table<T>) {
+  return table.getCoreRowModel().rows.some((row) => row.getIsSelected());
+}
+
+function somePageRowsSelected<T>(table: Table<T>) {
+  return table.getRowModel().rows.some((row) => row.getIsSelected());
+}
+
+export function createSelectColumn<T>(dataCy: string): ColumnDef<T> {
+  let lastSelectedId = '';
+
+  return {
+    id: 'select',
+    header: ({ table }) => (
+      <Checkbox
+        id="select-all"
+        data-cy={`select-all-checkbox-${dataCy}`}
+        checked={allRowsSelected(table)}
+        indeterminate={!allRowsSelected(table) && someRowsSelected(table)}
+        onChange={(e) => {
+          // Select all rows if shift key is held down, otherwise only page rows
+          if (e.nativeEvent instanceof MouseEvent && e.nativeEvent.shiftKey) {
+            table.toggleAllRowsSelected();
+            return;
+          }
+          table.toggleAllPageRowsSelected(!somePageRowsSelected(table));
+        }}
+        disabled={table.getRowModel().rows.every((row) => !row.getCanSelect())}
+        onClick={(e) => {
+          e.stopPropagation();
+        }}
+        aria-label="Select all rows"
+        title="Select all rows. Hold shift key to select across all pages."
+      />
+    ),
+    cell: ({ row, table }) => (
+      <Checkbox
+        id={`select-row-${row.id}`}
+        data-cy={`select-row-checkbox_${row.id}`}
+        checked={row.getIsSelected()}
+        indeterminate={row.getIsSomeSelected()}
+        onChange={row.getToggleSelectedHandler()}
+        disabled={!row.getCanSelect()}
+        onClick={(e) => {
+          e.stopPropagation();
+
+          if (e.shiftKey) {
+            const { rows, rowsById } = table.getRowModel();
+            const rowsToToggle = getRowRange(rows, row.id, lastSelectedId);
+            const isLastSelected = rowsById[lastSelectedId].getIsSelected();
+            rowsToToggle.forEach((row) => row.toggleSelected(isLastSelected));
+          }
+
+          lastSelectedId = row.id;
+        }}
+        aria-label="Select row"
+      />
+    ),
+    enableHiding: false,
+    meta: {
+      width: '50px',
+    },
+  };
+}
+
+function getRowRange<T>(rows: Array<Row<T>>, idA: string, idB: string) {
+  const range: Array<Row<T>> = [];
+  let foundStart = false;
+  let foundEnd = false;
+  for (let index = 0; index < rows.length; index += 1) {
+    const row = rows[index];
+    if (row.id === idA || row.id === idB) {
+      if (foundStart) {
+        foundEnd = true;
+      }
+      if (!foundStart) {
+        foundStart = true;
+      }
+    }
+
+    if (foundStart) {
+      range.push(row);
+    }
+
+    if (foundEnd) {
+      break;
+    }
+  }
+
+  return range;
+}
diff --git a/app/react/components/datatables/sort-arrow-down.svg b/app/react/components/datatables/sort-arrow-down.svg
new file mode 100644
index 0000000..0af9944
--- /dev/null
+++ b/app/react/components/datatables/sort-arrow-down.svg
@@ -0,0 +1,3 @@
+<svg width="8" height="12" viewBox="0 0 8 12" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M4.4734 0.727041C4.4734 0.399398 4.2078 0.133789 3.88015 0.133789C3.55251 0.133789 3.2869 0.399398 3.2869 0.727041H4.4734ZM3.88015 11.2737L3.47355 11.7057C3.70705 11.9255 4.07293 11.9199 4.29966 11.6931L3.88015 11.2737ZM6.93628 9.0563C7.16795 8.82464 7.16795 8.44901 6.93618 8.21734C6.70452 7.98568 6.32891 7.98568 6.09723 8.21734L6.93628 9.0563ZM1.48521 8.20479C1.24663 7.98024 0.871167 7.99161 0.646611 8.2302C0.422046 8.46878 0.433416 8.84431 0.672003 9.06886L1.48521 8.20479ZM3.2869 0.727041V11.2737H4.4734V0.727041H3.2869ZM6.09723 8.21734L3.46064 10.8542L4.29966 11.6931L6.93628 9.0563L6.09723 8.21734ZM4.28676 10.8417L1.48521 8.20479L0.672003 9.06886L3.47355 11.7057L4.28676 10.8417Z" fill="#D0D5DD"/>
+</svg>
diff --git a/app/react/components/datatables/sort-arrow-up.svg b/app/react/components/datatables/sort-arrow-up.svg
new file mode 100644
index 0000000..6b28b76
--- /dev/null
+++ b/app/react/components/datatables/sort-arrow-up.svg
@@ -0,0 +1,3 @@
+<svg width="8" height="12" viewBox="0 0 8 12" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M3.52627 11.2732C3.52627 11.6008 3.79185 11.8664 4.11952 11.8664C4.4472 11.8664 4.71278 11.6008 4.71278 11.2732H3.52627ZM4.11952 0.726556L4.5261 0.29456C4.29265 0.0747795 3.92672 0.0803264 3.7 0.307077L4.11952 0.726556ZM1.06338 2.94393C0.83172 3.17561 0.83172 3.55124 1.06348 3.7829C1.29515 4.01458 1.67078 4.01456 1.90244 3.78286L1.06338 2.94393ZM6.51448 3.79539C6.75307 4.01996 7.1285 4.00859 7.35304 3.77C7.57759 3.53141 7.56622 3.15595 7.32763 2.9314L6.51448 3.79539ZM4.71278 11.2732V0.726556H3.52627V11.2732H4.71278ZM1.90244 3.78286L4.53905 1.14602L3.7 0.307077L1.06338 2.94393L1.90244 3.78286ZM3.71295 1.15855L6.51448 3.79539L7.32763 2.9314L4.5261 0.29456L3.71295 1.15855Z" fill="#D0D5DD"/>
+</svg>
diff --git a/app/react/components/datatables/types.ts b/app/react/components/datatables/types.ts
new file mode 100644
index 0000000..6217637
--- /dev/null
+++ b/app/react/components/datatables/types.ts
@@ -0,0 +1,160 @@
+import { createStore } from 'zustand';
+import { persist } from 'zustand/middleware';
+import { ColumnFiltersState } from '@tanstack/react-table';
+
+import { keyBuilder } from '@/react/hooks/useLocalStorage';
+
+export type DefaultType = object;
+
+export type ZustandSetFunc<T> = (
+  partial: T | Partial<T> | ((state: T) => T | Partial<T>),
+  replace?: boolean | undefined
+) => void;
+
+// pagination (page size dropdown)
+// for both backend and frontend pagination
+export interface PaginationTableSettings {
+  pageSize: number;
+  setPageSize: (pageSize: number) => void;
+}
+
+export function paginationSettings<T extends PaginationTableSettings>(
+  set: ZustandSetFunc<T>
+): PaginationTableSettings {
+  return {
+    pageSize: 10,
+    setPageSize: (pageSize: number) => set((s) => ({ ...s, pageSize })),
+  };
+}
+
+// pagination (page number selector)
+// for backend pagination
+export interface BackendPaginationTableSettings {
+  page: number;
+  setPage: (page: number) => void;
+}
+
+export function backendPaginationSettings<
+  T extends BackendPaginationTableSettings,
+>(set: ZustandSetFunc<T>): BackendPaginationTableSettings {
+  return {
+    page: 0,
+    setPage: (page: number) => set((s) => ({ ...s, page })),
+  };
+}
+
+// sorting
+// arrows in datatable column headers
+export interface SortableTableSettings {
+  sortBy: { id: string; desc: boolean } | undefined;
+  setSortBy: (id: string | undefined, desc: boolean) => void;
+}
+
+export function sortableSettings<T extends SortableTableSettings>(
+  set: ZustandSetFunc<T>,
+  initialSortBy?: string | { id: string; desc: boolean }
+): SortableTableSettings {
+  return {
+    sortBy:
+      typeof initialSortBy === 'string'
+        ? { id: initialSortBy, desc: false }
+        : initialSortBy,
+    setSortBy: (id: string | undefined, desc: boolean) =>
+      set((s) => ({
+        ...s,
+        sortBy: typeof id === 'string' ? { id, desc } : id,
+      })),
+  };
+}
+
+// hidding columns
+// datatable options allowing to hide columns
+export interface SettableColumnsTableSettings {
+  hiddenColumns: string[];
+  setHiddenColumns: (hiddenColumns: string[]) => void;
+}
+
+export function hiddenColumnsSettings<T extends SettableColumnsTableSettings>(
+  set: ZustandSetFunc<T>,
+  initialHiddenColumns: string[] = []
+): SettableColumnsTableSettings {
+  return {
+    hiddenColumns: initialHiddenColumns,
+    setHiddenColumns: (hiddenColumns: string[]) =>
+      set((s) => ({ ...s, hiddenColumns })),
+  };
+}
+
+// auto refresh settings
+export interface RefreshableTableSettings {
+  autoRefreshRate: number;
+  setAutoRefreshRate: (autoRefreshRate: number) => void;
+}
+
+export function refreshableSettings<T extends RefreshableTableSettings>(
+  set: ZustandSetFunc<T>,
+  autoRefreshRate: number = 0
+): RefreshableTableSettings {
+  return {
+    autoRefreshRate,
+    setAutoRefreshRate: (autoRefreshRate: number) =>
+      set((s) => ({ ...s, autoRefreshRate })),
+  };
+}
+
+export interface FilteredColumnsTableSettings {
+  columnFilters: ColumnFiltersState;
+  setColumnFilters(columns: ColumnFiltersState): void;
+}
+
+export function filteredColumnsSettings<T extends FilteredColumnsTableSettings>(
+  set: ZustandSetFunc<T>
+): FilteredColumnsTableSettings {
+  return {
+    columnFilters: [],
+    setColumnFilters(columns) {
+      set((s) => ({ ...s, columnFilters: columns }));
+    },
+  };
+}
+
+export interface BasicTableSettings
+  extends SortableTableSettings, PaginationTableSettings {}
+
+export interface TableSettingsWithRefreshable
+  extends BasicTableSettings, RefreshableTableSettings {}
+
+export function createPersistedStore<T extends BasicTableSettings>(
+  storageKey: string,
+  initialSortBy?: string | { id: string; desc: boolean },
+  create: (set: ZustandSetFunc<T>) => Partial<T> = () => ({}) as T
+) {
+  return createStore<T>()(
+    persist(
+      (set) =>
+        ({
+          ...sortableSettings<T>(set, initialSortBy),
+          ...paginationSettings<T>(set),
+          ...create(set),
+        }) as T,
+      {
+        name: keyBuilder(`datatable_settings_${storageKey}`),
+        version: 1,
+      }
+    )
+  );
+}
+
+export function createTableStore<T extends BasicTableSettings>(
+  initialSortBy?: string | { id: string; desc: boolean },
+  create: (set: ZustandSetFunc<T>) => Partial<T> = () => ({}) as T
+) {
+  return createStore<T>()(
+    (set) =>
+      ({
+        ...sortableSettings<T>(set, initialSortBy),
+        ...paginationSettings<T>(set),
+        ...create(set),
+      }) as T
+  );
+}
diff --git a/app/react/components/datatables/useGoToHighlightedRow.ts b/app/react/components/datatables/useGoToHighlightedRow.ts
new file mode 100644
index 0000000..0c58286
--- /dev/null
+++ b/app/react/components/datatables/useGoToHighlightedRow.ts
@@ -0,0 +1,51 @@
+import _ from 'lodash';
+import { useRef, useLayoutEffect, useEffect } from 'react';
+
+export function useGoToHighlightedRow<T extends { id: string }>(
+  isServerSidePagination: boolean,
+  pageSize: number,
+  rows: Array<T>,
+  goToPage: (page: number) => void,
+  highlightedItemId?: string
+) {
+  const handlePageChangeRef = useRef(goToPage);
+  useLayoutEffect(() => {
+    handlePageChangeRef.current = goToPage;
+  });
+
+  const highlightedItemIdRef = useRef<string>();
+
+  useEffect(() => {
+    if (
+      !isServerSidePagination &&
+      highlightedItemId &&
+      highlightedItemId !== highlightedItemIdRef.current
+    ) {
+      const page = getRowPage(highlightedItemId, pageSize, rows);
+      if (page) {
+        handlePageChangeRef.current(page);
+      }
+      highlightedItemIdRef.current = highlightedItemId;
+    }
+  }, [highlightedItemId, isServerSidePagination, rows, pageSize]);
+}
+
+function getRowPage<T extends { id: string }>(
+  rowID: string,
+  pageSize: number,
+  rows: Array<T>
+) {
+  const totalRows = rows.length;
+
+  if (!rowID || pageSize > totalRows) {
+    return 0;
+  }
+
+  const paginatedData = _.chunk(rows, pageSize);
+
+  const itemPage = paginatedData.findIndex((sub) =>
+    sub.some((row) => row.id === rowID)
+  );
+
+  return itemPage;
+}
diff --git a/app/react/components/datatables/useRepeater.ts b/app/react/components/datatables/useRepeater.ts
new file mode 100644
index 0000000..03a8c46
--- /dev/null
+++ b/app/react/components/datatables/useRepeater.ts
@@ -0,0 +1,42 @@
+import { useEffect, useCallback, useState } from 'react';
+
+export function useRepeater(
+  refreshRate: number,
+  onRefresh?: () => Promise<void> | void
+) {
+  const [intervalId, setIntervalId] = useState<NodeJS.Timeout | null>(null);
+
+  const stopRepeater = useCallback(() => {
+    if (!intervalId) {
+      return;
+    }
+
+    clearInterval(intervalId);
+    setIntervalId(null);
+  }, [intervalId]);
+
+  const startRepeater = useCallback(
+    (refreshRate) => {
+      if (intervalId || !onRefresh) {
+        return;
+      }
+
+      setIntervalId(
+        setInterval(async () => {
+          await onRefresh();
+        }, refreshRate * 1000)
+      );
+    },
+    [intervalId, onRefresh]
+  );
+
+  useEffect(() => {
+    if (!refreshRate || !onRefresh) {
+      stopRepeater();
+    } else {
+      startRepeater(refreshRate);
+    }
+
+    return stopRepeater;
+  }, [refreshRate, startRepeater, stopRepeater, intervalId, onRefresh]);
+}
diff --git a/app/react/components/datatables/useTableSettings.tsx b/app/react/components/datatables/useTableSettings.tsx
new file mode 100644
index 0000000..fd76ec5
--- /dev/null
+++ b/app/react/components/datatables/useTableSettings.tsx
@@ -0,0 +1,34 @@
+import { Context, createContext, ReactNode, useContext } from 'react';
+import { StoreApi, useStore } from 'zustand';
+
+const TableSettingsContext = createContext<StoreApi<object> | null>(null);
+TableSettingsContext.displayName = 'TableSettingsContext';
+
+export function useTableSettings<T extends object>() {
+  const Context = getContextType<T>();
+
+  const context = useContext(Context);
+  if (context === null) {
+    throw new Error('must be nested under TableSettingsProvider');
+  }
+
+  return useStore(context);
+}
+
+interface ProviderProps<T extends object> {
+  children: ReactNode;
+  settings: StoreApi<T>;
+}
+
+export function TableSettingsProvider<T extends object>({
+  children,
+  settings,
+}: ProviderProps<T>) {
+  const Context = getContextType<T>();
+
+  return <Context.Provider value={settings}>{children}</Context.Provider>;
+}
+
+function getContextType<T extends object>() {
+  return TableSettingsContext as unknown as Context<StoreApi<T>>;
+}
diff --git a/app/react/components/datatables/useTableState.ts b/app/react/components/datatables/useTableState.ts
new file mode 100644
index 0000000..bd4d395
--- /dev/null
+++ b/app/react/components/datatables/useTableState.ts
@@ -0,0 +1,57 @@
+import { useMemo, useState } from 'react';
+import { useStore } from 'zustand';
+
+import { useSearchBarState } from './SearchBar';
+import { BasicTableSettings, createPersistedStore } from './types';
+
+export type TableState<TSettings extends BasicTableSettings> = TSettings & {
+  setSearch: (search: string) => void;
+  search: string;
+};
+
+export function useTableState<
+  TSettings extends BasicTableSettings = BasicTableSettings,
+>(
+  store: ReturnType<typeof createPersistedStore<TSettings>>,
+  storageKey: string
+) {
+  const settings = useStore(store);
+
+  const [search, setSearch] = useSearchBarState(storageKey);
+
+  return useMemo(
+    () => ({ ...settings, setSearch, search }),
+    [settings, search, setSearch]
+  );
+}
+
+export function useTableStateWithStorage<T extends BasicTableSettings>(
+  ...args: Parameters<typeof createPersistedStore<T>>
+) {
+  const [store] = useState(() => createPersistedStore(...args));
+  return useTableState(store, args[0]);
+}
+
+export function useTableStateWithoutStorage(
+  defaultSortKey?: string,
+  defaultSortDesc: boolean = false
+): BasicTableSettings & {
+  setSearch: (search: string) => void;
+  search: string;
+} {
+  const [search, setSearch] = useState('');
+  const [pageSize, setPageSize] = useState(10);
+  const [sortBy, setSortBy] = useState(
+    defaultSortKey ? { id: defaultSortKey, desc: defaultSortDesc } : undefined
+  );
+
+  return {
+    search,
+    setSearch,
+    pageSize,
+    setPageSize,
+    setSortBy: (id: string | undefined, desc: boolean) =>
+      setSortBy(id ? { id, desc } : undefined),
+    sortBy,
+  };
+}
diff --git a/app/react/components/datatables/useTableStateFromUrl.test.ts b/app/react/components/datatables/useTableStateFromUrl.test.ts
new file mode 100644
index 0000000..6c24f11
--- /dev/null
+++ b/app/react/components/datatables/useTableStateFromUrl.test.ts
@@ -0,0 +1,399 @@
+import { renderHook, act } from '@testing-library/react-hooks';
+import { vi, describe, it, expect, beforeEach } from 'vitest';
+
+import {
+  useTableStateFromUrl,
+  parseIntOrDefault,
+  parsePositiveIntOrNull,
+  asEnum,
+} from './useTableStateFromUrl';
+
+const mockSetState = vi.fn();
+let mockState: Record<string, unknown> = {};
+
+vi.mock('@/react/hooks/useParamState', () => ({
+  usePersistedParamsState: (
+    parse: (params: Record<string, unknown>) => Record<string, unknown>
+  ) => [parse(mockState), mockSetState] as const,
+}));
+
+function setState(partial: Record<string, unknown>) {
+  mockState = { ...defaults(), ...partial };
+}
+
+function defaults(): Record<string, unknown> {
+  return {
+    search: '',
+    sort: 'name',
+    order: 'asc',
+    groupBy: null,
+    groupFilter: null,
+    page: 0,
+    pageSize: 10,
+  };
+}
+
+describe('useTableStateFromUrl', () => {
+  beforeEach(() => {
+    mockState = defaults();
+    mockSetState.mockReset();
+  });
+
+  it('returns defaults when state is at defaults', () => {
+    const { result } = renderHook(() =>
+      useTableStateFromUrl({ localStorageKey: 'test', defaultSort: 'name' })
+    );
+
+    expect(result.current.search).toBe('');
+    expect(result.current.sortBy).toEqual({ id: 'name', desc: false });
+    expect(result.current.page).toBe(0);
+    expect(result.current.pageSize).toBe(10);
+  });
+
+  it('setSearch updates search and resets page to 0', () => {
+    const { result } = renderHook(() =>
+      useTableStateFromUrl({ localStorageKey: 'test', defaultSort: 'name' })
+    );
+
+    act(() => {
+      result.current.setSearch('hello');
+    });
+
+    expect(mockSetState).toHaveBeenCalledWith({ search: 'hello', page: 0 });
+  });
+
+  it('setSortBy updates sort and order and resets page to 0', () => {
+    const { result } = renderHook(() =>
+      useTableStateFromUrl({ localStorageKey: 'test', defaultSort: 'name' })
+    );
+
+    act(() => {
+      result.current.setSortBy('age', true);
+    });
+
+    expect(mockSetState).toHaveBeenCalledWith({
+      sort: 'age',
+      order: 'desc',
+      page: 0,
+      groupBy: null,
+      groupFilter: null,
+    });
+  });
+
+  it('setPage updates page only', () => {
+    const { result } = renderHook(() =>
+      useTableStateFromUrl({ localStorageKey: 'test', defaultSort: 'name' })
+    );
+
+    act(() => {
+      result.current.setPage(3);
+    });
+
+    expect(mockSetState).toHaveBeenCalledWith({ page: 3 });
+  });
+
+  it('setPageSize updates URL pageSize and resets page to 0', () => {
+    const { result } = renderHook(() =>
+      useTableStateFromUrl({ localStorageKey: 'test', defaultSort: 'name' })
+    );
+
+    act(() => {
+      result.current.setPageSize(25);
+    });
+
+    expect(mockSetState).toHaveBeenCalledWith({ pageSize: 25, page: 0 });
+  });
+
+  it('reflects state into the table shape', () => {
+    setState({ sort: 'age', order: 'desc', pageSize: 25, page: 2 });
+
+    const { result } = renderHook(() =>
+      useTableStateFromUrl({ localStorageKey: 'test', defaultSort: 'name' })
+    );
+
+    expect(result.current.sortBy).toEqual({ id: 'age', desc: true });
+    expect(result.current.pageSize).toBe(25);
+    expect(result.current.page).toBe(2);
+  });
+
+  it('setGroupBy updates groupBy, resets groupFilter and page', () => {
+    const { result } = renderHook(() =>
+      useTableStateFromUrl({ localStorageKey: 'test', defaultSort: 'name' })
+    );
+
+    act(() => {
+      result.current.setGroupBy('status');
+    });
+
+    expect(mockSetState).toHaveBeenCalledWith({
+      groupBy: 'status',
+      groupFilter: null,
+      page: 0,
+    });
+  });
+
+  it('setGroupBy with null clears groupBy', () => {
+    setState({ groupBy: 'status' });
+
+    const { result } = renderHook(() =>
+      useTableStateFromUrl({ localStorageKey: 'test', defaultSort: 'name' })
+    );
+
+    act(() => {
+      result.current.setGroupBy(null);
+    });
+
+    expect(mockSetState).toHaveBeenCalledWith({
+      groupBy: null,
+      groupFilter: null,
+      page: 0,
+    });
+  });
+
+  it('setGroupFilter with a new group sets asc order', () => {
+    setState({ groupBy: null, order: 'asc' });
+
+    const { result } = renderHook(() =>
+      useTableStateFromUrl({ localStorageKey: 'test', defaultSort: 'name' })
+    );
+
+    act(() => {
+      result.current.setGroupFilter({ group: 'status', groupValue: 'healthy' });
+    });
+
+    expect(mockSetState).toHaveBeenCalledWith({
+      sort: 'status',
+      order: 'asc',
+      groupBy: 'status',
+      groupFilter: 'healthy',
+      page: 0,
+    });
+  });
+
+  it('setGroupFilter with same group and asc order toggles to desc', () => {
+    setState({ groupBy: 'status', order: 'asc' });
+
+    const { result } = renderHook(() =>
+      useTableStateFromUrl({ localStorageKey: 'test', defaultSort: 'name' })
+    );
+
+    act(() => {
+      result.current.setGroupFilter({ group: 'status', groupValue: 'healthy' });
+    });
+
+    expect(mockSetState).toHaveBeenCalledWith({
+      sort: 'status',
+      order: 'desc',
+      groupBy: 'status',
+      groupFilter: 'healthy',
+      page: 0,
+    });
+  });
+
+  it('setGroupFilter with same group and desc order toggles to asc', () => {
+    setState({ groupBy: 'status', order: 'desc' });
+
+    const { result } = renderHook(() =>
+      useTableStateFromUrl({ localStorageKey: 'test', defaultSort: 'name' })
+    );
+
+    act(() => {
+      result.current.setGroupFilter({ group: 'status', groupValue: null });
+    });
+
+    expect(mockSetState).toHaveBeenCalledWith({
+      sort: 'status',
+      order: 'asc',
+      groupBy: 'status',
+      groupFilter: null,
+      page: 0,
+    });
+  });
+
+  it('buildExtra result is merged into returned state', () => {
+    setState({ sort: 'age' });
+
+    const { result } = renderHook(() =>
+      useTableStateFromUrl({
+        localStorageKey: 'test',
+        defaultSort: 'name',
+        buildExtra: (urlState) => ({ computed: urlState.sort }),
+      })
+    );
+
+    expect(
+      (result.current as unknown as Record<string, unknown>).computed
+    ).toBe('age');
+  });
+
+  it('parseExtra result is merged into urlState', () => {
+    const { result } = renderHook(() =>
+      useTableStateFromUrl({
+        localStorageKey: 'test',
+        defaultSort: 'name',
+        parseExtra: (params) => ({ tag: (params.tag as string) ?? 'default' }),
+        buildExtra: (urlState) => ({
+          tag: (urlState as Record<string, unknown>).tag,
+        }),
+      })
+    );
+
+    expect((result.current as unknown as Record<string, unknown>).tag).toBe(
+      'default'
+    );
+  });
+
+  it('uses defaultGroupBy when groupBy is absent from params', () => {
+    mockState = { ...defaults(), groupBy: undefined };
+
+    const { result } = renderHook(() =>
+      useTableStateFromUrl({
+        localStorageKey: 'test',
+        defaultSort: 'name',
+        defaultGroupBy: 'type',
+      })
+    );
+
+    expect(result.current.groupBy).toBe('type');
+  });
+
+  it('defaults groupFilter to null when absent from params', () => {
+    mockState = { ...defaults(), groupFilter: undefined };
+
+    const { result } = renderHook(() =>
+      useTableStateFromUrl({ localStorageKey: 'test', defaultSort: 'name' })
+    );
+
+    expect(result.current.groupFilter).toBeNull();
+  });
+
+  it('defaults order to asc for an unrecognised value', () => {
+    mockState = { ...defaults(), order: 'sideways' };
+
+    const { result } = renderHook(() =>
+      useTableStateFromUrl({ localStorageKey: 'test', defaultSort: 'name' })
+    );
+
+    expect(result.current.sortBy?.desc).toBe(false);
+  });
+
+  it('defaults pageSize to 10 for a non-positive value', () => {
+    mockState = { ...defaults(), pageSize: 0 };
+
+    const { result } = renderHook(() =>
+      useTableStateFromUrl({ localStorageKey: 'test', defaultSort: 'name' })
+    );
+
+    expect(result.current.pageSize).toBe(10);
+  });
+
+  it('parses pageSize from a string when coming from URL', () => {
+    mockState = { ...defaults(), pageSize: '25' };
+
+    const { result } = renderHook(() =>
+      useTableStateFromUrl({ localStorageKey: 'test', defaultSort: 'name' })
+    );
+
+    expect(result.current.pageSize).toBe(25);
+  });
+
+  it('defaults groupBy to null when absent and no defaultGroupBy provided', () => {
+    mockState = { ...defaults(), groupBy: undefined };
+
+    const { result } = renderHook(() =>
+      useTableStateFromUrl({ localStorageKey: 'test', defaultSort: 'name' })
+    );
+
+    expect(result.current.groupBy).toBeNull();
+  });
+
+  it('defaults search to empty string when absent from params', () => {
+    mockState = { ...defaults(), search: undefined };
+
+    const { result } = renderHook(() =>
+      useTableStateFromUrl({ localStorageKey: 'test', defaultSort: 'name' })
+    );
+
+    expect(result.current.search).toBe('');
+  });
+
+  it('defaults sort to defaultSort when absent from params', () => {
+    mockState = { ...defaults(), sort: undefined };
+
+    const { result } = renderHook(() =>
+      useTableStateFromUrl({ localStorageKey: 'test', defaultSort: 'custom' })
+    );
+
+    expect(result.current.sortBy?.id).toBe('custom');
+  });
+
+  it('setSortBy with null id falls back to defaultSort', () => {
+    const { result } = renderHook(() =>
+      useTableStateFromUrl({ localStorageKey: 'test', defaultSort: 'name' })
+    );
+
+    act(() => {
+      result.current.setSortBy(undefined, false);
+    });
+
+    expect(mockSetState).toHaveBeenCalledWith(
+      expect.objectContaining({ sort: 'name', order: 'asc' })
+    );
+  });
+});
+
+describe('parseIntOrDefault', () => {
+  it('parses a valid integer string', () => {
+    expect(parseIntOrDefault('42', 0)).toBe(42);
+  });
+
+  it('returns fallback for undefined', () => {
+    expect(parseIntOrDefault(undefined, 99)).toBe(99);
+  });
+
+  it('returns fallback for empty string', () => {
+    expect(parseIntOrDefault('', 5)).toBe(5);
+  });
+
+  it('returns fallback for non-numeric string', () => {
+    expect(parseIntOrDefault('abc', 0)).toBe(0);
+  });
+});
+
+describe('parsePositiveIntOrNull', () => {
+  it('parses a positive integer string', () => {
+    expect(parsePositiveIntOrNull('10')).toBe(10);
+  });
+
+  it('returns null for zero', () => {
+    expect(parsePositiveIntOrNull('0')).toBeNull();
+  });
+
+  it('returns null for a negative number', () => {
+    expect(parsePositiveIntOrNull('-5')).toBeNull();
+  });
+
+  it('returns null for undefined', () => {
+    expect(parsePositiveIntOrNull(undefined)).toBeNull();
+  });
+});
+
+describe('asEnum', () => {
+  const ALLOWED = new Set(['asc', 'desc'] as const);
+
+  it('returns the value when it is in the allowed set', () => {
+    expect(asEnum('asc', ALLOWED)).toBe('asc');
+  });
+
+  it('returns null when the value is not in the allowed set', () => {
+    expect(asEnum('invalid', ALLOWED)).toBeNull();
+  });
+
+  it('returns null for undefined', () => {
+    expect(asEnum(undefined, ALLOWED)).toBeNull();
+  });
+
+  it('returns null for null', () => {
+    expect(asEnum(null, ALLOWED)).toBeNull();
+  });
+});
diff --git a/app/react/components/datatables/useTableStateFromUrl.ts b/app/react/components/datatables/useTableStateFromUrl.ts
new file mode 100644
index 0000000..c9c4b10
--- /dev/null
+++ b/app/react/components/datatables/useTableStateFromUrl.ts
@@ -0,0 +1,171 @@
+import { usePersistedParamsState } from '@/react/hooks/useParamState';
+
+import { BasicTableSettings } from './types';
+
+type CoreUrlState = {
+  search: string;
+  sort: string;
+  order: 'asc' | 'desc';
+  groupBy: string | null;
+  groupFilter: string | null;
+  page: number;
+  pageSize: number;
+};
+
+type Extra = {
+  search: string;
+  setSearch(value: string): void;
+  page: number;
+  setPage(page: number): void;
+  groupBy: string | null;
+  setGroupBy(group: string | null): void;
+  groupFilter: string | null;
+  setGroupFilter(value: { group: string; groupValue: string | null }): void;
+};
+
+export function useTableStateFromUrl<
+  TParsed extends Record<string, unknown> = Record<never, never>,
+  TExtra extends Record<string, unknown> = Record<never, never>,
+>({
+  localStorageKey,
+  defaultSort = 'name',
+  defaultGroupBy,
+  persistedExtraKeys,
+  parseExtra,
+  buildExtra,
+}: {
+  localStorageKey: string;
+  defaultSort?: string;
+  defaultGroupBy?: string;
+  persistedExtraKeys?: string[];
+  parseExtra?: (params: Record<string, unknown>) => TParsed;
+  buildExtra?: (
+    urlState: CoreUrlState & TParsed,
+    setUrlState: (s: Partial<CoreUrlState & TParsed>) => void
+  ) => TExtra;
+}): BasicTableSettings & TExtra & Extra {
+  const persistedKeys = [
+    'sort',
+    'order',
+    'groupBy',
+    'groupFilter',
+    'pageSize',
+    ...(persistedExtraKeys ?? []),
+  ];
+
+  const [urlState, setUrlState] = usePersistedParamsState<
+    CoreUrlState & TParsed
+  >(
+    (params) => ({
+      search: typeof params.search === 'string' ? params.search : '',
+      sort: typeof params.sort === 'string' ? params.sort : defaultSort,
+      order:
+        parseOrder(
+          typeof params.order === 'string' ? params.order : undefined
+        ) ?? 'asc',
+      groupBy:
+        params.groupBy !== undefined
+          ? (params.groupBy as string | null)
+          : (defaultGroupBy ?? null),
+      groupFilter:
+        params.groupFilter !== undefined
+          ? (params.groupFilter as string | null)
+          : null,
+      page: Math.max(
+        0,
+        typeof params.page === 'number'
+          ? params.page
+          : parseIntOrDefault(
+              typeof params.page === 'string' ? params.page : undefined,
+              0
+            )
+      ),
+      pageSize: parsePositiveIntOrNull(params.pageSize) ?? 10,
+      ...(parseExtra ? parseExtra(params) : ({} as TParsed)),
+    }),
+    {
+      storageKey: `datatable_${localStorageKey}_state`,
+      persistedKeys,
+    }
+  );
+
+  const extra = buildExtra ? buildExtra(urlState, setUrlState) : ({} as TExtra);
+
+  return {
+    search: urlState.search,
+    setSearch: (search: string) => setCoreState({ search, page: 0 }),
+
+    sortBy: { id: urlState.sort, desc: urlState.order === 'desc' },
+    setSortBy: (id, desc) =>
+      setCoreState({
+        sort: id ?? defaultSort,
+        groupBy: null,
+        groupFilter: null,
+        order: desc ? 'desc' : 'asc',
+        page: 0,
+      }),
+
+    groupBy: urlState.groupBy,
+    setGroupBy: (group) =>
+      setCoreState({
+        groupBy: group,
+        groupFilter: null,
+        page: 0,
+      }),
+
+    groupFilter: urlState.groupFilter,
+    setGroupFilter: ({
+      group,
+      groupValue,
+    }: {
+      group: string;
+      groupValue: string | null;
+    }) => {
+      const isSameGroup = urlState.groupBy === group;
+      setCoreState({
+        sort: group,
+        order: isSameGroup && urlState.order === 'asc' ? 'desc' : 'asc',
+        groupBy: group,
+        groupFilter: groupValue,
+        page: 0,
+      });
+    },
+
+    page: urlState.page,
+    setPage: (page) => setCoreState({ page }),
+
+    pageSize: urlState.pageSize,
+    setPageSize: (size) => {
+      setCoreState({ pageSize: size, page: 0 });
+    },
+
+    ...extra,
+  } satisfies BasicTableSettings & TExtra & Extra;
+
+  function setCoreState(partial: Partial<CoreUrlState>) {
+    setUrlState(partial as Partial<CoreUrlState & TParsed>);
+  }
+}
+
+export function parseIntOrDefault<T>(
+  raw: string | undefined,
+  fallback: T
+): number | T {
+  if (!raw) return fallback;
+  const n = parseInt(raw, 10);
+  return Number.isFinite(n) ? n : fallback;
+}
+
+export function parsePositiveIntOrNull(raw: unknown): number | null {
+  if (typeof raw === 'number') return raw > 0 ? Math.floor(raw) : null;
+  const n = parseIntOrDefault(typeof raw === 'string' ? raw : undefined, null);
+  return n !== null && n > 0 ? n : null;
+}
+
+export function asEnum<T>(value: unknown, allowed: Set<T>): T | null {
+  return allowed.has(value as T) ? (value as T) : null;
+}
+
+function parseOrder(raw: string | undefined): 'asc' | 'desc' | null {
+  return raw === 'asc' || raw === 'desc' ? raw : null;
+}
diff --git a/app/react/components/form-components/AutocompleteSelect/AutocompleteSelect.module.css b/app/react/components/form-components/AutocompleteSelect/AutocompleteSelect.module.css
new file mode 100644
index 0000000..262a8aa
--- /dev/null
+++ b/app/react/components/form-components/AutocompleteSelect/AutocompleteSelect.module.css
@@ -0,0 +1,19 @@
+.root [data-reach-combobox-popover] {
+  border-radius: 5px;
+  border: 1px solid var(--border-form-control-color);
+  background-color: var(--bg-dropdown-menu-color);
+  color: var(--text-form-control-color);
+  z-index: 9999;
+}
+
+.root [data-reach-combobox-option]:hover {
+  background-color: var(--bg-dropdown-hover);
+}
+
+.root [data-suggested-value] {
+  font-weight: normal;
+}
+
+.root [data-user-value] {
+  font-weight: bold;
+}
diff --git a/app/react/components/form-components/AutocompleteSelect/AutocompleteSelect.tsx b/app/react/components/form-components/AutocompleteSelect/AutocompleteSelect.tsx
new file mode 100644
index 0000000..5d3ab6d
--- /dev/null
+++ b/app/react/components/form-components/AutocompleteSelect/AutocompleteSelect.tsx
@@ -0,0 +1,89 @@
+import '@reach/combobox/styles.css';
+
+import { useState, ChangeEvent } from 'react';
+import {
+  Combobox,
+  ComboboxInput,
+  ComboboxList,
+  ComboboxOption,
+  ComboboxPopover,
+} from '@reach/combobox';
+import clsx from 'clsx';
+
+import { useDebounce } from '@/react/hooks/useDebounce';
+import { AutomationTestingProps } from '@/types';
+
+import { Option } from '@@/form-components/PortainerSelect';
+
+import styles from './AutocompleteSelect.module.css';
+
+export function AutocompleteSelect({
+  value,
+  onChange,
+  placeholder,
+  searchResults,
+  readOnly,
+  inputId,
+  'data-cy': dataCy,
+}: {
+  value: string;
+  /**
+   * onChange is called whenever the input is changed or an option is selected
+   *
+   * when the input is changed, the call is debounced
+   */
+  onChange(value: string): void;
+  placeholder?: string;
+  searchResults?: Option<string>[];
+  readOnly?: boolean;
+  inputId: string;
+} & AutomationTestingProps) {
+  const [searchTerm, setSearchTerm] = useDebounce(value, onChange);
+  const [selected, setSelected] = useState(false);
+
+  return (
+    <Combobox
+      className={clsx(styles.root, 'form-control')}
+      onSelect={onSelect}
+      data-cy="component-gitComposeInput"
+    >
+      <ComboboxInput
+        value={searchTerm}
+        className="w-full border-none bg-transparent outline-none"
+        onChange={handleChange}
+        placeholder={placeholder}
+        readOnly={readOnly}
+        id={inputId}
+        autoComplete="off"
+        data-cy={dataCy}
+      />
+      {!selected && searchResults && searchResults.length > 0 && (
+        <ComboboxPopover>
+          <ComboboxList>
+            {searchResults.map((option: Option<string>) => (
+              <ComboboxOption
+                key={option.value}
+                value={option.value}
+                className={clsx(
+                  `[&[aria-selected="true"]]:th-highcontrast:!bg-black [&[aria-selected="true"]]:th-dark:!bg-black`,
+                  `hover:th-highcontrast:!bg-black hover:th-dark:!bg-black`,
+                  'th-highcontrast:bg-gray-10 th-dark:bg-gray-10'
+                )}
+              />
+            ))}
+          </ComboboxList>
+        </ComboboxPopover>
+      )}
+    </Combobox>
+  );
+
+  function handleChange(e: ChangeEvent<HTMLInputElement>) {
+    setSearchTerm(e.target.value);
+    setSelected(false);
+  }
+
+  function onSelect(value: string) {
+    onChange(value);
+    setSelected(true);
+  }
+}
diff --git a/app/react/components/form-components/AutocompleteSelect/index.ts b/app/react/components/form-components/AutocompleteSelect/index.ts
new file mode 100644
index 0000000..e0c18f8
--- /dev/null
+++ b/app/react/components/form-components/AutocompleteSelect/index.ts
@@ -0,0 +1 @@
+export { AutocompleteSelect } from './AutocompleteSelect';
diff --git a/app/react/components/form-components/ButtonSelector/ButtonSelector.module.css b/app/react/components/form-components/ButtonSelector/ButtonSelector.module.css
new file mode 100644
index 0000000..c5cf575
--- /dev/null
+++ b/app/react/components/form-components/ButtonSelector/ButtonSelector.module.css
@@ -0,0 +1,10 @@
+.group input {
+  display: none;
+}
+
+.group input:checked + label {
+  color: #fff;
+  background-color: #286090;
+  background-image: none;
+  border-color: #204d74;
+}
diff --git a/app/react/components/form-components/ButtonSelector/ButtonSelector.stories.tsx b/app/react/components/form-components/ButtonSelector/ButtonSelector.stories.tsx
new file mode 100644
index 0000000..bb3c6e9
--- /dev/null
+++ b/app/react/components/form-components/ButtonSelector/ButtonSelector.stories.tsx
@@ -0,0 +1,31 @@
+import { Meta } from '@storybook/react-webpack5';
+import { useState } from 'react';
+
+import { ButtonSelector, Option } from './ButtonSelector';
+
+export default {
+  component: ButtonSelector,
+  title: 'Components/ButtonSelector',
+} as Meta;
+
+export { TwoOptionsSelector };
+
+function TwoOptionsSelector() {
+  const options: Option<string>[] = [
+    { value: 'sAMAccountName', label: 'username' },
+    { value: 'userPrincipalName', label: 'user@domainname' },
+  ];
+
+  const [value, setValue] = useState('sAMAccountName');
+  return (
+    <ButtonSelector<string>
+      onChange={handleChange}
+      value={value}
+      options={options}
+    />
+  );
+
+  function handleChange(value: string) {
+    setValue(value);
+  }
+}
diff --git a/app/react/components/form-components/ButtonSelector/ButtonSelector.tsx b/app/react/components/form-components/ButtonSelector/ButtonSelector.tsx
new file mode 100644
index 0000000..3974fd8
--- /dev/null
+++ b/app/react/components/form-components/ButtonSelector/ButtonSelector.tsx
@@ -0,0 +1,104 @@
+import clsx from 'clsx';
+import { ComponentProps, PropsWithChildren, ReactNode } from 'react';
+
+import { AutomationTestingProps } from '@/types';
+
+import { ButtonGroup, Size } from '@@/buttons/ButtonGroup';
+import { Button } from '@@/buttons';
+
+import styles from './ButtonSelector.module.css';
+
+export interface Option<T> {
+  value: T;
+  label?: ReactNode;
+  disabled?: boolean;
+  icon?: ComponentProps<typeof Button>['icon'];
+}
+
+interface Props<T> {
+  value: T;
+  onChange(value: T): void;
+  options: Option<T>[];
+  size?: Size;
+  disabled?: boolean;
+  readOnly?: boolean;
+  className?: string;
+  'aria-label'?: string;
+}
+
+export function ButtonSelector<T extends string | number | boolean>({
+  value,
+  onChange,
+  size,
+  options,
+  disabled,
+  readOnly,
+  className,
+  'aria-label': ariaLabel,
+}: Props<T>) {
+  return (
+    <ButtonGroup
+      size={size}
+      className={clsx(styles.group, className)}
+      aria-label={ariaLabel}
+    >
+      {options.map((option) => (
+        <OptionItem
+          key={option.value.toString()}
+          data-cy={`button-selector-option-${option.value}`}
+          selected={value === option.value}
+          onChange={() => onChange(option.value)}
+          disabled={disabled || option.disabled}
+          readOnly={readOnly}
+          icon={option.icon}
+        >
+          {option.label || option.value.toString()}
+        </OptionItem>
+      ))}
+    </ButtonGroup>
+  );
+}
+
+interface OptionItemProps {
+  selected: boolean;
+  onChange(): void;
+  disabled?: boolean;
+  readOnly?: boolean;
+  icon?: ComponentProps<typeof Button>['icon'];
+}
+
+function OptionItem({
+  selected,
+  children,
+  onChange,
+  disabled,
+  readOnly,
+  'data-cy': dataCy,
+  icon,
+}: PropsWithChildren<OptionItemProps> & AutomationTestingProps) {
+  return (
+    <Button
+      color="light"
+      as="label"
+      disabled={disabled || readOnly}
+      className={clsx(
+        {
+          active: selected,
+        },
+        '!static !z-auto'
+      )}
+      data-cy={dataCy}
+      icon={icon}
+    >
+      {children}
+      <input
+        type="radio"
+        data-cy={`${dataCy}-radio-input`}
+        checked={selected}
+        onChange={onChange}
+        disabled={disabled}
+        readOnly={readOnly}
+      />
+    </Button>
+  );
+}
diff --git a/app/react/components/form-components/Checkbox.tsx b/app/react/components/form-components/Checkbox.tsx
new file mode 100644
index 0000000..85c519d
--- /dev/null
+++ b/app/react/components/form-components/Checkbox.tsx
@@ -0,0 +1,77 @@
+import clsx from 'clsx';
+import {
+  forwardRef,
+  useRef,
+  useEffect,
+  MutableRefObject,
+  ChangeEventHandler,
+  HTMLProps,
+} from 'react';
+
+interface Props extends HTMLProps<HTMLInputElement> {
+  checked?: boolean;
+  indeterminate?: boolean;
+  title?: string;
+  label?: string;
+  id?: string;
+  className?: string;
+  role?: string;
+  onChange?: ChangeEventHandler<HTMLInputElement>;
+  bold?: boolean;
+  'data-cy': string;
+}
+
+export const Checkbox = forwardRef<HTMLInputElement, Props>(
+  (
+    {
+      indeterminate,
+      title,
+      label,
+      id,
+      checked,
+      onChange,
+      bold = true,
+      'data-cy': dataCy,
+      ...props
+    }: Props,
+    ref
+  ) => {
+    const defaultRef = useRef<HTMLInputElement>(null);
+    let resolvedRef = ref as MutableRefObject<HTMLInputElement | null>;
+    if (!ref) {
+      resolvedRef = defaultRef;
+    }
+
+    // Need to check this on every render as the browser will always set the element's
+    // indeterminate state to false when the checkbox is clicked, even if the indeterminate prop hasn't changed
+    useEffect(() => {
+      if (resolvedRef === null || resolvedRef.current === null) {
+        return;
+      }
+
+      if (typeof indeterminate !== 'undefined') {
+        resolvedRef.current.indeterminate = indeterminate;
+      }
+    });
+
+    return (
+      <div className="md-checkbox flex items-center" title={title || label}>
+        <input
+          id={id}
+          type="checkbox"
+          ref={resolvedRef}
+          onChange={onChange}
+          checked={checked}
+          data-cy={dataCy}
+          // eslint-disable-next-line react/jsx-props-no-spreading
+          {...props}
+        />
+        <label htmlFor={id} className={clsx('m-0', { '!font-normal': !bold })}>
+          {label}
+        </label>
+      </div>
+    );
+  }
+);
+
+Checkbox.displayName = 'Checkbox';
diff --git a/app/react/components/form-components/ColorPicker/ColorPicker.stories.tsx b/app/react/components/form-components/ColorPicker/ColorPicker.stories.tsx
new file mode 100644
index 0000000..f571cd2
--- /dev/null
+++ b/app/react/components/form-components/ColorPicker/ColorPicker.stories.tsx
@@ -0,0 +1,21 @@
+import { Meta } from '@storybook/react-webpack5';
+import { useState } from 'react';
+
+import { ColorPicker } from './ColorPicker';
+
+export default {
+  component: ColorPicker,
+  title: 'Components/Forms/ColorPicker',
+} as Meta;
+
+export function Default() {
+  const [value, setValue] = useState('#3c8dbc');
+  return (
+    <ColorPicker
+      value={value}
+      onChange={setValue}
+      id="story-color-picker"
+      data-cy="story-color-picker"
+    />
+  );
+}
diff --git a/app/react/components/form-components/ColorPicker/ColorPicker.test.tsx b/app/react/components/form-components/ColorPicker/ColorPicker.test.tsx
new file mode 100644
index 0000000..926d241
--- /dev/null
+++ b/app/react/components/form-components/ColorPicker/ColorPicker.test.tsx
@@ -0,0 +1,67 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { describe, expect, it, vi } from 'vitest';
+
+import { ColorPicker } from './ColorPicker';
+
+describe('ColorPicker', () => {
+  it('renders with initial value and shows text input', () => {
+    render(
+      <ColorPicker value="#3c8dbc" onChange={() => {}} data-cy="color-picker" />
+    );
+
+    expect(screen.getByPlaceholderText('e.g. #ffbbbb')).toBeVisible();
+    expect(screen.getByPlaceholderText('e.g. #ffbbbb')).toHaveValue('#3c8dbc');
+    expect(screen.getByLabelText('Choose color')).toBeVisible();
+  });
+
+  it('calls onChange when user enters valid hex in text input', async () => {
+    const user = userEvent.setup();
+    const onChange = vi.fn();
+
+    render(
+      <ColorPicker value="#000000" onChange={onChange} data-cy="color-picker" />
+    );
+
+    const input = screen.getByPlaceholderText('e.g. #ffbbbb');
+    await user.clear(input);
+    await user.type(input, 'ff5500');
+
+    await waitFor(() => {
+      expect(onChange).toHaveBeenCalledWith('#ff5500');
+    });
+  });
+
+  it('calls onChange with expanded hex when user enters 3-digit shorthand', async () => {
+    const user = userEvent.setup();
+    const onChange = vi.fn();
+
+    render(
+      <ColorPicker value="#000000" onChange={onChange} data-cy="color-picker" />
+    );
+
+    const input = screen.getByPlaceholderText('e.g. #ffbbbb');
+    await user.clear(input);
+    await user.type(input, 'f50');
+
+    await waitFor(() => {
+      expect(onChange).toHaveBeenCalledWith('#ff5500');
+    });
+  });
+
+  it('reverts text input to committed value on blur when input is invalid', async () => {
+    const user = userEvent.setup();
+
+    render(
+      <ColorPicker value="#3c8dbc" onChange={() => {}} data-cy="color-picker" />
+    );
+
+    const input = screen.getByPlaceholderText('e.g. #ffbbbb');
+    await user.clear(input);
+    await user.type(input, 'xx');
+    expect(input).toHaveValue('#xx');
+
+    await user.tab();
+    expect(input).toHaveValue('#3c8dbc');
+  });
+});
diff --git a/app/react/components/form-components/ColorPicker/ColorPicker.tsx b/app/react/components/form-components/ColorPicker/ColorPicker.tsx
new file mode 100644
index 0000000..52685c9
--- /dev/null
+++ b/app/react/components/form-components/ColorPicker/ColorPicker.tsx
@@ -0,0 +1,124 @@
+import { debounce } from 'lodash';
+import { ChangeEvent, useEffect, useRef, useState } from 'react';
+
+import { Input } from '../Input';
+
+const SHORT_HEX_RE = /^#[0-9a-fA-F]{3}$/;
+const FULL_HEX_RE = /^#[0-9a-fA-F]{6}$/;
+
+export interface Props {
+  value: string;
+  onChange: (color: string) => void;
+  'data-cy': string;
+  id?: string;
+  pickerId?: string;
+}
+
+export function ColorPicker({
+  value,
+  onChange,
+  id = 'colorPickerTextInput',
+  pickerId = 'colorPickerSwatch',
+  'data-cy': dataCy = 'color-picker-input',
+}: Props) {
+  const [localHex, setLocalHex] = useState(value);
+
+  // Tracks the last value emitted by this component so the sync effect below
+  // doesn't reset localHex when the parent echoes our own change back.
+  const lastEmitted = useRef(value);
+
+  // Debounce only the swatch - useDebounce can't be used here because the text
+  // input shows a different value (#abc) than what's emitted (#aabbcc).
+  const onChangeRef = useRef(onChange);
+  onChangeRef.current = onChange;
+  const debouncedOnChange = useRef(
+    debounce((hex: string) => onChangeRef.current(hex), 80)
+  ).current;
+
+  useEffect(() => {
+    if (value !== lastEmitted.current) {
+      setLocalHex(value);
+      lastEmitted.current = value;
+    }
+  }, [value]);
+
+  const swatchColor = getSwatchColor(localHex, value);
+
+  return (
+    <div className="flex items-center gap-2">
+      <label
+        aria-label="Choose color"
+        htmlFor={pickerId}
+        className="form-control relative !mb-0 h-[34px] w-[34px] shrink-0 cursor-pointer overflow-hidden rounded"
+        style={{ backgroundColor: swatchColor }}
+      >
+        <input
+          type="color"
+          id={pickerId}
+          value={swatchColor}
+          onChange={handleColorChange}
+          className="absolute inset-0 h-full w-full cursor-pointer opacity-0"
+          aria-label="Choose highlight color"
+        />
+      </label>
+      <Input
+        id={id}
+        value={localHex}
+        onChange={handleTextChange}
+        onBlur={handleBlur}
+        className="w-28 uppercase"
+        maxLength={7}
+        placeholder="e.g. #ffbbbb"
+        spellCheck={false}
+        data-cy={dataCy}
+      />
+    </div>
+  );
+
+  function handleColorChange(e: ChangeEvent<HTMLInputElement>) {
+    const hex = e.target.value;
+    setLocalHex(hex);
+    lastEmitted.current = hex;
+    debouncedOnChange(hex);
+  }
+
+  function handleTextChange(e: ChangeEvent<HTMLInputElement>) {
+    const raw = e.target.value;
+    const normalized = raw.startsWith('#') ? raw : `#${raw}`;
+    setLocalHex(normalized);
+    if (isValidHex(normalized)) {
+      const expanded = expandHex(normalized);
+      lastEmitted.current = expanded;
+      onChange(expanded);
+    }
+  }
+
+  function handleBlur() {
+    if (!isValidHex(localHex)) {
+      setLocalHex(value);
+    }
+  }
+}
+
+function isValidHex(hex: string): boolean {
+  return SHORT_HEX_RE.test(hex) || FULL_HEX_RE.test(hex);
+}
+
+/** Expands a 3-digit shorthand (#rgb → #rrggbb). Full hex passes through unchanged. */
+function expandHex(hex: string): string {
+  if (SHORT_HEX_RE.test(hex)) {
+    const [, r, g, b] = hex;
+    return `#${r}${r}${g}${g}${b}${b}`;
+  }
+  return hex;
+}
+
+function getSwatchColor(localHex: string, committedValue: string): string {
+  if (isValidHex(localHex)) {
+    return expandHex(localHex);
+  }
+  if (isValidHex(committedValue)) {
+    return expandHex(committedValue);
+  }
+  return '#ffffff';
+}
diff --git a/app/react/components/form-components/DisabledMultiValue.tsx b/app/react/components/form-components/DisabledMultiValue.tsx
new file mode 100644
index 0000000..52e0f7a
--- /dev/null
+++ b/app/react/components/form-components/DisabledMultiValue.tsx
@@ -0,0 +1,73 @@
+import type { ReactNode } from 'react';
+import {
+  components,
+  type GroupBase,
+  type MultiValueProps,
+  type MultiValueRemoveProps,
+} from 'react-select';
+
+import { TooltipWithChildren } from '@@/Tip/TooltipWithChildren';
+
+import { type Option } from './PortainerSelect';
+
+/** Extends Option with an optional tooltip shown when the item is disabled. */
+export interface DisabledOption<TValue> extends Option<TValue> {
+  disabledMessage?: ReactNode;
+}
+
+export function DisabledMultiValue({
+  data,
+  ...props
+}: MultiValueProps<Option<string>, true, GroupBase<Option<string>>>) {
+  const disabledMessage = (data as DisabledOption<string>).disabledMessage;
+
+  const value = (
+    <components.MultiValue
+      // eslint-disable-next-line react/jsx-props-no-spreading
+      {...props}
+      data={data}
+      isDisabled={!!data.disabled}
+    >
+      <span className={data.disabled ? 'text-muted pr-1' : ''}>
+        {props.children}
+      </span>
+    </components.MultiValue>
+  );
+
+  if (data.disabled && disabledMessage) {
+    return (
+      <TooltipWithChildren
+        message={disabledMessage}
+        appendTo={() => document.body}
+      >
+        <span>{value}</span>
+      </TooltipWithChildren>
+    );
+  }
+
+  return value;
+}
+
+export function DisabledMultiValueRemove({
+  data,
+  ...props
+}: MultiValueRemoveProps<Option<string>, true, GroupBase<Option<string>>>) {
+  if (data.disabled) {
+    return null;
+  }
+
+  return (
+    <components.MultiValueRemove
+      // eslint-disable-next-line react/jsx-props-no-spreading
+      {...props}
+      data={data}
+    />
+  );
+}
+
+export function preserveProtectedValues<T>(
+  selectedValues: T[],
+  protectedValues: T[]
+): T[] {
+  return [...new Set([...selectedValues, ...protectedValues])];
+}
diff --git a/app/react/components/form-components/EnvironmentVariablesFieldset/AdvancedMode.tsx b/app/react/components/form-components/EnvironmentVariablesFieldset/AdvancedMode.tsx
new file mode 100644
index 0000000..54bc3e6
--- /dev/null
+++ b/app/react/components/form-components/EnvironmentVariablesFieldset/AdvancedMode.tsx
@@ -0,0 +1,55 @@
+import { List } from 'lucide-react';
+
+import { AutomationTestingProps } from '@/types';
+
+import { CodeEditor } from '@@/CodeEditor';
+import { TextTip } from '@@/Tip/TextTip';
+import { Button } from '@@/buttons';
+
+import { convertToArrayOfStrings, parseDotEnvFile } from './utils';
+import { type Values } from './types';
+
+export function AdvancedMode({
+  value,
+  onChange,
+  onSimpleModeClick,
+  'data-cy': dataCy,
+}: {
+  value: Values;
+  onChange: (value: Values) => void;
+  onSimpleModeClick: () => void;
+} & AutomationTestingProps) {
+  const editorValue = convertToArrayOfStrings(value).join('\n');
+
+  return (
+    <>
+      <Button
+        size="small"
+        color="link"
+        icon={List}
+        className="!ml-0 p-0 hover:no-underline"
+        onClick={onSimpleModeClick}
+        data-cy="env-simple-mode-button"
+      >
+        Simple mode
+      </Button>
+
+      <TextTip color="blue" inline={false}>
+        Switch to simple mode to define variables line by line, or load from
+        .env file
+      </TextTip>
+
+      <CodeEditor
+        id="environment-variables-editor"
+        value={editorValue}
+        onChange={handleEditorChange}
+        textTip="e.g. key=value"
+        data-cy={dataCy}
+      />
+    </>
+  );
+
+  function handleEditorChange(value: string) {
+    onChange(parseDotEnvFile(value));
+  }
+}
diff --git a/app/react/components/form-components/EnvironmentVariablesFieldset/EnvironmentVariableItem.tsx b/app/react/components/form-components/EnvironmentVariablesFieldset/EnvironmentVariableItem.tsx
new file mode 100644
index 0000000..8b1f11d
--- /dev/null
+++ b/app/react/components/form-components/EnvironmentVariablesFieldset/EnvironmentVariableItem.tsx
@@ -0,0 +1,61 @@
+import { FormError } from '../FormError';
+import { InputLabeled } from '../Input/InputLabeled';
+import { ItemProps } from '../InputList';
+
+import { EnvVar } from './types';
+
+export function EnvironmentVariableItem({
+  item,
+  onChange,
+  disabled,
+  error,
+  readOnly,
+  index,
+}: ItemProps<EnvVar>) {
+  return (
+    <div className="relative flex w-full flex-col">
+      <div className="flex w-full items-start gap-2">
+        <div className="w-1/2">
+          <InputLabeled
+            className="w-full"
+            data-cy={`env-name_${index}`}
+            label="name"
+            required
+            value={item.name}
+            onChange={(e) => handleChange({ name: e.target.value })}
+            disabled={disabled}
+            needsDeletion={item.needsDeletion}
+            readOnly={readOnly}
+            placeholder="e.g. FOO"
+            size="small"
+            id={`env-name${index}`}
+          />
+          {error && (
+            <div>
+              <FormError className="!mb-0 mt-1">
+                {Object.values(error)[0]}
+              </FormError>
+            </div>
+          )}
+        </div>
+        <InputLabeled
+          className="w-1/2"
+          data-cy={`env-value_${index}`}
+          label="value"
+          value={item.value}
+          onChange={(e) => handleChange({ value: e.target.value })}
+          disabled={disabled}
+          needsDeletion={item.needsDeletion}
+          readOnly={readOnly}
+          placeholder="e.g. bar"
+          size="small"
+          id={`env-value${index}`}
+        />
+      </div>
+    </div>
+  );
+
+  function handleChange(partial: Partial<EnvVar>) {
+    onChange({ ...item, ...partial });
+  }
+}
diff --git a/app/react/components/form-components/EnvironmentVariablesFieldset/EnvironmentVariablesFieldset.tsx b/app/react/components/form-components/EnvironmentVariablesFieldset/EnvironmentVariablesFieldset.tsx
new file mode 100644
index 0000000..602c559
--- /dev/null
+++ b/app/react/components/form-components/EnvironmentVariablesFieldset/EnvironmentVariablesFieldset.tsx
@@ -0,0 +1,61 @@
+import { useState } from 'react';
+import { array, boolean, object, SchemaOf, string } from 'yup';
+
+import { ArrayError } from '../InputList/InputList';
+import { buildUniquenessTest } from '../validate-unique';
+
+import { AdvancedMode } from './AdvancedMode';
+import { SimpleMode } from './SimpleMode';
+import { Values } from './types';
+
+export function EnvironmentVariablesFieldset({
+  onChange,
+  values,
+  errors,
+  canUndoDelete,
+}: {
+  values: Values;
+  onChange(value: Values): void;
+  errors?: ArrayError<Values>;
+  canUndoDelete?: boolean;
+}) {
+  const [simpleMode, setSimpleMode] = useState(true);
+
+  return (
+    <>
+      {simpleMode ? (
+        <SimpleMode
+          onAdvancedModeClick={() => setSimpleMode(false)}
+          onChange={onChange}
+          value={values}
+          errors={errors}
+          canUndoDelete={canUndoDelete}
+        />
+      ) : (
+        <AdvancedMode
+          onSimpleModeClick={() => setSimpleMode(true)}
+          data-cy="env-var-advanced-mode"
+          onChange={onChange}
+          value={values}
+        />
+      )}
+    </>
+  );
+}
+
+export function envVarValidation(): SchemaOf<Values> {
+  return array(
+    object({
+      name: string().required('Environment variable name is required'),
+      value: string().default(''),
+      needsDeletion: boolean().default(false),
+    })
+  ).test(
+    'unique',
+    'This environment variable is already defined',
+    buildUniquenessTest(
+      () => 'This environment variable is already defined',
+      'name'
+    )
+  );
+}
diff --git a/app/react/components/form-components/EnvironmentVariablesFieldset/EnvironmentVariablesPanel.tsx b/app/react/components/form-components/EnvironmentVariablesFieldset/EnvironmentVariablesPanel.tsx
new file mode 100644
index 0000000..b4d8fce
--- /dev/null
+++ b/app/react/components/form-components/EnvironmentVariablesFieldset/EnvironmentVariablesPanel.tsx
@@ -0,0 +1,59 @@
+import React, { ComponentProps } from 'react';
+
+import { FormSection } from '@@/form-components/FormSection';
+import { TextTip } from '@@/Tip/TextTip';
+
+import { EnvironmentVariablesFieldset } from './EnvironmentVariablesFieldset';
+
+type FieldsetProps = ComponentProps<typeof EnvironmentVariablesFieldset>;
+
+export function EnvironmentVariablesPanel({
+  explanation,
+  onChange,
+  values,
+  showHelpMessage,
+  errors,
+  isFoldable = false,
+  alertMessage,
+}: {
+  explanation?: React.ReactNode;
+  showHelpMessage?: boolean;
+  isFoldable?: boolean;
+  alertMessage?: React.ReactNode;
+} & FieldsetProps) {
+  return (
+    <FormSection
+      title="Environment variables"
+      isFoldable={isFoldable}
+      defaultFolded={isFoldable}
+      className="flex w-full flex-col"
+    >
+      <div className="form-group">
+        {!!explanation && (
+          <div className="col-sm-12 environment-variables-panel--explanation">
+            {explanation}
+          </div>
+        )}
+
+        {alertMessage}
+
+        <div className="col-sm-12">
+          <EnvironmentVariablesFieldset
+            values={values}
+            onChange={onChange}
+            errors={errors}
+          />
+        </div>
+
+        {showHelpMessage && (
+          <div className="col-sm-12">
+            <TextTip color="blue" inline={false}>
+              Environment changes will not take effect until redeployment occurs
+              manually or via webhook.
+            </TextTip>
+          </div>
+        )}
+      </div>
+    </FormSection>
+  );
+}
diff --git a/app/react/components/form-components/EnvironmentVariablesFieldset/SimpleMode.tsx b/app/react/components/form-components/EnvironmentVariablesFieldset/SimpleMode.tsx
new file mode 100644
index 0000000..08db41a
--- /dev/null
+++ b/app/react/components/form-components/EnvironmentVariablesFieldset/SimpleMode.tsx
@@ -0,0 +1,115 @@
+import { Edit, Plus } from 'lucide-react';
+import { useState } from 'react';
+
+import { readFileAsText } from '@/portainer/services/fileUploadReact';
+
+import { Button } from '@@/buttons';
+import { TextTip } from '@@/Tip/TextTip';
+import { FileUploadField } from '@@/form-components/FileUpload';
+import { InputList } from '@@/form-components/InputList';
+import { ArrayError } from '@@/form-components/InputList/InputList';
+
+import type { Values } from './types';
+import { parseDotEnvFile } from './utils';
+import { EnvironmentVariableItem } from './EnvironmentVariableItem';
+
+export function SimpleMode({
+  value,
+  onChange,
+  onAdvancedModeClick,
+  errors,
+  canUndoDelete,
+}: {
+  value: Values;
+  onChange: (value: Values) => void;
+  onAdvancedModeClick: () => void;
+  errors?: ArrayError<Values>;
+  canUndoDelete?: boolean;
+}) {
+  return (
+    <>
+      <Button
+        size="small"
+        color="link"
+        icon={Edit}
+        className="!ml-0 p-0 hover:no-underline"
+        onClick={onAdvancedModeClick}
+        data-cy="environment-variables-advanced-mode-button"
+      >
+        Advanced mode
+      </Button>
+
+      <TextTip color="blue" inline={false}>
+        Switch to advanced mode to copy & paste multiple variables
+      </TextTip>
+
+      <InputList
+        aria-label="environment variables list"
+        onChange={onChange}
+        value={value}
+        isAddButtonHidden
+        item={EnvironmentVariableItem}
+        errors={errors}
+        canUndoDelete={canUndoDelete}
+        data-cy="simple-environment-variable-fieldset"
+      />
+
+      <div className="flex gap-2">
+        <Button
+          onClick={() =>
+            onChange([...value, { name: '', value: '', needsDeletion: false }])
+          }
+          className="!ml-0"
+          color="default"
+          icon={Plus}
+          data-cy="add-environment-variable-button"
+        >
+          Add an environment variable
+        </Button>
+
+        <FileEnv onChooseFile={(add) => onChange([...value, ...add])} />
+      </div>
+    </>
+  );
+}
+
+function FileEnv({ onChooseFile }: { onChooseFile: (file: Values) => void }) {
+  const [file, setFile] = useState<File | null>(null);
+
+  const fileTooBig = file && file.size > 1024 * 1024;
+
+  return (
+    <>
+      <FileUploadField
+        inputId="env-file-upload"
+        onChange={handleChange}
+        title="Load variables from .env file"
+        accept=".env"
+        value={file}
+        color="default"
+        data-cy="load-environment-variables-from-file-button"
+      />
+
+      {fileTooBig && (
+        <TextTip color="orange" inline>
+          File too large! Try uploading a file smaller than 1MB
+        </TextTip>
+      )}
+    </>
+  );
+
+  async function handleChange(file: File) {
+    setFile(file);
+    if (!file) {
+      return;
+    }
+
+    const text = await readFileAsText(file);
+    if (!text) {
+      return;
+    }
+
+    const parsed = parseDotEnvFile(text);
+    onChooseFile(parsed);
+  }
+}
diff --git a/app/react/components/form-components/EnvironmentVariablesFieldset/StackEnvironmentVariablesPanel.tsx b/app/react/components/form-components/EnvironmentVariablesFieldset/StackEnvironmentVariablesPanel.tsx
new file mode 100644
index 0000000..36c4127
--- /dev/null
+++ b/app/react/components/form-components/EnvironmentVariablesFieldset/StackEnvironmentVariablesPanel.tsx
@@ -0,0 +1,70 @@
+import { ComponentProps } from 'react';
+
+import { Alert } from '@@/Alert';
+import { useDocsUrl } from '@@/PageHeader/ContextHelp';
+
+import { EnvironmentVariablesFieldset } from './EnvironmentVariablesFieldset';
+import { EnvironmentVariablesPanel } from './EnvironmentVariablesPanel';
+
+type FieldsetProps = ComponentProps<typeof EnvironmentVariablesFieldset>;
+
+export function StackEnvironmentVariablesPanel({
+  onChange,
+  values,
+  errors,
+  isFoldable = false,
+  showHelpMessage,
+}: {
+  isFoldable?: boolean;
+  showHelpMessage?: boolean;
+} & FieldsetProps) {
+  return (
+    <EnvironmentVariablesPanel
+      explanation={
+        <div>
+          You may use{' '}
+          <a
+            href={`${useDocsUrl(
+              '/user/docker/stacks/add#environment-variables'
+            )}`}
+            target="_blank"
+            data-cy="stack-env-vars-help-link"
+            rel="noreferrer noopener"
+          >
+            environment variables in your compose file
+          </a>
+          . The environment variable values set below will be used as
+          substitutions in the compose file. Note that you may also reference a
+          stack.env file in your compose file. A stack.env file contains the
+          environment variables and their values (e.g. TAG=v1.5).
+        </div>
+      }
+      onChange={onChange}
+      values={values}
+      errors={errors}
+      isFoldable={isFoldable}
+      showHelpMessage={showHelpMessage}
+      alertMessage={
+        <div className="flex p-4">
+          <Alert color="info" className="col-sm-12">
+            <div>
+              <p>
+                <strong>stack.env file operation</strong>
+              </p>
+              <div>
+                When deploying via <strong>Repository</strong>, the stack.env
+                file must already reside in the Git repo.
+              </div>
+              <div>
+                When deploying via <strong>Web editor</strong>,{' '}
+                <strong>Upload</strong> or{' '}
+                <strong>Custom template deployment</strong>, the stack.env file
+                is auto created from what you set below.
+              </div>
+            </div>
+          </Alert>
+        </div>
+      }
+    />
+  );
+}
diff --git a/app/react/components/form-components/EnvironmentVariablesFieldset/index.ts b/app/react/components/form-components/EnvironmentVariablesFieldset/index.ts
new file mode 100644
index 0000000..3e2e0e2
--- /dev/null
+++ b/app/react/components/form-components/EnvironmentVariablesFieldset/index.ts
@@ -0,0 +1,9 @@
+export {
+  EnvironmentVariablesFieldset,
+  envVarValidation,
+} from './EnvironmentVariablesFieldset';
+
+export { EnvironmentVariablesPanel } from './EnvironmentVariablesPanel';
+export { StackEnvironmentVariablesPanel } from './StackEnvironmentVariablesPanel';
+
+export { type Values as EnvVarValues } from './types';
diff --git a/app/react/components/form-components/EnvironmentVariablesFieldset/types.ts b/app/react/components/form-components/EnvironmentVariablesFieldset/types.ts
new file mode 100644
index 0000000..5a92beb
--- /dev/null
+++ b/app/react/components/form-components/EnvironmentVariablesFieldset/types.ts
@@ -0,0 +1,7 @@
+export interface EnvVar {
+  name: string;
+  value?: string;
+  needsDeletion?: boolean;
+}
+
+export type Values = Array<EnvVar>;
diff --git a/app/react/components/form-components/EnvironmentVariablesFieldset/utils.ts b/app/react/components/form-components/EnvironmentVariablesFieldset/utils.ts
new file mode 100644
index 0000000..f561dc5
--- /dev/null
+++ b/app/react/components/form-components/EnvironmentVariablesFieldset/utils.ts
@@ -0,0 +1,54 @@
+import _ from 'lodash';
+
+import { EnvVar } from './types';
+
+export const KEY_REGEX = /(.+?)/.source;
+export const VALUE_REGEX = /(.*)?/.source;
+
+const KEY_VALUE_REGEX = new RegExp(`^(${KEY_REGEX})\\s*=(${VALUE_REGEX})$`);
+const NEWLINES_REGEX = /\n|\r|\r\n/;
+
+export function parseDotEnvFile(src: string) {
+  return parseArrayOfStrings(
+    _.compact(src.split(NEWLINES_REGEX))
+      .map((v) => v.trim())
+      .filter((v) => !v.startsWith('#') && v !== '')
+  );
+}
+
+export function parseArrayOfStrings(array: Array<string> = []): Array<EnvVar> {
+  if (!array) {
+    return [];
+  }
+
+  return _.compact(
+    array.map((variableString) => {
+      if (!variableString.includes('=')) {
+        return { name: variableString };
+      }
+
+      const parsedKeyValArr = variableString.trim().match(KEY_VALUE_REGEX);
+      if (parsedKeyValArr == null || parsedKeyValArr.length < 4) {
+        return null;
+      }
+
+      return {
+        name: parsedKeyValArr[1].trim(),
+        value: parsedKeyValArr[3].trim() || '',
+        needsDeletion: false,
+      };
+    })
+  );
+}
+
+export function convertToArrayOfStrings(array: Array<EnvVar>) {
+  if (!array) {
+    return [];
+  }
+
+  return array
+    .filter((variable) => variable.name)
+    .map(({ name, value }) =>
+      value || value === '' ? `${name}=${value}` : name
+    );
+}
diff --git a/app/react/components/form-components/FilePicker/FilePicker.stories.tsx b/app/react/components/form-components/FilePicker/FilePicker.stories.tsx
new file mode 100644
index 0000000..55fa81a
--- /dev/null
+++ b/app/react/components/form-components/FilePicker/FilePicker.stories.tsx
@@ -0,0 +1,219 @@
+import { Meta, StoryObj } from '@storybook/react-webpack5';
+import { useEffect, useState } from 'react';
+
+import { Button } from '@@/buttons/Button';
+import { FileNode } from '@@/form-components/FilePicker/types';
+
+import { FilePicker } from './FilePicker';
+import { FilePickerSkeleton } from './FilePickerSkeleton';
+
+const meta: Meta<typeof FilePicker> = {
+  title: 'Components/Forms/File Picker',
+  component: FilePicker,
+  tags: [],
+  decorators: [
+    (Story, { viewMode }) => (
+      <div
+        style={{
+          background: 'var(--bg, #f9fafb)',
+          padding: 'var(--space-16)',
+          minHeight: viewMode === 'story' ? '100vh' : undefined,
+          fontFamily: "'DM Sans', system-ui, sans-serif",
+        }}
+      >
+        <Story />
+      </div>
+    ),
+  ],
+  parameters: {
+    layout: 'fullscreen',
+    docs: {
+      description: {
+        component:
+          '`FilePicker` lets users select individual files or build wildcard expressions (e.g. `*.yml`, `src/**/*.ts`) from a repository tree. Selected items surface as **File** or **Expression** chips. A blue dot marks every tree row that is selected or matched by an expression. Typing in the filter bar shows a live preview of matching files and offers a one-click "Add expression (N matches)" button.',
+      },
+    },
+  },
+};
+
+export default meta;
+type Story = StoryObj<typeof FilePicker>;
+
+// ─── Demo data ────────────────────────────────────────────────────────────────
+
+const REPO_NODES: FileNode[] = [
+  {
+    name: '.github',
+    children: [
+      {
+        name: 'workflows',
+        children: [
+          { name: 'ci.yml' },
+          { name: 'deploy.yml' },
+          { name: 'release.yml' },
+        ],
+      },
+    ],
+  },
+  {
+    name: 'config',
+    children: [
+      { name: 'app.yml' },
+      { name: 'database.yml' },
+      { name: 'cache.yml' },
+      { name: 'logging.yml' },
+    ],
+  },
+  {
+    name: 'deploy',
+    children: [
+      { name: 'k8s.yaml' },
+      { name: 'helm-values.yaml' },
+      { name: 'terraform.tfvars' },
+    ],
+  },
+  {
+    name: 'docs',
+    children: [
+      { name: 'README.md' },
+      { name: 'architecture.md' },
+      { name: 'CONTRIBUTING.md' },
+    ],
+  },
+  {
+    name: 'scripts',
+    children: [
+      { name: 'build.sh' },
+      { name: 'deploy.sh' },
+      { name: 'seed.sh' },
+    ],
+  },
+  {
+    name: 'src',
+    children: [
+      {
+        name: 'api',
+        children: [
+          { name: 'routes.ts' },
+          { name: 'handlers.ts' },
+          { name: 'middleware.ts' },
+        ],
+      },
+      {
+        name: 'components',
+        children: [
+          { name: 'Button.tsx' },
+          { name: 'Modal.tsx' },
+          { name: 'Table.tsx' },
+        ],
+      },
+      {
+        name: 'utils',
+        children: [{ name: 'helpers.ts' }, { name: 'types.ts' }],
+      },
+    ],
+  },
+  {
+    name: 'tests',
+    children: [
+      { name: 'setup.ts' },
+      { name: 'integration.ts' },
+      { name: 'e2e.ts' },
+    ],
+  },
+  { name: '.gitignore' },
+  { name: 'docker-compose.yml' },
+  { name: 'docker-compose.prod.yml' },
+  { name: 'docker-compose.staging.yml' },
+  { name: 'Dockerfile' },
+  { name: 'package.json' },
+  { name: 'tsconfig.json' },
+];
+
+// ─── Skeleton ─────────────────────────────────────────────────────────────────
+
+export const Skeleton: StoryObj<{ loading: boolean }> = {
+  render: () => {
+    // eslint-disable-next-line react-hooks/rules-of-hooks
+    const [loading, setLoading] = useState(true);
+    // eslint-disable-next-line react-hooks/rules-of-hooks
+    const [value, setValue] = useState<string[]>([]);
+
+    // eslint-disable-next-line react-hooks/rules-of-hooks
+    useEffect(() => {
+      const id = setTimeout(() => setLoading(false), 2000);
+      return () => clearTimeout(id);
+    }, []);
+
+    return (
+      <div className="flex flex-col gap-2 p-2">
+        {loading ? (
+          <FilePickerSkeleton />
+        ) : (
+          <FilePicker
+            files={REPO_NODES}
+            value={value}
+            onChange={setValue}
+            exampleExpressions={[
+              '*.yml',
+              '*.yaml',
+              '*.ts',
+              'src/**',
+              'deploy/**',
+            ]}
+          />
+        )}
+      </div>
+    );
+  },
+  parameters: {
+    docs: {
+      description: {
+        story:
+          'Shows a skeleton placeholder while file tree data is loading, then transitions to the real `FilePicker` after 2 seconds. Reload the story to replay the transition.',
+      },
+    },
+  },
+};
+
+// ─── Default ──────────────────────────────────────────────────────────────────
+
+export const Default: Story = {
+  args: {
+    files: REPO_NODES,
+    exampleExpressions: ['*.yml', '*.yaml', '*.ts', 'src/**', 'deploy/**'],
+  },
+  render: (args) => {
+    // eslint-disable-next-line react-hooks/rules-of-hooks
+    const [value, setValue] = useState<string[]>([]);
+    return (
+      <div className="flex flex-col gap-2 p-2">
+        <FilePicker {...args} value={value} onChange={setValue} />
+        <Button
+          color="primary"
+          size="small"
+          data-cy="file-picker-add-paths"
+          onClick={() => alert(`Files:\n${value.join('\n') || '(none)'}`)}
+        >
+          Add Paths
+        </Button>
+      </div>
+    );
+  },
+  parameters: {
+    docs: {
+      description: {
+        story:
+          'Default state — header shows total file count, suggested pattern chips for one-click expression adding, and an empty tree with all folders collapsed. Click a pattern chip (e.g. `*.yml`) to add it as an expression immediately.',
+      },
+      source: {
+        code: `<FilePicker
+  files={REPO_NODES}
+  value={value}
+  onChange={setValue}
+  exampleExpressions={['*.yml', '*.yaml', '*.ts', 'src/**', 'deploy/**']}
+/>`,
+      },
+    },
+  },
+};
diff --git a/app/react/components/form-components/FilePicker/FilePicker.test.tsx b/app/react/components/form-components/FilePicker/FilePicker.test.tsx
new file mode 100644
index 0000000..3c539a2
--- /dev/null
+++ b/app/react/components/form-components/FilePicker/FilePicker.test.tsx
@@ -0,0 +1,105 @@
+import { useState } from 'react';
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+
+import { FilePicker } from './FilePicker';
+import { FileNode } from './types';
+
+const flatFiles: FileNode[] = [
+  { name: 'foo.yml' },
+  { name: 'bar.ts' },
+  { name: 'baz.json' },
+];
+
+function renderFilePicker({
+  files = flatFiles,
+  initialValue = [],
+  examplePatterns = ['*.yml', 'src/**'],
+}: {
+  files?: FileNode[];
+  initialValue?: string[];
+  examplePatterns?: string[];
+} = {}) {
+  const user = userEvent.setup();
+  const onChange = vi.fn();
+
+  function Wrapper() {
+    const [value, setValue] = useState<string[]>(initialValue);
+    return (
+      <FilePicker
+        files={files}
+        value={value}
+        onChange={(paths) => {
+          setValue(paths);
+          onChange(paths);
+        }}
+        exampleExpressions={examplePatterns}
+      />
+    );
+  }
+
+  render(<Wrapper />);
+  return { user, onChange };
+}
+
+describe('FilePicker', () => {
+  it('calls onChange with slash-prefixed sorted paths when files are selected', async () => {
+    const { user, onChange } = renderFilePicker({
+      files: [{ name: 'foo.yml' }, { name: 'bar.ts' }],
+    });
+    const checkboxes = screen.getAllByRole('checkbox');
+    await user.click(checkboxes[0]); // foo.yml
+    await user.click(checkboxes[1]); // bar.ts
+    expect(onChange).toHaveBeenLastCalledWith(['/bar.ts', '/foo.yml']);
+  });
+
+  it('sets the search filter when an example pattern button is clicked', async () => {
+    const { user } = renderFilePicker({ examplePatterns: ['*.yml'] });
+    await user.click(screen.getByRole('button', { name: '*.yml' }));
+    expect(screen.getByRole('textbox')).toHaveValue('*.yml');
+  });
+
+  it('counts expression-matched files as selected', async () => {
+    const { user } = renderFilePicker({
+      files: [{ name: 'foo.yml' }, { name: 'bar.ts' }],
+    });
+    const filterInput = screen.getByRole('textbox');
+    await user.click(filterInput);
+    await user.type(filterInput, '*.yml');
+    await user.keyboard('{Enter}');
+    // *.yml matches foo.yml only → 1 selected
+    expect(screen.getByText('1 selected')).toBeVisible();
+  });
+
+  it('selecting a directory checkbox selects all its descendant files', async () => {
+    const { user, onChange } = renderFilePicker({
+      files: [{ name: 'src', children: [{ name: 'a.ts' }, { name: 'b.ts' }] }],
+    });
+    // Only the directory checkbox is visible (not expanded)
+    await user.click(screen.getByRole('checkbox'));
+    expect(onChange).toHaveBeenCalledWith(['/src/a.ts', '/src/b.ts']);
+  });
+
+  it('deselects all directory files when a fully-checked directory is clicked again', async () => {
+    const { user, onChange } = renderFilePicker({
+      files: [{ name: 'src', children: [{ name: 'a.ts' }] }],
+    });
+    const checkbox = screen.getByRole('checkbox');
+    await user.click(checkbox); // select all
+    await user.click(checkbox); // deselect all
+    expect(onChange).toHaveBeenLastCalledWith([]);
+  });
+
+  it('clears all selected files when Clear is clicked', async () => {
+    const { user } = renderFilePicker({
+      files: [{ name: 'foo.yml' }],
+    });
+    const filterInput = screen.getByRole('textbox');
+    await user.click(filterInput);
+    await user.type(filterInput, '*.yml');
+    await user.keyboard('{Enter}');
+    expect(screen.getByText('1 selected')).toBeVisible();
+    await user.click(screen.getByRole('button', { name: /clear/i }));
+    expect(screen.getByText('0 selected')).toBeVisible();
+  });
+});
diff --git a/app/react/components/form-components/FilePicker/FilePicker.tsx b/app/react/components/form-components/FilePicker/FilePicker.tsx
new file mode 100644
index 0000000..00b5ccd
--- /dev/null
+++ b/app/react/components/form-components/FilePicker/FilePicker.tsx
@@ -0,0 +1,206 @@
+import { useMemo, useRef, useState, type ReactNode } from 'react';
+import { createPortal } from 'react-dom';
+
+import { pluralize } from '@/react/common/string-utils';
+
+import { Button } from '@@/buttons/Button';
+import { Directory, File, FileNode } from '@@/form-components/FilePicker/types';
+import { CommandPalette } from '@@/CommandPalette/CommandPalette';
+import { globToRegex } from '@@/CommandPalette/utils';
+import { Widget } from '@@/Widget';
+
+import { isDirectory, getAllFilePaths, getFolderState } from './utils';
+import { TreeNode } from './TreeNode';
+import { SelectedPanel } from './SelectedPanel';
+
+interface Props {
+  files: FileNode[];
+  /* array of file paths that have been selected */
+  value: string[];
+  onChange: (filePaths: string[]) => void;
+  exampleExpressions?: string[];
+}
+
+export function FilePicker({
+  files,
+  value,
+  onChange,
+  exampleExpressions = ['*.yml', 'src/**', '**/dist/*'],
+}: Props) {
+  const [expanded, setExpanded] = useState<Set<string>>(() => new Set([]));
+  const selected = useMemo(
+    () => new Set(value.map((p) => (p.startsWith('/') ? p.slice(1) : p))),
+    [value]
+  );
+  const [filter, setFilter] = useState('');
+  const treeAreaRef = useRef<HTMLDivElement>(null);
+  const commandPaletteRef = useRef<HTMLInputElement>(null);
+
+  const allFilePaths = useMemo(
+    () => files.flatMap((file) => getAllFilePaths(file, file.name)),
+    [files]
+  );
+
+  return (
+    <Widget>
+      <div className="flex flex-col border-b border-l-0 border-r-0 border-t-0 border-solid border-gray-4 px-3 py-2 th-highcontrast:border-white th-dark:border-gray-7">
+        <p>
+          Browse files, select individually, or use wildcard expressions.
+          Contains {allFilePaths.length}{' '}
+          {pluralize(allFilePaths.length, 'file')}. Try patterns like:
+        </p>
+        <div className="flex gap-1">
+          {exampleExpressions.map((pattern, index) => {
+            return (
+              <Button
+                key={`example-${index}`}
+                color="none"
+                className="!th-highcontrast:bg-gray-9 !th-highcontrast:text-gray-3 !th-dark:bg-gray-9 !th-dark:text-gray-3 !bg-gray-3 !p-2 font-mono !text-gray-9"
+                onClick={() => {
+                  setFilter(pattern);
+                  commandPaletteRef.current?.focus();
+                }}
+                data-cy={`example-${index}-button`}
+              >
+                {pattern}
+              </Button>
+            );
+          })}
+        </div>
+      </div>
+
+      <div className="flex items-center gap-2 border-b border-l-0 border-r-0 border-t-0 border-solid border-gray-4 px-3 py-2 th-highcontrast:border-white th-dark:border-gray-7">
+        <CommandPalette
+          ref={commandPaletteRef}
+          value={filter}
+          onChange={setFilter}
+          onCompletion={addExpression}
+          allFilePaths={allFilePaths}
+          openDropdownOnFocus={false}
+          renderDropdown={renderDropdown}
+        />
+      </div>
+
+      <div ref={treeAreaRef} className="flex h-80 overflow-hidden">
+        {allFilePaths.length === 0 && (
+          <p className="w-full px-3 py-4 text-center text-xs text-gray-6 th-highcontrast:text-gray-5 th-dark:text-gray-5">
+            No files available
+          </p>
+        )}
+        {!filter.trim() && (
+          <>
+            <div className="min-w-0 flex-1 overflow-y-auto">
+              {files.map((file) => (
+                <TreeNode
+                  key={file.name}
+                  item={file}
+                  depth={0}
+                  expanded={expanded}
+                  selected={selected}
+                  nodePath={file.name}
+                  onExpandDirectory={toggleDirectory}
+                  onToggleSelect={toggleSelect}
+                />
+              ))}
+            </div>
+
+            <div className="flex w-80 shrink-0 flex-col border-b-0 border-l border-r-0 border-t-0 border-solid border-gray-4 th-highcontrast:border-white th-dark:border-gray-7">
+              <SelectedPanel selected={selected} removeFile={removeFile} />
+            </div>
+          </>
+        )}
+      </div>
+
+      <div className="flex items-center justify-between border-b-0 border-l-0 border-r-0 border-t border-solid border-gray-4 px-3 py-2 th-highcontrast:border-white th-dark:border-gray-7">
+        <span className="text-xs text-gray-6 th-highcontrast:text-white th-dark:text-gray-5">
+          {selected.size} selected
+        </span>
+        <Button
+          color="default"
+          size="small"
+          onClick={() => onChange([])}
+          data-cy="file-picker-clear"
+        >
+          Clear
+        </Button>
+      </div>
+    </Widget>
+  );
+
+  function renderDropdown(paths: string[]): ReactNode {
+    if (!treeAreaRef.current) return null;
+    return createPortal(
+      paths.length === 0 ? (
+        <p className="px-3 py-4 text-center text-xs text-gray-6 th-highcontrast:text-gray-5 th-dark:text-gray-5">
+          No matching files
+        </p>
+      ) : (
+        <ul className="px-1">
+          {paths.map((path) => (
+            <li key={path} className="flex h-8 list-none items-center px-3">
+              <span className="truncate font-mono text-[13px] text-gray-11 th-highcontrast:text-white th-dark:text-white">
+                /{path}
+              </span>
+            </li>
+          ))}
+        </ul>
+      ),
+      treeAreaRef.current
+    );
+  }
+
+  function handleChange(next: Set<string>) {
+    onChange(
+      Array.from(next)
+        .map((f) => `/${f}`)
+        .sort()
+    );
+  }
+
+  function toggleDirectory(path: string) {
+    setExpanded((prev) => {
+      const next = new Set(prev);
+      if (next.has(path)) {
+        next.delete(path);
+      } else {
+        next.add(path);
+      }
+      return next;
+    });
+  }
+
+  function toggleSelect(path: string, item: Directory | File) {
+    if (!isDirectory(item)) {
+      const next = new Set(selected);
+      if (next.has(path)) {
+        next.delete(path);
+      } else {
+        next.add(path);
+      }
+      handleChange(next);
+      return;
+    }
+
+    const filePaths = getAllFilePaths(item, path);
+    const state = getFolderState(item, selected, path);
+    const next = new Set(selected);
+    if (state === 'checked') {
+      filePaths.forEach((p) => next.delete(p));
+    } else {
+      filePaths.forEach((p) => next.add(p));
+    }
+    handleChange(next);
+  }
+
+  function removeFile(path: string) {
+    const next = new Set(selected);
+    next.delete(path);
+    handleChange(next);
+  }
+
+  function addExpression(pattern: string) {
+    const re = globToRegex(pattern);
+    const matchedPaths = allFilePaths.filter((p) => re.test(p));
+    handleChange(new Set([...selected, ...matchedPaths]));
+  }
+}
diff --git a/app/react/components/form-components/FilePicker/FilePickerSkeleton.tsx b/app/react/components/form-components/FilePicker/FilePickerSkeleton.tsx
new file mode 100644
index 0000000..43a1215
--- /dev/null
+++ b/app/react/components/form-components/FilePicker/FilePickerSkeleton.tsx
@@ -0,0 +1,50 @@
+export function FilePickerSkeleton() {
+  return (
+    <div className="animate-pulse overflow-hidden rounded-lg border border-solid border-gray-4 bg-white th-highcontrast:border-white th-highcontrast:bg-black th-dark:border-gray-7 th-dark:bg-gray-iron-10">
+      <div className="flex flex-col gap-2 border-b border-l-0 border-r-0 border-t-0 border-solid border-gray-4 px-3 py-2 th-highcontrast:border-white th-dark:border-gray-7">
+        <div className="h-3 w-3/4 rounded bg-gray-3 th-dark:bg-gray-8" />
+        <div className="flex gap-1">
+          <div className="h-7 w-14 rounded bg-gray-3 th-dark:bg-gray-8" />
+          <div className="h-7 w-12 rounded bg-gray-3 th-dark:bg-gray-8" />
+          <div className="h-7 w-16 rounded bg-gray-3 th-dark:bg-gray-8" />
+        </div>
+      </div>
+
+      <div className="flex items-center border-b border-l-0 border-r-0 border-t-0 border-solid border-gray-4 px-3 py-2 th-highcontrast:border-white th-dark:border-gray-7">
+        <div className="h-8 w-full rounded bg-gray-3 th-dark:bg-gray-8" />
+      </div>
+
+      <div className="flex h-80 overflow-hidden">
+        <div className="min-w-0 flex-1 overflow-y-auto px-1 py-1">
+          {Array.from({ length: 8 }).map((_, i) => (
+            <div
+              key={i}
+              className="flex h-8 items-center gap-2 px-3"
+              style={{ paddingLeft: `${(i % 3) * 12 + 12}px` }}
+            >
+              <div className="h-4 w-4 shrink-0 rounded bg-gray-3 th-dark:bg-gray-8" />
+              <div
+                className="h-3 rounded bg-gray-3 th-dark:bg-gray-8"
+                style={{ width: `${40 + ((i * 37) % 80)}px` }}
+              />
+            </div>
+          ))}
+        </div>
+
+        <div className="flex w-80 shrink-0 flex-col border-b-0 border-l border-r-0 border-t-0 border-solid border-gray-4 th-highcontrast:border-white th-dark:border-gray-7">
+          <div className="border-b border-solid border-gray-4 px-3 py-2 th-dark:border-gray-7">
+            <div className="h-3 w-20 rounded bg-gray-3 th-dark:bg-gray-8" />
+          </div>
+          <div className="flex flex-1 items-center justify-center">
+            <div className="h-3 w-32 rounded bg-gray-2 th-dark:bg-gray-9" />
+          </div>
+        </div>
+      </div>
+
+      <div className="flex items-center justify-between border-b-0 border-l-0 border-r-0 border-t border-solid border-gray-4 px-3 py-2 th-highcontrast:border-white th-dark:border-gray-7">
+        <div className="h-3 w-16 rounded bg-gray-3 th-dark:bg-gray-8" />
+        <div className="h-7 w-16 rounded bg-gray-3 th-dark:bg-gray-8" />
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/components/form-components/FilePicker/SelectedPanel.test.tsx b/app/react/components/form-components/FilePicker/SelectedPanel.test.tsx
new file mode 100644
index 0000000..090aae5
--- /dev/null
+++ b/app/react/components/form-components/FilePicker/SelectedPanel.test.tsx
@@ -0,0 +1,43 @@
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+
+import { SelectedPanel } from './SelectedPanel';
+
+function renderSelectedPanel({
+  selected = new Set<string>(),
+  removeFile = vi.fn(),
+}: {
+  selected?: Set<string>;
+  removeFile?: (path: string) => void;
+} = {}) {
+  const user = userEvent.setup();
+  render(<SelectedPanel selected={selected} removeFile={removeFile} />);
+  return { user, removeFile };
+}
+
+describe('SelectedPanel', () => {
+  it('calls removeFile with the correct path when the remove button is clicked', async () => {
+    const removeFile = vi.fn();
+    const { user } = renderSelectedPanel({
+      selected: new Set(['src/foo.ts']),
+      removeFile,
+    });
+    await user.click(
+      screen.getByRole('button', { name: /remove file \/src\/foo\.ts/i })
+    );
+    expect(removeFile).toHaveBeenCalledWith('src/foo.ts');
+  });
+
+  it('shows "No files selected" when nothing is selected', () => {
+    renderSelectedPanel();
+    expect(screen.getByText(/no files selected/i)).toBeVisible();
+  });
+
+  it('renders all selected file paths', () => {
+    renderSelectedPanel({
+      selected: new Set(['lib/index.ts', 'src/foo.ts']),
+    });
+    expect(screen.getByTitle('/lib/index.ts')).toBeVisible();
+    expect(screen.getByTitle('/src/foo.ts')).toBeVisible();
+  });
+});
diff --git a/app/react/components/form-components/FilePicker/SelectedPanel.tsx b/app/react/components/form-components/FilePicker/SelectedPanel.tsx
new file mode 100644
index 0000000..68af273
--- /dev/null
+++ b/app/react/components/form-components/FilePicker/SelectedPanel.tsx
@@ -0,0 +1,62 @@
+import { X } from 'lucide-react';
+
+import { pluralize } from '@/react/common/string-utils';
+
+import { Badge } from '@@/Badge';
+
+interface Props {
+  selected: Set<string>;
+  removeFile: (path: string) => void;
+}
+
+export function SelectedPanel({ selected, removeFile }: Props) {
+  const selectedPaths = Array.from(selected).sort();
+
+  return (
+    <>
+      <div className="shrink-0 border-b border-l-0 border-r-0 border-t-0 border-solid border-gray-4 px-3 py-2.5 text-sm font-semibold text-gray-11 th-highcontrast:border-white th-highcontrast:text-white th-dark:border-gray-7 th-dark:text-white">
+        {selected.size} Selected {pluralize(selected.size, 'File')}
+      </div>
+      <div className="flex-1 overflow-y-auto">
+        {selectedPaths.length === 0 ? (
+          <p className="px-3 py-4 text-center text-xs text-gray-6 th-highcontrast:text-gray-5 th-dark:text-gray-5">
+            No files selected
+          </p>
+        ) : (
+          selectedPaths.map((path) => (
+            <FileRow key={path} path={path} onRemove={() => removeFile(path)} />
+          ))
+        )}
+      </div>
+    </>
+  );
+}
+
+interface FileRowProps {
+  path: string;
+  onRemove: () => void;
+}
+
+function FileRow({ path, onRemove }: FileRowProps) {
+  return (
+    <div className="flex items-center gap-2 border-b border-l-0 border-r-0 border-t-0 border-solid border-gray-4 bg-blue-1 px-3 py-2.5 th-highcontrast:border-white th-highcontrast:bg-gray-iron-10 th-dark:border-gray-7 th-dark:bg-blue-11">
+      <Badge type="infoSecondary" shape="rect" size="sm" className="uppercase">
+        File
+      </Badge>
+      <span
+        className="min-w-0 flex-1 truncate font-mono text-xs text-gray-11 th-highcontrast:text-white th-dark:text-white"
+        title={`/${path}`}
+      >
+        /{path}
+      </span>
+      <button
+        type="button"
+        onClick={onRemove}
+        className="flex shrink-0 items-center justify-center rounded border-0 bg-transparent p-0.5 text-gray-6 hover:text-gray-9 th-highcontrast:text-white th-dark:text-gray-6"
+        aria-label={`Remove file /${path}`}
+      >
+        <X size={12} />
+      </button>
+    </div>
+  );
+}
diff --git a/app/react/components/form-components/FilePicker/TreeNode.tsx b/app/react/components/form-components/FilePicker/TreeNode.tsx
new file mode 100644
index 0000000..19bef78
--- /dev/null
+++ b/app/react/components/form-components/FilePicker/TreeNode.tsx
@@ -0,0 +1,115 @@
+import { useRef } from 'react';
+import { slugify } from 'markdown-to-jsx';
+
+import { CollapseExpandButton } from '@@/CollapseExpandButton';
+import { Checkbox } from '@@/form-components/Checkbox';
+
+import { isDirectory, getFolderState, isDirectoryWithChildren } from './utils';
+import { TreeNodeIcon } from './TreeNodeIcon';
+import { FileNode } from './types';
+
+const INDENT_PX = 16;
+const DOUBLE_CLICK_DELAY_MS = 250;
+
+interface Props {
+  item: FileNode;
+  depth: number;
+  expanded: Set<string>;
+  selected: Set<string>;
+  nodePath: string;
+  onExpandDirectory: (path: string) => void;
+  onToggleSelect: (path: string, item: FileNode) => void;
+}
+
+export function TreeNode({
+  item,
+  depth,
+  expanded,
+  selected,
+  nodePath,
+  onExpandDirectory,
+  onToggleSelect,
+}: Props) {
+  const isDir = isDirectory(item);
+  const hasSubDir = isDirectoryWithChildren(item);
+  const isOpen = isDir && expanded.has(nodePath);
+  const folderState = isDir ? getFolderState(item, selected, nodePath) : null;
+  const isChecked = isDir ? folderState === 'checked' : selected.has(nodePath);
+  const isIndeterminate = folderState === 'indeterminate';
+
+  const checkboxId = slugify(`${nodePath}/${item.name}`);
+  const clickTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null);
+
+  function handleRowClick() {
+    if (clickTimerRef.current) {
+      clearTimeout(clickTimerRef.current);
+      clickTimerRef.current = null;
+      if (isDir) {
+        onExpandDirectory(nodePath);
+      }
+      return;
+    }
+    clickTimerRef.current = setTimeout(() => {
+      clickTimerRef.current = null;
+      onToggleSelect(nodePath, item);
+    }, DOUBLE_CLICK_DELAY_MS);
+  }
+
+  return (
+    <>
+      <div
+        role="button"
+        tabIndex={0}
+        className="relative flex h-8 cursor-pointer select-none items-center gap-1 pr-2"
+        style={{ paddingLeft: depth * INDENT_PX + 12 }}
+        onClick={handleRowClick}
+        onKeyDown={(e) => {
+          if (e.key === 'Enter' && isDir) onExpandDirectory(nodePath);
+          if (e.key === 'Space') onToggleSelect(nodePath, item);
+        }}
+      >
+        {isDir ? (
+          <CollapseExpandButton
+            quarterRotation
+            isExpanded={isOpen}
+            onClick={() => onExpandDirectory(nodePath)}
+          />
+        ) : (
+          <span className="w-[22px] shrink-0" />
+        )}
+        <Checkbox
+          id={checkboxId}
+          data-cy={checkboxId}
+          checked={isChecked}
+          indeterminate={isIndeterminate}
+          onChange={() => onToggleSelect(nodePath, item)}
+          onClick={(e) => e.stopPropagation()}
+          aria-labelledby={`${checkboxId}-label`}
+        />
+        <TreeNodeIcon node={item} />
+        <span
+          id={`${checkboxId}-label`}
+          className="flex-1 truncate text-sm text-gray-11 th-highcontrast:text-white th-dark:text-white"
+          title={item.name}
+        >
+          {item.name}
+        </span>
+      </div>
+
+      {isOpen &&
+        hasSubDir &&
+        item.children.map((child, index) => (
+          <TreeNode
+            key={`${nodePath}/${child.name}/${index}`}
+            item={child}
+            depth={depth + 1}
+            expanded={expanded}
+            selected={selected}
+            nodePath={`${nodePath}/${child.name}`}
+            onExpandDirectory={onExpandDirectory}
+            onToggleSelect={onToggleSelect}
+          />
+        ))}
+    </>
+  );
+}
diff --git a/app/react/components/form-components/FilePicker/TreeNodeIcon.tsx b/app/react/components/form-components/FilePicker/TreeNodeIcon.tsx
new file mode 100644
index 0000000..d321069
--- /dev/null
+++ b/app/react/components/form-components/FilePicker/TreeNodeIcon.tsx
@@ -0,0 +1,23 @@
+import { File as FileIcon, Folder } from 'lucide-react';
+
+import { isDirectory } from '@@/form-components/FilePicker/utils';
+
+import { Directory, File } from './types';
+
+interface Props {
+  node: Directory | File;
+}
+
+export function TreeNodeIcon({ node }: Props) {
+  return isDirectory(node) ? (
+    <Folder
+      size={14}
+      className="shrink-0 text-blue-7 th-highcontrast:text-white th-dark:text-blue-5"
+    />
+  ) : (
+    <FileIcon
+      size={14}
+      className="shrink-0 text-gray-7 th-highcontrast:text-white th-dark:text-gray-5"
+    />
+  );
+}
diff --git a/app/react/components/form-components/FilePicker/types.ts b/app/react/components/form-components/FilePicker/types.ts
new file mode 100644
index 0000000..c89225f
--- /dev/null
+++ b/app/react/components/form-components/FilePicker/types.ts
@@ -0,0 +1,10 @@
+export type FileNode = Directory | File;
+
+export interface File {
+  name: string;
+}
+
+export interface Directory {
+  name: string;
+  children?: FileNode[];
+}
diff --git a/app/react/components/form-components/FilePicker/utils.test.ts b/app/react/components/form-components/FilePicker/utils.test.ts
new file mode 100644
index 0000000..eb85c4a
--- /dev/null
+++ b/app/react/components/form-components/FilePicker/utils.test.ts
@@ -0,0 +1,121 @@
+import { Directory, File, FileNode } from './types';
+import {
+  isDirectory,
+  getAllFilePaths,
+  getFolderState,
+  filterToPattern,
+} from './utils';
+
+function file(name: string): File {
+  return { name };
+}
+
+function dir(name: string, children: FileNode[] = []): Directory {
+  return { name, children };
+}
+
+describe('isDirectory', () => {
+  it('returns true when the item has a children property', () => {
+    expect(isDirectory(dir('src'))).toBe(true);
+  });
+
+  it('returns true when the children property is present but undefined', () => {
+    const dirWithUndefinedChildren: Directory = {
+      name: 'empty',
+      children: undefined,
+    };
+    expect(isDirectory(dirWithUndefinedChildren)).toBe(true);
+  });
+
+  it('returns false for a file without children', () => {
+    expect(isDirectory(file('foo.ts'))).toBe(false);
+  });
+});
+
+describe('getAllFilePaths', () => {
+  it('returns the node path for a single file', () => {
+    expect(getAllFilePaths(file('foo.ts'), 'foo.ts')).toEqual(['foo.ts']);
+  });
+
+  it('returns all child file paths for a flat directory', () => {
+    const node = dir('src', [file('a.ts'), file('b.ts')]);
+    expect(getAllFilePaths(node, 'src')).toEqual(['src/a.ts', 'src/b.ts']);
+  });
+
+  it('returns an empty array for an empty directory', () => {
+    expect(getAllFilePaths(dir('empty'), 'empty')).toEqual([]);
+  });
+
+  it('returns deeply nested file paths', () => {
+    const node = dir('root', [dir('sub', [file('deep.ts')])]);
+    expect(getAllFilePaths(node, 'root')).toEqual(['root/sub/deep.ts']);
+  });
+
+  it('returns all paths across multiple nested levels', () => {
+    const node = dir('a', [
+      file('top.ts'),
+      dir('b', [file('nested.ts'), dir('c', [file('deep.ts')])]),
+    ]);
+    expect(getAllFilePaths(node, 'a').sort()).toEqual([
+      'a/b/c/deep.ts',
+      'a/b/nested.ts',
+      'a/top.ts',
+    ]);
+  });
+});
+
+describe('getFolderState', () => {
+  const tree = dir('src', [file('a.ts'), file('b.ts')]);
+
+  it('returns unchecked when no files are selected', () => {
+    expect(getFolderState(tree, new Set(), 'src')).toBe('unchecked');
+  });
+
+  it('returns checked when all files in the directory are selected', () => {
+    expect(getFolderState(tree, new Set(['src/a.ts', 'src/b.ts']), 'src')).toBe(
+      'checked'
+    );
+  });
+
+  it('returns indeterminate when some but not all files are selected', () => {
+    expect(getFolderState(tree, new Set(['src/a.ts']), 'src')).toBe(
+      'indeterminate'
+    );
+  });
+
+  it('returns unchecked for an empty directory', () => {
+    expect(getFolderState(dir('empty'), new Set(), 'empty')).toBe('unchecked');
+  });
+
+  it('ignores selected paths outside the directory', () => {
+    expect(getFolderState(tree, new Set(['other/file.ts']), 'src')).toBe(
+      'unchecked'
+    );
+  });
+});
+
+describe('filterToPattern', () => {
+  it('wraps plain text with wildcards', () => {
+    expect(filterToPattern('foo')).toBe('*foo*');
+  });
+
+  it('leaves a glob pattern with * unchanged', () => {
+    expect(filterToPattern('*.yml')).toBe('*.yml');
+  });
+
+  it('leaves a glob pattern with ? unchanged', () => {
+    expect(filterToPattern('file?.ts')).toBe('file?.ts');
+  });
+
+  it('trims whitespace before wrapping plain text', () => {
+    expect(filterToPattern('  foo  ')).toBe('*foo*');
+  });
+
+  it('trims whitespace before preserving a glob', () => {
+    expect(filterToPattern('  *.yml  ')).toBe('*.yml');
+  });
+
+  it('handles empty string after trimming', () => {
+    expect(filterToPattern('   ')).toBe('**');
+  });
+});
diff --git a/app/react/components/form-components/FilePicker/utils.ts b/app/react/components/form-components/FilePicker/utils.ts
new file mode 100644
index 0000000..daa73c6
--- /dev/null
+++ b/app/react/components/form-components/FilePicker/utils.ts
@@ -0,0 +1,39 @@
+import { Directory, FileNode } from './types';
+
+export function isDirectory(item: FileNode): item is Directory {
+  return 'children' in item;
+}
+
+export function isDirectoryWithChildren(
+  item: FileNode
+): item is Required<Directory> {
+  return isDirectory(item) && 'children' in item;
+}
+
+export function getAllFilePaths(item: FileNode, nodePath: string): string[] {
+  if (!isDirectory(item)) {
+    return [nodePath];
+  }
+  return (item.children ?? []).flatMap((child) =>
+    getAllFilePaths(child, `${nodePath}/${child.name}`)
+  );
+}
+
+export function getFolderState(
+  item: Directory,
+  selected: Set<string>,
+  nodePath: string
+): 'checked' | 'indeterminate' | 'unchecked' {
+  const filePaths = getAllFilePaths(item, nodePath);
+  if (filePaths.length === 0) return 'unchecked';
+  const selectedCount = filePaths.filter((p) => selected.has(p)).length;
+  if (selectedCount === filePaths.length) return 'checked';
+  if (selectedCount > 0) return 'indeterminate';
+  return 'unchecked';
+}
+
+export function filterToPattern(text: string): string {
+  const t = text.trim();
+  if (/[*?]/.test(t)) return t;
+  return `*${t}*`;
+}
diff --git a/app/react/components/form-components/FileUpload/FileUploadField.stories.tsx b/app/react/components/form-components/FileUpload/FileUploadField.stories.tsx
new file mode 100644
index 0000000..d2fdb23
--- /dev/null
+++ b/app/react/components/form-components/FileUpload/FileUploadField.stories.tsx
@@ -0,0 +1,34 @@
+import { Meta } from '@storybook/react-webpack5';
+import { useState } from 'react';
+
+import { FileUploadField } from './FileUploadField';
+
+export default {
+  component: FileUploadField,
+  title: 'Components/Buttons/FileUploadField',
+} as Meta;
+
+interface Args {
+  title: string;
+}
+
+export { Example };
+
+function Example({ title }: Args) {
+  const [value, setValue] = useState<File>();
+  function onChange(value: File) {
+    if (value) {
+      setValue(value);
+    }
+  }
+
+  return (
+    <FileUploadField
+      onChange={onChange}
+      value={value}
+      title={title}
+      inputId="file-field"
+      data-cy="file-upload-field"
+    />
+  );
+}
diff --git a/app/react/components/form-components/FileUpload/FileUploadField.test.tsx b/app/react/components/form-components/FileUpload/FileUploadField.test.tsx
new file mode 100644
index 0000000..dfb10f6
--- /dev/null
+++ b/app/react/components/form-components/FileUpload/FileUploadField.test.tsx
@@ -0,0 +1,102 @@
+import { fireEvent, render } from '@testing-library/react';
+
+import { FileUploadField } from './FileUploadField';
+
+test('render should make the file button clickable and fire onChange event after click', async () => {
+  const onClick = vi.fn();
+  const { findByText, findByTestId } = render(
+    <FileUploadField
+      title="test button"
+      data-cy="file-upload"
+      onChange={onClick}
+      inputId="file-field"
+    />
+  );
+
+  const button = await findByText('test button');
+  expect(button).toBeVisible();
+
+  const input = await findByTestId('file-upload-input');
+  expect(input).not.toBeNull();
+
+  const mockFile = new File([], 'file.txt');
+  if (input) {
+    fireEvent.change(input, {
+      target: { files: [mockFile] },
+    });
+  }
+  expect(onClick).toHaveBeenCalledWith(mockFile);
+});
+
+describe('state icons', () => {
+  test('renders a spinning icon when state is uploading', () => {
+    const { getByTestId } = render(
+      <FileUploadField
+        inputId="file-field"
+        onChange={() => {}}
+        state="uploading"
+        data-cy="file-upload"
+      />
+    );
+
+    expect(getByTestId('file-upload-uploading-icon')).toBeVisible();
+  });
+
+  test('renders a success icon when state is success', () => {
+    const { getByTestId } = render(
+      <FileUploadField
+        inputId="file-field"
+        onChange={() => {}}
+        state="success"
+        data-cy="file-upload"
+      />
+    );
+
+    expect(getByTestId('file-upload-success-icon')).toBeVisible();
+  });
+
+  test('shows state icon even when hideFilename is true', () => {
+    const { getByTestId } = render(
+      <FileUploadField
+        inputId="file-field"
+        onChange={() => {}}
+        state="success"
+        hideFilename
+        data-cy="file-upload"
+      />
+    );
+
+    expect(getByTestId('file-upload-success-icon')).toBeVisible();
+  });
+
+  test('shows danger icon when required and no state or file', () => {
+    const { getByTestId } = render(
+      <FileUploadField
+        inputId="file-field"
+        onChange={() => {}}
+        required
+        hideFilename
+        data-cy="file-upload"
+      />
+    );
+
+    expect(getByTestId('file-upload-required-icon')).toBeVisible();
+  });
+});
+
+describe('disabled prop', () => {
+  test('disables both the button and the hidden input when disabled is true', () => {
+    const { getByRole, getByTestId } = render(
+      <FileUploadField
+        inputId="file-field"
+        data-cy="file-upload"
+        onChange={() => {}}
+        disabled
+        required
+      />
+    );
+
+    expect(getByRole('button')).toBeDisabled();
+    expect(getByTestId('file-upload-input')).toBeDisabled();
+  });
+});
diff --git a/app/react/components/form-components/FileUpload/FileUploadField.tsx b/app/react/components/form-components/FileUpload/FileUploadField.tsx
new file mode 100644
index 0000000..6f4527d
--- /dev/null
+++ b/app/react/components/form-components/FileUpload/FileUploadField.tsx
@@ -0,0 +1,147 @@
+import clsx from 'clsx';
+import { ChangeEvent, ComponentProps, createRef } from 'react';
+import { CheckIcon, Loader2Icon, UploadIcon, XCircleIcon } from 'lucide-react';
+
+import { AutomationTestingProps } from '@/types';
+
+import { Button } from '@@/buttons';
+import { Icon } from '@@/Icon';
+import { Tooltip } from '@@/Tip/Tooltip';
+
+export interface Props extends AutomationTestingProps {
+  onChange(value: File): void;
+  value?: File | null;
+  accept?: string;
+  title?: string;
+  required?: boolean;
+  inputId: string;
+  className?: string;
+  color?: ComponentProps<typeof Button>['color'];
+  name?: string;
+  hideFilename?: boolean;
+  tooltip?: string;
+  state?: 'uploading' | 'success';
+  disabled?: boolean;
+}
+
+export function FileUploadField({
+  onChange,
+  value,
+  accept,
+  title = 'Select a file',
+  required = false,
+  inputId,
+  className,
+  color = 'primary',
+  name,
+  hideFilename,
+  tooltip,
+  disabled,
+  state,
+  'data-cy': dataCy,
+}: Props) {
+  const fileRef = createRef<HTMLInputElement>();
+
+  return (
+    <div className="flex items-center gap-2">
+      <input
+        id={inputId}
+        ref={fileRef}
+        type="file"
+        accept={accept}
+        required={required}
+        disabled={disabled}
+        className="!hidden"
+        onChange={changeHandler}
+        name={name}
+        data-cy={`${dataCy}-input`}
+      />
+      <Button
+        size="small"
+        color={color}
+        onClick={handleButtonClick}
+        className={clsx('!ml-0', className)}
+        data-cy={dataCy}
+        icon={UploadIcon}
+        disabled={disabled}
+      >
+        {title}
+      </Button>
+      {tooltip && <Tooltip message={tooltip} />}
+
+      <FileStatus
+        state={state}
+        value={value}
+        hideFilename={hideFilename}
+        required={required}
+        dataCy={dataCy}
+      />
+    </div>
+  );
+
+  function handleButtonClick() {
+    if (fileRef && fileRef.current) {
+      fileRef.current.click();
+    }
+  }
+
+  function changeHandler(event: ChangeEvent<HTMLInputElement>) {
+    if (event.target && event.target.files && event.target.files.length > 0) {
+      onChange(event.target.files[0]);
+    }
+  }
+}
+
+function FileStatus({
+  state,
+  value,
+  hideFilename,
+  required,
+  dataCy,
+}: {
+  state?: 'uploading' | 'success';
+  value?: File | null;
+  hideFilename?: boolean;
+  required?: boolean;
+  dataCy?: string;
+}) {
+  const stateIcon = getStateIcon(state, dataCy);
+  const filename = !hideFilename && value ? value.name : null;
+
+  if (stateIcon || filename) {
+    return (
+      <span className="flex items-center gap-2">
+        {stateIcon}
+        {filename}
+      </span>
+    );
+  }
+
+  if (required) {
+    return (
+      <span data-cy={dataCy ? `${dataCy}-required-icon` : undefined}>
+        <Icon icon={XCircleIcon} mode="danger" />
+      </span>
+    );
+  }
+
+  return null;
+}
+
+function getStateIcon(state?: 'uploading' | 'success', dataCy?: string) {
+  if (state === 'uploading') {
+    return (
+      <span data-cy={dataCy ? `${dataCy}-uploading-icon` : undefined}>
+        <Icon icon={Loader2Icon} className="animate-spin-slow" />
+      </span>
+    );
+  }
+  if (state === 'success') {
+    return (
+      <span data-cy={dataCy ? `${dataCy}-success-icon` : undefined}>
+        <Icon icon={CheckIcon} mode="success" />
+      </span>
+    );
+  }
+  return null;
+}
diff --git a/app/react/components/form-components/FileUpload/FileUploadForm.stories.tsx b/app/react/components/form-components/FileUpload/FileUploadForm.stories.tsx
new file mode 100644
index 0000000..1c4332e
--- /dev/null
+++ b/app/react/components/form-components/FileUpload/FileUploadForm.stories.tsx
@@ -0,0 +1,38 @@
+import { Meta } from '@storybook/react-webpack5';
+import { useState } from 'react';
+
+import { FileUploadForm } from './FileUploadForm';
+
+export default {
+  component: FileUploadForm,
+  title: 'Components/Forms/FileUploadForm',
+} as Meta;
+
+interface Args {
+  title: string;
+}
+
+export { Example };
+
+function Example({ title }: Args) {
+  const [value, setValue] = useState<File>();
+  function onChange(value: File) {
+    if (value) {
+      setValue(value);
+    }
+  }
+
+  return (
+    <div className="form-horizontal">
+      <FileUploadForm
+        onChange={onChange}
+        value={value}
+        title={title}
+        description={
+          <span>You can upload a Compose file from your computer.</span>
+        }
+        data-cy="file-upload-form"
+      />
+    </div>
+  );
+}
diff --git a/app/react/components/form-components/FileUpload/FileUploadForm.test.tsx b/app/react/components/form-components/FileUpload/FileUploadForm.test.tsx
new file mode 100644
index 0000000..1f96525
--- /dev/null
+++ b/app/react/components/form-components/FileUpload/FileUploadForm.test.tsx
@@ -0,0 +1,22 @@
+import { render } from '@testing-library/react';
+
+import { FileUploadForm } from './FileUploadForm';
+
+test('render should include description', async () => {
+  const onClick = vi.fn();
+  const { findByText } = render(
+    <FileUploadForm
+      value={undefined}
+      title="test button"
+      onChange={onClick}
+      description={<span>test description</span>}
+      data-cy="test"
+    />
+  );
+
+  const button = await findByText('test button');
+  expect(button).toBeVisible();
+
+  const description = await findByText('test description');
+  expect(description).toBeVisible();
+});
diff --git a/app/react/components/form-components/FileUpload/FileUploadForm.tsx b/app/react/components/form-components/FileUpload/FileUploadForm.tsx
new file mode 100644
index 0000000..bae092a
--- /dev/null
+++ b/app/react/components/form-components/FileUpload/FileUploadForm.tsx
@@ -0,0 +1,53 @@
+import { PropsWithChildren, ReactNode } from 'react';
+
+import { AutomationTestingProps } from '@/types';
+
+import { FormSectionTitle } from '@@/form-components/FormSectionTitle';
+import { FileUploadField } from '@@/form-components/FileUpload/FileUploadField';
+
+import { FormError } from '../FormError';
+
+export interface Props {
+  onChange(value?: File): void;
+  value: File | undefined;
+  title?: string;
+  required?: boolean;
+  description: ReactNode;
+  error?: string;
+}
+
+export function FileUploadForm({
+  onChange,
+  value,
+  title = 'Select a file',
+  required = false,
+  description,
+  error,
+  'data-cy': dataCy,
+}: PropsWithChildren<Props> & AutomationTestingProps) {
+  return (
+    <div className="file-upload-form">
+      <FormSectionTitle htmlFor="file-upload-field">Upload</FormSectionTitle>
+      <div className="form-group">
+        <span className="col-sm-12 text-muted small">{description}</span>
+        {error && (
+          <div className="col-sm-12">
+            <FormError>{error}</FormError>
+          </div>
+        )}
+      </div>
+      <div className="form-group">
+        <div className="col-sm-12">
+          <FileUploadField
+            inputId="file-upload-field"
+            data-cy={dataCy}
+            onChange={onChange}
+            value={value}
+            title={title}
+            required={required}
+          />
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/components/form-components/FileUpload/index.ts b/app/react/components/form-components/FileUpload/index.ts
new file mode 100644
index 0000000..6ca730f
--- /dev/null
+++ b/app/react/components/form-components/FileUpload/index.ts
@@ -0,0 +1,2 @@
+export { FileUploadField } from './FileUploadField';
+export { FileUploadForm } from './FileUploadForm';
diff --git a/app/react/components/form-components/FormActions.tsx b/app/react/components/form-components/FormActions.tsx
new file mode 100644
index 0000000..413acfd
--- /dev/null
+++ b/app/react/components/form-components/FormActions.tsx
@@ -0,0 +1,56 @@
+import { ComponentProps, PropsWithChildren } from 'react';
+
+import { AutomationTestingProps } from '@/types';
+
+import { LoadingButton } from '@@/buttons';
+
+import { FormSection } from './FormSection';
+
+interface Props extends AutomationTestingProps {
+  submitLabel: string;
+  loadingText: string;
+  isLoading: boolean;
+  isValid: boolean;
+  errors?: unknown;
+  submitIcon?: ComponentProps<typeof LoadingButton>['icon'];
+}
+
+export function FormActions({
+  submitLabel = 'Save',
+  loadingText = 'Saving',
+  isLoading,
+  children,
+  isValid,
+  errors,
+  submitIcon,
+  'data-cy': dataCy,
+}: PropsWithChildren<Props>) {
+  return (
+    <FormSection title="Actions">
+      <div className="form-group">
+        <div className="col-sm-12">
+          <div className="item-center flex gap-3">
+            <LoadingButton
+              className="!ml-0"
+              loadingText={loadingText}
+              isLoading={isLoading}
+              disabled={!isValid}
+              data-cy={dataCy}
+              icon={submitIcon}
+            >
+              {submitLabel}
+            </LoadingButton>
+
+            {!isValid && (
+              <div className="hidden" data-cy="errors">
+                {JSON.stringify(errors)}
+              </div>
+            )}
+
+            {children}
+          </div>
+        </div>
+      </div>
+    </FormSection>
+  );
+}
diff --git a/app/react/components/form-components/FormControl/FormControl.stories.tsx b/app/react/components/form-components/FormControl/FormControl.stories.tsx
new file mode 100644
index 0000000..dd65007
--- /dev/null
+++ b/app/react/components/form-components/FormControl/FormControl.stories.tsx
@@ -0,0 +1,98 @@
+import { Meta } from '@storybook/react-webpack5';
+import { useState } from 'react';
+
+import { Input, Select } from '../Input';
+
+import { FormControl } from './FormControl';
+
+export default {
+  title: 'Components/Forms/Control',
+} as Meta;
+
+interface TextFieldProps {
+  label: string;
+  tooltip?: string;
+  vertical?: boolean;
+  required?: boolean;
+  error?: string;
+}
+
+export { TextField, SelectField };
+
+function TextField({
+  label,
+  tooltip = '',
+  required,
+  error,
+  vertical,
+}: TextFieldProps) {
+  const [value, setValue] = useState('');
+  const inputId = 'input';
+  return (
+    <FormControl
+      inputId={inputId}
+      label={label}
+      tooltip={tooltip}
+      required={required}
+      errors={error}
+      size={vertical ? 'vertical' : undefined}
+    >
+      <Input
+        id={inputId}
+        type="text"
+        value={value}
+        onChange={(e) => setValue(e.target.value)}
+        data-cy="input"
+      />
+    </FormControl>
+  );
+}
+
+TextField.args = {
+  label: 'label',
+  tooltip: '',
+  vertical: false,
+  required: false,
+  error: '',
+};
+
+function SelectField({
+  label,
+  tooltip = '',
+  vertical,
+  required,
+  error,
+}: TextFieldProps) {
+  const options = [
+    { value: 1, label: 'one' },
+    { value: 2, label: 'two' },
+  ];
+  const [value, setValue] = useState(0);
+  const inputId = 'input';
+  return (
+    <FormControl
+      inputId={inputId}
+      label={label}
+      tooltip={tooltip}
+      size={vertical ? 'vertical' : undefined}
+      required={required}
+      errors={error}
+    >
+      <Select
+        className="form-control"
+        data-cy="select"
+        value={value}
+        onChange={(e) => setValue(parseInt(e.target.value, 10))}
+        options={options}
+      />
+    </FormControl>
+  );
+}
+
+SelectField.args = {
+  label: 'select',
+  tooltip: '',
+  vertical: false,
+  required: false,
+  error: '',
+};
diff --git a/app/react/components/form-components/FormControl/FormControl.test.tsx b/app/react/components/form-components/FormControl/FormControl.test.tsx
new file mode 100644
index 0000000..225720e
--- /dev/null
+++ b/app/react/components/form-components/FormControl/FormControl.test.tsx
@@ -0,0 +1,30 @@
+import { render } from '@testing-library/react';
+
+import { FormControl, Props } from './FormControl';
+
+function renderDefault({
+  inputId = 'id',
+  label,
+  tooltip = '',
+
+  errors,
+}: Partial<Props>) {
+  return render(
+    <FormControl
+      inputId={inputId}
+      label={label}
+      tooltip={tooltip}
+      errors={errors}
+    >
+      <input />
+    </FormControl>
+  );
+}
+
+test('should display a Input component', async () => {
+  const label = 'test label';
+  const { findByText } = renderDefault({ label });
+
+  const inputElem = await findByText(label);
+  expect(inputElem).toBeTruthy();
+});
diff --git a/app/react/components/form-components/FormControl/FormControl.tsx b/app/react/components/form-components/FormControl/FormControl.tsx
new file mode 100644
index 0000000..40e0a6a
--- /dev/null
+++ b/app/react/components/form-components/FormControl/FormControl.tsx
@@ -0,0 +1,106 @@
+import { PropsWithChildren, ReactNode } from 'react';
+import clsx from 'clsx';
+
+import { Tooltip } from '@@/Tip/Tooltip';
+import { InlineLoader } from '@@/InlineLoader';
+
+import { FormError } from '../FormError';
+
+export type Size = 'xsmall' | 'small' | 'medium' | 'large' | 'vertical';
+
+export interface Props {
+  inputId?: string;
+  dataCy?: string;
+  label: ReactNode;
+  size?: Size;
+  tooltip?: ReactNode;
+  setTooltipHtmlMessage?: boolean;
+  children?: ReactNode;
+  errors?: ReactNode;
+  required?: boolean;
+  className?: string;
+  isLoading?: boolean; // whether to show an inline loader, instead of the children
+  loadingText?: ReactNode; // text to show when isLoading is true
+}
+
+export function FormControl({
+  inputId,
+  dataCy,
+  label,
+  size = 'small',
+  tooltip = '',
+  children,
+  errors,
+  className,
+  required = false,
+  setTooltipHtmlMessage,
+  isLoading = false,
+  loadingText = 'Loading...',
+}: PropsWithChildren<Props>) {
+  return (
+    <div
+      className={clsx(
+        className,
+        'form-group',
+        'after:clear-both after:table after:content-[""]' // to fix issues with float
+      )}
+      data-cy={dataCy}
+    >
+      <label
+        htmlFor={inputId}
+        className={clsx(sizeClassLabel(size), 'control-label', 'text-left')}
+      >
+        {label}
+
+        {required && <span className="text-danger">*</span>}
+
+        {tooltip && (
+          <Tooltip message={tooltip} setHtmlMessage={setTooltipHtmlMessage} />
+        )}
+      </label>
+
+      <div className={clsx('flex flex-col', sizeClassChildren(size))}>
+        {isLoading && (
+          // 34px height to reduce layout shift when loading is complete
+          <div className="flex h-[34px] items-center">
+            <InlineLoader>{loadingText}</InlineLoader>
+          </div>
+        )}
+        {!isLoading && children}
+        {!!errors && !isLoading && <FormError>{errors}</FormError>}
+      </div>
+    </div>
+  );
+}
+
+function sizeClassLabel(size: Size) {
+  switch (size) {
+    case 'large':
+      return 'col-sm-5 col-lg-4';
+    case 'medium':
+      return 'col-sm-4 col-lg-3';
+    case 'xsmall':
+      return 'col-sm-1';
+    case 'vertical':
+      return '';
+    case 'small':
+    default:
+      return 'col-sm-3 col-lg-2';
+  }
+}
+
+function sizeClassChildren(size: Size) {
+  switch (size) {
+    case 'large':
+      return 'col-sm-7 col-lg-8';
+    case 'medium':
+      return 'col-sm-8 col-lg-9';
+    case 'xsmall':
+      return 'col-sm-11';
+    case 'vertical':
+      return '';
+    case 'small':
+    default:
+      return 'col-sm-9 col-lg-10';
+  }
+}
diff --git a/app/react/components/form-components/FormControl/index.ts b/app/react/components/form-components/FormControl/index.ts
new file mode 100644
index 0000000..46b99fa
--- /dev/null
+++ b/app/react/components/form-components/FormControl/index.ts
@@ -0,0 +1,2 @@
+export { FormControl } from './FormControl';
+export type { Size } from './FormControl';
diff --git a/app/react/components/form-components/FormError.tsx b/app/react/components/form-components/FormError.tsx
new file mode 100644
index 0000000..1b638a0
--- /dev/null
+++ b/app/react/components/form-components/FormError.tsx
@@ -0,0 +1,34 @@
+import { PropsWithChildren } from 'react';
+import clsx from 'clsx';
+import { AlertTriangle } from 'lucide-react';
+
+import { Icon } from '@@/Icon';
+
+interface Props {
+  className?: string;
+}
+
+export function FormError({ children, className }: PropsWithChildren<Props>) {
+  if (!children) {
+    return null;
+  }
+
+  return (
+    <div
+      className={clsx(
+        `text-muted help-block !inline-flex gap-1 !align-top text-xs`,
+        className
+      )}
+      role="alert"
+      aria-label={typeof children === 'string' ? children : undefined}
+    >
+      <Icon
+        icon={AlertTriangle}
+        mode="warning"
+        size="sm"
+        className="flex-none"
+      />
+      <div className="text-warning">{children}</div>
+    </div>
+  );
+}
diff --git a/app/react/components/form-components/FormSection/FormSection.stories.tsx b/app/react/components/form-components/FormSection/FormSection.stories.tsx
new file mode 100644
index 0000000..0d80740
--- /dev/null
+++ b/app/react/components/form-components/FormSection/FormSection.stories.tsx
@@ -0,0 +1,43 @@
+import { Meta, StoryFn } from '@storybook/react-webpack5';
+
+import { FormSection } from './FormSection';
+
+export default {
+  component: FormSection,
+  title: 'Components/Forms/FormSection',
+} as Meta;
+
+interface Args {
+  title: string;
+  content: string;
+}
+
+function Template({ title, content }: Args) {
+  return <FormSection title={title}>{content}</FormSection>;
+}
+
+const exampleContent = `Content
+  
+  Lorem ipsum dolor sit amet, consectetur adipiscing elit. Etiam egestas turpis magna,
+   vel pretium dui rhoncus nec. Maecenas felis purus, consectetur non porta sit amet,
+    auctor sed sapien. Aliquam eu nunc felis. Pellentesque pulvinar velit id quam pellentesque,
+     nec imperdiet dui finibus. In blandit augue nibh, nec tincidunt nisi porttitor quis.
+      Nullam nec nibh maximus, consequat quam sed, dapibus purus. Donec facilisis commodo mi, in commodo augue molestie sed.
+  `;
+
+export const Example: StoryFn<Args> = Template.bind({});
+Example.args = {
+  title: 'title',
+  content: exampleContent,
+};
+
+export function FoldableSection({
+  title = 'title',
+  content = exampleContent,
+}: Args) {
+  return (
+    <FormSection title={title} isFoldable>
+      {content}
+    </FormSection>
+  );
+}
diff --git a/app/react/components/form-components/FormSection/FormSection.tsx b/app/react/components/form-components/FormSection/FormSection.tsx
new file mode 100644
index 0000000..79fd743
--- /dev/null
+++ b/app/react/components/form-components/FormSection/FormSection.tsx
@@ -0,0 +1,68 @@
+import { PropsWithChildren, ReactNode, useState } from 'react';
+
+import { CollapseExpandButton } from '@@/CollapseExpandButton';
+
+import { FormSectionTitle } from '../FormSectionTitle';
+
+interface Props {
+  id?: string;
+  title: ReactNode;
+  titleSize?: 'sm' | 'md' | 'lg';
+  isFoldable?: boolean;
+  defaultFolded?: boolean;
+  titleClassName?: string;
+  className?: string;
+  htmlFor?: string;
+  setIsDefaultFolded?: (isDefaultFolded: boolean) => void;
+}
+
+let componentIndex = 0;
+
+export function FormSection({
+  id,
+  title,
+  titleSize = 'md',
+  children,
+  isFoldable = false,
+  defaultFolded = isFoldable,
+  titleClassName,
+  className,
+  htmlFor = '',
+  setIsDefaultFolded,
+}: PropsWithChildren<Props>) {
+  const [labelId] = useState(
+    () => `form-section-label-${componentIndex++}` as const
+  );
+  const [isExpanded, setIsExpanded] = useState(!defaultFolded);
+
+  const collapsibleIdSuffix = typeof title === 'string' ? title : id || labelId;
+  const collapsibleId = `foldingButton${collapsibleIdSuffix}`;
+
+  return (
+    <section className={className} id={id} aria-labelledby={labelId}>
+      <FormSectionTitle
+        htmlFor={isFoldable ? collapsibleId : htmlFor}
+        titleSize={titleSize}
+        className={titleClassName}
+        id={labelId}
+      >
+        {isFoldable && (
+          <CollapseExpandButton
+            isExpanded={isExpanded}
+            data-cy={collapsibleId}
+            id={collapsibleId}
+            onClick={() => {
+              setIsExpanded((isExpanded) => !isExpanded);
+              setIsDefaultFolded?.(isExpanded);
+            }}
+          />
+        )}
+
+        {title}
+      </FormSectionTitle>
+      {/* col-sm-12 in the title has a 'float: left' style - 'clear-both' makes sure it doesn't get in the way of the next div */}
+      {/* https://stackoverflow.com/questions/7759837/put-divs-below-floatleft-divs */}
+      <div className="clear-both">{isExpanded && children}</div>
+    </section>
+  );
+}
diff --git a/app/react/components/form-components/FormSection/index.ts b/app/react/components/form-components/FormSection/index.ts
new file mode 100644
index 0000000..f9b071e
--- /dev/null
+++ b/app/react/components/form-components/FormSection/index.ts
@@ -0,0 +1 @@
+export { FormSection } from './FormSection';
diff --git a/app/react/components/form-components/FormSectionTitle/FormSectionTitle.stories.tsx b/app/react/components/form-components/FormSectionTitle/FormSectionTitle.stories.tsx
new file mode 100644
index 0000000..0c0b1a8
--- /dev/null
+++ b/app/react/components/form-components/FormSectionTitle/FormSectionTitle.stories.tsx
@@ -0,0 +1,20 @@
+import { Meta, StoryFn } from '@storybook/react-webpack5';
+import { PropsWithChildren } from 'react';
+
+import { FormSectionTitle } from './FormSectionTitle';
+
+export default {
+  component: FormSectionTitle,
+  title: 'Components/Forms/FormSectionTitle',
+} as Meta;
+
+function Template({
+  children,
+}: JSX.IntrinsicAttributes & PropsWithChildren<unknown>) {
+  return <FormSectionTitle>{children}</FormSectionTitle>;
+}
+
+export const Example: StoryFn<PropsWithChildren<unknown>> = Template.bind({});
+Example.args = {
+  children: 'This is a title with children',
+};
diff --git a/app/react/components/form-components/FormSectionTitle/FormSectionTitle.test.tsx b/app/react/components/form-components/FormSectionTitle/FormSectionTitle.test.tsx
new file mode 100644
index 0000000..cb89615
--- /dev/null
+++ b/app/react/components/form-components/FormSectionTitle/FormSectionTitle.test.tsx
@@ -0,0 +1,13 @@
+import { render } from '@testing-library/react';
+
+import { FormSectionTitle } from './FormSectionTitle';
+
+test('should display a FormSectionTitle with children', async () => {
+  const children = 'test form title';
+  const { findByText } = render(
+    <FormSectionTitle>{children}</FormSectionTitle>
+  );
+
+  const heading = await findByText(children);
+  expect(heading).toBeTruthy();
+});
diff --git a/app/react/components/form-components/FormSectionTitle/FormSectionTitle.tsx b/app/react/components/form-components/FormSectionTitle/FormSectionTitle.tsx
new file mode 100644
index 0000000..f106190
--- /dev/null
+++ b/app/react/components/form-components/FormSectionTitle/FormSectionTitle.tsx
@@ -0,0 +1,51 @@
+import clsx from 'clsx';
+import { PropsWithChildren } from 'react';
+
+interface Props {
+  htmlFor?: string;
+  titleSize?: 'sm' | 'md' | 'lg';
+  className?: string;
+  id?: string;
+}
+
+const tailwindTitleSize = {
+  sm: 'text-sm',
+  md: 'text-base',
+  lg: 'text-lg',
+};
+
+export function FormSectionTitle({
+  children,
+  htmlFor,
+  titleSize = 'md',
+  className,
+  id,
+}: PropsWithChildren<Props>) {
+  if (htmlFor) {
+    return (
+      <label
+        htmlFor={htmlFor}
+        className={clsx(
+          'col-sm-12 mb-2 mt-1 flex cursor-pointer items-center pl-0 font-medium',
+          tailwindTitleSize[titleSize],
+          className
+        )}
+        id={id}
+      >
+        {children}
+      </label>
+    );
+  }
+  return (
+    <div
+      className={clsx(
+        'col-sm-12 mb-2 mt-4 pl-0 font-medium',
+        tailwindTitleSize[titleSize],
+        className
+      )}
+      id={id}
+    >
+      {children}
+    </div>
+  );
+}
diff --git a/app/react/components/form-components/FormSectionTitle/index.ts b/app/react/components/form-components/FormSectionTitle/index.ts
new file mode 100644
index 0000000..79bc7bd
--- /dev/null
+++ b/app/react/components/form-components/FormSectionTitle/index.ts
@@ -0,0 +1 @@
+export { FormSectionTitle } from './FormSectionTitle';
diff --git a/app/react/components/form-components/Input/Input.stories.tsx b/app/react/components/form-components/Input/Input.stories.tsx
new file mode 100644
index 0000000..2b185e0
--- /dev/null
+++ b/app/react/components/form-components/Input/Input.stories.tsx
@@ -0,0 +1,33 @@
+import { Meta, StoryFn } from '@storybook/react-webpack5';
+import { useState } from 'react';
+
+import { Input } from './Input';
+
+export default {
+  title: 'Components/Forms/Input',
+  args: {
+    disabled: false,
+  },
+} as Meta;
+
+interface Args {
+  disabled?: boolean;
+}
+
+export function TextField({ disabled }: Args) {
+  const [value, setValue] = useState('');
+  return (
+    <Input
+      type="text"
+      value={value}
+      onChange={(e) => setValue(e.target.value)}
+      disabled={disabled}
+      data-cy="docker-logging-options-input"
+    />
+  );
+}
+
+export const DisabledTextField: StoryFn<Args> = TextField.bind({});
+DisabledTextField.args = {
+  disabled: true,
+};
diff --git a/app/react/components/form-components/Input/Input.tsx b/app/react/components/form-components/Input/Input.tsx
new file mode 100644
index 0000000..2192e10
--- /dev/null
+++ b/app/react/components/form-components/Input/Input.tsx
@@ -0,0 +1,37 @@
+import clsx from 'clsx';
+import { forwardRef, InputHTMLAttributes, Ref } from 'react';
+
+import { AutomationTestingProps } from '@/types';
+
+export const InputWithRef = forwardRef<
+  HTMLInputElement,
+  InputHTMLAttributes<HTMLInputElement> & AutomationTestingProps
+>(
+  // eslint-disable-next-line react/jsx-props-no-spreading
+  (props, ref) => <Input {...props} mRef={ref} />
+);
+
+InputWithRef.displayName = 'InputWithRef';
+
+export function Input({
+  className,
+  mRef: ref,
+  value,
+  type,
+  'data-cy': dataCy,
+  ...props
+}: InputHTMLAttributes<HTMLInputElement> & {
+  mRef?: Ref<HTMLInputElement>;
+} & AutomationTestingProps) {
+  return (
+    <input
+      // eslint-disable-next-line react/jsx-props-no-spreading
+      {...props}
+      type={type}
+      value={type === 'number' && Number.isNaN(value) ? '' : value} // avoid the `"NaN" cannot be parsed, or is out of range.` error for an empty number input
+      ref={ref}
+      className={clsx('form-control', className)}
+      data-cy={dataCy}
+    />
+  );
+}
diff --git a/app/react/components/form-components/Input/InputLabeled.stories.tsx b/app/react/components/form-components/Input/InputLabeled.stories.tsx
new file mode 100644
index 0000000..7ef393a
--- /dev/null
+++ b/app/react/components/form-components/Input/InputLabeled.stories.tsx
@@ -0,0 +1,38 @@
+import { Meta } from '@storybook/react-webpack5';
+import { useState } from 'react';
+
+import { InputLabeled } from './InputLabeled';
+
+export default {
+  component: InputLabeled,
+  title: 'Components/Forms/InputLabeled',
+} as Meta;
+
+export { TextInput, NumberInput };
+
+function TextInput() {
+  const [value, setValue] = useState('');
+
+  return (
+    <InputLabeled
+      label="label"
+      data-cy="input"
+      value={value}
+      onChange={(e) => setValue(e.target.value)}
+    />
+  );
+}
+
+function NumberInput() {
+  const [value, setValue] = useState(5);
+
+  return (
+    <InputLabeled
+      label="label"
+      data-cy="input"
+      type="number"
+      value={value}
+      onChange={(e) => setValue(e.target.valueAsNumber)}
+    />
+  );
+}
diff --git a/app/react/components/form-components/Input/InputLabeled.tsx b/app/react/components/form-components/Input/InputLabeled.tsx
new file mode 100644
index 0000000..23406f5
--- /dev/null
+++ b/app/react/components/form-components/Input/InputLabeled.tsx
@@ -0,0 +1,40 @@
+import { ComponentProps, InputHTMLAttributes } from 'react';
+import clsx from 'clsx';
+
+import { AutomationTestingProps } from '@/types';
+
+import { InputGroup } from '../InputGroup';
+
+export function InputLabeled({
+  label,
+  className,
+  size,
+  needsDeletion,
+  id,
+  required,
+  disabled,
+  ...props
+}: {
+  label: string;
+  className?: string;
+  size?: ComponentProps<typeof InputGroup>['size'];
+  needsDeletion?: boolean;
+} & Omit<InputHTMLAttributes<HTMLInputElement>, 'size' | 'children'> &
+  AutomationTestingProps) {
+  return (
+    <InputGroup
+      className={clsx(className, needsDeletion && 'striked')}
+      size={size}
+    >
+      <InputGroup.Addon as="label" htmlFor={id} required={required}>
+        {label}
+      </InputGroup.Addon>
+      <InputGroup.Input
+        // eslint-disable-next-line react/jsx-props-no-spreading
+        {...props}
+        disabled={disabled || needsDeletion}
+        id={id}
+      />
+    </InputGroup>
+  );
+}
diff --git a/app/react/components/form-components/Input/Select.stories.tsx b/app/react/components/form-components/Input/Select.stories.tsx
new file mode 100644
index 0000000..465e352
--- /dev/null
+++ b/app/react/components/form-components/Input/Select.stories.tsx
@@ -0,0 +1,37 @@
+import { Meta, StoryFn } from '@storybook/react-webpack5';
+import { useState } from 'react';
+
+import { Select } from './Select';
+
+export default {
+  title: 'Components/Forms/Select',
+  args: {
+    disabled: false,
+  },
+} as Meta;
+
+interface Args {
+  disabled?: boolean;
+}
+
+export function Example({ disabled }: Args) {
+  const [value, setValue] = useState(0);
+  const options = [
+    { value: 1, label: 'one' },
+    { value: 2, label: 'two' },
+  ];
+  return (
+    <Select
+      value={value}
+      data-cy="select"
+      onChange={(e) => setValue(parseInt(e.target.value, 10))}
+      disabled={disabled}
+      options={options}
+    />
+  );
+}
+
+export const DisabledSelect: StoryFn<Args> = Example.bind({});
+DisabledSelect.args = {
+  disabled: true,
+};
diff --git a/app/react/components/form-components/Input/Select.tsx b/app/react/components/form-components/Input/Select.tsx
new file mode 100644
index 0000000..b6db7ef
--- /dev/null
+++ b/app/react/components/form-components/Input/Select.tsx
@@ -0,0 +1,43 @@
+import clsx from 'clsx';
+import { SelectHTMLAttributes } from 'react';
+
+import { AutomationTestingProps } from '@/types';
+
+export interface Option<
+  T extends string | number,
+> extends Partial<AutomationTestingProps> {
+  value: T;
+  label: string;
+  disabled?: boolean;
+}
+
+interface Props<T extends string | number> extends AutomationTestingProps {
+  options: Array<Option<T>> | ReadonlyArray<Option<T>>;
+}
+
+export function Select<T extends number | string>({
+  options,
+  className,
+  'data-cy': dataCy,
+  ...props
+}: Props<T> & SelectHTMLAttributes<HTMLSelectElement>) {
+  return (
+    <select
+      // eslint-disable-next-line react/jsx-props-no-spreading
+      {...props}
+      className={clsx('form-control', className)}
+      data-cy={dataCy}
+    >
+      {options.map((item) => (
+        <option
+          value={item.value}
+          key={item.value}
+          disabled={item.disabled}
+          data-cy={`${dataCy}-${item.value}`}
+        >
+          {item.label}
+        </option>
+      ))}
+    </select>
+  );
+}
diff --git a/app/react/components/form-components/Input/Textarea.tsx b/app/react/components/form-components/Input/Textarea.tsx
new file mode 100644
index 0000000..b532bbd
--- /dev/null
+++ b/app/react/components/form-components/Input/Textarea.tsx
@@ -0,0 +1,17 @@
+import clsx from 'clsx';
+import { TextareaHTMLAttributes } from 'react';
+
+import { AutomationTestingProps } from '@/types';
+
+export function TextArea({
+  className,
+  ...props
+}: TextareaHTMLAttributes<HTMLTextAreaElement> & AutomationTestingProps) {
+  return (
+    <textarea
+      // eslint-disable-next-line react/jsx-props-no-spreading
+      {...props}
+      className={clsx('form-control', className)}
+    />
+  );
+}
diff --git a/app/react/components/form-components/Input/index.ts b/app/react/components/form-components/Input/index.ts
new file mode 100644
index 0000000..ad493dd
--- /dev/null
+++ b/app/react/components/form-components/Input/index.ts
@@ -0,0 +1,2 @@
+export { Input } from './Input';
+export { Select } from './Select';
diff --git a/app/react/components/form-components/InputGroup/InputGroup.stories.tsx b/app/react/components/form-components/InputGroup/InputGroup.stories.tsx
new file mode 100644
index 0000000..fd2e6cd
--- /dev/null
+++ b/app/react/components/form-components/InputGroup/InputGroup.stories.tsx
@@ -0,0 +1,135 @@
+import { Meta } from '@storybook/react-webpack5';
+import { useState } from 'react';
+
+import { InputGroup } from '.';
+
+export default {
+  component: InputGroup,
+  title: 'Components/Forms/InputGroup',
+} as Meta;
+
+export { BasicExample, Addons, Sizing };
+
+function BasicExample() {
+  const [value1, setValue1] = useState('');
+  const [valueNumber, setValueNumber] = useState(0);
+
+  return (
+    <div className="space-y-8">
+      <InputGroup>
+        <InputGroup.Addon>@</InputGroup.Addon>
+        <InputGroup.Input
+          value={value1}
+          data-cy="input"
+          onChange={(e) => setValue1(e.target.value)}
+          placeholder="Username"
+          aria-describedby="basic-addon1"
+        />
+      </InputGroup>
+
+      <InputGroup>
+        <InputGroup.Input
+          value={value1}
+          data-cy="input"
+          onChange={(e) => setValue1(e.target.value)}
+          placeholder="Recipient's username"
+          aria-describedby="basic-addon2"
+        />
+        <InputGroup.Addon>@example.com</InputGroup.Addon>
+      </InputGroup>
+
+      <InputGroup>
+        <InputGroup.Addon>$</InputGroup.Addon>
+        <InputGroup.Input
+          type="number"
+          data-cy="input"
+          value={valueNumber}
+          onChange={(e) => setValueNumber(parseInt(e.target.value, 10))}
+          aria-label="Amount (to the nearest dollar)"
+        />
+        <InputGroup.Addon>.00</InputGroup.Addon>
+      </InputGroup>
+
+      <label htmlFor="basic-url">Your vanity URL</label>
+      <InputGroup>
+        <InputGroup.Addon>https://example.com/users/</InputGroup.Addon>
+        <InputGroup.Input
+          value={value1}
+          data-cy="input"
+          onChange={(e) => setValue1(e.target.value)}
+          id="basic-url"
+          aria-describedby="basic-addon3"
+        />
+      </InputGroup>
+    </div>
+  );
+}
+
+function Addons() {
+  const [value1, setValue1] = useState('');
+  const [value2, setValue2] = useState('');
+  return (
+    <div className="row">
+      <div className="col-lg-6">
+        <InputGroup>
+          <InputGroup.ButtonWrapper>
+            <button className="btn btn-default" type="button">
+              Go!
+            </button>
+          </InputGroup.ButtonWrapper>
+          <InputGroup.Input
+            value={value1}
+            data-cy="input"
+            onChange={(e) => setValue1(e.target.value)}
+          />
+        </InputGroup>
+      </div>
+      <div className="col-lg-6">
+        <InputGroup>
+          <InputGroup.Input
+            value={value2}
+            data-cy="input"
+            onChange={(e) => setValue2(e.target.value)}
+          />
+          <InputGroup.Addon>
+            <input type="checkbox" data-cy="checkbox" />
+          </InputGroup.Addon>
+        </InputGroup>
+      </div>
+    </div>
+  );
+}
+
+function Sizing() {
+  const [value, setValue] = useState('');
+  return (
+    <div className="space-y-8">
+      <InputGroup size="small">
+        <InputGroup.Addon>Small</InputGroup.Addon>
+        <InputGroup.Input
+          value={value}
+          data-cy="input"
+          onChange={(e) => setValue(e.target.value)}
+        />
+      </InputGroup>
+
+      <InputGroup>
+        <InputGroup.Addon>Default</InputGroup.Addon>
+        <InputGroup.Input
+          value={value}
+          data-cy="input"
+          onChange={(e) => setValue(e.target.value)}
+        />
+      </InputGroup>
+
+      <InputGroup size="large">
+        <InputGroup.Addon>Large</InputGroup.Addon>
+        <InputGroup.Input
+          value={value}
+          data-cy="input"
+          onChange={(e) => setValue(e.target.value)}
+        />
+      </InputGroup>
+    </div>
+  );
+}
diff --git a/app/react/components/form-components/InputGroup/InputGroup.tsx b/app/react/components/form-components/InputGroup/InputGroup.tsx
new file mode 100644
index 0000000..35c343d
--- /dev/null
+++ b/app/react/components/form-components/InputGroup/InputGroup.tsx
@@ -0,0 +1,45 @@
+import clsx from 'clsx';
+import { createContext, PropsWithChildren, useContext } from 'react';
+
+const Context = createContext<null | boolean>(null);
+Context.displayName = 'InputGroupContext';
+
+type Size = 'small' | 'large';
+
+export function useInputGroupContext() {
+  const context = useContext(Context);
+
+  if (context == null) {
+    throw new Error('Should be inside a InputGroup component');
+  }
+}
+
+interface Props {
+  size?: Size;
+  className?: string;
+}
+
+export function InputGroup({
+  children,
+  size,
+  className,
+}: PropsWithChildren<Props>) {
+  return (
+    <Context.Provider value>
+      <div className={clsx('input-group', sizeClass(size), className)}>
+        {children}
+      </div>
+    </Context.Provider>
+  );
+}
+
+function sizeClass(size?: Size) {
+  switch (size) {
+    case 'large':
+      return 'input-group-lg';
+    case 'small':
+      return 'input-group-sm';
+    default:
+      return '';
+  }
+}
diff --git a/app/react/components/form-components/InputGroup/InputGroupAddon.tsx b/app/react/components/form-components/InputGroup/InputGroupAddon.tsx
new file mode 100644
index 0000000..ca2d131
--- /dev/null
+++ b/app/react/components/form-components/InputGroup/InputGroupAddon.tsx
@@ -0,0 +1,31 @@
+import { ComponentType, PropsWithChildren } from 'react';
+import clsx from 'clsx';
+
+import { useInputGroupContext } from './InputGroup';
+
+type BaseProps<TProps> = {
+  as?: ComponentType<TProps> | string;
+  required?: boolean;
+  className?: string;
+};
+
+export function InputGroupAddon<TProps>({
+  children,
+  as = 'span',
+  className,
+  required,
+  ...props
+}: PropsWithChildren<BaseProps<TProps> & TProps>) {
+  useInputGroupContext();
+  const Component = as as 'span';
+
+  return (
+    <Component
+      className={clsx('input-group-addon', required && 'required', className)}
+      // eslint-disable-next-line react/jsx-props-no-spreading
+      {...props}
+    >
+      {children}
+    </Component>
+  );
+}
diff --git a/app/react/components/form-components/InputGroup/InputGroupButtonWrapper.tsx b/app/react/components/form-components/InputGroup/InputGroupButtonWrapper.tsx
new file mode 100644
index 0000000..27f3f0c
--- /dev/null
+++ b/app/react/components/form-components/InputGroup/InputGroupButtonWrapper.tsx
@@ -0,0 +1,24 @@
+import { PropsWithChildren } from 'react';
+
+import { useInputGroupContext } from './InputGroup';
+
+/**
+ * Should wrap all buttons inside a InputGroup
+ *
+ * example:
+ * ```
+ * <InputGroup>
+ *  <InputGroup.ButtonWrapper>
+ *   <Button>...</Button>
+ *   <Button>...</Button>
+ *  </InputGroup.ButtonWrapper>
+ * </InputGroup>
+ * ```
+ */
+export function InputGroupButtonWrapper({
+  children,
+}: PropsWithChildren<unknown>) {
+  useInputGroupContext();
+
+  return <span className="input-group-btn">{children}</span>;
+}
diff --git a/app/react/components/form-components/InputGroup/index.ts b/app/react/components/form-components/InputGroup/index.ts
new file mode 100644
index 0000000..771fe1e
--- /dev/null
+++ b/app/react/components/form-components/InputGroup/index.ts
@@ -0,0 +1,34 @@
+import { Input } from '../Input';
+
+import { InputGroup as MainComponent } from './InputGroup';
+import { InputGroupAddon } from './InputGroupAddon';
+import { InputGroupButtonWrapper } from './InputGroupButtonWrapper';
+
+interface InputGroupSubComponents {
+  Addon: typeof InputGroupAddon;
+  /**
+   * Should wrap all buttons inside a InputGroup
+   *
+   * example:
+   * ```
+   * <InputGroup>
+   *  <InputGroup.ButtonWrapper>
+   *   <Button>...</Button>
+   *   <Button>...</Button>
+   *  </InputGroup.ButtonWrapper>
+   * </InputGroup>
+   * ```
+   */
+  ButtonWrapper: typeof InputGroupButtonWrapper;
+  Input: typeof Input;
+  className: string | undefined;
+}
+
+const InputGroup: typeof MainComponent & InputGroupSubComponents =
+  MainComponent as typeof MainComponent & InputGroupSubComponents;
+
+InputGroup.Addon = InputGroupAddon;
+InputGroup.ButtonWrapper = InputGroupButtonWrapper;
+InputGroup.Input = Input;
+
+export { InputGroup };
diff --git a/app/react/components/form-components/InputList/ActionButtons.tsx b/app/react/components/form-components/InputList/ActionButtons.tsx
new file mode 100644
index 0000000..c962e9c
--- /dev/null
+++ b/app/react/components/form-components/InputList/ActionButtons.tsx
@@ -0,0 +1,158 @@
+import {
+  ArrowDownIcon,
+  ArrowUpIcon,
+  RotateCwIcon,
+  Trash2Icon,
+} from 'lucide-react';
+
+import { Button } from '@@/buttons';
+
+import { hasKey } from './utils';
+import { DefaultType, Key } from './types';
+
+interface InputListActionButtonsProps<T = DefaultType> {
+  index: number;
+  count: number;
+  movable?: boolean;
+  disabled?: boolean;
+  showDelete?: boolean;
+  canUndoDelete?: boolean;
+  item?: T;
+  initialItemsCount?: number;
+  onMoveUp?: () => void;
+  onMoveDown?: () => void;
+  onDelete: () => void;
+  onToggleNeedsDeletion?: (index: number, item: CanUndoDeleteItem<T>) => void;
+  'data-cy'?: string;
+}
+
+export function InputListActionButtons<T = DefaultType>({
+  index,
+  count,
+  movable = false,
+  disabled = false,
+  showDelete = true,
+  canUndoDelete = false,
+  item,
+  initialItemsCount,
+  onMoveUp,
+  onMoveDown,
+  onDelete,
+  onToggleNeedsDeletion,
+  'data-cy': dataCy = '',
+}: InputListActionButtonsProps<T>) {
+  return (
+    <div className="flex items-start gap-2">
+      {movable && (
+        <>
+          <Button
+            size="medium"
+            disabled={disabled || index === 0}
+            onClick={onMoveUp}
+            className="vertical-center btn-only-icon h-[34px]"
+            icon={ArrowUpIcon}
+            data-cy={`${dataCy}-move-up_${index}`}
+          />
+          <Button
+            size="medium"
+            type="button"
+            disabled={disabled || index === count - 1}
+            onClick={onMoveDown}
+            className="vertical-center btn-only-icon h-[34px]"
+            icon={ArrowDownIcon}
+            data-cy={`${dataCy}-move-down_${index}`}
+          />
+        </>
+      )}
+      {showDelete && (
+        <>
+          {canUndoDelete &&
+          item &&
+          initialItemsCount !== undefined &&
+          onToggleNeedsDeletion &&
+          hasKey(item, 'needsDeletion') ? (
+            <CanUndoDeleteButton
+              item={{ ...item, needsDeletion: !!item.needsDeletion }}
+              itemIndex={index}
+              initialItemsCount={initialItemsCount}
+              handleRemoveItem={onDelete}
+              handleToggleNeedsDeletion={onToggleNeedsDeletion}
+              dataCy={`${dataCy}RemoveButton_${index}`}
+              disabled={disabled}
+            />
+          ) : (
+            <Button
+              color="dangerlight"
+              size="medium"
+              onClick={onDelete}
+              className="vertical-center btn-only-icon h-[34px]"
+              data-cy={`${dataCy}RemoveButton_${index}`}
+              icon={Trash2Icon}
+              disabled={disabled}
+              aria-label="Remove item"
+              title="Remove item"
+            />
+          )}
+        </>
+      )}
+    </div>
+  );
+}
+
+export type CanUndoDeleteItem<T> = T & { needsDeletion: boolean };
+
+type CanUndoDeleteButtonProps<T> = {
+  item: CanUndoDeleteItem<T>;
+  itemIndex: number;
+  initialItemsCount: number;
+  handleRemoveItem(key: Key, item: T): void;
+  handleToggleNeedsDeletion(key: Key, item: T): void;
+  dataCy: string;
+  disabled?: boolean;
+};
+
+function CanUndoDeleteButton<T>({
+  item,
+  itemIndex,
+  initialItemsCount,
+  handleRemoveItem,
+  handleToggleNeedsDeletion,
+  disabled,
+  dataCy,
+}: CanUndoDeleteButtonProps<T>) {
+  // if the item is new, we can just remove it, otherwise we need to toggle the needsDeletion flag
+  function handleDeleteClick() {
+    if (itemIndex < initialItemsCount) {
+      handleToggleNeedsDeletion(itemIndex, item);
+    } else {
+      handleRemoveItem(itemIndex, item);
+    }
+  }
+
+  return (
+    <>
+      {!item.needsDeletion && (
+        <Button
+          color="dangerlight"
+          size="medium"
+          onClick={handleDeleteClick}
+          className="vertical-center btn-only-icon h-[34px]"
+          icon={Trash2Icon}
+          data-cy={`${dataCy}_delete`}
+          disabled={disabled}
+        />
+      )}
+      {item.needsDeletion && (
+        <Button
+          color="default"
+          size="medium"
+          onClick={handleDeleteClick}
+          className="vertical-center btn-only-icon h-[34px]"
+          icon={RotateCwIcon}
+          data-cy={`${dataCy}_undo_delete`}
+          disabled={disabled}
+        />
+      )}
+    </>
+  );
+}
diff --git a/app/react/components/form-components/InputList/InputList.module.css b/app/react/components/form-components/InputList/InputList.module.css
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/components/form-components/InputList/InputList.stories.tsx b/app/react/components/form-components/InputList/InputList.stories.tsx
new file mode 100644
index 0000000..4e6187f
--- /dev/null
+++ b/app/react/components/form-components/InputList/InputList.stories.tsx
@@ -0,0 +1,116 @@
+import { Meta } from '@storybook/react-webpack5';
+import { useState } from 'react';
+
+import { Input, Select } from '../Input';
+
+import { InputList } from './InputList';
+import { DefaultType } from './types';
+
+const meta: Meta = {
+  title: 'Components/Forms/InputList',
+  component: InputList,
+};
+
+export default meta;
+
+export { Defaults, ListWithInputAndSelect, ListWithUndoDeletion };
+
+function Defaults() {
+  const [values, setValues] = useState<DefaultType[]>([{ value: '' }]);
+
+  return (
+    <InputList
+      label="default example"
+      value={values}
+      onChange={(value) => setValues(value)}
+      data-cy="input-list-default-example"
+    />
+  );
+}
+
+function ListWithUndoDeletion() {
+  const [values, setValues] = useState<DefaultType[]>([
+    { value: 'Existing item', needsDeletion: false },
+  ]);
+
+  return (
+    <InputList
+      label="List with undo deletion"
+      value={values}
+      onChange={(value) => setValues(value)}
+      canUndoDelete
+      data-cy="input-list-with-undo-deletion"
+    />
+  );
+}
+
+interface ListWithSelectItem {
+  value: number;
+  select: string;
+  id: number;
+}
+
+interface ListWithInputAndSelectArgs {
+  label: string;
+  movable: boolean;
+  tooltip: string;
+}
+function ListWithInputAndSelect({
+  label,
+  movable,
+  tooltip,
+}: ListWithInputAndSelectArgs) {
+  const [values, setValues] = useState<ListWithSelectItem[]>([
+    { value: 0, select: '', id: 0 },
+  ]);
+
+  return (
+    <InputList<ListWithSelectItem>
+      label={label}
+      onChange={setValues}
+      value={values}
+      item={SelectAndInputItem}
+      itemKeyGetter={(item) => item.id}
+      movable={movable}
+      itemBuilder={() => ({ value: 0, select: '', id: values.length })}
+      tooltip={tooltip}
+      data-cy="input-list-with-select-and-input"
+    />
+  );
+}
+
+ListWithInputAndSelect.args = {
+  label: 'List with select and input',
+  movable: false,
+  tooltip: '',
+};
+
+function SelectAndInputItem({
+  item,
+  onChange,
+}: {
+  item: ListWithSelectItem;
+  onChange: (value: ListWithSelectItem) => void;
+}) {
+  return (
+    <div className="flex gap-2">
+      <Input
+        type="number"
+        value={item.value}
+        onChange={(e) =>
+          onChange({ ...item, value: parseInt(e.target.value, 10) })
+        }
+        data-cy="input"
+      />
+      <Select
+        onChange={(e) => onChange({ ...item, select: e.target.value })}
+        data-cy="select"
+        options={[
+          { label: 'option1', value: 'option1' },
+          { label: 'option2', value: 'option2' },
+        ]}
+        value={item.select}
+      />
+    </div>
+  );
+}
diff --git a/app/react/components/form-components/InputList/InputList.tsx b/app/react/components/form-components/InputList/InputList.tsx
new file mode 100644
index 0000000..a4c6087
--- /dev/null
+++ b/app/react/components/form-components/InputList/InputList.tsx
@@ -0,0 +1,248 @@
+import { ComponentType, useRef } from 'react';
+import { FormikErrors } from 'formik';
+import { Plus } from 'lucide-react';
+import clsx from 'clsx';
+
+import { AutomationTestingProps } from '@/types';
+
+import { Button } from '@@/buttons';
+import { Tooltip } from '@@/Tip/Tooltip';
+import { TextTip } from '@@/Tip/TextTip';
+
+import { Input } from '../Input';
+import { FormError } from '../FormError';
+
+import { defaultItemBuilder } from './utils';
+import { InputListActionButtons } from './ActionButtons';
+import { DefaultType, Key, OnChangeEvent } from './types';
+import { useInputList } from './useInputList';
+
+export { useInputList } from './useInputList';
+
+type ArrElement<ArrType> = ArrType extends readonly (infer ElementType)[]
+  ? ElementType
+  : never;
+
+export type ArrayError<TArray> =
+  | Array<FormikErrors<ArrElement<TArray> | undefined>>
+  | string
+  | string[]
+  | undefined;
+export type ItemError<T> = FormikErrors<T> | string | undefined;
+
+export interface ItemProps<T> {
+  item: T;
+  onChange(value: T): void;
+  error?: ItemError<T>;
+  disabled?: boolean;
+  readOnly?: boolean;
+
+  index: number;
+  needsDeletion?: boolean;
+}
+
+type RenderItemFunction<T> = (
+  item: T,
+  onChange: (value: T) => void,
+  index: number,
+  dataCy: string,
+  error?: ItemError<T>
+) => React.ReactNode;
+
+interface Props<T> extends AutomationTestingProps {
+  label?: string;
+  value: T[];
+  onChange(value: T[], e: OnChangeEvent<T>): void;
+  itemBuilder?(): T;
+  renderItem?: RenderItemFunction<T>;
+  item?: ComponentType<ItemProps<T>>;
+  tooltip?: string;
+  addLabel?: string;
+  itemKeyGetter?(item: T, index: number): Key;
+  movable?: boolean;
+  canUndoDelete?: boolean;
+  errors?: ArrayError<T[]>;
+  textTip?: string;
+  isAddButtonHidden?: boolean;
+  isDeleteButtonHidden?: boolean;
+  disabled?: boolean;
+  addButtonError?: string;
+  readOnly?: boolean;
+  'aria-label'?: string;
+}
+
+export function InputList<T = DefaultType>({
+  label,
+  value,
+  onChange,
+  itemBuilder = defaultItemBuilder as unknown as () => T,
+  renderItem = renderDefaultItem as unknown as RenderItemFunction<T>,
+  item: Item,
+  tooltip,
+  addLabel = 'Add item',
+  itemKeyGetter = (item: T, index: number) => index,
+  movable,
+  canUndoDelete = false,
+  errors,
+  textTip,
+  isAddButtonHidden = false,
+  isDeleteButtonHidden = false,
+  'data-cy': dataCy,
+  disabled,
+  addButtonError,
+  readOnly,
+  'aria-label': ariaLabel,
+}: Props<T>) {
+  const initialItemsCount = useRef(value.length);
+  const isAddButtonVisible = !(isAddButtonHidden || readOnly);
+  const isDeleteButtonVisible = !(isDeleteButtonHidden || readOnly);
+  const {
+    handleMoveUp,
+    handleMoveDown,
+    handleRemoveItem,
+    handleAdd,
+    handleChangeItem,
+    toggleNeedsDeletion,
+  } = useInputList<T>({
+    value,
+    onChange,
+    itemBuilder,
+    itemKeyGetter,
+    movable,
+  });
+
+  return (
+    <div className="form-group" aria-label={ariaLabel || label}>
+      {label && (
+        <div className="col-sm-12">
+          <span className="control-label space-right pt-2 text-left">
+            {label}
+            {tooltip && <Tooltip message={tooltip} />}
+          </span>
+        </div>
+      )}
+
+      {textTip && (
+        <div className="col-sm-12 mt-5">
+          <TextTip color="blue">{textTip}</TextTip>
+        </div>
+      )}
+
+      {value.length > 0 && (
+        <div className="col-sm-12 mt-5 flex flex-col gap-y-5">
+          {value.map((item, index) => {
+            const key = itemKeyGetter(item, index);
+            const error =
+              typeof errors === 'object' ? errors[index] : undefined;
+
+            return (
+              <div key={key} className="flex gap-1">
+                {Item ? (
+                  <Item
+                    item={item}
+                    onChange={(value: T) => handleChangeItem(key, value)}
+                    error={error}
+                    disabled={disabled}
+                    readOnly={readOnly}
+                    index={index}
+                  />
+                ) : (
+                  renderItem(
+                    item,
+                    (value: T) => handleChangeItem(key, value),
+                    index,
+                    dataCy,
+                    error
+                  )
+                )}
+                <InputListActionButtons
+                  index={index}
+                  count={value.length}
+                  movable={movable && !readOnly}
+                  disabled={disabled}
+                  showDelete={isDeleteButtonVisible}
+                  canUndoDelete={canUndoDelete}
+                  item={item}
+                  initialItemsCount={initialItemsCount.current}
+                  onMoveUp={() => handleMoveUp(index)}
+                  onMoveDown={() => handleMoveDown(index)}
+                  onDelete={() => handleRemoveItem(key, item)}
+                  onToggleNeedsDeletion={(idx, itm) =>
+                    toggleNeedsDeletion(key, itm)
+                  }
+                  data-cy={dataCy}
+                />
+              </div>
+            );
+          })}
+        </div>
+      )}
+
+      {isAddButtonVisible && (
+        <>
+          <div className="col-sm-12 mt-5">
+            <Button
+              onClick={handleAdd}
+              disabled={disabled}
+              type="button"
+              color="default"
+              className="!ml-0"
+              size="small"
+              icon={Plus}
+              data-cy={`${dataCy}AddButton`}
+            >
+              {addLabel}
+            </Button>
+          </div>
+          {addButtonError && (
+            <div className="col-sm-12 mt-1">
+              <TextTip color="blue">{addButtonError}</TextTip>
+            </div>
+          )}
+        </>
+      )}
+    </div>
+  );
+}
+
+function DefaultItem({
+  item,
+  onChange,
+  error,
+  disabled,
+  readOnly,
+  index,
+  'data-cy': dataCy,
+}: ItemProps<DefaultType> & AutomationTestingProps) {
+  return (
+    <>
+      <Input
+        value={item.value}
+        onChange={(e) => onChange({ value: e.target.value })}
+        className={clsx('!w-full', item.needsDeletion && 'striked')}
+        disabled={disabled || item.needsDeletion}
+        readOnly={readOnly}
+        data-cy={`${dataCy}RemoveButton_${index}`}
+      />
+      {error && <FormError>{error}</FormError>}
+    </>
+  );
+}
+
+function renderDefaultItem(
+  item: DefaultType,
+  onChange: (value: DefaultType) => void,
+  index: number,
+  dataCy: string,
+  error?: ItemError<DefaultType>
+) {
+  return (
+    <DefaultItem
+      item={item}
+      onChange={onChange}
+      error={error}
+      index={index}
+      data-cy={dataCy}
+    />
+  );
+}
diff --git a/app/react/components/form-components/InputList/index.ts b/app/react/components/form-components/InputList/index.ts
new file mode 100644
index 0000000..8be0fcf
--- /dev/null
+++ b/app/react/components/form-components/InputList/index.ts
@@ -0,0 +1 @@
+export { InputList, type ItemProps } from './InputList';
diff --git a/app/react/components/form-components/InputList/types.ts b/app/react/components/form-components/InputList/types.ts
new file mode 100644
index 0000000..3e703bc
--- /dev/null
+++ b/app/react/components/form-components/InputList/types.ts
@@ -0,0 +1,14 @@
+export type DefaultType = { value: string; needsDeletion?: boolean };
+export type Key = string | number;
+type ChangeType = 'delete' | 'create' | 'update';
+
+export type OnChangeEvent<T> =
+  | {
+      item: T;
+      type: ChangeType;
+    }
+  | {
+      type: 'move';
+      fromIndex: number;
+      to: number;
+    };
diff --git a/app/react/components/form-components/InputList/useInputList.ts b/app/react/components/form-components/InputList/useInputList.ts
new file mode 100644
index 0000000..45a3502
--- /dev/null
+++ b/app/react/components/form-components/InputList/useInputList.ts
@@ -0,0 +1,85 @@
+import { CanUndoDeleteItem } from './ActionButtons';
+import { DefaultType, Key, OnChangeEvent } from './types';
+import { arrayMove, defaultItemBuilder } from './utils';
+
+export function useInputList<T = DefaultType>({
+  value,
+  onChange,
+  itemBuilder = defaultItemBuilder as unknown as () => T,
+  itemKeyGetter = (item: T, index: number) => index,
+  movable = false,
+}: {
+  value: T[];
+  onChange(value: T[], e: OnChangeEvent<T>): void;
+  itemBuilder?(): T;
+  itemKeyGetter?(item: T, index: number): Key;
+  movable?: boolean;
+}) {
+  function handleMoveUp(index: number) {
+    if (index <= 0) {
+      return;
+    }
+    handleMove(index, index - 1);
+  }
+
+  function handleMoveDown(index: number) {
+    if (index >= value.length - 1) {
+      return;
+    }
+    handleMove(index, index + 1);
+  }
+
+  function handleMove(from: number, to: number) {
+    if (!movable) {
+      return;
+    }
+
+    onChange(arrayMove(value, from, to), {
+      type: 'move',
+      fromIndex: from,
+      to,
+    });
+  }
+
+  function handleRemoveItem(key: Key, item: T) {
+    onChange(
+      value.filter((item, index) => {
+        const itemKey = itemKeyGetter(item, index);
+        return itemKey !== key;
+      }),
+      { type: 'delete', item }
+    );
+  }
+
+  function toggleNeedsDeletion(key: Key, item: CanUndoDeleteItem<T>) {
+    handleChangeItem(key, { ...item, needsDeletion: !item.needsDeletion });
+  }
+
+  function handleAdd() {
+    const newItem = itemBuilder();
+    onChange([...value, newItem], { type: 'create', item: newItem });
+  }
+
+  function handleChangeItem(key: Key, newItemValue: T) {
+    const newItems = value.map((item, index) => {
+      const itemKey = itemKeyGetter(item, index);
+      if (itemKey !== key) {
+        return item;
+      }
+      return newItemValue;
+    });
+    onChange(newItems, {
+      type: 'update',
+      item: newItemValue,
+    });
+  }
+
+  return {
+    handleMoveUp,
+    handleMoveDown,
+    handleRemoveItem,
+    handleAdd,
+    handleChangeItem,
+    toggleNeedsDeletion,
+  };
+}
diff --git a/app/react/components/form-components/InputList/utils.test.ts b/app/react/components/form-components/InputList/utils.test.ts
new file mode 100644
index 0000000..cf350e6
--- /dev/null
+++ b/app/react/components/form-components/InputList/utils.test.ts
@@ -0,0 +1,23 @@
+import { arrayMove } from './utils';
+
+it('moves items in an array', () => {
+  expect(arrayMove(['a', 'b', 'c'], 2, 0)).toEqual(['c', 'a', 'b']);
+  expect(
+    arrayMove(
+      [
+        { name: 'Fred' },
+        { name: 'Barney' },
+        { name: 'Wilma' },
+        { name: 'Betty' },
+      ],
+      2,
+      1
+    )
+  ).toEqual([
+    { name: 'Fred' },
+    { name: 'Wilma' },
+    { name: 'Barney' },
+    { name: 'Betty' },
+  ]);
+  expect(arrayMove([1, 2, 3], 2, 1)).toEqual([1, 3, 2]);
+});
diff --git a/app/react/components/form-components/InputList/utils.ts b/app/react/components/form-components/InputList/utils.ts
new file mode 100644
index 0000000..9daf304
--- /dev/null
+++ b/app/react/components/form-components/InputList/utils.ts
@@ -0,0 +1,54 @@
+import { DefaultType } from './types';
+
+export function arrayMove<T>(array: Array<T>, from: number, to: number) {
+  if (!checkValidIndex(array, from) || !checkValidIndex(array, to)) {
+    throw new Error('index is out of bounds');
+  }
+
+  const item = array[from];
+  const { length } = array;
+
+  const diff = from - to;
+
+  if (diff > 0) {
+    // move left
+    return [
+      ...array.slice(0, to),
+      item,
+      ...array.slice(to, from),
+      ...array.slice(from + 1, length),
+    ];
+  }
+
+  if (diff < 0) {
+    // move right
+    const targetIndex = to + 1;
+    return [
+      ...array.slice(0, from),
+      ...array.slice(from + 1, targetIndex),
+      item,
+      ...array.slice(targetIndex, length),
+    ];
+  }
+
+  return [...array];
+
+  function checkValidIndex<T>(array: Array<T>, index: number) {
+    return index >= 0 && index <= array.length;
+  }
+}
+
+export function hasKey(
+  value: unknown,
+  key: string | number | symbol
+): value is { needsDeletion: boolean } {
+  return isObject(value) && key in value;
+}
+
+function isObject(value: unknown): value is object {
+  return typeof value === 'object' && value !== null;
+}
+
+export function defaultItemBuilder(): DefaultType {
+  return { value: '' };
+}
diff --git a/app/react/components/form-components/PortainerSelect.tsx b/app/react/components/form-components/PortainerSelect.tsx
new file mode 100644
index 0000000..e14aabb
--- /dev/null
+++ b/app/react/components/form-components/PortainerSelect.tsx
@@ -0,0 +1,285 @@
+import { useState } from 'react';
+import type { AriaAttributes } from 'react';
+import {
+  FilterOptionOption,
+  GroupBase,
+  OptionsOrGroups,
+  SelectComponentsConfig,
+} from 'react-select';
+import _ from 'lodash';
+
+import { AutomationTestingProps } from '@/types';
+
+import {
+  Creatable,
+  Select as ReactSelect,
+} from '@@/form-components/ReactSelect';
+
+export interface Option<TValue> {
+  value: TValue;
+  label: string;
+  disabled?: boolean;
+  [key: string]: unknown;
+}
+
+export interface GroupOption<TValue> {
+  label: string;
+  options: Option<TValue>[];
+}
+
+export type Options<TValue> = OptionsOrGroups<
+  Option<TValue>,
+  GroupBase<Option<TValue>>
+>;
+
+interface SharedProps<TValue>
+  extends AutomationTestingProps, Pick<AriaAttributes, 'aria-label'> {
+  name?: string;
+  inputId?: string;
+  size?: 'sm' | 'md';
+  placeholder?: string;
+  disabled?: boolean;
+  isClearable?: boolean;
+  /** Portals the dropdown to document.body, ensuring it renders above sticky footers and overlays. */
+  bindToBody?: boolean;
+  isLoading?: boolean;
+  noOptionsMessage?: () => string;
+  loadingMessage?: () => string;
+  filterOption?: (
+    option: FilterOptionOption<Option<TValue>>,
+    rawInput: string
+  ) => boolean;
+  getOptionValue?: (option: TValue) => string;
+  onBlur?: (e: React.FocusEvent<HTMLInputElement>) => void;
+}
+
+interface MultiProps<TValue> extends SharedProps<TValue> {
+  value: readonly TValue[];
+  onChange(value: TValue[]): void;
+  options: Options<TValue>;
+  isMulti: true;
+  components?: SelectComponentsConfig<
+    Option<TValue>,
+    true,
+    GroupBase<Option<TValue>>
+  >;
+  formatCreateLabel?: (input: string) => string;
+  onCreateOption?: (input: string) => void;
+  isCreatable?: boolean;
+}
+
+interface SingleProps<TValue> extends SharedProps<TValue> {
+  value: TValue;
+  onChange(value: TValue | null): void;
+  options: Options<TValue>;
+  isMulti?: never;
+  components?: SelectComponentsConfig<
+    Option<TValue>,
+    false,
+    GroupBase<Option<TValue>>
+  >;
+}
+
+export type PortainerSelectProps<TValue> =
+  | MultiProps<TValue>
+  | SingleProps<TValue>;
+
+export function PortainerSelect<TValue = string>(
+  props: PortainerSelectProps<TValue>
+) {
+  return isMultiProps(props) ? (
+    // eslint-disable-next-line react/jsx-props-no-spreading
+    <MultiSelect {...props} />
+  ) : (
+    // eslint-disable-next-line react/jsx-props-no-spreading
+    <SingleSelect {...props} />
+  );
+}
+
+function isMultiProps<TValue>(
+  props: PortainerSelectProps<TValue>
+): props is MultiProps<TValue> {
+  return 'isMulti' in props && !!props.isMulti;
+}
+
+export function SingleSelect<TValue = string>({
+  name,
+  options,
+  onChange,
+  value,
+  'data-cy': dataCy,
+  disabled,
+  inputId,
+  placeholder,
+  isClearable,
+  bindToBody,
+  filterOption,
+  components,
+  isLoading,
+  noOptionsMessage,
+  loadingMessage,
+  isMulti,
+  size,
+  getOptionValue,
+  onBlur,
+  ...aria
+}: SingleProps<TValue>) {
+  const selectedValue =
+    value ||
+    (typeof value === 'number' && value === 0) ||
+    (typeof value === 'string' && value === '')
+      ? _.first(findSelectedOptions<TValue>(options, value, getOptionValue))
+      : null;
+
+  return (
+    <ReactSelect<Option<TValue>>
+      name={name}
+      isClearable={isClearable}
+      getOptionLabel={(option) => option.label}
+      getOptionValue={(option) =>
+        getOptionValue ? getOptionValue(option.value) : String(option.value)
+      }
+      options={options}
+      value={selectedValue}
+      onChange={(option) => onChange(option ? option.value : null)}
+      isOptionDisabled={(option) => !!option.disabled}
+      data-cy={dataCy}
+      inputId={inputId}
+      placeholder={placeholder}
+      isDisabled={disabled}
+      menuPortalTarget={bindToBody ? document.body : undefined}
+      filterOption={filterOption}
+      components={components}
+      isLoading={isLoading}
+      noOptionsMessage={noOptionsMessage}
+      size={size}
+      loadingMessage={loadingMessage}
+      onBlur={onBlur}
+      // eslint-disable-next-line react/jsx-props-no-spreading
+      {...aria}
+    />
+  );
+}
+
+function isSingleValue<TValue>(
+  value: TValue | readonly TValue[]
+): value is TValue {
+  return !Array.isArray(value);
+}
+
+function findSelectedOptions<TValue>(
+  options: Options<TValue>,
+  value: TValue | readonly TValue[],
+  getOptionValue: (option: TValue) => string | TValue = (v: TValue) => v
+) {
+  const valueArr = isSingleValue(value)
+    ? [getOptionValue(value)]
+    : value.map((v) => getOptionValue(v));
+
+  const values = _.compact(
+    options.flatMap((option) => {
+      if (isGroup(option)) {
+        return option.options.find((opt) =>
+          valueArr.includes(getOptionValue(opt.value))
+        );
+      }
+
+      if (valueArr.includes(getOptionValue(option.value))) {
+        return option;
+      }
+
+      return null;
+    })
+  );
+
+  return values;
+}
+
+export function MultiSelect<TValue = string>({
+  name,
+  value,
+  onChange,
+  options,
+  'data-cy': dataCy,
+  inputId,
+  placeholder,
+  disabled,
+  isClearable,
+  bindToBody,
+  filterOption,
+  components,
+  isLoading,
+  noOptionsMessage,
+  loadingMessage,
+  formatCreateLabel,
+  onCreateOption,
+  isCreatable,
+  size,
+  getOptionValue,
+  onBlur,
+  ...aria
+}: Omit<MultiProps<TValue>, 'isMulti'>) {
+  const [inputValue, setInputValue] = useState('');
+  const selectedOptions = findSelectedOptions(options, value, getOptionValue);
+  const SelectComponent = isCreatable ? Creatable : ReactSelect;
+
+  return (
+    <SelectComponent
+      name={name}
+      isMulti
+      isClearable={isClearable}
+      getOptionLabel={(option) => option.label}
+      getOptionValue={(option) =>
+        getOptionValue ? getOptionValue(option.value) : String(option.value)
+      }
+      isOptionDisabled={(option) => !!option.disabled}
+      options={options}
+      value={selectedOptions}
+      closeMenuOnSelect={false}
+      onChange={(newValue) => {
+        onChange(newValue.map((option) => option.value));
+        setInputValue('');
+      }}
+      data-cy={dataCy}
+      id={dataCy}
+      inputId={inputId}
+      placeholder={placeholder}
+      isDisabled={disabled}
+      menuPortalTarget={bindToBody ? document.body : undefined}
+      filterOption={filterOption}
+      components={components}
+      isLoading={isLoading}
+      noOptionsMessage={noOptionsMessage}
+      loadingMessage={loadingMessage}
+      formatCreateLabel={formatCreateLabel}
+      onCreateOption={onCreateOption}
+      inputValue={inputValue}
+      onInputChange={(textInput) => setInputValue(textInput)}
+      onBlur={handleBlur}
+      size={size}
+      // eslint-disable-next-line react/jsx-props-no-spreading
+      {...aria}
+    />
+  );
+
+  function handleBlur(e: React.FocusEvent<HTMLInputElement>) {
+    onBlur?.(e);
+    const trimmed = inputValue.trim();
+    if (!trimmed || value.includes(trimmed as TValue)) {
+      setInputValue('');
+      return;
+    }
+    if (onCreateOption && isCreatable) {
+      onCreateOption(trimmed);
+    } else {
+      onChange([...value, trimmed as TValue]);
+    }
+    setInputValue('');
+  }
+}
+
+function isGroup<TValue>(
+  option: Option<TValue> | GroupBase<Option<TValue>>
+): option is GroupBase<Option<TValue>> {
+  return 'options' in option;
+}
diff --git a/app/react/components/form-components/PortainerSelectCustomRenderers.tsx b/app/react/components/form-components/PortainerSelectCustomRenderers.tsx
new file mode 100644
index 0000000..4faf5aa
--- /dev/null
+++ b/app/react/components/form-components/PortainerSelectCustomRenderers.tsx
@@ -0,0 +1,49 @@
+import {
+  GroupBase,
+  OptionProps,
+  SingleValueProps,
+  SelectComponentsConfig,
+  components,
+} from 'react-select';
+import { ReactNode } from 'react';
+
+import { Option } from './PortainerSelect';
+
+export function CustomComponents<TValue>(
+  render: (data: Option<TValue>) => ReactNode
+): SelectComponentsConfig<Option<TValue>, false, GroupBase<Option<TValue>>> {
+  return {
+    Option: CustomOption(render),
+    SingleValue: CustomSingleValue(render),
+  };
+}
+
+function CustomOption<TValue>(render: (data: Option<TValue>) => ReactNode) {
+  return function CustomOptionRenderer({
+    data,
+    ...props
+  }: OptionProps<Option<TValue>, false, GroupBase<Option<TValue>>>) {
+    return (
+      // eslint-disable-next-line react/jsx-props-no-spreading
+      <components.Option data={data} {...props}>
+        {render(data)}
+      </components.Option>
+    );
+  };
+}
+
+function CustomSingleValue<TValue>(
+  render: (data: Option<TValue>) => ReactNode
+) {
+  return function CustomOptionRenderer({
+    data,
+    ...props
+  }: SingleValueProps<Option<TValue>, false, GroupBase<Option<TValue>>>) {
+    return (
+      // eslint-disable-next-line react/jsx-props-no-spreading
+      <components.SingleValue data={data} {...props}>
+        {render(data)}
+      </components.SingleValue>
+    );
+  };
+}
diff --git a/app/react/components/form-components/ReactSelect.css b/app/react/components/form-components/ReactSelect.css
new file mode 100644
index 0000000..a4b6f1d
--- /dev/null
+++ b/app/react/components/form-components/ReactSelect.css
@@ -0,0 +1,206 @@
+.portainer-selector-root {
+  --multi-value-tag-bg: var(--grey-51);
+  --single-value-option-text-color: currentColor;
+}
+
+:root[theme='dark'] .portainer-selector-root {
+  --multi-value-tag-bg: var(--grey-3);
+  --single-value-option-text-color: var(--white-color);
+}
+
+:root[theme='highcontrast'] .portainer-selector-root {
+  --multi-value-tag-bg: var(--grey-3);
+  --single-value-option-text-color: var(--white-color);
+}
+
+.portainer-selector__placeholder {
+  white-space: nowrap;
+  text-overflow: ellipsis;
+  overflow: hidden;
+}
+
+.portainer-selector-root.sm .portainer-selector__placeholder {
+  @apply text-xs;
+}
+
+.portainer-selector-root.md .portainer-selector__placeholder {
+  @apply text-sm;
+}
+
+.portainer-selector__indicator-separator {
+  display: none;
+}
+
+.portainer-selector-root .portainer-selector__group-heading {
+  text-transform: none !important;
+  font-size: 85% !important;
+}
+
+.input-group .portainer-selector-root:last-child .portainer-selector__control {
+  border-top-left-radius: 0;
+  border-bottom-left-radius: 0;
+  border-top-right-radius: 5px;
+  border-bottom-right-radius: 5px;
+}
+
+.input-group .portainer-selector-root:not(:first-child):not(:last-child) .portainer-selector__control {
+  border-radius: 0;
+}
+
+/* input style */
+.portainer-selector-root .portainer-selector__control {
+  border-color: var(--border-form-control-color);
+  background-color: var(--bg-inputbox);
+  box-shadow: none;
+
+  @apply th-highcontrast:border-white;
+}
+
+/* Match the same box shadow styles as the other portainer inputs, which are inherited from the bootstrap form-control class */
+.portainer-selector-root .portainer-selector__control--is-focused {
+  border-color: #66afe9;
+  -webkit-box-shadow:
+    inset 0 1px 1px rgba(0, 0, 0, 0.075),
+    0 0 8px rgba(102, 175, 233, 0.6);
+  box-shadow:
+    inset 0 1px 1px rgba(0, 0, 0, 0.075),
+    0 0 8px rgba(102, 175, 233, 0.6);
+  transition:
+    border-color ease-in-out 0.15s,
+    -webkit-box-shadow ease-in-out 0.15s;
+}
+
+.portainer-selector-root .portainer-selector__control--is-focused:hover {
+  border-color: #66afe9;
+  -webkit-box-shadow:
+    inset 0 1px 1px rgba(0, 0, 0, 0.075),
+    0 0 8px rgba(102, 175, 233, 0.6);
+  box-shadow:
+    inset 0 1px 1px rgba(0, 0, 0, 0.075),
+    0 0 8px rgba(102, 175, 233, 0.6);
+  transition:
+    border-color ease-in-out 0.15s,
+    -webkit-box-shadow ease-in-out 0.15s;
+}
+
+.portainer-selector-root.sm .portainer-selector__control {
+  min-height: 30px;
+}
+
+.portainer-selector-root.md .portainer-selector__control {
+  min-height: 34px;
+}
+
+.input-group .portainer-selector-root .portainer-selector__control:not(:first-child) {
+  border-top-left-radius: 0;
+  border-bottom-left-radius: 0;
+}
+
+.input-group .portainer-selector-root .portainer-selector__control:not(:last-child, .portainer-selector__control--menu-is-open) {
+  border-top-right-radius: 0;
+  border-bottom-right-radius: 0;
+}
+
+.portainer-selector-root .portainer-selector__multi-value {
+  background-color: var(--multi-value-tag-bg);
+}
+
+.portainer-selector-root .portainer-selector__input-container {
+  color: var(--text-form-control-color);
+}
+
+.portainer-selector-root.sm .portainer-selector__input-container {
+  height: 20px;
+  @apply text-xs;
+}
+
+.portainer-selector-root .portainer-selector__dropdown-indicator {
+  padding: 0 8px;
+}
+
+.portainer-selector-root .portainer-selector__clear-indicator {
+  padding: 6px;
+}
+
+.portainer-selector-root .portainer-selector__multi-value__label {
+  @apply text-black;
+  @apply th-dark:text-white;
+  @apply th-highcontrast:text-white;
+}
+
+.portainer-selector-root .portainer-selector__single-value {
+  color: var(--single-value-option-text-color);
+}
+
+.portainer-selector-root.sm .portainer-selector__single-value {
+  @apply text-xs;
+}
+
+.portainer-selector-root.md .portainer-selector__single-value {
+  @apply text-sm;
+}
+
+/* Menu colors */
+.portainer-selector__menu {
+  --bg-multiselect-color: var(--white-color);
+  --border-multiselect: var(--grey-48);
+
+  --focused-option-bg: var(--ui-gray-3);
+  --focused-option-color: currentColor;
+
+  --selected-option-text-color: var(--grey-7);
+}
+
+:root[theme='dark'] .portainer-selector__menu {
+  --bg-multiselect-color: var(--grey-1);
+  --border-multiselect: var(--grey-3);
+
+  --focused-option-bg: var(--blue-2);
+  --focused-option-color: var(--white-color);
+
+  --selected-option-text-color: var(--white);
+}
+:root[theme='highcontrast'] .portainer-selector__menu {
+  --bg-multiselect-color: var(--black-color);
+  --border-multiselect: var(--grey-3);
+
+  --focused-option-bg: var(--blue-2);
+  --focused-option-color: var(--white-color);
+
+  --selected-option-text-color: var(--white);
+}
+
+.portainer-selector__menu-portal .portainer-selector__menu,
+.portainer-selector-root .portainer-selector__menu {
+  background-color: var(--bg-multiselect-color);
+  border: 1px solid var(--border-multiselect);
+  padding: 5px;
+  z-index: 10;
+}
+
+.portainer-selector__menu-portal {
+  z-index: 50 !important;
+}
+
+.portainer-selector__menu-portal .portainer-selector__menu .portainer-selector__option,
+.portainer-selector-root .portainer-selector__menu .portainer-selector__option {
+  background-color: var(--bg-multiselect-color);
+  border-radius: 5px;
+}
+
+.portainer-selector-root.sm .portainer-selector__menu .portainer-selector__option {
+  @apply text-xs;
+}
+
+.portainer-selector__menu-portal .portainer-selector__menu .portainer-selector__option:active,
+.portainer-selector__menu-portal .portainer-selector__menu .portainer-selector__option--is-focused,
+.portainer-selector-root .portainer-selector__menu .portainer-selector__option:active,
+.portainer-selector-root .portainer-selector__menu .portainer-selector__option--is-focused {
+  background-color: var(--focused-option-bg);
+  color: var(--focused-option-color);
+}
+
+.portainer-selector__menu-portal .portainer-selector__menu .portainer-selector__option--is-selected,
+.portainer-selector-root .portainer-selector__menu .portainer-selector__option--is-selected {
+  color: var(--selected-option-text-color);
+}
diff --git a/app/react/components/form-components/ReactSelect.test.tsx b/app/react/components/form-components/ReactSelect.test.tsx
new file mode 100644
index 0000000..d5368b5
--- /dev/null
+++ b/app/react/components/form-components/ReactSelect.test.tsx
@@ -0,0 +1,330 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { vi } from 'vitest';
+
+import selectEvent from '@/react/test-utils/react-select';
+
+import { Select } from './ReactSelect';
+
+describe('ReactSelect', () => {
+  const mockOptions = [
+    { value: 'option1', label: 'Option 1' },
+    { value: 'option2', label: 'Option 2' },
+    { value: 'option3', label: 'Option 3' },
+  ];
+
+  const mockGroupedOptions = [
+    {
+      label: 'Group 1',
+      options: [
+        { value: 'g1-option1', label: 'Group 1 Option 1' },
+        { value: 'g1-option2', label: 'Group 1 Option 2' },
+      ],
+    },
+    {
+      label: 'Group 2',
+      options: [
+        { value: 'g2-option1', label: 'Group 2 Option 1' },
+        { value: 'g2-option2', label: 'Group 2 Option 2' },
+      ],
+    },
+  ];
+
+  describe('Select component', () => {
+    it('should apply the correct size class', () => {
+      const { container } = render(
+        <Select
+          id="test-select"
+          options={mockOptions}
+          size="sm"
+          data-cy="test-select"
+        />
+      );
+
+      const selectContainer = container.querySelector(
+        '.portainer-selector-root'
+      );
+      expect(selectContainer).toHaveClass('sm');
+    });
+
+    it('should apply custom className', () => {
+      const { container } = render(
+        <Select
+          id="test-select"
+          options={mockOptions}
+          className="custom-class"
+          data-cy="test-select"
+        />
+      );
+
+      const selectContainer = container.querySelector(
+        '.portainer-selector-root'
+      );
+      expect(selectContainer).toHaveClass('custom-class');
+    });
+
+    it('should handle onChange event', async () => {
+      const user = userEvent.setup();
+      const handleChange = vi.fn();
+
+      render(
+        <Select
+          id="test-select"
+          options={mockOptions}
+          onChange={handleChange}
+          data-cy="test-select"
+          inputId="test-input"
+        />
+      );
+
+      const input = screen.getByRole('combobox');
+      await selectEvent.select(input, 'Option 2', { user });
+
+      expect(handleChange).toHaveBeenCalledWith(
+        mockOptions[1],
+        expect.objectContaining({ action: 'select-option' })
+      );
+    });
+
+    it('should handle multi-select', async () => {
+      const user = userEvent.setup();
+      const handleChange = vi.fn();
+
+      render(
+        <Select
+          id="test-select"
+          options={mockOptions}
+          onChange={handleChange}
+          isMulti
+          data-cy="test-select"
+          inputId="test-input"
+        />
+      );
+
+      const input = screen.getByRole('combobox');
+      await selectEvent.select(input, 'Option 1', { user });
+      await selectEvent.select(input, 'Option 2', { user });
+
+      expect(handleChange).toHaveBeenCalledTimes(2);
+      expect(handleChange).toHaveBeenLastCalledWith(
+        [mockOptions[0], mockOptions[1]],
+        expect.objectContaining({ action: 'select-option' })
+      );
+    });
+
+    it('should render with grouped options', async () => {
+      const user = userEvent.setup();
+
+      render(
+        <Select
+          id="test-select"
+          options={mockGroupedOptions}
+          data-cy="test-select"
+          inputId="test-input"
+        />
+      );
+
+      const input = screen.getByRole('combobox');
+      await selectEvent.openMenu(input, { user });
+
+      expect(screen.getByText('Group 1')).toBeInTheDocument();
+      expect(screen.getByText('Group 2')).toBeInTheDocument();
+      expect(screen.getByText('Group 1 Option 1')).toBeInTheDocument();
+    });
+
+    it('should handle disabled state', () => {
+      const { container } = render(
+        <Select
+          id="test-select"
+          options={mockOptions}
+          isDisabled
+          data-cy="test-select"
+        />
+      );
+
+      const selectContainer = container.querySelector(
+        '.portainer-selector-root'
+      );
+      expect(selectContainer).toHaveClass('portainer-selector--is-disabled');
+    });
+
+    it('should handle loading state', () => {
+      const { container } = render(
+        <Select
+          id="test-select"
+          options={mockOptions}
+          isLoading
+          data-cy="test-select"
+        />
+      );
+
+      const loadingIndicator = container.querySelector(
+        '.portainer-selector__loading-indicator'
+      );
+      expect(loadingIndicator).toBeInTheDocument();
+    });
+
+    it('should clear selection', async () => {
+      const user = userEvent.setup();
+      const handleChange = vi.fn();
+
+      render(
+        <Select
+          id="test-select"
+          options={mockOptions}
+          onChange={handleChange}
+          isClearable
+          value={mockOptions[0]}
+          data-cy="test-select"
+          inputId="test-input"
+        />
+      );
+
+      const input = screen.getByRole('combobox');
+      await selectEvent.clearFirst(input, { user });
+
+      expect(handleChange).toHaveBeenCalledWith(
+        null,
+        expect.objectContaining({ action: 'clear' })
+      );
+    });
+
+    it('should handle empty options array', () => {
+      render(<Select id="test-select" options={[]} data-cy="test-select" />);
+
+      const input = screen.getByRole('combobox');
+      expect(input).toBeInTheDocument();
+    });
+
+    it('should handle undefined options', () => {
+      render(
+        <Select id="test-select" options={undefined} data-cy="test-select" />
+      );
+
+      const input = screen.getByRole('combobox');
+      expect(input).toBeInTheDocument();
+    });
+  });
+
+  describe('Component integration', () => {
+    it('should switch between regular and paginated select based on options count', async () => {
+      const user = userEvent.setup();
+
+      // First render with few options - should use regular Select
+      const { rerender } = render(
+        <Select
+          id="test-select"
+          options={mockOptions}
+          data-cy="test-select"
+          inputId="test-input"
+        />
+      );
+
+      let input = screen.getByRole('combobox');
+      await user.click(input);
+
+      // Regular select should render all 3 options immediately
+      expect(screen.getByText('Option 1')).toBeInTheDocument();
+      expect(screen.getByText('Option 2')).toBeInTheDocument();
+      expect(screen.getByText('Option 3')).toBeInTheDocument();
+
+      // Close menu
+      await user.keyboard('{Escape}');
+
+      // Now rerender with many options - should switch to TooManyResultsSelector
+      const manyOptions = Array.from({ length: 1001 }, (_, i) => ({
+        value: `option${i}`,
+        label: `Option ${i}`,
+      }));
+
+      rerender(
+        <Select
+          id="test-select"
+          options={manyOptions}
+          data-cy="test-select"
+          inputId="test-input"
+        />
+      );
+
+      input = screen.getByRole('combobox');
+      await user.click(input);
+
+      // Paginated select should only render first page (100 items max)
+      // Check that first few options are present
+      await waitFor(() => {
+        expect(screen.getByText('Option 0')).toBeInTheDocument();
+      });
+
+      // Count total rendered options - should be limited to PAGE_SIZE (100)
+      // React-select uses divs with class portainer-selector__option for options
+      const renderedOptions = document.querySelectorAll(
+        '.portainer-selector__option'
+      );
+      expect(renderedOptions.length).toBeLessThanOrEqual(100);
+      expect(renderedOptions.length).toBeGreaterThan(0);
+
+      // Verify that options beyond page size are NOT rendered
+      expect(screen.queryByText('Option 999')).not.toBeInTheDocument();
+    });
+
+    it('should render creatable mode when isCreatable prop is true', async () => {
+      const user = userEvent.setup();
+      const handleChange = vi.fn();
+
+      render(
+        <Select
+          id="test-select"
+          options={mockOptions}
+          isCreatable
+          onChange={handleChange}
+          data-cy="test-select"
+          inputId="test-input"
+        />
+      );
+
+      const input = screen.getByRole('combobox');
+      // Type a new value that doesn't exist in options
+      await user.type(input, 'Brand New Option');
+
+      // Should show create option (may appear in multiple places)
+      await waitFor(() => {
+        const createOptions = screen.getAllByText(/Create "Brand New Option"/);
+        expect(createOptions.length).toBeGreaterThan(0);
+      });
+    });
+
+    it('should preserve props when switching to TooManyResultsSelector', () => {
+      const handleChange = vi.fn();
+      const manyOptions = Array.from({ length: 1001 }, (_, i) => ({
+        value: `option${i}`,
+        label: `Option ${i}`,
+      }));
+
+      const { container } = render(
+        <Select
+          id="test-select"
+          options={manyOptions}
+          onChange={handleChange}
+          placeholder="Select an option"
+          isSearchable
+          isClearable
+          data-cy="test-select"
+          inputId="test-input"
+        />
+      );
+
+      // Should use TooManyResultsSelector for large datasets
+      const selectContainer = container.querySelector(
+        '.portainer-selector-root'
+      );
+      expect(selectContainer).toBeInTheDocument();
+
+      // Should preserve data-cy attribute
+      const input = screen.getByRole('combobox');
+      expect(input).toHaveAttribute('data-cy', 'test-select');
+
+      // Should preserve id
+      expect(input).toHaveAttribute('id', 'test-input');
+    });
+  });
+});
diff --git a/app/react/components/form-components/ReactSelect.tsx b/app/react/components/form-components/ReactSelect.tsx
new file mode 100644
index 0000000..61ae684
--- /dev/null
+++ b/app/react/components/form-components/ReactSelect.tsx
@@ -0,0 +1,275 @@
+import ReactSelectCreatable, {
+  CreatableProps as ReactSelectCreatableProps,
+} from 'react-select/creatable';
+import {
+  AsyncPaginate as ReactSelectAsyncPaginate,
+  AsyncPaginateProps as ReactSelectAsyncPaginateProps,
+} from 'react-select-async-paginate';
+import ReactSelect, {
+  components,
+  GroupBase,
+  InputProps,
+  OptionsOrGroups,
+  Props as ReactSelectProps,
+  SelectInstance as ReactSelectType,
+} from 'react-select';
+import clsx from 'clsx';
+import { RefAttributes, useMemo, useCallback } from 'react';
+
+import './ReactSelect.css';
+import { AutomationTestingProps } from '@/types';
+
+const PAGE_SIZE = 100;
+const MAX_OPTIONS_WITHOUT_PAGINATION = 1000;
+
+interface DefaultOption {
+  value: string;
+  label: string;
+}
+
+type RegularProps<
+  Option = DefaultOption,
+  IsMulti extends boolean = false,
+  Group extends GroupBase<Option> = GroupBase<Option>,
+> = { isCreatable?: false; size?: 'sm' | 'md' } & ReactSelectProps<
+  Option,
+  IsMulti,
+  Group
+> &
+  RefAttributes<ReactSelectType<Option, IsMulti, Group>> &
+  AutomationTestingProps;
+
+type CreatableProps<
+  Option = DefaultOption,
+  IsMulti extends boolean = false,
+  Group extends GroupBase<Option> = GroupBase<Option>,
+> = { isCreatable: true; size?: 'sm' | 'md' } & ReactSelectCreatableProps<
+  Option,
+  IsMulti,
+  Group
+> &
+  AutomationTestingProps;
+
+type Props<
+  Option = DefaultOption,
+  IsMulti extends boolean = false,
+  Group extends GroupBase<Option> = GroupBase<Option>,
+> =
+  | CreatableProps<Option, IsMulti, Group>
+  | RegularProps<Option, IsMulti, Group>;
+
+/**
+ * DO NOT use this component directly, use PortainerSelect instead.
+ */
+export function Select<
+  Option = DefaultOption,
+  IsMulti extends boolean = false,
+  Group extends GroupBase<Option> = GroupBase<Option>,
+>({
+  className,
+  isCreatable = false,
+  size = 'md',
+
+  ...props
+}: Props<Option, IsMulti, Group> &
+  AutomationTestingProps & {
+    isItemVisible?: (item: Option, search: string) => boolean;
+    id?: string;
+  }) {
+  const Component = isCreatable ? ReactSelectCreatable : ReactSelect;
+  const {
+    options,
+    'data-cy': dataCy,
+    components: componentsProp,
+    ...rest
+  } = props;
+
+  const memoizedComponents = useMemoizedSelectComponents<
+    Option,
+    IsMulti,
+    Group
+  >(dataCy, componentsProp);
+
+  if ((options?.length || 0) > MAX_OPTIONS_WITHOUT_PAGINATION) {
+    return (
+      <TooManyResultsSelector
+        size={size}
+        // eslint-disable-next-line react/jsx-props-no-spreading
+        {...props}
+      />
+    );
+  }
+
+  return (
+    <Component
+      options={options}
+      className={clsx(className, 'portainer-selector-root', size)}
+      classNamePrefix="portainer-selector"
+      components={memoizedComponents}
+      // eslint-disable-next-line react/jsx-props-no-spreading
+      {...rest}
+    />
+  );
+}
+
+export function Creatable<
+  Option = DefaultOption,
+  IsMulti extends boolean = false,
+  Group extends GroupBase<Option> = GroupBase<Option>,
+>({
+  className,
+  ...props
+}: ReactSelectCreatableProps<Option, IsMulti, Group> & AutomationTestingProps) {
+  const { 'data-cy': dataCy, components: componentsProp, ...rest } = props;
+
+  const memoizedComponents = useMemoizedSelectComponents<
+    Option,
+    IsMulti,
+    Group
+  >(dataCy, componentsProp);
+
+  return (
+    <ReactSelectCreatable
+      className={clsx(className, 'portainer-selector-root')}
+      classNamePrefix="portainer-selector"
+      components={memoizedComponents}
+      // eslint-disable-next-line react/jsx-props-no-spreading
+      {...rest}
+    />
+  );
+}
+
+export function Async<
+  Option = DefaultOption,
+  IsMulti extends boolean = false,
+  Group extends GroupBase<Option> = GroupBase<Option>,
+>({
+  className,
+  size,
+  ...props
+}: ReactSelectAsyncPaginateProps<Option, Group, unknown, IsMulti> & {
+  size?: 'sm' | 'md';
+} & AutomationTestingProps) {
+  const { 'data-cy': dataCy, components: componentsProp, ...rest } = props;
+
+  const memoizedComponents = useMemoizedSelectComponents<
+    Option,
+    IsMulti,
+    Group
+  >(dataCy, componentsProp);
+
+  return (
+    <ReactSelectAsyncPaginate
+      className={clsx(className, 'portainer-selector-root', size)}
+      classNamePrefix="portainer-selector"
+      components={memoizedComponents}
+      // eslint-disable-next-line react/jsx-props-no-spreading
+      {...rest}
+    />
+  );
+}
+
+export function TooManyResultsSelector<
+  Option = DefaultOption,
+  IsMulti extends boolean = false,
+  Group extends GroupBase<Option> = GroupBase<Option>,
+>({
+  options,
+  isLoading,
+  getOptionValue,
+  getOptionLabel,
+  isItemVisible = (item, search) =>
+    search.trim() === '' ||
+    !!getOptionLabel?.(item).toLowerCase().includes(search.toLowerCase()),
+  ...props
+}: RegularProps<Option, IsMulti, Group> & {
+  isItemVisible?: (item: Option, search: string) => boolean;
+}) {
+  return (
+    <Async
+      isLoading={isLoading}
+      getOptionValue={getOptionValue}
+      loadOptions={(
+        search: string,
+        loadedOptions: OptionsOrGroups<Option, Group> | undefined
+      ) =>
+        filterOptions<Option, Group>(
+          options,
+          isItemVisible,
+          search,
+          loadedOptions
+        )
+      }
+      // eslint-disable-next-line react/jsx-props-no-spreading
+      {...props}
+    />
+  );
+}
+
+function filterOptions<
+  Option = DefaultOption,
+  Group extends GroupBase<Option> = GroupBase<Option>,
+>(
+  options: OptionsOrGroups<Option, Group> | undefined,
+  isItemVisible: (item: Option, search: string) => boolean,
+  search: string,
+  loadedOptions?: OptionsOrGroups<Option, Group>
+) {
+  const filteredOptions = options?.filter((item) =>
+    isGroup(item)
+      ? item.options.some((ni) => isItemVisible(ni, search))
+      : isItemVisible(item, search)
+  );
+
+  const offset = loadedOptions?.length ?? 0;
+
+  return {
+    options: filteredOptions?.slice(offset, offset + PAGE_SIZE) ?? [],
+    hasMore: (filteredOptions?.length ?? 0) > offset + PAGE_SIZE,
+  };
+}
+
+function isGroup<
+  Option = DefaultOption,
+  Group extends GroupBase<Option> = GroupBase<Option>,
+>(option: Option | Group): option is Group {
+  if (!option) {
+    return false;
+  }
+
+  if (typeof option !== 'object') {
+    return false;
+  }
+
+  return 'options' in option;
+}
+
+/**
+ * Memoize components to prevent unnecessary re-renders.
+ */
+function useMemoizedSelectComponents<
+  Option = DefaultOption,
+  IsMulti extends boolean = false,
+  Group extends GroupBase<Option> = GroupBase<Option>,
+>(
+  dataCy: string | undefined,
+  componentsProp: Partial<
+    ReactSelectProps<Option, IsMulti, Group>['components']
+  >
+) {
+  const customInput = useCallback(
+    (inputProps: InputProps<Option, IsMulti, Group>) =>
+      components.Input({ ...inputProps, 'data-cy': dataCy }),
+    [dataCy]
+  );
+
+  const memoizedComponents = useMemo(
+    () => ({
+      Input: customInput,
+      ...componentsProp,
+    }),
+    [customInput, componentsProp]
+  );
+
+  return memoizedComponents;
+}
diff --git a/app/react/components/form-components/SegmentedControl.stories.tsx b/app/react/components/form-components/SegmentedControl.stories.tsx
new file mode 100644
index 0000000..fcfb9e3
--- /dev/null
+++ b/app/react/components/form-components/SegmentedControl.stories.tsx
@@ -0,0 +1,49 @@
+import { Meta, StoryFn } from '@storybook/react-webpack5';
+import { useState } from 'react';
+
+import { SegmentedControl } from './SegmentedControl';
+import type {
+  SegmentedControlVariant,
+  SegmentedControlSize,
+} from './SegmentedControl';
+
+export default {
+  component: SegmentedControl,
+  title: 'Components/Forms/SegmentedControl',
+} as Meta;
+
+const items = [
+  { id: 'all', label: 'All' },
+  { id: 'running', label: 'Running' },
+  { id: 'stopped', label: 'Stopped' },
+  { id: 'disabled-item', label: 'Disabled', disabled: true },
+];
+
+function Controlled({
+  variant,
+  size,
+}: {
+  variant?: SegmentedControlVariant;
+  size?: SegmentedControlSize;
+}) {
+  const [active, setActive] = useState('all');
+  return (
+    <SegmentedControl
+      items={items}
+      activeId={active}
+      onChange={setActive}
+      label="Filter"
+      variant={variant}
+      size={size}
+    />
+  );
+}
+
+export const ContainedMd: StoryFn = () => (
+  <Controlled variant="contained" size="md" />
+);
+export const ContainedSm: StoryFn = () => (
+  <Controlled variant="contained" size="sm" />
+);
+export const PillMd: StoryFn = () => <Controlled variant="pill" size="md" />;
+export const PillSm: StoryFn = () => <Controlled variant="pill" size="sm" />;
diff --git a/app/react/components/form-components/SegmentedControl.tsx b/app/react/components/form-components/SegmentedControl.tsx
new file mode 100644
index 0000000..70a237c
--- /dev/null
+++ b/app/react/components/form-components/SegmentedControl.tsx
@@ -0,0 +1,92 @@
+import clsx from 'clsx';
+import { ReactNode } from 'react';
+
+import { useId } from '@/react/hooks/useId';
+
+import { Tabs } from '@@/primitives/Tabs/Tabs';
+
+export interface SegmentItem {
+  id: string;
+  label: ReactNode;
+  title?: string;
+  disabled?: boolean;
+}
+
+export type SegmentedControlVariant = 'contained' | 'pill';
+export type SegmentedControlSize = 'sm' | 'md';
+
+interface Props {
+  items: SegmentItem[];
+  activeId?: string;
+  onChange?: (id: string) => void;
+  size?: SegmentedControlSize;
+  variant?: SegmentedControlVariant;
+  className?: string;
+  label: string;
+}
+
+export function SegmentedControl({
+  items,
+  activeId,
+  onChange,
+  size = 'md',
+  variant = 'contained',
+  className,
+  label,
+}: Props) {
+  const groupName = useId();
+
+  return (
+    <fieldset className={clsx('m-0 min-w-0 border-0 p-0', className)}>
+      <legend className="sr-only">{label}</legend>
+      <Tabs.Container variant={variant} size={size}>
+        {items.map((item) => (
+          <SegmentedControlItem
+            key={item.id}
+            item={item}
+            isActive={item.id === activeId}
+            groupName={groupName}
+            onChange={onChange}
+          />
+        ))}
+      </Tabs.Container>
+    </fieldset>
+  );
+}
+
+interface ItemProps {
+  item: SegmentItem;
+  isActive: boolean;
+  groupName: string;
+  onChange?: (id: string) => void;
+}
+
+function SegmentedControlItem({
+  item,
+  isActive,
+  groupName,
+  onChange,
+}: ItemProps) {
+  return (
+    <Tabs.Item
+      asChild
+      isActive={isActive}
+      disabled={item.disabled}
+      className="m-0"
+    >
+      <label title={item.title}>
+        <input
+          type="radio"
+          name={groupName}
+          value={item.id}
+          checked={isActive}
+          disabled={item.disabled}
+          onChange={() => onChange?.(item.id)}
+          className="sr-only"
+          aria-label={item.title}
+        />
+        {item.label}
+      </label>
+    </Tabs.Item>
+  );
+}
diff --git a/app/react/components/form-components/Slider/Slider.module.css b/app/react/components/form-components/Slider/Slider.module.css
new file mode 100644
index 0000000..81e2c68
--- /dev/null
+++ b/app/react/components/form-components/Slider/Slider.module.css
@@ -0,0 +1,40 @@
+.root {
+  padding-top: 50px;
+}
+
+.root :global .rc-slider .rc-slider-handle-dragging {
+  @apply border-2 border-blue-8;
+}
+
+.root :global .rc-slider-dot {
+  display: none;
+}
+
+.root :global .rc-slider-handle {
+  @apply border-2 border-blue-8;
+  width: 24px;
+  height: 24px;
+  margin-top: -8px;
+  border-radius: 16px;
+  opacity: 1;
+  background-color: #ffffff;
+}
+
+.root :global .rc-slider-track {
+  @apply bg-blue-8;
+  height: 8px;
+}
+
+.root :global .rc-slider-rail {
+  height: 8px;
+}
+
+.root :global .rc-slider-mark {
+  top: -28px;
+}
+
+.root :global .rc-slider-mark-text {
+  font-size: 14px;
+  color: var(--text-body-color);
+  user-select: none;
+}
diff --git a/app/react/components/form-components/Slider/Slider.stories.tsx b/app/react/components/form-components/Slider/Slider.stories.tsx
new file mode 100644
index 0000000..2aa90be
--- /dev/null
+++ b/app/react/components/form-components/Slider/Slider.stories.tsx
@@ -0,0 +1,52 @@
+import { Meta, StoryFn } from '@storybook/react-webpack5';
+import { useEffect, useState } from 'react';
+
+import { Slider, Props } from './Slider';
+
+export default {
+  component: Slider,
+  title: 'Components/Forms/Slider',
+} as Meta;
+
+function Template({
+  value,
+  min,
+  max,
+  step,
+  dataCy,
+  visibleTooltip,
+}: JSX.IntrinsicAttributes & Props) {
+  const [sliderValue, setSliderValue] = useState(min);
+
+  useEffect(() => {
+    setSliderValue(value);
+  }, [value]);
+
+  return (
+    <Slider
+      min={min}
+      max={max}
+      step={step}
+      value={sliderValue}
+      onChange={(value) => {
+        if (Array.isArray(value)) {
+          setSliderValue(value[0]);
+        } else {
+          setSliderValue(value);
+        }
+      }}
+      dataCy={dataCy}
+      visibleTooltip={visibleTooltip}
+    />
+  );
+}
+
+export const Primary: StoryFn<Props> = Template.bind({});
+Primary.args = {
+  min: 0,
+  max: 100,
+  step: 1,
+  value: 5,
+  visibleTooltip: true,
+  dataCy: 'someView-coolSlider',
+};
diff --git a/app/react/components/form-components/Slider/Slider.test.tsx b/app/react/components/form-components/Slider/Slider.test.tsx
new file mode 100644
index 0000000..e084015
--- /dev/null
+++ b/app/react/components/form-components/Slider/Slider.test.tsx
@@ -0,0 +1,32 @@
+import { render } from '@testing-library/react';
+
+import { Slider, Props } from './Slider';
+
+function renderDefault({
+  min = 0,
+  max = 10,
+  step = 1,
+  value = min,
+  onChange = () => {},
+  dataCy = 'someView-coolSlider',
+  visibleTooltip = true,
+}: Partial<Props> = {}) {
+  return render(
+    <Slider
+      min={min}
+      max={max}
+      step={step}
+      onChange={onChange}
+      value={value}
+      visibleTooltip={visibleTooltip}
+      dataCy={dataCy}
+    />
+  );
+}
+
+test('should display a Slider component', async () => {
+  const { getByRole } = renderDefault({});
+
+  const handle = getByRole('slider');
+  expect(handle).toBeTruthy();
+});
diff --git a/app/react/components/form-components/Slider/Slider.tsx b/app/react/components/form-components/Slider/Slider.tsx
new file mode 100644
index 0000000..8d75f5b
--- /dev/null
+++ b/app/react/components/form-components/Slider/Slider.tsx
@@ -0,0 +1,72 @@
+import { ReactElement } from 'react';
+import RcSlider from 'rc-slider';
+import { HandleProps } from 'rc-slider/lib/Handles/Handle';
+
+import { SliderTooltip } from '@@/Tip/SliderTooltip';
+
+import styles from './Slider.module.css';
+
+import 'rc-slider/assets/index.css';
+
+export interface Props {
+  min: number;
+  max: number;
+  step: number;
+  value: number;
+  onChange: (value: number | number[]) => void;
+  dataCy: string;
+  // true if you want to always show the tooltip
+  visibleTooltip?: boolean;
+  disabled?: boolean;
+}
+
+export function Slider({
+  min,
+  max,
+  step,
+  value,
+  onChange,
+  dataCy,
+  visibleTooltip: visible,
+  disabled,
+}: Props) {
+  const marks = {
+    [min]: visible && value / max < 0.1 ? '' : translateMinValue(min),
+    [max]: visible && value / max > 0.9 ? '' : max.toString(),
+  };
+
+  return (
+    <div className={styles.root} data-cy={dataCy}>
+      <RcSlider
+        handleRender={visible ? sliderTooltip : undefined}
+        min={min}
+        max={max}
+        marks={marks}
+        step={step}
+        disabled={disabled}
+        value={value}
+        onChange={onChange}
+      />
+    </div>
+  );
+}
+
+function translateMinValue(value: number) {
+  if (value === 0) {
+    return 'unlimited';
+  }
+  return value.toString();
+}
+
+function sliderTooltip(
+  node: ReactElement<HandleProps>,
+  handleProps: { value: number }
+) {
+  return (
+    <SliderTooltip
+      value={translateMinValue(handleProps.value)}
+      child={node}
+      delay={0}
+    />
+  );
+}
diff --git a/app/react/components/form-components/Slider/SliderWithInput.tsx b/app/react/components/form-components/Slider/SliderWithInput.tsx
new file mode 100644
index 0000000..088a910
--- /dev/null
+++ b/app/react/components/form-components/Slider/SliderWithInput.tsx
@@ -0,0 +1,53 @@
+import { Input } from '../Input';
+
+import { Slider } from './Slider';
+
+export function SliderWithInput({
+  value,
+  onChange,
+  max,
+  min = 0,
+  step = 1,
+  dataCy,
+  visibleTooltip = false,
+  inputId,
+}: {
+  value: number;
+  onChange: (value: number) => void;
+  max: number;
+  min?: number;
+  dataCy: string;
+  step?: number;
+  visibleTooltip?: boolean;
+  inputId?: string;
+}) {
+  return (
+    <div className="flex items-center gap-6">
+      {max && (
+        <div className="mr-2 flex-1">
+          <Slider
+            onChange={(value) =>
+              onChange(typeof value === 'number' ? value : value[0])
+            }
+            value={value}
+            min={min}
+            max={max}
+            step={step}
+            dataCy={`${dataCy}Slider`}
+            visibleTooltip={visibleTooltip}
+          />
+        </div>
+      )}
+      <Input
+        type="number"
+        min="0"
+        max={max}
+        value={value}
+        onChange={(e) => onChange(e.target.valueAsNumber)}
+        className="w-32"
+        data-cy={`${dataCy}Input`}
+        id={inputId}
+      />
+    </div>
+  );
+}
diff --git a/app/react/components/form-components/Slider/index.ts b/app/react/components/form-components/Slider/index.ts
new file mode 100644
index 0000000..f84acd8
--- /dev/null
+++ b/app/react/components/form-components/Slider/index.ts
@@ -0,0 +1 @@
+export { Slider } from './Slider';
diff --git a/app/react/components/form-components/SwitchField/Switch.css b/app/react/components/form-components/SwitchField/Switch.css
new file mode 100644
index 0000000..1234ea3
--- /dev/null
+++ b/app/react/components/form-components/SwitchField/Switch.css
@@ -0,0 +1,81 @@
+/* switch box */
+
+.switch {
+  --switch-size: 24px;
+}
+
+.switch.small {
+  --switch-size: 12px;
+}
+
+/* Bring offscreen, but allow it to be focusable for accessibility */
+.switch input[type='checkbox'] {
+  position: absolute;
+  opacity: 0;
+  z-index: -1;
+  width: 1px;
+  height: 1px;
+  overflow: hidden;
+}
+
+.switch i {
+  display: inline-block;
+  vertical-align: middle;
+  cursor: pointer;
+  padding-right: var(--switch-size);
+  transition: all ease 0.2s;
+  -webkit-transition: all ease 0.2s;
+  -moz-transition: all ease 0.2s;
+  -o-transition: all ease 0.2s;
+  border-radius: var(--switch-size);
+  box-shadow: inset 0 0 1px 1px rgba(0, 0, 0, 0.5);
+}
+
+.switch i:before {
+  display: block;
+  content: '';
+  width: var(--switch-size);
+  height: var(--switch-size);
+  border-radius: var(--switch-size);
+  background: white;
+  box-shadow: 0 0 1px 1px rgba(0, 0, 0, 0.5);
+}
+
+.switch :checked + i {
+  padding-right: 0;
+  padding-left: var(--switch-size);
+  -webkit-box-shadow:
+    inset 0 0 1px rgba(0, 0, 0, 0.5),
+    inset 0 0 40px #337ab7;
+  -moz-box-shadow:
+    inset 0 0 1px rgba(0, 0, 0, 0.5),
+    inset 0 0 40px #337ab7;
+  box-shadow:
+    inset 0 0 1px rgba(0, 0, 0, 0.5),
+    inset 0 0 40px #337ab7;
+}
+
+.switch :disabled + i {
+  opacity: 0.5;
+  cursor: not-allowed;
+}
+
+.switch.limited {
+  touch-action: none;
+}
+
+.switch.limited i {
+  opacity: 1;
+  cursor: not-allowed;
+}
+
+.switch.business i {
+  background-color: var(--BE-only);
+  box-shadow:
+    inset 0 0 1px rgb(0 0 0 / 50%),
+    inset 0 0 40px var(--BE-only);
+}
+
+.switch input[type='checkbox']:disabled + .slider {
+  cursor: not-allowed;
+}
diff --git a/app/react/components/form-components/SwitchField/Switch.module.css b/app/react/components/form-components/SwitchField/Switch.module.css
new file mode 100644
index 0000000..9e11805
--- /dev/null
+++ b/app/react/components/form-components/SwitchField/Switch.module.css
@@ -0,0 +1,3 @@
+.root {
+  margin-bottom: 0;
+}
diff --git a/app/react/components/form-components/SwitchField/Switch.stories.tsx b/app/react/components/form-components/SwitchField/Switch.stories.tsx
new file mode 100644
index 0000000..94c65c9
--- /dev/null
+++ b/app/react/components/form-components/SwitchField/Switch.stories.tsx
@@ -0,0 +1,51 @@
+import { Meta, StoryFn } from '@storybook/react-webpack5';
+import { useState } from 'react';
+
+import { Switch } from './Switch';
+
+export default {
+  title: 'Components/Forms/SwitchField/Switch',
+} as Meta;
+
+export function Example() {
+  const [isChecked, setIsChecked] = useState(false);
+  function onChange() {
+    setIsChecked(!isChecked);
+  }
+
+  return (
+    <Switch
+      name="name"
+      data-cy="switch"
+      checked={isChecked}
+      onChange={onChange}
+      id="id"
+    />
+  );
+}
+
+interface Args {
+  checked: boolean;
+}
+
+function Template({ checked }: Args) {
+  return (
+    <Switch
+      name="name"
+      data-cy="switch"
+      checked={checked}
+      onChange={() => {}}
+      id="id"
+    />
+  );
+}
+
+export const Checked: StoryFn<Args> = Template.bind({});
+Checked.args = {
+  checked: true,
+};
+
+export const Unchecked: StoryFn<Args> = Template.bind({});
+Unchecked.args = {
+  checked: false,
+};
diff --git a/app/react/components/form-components/SwitchField/Switch.test.tsx b/app/react/components/form-components/SwitchField/Switch.test.tsx
new file mode 100644
index 0000000..ce4c10a
--- /dev/null
+++ b/app/react/components/form-components/SwitchField/Switch.test.tsx
@@ -0,0 +1,26 @@
+import { PropsWithChildren } from 'react';
+import { render } from '@testing-library/react';
+
+import { Switch, Props } from './Switch';
+
+function renderDefault({
+  name = 'default name',
+  checked = false,
+}: Partial<PropsWithChildren<Props>> = {}) {
+  return render(
+    <Switch
+      id="id"
+      name={name}
+      checked={checked}
+      onChange={() => {}}
+      data-cy="switch"
+    />
+  );
+}
+
+test('should display a Switch component', async () => {
+  const { findByRole } = renderDefault();
+
+  const switchElem = await findByRole('checkbox');
+  expect(switchElem).toBeTruthy();
+});
diff --git a/app/react/components/form-components/SwitchField/Switch.tsx b/app/react/components/form-components/SwitchField/Switch.tsx
new file mode 100644
index 0000000..54acc29
--- /dev/null
+++ b/app/react/components/form-components/SwitchField/Switch.tsx
@@ -0,0 +1,62 @@
+import clsx from 'clsx';
+
+import { isLimitedToBE } from '@/react/portainer/feature-flags/feature-flags.service';
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+import { AutomationTestingProps } from '@/types';
+
+import { BEFeatureIndicator } from '@@/BEFeatureIndicator';
+
+import './Switch.css';
+
+import styles from './Switch.module.css';
+
+export interface Props extends AutomationTestingProps {
+  checked: boolean;
+  id: string;
+  name: string;
+  onChange(checked: boolean, index?: number): void;
+
+  index?: number;
+  className?: string;
+  disabled?: boolean;
+  featureId?: FeatureId;
+}
+
+export function Switch({
+  name,
+  checked,
+  id,
+  disabled,
+  'data-cy': dataCy,
+  onChange,
+  index,
+  featureId,
+  className,
+}: Props) {
+  const limitedToBE = isLimitedToBE(featureId);
+
+  return (
+    <>
+      {/* eslint-disable-next-line jsx-a11y/label-has-associated-control -- accessible text is provided by the parent SwitchField label */}
+      <label
+        className={clsx('switch', className, styles.root, {
+          business: limitedToBE,
+          limited: limitedToBE,
+        })}
+        data-cy={dataCy}
+        aria-checked={checked}
+      >
+        <input
+          type="checkbox"
+          name={name}
+          id={id}
+          checked={checked}
+          disabled={disabled || limitedToBE}
+          onChange={({ target: { checked } }) => onChange(checked, index)}
+        />
+        <span className="slider round before:content-['']" />
+      </label>
+      {featureId && limitedToBE && <BEFeatureIndicator featureId={featureId} />}
+    </>
+  );
+}
diff --git a/app/react/components/form-components/SwitchField/SwitchField.module.css b/app/react/components/form-components/SwitchField/SwitchField.module.css
new file mode 100644
index 0000000..9223d50
--- /dev/null
+++ b/app/react/components/form-components/SwitchField/SwitchField.module.css
@@ -0,0 +1,5 @@
+.root {
+  display: flex;
+  align-items: center;
+  margin: 0;
+}
diff --git a/app/react/components/form-components/SwitchField/SwitchField.stories.tsx b/app/react/components/form-components/SwitchField/SwitchField.stories.tsx
new file mode 100644
index 0000000..cd9b92c
--- /dev/null
+++ b/app/react/components/form-components/SwitchField/SwitchField.stories.tsx
@@ -0,0 +1,58 @@
+import { Meta, StoryFn } from '@storybook/react-webpack5';
+import { useState } from 'react';
+
+import { SwitchField } from './SwitchField';
+
+export default {
+  title: 'Components/Forms/SwitchField',
+} as Meta;
+
+export function Example() {
+  const [isChecked, setIsChecked] = useState(false);
+  function onChange() {
+    setIsChecked(!isChecked);
+  }
+
+  return (
+    <SwitchField
+      name="name"
+      data-cy="switch-field-example"
+      checked={isChecked}
+      onChange={onChange}
+      label="Example"
+    />
+  );
+}
+
+interface Args {
+  checked: boolean;
+  label: string;
+  labelClass: string;
+}
+
+function Template({ checked, label, labelClass }: Args) {
+  return (
+    <SwitchField
+      name="name"
+      data-cy="switch-field-example"
+      checked={checked}
+      onChange={() => {}}
+      label={label}
+      labelClass={labelClass}
+    />
+  );
+}
+
+export const Checked: StoryFn<Args> = Template.bind({});
+Checked.args = {
+  checked: true,
+  label: 'label',
+  labelClass: 'col-sm-6',
+};
+
+export const Unchecked: StoryFn<Args> = Template.bind({});
+Unchecked.args = {
+  checked: false,
+  label: 'label',
+  labelClass: 'col-sm-6',
+};
diff --git a/app/react/components/form-components/SwitchField/SwitchField.test.tsx b/app/react/components/form-components/SwitchField/SwitchField.test.tsx
new file mode 100644
index 0000000..4c72cff
--- /dev/null
+++ b/app/react/components/form-components/SwitchField/SwitchField.test.tsx
@@ -0,0 +1,52 @@
+import { render, fireEvent } from '@testing-library/react';
+
+import { SwitchField, Props } from './SwitchField';
+
+function renderDefault({
+  name = 'default name',
+  checked = false,
+  label = 'label',
+  onChange = vi.fn(),
+  index,
+}: Partial<Props> = {}) {
+  return render(
+    <SwitchField
+      label={label}
+      data-cy="switch-field"
+      name={name}
+      checked={checked}
+      onChange={onChange}
+      index={index}
+    />
+  );
+}
+
+test('should display a Switch component', async () => {
+  const { findByRole } = renderDefault();
+
+  const switchElem = await findByRole('checkbox');
+  expect(switchElem).toBeTruthy();
+});
+
+test('clicking should emit on-change with the opposite value', async () => {
+  const onChange = vi.fn();
+  const checked = true;
+  const { findByRole } = renderDefault({ onChange, checked });
+
+  const switchElem = await findByRole('checkbox');
+  fireEvent.click(switchElem);
+
+  expect(onChange).toHaveBeenCalledWith(!checked, undefined);
+});
+
+test('clicking should emit on-change with the opposite value and index', async () => {
+  const onChange = vi.fn();
+  const checked = true;
+  const index = 3;
+  const { findByRole } = renderDefault({ onChange, checked, index });
+
+  const switchElem = await findByRole('checkbox');
+  fireEvent.click(switchElem);
+
+  expect(onChange).toHaveBeenCalledWith(!checked, index);
+});
diff --git a/app/react/components/form-components/SwitchField/SwitchField.tsx b/app/react/components/form-components/SwitchField/SwitchField.tsx
new file mode 100644
index 0000000..935a651
--- /dev/null
+++ b/app/react/components/form-components/SwitchField/SwitchField.tsx
@@ -0,0 +1,75 @@
+import clsx from 'clsx';
+import uuid from 'uuid';
+import { ComponentProps, PropsWithChildren, ReactNode, useState } from 'react';
+
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+import { AutomationTestingProps } from '@/types';
+
+import { Tooltip } from '@@/Tip/Tooltip';
+
+import styles from './SwitchField.module.css';
+import { Switch } from './Switch';
+
+export interface Props extends AutomationTestingProps {
+  label: string;
+  checked: boolean;
+  onChange(value: boolean, index?: number): void;
+
+  index?: number;
+  name?: string;
+  tooltip?: ComponentProps<typeof Tooltip>['message'];
+  setTooltipHtmlMessage?: ComponentProps<typeof Tooltip>['setHtmlMessage'];
+  labelClass?: string;
+  switchClass?: string;
+  fieldClass?: string;
+
+  disabled?: boolean;
+  featureId?: FeatureId;
+  valueExplanation?: ReactNode;
+}
+
+export function SwitchField({
+  tooltip,
+  checked,
+  label,
+  index,
+  name,
+  labelClass,
+  fieldClass,
+  'data-cy': dataCy,
+  disabled,
+  onChange,
+  featureId,
+  switchClass,
+  setTooltipHtmlMessage,
+  valueExplanation,
+}: PropsWithChildren<Props>) {
+  const [toggleId] = useState(() => `toggle_${uuid()}`);
+  const toggleName = name ? `toggle_${name}` : '';
+
+  return (
+    <div className={clsx(styles.root, fieldClass)}>
+      <label
+        className={clsx('space-right control-label !p-0 text-left', labelClass)}
+        htmlFor={toggleId}
+      >
+        {label}
+        {tooltip && (
+          <Tooltip message={tooltip} setHtmlMessage={setTooltipHtmlMessage} />
+        )}
+      </label>
+      <Switch
+        className={clsx('space-right', switchClass)}
+        name={toggleName}
+        id={toggleId}
+        checked={checked}
+        disabled={disabled}
+        onChange={onChange}
+        index={index}
+        featureId={featureId}
+        data-cy={dataCy}
+      />
+      {valueExplanation && <span>{valueExplanation}</span>}
+    </div>
+  );
+}
diff --git a/app/react/components/form-components/SwitchField/index.ts b/app/react/components/form-components/SwitchField/index.ts
new file mode 100644
index 0000000..b8ccca2
--- /dev/null
+++ b/app/react/components/form-components/SwitchField/index.ts
@@ -0,0 +1 @@
+export { SwitchField } from './SwitchField';
diff --git a/app/react/components/form-components/formikUtils.ts b/app/react/components/form-components/formikUtils.ts
new file mode 100644
index 0000000..459b025
--- /dev/null
+++ b/app/react/components/form-components/formikUtils.ts
@@ -0,0 +1,18 @@
+import { FormikErrors } from 'formik';
+
+export function isErrorType<T>(
+  error: string | FormikErrors<T> | undefined
+): error is FormikErrors<T> {
+  return error !== undefined && typeof error !== 'string';
+}
+
+export function isArrayErrorType<T>(
+  error:
+    | string[]
+    | FormikErrors<T>[]
+    | string
+    | undefined
+    | (FormikErrors<T> | undefined)[]
+): error is FormikErrors<T>[] {
+  return error !== undefined && typeof error !== 'string';
+}
diff --git a/app/react/components/form-components/useCachedTest.ts b/app/react/components/form-components/useCachedTest.ts
new file mode 100644
index 0000000..14dfbfc
--- /dev/null
+++ b/app/react/components/form-components/useCachedTest.ts
@@ -0,0 +1,27 @@
+import { useRef } from 'react';
+import { TestContext, TestFunction } from 'yup';
+
+function cacheTest<T, TContext>(
+  asyncValidate: TestFunction<T, TContext>
+): TestFunction<T, TContext> {
+  let valid = true;
+  let value: T | undefined;
+
+  return async (newValue: T, context: TestContext<TContext>) => {
+    if (newValue !== value) {
+      value = newValue;
+
+      const response = await asyncValidate.call(context, newValue, context);
+      valid = !!response;
+    }
+    return valid;
+  };
+}
+
+export function useCachedValidation<T, TContext>(
+  test: TestFunction<T, TContext>
+) {
+  const ref = useRef(cacheTest(test));
+
+  return ref.current;
+}
diff --git a/app/react/components/form-components/useCaretPosition.ts b/app/react/components/form-components/useCaretPosition.ts
new file mode 100644
index 0000000..3681e46
--- /dev/null
+++ b/app/react/components/form-components/useCaretPosition.ts
@@ -0,0 +1,26 @@
+import { useRef, useState, useCallback, useEffect } from 'react';
+
+export function useCaretPosition<
+  T extends HTMLInputElement | HTMLTextAreaElement = HTMLInputElement,
+>() {
+  const node = useRef<T>(null);
+  const [start, setStart] = useState(0);
+  const [end, setEnd] = useState(0);
+
+  const updateCaret = useCallback(() => {
+    if (node.current) {
+      const { selectionStart, selectionEnd } = node.current;
+
+      setStart(selectionStart || 0);
+      setEnd(selectionEnd || 0);
+    }
+  }, []);
+
+  useEffect(() => {
+    if (node.current) {
+      node.current.setSelectionRange(start, end);
+    }
+  });
+
+  return { start, end, ref: node, updateCaret };
+}
diff --git a/app/react/components/form-components/usePreventFormExit.ts b/app/react/components/form-components/usePreventFormExit.ts
new file mode 100644
index 0000000..8d4e8f6
--- /dev/null
+++ b/app/react/components/form-components/usePreventFormExit.ts
@@ -0,0 +1,39 @@
+import { useEffect } from 'react';
+import { useTransitionHook } from '@uirouter/react';
+
+import { confirmGenericDiscard } from '@@/modals/confirm';
+
+export function usePreventFormExit(
+  isChanged: () => boolean,
+  check = true,
+  confirmFn: () => Promise<boolean> = confirmGenericDiscard
+) {
+  // when navigating away from the page with unsaved changes, show a portainer prompt to confirm
+  useTransitionHook('onBefore', {}, async () => {
+    // need to calculate inside the hook because it doesn't have dep array
+    if (!(check && isChanged())) {
+      return true;
+    }
+    return confirmFn();
+  });
+
+  const preventExit = check && isChanged();
+  // when reloading or exiting the page with unsaved changes, show a browser prompt to confirm
+  useEffect(() => {
+    function handler(event: BeforeUnloadEvent) {
+      if (!preventExit) {
+        return undefined;
+      }
+
+      event.preventDefault();
+      // eslint-disable-next-line no-param-reassign
+      event.returnValue = '';
+      return '';
+    }
+
+    window.addEventListener('beforeunload', handler);
+    return () => {
+      window.removeEventListener('beforeunload', handler);
+    };
+  }, [preventExit]);
+}
diff --git a/app/react/components/form-components/validate-form.ts b/app/react/components/form-components/validate-form.ts
new file mode 100644
index 0000000..0d3e544
--- /dev/null
+++ b/app/react/components/form-components/validate-form.ts
@@ -0,0 +1,19 @@
+import { yupToFormErrors } from 'formik';
+import { SchemaOf } from 'yup';
+
+export async function validateForm<T>(
+  schemaBuilder: () => SchemaOf<T>,
+  formValues: T
+) {
+  const validationSchema = schemaBuilder();
+
+  try {
+    await validationSchema.validate(formValues, {
+      strict: true,
+      abortEarly: false,
+    });
+    return undefined;
+  } catch (error) {
+    return yupToFormErrors<T>(error);
+  }
+}
diff --git a/app/react/components/form-components/validate-unique.ts b/app/react/components/form-components/validate-unique.ts
new file mode 100644
index 0000000..1547b0d
--- /dev/null
+++ b/app/react/components/form-components/validate-unique.ts
@@ -0,0 +1,56 @@
+import _ from 'lodash';
+import { AnySchema, TestContext, TypeOf, ValidationError } from 'yup';
+import Lazy from 'yup/lib/Lazy';
+import { AnyObject } from 'yup/lib/types';
+
+/**
+ * Builds a uniqueness test for yup.
+ * @param errorMessage The error message to display for duplicates.
+ * @param path The path to the value to test for uniqueness (if the list item is an object).
+ * @returns A function that can be passed to yup's `test` method.
+ */
+export function buildUniquenessTest<
+  T extends AnySchema | Lazy<AnySchema, AnySchema>,
+>(errorMessage: (errorIndex: number) => string, path = '') {
+  return (
+    list: Array<TypeOf<T>> | undefined,
+    testContext: TestContext<AnyObject>
+  ) => {
+    if (!list) {
+      return true;
+    }
+
+    const values = list.map(mapper);
+
+    // check for duplicates, adding the index of each duplicate to an array
+    const seen = new Set<TypeOf<T>>();
+    const duplicates: number[] = [];
+    values.forEach((value, i) => {
+      if (seen.has(value)) {
+        duplicates.push(i);
+      } else {
+        seen.add(value);
+      }
+    });
+
+    // create an array of yup validation errors for each duplicate
+    const errors = duplicates.map((i) => {
+      const error = new ValidationError(
+        errorMessage(i),
+        list[i],
+        `${testContext.path}[${i}]${path}`
+      );
+      return error;
+    });
+
+    if (errors.length > 0) {
+      throw new ValidationError(errors);
+    }
+
+    return true;
+  };
+
+  function mapper(a: TypeOf<T>) {
+    return path ? _.get(a, path) : a;
+  }
+}
diff --git a/app/react/components/form-components/validate-url.ts b/app/react/components/form-components/validate-url.ts
new file mode 100644
index 0000000..bfe766e
--- /dev/null
+++ b/app/react/components/form-components/validate-url.ts
@@ -0,0 +1,15 @@
+export function isValidUrl(
+  value: string | undefined,
+  additionalCheck: (url: URL) => boolean = () => true
+) {
+  if (!value) {
+    return false;
+  }
+
+  try {
+    const url = new URL(value);
+    return additionalCheck(url);
+  } catch {
+    return false;
+  }
+}
diff --git a/app/react/components/form-components/yup-file-validation.ts b/app/react/components/form-components/yup-file-validation.ts
new file mode 100644
index 0000000..dbdd573
--- /dev/null
+++ b/app/react/components/form-components/yup-file-validation.ts
@@ -0,0 +1,45 @@
+import { mixed } from 'yup';
+import { MixedSchema } from 'yup/lib/mixed';
+
+type FileSchema = MixedSchema<File | undefined>;
+
+export function file(): FileSchema {
+  return mixed();
+}
+
+export function withFileSize(fileValidation: FileSchema, maxSize: number) {
+  return fileValidation.test(
+    'fileSize',
+    'Selected file is too big.',
+    validateFileSize
+  );
+
+  function validateFileSize(file?: File) {
+    if (!file) {
+      return true;
+    }
+
+    return file.size <= maxSize;
+  }
+}
+
+export function withFileExtension(
+  fileValidation: FileSchema,
+  allowedExtensions: string[]
+) {
+  return fileValidation.test(
+    'fileExtension',
+    'Selected file has invalid extension.',
+    validateFileExtension
+  );
+
+  function validateFileExtension(file?: File) {
+    if (!file) {
+      return true;
+    }
+
+    const fileExtension = file.name.split('.').pop();
+
+    return allowedExtensions.includes(fileExtension || '');
+  }
+}
diff --git a/app/react/components/modals/Dialog.tsx b/app/react/components/modals/Dialog.tsx
new file mode 100644
index 0000000..d5552a9
--- /dev/null
+++ b/app/react/components/modals/Dialog.tsx
@@ -0,0 +1,88 @@
+import { ReactNode, useEffect, useState, useRef } from 'react';
+
+import { Button } from '@@/buttons';
+
+import { ButtonOptions, ModalType } from './types';
+import { openModal } from './open-modal';
+import { Modal, OnSubmit } from './Modal';
+
+export interface DialogOptions<T> {
+  title?: ReactNode;
+  message: ReactNode;
+  modalType?: ModalType;
+  buttons: Array<ButtonOptions<T>>;
+}
+
+interface Props<T> extends DialogOptions<T> {
+  onSubmit: OnSubmit<T>;
+}
+
+export function Dialog<T>({
+  buttons,
+  message,
+  title,
+  onSubmit,
+  modalType,
+}: Props<T>) {
+  const ariaLabel = requireString(title) || requireString(message) || 'Dialog';
+
+  const [count, setCount] = useState<number>(0);
+  const countRef = useRef(count);
+  countRef.current = count;
+
+  useEffect(() => {
+    let retFn;
+
+    // only countdown the first button with non-zero timeout
+    for (let i = 0; i < buttons.length; i++) {
+      const button = buttons[i];
+      if (button.timeout) {
+        setCount(button.timeout as number);
+
+        const intervalID = setInterval(() => {
+          const count = countRef.current;
+
+          setCount(count - 1);
+          if (count === 1) {
+            onSubmit(button.value);
+          }
+        }, 1000);
+
+        retFn = () => clearInterval(intervalID);
+
+        break;
+      }
+    }
+
+    return retFn;
+  }, [buttons, onSubmit]);
+
+  return (
+    <Modal onDismiss={() => onSubmit()} aria-label={ariaLabel}>
+      {title && <Modal.Header title={title} modalType={modalType} />}
+      <Modal.Body>{message}</Modal.Body>
+      <Modal.Footer>
+        {buttons.map((button, index) => (
+          <Button
+            onClick={() => onSubmit(button.value)}
+            className={button.className}
+            color={button.color}
+            key={index}
+            size="medium"
+            data-cy={button.dataCy}
+          >
+            {button.label} {button.timeout && count ? `(${count})` : null}
+          </Button>
+        ))}
+      </Modal.Footer>
+    </Modal>
+  );
+}
+
+function requireString(value: ReactNode) {
+  return typeof value === 'string' ? value : undefined;
+}
+
+export async function openDialog<T>(options: DialogOptions<T>) {
+  return openModal<DialogOptions<T>, T>(Dialog, options);
+}
diff --git a/app/react/components/modals/Modal/CloseButton.module.css b/app/react/components/modals/Modal/CloseButton.module.css
new file mode 100644
index 0000000..adff242
--- /dev/null
+++ b/app/react/components/modals/Modal/CloseButton.module.css
@@ -0,0 +1,22 @@
+.close {
+  color: var(--button-close-color);
+  opacity: var(--button-opacity);
+
+  padding: 0;
+  cursor: pointer;
+  background: transparent;
+  border: 0;
+  appearance: none;
+
+  font-size: 21px;
+  font-weight: bold;
+  line-height: 1;
+  text-shadow: 0 1px 0 #fff;
+  filter: alpha(opacity=20);
+}
+
+.close:hover,
+.close:focus {
+  color: var(--button-close-color);
+  opacity: var(--button-opacity-hover);
+}
diff --git a/app/react/components/modals/Modal/CloseButton.tsx b/app/react/components/modals/Modal/CloseButton.tsx
new file mode 100644
index 0000000..534d516
--- /dev/null
+++ b/app/react/components/modals/Modal/CloseButton.tsx
@@ -0,0 +1,25 @@
+import clsx from 'clsx';
+
+import styles from './CloseButton.module.css';
+
+export function CloseButton({
+  onClose,
+  className,
+}: {
+  onClose: () => void;
+  className?: string;
+}) {
+  return (
+    <button
+      type="button"
+      className={clsx(
+        styles.close,
+        className,
+        'close-button absolute right-5 top-4'
+      )}
+      onClick={() => onClose()}
+    >
+      ×
+    </button>
+  );
+}
diff --git a/app/react/components/modals/Modal/Modal.module.css b/app/react/components/modals/Modal/Modal.module.css
new file mode 100644
index 0000000..73bf935
--- /dev/null
+++ b/app/react/components/modals/Modal/Modal.module.css
@@ -0,0 +1,21 @@
+.overlay[data-reach-dialog-overlay] {
+  background: hsla(0, 0%, 0%, 0.8);
+}
+
+.modal-dialog {
+  display: inline-block;
+  text-align: left;
+  vertical-align: middle;
+}
+
+.modal-content {
+  background-color: var(--bg-modal-content-color);
+
+  border: 1px solid rgba(0, 0, 0, 0.2);
+
+  box-shadow: 0 5px 15px rgb(0 0 0 / 50%);
+}
+
+[theme='highcontrast'] .modal-content {
+  border: 1px solid var(--border-widget);
+}
diff --git a/app/react/components/modals/Modal/Modal.tsx b/app/react/components/modals/Modal/Modal.tsx
new file mode 100644
index 0000000..a1b81aa
--- /dev/null
+++ b/app/react/components/modals/Modal/Modal.tsx
@@ -0,0 +1,76 @@
+import { DialogContent, DialogOverlay } from '@reach/dialog';
+import clsx from 'clsx';
+import { createContext, PropsWithChildren, useContext } from 'react';
+
+import { CloseButton } from './CloseButton';
+import styles from './Modal.module.css';
+
+const Context = createContext<boolean | null>(null);
+Context.displayName = 'ModalContext';
+
+export function useModalContext() {
+  const context = useContext(Context);
+  if (!context) {
+    throw new Error('should be nested under Modal');
+  }
+
+  return context;
+}
+
+interface Props {
+  onDismiss?(): void;
+  'aria-label'?: string;
+  'aria-labelledby'?: string;
+  size?: 'md' | 'lg' | 'xl';
+  className?: string;
+  dialogClassName?: string;
+}
+
+export function Modal({
+  children,
+  onDismiss,
+  'aria-label': ariaLabel,
+  'aria-labelledby': ariaLabelledBy,
+  size = 'md',
+  className,
+  dialogClassName,
+}: PropsWithChildren<Props>) {
+  return (
+    <Context.Provider value>
+      <DialogOverlay
+        isOpen
+        className={clsx(styles.overlay, 'flex items-center justify-center')}
+        onDismiss={onDismiss}
+        // When a Sheet is open and then a Modal opens, Radix DismissableLayer sets body.style.pointerEvents="none" for this modal overlay, so make it auto here.
+        // z-index ensures the modal renders above the base views and any Sheet (z-50).
+        style={{ zIndex: 60, pointerEvents: 'auto' }}
+      >
+        <DialogContent
+          aria-label={ariaLabel}
+          aria-labelledby={ariaLabelledBy}
+          className={clsx(
+            styles.modalDialog,
+            'max-h-[calc(100vh-2rem)] max-w-[calc(100vw-2rem)] bg-transparent p-0',
+            {
+              'w-[450px]': size === 'md',
+              'w-[700px]': size === 'lg',
+              'w-[1000px]': size === 'xl',
+            },
+            dialogClassName
+          )}
+        >
+          <div
+            className={clsx(
+              styles.modalContent,
+              'relative overflow-y-auto rounded-lg p-5',
+              className
+            )}
+          >
+            {children}
+            {onDismiss && <CloseButton onClose={onDismiss} />}
+          </div>
+        </DialogContent>
+      </DialogOverlay>
+    </Context.Provider>
+  );
+}
diff --git a/app/react/components/modals/Modal/ModalBody.module.css b/app/react/components/modals/Modal/ModalBody.module.css
new file mode 100644
index 0000000..2a7959d
--- /dev/null
+++ b/app/react/components/modals/Modal/ModalBody.module.css
@@ -0,0 +1,4 @@
+.modal-body {
+  padding: 10px 0px;
+  border-bottom: none;
+}
diff --git a/app/react/components/modals/Modal/ModalBody.tsx b/app/react/components/modals/Modal/ModalBody.tsx
new file mode 100644
index 0000000..5da03cd
--- /dev/null
+++ b/app/react/components/modals/Modal/ModalBody.tsx
@@ -0,0 +1,9 @@
+import { PropsWithChildren } from 'react';
+
+import { useModalContext } from './Modal';
+import styles from './ModalBody.module.css';
+
+export function ModalBody({ children }: PropsWithChildren<unknown>) {
+  useModalContext();
+  return <div className={styles.modalBody}>{children}</div>;
+}
diff --git a/app/react/components/modals/Modal/ModalFooter.module.css b/app/react/components/modals/Modal/ModalFooter.module.css
new file mode 100644
index 0000000..d1fc061
--- /dev/null
+++ b/app/react/components/modals/Modal/ModalFooter.module.css
@@ -0,0 +1,5 @@
+.modal-footer {
+  padding: 10px 0px;
+  border-top: none;
+  display: flex;
+}
diff --git a/app/react/components/modals/Modal/ModalFooter.tsx b/app/react/components/modals/Modal/ModalFooter.tsx
new file mode 100644
index 0000000..66b0310
--- /dev/null
+++ b/app/react/components/modals/Modal/ModalFooter.tsx
@@ -0,0 +1,11 @@
+import { PropsWithChildren } from 'react';
+
+import { useModalContext } from './Modal';
+
+export function ModalFooter({ children }: PropsWithChildren<unknown>) {
+  useModalContext();
+
+  return (
+    <div className="flex justify-end gap-3 pt-3 [&>*]:flex-1">{children}</div>
+  );
+}
diff --git a/app/react/components/modals/Modal/ModalHeader.module.css b/app/react/components/modals/Modal/ModalHeader.module.css
new file mode 100644
index 0000000..a16b4a9
--- /dev/null
+++ b/app/react/components/modals/Modal/ModalHeader.module.css
@@ -0,0 +1,19 @@
+.modal-header {
+  margin-bottom: 10px;
+  padding: 0px;
+  border-bottom: none;
+}
+
+.background-error {
+  padding-top: 55px;
+  background-image: url(~@/assets/images/icon-error.svg);
+  background-repeat: no-repeat;
+  background-position: top left;
+}
+
+.background-warning {
+  padding-top: 55px;
+  background-image: url(~@/assets/images/icon-warning.svg);
+  background-repeat: no-repeat;
+  background-position: top left;
+}
diff --git a/app/react/components/modals/Modal/ModalHeader.tsx b/app/react/components/modals/Modal/ModalHeader.tsx
new file mode 100644
index 0000000..89a0351
--- /dev/null
+++ b/app/react/components/modals/Modal/ModalHeader.tsx
@@ -0,0 +1,33 @@
+import clsx from 'clsx';
+import { ReactNode } from 'react';
+
+import { ModalType } from './types';
+import { useModalContext } from './Modal';
+import styles from './ModalHeader.module.css';
+
+interface Props {
+  title: ReactNode;
+  modalType?: ModalType;
+}
+
+export function ModalHeader({ title, modalType }: Props) {
+  useModalContext();
+
+  return (
+    <div className={styles.modalHeader}>
+      {modalType && (
+        <div
+          className={clsx({
+            [styles.backgroundError]: modalType === ModalType.Destructive,
+            [styles.backgroundWarning]: modalType === ModalType.Warn,
+          })}
+        />
+      )}
+      {typeof title === 'string' ? (
+        <h5 className="m-0 font-bold">{title}</h5>
+      ) : (
+        title
+      )}
+    </div>
+  );
+}
diff --git a/app/react/components/modals/Modal/index.tsx b/app/react/components/modals/Modal/index.tsx
new file mode 100644
index 0000000..c51aa71
--- /dev/null
+++ b/app/react/components/modals/Modal/index.tsx
@@ -0,0 +1,20 @@
+import { Modal as MainComponent } from './Modal';
+import { ModalHeader } from './ModalHeader';
+import { ModalBody } from './ModalBody';
+import { ModalFooter } from './ModalFooter';
+
+export { ModalType, type OnSubmit } from './types';
+
+interface WithSubComponents {
+  Header: typeof ModalHeader;
+  Body: typeof ModalBody;
+  Footer: typeof ModalFooter;
+}
+
+const Modal = MainComponent as typeof MainComponent & WithSubComponents;
+
+Modal.Header = ModalHeader;
+Modal.Body = ModalBody;
+Modal.Footer = ModalFooter;
+
+export { Modal };
diff --git a/app/react/components/modals/Modal/types.ts b/app/react/components/modals/Modal/types.ts
new file mode 100644
index 0000000..53a6bfa
--- /dev/null
+++ b/app/react/components/modals/Modal/types.ts
@@ -0,0 +1,6 @@
+export type OnSubmit<TResult> = (result?: TResult) => void;
+
+export enum ModalType {
+  Warn = 'warning',
+  Destructive = 'error',
+}
diff --git a/app/react/components/modals/SwitchPrompt.tsx b/app/react/components/modals/SwitchPrompt.tsx
new file mode 100644
index 0000000..c00523a
--- /dev/null
+++ b/app/react/components/modals/SwitchPrompt.tsx
@@ -0,0 +1,82 @@
+import { ReactNode, useState } from 'react';
+
+import { AutomationTestingProps } from '@/types';
+
+import { SwitchField } from '@@/form-components/SwitchField';
+
+import { ModalType, type ButtonOptions } from './types';
+import { openModal } from './open-modal';
+import { OnSubmit } from './Modal/types';
+import { Dialog } from './Dialog';
+import { buildCancelButton, buildConfirmButton } from './utils';
+
+function SwitchPrompt({
+  onSubmit,
+  title,
+  confirmButton = buildConfirmButton('OK'),
+  switchLabel,
+  modalType,
+  message,
+  defaultValue = false,
+  'data-cy': dataCy,
+}: {
+  onSubmit: OnSubmit<{ value: boolean }>;
+  title: string;
+  switchLabel: string;
+  confirmButton?: ButtonOptions<true>;
+  modalType?: ModalType;
+  message?: ReactNode;
+  defaultValue?: boolean;
+} & AutomationTestingProps) {
+  const [value, setValue] = useState(defaultValue);
+
+  return (
+    <Dialog
+      modalType={modalType}
+      title={title}
+      message={
+        <>
+          {message && <div className="mb-3">{message}</div>}
+          <SwitchField
+            name="value"
+            data-cy={dataCy}
+            label={switchLabel}
+            checked={value}
+            onChange={setValue}
+          />
+        </>
+      }
+      onSubmit={(confirm) => onSubmit(confirm ? { value } : undefined)}
+      buttons={[buildCancelButton(), confirmButton]}
+    />
+  );
+}
+
+export async function openSwitchPrompt(
+  title: string,
+  switchLabel: string,
+  {
+    confirmButton,
+    modalType,
+    message,
+    defaultValue,
+    'data-cy': dataCy,
+  }: {
+    confirmButton?: ButtonOptions<true>;
+    modalType?: ModalType;
+    message?: ReactNode;
+    defaultValue?: boolean;
+  } & AutomationTestingProps = {
+    'data-cy': 'switch-prompt',
+  }
+) {
+  return openModal(SwitchPrompt, {
+    confirmButton,
+    title,
+    switchLabel,
+    modalType,
+    message,
+    defaultValue,
+    'data-cy': dataCy,
+  });
+}
diff --git a/app/react/components/modals/confirm.ts b/app/react/components/modals/confirm.ts
new file mode 100644
index 0000000..13db333
--- /dev/null
+++ b/app/react/components/modals/confirm.ts
@@ -0,0 +1,94 @@
+import { ReactNode } from 'react';
+
+import { openDialog, DialogOptions } from './Dialog';
+import { OnSubmit, ModalType } from './Modal';
+import { ButtonOptions } from './types';
+import { buildCancelButton, buildConfirmButton } from './utils';
+
+export type ConfirmCallback = OnSubmit<boolean>;
+
+export interface ConfirmOptions extends Omit<
+  DialogOptions<boolean>,
+  'title' | 'buttons'
+> {
+  title: string;
+  confirmButton?: ButtonOptions<true>;
+  cancelButtonLabel?: string;
+}
+
+export async function openConfirm({
+  confirmButton = buildConfirmButton(),
+  cancelButtonLabel,
+  ...options
+}: ConfirmOptions) {
+  const result = await openDialog({
+    ...options,
+    buttons: [buildCancelButton(cancelButtonLabel), confirmButton],
+  });
+  return !!result;
+}
+
+export function confirm(options: ConfirmOptions) {
+  return openConfirm(options);
+}
+
+export function confirmDestructive(options: Omit<ConfirmOptions, 'modalType'>) {
+  return openConfirm({
+    ...options,
+    modalType: ModalType.Destructive,
+  });
+}
+
+export function confirmWebEditorDiscard() {
+  return openConfirm({
+    modalType: ModalType.Warn,
+    title: 'Are you sure?',
+    message:
+      'You currently have unsaved changes in the editor. Are you sure you want to leave?',
+    confirmButton: buildConfirmButton('Yes', 'danger'),
+  });
+}
+
+export function confirmGenericDiscard() {
+  return openConfirm({
+    modalType: ModalType.Warn,
+    title: 'Are you sure?',
+    message:
+      'You currently have unsaved changes. Are you sure you want to leave?',
+    confirmButton: buildConfirmButton('Yes', 'danger'),
+  });
+}
+
+export function confirmDelete(message: ReactNode) {
+  return confirmDestructive({
+    title: 'Are you sure?',
+    message,
+    confirmButton: buildConfirmButton('Remove', 'danger'),
+  });
+}
+
+export async function confirmUpdate(
+  message: string,
+  callback: ConfirmCallback
+) {
+  const result = await openConfirm({
+    title: 'Are you sure?',
+    modalType: ModalType.Warn,
+    message,
+    confirmButton: buildConfirmButton('Update'),
+  });
+
+  callback(result);
+
+  return result;
+}
+
+export function confirmChangePassword() {
+  return openConfirm({
+    modalType: ModalType.Warn,
+    title: 'Are you sure?',
+    message:
+      'You will be logged out after the password change. Do you want to change your password?',
+    confirmButton: buildConfirmButton('Change'),
+  });
+}
diff --git a/app/react/components/modals/index.ts b/app/react/components/modals/index.ts
new file mode 100644
index 0000000..244ce01
--- /dev/null
+++ b/app/react/components/modals/index.ts
@@ -0,0 +1,4 @@
+export { Modal } from './Modal';
+export { openModal } from './open-modal';
+export { ModalType } from './types';
+export { type OnSubmit } from './Modal/types';
diff --git a/app/react/components/modals/open-modal.tsx b/app/react/components/modals/open-modal.tsx
new file mode 100644
index 0000000..30a1dbf
--- /dev/null
+++ b/app/react/components/modals/open-modal.tsx
@@ -0,0 +1,31 @@
+import { ComponentType } from 'react';
+import { render, unmountComponentAtNode } from 'react-dom';
+
+import '@reach/dialog/styles.css';
+import { OnSubmit } from './Modal/types';
+
+let counter = 0;
+export async function openModal<TProps, TResult>(
+  Modal: ComponentType<
+    { onSubmit: OnSubmit<TResult> } & Omit<TProps, 'onSubmit'>
+  >,
+  props: TProps = {} as TProps
+) {
+  const modal = document.createElement('div');
+  counter += 1;
+  modal.id = `dialog-${counter}`;
+  document.body.appendChild(modal);
+
+  const result = await new Promise<TResult | undefined>((resolve) => {
+    render(
+      // eslint-disable-next-line react/jsx-props-no-spreading
+      <Modal {...props} onSubmit={(result) => resolve(result)} />,
+      modal
+    );
+  });
+
+  unmountComponentAtNode(modal);
+  document.body.removeChild(modal);
+
+  return result;
+}
diff --git a/app/react/components/modals/types.ts b/app/react/components/modals/types.ts
new file mode 100644
index 0000000..bdf3012
--- /dev/null
+++ b/app/react/components/modals/types.ts
@@ -0,0 +1,22 @@
+import { ComponentProps } from 'react';
+
+import { Button } from '@@/buttons';
+
+export interface ButtonOptions<TValue = undefined> {
+  label: string;
+  className?: string;
+  color?: ComponentProps<typeof Button>['color'];
+  value?: TValue;
+  timeout?: number;
+  dataCy: string;
+}
+
+export interface ButtonsOptions<T> {
+  confirm: ButtonOptions<T>;
+  cancel?: ButtonOptions<T>;
+}
+
+export enum ModalType {
+  Warn = 'warning',
+  Destructive = 'error',
+}
diff --git a/app/react/components/modals/utils.ts b/app/react/components/modals/utils.ts
new file mode 100644
index 0000000..00ac3b6
--- /dev/null
+++ b/app/react/components/modals/utils.ts
@@ -0,0 +1,26 @@
+import { ComponentProps } from 'react';
+
+import { Button } from '@@/buttons';
+
+import { ButtonOptions } from './types';
+
+export function buildConfirmButton(
+  label = 'Confirm',
+  color: ComponentProps<typeof Button>['color'] = 'primary',
+  timeout = 0,
+  dataCy = 'modal-confirm-button'
+): ButtonOptions<true> {
+  return { label, color, value: true, timeout, dataCy };
+}
+
+export function buildCancelButton(
+  label = 'Cancel',
+  dataCy = 'modal-cancel-button'
+): ButtonOptions<false> {
+  return {
+    label,
+    color: 'default',
+    value: false,
+    dataCy,
+  };
+}
diff --git a/app/react/components/primitives/Card.stories.tsx b/app/react/components/primitives/Card.stories.tsx
new file mode 100644
index 0000000..8708b87
--- /dev/null
+++ b/app/react/components/primitives/Card.stories.tsx
@@ -0,0 +1,93 @@
+import type { Meta, StoryObj } from '@storybook/react-webpack5';
+import { GitBranch } from 'lucide-react';
+
+import { Card } from './Card';
+
+const meta = {
+  title: 'Design System/Primitives/Card',
+  component: Card.Container,
+} as Meta<typeof Card.Container>;
+
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    children: <Card.Body>A basic card with body padding.</Card.Body>,
+  },
+};
+
+export const WithShadow: Story = {
+  args: {
+    shadow: true,
+    children: (
+      <Card.Body>Card with a drop shadow to create visual elevation.</Card.Body>
+    ),
+  },
+};
+
+export const FilledVariant: Story = {
+  args: {
+    variant: 'filled',
+    children: (
+      <Card.Body>
+        Filled card using the gray background variant for nested or secondary
+        content areas.
+      </Card.Body>
+    ),
+  },
+};
+
+export const WithHeader: Story = {
+  render: (args) => (
+    <Card.Container {...args}>
+      <Card.Header title="Container registries" />
+      <Card.Body>
+        Manage connected registries and configure pull-through caching.
+      </Card.Body>
+    </Card.Container>
+  ),
+};
+
+export const WithHeaderAndSubtitle: Story = {
+  render: (args) => (
+    <Card.Container {...args}>
+      <Card.Header
+        title="Container registries"
+        subtitle="2 registries connected"
+      />
+      <Card.Body>
+        Manage connected registries and configure pull-through caching.
+      </Card.Body>
+    </Card.Container>
+  ),
+};
+
+export const WithHeaderIconAndActions: Story = {
+  render: (args) => (
+    <Card.Container {...args}>
+      <Card.Header
+        title="Git repositories"
+        subtitle="3 repositories linked"
+        actions={<button type="button">Add repository</button>}
+        icon={GitBranch}
+      />
+      <Card.Body>
+        Connect and manage Git repositories for GitOps deployments.
+      </Card.Body>
+    </Card.Container>
+  ),
+};
+
+export const WithLongText: Story = {
+  args: {
+    className: 'max-w-xs',
+    children: (
+      <Card.Body>
+        This card contains a very long piece of text to verify the component
+        handles overflow gracefully. The container should clip or wrap content
+        without breaking the surrounding layout.
+      </Card.Body>
+    ),
+  },
+};
diff --git a/app/react/components/primitives/Card.tsx b/app/react/components/primitives/Card.tsx
new file mode 100644
index 0000000..11a216b
--- /dev/null
+++ b/app/react/components/primitives/Card.tsx
@@ -0,0 +1,129 @@
+import clsx from 'clsx';
+import { cva, type VariantProps } from 'class-variance-authority';
+import { ComponentType, PropsWithChildren, ReactNode } from 'react';
+
+import { Icon } from '@@/Icon';
+
+const cardContainer = cva(
+  [
+    'overflow-hidden border border-solid border-gray-5',
+    'th-highcontrast:border-white',
+    'th-dark:border-legacy-grey-3',
+  ],
+  {
+    variants: {
+      variant: {
+        default: [
+          'rounded-xl bg-white',
+          'th-highcontrast:bg-black',
+          'th-dark:bg-gray-iron-11',
+        ],
+        filled: [
+          'rounded-lg bg-gray-neutral-3',
+          'th-highcontrast:bg-gray-warm-10',
+          'th-dark:bg-gray-iron-10',
+        ],
+      },
+      shadow: {
+        true: 'shadow-md',
+      },
+    },
+    defaultVariants: {
+      variant: 'default',
+    },
+  }
+);
+
+export type CardVariant = NonNullable<
+  VariantProps<typeof cardContainer>['variant']
+>;
+
+/**
+ * Low-level card surface. Compose with `Card.Header` for a titled section and `Card.Body` for
+ * padded content. Use `variant="filled"` for a gray background.
+ * Reach for `Widget` when you need a full dashboard panel with toolbar.
+ *
+ * @example
+ * <Card.Container>
+ *   <Card.Header title="Container registries" subtitle="2 connected" />
+ *   <Card.Body>Manage pull-through caching and credentials.</Card.Body>
+ * </Card.Container>
+ */
+export const Card = {
+  Container: CardContainer,
+  Header: CardHeader,
+  Body: CardBody,
+};
+
+interface CardContainerProps extends VariantProps<typeof cardContainer> {
+  className?: string;
+  'aria-label'?: string;
+}
+
+function CardContainer({
+  className,
+  children,
+  shadow,
+  variant,
+  'aria-label': ariaLabel,
+}: PropsWithChildren<CardContainerProps>) {
+  return (
+    <section
+      aria-label={ariaLabel}
+      className={cardContainer({ variant, shadow, className })}
+    >
+      {children}
+    </section>
+  );
+}
+
+interface CardBodyProps {
+  className?: string;
+}
+
+function CardBody({ className, children }: PropsWithChildren<CardBodyProps>) {
+  return <div className={clsx('p-5', className)}>{children}</div>;
+}
+
+interface CardHeaderProps {
+  title: ReactNode;
+  subtitle?: ReactNode;
+  icon?: ComponentType<unknown>;
+  actions?: ReactNode;
+}
+
+function CardHeader({ title, subtitle, icon, actions }: CardHeaderProps) {
+  return (
+    <div
+      className={clsx(
+        'min-h-14 flex items-center justify-between gap-4 px-4 py-3.5',
+        'border-0 border-b border-solid border-gray-5 bg-gray-iron-2',
+        'th-dark:border-legacy-grey-3 th-dark:bg-gray-iron-10',
+        'th-highcontrast:border-white th-highcontrast:bg-gray-warm-10'
+      )}
+    >
+      <div className="flex flex-col gap-1">
+        <div className="min-h-5 flex items-center gap-2">
+          {icon && (
+            <Icon
+              icon={icon}
+              size="md"
+              className="shrink-0 opacity-70 th-highcontrast:text-white th-dark:text-gray-3"
+            />
+          )}
+          <span className="text-sm font-extrabold leading-tight tracking-wide text-gray-9 th-highcontrast:text-white th-dark:text-gray-4">
+            {title}
+          </span>
+        </div>
+        {subtitle && (
+          <span className="text-xs leading-tight text-[var(--text-muted-color)]">
+            {subtitle}
+          </span>
+        )}
+      </div>
+      {actions && (
+        <div className="flex shrink-0 items-center gap-2">{actions}</div>
+      )}
+    </div>
+  );
+}
diff --git a/app/react/components/primitives/Primitives.stories.tsx b/app/react/components/primitives/Primitives.stories.tsx
new file mode 100644
index 0000000..79dde1d
--- /dev/null
+++ b/app/react/components/primitives/Primitives.stories.tsx
@@ -0,0 +1,252 @@
+import { Meta, StoryFn } from '@storybook/react-webpack5';
+import { Check, Edit2, Layers, RefreshCw, Trash2, Users } from 'lucide-react';
+import { ReactNode } from 'react';
+
+import { Badge } from '@@/Badge';
+import { Button } from '@@/buttons/Button';
+
+import { Card } from './Card';
+import { StatusDot } from './StatusDot';
+
+export default {
+  title: 'Design System/Primitives/Overview',
+  parameters: { msw: { handlers: [] } },
+} as Meta;
+
+function Section({ title, children }: { title: string; children: ReactNode }) {
+  return (
+    <div className="mb-8">
+      <p className="mb-2 text-xs font-semibold uppercase tracking-wider text-gray-6">
+        {title}
+      </p>
+      <hr className="mb-4 border-gray-5" />
+      {children}
+    </div>
+  );
+}
+
+function Row({ label, children }: { label: string; children: ReactNode }) {
+  return (
+    <div className="mb-4 flex items-center gap-8">
+      <span className="w-32 shrink-0 text-sm text-gray-6">{label}</span>
+      <div className="flex flex-wrap items-center gap-3">{children}</div>
+    </div>
+  );
+}
+
+function Labeled({ label, children }: { label: string; children: ReactNode }) {
+  return (
+    <span className="inline-flex items-center gap-1.5">
+      {children}
+      <span className="text-sm text-gray-6">{label}</span>
+    </span>
+  );
+}
+
+export const Overview: StoryFn = () => {
+  return (
+    <>
+      <Section title="StatusDot">
+        <Row label="Tones">
+          <Labeled label="success">
+            <StatusDot color="success" />
+          </Labeled>
+          <Labeled label="warning">
+            <StatusDot color="warn" />
+          </Labeled>
+          <Labeled label="danger">
+            <StatusDot color="danger" />
+          </Labeled>
+          <Labeled label="neutral">
+            <StatusDot color="muted" />
+          </Labeled>
+          <Labeled label="accent">
+            <StatusDot color="info" />
+          </Labeled>
+        </Row>
+        <Row label="Sizes">
+          <Labeled label="xs">
+            <StatusDot color="success" size="xs" />
+          </Labeled>
+          <Labeled label="sm">
+            <StatusDot color="success" size="sm" />
+          </Labeled>
+          <Labeled label="md">
+            <StatusDot color="success" size="md" />
+          </Labeled>
+        </Row>
+        <Row label="Pulse">
+          <Labeled label="warning + pulse">
+            <StatusDot color="warn" pulse />
+          </Labeled>
+          <Labeled label="accent + pulse">
+            <StatusDot color="info" pulse />
+          </Labeled>
+        </Row>
+      </Section>
+
+      <Section title="Badge">
+        <Row label="Tones (pill)">
+          <Badge type="muted">neutral</Badge>
+          <Badge type="success">success</Badge>
+          <Badge type="danger">danger</Badge>
+          <Badge type="warn">warning</Badge>
+          <Badge type="info">info</Badge>
+          <Badge type="successSecondary">successSecondary</Badge>
+          <Badge type="dangerSecondary">dangerSecondary</Badge>
+          <Badge type="warnSecondary">warnSecondary</Badge>
+          <Badge type="infoSecondary">infoSecondary</Badge>
+        </Row>
+        <Row label="Tones (rect)">
+          <Badge type="muted" shape="rect">
+            neutral
+          </Badge>
+          <Badge type="success" shape="rect">
+            success
+          </Badge>
+          <Badge type="danger" shape="rect">
+            danger
+          </Badge>
+          <Badge type="warn" shape="rect">
+            warning
+          </Badge>
+          <Badge type="info" shape="rect">
+            info
+          </Badge>
+          <Badge type="successSecondary" shape="rect">
+            successSecondary
+          </Badge>
+          <Badge type="dangerSecondary" shape="rect">
+            dangerSecondary
+          </Badge>
+          <Badge type="warnSecondary" shape="rect">
+            warnSecondary
+          </Badge>
+          <Badge type="infoSecondary" shape="rect">
+            infoSecondary
+          </Badge>
+        </Row>
+        <Row label="Sizes">
+          <Badge type="info" size="sm">
+            sm
+          </Badge>
+          <Badge type="info" size="md">
+            md
+          </Badge>
+        </Row>
+        <Row label="With StatusDot">
+          <Badge type="success">
+            <StatusDot color="success" size="xs" className="mr-1" />
+            Running
+          </Badge>
+          <Badge type="warn">
+            <StatusDot color="warn" size="xs" className="mr-1" />
+            Starting
+          </Badge>
+          <Badge type="danger">
+            <StatusDot color="danger" size="xs" className="mr-1" />
+            Error
+          </Badge>
+        </Row>
+      </Section>
+
+      <Section title="Button">
+        <Row label="Variants">
+          <Button color="primary" data-cy="btn">
+            Primary
+          </Button>
+          <Button color="secondary" data-cy="btn">
+            Secondary
+          </Button>
+          <Button color="light" data-cy="btn">
+            Ghost
+          </Button>
+          <Button color="danger" data-cy="btn">
+            Danger
+          </Button>
+        </Row>
+        <Row label="With icon">
+          <Button color="primary" icon={Check} data-cy="btn">
+            Save
+          </Button>
+          <Button color="secondary" icon={Edit2} data-cy="btn">
+            Edit
+          </Button>
+          <Button color="light" icon={RefreshCw} data-cy="btn">
+            Restart
+          </Button>
+          <Button color="danger" icon={Trash2} data-cy="btn">
+            Delete
+          </Button>
+        </Row>
+        <Row label="Icon only">
+          <Button color="secondary" icon={Edit2} data-cy="btn" />
+          <Button color="light" icon={RefreshCw} data-cy="btn" />
+        </Row>
+        <Row label="Sizes">
+          <Button color="secondary" size="small" data-cy="btn">
+            Small
+          </Button>
+          <Button color="secondary" size="medium" data-cy="btn">
+            Medium
+          </Button>
+        </Row>
+        <Row label="Disabled">
+          <Button color="primary" disabled data-cy="btn">
+            Primary
+          </Button>
+          <Button color="secondary" disabled data-cy="btn">
+            Secondary
+          </Button>
+        </Row>
+      </Section>
+
+      <Section title="Card + CardHeader">
+        <Row label="With icon, subtitle, actions">
+          <div className="w-[600px]">
+            <Card.Container>
+              <Card.Header
+                title="Access Rules"
+                subtitle="All users and teams with access to this resource"
+                icon={Users}
+                actions={
+                  <Button color="secondary" icon={Edit2} data-cy="btn">
+                    Edit
+                  </Button>
+                }
+              />
+              <p className="p-5 text-sm text-gray-6">
+                Card body content goes here.
+              </p>
+            </Card.Container>
+          </div>
+        </Row>
+        <Row label="With shadow">
+          <div className="w-[600px]">
+            <Card.Container shadow>
+              <Card.Header
+                title="Services"
+                subtitle="Search and manage stack services"
+                icon={Layers}
+              />
+              <p className="p-5 text-sm text-gray-6">
+                Card with drop shadow (list style).
+              </p>
+            </Card.Container>
+          </div>
+        </Row>
+        <Row label="Title only">
+          <div className="w-[500px]">
+            <Card.Container>
+              <Card.Header
+                title="Connection Settings"
+                subtitle="Define how this endpoint is reached"
+              />
+              <p className="p-5 text-sm text-gray-6">No icon, no actions.</p>
+            </Card.Container>
+          </div>
+        </Row>
+      </Section>
+    </>
+  );
+};
diff --git a/app/react/components/primitives/StatusDot.stories.tsx b/app/react/components/primitives/StatusDot.stories.tsx
new file mode 100644
index 0000000..9248bc0
--- /dev/null
+++ b/app/react/components/primitives/StatusDot.stories.tsx
@@ -0,0 +1,42 @@
+import { Meta, StoryFn } from '@storybook/react-webpack5';
+
+import { StatusDot } from './StatusDot';
+import type { StatusDotColor, StatusDotSize } from './StatusDot';
+
+export default {
+  component: StatusDot,
+  title: 'Design System/Primitives/StatusDot',
+} as Meta;
+
+const colors: StatusDotColor[] = ['success', 'warn', 'danger', 'muted', 'info'];
+const sizes: StatusDotSize[] = ['xs', 'sm', 'md'];
+
+export const AllColors: StoryFn = () => (
+  <div className="flex items-center gap-3">
+    {colors.map((color) => (
+      <div key={color} className="flex flex-col items-center gap-1">
+        <StatusDot color={color} />
+        <span className="text-xs">{color}</span>
+      </div>
+    ))}
+  </div>
+);
+
+export const AllSizes: StoryFn = () => (
+  <div className="flex items-center gap-3">
+    {sizes.map((size) => (
+      <div key={size} className="flex flex-col items-center gap-1">
+        <StatusDot color="success" size={size} />
+        <span className="text-xs">{size}</span>
+      </div>
+    ))}
+  </div>
+);
+
+export const Pulse: StoryFn = () => (
+  <div className="flex items-center gap-3">
+    {colors.map((color) => (
+      <StatusDot key={color} color={color} pulse />
+    ))}
+  </div>
+);
diff --git a/app/react/components/primitives/StatusDot.tsx b/app/react/components/primitives/StatusDot.tsx
new file mode 100644
index 0000000..e4e66b3
--- /dev/null
+++ b/app/react/components/primitives/StatusDot.tsx
@@ -0,0 +1,49 @@
+import { cva, type VariantProps } from 'class-variance-authority';
+
+const statusDot = cva(
+  [
+    'inline-block shrink-0 rounded-full',
+    'shadow-[0_0_8px_var(--tw-shadow-color)]',
+  ],
+  {
+    variants: {
+      color: {
+        success: 'bg-success-7 shadow-success-7/40',
+        warn: 'bg-warning-7 shadow-warning-7/40',
+        danger: 'bg-error-7 shadow-error-7/40',
+        muted: 'bg-gray-5 th-dark:bg-gray-7',
+        info: 'bg-blue-7 shadow-blue-7/40',
+      },
+      size: {
+        xs: 'h-1.5 w-1.5',
+        sm: 'h-2 w-2',
+        md: 'h-2.5 w-2.5',
+      },
+      pulse: {
+        true: 'animate-pulse',
+      },
+    },
+    defaultVariants: {
+      color: 'muted',
+      size: 'md',
+    },
+  }
+);
+
+export type StatusDotColor = NonNullable<
+  VariantProps<typeof statusDot>['color']
+>;
+export type StatusDotSize = NonNullable<VariantProps<typeof statusDot>['size']>;
+
+interface Props extends VariantProps<typeof statusDot> {
+  className?: string;
+}
+
+export function StatusDot({ color, size, pulse, className }: Props) {
+  return (
+    <span
+      aria-hidden="true"
+      className={statusDot({ color, size, pulse, className })}
+    />
+  );
+}
diff --git a/app/react/components/primitives/Tabs/Tabs.stories.tsx b/app/react/components/primitives/Tabs/Tabs.stories.tsx
new file mode 100644
index 0000000..9472680
--- /dev/null
+++ b/app/react/components/primitives/Tabs/Tabs.stories.tsx
@@ -0,0 +1,61 @@
+import type { Meta, StoryObj } from '@storybook/react-webpack5';
+import { userEvent, within, expect } from 'storybook/test';
+import { useState } from 'react';
+
+import { Tabs } from './Tabs';
+import { TabSize, TabVariant } from './TabsItem';
+
+const labels = ['Services', 'Compose', 'Automation', 'Disabled'] as const;
+
+function Example({ size, variant }: { variant: TabVariant; size: TabSize }) {
+  const [active, setActive] = useState('Services');
+  return (
+    <Tabs.Container variant={variant} size={size}>
+      {labels.map((label, i) => (
+        <Tabs.Item
+          key={label}
+          isActive={active === label}
+          disabled={i === labels.length - 1}
+          aria-current={active === label ? 'page' : undefined}
+          onClick={() => setActive(label)}
+        >
+          {label}
+        </Tabs.Item>
+      ))}
+    </Tabs.Container>
+  );
+}
+
+const meta = {
+  title: 'Design System/Primitives/Tabs',
+  component: Example,
+  parameters: { layout: 'padded' },
+  args: {
+    variant: 'contained',
+    size: 'md',
+  },
+} as Meta<typeof Example>;
+
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  play: async ({ canvasElement }) => {
+    const canvas = within(canvasElement);
+    const composeTab = canvas.getByRole('button', { name: 'Compose' });
+    await userEvent.click(composeTab);
+    expect(composeTab).toHaveAttribute('aria-current', 'page');
+  },
+};
+
+export const Small: Story = {
+  args: { size: 'sm' },
+};
+
+export const Pill: Story = {
+  args: { variant: 'pill' },
+};
+
+export const PillSmall: Story = {
+  args: { variant: 'pill', size: 'sm' },
+};
diff --git a/app/react/components/primitives/Tabs/Tabs.ts b/app/react/components/primitives/Tabs/Tabs.ts
new file mode 100644
index 0000000..a817f7e
--- /dev/null
+++ b/app/react/components/primitives/Tabs/Tabs.ts
@@ -0,0 +1,18 @@
+import { TabsContainer } from './TabsContainer';
+import { TabItem } from './TabsItem';
+
+/**
+ * Low-level tab group. Compose with `Tabs.Container` for the tab bar and `Tabs.Item` for each
+ * tab button. Use `variant="pill"` for a floating pill style or `"contained"` (default) for a
+ * segmented control look. Context from `TabsContainer` auto-applies variant and size to items.
+ *
+ * @example
+ * <Tabs.Container variant="contained" aria-label="View mode">
+ *   <Tabs.Item isActive={view === 'list'} onClick={() => setView('list')}>List</Tabs.Item>
+ *   <Tabs.Item isActive={view === 'grid'} onClick={() => setView('grid')}>Grid</Tabs.Item>
+ * </Tabs.Container>
+ */
+export const Tabs = {
+  Container: TabsContainer,
+  Item: TabItem,
+};
diff --git a/app/react/components/primitives/Tabs/TabsContainer.tsx b/app/react/components/primitives/Tabs/TabsContainer.tsx
new file mode 100644
index 0000000..eb3a36c
--- /dev/null
+++ b/app/react/components/primitives/Tabs/TabsContainer.tsx
@@ -0,0 +1,84 @@
+import { cva, type VariantProps } from 'class-variance-authority';
+import { ElementType, ReactNode } from 'react';
+
+import { TabContext, TabVariant, TabSize } from './TabsItem';
+
+const tabsContainerOuter = cva('', {
+  variants: {
+    variant: {
+      pill: 'flex flex-wrap gap-2.5',
+      contained: [
+        'inline-flex overflow-hidden',
+        'border border-solid border-[var(--border-widget)] bg-[var(--bg-widget-color)]',
+      ],
+    },
+    size: {
+      md: '',
+      sm: '',
+    },
+  },
+  compoundVariants: [
+    { variant: 'contained', size: 'md', className: 'rounded-xl' },
+    { variant: 'contained', size: 'sm', className: 'rounded-md' },
+  ],
+  defaultVariants: {
+    variant: 'contained',
+    size: 'md',
+  },
+});
+
+const tabsContainerInner = cva('flex items-center overflow-x-auto', {
+  variants: {
+    size: {
+      md: 'gap-1 p-1',
+      sm: 'gap-0.5 p-0.5',
+    },
+  },
+  defaultVariants: { size: 'md' },
+});
+
+interface Props extends VariantProps<typeof tabsContainerOuter> {
+  as?: ElementType;
+  children?: ReactNode;
+  className?: string;
+  'aria-label'?: string;
+}
+
+export function TabsContainer({
+  as: Component = 'div',
+  className,
+  children,
+  variant = 'contained',
+  size = 'md',
+  'aria-label': ariaLabel,
+}: Props) {
+  const ctx: { variant: TabVariant; size: TabSize } = {
+    variant: variant ?? 'contained',
+    size: size ?? 'md',
+  };
+
+  if (variant === 'pill') {
+    return (
+      <TabContext.Provider value={ctx}>
+        <Component
+          className={tabsContainerOuter({ variant, size, className })}
+          aria-label={ariaLabel}
+        >
+          {children}
+        </Component>
+      </TabContext.Provider>
+    );
+  }
+
+  return (
+    <TabContext.Provider value={ctx}>
+      <Component
+        className={tabsContainerOuter({ variant, size, className })}
+        aria-label={ariaLabel}
+      >
+        {/* inner div so the overflow-x-auto scrollbar doesn't overlap the rounded corners */}
+        <div className={tabsContainerInner({ size })}>{children}</div>
+      </Component>
+    </TabContext.Provider>
+  );
+}
diff --git a/app/react/components/primitives/Tabs/TabsItem.tsx b/app/react/components/primitives/Tabs/TabsItem.tsx
new file mode 100644
index 0000000..3917c86
--- /dev/null
+++ b/app/react/components/primitives/Tabs/TabsItem.tsx
@@ -0,0 +1,137 @@
+import { Slot } from '@radix-ui/react-slot';
+import { cva, type VariantProps } from 'class-variance-authority';
+import {
+  AriaAttributes,
+  createContext,
+  PropsWithChildren,
+  useContext,
+} from 'react';
+
+const tabItem = cva(
+  'inline-flex cursor-pointer select-none items-center gap-2 whitespace-nowrap no-underline hover:no-underline focus:no-underline transition-colors duration-150',
+  {
+    variants: {
+      variant: {
+        pill: 'rounded-full border border-solid',
+        contained: 'rounded-lg border-0',
+      },
+      size: {
+        md: '',
+        sm: '',
+      },
+      isActive: {
+        true: '',
+        false: '',
+      },
+      disabled: {
+        true: 'cursor-default opacity-50',
+        false: '',
+      },
+    },
+    compoundVariants: [
+      { variant: 'pill', size: 'md', className: 'px-2.5 py-2 text-xs' },
+      { variant: 'pill', size: 'sm', className: 'px-2 py-1.5 text-[11px]' },
+      { variant: 'contained', size: 'md', className: 'px-4 py-2 text-sm' },
+      { variant: 'contained', size: 'sm', className: 'px-3 py-1.5 text-xs' },
+      {
+        variant: 'pill',
+        isActive: false,
+        disabled: false,
+        className: [
+          'border-gray-5 bg-gray-neutral-3 text-gray-6',
+          'th-dark:border-legacy-grey-3 th-dark:bg-gray-iron-11 th-dark:text-gray-5',
+          'th-highcontrast:border-white th-highcontrast:bg-black th-highcontrast:text-gray-3',
+          'hover:border-gray-6 hover:bg-gray-2 hover:text-gray-9',
+          'th-dark:hover:bg-gray-iron-10 th-dark:hover:text-white',
+        ],
+      },
+      {
+        variant: 'pill',
+        isActive: true,
+        className: [
+          'border-blue-5 bg-blue-1 text-blue-7',
+          'th-dark:border-blue-7 th-dark:bg-blue-11 th-dark:text-blue-4',
+          'th-highcontrast:border-blue-5 th-highcontrast:bg-blue-11 th-highcontrast:text-blue-4',
+        ],
+      },
+      {
+        variant: 'contained',
+        isActive: false,
+        disabled: false,
+        className: [
+          'bg-transparent text-gray-7 th-highcontrast:text-white th-dark:text-gray-6',
+          'hover:bg-graphite-50 hover:text-graphite-900',
+          'th-dark:hover:bg-graphite-600 th-dark:hover:text-gray-4',
+          'th-highcontrast:hover:bg-white th-highcontrast:hover:text-black',
+        ],
+      },
+      {
+        variant: 'contained',
+        isActive: true,
+        className: [
+          'bg-graphite-50 text-graphite-900 hover:text-inherit focus:text-inherit',
+          'th-dark:bg-graphite-600 th-dark:text-white th-dark:hover:text-inherit th-dark:focus:text-inherit',
+          'th-highcontrast:bg-white th-highcontrast:text-black th-highcontrast:hover:text-black th-highcontrast:focus:text-black',
+        ],
+      },
+    ],
+    defaultVariants: {
+      variant: 'pill',
+      size: 'md',
+      isActive: false,
+      disabled: false,
+    },
+  }
+);
+
+export type TabVariant = NonNullable<VariantProps<typeof tabItem>['variant']>;
+export type TabSize = NonNullable<VariantProps<typeof tabItem>['size']>;
+
+interface TabContextValue {
+  variant: TabVariant;
+  size: TabSize;
+}
+
+export const TabContext = createContext<TabContextValue>({
+  variant: 'pill',
+  size: 'md',
+});
+
+interface Props extends AriaAttributes, VariantProps<typeof tabItem> {
+  asChild?: boolean;
+  className?: string;
+  onClick?(): void;
+}
+
+export function TabItem({
+  asChild = false,
+  variant: variantProp,
+  isActive,
+  disabled,
+  size: sizeProp,
+  className,
+  children,
+  onClick,
+  ...ariaProps
+}: PropsWithChildren<Props>) {
+  const ctx = useContext(TabContext);
+  const variant = variantProp ?? ctx.variant;
+  const size = sizeProp ?? ctx.size;
+
+  const Component = asChild ? Slot : 'button';
+
+  return (
+    <Component
+      className={tabItem({ variant, size, isActive, disabled, className })}
+      type={asChild ? undefined : 'button'}
+      disabled={disabled || undefined}
+      aria-disabled={disabled || undefined}
+      tabIndex={disabled ? -1 : undefined}
+      onClick={disabled ? undefined : onClick}
+      // eslint-disable-next-line react/jsx-props-no-spreading
+      {...ariaProps}
+    >
+      {children}
+    </Component>
+  );
+}
diff --git a/app/react/components/ui-router.test.tsx b/app/react/components/ui-router.test.tsx
new file mode 100644
index 0000000..78e9cc3
--- /dev/null
+++ b/app/react/components/ui-router.test.tsx
@@ -0,0 +1,39 @@
+import { UISref, UIView } from '@uirouter/react';
+import { render, screen } from '@testing-library/react';
+
+import { withTestRouter } from '@/react/test-utils/withRouter';
+
+function RelativePathLink() {
+  return (
+    <UISref to=".custom">
+      <span>Link</span>
+    </UISref>
+  );
+}
+
+test.todo('should render a link with relative path', () => {
+  const WrappedComponent = withTestRouter(RelativePathLink, {
+    stateConfig: [
+      {
+        name: 'parent',
+        url: '/',
+
+        component: () => (
+          <>
+            <div>parent</div>
+            <UIView />
+          </>
+        ),
+      },
+      {
+        name: 'parent.custom',
+        url: 'custom',
+      },
+    ],
+    route: 'parent',
+  });
+
+  render(<WrappedComponent />);
+
+  expect(screen.getByText('Link')).toBeInTheDocument();
+});
diff --git a/app/react/constants.ts b/app/react/constants.ts
new file mode 100644
index 0000000..0cccd0c
--- /dev/null
+++ b/app/react/constants.ts
@@ -0,0 +1,16 @@
+export const STACK_NAME_VALIDATION_REGEX = '^[-_a-z0-9]+$';
+
+export const BROWSER_OS_PLATFORM = getOs();
+
+function getOs() {
+  const { userAgent } = navigator;
+
+  if (userAgent.includes('Windows')) {
+    return 'win';
+  }
+
+  return userAgent.includes('Mac') ? 'mac' : 'lin';
+}
+
+export const COMPOSE_STACK_NAME_LABEL = 'com.docker.compose.project';
+export const SWARM_STACK_NAME_LABEL = 'com.docker.stack.namespace';
diff --git a/app/react/docker/DashboardView/ClusterAgentInfo.tsx b/app/react/docker/DashboardView/ClusterAgentInfo.tsx
new file mode 100644
index 0000000..5d64725
--- /dev/null
+++ b/app/react/docker/DashboardView/ClusterAgentInfo.tsx
@@ -0,0 +1,37 @@
+import { GaugeIcon } from 'lucide-react';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+
+import { Widget } from '@@/Widget';
+import { DetailsTable } from '@@/DetailsTable';
+
+import { useAgentNodes } from '../agent/queries/useAgentNodes';
+import { useApiVersion } from '../agent/queries/useApiVersion';
+
+import { ClusterVisualizerLink } from './ClusterVisualizerLink';
+
+export function ClusterAgentInfo() {
+  const environmentId = useEnvironmentId();
+
+  const apiVersionQuery = useApiVersion(environmentId);
+
+  const nodesCountQuery = useAgentNodes(environmentId, apiVersionQuery.data!, {
+    select: (data) => data.length,
+    enabled: apiVersionQuery.data !== undefined,
+  });
+
+  return (
+    <Widget>
+      <Widget.Title icon={GaugeIcon} title="Cluster information" />
+      <Widget.Body className="!px-5 !py-0">
+        <DetailsTable dataCy="cluster-agent-info">
+          <DetailsTable.Row label="Nodes in the cluster">
+            {nodesCountQuery.data}
+          </DetailsTable.Row>
+
+          <ClusterVisualizerLink />
+        </DetailsTable>
+      </Widget.Body>
+    </Widget>
+  );
+}
diff --git a/app/react/docker/DashboardView/ClusterVisualizerLink.tsx b/app/react/docker/DashboardView/ClusterVisualizerLink.tsx
new file mode 100644
index 0000000..219e774
--- /dev/null
+++ b/app/react/docker/DashboardView/ClusterVisualizerLink.tsx
@@ -0,0 +1,24 @@
+import { TrelloIcon } from 'lucide-react';
+
+import { Link } from '@@/Link';
+import { Button } from '@@/buttons';
+
+export function ClusterVisualizerLink() {
+  return (
+    <tr>
+      <td colSpan={2}>
+        <Button
+          as={Link}
+          color="link"
+          icon={TrelloIcon}
+          props={{
+            to: 'docker.swarm.visualizer',
+          }}
+          data-cy="cluster-visualizer"
+        >
+          Go to cluster visualizer
+        </Button>
+      </td>
+    </tr>
+  );
+}
diff --git a/app/react/docker/DashboardView/ContainerStatus.tsx b/app/react/docker/DashboardView/ContainerStatus.tsx
new file mode 100644
index 0000000..2c22bd1
--- /dev/null
+++ b/app/react/docker/DashboardView/ContainerStatus.tsx
@@ -0,0 +1,39 @@
+import { Heart, Power } from 'lucide-react';
+
+import { Icon } from '@/react/components/Icon';
+
+interface Props {
+  stats: {
+    running: number;
+    stopped: number;
+    healthy: number;
+    unhealthy: number;
+  };
+}
+
+export function ContainerStatus({ stats }: Props) {
+  return (
+    <div className="pull-right">
+      <div>
+        <div className="vertical-center space-right pr-5">
+          <Icon icon={Power} mode="success" size="sm" />
+          {stats.running} running
+        </div>
+        <div className="vertical-center space-right">
+          <Icon icon={Power} mode="danger" size="sm" />
+          {stats.stopped} stopped
+        </div>
+      </div>
+      <div>
+        <div className="vertical-center space-right pr-5">
+          <Icon icon={Heart} mode="success" size="sm" />
+          {stats.healthy} healthy
+        </div>
+        <div className="vertical-center space-right">
+          <Icon icon={Heart} mode="danger" size="sm" />
+          {stats.unhealthy} unhealthy
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/docker/DashboardView/DashboardView.tsx b/app/react/docker/DashboardView/DashboardView.tsx
new file mode 100644
index 0000000..e8afb0d
--- /dev/null
+++ b/app/react/docker/DashboardView/DashboardView.tsx
@@ -0,0 +1,143 @@
+import {
+  BoxIcon,
+  CpuIcon,
+  DatabaseIcon,
+  LayersIcon,
+  ListIcon,
+  NetworkIcon,
+  ShuffleIcon,
+} from 'lucide-react';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { isAgentEnvironment } from '@/react/portainer/environments/utils';
+import { useCurrentEnvironment } from '@/react/hooks/useCurrentEnvironment';
+import { useIsEnvironmentAdmin } from '@/react/hooks/useUser';
+
+import { PageHeader } from '@@/PageHeader';
+import { DashboardGrid } from '@@/DashboardItem/DashboardGrid';
+import { DashboardItem } from '@@/DashboardItem';
+
+import { useIsSwarm, useIsSwarmManager } from '../proxy/queries/useInfo';
+
+import { NonAgentSwarmInfo } from './NonAgentSwarmInfo';
+import { ClusterAgentInfo } from './ClusterAgentInfo';
+import { EnvironmentInfo } from './EnvironmentInfo';
+import { ContainerStatus } from './ContainerStatus';
+import { ImagesTotalSize } from './ImagesTotalSize';
+import { useDashboard } from './useDashboard';
+
+export function DashboardView() {
+  const envId = useEnvironmentId();
+  const envQuery = useCurrentEnvironment();
+  const isEnvAdminQuery = useIsEnvironmentAdmin();
+  const isSwarmManager = useIsSwarmManager(envId);
+  const isStandalone = useIsSwarm(envId);
+  const dashboardStatsQuery = useDashboard(envId);
+
+  if (!envQuery.data || !dashboardStatsQuery.data) {
+    return null;
+  }
+
+  const env = envQuery.data;
+  const isStacksVisible = shouldShowStacks();
+  const dashboardStats = dashboardStatsQuery.data;
+
+  return (
+    <>
+      <PageHeader title="Dashboard" breadcrumbs="Environment summary" reload />
+
+      <div className="mx-4 space-y-6">
+        <InfoPanels isAgent={isAgentEnvironment(env.Type)} />
+
+        <DashboardGrid>
+          {isStacksVisible && (
+            <DashboardItem
+              to="docker.stacks"
+              icon={LayersIcon}
+              type="Stack"
+              value={dashboardStats.stacks}
+              data-cy="stacks"
+            />
+          )}
+
+          {isSwarmManager && (
+            <DashboardItem
+              to="docker.services"
+              icon={ShuffleIcon}
+              type="Service"
+              value={dashboardStats.services}
+              data-cy="services"
+            />
+          )}
+
+          <DashboardItem
+            to="docker.containers"
+            icon={BoxIcon}
+            type="Container"
+            value={dashboardStats.containers.total}
+            data-cy="containers"
+          >
+            <ContainerStatus stats={dashboardStats.containers} />
+          </DashboardItem>
+
+          <DashboardItem
+            to="docker.images"
+            icon={ListIcon}
+            type="Image"
+            value={dashboardStats.images.total}
+            data-cy="images"
+          >
+            <ImagesTotalSize imagesTotalSize={dashboardStats.images.size} />
+          </DashboardItem>
+
+          <DashboardItem
+            to="docker.volumes"
+            icon={DatabaseIcon}
+            type="Volume"
+            value={dashboardStats.volumes}
+            data-cy="volumes"
+          />
+
+          <DashboardItem
+            to="docker.networks"
+            icon={NetworkIcon}
+            type="Network"
+            value={dashboardStats.networks}
+            data-cy="networks"
+          />
+
+          {env.EnableGPUManagement && isStandalone && (
+            <DashboardItem
+              icon={CpuIcon}
+              type="GPU"
+              value={env.Gpus?.length}
+              data-cy="gpus"
+            />
+          )}
+        </DashboardGrid>
+      </div>
+
+      <div className="pt-6" />
+    </>
+  );
+
+  function shouldShowStacks() {
+    return (
+      env.SecuritySettings.allowStackManagementForRegularUsers ||
+      isEnvAdminQuery.authorized
+    );
+  }
+}
+
+function InfoPanels({ isAgent }: { isAgent: boolean }) {
+  const envId = useEnvironmentId();
+  const isSwarm = useIsSwarm(envId);
+
+  return (
+    <>
+      {isSwarm && !isAgent && <NonAgentSwarmInfo />}
+      {isSwarm && isAgent && <ClusterAgentInfo />}
+      {(!isSwarm || !isAgent) && <EnvironmentInfo />}
+    </>
+  );
+}
diff --git a/app/react/docker/DashboardView/EnvironmentInfo.DockerInfo.tsx b/app/react/docker/DashboardView/EnvironmentInfo.DockerInfo.tsx
new file mode 100644
index 0000000..ffec3e2
--- /dev/null
+++ b/app/react/docker/DashboardView/EnvironmentInfo.DockerInfo.tsx
@@ -0,0 +1,41 @@
+import { ZapIcon } from 'lucide-react';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { getDockerEnvironmentType } from '@/react/portainer/environments/utils/getDockerEnvironmentType';
+import { useIsPodman } from '@/react/portainer/environments/queries/useIsPodman';
+
+import { Icon } from '@@/Icon';
+
+import { useInfo } from '../proxy/queries/useInfo';
+
+export function DockerInfo({ isAgent }: { isAgent: boolean }) {
+  const envId = useEnvironmentId();
+  const infoQuery = useInfo(envId);
+  const isPodman = useIsPodman(envId);
+
+  if (!infoQuery.data) {
+    return null;
+  }
+
+  const info = infoQuery.data;
+
+  const isSwarm = info.Swarm !== undefined && info.Swarm?.NodeID !== '';
+  const type = getDockerEnvironmentType(isSwarm, isPodman);
+
+  return (
+    <span className="small text-muted inline-flex gap-x-2">
+      <span>
+        {type} {info.ServerVersion}
+      </span>
+      {isAgent && (
+        <>
+          <span>-</span>
+          <span className="inline-flex items-center">
+            <Icon icon={ZapIcon} />
+            Agent
+          </span>
+        </>
+      )}
+    </span>
+  );
+}
diff --git a/app/react/docker/DashboardView/EnvironmentInfo.GpuInfo.tsx b/app/react/docker/DashboardView/EnvironmentInfo.GpuInfo.tsx
new file mode 100644
index 0000000..b902a96
--- /dev/null
+++ b/app/react/docker/DashboardView/EnvironmentInfo.GpuInfo.tsx
@@ -0,0 +1,61 @@
+import { DetailsTable } from '@@/DetailsTable';
+
+import { DockerSnapshot } from '../snapshots/types';
+
+export function GpuInfo({
+  gpus,
+  snapshot,
+}: {
+  gpus: Array<{ name: string }>;
+  snapshot?: DockerSnapshot;
+}) {
+  if (!snapshot) {
+    return null;
+  }
+
+  const gpuUseAll = snapshot.GpuUseAll;
+  const gpuUseList = snapshot.GpuUseList;
+  let gpuFreeStr;
+  if (gpuUseAll) {
+    gpuFreeStr = 'none';
+  } else {
+    gpuFreeStr = buildGpusStr(gpuUseList, gpus);
+  }
+
+  return (
+    <DetailsTable.Row label={gpus.length <= 1 ? 'GPU' : 'GPUs'}>
+      {gpuFreeStr}
+    </DetailsTable.Row>
+  );
+
+  function buildGpusStr(
+    gpuUseList: Array<string>,
+    gpus: Array<{ name: string }> = []
+  ) {
+    if (!gpus.length) {
+      return 'none';
+    }
+
+    const gpuUseSet = new Set(gpuUseList);
+    const gpusAvailable: Record<string, number> = {};
+    for (let i = 0; i < gpus.length; i++) {
+      if (!gpuUseSet.has(gpus[i].name)) {
+        if (gpusAvailable[gpus[i].name]) {
+          gpusAvailable[gpus[i].name] += 1;
+        } else {
+          gpusAvailable[gpus[i].name] = 1;
+        }
+      }
+    }
+
+    const gpusKeys = Object.keys(gpusAvailable);
+
+    if (!gpusKeys.length) {
+      return 'none';
+    }
+
+    return Object.keys(gpusAvailable)
+      .map((gpuAvailable) => `${gpusAvailable[gpuAvailable]} x ${gpuAvailable}`)
+      .join(' + ');
+  }
+}
diff --git a/app/react/docker/DashboardView/EnvironmentInfo.SnapshotStats.tsx b/app/react/docker/DashboardView/EnvironmentInfo.SnapshotStats.tsx
new file mode 100644
index 0000000..ce3098c
--- /dev/null
+++ b/app/react/docker/DashboardView/EnvironmentInfo.SnapshotStats.tsx
@@ -0,0 +1,30 @@
+import { CpuIcon } from 'lucide-react';
+
+import { humanize } from '@/portainer/filters/filters';
+import memoryIcon from '@/assets/ico/memory.svg?c';
+
+import { Icon } from '@@/Icon';
+
+import { DockerSnapshot } from '../snapshots/types';
+
+export function SnapshotStats({
+  snapshot,
+}: {
+  snapshot: DockerSnapshot | undefined;
+}) {
+  if (!snapshot) {
+    return null;
+  }
+
+  return (
+    <span className="small text-muted flex gap-2">
+      <span className="flex items-center gap-1">
+        <Icon icon={CpuIcon} /> {snapshot.TotalCPU}
+      </span>
+      <span className="flex items-center gap-1">
+        <Icon icon={memoryIcon} />
+        {humanize(snapshot.TotalMemory)}
+      </span>
+    </span>
+  );
+}
diff --git a/app/react/docker/DashboardView/EnvironmentInfo.TagsInfo.tsx b/app/react/docker/DashboardView/EnvironmentInfo.TagsInfo.tsx
new file mode 100644
index 0000000..659d350
--- /dev/null
+++ b/app/react/docker/DashboardView/EnvironmentInfo.TagsInfo.tsx
@@ -0,0 +1,28 @@
+import _ from 'lodash';
+
+import { useTags } from '@/portainer/tags/queries';
+
+import { DetailsTable } from '@@/DetailsTable';
+
+export function TagsInfo({ ids }: { ids: number[] }) {
+  const tagsQuery = useTags();
+
+  if (!tagsQuery.data) {
+    return null;
+  }
+
+  const tags = tagsQuery.data;
+
+  const tagNameList = ids.length
+    ? _.compact(
+        ids
+          .map((id) => {
+            const tag = tags.find((tag) => tag.ID === id);
+            return tag ? tag.Name : '';
+          })
+          .join(', ')
+      )
+    : '-';
+
+  return <DetailsTable.Row label="Tags">{tagNameList}</DetailsTable.Row>;
+}
diff --git a/app/react/docker/DashboardView/EnvironmentInfo.tsx b/app/react/docker/DashboardView/EnvironmentInfo.tsx
new file mode 100644
index 0000000..d74e4bc
--- /dev/null
+++ b/app/react/docker/DashboardView/EnvironmentInfo.tsx
@@ -0,0 +1,71 @@
+import { GaugeIcon } from 'lucide-react';
+
+import { useCurrentEnvironment } from '@/react/hooks/useCurrentEnvironment';
+import { stripProtocol } from '@/react/common/string-utils';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import {
+  isAgentEnvironment,
+  isEdgeEnvironment,
+} from '@/react/portainer/environments/utils';
+
+import { DetailsTable } from '@@/DetailsTable';
+import { Widget } from '@@/Widget';
+
+import { useIsSwarmManager } from '../proxy/queries/useInfo';
+
+import { GpuInfo } from './EnvironmentInfo.GpuInfo';
+import { SnapshotStats } from './EnvironmentInfo.SnapshotStats';
+import { DockerInfo } from './EnvironmentInfo.DockerInfo';
+import { TagsInfo } from './EnvironmentInfo.TagsInfo';
+import { ClusterVisualizerLink } from './ClusterVisualizerLink';
+
+export function EnvironmentInfo() {
+  const environmentId = useEnvironmentId();
+  const envQuery = useCurrentEnvironment();
+
+  const isSwarmManager = useIsSwarmManager(environmentId);
+
+  if (!envQuery.data) {
+    return null;
+  }
+
+  const environment = envQuery.data;
+
+  const isAgent = isAgentEnvironment(environment.Type);
+  const isEdgeAgent = isEdgeEnvironment(environment.Type);
+
+  const isEnvUrlVisible = !isEdgeAgent;
+
+  return (
+    <Widget>
+      <Widget.Title icon={GaugeIcon} title="Environment info" />
+      <Widget.Body className="!px-5 !py-0">
+        <DetailsTable dataCy="environment-info">
+          <DetailsTable.Row label="Environment">
+            <div className="flex items-center gap-2">
+              {environment.Name}
+              <SnapshotStats snapshot={environment.Snapshots[0]} />
+              <span className="text-muted">-</span>
+              <DockerInfo isAgent={isAgent} />
+            </div>
+          </DetailsTable.Row>
+
+          {isEnvUrlVisible && (
+            <DetailsTable.Row label="URL">
+              {stripProtocol(environment.URL)}
+            </DetailsTable.Row>
+          )}
+
+          <GpuInfo
+            gpus={environment.Gpus || []}
+            snapshot={environment.Snapshots[0]}
+          />
+
+          <TagsInfo ids={environment.TagIds} />
+
+          {isSwarmManager && <ClusterVisualizerLink />}
+        </DetailsTable>
+      </Widget.Body>
+    </Widget>
+  );
+}
diff --git a/app/react/docker/DashboardView/ImagesTotalSize.tsx b/app/react/docker/DashboardView/ImagesTotalSize.tsx
new file mode 100644
index 0000000..63f99db
--- /dev/null
+++ b/app/react/docker/DashboardView/ImagesTotalSize.tsx
@@ -0,0 +1,18 @@
+import clsx from 'clsx';
+import { PieChart } from 'lucide-react';
+
+import { Icon } from '@/react/components/Icon';
+import { humanize } from '@/portainer/filters/filters';
+
+interface Props {
+  imagesTotalSize: number;
+}
+
+export function ImagesTotalSize({ imagesTotalSize }: Props) {
+  return (
+    <div className="vertical-center">
+      <Icon icon={PieChart} className={clsx('space-right')} />
+      {humanize(imagesTotalSize)}
+    </div>
+  );
+}
diff --git a/app/react/docker/DashboardView/NonAgentSwarmInfo.tsx b/app/react/docker/DashboardView/NonAgentSwarmInfo.tsx
new file mode 100644
index 0000000..553b160
--- /dev/null
+++ b/app/react/docker/DashboardView/NonAgentSwarmInfo.tsx
@@ -0,0 +1,49 @@
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useInfoPanelState } from '@/react/hooks/useInfoPanelState';
+
+import { InformationPanel } from '@@/InformationPanel';
+import { TextTip } from '@@/Tip/TextTip';
+import { HelpLink } from '@@/HelpLink';
+
+import { useInfo } from '../proxy/queries/useInfo';
+
+const infoPanelId = 'docker-dashboard-info-01';
+
+export function NonAgentSwarmInfo() {
+  const { isVisible, dismiss } = useInfoPanelState(infoPanelId);
+  const envId = useEnvironmentId();
+  const isManagerQuery = useInfo(envId, {
+    select: (info) => !!info.Swarm?.ControlAvailable,
+  });
+  if (!isVisible || isManagerQuery.isLoading) {
+    return null;
+  }
+
+  const isManager = isManagerQuery.data;
+
+  return (
+    <InformationPanel title="Information" onDismiss={() => dismiss()}>
+      <TextTip color="blue">
+        {isManager ? (
+          <>
+            Portainer is connected to a node that is part of a Swarm cluster.
+            Some resources located on other nodes in the cluster might not be
+            available for management, have a look at{' '}
+            <HelpLink
+              docLink="/admin/environments/add/swarm/agent"
+              target="_blank"
+            >
+              our agent setup
+            </HelpLink>{' '}
+            for more details.
+          </>
+        ) : (
+          <>
+            Portainer is connected to a worker node. Swarm management features
+            will not be available.
+          </>
+        )}
+      </TextTip>
+    </InformationPanel>
+  );
+}
diff --git a/app/react/docker/DashboardView/useDashboard.ts b/app/react/docker/DashboardView/useDashboard.ts
new file mode 100644
index 0000000..54cd51a
--- /dev/null
+++ b/app/react/docker/DashboardView/useDashboard.ts
@@ -0,0 +1,41 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { queryKeys } from '../queries/utils';
+import { buildDockerUrl } from '../queries/utils/buildDockerUrl';
+
+interface DashboardResponse {
+  containers: {
+    total: number;
+    running: number;
+    stopped: number;
+    healthy: number;
+    unhealthy: number;
+  };
+  services: number;
+  images: {
+    total: number;
+    size: number;
+  };
+  volumes: number;
+  networks: number;
+  stacks: number;
+}
+
+export function useDashboard(envId: EnvironmentId) {
+  return useQuery({
+    queryFn: async () => {
+      try {
+        const res = await axios.get<DashboardResponse>(
+          buildDockerUrl(envId, 'dashboard')
+        );
+        return res.data;
+      } catch (error) {
+        throw parseAxiosError(error);
+      }
+    },
+    queryKey: [...queryKeys.root(envId), 'dashboard'] as const,
+  });
+}
diff --git a/app/react/docker/agent/NodeSelector.tsx b/app/react/docker/agent/NodeSelector.tsx
new file mode 100644
index 0000000..46e6fbb
--- /dev/null
+++ b/app/react/docker/agent/NodeSelector.tsx
@@ -0,0 +1,52 @@
+import { useEffect } from 'react';
+import { FormikErrors } from 'formik';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+
+import { Option, PortainerSelect } from '@@/form-components/PortainerSelect';
+import { FormControl } from '@@/form-components/FormControl';
+
+import { useApiVersion } from './queries/useApiVersion';
+import { useAgentNodes } from './queries/useAgentNodes';
+
+export function NodeSelector({
+  value,
+  onChange,
+  error,
+}: {
+  value: string;
+  onChange: (value: string) => void;
+  error?: FormikErrors<string>;
+}) {
+  const environmentId = useEnvironmentId();
+
+  const apiVersionQuery = useApiVersion(environmentId);
+
+  const nodesQuery = useAgentNodes<Array<Option<string>>>(
+    environmentId,
+    apiVersionQuery.data || 1,
+    {
+      select: (data) =>
+        data.map((node) => ({ label: node.NodeName, value: node.NodeName })),
+      enabled: apiVersionQuery.data !== undefined,
+    }
+  );
+
+  useEffect(() => {
+    if (nodesQuery.data && !value && nodesQuery.data.length > 0) {
+      onChange(nodesQuery.data[0].value);
+    }
+  }, [nodesQuery.data, onChange, value]);
+
+  return (
+    <FormControl label="Node" inputId="node-selector" errors={error}>
+      <PortainerSelect
+        inputId="node-selector"
+        value={value}
+        onChange={onChange}
+        options={nodesQuery.data || []}
+        data-cy="docker-agent-node-selector"
+      />
+    </FormControl>
+  );
+}
diff --git a/app/react/docker/agent/queries/build-url.ts b/app/react/docker/agent/queries/build-url.ts
new file mode 100644
index 0000000..6121497
--- /dev/null
+++ b/app/react/docker/agent/queries/build-url.ts
@@ -0,0 +1,17 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+export function buildAgentUrl(
+  environmentId: EnvironmentId,
+  apiVersion: number,
+  action: string
+) {
+  let url = `/endpoints/${environmentId}/agent/docker`;
+
+  if (apiVersion > 1) {
+    url += `/v${apiVersion}`;
+  }
+
+  url += `/${action}`;
+
+  return url;
+}
diff --git a/app/react/docker/agent/queries/useAgentNodes.ts b/app/react/docker/agent/queries/useAgentNodes.ts
new file mode 100644
index 0000000..b96c605
--- /dev/null
+++ b/app/react/docker/agent/queries/useAgentNodes.ts
@@ -0,0 +1,44 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { buildAgentUrl } from './build-url';
+
+export interface AgentNode {
+  IPAddress: string;
+  NodeName: string;
+  NodeRole: string;
+}
+
+export function useAgentNodes<T = Array<AgentNode>>(
+  environmentId: EnvironmentId,
+  apiVersion: number,
+  {
+    select,
+    enabled,
+  }: {
+    select?: (data: Array<AgentNode>) => T;
+    enabled?: boolean;
+  } = {}
+) {
+  return useQuery(
+    ['environment', environmentId, 'agent', 'nodes'],
+    () => getNodes(environmentId, apiVersion),
+    {
+      select,
+      enabled,
+    }
+  );
+}
+
+async function getNodes(environmentId: EnvironmentId, apiVersion: number) {
+  try {
+    const response = await axios.get<Array<AgentNode>>(
+      buildAgentUrl(environmentId, apiVersion, 'agents')
+    );
+    return response.data;
+  } catch (error) {
+    throw parseAxiosError(error as Error, 'Unable to retrieve nodes');
+  }
+}
diff --git a/app/react/docker/agent/queries/useApiVersion.ts b/app/react/docker/agent/queries/useApiVersion.ts
new file mode 100644
index 0000000..2a2f4a9
--- /dev/null
+++ b/app/react/docker/agent/queries/useApiVersion.ts
@@ -0,0 +1,29 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { isAxiosError } from '@/portainer/services/axios/utils/isAxiosError';
+
+import { buildDockerProxyUrl } from '../../proxy/queries/buildDockerProxyUrl';
+
+export function useApiVersion(environmentId: EnvironmentId) {
+  return useQuery(['environment', environmentId, 'agent', 'ping'], () =>
+    getApiVersion(environmentId)
+  );
+}
+
+async function getApiVersion(environmentId: EnvironmentId) {
+  try {
+    const { headers } = await axios.get(
+      buildDockerProxyUrl(environmentId, 'ping')
+    );
+    return parseInt(headers['portainer-agent-api-version'], 10) || 1;
+  } catch (error) {
+    // 404 - agent is up - set version to 1
+    if (isAxiosError(error) && error.response?.status === 404) {
+      return 1;
+    }
+
+    throw parseAxiosError(error as Error, 'Unable to ping agent');
+  }
+}
diff --git a/app/react/docker/components/FilesTable/FilesTable.tsx b/app/react/docker/components/FilesTable/FilesTable.tsx
new file mode 100644
index 0000000..4ffbcbd
--- /dev/null
+++ b/app/react/docker/components/FilesTable/FilesTable.tsx
@@ -0,0 +1,134 @@
+import { CornerLeftUp, File as FileIcon, Upload } from 'lucide-react';
+import { useState } from 'react';
+
+import { Authorized } from '@/react/hooks/useUser';
+
+import { Datatable } from '@@/datatables';
+import { BasicTableSettings } from '@@/datatables/types';
+import { Button } from '@@/buttons';
+import { TableState } from '@@/datatables/useTableState';
+import { withMeta } from '@@/datatables/extend-options/withMeta';
+import { mergeOptions } from '@@/datatables/extend-options/mergeOptions';
+
+import { FileData } from './types';
+import { columns } from './columns';
+
+interface Props {
+  title: string;
+  dataset: FileData[];
+  tableState: TableState<BasicTableSettings>;
+
+  isRoot: boolean;
+  onGoToParent: () => void;
+  onBrowse: (folderName: string) => void;
+  onRename: (oldName: string, newName: string) => void;
+  onDownload: (fileName: string) => void;
+  onDelete: (fileName: string) => void;
+
+  isUploadAllowed: boolean;
+  onFileSelectedForUpload: (file: File) => void;
+}
+
+function goToParent(onClick: () => void): FileData {
+  return {
+    custom: (
+      <Button
+        onClick={onClick}
+        color="link"
+        icon={CornerLeftUp}
+        className="!m-0 !p-0"
+        data-cy="component-goToParentButton"
+      >
+        Go to parent
+      </Button>
+    ),
+    Dir: true,
+    Name: '..',
+    Size: 0,
+    ModTime: 0,
+  };
+}
+
+export function FilesTable({
+  isRoot,
+  title,
+  dataset,
+  tableState,
+  onGoToParent,
+  onRename,
+  onBrowse,
+  onDelete,
+  onDownload,
+  isUploadAllowed,
+  onFileSelectedForUpload,
+}: Props) {
+  const [isEditState, setIsEditState] = useState(
+    Object.fromEntries(dataset.map((f) => [f.Name, false]))
+  );
+
+  function isEdit(name: string) {
+    return isEditState[name];
+  }
+
+  function setIsEdit(name: string, value: boolean) {
+    setIsEditState((editState) => ({ ...editState, [name]: value }));
+  }
+
+  return (
+    <Datatable<FileData>
+      title={title}
+      titleIcon={FileIcon}
+      dataset={isRoot ? dataset : [goToParent(onGoToParent), ...dataset]}
+      settingsManager={tableState}
+      columns={columns}
+      getRowId={(row) => row.Name}
+      initialTableState={{
+        columnVisibility: {
+          Dir: false,
+        },
+      }}
+      extendTableOptions={mergeOptions(
+        withMeta({
+          table: 'files',
+          isEdit,
+          setIsEdit,
+          onRename,
+          onBrowse,
+          onDownload,
+          onDelete,
+        })
+      )}
+      disableSelect
+      data-cy="files-datatable"
+      renderTableActions={() => {
+        if (!isUploadAllowed) {
+          return null;
+        }
+
+        return (
+          <Authorized authorizations="DockerAgentBrowsePut">
+            <div className="flex flex-row items-center">
+              <Button
+                color="light"
+                icon={Upload}
+                as="label"
+                data-cy="docker-agent-file-upload-button"
+              >
+                <input
+                  type="file"
+                  className="hidden"
+                  onChange={(e) => {
+                    const file = e.target.files?.[0];
+                    if (file) {
+                      onFileSelectedForUpload(file);
+                    }
+                  }}
+                />
+              </Button>
+            </div>
+          </Authorized>
+        );
+      }}
+    />
+  );
+}
diff --git a/app/react/docker/components/FilesTable/columns/ActionsCell.tsx b/app/react/docker/components/FilesTable/columns/ActionsCell.tsx
new file mode 100644
index 0000000..1e635c8
--- /dev/null
+++ b/app/react/docker/components/FilesTable/columns/ActionsCell.tsx
@@ -0,0 +1,61 @@
+import { CellContext } from '@tanstack/react-table';
+import { Download, Edit, Trash2 } from 'lucide-react';
+
+import { Authorized } from '@/react/hooks/useUser';
+
+import { Button } from '@@/buttons';
+
+import { FileData, isFilesTableMeta } from '../types';
+
+export function ActionsCell({
+  row: { original: item },
+  table,
+}: CellContext<FileData, unknown>) {
+  const { meta } = table.options;
+  if (!isFilesTableMeta(meta)) {
+    throw new Error('Invalid table meta');
+  }
+
+  return (
+    <div className="flex gap-2">
+      {!item.Dir && (
+        <Authorized authorizations="DockerAgentBrowseGet">
+          <Button
+            color="secondary"
+            size="xsmall"
+            onClick={() => meta.onDownload(item.Name)}
+            icon={Download}
+            className="!m-0"
+            data-cy={`docker-files-download-${item.Name}`}
+          >
+            Download
+          </Button>
+        </Authorized>
+      )}
+      <Authorized authorizations="DockerAgentBrowseRename">
+        <Button
+          color="secondary"
+          size="xsmall"
+          icon={Edit}
+          onClick={() => meta.setIsEdit(item.Name, true)}
+          className="!m-0"
+          data-cy={`docker-files-rename-${item.Name}`}
+        >
+          Rename
+        </Button>
+      </Authorized>
+      <Authorized authorizations="DockerAgentBrowseDelete">
+        <Button
+          color="dangerlight"
+          size="xsmall"
+          icon={Trash2}
+          onClick={() => meta.onDelete(item.Name)}
+          className="!m-0"
+          data-cy={`docker-files-delete-${item.Name}`}
+        >
+          Delete
+        </Button>
+      </Authorized>
+    </div>
+  );
+}
diff --git a/app/react/docker/components/FilesTable/columns/NameCell.tsx b/app/react/docker/components/FilesTable/columns/NameCell.tsx
new file mode 100644
index 0000000..33742b3
--- /dev/null
+++ b/app/react/docker/components/FilesTable/columns/NameCell.tsx
@@ -0,0 +1,110 @@
+import { CellContext } from '@tanstack/react-table';
+import { Check, File as FileIcon, Folder, X } from 'lucide-react';
+import { Form, Formik } from 'formik';
+
+import { Icon } from '@@/Icon';
+import { Button } from '@@/buttons';
+import { Input } from '@@/form-components/Input';
+
+import { FileData, isFilesTableMeta } from '../types';
+
+export function NameCell({
+  getValue,
+  row: { original: item },
+  table,
+}: CellContext<FileData, string>) {
+  const name = getValue();
+  const { meta } = table.options;
+  if (!isFilesTableMeta(meta)) {
+    throw new Error('Invalid table meta');
+  }
+  const isEdit = meta.isEdit(name);
+
+  if (item.custom) {
+    return item.custom;
+  }
+
+  if (isEdit) {
+    return (
+      <EditForm
+        originalName={name}
+        onSave={handleRename}
+        onClose={() => meta.setIsEdit(name, false)}
+      />
+    );
+  }
+
+  return (
+    <>
+      {item.Dir ? (
+        <Button
+          color="link"
+          className="!ml-0 p-0"
+          onClick={() => meta.onBrowse(name)}
+          icon={Folder}
+          data-cy={`file-browse-${name}`}
+        >
+          {name}
+        </Button>
+      ) : (
+        <span className="vertical-center">
+          <Icon icon={FileIcon} />
+          {name}
+        </span>
+      )}
+    </>
+  );
+
+  function handleRename(name: string) {
+    if (!isFilesTableMeta(meta)) {
+      throw new Error('Invalid table meta');
+    }
+
+    meta.onRename(item.Name, name);
+    meta.setIsEdit(name, false);
+  }
+}
+
+function EditForm({
+  originalName,
+  onSave,
+  onClose,
+}: {
+  originalName: string;
+  onSave: (name: string) => void;
+  onClose: () => void;
+}) {
+  return (
+    <Formik
+      initialValues={{ name: originalName }}
+      onSubmit={({ name }) => onSave(name)}
+      onReset={onClose}
+    >
+      {({ values, setFieldValue }) => (
+        <Form className="flex items-center">
+          <Input
+            name="name"
+            value={values.name}
+            onChange={(e) => setFieldValue('name', e.target.value)}
+            className="input-sm w-auto"
+            data-cy={`file-rename-${originalName}`}
+          />
+
+          <Button
+            color="none"
+            type="reset"
+            icon={X}
+            data-cy={`file-reset-button-${originalName}`}
+          />
+
+          <Button
+            color="none"
+            type="submit"
+            icon={Check}
+            data-cy={`file-submit-button-${originalName}`}
+          />
+        </Form>
+      )}
+    </Formik>
+  );
+}
diff --git a/app/react/docker/components/FilesTable/columns/helper.ts b/app/react/docker/components/FilesTable/columns/helper.ts
new file mode 100644
index 0000000..f9d1126
--- /dev/null
+++ b/app/react/docker/components/FilesTable/columns/helper.ts
@@ -0,0 +1,5 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { FileData } from '../types';
+
+export const columnHelper = createColumnHelper<FileData>();
diff --git a/app/react/docker/components/FilesTable/columns/index.ts b/app/react/docker/components/FilesTable/columns/index.ts
new file mode 100644
index 0000000..79d6852
--- /dev/null
+++ b/app/react/docker/components/FilesTable/columns/index.ts
@@ -0,0 +1,44 @@
+import {
+  CellContext,
+  ColumnDef,
+  ColumnDefTemplate,
+} from '@tanstack/react-table';
+
+import { humanize, isoDateFromTimestamp } from '@/portainer/filters/filters';
+
+import { FileData } from '../types';
+
+import { columnHelper } from './helper';
+import { NameCell } from './NameCell';
+import { ActionsCell } from './ActionsCell';
+
+export const columns = [
+  columnHelper.accessor('Name', {
+    header: 'Name',
+    cell: NameCell,
+  }),
+  columnHelper.accessor('Size', {
+    header: 'Size',
+    cell: hideIfCustom(({ getValue }) => humanize(getValue())),
+  }),
+  columnHelper.accessor('ModTime', {
+    header: 'Last modification',
+    cell: hideIfCustom(({ getValue }) => isoDateFromTimestamp(getValue())),
+  }),
+  columnHelper.display({
+    header: 'Actions',
+    cell: hideIfCustom(ActionsCell),
+  }),
+  columnHelper.accessor('Dir', {}), // workaround, to enable sorting by Dir (put directory first)
+] as ColumnDef<FileData>[];
+
+function hideIfCustom<TValue>(
+  template: ColumnDefTemplate<CellContext<FileData, TValue>>
+): ColumnDefTemplate<CellContext<FileData, TValue>> {
+  return (props) => {
+    if (props.row.original.custom) {
+      return null;
+    }
+    return typeof template === 'string' ? template : template(props);
+  };
+}
diff --git a/app/react/docker/components/FilesTable/index.ts b/app/react/docker/components/FilesTable/index.ts
new file mode 100644
index 0000000..7c9b964
--- /dev/null
+++ b/app/react/docker/components/FilesTable/index.ts
@@ -0,0 +1 @@
+export { FilesTable } from './FilesTable';
diff --git a/app/react/docker/components/FilesTable/types.ts b/app/react/docker/components/FilesTable/types.ts
new file mode 100644
index 0000000..b9c552a
--- /dev/null
+++ b/app/react/docker/components/FilesTable/types.ts
@@ -0,0 +1,26 @@
+import { TableMeta } from '@tanstack/react-table';
+import { ReactNode } from 'react';
+
+export type FileData = {
+  Name: string;
+  Dir: boolean;
+  Size: number;
+  ModTime: number;
+  custom: ReactNode;
+};
+
+export type FilesTableMeta = TableMeta<FileData> & {
+  table: 'files';
+  isEdit(rowId: string): boolean;
+  setIsEdit(rowId: string, isEdit: boolean): void;
+  onRename: (oldName: string, newName: string) => void;
+  onBrowse: (name: string) => void;
+  onDownload: (fileName: string) => void;
+  onDelete: (fileName: string) => void;
+};
+
+export function isFilesTableMeta(
+  meta?: TableMeta<FileData>
+): meta is FilesTableMeta {
+  return !!meta && 'table' in meta && meta.table === 'files';
+}
diff --git a/app/react/docker/components/ImageStatus/ImageStatus.tsx b/app/react/docker/components/ImageStatus/ImageStatus.tsx
new file mode 100644
index 0000000..1c36c13
--- /dev/null
+++ b/app/react/docker/components/ImageStatus/ImageStatus.tsx
@@ -0,0 +1,60 @@
+import { Loader } from 'lucide-react';
+
+import { useEnvironment } from '@/react/portainer/environments/queries';
+import { statusIcon } from '@/react/docker/components/ImageStatus/helpers';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { isBE } from '@/react/portainer/feature-flags/feature-flags.service';
+
+import { Icon } from '@@/Icon';
+
+import { ResourceID, ResourceType } from './types';
+import { useImageNotification } from './useImageNotification';
+
+export interface Props {
+  environmentId: EnvironmentId;
+  resourceId: ResourceID;
+  resourceType?: ResourceType;
+  nodeName?: string;
+}
+
+export function ImageStatus({
+  environmentId,
+  resourceId,
+  resourceType = ResourceType.CONTAINER,
+  nodeName = '',
+}: Props) {
+  const enableImageNotificationQuery = useEnvironment(
+    environmentId,
+    (environment) => environment?.EnableImageNotification
+  );
+
+  const { data, isLoading, isError } = useImageNotification(
+    environmentId,
+    resourceId,
+    resourceType,
+    nodeName,
+    enableImageNotificationQuery.data
+  );
+
+  if (!enableImageNotificationQuery.data || isError) {
+    return null;
+  }
+
+  if (!isBE) {
+    return null;
+  }
+
+  if (isLoading || !data) {
+    return (
+      <Icon
+        icon={Loader}
+        size="sm"
+        className="!mr-1 animate-spin-slow align-middle"
+      />
+    );
+  }
+
+  return (
+    <Icon icon={statusIcon(data)} size="sm" className="!mr-1 align-middle" />
+  );
+}
diff --git a/app/react/docker/components/ImageStatus/PublishedPortLink.tsx b/app/react/docker/components/ImageStatus/PublishedPortLink.tsx
new file mode 100644
index 0000000..79cfd6b
--- /dev/null
+++ b/app/react/docker/components/ImageStatus/PublishedPortLink.tsx
@@ -0,0 +1,44 @@
+import { ExternalLink } from '@@/ExternalLink';
+
+type Props = {
+  hostURL?: string;
+  hostPort?: string | number;
+  containerPort?: string | number;
+};
+
+export function PublishedPortLink({ hostURL, hostPort, containerPort }: Props) {
+  return (
+    <ExternalLink
+      to={generateContainerURL(hostURL, hostPort, containerPort)}
+      className="image-tag"
+      data-cy="published-port-link"
+    >
+      {hostPort}:{containerPort}
+    </ExternalLink>
+  );
+}
+
+function generateContainerURL(
+  hostURL?: string,
+  hostPort?: string | number,
+  containerPort?: string | number
+) {
+  const url = stripTrailingSlash(hostURL?.toLowerCase());
+
+  if (!url.startsWith('http://') && !url.startsWith('https://')) {
+    if (String(containerPort).endsWith('443')) {
+      return `https://${url}:${hostPort}`;
+    }
+
+    return `http://${url}:${hostPort}`;
+  }
+
+  return `${url}:${hostPort}`;
+}
+
+function stripTrailingSlash(url?: string) {
+  if (!url) {
+    return '';
+  }
+  return url.endsWith('/') ? url.slice(0, -1) : url;
+}
diff --git a/app/react/docker/components/ImageStatus/helpers.ts b/app/react/docker/components/ImageStatus/helpers.ts
new file mode 100644
index 0000000..e11e82a
--- /dev/null
+++ b/app/react/docker/components/ImageStatus/helpers.ts
@@ -0,0 +1,20 @@
+import { Loader } from 'lucide-react';
+
+import UpdatesAvailable from '@/assets/ico/icon_updates-available.svg?c';
+import UpToDate from '@/assets/ico/icon_up-to-date.svg?c';
+import UpdatesUnknown from '@/assets/ico/icon_updates-unknown.svg?c';
+
+import { ImageStatus } from './types';
+
+export function statusIcon(status: ImageStatus) {
+  switch (status.Status) {
+    case 'outdated':
+      return UpdatesAvailable;
+    case 'updated':
+      return UpToDate;
+    case 'processing':
+      return Loader;
+    default:
+      return UpdatesUnknown;
+  }
+}
diff --git a/app/react/docker/components/ImageStatus/index.js b/app/react/docker/components/ImageStatus/index.js
new file mode 100644
index 0000000..a204525
--- /dev/null
+++ b/app/react/docker/components/ImageStatus/index.js
@@ -0,0 +1 @@
+export { ImageStatus } from './ImageStatus';
diff --git a/app/react/docker/components/ImageStatus/types.ts b/app/react/docker/components/ImageStatus/types.ts
new file mode 100644
index 0000000..c8bde18
--- /dev/null
+++ b/app/react/docker/components/ImageStatus/types.ts
@@ -0,0 +1,13 @@
+type Status = 'outdated' | 'updated' | 'inprocess' | string;
+
+export enum ResourceType {
+  CONTAINER,
+  SERVICE,
+}
+
+export interface ImageStatus {
+  Status: Status;
+  Message: string;
+}
+
+export type ResourceID = string;
diff --git a/app/react/docker/components/ImageStatus/useImageNotification.ts b/app/react/docker/components/ImageStatus/useImageNotification.ts
new file mode 100644
index 0000000..780fc10
--- /dev/null
+++ b/app/react/docker/components/ImageStatus/useImageNotification.ts
@@ -0,0 +1,75 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios from '@/portainer/services/axios/axios';
+import { ServiceId } from '@/react/docker/services/types';
+import { ContainerId } from '@/react/docker/containers/types';
+
+import { ImageStatus, ResourceID, ResourceType } from './types';
+
+export function useImageNotification(
+  environmentId: number,
+  resourceId: ResourceID,
+  resourceType: ResourceType,
+  nodeName: string,
+  enabled = false
+) {
+  return useQuery(
+    [
+      'environments',
+      environmentId,
+      'docker',
+      'images',
+      resourceType,
+      resourceId,
+      'status',
+    ],
+    () =>
+      resourceType === ResourceType.SERVICE
+        ? getServiceImagesStatus(environmentId, resourceId)
+        : getContainerImagesStatus(environmentId, resourceId, nodeName),
+    {
+      enabled,
+    }
+  );
+}
+
+async function getContainerImagesStatus(
+  environmentId: EnvironmentId,
+  containerID: ContainerId,
+  nodeName: string
+) {
+  try {
+    let headers = {};
+    if (nodeName !== '') {
+      headers = { 'X-PortainerAgent-Target': nodeName };
+    }
+    const { data } = await axios.get<ImageStatus>(
+      `/docker/${environmentId}/containers/${containerID}/image_status`,
+      { headers }
+    );
+    return data;
+  } catch (e) {
+    return {
+      Status: 'unknown',
+      Message: `Unable to retrieve image status for container: ${containerID}`,
+    };
+  }
+}
+
+async function getServiceImagesStatus(
+  environmentId: EnvironmentId,
+  serviceID: ServiceId
+) {
+  try {
+    const { data } = await axios.get<ImageStatus>(
+      `/docker/${environmentId}/services/${serviceID}/image_status`
+    );
+    return data;
+  } catch (e) {
+    return {
+      Status: 'unknown',
+      Message: `Unable to retrieve image status for service: ${serviceID}`,
+    };
+  }
+}
diff --git a/app/react/docker/components/datatable/TableColumnHeaderImageUpToDate.tsx b/app/react/docker/components/datatable/TableColumnHeaderImageUpToDate.tsx
new file mode 100644
index 0000000..223b88b
--- /dev/null
+++ b/app/react/docker/components/datatable/TableColumnHeaderImageUpToDate.tsx
@@ -0,0 +1,70 @@
+import UpdatesAvailable from '@/assets/ico/icon_updates-available.svg?c';
+import UpToDate from '@/assets/ico/icon_up-to-date.svg?c';
+import UpdatesUnknown from '@/assets/ico/icon_updates-unknown.svg?c';
+import { useEnvironment } from '@/react/portainer/environments/queries';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { isBE } from '@/react/portainer/feature-flags/feature-flags.service';
+
+import { Icon } from '@@/Icon';
+import { Tooltip } from '@@/Tip/Tooltip';
+import {
+  TableColumnHeaderAngular,
+  TableColumnHeaderAngularProps,
+} from '@@/datatables/TableHeaderCell';
+
+export function TableColumnHeaderImageUpToDate({
+  canSort,
+  isSorted,
+  colTitle,
+  isSortedDesc = true,
+}: TableColumnHeaderAngularProps) {
+  return (
+    <TableColumnHeaderAngular
+      canSort={canSort}
+      isSorted={isSorted}
+      colTitle={colTitle}
+      isSortedDesc={isSortedDesc}
+    >
+      <ImageUpToDateTooltip />
+    </TableColumnHeaderAngular>
+  );
+}
+
+export function ImageUpToDateTooltip() {
+  const environmentId = useEnvironmentId();
+
+  const enableImageNotificationQuery = useEnvironment(
+    environmentId,
+    (environment) => environment?.EnableImageNotification
+  );
+
+  if (!enableImageNotificationQuery.data) {
+    return null;
+  }
+
+  if (!isBE) {
+    return null;
+  }
+
+  return (
+    <Tooltip
+      position="top"
+      message={
+        <div className="flex flex-col gap-y-2 p-2">
+          <div className="flex items-center gap-2">
+            <Icon icon={UpToDate} />
+            Images are up to date
+          </div>
+          <div className="flex items-center gap-2">
+            <Icon icon={UpdatesAvailable} />
+            Updates are available
+          </div>
+          <div className="flex items-center gap-2">
+            <Icon icon={UpdatesUnknown} />
+            Updates availability unknown
+          </div>
+        </div>
+      }
+    />
+  );
+}
diff --git a/app/react/docker/components/datatable/createOwnershipColumn.tsx b/app/react/docker/components/datatable/createOwnershipColumn.tsx
new file mode 100644
index 0000000..feba754
--- /dev/null
+++ b/app/react/docker/components/datatable/createOwnershipColumn.tsx
@@ -0,0 +1,51 @@
+import { CellContext, ColumnDef } from '@tanstack/react-table';
+import { Eye, EyeOff, Users } from 'lucide-react';
+
+import { ResourceControlOwnership } from '@/react/portainer/access-control/types';
+
+import { Icon } from '@@/Icon';
+
+export interface IResource {
+  ResourceControl?: {
+    Ownership: ResourceControlOwnership;
+  };
+}
+
+export function createOwnershipColumn<D extends IResource>(
+  enableHiding = true
+): ColumnDef<D, ResourceControlOwnership> {
+  return {
+    accessorFn: (row) =>
+      row.ResourceControl?.Ownership || ResourceControlOwnership.ADMINISTRATORS,
+    header: 'Ownership',
+    id: 'ownership',
+    cell: OwnershipCell,
+    enableHiding,
+  };
+
+  function OwnershipCell({
+    getValue,
+  }: CellContext<D, ResourceControlOwnership>) {
+    const value = getValue();
+
+    return (
+      <span className="flex items-center gap-2">
+        <Icon icon={ownershipIcon(value)} className="space-right" />
+        {value}
+      </span>
+    );
+  }
+}
+
+export function ownershipIcon(ownership: ResourceControlOwnership) {
+  switch (ownership) {
+    case ResourceControlOwnership.PRIVATE:
+      return EyeOff;
+    case ResourceControlOwnership.ADMINISTRATORS:
+      return EyeOff;
+    case ResourceControlOwnership.RESTRICTED:
+      return Users;
+    default:
+      return Eye;
+  }
+}
diff --git a/app/react/docker/configs/CreateView/.keep b/app/react/docker/configs/CreateView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/docker/configs/EditView/.keep b/app/react/docker/configs/EditView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/docker/configs/ListView/ConfigsDatatable/ConfigsDatatable.test.tsx b/app/react/docker/configs/ListView/ConfigsDatatable/ConfigsDatatable.test.tsx
new file mode 100644
index 0000000..e0b69e7
--- /dev/null
+++ b/app/react/docker/configs/ListView/ConfigsDatatable/ConfigsDatatable.test.tsx
@@ -0,0 +1,198 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import { HttpResponse, http } from 'msw';
+import { Config } from 'docker-types';
+
+import { isoDate } from '@/portainer/filters/filters';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { server } from '@/setup-tests/server';
+import { Role, User } from '@/portainer/users/types';
+import {
+  createMockEnvironment,
+  createMockUsers,
+} from '@/react-tools/test-mocks';
+
+import { ConfigsDatatable } from './ConfigsDatatable';
+
+vi.mock('@uirouter/react', async (importOriginal: () => Promise<object>) => ({
+  ...(await importOriginal()),
+  useCurrentStateAndParams: vi.fn(() => ({
+    params: { endpointId: '1' },
+  })),
+}));
+
+vi.mock('@@/Link', () => ({
+  Link: ({
+    children,
+    'data-cy': dataCy,
+  }: {
+    children: React.ReactNode;
+    'data-cy'?: string;
+  }) => (
+    // eslint-disable-next-line jsx-a11y/anchor-is-valid
+    <a data-cy={dataCy}>{children}</a>
+  ),
+}));
+
+beforeEach(() => {
+  server.use(
+    http.get('/api/endpoints/1', () =>
+      HttpResponse.json(
+        createMockEnvironment({
+          Id: 1,
+          Name: 'test-environment',
+          Type: 1,
+        })
+      )
+    )
+  );
+});
+
+beforeAll(() => {
+  // set timezone explicitly to avoid daylight savings drift
+  vi.stubEnv('TZ', 'UTC');
+});
+
+afterAll(() => {
+  vi.unstubAllEnvs();
+});
+
+it('should return null when data is loading', () => {
+  server.use(
+    http.get('/api/endpoints/:environmentId/docker/configs', async () => {
+      // Never resolve to simulate loading state
+      await new Promise(() => {});
+      return HttpResponse.json([]);
+    })
+  );
+
+  const { container } = renderComponent();
+
+  // Component returns null while loading, so the container's first child is empty
+  expect(container.firstChild).toBeEmptyDOMElement();
+});
+
+it('should render datatable with configs', async () => {
+  const mockConfigs = [
+    createMockConfig({ ID: 'config-1', Spec: { Name: 'my-config-1' } }),
+    createMockConfig({ ID: 'config-2', Spec: { Name: 'my-config-2' } }),
+  ];
+
+  server.use(
+    http.get('/api/endpoints/:environmentId/docker/configs', () =>
+      HttpResponse.json(mockConfigs)
+    )
+  );
+
+  renderComponent();
+
+  await waitFor(() => {
+    expect(screen.getByRole('region', { name: 'Configs' })).toBeVisible();
+  });
+
+  expect(screen.getByText('my-config-1')).toBeVisible();
+  expect(screen.getByText('my-config-2')).toBeVisible();
+});
+
+it('should display config creation date formatted', async () => {
+  const createdAt = '2024-06-15T14:30:00.000000000Z';
+  const mockConfigs = [
+    createMockConfig({
+      ID: 'config-1',
+      CreatedAt: createdAt,
+    }),
+  ];
+
+  server.use(
+    http.get('/api/endpoints/:environmentId/docker/configs', () =>
+      HttpResponse.json(mockConfigs)
+    )
+  );
+
+  renderComponent();
+
+  await waitFor(() => {
+    expect(screen.getByRole('region', { name: 'Configs' })).toBeVisible();
+  });
+
+  const expectedDate = isoDate(mockConfigs[0].CreatedAt);
+  expect(screen.getByText(new RegExp(expectedDate))).toBeVisible();
+});
+
+it('should show Add config button for admin user', async () => {
+  server.use(
+    http.get('/api/endpoints/:environmentId/docker/configs', () =>
+      HttpResponse.json([createMockConfig()])
+    )
+  );
+
+  renderComponent(createAdminUser());
+
+  await waitFor(() => {
+    expect(screen.getByRole('region', { name: 'Configs' })).toBeVisible();
+  });
+
+  expect(screen.getByText(/add config/i)).toBeVisible();
+});
+
+it('should show Add config button for standard user', async () => {
+  server.use(
+    http.get('/api/endpoints/:environmentId/docker/configs', () =>
+      HttpResponse.json([createMockConfig()])
+    )
+  );
+
+  renderComponent(createStandardUser());
+
+  await waitFor(() => {
+    expect(screen.getByRole('region', { name: 'Configs' })).toBeVisible();
+  });
+
+  expect(screen.getByText(/add config/i)).toBeVisible();
+});
+
+it('should render empty datatable when no configs exist', async () => {
+  server.use(
+    http.get('/api/endpoints/:environmentId/docker/configs', () =>
+      HttpResponse.json([])
+    )
+  );
+
+  renderComponent();
+
+  await waitFor(() => {
+    expect(screen.getByRole('region', { name: 'Configs' })).toBeVisible();
+  });
+});
+
+function createMockConfig(overrides: Partial<Config> = {}): Config {
+  return {
+    ID: 'config-id-1',
+    CreatedAt: '2024-01-15T10:30:00.000000000Z',
+    UpdatedAt: '2024-01-15T10:30:00.000000000Z',
+    Version: { Index: 1 },
+    Spec: {
+      Name: 'test-config',
+      Labels: {},
+      Data: btoa('config data'),
+    },
+    ...overrides,
+  };
+}
+
+function createAdminUser(): User {
+  return createMockUsers(1, Role.Admin)[0];
+}
+
+function createStandardUser(): User {
+  return createMockUsers(1, Role.Standard)[0];
+}
+
+function renderComponent(user: User = createAdminUser()) {
+  const Wrapped = withTestQueryProvider(
+    withUserProvider(withTestRouter(ConfigsDatatable), user)
+  );
+
+  return render(<Wrapped />);
+}
diff --git a/app/react/docker/configs/ListView/ConfigsDatatable/ConfigsDatatable.tsx b/app/react/docker/configs/ListView/ConfigsDatatable/ConfigsDatatable.tsx
new file mode 100644
index 0000000..c826dbd
--- /dev/null
+++ b/app/react/docker/configs/ListView/ConfigsDatatable/ConfigsDatatable.tsx
@@ -0,0 +1,75 @@
+import { Clipboard } from 'lucide-react';
+
+import { Authorized, useAuthorizations } from '@/react/hooks/useUser';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+
+import { Datatable, TableSettingsMenu } from '@@/datatables';
+import { TableSettingsMenuAutoRefresh } from '@@/datatables/TableSettingsMenuAutoRefresh';
+import { AddButton } from '@@/buttons';
+import { useTableState } from '@@/datatables/useTableState';
+
+import { useConfigsList } from '../../queries/useConfigs';
+import { ConfigViewModel } from '../../model';
+
+import { columns } from './columns';
+import { createStore } from './store';
+import { DeleteConfigButton } from './DeleteConfigButton';
+
+const storageKey = 'docker_configs';
+const settingsStore = createStore(storageKey);
+
+export function ConfigsDatatable() {
+  const environmentId = useEnvironmentId();
+  const tableState = useTableState(settingsStore, storageKey);
+
+  const configListQuery = useConfigsList(environmentId, {
+    refetchInterval: tableState.autoRefreshRate * 1000,
+    select: (configs) => configs.map((c) => new ConfigViewModel(c)),
+  });
+
+  const hasWriteAccessQuery = useAuthorizations([
+    'DockerConfigCreate',
+    'DockerConfigDelete',
+  ]);
+
+  if (!configListQuery.data) {
+    return null;
+  }
+
+  const dataset = configListQuery.data;
+
+  return (
+    <Datatable
+      dataset={dataset}
+      columns={columns}
+      settingsManager={tableState}
+      title="Configs"
+      titleIcon={Clipboard}
+      renderTableSettings={() => (
+        <TableSettingsMenu>
+          <TableSettingsMenuAutoRefresh
+            value={tableState.autoRefreshRate}
+            onChange={(value) => tableState.setAutoRefreshRate(value)}
+          />
+        </TableSettingsMenu>
+      )}
+      disableSelect={!hasWriteAccessQuery.authorized}
+      data-cy="configs-datatable"
+      renderTableActions={(selectedRows) =>
+        hasWriteAccessQuery.authorized && (
+          <div className="flex items-center gap-3">
+            <Authorized authorizations="DockerConfigDelete">
+              <DeleteConfigButton selectedItems={selectedRows} />
+            </Authorized>
+
+            <Authorized authorizations="DockerConfigCreate">
+              <AddButton data-cy="add-docker-config-button">
+                Add config
+              </AddButton>
+            </Authorized>
+          </div>
+        )
+      }
+    />
+  );
+}
diff --git a/app/react/docker/configs/ListView/ConfigsDatatable/DeleteConfigButton.test.tsx b/app/react/docker/configs/ListView/ConfigsDatatable/DeleteConfigButton.test.tsx
new file mode 100644
index 0000000..29fcd74
--- /dev/null
+++ b/app/react/docker/configs/ListView/ConfigsDatatable/DeleteConfigButton.test.tsx
@@ -0,0 +1,165 @@
+import { render, screen, waitFor, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { HttpResponse, http } from 'msw';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { server } from '@/setup-tests/server';
+import { Role } from '@/portainer/users/types';
+import { createMockUsers } from '@/react-tools/test-mocks';
+
+import { ConfigViewModel } from '../../model';
+
+import { DeleteConfigButton } from './DeleteConfigButton';
+
+vi.mock('@uirouter/react', async (importOriginal: () => Promise<object>) => ({
+  ...(await importOriginal()),
+  useCurrentStateAndParams: vi.fn(() => ({
+    params: { endpointId: '1' },
+  })),
+}));
+
+beforeEach(() => {
+  server.use(
+    http.get('/api/endpoints/1', () =>
+      HttpResponse.json({
+        Id: 1,
+        Name: 'test-environment',
+        Type: 1,
+      })
+    )
+  );
+});
+
+afterEach(() => {
+  // Clean up any portal elements (modals) that may have been left behind
+  document.body.querySelectorAll('reach-portal').forEach((el) => el.remove());
+});
+
+it('should render disabled when no items selected', () => {
+  renderComponent([]);
+
+  const button = screen.getByRole('button', { name: /remove/i });
+  expect(button).toBeVisible();
+  expect(button).toBeDisabled();
+});
+
+it('should render enabled with selected items', () => {
+  const selectedItems = [createMockConfigViewModel({ Id: 'config-1' })];
+
+  renderComponent(selectedItems);
+
+  const button = screen.getByRole('button', { name: /remove/i });
+  expect(button).toBeVisible();
+  expect(button).toBeEnabled();
+});
+
+it('should show confirmation dialog on click', async () => {
+  const user = userEvent.setup();
+  const selectedItems = [createMockConfigViewModel({ Id: 'config-1' })];
+
+  renderComponent(selectedItems);
+
+  const button = screen.getByRole('button', { name: /remove/i });
+  await user.click(button);
+
+  await waitFor(() => {
+    expect(
+      screen.getByText('Do you want to remove the selected config(s)?')
+    ).toBeVisible();
+  });
+});
+
+it('should call delete API for each selected config on confirm', async () => {
+  const user = userEvent.setup();
+  const deletedConfigIds: string[] = [];
+
+  server.use(
+    http.delete(
+      '/api/endpoints/:environmentId/docker/configs/:configId',
+      ({ params }) => {
+        deletedConfigIds.push(params.configId as string);
+        return HttpResponse.json({});
+      }
+    )
+  );
+
+  const selectedItems = [
+    createMockConfigViewModel({ Id: 'config-1' }),
+    createMockConfigViewModel({ Id: 'config-2' }),
+  ];
+
+  renderComponent(selectedItems);
+
+  await user.click(screen.getByRole('button', { name: /remove/i }));
+
+  const dialog = await screen.findByRole('dialog', { name: 'Are you sure?' });
+  await user.click(within(dialog).getByRole('button', { name: /remove/i }));
+
+  await waitFor(() => {
+    expect(deletedConfigIds).toContain('config-1');
+    expect(deletedConfigIds).toContain('config-2');
+  });
+});
+
+it('should not call delete API when cancel is clicked', async () => {
+  const user = userEvent.setup();
+  let deleteCallCount = 0;
+
+  server.use(
+    http.delete(
+      '/api/endpoints/:environmentId/docker/configs/:configId',
+      () => {
+        deleteCallCount += 1;
+        return HttpResponse.json({});
+      }
+    )
+  );
+
+  const selectedItems = [createMockConfigViewModel({ Id: 'config-1' })];
+
+  renderComponent(selectedItems);
+
+  await user.click(screen.getByRole('button', { name: /remove/i }));
+
+  const dialog = await screen.findByRole('dialog', { name: 'Are you sure?' });
+  await user.click(within(dialog).getByRole('button', { name: /cancel/i }));
+
+  // Wait a bit to ensure no API call was made
+  await new Promise((resolve) => {
+    setTimeout(resolve, 100);
+  });
+
+  expect(deleteCallCount).toBe(0);
+});
+
+function createMockConfigViewModel(
+  overrides: Partial<ConfigViewModel> = {}
+): ConfigViewModel {
+  return {
+    Id: 'config-id-1',
+    Name: 'test-config',
+    CreatedAt: '2024-01-15T10:30:00.000000000Z',
+    UpdatedAt: '2024-01-15T10:30:00.000000000Z',
+    Version: 1,
+    Labels: {},
+    Data: 'config data',
+    ...overrides,
+  } as ConfigViewModel;
+}
+
+function renderComponent(selectedItems: ConfigViewModel[] = []) {
+  const user = createMockUsers(1, Role.Admin)[0];
+
+  const Wrapped = withTestQueryProvider(
+    withUserProvider(
+      withTestRouter(() => (
+        <DeleteConfigButton selectedItems={selectedItems} />
+      )),
+      user
+    )
+  );
+
+  return render(<Wrapped />);
+}
diff --git a/app/react/docker/configs/ListView/ConfigsDatatable/DeleteConfigButton.tsx b/app/react/docker/configs/ListView/ConfigsDatatable/DeleteConfigButton.tsx
new file mode 100644
index 0000000..569256d
--- /dev/null
+++ b/app/react/docker/configs/ListView/ConfigsDatatable/DeleteConfigButton.tsx
@@ -0,0 +1,60 @@
+import { useQueryClient, useMutation } from '@tanstack/react-query';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { promiseSequence } from '@/portainer/helpers/promise-utils';
+import { withError, withInvalidate } from '@/react-tools/react-query';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { notifySuccess } from '@/portainer/services/notifications';
+import { pluralize } from '@/portainer/helpers/strings';
+
+import { DeleteButton } from '@@/buttons/DeleteButton';
+
+import { ConfigViewModel } from '../../model';
+import { queryKeys } from '../../queries/query-keys';
+import { deleteConfig } from '../../queries/useDeleteConfigMutation';
+
+export function DeleteConfigButton({
+  selectedItems,
+}: {
+  selectedItems: Array<ConfigViewModel>;
+}) {
+  const environmentId = useEnvironmentId();
+  const mutation = useDeleteConfigListMutation(environmentId);
+
+  return (
+    <DeleteButton
+      data-cy="remove-docker-configs-button"
+      onConfirmed={() => {
+        mutation.mutate(
+          selectedItems.map((item) => item.Id),
+          {
+            onSuccess() {
+              notifySuccess(
+                `${pluralize(
+                  selectedItems.length,
+                  'Config'
+                )} successfully removed`,
+                // log the item name if it's only one config
+                selectedItems.length === 1 ? selectedItems[0].Name : ''
+              );
+            },
+          }
+        );
+      }}
+      confirmMessage="Do you want to remove the selected config(s)?"
+      disabled={selectedItems.length === 0}
+    />
+  );
+}
+
+function useDeleteConfigListMutation(environmentId: EnvironmentId) {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: (ids: Array<string>) =>
+      promiseSequence(
+        ids.map((configId) => () => deleteConfig({ environmentId, configId }))
+      ),
+    ...withError('Unable to remove configs'),
+    ...withInvalidate(queryClient, [queryKeys.base(environmentId)]),
+  });
+}
diff --git a/app/react/docker/configs/ListView/ConfigsDatatable/columns.tsx b/app/react/docker/configs/ListView/ConfigsDatatable/columns.tsx
new file mode 100644
index 0000000..86e3fb6
--- /dev/null
+++ b/app/react/docker/configs/ListView/ConfigsDatatable/columns.tsx
@@ -0,0 +1,26 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { isoDate } from '@/portainer/filters/filters';
+import { createOwnershipColumn } from '@/react/docker/components/datatable/createOwnershipColumn';
+
+import { buildNameColumnFromObject } from '@@/datatables/buildNameColumn';
+
+import { ConfigViewModel } from '../../model';
+
+const columnHelper = createColumnHelper<ConfigViewModel>();
+
+export const columns = [
+  buildNameColumnFromObject<ConfigViewModel>({
+    nameKey: 'Name',
+    path: 'docker.configs.config',
+    dataCy: 'docker-configs-name',
+  }),
+  columnHelper.accessor('CreatedAt', {
+    header: 'Creation Date',
+    cell: ({ getValue }) => {
+      const date = getValue();
+      return <time dateTime={date}>{isoDate(date)}</time>;
+    },
+  }),
+  createOwnershipColumn<ConfigViewModel>(),
+];
diff --git a/app/react/docker/configs/ListView/ConfigsDatatable/store.ts b/app/react/docker/configs/ListView/ConfigsDatatable/store.ts
new file mode 100644
index 0000000..95a649f
--- /dev/null
+++ b/app/react/docker/configs/ListView/ConfigsDatatable/store.ts
@@ -0,0 +1,15 @@
+import {
+  createPersistedStore,
+  refreshableSettings,
+  TableSettingsWithRefreshable,
+} from '@@/datatables/types';
+
+export function createStore(storageKey: string) {
+  return createPersistedStore<TableSettingsWithRefreshable>(
+    storageKey,
+    'name',
+    (set) => ({
+      ...refreshableSettings(set),
+    })
+  );
+}
diff --git a/app/react/docker/configs/ListView/ListView.test.tsx b/app/react/docker/configs/ListView/ListView.test.tsx
new file mode 100644
index 0000000..812007a
--- /dev/null
+++ b/app/react/docker/configs/ListView/ListView.test.tsx
@@ -0,0 +1,70 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import { HttpResponse, http } from 'msw';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { server } from '@/setup-tests/server';
+import { Role } from '@/portainer/users/types';
+import { createMockUsers } from '@/react-tools/test-mocks';
+
+import { ListView } from './ListView';
+
+vi.mock('@uirouter/react', async (importOriginal: () => Promise<object>) => ({
+  ...(await importOriginal()),
+  useCurrentStateAndParams: vi.fn(() => ({
+    params: { endpointId: '1' },
+  })),
+}));
+
+vi.mock('@@/Link', () => ({
+  Link: ({
+    children,
+    'data-cy': dataCy,
+  }: {
+    children: React.ReactNode;
+    'data-cy'?: string;
+  }) => (
+    // eslint-disable-next-line jsx-a11y/anchor-is-valid
+    <a data-cy={dataCy}>{children}</a>
+  ),
+}));
+
+function renderComponent() {
+  const user = createMockUsers(1, Role.Admin)[0];
+
+  const Wrapped = withTestQueryProvider(
+    withUserProvider(withTestRouter(ListView), user)
+  );
+
+  return render(<Wrapped />);
+}
+
+describe('ListView', () => {
+  beforeEach(() => {
+    server.use(
+      http.get('/api/endpoints/1', () =>
+        HttpResponse.json({
+          Id: 1,
+          Name: 'test-environment',
+          Type: 1,
+        })
+      ),
+      http.get('/api/endpoints/:environmentId/docker/configs', () =>
+        HttpResponse.json([])
+      )
+    );
+  });
+
+  it('should render correctly', async () => {
+    renderComponent();
+
+    await waitFor(() => {
+      expect(screen.getByRole('region', { name: 'Configs' })).toBeVisible();
+    });
+
+    expect(
+      screen.getByRole('heading', { name: 'Configs list', level: 1 })
+    ).toBeVisible();
+  });
+});
diff --git a/app/react/docker/configs/ListView/ListView.tsx b/app/react/docker/configs/ListView/ListView.tsx
new file mode 100644
index 0000000..ea7f64c
--- /dev/null
+++ b/app/react/docker/configs/ListView/ListView.tsx
@@ -0,0 +1,13 @@
+import { PageHeader } from '@@/PageHeader';
+
+import { ConfigsDatatable } from './ConfigsDatatable/ConfigsDatatable';
+
+export function ListView() {
+  return (
+    <>
+      <PageHeader title="Configs list" breadcrumbs="Configs" reload />
+
+      <ConfigsDatatable />
+    </>
+  );
+}
diff --git a/app/react/docker/configs/model.ts b/app/react/docker/configs/model.ts
new file mode 100644
index 0000000..d37e89f
--- /dev/null
+++ b/app/react/docker/configs/model.ts
@@ -0,0 +1,55 @@
+import { Config } from 'docker-types';
+
+import { PortainerResponse } from '@/react/docker/types';
+import { ResourceControlViewModel } from '@/react/portainer/access-control/models/ResourceControlViewModel';
+
+import { IResource } from '../components/datatable/createOwnershipColumn';
+
+export class ConfigViewModel implements IResource {
+  Id: string;
+
+  CreatedAt: string;
+
+  UpdatedAt: string;
+
+  Version: number;
+
+  Name: string;
+
+  Labels: Record<string, string>;
+
+  Data: string;
+
+  ResourceControl?: ResourceControlViewModel;
+
+  constructor(data: PortainerResponse<Config>) {
+    this.Id = data.ID || '';
+    this.CreatedAt = data.CreatedAt || '';
+    this.UpdatedAt = data.UpdatedAt || '';
+    this.Version = data.Version?.Index || 0;
+    this.Name = data.Spec?.Name || '';
+    this.Labels = data.Spec?.Labels || {};
+    this.Data = b64DecodeUnicode(data.Spec?.Data || '');
+
+    if (data.Portainer && data.Portainer.ResourceControl) {
+      this.ResourceControl = new ResourceControlViewModel(
+        data.Portainer.ResourceControl
+      );
+    }
+  }
+}
+
+function b64DecodeUnicode(str: string) {
+  try {
+    return decodeURIComponent(
+      window
+        .atob(str)
+        .toString()
+        .split('')
+        .map((c) => `%${`00${c.charCodeAt(0).toString(16)}`.slice(-2)}`)
+        .join('')
+    );
+  } catch (err) {
+    return window.atob(str);
+  }
+}
diff --git a/app/react/docker/configs/queries/build-url.ts b/app/react/docker/configs/queries/build-url.ts
new file mode 100644
index 0000000..5a14b51
--- /dev/null
+++ b/app/react/docker/configs/queries/build-url.ts
@@ -0,0 +1,6 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { buildDockerProxyUrl } from '@/react/docker/proxy/queries/buildDockerProxyUrl';
+
+export function buildUrl(environmentId: EnvironmentId, id = '', action = '') {
+  return buildDockerProxyUrl(environmentId, 'configs', id, action);
+}
diff --git a/app/react/docker/configs/queries/query-keys.ts b/app/react/docker/configs/queries/query-keys.ts
new file mode 100644
index 0000000..395ff80
--- /dev/null
+++ b/app/react/docker/configs/queries/query-keys.ts
@@ -0,0 +1,8 @@
+import { queryKeys as proxyQueryKeys } from '@/react/docker/proxy/queries/query-keys';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+export const queryKeys = {
+  base: (environmentId: EnvironmentId) =>
+    [...proxyQueryKeys.base(environmentId), 'configs'] as const,
+  list: (environmentId: EnvironmentId) => queryKeys.base(environmentId),
+};
diff --git a/app/react/docker/configs/queries/useConfig.ts b/app/react/docker/configs/queries/useConfig.ts
new file mode 100644
index 0000000..b2b7f7b
--- /dev/null
+++ b/app/react/docker/configs/queries/useConfig.ts
@@ -0,0 +1,22 @@
+import { Config } from 'docker-types';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { PortainerResponse } from '../../types';
+
+import { buildUrl } from './build-url';
+
+export async function getConfig(
+  environmentId: EnvironmentId,
+  configId: Config['ID']
+) {
+  try {
+    const { data } = await axios.get<PortainerResponse<Config>>(
+      buildUrl(environmentId, configId)
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to retrieve config');
+  }
+}
diff --git a/app/react/docker/configs/queries/useConfigs.ts b/app/react/docker/configs/queries/useConfigs.ts
new file mode 100644
index 0000000..25ddb35
--- /dev/null
+++ b/app/react/docker/configs/queries/useConfigs.ts
@@ -0,0 +1,37 @@
+import { Config } from 'docker-types';
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { withError } from '@/react-tools/react-query';
+
+import { buildDockerProxyUrl } from '../../proxy/queries/buildDockerProxyUrl';
+
+import { queryKeys } from './query-keys';
+
+export function useConfigsList<T>(
+  environmentId: EnvironmentId,
+  {
+    refetchInterval,
+    select,
+  }: { refetchInterval?: number; select?: (configs: Config[]) => T } = {}
+) {
+  return useQuery({
+    queryKey: queryKeys.list(environmentId),
+    queryFn: () => getConfigs(environmentId),
+    refetchInterval,
+    select,
+    ...withError('Unable to retrieve configs'),
+  });
+}
+
+export async function getConfigs(environmentId: EnvironmentId) {
+  try {
+    const { data } = await axios.get<Config[]>(
+      buildDockerProxyUrl(environmentId, 'configs')
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to retrieve configs');
+  }
+}
diff --git a/app/react/docker/configs/queries/useCreateConfigMutation.ts b/app/react/docker/configs/queries/useCreateConfigMutation.ts
new file mode 100644
index 0000000..165bfd4
--- /dev/null
+++ b/app/react/docker/configs/queries/useCreateConfigMutation.ts
@@ -0,0 +1,22 @@
+import { ConfigSpec } from 'docker-types';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { buildDockerProxyUrl } from '../../proxy/queries/buildDockerProxyUrl';
+import { PortainerResponse } from '../../types';
+
+export async function createConfig(
+  environmentId: EnvironmentId,
+  config: ConfigSpec
+) {
+  try {
+    const { data } = await axios.post<PortainerResponse<{ Id: string }>>(
+      buildDockerProxyUrl(environmentId, 'configs', 'create'),
+      config
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to create config');
+  }
+}
diff --git a/app/react/docker/configs/queries/useDeleteConfigMutation.ts b/app/react/docker/configs/queries/useDeleteConfigMutation.ts
new file mode 100644
index 0000000..739d867
--- /dev/null
+++ b/app/react/docker/configs/queries/useDeleteConfigMutation.ts
@@ -0,0 +1,26 @@
+import { useMutation } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { buildUrl } from './build-url';
+
+export function useDeleteConfigMutation() {
+  return useMutation({
+    mutationFn: deleteConfig,
+  });
+}
+
+export async function deleteConfig({
+  environmentId,
+  configId,
+}: {
+  environmentId: EnvironmentId;
+  configId: string;
+}) {
+  try {
+    await axios.delete(buildUrl(environmentId, configId));
+  } catch (err) {
+    throw parseAxiosError(err, 'Unable to delete config');
+  }
+}
diff --git a/app/react/docker/configs/types.ts b/app/react/docker/configs/types.ts
new file mode 100644
index 0000000..489fd3b
--- /dev/null
+++ b/app/react/docker/configs/types.ts
@@ -0,0 +1,8 @@
+import { ResourceControlViewModel } from '@/react/portainer/access-control/models/ResourceControlViewModel';
+
+export type DockerConfig = {
+  Id: string;
+  Name: string;
+  CreatedAt: string;
+  ResourceControl?: ResourceControlViewModel;
+};
diff --git a/app/react/docker/containers/ConsoleAttachView/.keep b/app/react/docker/containers/ConsoleAttachView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/docker/containers/ConsoleExecView/.keep b/app/react/docker/containers/ConsoleExecView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/docker/containers/CreateView/BaseForm/BaseForm.tsx b/app/react/docker/containers/CreateView/BaseForm/BaseForm.tsx
new file mode 100644
index 0000000..33e00f9
--- /dev/null
+++ b/app/react/docker/containers/CreateView/BaseForm/BaseForm.tsx
@@ -0,0 +1,204 @@
+import { useFormikContext } from 'formik';
+
+import { useCurrentEnvironment } from '@/react/hooks/useCurrentEnvironment';
+import { Authorized } from '@/react/hooks/useUser';
+import { AccessControlForm } from '@/react/portainer/access-control';
+import { AccessControlFormData } from '@/react/portainer/access-control/types';
+import { EnvironmentType } from '@/react/portainer/environments/types';
+import { NodeSelector } from '@/react/docker/agent/NodeSelector';
+import { useIsSwarm } from '@/react/docker/proxy/queries/useInfo';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { isAgentEnvironment } from '@/react/portainer/environments/utils';
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+
+import { FormSection } from '@@/form-components/FormSection';
+import { SwitchField } from '@@/form-components/SwitchField';
+import { ImageConfigFieldset, ImageConfigValues } from '@@/ImageConfigFieldset';
+import { LoadingButton } from '@@/buttons';
+import { Widget } from '@@/Widget';
+
+import {
+  PortsMappingField,
+  Values as PortMappingValue,
+} from './PortsMappingField';
+import { NameField } from './NameField';
+
+export interface Values {
+  name: string;
+  enableWebhook: boolean;
+  publishAllPorts: boolean;
+  image: ImageConfigValues;
+  alwaysPull: boolean;
+  ports: PortMappingValue;
+  accessControl: AccessControlFormData;
+  nodeName: string;
+  autoRemove: boolean;
+}
+
+function useIsAgentOnSwarm() {
+  const environmentId = useEnvironmentId();
+  const environmentQuery = useCurrentEnvironment();
+
+  const isSwarm = useIsSwarm(environmentId);
+
+  return (
+    !!environmentQuery.data &&
+    isAgentEnvironment(environmentQuery.data?.Type) &&
+    isSwarm
+  );
+}
+
+export function BaseForm({
+  isLoading,
+  onChangeName,
+  onChangeImageName,
+  onRateLimit,
+}: {
+  isLoading: boolean;
+  onChangeName: (value: string) => void;
+  onChangeImageName: () => void;
+  onRateLimit: (limited?: boolean) => void;
+}) {
+  const { setFieldValue, values, errors, isValid } = useFormikContext<Values>();
+  const environmentQuery = useCurrentEnvironment();
+  const isAgentOnSwarm = useIsAgentOnSwarm();
+  if (!environmentQuery.data) {
+    return null;
+  }
+
+  const environment = environmentQuery.data;
+
+  const canUseWebhook = environment.Type !== EnvironmentType.EdgeAgentOnDocker;
+
+  return (
+    <Widget>
+      <Widget.Body>
+        <NameField
+          value={values.name}
+          onChange={(name) => {
+            setFieldValue('name', name);
+            onChangeName(name);
+          }}
+          error={errors?.name}
+        />
+
+        <FormSection title="Image Configuration">
+          <ImageConfigFieldset
+            values={values.image}
+            setFieldValue={(field, value) =>
+              setFieldValue(`image.${field}`, value)
+            }
+            autoComplete
+            onRateLimit={values.alwaysPull ? onRateLimit : undefined}
+            errors={errors?.image}
+            onChangeImage={onChangeImageName}
+          >
+            <div className="form-group">
+              <div className="col-sm-12">
+                <SwitchField
+                  label="Always pull the image"
+                  tooltip="When enabled, Portainer will automatically try to pull the specified image before creating the container."
+                  checked={values.alwaysPull}
+                  onChange={(alwaysPull) =>
+                    setFieldValue('alwaysPull', alwaysPull)
+                  }
+                  labelClass="col-sm-3 col-lg-2"
+                  data-cy="always-pull-switch"
+                />
+              </div>
+            </div>
+          </ImageConfigFieldset>
+        </FormSection>
+
+        {canUseWebhook && (
+          <Authorized authorizations="PortainerWebhookCreate" adminOnlyCE>
+            <FormSection title="Webhook">
+              <div className="form-group">
+                <div className="col-sm-12">
+                  <SwitchField
+                    label="Create a container webhook"
+                    data-cy="container-webhook-switch"
+                    tooltip="Create a webhook (or callback URI) to automate the recreate this container. Sending a POST request to this callback URI (without requiring any authentication) will pull the most up-to-date version of the associated image and recreate this container."
+                    checked={values.enableWebhook}
+                    onChange={(enableWebhook) =>
+                      setFieldValue('enableWebhook', enableWebhook)
+                    }
+                    featureId={FeatureId.CONTAINER_WEBHOOK}
+                    labelClass="col-sm-3 col-lg-2"
+                  />
+                </div>
+              </div>
+            </FormSection>
+          </Authorized>
+        )}
+
+        <FormSection title="Network ports configuration">
+          <div className="form-group">
+            <div className="col-sm-12">
+              <SwitchField
+                label="Publish all exposed ports to random host ports"
+                data-cy="publish-all-ports-switch"
+                tooltip="When enabled, Portainer will let Docker automatically map a random port on the host to each one defined in the image Dockerfile."
+                checked={values.publishAllPorts}
+                onChange={(publishAllPorts) =>
+                  setFieldValue('publishAllPorts', publishAllPorts)
+                }
+                labelClass="col-sm-3 col-lg-2"
+              />
+            </div>
+          </div>
+
+          <PortsMappingField
+            value={values.ports}
+            onChange={(ports) => setFieldValue('ports', ports)}
+            errors={errors?.ports}
+          />
+        </FormSection>
+
+        {isAgentOnSwarm && (
+          <FormSection title="Deployment">
+            <NodeSelector
+              value={values.nodeName}
+              onChange={(nodeName) => setFieldValue('nodeName', nodeName)}
+            />
+          </FormSection>
+        )}
+
+        <AccessControlForm
+          onChange={(accessControl) =>
+            setFieldValue('accessControl', accessControl)
+          }
+          errors={errors?.accessControl}
+          values={values.accessControl}
+          environmentId={environment.Id}
+        />
+
+        <div className="form-group">
+          <div className="col-sm-12">
+            <SwitchField
+              label="Auto remove"
+              data-cy="container-auto-remove-switch"
+              tooltip="When enabled, Portainer will automatically remove the container when it exits. This is useful when you want to use the container only once."
+              checked={values.autoRemove}
+              onChange={(autoRemove) => setFieldValue('autoRemove', autoRemove)}
+              labelClass="col-sm-3 col-lg-2"
+            />
+          </div>
+        </div>
+
+        <div className="form-group">
+          <div className="col-sm-12">
+            <LoadingButton
+              loadingText="Deployment in progress..."
+              data-cy="deploy-container-button"
+              isLoading={isLoading}
+              disabled={!isValid}
+            >
+              Deploy the container
+            </LoadingButton>
+          </div>
+        </div>
+      </Widget.Body>
+    </Widget>
+  );
+}
diff --git a/app/react/docker/containers/CreateView/BaseForm/NameField.tsx b/app/react/docker/containers/CreateView/BaseForm/NameField.tsx
new file mode 100644
index 0000000..605e7be
--- /dev/null
+++ b/app/react/docker/containers/CreateView/BaseForm/NameField.tsx
@@ -0,0 +1,32 @@
+import { string } from 'yup';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+
+export function NameField({
+  value,
+  error,
+  onChange,
+}: {
+  value: string;
+  error?: string;
+  onChange: (value: string) => void;
+}) {
+  return (
+    <FormControl label="Name" inputId="name-input" errors={error}>
+      <Input
+        id="name-input"
+        value={value}
+        onChange={(e) => {
+          onChange(e.target.value);
+        }}
+        placeholder="e.g. myContainer"
+        data-cy="container-name-input"
+      />
+    </FormControl>
+  );
+}
+
+export function nameValidation() {
+  return string().default('');
+}
diff --git a/app/react/docker/containers/CreateView/BaseForm/PortsMappingField.requestModel.ts b/app/react/docker/containers/CreateView/BaseForm/PortsMappingField.requestModel.ts
new file mode 100644
index 0000000..9208700
--- /dev/null
+++ b/app/react/docker/containers/CreateView/BaseForm/PortsMappingField.requestModel.ts
@@ -0,0 +1,128 @@
+import { PortMap } from 'docker-types';
+import _ from 'lodash';
+
+import { PortMapping, Protocol, Values } from './PortsMappingField';
+import { Range } from './PortsMappingField.viewModel';
+
+type PortKey = `${string}/${Protocol}`;
+
+export function parsePortBindingRequest(portBindings: Values): PortMap {
+  const bindings: Record<
+    PortKey,
+    Array<{ HostIp?: string; HostPort?: string }>
+  > = {};
+  _.forEach(portBindings, (portBinding) => {
+    if (!portBinding.containerPort) {
+      return;
+    }
+
+    const portInfo = extractPortInfo(portBinding);
+
+    let { hostPort } = portBinding;
+    const { endHostPort, endPort, hostIp, startHostPort, startPort } = portInfo;
+    _.range(startPort, endPort + 1).forEach((containerPort) => {
+      const bindKey: PortKey = `${containerPort}/${portBinding.protocol}`;
+      if (!bindings[bindKey]) {
+        bindings[bindKey] = [];
+      }
+
+      if (startHostPort > 0) {
+        hostPort = (startHostPort + containerPort - startPort).toString();
+      }
+      if (startPort === endPort && startHostPort !== endHostPort) {
+        hostPort += `-${endHostPort.toString()}`;
+      }
+
+      bindings[bindKey].push(
+        hostIp || hostPort ? { HostIp: hostIp, HostPort: hostPort } : {}
+      );
+    });
+  });
+  return bindings;
+}
+
+function isValidPortRange(portRange: Range) {
+  return portRange.start > 0 && portRange.end >= portRange.start;
+}
+
+function parsePortRange(portRange: string | number): Range {
+  // Make sure we have a string
+  const portRangeString = portRange.toString();
+
+  // Split the range and convert to integers
+  const stringPorts = _.split(portRangeString, '-', 2);
+  const intPorts = _.map(stringPorts, parsePort);
+
+  return {
+    start: intPorts[0],
+    end: intPorts[1] || intPorts[0],
+  };
+}
+
+const portPattern =
+  /^([1-9]|[1-5]?[0-9]{2,4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$/m;
+
+function parsePort(port: string) {
+  if (portPattern.test(port)) {
+    return parseInt(port, 10);
+  }
+
+  return 0;
+}
+
+function extractPortInfo(portBinding: PortMapping): {
+  startPort: number;
+  endPort: number;
+  hostIp: string;
+  startHostPort: number;
+  endHostPort: number;
+} {
+  const containerPortRange = parsePortRange(portBinding.containerPort);
+  if (!isValidPortRange(containerPortRange)) {
+    throw new Error(`Invalid port specification: ${portBinding.containerPort}`);
+  }
+
+  const startPort = containerPortRange.start;
+  const endPort = containerPortRange.end;
+  let hostIp = '';
+  let { hostPort } = portBinding;
+  if (!hostPort) {
+    return {
+      startPort,
+      endPort,
+      hostIp: '',
+      startHostPort: 0,
+      endHostPort: 0,
+    };
+  }
+
+  if (hostPort.includes('[')) {
+    const hostAndPort = _.split(hostPort, ']:');
+
+    if (hostAndPort.length < 2) {
+      throw new Error(
+        `Invalid port specification: ${portBinding.containerPort}`
+      );
+    }
+
+    hostIp = hostAndPort[0].replace('[', '');
+    [, hostPort] = hostAndPort;
+  } else if (hostPort.includes(':')) {
+    [hostIp, hostPort] = _.split(hostPort, ':');
+  }
+
+  const hostPortRange = parsePortRange(hostPort);
+  if (!isValidPortRange(hostPortRange)) {
+    throw new Error(`Invalid port specification: ${hostPort}`);
+  }
+
+  const { start: startHostPort, end: endHostPort } = hostPortRange;
+  if (
+    endPort !== startPort &&
+    endPort - startPort !== endHostPort - startHostPort
+  ) {
+    throw new Error(`Invalid port specification: ${hostPort}`);
+  }
+
+  return { startPort, endPort, hostIp, startHostPort, endHostPort };
+}
diff --git a/app/react/docker/containers/CreateView/BaseForm/PortsMappingField.tsx b/app/react/docker/containers/CreateView/BaseForm/PortsMappingField.tsx
new file mode 100644
index 0000000..cbf3347
--- /dev/null
+++ b/app/react/docker/containers/CreateView/BaseForm/PortsMappingField.tsx
@@ -0,0 +1,123 @@
+import { FormikErrors } from 'formik';
+import { ArrowRight } from 'lucide-react';
+
+import { ButtonSelector } from '@@/form-components/ButtonSelector/ButtonSelector';
+import { FormError } from '@@/form-components/FormError';
+import { InputList } from '@@/form-components/InputList';
+import { ItemProps } from '@@/form-components/InputList/InputList';
+import { Icon } from '@@/Icon';
+import { InputLabeled } from '@@/form-components/Input/InputLabeled';
+
+export type Protocol = 'tcp' | 'udp';
+
+export interface PortMapping {
+  hostPort: string;
+  protocol: Protocol;
+  containerPort: string;
+}
+
+export type Values = Array<PortMapping>;
+
+interface Props {
+  value: Values;
+  onChange?(value: Values): void;
+  errors?: FormikErrors<PortMapping>[] | string | string[];
+  disabled?: boolean;
+  readOnly?: boolean;
+}
+
+export function PortsMappingField({
+  value,
+  onChange = () => {},
+  errors,
+  disabled,
+  readOnly,
+}: Props) {
+  return (
+    <>
+      <InputList<PortMapping>
+        label="Port mapping"
+        value={value}
+        onChange={onChange}
+        addLabel="Map additional port"
+        itemBuilder={() => ({
+          hostPort: '',
+          containerPort: '',
+          protocol: 'tcp',
+        })}
+        item={Item}
+        errors={errors}
+        disabled={disabled}
+        readOnly={readOnly}
+        tooltip="When a range of ports on the host and a single port on the container is specified, Docker will randomly choose a single available port in the defined range and forward that to the container port."
+        data-cy="docker-containers-ports-mapping"
+      />
+      {typeof errors === 'string' && (
+        <div className="form-group col-md-12">
+          <FormError>{errors}</FormError>
+        </div>
+      )}
+    </>
+  );
+}
+
+function Item({
+  onChange,
+  item,
+  error,
+  disabled,
+  readOnly,
+  index,
+}: ItemProps<PortMapping>) {
+  return (
+    <div className="flex flex-col">
+      <div className="flex items-center gap-2">
+        <InputLabeled
+          size="small"
+          data-cy={`hostPort-${index}`}
+          disabled={disabled}
+          readOnly={readOnly}
+          value={item.hostPort}
+          onChange={(e) => handleChange('hostPort', e.target.value)}
+          label="Host"
+          placeholder="e.g. 80"
+          className="w-1/2"
+          id={`hostPort-${index}`}
+        />
+
+        <span className="mx-3">
+          <Icon icon={ArrowRight} />
+        </span>
+
+        <InputLabeled
+          size="small"
+          disabled={disabled}
+          readOnly={readOnly}
+          value={item.containerPort}
+          onChange={(e) => handleChange('containerPort', e.target.value)}
+          label="Container"
+          placeholder="e.g. 80"
+          className="w-1/2"
+          id={`containerPort-${index}`}
+          data-cy={`containerPort-${index}`}
+        />
+
+        <ButtonSelector<Protocol>
+          onChange={(value) => handleChange('protocol', value)}
+          value={item.protocol}
+          options={[
+            { value: 'tcp', label: 'TCP' },
+            { value: 'udp', label: 'UDP' },
+          ]}
+          disabled={disabled}
+          readOnly={readOnly}
+        />
+      </div>
+      {!!error && <FormError>{Object.values(error)[0]}</FormError>}
+    </div>
+  );
+
+  function handleChange(name: keyof PortMapping, value: string) {
+    onChange({ ...item, [name]: value });
+  }
+}
diff --git a/app/react/docker/containers/CreateView/BaseForm/PortsMappingField.validation.ts b/app/react/docker/containers/CreateView/BaseForm/PortsMappingField.validation.ts
new file mode 100644
index 0000000..1529b9c
--- /dev/null
+++ b/app/react/docker/containers/CreateView/BaseForm/PortsMappingField.validation.ts
@@ -0,0 +1,13 @@
+import { array, mixed, object, SchemaOf, string } from 'yup';
+
+import { Values } from './PortsMappingField';
+
+export function validationSchema(): SchemaOf<Values> {
+  return array(
+    object({
+      hostPort: string().default(''),
+      containerPort: string().required('container is required'),
+      protocol: mixed().oneOf(['tcp', 'udp']),
+    })
+  );
+}
diff --git a/app/react/docker/containers/CreateView/BaseForm/PortsMappingField.viewModel.test.ts b/app/react/docker/containers/CreateView/BaseForm/PortsMappingField.viewModel.test.ts
new file mode 100644
index 0000000..2c9b8da
--- /dev/null
+++ b/app/react/docker/containers/CreateView/BaseForm/PortsMappingField.viewModel.test.ts
@@ -0,0 +1,139 @@
+import { toViewModel } from './PortsMappingField.viewModel';
+
+test('basic', () => {
+  expect(
+    toViewModel({
+      '22/tcp': [
+        {
+          HostIp: '',
+          HostPort: '222',
+        },
+      ],
+      '3000/tcp': [
+        {
+          HostIp: '',
+          HostPort: '3000',
+        },
+      ],
+    })
+  ).toStrictEqual([
+    {
+      hostPort: '222',
+      containerPort: '22',
+      protocol: 'tcp',
+    },
+    {
+      hostPort: '3000',
+      containerPort: '3000',
+      protocol: 'tcp',
+    },
+  ]);
+});
+
+test('already combined', () => {
+  expect(
+    toViewModel({
+      '80/tcp': [
+        {
+          HostIp: '',
+          HostPort: '7000-7999',
+        },
+      ],
+    })
+  ).toStrictEqual([
+    {
+      hostPort: '7000-7999',
+      containerPort: '80',
+      protocol: 'tcp',
+    },
+  ]);
+});
+
+test('simple combine ports', () => {
+  expect(
+    toViewModel({
+      '81/tcp': [
+        {
+          HostIp: '',
+          HostPort: '81',
+        },
+      ],
+      '82/tcp': [
+        {
+          HostIp: '',
+          HostPort: '82',
+        },
+      ],
+    })
+  ).toStrictEqual([
+    {
+      hostPort: '81-82',
+      containerPort: '81-82',
+      protocol: 'tcp',
+    },
+  ]);
+});
+
+test('combine and sort', () => {
+  expect(
+    toViewModel({
+      '3244/tcp': [
+        {
+          HostIp: '',
+          HostPort: '105',
+        },
+      ],
+      '3245/tcp': [
+        {
+          HostIp: '',
+          HostPort: '106',
+        },
+      ],
+      '81/tcp': [
+        {
+          HostIp: '',
+          HostPort: '81',
+        },
+      ],
+      '82/tcp': [
+        {
+          HostIp: '',
+          HostPort: '82',
+        },
+      ],
+      '83/tcp': [
+        {
+          HostIp: '0.0.0.0',
+          HostPort: '0',
+        },
+      ],
+      '84/tcp': [
+        {
+          HostIp: '0.0.0.0',
+          HostPort: '0',
+        },
+      ],
+    })
+  ).toStrictEqual([
+    {
+      hostPort: '81-82',
+      containerPort: '81-82',
+      protocol: 'tcp',
+    },
+    {
+      hostPort: '',
+      containerPort: '83',
+      protocol: 'tcp',
+    },
+    {
+      hostPort: '',
+      containerPort: '84',
+      protocol: 'tcp',
+    },
+    {
+      hostPort: '105-106',
+      containerPort: '3244-3245',
+      protocol: 'tcp',
+    },
+  ]);
+});
diff --git a/app/react/docker/containers/CreateView/BaseForm/PortsMappingField.viewModel.ts b/app/react/docker/containers/CreateView/BaseForm/PortsMappingField.viewModel.ts
new file mode 100644
index 0000000..cd84b70
--- /dev/null
+++ b/app/react/docker/containers/CreateView/BaseForm/PortsMappingField.viewModel.ts
@@ -0,0 +1,169 @@
+import { PortMap } from 'docker-types';
+import _ from 'lodash';
+
+import { Protocol, Values } from './PortsMappingField';
+
+export type Range = {
+  start: number;
+  end: number;
+};
+
+type StringPortBinding = {
+  hostPort: string;
+  protocol: Protocol;
+  containerPort: number;
+};
+
+type RangePortBinding = {
+  hostIp: string;
+  hostPort: Range;
+  protocol: Protocol;
+  containerPort: Range;
+};
+
+export function toViewModel(portBindings: PortMap): Values {
+  const parsedPorts = parsePorts(portBindings);
+  const sortedPorts = sortPorts(parsedPorts);
+
+  return [
+    ...sortedPorts.rangePorts.map((port) => ({
+      ...port,
+      containerPort: String(port.containerPort),
+    })),
+    ...combinePorts(sortedPorts.nonRangePorts),
+  ];
+
+  function isProtocol(value: string): value is Protocol {
+    return value === 'tcp' || value === 'udp';
+  }
+
+  function parsePorts(portBindings: PortMap): Array<StringPortBinding> {
+    return Object.entries(portBindings).flatMap(([key, bindings]) => {
+      const [containerPort, protocol] = key.split('/');
+
+      if (!isProtocol(protocol)) {
+        throw new Error(`Invalid protocol: ${protocol}`);
+      }
+
+      if (!bindings) {
+        return [];
+      }
+
+      const containerPortNumber = parseInt(containerPort, 10);
+
+      if (Number.isNaN(containerPortNumber)) {
+        throw new Error(`Invalid container port: ${containerPort}`);
+      }
+
+      return bindings.map((binding) => {
+        let port = '';
+        if (binding.HostPort) {
+          port = binding.HostPort;
+        }
+        if (binding.HostIp) {
+          port = `${binding.HostIp}:${port}`;
+        }
+
+        if (binding.HostPort?.includes('-')) {
+          // Range port
+          return {
+            hostPort: port,
+            protocol,
+            containerPort: containerPortNumber,
+          };
+        }
+        return {
+          hostPort: port,
+          protocol,
+          containerPort: containerPortNumber,
+        };
+      });
+    });
+  }
+
+  function sortPorts(ports: Array<StringPortBinding>) {
+    const rangePorts = ports.filter(isRangePortBinding);
+    const nonRangePorts = ports.filter((port) => !isRangePortBinding(port));
+
+    return {
+      rangePorts,
+      nonRangePorts: _.sortBy(nonRangePorts, [
+        'containerPort',
+        'hostPort',
+        'protocol',
+      ]),
+    };
+  }
+
+  function combinePorts(ports: Array<StringPortBinding>) {
+    return ports
+      .reduce((acc, port) => {
+        let hostIp = '';
+        let hostPort;
+        if (port.hostPort.includes(':')) {
+          const [ipStr, portStr] = port.hostPort.split(':');
+          hostIp = ipStr;
+          hostPort = parseInt(portStr || '0', 10);
+        } else {
+          hostPort = parseInt(port.hostPort || '0', 10);
+        }
+
+        const lastPort = acc[acc.length - 1];
+        if (
+          lastPort &&
+          lastPort.hostIp === hostIp &&
+          lastPort.containerPort.end === port.containerPort - 1 &&
+          lastPort.hostPort.end === hostPort - 1 &&
+          lastPort.protocol === port.protocol
+        ) {
+          lastPort.hostIp = hostIp;
+          lastPort.containerPort.end = port.containerPort;
+          lastPort.hostPort.end = hostPort;
+          return acc;
+        }
+
+        return [
+          ...acc,
+          {
+            hostIp,
+            hostPort: {
+              start: hostPort,
+              end: hostPort,
+            },
+            containerPort: {
+              start: port.containerPort,
+              end: port.containerPort,
+            },
+            protocol: port.protocol,
+          },
+        ];
+      }, [] as Array<RangePortBinding>)
+      .map(({ protocol, containerPort, hostPort, hostIp }) => ({
+        hostPort: getRange(hostPort.start, hostPort.end, hostIp),
+        containerPort: getRange(containerPort.start, containerPort.end),
+        protocol,
+      }));
+
+    function getRange(start: number, end: number, hostIp?: string): string {
+      if (start === end) {
+        if (start === 0) {
+          return '';
+        }
+
+        if (hostIp) {
+          return `${hostIp}:${start}`;
+        }
+        return start.toString();
+      }
+
+      if (hostIp) {
+        return `${hostIp}:${start}-${end}`;
+      }
+      return `${start}-${end}`;
+    }
+  }
+}
+
+function isRangePortBinding(port: StringPortBinding): boolean {
+  return port.hostPort.includes('-');
+}
diff --git a/app/react/docker/containers/CreateView/BaseForm/index.ts b/app/react/docker/containers/CreateView/BaseForm/index.ts
new file mode 100644
index 0000000..ecdc9a4
--- /dev/null
+++ b/app/react/docker/containers/CreateView/BaseForm/index.ts
@@ -0,0 +1,12 @@
+import { getDefaultViewModel, toViewModel } from './toViewModel';
+import { toRequest } from './toRequest';
+import { validation } from './validation';
+
+export { BaseForm, type Values as BaseFormValues } from './BaseForm';
+
+export const baseFormUtils = {
+  toRequest,
+  toViewModel,
+  validation,
+  getDefaultViewModel,
+};
diff --git a/app/react/docker/containers/CreateView/BaseForm/toRequest.ts b/app/react/docker/containers/CreateView/BaseForm/toRequest.ts
new file mode 100644
index 0000000..eedda1a
--- /dev/null
+++ b/app/react/docker/containers/CreateView/BaseForm/toRequest.ts
@@ -0,0 +1,24 @@
+import { CreateContainerRequest } from '../types';
+
+import { Values } from './BaseForm';
+import { parsePortBindingRequest } from './PortsMappingField.requestModel';
+
+export function toRequest(
+  oldConfig: CreateContainerRequest,
+  values: Values
+): CreateContainerRequest {
+  const bindings = parsePortBindingRequest(values.ports);
+
+  return {
+    ...oldConfig,
+    ExposedPorts: Object.fromEntries(
+      Object.keys(bindings).map((key) => [key, {}])
+    ),
+    HostConfig: {
+      ...oldConfig.HostConfig,
+      PublishAllPorts: values.publishAllPorts,
+      PortBindings: bindings,
+      AutoRemove: values.autoRemove,
+    },
+  };
+}
diff --git a/app/react/docker/containers/CreateView/BaseForm/toViewModel.ts b/app/react/docker/containers/CreateView/BaseForm/toViewModel.ts
new file mode 100644
index 0000000..293783d
--- /dev/null
+++ b/app/react/docker/containers/CreateView/BaseForm/toViewModel.ts
@@ -0,0 +1,59 @@
+import { parseAccessControlFormData } from '@/react/portainer/access-control/utils';
+import { ResourceControlOwnership } from '@/react/portainer/access-control/types';
+import { UserId } from '@/portainer/users/types';
+
+import { getDefaultImageConfig } from '@@/ImageConfigFieldset/getImageConfig';
+
+import { ContainerDetailsResponse } from '../../queries/useContainer';
+
+import { toViewModel as toPortsMappingViewModel } from './PortsMappingField.viewModel';
+import { Values } from './BaseForm';
+
+export function toViewModel(
+  config: ContainerDetailsResponse,
+  isPureAdmin: boolean,
+  currentUserId: UserId,
+  nodeName: string,
+  image: Values['image'],
+  enableWebhook: boolean
+): Values {
+  // accessControl shouldn't be copied to new container
+
+  const accessControl = parseAccessControlFormData(isPureAdmin, currentUserId);
+
+  if (config.Portainer?.ResourceControl?.Public) {
+    accessControl.ownership = ResourceControlOwnership.PUBLIC;
+  }
+
+  return {
+    accessControl,
+    name: config.Name ? config.Name.replace('/', '') : '',
+    alwaysPull: true,
+    autoRemove: config.HostConfig?.AutoRemove || false,
+    ports: toPortsMappingViewModel(config.HostConfig?.PortBindings || {}),
+    publishAllPorts: config.HostConfig?.PublishAllPorts || false,
+    nodeName,
+    image,
+    enableWebhook,
+  };
+}
+
+export function getDefaultViewModel(
+  isPureAdmin: boolean,
+  currentUserId: UserId,
+  nodeName: string
+): Values {
+  const accessControl = parseAccessControlFormData(isPureAdmin, currentUserId);
+
+  return {
+    nodeName,
+    enableWebhook: false,
+    image: getDefaultImageConfig(),
+    accessControl,
+    name: '',
+    alwaysPull: true,
+    autoRemove: false,
+    ports: [],
+    publishAllPorts: false,
+  };
+}
diff --git a/app/react/docker/containers/CreateView/BaseForm/validation.ts b/app/react/docker/containers/CreateView/BaseForm/validation.ts
new file mode 100644
index 0000000..b110e20
--- /dev/null
+++ b/app/react/docker/containers/CreateView/BaseForm/validation.ts
@@ -0,0 +1,51 @@
+import { boolean, object, SchemaOf, string } from 'yup';
+
+import { validationSchema as accessControlSchema } from '@/react/portainer/access-control/AccessControlForm/AccessControlForm.validation';
+
+import { imageConfigValidation } from '@@/ImageConfigFieldset';
+
+import { Values } from './BaseForm';
+import { validationSchema as portsSchema } from './PortsMappingField.validation';
+import { nameValidation } from './NameField';
+
+export function validation(
+  {
+    isAdmin,
+    isDuplicating,
+    isDuplicatingPortainer,
+    isDockerhubRateLimited,
+  }: {
+    isAdmin: boolean;
+    isDuplicating: boolean | undefined;
+    isDuplicatingPortainer: boolean | undefined;
+    isDockerhubRateLimited: boolean;
+  } = {
+    isAdmin: false,
+    isDuplicating: false,
+    isDuplicatingPortainer: false,
+    isDockerhubRateLimited: false,
+  }
+): SchemaOf<Values> {
+  return object({
+    name: nameValidation().test(
+      'not-duplicate-portainer',
+      () => !isDuplicatingPortainer
+    ),
+    alwaysPull: boolean()
+      .default(true)
+      .test('rate-limits', 'Rate limit exceeded', (alwaysPull: boolean) =>
+        alwaysPull ? !isDockerhubRateLimited : true
+      ),
+    accessControl: accessControlSchema(isAdmin),
+    autoRemove: boolean().default(false),
+    enableWebhook: boolean().default(false),
+    nodeName: string().default(''),
+    ports: portsSchema(),
+    publishAllPorts: boolean().default(false),
+    image: imageConfigValidation().test(
+      'duplicate-must-have-registry',
+      'Duplicate is only possible when registry is selected',
+      (value) => !isDuplicating || typeof value.registryId !== 'undefined'
+    ),
+  });
+}
diff --git a/app/react/docker/containers/CreateView/CapabilitiesTab/CapabilitiesTab.tsx b/app/react/docker/containers/CreateView/CapabilitiesTab/CapabilitiesTab.tsx
new file mode 100644
index 0000000..a2745e8
--- /dev/null
+++ b/app/react/docker/containers/CreateView/CapabilitiesTab/CapabilitiesTab.tsx
@@ -0,0 +1,40 @@
+import { FormSection } from '@@/form-components/FormSection';
+import { SwitchField } from '@@/form-components/SwitchField';
+
+import { capabilities } from './types';
+
+export type Values = string[];
+
+export function CapabilitiesTab({
+  values,
+  onChange,
+}: {
+  values: Values;
+  onChange: (values: Values) => void;
+}) {
+  return (
+    <FormSection title="Container capabilities">
+      <div className="form-group flex flex-wrap gap-y-2 px-5">
+        {capabilities.map((cap) => (
+          <div key={cap.key} className="w-1/3 text-center">
+            <SwitchField
+              labelClass="col-sm-6"
+              data-cy="docker-container-capability-switch"
+              tooltip={cap.description}
+              checked={values.includes(cap.key)}
+              label={cap.key}
+              name={`${cap.key}-capability`}
+              onChange={(value) => {
+                if (value) {
+                  onChange([...values, cap.key]);
+                } else {
+                  onChange(values.filter((v) => v !== cap.key));
+                }
+              }}
+            />
+          </div>
+        ))}
+      </div>
+    </FormSection>
+  );
+}
diff --git a/app/react/docker/containers/CreateView/CapabilitiesTab/index.ts b/app/react/docker/containers/CreateView/CapabilitiesTab/index.ts
new file mode 100644
index 0000000..8c70ca8
--- /dev/null
+++ b/app/react/docker/containers/CreateView/CapabilitiesTab/index.ts
@@ -0,0 +1,15 @@
+import { validation } from './validation';
+import { toViewModel, getDefaultViewModel } from './toViewModel';
+import { toRequest } from './toRequest';
+
+export {
+  CapabilitiesTab,
+  type Values as CapabilitiesTabValues,
+} from './CapabilitiesTab';
+
+export const capabilitiesTabUtils = {
+  toRequest,
+  toViewModel,
+  validation,
+  getDefaultViewModel,
+};
diff --git a/app/react/docker/containers/CreateView/CapabilitiesTab/toRequest.ts b/app/react/docker/containers/CreateView/CapabilitiesTab/toRequest.ts
new file mode 100644
index 0000000..208e11e
--- /dev/null
+++ b/app/react/docker/containers/CreateView/CapabilitiesTab/toRequest.ts
@@ -0,0 +1,23 @@
+import { CreateContainerRequest } from '@/react/docker/containers/CreateView/types';
+
+import { capabilities } from './types';
+import { Values } from './CapabilitiesTab';
+
+export function toRequest(
+  oldConfig: CreateContainerRequest,
+  values: Values,
+  hideCapabilities: boolean
+): CreateContainerRequest {
+  return {
+    ...oldConfig,
+    HostConfig: {
+      ...oldConfig.HostConfig,
+      CapAdd: hideCapabilities ? [] : values,
+      CapDrop: hideCapabilities
+        ? []
+        : capabilities
+            .filter((cap) => !values.includes(cap.key))
+            .map((cap) => cap.key),
+    },
+  };
+}
diff --git a/app/react/docker/containers/CreateView/CapabilitiesTab/toViewModel.ts b/app/react/docker/containers/CreateView/CapabilitiesTab/toViewModel.ts
new file mode 100644
index 0000000..7548e9a
--- /dev/null
+++ b/app/react/docker/containers/CreateView/CapabilitiesTab/toViewModel.ts
@@ -0,0 +1,28 @@
+import { ContainerDetailsJSON } from '@/react/docker/containers/queries/useContainer';
+
+import { capabilities } from './types';
+import { Values } from './CapabilitiesTab';
+
+export function toViewModel(config: ContainerDetailsJSON): Values {
+  const { CapAdd, CapDrop } = getDefaults(config);
+
+  const missingCaps = capabilities
+    .filter(
+      (cap) =>
+        cap.default && !CapAdd.includes(cap.key) && !CapDrop.includes(cap.key)
+    )
+    .map((cap) => cap.key);
+
+  return [...CapAdd, ...missingCaps];
+
+  function getDefaults(config: ContainerDetailsJSON) {
+    return {
+      CapAdd: config.HostConfig?.CapAdd || [],
+      CapDrop: config.HostConfig?.CapDrop || [],
+    };
+  }
+}
+
+export function getDefaultViewModel(): Values {
+  return capabilities.filter((cap) => cap.default).map((cap) => cap.key);
+}
diff --git a/app/react/docker/containers/CreateView/CapabilitiesTab/types.ts b/app/react/docker/containers/CreateView/CapabilitiesTab/types.ts
new file mode 100644
index 0000000..843c227
--- /dev/null
+++ b/app/react/docker/containers/CreateView/CapabilitiesTab/types.ts
@@ -0,0 +1,185 @@
+export interface Capability {
+  key: string;
+  description: string;
+  default?: boolean;
+}
+
+const capDesc: Array<Capability> = [
+  {
+    key: 'SETPCAP',
+    description: 'Modify process capabilities.',
+    default: true,
+  },
+  {
+    key: 'MKNOD',
+    description: 'Create special files using mknod(2).',
+    default: true,
+  },
+  {
+    key: 'AUDIT_WRITE',
+    description: 'Write records to kernel auditing log.',
+    default: true,
+  },
+  {
+    key: 'CHOWN',
+    description: 'Make arbitrary changes to file UIDs and GIDs (see chown(2)).',
+    default: true,
+  },
+  {
+    key: 'NET_RAW',
+    description: 'Use RAW and PACKET sockets.',
+    default: true,
+  },
+  {
+    key: 'DAC_OVERRIDE',
+    description: 'Bypass file read, write, and execute permission checks.',
+    default: true,
+  },
+  {
+    key: 'FOWNER',
+    description:
+      'Bypass permission checks on operations that normally require the file system UID of the process to match the UID of the file.',
+    default: true,
+  },
+  {
+    key: 'FSETID',
+    description:
+      'Don’t clear set-user-ID and set-group-ID permission bits when a file is modified.',
+    default: true,
+  },
+  {
+    key: 'KILL',
+    description: 'Bypass permission checks for sending signals.',
+    default: true,
+  },
+  {
+    key: 'SETGID',
+    description:
+      'Make arbitrary manipulations of process GIDs and supplementary GID list.',
+    default: true,
+  },
+  {
+    key: 'SETUID',
+    description: 'Make arbitrary manipulations of process UIDs.',
+    default: true,
+  },
+  {
+    key: 'NET_BIND_SERVICE',
+    description:
+      'Bind a socket to internet domain privileged ports (port numbers less than 1024).',
+    default: true,
+  },
+  {
+    key: 'SYS_CHROOT',
+    description: 'Use chroot(2), change root directory.',
+    default: true,
+  },
+  {
+    key: 'SETFCAP',
+    description: 'Set file capabilities.',
+    default: true,
+  },
+  {
+    key: 'SYS_MODULE',
+    description: 'Load and unload kernel modules.',
+  },
+  {
+    key: 'SYS_RAWIO',
+    description: 'Perform I/O port operations (iopl(2) and ioperm(2)).',
+  },
+  {
+    key: 'SYS_PACCT',
+    description: 'Use acct(2), switch process accounting on or off.',
+  },
+  {
+    key: 'SYS_ADMIN',
+    description: 'Perform a range of system administration operations.',
+  },
+  {
+    key: 'SYS_NICE',
+    description:
+      'Raise process nice value (nice(2), setpriority(2)) and change the nice value for arbitrary processes.',
+  },
+  {
+    key: 'SYS_RESOURCE',
+    description: 'Override resource Limits.',
+  },
+  {
+    key: 'SYS_TIME',
+    description:
+      'Set system clock (settimeofday(2), stime(2), adjtimex(2)); set real-time (hardware) clock.',
+  },
+  {
+    key: 'SYS_TTY_CONFIG',
+    description:
+      'Use vhangup(2); employ various privileged ioctl(2) operations on virtual terminals.',
+  },
+  {
+    key: 'AUDIT_CONTROL',
+    description:
+      'Enable and disable kernel auditing; change auditing filter rules; retrieve auditing status and filtering rules.',
+  },
+  {
+    key: 'MAC_ADMIN',
+    description:
+      'Allow MAC configuration or state changes. Implemented for the Smack LSM.',
+  },
+  {
+    key: 'MAC_OVERRIDE',
+    description:
+      'Override Mandatory Access Control (MAC). Implemented for the Smack Linux Security Module (LSM).',
+  },
+  {
+    key: 'NET_ADMIN',
+    description: 'Perform various network-related operations.',
+  },
+  {
+    key: 'SYSLOG',
+    description: 'Perform privileged syslog(2) operations.',
+  },
+  {
+    key: 'DAC_READ_SEARCH',
+    description:
+      'Bypass file read permission checks and directory read and execute permission checks.',
+  },
+  {
+    key: 'LINUX_IMMUTABLE',
+    description: 'Set the FS_APPEND_FL and FS_IMMUTABLE_FL i-node flags.',
+  },
+  {
+    key: 'NET_BROADCAST',
+    description: 'Make socket broadcasts, and listen to multicasts.',
+  },
+  {
+    key: 'IPC_LOCK',
+    description: 'Lock memory (mlock(2), mlockall(2), mmap(2), shmctl(2)).',
+  },
+  {
+    key: 'IPC_OWNER',
+    description:
+      'Bypass permission checks for operations on System V IPC objects.',
+  },
+  {
+    key: 'SYS_PTRACE',
+    description: 'Trace arbitrary processes using ptrace(2).',
+  },
+  {
+    key: 'SYS_BOOT',
+    description:
+      'Use reboot(2) and kexec_load(2), reboot and load a new kernel for later execution.',
+  },
+  {
+    key: 'LEASE',
+    description: 'Establish leases on arbitrary files (see fcntl(2)).',
+  },
+  {
+    key: 'WAKE_ALARM',
+    description: 'Trigger something that will wake up the system.',
+  },
+  {
+    key: 'BLOCK_SUSPEND',
+    description: 'Employ features that can block system suspend.',
+  },
+];
+
+export const capabilities = capDesc.sort((a, b) => (a.key < b.key ? -1 : 1));
diff --git a/app/react/docker/containers/CreateView/CapabilitiesTab/validation.ts b/app/react/docker/containers/CreateView/CapabilitiesTab/validation.ts
new file mode 100644
index 0000000..3d679fc
--- /dev/null
+++ b/app/react/docker/containers/CreateView/CapabilitiesTab/validation.ts
@@ -0,0 +1,7 @@
+import { array, SchemaOf, string } from 'yup';
+
+import { Values } from './CapabilitiesTab';
+
+export function validation(): SchemaOf<Values> {
+  return array(string().default('')).default([]);
+}
diff --git a/app/react/docker/containers/CreateView/CommandsTab/CommandsTab.tsx b/app/react/docker/containers/CreateView/CommandsTab/CommandsTab.tsx
new file mode 100644
index 0000000..a722f2e
--- /dev/null
+++ b/app/react/docker/containers/CreateView/CommandsTab/CommandsTab.tsx
@@ -0,0 +1,95 @@
+import { FormikErrors } from 'formik';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+
+import { ConsoleSettings } from './ConsoleSettings';
+import { LoggerConfig } from './LoggerConfig';
+import { OverridableInput } from './OverridableInput';
+import { Values } from './types';
+
+export function CommandsTab({
+  apiVersion,
+  values,
+  setFieldValue,
+  errors,
+}: {
+  apiVersion: number;
+  values: Values;
+  setFieldValue: (field: string, value: unknown) => void;
+  errors?: FormikErrors<Values>;
+}) {
+  return (
+    <div className="mt-3">
+      <FormControl
+        label="Command"
+        inputId="command-input"
+        size="xsmall"
+        errors={errors?.cmd}
+      >
+        <OverridableInput
+          value={values.cmd}
+          onChange={(cmd) => setFieldValue('cmd', cmd)}
+          id="command-input"
+          placeholder="e.g. '-logtostderr' '--housekeeping_interval=5s' or /usr/bin/nginx -t -c /mynginx.conf"
+        />
+      </FormControl>
+
+      <FormControl
+        label="Entrypoint"
+        inputId="entrypoint-input"
+        size="xsmall"
+        tooltip="When container entrypoint is entered as part of the Command field, set Entrypoint to Override mode and leave blank, else it will revert to default."
+        errors={errors?.entrypoint}
+      >
+        <OverridableInput
+          value={values.entrypoint}
+          onChange={(entrypoint) => setFieldValue('entrypoint', entrypoint)}
+          id="entrypoint-input"
+          placeholder="e.g. /bin/sh -c"
+        />
+      </FormControl>
+
+      <div className="flex justify-between gap-4">
+        <FormControl
+          label="Working Dir"
+          inputId="working-dir-input"
+          className="w-1/2"
+          errors={errors?.workingDir}
+        >
+          <Input
+            value={values.workingDir}
+            onChange={(e) => setFieldValue('workingDir', e.target.value)}
+            placeholder="e.g. /myapp"
+            data-cy="working-dir-input"
+          />
+        </FormControl>
+        <FormControl
+          label="User"
+          inputId="user-input"
+          className="w-1/2"
+          errors={errors?.user}
+        >
+          <Input
+            value={values.user}
+            onChange={(e) => setFieldValue('user', e.target.value)}
+            placeholder="e.g. nginx"
+            data-cy="user-input"
+          />
+        </FormControl>
+      </div>
+
+      <ConsoleSettings
+        value={values.console}
+        onChange={(console) => setFieldValue('console', console)}
+      />
+
+      <LoggerConfig
+        apiVersion={apiVersion}
+        value={values.logConfig}
+        onChange={(logConfig) => setFieldValue('logConfig', logConfig)}
+        errors={errors?.logConfig}
+      />
+    </div>
+  );
+}
diff --git a/app/react/docker/containers/CreateView/CommandsTab/ConsoleSettings.tsx b/app/react/docker/containers/CreateView/CommandsTab/ConsoleSettings.tsx
new file mode 100644
index 0000000..6ae6bec
--- /dev/null
+++ b/app/react/docker/containers/CreateView/CommandsTab/ConsoleSettings.tsx
@@ -0,0 +1,103 @@
+import { ReactNode } from 'react';
+import { mixed } from 'yup';
+import { ContainerConfig } from 'docker-types';
+
+import { AutomationTestingProps } from '@/types';
+
+import { FormControl } from '@@/form-components/FormControl';
+
+const consoleSettingTypes = ['tty', 'interactive', 'both', 'none'] as const;
+
+export type ConsoleSetting = (typeof consoleSettingTypes)[number];
+
+export type ConsoleConfig = Pick<ContainerConfig, 'OpenStdin' | 'Tty'>;
+
+export function ConsoleSettings({
+  value,
+  onChange,
+}: {
+  value: ConsoleSetting;
+  onChange(value: ConsoleSetting): void;
+}) {
+  return (
+    <FormControl label="Console" size="xsmall">
+      <Item
+        value="both"
+        onChange={handleChange}
+        label={
+          <>
+            Interactive & TTY <span className="small text-muted">(-i -t)</span>
+          </>
+        }
+        selected={value}
+        data-cy="container-console-interactive-tty"
+      />
+      <Item
+        value="interactive"
+        onChange={handleChange}
+        label={
+          <>
+            Interactive <span className="small text-muted">(-i)</span>
+          </>
+        }
+        selected={value}
+        data-cy="container-console-interactive"
+      />
+      <Item
+        value="tty"
+        onChange={handleChange}
+        label={
+          <>
+            TTY <span className="small text-muted">(-t)</span>
+          </>
+        }
+        selected={value}
+        data-cy="container-console-tty"
+      />
+      <Item
+        value="none"
+        onChange={handleChange}
+        label={<>None</>}
+        selected={value}
+        data-cy="container-console-none"
+      />
+    </FormControl>
+  );
+
+  function handleChange(value: ConsoleSetting) {
+    onChange(value);
+  }
+}
+
+function Item({
+  value,
+  selected,
+  onChange,
+  label,
+  'data-cy': dataCy,
+}: {
+  value: ConsoleSetting;
+  selected: ConsoleSetting;
+  onChange(value: ConsoleSetting): void;
+  label: ReactNode;
+} & AutomationTestingProps) {
+  return (
+    <label className="radio-inline !m-0 w-1/2">
+      <input
+        type="radio"
+        data-cy={dataCy}
+        name="container_console"
+        value={value}
+        checked={value === selected}
+        onChange={() => onChange(value)}
+      />
+      {label}
+    </label>
+  );
+}
+
+export function validation() {
+  return mixed<ConsoleSetting>()
+    .oneOf([...consoleSettingTypes])
+    .default('none');
+}
diff --git a/app/react/docker/containers/CreateView/CommandsTab/LoggerConfig.tsx b/app/react/docker/containers/CreateView/CommandsTab/LoggerConfig.tsx
new file mode 100644
index 0000000..5235fa3
--- /dev/null
+++ b/app/react/docker/containers/CreateView/CommandsTab/LoggerConfig.tsx
@@ -0,0 +1,145 @@
+import { FormikErrors } from 'formik';
+import { array, object, SchemaOf, string } from 'yup';
+import _ from 'lodash';
+
+import { useLoggingPlugins } from '@/react/docker/proxy/queries/usePlugins';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useIsPodman } from '@/react/portainer/environments/queries/useIsPodman';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { FormSection } from '@@/form-components/FormSection';
+import { InputGroup } from '@@/form-components/InputGroup';
+import { InputList, ItemProps } from '@@/form-components/InputList';
+import { PortainerSelect } from '@@/form-components/PortainerSelect';
+import { TextTip } from '@@/Tip/TextTip';
+import { FormError } from '@@/form-components/FormError';
+
+export interface LogConfig {
+  type: string;
+  options: Array<{ option: string; value: string }>;
+}
+
+export function LoggerConfig({
+  value,
+  onChange,
+  apiVersion,
+  errors,
+}: {
+  value: LogConfig;
+  onChange: (value: LogConfig) => void;
+  apiVersion: number;
+  errors?: FormikErrors<LogConfig>;
+}) {
+  const envId = useEnvironmentId();
+  const isPodman = useIsPodman(envId);
+  const isSystem = apiVersion < 1.25;
+  const pluginsQuery = useLoggingPlugins(envId, isSystem, isPodman);
+
+  if (!pluginsQuery.data) {
+    return null;
+  }
+
+  const isDisabled = !value.type || value.type === 'none';
+
+  const pluginOptions = [
+    { label: 'Default logging driver', value: '' },
+    ...pluginsQuery.data.map((p) => ({ label: p, value: p })),
+    { label: 'none', value: 'none' },
+  ];
+
+  return (
+    <FormSection title="Logging">
+      <FormControl label="Driver">
+        <PortainerSelect
+          value={value.type}
+          onChange={(type) => onChange({ ...value, type: type || '' })}
+          options={pluginOptions}
+          data-cy="docker-logging-driver-selector"
+        />
+      </FormControl>
+
+      <TextTip color="blue">
+        Logging driver that will override the default docker daemon driver.
+        Select Default logging driver if you don&apos;t want to override it.
+        Supported logging drivers can be found{' '}
+        <a
+          href="https://docs.docker.com/engine/admin/logging/overview/#supported-logging-drivers"
+          target="_blank"
+          rel="noreferrer"
+        >
+          in the Docker documentation
+        </a>
+        .
+      </TextTip>
+
+      <InputList
+        tooltip={
+          isDisabled
+            ? 'Add button is disabled unless a driver other than none or default is selected. Options are specific to the selected driver, refer to the driver documentation.'
+            : ''
+        }
+        label="Options"
+        onChange={(options) => handleChange({ options })}
+        value={value.options}
+        item={Item}
+        itemBuilder={() => ({ option: '', value: '' })}
+        disabled={isDisabled}
+        errors={errors?.options}
+        data-cy="docker-logging-options"
+      />
+    </FormSection>
+  );
+
+  function handleChange(partial: Partial<LogConfig>) {
+    onChange({ ...value, ...partial });
+  }
+}
+
+function Item({
+  item: { option, value },
+  onChange,
+  error,
+  index,
+}: ItemProps<{ option: string; value: string }>) {
+  return (
+    <div>
+      <div className="flex w-full gap-4">
+        <InputGroup className="w-1/2">
+          <InputGroup.Addon>option</InputGroup.Addon>
+          <InputGroup.Input
+            value={option}
+            onChange={(e) => handleChange({ option: e.target.value })}
+            placeholder="e.g. FOO"
+            data-cy={`docker-logging-option_${index}`}
+          />
+        </InputGroup>
+        <InputGroup className="w-1/2">
+          <InputGroup.Addon>value</InputGroup.Addon>
+          <InputGroup.Input
+            value={value}
+            onChange={(e) => handleChange({ value: e.target.value })}
+            placeholder="e.g bar"
+            data-cy={`docker-logging-value_${index}`}
+          />
+        </InputGroup>
+      </div>
+      {error && <FormError>{_.first(Object.values(error))}</FormError>}
+    </div>
+  );
+
+  function handleChange(partial: Partial<{ option: string; value: string }>) {
+    onChange({ option, value, ...partial });
+  }
+}
+
+export function validation(): SchemaOf<LogConfig> {
+  return object({
+    options: array().of(
+      object({
+        option: string().required('Option is required'),
+        value: string().required('Value is required'),
+      })
+    ),
+    type: string().default(''),
+  });
+}
diff --git a/app/react/docker/containers/CreateView/CommandsTab/OverridableInput.tsx b/app/react/docker/containers/CreateView/CommandsTab/OverridableInput.tsx
new file mode 100644
index 0000000..4218478
--- /dev/null
+++ b/app/react/docker/containers/CreateView/CommandsTab/OverridableInput.tsx
@@ -0,0 +1,51 @@
+import clsx from 'clsx';
+
+import { Button } from '@@/buttons';
+import { InputGroup } from '@@/form-components/InputGroup';
+
+export function OverridableInput({
+  value,
+  onChange,
+  id,
+  placeholder,
+}: {
+  value: string | null;
+  onChange: (value: string | null) => void;
+  id: string;
+  placeholder: string;
+}) {
+  const override = value !== null;
+
+  return (
+    <InputGroup>
+      <InputGroup.ButtonWrapper>
+        <Button
+          color="light"
+          data-cy={`docker-container-default-${id}`}
+          size="medium"
+          className={clsx('!ml-0', { active: !override })}
+          onClick={() => onChange(null)}
+        >
+          Default
+        </Button>
+        <Button
+          color="light"
+          data-cy={`docker-container-override-${id}`}
+          size="medium"
+          className={clsx({ active: override })}
+          onClick={() => onChange('')}
+        >
+          Override
+        </Button>
+      </InputGroup.ButtonWrapper>
+      <InputGroup.Input
+        disabled={!override}
+        data-cy={`docker-container-input-${id}`}
+        value={value || ''}
+        onChange={(e) => onChange(e.target.value)}
+        id={id}
+        placeholder={placeholder}
+      />
+    </InputGroup>
+  );
+}
diff --git a/app/react/docker/containers/CreateView/CommandsTab/index.ts b/app/react/docker/containers/CreateView/CommandsTab/index.ts
new file mode 100644
index 0000000..f2c49cb
--- /dev/null
+++ b/app/react/docker/containers/CreateView/CommandsTab/index.ts
@@ -0,0 +1,13 @@
+import { validation } from './validation';
+import { toRequest } from './toRequest';
+import { toViewModel, getDefaultViewModel } from './toViewModel';
+
+export { CommandsTab } from './CommandsTab';
+export { type Values as CommandsTabValues } from './types';
+
+export const commandsTabUtils = {
+  toRequest,
+  toViewModel,
+  validation,
+  getDefaultViewModel,
+};
diff --git a/app/react/docker/containers/CreateView/CommandsTab/toRequest.ts b/app/react/docker/containers/CreateView/CommandsTab/toRequest.ts
new file mode 100644
index 0000000..7e22809
--- /dev/null
+++ b/app/react/docker/containers/CreateView/CommandsTab/toRequest.ts
@@ -0,0 +1,69 @@
+import { commandStringToArray } from '@/docker/helpers/containers';
+
+import { CreateContainerRequest } from '../types';
+
+import { Values } from './types';
+import { LogConfig } from './LoggerConfig';
+import { ConsoleConfig, ConsoleSetting } from './ConsoleSettings';
+
+export function toRequest(
+  oldConfig: CreateContainerRequest,
+  values: Values
+): CreateContainerRequest {
+  const config = {
+    ...oldConfig,
+
+    HostConfig: {
+      ...oldConfig.HostConfig,
+      LogConfig: getLogConfig(values.logConfig),
+    },
+    User: values.user,
+    WorkingDir: values.workingDir,
+    ...getConsoleConfig(values.console),
+  } satisfies CreateContainerRequest;
+
+  if (values.cmd) {
+    config.Cmd = commandStringToArray(values.cmd);
+  } else if (values.cmd === null) {
+    delete config.Cmd;
+  }
+
+  if (values.entrypoint) {
+    config.Entrypoint = commandStringToArray(values.entrypoint);
+  } else if (values.entrypoint === null) {
+    delete config.Entrypoint;
+  }
+
+  // don't include LogConfig object if "Default logging driver" (type === '') is selected
+  if (values.logConfig.type === '') {
+    delete config.HostConfig.LogConfig;
+  }
+
+  return config;
+}
+
+export function getConsoleConfig(value: ConsoleSetting): ConsoleConfig {
+  switch (value) {
+    case 'both':
+      return { OpenStdin: true, Tty: true };
+    case 'interactive':
+      return { OpenStdin: true, Tty: false };
+    case 'tty':
+      return { OpenStdin: false, Tty: true };
+    case 'none':
+    default:
+      return { OpenStdin: false, Tty: false };
+  }
+}
+
+function getLogConfig(
+  value: LogConfig
+): CreateContainerRequest['HostConfig']['LogConfig'] {
+  return {
+    Type: value.type,
+    Config: Object.fromEntries(
+      value.options.map(({ option, value }) => [option, value])
+    ),
+    // docker types - requires union while it should allow also custom string for custom plugins
+  } as CreateContainerRequest['HostConfig']['LogConfig'];
+}
diff --git a/app/react/docker/containers/CreateView/CommandsTab/toViewModel.tsx b/app/react/docker/containers/CreateView/CommandsTab/toViewModel.tsx
new file mode 100644
index 0000000..4b2729d
--- /dev/null
+++ b/app/react/docker/containers/CreateView/CommandsTab/toViewModel.tsx
@@ -0,0 +1,70 @@
+import { HostConfig } from 'docker-types';
+
+import { commandArrayToString } from '@/docker/helpers/containers';
+
+import { ContainerDetailsJSON } from '../../queries/useContainer';
+
+import { ConsoleConfig, ConsoleSetting } from './ConsoleSettings';
+import { LogConfig } from './LoggerConfig';
+import { Values } from './types';
+
+export function getDefaultViewModel(): Values {
+  return {
+    cmd: null,
+    entrypoint: null,
+    user: '',
+    workingDir: '',
+    console: 'none',
+    logConfig: getLogConfig(),
+  };
+}
+
+export function toViewModel(config: ContainerDetailsJSON): Values {
+  if (!config.Config) {
+    return getDefaultViewModel();
+  }
+
+  return {
+    cmd: config.Config.Cmd ? commandArrayToString(config.Config.Cmd) : null,
+    entrypoint: config.Config.Entrypoint
+      ? commandArrayToString(config.Config.Entrypoint)
+      : null,
+    user: config.Config.User || '',
+    workingDir: config.Config.WorkingDir || '',
+    console: config ? getConsoleSetting(config.Config) : 'none',
+    logConfig: getLogConfig(config.HostConfig?.LogConfig),
+  };
+}
+
+function getLogConfig(value?: HostConfig['LogConfig']): LogConfig {
+  if (!value || !value.Type) {
+    return {
+      type: '',
+      options: [],
+    };
+  }
+
+  return {
+    type: value.Type,
+    options: Object.entries(value.Config || {}).map(([option, value]) => ({
+      option,
+      value,
+    })),
+  };
+}
+
+function getConsoleSetting(value: ConsoleConfig): ConsoleSetting {
+  if (value.OpenStdin && value.Tty) {
+    return 'both';
+  }
+
+  if (!value.OpenStdin && value.Tty) {
+    return 'tty';
+  }
+
+  if (value.OpenStdin && !value.Tty) {
+    return 'interactive';
+  }
+
+  return 'none';
+}
diff --git a/app/react/docker/containers/CreateView/CommandsTab/types.ts b/app/react/docker/containers/CreateView/CommandsTab/types.ts
new file mode 100644
index 0000000..d083190
--- /dev/null
+++ b/app/react/docker/containers/CreateView/CommandsTab/types.ts
@@ -0,0 +1,11 @@
+import { ConsoleSetting } from './ConsoleSettings';
+import { LogConfig } from './LoggerConfig';
+
+export interface Values {
+  cmd: string | null;
+  entrypoint: string | null;
+  workingDir: string;
+  user: string;
+  console: ConsoleSetting;
+  logConfig: LogConfig;
+}
diff --git a/app/react/docker/containers/CreateView/CommandsTab/validation.ts b/app/react/docker/containers/CreateView/CommandsTab/validation.ts
new file mode 100644
index 0000000..e693d87
--- /dev/null
+++ b/app/react/docker/containers/CreateView/CommandsTab/validation.ts
@@ -0,0 +1,16 @@
+import { object, SchemaOf, string } from 'yup';
+
+import { validation as consoleValidation } from './ConsoleSettings';
+import { validation as logConfigValidation } from './LoggerConfig';
+import { Values } from './types';
+
+export function validation(): SchemaOf<Values> {
+  return object({
+    cmd: string().nullable().default(''),
+    entrypoint: string().nullable().default(''),
+    logConfig: logConfigValidation(),
+    console: consoleValidation(),
+    user: string().default(''),
+    workingDir: string().default(''),
+  });
+}
diff --git a/app/react/docker/containers/CreateView/CreateInnerForm.tsx b/app/react/docker/containers/CreateView/CreateInnerForm.tsx
new file mode 100644
index 0000000..7f2a30f
--- /dev/null
+++ b/app/react/docker/containers/CreateView/CreateInnerForm.tsx
@@ -0,0 +1,227 @@
+import { useFormikContext, Form } from 'formik';
+import { Settings } from 'lucide-react';
+import { useState } from 'react';
+
+import { useCurrentEnvironment } from '@/react/hooks/useCurrentEnvironment';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useIsEnvironmentAdmin } from '@/react/hooks/useUser';
+
+import { NavTabs } from '@@/NavTabs';
+import { Widget } from '@@/Widget';
+
+import { useApiVersion } from '../../proxy/queries/useVersion';
+
+import { BaseForm } from './BaseForm';
+import { CapabilitiesTab } from './CapabilitiesTab';
+import { CommandsTab } from './CommandsTab';
+import { LabelsTab } from './LabelsTab';
+import { NetworkTab } from './NetworkTab';
+import { ResourcesTab } from './ResourcesTab';
+import { RestartPolicyTab } from './RestartPolicyTab';
+import { VolumesTab } from './VolumesTab';
+import { Values } from './useInitialValues';
+import { EnvVarsTab } from './EnvVarsTab';
+import { EditResourcesForm } from './ResourcesTab/EditResourceForm';
+
+export function CreateInnerForm({
+  hideCapabilities = false,
+  isLoading,
+  isDuplicate,
+  onChangeName,
+  onRateLimit,
+}: {
+  hideCapabilities: boolean;
+  isDuplicate: boolean;
+  isLoading: boolean;
+  onChangeName: (value: string) => void;
+  onRateLimit: (limited?: boolean) => void;
+}) {
+  const { values, setFieldValue, errors, submitForm } =
+    useFormikContext<Values>();
+  const environmentId = useEnvironmentId();
+  const [tab, setTab] = useState('commands');
+  const apiVersion = useApiVersion(environmentId);
+  const isEnvironmentAdminQuery = useIsEnvironmentAdmin({ adminOnlyCE: true });
+  const envQuery = useCurrentEnvironment();
+
+  if (!envQuery.data) {
+    return null;
+  }
+
+  const environment = envQuery.data;
+
+  return (
+    <Form className="form-horizontal">
+      <div className="row">
+        <div className="col-sm-12">
+          <div>
+            <BaseForm
+              onChangeName={onChangeName}
+              onChangeImageName={() => {
+                setFieldValue('commands.cmd', null);
+                setFieldValue('commands.entrypoint', null);
+              }}
+              isLoading={isLoading}
+              onRateLimit={onRateLimit}
+            />
+
+            <div className="mt-4">
+              <Widget>
+                <Widget.Title
+                  title="Advanced container settings"
+                  icon={Settings}
+                />
+                <Widget.Body>
+                  <NavTabs<string>
+                    onSelect={setTab}
+                    selectedId={tab}
+                    type="pills"
+                    justified
+                    options={[
+                      {
+                        id: 'commands',
+                        label: 'Commands & logging',
+                        children: (
+                          <CommandsTab
+                            apiVersion={apiVersion}
+                            values={values.commands}
+                            setFieldValue={(field, value) =>
+                              setFieldValue(`commands.${field}`, value)
+                            }
+                          />
+                        ),
+                      },
+                      {
+                        id: 'volumes',
+                        label: 'Volumes',
+                        children: (
+                          <VolumesTab
+                            values={values.volumes}
+                            onChange={(value) =>
+                              setFieldValue('volumes', value)
+                            }
+                            errors={errors.volumes}
+                          />
+                        ),
+                      },
+                      {
+                        id: 'network',
+                        label: 'Network',
+                        children: (
+                          <NetworkTab
+                            values={values.network}
+                            setFieldValue={(field, value) =>
+                              setFieldValue(`network.${field}`, value)
+                            }
+                          />
+                        ),
+                      },
+                      {
+                        id: 'env',
+                        label: 'Env',
+                        children: (
+                          <EnvVarsTab
+                            values={values.env}
+                            onChange={(value) => setFieldValue('env', value)}
+                            errors={errors.env}
+                          />
+                        ),
+                      },
+                      {
+                        id: 'labels',
+                        label: 'Labels',
+                        children: (
+                          <LabelsTab
+                            values={values.labels}
+                            onChange={(value) => setFieldValue('labels', value)}
+                            errors={errors.labels}
+                          />
+                        ),
+                      },
+                      {
+                        id: 'restart',
+                        label: 'Restart policy',
+                        children: (
+                          <RestartPolicyTab
+                            values={values.restartPolicy}
+                            onChange={(value) =>
+                              setFieldValue('restartPolicy', value)
+                            }
+                          />
+                        ),
+                      },
+                      {
+                        id: 'runtime',
+                        label: 'Runtime & resources',
+                        children: (
+                          <ResourcesTab
+                            values={values.resources}
+                            errors={errors.resources}
+                            setFieldValue={(field, value) =>
+                              setFieldValue(`resources.${field}`, value)
+                            }
+                            allowPrivilegedMode={
+                              isEnvironmentAdminQuery.authorized ||
+                              environment.SecuritySettings
+                                .allowPrivilegedModeForRegularUsers
+                            }
+                            isDevicesFieldVisible={
+                              isEnvironmentAdminQuery.authorized ||
+                              environment.SecuritySettings
+                                .allowDeviceMappingForRegularUsers
+                            }
+                            isInitFieldVisible={apiVersion >= 1.37}
+                            isSysctlFieldVisible={
+                              isEnvironmentAdminQuery.authorized ||
+                              environment.SecuritySettings
+                                .allowSysctlSettingForRegularUsers
+                            }
+                            isSecurityOptFieldVisible={
+                              isEnvironmentAdminQuery.authorized ||
+                              environment.SecuritySettings
+                                .allowSecurityOptForRegularUsers
+                            }
+                            renderLimits={
+                              isDuplicate
+                                ? (values) => (
+                                    <EditResourcesForm
+                                      initialValues={values}
+                                      onChange={(values) => {
+                                        setFieldValue(
+                                          'resources.resources',
+                                          values
+                                        );
+                                      }}
+                                      redeploy={submitForm}
+                                      isImageInvalid={!!errors?.image}
+                                    />
+                                  )
+                                : undefined
+                            }
+                          />
+                        ),
+                      },
+                      {
+                        id: 'capabilities',
+                        label: 'Capabilities',
+                        hidden: hideCapabilities,
+                        children: (
+                          <CapabilitiesTab
+                            values={values.capabilities}
+                            onChange={(value) =>
+                              setFieldValue('capabilities', value)
+                            }
+                          />
+                        ),
+                      },
+                    ]}
+                  />
+                </Widget.Body>
+              </Widget>
+            </div>
+          </div>
+        </div>
+      </div>
+    </Form>
+  );
+}
diff --git a/app/react/docker/containers/CreateView/CreateView.tsx b/app/react/docker/containers/CreateView/CreateView.tsx
new file mode 100644
index 0000000..b065aa0
--- /dev/null
+++ b/app/react/docker/containers/CreateView/CreateView.tsx
@@ -0,0 +1,205 @@
+import { Formik } from 'formik';
+import { useRouter } from '@uirouter/react';
+import { useEffect, useState } from 'react';
+
+import { useIsEdgeAdmin, useIsEnvironmentAdmin } from '@/react/hooks/useUser';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useCurrentEnvironment } from '@/react/hooks/useCurrentEnvironment';
+import { useEnvironmentRegistries } from '@/react/portainer/environments/queries/useEnvironmentRegistries';
+import { Registry } from '@/react/portainer/registries/types/registry';
+import { notifySuccess } from '@/portainer/services/notifications';
+import { useDebouncedValue } from '@/react/hooks/useDebouncedValue';
+
+import { PageHeader } from '@@/PageHeader';
+import { ImageConfigValues } from '@@/ImageConfigFieldset';
+import { confirmDestructive } from '@@/modals/confirm';
+import { buildConfirmButton } from '@@/modals/utils';
+import { InformationPanel } from '@@/InformationPanel';
+import { TextTip } from '@@/Tip/TextTip';
+import { HelpLink } from '@@/HelpLink';
+
+import { useContainers } from '../queries/useContainers';
+import { useSystemLimits, useIsWindows } from '../../proxy/queries/useInfo';
+
+import { useCreateOrReplaceMutation } from './useCreateMutation';
+import { useValidation } from './validation';
+import { useInitialValues, Values } from './useInitialValues';
+import { CreateInnerForm } from './CreateInnerForm';
+import { toRequest } from './toRequest';
+
+export function CreateView() {
+  return (
+    <>
+      <PageHeader
+        title="Create container"
+        breadcrumbs={[
+          { label: 'Containers', link: 'docker.containers' },
+          'Add container',
+        ]}
+        reload
+      />
+
+      <CreateForm />
+    </>
+  );
+}
+
+function CreateForm() {
+  const environmentId = useEnvironmentId();
+  const router = useRouter();
+  const isWindows = useIsWindows(environmentId);
+  const isAdminQuery = useIsEdgeAdmin();
+  const { authorized: isEnvironmentAdmin } = useIsEnvironmentAdmin();
+  const [isDockerhubRateLimited, setIsDockerhubRateLimited] = useState(false);
+
+  const mutation = useCreateOrReplaceMutation();
+  const initialValuesQuery = useInitialValues(
+    mutation.isLoading || mutation.isSuccess,
+    isWindows
+  );
+  const registriesQuery = useEnvironmentRegistries(environmentId);
+
+  const { oldContainer, syncName } = useOldContainer(
+    initialValuesQuery?.initialValues?.name
+  );
+
+  const { maxCpu, maxMemory } = useSystemLimits(environmentId);
+
+  const envQuery = useCurrentEnvironment();
+
+  const validationSchema = useValidation({
+    isAdmin: isAdminQuery.isAdmin,
+    maxCpu,
+    maxMemory,
+    isDuplicating: initialValuesQuery?.isDuplicating,
+    isDuplicatingPortainer: oldContainer?.IsPortainer,
+    isDockerhubRateLimited,
+  });
+
+  if (!envQuery.data || !initialValuesQuery) {
+    return null;
+  }
+
+  const environment = envQuery.data;
+
+  const hideCapabilities =
+    (!environment.SecuritySettings.allowContainerCapabilitiesForRegularUsers &&
+      !isEnvironmentAdmin) ||
+    isWindows;
+
+  const {
+    isDuplicating = false,
+    initialValues,
+    extraNetworks,
+  } = initialValuesQuery;
+
+  return (
+    <>
+      {isDuplicating && (
+        <div className="row">
+          <div className="col-sm-12">
+            <InformationPanel title-text="Caution">
+              <TextTip>
+                The new container may fail to start if the image is changed, and
+                settings from the previous container aren&apos;t compatible.
+                Common causes include entrypoint, cmd or{' '}
+                <HelpLink docLink="/user/docker/containers/advanced">
+                  other settings
+                </HelpLink>{' '}
+                set by an image.
+              </TextTip>
+            </InformationPanel>
+          </div>
+        </div>
+      )}
+
+      <Formik
+        initialValues={initialValues}
+        onSubmit={handleSubmit}
+        validateOnMount
+        validationSchema={validationSchema}
+      >
+        <CreateInnerForm
+          hideCapabilities={hideCapabilities}
+          onChangeName={syncName}
+          isDuplicate={isDuplicating}
+          isLoading={mutation.isLoading}
+          onRateLimit={(limited = false) => setIsDockerhubRateLimited(limited)}
+        />
+      </Formik>
+    </>
+  );
+
+  async function handleSubmit(values: Values) {
+    if (oldContainer) {
+      const confirmed = await confirmDestructive({
+        title: 'Are you sure?',
+        message:
+          'A container with the same name already exists. Portainer can automatically remove it and re-create one. Do you want to replace it?',
+        confirmButton: buildConfirmButton('Replace', 'danger'),
+      });
+
+      if (!confirmed) {
+        return false;
+      }
+    }
+
+    const registry = getRegistry(values.image, registriesQuery.data || []);
+    const config = toRequest(values, registry, hideCapabilities);
+
+    return mutation.mutate(
+      {
+        config,
+        environment,
+        values: {
+          accessControl: values.accessControl,
+          imageName: values.image.image,
+          name: values.name,
+          alwaysPull: values.alwaysPull,
+          enableWebhook: values.enableWebhook,
+          nodeName: values.nodeName,
+        },
+        registry,
+        oldContainer,
+        extraNetworks,
+      },
+      {
+        onSuccess() {
+          notifySuccess('Success', 'Container successfully created');
+          router.stateService.go('docker.containers');
+        },
+      }
+    );
+  }
+}
+
+function getRegistry(image: ImageConfigValues, registries: Registry[]) {
+  return image.useRegistry
+    ? registries.find((registry) => registry.Id === image.registryId)
+    : undefined;
+}
+
+function useOldContainer(initialName?: string) {
+  const environmentId = useEnvironmentId();
+
+  const [name, setName] = useState(initialName);
+  const debouncedName = useDebouncedValue(name, 1000);
+  const oldContainerQuery = useContainers(environmentId, {
+    enabled: !!debouncedName,
+    filters: {
+      name: [`^/${debouncedName}$`],
+    },
+  });
+
+  useEffect(() => {
+    setName(initialName);
+  }, [initialName]);
+
+  return {
+    syncName: setName,
+    oldContainer:
+      oldContainerQuery.data && oldContainerQuery.data.length > 0
+        ? oldContainerQuery.data[0]
+        : undefined,
+  };
+}
diff --git a/app/react/docker/containers/CreateView/EnvVarsTab/EnvVarsTab.tsx b/app/react/docker/containers/CreateView/EnvVarsTab/EnvVarsTab.tsx
new file mode 100644
index 0000000..c0c51d1
--- /dev/null
+++ b/app/react/docker/containers/CreateView/EnvVarsTab/EnvVarsTab.tsx
@@ -0,0 +1,30 @@
+import {
+  EnvVarValues,
+  EnvironmentVariablesPanel,
+} from '@@/form-components/EnvironmentVariablesFieldset';
+import { ArrayError } from '@@/form-components/InputList/InputList';
+
+export function EnvVarsTab({
+  values,
+  onChange,
+  errors,
+}: {
+  values: EnvVarValues;
+  onChange(value: EnvVarValues): void;
+  errors?: ArrayError<EnvVarValues>;
+}) {
+  return (
+    <div className="form-group">
+      <EnvironmentVariablesPanel
+        values={values}
+        explanation="These values will be applied to the container when deployed"
+        onChange={handleChange}
+        errors={errors}
+      />
+    </div>
+  );
+
+  function handleChange(values: EnvVarValues) {
+    onChange(values);
+  }
+}
diff --git a/app/react/docker/containers/CreateView/EnvVarsTab/index.ts b/app/react/docker/containers/CreateView/EnvVarsTab/index.ts
new file mode 100644
index 0000000..cb1189b
--- /dev/null
+++ b/app/react/docker/containers/CreateView/EnvVarsTab/index.ts
@@ -0,0 +1,13 @@
+import { envVarValidation } from '@@/form-components/EnvironmentVariablesFieldset';
+
+import { toRequest } from './toRequest';
+import { toViewModel, getDefaultViewModel } from './toViewModel';
+
+export { EnvVarsTab } from './EnvVarsTab';
+
+export const envVarsTabUtils = {
+  toRequest,
+  toViewModel,
+  validation: envVarValidation,
+  getDefaultViewModel,
+};
diff --git a/app/react/docker/containers/CreateView/EnvVarsTab/toRequest.ts b/app/react/docker/containers/CreateView/EnvVarsTab/toRequest.ts
new file mode 100644
index 0000000..b159430
--- /dev/null
+++ b/app/react/docker/containers/CreateView/EnvVarsTab/toRequest.ts
@@ -0,0 +1,14 @@
+import { convertToArrayOfStrings } from '@@/form-components/EnvironmentVariablesFieldset/utils';
+import { EnvVarValues } from '@@/form-components/EnvironmentVariablesFieldset';
+
+import { CreateContainerRequest } from '../types';
+
+export function toRequest(
+  oldConfig: CreateContainerRequest,
+  values: EnvVarValues
+): CreateContainerRequest {
+  return {
+    ...oldConfig,
+    Env: convertToArrayOfStrings(values),
+  };
+}
diff --git a/app/react/docker/containers/CreateView/EnvVarsTab/toViewModel.ts b/app/react/docker/containers/CreateView/EnvVarsTab/toViewModel.ts
new file mode 100644
index 0000000..63af6a1
--- /dev/null
+++ b/app/react/docker/containers/CreateView/EnvVarsTab/toViewModel.ts
@@ -0,0 +1,11 @@
+import { parseArrayOfStrings } from '@@/form-components/EnvironmentVariablesFieldset/utils';
+
+import { ContainerDetailsJSON } from '../../queries/useContainer';
+
+export function getDefaultViewModel() {
+  return [];
+}
+
+export function toViewModel(container: ContainerDetailsJSON) {
+  return parseArrayOfStrings(container.Config?.Env);
+}
diff --git a/app/react/docker/containers/CreateView/LabelsTab/Item.tsx b/app/react/docker/containers/CreateView/LabelsTab/Item.tsx
new file mode 100644
index 0000000..ec5ea41
--- /dev/null
+++ b/app/react/docker/containers/CreateView/LabelsTab/Item.tsx
@@ -0,0 +1,33 @@
+import { FormError } from '@@/form-components/FormError';
+import { InputGroup } from '@@/form-components/InputGroup';
+import { ItemProps } from '@@/form-components/InputList';
+
+import { Label } from './types';
+
+export function Item({ item, onChange, error, index }: ItemProps<Label>) {
+  return (
+    <div className="w-full">
+      <div className="flex w-full gap-4">
+        <InputGroup className="w-1/2">
+          <InputGroup.Addon>name</InputGroup.Addon>
+          <InputGroup.Input
+            value={item.name}
+            data-cy={`label-name_${index}`}
+            onChange={(e) => onChange({ ...item, name: e.target.value })}
+            placeholder="e.g. com.example.foo"
+          />
+        </InputGroup>
+        <InputGroup className="w-1/2">
+          <InputGroup.Addon>value</InputGroup.Addon>
+          <InputGroup.Input
+            value={item.value}
+            data-cy={`label-value${index}`}
+            onChange={(e) => onChange({ ...item, value: e.target.value })}
+            placeholder="e.g. bar"
+          />
+        </InputGroup>
+      </div>
+      {error && <FormError>{Object.values(error)[0]}</FormError>}
+    </div>
+  );
+}
diff --git a/app/react/docker/containers/CreateView/LabelsTab/LabelsTab.tsx b/app/react/docker/containers/CreateView/LabelsTab/LabelsTab.tsx
new file mode 100644
index 0000000..e79065f
--- /dev/null
+++ b/app/react/docker/containers/CreateView/LabelsTab/LabelsTab.tsx
@@ -0,0 +1,31 @@
+import { InputList } from '@@/form-components/InputList';
+import { ArrayError } from '@@/form-components/InputList/InputList';
+
+import { Item } from './Item';
+import { Values } from './types';
+
+export function LabelsTab({
+  values,
+  onChange,
+  errors,
+}: {
+  values: Values;
+  onChange: (values: Values) => void;
+  errors?: ArrayError<Values>;
+}) {
+  return (
+    <InputList
+      label="Labels"
+      onChange={handleChange}
+      errors={errors}
+      value={values}
+      item={Item}
+      itemBuilder={() => ({ name: '', value: '' })}
+      data-cy="docker-container-labels"
+    />
+  );
+
+  function handleChange(values: Values) {
+    onChange(values);
+  }
+}
diff --git a/app/react/docker/containers/CreateView/LabelsTab/index.ts b/app/react/docker/containers/CreateView/LabelsTab/index.ts
new file mode 100644
index 0000000..c94a16d
--- /dev/null
+++ b/app/react/docker/containers/CreateView/LabelsTab/index.ts
@@ -0,0 +1,14 @@
+import { validation } from './validation';
+import { toRequest } from './toRequest';
+import { toViewModel, getDefaultViewModel } from './toViewModel';
+
+export { LabelsTab } from './LabelsTab';
+
+export { type Values as LabelsTabValues } from './types';
+
+export const labelsTabUtils = {
+  toRequest,
+  toViewModel,
+  validation,
+  getDefaultViewModel,
+};
diff --git a/app/react/docker/containers/CreateView/LabelsTab/toRequest.ts b/app/react/docker/containers/CreateView/LabelsTab/toRequest.ts
new file mode 100644
index 0000000..3b9ee54
--- /dev/null
+++ b/app/react/docker/containers/CreateView/LabelsTab/toRequest.ts
@@ -0,0 +1,17 @@
+import { CreateContainerRequest } from '../types';
+
+import { Values } from './types';
+
+export function toRequest(
+  oldConfig: CreateContainerRequest,
+  values: Values
+): CreateContainerRequest {
+  return {
+    ...oldConfig,
+    Labels: Object.fromEntries(
+      values
+        .filter((label) => label.name)
+        .map((label) => [label.name, label.value])
+    ),
+  };
+}
diff --git a/app/react/docker/containers/CreateView/LabelsTab/toViewModel.ts b/app/react/docker/containers/CreateView/LabelsTab/toViewModel.ts
new file mode 100644
index 0000000..8777d01
--- /dev/null
+++ b/app/react/docker/containers/CreateView/LabelsTab/toViewModel.ts
@@ -0,0 +1,18 @@
+import { ContainerDetailsJSON } from '../../queries/useContainer';
+
+import { Values } from './types';
+
+export function toViewModel(config: ContainerDetailsJSON): Values {
+  if (!config || !config.Config || !config.Config.Labels) {
+    return [];
+  }
+
+  return Object.entries(config.Config.Labels).map(([name, value]) => ({
+    name,
+    value,
+  }));
+}
+
+export function getDefaultViewModel(): Values {
+  return [];
+}
diff --git a/app/react/docker/containers/CreateView/LabelsTab/types.ts b/app/react/docker/containers/CreateView/LabelsTab/types.ts
new file mode 100644
index 0000000..bf47e55
--- /dev/null
+++ b/app/react/docker/containers/CreateView/LabelsTab/types.ts
@@ -0,0 +1,6 @@
+export interface Label {
+  name: string;
+  value: string;
+}
+
+export type Values = Array<Label>;
diff --git a/app/react/docker/containers/CreateView/LabelsTab/validation.ts b/app/react/docker/containers/CreateView/LabelsTab/validation.ts
new file mode 100644
index 0000000..0696828
--- /dev/null
+++ b/app/react/docker/containers/CreateView/LabelsTab/validation.ts
@@ -0,0 +1,12 @@
+import { array, object, SchemaOf, string } from 'yup';
+
+import { Values } from './types';
+
+export function validation(): SchemaOf<Values> {
+  return array(
+    object({
+      name: string().required('Name is required'),
+      value: string().default(''),
+    })
+  );
+}
diff --git a/app/react/docker/containers/CreateView/NetworkTab/ContainerSelector.tsx b/app/react/docker/containers/CreateView/NetworkTab/ContainerSelector.tsx
new file mode 100644
index 0000000..4fbae48
--- /dev/null
+++ b/app/react/docker/containers/CreateView/NetworkTab/ContainerSelector.tsx
@@ -0,0 +1,37 @@
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+
+import { Option, PortainerSelect } from '@@/form-components/PortainerSelect';
+
+import { useContainers } from '../../queries/useContainers';
+import { ContainerStatus } from '../../types';
+
+export function ContainerSelector({
+  onChange,
+  value,
+}: {
+  value: string;
+  onChange: (value: string) => void;
+}) {
+  const environmentId = useEnvironmentId();
+
+  const containersQuery = useContainers<Array<Option<string>>>(environmentId, {
+    filters: { status: [ContainerStatus.Running] },
+    select(containers) {
+      return containers.map((n) => {
+        const name = n.Names[0];
+
+        return { label: name, value: name };
+      });
+    },
+  });
+
+  return (
+    <PortainerSelect
+      value={value}
+      onChange={onChange}
+      options={containersQuery.data || []}
+      isLoading={containersQuery.isLoading}
+      data-cy="docker-container-selector"
+    />
+  );
+}
diff --git a/app/react/docker/containers/CreateView/NetworkTab/HostnameField.tsx b/app/react/docker/containers/CreateView/NetworkTab/HostnameField.tsx
new file mode 100644
index 0000000..f0186e7
--- /dev/null
+++ b/app/react/docker/containers/CreateView/NetworkTab/HostnameField.tsx
@@ -0,0 +1,27 @@
+import { string } from 'yup';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+
+export function HostnameField({
+  value,
+  error,
+  onChange,
+}: {
+  value: string;
+  error?: string;
+  onChange: (value: string) => void;
+}) {
+  return (
+    <FormControl label="Hostname" errors={error}>
+      <Input
+        value={value}
+        onChange={(e) => onChange(e.target.value)}
+        placeholder="e.g. web01"
+        data-cy="docker-container-hostname-input"
+      />
+    </FormControl>
+  );
+}
+
+export const hostnameSchema = string().default('');
diff --git a/app/react/docker/containers/CreateView/NetworkTab/HostsFileEntries.tsx b/app/react/docker/containers/CreateView/NetworkTab/HostsFileEntries.tsx
new file mode 100644
index 0000000..963c131
--- /dev/null
+++ b/app/react/docker/containers/CreateView/NetworkTab/HostsFileEntries.tsx
@@ -0,0 +1,56 @@
+import { array, string } from 'yup';
+
+import { FormError } from '@@/form-components/FormError';
+import { InputLabeled } from '@@/form-components/Input/InputLabeled';
+import { ItemProps } from '@@/form-components/InputList';
+import { ArrayError, InputList } from '@@/form-components/InputList/InputList';
+
+export const hostFileSchema = array(
+  string().required('Entry is required')
+).default([]);
+
+export function HostsFileEntries({
+  values,
+  onChange,
+  errors,
+}: {
+  values: string[];
+  onChange: (values: string[]) => void;
+  errors?: ArrayError<string>;
+}) {
+  return (
+    <InputList
+      label="Hosts file entries"
+      value={values}
+      onChange={(hostsFileEntries) => onChange(hostsFileEntries)}
+      errors={errors}
+      item={HostsFileEntryItem}
+      itemBuilder={() => ''}
+      data-cy="hosts-file-entries"
+    />
+  );
+}
+
+function HostsFileEntryItem({
+  item,
+  onChange,
+  disabled,
+  error,
+  readOnly,
+  index,
+}: ItemProps<string>) {
+  return (
+    <div>
+      <InputLabeled
+        label="value"
+        value={item}
+        onChange={(e) => onChange(e.target.value)}
+        disabled={disabled}
+        readOnly={readOnly}
+        data-cy={`hosts-file-entry_${index}`}
+      />
+
+      {error && <FormError>{error}</FormError>}
+    </div>
+  );
+}
diff --git a/app/react/docker/containers/CreateView/NetworkTab/NetworkTab.tsx b/app/react/docker/containers/CreateView/NetworkTab/NetworkTab.tsx
new file mode 100644
index 0000000..c3654f0
--- /dev/null
+++ b/app/react/docker/containers/CreateView/NetworkTab/NetworkTab.tsx
@@ -0,0 +1,120 @@
+import { FormikErrors } from 'formik';
+
+import { useIsPodman } from '@/react/portainer/environments/queries/useIsPodman';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+
+import { NetworkSelector } from '../../components/NetworkSelector';
+
+import { CONTAINER_MODE, Values } from './types';
+import { ContainerSelector } from './ContainerSelector';
+import { HostsFileEntries } from './HostsFileEntries';
+import { HostnameField } from './HostnameField';
+
+export function NetworkTab({
+  values,
+  setFieldValue,
+  errors,
+}: {
+  values: Values;
+  setFieldValue: (field: string, value: unknown) => void;
+  errors?: FormikErrors<Values>;
+}) {
+  const envId = useEnvironmentId();
+  const isPodman = useIsPodman(envId);
+  const additionalOptions = getAdditionalOptions(isPodman);
+  return (
+    <div className="mt-3">
+      <FormControl label="Network" errors={errors?.networkMode}>
+        <NetworkSelector
+          value={values.networkMode}
+          additionalOptions={additionalOptions}
+          onChange={(networkMode) => setFieldValue('networkMode', networkMode)}
+        />
+      </FormControl>
+
+      {values.networkMode === CONTAINER_MODE && (
+        <FormControl label="Container" errors={errors?.container}>
+          <ContainerSelector
+            value={values.container}
+            onChange={(container) => setFieldValue('container', container)}
+          />
+        </FormControl>
+      )}
+
+      <HostnameField
+        value={values.hostname}
+        onChange={(value) => setFieldValue('hostname', value)}
+      />
+
+      <FormControl label="Domain Name" errors={errors?.domain}>
+        <Input
+          value={values.domain}
+          onChange={(e) => setFieldValue('domain', e.target.value)}
+          placeholder="e.g. example.com"
+          data-cy="docker-container-domain-input"
+        />
+      </FormControl>
+
+      <FormControl label="MAC Address" errors={errors?.macAddress}>
+        <Input
+          value={values.macAddress}
+          onChange={(e) => setFieldValue('macAddress', e.target.value)}
+          placeholder="e.g. 12-34-56-78-9a-bc"
+          data-cy="docker-container-mac-address-input"
+        />
+      </FormControl>
+
+      <FormControl label="IPv4 Address" errors={errors?.ipv4Address}>
+        <Input
+          value={values.ipv4Address}
+          onChange={(e) => setFieldValue('ipv4Address', e.target.value)}
+          placeholder="e.g. 172.20.0.7"
+          data-cy="docker-container-ipv4-address-input"
+        />
+      </FormControl>
+
+      <FormControl label="IPv6 Address" errors={errors?.ipv6Address}>
+        <Input
+          value={values.ipv6Address}
+          onChange={(e) => setFieldValue('ipv6Address', e.target.value)}
+          placeholder="e.g. a:b:c:d::1234"
+          data-cy="docker-container-ipv6-address-input"
+        />
+      </FormControl>
+
+      <FormControl label="Primary DNS Server" errors={errors?.primaryDns}>
+        <Input
+          value={values.primaryDns}
+          onChange={(e) => setFieldValue('primaryDns', e.target.value)}
+          placeholder="e.g. 1.1.1.1, 2606:4700:4700::1111"
+          data-cy="docker-container-primary-dns-input"
+        />
+      </FormControl>
+
+      <FormControl label="Secondary DNS Server" errors={errors?.secondaryDns}>
+        <Input
+          value={values.secondaryDns}
+          onChange={(e) => setFieldValue('secondaryDns', e.target.value)}
+          placeholder="e.g. 1.0.0.1, 2606:4700:4700::1001"
+          data-cy="docker-container-secondary-dns-input"
+        />
+      </FormControl>
+
+      <HostsFileEntries
+        values={values.hostsFileEntries}
+        onChange={(v) => setFieldValue('hostsFileEntries', v)}
+        errors={errors?.hostsFileEntries}
+      />
+    </div>
+  );
+}
+
+function getAdditionalOptions(isPodman?: boolean) {
+  if (isPodman) {
+    return [];
+  }
+  return [{ label: 'Container', value: CONTAINER_MODE }];
+}
diff --git a/app/react/docker/containers/CreateView/NetworkTab/index.ts b/app/react/docker/containers/CreateView/NetworkTab/index.ts
new file mode 100644
index 0000000..e4ace09
--- /dev/null
+++ b/app/react/docker/containers/CreateView/NetworkTab/index.ts
@@ -0,0 +1,13 @@
+import { validation } from './validation';
+import { toRequest } from './toRequest';
+import { toViewModel, getDefaultViewModel } from './toViewModel';
+
+export { NetworkTab } from './NetworkTab';
+export { type Values as NetworkTabValues } from './types';
+
+export const networkTabUtils = {
+  toRequest,
+  toViewModel,
+  validation,
+  getDefaultViewModel,
+};
diff --git a/app/react/docker/containers/CreateView/NetworkTab/toRequest.test.ts b/app/react/docker/containers/CreateView/NetworkTab/toRequest.test.ts
new file mode 100644
index 0000000..5d726e3
--- /dev/null
+++ b/app/react/docker/containers/CreateView/NetworkTab/toRequest.test.ts
@@ -0,0 +1,82 @@
+import { describe, it, expect } from 'vitest';
+
+import { CreateContainerRequest } from '../types';
+
+import { toRequest } from './toRequest';
+import { Values } from './types';
+
+describe('toRequest', () => {
+  const mockOldConfig: CreateContainerRequest = {
+    Hostname: 'old-hostname',
+    Domainname: 'old-domain',
+    MacAddress: '02:42:ac:11:00:99',
+    HostConfig: {
+      NetworkMode: 'bridge',
+      Dns: ['1.1.1.1'],
+      ExtraHosts: [],
+    },
+    NetworkingConfig: {
+      EndpointsConfig: {
+        bridge: {
+          Aliases: [],
+        },
+      },
+    },
+  };
+
+  const mockValues: Values = {
+    networkMode: 'bridge',
+    hostname: 'new-hostname',
+    domain: 'new-domain',
+    macAddress: '02:42:ac:11:00:88',
+    ipv4Address: '172.17.0.5',
+    ipv6Address: 'fe80::42:acff:fe11:5',
+    primaryDns: '8.8.8.8',
+    secondaryDns: '8.8.4.4',
+    hostsFileEntries: ['host1:127.0.0.1'],
+    container: '',
+  };
+
+  it('should use MAC address from values, not from oldConfig', () => {
+    const oldMacAddress = '02:42:ac:11:00:99';
+    const macAddress = '02:42:ac:11:00:88';
+    const result = toRequest(
+      { ...mockOldConfig, MacAddress: oldMacAddress },
+      { ...mockValues, macAddress },
+      'container-123'
+    );
+
+    expect(result.MacAddress).toBe(macAddress);
+    expect(result.MacAddress).not.toBe(oldMacAddress);
+  });
+
+  it('should allow empty MAC address when duplicating containers', () => {
+    const valuesWithEmptyMac: Values = {
+      ...mockValues,
+      macAddress: '', // Empty MAC from toViewModel
+    };
+
+    const result = toRequest(
+      mockOldConfig,
+      valuesWithEmptyMac,
+      'container-123'
+    );
+
+    expect(result.MacAddress).toBe('');
+    expect(result.MacAddress).not.toBe(mockOldConfig.MacAddress);
+  });
+
+  it('should set other network properties from values', () => {
+    const result = toRequest(mockOldConfig, mockValues, 'container-123');
+
+    expect(result.Hostname).toBe('new-hostname');
+    expect(result.Domainname).toBe('new-domain');
+    expect(result.HostConfig.NetworkMode).toBe('bridge');
+    expect(result.HostConfig.Dns).toEqual(['8.8.8.8', '8.8.4.4']);
+    expect(result.HostConfig.ExtraHosts).toEqual(['host1:127.0.0.1']);
+    expect(result.NetworkingConfig.EndpointsConfig?.bridge.IPAMConfig).toEqual({
+      IPv4Address: '172.17.0.5',
+      IPv6Address: 'fe80::42:acff:fe11:5',
+    });
+  });
+});
diff --git a/app/react/docker/containers/CreateView/NetworkTab/toRequest.ts b/app/react/docker/containers/CreateView/NetworkTab/toRequest.ts
new file mode 100644
index 0000000..d3907f5
--- /dev/null
+++ b/app/react/docker/containers/CreateView/NetworkTab/toRequest.ts
@@ -0,0 +1,43 @@
+import { CreateContainerRequest } from '../types';
+
+import { CONTAINER_MODE, Values } from './types';
+
+export function toRequest(
+  oldConfig: CreateContainerRequest,
+  values: Values,
+  fromContainerId: string
+): CreateContainerRequest {
+  let mode = values.networkMode;
+  let hostName = values.hostname;
+  if (mode === CONTAINER_MODE && values.container) {
+    mode += `:${values.container}`;
+    hostName = '';
+  }
+
+  return {
+    ...oldConfig,
+    Hostname: hostName,
+    Domainname: values.domain,
+    MacAddress: values.macAddress,
+    HostConfig: {
+      ...oldConfig.HostConfig,
+      NetworkMode: mode,
+      Dns: [values.primaryDns, values.secondaryDns].filter((d) => d),
+      ExtraHosts: values.hostsFileEntries,
+    },
+    NetworkingConfig: {
+      ...oldConfig.NetworkingConfig,
+      EndpointsConfig: {
+        [mode]: {
+          IPAMConfig: {
+            IPv4Address: values.ipv4Address,
+            IPv6Address: values.ipv6Address,
+          },
+          Aliases: oldConfig.NetworkingConfig.EndpointsConfig?.[
+            mode
+          ]?.Aliases?.filter((al) => !fromContainerId.startsWith(al)),
+        },
+      },
+    },
+  };
+}
diff --git a/app/react/docker/containers/CreateView/NetworkTab/toViewModel.test.ts b/app/react/docker/containers/CreateView/NetworkTab/toViewModel.test.ts
new file mode 100644
index 0000000..3cba1f7
--- /dev/null
+++ b/app/react/docker/containers/CreateView/NetworkTab/toViewModel.test.ts
@@ -0,0 +1,234 @@
+import { describe, it, expect } from 'vitest';
+
+import { DockerNetwork } from '@/react/docker/networks/types';
+
+import { ContainerListViewModel } from '../../types';
+import { ContainerDetailsJSON } from '../../queries/useContainer';
+
+import {
+  getDefaultViewModel,
+  getNetworkMode,
+  toViewModel,
+} from './toViewModel';
+
+describe('getDefaultViewModel', () => {
+  it('should return the correct default view model for Windows', () => {
+    const result = getDefaultViewModel(true);
+    expect(result).toEqual({
+      networkMode: 'nat',
+      hostname: '',
+      domain: '',
+      macAddress: '',
+      ipv4Address: '',
+      ipv6Address: '',
+      primaryDns: '',
+      secondaryDns: '',
+      hostsFileEntries: [],
+      container: '',
+    });
+  });
+
+  it('should return the correct default view model for Podman', () => {
+    const result = getDefaultViewModel(false, true);
+    expect(result).toEqual({
+      networkMode: 'podman',
+      hostname: '',
+      domain: '',
+      macAddress: '',
+      ipv4Address: '',
+      ipv6Address: '',
+      primaryDns: '',
+      secondaryDns: '',
+      hostsFileEntries: [],
+      container: '',
+    });
+  });
+
+  it('should return the correct default view model for Linux Docker', () => {
+    const result = getDefaultViewModel(false);
+    expect(result).toEqual({
+      networkMode: 'bridge',
+      hostname: '',
+      domain: '',
+      macAddress: '',
+      ipv4Address: '',
+      ipv6Address: '',
+      primaryDns: '',
+      secondaryDns: '',
+      hostsFileEntries: [],
+      container: '',
+    });
+  });
+});
+
+describe('getNetworkMode', () => {
+  const mockNetworks: Array<DockerNetwork> = [
+    {
+      Name: 'bridge',
+      Id: 'bridge-id',
+      Driver: 'bridge',
+      Scope: 'local',
+      Attachable: false,
+      Internal: false,
+      IPAM: { Config: [], Driver: '', Options: {} },
+      Options: {},
+      Containers: {},
+    },
+    {
+      Name: 'host',
+      Id: 'host-id',
+      Driver: 'host',
+      Scope: 'local',
+      Attachable: false,
+      Internal: false,
+      IPAM: { Config: [], Driver: '', Options: {} },
+      Options: {},
+      Containers: {},
+    },
+    {
+      Name: 'custom',
+      Id: 'custom-id',
+      Driver: 'bridge',
+      Scope: 'local',
+      Attachable: true,
+      Internal: false,
+      IPAM: { Config: [], Driver: '', Options: {} },
+      Options: {},
+      Containers: {},
+    },
+  ];
+
+  const mockRunningContainers: Array<ContainerListViewModel> = [
+    {
+      Id: 'container-1',
+      Names: ['container-1-name'],
+    } as ContainerListViewModel, // gaslight the type to avoid over-specifying
+  ];
+
+  it('should return the network mode from HostConfig', () => {
+    const config: ContainerDetailsJSON = {
+      HostConfig: { NetworkMode: 'host' },
+    };
+    expect(getNetworkMode(config, mockNetworks)).toEqual(['host']);
+  });
+
+  it('should return the network mode from NetworkSettings if HostConfig is empty', () => {
+    const config: ContainerDetailsJSON = {
+      NetworkSettings: { Networks: { custom: {} } },
+    };
+    expect(getNetworkMode(config, mockNetworks)).toEqual(['custom']);
+  });
+
+  it('should return container mode when NetworkMode starts with "container:"', () => {
+    const config: ContainerDetailsJSON = {
+      HostConfig: { NetworkMode: 'container:container-1' },
+    };
+    expect(getNetworkMode(config, mockNetworks, mockRunningContainers)).toEqual(
+      ['container', 'container-1-name']
+    );
+  });
+
+  it('should return "podman" for bridge network when isPodman is true', () => {
+    const config: ContainerDetailsJSON = {
+      HostConfig: { NetworkMode: 'bridge' },
+    };
+    expect(getNetworkMode(config, mockNetworks, [], true)).toEqual(['podman']);
+  });
+
+  it('should return "bridge" for default network mode on Docker', () => {
+    const config: ContainerDetailsJSON = {
+      HostConfig: { NetworkMode: 'default' },
+    };
+    expect(getNetworkMode(config, mockNetworks)).toEqual(['bridge']);
+  });
+
+  it('should return the first available network if no matching network is found', () => {
+    const config: ContainerDetailsJSON = {
+      HostConfig: { NetworkMode: 'non-existent' },
+    };
+    expect(getNetworkMode(config, mockNetworks)).toEqual(['bridge']);
+  });
+});
+
+describe('toViewModel', () => {
+  const mockNetworks: Array<DockerNetwork> = [
+    {
+      Name: 'bridge',
+      Id: 'bridge-id',
+      Driver: 'bridge',
+      Scope: 'local',
+      Attachable: false,
+      Internal: false,
+      IPAM: { Config: [], Driver: '', Options: {} },
+      Options: {},
+      Containers: {},
+    },
+  ];
+
+  it('should copy network settings while clearing mac address', () => {
+    const config: ContainerDetailsJSON = {
+      Config: {
+        Hostname: 'test-host',
+        Domainname: 'test-domain',
+      },
+      HostConfig: {
+        NetworkMode: 'bridge',
+        Dns: ['8.8.8.8', '8.8.4.4'],
+        ExtraHosts: ['host1:127.0.0.1'],
+      },
+      NetworkSettings: {
+        Networks: {
+          bridge: {
+            MacAddress: '02:42:ac:11:00:02',
+            IPAMConfig: {
+              IPv4Address: '172.17.0.2',
+              IPv6Address: 'fe80::42:acff:fe11:2',
+            },
+          },
+        },
+      },
+    };
+
+    const result = toViewModel(config, mockNetworks);
+
+    expect(result.macAddress).toBe('');
+    expect(result.hostname).toBe('test-host');
+    expect(result.domain).toBe('test-domain');
+    expect(result.ipv4Address).toBe('172.17.0.2');
+    expect(result.ipv6Address).toBe('fe80::42:acff:fe11:2');
+  });
+
+  it('should return empty MAC address for new containers', () => {
+    const config: ContainerDetailsJSON = {
+      Config: {},
+      HostConfig: { NetworkMode: 'bridge' },
+    };
+
+    const result = toViewModel(config, mockNetworks);
+
+    expect(result.macAddress).toBe('');
+  });
+
+  it('should not duplicate MAC address when duplicating containers', () => {
+    const config: ContainerDetailsJSON = {
+      Config: {
+        Hostname: 'original-container',
+      },
+      HostConfig: {
+        NetworkMode: 'bridge',
+      },
+      NetworkSettings: {
+        Networks: {
+          bridge: {
+            MacAddress: '02:42:ac:11:00:99',
+          },
+        },
+      },
+    };
+
+    const result = toViewModel(config, mockNetworks);
+
+    expect(result.macAddress).toBe('');
+    expect(result.hostname).toBe('original-container');
+  });
+});
diff --git a/app/react/docker/containers/CreateView/NetworkTab/toViewModel.ts b/app/react/docker/containers/CreateView/NetworkTab/toViewModel.ts
new file mode 100644
index 0000000..7701e6e
--- /dev/null
+++ b/app/react/docker/containers/CreateView/NetworkTab/toViewModel.ts
@@ -0,0 +1,116 @@
+import { DockerNetwork } from '@/react/docker/networks/types';
+
+import { ContainerDetailsJSON } from '../../queries/useContainer';
+import { ContainerListViewModel } from '../../types';
+
+import { CONTAINER_MODE, Values } from './types';
+
+export function getDefaultViewModel(isWindows: boolean, isPodman?: boolean) {
+  const networkMode = getDefaultNetworkMode(isWindows, isPodman);
+  return {
+    networkMode,
+    hostname: '',
+    domain: '',
+    macAddress: '',
+    ipv4Address: '',
+    ipv6Address: '',
+    primaryDns: '',
+    secondaryDns: '',
+    hostsFileEntries: [],
+    container: '',
+  };
+}
+
+export function getDefaultNetworkMode(isWindows: boolean, isPodman?: boolean) {
+  if (isWindows) return 'nat';
+  if (isPodman) return 'podman';
+  return 'bridge';
+}
+
+export function toViewModel(
+  config: ContainerDetailsJSON,
+  networks: Array<DockerNetwork>,
+  runningContainers: Array<ContainerListViewModel> = [],
+  isPodman?: boolean
+): Values {
+  const dns = config.HostConfig?.Dns;
+  const [primaryDns = '', secondaryDns = ''] = dns || [];
+
+  const hostsFileEntries = config.HostConfig?.ExtraHosts || [];
+
+  const [networkMode, container = ''] = getNetworkMode(
+    config,
+    networks,
+    runningContainers,
+    isPodman
+  );
+
+  const networkSettings = config.NetworkSettings?.Networks?.[networkMode];
+  let ipv4Address = '';
+  let ipv6Address = '';
+  if (networkSettings && networkSettings.IPAMConfig) {
+    ipv4Address = networkSettings.IPAMConfig.IPv4Address || '';
+    ipv6Address = networkSettings.IPAMConfig.IPv6Address || '';
+  }
+
+  return {
+    networkMode,
+    hostname: config.Config?.Hostname || '',
+    domain: config.Config?.Domainname || '',
+    macAddress: '', // mac address is cleared between edit/duplicate
+    ipv4Address,
+    ipv6Address,
+    primaryDns,
+    secondaryDns,
+    hostsFileEntries,
+    container,
+  };
+}
+
+export function getNetworkMode(
+  config: ContainerDetailsJSON,
+  networks: Array<DockerNetwork>,
+  runningContainers: Array<ContainerListViewModel> = [],
+  isPodman?: boolean
+) {
+  let networkMode = config.HostConfig?.NetworkMode || '';
+  if (!networkMode) {
+    const networks = Object.keys(config.NetworkSettings?.Networks || {});
+    if (networks.length > 0) {
+      [networkMode] = networks;
+    }
+  }
+
+  if (networkMode.startsWith('container:')) {
+    const networkContainerId = networkMode.split(/^container:/)[1];
+    const container =
+      runningContainers.find((c) => c.Id === networkContainerId)?.Names[0] ||
+      '';
+    return [CONTAINER_MODE, container] as const;
+  }
+
+  const networkNames = networks.map((n) => n.Name);
+
+  if (networkNames.includes(networkMode)) {
+    if (isPodman && networkMode === 'bridge') {
+      return ['podman'] as const;
+    }
+    return [networkMode] as const;
+  }
+
+  if (
+    networkNames.includes('bridge') &&
+    (!networkMode || networkMode === 'default' || networkMode === 'bridge')
+  ) {
+    if (isPodman) {
+      return ['podman'] as const;
+    }
+    return ['bridge'] as const;
+  }
+
+  if (networkNames.includes('nat')) {
+    return ['nat'] as const;
+  }
+
+  return [networks[0].Name] as const;
+}
diff --git a/app/react/docker/containers/CreateView/NetworkTab/types.ts b/app/react/docker/containers/CreateView/NetworkTab/types.ts
new file mode 100644
index 0000000..8b2f7e1
--- /dev/null
+++ b/app/react/docker/containers/CreateView/NetworkTab/types.ts
@@ -0,0 +1,14 @@
+export const CONTAINER_MODE = 'container';
+
+export interface Values {
+  networkMode: string;
+  hostname: string;
+  domain: string;
+  macAddress: string;
+  ipv4Address: string;
+  ipv6Address: string;
+  primaryDns: string;
+  secondaryDns: string;
+  hostsFileEntries: Array<string>;
+  container: string;
+}
diff --git a/app/react/docker/containers/CreateView/NetworkTab/validation.ts b/app/react/docker/containers/CreateView/NetworkTab/validation.ts
new file mode 100644
index 0000000..46d776c
--- /dev/null
+++ b/app/react/docker/containers/CreateView/NetworkTab/validation.ts
@@ -0,0 +1,25 @@
+import { object, SchemaOf, string } from 'yup';
+
+import { Values } from './types';
+import { hostnameSchema } from './HostnameField';
+import { hostFileSchema } from './HostsFileEntries';
+
+export function validation(): SchemaOf<Values> {
+  return object({
+    networkMode: string().default(''),
+    hostname: hostnameSchema,
+    domain: string().default(''),
+    macAddress: string().default(''),
+    ipv4Address: string().default(''),
+    ipv6Address: string().default(''),
+    primaryDns: string().default(''),
+    secondaryDns: string().default(''),
+    hostsFileEntries: hostFileSchema,
+    container: string()
+      .default('')
+      .when('network', {
+        is: 'container',
+        then: string().required('Container is required'),
+      }),
+  });
+}
diff --git a/app/react/docker/containers/CreateView/ResourcesTab/DevicesField.tsx b/app/react/docker/containers/CreateView/ResourcesTab/DevicesField.tsx
new file mode 100644
index 0000000..9dd3060
--- /dev/null
+++ b/app/react/docker/containers/CreateView/ResourcesTab/DevicesField.tsx
@@ -0,0 +1,89 @@
+import { FormikErrors } from 'formik';
+import { array, object, SchemaOf, string } from 'yup';
+import { DeviceMapping } from 'docker-types';
+
+import { FormError } from '@@/form-components/FormError';
+import { InputList, ItemProps } from '@@/form-components/InputList';
+import { InputLabeled } from '@@/form-components/Input/InputLabeled';
+
+interface Device {
+  pathOnHost: string;
+  pathInContainer: string;
+}
+
+export type Values = Array<Device>;
+
+export function DevicesField({
+  values,
+  onChange,
+  errors,
+}: {
+  values: Values;
+  onChange: (value: Values) => void;
+  errors?: FormikErrors<Device>[];
+}) {
+  return (
+    <InputList
+      value={values}
+      onChange={onChange}
+      item={Item}
+      addLabel="Add device"
+      label="Devices"
+      errors={errors}
+      itemBuilder={() => ({ pathOnHost: '', pathInContainer: '' })}
+      data-cy="docker-container-devices"
+    />
+  );
+}
+
+function Item({ item, onChange, error, index }: ItemProps<Device>) {
+  return (
+    <div className="w-full">
+      <div className="flex w-full gap-4">
+        <InputLabeled
+          value={item.pathOnHost}
+          data-cy={`device-path-on-host_${index}`}
+          onChange={(e) => onChange({ ...item, pathOnHost: e.target.value })}
+          label="host"
+          placeholder="e.g. /dev/tty0"
+          className="w-1/2"
+          size="small"
+        />
+        <InputLabeled
+          value={item.pathInContainer}
+          data-cy={`device-path-on-container_${index}`}
+          onChange={(e) =>
+            onChange({ ...item, pathInContainer: e.target.value })
+          }
+          label="container"
+          placeholder="e.g. /dev/tty0"
+          className="w-1/2"
+          size="small"
+        />
+      </div>
+      {error && <FormError>{Object.values(error)[0]}</FormError>}
+    </div>
+  );
+}
+
+export function devicesValidation(): SchemaOf<Values> {
+  return array(
+    object({
+      pathOnHost: string().required('Host path is required'),
+      pathInContainer: string().required('Container path is required'),
+    })
+  );
+}
+
+export function toDevicesViewModel(devices: Array<DeviceMapping>): Values {
+  return devices.filter(hasPath).map((device) => ({
+    pathOnHost: device.PathOnHost,
+    pathInContainer: device.PathInContainer,
+  }));
+
+  function hasPath(
+    device: DeviceMapping
+  ): device is { PathOnHost: string; PathInContainer: string } {
+    return !!device.PathOnHost && !!device.PathInContainer;
+  }
+}
diff --git a/app/react/docker/containers/CreateView/ResourcesTab/EditResourceForm.tsx b/app/react/docker/containers/CreateView/ResourcesTab/EditResourceForm.tsx
new file mode 100644
index 0000000..a56d449
--- /dev/null
+++ b/app/react/docker/containers/CreateView/ResourcesTab/EditResourceForm.tsx
@@ -0,0 +1,151 @@
+import { Formik } from 'formik';
+import { useMutation } from '@tanstack/react-query';
+import { useCurrentStateAndParams } from '@uirouter/react';
+import { useState } from 'react';
+import { FormikHelpers } from 'formik/dist/types';
+
+import { invalidateContainer } from '@/react/docker/containers/queries/useContainer';
+import { notifySuccess } from '@/portainer/services/notifications';
+import { mutationOptions, withError } from '@/react-tools/react-query';
+import { useSystemLimits } from '@/react/docker/proxy/queries/useInfo';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { LoadingButton } from '@@/buttons';
+import { TextTip } from '@@/Tip/TextTip';
+
+import { updateContainer } from '../../queries/useUpdateContainer';
+
+import {
+  ResourceFieldset,
+  resourcesValidation,
+  Values,
+} from './ResourcesFieldset';
+import { toConfigCpu, toConfigMemory } from './memory-utils';
+
+export function EditResourcesForm({
+  onChange,
+  redeploy,
+  initialValues,
+  isImageInvalid,
+}: {
+  initialValues: Values;
+  onChange: (values: Values) => void;
+  redeploy: () => Promise<boolean>;
+  isImageInvalid: boolean;
+}) {
+  const {
+    params: { from: containerId },
+  } = useCurrentStateAndParams();
+
+  const [savedInitValues, setSavedInitValues] = useState(initialValues);
+
+  if (!containerId || typeof containerId !== 'string') {
+    throw new Error('missing parameter "from"');
+  }
+
+  const updateMutation = useMutation(
+    updateLimitsOrCreate,
+    mutationOptions(withError('Failed to update limits'))
+  );
+
+  const environmentId = useEnvironmentId();
+  const systemLimits = useSystemLimits(environmentId);
+
+  return (
+    <Formik
+      initialValues={initialValues}
+      onSubmit={handleSubmit}
+      validationSchema={() => resourcesValidation(systemLimits)}
+    >
+      {({ values, errors, setValues, dirty, submitForm }) => (
+        <div className="edit-resources p-5">
+          <ResourceFieldset
+            values={values}
+            onChange={(values) => {
+              onChange(values);
+              setValues(values);
+            }}
+            errors={errors}
+          />
+
+          <div className="form-group">
+            <div className="col-sm-12 flex items-center gap-4">
+              <LoadingButton
+                isLoading={updateMutation.isLoading}
+                data-cy="update-limits-button"
+                disabled={isImageInvalid || !dirty}
+                loadingText="Update in progress..."
+                type="button"
+                onClick={submitForm}
+              >
+                Update Limits
+              </LoadingButton>
+              {settingUnlimitedResources(values) && (
+                <TextTip>
+                  Updating any resource value to &apos;unlimited&apos; will
+                  redeploy this container.
+                </TextTip>
+              )}
+            </div>
+          </div>
+        </div>
+      )}
+    </Formik>
+  );
+
+  function handleSubmit(values: Values, helper: FormikHelpers<Values>) {
+    updateMutation.mutate(values, {
+      onSuccess: (data) => {
+        if (data) {
+          notifySuccess('Success', 'Limits updated');
+          helper.resetForm({ values: initialValues });
+          invalidateContainer(environmentId, containerId);
+        }
+      },
+    });
+  }
+
+  function settingUnlimitedResources(values: Values) {
+    return (
+      (savedInitValues.limit > 0 && values.limit === 0) ||
+      (savedInitValues.reservation > 0 && values.reservation === 0) ||
+      (savedInitValues.cpu > 0 && values.cpu === 0)
+    );
+  }
+
+  // return true only if limits are updated
+  // return false otherwise(container recreated, user canceled container recreation, etc.)
+  async function updateLimitsOrCreate(values: Values) {
+    if (settingUnlimitedResources(values)) {
+      const ret = await redeploy();
+
+      if (ret === false) {
+        return false;
+      }
+
+      setSavedInitValues(values);
+      return false;
+    }
+
+    setSavedInitValues(values);
+    await updateLimits(environmentId, containerId, values);
+
+    return true;
+  }
+}
+
+async function updateLimits(
+  environmentId: EnvironmentId,
+  containerId: string,
+  values: Values
+) {
+  return updateContainer(environmentId, containerId, {
+    // MemorySwap: must be set
+    // -1: non limits, 0: treated as unset(cause update error).
+    MemorySwap: -1,
+    MemoryReservation: toConfigMemory(values.reservation),
+    Memory: toConfigMemory(values.limit),
+    NanoCpus: toConfigCpu(values.cpu),
+  });
+}
diff --git a/app/react/docker/containers/CreateView/ResourcesTab/GpuFieldset/GpuFieldset.tsx b/app/react/docker/containers/CreateView/ResourcesTab/GpuFieldset/GpuFieldset.tsx
new file mode 100644
index 0000000..de6921f
--- /dev/null
+++ b/app/react/docker/containers/CreateView/ResourcesTab/GpuFieldset/GpuFieldset.tsx
@@ -0,0 +1,259 @@
+import { useMemo } from 'react';
+import {
+  ActionMeta,
+  components,
+  MultiValue,
+  MultiValueRemoveProps,
+  OnChangeValue,
+  OptionProps,
+} from 'react-select';
+
+import { Select } from '@@/form-components/ReactSelect';
+import { Switch } from '@@/form-components/SwitchField/Switch';
+import { Tooltip } from '@@/Tip/Tooltip';
+import { TextTip } from '@@/Tip/TextTip';
+
+import { Values } from './types';
+
+interface GpuOption {
+  value: string;
+  label: string;
+  description?: string;
+}
+
+interface GPU {
+  value: string;
+  name: string;
+}
+
+export interface Props {
+  values: Values;
+  onChange(values: Values): void;
+  gpus: GPU[];
+  usedGpus: string[];
+  usedAllGpus: boolean;
+  enableGpuManagement?: boolean;
+}
+
+const NvidiaCapabilitiesOptions = [
+  // Taken from https://github.com/containerd/containerd/blob/master/contrib/nvidia/nvidia.go#L40
+  {
+    value: 'compute',
+    label: 'compute',
+    description: 'required for CUDA and OpenCL applications',
+  },
+  {
+    value: 'compat32',
+    label: 'compat32',
+    description: 'required for running 32-bit applications',
+  },
+  {
+    value: 'graphics',
+    label: 'graphics',
+    description: 'required for running OpenGL and Vulkan applications',
+  },
+  {
+    value: 'utility',
+    label: 'utility',
+    description: 'required for using nvidia-smi and NVML',
+  },
+  {
+    value: 'video',
+    label: 'video',
+    description: 'required for using the Video Codec SDK',
+  },
+  {
+    value: 'display',
+    label: 'display',
+    description: 'required for leveraging X11 display',
+  },
+] as const;
+
+export function GpuFieldset({
+  values,
+  onChange,
+  gpus = [],
+  usedGpus = [],
+  usedAllGpus,
+  enableGpuManagement,
+}: Props) {
+  const options = useMemo(() => {
+    const options = (gpus || []).map((gpu) => ({
+      value: gpu.value,
+      label:
+        usedGpus.includes(gpu.value) || usedAllGpus
+          ? `${gpu.name} (in use)`
+          : gpu.name,
+    }));
+
+    options.unshift({
+      value: 'all',
+      label: 'Use All GPUs',
+    });
+
+    return options;
+  }, [gpus, usedGpus, usedAllGpus]);
+
+  const gpuCmd = useMemo(() => {
+    const devices = values.selectedGPUs.join(',');
+    const deviceStr = devices === 'all' ? 'all,' : `device=${devices},`;
+    const caps = values.capabilities.join(',');
+    return `--gpus '${deviceStr}"capabilities=${caps}"'`;
+  }, [values.selectedGPUs, values.capabilities]);
+
+  const gpuValue = useMemo(
+    () =>
+      options.filter((option) => values.selectedGPUs.includes(option.value)),
+    [values.selectedGPUs, options]
+  );
+
+  const capValue = useMemo(
+    () =>
+      NvidiaCapabilitiesOptions.filter((option) =>
+        values.capabilities.includes(option.value)
+      ),
+    [values.capabilities]
+  );
+
+  return (
+    <div>
+      <TextTip inline={false} color="blue">
+        <p>GPU support is currently limited to NVIDIA graphics cards only.</p>
+      </TextTip>
+
+      {!enableGpuManagement && (
+        <TextTip color="blue">
+          GPU in the UI is not currently enabled for this environment.
+        </TextTip>
+      )}
+
+      <div className="form-group">
+        <div className="col-sm-3 col-lg-2 control-label text-left">
+          Enable GPU
+          <Switch
+            id="enabled"
+            name="enabled"
+            checked={values.enabled && !!enableGpuManagement}
+            onChange={toggleEnableGpu}
+            className="ml-2"
+            disabled={!enableGpuManagement}
+            data-cy="docker-containers-gpu-enabled-switch"
+          />
+        </div>
+        {enableGpuManagement && values.enabled && (
+          <div className="col-sm-9 col-lg-10 text-left">
+            <Select<GpuOption, true>
+              isMulti
+              closeMenuOnSelect
+              value={gpuValue}
+              isClearable={false}
+              backspaceRemovesValue={false}
+              isDisabled={!values.enabled}
+              onChange={onChangeSelectedGpus}
+              options={options}
+              components={{ MultiValueRemove }}
+              data-cy="docker-containers-gpu-select"
+              id="docker-containers-gpu-select"
+            />
+          </div>
+        )}
+      </div>
+
+      {values.enabled && (
+        <>
+          <div className="form-group">
+            <div className="col-sm-3 col-lg-2 control-label text-left">
+              Capabilities
+              <Tooltip message="‘compute’ and ‘utility’ capabilities are preselected by Portainer because they are used by default when you don’t explicitly specify capabilities with docker CLI ‘--gpus’ option." />
+            </div>
+            <div className="col-sm-9 col-lg-10 text-left">
+              <Select<GpuOption, true>
+                isMulti
+                closeMenuOnSelect
+                value={capValue}
+                options={NvidiaCapabilitiesOptions}
+                components={{ Option }}
+                onChange={onChangeSelectedCaps}
+                data-cy="docker-containers-gpu-capabilities-select"
+                id="docker-containers-gpu-capabilities-select"
+              />
+            </div>
+          </div>
+
+          <div className="form-group">
+            <div className="col-sm-3 col-lg-2 control-label text-left">
+              Control
+              <Tooltip message="This is the generated equivalent of the '--gpus' docker CLI parameter based on your settings." />
+            </div>
+            <div className="col-sm-9 col-lg-10">
+              <code>{gpuCmd}</code>
+            </div>
+          </div>
+        </>
+      )}
+    </div>
+  );
+
+  function onChangeValues(key: string, newValue: boolean | string[]) {
+    const newValues = {
+      ...values,
+      [key]: newValue,
+    };
+    onChange(newValues);
+  }
+
+  function toggleEnableGpu() {
+    onChangeValues('enabled', !values.enabled);
+  }
+
+  function onChangeSelectedGpus(
+    newValue: OnChangeValue<GpuOption, true>,
+    actionMeta: ActionMeta<GpuOption>
+  ) {
+    let { useSpecific } = values;
+    let selectedGPUs = newValue.map((option) => option.value);
+
+    if (actionMeta.action === 'select-option') {
+      useSpecific = actionMeta.option?.value !== 'all';
+      selectedGPUs = selectedGPUs.filter((value) =>
+        useSpecific ? value !== 'all' : value === 'all'
+      );
+    }
+
+    const newValues = { ...values, selectedGPUs, useSpecific };
+    onChange(newValues);
+  }
+
+  function onChangeSelectedCaps(newValue: OnChangeValue<GpuOption, true>) {
+    onChangeValues(
+      'capabilities',
+      newValue.map((option) => option.value)
+    );
+  }
+}
+
+function Option(props: OptionProps<GpuOption, true>) {
+  const {
+    data: { value, description },
+  } = props;
+
+  return (
+    <div>
+      {/* eslint-disable-next-line react/jsx-props-no-spreading */}
+      <components.Option {...props}>
+        {`${value} - ${description}`}
+      </components.Option>
+    </div>
+  );
+}
+
+function MultiValueRemove(props: MultiValueRemoveProps<GpuOption, true>) {
+  const {
+    selectProps: { value },
+  } = props;
+  if (value && (value as MultiValue<GpuOption>).length === 1) {
+    return null;
+  }
+  // eslint-disable-next-line react/jsx-props-no-spreading
+  return <components.MultiValueRemove {...props} />;
+}
diff --git a/app/react/docker/containers/CreateView/ResourcesTab/GpuFieldset/index.ts b/app/react/docker/containers/CreateView/ResourcesTab/GpuFieldset/index.ts
new file mode 100644
index 0000000..9160ad6
--- /dev/null
+++ b/app/react/docker/containers/CreateView/ResourcesTab/GpuFieldset/index.ts
@@ -0,0 +1,14 @@
+import { validation } from './validation';
+import { toRequest } from './toRequest';
+import { toViewModel, getDefaultViewModel } from './toViewModel';
+
+export { GpuFieldset } from './GpuFieldset';
+
+export type { Values as GpuFieldsetValues } from './types';
+
+export const gpuFieldsetUtils = {
+  toRequest,
+  toViewModel,
+  validation,
+  getDefaultViewModel,
+};
diff --git a/app/react/docker/containers/CreateView/ResourcesTab/GpuFieldset/toRequest.ts b/app/react/docker/containers/CreateView/ResourcesTab/GpuFieldset/toRequest.ts
new file mode 100644
index 0000000..e0dcd2a
--- /dev/null
+++ b/app/react/docker/containers/CreateView/ResourcesTab/GpuFieldset/toRequest.ts
@@ -0,0 +1,33 @@
+import { DeviceRequest } from 'docker-types';
+
+import { Values } from './types';
+
+export function toRequest(
+  deviceRequests: Array<DeviceRequest>,
+  gpu: Values
+): Array<DeviceRequest> {
+  const driver = 'nvidia';
+
+  const otherDeviceRequests = deviceRequests.filter(
+    (deviceRequest) => deviceRequest.Driver !== driver
+  );
+
+  if (!gpu.enabled) {
+    return otherDeviceRequests;
+  }
+
+  const deviceRequest: DeviceRequest = {
+    Driver: driver,
+    Count: -1,
+    DeviceIDs: [], // must be empty if Count != 0 https://github.com/moby/moby/blob/master/daemon/nvidia_linux.go#L50
+    Capabilities: [], // array of ORed arrays of ANDed capabilites = [ [c1 AND c2] OR [c1 AND c3] ] : https://github.com/moby/moby/blob/master/api/types/container/host_config.go#L272
+  };
+
+  if (gpu.useSpecific) {
+    deviceRequest.DeviceIDs = gpu.selectedGPUs;
+    deviceRequest.Count = 0;
+  }
+  deviceRequest.Capabilities = [gpu.capabilities];
+
+  return [...otherDeviceRequests, deviceRequest];
+}
diff --git a/app/react/docker/containers/CreateView/ResourcesTab/GpuFieldset/toViewModel.ts b/app/react/docker/containers/CreateView/ResourcesTab/GpuFieldset/toViewModel.ts
new file mode 100644
index 0000000..9c3a722
--- /dev/null
+++ b/app/react/docker/containers/CreateView/ResourcesTab/GpuFieldset/toViewModel.ts
@@ -0,0 +1,30 @@
+import { DeviceRequest } from 'docker-types';
+
+import { Values } from './types';
+
+export function getDefaultViewModel(): Values {
+  return {
+    enabled: false,
+    useSpecific: false,
+    selectedGPUs: ['all'],
+    capabilities: ['compute', 'utility'],
+  };
+}
+
+export function toViewModel(deviceRequests: Array<DeviceRequest> = []): Values {
+  const deviceRequest = deviceRequests.find(
+    (o) => o.Driver === 'nvidia' || o.Capabilities?.[0]?.[0] === 'gpu'
+  );
+  if (!deviceRequest) {
+    return getDefaultViewModel();
+  }
+
+  const useSpecific = deviceRequest.Count !== -1;
+
+  return {
+    enabled: true,
+    useSpecific,
+    selectedGPUs: useSpecific ? deviceRequest.DeviceIDs || [] : ['all'],
+    capabilities: deviceRequest.Capabilities?.[0] || [],
+  };
+}
diff --git a/app/react/docker/containers/CreateView/ResourcesTab/GpuFieldset/types.ts b/app/react/docker/containers/CreateView/ResourcesTab/GpuFieldset/types.ts
new file mode 100644
index 0000000..7e8569e
--- /dev/null
+++ b/app/react/docker/containers/CreateView/ResourcesTab/GpuFieldset/types.ts
@@ -0,0 +1,6 @@
+export interface Values {
+  enabled: boolean;
+  useSpecific: boolean;
+  selectedGPUs: string[];
+  capabilities: string[];
+}
diff --git a/app/react/docker/containers/CreateView/ResourcesTab/GpuFieldset/validation.ts b/app/react/docker/containers/CreateView/ResourcesTab/GpuFieldset/validation.ts
new file mode 100644
index 0000000..ec01b5e
--- /dev/null
+++ b/app/react/docker/containers/CreateView/ResourcesTab/GpuFieldset/validation.ts
@@ -0,0 +1,14 @@
+import { SchemaOf, object, array, string, bool } from 'yup';
+
+import { Values } from './types';
+
+export function validation(): SchemaOf<Values> {
+  return object({
+    capabilities: array()
+      .of(string().default(''))
+      .default(['compute', 'utility']),
+    enabled: bool().default(false),
+    selectedGPUs: array().of(string()).default(['all']),
+    useSpecific: bool().default(false),
+  });
+}
diff --git a/app/react/docker/containers/CreateView/ResourcesTab/ResourcesFieldset.tsx b/app/react/docker/containers/CreateView/ResourcesTab/ResourcesFieldset.tsx
new file mode 100644
index 0000000..078d26e
--- /dev/null
+++ b/app/react/docker/containers/CreateView/ResourcesTab/ResourcesFieldset.tsx
@@ -0,0 +1,112 @@
+import { FormikErrors } from 'formik';
+import { object, SchemaOf } from 'yup';
+
+import { useSystemLimits } from '@/react/docker/proxy/queries/useInfo';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { nanNumberSchema } from '@/react-tools/yup-schemas';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { FormSection } from '@@/form-components/FormSection';
+import { Slider } from '@@/form-components/Slider';
+import { SliderWithInput } from '@@/form-components/Slider/SliderWithInput';
+
+import { CreateContainerRequest } from '../types';
+
+import { toConfigCpu, toConfigMemory } from './memory-utils';
+
+export interface Values {
+  reservation: number;
+  limit: number;
+  cpu: number;
+}
+
+export function ResourceFieldset({
+  values,
+  onChange,
+  errors,
+}: {
+  values: Values;
+  onChange: (values: Values) => void;
+  errors: FormikErrors<Values> | undefined;
+}) {
+  const environmentId = useEnvironmentId();
+  const { maxCpu, maxMemory } = useSystemLimits(environmentId);
+
+  return (
+    <FormSection title="Resources">
+      <FormControl label="Memory reservation (MB)" errors={errors?.reservation}>
+        <SliderWithInput
+          visibleTooltip
+          value={values.reservation}
+          onChange={(value) => onChange({ ...values, reservation: value })}
+          max={maxMemory}
+          step={256}
+          dataCy="k8sNamespaceCreate-resourceReservationMemory"
+        />
+      </FormControl>
+
+      <FormControl label="Memory limit (MB)" errors={errors?.limit}>
+        <SliderWithInput
+          visibleTooltip
+          value={values.limit}
+          onChange={(value) => onChange({ ...values, limit: value })}
+          max={maxMemory}
+          step={256}
+          dataCy="k8sNamespaceCreate-resourceLimitMemory"
+        />
+      </FormControl>
+
+      <FormControl label="Maximum CPU usage" errors={errors?.cpu}>
+        <Slider
+          visibleTooltip
+          value={values.cpu}
+          onChange={(value) =>
+            onChange({
+              ...values,
+              cpu: typeof value === 'number' ? value : value[0],
+            })
+          }
+          min={0}
+          max={maxCpu}
+          step={0.1}
+          dataCy="k8sNamespaceCreate-resourceCpu"
+        />
+      </FormControl>
+    </FormSection>
+  );
+}
+
+export function toRequest(
+  oldConfig: CreateContainerRequest['HostConfig'],
+  values: Values
+): CreateContainerRequest['HostConfig'] {
+  return {
+    ...oldConfig,
+    NanoCpus: toConfigCpu(values.cpu),
+    MemoryReservation: toConfigMemory(values.reservation),
+    Memory: toConfigMemory(values.limit),
+  };
+}
+
+export function resourcesValidation({
+  maxMemory = Number.POSITIVE_INFINITY,
+  maxCpu = Number.POSITIVE_INFINITY,
+}: {
+  maxMemory?: number;
+  maxCpu?: number;
+} = {}): SchemaOf<Values> {
+  return object({
+    reservation: nanNumberSchema()
+      .min(0)
+      .max(maxMemory, `Value must be between 0 and ${maxMemory}`)
+      .default(0),
+    limit: nanNumberSchema()
+      .min(0)
+      .max(maxMemory, `Value must be between 0 and ${maxMemory}`)
+      .default(0),
+    cpu: nanNumberSchema()
+      .min(0)
+      .max(maxCpu, `Value must be between 0 and ${maxCpu}`)
+      .default(0),
+  });
+}
diff --git a/app/react/docker/containers/CreateView/ResourcesTab/ResourcesTab.tsx b/app/react/docker/containers/CreateView/ResourcesTab/ResourcesTab.tsx
new file mode 100644
index 0000000..50c380a
--- /dev/null
+++ b/app/react/docker/containers/CreateView/ResourcesTab/ResourcesTab.tsx
@@ -0,0 +1,143 @@
+import _ from 'lodash';
+import { FormikErrors } from 'formik';
+import { ReactNode } from 'react';
+
+import { useIsStandalone } from '@/react/docker/proxy/queries/useInfo';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useCurrentEnvironment } from '@/react/hooks/useCurrentEnvironment';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+
+import { GpuFieldset, GpuFieldsetValues } from './GpuFieldset';
+import { Values as RuntimeValues, RuntimeSection } from './RuntimeSection';
+import { DevicesField, Values as Devices } from './DevicesField';
+import { SysctlsField, Values as Sysctls } from './SysctlsField';
+import { SecurityOptField, Values as SecurityOpt } from './SecurityOptField';
+import {
+  ResourceFieldset,
+  Values as ResourcesValues,
+} from './ResourcesFieldset';
+
+export interface Values {
+  runtime: RuntimeValues;
+
+  devices: Devices;
+
+  sysctls: Sysctls;
+  securityOpt: SecurityOpt;
+
+  sharedMemorySize: number;
+
+  gpu: GpuFieldsetValues;
+
+  resources: ResourcesValues;
+}
+
+export function ResourcesTab({
+  values,
+  setFieldValue,
+  errors,
+  allowPrivilegedMode,
+  isInitFieldVisible,
+  isDevicesFieldVisible,
+  isSysctlFieldVisible,
+  isSecurityOptFieldVisible,
+  renderLimits,
+}: {
+  values: Values;
+  setFieldValue: (field: string, value: unknown) => void;
+  errors?: FormikErrors<Values>;
+  allowPrivilegedMode: boolean;
+  isInitFieldVisible: boolean;
+  isDevicesFieldVisible: boolean;
+  isSysctlFieldVisible: boolean;
+  isSecurityOptFieldVisible: boolean;
+  renderLimits?: (values: ResourcesValues) => ReactNode;
+}) {
+  const environmentId = useEnvironmentId();
+
+  const environmentQuery = useCurrentEnvironment();
+
+  const isStandalone = useIsStandalone(environmentId);
+
+  if (!environmentQuery.data) {
+    return null;
+  }
+
+  const environment = environmentQuery.data;
+  const gpuUseAll = _.get(environment, 'Snapshots[0].GpuUseAll', false);
+  const gpuUseList = _.get(environment, 'Snapshots[0].GpuUseList', []);
+
+  return (
+    <div className="mt-3">
+      <RuntimeSection
+        values={values.runtime}
+        onChange={(runtime) => setFieldValue('runtime', runtime)}
+        allowPrivilegedMode={allowPrivilegedMode}
+        isInitFieldVisible={isInitFieldVisible}
+      />
+
+      {isDevicesFieldVisible && (
+        <DevicesField
+          values={values.devices}
+          onChange={(devices) => setFieldValue('devices', devices)}
+        />
+      )}
+
+      {isSysctlFieldVisible && (
+        <SysctlsField
+          values={values.sysctls}
+          onChange={(sysctls) => setFieldValue('sysctls', sysctls)}
+        />
+      )}
+
+      {isSecurityOptFieldVisible && (
+        <SecurityOptField
+          values={values.securityOpt}
+          onChange={(securityOpt) => setFieldValue('securityOpt', securityOpt)}
+        />
+      )}
+
+      <FormControl label="Shared memory size" inputId="shm-size">
+        <div className="flex items-center gap-4">
+          <Input
+            id="shm-size"
+            type="number"
+            min="1"
+            value={values.sharedMemorySize}
+            onChange={(e) =>
+              setFieldValue('sharedMemorySize', e.target.valueAsNumber)
+            }
+            className="w-32"
+            data-cy="shared-memory-size"
+          />
+          <div className="small text-muted">
+            Size of /dev/shm (<b>MB</b>)
+          </div>
+        </div>
+      </FormControl>
+
+      {isStandalone && (
+        <GpuFieldset
+          values={values.gpu}
+          onChange={(gpu) => setFieldValue('gpu', gpu)}
+          gpus={environment.Gpus || []}
+          enableGpuManagement={environment.EnableGPUManagement}
+          usedGpus={gpuUseList}
+          usedAllGpus={gpuUseAll}
+        />
+      )}
+
+      {renderLimits ? (
+        renderLimits(values.resources)
+      ) : (
+        <ResourceFieldset
+          values={values.resources}
+          onChange={(resources) => setFieldValue('resources', resources)}
+          errors={errors?.resources}
+        />
+      )}
+    </div>
+  );
+}
diff --git a/app/react/docker/containers/CreateView/ResourcesTab/RuntimeSection.tsx b/app/react/docker/containers/CreateView/ResourcesTab/RuntimeSection.tsx
new file mode 100644
index 0000000..17a4250
--- /dev/null
+++ b/app/react/docker/containers/CreateView/ResourcesTab/RuntimeSection.tsx
@@ -0,0 +1,76 @@
+import { bool, object, SchemaOf, string } from 'yup';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { FormSection } from '@@/form-components/FormSection';
+import { SwitchField } from '@@/form-components/SwitchField';
+
+import { RuntimeSelector } from './RuntimeSelector';
+
+export interface Values {
+  privileged: boolean;
+  init: boolean;
+  type: string;
+}
+
+export function RuntimeSection({
+  values,
+  onChange,
+  allowPrivilegedMode,
+  isInitFieldVisible,
+}: {
+  values: Values;
+  onChange: (values: Values) => void;
+  allowPrivilegedMode: boolean;
+  isInitFieldVisible: boolean;
+}) {
+  return (
+    <FormSection title="Runtime">
+      {allowPrivilegedMode && (
+        <div className="form-group">
+          <div className="col-sm-12">
+            <SwitchField
+              labelClass="col-sm-2"
+              data-cy="docker-privileged-switch"
+              label="Privileged mode"
+              checked={values.privileged}
+              onChange={(privileged) => handleChange({ privileged })}
+            />
+          </div>
+        </div>
+      )}
+
+      {isInitFieldVisible && (
+        <div className="form-group">
+          <div className="col-sm-12">
+            <SwitchField
+              labelClass="col-sm-2"
+              data-cy="docker-init-switch"
+              label="Init"
+              checked={values.init}
+              onChange={(init) => handleChange({ init })}
+            />
+          </div>
+        </div>
+      )}
+
+      <FormControl label="Type" inputId="container_runtime" size="xsmall">
+        <RuntimeSelector
+          value={values.type}
+          onChange={(type) => handleChange({ type })}
+        />
+      </FormControl>
+    </FormSection>
+  );
+
+  function handleChange(newValues: Partial<Values>) {
+    onChange({ ...values, ...newValues });
+  }
+}
+
+export function runtimeValidation(): SchemaOf<Values> {
+  return object({
+    privileged: bool().default(false),
+    init: bool().default(false),
+    type: string().default(''),
+  });
+}
diff --git a/app/react/docker/containers/CreateView/ResourcesTab/RuntimeSelector.tsx b/app/react/docker/containers/CreateView/ResourcesTab/RuntimeSelector.tsx
new file mode 100644
index 0000000..b536308
--- /dev/null
+++ b/app/react/docker/containers/CreateView/ResourcesTab/RuntimeSelector.tsx
@@ -0,0 +1,34 @@
+import { useInfo } from '@/react/docker/proxy/queries/useInfo';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+
+import { PortainerSelect } from '@@/form-components/PortainerSelect';
+
+export function RuntimeSelector({
+  value,
+  onChange,
+}: {
+  value: string;
+  onChange: (value: string) => void;
+}) {
+  const environmentId = useEnvironmentId();
+  const infoQuery = useInfo(environmentId, {
+    select: (info) => [
+      { label: 'Default', value: '' },
+      ...Object.keys(info?.Runtimes || {}).map((runtime) => ({
+        label: runtime,
+        value: runtime,
+      })),
+    ],
+  });
+
+  return (
+    <PortainerSelect
+      onChange={onChange}
+      value={value}
+      options={infoQuery.data || []}
+      isLoading={infoQuery.isLoading}
+      disabled={infoQuery.isLoading}
+      data-cy="docker-runtime-selector"
+    />
+  );
+}
diff --git a/app/react/docker/containers/CreateView/ResourcesTab/SecurityOptField.tsx b/app/react/docker/containers/CreateView/ResourcesTab/SecurityOptField.tsx
new file mode 100644
index 0000000..4e9f9c4
--- /dev/null
+++ b/app/react/docker/containers/CreateView/ResourcesTab/SecurityOptField.tsx
@@ -0,0 +1,58 @@
+import { FormikErrors } from 'formik';
+import { array, SchemaOf, string } from 'yup';
+
+import { FormError } from '@@/form-components/FormError';
+import { InputList, ItemProps } from '@@/form-components/InputList';
+import { InputLabeled } from '@@/form-components/Input/InputLabeled';
+
+export type Values = Array<string>;
+
+export function SecurityOptField({
+  values,
+  onChange,
+  errors,
+}: {
+  values: Values;
+  onChange: (value: Values) => void;
+  errors?: FormikErrors<string>[];
+}) {
+  return (
+    <InputList
+      value={values}
+      onChange={onChange}
+      item={Item}
+      addLabel="Add security-opt"
+      label="SecurityOpt"
+      errors={errors}
+      itemBuilder={() => ''}
+      data-cy="docker-container-securityopts"
+    />
+  );
+}
+
+function Item({ item, onChange, error, index }: ItemProps<string>) {
+  return (
+    <div className="w-full">
+      <div className="flex w-full gap-4">
+        <InputLabeled
+          value={item}
+          onChange={(e) => onChange(e.target.value)}
+          label="Security Option"
+          placeholder="e.g. seccomp=unconfined"
+          className="w-full"
+          size="small"
+          data-cy={`docker-container-securityopt-name_${index}`}
+        />
+      </div>
+      {error && (
+        <FormError>
+          {typeof error === 'string' ? error : Object.values(error)[0]}
+        </FormError>
+      )}
+    </div>
+  );
+}
+
+export function securityOptValidation(): SchemaOf<Values> {
+  return array(string().required('Security option is required'));
+}
diff --git a/app/react/docker/containers/CreateView/ResourcesTab/SysctlsField.tsx b/app/react/docker/containers/CreateView/ResourcesTab/SysctlsField.tsx
new file mode 100644
index 0000000..8180daf
--- /dev/null
+++ b/app/react/docker/containers/CreateView/ResourcesTab/SysctlsField.tsx
@@ -0,0 +1,73 @@
+import { FormikErrors } from 'formik';
+import { array, object, SchemaOf, string } from 'yup';
+
+import { FormError } from '@@/form-components/FormError';
+import { InputList, ItemProps } from '@@/form-components/InputList';
+import { InputLabeled } from '@@/form-components/Input/InputLabeled';
+
+interface Sysctls {
+  name: string;
+  value: string;
+}
+
+export type Values = Array<Sysctls>;
+
+export function SysctlsField({
+  values,
+  onChange,
+  errors,
+}: {
+  values: Values;
+  onChange: (value: Values) => void;
+  errors?: FormikErrors<Sysctls>[];
+}) {
+  return (
+    <InputList
+      value={values}
+      onChange={onChange}
+      item={Item}
+      addLabel="Add sysctl"
+      label="Sysctls"
+      errors={errors}
+      itemBuilder={() => ({ name: '', value: '' })}
+      data-cy="docker-container-sysctls"
+    />
+  );
+}
+
+function Item({ item, onChange, error, index }: ItemProps<Sysctls>) {
+  return (
+    <div className="w-full">
+      <div className="flex w-full gap-4">
+        <InputLabeled
+          value={item.name}
+          onChange={(e) => onChange({ ...item, name: e.target.value })}
+          label="name"
+          placeholder="e.g. FOO"
+          className="w-1/2"
+          size="small"
+          data-cy={`docker-container-sysctl-name_${index}`}
+        />
+        <InputLabeled
+          value={item.value}
+          onChange={(e) => onChange({ ...item, value: e.target.value })}
+          label="value"
+          placeholder="e.g. bar"
+          className="w-1/2"
+          size="small"
+          data-cy={`docker-container-sysctl-value_${index}`}
+        />
+      </div>
+      {error && <FormError>{Object.values(error)[0]}</FormError>}
+    </div>
+  );
+}
+
+export function sysctlsValidation(): SchemaOf<Values> {
+  return array(
+    object({
+      name: string().required('Name is required'),
+      value: string().required('Value is required'),
+    })
+  );
+}
diff --git a/app/react/docker/containers/CreateView/ResourcesTab/index.ts b/app/react/docker/containers/CreateView/ResourcesTab/index.ts
new file mode 100644
index 0000000..95c4cc2
--- /dev/null
+++ b/app/react/docker/containers/CreateView/ResourcesTab/index.ts
@@ -0,0 +1,15 @@
+import { validation } from './validation';
+import { toRequest } from './toRequest';
+import { toViewModel, getDefaultViewModel } from './toViewModel';
+
+export {
+  ResourcesTab,
+  type Values as ResourcesTabValues,
+} from './ResourcesTab';
+
+export const resourcesTabUtils = {
+  toRequest,
+  toViewModel,
+  validation,
+  getDefaultViewModel,
+};
diff --git a/app/react/docker/containers/CreateView/ResourcesTab/memory-utils.ts b/app/react/docker/containers/CreateView/ResourcesTab/memory-utils.ts
new file mode 100644
index 0000000..f6a5f6c
--- /dev/null
+++ b/app/react/docker/containers/CreateView/ResourcesTab/memory-utils.ts
@@ -0,0 +1,36 @@
+export function toConfigMemory(value: number): number {
+  if (value < 0) {
+    return 0;
+  }
+
+  return round(Math.round(value * 8) / 8, 3) * 1024 * 1024;
+}
+
+export function toViewModelMemory(value = 0): number {
+  if (value < 0) {
+    return 0;
+  }
+
+  return value / 1024 / 1024;
+}
+
+export function round(value: number, decimals: number) {
+  const tenth = 10 ** decimals;
+  return Math.round((value + Number.EPSILON) * tenth) / tenth;
+}
+
+export function toViewModelCpu(value = 0) {
+  if (value < 0) {
+    return 0;
+  }
+
+  return value / 1000000000;
+}
+
+export function toConfigCpu(value: number) {
+  if (value < 0) {
+    return 0;
+  }
+
+  return value * 1000000000;
+}
diff --git a/app/react/docker/containers/CreateView/ResourcesTab/toRequest.ts b/app/react/docker/containers/CreateView/ResourcesTab/toRequest.ts
new file mode 100644
index 0000000..2c6b59b
--- /dev/null
+++ b/app/react/docker/containers/CreateView/ResourcesTab/toRequest.ts
@@ -0,0 +1,36 @@
+import { CreateContainerRequest } from '../types';
+
+import { gpuFieldsetUtils } from './GpuFieldset';
+import { toConfigMemory } from './memory-utils';
+import { Values } from './ResourcesTab';
+import { toRequest as toResourcesRequest } from './ResourcesFieldset';
+
+export function toRequest(
+  oldConfig: CreateContainerRequest,
+  values: Values
+): CreateContainerRequest {
+  return {
+    ...oldConfig,
+    HostConfig: {
+      ...oldConfig.HostConfig,
+      Privileged: values.runtime.privileged,
+      Init: values.runtime.init,
+      Runtime: values.runtime.type,
+      Devices: values.devices.map((device) => ({
+        PathOnHost: device.pathOnHost,
+        PathInContainer: device.pathInContainer,
+        CgroupPermissions: 'rwm',
+      })),
+      Sysctls: Object.fromEntries(
+        values.sysctls.map((sysctl) => [sysctl.name, sysctl.value])
+      ),
+      SecurityOpt: values.securityOpt,
+      ShmSize: toConfigMemory(values.sharedMemorySize),
+      DeviceRequests: gpuFieldsetUtils.toRequest(
+        oldConfig.HostConfig.DeviceRequests || [],
+        values.gpu
+      ),
+      ...toResourcesRequest(oldConfig.HostConfig, values.resources),
+    },
+  };
+}
diff --git a/app/react/docker/containers/CreateView/ResourcesTab/toViewModel.ts b/app/react/docker/containers/CreateView/ResourcesTab/toViewModel.ts
new file mode 100644
index 0000000..c512890
--- /dev/null
+++ b/app/react/docker/containers/CreateView/ResourcesTab/toViewModel.ts
@@ -0,0 +1,51 @@
+import { ContainerDetailsJSON } from '../../queries/useContainer';
+
+import { toDevicesViewModel } from './DevicesField';
+import { gpuFieldsetUtils } from './GpuFieldset';
+import { toViewModelCpu, toViewModelMemory } from './memory-utils';
+import { Values } from './ResourcesTab';
+
+export function toViewModel(config: ContainerDetailsJSON): Values {
+  return {
+    runtime: {
+      privileged: config.HostConfig?.Privileged || false,
+      init: config.HostConfig?.Init || false,
+      type: config.HostConfig?.Runtime || '',
+    },
+    devices: toDevicesViewModel(config.HostConfig?.Devices || []),
+    sysctls: Object.entries(config.HostConfig?.Sysctls || {}).map(
+      ([name, value]) => ({
+        name,
+        value,
+      })
+    ),
+    securityOpt: config.HostConfig?.SecurityOpt || [],
+    gpu: gpuFieldsetUtils.toViewModel(config.HostConfig?.DeviceRequests || []),
+    sharedMemorySize: toViewModelMemory(config.HostConfig?.ShmSize),
+    resources: {
+      cpu: toViewModelCpu(config.HostConfig?.NanoCpus),
+      reservation: toViewModelMemory(config.HostConfig?.MemoryReservation),
+      limit: toViewModelMemory(config.HostConfig?.Memory),
+    },
+  };
+}
+
+export function getDefaultViewModel(): Values {
+  return {
+    runtime: {
+      privileged: false,
+      init: false,
+      type: '',
+    },
+    devices: [],
+    sysctls: [],
+    securityOpt: [],
+    sharedMemorySize: 64,
+    gpu: gpuFieldsetUtils.getDefaultViewModel(),
+    resources: {
+      reservation: 0,
+      limit: 0,
+      cpu: 0,
+    },
+  };
+}
diff --git a/app/react/docker/containers/CreateView/ResourcesTab/validation.ts b/app/react/docker/containers/CreateView/ResourcesTab/validation.ts
new file mode 100644
index 0000000..2255281
--- /dev/null
+++ b/app/react/docker/containers/CreateView/ResourcesTab/validation.ts
@@ -0,0 +1,27 @@
+import { number, object, SchemaOf } from 'yup';
+
+import { devicesValidation } from './DevicesField';
+import { gpuFieldsetUtils } from './GpuFieldset';
+import { resourcesValidation } from './ResourcesFieldset';
+import { Values } from './ResourcesTab';
+import { runtimeValidation } from './RuntimeSection';
+import { sysctlsValidation } from './SysctlsField';
+import { securityOptValidation } from './SecurityOptField';
+
+export function validation({
+  maxMemory,
+  maxCpu,
+}: {
+  maxMemory?: number;
+  maxCpu?: number;
+} = {}): SchemaOf<Values> {
+  return object({
+    runtime: runtimeValidation(),
+    devices: devicesValidation(),
+    sysctls: sysctlsValidation(),
+    securityOpt: securityOptValidation(),
+    sharedMemorySize: number().min(0).default(0),
+    gpu: gpuFieldsetUtils.validation(),
+    resources: resourcesValidation({ maxMemory, maxCpu }),
+  });
+}
diff --git a/app/react/docker/containers/CreateView/RestartPolicyTab/RestartPolicyTab.tsx b/app/react/docker/containers/CreateView/RestartPolicyTab/RestartPolicyTab.tsx
new file mode 100644
index 0000000..b4dae33
--- /dev/null
+++ b/app/react/docker/containers/CreateView/RestartPolicyTab/RestartPolicyTab.tsx
@@ -0,0 +1,27 @@
+import { ButtonSelector } from '@@/form-components/ButtonSelector/ButtonSelector';
+import { FormControl } from '@@/form-components/FormControl';
+
+import { RestartPolicy } from './types';
+
+export function RestartPolicyTab({
+  values,
+  onChange,
+}: {
+  values: RestartPolicy;
+  onChange: (values: RestartPolicy) => void;
+}) {
+  return (
+    <FormControl label="Restart Policy">
+      <ButtonSelector
+        options={[
+          { label: 'Never', value: RestartPolicy.No },
+          { label: 'Always', value: RestartPolicy.Always },
+          { label: 'On failure', value: RestartPolicy.OnFailure },
+          { label: 'Unless stopped', value: RestartPolicy.UnlessStopped },
+        ]}
+        value={values}
+        onChange={onChange}
+      />
+    </FormControl>
+  );
+}
diff --git a/app/react/docker/containers/CreateView/RestartPolicyTab/index.ts b/app/react/docker/containers/CreateView/RestartPolicyTab/index.ts
new file mode 100644
index 0000000..fbe7004
--- /dev/null
+++ b/app/react/docker/containers/CreateView/RestartPolicyTab/index.ts
@@ -0,0 +1,13 @@
+import { validation } from './validation';
+import { toViewModel, getDefaultViewModel } from './toViewModel';
+import { toRequest } from './toRequest';
+
+export { RestartPolicyTab } from './RestartPolicyTab';
+export { RestartPolicy } from './types';
+
+export const restartPolicyTabUtils = {
+  toViewModel,
+  toRequest,
+  validation,
+  getDefaultViewModel,
+};
diff --git a/app/react/docker/containers/CreateView/RestartPolicyTab/toRequest.ts b/app/react/docker/containers/CreateView/RestartPolicyTab/toRequest.ts
new file mode 100644
index 0000000..3afad03
--- /dev/null
+++ b/app/react/docker/containers/CreateView/RestartPolicyTab/toRequest.ts
@@ -0,0 +1,19 @@
+import { CreateContainerRequest } from '../types';
+
+import { RestartPolicy } from './types';
+
+export function toRequest(
+  config: CreateContainerRequest,
+  value: RestartPolicy
+): CreateContainerRequest {
+  return {
+    ...config,
+    HostConfig: {
+      ...config.HostConfig,
+      RestartPolicy: {
+        ...config.HostConfig.RestartPolicy,
+        Name: value,
+      },
+    },
+  };
+}
diff --git a/app/react/docker/containers/CreateView/RestartPolicyTab/toViewModel.ts b/app/react/docker/containers/CreateView/RestartPolicyTab/toViewModel.ts
new file mode 100644
index 0000000..bdd8a34
--- /dev/null
+++ b/app/react/docker/containers/CreateView/RestartPolicyTab/toViewModel.ts
@@ -0,0 +1,21 @@
+import { ContainerDetailsJSON } from '../../queries/useContainer';
+
+import { RestartPolicy } from './types';
+
+export function toViewModel(config: ContainerDetailsJSON): RestartPolicy {
+  switch (config.HostConfig?.RestartPolicy?.Name) {
+    case 'always':
+      return RestartPolicy.Always;
+    case 'on-failure':
+      return RestartPolicy.OnFailure;
+    case 'unless-stopped':
+      return RestartPolicy.UnlessStopped;
+    case 'no':
+    default:
+      return RestartPolicy.No;
+  }
+}
+
+export function getDefaultViewModel(): RestartPolicy {
+  return RestartPolicy.No;
+}
diff --git a/app/react/docker/containers/CreateView/RestartPolicyTab/types.ts b/app/react/docker/containers/CreateView/RestartPolicyTab/types.ts
new file mode 100644
index 0000000..d919ee3
--- /dev/null
+++ b/app/react/docker/containers/CreateView/RestartPolicyTab/types.ts
@@ -0,0 +1,7 @@
+// Enum version of RestartPolicy
+export enum RestartPolicy {
+  No = 'no',
+  Always = 'always',
+  OnFailure = 'on-failure',
+  UnlessStopped = 'unless-stopped',
+}
diff --git a/app/react/docker/containers/CreateView/RestartPolicyTab/validation.ts b/app/react/docker/containers/CreateView/RestartPolicyTab/validation.ts
new file mode 100644
index 0000000..e3b275e
--- /dev/null
+++ b/app/react/docker/containers/CreateView/RestartPolicyTab/validation.ts
@@ -0,0 +1,9 @@
+import { mixed, SchemaOf } from 'yup';
+
+import { RestartPolicy } from './types';
+
+export function validation(): SchemaOf<RestartPolicy> {
+  return mixed<RestartPolicy>()
+    .oneOf(Object.values(RestartPolicy))
+    .default(RestartPolicy.No) as SchemaOf<RestartPolicy>;
+}
diff --git a/app/react/docker/containers/CreateView/VolumesTab/Item.tsx b/app/react/docker/containers/CreateView/VolumesTab/Item.tsx
new file mode 100644
index 0000000..22f3b26
--- /dev/null
+++ b/app/react/docker/containers/CreateView/VolumesTab/Item.tsx
@@ -0,0 +1,101 @@
+import _ from 'lodash';
+import { ArrowRight } from 'lucide-react';
+
+import { Icon } from '@@/Icon';
+import { ButtonSelector } from '@@/form-components/ButtonSelector/ButtonSelector';
+import { FormError } from '@@/form-components/FormError';
+import { InputGroup } from '@@/form-components/InputGroup';
+import { ItemProps } from '@@/form-components/InputList';
+import { InputLabeled } from '@@/form-components/Input/InputLabeled';
+
+import { Volume } from './types';
+import { useInputContext } from './context';
+import { VolumeSelector } from './VolumeSelector';
+
+export function Item({
+  item: volume,
+  onChange,
+  error,
+  index,
+}: ItemProps<Volume>) {
+  const { allowBindMounts, allowAuto } = useInputContext();
+
+  return (
+    <div>
+      <div className="col-sm-12 form-inline flex gap-1">
+        <InputLabeled
+          label="container"
+          placeholder="e.g. /path/in/container"
+          value={volume.containerPath}
+          onChange={(e) => setValue({ containerPath: e.target.value })}
+          size="small"
+          className="flex-1"
+          id={`container-path-${index}`}
+          data-cy={`container-path_${index}`}
+        />
+
+        {allowBindMounts && (
+          <InputGroup size="small">
+            <ButtonSelector
+              value={volume.type}
+              onChange={(type) => {
+                onChange({ ...volume, type, name: '' });
+              }}
+              options={[
+                { value: 'volume', label: 'Volume' },
+                { value: 'bind', label: 'Bind' },
+              ]}
+              aria-label="Volume type"
+            />
+          </InputGroup>
+        )}
+      </div>
+      <div className="col-sm-12 form-inline mt-1 flex items-center gap-1">
+        <Icon icon={ArrowRight} />
+        {volume.type === 'volume' && (
+          <InputGroup size="small" className="flex-1">
+            <InputGroup.Addon as="label" htmlFor={`volume-${index}`}>
+              volume
+            </InputGroup.Addon>
+            <VolumeSelector
+              value={volume.name}
+              onChange={(name) => setValue({ name })}
+              inputId={`volume-${index}`}
+              allowAuto={allowAuto}
+            />
+          </InputGroup>
+        )}
+
+        {volume.type === 'bind' && (
+          <InputLabeled
+            size="small"
+            className="flex-1"
+            label="host"
+            placeholder="e.g. /path/on/host"
+            value={volume.name}
+            onChange={(e) => setValue({ name: e.target.value })}
+            id={`host-path-${index}`}
+            data-cy={`host-path_${index}`}
+          />
+        )}
+
+        <InputGroup size="small">
+          <ButtonSelector<boolean>
+            aria-label="ReadWrite"
+            value={volume.readOnly}
+            onChange={(readOnly) => setValue({ readOnly })}
+            options={[
+              { value: false, label: 'Writable' },
+              { value: true, label: 'Read-only' },
+            ]}
+          />
+        </InputGroup>
+      </div>
+      {error && <FormError>{_.first(Object.values(error))}</FormError>}
+    </div>
+  );
+
+  function setValue(partial: Partial<Volume>) {
+    onChange({ ...volume, ...partial });
+  }
+}
diff --git a/app/react/docker/containers/CreateView/VolumesTab/VolumeSelector.tsx b/app/react/docker/containers/CreateView/VolumesTab/VolumeSelector.tsx
new file mode 100644
index 0000000..40ccdd1
--- /dev/null
+++ b/app/react/docker/containers/CreateView/VolumesTab/VolumeSelector.tsx
@@ -0,0 +1,68 @@
+import { components, OptionProps } from 'react-select';
+
+import { truncate } from '@/portainer/filters/filters';
+import { useVolumes } from '@/react/docker/volumes/queries/useVolumes';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+
+import { Select } from '@@/form-components/ReactSelect';
+
+export function VolumeSelector({
+  value,
+  onChange,
+  inputId,
+  allowAuto,
+}: {
+  value: string;
+  onChange: (value?: string) => void;
+  inputId?: string;
+  allowAuto: boolean;
+}) {
+  const environmentId = useEnvironmentId();
+  const volumesQuery = useVolumes(environmentId, {
+    select(volumes) {
+      return volumes.sort((vol1, vol2) => vol1.Name.localeCompare(vol2.Name));
+    },
+  });
+
+  const initialVolumes = volumesQuery.data || [];
+
+  const volumes = allowAuto
+    ? [...initialVolumes, { Name: 'auto', Driver: '' }]
+    : initialVolumes;
+
+  const selectedValue = volumes.find((vol) => vol.Name === value);
+  return (
+    <Select
+      placeholder="Select a volume"
+      options={volumes}
+      getOptionLabel={(vol) =>
+        vol.Name !== 'auto'
+          ? `${truncate(vol.Name, 30)} - ${truncate(vol.Driver, 30)}`
+          : 'auto'
+      }
+      getOptionValue={(vol) => vol.Name}
+      isMulti={false}
+      value={selectedValue}
+      onChange={(vol) => onChange(vol?.Name)}
+      inputId={inputId}
+      data-cy="docker-containers-volume-selector"
+      id="docker-containers-volume-selector"
+      size="sm"
+      components={{ Option }}
+    />
+  );
+}
+
+function Option(props: OptionProps<{ Name: string; Driver: string }, false>) {
+  const { data: vol } = props;
+  return (
+    // eslint-disable-next-line react/jsx-props-no-spreading
+    <components.Option {...props}>
+      <span title={`${vol.Name} - ${vol.Driver}`}>
+        {vol.Name !== 'auto'
+          ? `${truncate(vol.Name, 30)} - ${truncate(vol.Driver, 30)}`
+          : 'auto'}
+      </span>
+    </components.Option>
+  );
+}
diff --git a/app/react/docker/containers/CreateView/VolumesTab/VolumesTab.tsx b/app/react/docker/containers/CreateView/VolumesTab/VolumesTab.tsx
new file mode 100644
index 0000000..4d5ff34
--- /dev/null
+++ b/app/react/docker/containers/CreateView/VolumesTab/VolumesTab.tsx
@@ -0,0 +1,60 @@
+import { useMemo } from 'react';
+
+import { useIsEnvironmentAdmin } from '@/react/hooks/useUser';
+import { useCurrentEnvironment } from '@/react/hooks/useCurrentEnvironment';
+
+import { InputList } from '@@/form-components/InputList';
+import { ArrayError } from '@@/form-components/InputList/InputList';
+
+import { Values, Volume } from './types';
+import { InputContext } from './context';
+import { Item } from './Item';
+
+export function VolumesTab({
+  onChange,
+  values,
+  errors,
+  allowAuto = false,
+}: {
+  onChange: (values: Values) => void;
+  values: Values;
+  errors?: ArrayError<Values>;
+  allowAuto?: boolean;
+}) {
+  const isEnvironmentAdminQuery = useIsEnvironmentAdmin({ adminOnlyCE: true });
+  const envQuery = useCurrentEnvironment();
+
+  const allowBindMounts = !!(
+    isEnvironmentAdminQuery.authorized ||
+    envQuery.data?.SecuritySettings.allowBindMountsForRegularUsers
+  );
+
+  const inputContext = useMemo(
+    () => ({ allowBindMounts, allowAuto }),
+    [allowAuto, allowBindMounts]
+  );
+
+  return (
+    <InputContext.Provider value={inputContext}>
+      <InputList<Volume>
+        errors={Array.isArray(errors) ? errors : []}
+        label="Volume mapping"
+        onChange={(volumes) => handleChange(volumes)}
+        value={values}
+        addLabel="map additional volume"
+        item={Item}
+        itemBuilder={() => ({
+          containerPath: '',
+          type: 'volume',
+          name: '',
+          readOnly: false,
+        })}
+        data-cy="docker-container-volumes"
+      />
+    </InputContext.Provider>
+  );
+
+  function handleChange(newValues: Values) {
+    onChange(newValues);
+  }
+}
diff --git a/app/react/docker/containers/CreateView/VolumesTab/context.ts b/app/react/docker/containers/CreateView/VolumesTab/context.ts
new file mode 100644
index 0000000..52d6f76
--- /dev/null
+++ b/app/react/docker/containers/CreateView/VolumesTab/context.ts
@@ -0,0 +1,16 @@
+import { createContext, useContext } from 'react';
+
+export const InputContext = createContext<{
+  allowAuto: boolean;
+  allowBindMounts: boolean;
+} | null>(null);
+
+export function useInputContext() {
+  const value = useContext(InputContext);
+
+  if (value === null) {
+    throw new Error('useContext must be used within a Context.Provider');
+  }
+
+  return value;
+}
diff --git a/app/react/docker/containers/CreateView/VolumesTab/index.ts b/app/react/docker/containers/CreateView/VolumesTab/index.ts
new file mode 100644
index 0000000..d4a18c8
--- /dev/null
+++ b/app/react/docker/containers/CreateView/VolumesTab/index.ts
@@ -0,0 +1,14 @@
+import { validation } from './validation';
+import { toRequest } from './toRequest';
+import { toViewModel, getDefaultViewModel } from './toViewModel';
+
+export { VolumesTab } from './VolumesTab';
+
+export { type Values as VolumesTabValues } from './types';
+
+export const volumesTabUtils = {
+  toRequest,
+  toViewModel,
+  validation,
+  getDefaultViewModel,
+};
diff --git a/app/react/docker/containers/CreateView/VolumesTab/toRequest.ts b/app/react/docker/containers/CreateView/VolumesTab/toRequest.ts
new file mode 100644
index 0000000..4424b5d
--- /dev/null
+++ b/app/react/docker/containers/CreateView/VolumesTab/toRequest.ts
@@ -0,0 +1,33 @@
+import { CreateContainerRequest } from '../types';
+
+import { Values } from './types';
+
+export function toRequest(
+  oldConfig: CreateContainerRequest,
+  values: Values
+): CreateContainerRequest {
+  const validValues = values.filter(
+    (volume) => volume.containerPath && volume.name
+  );
+
+  const volumes = Object.fromEntries(
+    validValues.map((volume) => [volume.containerPath, {}])
+  );
+  const binds = validValues.map((volume) => {
+    let bind = `${volume.name}:${volume.containerPath}`;
+    if (volume.readOnly) {
+      bind += ':ro';
+    }
+
+    return bind;
+  });
+
+  return {
+    ...oldConfig,
+    Volumes: volumes,
+    HostConfig: {
+      ...oldConfig.HostConfig,
+      Binds: binds,
+    },
+  };
+}
diff --git a/app/react/docker/containers/CreateView/VolumesTab/toViewModel.ts b/app/react/docker/containers/CreateView/VolumesTab/toViewModel.ts
new file mode 100644
index 0000000..660b696
--- /dev/null
+++ b/app/react/docker/containers/CreateView/VolumesTab/toViewModel.ts
@@ -0,0 +1,16 @@
+import { ContainerDetailsJSON } from '../../queries/useContainer';
+
+import { VolumeType, Values } from './types';
+
+export function toViewModel(config: ContainerDetailsJSON): Values {
+  return Object.values(config.Mounts || {}).map((mount) => ({
+    type: (mount.Type || 'volume') as VolumeType,
+    name: mount.Name || mount.Source || '',
+    containerPath: mount.Destination || '',
+    readOnly: mount.RW === false,
+  }));
+}
+
+export function getDefaultViewModel(): Values {
+  return [];
+}
diff --git a/app/react/docker/containers/CreateView/VolumesTab/types.ts b/app/react/docker/containers/CreateView/VolumesTab/types.ts
new file mode 100644
index 0000000..bea0808
--- /dev/null
+++ b/app/react/docker/containers/CreateView/VolumesTab/types.ts
@@ -0,0 +1,12 @@
+export const volumeTypes = ['bind', 'volume'] as const;
+
+export type VolumeType = (typeof volumeTypes)[number];
+
+export interface Volume {
+  containerPath: string;
+  type: VolumeType;
+  name: string;
+  readOnly: boolean;
+}
+
+export type Values = Array<Volume>;
diff --git a/app/react/docker/containers/CreateView/VolumesTab/validation.ts b/app/react/docker/containers/CreateView/VolumesTab/validation.ts
new file mode 100644
index 0000000..feda750
--- /dev/null
+++ b/app/react/docker/containers/CreateView/VolumesTab/validation.ts
@@ -0,0 +1,16 @@
+import { object, SchemaOf, array, string, mixed } from 'yup';
+
+import { Values, VolumeType, volumeTypes } from './types';
+
+export function validation(): SchemaOf<Values> {
+  return array(
+    object({
+      containerPath: string().required('Container path is required'),
+      type: mixed<VolumeType>()
+        .oneOf([...volumeTypes])
+        .default('volume'),
+      name: string().required('Volume name is required'),
+      readOnly: mixed<boolean>().default(false),
+    })
+  ).default([]);
+}
diff --git a/app/react/docker/containers/CreateView/index.ts b/app/react/docker/containers/CreateView/index.ts
new file mode 100644
index 0000000..74e5921
--- /dev/null
+++ b/app/react/docker/containers/CreateView/index.ts
@@ -0,0 +1 @@
+export { CreateView } from './CreateView';
diff --git a/app/react/docker/containers/CreateView/toRequest.ts b/app/react/docker/containers/CreateView/toRequest.ts
new file mode 100644
index 0000000..71f4163
--- /dev/null
+++ b/app/react/docker/containers/CreateView/toRequest.ts
@@ -0,0 +1,42 @@
+import { Registry } from '@/react/portainer/registries/types/registry';
+import { buildImageFullURI } from '@/react/docker/images/utils';
+
+import { baseFormUtils } from './BaseForm';
+import { capabilitiesTabUtils } from './CapabilitiesTab';
+import { commandsTabUtils } from './CommandsTab';
+import { labelsTabUtils } from './LabelsTab';
+import { networkTabUtils } from './NetworkTab';
+import { resourcesTabUtils } from './ResourcesTab';
+import { volumesTabUtils } from './VolumesTab';
+import { CreateContainerRequest } from './types';
+import { restartPolicyTabUtils } from './RestartPolicyTab';
+import { envVarsTabUtils } from './EnvVarsTab';
+import { Values } from './useInitialValues';
+
+export function toRequest(
+  values: Values,
+  registry?: Registry,
+  ignoreCapabilities?: boolean
+) {
+  let config: CreateContainerRequest = {
+    HostConfig: {},
+    NetworkingConfig: {},
+  };
+
+  config = commandsTabUtils.toRequest(config, values.commands);
+  config = volumesTabUtils.toRequest(config, values.volumes);
+  config = networkTabUtils.toRequest(config, values.network, '');
+  config = labelsTabUtils.toRequest(config, values.labels);
+  config = restartPolicyTabUtils.toRequest(config, values.restartPolicy);
+  config = resourcesTabUtils.toRequest(config, values.resources);
+  config = capabilitiesTabUtils.toRequest(
+    config,
+    values.capabilities,
+    !!ignoreCapabilities
+  );
+  config = baseFormUtils.toRequest(config, values);
+  config = envVarsTabUtils.toRequest(config, values.env);
+  config.Image = buildImageFullURI(values.image.image, registry);
+
+  return config;
+}
diff --git a/app/react/docker/containers/CreateView/types.ts b/app/react/docker/containers/CreateView/types.ts
new file mode 100644
index 0000000..1042ccd
--- /dev/null
+++ b/app/react/docker/containers/CreateView/types.ts
@@ -0,0 +1,6 @@
+import { ContainerConfig, HostConfig, NetworkingConfig } from 'docker-types';
+
+export interface CreateContainerRequest extends ContainerConfig {
+  HostConfig: HostConfig;
+  NetworkingConfig: NetworkingConfig;
+}
diff --git a/app/react/docker/containers/CreateView/useCreateMutation.tsx b/app/react/docker/containers/CreateView/useCreateMutation.tsx
new file mode 100644
index 0000000..682ba12
--- /dev/null
+++ b/app/react/docker/containers/CreateView/useCreateMutation.tsx
@@ -0,0 +1,357 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import {
+  Environment,
+  EnvironmentId,
+  EnvironmentType,
+} from '@/react/portainer/environments/types';
+import {
+  Registry,
+  RegistryId,
+} from '@/react/portainer/registries/types/registry';
+import { createWebhook } from '@/react/portainer/webhooks/useCreateWebhook';
+import { WebhookType } from '@/react/portainer/webhooks/types';
+import {
+  AccessControlFormData,
+  ResourceControlResponse,
+} from '@/react/portainer/access-control/types';
+import { applyResourceControl } from '@/react/portainer/access-control/access-control.service';
+import PortainerError from '@/portainer/error';
+import {
+  mutationOptions,
+  withError,
+  withInvalidate,
+} from '@/react-tools/react-query';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+
+import { pullImage } from '../../images/queries/usePullImageMutation';
+import {
+  removeContainer,
+  renameContainer,
+  startContainer,
+  stopContainer,
+} from '../containers.service';
+import { PortainerResponse } from '../../types';
+import { connectContainer } from '../../networks/queries/useConnectContainerMutation';
+import { ContainerListViewModel } from '../types';
+import { queryKeys } from '../queries/query-keys';
+import { withAgentTargetHeader } from '../../proxy/queries/utils';
+import { buildDockerProxyUrl } from '../../proxy/queries/buildDockerProxyUrl';
+
+import { CreateContainerRequest } from './types';
+import { Values } from './useInitialValues';
+
+interface ExtraNetwork {
+  networkName: string;
+  aliases: string[];
+}
+
+export function useCreateOrReplaceMutation() {
+  const environmentId = useEnvironmentId();
+  const queryClient = useQueryClient();
+
+  return useMutation(
+    createOrReplace,
+    mutationOptions(
+      withError('Failed to create container'),
+      withInvalidate(queryClient, [queryKeys.list(environmentId)])
+    )
+  );
+}
+
+interface CreateOptions {
+  config: CreateContainerRequest;
+  values: {
+    name: Values['name'];
+    imageName: string;
+    accessControl: Values['accessControl'];
+    nodeName?: Values['nodeName'];
+    alwaysPull?: Values['alwaysPull'];
+    enableWebhook?: Values['enableWebhook'];
+  };
+  registry?: Registry;
+  environment: Environment;
+}
+
+interface ReplaceOptions extends CreateOptions {
+  oldContainer: ContainerListViewModel;
+  extraNetworks: Array<ExtraNetwork>;
+}
+
+function isReplace(
+  options: ReplaceOptions | CreateOptions
+): options is ReplaceOptions {
+  return 'oldContainer' in options && !!options.oldContainer;
+}
+
+export function createOrReplace(options: ReplaceOptions | CreateOptions) {
+  return isReplace(options) ? replace(options) : create(options);
+}
+
+async function create({
+  config,
+  values,
+  registry,
+  environment,
+}: CreateOptions) {
+  await pullImageIfNeeded(
+    environment.Id,
+    values.alwaysPull || false,
+    values.imageName,
+    values.nodeName,
+    registry
+  );
+
+  const containerResponse = await createAndStart(
+    environment.Id,
+    config,
+    values.name,
+    values.nodeName
+  );
+
+  await applyContainerSettings(
+    containerResponse.Id,
+    environment,
+    values.accessControl,
+    values.enableWebhook,
+    containerResponse.Portainer?.ResourceControl,
+    registry
+  );
+}
+
+async function replace({
+  oldContainer,
+  config,
+  values,
+  registry,
+  environment,
+  extraNetworks,
+}: ReplaceOptions) {
+  await pullImageIfNeeded(
+    environment.Id,
+    values.alwaysPull || false,
+    values.imageName,
+    values.nodeName,
+    registry
+  );
+
+  const containerResponse = await renameAndCreate(
+    environment.Id,
+    values.name,
+    oldContainer,
+    config,
+    values.nodeName
+  );
+
+  await applyContainerSettings(
+    containerResponse.Id,
+    environment,
+    values.accessControl,
+    values.enableWebhook,
+    containerResponse.Portainer?.ResourceControl,
+    registry
+  );
+
+  await connectToExtraNetworks(
+    environment.Id,
+    containerResponse.Id,
+    extraNetworks,
+    values.nodeName
+  );
+
+  await removeContainer(environment.Id, oldContainer.Id, {
+    nodeName: oldContainer.NodeName,
+  });
+}
+
+/**
+ * stop and renames the old container, and creates and stops the new container.
+ * on any failure, it will rename the old container to its original name
+ */
+async function renameAndCreate(
+  environmentId: EnvironmentId,
+  name: string,
+  oldContainer: ContainerListViewModel,
+  config: CreateContainerRequest,
+  nodeName?: string
+) {
+  let renamed = false;
+  try {
+    await stopContainerIfNeeded(
+      environmentId,
+      oldContainer,
+      oldContainer.NodeName
+    );
+
+    await renameContainer(
+      environmentId,
+      oldContainer.Id,
+      `${oldContainer.Names[0]}-old`,
+      { nodeName: oldContainer.NodeName }
+    );
+    renamed = true;
+
+    return await createAndStart(environmentId, config, name, nodeName);
+  } catch (e) {
+    if (renamed) {
+      await renameContainer(environmentId, oldContainer.Id, name, {
+        nodeName: oldContainer.NodeName,
+      });
+    }
+    throw e;
+  }
+}
+
+/**
+ * creates a webhook if necessary and applies resource control
+ */
+async function applyContainerSettings(
+  containerId: string,
+  environment: Environment,
+  accessControl: AccessControlFormData,
+  enableWebhook?: boolean,
+  resourceControl?: ResourceControlResponse,
+  registry?: Registry
+) {
+  if (enableWebhook) {
+    await createContainerWebhook(containerId, environment, registry?.Id);
+  }
+
+  // Portainer will always return a resource control, but since types mark it as optional, we need to check it.
+  // Ignoring the missing value will result with bugs, hence it's better to throw an error
+  if (!resourceControl) {
+    throw new PortainerError('resource control expected after creation');
+  }
+
+  await applyResourceControl(accessControl, resourceControl.Id);
+}
+
+/**
+ * creates a new container and starts it.
+ * on failure, it will remove the new container
+ */
+async function createAndStart(
+  environmentId: EnvironmentId,
+  config: CreateContainerRequest,
+  name?: string,
+  nodeName?: string
+) {
+  let containerId = '';
+  try {
+    const containerResponse = await createContainer(
+      environmentId,
+      config,
+      name,
+      {
+        nodeName,
+      }
+    );
+
+    containerId = containerResponse.Id;
+
+    await startContainer(environmentId, containerResponse.Id, { nodeName });
+    return containerResponse;
+  } catch (e) {
+    if (containerId) {
+      await removeContainer(environmentId, containerId, {
+        nodeName,
+      });
+    }
+
+    throw e;
+  }
+}
+
+async function pullImageIfNeeded(
+  environmentId: EnvironmentId,
+  pull: boolean,
+  image: string,
+  nodeName?: string,
+  registry?: Registry
+) {
+  if (!pull) {
+    return null;
+  }
+
+  return pullImage({
+    environmentId,
+    nodeName,
+    image,
+    registry,
+    ignoreErrors: true,
+  });
+}
+
+async function createContainer(
+  environmentId: EnvironmentId,
+  config: CreateContainerRequest,
+  name?: string,
+  { nodeName }: { nodeName?: string } = {}
+) {
+  try {
+    const { data } = await axios.post<
+      PortainerResponse<{ Id: string; Warnings: Array<string> }>
+    >(buildDockerProxyUrl(environmentId, 'containers', 'create'), config, {
+      headers: { ...withAgentTargetHeader(nodeName) },
+      params: { name },
+    });
+
+    return data;
+  } catch (err) {
+    throw parseAxiosError(err, 'Unable to create container');
+  }
+}
+
+async function createContainerWebhook(
+  containerId: string,
+  environment: Environment,
+  registryId?: RegistryId
+) {
+  const isNotEdgeAgentOnDockerEnvironment =
+    environment.Type !== EnvironmentType.EdgeAgentOnDocker;
+  if (!isNotEdgeAgentOnDockerEnvironment) {
+    return;
+  }
+
+  await createWebhook({
+    resourceId: containerId,
+    environmentId: environment.Id,
+    registryId,
+    webhookType: WebhookType.DockerContainer,
+  });
+}
+
+function connectToExtraNetworks(
+  environmentId: EnvironmentId,
+  containerId: string,
+  extraNetworks: Array<ExtraNetwork>,
+  nodeName?: string
+) {
+  if (!extraNetworks) {
+    return null;
+  }
+
+  return Promise.all(
+    extraNetworks.map(({ networkName, aliases }) =>
+      connectContainer({
+        networkId: networkName,
+        nodeName,
+        containerId,
+        environmentId,
+        aliases,
+      })
+    )
+  );
+}
+
+function stopContainerIfNeeded(
+  environmentId: EnvironmentId,
+  container: ContainerListViewModel,
+  nodeName?: string
+) {
+  if (container.State !== 'running' || !container.Id) {
+    return null;
+  }
+  return stopContainer(environmentId, container.Id, { nodeName });
+}
diff --git a/app/react/docker/containers/CreateView/useInitialValues.ts b/app/react/docker/containers/CreateView/useInitialValues.ts
new file mode 100644
index 0000000..2e3009f
--- /dev/null
+++ b/app/react/docker/containers/CreateView/useInitialValues.ts
@@ -0,0 +1,190 @@
+import { useCurrentStateAndParams } from '@uirouter/react';
+
+import { useIsPodman } from '@/react/portainer/environments/queries/useIsPodman';
+import {
+  BaseFormValues,
+  baseFormUtils,
+} from '@/react/docker/containers/CreateView/BaseForm';
+import {
+  CapabilitiesTabValues,
+  capabilitiesTabUtils,
+} from '@/react/docker/containers/CreateView/CapabilitiesTab';
+import {
+  CommandsTabValues,
+  commandsTabUtils,
+} from '@/react/docker/containers/CreateView/CommandsTab';
+import {
+  LabelsTabValues,
+  labelsTabUtils,
+} from '@/react/docker/containers/CreateView/LabelsTab';
+import {
+  NetworkTabValues,
+  networkTabUtils,
+} from '@/react/docker/containers/CreateView/NetworkTab';
+import {
+  ResourcesTabValues,
+  resourcesTabUtils,
+} from '@/react/docker/containers/CreateView/ResourcesTab';
+import {
+  RestartPolicy,
+  restartPolicyTabUtils,
+} from '@/react/docker/containers/CreateView/RestartPolicyTab';
+import {
+  VolumesTabValues,
+  volumesTabUtils,
+} from '@/react/docker/containers/CreateView/VolumesTab';
+import { envVarsTabUtils } from '@/react/docker/containers/CreateView/EnvVarsTab';
+import { UserId } from '@/portainer/users/types';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useCurrentUser } from '@/react/hooks/useUser';
+import { useWebhooks } from '@/react/portainer/webhooks/useWebhooks';
+import { useEnvironmentRegistries } from '@/react/portainer/environments/queries/useEnvironmentRegistries';
+import { ContainerDetailsViewModel } from '@/docker/models/containerDetails';
+
+import { getImageConfig } from '@@/ImageConfigFieldset/getImageConfig';
+import { EnvVarValues } from '@@/form-components/EnvironmentVariablesFieldset';
+
+import { useNetworksForSelector } from '../components/NetworkSelector';
+import { useContainers } from '../queries/useContainers';
+import { useContainer } from '../queries/useContainer';
+
+import { getDefaultNetworkMode } from './NetworkTab/toViewModel';
+
+export interface Values extends BaseFormValues {
+  commands: CommandsTabValues;
+  volumes: VolumesTabValues;
+  network: NetworkTabValues;
+  labels: LabelsTabValues;
+  restartPolicy: RestartPolicy;
+  resources: ResourcesTabValues;
+  capabilities: CapabilitiesTabValues;
+  env: EnvVarValues;
+}
+
+export function useInitialValues(submitting: boolean, isWindows: boolean) {
+  const {
+    params: { nodeName, from },
+  } = useCurrentStateAndParams();
+  const environmentId = useEnvironmentId();
+  const { user, isPureAdmin } = useCurrentUser();
+
+  const networksQuery = useNetworksForSelector();
+
+  const fromContainerQuery = useContainer(
+    { environmentId, containerId: from, nodeName },
+    {
+      enabled: !submitting,
+      select: (c) => new ContainerDetailsViewModel(c),
+    }
+  );
+
+  const runningContainersQuery = useContainers(environmentId, {
+    enabled: !!from,
+  });
+  const webhookQuery = useWebhooks(
+    { endpointId: environmentId, resourceId: from },
+    { enabled: !!from }
+  );
+  const registriesQuery = useEnvironmentRegistries(environmentId, {
+    enabled: !!from,
+  });
+  const isPodman = useIsPodman(environmentId);
+
+  if (!networksQuery.data) {
+    return null;
+  }
+
+  if (!from) {
+    return {
+      initialValues: defaultValues(
+        isPureAdmin,
+        user.Id,
+        nodeName,
+        isWindows,
+        isPodman
+      ),
+    };
+  }
+
+  const fromContainer = fromContainerQuery.data;
+  if (
+    !fromContainer ||
+    !registriesQuery.data ||
+    !runningContainersQuery.data ||
+    !webhookQuery.data
+  ) {
+    return null;
+  }
+
+  const network = networkTabUtils.toViewModel(
+    fromContainer,
+    networksQuery.data,
+    runningContainersQuery.data
+  );
+
+  const extraNetworks = Object.entries(
+    fromContainer.NetworkSettings?.Networks || {}
+  )
+    .filter(
+      ([n]) =>
+        n !== network.networkMode &&
+        n !== getDefaultNetworkMode(isWindows, isPodman)
+    )
+    .map(([networkName, network]) => ({
+      networkName,
+      aliases: (network.Aliases || []).filter(
+        (o) => !fromContainer.Id?.startsWith(o)
+      ),
+    }));
+
+  const imageConfig = getImageConfig(
+    fromContainer?.Config?.Image || '',
+    registriesQuery.data
+  );
+
+  const initialValues: Values = {
+    commands: commandsTabUtils.toViewModel(fromContainer),
+    volumes: volumesTabUtils.toViewModel(fromContainer),
+    network: networkTabUtils.toViewModel(
+      fromContainer,
+      networksQuery.data,
+      runningContainersQuery.data,
+      isPodman
+    ),
+    labels: labelsTabUtils.toViewModel(fromContainer),
+    restartPolicy: restartPolicyTabUtils.toViewModel(fromContainer),
+    resources: resourcesTabUtils.toViewModel(fromContainer),
+    capabilities: capabilitiesTabUtils.toViewModel(fromContainer),
+    env: envVarsTabUtils.toViewModel(fromContainer),
+    ...baseFormUtils.toViewModel(
+      fromContainer,
+      isPureAdmin,
+      user.Id,
+      nodeName,
+      imageConfig,
+      (webhookQuery.data?.length || 0) > 0
+    ),
+  };
+
+  return { initialValues, isDuplicating: true, extraNetworks };
+}
+
+function defaultValues(
+  isPureAdmin: boolean,
+  currentUserId: UserId,
+  nodeName: string,
+  isWindows: boolean,
+  isPodman?: boolean
+): Values {
+  return {
+    commands: commandsTabUtils.getDefaultViewModel(),
+    volumes: volumesTabUtils.getDefaultViewModel(),
+    network: networkTabUtils.getDefaultViewModel(isWindows, isPodman), // windows containers should default to the nat network, not the bridge
+    labels: labelsTabUtils.getDefaultViewModel(),
+    restartPolicy: restartPolicyTabUtils.getDefaultViewModel(),
+    resources: resourcesTabUtils.getDefaultViewModel(),
+    capabilities: capabilitiesTabUtils.getDefaultViewModel(),
+    env: envVarsTabUtils.getDefaultViewModel(),
+    ...baseFormUtils.getDefaultViewModel(isPureAdmin, currentUserId, nodeName),
+  };
+}
diff --git a/app/react/docker/containers/CreateView/validation.ts b/app/react/docker/containers/CreateView/validation.ts
new file mode 100644
index 0000000..d3f7bec
--- /dev/null
+++ b/app/react/docker/containers/CreateView/validation.ts
@@ -0,0 +1,58 @@
+import { object, SchemaOf } from 'yup';
+import { useMemo } from 'react';
+
+import { baseFormUtils } from './BaseForm';
+import { capabilitiesTabUtils } from './CapabilitiesTab';
+import { commandsTabUtils } from './CommandsTab';
+import { labelsTabUtils } from './LabelsTab';
+import { networkTabUtils } from './NetworkTab';
+import { resourcesTabUtils } from './ResourcesTab';
+import { restartPolicyTabUtils } from './RestartPolicyTab';
+import { volumesTabUtils } from './VolumesTab';
+import { envVarsTabUtils } from './EnvVarsTab';
+import { Values } from './useInitialValues';
+
+export function useValidation({
+  isAdmin,
+  maxCpu,
+  maxMemory,
+  isDuplicating,
+  isDuplicatingPortainer,
+  isDockerhubRateLimited,
+}: {
+  isAdmin: boolean;
+  maxCpu: number;
+  maxMemory: number;
+  isDuplicating: boolean | undefined;
+  isDuplicatingPortainer: boolean | undefined;
+  isDockerhubRateLimited: boolean;
+}): SchemaOf<Values> {
+  return useMemo(
+    () =>
+      object({
+        commands: commandsTabUtils.validation(),
+        volumes: volumesTabUtils.validation(),
+        network: networkTabUtils.validation(),
+        labels: labelsTabUtils.validation(),
+        restartPolicy: restartPolicyTabUtils.validation(),
+        resources: resourcesTabUtils.validation({ maxCpu, maxMemory }),
+        capabilities: capabilitiesTabUtils.validation(),
+        env: envVarsTabUtils.validation(),
+      }).concat(
+        baseFormUtils.validation({
+          isAdmin,
+          isDuplicating,
+          isDuplicatingPortainer,
+          isDockerhubRateLimited,
+        })
+      ),
+    [
+      isAdmin,
+      isDockerhubRateLimited,
+      isDuplicating,
+      isDuplicatingPortainer,
+      maxCpu,
+      maxMemory,
+    ]
+  );
+}
diff --git a/app/react/docker/containers/InspectView/InspectView.tsx b/app/react/docker/containers/InspectView/InspectView.tsx
new file mode 100644
index 0000000..df6b4d5
--- /dev/null
+++ b/app/react/docker/containers/InspectView/InspectView.tsx
@@ -0,0 +1,79 @@
+import { useCurrentStateAndParams } from '@uirouter/react';
+import { Circle, Code as CodeIcon, File } from 'lucide-react';
+import { useState } from 'react';
+
+import { trimContainerName } from '@/docker/filters/utils';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+
+import { JsonTree } from '@@/JsonTree';
+import { PageHeader } from '@@/PageHeader';
+import { Widget } from '@@/Widget';
+import { ButtonSelector } from '@@/form-components/ButtonSelector/ButtonSelector';
+import { Code } from '@@/Code';
+
+import { useContainerInspect } from '../queries/useContainerInspect';
+
+export function InspectView() {
+  const environmentId = useEnvironmentId();
+  const {
+    params: { id, nodeName },
+  } = useCurrentStateAndParams();
+  const inspectQuery = useContainerInspect(environmentId, id, { nodeName });
+  const [viewType, setViewType] = useState<'tree' | 'text'>('tree');
+
+  if (!inspectQuery.data) {
+    return null;
+  }
+
+  const containerInfo = inspectQuery.data;
+
+  return (
+    <>
+      <PageHeader
+        title="Container inspect"
+        breadcrumbs={[
+          { label: 'Containers', link: 'docker.containers' },
+          {
+            label: trimContainerName(containerInfo.Name),
+            link: '^',
+            // linkParams: { id: containerInfo.Id },
+          },
+          'Inspect',
+        ]}
+      />
+
+      <div className="row">
+        <div className="col-lg-12 col-md-12 col-xs-12">
+          <Widget>
+            <Widget.Title icon={Circle} title="Inspect">
+              <ButtonSelector<'tree' | 'text'>
+                onChange={(value) => setViewType(value)}
+                value={viewType}
+                options={[
+                  {
+                    label: 'Tree',
+                    icon: CodeIcon,
+                    value: 'tree',
+                  },
+                  {
+                    label: 'Text',
+                    icon: File,
+                    value: 'text',
+                  },
+                ]}
+              />
+            </Widget.Title>
+            <Widget.Body>
+              {viewType === 'text' && (
+                <Code showCopyButton>
+                  {JSON.stringify(containerInfo, undefined, 4)}
+                </Code>
+              )}
+              {viewType === 'tree' && <JsonTree data={containerInfo} />}
+            </Widget.Body>
+          </Widget>
+        </div>
+      </div>
+    </>
+  );
+}
diff --git a/app/react/docker/containers/ItemView/ConfirmRecreationModal.tsx b/app/react/docker/containers/ItemView/ConfirmRecreationModal.tsx
new file mode 100644
index 0000000..2024e15
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ConfirmRecreationModal.tsx
@@ -0,0 +1,71 @@
+import { useState } from 'react';
+
+import { Modal, OnSubmit, ModalType, openModal } from '@@/modals';
+import { Button } from '@@/buttons';
+import { SwitchField } from '@@/form-components/SwitchField';
+import { TextTip } from '@@/Tip/TextTip';
+
+interface Props {
+  onSubmit: OnSubmit<{ pullLatest: boolean }>;
+
+  cannotPullImage: boolean;
+}
+
+function ConfirmRecreationModal({ onSubmit, cannotPullImage }: Props) {
+  const [pullLatest, setPullLatest] = useState(false);
+
+  return (
+    <Modal
+      onDismiss={() => onSubmit()}
+      aria-label="confirm recreate container modal"
+    >
+      <Modal.Header title="Are you sure?" modalType={ModalType.Destructive} />
+
+      <Modal.Body>
+        <p>
+          You&apos;re about to recreate this container and any non-persisted
+          data will be lost. This container will be removed and another one will
+          be created using the same configuration.
+        </p>
+        <SwitchField
+          name="pullLatest"
+          data-cy="recreate-pull-latest-switch"
+          label="Re-pull image"
+          checked={pullLatest}
+          onChange={setPullLatest}
+          disabled={cannotPullImage}
+        />
+        {cannotPullImage && (
+          <div className="mt-1 text-sm">
+            <TextTip color="orange">
+              Cannot re-pull as the image is inaccessible - either it no longer
+              exists or the tag or name is no longer correct.
+            </TextTip>
+          </div>
+        )}
+      </Modal.Body>
+      <Modal.Footer>
+        <Button
+          onClick={() => onSubmit()}
+          color="default"
+          data-cy="cancel-recreate"
+        >
+          Cancel
+        </Button>
+        <Button
+          onClick={() => onSubmit({ pullLatest })}
+          color="danger"
+          data-cy="confirm-recreate"
+        >
+          Recreate
+        </Button>
+      </Modal.Footer>
+    </Modal>
+  );
+}
+
+export async function confirmContainerRecreation(cannotPullImage: boolean) {
+  return openModal(ConfirmRecreationModal, {
+    cannotPullImage,
+  });
+}
diff --git a/app/react/docker/containers/ItemView/ContainerActionsSection/ContainerActionsSection.test.tsx b/app/react/docker/containers/ItemView/ContainerActionsSection/ContainerActionsSection.test.tsx
new file mode 100644
index 0000000..4ea0b39
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerActionsSection/ContainerActionsSection.test.tsx
@@ -0,0 +1,348 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { vi } from 'vitest';
+import _ from 'lodash';
+import { http, HttpResponse } from 'msw';
+
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { ContainerDetailsViewModel } from '@/docker/models/containerDetails';
+import { ContainerEngine } from '@/react/portainer/environments/types';
+import { server } from '@/setup-tests/server';
+import {
+  createMockEnvironment,
+  createMockUser,
+} from '@/react-tools/test-mocks';
+
+import { ContainerActionsSection } from './ContainerActionsSection';
+
+const mockStartMutate = vi.fn();
+const mockStopMutate = vi.fn();
+const mockKillMutate = vi.fn();
+const mockRestartMutate = vi.fn();
+const mockPauseMutate = vi.fn();
+const mockUnpauseMutate = vi.fn();
+const mockRemoveMutate = vi.fn();
+
+vi.mock('@uirouter/react', async (importOriginal: () => Promise<object>) => ({
+  ...(await importOriginal()),
+  useCurrentStateAndParams: vi.fn(() => ({
+    params: { endpointId: 1 }, // Must match environmentId in test props and user authorizations
+  })),
+}));
+
+vi.mock('./queries/useStartContainer', () => ({
+  useStartContainer: () => ({ mutate: mockStartMutate, isLoading: false }),
+}));
+
+vi.mock('./queries/useStopContainer', () => ({
+  useStopContainer: () => ({ mutate: mockStopMutate, isLoading: false }),
+}));
+
+vi.mock('./queries/useKillContainer', () => ({
+  useKillContainer: () => ({ mutate: mockKillMutate, isLoading: false }),
+}));
+
+vi.mock('./queries/useRestartContainer', () => ({
+  useRestartContainer: () => ({ mutate: mockRestartMutate, isLoading: false }),
+}));
+
+vi.mock('./queries/usePauseContainer', () => ({
+  usePauseContainer: () => ({ mutate: mockPauseMutate, isLoading: false }),
+}));
+
+vi.mock('./queries/useResumeContainer', () => ({
+  useResumeContainer: () => ({ mutate: mockUnpauseMutate, isLoading: false }),
+}));
+
+vi.mock('./queries/useRemoveContainer', () => ({
+  useRemoveContainer: () => ({ mutate: mockRemoveMutate, isLoading: false }),
+}));
+
+vi.mock('@/react/docker/proxy/queries/useInfo', () => ({
+  useIsSwarm: () => false,
+}));
+
+const mockConfirmContainerDeletion = vi.fn();
+vi.mock(
+  '@/react/docker/containers/common/confirm-container-delete-modal',
+  () => ({
+    confirmContainerDeletion: (title: string) =>
+      mockConfirmContainerDeletion(title),
+  })
+);
+
+describe('ContainerActionsSection', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+
+    // Setup MSW handler for environment endpoint
+    server.use(
+      http.get('/api/endpoints/:id', () =>
+        HttpResponse.json(
+          createMockEnvironment({
+            Id: 1,
+            ContainerEngine: ContainerEngine.Docker,
+            SecuritySettings: {
+              allowContainerCapabilitiesForRegularUsers: true,
+              allowBindMountsForRegularUsers: true,
+              allowDeviceMappingForRegularUsers: true,
+              allowSysctlSettingForRegularUsers: true,
+              allowHostNamespaceForRegularUsers: true,
+              allowPrivilegedModeForRegularUsers: true,
+              allowVolumeBrowserForRegularUsers: true,
+              allowStackManagementForRegularUsers: true,
+              allowSecurityOptForRegularUsers: true,
+              enableHostManagementFeatures: false,
+            },
+          })
+        )
+      )
+    );
+  });
+
+  it('should render all action buttons when authorized', async () => {
+    renderComponent();
+
+    // Wait for environment data to load
+    await waitFor(() => {
+      expect(screen.getByRole('button', { name: 'Start' })).toBeVisible();
+    });
+
+    expect(screen.getByRole('button', { name: 'Stop' })).toBeVisible();
+    expect(screen.getByRole('button', { name: 'Kill' })).toBeVisible();
+    expect(screen.getByRole('button', { name: 'Restart' })).toBeVisible();
+    expect(screen.getByRole('button', { name: 'Pause' })).toBeVisible();
+    expect(screen.getByRole('button', { name: 'Resume' })).toBeVisible();
+    expect(screen.getByRole('button', { name: 'Remove' })).toBeVisible();
+  });
+
+  it('should disable start button when container is running', async () => {
+    renderComponent({
+      container: mockContainer({
+        Id: 'test-container-id',
+        State: { Running: true, Paused: false },
+        Config: { Image: 'nginx:latest' },
+      }),
+    });
+
+    await waitFor(() => {
+      expect(screen.getByRole('button', { name: 'Start' })).toBeDisabled();
+    });
+  });
+
+  it('should disable stop, kill, restart buttons when container is not running', async () => {
+    renderComponent({
+      container: mockContainer({
+        Id: 'test-container-id',
+        State: { Running: false, Paused: false },
+        Config: { Image: 'nginx:latest' },
+      }),
+    });
+
+    await waitFor(() => {
+      expect(screen.getByRole('button', { name: 'Stop' })).toBeDisabled();
+    });
+    expect(screen.getByRole('button', { name: 'Kill' })).toBeDisabled();
+    expect(screen.getByRole('button', { name: 'Restart' })).toBeDisabled();
+  });
+
+  it('should disable pause button when container is paused', async () => {
+    renderComponent({
+      container: mockContainer({
+        Id: 'test-container-id',
+        State: { Running: true, Paused: true },
+        Config: { Image: 'nginx:latest' },
+      }),
+    });
+
+    await waitFor(() => {
+      expect(screen.getByRole('button', { name: 'Pause' })).toBeDisabled();
+    });
+  });
+
+  it('should disable unpause button when container is not paused', async () => {
+    renderComponent({
+      container: mockContainer({
+        Id: 'test-container-id',
+        State: { Running: true, Paused: false },
+        Config: { Image: 'nginx:latest' },
+      }),
+    });
+
+    await waitFor(() => {
+      expect(screen.getByRole('button', { name: 'Resume' })).toBeDisabled();
+    });
+  });
+
+  it('should disable all buttons when container is Portainer', async () => {
+    renderComponent({
+      container: mockContainer({
+        Id: 'test-container-id',
+        State: { Running: true, Paused: false },
+        Config: { Image: 'portainer:latest' },
+        IsPortainer: true,
+      }),
+    });
+
+    await waitFor(() => {
+      expect(screen.getByRole('button', { name: 'Start' })).toBeDisabled();
+    });
+    expect(screen.getByRole('button', { name: 'Stop' })).toBeDisabled();
+    expect(screen.getByRole('button', { name: 'Kill' })).toBeDisabled();
+    expect(screen.getByRole('button', { name: 'Restart' })).toBeDisabled();
+    expect(screen.getByRole('button', { name: 'Pause' })).toBeDisabled();
+    expect(screen.getByRole('button', { name: 'Resume' })).toBeDisabled();
+    expect(screen.getByRole('button', { name: 'Remove' })).toBeDisabled();
+  });
+
+  it('should call start mutation when start button is clicked', async () => {
+    const user = userEvent.setup();
+    renderComponent();
+
+    const startButton = await screen.findByRole('button', { name: 'Start' });
+    await user.click(startButton);
+
+    expect(mockStartMutate).toHaveBeenCalledWith(
+      {
+        environmentId: 1,
+        containerId: 'test-container-id',
+        nodeName: 'node1',
+      },
+      expect.objectContaining({
+        onSuccess: expect.any(Function),
+      })
+    );
+  });
+
+  it('should call stop mutation when stop button is clicked', async () => {
+    const user = userEvent.setup();
+    renderComponent({
+      container: mockContainer({
+        Id: 'test-container-id',
+        State: { Running: true, Paused: false },
+        Config: { Image: 'nginx:latest' },
+      }),
+    });
+
+    const stopButton = await screen.findByRole('button', { name: 'Stop' });
+    await user.click(stopButton);
+
+    expect(mockStopMutate).toHaveBeenCalledWith(
+      {
+        environmentId: 1,
+        containerId: 'test-container-id',
+        nodeName: 'node1',
+      },
+      expect.objectContaining({
+        onSuccess: expect.any(Function),
+      })
+    );
+  });
+
+  it('should show confirmation modal and call remove mutation when confirmed', async () => {
+    const user = userEvent.setup();
+    mockConfirmContainerDeletion.mockResolvedValue({ removeVolumes: true });
+
+    renderComponent();
+
+    const removeButton = await screen.findByRole('button', { name: 'Remove' });
+    await user.click(removeButton);
+
+    await waitFor(() => {
+      expect(mockConfirmContainerDeletion).toHaveBeenCalledWith(
+        'You are about to remove a container.'
+      );
+    });
+
+    await waitFor(() => {
+      expect(mockRemoveMutate).toHaveBeenCalledWith(
+        {
+          environmentId: 1,
+          containerId: 'test-container-id',
+          nodeName: 'node1',
+          removeVolumes: true,
+        },
+        expect.objectContaining({
+          onSuccess: expect.any(Function),
+        })
+      );
+    });
+  });
+
+  it('should not call remove mutation when confirmation is cancelled', async () => {
+    const user = userEvent.setup();
+    mockConfirmContainerDeletion.mockResolvedValue(undefined);
+
+    renderComponent();
+
+    const removeButton = await screen.findByRole('button', { name: 'Remove' });
+    await user.click(removeButton);
+
+    await waitFor(() => {
+      expect(mockConfirmContainerDeletion).toHaveBeenCalled();
+    });
+
+    expect(mockRemoveMutate).not.toHaveBeenCalled();
+  });
+});
+
+function renderComponent(
+  props: Partial<React.ComponentProps<typeof ContainerActionsSection>> & {
+    userAuthorizations?: Record<string, boolean>;
+  } = {}
+) {
+  const { userAuthorizations, ...componentProps } = props;
+
+  const defaultProps: React.ComponentProps<typeof ContainerActionsSection> = {
+    environmentId: 1,
+    nodeName: 'node1',
+    container: mockContainer(),
+    ...componentProps,
+  };
+
+  const defaultAuthorizations = {
+    DockerContainerStart: true,
+    DockerContainerStop: true,
+    DockerContainerKill: true,
+    DockerContainerRestart: true,
+    DockerContainerPause: true,
+    DockerContainerUnpause: true,
+    DockerContainerDelete: true,
+    DockerContainerCreate: true,
+  };
+
+  const mockUser = createMockUser({
+    EndpointAuthorizations: {
+      1: userAuthorizations || defaultAuthorizations,
+    },
+    Id: 1,
+    Role: 1,
+  });
+
+  const Wrapper = withTestQueryProvider(
+    withUserProvider(withTestRouter(ContainerActionsSection), mockUser)
+  );
+
+  return render(<Wrapper {...defaultProps} />);
+}
+
+function mockContainer(
+  overrides: Partial<ContainerDetailsViewModel> = {}
+): ContainerDetailsViewModel {
+  return _.merge(
+    {
+      Id: 'test-container-id',
+      State: {
+        Running: false,
+        Paused: false,
+      },
+      Config: {
+        Image: 'nginx:latest',
+      },
+      IsPortainer: false,
+    } as ContainerDetailsViewModel,
+    overrides
+  );
+}
diff --git a/app/react/docker/containers/ItemView/ContainerActionsSection/ContainerActionsSection.tsx b/app/react/docker/containers/ItemView/ContainerActionsSection/ContainerActionsSection.tsx
new file mode 100644
index 0000000..653dd37
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerActionsSection/ContainerActionsSection.tsx
@@ -0,0 +1,69 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { useAuthorizations } from '@/react/hooks/useUser';
+import { ContainerDetailsViewModel } from '@/docker/models/containerDetails';
+import { isPartOfSwarmService } from '@/docker/helpers/containers';
+
+import { Widget, WidgetBody } from '@@/Widget';
+
+import { PrimaryActions } from './PrimaryActions';
+import { SecondaryActions } from './SecondaryActions';
+
+interface Props {
+  environmentId: EnvironmentId;
+  nodeName?: string;
+  container: ContainerDetailsViewModel;
+  onSuccess?(): void;
+}
+
+export function ContainerActionsSection({
+  environmentId,
+  nodeName,
+  container,
+  onSuccess,
+}: Props) {
+  const authorizedQuery = useAuthorizations([
+    'DockerContainerStart',
+    'DockerContainerStop',
+    'DockerContainerKill',
+    'DockerContainerRestart',
+    'DockerContainerPause',
+    'DockerContainerUnpause',
+    'DockerContainerDelete',
+    'DockerContainerCreate',
+  ]);
+
+  if (!authorizedQuery.authorized || !container.Id) {
+    return null;
+  }
+
+  const isRunning = container.State?.Running || false;
+  const isPaused = container.State?.Paused || false;
+  const isPortainer = container.IsPortainer || false;
+  return (
+    <Widget>
+      <Widget.Title icon="settings" title="Actions" />
+      <WidgetBody>
+        <div className="flex gap-2">
+          <PrimaryActions
+            environmentId={environmentId}
+            containerId={container.Id}
+            nodeName={nodeName}
+            isRunning={isRunning}
+            isPaused={isPaused}
+            isPortainer={isPortainer}
+            onSuccess={onSuccess}
+          />
+          <SecondaryActions
+            environmentId={environmentId}
+            containerId={container.Id}
+            containerImage={container.Config?.Image || ''}
+            containerAutoRemove={container.HostConfig?.AutoRemove}
+            nodeName={nodeName}
+            partOfSwarmService={isPartOfSwarmService(container)}
+            isPortainer={isPortainer}
+          />
+        </div>
+      </WidgetBody>
+    </Widget>
+  );
+}
diff --git a/app/react/docker/containers/ItemView/ContainerActionsSection/PrimaryActions.tsx b/app/react/docker/containers/ItemView/ContainerActionsSection/PrimaryActions.tsx
new file mode 100644
index 0000000..4ba3f66
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerActionsSection/PrimaryActions.tsx
@@ -0,0 +1,100 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { ButtonGroup } from '@@/buttons';
+
+import { ContainerId } from '../../types';
+
+import { StartButton } from './PrimaryActions/StartButton';
+import { StopButton } from './PrimaryActions/StopButton';
+import { KillButton } from './PrimaryActions/KillButton';
+import { RestartButton } from './PrimaryActions/RestartButton';
+import { PauseButton } from './PrimaryActions/PauseButton';
+import { ResumeButton } from './PrimaryActions/ResumeButton';
+import { RemoveButton } from './PrimaryActions/RemoveButton';
+
+interface Props {
+  environmentId: EnvironmentId;
+  containerId: ContainerId;
+  nodeName?: string;
+  isRunning: boolean;
+  isPaused: boolean;
+  isPortainer: boolean;
+  onSuccess?(): void;
+}
+
+export function PrimaryActions({
+  environmentId,
+  containerId,
+  nodeName,
+  isRunning,
+  isPaused,
+  isPortainer,
+  onSuccess = () => {},
+}: Props) {
+  return (
+    <ButtonGroup>
+      <StartButton
+        environmentId={environmentId}
+        containerId={containerId}
+        nodeName={nodeName}
+        isRunning={isRunning}
+        isPortainer={isPortainer}
+        onSuccess={onSuccess}
+      />
+
+      <StopButton
+        environmentId={environmentId}
+        containerId={containerId}
+        nodeName={nodeName}
+        isRunning={isRunning}
+        isPortainer={isPortainer}
+        onSuccess={onSuccess}
+      />
+
+      <KillButton
+        environmentId={environmentId}
+        containerId={containerId}
+        nodeName={nodeName}
+        isRunning={isRunning}
+        isPortainer={isPortainer}
+        onSuccess={onSuccess}
+      />
+
+      <RestartButton
+        environmentId={environmentId}
+        containerId={containerId}
+        nodeName={nodeName}
+        isRunning={isRunning}
+        isPortainer={isPortainer}
+        onSuccess={onSuccess}
+      />
+
+      <PauseButton
+        environmentId={environmentId}
+        containerId={containerId}
+        nodeName={nodeName}
+        isRunning={isRunning}
+        isPaused={isPaused}
+        isPortainer={isPortainer}
+        onSuccess={onSuccess}
+      />
+
+      <ResumeButton
+        environmentId={environmentId}
+        containerId={containerId}
+        nodeName={nodeName}
+        isPaused={isPaused}
+        isPortainer={isPortainer}
+        onSuccess={onSuccess}
+      />
+
+      <RemoveButton
+        environmentId={environmentId}
+        containerId={containerId}
+        nodeName={nodeName}
+        isRunning={isRunning}
+        isPortainer={isPortainer}
+      />
+    </ButtonGroup>
+  );
+}
diff --git a/app/react/docker/containers/ItemView/ContainerActionsSection/PrimaryActions/KillButton.tsx b/app/react/docker/containers/ItemView/ContainerActionsSection/PrimaryActions/KillButton.tsx
new file mode 100644
index 0000000..be0e6d5
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerActionsSection/PrimaryActions/KillButton.tsx
@@ -0,0 +1,59 @@
+import { Bomb } from 'lucide-react';
+
+import { Authorized } from '@/react/hooks/useUser';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { LoadingButton } from '@@/buttons';
+
+import { ContainerId } from '../../../types';
+import { useKillContainer } from '../queries/useKillContainer';
+
+interface KillButtonProps {
+  environmentId: EnvironmentId;
+  containerId: ContainerId;
+  nodeName?: string;
+  isRunning: boolean;
+  isPortainer: boolean;
+  onSuccess?(): void;
+}
+
+export function KillButton({
+  environmentId,
+  containerId,
+  nodeName,
+  isRunning,
+  isPortainer,
+  onSuccess = () => {},
+}: KillButtonProps) {
+  const killMutation = useKillContainer();
+
+  function handleKill() {
+    killMutation.mutate(
+      { environmentId, containerId, nodeName },
+      {
+        onSuccess() {
+          notifySuccess('Success', 'Container successfully killed');
+          onSuccess();
+        },
+      }
+    );
+  }
+
+  return (
+    <Authorized authorizations="DockerContainerKill">
+      <LoadingButton
+        color="light"
+        size="small"
+        onClick={handleKill}
+        disabled={!isRunning || isPortainer}
+        isLoading={killMutation.isLoading}
+        loadingText="Killing..."
+        data-cy="kill-container-button"
+        icon={Bomb}
+      >
+        Kill
+      </LoadingButton>
+    </Authorized>
+  );
+}
diff --git a/app/react/docker/containers/ItemView/ContainerActionsSection/PrimaryActions/PauseButton.tsx b/app/react/docker/containers/ItemView/ContainerActionsSection/PrimaryActions/PauseButton.tsx
new file mode 100644
index 0000000..45b741e
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerActionsSection/PrimaryActions/PauseButton.tsx
@@ -0,0 +1,61 @@
+import { Pause } from 'lucide-react';
+
+import { Authorized } from '@/react/hooks/useUser';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { LoadingButton } from '@@/buttons';
+
+import { ContainerId } from '../../../types';
+import { usePauseContainer } from '../queries/usePauseContainer';
+
+interface PauseButtonProps {
+  environmentId: EnvironmentId;
+  containerId: ContainerId;
+  nodeName?: string;
+  isRunning: boolean;
+  isPaused: boolean;
+  isPortainer: boolean;
+  onSuccess?(): void;
+}
+
+export function PauseButton({
+  environmentId,
+  containerId,
+  nodeName,
+  isRunning,
+  isPaused,
+  isPortainer,
+  onSuccess = () => {},
+}: PauseButtonProps) {
+  const pauseMutation = usePauseContainer();
+
+  function handlePause() {
+    pauseMutation.mutate(
+      { environmentId, containerId, nodeName },
+      {
+        onSuccess() {
+          notifySuccess('Success', 'Container successfully paused');
+          onSuccess();
+        },
+      }
+    );
+  }
+
+  return (
+    <Authorized authorizations="DockerContainerPause">
+      <LoadingButton
+        color="light"
+        size="small"
+        onClick={handlePause}
+        disabled={!isRunning || isPaused || isPortainer}
+        isLoading={pauseMutation.isLoading}
+        loadingText="Pausing..."
+        data-cy="pause-container-button"
+        icon={Pause}
+      >
+        Pause
+      </LoadingButton>
+    </Authorized>
+  );
+}
diff --git a/app/react/docker/containers/ItemView/ContainerActionsSection/PrimaryActions/RemoveButton.tsx b/app/react/docker/containers/ItemView/ContainerActionsSection/PrimaryActions/RemoveButton.tsx
new file mode 100644
index 0000000..277e645
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerActionsSection/PrimaryActions/RemoveButton.tsx
@@ -0,0 +1,72 @@
+import { Trash2 } from 'lucide-react';
+
+import { Authorized } from '@/react/hooks/useUser';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { confirmContainerDeletion } from '@/react/docker/containers/common/confirm-container-delete-modal';
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { LoadingButton } from '@@/buttons';
+
+import { ContainerId } from '../../../types';
+import { useRemoveContainer } from '../queries/useRemoveContainer';
+
+interface RemoveButtonProps {
+  environmentId: EnvironmentId;
+  containerId: ContainerId;
+  nodeName?: string;
+  isRunning: boolean;
+  isPortainer: boolean;
+}
+
+export function RemoveButton({
+  environmentId,
+  containerId,
+  nodeName,
+  isRunning,
+  isPortainer,
+}: RemoveButtonProps) {
+  const removeMutation = useRemoveContainer();
+
+  async function handleRemove() {
+    const title = isRunning
+      ? 'You are about to remove a running container.'
+      : 'You are about to remove a container.';
+
+    const result = await confirmContainerDeletion(title);
+
+    if (!result) {
+      return;
+    }
+
+    removeMutation.mutate(
+      {
+        environmentId,
+        containerId,
+        nodeName,
+        removeVolumes: result.removeVolumes,
+      },
+      {
+        onSuccess() {
+          notifySuccess('Success', 'Container successfully removed');
+        },
+      }
+    );
+  }
+
+  return (
+    <Authorized authorizations="DockerContainerDelete">
+      <LoadingButton
+        color="dangerlight"
+        size="small"
+        onClick={handleRemove}
+        disabled={isPortainer}
+        isLoading={removeMutation.isLoading}
+        loadingText="Removing..."
+        data-cy="remove-container-button"
+        icon={Trash2}
+      >
+        Remove
+      </LoadingButton>
+    </Authorized>
+  );
+}
diff --git a/app/react/docker/containers/ItemView/ContainerActionsSection/PrimaryActions/RestartButton.tsx b/app/react/docker/containers/ItemView/ContainerActionsSection/PrimaryActions/RestartButton.tsx
new file mode 100644
index 0000000..da04aea
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerActionsSection/PrimaryActions/RestartButton.tsx
@@ -0,0 +1,59 @@
+import { RefreshCw } from 'lucide-react';
+
+import { Authorized } from '@/react/hooks/useUser';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { LoadingButton } from '@@/buttons';
+
+import { ContainerId } from '../../../types';
+import { useRestartContainer } from '../queries/useRestartContainer';
+
+interface RestartButtonProps {
+  environmentId: EnvironmentId;
+  containerId: ContainerId;
+  nodeName?: string;
+  isRunning: boolean;
+  isPortainer: boolean;
+  onSuccess?(): void;
+}
+
+export function RestartButton({
+  environmentId,
+  containerId,
+  nodeName,
+  isRunning,
+  isPortainer,
+  onSuccess = () => {},
+}: RestartButtonProps) {
+  const restartMutation = useRestartContainer();
+
+  function handleRestart() {
+    restartMutation.mutate(
+      { environmentId, containerId, nodeName },
+      {
+        onSuccess() {
+          notifySuccess('Success', 'Container successfully restarted');
+          onSuccess();
+        },
+      }
+    );
+  }
+
+  return (
+    <Authorized authorizations="DockerContainerRestart">
+      <LoadingButton
+        color="light"
+        size="small"
+        onClick={handleRestart}
+        disabled={!isRunning || isPortainer}
+        isLoading={restartMutation.isLoading}
+        loadingText="Restarting..."
+        data-cy="restart-container-button"
+        icon={RefreshCw}
+      >
+        Restart
+      </LoadingButton>
+    </Authorized>
+  );
+}
diff --git a/app/react/docker/containers/ItemView/ContainerActionsSection/PrimaryActions/ResumeButton.tsx b/app/react/docker/containers/ItemView/ContainerActionsSection/PrimaryActions/ResumeButton.tsx
new file mode 100644
index 0000000..7d8c3ad
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerActionsSection/PrimaryActions/ResumeButton.tsx
@@ -0,0 +1,59 @@
+import { Play } from 'lucide-react';
+
+import { Authorized } from '@/react/hooks/useUser';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { LoadingButton } from '@@/buttons';
+
+import { ContainerId } from '../../../types';
+import { useResumeContainer } from '../queries/useResumeContainer';
+
+interface ResumeButtonProps {
+  environmentId: EnvironmentId;
+  containerId: ContainerId;
+  nodeName?: string;
+  isPaused: boolean;
+  isPortainer: boolean;
+  onSuccess?(): void;
+}
+
+export function ResumeButton({
+  environmentId,
+  containerId,
+  nodeName,
+  isPaused,
+  isPortainer,
+  onSuccess = () => {},
+}: ResumeButtonProps) {
+  const resumeMutation = useResumeContainer();
+
+  function handleResume() {
+    resumeMutation.mutate(
+      { environmentId, containerId, nodeName },
+      {
+        onSuccess() {
+          notifySuccess('Success', 'Container successfully resumed');
+          onSuccess();
+        },
+      }
+    );
+  }
+
+  return (
+    <Authorized authorizations="DockerContainerUnpause">
+      <LoadingButton
+        color="light"
+        size="small"
+        onClick={handleResume}
+        disabled={!isPaused || isPortainer}
+        isLoading={resumeMutation.isLoading}
+        loadingText="Resuming..."
+        data-cy="unpause-container-button"
+        icon={Play}
+      >
+        Resume
+      </LoadingButton>
+    </Authorized>
+  );
+}
diff --git a/app/react/docker/containers/ItemView/ContainerActionsSection/PrimaryActions/StartButton.tsx b/app/react/docker/containers/ItemView/ContainerActionsSection/PrimaryActions/StartButton.tsx
new file mode 100644
index 0000000..2d75639
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerActionsSection/PrimaryActions/StartButton.tsx
@@ -0,0 +1,59 @@
+import { Play } from 'lucide-react';
+
+import { Authorized } from '@/react/hooks/useUser';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { LoadingButton } from '@@/buttons';
+
+import { ContainerId } from '../../../types';
+import { useStartContainer } from '../queries/useStartContainer';
+
+interface StartButtonProps {
+  environmentId: EnvironmentId;
+  containerId: ContainerId;
+  nodeName?: string;
+  isRunning: boolean;
+  isPortainer: boolean;
+  onSuccess?(): void;
+}
+
+export function StartButton({
+  environmentId,
+  containerId,
+  nodeName,
+  isRunning,
+  isPortainer,
+  onSuccess = () => {},
+}: StartButtonProps) {
+  const startMutation = useStartContainer();
+
+  function handleStart() {
+    startMutation.mutate(
+      { environmentId, containerId, nodeName },
+      {
+        onSuccess() {
+          notifySuccess('Success', 'Container successfully started');
+          onSuccess();
+        },
+      }
+    );
+  }
+
+  return (
+    <Authorized authorizations="DockerContainerStart">
+      <LoadingButton
+        color="light"
+        size="small"
+        onClick={handleStart}
+        disabled={isRunning || isPortainer}
+        isLoading={startMutation.isLoading}
+        loadingText="Starting..."
+        data-cy="start-container-button"
+        icon={Play}
+      >
+        Start
+      </LoadingButton>
+    </Authorized>
+  );
+}
diff --git a/app/react/docker/containers/ItemView/ContainerActionsSection/PrimaryActions/StopButton.tsx b/app/react/docker/containers/ItemView/ContainerActionsSection/PrimaryActions/StopButton.tsx
new file mode 100644
index 0000000..c70b488
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerActionsSection/PrimaryActions/StopButton.tsx
@@ -0,0 +1,59 @@
+import { Square } from 'lucide-react';
+
+import { Authorized } from '@/react/hooks/useUser';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { LoadingButton } from '@@/buttons';
+
+import { ContainerId } from '../../../types';
+import { useStopContainer } from '../queries/useStopContainer';
+
+interface StopButtonProps {
+  environmentId: EnvironmentId;
+  containerId: ContainerId;
+  nodeName?: string;
+  isRunning: boolean;
+  isPortainer: boolean;
+  onSuccess?(): void;
+}
+
+export function StopButton({
+  environmentId,
+  containerId,
+  nodeName,
+  isRunning,
+  isPortainer,
+  onSuccess = () => {},
+}: StopButtonProps) {
+  const stopMutation = useStopContainer();
+
+  function handleStop() {
+    stopMutation.mutate(
+      { environmentId, containerId, nodeName },
+      {
+        onSuccess() {
+          notifySuccess('Success', 'Container successfully stopped');
+          onSuccess();
+        },
+      }
+    );
+  }
+
+  return (
+    <Authorized authorizations="DockerContainerStop">
+      <LoadingButton
+        color="light"
+        size="small"
+        onClick={handleStop}
+        disabled={!isRunning || isPortainer}
+        isLoading={stopMutation.isLoading}
+        loadingText="Stopping..."
+        data-cy="stop-container-button"
+        icon={Square}
+      >
+        Stop
+      </LoadingButton>
+    </Authorized>
+  );
+}
diff --git a/app/react/docker/containers/ItemView/ContainerActionsSection/SecondaryActions.test.tsx b/app/react/docker/containers/ItemView/ContainerActionsSection/SecondaryActions.test.tsx
new file mode 100644
index 0000000..f65da74
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerActionsSection/SecondaryActions.test.tsx
@@ -0,0 +1,226 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { vi } from 'vitest';
+import { http, HttpResponse } from 'msw';
+
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { ContainerEngine } from '@/react/portainer/environments/types';
+import { server } from '@/setup-tests/server';
+import { createMockEnvironment } from '@/react-tools/test-mocks';
+
+import { SecondaryActions } from './SecondaryActions';
+
+const mockRecreateMutate = vi.fn();
+
+vi.mock('@uirouter/react', async (importOriginal: () => Promise<object>) => ({
+  ...(await importOriginal()),
+  useRouter: vi.fn(() => ({
+    stateService: {
+      go: vi.fn(),
+    },
+  })),
+  useCurrentStateAndParams: vi.fn(() => ({
+    params: { endpointId: 1 }, // Must match environmentId in test props and user authorizations
+  })),
+}));
+
+vi.mock('./queries/useRecreateContainer', () => ({
+  useRecreateContainer: () => ({
+    mutate: mockRecreateMutate,
+    isLoading: false,
+  }),
+}));
+
+vi.mock(
+  '@/react/hooks/useUser',
+  async (importOriginal: () => Promise<object>) => {
+    const actual = await importOriginal();
+    return {
+      ...actual,
+      useIsEdgeAdmin: () => ({
+        isAdmin: true,
+      }),
+    };
+  }
+);
+
+vi.mock('@/react/docker/proxy/queries/useInfo', () => ({
+  useIsSwarm: () => false,
+}));
+
+const mockConfirmContainerRecreation = vi.fn();
+vi.mock('../ConfirmRecreationModal', () => ({
+  confirmContainerRecreation: (cannotPullImage: boolean) =>
+    mockConfirmContainerRecreation(cannotPullImage),
+}));
+
+describe('SecondaryActions', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+
+    // Setup MSW handler for environment endpoint
+    server.use(
+      http.get('/api/endpoints/:id', () =>
+        HttpResponse.json(
+          createMockEnvironment({
+            Id: 1,
+            ContainerEngine: ContainerEngine.Docker,
+            SecuritySettings: {
+              allowContainerCapabilitiesForRegularUsers: true,
+              allowBindMountsForRegularUsers: true,
+              allowDeviceMappingForRegularUsers: true,
+              allowSysctlSettingForRegularUsers: true,
+              allowHostNamespaceForRegularUsers: true,
+              allowPrivilegedModeForRegularUsers: true,
+              allowVolumeBrowserForRegularUsers: true,
+              allowStackManagementForRegularUsers: true,
+              allowSecurityOptForRegularUsers: true,
+              enableHostManagementFeatures: false,
+            },
+          })
+        )
+      )
+    );
+  });
+
+  it('should render component when authorized', async () => {
+    renderComponent();
+
+    // Wait for component to load environment data and render
+    await waitFor(() => {
+      expect(
+        screen.getByTestId('recreate-container-button')
+      ).toBeInTheDocument();
+    });
+  });
+
+  it('should show recreate button for Docker containers', async () => {
+    renderComponent();
+
+    await waitFor(() => {
+      expect(screen.getByTestId('recreate-container-button')).toBeVisible();
+    });
+  });
+
+  it('should show duplicate/edit button', async () => {
+    renderComponent();
+
+    await waitFor(() => {
+      expect(
+        screen.getByTestId('duplicate-edit-container-button')
+      ).toBeVisible();
+    });
+  });
+
+  it('should hide recreate button when container has AutoRemove enabled', () => {
+    renderComponent({ containerAutoRemove: true });
+
+    expect(
+      screen.queryByTestId('recreate-container-button')
+    ).not.toBeInTheDocument();
+  });
+
+  it('should show confirmation modal and call recreate mutation when confirmed', async () => {
+    const user = userEvent.setup();
+    mockConfirmContainerRecreation.mockResolvedValue({ pullLatest: true });
+
+    renderComponent();
+
+    const recreateButton = await screen.findByTestId(
+      'recreate-container-button'
+    );
+    await user.click(recreateButton);
+
+    await waitFor(() => {
+      expect(mockConfirmContainerRecreation).toHaveBeenCalledWith(false);
+    });
+
+    await waitFor(() => {
+      expect(mockRecreateMutate).toHaveBeenCalledWith(
+        {
+          environmentId: 1,
+          containerId: 'test-container-id',
+          pullImage: true,
+          nodeName: 'node1',
+        },
+        expect.objectContaining({
+          onSuccess: expect.any(Function),
+        })
+      );
+    });
+  });
+
+  it('should detect cannotPullImage when image starts with sha256', async () => {
+    const user = userEvent.setup();
+    mockConfirmContainerRecreation.mockResolvedValue({ pullLatest: false });
+
+    renderComponent({
+      containerImage: 'sha256:1234567890abcdef',
+    });
+
+    const recreateButton = await screen.findByTestId(
+      'recreate-container-button'
+    );
+    await user.click(recreateButton);
+
+    await waitFor(() => {
+      expect(mockConfirmContainerRecreation).toHaveBeenCalledWith(true);
+    });
+  });
+
+  it('should not call recreate mutation when confirmation is cancelled', async () => {
+    const user = userEvent.setup();
+    mockConfirmContainerRecreation.mockResolvedValue(undefined);
+
+    renderComponent();
+
+    const recreateButton = await screen.findByTestId(
+      'recreate-container-button'
+    );
+    await user.click(recreateButton);
+
+    await waitFor(() => {
+      expect(mockConfirmContainerRecreation).toHaveBeenCalled();
+    });
+
+    expect(mockRecreateMutate).not.toHaveBeenCalled();
+  });
+});
+
+function renderComponent(
+  props: Partial<React.ComponentProps<typeof SecondaryActions>> = {}
+) {
+  const defaultProps: React.ComponentProps<typeof SecondaryActions> = {
+    environmentId: 1,
+    containerId: 'test-container-id',
+    nodeName: 'node1',
+    containerImage: 'nginx:latest',
+    containerAutoRemove: false,
+    isPortainer: false,
+    partOfSwarmService: false,
+    ...props,
+  };
+
+  const mockUser = {
+    EndpointAuthorizations: {
+      1: { DockerContainerCreate: true },
+    },
+    PortainerAuthorizations: {},
+    Id: 1,
+    Role: 1,
+    Username: 'mock',
+    UseCache: false,
+    ThemeSettings: {
+      color: 'auto' as const,
+      subtleUpgradeButton: false,
+    },
+  };
+
+  const Wrapper = withTestQueryProvider(
+    withUserProvider(withTestRouter(SecondaryActions), mockUser)
+  );
+
+  return render(<Wrapper {...defaultProps} />);
+}
diff --git a/app/react/docker/containers/ItemView/ContainerActionsSection/SecondaryActions.tsx b/app/react/docker/containers/ItemView/ContainerActionsSection/SecondaryActions.tsx
new file mode 100644
index 0000000..77beec2
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerActionsSection/SecondaryActions.tsx
@@ -0,0 +1,69 @@
+import { Authorized } from '@/react/hooks/useUser';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { ButtonGroup } from '@@/buttons';
+
+import { ContainerId } from '../../types';
+
+import { RecreateButton } from './SecondaryActions/RecreateButton';
+import { DuplicateEditButton } from './SecondaryActions/DuplicateEditButton';
+import { useCanRecreateContainer } from './SecondaryActions/useCanRecreateContainer';
+import { useCanDuplicateEditContainer } from './SecondaryActions/useCanDuplicateEditContainer';
+
+interface Props {
+  environmentId: EnvironmentId;
+  containerId: ContainerId;
+  nodeName?: string;
+  containerImage: string;
+  containerAutoRemove: boolean | undefined;
+  isPortainer: boolean;
+  partOfSwarmService: boolean;
+}
+
+export function SecondaryActions({
+  environmentId,
+  containerId,
+  nodeName,
+  containerImage,
+  containerAutoRemove = false,
+  isPortainer,
+  partOfSwarmService,
+}: Props) {
+  const displayRecreateButton = useCanRecreateContainer({
+    autoRemove: containerAutoRemove,
+    partOfSwarmService,
+  });
+
+  const displayDuplicateEditButton = useCanDuplicateEditContainer({
+    autoRemove: containerAutoRemove,
+    partOfSwarmService,
+  });
+
+  if (!displayRecreateButton && !displayDuplicateEditButton) {
+    return null;
+  }
+
+  return (
+    <Authorized authorizations="DockerContainerCreate">
+      <ButtonGroup>
+        {displayRecreateButton && (
+          <RecreateButton
+            environmentId={environmentId}
+            containerId={containerId}
+            nodeName={nodeName}
+            containerImage={containerImage}
+            isPortainer={isPortainer}
+          />
+        )}
+
+        {displayDuplicateEditButton && (
+          <DuplicateEditButton
+            containerId={containerId}
+            nodeName={nodeName}
+            isPortainer={isPortainer}
+          />
+        )}
+      </ButtonGroup>
+    </Authorized>
+  );
+}
diff --git a/app/react/docker/containers/ItemView/ContainerActionsSection/SecondaryActions/DuplicateEditButton.tsx b/app/react/docker/containers/ItemView/ContainerActionsSection/SecondaryActions/DuplicateEditButton.tsx
new file mode 100644
index 0000000..64aef32
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerActionsSection/SecondaryActions/DuplicateEditButton.tsx
@@ -0,0 +1,38 @@
+import { Copy } from 'lucide-react';
+
+import { Button } from '@@/buttons';
+import { Link } from '@@/Link';
+
+import { ContainerId } from '../../../types';
+
+interface DuplicateEditButtonProps {
+  containerId: ContainerId;
+  nodeName?: string;
+  isPortainer: boolean;
+}
+
+export function DuplicateEditButton({
+  containerId,
+  nodeName,
+  isPortainer,
+}: DuplicateEditButtonProps) {
+  return (
+    <Button
+      color="light"
+      size="small"
+      as={Link}
+      disabled={isPortainer}
+      data-cy="duplicate-edit-container-button"
+      icon={Copy}
+      props={{
+        to: 'docker.containers.new',
+        params: {
+          from: containerId,
+          nodeName,
+        },
+      }}
+    >
+      Duplicate/Edit
+    </Button>
+  );
+}
diff --git a/app/react/docker/containers/ItemView/ContainerActionsSection/SecondaryActions/RecreateButton.tsx b/app/react/docker/containers/ItemView/ContainerActionsSection/SecondaryActions/RecreateButton.tsx
new file mode 100644
index 0000000..acb9dc8
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerActionsSection/SecondaryActions/RecreateButton.tsx
@@ -0,0 +1,71 @@
+import { RefreshCw } from 'lucide-react';
+import { useRouter } from '@uirouter/react';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { confirmContainerRecreation } from '@/react/docker/containers/ItemView/ConfirmRecreationModal';
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { LoadingButton } from '@@/buttons';
+
+import { ContainerId } from '../../../types';
+import { useRecreateContainer } from '../queries/useRecreateContainer';
+
+interface RecreateButtonProps {
+  environmentId: EnvironmentId;
+  containerId: ContainerId;
+  nodeName?: string;
+  containerImage: string;
+  isPortainer: boolean;
+}
+
+export function RecreateButton({
+  environmentId,
+  containerId,
+  nodeName,
+  containerImage,
+  isPortainer,
+}: RecreateButtonProps) {
+  const recreateMutation = useRecreateContainer();
+  const router = useRouter();
+
+  async function handleRecreate() {
+    const cannotPullImage =
+      !containerImage || containerImage.toLowerCase().startsWith('sha256');
+
+    const result = await confirmContainerRecreation(cannotPullImage);
+
+    if (!result) {
+      return;
+    }
+
+    recreateMutation.mutate(
+      {
+        environmentId,
+        containerId,
+        pullImage: result.pullLatest,
+        nodeName,
+      },
+      {
+        onSuccess: () => {
+          notifySuccess('Success', 'Container successfully re-created');
+          router.stateService.go('docker.containers', {}, { reload: true });
+        },
+      }
+    );
+  }
+
+  return (
+    <LoadingButton
+      color="light"
+      size="small"
+      onClick={handleRecreate}
+      disabled={isPortainer}
+      isLoading={recreateMutation.isLoading}
+      loadingText="Recreation in progress..."
+      data-cy="recreate-container-button"
+      icon={RefreshCw}
+    >
+      Recreate
+    </LoadingButton>
+  );
+}
diff --git a/app/react/docker/containers/ItemView/ContainerActionsSection/SecondaryActions/useCanDuplicateEditContainer.test.tsx b/app/react/docker/containers/ItemView/ContainerActionsSection/SecondaryActions/useCanDuplicateEditContainer.test.tsx
new file mode 100644
index 0000000..5029838
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerActionsSection/SecondaryActions/useCanDuplicateEditContainer.test.tsx
@@ -0,0 +1,138 @@
+import { renderHook } from '@testing-library/react-hooks';
+import { vi } from 'vitest';
+
+import {
+  Environment,
+  ContainerEngine,
+  EnvironmentSecuritySettings,
+} from '@/react/portainer/environments/types';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { createMockEnvironment } from '@/react-tools/test-mocks';
+
+import { useCanDuplicateEditContainer } from './useCanDuplicateEditContainer';
+
+let mockEnvironmentData: Environment | undefined;
+let mockIsAdmin = true;
+
+vi.mock('@/react/hooks/useCurrentEnvironment', () => ({
+  useCurrentEnvironment: vi.fn(() => ({
+    data: mockEnvironmentData,
+  })),
+}));
+
+vi.mock('@/react/hooks/useUser', () => ({
+  useIsEdgeAdmin: vi.fn(() => ({
+    isAdmin: mockIsAdmin,
+  })),
+}));
+
+describe('useCanDuplicateEditContainer', () => {
+  function createPermissiveSettings(): EnvironmentSecuritySettings {
+    return {
+      allowContainerCapabilitiesForRegularUsers: true,
+      allowBindMountsForRegularUsers: true,
+      allowDeviceMappingForRegularUsers: true,
+      allowSysctlSettingForRegularUsers: true,
+      allowSecurityOptForRegularUsers: true,
+      allowHostNamespaceForRegularUsers: true,
+      allowPrivilegedModeForRegularUsers: true,
+      allowVolumeBrowserForRegularUsers: true,
+      allowStackManagementForRegularUsers: true,
+      enableHostManagementFeatures: false,
+    };
+  }
+
+  function createRestrictiveSettings(): EnvironmentSecuritySettings {
+    return {
+      ...createPermissiveSettings(),
+      allowContainerCapabilitiesForRegularUsers: false,
+    };
+  }
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  function renderCustomHook(
+    ...params: Parameters<typeof useCanDuplicateEditContainer>
+  ) {
+    return renderHook(() => useCanDuplicateEditContainer(...params), {
+      wrapper: withTestQueryProvider(({ children }) => <>{children}</>),
+    });
+  }
+
+  it('should return true for Podman container (unlike recreate button)', () => {
+    mockEnvironmentData = createMockEnvironment({
+      ContainerEngine: ContainerEngine.Podman,
+      SecuritySettings: createPermissiveSettings(),
+    } as Environment);
+    mockIsAdmin = true;
+
+    const { result } = renderCustomHook({
+      autoRemove: false,
+      partOfSwarmService: false,
+    });
+
+    expect(result.current).toBe(true);
+  });
+
+  it('should return false when container is in Swarm', () => {
+    mockEnvironmentData = createMockEnvironment({
+      ContainerEngine: ContainerEngine.Docker,
+      SecuritySettings: createPermissiveSettings(),
+    } as Environment);
+    mockIsAdmin = true;
+
+    const { result } = renderCustomHook({
+      autoRemove: false,
+      partOfSwarmService: true,
+    });
+
+    expect(result.current).toBe(false);
+  });
+
+  it('should return false when AutoRemove is enabled', () => {
+    mockEnvironmentData = createMockEnvironment({
+      ContainerEngine: ContainerEngine.Docker,
+      SecuritySettings: createPermissiveSettings(),
+    } as Environment);
+    mockIsAdmin = true;
+
+    const { result } = renderCustomHook({
+      autoRemove: true,
+      partOfSwarmService: false,
+    });
+
+    expect(result.current).toBe(false);
+  });
+
+  it('should return false for regular user with restrictive settings', () => {
+    mockEnvironmentData = createMockEnvironment({
+      ContainerEngine: ContainerEngine.Docker,
+      SecuritySettings: createRestrictiveSettings(),
+    } as Environment);
+    mockIsAdmin = false;
+
+    const { result } = renderCustomHook({
+      autoRemove: false,
+      partOfSwarmService: false,
+    });
+
+    expect(result.current).toBe(false);
+  });
+
+  it('should return true for regular user with permissive settings', () => {
+    mockEnvironmentData = createMockEnvironment({
+      ContainerEngine: ContainerEngine.Docker,
+      SecuritySettings: createPermissiveSettings(),
+    } as Environment);
+    mockIsAdmin = false;
+
+    const { result } = renderCustomHook({
+      autoRemove: false,
+      partOfSwarmService: false,
+    });
+
+    expect(result.current).toBe(true);
+  });
+});
diff --git a/app/react/docker/containers/ItemView/ContainerActionsSection/SecondaryActions/useCanDuplicateEditContainer.ts b/app/react/docker/containers/ItemView/ContainerActionsSection/SecondaryActions/useCanDuplicateEditContainer.ts
new file mode 100644
index 0000000..bd902ec
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerActionsSection/SecondaryActions/useCanDuplicateEditContainer.ts
@@ -0,0 +1,30 @@
+import { useIsEdgeAdmin } from '@/react/hooks/useUser';
+import { useCurrentEnvironment } from '@/react/hooks/useCurrentEnvironment';
+
+import { isRegularUserRestricted } from './utils';
+
+/**
+ * Hook to determine if the duplicate/edit button should be displayed
+ */
+export function useCanDuplicateEditContainer({
+  autoRemove,
+  partOfSwarmService,
+}: {
+  autoRemove: boolean;
+  partOfSwarmService: boolean;
+}) {
+  const environmentQuery = useCurrentEnvironment();
+  const { isAdmin } = useIsEdgeAdmin();
+
+  if (!environmentQuery.data) {
+    return false;
+  }
+
+  const regularUserRestricted = isRegularUserRestricted(
+    environmentQuery.data.SecuritySettings
+  );
+
+  return (
+    !partOfSwarmService && !autoRemove && (isAdmin || !regularUserRestricted)
+  );
+}
diff --git a/app/react/docker/containers/ItemView/ContainerActionsSection/SecondaryActions/useCanRecreateContainer.test.tsx b/app/react/docker/containers/ItemView/ContainerActionsSection/SecondaryActions/useCanRecreateContainer.test.tsx
new file mode 100644
index 0000000..1cb414b
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerActionsSection/SecondaryActions/useCanRecreateContainer.test.tsx
@@ -0,0 +1,153 @@
+import { renderHook } from '@testing-library/react-hooks';
+import { vi } from 'vitest';
+
+import {
+  Environment,
+  ContainerEngine,
+  EnvironmentSecuritySettings,
+} from '@/react/portainer/environments/types';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { createMockEnvironment } from '@/react-tools/test-mocks';
+
+import { useCanRecreateContainer } from './useCanRecreateContainer';
+
+let mockEnvironmentData: Environment | undefined;
+let mockIsAdmin = true;
+
+vi.mock('@/react/hooks/useCurrentEnvironment', () => ({
+  useCurrentEnvironment: vi.fn(() => ({
+    data: mockEnvironmentData,
+  })),
+}));
+
+vi.mock('@/react/hooks/useUser', () => ({
+  useIsEdgeAdmin: vi.fn(() => ({
+    isAdmin: mockIsAdmin,
+  })),
+}));
+
+describe('useCanRecreateContainer', () => {
+  function createPermissiveSettings(): EnvironmentSecuritySettings {
+    return {
+      allowContainerCapabilitiesForRegularUsers: true,
+      allowBindMountsForRegularUsers: true,
+      allowDeviceMappingForRegularUsers: true,
+      allowSysctlSettingForRegularUsers: true,
+      allowSecurityOptForRegularUsers: true,
+      allowHostNamespaceForRegularUsers: true,
+      allowPrivilegedModeForRegularUsers: true,
+      allowVolumeBrowserForRegularUsers: true,
+      allowStackManagementForRegularUsers: true,
+      enableHostManagementFeatures: false,
+    };
+  }
+
+  function createRestrictiveSettings(): EnvironmentSecuritySettings {
+    return {
+      ...createPermissiveSettings(),
+      allowContainerCapabilitiesForRegularUsers: false,
+    };
+  }
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  function renderCustomHook(
+    ...params: Parameters<typeof useCanRecreateContainer>
+  ) {
+    return renderHook(() => useCanRecreateContainer(...params), {
+      wrapper: withTestQueryProvider(({ children }) => <>{children}</>),
+    });
+  }
+
+  it('should return true for Docker container with admin user', () => {
+    mockEnvironmentData = createMockEnvironment({
+      ContainerEngine: ContainerEngine.Docker,
+      SecuritySettings: createPermissiveSettings(),
+    } as Environment);
+    mockIsAdmin = true;
+
+    const { result } = renderCustomHook({
+      autoRemove: false,
+      partOfSwarmService: false,
+    });
+
+    expect(result.current).toBe(true);
+  });
+
+  it('should return false for Podman container', () => {
+    mockEnvironmentData = createMockEnvironment({
+      ContainerEngine: ContainerEngine.Podman,
+      SecuritySettings: createPermissiveSettings(),
+    } as Environment);
+    mockIsAdmin = true;
+
+    const { result } = renderCustomHook({
+      autoRemove: false,
+      partOfSwarmService: false,
+    });
+
+    expect(result.current).toBe(false);
+  });
+
+  it('should return false when container is in Swarm', () => {
+    mockEnvironmentData = createMockEnvironment({
+      ContainerEngine: ContainerEngine.Docker,
+      SecuritySettings: createPermissiveSettings(),
+    } as Environment);
+    mockIsAdmin = true;
+
+    const { result } = renderCustomHook({
+      autoRemove: false,
+      partOfSwarmService: true,
+    });
+
+    expect(result.current).toBe(false);
+  });
+
+  it('should return false when AutoRemove is enabled', () => {
+    mockEnvironmentData = createMockEnvironment({
+      ContainerEngine: ContainerEngine.Docker,
+      SecuritySettings: createPermissiveSettings(),
+    } as Environment);
+    mockIsAdmin = true;
+
+    const { result } = renderCustomHook({
+      autoRemove: true,
+      partOfSwarmService: false,
+    });
+
+    expect(result.current).toBe(false);
+  });
+
+  it('should return false for regular user with restrictive settings', () => {
+    mockEnvironmentData = createMockEnvironment({
+      ContainerEngine: ContainerEngine.Docker,
+      SecuritySettings: createRestrictiveSettings(),
+    } as Environment);
+    mockIsAdmin = false;
+
+    const { result } = renderCustomHook({
+      autoRemove: false,
+      partOfSwarmService: false,
+    });
+
+    expect(result.current).toBe(false);
+  });
+
+  it('should return true for regular user with permissive settings', () => {
+    mockEnvironmentData = createMockEnvironment({
+      ContainerEngine: ContainerEngine.Docker,
+      SecuritySettings: createPermissiveSettings(),
+    } as Environment);
+    mockIsAdmin = false;
+
+    const { result } = renderCustomHook({
+      autoRemove: false,
+      partOfSwarmService: false,
+    });
+
+    expect(result.current).toBe(true);
+  });
+});
diff --git a/app/react/docker/containers/ItemView/ContainerActionsSection/SecondaryActions/useCanRecreateContainer.ts b/app/react/docker/containers/ItemView/ContainerActionsSection/SecondaryActions/useCanRecreateContainer.ts
new file mode 100644
index 0000000..485fbd8
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerActionsSection/SecondaryActions/useCanRecreateContainer.ts
@@ -0,0 +1,32 @@
+import { ContainerEngine } from '@/react/portainer/environments/types';
+import { useCurrentEnvironment } from '@/react/hooks/useCurrentEnvironment';
+
+import { useCanDuplicateEditContainer } from './useCanDuplicateEditContainer';
+
+/**
+ * Hook to determine if the recreate button should be displayed
+ * Recreate button is hidden for:
+ * - Containers in Swarm
+ * - Containers with AutoRemove enabled
+ * - Podman containers (known issue with memory swappiness in cgroupv2)
+ * - Regular users when security settings restrict container operations
+ *
+ * should be false for Podman because
+ * recreating Podman containers gives an error: cannot set memory swappiness with cgroupv2
+ * https://github.com/containrrr/watchtower/issues/1060#issuecomment-2319076222
+ */
+export function useCanRecreateContainer(
+  ...params: Parameters<typeof useCanDuplicateEditContainer>
+) {
+  const canDuplicate = useCanDuplicateEditContainer(...params);
+  const environmentQuery = useCurrentEnvironment();
+
+  if (!environmentQuery.data) {
+    return false;
+  }
+
+  const isPodman =
+    environmentQuery.data.ContainerEngine === ContainerEngine.Podman;
+
+  return canDuplicate && !isPodman;
+}
diff --git a/app/react/docker/containers/ItemView/ContainerActionsSection/SecondaryActions/utils.ts b/app/react/docker/containers/ItemView/ContainerActionsSection/SecondaryActions/utils.ts
new file mode 100644
index 0000000..c49149f
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerActionsSection/SecondaryActions/utils.ts
@@ -0,0 +1,18 @@
+import { EnvironmentSecuritySettings } from '@/react/portainer/environments/types';
+
+/**
+ * Checks if security settings restrict regular users from container operations
+ */
+export function isRegularUserRestricted(
+  securitySettings: EnvironmentSecuritySettings
+): boolean {
+  return (
+    !securitySettings.allowContainerCapabilitiesForRegularUsers ||
+    !securitySettings.allowBindMountsForRegularUsers ||
+    !securitySettings.allowDeviceMappingForRegularUsers ||
+    !securitySettings.allowSysctlSettingForRegularUsers ||
+    !securitySettings.allowSecurityOptForRegularUsers ||
+    !securitySettings.allowHostNamespaceForRegularUsers ||
+    !securitySettings.allowPrivilegedModeForRegularUsers
+  );
+}
diff --git a/app/react/docker/containers/ItemView/ContainerActionsSection/queries/useKillContainer.ts b/app/react/docker/containers/ItemView/ContainerActionsSection/queries/useKillContainer.ts
new file mode 100644
index 0000000..88b036d
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerActionsSection/queries/useKillContainer.ts
@@ -0,0 +1,36 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { withError } from '@/react-tools/react-query';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { killContainer } from '../../../containers.service';
+import { ContainerId } from '../../../types';
+import { queryKeys as containerQueryKeys } from '../../../queries/query-keys';
+
+interface ContainerActionParams {
+  environmentId: EnvironmentId;
+  containerId: ContainerId;
+  nodeName?: string;
+}
+
+export function useKillContainer() {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: ({
+      environmentId,
+      containerId,
+      nodeName,
+    }: ContainerActionParams) =>
+      killContainer(environmentId, containerId, { nodeName }),
+    onSuccess: (_data, variables) => {
+      queryClient.invalidateQueries({
+        queryKey: containerQueryKeys.container(
+          variables.environmentId,
+          variables.containerId
+        ),
+      });
+    },
+    ...withError('Unable to kill container'),
+  });
+}
diff --git a/app/react/docker/containers/ItemView/ContainerActionsSection/queries/usePauseContainer.ts b/app/react/docker/containers/ItemView/ContainerActionsSection/queries/usePauseContainer.ts
new file mode 100644
index 0000000..b7c58c8
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerActionsSection/queries/usePauseContainer.ts
@@ -0,0 +1,36 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { withError } from '@/react-tools/react-query';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { pauseContainer } from '../../../containers.service';
+import { ContainerId } from '../../../types';
+import { queryKeys as containerQueryKeys } from '../../../queries/query-keys';
+
+interface ContainerActionParams {
+  environmentId: EnvironmentId;
+  containerId: ContainerId;
+  nodeName?: string;
+}
+
+export function usePauseContainer() {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: ({
+      environmentId,
+      containerId,
+      nodeName,
+    }: ContainerActionParams) =>
+      pauseContainer(environmentId, containerId, { nodeName }),
+    onSuccess: (_data, variables) => {
+      queryClient.invalidateQueries({
+        queryKey: containerQueryKeys.container(
+          variables.environmentId,
+          variables.containerId
+        ),
+      });
+    },
+    ...withError('Unable to pause container'),
+  });
+}
diff --git a/app/react/docker/containers/ItemView/ContainerActionsSection/queries/useRecreateContainer.ts b/app/react/docker/containers/ItemView/ContainerActionsSection/queries/useRecreateContainer.ts
new file mode 100644
index 0000000..dd1d11b
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerActionsSection/queries/useRecreateContainer.ts
@@ -0,0 +1,38 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { withError } from '@/react-tools/react-query';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { queryKeys as containerQueryKeys } from '../../../queries/query-keys';
+import { recreateContainer } from '../../../containers.service';
+import { ContainerId } from '../../../types';
+
+interface RecreateContainerParams {
+  environmentId: EnvironmentId;
+  containerId: ContainerId;
+  pullImage: boolean;
+  nodeName?: string;
+}
+
+export function useRecreateContainer() {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: ({
+      environmentId,
+      containerId,
+      pullImage,
+      nodeName,
+    }: RecreateContainerParams) =>
+      recreateContainer(environmentId, containerId, pullImage, { nodeName }),
+    onSuccess: (_, variables) => {
+      queryClient.removeQueries({
+        queryKey: containerQueryKeys.container(
+          variables.environmentId,
+          variables.containerId
+        ),
+      });
+    },
+    ...withError('Unable to re-create container'),
+  });
+}
diff --git a/app/react/docker/containers/ItemView/ContainerActionsSection/queries/useRemoveContainer.ts b/app/react/docker/containers/ItemView/ContainerActionsSection/queries/useRemoveContainer.ts
new file mode 100644
index 0000000..bca1ef8
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerActionsSection/queries/useRemoveContainer.ts
@@ -0,0 +1,44 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+import { useRouter } from '@uirouter/react';
+
+import { withError } from '@/react-tools/react-query';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { removeContainer } from '../../../containers.service';
+import { ContainerId } from '../../../types';
+import { queryKeys as containerQueryKeys } from '../../../queries/query-keys';
+
+interface RemoveContainerParams {
+  environmentId: EnvironmentId;
+  containerId: ContainerId;
+  nodeName?: string;
+  removeVolumes?: boolean;
+}
+
+export function useRemoveContainer() {
+  const queryClient = useQueryClient();
+  const router = useRouter();
+
+  return useMutation({
+    mutationFn: ({
+      environmentId,
+      containerId,
+      nodeName,
+      removeVolumes,
+    }: RemoveContainerParams) =>
+      removeContainer(environmentId, containerId, { nodeName, removeVolumes }),
+    onSuccess: (_data, variables) => {
+      queryClient.removeQueries({
+        queryKey: containerQueryKeys.container(
+          variables.environmentId,
+          variables.containerId
+        ),
+      });
+      queryClient.invalidateQueries({
+        queryKey: containerQueryKeys.list(variables.environmentId),
+      });
+      router.stateService.go('^');
+    },
+    ...withError('Unable to remove container'),
+  });
+}
diff --git a/app/react/docker/containers/ItemView/ContainerActionsSection/queries/useRestartContainer.ts b/app/react/docker/containers/ItemView/ContainerActionsSection/queries/useRestartContainer.ts
new file mode 100644
index 0000000..6faffbf
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerActionsSection/queries/useRestartContainer.ts
@@ -0,0 +1,36 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { withError } from '@/react-tools/react-query';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { restartContainer } from '../../../containers.service';
+import { ContainerId } from '../../../types';
+import { queryKeys as containerQueryKeys } from '../../../queries/query-keys';
+
+interface ContainerActionParams {
+  environmentId: EnvironmentId;
+  containerId: ContainerId;
+  nodeName?: string;
+}
+
+export function useRestartContainer() {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: ({
+      environmentId,
+      containerId,
+      nodeName,
+    }: ContainerActionParams) =>
+      restartContainer(environmentId, containerId, { nodeName }),
+    onSuccess: (_data, variables) => {
+      queryClient.invalidateQueries({
+        queryKey: containerQueryKeys.container(
+          variables.environmentId,
+          variables.containerId
+        ),
+      });
+    },
+    ...withError('Unable to restart container'),
+  });
+}
diff --git a/app/react/docker/containers/ItemView/ContainerActionsSection/queries/useResumeContainer.ts b/app/react/docker/containers/ItemView/ContainerActionsSection/queries/useResumeContainer.ts
new file mode 100644
index 0000000..8f27dbd
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerActionsSection/queries/useResumeContainer.ts
@@ -0,0 +1,36 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { withError } from '@/react-tools/react-query';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { resumeContainer } from '../../../containers.service';
+import { ContainerId } from '../../../types';
+import { queryKeys as containerQueryKeys } from '../../../queries/query-keys';
+
+interface ContainerActionParams {
+  environmentId: EnvironmentId;
+  containerId: ContainerId;
+  nodeName?: string;
+}
+
+export function useResumeContainer() {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: ({
+      environmentId,
+      containerId,
+      nodeName,
+    }: ContainerActionParams) =>
+      resumeContainer(environmentId, containerId, { nodeName }),
+    onSuccess: (_data, variables) => {
+      queryClient.invalidateQueries({
+        queryKey: containerQueryKeys.container(
+          variables.environmentId,
+          variables.containerId
+        ),
+      });
+    },
+    ...withError('Unable to resume container'),
+  });
+}
diff --git a/app/react/docker/containers/ItemView/ContainerActionsSection/queries/useStartContainer.ts b/app/react/docker/containers/ItemView/ContainerActionsSection/queries/useStartContainer.ts
new file mode 100644
index 0000000..94ad5f0
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerActionsSection/queries/useStartContainer.ts
@@ -0,0 +1,36 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { withError } from '@/react-tools/react-query';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { startContainer } from '../../../containers.service';
+import { ContainerId } from '../../../types';
+import { queryKeys as containerQueryKeys } from '../../../queries/query-keys';
+
+interface ContainerActionParams {
+  environmentId: EnvironmentId;
+  containerId: ContainerId;
+  nodeName?: string;
+}
+
+export function useStartContainer() {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: ({
+      environmentId,
+      containerId,
+      nodeName,
+    }: ContainerActionParams) =>
+      startContainer(environmentId, containerId, { nodeName }),
+    onSuccess: (_data, variables) => {
+      queryClient.invalidateQueries({
+        queryKey: containerQueryKeys.container(
+          variables.environmentId,
+          variables.containerId
+        ),
+      });
+    },
+    ...withError('Unable to start container'),
+  });
+}
diff --git a/app/react/docker/containers/ItemView/ContainerActionsSection/queries/useStopContainer.ts b/app/react/docker/containers/ItemView/ContainerActionsSection/queries/useStopContainer.ts
new file mode 100644
index 0000000..8a05a2e
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerActionsSection/queries/useStopContainer.ts
@@ -0,0 +1,36 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { withError } from '@/react-tools/react-query';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { stopContainer } from '../../../containers.service';
+import { ContainerId } from '../../../types';
+import { queryKeys as containerQueryKeys } from '../../../queries/query-keys';
+
+interface ContainerActionParams {
+  environmentId: EnvironmentId;
+  containerId: ContainerId;
+  nodeName?: string;
+}
+
+export function useStopContainer() {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: ({
+      environmentId,
+      containerId,
+      nodeName,
+    }: ContainerActionParams) =>
+      stopContainer(environmentId, containerId, { nodeName }),
+    onSuccess: (_data, variables) => {
+      queryClient.invalidateQueries({
+        queryKey: containerQueryKeys.container(
+          variables.environmentId,
+          variables.containerId
+        ),
+      });
+    },
+    ...withError('Unable to stop container'),
+  });
+}
diff --git a/app/react/docker/containers/ItemView/ContainerDetailsSection/ContainerDetailsSection.test.tsx b/app/react/docker/containers/ItemView/ContainerDetailsSection/ContainerDetailsSection.test.tsx
new file mode 100644
index 0000000..a16af4b
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerDetailsSection/ContainerDetailsSection.test.tsx
@@ -0,0 +1,66 @@
+import { render, screen } from '@testing-library/react';
+import { describe, expect, test } from 'vitest';
+
+import { ContainerDetailsViewModel } from '@/docker/models/containerDetails';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { createMockContainer } from '@/react-tools/test-mocks';
+
+import { ContainerDetailsSection } from './ContainerDetailsSection';
+
+function renderComponent(
+  container: ContainerDetailsViewModel,
+  nodeName?: string
+) {
+  const Wrapped = withTestQueryProvider(
+    withTestRouter(withUserProvider(ContainerDetailsSection))
+  );
+
+  return render(
+    <Wrapped environmentId={1} container={container} nodeName={nodeName} />
+  );
+}
+
+describe('ContainerDetailsSection', () => {
+  test('renders container details correctly', () => {
+    const container = createMockContainer({
+      Image: 'hash',
+      Config: { Image: 'nginx:latest' },
+    });
+
+    renderComponent(container);
+
+    expect(screen.getByText('Container details')).toBeVisible();
+    expect(screen.getByText('nginx:latest@hash')).toBeVisible();
+    expect(screen.getByText('CMD')).toBeVisible();
+  });
+
+  test('hides empty sections', () => {
+    // make sure container is empty
+    const container = {
+      Config: {
+        Image: 'nginx:latest',
+        Cmd: ['nginx'],
+        Entrypoint: [],
+        Env: [],
+        Labels: {},
+      },
+      HostConfig: {
+        RestartPolicy: { Name: 'no', MaximumRetryCount: 0 },
+        Sysctls: {},
+        DeviceRequests: [],
+      },
+      NetworkSettings: {
+        Ports: {},
+      },
+    } as unknown as ContainerDetailsViewModel;
+
+    renderComponent(container);
+
+    expect(screen.queryByText('Labels')).not.toBeInTheDocument();
+    expect(screen.queryByText('Sysctls')).not.toBeInTheDocument();
+    expect(screen.queryByText('GPUS')).not.toBeInTheDocument();
+    expect(screen.queryByText('Port configuration')).not.toBeInTheDocument();
+  });
+});
diff --git a/app/react/docker/containers/ItemView/ContainerDetailsSection/ContainerDetailsSection.tsx b/app/react/docker/containers/ItemView/ContainerDetailsSection/ContainerDetailsSection.tsx
new file mode 100644
index 0000000..6b13966
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerDetailsSection/ContainerDetailsSection.tsx
@@ -0,0 +1,92 @@
+import { List } from 'lucide-react';
+
+import { ContainerDetailsViewModel } from '@/docker/models/containerDetails';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { joinCommand } from '@/docker/filters/utils';
+
+import { DetailsTable } from '@@/DetailsTable';
+import { Widget } from '@@/Widget';
+
+import { RestartPolicy } from '../../CreateView/RestartPolicyTab/types';
+import { RestartPolicySection } from '../RestartPolicySection/RestartPolicySection';
+
+import { ImageRow } from './ImageRow';
+import { PortConfigurationRow } from './PortConfigurationRow';
+import { EnvironmentVariablesRow } from './EnvironmentVariablesRow';
+import { LabelsRow } from './LabelsRow';
+import { SysctlsRow } from './SysctlsRow';
+import { SecurityOptRow } from './SecurityOptRow';
+import { GpuRow } from './GpuRow';
+
+interface Props {
+  environmentId: EnvironmentId;
+  container: ContainerDetailsViewModel;
+  nodeName?: string;
+  onUpdateSuccess?(): void;
+}
+
+export function ContainerDetailsSection({
+  environmentId,
+  container,
+  nodeName,
+  onUpdateSuccess,
+}: Props) {
+  const config = container.Config;
+  const hostConfig = container.HostConfig;
+
+  if (!config || !hostConfig || !container.Id) {
+    return null;
+  }
+
+  const restartPolicyName = hostConfig.RestartPolicy?.Name as
+    | RestartPolicy
+    | undefined;
+
+  return (
+    <Widget>
+      <Widget.Title icon={List} title="Container details" />
+      <Widget.Body>
+        <DetailsTable dataCy="container-details-table">
+          <ImageRow
+            image={config.Image || ''}
+            imageHash={container.Image || ''}
+            nodeName={nodeName}
+          />
+
+          <PortConfigurationRow ports={container.NetworkSettings?.Ports} />
+
+          <DetailsTable.Row label="CMD">
+            <code>{joinCommand(config.Cmd)}</code>
+          </DetailsTable.Row>
+
+          <DetailsTable.Row label="ENTRYPOINT">
+            <code>
+              {config.Entrypoint ? joinCommand(config.Entrypoint) : 'null'}
+            </code>
+          </DetailsTable.Row>
+
+          <EnvironmentVariablesRow variables={config.Env} />
+
+          <LabelsRow labels={config.Labels} />
+
+          <DetailsTable.Row label="Restart policies">
+            <RestartPolicySection
+              environmentId={environmentId}
+              containerId={container.Id}
+              nodeName={nodeName}
+              name={restartPolicyName}
+              maximumRetryCount={hostConfig.RestartPolicy?.MaximumRetryCount}
+              onUpdateSuccess={onUpdateSuccess}
+            />
+          </DetailsTable.Row>
+
+          <SysctlsRow sysctls={hostConfig.Sysctls} />
+
+          <SecurityOptRow securityOpts={hostConfig.SecurityOpt} />
+
+          <GpuRow deviceRequests={hostConfig.DeviceRequests} />
+        </DetailsTable>
+      </Widget.Body>
+    </Widget>
+  );
+}
diff --git a/app/react/docker/containers/ItemView/ContainerDetailsSection/EnvironmentVariablesRow.tsx b/app/react/docker/containers/ItemView/ContainerDetailsSection/EnvironmentVariablesRow.tsx
new file mode 100644
index 0000000..0887159
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerDetailsSection/EnvironmentVariablesRow.tsx
@@ -0,0 +1,46 @@
+import { DetailsTable } from '@@/DetailsTable';
+
+interface EnvironmentVariablesRowProps {
+  variables: Array<string> | undefined;
+}
+
+export function EnvironmentVariablesRow({
+  variables,
+}: EnvironmentVariablesRowProps) {
+  if (!variables || variables?.length === 0) {
+    return null;
+  }
+
+  const sortedEnv = [...variables].sort((a, b) =>
+    a.toLowerCase().localeCompare(b.toLowerCase())
+  );
+
+  return (
+    <DetailsTable.Row label="ENV">
+      <table className="table-bordered table-condensed !m-0 table">
+        <tbody>
+          {sortedEnv.map((envVar, index) => {
+            const { key, value } = parseEnvVariable(envVar);
+            return (
+              <tr key={index}>
+                <td>{key}</td>
+                <td>{value}</td>
+              </tr>
+            );
+          })}
+        </tbody>
+      </table>
+    </DetailsTable.Row>
+  );
+}
+
+function parseEnvVariable(envVar: string): { key: string; value: string } {
+  const index = envVar.indexOf('=');
+  if (index === -1) {
+    return { key: envVar, value: '' };
+  }
+  return {
+    key: envVar.substring(0, index),
+    value: envVar.substring(index + 1),
+  };
+}
diff --git a/app/react/docker/containers/ItemView/ContainerDetailsSection/GpuRow.test.tsx b/app/react/docker/containers/ItemView/ContainerDetailsSection/GpuRow.test.tsx
new file mode 100644
index 0000000..18df0e8
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerDetailsSection/GpuRow.test.tsx
@@ -0,0 +1,131 @@
+import { DeviceRequest } from 'docker-types/generated/1.44';
+
+import { computeDockerGPUCommand } from './GpuRow';
+
+describe('computeDockerGPUCommand', () => {
+  it('should return "No GPU config found" when deviceRequests is empty', () => {
+    const result = computeDockerGPUCommand([]);
+    expect(result).toBe('No GPU config found');
+  });
+
+  it('should return "No GPU config found" when no GPU request is found', () => {
+    const deviceRequests: Array<DeviceRequest> = [
+      {
+        Driver: 'other',
+        Count: 1,
+        DeviceIDs: [],
+        Capabilities: [],
+        Options: {},
+      },
+    ];
+    const result = computeDockerGPUCommand(deviceRequests);
+    expect(result).toBe('No GPU config found');
+  });
+
+  it('should return "all" with capabilities for nvidia driver with Count=-1', () => {
+    const deviceRequests: Array<DeviceRequest> = [
+      {
+        Driver: 'nvidia',
+        Count: -1,
+        DeviceIDs: [],
+        Capabilities: [['gpu', 'utility']],
+        Options: {},
+      },
+    ];
+    const result = computeDockerGPUCommand(deviceRequests);
+    expect(result).toBe('all,"capabilities=gpu,utility"');
+  });
+
+  it('should return device IDs with capabilities when Count is not -1', () => {
+    const deviceRequests: Array<DeviceRequest> = [
+      {
+        Driver: 'nvidia',
+        Count: 2,
+        DeviceIDs: ['0', '1'],
+        Capabilities: [['gpu', 'compute']],
+        Options: {},
+      },
+    ];
+    const result = computeDockerGPUCommand(deviceRequests);
+    expect(result).toBe('"device=0,1","capabilities=gpu,compute"');
+  });
+
+  it('should work with gpu capability detection instead of nvidia driver', () => {
+    const deviceRequests: Array<DeviceRequest> = [
+      {
+        Driver: '',
+        Count: -1,
+        DeviceIDs: [],
+        Capabilities: [['gpu']],
+        Options: {},
+      },
+    ];
+    const result = computeDockerGPUCommand(deviceRequests);
+    expect(result).toBe('all,"capabilities=gpu"');
+  });
+
+  it('should return "all" without capabilities when Capabilities is undefined', () => {
+    const deviceRequests: Array<DeviceRequest> = [
+      {
+        Driver: 'nvidia',
+        Count: -1,
+        DeviceIDs: [],
+        Capabilities: undefined,
+        Options: {},
+      },
+    ];
+    const result = computeDockerGPUCommand(deviceRequests);
+    expect(result).toBe('all,');
+  });
+
+  it('should handle multiple device IDs correctly', () => {
+    const deviceRequests: Array<DeviceRequest> = [
+      {
+        Driver: 'nvidia',
+        Count: 3,
+        DeviceIDs: ['GPU-0', 'GPU-1', 'GPU-2'],
+        Capabilities: [['gpu', 'utility', 'compute']],
+        Options: {},
+      },
+    ];
+    const result = computeDockerGPUCommand(deviceRequests);
+    expect(result).toBe(
+      '"device=GPU-0,GPU-1,GPU-2","capabilities=gpu,utility,compute"'
+    );
+  });
+
+  it('should find GPU request when it is not the first element', () => {
+    const deviceRequests: Array<DeviceRequest> = [
+      {
+        Driver: 'other',
+        Count: 1,
+        DeviceIDs: [],
+        Capabilities: [],
+        Options: {},
+      },
+      {
+        Driver: 'nvidia',
+        Count: -1,
+        DeviceIDs: [],
+        Capabilities: [['gpu']],
+        Options: {},
+      },
+    ];
+    const result = computeDockerGPUCommand(deviceRequests);
+    expect(result).toBe('all,"capabilities=gpu"');
+  });
+
+  it('should handle empty capabilities array', () => {
+    const deviceRequests: Array<DeviceRequest> = [
+      {
+        Driver: 'nvidia',
+        Count: -1,
+        DeviceIDs: [],
+        Capabilities: [[]],
+        Options: {},
+      },
+    ];
+    const result = computeDockerGPUCommand(deviceRequests);
+    expect(result).toBe('all,"capabilities="');
+  });
+});
diff --git a/app/react/docker/containers/ItemView/ContainerDetailsSection/GpuRow.tsx b/app/react/docker/containers/ItemView/ContainerDetailsSection/GpuRow.tsx
new file mode 100644
index 0000000..128569a
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerDetailsSection/GpuRow.tsx
@@ -0,0 +1,50 @@
+import { DeviceRequest } from 'docker-types/generated/1.44';
+import _ from 'lodash';
+
+import { DetailsTable } from '@@/DetailsTable';
+
+interface GpuRowProps {
+  deviceRequests?: Array<DeviceRequest>;
+}
+
+export function GpuRow({ deviceRequests }: GpuRowProps) {
+  if (!deviceRequests?.length) {
+    return null;
+  }
+
+  const gpuCommand = computeDockerGPUCommand(deviceRequests);
+
+  if (!gpuCommand) {
+    return null;
+  }
+
+  return <DetailsTable.Row label="GPUS">{gpuCommand}</DetailsTable.Row>;
+}
+
+export function computeDockerGPUCommand(
+  deviceRequests: Array<DeviceRequest>
+): string | null {
+  const gpuOptions = deviceRequests?.find(
+    (o) =>
+      o.Driver === 'nvidia' ||
+      (o.Capabilities &&
+        o.Capabilities.length > 0 &&
+        o.Capabilities[0].length > 0 &&
+        o.Capabilities[0][0] === 'gpu')
+  );
+  if (!gpuOptions) {
+    return 'No GPU config found';
+  }
+
+  let gpuStr = 'all';
+  if (gpuOptions.Count !== -1) {
+    gpuStr = `"device=${_.join(gpuOptions.DeviceIDs, ',')}"`;
+  }
+
+  // we only support a single set of capabilities for now
+  // creation UI needs to be reworked in order to support OR combinations of AND capabilities
+  const capStr = gpuOptions.Capabilities
+    ? `"capabilities=${_.join(gpuOptions.Capabilities[0], ',')}"`
+    : '';
+  return `${gpuStr},${capStr}`;
+}
diff --git a/app/react/docker/containers/ItemView/ContainerDetailsSection/ImageRow.tsx b/app/react/docker/containers/ItemView/ContainerDetailsSection/ImageRow.tsx
new file mode 100644
index 0000000..0b8cd56
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerDetailsSection/ImageRow.tsx
@@ -0,0 +1,22 @@
+import { DetailsTable } from '@@/DetailsTable';
+import { Link } from '@@/Link';
+
+interface ImageRowProps {
+  image: string;
+  imageHash: string;
+  nodeName?: string;
+}
+
+export function ImageRow({ image, imageHash, nodeName }: ImageRowProps) {
+  return (
+    <DetailsTable.Row label="Image">
+      <Link
+        data-cy="container-image-link"
+        to="docker.images.image"
+        params={{ id: image, nodeName }}
+      >
+        {image}@{imageHash}
+      </Link>
+    </DetailsTable.Row>
+  );
+}
diff --git a/app/react/docker/containers/ItemView/ContainerDetailsSection/LabelsRow.tsx b/app/react/docker/containers/ItemView/ContainerDetailsSection/LabelsRow.tsx
new file mode 100644
index 0000000..8696ae5
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerDetailsSection/LabelsRow.tsx
@@ -0,0 +1,26 @@
+import { DetailsTable } from '@@/DetailsTable';
+
+interface LabelsRowProps {
+  labels?: Record<string, string>;
+}
+
+export function LabelsRow({ labels }: LabelsRowProps) {
+  if (!labels || Object.keys(labels).length === 0) {
+    return null;
+  }
+
+  return (
+    <DetailsTable.Row label="Labels">
+      <table className="table-bordered table-condensed !m-0 table">
+        <tbody>
+          {Object.entries(labels).map(([key, value]) => (
+            <tr key={key}>
+              <td>{key}</td>
+              <td>{value}</td>
+            </tr>
+          ))}
+        </tbody>
+      </table>
+    </DetailsTable.Row>
+  );
+}
diff --git a/app/react/docker/containers/ItemView/ContainerDetailsSection/PortConfigurationRow.tsx b/app/react/docker/containers/ItemView/ContainerDetailsSection/PortConfigurationRow.tsx
new file mode 100644
index 0000000..e215810
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerDetailsSection/PortConfigurationRow.tsx
@@ -0,0 +1,46 @@
+import { ArrowRight } from 'lucide-react';
+import { PortMap } from 'docker-types/generated/1.44';
+
+import { DetailsTable } from '@@/DetailsTable';
+
+interface PortConfigurationRowProps {
+  ports: PortMap | undefined;
+}
+
+export function PortConfigurationRow({ ports }: PortConfigurationRowProps) {
+  const bindings = transformPortBindings(ports);
+
+  if (bindings.length === 0) {
+    return null;
+  }
+
+  return (
+    <DetailsTable.Row label="Port configuration">
+      {bindings.map((binding, index) => (
+        <div key={index} className="flex items-center gap-2">
+          {binding.host} <ArrowRight size={13} />
+          {binding.container}
+        </div>
+      ))}
+    </DetailsTable.Row>
+  );
+}
+
+function transformPortBindings(ports: PortMap | undefined) {
+  const bindings: Array<{ container: string; host: string }> = [];
+  if (!ports) return bindings;
+
+  Object.keys(ports).forEach((containerPort) => {
+    const mappings = ports[containerPort];
+    if (mappings) {
+      mappings.forEach((mapping) => {
+        bindings.push({
+          container: containerPort,
+          host: `${mapping.HostIp}:${mapping.HostPort}`,
+        });
+      });
+    }
+  });
+
+  return bindings;
+}
diff --git a/app/react/docker/containers/ItemView/ContainerDetailsSection/SecurityOptRow.tsx b/app/react/docker/containers/ItemView/ContainerDetailsSection/SecurityOptRow.tsx
new file mode 100644
index 0000000..9f692f6
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerDetailsSection/SecurityOptRow.tsx
@@ -0,0 +1,25 @@
+import { DetailsTable } from '@@/DetailsTable';
+
+interface SecurityOptRowProps {
+  securityOpts?: Array<string>;
+}
+
+export function SecurityOptRow({ securityOpts }: SecurityOptRowProps) {
+  if (!securityOpts || securityOpts.length === 0) {
+    return null;
+  }
+
+  return (
+    <DetailsTable.Row label="SecurityOpt">
+      <table className="table-bordered table-condensed !m-0 table">
+        <tbody>
+          {securityOpts.map((value, index) => (
+            <tr key={index}>
+              <td>{value}</td>
+            </tr>
+          ))}
+        </tbody>
+      </table>
+    </DetailsTable.Row>
+  );
+}
diff --git a/app/react/docker/containers/ItemView/ContainerDetailsSection/SysctlsRow.tsx b/app/react/docker/containers/ItemView/ContainerDetailsSection/SysctlsRow.tsx
new file mode 100644
index 0000000..1e170c6
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerDetailsSection/SysctlsRow.tsx
@@ -0,0 +1,26 @@
+import { DetailsTable } from '@@/DetailsTable';
+
+interface SysctlsRowProps {
+  sysctls?: Record<string, string>;
+}
+
+export function SysctlsRow({ sysctls }: SysctlsRowProps) {
+  if (!sysctls || Object.keys(sysctls).length === 0) {
+    return null;
+  }
+
+  return (
+    <DetailsTable.Row label="Sysctls">
+      <table className="table-bordered table-condensed !m-0 table">
+        <tbody>
+          {Object.entries(sysctls).map(([key, value]) => (
+            <tr key={key}>
+              <td>{key}</td>
+              <td>{value}</td>
+            </tr>
+          ))}
+        </tbody>
+      </table>
+    </DetailsTable.Row>
+  );
+}
diff --git a/app/react/docker/containers/ItemView/ContainerNetworksDatatable/ConnectNetworkForm.tsx b/app/react/docker/containers/ItemView/ContainerNetworksDatatable/ConnectNetworkForm.tsx
new file mode 100644
index 0000000..92f6017
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerNetworksDatatable/ConnectNetworkForm.tsx
@@ -0,0 +1,85 @@
+import { Form, Formik } from 'formik';
+import { SchemaOf, object, string } from 'yup';
+
+import { useAuthorizations } from '@/react/hooks/useUser';
+import { useConnectContainerMutation } from '@/react/docker/networks/queries/useConnectContainerMutation';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { LoadingButton } from '@@/buttons';
+
+import { NetworkSelector } from '../../components/NetworkSelector';
+
+interface FormValues {
+  networkId: string;
+}
+
+export function ConnectNetworkForm({
+  nodeName,
+  containerId,
+  selectedNetworks,
+}: {
+  nodeName?: string;
+  containerId: string;
+  selectedNetworks: string[];
+}) {
+  const environmentId = useEnvironmentId();
+  const { authorized } = useAuthorizations('DockerNetworkConnect');
+  const connectMutation = useConnectContainerMutation(environmentId);
+  if (!authorized) {
+    return null;
+  }
+
+  return (
+    <Formik<FormValues>
+      initialValues={{ networkId: '' }}
+      onSubmit={handleSubmit}
+      validationSchema={validation}
+    >
+      {({ values, errors, setFieldValue }) => (
+        <Form className="form-horizontal w-full">
+          <FormControl
+            label="Join a network"
+            className="!mb-0"
+            errors={errors.networkId}
+          >
+            <div className="flex items-center gap-4">
+              <div className="w-full">
+                <NetworkSelector
+                  value={values.networkId}
+                  onChange={(value) => setFieldValue('networkId', value)}
+                  hiddenNetworks={selectedNetworks}
+                />
+              </div>
+              <LoadingButton
+                loadingText="Joining network..."
+                data-cy="connect-network-button"
+                isLoading={connectMutation.isLoading}
+              >
+                Join Network
+              </LoadingButton>
+            </div>
+          </FormControl>
+        </Form>
+      )}
+    </Formik>
+  );
+
+  function handleSubmit({ networkId }: { networkId: string }) {
+    connectMutation.mutate(
+      { containerId, networkId, nodeName },
+      {
+        onSuccess() {
+          notifySuccess('Success', `Connected container to ${networkId}`);
+        },
+      }
+    );
+  }
+}
+
+function validation(): SchemaOf<FormValues> {
+  return object({
+    networkId: string().required('Please select a network'),
+  });
+}
diff --git a/app/react/docker/containers/ItemView/ContainerNetworksDatatable/ContainerNetworksDatatable.tsx b/app/react/docker/containers/ItemView/ContainerNetworksDatatable/ContainerNetworksDatatable.tsx
new file mode 100644
index 0000000..c4d23c3
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerNetworksDatatable/ContainerNetworksDatatable.tsx
@@ -0,0 +1,79 @@
+import { useMemo } from 'react';
+import { Network } from 'lucide-react';
+import { EndpointSettings, NetworkSettings } from 'docker-types';
+
+import { createPersistedStore } from '@@/datatables/types';
+import { useTableState } from '@@/datatables/useTableState';
+import { ExpandableDatatable } from '@@/datatables/ExpandableDatatable';
+import { withMeta } from '@@/datatables/extend-options/withMeta';
+import { mergeOptions } from '@@/datatables/extend-options/mergeOptions';
+
+import { ContainerListViewModel } from '../../types';
+
+import { TableNetwork } from './types';
+import { buildColumns } from './columns';
+import { ConnectNetworkForm } from './ConnectNetworkForm';
+
+const storageKey = 'container-networks';
+const store = createPersistedStore(storageKey, 'name');
+
+export function ContainerNetworksDatatable({
+  dataset,
+  containerId,
+  nodeName,
+}: {
+  dataset: NetworkSettings['Networks'];
+  containerId: ContainerListViewModel['Id'];
+  nodeName?: string;
+}) {
+  const tableState = useTableState(store, storageKey);
+  const columns = useMemo(() => buildColumns({ nodeName }), [nodeName]);
+
+  const networks: Array<TableNetwork> = Object.entries(dataset || {})
+    .filter(isNetworkDefined)
+    .map(([id, network]) => ({
+      ...network,
+      id,
+      name: id,
+    }));
+
+  return (
+    <ExpandableDatatable<TableNetwork>
+      columns={columns}
+      dataset={networks}
+      settingsManager={tableState}
+      title="Connected Networks"
+      titleIcon={Network}
+      disableSelect
+      getRowCanExpand={(row) => !!row.original.GlobalIPv6Address}
+      isLoading={!dataset}
+      renderSubRow={({ original: item }) => (
+        <tr className="datatable-highlighted">
+          <td colSpan={2} />
+          <td>{item.GlobalIPv6Address}</td>
+          <td colSpan={3}>{item.IPv6Gateway || '-'}</td>
+        </tr>
+      )}
+      description={
+        <ConnectNetworkForm
+          containerId={containerId}
+          nodeName={nodeName}
+          selectedNetworks={networks.map((n) => n.id)}
+        />
+      }
+      extendTableOptions={mergeOptions(
+        withMeta({
+          table: 'container-networks',
+          containerId,
+        })
+      )}
+      data-cy="container-networks-datatable"
+    />
+  );
+}
+
+function isNetworkDefined(
+  value: [string, EndpointSettings | undefined]
+): value is [string, EndpointSettings] {
+  return value.length > 1 && !!value[1];
+}
diff --git a/app/react/docker/containers/ItemView/ContainerNetworksDatatable/actions.tsx b/app/react/docker/containers/ItemView/ContainerNetworksDatatable/actions.tsx
new file mode 100644
index 0000000..a42a832
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerNetworksDatatable/actions.tsx
@@ -0,0 +1,66 @@
+import { CellContext } from '@tanstack/react-table';
+
+import { Authorized } from '@/react/hooks/useUser';
+import { useDisconnectContainer } from '@/react/docker/networks/queries/useDisconnectContainerMutation';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { LoadingButton } from '@@/buttons';
+
+import { TableNetwork, isContainerNetworkTableMeta } from './types';
+import { columnHelper } from './helper';
+
+export function buildActions({ nodeName }: { nodeName?: string } = {}) {
+  return columnHelper.display({
+    header: 'Actions',
+    cell: Cell,
+  });
+
+  function Cell({
+    row: {
+      original: { id: networkId },
+    },
+    table: {
+      options: { meta },
+    },
+  }: CellContext<TableNetwork, unknown>) {
+    const environmentId = useEnvironmentId();
+    const disconnectMutation = useDisconnectContainer({
+      environmentId,
+      networkId,
+    });
+
+    return (
+      <Authorized authorizations="DockerNetworkDisconnect">
+        <LoadingButton
+          color="dangerlight"
+          data-cy="disconnect-network-button"
+          isLoading={disconnectMutation.isLoading}
+          loadingText="Leaving network..."
+          type="button"
+          onClick={handleSubmit}
+        >
+          Leave network
+        </LoadingButton>
+      </Authorized>
+    );
+
+    function handleSubmit() {
+      if (!isContainerNetworkTableMeta(meta)) {
+        throw new Error('Invalid row meta');
+      }
+
+      disconnectMutation.mutate(
+        {
+          containerId: meta.containerId,
+          nodeName,
+        },
+        {
+          onSuccess() {
+            notifySuccess('Container successfully disconnected', networkId);
+          },
+        }
+      );
+    }
+  }
+}
diff --git a/app/react/docker/containers/ItemView/ContainerNetworksDatatable/columns.tsx b/app/react/docker/containers/ItemView/ContainerNetworksDatatable/columns.tsx
new file mode 100644
index 0000000..53358b5
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerNetworksDatatable/columns.tsx
@@ -0,0 +1,37 @@
+import { buildExpandColumn } from '@@/datatables/expand-column';
+import { buildNameColumnFromObject } from '@@/datatables/buildNameColumn';
+
+import { TableNetwork } from './types';
+import { columnHelper } from './helper';
+import { buildActions } from './actions';
+
+export function buildColumns({ nodeName }: { nodeName?: string } = {}) {
+  return [
+    buildExpandColumn<TableNetwork>(),
+    {
+      ...buildNameColumnFromObject<TableNetwork>({
+        nameKey: 'name',
+        path: 'docker.networks.network',
+        dataCy: 'docker-networks-name',
+        linkParamsBuilder: () => ({ nodeName }),
+      }),
+      header: 'Network',
+    },
+    columnHelper.accessor((item) => item.IPAddress || '-', {
+      header: 'IP Address',
+      id: 'ip',
+      enableSorting: false,
+    }),
+    columnHelper.accessor((item) => item.Gateway || '-', {
+      header: 'Gateway',
+      id: 'gateway',
+      enableSorting: false,
+    }),
+    columnHelper.accessor((item) => item.MacAddress || '-', {
+      header: 'MAC Address',
+      id: 'macAddress',
+      enableSorting: false,
+    }),
+    buildActions({ nodeName }),
+  ];
+}
diff --git a/app/react/docker/containers/ItemView/ContainerNetworksDatatable/helper.ts b/app/react/docker/containers/ItemView/ContainerNetworksDatatable/helper.ts
new file mode 100644
index 0000000..1230b9a
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerNetworksDatatable/helper.ts
@@ -0,0 +1,5 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { TableNetwork } from './types';
+
+export const columnHelper = createColumnHelper<TableNetwork>();
diff --git a/app/react/docker/containers/ItemView/ContainerNetworksDatatable/index.ts b/app/react/docker/containers/ItemView/ContainerNetworksDatatable/index.ts
new file mode 100644
index 0000000..c31d0ba
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerNetworksDatatable/index.ts
@@ -0,0 +1 @@
+export { ContainerNetworksDatatable } from './ContainerNetworksDatatable';
diff --git a/app/react/docker/containers/ItemView/ContainerNetworksDatatable/types.ts b/app/react/docker/containers/ItemView/ContainerNetworksDatatable/types.ts
new file mode 100644
index 0000000..ffb8a45
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerNetworksDatatable/types.ts
@@ -0,0 +1,15 @@
+import { TableMeta } from '@tanstack/react-table';
+import { EndpointSettings } from 'docker-types';
+
+export type TableNetwork = EndpointSettings & { id: string; name: string };
+
+export type ContainerNetworkTableMeta = TableMeta<TableNetwork> & {
+  table: 'container-networks';
+  containerId: string;
+};
+
+export function isContainerNetworkTableMeta(
+  meta?: TableMeta<TableNetwork>
+): meta is ContainerNetworkTableMeta {
+  return !!meta && 'table' in meta && meta.table === 'container-networks';
+}
diff --git a/app/react/docker/containers/ItemView/ContainerStatusSection/ActionLinksRow.tsx b/app/react/docker/containers/ItemView/ContainerStatusSection/ActionLinksRow.tsx
new file mode 100644
index 0000000..ac8ab60
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerStatusSection/ActionLinksRow.tsx
@@ -0,0 +1,120 @@
+import { FileText, Info, BarChart2, Terminal, Paperclip } from 'lucide-react';
+
+import { ContainerId } from '@/react/docker/containers/types';
+import { useAuthorizations } from '@/react/hooks/useUser';
+
+import { Icon } from '@@/Icon';
+import { Button, ButtonGroup } from '@@/buttons';
+import { Link } from '@@/Link';
+
+interface Props {
+  containerId: ContainerId;
+}
+
+export function ActionLinksRow({ containerId }: Props) {
+  const { authorized: canLogs } = useAuthorizations(['DockerContainerLogs']);
+  const { authorized: canInspect } = useAuthorizations([
+    'DockerContainerInspect',
+  ]);
+  const { authorized: canStats } = useAuthorizations(['DockerContainerStats']);
+  const { authorized: canExec } = useAuthorizations(['DockerExecStart']);
+  const { authorized: canAttach } = useAuthorizations([
+    'DockerContainerAttach',
+  ]);
+
+  const hasAnyAuthorization =
+    canLogs || canInspect || canStats || canExec || canAttach;
+
+  if (!hasAnyAuthorization) {
+    return null;
+  }
+
+  return (
+    <tr>
+      <td colSpan={2}>
+        <ButtonGroup>
+          {canLogs && (
+            <Button
+              as={Link}
+              props={{
+                to: 'docker.containers.container.logs',
+                params: {
+                  id: containerId,
+                },
+              }}
+              data-cy="container-logs-link"
+              color="link"
+            >
+              <Icon icon={FileText} className="lucide space-right" />
+              Logs
+            </Button>
+          )}
+          {canInspect && (
+            <Button
+              as={Link}
+              props={{
+                to: 'docker.containers.container.inspect',
+                params: {
+                  id: containerId,
+                },
+              }}
+              data-cy="container-inspect-link"
+              color="link"
+            >
+              <Icon icon={Info} className="lucide space-right" />
+              Inspect
+            </Button>
+          )}
+          {canStats && (
+            <Button
+              as={Link}
+              props={{
+                to: 'docker.containers.container.stats',
+                params: {
+                  id: containerId,
+                },
+              }}
+              data-cy="container-stats-link"
+              color="link"
+            >
+              <Icon icon={BarChart2} className="lucide space-right" />
+              Stats
+            </Button>
+          )}
+          {canExec && (
+            <Button
+              as={Link}
+              props={{
+                to: 'docker.containers.container.exec',
+                params: {
+                  id: containerId,
+                },
+              }}
+              data-cy="container-console-link"
+              color="link"
+            >
+              <Icon icon={Terminal} className="lucide space-right" />
+              Console
+            </Button>
+          )}
+          {canAttach && (
+            <Button
+              as={Link}
+              props={{
+                to: 'docker.containers.container.attach',
+                params: {
+                  id: containerId,
+                },
+              }}
+              data-cy="container-attach-link"
+              color="link"
+            >
+              <Icon icon={Paperclip} className="lucide space-right" />
+              Attach
+            </Button>
+          )}
+        </ButtonGroup>
+      </td>
+    </tr>
+  );
+}
diff --git a/app/react/docker/containers/ItemView/ContainerStatusSection/ContainerStatusSection.test.tsx b/app/react/docker/containers/ItemView/ContainerStatusSection/ContainerStatusSection.test.tsx
new file mode 100644
index 0000000..272acfe
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerStatusSection/ContainerStatusSection.test.tsx
@@ -0,0 +1,216 @@
+import { render, screen } from '@testing-library/react';
+import { http, HttpResponse } from 'msw';
+
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { ContainerDetailsViewModel } from '@/docker/models/containerDetails';
+import { ContainerEngine } from '@/react/portainer/environments/types';
+import { server } from '@/setup-tests/server';
+import {
+  createMockEnvironment,
+  createMockUser,
+} from '@/react-tools/test-mocks';
+
+import { ContainerStatusSection } from './ContainerStatusSection';
+
+vi.mock('@uirouter/react', async (importOriginal: () => Promise<object>) => ({
+  ...(await importOriginal()),
+  useCurrentStateAndParams: vi.fn(() => ({
+    params: { endpointId: 1 },
+  })),
+}));
+
+describe('ContainerStatusSection', () => {
+  beforeEach(() => {
+    // Mock environment endpoint
+    server.use(
+      http.get('/api/endpoints/:id', () =>
+        HttpResponse.json(
+          createMockEnvironment({
+            Id: 1,
+            ContainerEngine: ContainerEngine.Docker,
+            SecuritySettings: {
+              allowContainerCapabilitiesForRegularUsers: true,
+              allowHostNamespaceForRegularUsers: true,
+              allowDeviceMappingForRegularUsers: true,
+              allowSysctlSettingForRegularUsers: true,
+              allowBindMountsForRegularUsers: true,
+              allowPrivilegedModeForRegularUsers: true,
+              allowStackManagementForRegularUsers: true,
+              allowVolumeBrowserForRegularUsers: true,
+              allowSecurityOptForRegularUsers: true,
+              enableHostManagementFeatures: true,
+            },
+          })
+        )
+      )
+    );
+  });
+
+  test('renders container status information for running container', async () => {
+    const container = createMockContainer({
+      Id: 'abc123',
+      Name: '/my-nginx-container',
+      State: {
+        Running: true,
+        Paused: false,
+        Restarting: false,
+        Status: 'running',
+        StartedAt: '2024-01-01T10:00:00Z',
+        FinishedAt: '',
+        ExitCode: 0,
+      },
+      NetworkSettings: {
+        IPAddress: '172.17.0.5',
+      },
+    });
+
+    renderComponent(container);
+
+    // Verify widget title
+    expect(await screen.findByText('Container status')).toBeVisible();
+
+    // Verify table is rendered
+    const table = screen.getByTestId('container-status-table');
+    expect(table).toBeVisible();
+
+    // Verify container ID
+    expect(screen.getByText('abc123')).toBeVisible();
+
+    // Verify container name (without leading slash)
+    expect(screen.getByText('my-nginx-container')).toBeVisible();
+
+    // Verify IP address
+    expect(screen.getByText('172.17.0.5')).toBeVisible();
+
+    // Verify status shows running
+    expect(screen.getByText(/running/i)).toBeVisible();
+
+    // Verify Start time row is present (only for running containers)
+    expect(screen.getByText('Start time')).toBeVisible();
+
+    // Verify Finished row is NOT present for running containers
+    expect(screen.queryByText('Finished')).not.toBeInTheDocument();
+  });
+
+  test('renders container status information for stopped container', async () => {
+    const container = createMockContainer({
+      State: {
+        Running: false,
+        Paused: false,
+        Restarting: false,
+        Status: 'exited',
+        StartedAt: '2024-01-01T10:00:00Z',
+        FinishedAt: '2024-01-01T11:00:00Z',
+        ExitCode: 137,
+      },
+    });
+
+    renderComponent(container);
+
+    expect(await screen.findByText('Container status')).toBeVisible();
+
+    // Verify status shows stopped
+    expect(screen.getByText(/stopped/i)).toBeVisible();
+
+    // Verify exit code is shown
+    expect(screen.getByText(/with exit code 137/i)).toBeVisible();
+
+    // Verify Finished row is present for stopped containers
+    expect(screen.getByText('Finished')).toBeVisible();
+
+    // Verify Start time row is NOT present for stopped containers
+    expect(screen.queryByText('Start time')).not.toBeInTheDocument();
+  });
+
+  test('renders NameRow component with correct props', async () => {
+    const container = createMockContainer({
+      Id: 'test-123',
+      Name: '/my-container',
+    });
+
+    renderComponent(container);
+
+    expect(await screen.findByText('Container status')).toBeVisible();
+
+    // Verify NameRow is rendered with the container name
+    expect(screen.getByText('my-container')).toBeVisible();
+  });
+
+  test('renders the table with container information', async () => {
+    const container = createMockContainer({
+      Id: 'test-id-123',
+      Name: '/test-container',
+      State: { Running: true },
+      NetworkSettings: { IPAddress: '172.17.0.5' },
+    });
+
+    renderComponent(container);
+
+    expect(await screen.findByText('Container status')).toBeVisible();
+
+    // Verify the table renders all key container information
+    const table = screen.getByTestId('container-status-table');
+    expect(table).toBeVisible();
+
+    // Check key fields are rendered
+    expect(screen.getByText('test-id-123')).toBeVisible();
+    expect(screen.getByText('test-container')).toBeVisible();
+    expect(screen.getByText('172.17.0.5')).toBeVisible();
+  });
+});
+
+function renderComponent(container: ContainerDetailsViewModel) {
+  const Wrapped = withTestQueryProvider(
+    withTestRouter(withUserProvider(ContainerStatusSection, createMockUser()), {
+      route: 'docker.containers.container',
+      stateConfig: [
+        {
+          name: 'docker.containers.container',
+          url: '/docker/:endpointId/containers/:id',
+          params: { endpointId: '1', id: 'container-123' },
+        },
+      ],
+    })
+  );
+
+  return render(
+    <Wrapped
+      environmentId={1}
+      container={container}
+      nodeName="node-1"
+      onSuccessUpdate={() => {}}
+    />
+  );
+}
+
+function createMockContainer(
+  overrides: Partial<ContainerDetailsViewModel> = {}
+): ContainerDetailsViewModel {
+  return {
+    Id: 'container-123',
+    Name: '/test-container',
+    Created: '2024-01-01T10:00:00Z',
+    State: {
+      Running: true,
+      Paused: false,
+      Restarting: false,
+      Status: 'running',
+      StartedAt: '2024-01-01T10:00:00Z',
+      FinishedAt: '',
+      ExitCode: 0,
+    },
+    NetworkSettings: {
+      IPAddress: '172.17.0.2',
+    },
+    Config: {
+      Image: 'nginx:latest',
+      Labels: {},
+    },
+    HostConfig: {
+      AutoRemove: false,
+    },
+    ...overrides,
+  } as ContainerDetailsViewModel;
+}
diff --git a/app/react/docker/containers/ItemView/ContainerStatusSection/ContainerStatusSection.tsx b/app/react/docker/containers/ItemView/ContainerStatusSection/ContainerStatusSection.tsx
new file mode 100644
index 0000000..407c984
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerStatusSection/ContainerStatusSection.tsx
@@ -0,0 +1,92 @@
+import {
+  EnvironmentId,
+  EnvironmentType,
+} from '@/react/portainer/environments/types';
+import { ContainerDetailsViewModel } from '@/docker/models/containerDetails';
+import { useEnvironment } from '@/react/portainer/environments/queries/useEnvironment';
+import { isoDate } from '@/portainer/filters/filters';
+import { RegistryId } from '@/react/portainer/registries/types/registry';
+import { isPartOfSwarmService } from '@/docker/helpers/containers';
+
+import { Widget, WidgetBody } from '@@/Widget';
+import { DetailsTable } from '@@/DetailsTable';
+
+import { NameRow } from './NameRow';
+import { WebhookRow } from './WebhookRow';
+import { ActionLinksRow } from './ActionLinksRow';
+import { StatusRow } from './StatusRow';
+
+interface Props {
+  environmentId: EnvironmentId;
+  container: ContainerDetailsViewModel;
+  nodeName?: string;
+  onSuccessUpdate?(): void;
+  registryId?: RegistryId;
+}
+
+export function ContainerStatusSection({
+  environmentId,
+  container,
+  nodeName,
+  onSuccessUpdate,
+  registryId,
+}: Props) {
+  const environmentQuery = useEnvironment(environmentId);
+  const isRunning = container.State?.Running || false;
+  const isCreated = container.State?.Status === 'created';
+  if (!environmentQuery.data) {
+    return null;
+  }
+
+  return (
+    <Widget>
+      <Widget.Title icon="box" title="Container status" />
+      <WidgetBody className="no-padding">
+        <DetailsTable dataCy="container-status-table">
+          <DetailsTable.Row label="ID">{container.Id}</DetailsTable.Row>
+          <DetailsTable.Row label="Name">
+            <NameRow
+              containerId={container.Id || ''}
+              containerName={container.Name || ''}
+              environmentId={environmentId}
+              nodeName={nodeName}
+              onSuccess={onSuccessUpdate}
+            />
+          </DetailsTable.Row>
+          {!!container.NetworkSettings?.IPAddress && (
+            <DetailsTable.Row label="IP address">
+              {container.NetworkSettings.IPAddress}
+            </DetailsTable.Row>
+          )}
+          <DetailsTable.Row label="Status">
+            <StatusRow container={container} />
+          </DetailsTable.Row>
+          <DetailsTable.Row label="Created">
+            {isoDate(container.Created)}
+          </DetailsTable.Row>
+          {isRunning && (
+            <DetailsTable.Row label="Start time">
+              {isoDate(container.State?.StartedAt)}
+            </DetailsTable.Row>
+          )}
+          {!isRunning && !isCreated && (
+            <DetailsTable.Row label="Finished">
+              {isoDate(container.State?.FinishedAt)}
+            </DetailsTable.Row>
+          )}
+          {environmentQuery.data.Type !== EnvironmentType.EdgeAgentOnDocker && (
+            <WebhookRow
+              containerId={container.Id || ''}
+              environmentId={environmentId}
+              autoRemove={container.HostConfig?.AutoRemove || false}
+              onSuccess={onSuccessUpdate}
+              registryId={registryId}
+              partOfSwarmService={isPartOfSwarmService(container)}
+            />
+          )}
+          <ActionLinksRow containerId={container.Id || ''} />
+        </DetailsTable>
+      </WidgetBody>
+    </Widget>
+  );
+}
diff --git a/app/react/docker/containers/ItemView/ContainerStatusSection/EditNameForm.tsx b/app/react/docker/containers/ItemView/ContainerStatusSection/EditNameForm.tsx
new file mode 100644
index 0000000..1a330fb
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerStatusSection/EditNameForm.tsx
@@ -0,0 +1,128 @@
+import { useEffect, useRef } from 'react';
+import { Check, X } from 'lucide-react';
+import { Form, Formik } from 'formik';
+import * as yup from 'yup';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { trimContainerName } from '@/docker/filters/utils';
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { Button } from '@@/buttons';
+import { Icon } from '@@/Icon';
+
+import { ContainerId } from '../../types';
+import { useRenameContainer } from '../../queries/useRenameContainer';
+
+interface FormValues {
+  name: string;
+}
+
+const validationSchema = yup.object({
+  name: yup
+    .string()
+    .trim()
+    .required('Container name is required')
+    .min(1, 'Container name cannot be empty'),
+});
+
+export function EditNameForm({
+  name,
+  onCancel,
+  containerId,
+  environmentId,
+  nodeName,
+  onSuccess,
+}: {
+  name: string;
+  onCancel(): void;
+  onSuccess(): void;
+  containerId: ContainerId;
+  environmentId: EnvironmentId;
+  nodeName: string | undefined;
+}) {
+  const inputRef = useRef<HTMLInputElement>(null);
+  useEffect(() => {
+    if (inputRef.current) {
+      inputRef.current.focus();
+    }
+  }, []);
+
+  const renameMutation = useRenameContainer();
+
+  const initialValues: FormValues = {
+    name: trimContainerName(name),
+  };
+
+  return (
+    <Formik
+      initialValues={initialValues}
+      onSubmit={handleSubmit}
+      validationSchema={validationSchema}
+      enableReinitialize
+    >
+      {({ values, handleChange, isSubmitting }) => (
+        <Form className="flex items-center gap-2">
+          <input
+            ref={inputRef}
+            type="text"
+            name="name"
+            className="form-control form-control-sm containerNameInput"
+            value={values.name}
+            onChange={handleChange}
+            data-cy="containerNameInput"
+            aria-label="Container name"
+          />
+          <Button
+            size="xsmall"
+            color="none"
+            className="!p-0 hover:no-underline"
+            onClick={() => onCancel()}
+            type="button"
+            data-cy="container-cancel-rename-button"
+            title="Cancel"
+            aria-label="Cancel Container name edit"
+          >
+            <Icon icon={X} className="lucide" />
+          </Button>
+          <Button
+            size="xsmall"
+            color="none"
+            className="!p-0 hover:no-underline"
+            type="submit"
+            data-cy="container-confirm-rename-button"
+            disabled={isSubmitting}
+            title="Rename"
+            aria-label="Rename container"
+          >
+            <Icon icon={Check} className="lucide" />
+          </Button>
+        </Form>
+      )}
+    </Formik>
+  );
+
+  function handleSubmit(values: FormValues) {
+    if (values.name === trimContainerName(name)) {
+      onCancel();
+      return;
+    }
+
+    renameMutation.mutate(
+      {
+        containerId,
+        environmentId,
+        name: values.name,
+        nodeName,
+      },
+      {
+        onSuccess(_, variables) {
+          notifySuccess(
+            'Success',
+            `Container successfully renamed to ${variables.name}`
+          );
+          onSuccess();
+        },
+      }
+    );
+  }
+}
diff --git a/app/react/docker/containers/ItemView/ContainerStatusSection/NameRow.test.tsx b/app/react/docker/containers/ItemView/ContainerStatusSection/NameRow.test.tsx
new file mode 100644
index 0000000..e1f6af2
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerStatusSection/NameRow.test.tsx
@@ -0,0 +1,388 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import { http, HttpResponse } from 'msw';
+import userEvent from '@testing-library/user-event';
+import { JSXElementConstructor, ReactElement } from 'react';
+
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { createMockUser } from '@/react-tools/test-mocks';
+import { server } from '@/setup-tests/server';
+import { User } from '@/portainer/users/types';
+
+import { NameRow } from './NameRow';
+
+vi.mock('@uirouter/react', async (importOriginal: () => Promise<object>) => ({
+  ...(await importOriginal()),
+  useCurrentStateAndParams: vi.fn(() => ({
+    params: { endpointId: 1 },
+  })),
+}));
+
+describe('NameRow', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  describe('Display Mode', () => {
+    it('displays container name with leading slash trimmed', () => {
+      // Test with leading slash
+      const { rerender } = renderComponent({ containerName: '/my-container' });
+      expect(screen.getByText('my-container')).toBeVisible();
+      expect(screen.queryByText('/my-container')).not.toBeInTheDocument();
+
+      // Test without leading slash
+      rerenderComponent(rerender, {
+        props: {
+          containerName: 'already-trimmed',
+        },
+      });
+
+      expect(screen.getByText('already-trimmed')).toBeVisible();
+    });
+
+    it('shows edit button for admin user', async () => {
+      const adminUser = createMockUser({ Role: 1 });
+      renderComponent({}, adminUser);
+      expect(
+        await screen.findByRole('button', { name: /edit container name/i })
+      ).toBeVisible();
+    });
+
+    it('shows edit button for non-admin user with authorization', async () => {
+      const authorizedUser = createMockUser({
+        Role: 2,
+        EndpointAuthorizations: {
+          1: {
+            DockerContainerRename: true,
+          },
+        },
+      });
+      renderComponent({}, authorizedUser);
+
+      await waitFor(async () => {
+        expect(
+          screen.getByRole('button', { name: /edit container name/i })
+        ).toBeVisible();
+      });
+    });
+
+    it('shows edit button for non-admin user without authorization (CE)', async () => {
+      const unauthorizedUser = createMockUser({
+        Role: 2,
+        EndpointAuthorizations: {
+          1: {
+            DockerContainerRename: false,
+          },
+        },
+      });
+      renderComponent({}, unauthorizedUser);
+      expect(
+        await screen.findByRole('button', { name: /edit container name/i })
+      ).toBeVisible();
+    });
+  });
+
+  describe('Edit Mode', () => {
+    it('enters edit mode with focused input pre-filled with trimmed name', async () => {
+      renderComponent({ containerName: '/original-name' });
+
+      const editButton = await screen.findByRole('button', {
+        name: /edit container name/i,
+      });
+      await userEvent.click(editButton);
+
+      const nameInput = screen.getByTestId('containerNameInput');
+      expect(nameInput).toBeVisible();
+      expect(nameInput).toHaveFocus();
+      expect(nameInput).toHaveValue('original-name');
+    });
+
+    it('shows cancel and confirm buttons in edit mode', async () => {
+      renderComponent();
+
+      const editButton = await screen.findByRole('button', {
+        name: /edit container name/i,
+      });
+      await userEvent.click(editButton);
+
+      expect(
+        screen.getByRole('button', { name: /cancel container name edit/i })
+      ).toBeVisible();
+      expect(
+        screen.getByRole('button', { name: /rename container/i })
+      ).toBeVisible();
+    });
+
+    it('returns to display mode when cancel button is clicked', async () => {
+      renderComponent({ containerName: '/my-container' });
+
+      const editButton = await screen.findByRole('button', {
+        name: /edit container name/i,
+      });
+      await userEvent.click(editButton);
+
+      const cancelButton = screen.getByRole('button', {
+        name: /cancel container name edit/i,
+      });
+      await userEvent.click(cancelButton);
+
+      expect(screen.getByText('my-container')).toBeVisible();
+      expect(
+        screen.queryByTestId('containerNameInput')
+      ).not.toBeInTheDocument();
+    });
+
+    it('allows editing the container name', async () => {
+      renderComponent();
+
+      const editButton = await screen.findByRole('button', {
+        name: /edit container name/i,
+      });
+      await userEvent.click(editButton);
+
+      const nameInput = screen.getByTestId('containerNameInput');
+      await userEvent.clear(nameInput);
+      await userEvent.type(nameInput, 'new-container-name');
+
+      expect(nameInput).toHaveValue('new-container-name');
+    });
+  });
+
+  describe('Rename Functionality', () => {
+    it('successfully renames container with correct API parameters and returns to display mode', async () => {
+      let capturedRequest: {
+        endpointId: string | null;
+        containerId: string | null;
+        nodeNameHeader: string | null;
+        name: string | null;
+      } | null = null;
+
+      const onSuccess = vi.fn();
+
+      server.use(
+        http.post(
+          '/api/endpoints/:endpointId/docker/containers/:id/rename',
+          async ({ params, request }) => {
+            const url = new URL(request.url);
+            capturedRequest = {
+              endpointId: params.endpointId as string,
+              containerId: params.id as string,
+              nodeNameHeader: request.headers.get('X-PortainerAgent-Target'),
+              name: url.searchParams.get('name'),
+            };
+            return HttpResponse.json({});
+          }
+        )
+      );
+
+      renderComponent({
+        containerId: 'container-abc',
+        containerName: '/original-name',
+        environmentId: 5,
+        nodeName: 'swarm-node-2',
+        onSuccess,
+      });
+
+      const editButton = await screen.findByRole('button', {
+        name: /edit container name/i,
+      });
+      await userEvent.click(editButton);
+
+      const nameInput = screen.getByTestId('containerNameInput');
+      await userEvent.clear(nameInput);
+      await userEvent.type(nameInput, 'updated-name');
+
+      const confirmButton = screen.getByTestId(
+        'container-confirm-rename-button'
+      );
+      expect(confirmButton).not.toBeDisabled();
+
+      await userEvent.click(confirmButton);
+
+      // Button should be disabled during submission
+      expect(confirmButton).toBeDisabled();
+
+      // Should call onSuccess callback after successful rename
+      await waitFor(() => {
+        expect(onSuccess).toHaveBeenCalledTimes(1);
+      });
+
+      // Should return to display mode
+      await waitFor(() => {
+        expect(
+          screen.queryByTestId('containerNameInput')
+        ).not.toBeInTheDocument();
+      });
+
+      // Verify API was called with correct parameters
+      expect(capturedRequest).toEqual({
+        endpointId: '5',
+        containerId: 'container-abc',
+        nodeNameHeader: 'swarm-node-2',
+        name: 'updated-name',
+      });
+    });
+
+    it('does not make API call if name is unchanged', async () => {
+      const onSuccess = vi.fn();
+      let apiCallCount = 0;
+
+      server.use(
+        http.post(
+          '/api/endpoints/:endpointId/docker/containers/:id/rename',
+          () => {
+            apiCallCount += 1;
+            return HttpResponse.json({});
+          }
+        )
+      );
+
+      renderComponent({
+        containerName: '/same-name',
+        onSuccess,
+      });
+
+      const editButton = await screen.findByRole('button', {
+        name: /edit container name/i,
+      });
+      await userEvent.click(editButton);
+
+      const confirmButton = screen.getByTestId(
+        'container-confirm-rename-button'
+      );
+      await userEvent.click(confirmButton);
+
+      await waitFor(() => {
+        expect(screen.getByText('same-name')).toBeVisible();
+      });
+
+      expect(apiCallCount).toBe(0);
+      expect(onSuccess).not.toHaveBeenCalled();
+    });
+
+    it('handles rename API error gracefully', async () => {
+      // Mock console.error to suppress expected error logs
+      const consoleErrorSpy = vi
+        .spyOn(console, 'error')
+        .mockImplementation(() => {});
+
+      server.use(
+        http.post(
+          '/api/endpoints/:endpointId/docker/containers/:id/rename',
+          () =>
+            HttpResponse.json(
+              { message: 'Container rename failed' },
+              { status: 500 }
+            )
+        )
+      );
+
+      renderComponent({ containerName: '/original-name' });
+
+      const editButton = await screen.findByRole('button', {
+        name: /edit container name/i,
+      });
+      await userEvent.click(editButton);
+
+      const nameInput = screen.getByTestId('containerNameInput');
+      await userEvent.clear(nameInput);
+      await userEvent.type(nameInput, 'new-name');
+
+      const confirmButton = screen.getByTestId(
+        'container-confirm-rename-button'
+      );
+      await userEvent.click(confirmButton);
+
+      expect(confirmButton).toBeDisabled();
+
+      await new Promise((resolve) => {
+        setTimeout(resolve, 100);
+      });
+
+      // Should still be in edit mode with the form visible (not closed on error)
+      expect(screen.getByTestId('containerNameInput')).toBeVisible();
+      expect(nameInput).toHaveValue('new-name');
+
+      consoleErrorSpy.mockRestore();
+    });
+
+    it('validates that container name is required', async () => {
+      renderComponent({ containerName: '/original-name' });
+
+      const editButton = await screen.findByRole('button', {
+        name: /edit container name/i,
+      });
+      await userEvent.click(editButton);
+
+      const nameInput = screen.getByTestId('containerNameInput');
+      await userEvent.clear(nameInput);
+
+      const confirmButton = screen.getByTestId(
+        'container-confirm-rename-button'
+      );
+      await userEvent.click(confirmButton);
+
+      expect(
+        screen.queryByText(/successfully renamed/i)
+      ).not.toBeInTheDocument();
+    });
+  });
+});
+
+type RenderProps = Partial<{
+  containerId: string;
+  containerName: string;
+  environmentId: number;
+  nodeName: string;
+  onSuccess: () => void;
+}>;
+
+function createWrappedComponent(
+  props: RenderProps,
+  user = createMockUser({ Role: 1 })
+) {
+  const defaultProps = {
+    containerId: 'container-123',
+    containerName: '/test-container',
+    environmentId: 1,
+    nodeName: 'node-1',
+    onSuccess: vi.fn(),
+  };
+
+  const mergedProps = { ...defaultProps, ...props };
+
+  const Wrapped = withTestQueryProvider(
+    withTestRouter(withUserProvider(NameRow, user), {
+      route: 'docker.containers.container',
+      stateConfig: [
+        {
+          name: 'docker.containers.container',
+          url: '/docker/:endpointId/containers/:id',
+          params: { endpointId: '1', id: mergedProps.containerId },
+        },
+      ],
+    })
+  );
+
+  return { Wrapped, mergedProps };
+}
+
+function renderComponent(
+  props: RenderProps = {},
+  user = createMockUser({ Role: 1 })
+) {
+  const { Wrapped, mergedProps } = createWrappedComponent(props, user);
+  return render(<Wrapped {...mergedProps} />);
+}
+
+function rerenderComponent(
+  rerender: (
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    ui: ReactElement<any, string | JSXElementConstructor<any>>
+  ) => void,
+  { props = {}, user }: { props?: RenderProps; user?: User } = {}
+) {
+  const { Wrapped, mergedProps } = createWrappedComponent(props, user);
+  rerender(<Wrapped {...mergedProps} />);
+}
diff --git a/app/react/docker/containers/ItemView/ContainerStatusSection/NameRow.tsx b/app/react/docker/containers/ItemView/ContainerStatusSection/NameRow.tsx
new file mode 100644
index 0000000..1085a26
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerStatusSection/NameRow.tsx
@@ -0,0 +1,69 @@
+import { useState } from 'react';
+import { Edit } from 'lucide-react';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { ContainerId } from '@/react/docker/containers/types';
+import { Authorized } from '@/react/hooks/useUser';
+import { trimContainerName } from '@/docker/filters/utils';
+
+import { Button } from '@@/buttons';
+import { Icon } from '@@/Icon';
+
+import { EditNameForm } from './EditNameForm';
+
+export function NameRow({
+  containerId,
+  containerName,
+  environmentId,
+  nodeName,
+  onSuccess = () => {},
+}: {
+  containerId: ContainerId;
+  containerName: string;
+  environmentId: EnvironmentId;
+  nodeName?: string;
+  onSuccess?(): void;
+}) {
+  const [isEditing, setIsEditing] = useState(false);
+
+  function handleEdit() {
+    setIsEditing(true);
+  }
+
+  if (!isEditing) {
+    return (
+      <>
+        {trimContainerName(containerName)}
+        <Authorized authorizations="DockerContainerRename">
+          <Button
+            size="xsmall"
+            color="none"
+            className="!ml-1 !p-0 hover:no-underline"
+            onClick={handleEdit}
+            data-cy="container-edit-name-button"
+            title="Edit container name"
+            aria-label="Edit container name"
+          >
+            <Icon icon={Edit} className="lucide" />
+          </Button>
+        </Authorized>
+      </>
+    );
+  }
+
+  return (
+    <EditNameForm
+      onSuccess={() => {
+        setIsEditing(false);
+        onSuccess();
+      }}
+      onCancel={() => {
+        setIsEditing(false);
+      }}
+      containerId={containerId}
+      environmentId={environmentId}
+      name={containerName}
+      nodeName={nodeName}
+    />
+  );
+}
diff --git a/app/react/docker/containers/ItemView/ContainerStatusSection/StatusRow.tsx b/app/react/docker/containers/ItemView/ContainerStatusSection/StatusRow.tsx
new file mode 100644
index 0000000..e7ad7ac
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerStatusSection/StatusRow.tsx
@@ -0,0 +1,96 @@
+import { HeartPulseIcon } from 'lucide-react';
+import { formatDistanceToNow, parseISO } from 'date-fns';
+
+import { ContainerDetailsViewModel } from '@/docker/models/containerDetails';
+
+import { Icon } from '@@/Icon';
+
+export function StatusRow({
+  container,
+}: {
+  container: ContainerDetailsViewModel;
+}) {
+  const isRunning = container.State?.Running || false;
+  const isCreated = container.State?.Status === 'created';
+  const activityTime = calculateActivityTime(container);
+
+  return (
+    <div className="flex items-center gap-2">
+      <Icon
+        icon={HeartPulseIcon}
+        mode={getIconColor(container.State)}
+        className="lucide mr-1"
+      />
+      {getStateText(container.State)} for {activityTime}
+      {!isRunning && !isCreated && (
+        <span> with exit code {container.State?.ExitCode}</span>
+      )}
+    </div>
+  );
+}
+
+function getIconColor(
+  state: ContainerDetailsViewModel['State']
+): 'success' | 'danger' | undefined {
+  if (!state) {
+    return undefined;
+  }
+
+  if (state.Running) {
+    return 'success';
+  }
+
+  if (state.Status !== 'created') {
+    return 'danger';
+  }
+
+  return undefined;
+}
+
+function getStateText(state: ContainerDetailsViewModel['State']): string {
+  if (state === undefined) {
+    return '';
+  }
+
+  if (state.Dead) {
+    return 'Dead';
+  }
+
+  if ('Ghost' in state && state.Ghost && state.Running) {
+    return 'Ghost';
+  }
+
+  if (state.Running && state.Paused) {
+    return 'Running (Paused)';
+  }
+
+  if (state.Running) {
+    return 'Running';
+  }
+
+  if (state.Status === 'created') {
+    return 'Created';
+  }
+
+  return 'Stopped';
+}
+
+function calculateActivityTime(container: ContainerDetailsViewModel): string {
+  if (!container.State) {
+    return '';
+  }
+
+  if (container.State.Running && container.State.StartedAt) {
+    return formatDistanceToNow(parseISO(container.State.StartedAt));
+  }
+
+  if (container.State.Status === 'created' && container.Created) {
+    return formatDistanceToNow(parseISO(container.Created));
+  }
+
+  if (container.State.FinishedAt) {
+    return formatDistanceToNow(parseISO(container.State.FinishedAt));
+  }
+
+  return '';
+}
diff --git a/app/react/docker/containers/ItemView/ContainerStatusSection/WebhookRow.tsx b/app/react/docker/containers/ItemView/ContainerStatusSection/WebhookRow.tsx
new file mode 100644
index 0000000..8c4a197
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ContainerStatusSection/WebhookRow.tsx
@@ -0,0 +1,132 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { ContainerId } from '@/react/docker/containers/types';
+import { useAuthorizations } from '@/react/hooks/useUser';
+import { dockerWebhookUrl } from '@/portainer/helpers/webhookHelper';
+import { notifySuccess } from '@/portainer/services/notifications';
+import { truncateLeftRight } from '@/portainer/filters/filters';
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+import { useWebhooks } from '@/react/portainer/webhooks/useWebhooks';
+import { useCreateWebhook } from '@/react/portainer/webhooks/useCreateWebhook';
+import { useDeleteWebhook } from '@/react/portainer/webhooks/useDeleteWebhook';
+import { WebhookType } from '@/react/portainer/webhooks/types';
+import { RegistryId } from '@/react/portainer/registries/types/registry';
+
+import { CopyButton } from '@@/buttons';
+import { SwitchField } from '@@/form-components/SwitchField';
+
+import { useCanRecreateContainer } from '../ContainerActionsSection/SecondaryActions/useCanRecreateContainer';
+
+interface Props {
+  containerId: ContainerId;
+  environmentId: EnvironmentId;
+  autoRemove: boolean;
+  onSuccess?(): void;
+  registryId?: RegistryId;
+  partOfSwarmService: boolean;
+}
+
+export function WebhookRow({
+  containerId,
+  environmentId,
+  autoRemove,
+  registryId,
+  onSuccess = () => {},
+  partOfSwarmService,
+}: Props) {
+  const shouldDisplayWebhook = useCanRecreateContainer({
+    autoRemove,
+    partOfSwarmService,
+  });
+  const { authorized: canUpdate } = useAuthorizations([
+    'DockerContainerUpdate',
+  ]);
+  const { authorized: canCreateWebhook } = useAuthorizations([
+    'PortainerWebhookCreate',
+  ]);
+  const { authorized: canDeleteWebhook } = useAuthorizations([
+    'PortainerWebhookDelete',
+  ]);
+
+  const webhooksQuery = useWebhooks(
+    { endpointId: environmentId, resourceId: containerId },
+    {
+      enabled: canUpdate && shouldDisplayWebhook,
+    }
+  );
+
+  const createWebhookMutation = useCreateWebhook();
+  const deleteWebhookMutation = useDeleteWebhook();
+
+  const webhook = webhooksQuery.data?.[0];
+  const webhookUrl = webhook ? dockerWebhookUrl(webhook.Token) : '';
+
+  if (!shouldDisplayWebhook) {
+    return null;
+  }
+
+  const webhookExists = !!webhook;
+  const isDisabled =
+    !shouldDisplayWebhook ||
+    !canUpdate ||
+    (webhookExists ? !canDeleteWebhook : !canCreateWebhook);
+
+  function handleWebhookChange(enabled: boolean) {
+    if (enabled && !webhookExists) {
+      createWebhookMutation.mutate(
+        {
+          resourceId: containerId,
+          environmentId,
+          webhookType: WebhookType.DockerContainer,
+          registryId,
+        },
+        {
+          onSuccess: () => {
+            notifySuccess('Success', 'Webhook created successfully');
+            onSuccess();
+          },
+        }
+      );
+    } else if (!enabled && webhookExists) {
+      deleteWebhookMutation.mutate(
+        { webhookId: webhook.Id },
+        {
+          onSuccess: () => {
+            notifySuccess('Success', 'Webhook deleted successfully');
+            onSuccess();
+          },
+        }
+      );
+    }
+  }
+
+  return (
+    <tr>
+      <td>
+        <SwitchField
+          label="Container webhook"
+          checked={webhookExists}
+          disabled={isDisabled}
+          onChange={handleWebhookChange}
+          tooltip="Webhook (or callback URI) used to automate the recreation of this container. Sending a POST request to this callback URI (without requiring any authentication) will pull the most up-to-date version of the associated image and recreate this container."
+          data-cy="container-webhook-switch"
+          fieldClass="flex items-center gap-2"
+          labelClass="!m-0"
+          featureId={FeatureId.CONTAINER_WEBHOOK}
+        />
+      </td>
+      <td>
+        {!!webhookUrl && (
+          <div className="flex items-center gap-2">
+            <span className="text-muted">{truncateLeftRight(webhookUrl)}</span>
+            <CopyButton
+              copyText={webhookUrl}
+              data-cy="container-webhook-copy-button"
+            >
+              Copy link
+            </CopyButton>
+          </div>
+        )}
+      </td>
+    </tr>
+  );
+}
diff --git a/app/react/docker/containers/ItemView/CreateImageSection/CreateImageForm.tsx b/app/react/docker/containers/ItemView/CreateImageSection/CreateImageForm.tsx
new file mode 100644
index 0000000..ae23d4f
--- /dev/null
+++ b/app/react/docker/containers/ItemView/CreateImageSection/CreateImageForm.tsx
@@ -0,0 +1,60 @@
+import { Form, useFormikContext } from 'formik';
+
+import { ImageConfigFieldset } from '@@/ImageConfigFieldset';
+import { LoadingButton } from '@@/buttons';
+
+import { FormValues } from './types';
+
+export function CreateImageForm({
+  onRateLimit,
+  isLoading,
+}: {
+  onRateLimit: (limited?: boolean) => void;
+  isLoading: boolean;
+}) {
+  const { values, setFieldValue, errors, isValid } =
+    useFormikContext<FormValues>();
+
+  return (
+    <Form className="form-horizontal">
+      <div className="form-group">
+        <div className="col-sm-12">
+          <span className="small text-muted">
+            You can create an image from this container, this allows you to
+            backup important data or save helpful configurations. You&apos;ll be
+            able to spin up another container based on this image afterward.
+          </span>
+        </div>
+      </div>
+
+      <ImageConfigFieldset
+        autoComplete
+        values={values.config}
+        setFieldValue={(field, value) =>
+          setFieldValue(`config.${field}`, value)
+        }
+        errors={errors.config}
+        onRateLimit={onRateLimit}
+      />
+
+      {/* Tag note */}
+      <div className="form-group">
+        <div className="col-sm-12">
+          <span className="small text-muted">
+            Note: if you don&apos;t specify the tag in the image name,{' '}
+            <span className="label label-default">latest</span> will be used.
+          </span>
+        </div>
+      </div>
+
+      <LoadingButton
+        isLoading={isLoading}
+        disabled={!isValid}
+        loadingText="Creating image..."
+        data-cy="create-image-button"
+      >
+        Create
+      </LoadingButton>
+    </Form>
+  );
+}
diff --git a/app/react/docker/containers/ItemView/CreateImageSection/CreateImageSection.test.tsx b/app/react/docker/containers/ItemView/CreateImageSection/CreateImageSection.test.tsx
new file mode 100644
index 0000000..0d87075
--- /dev/null
+++ b/app/react/docker/containers/ItemView/CreateImageSection/CreateImageSection.test.tsx
@@ -0,0 +1,284 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { vi } from 'vitest';
+import { http, HttpResponse } from 'msw';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { server } from '@/setup-tests/server';
+import { createMockUser } from '@/react-tools/test-mocks';
+
+import { CreateImageSection } from './CreateImageSection';
+
+vi.mock('@uirouter/react', async (importOriginal: () => Promise<object>) => ({
+  ...(await importOriginal()),
+  useCurrentStateAndParams: vi.fn(() => ({
+    params: { endpointId: 1 },
+  })),
+}));
+
+vi.mock('@/portainer/services/notifications', () => ({
+  notifySuccess: vi.fn(),
+}));
+
+describe('CreateImageSection', () => {
+  beforeEach(() => {
+    // Setup MSW handlers for registries API
+    server.use(
+      http.get('/api/endpoints/:endpointId/registries', () =>
+        HttpResponse.json([
+          {
+            Id: 1,
+            Name: 'DockerHub',
+            Type: 1,
+            URL: 'docker.io',
+            Username: 'testuser',
+          },
+          {
+            Id: 2,
+            Name: 'Private Registry',
+            Type: 3,
+            URL: 'registry.example.com',
+            Username: '',
+          },
+        ])
+      ),
+      // Mock images endpoint for autocomplete functionality
+      http.get('/api/endpoints/:endpointId/docker/images/json', () =>
+        HttpResponse.json([
+          {
+            Id: 'sha256:abc123',
+            RepoTags: ['docker.io/testuser/my-app:latest', 'nginx:latest'],
+          },
+          {
+            Id: 'sha256:def456',
+            RepoTags: ['registry.example.com/another-app:v1.0'],
+          },
+        ])
+      )
+    );
+  });
+
+  afterEach(() => {
+    vi.clearAllMocks();
+  });
+
+  describe('Authorization', () => {
+    it('should render widget when user has DockerImageCreate authorization', async () => {
+      renderComponent({
+        userAuthorizations: {
+          DockerImageCreate: true,
+        },
+      });
+
+      await waitFor(() => {
+        expect(
+          screen.getByRole('heading', { name: /create image/i })
+        ).toBeVisible();
+      });
+    });
+
+    it('should not render when user lacks authorization', () => {
+      renderComponent({
+        userAuthorizations: {
+          DockerImageCreate: false,
+        },
+      });
+
+      expect(
+        screen.queryByRole('heading', { name: /create image/i })
+      ).not.toBeInTheDocument();
+    });
+  });
+
+  describe('Basic Rendering', () => {
+    it('should render widget with title', async () => {
+      renderComponent();
+
+      await waitFor(() => {
+        expect(
+          screen.getByRole('heading', { name: /create image/i })
+        ).toBeVisible();
+      });
+    });
+
+    it('should render description text', async () => {
+      renderComponent();
+
+      await waitFor(() => {
+        expect(
+          screen.getByText(/you can create an image from this container/i)
+        ).toBeVisible();
+      });
+    });
+  });
+
+  describe('Image Creation', () => {
+    it('should successfully create image and call onSuccess', async () => {
+      const onSuccess = vi.fn();
+      let capturedRequest: {
+        container?: string;
+        repo?: string;
+        tag?: string;
+      } = {};
+
+      // Setup MSW handler for commit
+      server.use(
+        http.post(
+          '/api/endpoints/:endpointId/docker/commit',
+          async ({ request }) => {
+            const url = new URL(request.url);
+            capturedRequest = {
+              container: url.searchParams.get('container') || undefined,
+              repo: url.searchParams.get('repo') || undefined,
+              tag: url.searchParams.get('tag') || undefined,
+            };
+            return HttpResponse.json({ Id: 'sha256:abc123' });
+          }
+        )
+      );
+
+      renderComponent({ onSuccess });
+
+      // Wait for form to load
+      await waitFor(() => {
+        expect(screen.getByRole('combobox', { name: 'Image' })).toBeVisible();
+      });
+
+      // Fill in image name
+      const imageInput = screen.getByRole('combobox', { name: 'Image' });
+      await userEvent.type(imageInput, 'my-app:v1.0');
+
+      // Submit form
+      const createButton = screen.getByRole('button', { name: /^create$/i });
+
+      await waitFor(() => {
+        expect(createButton).not.toBeDisabled();
+      });
+
+      await userEvent.click(createButton);
+
+      // Verify API call
+      await waitFor(() => {
+        expect(capturedRequest.container).toBe('container123');
+        expect(capturedRequest.repo).toBe('my-app');
+        expect(capturedRequest.tag).toBe('v1.0');
+      });
+
+      // Verify onSuccess callback
+      await waitFor(() => {
+        expect(onSuccess).toHaveBeenCalled();
+      });
+    });
+
+    it('should handle API error', async () => {
+      const onMutationError = vi.fn();
+      const consoleErrorSpy = vi
+        .spyOn(console, 'error')
+        .mockImplementation(() => {});
+
+      server.use(
+        http.post('/api/endpoints/:endpointId/docker/commit', () =>
+          HttpResponse.json({ message: 'Container not found' }, { status: 404 })
+        )
+      );
+
+      renderComponent({ onMutationError });
+
+      await waitFor(() => {
+        expect(screen.getByRole('combobox', { name: 'Image' })).toBeVisible();
+      });
+
+      const imageInput = screen.getByRole('combobox', { name: 'Image' });
+      await userEvent.type(imageInput, 'my-app');
+
+      const createButton = screen.getByRole('button', { name: /^create$/i });
+
+      await waitFor(() => {
+        expect(createButton).not.toBeDisabled();
+      });
+
+      await userEvent.click(createButton);
+
+      // Wait for the mutation error to be handled
+      await waitFor(
+        () => {
+          expect(onMutationError).toHaveBeenCalled();
+        },
+        { timeout: 3000 }
+      );
+
+      consoleErrorSpy.mockRestore();
+    });
+
+    it('should show loading state during creation', async () => {
+      server.use(
+        http.post('/api/endpoints/:endpointId/docker/commit', async () => {
+          await new Promise((resolve) => {
+            setTimeout(resolve, 100);
+          });
+          return HttpResponse.json({ Id: 'sha256:abc123' });
+        })
+      );
+
+      renderComponent();
+
+      await waitFor(() => {
+        expect(screen.getByRole('combobox', { name: 'Image' })).toBeVisible();
+      });
+
+      const imageInput = screen.getByRole('combobox', { name: 'Image' });
+      await userEvent.type(imageInput, 'my-app');
+
+      const createButton = screen.getByRole('button', { name: /^create$/i });
+
+      await waitFor(() => {
+        expect(createButton).not.toBeDisabled();
+      });
+
+      await userEvent.click(createButton);
+
+      // Check loading state
+      await waitFor(() => {
+        expect(
+          screen.getByRole('button', { name: /creating image/i })
+        ).toBeDisabled();
+      });
+    });
+  });
+});
+
+function renderComponent({
+  userAuthorizations,
+  onMutationError,
+  ...componentProps
+}: Partial<React.ComponentProps<typeof CreateImageSection>> & {
+  userAuthorizations?: Record<string, boolean>;
+  onMutationError?: (error: unknown) => void;
+} = {}) {
+  const defaultProps: React.ComponentProps<typeof CreateImageSection> = {
+    environmentId: 1,
+    containerId: 'container123',
+    ...componentProps,
+  };
+
+  const defaultAuthorizations = {
+    DockerImageCreate: true,
+  };
+
+  const mockUser = createMockUser({
+    EndpointAuthorizations: {
+      1: userAuthorizations || defaultAuthorizations,
+    },
+    Id: 1,
+    Role: 1,
+  });
+
+  const Wrapper = withTestQueryProvider(
+    withUserProvider(withTestRouter(CreateImageSection), mockUser),
+    onMutationError ? { onMutationError } : undefined
+  );
+
+  return render(<Wrapper {...defaultProps} />);
+}
diff --git a/app/react/docker/containers/ItemView/CreateImageSection/CreateImageSection.tsx b/app/react/docker/containers/ItemView/CreateImageSection/CreateImageSection.tsx
new file mode 100644
index 0000000..055004f
--- /dev/null
+++ b/app/react/docker/containers/ItemView/CreateImageSection/CreateImageSection.tsx
@@ -0,0 +1,80 @@
+import { Formik } from 'formik';
+import { useState } from 'react';
+import { ListIcon } from 'lucide-react';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { useAuthorizations } from '@/react/hooks/useUser';
+import { notifySuccess } from '@/portainer/services/notifications';
+import { useCommitContainerMutation } from '@/react/docker/proxy/queries/useCommitContainerMutation';
+
+import { getDefaultImageConfig } from '@@/ImageConfigFieldset/getImageConfig';
+import { Widget } from '@@/Widget';
+
+import { CreateImageForm } from './CreateImageForm';
+import { useValidation } from './validation';
+import { FormValues } from './types';
+
+interface Props {
+  environmentId: EnvironmentId;
+  containerId: string;
+  onSuccess?(): void;
+}
+
+export function CreateImageSection({
+  environmentId,
+  containerId,
+  onSuccess,
+}: Props) {
+  const mutation = useCommitContainerMutation(environmentId);
+  const authorizedQuery = useAuthorizations('DockerImageCreate');
+  const [isDockerhubRateLimited, setIsDockerhubRateLimited] = useState(false);
+
+  const validation = useValidation(isDockerhubRateLimited);
+
+  if (!authorizedQuery.authorized) {
+    return null;
+  }
+
+  const initialValues: FormValues = {
+    config: getDefaultImageConfig(),
+  };
+
+  return (
+    <Widget>
+      <Widget.Title icon={ListIcon} title="Create image" />
+      <Widget.Body>
+        <Formik
+          initialValues={initialValues}
+          onSubmit={handleSubmit}
+          validationSchema={validation}
+          validateOnMount
+        >
+          <CreateImageForm
+            onRateLimit={(limited = false) =>
+              setIsDockerhubRateLimited(limited)
+            }
+            isLoading={mutation.isLoading}
+          />
+        </Formik>
+      </Widget.Body>
+    </Widget>
+  );
+
+  function handleSubmit({ config }: FormValues) {
+    mutation.mutate(
+      {
+        environmentId,
+        containerId,
+        image: config.image,
+        registryId: config.registryId,
+        useRegistry: config.useRegistry,
+      },
+      {
+        onSuccess() {
+          notifySuccess('Image created', containerId);
+          onSuccess?.();
+        },
+      }
+    );
+  }
+}
diff --git a/app/react/docker/containers/ItemView/CreateImageSection/types.ts b/app/react/docker/containers/ItemView/CreateImageSection/types.ts
new file mode 100644
index 0000000..10d4c30
--- /dev/null
+++ b/app/react/docker/containers/ItemView/CreateImageSection/types.ts
@@ -0,0 +1,5 @@
+import { ImageConfigValues } from '@@/ImageConfigFieldset';
+
+export interface FormValues {
+  config: ImageConfigValues;
+}
diff --git a/app/react/docker/containers/ItemView/CreateImageSection/validation.ts b/app/react/docker/containers/ItemView/CreateImageSection/validation.ts
new file mode 100644
index 0000000..4736afb
--- /dev/null
+++ b/app/react/docker/containers/ItemView/CreateImageSection/validation.ts
@@ -0,0 +1,22 @@
+import { useMemo } from 'react';
+import { SchemaOf, object } from 'yup';
+
+import { imageConfigValidation } from '@@/ImageConfigFieldset';
+
+import { FormValues } from './types';
+
+export function useValidation(
+  isDockerhubRateLimited: boolean
+): SchemaOf<FormValues> {
+  return useMemo(
+    () =>
+      object({
+        config: imageConfigValidation().test(
+          'rate-limits',
+          'Rate limit exceeded',
+          () => !isDockerhubRateLimited
+        ),
+      }),
+    [isDockerhubRateLimited]
+  );
+}
diff --git a/app/react/docker/containers/ItemView/HealthStatus.tsx b/app/react/docker/containers/ItemView/HealthStatus.tsx
new file mode 100644
index 0000000..3c0904b
--- /dev/null
+++ b/app/react/docker/containers/ItemView/HealthStatus.tsx
@@ -0,0 +1,55 @@
+import { ComponentProps } from 'react';
+import { HeartPulse, Server } from 'lucide-react';
+import { Health } from 'docker-types/generated/1.44';
+
+import { TableContainer, TableTitle } from '@@/datatables';
+import { DetailsTable } from '@@/DetailsTable';
+import { Icon } from '@@/Icon';
+
+const StatusMode: Record<
+  Exclude<Health['Status'], undefined | 'none'>,
+  ComponentProps<typeof Icon>['mode']
+> = {
+  healthy: 'success',
+  unhealthy: 'danger',
+  starting: 'warning',
+};
+
+interface Props {
+  health: Health;
+}
+
+export function HealthStatus({ health }: Props) {
+  return (
+    <TableContainer>
+      <TableTitle label="Container health" icon={Server} />
+
+      <DetailsTable dataCy="health-status-table">
+        <DetailsTable.Row label="Status">
+          {health.Status && health.Status !== 'none' ? (
+            <div className="vertical-center">
+              <Icon
+                icon={HeartPulse}
+                mode={StatusMode[health.Status]}
+                className="space-right"
+              />
+              {health.Status}
+            </div>
+          ) : (
+            <div>No health status</div>
+          )}
+        </DetailsTable.Row>
+
+        <DetailsTable.Row label="Failure count">
+          <div className="vertical-center">{health.FailingStreak}</div>
+        </DetailsTable.Row>
+
+        {!!health.Log?.length && (
+          <DetailsTable.Row label="Last output">
+            {health.Log[health.Log.length - 1].Output}
+          </DetailsTable.Row>
+        )}
+      </DetailsTable>
+    </TableContainer>
+  );
+}
diff --git a/app/react/docker/containers/ItemView/ItemView.test.tsx b/app/react/docker/containers/ItemView/ItemView.test.tsx
new file mode 100644
index 0000000..02674f4
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ItemView.test.tsx
@@ -0,0 +1,86 @@
+import { render, screen } from '@testing-library/react';
+import { http, HttpResponse } from 'msw';
+
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { createMockContainer, createMockUser } from '@/react-tools/test-mocks';
+import { server } from '@/setup-tests/server';
+import { User } from '@/portainer/users/types';
+import { ContainerDetailsViewModel } from '@/docker/models/containerDetails';
+
+import { ItemView } from './ItemView';
+
+vi.mock('@uirouter/react', async (importOriginal: () => Promise<object>) => ({
+  ...(await importOriginal()),
+  useCurrentStateAndParams: vi.fn(() => ({
+    params: { id: 'container-id-123', endpointId: '1', nodeName: undefined },
+  })),
+}));
+
+describe('ItemView', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('renders page header with container details title', async () => {
+    renderComponent();
+
+    expect(
+      await screen.findByRole('heading', {
+        name: 'Container details',
+        level: 1,
+      })
+    ).toBeVisible();
+  });
+
+  it('displays container name in breadcrumbs with leading slash trimmed', async () => {
+    renderComponent();
+
+    expect(await screen.findByText('test-container')).toBeVisible();
+    expect(screen.queryByText('/test-container')).not.toBeInTheDocument();
+  });
+
+  it('renders health status section when container has health data', async () => {
+    renderComponent({
+      container: {
+        State: {
+          Health: {
+            Status: 'healthy',
+            FailingStreak: 0,
+            Log: [
+              {
+                Start: '2024-01-01T00:00:00Z',
+                End: '2024-01-01T00:00:01Z',
+                ExitCode: 0,
+                Output: 'Health check passed',
+              },
+            ],
+          },
+        },
+      },
+    });
+
+    expect(await screen.findByText('Container health')).toBeVisible();
+  });
+});
+
+function renderComponent({
+  user = createMockUser({ Role: 1 }),
+  container,
+}: {
+  user?: User;
+  container?: Partial<ContainerDetailsViewModel>;
+} = {}) {
+  server.use(
+    http.get('/api/endpoints/:endpointId/docker/containers/:id/json', () =>
+      HttpResponse.json(createMockContainer(container))
+    )
+  );
+
+  const Wrapped = withTestQueryProvider(
+    withTestRouter(withUserProvider(ItemView, user))
+  );
+
+  return render(<Wrapped />);
+}
diff --git a/app/react/docker/containers/ItemView/ItemView.tsx b/app/react/docker/containers/ItemView/ItemView.tsx
new file mode 100644
index 0000000..0d45e7f
--- /dev/null
+++ b/app/react/docker/containers/ItemView/ItemView.tsx
@@ -0,0 +1,129 @@
+import { useCurrentStateAndParams } from '@uirouter/react';
+
+import { AccessControlPanel } from '@/react/portainer/access-control/AccessControlPanel';
+import { ContainerDetailsViewModel } from '@/docker/models/containerDetails';
+import { ResourceControlType } from '@/react/portainer/access-control/types';
+import { trimContainerName } from '@/docker/filters/utils';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useEnvironmentRegistries } from '@/react/portainer/environments/queries/useEnvironmentRegistries';
+import { Registry } from '@/react/portainer/registries/types/registry';
+
+import { PageHeader } from '@@/PageHeader';
+import { findBestMatchRegistry } from '@@/ImageConfigFieldset/findRegistryMatch';
+
+import { useContainer } from '../queries/useContainer';
+
+import { ContainerActionsSection } from './ContainerActionsSection/ContainerActionsSection';
+import { ContainerStatusSection } from './ContainerStatusSection/ContainerStatusSection';
+import { CreateImageSection } from './CreateImageSection/CreateImageSection';
+import { ContainerDetailsSection } from './ContainerDetailsSection/ContainerDetailsSection';
+import { VolumesSection } from './VolumesSection/VolumesSection';
+import { ContainerNetworksDatatable } from './ContainerNetworksDatatable';
+import { HealthStatus } from './HealthStatus';
+
+export function ItemView() {
+  const environmentId = useEnvironmentId();
+  const {
+    params: { id: containerId, nodeName },
+  } = useCurrentStateAndParams();
+
+  const containerQuery = useContainer(
+    { environmentId, containerId, nodeName },
+    { select: (c) => new ContainerDetailsViewModel(c) }
+  );
+
+  const registriesQuery = useEnvironmentRegistries(environmentId);
+
+  if (
+    containerQuery.isLoading ||
+    !containerQuery.data ||
+    !registriesQuery.data
+  ) {
+    return null;
+  }
+
+  const container = containerQuery.data;
+  const registryId = getRegistryId(container, registriesQuery.data);
+
+  async function handleSuccess() {
+    containerQuery.refetch();
+  }
+
+  const containerName =
+    trimContainerName(container.Name) || container.Id || 'unknown';
+
+  return (
+    <>
+      <PageHeader
+        title="Container details"
+        breadcrumbs={[
+          { label: 'Containers', link: 'docker.containers' },
+          containerName,
+        ]}
+      />
+
+      <div className="mx-4 mb-4 space-y-4 [&>*]:block">
+        <ContainerActionsSection
+          environmentId={environmentId}
+          nodeName={nodeName}
+          container={container}
+        />
+
+        <ContainerStatusSection
+          environmentId={environmentId}
+          nodeName={nodeName}
+          container={container}
+          registryId={registryId}
+        />
+      </div>
+
+      <AccessControlPanel
+        resourceId={container.Id || ''}
+        resourceControl={container.ResourceControl}
+        resourceType={ResourceControlType.Container}
+        onUpdateSuccess={handleSuccess}
+        environmentId={environmentId}
+      />
+
+      {container.State?.Health && (
+        <HealthStatus health={container.State.Health} />
+      )}
+
+      <div className="mx-4 mb-4 space-y-4 [&>*]:block">
+        <CreateImageSection
+          environmentId={environmentId}
+          containerId={container.Id || ''}
+        />
+
+        <ContainerDetailsSection
+          environmentId={environmentId}
+          container={container}
+          nodeName={nodeName}
+        />
+
+        <VolumesSection volumes={container.Mounts} nodeName={nodeName} />
+      </div>
+
+      {container.NetworkSettings?.Networks && (
+        <ContainerNetworksDatatable
+          dataset={container.NetworkSettings.Networks}
+          containerId={containerId}
+          nodeName={nodeName}
+        />
+      )}
+    </>
+  );
+}
+
+function getRegistryId(
+  container: ContainerDetailsViewModel,
+  registries?: Array<Registry>
+) {
+  const imageName = container.Config?.Image;
+  if (!imageName || !registries) {
+    return undefined;
+  }
+
+  const registry = findBestMatchRegistry(imageName, registries);
+  return registry?.Id;
+}
diff --git a/app/react/docker/containers/ItemView/RestartPolicySection/RestartPolicySection.test.tsx b/app/react/docker/containers/ItemView/RestartPolicySection/RestartPolicySection.test.tsx
new file mode 100644
index 0000000..55eaca4
--- /dev/null
+++ b/app/react/docker/containers/ItemView/RestartPolicySection/RestartPolicySection.test.tsx
@@ -0,0 +1,166 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { vi } from 'vitest';
+
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+
+import { RestartPolicy } from '../../CreateView/RestartPolicyTab/types';
+
+import { RestartPolicySection } from './RestartPolicySection';
+
+const mockMutate = vi.fn();
+
+vi.mock('./useUpdateRestartPolicyMutation', () => ({
+  useUpdateRestartPolicyMutation: () => ({
+    mutate: mockMutate,
+  }),
+}));
+
+function renderComponent(
+  props: Partial<React.ComponentProps<typeof RestartPolicySection>> = {}
+) {
+  const defaultProps: React.ComponentProps<typeof RestartPolicySection> = {
+    environmentId: 1,
+    containerId: 'test-container-id',
+    name: RestartPolicy.No,
+    maximumRetryCount: 0,
+    ...props,
+  };
+
+  const Wrapper = withTestQueryProvider(
+    withUserProvider(withTestRouter(RestartPolicySection))
+  );
+
+  return render(<Wrapper {...defaultProps} />);
+}
+
+describe('RestartPolicySection', () => {
+  beforeEach(() => {
+    mockMutate.mockReset();
+  });
+
+  it('should render with initial policy name', () => {
+    renderComponent({ name: RestartPolicy.Always });
+
+    const select = screen.getByTestId('container-restart-policy-select');
+    expect(select).toHaveValue('always');
+  });
+
+  it('should show retry count input when "on-failure" is selected', async () => {
+    const user = userEvent.setup();
+    renderComponent({ name: RestartPolicy.No });
+
+    const select = screen.getByTestId('container-restart-policy-select');
+    await user.selectOptions(select, 'on-failure');
+
+    expect(
+      screen.getByTestId('container-restart-max-retry-input')
+    ).toBeVisible();
+  });
+
+  it('should hide retry count input for policies other than "on-failure"', () => {
+    renderComponent({ name: RestartPolicy.Always });
+
+    expect(
+      screen.queryByTestId('container-restart-max-retry-input')
+    ).not.toBeInTheDocument();
+  });
+
+  it('should call mutation with correct values when update button is clicked', async () => {
+    const user = userEvent.setup();
+    renderComponent({ name: RestartPolicy.No });
+
+    const select = screen.getByTestId('container-restart-policy-select');
+    await user.selectOptions(select, 'always');
+
+    const updateButton = screen.getByTestId(
+      'container-restart-policy-update-button'
+    );
+    await user.click(updateButton);
+
+    expect(mockMutate).toHaveBeenCalledWith(
+      expect.objectContaining({
+        environmentId: 1,
+        containerId: 'test-container-id',
+        nodeName: undefined,
+        policy: {
+          name: RestartPolicy.Always,
+          maximumRetryCount: 0,
+        },
+      }),
+      expect.anything()
+    );
+  });
+
+  it('should disable update button when no changes are made', async () => {
+    renderComponent({ name: RestartPolicy.Always });
+
+    const updateButton = screen.getByTestId(
+      'container-restart-policy-update-button'
+    );
+    await waitFor(() => {
+      expect(updateButton).toBeDisabled();
+    });
+  });
+
+  it('should include retry count when updating "on-failure" policy', async () => {
+    const user = userEvent.setup();
+    renderComponent({ name: RestartPolicy.No });
+
+    const select = screen.getByTestId('container-restart-policy-select');
+    await user.selectOptions(select, 'on-failure');
+
+    const retryInput = screen.getByTestId('container-restart-max-retry-input');
+    await user.clear(retryInput);
+    await user.type(retryInput, '5');
+
+    const updateButton = screen.getByTestId(
+      'container-restart-policy-update-button'
+    );
+    await user.click(updateButton);
+
+    expect(mockMutate).toHaveBeenCalledWith(
+      {
+        environmentId: 1,
+        containerId: 'test-container-id',
+        nodeName: undefined,
+        policy: {
+          name: RestartPolicy.OnFailure,
+          maximumRetryCount: 5,
+        },
+      },
+      expect.anything()
+    );
+  });
+
+  it('should call onUpdateSuccess callback when mutation succeeds', async () => {
+    const user = userEvent.setup();
+    const mockOnUpdateSuccess = vi.fn();
+
+    mockMutate.mockImplementation((_, options) => {
+      options.onSuccess();
+    });
+
+    renderComponent({
+      name: RestartPolicy.No,
+      onUpdateSuccess: mockOnUpdateSuccess,
+    });
+
+    const select = screen.getByTestId('container-restart-policy-select');
+    await user.selectOptions(select, 'always');
+
+    const updateButton = screen.getByTestId(
+      'container-restart-policy-update-button'
+    );
+    await user.click(updateButton);
+
+    await waitFor(() => {
+      expect(mockOnUpdateSuccess).toHaveBeenCalledWith({
+        name: RestartPolicy.Always,
+        maximumRetryCount: 0,
+      });
+    });
+  });
+});
diff --git a/app/react/docker/containers/ItemView/RestartPolicySection/RestartPolicySection.tsx b/app/react/docker/containers/ItemView/RestartPolicySection/RestartPolicySection.tsx
new file mode 100644
index 0000000..8972fa4
--- /dev/null
+++ b/app/react/docker/containers/ItemView/RestartPolicySection/RestartPolicySection.tsx
@@ -0,0 +1,121 @@
+import { Form, Formik } from 'formik';
+
+import { notifySuccess } from '@/portainer/services/notifications';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { Authorized } from '@/react/hooks/useUser';
+
+import { LoadingButton } from '@@/buttons';
+import { Input } from '@@/form-components/Input';
+import { Select, Option } from '@@/form-components/Input/Select';
+import { DetailsTable } from '@@/DetailsTable';
+import { DetailsRow } from '@@/DetailsTable/DetailsRow';
+
+import { RestartPolicy } from '../../CreateView/RestartPolicyTab/types';
+
+import { useUpdateRestartPolicyMutation } from './useUpdateRestartPolicyMutation';
+
+interface Props {
+  environmentId: EnvironmentId;
+  containerId: string;
+  nodeName?: string;
+  name?: RestartPolicy;
+  maximumRetryCount?: number;
+  onUpdateSuccess?: (policy: {
+    name: RestartPolicy;
+    maximumRetryCount?: number;
+  }) => void;
+}
+
+const restartPolicyOptions: Array<Option<RestartPolicy>> = [
+  { label: 'None', value: RestartPolicy.No },
+  { label: 'On Failure', value: RestartPolicy.OnFailure },
+  { label: 'Always', value: RestartPolicy.Always },
+  { label: 'Unless Stopped', value: RestartPolicy.UnlessStopped },
+];
+
+export function RestartPolicySection({
+  environmentId,
+  containerId,
+  nodeName,
+  name = RestartPolicy.No,
+  maximumRetryCount = 0,
+  onUpdateSuccess,
+}: Props) {
+  const updateMutation = useUpdateRestartPolicyMutation();
+
+  return (
+    <Formik
+      initialValues={{ name, maximumRetryCount }}
+      onSubmit={handleSubmit}
+      enableReinitialize
+    >
+      {({ values, isValid, dirty, setFieldValue }) => (
+        <Form>
+          <DetailsTable
+            dataCy="container-restart-policy-table"
+            className="table-bordered table-condensed !m-0"
+          >
+            <Authorized authorizations="DockerContainerUpdate">
+              <DetailsRow
+                label="Name"
+                columns={[
+                  <LoadingButton
+                    key="update-button"
+                    type="submit"
+                    disabled={!isValid || !dirty}
+                    isLoading={updateMutation.isLoading}
+                    data-cy="container-restart-policy-update-button"
+                    loadingText="Updating..."
+                  >
+                    Update
+                  </LoadingButton>,
+                ]}
+              >
+                <Select
+                  options={restartPolicyOptions}
+                  value={values.name}
+                  onChange={(e) => setFieldValue('name', e.target.value)}
+                  data-cy="container-restart-policy-select"
+                />
+              </DetailsRow>
+            </Authorized>
+            {values.name === RestartPolicy.OnFailure && (
+              <DetailsRow label="Maximum Retry Count">
+                <Input
+                  type="number"
+                  value={values.maximumRetryCount}
+                  onChange={(e) =>
+                    setFieldValue('maximumRetryCount', e.target.valueAsNumber)
+                  }
+                  data-cy="container-restart-max-retry-input"
+                  min={0}
+                />
+              </DetailsRow>
+            )}
+          </DetailsTable>
+        </Form>
+      )}
+    </Formik>
+  );
+
+  function handleSubmit(values: {
+    name: RestartPolicy;
+    maximumRetryCount: number;
+  }) {
+    updateMutation.mutate(
+      {
+        environmentId,
+        containerId,
+        nodeName,
+        policy: values,
+      },
+      {
+        onSuccess: () => {
+          notifySuccess('Success', 'Restart policy updated');
+
+          onUpdateSuccess?.(values);
+        },
+      }
+    );
+  }
+}
diff --git a/app/react/docker/containers/ItemView/RestartPolicySection/useUpdateRestartPolicyMutation.ts b/app/react/docker/containers/ItemView/RestartPolicySection/useUpdateRestartPolicyMutation.ts
new file mode 100644
index 0000000..4a10324
--- /dev/null
+++ b/app/react/docker/containers/ItemView/RestartPolicySection/useUpdateRestartPolicyMutation.ts
@@ -0,0 +1,55 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { withError } from '@/react-tools/react-query';
+
+import { updateContainer } from '../../queries/useUpdateContainer';
+import { queryKeys } from '../../queries/query-keys';
+import { RestartPolicy } from '../../CreateView/RestartPolicyTab/types';
+
+interface UpdateRestartPolicyRequest {
+  environmentId: EnvironmentId;
+  containerId: string;
+  policy: {
+    name: RestartPolicy;
+    maximumRetryCount?: number;
+  };
+  nodeName?: string;
+}
+
+export function useUpdateRestartPolicyMutation() {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    ...withError('Unable to update restart policy'),
+    onSuccess(_, variables) {
+      queryClient.invalidateQueries({
+        queryKey: queryKeys.container(
+          variables.environmentId,
+          variables.containerId
+        ),
+      });
+    },
+    mutationFn: async ({
+      environmentId,
+      containerId,
+      policy,
+      nodeName,
+    }: UpdateRestartPolicyRequest) => {
+      await updateContainer(
+        environmentId,
+        containerId,
+        {
+          RestartPolicy: {
+            Name: policy.name,
+            MaximumRetryCount:
+              policy.name === RestartPolicy.OnFailure
+                ? policy.maximumRetryCount
+                : undefined,
+          },
+        },
+        { nodeName }
+      );
+    },
+  });
+}
diff --git a/app/react/docker/containers/ItemView/VolumesSection/VolumeRow.test.tsx b/app/react/docker/containers/ItemView/VolumesSection/VolumeRow.test.tsx
new file mode 100644
index 0000000..cc05df0
--- /dev/null
+++ b/app/react/docker/containers/ItemView/VolumesSection/VolumeRow.test.tsx
@@ -0,0 +1,87 @@
+import { render, screen } from '@testing-library/react';
+import { MountPoint } from 'docker-types/generated/1.44';
+
+import { withTestRouter } from '@/react/test-utils/withRouter';
+
+import { VolumeRow } from './VolumeRow';
+
+describe('VolumeRow', () => {
+  it('should render bind mount with source path', () => {
+    const volume: MountPoint = {
+      Type: 'bind',
+      Source: '/host/path',
+      Destination: '/container/path',
+      Mode: '',
+      RW: true,
+      Propagation: '',
+    };
+
+    renderComponent(volume);
+
+    expect(screen.getByText('/host/path')).toBeVisible();
+    expect(screen.getByText('/container/path')).toBeVisible();
+  });
+
+  it('should render volume mount with link to volume details', () => {
+    const volume: MountPoint = {
+      Type: 'volume',
+      Name: 'my-volume',
+      Source: '/var/lib/docker/volumes/my-volume/_data',
+      Destination: '/data',
+      Driver: 'local',
+      Mode: '',
+      RW: true,
+      Propagation: '',
+    };
+
+    renderComponent(volume);
+
+    const link = screen.getByText('my-volume');
+    expect(link).toBeVisible();
+    expect(link.tagName).toBe('A');
+    expect(screen.getByText('/data')).toBeVisible();
+  });
+
+  it('should render tmpfs mount', () => {
+    const volume: MountPoint = {
+      Type: 'tmpfs',
+      Source: '',
+      Destination: '/tmp',
+      Mode: '',
+      RW: true,
+      Propagation: '',
+    };
+
+    renderComponent(volume);
+
+    expect(screen.getByText('/tmp')).toBeVisible();
+  });
+
+  it('should handle volume without name by showing source', () => {
+    const volume: MountPoint = {
+      Type: 'volume',
+      Source: '/some/source',
+      Destination: '/dest',
+      Driver: 'local',
+      Mode: '',
+      RW: true,
+      Propagation: '',
+    };
+
+    renderComponent(volume);
+
+    expect(screen.getByText('/some/source')).toBeVisible();
+    expect(screen.getByText('/dest')).toBeVisible();
+  });
+});
+
+function renderComponent(volume: MountPoint) {
+  const Wrapped = withTestRouter(() => (
+    <table>
+      <tbody>
+        <VolumeRow volume={volume} nodeName="node1" />
+      </tbody>
+    </table>
+  ));
+  return render(<Wrapped />);
+}
diff --git a/app/react/docker/containers/ItemView/VolumesSection/VolumeRow.tsx b/app/react/docker/containers/ItemView/VolumesSection/VolumeRow.tsx
new file mode 100644
index 0000000..4153ae3
--- /dev/null
+++ b/app/react/docker/containers/ItemView/VolumesSection/VolumeRow.tsx
@@ -0,0 +1,36 @@
+import { MountPoint } from 'docker-types/generated/1.44';
+
+import { Link } from '@@/Link';
+
+interface Props {
+  volume: MountPoint;
+  nodeName?: string;
+}
+
+export function VolumeRow({ volume, nodeName }: Props) {
+  return (
+    <tr>
+      <td>{renderHostOrVolume()}</td>
+      <td>{volume.Destination}</td>
+    </tr>
+  );
+
+  function renderHostOrVolume() {
+    if (volume.Type === 'volume' && volume.Name) {
+      return (
+        <Link
+          to="docker.volumes.volume"
+          params={{
+            id: volume.Name,
+            nodeName,
+          }}
+          data-cy="volume-link"
+        >
+          {volume.Name}
+        </Link>
+      );
+    }
+
+    return volume.Source;
+  }
+}
diff --git a/app/react/docker/containers/ItemView/VolumesSection/VolumesSection.test.tsx b/app/react/docker/containers/ItemView/VolumesSection/VolumesSection.test.tsx
new file mode 100644
index 0000000..2aec3d6
--- /dev/null
+++ b/app/react/docker/containers/ItemView/VolumesSection/VolumesSection.test.tsx
@@ -0,0 +1,81 @@
+import { render, screen } from '@testing-library/react';
+import { MountPoint } from 'docker-types/generated/1.44';
+
+import { withTestRouter } from '@/react/test-utils/withRouter';
+
+import { VolumesSection } from './VolumesSection';
+
+describe('VolumesSection', () => {
+  it('should render volumes table with correct headers', () => {
+    const volumes: Array<MountPoint> = [
+      {
+        Type: 'volume',
+        Name: 'test-volume',
+        Source: '/var/lib/docker/volumes/test-volume/_data',
+        Destination: '/data',
+        Driver: 'local',
+        Mode: '',
+        RW: true,
+        Propagation: '',
+      },
+    ];
+
+    renderComponent(volumes);
+
+    const table = screen.getByRole('table');
+    expect(table).toBeVisible();
+    expect(table).toHaveAttribute('data-cy', 'containerDetails-volumesTable');
+    expect(screen.getByText('Host/volume')).toBeVisible();
+    expect(screen.getByText('Path in container')).toBeVisible();
+  });
+
+  it('should render multiple volumes', () => {
+    const volumes: Array<MountPoint> = [
+      {
+        Type: 'volume',
+        Name: 'volume1',
+        Source: '/var/lib/docker/volumes/volume1/_data',
+        Destination: '/data1',
+        Driver: 'local',
+        Mode: '',
+        RW: true,
+        Propagation: '',
+      },
+      {
+        Type: 'bind',
+        Source: '/host/path',
+        Destination: '/container/path',
+        Mode: '',
+        RW: false,
+        Propagation: '',
+      },
+    ];
+
+    renderComponent(volumes);
+
+    expect(screen.getByText('volume1')).toBeVisible();
+    expect(screen.getByText('/host/path')).toBeVisible();
+    expect(screen.getByText('/data1')).toBeVisible();
+    expect(screen.getByText('/container/path')).toBeVisible();
+  });
+
+  it('should not render when volumes array is empty', () => {
+    renderComponent([]);
+
+    expect(screen.queryByRole('table')).not.toBeInTheDocument();
+    expect(screen.queryByText('Volumes')).not.toBeInTheDocument();
+  });
+
+  it('should not render when volumes is undefined', () => {
+    const Wrapped = withTestRouter(VolumesSection);
+    render(<Wrapped volumes={undefined as unknown as Array<MountPoint>} />);
+
+    expect(screen.queryByRole('table')).not.toBeInTheDocument();
+    expect(screen.queryByText('Volumes')).not.toBeInTheDocument();
+  });
+});
+
+function renderComponent(volumes: Array<MountPoint>) {
+  const Wrapped = withTestRouter(VolumesSection);
+  return render(<Wrapped volumes={volumes} nodeName="node1" />);
+}
diff --git a/app/react/docker/containers/ItemView/VolumesSection/VolumesSection.tsx b/app/react/docker/containers/ItemView/VolumesSection/VolumesSection.tsx
new file mode 100644
index 0000000..f805fca
--- /dev/null
+++ b/app/react/docker/containers/ItemView/VolumesSection/VolumesSection.tsx
@@ -0,0 +1,42 @@
+import { MountPoint } from 'docker-types/generated/1.44';
+import { DatabaseIcon } from 'lucide-react';
+
+import { Widget, WidgetBody } from '@@/Widget';
+import { DetailsTable } from '@@/DetailsTable';
+
+import { VolumeRow } from './VolumeRow';
+
+interface Props {
+  volumes: Array<MountPoint> | undefined;
+  nodeName?: string;
+}
+
+export function VolumesSection({ volumes, nodeName }: Props) {
+  if (!volumes || volumes.length === 0) {
+    return null;
+  }
+
+  return (
+    <Widget>
+      <Widget.Title icon={DatabaseIcon} title="Volumes" />
+      <WidgetBody className="no-padding">
+        <DetailsTable
+          dataCy="containerDetails-volumesTable"
+          headers={['Host/volume', 'Path in container']}
+        >
+          {volumes.map((volume) => (
+            <VolumeRow
+              key={
+                volume.Type === 'volume'
+                  ? volume.Name
+                  : volume.Source || volume.Destination
+              }
+              volume={volume}
+              nodeName={nodeName}
+            />
+          ))}
+        </DetailsTable>
+      </WidgetBody>
+    </Widget>
+  );
+}
diff --git a/app/react/docker/containers/ListView/.keep b/app/react/docker/containers/ListView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/docker/containers/ListView/ContainersDatatable/ContainersDatatable.tsx b/app/react/docker/containers/ListView/ContainersDatatable/ContainersDatatable.tsx
new file mode 100644
index 0000000..1d9a692
--- /dev/null
+++ b/app/react/docker/containers/ListView/ContainersDatatable/ContainersDatatable.tsx
@@ -0,0 +1,106 @@
+import { Box } from 'lucide-react';
+
+import { ContainerListViewModel } from '@/react/docker/containers/types';
+import { useShowGPUsColumn } from '@/react/docker/containers/utils';
+import { Environment } from '@/react/portainer/environments/types';
+
+import { Datatable, Table } from '@@/datatables';
+import {
+  ColumnVisibilityMenu,
+  getColumnVisibilityState,
+} from '@@/datatables/ColumnVisibilityMenu';
+import {
+  QuickActionsSettings,
+  buildAction,
+} from '@@/datatables/QuickActionsSettings';
+import { mergeOptions } from '@@/datatables/extend-options/mergeOptions';
+import { withColumnFilters } from '@@/datatables/extend-options/withColumnFilters';
+import { TableSettingsProvider } from '@@/datatables/useTableSettings';
+import { useTableState } from '@@/datatables/useTableState';
+
+import { useContainers } from '../../queries/useContainers';
+
+import { ContainersDatatableActions } from './ContainersDatatableActions';
+import { ContainersDatatableSettings } from './ContainersDatatableSettings';
+import { RowProvider } from './RowContext';
+import { useColumns } from './columns';
+import { createStore } from './datatable-store';
+
+const storageKey = 'containers';
+const settingsStore = createStore(storageKey);
+
+const actions = [
+  buildAction('logs', 'Logs'),
+  buildAction('inspect', 'Inspect'),
+  buildAction('stats', 'Stats'),
+  buildAction('exec', 'Console'),
+  buildAction('attach', 'Attach'),
+];
+
+export interface Props {
+  isHostColumnVisible: boolean;
+  environment: Environment;
+}
+
+export function ContainersDatatable({
+  isHostColumnVisible,
+  environment,
+}: Props) {
+  const isGPUsColumnVisible = useShowGPUsColumn(environment);
+  const columns = useColumns(isHostColumnVisible, isGPUsColumnVisible);
+  const tableState = useTableState(settingsStore, storageKey);
+
+  const containersQuery = useContainers(environment.Id, {
+    autoRefreshRate: tableState.autoRefreshRate * 1000,
+  });
+
+  return (
+    <RowProvider context={{ environment }}>
+      <TableSettingsProvider settings={settingsStore}>
+        <Datatable
+          titleIcon={Box}
+          title="Containers"
+          settingsManager={tableState}
+          columns={columns}
+          renderTableActions={(selectedRows) => (
+            <ContainersDatatableActions
+              selectedItems={selectedRows}
+              isAddActionVisible
+              endpointId={environment.Id}
+            />
+          )}
+          isLoading={containersQuery.isLoading}
+          isRowSelectable={(row) => !row.original.IsPortainer}
+          initialTableState={getColumnVisibilityState(tableState.hiddenColumns)}
+          data-cy="docker-containers-datatable"
+          renderTableSettings={(tableInstance) => (
+            <>
+              <ColumnVisibilityMenu<ContainerListViewModel>
+                table={tableInstance}
+                onChange={(hiddenColumns) => {
+                  tableState.setHiddenColumns(hiddenColumns);
+                }}
+                value={tableState.hiddenColumns}
+              />
+              <Table.SettingsMenu
+                quickActions={<QuickActionsSettings actions={actions} />}
+              >
+                <ContainersDatatableSettings
+                  isRefreshVisible
+                  settings={tableState}
+                />
+              </Table.SettingsMenu>
+            </>
+          )}
+          dataset={containersQuery.data || []}
+          extendTableOptions={mergeOptions(
+            withColumnFilters(
+              tableState.columnFilters,
+              tableState.setColumnFilters
+            )
+          )}
+        />
+      </TableSettingsProvider>
+    </RowProvider>
+  );
+}
diff --git a/app/react/docker/containers/ListView/ContainersDatatable/ContainersDatatableActions.tsx b/app/react/docker/containers/ListView/ContainersDatatable/ContainersDatatableActions.tsx
new file mode 100644
index 0000000..fe6ea04
--- /dev/null
+++ b/app/react/docker/containers/ListView/ContainersDatatable/ContainersDatatableActions.tsx
@@ -0,0 +1,311 @@
+import { useRouter } from '@uirouter/react';
+import { Pause, Play, RefreshCw, Slash, Square, Trash2 } from 'lucide-react';
+
+import * as notifications from '@/portainer/services/notifications';
+import { useAuthorizations, Authorized } from '@/react/hooks/useUser';
+import { confirmContainerDeletion } from '@/react/docker/containers/common/confirm-container-delete-modal';
+import { setPortainerAgentTargetHeader } from '@/portainer/services/http-request.helper';
+import {
+  ContainerId,
+  ContainerStatus,
+  ContainerListViewModel,
+} from '@/react/docker/containers/types';
+import {
+  killContainer,
+  pauseContainer,
+  removeContainer,
+  restartContainer,
+  resumeContainer,
+  startContainer,
+  stopContainer,
+} from '@/react/docker/containers/containers.service';
+import type { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { ButtonGroup, Button, AddButton } from '@@/buttons';
+
+type ContainerServiceAction = (
+  endpointId: EnvironmentId,
+  containerId: ContainerId
+) => Promise<void>;
+
+interface Props {
+  selectedItems: ContainerListViewModel[];
+  isAddActionVisible: boolean;
+  endpointId: EnvironmentId;
+}
+
+export function ContainersDatatableActions({
+  selectedItems,
+  isAddActionVisible,
+  endpointId,
+}: Props) {
+  const selectedItemCount = selectedItems.length;
+  const hasPausedItemsSelected = selectedItems.some(
+    (item) => item.State === ContainerStatus.Paused
+  );
+  const hasStoppedItemsSelected = selectedItems.some((item) =>
+    [
+      ContainerStatus.Stopped,
+      ContainerStatus.Created,
+      ContainerStatus.Exited,
+    ].includes(item.Status)
+  );
+  const hasRunningItemsSelected = selectedItems.some((item) =>
+    [
+      ContainerStatus.Running,
+      ContainerStatus.Healthy,
+      ContainerStatus.Unhealthy,
+      ContainerStatus.Starting,
+    ].includes(item.Status)
+  );
+
+  const { authorized } = useAuthorizations([
+    'DockerContainerStart',
+    'DockerContainerStop',
+    'DockerContainerKill',
+    'DockerContainerRestart',
+    'DockerContainerPause',
+    'DockerContainerUnpause',
+    'DockerContainerDelete',
+    'DockerContainerCreate',
+  ]);
+
+  const router = useRouter();
+
+  if (!authorized) {
+    return null;
+  }
+
+  return (
+    <div className="flex gap-2">
+      <ButtonGroup>
+        <Authorized authorizations="DockerContainerStart">
+          <Button
+            color="light"
+            data-cy="start-docker-container-button"
+            onClick={() => onStartClick(selectedItems)}
+            disabled={selectedItemCount === 0 || !hasStoppedItemsSelected}
+            icon={Play}
+          >
+            Start
+          </Button>
+        </Authorized>
+
+        <Authorized authorizations="DockerContainerStop">
+          <Button
+            color="light"
+            data-cy="stop-docker-container-button"
+            onClick={() => onStopClick(selectedItems)}
+            disabled={selectedItemCount === 0 || !hasRunningItemsSelected}
+            icon={Square}
+          >
+            Stop
+          </Button>
+        </Authorized>
+
+        <Authorized authorizations="DockerContainerKill">
+          <Button
+            color="light"
+            data-cy="kill-docker-container-button"
+            onClick={() => onKillClick(selectedItems)}
+            disabled={selectedItemCount === 0 || hasStoppedItemsSelected}
+            icon={Slash}
+          >
+            Kill
+          </Button>
+        </Authorized>
+
+        <Authorized authorizations="DockerContainerRestart">
+          <Button
+            color="light"
+            data-cy="restart-docker-container-button"
+            onClick={() => onRestartClick(selectedItems)}
+            disabled={selectedItemCount === 0}
+            icon={RefreshCw}
+          >
+            Restart
+          </Button>
+        </Authorized>
+
+        <Authorized authorizations="DockerContainerPause">
+          <Button
+            color="light"
+            data-cy="pause-docker-container-button"
+            onClick={() => onPauseClick(selectedItems)}
+            disabled={selectedItemCount === 0 || !hasRunningItemsSelected}
+            icon={Pause}
+          >
+            Pause
+          </Button>
+        </Authorized>
+
+        <Authorized authorizations="DockerContainerUnpause">
+          <Button
+            color="light"
+            data-cy="resume-docker-container-button"
+            onClick={() => onResumeClick(selectedItems)}
+            disabled={selectedItemCount === 0 || !hasPausedItemsSelected}
+            icon={Play}
+          >
+            Resume
+          </Button>
+        </Authorized>
+
+        <Authorized authorizations="DockerContainerDelete">
+          <Button
+            color="dangerlight"
+            data-cy="remove-docker-container-button"
+            onClick={() => onRemoveClick(selectedItems)}
+            disabled={selectedItemCount === 0}
+            icon={Trash2}
+          >
+            Remove
+          </Button>
+        </Authorized>
+      </ButtonGroup>
+      {isAddActionVisible && (
+        <div className="space-left">
+          <Authorized authorizations="DockerContainerCreate">
+            <AddButton data-cy="add-docker-container-button">
+              Add container
+            </AddButton>
+          </Authorized>
+        </div>
+      )}
+    </div>
+  );
+
+  function onStartClick(selectedItems: ContainerListViewModel[]) {
+    const successMessage = 'Container successfully started';
+    const errorMessage = 'Unable to start container';
+    executeActionOnContainerList(
+      selectedItems,
+      startContainer,
+      successMessage,
+      errorMessage
+    );
+  }
+
+  function onStopClick(selectedItems: ContainerListViewModel[]) {
+    const successMessage = 'Container successfully stopped';
+    const errorMessage = 'Unable to stop container';
+    executeActionOnContainerList(
+      selectedItems,
+      stopContainer,
+      successMessage,
+      errorMessage
+    );
+  }
+
+  function onRestartClick(selectedItems: ContainerListViewModel[]) {
+    const successMessage = 'Container successfully restarted';
+    const errorMessage = 'Unable to restart container';
+    executeActionOnContainerList(
+      selectedItems,
+      restartContainer,
+      successMessage,
+      errorMessage
+    );
+  }
+
+  function onKillClick(selectedItems: ContainerListViewModel[]) {
+    const successMessage = 'Container successfully killed';
+    const errorMessage = 'Unable to kill container';
+    executeActionOnContainerList(
+      selectedItems,
+      killContainer,
+      successMessage,
+      errorMessage
+    );
+  }
+
+  function onPauseClick(selectedItems: ContainerListViewModel[]) {
+    const successMessage = 'Container successfully paused';
+    const errorMessage = 'Unable to pause container';
+    executeActionOnContainerList(
+      selectedItems,
+      pauseContainer,
+      successMessage,
+      errorMessage
+    );
+  }
+
+  function onResumeClick(selectedItems: ContainerListViewModel[]) {
+    const successMessage = 'Container successfully resumed';
+    const errorMessage = 'Unable to resume container';
+    executeActionOnContainerList(
+      selectedItems,
+      resumeContainer,
+      successMessage,
+      errorMessage
+    );
+  }
+
+  async function onRemoveClick(selectedItems: ContainerListViewModel[]) {
+    const isOneContainerRunning = selectedItems.some(
+      (container) => container.State === 'running'
+    );
+
+    const runningTitle = isOneContainerRunning ? 'running' : '';
+    const title = `You are about to remove one or more ${runningTitle} containers.`;
+
+    const result = await confirmContainerDeletion(title);
+    if (!result) {
+      return;
+    }
+    const { removeVolumes } = result;
+
+    removeSelectedContainers(selectedItems, removeVolumes);
+  }
+
+  async function executeActionOnContainerList(
+    containers: ContainerListViewModel[],
+    action: ContainerServiceAction,
+    successMessage: string,
+    errorMessage: string
+  ) {
+    for (let i = 0; i < containers.length; i += 1) {
+      const container = containers[i];
+      try {
+        setPortainerAgentTargetHeader(container.NodeName);
+        await action(endpointId, container.Id);
+        notifications.success(successMessage, container.Names[0]);
+      } catch (err) {
+        notifications.error(
+          'Failure',
+          err as Error,
+          `${errorMessage}:${container.Names[0]}`
+        );
+      }
+    }
+
+    router.stateService.reload();
+  }
+
+  async function removeSelectedContainers(
+    containers: ContainerListViewModel[],
+    removeVolumes: boolean
+  ) {
+    for (let i = 0; i < containers.length; i += 1) {
+      const container = containers[i];
+      try {
+        await removeContainer(endpointId, container.Id, {
+          removeVolumes,
+          nodeName: container.NodeName,
+        });
+        notifications.success(
+          'Container successfully removed',
+          container.Names[0]
+        );
+      } catch (err) {
+        notifications.error(
+          'Failure',
+          err as Error,
+          'Unable to remove container'
+        );
+      }
+    }
+
+    router.stateService.reload();
+  }
+}
diff --git a/app/react/docker/containers/ListView/ContainersDatatable/ContainersDatatableSettings.tsx b/app/react/docker/containers/ListView/ContainersDatatable/ContainersDatatableSettings.tsx
new file mode 100644
index 0000000..0146aaa
--- /dev/null
+++ b/app/react/docker/containers/ListView/ContainersDatatable/ContainersDatatableSettings.tsx
@@ -0,0 +1,38 @@
+import { Checkbox } from '@@/form-components/Checkbox';
+import { TableSettingsMenuAutoRefresh } from '@@/datatables/TableSettingsMenuAutoRefresh';
+
+import { TableSettings } from './types';
+import { TRUNCATE_LENGTH } from './datatable-store';
+
+interface Props {
+  isRefreshVisible?: boolean;
+  settings: TableSettings;
+}
+
+export function ContainersDatatableSettings({
+  isRefreshVisible,
+  settings,
+}: Props) {
+  return (
+    <>
+      <Checkbox
+        id="settings-container-truncate-name"
+        data-cy="settings-container-truncate-name"
+        label="Truncate container name"
+        checked={settings.truncateContainerName > 0}
+        onChange={() =>
+          settings.setTruncateContainerName(
+            settings.truncateContainerName > 0 ? 0 : TRUNCATE_LENGTH
+          )
+        }
+      />
+
+      {isRefreshVisible && (
+        <TableSettingsMenuAutoRefresh
+          value={settings.autoRefreshRate}
+          onChange={(value) => settings.setAutoRefreshRate(value)}
+        />
+      )}
+    </>
+  );
+}
diff --git a/app/react/docker/containers/ListView/ContainersDatatable/RowContext.ts b/app/react/docker/containers/ListView/ContainersDatatable/RowContext.ts
new file mode 100644
index 0000000..66af358
--- /dev/null
+++ b/app/react/docker/containers/ListView/ContainersDatatable/RowContext.ts
@@ -0,0 +1,11 @@
+import { Environment } from '@/react/portainer/environments/types';
+
+import { createRowContext } from '@@/datatables/RowContext';
+
+interface RowContextState {
+  environment: Environment;
+}
+
+const { RowProvider, useRowContext } = createRowContext<RowContextState>();
+
+export { RowProvider, useRowContext };
diff --git a/app/react/docker/containers/ListView/ContainersDatatable/columns/created.tsx b/app/react/docker/containers/ListView/ContainersDatatable/columns/created.tsx
new file mode 100644
index 0000000..025243b
--- /dev/null
+++ b/app/react/docker/containers/ListView/ContainersDatatable/columns/created.tsx
@@ -0,0 +1,12 @@
+import { isoDateFromTimestamp } from '@/portainer/filters/filters';
+
+import { columnHelper } from './helper';
+
+export const created = columnHelper.accessor(
+  (row) => isoDateFromTimestamp(row.Created),
+  {
+    header: 'Created',
+    id: 'created',
+    cell: ({ row }) => isoDateFromTimestamp(row.original.Created),
+  }
+);
diff --git a/app/react/docker/containers/ListView/ContainersDatatable/columns/gpus.tsx b/app/react/docker/containers/ListView/ContainersDatatable/columns/gpus.tsx
new file mode 100644
index 0000000..fbf83ba
--- /dev/null
+++ b/app/react/docker/containers/ListView/ContainersDatatable/columns/gpus.tsx
@@ -0,0 +1,27 @@
+import { CellContext } from '@tanstack/react-table';
+
+import type { ContainerListViewModel } from '@/react/docker/containers/types';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useContainerGpus } from '@/react/docker/containers/queries/gpus';
+
+import { columnHelper } from './helper';
+
+export const gpus = columnHelper.display({
+  header: 'GPUs',
+  id: 'gpus',
+  cell: GpusCell,
+});
+
+function GpusCell({
+  row: { original: container },
+}: CellContext<ContainerListViewModel, unknown>) {
+  const containerId = container.Id;
+  const environmentId = useEnvironmentId();
+  const gpusQuery = useContainerGpus(environmentId, containerId);
+
+  if (!gpusQuery.data) {
+    return null;
+  }
+
+  return <>{gpusQuery.data}</>;
+}
diff --git a/app/react/docker/containers/ListView/ContainersDatatable/columns/helper.ts b/app/react/docker/containers/ListView/ContainersDatatable/columns/helper.ts
new file mode 100644
index 0000000..34e3833
--- /dev/null
+++ b/app/react/docker/containers/ListView/ContainersDatatable/columns/helper.ts
@@ -0,0 +1,5 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { ContainerListViewModel } from '../../../types';
+
+export const columnHelper = createColumnHelper<ContainerListViewModel>();
diff --git a/app/react/docker/containers/ListView/ContainersDatatable/columns/host.tsx b/app/react/docker/containers/ListView/ContainersDatatable/columns/host.tsx
new file mode 100644
index 0000000..c47c633
--- /dev/null
+++ b/app/react/docker/containers/ListView/ContainersDatatable/columns/host.tsx
@@ -0,0 +1,6 @@
+import { columnHelper } from './helper';
+
+export const host = columnHelper.accessor((row) => row.NodeName || '-', {
+  header: 'Host',
+  id: 'host',
+});
diff --git a/app/react/docker/containers/ListView/ContainersDatatable/columns/image.tsx b/app/react/docker/containers/ListView/ContainersDatatable/columns/image.tsx
new file mode 100644
index 0000000..23971fb
--- /dev/null
+++ b/app/react/docker/containers/ListView/ContainersDatatable/columns/image.tsx
@@ -0,0 +1,36 @@
+import { CellContext } from '@tanstack/react-table';
+import { useSref } from '@uirouter/react';
+
+import type { ContainerListViewModel } from '@/react/docker/containers/types';
+
+import { columnHelper } from './helper';
+
+export const image = columnHelper.accessor('Image', {
+  header: 'Image',
+  id: 'image',
+  cell: ImageCell,
+});
+
+function ImageCell({ getValue }: CellContext<ContainerListViewModel, string>) {
+  const imageName = getValue();
+  const linkProps = useSref('docker.images.image', { id: imageName });
+  const shortImageName = trimSHASum(imageName);
+
+  return (
+    <a href={linkProps.href} onClick={linkProps.onClick}>
+      {shortImageName}
+    </a>
+  );
+
+  function trimSHASum(imageName: string) {
+    if (!imageName) {
+      return '';
+    }
+
+    if (imageName.indexOf('sha256:') === 0) {
+      return imageName.substring(7, 19);
+    }
+
+    return imageName.split('@sha256')[0];
+  }
+}
diff --git a/app/react/docker/containers/ListView/ContainersDatatable/columns/index.tsx b/app/react/docker/containers/ListView/ContainersDatatable/columns/index.tsx
new file mode 100644
index 0000000..ad84eda
--- /dev/null
+++ b/app/react/docker/containers/ListView/ContainersDatatable/columns/index.tsx
@@ -0,0 +1,39 @@
+import _ from 'lodash';
+import { useMemo } from 'react';
+
+import { createOwnershipColumn } from '@/react/docker/components/datatable/createOwnershipColumn';
+import { ContainerListViewModel } from '@/react/docker/containers/types';
+
+import { created } from './created';
+import { host } from './host';
+import { image } from './image';
+import { ip } from './ip';
+import { name } from './name';
+import { ports } from './ports';
+import { quickActions } from './quick-actions';
+import { stack } from './stack';
+import { state } from './state';
+import { gpus } from './gpus';
+
+export function useColumns(
+  isHostColumnVisible: boolean,
+  isGPUsColumnVisible: boolean | undefined
+) {
+  return useMemo(
+    () =>
+      _.compact([
+        name,
+        state,
+        quickActions,
+        stack,
+        image,
+        created,
+        ip,
+        isHostColumnVisible && host,
+        isGPUsColumnVisible && gpus,
+        ports,
+        createOwnershipColumn<ContainerListViewModel>(),
+      ]),
+    [isHostColumnVisible, isGPUsColumnVisible]
+  );
+}
diff --git a/app/react/docker/containers/ListView/ContainersDatatable/columns/ip.tsx b/app/react/docker/containers/ListView/ContainersDatatable/columns/ip.tsx
new file mode 100644
index 0000000..728bd44
--- /dev/null
+++ b/app/react/docker/containers/ListView/ContainersDatatable/columns/ip.tsx
@@ -0,0 +1,6 @@
+import { columnHelper } from './helper';
+
+export const ip = columnHelper.accessor((row) => row.IP || '-', {
+  header: 'IP Address',
+  id: 'ip',
+});
diff --git a/app/react/docker/containers/ListView/ContainersDatatable/columns/name.tsx b/app/react/docker/containers/ListView/ContainersDatatable/columns/name.tsx
new file mode 100644
index 0000000..bb4263a
--- /dev/null
+++ b/app/react/docker/containers/ListView/ContainersDatatable/columns/name.tsx
@@ -0,0 +1,43 @@
+import { CellContext } from '@tanstack/react-table';
+import _ from 'lodash';
+import { useSref } from '@uirouter/react';
+
+import type { ContainerListViewModel } from '@/react/docker/containers/types';
+
+import { useTableSettings } from '@@/datatables/useTableSettings';
+
+import { TableSettings } from '../types';
+
+import { columnHelper } from './helper';
+
+export const name = columnHelper.accessor((row) => row.Names[0], {
+  header: 'Name',
+  id: 'name',
+  cell: NameCell,
+});
+
+export function NameCell({
+  getValue,
+  row: { original: container },
+}: CellContext<ContainerListViewModel, string>) {
+  const name = getValue();
+
+  const linkProps = useSref('.container', {
+    id: container.Id,
+    nodeName: container.NodeName,
+  });
+
+  const settings = useTableSettings<TableSettings>();
+  const truncate = settings.truncateContainerName;
+
+  let shortName = name;
+  if (truncate > 0) {
+    shortName = _.truncate(name, { length: truncate });
+  }
+
+  return (
+    <a href={linkProps.href} onClick={linkProps.onClick} title={name}>
+      {shortName}
+    </a>
+  );
+}
diff --git a/app/react/docker/containers/ListView/ContainersDatatable/columns/ports.tsx b/app/react/docker/containers/ListView/ContainersDatatable/columns/ports.tsx
new file mode 100644
index 0000000..4e11517
--- /dev/null
+++ b/app/react/docker/containers/ListView/ContainersDatatable/columns/ports.tsx
@@ -0,0 +1,72 @@
+import _ from 'lodash';
+import { CellContext } from '@tanstack/react-table';
+
+import { PublishedPortLink } from '@/react/docker/components/ImageStatus/PublishedPortLink';
+import type { ContainerListViewModel } from '@/react/docker/containers/types';
+
+import { Badge } from '@@/Badge';
+import { TooltipWithChildren } from '@@/Tip/TooltipWithChildren';
+
+import { useRowContext } from '../RowContext';
+
+import { columnHelper } from './helper';
+
+const MAX_VISIBLE_PORTS = 3;
+
+export const ports = columnHelper.accessor(
+  (row) =>
+    _.uniqBy(row.Ports, 'public')
+      .map((port) => `${port.public}:${port.private}`)
+      .join(','),
+  {
+    header: 'Published Ports',
+    id: 'ports',
+    cell: Cell,
+  }
+);
+
+function Cell({ row }: CellContext<ContainerListViewModel, string>) {
+  const ports = _.uniqBy(row.original.Ports, 'public');
+
+  const { environment } = useRowContext();
+
+  if (ports.length === 0) {
+    return '-';
+  }
+
+  const visiblePorts = ports.slice(0, MAX_VISIBLE_PORTS);
+  const hiddenPorts = ports.slice(MAX_VISIBLE_PORTS);
+
+  return (
+    <div className="flex flex-wrap items-center gap-1">
+      {visiblePorts.map((port) => (
+        <PublishedPortLink
+          key={`${port.host}:${port.public}`}
+          hostPort={port.public}
+          containerPort={port.private}
+          hostURL={environment.PublicURL || port.host}
+        />
+      ))}
+      {hiddenPorts.length > 0 && (
+        <TooltipWithChildren
+          message={
+            <div className="flex flex-wrap gap-1">
+              {hiddenPorts.map((port) => (
+                <PublishedPortLink
+                  key={`${port.host}:${port.public}`}
+                  hostPort={port.public}
+                  containerPort={port.private}
+                  hostURL={environment.PublicURL || port.host}
+                />
+              ))}
+            </div>
+          }
+        >
+          <Badge type="muted" size="sm">
+            +{hiddenPorts.length} more
+          </Badge>
+        </TooltipWithChildren>
+      )}
+    </div>
+  );
+}
diff --git a/app/react/docker/containers/ListView/ContainersDatatable/columns/quick-actions.tsx b/app/react/docker/containers/ListView/ContainersDatatable/columns/quick-actions.tsx
new file mode 100644
index 0000000..429ec26
--- /dev/null
+++ b/app/react/docker/containers/ListView/ContainersDatatable/columns/quick-actions.tsx
@@ -0,0 +1,62 @@
+import { CellContext } from '@tanstack/react-table';
+
+import { useAuthorizations } from '@/react/hooks/useUser';
+import { ContainerQuickActions } from '@/react/docker/containers/components/ContainerQuickActions';
+import { ContainerListViewModel } from '@/react/docker/containers/types';
+
+import { useTableSettings } from '@@/datatables/useTableSettings';
+
+import { TableSettings } from '../types';
+
+import { columnHelper } from './helper';
+
+export const quickActions = columnHelper.display({
+  header: 'Quick Actions',
+  id: 'actions',
+  cell: QuickActionsCell,
+});
+
+function QuickActionsCell({
+  row: { original: container },
+}: CellContext<ContainerListViewModel, unknown>) {
+  const settings = useTableSettings<TableSettings>();
+
+  const { hiddenQuickActions = [] } = settings;
+
+  const wrapperState = {
+    showQuickActionAttach: !hiddenQuickActions.includes('attach'),
+    showQuickActionExec: !hiddenQuickActions.includes('exec'),
+    showQuickActionInspect: !hiddenQuickActions.includes('inspect'),
+    showQuickActionLogs: !hiddenQuickActions.includes('logs'),
+    showQuickActionStats: !hiddenQuickActions.includes('stats'),
+  };
+
+  const someOn =
+    wrapperState.showQuickActionAttach ||
+    wrapperState.showQuickActionExec ||
+    wrapperState.showQuickActionInspect ||
+    wrapperState.showQuickActionLogs ||
+    wrapperState.showQuickActionStats;
+
+  const { authorized } = useAuthorizations([
+    'DockerContainerStats',
+    'DockerContainerLogs',
+    'DockerExecStart',
+    'DockerContainerInspect',
+    'DockerTaskInspect',
+    'DockerTaskLogs',
+  ]);
+
+  if (!someOn || !authorized) {
+    return null;
+  }
+
+  return (
+    <ContainerQuickActions
+      containerId={container.Id}
+      nodeName={container.NodeName}
+      status={container.Status}
+      state={wrapperState}
+    />
+  );
+}
diff --git a/app/react/docker/containers/ListView/ContainersDatatable/columns/stack.tsx b/app/react/docker/containers/ListView/ContainersDatatable/columns/stack.tsx
new file mode 100644
index 0000000..bd327e5
--- /dev/null
+++ b/app/react/docker/containers/ListView/ContainersDatatable/columns/stack.tsx
@@ -0,0 +1,6 @@
+import { columnHelper } from './helper';
+
+export const stack = columnHelper.accessor((row) => row.StackName || '-', {
+  header: 'Stack',
+  id: 'stack',
+});
diff --git a/app/react/docker/containers/ListView/ContainersDatatable/columns/state.tsx b/app/react/docker/containers/ListView/ContainersDatatable/columns/state.tsx
new file mode 100644
index 0000000..267a9dc
--- /dev/null
+++ b/app/react/docker/containers/ListView/ContainersDatatable/columns/state.tsx
@@ -0,0 +1,83 @@
+import clsx from 'clsx';
+import { CellContext } from '@tanstack/react-table';
+
+import {
+  type ContainerListViewModel,
+  ContainerStatus,
+} from '@/react/docker/containers/types';
+
+import { filterHOC } from '@@/datatables/Filter';
+import { multiple } from '@@/datatables/filter-types';
+
+import { columnHelper } from './helper';
+
+export const state = columnHelper.accessor('Status', {
+  header: 'State',
+  id: 'state',
+  cell: StatusCell,
+  enableColumnFilter: true,
+  filterFn: multiple,
+  meta: {
+    filter: filterHOC('Filter by state'),
+  },
+});
+
+function StatusCell({
+  getValue,
+  row: { original: container },
+}: CellContext<ContainerListViewModel, ContainerStatus>) {
+  const status = getValue();
+
+  const hasHealthCheck = [
+    ContainerStatus.Starting,
+    ContainerStatus.Healthy,
+    ContainerStatus.Unhealthy,
+  ].includes(status);
+
+  const statusClassName = getClassName();
+
+  let transformedStatus: ContainerStatus | string = status;
+  if (transformedStatus === ContainerStatus.Exited) {
+    transformedStatus = `${transformedStatus} - code ${extractExitCode(
+      container.StatusText
+    )}`;
+  }
+
+  return (
+    <span
+      className={clsx('label', `label-${statusClassName}`, {
+        interactive: hasHealthCheck,
+      })}
+      title={hasHealthCheck ? 'This container has a health check' : ''}
+    >
+      {transformedStatus}
+    </span>
+  );
+
+  function getClassName() {
+    switch (status) {
+      case ContainerStatus.Paused:
+      case ContainerStatus.Starting:
+      case ContainerStatus.Unhealthy:
+      case ContainerStatus.Restarting:
+      case ContainerStatus.Removing:
+        return 'warning';
+      case ContainerStatus.Created:
+        return 'info';
+      case ContainerStatus.Stopped:
+      case ContainerStatus.Dead:
+      case ContainerStatus.Exited:
+        return 'danger';
+      case ContainerStatus.Healthy:
+      case ContainerStatus.Running:
+      default:
+        return 'success';
+    }
+  }
+
+  function extractExitCode(statusText: string) {
+    const regex = /\((\d+)\)/;
+    const match = statusText.match(regex);
+    return match ? match[1] : '';
+  }
+}
diff --git a/app/react/docker/containers/ListView/ContainersDatatable/datatable-store.ts b/app/react/docker/containers/ListView/ContainersDatatable/datatable-store.ts
new file mode 100644
index 0000000..3c48776
--- /dev/null
+++ b/app/react/docker/containers/ListView/ContainersDatatable/datatable-store.ts
@@ -0,0 +1,28 @@
+import {
+  refreshableSettings,
+  hiddenColumnsSettings,
+  createPersistedStore,
+  filteredColumnsSettings,
+} from '@@/datatables/types';
+
+import { QuickAction, TableSettings } from './types';
+
+export const TRUNCATE_LENGTH = 32;
+
+export function createStore(storageKey: string) {
+  return createPersistedStore<TableSettings>(storageKey, 'name', (set) => ({
+    ...hiddenColumnsSettings(set),
+    ...refreshableSettings(set),
+    ...filteredColumnsSettings(set),
+    truncateContainerName: TRUNCATE_LENGTH,
+    setTruncateContainerName(truncateContainerName: number) {
+      set({
+        truncateContainerName,
+      });
+    },
+
+    hiddenQuickActions: [] as QuickAction[],
+    setHiddenQuickActions: (hiddenQuickActions: QuickAction[]) =>
+      set({ hiddenQuickActions }),
+  }));
+}
diff --git a/app/react/docker/containers/ListView/ContainersDatatable/index.ts b/app/react/docker/containers/ListView/ContainersDatatable/index.ts
new file mode 100644
index 0000000..7b416d8
--- /dev/null
+++ b/app/react/docker/containers/ListView/ContainersDatatable/index.ts
@@ -0,0 +1 @@
+export { ContainersDatatable } from './ContainersDatatable';
diff --git a/app/react/docker/containers/ListView/ContainersDatatable/types.ts b/app/react/docker/containers/ListView/ContainersDatatable/types.ts
new file mode 100644
index 0000000..8ea405d
--- /dev/null
+++ b/app/react/docker/containers/ListView/ContainersDatatable/types.ts
@@ -0,0 +1,24 @@
+import {
+  BasicTableSettings,
+  FilteredColumnsTableSettings,
+  RefreshableTableSettings,
+  SettableColumnsTableSettings,
+} from '@@/datatables/types';
+
+export type QuickAction = 'attach' | 'exec' | 'inspect' | 'logs' | 'stats';
+
+export interface SettableQuickActionsTableSettings<TAction> {
+  hiddenQuickActions: TAction[];
+  setHiddenQuickActions: (hiddenQuickActions: TAction[]) => void;
+}
+
+export interface TableSettings
+  extends
+    BasicTableSettings,
+    SettableColumnsTableSettings,
+    SettableQuickActionsTableSettings<QuickAction>,
+    RefreshableTableSettings,
+    FilteredColumnsTableSettings {
+  truncateContainerName: number;
+  setTruncateContainerName: (value: number) => void;
+}
diff --git a/app/react/docker/containers/ListView/ListView.tsx b/app/react/docker/containers/ListView/ListView.tsx
new file mode 100644
index 0000000..cef7fca
--- /dev/null
+++ b/app/react/docker/containers/ListView/ListView.tsx
@@ -0,0 +1,36 @@
+import { useInfo } from '@/react/docker/proxy/queries/useInfo';
+import { Environment } from '@/react/portainer/environments/types';
+import { isAgentEnvironment } from '@/react/portainer/environments/utils';
+
+import { PageHeader } from '@@/PageHeader';
+
+import { ContainersDatatable } from './ContainersDatatable';
+
+interface Props {
+  endpoint: Environment;
+}
+
+export function ListView({ endpoint: environment }: Props) {
+  const isAgent = isAgentEnvironment(environment.Type);
+
+  const envInfoQuery = useInfo(environment.Id, {
+    select: (info) => !!info.Swarm?.NodeID,
+  });
+
+  const isSwarmManager = !!envInfoQuery.data;
+  const isHostColumnVisible = isAgent && isSwarmManager;
+  return (
+    <>
+      <PageHeader
+        title="Container list"
+        breadcrumbs={[{ label: 'Containers' }]}
+        reload
+      />
+
+      <ContainersDatatable
+        isHostColumnVisible={isHostColumnVisible}
+        environment={environment}
+      />
+    </>
+  );
+}
diff --git a/app/react/docker/containers/ListView/index.ts b/app/react/docker/containers/ListView/index.ts
new file mode 100644
index 0000000..dd06dfd
--- /dev/null
+++ b/app/react/docker/containers/ListView/index.ts
@@ -0,0 +1 @@
+export { ListView } from './ListView';
diff --git a/app/react/docker/containers/LogView/LogView.tsx b/app/react/docker/containers/LogView/LogView.tsx
new file mode 100644
index 0000000..2509cd8
--- /dev/null
+++ b/app/react/docker/containers/LogView/LogView.tsx
@@ -0,0 +1,58 @@
+import { useCurrentStateAndParams } from '@uirouter/react';
+
+import { useContainer } from '@/react/docker/containers/queries/useContainer';
+import { ContainerDetailsViewModel } from '@/docker/models/containerDetails';
+
+import { InformationPanel } from '@@/InformationPanel';
+import { TextTip } from '@@/Tip/TextTip';
+import { Link } from '@@/Link';
+
+export function LogView() {
+  const {
+    params: { endpointId: environmentId, id: containerId, nodeName },
+  } = useCurrentStateAndParams();
+
+  const containerQuery = useContainer(
+    { environmentId, containerId, nodeName },
+    {
+      select: (c) => new ContainerDetailsViewModel(c),
+    }
+  );
+  if (!containerQuery.data || containerQuery.isLoading) {
+    return null;
+  }
+
+  const logsEnabled =
+    containerQuery.data.HostConfig?.LogConfig?.Type && // if a portion of the object path doesn't exist, logging is likely disabled
+    containerQuery.data.HostConfig.LogConfig.Type !== 'none'; // if type === none logging is disabled
+
+  return <>{!logsEnabled && <LogsDisabledInfoPanel />}</>;
+}
+
+function LogsDisabledInfoPanel() {
+  const {
+    params: { id: containerId, nodeName },
+  } = useCurrentStateAndParams();
+
+  return (
+    <div className="row">
+      <div className="col-sm-12">
+        <InformationPanel>
+          <TextTip color="blue">
+            Logging is disabled for this container. If you want to re-enable
+            logging, please{' '}
+            <Link
+              to="docker.containers.new"
+              params={{ from: containerId, nodeName }}
+              data-cy="redeploy-container-link"
+            >
+              redeploy your container
+            </Link>{' '}
+            and select a logging driver in the &quot;Command & logging&quot;
+            panel.
+          </TextTip>
+        </InformationPanel>
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/docker/containers/LogView/index.ts b/app/react/docker/containers/LogView/index.ts
new file mode 100644
index 0000000..3f807de
--- /dev/null
+++ b/app/react/docker/containers/LogView/index.ts
@@ -0,0 +1 @@
+export { LogView } from './LogView';
diff --git a/app/react/docker/containers/StatsView/ProcessesDatatable.tsx b/app/react/docker/containers/StatsView/ProcessesDatatable.tsx
new file mode 100644
index 0000000..e4892bb
--- /dev/null
+++ b/app/react/docker/containers/StatsView/ProcessesDatatable.tsx
@@ -0,0 +1,83 @@
+import { ColumnDef } from '@tanstack/react-table';
+import { List } from 'lucide-react';
+import { useCurrentStateAndParams } from '@uirouter/react';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+
+import { Datatable } from '@@/datatables';
+import { createPersistedStore } from '@@/datatables/types';
+import { useTableState } from '@@/datatables/useTableState';
+
+import { useContainerTop } from '../queries/useContainerTop';
+import { ContainerProcesses } from '../queries/types';
+
+const tableKey = 'container-processes';
+const store = createPersistedStore(tableKey);
+
+type ProcessRow = {
+  id: number;
+};
+
+type ProcessesDatatableProps = {
+  rows: Array<ProcessRow>;
+  columns: Array<ColumnDef<ProcessRow>>;
+};
+
+export function ProcessesDatatable() {
+  const {
+    params: { id: containerId },
+  } = useCurrentStateAndParams();
+  const environmentId = useEnvironmentId();
+  const topQuery = useContainerTop(
+    environmentId,
+    containerId,
+    (containerProcesses: ContainerProcesses) =>
+      parseContainerProcesses(containerProcesses)
+  );
+  const tableState = useTableState(store, tableKey);
+
+  return (
+    <Datatable
+      title="Processes"
+      titleIcon={List}
+      dataset={topQuery.data?.rows ?? []}
+      columns={topQuery.data?.columns ?? []}
+      settingsManager={tableState}
+      disableSelect
+      isLoading={topQuery.isLoading}
+      data-cy="docker-container-stats-processes-datatable"
+    />
+  );
+}
+
+// transform the data from the API into the format expected by the datatable
+function parseContainerProcesses(
+  containerProcesses: ContainerProcesses
+): ProcessesDatatableProps {
+  const { Processes: processes, Titles: titles } = containerProcesses;
+  const rows = processes?.map((row, index) => {
+    // docker has the row data as an array of many strings
+    // podman has the row data as an array with a single string separated by one or many spaces
+    const processArray = row.length === 1 ? row[0].split(/\s+/) : row;
+    return {
+      id: index,
+      ...Object.fromEntries(
+        titles.map((header, index) => [header, processArray[index]])
+      ),
+    };
+  });
+
+  const columns = titles
+    ? titles.map(
+        (header) =>
+          ({ header, accessorKey: header }) satisfies ColumnDef<{
+            [k: string]: string;
+          }>
+      )
+    : [];
+
+  return {
+    rows,
+    columns,
+  };
+}
diff --git a/app/react/docker/containers/common/confirm-container-delete-modal.ts b/app/react/docker/containers/common/confirm-container-delete-modal.ts
new file mode 100644
index 0000000..588c274
--- /dev/null
+++ b/app/react/docker/containers/common/confirm-container-delete-modal.ts
@@ -0,0 +1,17 @@
+import { ModalType } from '@@/modals';
+import { openSwitchPrompt } from '@@/modals/SwitchPrompt';
+import { buildConfirmButton } from '@@/modals/utils';
+
+export async function confirmContainerDeletion(title: string) {
+  const result = await openSwitchPrompt(
+    title,
+    'Automatically remove non-persistent volumes',
+    {
+      confirmButton: buildConfirmButton('Remove', 'danger'),
+      modalType: ModalType.Destructive,
+      'data-cy': 'confirm-container-delete-button',
+    }
+  );
+
+  return result ? { removeVolumes: result.value } : undefined;
+}
diff --git a/app/react/docker/containers/components/ContainerQuickActions/ContainerQuickActions.module.css b/app/react/docker/containers/components/ContainerQuickActions/ContainerQuickActions.module.css
new file mode 100644
index 0000000..dfc0a60
--- /dev/null
+++ b/app/react/docker/containers/components/ContainerQuickActions/ContainerQuickActions.module.css
@@ -0,0 +1,3 @@
+.root {
+  display: inline-flex;
+}
diff --git a/app/react/docker/containers/components/ContainerQuickActions/ContainerQuickActions.tsx b/app/react/docker/containers/components/ContainerQuickActions/ContainerQuickActions.tsx
new file mode 100644
index 0000000..fe2da97
--- /dev/null
+++ b/app/react/docker/containers/components/ContainerQuickActions/ContainerQuickActions.tsx
@@ -0,0 +1,108 @@
+import clsx from 'clsx';
+import { BarChart, FileText, Info, Paperclip, Terminal } from 'lucide-react';
+
+import { ContainerStatus } from '@/react/docker/containers/types';
+import { Authorized } from '@/react/hooks/useUser';
+
+import { Icon } from '@@/Icon';
+import { Link } from '@@/Link';
+
+import styles from './ContainerQuickActions.module.css';
+
+export interface QuickActionsState {
+  showQuickActionAttach: boolean;
+  showQuickActionExec: boolean;
+  showQuickActionInspect: boolean;
+  showQuickActionLogs: boolean;
+  showQuickActionStats: boolean;
+}
+
+export function ContainerQuickActions({
+  status,
+  containerId,
+  nodeName,
+  state,
+}: {
+  containerId: string;
+  nodeName: string;
+  status: ContainerStatus;
+  state: QuickActionsState;
+}) {
+  const isActive =
+    !!status &&
+    [
+      ContainerStatus.Starting,
+      ContainerStatus.Running,
+      ContainerStatus.Healthy,
+      ContainerStatus.Unhealthy,
+    ].includes(status);
+
+  return (
+    <div className={clsx('space-x-1', styles.root)}>
+      {state.showQuickActionLogs && (
+        <Authorized authorizations="DockerContainerLogs">
+          <Link
+            to="docker.containers.container.logs"
+            params={{ id: containerId, nodeName }}
+            title="Logs"
+            data-cy={`container-logs-${containerId}`}
+          >
+            <Icon icon={FileText} className="space-right" />
+          </Link>
+        </Authorized>
+      )}
+
+      {state.showQuickActionInspect && (
+        <Authorized authorizations="DockerContainerInspect">
+          <Link
+            to="docker.containers.container.inspect"
+            params={{ id: containerId, nodeName }}
+            title="Inspect"
+            data-cy={`container-inspect-${containerId}`}
+          >
+            <Icon icon={Info} className="space-right" />
+          </Link>
+        </Authorized>
+      )}
+
+      {state.showQuickActionStats && isActive && (
+        <Authorized authorizations="DockerContainerStats">
+          <Link
+            to="docker.containers.container.stats"
+            params={{ id: containerId, nodeName }}
+            title="Stats"
+            data-cy={`container-stats-${containerId}`}
+          >
+            <Icon icon={BarChart} className="space-right" />
+          </Link>
+        </Authorized>
+      )}
+
+      {state.showQuickActionExec && isActive && (
+        <Authorized authorizations="DockerExecStart">
+          <Link
+            to="docker.containers.container.exec"
+            params={{ id: containerId, nodeName }}
+            title="Exec Console"
+            data-cy={`container-exec-${containerId}`}
+          >
+            <Icon icon={Terminal} className="space-right" />
+          </Link>
+        </Authorized>
+      )}
+
+      {state.showQuickActionAttach && isActive && (
+        <Authorized authorizations="DockerContainerAttach">
+          <Link
+            to="docker.containers.container.attach"
+            params={{ id: containerId, nodeName }}
+            title="Attach Console"
+            data-cy={`container-attach-${containerId}`}
+          >
+            <Icon icon={Paperclip} className="space-right" />
+          </Link>
+        </Authorized>
+      )}
+    </div>
+  );
+}
diff --git a/app/react/docker/containers/components/ContainerQuickActions/index.ts b/app/react/docker/containers/components/ContainerQuickActions/index.ts
new file mode 100644
index 0000000..48c0d85
--- /dev/null
+++ b/app/react/docker/containers/components/ContainerQuickActions/index.ts
@@ -0,0 +1 @@
+export { ContainerQuickActions } from './ContainerQuickActions';
diff --git a/app/react/docker/containers/components/NetworkSelector.tsx b/app/react/docker/containers/components/NetworkSelector.tsx
new file mode 100644
index 0000000..4eba400
--- /dev/null
+++ b/app/react/docker/containers/components/NetworkSelector.tsx
@@ -0,0 +1,81 @@
+import { useMemo } from 'react';
+
+import { useNetworks } from '@/react/docker/networks/queries/useNetworks';
+import { DockerNetwork } from '@/react/docker/networks/types';
+import { useIsSwarm } from '@/react/docker/proxy/queries/useInfo';
+import { useApiVersion } from '@/react/docker/proxy/queries/useVersion';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useIsPodman } from '@/react/portainer/environments/queries/useIsPodman';
+
+import { Option, PortainerSelect } from '@@/form-components/PortainerSelect';
+
+export function NetworkSelector({
+  onChange,
+  additionalOptions = [],
+  value,
+  hiddenNetworks = [],
+}: {
+  value: string;
+  additionalOptions?: Array<Option<string>>;
+  onChange: (value: string) => void;
+  hiddenNetworks?: string[];
+}) {
+  const envId = useEnvironmentId();
+  const isPodman = useIsPodman(envId);
+  const networksQuery = useNetworksForSelector({
+    select(networks) {
+      return networks.map((n) => {
+        // The name of the 'bridge' network is 'podman' in Podman
+        if (n.Name === 'bridge' && isPodman) {
+          return { label: 'podman', value: 'podman' };
+        }
+        return { label: n.Name, value: n.Name };
+      });
+    },
+  });
+
+  const networks = networksQuery.data;
+
+  const options = useMemo(
+    () =>
+      (networks || [])
+        .concat(additionalOptions)
+        .filter((n) => !hiddenNetworks.includes(n.value))
+        .sort((a, b) => a.label.localeCompare(b.label)),
+    [additionalOptions, hiddenNetworks, networks]
+  );
+
+  return (
+    <PortainerSelect
+      value={value}
+      onChange={onChange}
+      options={options}
+      isLoading={networksQuery.isLoading}
+      bindToBody
+      placeholder="Select a network"
+      data-cy="docker-network-selector"
+    />
+  );
+}
+
+export function useNetworksForSelector<T = DockerNetwork[]>({
+  select,
+}: {
+  select?(networks: Array<DockerNetwork>): T;
+} = {}) {
+  const environmentId = useEnvironmentId();
+
+  const isSwarmQuery = useIsSwarm(environmentId);
+  const dockerApiVersion = useApiVersion(environmentId);
+
+  return useNetworks(
+    environmentId,
+    {
+      local: true,
+      swarmAttachable: isSwarmQuery && dockerApiVersion >= 1.25,
+    },
+    {
+      select,
+    }
+  );
+}
diff --git a/app/react/docker/containers/containers.service.ts b/app/react/docker/containers/containers.service.ts
new file mode 100644
index 0000000..c485ec8
--- /dev/null
+++ b/app/react/docker/containers/containers.service.ts
@@ -0,0 +1,192 @@
+import _ from 'lodash';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import PortainerError from '@/portainer/error';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { withAgentTargetHeader } from '../proxy/queries/utils';
+import { buildDockerProxyUrl } from '../proxy/queries/buildDockerProxyUrl';
+import { buildDockerUrl } from '../queries/utils/buildDockerUrl';
+
+import { ContainerId, ContainerLogsParams } from './types';
+
+export async function startContainer(
+  environmentId: EnvironmentId,
+  id: ContainerId,
+  { nodeName }: { nodeName?: string } = {}
+) {
+  try {
+    await axios.post<void>(
+      buildDockerProxyUrl(environmentId, 'containers', id, 'start'),
+      {},
+      {
+        headers: { ...withAgentTargetHeader(nodeName) },
+      }
+    );
+  } catch (e) {
+    throw parseAxiosError(e, 'Failed starting container');
+  }
+}
+
+export async function stopContainer(
+  endpointId: EnvironmentId,
+  id: ContainerId,
+  { nodeName }: { nodeName?: string } = {}
+) {
+  try {
+    await axios.post<void>(
+      buildDockerProxyUrl(endpointId, 'containers', id, 'stop'),
+      {},
+      { headers: { ...withAgentTargetHeader(nodeName) } }
+    );
+  } catch (e) {
+    throw parseAxiosError(e, 'Failed stopping container');
+  }
+}
+
+export async function recreateContainer(
+  endpointId: EnvironmentId,
+  id: ContainerId,
+  pullImage: boolean,
+  { nodeName }: { nodeName?: string } = {}
+) {
+  try {
+    await axios.post<void>(
+      buildDockerUrl(endpointId, 'containers', id, 'recreate'),
+      {
+        PullImage: pullImage,
+      },
+      { headers: { ...withAgentTargetHeader(nodeName) } }
+    );
+  } catch (e) {
+    throw parseAxiosError(e, 'Failed recreating container');
+  }
+}
+
+export async function restartContainer(
+  endpointId: EnvironmentId,
+  id: ContainerId,
+  { nodeName }: { nodeName?: string } = {}
+) {
+  try {
+    await axios.post<void>(
+      buildDockerProxyUrl(endpointId, 'containers', id, 'restart'),
+      {},
+      { headers: { ...withAgentTargetHeader(nodeName) } }
+    );
+  } catch (e) {
+    throw parseAxiosError(e, 'Failed restarting container');
+  }
+}
+
+export async function killContainer(
+  endpointId: EnvironmentId,
+  id: ContainerId,
+  { nodeName }: { nodeName?: string } = {}
+) {
+  try {
+    await axios.post<void>(
+      buildDockerProxyUrl(endpointId, 'containers', id, 'kill'),
+      {},
+      { headers: { ...withAgentTargetHeader(nodeName) } }
+    );
+  } catch (e) {
+    throw parseAxiosError(e, 'Failed killing container');
+  }
+}
+
+export async function pauseContainer(
+  endpointId: EnvironmentId,
+  id: ContainerId,
+  { nodeName }: { nodeName?: string } = {}
+) {
+  try {
+    await axios.post<void>(
+      buildDockerProxyUrl(endpointId, 'containers', id, 'pause'),
+      {},
+      { headers: { ...withAgentTargetHeader(nodeName) } }
+    );
+  } catch (e) {
+    throw parseAxiosError(e, 'Failed pausing container');
+  }
+}
+
+export async function resumeContainer(
+  endpointId: EnvironmentId,
+  id: ContainerId,
+  { nodeName }: { nodeName?: string } = {}
+) {
+  try {
+    await axios.post<void>(
+      buildDockerProxyUrl(endpointId, 'containers', id, 'unpause'),
+      {},
+      { headers: { ...withAgentTargetHeader(nodeName) } }
+    );
+  } catch (e) {
+    throw parseAxiosError(e, 'Failed resuming container');
+  }
+}
+
+export async function renameContainer(
+  endpointId: EnvironmentId,
+  id: ContainerId,
+  name: string,
+  { nodeName }: { nodeName?: string } = {}
+) {
+  try {
+    await axios.post<void>(
+      buildDockerProxyUrl(endpointId, 'containers', id, 'rename'),
+      {},
+      {
+        params: { name },
+        headers: { ...withAgentTargetHeader(nodeName) },
+      }
+    );
+  } catch (e) {
+    throw parseAxiosError(e, 'Failed renaming container');
+  }
+}
+
+export async function removeContainer(
+  endpointId: EnvironmentId,
+  containerId: string,
+  {
+    nodeName,
+    removeVolumes,
+  }: { removeVolumes?: boolean; nodeName?: string } = {}
+) {
+  try {
+    const { data } = await axios.delete<null | { message: string }>(
+      buildDockerProxyUrl(endpointId, 'containers', containerId),
+      {
+        params: { v: removeVolumes ? 1 : 0, force: true },
+        headers: { ...withAgentTargetHeader(nodeName) },
+      }
+    );
+
+    if (data && data.message) {
+      throw new PortainerError(data.message);
+    }
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to remove container');
+  }
+}
+
+export async function getContainerLogs(
+  environmentId: EnvironmentId,
+  containerId: ContainerId,
+  params?: ContainerLogsParams
+): Promise<string> {
+  try {
+    const { data } = await axios.get<string>(
+      buildDockerProxyUrl(environmentId, 'containers', containerId, 'logs'),
+      {
+        params: _.pickBy(params),
+      }
+    );
+
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to get container logs');
+  }
+}
diff --git a/app/react/docker/containers/queries/gpus.tsx b/app/react/docker/containers/queries/gpus.tsx
new file mode 100644
index 0000000..603e63d
--- /dev/null
+++ b/app/react/docker/containers/queries/gpus.tsx
@@ -0,0 +1,29 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { queryKeys } from './query-keys';
+
+async function getContainerGpus(
+  environmentId: EnvironmentId,
+  containerId: string
+) {
+  try {
+    const { data } = await axios.get<{ gpus: string }>(
+      `/docker/${environmentId}/containers/${containerId}/gpus`
+    );
+    return data.gpus;
+  } catch (err) {
+    throw parseAxiosError(err as Error);
+  }
+}
+
+export function useContainerGpus(
+  environmentId: EnvironmentId,
+  containerId: string
+) {
+  return useQuery(queryKeys.gpus(environmentId, containerId), () =>
+    getContainerGpus(environmentId, containerId)
+  );
+}
diff --git a/app/react/docker/containers/queries/query-keys.ts b/app/react/docker/containers/queries/query-keys.ts
new file mode 100644
index 0000000..30661cd
--- /dev/null
+++ b/app/react/docker/containers/queries/query-keys.ts
@@ -0,0 +1,24 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { queryKeys as dockerQueryKeys } from '../../queries/utils';
+
+import { Filters } from './types';
+
+export const queryKeys = {
+  list: (environmentId: EnvironmentId) =>
+    [...dockerQueryKeys.root(environmentId), 'containers'] as const,
+
+  filters: (
+    environmentId: EnvironmentId,
+    params: { all?: boolean; filters?: Filters; nodeName?: string } = {}
+  ) => [...queryKeys.list(environmentId), params] as const,
+
+  container: (environmentId: EnvironmentId, id: string) =>
+    [...queryKeys.list(environmentId), id] as const,
+
+  gpus: (environmentId: EnvironmentId, id: string) =>
+    [...queryKeys.container(environmentId, id), 'gpus'] as const,
+
+  top: (environmentId: EnvironmentId, id: string) =>
+    [...queryKeys.container(environmentId, id), 'top'] as const,
+};
diff --git a/app/react/docker/containers/queries/types.ts b/app/react/docker/containers/queries/types.ts
new file mode 100644
index 0000000..681da47
--- /dev/null
+++ b/app/react/docker/containers/queries/types.ts
@@ -0,0 +1,14 @@
+import { NetworkId } from '../../networks/types';
+import { ContainerStatus } from '../types';
+
+export interface Filters {
+  label?: string[];
+  name?: string[];
+  network?: NetworkId[];
+  status?: ContainerStatus[];
+}
+
+export type ContainerProcesses = {
+  Processes: Array<Array<string>>;
+  Titles: Array<string>;
+};
diff --git a/app/react/docker/containers/queries/useContainer.ts b/app/react/docker/containers/queries/useContainer.ts
new file mode 100644
index 0000000..798af4a
--- /dev/null
+++ b/app/react/docker/containers/queries/useContainer.ts
@@ -0,0 +1,139 @@
+import { useQuery } from '@tanstack/react-query';
+import {
+  ContainerConfig,
+  ContainerState,
+  DriverData,
+  HostConfig,
+  MountPoint,
+  NetworkSettings,
+} from 'docker-types';
+
+import { PortainerResponse } from '@/react/docker/types';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { ContainerId } from '@/react/docker/containers/types';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { queryClient, withError } from '@/react-tools/react-query';
+
+import { buildDockerProxyUrl } from '../../proxy/queries/buildDockerProxyUrl';
+import { withAgentTargetHeader } from '../../proxy/queries/utils';
+
+import { queryKeys } from './query-keys';
+
+/**
+ * Raw Docker Container Details response
+ */
+export interface ContainerDetailsJSON {
+  /**
+   * The ID of the container
+   */
+  Id?: string;
+  /**
+   * The time the container was created
+   */
+  Created?: string;
+  /**
+   * The path to the command being run
+   */
+  Path?: string;
+  /**
+   * The arguments to the command being run
+   */
+  Args?: Array<string>;
+  State?: ContainerState;
+  /**
+   * The container's image ID
+   */
+  Image?: string;
+  ResolvConfPath?: string;
+  HostnamePath?: string;
+  HostsPath?: string;
+  LogPath?: string;
+  Name?: string;
+  RestartCount?: number;
+  Driver?: string;
+  Platform?: string;
+  MountLabel?: string;
+  ProcessLabel?: string;
+  AppArmorProfile?: string;
+  /**
+   * IDs of exec instances that are running in the container.
+   */
+  ExecIDs?: Array<string> | null;
+  HostConfig?: HostConfig;
+  GraphDriver?: DriverData;
+  /**
+   * The size of files that have been created or changed by this
+   * container.
+   *
+   */
+  SizeRw?: number;
+  /**
+   * The total size of all the files in this container.
+   */
+  SizeRootFs?: number;
+  Mounts?: Array<MountPoint>;
+  Config?: ContainerConfig;
+  NetworkSettings?: NetworkSettings;
+}
+
+export function useContainer<T>(
+  {
+    environmentId,
+    containerId,
+    nodeName,
+  }: {
+    environmentId: EnvironmentId;
+    containerId?: ContainerId;
+    nodeName?: string;
+  },
+  {
+    enabled,
+    select,
+  }: { enabled?: boolean; select?(container: ContainerDetailsResponse): T } = {}
+) {
+  return useQuery({
+    queryKey: queryKeys.container(environmentId, containerId!),
+    queryFn: () => getContainer(environmentId, containerId!, { nodeName }),
+    enabled: enabled && !!containerId,
+    select,
+    ...withError('Unable to retrieve container'),
+  });
+}
+
+export function invalidateContainer(
+  environmentId: EnvironmentId,
+  containerId?: ContainerId
+) {
+  return queryClient.invalidateQueries(
+    containerId ? queryKeys.container(environmentId, containerId) : []
+  );
+}
+
+export type ContainerDetailsResponse = PortainerResponse<ContainerDetailsJSON>;
+
+/**
+ * Raw docker API proxy
+ * @param environmentId
+ * @param id
+ * @param param2
+ * @returns
+ */
+export async function getContainer(
+  environmentId: EnvironmentId,
+  id: ContainerId,
+  { nodeName }: { nodeName?: string } = {}
+) {
+  try {
+    const { data } = await axios.get<ContainerDetailsResponse>(
+      buildDockerProxyUrl(environmentId, 'containers', id, 'json'),
+      {
+        headers: {
+          ...withAgentTargetHeader(nodeName),
+        },
+      }
+    );
+    return data;
+  } catch (error) {
+    throw parseAxiosError(error as Error, 'Unable to retrieve container');
+  }
+}
diff --git a/app/react/docker/containers/queries/useContainerInspect.ts b/app/react/docker/containers/queries/useContainerInspect.ts
new file mode 100644
index 0000000..a4e8633
--- /dev/null
+++ b/app/react/docker/containers/queries/useContainerInspect.ts
@@ -0,0 +1,38 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { ContainerId } from '../types';
+import { withAgentTargetHeader } from '../../proxy/queries/utils';
+import { buildDockerProxyUrl } from '../../proxy/queries/buildDockerProxyUrl';
+
+import { queryKeys } from './query-keys';
+import { ContainerDetailsJSON } from './useContainer';
+
+export function useContainerInspect(
+  environmentId: EnvironmentId,
+  id: ContainerId,
+  params: { nodeName?: string } = {}
+) {
+  return useQuery({
+    queryKey: [...queryKeys.container(environmentId, id), params] as const,
+    queryFn: () => inspectContainer(environmentId, id, params),
+  });
+}
+
+export async function inspectContainer(
+  environmentId: EnvironmentId,
+  id: ContainerId,
+  { nodeName }: { nodeName?: string } = {}
+) {
+  try {
+    const { data } = await axios.get<ContainerDetailsJSON>(
+      buildDockerProxyUrl(environmentId, 'containers', id, 'json'),
+      { headers: { ...withAgentTargetHeader(nodeName) } }
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e, 'Failed inspecting container');
+  }
+}
diff --git a/app/react/docker/containers/queries/useContainerResizeTTYMutation.ts b/app/react/docker/containers/queries/useContainerResizeTTYMutation.ts
new file mode 100644
index 0000000..6ba9036
--- /dev/null
+++ b/app/react/docker/containers/queries/useContainerResizeTTYMutation.ts
@@ -0,0 +1,27 @@
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { buildDockerProxyUrl } from '../../proxy/queries/buildDockerProxyUrl';
+
+/**
+ * Raw docker API proxy
+ * @param environmentId
+ * @param id exec instance id
+ */
+export async function resizeTTY(
+  environmentId: EnvironmentId,
+  id: string,
+  { width, height }: { width: number; height: number }
+) {
+  try {
+    await axios.post(
+      buildDockerProxyUrl(environmentId, 'containers', id, 'resize'),
+      {},
+      {
+        params: { h: height, w: width },
+      }
+    );
+  } catch (err) {
+    throw parseAxiosError(err, 'Unable to resize tty of container');
+  }
+}
diff --git a/app/react/docker/containers/queries/useContainerStats.ts b/app/react/docker/containers/queries/useContainerStats.ts
new file mode 100644
index 0000000..eb1bac0
--- /dev/null
+++ b/app/react/docker/containers/queries/useContainerStats.ts
@@ -0,0 +1,136 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { buildDockerProxyUrl } from '../../proxy/queries/buildDockerProxyUrl';
+import { ContainerId } from '../types';
+
+/**
+ * This type is arbitrary and only defined based on what we use / observed from the API responses.
+ */
+export type ContainerStats = {
+  name?: string;
+  id?: string;
+  read?: string;
+  preread?: string;
+  pids_stats?: {
+    current?: number;
+    limit?: number;
+  };
+  memory_stats?: MemoryStats;
+  num_procs?: number;
+  precpu_stats?: CpuStats;
+  cpu_stats?: CpuStats;
+  networks?: Record<string, NetworkStats>;
+  blkio_stats?: BlkioStats;
+  storage_stats?: unknown;
+};
+
+/**
+ * Raw docker API proxy
+ * @param environmentId
+ * @param id
+ * @returns
+ */
+export async function containerStats(
+  environmentId: EnvironmentId,
+  id: ContainerId
+) {
+  try {
+    const { data } = await axios.get(
+      buildDockerProxyUrl(environmentId, 'containers', id, 'stats'),
+      { params: { stream: false } }
+    );
+    return data;
+  } catch (err) {
+    throw parseAxiosError(err, 'Unable to retrieve container stats');
+  }
+}
+
+type BlkioStats = {
+  io_service_bytes_recursive?: {
+    major: number;
+    minor: number;
+    op: string;
+    value: number;
+  }[];
+  io_serviced_recursive?: null;
+  io_queue_recursive?: null;
+  io_service_time_recursive?: null;
+  io_wait_time_recursive?: null;
+  io_merged_recursive?: null;
+  io_time_recursive?: null;
+  sectors_recursive?: null;
+};
+
+type NetworkStats = {
+  rx_bytes?: number;
+  rx_packets?: number;
+  rx_errors?: number;
+  rx_dropped?: number;
+  tx_bytes?: number;
+  tx_packets?: number;
+  tx_errors?: number;
+  tx_dropped?: number;
+};
+
+type MemoryStats = {
+  privateworkingset?: number;
+  usage?: number;
+  stats?: MemoryStatsStats;
+  limit?: number;
+};
+
+type MemoryStatsStats = {
+  active_anon?: number;
+  active_file?: number;
+  anon?: number;
+  anon_thp?: number;
+  cache?: number;
+  file?: number;
+  file_dirty?: number;
+  file_mapped?: number;
+  file_writeback?: number;
+  inactive_anon?: number;
+  inactive_file?: number;
+  kernel_stack?: number;
+  pgactivate?: number;
+  pgdeactivate?: number;
+  pgfault?: number;
+  pglazyfree?: number;
+  pglazyfreed?: number;
+  pgmajfault?: number;
+  pgrefill?: number;
+  pgscan?: number;
+  pgsteal?: number;
+  shmem?: number;
+  slab?: number;
+  slab_reclaimable?: number;
+  slab_unreclaimable?: number;
+  sock?: number;
+  thp_collapse_alloc?: number;
+  thp_fault_alloc?: number;
+  unevictable?: number;
+  workingset_activate?: number;
+  workingset_nodereclaim?: number;
+  workingset_refault?: number;
+};
+
+type CpuUsage = {
+  total_usage?: number;
+  usage_in_kernelmode?: number;
+  usage_in_usermode?: number;
+  percpu_usage?: number[];
+};
+
+type ThrottlingData = {
+  periods?: number;
+  throttled_periods?: number;
+  throttled_time?: number;
+};
+
+type CpuStats = {
+  cpu_usage?: CpuUsage;
+  system_cpu_usage?: number;
+  online_cpus?: number;
+  throttling_data?: ThrottlingData;
+};
diff --git a/app/react/docker/containers/queries/useContainerTop.ts b/app/react/docker/containers/queries/useContainerTop.ts
new file mode 100644
index 0000000..45cfab4
--- /dev/null
+++ b/app/react/docker/containers/queries/useContainerTop.ts
@@ -0,0 +1,44 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { ContainerId } from '../types';
+import { buildDockerProxyUrl } from '../../proxy/queries/buildDockerProxyUrl';
+
+import { queryKeys } from './query-keys';
+import { ContainerProcesses } from './types';
+
+export function useContainerTop<T = ContainerProcesses>(
+  environmentId: EnvironmentId,
+  id: ContainerId,
+  select?: (environment: ContainerProcesses) => T
+) {
+  // many containers don't allow this call, so fail early, and omit withError to silently fail
+  return useQuery({
+    queryKey: queryKeys.top(environmentId, id),
+    queryFn: () => getContainerTop(environmentId, id),
+    retry: false,
+    select,
+  });
+}
+
+/**
+ * Raw docker API proxy
+ * @param environmentId
+ * @param id
+ * @returns
+ */
+export async function getContainerTop(
+  environmentId: EnvironmentId,
+  id: ContainerId
+) {
+  try {
+    const { data } = await axios.get<ContainerProcesses>(
+      buildDockerProxyUrl(environmentId, 'containers', id, 'top')
+    );
+    return data;
+  } catch (err) {
+    throw parseAxiosError(err, 'Unable to retrieve container top');
+  }
+}
diff --git a/app/react/docker/containers/queries/useContainers.ts b/app/react/docker/containers/queries/useContainers.ts
new file mode 100644
index 0000000..c62b75c
--- /dev/null
+++ b/app/react/docker/containers/queries/useContainers.ts
@@ -0,0 +1,76 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+
+import { DockerContainerResponse } from '../types/response';
+import { toListViewModel } from '../utils';
+import { ContainerListViewModel } from '../types';
+import { buildDockerProxyUrl } from '../../proxy/queries/buildDockerProxyUrl';
+import {
+  withFiltersQueryParam,
+  withAgentTargetHeader,
+} from '../../proxy/queries/utils';
+
+import { Filters } from './types';
+import { queryKeys } from './query-keys';
+
+interface UseContainers {
+  all?: boolean;
+  filters?: Filters;
+  nodeName?: string;
+}
+
+export function useContainers<T = ContainerListViewModel[]>(
+  environmentId: EnvironmentId | undefined,
+  {
+    autoRefreshRate,
+    select,
+    enabled,
+    ...params
+  }: UseContainers & {
+    autoRefreshRate?: number;
+    select?: (data: ContainerListViewModel[]) => T;
+    enabled?: boolean;
+  } = {}
+) {
+  return useQuery(
+    queryKeys.filters(environmentId!, params),
+    () => getContainers(environmentId!, params),
+    {
+      ...withError('Unable to retrieve containers'),
+      refetchInterval: autoRefreshRate ?? false,
+      select,
+      enabled: enabled && !!environmentId,
+    }
+  );
+}
+
+/**
+ * Fetch containers and transform to ContainerListViewModel
+ * @param environmentId
+ * @param param1
+ * @returns ContainerListViewModel[]
+ */
+export async function getContainers(
+  environmentId: EnvironmentId,
+  { all = true, filters, nodeName }: UseContainers = {}
+) {
+  try {
+    if (!environmentId) {
+      return [];
+    }
+
+    const { data } = await axios.get<DockerContainerResponse[]>(
+      buildDockerProxyUrl(environmentId, 'containers', 'json'),
+      {
+        params: { all, ...withFiltersQueryParam(filters) },
+        headers: { ...withAgentTargetHeader(nodeName) },
+      }
+    );
+    return data.map((c) => toListViewModel(c));
+  } catch (error) {
+    throw parseAxiosError(error as Error, 'Unable to retrieve containers');
+  }
+}
diff --git a/app/react/docker/containers/queries/useCreateExecMutation.ts b/app/react/docker/containers/queries/useCreateExecMutation.ts
new file mode 100644
index 0000000..f733301
--- /dev/null
+++ b/app/react/docker/containers/queries/useCreateExecMutation.ts
@@ -0,0 +1,33 @@
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { buildDockerProxyUrl } from '../../proxy/queries/buildDockerProxyUrl';
+import { ContainerId } from '../types';
+
+type ExecConfig = {
+  AttachStdin: boolean; // Attach to stdin of the exec command.
+  AttachStdout: boolean; // Attach to stdout of the exec command.
+  AttachStderr: boolean; // Attach to stderr of the exec command.
+  DetachKeys: string; // Override the key sequence for detaching a container. Format is a single character [a-Z] or ctrl-<value> where <value> is one of: a-z, @, ^, [, , or _.
+  Tty: boolean; // Allocate a pseudo-TTY.
+  Env: string[]; // A list of environment variables in the form ["VAR=value", ...].
+  Cmd: string[]; // Command to run, as a string or array of strings.
+  Privileged: boolean; // Default: false - Runs the exec process with extended privileges.
+  User: string; // The user, and optionally, group to run the exec process inside the container. Format is one of: user, user:group, uid, or uid:gid.
+  WorkingDir: string; // The working directory for the exec process inside the container.
+};
+export async function createExec(
+  environmentId: EnvironmentId,
+  id: ContainerId,
+  config: ExecConfig
+) {
+  try {
+    const { data } = await axios.post<{ Id: string }>(
+      buildDockerProxyUrl(environmentId, 'containers', id, 'exec'),
+      config
+    );
+    return data;
+  } catch (err) {
+    throw parseAxiosError(err, 'Unable to create exec');
+  }
+}
diff --git a/app/react/docker/containers/queries/useRenameContainer.ts b/app/react/docker/containers/queries/useRenameContainer.ts
new file mode 100644
index 0000000..d596fb9
--- /dev/null
+++ b/app/react/docker/containers/queries/useRenameContainer.ts
@@ -0,0 +1,24 @@
+import { useMutation } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { ContainerId } from '@/react/docker/containers/types';
+import { renameContainer } from '@/react/docker/containers/containers.service';
+import { withError } from '@/react-tools/react-query';
+
+export function useRenameContainer() {
+  return useMutation({
+    mutationFn: ({
+      containerId,
+      environmentId,
+      name,
+      nodeName,
+    }: {
+      containerId: ContainerId;
+      environmentId: EnvironmentId;
+      name: string;
+      nodeName?: string;
+    }) => renameContainer(environmentId, containerId, name, { nodeName }),
+
+    ...withError('Failed to rename container'),
+  });
+}
diff --git a/app/react/docker/containers/queries/useUpdateContainer.ts b/app/react/docker/containers/queries/useUpdateContainer.ts
new file mode 100644
index 0000000..5b94111
--- /dev/null
+++ b/app/react/docker/containers/queries/useUpdateContainer.ts
@@ -0,0 +1,36 @@
+import { Resources, RestartPolicy } from 'docker-types';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { withAgentTargetHeader } from '../../proxy/queries/utils';
+import { buildDockerProxyUrl } from '../../proxy/queries/buildDockerProxyUrl';
+
+/**
+ * UpdateConfig holds the mutable attributes of a Container.
+ * Those attributes can be updated at runtime.
+ */
+interface UpdateConfig extends Resources {
+  // Contains container's resources (cgroups, ulimits)
+  RestartPolicy?: RestartPolicy;
+}
+
+/**
+ * Raw docker API proxy
+ */
+export async function updateContainer(
+  environmentId: EnvironmentId,
+  containerId: string,
+  config: UpdateConfig,
+  { nodeName }: { nodeName?: string } = {}
+) {
+  try {
+    await axios.post<{ Warnings: string[] }>(
+      buildDockerProxyUrl(environmentId, 'containers', containerId, 'update'),
+      config,
+      { headers: { ...withAgentTargetHeader(nodeName) } }
+    );
+  } catch (err) {
+    throw parseAxiosError(err, 'failed updating container');
+  }
+}
diff --git a/app/react/docker/containers/types.ts b/app/react/docker/containers/types.ts
new file mode 100644
index 0000000..1a74047
--- /dev/null
+++ b/app/react/docker/containers/types.ts
@@ -0,0 +1,59 @@
+import { ResourceControlViewModel } from '@/react/portainer/access-control/models/ResourceControlViewModel';
+
+import { DockerContainerResponse } from './types/response';
+
+export enum ContainerStatus {
+  Paused = 'paused',
+  Stopped = 'stopped',
+  Created = 'created',
+  Healthy = 'healthy',
+  Unhealthy = 'unhealthy',
+  Starting = 'starting',
+  Running = 'running',
+  Dead = 'dead',
+  Exited = 'exited',
+  Restarting = 'restarting',
+  Removing = 'removing',
+}
+
+export type QuickAction = 'attach' | 'exec' | 'inspect' | 'logs' | 'stats';
+
+export interface Port {
+  host?: string;
+  public: number;
+  private: number;
+}
+
+export type ContainerId = string;
+
+/**
+ * Computed fields from Container List Raw data
+ */
+type DecoratedDockerContainer = {
+  NodeName: string;
+  ResourceControl?: ResourceControlViewModel;
+  IP: string;
+  StackName?: string;
+  Status: ContainerStatus;
+  Ports: Port[];
+  StatusText: string;
+  Gpus: string;
+};
+
+/**
+ * Docker Container list ViewModel
+ *
+ * Alias AngularJS ContainerViewModel
+ *
+ * Raw details is ContainerDetailsJSON
+ */
+export type ContainerListViewModel = DecoratedDockerContainer &
+  Omit<DockerContainerResponse, keyof DecoratedDockerContainer>;
+
+export type ContainerLogsParams = {
+  stdout?: boolean;
+  stderr?: boolean;
+  timestamps?: boolean;
+  since?: number;
+  tail?: number;
+};
diff --git a/app/react/docker/containers/types/response.ts b/app/react/docker/containers/types/response.ts
new file mode 100644
index 0000000..e442eb7
--- /dev/null
+++ b/app/react/docker/containers/types/response.ts
@@ -0,0 +1,29 @@
+import { ContainerSummary } from 'docker-types';
+
+import { PortainerResponse } from '@/react/docker/types';
+import { WithRequiredProperties } from '@/types';
+
+export type SummaryNetworkSettings = NonNullable<
+  ContainerSummary['NetworkSettings']
+>;
+
+/**
+ * Raw container list response item
+ */
+export type DockerContainerResponse = PortainerResponse<
+  WithRequiredProperties<
+    ContainerSummary,
+    | 'Id'
+    | 'Names'
+    | 'Image'
+    | 'ImageID'
+    | 'Command'
+    | 'Created'
+    | 'Ports'
+    | 'Labels'
+    | 'State'
+    | 'Status'
+    | 'HostConfig'
+    | 'Mounts'
+  >
+>;
diff --git a/app/react/docker/containers/utils.test.ts b/app/react/docker/containers/utils.test.ts
new file mode 100644
index 0000000..040a528
--- /dev/null
+++ b/app/react/docker/containers/utils.test.ts
@@ -0,0 +1,174 @@
+import { describe, it, expect } from 'vitest';
+
+import { toListViewModel } from './utils';
+import { DockerContainerResponse } from './types/response';
+
+describe('toListViewModel', () => {
+  function createMockResponse(
+    overrides: Partial<DockerContainerResponse> = {}
+  ): DockerContainerResponse {
+    return {
+      Id: 'container123',
+      Names: ['/test-container'],
+      Image: 'nginx:latest',
+      ImageID: 'sha256:abc123',
+      Command: 'nginx -g daemon off;',
+      Created: 1234567890,
+      State: 'running',
+      Status: 'Up 2 hours',
+      Ports: [],
+      Labels: {},
+      SizeRw: 0,
+      SizeRootFs: 0,
+      HostConfig: { NetworkMode: 'bridge' },
+      NetworkSettings: { Networks: {} },
+      Mounts: [],
+      ...overrides,
+    };
+  }
+
+  describe('Names field handling', () => {
+    it('should remove leading slash from container names', () => {
+      const response = createMockResponse({
+        Names: ['/container1', '/container2'],
+      });
+
+      const result = toListViewModel(response);
+
+      expect(result.Names).toEqual(['container1', 'container2']);
+    });
+
+    it('should keep names without leading slash unchanged', () => {
+      const response = createMockResponse({
+        Names: ['container1', 'container2'],
+      });
+
+      const result = toListViewModel(response);
+
+      expect(result.Names).toEqual(['container1', 'container2']);
+    });
+
+    it('should handle mixed names with and without leading slashes', () => {
+      const response = createMockResponse({
+        Names: ['/container1', 'container2', '/container3'],
+      });
+
+      const result = toListViewModel(response);
+
+      expect(result.Names).toEqual(['container1', 'container2', 'container3']);
+    });
+
+    it('should handle empty string names', () => {
+      const response = createMockResponse({
+        Names: [''],
+      });
+
+      const result = toListViewModel(response);
+
+      expect(result.Names).toEqual(['']);
+    });
+
+    it('should handle names that are only a slash', () => {
+      const response = createMockResponse({
+        Names: ['/'],
+      });
+
+      const result = toListViewModel(response);
+
+      expect(result.Names).toEqual(['']);
+    });
+
+    it('should return default empty name when Names is undefined', () => {
+      const response = createMockResponse({
+        Names: undefined,
+      });
+
+      const result = toListViewModel(response);
+
+      expect(result.Names).toEqual(['<empty_name>']);
+    });
+
+    it('should return default empty name when Names is empty array', () => {
+      const response = createMockResponse({
+        Names: [],
+      });
+
+      const result = toListViewModel(response);
+
+      expect(result.Names).toEqual(['<empty_name>']);
+    });
+
+    it('should handle names with multiple leading slashes', () => {
+      const response = createMockResponse({
+        Names: ['//container1', '///container2'],
+      });
+
+      const result = toListViewModel(response);
+
+      // Note: The function only removes the first character if it's a slash
+      expect(result.Names).toEqual(['/container1', '//container2']);
+    });
+
+    it('should handle names with slashes in the middle', () => {
+      const response = createMockResponse({
+        Names: ['/container/name', 'another/container'],
+      });
+
+      const result = toListViewModel(response);
+
+      expect(result.Names).toEqual(['container/name', 'another/container']);
+    });
+  });
+
+  describe('Full integration tests', () => {
+    it('should transform complete response correctly', () => {
+      const response = createMockResponse({
+        Names: ['/my-container'],
+        Status: 'Up 5 minutes',
+        Labels: {
+          'com.docker.compose.project': 'my-stack',
+        },
+        NetworkSettings: {
+          Networks: {
+            bridge: {
+              IPAddress: '172.17.0.2',
+              Gateway: '172.17.0.1',
+            },
+          },
+        },
+        Ports: [
+          {
+            IP: '0.0.0.0',
+            PrivatePort: 80,
+            PublicPort: 8080,
+            Type: 'tcp',
+          },
+        ],
+        Portainer: {
+          ResourceControl: {
+            Id: 1,
+            ResourceId: 'container123',
+            Type: 1,
+            AdministratorsOnly: false,
+            Public: false,
+            System: false,
+            TeamAccesses: [],
+            UserAccesses: [],
+          },
+          Agent: {
+            NodeName: 'node1',
+          },
+        },
+      });
+
+      const result = toListViewModel(response);
+
+      expect(result.Names).toEqual(['my-container']);
+      expect(result.IP).toBe('172.17.0.2');
+      expect(result.StackName).toBe('my-stack');
+      expect(result.NodeName).toBe('node1');
+      expect(result.Ports).toHaveLength(1);
+      expect(result.StatusText).toBe('Up 5 minutes');
+    });
+  });
+});
diff --git a/app/react/docker/containers/utils.ts b/app/react/docker/containers/utils.ts
new file mode 100644
index 0000000..5990d18
--- /dev/null
+++ b/app/react/docker/containers/utils.ts
@@ -0,0 +1,107 @@
+import _ from 'lodash';
+
+import { ResourceControlViewModel } from '@/react/portainer/access-control/models/ResourceControlViewModel';
+import { useIsStandalone } from '@/react/docker/proxy/queries/useInfo';
+import { Environment } from '@/react/portainer/environments/types';
+
+import { ContainerListViewModel, ContainerStatus } from './types';
+import { DockerContainerResponse } from './types/response';
+
+/**
+ * Transform an item of the raw docker container list reponse to a container list view model
+ * @param response Raw docker container list reponse item
+ * @returns ContainerListViewModel
+ */
+export function toListViewModel(
+  response: DockerContainerResponse
+): ContainerListViewModel {
+  const resourceControl =
+    response.Portainer?.ResourceControl &&
+    new ResourceControlViewModel(response?.Portainer?.ResourceControl);
+  const nodeName = response.Portainer?.Agent?.NodeName || '';
+
+  const ip =
+    Object.values(response?.NetworkSettings?.Networks || {})[0]?.IPAddress ||
+    '';
+
+  const labels = response.Labels || {};
+  const stackName =
+    labels['com.docker.compose.project'] ||
+    labels['com.docker.stack.namespace'];
+
+  const status = createStatus(response.State, response.Status);
+
+  const ports = _.compact(
+    response.Ports?.map(
+      (p) =>
+        p.PublicPort && {
+          host: p.IP,
+          private: p.PrivatePort,
+          public: p.PublicPort,
+        }
+    )
+  );
+
+  let names = response.Names?.map((n) => {
+    const nameWithoutSlash = n[0] === '/' ? n.slice(1) : n;
+    return nameWithoutSlash;
+  });
+
+  if (!names || names.length === 0) {
+    names = ['<empty_name>'];
+  }
+
+  return {
+    ...response,
+    ResourceControl: resourceControl,
+    Names: names,
+    NodeName: nodeName,
+    IP: ip,
+    StackName: stackName,
+    Status: status,
+    Ports: ports,
+    StatusText: response.Status,
+    Gpus: '',
+  };
+}
+
+function createStatus(state = '', statusText = ''): ContainerStatus {
+  const statusLower = statusText.toLowerCase();
+
+  // Health check status is only present in the human-readable Status field, not in State
+  if (statusLower.includes('(healthy)')) {
+    return ContainerStatus.Healthy;
+  }
+
+  if (statusLower.includes('(unhealthy)')) {
+    return ContainerStatus.Unhealthy;
+  }
+
+  if (statusLower.includes('(health: starting)')) {
+    return ContainerStatus.Starting;
+  }
+
+  // Use the standardized State field for all other states
+  switch (state.toLowerCase()) {
+    case ContainerStatus.Paused:
+      return ContainerStatus.Paused;
+    case ContainerStatus.Dead:
+      return ContainerStatus.Dead;
+    case ContainerStatus.Created:
+      return ContainerStatus.Created;
+    case ContainerStatus.Exited:
+      return ContainerStatus.Exited;
+    case ContainerStatus.Restarting:
+      return ContainerStatus.Restarting;
+    case ContainerStatus.Removing:
+      return ContainerStatus.Removing;
+    default:
+      return ContainerStatus.Running;
+  }
+}
+
+export function useShowGPUsColumn(environment: Environment | undefined) {
+  const isDockerStandalone = useIsStandalone(environment?.Id);
+  const enableGPUManagement = !!environment?.EnableGPUManagement;
+  return isDockerStandalone && enableGPUManagement;
+}
diff --git a/app/react/docker/events/EventsDatatables.tsx b/app/react/docker/events/EventsDatatables.tsx
new file mode 100644
index 0000000..c13b164
--- /dev/null
+++ b/app/react/docker/events/EventsDatatables.tsx
@@ -0,0 +1,56 @@
+import { createColumnHelper } from '@tanstack/react-table';
+import { Clock } from 'lucide-react';
+import { EventMessage } from 'docker-types';
+
+import { isoDateFromTimestamp } from '@/portainer/filters/filters';
+
+import { Datatable } from '@@/datatables';
+import { createPersistedStore } from '@@/datatables/types';
+import { useTableState } from '@@/datatables/useTableState';
+
+import { createEventDetails } from './model';
+
+const columnHelper = createColumnHelper<EventMessage>();
+
+export const columns = [
+  columnHelper.accessor('time', {
+    header: 'Date',
+    cell: ({ getValue }) => {
+      const value = getValue();
+      return isoDateFromTimestamp(value);
+    },
+  }),
+  columnHelper.accessor((c) => c.Type, {
+    header: 'Type',
+  }),
+  columnHelper.accessor((c) => createEventDetails(c), {
+    header: 'Details',
+  }),
+];
+
+const tableKey = 'docker-events';
+const settingsStore = createPersistedStore(tableKey, {
+  id: 'Time',
+  desc: true,
+});
+
+export function EventsDatatable({
+  dataset,
+}: {
+  dataset?: Array<EventMessage>;
+}) {
+  const tableState = useTableState(settingsStore, tableKey);
+
+  return (
+    <Datatable
+      dataset={dataset ?? []}
+      isLoading={!dataset}
+      columns={columns}
+      settingsManager={tableState}
+      title="Events"
+      titleIcon={Clock}
+      disableSelect
+      data-cy="docker-events-datatable"
+    />
+  );
+}
diff --git a/app/react/docker/events/ListView.tsx b/app/react/docker/events/ListView.tsx
new file mode 100644
index 0000000..1a4637f
--- /dev/null
+++ b/app/react/docker/events/ListView.tsx
@@ -0,0 +1,33 @@
+import { useState } from 'react';
+import moment from 'moment';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+
+import { PageHeader } from '@@/PageHeader';
+
+import { useEvents } from '../proxy/queries/useEvents';
+
+import { EventsDatatable } from './EventsDatatables';
+
+export function ListView() {
+  const { since, until } = useDateRange();
+  const envId = useEnvironmentId();
+  const eventsQuery = useEvents(envId, { params: { since, until } });
+
+  return (
+    <>
+      <PageHeader title="Event list" breadcrumbs="Events" reload />
+
+      <EventsDatatable dataset={eventsQuery.data} />
+    </>
+  );
+}
+
+function useDateRange() {
+  return useState(() => {
+    const since = moment().subtract(24, 'hour').unix();
+    const until = moment().unix();
+
+    return { since, until };
+  })[0];
+}
diff --git a/app/react/docker/events/model.ts b/app/react/docker/events/model.ts
new file mode 100644
index 0000000..a8dcbb3
--- /dev/null
+++ b/app/react/docker/events/model.ts
@@ -0,0 +1,120 @@
+import { EventMessage } from 'docker-types';
+
+type EventType = NonNullable<EventMessage['Type']>;
+type Action = string;
+
+type Attributes = {
+  id: string;
+  name: string;
+  exitCode: string;
+};
+
+type EventToTemplateMap = Record<EventType, ActionToTemplateMap>;
+type ActionToTemplateMap = Record<Action, TemplateBuilder>;
+type TemplateBuilder = (attr: Attributes) => string;
+
+/**
+ * {
+ *  [EventType]: {
+ *    [Action]: TemplateBuilder,
+ *    [Action]: TemplateBuilder
+ *  },
+ *  [EventType]: {
+ *    [Action]: TemplateBuilder,
+ *  }
+ * }
+ *
+ * EventType are known and defined by Docker specs
+ * Action are unknown and specific for each EventType
+ */
+const templates: EventToTemplateMap = {
+  builder: {},
+  config: {},
+  container: {
+    stop: ({ name }) => `Container ${name} stopped`,
+    destroy: ({ name }) => `Container ${name} deleted`,
+    create: ({ name }) => `Container ${name} created`,
+    start: ({ name }) => `Container ${name} started`,
+    kill: ({ name }) => `Container ${name} killed`,
+    die: ({ name, exitCode }) =>
+      `Container ${name} exited with status code ${exitCode}`,
+    commit: ({ name }) => `Container ${name} committed`,
+    restart: ({ name }) => `Container ${name} restarted`,
+    pause: ({ name }) => `Container ${name} paused`,
+    unpause: ({ name }) => `Container ${name} unpaused`,
+    attach: ({ name }) => `Container ${name} attached`,
+    detach: ({ name }) => `Container ${name} detached`,
+    copy: ({ name }) => `Container ${name} copied`,
+    export: ({ name }) => `Container ${name} exported`,
+    health_status: ({ name }) => `Container ${name} executed health status`,
+    oom: ({ name }) => `Container ${name} goes in out of memory`,
+    rename: ({ name }) => `Container ${name} renamed`,
+    resize: ({ name }) => `Container ${name} resized`,
+    top: ({ name }) => `Showed running processes for container ${name}`,
+    update: ({ name }) => `Container ${name} updated`,
+    exec_create: () => `Exec instance created`,
+    exec_start: () => `Exec instance started`,
+    exec_die: () => `Exec instance exited`,
+  },
+  daemon: {},
+  image: {
+    delete: () => `Image deleted`,
+    import: ({ id }) => `Image ${id} imported`,
+    load: ({ id }) => `Image ${id} loaded`,
+    tag: ({ name }) => `New tag created for ${name}`,
+    untag: () => `Image untagged`,
+    save: ({ id }) => `Image ${id} saved`,
+    pull: ({ id }) => `Image ${id} pulled`,
+    push: ({ id }) => `Image ${id} pushed`,
+  },
+  network: {
+    create: ({ name }) => `Network ${name} created`,
+    destroy: ({ name }) => `Network ${name} deleted`,
+    remove: ({ name }) => `Network ${name} removed`,
+    connect: ({ name }) => `Container connected to ${name} network`,
+    disconnect: ({ name }) => `Container disconnected from ${name} network`,
+    prune: () => `Networks pruned`,
+  },
+  node: {},
+  plugin: {},
+  secret: {},
+  service: {},
+  volume: {
+    create: ({ id }) => `Volume ${id} created`,
+    destroy: ({ id }) => `Volume ${id} deleted`,
+    mount: ({ id }) => `Volume ${id} mounted`,
+    unmount: ({ id }) => `Volume ${id} unmounted`,
+  },
+};
+
+export function createEventDetails(event: EventMessage) {
+  const eventType = event.Type ?? '';
+
+  // An action can be `action:extra`
+  // For example `docker exec -it CONTAINER sh`
+  // Generates the action `exec_create: sh`
+  let extra = '';
+  let action = event.Action ?? '';
+  const hasColon = action?.indexOf(':') ?? -1;
+  if (hasColon !== -1) {
+    extra = action?.substring(hasColon) ?? '';
+    action = action?.substring(0, hasColon);
+  }
+
+  const attr: Attributes = {
+    id: event.Actor?.ID || '',
+    name: event.Actor?.Attributes?.name || '',
+    exitCode: event.Actor?.Attributes?.exitCode || '',
+  };
+
+  // Event types are defined by the docker API specs
+  // Each event has it own set of actions, which a unknown/not defined by specs
+  // If the received event or action has no builder associated to it
+  // We consider the event unsupported and we provide the raw data
+  const detailsBuilder = templates[eventType as EventType]?.[action];
+  const details = detailsBuilder
+    ? detailsBuilder(attr)
+    : `Unsupported event: ${eventType} / ${action}`;
+
+  return details + extra;
+}
diff --git a/app/react/docker/events/types.ts b/app/react/docker/events/types.ts
new file mode 100644
index 0000000..9d9cd92
--- /dev/null
+++ b/app/react/docker/events/types.ts
@@ -0,0 +1,5 @@
+export type DockerEvent = {
+  Time: number;
+  Type: string;
+  Details: string;
+};
diff --git a/app/react/docker/host/.keep b/app/react/docker/host/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/docker/host/BrowseView/.keep b/app/react/docker/host/BrowseView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/docker/host/BrowseView/AgentHostBrowser.tsx b/app/react/docker/host/BrowseView/AgentHostBrowser.tsx
new file mode 100644
index 0000000..d1c44b8
--- /dev/null
+++ b/app/react/docker/host/BrowseView/AgentHostBrowser.tsx
@@ -0,0 +1,50 @@
+import { ComponentProps } from 'react';
+
+import { FilesTable } from '@/react/docker/components/FilesTable';
+
+import { createPersistedStore } from '@@/datatables/types';
+import { useTableState } from '@@/datatables/useTableState';
+
+const tableKey = 'host-browser';
+
+const settingsStore = createPersistedStore(tableKey, {
+  desc: true,
+  id: 'Dir',
+});
+
+interface Props extends Omit<
+  ComponentProps<typeof FilesTable>,
+  'isUploadAllowed' | 'tableState' | 'title'
+> {
+  relativePath: string;
+}
+
+export function AgentHostBrowser({
+  relativePath,
+  dataset,
+  isRoot,
+  onBrowse,
+  onDelete,
+  onDownload,
+  onFileSelectedForUpload,
+  onGoToParent,
+  onRename,
+}: Props) {
+  const tableState = useTableState(settingsStore, tableKey);
+
+  return (
+    <FilesTable
+      tableState={tableState}
+      dataset={dataset}
+      title={`Host browser - ${relativePath}`}
+      isRoot={isRoot}
+      onRename={onRename}
+      onBrowse={onBrowse}
+      onDownload={onDownload}
+      onDelete={onDelete}
+      isUploadAllowed
+      onFileSelectedForUpload={onFileSelectedForUpload}
+      onGoToParent={onGoToParent}
+    />
+  );
+}
diff --git a/app/react/docker/host/DetailsView/.keep b/app/react/docker/host/DetailsView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/docker/host/DockerStorageInfo.test.tsx b/app/react/docker/host/DockerStorageInfo.test.tsx
new file mode 100644
index 0000000..d5735f8
--- /dev/null
+++ b/app/react/docker/host/DockerStorageInfo.test.tsx
@@ -0,0 +1,269 @@
+import { ReactNode } from 'react';
+import { render, screen } from '@testing-library/react';
+import { vi } from 'vitest';
+
+import { EnvironmentType } from '@/react/portainer/environments/types';
+import { useEnvironment } from '@/react/portainer/environments/queries';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+
+import { useDockerStorageUsageQuery } from '../queries/useDockerStorageUsageQuery';
+
+import { DockerStorageInfo } from './DockerStorageInfo';
+
+vi.mock('../queries/useDockerStorageUsageQuery', () => ({
+  useDockerStorageUsageQuery: vi.fn(),
+}));
+
+vi.mock('@/react/portainer/environments/queries', () => ({
+  useEnvironment: vi.fn(),
+}));
+
+// Tippy renders tooltip content in a portal which is not accessible without
+// user interaction in jsdom. Mock Tooltip to render its message inline so
+// tests can assert on the message text.
+vi.mock('@@/Tip/Tooltip/Tooltip', () => ({
+  Tooltip: ({ message }: { message: ReactNode }) => (
+    <span data-cy="tooltip">{message}</span>
+  ),
+}));
+
+const Wrapped = withTestQueryProvider(() => (
+  <DockerStorageInfo endpointId={1} />
+));
+
+function mockEnvironmentLoading() {
+  vi.mocked(useEnvironment).mockReturnValue({
+    isLoading: true,
+    isFetched: false,
+    data: undefined,
+    isError: false,
+  } as ReturnType<typeof useEnvironment>);
+}
+
+function mockEnvironmentReady(
+  agentVersion: string | undefined = '2.42.0',
+  envType = EnvironmentType.AgentOnDocker
+) {
+  vi.mocked(useEnvironment).mockReturnValue({
+    isLoading: false,
+    isFetched: true,
+    isError: false,
+    data: {
+      Type: envType,
+      Agent: { Version: agentVersion },
+    },
+  } as ReturnType<typeof useEnvironment>);
+}
+
+function mockEnvironmentNoData() {
+  vi.mocked(useEnvironment).mockReturnValue({
+    isLoading: false,
+    isFetched: true,
+    isError: false,
+    data: undefined,
+  } as ReturnType<typeof useEnvironment>);
+}
+
+function mockStorageLoading() {
+  vi.mocked(useDockerStorageUsageQuery).mockReturnValue({
+    isLoading: true,
+    isFetched: false,
+    isError: false,
+    data: undefined,
+  } as ReturnType<typeof useDockerStorageUsageQuery>);
+}
+
+function mockStorageIdle() {
+  vi.mocked(useDockerStorageUsageQuery).mockReturnValue({
+    isLoading: false,
+    isFetched: false,
+    isError: false,
+    data: undefined,
+  } as ReturnType<typeof useDockerStorageUsageQuery>);
+}
+
+function mockStorageError(message = 'connection refused') {
+  vi.mocked(useDockerStorageUsageQuery).mockReturnValue({
+    isLoading: false,
+    isFetched: true,
+    isError: true,
+    error: new Error(message),
+    data: undefined,
+  } as ReturnType<typeof useDockerStorageUsageQuery>);
+}
+
+function mockStorageNoData() {
+  vi.mocked(useDockerStorageUsageQuery).mockReturnValue({
+    isLoading: false,
+    isFetched: true,
+    isError: false,
+    data: undefined,
+  } as ReturnType<typeof useDockerStorageUsageQuery>);
+}
+
+const MOCK_STORAGE = {
+  rootDir: '/var/lib/docker',
+  totalBytes: 500_000_000,
+  dockerBytes: 100_000_000,
+  availableBytes: 300_000_000,
+  imageBytes: 60_000_000,
+  containerBytes: 20_000_000,
+  volumeBytes: 15_000_000,
+  buildCacheBytes: 5_000_000,
+};
+
+function mockStorageSuccess(data = MOCK_STORAGE) {
+  vi.mocked(useDockerStorageUsageQuery).mockReturnValue({
+    isLoading: false,
+    isFetched: true,
+    isError: false,
+    data,
+  } as ReturnType<typeof useDockerStorageUsageQuery>);
+}
+
+afterEach(() => {
+  vi.clearAllMocks();
+});
+
+describe('DockerStorageInfo', () => {
+  describe('loading state', () => {
+    it('shows loading text while environment is loading', () => {
+      mockEnvironmentLoading();
+      mockStorageIdle();
+
+      render(<Wrapped />);
+
+      expect(screen.getByText('Loading storage information...')).toBeVisible();
+    });
+
+    it('shows loading text while storage query is loading', () => {
+      mockEnvironmentReady();
+      mockStorageLoading();
+
+      render(<Wrapped />);
+
+      expect(screen.getByText('Loading storage information...')).toBeVisible();
+    });
+  });
+
+  describe('error state', () => {
+    it('shows "Not available" when storage query fails', () => {
+      mockEnvironmentReady();
+      mockStorageError('Unable to connect to agent');
+
+      render(<Wrapped />);
+
+      expect(screen.getByText('Not available')).toBeVisible();
+    });
+
+    it('displays the error message in the tooltip', () => {
+      mockEnvironmentReady();
+      mockStorageError('Unable to connect to agent');
+
+      render(<Wrapped />);
+
+      expect(
+        screen.getByText('Unable to connect to agent')
+      ).toBeInTheDocument();
+    });
+  });
+
+  describe('agent upgrade required', () => {
+    it('shows "Not available" when agent version is older than required', () => {
+      mockEnvironmentReady('2.39.0');
+      mockStorageIdle();
+
+      render(<Wrapped />);
+
+      expect(screen.getByText('Not available')).toBeVisible();
+    });
+
+    it('shows "Not available" when agent version is missing (pre-2.15 agent)', () => {
+      mockEnvironmentReady(undefined);
+      mockStorageIdle();
+
+      render(<Wrapped />);
+
+      expect(screen.getByText('Not available')).toBeVisible();
+    });
+
+    it('shows upgrade tooltip message', () => {
+      mockEnvironmentReady('2.39.0');
+      mockStorageError();
+
+      render(<Wrapped />);
+
+      expect(
+        screen.getByText(/Upgrade your agent to enable this feature/i)
+      ).toBeInTheDocument();
+    });
+  });
+
+  describe('storage unavailable (no data from agent)', () => {
+    it('shows "Not available" when agent returns 204 (totalBytes undefined)', () => {
+      mockEnvironmentReady();
+      mockStorageNoData();
+
+      render(<Wrapped />);
+
+      expect(screen.getByText('Not available')).toBeVisible();
+    });
+
+    it('shows Docker socket tooltip message', () => {
+      mockEnvironmentReady();
+      mockStorageNoData();
+
+      render(<Wrapped />);
+
+      expect(
+        screen.getByText(/Docker socket and host filesystem are accessible/i)
+      ).toBeInTheDocument();
+    });
+  });
+
+  describe('success state', () => {
+    it('renders the complete storage breakdown', () => {
+      mockEnvironmentReady();
+      mockStorageSuccess();
+
+      render(<Wrapped />);
+
+      // Legend items with humanized sizes
+      // Use exact match for Docker to avoid matching the partition path "/var/lib/docker"
+      expect(screen.getByText('Docker (100 MB)')).toBeVisible();
+      expect(screen.getByText(/Other/i)).toBeVisible();
+      expect(screen.getByText(/Free/i)).toBeVisible();
+
+      // Partition
+      expect(screen.getByText(/Partition:/i)).toBeVisible();
+      expect(screen.getByText('/var/lib/docker')).toBeVisible();
+
+      expect(screen.queryByText('Not available')).not.toBeInTheDocument();
+    });
+
+    it('shows Docker artifact breakdown in the tooltip', () => {
+      mockEnvironmentReady();
+      mockStorageSuccess();
+
+      render(<Wrapped />);
+
+      expect(screen.getByText('Images')).toBeInTheDocument();
+      expect(screen.getByText('Containers')).toBeInTheDocument();
+      expect(screen.getByText('Volumes')).toBeInTheDocument();
+      expect(screen.getByText('Build cache')).toBeInTheDocument();
+    });
+  });
+
+  describe('no environment data', () => {
+    it('shows "Not available" when environment data is missing after loading', () => {
+      mockEnvironmentNoData();
+      // When environment has no data, needsUpgrade will be true (no agentVersion),
+      // so dockerStorage query won't run. Simulate it returning no data.
+      mockStorageNoData();
+
+      render(<Wrapped />);
+
+      expect(screen.getByText('Not available')).toBeVisible();
+    });
+  });
+});
diff --git a/app/react/docker/host/DockerStorageInfo.tsx b/app/react/docker/host/DockerStorageInfo.tsx
new file mode 100644
index 0000000..12ef480
--- /dev/null
+++ b/app/react/docker/host/DockerStorageInfo.tsx
@@ -0,0 +1,171 @@
+import { isVersionSmaller } from '@/react/common/semver-utils';
+import { humanize } from '@/portainer/filters/filters';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { useEnvironment } from '@/react/portainer/environments/queries';
+import { getPlatformTypeName } from '@/react/portainer/environments/utils';
+
+import { ProgressBar } from '@@/ProgressBar';
+import { Tooltip } from '@@/Tip/Tooltip/Tooltip';
+import { InlineLoader } from '@@/InlineLoader/InlineLoader';
+
+import { useDockerStorageUsageQuery } from '../queries/useDockerStorageUsageQuery';
+
+const MIN_AGENT_VERSION = '2.42.0';
+
+export function DockerStorageInfo({
+  endpointId,
+}: {
+  endpointId: EnvironmentId;
+}) {
+  const environmentQuery = useEnvironment(endpointId);
+  const environment = environmentQuery.data;
+  const agentVersion = environment?.Agent.Version;
+
+  const dockerStorageUsageQuery = useDockerStorageUsageQuery(endpointId, {
+    enabled: !!environment,
+  });
+  const dockerStorageUsage = dockerStorageUsageQuery.data;
+
+  if (environmentQuery.isLoading || dockerStorageUsageQuery.isLoading) {
+    return <InlineLoader>Loading storage information...</InlineLoader>;
+  }
+
+  if (dockerStorageUsageQuery.isError) {
+    const errorMessage =
+      dockerStorageUsageQuery.error instanceof Error
+        ? dockerStorageUsageQuery.error.message
+        : 'Unknown error';
+
+    const needsUpgrade =
+      environmentQuery.isFetched &&
+      // Empty version means a pre-2.15 agent that doesn't report its version —
+      // definitely predates docker-storage support.
+      (!agentVersion || isVersionSmaller(agentVersion, MIN_AGENT_VERSION));
+    const minAgentVersionMessage = `Disk usage requires agent version ${MIN_AGENT_VERSION} or later. Upgrade your agent to enable this feature.`;
+
+    return (
+      <span className="flex items-center">
+        <span className="text-muted small">Not available</span>
+        <Tooltip
+          message={needsUpgrade ? minAgentVersionMessage : errorMessage}
+        />
+      </span>
+    );
+  }
+
+  if (!environment) {
+    return (
+      <span className="flex items-center">
+        <span className="text-muted small">Not available</span>
+        <Tooltip message="Unable to read environment information." />
+      </span>
+    );
+  }
+
+  const platformName = getPlatformTypeName(
+    environment.Type,
+    environment.ContainerEngine
+  );
+
+  if (dockerStorageUsage?.totalBytes === undefined) {
+    return (
+      <span className="flex items-center">
+        <span className="text-muted small">Not available</span>
+        <Tooltip
+          message={`The agent could not determine ${platformName} storage usage. Ensure the ${platformName} socket and host filesystem are accessible to the agent.`}
+        />
+      </span>
+    );
+  }
+
+  const dockerBytes = dockerStorageUsage.dockerBytes;
+  const otherBytes = Math.max(
+    0,
+    dockerStorageUsage.totalBytes -
+      dockerStorageUsage.availableBytes -
+      dockerBytes
+  );
+
+  return (
+    <>
+      <div className="flex items-center gap-2">
+        {/* The progress bar is purely visual — all data is in the text legend below */}
+        <div aria-hidden="true" className="flex-1">
+          <ProgressBar
+            steps={[
+              {
+                value: dockerBytes,
+                className: 'progress-bar !bg-blue-7',
+              },
+              {
+                value: otherBytes,
+                className: 'progress-bar !bg-warning-8',
+              },
+            ]}
+            total={dockerStorageUsage.totalBytes}
+            className="!w-full"
+          />
+        </div>
+        <span className="small text-muted shrink-0" aria-label="Total capacity">
+          {humanize(dockerStorageUsage.totalBytes)}
+        </span>
+      </div>
+      <div
+        className="flex flex-wrap justify-between gap-2"
+        role="list"
+        aria-label="Disk usage breakdown"
+      >
+        <div className="mt-1 flex flex-wrap gap-3 text-xs">
+          <span className="flex items-center gap-1" role="listitem">
+            <span
+              aria-hidden="true"
+              className="inline-block h-2 w-2 rounded-sm bg-blue-7"
+            />
+            <span>
+              {platformName} ({humanize(dockerBytes)})
+            </span>
+            <Tooltip
+              message={
+                <div className="flex flex-col gap-1 text-xs">
+                  <div className="flex justify-between gap-4">
+                    <span>Images</span>
+                    <span>{humanize(dockerStorageUsage.imageBytes)}</span>
+                  </div>
+                  <div className="flex justify-between gap-4">
+                    <span>Containers</span>
+                    <span>{humanize(dockerStorageUsage.containerBytes)}</span>
+                  </div>
+                  <div className="flex justify-between gap-4">
+                    <span>Volumes</span>
+                    <span>{humanize(dockerStorageUsage.volumeBytes)}</span>
+                  </div>
+                  <div className="flex justify-between gap-4">
+                    <span>Build cache</span>
+                    <span>{humanize(dockerStorageUsage.buildCacheBytes)}</span>
+                  </div>
+                </div>
+              }
+            />
+          </span>
+          <span className="flex items-center gap-1" role="listitem">
+            <span
+              aria-hidden="true"
+              className="inline-block h-2 w-2 rounded-sm bg-warning-8"
+            />
+            <span>Other ({humanize(otherBytes)})</span>
+          </span>
+          <span className="flex items-center gap-1" role="listitem">
+            <span
+              aria-hidden="true"
+              className="inline-block h-2 w-2 rounded-sm bg-gray-5"
+            />
+            <span>Free ({humanize(dockerStorageUsage.availableBytes)})</span>
+          </span>
+        </div>
+        <div className="text-muted mt-1 text-xs" role="listitem">
+          Partition: <code className="px-0">{dockerStorageUsage.rootDir}</code>
+        </div>
+      </div>
+    </>
+  );
+}
diff --git a/app/react/docker/host/HostDetailsPanel/HostDetailsPanel.test.tsx b/app/react/docker/host/HostDetailsPanel/HostDetailsPanel.test.tsx
new file mode 100644
index 0000000..59952bd
--- /dev/null
+++ b/app/react/docker/host/HostDetailsPanel/HostDetailsPanel.test.tsx
@@ -0,0 +1,144 @@
+import { ComponentProps } from 'react';
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { UIRouterContext, UIRouterReact } from '@uirouter/react';
+import { vi } from 'vitest';
+
+import { humanize } from '@/portainer/filters/filters';
+
+import { HostDetailsPanel } from './HostDetailsPanel';
+
+vi.mock('../DockerStorageInfo', () => ({
+  DockerStorageInfo: () => <span>storage-info</span>,
+}));
+
+const mockGo = vi.fn();
+const mockRouter = {
+  stateService: { go: mockGo },
+} as unknown as UIRouterReact;
+
+function renderPanel(
+  props: Partial<ComponentProps<typeof HostDetailsPanel>> = {}
+) {
+  const defaults = {
+    host: {
+      name: 'my-host',
+      totalCPU: 4,
+      totalMemory: 1073741824, // 1 GB
+    },
+    isBrowseEnabled: false,
+    browseUrl: 'docker.host.browse',
+  };
+
+  return render(
+    <UIRouterContext.Provider value={mockRouter}>
+      <HostDetailsPanel {...defaults} {...props} />
+    </UIRouterContext.Provider>
+  );
+}
+
+afterEach(() => {
+  vi.clearAllMocks();
+});
+
+describe('HostDetailsPanel', () => {
+  it('renders the "Host Details" heading', () => {
+    renderPanel();
+    expect(screen.getByRole('heading', { name: 'Host Details' })).toBeVisible();
+  });
+
+  it('renders an icon alongside the heading', () => {
+    const { container } = renderPanel();
+    expect(container.querySelector('.widget-header svg')).toBeInTheDocument();
+  });
+
+  it('renders the hostname', () => {
+    renderPanel({ host: { name: 'prod-node', totalCPU: 2, totalMemory: 0 } });
+    expect(screen.getByText('prod-node')).toBeVisible();
+  });
+
+  it('renders OS information when present', () => {
+    renderPanel({
+      host: {
+        name: 'my-host',
+        totalCPU: 4,
+        totalMemory: 0,
+        os: { type: 'linux', arch: 'amd64', name: 'Ubuntu 22.04' },
+      },
+    });
+    expect(screen.getByText('linux amd64 Ubuntu 22.04')).toBeVisible();
+  });
+
+  it('hides the OS row when os is absent', () => {
+    renderPanel();
+    expect(screen.queryByText('OS Information')).not.toBeInTheDocument();
+  });
+
+  it('renders kernel version when present', () => {
+    renderPanel({
+      host: {
+        name: 'my-host',
+        totalCPU: 4,
+        totalMemory: 0,
+        kernelVersion: '5.15.0-105-generic',
+      },
+    });
+    expect(screen.getByText('5.15.0-105-generic')).toBeVisible();
+  });
+
+  it('hides the kernel version row when absent', () => {
+    renderPanel();
+    expect(screen.queryByText('Kernel Version')).not.toBeInTheDocument();
+  });
+
+  it('renders total CPU count', () => {
+    renderPanel({ host: { name: 'h', totalCPU: 8, totalMemory: 0 } });
+    expect(screen.getByText('8')).toBeVisible();
+  });
+
+  it('renders total memory as a humanized value', () => {
+    const totalMemory = 1073741824;
+    const humanizedTotalMemory = humanize(totalMemory);
+
+    if (humanizedTotalMemory === undefined) {
+      throw new Error('Expected humanize(totalMemory) to return a value');
+    }
+
+    renderPanel({ host: { name: 'h', totalCPU: 1, totalMemory } });
+    expect(screen.getByText(humanizedTotalMemory)).toBeVisible();
+  });
+
+  describe('disk usage row', () => {
+    it('renders the disk usage row when endpointId is provided', () => {
+      renderPanel({ endpointId: 1 });
+      expect(screen.getByText('Disk usage')).toBeVisible();
+      expect(screen.getByText('storage-info')).toBeVisible();
+    });
+
+    it('hides the disk usage row when endpointId is absent', () => {
+      renderPanel({ endpointId: undefined });
+      expect(screen.queryByText('Disk usage')).not.toBeInTheDocument();
+    });
+  });
+
+  describe('Browse button', () => {
+    it('renders the Browse button when isBrowseEnabled is true', () => {
+      renderPanel({ isBrowseEnabled: true });
+      expect(screen.getByRole('button', { name: 'Browse' })).toBeVisible();
+    });
+
+    it('hides the Browse button when isBrowseEnabled is false', () => {
+      renderPanel({ isBrowseEnabled: false });
+      expect(
+        screen.queryByRole('button', { name: 'Browse' })
+      ).not.toBeInTheDocument();
+    });
+
+    it('navigates to browseUrl when Browse is clicked', async () => {
+      const user = userEvent.setup();
+      renderPanel({ isBrowseEnabled: true, browseUrl: 'docker.host.browse' });
+      await user.click(screen.getByRole('button', { name: 'Browse' }));
+      expect(mockGo).toHaveBeenCalledWith('docker.host.browse');
+    });
+  });
+});
diff --git a/app/react/docker/host/HostDetailsPanel/HostDetailsPanel.tsx b/app/react/docker/host/HostDetailsPanel/HostDetailsPanel.tsx
new file mode 100644
index 0000000..ac4cb4c
--- /dev/null
+++ b/app/react/docker/host/HostDetailsPanel/HostDetailsPanel.tsx
@@ -0,0 +1,109 @@
+import { useRouter } from '@uirouter/react';
+
+import { humanize } from '@/portainer/filters/filters';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { Widget } from '@@/Widget/Widget';
+import { WidgetBody } from '@@/Widget/WidgetBody';
+import { WidgetTitle } from '@@/Widget/WidgetTitle';
+import { DetailsTable } from '@@/DetailsTable/DetailsTable';
+import { Tooltip } from '@@/Tip/Tooltip';
+
+import { DockerStorageInfo } from '../DockerStorageInfo';
+
+type HostOs = {
+  type: string;
+  arch: string;
+  name: string;
+};
+
+type HostInfo = {
+  name: string;
+  os?: HostOs;
+  kernelVersion?: string;
+  totalCPU: number;
+  totalMemory: number;
+};
+
+type Props = {
+  host: HostInfo;
+  isBrowseEnabled: boolean;
+  browseUrl: string;
+  endpointId?: EnvironmentId;
+};
+
+export function HostDetailsPanel({
+  host,
+  isBrowseEnabled,
+  browseUrl,
+  endpointId,
+}: Props) {
+  const router = useRouter();
+
+  return (
+    <div className="row">
+      <div className="col-lg-12 col-md-12 col-sm-12 col-xs-12">
+        <Widget>
+          <WidgetTitle title="Host Details" icon="code" />
+          <WidgetBody className="no-padding">
+            <DetailsTable dataCy="host-details" className="!mb-0">
+              <tr>
+                <td>Hostname</td>
+                <td>{host.name}</td>
+              </tr>
+              {host.os && (
+                <tr>
+                  <td>OS Information</td>
+                  <td>
+                    {host.os.type} {host.os.arch} {host.os.name}
+                  </td>
+                </tr>
+              )}
+              {host.kernelVersion && (
+                <tr>
+                  <td>Kernel Version</td>
+                  <td>{host.kernelVersion}</td>
+                </tr>
+              )}
+              <tr>
+                <td>Total CPU</td>
+                <td>{host.totalCPU}</td>
+              </tr>
+              <tr>
+                <td>Total memory</td>
+                <td>{humanize(host.totalMemory)}</td>
+              </tr>
+              {endpointId && (
+                <tr>
+                  <td>
+                    <span className="flex items-center">
+                      Disk usage
+                      <Tooltip message="Disk usage on the partition backing Docker's data directory. Docker usage includes images, container layers, volumes, and build cache." />
+                    </span>
+                  </td>
+                  <td>
+                    <DockerStorageInfo endpointId={endpointId} />
+                  </td>
+                </tr>
+              )}
+              {isBrowseEnabled && (
+                <tr>
+                  <td colSpan={2}>
+                    <button
+                      type="button"
+                      className="btn btn-primary btn-sm"
+                      title="Browse"
+                      onClick={() => router.stateService.go(browseUrl)}
+                    >
+                      Browse
+                    </button>
+                  </td>
+                </tr>
+              )}
+            </DetailsTable>
+          </WidgetBody>
+        </Widget>
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/docker/host/SetupView/GpusList.tsx b/app/react/docker/host/SetupView/GpusList.tsx
new file mode 100644
index 0000000..982cbde
--- /dev/null
+++ b/app/react/docker/host/SetupView/GpusList.tsx
@@ -0,0 +1,76 @@
+import { array, object, string } from 'yup';
+
+import { r2a } from '@/react-tools/react2angular';
+import { withControlledInput } from '@/react-tools/withControlledInput';
+
+import { InputList } from '@@/form-components/InputList';
+import { ItemProps } from '@@/form-components/InputList/InputList';
+import { InputGroup } from '@@/form-components/InputGroup';
+
+export interface Gpu {
+  value: string;
+  name: string;
+}
+
+interface Props {
+  value: Gpu[];
+  onChange(value: Gpu[]): void;
+}
+
+function Item({ item, onChange, index }: ItemProps<Gpu>) {
+  return (
+    <div className="flex flex-grow gap-2">
+      <InputGroup size="small" className="flex-grow">
+        <InputGroup.Addon>GPU Name</InputGroup.Addon>
+        <InputGroup.Input
+          placeholder="my-gpu"
+          value={item.name}
+          onChange={(e) => {
+            onChange({ ...item, name: e.target.value });
+          }}
+          data-cy={`docker-gpu-name_${index}`}
+        />
+      </InputGroup>
+
+      <InputGroup size="small" className="flex-grow">
+        <InputGroup.Addon>Index or UUID</InputGroup.Addon>
+        <InputGroup.Input
+          placeholder="0 or GPU-6e2c7185-c3d3-ae22-da43-bc5267b89061"
+          value={item.value}
+          onChange={(e) => {
+            onChange({ ...item, value: e.target.value });
+          }}
+          data-cy={`docker-gpu-value_${index}`}
+        />
+      </InputGroup>
+    </div>
+  );
+}
+
+export function GpusList({ value, onChange }: Props) {
+  return (
+    <InputList<Gpu>
+      label="GPUs"
+      tooltip="You may optionally set up the GPUs that will be selectable against containers, although 'All GPUs' will always be available."
+      value={value}
+      onChange={onChange}
+      itemBuilder={() => ({ value: '', name: '' })}
+      addLabel="Add GPU"
+      item={Item}
+      data-cy="docker-containers-gpus"
+    />
+  );
+}
+
+export function gpusListValidation() {
+  const gpuShape = object().shape({
+    name: string().required(),
+    value: string().required(),
+  });
+  return array().of(gpuShape).default([]);
+}
+
+export const GpusListAngular = r2a(withControlledInput(GpusList), [
+  'value',
+  'onChange',
+]);
diff --git a/app/react/docker/images/BuildView/.keep b/app/react/docker/images/BuildView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/docker/images/ImportView/.keep b/app/react/docker/images/ImportView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/docker/images/ItemView/.keep b/app/react/docker/images/ItemView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/docker/images/ItemView/DockerfileDetails.tsx b/app/react/docker/images/ItemView/DockerfileDetails.tsx
new file mode 100644
index 0000000..33ed552
--- /dev/null
+++ b/app/react/docker/images/ItemView/DockerfileDetails.tsx
@@ -0,0 +1,75 @@
+import { List } from 'lucide-react';
+
+import { joinCommand } from '@/docker/filters/utils';
+import { getPairKey, getPairValue } from '@/portainer/filters/filters';
+
+import { TableContainer, TableTitle } from '@@/datatables';
+import { DetailsTable } from '@@/DetailsTable';
+
+interface DockerImage {
+  Command: null | Array<string>;
+  Entrypoint: Array<string>;
+  ExposedPorts: Array<number>;
+  Volumes: Array<string>;
+  Env: Array<string>;
+}
+
+interface Props {
+  image: DockerImage;
+}
+
+export function DockerfileDetails({ image }: Props) {
+  return (
+    <TableContainer>
+      <TableTitle label="Dockerfile details" icon={List} />
+      <DetailsTable dataCy="dockerfile-details-table">
+        <DetailsTable.Row label="CMD">
+          <code>{image.Command ? joinCommand(image.Command) : '-'}</code>
+        </DetailsTable.Row>
+
+        {image.Entrypoint && (
+          <DetailsTable.Row label="ENTRYPOINT">
+            <code>{joinCommand(image.Entrypoint)}</code>
+          </DetailsTable.Row>
+        )}
+
+        {image.ExposedPorts.length > 0 && (
+          <DetailsTable.Row label="EXPOSE">
+            {image.ExposedPorts.map((port, index) => (
+              <span className="label label-default space-right" key={index}>
+                {port}
+              </span>
+            ))}
+          </DetailsTable.Row>
+        )}
+
+        {image.Volumes.length > 0 && (
+          <DetailsTable.Row label="VOLUME">
+            <div className="flex flex-wrap gap-1">
+              {image.Volumes.map((volume, index) => (
+                <span key={index} className="label label-default space-right">
+                  {volume}
+                </span>
+              ))}
+            </div>
+          </DetailsTable.Row>
+        )}
+
+        {image.Env.length > 0 && (
+          <DetailsTable.Row label="ENV">
+            <table className="table-bordered table-condensed table">
+              <tbody>
+                {image.Env.map((variable) => (
+                  <tr key={variable}>
+                    <td>{getPairKey(variable, '=')}</td>
+                    <td>{getPairValue(variable, '=')}</td>
+                  </tr>
+                ))}
+              </tbody>
+            </table>
+          </DetailsTable.Row>
+        )}
+      </DetailsTable>
+    </TableContainer>
+  );
+}
diff --git a/app/react/docker/images/ItemView/RegistrySelectPrompt.tsx b/app/react/docker/images/ItemView/RegistrySelectPrompt.tsx
new file mode 100644
index 0000000..aa6c6c2
--- /dev/null
+++ b/app/react/docker/images/ItemView/RegistrySelectPrompt.tsx
@@ -0,0 +1,67 @@
+import { useState } from 'react';
+
+import { Registry } from '@/react/portainer/registries/types/registry';
+
+import { Modal, OnSubmit, openModal } from '@@/modals';
+import { Button } from '@@/buttons';
+import { PortainerSelect } from '@@/form-components/PortainerSelect';
+
+interface Props {
+  registries: Registry[];
+  onSubmit: OnSubmit<Registry['Id']>;
+  defaultValue: Registry['Id'];
+}
+
+function RegistrySelectPrompt({ onSubmit, defaultValue, registries }: Props) {
+  const title = 'Which registry do you want to use?';
+  const [registryId, setRegistryId] = useState(defaultValue);
+  const options = registries2Options(registries);
+
+  return (
+    <Modal onDismiss={() => onSubmit()} aria-label={title}>
+      <Modal.Header title={title} />
+
+      <Modal.Body>
+        <PortainerSelect
+          onChange={setRegistryId}
+          value={registryId}
+          options={options}
+          data-cy="registry-select-selector"
+        />
+      </Modal.Body>
+      <Modal.Footer>
+        <Button
+          onClick={() => onSubmit()}
+          color="default"
+          data-cy="registry-select-cancel-button"
+        >
+          Cancel
+        </Button>
+        <Button
+          onClick={() => onSubmit(registryId)}
+          color="primary"
+          data-cy="registry-select-update-button"
+        >
+          Update
+        </Button>
+      </Modal.Footer>
+    </Modal>
+  );
+}
+
+export function selectRegistry(
+  registries: Registry[],
+  defaultValue: Registry['Id']
+) {
+  return openModal(RegistrySelectPrompt, {
+    registries,
+    defaultValue,
+  });
+}
+
+function registries2Options(registries: Registry[]) {
+  return registries.map((r) => ({
+    label: r.Name,
+    value: r.Id,
+  }));
+}
diff --git a/app/react/docker/images/ListView/.keep b/app/react/docker/images/ListView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/docker/images/ListView/ImagesDatatable/ConfirmPruneModal.test.tsx b/app/react/docker/images/ListView/ImagesDatatable/ConfirmPruneModal.test.tsx
new file mode 100644
index 0000000..33e906b
--- /dev/null
+++ b/app/react/docker/images/ListView/ImagesDatatable/ConfirmPruneModal.test.tsx
@@ -0,0 +1,174 @@
+import { screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+
+import { confirmPruneImages } from './ConfirmPruneModal';
+
+describe('ConfirmPruneModal', () => {
+  afterEach(() => {
+    // Clean up any modal elements
+    document.body
+      .querySelectorAll('[data-reach-dialog-overlay]')
+      .forEach((el) => el.remove());
+    document.body
+      .querySelectorAll('[id^="dialog-"]')
+      .forEach((el) => el.remove());
+  });
+
+  it('should render modal with title and description', async () => {
+    confirmPruneImages();
+
+    await waitFor(() => {
+      expect(screen.getByText('Are you sure?')).toBeVisible();
+      expect(
+        screen.getByText(/This will delete all untagged \(dangling\) images/)
+      ).toBeVisible();
+    });
+  });
+
+  it('should render switch for pruning all unused images', async () => {
+    confirmPruneImages();
+
+    await waitFor(() => {
+      expect(screen.getByText('Delete all unused images')).toBeVisible();
+    });
+  });
+
+  it('should return undefined when Cancel is clicked', async () => {
+    const user = userEvent.setup();
+    const resultPromise = confirmPruneImages();
+
+    const cancelButton = await screen.findByRole('button', { name: /cancel/i });
+    await user.click(cancelButton);
+
+    const result = await resultPromise;
+    expect(result).toBeUndefined();
+  });
+
+  it('should return pruneAll: false and clearBuildCache: false when Continue is clicked without toggling switches', async () => {
+    const user = userEvent.setup();
+    const resultPromise = confirmPruneImages();
+
+    const confirmButton = await screen.findByRole('button', {
+      name: /continue/i,
+    });
+    await user.click(confirmButton);
+
+    const result = await resultPromise;
+    expect(result).toEqual({ pruneAll: false, clearBuildCache: false });
+  });
+
+  it('should return pruneAll: true when first switch is toggled and Continue is clicked', async () => {
+    const user = userEvent.setup();
+    const resultPromise = confirmPruneImages();
+
+    const [pruneAllSwitch] = await screen.findAllByRole('checkbox');
+    await user.click(pruneAllSwitch);
+
+    const confirmButton = screen.getByRole('button', { name: /continue/i });
+    await user.click(confirmButton);
+
+    const result = await resultPromise;
+    expect(result).toEqual({ pruneAll: true, clearBuildCache: false });
+  });
+
+  it('should have both switches unchecked by default', async () => {
+    confirmPruneImages();
+
+    const switches = await screen.findAllByRole('checkbox');
+    switches.forEach((s) => expect(s).not.toBeChecked());
+  });
+
+  it('should render switch for clearing Docker build cache', async () => {
+    confirmPruneImages();
+
+    await waitFor(() => {
+      expect(screen.getByText('Clear Docker build cache')).toBeVisible();
+    });
+  });
+
+  it('should return clearBuildCache: true when build cache switch is toggled', async () => {
+    const user = userEvent.setup();
+    const resultPromise = confirmPruneImages();
+
+    const [, buildCacheSwitch] = await screen.findAllByRole('checkbox');
+    await user.click(buildCacheSwitch);
+
+    const confirmButton = screen.getByRole('button', { name: /continue/i });
+    await user.click(confirmButton);
+
+    const result = await resultPromise;
+    expect(result).toEqual({ pruneAll: false, clearBuildCache: true });
+  });
+
+  it('should show validation message when no untagged images but unused images exist', async () => {
+    confirmPruneImages([
+      {
+        id: 'img1',
+        used: false,
+        tags: ['tag1'],
+        created: 1234567890,
+        size: 1024,
+      }, // unused but tagged
+    ]);
+
+    await waitFor(() => {
+      expect(
+        screen.getByText(
+          /No untagged \(dangling\) images available to delete\./
+        )
+      ).toBeVisible();
+    });
+  });
+
+  it('should not show validation message when untagged images exist', async () => {
+    confirmPruneImages([
+      {
+        id: 'img1',
+        used: true,
+        tags: [],
+        created: 1234567890,
+        size: 1024,
+      }, // untagged
+    ]);
+
+    await waitFor(() => {
+      expect(
+        screen.queryByText(
+          /No untagged \(dangling\) images available to delete\./
+        )
+      ).not.toBeInTheDocument();
+    });
+  });
+
+  it('should not show validation message when switch is toggled', async () => {
+    const user = userEvent.setup();
+    confirmPruneImages([
+      {
+        id: 'img1',
+        used: false,
+        tags: ['tag1'],
+        created: 1234567890,
+        size: 1024,
+      }, // unused but tagged
+    ]);
+
+    await waitFor(() => {
+      expect(
+        screen.getByText(
+          /No untagged \(dangling\) images available to delete\./
+        )
+      ).toBeVisible();
+    });
+
+    const [pruneAllSwitch] = await screen.findAllByRole('checkbox');
+    await user.click(pruneAllSwitch);
+
+    await waitFor(() => {
+      expect(
+        screen.queryByText(
+          /No untagged \(dangling\) images available to delete\./
+        )
+      ).not.toBeInTheDocument();
+    });
+  });
+});
diff --git a/app/react/docker/images/ListView/ImagesDatatable/ConfirmPruneModal.tsx b/app/react/docker/images/ListView/ImagesDatatable/ConfirmPruneModal.tsx
new file mode 100644
index 0000000..84f14dd
--- /dev/null
+++ b/app/react/docker/images/ListView/ImagesDatatable/ConfirmPruneModal.tsx
@@ -0,0 +1,78 @@
+import { useState } from 'react';
+
+import { Modal, OnSubmit, ModalType, openModal } from '@@/modals';
+import { Button } from '@@/buttons';
+import { SwitchField } from '@@/form-components/SwitchField';
+
+import { ImagesListResponse } from '../../queries/useImages';
+
+interface Props {
+  onSubmit: OnSubmit<{ pruneAll: boolean; clearBuildCache: boolean }>;
+  images?: ImagesListResponse[];
+}
+
+function ConfirmPruneModal({ onSubmit, images = [] }: Props) {
+  const [pruneAll, setPruneAll] = useState(false);
+  const [clearBuildCache, setClearBuildCache] = useState(false);
+
+  const hasUntaggedImages = images.some(
+    (img) => !img.tags || img.tags.length === 0
+  );
+  const hasUnusedImages = images.some((img) => !img.used);
+  const showValidationMessage =
+    !pruneAll && !hasUntaggedImages && hasUnusedImages;
+
+  return (
+    <Modal onDismiss={() => onSubmit()} aria-label="confirm prune images modal">
+      <Modal.Header title="Are you sure?" modalType={ModalType.Destructive} />
+      <Modal.Body>
+        <p>
+          This will delete all untagged (dangling) images in this environment.
+        </p>
+        <div className="mb-4">
+          <SwitchField
+            name="pruneAll"
+            data-cy="prune-all-unused-switch"
+            label="Delete all unused images"
+            tooltip="Delete all unused images, even if they are tagged."
+            checked={pruneAll}
+            onChange={setPruneAll}
+          />
+          {showValidationMessage && (
+            <p className="text-muted mt-1 text-xs">
+              No untagged (dangling) images available to delete.
+            </p>
+          )}
+        </div>
+        <SwitchField
+          name="clearBuildCache"
+          data-cy="prune-clear-build-cache-switch"
+          label="Clear Docker build cache"
+          tooltip="This removes cached build layers that are no longer in use. Future builds may take longer until the cache is rebuilt."
+          checked={clearBuildCache}
+          onChange={setClearBuildCache}
+        />
+      </Modal.Body>
+      <Modal.Footer>
+        <Button
+          onClick={() => onSubmit()}
+          color="default"
+          data-cy="prune-cancel"
+        >
+          Cancel
+        </Button>
+        <Button
+          onClick={() => onSubmit({ pruneAll, clearBuildCache })}
+          color="danger"
+          data-cy="prune-confirm"
+        >
+          Continue
+        </Button>
+      </Modal.Footer>
+    </Modal>
+  );
+}
+
+export async function confirmPruneImages(images?: ImagesListResponse[]) {
+  return openModal(ConfirmPruneModal, { images });
+}
diff --git a/app/react/docker/images/ListView/ImagesDatatable/ImagesDatatable.test.tsx b/app/react/docker/images/ListView/ImagesDatatable/ImagesDatatable.test.tsx
new file mode 100644
index 0000000..14d228f
--- /dev/null
+++ b/app/react/docker/images/ListView/ImagesDatatable/ImagesDatatable.test.tsx
@@ -0,0 +1,329 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import { http, HttpResponse } from 'msw';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { server } from '@/setup-tests/server';
+import { createMockUser } from '@/react-tools/test-mocks';
+import { Role, User } from '@/portainer/users/types';
+
+import { ImagesListResponse } from '../../queries/useImages';
+
+import { ImagesDatatable } from './ImagesDatatable';
+
+vi.mock('@uirouter/react', async (importOriginal: () => Promise<object>) => ({
+  ...(await importOriginal()),
+  useCurrentStateAndParams: vi.fn(() => ({
+    params: { endpointId: '1' },
+  })),
+}));
+
+vi.mock('@@/Link', () => ({
+  Link: ({
+    children,
+    'data-cy': dataCy,
+  }: {
+    children: React.ReactNode;
+    'data-cy'?: string;
+  }) => (
+    // eslint-disable-next-line jsx-a11y/anchor-is-valid
+    <a data-cy={dataCy}>{children}</a>
+  ),
+}));
+
+// Mock child components to simplify testing
+vi.mock('./RemoveButtonMenu', () => ({
+  RemoveButtonMenu: ({
+    selectedItems,
+  }: {
+    selectedItems: ImagesListResponse[];
+  }) => (
+    <button
+      type="button"
+      data-cy="remove-button-menu"
+      disabled={selectedItems.length === 0}
+    >
+      Remove ({selectedItems.length})
+    </button>
+  ),
+}));
+
+vi.mock('./ImportExportButtons', () => ({
+  ImportExportButtons: ({
+    selectedItems,
+  }: {
+    selectedItems: ImagesListResponse[];
+  }) => (
+    <div data-cy="import-export-buttons">
+      Import/Export ({selectedItems.length})
+    </div>
+  ),
+}));
+
+describe('ImagesDatatable', () => {
+  describe('Data Fetching and Display', () => {
+    it('should fetch and display images list', async () => {
+      const mockImages = [
+        createMockImage({ id: 'sha256:abc123', tags: ['nginx:latest'] }),
+        createMockImage({ id: 'sha256:def456', tags: ['redis:alpine'] }),
+      ];
+
+      server.use(
+        http.get('/api/docker/:envId/images', () =>
+          HttpResponse.json(mockImages)
+        )
+      );
+
+      renderComponent({ isHostColumnVisible: false });
+
+      await waitFor(() => {
+        expect(screen.getByText(/nginx:latest/)).toBeVisible();
+        expect(screen.getByText(/redis:alpine/)).toBeVisible();
+      });
+    });
+
+    it('should show loading state while fetching images', () => {
+      server.use(
+        http.get('/api/docker/:envId/images', async () => {
+          // Never resolve to simulate loading state
+          await new Promise(() => {});
+          return HttpResponse.json([]);
+        })
+      );
+
+      renderComponent({ isHostColumnVisible: false });
+
+      expect(screen.getByText(/Loading/)).toBeVisible();
+    });
+
+    it('should handle empty images list', async () => {
+      server.use(
+        http.get('/api/docker/:envId/images', () => HttpResponse.json([]))
+      );
+
+      renderComponent({ isHostColumnVisible: false });
+
+      await waitFor(() => {
+        expect(screen.getByText(/No items available./i)).toBeInTheDocument();
+      });
+    });
+  });
+
+  describe('Column Visibility', () => {
+    it('should show host column when isHostColumnVisible=true', async () => {
+      const mockImages = [
+        createMockImage({
+          id: 'sha256:abc123',
+          tags: ['nginx:latest'],
+          nodeName: 'worker-node-1',
+        }),
+        createMockImage({
+          id: 'sha256:def456',
+          tags: ['redis:alpine'],
+          nodeName: 'worker-node-2',
+        }),
+      ];
+
+      server.use(
+        http.get('/api/docker/:envId/images', () =>
+          HttpResponse.json(mockImages)
+        )
+      );
+
+      renderComponent({ isHostColumnVisible: true });
+
+      await waitFor(() => {
+        expect(screen.getByText('worker-node-1')).toBeVisible();
+        expect(screen.getByText('worker-node-2')).toBeVisible();
+      });
+    });
+
+    it('should hide host column when isHostColumnVisible=false', async () => {
+      const mockImages = [
+        createMockImage({
+          id: 'sha256:abc123',
+          tags: ['nginx:latest'],
+          nodeName: 'worker-node-1',
+        }),
+      ];
+
+      server.use(
+        http.get('/api/docker/:envId/images', () =>
+          HttpResponse.json(mockImages)
+        )
+      );
+
+      renderComponent({ isHostColumnVisible: false });
+
+      await waitFor(() => {
+        expect(screen.getByText('nginx:latest')).toBeVisible();
+        expect(screen.queryByText('worker-node-1')).not.toBeInTheDocument();
+      });
+    });
+  });
+
+  describe('Table Actions', () => {
+    it('should render RemoveButtonMenu', async () => {
+      server.use(
+        http.get('/api/docker/:envId/images', () =>
+          HttpResponse.json([createMockImage()])
+        )
+      );
+
+      renderComponent({ isHostColumnVisible: false });
+
+      await waitFor(() => {
+        expect(screen.getByTestId('remove-button-menu')).toBeVisible();
+      });
+    });
+
+    it('should render ImportExportButtons', async () => {
+      server.use(
+        http.get('/api/docker/:envId/images', () =>
+          HttpResponse.json([createMockImage()])
+        )
+      );
+
+      renderComponent({ isHostColumnVisible: false });
+
+      await waitFor(() => {
+        expect(screen.getByTestId('import-export-buttons')).toBeVisible();
+      });
+    });
+
+    it('should render Build Image button when user has DockerImageBuild authorization', async () => {
+      server.use(
+        http.get('/api/docker/:envId/images', () =>
+          HttpResponse.json([createMockImage()])
+        )
+      );
+
+      renderComponent(
+        { isHostColumnVisible: false },
+        createMockUser({
+          Role: Role.Standard,
+          EndpointAuthorizations: {
+            1: { DockerImageBuild: true },
+          },
+        })
+      );
+
+      await waitFor(() => {
+        const buildButton = screen.getByText(/Build a new image/i);
+
+        expect(buildButton).toBeVisible();
+        expect(buildButton).toHaveAttribute(
+          'data-cy',
+          'image-buildImageButton'
+        );
+      });
+    });
+
+    it('should hide Build Image button when user lacks DockerImageBuild authorization', async () => {
+      server.use(
+        http.get('/api/docker/:envId/images', () =>
+          HttpResponse.json([createMockImage()])
+        )
+      );
+
+      renderComponent(
+        { isHostColumnVisible: false },
+        createMockUser({
+          Role: Role.Standard,
+          EndpointAuthorizations: {
+            1: { DockerImageBuild: false },
+          },
+        })
+      );
+
+      await waitFor(() => {
+        expect(
+          screen.queryByText(/Build a new image/i)
+        ).not.toBeInTheDocument();
+      });
+    });
+  });
+
+  describe('Image Data Display', () => {
+    it('should display image id, tags, size, and created date', async () => {
+      const mockImages = [
+        createMockImage({
+          id: 'sha256:abcdef123456',
+          tags: ['nginx:1.21', 'nginx:latest'],
+          size: 142000000,
+          created: 1704067200, // 2024-01-01 00:00:00 UTC
+        }),
+      ];
+
+      server.use(
+        http.get('/api/docker/:envId/images', () =>
+          HttpResponse.json(mockImages)
+        )
+      );
+
+      renderComponent({ isHostColumnVisible: false });
+
+      await waitFor(() => {
+        // Image ID (shortened)
+        expect(screen.getByText(/abcdef123456/)).toBeVisible();
+
+        // Tags
+        expect(screen.getByText(/nginx:1.21/)).toBeVisible();
+        expect(screen.getByText(/nginx:latest/)).toBeVisible();
+      });
+    });
+
+    it('should handle images without tags', async () => {
+      const mockImages = [
+        createMockImage({
+          id: 'sha256:untagged123',
+          tags: undefined,
+        }),
+      ];
+
+      server.use(
+        http.get('/api/docker/:envId/images', () =>
+          HttpResponse.json(mockImages)
+        )
+      );
+
+      renderComponent({ isHostColumnVisible: false });
+
+      await waitFor(() => {
+        expect(screen.getByText(/untagged123/)).toBeVisible();
+      });
+    });
+  });
+});
+
+function createMockImage(
+  overrides?: Partial<ImagesListResponse>
+): ImagesListResponse {
+  return {
+    id: 'sha256:default123',
+    tags: ['test:latest'],
+    size: 100000000,
+    created: 1704067200,
+    used: false,
+    nodeName: undefined,
+    ...overrides,
+  };
+}
+
+function renderComponent(
+  { isHostColumnVisible }: { isHostColumnVisible: boolean },
+  user: User = createMockUser()
+) {
+  const Wrapped = withTestQueryProvider(
+    withUserProvider(withTestRouter(ImagesDatatable), user)
+  );
+
+  const rendered = render(
+    <Wrapped isHostColumnVisible={isHostColumnVisible} />
+  );
+
+  expect(screen.getByTestId('docker-images-datatable')).toBeVisible();
+
+  return rendered;
+}
diff --git a/app/react/docker/images/ListView/ImagesDatatable/ImagesDatatable.tsx b/app/react/docker/images/ListView/ImagesDatatable/ImagesDatatable.tsx
new file mode 100644
index 0000000..779435b
--- /dev/null
+++ b/app/react/docker/images/ListView/ImagesDatatable/ImagesDatatable.tsx
@@ -0,0 +1,102 @@
+import { List } from 'lucide-react';
+import { useMemo } from 'react';
+
+import { Authorized } from '@/react/hooks/useUser';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+
+import { Datatable, TableSettingsMenu } from '@@/datatables';
+import {
+  BasicTableSettings,
+  createPersistedStore,
+  FilteredColumnsTableSettings,
+  filteredColumnsSettings,
+  refreshableSettings,
+  RefreshableTableSettings,
+} from '@@/datatables/types';
+import { useTableState } from '@@/datatables/useTableState';
+import { AddButton } from '@@/buttons';
+import { TableSettingsMenuAutoRefresh } from '@@/datatables/TableSettingsMenuAutoRefresh';
+import { mergeOptions } from '@@/datatables/extend-options/mergeOptions';
+import { withColumnFilters } from '@@/datatables/extend-options/withColumnFilters';
+
+import { useImages } from '../../queries/useImages';
+
+import { columns as defColumns } from './columns';
+import { host as hostColumn } from './columns/host';
+import { RemoveButtonMenu } from './RemoveButtonMenu';
+import { ImportExportButtons } from './ImportExportButtons';
+import { PruneButton } from './PruneButton';
+
+const tableKey = 'images';
+
+export interface TableSettings
+  extends
+    BasicTableSettings,
+    RefreshableTableSettings,
+    FilteredColumnsTableSettings {}
+
+const settingsStore = createPersistedStore<TableSettings>(
+  tableKey,
+  'tags',
+  (set) => ({
+    ...refreshableSettings(set),
+    ...filteredColumnsSettings(set),
+  })
+);
+
+export function ImagesDatatable({
+  isHostColumnVisible,
+}: {
+  isHostColumnVisible: boolean;
+}) {
+  const environmentId = useEnvironmentId();
+  const tableState = useTableState(settingsStore, tableKey);
+  const columns = useMemo(
+    () => (isHostColumnVisible ? [...defColumns, hostColumn] : defColumns),
+    [isHostColumnVisible]
+  );
+  const imagesQuery = useImages(environmentId, true, {
+    refetchInterval: tableState.autoRefreshRate * 1000,
+  });
+
+  return (
+    <Datatable
+      title="Images"
+      titleIcon={List}
+      data-cy="docker-images-datatable"
+      extendTableOptions={mergeOptions(
+        withColumnFilters(tableState.columnFilters, tableState.setColumnFilters)
+      )}
+      renderTableActions={(selectedItems) => (
+        <div className="flex items-center gap-2">
+          <RemoveButtonMenu selectedItems={selectedItems} />
+
+          <PruneButton images={imagesQuery.data || []} />
+
+          <ImportExportButtons selectedItems={selectedItems} />
+
+          <Authorized authorizations="DockerImageBuild">
+            <AddButton
+              to="docker.images.build"
+              data-cy="image-buildImageButton"
+            >
+              Build a new image
+            </AddButton>
+          </Authorized>
+        </div>
+      )}
+      dataset={imagesQuery.data || []}
+      isLoading={imagesQuery.isLoading}
+      settingsManager={tableState}
+      columns={columns}
+      renderTableSettings={() => (
+        <TableSettingsMenu>
+          <TableSettingsMenuAutoRefresh
+            value={tableState.autoRefreshRate}
+            onChange={(value) => tableState.setAutoRefreshRate(value)}
+          />
+        </TableSettingsMenu>
+      )}
+    />
+  );
+}
diff --git a/app/react/docker/images/ListView/ImagesDatatable/ImportExportButtons.test.tsx b/app/react/docker/images/ListView/ImagesDatatable/ImportExportButtons.test.tsx
new file mode 100644
index 0000000..a52f0ea
--- /dev/null
+++ b/app/react/docker/images/ListView/ImagesDatatable/ImportExportButtons.test.tsx
@@ -0,0 +1,529 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http } from 'msw';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { server } from '@/setup-tests/server';
+import { createMockUser } from '@/react-tools/test-mocks';
+import { Role } from '@/portainer/users/types';
+
+import { ImagesListResponse } from '../../queries/useImages';
+
+import { ImportExportButtons } from './ImportExportButtons';
+
+// Use vi.hoisted to ensure mocks are available before imports
+const { mockConfirmImageExport, mockNotifyWarning, mockSaveAs } = vi.hoisted(
+  () => ({
+    mockConfirmImageExport: vi.fn(),
+    mockNotifyWarning: vi.fn(),
+    mockSaveAs: vi.fn(),
+  })
+);
+
+vi.mock('file-saver', () => ({
+  saveAs: mockSaveAs,
+}));
+
+vi.mock('@uirouter/react', async (importOriginal: () => Promise<object>) => ({
+  ...(await importOriginal()),
+  useCurrentStateAndParams: vi.fn(() => ({
+    params: { endpointId: '1' },
+  })),
+}));
+
+vi.mock('@@/Link', () => ({
+  Link: ({
+    children,
+    'data-cy': dataCy,
+  }: {
+    children: React.ReactNode;
+    'data-cy'?: string;
+  }) => (
+    <a data-cy={dataCy} href="/mock-link">
+      {children}
+    </a>
+  ),
+}));
+
+// Mock the confirm modal
+vi.mock('../../common/ConfirmExportModal', () => ({
+  confirmImageExport: mockConfirmImageExport,
+}));
+
+// Mock the notification service
+vi.mock('@/portainer/services/notifications', () => ({
+  notifyWarning: mockNotifyWarning,
+}));
+
+describe('ImportExportButtons', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    server.resetHandlers();
+    mockConfirmImageExport.mockResolvedValue(false);
+  });
+
+  describe('Authorization', () => {
+    it('should render Import button when user has DockerImageLoad authorization', async () => {
+      renderComponent(
+        [],
+        createMockUser({
+          Role: Role.Standard,
+          EndpointAuthorizations: {
+            1: { DockerImageLoad: true },
+          },
+        })
+      );
+
+      await waitFor(() => {
+        expect(screen.getByRole('link', { name: /import/i })).toBeVisible();
+      });
+    });
+
+    it('should render Export button when user has DockerImageGet authorization', async () => {
+      renderComponent(
+        [],
+        createMockUser({
+          Role: Role.Standard,
+          EndpointAuthorizations: {
+            1: { DockerImageGet: true },
+          },
+        })
+      );
+
+      await waitFor(() => {
+        expect(screen.getByRole('button', { name: /export/i })).toBeVisible();
+      });
+    });
+  });
+
+  describe('Export Button State', () => {
+    it('should disable Export button when no images are selected', async () => {
+      renderComponent(
+        [],
+        createMockUser({
+          EndpointAuthorizations: { 1: { DockerImageGet: true } },
+        })
+      );
+
+      await waitFor(() => {
+        const exportButton = screen.getByRole('button', { name: /export/i });
+        expect(exportButton).toBeDisabled();
+      });
+    });
+
+    it('should enable Export button when images are selected', async () => {
+      const selectedImages = [
+        createMockImage({ id: 'sha256:abc123', tags: ['nginx:latest'] }),
+      ];
+
+      renderComponent(
+        selectedImages,
+        createMockUser({
+          EndpointAuthorizations: { 1: { DockerImageGet: true } },
+        })
+      );
+
+      await waitFor(() => {
+        const exportButton = screen.getByRole('button', { name: /export/i });
+        expect(exportButton).not.toBeDisabled();
+      });
+    });
+
+    it('should disable Export button while export is in progress', async () => {
+      mockConfirmImageExport.mockResolvedValue(true);
+
+      const selectedImages = [
+        createMockImage({ id: 'sha256:abc123', tags: ['nginx:latest'] }),
+      ];
+
+      // Use a manually-controlled promise so the test can resolve it before
+      // exiting — a setTimeout-based delay would leave a dangling async
+      // operation that fires during subsequent tests and pollutes their mocks.
+      let resolveExport!: (r: Response) => void;
+      server.use(
+        http.get(
+          '/api/endpoints/:envId/docker/images/get',
+          () =>
+            new Promise<Response>((resolve) => {
+              resolveExport = resolve;
+            })
+        )
+      );
+
+      const user = userEvent.setup();
+      renderComponent(
+        selectedImages,
+        createMockUser({
+          EndpointAuthorizations: { 1: { DockerImageGet: true } },
+        })
+      );
+
+      const exportButton = await waitFor(() =>
+        screen.getByRole('button', { name: /export/i })
+      );
+      await user.click(exportButton);
+
+      await waitFor(() => {
+        expect(screen.getByText('Export in progress...')).toBeVisible();
+      });
+
+      // Resolve the in-flight request so the test exits cleanly with no
+      // pending async work that could bleed into the next test.
+      resolveExport(
+        new Response(new Blob(['image data']), {
+          headers: { 'content-disposition': 'attachment; filename=test.tar' },
+        })
+      );
+      await waitFor(() => {
+        expect(
+          screen.queryByText('Export in progress...')
+        ).not.toBeInTheDocument();
+      });
+    });
+  });
+
+  describe('Export Validation', () => {
+    it('should prevent export of untagged images', async () => {
+      const selectedImages = [
+        createMockImage({
+          id: 'sha256:abc123',
+          tags: ['<none>'],
+        }),
+      ];
+
+      let apiCalled = false;
+      server.use(
+        http.get('/api/endpoints/:envId/docker/images/get', () => {
+          apiCalled = true;
+          return new Response(new Blob(['image data']), {
+            headers: {
+              'content-disposition': 'attachment; filename=test.tar',
+            },
+          });
+        })
+      );
+
+      const user = userEvent.setup();
+      renderComponent(
+        selectedImages,
+        createMockUser({
+          EndpointAuthorizations: { 1: { DockerImageGet: true } },
+        })
+      );
+
+      const exportButton = await waitFor(() =>
+        screen.getByRole('button', { name: /export/i })
+      );
+      await user.click(exportButton);
+
+      expect(mockNotifyWarning).toHaveBeenCalledWith(
+        '',
+        'Cannot download an untagged image'
+      );
+      expect(apiCalled).toBe(false);
+      expect(mockConfirmImageExport).not.toHaveBeenCalled();
+    });
+
+    it('should prevent export of images from different nodes', async () => {
+      const selectedImages = [
+        createMockImage({
+          id: 'sha256:abc123',
+          tags: ['nginx:latest'],
+          nodeName: 'node-1',
+        }),
+        createMockImage({
+          id: 'sha256:def456',
+          tags: ['redis:alpine'],
+          nodeName: 'node-2',
+        }),
+      ];
+
+      let apiCalled = false;
+      server.use(
+        http.get('/api/endpoints/:envId/docker/images/get', () => {
+          apiCalled = true;
+          return new Response(new Blob(['image data']), {
+            headers: {
+              'content-disposition': 'attachment; filename=test.tar',
+            },
+          });
+        })
+      );
+
+      const user = userEvent.setup();
+      renderComponent(
+        selectedImages,
+        createMockUser({
+          EndpointAuthorizations: { 1: { DockerImageGet: true } },
+        })
+      );
+
+      const exportButton = await waitFor(() =>
+        screen.getByRole('button', { name: /export/i })
+      );
+      await user.click(exportButton);
+
+      expect(mockNotifyWarning).toHaveBeenCalledWith(
+        '',
+        'Cannot download images from different nodes at the same time'
+      );
+      expect(apiCalled).toBe(false);
+      expect(mockConfirmImageExport).not.toHaveBeenCalled();
+    });
+
+    it('should allow export of images from the same node', async () => {
+      mockConfirmImageExport.mockResolvedValue(true);
+
+      const selectedImages = [
+        createMockImage({
+          id: 'sha256:abc123',
+          tags: ['nginx:latest'],
+          nodeName: 'node-1',
+        }),
+        createMockImage({
+          id: 'sha256:def456',
+          tags: ['redis:alpine'],
+          nodeName: 'node-1',
+        }),
+      ];
+
+      server.use(
+        http.get(
+          '/api/endpoints/:envId/docker/images/get',
+          () =>
+            new Response(new Blob(['image data']), {
+              headers: {
+                'content-disposition': 'attachment; filename=images.tar',
+              },
+            })
+        )
+      );
+
+      const user = userEvent.setup();
+      renderComponent(
+        selectedImages,
+        createMockUser({
+          EndpointAuthorizations: { 1: { DockerImageGet: true } },
+        })
+      );
+
+      const exportButton = await waitFor(() =>
+        screen.getByRole('button', { name: /export/i })
+      );
+      await user.click(exportButton);
+
+      await waitFor(() => {
+        expect(mockSaveAs).toHaveBeenCalled();
+      });
+    });
+  });
+
+  describe('Export Confirmation Flow', () => {
+    it('should show confirmation modal before exporting', async () => {
+      mockConfirmImageExport.mockResolvedValue(true);
+
+      const selectedImages = [
+        createMockImage({ id: 'sha256:abc123', tags: ['nginx:latest'] }),
+      ];
+
+      server.use(
+        http.get(
+          '/api/endpoints/:envId/docker/images/get',
+          () =>
+            new Response(new Blob(['image data']), {
+              headers: {
+                'content-disposition': 'attachment; filename=test.tar',
+              },
+            })
+        )
+      );
+
+      const user = userEvent.setup();
+      renderComponent(
+        selectedImages,
+        createMockUser({
+          EndpointAuthorizations: { 1: { DockerImageGet: true } },
+        })
+      );
+
+      const exportButton = await waitFor(() =>
+        screen.getByRole('button', { name: /export/i })
+      );
+      await user.click(exportButton);
+
+      expect(mockConfirmImageExport).toHaveBeenCalled();
+
+      await waitFor(() => {
+        expect(mockSaveAs).toHaveBeenCalled();
+      });
+    });
+
+    it('should not export when user cancels confirmation', async () => {
+      const selectedImages = [
+        createMockImage({ id: 'sha256:abc123', tags: ['nginx:latest'] }),
+      ];
+
+      let apiCalled = false;
+      server.use(
+        http.get('/api/endpoints/:envId/docker/images/get', () => {
+          apiCalled = true;
+          return new Response(new Blob(['image data']), {
+            headers: {
+              'content-disposition': 'attachment; filename=test.tar',
+            },
+          });
+        })
+      );
+
+      const user = userEvent.setup();
+      renderComponent(
+        selectedImages,
+        createMockUser({
+          EndpointAuthorizations: { 1: { DockerImageGet: true } },
+        })
+      );
+
+      const exportButton = await waitFor(() =>
+        screen.getByRole('button', { name: /export/i })
+      );
+      mockConfirmImageExport.mockResolvedValue(false);
+      await user.click(exportButton);
+
+      await waitFor(() => {
+        expect(mockConfirmImageExport).toHaveBeenCalled();
+        expect(apiCalled).toBe(false);
+        expect(mockSaveAs).not.toHaveBeenCalled();
+      });
+    });
+  });
+
+  describe('Export Success', () => {
+    it('should successfully export selected images', async () => {
+      mockConfirmImageExport.mockResolvedValue(true);
+
+      const selectedImages = [
+        createMockImage({ id: 'sha256:abc123', tags: ['nginx:latest'] }),
+        createMockImage({ id: 'sha256:def456', tags: ['redis:alpine'] }),
+      ];
+
+      let requestUrl = '';
+
+      server.use(
+        http.get('/api/endpoints/:envId/docker/images/get', ({ request }) => {
+          requestUrl = request.url;
+          return new Response(new Blob(['image data']), {
+            headers: {
+              'content-disposition': 'attachment; filename=images.tar',
+            },
+          });
+        })
+      );
+
+      const user = userEvent.setup();
+      renderComponent(
+        selectedImages,
+        createMockUser({
+          EndpointAuthorizations: { 1: { DockerImageGet: true } },
+        })
+      );
+
+      const exportButton = await waitFor(() =>
+        screen.getByRole('button', { name: /export/i })
+      );
+      await user.click(exportButton);
+
+      await waitFor(() => {
+        expect(mockSaveAs).toHaveBeenCalled();
+      });
+
+      // Verify the request was made with image names
+      expect(requestUrl).toContain('names');
+    });
+
+    it('should include nodeName in request when exporting from swarm node', async () => {
+      mockConfirmImageExport.mockResolvedValue(true);
+
+      const selectedImages = [
+        createMockImage({
+          id: 'sha256:abc123',
+          tags: ['nginx:latest'],
+          nodeName: 'worker-node-1',
+        }),
+      ];
+
+      let requestHeaders: Record<string, string> = {};
+
+      server.use(
+        http.get('/api/endpoints/:envId/docker/images/get', ({ request }) => {
+          requestHeaders = Object.fromEntries(request.headers.entries());
+          return new Response(new Blob(['image data']), {
+            headers: {
+              'content-disposition': 'attachment; filename=test.tar',
+            },
+          });
+        })
+      );
+
+      const user = userEvent.setup();
+      renderComponent(
+        selectedImages,
+        createMockUser({
+          EndpointAuthorizations: { 1: { DockerImageGet: true } },
+        })
+      );
+
+      const exportButton = await waitFor(() =>
+        screen.getByRole('button', { name: /export/i })
+      );
+      await user.click(exportButton);
+
+      await waitFor(() => {
+        expect(mockSaveAs).toHaveBeenCalled();
+      });
+
+      expect(requestHeaders['x-portaineragent-target']).toBe('worker-node-1');
+    });
+  });
+
+  describe('Import Button', () => {
+    it('should link to import page', async () => {
+      renderComponent(
+        [],
+        createMockUser({
+          EndpointAuthorizations: { 1: { DockerImageLoad: true } },
+        })
+      );
+
+      await waitFor(() => {
+        expect(screen.getByRole('link', { name: /import/i })).toBeVisible();
+      });
+    });
+  });
+});
+
+function createMockImage(
+  overrides?: Partial<ImagesListResponse>
+): ImagesListResponse {
+  return {
+    id: 'sha256:default123',
+    tags: ['test:latest'],
+    size: 100000000,
+    created: 1704067200,
+    used: false,
+    nodeName: undefined,
+    ...overrides,
+  };
+}
+
+function renderComponent(
+  selectedItems: ImagesListResponse[],
+  user = createMockUser()
+) {
+  const Wrapped = withTestQueryProvider(
+    withUserProvider(withTestRouter(ImportExportButtons), user)
+  );
+
+  return render(<Wrapped selectedItems={selectedItems} />);
+}
diff --git a/app/react/docker/images/ListView/ImagesDatatable/ImportExportButtons.tsx b/app/react/docker/images/ListView/ImagesDatatable/ImportExportButtons.tsx
new file mode 100644
index 0000000..1546caf
--- /dev/null
+++ b/app/react/docker/images/ListView/ImagesDatatable/ImportExportButtons.tsx
@@ -0,0 +1,95 @@
+import { Download, Upload } from 'lucide-react';
+import _ from 'lodash';
+
+import { Authorized } from '@/react/hooks/useUser';
+import { notifyWarning } from '@/portainer/services/notifications';
+
+import { Button, ButtonGroup, LoadingButton } from '@@/buttons';
+import { Link } from '@@/Link';
+
+import { ImagesListResponse } from '../../queries/useImages';
+import { useExportMutation } from '../../queries/useExportImageMutation';
+import { confirmImageExport } from '../../common/ConfirmExportModal';
+
+export function ImportExportButtons({
+  selectedItems,
+}: {
+  selectedItems: Array<ImagesListResponse>;
+}) {
+  const exportMutation = useExportMutation();
+
+  return (
+    <ButtonGroup>
+      <Authorized authorizations="DockerImageLoad">
+        <Button
+          size="small"
+          color="light"
+          as={Link}
+          data-cy="image-importImageButton"
+          icon={Upload}
+          disabled={exportMutation.isLoading}
+          props={{
+            to: 'docker.images.import',
+          }}
+          aria-disabled={exportMutation.isLoading}
+        >
+          Import
+        </Button>
+      </Authorized>
+      <Authorized authorizations="DockerImageGet">
+        <LoadingButton
+          size="small"
+          color="light"
+          icon={Download}
+          isLoading={exportMutation.isLoading}
+          loadingText="Export in progress..."
+          data-cy="image-exportImageButton"
+          onClick={() => handleExport()}
+          disabled={selectedItems.length === 0}
+        >
+          Export
+        </LoadingButton>
+      </Authorized>
+    </ButtonGroup>
+  );
+
+  async function handleExport() {
+    if (!isValidToDownload(selectedItems)) {
+      return;
+    }
+
+    const confirmed = await confirmImageExport();
+
+    if (!confirmed) {
+      return;
+    }
+
+    exportMutation.mutate({
+      images: selectedItems,
+      nodeName: selectedItems[0].nodeName,
+    });
+  }
+}
+
+function isValidToDownload(selectedItems: Array<ImagesListResponse>) {
+  for (let i = 0; i < selectedItems.length; i++) {
+    const image = selectedItems[i];
+
+    const untagged = image.tags?.find((item) => item.includes('<none>'));
+
+    if (untagged) {
+      notifyWarning('', 'Cannot download an untagged image');
+      return false;
+    }
+  }
+
+  if (_.uniqBy(selectedItems, 'nodeName').length > 1) {
+    notifyWarning(
+      '',
+      'Cannot download images from different nodes at the same time'
+    );
+    return false;
+  }
+
+  return true;
+}
diff --git a/app/react/docker/images/ListView/ImagesDatatable/PruneButton.test.tsx b/app/react/docker/images/ListView/ImagesDatatable/PruneButton.test.tsx
new file mode 100644
index 0000000..4d0f69b
--- /dev/null
+++ b/app/react/docker/images/ListView/ImagesDatatable/PruneButton.test.tsx
@@ -0,0 +1,549 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { HttpResponse, http } from 'msw';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { server } from '@/setup-tests/server';
+
+import { PruneButton } from './PruneButton';
+
+// Use vi.hoisted to ensure mocks are available before imports
+const {
+  mockConfirmPruneImages,
+  mockNotifySuccess,
+  mockNotifyError,
+  mockIsAuthorized,
+} = vi.hoisted(() => ({
+  mockConfirmPruneImages: vi.fn(),
+  mockNotifySuccess: vi.fn(),
+  mockNotifyError: vi.fn(),
+  mockIsAuthorized: vi.fn(),
+}));
+
+vi.mock('@uirouter/react', async (importOriginal: () => Promise<object>) => ({
+  ...(await importOriginal()),
+  useCurrentStateAndParams: vi.fn(() => ({
+    params: { endpointId: '1' },
+  })),
+}));
+
+vi.mock(
+  '@/react/hooks/useUser',
+  async (importOriginal: () => Promise<object>) => ({
+    ...(await importOriginal()),
+    Authorized: ({
+      children,
+      childrenUnauthorized = null,
+    }: {
+      children: React.ReactNode;
+      childrenUnauthorized?: React.ReactNode;
+    }) => (mockIsAuthorized() ? children : childrenUnauthorized),
+  })
+);
+
+vi.mock('./ConfirmPruneModal', () => ({
+  confirmPruneImages: mockConfirmPruneImages,
+}));
+
+vi.mock('@/portainer/services/notifications', () => ({
+  notifySuccess: mockNotifySuccess,
+  notifyError: mockNotifyError,
+}));
+
+describe('PruneButton', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    server.resetHandlers();
+    mockConfirmPruneImages.mockResolvedValue(null);
+    mockIsAuthorized.mockReturnValue(true);
+  });
+
+  afterEach(() => {
+    document.body.querySelectorAll('reach-portal').forEach((el) => el.remove());
+  });
+
+  describe('Authorization', () => {
+    it('should render when user has DockerImagePrune authorization', () => {
+      mockIsAuthorized.mockReturnValue(true);
+
+      renderComponent([{ id: 'img1', used: true, tags: ['tag1'] }]);
+
+      expect(screen.getByRole('button', { name: /prune/i })).toBeVisible();
+    });
+
+    it('should not render when user lacks DockerImagePrune authorization', () => {
+      mockIsAuthorized.mockReturnValue(false);
+
+      renderComponent([{ id: 'img1', used: true, tags: ['tag1'] }]);
+
+      expect(
+        screen.queryByRole('button', { name: /prune/i })
+      ).not.toBeInTheDocument();
+    });
+  });
+
+  describe('Button State', () => {
+    it('should disable button when no prunable images are available', () => {
+      mockIsAuthorized.mockReturnValue(true);
+
+      renderComponent([
+        { id: 'img1', used: true, tags: ['tag1'] }, // used image with tags
+        { id: 'img2', used: true, tags: ['tag2'] }, // used image with tags
+      ]);
+
+      const button = screen.getByRole('button', { name: /prune/i });
+      expect(button).toBeDisabled();
+      // Verify the button is wrapped in a tooltip by checking the parent has aria-expanded
+      expect(button.closest('[aria-expanded]')).toBeInTheDocument();
+    });
+
+    it('should enable button when unused images are available', () => {
+      mockIsAuthorized.mockReturnValue(true);
+
+      renderComponent([
+        { id: 'img1', used: true, tags: ['tag1'] },
+        { id: 'img2', used: false, tags: ['tag2'] }, // unused image
+      ]);
+
+      const button = screen.getByRole('button', { name: /prune/i });
+      expect(button).not.toBeDisabled();
+    });
+  });
+
+  describe('Prune Flow', () => {
+    it('should show confirmation modal when clicked', async () => {
+      const user = userEvent.setup();
+      renderComponent([{ id: 'img1', used: false, tags: ['tag1'] }]);
+
+      const button = screen.getByRole('button', { name: /prune/i });
+      await user.click(button);
+
+      expect(mockConfirmPruneImages).toHaveBeenCalled();
+    });
+
+    it('should not call API when user cancels confirmation', async () => {
+      mockConfirmPruneImages.mockResolvedValue(null);
+
+      let apiCalled = false;
+      server.use(
+        http.post('/api/endpoints/:envId/docker/images/prune', () => {
+          apiCalled = true;
+          return HttpResponse.json({ ImagesDeleted: [], SpaceReclaimed: 0 });
+        })
+      );
+
+      const user = userEvent.setup();
+      renderComponent([{ id: 'img1', used: false, tags: ['tag1'] }]);
+
+      const button = screen.getByRole('button', { name: /prune/i });
+      await user.click(button);
+
+      // Wait a bit to ensure no API call was made
+      await new Promise((resolve) => {
+        setTimeout(resolve, 100);
+      });
+
+      expect(apiCalled).toBe(false);
+    });
+
+    it('should call API with dangling filter when pruneAll is false', async () => {
+      mockConfirmPruneImages.mockResolvedValue({
+        pruneAll: false,
+        clearBuildCache: false,
+      });
+
+      let requestFilters = '';
+      server.use(
+        http.post(
+          '/api/endpoints/:envId/docker/images/prune',
+          ({ request }) => {
+            const url = new URL(request.url);
+            requestFilters = url.searchParams.get('filters') || '';
+            return HttpResponse.json({
+              ImagesDeleted: [{ Deleted: 'sha256:abc123' }],
+              SpaceReclaimed: 1024000,
+            });
+          }
+        )
+      );
+
+      const user = userEvent.setup();
+      renderComponent([{ id: 'img1', used: false, tags: ['tag1'] }]);
+
+      const button = screen.getByRole('button', { name: /prune/i });
+      await user.click(button);
+
+      await waitFor(() => {
+        expect(mockNotifySuccess).toHaveBeenCalled();
+      });
+
+      expect(JSON.parse(requestFilters)).toEqual({ dangling: ['true'] });
+    });
+
+    it('should call API with dangling=false filter when pruneAll is true', async () => {
+      mockConfirmPruneImages.mockResolvedValue({
+        pruneAll: true,
+        clearBuildCache: false,
+      });
+
+      let requestFilters = '';
+      server.use(
+        http.post(
+          '/api/endpoints/:envId/docker/images/prune',
+          ({ request }) => {
+            const url = new URL(request.url);
+            requestFilters = url.searchParams.get('filters') || '';
+            return HttpResponse.json({
+              ImagesDeleted: [
+                { Deleted: 'sha256:abc123' },
+                { Untagged: 'nginx:latest' },
+              ],
+              SpaceReclaimed: 5120000,
+            });
+          }
+        )
+      );
+
+      const user = userEvent.setup();
+      renderComponent([{ id: 'img1', used: false, tags: ['tag1'] }]);
+
+      const button = screen.getByRole('button', { name: /prune/i });
+      await user.click(button);
+
+      await waitFor(() => {
+        expect(mockNotifySuccess).toHaveBeenCalled();
+      });
+
+      expect(JSON.parse(requestFilters)).toEqual({ dangling: ['false'] });
+    });
+  });
+
+  describe('Success Notification', () => {
+    it('should show success notification with space reclaimed', async () => {
+      mockConfirmPruneImages.mockResolvedValue({
+        pruneAll: false,
+        clearBuildCache: false,
+      });
+
+      server.use(
+        http.post('/api/endpoints/:envId/docker/images/prune', () =>
+          HttpResponse.json({
+            ImagesDeleted: [
+              { Untagged: 'sha256:abc123' },
+              { Deleted: 'sha256:abc123' },
+              { Deleted: 'sha256:def456' },
+            ],
+            SpaceReclaimed: 104857600, // 100 MB
+          })
+        )
+      );
+
+      const user = userEvent.setup();
+      renderComponent([{ id: 'img1', used: false, tags: ['tag1'] }]);
+
+      const button = screen.getByRole('button', { name: /prune/i });
+      await user.click(button);
+
+      await waitFor(() => {
+        expect(mockNotifySuccess).toHaveBeenCalledWith(
+          'Images pruned',
+          'Reclaimed 104.9 MB'
+        );
+      });
+    });
+
+    it('should show success notification with correct space reclaimed', async () => {
+      mockConfirmPruneImages.mockResolvedValue({
+        pruneAll: false,
+        clearBuildCache: false,
+      });
+
+      server.use(
+        http.post('/api/endpoints/:envId/docker/images/prune', () =>
+          HttpResponse.json({
+            ImagesDeleted: [
+              { Deleted: 'sha256:abc123' },
+              { Deleted: 'sha256:def456' },
+              { Untagged: 'nginx:latest' },
+            ],
+            SpaceReclaimed: 5242880, // 5 MB
+          })
+        )
+      );
+
+      const user = userEvent.setup();
+      renderComponent([{ id: 'img1', used: false, tags: ['tag1'] }]);
+
+      const button = screen.getByRole('button', { name: /prune/i });
+      await user.click(button);
+
+      await waitFor(() => {
+        expect(mockNotifySuccess).toHaveBeenCalledWith(
+          'Images pruned',
+          'Reclaimed 5.2 MB'
+        );
+      });
+    });
+
+    it('should handle small space reclaimed', async () => {
+      mockConfirmPruneImages.mockResolvedValue({
+        pruneAll: false,
+        clearBuildCache: false,
+      });
+
+      server.use(
+        http.post('/api/endpoints/:envId/docker/images/prune', () =>
+          HttpResponse.json({
+            ImagesDeleted: [{ Deleted: 'sha256:abc123' }],
+            SpaceReclaimed: 2048, // ~2 KB
+          })
+        )
+      );
+
+      const user = userEvent.setup();
+      renderComponent([{ id: 'img1', used: false, tags: ['tag1'] }]);
+
+      const button = screen.getByRole('button', { name: /prune/i });
+      await user.click(button);
+
+      await waitFor(() => {
+        expect(mockNotifySuccess).toHaveBeenCalledWith(
+          'Images pruned',
+          'Reclaimed 2 kB'
+        );
+      });
+    });
+
+    it('should show contextual message when zero bytes reclaimed', async () => {
+      mockConfirmPruneImages.mockResolvedValue({
+        pruneAll: false,
+        clearBuildCache: false,
+      });
+
+      server.use(
+        http.post('/api/endpoints/:envId/docker/images/prune', () =>
+          HttpResponse.json({
+            ImagesDeleted: null,
+            SpaceReclaimed: 0,
+          })
+        )
+      );
+
+      const user = userEvent.setup();
+      renderComponent([{ id: 'img1', used: false, tags: ['tag1'] }]);
+
+      const button = screen.getByRole('button', { name: /prune/i });
+      await user.click(button);
+
+      await waitFor(() => {
+        expect(mockNotifySuccess).toHaveBeenCalledWith(
+          'Images pruned',
+          'Reclaimed 0 B - the image layers may still be in use by other images, or are still in the Docker build cache.'
+        );
+      });
+    });
+
+    it('should call build cache prune API when clearBuildCache is toggled', async () => {
+      mockConfirmPruneImages.mockResolvedValue({
+        pruneAll: false,
+        clearBuildCache: true,
+      });
+
+      let buildPruneCalled = false;
+      server.use(
+        http.post('/api/endpoints/:envId/docker/images/prune', () =>
+          HttpResponse.json({ ImagesDeleted: [], SpaceReclaimed: 0 })
+        ),
+        http.post('/api/endpoints/:envId/docker/build/prune', () => {
+          buildPruneCalled = true;
+          return HttpResponse.json({ CachesDeleted: [], SpaceReclaimed: 0 });
+        })
+      );
+
+      const user = userEvent.setup();
+      renderComponent([{ id: 'img1', used: false, tags: ['tag1'] }]);
+      await user.click(screen.getByRole('button', { name: /prune/i }));
+
+      await waitFor(() => expect(mockNotifySuccess).toHaveBeenCalled());
+      expect(buildPruneCalled).toBe(true);
+    });
+
+    it('should not call build cache prune API when clearBuildCache is false', async () => {
+      mockConfirmPruneImages.mockResolvedValue({
+        pruneAll: false,
+        clearBuildCache: false,
+      });
+
+      let buildPruneCalled = false;
+      server.use(
+        http.post('/api/endpoints/:envId/docker/images/prune', () =>
+          HttpResponse.json({ ImagesDeleted: [], SpaceReclaimed: 0 })
+        ),
+        http.post('/api/endpoints/:envId/docker/build/prune', () => {
+          buildPruneCalled = true;
+          return HttpResponse.json({ CachesDeleted: [], SpaceReclaimed: 0 });
+        })
+      );
+
+      const user = userEvent.setup();
+      renderComponent([{ id: 'img1', used: false, tags: ['tag1'] }]);
+      await user.click(screen.getByRole('button', { name: /prune/i }));
+
+      await waitFor(() => expect(mockNotifySuccess).toHaveBeenCalled());
+      expect(buildPruneCalled).toBe(false);
+    });
+
+    it('should show combined space reclaimed from image and build cache prune', async () => {
+      mockConfirmPruneImages.mockResolvedValue({
+        pruneAll: false,
+        clearBuildCache: true,
+      });
+
+      server.use(
+        http.post('/api/endpoints/:envId/docker/images/prune', () =>
+          HttpResponse.json({ ImagesDeleted: [], SpaceReclaimed: 52428800 })
+        ),
+        http.post('/api/endpoints/:envId/docker/build/prune', () =>
+          HttpResponse.json({ CachesDeleted: [], SpaceReclaimed: 52428800 })
+        )
+      );
+
+      const user = userEvent.setup();
+      renderComponent([{ id: 'img1', used: false, tags: ['tag1'] }]);
+      await user.click(screen.getByRole('button', { name: /prune/i }));
+
+      await waitFor(() =>
+        expect(mockNotifySuccess).toHaveBeenCalledWith(
+          'Images pruned',
+          'Reclaimed 104.9 MB'
+        )
+      );
+    });
+  });
+
+  describe('Error Handling', () => {
+    it('should show error notification on API failure', async () => {
+      mockConfirmPruneImages.mockResolvedValue({
+        pruneAll: false,
+        clearBuildCache: false,
+      });
+
+      server.use(
+        http.post('/api/endpoints/:envId/docker/images/prune', () =>
+          HttpResponse.json({ message: 'Server error' }, { status: 500 })
+        )
+      );
+
+      const user = userEvent.setup();
+      renderComponent([{ id: 'img1', used: false, tags: ['tag1'] }]);
+
+      const button = screen.getByRole('button', { name: /prune/i });
+      await user.click(button);
+
+      await waitFor(() => {
+        expect(mockNotifyError).toHaveBeenCalledWith(
+          'Failed to prune images',
+          expect.anything()
+        );
+      });
+    });
+
+    it('should show success for images pruned and separate error when build cache prune fails', async () => {
+      mockConfirmPruneImages.mockResolvedValue({
+        pruneAll: false,
+        clearBuildCache: true,
+      });
+
+      server.use(
+        http.post('/api/endpoints/:envId/docker/images/prune', () =>
+          HttpResponse.json({ ImagesDeleted: [], SpaceReclaimed: 0 })
+        ),
+        http.post('/api/endpoints/:envId/docker/build/prune', () =>
+          HttpResponse.json({ message: 'Server error' }, { status: 500 })
+        )
+      );
+
+      const user = userEvent.setup();
+      renderComponent([{ id: 'img1', used: false, tags: ['tag1'] }]);
+      await user.click(screen.getByRole('button', { name: /prune/i }));
+
+      await waitFor(() => {
+        expect(mockNotifySuccess).toHaveBeenCalledWith(
+          'Images pruned',
+          expect.stringContaining('Reclaimed 0 B')
+        );
+        expect(mockNotifyError).toHaveBeenCalledWith(
+          'Failed to clear Docker build cache',
+          expect.anything()
+        );
+      });
+    });
+  });
+
+  describe('Loading State', () => {
+    it('should show loading state while pruning', async () => {
+      mockConfirmPruneImages.mockResolvedValue({
+        pruneAll: false,
+        clearBuildCache: false,
+      });
+
+      // Use a deferred promise so we control exactly when the request resolves,
+      // avoiding non-deterministic setTimeout timing.
+      let resolveRequest!: () => void;
+      const requestDeferred = new Promise<void>((resolve) => {
+        resolveRequest = resolve;
+      });
+
+      server.use(
+        http.post('/api/endpoints/:envId/docker/images/prune', async () => {
+          await requestDeferred;
+          return HttpResponse.json({
+            ImagesDeleted: [],
+            SpaceReclaimed: 0,
+          });
+        })
+      );
+
+      const user = userEvent.setup();
+      renderComponent([{ id: 'img1', used: false, tags: ['tag1'] }]);
+
+      const button = screen.getByRole('button', { name: /prune/i });
+      await user.click(button);
+
+      await waitFor(() => {
+        expect(screen.getByText('Pruning...')).toBeVisible();
+      });
+
+      resolveRequest();
+
+      // Wait for the in-flight request to complete before the test exits.
+      await waitFor(() => expect(mockNotifySuccess).toHaveBeenCalled(), {
+        timeout: 3000,
+      });
+
+      // Flush any remaining queued XHR events (e.g. loadend ProgressEvent) so
+      // they fire before jsdom tears down the environment, preventing an
+      // "ProgressEvent is not defined" unhandled rejection.
+      await new Promise((resolve) => {
+        setTimeout(resolve, 0);
+      });
+    });
+  });
+});
+
+function renderComponent(
+  images: Array<{ id: string; used: boolean; tags: string[] }> = []
+) {
+  const imagesWithDefaults = images.map((img) => ({
+    id: img.id,
+    used: img.used,
+    tags: img.tags,
+    created: 0,
+    size: 0,
+  }));
+  const Wrapped = withTestQueryProvider(
+    withTestRouter(() => <PruneButton images={imagesWithDefaults} />)
+  );
+  return render(<Wrapped />);
+}
diff --git a/app/react/docker/images/ListView/ImagesDatatable/PruneButton.tsx b/app/react/docker/images/ListView/ImagesDatatable/PruneButton.tsx
new file mode 100644
index 0000000..2daf9f6
--- /dev/null
+++ b/app/react/docker/images/ListView/ImagesDatatable/PruneButton.tsx
@@ -0,0 +1,82 @@
+import { BrushCleaning, Check } from 'lucide-react';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { notifySuccess, notifyError } from '@/portainer/services/notifications';
+import { Authorized } from '@/react/hooks/useUser';
+import { humanize } from '@/portainer/filters/filters';
+
+import { LoadingButton } from '@@/buttons';
+import { TooltipWithChildren } from '@@/Tip/TooltipWithChildren';
+
+import { usePruneImagesMutation } from '../../queries/usePruneImagesMutation';
+import { ImagesListResponse } from '../../queries/useImages';
+
+import { confirmPruneImages } from './ConfirmPruneModal';
+
+interface Props {
+  images: ImagesListResponse[];
+}
+
+export function PruneButton({ images }: Props) {
+  const environmentId = useEnvironmentId();
+  const pruneMutation = usePruneImagesMutation(environmentId);
+
+  const hasPrunableImages = images.some((image) => !image.used);
+
+  const button = (
+    <LoadingButton
+      color="default"
+      icon={hasPrunableImages ? BrushCleaning : Check}
+      onClick={handlePrune}
+      isLoading={pruneMutation.isLoading}
+      loadingText="Pruning..."
+      data-cy="image-pruneButton"
+      disabled={!hasPrunableImages}
+    >
+      Prune
+    </LoadingButton>
+  );
+
+  if (hasPrunableImages) {
+    return (
+      <Authorized authorizations="DockerImagePrune" adminOnlyCE>
+        {button}
+      </Authorized>
+    );
+  }
+
+  return (
+    <Authorized authorizations="DockerImagePrune" adminOnlyCE>
+      <TooltipWithChildren message="No unused images available to prune">
+        <span>{button}</span>
+      </TooltipWithChildren>
+    </Authorized>
+  );
+
+  async function handlePrune() {
+    const result = await confirmPruneImages(images);
+
+    if (!result) {
+      return;
+    }
+
+    pruneMutation.mutate(
+      { all: result.pruneAll, clearBuildCache: result.clearBuildCache },
+      {
+        onSuccess: ({ SpaceReclaimed, buildCacheError }) => {
+          const message =
+            SpaceReclaimed === 0
+              ? 'Reclaimed 0 B - the image layers may still be in use by other images, or are still in the Docker build cache.'
+              : `Reclaimed ${humanize(SpaceReclaimed)}`;
+          notifySuccess('Images pruned', message);
+          if (buildCacheError) {
+            notifyError('Failed to clear Docker build cache', buildCacheError);
+          }
+        },
+        onError: (error) => {
+          notifyError('Failed to prune images', error);
+        },
+      }
+    );
+  }
+}
diff --git a/app/react/docker/images/ListView/ImagesDatatable/RemoveButtonMenu.tsx b/app/react/docker/images/ListView/ImagesDatatable/RemoveButtonMenu.tsx
new file mode 100644
index 0000000..299a959
--- /dev/null
+++ b/app/react/docker/images/ListView/ImagesDatatable/RemoveButtonMenu.tsx
@@ -0,0 +1,122 @@
+import { ChevronDown, Trash2 } from 'lucide-react';
+import { Menu, MenuButton, MenuItem, MenuPopover } from '@reach/menu-button';
+import { positionRight } from '@reach/popover';
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { Authorized } from '@/react/hooks/useUser';
+import { withInvalidate } from '@/react-tools/react-query';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { notifySuccess } from '@/portainer/services/notifications';
+import { processItemsInBatches } from '@/react/common/processItemsInBatches';
+
+import { Button, ButtonGroup } from '@@/buttons';
+import { ButtonWithRef } from '@@/buttons/Button';
+import { confirmDestructive } from '@@/modals/confirm';
+import { buildConfirmButton } from '@@/modals/utils';
+
+import { ImagesListResponse } from '../../queries/useImages';
+import { queryKeys } from '../../queries/queryKeys';
+import { deleteImage } from '../../queries/useDeleteImageMutation';
+
+export function RemoveButtonMenu({
+  selectedItems,
+}: {
+  selectedItems: Array<ImagesListResponse>;
+}) {
+  const deleteImageListMutation = useDeleteImageListMutation();
+
+  return (
+    <Authorized authorizations="DockerImageDelete">
+      <ButtonGroup>
+        <Button
+          size="small"
+          color="dangerlight"
+          icon={Trash2}
+          disabled={selectedItems.length === 0}
+          data-cy="image-removeImageButton"
+          onClick={() => {
+            handleRemove(false);
+          }}
+        >
+          Remove
+        </Button>
+        <Menu>
+          <MenuButton
+            as={ButtonWithRef}
+            size="small"
+            color="dangerlight"
+            disabled={selectedItems.length === 0}
+            icon={ChevronDown}
+            data-cy="image-toggleRemoveButtonMenu"
+          >
+            <span className="sr-only">Toggle Dropdown</span>
+          </MenuButton>
+          <MenuPopover position={positionRight}>
+            <div className="mt-3 bg-white th-highcontrast:bg-black th-dark:bg-black">
+              <MenuItem
+                onSelect={() => {
+                  handleRemove(true);
+                }}
+              >
+                Force Remove
+              </MenuItem>
+            </div>
+          </MenuPopover>
+        </Menu>
+      </ButtonGroup>
+    </Authorized>
+  );
+
+  function confirmForceRemove() {
+    return confirmDestructive({
+      title: 'Are you sure?',
+      message:
+        "Forcing removal of an image will remove it even if it's used by stopped containers, and delete all associated tags. Are you sure you want to remove the selected image(s)?",
+      confirmButton: buildConfirmButton('Remove the image', 'danger'),
+    });
+  }
+
+  function confirmRegularRemove() {
+    return confirmDestructive({
+      title: 'Are you sure?',
+      message:
+        'Removing an image will also delete all associated tags. Are you sure you want to remove the selected image(s)?',
+      confirmButton: buildConfirmButton('Remove the image', 'danger'),
+    });
+  }
+
+  async function handleRemove(force: boolean) {
+    const confirmed = await (force
+      ? confirmForceRemove()
+      : confirmRegularRemove());
+
+    if (!confirmed) {
+      return;
+    }
+
+    deleteImageListMutation.mutate({
+      imageIds: selectedItems.map((image) => image.id),
+      force,
+    });
+  }
+}
+
+function useDeleteImageListMutation() {
+  const environmentId = useEnvironmentId();
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: ({
+      imageIds,
+      ...args
+    }: {
+      imageIds: Array<string>;
+    } & Omit<Parameters<typeof deleteImage>[0], 'imageId' | 'environmentId'>) =>
+      processItemsInBatches(imageIds, (imageId) =>
+        deleteImage({ ...args, environmentId, imageId }).then(() =>
+          notifySuccess('Image successfully removed', imageId)
+        )
+      ),
+    ...withInvalidate(queryClient, [queryKeys.base(environmentId)]),
+  });
+}
diff --git a/app/react/docker/images/ListView/ImagesDatatable/columns/created.tsx b/app/react/docker/images/ListView/ImagesDatatable/columns/created.tsx
new file mode 100644
index 0000000..cf102e0
--- /dev/null
+++ b/app/react/docker/images/ListView/ImagesDatatable/columns/created.tsx
@@ -0,0 +1,12 @@
+import { isoDateFromTimestamp } from '@/portainer/filters/filters';
+
+import { columnHelper } from './helper';
+
+export const created = columnHelper.accessor('created', {
+  id: 'created',
+  header: 'Created',
+  cell: ({ getValue }) => {
+    const value = getValue();
+    return isoDateFromTimestamp(value);
+  },
+});
diff --git a/app/react/docker/images/ListView/ImagesDatatable/columns/helper.ts b/app/react/docker/images/ListView/ImagesDatatable/columns/helper.ts
new file mode 100644
index 0000000..e7957b4
--- /dev/null
+++ b/app/react/docker/images/ListView/ImagesDatatable/columns/helper.ts
@@ -0,0 +1,5 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { ImagesListResponse } from '@/react/docker/images/queries/useImages';
+
+export const columnHelper = createColumnHelper<ImagesListResponse>();
diff --git a/app/react/docker/images/ListView/ImagesDatatable/columns/host.tsx b/app/react/docker/images/ListView/ImagesDatatable/columns/host.tsx
new file mode 100644
index 0000000..13772ff
--- /dev/null
+++ b/app/react/docker/images/ListView/ImagesDatatable/columns/host.tsx
@@ -0,0 +1,9 @@
+import { columnHelper } from './helper';
+
+export const host = columnHelper.accessor('nodeName', {
+  header: 'Host',
+  cell: ({ getValue }) => {
+    const value = getValue();
+    return value || '-';
+  },
+});
diff --git a/app/react/docker/images/ListView/ImagesDatatable/columns/id.tsx b/app/react/docker/images/ListView/ImagesDatatable/columns/id.tsx
new file mode 100644
index 0000000..d0de59d
--- /dev/null
+++ b/app/react/docker/images/ListView/ImagesDatatable/columns/id.tsx
@@ -0,0 +1,81 @@
+import { CellContext, Column } from '@tanstack/react-table';
+
+import { truncate } from '@/portainer/filters/filters';
+import { getValueAsArrayOfStrings } from '@/portainer/helpers/array';
+import { ImagesListResponse } from '@/react/docker/images/queries/useImages';
+
+import { MultipleSelectionFilter } from '@@/datatables/Filter';
+import { UnusedBadge } from '@@/Badge/UnusedBadge';
+import { Link } from '@@/Link';
+
+import { columnHelper } from './helper';
+
+export const id = columnHelper.accessor('id', {
+  id: 'id',
+  header: 'Id',
+  cell: Cell,
+  enableColumnFilter: true,
+  filterFn: (
+    { original: { used } },
+    columnId,
+    filterValue: Array<'Used' | 'Unused'>
+  ) => {
+    if (filterValue.length === 0) {
+      return true;
+    }
+
+    if (filterValue.includes('Used') && used) {
+      return true;
+    }
+
+    if (filterValue.includes('Unused') && !used) {
+      return true;
+    }
+
+    return false;
+  },
+  meta: {
+    filter: FilterByUsage,
+  },
+});
+
+function FilterByUsage<TData extends { Used: boolean }>({
+  column: { getFilterValue, setFilterValue, id },
+}: {
+  column: Column<TData>;
+}) {
+  const options = ['Used', 'Unused'];
+
+  const value = getFilterValue();
+
+  const valueAsArray = getValueAsArrayOfStrings(value);
+
+  return (
+    <MultipleSelectionFilter
+      options={options}
+      filterKey={id}
+      value={valueAsArray}
+      onChange={setFilterValue}
+      menuTitle="Filter by usage"
+    />
+  );
+}
+
+function Cell({
+  row: { original: item },
+}: CellContext<ImagesListResponse, string>) {
+  return (
+    <>
+      <Link
+        to=".image"
+        params={{ id: item.id, nodeName: item.nodeName }}
+        title={item.id}
+        data-cy={`image-link-${item.id}`}
+        className="mr-2"
+      >
+        {truncate(item.id, 40)}
+      </Link>
+      {!item.used && <UnusedBadge />}
+    </>
+  );
+}
diff --git a/app/react/docker/images/ListView/ImagesDatatable/columns/index.ts b/app/react/docker/images/ListView/ImagesDatatable/columns/index.ts
new file mode 100644
index 0000000..6b24c29
--- /dev/null
+++ b/app/react/docker/images/ListView/ImagesDatatable/columns/index.ts
@@ -0,0 +1,6 @@
+import { created } from './created';
+import { id } from './id';
+import { size } from './size';
+import { tags } from './tags';
+
+export const columns = [id, tags, size, created];
diff --git a/app/react/docker/images/ListView/ImagesDatatable/columns/size.tsx b/app/react/docker/images/ListView/ImagesDatatable/columns/size.tsx
new file mode 100644
index 0000000..adabd34
--- /dev/null
+++ b/app/react/docker/images/ListView/ImagesDatatable/columns/size.tsx
@@ -0,0 +1,12 @@
+import { humanize } from '@/portainer/filters/filters';
+
+import { columnHelper } from './helper';
+
+export const size = columnHelper.accessor('size', {
+  id: 'size',
+  header: 'Size',
+  cell: ({ getValue }) => {
+    const value = getValue();
+    return humanize(value) || '-';
+  },
+});
diff --git a/app/react/docker/images/ListView/ImagesDatatable/columns/tags.tsx b/app/react/docker/images/ListView/ImagesDatatable/columns/tags.tsx
new file mode 100644
index 0000000..b1a0653
--- /dev/null
+++ b/app/react/docker/images/ListView/ImagesDatatable/columns/tags.tsx
@@ -0,0 +1,47 @@
+import { CellContext } from '@tanstack/react-table';
+
+import { ImagesListResponse } from '@/react/docker/images/queries/useImages';
+
+import { Badge } from '@@/Badge';
+import { Tooltip } from '@@/Tip/Tooltip/Tooltip';
+
+import { columnHelper } from './helper';
+
+export const tags = columnHelper.accessor(
+  (item) => (isDangling(item.tags) ? 'Dangling' : item.tags?.join(',')),
+  {
+    id: 'tags',
+    header: 'Tags',
+    cell: Cell,
+  }
+);
+
+function Cell({
+  row: { original: item },
+}: CellContext<ImagesListResponse, unknown>) {
+  const repoTags = item.tags;
+  const isDanglingImage = isDangling(repoTags);
+
+  if (isDanglingImage) {
+    return (
+      <Badge type="muted">
+        Dangling
+        <Tooltip message="Dangling images are untagged and no longer referenced by any repository." />
+      </Badge>
+    );
+  }
+
+  return (
+    <div className="flex flex-wrap gap-1">
+      {repoTags?.map((tag, idx) => (
+        <Badge key={idx} type="info">
+          {tag}
+        </Badge>
+      ))}
+    </div>
+  );
+}
+
+function isDangling(tags?: string[]) {
+  return !tags || tags.length === 0;
+}
diff --git a/app/react/docker/images/ListView/ListView.test.tsx b/app/react/docker/images/ListView/ListView.test.tsx
new file mode 100644
index 0000000..24eeb15
--- /dev/null
+++ b/app/react/docker/images/ListView/ListView.test.tsx
@@ -0,0 +1,96 @@
+import { render, screen } from '@testing-library/react';
+import { vi } from 'vitest';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+
+import { useIsSwarmAgent } from '../../proxy/queries/useIsSwarmAgent';
+
+import { ListView } from './ListView';
+
+vi.mock('../../proxy/queries/useIsSwarmAgent');
+vi.mock('./PullImageFormWidget', () => ({
+  PullImageFormWidget: ({ isNodeVisible }: { isNodeVisible: boolean }) => (
+    <div data-cy="pull-image-form-widget">
+      PullImageFormWidget - isNodeVisible: {String(isNodeVisible)}
+    </div>
+  ),
+}));
+vi.mock('./ImagesDatatable/ImagesDatatable', () => ({
+  ImagesDatatable: ({
+    isHostColumnVisible,
+  }: {
+    isHostColumnVisible: boolean;
+  }) => (
+    <div data-cy="images-datatable">
+      ImagesDatatable - isHostColumnVisible: {String(isHostColumnVisible)}
+    </div>
+  ),
+}));
+
+describe('ListView', () => {
+  afterEach(() => {
+    vi.resetAllMocks();
+  });
+
+  describe('Rendering', () => {
+    it('should render all main sections', async () => {
+      vi.mocked(useIsSwarmAgent).mockReturnValue(false);
+
+      renderComponent();
+
+      // PageHeader with title
+      expect(
+        screen.getByRole('heading', { name: /image list/i })
+      ).toBeVisible();
+
+      // PullImageFormWidget
+      expect(screen.getByTestId('pull-image-form-widget')).toBeVisible();
+
+      // ImagesDatatable
+      expect(screen.getByTestId('images-datatable')).toBeVisible();
+    });
+  });
+
+  describe('Swarm Agent Integration', () => {
+    it('should pass isNodeVisible=false to child components when not swarm agent', async () => {
+      vi.mocked(useIsSwarmAgent).mockReturnValue(false);
+
+      renderComponent();
+
+      // Verify PullImageFormWidget receives isNodeVisible={false}
+      expect(screen.getByTestId('pull-image-form-widget')).toHaveTextContent(
+        'isNodeVisible: false'
+      );
+
+      // Verify ImagesDatatable receives isHostColumnVisible={false}
+      expect(screen.getByTestId('images-datatable')).toHaveTextContent(
+        'isHostColumnVisible: false'
+      );
+    });
+
+    it('should pass isNodeVisible=true to child components when swarm agent', async () => {
+      vi.mocked(useIsSwarmAgent).mockReturnValue(true);
+
+      renderComponent();
+
+      // Verify PullImageFormWidget receives isNodeVisible={true}
+      expect(screen.getByTestId('pull-image-form-widget')).toHaveTextContent(
+        'isNodeVisible: true'
+      );
+
+      // Verify ImagesDatatable receives isHostColumnVisible={true}
+      expect(screen.getByTestId('images-datatable')).toHaveTextContent(
+        'isHostColumnVisible: true'
+      );
+    });
+  });
+});
+
+function renderComponent() {
+  const Wrapped = withTestQueryProvider(
+    withUserProvider(withTestRouter(ListView))
+  );
+  return render(<Wrapped />);
+}
diff --git a/app/react/docker/images/ListView/ListView.tsx b/app/react/docker/images/ListView/ListView.tsx
new file mode 100644
index 0000000..87e13c6
--- /dev/null
+++ b/app/react/docker/images/ListView/ListView.tsx
@@ -0,0 +1,24 @@
+import { PageHeader } from '@@/PageHeader';
+
+import { useIsSwarmAgent } from '../../proxy/queries/useIsSwarmAgent';
+
+import { PullImageFormWidget } from './PullImageFormWidget';
+import { ImagesDatatable } from './ImagesDatatable/ImagesDatatable';
+
+export function ListView() {
+  const isSwarmAgent = useIsSwarmAgent();
+
+  return (
+    <>
+      <PageHeader title="Image list" breadcrumbs="Images" reload />
+
+      <div className="row">
+        <div className="col-sm-12">
+          <PullImageFormWidget isNodeVisible={isSwarmAgent} />
+        </div>
+      </div>
+
+      <ImagesDatatable isHostColumnVisible={isSwarmAgent} />
+    </>
+  );
+}
diff --git a/app/react/docker/images/ListView/PullImageFormWidget.Form.tsx b/app/react/docker/images/ListView/PullImageFormWidget.Form.tsx
new file mode 100644
index 0000000..3f91230
--- /dev/null
+++ b/app/react/docker/images/ListView/PullImageFormWidget.Form.tsx
@@ -0,0 +1,54 @@
+import { Form, useFormikContext } from 'formik';
+
+import { ImageConfigFieldset } from '@@/ImageConfigFieldset';
+import { FormSection } from '@@/form-components/FormSection';
+import { FormActions } from '@@/form-components/FormActions';
+
+import { NodeSelector } from '../../agent/NodeSelector';
+
+import { FormValues } from './PullImageFormWidget.types';
+
+export function PullImageForm({
+  onRateLimit,
+  isLoading,
+  isNodeVisible,
+}: {
+  onRateLimit: (limited?: boolean) => void;
+  isLoading: boolean;
+  isNodeVisible: boolean;
+}) {
+  const { values, setFieldValue, errors, isValid } =
+    useFormikContext<FormValues>();
+
+  return (
+    <Form className="form-horizontal">
+      <ImageConfigFieldset
+        autoComplete
+        values={values.config}
+        setFieldValue={(field, value) =>
+          setFieldValue(`config.${field}`, value)
+        }
+        errors={errors.config}
+        onRateLimit={onRateLimit}
+      >
+        {isNodeVisible && (
+          <FormSection title="Deployment">
+            <NodeSelector
+              value={values.node}
+              onChange={(node) => setFieldValue('node', node)}
+              error={errors.node}
+            />
+          </FormSection>
+        )}
+
+        <FormActions
+          isLoading={isLoading}
+          isValid={isValid}
+          loadingText="Download in progress..."
+          submitLabel="Pull the image"
+          data-cy="pull-image-button"
+        />
+      </ImageConfigFieldset>
+    </Form>
+  );
+}
diff --git a/app/react/docker/images/ListView/PullImageFormWidget.test.tsx b/app/react/docker/images/ListView/PullImageFormWidget.test.tsx
new file mode 100644
index 0000000..3f014c5
--- /dev/null
+++ b/app/react/docker/images/ListView/PullImageFormWidget.test.tsx
@@ -0,0 +1,175 @@
+import { render, screen } from '@testing-library/react';
+import { vi } from 'vitest';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { useAuthorizations } from '@/react/hooks/useUser';
+
+import { usePullImageMutation } from '../queries/usePullImageMutation';
+
+import { PullImageFormWidget } from './PullImageFormWidget';
+
+// Mocks
+vi.mock(
+  '@/react/hooks/useUser',
+  async (importOriginal: () => Promise<object>) => {
+    const actual = await importOriginal();
+    return {
+      ...actual,
+      useAuthorizations: vi.fn(),
+    };
+  }
+);
+
+vi.mock('@/react/hooks/useEnvironmentId', () => ({
+  useEnvironmentId: () => 1,
+}));
+
+vi.mock('@/portainer/services/notifications', () => ({
+  notifySuccess: vi.fn(),
+}));
+
+vi.mock('../queries/usePullImageMutation', () => ({
+  usePullImageMutation: vi.fn(() => ({
+    mutate: vi.fn(),
+    isLoading: false,
+  })),
+}));
+
+vi.mock('@@/ImageConfigFieldset/getImageConfig', () => ({
+  getDefaultImageConfig: () => ({
+    image: '',
+    registryId: 0,
+    useRegistry: false,
+  }),
+}));
+
+// Mock child components to simplify tests
+vi.mock('./PullImageFormWidget.Form', () => ({
+  PullImageForm: ({
+    isNodeVisible,
+    isLoading,
+  }: {
+    isNodeVisible: boolean;
+    isLoading: boolean;
+  }) => (
+    <form data-cy="pull-image-form">
+      <input aria-label="Image name" name="image" data-cy="image-input" />
+      {isNodeVisible && (
+        <select aria-label="Node" name="node" data-cy="node-selector">
+          <option value="">Select a node</option>
+          <option value="node1">Node 1</option>
+          <option value="node2">Node 2</option>
+        </select>
+      )}
+      <button type="submit" disabled={isLoading} data-cy="pull-image-button">
+        {isLoading ? 'Download in progress...' : 'Pull the image'}
+      </button>
+    </form>
+  ),
+}));
+
+describe('PullImageFormWidget', () => {
+  afterEach(() => {
+    vi.clearAllMocks();
+  });
+
+  describe('Authorization', () => {
+    it('should render widget when user has DockerImageCreate authorization', () => {
+      vi.mocked(useAuthorizations).mockReturnValue({
+        authorized: true,
+        isLoading: false,
+      });
+
+      renderComponent({ isNodeVisible: false });
+
+      expect(
+        screen.getByRole('heading', { name: /pull image/i })
+      ).toBeVisible();
+      expect(screen.getByTestId('pull-image-form')).toBeVisible();
+    });
+
+    it('should not render when user lacks DockerImageCreate authorization', () => {
+      vi.mocked(useAuthorizations).mockReturnValue({
+        authorized: false,
+        isLoading: false,
+      });
+
+      renderComponent({ isNodeVisible: false });
+
+      expect(
+        screen.queryByRole('heading', { name: /pull image/i })
+      ).not.toBeInTheDocument();
+      expect(screen.queryByTestId('pull-image-form')).not.toBeInTheDocument();
+    });
+  });
+
+  describe('Form Rendering', () => {
+    beforeEach(() => {
+      vi.mocked(useAuthorizations).mockReturnValue({
+        authorized: true,
+        isLoading: false,
+      });
+    });
+
+    it('should render widget with title "Pull image"', () => {
+      renderComponent({ isNodeVisible: false });
+
+      expect(
+        screen.getByRole('heading', { name: /pull image/i })
+      ).toBeVisible();
+    });
+
+    it('should not render NodeSelector when isNodeVisible=false', () => {
+      renderComponent({ isNodeVisible: false });
+
+      expect(screen.queryByLabelText(/node/i)).not.toBeInTheDocument();
+      expect(screen.queryByTestId('node-selector')).not.toBeInTheDocument();
+    });
+
+    it('should render NodeSelector when isNodeVisible=true', () => {
+      renderComponent({ isNodeVisible: true });
+
+      expect(screen.getByLabelText(/node/i)).toBeVisible();
+      expect(screen.getByTestId('node-selector')).toBeVisible();
+    });
+  });
+
+  describe('Mutation Hook Setup', () => {
+    beforeEach(() => {
+      vi.mocked(useAuthorizations).mockReturnValue({
+        authorized: true,
+        isLoading: false,
+      });
+    });
+
+    it('should initialize usePullImageMutation with correct environment ID', async () => {
+      const mockUsePullImageMutation = vi.mocked(usePullImageMutation);
+
+      renderComponent({ isNodeVisible: false });
+
+      // Verify mutation hook was called with environment ID 1
+      expect(mockUsePullImageMutation).toHaveBeenCalledWith(1);
+    });
+
+    it('should show loading state during pull operation', async () => {
+      vi.mocked(usePullImageMutation).mockReturnValue({
+        mutate: vi.fn(),
+        isLoading: true,
+      } as unknown as ReturnType<typeof usePullImageMutation>);
+
+      renderComponent({ isNodeVisible: false });
+
+      const submitButton = screen.getByRole('button', {
+        name: /download in progress/i,
+      });
+      expect(submitButton).toBeVisible();
+      expect(submitButton).toBeDisabled();
+    });
+  });
+});
+
+function renderComponent({ isNodeVisible }: { isNodeVisible: boolean }) {
+  const Wrapped = withTestQueryProvider(withTestRouter(PullImageFormWidget));
+  return render(<Wrapped isNodeVisible={isNodeVisible} />);
+}
diff --git a/app/react/docker/images/ListView/PullImageFormWidget.tsx b/app/react/docker/images/ListView/PullImageFormWidget.tsx
new file mode 100644
index 0000000..6eb3e8f
--- /dev/null
+++ b/app/react/docker/images/ListView/PullImageFormWidget.tsx
@@ -0,0 +1,77 @@
+import { DownloadIcon } from 'lucide-react';
+import { Formik } from 'formik';
+import { useState } from 'react';
+
+import { useAuthorizations } from '@/react/hooks/useUser';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { getDefaultImageConfig } from '@@/ImageConfigFieldset/getImageConfig';
+import { Widget } from '@@/Widget';
+
+import { usePullImageMutation } from '../queries/usePullImageMutation';
+
+import { FormValues } from './PullImageFormWidget.types';
+import { PullImageForm } from './PullImageFormWidget.Form';
+import { useValidation } from './PullImageFormWidget.validation';
+
+export function PullImageFormWidget({
+  isNodeVisible,
+}: {
+  isNodeVisible: boolean;
+}) {
+  const envId = useEnvironmentId();
+  const mutation = usePullImageMutation(envId);
+  const authorizedQuery = useAuthorizations('DockerImageCreate');
+  const [isDockerhubRateLimited, setIsDockerhubRateLimited] = useState(false);
+
+  const validation = useValidation(isDockerhubRateLimited, isNodeVisible);
+
+  if (!authorizedQuery.authorized) {
+    return null;
+  }
+
+  const initialValues: FormValues = {
+    node: '',
+    config: getDefaultImageConfig(),
+  };
+
+  return (
+    <Widget>
+      <Widget.Title icon={DownloadIcon} title="Pull image" />
+      <Widget.Body>
+        <Formik
+          initialValues={initialValues}
+          onSubmit={handleSubmit}
+          validationSchema={validation}
+          validateOnMount
+        >
+          <PullImageForm
+            onRateLimit={(limited = false) =>
+              setIsDockerhubRateLimited(limited)
+            }
+            isLoading={mutation.isLoading}
+            isNodeVisible={isNodeVisible}
+          />
+        </Formik>
+      </Widget.Body>
+    </Widget>
+  );
+
+  function handleSubmit({ config, node }: FormValues) {
+    mutation.mutate(
+      {
+        environmentId: envId,
+        image: config.image,
+        nodeName: node,
+        registryId: config.registryId,
+        ignoreErrors: false,
+      },
+      {
+        onSuccess() {
+          notifySuccess('Image successfully pulled', config.image);
+        },
+      }
+    );
+  }
+}
diff --git a/app/react/docker/images/ListView/PullImageFormWidget.types.tsx b/app/react/docker/images/ListView/PullImageFormWidget.types.tsx
new file mode 100644
index 0000000..3e4f3e6
--- /dev/null
+++ b/app/react/docker/images/ListView/PullImageFormWidget.types.tsx
@@ -0,0 +1,6 @@
+import { ImageConfigValues } from '@@/ImageConfigFieldset';
+
+export interface FormValues {
+  config: ImageConfigValues;
+  node: string;
+}
diff --git a/app/react/docker/images/ListView/PullImageFormWidget.validation.test.tsx b/app/react/docker/images/ListView/PullImageFormWidget.validation.test.tsx
new file mode 100644
index 0000000..d00ab00
--- /dev/null
+++ b/app/react/docker/images/ListView/PullImageFormWidget.validation.test.tsx
@@ -0,0 +1,30 @@
+import { render } from '@testing-library/react';
+
+import { FormValues } from './PullImageFormWidget.types';
+import { useValidation } from './PullImageFormWidget.validation';
+
+function setup(...args: Parameters<typeof useValidation>) {
+  const returnVal: { schema?: ReturnType<typeof useValidation> } = {
+    schema: undefined,
+  };
+  function TestComponent() {
+    Object.assign(returnVal, { schema: useValidation(...args) });
+    return null;
+  }
+  render(<TestComponent />);
+  return returnVal;
+}
+
+test('image is required', async () => {
+  const { schema } = setup(false, false);
+  const object: FormValues = {
+    config: { image: '', registryId: 0, useRegistry: true },
+    node: '',
+  };
+
+  await expect(
+    schema?.validate(object, { strict: true })
+  ).rejects.toThrowErrorMatchingInlineSnapshot(
+    `[ValidationError: Image is required]`
+  );
+});
diff --git a/app/react/docker/images/ListView/PullImageFormWidget.validation.ts b/app/react/docker/images/ListView/PullImageFormWidget.validation.ts
new file mode 100644
index 0000000..3d95ffc
--- /dev/null
+++ b/app/react/docker/images/ListView/PullImageFormWidget.validation.ts
@@ -0,0 +1,26 @@
+import { useMemo } from 'react';
+import { SchemaOf, object, string } from 'yup';
+
+import { imageConfigValidation } from '@@/ImageConfigFieldset';
+
+import { FormValues } from './PullImageFormWidget.types';
+
+export function useValidation(
+  isDockerhubRateLimited: boolean,
+  isNodeVisible: boolean
+): SchemaOf<FormValues> {
+  return useMemo(
+    () =>
+      object({
+        config: imageConfigValidation().test(
+          'rate-limits',
+          'Rate limit exceeded',
+          () => !isDockerhubRateLimited
+        ),
+        node: isNodeVisible
+          ? string().required('Node is required')
+          : string().default(''),
+      }),
+    [isDockerhubRateLimited, isNodeVisible]
+  );
+}
diff --git a/app/react/docker/images/common/ConfirmExportModal.tsx b/app/react/docker/images/common/ConfirmExportModal.tsx
new file mode 100644
index 0000000..74e106b
--- /dev/null
+++ b/app/react/docker/images/common/ConfirmExportModal.tsx
@@ -0,0 +1,13 @@
+import { ModalType } from '@@/modals';
+import { openConfirm } from '@@/modals/confirm';
+import { buildConfirmButton } from '@@/modals/utils';
+
+export async function confirmImageExport() {
+  return openConfirm({
+    modalType: ModalType.Warn,
+    title: 'Caution',
+    message:
+      'The export may take several minutes, do not navigate away whilst the export is in progress.',
+    confirmButton: buildConfirmButton('Continue'),
+  });
+}
diff --git a/app/react/docker/images/queries/queryKeys.ts b/app/react/docker/images/queries/queryKeys.ts
new file mode 100644
index 0000000..79db4a0
--- /dev/null
+++ b/app/react/docker/images/queries/queryKeys.ts
@@ -0,0 +1,10 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { queryKeys as dockerQueryKeys } from '../../queries/utils';
+
+export const queryKeys = {
+  base: (environmentId: EnvironmentId) =>
+    [...dockerQueryKeys.root(environmentId), 'images'] as const,
+  list: (environmentId: EnvironmentId, options: { withUsage?: boolean } = {}) =>
+    [...queryKeys.base(environmentId), options] as const,
+};
diff --git a/app/react/docker/images/queries/useBuildImageMutation.ts b/app/react/docker/images/queries/useBuildImageMutation.ts
new file mode 100644
index 0000000..d3557ba
--- /dev/null
+++ b/app/react/docker/images/queries/useBuildImageMutation.ts
@@ -0,0 +1,288 @@
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { jsonObjectsToArrayHandler } from '@/portainer/helpers/json';
+
+import { buildDockerProxyUrl } from '../../proxy/queries/buildDockerProxyUrl';
+import { formatArrayQueryParamsForDockerAPI } from '../../proxy/queries/utils';
+
+export async function buildImageFromUpload(
+  environmentId: EnvironmentId,
+  names: string[],
+  file: File,
+  path: string
+) {
+  return buildImage(
+    environmentId,
+    { t: names, dockerfile: path },
+    file,
+    file.type
+  );
+}
+
+export async function buildImageFromURL(
+  environmentId: EnvironmentId,
+  names: string[],
+  url: string,
+  path: string
+) {
+  return buildImage(
+    environmentId,
+    { t: names, remote: url, dockerfile: path },
+    {},
+    'application/x-tar'
+  );
+}
+
+export async function buildImageFromDockerfileContent(
+  environmentId: EnvironmentId,
+  names: string[],
+  content: string
+) {
+  return buildImage(
+    environmentId,
+    { t: names },
+    { content },
+    'application/json'
+  );
+}
+
+export async function buildImageFromDockerfileContentAndFiles(
+  environmentId: EnvironmentId,
+  names: string[],
+  content: string,
+  files: File[]
+) {
+  const dockerfile = new Blob([content], { type: 'text/plain' });
+  const uploadFiles = [dockerfile, ...files];
+
+  const formData = new FormData();
+  uploadFiles.forEach((file, index) => {
+    formData.append(`file${index}`, file);
+  });
+
+  return buildImage(
+    environmentId,
+    { t: names },
+    formData,
+    'multipart/form-data'
+  );
+}
+
+/**
+ * Raw docker API proxy
+ *
+ * -----
+ *
+ * See api/http/proxy/factory/docker/build.go for the rules (copied below)
+ *
+ * buildOperation inspects the "Content-Type" header to determine if it needs to alter the request.
+ *
+ * -- buildImageFromUpload()
+ * If the value of the header is empty, it means that a Dockerfile is posted via upload, the function
+ * will extract the file content from the request body, tar it, and rewrite the body.
+ * !! THIS IS ONLY TRUE WHEN THE UPLOADED DOCKERFILE FILE HAS NO EXTENSION (the generated file.type in the frontend will be empty)
+ * If the Dockerfile is named like Dockerfile.yaml or has an internal type, a non-empty Content-Type header will be generated
+ *
+ * -- buildImageFromDockerfileContent()
+ * If the value of the header contains "application/json", it means that the content of a Dockerfile is posted
+ * in the request payload as JSON, the function will create a new file called Dockerfile inside a tar archive and
+ * rewrite the body of the request.
+ *
+ * -- buildImageFromUpload()
+ * -- buildImageFromURL()
+ * -- buildImageFromDockerfileContentAndFiles()
+ * In any other case, it will leave the request unaltered.
+ *
+ * -----
+ *
+ * @param environmentId
+ * @param params
+ * @param payload
+ * @param contentType
+ */
+async function buildImage(
+  environmentId: EnvironmentId,
+  params: BuildImageQueryParams,
+  payload: unknown,
+  contentType: string
+) {
+  try {
+    const { data } = await axios.post(
+      buildDockerProxyUrl(environmentId, 'build'),
+      payload,
+      {
+        headers: { 'Content-Type': contentType },
+        params,
+        transformResponse: jsonObjectsToArrayHandler,
+        paramsSerializer: formatArrayQueryParamsForDockerAPI,
+      }
+    );
+    return data;
+  } catch (err) {
+    throw parseAxiosError(err, 'Unable to build image');
+  }
+}
+
+type BuildImageQueryParams = {
+  /**
+   * Path within the build context to the Dockerfile.
+   * This is ignored if remote is specified and points to an external Dockerfile.
+   *
+   * @default "Dockerfile"
+   */
+  dockerfile?: string;
+
+  /**
+   * A name and optional tag to apply to the image in the name:tag format.
+   * If you omit the tag the default latest value is assumed.
+   * You can provide several t parameters.
+   */
+  t?: string[];
+
+  /**
+   * Extra hosts to add to /etc/hosts
+   */
+  extrahost?: string;
+
+  /**
+   * A Git repository URI or HTTP/HTTPS context URI.
+   * If the URI points to a single text file, the file’s contents are placed into a file called Dockerfile and the image is built from that file.
+   * If the URI points to a tarball, the file is downloaded by the daemon and the contents therein used as the context for the build.
+   * If the URI points to a tarball and the dockerfile parameter is also specified, there must be a file with the corresponding path inside the tarball.
+   */
+  remote?: string;
+
+  /**
+   * Suppress verbose build output.
+   *
+   * @default false
+   */
+  q?: boolean;
+
+  /**
+   * Do not use the cache when building the image.
+   *
+   * @default false
+   */
+  nocache?: boolean;
+
+  /**
+   * JSON array of images used for build cache resolution.
+   */
+  cachefrom?: string[];
+
+  /**
+   * Attempt to pull the image even if an older image exists locally.
+   */
+  pull?: string;
+
+  /**
+   * Remove intermediate containers after a successful build.
+   *
+   * @default true
+   */
+  rm?: boolean;
+
+  /**
+   * Always remove intermediate containers, even upon failure.
+   *
+   * @default false
+   */
+  forcerm?: boolean;
+
+  /**
+   * Set memory limit for build.
+   */
+  memory?: number;
+
+  /**
+   * Total memory (memory + swap).
+   *
+   * Set as -1 to disable swap.
+   */
+  memswap?: number;
+
+  /**
+   * CPU shares (relative weight).
+   */
+  cpushares?: number;
+
+  /**
+   * CPUs in which to allow execution (e.g., 0-3, 0,1).
+   */
+  cpusetcpus?: string;
+
+  /**
+   * The length of a CPU period in microseconds.
+   */
+  cpuperiod?: number;
+
+  /**
+   * Microseconds of CPU time that the container can get in a CPU period.
+   */
+  cpuquota?: number;
+
+  /**
+   * JSON map of string pairs for build-time variables. Users pass these values at build-time.
+   * Docker uses the buildargs as the environment context for commands run via the Dockerfile RUN instruction, or for variable expansion in other Dockerfile instructions.
+   * This is not meant for passing secret values.
+   * For example, the build arg FOO=bar would become {"FOO":"bar"} in JSON. This would result in the query parameter buildargs={"FOO":"bar"}.
+   * Note that {"FOO":"bar"} should be URI component encoded.
+   * Read more about the buildargs instruction.
+   */
+  buildargs?: string;
+
+  /**
+   * Size of /dev/shm in bytes. The size must be greater than 0. If omitted the system uses 64MB.
+   */
+  shmsize?: number;
+
+  /**
+   * Squash the resulting images layers into a single layer. (Experimental release only.)
+   */
+  squash?: boolean;
+
+  /**
+   * Arbitrary key/value labels to set on the image, as a JSON map of string pairs.
+   */
+  labels?: Record<string, string>;
+
+  /**
+   * Sets the networking mode for the run commands during build. Supported standard values are: bridge, host, none, and container:<name|id>.
+   * Any other value is taken as a custom network's name or ID to which this container should connect to.
+   */
+  networkmode?: string;
+
+  /**
+   * Platform in the format os[/arch[/variant]]
+   *
+   * @default ""
+   */
+  platform?: string;
+
+  /**
+   * Target build stage
+   *
+   * @default ""
+   */
+  target?: string;
+
+  /**
+   * BuildKit output configuration
+   *
+   * @default ""
+   */
+  outputs?: string;
+
+  /**
+   * Version of the builder backend to use.
+   *
+   * @enum {('1' | '2')}
+   *
+   * @default '1'
+   *
+   * - 1 is the first generation classic (deprecated) builder in the Docker daemon (default)
+   * - 2 is BuildKit
+   */
+  version?: string;
+};
diff --git a/app/react/docker/images/queries/useDeleteImageMutation.ts b/app/react/docker/images/queries/useDeleteImageMutation.ts
new file mode 100644
index 0000000..a5a4712
--- /dev/null
+++ b/app/react/docker/images/queries/useDeleteImageMutation.ts
@@ -0,0 +1,46 @@
+import { RawAxiosRequestHeaders } from 'axios';
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { withInvalidate } from '@/react-tools/react-query';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { buildDockerProxyUrl } from '../../proxy/queries/buildDockerProxyUrl';
+
+import { queryKeys } from './queryKeys';
+
+export function useDeleteImageMutation(envId: EnvironmentId) {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: deleteImage,
+    ...withInvalidate(queryClient, [queryKeys.base(envId)]),
+  });
+}
+
+export async function deleteImage({
+  environmentId,
+  imageId,
+  nodeName,
+  force,
+}: {
+  environmentId: EnvironmentId;
+  imageId: string;
+  nodeName?: string;
+  force?: boolean;
+}) {
+  const headers: RawAxiosRequestHeaders = {};
+
+  if (nodeName) {
+    headers['X-PortainerAgent-Target'] = nodeName;
+  }
+
+  try {
+    await axios.delete(buildDockerProxyUrl(environmentId, 'images', imageId), {
+      headers,
+      params: { force },
+    });
+  } catch (err) {
+    throw parseAxiosError(err as Error, 'Unable to delete image');
+  }
+}
diff --git a/app/react/docker/images/queries/useExportImageMutation.test.ts b/app/react/docker/images/queries/useExportImageMutation.test.ts
new file mode 100644
index 0000000..fd174b7
--- /dev/null
+++ b/app/react/docker/images/queries/useExportImageMutation.test.ts
@@ -0,0 +1,361 @@
+import { waitFor } from '@testing-library/react';
+import { renderHook } from '@testing-library/react-hooks';
+import { http, HttpResponse } from 'msw';
+import { saveAs } from 'file-saver';
+import { createElement, Fragment } from 'react';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { server } from '@/setup-tests/server';
+import { suppressConsoleLogs } from '@/setup-tests/suppress-console';
+
+import {
+  useExportMutation,
+  exportImage,
+  getImagesNamesForDownload,
+} from './useExportImageMutation';
+
+function renderMutationHook() {
+  const Wrapper = withTestQueryProvider(({ children }) =>
+    createElement(Fragment, null, children)
+  );
+
+  return renderHook(() => useExportMutation(), {
+    wrapper: Wrapper,
+  });
+}
+
+vi.mock('file-saver', () => ({
+  saveAs: vi.fn(),
+}));
+
+vi.mock('@uirouter/react', async (importOriginal: () => Promise<object>) => ({
+  ...(await importOriginal()),
+  useCurrentStateAndParams: vi.fn(() => ({
+    params: { endpointId: '1' },
+  })),
+}));
+
+describe('getImagesNamesForDownload', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('should return tag names when images have tags', () => {
+    const images = [
+      { id: 'sha256:abc123', tags: ['nginx:latest', 'nginx:1.21'] },
+      { id: 'sha256:def456', tags: ['redis:alpine'] },
+    ];
+
+    const result = getImagesNamesForDownload(images);
+
+    expect(result.names).toEqual(['nginx:latest', 'redis:alpine']);
+  });
+
+  it('should return image id when tags are undefined', () => {
+    const images = [
+      { id: 'sha256:abc123', tags: undefined },
+      { id: 'sha256:def456', tags: ['redis:alpine'] },
+    ];
+
+    const result = getImagesNamesForDownload(images);
+
+    expect(result.names).toEqual(['sha256:abc123', 'redis:alpine']);
+  });
+
+  it('should return image id when tag is <none>:<none>', () => {
+    const images = [
+      { id: 'sha256:abc123', tags: ['<none>:<none>'] },
+      { id: 'sha256:def456', tags: ['redis:alpine'] },
+    ];
+
+    const result = getImagesNamesForDownload(images);
+
+    expect(result.names).toEqual(['sha256:abc123', 'redis:alpine']);
+  });
+
+  it('should return image id when tags array is empty', () => {
+    const images = [
+      { id: 'sha256:abc123', tags: [] },
+      { id: 'sha256:def456', tags: ['redis:alpine'] },
+    ];
+
+    const result = getImagesNamesForDownload(images);
+
+    expect(result.names).toEqual(['sha256:abc123', 'redis:alpine']);
+  });
+});
+
+describe('exportImage', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('should export image and save file with correct filename', async () => {
+    const mockBlob = new Blob(['image data'], { type: 'application/x-tar' });
+
+    server.use(
+      http.get(
+        '/api/endpoints/:envId/docker/images/get',
+        () =>
+          new Response(mockBlob, {
+            headers: {
+              'content-disposition': 'attachment; filename=nginx-latest.tar',
+            },
+          })
+      )
+    );
+
+    await exportImage({
+      environmentId: 1,
+      nodeName: undefined,
+      images: [{ id: 'sha256:abc123', tags: ['nginx:latest'] }],
+    });
+
+    expect(saveAs).toHaveBeenCalledWith(mockBlob, 'nginx-latest.tar');
+  });
+
+  it('should include X-PortainerAgent-Target header when nodeName is provided', async () => {
+    let requestHeaders: Record<string, string | undefined> = {};
+
+    server.use(
+      http.get('/api/endpoints/:envId/docker/images/get', ({ request }) => {
+        requestHeaders = Object.fromEntries(request.headers.entries());
+        return new Response(new Blob(['image data']), {
+          headers: {
+            'content-disposition': 'attachment; filename=test.tar',
+          },
+        });
+      })
+    );
+
+    await exportImage({
+      environmentId: 1,
+      nodeName: 'worker-node-1',
+      images: [{ id: 'sha256:abc123', tags: ['nginx:latest'] }],
+    });
+
+    expect(requestHeaders['x-portaineragent-target']).toBe('worker-node-1');
+  });
+
+  it('should not include X-PortainerAgent-Target header when nodeName is undefined', async () => {
+    let requestHeaders: Record<string, string | undefined> = {};
+
+    server.use(
+      http.get('/api/endpoints/:envId/docker/images/get', ({ request }) => {
+        requestHeaders = Object.fromEntries(request.headers.entries());
+        return new Response(new Blob(['image data']), {
+          headers: {
+            'content-disposition': 'attachment; filename=test.tar',
+          },
+        });
+      })
+    );
+
+    await exportImage({
+      environmentId: 1,
+      nodeName: undefined,
+      images: [{ id: 'sha256:abc123', tags: ['nginx:latest'] }],
+    });
+
+    expect(requestHeaders['x-portaineragent-target']).toBeUndefined();
+  });
+
+  it('should send correct image names as query params', async () => {
+    let requestUrl = '';
+
+    server.use(
+      http.get('/api/endpoints/:envId/docker/images/get', ({ request }) => {
+        requestUrl = request.url;
+
+        return new Response(new Blob(['image data']), {
+          headers: {
+            'content-disposition': 'attachment; filename=test.tar',
+          },
+        });
+      })
+    );
+
+    await exportImage({
+      environmentId: 1,
+      nodeName: undefined,
+      images: [
+        { id: 'sha256:abc123', tags: ['nginx:latest'] },
+        { id: 'sha256:def456', tags: ['redis:alpine'] },
+      ],
+    });
+
+    const url = new URL(requestUrl);
+    // Axios serializes array params with brackets: names[]=value1&names[]=value2
+    const names = url.searchParams.getAll('names[]');
+    expect(names).toEqual(['nginx:latest', 'redis:alpine']);
+    expect(saveAs).toHaveBeenCalled();
+  });
+
+  it('should send mix of tags and IDs in query params for images without tags', async () => {
+    let requestUrl = '';
+
+    server.use(
+      http.get('/api/endpoints/:envId/docker/images/get', ({ request }) => {
+        requestUrl = request.url;
+        return new Response(new Blob(['image data']), {
+          headers: {
+            'content-disposition': 'attachment; filename=test.tar',
+          },
+        });
+      })
+    );
+
+    await exportImage({
+      environmentId: 1,
+      nodeName: undefined,
+      images: [
+        { id: 'sha256:abc123', tags: ['nginx:latest'] },
+        { id: 'sha256:def456', tags: undefined },
+        { id: 'sha256:ghi789', tags: ['<none>:<none>'] },
+        { id: 'sha256:jkl012', tags: [] },
+      ],
+    });
+
+    const url = new URL(requestUrl);
+    const names = url.searchParams.getAll('names[]');
+    expect(names).toEqual([
+      'nginx:latest',
+      'sha256:def456',
+      'sha256:ghi789',
+      'sha256:jkl012',
+    ]);
+    expect(saveAs).toHaveBeenCalled();
+  });
+
+  it('should throw error when export fails', async () => {
+    const restoreConsole = suppressConsoleLogs();
+
+    server.use(
+      http.get('/api/endpoints/:envId/docker/images/get', () =>
+        HttpResponse.json({ message: 'Image not found' }, { status: 404 })
+      )
+    );
+
+    await expect(
+      exportImage({
+        environmentId: 1,
+        nodeName: undefined,
+        images: [{ id: 'sha256:abc123', tags: ['nginx:latest'] }],
+      })
+    ).rejects.toThrow('Unable to export image');
+
+    restoreConsole();
+  });
+
+  it('should handle filename without content-disposition header', async () => {
+    const mockBlob = new Blob(['image data'], { type: 'application/x-tar' });
+
+    server.use(
+      http.get(
+        '/api/endpoints/:envId/docker/images/get',
+        () => new Response(mockBlob)
+      )
+    );
+
+    await exportImage({
+      environmentId: 1,
+      nodeName: undefined,
+      images: [{ id: 'sha256:abc123', tags: ['nginx:latest'] }],
+    });
+
+    expect(saveAs).toHaveBeenCalledWith(mockBlob, '');
+  });
+});
+
+describe('useExportMutation', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('should successfully export images', async () => {
+    const mockBlob = new Blob(['image data'], { type: 'application/x-tar' });
+
+    server.use(
+      http.get(
+        '/api/endpoints/:envId/docker/images/get',
+        () =>
+          new Response(mockBlob, {
+            headers: {
+              'content-disposition': 'attachment; filename=nginx-latest.tar',
+            },
+          })
+      )
+    );
+
+    const { result } = renderMutationHook();
+
+    result.current.mutate({
+      images: [{ id: 'sha256:abc123', tags: ['nginx:latest'] }],
+      nodeName: undefined,
+    });
+
+    await waitFor(() => {
+      expect(result.current.isSuccess).toBe(true);
+    });
+
+    expect(saveAs).toHaveBeenCalledWith(mockBlob, 'nginx-latest.tar');
+  });
+
+  it('should handle export error', async () => {
+    const restoreConsole = suppressConsoleLogs();
+
+    server.use(
+      http.get('/api/endpoints/:envId/docker/images/get', () =>
+        HttpResponse.json({ message: 'Internal server error' }, { status: 500 })
+      )
+    );
+
+    const { result } = renderMutationHook();
+
+    result.current.mutate({
+      images: [{ id: 'sha256:abc123', tags: ['nginx:latest'] }],
+      nodeName: undefined,
+    });
+
+    await waitFor(() => {
+      expect(result.current.isError).toBe(true);
+    });
+
+    expect(result.current.error).toBeDefined();
+    restoreConsole();
+  });
+
+  it('should export multiple images with node name', async () => {
+    const mockBlob = new Blob(['image data'], { type: 'application/x-tar' });
+    let requestHeaders: Record<string, string | undefined> = {};
+
+    server.use(
+      http.get('/api/endpoints/:envId/docker/images/get', ({ request }) => {
+        requestHeaders = Object.fromEntries(request.headers.entries());
+        return new Response(mockBlob, {
+          headers: {
+            'content-disposition': 'attachment; filename=images.tar',
+          },
+        });
+      })
+    );
+
+    const { result } = renderMutationHook();
+
+    result.current.mutate({
+      images: [
+        { id: 'sha256:abc123', tags: ['nginx:latest'] },
+        { id: 'sha256:def456', tags: ['redis:alpine'] },
+        { id: 'sha256:ghi789', tags: undefined },
+      ],
+      nodeName: 'worker-node-1',
+    });
+
+    await waitFor(() => {
+      expect(result.current.isSuccess).toBe(true);
+    });
+
+    expect(saveAs).toHaveBeenCalledWith(mockBlob, 'images.tar');
+    expect(requestHeaders['x-portaineragent-target']).toBe('worker-node-1');
+  });
+});
diff --git a/app/react/docker/images/queries/useExportImageMutation.ts b/app/react/docker/images/queries/useExportImageMutation.ts
new file mode 100644
index 0000000..9a3c9f4
--- /dev/null
+++ b/app/react/docker/images/queries/useExportImageMutation.ts
@@ -0,0 +1,71 @@
+import { RawAxiosRequestHeaders } from 'axios';
+import { useMutation } from '@tanstack/react-query';
+import { saveAs } from 'file-saver';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+
+import { buildDockerProxyUrl } from '../../proxy/queries/buildDockerProxyUrl';
+
+export function useExportMutation() {
+  const environmentId = useEnvironmentId();
+  return useMutation({
+    mutationFn: (
+      args: Omit<Parameters<typeof exportImage>[0], 'environmentId'>
+    ) => exportImage({ ...args, environmentId }),
+  });
+}
+
+export async function exportImage({
+  environmentId,
+  nodeName,
+  images,
+}: {
+  environmentId: EnvironmentId;
+  nodeName?: string;
+  images: Array<{ tags?: Array<string>; id: string }>;
+}) {
+  const { names } = getImagesNamesForDownload(images);
+
+  const headers: RawAxiosRequestHeaders = {};
+
+  if (nodeName) {
+    headers['X-PortainerAgent-Target'] = nodeName;
+  }
+
+  try {
+    const { headers: responseHeaders, data } = await axios.get(
+      buildDockerProxyUrl(environmentId, 'images', 'get'),
+      {
+        headers,
+        responseType: 'blob',
+        params: {
+          names,
+        },
+      }
+    );
+
+    const contentDispositionHeader =
+      responseHeaders['content-disposition'] || '';
+    const filename = contentDispositionHeader
+      .replace('attachment; filename=', '')
+      .trim();
+    saveAs(data, filename);
+  } catch (err) {
+    throw parseAxiosError(err as Error, 'Unable to export image');
+  }
+}
+
+export function getImagesNamesForDownload(
+  images: Array<{ tags?: Array<string>; id: string }>
+) {
+  const names = images.map((image) =>
+    image.tags?.length && image.tags[0] !== '<none>:<none>'
+      ? image.tags[0]
+      : image.id
+  );
+  return {
+    names,
+  };
+}
diff --git a/app/react/docker/images/queries/useImages.ts b/app/react/docker/images/queries/useImages.ts
new file mode 100644
index 0000000..600a7aa
--- /dev/null
+++ b/app/react/docker/images/queries/useImages.ts
@@ -0,0 +1,62 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { buildDockerUrl } from '../../queries/utils/buildDockerUrl';
+
+import { queryKeys } from './queryKeys';
+
+export interface ImagesListResponse {
+  created: number;
+  nodeName?: string;
+  id: string;
+  size: number;
+  tags?: string[];
+
+  /**
+   * Used is true if the image is used by at least one container.
+   * supplied only when withUsage is true
+   */
+  used: boolean;
+}
+
+/**
+ * Used in ImagesDatatable
+ *
+ * Query /api/docker/{envId}/images
+ */
+export function useImages<T = Array<ImagesListResponse>>(
+  environmentId: EnvironmentId,
+  withUsage = false,
+  {
+    select,
+    enabled,
+    refetchInterval,
+  }: {
+    select?(data: Array<ImagesListResponse>): T;
+    enabled?: boolean;
+    refetchInterval?: number;
+  } = {}
+) {
+  return useQuery(
+    queryKeys.list(environmentId, { withUsage }),
+    () => getImages(environmentId, { withUsage }),
+    { select, enabled, refetchInterval }
+  );
+}
+
+async function getImages(
+  environmentId: EnvironmentId,
+  { withUsage }: { withUsage?: boolean } = {}
+) {
+  try {
+    const { data } = await axios.get<Array<ImagesListResponse>>(
+      buildDockerUrl(environmentId, 'images'),
+      { params: { withUsage } }
+    );
+    return data;
+  } catch (err) {
+    throw parseAxiosError(err, 'Unable to retrieve images');
+  }
+}
diff --git a/app/react/docker/images/queries/usePruneImagesMutation.ts b/app/react/docker/images/queries/usePruneImagesMutation.ts
new file mode 100644
index 0000000..3f99afa
--- /dev/null
+++ b/app/react/docker/images/queries/usePruneImagesMutation.ts
@@ -0,0 +1,92 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { withInvalidate } from '@/react-tools/react-query';
+
+import { buildDockerProxyUrl } from '../../proxy/queries/buildDockerProxyUrl';
+
+import { queryKeys } from './queryKeys';
+
+interface PruneOptions {
+  all?: boolean;
+  clearBuildCache?: boolean;
+}
+
+export function usePruneImagesMutation(environmentId: EnvironmentId) {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: (options: PruneOptions) => pruneAll(environmentId, options),
+    ...withInvalidate(queryClient, [queryKeys.base(environmentId)]),
+  });
+}
+
+export interface PruneResult {
+  SpaceReclaimed: number;
+  buildCacheError?: unknown;
+}
+
+async function pruneAll(
+  environmentId: EnvironmentId,
+  { all = false, clearBuildCache = false }: PruneOptions
+): Promise<PruneResult> {
+  const imageData = await pruneImages(environmentId, { all });
+  let spaceReclaimed = imageData.SpaceReclaimed;
+
+  if (!clearBuildCache) {
+    return { SpaceReclaimed: spaceReclaimed };
+  }
+
+  try {
+    const cacheData = await pruneBuildCache(environmentId);
+    spaceReclaimed += cacheData.SpaceReclaimed;
+    return { SpaceReclaimed: spaceReclaimed };
+  } catch (buildCacheError) {
+    return { SpaceReclaimed: spaceReclaimed, buildCacheError };
+  }
+}
+
+interface PruneImagesResponse {
+  ImagesDeleted: Array<{ Deleted?: string; Untagged?: string }> | null;
+  SpaceReclaimed: number;
+}
+
+async function pruneImages(
+  environmentId: EnvironmentId,
+  { all = false }: { all?: boolean }
+): Promise<PruneImagesResponse> {
+  try {
+    const { data } = await axios.post<PruneImagesResponse>(
+      buildDockerProxyUrl(environmentId, 'images', 'prune'),
+      null,
+      {
+        params: {
+          filters: JSON.stringify({ dangling: [all ? 'false' : 'true'] }),
+        },
+      }
+    );
+    return data;
+  } catch (err) {
+    throw parseAxiosError(err, 'Unable to prune images');
+  }
+}
+
+interface PruneBuildCacheResponse {
+  CachesDeleted: string[] | null;
+  SpaceReclaimed: number;
+}
+
+async function pruneBuildCache(
+  environmentId: EnvironmentId
+): Promise<PruneBuildCacheResponse> {
+  try {
+    const { data } = await axios.post<PruneBuildCacheResponse>(
+      buildDockerProxyUrl(environmentId, 'build', 'prune'),
+      null
+    );
+    return data;
+  } catch (err) {
+    throw parseAxiosError(err, 'Unable to prune build cache');
+  }
+}
diff --git a/app/react/docker/images/queries/usePullImageMutation.ts b/app/react/docker/images/queries/usePullImageMutation.ts
new file mode 100644
index 0000000..0b6452e
--- /dev/null
+++ b/app/react/docker/images/queries/usePullImageMutation.ts
@@ -0,0 +1,81 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { Registry } from '@/react/portainer/registries/types/registry';
+import { useEnvironmentRegistries } from '@/react/portainer/environments/queries/useEnvironmentRegistries';
+import { withError, withInvalidate } from '@/react-tools/react-query';
+
+import { buildImageFullURI } from '../utils';
+import {
+  withRegistryAuthHeader,
+  withAgentTargetHeader,
+} from '../../proxy/queries/utils';
+import { buildDockerProxyUrl } from '../../proxy/queries/buildDockerProxyUrl';
+
+import { queryKeys } from './queryKeys';
+
+type UsePullImageMutation = Omit<PullImageOptions, 'registry'> & {
+  registryId?: Registry['Id'];
+};
+
+export function usePullImageMutation(envId: EnvironmentId) {
+  const queryClient = useQueryClient();
+  const registriesQuery = useEnvironmentRegistries(envId);
+
+  return useMutation({
+    mutationFn: (args: UsePullImageMutation) =>
+      pullImage({
+        ...args,
+        registry: getRegistry(registriesQuery.data || [], args.registryId),
+      }),
+    ...withError('Failure', 'Failed pulling image'),
+    ...withInvalidate(queryClient, [queryKeys.base(envId)]),
+  });
+}
+
+function getRegistry(registries: Registry[], registryId?: Registry['Id']) {
+  return registryId
+    ? registries.find((registry) => registry.Id === registryId)
+    : undefined;
+}
+
+interface PullImageOptions {
+  environmentId: EnvironmentId;
+  image: string;
+  nodeName?: string;
+  registry?: Registry;
+  ignoreErrors: boolean;
+}
+
+export async function pullImage({
+  environmentId,
+  ignoreErrors,
+  image,
+  nodeName,
+  registry,
+}: PullImageOptions) {
+  const imageURI = buildImageFullURI(image, registry);
+
+  try {
+    await axios.post(
+      buildDockerProxyUrl(environmentId, 'images', 'create'),
+      null,
+      {
+        params: {
+          fromImage: imageURI,
+        },
+        headers: {
+          ...withRegistryAuthHeader(registry?.Id),
+          ...withAgentTargetHeader(nodeName),
+        },
+      }
+    );
+  } catch (err) {
+    if (ignoreErrors) {
+      return;
+    }
+
+    throw parseAxiosError(err, 'Unable to pull image');
+  }
+}
diff --git a/app/react/docker/images/queries/usePushImageMutation.ts b/app/react/docker/images/queries/usePushImageMutation.ts
new file mode 100644
index 0000000..0aa8d1e
--- /dev/null
+++ b/app/react/docker/images/queries/usePushImageMutation.ts
@@ -0,0 +1,42 @@
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { Registry } from '@/react/portainer/registries/types/registry';
+import PortainerError from '@/portainer/error';
+import { jsonObjectsToArrayHandler } from '@/portainer/helpers/json';
+
+import { buildImageFullURI } from '../utils';
+import { withRegistryAuthHeader } from '../../proxy/queries/utils';
+import { buildDockerProxyUrl } from '../../proxy/queries/buildDockerProxyUrl';
+
+interface PushImageOptions {
+  environmentId: EnvironmentId;
+  image: string;
+  registry?: Registry;
+}
+
+export async function pushImage({
+  environmentId,
+  image,
+  registry,
+}: PushImageOptions) {
+  const imageURI = buildImageFullURI(image, registry);
+
+  try {
+    const { data } = await axios.post(
+      buildDockerProxyUrl(environmentId, 'images', imageURI, 'push'),
+      null,
+      {
+        headers: {
+          ...withRegistryAuthHeader(registry?.Id),
+        },
+        transformResponse: jsonObjectsToArrayHandler,
+      }
+    );
+
+    if (data[data.length - 1].error) {
+      throw new PortainerError(data[data.length - 1].error);
+    }
+  } catch (err) {
+    throw parseAxiosError(err, 'Unable to push image');
+  }
+}
diff --git a/app/react/docker/images/types.ts b/app/react/docker/images/types.ts
new file mode 100644
index 0000000..43b61f4
--- /dev/null
+++ b/app/react/docker/images/types.ts
@@ -0,0 +1,8 @@
+import { DockerImageResponse } from './types/response';
+
+type DecoratedDockerImage = {
+  Used: boolean;
+};
+
+export type DockerImage = DecoratedDockerImage &
+  Omit<DockerImageResponse, keyof DecoratedDockerImage>;
diff --git a/app/react/docker/images/types/response.ts b/app/react/docker/images/types/response.ts
new file mode 100644
index 0000000..4ffc754
--- /dev/null
+++ b/app/react/docker/images/types/response.ts
@@ -0,0 +1,13 @@
+import { PortainerResponse } from '../../types';
+
+export type DockerImageResponse = PortainerResponse<{
+  Containers: number;
+  Created: number;
+  Id: string;
+  Labels: { [key: string]: string };
+  ParentId: string;
+  RepoDigests: string[];
+  RepoTags: string[];
+  SharedSize: number;
+  Size: number;
+}>;
diff --git a/app/react/docker/images/utils.test.ts b/app/react/docker/images/utils.test.ts
new file mode 100644
index 0000000..70e1cf7
--- /dev/null
+++ b/app/react/docker/images/utils.test.ts
@@ -0,0 +1,69 @@
+import { describe, it, expect } from 'vitest';
+
+import { fullURIIntoRepoAndTag } from './utils';
+
+describe('fullURIIntoRepoAndTag', () => {
+  it('splits registry/image-repo:tag correctly', () => {
+    const result = fullURIIntoRepoAndTag('registry.example.com/my-image:v1.0');
+    expect(result).toEqual({
+      repo: 'registry.example.com/my-image',
+      tag: 'v1.0',
+    });
+  });
+
+  it('splits image-repo:tag correctly', () => {
+    const result = fullURIIntoRepoAndTag('nginx:latest');
+    expect(result).toEqual({ repo: 'nginx', tag: 'latest' });
+  });
+
+  it('splits image-repo:port/image correctly', () => {
+    const result = fullURIIntoRepoAndTag('registry.example.com:5000/my-image');
+    expect(result).toEqual({
+      repo: 'registry.example.com:5000/my-image',
+      tag: 'latest',
+    });
+  });
+
+  it('splits image-repo:port/image:tag correctly', () => {
+    const result = fullURIIntoRepoAndTag(
+      'registry.example.com:5000/my-image:v1'
+    );
+    expect(result).toEqual({
+      repo: 'registry.example.com:5000/my-image',
+      tag: 'v1',
+    });
+  });
+
+  it('splits registry:port/image-repo:tag correctly', () => {
+    const result = fullURIIntoRepoAndTag(
+      'registry.example.com:5000/my-image:v2.1'
+    );
+    expect(result).toEqual({
+      repo: 'registry.example.com:5000/my-image',
+      tag: 'v2.1',
+    });
+  });
+
+  it('handles empty string input', () => {
+    const result = fullURIIntoRepoAndTag('');
+    expect(result).toEqual({ repo: '', tag: 'latest' });
+  });
+
+  it('handles input with multiple colons', () => {
+    const result = fullURIIntoRepoAndTag('registry:5000/namespace/image:v1.0');
+    expect(result).toEqual({
+      repo: 'registry:5000/namespace/image',
+      tag: 'v1.0',
+    });
+  });
+
+  it('handles input with @ symbol (digest)', () => {
+    const result = fullURIIntoRepoAndTag(
+      'myregistry.azurecr.io/image@sha256:123456'
+    );
+    expect(result).toEqual({
+      repo: 'myregistry.azurecr.io/image@sha256',
+      tag: '123456',
+    });
+  });
+});
diff --git a/app/react/docker/images/utils.ts b/app/react/docker/images/utils.ts
new file mode 100644
index 0000000..a04fd71
--- /dev/null
+++ b/app/react/docker/images/utils.ts
@@ -0,0 +1,145 @@
+import _ from 'lodash';
+
+import { trimSHA } from '@/docker/filters/utils';
+import {
+  Registry,
+  RegistryTypes,
+} from '@/react/portainer/registries/types/registry';
+
+import { DockerImage } from './types';
+import { DockerImageResponse } from './types/response';
+
+type ImageModel = {
+  UseRegistry: boolean;
+  Registry?: Registry;
+  Image: string;
+};
+
+export function parseViewModel(response: DockerImageResponse): DockerImage {
+  return {
+    ...response,
+    Used: false,
+    RepoTags:
+      response.RepoTags ??
+      response.RepoDigests.map((digest) => `${trimSHA(digest)}:<none>`),
+  };
+}
+
+export function getUniqueTagListFromImages(
+  images: Array<{ RepoTags?: string[] }>
+) {
+  return _.uniq(
+    images.flatMap((image) =>
+      image.RepoTags
+        ? image.RepoTags.filter((item) => !item.includes('<none>'))
+        : []
+    )
+  );
+}
+
+export function imageContainsURL(image: string) {
+  const split = image.split('/');
+  const url = split[0];
+  if (split.length > 1) {
+    return url.includes('.') || url.includes(':');
+  }
+  return false;
+}
+
+export function buildImageFullURIFromModel(imageModel: ImageModel) {
+  const registry = imageModel.UseRegistry ? imageModel.Registry : undefined;
+  return buildImageFullURI(imageModel.Image, registry);
+}
+
+/**
+ * builds the complete uri for an image based on its registry
+ */
+export function buildImageFullURI(image: string, registry?: Registry) {
+  if (!image) {
+    throw new Error('Missing image');
+  }
+
+  if (!registry) {
+    return ensureTag(image);
+  }
+
+  const imageName = buildImageFullURIWithRegistry(image, registry);
+
+  return ensureTag(imageName);
+
+  function ensureTag(image: string, defaultTag = 'latest') {
+    return image.includes(':') ? image : `${image}:${defaultTag}`;
+  }
+}
+
+function buildImageFullURIWithRegistry(image: string, registry: Registry) {
+  switch (registry.Type) {
+    case RegistryTypes.GITHUB:
+      return buildImageURIForGithub(image, registry);
+    case RegistryTypes.GITLAB:
+      return buildImageURIForGitLab(image, registry);
+    case RegistryTypes.QUAY:
+      return buildImageURIForQuay(image, registry);
+    case RegistryTypes.ANONYMOUS:
+      return image;
+    default:
+      return buildImageURIForOtherRegistry(image, registry);
+  }
+
+  function buildImageURIForGithub(image: string, registry: Registry) {
+    const imageName = image.startsWith('/') ? image.slice(1) : image;
+
+    const namespace = registry.Github.UseOrganisation
+      ? registry.Github.OrganisationName
+      : registry.Username;
+    return `${registry.URL}/${namespace}/${imageName}`;
+  }
+
+  function buildImageURIForGitLab(image: string, registry: Registry) {
+    const slash = image.startsWith(':') ? '' : '/';
+    return `${registry.URL}/${registry.Gitlab.ProjectPath}${slash}${image}`;
+  }
+
+  function buildImageURIForQuay(image: string, registry: Registry) {
+    const name = registry.Quay.UseOrganisation
+      ? registry.Quay.OrganisationName
+      : registry.Username;
+    const url = registry.URL ? `${registry.URL}/` : '';
+    return `${url}${name}/${image}`;
+  }
+
+  function buildImageURIForOtherRegistry(image: string, registry: Registry) {
+    const url = registry.URL ? `${registry.URL}/` : '';
+    return url + image;
+  }
+}
+
+/**
+ * Splits a full URI into repository and tag.
+ *
+ * @param fullURI - The full URI to be split.
+ * @returns An object containing the repository and tag.
+ */
+export function fullURIIntoRepoAndTag(fullURI: string) {
+  // possible fullURI values (all should contain a tag):
+  // - registry/image-repo:tag
+  // - image-repo:tag
+  // - registry:port/image-repo:tag
+  // - localhost:5000/nginx
+  // buildImageFullURIFromModel always gives a tag (defaulting to 'latest'), so the tag is always present after the last ':'
+  const parts = fullURI.split(':');
+  const tag = parts.pop() || 'latest';
+
+  // handle the case of a repo with a non standard port
+  if (tag.includes('/')) {
+    return {
+      repo: fullURI,
+      tag: 'latest',
+    };
+  }
+  const repo = parts.join(':');
+  return {
+    repo,
+    tag,
+  };
+}
diff --git a/app/react/docker/networks/CreateView/MacvlanNodesSelector/MacvlanNodesSelector.tsx b/app/react/docker/networks/CreateView/MacvlanNodesSelector/MacvlanNodesSelector.tsx
new file mode 100644
index 0000000..4f02cee
--- /dev/null
+++ b/app/react/docker/networks/CreateView/MacvlanNodesSelector/MacvlanNodesSelector.tsx
@@ -0,0 +1,55 @@
+import { HardDrive } from 'lucide-react';
+
+import { NodeViewModel } from '@/docker/models/node';
+
+import { Datatable } from '@@/datatables';
+import { createPersistedStore } from '@@/datatables/types';
+import { useTableState } from '@@/datatables/useTableState';
+import { mergeOptions } from '@@/datatables/extend-options/mergeOptions';
+import { withMeta } from '@@/datatables/extend-options/withMeta';
+import { withControlledSelected } from '@@/datatables/extend-options/withControlledSelected';
+
+import { useColumns } from './useColumns';
+
+const tableKey = 'macvlan-nodes-selector';
+const store = createPersistedStore(tableKey);
+
+export function MacvlanNodesSelector({
+  dataset,
+  isIpColumnVisible,
+  haveAccessToNode,
+  value,
+  onChange,
+}: {
+  dataset?: Array<NodeViewModel>;
+  isIpColumnVisible: boolean;
+  haveAccessToNode: boolean;
+  value: Array<NodeViewModel>;
+  onChange(value: Array<NodeViewModel>): void;
+}) {
+  const columns = useColumns(isIpColumnVisible);
+  const tableState = useTableState(store, tableKey);
+
+  return (
+    <Datatable<NodeViewModel>
+      title="Select the nodes where you want to deploy the local configuration"
+      titleIcon={HardDrive}
+      columns={columns}
+      dataset={dataset || []}
+      isLoading={!dataset}
+      settingsManager={tableState}
+      data-cy="macvlan-nodes-selector-datatable"
+      extendTableOptions={mergeOptions(
+        withMeta({
+          table: 'nodes',
+          haveAccessToNode,
+        }),
+        withControlledSelected(
+          (ids) =>
+            onChange(dataset?.filter((n) => n.Id && ids.includes(n.Id)) || []),
+          value.map((n) => n.Id || '')
+        )
+      )}
+    />
+  );
+}
diff --git a/app/react/docker/networks/CreateView/MacvlanNodesSelector/index.ts b/app/react/docker/networks/CreateView/MacvlanNodesSelector/index.ts
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/docker/networks/CreateView/MacvlanNodesSelector/useColumns.ts b/app/react/docker/networks/CreateView/MacvlanNodesSelector/useColumns.ts
new file mode 100644
index 0000000..0279e25
--- /dev/null
+++ b/app/react/docker/networks/CreateView/MacvlanNodesSelector/useColumns.ts
@@ -0,0 +1,17 @@
+import { useMemo } from 'react';
+import _ from 'lodash';
+
+import {
+  engine,
+  ip,
+  role,
+  name,
+  status,
+} from '@/react/docker/swarm/SwarmView/NodesDatatable/columns';
+
+export function useColumns(isIpColumnVisible: boolean) {
+  return useMemo(
+    () => _.compact([name, role, engine, isIpColumnVisible && ip, status]),
+    [isIpColumnVisible]
+  );
+}
diff --git a/app/react/docker/networks/CreateView/macvlanOptions.tsx b/app/react/docker/networks/CreateView/macvlanOptions.tsx
new file mode 100644
index 0000000..99a5ee5
--- /dev/null
+++ b/app/react/docker/networks/CreateView/macvlanOptions.tsx
@@ -0,0 +1,27 @@
+import { Share2, Sliders } from 'lucide-react';
+
+import { BoxSelectorOption } from '@@/BoxSelector';
+
+export function getOptions(
+  hasNetworks: boolean
+): ReadonlyArray<BoxSelectorOption<string>> {
+  return [
+    {
+      id: 'network_config',
+      icon: Sliders,
+      iconType: 'badge',
+      label: 'Configuration',
+      description: 'I want to configure a network before deploying it',
+      value: 'local',
+    },
+    {
+      id: 'network_deploy',
+      icon: Share2,
+      iconType: 'badge',
+      label: 'Creation',
+      description: 'I want to create a network from a configuration',
+      value: 'swarm',
+      disabled: () => !hasNetworks,
+    },
+  ] as const;
+}
diff --git a/app/react/docker/networks/ItemView/ItemView.tsx b/app/react/docker/networks/ItemView/ItemView.tsx
new file mode 100644
index 0000000..c323868
--- /dev/null
+++ b/app/react/docker/networks/ItemView/ItemView.tsx
@@ -0,0 +1,122 @@
+import { useRouter, useCurrentStateAndParams } from '@uirouter/react';
+import { useQueryClient } from '@tanstack/react-query';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { AccessControlPanel } from '@/react/portainer/access-control/AccessControlPanel/AccessControlPanel';
+import { ResourceControlType } from '@/react/portainer/access-control/types';
+import { ContainerListViewModel } from '@/react/docker/containers/types';
+import { ResourceControlViewModel } from '@/react/portainer/access-control/models/ResourceControlViewModel';
+import { useContainers } from '@/react/docker/containers/queries/useContainers';
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { PageHeader } from '@@/PageHeader';
+
+import { useDeleteNetwork } from '../queries/useDeleteNetworkMutation';
+import { isSystemNetwork } from '../network.helper';
+import { NetworkResponseContainers } from '../types';
+import { queryKeys } from '../queries/queryKeys';
+import { useNetwork } from '../queries/useNetwork';
+
+import { NetworkDetailsTable } from './NetworkDetailsTable';
+import { NetworkOptionsTable } from './NetworkOptionsTable';
+import { NetworkContainersTable } from './NetworkContainersTable';
+
+export function ItemView() {
+  const router = useRouter();
+  const queryClient = useQueryClient();
+
+  const {
+    params: { id: networkId, nodeName },
+  } = useCurrentStateAndParams();
+  const environmentId = useEnvironmentId();
+  const networkQuery = useNetwork(environmentId, networkId, { nodeName });
+  const deleteNetworkMutation = useDeleteNetwork(environmentId);
+  const containersQuery = useContainers(environmentId, {
+    filters: {
+      network: [networkId],
+    },
+    nodeName,
+  });
+
+  if (!networkQuery.data) {
+    return null;
+  }
+
+  const network = networkQuery.data;
+
+  const networkContainers = filterContainersInNetwork(
+    network.Containers,
+    containersQuery.data
+  );
+  const resourceControl = network.Portainer?.ResourceControl
+    ? new ResourceControlViewModel(network.Portainer.ResourceControl)
+    : undefined;
+
+  return (
+    <>
+      <PageHeader
+        title="Network details"
+        breadcrumbs={[
+          { link: 'docker.networks', label: 'Networks' },
+          {
+            link: 'docker.networks.network',
+            label: networkQuery.data.Name,
+          },
+        ]}
+        reload
+      />
+      <NetworkDetailsTable
+        network={networkQuery.data}
+        onRemoveNetworkClicked={onRemoveNetworkClicked}
+      />
+
+      <AccessControlPanel
+        onUpdateSuccess={() =>
+          queryClient.invalidateQueries(
+            queryKeys.item(environmentId, networkId)
+          )
+        }
+        resourceControl={resourceControl}
+        resourceType={ResourceControlType.Network}
+        disableOwnershipChange={isSystemNetwork(networkQuery.data.Name)}
+        resourceId={networkId}
+        environmentId={environmentId}
+      />
+      <NetworkOptionsTable options={networkQuery.data.Options} />
+      <NetworkContainersTable
+        networkContainers={networkContainers}
+        nodeName={nodeName}
+        environmentId={environmentId}
+        networkId={networkId}
+      />
+    </>
+  );
+
+  async function onRemoveNetworkClicked() {
+    deleteNetworkMutation.mutate(
+      { networkId, nodeName },
+      {
+        onSuccess: () => {
+          notifySuccess('Network successfully removed', networkId);
+          router.stateService.go('docker.networks');
+        },
+      }
+    );
+  }
+}
+
+function filterContainersInNetwork(
+  networkContainers?: NetworkResponseContainers,
+  containers: ContainerListViewModel[] = []
+) {
+  if (!networkContainers) {
+    return [];
+  }
+
+  return containers
+    .filter((container) => networkContainers[container.Id])
+    .map((container) => ({
+      ...networkContainers[container.Id],
+      Id: container.Id,
+    }));
+}
diff --git a/app/react/docker/networks/ItemView/NetworkContainersTable.test.tsx b/app/react/docker/networks/ItemView/NetworkContainersTable.test.tsx
new file mode 100644
index 0000000..d45ebd5
--- /dev/null
+++ b/app/react/docker/networks/ItemView/NetworkContainersTable.test.tsx
@@ -0,0 +1,62 @@
+import { render } from '@testing-library/react';
+import { http, HttpResponse } from 'msw';
+
+import { UserViewModel } from '@/portainer/models/user';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { server } from '@/setup-tests/server';
+
+import { NetworkContainer } from '../types';
+
+import { NetworkContainersTable } from './NetworkContainersTable';
+
+const networkContainers: NetworkContainer[] = [
+  {
+    EndpointID:
+      '069d703f3ff4939956233137c4c6270d7d46c04fb10c44d3ec31fde1b46d6610',
+    IPv4Address: '10.0.1.3/24',
+    IPv6Address: '',
+    MacAddress: '02:42:0a:00:01:03',
+    Name: 'portainer-agent_agent.8hjjodl4hoyhuq1kscmzccyqn.wnv2pp17f8ayeopke2z56yw5x',
+    Id: 'd54c74b7e1c5649d2a880d3fc02c6201d1d2f85a4fee718f978ec8b147239295',
+  },
+];
+
+vi.mock('@uirouter/react', async (importOriginal: () => Promise<object>) => ({
+  ...(await importOriginal()),
+  useCurrentStateAndParams: vi.fn(() => ({
+    params: { endpointId: 1 },
+  })),
+}));
+
+test('Network container values should be visible and the link should be valid', async () => {
+  server.use(http.get('/api/endpoints/1', () => HttpResponse.json({})));
+
+  const user = new UserViewModel({ Username: 'test', Role: 1 });
+
+  const Wrapped = withTestQueryProvider(
+    withUserProvider(withTestRouter(NetworkContainersTable), user)
+  );
+
+  const { findByText } = render(
+    <Wrapped
+      networkContainers={networkContainers}
+      nodeName=""
+      environmentId={1}
+      networkId="pc8xc9s6ot043vl1q5iz4zhfs"
+    />
+  );
+
+  await expect(findByText('Containers in network')).resolves.toBeVisible();
+  await expect(findByText(networkContainers[0].Name)).resolves.toBeVisible();
+  await expect(
+    findByText(networkContainers[0].IPv4Address)
+  ).resolves.toBeVisible();
+  await expect(
+    findByText(networkContainers[0].MacAddress)
+  ).resolves.toBeVisible();
+  await expect(
+    findByText('Leave network', { exact: false })
+  ).resolves.toBeVisible();
+});
diff --git a/app/react/docker/networks/ItemView/NetworkContainersTable.tsx b/app/react/docker/networks/ItemView/NetworkContainersTable.tsx
new file mode 100644
index 0000000..c3f540d
--- /dev/null
+++ b/app/react/docker/networks/ItemView/NetworkContainersTable.tsx
@@ -0,0 +1,105 @@
+import { Server, Trash2 } from 'lucide-react';
+
+import { Authorized } from '@/react/hooks/useUser';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { Icon } from '@/react/components/Icon';
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { TableContainer, TableTitle } from '@@/datatables';
+import { DetailsTable } from '@@/DetailsTable';
+import { Button } from '@@/buttons';
+import { Link } from '@@/Link';
+
+import { NetworkContainer, NetworkId } from '../types';
+import { useDisconnectContainer } from '../queries/useDisconnectContainerMutation';
+
+type Props = {
+  networkContainers: NetworkContainer[];
+  nodeName: string;
+  environmentId: EnvironmentId;
+  networkId: NetworkId;
+};
+
+const tableHeaders = [
+  'Container Name',
+  'IPv4 Address',
+  'IPv6 Address',
+  'MacAddress',
+  'Actions',
+];
+
+export function NetworkContainersTable({
+  networkContainers,
+  nodeName,
+  environmentId,
+  networkId,
+}: Props) {
+  const disconnectContainer = useDisconnectContainer({
+    environmentId,
+    networkId,
+  });
+
+  if (networkContainers.length === 0) {
+    return null;
+  }
+
+  return (
+    <TableContainer>
+      <TableTitle label="Containers in network" icon={Server} />
+      <DetailsTable
+        headers={tableHeaders}
+        dataCy="networkDetails-networkContainers"
+      >
+        {networkContainers.map((container) => (
+          <tr key={container.Id}>
+            <td>
+              <Link
+                to="docker.containers.container"
+                params={{
+                  id: container.Id,
+                  nodeName,
+                }}
+                title={container.Name}
+                data-cy={`networkDetails-containerName-${container.Name}`}
+              >
+                {container.Name}
+              </Link>
+            </td>
+            <td>{container.IPv4Address || '-'}</td>
+            <td>{container.IPv6Address || '-'}</td>
+            <td>{container.MacAddress || '-'}</td>
+            <td>
+              <Authorized authorizations="DockerNetworkDisconnect">
+                <Button
+                  data-cy={`networkDetails-disconnect${container.Name}`}
+                  size="xsmall"
+                  color="dangerlight"
+                  onClick={() => {
+                    if (container.Id) {
+                      disconnectContainer.mutate(
+                        {
+                          containerId: container.Id,
+                          nodeName,
+                        },
+                        {
+                          onSuccess: () =>
+                            notifySuccess(
+                              'Container successfully disconnected',
+                              networkId
+                            ),
+                        }
+                      );
+                    }
+                  }}
+                >
+                  <Icon icon={Trash2} class-name="icon-secondary icon-md" />
+                  Leave Network
+                </Button>
+              </Authorized>
+            </td>
+          </tr>
+        ))}
+      </DetailsTable>
+    </TableContainer>
+  );
+}
diff --git a/app/react/docker/networks/ItemView/NetworkDetailsTable.test.tsx b/app/react/docker/networks/ItemView/NetworkDetailsTable.test.tsx
new file mode 100644
index 0000000..8e1b996
--- /dev/null
+++ b/app/react/docker/networks/ItemView/NetworkDetailsTable.test.tsx
@@ -0,0 +1,127 @@
+import { HttpResponse, http } from 'msw';
+import { render, screen } from '@testing-library/react';
+
+import { UserViewModel } from '@/portainer/models/user';
+import { server } from '@/setup-tests/server';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+
+import { DockerNetwork } from '../types';
+
+import { NetworkDetailsTable } from './NetworkDetailsTable';
+
+vi.mock('@uirouter/react', async (importOriginal: () => Promise<object>) => ({
+  ...(await importOriginal()),
+  useCurrentStateAndParams: vi.fn(() => ({
+    params: { endpointId: 1 },
+  })),
+}));
+
+test('Network details values should be visible', async () => {
+  const network = getNetwork('test');
+
+  const { findByText } = await renderComponent(true, network);
+
+  await expect(findByText(network.Name)).resolves.toBeVisible();
+  await expect(findByText(network.Id)).resolves.toBeVisible();
+  await expect(findByText(network.Driver)).resolves.toBeVisible();
+  await expect(findByText(network.Scope)).resolves.toBeVisible();
+  await expect(
+    findByText(network.IPAM?.Config[0].Gateway || 'not found', {
+      exact: false,
+    })
+  ).resolves.toBeVisible();
+  await expect(
+    findByText(network.IPAM?.Config[0].Subnet || 'not found', { exact: false })
+  ).resolves.toBeVisible();
+});
+
+test(`System networks shouldn't show a delete button`, async () => {
+  const systemNetwork = getNetwork('bridge');
+  await renderComponent(true, systemNetwork);
+
+  expect(screen.queryByText('Delete this network')).toBeNull();
+});
+
+test('Non system networks should have a delete button', async () => {
+  const nonSystemNetwork = getNetwork('non system network');
+
+  await renderComponent(true, nonSystemNetwork);
+
+  await expect(screen.findByText('Delete this network')).resolves.toBeVisible();
+});
+
+async function renderComponent(isAdmin: boolean, network: DockerNetwork) {
+  server.use(http.get('/api/endpoints/1', () => HttpResponse.json({})));
+
+  const user = new UserViewModel({ Username: 'test', Role: isAdmin ? 1 : 2 });
+
+  const Wrapped = withTestQueryProvider(
+    withUserProvider(NetworkDetailsTable, user)
+  );
+
+  const queries = render(
+    <Wrapped network={network} onRemoveNetworkClicked={() => {}} />
+  );
+
+  await expect(queries.findByText('Network details')).resolves.toBeVisible();
+
+  return queries;
+}
+
+function getNetwork(networkName: string): DockerNetwork {
+  return {
+    Attachable: false,
+    Containers: {
+      a761fcafdae3bdae42cf3702c8554b3e1b0334f85dd6b65b3584aff7246279e4: {
+        EndpointID:
+          '404afa6e25cede7c0fd70180777b662249cd83e40fa9a41aa593d2bac0fc5e18',
+        IPv4Address: '172.17.0.2/16',
+        IPv6Address: '',
+        MacAddress: '02:42:ac:11:00:02',
+        Name: 'portainer',
+      },
+    },
+    Driver: 'bridge',
+    IPAM: {
+      Config: [
+        {
+          Gateway: '172.17.0.1',
+          Subnet: '172.17.0.0/16',
+        },
+      ],
+      Driver: 'default',
+      Options: undefined,
+    },
+    Id: '4c52a72e3772fdfb5823cf519b759e3f716e6d98cfb3bfef056e32c9c878329f',
+    Internal: false,
+    Name: networkName,
+    Options: {
+      'com.docker.network.bridge.default_bridge': 'true',
+      'com.docker.network.bridge.enable_icc': 'true',
+      'com.docker.network.bridge.enable_ip_masquerade': 'true',
+      'com.docker.network.bridge.host_binding_ipv4': '0.0.0.0',
+      'com.docker.network.bridge.name': 'docker0',
+      'com.docker.network.driver.mtu': '1500',
+    },
+    Portainer: {
+      ResourceControl: {
+        Id: 41,
+        ResourceId:
+          '85d807847e4a4adb374a2a105124eda607ef584bef2eb6acf8091f3afd8446db',
+        Type: 4,
+        UserAccesses: [
+          {
+            UserId: 2,
+            AccessLevel: 1,
+          },
+        ],
+        TeamAccesses: [],
+        Public: true,
+        System: false,
+        AdministratorsOnly: true,
+      },
+    },
+    Scope: 'local',
+  };
+}
diff --git a/app/react/docker/networks/ItemView/NetworkDetailsTable.tsx b/app/react/docker/networks/ItemView/NetworkDetailsTable.tsx
new file mode 100644
index 0000000..0143131
--- /dev/null
+++ b/app/react/docker/networks/ItemView/NetworkDetailsTable.tsx
@@ -0,0 +1,111 @@
+import { Fragment } from 'react';
+import { Network } from 'lucide-react';
+
+import DockerNetworkHelper from '@/docker/helpers/networkHelper';
+import { Authorized } from '@/react/hooks/useUser';
+
+import { TableContainer, TableTitle } from '@@/datatables';
+import { DetailsTable } from '@@/DetailsTable';
+import { DeleteButton } from '@@/buttons/DeleteButton';
+
+import { isSystemNetwork } from '../network.helper';
+import { DockerNetwork, IPConfig } from '../types';
+
+interface Props {
+  network: DockerNetwork;
+  onRemoveNetworkClicked: () => void;
+}
+
+export function NetworkDetailsTable({
+  network,
+  onRemoveNetworkClicked,
+}: Props) {
+  const allowRemoveNetwork = !isSystemNetwork(network.Name);
+  const ipv4Configs: IPConfig[] = DockerNetworkHelper.getIPV4Configs(
+    network.IPAM?.Config
+  );
+  const ipv6Configs: IPConfig[] = DockerNetworkHelper.getIPV6Configs(
+    network.IPAM?.Config
+  );
+
+  return (
+    <TableContainer>
+      <TableTitle label="Network details" icon={Network} />
+      <DetailsTable dataCy="networkDetails-detailsTable">
+        {/* networkRowContent */}
+        <DetailsTable.Row label="Name">{network.Name}</DetailsTable.Row>
+        <DetailsTable.Row label="Id">
+          {network.Id}
+          {allowRemoveNetwork && (
+            <span className="ml-2">
+              <Authorized authorizations="DockerNetworkDelete">
+                <DeleteButton
+                  data-cy="networkDetails-deleteNetwork"
+                  size="xsmall"
+                  onConfirmed={onRemoveNetworkClicked}
+                  confirmMessage="Do you want to delete the network?"
+                >
+                  Delete this network
+                </DeleteButton>
+              </Authorized>
+            </span>
+          )}
+        </DetailsTable.Row>
+        <DetailsTable.Row label="Driver">{network.Driver}</DetailsTable.Row>
+        <DetailsTable.Row label="Scope">{network.Scope}</DetailsTable.Row>
+        <DetailsTable.Row label="Attachable">
+          {String(network.Attachable)}
+        </DetailsTable.Row>
+        <DetailsTable.Row label="Internal">
+          {String(network.Internal)}
+        </DetailsTable.Row>
+
+        {/* IPV4 ConfigRowContent */}
+        {ipv4Configs.map((config) => (
+          <Fragment key={config.Subnet}>
+            <DetailsTable.Row
+              label={`IPV4 Subnet${getConfigDetails(config.Subnet)}`}
+            >
+              {`IPV4 Gateway${getConfigDetails(config.Gateway)}`}
+            </DetailsTable.Row>
+            <DetailsTable.Row
+              label={`IPV4 IP Range${getConfigDetails(config.IPRange)}`}
+            >
+              {`IPV4 Excluded IPs${getAuxiliaryAddresses(
+                config.AuxiliaryAddresses
+              )}`}
+            </DetailsTable.Row>
+          </Fragment>
+        ))}
+
+        {/* IPV6 ConfigRowContent */}
+        {ipv6Configs.map((config) => (
+          <Fragment key={config.Subnet}>
+            <DetailsTable.Row
+              label={`IPV6 Subnet${getConfigDetails(config.Subnet)}`}
+            >
+              {`IPV6 Gateway${getConfigDetails(config.Gateway)}`}
+            </DetailsTable.Row>
+            <DetailsTable.Row
+              label={`IPV6 IP Range${getConfigDetails(config.IPRange)}`}
+            >
+              {`IPV6 Excluded IPs${getAuxiliaryAddresses(
+                config.AuxiliaryAddresses
+              )}`}
+            </DetailsTable.Row>
+          </Fragment>
+        ))}
+      </DetailsTable>
+    </TableContainer>
+  );
+
+  function getConfigDetails(configValue?: string) {
+    return configValue ? ` - ${configValue}` : '';
+  }
+
+  function getAuxiliaryAddresses(auxiliaryAddresses?: object) {
+    return auxiliaryAddresses
+      ? ` - ${Object.values(auxiliaryAddresses).join(' - ')}`
+      : '';
+  }
+}
diff --git a/app/react/docker/networks/ItemView/NetworkOptionsTable.test.tsx b/app/react/docker/networks/ItemView/NetworkOptionsTable.test.tsx
new file mode 100644
index 0000000..d68445a
--- /dev/null
+++ b/app/react/docker/networks/ItemView/NetworkOptionsTable.test.tsx
@@ -0,0 +1,34 @@
+import { render } from '@testing-library/react';
+
+import { NetworkOptions } from '../types';
+
+import { NetworkOptionsTable } from './NetworkOptionsTable';
+
+const options: NetworkOptions = {
+  'com.docker.network.bridge.default_bridge': 'true',
+  'com.docker.network.bridge.enable_icc': 'true',
+  'com.docker.network.bridge.enable_ip_masquerade': 'true',
+  'com.docker.network.bridge.host_binding_ipv4': '0.0.0.0',
+  'com.docker.network.bridge.name': 'docker0',
+  'com.docker.network.driver.mtu': '1500',
+};
+
+test('Network options values should be visible', async () => {
+  const { findByText, findAllByText } = render(
+    <NetworkOptionsTable options={options} />
+  );
+
+  await expect(findByText('Network options')).resolves.toBeVisible();
+  // expect to find three 'true' values for the first 3 options
+  const cells = await findAllByText('true');
+  expect(cells).toHaveLength(3);
+  await expect(
+    findByText(options['com.docker.network.bridge.host_binding_ipv4'])
+  ).resolves.toBeVisible();
+  await expect(
+    findByText(options['com.docker.network.bridge.name'])
+  ).resolves.toBeVisible();
+  await expect(
+    findByText(options['com.docker.network.driver.mtu'])
+  ).resolves.toBeVisible();
+});
diff --git a/app/react/docker/networks/ItemView/NetworkOptionsTable.tsx b/app/react/docker/networks/ItemView/NetworkOptionsTable.tsx
new file mode 100644
index 0000000..9b8c417
--- /dev/null
+++ b/app/react/docker/networks/ItemView/NetworkOptionsTable.tsx
@@ -0,0 +1,31 @@
+import { Network } from 'lucide-react';
+
+import { TableContainer, TableTitle } from '@@/datatables';
+import { DetailsTable } from '@@/DetailsTable';
+
+import { NetworkOptions } from '../types';
+
+type Props = {
+  options: NetworkOptions;
+};
+
+export function NetworkOptionsTable({ options }: Props) {
+  const networkEntries = Object.entries(options);
+
+  if (networkEntries.length === 0) {
+    return null;
+  }
+
+  return (
+    <TableContainer>
+      <TableTitle label="Network options" icon={Network} />
+      <DetailsTable dataCy="networkDetails-networkOptionsTable">
+        {networkEntries.map(([key, value]) => (
+          <DetailsTable.Row key={key} label={key}>
+            {value}
+          </DetailsTable.Row>
+        ))}
+      </DetailsTable>
+    </TableContainer>
+  );
+}
diff --git a/app/react/docker/networks/ItemView/index.ts b/app/react/docker/networks/ItemView/index.ts
new file mode 100644
index 0000000..a09ab2d
--- /dev/null
+++ b/app/react/docker/networks/ItemView/index.ts
@@ -0,0 +1 @@
+export { ItemView } from './ItemView';
diff --git a/app/react/docker/networks/ListView/ListView.tsx b/app/react/docker/networks/ListView/ListView.tsx
new file mode 100644
index 0000000..03dc565
--- /dev/null
+++ b/app/react/docker/networks/ListView/ListView.tsx
@@ -0,0 +1,19 @@
+import { PageHeader } from '@@/PageHeader';
+
+import { useDeleteNetworkListMutation } from '../queries/useDeleteNetworkListMutation';
+
+import { NetworksDatatable } from './NetworksDatatable';
+
+export function ListView() {
+  const removeMutation = useDeleteNetworkListMutation();
+
+  return (
+    <>
+      <PageHeader title="Network List" breadcrumbs={['Networks']} reload />
+
+      <NetworksDatatable
+        onRemove={(networks) => removeMutation.mutate({ networks })}
+      />
+    </>
+  );
+}
diff --git a/app/react/docker/networks/ListView/NestedNetworksTable.tsx b/app/react/docker/networks/ListView/NestedNetworksTable.tsx
new file mode 100644
index 0000000..f3f4764
--- /dev/null
+++ b/app/react/docker/networks/ListView/NestedNetworksTable.tsx
@@ -0,0 +1,27 @@
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+
+import { NestedDatatable } from '@@/datatables/NestedDatatable';
+
+import { useIsSwarm } from '../../proxy/queries/useInfo';
+
+import { useColumns } from './columns';
+import { DecoratedNetwork } from './types';
+
+export function NestedNetworksDatatable({
+  dataset,
+}: {
+  dataset: Array<DecoratedNetwork>;
+}) {
+  const environmentId = useEnvironmentId();
+  const isSwarm = useIsSwarm(environmentId);
+
+  const columns = useColumns(isSwarm);
+  return (
+    <NestedDatatable
+      columns={columns}
+      dataset={dataset}
+      aria-label="Networks table"
+      data-cy="docker-networks-nested-datatable"
+    />
+  );
+}
diff --git a/app/react/docker/networks/ListView/NetworksDatatable.tsx b/app/react/docker/networks/ListView/NetworksDatatable.tsx
new file mode 100644
index 0000000..c67c132
--- /dev/null
+++ b/app/react/docker/networks/ListView/NetworksDatatable.tsx
@@ -0,0 +1,111 @@
+import { Network } from 'lucide-react';
+
+import { Authorized } from '@/react/hooks/useUser';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+
+import { ExpandableDatatable } from '@@/datatables/ExpandableDatatable';
+import {
+  BasicTableSettings,
+  createPersistedStore,
+  refreshableSettings,
+  RefreshableTableSettings,
+} from '@@/datatables/types';
+import { AddButton } from '@@/buttons';
+import { TableSettingsMenu } from '@@/datatables';
+import { TableSettingsMenuAutoRefresh } from '@@/datatables/TableSettingsMenuAutoRefresh';
+import { useTableState } from '@@/datatables/useTableState';
+import { DeleteButton } from '@@/buttons/DeleteButton';
+
+import { useIsSwarm } from '../../proxy/queries/useInfo';
+
+import { useColumns } from './columns';
+import { DecoratedNetwork } from './types';
+import { NestedNetworksDatatable } from './NestedNetworksTable';
+import { useNetworksData } from './useNetworksData';
+
+const storageKey = 'docker.networks';
+
+interface TableSettings extends BasicTableSettings, RefreshableTableSettings {}
+
+const settingsStore = createPersistedStore<TableSettings>(
+  storageKey,
+  'name',
+  (set) => ({
+    ...refreshableSettings(set),
+  })
+);
+
+interface Props {
+  onRemove(selectedItems: Array<{ nodeName?: string; id: string }>): void;
+}
+
+export function NetworksDatatable({ onRemove }: Props) {
+  const settings = useTableState(settingsStore, storageKey);
+
+  const environmentId = useEnvironmentId();
+  const isSwarm = useIsSwarm(environmentId);
+
+  const datasetQuery = useNetworksData(settings.autoRefreshRate);
+  const columns = useColumns(isSwarm);
+
+  const dataset = datasetQuery.data;
+
+  return (
+    <ExpandableDatatable<DecoratedNetwork>
+      settingsManager={settings}
+      title="Networks"
+      titleIcon={Network}
+      dataset={dataset || []}
+      columns={columns}
+      isLoading={datasetQuery.isLoading}
+      getRowCanExpand={({ original: item }) =>
+        !!(item.Subs && item.Subs?.length > 0)
+      }
+      isRowSelectable={({ original: item }) => !item.ResourceControl?.System}
+      renderSubRow={(row) => (
+        <>
+          {row.original.Subs && (
+            <tr>
+              <td colSpan={Number.MAX_SAFE_INTEGER}>
+                <NestedNetworksDatatable dataset={row.original.Subs} />
+              </td>
+            </tr>
+          )}
+        </>
+      )}
+      renderTableActions={(selectedRows) => (
+        <div className="flex gap-3">
+          <Authorized
+            authorizations={['DockerNetworkDelete', 'DockerNetworkCreate']}
+          >
+            <DeleteButton
+              disabled={selectedRows.length === 0}
+              data-cy="network-removeNetworkButton"
+              confirmMessage="Do you want to remove the selected network(s)?"
+              onConfirmed={() =>
+                onRemove(
+                  selectedRows.map((n) => ({ id: n.Id, nodeName: n.NodeName }))
+                )
+              }
+            />
+          </Authorized>
+          <Authorized authorizations="DockerNetworkCreate">
+            <AddButton data-cy="network-addNetworkButton">
+              Add network
+            </AddButton>
+          </Authorized>
+        </div>
+      )}
+      renderTableSettings={() => (
+        <TableSettingsMenu>
+          <TableSettingsMenuAutoRefresh
+            onChange={settings.setAutoRefreshRate}
+            value={settings.autoRefreshRate}
+          />
+        </TableSettingsMenu>
+      )}
+      getRowId={(row) => `${row.Name}-${row.Id}`}
+      data-cy="networks-datatable"
+    />
+  );
+}
diff --git a/app/react/docker/networks/ListView/columns/helper.ts b/app/react/docker/networks/ListView/columns/helper.ts
new file mode 100644
index 0000000..bdc6af1
--- /dev/null
+++ b/app/react/docker/networks/ListView/columns/helper.ts
@@ -0,0 +1,5 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { DecoratedNetwork } from '../types';
+
+export const columnHelper = createColumnHelper<DecoratedNetwork>();
diff --git a/app/react/docker/networks/ListView/columns/index.ts b/app/react/docker/networks/ListView/columns/index.ts
new file mode 100644
index 0000000..b2be3b0
--- /dev/null
+++ b/app/react/docker/networks/ListView/columns/index.ts
@@ -0,0 +1,63 @@
+import _ from 'lodash';
+import { useMemo } from 'react';
+
+import { createOwnershipColumn } from '@/react/docker/components/datatable/createOwnershipColumn';
+
+import { buildExpandColumn } from '@@/datatables/expand-column';
+
+import { DecoratedNetwork } from '../types';
+
+import { columnHelper } from './helper';
+import { name } from './name';
+
+export function useColumns(isHostColumnVisible?: boolean) {
+  return useMemo(
+    () =>
+      _.compact([
+        buildExpandColumn<DecoratedNetwork>(),
+        name,
+        columnHelper.accessor((item) => item.StackName || '-', {
+          header: 'Stack',
+        }),
+        columnHelper.accessor('Driver', {
+          header: 'Driver',
+        }),
+        columnHelper.accessor('Attachable', {
+          header: 'Attachable',
+        }),
+        columnHelper.accessor('IPAM.Driver', {
+          header: 'IPAM Driver',
+        }),
+        columnHelper.accessor(
+          (item) => item.IPAM?.IPV4Configs?.[0]?.Subnet ?? '-',
+          {
+            header: 'IPV4 IPAM Subnet',
+          }
+        ),
+        columnHelper.accessor(
+          (item) => item.IPAM?.IPV4Configs?.[0]?.Gateway ?? '-',
+          {
+            header: 'IPV4 IPAM Gateway',
+          }
+        ),
+        columnHelper.accessor(
+          (item) => item.IPAM?.IPV6Configs?.[0]?.Subnet ?? '-',
+          {
+            header: 'IPV6 IPAM Subnet',
+          }
+        ),
+        columnHelper.accessor(
+          (item) => item.IPAM?.IPV6Configs?.[0]?.Gateway ?? '-',
+          {
+            header: 'IPV6 IPAM Gateway',
+          }
+        ),
+        isHostColumnVisible &&
+          columnHelper.accessor('NodeName', {
+            header: 'Node',
+          }),
+        createOwnershipColumn<DecoratedNetwork>(),
+      ]),
+    [isHostColumnVisible]
+  );
+}
diff --git a/app/react/docker/networks/ListView/columns/name.tsx b/app/react/docker/networks/ListView/columns/name.tsx
new file mode 100644
index 0000000..baad261
--- /dev/null
+++ b/app/react/docker/networks/ListView/columns/name.tsx
@@ -0,0 +1,30 @@
+import { truncate } from '@/portainer/filters/filters';
+
+import { Link } from '@@/Link';
+import { Badge } from '@@/Badge';
+
+import { columnHelper } from './helper';
+
+export const name = columnHelper.accessor('Name', {
+  header: 'Name',
+  id: 'name',
+  cell({ row: { original: item } }) {
+    return (
+      <>
+        <Link
+          to=".network"
+          params={{ id: item.Id, nodeName: item.NodeName }}
+          title={item.Name}
+          data-cy={`network-link-${item.Name}`}
+        >
+          {truncate(item.Name, 40)}
+        </Link>
+        {item.ResourceControl?.System && (
+          <Badge type="info" className="ml-2">
+            System
+          </Badge>
+        )}
+      </>
+    );
+  },
+});
diff --git a/app/react/docker/networks/ListView/types.ts b/app/react/docker/networks/ListView/types.ts
new file mode 100644
index 0000000..cc00b28
--- /dev/null
+++ b/app/react/docker/networks/ListView/types.ts
@@ -0,0 +1,11 @@
+import { IPAMConfig } from 'docker-types';
+
+import { NetworkViewModel } from '@/docker/models/network';
+
+export type DecoratedNetwork = NetworkViewModel & {
+  Subs: DecoratedNetwork[];
+  IPAM: NetworkViewModel['IPAM'] & {
+    IPV4Configs?: Array<IPAMConfig>;
+    IPV6Configs?: Array<IPAMConfig>;
+  };
+};
diff --git a/app/react/docker/networks/ListView/useNetworksData.test.ts b/app/react/docker/networks/ListView/useNetworksData.test.ts
new file mode 100644
index 0000000..c0efc19
--- /dev/null
+++ b/app/react/docker/networks/ListView/useNetworksData.test.ts
@@ -0,0 +1,91 @@
+import { describe, it, expect } from 'vitest';
+
+import { AgentNode } from '../../agent/queries/useAgentNodes';
+
+import { groupSwarmNetworksManagerNodesFirst } from './useNetworksData';
+import { DecoratedNetwork } from './types';
+
+describe('groupSwarmNetworksManagerNodesFirst', () => {
+  it('should leave non-swarm networks untouched and unsubbed', () => {
+    const local = createNetwork({ Id: 'net1', Scope: 'local' });
+
+    const result = groupSwarmNetworksManagerNodesFirst([local], []);
+
+    expect(result).toEqual([local]);
+  });
+
+  it('should group swarm networks sharing an Id, nesting the rest under Subs', () => {
+    const manager = createNetwork({
+      Id: 'net1',
+      NodeName: 'node-manager',
+    });
+    const worker = createNetwork({
+      Id: 'net1',
+      NodeName: 'node-worker',
+    });
+    const agents = [
+      createAgent({ NodeName: 'node-manager', NodeRole: 'manager' }),
+      createAgent({ NodeName: 'node-worker', NodeRole: 'worker' }),
+    ];
+
+    const [result] = groupSwarmNetworksManagerNodesFirst(
+      [worker, manager],
+      agents
+    );
+
+    expect(result.NodeName).toBe('node-manager');
+    expect(result.Subs).toEqual([worker]);
+  });
+
+  it('should place networks with no matching agent role after known roles', () => {
+    const manager = createNetwork({ Id: 'net1', NodeName: 'node-manager' });
+    const unknown = createNetwork({ Id: 'net1', NodeName: 'node-unknown' });
+    const agents = [
+      createAgent({ NodeName: 'node-manager', NodeRole: 'manager' }),
+    ];
+
+    const [result] = groupSwarmNetworksManagerNodesFirst(
+      [unknown, manager],
+      agents
+    );
+
+    expect(result.NodeName).toBe('node-manager');
+    expect(result.Subs).toEqual([unknown]);
+  });
+
+  it('should put grouped swarm networks before non-swarm networks', () => {
+    const swarm = createNetwork({ Id: 'net1', Scope: 'swarm' });
+    const local = createNetwork({ Id: 'net2', Scope: 'local' });
+
+    const result = groupSwarmNetworksManagerNodesFirst([local, swarm], []);
+
+    expect(result.map((n) => n.Id)).toEqual(['net1', 'net2']);
+  });
+});
+
+function createNetwork(
+  overrides: Partial<DecoratedNetwork> = {}
+): DecoratedNetwork {
+  return {
+    Id: 'network1',
+    Name: 'test-network',
+    Scope: 'swarm',
+    Driver: 'overlay',
+    Attachable: false,
+    Internal: false,
+    Ingress: false,
+    Labels: {},
+    IPAM: {},
+    Subs: [],
+    ...overrides,
+  } as DecoratedNetwork;
+}
+
+function createAgent(overrides: Partial<AgentNode> = {}): AgentNode {
+  return {
+    IPAddress: '10.0.0.1',
+    NodeName: 'node1',
+    NodeRole: 'worker',
+    ...overrides,
+  };
+}
diff --git a/app/react/docker/networks/ListView/useNetworksData.ts b/app/react/docker/networks/ListView/useNetworksData.ts
new file mode 100644
index 0000000..44525c7
--- /dev/null
+++ b/app/react/docker/networks/ListView/useNetworksData.ts
@@ -0,0 +1,95 @@
+import _ from 'lodash';
+import { IPAMConfig } from 'docker-types';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { NetworkViewModel } from '@/docker/models/network';
+import DockerNetworkHelper from '@/docker/helpers/networkHelper';
+
+import { useAgentNodes, AgentNode } from '../../agent/queries/useAgentNodes';
+import { useIsSwarmAgent } from '../../proxy/queries/useIsSwarmAgent';
+import { useNetworks } from '../queries/useNetworks';
+import { useApiVersion } from '../../agent/queries/useApiVersion';
+
+import { DecoratedNetwork } from './types';
+
+export function useNetworksData(autoRefreshRate?: number) {
+  const environmentId = useEnvironmentId();
+
+  const networksQuery = useNetworks(
+    environmentId,
+    {
+      local: true,
+      swarm: true,
+      swarmAttachable: true,
+    },
+    {
+      select: (networks) =>
+        networks.map((n) => {
+          const network = new NetworkViewModel(n);
+          const ipam: NetworkViewModel['IPAM'] & {
+            IPV4Configs?: Array<IPAMConfig>;
+            IPV6Configs?: Array<IPAMConfig>;
+          } = network.IPAM ?? {};
+
+          ipam.IPV4Configs = DockerNetworkHelper.getIPV4Configs(ipam.Config);
+          ipam.IPV6Configs = DockerNetworkHelper.getIPV6Configs(ipam.Config);
+
+          network.IPAM = ipam;
+          return {
+            ...network,
+            IPAM: ipam,
+            Subs: [],
+          } satisfies DecoratedNetwork;
+        }),
+      autoRefreshRate,
+    }
+  );
+  const isSwarmAgent = useIsSwarmAgent();
+  const apiVersionQuery = useApiVersion(environmentId);
+  const agentsQuery = useAgentNodes(environmentId, apiVersionQuery.data || 1, {
+    enabled: isSwarmAgent,
+  });
+
+  if (!networksQuery.data) {
+    return { isLoading: true };
+  }
+
+  const networks = groupSwarmNetworksManagerNodesFirst(
+    networksQuery.data,
+    agentsQuery.data
+  );
+
+  return {
+    data: networks,
+    isLoading: networksQuery.isLoading,
+  };
+}
+
+export function groupSwarmNetworksManagerNodesFirst(
+  networks: Array<DecoratedNetwork>,
+  agents: Array<AgentNode> = []
+): Array<DecoratedNetwork> {
+  const nonSwarmNetworks = networks.filter((item) => item.Scope !== 'swarm');
+  const swarmNetworks = networks.filter((item) => item.Scope === 'swarm');
+
+  const swarmNetworksById = new Map<string, Array<DecoratedNetwork>>();
+  swarmNetworks.forEach((item) => {
+    const group = swarmNetworksById.get(item.Id) ?? [];
+    group.push(item);
+    swarmNetworksById.set(item.Id, group);
+  });
+
+  const groupedSwarmNetworks = Array.from(swarmNetworksById.values()).map(
+    (group) => {
+      const [item, ...rest] = _.sortBy(group, getRole);
+      item.Subs = rest;
+      return item;
+    }
+  );
+
+  return [...groupedSwarmNetworks, ...nonSwarmNetworks];
+
+  function getRole(item: NetworkViewModel) {
+    return agents.find((agent) => agent.NodeName === item.NodeName)?.NodeRole;
+  }
+}
diff --git a/app/react/docker/networks/network.helper.ts b/app/react/docker/networks/network.helper.ts
new file mode 100644
index 0000000..761ab53
--- /dev/null
+++ b/app/react/docker/networks/network.helper.ts
@@ -0,0 +1,5 @@
+const systemNetworks = ['host', 'bridge', 'ingress', 'nat', 'none'];
+
+export function isSystemNetwork(networkName: string) {
+  return systemNetworks.includes(networkName);
+}
diff --git a/app/react/docker/networks/queries/queryKeys.ts b/app/react/docker/networks/queries/queryKeys.ts
new file mode 100644
index 0000000..42ef065
--- /dev/null
+++ b/app/react/docker/networks/queries/queryKeys.ts
@@ -0,0 +1,15 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { queryKeys as dockerQueryKeys } from '../../queries/utils';
+import { NetworkId } from '../types';
+
+import { NetworksQuery } from './types';
+
+export const queryKeys = {
+  base: (environmentId: EnvironmentId) =>
+    [...dockerQueryKeys.root(environmentId), 'networks'] as const,
+  list: (environmentId: EnvironmentId, query: NetworksQuery) =>
+    [...queryKeys.base(environmentId), 'list', query] as const,
+  item: (environmentId: EnvironmentId, id: NetworkId) =>
+    [...queryKeys.base(environmentId), id] as const,
+};
diff --git a/app/react/docker/networks/queries/types.ts b/app/react/docker/networks/queries/types.ts
new file mode 100644
index 0000000..94bfdf1
--- /dev/null
+++ b/app/react/docker/networks/queries/types.ts
@@ -0,0 +1,23 @@
+interface Filters {
+  /* dangling=<boolean> When set to true (or 1), returns all networks that are not in use by a container. When set to false (or 0), only networks that are in use by one or more containers are returned. */
+  dangling?: [boolean];
+  // Matches a network's driver
+  driver?: string[];
+  // Matches all or part of a network ID
+  id?: string[];
+  // `label=<key>` or `label=<key>=<value>` of a network label.
+  label?: string[];
+  // Matches all or part of a network name.
+  name?: string[];
+  // Filters networks by scope (swarm, global, or local).
+  scope?: ('swarm' | 'global' | 'local')[];
+  //  Filters networks by type. The custom keyword returns all user-defined networks.
+  type?: ('custom' | 'builtin')[];
+}
+
+export interface NetworksQuery {
+  local?: boolean;
+  swarm?: boolean;
+  swarmAttachable?: boolean;
+  filters?: Filters;
+}
diff --git a/app/react/docker/networks/queries/useConnectContainerMutation.ts b/app/react/docker/networks/queries/useConnectContainerMutation.ts
new file mode 100644
index 0000000..0e2bc38
--- /dev/null
+++ b/app/react/docker/networks/queries/useConnectContainerMutation.ts
@@ -0,0 +1,70 @@
+import { EndpointSettings } from 'docker-types';
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import {
+  mutationOptions,
+  withError,
+  withInvalidate,
+} from '@/react-tools/react-query';
+
+import { queryKeys as containerQueryKeys } from '../../containers/queries/query-keys';
+import { withAgentTargetHeader } from '../../proxy/queries/utils';
+import { buildDockerProxyUrl } from '../../proxy/queries/buildDockerProxyUrl';
+
+interface ConnectContainerPayload {
+  Container: string;
+  EndpointConfig?: EndpointSettings;
+}
+
+export function useConnectContainerMutation(environmentId: EnvironmentId) {
+  const queryClient = useQueryClient();
+
+  return useMutation(
+    (params: Omit<ConnectContainer, 'environmentId'>) =>
+      connectContainer({ ...params, environmentId }),
+    mutationOptions(
+      withError('Failed connecting container to network'),
+      withInvalidate(queryClient, [containerQueryKeys.list(environmentId)])
+    )
+  );
+}
+
+interface ConnectContainer {
+  environmentId: EnvironmentId;
+  networkId: string;
+  containerId: string;
+  aliases?: EndpointSettings['Aliases'];
+  nodeName?: string;
+}
+
+/**
+ * Raw docker API proxy
+ */
+export async function connectContainer({
+  environmentId,
+  containerId,
+  networkId,
+  aliases,
+  nodeName,
+}: ConnectContainer) {
+  const payload: ConnectContainerPayload = {
+    Container: containerId,
+  };
+  if (aliases) {
+    payload.EndpointConfig = {
+      Aliases: aliases,
+    };
+  }
+
+  try {
+    await axios.post(
+      buildDockerProxyUrl(environmentId, 'networks', networkId, 'connect'),
+      payload,
+      { headers: { ...withAgentTargetHeader(nodeName) } }
+    );
+  } catch (err) {
+    throw parseAxiosError(err, 'Unable to connect container');
+  }
+}
diff --git a/app/react/docker/networks/queries/useCreateNetworkMutation.ts b/app/react/docker/networks/queries/useCreateNetworkMutation.ts
new file mode 100644
index 0000000..eb1dbcb
--- /dev/null
+++ b/app/react/docker/networks/queries/useCreateNetworkMutation.ts
@@ -0,0 +1,91 @@
+import { Network } from 'docker-types';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { buildDockerProxyUrl } from '../../proxy/queries/buildDockerProxyUrl';
+import {
+  withAgentManagerOperationHeader,
+  withAgentTargetHeader,
+} from '../../proxy/queries/utils';
+
+type MacvlanConfigOnly = {
+  ConfigOnly: true;
+  Internal: false;
+  Attachable: false;
+  Options: {
+    parent: string; // parent network card
+  };
+};
+
+type MacvlanConfigFrom = {
+  ConfigFrom: {
+    Network: string;
+  };
+  Scope: 'swarm' | 'local';
+};
+
+type NetworkConfigBase = {
+  Name: Required<Network>['Name'];
+  CheckDuplicate?: boolean;
+  Driver?: string;
+  Internal?: boolean;
+  Attachable?: boolean;
+  Ingress?: boolean;
+  IPAM?: Network['IPAM'];
+  EnableIPv6?: boolean;
+  Options?: Network['Options'];
+  Labels?: Network['Labels'];
+};
+
+/**
+ * This type definition of NetworkConfig doesnt enforce the usage of only one type of the union
+ * and not a mix of fields of the unionised types.
+ * e.g. the following is valid for TS while it is not for the Docker API
+ *
+ * const config: NetworkConfig = {
+ *   Name: 'my-network', // shared
+ *   ConfigOnly: true, // MacvlanConfigOnly
+ *   Scope: 'swarm', // MacvlanConfigFrom
+ * }
+ *
+ */
+type NetworkConfig =
+  | NetworkConfigBase
+  | (NetworkConfigBase & MacvlanConfigOnly)
+  | (NetworkConfigBase & MacvlanConfigFrom);
+
+type CreateOptions = {
+  nodeName?: string;
+  agentManagerOperation?: boolean;
+};
+
+type CreateNetworkResponse = {
+  Id: string;
+  Warning: string;
+};
+
+/**
+ * Raw docker API proxy
+ */
+export async function createNetwork(
+  environmentId: EnvironmentId,
+  networkConfig: NetworkConfig,
+  { nodeName, agentManagerOperation }: CreateOptions = {}
+) {
+  try {
+    const { data } = await axios.post<CreateNetworkResponse>(
+      buildDockerProxyUrl(environmentId, 'networks', 'create'),
+      networkConfig,
+      {
+        headers: {
+          ...withAgentTargetHeader(nodeName),
+          ...withAgentManagerOperationHeader(agentManagerOperation),
+        },
+      }
+    );
+    return data;
+  } catch (err) {
+    throw parseAxiosError(err, 'Unable to create network');
+  }
+}
diff --git a/app/react/docker/networks/queries/useDeleteNetworkListMutation.tsx b/app/react/docker/networks/queries/useDeleteNetworkListMutation.tsx
new file mode 100644
index 0000000..9ced2a9
--- /dev/null
+++ b/app/react/docker/networks/queries/useDeleteNetworkListMutation.tsx
@@ -0,0 +1,29 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { processItemsInBatches } from '@/react/common/processItemsInBatches';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { notifySuccess } from '@/portainer/services/notifications';
+import { withError, withInvalidate } from '@/react-tools/react-query';
+
+import { queryKeys } from './queryKeys';
+import { deleteNetwork } from './useDeleteNetworkMutation';
+
+export function useDeleteNetworkListMutation() {
+  const environmentId = useEnvironmentId();
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: ({
+      networks,
+    }: {
+      networks: Array<{ nodeName?: string; id: string }>;
+    }) =>
+      processItemsInBatches(networks, ({ id, nodeName }) =>
+        deleteNetwork(environmentId, id, { nodeName }).then(() =>
+          notifySuccess('Network successfully removed', id)
+        )
+      ),
+    ...withInvalidate(queryClient, [queryKeys.base(environmentId)]),
+    ...withError('Failed to remove networks'),
+  });
+}
diff --git a/app/react/docker/networks/queries/useDeleteNetworkMutation.ts b/app/react/docker/networks/queries/useDeleteNetworkMutation.ts
new file mode 100644
index 0000000..71ae203
--- /dev/null
+++ b/app/react/docker/networks/queries/useDeleteNetworkMutation.ts
@@ -0,0 +1,54 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { withError } from '@/react-tools/react-query';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { buildDockerProxyUrl } from '../../proxy/queries/buildDockerProxyUrl';
+import { withAgentTargetHeader } from '../../proxy/queries/utils';
+import { NetworkId } from '../types';
+
+import { queryKeys } from './queryKeys';
+
+export function useDeleteNetwork(environmentId: EnvironmentId) {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: ({
+      networkId,
+      nodeName,
+    }: {
+      networkId: NetworkId;
+      nodeName?: string;
+    }) => deleteNetwork(environmentId, networkId, { nodeName }),
+    ...withError('Unable to remove network'),
+    onSuccess(_, { networkId }) {
+      queryClient.cancelQueries(queryKeys.item(environmentId, networkId));
+      return queryClient.invalidateQueries(queryKeys.base(environmentId));
+    },
+  });
+}
+
+/**
+ * Raw docker API proxy
+ * @param environmentId
+ * @param networkId
+ * @returns
+ */
+export async function deleteNetwork(
+  environmentId: EnvironmentId,
+  networkId: NetworkId,
+  { nodeName }: { nodeName?: string } = {}
+) {
+  try {
+    await axios.delete(
+      buildDockerProxyUrl(environmentId, 'networks', networkId),
+      {
+        headers: { ...withAgentTargetHeader(nodeName) },
+      }
+    );
+    return networkId;
+  } catch (err) {
+    throw parseAxiosError(err, 'Unable to remove network');
+  }
+}
diff --git a/app/react/docker/networks/queries/useDisconnectContainerMutation.ts b/app/react/docker/networks/queries/useDisconnectContainerMutation.ts
new file mode 100644
index 0000000..feeab4f
--- /dev/null
+++ b/app/react/docker/networks/queries/useDisconnectContainerMutation.ts
@@ -0,0 +1,72 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import {
+  mutationOptions,
+  withError,
+  withInvalidate,
+} from '@/react-tools/react-query';
+
+import { buildDockerProxyUrl } from '../../proxy/queries/buildDockerProxyUrl';
+import { queryKeys as containerQueryKeys } from '../../containers/queries/query-keys';
+import { withAgentTargetHeader } from '../../proxy/queries/utils';
+import { ContainerId } from '../../containers/types';
+import { NetworkId } from '../types';
+
+import { queryKeys } from './queryKeys';
+
+export function useDisconnectContainer({
+  environmentId,
+  networkId,
+}: {
+  environmentId: EnvironmentId;
+  networkId: NetworkId;
+}) {
+  const client = useQueryClient();
+
+  return useMutation(
+    ({
+      containerId,
+      nodeName,
+    }: {
+      containerId: ContainerId;
+      nodeName?: string;
+    }) => disconnectContainer(environmentId, networkId, containerId, nodeName),
+    mutationOptions(
+      withInvalidate(client, [
+        queryKeys.item(environmentId, networkId),
+        containerQueryKeys.list(environmentId),
+      ]),
+      withError('Unable to disconnect container from network')
+    )
+  );
+}
+
+/**
+ * Raw docker API proxy
+ * @param environmentId
+ * @param networkId
+ * @param containerId
+ * @returns
+ */
+export async function disconnectContainer(
+  environmentId: EnvironmentId,
+  networkId: NetworkId,
+  containerId: ContainerId,
+  nodeName?: string
+) {
+  try {
+    await axios.post(
+      buildDockerProxyUrl(environmentId, 'networks', networkId, 'disconnect'),
+      {
+        Container: containerId,
+        Force: false,
+      },
+      { headers: { ...withAgentTargetHeader(nodeName) } }
+    );
+    return { networkId, environmentId };
+  } catch (err) {
+    throw parseAxiosError(err, 'Unable to disconnect container from network');
+  }
+}
diff --git a/app/react/docker/networks/queries/useNetwork.ts b/app/react/docker/networks/queries/useNetwork.ts
new file mode 100644
index 0000000..7819e37
--- /dev/null
+++ b/app/react/docker/networks/queries/useNetwork.ts
@@ -0,0 +1,52 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { withError } from '@/react-tools/react-query';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { DockerNetwork, NetworkId } from '../types';
+import { buildDockerProxyUrl } from '../../proxy/queries/buildDockerProxyUrl';
+import { withAgentTargetHeader } from '../../proxy/queries/utils';
+
+import { queryKeys } from './queryKeys';
+
+export function useNetwork(
+  environmentId: EnvironmentId,
+  networkId: NetworkId,
+  { nodeName }: { nodeName?: string } = {}
+) {
+  return useQuery(
+    [...queryKeys.item(environmentId, networkId), { nodeName }],
+    () => getNetwork(environmentId, networkId, { nodeName }),
+    {
+      ...withError('Unable to get network'),
+    }
+  );
+}
+
+/**
+ * Raw docker API proxy
+ * @param environmentId
+ * @param networkId
+ * @param param2
+ * @returns
+ */
+export async function getNetwork(
+  environmentId: EnvironmentId,
+  networkId: NetworkId,
+  { nodeName }: { nodeName?: string } = {}
+) {
+  try {
+    const { data: network } = await axios.get<DockerNetwork>(
+      buildDockerProxyUrl(environmentId, 'networks', networkId),
+      {
+        headers: {
+          ...withAgentTargetHeader(nodeName),
+        },
+      }
+    );
+    return network;
+  } catch (e) {
+    throw parseAxiosError(e as Error, 'Unable to retrieve network details');
+  }
+}
diff --git a/app/react/docker/networks/queries/useNetworks.ts b/app/react/docker/networks/queries/useNetworks.ts
new file mode 100644
index 0000000..d4479f3
--- /dev/null
+++ b/app/react/docker/networks/queries/useNetworks.ts
@@ -0,0 +1,137 @@
+import { useQuery } from '@tanstack/react-query';
+import { IPAMConfig, Network } from 'docker-types';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { withFiltersQueryParam } from '../../proxy/queries/utils';
+import { buildDockerProxyUrl } from '../../proxy/queries/buildDockerProxyUrl';
+import { PortainerResponse } from '../../types';
+import { DockerNetwork, IPConfig, NetworkResponseContainers } from '../types';
+
+import { queryKeys } from './queryKeys';
+import { NetworksQuery } from './types';
+
+export type NetworkListResponseItem = PortainerResponse<
+  Network & {
+    ConfigFrom?: { Network: string };
+    ConfigOnly?: boolean;
+  }
+>;
+
+export function useNetworks<T = Array<DockerNetwork>>(
+  environmentId: EnvironmentId,
+  query: NetworksQuery,
+  {
+    enabled = true,
+    onSuccess,
+    select,
+    autoRefreshRate,
+  }: {
+    enabled?: boolean;
+    onSuccess?(networks: T): void;
+    select?(networks: Array<DockerNetwork>): T;
+    autoRefreshRate?: number;
+  } = {}
+) {
+  return useQuery(
+    queryKeys.list(environmentId, query),
+    () => getNetworks(environmentId, query),
+    {
+      enabled,
+      onSuccess,
+      select,
+
+      refetchInterval: autoRefreshRate ?? false,
+    }
+  );
+}
+
+/**
+ * Raw docker API proxy
+ */
+export async function getNetworks(
+  environmentId: EnvironmentId,
+  { local, swarm, swarmAttachable, filters }: NetworksQuery
+) {
+  try {
+    const { data } = await axios.get<Array<NetworkListResponseItem>>(
+      buildDockerProxyUrl(environmentId, 'networks'),
+      {
+        params: { ...withFiltersQueryParam(filters) },
+      }
+    );
+
+    const parsed = data.map(toDockerNetwork);
+
+    return !local && !swarm && !swarmAttachable
+      ? parsed
+      : parsed.filter(
+          (network) =>
+            (local && network.Scope === 'local') ||
+            (swarm && network.Scope === 'swarm') ||
+            (swarmAttachable &&
+              network.Scope === 'swarm' &&
+              network.Attachable === true)
+        );
+  } catch (err) {
+    throw parseAxiosError(err, 'Unable to retrieve networks');
+  }
+}
+
+function toDockerNetwork(req: NetworkListResponseItem): DockerNetwork {
+  return {
+    ...req,
+
+    Name: req.Name || '',
+    Id: req.Id || '',
+    Driver: req.Driver || '',
+    Scope: req.Scope || '',
+    Attachable: req.Attachable ?? false,
+    Internal: req.Internal ?? false,
+    IPAM: toIpam(req.IPAM),
+    Options: req.Options ?? {},
+    Containers: toContainers(req.Containers),
+  };
+
+  function toContainers(
+    req: NetworkListResponseItem['Containers']
+  ): NetworkResponseContainers {
+    if (!req) return {};
+    return Object.fromEntries(
+      Object.entries(req).map(([id, c]) => [
+        id,
+        {
+          EndpointID: c.EndpointID ?? '',
+          IPv4Address: c.IPv4Address ?? '',
+          IPv6Address: c.IPv6Address ?? '',
+          MacAddress: c.MacAddress ?? '',
+          Name: c.Name ?? '',
+        },
+      ])
+    );
+  }
+
+  function toIpam(req: NetworkListResponseItem['IPAM']): DockerNetwork['IPAM'] {
+    if (!req) {
+      return {
+        Config: [],
+        Driver: '',
+        Options: {},
+      };
+    }
+
+    return {
+      Config: req.Config?.map(toIpamConfig) || [],
+      Driver: req.Driver || '',
+      Options: req.Options,
+    };
+  }
+
+  function toIpamConfig(req: IPAMConfig): IPConfig {
+    return {
+      Subnet: req.Subnet ?? '',
+      Gateway: req.Gateway ?? '',
+    };
+  }
+}
diff --git a/app/react/docker/networks/types.ts b/app/react/docker/networks/types.ts
new file mode 100644
index 0000000..e53069c
--- /dev/null
+++ b/app/react/docker/networks/types.ts
@@ -0,0 +1,48 @@
+import { PortainerResponse } from '@/react/docker/types';
+import { ContainerId } from '@/react/docker/containers/types';
+
+export type IPConfig = {
+  Subnet: string;
+  Gateway: string;
+  IPRange?: string;
+  AuxiliaryAddresses?: Record<string, string>;
+};
+
+export type NetworkId = string;
+
+export type NetworkOptions = Record<string, string>;
+
+type IpamOptions = Record<string, string> | undefined;
+
+export type NetworkResponseContainer = {
+  EndpointID: string;
+  IPv4Address: string;
+  IPv6Address: string;
+  MacAddress: string;
+  Name: string;
+};
+
+export interface NetworkContainer extends NetworkResponseContainer {
+  Id: ContainerId;
+}
+
+export type NetworkResponseContainers = Record<
+  ContainerId,
+  NetworkResponseContainer
+>;
+
+export interface DockerNetwork extends PortainerResponse<unknown> {
+  Name: string;
+  Id: NetworkId;
+  Driver: string;
+  Scope: string;
+  Attachable: boolean;
+  Internal: boolean;
+  IPAM: {
+    Config: IPConfig[];
+    Driver: string;
+    Options: IpamOptions;
+  };
+  Options: NetworkOptions;
+  Containers: NetworkResponseContainers;
+}
diff --git a/app/react/docker/proxy/queries/buildDockerProxyUrl.ts b/app/react/docker/proxy/queries/buildDockerProxyUrl.ts
new file mode 100644
index 0000000..9f9218e
--- /dev/null
+++ b/app/react/docker/proxy/queries/buildDockerProxyUrl.ts
@@ -0,0 +1,50 @@
+import { compact } from 'lodash';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+/**
+ * Build docker proxy URL for Environment
+ *
+ * @param environmentId
+ * @param action
+ * @param subSegments  Sub segments are only added to the URL when they are not `undefined`.
+ * @returns `/endpoints/{environmentId}/docker/{action}/{subSegments[0]}/{subSegments[1]}/...`
+ *
+ * @example
+ * // all calls return /endpoints/1/docker/action/sub1/sub2
+ * buildDockerProxyUrl(1, 'action', 'sub1', 'sub2');
+ * buildDockerProxyUrl(1, 'action', undefined, 'sub1', undefined, 'sub2');
+ *
+ * @example
+ * function buildUrl(endpointId: EnvironmentId, id?: ServiceId, action?: string) {
+ *   return buildDockerProxyUrl(endpointId, 'services', id, action);
+ *}
+ *
+ * // returns /endpoints/1/docker/services/ubx3r/update
+ * buildUrl(1, 'ubx3r', 'update')
+ *
+ * // returns /endpoints/1/docker/services/update
+ * buildUrl(1, undefined, 'update')
+ *
+ * // returns /endpoints/1/docker/services/ubx3r
+ * buildUrl(1, 'ubx3r') // = buildUrl(1, 'ubx3r', undefined)
+ *
+ * // returns /endpoints/1/docker/services
+ * buildUrl(1) // = buildUrl(1, undefined, undefined)
+ *
+ */
+export function buildDockerProxyUrl(
+  environmentId: EnvironmentId,
+  action: string,
+  ...subSegments: unknown[]
+) {
+  let url = `/endpoints/${environmentId}/docker/${action}`;
+
+  const joined = compact(subSegments).join('/');
+
+  if (joined) {
+    url += `/${joined}`;
+  }
+
+  return url;
+}
diff --git a/app/react/docker/proxy/queries/images/queryKeys.ts b/app/react/docker/proxy/queries/images/queryKeys.ts
new file mode 100644
index 0000000..2daddae
--- /dev/null
+++ b/app/react/docker/proxy/queries/images/queryKeys.ts
@@ -0,0 +1,9 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { queryKeys as proxyQueryKeys } from '../query-keys';
+
+export const queryKeys = {
+  base: (environmentId: EnvironmentId) =>
+    [proxyQueryKeys.base(environmentId), 'images'] as const,
+  list: (environmentId: EnvironmentId) => queryKeys.base(environmentId),
+};
diff --git a/app/react/docker/proxy/queries/images/useDownloadImages.ts b/app/react/docker/proxy/queries/images/useDownloadImages.ts
new file mode 100644
index 0000000..40e170b
--- /dev/null
+++ b/app/react/docker/proxy/queries/images/useDownloadImages.ts
@@ -0,0 +1,31 @@
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { buildDockerProxyUrl } from '../buildDockerProxyUrl';
+import { formatArrayQueryParamsForDockerAPI } from '../utils';
+
+/**
+ * Raw docker API proxy
+ */
+export async function downloadImages(
+  environmentId: EnvironmentId,
+  images: { tags: string[]; id: string }[]
+) {
+  const names = images.map((image) =>
+    image.tags[0] !== '<none>:<none>' ? image.tags[0] : image.id
+  );
+
+  try {
+    const { data } = await axios.get(
+      buildDockerProxyUrl(environmentId, 'images', 'get'),
+      {
+        params: { names },
+        responseType: 'blob',
+        paramsSerializer: formatArrayQueryParamsForDockerAPI,
+      }
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to download images');
+  }
+}
diff --git a/app/react/docker/proxy/queries/images/useImage.ts b/app/react/docker/proxy/queries/images/useImage.ts
new file mode 100644
index 0000000..56ffa86
--- /dev/null
+++ b/app/react/docker/proxy/queries/images/useImage.ts
@@ -0,0 +1,26 @@
+import { ImageInspect } from 'docker-types';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { buildDockerProxyUrl } from '../buildDockerProxyUrl';
+
+/**
+ * Raw docker API proxy
+ * @param environmentId
+ * @param id
+ * @returns
+ */
+export async function getImage(
+  environmentId: EnvironmentId,
+  id: Required<ImageInspect['Id']>
+) {
+  try {
+    const { data } = await axios.get<ImageInspect>(
+      buildDockerProxyUrl(environmentId, 'images', id, 'json')
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to retrieve image');
+  }
+}
diff --git a/app/react/docker/proxy/queries/images/useImageHistory.ts b/app/react/docker/proxy/queries/images/useImageHistory.ts
new file mode 100644
index 0000000..a3073fe
--- /dev/null
+++ b/app/react/docker/proxy/queries/images/useImageHistory.ts
@@ -0,0 +1,32 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { buildDockerProxyUrl } from '../buildDockerProxyUrl';
+
+export type ImageLayer = {
+  Id: string;
+  Created: number;
+  CreatedBy: string;
+  Tags: string[];
+  Size: number;
+  Comment: string;
+};
+
+/**
+ * Raw docker API proxy
+ * @param environmentId
+ * @returns
+ */
+export async function getImageHistory(
+  environmentId: EnvironmentId,
+  id: ImageLayer['Id']
+) {
+  try {
+    const { data } = await axios.get<ImageLayer[]>(
+      buildDockerProxyUrl(environmentId, 'images', id, 'history')
+    );
+    return data;
+  } catch (err) {
+    throw parseAxiosError(err as Error, 'Unable to retrieve image layers');
+  }
+}
diff --git a/app/react/docker/proxy/queries/images/useImages.ts b/app/react/docker/proxy/queries/images/useImages.ts
new file mode 100644
index 0000000..4e5dd29
--- /dev/null
+++ b/app/react/docker/proxy/queries/images/useImages.ts
@@ -0,0 +1,41 @@
+import { useQuery } from '@tanstack/react-query';
+import { ImageSummary } from 'docker-types';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { buildDockerProxyUrl } from '../buildDockerProxyUrl';
+
+import { queryKeys } from './queryKeys';
+
+type ImagesListResponse = Array<ImageSummary>;
+
+export function useImages<T = ImagesListResponse>(
+  environmentId: EnvironmentId,
+  {
+    select,
+    enabled,
+  }: { select?(data: ImagesListResponse): T; enabled?: boolean } = {}
+) {
+  return useQuery(
+    queryKeys.list(environmentId),
+    () => getImages(environmentId),
+    { select, enabled }
+  );
+}
+
+/**
+ * Raw docker API proxy
+ * @param environmentId
+ * @returns
+ */
+export async function getImages(environmentId: EnvironmentId) {
+  try {
+    const { data } = await axios.get<ImagesListResponse>(
+      buildDockerProxyUrl(environmentId, 'images', 'json')
+    );
+    return data;
+  } catch (err) {
+    throw parseAxiosError(err, 'Unable to retrieve images');
+  }
+}
diff --git a/app/react/docker/proxy/queries/images/useRemoveImageMutation.ts b/app/react/docker/proxy/queries/images/useRemoveImageMutation.ts
new file mode 100644
index 0000000..1e3e0f1
--- /dev/null
+++ b/app/react/docker/proxy/queries/images/useRemoveImageMutation.ts
@@ -0,0 +1,28 @@
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { ImageId, ImageName } from '@/docker/models/image';
+
+import { buildDockerProxyUrl } from '../buildDockerProxyUrl';
+
+/**
+ * Raw docker API proxy
+ * @param environmentId
+ * @param id
+ * @param force
+ * @returns
+ */
+export async function removeImage(
+  environmentId: EnvironmentId,
+  id: ImageId | ImageName,
+  force?: boolean
+) {
+  try {
+    const { data } = await axios.delete(
+      buildDockerProxyUrl(environmentId, 'images', id),
+      { params: { force } }
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to remove image');
+  }
+}
diff --git a/app/react/docker/proxy/queries/images/useTagImageMutation.ts b/app/react/docker/proxy/queries/images/useTagImageMutation.ts
new file mode 100644
index 0000000..e38fcf2
--- /dev/null
+++ b/app/react/docker/proxy/queries/images/useTagImageMutation.ts
@@ -0,0 +1,30 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { ImageId, ImageName } from '@/docker/models/image';
+
+import { buildDockerProxyUrl } from '../buildDockerProxyUrl';
+
+/**
+ * Raw docker API proxy
+ * @param environmentId
+ * @param id
+ * @param repo string generated by `buildImageFullURIFromModel` or `buildImageFullURI`
+ * @returns
+ */
+export async function tagImage(
+  environmentId: EnvironmentId,
+  id: ImageId | ImageName,
+  repo: string,
+  tag?: string
+) {
+  try {
+    const { data } = await axios.post(
+      buildDockerProxyUrl(environmentId, 'images', id, 'tag'),
+      {},
+      { params: { repo, tag } }
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to tag image');
+  }
+}
diff --git a/app/react/docker/proxy/queries/images/useUploadImageMutation.ts b/app/react/docker/proxy/queries/images/useUploadImageMutation.ts
new file mode 100644
index 0000000..40c9626
--- /dev/null
+++ b/app/react/docker/proxy/queries/images/useUploadImageMutation.ts
@@ -0,0 +1,26 @@
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { buildDockerProxyUrl } from '../buildDockerProxyUrl';
+
+/**
+ * Raw docker API proxy
+ * @param environmentId
+ * @param file
+ * @returns
+ */
+export async function uploadImages(environmentId: EnvironmentId, file: File) {
+  try {
+    return await axios.post(
+      buildDockerProxyUrl(environmentId, 'images', 'load'),
+      file,
+      {
+        headers: {
+          'Content-Type': file.type, // 'application/x-tar',
+        },
+      }
+    );
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to upload image');
+  }
+}
diff --git a/app/react/docker/proxy/queries/nodes/query-keys.ts b/app/react/docker/proxy/queries/nodes/query-keys.ts
new file mode 100644
index 0000000..3f599e1
--- /dev/null
+++ b/app/react/docker/proxy/queries/nodes/query-keys.ts
@@ -0,0 +1,8 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { queryKeys as proxyQueryKeys } from '../query-keys';
+
+export const queryKeys = {
+  base: (environmentId: EnvironmentId) =>
+    [...proxyQueryKeys.base(environmentId), 'nodes'] as const,
+};
diff --git a/app/react/docker/proxy/queries/nodes/useNode.ts b/app/react/docker/proxy/queries/nodes/useNode.ts
new file mode 100644
index 0000000..6c00715
--- /dev/null
+++ b/app/react/docker/proxy/queries/nodes/useNode.ts
@@ -0,0 +1,26 @@
+import { Node } from 'docker-types';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { buildDockerProxyUrl } from '../buildDockerProxyUrl';
+
+/**
+ * Raw docker API proxy
+ * @param environmentId
+ * @param id
+ * @returns
+ */
+export async function getNode(
+  environmentId: EnvironmentId,
+  id: NonNullable<Node['ID']>
+) {
+  try {
+    const { data } = await axios.get<Node>(
+      buildDockerProxyUrl(environmentId, 'nodes', id)
+    );
+    return data;
+  } catch (error) {
+    throw parseAxiosError(error, 'Unable to retrieve node');
+  }
+}
diff --git a/app/react/docker/proxy/queries/nodes/useNodes.ts b/app/react/docker/proxy/queries/nodes/useNodes.ts
new file mode 100644
index 0000000..23a5ccc
--- /dev/null
+++ b/app/react/docker/proxy/queries/nodes/useNodes.ts
@@ -0,0 +1,29 @@
+import { Node } from 'docker-types';
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { buildDockerProxyUrl } from '../buildDockerProxyUrl';
+
+import { queryKeys } from './query-keys';
+
+export function useNodes(environmentId: EnvironmentId) {
+  return useQuery(queryKeys.base(environmentId), () => getNodes(environmentId));
+}
+
+/**
+ * Raw docker API proxy
+ * @param environmentId
+ * @returns
+ */
+export async function getNodes(environmentId: EnvironmentId) {
+  try {
+    const { data } = await axios.get<Array<Node>>(
+      buildDockerProxyUrl(environmentId, 'nodes')
+    );
+    return data;
+  } catch (error) {
+    throw parseAxiosError(error, 'Unable to retrieve nodes');
+  }
+}
diff --git a/app/react/docker/proxy/queries/nodes/useUpdateNodeMutation.ts b/app/react/docker/proxy/queries/nodes/useUpdateNodeMutation.ts
new file mode 100644
index 0000000..1e5b279
--- /dev/null
+++ b/app/react/docker/proxy/queries/nodes/useUpdateNodeMutation.ts
@@ -0,0 +1,31 @@
+import { Node, NodeSpec } from 'docker-types';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { buildDockerProxyUrl } from '../buildDockerProxyUrl';
+
+/**
+ * Raw docker API proxy
+ * @param environmentId
+ * @param id
+ * @param node
+ * @param version
+ */
+export async function updateNode(
+  environmentId: EnvironmentId,
+  id: NonNullable<Node['ID']>,
+  node: NodeSpec,
+  version: number
+) {
+  try {
+    const { data } = await axios.post(
+      buildDockerProxyUrl(environmentId, 'nodes', id, 'update'),
+      node,
+      { params: { version } }
+    );
+    return data;
+  } catch (err) {
+    throw parseAxiosError(err, 'Unable to update node');
+  }
+}
diff --git a/app/react/docker/proxy/queries/query-keys.ts b/app/react/docker/proxy/queries/query-keys.ts
new file mode 100644
index 0000000..d11da42
--- /dev/null
+++ b/app/react/docker/proxy/queries/query-keys.ts
@@ -0,0 +1,8 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+export const queryKeys = {
+  base: (environmentId: EnvironmentId) =>
+    [environmentId, 'docker', 'proxy'] as const,
+  events: (environmentId: EnvironmentId, params?: object) =>
+    [...queryKeys.base(environmentId), 'events', params] as const,
+};
diff --git a/app/react/docker/proxy/queries/secrets/useCreateSecretMutation.ts b/app/react/docker/proxy/queries/secrets/useCreateSecretMutation.ts
new file mode 100644
index 0000000..17f69f4
--- /dev/null
+++ b/app/react/docker/proxy/queries/secrets/useCreateSecretMutation.ts
@@ -0,0 +1,21 @@
+import { SecretSpec } from 'docker-types';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { buildDockerProxyUrl } from '../buildDockerProxyUrl';
+
+export async function createSecret(
+  environmentId: EnvironmentId,
+  secret: SecretSpec
+) {
+  try {
+    const { data } = await axios.post(
+      buildDockerProxyUrl(environmentId, 'secrets', 'create'),
+      secret
+    );
+    return data;
+  } catch (err) {
+    throw parseAxiosError(err, 'Unable to create secret');
+  }
+}
diff --git a/app/react/docker/proxy/queries/secrets/useRemoveSecretMutation.ts b/app/react/docker/proxy/queries/secrets/useRemoveSecretMutation.ts
new file mode 100644
index 0000000..603177c
--- /dev/null
+++ b/app/react/docker/proxy/queries/secrets/useRemoveSecretMutation.ts
@@ -0,0 +1,17 @@
+import { Secret } from 'docker-types';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { buildDockerProxyUrl } from '../buildDockerProxyUrl';
+
+export async function removeSecret(
+  environmentId: EnvironmentId,
+  id: NonNullable<Secret['ID']>
+) {
+  try {
+    await axios.delete(buildDockerProxyUrl(environmentId, 'secrets', id));
+  } catch (err) {
+    throw parseAxiosError(err, 'Unable to remove secret');
+  }
+}
diff --git a/app/react/docker/proxy/queries/secrets/useSecret.ts b/app/react/docker/proxy/queries/secrets/useSecret.ts
new file mode 100644
index 0000000..2bfbb60
--- /dev/null
+++ b/app/react/docker/proxy/queries/secrets/useSecret.ts
@@ -0,0 +1,21 @@
+import { Secret } from 'docker-types';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { PortainerResponse } from '@/react/docker/types';
+
+import { buildDockerProxyUrl } from '../buildDockerProxyUrl';
+
+export async function getSecret(
+  environmentId: EnvironmentId,
+  id: NonNullable<Secret['ID']>
+) {
+  try {
+    const { data } = await axios.get<PortainerResponse<Secret>>(
+      buildDockerProxyUrl(environmentId, 'secrets', id)
+    );
+    return data;
+  } catch (err) {
+    throw parseAxiosError(err, 'Unable to retrieve secret');
+  }
+}
diff --git a/app/react/docker/proxy/queries/secrets/useSecrets.ts b/app/react/docker/proxy/queries/secrets/useSecrets.ts
new file mode 100644
index 0000000..e3cef85
--- /dev/null
+++ b/app/react/docker/proxy/queries/secrets/useSecrets.ts
@@ -0,0 +1,15 @@
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { buildDockerProxyUrl } from '../buildDockerProxyUrl';
+
+export async function getSecrets(environmentId: EnvironmentId) {
+  try {
+    const { data } = await axios.get(
+      buildDockerProxyUrl(environmentId, 'secrets')
+    );
+    return data;
+  } catch (err) {
+    throw parseAxiosError(err, 'Unable to retrieve secrets');
+  }
+}
diff --git a/app/react/docker/proxy/queries/tasks/query-keys.ts b/app/react/docker/proxy/queries/tasks/query-keys.ts
new file mode 100644
index 0000000..57ba937
--- /dev/null
+++ b/app/react/docker/proxy/queries/tasks/query-keys.ts
@@ -0,0 +1,10 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { queryKeys as proxyQueryKeys } from '../query-keys';
+
+export const queryKeys = {
+  base: (environmentId: EnvironmentId) =>
+    [...proxyQueryKeys.base(environmentId), 'tasks'] as const,
+  list: (environmentId: EnvironmentId, params?: unknown) =>
+    [...queryKeys.base(environmentId), params] as const,
+};
diff --git a/app/react/docker/proxy/queries/tasks/useTasks.ts b/app/react/docker/proxy/queries/tasks/useTasks.ts
new file mode 100644
index 0000000..3baaaea
--- /dev/null
+++ b/app/react/docker/proxy/queries/tasks/useTasks.ts
@@ -0,0 +1,59 @@
+import { Task } from 'docker-types';
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { buildDockerProxyUrl } from '../buildDockerProxyUrl';
+import { withFiltersQueryParam } from '../utils';
+
+import { queryKeys } from './query-keys';
+
+/**
+ * https://docs.docker.com/reference/api/engine/version/v1.52/#tag/Task/operation/TaskList
+ */
+type Filters = {
+  'desired-state'?: Array<'running' | 'shutdown' | 'accepted'>;
+  id?: Array<Task['ID']>;
+  label?: Array<string>;
+  name?: Array<Task['Name']>;
+  node?: Array<Task['NodeID']>;
+  service?: Array<Task['ServiceID']>;
+};
+
+export function useTasks<T = Task>(
+  {
+    environmentId,
+    filters,
+  }: {
+    environmentId: EnvironmentId;
+    filters?: Filters;
+  },
+  { enabled, select }: { enabled?: boolean; select?: (data: Task[]) => T } = {}
+) {
+  return useQuery({
+    queryKey: queryKeys.list(environmentId, filters),
+    queryFn: () => getTasks(environmentId, filters),
+    enabled,
+    select,
+  });
+}
+
+export async function getTasks(
+  environmentId: EnvironmentId,
+  filters?: Filters
+) {
+  try {
+    const { data } = await axios.get<Task[]>(
+      buildDockerProxyUrl(environmentId, 'tasks'),
+      {
+        params: {
+          ...withFiltersQueryParam(filters),
+        },
+      }
+    );
+    return data;
+  } catch (err) {
+    throw parseAxiosError(err, 'Unable to retrieve tasks');
+  }
+}
diff --git a/app/react/docker/proxy/queries/useCommitContainerMutation.ts b/app/react/docker/proxy/queries/useCommitContainerMutation.ts
new file mode 100644
index 0000000..ea9f560
--- /dev/null
+++ b/app/react/docker/proxy/queries/useCommitContainerMutation.ts
@@ -0,0 +1,89 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import {
+  buildImageFullURIFromModel,
+  fullURIIntoRepoAndTag,
+} from '@/react/docker/images/utils';
+import { useEnvironmentRegistries } from '@/react/portainer/environments/queries/useEnvironmentRegistries';
+import { withError } from '@/react-tools/react-query';
+
+import { queryKeys } from '../../containers/queries/query-keys';
+
+import { buildDockerProxyUrl } from './buildDockerProxyUrl';
+
+type CommitParams = {
+  container?: string; //  The ID or name of the container to commit
+  repo?: string; //  Repository name for the created image
+  tag?: string; //  Tag name for the create image
+  comment?: string; //  Commit message
+  author?: string; //  Author of the image (e.g., John Hannibal Smith <hannibal@a-team.com>)
+  pause?: boolean; //  Default: true  Whether to pause the container before committing
+  changes?: string; //  Dockerfile instructions to apply while committing
+};
+
+interface MutationParams {
+  environmentId: EnvironmentId;
+  containerId: string;
+  image: string;
+  registryId?: number;
+  useRegistry: boolean;
+}
+
+export function useCommitContainerMutation(environmentId: EnvironmentId) {
+  const queryClient = useQueryClient();
+  const registriesQuery = useEnvironmentRegistries(environmentId);
+
+  return useMutation({
+    mutationFn: async ({
+      environmentId,
+      containerId,
+      image,
+      registryId,
+      useRegistry,
+    }: MutationParams) => {
+      const registry = useRegistry
+        ? registriesQuery.data?.find((r) => r.Id === registryId)
+        : undefined;
+
+      const fullURI = buildImageFullURIFromModel({
+        UseRegistry: useRegistry,
+        Registry: registry,
+        Image: image,
+      });
+
+      const { repo, tag } = fullURIIntoRepoAndTag(fullURI);
+
+      return commitContainer(environmentId, {
+        container: containerId,
+        repo,
+        tag,
+      });
+    },
+
+    ...withError('Unable to create image'),
+    onSuccess: (_, { containerId, environmentId }) =>
+      queryClient.invalidateQueries(
+        queryKeys.container(environmentId, containerId)
+      ),
+  });
+}
+
+export async function commitContainer(
+  environmentId: EnvironmentId,
+  params: CommitParams
+) {
+  try {
+    const { data } = await axios.post<{ Id: string }>(
+      buildDockerProxyUrl(environmentId, 'commit'),
+      {},
+      {
+        params,
+      }
+    );
+    return data;
+  } catch (err) {
+    throw parseAxiosError(err, 'Unable to commit container');
+  }
+}
diff --git a/app/react/docker/proxy/queries/useEvents.ts b/app/react/docker/proxy/queries/useEvents.ts
new file mode 100644
index 0000000..1713062
--- /dev/null
+++ b/app/react/docker/proxy/queries/useEvents.ts
@@ -0,0 +1,39 @@
+import { EventMessage } from 'docker-types';
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { jsonObjectsToArrayHandler } from '@/portainer/helpers/json';
+
+import { buildDockerProxyUrl } from './buildDockerProxyUrl';
+import { queryKeys } from './query-keys';
+
+type Params = { since?: number; until?: number };
+
+export function useEvents(
+  environmentId: EnvironmentId,
+  { params }: { params?: Params } = {}
+) {
+  return useQuery({
+    queryKey: [...queryKeys.events(environmentId, params)],
+    queryFn: () => getEvents(environmentId, params),
+  });
+}
+
+/**
+ * Raw docker API proxy
+ */
+export async function getEvents(
+  environmentId: EnvironmentId,
+  { since, until }: Params = {}
+) {
+  try {
+    const { data } = await axios.get<EventMessage[]>(
+      buildDockerProxyUrl(environmentId, 'events'),
+      { params: { since, until }, transformResponse: jsonObjectsToArrayHandler }
+    );
+    return data;
+  } catch (err) {
+    throw parseAxiosError(err, 'Unable to retrieve engine events');
+  }
+}
diff --git a/app/react/docker/proxy/queries/useExecResizeTTYMutation.ts b/app/react/docker/proxy/queries/useExecResizeTTYMutation.ts
new file mode 100644
index 0000000..a9532fe
--- /dev/null
+++ b/app/react/docker/proxy/queries/useExecResizeTTYMutation.ts
@@ -0,0 +1,30 @@
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { buildDockerProxyUrl } from './buildDockerProxyUrl';
+
+/**
+ * Raw docker API proxy
+ * @param environmentId
+ * @param id exec instance id
+ */
+export async function resizeTTY(
+  environmentId: EnvironmentId,
+  id: string,
+  { width, height }: { width: number; height: number }
+) {
+  try {
+    await axios.post(
+      buildDockerProxyUrl(environmentId, 'exec', id, 'resize'),
+      {},
+      {
+        params: {
+          h: height,
+          w: width,
+        },
+      }
+    );
+  } catch (err) {
+    throw parseAxiosError(err, 'Unable to resize tty of exec');
+  }
+}
diff --git a/app/react/docker/proxy/queries/useInfo.ts b/app/react/docker/proxy/queries/useInfo.ts
new file mode 100644
index 0000000..3e756bc
--- /dev/null
+++ b/app/react/docker/proxy/queries/useInfo.ts
@@ -0,0 +1,86 @@
+import { useQuery } from '@tanstack/react-query';
+import { SystemInfo } from 'docker-types';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { buildDockerProxyUrl } from './buildDockerProxyUrl';
+
+export async function getInfo(environmentId: EnvironmentId) {
+  try {
+    const { data } = await axios.get<SystemInfo>(
+      buildDockerProxyUrl(environmentId, 'info')
+    );
+    return data;
+  } catch (err) {
+    throw parseAxiosError(err, 'Unable to retrieve system info');
+  }
+}
+
+export function useInfo<TSelect = SystemInfo>(
+  environmentId?: EnvironmentId,
+  {
+    enabled,
+    select,
+  }: { select?: (info: SystemInfo) => TSelect; enabled?: boolean } = {}
+) {
+  return useQuery(
+    ['environment', environmentId, 'docker', 'info'],
+    () => getInfo(environmentId!),
+    {
+      select,
+      enabled: !!environmentId && enabled,
+    }
+  );
+}
+
+export function useIsWindows(environmentId: EnvironmentId) {
+  const query = useInfo(environmentId, {
+    select: (info) => info.OSType === 'windows',
+  });
+
+  return !!query.data;
+}
+
+export function useIsStandalone(
+  environmentId: EnvironmentId | undefined,
+  { enabled }: { enabled?: boolean } = {}
+) {
+  const query = useInfo(environmentId, {
+    select: (info) => !info.Swarm?.NodeID,
+    enabled,
+  });
+
+  return !!query.data;
+}
+
+export function useIsSwarm(
+  environmentId?: EnvironmentId,
+  { enabled }: { enabled?: boolean } = {}
+) {
+  const query = useInfo(environmentId, {
+    select: (info) => !!info.Swarm?.NodeID,
+    enabled,
+  });
+
+  return !!query.data;
+}
+
+export function useSystemLimits(environmentId: EnvironmentId) {
+  const infoQuery = useInfo(environmentId);
+
+  const maxCpu = infoQuery.data?.NCPU || 32;
+  const maxMemory = infoQuery.data?.MemTotal
+    ? Math.floor(infoQuery.data.MemTotal / 1000 / 1000)
+    : 32768;
+
+  return { maxCpu, maxMemory };
+}
+
+export function useIsSwarmManager(environmentId: EnvironmentId) {
+  const query = useInfo(environmentId, {
+    select: (info) => !!info.Swarm?.NodeID && info.Swarm.ControlAvailable,
+  });
+
+  return !!query.data;
+}
diff --git a/app/react/docker/proxy/queries/useIsSwarmAgent.ts b/app/react/docker/proxy/queries/useIsSwarmAgent.ts
new file mode 100644
index 0000000..b092f25
--- /dev/null
+++ b/app/react/docker/proxy/queries/useIsSwarmAgent.ts
@@ -0,0 +1,17 @@
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useCurrentEnvironment } from '@/react/hooks/useCurrentEnvironment';
+import { isAgentEnvironment } from '@/react/portainer/environments/utils';
+
+import { useIsSwarm } from './useInfo';
+
+export function useIsSwarmAgent() {
+  const envId = useEnvironmentId();
+  const isSwarm = useIsSwarm(envId);
+  const envQuery = useCurrentEnvironment();
+
+  if (!envQuery.isSuccess) {
+    return false;
+  }
+
+  return isSwarm && isAgentEnvironment(envQuery.data.Type);
+}
diff --git a/app/react/docker/proxy/queries/usePing.ts b/app/react/docker/proxy/queries/usePing.ts
new file mode 100644
index 0000000..f5a4ea7
--- /dev/null
+++ b/app/react/docker/proxy/queries/usePing.ts
@@ -0,0 +1,12 @@
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { buildDockerProxyUrl } from './buildDockerProxyUrl';
+
+export async function ping(environmentId: EnvironmentId) {
+  try {
+    await axios.get(buildDockerProxyUrl(environmentId, '_ping'));
+  } catch (error) {
+    throw parseAxiosError(error);
+  }
+}
diff --git a/app/react/docker/proxy/queries/usePlugins.ts b/app/react/docker/proxy/queries/usePlugins.ts
new file mode 100644
index 0000000..865e100
--- /dev/null
+++ b/app/react/docker/proxy/queries/usePlugins.ts
@@ -0,0 +1,124 @@
+import { useQuery } from '@tanstack/react-query';
+import { Plugin, PluginInterfaceType, PluginsInfo } from 'docker-types';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { queryKeys } from '../../queries/utils/root';
+
+import { buildDockerProxyUrl } from './buildDockerProxyUrl';
+import { useInfo } from './useInfo';
+
+const pluginTypeToVersionMap: { [k in keyof PluginsInfo]: string } = {
+  Volume: 'docker.volumedriver/1.0',
+  Network: 'docker.networkdriver/1.0',
+  Log: 'docker.logdriver/1.0',
+};
+
+export async function getPlugins(environmentId: EnvironmentId) {
+  try {
+    const { data } = await axios.get<Array<Plugin>>(
+      buildDockerProxyUrl(environmentId, 'plugins')
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to retrieve plugins');
+  }
+}
+
+function usePlugins(
+  environmentId: EnvironmentId,
+  { enabled }: { enabled?: boolean } = {}
+) {
+  return useQuery(
+    queryKeys.plugins(environmentId),
+    () => getPlugins(environmentId),
+    { enabled }
+  );
+}
+
+export function useServicePlugins(
+  environmentId: EnvironmentId,
+  systemOnly: boolean,
+  pluginType: keyof PluginsInfo
+) {
+  const systemPluginsQuery = useInfo(environmentId, {
+    select: (info) => info.Plugins,
+  });
+  const pluginsQuery = usePlugins(environmentId, { enabled: !systemOnly });
+
+  return {
+    data: aggregateData(
+      systemPluginsQuery.data,
+      pluginsQuery.data,
+      systemOnly,
+      pluginType
+    ),
+    isLoading: systemPluginsQuery.isLoading || pluginsQuery.isLoading,
+  };
+}
+
+/**
+ * @private Exported only for AngularJS `PluginService` factory `app/docker/services/pluginService.js`
+ */
+export function aggregateData(
+  systemPluginsData: PluginsInfo | undefined,
+  pluginsData: Plugin[] | undefined,
+  systemOnly: boolean,
+  pluginType: keyof PluginsInfo
+) {
+  if (!systemPluginsData) {
+    return null;
+  }
+
+  const systemPlugins = systemPluginsData[pluginType] || [];
+
+  if (systemOnly) {
+    return systemPlugins;
+  }
+
+  const plugins =
+    pluginsData
+      ?.filter(
+        (plugin) =>
+          plugin.Enabled &&
+          // docker has an error in their types, so we need to cast to unknown first
+          // see https://docs.docker.com/engine/api/v1.47/#tag/Plugin/operation/PluginList
+          plugin.Config.Interface.Types.includes(
+            pluginTypeToVersionMap[pluginType] as unknown as PluginInterfaceType
+          )
+      )
+      .map((plugin) => plugin.Name) || [];
+
+  return [...systemPlugins, ...plugins];
+}
+
+export function useLoggingPlugins(
+  environmentId: EnvironmentId,
+  systemOnly: boolean,
+  isPodman?: boolean
+) {
+  //  systemOnly false + podman false|undefined -> both
+  //  systemOnly true + podman false|undefined -> system
+  //  systemOnly false + podman true -> system
+  //  systemOnly true + podman true -> system
+  return useServicePlugins(
+    environmentId,
+    systemOnly || isPodman === true,
+    'Log'
+  );
+}
+
+export function useVolumePlugins(
+  environmentId: EnvironmentId,
+  systemOnly: boolean
+) {
+  return useServicePlugins(environmentId, systemOnly, 'Volume');
+}
+
+export function useNetworkPlugins(
+  environmentId: EnvironmentId,
+  systemOnly: boolean
+) {
+  return useServicePlugins(environmentId, systemOnly, 'Network');
+}
diff --git a/app/react/docker/proxy/queries/useSwarm.ts b/app/react/docker/proxy/queries/useSwarm.ts
new file mode 100644
index 0000000..b80ff07
--- /dev/null
+++ b/app/react/docker/proxy/queries/useSwarm.ts
@@ -0,0 +1,40 @@
+import { useQuery } from '@tanstack/react-query';
+import { Swarm } from 'docker-types';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { queryKeys } from './query-keys';
+import { useIsSwarm } from './useInfo';
+import { buildDockerProxyUrl } from './buildDockerProxyUrl';
+
+export function useSwarm<T = Swarm>(
+  environmentId: EnvironmentId,
+  { select }: { select?(value: Swarm): T } = {}
+) {
+  const isSwarm = useIsSwarm(environmentId);
+
+  return useQuery({
+    queryKey: [...queryKeys.base(environmentId), 'swarm'] as const,
+    queryFn: () => getSwarm(environmentId),
+    select,
+    enabled: isSwarm,
+  });
+}
+
+export async function getSwarm(environmentId: EnvironmentId) {
+  try {
+    const { data } = await axios.get<Swarm>(
+      buildDockerProxyUrl(environmentId, 'swarm')
+    );
+    return data;
+  } catch (err) {
+    throw parseAxiosError(err, 'Unable to retrieve swarm information');
+  }
+}
+
+export function useSwarmId(environmentId: EnvironmentId) {
+  return useSwarm(environmentId, {
+    select: (swarm) => swarm.ID,
+  });
+}
diff --git a/app/react/docker/proxy/queries/useVersion.ts b/app/react/docker/proxy/queries/useVersion.ts
new file mode 100644
index 0000000..d809877
--- /dev/null
+++ b/app/react/docker/proxy/queries/useVersion.ts
@@ -0,0 +1,37 @@
+import { useQuery } from '@tanstack/react-query';
+import { SystemVersion } from 'docker-types';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { buildDockerProxyUrl } from './buildDockerProxyUrl';
+
+export async function getVersion(environmentId: EnvironmentId) {
+  try {
+    const { data } = await axios.get<SystemVersion>(
+      buildDockerProxyUrl(environmentId, 'version')
+    );
+    return data;
+  } catch (err) {
+    throw parseAxiosError(err, 'Unable to retrieve version');
+  }
+}
+
+export function useVersion<TSelect = SystemVersion>(
+  environmentId?: EnvironmentId,
+  select?: (info: SystemVersion) => TSelect
+) {
+  return useQuery(
+    ['environment', environmentId!, 'docker', 'version'],
+    () => getVersion(environmentId!),
+    {
+      select,
+      enabled: !!environmentId,
+    }
+  );
+}
+
+export function useApiVersion(environmentId?: EnvironmentId) {
+  const query = useVersion(environmentId, (info) => info.ApiVersion);
+  return query.data ? parseFloat(query.data) : 0;
+}
diff --git a/app/react/docker/proxy/queries/utils.ts b/app/react/docker/proxy/queries/utils.ts
new file mode 100644
index 0000000..24bfba9
--- /dev/null
+++ b/app/react/docker/proxy/queries/utils.ts
@@ -0,0 +1,67 @@
+import { agentTargetHeader } from '@/portainer/services/axios/axios';
+import { RegistryId } from '@/react/portainer/registries/types/registry';
+
+/**
+ * Generates the `filters` query param entry for docker API list actions
+ *
+ * @param filters map[string][]string
+ * @returns `{ filters: filters && JSON.stringify(filters) }`
+ */
+export function withFiltersQueryParam<T = unknown>(filters?: T) {
+  return { filters: filters && JSON.stringify(filters) };
+}
+
+/**
+ * Encodes the registry credentials in base64
+ * @param registryId
+ * @returns
+ */
+function encodeRegistryCredentials(registryId: RegistryId) {
+  return window.btoa(JSON.stringify({ registryId }));
+}
+
+/**
+ * Generates the `X-Registry-Auth` header for docker API
+ * @param registryId The registry Id to use
+ * @returns
+ */
+export function withRegistryAuthHeader(registryId?: RegistryId) {
+  return registryId !== undefined
+    ? { 'X-Registry-Auth': encodeRegistryCredentials(registryId) }
+    : {};
+}
+
+/**
+ * Generates the `X-PortainerAgent-Target` header
+ * @param nodeName The node name to target
+ * @returns
+ */
+export function withAgentTargetHeader(nodeName?: string) {
+  return nodeName ? { [agentTargetHeader]: nodeName } : {};
+}
+
+/**
+ * Generates the `'X-PortainerAgent-ManagerOperation'` header
+ * @param managerOperation
+ * @returns
+ */
+export function withAgentManagerOperationHeader(managerOperation?: boolean) {
+  return managerOperation ? { 'X-PortainerAgent-ManagerOperation': '1' } : {};
+}
+
+/**
+ * The Docker API expects array query params as `param = value_1 & param = value_2`
+ * axios default serializer generates `names[] = value_1 & names[] = value_2`
+ * which are ignored by the Docker API
+ * @param params
+ * @returns the concatenated string of query params with Docker expected format
+ */
+export function formatArrayQueryParamsForDockerAPI(
+  params: Record<string, unknown>
+) {
+  return Object.entries(params)
+    .flatMap(([param, value]) =>
+      (Array.isArray(value) ? value : [value]).map((v) => `${param}=${v}`)
+    )
+    .join('&');
+}
diff --git a/app/react/docker/queries/useDockerStorageUsageQuery.ts b/app/react/docker/queries/useDockerStorageUsageQuery.ts
new file mode 100644
index 0000000..1398058
--- /dev/null
+++ b/app/react/docker/queries/useDockerStorageUsageQuery.ts
@@ -0,0 +1,64 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+/**
+ * Disk storage snapshot for the partition backing Docker's data directory.
+ * Returned by the agent's docker-storage endpoint (200 OK).
+ * A 204 response means the agent is reachable but could not determine usage
+ * (e.g. Docker socket or host filesystem not accessible).
+ */
+type DockerStorageUsage = {
+  /** Filesystem path used to measure disk capacity. */
+  rootDir: string;
+  /** Total capacity of the partition in bytes. */
+  totalBytes: number;
+  /** Bytes consumed by Docker artifacts (images, container layers, volumes, build cache). */
+  dockerBytes: number;
+  /** Deduplicated image layer data (LayersSize from docker system df). */
+  imageBytes: number;
+  /** Sum of writable-layer sizes across all containers (SizeRw). Image layers excluded. */
+  containerBytes: number;
+  /** Sum of known volume sizes. Volumes with unknown sizes (non-local drivers) excluded. */
+  volumeBytes: number;
+  /** Sum of all build cache entry sizes. */
+  buildCacheBytes: number;
+  /** Bytes available to unprivileged processes. Non-Docker used = totalBytes - availableBytes - dockerBytes. */
+  availableBytes: number;
+};
+
+const queryKeys = {
+  dockerStorage: (environmentId: EnvironmentId) =>
+    ['environments', environmentId, 'docker', 'storage'] as const,
+};
+
+export function useDockerStorageUsageQuery(
+  environmentId: EnvironmentId,
+  { enabled = true }: { enabled?: boolean } = {}
+) {
+  return useQuery(
+    queryKeys.dockerStorage(environmentId),
+    () => getDockerStorageUsage(environmentId),
+    {
+      retry: false,
+      enabled,
+    }
+  );
+}
+
+async function getDockerStorageUsage(
+  environmentId: EnvironmentId
+): Promise<DockerStorageUsage | undefined> {
+  try {
+    const { data } = await axios.get<DockerStorageUsage | null>(
+      `/endpoints/${environmentId}/agent/host/docker-storage`,
+      // Accept 204: agent reachable but storage info unavailable (returns null body).
+      { validateStatus: (s) => s === 200 || s === 204 }
+    );
+    // Normalise null (204 body) to undefined so callers can use a single undefined check.
+    return data ?? undefined;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to get Docker storage usage');
+  }
+}
diff --git a/app/react/docker/queries/utils/buildDockerUrl.ts b/app/react/docker/queries/utils/buildDockerUrl.ts
new file mode 100644
index 0000000..0c94c03
--- /dev/null
+++ b/app/react/docker/queries/utils/buildDockerUrl.ts
@@ -0,0 +1,50 @@
+import { compact } from 'lodash';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+/**
+ * Build docker URL for Environment
+ *
+ * @param environmentId
+ * @param action
+ * @param subSegments Sub segments are only added to the URL when they are not `undefined`.
+ * @returns `/docker/{environmentId}/{action}/{subSegments[0]}/{subSegments[1]}/...`
+ *
+ * @example
+ * // all calls return /docker/1/action/sub1/sub2
+ * buildDockerUrl(1, 'action', 'sub1', 'sub2');
+ * buildDockerUrl(1, 'action', undefined, 'sub1', undefined, 'sub2');
+ *
+ * @example
+ * function buildUrl(endpointId: EnvironmentId, id?: ServiceId, action?: string) {
+ *   return buildDockerUrl(endpointId, 'services', id, action);
+ *}
+ *
+ * // returns /docker/1/services/ubx3r/update
+ * buildUrl(1, 'ubx3r', 'update')
+ *
+ * // returns /docker/1/services/update
+ * buildUrl(1, undefined, 'update')
+ *
+ * // returns /docker/1/services/ubx3r
+ * buildUrl(1, 'ubx3r') // = buildUrl(1, 'ubx3r', undefined)
+ *
+ * // returns /docker/1/services
+ * buildUrl(1) // = buildUrl(1, undefined, undefined)
+ *
+ */
+export function buildDockerUrl(
+  environmentId: EnvironmentId,
+  action: string,
+  ...subSegments: unknown[]
+) {
+  let url = `/docker/${environmentId}/${action}`;
+
+  const joined = compact(subSegments).join('/');
+
+  if (joined) {
+    url += `/${joined}`;
+  }
+
+  return url;
+}
diff --git a/app/react/docker/queries/utils/container.ts b/app/react/docker/queries/utils/container.ts
new file mode 100644
index 0000000..2fb0484
--- /dev/null
+++ b/app/react/docker/queries/utils/container.ts
@@ -0,0 +1,36 @@
+import { ContainerListViewModel } from '@/react/docker/containers/types';
+import { EdgeStack } from '@/react/edge/edge-stacks/types';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { buildDockerSnapshotUrl, queryKeys as rootQueryKeys } from './root';
+
+export interface ContainersQueryParams {
+  edgeStackId?: EdgeStack['Id'];
+}
+
+export const queryKeys = {
+  ...rootQueryKeys,
+  containers: (environmentId: EnvironmentId) =>
+    [...queryKeys.snapshot(environmentId), 'containers'] as const,
+  containersQuery: (
+    environmentId: EnvironmentId,
+    params: ContainersQueryParams
+  ) => [...queryKeys.containers(environmentId), params] as const,
+  container: (
+    environmentId: EnvironmentId,
+    containerId: ContainerListViewModel['Id']
+  ) => [...queryKeys.containers(environmentId), containerId] as const,
+};
+
+export function buildDockerSnapshotContainersUrl(
+  environmentId: EnvironmentId,
+  containerId?: ContainerListViewModel['Id']
+) {
+  let url = `${buildDockerSnapshotUrl(environmentId)}/containers`;
+
+  if (containerId) {
+    url += `/${containerId}`;
+  }
+
+  return url;
+}
diff --git a/app/react/docker/queries/utils/index.ts b/app/react/docker/queries/utils/index.ts
new file mode 100644
index 0000000..eb0e0dd
--- /dev/null
+++ b/app/react/docker/queries/utils/index.ts
@@ -0,0 +1,14 @@
+import { queryKeys as containerQueryKeys } from './container';
+import { queryKeys as rootQueryKeys } from './root';
+
+export const queryKeys = {
+  ...rootQueryKeys,
+  ...containerQueryKeys,
+};
+
+export {
+  buildDockerSnapshotContainersUrl,
+  type ContainersQueryParams,
+} from './container';
+
+export { buildDockerSnapshotUrl } from './root';
diff --git a/app/react/docker/queries/utils/root.ts b/app/react/docker/queries/utils/root.ts
new file mode 100644
index 0000000..d47a94a
--- /dev/null
+++ b/app/react/docker/queries/utils/root.ts
@@ -0,0 +1,17 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { buildDockerUrl } from './buildDockerUrl';
+
+export const queryKeys = {
+  root: (environmentId: EnvironmentId) => ['docker', environmentId] as const,
+  snapshot: (environmentId: EnvironmentId) =>
+    [...queryKeys.root(environmentId), 'snapshot'] as const,
+  snapshotQuery: (environmentId: EnvironmentId) =>
+    [...queryKeys.snapshot(environmentId)] as const,
+  plugins: (environmentId: EnvironmentId) =>
+    [...queryKeys.root(environmentId), 'plugins'] as const,
+};
+
+export function buildDockerSnapshotUrl(environmentId: EnvironmentId) {
+  return buildDockerUrl(environmentId, 'snapshot');
+}
diff --git a/app/react/docker/secrets/.keep b/app/react/docker/secrets/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/docker/secrets/CreateView/.keep b/app/react/docker/secrets/CreateView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/docker/secrets/ItemView/.keep b/app/react/docker/secrets/ItemView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/docker/secrets/ListView/SecretsDatatable.tsx b/app/react/docker/secrets/ListView/SecretsDatatable.tsx
new file mode 100644
index 0000000..5655466
--- /dev/null
+++ b/app/react/docker/secrets/ListView/SecretsDatatable.tsx
@@ -0,0 +1,112 @@
+import { createColumnHelper } from '@tanstack/react-table';
+import { Lock } from 'lucide-react';
+
+import { SecretViewModel } from '@/docker/models/secret';
+import { isoDate } from '@/portainer/filters/filters';
+import { Authorized, useAuthorizations } from '@/react/hooks/useUser';
+
+import { buildNameColumn } from '@@/datatables/buildNameColumn';
+import { Datatable, TableSettingsMenu } from '@@/datatables';
+import {
+  BasicTableSettings,
+  RefreshableTableSettings,
+  createPersistedStore,
+  refreshableSettings,
+} from '@@/datatables/types';
+import { useTableState } from '@@/datatables/useTableState';
+import { TableSettingsMenuAutoRefresh } from '@@/datatables/TableSettingsMenuAutoRefresh';
+import { AddButton } from '@@/buttons';
+import { useRepeater } from '@@/datatables/useRepeater';
+import { DeleteButton } from '@@/buttons/DeleteButton';
+
+import { createOwnershipColumn } from '../../components/datatable/createOwnershipColumn';
+
+const columnHelper = createColumnHelper<SecretViewModel>();
+
+const columns = [
+  buildNameColumn<SecretViewModel>('Name', '.secret', 'docker-secrets-name'),
+  columnHelper.accessor((item) => isoDate(item.CreatedAt), {
+    header: 'Creation Date',
+  }),
+  createOwnershipColumn<SecretViewModel>(),
+];
+
+interface TableSettings extends BasicTableSettings, RefreshableTableSettings {}
+
+const storageKey = 'docker-secrets';
+const store = createPersistedStore<TableSettings>(
+  storageKey,
+  undefined,
+  (set) => ({
+    ...refreshableSettings(set),
+  })
+);
+
+export function SecretsDatatable({
+  dataset,
+  onRemove,
+  onRefresh,
+}: {
+  dataset?: Array<SecretViewModel>;
+  onRemove(items: Array<SecretViewModel>): void;
+  onRefresh(): Promise<void>;
+}) {
+  const tableState = useTableState(store, storageKey);
+  useRepeater(tableState.autoRefreshRate, onRefresh);
+
+  const hasWriteAccessQuery = useAuthorizations([
+    'DockerSecretCreate',
+    'DockerSecretDelete',
+  ]);
+
+  return (
+    <Datatable
+      title="Secrets"
+      titleIcon={Lock}
+      columns={columns}
+      dataset={dataset || []}
+      isLoading={!dataset}
+      disableSelect={!hasWriteAccessQuery.authorized}
+      settingsManager={tableState}
+      data-cy="docker-secrets-datatable"
+      renderTableActions={(selectedItems) =>
+        hasWriteAccessQuery.authorized && (
+          <TableActions selectedItems={selectedItems} onRemove={onRemove} />
+        )
+      }
+      renderTableSettings={() => (
+        <TableSettingsMenu>
+          <TableSettingsMenuAutoRefresh
+            value={tableState.autoRefreshRate}
+            onChange={(value) => tableState.setAutoRefreshRate(value)}
+          />
+        </TableSettingsMenu>
+      )}
+    />
+  );
+}
+
+function TableActions({
+  selectedItems,
+  onRemove,
+}: {
+  selectedItems: Array<SecretViewModel>;
+  onRemove(items: Array<SecretViewModel>): void;
+}) {
+  return (
+    <div className="flex items-center gap-2">
+      <Authorized authorizations="DockerSecretDelete">
+        <DeleteButton
+          disabled={selectedItems.length === 0}
+          onConfirmed={() => onRemove(selectedItems)}
+          confirmMessage="Do you want to remove the selected secret(s)?"
+          data-cy="secret-removeSecretButton"
+        />
+      </Authorized>
+
+      <Authorized authorizations="DockerSecretCreate">
+        <AddButton data-cy="secret-addSecretButton">Add secret</AddButton>
+      </Authorized>
+    </div>
+  );
+}
diff --git a/app/react/docker/services/CreateView/.keep b/app/react/docker/services/CreateView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/docker/services/ItemView/PortMappingField/PortsMappingField.tsx b/app/react/docker/services/ItemView/PortMappingField/PortsMappingField.tsx
new file mode 100644
index 0000000..5a81568
--- /dev/null
+++ b/app/react/docker/services/ItemView/PortMappingField/PortsMappingField.tsx
@@ -0,0 +1,213 @@
+import { List, Trash2 } from 'lucide-react';
+
+import { Authorized } from '@/react/hooks/useUser';
+
+import { ButtonSelector } from '@@/form-components/ButtonSelector/ButtonSelector';
+import { FormError } from '@@/form-components/FormError';
+import {
+  ArrayError,
+  ItemProps,
+  useInputList,
+} from '@@/form-components/InputList/InputList';
+import { Table } from '@@/datatables';
+import { Button } from '@@/buttons';
+import { Select } from '@@/form-components/Input';
+
+import { ServiceWidget } from '../ServiceWidget';
+
+import { Protocol, Value } from './types';
+import { RangeOrNumberField } from './RangeOrNumberField';
+
+export type Values = Array<Value>;
+
+export function PortsMappingField({
+  values,
+  onChange,
+  errors,
+  disabled,
+  readOnly,
+  hasChanges,
+  onReset,
+  onSubmit,
+}: {
+  values: Values;
+  onChange(value: Values): void;
+  errors?: ArrayError<Values>;
+  disabled?: boolean;
+  readOnly?: boolean;
+  hasChanges: boolean;
+  onReset(all?: boolean): void;
+  onSubmit(): void;
+}) {
+  const { handleRemoveItem, handleAdd, handleChangeItem } = useInputList<Value>(
+    {
+      value: values,
+      onChange,
+      itemBuilder: () => ({
+        hostPort: 0,
+        containerPort: 0,
+        protocol: 'tcp',
+        publishMode: 'ingress',
+      }),
+    }
+  );
+
+  return (
+    <ServiceWidget
+      titleIcon={List}
+      title="Published ports"
+      labelForAddButton="port mapping"
+      onAdd={handleAdd}
+      hasChanges={hasChanges}
+      onReset={onReset}
+      onSubmit={onSubmit}
+      isValid={!errors}
+    >
+      {values.length > 0 ? (
+        <Table data-cy="service-published-ports-table">
+          <thead>
+            <tr>
+              <th>Host port</th>
+              <th>Container port</th>
+              <th>Protocol</th>
+              <th>Publish mode</th>
+              <Authorized authorizations="DockerServiceUpdate">
+                <th>Actions</th>
+              </Authorized>
+            </tr>
+          </thead>
+
+          <tbody>
+            {values.map((item, index) => (
+              <Item
+                key={index}
+                item={item}
+                index={index}
+                onChange={(value) => handleChangeItem(index, value)}
+                error={errors?.[index]}
+                disabled={disabled}
+                readOnly={readOnly}
+                onRemove={() => handleRemoveItem(index, item)}
+              />
+            ))}
+          </tbody>
+        </Table>
+      ) : (
+        <p className="p-5">This service has no ports published.</p>
+      )}
+      {typeof errors === 'string' && (
+        <div className="form-group col-md-12">
+          <FormError>{errors}</FormError>
+        </div>
+      )}
+    </ServiceWidget>
+  );
+}
+
+function Item({
+  onChange,
+  item,
+  error,
+  disabled,
+  readOnly,
+  onRemove,
+  index,
+}: ItemProps<Value> & { onRemove(): void }) {
+  return (
+    <>
+      <tr>
+        <td>
+          <div className="flex items-center gap-2">
+            <RangeOrNumberField
+              value={item.hostPort}
+              onChange={(value) => handleChange('hostPort', value)}
+              id={`hostPort-${index}`}
+              label="host"
+              data-cy={`hostPort-${index}`}
+            />
+          </div>
+        </td>
+        <td>
+          <RangeOrNumberField
+            value={item.containerPort}
+            onChange={(value) => handleChange('containerPort', value)}
+            id={`containerPort-${index}`}
+            label="container"
+            data-cy={`containerPort-${index}`}
+          />
+        </td>
+        <td>
+          <ButtonSelector<Protocol>
+            onChange={(value) => handleChange('protocol', value)}
+            value={item.protocol}
+            options={[{ value: 'tcp' }, { value: 'udp' }]}
+            disabled={disabled}
+            readOnly={readOnly}
+            aria-label="protocol selector"
+          />
+        </td>
+        <td>
+          <Select
+            onChange={(e) => handleChange('publishMode', e.target.value)}
+            value={item.publishMode}
+            options={[
+              { value: 'ingress', label: 'ingress' },
+              { value: 'host', label: 'host' },
+            ]}
+            disabled={disabled}
+            aria-label="publish mode"
+            data-cy={`publishMode-${index}`}
+          />
+        </td>
+        <td>
+          <Button
+            icon={Trash2}
+            color="dangerlight"
+            onClick={() => onRemove()}
+            data-cy={`remove-port-${index}`}
+          />
+        </td>
+      </tr>
+      {error && (
+        <tr>
+          {typeof error === 'string' ? (
+            <td colSpan={5}>
+              <FormError>{error}</FormError>
+            </td>
+          ) : (
+            <>
+              <td>
+                <FormError>{rangeError(error.hostPort)}</FormError>
+              </td>
+              <td>
+                <FormError>{rangeError(error.containerPort)}</FormError>
+              </td>
+              <td>
+                <FormError>{error.protocol}</FormError>
+              </td>
+              <td>
+                <FormError>{error.publishMode}</FormError>
+              </td>
+            </>
+          )}
+        </tr>
+      )}
+    </>
+  );
+
+  function handleChange(name: keyof Value, value: unknown) {
+    onChange({ ...item, [name]: value });
+  }
+
+  function rangeError(error?: string | { start?: string; end?: string }) {
+    if (!error) {
+      return null;
+    }
+
+    if (typeof error === 'string') {
+      return error;
+    }
+
+    return error.start || error.end;
+  }
+}
diff --git a/app/react/docker/services/ItemView/PortMappingField/RangeOrNumberField.tsx b/app/react/docker/services/ItemView/PortMappingField/RangeOrNumberField.tsx
new file mode 100644
index 0000000..932735b
--- /dev/null
+++ b/app/react/docker/services/ItemView/PortMappingField/RangeOrNumberField.tsx
@@ -0,0 +1,137 @@
+import { AutomationTestingProps } from '@/types';
+
+import { InputLabeled } from '@@/form-components/Input/InputLabeled';
+import { Checkbox } from '@@/form-components/Checkbox';
+
+import { Range, isRange } from './types';
+
+export function RangeOrNumberField({
+  value,
+  onChange,
+  disabled,
+  readOnly,
+  id,
+  label,
+  'data-cy': dataCy,
+}: {
+  value: Range | number | undefined;
+  onChange: (value: Range | number | undefined) => void;
+  disabled?: boolean;
+  readOnly?: boolean;
+  id: string;
+  label: string;
+} & AutomationTestingProps) {
+  return (
+    <div className="flex items-center gap-2">
+      <RangeCheckbox value={value} onChange={onChange} data-cy={dataCy} />
+      {isRange(value) ? (
+        <RangeInput
+          value={value}
+          onChange={onChange}
+          label={label}
+          disabled={disabled}
+          readOnly={readOnly}
+          id={id}
+          data-cy={dataCy}
+        />
+      ) : (
+        <InputLabeled
+          size="small"
+          placeholder="e.g. 80"
+          className="w-1/2"
+          label={label}
+          disabled={disabled}
+          readOnly={readOnly}
+          id={id}
+          value={value || ''}
+          type="number"
+          onChange={(e) => onChange(getNumber(e.target.valueAsNumber))}
+          data-cy={dataCy}
+        />
+      )}
+    </div>
+  );
+}
+
+function RangeInput({
+  value,
+  onChange,
+  disabled,
+  readOnly,
+  id,
+  label,
+  'data-cy': dataCy,
+}: {
+  value: Range;
+  onChange: (value: Range) => void;
+  disabled?: boolean;
+  readOnly?: boolean;
+  id: string;
+  label: string;
+} & AutomationTestingProps) {
+  return (
+    <div className="flex items-center gap-2">
+      <label className="m-0 font-normal">{label}</label>
+      <InputLabeled
+        label="from"
+        size="small"
+        value={value.start || ''}
+        onChange={(e) =>
+          handleChange({ start: getNumber(e.target.valueAsNumber) })
+        }
+        disabled={disabled}
+        readOnly={readOnly}
+        id={id}
+        type="number"
+        data-cy={`${dataCy}-start`}
+      />
+
+      <InputLabeled
+        label="to"
+        size="small"
+        value={value.end || ''}
+        onChange={(e) =>
+          handleChange({ end: getNumber(e.target.valueAsNumber) })
+        }
+        disabled={disabled}
+        readOnly={readOnly}
+        id={id}
+        type="number"
+        data-cy={`${dataCy}-end`}
+      />
+    </div>
+  );
+
+  function handleChange(range: Partial<Range>) {
+    onChange({ ...value, ...range });
+  }
+}
+
+function getNumber(value: number) {
+  return Number.isNaN(value) ? 0 : value;
+}
+
+function RangeCheckbox({
+  value,
+  onChange,
+  'data-cy': dataCy,
+}: {
+  value: Range | number | undefined;
+  onChange: (value: Range | number | undefined) => void;
+} & AutomationTestingProps) {
+  const isValueRange = isRange(value);
+  return (
+    <Checkbox
+      label="range"
+      checked={isValueRange}
+      onChange={() => {
+        if (!isValueRange) {
+          onChange({ start: value || 0, end: value || 0 });
+        } else {
+          onChange(value.start);
+        }
+      }}
+      data-cy={`${dataCy}-range-checkbox`}
+    />
+  );
+}
diff --git a/app/react/docker/services/ItemView/PortMappingField/index.ts b/app/react/docker/services/ItemView/PortMappingField/index.ts
new file mode 100644
index 0000000..2d7783b
--- /dev/null
+++ b/app/react/docker/services/ItemView/PortMappingField/index.ts
@@ -0,0 +1,12 @@
+import { toRequest } from './toRequest';
+import { toViewModel } from './toViewModel';
+import { validation } from './validation';
+
+export { PortsMappingField } from './PortsMappingField';
+export type { Values as PortsMappingValues } from './PortsMappingField';
+
+export const portsMappingUtils = {
+  toRequest,
+  toViewModel,
+  validation,
+};
diff --git a/app/react/docker/services/ItemView/PortMappingField/toRequest.test.ts b/app/react/docker/services/ItemView/PortMappingField/toRequest.test.ts
new file mode 100644
index 0000000..1c895b6
--- /dev/null
+++ b/app/react/docker/services/ItemView/PortMappingField/toRequest.test.ts
@@ -0,0 +1,118 @@
+import { toRequest } from './toRequest';
+
+test('should handle empty portBindings', () => {
+  const result = toRequest([]);
+  expect(result).toEqual([]);
+});
+
+test('should handle single port binding', () => {
+  const result = toRequest([
+    {
+      hostPort: 80,
+      protocol: 'tcp',
+      containerPort: 80,
+      publishMode: 'ingress',
+    },
+  ]);
+  expect(result).toEqual([
+    {
+      PublishedPort: 80,
+      Protocol: 'tcp',
+      TargetPort: 80,
+      PublishMode: 'ingress',
+    },
+  ]);
+});
+
+test('should handle port range', () => {
+  const result = toRequest([
+    {
+      hostPort: { start: 80, end: 82 },
+      protocol: 'tcp',
+      containerPort: { start: 80, end: 82 },
+      publishMode: 'ingress',
+    },
+  ]);
+  expect(result).toEqual([
+    {
+      PublishedPort: 80,
+      Protocol: 'tcp',
+      TargetPort: 80,
+      PublishMode: 'ingress',
+    },
+    {
+      PublishedPort: 81,
+      Protocol: 'tcp',
+      TargetPort: 81,
+      PublishMode: 'ingress',
+    },
+    {
+      PublishedPort: 82,
+      Protocol: 'tcp',
+      TargetPort: 82,
+      PublishMode: 'ingress',
+    },
+  ]);
+});
+
+test('should throw error for unequal port ranges', () => {
+  expect(() =>
+    toRequest([
+      {
+        hostPort: { start: 80, end: 82 },
+        protocol: 'tcp',
+        containerPort: { start: 80, end: 81 },
+        publishMode: 'ingress',
+      },
+    ])
+  ).toThrow(
+    'Invalid port specification: host port range must be equal to container port range'
+  );
+});
+
+test('should handle host port range with single container port', () => {
+  const result = toRequest([
+    {
+      hostPort: { start: 80, end: 82 },
+      protocol: 'tcp',
+      containerPort: 80,
+      publishMode: 'ingress',
+    },
+  ]);
+  expect(result).toEqual([
+    {
+      PublishedPort: 80,
+      Protocol: 'tcp',
+      TargetPort: 80,
+      PublishMode: 'ingress',
+    },
+    {
+      PublishedPort: 81,
+      Protocol: 'tcp',
+      TargetPort: 80,
+      PublishMode: 'ingress',
+    },
+    {
+      PublishedPort: 82,
+      Protocol: 'tcp',
+      TargetPort: 80,
+      PublishMode: 'ingress',
+    },
+  ]);
+});
+
+test('should throw error for container port range with single host port', () => {
+  expect(() =>
+    toRequest([
+      // @ts-expect-error test invalid input
+      {
+        hostPort: 80,
+        protocol: 'tcp',
+        containerPort: { start: 80, end: 82 },
+        publishMode: 'ingress',
+      },
+    ])
+  ).toThrow(
+    'Invalid port specification: host port must be a range when container port is a range'
+  );
+});
diff --git a/app/react/docker/services/ItemView/PortMappingField/toRequest.ts b/app/react/docker/services/ItemView/PortMappingField/toRequest.ts
new file mode 100644
index 0000000..a41f54e
--- /dev/null
+++ b/app/react/docker/services/ItemView/PortMappingField/toRequest.ts
@@ -0,0 +1,62 @@
+import { EndpointPortConfig } from 'docker-types';
+import _ from 'lodash';
+
+import { Values } from './PortsMappingField';
+import { isRange } from './types';
+
+export function toRequest(portBindings: Values): Array<EndpointPortConfig> {
+  return _.compact(
+    portBindings.flatMap((portBinding) => {
+      const { hostPort, protocol, containerPort, publishMode } = portBinding;
+      if (!hostPort && !containerPort) {
+        return null;
+      }
+
+      if (isRange(hostPort) && isRange(containerPort)) {
+        if (
+          hostPort.end - hostPort.start !==
+          containerPort.end - containerPort.start
+        ) {
+          throw new Error(
+            `Invalid port specification: host port range must be equal to container port range`
+          );
+        }
+
+        return Array.from(
+          { length: hostPort.end - hostPort.start + 1 },
+          (_, i) => ({
+            PublishedPort: hostPort.start + i,
+            Protocol: protocol,
+            TargetPort: containerPort.start + i,
+            PublishMode: publishMode,
+          })
+        );
+      }
+
+      if (isRange(hostPort) && !isRange(containerPort)) {
+        return Array.from(
+          { length: hostPort.end - hostPort.start + 1 },
+          (_, i) => ({
+            PublishedPort: hostPort.start + i,
+            Protocol: protocol,
+            TargetPort: containerPort,
+            PublishMode: publishMode,
+          })
+        );
+      }
+
+      if (!isRange(hostPort) && !isRange(containerPort)) {
+        return {
+          PublishedPort: hostPort,
+          Protocol: protocol,
+          TargetPort: containerPort,
+          PublishMode: publishMode,
+        };
+      }
+
+      throw new Error(
+        `Invalid port specification: host port must be a range when container port is a range`
+      );
+    })
+  );
+}
diff --git a/app/react/docker/services/ItemView/PortMappingField/toViewModel.test.ts b/app/react/docker/services/ItemView/PortMappingField/toViewModel.test.ts
new file mode 100644
index 0000000..b42805f
--- /dev/null
+++ b/app/react/docker/services/ItemView/PortMappingField/toViewModel.test.ts
@@ -0,0 +1,280 @@
+import { toViewModel } from './toViewModel';
+
+test('basic', () => {
+  expect(
+    toViewModel([
+      {
+        Protocol: 'tcp',
+        TargetPort: 22,
+        PublishedPort: 222,
+        PublishMode: 'ingress',
+      },
+      {
+        Protocol: 'tcp',
+        TargetPort: 3000,
+        PublishedPort: 3000,
+        PublishMode: 'ingress',
+      },
+    ])
+  ).toStrictEqual([
+    {
+      hostPort: 222,
+      containerPort: 22,
+      protocol: 'tcp',
+      publishMode: 'ingress',
+    },
+    {
+      hostPort: 3000,
+      containerPort: 3000,
+      protocol: 'tcp',
+      publishMode: 'ingress',
+    },
+  ]);
+});
+
+test('already combined', () => {
+  expect(
+    toViewModel([
+      {
+        Protocol: 'tcp',
+        TargetPort: 80,
+        PublishedPort: 7000,
+        PublishMode: 'ingress',
+      },
+      {
+        Protocol: 'tcp',
+        TargetPort: 80,
+        PublishedPort: 7001,
+        PublishMode: 'ingress',
+      },
+      {
+        Protocol: 'tcp',
+        TargetPort: 80,
+        PublishedPort: 7002,
+        PublishMode: 'ingress',
+      },
+      {
+        Protocol: 'tcp',
+        TargetPort: 80,
+        PublishedPort: 7003,
+        PublishMode: 'ingress',
+      },
+      {
+        Protocol: 'tcp',
+        TargetPort: 80,
+        PublishedPort: 7004,
+        PublishMode: 'ingress',
+      },
+      {
+        Protocol: 'tcp',
+        TargetPort: 80,
+        PublishedPort: 7005,
+        PublishMode: 'ingress',
+      },
+    ])
+  ).toStrictEqual([
+    {
+      hostPort: {
+        start: 7000,
+        end: 7005,
+      },
+      containerPort: 80,
+      protocol: 'tcp',
+      publishMode: 'ingress',
+    },
+  ]);
+});
+
+test('simple combine ports', () => {
+  expect(
+    toViewModel([
+      {
+        Protocol: 'tcp',
+        TargetPort: 74,
+        PublishedPort: 81,
+      },
+      {
+        Protocol: 'tcp',
+        TargetPort: 75,
+        PublishedPort: 82,
+      },
+    ])
+  ).toStrictEqual([
+    {
+      hostPort: {
+        start: 81,
+        end: 82,
+      },
+      containerPort: {
+        start: 74,
+        end: 75,
+      },
+      protocol: 'tcp',
+      publishMode: 'ingress',
+    },
+  ]);
+});
+
+test('combine and sort', () => {
+  expect(
+    toViewModel([
+      { Protocol: 'tcp', TargetPort: 3244, PublishedPort: 105 },
+      { Protocol: 'tcp', TargetPort: 3245, PublishedPort: 106 },
+      { Protocol: 'tcp', TargetPort: 81, PublishedPort: 81 },
+      { Protocol: 'tcp', TargetPort: 82, PublishedPort: 82 },
+      { Protocol: 'tcp', TargetPort: 83 },
+      { Protocol: 'tcp', TargetPort: 84 },
+    ])
+  ).toStrictEqual([
+    {
+      hostPort: { start: 81, end: 82 },
+      containerPort: { start: 81, end: 82 },
+      protocol: 'tcp',
+      publishMode: 'ingress',
+    },
+    {
+      hostPort: undefined,
+      containerPort: {
+        start: 83,
+        end: 84,
+      },
+      protocol: 'tcp',
+      publishMode: 'ingress',
+    },
+    {
+      hostPort: { start: 105, end: 106 },
+      containerPort: { start: 3244, end: 3245 },
+      protocol: 'tcp',
+      publishMode: 'ingress',
+    },
+  ]);
+});
+
+test('empty input', () => {
+  expect(toViewModel([])).toStrictEqual([]);
+});
+
+test('invalid input', () => {
+  expect(() =>
+    toViewModel(
+      // @ts-expect-error testing invalid input
+      { Name: 'invalid', Protocol: 'tcp', TargetPort: 22, PublishedPort: 222 }
+    )
+  ).toThrow();
+});
+
+test('mixed protocols', () => {
+  expect(
+    toViewModel([
+      { Protocol: 'tcp', TargetPort: 22, PublishedPort: 222 },
+      { Protocol: 'udp', TargetPort: 23, PublishedPort: 223 },
+    ])
+  ).toStrictEqual([
+    {
+      containerPort: 22,
+      hostPort: 222,
+      protocol: 'tcp',
+      publishMode: 'ingress',
+    },
+    {
+      containerPort: 23,
+      hostPort: 223,
+      protocol: 'udp',
+      publishMode: 'ingress',
+    },
+  ]);
+});
+
+test('non-sequential ports', () => {
+  expect(
+    toViewModel([
+      { Protocol: 'tcp', TargetPort: 22, PublishedPort: 222 },
+      { Protocol: 'tcp', TargetPort: 24, PublishedPort: 224 },
+    ])
+  ).toStrictEqual([
+    {
+      containerPort: 22,
+      hostPort: 222,
+      protocol: 'tcp',
+      publishMode: 'ingress',
+    },
+    {
+      containerPort: 24,
+      hostPort: 224,
+      protocol: 'tcp',
+      publishMode: 'ingress',
+    },
+  ]);
+});
+
+test('without host', () => {
+  expect(
+    toViewModel([
+      {
+        Protocol: 'tcp',
+        PublishMode: 'ingress',
+        TargetPort: 39003,
+      },
+      {
+        Protocol: 'tcp',
+        PublishMode: 'ingress',
+        TargetPort: 39010,
+      },
+      {
+        Protocol: 'tcp',
+        PublishMode: 'ingress',
+        TargetPort: 39007,
+      },
+      {
+        Protocol: 'tcp',
+        PublishMode: 'ingress',
+        TargetPort: 39008,
+      },
+      {
+        Protocol: 'tcp',
+        PublishMode: 'ingress',
+        TargetPort: 39000,
+      },
+      {
+        Protocol: 'tcp',
+        PublishMode: 'ingress',
+        TargetPort: 39001,
+      },
+      {
+        Protocol: 'tcp',
+        PublishMode: 'ingress',
+        TargetPort: 39002,
+      },
+      {
+        Protocol: 'tcp',
+        PublishMode: 'ingress',
+        TargetPort: 39004,
+      },
+      {
+        Protocol: 'tcp',
+        PublishMode: 'ingress',
+        TargetPort: 39005,
+      },
+      {
+        Protocol: 'tcp',
+        PublishMode: 'ingress',
+        TargetPort: 39006,
+      },
+      {
+        Protocol: 'tcp',
+        PublishMode: 'ingress',
+        TargetPort: 39009,
+      },
+    ])
+  ).toStrictEqual([
+    {
+      protocol: 'tcp',
+      publishMode: 'ingress',
+      containerPort: {
+        start: 39000,
+        end: 39010,
+      },
+      hostPort: undefined,
+    },
+  ]);
+});
diff --git a/app/react/docker/services/ItemView/PortMappingField/toViewModel.ts b/app/react/docker/services/ItemView/PortMappingField/toViewModel.ts
new file mode 100644
index 0000000..d20b5c8
--- /dev/null
+++ b/app/react/docker/services/ItemView/PortMappingField/toViewModel.ts
@@ -0,0 +1,253 @@
+import { EndpointPortConfig } from 'docker-types';
+import _ from 'lodash';
+
+import { PortBinding, Protocol, Value, isProtocol, isRange } from './types';
+
+// if container is number then host is number | undefined
+export function toViewModel(
+  portBindings: Array<EndpointPortConfig> | undefined = []
+): Array<Value> {
+  const parsedPorts = parsePorts(portBindings);
+  const sortedPorts = sortPorts(parsedPorts);
+
+  return combinePorts(sortedPorts);
+
+  function parsePorts(portBindings: Array<EndpointPortConfig>) {
+    return portBindings.map((binding) => ({
+      hostPort: binding.PublishedPort,
+      protocol: isProtocol(binding.Protocol) ? binding.Protocol : 'tcp',
+      containerPort: binding.TargetPort,
+      publishMode: binding.PublishMode || 'ingress',
+    }));
+  }
+
+  function sortPorts(
+    ports: Array<{
+      hostPort: number | undefined;
+      protocol: Protocol;
+      containerPort: number | undefined;
+      publishMode: 'ingress' | 'host';
+    }>
+  ) {
+    return _.sortBy(ports, [
+      'containerPort',
+      'hostPort',
+      'protocol',
+      'publishMode',
+    ]);
+  }
+
+  function combinePorts(
+    ports: Array<PortBinding<number | undefined, number | undefined>>
+  ): Array<Value> {
+    return ports.reduce((acc, port) => {
+      const lastPort = acc[acc.length - 1];
+
+      if (
+        !lastPort ||
+        lastPort.publishMode !== port.publishMode ||
+        lastPort.protocol !== port.protocol
+      ) {
+        return [...acc, port] satisfies Array<Value>;
+      }
+
+      if (
+        typeof lastPort.hostPort === 'undefined' &&
+        typeof port.hostPort === 'undefined'
+      ) {
+        if (isRange(lastPort.containerPort)) {
+          if (lastPort.containerPort.end === port.containerPort) {
+            return acc;
+          }
+
+          if (lastPort.containerPort.end + 1 === port.containerPort) {
+            return [
+              ...acc.slice(0, acc.length - 1),
+              {
+                ...lastPort,
+                hostPort: undefined,
+                containerPort: {
+                  ...lastPort.containerPort,
+                  end: port.containerPort,
+                },
+              } satisfies Value,
+            ];
+          }
+
+          return [...acc, port];
+        }
+
+        if (typeof lastPort.containerPort === 'number') {
+          if (lastPort.containerPort === port.containerPort) {
+            return acc;
+          }
+
+          if (lastPort.containerPort + 1 === port.containerPort) {
+            return [
+              ...acc.slice(0, acc.length - 1),
+              {
+                ...lastPort,
+                hostPort: undefined,
+                containerPort: {
+                  start: lastPort.containerPort,
+                  end: port.containerPort,
+                },
+              } satisfies Value,
+            ];
+          }
+
+          return [...acc, port];
+        }
+      }
+
+      if (
+        typeof lastPort.hostPort === 'number' &&
+        typeof lastPort.containerPort === 'number'
+      ) {
+        if (
+          lastPort.hostPort === port.hostPort &&
+          lastPort.containerPort === port.containerPort
+        ) {
+          return acc;
+        }
+
+        if (
+          lastPort.hostPort + 1 === port.hostPort &&
+          lastPort.containerPort === port.containerPort
+        ) {
+          return [
+            ...acc.slice(0, acc.length - 1),
+            {
+              ...lastPort,
+              hostPort: {
+                start: lastPort.hostPort,
+                end: port.hostPort,
+              },
+            } satisfies Value,
+          ];
+        }
+
+        if (
+          lastPort.hostPort + 1 === port.hostPort &&
+          lastPort.containerPort + 1 === port.containerPort
+        ) {
+          return [
+            ...acc.slice(0, acc.length - 1),
+            {
+              ...lastPort,
+              hostPort: {
+                start: lastPort.hostPort,
+                end: port.hostPort,
+              },
+              containerPort: {
+                start: lastPort.containerPort,
+                end: port.containerPort,
+              },
+            } satisfies Value,
+          ];
+        }
+
+        return [...acc, port];
+      }
+
+      if (
+        isRange(lastPort.hostPort) &&
+        typeof lastPort.containerPort === 'number'
+      ) {
+        if (
+          lastPort.hostPort.end === port.hostPort &&
+          lastPort.containerPort === port.containerPort
+        ) {
+          return acc;
+        }
+
+        if (
+          lastPort.hostPort.end + 1 === port.hostPort &&
+          lastPort.containerPort === port.containerPort
+        ) {
+          return [
+            ...acc.slice(0, acc.length - 1),
+            {
+              ...lastPort,
+              hostPort: {
+                ...lastPort.hostPort,
+                end: port.hostPort,
+              },
+            } satisfies Value,
+          ];
+        }
+
+        if (
+          lastPort.hostPort.end + 1 === port.hostPort &&
+          lastPort.containerPort + 1 === port.containerPort
+        ) {
+          return [
+            ...acc.slice(0, acc.length - 1),
+            {
+              ...lastPort,
+              hostPort: {
+                ...lastPort.hostPort,
+                end: port.hostPort,
+              },
+              containerPort: {
+                start: lastPort.containerPort,
+                end: port.containerPort,
+              },
+            } satisfies Value,
+          ];
+        }
+
+        return [...acc, port];
+      }
+
+      if (isRange(lastPort.hostPort) && isRange(lastPort.containerPort)) {
+        if (
+          lastPort.hostPort.end === port.hostPort &&
+          lastPort.containerPort.end === port.containerPort
+        ) {
+          return acc;
+        }
+
+        if (
+          lastPort.hostPort.end + 1 === port.hostPort &&
+          lastPort.containerPort.end === port.containerPort
+        ) {
+          return [
+            ...acc.slice(0, acc.length - 1),
+            {
+              ...lastPort,
+              hostPort: {
+                ...lastPort.hostPort,
+                end: port.hostPort,
+              },
+            } satisfies Value,
+          ];
+        }
+
+        if (
+          lastPort.hostPort.end + 1 === port.hostPort &&
+          lastPort.containerPort.end + 1 === port.containerPort
+        ) {
+          return [
+            ...acc.slice(0, acc.length - 1),
+            {
+              ...lastPort,
+              hostPort: {
+                ...lastPort.hostPort,
+                end: port.hostPort,
+              },
+              containerPort: {
+                ...lastPort.containerPort,
+                end: port.containerPort,
+              },
+            } satisfies Value,
+          ];
+        }
+
+        return [...acc, port];
+      }
+
+      return [...acc, port];
+    }, [] as Array<Value>);
+  }
+}
diff --git a/app/react/docker/services/ItemView/PortMappingField/types.ts b/app/react/docker/services/ItemView/PortMappingField/types.ts
new file mode 100644
index 0000000..a8682a5
--- /dev/null
+++ b/app/react/docker/services/ItemView/PortMappingField/types.ts
@@ -0,0 +1,25 @@
+export type Protocol = 'tcp' | 'udp';
+
+export type Range = {
+  start: number;
+  end: number;
+};
+
+export type PortBinding<THost = number, TContainer = number> = {
+  hostPort: THost;
+  protocol: Protocol;
+  containerPort: TContainer;
+  publishMode: 'ingress' | 'host';
+};
+
+export type Value =
+  | PortBinding<number | undefined, number | undefined>
+  | PortBinding<Range | undefined, Range | number | undefined>;
+
+export function isProtocol(value?: string): value is Protocol {
+  return value === 'tcp' || value === 'udp';
+}
+
+export function isRange(value: Range | number | undefined): value is Range {
+  return typeof value === 'object';
+}
diff --git a/app/react/docker/services/ItemView/PortMappingField/validation.ts b/app/react/docker/services/ItemView/PortMappingField/validation.ts
new file mode 100644
index 0000000..95c52ed
--- /dev/null
+++ b/app/react/docker/services/ItemView/PortMappingField/validation.ts
@@ -0,0 +1,64 @@
+import {
+  array,
+  lazy,
+  mixed,
+  number,
+  NumberSchema,
+  object,
+  SchemaOf,
+} from 'yup';
+
+import { Range, isRange } from './types';
+
+export function validation() {
+  return array(
+    object({
+      hostPort: rangeOrNumber(),
+      containerPort: mixed().when('hostPort', {
+        is: (hostPort: Range | number | undefined) =>
+          !hostPort || isRange(hostPort),
+        then: rangeOrNumber(),
+        otherwise: port().typeError(
+          'Container port must be a number when host port is not a range'
+        ),
+      }),
+      protocol: mixed().oneOf(['tcp', 'udp']),
+      publishMode: mixed().oneOf(['ingress', 'host']),
+    }).test({
+      message:
+        'Invalid port specification: host port range must be equal to container port range',
+      test: (portBinding) => {
+        const hostPort = portBinding.hostPort as Range | number | undefined;
+        return !(
+          isRange(hostPort) &&
+          isRange(portBinding.containerPort) &&
+          hostPort.end - hostPort.start !==
+            portBinding.containerPort.end - portBinding.containerPort.start
+        );
+      },
+    })
+  );
+}
+
+function port() {
+  return number()
+    .optional()
+    .min(0, 'Port must be a number between 0 to 65535')
+    .max(65535, 'Port must be a number between 0 to 65535');
+}
+
+function rangeOrNumber() {
+  return lazy<SchemaOf<Range> | NumberSchema>(
+    (value: Range | number | undefined) => (isRange(value) ? range() : port())
+  );
+}
+
+function range(): SchemaOf<Range> {
+  return object({
+    start: port().required(),
+    end: port().required(),
+  }).test({
+    message: 'Start port must be less than end port',
+    test: (value) => !value.start || !value.end || value.start <= value.end,
+  });
+}
diff --git a/app/react/docker/services/ItemView/ServiceWidget.stories.tsx b/app/react/docker/services/ItemView/ServiceWidget.stories.tsx
new file mode 100644
index 0000000..b17559b
--- /dev/null
+++ b/app/react/docker/services/ItemView/ServiceWidget.stories.tsx
@@ -0,0 +1,30 @@
+import type { Meta, StoryObj } from '@storybook/react-webpack5';
+
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+
+import { ServiceWidget } from './ServiceWidget';
+
+const Wrapped = withUserProvider(ServiceWidget);
+
+const meta: Meta<typeof ServiceWidget> = {
+  title: 'Components/Services/ServiceWidget',
+  component: ServiceWidget,
+  render: (args) => <Wrapped {...args} />,
+  args: {
+    titleIcon: 'icon-name',
+    title: 'Service Widget',
+    onAdd: () => {},
+    hasChanges: false,
+    onReset: () => {},
+    onSubmit: () => {},
+    labelForAddButton: 'Add',
+    isValid: true,
+    children: <div className="p-5">This service has no ports published.</div>,
+  },
+};
+
+export default meta;
+
+type Story = StoryObj<typeof ServiceWidget>;
+
+export const Default: Story = {};
diff --git a/app/react/docker/services/ItemView/ServiceWidget.tsx b/app/react/docker/services/ItemView/ServiceWidget.tsx
new file mode 100644
index 0000000..c5a5ce9
--- /dev/null
+++ b/app/react/docker/services/ItemView/ServiceWidget.tsx
@@ -0,0 +1,89 @@
+import { Plus, ChevronDown } from 'lucide-react';
+import { ComponentProps, PropsWithChildren } from 'react';
+import { Menu, MenuButton, MenuItem, MenuPopover } from '@reach/menu-button';
+import { positionRight } from '@reach/popover';
+
+import { Authorized } from '@/react/hooks/useUser';
+
+import { Widget } from '@@/Widget';
+import { Button, ButtonGroup } from '@@/buttons';
+import { ButtonWithRef } from '@@/buttons/Button';
+
+/**
+ * used for wrapping widget in the service item view
+ */
+export function ServiceWidget({
+  titleIcon,
+  title,
+  children,
+  onAdd,
+  hasChanges,
+  onReset,
+  onSubmit,
+  labelForAddButton,
+  isValid,
+}: PropsWithChildren<{
+  titleIcon: ComponentProps<typeof Widget.Title>['icon'];
+  title: string;
+  onAdd(): void;
+  hasChanges: boolean;
+  onReset(all?: boolean): void;
+  onSubmit(): void;
+  labelForAddButton: string;
+  isValid?: boolean;
+}>) {
+  return (
+    <Widget aria-label={title}>
+      <Widget.Title icon={titleIcon} title={title}>
+        <Authorized authorizations="DockerServiceUpdate">
+          <Button
+            color="secondary"
+            size="small"
+            onClick={onAdd}
+            icon={Plus}
+            data-cy="service-add-button"
+          >
+            {labelForAddButton}
+          </Button>
+        </Authorized>
+      </Widget.Title>
+
+      <Widget.Body className="!p-0">{children}</Widget.Body>
+
+      <Authorized authorizations="DockerServiceUpdate">
+        <Widget.Footer>
+          <ButtonGroup>
+            <Button
+              type="button"
+              onClick={onSubmit}
+              disabled={!hasChanges || !isValid}
+              data-cy="service-apply-changes-button"
+            >
+              Apply changes
+            </Button>
+
+            <Menu>
+              <MenuButton
+                as={ButtonWithRef}
+                size="small"
+                color="default"
+                icon={ChevronDown}
+                data-cy="service-reset-changes-button"
+              >
+                <span className="sr-only">Toggle Dropdown</span>
+              </MenuButton>
+              <MenuPopover position={positionRight}>
+                <div className="mt-3 bg-white th-highcontrast:bg-black th-dark:bg-black">
+                  <MenuItem onSelect={() => onReset()}>Reset changes</MenuItem>
+                  <MenuItem onSelect={() => onReset(true)}>
+                    Reset all changes
+                  </MenuItem>
+                </div>
+              </MenuPopover>
+            </Menu>
+          </ButtonGroup>
+        </Widget.Footer>
+      </Authorized>
+    </Widget>
+  );
+}
diff --git a/app/react/docker/services/ItemView/TasksDatatable/TasksDatatable.tsx b/app/react/docker/services/ItemView/TasksDatatable/TasksDatatable.tsx
new file mode 100644
index 0000000..f193a3d
--- /dev/null
+++ b/app/react/docker/services/ItemView/TasksDatatable/TasksDatatable.tsx
@@ -0,0 +1,55 @@
+import { List } from 'lucide-react';
+
+import { Datatable } from '@@/datatables';
+import { mergeOptions } from '@@/datatables/extend-options/mergeOptions';
+import { withColumnFilters } from '@@/datatables/extend-options/withColumnFilters';
+import { withMeta } from '@@/datatables/extend-options/withMeta';
+import {
+  BasicTableSettings,
+  filteredColumnsSettings,
+  type FilteredColumnsTableSettings,
+} from '@@/datatables/types';
+import { useTableStateWithStorage } from '@@/datatables/useTableState';
+
+import { useColumns } from './columns';
+import { DecoratedTask } from './types';
+
+const storageKey = 'docker-service-tasks';
+
+interface TableSettings
+  extends BasicTableSettings, FilteredColumnsTableSettings {}
+
+export function TasksDatatable({
+  dataset,
+  isSlotColumnVisible,
+  serviceName,
+}: {
+  dataset: DecoratedTask[];
+  isSlotColumnVisible: boolean;
+  serviceName: string;
+}) {
+  const tableState = useTableStateWithStorage<TableSettings>(
+    storageKey,
+    undefined,
+    (set) => ({
+      ...filteredColumnsSettings(set),
+    })
+  );
+  const columns = useColumns(isSlotColumnVisible);
+
+  return (
+    <Datatable
+      title="Tasks"
+      titleIcon={List}
+      settingsManager={tableState}
+      columns={columns}
+      dataset={dataset}
+      extendTableOptions={mergeOptions(
+        withMeta({ table: 'tasks', serviceName }),
+        withColumnFilters(tableState.columnFilters, tableState.setColumnFilters)
+      )}
+      disableSelect
+      data-cy="docker-service-tasks-datatable"
+    />
+  );
+}
diff --git a/app/react/docker/services/ItemView/TasksDatatable/columns/actions.tsx b/app/react/docker/services/ItemView/TasksDatatable/columns/actions.tsx
new file mode 100644
index 0000000..1f153c5
--- /dev/null
+++ b/app/react/docker/services/ItemView/TasksDatatable/columns/actions.tsx
@@ -0,0 +1,45 @@
+import { CellContext } from '@tanstack/react-table';
+
+import { ContainerQuickActions } from '@/react/docker/containers/components/ContainerQuickActions';
+import { useCurrentEnvironment } from '@/react/hooks/useCurrentEnvironment';
+import { isAgentEnvironment } from '@/react/portainer/environments/utils';
+import { QuickActionsState } from '@/react/docker/containers/components/ContainerQuickActions/ContainerQuickActions';
+import { TaskTableQuickActions } from '@/react/docker/services/common/TaskTableQuickActions';
+
+import { DecoratedTask } from '../types';
+
+import { columnHelper } from './helper';
+
+export const actions = columnHelper.display({
+  header: 'Actions',
+  cell: Cell,
+});
+
+function Cell({
+  row: { original: item },
+}: CellContext<DecoratedTask, unknown>) {
+  const environmentQuery = useCurrentEnvironment();
+
+  if (!environmentQuery.data) {
+    return null;
+  }
+  const state: QuickActionsState = {
+    showQuickActionAttach: false,
+    showQuickActionExec: true,
+    showQuickActionInspect: true,
+    showQuickActionLogs: true,
+    showQuickActionStats: true,
+  };
+  const isAgent = isAgentEnvironment(environmentQuery.data.Type);
+
+  return isAgent && item.Container ? (
+    <ContainerQuickActions
+      containerId={item.Container.Id}
+      nodeName={item.Container.NodeName}
+      status={item.Container.Status}
+      state={state}
+    />
+  ) : (
+    <TaskTableQuickActions taskId={item.Id} />
+  );
+}
diff --git a/app/react/docker/services/ItemView/TasksDatatable/columns/helper.ts b/app/react/docker/services/ItemView/TasksDatatable/columns/helper.ts
new file mode 100644
index 0000000..34343b0
--- /dev/null
+++ b/app/react/docker/services/ItemView/TasksDatatable/columns/helper.ts
@@ -0,0 +1,5 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { DecoratedTask } from '../types';
+
+export const columnHelper = createColumnHelper<DecoratedTask>();
diff --git a/app/react/docker/services/ItemView/TasksDatatable/columns/index.ts b/app/react/docker/services/ItemView/TasksDatatable/columns/index.ts
new file mode 100644
index 0000000..cf6b1f5
--- /dev/null
+++ b/app/react/docker/services/ItemView/TasksDatatable/columns/index.ts
@@ -0,0 +1,24 @@
+import { useMemo } from 'react';
+import _ from 'lodash';
+
+import { actions } from './actions';
+import { node } from './node';
+import { slot } from './slot';
+import { status } from './status';
+import { task } from './task';
+import { updated } from './updated';
+
+export function useColumns(isSlotColumnsVisible = true) {
+  return useMemo(
+    () =>
+      _.compact([
+        status,
+        task,
+        actions,
+        isSlotColumnsVisible && slot,
+        node,
+        updated,
+      ]),
+    [isSlotColumnsVisible]
+  );
+}
diff --git a/app/react/docker/services/ItemView/TasksDatatable/columns/node.tsx b/app/react/docker/services/ItemView/TasksDatatable/columns/node.tsx
new file mode 100644
index 0000000..2042771
--- /dev/null
+++ b/app/react/docker/services/ItemView/TasksDatatable/columns/node.tsx
@@ -0,0 +1,32 @@
+import { Node } from 'docker-types';
+import { CellContext } from '@tanstack/react-table';
+
+import { useNodes } from '@/react/docker/proxy/queries/nodes/useNodes';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+
+import { DecoratedTask } from '../types';
+
+import { columnHelper } from './helper';
+
+export const node = columnHelper.accessor('NodeId', {
+  header: 'Node',
+  cell: Cell,
+});
+
+function Cell({ getValue }: CellContext<DecoratedTask, string>) {
+  const environmentId = useEnvironmentId();
+
+  const nodesQuery = useNodes(environmentId);
+
+  const nodes = nodesQuery.data || [];
+  return getNodeName(getValue(), nodes);
+}
+
+function getNodeName(nodeId: string, nodes: Array<Node>) {
+  const node = nodes.find((node) => node.ID === nodeId);
+  if (node?.Description?.Hostname) {
+    return node.Description.Hostname;
+  }
+
+  return '';
+}
diff --git a/app/react/docker/services/ItemView/TasksDatatable/columns/slot.tsx b/app/react/docker/services/ItemView/TasksDatatable/columns/slot.tsx
new file mode 100644
index 0000000..dd09164
--- /dev/null
+++ b/app/react/docker/services/ItemView/TasksDatatable/columns/slot.tsx
@@ -0,0 +1,5 @@
+import { columnHelper } from './helper';
+
+export const slot = columnHelper.accessor((item) => item.Slot || '-', {
+  header: 'Slot',
+});
diff --git a/app/react/docker/services/ItemView/TasksDatatable/columns/status.tsx b/app/react/docker/services/ItemView/TasksDatatable/columns/status.tsx
new file mode 100644
index 0000000..7f1bc39
--- /dev/null
+++ b/app/react/docker/services/ItemView/TasksDatatable/columns/status.tsx
@@ -0,0 +1,27 @@
+import clsx from 'clsx';
+
+import { taskStatusBadge } from '@/docker/filters/utils';
+
+import { multiple } from '@@/datatables/filter-types';
+import { filterHOC } from '@@/datatables/Filter';
+
+import { columnHelper } from './helper';
+
+export const status = columnHelper.accessor((item) => item.Status?.State, {
+  header: 'Status',
+  enableColumnFilter: true,
+  filterFn: multiple,
+  meta: {
+    filter: filterHOC('Filter by state'),
+    width: 100,
+  },
+  cell({ getValue }) {
+    const value = getValue();
+
+    return (
+      <span className={clsx('label', `label-${taskStatusBadge(value)}`)}>
+        {value}
+      </span>
+    );
+  },
+});
diff --git a/app/react/docker/services/ItemView/TasksDatatable/columns/task.tsx b/app/react/docker/services/ItemView/TasksDatatable/columns/task.tsx
new file mode 100644
index 0000000..5d4212a
--- /dev/null
+++ b/app/react/docker/services/ItemView/TasksDatatable/columns/task.tsx
@@ -0,0 +1,57 @@
+import { CellContext } from '@tanstack/react-table';
+
+import { useCurrentEnvironment } from '@/react/hooks/useCurrentEnvironment';
+import { isAgentEnvironment } from '@/react/portainer/environments/utils';
+
+import { Link } from '@@/Link';
+
+import { DecoratedTask } from '../types';
+import { getTableMeta } from '../meta';
+
+import { columnHelper } from './helper';
+
+export const task = columnHelper.accessor('Id', {
+  header: 'Id',
+  cell: Cell,
+});
+
+function Cell({
+  getValue,
+  row: { original: item },
+  table: {
+    options: { meta },
+  },
+}: CellContext<DecoratedTask, string>) {
+  const environmentQuery = useCurrentEnvironment();
+
+  if (!environmentQuery.data) {
+    return null;
+  }
+
+  const { serviceName } = getTableMeta(meta);
+
+  const value = getValue();
+  const isAgent = isAgentEnvironment(environmentQuery.data.Type);
+
+  const name = `${serviceName}${item.Slot ? `.${item.Slot}` : ''}.${value}`;
+
+  return isAgent && item.Container ? (
+    <Link
+      to="docker.containers.container"
+      params={{ id: item.Container.Id, nodeName: item.Container.NodeName }}
+      className="monospaced"
+      data-cy="docker-container-task-link"
+    >
+      {name}
+    </Link>
+  ) : (
+    <Link
+      to="docker.tasks.task"
+      params={{ id: value }}
+      className="monospaced"
+      data-cy="docker-task-link"
+    >
+      {name}
+    </Link>
+  );
+}
diff --git a/app/react/docker/services/ItemView/TasksDatatable/columns/updated.tsx b/app/react/docker/services/ItemView/TasksDatatable/columns/updated.tsx
new file mode 100644
index 0000000..026efc6
--- /dev/null
+++ b/app/react/docker/services/ItemView/TasksDatatable/columns/updated.tsx
@@ -0,0 +1,8 @@
+import { isoDate } from '@/portainer/filters/filters';
+
+import { columnHelper } from './helper';
+
+export const updated = columnHelper.accessor('Updated', {
+  header: 'Last Update',
+  cell: ({ getValue }) => isoDate(getValue()),
+});
diff --git a/app/react/docker/services/ItemView/TasksDatatable/index.ts b/app/react/docker/services/ItemView/TasksDatatable/index.ts
new file mode 100644
index 0000000..f95acf3
--- /dev/null
+++ b/app/react/docker/services/ItemView/TasksDatatable/index.ts
@@ -0,0 +1 @@
+export { TasksDatatable } from './TasksDatatable';
diff --git a/app/react/docker/services/ItemView/TasksDatatable/meta.ts b/app/react/docker/services/ItemView/TasksDatatable/meta.ts
new file mode 100644
index 0000000..08ac078
--- /dev/null
+++ b/app/react/docker/services/ItemView/TasksDatatable/meta.ts
@@ -0,0 +1,17 @@
+type TableMeta = {
+  serviceName: string;
+  table: 'tasks';
+};
+
+export function getTableMeta(meta: unknown): TableMeta {
+  return isTableMeta(meta) ? meta : { table: 'tasks', serviceName: '' };
+}
+
+function isTableMeta(meta: unknown): meta is TableMeta {
+  return (
+    !!meta &&
+    typeof meta === 'object' &&
+    'table' in meta &&
+    meta.table === 'tasks'
+  );
+}
diff --git a/app/react/docker/services/ItemView/TasksDatatable/types.ts b/app/react/docker/services/ItemView/TasksDatatable/types.ts
new file mode 100644
index 0000000..e58c37d
--- /dev/null
+++ b/app/react/docker/services/ItemView/TasksDatatable/types.ts
@@ -0,0 +1,6 @@
+import { TaskViewModel } from '@/docker/models/task';
+import { ContainerListViewModel } from '@/react/docker/containers/types';
+
+export type DecoratedTask = TaskViewModel & {
+  Container?: ContainerListViewModel;
+};
diff --git a/app/react/docker/services/ListView/ServicesDatatable/ServicesDatatable.tsx b/app/react/docker/services/ListView/ServicesDatatable/ServicesDatatable.tsx
new file mode 100644
index 0000000..1cc7407
--- /dev/null
+++ b/app/react/docker/services/ListView/ServicesDatatable/ServicesDatatable.tsx
@@ -0,0 +1,142 @@
+import { Shuffle } from 'lucide-react';
+import { Row } from '@tanstack/react-table';
+import { useRef } from 'react';
+
+import { ServiceViewModel } from '@/docker/models/service';
+import { useApiVersion } from '@/react/docker/proxy/queries/useVersion';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+
+import { IconProps } from '@@/Icon';
+import { ExpandableDatatable } from '@@/datatables/ExpandableDatatable';
+import {
+  createPersistedStore,
+  refreshableSettings,
+  hiddenColumnsSettings,
+} from '@@/datatables/types';
+import { useTableState } from '@@/datatables/useTableState';
+import { useRepeater } from '@@/datatables/useRepeater';
+import { defaultGlobalFilterFn } from '@@/datatables/Datatable';
+import { getColumnVisibilityState } from '@@/datatables/ColumnVisibilityMenu';
+import { mergeOptions } from '@@/datatables/extend-options/mergeOptions';
+import { withGlobalFilter } from '@@/datatables/extend-options/withGlobalFilter';
+
+import { DecoratedTask } from '../../ItemView/TasksDatatable/types';
+
+import { useColumns } from './columns';
+import { TasksDatatable } from './TasksDatatable';
+import { TableActions } from './TableActions';
+import { type TableSettings as TableSettingsType } from './types';
+import { TableSettings } from './TableSettings';
+
+export function ServicesDatatable({
+  titleIcon = Shuffle,
+  dataset,
+  isAddActionVisible,
+  isStackColumnVisible,
+  onRefresh,
+  tableKey,
+}: {
+  dataset: Array<ServiceViewModel> | undefined;
+  titleIcon?: IconProps['icon'];
+  isAddActionVisible?: boolean;
+  isStackColumnVisible?: boolean;
+  onRefresh?(): void;
+  tableKey: string;
+}) {
+  // use a unique tableKey so that unrelated services datatables don't share state
+  const store = createPersistedStore<TableSettingsType>(
+    tableKey,
+    'name',
+    (set) => ({
+      ...refreshableSettings(set),
+      ...hiddenColumnsSettings(set),
+      expanded: {},
+      setExpanded(value) {
+        set({ expanded: value });
+      },
+    })
+  );
+
+  // useRef so that updating the parent filter doesn't cause a re-render
+  const parentFilteredStatusRef = useRef<Map<string, boolean>>(new Map());
+  const environmentId = useEnvironmentId();
+  const apiVersion = useApiVersion(environmentId);
+  const tableState = useTableState(store, tableKey);
+  const columns = useColumns(isStackColumnVisible);
+  useRepeater(tableState.autoRefreshRate, onRefresh);
+
+  return (
+    <ExpandableDatatable
+      title="Services"
+      titleIcon={titleIcon}
+      dataset={dataset || []}
+      isLoading={!dataset}
+      settingsManager={tableState}
+      columns={columns}
+      getRowCanExpand={({ original: item }) => item.Tasks.length > 0}
+      renderSubRow={({ original: item }) => (
+        <tr>
+          <td />
+          <td colSpan={Number.MAX_SAFE_INTEGER}>
+            <TasksDatatable
+              dataset={item.Tasks as Array<DecoratedTask>}
+              search={
+                parentFilteredStatusRef.current.get(item.Id)
+                  ? ''
+                  : tableState.search
+              }
+            />
+          </td>
+        </tr>
+      )}
+      initialTableState={getColumnVisibilityState(tableState.hiddenColumns)}
+      renderTableActions={(selectedRows) => (
+        <TableActions
+          selectedItems={selectedRows}
+          isAddActionVisible={isAddActionVisible}
+          isUpdateActionVisible={apiVersion >= 1.25}
+        />
+      )}
+      renderTableSettings={(table) => (
+        <TableSettings settings={tableState} table={table} />
+      )}
+      extendTableOptions={mergeOptions(
+        (options) => ({
+          ...options,
+          onExpandedChange: (updater) => {
+            const value =
+              typeof updater === 'function'
+                ? updater(tableState.expanded)
+                : updater;
+            tableState.setExpanded(value);
+          },
+          state: {
+            expanded: tableState.expanded,
+          },
+        }),
+        withGlobalFilter(filter)
+      )}
+      data-cy="services-datatable"
+    />
+  );
+
+  function filter(
+    row: Row<ServiceViewModel>,
+    columnId: string,
+    filterValue: null | { search: string }
+  ) {
+    parentFilteredStatusRef.current = parentFilteredStatusRef.current.set(
+      row.id,
+      defaultGlobalFilterFn(row, columnId, filterValue)
+    );
+    return (
+      parentFilteredStatusRef.current.get(row.id) ||
+      row.original.Tasks.some((task) =>
+        Object.values(task).some(
+          (value) =>
+            value && value.toString().includes(filterValue?.search || '')
+        )
+      )
+    );
+  }
+}
diff --git a/app/react/docker/services/ListView/ServicesDatatable/TableActions.tsx b/app/react/docker/services/ListView/ServicesDatatable/TableActions.tsx
new file mode 100644
index 0000000..ba47abf
--- /dev/null
+++ b/app/react/docker/services/ListView/ServicesDatatable/TableActions.tsx
@@ -0,0 +1,99 @@
+import { RefreshCw } from 'lucide-react';
+import { useRouter } from '@uirouter/react';
+
+import { ServiceViewModel } from '@/docker/models/service';
+import { Authorized } from '@/react/hooks/useUser';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { AddButton, Button, ButtonGroup } from '@@/buttons';
+import { DeleteButton } from '@@/buttons/DeleteButton';
+
+import { confirmServiceForceUpdate } from '../../common/update-service-modal';
+
+import { useRemoveServicesMutation } from './useRemoveServicesMutation';
+import { useForceUpdateServicesMutation } from './useForceUpdateServicesMutation';
+
+export function TableActions({
+  selectedItems,
+  isAddActionVisible,
+  isUpdateActionVisible,
+}: {
+  selectedItems: Array<ServiceViewModel>;
+  isAddActionVisible?: boolean;
+  isUpdateActionVisible?: boolean;
+}) {
+  const environmentId = useEnvironmentId();
+  const removeMutation = useRemoveServicesMutation(environmentId);
+  const updateMutation = useForceUpdateServicesMutation(environmentId);
+  const router = useRouter();
+
+  return (
+    <div className="flex items-center gap-2">
+      <ButtonGroup>
+        {isUpdateActionVisible && (
+          <Authorized authorizations="DockerServiceUpdate">
+            <Button
+              color="light"
+              disabled={selectedItems.length === 0}
+              onClick={() => handleUpdate(selectedItems)}
+              icon={RefreshCw}
+              data-cy="service-updateServiceButton"
+            >
+              Update
+            </Button>
+          </Authorized>
+        )}
+        <Authorized authorizations="DockerServiceDelete">
+          <DeleteButton
+            disabled={selectedItems.length === 0}
+            onConfirmed={() => handleRemove(selectedItems)}
+            confirmMessage="Do you want to remove the selected service(s)? All the containers associated to the selected service(s) will be removed too."
+            data-cy="service-removeServiceButton"
+          />
+        </Authorized>
+      </ButtonGroup>
+
+      {isAddActionVisible && (
+        <Authorized authorizations="DockerServiceCreate">
+          <AddButton data-cy="docker-add-service-button">Add service</AddButton>
+        </Authorized>
+      )}
+    </div>
+  );
+
+  async function handleUpdate(selectedItems: Array<ServiceViewModel>) {
+    const confirmed = await confirmServiceForceUpdate(
+      'Do you want to force an update of the selected service(s)? All the tasks associated to the selected service(s) will be recreated.'
+    );
+
+    if (!confirmed) {
+      return;
+    }
+
+    updateMutation.mutate(
+      {
+        ids: selectedItems.map((service) => service.Id),
+        pullImage: confirmed.pullLatest,
+      },
+      {
+        onSuccess() {
+          notifySuccess('Success', 'Service(s) successfully updated');
+          router.stateService.reload();
+        },
+      }
+    );
+  }
+
+  async function handleRemove(selectedItems: Array<ServiceViewModel>) {
+    removeMutation.mutate(
+      selectedItems.map((service) => service.Id),
+      {
+        onSuccess() {
+          notifySuccess('Success', 'Service(s) successfully removed');
+          router.stateService.reload();
+        },
+      }
+    );
+  }
+}
diff --git a/app/react/docker/services/ListView/ServicesDatatable/TableSettings.tsx b/app/react/docker/services/ListView/ServicesDatatable/TableSettings.tsx
new file mode 100644
index 0000000..4145c10
--- /dev/null
+++ b/app/react/docker/services/ListView/ServicesDatatable/TableSettings.tsx
@@ -0,0 +1,35 @@
+import { Table } from '@tanstack/react-table';
+
+import { ServiceViewModel } from '@/docker/models/service';
+
+import { TableSettingsMenu } from '@@/datatables';
+import { TableSettingsMenuAutoRefresh } from '@@/datatables/TableSettingsMenuAutoRefresh';
+import { ColumnVisibilityMenu } from '@@/datatables/ColumnVisibilityMenu';
+
+import { type TableSettings as TableSettingsType } from './types';
+
+export function TableSettings({
+  settings,
+  table,
+}: {
+  settings: TableSettingsType;
+  table: Table<ServiceViewModel>;
+}) {
+  return (
+    <>
+      <ColumnVisibilityMenu<ServiceViewModel>
+        table={table}
+        onChange={(hiddenColumns) => {
+          settings.setHiddenColumns(hiddenColumns);
+        }}
+        value={settings.hiddenColumns}
+      />
+      <TableSettingsMenu>
+        <TableSettingsMenuAutoRefresh
+          value={settings.autoRefreshRate}
+          onChange={(value) => settings.setAutoRefreshRate(value)}
+        />
+      </TableSettingsMenu>
+    </>
+  );
+}
diff --git a/app/react/docker/services/ListView/ServicesDatatable/TasksDatatable/TasksDatatable.tsx b/app/react/docker/services/ListView/ServicesDatatable/TasksDatatable/TasksDatatable.tsx
new file mode 100644
index 0000000..38f6596
--- /dev/null
+++ b/app/react/docker/services/ListView/ServicesDatatable/TasksDatatable/TasksDatatable.tsx
@@ -0,0 +1,31 @@
+import { DecoratedTask } from '@/react/docker/services/ItemView/TasksDatatable/types';
+import { status } from '@/react/docker/services/ItemView/TasksDatatable/columns/status';
+import { actions } from '@/react/docker/services/ItemView/TasksDatatable/columns/actions';
+import { slot } from '@/react/docker/services/ItemView/TasksDatatable/columns/slot';
+import { node } from '@/react/docker/services/ItemView/TasksDatatable/columns/node';
+import { updated } from '@/react/docker/services/ItemView/TasksDatatable/columns/updated';
+
+import { NestedDatatable } from '@@/datatables/NestedDatatable';
+
+import { task } from './task-column';
+
+const columns = [status, task, actions, slot, node, updated];
+
+export function TasksDatatable({
+  dataset,
+  search,
+}: {
+  dataset: DecoratedTask[];
+  search?: string;
+}) {
+  return (
+    <NestedDatatable
+      columns={columns}
+      dataset={dataset}
+      search={search}
+      aria-label="Tasks table"
+      data-cy="docker-service-tasks-nested-datatable"
+      initialSortBy={{ id: 'Updated', desc: true }}
+    />
+  );
+}
diff --git a/app/react/docker/services/ListView/ServicesDatatable/TasksDatatable/index.ts b/app/react/docker/services/ListView/ServicesDatatable/TasksDatatable/index.ts
new file mode 100644
index 0000000..f95acf3
--- /dev/null
+++ b/app/react/docker/services/ListView/ServicesDatatable/TasksDatatable/index.ts
@@ -0,0 +1 @@
+export { TasksDatatable } from './TasksDatatable';
diff --git a/app/react/docker/services/ListView/ServicesDatatable/TasksDatatable/task-column.tsx b/app/react/docker/services/ListView/ServicesDatatable/TasksDatatable/task-column.tsx
new file mode 100644
index 0000000..b2c34ce
--- /dev/null
+++ b/app/react/docker/services/ListView/ServicesDatatable/TasksDatatable/task-column.tsx
@@ -0,0 +1,47 @@
+import { CellContext } from '@tanstack/react-table';
+
+import { useCurrentEnvironment } from '@/react/hooks/useCurrentEnvironment';
+import { isAgentEnvironment } from '@/react/portainer/environments/utils';
+import { DecoratedTask } from '@/react/docker/services/ItemView/TasksDatatable/types';
+import { columnHelper } from '@/react/docker/services/ItemView/TasksDatatable/columns/helper';
+
+import { Link } from '@@/Link';
+
+export const task = columnHelper.accessor('Id', {
+  header: 'Task',
+  cell: Cell,
+});
+
+function Cell({
+  getValue,
+  row: { original: item },
+}: CellContext<DecoratedTask, string>) {
+  const environmentQuery = useCurrentEnvironment();
+
+  if (!environmentQuery.data) {
+    return null;
+  }
+
+  const value = getValue();
+  const isAgent = isAgentEnvironment(environmentQuery.data.Type);
+
+  return isAgent && item.Container ? (
+    <Link
+      to="docker.containers.container"
+      params={{ id: item.Container.Id, nodeName: item.Container.NodeName }}
+      className="monospaced"
+      data-cy="docker-task-container-link"
+    >
+      {value}
+    </Link>
+  ) : (
+    <Link
+      to="docker.tasks.task"
+      params={{ id: item.Id }}
+      className="monospaced"
+      data-cy="docker-task-link"
+    >
+      {value}
+    </Link>
+  );
+}
diff --git a/app/react/docker/services/ListView/ServicesDatatable/columns/helper.ts b/app/react/docker/services/ListView/ServicesDatatable/columns/helper.ts
new file mode 100644
index 0000000..ddabe66
--- /dev/null
+++ b/app/react/docker/services/ListView/ServicesDatatable/columns/helper.ts
@@ -0,0 +1,5 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { ServiceViewModel } from '@/docker/models/service';
+
+export const columnHelper = createColumnHelper<ServiceViewModel>();
diff --git a/app/react/docker/services/ListView/ServicesDatatable/columns/image.tsx b/app/react/docker/services/ListView/ServicesDatatable/columns/image.tsx
new file mode 100644
index 0000000..ff71a66
--- /dev/null
+++ b/app/react/docker/services/ListView/ServicesDatatable/columns/image.tsx
@@ -0,0 +1,43 @@
+import { CellContext } from '@tanstack/react-table';
+
+import { ServiceViewModel } from '@/docker/models/service';
+import { ImageStatus } from '@/react/docker/components/ImageStatus';
+import { hideShaSum } from '@/docker/filters/utils';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { ResourceType } from '@/react/docker/components/ImageStatus/types';
+import { ImageUpToDateTooltip } from '@/react/docker/components/datatable/TableColumnHeaderImageUpToDate';
+
+import { columnHelper } from './helper';
+
+export const image = columnHelper.accessor((item) => item.Image, {
+  id: 'image',
+  header: Header,
+  cell: Cell,
+});
+
+function Header() {
+  return (
+    <>
+      Image
+      <ImageUpToDateTooltip />
+    </>
+  );
+}
+
+function Cell({
+  getValue,
+  row: { original: item },
+}: CellContext<ServiceViewModel, string>) {
+  const value = hideShaSum(getValue());
+  const environmentId = useEnvironmentId();
+  return (
+    <>
+      <ImageStatus
+        resourceId={item.Id || ''}
+        resourceType={ResourceType.SERVICE}
+        environmentId={environmentId}
+      />
+      {value}
+    </>
+  );
+}
diff --git a/app/react/docker/services/ListView/ServicesDatatable/columns/index.ts b/app/react/docker/services/ListView/ServicesDatatable/columns/index.ts
new file mode 100644
index 0000000..85204f2
--- /dev/null
+++ b/app/react/docker/services/ListView/ServicesDatatable/columns/index.ts
@@ -0,0 +1,42 @@
+import { useMemo } from 'react';
+import _ from 'lodash';
+
+import { ServiceViewModel } from '@/docker/models/service';
+import { isoDate } from '@/portainer/filters/filters';
+import { createOwnershipColumn } from '@/react/docker/components/datatable/createOwnershipColumn';
+
+import { buildNameColumn } from '@@/datatables/buildNameColumn';
+import { buildExpandColumn } from '@@/datatables/expand-column';
+
+import { image } from './image';
+import { columnHelper } from './helper';
+import { schedulingMode } from './schedulingMode';
+import { ports } from './ports';
+
+export function useColumns(isStackColumnVisible?: boolean) {
+  return useMemo(
+    () =>
+      _.compact([
+        buildExpandColumn<ServiceViewModel>(),
+        buildNameColumn<ServiceViewModel>(
+          'Name',
+          'docker.services.service',
+          'docker-services-name'
+        ),
+        isStackColumnVisible &&
+          columnHelper.accessor((item) => item.StackName || '-', {
+            header: 'Stack',
+            enableHiding: false,
+          }),
+        image,
+        schedulingMode,
+        ports,
+        columnHelper.accessor('UpdatedAt', {
+          header: 'Last Update',
+          cell: ({ getValue }) => isoDate(getValue()),
+        }),
+        createOwnershipColumn<ServiceViewModel>(),
+      ]),
+    [isStackColumnVisible]
+  );
+}
diff --git a/app/react/docker/services/ListView/ServicesDatatable/columns/ports.tsx b/app/react/docker/services/ListView/ServicesDatatable/columns/ports.tsx
new file mode 100644
index 0000000..691b0df
--- /dev/null
+++ b/app/react/docker/services/ListView/ServicesDatatable/columns/ports.tsx
@@ -0,0 +1,47 @@
+import { CellContext } from '@tanstack/react-table';
+
+import { ServiceViewModel } from '@/docker/models/service';
+import { useCurrentEnvironment } from '@/react/hooks/useCurrentEnvironment';
+import { PublishedPortLink } from '@/react/docker/components/ImageStatus/PublishedPortLink';
+
+import { columnHelper } from './helper';
+
+export const ports = columnHelper.accessor(
+  (row) =>
+    (row.Ports || [])
+      .filter((port) => port.PublishedPort)
+      .map((port) => `${port.PublishedPort}:${port.TargetPort}`)
+      .join(','),
+  {
+    header: 'Published Ports',
+    id: 'ports',
+    cell: Cell,
+  }
+);
+
+function Cell({
+  row: { original: item },
+}: CellContext<ServiceViewModel, string>) {
+  const environmentQuery = useCurrentEnvironment();
+
+  if (!environmentQuery.data) {
+    return null;
+  }
+
+  const ports = item.Ports || [];
+
+  if (ports.length === 0) {
+    return '-';
+  }
+
+  return ports
+    .filter((port) => port.PublishedPort)
+    .map((port) => (
+      <PublishedPortLink
+        key={port.PublishedPort}
+        hostPort={port.PublishedPort}
+        containerPort={port.TargetPort}
+        hostURL={environmentQuery.data.PublicURL}
+      />
+    ));
+}
diff --git a/app/react/docker/services/ListView/ServicesDatatable/columns/schedulingMode/ScaleForm.tsx b/app/react/docker/services/ListView/ServicesDatatable/columns/schedulingMode/ScaleForm.tsx
new file mode 100644
index 0000000..714b3bb
--- /dev/null
+++ b/app/react/docker/services/ListView/ServicesDatatable/columns/schedulingMode/ScaleForm.tsx
@@ -0,0 +1,102 @@
+import { Formik, Form } from 'formik';
+import { X, CheckSquare } from 'lucide-react';
+import { useRouter } from '@uirouter/react';
+
+import { ServiceViewModel } from '@/docker/models/service';
+import { useUpdateServiceMutation } from '@/react/docker/services/queries/useUpdateServiceMutation';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { convertServiceToConfig } from '@/react/docker/services/common/convertServiceToConfig';
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { Button, LoadingButton } from '@@/buttons';
+
+export function ScaleForm({
+  onClose,
+  service,
+}: {
+  onClose: () => void;
+  service: ServiceViewModel;
+}) {
+  const environmentId = useEnvironmentId();
+  const mutation = useUpdateServiceMutation(environmentId);
+  const router = useRouter();
+  return (
+    <Formik
+      initialValues={{ replicas: service.Replicas || 0 }}
+      onSubmit={handleSubmit}
+    >
+      {({ values, setFieldValue }) => (
+        <Form>
+          <input
+            className="input-sm w-20"
+            type="number"
+            min={0}
+            step={1}
+            value={Number.isNaN(values.replicas) ? '' : values.replicas}
+            onKeyUp={(event) => {
+              if (event.key === 'Escape') {
+                onClose();
+              }
+            }}
+            onChange={(event) => {
+              setFieldValue('replicas', event.target.valueAsNumber);
+            }}
+            // disabled because it makes sense to auto focus once the form is mounted
+            // eslint-disable-next-line jsx-a11y/no-autofocus
+            autoFocus
+          />
+          <Button
+            color="none"
+            icon={X}
+            onClick={() => onClose()}
+            data-cy={`scale-service-cancel-button-${service.Name}`}
+          />
+          <LoadingButton
+            isLoading={mutation.isLoading}
+            data-cy={`scale-service-submit-button-${service.Name}`}
+            disabled={
+              values.replicas === service.Replicas ||
+              values.replicas < 0 ||
+              Number.isNaN(values.replicas)
+            }
+            loadingText="Scaling..."
+            color="none"
+            icon={CheckSquare}
+            type="submit"
+          />
+        </Form>
+      )}
+    </Formik>
+  );
+
+  function handleSubmit({ replicas }: { replicas: number }) {
+    const config = convertServiceToConfig(service.Model);
+    mutation.mutate(
+      {
+        serviceId: service.Id,
+        config: {
+          ...config,
+          Mode: {
+            ...config.Mode,
+            Replicated: {
+              ...config.Mode?.Replicated,
+              Replicas: replicas,
+            },
+          },
+        },
+        environmentId,
+        version: service.Version || 0,
+      },
+      {
+        onSuccess() {
+          onClose();
+          notifySuccess(
+            'Service successfully scaled',
+            `New replica count: ${replicas}`
+          );
+          router.stateService.reload();
+        },
+      }
+    );
+  }
+}
diff --git a/app/react/docker/services/ListView/ServicesDatatable/columns/schedulingMode/ScaleServiceButton.tsx b/app/react/docker/services/ListView/ServicesDatatable/columns/schedulingMode/ScaleServiceButton.tsx
new file mode 100644
index 0000000..89d36ca
--- /dev/null
+++ b/app/react/docker/services/ListView/ServicesDatatable/columns/schedulingMode/ScaleServiceButton.tsx
@@ -0,0 +1,30 @@
+import { Minimize2 } from 'lucide-react';
+import { useState } from 'react';
+
+import { ServiceViewModel } from '@/docker/models/service';
+import { Authorized } from '@/react/hooks/useUser';
+
+import { Button } from '@@/buttons';
+
+import { ScaleForm } from './ScaleForm';
+
+export function ScaleServiceButton({ service }: { service: ServiceViewModel }) {
+  const [isEdit, setIsEdit] = useState(false);
+
+  if (!isEdit) {
+    return (
+      <Authorized authorizations="DockerServiceUpdate">
+        <Button
+          color="none"
+          icon={Minimize2}
+          onClick={() => setIsEdit(true)}
+          data-cy="scale-service-button"
+        >
+          Scale
+        </Button>
+      </Authorized>
+    );
+  }
+
+  return <ScaleForm onClose={() => setIsEdit(false)} service={service} />;
+}
diff --git a/app/react/docker/services/ListView/ServicesDatatable/columns/schedulingMode/constraint-helper.ts b/app/react/docker/services/ListView/ServicesDatatable/columns/schedulingMode/constraint-helper.ts
new file mode 100644
index 0000000..12f4a28
--- /dev/null
+++ b/app/react/docker/services/ListView/ServicesDatatable/columns/schedulingMode/constraint-helper.ts
@@ -0,0 +1,133 @@
+import { Node } from 'docker-types';
+
+import { ServiceViewModel } from '@/docker/models/service';
+
+class ConstraintModel {
+  op: string;
+
+  value: string;
+
+  key: string;
+
+  constructor(op: string, key: string, value: string) {
+    this.op = op;
+    this.value = value;
+    this.key = key;
+  }
+}
+
+const patterns = {
+  id: {
+    nodeId: 'node.id',
+    nodeHostname: 'node.hostname',
+    nodeRole: 'node.role',
+    nodeLabels: 'node.labels.',
+    engineLabels: 'engine.labels.',
+  },
+  op: {
+    eq: '==',
+    neq: '!=',
+  },
+} as const;
+
+function matchesConstraint(
+  value: string | undefined,
+  constraint?: ConstraintModel
+) {
+  if (
+    !constraint ||
+    (constraint.op === patterns.op.eq && value === constraint.value) ||
+    (constraint.op === patterns.op.neq && value !== constraint.value)
+  ) {
+    return true;
+  }
+  return false;
+}
+
+function matchesLabel(
+  labels: Record<string, string> | undefined,
+  constraint?: ConstraintModel
+) {
+  if (!constraint) {
+    return true;
+  }
+  return Object.entries(labels || {}).some(
+    ([key, value]) => key === constraint.key && value === constraint.value
+  );
+}
+
+function extractValue(constraint: string, op: string) {
+  return constraint.split(op).pop()?.trim() || '';
+}
+
+function extractCustomLabelKey(
+  constraint: string,
+  op: string,
+  baseLabelKey: string
+) {
+  return constraint.split(op).shift()?.trim().replace(baseLabelKey, '') || '';
+}
+
+interface Constraint {
+  nodeId?: ConstraintModel;
+  nodeHostname?: ConstraintModel;
+  nodeRole?: ConstraintModel;
+  nodeLabels?: ConstraintModel;
+  engineLabels?: ConstraintModel;
+}
+
+function transformConstraints(constraints: Array<string>) {
+  const transform: Constraint = {};
+  for (let i = 0; i < constraints.length; i++) {
+    const constraint = constraints[i];
+
+    let op = '';
+    if (constraint.includes(patterns.op.eq)) {
+      op = patterns.op.eq;
+    } else if (constraint.includes(patterns.op.neq)) {
+      op = patterns.op.neq;
+    }
+
+    const value = extractValue(constraint, op);
+    let key = '';
+    switch (true) {
+      case constraint.includes(patterns.id.nodeId):
+        transform.nodeId = new ConstraintModel(op, key, value);
+        break;
+      case constraint.includes(patterns.id.nodeHostname):
+        transform.nodeHostname = new ConstraintModel(op, key, value);
+        break;
+      case constraint.includes(patterns.id.nodeRole):
+        transform.nodeRole = new ConstraintModel(op, key, value);
+        break;
+      case constraint.includes(patterns.id.nodeLabels):
+        key = extractCustomLabelKey(constraint, op, patterns.id.nodeLabels);
+        transform.nodeLabels = new ConstraintModel(op, key, value);
+        break;
+      case constraint.includes(patterns.id.engineLabels):
+        key = extractCustomLabelKey(constraint, op, patterns.id.engineLabels);
+        transform.engineLabels = new ConstraintModel(op, key, value);
+        break;
+      default:
+        break;
+    }
+  }
+  return transform;
+}
+
+export function matchesServiceConstraints(
+  service: ServiceViewModel,
+  node: Node
+) {
+  if (service.Constraints === undefined || service.Constraints.length === 0) {
+    return true;
+  }
+  const constraints = transformConstraints([...service.Constraints]);
+  return (
+    matchesConstraint(node.ID, constraints.nodeId) &&
+    matchesConstraint(node.Description?.Hostname, constraints.nodeHostname) &&
+    matchesConstraint(node.Spec?.Role, constraints.nodeRole) &&
+    matchesLabel(node.Spec?.Labels, constraints.nodeLabels) &&
+    matchesLabel(node.Description?.Engine?.Labels, constraints.engineLabels)
+  );
+}
diff --git a/app/react/docker/services/ListView/ServicesDatatable/columns/schedulingMode/index.ts b/app/react/docker/services/ListView/ServicesDatatable/columns/schedulingMode/index.ts
new file mode 100644
index 0000000..7159bff
--- /dev/null
+++ b/app/react/docker/services/ListView/ServicesDatatable/columns/schedulingMode/index.ts
@@ -0,0 +1 @@
+export { schedulingMode } from './schedulingMode';
diff --git a/app/react/docker/services/ListView/ServicesDatatable/columns/schedulingMode/schedulingMode.tsx b/app/react/docker/services/ListView/ServicesDatatable/columns/schedulingMode/schedulingMode.tsx
new file mode 100644
index 0000000..cea20e6
--- /dev/null
+++ b/app/react/docker/services/ListView/ServicesDatatable/columns/schedulingMode/schedulingMode.tsx
@@ -0,0 +1,66 @@
+import { CellContext } from '@tanstack/react-table';
+import { Node } from 'docker-types';
+
+import { ServiceViewModel } from '@/docker/models/service';
+import { useNodes } from '@/react/docker/proxy/queries/nodes/useNodes';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { TaskViewModel } from '@/docker/models/task';
+
+import { columnHelper } from '../helper';
+
+import { matchesServiceConstraints } from './constraint-helper';
+import { ScaleServiceButton } from './ScaleServiceButton';
+
+export const schedulingMode = columnHelper.accessor('Mode', {
+  header: 'Scheduling Mode',
+  cell: Cell,
+  enableHiding: false,
+});
+
+function Cell({
+  getValue,
+  row: { original: item },
+}: CellContext<ServiceViewModel, string>) {
+  const environmentId = useEnvironmentId();
+  const nodesQuery = useNodes(environmentId);
+
+  if (!nodesQuery.data) {
+    return null;
+  }
+
+  const mode = getValue();
+  return (
+    <div className="flex items-center gap-3">
+      {mode}
+      <code>{totalRunningTasks(item.Tasks)}</code> /{' '}
+      <code>
+        {mode === 'replicated'
+          ? item.Replicas
+          : availableNodeCount(nodesQuery.data, item)}
+      </code>
+      {mode === 'replicated' && <ScaleServiceButton service={item} />}
+    </div>
+  );
+}
+
+function totalRunningTasks(tasks: Array<TaskViewModel>) {
+  return tasks.filter(
+    (task) =>
+      task.Status?.State === 'running' && task.DesiredState === 'running'
+  ).length;
+}
+
+function availableNodeCount(nodes: Array<Node>, service: ServiceViewModel) {
+  let availableNodes = 0;
+  for (let i = 0; i < nodes.length; i++) {
+    const node = nodes[i];
+    if (
+      node.Spec?.Availability === 'active' &&
+      node.Status?.State === 'ready' &&
+      matchesServiceConstraints(service, node)
+    ) {
+      availableNodes++;
+    }
+  }
+  return availableNodes;
+}
diff --git a/app/react/docker/services/ListView/ServicesDatatable/index.ts b/app/react/docker/services/ListView/ServicesDatatable/index.ts
new file mode 100644
index 0000000..2c44e47
--- /dev/null
+++ b/app/react/docker/services/ListView/ServicesDatatable/index.ts
@@ -0,0 +1 @@
+export { ServicesDatatable } from './ServicesDatatable';
diff --git a/app/react/docker/services/ListView/ServicesDatatable/types.ts b/app/react/docker/services/ListView/ServicesDatatable/types.ts
new file mode 100644
index 0000000..2b50727
--- /dev/null
+++ b/app/react/docker/services/ListView/ServicesDatatable/types.ts
@@ -0,0 +1,13 @@
+import {
+  BasicTableSettings,
+  RefreshableTableSettings,
+  SettableColumnsTableSettings,
+} from '@@/datatables/types';
+
+export type TableSettings = {
+  /** expanded is true (all expanded) or a record where each key value pair sets the state of the mentioned row */
+  expanded: true | Record<string, boolean>;
+  setExpanded(value: true | Record<string, boolean>): void;
+} & SettableColumnsTableSettings &
+  RefreshableTableSettings &
+  BasicTableSettings;
diff --git a/app/react/docker/services/ListView/ServicesDatatable/useForceUpdateServicesMutation.ts b/app/react/docker/services/ListView/ServicesDatatable/useForceUpdateServicesMutation.ts
new file mode 100644
index 0000000..813bb79
--- /dev/null
+++ b/app/react/docker/services/ListView/ServicesDatatable/useForceUpdateServicesMutation.ts
@@ -0,0 +1,16 @@
+import { useMutation } from '@tanstack/react-query';
+
+import { promiseSequence } from '@/portainer/helpers/promise-utils';
+import { withError } from '@/react-tools/react-query';
+import { forceUpdateService } from '@/react/portainer/environments/environment.service';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+export function useForceUpdateServicesMutation(environmentId: EnvironmentId) {
+  return useMutation(
+    ({ ids, pullImage }: { ids: Array<string>; pullImage: boolean }) =>
+      promiseSequence(
+        ids.map((id) => () => forceUpdateService(environmentId, id, pullImage))
+      ),
+    withError('Failed to remove services')
+  );
+}
diff --git a/app/react/docker/services/ListView/ServicesDatatable/useRemoveServicesMutation.ts b/app/react/docker/services/ListView/ServicesDatatable/useRemoveServicesMutation.ts
new file mode 100644
index 0000000..5b2b446
--- /dev/null
+++ b/app/react/docker/services/ListView/ServicesDatatable/useRemoveServicesMutation.ts
@@ -0,0 +1,30 @@
+import { useMutation } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { promiseSequence } from '@/portainer/helpers/promise-utils';
+import { withError } from '@/react-tools/react-query';
+
+import { buildUrl } from '../../queries/build-url';
+import { removeWebhooksForService } from '../../webhooks/removeWebhook';
+
+export function useRemoveServicesMutation(environmentId: EnvironmentId) {
+  return useMutation(
+    (ids: Array<string>) =>
+      promiseSequence(ids.map((id) => () => removeService(environmentId, id))),
+    withError('Unable to remove services')
+  );
+}
+
+export async function removeService(
+  environmentId: EnvironmentId,
+  serviceId: string
+) {
+  try {
+    await axios.delete(buildUrl(environmentId, serviceId));
+
+    await removeWebhooksForService(environmentId, serviceId);
+  } catch (error) {
+    throw parseAxiosError(error);
+  }
+}
diff --git a/app/react/docker/services/LogsView/.keep b/app/react/docker/services/LogsView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/docker/services/common/TaskTableQuickActions.tsx b/app/react/docker/services/common/TaskTableQuickActions.tsx
new file mode 100644
index 0000000..28a3628
--- /dev/null
+++ b/app/react/docker/services/common/TaskTableQuickActions.tsx
@@ -0,0 +1,52 @@
+import { FileText, Info } from 'lucide-react';
+
+import { Authorized } from '@/react/hooks/useUser';
+
+import { Icon } from '@@/Icon';
+import { Link } from '@@/Link';
+
+interface State {
+  showQuickActionInspect: boolean;
+  showQuickActionLogs: boolean;
+}
+
+export function TaskTableQuickActions({
+  taskId,
+  state = {
+    showQuickActionInspect: true,
+    showQuickActionLogs: true,
+  },
+}: {
+  taskId: string;
+  state?: State;
+}) {
+  return (
+    <div className="inline-flex space-x-1">
+      {state.showQuickActionLogs && (
+        <Authorized authorizations="DockerTaskLogs">
+          <Link
+            to="docker.tasks.task.logs"
+            params={{ id: taskId }}
+            title="Logs"
+            data-cy="docker-task-logs-link"
+          >
+            <Icon icon={FileText} className="space-right" />
+          </Link>
+        </Authorized>
+      )}
+
+      {state.showQuickActionInspect && (
+        <Authorized authorizations="DockerTaskInspect">
+          <Link
+            to="docker.tasks.task"
+            params={{ id: taskId }}
+            title="Inspect"
+            data-cy="docker-task-inspect-link"
+          >
+            <Icon icon={Info} className="space-right" />
+          </Link>
+        </Authorized>
+      )}
+    </div>
+  );
+}
diff --git a/app/react/docker/services/common/convertServiceToConfig.ts b/app/react/docker/services/common/convertServiceToConfig.ts
new file mode 100644
index 0000000..e93e813
--- /dev/null
+++ b/app/react/docker/services/common/convertServiceToConfig.ts
@@ -0,0 +1,15 @@
+import { Service } from 'docker-types';
+
+import { ServiceUpdateConfig } from '../types';
+
+export function convertServiceToConfig(service: Service): ServiceUpdateConfig {
+  return {
+    Name: service.Spec?.Name || '',
+    Labels: service.Spec?.Labels || {},
+    TaskTemplate: service.Spec?.TaskTemplate || {},
+    Mode: service.Spec?.Mode || {},
+    UpdateConfig: service.Spec?.UpdateConfig || {},
+    Networks: service.Spec?.Networks || [],
+    EndpointSpec: service.Spec?.EndpointSpec || {},
+  };
+}
diff --git a/app/react/docker/services/common/update-service-modal.ts b/app/react/docker/services/common/update-service-modal.ts
new file mode 100644
index 0000000..e9107b9
--- /dev/null
+++ b/app/react/docker/services/common/update-service-modal.ts
@@ -0,0 +1,14 @@
+import { openSwitchPrompt } from '@@/modals/SwitchPrompt';
+import { ModalType } from '@@/modals';
+import { buildConfirmButton } from '@@/modals/utils';
+
+export async function confirmServiceForceUpdate(message: string) {
+  const result = await openSwitchPrompt('Are you sure?', 'Re-pull image', {
+    message,
+    confirmButton: buildConfirmButton('Update'),
+    modalType: ModalType.Warn,
+    'data-cy': 'confirm-service-force-update',
+  });
+
+  return result ? { pullLatest: result.value } : undefined;
+}
diff --git a/app/react/docker/services/queries/build-url.ts b/app/react/docker/services/queries/build-url.ts
new file mode 100644
index 0000000..34bc4c8
--- /dev/null
+++ b/app/react/docker/services/queries/build-url.ts
@@ -0,0 +1,12 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { buildDockerProxyUrl } from '../../proxy/queries/buildDockerProxyUrl';
+import { ServiceId } from '../types';
+
+export function buildUrl(
+  endpointId: EnvironmentId,
+  id?: ServiceId,
+  action?: string
+) {
+  return buildDockerProxyUrl(endpointId, 'services', id, action);
+}
diff --git a/app/react/docker/services/queries/query-keys.ts b/app/react/docker/services/queries/query-keys.ts
new file mode 100644
index 0000000..0c64897
--- /dev/null
+++ b/app/react/docker/services/queries/query-keys.ts
@@ -0,0 +1,15 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { queryKeys as dockerQueryKeys } from '../../queries/utils';
+import { Filters } from '../types';
+
+export const queryKeys = {
+  list: (environmentId: EnvironmentId) =>
+    [...dockerQueryKeys.root(environmentId), 'services'] as const,
+
+  filters: (environmentId: EnvironmentId, filters: Filters = {}) =>
+    [...queryKeys.list(environmentId), filters] as const,
+
+  service: (environmentId: EnvironmentId, id: string) =>
+    [...queryKeys.list(environmentId), id] as const,
+};
diff --git a/app/react/docker/services/queries/useCreateServiceMutation.ts b/app/react/docker/services/queries/useCreateServiceMutation.ts
new file mode 100644
index 0000000..4c82ea2
--- /dev/null
+++ b/app/react/docker/services/queries/useCreateServiceMutation.ts
@@ -0,0 +1,54 @@
+import { Service } from 'docker-types';
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import {
+  mutationOptions,
+  withError,
+  withInvalidate,
+} from '@/react-tools/react-query';
+
+import { ServiceUpdateConfig } from '../types';
+import { withRegistryAuthHeader } from '../../proxy/queries/utils';
+
+import { buildUrl } from './build-url';
+import { queryKeys } from './query-keys';
+
+export function useCreateServiceMutation(environmentId: EnvironmentId) {
+  const queryClient = useQueryClient();
+
+  return useMutation(
+    createService,
+    mutationOptions(
+      withInvalidate(queryClient, [queryKeys.list(environmentId)]),
+      withError('Unable to create service')
+    )
+  );
+}
+
+export async function createService({
+  environmentId,
+  config,
+  registryId,
+}: {
+  environmentId: EnvironmentId;
+  config: ServiceUpdateConfig;
+  registryId?: number;
+}) {
+  try {
+    const { data } = await axios.post<Service>(
+      buildUrl(environmentId, 'create'),
+      config,
+      {
+        headers: {
+          version: '1.29', // https://github.com/orgs/portainer/discussions/9407#discussioncomment-6559219
+          ...withRegistryAuthHeader(registryId),
+        },
+      }
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to create service');
+  }
+}
diff --git a/app/react/docker/services/queries/useService.ts b/app/react/docker/services/queries/useService.ts
new file mode 100644
index 0000000..37c9173
--- /dev/null
+++ b/app/react/docker/services/queries/useService.ts
@@ -0,0 +1,35 @@
+import { useQuery } from '@tanstack/react-query';
+import { Service } from 'docker-types';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+import { ServiceId } from '@/react/docker/services/types';
+import { queryKeys } from '@/react/docker/services/queries/query-keys';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { buildUrl } from '@/react/docker/services/queries/build-url';
+
+export function useService(environmentId: EnvironmentId, serviceId: ServiceId) {
+  return useQuery(
+    queryKeys.service(environmentId, serviceId),
+    () => getService(environmentId, serviceId),
+    {
+      enabled: !!serviceId,
+      ...withError('Unable to retrieve service'),
+    }
+  );
+}
+
+export async function getService(
+  environmentId: EnvironmentId,
+  serviceId: ServiceId
+) {
+  try {
+    const { data } = await axios.get<Service>(
+      buildUrl(environmentId, serviceId)
+    );
+
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to get service');
+  }
+}
diff --git a/app/react/docker/services/queries/useServiceLogs.ts b/app/react/docker/services/queries/useServiceLogs.ts
new file mode 100644
index 0000000..a40cb8a
--- /dev/null
+++ b/app/react/docker/services/queries/useServiceLogs.ts
@@ -0,0 +1,33 @@
+import _ from 'lodash';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { buildUrl } from '@/react/docker/services/queries/build-url';
+import { ServiceId } from '@/react/docker/services/types';
+
+type ServiceLogsParams = {
+  stdout?: boolean;
+  stderr?: boolean;
+  timestamps?: boolean;
+  since?: number;
+  tail?: number;
+};
+
+export async function getServiceLogs(
+  environmentId: EnvironmentId,
+  serviceId: ServiceId,
+  params?: ServiceLogsParams
+): Promise<string> {
+  try {
+    const { data } = await axios.get<string>(
+      buildUrl(environmentId, serviceId, 'logs'),
+      {
+        params: _.pickBy(params),
+      }
+    );
+
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to get service logs');
+  }
+}
diff --git a/app/react/docker/services/queries/useServices.ts b/app/react/docker/services/queries/useServices.ts
new file mode 100644
index 0000000..635093b
--- /dev/null
+++ b/app/react/docker/services/queries/useServices.ts
@@ -0,0 +1,47 @@
+import { useQuery } from '@tanstack/react-query';
+import { Service } from 'docker-types';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+import { queryKeys } from '@/react/docker/services/queries/query-keys';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { buildUrl } from '@/react/docker/services/queries/build-url';
+
+import { Filters } from '../types';
+import { withFiltersQueryParam } from '../../proxy/queries/utils';
+
+export function useServices<T = Service>(
+  {
+    environmentId,
+    filters,
+  }: { environmentId: EnvironmentId; filters?: Filters },
+  {
+    enabled,
+    select,
+  }: { enabled?: boolean; select?: (services: Array<Service>) => Array<T> } = {}
+) {
+  return useQuery(
+    queryKeys.filters(environmentId, filters),
+    () => getServices(environmentId, filters),
+    {
+      ...withError('Unable to retrieve services'),
+      enabled,
+      select,
+    }
+  );
+}
+
+export async function getServices(
+  environmentId: EnvironmentId,
+  filters?: Filters
+) {
+  try {
+    const { data } = await axios.get<Service[]>(buildUrl(environmentId), {
+      params: withFiltersQueryParam(filters),
+    });
+
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to get services');
+  }
+}
diff --git a/app/react/docker/services/queries/useUpdateServiceMutation.ts b/app/react/docker/services/queries/useUpdateServiceMutation.ts
new file mode 100644
index 0000000..27def6b
--- /dev/null
+++ b/app/react/docker/services/queries/useUpdateServiceMutation.ts
@@ -0,0 +1,64 @@
+import { ServiceUpdateResponse } from 'docker-types';
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import {
+  mutationOptions,
+  withError,
+  withInvalidate,
+} from '@/react-tools/react-query';
+
+import { ServiceUpdateConfig } from '../types';
+import { withRegistryAuthHeader } from '../../proxy/queries/utils';
+
+import { buildUrl } from './build-url';
+import { queryKeys } from './query-keys';
+
+export function useUpdateServiceMutation(environmentId: EnvironmentId) {
+  const queryClient = useQueryClient();
+
+  return useMutation(
+    updateService,
+    mutationOptions(
+      withInvalidate(queryClient, [queryKeys.list(environmentId)]),
+      withError('Unable to update service')
+    )
+  );
+}
+
+export async function updateService({
+  environmentId,
+  serviceId,
+  config,
+  rollback,
+  version,
+  registryId,
+}: {
+  environmentId: EnvironmentId;
+  serviceId: string;
+  config: ServiceUpdateConfig;
+  rollback?: 'previous';
+  version: number;
+  registryId?: number;
+}) {
+  try {
+    const { data } = await axios.post<ServiceUpdateResponse>(
+      buildUrl(environmentId, serviceId, 'update'),
+      config,
+      {
+        params: {
+          rollback,
+          version,
+        },
+        headers: {
+          version: '1.29', // https://github.com/orgs/portainer/discussions/9407#discussioncomment-6559219
+          ...withRegistryAuthHeader(registryId),
+        },
+      }
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to update service');
+  }
+}
diff --git a/app/react/docker/services/types.ts b/app/react/docker/services/types.ts
new file mode 100644
index 0000000..cd9acef
--- /dev/null
+++ b/app/react/docker/services/types.ts
@@ -0,0 +1,20 @@
+import { ServiceSpec, TaskSpec } from 'docker-types';
+
+export type ServiceId = string;
+
+export type Filters = {
+  id?: ServiceId[];
+  label?: string[];
+  mode?: ['replicated' | 'global'];
+  name?: string[];
+};
+
+export interface ServiceUpdateConfig {
+  Name: string;
+  Labels: Record<string, string>;
+  TaskTemplate: TaskSpec;
+  Mode: ServiceSpec['Mode'];
+  UpdateConfig: ServiceSpec['UpdateConfig'];
+  Networks: ServiceSpec['Networks'];
+  EndpointSpec: ServiceSpec['EndpointSpec'];
+}
diff --git a/app/react/docker/services/utils.ts b/app/react/docker/services/utils.ts
new file mode 100644
index 0000000..a000b50
--- /dev/null
+++ b/app/react/docker/services/utils.ts
@@ -0,0 +1,11 @@
+/**
+ * Associates tasks to a Docker service by filtering tasks that belong to the service.
+ */
+export function associateServiceTasks<TTask extends { ServiceId: string }>(
+  service: { Id: string; Name: string },
+  tasks: Array<TTask>
+) {
+  return tasks
+    .filter((t) => t.ServiceId === service.Id)
+    .map((t) => ({ ...t, ServiceName: service.Name }));
+}
diff --git a/app/react/docker/services/webhooks/build-url.ts b/app/react/docker/services/webhooks/build-url.ts
new file mode 100644
index 0000000..7e75434
--- /dev/null
+++ b/app/react/docker/services/webhooks/build-url.ts
@@ -0,0 +1,4 @@
+export function buildUrl(webhookId?: string) {
+  const baseUrl = '/webhooks';
+  return webhookId ? `${baseUrl}/${webhookId}` : baseUrl;
+}
diff --git a/app/react/docker/services/webhooks/getWebhooks.ts b/app/react/docker/services/webhooks/getWebhooks.ts
new file mode 100644
index 0000000..aa98f4e
--- /dev/null
+++ b/app/react/docker/services/webhooks/getWebhooks.ts
@@ -0,0 +1,24 @@
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { buildUrl } from './build-url';
+import { Webhook } from './types';
+
+export async function getWebhooks(
+  environmentId: EnvironmentId,
+  serviceId: string
+) {
+  try {
+    const { data } = await axios.get<Array<Webhook>>(buildUrl(), {
+      params: {
+        filters: JSON.stringify({
+          EndpointID: environmentId,
+          ResourceID: serviceId,
+        }),
+      },
+    });
+    return data;
+  } catch (error) {
+    throw parseAxiosError(error);
+  }
+}
diff --git a/app/react/docker/services/webhooks/removeWebhook.ts b/app/react/docker/services/webhooks/removeWebhook.ts
new file mode 100644
index 0000000..886e6f8
--- /dev/null
+++ b/app/react/docker/services/webhooks/removeWebhook.ts
@@ -0,0 +1,25 @@
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { promiseSequence } from '@/portainer/helpers/promise-utils';
+
+import { getWebhooks } from './getWebhooks';
+import { Webhook } from './types';
+import { buildUrl } from './build-url';
+
+export async function removeWebhooksForService(
+  environmentId: EnvironmentId,
+  serviceId: string
+) {
+  const webhooks = await getWebhooks(environmentId, serviceId);
+  return promiseSequence(
+    webhooks.map((webhook) => () => removeWebhook(webhook.Id))
+  );
+}
+
+export async function removeWebhook(webhookId: Webhook['Id']) {
+  try {
+    await axios.delete(buildUrl(webhookId));
+  } catch (err) {
+    throw parseAxiosError(err);
+  }
+}
diff --git a/app/react/docker/services/webhooks/types.ts b/app/react/docker/services/webhooks/types.ts
new file mode 100644
index 0000000..4f5991b
--- /dev/null
+++ b/app/react/docker/services/webhooks/types.ts
@@ -0,0 +1,16 @@
+import { Environment } from '@/react/portainer/environments/types';
+import { Registry } from '@/react/portainer/registries/types/registry';
+
+enum WebhookType {
+  Service = 1,
+  Container = 2,
+}
+
+export interface Webhook {
+  Id: string;
+  Token: string;
+  ResourceId: string;
+  EndpointId: Environment['Id'];
+  RegistryId: Registry['Id'];
+  Type: WebhookType;
+}
diff --git a/app/react/docker/setup/.keep b/app/react/docker/setup/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/docker/setup/RegistriesView/.keep b/app/react/docker/setup/RegistriesView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/docker/setup/RegistryAccessView/.keep b/app/react/docker/setup/RegistryAccessView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/docker/setup/SetupView/.keep b/app/react/docker/setup/SetupView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/docker/snapshots/types/index.ts b/app/react/docker/snapshots/types/index.ts
new file mode 100644
index 0000000..e386892
--- /dev/null
+++ b/app/react/docker/snapshots/types/index.ts
@@ -0,0 +1,16 @@
+import { PortainerDockerSnapshot } from '@api/types.gen';
+
+import { ContainerListViewModel } from '@/react/docker/containers/types';
+
+export type DockerContainerSnapshot = ContainerListViewModel & {
+  Env: string[];
+};
+
+export type DockerSnapshotRaw = {
+  Containers: DockerContainerSnapshot[];
+  SnapshotTime: string;
+};
+
+export interface DockerSnapshot extends PortainerDockerSnapshot {
+  GpuUseList: string[];
+}
diff --git a/app/react/docker/stacks/CreateView/CreateStackForm/CreateStackForm.test.tsx b/app/react/docker/stacks/CreateView/CreateStackForm/CreateStackForm.test.tsx
new file mode 100644
index 0000000..5f7fc09
--- /dev/null
+++ b/app/react/docker/stacks/CreateView/CreateStackForm/CreateStackForm.test.tsx
@@ -0,0 +1,386 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { vi } from 'vitest';
+
+import { SourcesSource } from '@api/types.gen';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { server } from '@/setup-tests/server';
+
+import { CreateStackForm } from './CreateStackForm';
+
+vi.mock('@/react/hooks/useEnvironmentId', () => ({
+  useEnvironmentId: () => 1,
+}));
+
+vi.mock('@/react/hooks/useDebounce', () => ({
+  useDebounce: (value: unknown, onChange: (value: unknown) => void) => [
+    value,
+    onChange,
+  ],
+}));
+
+vi.mock('@/portainer/services/notifications', () => ({
+  notifyError: vi.fn(),
+  notifySuccess: vi.fn(),
+}));
+
+function renderComponent({
+  onMutationError,
+}: { onMutationError?(): void } = {}) {
+  const Wrapped = withTestQueryProvider(
+    withTestRouter(withUserProvider(CreateStackForm)),
+    { onMutationError }
+  );
+
+  return render(<Wrapped environmentId={1} isSwarm={false} swarmId="" />);
+}
+
+describe('CreateStackForm', () => {
+  it.todo(
+    'should not display any visible error messages on initial load',
+    async () => {
+      renderComponent();
+
+      const errors = await screen.findByRole('alert');
+
+      // Check that no error messages (role="alert") are visible
+      expect(errors).not.toBeInTheDocument();
+    }
+  );
+
+  it('should render with default method (editor)', async () => {
+    renderComponent();
+
+    expect(await screen.findByText('Build method')).toBeVisible();
+    expect(screen.getByRole('radio', { name: /web editor/i })).toBeChecked();
+    expect(screen.getByRole('radio', { name: /upload/i })).not.toBeChecked();
+    expect(
+      screen.getByRole('radio', { name: /repository/i })
+    ).not.toBeChecked();
+    expect(
+      screen.getByRole('radio', { name: /custom template/i })
+    ).not.toBeChecked();
+  });
+
+  it('should switch to upload method', async () => {
+    const user = userEvent.setup();
+    renderComponent();
+
+    const element = await screen.findByRole('radio', { name: /upload/i });
+
+    await user.click(element);
+
+    expect(element).toBeChecked();
+    expect(
+      screen.getByText('You can upload a Compose file from your computer.')
+    ).toBeVisible();
+  });
+
+  it('should switch to git method', async () => {
+    const user = userEvent.setup();
+    renderComponent();
+
+    const element = await screen.findByRole('radio', {
+      name: /repository/i,
+    });
+    await user.click(element);
+
+    expect(element).toBeChecked();
+
+    expect(
+      await screen.findByRole('combobox', { name: /source/i })
+    ).toBeVisible();
+  });
+
+  it('should switch to template method', async () => {
+    const user = userEvent.setup();
+    renderComponent();
+
+    // Mock custom templates
+    server.use(
+      http.get('/api/custom_templates', () =>
+        HttpResponse.json([
+          { Id: 1, Title: 'Template 1', Type: 1 },
+          { Id: 2, Title: 'Template 2', Type: 1 },
+        ])
+      )
+    );
+    const element = await screen.findByRole('radio', {
+      name: /custom template/i,
+    });
+    await user.click(element);
+    expect(element).toBeChecked();
+
+    expect(
+      await screen.findByRole('combobox', { name: 'Template' })
+    ).toBeVisible();
+  });
+
+  it('should show validation error for empty name', async () => {
+    renderComponent();
+
+    expect(await screen.findByText(/name is required/i)).toBeVisible();
+  });
+
+  it('should show validation error for empty editor content', async () => {
+    renderComponent();
+
+    expect(
+      await screen.findByText(/stack file content is required/i)
+    ).toBeVisible();
+  });
+
+  it('should submit editor form successfully', async () => {
+    let requestBody: unknown;
+    server.use(
+      http.post('/api/stacks/create/standalone/string', async ({ request }) => {
+        requestBody = await request.json();
+        return HttpResponse.json({
+          Id: 123,
+          Name: 'test-stack',
+          ResourceControl: { Id: 1 },
+        });
+      }),
+      http.put('/api/resource_controls/:id', () =>
+        HttpResponse.json({ success: true })
+      )
+    );
+
+    const user = userEvent.setup();
+    renderComponent();
+
+    const nameInput = await screen.findByRole('textbox', { name: /name/i });
+    await user.clear(nameInput);
+    await user.type(nameInput, 'test-stack');
+
+    // TODO: find a way to use getByRole
+    const editor = screen.getByTestId('stack-creation-editor');
+
+    await user.type(
+      editor,
+      'version: "3"\nservices:\n  web:\n    image: nginx'
+    );
+
+    await waitFor(() => {
+      expect(screen.queryByRole('alert')).not.toBeInTheDocument();
+    });
+    const button = screen.getByRole('button', { name: /deploy the stack/i });
+    expect(button).toBeEnabled();
+
+    await user.click(button);
+
+    await waitFor(() => {
+      expect(requestBody).toMatchObject({
+        name: 'test-stack',
+        stackFileContent: expect.stringContaining('version: "3"'),
+      });
+    });
+  });
+
+  // TODO: update to happydom fixes the issues, but fails other tests
+  it.todo(
+    'some issue with file upload prevents this from working: should submit upload form with file',
+    async () => {
+      let requestPayload: FormData | undefined;
+      server.use(
+        http.post('/api/stacks/create/standalone/file', async ({ request }) => {
+          requestPayload = (await request.formData()) as FormData;
+          return HttpResponse.json({
+            Id: 123,
+            Name: 'test-stack',
+            ResourceControl: { Id: 1 },
+          });
+        }),
+        http.put('/api/resource_controls/:id', () =>
+          HttpResponse.json({ success: true })
+        )
+      );
+
+      const user = userEvent.setup();
+      renderComponent();
+
+      await user.click(await screen.findByRole('radio', { name: /upload/i }));
+
+      // Fill in name
+      const nameInput = screen.getByRole('textbox', { name: /name/i });
+      await user.clear(nameInput);
+      await user.type(nameInput, 'test-stack');
+
+      // Upload file
+      const file = new File(
+        ['version: "3"\nservices:\n  web:\n    image: nginx'],
+        'docker-compose.yml',
+        {
+          type: 'application/x-yaml',
+        }
+      );
+      const fileInput = screen.getByTestId('stack-creation-file-upload-input');
+      await user.upload(fileInput, file);
+
+      await waitFor(() => {
+        expect(screen.queryByRole('alert')).not.toBeInTheDocument();
+      });
+
+      const submitButton = screen.getByRole('button', {
+        name: /deploy the stack/i,
+      });
+
+      expect(submitButton).toBeEnabled();
+
+      await user.click(submitButton);
+
+      await waitFor(() => {
+        expect(requestPayload).toBeDefined();
+        expect(requestPayload?.get('Name')).toBe('test-stack');
+        expect(requestPayload?.get('file')).toBeInstanceOf(File);
+      });
+    }
+  );
+
+  it('should submit git form successfully', async () => {
+    let requestBody: unknown;
+    server.use(
+      http.get('/api/gitops/sources', () =>
+        HttpResponse.json<SourcesSource[]>(
+          [
+            {
+              id: 1,
+              name: 'my-source',
+              type: 'git',
+              url: 'https://github.com/test/repo',
+              status: 'healthy',
+            },
+          ],
+          {
+            headers: {
+              'x-total-count': '1',
+              'x-total-available': '1',
+            },
+          }
+        )
+      ),
+      http.post(
+        '/api/stacks/create/standalone/repository',
+        async ({ request }) => {
+          requestBody = await request.json();
+          return HttpResponse.json({
+            Id: 123,
+            Name: 'test-stack',
+            ResourceControl: { Id: 1 },
+          });
+        }
+      ),
+      http.put('/api/resource_controls/:id', () =>
+        HttpResponse.json({ success: true })
+      ),
+      http.post('/api/gitops/repo/refs', () => HttpResponse.json([])),
+      http.post('/api/gitops/repo/files/search', () =>
+        HttpResponse.json(['docker-compose.yml'])
+      )
+    );
+
+    const user = userEvent.setup();
+    renderComponent();
+
+    // Switch to git
+    await user.click(await screen.findByRole('radio', { name: /repository/i }));
+
+    // using paste to reduce test validation time and test time
+    const nameInput = screen.getByRole('textbox', { name: /name/i });
+    await user.clear(nameInput);
+    await user.paste('test-stack');
+
+    // Select a source (sets URL and SourceId)
+    const sourceInput = await screen.findByRole('combobox', {
+      name: /source/i,
+    });
+    await user.click(sourceInput);
+    await user.click(await screen.findByRole('option', { name: 'my-source' }));
+
+    const refsField = screen.getByLabelText(/reference/i);
+    await user.clear(refsField);
+    await user.paste('refs/heads/main');
+
+    const configFileField = screen.getByLabelText(/compose path/i);
+    await user.clear(configFileField);
+    await user.paste('docker-compose.yml');
+
+    await waitFor(() => {
+      expect(screen.queryByRole('alert')).not.toBeInTheDocument();
+    });
+
+    const submitButton = screen.getByRole('button', {
+      name: /deploy the stack/i,
+    });
+
+    expect(submitButton).toBeEnabled();
+
+    await user.click(submitButton);
+
+    await waitFor(() => {
+      expect(requestBody).toMatchObject(
+        expect.objectContaining({
+          name: 'test-stack',
+          sourceId: 1,
+          repositoryReferenceName: 'refs/heads/main',
+          composeFile: 'docker-compose.yml',
+        })
+      );
+    });
+  });
+
+  it('should handle API error gracefully', async () => {
+    const consoleErrorSpy = vi
+      .spyOn(console, 'error')
+      .mockImplementation(() => {});
+    const consoleLogSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+
+    const mutationError = vi.fn();
+    const errorMessage = 'test - failed to create stack';
+    server.use(
+      http.post('/api/stacks/create/standalone/string', () =>
+        HttpResponse.json({ message: errorMessage }, { status: 500 })
+      )
+    );
+
+    const user = userEvent.setup();
+    renderComponent({ onMutationError: mutationError });
+
+    const nameInput = await screen.findByRole('textbox', { name: /name/i });
+    await user.clear(nameInput);
+    await user.type(nameInput, 'test-stack');
+
+    const editor = screen.getByTestId('stack-creation-editor');
+
+    await user.type(
+      editor,
+      'version: "3"\nservices:\n  web:\n    image: nginx'
+    );
+
+    await waitFor(() => {
+      expect(screen.queryByRole('alert')).not.toBeInTheDocument();
+    });
+
+    const submitButton = screen.getByRole('button', {
+      name: /deploy the stack/i,
+    });
+
+    expect(submitButton).toBeEnabled();
+
+    await user.click(submitButton);
+
+    await waitFor(() => {
+      expect(mutationError).toHaveBeenCalledOnce();
+      expect(mutationError.mock.calls[0][0].toString()).toBe(
+        new Error(errorMessage).toString()
+      );
+    });
+
+    consoleErrorSpy.mockRestore();
+    consoleLogSpy.mockRestore();
+  });
+});
diff --git a/app/react/docker/stacks/CreateView/CreateStackForm/CreateStackForm.tsx b/app/react/docker/stacks/CreateView/CreateStackForm/CreateStackForm.tsx
new file mode 100644
index 0000000..1412768
--- /dev/null
+++ b/app/react/docker/stacks/CreateView/CreateStackForm/CreateStackForm.tsx
@@ -0,0 +1,245 @@
+import { Formik } from 'formik';
+import { useCurrentStateAndParams, useRouter } from '@uirouter/react';
+import { useState } from 'react';
+import uuidv4 from 'uuid/v4';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import {
+  useCreateStack,
+  CreateStackPayload,
+} from '@/react/common/stacks/queries/useCreateStack/useCreateStack';
+import { useCurrentUser, useIsEdgeAdmin } from '@/react/hooks/useUser';
+import { defaultValues } from '@/react/portainer/access-control/utils';
+import { getDefaultModel } from '@/react/portainer/gitops/types';
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { FormValues } from './types';
+import { useValidationSchema } from './useValidationSchema';
+import { CreateStackInnerForm } from './CreateStackInnerForm';
+
+interface Props {
+  environmentId: EnvironmentId;
+  isSwarm: boolean;
+  swarmId: string;
+}
+
+export function CreateStackForm({ environmentId, isSwarm, swarmId }: Props) {
+  const router = useRouter();
+  const {
+    params: { yaml },
+  } = useCurrentStateAndParams();
+  const createStackMutation = useCreateStack();
+  const { user } = useCurrentUser();
+  const { isAdmin } = useIsEdgeAdmin();
+  const [webhookId] = useState(() => uuidv4());
+  const validationSchema = useValidationSchema(environmentId);
+
+  const initialValues: FormValues = {
+    method: 'editor',
+    name: '',
+    editor: {
+      fileContent: yaml || '',
+    },
+    upload: {
+      file: null,
+    },
+    git: {
+      ...getDefaultModel(),
+      SupportRelativePath: false,
+      FilesystemPath: '',
+    },
+    template: {
+      fileContent: '',
+      selectedId: undefined,
+      variables: [],
+    },
+    env: [],
+    enableWebhook: false,
+    registries: [],
+    accessControl: defaultValues(isAdmin, user.Id),
+  };
+
+  return (
+    <Formik
+      initialValues={initialValues}
+      onSubmit={handleSubmit}
+      validationSchema={validationSchema}
+      validateOnMount
+    >
+      <CreateStackInnerForm
+        isDeploying={createStackMutation.isLoading}
+        isSwarm={isSwarm}
+        isSaved={createStackMutation.isSuccess}
+        webhookId={webhookId}
+      />
+    </Formik>
+  );
+
+  async function handleSubmit(values: FormValues) {
+    const stackType = isSwarm ? 'swarm' : 'standalone';
+
+    const payload = buildCreateStackPayload({
+      values,
+      environmentId,
+      stackType,
+      swarmId,
+      webhookId,
+    });
+
+    createStackMutation.mutate(payload, {
+      onSuccess: (stack) => {
+        notifySuccess('Success', 'Stack successfully created');
+        router.stateService.go('docker.stacks.stack', {
+          name: stack.Name,
+          id: stack.Id,
+          type: stack.Type,
+          regular: 'true',
+        });
+      },
+    });
+  }
+}
+
+function buildCreateStackPayload({
+  environmentId,
+  stackType,
+  swarmId,
+  values,
+  webhookId,
+}: {
+  values: FormValues;
+  environmentId: EnvironmentId;
+  stackType: 'swarm' | 'standalone';
+  swarmId: string;
+  webhookId: string;
+}): CreateStackPayload {
+  const basePayload = {
+    name: values.name,
+    environmentId,
+    env: values.env,
+    accessControl: values.accessControl,
+    registries: values.registries,
+  };
+
+  switch (values.method) {
+    case 'editor':
+      if (stackType === 'swarm') {
+        return {
+          type: 'swarm',
+          method: 'string',
+          payload: {
+            ...basePayload,
+            swarmId,
+            fileContent: values.editor.fileContent,
+            webhook: values.enableWebhook ? webhookId : undefined,
+          },
+        };
+      }
+      return {
+        type: 'standalone',
+        method: 'string',
+        payload: {
+          ...basePayload,
+          fileContent: values.editor.fileContent,
+          webhook: values.enableWebhook ? webhookId : undefined,
+        },
+      };
+
+    case 'upload':
+      if (!values.upload.file) {
+        throw new Error('File is required for upload method');
+      }
+      if (stackType === 'swarm') {
+        return {
+          type: 'swarm',
+          method: 'file',
+          payload: {
+            ...basePayload,
+            swarmId,
+            file: values.upload.file,
+            webhook: values.enableWebhook ? webhookId : undefined,
+          },
+        };
+      }
+      return {
+        type: 'standalone',
+        method: 'file',
+        payload: {
+          ...basePayload,
+          file: values.upload.file,
+          webhook: values.enableWebhook ? webhookId : undefined,
+        },
+      };
+
+    case 'repository':
+      if (stackType === 'swarm') {
+        return {
+          type: 'swarm',
+          method: 'git',
+          payload: {
+            ...basePayload,
+            webhook: webhookId,
+            swarmId,
+            git: values.git,
+            relativePathSettings: values.git.SupportRelativePath
+              ? {
+                  SupportRelativePath: true,
+                  FilesystemPath: values.git.FilesystemPath,
+                  SupportPerDeviceConfigs: false,
+                  PerDeviceConfigsPath: '',
+                  PerDeviceConfigsMatchType: '',
+                  PerDeviceConfigsGroupMatchType: '',
+                }
+              : undefined,
+          },
+        };
+      }
+      return {
+        type: 'standalone',
+        method: 'git',
+        payload: {
+          ...basePayload,
+          git: values.git,
+          webhook: webhookId,
+          relativePathSettings: values.git.SupportRelativePath
+            ? {
+                SupportRelativePath: true,
+                FilesystemPath: values.git.FilesystemPath,
+                SupportPerDeviceConfigs: false,
+                PerDeviceConfigsPath: '',
+                PerDeviceConfigsMatchType: '',
+                PerDeviceConfigsGroupMatchType: '',
+              }
+            : undefined,
+        },
+      };
+
+    case 'template':
+      if (stackType === 'swarm') {
+        return {
+          type: 'swarm',
+          method: 'string',
+          payload: {
+            ...basePayload,
+            swarmId,
+            fileContent: values.template.fileContent,
+            webhook: values.enableWebhook ? webhookId : undefined,
+            fromAppTemplate: true,
+          },
+        };
+      }
+      return {
+        type: 'standalone',
+        method: 'string',
+        payload: {
+          ...basePayload,
+          fileContent: values.template.fileContent,
+          webhook: values.enableWebhook ? webhookId : undefined,
+          fromAppTemplate: true,
+        },
+      };
+
+    default:
+      throw new Error('Invalid method');
+  }
+}
diff --git a/app/react/docker/stacks/CreateView/CreateStackForm/CreateStackForm.webhook.test.tsx b/app/react/docker/stacks/CreateView/CreateStackForm/CreateStackForm.webhook.test.tsx
new file mode 100644
index 0000000..d7d38a0
--- /dev/null
+++ b/app/react/docker/stacks/CreateView/CreateStackForm/CreateStackForm.webhook.test.tsx
@@ -0,0 +1,336 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { DefaultBodyType, http, HttpResponse } from 'msw';
+import uuidv4 from 'uuid/v4';
+import { Formik } from 'formik';
+
+import { server } from '@/setup-tests/server';
+import { EnvironmentType } from '@/react/portainer/environments/types';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import {
+  createMockEnvironment,
+  createMockUsers,
+} from '@/react-tools/test-mocks';
+import { Role } from '@/portainer/users/types';
+
+import { mockFormValues } from './test-utils';
+import { CreateStackInnerForm } from './CreateStackInnerForm';
+import { CreateStackForm } from './CreateStackForm';
+
+vi.mock('uuid/v4', () => ({
+  default: vi.fn(() => 'test-webhook-id-1234'),
+}));
+
+vi.mock('@uirouter/react', async (importOriginal: () => Promise<object>) => ({
+  ...(await importOriginal()),
+  useCurrentStateAndParams: vi.fn(() => ({
+    params: { endpointId: 1 },
+  })),
+}));
+
+describe('CreateStackForm - Webhook ID Integration', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+
+    server.use(
+      http.get('/api/endpoints/1', () =>
+        HttpResponse.json(
+          createMockEnvironment({
+            Id: 1,
+            Type: EnvironmentType.Docker,
+            ComposeSyntaxMaxVersion: '3',
+          })
+        )
+      )
+    );
+  });
+
+  it('should display webhook ID when webhook is enabled in editor method', async () => {
+    const webhookId = 'test-webhook-id-1234';
+
+    renderComponent({
+      webhookId,
+      initialValues: mockFormValues({
+        method: 'editor',
+        name: 'test-stack',
+        enableWebhook: true,
+        editor: {
+          fileContent: "version: '3'\nservices:\n  web:\n    image: nginx",
+        },
+      }),
+    });
+
+    await waitFor(() => {
+      expect(screen.getByTestId('stack-name-input')).toBeInTheDocument();
+    });
+
+    await waitFor(() => {
+      const webhookDisplay = screen.queryByRole('textbox', {
+        name: /webhook url/i,
+      });
+      expect(webhookDisplay).toBeInTheDocument();
+      expect(webhookDisplay).toHaveTextContent(webhookId);
+    });
+
+    expect(vi.mocked(uuidv4)).not.toHaveBeenCalled();
+  });
+
+  it('should display webhook ID in git repository method with auto-update', async () => {
+    const webhookId = 'test-webhook-id-1234';
+
+    server.use(
+      http.post('/api/gitops/repo/refs', () =>
+        HttpResponse.json(['refs/heads/main', 'refs/heads/develop'])
+      ),
+      http.post('/api/gitops/repo/files/search', () =>
+        HttpResponse.json(['docker-compose.yml'])
+      )
+    );
+
+    renderComponent({
+      webhookId,
+      initialValues: mockFormValues({
+        method: 'repository',
+        name: 'test-stack',
+        git: {
+          RepositoryReferenceName: 'main',
+          ComposeFilePathInRepository: 'docker-compose.yml',
+          AdditionalFiles: [],
+          AutoUpdate: {
+            RepositoryAutomaticUpdates: true,
+            RepositoryMechanism: 'Webhook',
+            RepositoryFetchInterval: '',
+            ForcePullImage: false,
+            RepositoryAutomaticUpdatesForce: false,
+          },
+          SupportRelativePath: false,
+          FilesystemPath: '',
+        },
+      }),
+    });
+
+    await waitFor(() => {
+      expect(screen.getByTestId('stack-name-input')).toBeInTheDocument();
+    });
+
+    await waitFor(
+      () => {
+        const webhookDisplay = screen.queryByRole('textbox', {
+          name: /webhook url/i,
+        });
+        expect(webhookDisplay).toBeInTheDocument();
+        expect(webhookDisplay).toHaveTextContent(webhookId);
+      },
+      { timeout: 3000 }
+    );
+  });
+
+  it('should not display webhook ID when webhook is disabled', async () => {
+    const webhookId = 'test-webhook-id-1234';
+
+    renderComponent({
+      webhookId,
+      initialValues: mockFormValues({
+        method: 'editor',
+        name: 'test-stack',
+        enableWebhook: false,
+        editor: {
+          fileContent: "version: '3'\nservices:\n  web:\n    image: nginx",
+        },
+      }),
+    });
+
+    await waitFor(() => {
+      expect(screen.getByTestId('stack-name-input')).toBeInTheDocument();
+    });
+
+    const webhookDisplay = screen.queryByRole('textbox', {
+      name: /webhook url/i,
+    });
+    expect(webhookDisplay).not.toBeInTheDocument();
+  });
+
+  it('should call uuid exactly once when CreateStackForm mounts', async () => {
+    vi.clearAllMocks();
+
+    renderFullComponent({
+      environmentId: 1,
+      isSwarm: false,
+      swarmId: '',
+    });
+
+    await waitFor(() => {
+      expect(screen.getByTestId('stack-name-input')).toBeInTheDocument();
+    });
+
+    expect(vi.mocked(uuidv4)).toHaveBeenCalledOnce();
+  });
+
+  it('should send webhook ID in API request when editor webhook is enabled', async () => {
+    const user = userEvent.setup();
+    let capturedRequestBody: DefaultBodyType;
+
+    server.use(
+      http.post('/api/stacks/create/standalone/string', async ({ request }) => {
+        capturedRequestBody = await request.json();
+        return HttpResponse.json({
+          Id: 1,
+          Name: 'test-stack',
+          ResourceControl: { Id: 1 },
+        });
+      }),
+      http.put('/api/resource_controls/:id', () => HttpResponse.json({}))
+    );
+
+    renderFullComponent({
+      environmentId: 1,
+      isSwarm: false,
+      swarmId: '',
+    });
+
+    const nameInput = await screen.findByRole('textbox', { name: /name/i });
+    await user.clear(nameInput);
+    await user.type(nameInput, 'test-stack');
+
+    const editor = screen.getByTestId('stack-creation-editor');
+    await user.type(editor, 'services:\n  web:\n    image: nginx');
+
+    const webhookToggle = await screen.findByRole('checkbox', {
+      name: /create a stack webhook/i,
+    });
+    await user.click(webhookToggle);
+
+    await waitFor(() => {
+      expect(screen.queryByRole('alert')).not.toBeInTheDocument();
+    });
+
+    const deployButton = screen.getByRole('button', {
+      name: /deploy the stack/i,
+    });
+    expect(deployButton).toBeEnabled();
+
+    await user.click(deployButton);
+
+    await waitFor(
+      () => {
+        expect(capturedRequestBody).toBeDefined();
+      },
+      { timeout: 3000 }
+    );
+    assert(capturedRequestBody && typeof capturedRequestBody === 'object');
+
+    expect(capturedRequestBody?.webhook).toBe('test-webhook-id-1234');
+  });
+
+  it('should not send webhook ID in API request when editor webhook is disabled', async () => {
+    const user = userEvent.setup();
+    let capturedRequestBody: DefaultBodyType;
+
+    server.use(
+      http.post('/api/stacks/create/standalone/string', async ({ request }) => {
+        capturedRequestBody = await request.json();
+        return HttpResponse.json({
+          Id: 1,
+          Name: 'test-stack',
+          ResourceControl: { Id: 1 },
+        });
+      }),
+      http.put('/api/resource_controls/:id', () => HttpResponse.json({}))
+    );
+
+    renderFullComponent({
+      environmentId: 1,
+      isSwarm: false,
+      swarmId: '',
+    });
+
+    const nameInput = await screen.findByRole('textbox', { name: /name/i });
+    await user.clear(nameInput);
+    await user.type(nameInput, 'test-stack');
+
+    const editor = screen.getByTestId('stack-creation-editor');
+    await user.type(editor, 'services:\n  web:\n    image: nginx');
+
+    await waitFor(() => {
+      expect(screen.queryByRole('alert')).not.toBeInTheDocument();
+    });
+
+    const deployButton = screen.getByRole('button', {
+      name: /deploy the stack/i,
+    });
+    expect(deployButton).toBeEnabled();
+
+    await user.click(deployButton);
+
+    await waitFor(
+      () => {
+        expect(capturedRequestBody).toBeDefined();
+      },
+      { timeout: 3000 }
+    );
+
+    expect(capturedRequestBody).not.toHaveProperty('webhook');
+  });
+});
+
+function renderComponent({
+  webhookId,
+  initialValues,
+}: {
+  webhookId: string;
+  initialValues: ReturnType<typeof mockFormValues>;
+}) {
+  const user = createMockUsers(1, Role.Admin)[0];
+
+  const Component = withTestRouter(
+    withUserProvider(
+      withTestQueryProvider(() => (
+        <Formik
+          initialValues={initialValues}
+          onSubmit={async () => {}}
+          validateOnMount
+        >
+          <CreateStackInnerForm
+            isSwarm={false}
+            isDeploying={false}
+            isSaved={false}
+            webhookId={webhookId}
+          />
+        </Formik>
+      )),
+      user
+    )
+  );
+
+  return render(<Component />);
+}
+
+function renderFullComponent({
+  environmentId,
+  isSwarm,
+  swarmId,
+}: {
+  environmentId: number;
+  isSwarm: boolean;
+  swarmId: string;
+}) {
+  const user = createMockUsers(1, Role.Admin)[0];
+
+  const Component = withTestRouter(
+    withUserProvider(
+      withTestQueryProvider(() => (
+        <CreateStackForm
+          environmentId={environmentId}
+          isSwarm={isSwarm}
+          swarmId={swarmId}
+        />
+      )),
+      user
+    )
+  );
+
+  return render(<Component />);
+}
diff --git a/app/react/docker/stacks/CreateView/CreateStackForm/CreateStackInnerForm.tsx b/app/react/docker/stacks/CreateView/CreateStackForm/CreateStackInnerForm.tsx
new file mode 100644
index 0000000..2810c6f
--- /dev/null
+++ b/app/react/docker/stacks/CreateView/CreateStackForm/CreateStackInnerForm.tsx
@@ -0,0 +1,139 @@
+import { Form, useFormikContext } from 'formik';
+
+import { AccessControlForm } from '@/react/portainer/access-control/AccessControlForm';
+import { NameField } from '@/react/docker/stacks/common/NameField';
+import { useDockerComposeSchema } from '@/react/hooks/useDockerComposeSchema/useDockerComposeSchema';
+import { useCurrentEnvironment } from '@/react/hooks/useCurrentEnvironment';
+
+import { BoxSelector } from '@@/BoxSelector';
+import { LoadingButton } from '@@/buttons';
+import { FormSection } from '@@/form-components/FormSection';
+import { StackEnvironmentVariablesPanel } from '@@/form-components/EnvironmentVariablesFieldset';
+import {
+  editor,
+  upload,
+  git,
+  customTemplate,
+} from '@@/BoxSelector/common-options/build-methods';
+
+import { WebhookFieldset } from '../../common/WebhookFieldset';
+
+import { EditorSection } from './EditorSection/EditorSection';
+import { UploadSection } from './UploadSection/UploadSection';
+import { GitSection } from './GitSection/GitSection';
+import { TemplateSection } from './TemplateSection/TemplateSection';
+import { DeploymentInfo } from './DeploymentInfo';
+import { FormValues } from './types';
+
+const buildMethods = [editor, upload, git, customTemplate];
+
+export function CreateStackInnerForm({
+  isSwarm = false,
+  isDeploying,
+  isSaved,
+  webhookId,
+}: {
+  isSwarm: boolean | undefined;
+  isDeploying: boolean;
+  isSaved: boolean;
+  webhookId: string;
+}) {
+  const environmentQuery = useCurrentEnvironment();
+  const schemaQuery = useDockerComposeSchema();
+  const formikContext = useFormikContext<FormValues>();
+  const { errors, values, setFieldValue, isValid } = formikContext;
+
+  if (!environmentQuery.data) {
+    return null;
+  }
+
+  const environment = environmentQuery.data;
+
+  const dockerComposeSchema = schemaQuery.data;
+  const composeSyntaxMaxVersion = environment?.ComposeSyntaxMaxVersion
+    ? parseInt(environment.ComposeSyntaxMaxVersion, 10)
+    : undefined;
+
+  return (
+    <Form className="form-horizontal">
+      <NameField
+        value={values.name}
+        onChange={(name) => setFieldValue('name', name)}
+        placeholder="e.g. mystack"
+        errors={errors.name}
+      />
+
+      <DeploymentInfo
+        isSwarm={isSwarm}
+        composeSyntaxMaxVersion={composeSyntaxMaxVersion}
+      />
+
+      <FormSection title="Build method">
+        <BoxSelector
+          radioName="build-method"
+          value={values.method}
+          onChange={(method) => setFieldValue('method', method)}
+          options={buildMethods}
+          slim
+        />
+      </FormSection>
+
+      {values.method === 'upload' && <UploadSection isSwarm={isSwarm} />}
+
+      {values.method === 'repository' && (
+        <GitSection isDockerStandalone={!isSwarm} webhookId={webhookId} />
+      )}
+
+      {values.method === 'template' && (
+        <TemplateSection
+          isSwarm={isSwarm}
+          schema={dockerComposeSchema}
+          isSaved={isSaved}
+        />
+      )}
+
+      {values.method === 'editor' && (
+        <EditorSection
+          schema={dockerComposeSchema}
+          isSwarm={isSwarm}
+          isSaved={isSaved}
+        />
+      )}
+
+      {values.method !== 'repository' && (
+        <WebhookFieldset
+          value={values.enableWebhook}
+          onChange={(value) => setFieldValue('enableWebhook', value)}
+          webhookId={webhookId}
+        />
+      )}
+
+      <StackEnvironmentVariablesPanel
+        values={values.env}
+        onChange={(env) => setFieldValue('env', env)}
+        errors={errors.env}
+      />
+
+      <AccessControlForm
+        values={values.accessControl}
+        onChange={(accessControl) =>
+          setFieldValue('accessControl', accessControl)
+        }
+        environmentId={environment.Id}
+        errors={errors.accessControl}
+      />
+
+      <FormSection title="Actions">
+        <LoadingButton
+          loadingText="Deployment in progress..."
+          isLoading={isDeploying}
+          disabled={!isValid}
+          className="!ml-0"
+          data-cy="create-stack-submit-btn"
+        >
+          Deploy the stack
+        </LoadingButton>
+      </FormSection>
+    </Form>
+  );
+}
diff --git a/app/react/docker/stacks/CreateView/CreateStackForm/DeploymentInfo.tsx b/app/react/docker/stacks/CreateView/CreateStackForm/DeploymentInfo.tsx
new file mode 100644
index 0000000..1052adc
--- /dev/null
+++ b/app/react/docker/stacks/CreateView/CreateStackForm/DeploymentInfo.tsx
@@ -0,0 +1,50 @@
+import { TextTip } from '@@/Tip/TextTip';
+
+interface Props {
+  isSwarm: boolean;
+  composeSyntaxMaxVersion?: number;
+}
+
+export function DeploymentInfo({ isSwarm, composeSyntaxMaxVersion }: Props) {
+  if (isSwarm) {
+    return (
+      <div className="form-group">
+        <div className="col-sm-12">
+          <span className="text-muted small">
+            This stack will be deployed using the equivalent of the{' '}
+            <code>docker stack deploy</code> command.
+          </span>
+        </div>
+      </div>
+    );
+  }
+
+  if (composeSyntaxMaxVersion === 2) {
+    return (
+      <div className="form-group">
+        <div className="col-sm-12">
+          <div className="text-muted small mb-2">
+            This stack will be deployed using the equivalent of{' '}
+            <code>docker compose</code>. Only Compose file format version{' '}
+            <b>2</b> is supported at the moment.
+          </div>
+          <TextTip color="orange">
+            Note: Due to a limitation of libcompose, the name of the stack will
+            be standardized to remove all special characters and uppercase
+            letters.
+          </TextTip>
+        </div>
+      </div>
+    );
+  }
+
+  return (
+    <div className="form-group">
+      <div className="col-sm-12">
+        <span className="text-muted small">
+          This stack will be deployed using <code>docker compose</code>.
+        </span>
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/docker/stacks/CreateView/CreateStackForm/EditorSection/EditorSection.test.tsx b/app/react/docker/stacks/CreateView/CreateStackForm/EditorSection/EditorSection.test.tsx
new file mode 100644
index 0000000..9935359
--- /dev/null
+++ b/app/react/docker/stacks/CreateView/CreateStackForm/EditorSection/EditorSection.test.tsx
@@ -0,0 +1,68 @@
+import { render, screen } from '@testing-library/react';
+import { Formik } from 'formik';
+
+import { withTestRouter } from '@/react/test-utils/withRouter';
+
+import { mockFormValues } from '../test-utils';
+
+import { EditorFormValues } from './types';
+import { EditorSection } from './EditorSection';
+
+describe('EditorSection', () => {
+  it('should render the component', () => {
+    renderComponent();
+
+    expect(screen.getByText('Web editor')).toBeInTheDocument();
+    expect(
+      screen.getByText(/You can get more information about Compose file format/)
+    ).toBeInTheDocument();
+
+    const editor = screen.getByTestId('stack-creation-editor');
+    expect(editor).toBeInTheDocument();
+
+    const link = screen.getByRole('link', {
+      name: /official documentation/i,
+    });
+    expect(link).toHaveAttribute(
+      'href',
+      'https://docs.docker.com/compose/compose-file/'
+    );
+    expect(link).toHaveAttribute('target', '_blank');
+  });
+
+  it('should render with initial file content', () => {
+    const value = 'version: "3"\nservices:\n  web:\n    image: nginx';
+    renderComponent({
+      initialValues: {
+        fileContent: value,
+      },
+    });
+
+    const editor = screen.getByTestId('stack-creation-editor');
+    expect(editor).toBeInTheDocument();
+
+    const textarea = screen.getByRole('textbox');
+    expect(textarea).toHaveValue(value);
+  });
+});
+
+function renderComponent({
+  initialValues,
+  isSwarm = false,
+}: { initialValues?: Partial<EditorFormValues>; isSwarm?: boolean } = {}) {
+  const values = mockFormValues({
+    method: 'editor',
+    editor: {
+      fileContent: '',
+      ...initialValues,
+    },
+  });
+
+  const Wrapped = withTestRouter(EditorSection);
+
+  return render(
+    <Formik initialValues={values} onSubmit={() => {}} validateOnMount>
+      <Wrapped isSwarm={isSwarm} isSaved={false} />
+    </Formik>
+  );
+}
diff --git a/app/react/docker/stacks/CreateView/CreateStackForm/EditorSection/EditorSection.tsx b/app/react/docker/stacks/CreateView/CreateStackForm/EditorSection/EditorSection.tsx
new file mode 100644
index 0000000..74b77bc
--- /dev/null
+++ b/app/react/docker/stacks/CreateView/CreateStackForm/EditorSection/EditorSection.tsx
@@ -0,0 +1,44 @@
+import { useFormikContext } from 'formik';
+import { JSONSchema7 } from 'json-schema';
+
+import { textByType } from '@/react/common/stacks/common/form-texts';
+import { StackType } from '@/react/common/stacks/types';
+
+import { usePreventExit, WebEditorForm } from '@@/WebEditorForm';
+
+import { FormValues } from '../types';
+
+export function EditorSection({
+  schema,
+  isSwarm,
+  isSaved,
+}: {
+  isSwarm: boolean;
+  schema?: JSONSchema7;
+  isSaved: boolean;
+}) {
+  const texts =
+    textByType[isSwarm ? StackType.DockerSwarm : StackType.DockerCompose];
+  const { values, errors, setFieldValue, isSubmitting, initialValues } =
+    useFormikContext<FormValues>();
+
+  usePreventExit(
+    initialValues.editor.fileContent,
+    values.editor.fileContent,
+    !isSubmitting && !isSaved
+  );
+
+  return (
+    <WebEditorForm
+      id="stack-creation-editor"
+      value={values.editor.fileContent}
+      onChange={(value) => setFieldValue('editor.fileContent', value)}
+      schema={schema}
+      error={errors.editor?.fileContent}
+      textTip={texts.editor.placeholder}
+      data-cy="stack-creation-editor"
+    >
+      {texts.editor.description}
+    </WebEditorForm>
+  );
+}
diff --git a/app/react/docker/stacks/CreateView/CreateStackForm/EditorSection/types.ts b/app/react/docker/stacks/CreateView/CreateStackForm/EditorSection/types.ts
new file mode 100644
index 0000000..e0fe6b2
--- /dev/null
+++ b/app/react/docker/stacks/CreateView/CreateStackForm/EditorSection/types.ts
@@ -0,0 +1,3 @@
+export interface EditorFormValues {
+  fileContent: string;
+}
diff --git a/app/react/docker/stacks/CreateView/CreateStackForm/EditorSection/validation.test.ts b/app/react/docker/stacks/CreateView/CreateStackForm/EditorSection/validation.test.ts
new file mode 100644
index 0000000..8cdacfb
--- /dev/null
+++ b/app/react/docker/stacks/CreateView/CreateStackForm/EditorSection/validation.test.ts
@@ -0,0 +1,74 @@
+import { EditorFormValues } from './types';
+import { getEditorValidationSchema } from './validation';
+
+describe('Editor validation', () => {
+  const containerNames = ['existing-container-1', 'existing-container-2'];
+
+  it('should pass validation with valid editor form values', async () => {
+    const schema = getEditorValidationSchema({
+      containerNames,
+    });
+
+    const validData: EditorFormValues = {
+      fileContent: 'version: "3"\nservices:\n  web:\n    image: nginx',
+    };
+
+    await expect(schema.validate(validData)).resolves.toBeDefined();
+  });
+
+  it('should fail validation when fileContent is missing', async () => {
+    const schema = getEditorValidationSchema({
+      containerNames,
+    });
+
+    const invalidData: Partial<EditorFormValues> = {
+      fileContent: undefined,
+    };
+
+    await expect(schema.validate(invalidData)).rejects.toThrow();
+  });
+
+  it('should fail validation when fileContent is empty', async () => {
+    const schema = getEditorValidationSchema({
+      containerNames,
+    });
+
+    const invalidData: EditorFormValues = {
+      fileContent: '',
+    };
+
+    await expect(schema.validate(invalidData)).rejects.toThrow(
+      'Stack file content is required'
+    );
+  });
+
+  it('should fail validation with invalid YAML', async () => {
+    const schema = getEditorValidationSchema({
+      containerNames,
+    });
+
+    const invalidData: EditorFormValues = {
+      fileContent: 'invalid: yaml: syntax:',
+    };
+
+    await expect(schema.validate(invalidData)).rejects.toThrow();
+  });
+
+  it('should fail validation when container name conflicts with existing containers', async () => {
+    const schema = getEditorValidationSchema({
+      containerNames,
+    });
+
+    const invalidData: EditorFormValues = {
+      fileContent: `version: "3"
+services:
+  web:
+    container_name: existing-container-1
+    image: nginx`,
+    };
+
+    await expect(schema.validate(invalidData)).rejects.toThrow(
+      'already used by another container'
+    );
+  });
+});
diff --git a/app/react/docker/stacks/CreateView/CreateStackForm/EditorSection/validation.ts b/app/react/docker/stacks/CreateView/CreateStackForm/EditorSection/validation.ts
new file mode 100644
index 0000000..e08b56b
--- /dev/null
+++ b/app/react/docker/stacks/CreateView/CreateStackForm/EditorSection/validation.ts
@@ -0,0 +1,30 @@
+import { object, SchemaOf, string } from 'yup';
+
+import { validateYAML } from '@/react/docker/stacks/common/stackYamlValidation';
+
+import { EditorFormValues } from './types';
+
+export function getEditorValidationSchema({
+  containerNames = [],
+}: {
+  containerNames: Array<string> | undefined;
+}): SchemaOf<EditorFormValues> {
+  return object({
+    fileContent: string()
+      .required('Stack file content is required')
+      .min(1, 'Stack file content cannot be empty')
+      .test('valid-yaml', 'Invalid YAML', function validateYamlTest(value) {
+        if (!value) {
+          return true;
+        }
+
+        const yamlError = validateYAML(value, containerNames, []);
+
+        if (yamlError) {
+          return this.createError({ message: yamlError });
+        }
+
+        return true;
+      }),
+  });
+}
diff --git a/app/react/docker/stacks/CreateView/CreateStackForm/GitSection/GitSection.test.tsx b/app/react/docker/stacks/CreateView/CreateStackForm/GitSection/GitSection.test.tsx
new file mode 100644
index 0000000..37cf38e
--- /dev/null
+++ b/app/react/docker/stacks/CreateView/CreateStackForm/GitSection/GitSection.test.tsx
@@ -0,0 +1,87 @@
+import { render, screen } from '@testing-library/react';
+import { Formik } from 'formik';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+
+import { mockFormValues } from '../test-utils';
+
+import { GitSection } from './GitSection';
+import { GitFormValues } from './types';
+
+describe('GitSection', () => {
+  it('should render the git repository section', () => {
+    renderComponent();
+
+    expect(screen.getByText('Git repository')).toBeInTheDocument();
+  });
+
+  it('should render the source selector', () => {
+    renderComponent();
+
+    expect(screen.getByText('Source')).toBeInTheDocument();
+  });
+
+  it('should render with auto update enabled', () => {
+    renderComponent({
+      webhookId: 'webhookId',
+      initialValues: {
+        AutoUpdate: {
+          RepositoryAutomaticUpdates: true,
+          RepositoryMechanism: 'Interval' as const,
+          RepositoryFetchInterval: '5m',
+          ForcePullImage: false,
+          RepositoryAutomaticUpdatesForce: false,
+        },
+      },
+    });
+
+    expect(screen.getByText('Git repository')).toBeInTheDocument();
+  });
+
+  it('should render with docker standalone flag', () => {
+    renderComponent({ isDockerStandalone: true });
+
+    expect(screen.getByText('Git repository')).toBeInTheDocument();
+  });
+});
+
+function renderComponent({
+  webhookId = 'webhook',
+  initialValues,
+  isDockerStandalone,
+}: {
+  webhookId?: string;
+  isDockerStandalone?: boolean;
+  initialValues?: Partial<GitFormValues>;
+} = {}) {
+  const values = mockFormValues({
+    method: 'repository',
+    git: {
+      SourceId: 0,
+      RepositoryReferenceName: 'refs/heads/main',
+      ComposeFilePathInRepository: 'docker-compose.yml',
+      AdditionalFiles: [],
+      AutoUpdate: undefined,
+      SupportRelativePath: false,
+      FilesystemPath: '',
+      ...initialValues,
+    },
+  });
+
+  const Wrapped = withTestRouter(
+    withUserProvider(
+      withTestQueryProvider(() => (
+        <Formik initialValues={values} onSubmit={() => {}} validateOnMount>
+          <GitSection
+            webhookId={webhookId}
+            isDockerStandalone={isDockerStandalone}
+          />
+        </Formik>
+      ))
+    )
+  );
+
+  return render(<Wrapped />);
+}
diff --git a/app/react/docker/stacks/CreateView/CreateStackForm/GitSection/GitSection.tsx b/app/react/docker/stacks/CreateView/CreateStackForm/GitSection/GitSection.tsx
new file mode 100644
index 0000000..6d74213
--- /dev/null
+++ b/app/react/docker/stacks/CreateView/CreateStackForm/GitSection/GitSection.tsx
@@ -0,0 +1,46 @@
+import { useFormikContext } from 'formik';
+
+import { GitForm } from '@/react/portainer/gitops/GitForm';
+import { isBE } from '@/react/portainer/feature-flags/feature-flags.service';
+import { baseStackWebhookUrl } from '@/portainer/helpers/webhookHelper';
+
+import { FormValues } from '../types';
+
+import { StackRelativePathFieldset } from './StackRelativePathFieldset';
+
+interface Props {
+  isDockerStandalone?: boolean;
+  webhookId: string;
+}
+
+export function GitSection({ webhookId, isDockerStandalone = false }: Props) {
+  const { values, errors, setValues } = useFormikContext<FormValues>();
+
+  return (
+    <>
+      <GitForm
+        value={values.git}
+        onChange={(gitValues) =>
+          setValues((values) => ({
+            ...values,
+            git: {
+              ...values.git,
+              ...gitValues,
+            },
+          }))
+        }
+        environmentType="DOCKER"
+        deployMethod="compose"
+        isDockerStandalone={isDockerStandalone}
+        isAdditionalFilesFieldVisible
+        isForcePullVisible
+        errors={errors.git}
+        baseWebhookUrl={baseStackWebhookUrl()}
+        webhookId={webhookId}
+      />
+      {isBE && (
+        <StackRelativePathFieldset isDockerStandalone={isDockerStandalone} />
+      )}
+    </>
+  );
+}
diff --git a/app/react/docker/stacks/CreateView/CreateStackForm/GitSection/StackRelativePathFieldset.tsx b/app/react/docker/stacks/CreateView/CreateStackForm/GitSection/StackRelativePathFieldset.tsx
new file mode 100644
index 0000000..c18087f
--- /dev/null
+++ b/app/react/docker/stacks/CreateView/CreateStackForm/GitSection/StackRelativePathFieldset.tsx
@@ -0,0 +1,71 @@
+import { Info } from 'lucide-react';
+import { Field, useFormikContext } from 'formik';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+import { SwitchField } from '@@/form-components/SwitchField';
+import { Icon } from '@@/Icon';
+
+import { FormValues } from '../types';
+
+interface Props {
+  isDockerStandalone: boolean;
+}
+
+export function StackRelativePathFieldset({ isDockerStandalone }: Props) {
+  const { values, setFieldValue, errors } = useFormikContext<FormValues>();
+
+  const supportRelativePath = values.git.SupportRelativePath || false;
+
+  return (
+    <div className="form-group">
+      <div className="col-sm-12 mb-3">
+        <SwitchField
+          label="Enable relative path volumes"
+          checked={supportRelativePath}
+          onChange={(checked) =>
+            setFieldValue('git.SupportRelativePath', checked)
+          }
+          tooltip="Enabling this means you can specify relative path volumes in your Compose files, with Portainer pulling the content from your git repository to the environment the stack is deployed to."
+          labelClass="col-sm-3 col-lg-2"
+          data-cy="enable-relative-paths"
+        />
+      </div>
+
+      {supportRelativePath && (
+        <>
+          {!isDockerStandalone && (
+            <div className="col-sm-12">
+              <p className="small text-muted flex items-center gap-1">
+                <Icon icon={Info} className="!mr-1 text-blue-8" />
+                For relative path volumes use with Docker Swarm, you must have a
+                network filesystem which all of your nodes can access.
+              </p>
+            </div>
+          )}
+
+          <div className="col-sm-12">
+            <FormControl
+              label={
+                isDockerStandalone
+                  ? 'Local filesystem path'
+                  : 'Network filesystem path'
+              }
+              inputId="filesystem-path"
+              size="medium"
+              errors={errors.git?.FilesystemPath}
+            >
+              <Field
+                as={Input}
+                id="filesystem-path"
+                name="git.FilesystemPath"
+                placeholder="/mnt"
+                data-cy="filesystem-path"
+              />
+            </FormControl>
+          </div>
+        </>
+      )}
+    </div>
+  );
+}
diff --git a/app/react/docker/stacks/CreateView/CreateStackForm/GitSection/types.ts b/app/react/docker/stacks/CreateView/CreateStackForm/GitSection/types.ts
new file mode 100644
index 0000000..e8eaec9
--- /dev/null
+++ b/app/react/docker/stacks/CreateView/CreateStackForm/GitSection/types.ts
@@ -0,0 +1,6 @@
+import { GitFormModel } from '@/react/portainer/gitops/types';
+
+export interface GitFormValues extends GitFormModel {
+  SupportRelativePath: boolean;
+  FilesystemPath: string;
+}
diff --git a/app/react/docker/stacks/CreateView/CreateStackForm/GitSection/validation.test.ts b/app/react/docker/stacks/CreateView/CreateStackForm/GitSection/validation.test.ts
new file mode 100644
index 0000000..5700216
--- /dev/null
+++ b/app/react/docker/stacks/CreateView/CreateStackForm/GitSection/validation.test.ts
@@ -0,0 +1,31 @@
+import { GitFormValues } from './types';
+import { getGitValidationSchema } from './validation';
+
+describe('Git validation', () => {
+  it('should pass validation with valid git form values', async () => {
+    const schema = getGitValidationSchema();
+
+    const validData: GitFormValues = {
+      SourceId: 1,
+      RepositoryReferenceName: 'refs/heads/main',
+      ComposeFilePathInRepository: 'docker-compose.yml',
+      AdditionalFiles: [],
+      AutoUpdate: undefined,
+      SupportRelativePath: false,
+      FilesystemPath: '',
+    };
+
+    await expect(schema.validate(validData)).resolves.toBeDefined();
+  });
+
+  it('should fail validation when SourceId is missing', async () => {
+    const schema = getGitValidationSchema();
+
+    const invalidData = {
+      RepositoryReferenceName: 'refs/heads/main',
+      ComposeFilePathInRepository: 'docker-compose.yml',
+    };
+
+    await expect(schema.validate(invalidData)).rejects.toThrow();
+  });
+});
diff --git a/app/react/docker/stacks/CreateView/CreateStackForm/GitSection/validation.ts b/app/react/docker/stacks/CreateView/CreateStackForm/GitSection/validation.ts
new file mode 100644
index 0000000..90eecfe
--- /dev/null
+++ b/app/react/docker/stacks/CreateView/CreateStackForm/GitSection/validation.ts
@@ -0,0 +1,19 @@
+import { SchemaOf, object, boolean, string } from 'yup';
+
+import { buildGitValidationSchema } from '@/react/portainer/gitops/GitForm';
+
+import { GitFormValues } from './types';
+
+export function getGitValidationSchema(): SchemaOf<GitFormValues> {
+  return buildGitValidationSchema('compose').concat(
+    object({
+      SupportRelativePath: boolean().default(false),
+      FilesystemPath: string()
+        .default('')
+        .when('SupportRelativePath', {
+          is: true,
+          then: string().required('Filesystem path is required'),
+        }),
+    })
+  );
+}
diff --git a/app/react/docker/stacks/CreateView/CreateStackForm/TemplateSection/TemplateSection.test.tsx b/app/react/docker/stacks/CreateView/CreateStackForm/TemplateSection/TemplateSection.test.tsx
new file mode 100644
index 0000000..73bb01b
--- /dev/null
+++ b/app/react/docker/stacks/CreateView/CreateStackForm/TemplateSection/TemplateSection.test.tsx
@@ -0,0 +1,117 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import { Formik } from 'formik';
+import { HttpResponse } from 'msw';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { http, server } from '@/setup-tests/server';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+
+import { mockFormValues } from '../test-utils';
+
+import { TemplateSection } from './TemplateSection';
+import { TemplateFormValues } from './types';
+
+beforeEach(() => {
+  server.use(
+    http.get('/api/custom_templates', () =>
+      HttpResponse.json([
+        {
+          Id: 1,
+          Title: 'Test Template',
+          Description: 'A test template',
+          Note: 'This is a test note',
+          Variables: [
+            {
+              name: 'VAR1',
+              label: 'Variable 1',
+              description: 'First variable',
+              default: 'default1',
+            },
+          ],
+        },
+        {
+          Id: 2,
+          Title: 'Another Template',
+          Description: 'Another test template',
+          Note: '',
+          Variables: [],
+        },
+      ])
+    ),
+    http.get('/api/custom_templates/:id', () => HttpResponse.json({})),
+    http.get('/api/custom_templates/:id/file', () =>
+      HttpResponse.json({
+        FileContent: 'version: "3"\nservices:\n  web:\n    image: nginx',
+      })
+    )
+  );
+});
+
+describe('TemplateSection', () => {
+  it('should render the template section', async () => {
+    server.use(http.get('/api/custom_templates', () => HttpResponse.json([])));
+    renderComponent();
+
+    await waitFor(() => {
+      expect(
+        screen.getByText(/No custom templates are available/)
+      ).toBeInTheDocument();
+    });
+  });
+
+  it('should render template selector', async () => {
+    renderComponent();
+
+    await waitFor(() => {
+      expect(screen.getByText(/Select a custom template/)).toBeInTheDocument();
+    });
+  });
+
+  it('should show loading indicator when loading template', async () => {
+    server.use(
+      http.get('/api/custom_templates/:id', async () => {
+        await new Promise(() => {});
+        return HttpResponse.json({});
+      })
+    );
+    renderComponent({
+      initialValues: {
+        selectedId: 1,
+        variables: [],
+        fileContent: '',
+      },
+    });
+
+    await waitFor(() => {
+      expect(screen.getByText('Loading template...')).toBeInTheDocument();
+    });
+  });
+});
+
+function renderComponent({
+  initialValues = {},
+  isSwarm = false,
+}: { initialValues?: Partial<TemplateFormValues>; isSwarm?: boolean } = {}) {
+  const values = mockFormValues({
+    method: 'template',
+    template: {
+      selectedId: undefined,
+      variables: [],
+      fileContent: '',
+      ...initialValues,
+    },
+  });
+
+  const Wrapped = withTestRouter(
+    withUserProvider(
+      withTestQueryProvider(() => (
+        <Formik initialValues={values} onSubmit={() => {}} validateOnMount>
+          <TemplateSection isSwarm={isSwarm} isSaved={false} />
+        </Formik>
+      ))
+    )
+  );
+
+  return render(<Wrapped />);
+}
diff --git a/app/react/docker/stacks/CreateView/CreateStackForm/TemplateSection/TemplateSection.tsx b/app/react/docker/stacks/CreateView/CreateStackForm/TemplateSection/TemplateSection.tsx
new file mode 100644
index 0000000..78ea8c3
--- /dev/null
+++ b/app/react/docker/stacks/CreateView/CreateStackForm/TemplateSection/TemplateSection.tsx
@@ -0,0 +1,170 @@
+import { useCallback } from 'react';
+import { useFormikContext } from 'formik';
+import { JSONSchema7 } from 'json-schema';
+
+import { CustomTemplatesVariablesField } from '@/react/portainer/custom-templates/components/CustomTemplatesVariablesField';
+import {
+  isTemplateVariablesEnabled,
+  renderTemplate,
+} from '@/react/portainer/custom-templates/components/utils';
+import { TemplateNote } from '@/react/portainer/templates/components/TemplateNote';
+import { useCustomTemplateFile } from '@/react/portainer/templates/custom-templates/queries/useCustomTemplateFile';
+import { CustomTemplate } from '@/react/portainer/templates/custom-templates/types';
+import { useCurrentUser } from '@/react/hooks/useUser';
+import { textByType } from '@/react/common/stacks/common/form-texts';
+import { StackType } from '@/react/common/stacks/types';
+import { useCustomTemplate } from '@/react/portainer/templates/custom-templates/queries/useCustomTemplate';
+
+import { CustomTemplateSelector } from '@@/CustomTemplateSelector';
+import { FormSection } from '@@/form-components/FormSection';
+import { InlineLoader } from '@@/InlineLoader';
+import { Link } from '@@/Link';
+import { TextTip } from '@@/Tip/TextTip';
+import { usePreventExit, WebEditorForm } from '@@/WebEditorForm';
+
+import { FormValues } from '../types';
+
+import { useTemplateInitialization } from './useTemplateInitialization';
+
+export function TemplateSection({
+  isSwarm,
+  schema,
+  isSaved,
+}: {
+  isSwarm: boolean;
+  schema?: JSONSchema7;
+  isSaved: boolean;
+}) {
+  const texts =
+    textByType[isSwarm ? StackType.DockerSwarm : StackType.DockerCompose];
+  const { values, errors, setFieldValue, isSubmitting } =
+    useFormikContext<FormValues>();
+
+  const { user, isPureAdmin } = useCurrentUser();
+
+  const templateQuery = useCustomTemplate(values.template.selectedId);
+
+  const selectedTemplate = templateQuery.data;
+
+  const templateFileQuery = useCustomTemplateFile(
+    values.template.selectedId,
+    !!selectedTemplate?.GitConfig
+  );
+
+  const templateFile = templateFileQuery.data || '';
+
+  usePreventExit(
+    templateFile,
+    values.template.fileContent,
+    !isSubmitting && !isSaved
+  );
+
+  const isAdminOrEditor =
+    isPureAdmin || user.Id === selectedTemplate?.CreatedByUserId;
+
+  const handleVariablesChange = useCallback(
+    (newVariables: Array<{ key: string; value?: string }>) => {
+      setFieldValue('template.variables', newVariables);
+      if (selectedTemplate && templateFile) {
+        const rendered = renderTemplate(
+          templateFile,
+          newVariables,
+          selectedTemplate.Variables
+        );
+        setFieldValue('template.fileContent', rendered);
+      }
+    },
+    [selectedTemplate, setFieldValue, templateFile]
+  );
+
+  const handleFileContentChange = useCallback(
+    (value: string) => {
+      setFieldValue('template.fileContent', value);
+    },
+    [setFieldValue]
+  );
+
+  useTemplateInitialization({
+    selectedTemplate,
+    templateFile,
+    onVariablesChange: handleVariablesChange,
+    onFileContentChange: handleFileContentChange,
+  });
+
+  function handleTemplateChange(templateId: CustomTemplate['Id'] | undefined) {
+    setFieldValue('template.selectedId', templateId);
+    if (templateId) {
+      setFieldValue('template.variables', []);
+      setFieldValue('template.fileContent', '');
+    }
+  }
+
+  return (
+    <>
+      <FormSection title="Template">
+        <CustomTemplateSelector
+          value={values.template.selectedId}
+          onChange={handleTemplateChange}
+          error={errors.template?.selectedId}
+        />
+
+        {!!values.template.selectedId && templateFileQuery.isLoading && (
+          <InlineLoader>Loading template...</InlineLoader>
+        )}
+      </FormSection>
+
+      {selectedTemplate && (
+        <>
+          <TemplateNote note={selectedTemplate.Note} />
+
+          {isTemplateVariablesEnabled && (
+            <CustomTemplatesVariablesField
+              definitions={selectedTemplate.Variables}
+              onChange={handleVariablesChange}
+              value={values.template.variables}
+              errors={errors.template?.variables}
+            />
+          )}
+
+          {templateFileQuery.isError && (
+            <TextTip color="orange">
+              {isAdminOrEditor ? (
+                <>
+                  Custom template could not be loaded, please{' '}
+                  <Link
+                    to="kubernetes.templates.custom.edit"
+                    params={{ id: selectedTemplate.Id }}
+                    data-cy="template-error-edit-link"
+                  >
+                    click here
+                  </Link>{' '}
+                  for configuration.
+                </>
+              ) : (
+                <>
+                  Custom template could not be loaded, please contact your
+                  administrator.
+                </>
+              )}
+            </TextTip>
+          )}
+
+          {values.template.fileContent && (
+            <WebEditorForm
+              id="stack-creation-editor"
+              type="yaml"
+              value={values.template.fileContent}
+              textTip={texts.editor.placeholder}
+              readonly={!!selectedTemplate.GitConfig}
+              data-cy="stack-creation-editor"
+              schema={schema}
+              onChange={handleFileContentChange}
+            >
+              {texts.editor.description}
+            </WebEditorForm>
+          )}
+        </>
+      )}
+    </>
+  );
+}
diff --git a/app/react/docker/stacks/CreateView/CreateStackForm/TemplateSection/types.ts b/app/react/docker/stacks/CreateView/CreateStackForm/TemplateSection/types.ts
new file mode 100644
index 0000000..ebdad9a
--- /dev/null
+++ b/app/react/docker/stacks/CreateView/CreateStackForm/TemplateSection/types.ts
@@ -0,0 +1,5 @@
+export interface TemplateFormValues {
+  selectedId: number | undefined;
+  variables: Array<{ key: string; value: string }>;
+  fileContent: string;
+}
diff --git a/app/react/docker/stacks/CreateView/CreateStackForm/TemplateSection/useTemplateInitialization.test.ts b/app/react/docker/stacks/CreateView/CreateStackForm/TemplateSection/useTemplateInitialization.test.ts
new file mode 100644
index 0000000..cbcf2f3
--- /dev/null
+++ b/app/react/docker/stacks/CreateView/CreateStackForm/TemplateSection/useTemplateInitialization.test.ts
@@ -0,0 +1,229 @@
+import { renderHook } from '@testing-library/react-hooks';
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+import { CustomTemplate } from '@/react/portainer/templates/custom-templates/types';
+import { Platform } from '@/react/portainer/templates/types';
+import { StackType } from '@/react/common/stacks/types';
+
+import { useTemplateInitialization } from './useTemplateInitialization';
+
+describe('useTemplateInitialization', () => {
+  const mockOnVariablesChange = vi.fn();
+  const mockOnFileContentChange = vi.fn();
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('should not initialize when templateFile is empty', () => {
+    renderHook(() =>
+      useTemplateInitialization({
+        selectedTemplate: createMockCustomTemplate(),
+        templateFile: '',
+        onVariablesChange: mockOnVariablesChange,
+        onFileContentChange: mockOnFileContentChange,
+      })
+    );
+
+    expect(mockOnVariablesChange).not.toHaveBeenCalled();
+    expect(mockOnFileContentChange).not.toHaveBeenCalled();
+  });
+
+  it('should not initialize when selectedTemplate is undefined', () => {
+    renderHook(() =>
+      useTemplateInitialization({
+        selectedTemplate: undefined,
+        templateFile: 'version: "3"\nservices:\n  web:\n    image: nginx',
+        onVariablesChange: mockOnVariablesChange,
+        onFileContentChange: mockOnFileContentChange,
+      })
+    );
+
+    expect(mockOnVariablesChange).not.toHaveBeenCalled();
+    expect(mockOnFileContentChange).not.toHaveBeenCalled();
+  });
+
+  it('should set file content directly when template has no variables', () => {
+    const fileContent = 'version: "3"\nservices:\n  web:\n    image: nginx';
+
+    renderHook(() =>
+      useTemplateInitialization({
+        selectedTemplate: createMockCustomTemplate({ Variables: [] }),
+        templateFile: fileContent,
+        onVariablesChange: mockOnVariablesChange,
+        onFileContentChange: mockOnFileContentChange,
+      })
+    );
+
+    expect(mockOnFileContentChange).toHaveBeenCalledWith(fileContent);
+    expect(mockOnVariablesChange).toHaveBeenCalledWith([]);
+  });
+
+  it('should initialize variables with defaults when template has variables', () => {
+    const fileContent =
+      'version: "3"\nservices:\n  web:\n    image: {{ IMAGE_NAME }}\n    ports:\n      - {{ PORT }}:80';
+
+    renderHook(() =>
+      useTemplateInitialization({
+        selectedTemplate: createMockCustomTemplate({
+          Variables: [
+            {
+              name: 'IMAGE_NAME',
+              label: 'Image Name',
+              defaultValue: 'nginx',
+              description: 'Docker image name',
+            },
+            {
+              name: 'PORT',
+              label: 'Port',
+              defaultValue: '80',
+              description: 'Exposed port',
+            },
+          ],
+        }),
+        templateFile: fileContent,
+        onVariablesChange: mockOnVariablesChange,
+        onFileContentChange: mockOnFileContentChange,
+      })
+    );
+
+    expect(mockOnVariablesChange).toHaveBeenCalledWith([
+      { key: 'IMAGE_NAME', value: 'nginx' },
+      { key: 'PORT', value: '80' },
+    ]);
+    expect(mockOnFileContentChange).not.toHaveBeenCalled();
+  });
+
+  it('should only initialize once per template', () => {
+    const template = createMockCustomTemplate();
+    const fileContent = 'version: "3"\nservices:\n  web:\n    image: nginx';
+
+    const { rerender } = renderHook(
+      ({ selectedTemplate, templateFile }) =>
+        useTemplateInitialization({
+          selectedTemplate,
+          templateFile,
+          onVariablesChange: mockOnVariablesChange,
+          onFileContentChange: mockOnFileContentChange,
+        }),
+      {
+        initialProps: { selectedTemplate: template, templateFile: fileContent },
+      }
+    );
+
+    expect(mockOnFileContentChange).toHaveBeenCalledTimes(1);
+    expect(mockOnVariablesChange).toHaveBeenCalledTimes(1);
+
+    mockOnFileContentChange.mockClear();
+    mockOnVariablesChange.mockClear();
+
+    rerender({ selectedTemplate: template, templateFile: fileContent });
+
+    expect(mockOnFileContentChange).not.toHaveBeenCalled();
+    expect(mockOnVariablesChange).not.toHaveBeenCalled();
+  });
+
+  it('should reinitialize when template changes', () => {
+    const template1 = createMockCustomTemplate({
+      Id: 1,
+      Title: 'Template 1',
+      Variables: [],
+    });
+    const template2 = createMockCustomTemplate({
+      Id: 2,
+      Title: 'Template 2',
+      Variables: [],
+    });
+    const fileContent1 = 'version: "3"\nservices:\n  web:\n    image: nginx';
+    const fileContent2 = 'version: "3"\nservices:\n  app:\n    image: postgres';
+
+    const { rerender } = renderHook(
+      ({ selectedTemplate, templateFile }) =>
+        useTemplateInitialization({
+          selectedTemplate,
+          templateFile,
+          onVariablesChange: mockOnVariablesChange,
+          onFileContentChange: mockOnFileContentChange,
+        }),
+      {
+        initialProps: {
+          selectedTemplate: template1,
+          templateFile: fileContent1,
+        },
+      }
+    );
+
+    expect(mockOnFileContentChange).toHaveBeenCalledWith(fileContent1);
+    expect(mockOnFileContentChange).toHaveBeenCalledTimes(1);
+
+    mockOnFileContentChange.mockClear();
+    mockOnVariablesChange.mockClear();
+
+    rerender({ selectedTemplate: template2, templateFile: fileContent2 });
+
+    expect(mockOnFileContentChange).toHaveBeenCalledWith(fileContent2);
+    expect(mockOnFileContentChange).toHaveBeenCalledTimes(1);
+  });
+
+  it('should handle template with undefined Variables property', () => {
+    const template = createMockCustomTemplate({
+      Id: 1,
+      Title: 'Test Template',
+      Variables: undefined,
+    });
+    const fileContent = 'version: "3"\nservices:\n  web:\n    image: nginx';
+
+    renderHook(() =>
+      useTemplateInitialization({
+        selectedTemplate: template,
+        templateFile: fileContent,
+        onVariablesChange: mockOnVariablesChange,
+        onFileContentChange: mockOnFileContentChange,
+      })
+    );
+
+    expect(mockOnFileContentChange).toHaveBeenCalledWith(fileContent);
+    expect(mockOnVariablesChange).toHaveBeenCalledWith([]);
+  });
+
+  it('should handle template with empty Variables array', () => {
+    const fileContent = 'version: "3"\nservices:\n  web:\n    image: nginx';
+
+    renderHook(() =>
+      useTemplateInitialization({
+        selectedTemplate: createMockCustomTemplate({
+          Id: 1,
+          Title: 'Test Template',
+          Variables: [],
+        }),
+        templateFile: fileContent,
+        onVariablesChange: mockOnVariablesChange,
+        onFileContentChange: mockOnFileContentChange,
+      })
+    );
+
+    expect(mockOnFileContentChange).toHaveBeenCalledWith(fileContent);
+    expect(mockOnVariablesChange).toHaveBeenCalledWith([]);
+  });
+});
+
+function createMockCustomTemplate(
+  overrides: Partial<CustomTemplate> = {}
+): CustomTemplate {
+  return {
+    Id: 1,
+    Title: 'Test Template',
+    Variables: [],
+    CreatedByUserId: 5,
+    Description: '',
+    ProjectPath: '',
+    EdgeTemplate: false,
+    EntryPoint: '',
+    Note: '',
+    Platform: Platform.LINUX,
+    Logo: '',
+    Type: StackType.DockerCompose,
+    IsComposeFormat: true,
+    ...overrides,
+  };
+}
diff --git a/app/react/docker/stacks/CreateView/CreateStackForm/TemplateSection/useTemplateInitialization.ts b/app/react/docker/stacks/CreateView/CreateStackForm/TemplateSection/useTemplateInitialization.ts
new file mode 100644
index 0000000..9573e8b
--- /dev/null
+++ b/app/react/docker/stacks/CreateView/CreateStackForm/TemplateSection/useTemplateInitialization.ts
@@ -0,0 +1,42 @@
+import { useEffect, useRef } from 'react';
+
+import {
+  getVariablesFieldDefaultValues,
+  VariablesFieldValue,
+} from '@/react/portainer/custom-templates/components/CustomTemplatesVariablesField';
+import { CustomTemplate } from '@/react/portainer/templates/custom-templates/types';
+
+export function useTemplateInitialization({
+  selectedTemplate,
+  templateFile,
+  onVariablesChange,
+  onFileContentChange,
+}: {
+  selectedTemplate: CustomTemplate | undefined;
+  templateFile: string;
+  onVariablesChange(values: VariablesFieldValue): void;
+  onFileContentChange(value: string): void;
+}) {
+  const lastInitializedTemplateId = useRef<number | null>(null);
+
+  useEffect(() => {
+    if (!templateFile || !selectedTemplate) {
+      return;
+    }
+
+    if (lastInitializedTemplateId.current === selectedTemplate.Id) {
+      return;
+    }
+
+    lastInitializedTemplateId.current = selectedTemplate.Id;
+
+    if (!selectedTemplate.Variables?.length) {
+      onFileContentChange(templateFile);
+    }
+
+    const defaultVariables = getVariablesFieldDefaultValues(
+      selectedTemplate.Variables
+    );
+    onVariablesChange(defaultVariables);
+  }, [templateFile, selectedTemplate, onVariablesChange, onFileContentChange]);
+}
diff --git a/app/react/docker/stacks/CreateView/CreateStackForm/TemplateSection/validation.test.ts b/app/react/docker/stacks/CreateView/CreateStackForm/TemplateSection/validation.test.ts
new file mode 100644
index 0000000..a211080
--- /dev/null
+++ b/app/react/docker/stacks/CreateView/CreateStackForm/TemplateSection/validation.test.ts
@@ -0,0 +1,49 @@
+import { TemplateFormValues } from './types';
+import { getTemplateValidationSchema } from './validation';
+
+describe('Template validation', () => {
+  const containerNames = ['existing-container-1', 'existing-container-2'];
+  it('should pass validation with valid template form values', async () => {
+    const schema = getTemplateValidationSchema({
+      containerNames,
+    });
+
+    const validData: TemplateFormValues = {
+      selectedId: 1,
+      variables: [],
+      fileContent: 'version: "3"\nservices:\n  web:\n    image: nginx',
+    };
+
+    await expect(schema.validate(validData)).resolves.toBeDefined();
+  });
+
+  it('should fail validation when template ID is undefined', async () => {
+    const schema = getTemplateValidationSchema({
+      containerNames,
+    });
+
+    const invalidData: Partial<TemplateFormValues> = {
+      selectedId: undefined,
+      variables: [],
+      fileContent: 'version: "3"\nservices:\n  web:\n    image: nginx',
+    };
+
+    await expect(schema.validate(invalidData)).rejects.toThrow(
+      'Template is required'
+    );
+  });
+
+  it('should validate rendered template content YAML', async () => {
+    const schema = getTemplateValidationSchema({
+      containerNames,
+    });
+
+    const invalidData: TemplateFormValues = {
+      selectedId: 1,
+      variables: [],
+      fileContent: 'invalid: yaml: syntax:',
+    };
+
+    await expect(schema.validate(invalidData)).rejects.toThrow();
+  });
+});
diff --git a/app/react/docker/stacks/CreateView/CreateStackForm/TemplateSection/validation.ts b/app/react/docker/stacks/CreateView/CreateStackForm/TemplateSection/validation.ts
new file mode 100644
index 0000000..0d878f2
--- /dev/null
+++ b/app/react/docker/stacks/CreateView/CreateStackForm/TemplateSection/validation.ts
@@ -0,0 +1,36 @@
+import { SchemaOf, object, number, array, string } from 'yup';
+
+import { validateYAML } from '@/react/docker/stacks/common/stackYamlValidation';
+
+import { TemplateFormValues } from './types';
+
+export function getTemplateValidationSchema({
+  containerNames = [],
+}: {
+  containerNames: Array<string> | undefined;
+}): SchemaOf<TemplateFormValues> {
+  return object({
+    selectedId: number().required('Template is required'),
+    variables: array(
+      object({
+        key: string().required(),
+        value: string().required(),
+      })
+    ).default([]),
+    fileContent: string()
+      .required('Template content is required')
+      .test('valid-yaml', 'Invalid YAML', function validateYamlTest(value) {
+        if (!value) {
+          return true;
+        }
+
+        const yamlError = validateYAML(value, containerNames, []);
+
+        if (yamlError) {
+          return this.createError({ message: yamlError });
+        }
+
+        return true;
+      }),
+  });
+}
diff --git a/app/react/docker/stacks/CreateView/CreateStackForm/UploadSection/UploadSection.test.tsx b/app/react/docker/stacks/CreateView/CreateStackForm/UploadSection/UploadSection.test.tsx
new file mode 100644
index 0000000..f55b6bf
--- /dev/null
+++ b/app/react/docker/stacks/CreateView/CreateStackForm/UploadSection/UploadSection.test.tsx
@@ -0,0 +1,51 @@
+import { render, screen } from '@testing-library/react';
+import { Formik } from 'formik';
+
+import { mockFormValues } from '../test-utils';
+
+import { UploadSection } from './UploadSection';
+import { UploadFormValues } from './types';
+
+describe('UploadSection', () => {
+  it('should render the upload section', () => {
+    renderComponent();
+
+    expect(screen.getByText('Upload')).toBeInTheDocument();
+    expect(
+      screen.getByText(/You can upload a Compose file from your computer/)
+    ).toBeInTheDocument();
+  });
+
+  it('should render with uploaded file', () => {
+    const fileName = 'docker-compose.yml';
+    const file = new File(['test content'], fileName, {
+      type: 'text/yaml',
+    });
+
+    renderComponent({ initialValues: { file } });
+
+    expect(screen.getByText(fileName)).toBeInTheDocument();
+  });
+});
+
+function renderComponent({
+  initialValues = {},
+  isSwarm = false,
+}: {
+  initialValues?: Partial<UploadFormValues>;
+  isSwarm?: boolean;
+} = {}) {
+  const values = mockFormValues({
+    method: 'upload',
+    upload: {
+      file: null,
+      ...initialValues,
+    },
+  });
+
+  return render(
+    <Formik initialValues={values} onSubmit={() => {}} validateOnMount>
+      <UploadSection isSwarm={isSwarm} />
+    </Formik>
+  );
+}
diff --git a/app/react/docker/stacks/CreateView/CreateStackForm/UploadSection/UploadSection.tsx b/app/react/docker/stacks/CreateView/CreateStackForm/UploadSection/UploadSection.tsx
new file mode 100644
index 0000000..d8b02cd
--- /dev/null
+++ b/app/react/docker/stacks/CreateView/CreateStackForm/UploadSection/UploadSection.tsx
@@ -0,0 +1,25 @@
+import { useFormikContext } from 'formik';
+
+import { textByType } from '@/react/common/stacks/common/form-texts';
+import { StackType } from '@/react/common/stacks/types';
+
+import { FileUploadForm } from '@@/form-components/FileUpload';
+
+import { FormValues } from '../types';
+
+export function UploadSection({ isSwarm }: { isSwarm: boolean }) {
+  const texts =
+    textByType[isSwarm ? StackType.DockerSwarm : StackType.DockerCompose];
+  const { values, errors, setFieldValue } = useFormikContext<FormValues>();
+
+  return (
+    <FileUploadForm
+      value={values.upload.file || undefined}
+      onChange={(file) => setFieldValue('upload.file', file)}
+      required
+      description={texts.upload}
+      data-cy="stack-creation-file-upload"
+      error={errors.upload?.file}
+    />
+  );
+}
diff --git a/app/react/docker/stacks/CreateView/CreateStackForm/UploadSection/types.ts b/app/react/docker/stacks/CreateView/CreateStackForm/UploadSection/types.ts
new file mode 100644
index 0000000..511bb4d
--- /dev/null
+++ b/app/react/docker/stacks/CreateView/CreateStackForm/UploadSection/types.ts
@@ -0,0 +1,3 @@
+export interface UploadFormValues {
+  file: File | null;
+}
diff --git a/app/react/docker/stacks/CreateView/CreateStackForm/UploadSection/validation.test.ts b/app/react/docker/stacks/CreateView/CreateStackForm/UploadSection/validation.test.ts
new file mode 100644
index 0000000..99ec2fb
--- /dev/null
+++ b/app/react/docker/stacks/CreateView/CreateStackForm/UploadSection/validation.test.ts
@@ -0,0 +1,100 @@
+import { UploadFormValues } from './types';
+import { getUploadValidationSchema } from './validation';
+
+function createMockFile(content: string, filename: string): File {
+  const blob = new Blob([content], { type: 'application/x-yaml' });
+  const file = new File([blob], filename, { type: 'application/x-yaml' });
+
+  // Add text() method if not available (for jsdom environment)
+  if (!file.text) {
+    Object.defineProperty(file, 'text', {
+      value: () => Promise.resolve(content),
+    });
+  }
+
+  return file;
+}
+
+describe('Upload validation', () => {
+  const containerNames = ['existing-container-1', 'existing-container-2'];
+  it('should pass validation with valid upload form values', async () => {
+    const schema = getUploadValidationSchema({
+      containerNames,
+    });
+
+    const validData: UploadFormValues = {
+      file: createMockFile(
+        'version: "3"\nservices:\n  web:\n    image: nginx',
+        'test.yml'
+      ),
+    };
+
+    await expect(schema.validate(validData)).resolves.toBeDefined();
+  });
+
+  it('should fail validation when file is null', async () => {
+    const schema = getUploadValidationSchema({
+      containerNames,
+    });
+
+    const invalidData: UploadFormValues = {
+      file: null,
+    };
+
+    await expect(schema.validate(invalidData)).rejects.toThrow(
+      'Stack file is required'
+    );
+  });
+
+  it('should fail validation with invalid YAML in uploaded file', async () => {
+    const schema = getUploadValidationSchema({
+      containerNames,
+    });
+
+    const invalidData: UploadFormValues = {
+      file: createMockFile('invalid: yaml: syntax:', 'test.yml'),
+    };
+
+    await expect(schema.validate(invalidData)).rejects.toThrow();
+  });
+
+  it('should fail validation when uploaded file contains container name conflicts', async () => {
+    const schema = getUploadValidationSchema({
+      containerNames,
+    });
+
+    const invalidData: UploadFormValues = {
+      file: createMockFile(
+        `version: "3"
+services:
+  web:
+    container_name: existing-container-1
+    image: nginx`,
+        'test.yml'
+      ),
+    };
+
+    await expect(schema.validate(invalidData)).rejects.toThrow(
+      'already used by another container'
+    );
+  });
+
+  it('should fail validation when file cannot be read', async () => {
+    const schema = getUploadValidationSchema({
+      containerNames,
+    });
+
+    // Create a mock file that throws an error when text() is called
+    const mockFile = {
+      text: () => Promise.reject(new Error('Read error')),
+    } as File;
+
+    const invalidData: UploadFormValues = {
+      file: mockFile,
+    };
+
+    await expect(schema.validate(invalidData)).rejects.toThrow(
+      'Unable to read file'
+    );
+  });
+});
diff --git a/app/react/docker/stacks/CreateView/CreateStackForm/UploadSection/validation.ts b/app/react/docker/stacks/CreateView/CreateStackForm/UploadSection/validation.ts
new file mode 100644
index 0000000..d67a74f
--- /dev/null
+++ b/app/react/docker/stacks/CreateView/CreateStackForm/UploadSection/validation.ts
@@ -0,0 +1,40 @@
+import { SchemaOf, object, mixed } from 'yup';
+
+import { validateYAML } from '@/react/docker/stacks/common/stackYamlValidation';
+
+import { UploadFormValues } from './types';
+
+export function getUploadValidationSchema({
+  containerNames = [],
+}: {
+  containerNames: Array<string> | undefined;
+}): SchemaOf<UploadFormValues> {
+  return object({
+    file: mixed<File>()
+      .required('Stack file is required')
+      .test(
+        'valid-yaml',
+        'Invalid YAML',
+        async function validateYamlTest(value) {
+          if (!value) {
+            return true;
+          }
+
+          let fileContent: string;
+          try {
+            fileContent = await value.text();
+          } catch {
+            return this.createError({ message: 'Unable to read file' });
+          }
+
+          const yamlError = validateYAML(fileContent, containerNames, []);
+
+          if (yamlError) {
+            return this.createError({ message: yamlError });
+          }
+
+          return true;
+        }
+      ),
+  });
+}
diff --git a/app/react/docker/stacks/CreateView/CreateStackForm/test-utils.ts b/app/react/docker/stacks/CreateView/CreateStackForm/test-utils.ts
new file mode 100644
index 0000000..e08eb89
--- /dev/null
+++ b/app/react/docker/stacks/CreateView/CreateStackForm/test-utils.ts
@@ -0,0 +1,40 @@
+import _ from 'lodash';
+
+import { defaultValues } from '@/react/portainer/access-control/utils';
+import { DeepPartial } from '@/types';
+
+import { FormValues } from './types';
+
+export function mockFormValues(overrides: DeepPartial<FormValues>): FormValues {
+  return _.merge(
+    {
+      method: 'editor',
+      name: 'test-stack',
+      env: [],
+      accessControl: defaultValues(false, 1),
+      enableWebhook: false,
+      registries: [],
+      editor: {
+        fileContent: '',
+      },
+      upload: {
+        file: null,
+      },
+      git: {
+        SourceId: 0,
+        RepositoryReferenceName: '',
+        ComposeFilePathInRepository: '',
+        AdditionalFiles: [],
+        AutoUpdate: undefined,
+        SupportRelativePath: false,
+        FilesystemPath: '',
+      },
+      template: {
+        selectedId: undefined,
+        variables: [],
+        fileContent: '',
+      },
+    },
+    overrides
+  );
+}
diff --git a/app/react/docker/stacks/CreateView/CreateStackForm/types.ts b/app/react/docker/stacks/CreateView/CreateStackForm/types.ts
new file mode 100644
index 0000000..eeeffe0
--- /dev/null
+++ b/app/react/docker/stacks/CreateView/CreateStackForm/types.ts
@@ -0,0 +1,27 @@
+import { RegistryId } from '@/react/portainer/registries/types/registry';
+import { AccessControlFormData } from '@/react/portainer/access-control/types';
+
+import { EnvVarValues } from '@@/form-components/EnvironmentVariablesFieldset';
+
+import { EditorFormValues } from './EditorSection/types';
+import { GitFormValues } from './GitSection/types';
+import { TemplateFormValues } from './TemplateSection/types';
+import { UploadFormValues } from './UploadSection/types';
+
+export type BuildMethod = 'editor' | 'upload' | 'repository' | 'template';
+
+export interface BaseFormValues {
+  method: BuildMethod;
+  name: string;
+  env: EnvVarValues;
+  accessControl: AccessControlFormData;
+  enableWebhook: boolean;
+  registries: Array<RegistryId>;
+}
+
+export interface FormValues extends BaseFormValues {
+  editor: EditorFormValues;
+  upload: UploadFormValues;
+  git: GitFormValues;
+  template: TemplateFormValues;
+}
diff --git a/app/react/docker/stacks/CreateView/CreateStackForm/useValidationSchema.ts b/app/react/docker/stacks/CreateView/CreateStackForm/useValidationSchema.ts
new file mode 100644
index 0000000..f6b2ba1
--- /dev/null
+++ b/app/react/docker/stacks/CreateView/CreateStackForm/useValidationSchema.ts
@@ -0,0 +1,33 @@
+import { useMemo } from 'react';
+import _ from 'lodash';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { useStacks } from '@/react/common/stacks/queries/useStacks';
+import { useContainers } from '@/react/docker/containers/queries/useContainers';
+import { useIsEdgeAdmin } from '@/react/hooks/useUser';
+
+import { getValidationSchema } from './validation';
+
+export function useValidationSchema(environmentId: EnvironmentId) {
+  const { isAdmin } = useIsEdgeAdmin();
+
+  const stacksQuery = useStacks();
+  const containersQuery = useContainers(environmentId, {
+    select: (containers) =>
+      containers.flatMap((c) => c.Names).map((name) => _.trimStart(name, '/')),
+  });
+
+  const containerNames = containersQuery.data;
+  const stacks = stacksQuery.data;
+
+  return useMemo(
+    () =>
+      getValidationSchema({
+        isAdmin,
+        environmentId,
+        stacks,
+        containerNames,
+      }),
+    [isAdmin, environmentId, stacks, containerNames]
+  );
+}
diff --git a/app/react/docker/stacks/CreateView/CreateStackForm/validation.test.ts b/app/react/docker/stacks/CreateView/CreateStackForm/validation.test.ts
new file mode 100644
index 0000000..9620594
--- /dev/null
+++ b/app/react/docker/stacks/CreateView/CreateStackForm/validation.test.ts
@@ -0,0 +1,70 @@
+import { defaultValues as acDefaultValues } from '@/react/portainer/access-control/utils';
+
+import { FormValues } from './types';
+import { getValidationSchema } from './validation';
+
+describe('CreateStackForm validation schemas', () => {
+  const containerNames = ['existing-container-1', 'existing-container-2'];
+  const environmentId = 1;
+  const isAdmin = true;
+
+  it('should fail when method is upload but upload section is missing', async () => {
+    const schema = getValidationSchema({
+      isAdmin,
+      environmentId,
+      containerNames,
+    });
+
+    const invalidData: Partial<FormValues> = {
+      method: 'upload',
+      name: 'test-stack',
+      env: [],
+      accessControl: acDefaultValues(false, 1),
+      enableWebhook: false,
+      registries: [],
+      upload: undefined,
+    };
+
+    await expect(schema.validate(invalidData)).rejects.toThrow();
+  });
+
+  it('should fail when method is editor but editor section is missing', async () => {
+    const schema = getValidationSchema({
+      isAdmin,
+      environmentId,
+      containerNames,
+    });
+
+    const invalidData: Partial<FormValues> = {
+      method: 'editor',
+      name: 'test-stack',
+      env: [],
+      accessControl: acDefaultValues(false, 1),
+      enableWebhook: false,
+      registries: [],
+      editor: undefined,
+    };
+
+    await expect(schema.validate(invalidData)).rejects.toThrow();
+  });
+
+  it('should fail when method is repository but git section is missing', async () => {
+    const schema = getValidationSchema({
+      isAdmin,
+      environmentId,
+      containerNames,
+    });
+
+    const invalidData: Partial<FormValues> = {
+      method: 'repository',
+      name: 'test-stack',
+      env: [],
+      accessControl: acDefaultValues(false, 1),
+      enableWebhook: false,
+      registries: [],
+      git: undefined,
+    };
+
+    await expect(schema.validate(invalidData)).rejects.toThrow();
+  });
+});
diff --git a/app/react/docker/stacks/CreateView/CreateStackForm/validation.ts b/app/react/docker/stacks/CreateView/CreateStackForm/validation.ts
new file mode 100644
index 0000000..9fc1708
--- /dev/null
+++ b/app/react/docker/stacks/CreateView/CreateStackForm/validation.ts
@@ -0,0 +1,74 @@
+import { object, array, number, mixed, SchemaOf, bool } from 'yup';
+
+import { accessControlFormValidation } from '@/react/portainer/access-control/AccessControlForm';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { nameValidation } from '@/react/docker/stacks/common/NameField';
+import { Stack } from '@/react/common/stacks/types';
+
+import { envVarValidation } from '@@/form-components/EnvironmentVariablesFieldset';
+
+import { BaseFormValues, FormValues } from './types';
+import { getEditorValidationSchema } from './EditorSection/validation';
+import { getGitValidationSchema } from './GitSection/validation';
+import { getTemplateValidationSchema } from './TemplateSection/validation';
+import { getUploadValidationSchema } from './UploadSection/validation';
+
+export function getValidationSchema({
+  isAdmin,
+  environmentId,
+  stacks,
+  containerNames = [],
+}: {
+  isAdmin: boolean;
+  environmentId: EnvironmentId;
+  stacks?: Array<Stack>;
+  containerNames?: Array<string>;
+}): SchemaOf<FormValues> {
+  return getBaseValidationSchema({ isAdmin, environmentId, stacks }).concat(
+    object({
+      git: getGitValidationSchema().when('method', {
+        is: 'repository',
+        then: (schema) => schema.required(),
+        otherwise: () => mixed(),
+      }),
+      upload: getUploadValidationSchema({ containerNames }).when('method', {
+        is: 'upload',
+        then: (schema) => schema.required(),
+        otherwise: () => mixed(),
+      }),
+      editor: getEditorValidationSchema({ containerNames }).when('method', {
+        is: 'editor',
+        then: (schema) => schema.required(),
+        otherwise: () => mixed(),
+      }),
+      template: getTemplateValidationSchema({ containerNames }).when('method', {
+        is: 'template',
+        then: (schema) => schema.required(),
+        otherwise: () => mixed(),
+      }),
+    })
+  );
+}
+
+function getBaseValidationSchema({
+  isAdmin,
+  environmentId,
+  stacks,
+}: {
+  isAdmin: boolean;
+  environmentId: EnvironmentId;
+  stacks?: Array<Stack>;
+}): SchemaOf<BaseFormValues> {
+  return object({
+    method: mixed<'editor' | 'upload' | 'repository' | 'template'>()
+      .oneOf(['editor', 'repository', 'template', 'upload'])
+      .default('editor'),
+    name: nameValidation({ environmentId, stacks }).required(
+      'Stack name is required'
+    ),
+    env: envVarValidation(),
+    accessControl: accessControlFormValidation(isAdmin),
+    enableWebhook: bool().default(false),
+    registries: array(number().required()).default([]),
+  });
+}
diff --git a/app/react/docker/stacks/CreateView/CreateView.tsx b/app/react/docker/stacks/CreateView/CreateView.tsx
new file mode 100644
index 0000000..6fecf9a
--- /dev/null
+++ b/app/react/docker/stacks/CreateView/CreateView.tsx
@@ -0,0 +1,41 @@
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useIsSwarm } from '@/react/docker/proxy/queries/useInfo';
+import { useSwarmId } from '@/react/docker/proxy/queries/useSwarm';
+
+import { PageHeader } from '@@/PageHeader';
+import { Widget } from '@@/Widget';
+
+import { CreateStackForm } from './CreateStackForm/CreateStackForm';
+
+export function CreateView() {
+  const environmentId = useEnvironmentId();
+
+  const isSwarm = useIsSwarm(environmentId);
+  const swarmIdQuery = useSwarmId(environmentId);
+
+  if (isSwarm && swarmIdQuery.isLoading) {
+    return null;
+  }
+
+  const swarmId = isSwarm && swarmIdQuery.data ? swarmIdQuery.data : '';
+
+  return (
+    <>
+      <PageHeader title="Create stack" breadcrumbs="Stack creation" reload />
+
+      <div className="row">
+        <div className="col-sm-12">
+          <Widget>
+            <Widget.Body>
+              <CreateStackForm
+                environmentId={environmentId}
+                isSwarm={isSwarm}
+                swarmId={swarmId}
+              />
+            </Widget.Body>
+          </Widget>
+        </div>
+      </div>
+    </>
+  );
+}
diff --git a/app/react/docker/stacks/ItemView/ItemView.tsx b/app/react/docker/stacks/ItemView/ItemView.tsx
new file mode 100644
index 0000000..d286551
--- /dev/null
+++ b/app/react/docker/stacks/ItemView/ItemView.tsx
@@ -0,0 +1,144 @@
+import { useCurrentStateAndParams } from '@uirouter/react';
+import { useQueryClient } from '@tanstack/react-query';
+import { useEffect } from 'react';
+
+import { StackContainersDatatable } from '@/react/docker/stacks/ItemView/StackContainersDatatable';
+import { AccessControlPanel } from '@/react/portainer/access-control';
+import { useStack } from '@/react/common/stacks/queries/useStack';
+import { Stack, StackStatus, StackType } from '@/react/common/stacks/types';
+import { ResourceControlViewModel } from '@/react/portainer/access-control/models/ResourceControlViewModel';
+import { ResourceControlType } from '@/react/portainer/access-control/types';
+import { queryKeys } from '@/react/common/stacks/queries/query-keys';
+import { notifyError } from '@/portainer/services/notifications';
+import { useUpdateStackResourcesOnDeployment } from '@/react/docker/stacks/ItemView/useUpdateStackResourcesOnDeployment';
+
+import { PageHeader } from '@@/PageHeader';
+
+import { StackDetails } from './StackDetails';
+import { StackServicesDatatable } from './StackServicesDatatable';
+
+export function ItemView() {
+  const {
+    isExternal,
+    isOrphaned,
+    isOrphanedRunning,
+    isRegular,
+    stackName,
+    stackId,
+    stackType,
+  } = useParams();
+
+  const queryClient = useQueryClient();
+  const stackQuery = useStack(stackId, {
+    enabled: isRegular || isOrphaned,
+    refetchInterval: (data) =>
+      data?.Status === StackStatus.Deploying ? 3000 : false,
+  });
+
+  const stack = stackQuery.data;
+
+  useUpdateStackResourcesOnDeployment(stack);
+
+  const resourceControl = stack?.ResourceControl
+    ? new ResourceControlViewModel(stack.ResourceControl)
+    : undefined;
+
+  useEffect(() => {
+    if (
+      isInvalidStackType({
+        isExternal,
+        isOrphaned,
+        isOrphanedRunning,
+        stackType,
+      })
+    ) {
+      notifyError('Failure', undefined, 'Invalid type URL parameter.');
+    }
+  }, [isExternal, isOrphaned, isOrphanedRunning, stackType]);
+
+  return (
+    <>
+      <PageHeader
+        title="Stack details"
+        breadcrumbs={[{ label: 'Stacks', link: '^' }, stackName]}
+      />
+      <StackDetails
+        isExternal={isExternal}
+        isOrphaned={isOrphaned}
+        isOrphanedRunning={isOrphanedRunning}
+        isRegular={isRegular}
+        stackName={stackName}
+        stack={stack}
+      />
+      {(!isOrphaned || isOrphanedRunning) && (
+        <>
+          {stackType === StackType.DockerCompose && (
+            <StackContainersDatatable stackName={stackName} />
+          )}
+          {stackType === StackType.DockerSwarm && (
+            <StackServicesDatatable name={stackName} />
+          )}
+        </>
+      )}
+      {stack && !isOrphaned && (
+        <AccessControlPanel
+          environmentId={stack.EndpointId}
+          resourceId={`${stack.EndpointId}_${stack.Name}`}
+          resourceControl={resourceControl}
+          resourceType={ResourceControlType.Stack}
+          onUpdateSuccess={() =>
+            queryClient.invalidateQueries(queryKeys.stack(stackId))
+          }
+        />
+      )}
+    </>
+  );
+}
+
+function isInvalidStackType({
+  isExternal,
+  isOrphaned,
+  isOrphanedRunning,
+  stackType,
+}: {
+  isExternal: boolean;
+  isOrphaned: boolean;
+  isOrphanedRunning: boolean;
+  stackType: StackType | undefined;
+}) {
+  return (
+    (isExternal || (isOrphaned && isOrphanedRunning)) &&
+    (!stackType ||
+      (stackType !== StackType.DockerSwarm &&
+        stackType !== StackType.DockerCompose))
+  );
+}
+
+function useParams() {
+  /*
+TODO Check:
+why use stack.Name or params.stackName?
+why use booleans from params instead of figuring out by name/id
+why stack.EndpointID and not params.envId?
+*/
+  const { params } = useCurrentStateAndParams();
+  const isRegular = params.regular === 'true';
+  const isExternal = params.external === 'true';
+  const isOrphaned = params.orphaned === 'true';
+  const isOrphanedRunning = params.orphanedRunning === 'true';
+  const stackName = params.name || ('' as string);
+  const id = params.id ? (parseInt(params.id, 10) as Stack['Id']) : undefined;
+  const type = ['1', '2', '3'].includes(params.type)
+    ? (parseInt(params.type, 10) as StackType)
+    : undefined;
+
+  return {
+    isExternal,
+    isRegular,
+    isOrphaned,
+    isOrphanedRunning,
+    stackName,
+    stackId: id,
+    stackType: type,
+  };
+}
diff --git a/app/react/docker/stacks/ItemView/StackContainersDatatable.tsx b/app/react/docker/stacks/ItemView/StackContainersDatatable.tsx
new file mode 100644
index 0000000..0ac00f2
--- /dev/null
+++ b/app/react/docker/stacks/ItemView/StackContainersDatatable.tsx
@@ -0,0 +1,101 @@
+import { Box } from 'lucide-react';
+
+import { ContainerListViewModel } from '@/react/docker/containers/types';
+import { createStore } from '@/react/docker/containers/ListView/ContainersDatatable/datatable-store';
+import { useColumns } from '@/react/docker/containers/ListView/ContainersDatatable/columns';
+import { ContainersDatatableActions } from '@/react/docker/containers/ListView/ContainersDatatable/ContainersDatatableActions';
+import { ContainersDatatableSettings } from '@/react/docker/containers/ListView/ContainersDatatable/ContainersDatatableSettings';
+import { useShowGPUsColumn } from '@/react/docker/containers/utils';
+import { useCurrentEnvironment } from '@/react/hooks/useCurrentEnvironment';
+
+import { Datatable, Table } from '@@/datatables';
+import {
+  buildAction,
+  QuickActionsSettings,
+} from '@@/datatables/QuickActionsSettings';
+import {
+  ColumnVisibilityMenu,
+  getColumnVisibilityState,
+} from '@@/datatables/ColumnVisibilityMenu';
+import { TableSettingsProvider } from '@@/datatables/useTableSettings';
+import { useTableState } from '@@/datatables/useTableState';
+
+import { RowProvider } from '../../containers/ListView/ContainersDatatable/RowContext';
+
+import { useComposeStackContainers } from './useComposeStackContainers';
+
+const storageKey = 'stack-containers';
+const settingsStore = createStore(storageKey);
+
+const actions = [
+  buildAction('logs', 'Logs'),
+  buildAction('inspect', 'Inspect'),
+  buildAction('stats', 'Stats'),
+  buildAction('exec', 'Console'),
+  buildAction('attach', 'Attach'),
+];
+
+export interface Props {
+  stackName: string;
+}
+
+export function StackContainersDatatable({ stackName }: Props) {
+  const environmentQuery = useCurrentEnvironment();
+  const tableState = useTableState(settingsStore, storageKey);
+
+  const isGPUsColumnVisible = useShowGPUsColumn(environmentQuery.data);
+  const columns = useColumns(false, isGPUsColumnVisible);
+
+  const containersQuery = useComposeStackContainers(
+    { environmentId: environmentQuery.data?.Id, stackName },
+    {
+      autoRefreshRate: tableState.autoRefreshRate * 1000,
+    }
+  );
+
+  if (!environmentQuery.data) {
+    return null;
+  }
+
+  const environment = environmentQuery.data;
+
+  return (
+    <RowProvider context={{ environment }}>
+      <TableSettingsProvider settings={settingsStore}>
+        <Datatable
+          title="Containers"
+          titleIcon={Box}
+          settingsManager={tableState}
+          columns={columns}
+          renderTableActions={(selectedRows) => (
+            <ContainersDatatableActions
+              selectedItems={selectedRows}
+              isAddActionVisible={false}
+              endpointId={environment.Id}
+            />
+          )}
+          initialTableState={getColumnVisibilityState(tableState.hiddenColumns)}
+          data-cy="stack-containers-datatable"
+          renderTableSettings={(tableInstance) => (
+            <>
+              <ColumnVisibilityMenu<ContainerListViewModel>
+                table={tableInstance}
+                onChange={(hiddenColumns) => {
+                  tableState.setHiddenColumns(hiddenColumns);
+                }}
+                value={tableState.hiddenColumns}
+              />
+              <Table.SettingsMenu
+                quickActions={<QuickActionsSettings actions={actions} />}
+              >
+                <ContainersDatatableSettings settings={tableState} />
+              </Table.SettingsMenu>
+            </>
+          )}
+          dataset={containersQuery.data || []}
+          isLoading={!containersQuery.data}
+        />
+      </TableSettingsProvider>
+    </RowProvider>
+  );
+}
diff --git a/app/react/docker/stacks/ItemView/StackDetails.tsx b/app/react/docker/stacks/ItemView/StackDetails.tsx
new file mode 100644
index 0000000..7c3e156
--- /dev/null
+++ b/app/react/docker/stacks/ItemView/StackDetails.tsx
@@ -0,0 +1,161 @@
+import { useRouter } from '@uirouter/react';
+import { Edit2, List } from 'lucide-react';
+import _ from 'lodash';
+import { useMemo } from 'react';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { Stack } from '@/react/common/stacks/types';
+import { useStackFile } from '@/react/common/stacks/queries/useStackFile';
+import { isGitConfigDiverged } from '@/react/portainer/gitops/utils';
+
+import { WidgetBody, Widget } from '@@/Widget';
+import { Tab, useCurrentTabIndex, WidgetTabs } from '@@/Widget/WidgetTabs';
+
+import { useContainers } from '../../containers/queries/useContainers';
+import { validateYAML } from '../common/stackYamlValidation';
+import { extractContainerNames } from '../common/container-names';
+
+import { StackEditorTab } from './StackEditorTab/StackEditorTab';
+import { StackInfoTab } from './StackInfoTab/StackInfoTab';
+
+function showEditorTab(
+  isExternal: boolean,
+  stack: Stack | undefined,
+  fileQueryLoading: boolean
+) {
+  return (
+    !isExternal &&
+    !isExternal &&
+    !!stack &&
+    !fileQueryLoading &&
+    (!stack.GitConfig || stack.FromAppTemplate)
+  );
+}
+
+export function StackDetails({
+  isExternal,
+  isOrphaned,
+  isOrphanedRunning,
+  isRegular,
+  stackName,
+  stack,
+}: {
+  isOrphaned: boolean;
+  isExternal: boolean;
+  isOrphanedRunning: boolean;
+  isRegular: boolean;
+  stackName: string;
+  stack: Stack | undefined;
+}) {
+  const router = useRouter();
+  const envId = useEnvironmentId();
+  const containerNamesQuery = useContainers(envId, {
+    select: (containers) =>
+      containers.flatMap((c) => c.Names).map((n) => _.trimStart(n, '/')),
+  });
+  const shouldLoadFile =
+    !stack?.GitConfig ||
+    !isGitConfigDiverged(stack.GitConfig, stack.CurrentDeploymentInfo);
+
+  const fileQuery = useStackFile(
+    stack?.Id,
+    {
+      version: stack?.StackFileVersion,
+      commitHash: stack?.GitConfig?.ConfigHash,
+    },
+    {
+      enabled: shouldLoadFile,
+    }
+  );
+
+  const stackFileContent = fileQuery.data?.StackFileContent;
+  const originalContainerNames = extractContainerNames(stackFileContent);
+  const yamlError = validateYAML(
+    stackFileContent || '',
+    containerNamesQuery.data,
+    originalContainerNames
+  );
+
+  const tabs: Tab[] = useMemo(() => {
+    const infoTab: Tab = {
+      name: 'Stack',
+      icon: List,
+      widget: (
+        <Widget>
+          <WidgetBody>
+            <StackInfoTab
+              environmentId={envId}
+              isExternal={isExternal}
+              isOrphaned={isOrphaned}
+              isOrphanedRunning={isOrphanedRunning}
+              stackName={stackName}
+              isRegular={isRegular}
+              stack={stack}
+              stackFileContent={stackFileContent}
+              yamlError={yamlError}
+            />
+          </WidgetBody>
+        </Widget>
+      ),
+      selectedTabParam: 'info',
+    };
+
+    const editorTab: Tab = {
+      name: 'Editor',
+      icon: Edit2,
+      widget: (
+        <Widget>
+          <WidgetBody>
+            <StackEditorTab
+              stack={stack!}
+              isOrphaned={isOrphaned}
+              originalFileContent={stackFileContent || ''}
+              containerNames={containerNamesQuery.data}
+              originalContainerNames={originalContainerNames}
+              onSubmitSuccess={() =>
+                router.stateService.go('.', { tab: 'info' })
+              }
+            />
+          </WidgetBody>
+        </Widget>
+      ),
+      selectedTabParam: 'editor',
+    };
+
+    const withEditor = showEditorTab(isExternal, stack, fileQuery.isLoading);
+    return withEditor ? [infoTab, editorTab] : [infoTab];
+  }, [
+    envId,
+    isExternal,
+    isOrphaned,
+    isOrphanedRunning,
+    stackName,
+    isRegular,
+    stack,
+    stackFileContent,
+    yamlError,
+    fileQuery.isLoading,
+    containerNamesQuery.data,
+    originalContainerNames,
+    router.stateService,
+  ]);
+
+  const currentTabIndex = useCurrentTabIndex(tabs);
+
+  if (tabs.length === 1) {
+    return (
+      <div className="row">
+        <div className="col-sm-12">{tabs[0].widget}</div>
+      </div>
+    );
+  }
+
+  return (
+    <>
+      <WidgetTabs tabs={tabs} currentTabIndex={currentTabIndex} />
+      <div className="row">
+        <div className="col-sm-12">{tabs[currentTabIndex].widget}</div>
+      </div>
+    </>
+  );
+}
diff --git a/app/react/docker/stacks/ItemView/StackEditorTab/StackEditorTab.test.tsx b/app/react/docker/stacks/ItemView/StackEditorTab/StackEditorTab.test.tsx
new file mode 100644
index 0000000..ebcc9a3
--- /dev/null
+++ b/app/react/docker/stacks/ItemView/StackEditorTab/StackEditorTab.test.tsx
@@ -0,0 +1,478 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { vi } from 'vitest';
+import { ComponentProps } from 'react';
+
+import { server } from '@/setup-tests/server';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { suppressConsoleLogs } from '@/setup-tests/suppress-console';
+import {
+  createMockUsers,
+  createMockStack,
+  createMockEnvironment,
+} from '@/react-tools/test-mocks';
+import { EnvironmentType } from '@/react/portainer/environments/types';
+import { Role } from '@/portainer/users/types';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { confirmStackUpdate } from '@/react/common/stacks/common/confirm-stack-update';
+import { notifyError, notifySuccess } from '@/portainer/services/notifications';
+
+import { StackEditorTab } from './StackEditorTab';
+
+const defaultProps = {
+  stack: createMockStack({
+    EndpointId: 5,
+    PreviousDeploymentInfo: {
+      Version: 1,
+      FileVersion: 2,
+    },
+    Option: {
+      Prune: false,
+      Force: false,
+    },
+    Webhook: '',
+  }),
+  originalFileContent: 'version: "3"\nservices:\n  web:\n    image: nginx',
+  isOrphaned: false,
+  containerNames: [],
+  originalContainerNames: [],
+};
+
+// Mock the hooks and child component
+vi.mock('@@/WebEditorForm', () => ({
+  usePreventExit: vi.fn(),
+}));
+
+vi.mock('./useVersionedStackFile', () => ({
+  useVersionedStackFile: vi.fn(),
+}));
+
+vi.mock('@uirouter/react', async (importOriginal: () => Promise<object>) => ({
+  ...(await importOriginal()),
+  useCurrentStateAndParams: vi.fn(() => ({
+    params: { endpointId: 5 },
+  })),
+}));
+
+vi.mock('@/react/common/stacks/common/confirm-stack-update', () => ({
+  confirmStackUpdate: vi.fn(() =>
+    Promise.resolve({ repullImageAndRedeploy: false })
+  ),
+}));
+
+vi.mock('@/portainer/services/notifications', () => ({
+  notifyError: vi.fn(),
+  notifySuccess: vi.fn(),
+}));
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  setupMswHandlers();
+});
+
+describe('initial loading', () => {
+  it('should be empty when environment data is not loaded', async () => {
+    const restoreConsole = suppressConsoleLogs();
+    setupMswHandlers({ shouldReturnEnv: false });
+
+    const { container } = renderComponent();
+
+    // Wait for queries to settle
+    await waitFor(() => {
+      expect(container.innerHTML).toBe('<div></div>');
+    });
+
+    restoreConsole();
+  });
+
+  it('should be empty when schema data is not loaded', async () => {
+    setupMswHandlers({ shouldReturnSchema: false });
+
+    const { container } = renderComponent();
+
+    // Wait for queries to settle
+    await waitFor(() => {
+      expect(container.innerHTML).toBe('<div></div>');
+    });
+  });
+
+  it('should render StackEditorTabInner when both environment and schema are loaded', async () => {
+    renderComponent();
+
+    await waitFor(() => {
+      expect(screen.getByTestId('stack-editor')).toBeInTheDocument();
+    });
+  });
+
+  it('should fetch current environment data on mount', async () => {
+    let envFetched = false;
+
+    server.use(
+      http.get('/api/endpoints/:id', () => {
+        envFetched = true;
+        return HttpResponse.json(
+          createMockEnvironment({
+            Id: 1,
+            Name: 'local',
+            Type: EnvironmentType.Docker,
+          })
+        );
+      })
+    );
+
+    renderComponent();
+
+    await waitFor(() => {
+      expect(envFetched).toBe(true);
+    });
+  });
+
+  it('should fetch API version for environment', async () => {
+    let versionFetched = false;
+
+    server.use(
+      http.get('/api/endpoints/:id/docker/version', () => {
+        versionFetched = true;
+        return HttpResponse.json({
+          ApiVersion: '1.47',
+        });
+      })
+    );
+
+    renderComponent();
+
+    await waitFor(() => {
+      expect(versionFetched).toBe(true);
+    });
+  });
+});
+
+describe('form submission', () => {
+  it('should show confirmation dialog before submitting', async () => {
+    const restoreConsole = suppressConsoleLogs();
+
+    const mockConfirm = vi.mocked(confirmStackUpdate);
+    renderComponent();
+    const user = userEvent.setup();
+
+    await waitFor(() => {
+      expect(screen.getByTestId('stack-editor')).toBeInTheDocument();
+    });
+
+    const deployButton = screen.getByTestId('stack-deploy-button');
+    await waitFor(() => {
+      expect(deployButton).toBeEnabled();
+    });
+
+    await user.click(deployButton);
+
+    await waitFor(() => {
+      expect(mockConfirm).toHaveBeenCalledWith(
+        'Do you want to force an update of the stack?',
+        false // stackType is DockerCompose
+      );
+    });
+
+    restoreConsole();
+  });
+
+  it('should call mutation API with correct payload', async () => {
+    const restoreConsole = suppressConsoleLogs();
+
+    let capturedRequestBody: unknown;
+
+    server.use(
+      http.put('/api/stacks/:id', async ({ request }) => {
+        capturedRequestBody = await request.json();
+        return HttpResponse.json({
+          Id: 1,
+          Name: 'test-stack',
+          Type: 2,
+        });
+      })
+    );
+
+    renderComponent({ stack: createMockStack({ Id: 42 }) });
+    const user = userEvent.setup();
+
+    await waitFor(() => {
+      expect(screen.getByTestId('stack-editor')).toBeInTheDocument();
+    });
+
+    const deployButton = screen.getByTestId('stack-deploy-button');
+    await waitFor(() => {
+      expect(deployButton).toBeEnabled();
+    });
+
+    await user.click(deployButton);
+
+    await waitFor(
+      () => {
+        expect(capturedRequestBody).toEqual({
+          stackFileContent: defaultProps.originalFileContent,
+          env: [],
+          prune: false,
+          repullImageAndRedeploy: false,
+        });
+      },
+      { timeout: 3000 }
+    );
+
+    restoreConsole();
+  });
+
+  it('should not submit if confirmation is cancelled', async () => {
+    const mockConfirm = vi.mocked(confirmStackUpdate);
+    mockConfirm.mockResolvedValueOnce(undefined); // User cancelled
+
+    let mutationCalled = false;
+    server.use(
+      http.put('/api/stacks/:id', () => {
+        mutationCalled = true;
+        return HttpResponse.json({ Id: 1 });
+      })
+    );
+
+    renderComponent();
+    const user = userEvent.setup();
+
+    await waitFor(() => {
+      expect(screen.getByTestId('stack-editor')).toBeInTheDocument();
+    });
+
+    const deployButton = screen.getByTestId('stack-deploy-button');
+    await waitFor(() => {
+      expect(deployButton).toBeEnabled();
+    });
+
+    await user.click(deployButton);
+
+    await waitFor(() => {
+      expect(mockConfirm).toHaveBeenCalled();
+    });
+
+    // Give some time to ensure mutation doesn't happen
+    await new Promise((resolve) => {
+      setTimeout(resolve, 100);
+    });
+
+    expect(mutationCalled).toBe(false);
+  });
+
+  it('should call onSubmitSuccess callback and show success notification after mutation completes', async () => {
+    const restoreConsole = suppressConsoleLogs();
+
+    const onSubmitSuccess = vi.fn();
+    renderComponent({ onSubmitSuccess });
+    const user = userEvent.setup();
+
+    await waitFor(() => {
+      expect(screen.getByTestId('stack-editor')).toBeInTheDocument();
+    });
+
+    const deployButton = screen.getByTestId('stack-deploy-button');
+    await waitFor(() => {
+      expect(deployButton).toBeEnabled();
+    });
+
+    await user.click(deployButton);
+
+    await waitFor(() => {
+      expect(notifySuccess).toHaveBeenCalledWith(
+        'Success',
+        'Stack successfully deployed'
+      );
+      expect(onSubmitSuccess).toHaveBeenCalled();
+    });
+
+    restoreConsole();
+  });
+
+  it('should handle API errors during submission', async () => {
+    const restoreConsole = suppressConsoleLogs();
+
+    server.use(
+      http.put('/api/stacks/:id', () =>
+        HttpResponse.json({ message: 'Stack update failed' }, { status: 500 })
+      )
+    );
+
+    renderComponent();
+    const user = userEvent.setup();
+
+    await waitFor(() => {
+      expect(screen.getByTestId('stack-editor')).toBeInTheDocument();
+    });
+
+    const deployButton = screen.getByTestId('stack-deploy-button');
+    await waitFor(() => {
+      expect(deployButton).toBeEnabled();
+    });
+
+    await user.click(deployButton);
+
+    // Verify error notification is called
+    await waitFor(() => {
+      expect(notifyError).toHaveBeenCalled();
+    });
+
+    expect(deployButton).toBeEnabled();
+    restoreConsole();
+  });
+});
+
+describe('container name validation', () => {
+  it('should validate container names using provided containerNames', async () => {
+    const originalFileContent = `
+version: "3"
+services:
+  web:
+    image: nginx
+    container_name: existing-container
+`;
+
+    const containerNames = ['existing-container', 'other-container'];
+
+    renderComponent({ originalFileContent, containerNames });
+
+    await waitFor(() => {
+      expect(
+        screen.getByText(/already used by another container/)
+      ).toBeVisible();
+    });
+  });
+
+  it('should not show error when container name is in originalContainerNames', async () => {
+    const originalFileContent = `
+version: "3"
+services:
+  web:
+    image: nginx
+    container_name: my-container
+`;
+
+    const containerNames = ['my-container', 'other-container'];
+    const originalContainerNames = ['my-container'];
+
+    renderComponent({
+      originalFileContent,
+      containerNames,
+      originalContainerNames,
+    });
+
+    await waitFor(() => {
+      expect(screen.getByTestId('stack-editor')).toBeInTheDocument();
+    });
+
+    // Should not show conflict error
+    expect(
+      screen.queryByText(/already used by another container/)
+    ).not.toBeInTheDocument();
+  });
+
+  it('should validate YAML syntax errors', async () => {
+    const originalFileContent = 'invalid: [yaml syntax';
+
+    renderComponent({ originalFileContent });
+
+    await waitFor(() => {
+      expect(
+        screen.getByText(/There is an error in the yaml syntax/)
+      ).toBeVisible();
+    });
+  });
+});
+
+/**
+ * Setup MSW handlers for API requests
+ */
+function setupMswHandlers({
+  shouldReturnEnv = true,
+  shouldReturnSchema = true,
+  envType = EnvironmentType.Docker,
+  apiVersion = 1.47,
+  schema = { type: 'object', properties: {} },
+  stackUpdateResponse,
+}: {
+  shouldReturnEnv?: boolean;
+  shouldReturnSchema?: boolean;
+  envType?: EnvironmentType;
+  apiVersion?: number;
+  schema?: object;
+  stackUpdateResponse?: object | ((body: unknown) => object);
+} = {}) {
+  server.use(
+    http.get('/api/endpoints/:id', () => {
+      if (!shouldReturnEnv) {
+        return HttpResponse.json(null, { status: 404 });
+      }
+      return HttpResponse.json(
+        createMockEnvironment({
+          Id: 1,
+          Name: 'local',
+          Type: envType,
+        })
+      );
+    }),
+    http.get('https://raw.githubusercontent.com/*', () => {
+      if (!shouldReturnSchema) {
+        return HttpResponse.json(null, { status: 404 });
+      }
+      return HttpResponse.json(schema);
+    }),
+    http.get('/api/endpoints/:id/docker/version', () =>
+      HttpResponse.json({
+        ApiVersion: apiVersion.toString(),
+      })
+    ),
+    http.get('/api/endpoints/:id/docker/info', () =>
+      HttpResponse.json({
+        Swarm: {
+          LocalNodeState: 'active',
+        },
+      })
+    ),
+    http.put('/api/stacks/:id', async ({ request, params }) => {
+      const body = await request.json();
+
+      if (stackUpdateResponse) {
+        const response =
+          typeof stackUpdateResponse === 'function'
+            ? stackUpdateResponse(body)
+            : stackUpdateResponse;
+        return HttpResponse.json(response);
+      }
+
+      // Default success response
+      return HttpResponse.json({
+        Id: Number(params.id),
+        Name: 'test-stack',
+        Type: 2,
+        EndpointId: 1,
+        ...(body as object),
+      });
+    })
+  );
+}
+
+type RenderComponentProps = Partial<ComponentProps<typeof StackEditorTab>>;
+/**
+ * Helper function to render StackEditorTab component
+ */
+function renderComponent(props: RenderComponentProps = {}) {
+  const Component = createComponent();
+  return render(<Component {...defaultProps} {...props} />);
+}
+
+/**
+ * Helper to create component with props and providers
+ */
+function createComponent() {
+  const user = createMockUsers(1, Role.Admin)[0]; // Admin user with all permissions
+
+  return withTestRouter(
+    withTestQueryProvider(withUserProvider(StackEditorTab, user))
+  );
+}
diff --git a/app/react/docker/stacks/ItemView/StackEditorTab/StackEditorTab.tsx b/app/react/docker/stacks/ItemView/StackEditorTab/StackEditorTab.tsx
new file mode 100644
index 0000000..db6239b
--- /dev/null
+++ b/app/react/docker/stacks/ItemView/StackEditorTab/StackEditorTab.tsx
@@ -0,0 +1,123 @@
+import { Formik } from 'formik';
+import { useRouter } from '@uirouter/react';
+import _ from 'lodash';
+import { useState } from 'react';
+import uuidv4 from 'uuid/v4';
+
+import { Stack, StackType } from '@/react/common/stacks/types';
+import { useDockerComposeSchema } from '@/react/hooks/useDockerComposeSchema/useDockerComposeSchema';
+import { useCurrentEnvironment } from '@/react/hooks/useCurrentEnvironment';
+import { confirmStackUpdate } from '@/react/common/stacks/common/confirm-stack-update';
+import { notifyError, notifySuccess } from '@/portainer/services/notifications';
+
+import { useUpdateStackMutation } from '../../useUpdateStack';
+
+import { StackEditorFormValues } from './StackEditorTab.types';
+import { getValidationSchema } from './StackEditorTab.validation';
+import { StackEditorTabInner } from './StackEditorTabInner';
+
+interface StackEditorTabProps {
+  isOrphaned: boolean;
+  containerNames?: string[];
+  originalContainerNames?: string[];
+  stack: Stack;
+  originalFileContent: string;
+
+  onSubmitSuccess?(): void;
+}
+
+export function StackEditorTab({
+  isOrphaned,
+
+  containerNames = [],
+  originalContainerNames = [],
+  originalFileContent,
+  onSubmitSuccess = () => {},
+  stack,
+}: StackEditorTabProps) {
+  const versions = _.compact([
+    stack.StackFileVersion,
+    stack.PreviousDeploymentInfo?.FileVersion,
+  ]);
+  const router = useRouter();
+  const mutation = useUpdateStackMutation();
+  const envQuery = useCurrentEnvironment();
+  const schemaQuery = useDockerComposeSchema();
+  const [webhookId] = useState(() => stack.Webhook || uuidv4());
+
+  if (!envQuery.data || !schemaQuery.data) {
+    return null;
+  }
+
+  const envType = envQuery.data?.Type;
+  const composeSyntaxMaxVersion = parseFloat(
+    envQuery.data?.ComposeSyntaxMaxVersion
+  );
+
+  const initialValues: StackEditorFormValues = {
+    environmentVariables: stack.Env || [],
+    prune: !!(stack.Option && stack.Option.Prune),
+    stackFileContent: originalFileContent,
+    enabledWebhook: !!stack.Webhook,
+  };
+
+  return (
+    <Formik
+      initialValues={initialValues}
+      validationSchema={getValidationSchema(
+        containerNames,
+        originalContainerNames
+      )}
+      onSubmit={async (values) => {
+        const response = await confirmStackUpdate(
+          'Do you want to force an update of the stack?',
+          stack.Type === StackType.DockerSwarm
+        );
+
+        if (!response) {
+          return;
+        }
+
+        mutation.mutate(
+          {
+            stackId: stack.Id,
+            environmentId: envQuery.data.Id,
+            payload: {
+              stackFileContent: values.stackFileContent,
+              env: values.environmentVariables,
+              prune: values.prune,
+              webhook: values.enabledWebhook ? webhookId : undefined,
+              repullImageAndRedeploy: response.repullImageAndRedeploy,
+              rollbackTo: values.rollbackTo,
+            },
+          },
+          {
+            onSuccess() {
+              notifySuccess('Success', 'Stack successfully deployed');
+              router.stateService.reload();
+              onSubmitSuccess();
+            },
+            onError(err) {
+              notifyError('Failure', err as Error, 'Unable to create stack');
+            },
+          }
+        );
+      }}
+      validateOnMount
+      enableReinitialize
+    >
+      <StackEditorTabInner
+        stackId={stack.Id}
+        stackType={stack.Type}
+        composeSyntaxMaxVersion={composeSyntaxMaxVersion}
+        isOrphaned={isOrphaned}
+        envType={envType}
+        schema={schemaQuery.data}
+        versions={versions}
+        isSubmitting={mutation.isLoading}
+        isSaved={mutation.isSuccess}
+        webhookId={webhookId}
+      />
+    </Formik>
+  );
+}
diff --git a/app/react/docker/stacks/ItemView/StackEditorTab/StackEditorTab.types.ts b/app/react/docker/stacks/ItemView/StackEditorTab/StackEditorTab.types.ts
new file mode 100644
index 0000000..4dd0d72
--- /dev/null
+++ b/app/react/docker/stacks/ItemView/StackEditorTab/StackEditorTab.types.ts
@@ -0,0 +1,9 @@
+import { EnvVarValues } from '@@/form-components/EnvironmentVariablesFieldset';
+
+export interface StackEditorFormValues {
+  stackFileContent: string;
+  environmentVariables: EnvVarValues;
+  rollbackTo?: number;
+  prune: boolean;
+  enabledWebhook: boolean;
+}
diff --git a/app/react/docker/stacks/ItemView/StackEditorTab/StackEditorTab.validation.ts b/app/react/docker/stacks/ItemView/StackEditorTab/StackEditorTab.validation.ts
new file mode 100644
index 0000000..75bfb71
--- /dev/null
+++ b/app/react/docker/stacks/ItemView/StackEditorTab/StackEditorTab.validation.ts
@@ -0,0 +1,40 @@
+import { object, string, boolean, SchemaOf, array, number } from 'yup';
+
+import { envVarValidation } from '@@/form-components/EnvironmentVariablesFieldset';
+
+import { validateYAML } from '../../common/stackYamlValidation';
+
+import { StackEditorFormValues } from './StackEditorTab.types';
+
+export function getValidationSchema(
+  containerNames: string[] = [],
+  originalContainerNames: string[] = []
+): SchemaOf<StackEditorFormValues> {
+  return object({
+    stackFileContent: string()
+      .required('Stack file content is required')
+      .min(1, 'Stack file content cannot be empty')
+      .test('valid-yaml', 'Invalid YAML', function validateYamlTest(value) {
+        if (!value) {
+          return true; // Let required validation handle empty values
+        }
+
+        const yamlError = validateYAML(
+          value,
+          containerNames,
+          originalContainerNames
+        );
+
+        if (yamlError) {
+          return this.createError({ message: yamlError });
+        }
+
+        return true;
+      }),
+    environmentVariables: envVarValidation(),
+    prune: boolean().default(false),
+    registries: array(number().required()).default([]),
+    rollbackTo: number().notRequired(),
+    enabledWebhook: boolean().default(false),
+  });
+}
diff --git a/app/react/docker/stacks/ItemView/StackEditorTab/StackEditorTab.webhook.test.tsx b/app/react/docker/stacks/ItemView/StackEditorTab/StackEditorTab.webhook.test.tsx
new file mode 100644
index 0000000..a370b0a
--- /dev/null
+++ b/app/react/docker/stacks/ItemView/StackEditorTab/StackEditorTab.webhook.test.tsx
@@ -0,0 +1,219 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { DefaultBodyType, http, HttpResponse } from 'msw';
+import uuidv4 from 'uuid/v4';
+
+import { server } from '@/setup-tests/server';
+import { Stack } from '@/react/common/stacks/types';
+import { EnvironmentType } from '@/react/portainer/environments/types';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import {
+  createMockEnvironment,
+  createMockStack,
+  createMockUsers,
+} from '@/react-tools/test-mocks';
+import { Role } from '@/portainer/users/types';
+import { suppressConsoleLogs } from '@/setup-tests/suppress-console';
+
+import { StackEditorTab } from './StackEditorTab';
+
+vi.mock('uuid/v4', () => ({
+  default: vi.fn(() => 'test-webhook-id-1234'),
+}));
+
+vi.mock('@uirouter/react', async (importOriginal: () => Promise<object>) => ({
+  ...(await importOriginal()),
+  useCurrentStateAndParams: vi.fn(() => ({
+    params: { endpointId: 1 },
+  })),
+}));
+
+vi.mock('@/react/common/stacks/common/confirm-stack-update', () => ({
+  confirmStackUpdate: vi.fn(() =>
+    Promise.resolve({ repullImageAndRedeploy: false })
+  ),
+}));
+
+describe('StackEditorTab - Webhook ID Handling', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+
+    server.use(
+      http.get('/api/endpoints/1', () =>
+        HttpResponse.json(
+          createMockEnvironment({
+            Id: 1,
+            Type: EnvironmentType.Docker,
+            ComposeSyntaxMaxVersion: '3',
+          })
+        )
+      )
+    );
+  });
+
+  describe('Editor stack with existing webhook', () => {
+    it('should display existing webhook ID', async () => {
+      const existingWebhookId = 'existing-webhook-123';
+
+      const stack = createMockStack({
+        Id: 1,
+        Webhook: existingWebhookId,
+      });
+
+      renderComponent({ stack });
+
+      await waitFor(() => {
+        expect(screen.getByTestId('stack-deploy-button')).toBeInTheDocument();
+      });
+
+      await waitFor(() => {
+        const webhookDisplay = screen.queryByRole('textbox', {
+          name: /webhook url/i,
+        });
+        expect(webhookDisplay).toBeInTheDocument();
+        expect(webhookDisplay).toHaveTextContent(existingWebhookId);
+      });
+
+      expect(vi.mocked(uuidv4)).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('Editor stack without webhook', () => {
+    it('should not display webhook ID and should call uuid once for fallback', async () => {
+      vi.clearAllMocks();
+
+      const stack = createMockStack({
+        Id: 1,
+        Webhook: '',
+      });
+
+      renderComponent({ stack });
+
+      await waitFor(() => {
+        expect(screen.getByTestId('stack-deploy-button')).toBeInTheDocument();
+      });
+
+      const webhookDisplay = screen.queryByRole('textbox', {
+        name: /webhook url/i,
+      });
+      expect(webhookDisplay).not.toBeInTheDocument();
+
+      expect(vi.mocked(uuidv4)).toHaveBeenCalledOnce();
+    });
+  });
+
+  describe('Form submission', () => {
+    it('should send webhook ID in API request when stack has webhook', async () => {
+      const restoreConsole = suppressConsoleLogs();
+
+      const user = userEvent.setup();
+      let capturedRequestBody: DefaultBodyType;
+
+      server.use(
+        http.put('/api/stacks/:id', async ({ request }) => {
+          capturedRequestBody = await request.json();
+          return HttpResponse.json({ Id: 1, Name: 'test-stack' });
+        })
+      );
+
+      const stack = createMockStack({
+        Id: 1,
+        Webhook: 'existing-webhook-123',
+      });
+
+      renderComponent({ stack });
+
+      await waitFor(() => {
+        expect(screen.getByTestId('stack-deploy-button')).toBeInTheDocument();
+      });
+
+      expect(screen.queryByRole('alert')).not.toBeInTheDocument();
+
+      const deployButton = screen.getByTestId('stack-deploy-button');
+      await waitFor(() => {
+        expect(deployButton).toBeEnabled();
+      });
+
+      await user.click(deployButton);
+
+      await waitFor(
+        () => {
+          expect(capturedRequestBody).toBeDefined();
+        },
+        { timeout: 3000 }
+      );
+
+      assert(capturedRequestBody && typeof capturedRequestBody === 'object');
+      expect(capturedRequestBody?.webhook).toBe('existing-webhook-123');
+
+      restoreConsole();
+    });
+
+    it('should not send webhook ID in API request when stack has no webhook', async () => {
+      const restoreConsole = suppressConsoleLogs();
+      const user = userEvent.setup();
+      let capturedRequestBody: DefaultBodyType;
+
+      server.use(
+        http.put('/api/stacks/:id', async ({ request }) => {
+          capturedRequestBody = await request.json();
+          return HttpResponse.json({ Id: 1, Name: 'test-stack' });
+        })
+      );
+
+      const stack = createMockStack({
+        Id: 1,
+        Webhook: '',
+      });
+
+      renderComponent({ stack });
+
+      await waitFor(() => {
+        expect(screen.getByTestId('stack-deploy-button')).toBeInTheDocument();
+      });
+
+      expect(screen.queryByRole('alert')).not.toBeInTheDocument();
+
+      const deployButton = screen.getByTestId('stack-deploy-button');
+      await waitFor(() => {
+        expect(deployButton).toBeEnabled();
+      });
+
+      await user.click(deployButton);
+
+      await waitFor(
+        () => {
+          expect(capturedRequestBody).toBeDefined();
+        },
+        { timeout: 3000 }
+      );
+
+      expect(capturedRequestBody).not.toHaveProperty('webhook');
+      restoreConsole();
+    });
+  });
+});
+
+function renderComponent({ stack }: { stack: Stack }) {
+  const user = createMockUsers(1, Role.Admin)[0];
+
+  const Component = withTestRouter(
+    withUserProvider(
+      withTestQueryProvider(() => (
+        <StackEditorTab
+          stack={stack}
+          isOrphaned={false}
+          originalFileContent={`services:
+  web:
+    image: nginx`}
+        />
+      )),
+      user
+    )
+  );
+
+  return render(<Component />);
+}
diff --git a/app/react/docker/stacks/ItemView/StackEditorTab/StackEditorTabInner.test.tsx b/app/react/docker/stacks/ItemView/StackEditorTab/StackEditorTabInner.test.tsx
new file mode 100644
index 0000000..09871a0
--- /dev/null
+++ b/app/react/docker/stacks/ItemView/StackEditorTab/StackEditorTabInner.test.tsx
@@ -0,0 +1,532 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { Formik } from 'formik';
+import { vi } from 'vitest';
+import { ComponentProps } from 'react';
+import { JSONSchema7 } from 'json-schema';
+import { http, HttpResponse } from 'msw';
+
+import { StackType } from '@/react/common/stacks/types';
+import { EnvironmentType } from '@/react/portainer/environments/types';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { createMockUser, createMockUsers } from '@/react-tools/test-mocks';
+import { Role } from '@/portainer/users/types';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { server } from '@/setup-tests/server';
+
+import { usePreventExit } from '@@/WebEditorForm';
+
+import { StackEditorTabInner } from './StackEditorTabInner';
+import { StackEditorFormValues } from './StackEditorTab.types';
+import { useVersionedStackFile } from './useVersionedStackFile';
+
+// Mock the hooks
+vi.mock('@@/WebEditorForm', () => ({
+  usePreventExit: vi.fn(),
+}));
+
+vi.mock('./useVersionedStackFile', () => ({
+  useVersionedStackFile: vi.fn(),
+}));
+
+vi.mock('@uirouter/react', async (importOriginal: () => Promise<object>) => ({
+  ...(await importOriginal()),
+  useCurrentStateAndParams: vi.fn(() => ({
+    params: { endpointId: 5 },
+  })),
+}));
+
+const defaultProps = {
+  stackType: StackType.DockerCompose,
+  composeSyntaxMaxVersion: 3,
+  envType: EnvironmentType.Docker,
+  schema: { type: 'object' } as JSONSchema7,
+  isOrphaned: false,
+  stackId: 1,
+  isSubmitting: false,
+  isSaved: false,
+  webhookId: '',
+};
+
+const defaultInitialValues: StackEditorFormValues = {
+  stackFileContent: 'version: "3"\nservices:\n  web:\n    image: nginx',
+  environmentVariables: [],
+  enabledWebhook: false,
+  prune: false,
+};
+
+beforeEach(() => {
+  vi.clearAllMocks();
+});
+
+describe('initial rendering', () => {
+  it('should render the form with all main sections', async () => {
+    renderComponent();
+
+    await waitFor(() => {
+      expect(
+        screen.getByText(/This stack will be deployed using/)
+      ).toBeVisible();
+    });
+
+    // Code editor should be present
+    expect(screen.getByTestId('stack-editor')).toBeInTheDocument();
+
+    // Environment variables panel
+    expect(screen.getByText(/Environment variables/)).toBeInTheDocument();
+  });
+
+  it('should show Docker Compose version 2 message when composeSyntaxMaxVersion is 2', async () => {
+    renderComponent({
+      stackType: StackType.DockerCompose,
+      composeSyntaxMaxVersion: 2,
+    });
+
+    await waitFor(() => {
+      expect(
+        screen.getByText(/Only Compose file format version/)
+      ).toBeVisible();
+      expect(screen.getByText(/2/)).toBeVisible();
+    });
+  });
+
+  it('should show Docker Compose generic message when composeSyntaxMaxVersion > 2', async () => {
+    renderComponent({
+      stackType: StackType.DockerCompose,
+      composeSyntaxMaxVersion: 3,
+    });
+
+    await waitFor(() => {
+      expect(
+        screen.getByText(/This stack will be deployed using/)
+      ).toBeVisible();
+    });
+  });
+
+  it('should show documentation link', () => {
+    renderComponent();
+
+    const link = screen.getByRole('link', {
+      name: /official documentation/i,
+    });
+    expect(link).toHaveAttribute(
+      'href',
+      'https://docs.docker.com/compose/compose-file/'
+    );
+    expect(link).toHaveAttribute('target', '_blank');
+  });
+
+  it('should call usePreventExit with correct parameters', () => {
+    const mockUsePreventExit = vi.mocked(usePreventExit);
+    renderComponent();
+
+    expect(mockUsePreventExit).toHaveBeenCalledWith(
+      defaultInitialValues.stackFileContent,
+      defaultInitialValues.stackFileContent,
+      true
+    );
+  });
+
+  it('should call useVersionedStackFile with stackId and rollbackTo', () => {
+    const mockUseVersionedStackFile = vi.mocked(useVersionedStackFile);
+    renderComponent({ stackId: 42 });
+
+    expect(mockUseVersionedStackFile).toHaveBeenCalledWith({
+      stackId: 42,
+      version: undefined,
+      onLoad: expect.any(Function),
+    });
+  });
+});
+
+describe('conditional rendering - Prune services field', () => {
+  it('should show Prune field for DockerSwarm with API >= 1.27', async () => {
+    renderComponent(
+      {
+        stackType: StackType.DockerSwarm,
+      },
+      {
+        apiVersion: 1.27,
+      }
+    );
+
+    await waitFor(() => {
+      expect(
+        screen.getByTestId('stack-prune-services-switch')
+      ).toBeInTheDocument();
+    });
+
+    expect(screen.getByText('Prune services')).toBeVisible();
+  });
+
+  it('should show Prune field for DockerCompose with API >= 1.27', async () => {
+    renderComponent(
+      {
+        stackType: StackType.DockerCompose,
+      },
+      {
+        apiVersion: 1.27,
+      }
+    );
+
+    await waitFor(() => {
+      expect(
+        screen.getByTestId('stack-prune-services-switch')
+      ).toBeInTheDocument();
+    });
+  });
+
+  it('should hide Prune field for DockerSwarm with API < 1.27', () => {
+    renderComponent(
+      {
+        stackType: StackType.DockerSwarm,
+      },
+      {
+        apiVersion: 1.26,
+      }
+    );
+
+    expect(
+      screen.queryByTestId('stack-prune-services-switch')
+    ).not.toBeInTheDocument();
+  });
+
+  it('should hide Prune field for DockerCompose with API < 1.27', () => {
+    renderComponent(
+      {
+        stackType: StackType.DockerCompose,
+      },
+      {
+        apiVersion: 1.26,
+      }
+    );
+
+    expect(
+      screen.queryByTestId('stack-prune-services-switch')
+    ).not.toBeInTheDocument();
+  });
+
+  it('should hide Prune field for Kubernetes stack', () => {
+    renderComponent({
+      stackType: StackType.Kubernetes,
+    });
+
+    expect(
+      screen.queryByTestId('stack-prune-services-switch')
+    ).not.toBeInTheDocument();
+  });
+});
+
+// TODO: Unskip these tests once WebhookFieldset authorization is properly mocked
+// These tests fail because WebhookFieldset has complex authorization checks
+// (PortainerWebhookCreate, PortainerWebhookList, PortainerWebhookDelete)
+// that aren't properly set up in the test environment
+describe.skip('conditional rendering - Webhook field', () => {
+  it('should show WebhookFieldset for Docker environment', () => {
+    renderComponent({
+      envType: EnvironmentType.Docker,
+    });
+
+    expect(screen.getByText(/Webhook/)).toBeInTheDocument();
+  });
+
+  it('should show WebhookFieldset for KubernetesLocal environment', () => {
+    renderComponent({
+      envType: EnvironmentType.KubernetesLocal,
+    });
+
+    expect(screen.getByText(/Webhook/)).toBeInTheDocument();
+  });
+
+  it('should hide WebhookFieldset for EdgeAgentOnDocker environment', () => {
+    renderComponent({
+      envType: EnvironmentType.EdgeAgentOnDocker,
+    });
+
+    expect(screen.queryByText(/Webhook/)).not.toBeInTheDocument();
+  });
+});
+
+describe('orphaned stack behavior', () => {
+  it('should disable CodeEditor when stack is orphaned', () => {
+    renderComponent({ isOrphaned: true });
+
+    const editor = screen.getByTestId('stack-editor');
+    expect(editor).toHaveAttribute('readonly');
+  });
+
+  it('should disable deploy button when stack is orphaned', async () => {
+    renderComponent({ isOrphaned: true });
+
+    await waitFor(() => {
+      const deployButton = screen.queryByTestId('stack-deploy-button');
+
+      expect(deployButton).toBeDisabled();
+    });
+  });
+
+  it('should enable CodeEditor when stack is not orphaned', async () => {
+    renderComponent({ isOrphaned: false });
+
+    const editor = screen.getByTestId('stack-editor');
+    await waitFor(() => {
+      expect(editor).not.toHaveAttribute('readonly');
+    });
+  });
+});
+
+describe('form field updates', () => {
+  it('should update stackFileContent when CodeEditor changes', async () => {
+    const onSubmit = vi.fn();
+    renderComponent({}, { onSubmit });
+    const user = userEvent.setup();
+
+    const editor = screen.getByTestId('stack-editor');
+    await waitFor(() => {
+      expect(editor).not.toHaveAttribute('readonly');
+    });
+
+    await user.clear(editor);
+    await user.type(editor, 'version: "3.8"');
+
+    await waitFor(() => {
+      expect(editor).toHaveValue('version: "3.8"');
+    });
+  });
+
+  it('should update prune field when SwitchField changes', async () => {
+    const onSubmit = vi.fn();
+    renderComponent(
+      {
+        stackType: StackType.DockerSwarm,
+      },
+      { onSubmit }
+    );
+    const user = userEvent.setup();
+
+    await waitFor(() => {
+      expect(
+        screen.getByTestId('stack-prune-services-switch')
+      ).toBeInTheDocument();
+    });
+
+    const pruneSwitchField = screen.getByTestId('stack-prune-services-switch');
+    await user.click(pruneSwitchField);
+
+    const pruneSwitch = pruneSwitchField.querySelector(
+      'input[type="checkbox"]'
+    );
+
+    await waitFor(() => {
+      expect(pruneSwitch).toBeChecked();
+    });
+  });
+});
+
+describe('version rollback', () => {
+  it('should call useVersionedStackFile with rollbackTo value', () => {
+    const mockUseVersionedStackFile = vi.mocked(useVersionedStackFile);
+    const initialValues = {
+      ...defaultInitialValues,
+      rollbackTo: 2,
+    };
+
+    renderComponent({ stackId: 5 }, { initialValues });
+
+    expect(mockUseVersionedStackFile).toHaveBeenCalledWith({
+      stackId: 5,
+      version: 2,
+      onLoad: expect.any(Function),
+    });
+  });
+
+  it('should update stackFileContent when version loaded', () => {
+    const mockUseVersionedStackFile = vi.mocked(useVersionedStackFile);
+    let capturedOnLoad: ((content: string) => void) | undefined;
+
+    mockUseVersionedStackFile.mockImplementation(({ onLoad }) => {
+      capturedOnLoad = onLoad;
+
+      return {
+        content: '',
+        isLoading: false,
+      };
+    });
+
+    renderComponent({ versions: [3, 2, 1] });
+
+    expect(capturedOnLoad).toBeDefined();
+
+    // Simulate loading a different version
+    if (capturedOnLoad) {
+      capturedOnLoad('version: "2"\nservices:\n  db:\n    image: postgres');
+    }
+
+    // The form value should be updated through setFieldValue
+    // This would be verified by checking the editor value in a full integration test
+  });
+
+  it('should set rollbackTo when version selected and multiple versions available', async () => {
+    const onSubmit = vi.fn();
+    const versions = [3, 2, 1];
+    renderComponent({ versions }, { onSubmit });
+    const user = userEvent.setup();
+
+    const versionSelect = screen.getByRole('combobox', { name: /version/i });
+    await user.selectOptions(versionSelect, '2');
+
+    await waitFor(() => {
+      // Check that the form value was updated (through Formik)
+      expect(versionSelect).toHaveValue('2');
+    });
+  });
+});
+
+describe('form submission', () => {
+  it('should enable submit button when form is valid', async () => {
+    renderComponent();
+
+    await waitFor(() => {
+      const deployButton = screen.getByTestId('stack-deploy-button');
+      expect(deployButton).toBeEnabled();
+    });
+  });
+
+  it('should disable submit button when stack is orphaned', async () => {
+    const onSubmit = vi.fn();
+    renderComponent({ isOrphaned: true }, { onSubmit });
+
+    await waitFor(() => {
+      const deployButton = screen.queryByTestId('stack-deploy-button');
+
+      expect(deployButton).toBeDisabled();
+    });
+  });
+
+  it('should show loading text during submission', async () => {
+    renderComponent({ isSubmitting: true }, {});
+
+    await waitFor(() => {
+      expect(screen.getByText(/Deployment in progress.../)).toBeInTheDocument();
+    });
+  });
+
+  it('should call onSubmit with form values when button is clicked', async () => {
+    const onSubmit = vi.fn();
+    renderComponent({}, { onSubmit });
+    const user = userEvent.setup();
+
+    await waitFor(() => {
+      const deployButton = screen.getByTestId('stack-deploy-button');
+      expect(deployButton).toBeEnabled();
+    });
+
+    const deployButton = screen.getByTestId('stack-deploy-button');
+    await user.click(deployButton);
+
+    await waitFor(() => {
+      expect(onSubmit).toHaveBeenCalled();
+    });
+  });
+});
+
+describe('authorization', () => {
+  it('should hide Prune field when user lacks PortainerStackUpdate authorization', () => {
+    const unauthorizedUser = createMockUsers(1, Role.Standard)[0];
+
+    renderComponent(
+      {
+        stackType: StackType.DockerSwarm,
+      },
+      { user: unauthorizedUser }
+    );
+
+    expect(
+      screen.queryByTestId('stack-prune-services-switch')
+    ).not.toBeInTheDocument();
+  });
+
+  it('should hide FormActions when user lacks PortainerStackUpdate authorization', () => {
+    const unauthorizedUser = createMockUsers(1, Role.Standard)[0];
+
+    renderComponent({}, { user: unauthorizedUser });
+
+    expect(screen.queryByTestId('stack-deploy-button')).not.toBeInTheDocument();
+  });
+});
+
+describe('isSaved state', () => {
+  it('should not prevent exit when isSaved is true', () => {
+    const mockUsePreventExit = vi.mocked(usePreventExit);
+    renderComponent({ isSaved: true });
+
+    expect(mockUsePreventExit).toHaveBeenCalledWith(
+      expect.any(String),
+      expect.any(String),
+      false // Should be false when isSaved is true
+    );
+  });
+
+  it('should prevent exit when isSaved is false and form is dirty', () => {
+    const mockUsePreventExit = vi.mocked(usePreventExit);
+    const initialValues = {
+      ...defaultInitialValues,
+      stackFileContent: 'original content',
+    };
+
+    renderComponent({ isSaved: false }, { initialValues });
+
+    expect(mockUsePreventExit).toHaveBeenCalledWith(
+      'original content',
+      'original content',
+      true
+    );
+  });
+});
+
+/**
+ * Helper function to render StackEditorTabInner with Formik wrapper
+ */
+function renderComponent(
+  props: Partial<ComponentProps<typeof StackEditorTabInner>> = {},
+  {
+    apiVersion = 1.47,
+    onSubmit = vi.fn(),
+    initialValues = defaultInitialValues,
+    validationErrors = {},
+    user = createMockUser({ Role: Role.Admin }), // Default admin user
+  }: {
+    apiVersion?: number;
+    onSubmit?: (values: StackEditorFormValues) => void | Promise<void>;
+    initialValues?: StackEditorFormValues;
+    validationErrors?: Partial<Record<keyof StackEditorFormValues, string>>;
+    user?: ReturnType<typeof createMockUser>;
+  } = {}
+) {
+  server.use(
+    http.get('/api/endpoints/:endpointId/docker/version', () =>
+      HttpResponse.json({ ApiVersion: String(apiVersion) })
+    )
+  );
+
+  // Create validation function that returns errors
+  function validate() {
+    return validationErrors;
+  }
+
+  const Component = withTestQueryProvider(
+    withTestRouter(withUserProvider(StackEditorTabInner, user))
+  );
+
+  return render(
+    <Formik
+      initialValues={initialValues}
+      onSubmit={onSubmit}
+      validate={validate}
+      enableReinitialize
+    >
+      <Component {...defaultProps} {...props} />
+    </Formik>
+  );
+}
diff --git a/app/react/docker/stacks/ItemView/StackEditorTab/StackEditorTabInner.tsx b/app/react/docker/stacks/ItemView/StackEditorTab/StackEditorTabInner.tsx
new file mode 100644
index 0000000..ec92c3c
--- /dev/null
+++ b/app/react/docker/stacks/ItemView/StackEditorTab/StackEditorTabInner.tsx
@@ -0,0 +1,171 @@
+import { Form, useFormikContext } from 'formik';
+import { JSONSchema7 } from 'json-schema';
+import { useCallback } from 'react';
+
+import { Stack, StackType } from '@/react/common/stacks/types';
+import { PruneField } from '@/react/common/stacks/PruneField';
+import { EnvironmentType } from '@/react/portainer/environments/types';
+import { Authorized, useAuthorizations } from '@/react/hooks/useUser';
+
+import { CodeEditor } from '@@/CodeEditor';
+import { StackEnvironmentVariablesPanel } from '@@/form-components/EnvironmentVariablesFieldset';
+import { FormActions } from '@@/form-components/FormActions';
+import { usePreventExit } from '@@/WebEditorForm';
+import { FormError } from '@@/form-components/FormError';
+
+import { WebhookFieldset } from '../../common/WebhookFieldset';
+
+import { StackEditorFormValues } from './StackEditorTab.types';
+import { useVersionedStackFile } from './useVersionedStackFile';
+
+interface StackEditorTabInnerProps {
+  stackType: StackType | undefined;
+  composeSyntaxMaxVersion: number;
+  envType: EnvironmentType;
+  schema: JSONSchema7;
+  isOrphaned: boolean;
+  versions?: Array<number>;
+  stackId: Stack['Id'];
+  isSaved: boolean;
+  isSubmitting: boolean;
+  webhookId: string;
+}
+
+export function StackEditorTabInner({
+  stackType,
+  composeSyntaxMaxVersion,
+  envType,
+  schema,
+  isOrphaned,
+  versions,
+  stackId,
+  isSaved,
+  isSubmitting,
+  webhookId,
+}: StackEditorTabInnerProps) {
+  const { authorized: isAuthorizedToUpdate } = useAuthorizations(
+    'PortainerStackUpdate'
+  );
+
+  const { values, errors, setFieldValue, isValid, initialValues } =
+    useFormikContext<StackEditorFormValues>();
+
+  usePreventExit(
+    initialValues.stackFileContent,
+    values.stackFileContent,
+    !isSubmitting && !isSaved
+  );
+
+  const handleLoadFile = useCallback(
+    (content: string) => {
+      setFieldValue('stackFileContent', content);
+    },
+    [setFieldValue]
+  );
+
+  useVersionedStackFile({
+    stackId,
+    version: values.rollbackTo,
+    onLoad: handleLoadFile,
+  });
+
+  const isDeployDisabled = isOrphaned;
+
+  return (
+    <Form className="form-horizontal">
+      {/* Docker Compose Info Section */}
+      <div className="form-group mb-0 space-y-2">
+        {stackType === StackType.DockerCompose &&
+          composeSyntaxMaxVersion === 2 && (
+            <span className="col-sm-12 text-muted small">
+              This stack will be deployed using the equivalent of{' '}
+              <code>docker compose</code>. Only Compose file format version{' '}
+              <b>2</b> is supported at the moment.
+            </span>
+          )}
+        {stackType === StackType.DockerCompose &&
+          composeSyntaxMaxVersion > 2 && (
+            <span className="col-sm-12 text-muted small">
+              This stack will be deployed using <code>docker compose</code>.
+            </span>
+          )}
+        <span className="col-sm-12 text-muted small">
+          You can get more information about Compose file format in the{' '}
+          <a
+            href="https://docs.docker.com/compose/compose-file/"
+            target="_blank"
+            rel="noreferrer"
+          >
+            official documentation
+          </a>
+          .
+        </span>
+        <div className="col-sm-12">
+          {errors.stackFileContent && (
+            <FormError>{errors.stackFileContent}</FormError>
+          )}
+        </div>
+      </div>
+
+      <div className="form-group">
+        <div className="col-sm-12">
+          <CodeEditor
+            id="stack-editor"
+            textTip="Define or paste the content of your docker compose file here"
+            type="yaml"
+            onChange={(value) => setFieldValue('stackFileContent', value)}
+            value={values.stackFileContent}
+            readonly={isOrphaned || !isAuthorizedToUpdate}
+            schema={schema}
+            data-cy="stack-editor"
+            onVersionChange={handleVersionChange}
+            versions={versions}
+          />
+        </div>
+      </div>
+
+      <StackEnvironmentVariablesPanel
+        values={values.environmentVariables}
+        onChange={(envVars) => setFieldValue('environmentVariables', envVars)}
+        errors={errors.environmentVariables}
+        showHelpMessage
+        isFoldable
+      />
+
+      {envType !== EnvironmentType.EdgeAgentOnDocker && (
+        <WebhookFieldset
+          onChange={(value) => setFieldValue('enabledWebhook', value)}
+          value={values.enabledWebhook}
+          webhookId={webhookId}
+        />
+      )}
+
+      <Authorized authorizations="PortainerStackUpdate">
+        <PruneField
+          stackType={stackType}
+          checked={values.prune}
+          onChange={(checked) => setFieldValue('prune', checked)}
+        />
+      </Authorized>
+
+      <Authorized authorizations="PortainerStackUpdate">
+        <FormActions
+          isValid={isValid && !isDeployDisabled}
+          isLoading={isSubmitting}
+          loadingText="Deployment in progress..."
+          submitLabel="Update the stack"
+          data-cy="stack-deploy-button"
+        />
+      </Authorized>
+    </Form>
+  );
+
+  async function handleVersionChange(newVersion: number) {
+    if (versions && versions.length > 1) {
+      setFieldValue(
+        'rollbackTo',
+        newVersion < versions[0] ? newVersion : versions[0]
+      );
+    }
+  }
+}
diff --git a/app/react/docker/stacks/ItemView/StackEditorTab/useVersionedStackFile.test.tsx b/app/react/docker/stacks/ItemView/StackEditorTab/useVersionedStackFile.test.tsx
new file mode 100644
index 0000000..782b939
--- /dev/null
+++ b/app/react/docker/stacks/ItemView/StackEditorTab/useVersionedStackFile.test.tsx
@@ -0,0 +1,530 @@
+import { waitFor } from '@testing-library/react';
+import { renderHook } from '@testing-library/react-hooks';
+import { http, HttpResponse } from 'msw';
+import { vi } from 'vitest';
+
+import { server } from '@/setup-tests/server';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { suppressConsoleLogs } from '@/setup-tests/suppress-console';
+
+import { useVersionedStackFile } from './useVersionedStackFile';
+
+describe('useVersionedStackFile', () => {
+  const defaultStackId = 1;
+  const defaultVersion = 2;
+  const mockOnLoad = vi.fn();
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    setupMswHandlers();
+  });
+
+  describe('initial state', () => {
+    it('should return loading state initially when version is provided', () => {
+      const { result } = renderHookWithProviders({
+        stackId: defaultStackId,
+        version: defaultVersion,
+        onLoad: mockOnLoad,
+      });
+
+      expect(result.current.isLoading).toBe(true);
+      expect(result.current.content).toBeUndefined();
+    });
+
+    it('should not fetch when version is undefined', () => {
+      let fetchAttempted = false;
+
+      server.use(
+        http.get('/api/stacks/:id/file', () => {
+          fetchAttempted = true;
+          return HttpResponse.json({
+            StackFileContent: 'version: "3"',
+          });
+        })
+      );
+
+      renderHookWithProviders({
+        stackId: defaultStackId,
+        version: undefined,
+        onLoad: mockOnLoad,
+      });
+
+      expect(fetchAttempted).toBe(false);
+      expect(mockOnLoad).not.toHaveBeenCalled();
+    });
+
+    it('should not fetch when version is empty string', () => {
+      let fetchAttempted = false;
+
+      server.use(
+        http.get('/api/stacks/:id/file', () => {
+          fetchAttempted = true;
+          return HttpResponse.json({
+            StackFileContent: 'version: "3"',
+          });
+        })
+      );
+
+      renderHookWithProviders({
+        stackId: defaultStackId,
+        onLoad: mockOnLoad,
+      });
+
+      expect(fetchAttempted).toBe(false);
+      expect(mockOnLoad).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('successful data fetching', () => {
+    it('should fetch stack file content when version is provided', async () => {
+      const stackContent = 'version: "3"\nservices:\n  web:\n    image: nginx';
+
+      setupMswHandlers({ stackContent });
+
+      const { result } = renderHookWithProviders({
+        stackId: defaultStackId,
+        version: defaultVersion,
+        onLoad: mockOnLoad,
+      });
+
+      await waitFor(() => {
+        expect(result.current.isLoading).toBe(false);
+      });
+
+      expect(result.current.content).toBe(stackContent);
+    });
+
+    it('should call onLoad callback with content when data is fetched successfully', async () => {
+      const stackContent =
+        'version: "3.8"\nservices:\n  db:\n    image: postgres';
+
+      setupMswHandlers({ stackContent });
+
+      renderHookWithProviders({
+        stackId: defaultStackId,
+        version: defaultVersion,
+        onLoad: mockOnLoad,
+      });
+
+      await waitFor(() => {
+        expect(mockOnLoad).toHaveBeenCalledWith(stackContent);
+      });
+    });
+
+    it('should call onLoad only once for the same data', async () => {
+      const stackContent = 'version: "3"';
+
+      setupMswHandlers({ stackContent });
+
+      renderHookWithProviders({
+        stackId: defaultStackId,
+        version: defaultVersion,
+        onLoad: mockOnLoad,
+      });
+
+      await waitFor(() => {
+        expect(mockOnLoad).toHaveBeenCalledTimes(1);
+      });
+
+      // Wait a bit to ensure no additional calls
+      await waitFor(() => expect(true).toBe(true));
+
+      expect(mockOnLoad).toHaveBeenCalledTimes(1);
+    });
+
+    it('should include version parameter in API request', async () => {
+      let capturedVersion: string | null = null;
+
+      server.use(
+        http.get('/api/stacks/:id/file', ({ request }) => {
+          const url = new URL(request.url);
+          capturedVersion = url.searchParams.get('version');
+
+          return HttpResponse.json({
+            StackFileContent: 'version: "3"',
+          });
+        })
+      );
+
+      renderHookWithProviders({
+        stackId: defaultStackId,
+        version: 5,
+        onLoad: mockOnLoad,
+      });
+
+      await waitFor(() => {
+        expect(capturedVersion).toBe('5');
+      });
+    });
+
+    it('should fetch from correct stack ID endpoint', async () => {
+      let capturedStackId: string | null = null;
+
+      server.use(
+        http.get('/api/stacks/:id/file', ({ params }) => {
+          capturedStackId = params.id as string;
+
+          return HttpResponse.json({
+            StackFileContent: 'version: "3"',
+          });
+        })
+      );
+
+      renderHookWithProviders({
+        stackId: 42,
+        version: defaultVersion,
+        onLoad: mockOnLoad,
+      });
+
+      await waitFor(() => {
+        expect(capturedStackId).toBe('42');
+      });
+    });
+  });
+
+  describe('version changes', () => {
+    it('should refetch when version changes', async () => {
+      const firstContent = 'version: "3"\nservices:\n  web:\n    image: nginx';
+      const secondContent =
+        'version: "2"\nservices:\n  web:\n    image: apache';
+
+      server.use(
+        http.get('/api/stacks/:id/file', ({ request }) => {
+          const url = new URL(request.url);
+          const version = url.searchParams.get('version');
+
+          if (version === '3') {
+            return HttpResponse.json({
+              StackFileContent: firstContent,
+            });
+          }
+
+          return HttpResponse.json({
+            StackFileContent: secondContent,
+          });
+        })
+      );
+
+      const { rerender } = renderHookWithProviders({
+        stackId: defaultStackId,
+        version: 3,
+        onLoad: mockOnLoad,
+      });
+
+      await waitFor(() => {
+        expect(mockOnLoad).toHaveBeenCalledWith(firstContent);
+      });
+
+      expect(mockOnLoad).toHaveBeenCalledTimes(1);
+
+      // Change version to 2
+      rerender({
+        stackId: defaultStackId,
+        version: 2,
+        onLoad: mockOnLoad,
+      });
+
+      await waitFor(() => {
+        expect(mockOnLoad).toHaveBeenCalledWith(secondContent);
+      });
+
+      expect(mockOnLoad).toHaveBeenCalledTimes(2);
+    });
+
+    it('should call onLoad with new content when version changes', async () => {
+      server.use(
+        http.get('/api/stacks/:id/file', ({ request }) => {
+          const url = new URL(request.url);
+          const version = url.searchParams.get('version');
+
+          return HttpResponse.json({
+            StackFileContent: `content for version ${version}`,
+          });
+        })
+      );
+
+      const { rerender } = renderHookWithProviders({
+        stackId: defaultStackId,
+        version: 1,
+        onLoad: mockOnLoad,
+      });
+
+      await waitFor(() => {
+        expect(mockOnLoad).toHaveBeenCalledWith('content for version 1');
+      });
+
+      mockOnLoad.mockClear();
+
+      // Change to version 2
+      rerender({
+        stackId: defaultStackId,
+        version: 2,
+        onLoad: mockOnLoad,
+      });
+
+      await waitFor(() => {
+        expect(mockOnLoad).toHaveBeenCalledWith('content for version 2');
+      });
+    });
+
+    it('should stop fetching when version becomes undefined', async () => {
+      let fetchCount = 0;
+
+      server.use(
+        http.get('/api/stacks/:id/file', () => {
+          fetchCount++;
+          return HttpResponse.json({
+            StackFileContent: 'version: "3"',
+          });
+        })
+      );
+
+      const { rerender } = renderHookWithProviders({
+        stackId: defaultStackId,
+        version: 3,
+        onLoad: mockOnLoad,
+      });
+
+      await waitFor(() => {
+        expect(fetchCount).toBe(1);
+      });
+
+      const initialFetchCount = fetchCount;
+
+      // Change version to undefined
+      rerender({
+        stackId: defaultStackId,
+        version: undefined,
+        onLoad: mockOnLoad,
+      });
+
+      // Wait to ensure no new fetch
+      await waitFor(() => expect(true).toBe(true));
+
+      expect(fetchCount).toBe(initialFetchCount);
+    });
+  });
+
+  describe('error handling', () => {
+    const restoreConsole = suppressConsoleLogs();
+    afterAll(restoreConsole);
+
+    it('should handle API errors gracefully', async () => {
+      server.use(
+        http.get('/api/stacks/:id/file', () =>
+          HttpResponse.json({ message: 'Stack not found' }, { status: 404 })
+        )
+      );
+
+      const { result } = renderHookWithProviders({
+        stackId: defaultStackId,
+        version: defaultVersion,
+        onLoad: mockOnLoad,
+      });
+
+      await waitFor(() => {
+        expect(result.current.isLoading).toBe(false);
+      });
+
+      // onLoad should not be called on error
+      expect(mockOnLoad).not.toHaveBeenCalled();
+      expect(result.current.content).toBeUndefined();
+    });
+
+    it('should not call onLoad when StackFileContent is empty', async () => {
+      server.use(
+        http.get('/api/stacks/:id/file', () =>
+          HttpResponse.json({
+            StackFileContent: '',
+          })
+        )
+      );
+
+      renderHookWithProviders({
+        stackId: defaultStackId,
+        version: defaultVersion,
+        onLoad: mockOnLoad,
+      });
+
+      await waitFor(() => expect(true).toBe(true));
+
+      expect(mockOnLoad).not.toHaveBeenCalled();
+    });
+
+    it('should not call onLoad when StackFileContent is null', async () => {
+      server.use(
+        http.get('/api/stacks/:id/file', () =>
+          HttpResponse.json({
+            StackFileContent: null,
+          })
+        )
+      );
+
+      renderHookWithProviders({
+        stackId: defaultStackId,
+        version: defaultVersion,
+        onLoad: mockOnLoad,
+      });
+
+      await waitFor(() => expect(true).toBe(true));
+
+      expect(mockOnLoad).not.toHaveBeenCalled();
+    });
+
+    it('should not call onLoad when StackFileContent is missing from response', async () => {
+      server.use(http.get('/api/stacks/:id/file', () => HttpResponse.json({})));
+
+      renderHookWithProviders({
+        stackId: defaultStackId,
+        version: defaultVersion,
+        onLoad: mockOnLoad,
+      });
+
+      await waitFor(() => expect(true).toBe(true));
+
+      expect(mockOnLoad).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('loading states', () => {
+    it('should show loading state while fetching', () => {
+      server.use(
+        http.get('/api/stacks/:id/file', async () => {
+          // Delay response
+          await new Promise((resolve) => {
+            setTimeout(resolve, 100);
+          });
+          return HttpResponse.json({
+            StackFileContent: 'version: "3"',
+          });
+        })
+      );
+
+      const { result } = renderHookWithProviders({
+        stackId: defaultStackId,
+        version: defaultVersion,
+        onLoad: mockOnLoad,
+      });
+
+      expect(result.current.isLoading).toBe(true);
+    });
+
+    it('should clear loading state after successful fetch', async () => {
+      setupMswHandlers();
+
+      const { result } = renderHookWithProviders({
+        stackId: defaultStackId,
+        version: defaultVersion,
+        onLoad: mockOnLoad,
+      });
+
+      await waitFor(() => {
+        expect(result.current.isLoading).toBe(false);
+      });
+    });
+
+    it('should clear loading state after failed fetch', async () => {
+      const restoreConsole = suppressConsoleLogs();
+      server.use(
+        http.get('/api/stacks/:id/file', () =>
+          HttpResponse.json({ message: 'Error' }, { status: 500 })
+        )
+      );
+
+      const { result } = renderHookWithProviders({
+        stackId: defaultStackId,
+        version: defaultVersion,
+        onLoad: mockOnLoad,
+      });
+
+      await waitFor(() => {
+        expect(result.current.isLoading).toBe(false);
+      });
+
+      restoreConsole();
+    });
+  });
+
+  describe('onLoad callback stability', () => {
+    it('should handle onLoad callback changes without refetching', async () => {
+      let fetchCount = 0;
+
+      server.use(
+        http.get('/api/stacks/:id/file', () => {
+          fetchCount++;
+          return HttpResponse.json({
+            StackFileContent: 'version: "3"',
+          });
+        })
+      );
+
+      const firstCallback = vi.fn();
+      const { rerender } = renderHookWithProviders({
+        stackId: defaultStackId,
+        version: defaultVersion,
+        onLoad: firstCallback,
+      });
+
+      await waitFor(() => {
+        expect(firstCallback).toHaveBeenCalled();
+      });
+
+      const initialFetchCount = fetchCount;
+      const secondCallback = vi.fn();
+
+      // Change callback
+      rerender({
+        stackId: defaultStackId,
+        version: defaultVersion,
+        onLoad: secondCallback,
+      });
+
+      await waitFor(() => {
+        // The new callback should be called with existing data
+        expect(secondCallback).toHaveBeenCalledWith('version: "3"');
+      });
+
+      // But no new fetch should occur
+      expect(fetchCount).toBe(initialFetchCount);
+    });
+  });
+});
+
+/**
+ * Setup MSW handlers for API requests
+ */
+function setupMswHandlers({
+  stackContent = 'version: "3"\nservices:\n  web:\n    image: nginx',
+}: { stackContent?: string } = {}) {
+  server.use(
+    http.get('/api/stacks/:id/file', () =>
+      HttpResponse.json({
+        StackFileContent: stackContent,
+      })
+    )
+  );
+}
+
+/**
+ * Helper function to render hook with providers
+ */
+function renderHookWithProviders({
+  stackId,
+  version,
+  onLoad,
+}: {
+  stackId: number;
+  version?: number;
+  onLoad: (content: string) => void;
+}) {
+  const Wrapper = withTestQueryProvider<{
+    stackId: number;
+    version?: number;
+    onLoad: (content: string) => void;
+  }>(({ children }) => <>{children}</>);
+
+  return renderHook(useVersionedStackFile, {
+    initialProps: { stackId, version, onLoad },
+    wrapper: Wrapper,
+  });
+}
diff --git a/app/react/docker/stacks/ItemView/StackEditorTab/useVersionedStackFile.tsx b/app/react/docker/stacks/ItemView/StackEditorTab/useVersionedStackFile.tsx
new file mode 100644
index 0000000..7b7b0f8
--- /dev/null
+++ b/app/react/docker/stacks/ItemView/StackEditorTab/useVersionedStackFile.tsx
@@ -0,0 +1,31 @@
+import { useEffect } from 'react';
+
+import { useStackFile } from '@/react/common/stacks/queries/useStackFile';
+import { Stack } from '@/react/common/stacks/types';
+
+export function useVersionedStackFile({
+  stackId,
+  version,
+  onLoad,
+}: {
+  stackId: Stack['Id'];
+  version?: number;
+  onLoad(content: string): void;
+}) {
+  const fileQuery = useStackFile(stackId, { version }, { enabled: !!version });
+  useEffect(() => {
+    if (fileQuery.isSuccess && fileQuery.data?.StackFileContent) {
+      onLoad(fileQuery.data.StackFileContent);
+    }
+  }, [
+    fileQuery.isSuccess,
+    fileQuery.data?.StackFileContent,
+    onLoad,
+    version, // reload on version change
+  ]);
+
+  return {
+    isLoading: fileQuery.isLoading,
+    content: fileQuery.data?.StackFileContent,
+  };
+}
diff --git a/app/react/docker/stacks/ItemView/StackInfoTab/AssociateStackForm.test.tsx b/app/react/docker/stacks/ItemView/StackInfoTab/AssociateStackForm.test.tsx
new file mode 100644
index 0000000..ea29b56
--- /dev/null
+++ b/app/react/docker/stacks/ItemView/StackInfoTab/AssociateStackForm.test.tsx
@@ -0,0 +1,310 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { delay, http, HttpResponse } from 'msw';
+
+import { server } from '@/setup-tests/server';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { createMockUsers } from '@/react-tools/test-mocks';
+import { useSwarmId } from '@/react/docker/proxy/queries/useSwarm';
+
+import { AssociateStackForm } from './AssociateStackForm';
+
+// Mock the useSwarmId hook to avoid React Query complexity
+vi.mock('@/react/docker/proxy/queries/useSwarm', () => ({
+  useSwarmId: vi.fn(),
+}));
+
+// Mock the AccessControlForm to simplify testing
+vi.mock('@/react/portainer/access-control', () => ({
+  AccessControlForm: vi.fn(({ onChange, values }) => (
+    <div data-cy="access-control-form">
+      <button
+        type="button"
+        onClick={() =>
+          onChange({
+            ...values,
+            ownership: 'private',
+          })
+        }
+      >
+        Change Access Control
+      </button>
+    </div>
+  )),
+}));
+
+beforeEach(() => {
+  vi.mocked(useSwarmId).mockReturnValue({
+    data: undefined,
+  } as ReturnType<typeof useSwarmId>);
+});
+
+afterEach(() => {
+  vi.clearAllMocks();
+});
+
+it('should render correctly', () => {
+  renderComponent();
+
+  expect(screen.getByText('Associate to this environment')).toBeVisible();
+  expect(
+    screen.getByText(/This feature allows you to re-associate this stack/i)
+  ).toBeVisible();
+
+  expect(screen.getByTestId('access-control-form')).toBeVisible();
+  expect(screen.getByRole('button', { name: 'Associate' })).toBeVisible();
+});
+
+describe('form submission', () => {
+  it('should call mutation with correct payload on submit', async () => {
+    let requestUrl = '';
+
+    server.use(
+      http.put<{ id: string }>(
+        '/api/stacks/:id/associate',
+        async ({ request, params }) => {
+          requestUrl = request.url;
+          return HttpResponse.json(createMockStackResponse(params.id));
+        }
+      ),
+      http.put('/api/resource_controls/:id', async ({ request }) => {
+        await request.json();
+        return HttpResponse.json({ success: true });
+      })
+    );
+
+    const user = userEvent.setup();
+    renderComponent({
+      environmentId: 5,
+      stackId: 123,
+      isOrphanedRunning: true,
+    });
+
+    await waitFor(() => {
+      expect(screen.getByRole('button', { name: 'Associate' })).toBeVisible();
+    });
+
+    const associateButton = screen.getByRole('button', { name: 'Associate' });
+    await user.click(associateButton);
+
+    await waitFor(() => {
+      expect(requestUrl).toContain('endpointId=5');
+      expect(requestUrl).toContain('orphanedRunning=true');
+    });
+  });
+
+  it('should show loading state during submission', async () => {
+    let associateCalled = false;
+
+    server.use(
+      http.put('/api/stacks/:id/associate', async () => {
+        associateCalled = true;
+        await delay(50);
+        return HttpResponse.json(createMockStackResponse());
+      }),
+      http.put('/api/resource_controls/:id', () =>
+        HttpResponse.json({ success: true })
+      )
+    );
+
+    const user = userEvent.setup();
+    renderComponent();
+
+    const associateButton = screen.getByRole('button', { name: 'Associate' });
+    await user.click(associateButton);
+
+    // Check for loading text
+    expect(screen.getByText(/association in progress/i)).toBeVisible();
+
+    // Wait for API call
+    await waitFor(
+      () => {
+        expect(associateCalled).toBe(true);
+      },
+      { timeout: 2000 }
+    );
+  });
+
+  it('should complete association successfully', async () => {
+    let associateCalled = false;
+    let resourceControlCalled = false;
+
+    server.use(
+      http.put('/api/stacks/:id/associate', () => {
+        associateCalled = true;
+        return HttpResponse.json(createMockStackResponse());
+      }),
+      http.put('/api/resource_controls/:id', () => {
+        resourceControlCalled = true;
+        return HttpResponse.json({ success: true });
+      })
+    );
+
+    const user = userEvent.setup();
+    renderComponent({ stackName: 'my-stack' });
+
+    const associateButton = screen.getByRole('button', { name: 'Associate' });
+    await user.click(associateButton);
+
+    // Verify both API calls were made
+    await waitFor(
+      () => {
+        expect(associateCalled).toBe(true);
+        expect(resourceControlCalled).toBe(true);
+      },
+      { timeout: 3000 }
+    );
+  });
+});
+
+describe('swarmId integration', () => {
+  it('should pass swarmId when environment is in swarm mode', async () => {
+    let requestUrl = '';
+
+    vi.mocked(useSwarmId).mockReturnValue({
+      data: 'swarm-id-123',
+    } as ReturnType<typeof useSwarmId>);
+
+    server.use(
+      http.put('/api/stacks/:id/associate', async ({ request }) => {
+        requestUrl = request.url;
+        return HttpResponse.json(createMockStackResponse());
+      }),
+      http.put('/api/resource_controls/:id', () =>
+        HttpResponse.json({ success: true })
+      )
+    );
+
+    const user = userEvent.setup();
+    renderComponent({ environmentId: 1 });
+
+    const associateButton = screen.getByRole('button', { name: 'Associate' });
+    await user.click(associateButton);
+
+    await waitFor(() => {
+      expect(requestUrl).toContain('swarmId=swarm-id-123');
+    });
+  });
+
+  it('should not pass swarmId when environment is not in swarm mode', async () => {
+    let requestUrl = '';
+
+    vi.mocked(useSwarmId).mockReturnValue({
+      data: undefined,
+    } as ReturnType<typeof useSwarmId>);
+
+    server.use(
+      http.put('/api/stacks/:id/associate', async ({ request }) => {
+        requestUrl = request.url;
+        return HttpResponse.json(createMockStackResponse());
+      }),
+      http.put('/api/resource_controls/:id', () =>
+        HttpResponse.json({ success: true })
+      )
+    );
+
+    const user = userEvent.setup();
+    renderComponent();
+
+    const associateButton = screen.getByRole('button', { name: 'Associate' });
+    await user.click(associateButton);
+
+    // Verify swarmId is not included in the request
+    await waitFor(() => {
+      expect(requestUrl).not.toContain('swarmId');
+    });
+  });
+});
+
+describe('orphanedRunning parameter', () => {
+  it('should pass isOrphanedRunning=true when provided', async () => {
+    let requestUrl = '';
+
+    server.use(
+      http.put('/api/stacks/:id/associate', async ({ request }) => {
+        requestUrl = request.url;
+        return HttpResponse.json(createMockStackResponse());
+      }),
+      http.put('/api/resource_controls/:id', () =>
+        HttpResponse.json({ success: true })
+      )
+    );
+
+    const user = userEvent.setup();
+    renderComponent({ isOrphanedRunning: true });
+
+    const associateButton = screen.getByRole('button', { name: 'Associate' });
+    await user.click(associateButton);
+
+    await waitFor(() => {
+      expect(requestUrl).toContain('orphanedRunning=true');
+    });
+  });
+
+  it('should pass isOrphanedRunning=false when undefined', async () => {
+    let requestUrl = '';
+
+    server.use(
+      http.put('/api/stacks/:id/associate', async ({ request }) => {
+        requestUrl = request.url;
+        return HttpResponse.json(createMockStackResponse());
+      }),
+      http.put('/api/resource_controls/:id', () =>
+        HttpResponse.json({ success: true })
+      )
+    );
+
+    const user = userEvent.setup();
+    renderComponent({ isOrphanedRunning: undefined });
+
+    const associateButton = screen.getByRole('button', { name: 'Associate' });
+    await user.click(associateButton);
+
+    await waitFor(() => {
+      expect(requestUrl).toContain('orphanedRunning=false');
+    });
+  });
+});
+
+function renderComponent({
+  stackName = 'test-stack',
+  environmentId = 1,
+  stackId = 123,
+  isOrphanedRunning,
+}: Partial<React.ComponentProps<typeof AssociateStackForm>> = {}) {
+  const users = createMockUsers(1, [1]);
+
+  server.use(
+    http.get('/api/users/:id', () => HttpResponse.json(users[0])),
+    http.get('/api/endpoints/:id/docker/swarm', () =>
+      HttpResponse.json({ message: 'Not in swarm mode' }, { status: 503 })
+    )
+  );
+
+  const Wrapped = withTestQueryProvider(
+    withTestRouter(withUserProvider(AssociateStackForm))
+  );
+
+  return render(
+    <Wrapped
+      stackName={stackName}
+      environmentId={environmentId}
+      stackId={stackId}
+      isOrphanedRunning={isOrphanedRunning}
+    />
+  );
+}
+
+function createMockStackResponse(stackId = '123') {
+  return {
+    Id: stackId,
+    Name: 'test-stack',
+    ResourceControl: {
+      Id: 1,
+      ResourceId: stackId,
+      Type: 6,
+    },
+  };
+}
diff --git a/app/react/docker/stacks/ItemView/StackInfoTab/AssociateStackForm.tsx b/app/react/docker/stacks/ItemView/StackInfoTab/AssociateStackForm.tsx
new file mode 100644
index 0000000..d83a1e8
--- /dev/null
+++ b/app/react/docker/stacks/ItemView/StackInfoTab/AssociateStackForm.tsx
@@ -0,0 +1,115 @@
+import { RefreshCw } from 'lucide-react';
+import { Form, Formik, useFormikContext } from 'formik';
+import { object } from 'yup';
+import { useRouter } from '@uirouter/react';
+
+import { AccessControlForm } from '@/react/portainer/access-control';
+import { AccessControlFormData } from '@/react/portainer/access-control/types';
+import { parseAccessControlFormData } from '@/react/portainer/access-control/utils';
+import { useCurrentUser, useIsEdgeAdmin } from '@/react/hooks/useUser';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { validationSchema as accessControlValidation } from '@/react/portainer/access-control/AccessControlForm/AccessControlForm.validation';
+import { useSwarmId } from '@/react/docker/proxy/queries/useSwarm';
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { LoadingButton } from '@@/buttons';
+import { FormSection } from '@@/form-components/FormSection';
+
+import { useAssociateStackToEnvironmentMutation } from './useAssociateStackToEnvironmentMutation';
+
+function validationSchema({ isAdmin }: { isAdmin: boolean }) {
+  return object({
+    accessControl: accessControlValidation(isAdmin),
+  });
+}
+
+export function AssociateStackForm({
+  stackName,
+  environmentId,
+  stackId,
+  isOrphanedRunning,
+}: {
+  stackName: string;
+  environmentId: EnvironmentId;
+  stackId: number;
+  isOrphanedRunning: boolean | undefined;
+}) {
+  const router = useRouter();
+  const swarmIdQuery = useSwarmId(environmentId);
+  const mutation = useAssociateStackToEnvironmentMutation();
+
+  const { user } = useCurrentUser();
+  const { isAdmin } = useIsEdgeAdmin();
+  const initialValues: FormValues = {
+    accessControl: parseAccessControlFormData(isAdmin, user.Id),
+  };
+
+  return (
+    <FormSection title="Associate to this environment">
+      <p className="small text-muted">
+        This feature allows you to re-associate this stack to the current
+        environment.
+      </p>
+
+      <Formik
+        initialValues={initialValues}
+        onSubmit={(values) => {
+          mutation.mutate(
+            {
+              environmentId,
+              accessControl: values.accessControl,
+              swarmId: swarmIdQuery.data,
+              isOrphanedRunning,
+              stackId,
+            },
+            {
+              onSuccess() {
+                notifySuccess('Stack successfully associated', stackName);
+                router.stateService.go('docker.stacks');
+              },
+            }
+          );
+        }}
+        validateOnMount
+        validationSchema={() => validationSchema({ isAdmin })}
+      >
+        <InnerForm environmentId={environmentId} />
+      </Formik>
+    </FormSection>
+  );
+}
+type FormValues = {
+  accessControl: AccessControlFormData;
+};
+
+function InnerForm({ environmentId }: { environmentId: EnvironmentId }) {
+  const { values, setFieldValue, errors, isSubmitting } =
+    useFormikContext<FormValues>();
+
+  return (
+    <Form className="form-horizontal">
+      <AccessControlForm
+        values={values.accessControl}
+        onChange={(newValues) => setFieldValue('accessControl', newValues)}
+        hideTitle
+        environmentId={environmentId}
+        errors={errors.accessControl}
+      />
+      <div className="form-group">
+        <div className="col-sm-12">
+          <LoadingButton
+            color="primary"
+            size="small"
+            isLoading={isSubmitting}
+            loadingText="Association in progress..."
+            icon={RefreshCw}
+            className="-ml-1.25"
+            data-cy="stack-associate-btn"
+          >
+            Associate
+          </LoadingButton>
+        </div>
+      </div>
+    </Form>
+  );
+}
diff --git a/app/react/docker/stacks/ItemView/StackInfoTab/StackActions.tsx b/app/react/docker/stacks/ItemView/StackInfoTab/StackActions.tsx
new file mode 100644
index 0000000..d5fefdc
--- /dev/null
+++ b/app/react/docker/stacks/ItemView/StackInfoTab/StackActions.tsx
@@ -0,0 +1,249 @@
+import {
+  ArrowRightIcon,
+  PlayIcon,
+  PlusIcon,
+  StopCircleIcon,
+  Trash2Icon,
+} from 'lucide-react';
+import { useRouter } from '@uirouter/react';
+
+import { Authorized } from '@/react/hooks/useUser';
+import { Stack, StackStatus } from '@/react/common/stacks/types';
+import { useDeleteStackMutation } from '@/react/common/stacks/queries/useDeleteStackMutation';
+import { notifyError, notifySuccess } from '@/portainer/services/notifications';
+import { EditGitSettingsButton } from '@/react/common/stacks/EditGitSettingsButton';
+import { GitPullButton } from '@/react/common/stacks/GitPullButton';
+
+import { Button, LoadingButton } from '@@/buttons';
+import { Link } from '@@/Link';
+import { confirm, confirmDelete } from '@@/modals/confirm';
+import { ModalType } from '@@/modals/Modal/types';
+import { buildConfirmButton } from '@@/modals/utils';
+
+import { useUpdateStackMutation } from '../../useUpdateStack';
+
+import { useStartStackMutation } from './useStartStackMutation';
+import { useStopStackMutation } from './useStopStackMutation';
+
+export function StackActions({
+  stack,
+  fileContent,
+  isRegular,
+  environmentId,
+  isExternal,
+  status,
+}: {
+  stack: Stack;
+  fileContent?: string;
+  isRegular?: boolean;
+  environmentId: number;
+  isExternal: boolean;
+  status: Stack['Status'];
+}) {
+  const router = useRouter();
+  const startStackMutation = useStartStackMutation();
+  const stopStackMutation = useStopStackMutation();
+  const deleteStackMutation = useDeleteStackMutation();
+  const detachFromGitMutation = useUpdateStackMutation();
+
+  const isMutating =
+    startStackMutation.isLoading ||
+    stopStackMutation.isLoading ||
+    deleteStackMutation.isLoading ||
+    detachFromGitMutation.isLoading;
+
+  const isDeploying = status === StackStatus.Deploying;
+
+  const stackId = stack.Id;
+
+  return (
+    <div className="flex items-center gap-2">
+      {isRegular && (
+        <Authorized authorizations="PortainerStackUpdate">
+          {(status === StackStatus.Active || status === StackStatus.Error) && (
+            <Button
+              icon={StopCircleIcon}
+              color="dangerlight"
+              size="small"
+              onClick={() => handleStop()}
+              disabled={isMutating}
+              data-cy="stack-stop-btn"
+            >
+              Stop this stack
+            </Button>
+          )}
+          {status === StackStatus.Inactive && (
+            <Button
+              icon={PlayIcon}
+              color="success"
+              data-cy="stack-start-btn"
+              size="small"
+              disabled={isMutating}
+              onClick={() => handleStart()}
+            >
+              Start this stack
+            </Button>
+          )}
+        </Authorized>
+      )}
+
+      <Authorized authorizations="PortainerStackDelete">
+        <Button
+          icon={Trash2Icon}
+          color="dangerlight"
+          size="small"
+          onClick={() => handleDelete()}
+          disabled={isMutating || isDeploying}
+          data-cy="stack-delete-btn"
+        >
+          Delete this stack
+        </Button>
+      </Authorized>
+
+      {!!(isRegular && fileContent) && (
+        <Button
+          as={Link}
+          icon={PlusIcon}
+          color="primary"
+          size="small"
+          data-cy="stack-create-template-btn"
+          props={{
+            to: 'docker.templates.custom.new',
+            params: {
+              fileContent,
+              type: stack.Type,
+            },
+          }}
+        >
+          Create template from stack
+        </Button>
+      )}
+
+      {!!stack.GitConfig && !stack.FromAppTemplate && (
+        <>
+          <EditGitSettingsButton stack={stack} />
+
+          <GitPullButton stack={stack} />
+
+          {!!(isRegular && fileContent) && (
+            <Authorized authorizations="PortainerStackUpdate">
+              <LoadingButton
+                icon={ArrowRightIcon}
+                color="primary"
+                onClick={() => handleDetachFromGit()}
+                disabled={isMutating}
+                data-cy="stack-detach-git-btn"
+                isLoading={detachFromGitMutation.isLoading}
+                loadingText="Detachment in progress..."
+              >
+                Detach from Git
+              </LoadingButton>
+            </Authorized>
+          )}
+        </>
+      )}
+    </div>
+  );
+
+  function handleStart() {
+    startStackMutation.mutate(
+      { id: stackId, environmentId },
+      {
+        onError(err) {
+          notifyError('Failure', err as Error, 'Unable to start stack');
+          router.stateService.reload();
+        },
+        onSuccess() {
+          notifySuccess('Success', `Stack ${stack.Name} started successfully`);
+          router.stateService.reload();
+        },
+      }
+    );
+  }
+
+  async function handleStop() {
+    const confirmed = await confirm({
+      title: 'Are you sure?',
+      modalType: ModalType.Warn,
+      message: 'Are you sure you want to stop this stack?',
+      confirmButton: buildConfirmButton('Stop', 'danger'),
+    });
+
+    if (!confirmed) {
+      return;
+    }
+
+    stopStackMutation.mutate(
+      { id: stackId, environmentId },
+      {
+        onError(err) {
+          notifyError('Failure', err as Error, 'Unable to stop stack');
+        },
+        onSuccess() {
+          notifySuccess('Success', `Stack ${stack.Name} stopped successfully`);
+          router.stateService.reload();
+        },
+      }
+    );
+  }
+
+  async function handleDelete() {
+    const confirmed = await confirmDelete(
+      'Do you want to remove the stack? Associated services will be removed as well'
+    );
+    if (!confirmed) {
+      return;
+    }
+    deleteStackMutation.mutate(
+      {
+        id: stack.Id,
+        name: stack.Name,
+        environmentId: stack.EndpointId,
+        external: isExternal,
+      },
+      {
+        onError(err) {
+          notifyError(
+            'Failure',
+            err as Error,
+            `Unable to remove stack ${stack.Name}`
+          );
+        },
+        onSuccess() {
+          notifySuccess('Stack successfully removed', stack.Name);
+          router.stateService.go('^');
+        },
+      }
+    );
+  }
+
+  async function handleDetachFromGit() {
+    const confirmed = await confirm({
+      modalType: ModalType.Warn,
+      title: 'Are you sure?',
+      message: 'Do you want to detach the stack from Git?',
+      confirmButton: buildConfirmButton('Detach', 'danger'),
+    });
+
+    if (!confirmed) {
+      return;
+    }
+
+    detachFromGitMutation.mutate(
+      {
+        environmentId,
+        stackId: stack.Id,
+        payload: {
+          stackFileContent: fileContent!,
+          env: stack.Env,
+          prune: false,
+        },
+      },
+      {
+        onSuccess() {
+          router.stateService.go('^');
+        },
+      }
+    );
+  }
+}
diff --git a/app/react/docker/stacks/ItemView/StackInfoTab/StackDuplicationForm/EnvSelector.test.tsx b/app/react/docker/stacks/ItemView/StackInfoTab/StackDuplicationForm/EnvSelector.test.tsx
new file mode 100644
index 0000000..4bb5eb9
--- /dev/null
+++ b/app/react/docker/stacks/ItemView/StackInfoTab/StackDuplicationForm/EnvSelector.test.tsx
@@ -0,0 +1,204 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import { http, HttpResponse } from 'msw';
+
+import { server } from '@/setup-tests/server';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { EnvironmentGroup } from '@/react/portainer/environments/environment-groups/types';
+import {
+  createMockEnvironment,
+  createMockEnvironmentGroup,
+} from '@/react-tools/test-mocks';
+import { Environment } from '@/react/portainer/environments/types';
+
+import { EnvSelector, getEnvironmentOptions } from './EnvSelector';
+
+describe('EnvSelector', () => {
+  it('should render when environment options are available', async () => {
+    const mockEnvironments = [
+      createMockEnvironment({
+        Id: 1,
+        Name: 'Environment 1',
+        GroupId: 1,
+      }),
+      createMockEnvironment({
+        Id: 2,
+        Name: 'Environment 2',
+        GroupId: 1,
+      }),
+    ];
+
+    const mockGroups = [
+      createMockEnvironmentGroup({
+        Id: 1,
+        Name: 'Unassigned',
+      }),
+    ];
+
+    renderComponent({
+      environments: mockEnvironments,
+      groups: mockGroups,
+    });
+    await waitFor(() => {
+      // render select
+      const select = screen.getByRole('combobox');
+      expect(select).toBeVisible();
+
+      // placeholder text
+      expect(screen.getByText('Select an environment')).toBeVisible();
+
+      // no error displayed
+      expect(screen.queryByRole('alert')).not.toBeInTheDocument();
+
+      // data-cy
+      expect(
+        screen.getByTestId('stack-duplicate-environment-select')
+      ).toBeInTheDocument();
+    });
+  });
+
+  it('should return null when no environment options exist', async () => {
+    const { container } = renderComponent();
+
+    await waitFor(() => {
+      expect(container.firstChild).toBeNull();
+    });
+  });
+
+  it('should display FormError when error prop is provided', async () => {
+    const mockEnvironments = [
+      createMockEnvironment({
+        Id: 1,
+        Name: 'Environment 1',
+        GroupId: 1,
+      }),
+    ];
+
+    const mockGroups: EnvironmentGroup[] = [
+      createMockEnvironmentGroup({
+        Id: 1,
+        Name: 'Group 1',
+      }),
+    ];
+
+    const error = 'Environment is required';
+
+    renderComponent({
+      environments: mockEnvironments,
+      groups: mockGroups,
+      error,
+    });
+
+    await waitFor(() => {
+      expect(screen.getByRole('alert', { name: error })).toBeVisible();
+    });
+  });
+
+  function renderComponent({
+    environments = [],
+    groups = [],
+    onChange = vi.fn(),
+    error,
+  }: {
+    environments?: Environment[];
+    groups?: EnvironmentGroup[];
+    onChange?: (value: number | undefined) => void;
+    error?: string;
+  } = {}) {
+    const Component = withTestQueryProvider(EnvSelector);
+
+    server.use(
+      http.get('/api/endpoints', () => HttpResponse.json(environments)),
+      http.get('/api/endpoint_groups', () => HttpResponse.json(groups))
+    );
+
+    return render(
+      <Component value={undefined} onChange={onChange} error={error} />
+    );
+  }
+});
+
+describe('getEnvironmentOptions', () => {
+  it('should return empty array when no data provided', () => {
+    expect(getEnvironmentOptions([], [])).toEqual([]);
+
+    expect(
+      getEnvironmentOptions(
+        [
+          createMockEnvironmentGroup({
+            Id: 1,
+            Name: 'Group 1',
+          }),
+        ],
+        []
+      )
+    ).toEqual([]);
+  });
+
+  it('should exclude current environment when currentEnvironmentId is provided', () => {
+    const groups: EnvironmentGroup[] = [
+      createMockEnvironmentGroup({
+        Id: 1,
+        Name: 'Group 1',
+      }),
+    ];
+    const environments = [
+      createMockEnvironment({ Id: 1, Name: 'Env 1', GroupId: 1 }),
+      createMockEnvironment({ Id: 2, Name: 'Env 2', GroupId: 1 }),
+    ];
+
+    const result = getEnvironmentOptions(groups, environments, 1);
+
+    expect(result).toHaveLength(1);
+    expect(result[0].options).toHaveLength(1);
+    expect(result[0].options[0]).toEqual({ label: 'Env 2', value: 2 });
+  });
+
+  it('should group environments by GroupId with correct structure', () => {
+    const groups: EnvironmentGroup[] = [
+      createMockEnvironmentGroup({
+        Id: 1,
+        Name: 'Group 1',
+      }),
+      createMockEnvironmentGroup({
+        Id: 2,
+        Name: 'Group 2',
+      }),
+    ];
+    const environments = [
+      createMockEnvironment({ Id: 1, Name: 'Env 1', GroupId: 1 }),
+      createMockEnvironment({ Id: 2, Name: 'Env 2', GroupId: 1 }),
+      createMockEnvironment({ Id: 3, Name: 'Env 3', GroupId: 2 }),
+    ];
+
+    const result = getEnvironmentOptions(groups, environments);
+
+    expect(result).toHaveLength(2);
+    expect(result[0]).toEqual({
+      label: 'Group 1',
+      options: [
+        { label: 'Env 1', value: 1 },
+        { label: 'Env 2', value: 2 },
+      ],
+    });
+    expect(result[1]).toEqual({
+      label: 'Group 2',
+      options: [{ label: 'Env 3', value: 3 }],
+    });
+  });
+
+  it('should auto create an Others group if group is missing', () => {
+    const environments = [
+      createMockEnvironment({ Id: 1, Name: 'Env 1', GroupId: 1 }),
+      createMockEnvironment({ Id: 2, Name: 'Env 2', GroupId: 2 }),
+    ];
+    const groups: EnvironmentGroup[] = [];
+
+    const result = getEnvironmentOptions(groups, environments);
+    expect(result.length).toBe(1);
+    expect(result[0].label).toBe('Others');
+    expect(result[0].options).toEqual([
+      { label: 'Env 1', value: 1 },
+      { label: 'Env 2', value: 2 },
+    ]);
+  });
+});
diff --git a/app/react/docker/stacks/ItemView/StackInfoTab/StackDuplicationForm/EnvSelector.tsx b/app/react/docker/stacks/ItemView/StackInfoTab/StackDuplicationForm/EnvSelector.tsx
new file mode 100644
index 0000000..bbb39e1
--- /dev/null
+++ b/app/react/docker/stacks/ItemView/StackInfoTab/StackDuplicationForm/EnvSelector.tsx
@@ -0,0 +1,101 @@
+import { useMemo } from 'react';
+import { sortBy } from 'lodash';
+
+import { useEnvironmentList } from '@/react/portainer/environments/queries';
+import { useGroups } from '@/react/portainer/environments/environment-groups/queries';
+import { Environment } from '@/react/portainer/environments/types';
+import { EnvironmentGroup } from '@/react/portainer/environments/environment-groups/types';
+
+import {
+  PortainerSelect,
+  GroupOption,
+} from '@@/form-components/PortainerSelect';
+import { FormError } from '@@/form-components/FormError';
+
+export function EnvSelector({
+  value,
+  onChange,
+  error,
+}: {
+  value: number | undefined;
+  onChange: (value: number | undefined) => void;
+  error?: string;
+}) {
+  const envsQuery = useEnvironmentList();
+  const groupsQuery = useGroups();
+
+  const environmentOptions = useMemo(() => {
+    if (!envsQuery.environments || !groupsQuery.data) {
+      return [];
+    }
+
+    return getEnvironmentOptions(groupsQuery.data, envsQuery.environments);
+  }, [envsQuery.environments, groupsQuery.data]);
+
+  if (!environmentOptions.length) {
+    return null;
+  }
+
+  return (
+    <div className="form-group">
+      <PortainerSelect
+        value={value}
+        onChange={onChange}
+        options={environmentOptions}
+        placeholder="Select an environment"
+        data-cy="stack-duplicate-environment-select"
+      />
+      {error && (
+        <div className="col-sm-12">
+          <FormError>{error}</FormError>
+        </div>
+      )}
+    </div>
+  );
+}
+
+/**
+ * Transforms environments and groups into grouped options for PortainerSelect
+ */
+export function getEnvironmentOptions(
+  groups: EnvironmentGroup[],
+  environments: Environment[],
+  currentEnvironmentId?: number
+): GroupOption<number>[] {
+  if (!groups || !environments) {
+    return [];
+  }
+
+  // Group environments by their GroupId
+  const groupedEnvironments = environments.reduce<
+    Record<number, Array<{ label: string; value: number }>>
+  >((acc, environment) => {
+    if (environment.Id === currentEnvironmentId) {
+      return acc;
+    }
+
+    let groupId = environment.GroupId;
+    if (!groups.some((g) => g.Id === groupId)) {
+      groupId = -1;
+    }
+
+    if (!acc[groupId]) {
+      acc[groupId] = [];
+    }
+    acc[groupId].push({
+      label: environment.Name,
+      value: environment.Id,
+    });
+    return acc;
+  }, {});
+
+  return Object.entries(groupedEnvironments).map(([groupId, envOptions]) => {
+    const parsedGroupId = parseInt(groupId, 10);
+    const group = groups.find((g) => g.Id === parsedGroupId);
+
+    return {
+      label: group?.Name || 'Others',
+      options: sortBy(envOptions, 'label'),
+    };
+  });
+}
diff --git a/app/react/docker/stacks/ItemView/StackInfoTab/StackDuplicationForm/StackDuplicationForm.test.tsx b/app/react/docker/stacks/ItemView/StackInfoTab/StackDuplicationForm/StackDuplicationForm.test.tsx
new file mode 100644
index 0000000..75a7bd4
--- /dev/null
+++ b/app/react/docker/stacks/ItemView/StackInfoTab/StackDuplicationForm/StackDuplicationForm.test.tsx
@@ -0,0 +1,95 @@
+import { render, waitFor } from '@testing-library/react';
+import { http, HttpResponse } from 'msw';
+import { UIRouterContext, UIRouterReact } from '@uirouter/react';
+
+import { server } from '@/setup-tests/server';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { EnvironmentGroup } from '@/react/portainer/environments/environment-groups/types';
+import { Stack } from '@/react/common/stacks/types';
+import {
+  createMockEnvironment,
+  createMockEnvironmentGroup,
+  createMockStack,
+} from '@/react-tools/test-mocks';
+
+import { StackDuplicationForm } from './StackDuplicationForm';
+
+it('should render Widget with title and inner component', async () => {
+  const { getByText } = renderComponent();
+
+  expect(getByText('Stack duplication / migration')).toBeVisible();
+  await waitFor(() => {
+    expect(
+      getByText('This feature allows you to duplicate or migrate this stack.')
+    ).toBeVisible();
+  });
+});
+
+it('should initialize form with empty name and no selected environment', async () => {
+  const { getByPlaceholderText, getByRole } = renderComponent();
+
+  await waitFor(() => {
+    expect(
+      getByPlaceholderText('Stack name (optional for migration)')
+    ).toHaveValue('');
+    expect(getByRole('button', { name: /migrate/i })).toBeDisabled();
+    expect(getByRole('button', { name: /duplicate/i })).toBeDisabled();
+  });
+});
+
+it('should display rename help text', async () => {
+  const { getByText } = renderComponent();
+
+  await waitFor(() => {
+    expect(
+      getByText(
+        'To rename the stack, choose the same environment when migrating.'
+      )
+    ).toBeVisible();
+  });
+});
+
+function renderComponent({
+  stack = createMockStack(),
+  currentEnvironmentId = 1,
+  yamlError,
+  originalFileContent = 'version: "3"\nservices:\n  app:\n    image: nginx',
+}: {
+  stack?: Stack;
+  currentEnvironmentId?: number;
+  yamlError?: string;
+  originalFileContent?: string;
+} = {}) {
+  const mockEnvironments = [
+    createMockEnvironment({ Id: 1, Name: 'Current Environment', GroupId: 1 }),
+    createMockEnvironment({ Id: 2, Name: 'Target Environment', GroupId: 1 }),
+  ];
+
+  const mockGroups: EnvironmentGroup[] = [
+    createMockEnvironmentGroup({ Id: 1, Name: 'Unassigned' }),
+  ];
+
+  server.use(
+    http.get('/api/endpoints', () => HttpResponse.json(mockEnvironments)),
+    http.get('/api/endpoint_groups', () => HttpResponse.json(mockGroups))
+  );
+
+  const mockRouter = {
+    stateService: {
+      go: vi.fn(),
+    },
+  } as unknown as UIRouterReact;
+
+  const Component = withTestQueryProvider(() => (
+    <UIRouterContext.Provider value={mockRouter}>
+      <StackDuplicationForm
+        stack={stack}
+        currentEnvironmentId={currentEnvironmentId}
+        yamlError={yamlError}
+        originalFileContent={originalFileContent}
+      />
+    </UIRouterContext.Provider>
+  ));
+
+  return { ...render(<Component />), mockRouter };
+}
diff --git a/app/react/docker/stacks/ItemView/StackInfoTab/StackDuplicationForm/StackDuplicationForm.tsx b/app/react/docker/stacks/ItemView/StackInfoTab/StackDuplicationForm/StackDuplicationForm.tsx
new file mode 100644
index 0000000..e91807f
--- /dev/null
+++ b/app/react/docker/stacks/ItemView/StackInfoTab/StackDuplicationForm/StackDuplicationForm.tsx
@@ -0,0 +1,175 @@
+import { Formik } from 'formik';
+import { Copy } from 'lucide-react';
+import { useRouter } from '@uirouter/react';
+
+import { notifyError, notifySuccess } from '@/portainer/services/notifications';
+import { Stack } from '@/react/common/stacks/types';
+
+import { Widget } from '@@/Widget';
+import { WidgetBody } from '@@/Widget/WidgetBody';
+import { WidgetTitle } from '@@/Widget/WidgetTitle';
+import { validateForm } from '@@/form-components/validate-form';
+import { confirm } from '@@/modals/confirm';
+import { ModalType } from '@@/modals';
+import { buildConfirmButton } from '@@/modals/utils';
+
+import { FormSubmitValues } from './StackDuplicationForm.types';
+import { StackDuplicationFormInner } from './StackDuplicationFormInner';
+import {
+  getBaseValidationSchema,
+  getDuplicateValidationSchema,
+  getMigrateValidationSchema,
+} from './StackDuplicationForm.validation';
+import { useDuplicateStackMutation } from './useDuplicateStackMutation';
+import { useMigrateStackMutation } from './useMigrateStackMutation';
+
+interface StackDuplicationFormProps {
+  currentEnvironmentId: number;
+
+  yamlError?: string;
+
+  originalFileContent: string;
+  stack: Stack;
+}
+
+export function StackDuplicationForm({
+  yamlError,
+  originalFileContent,
+  currentEnvironmentId,
+  stack,
+}: StackDuplicationFormProps) {
+  const router = useRouter();
+  const duplicateMutation = useDuplicateStackMutation();
+  const migrateMutation = useMigrateStackMutation();
+  const initialValues: FormSubmitValues = {
+    environmentId: undefined,
+    newName: '',
+    actionType: 'migrate', // Default value, will be set by button clicks
+  };
+
+  return (
+    <Widget>
+      <WidgetTitle title="Stack duplication / migration" icon={Copy} />
+      <WidgetBody>
+        <Formik
+          initialValues={initialValues}
+          onSubmit={handleSubmit}
+          validateOnMount
+          validationSchema={getBaseValidationSchema()}
+        >
+          <StackDuplicationFormInner
+            yamlError={yamlError}
+            currentEnvironmentId={currentEnvironmentId}
+            currentStackName={stack.Name}
+            isLoading={migrateMutation.isLoading || duplicateMutation.isLoading}
+          />
+        </Formik>
+      </WidgetBody>
+    </Widget>
+  );
+
+  async function handleSubmit(values: FormSubmitValues) {
+    const { actionType, environmentId, newName } = values;
+
+    switch (actionType) {
+      case 'duplicate':
+        await handleDuplicate(environmentId!, newName);
+        break;
+      case 'migrate':
+        await handleMigrate(environmentId!, newName);
+        break;
+      default:
+        break;
+    }
+  }
+
+  async function handleDuplicate(environmentId: number, name: string) {
+    const schema = getDuplicateValidationSchema();
+    const errors = await validateForm(() => schema, { environmentId, name });
+    if (errors) {
+      notifyError(
+        'Validation Error',
+        undefined,
+        'Please fix the errors and try again.'
+      );
+      return;
+    }
+
+    duplicateMutation.mutate(
+      {
+        fileContent: originalFileContent,
+        name,
+        type: stack.Type,
+        env: stack.Env,
+        targetEnvironmentId: environmentId,
+      },
+      {
+        onSuccess() {
+          notifySuccess('Success', 'Stack successfully duplicated');
+          router.stateService.go('docker.stacks', {}, { reload: true });
+        },
+        onError(error) {
+          notifyError('Failure', error as Error, 'Unable to duplicate stack');
+        },
+      }
+    );
+  }
+
+  async function handleMigrate(
+    environmentId: number,
+    name: string | undefined
+  ) {
+    const isRename = environmentId === currentEnvironmentId;
+
+    const confirmed = await confirm({
+      title: 'Are you sure?',
+      modalType: ModalType.Warn,
+      message: isRename
+        ? 'This action will deploy a new instance of this stack with the new name that will replace the current stack. Please note that this does NOT migrate the content of any persistent volumes that may be attached to this stack.'
+        : 'This action will deploy a new instance of this stack on the target environment, please note that this does NOT relocate the content of any persistent volumes that may be attached to this stack.',
+      confirmButton: buildConfirmButton(
+        isRename ? 'Rename' : 'Migrate',
+        'danger'
+      ),
+    });
+
+    if (!confirmed) {
+      return;
+    }
+
+    const schema = getMigrateValidationSchema(stack.Name, currentEnvironmentId);
+    const errors = await validateForm(() => schema, {
+      environmentId,
+      name,
+    });
+
+    if (errors) {
+      notifyError(
+        'Validation Error',
+        undefined,
+        'Please fix the errors and try again.'
+      );
+      return;
+    }
+
+    migrateMutation.mutate(
+      {
+        name,
+        stackType: stack.Type,
+        fromEnvId: currentEnvironmentId,
+        id: stack.Id,
+        targetEnvId: environmentId,
+        fromSwarmId: stack.SwarmId,
+      },
+      {
+        onSuccess() {
+          notifySuccess('Stack successfully migrated', name || stack.Name);
+          router.stateService.go('docker.stacks', {}, { reload: true });
+        },
+        onError(error) {
+          notifyError('Failure', error as Error, 'Unable to migrate stack');
+        },
+      }
+    );
+  }
+}
diff --git a/app/react/docker/stacks/ItemView/StackInfoTab/StackDuplicationForm/StackDuplicationForm.types.ts b/app/react/docker/stacks/ItemView/StackInfoTab/StackDuplicationForm/StackDuplicationForm.types.ts
new file mode 100644
index 0000000..a858065
--- /dev/null
+++ b/app/react/docker/stacks/ItemView/StackInfoTab/StackDuplicationForm/StackDuplicationForm.types.ts
@@ -0,0 +1,10 @@
+export interface FormValues {
+  environmentId: number | undefined;
+  newName: string;
+}
+
+export type ActionType = 'duplicate' | 'migrate';
+
+export interface FormSubmitValues extends FormValues {
+  actionType: ActionType;
+}
diff --git a/app/react/docker/stacks/ItemView/StackInfoTab/StackDuplicationForm/StackDuplicationForm.validation.test.ts b/app/react/docker/stacks/ItemView/StackInfoTab/StackDuplicationForm/StackDuplicationForm.validation.test.ts
new file mode 100644
index 0000000..173df92
--- /dev/null
+++ b/app/react/docker/stacks/ItemView/StackInfoTab/StackDuplicationForm/StackDuplicationForm.validation.test.ts
@@ -0,0 +1,320 @@
+import { waitFor } from '@testing-library/react';
+import { renderHook } from '@testing-library/react-hooks';
+import type { AnySchema } from 'yup';
+
+import {
+  getDuplicateValidationSchema,
+  getMigrateValidationSchema,
+  useValidation,
+} from './StackDuplicationForm.validation';
+import { FormSubmitValues } from './StackDuplicationForm.types';
+
+describe('getDuplicateValidationSchema', () => {
+  const schema = getDuplicateValidationSchema();
+
+  describe('name validation', () => {
+    it.each([
+      {
+        name: '',
+        environmentId: 2,
+        error: 'Stack name is required',
+        scenario: 'should fail with empty name',
+      },
+      {
+        name: 'mystack123',
+        environmentId: 2,
+        error: '',
+        scenario: 'should be valid with lowercase alphanumeric',
+      },
+      {
+        name: 'my_stack',
+        environmentId: 2,
+        error: '',
+        scenario: 'should be valid with underscores',
+      },
+      {
+        name: 'my-stack',
+        environmentId: 2,
+        error: '',
+        scenario: 'should be valid with hyphens',
+      },
+      {
+        name: 'my_stack-123',
+        environmentId: 2,
+        error: '',
+        scenario: 'should be valid with underscores and hyphens',
+      },
+      {
+        name: 'MyStack',
+        environmentId: 2,
+        error:
+          "Stack name must consist of lower case alphanumeric characters, '_' or '-'",
+        scenario: 'should fail with uppercase letters',
+      },
+      {
+        name: 'my stack',
+        environmentId: 2,
+        error:
+          "Stack name must consist of lower case alphanumeric characters, '_' or '-'",
+        scenario: 'should fail with spaces',
+      },
+      {
+        name: 'my@stack',
+        environmentId: 2,
+        error:
+          "Stack name must consist of lower case alphanumeric characters, '_' or '-'",
+        scenario: 'should fail with special characters',
+      },
+    ])('$scenario', async ({ name, environmentId, error }) => {
+      const promise = schema.validate({ name, environmentId });
+      if (error) {
+        await expect(promise).rejects.toThrow(error);
+      } else {
+        await expect(promise).resolves.toBeTruthy();
+      }
+    });
+  });
+
+  describe('environmentId validation', () => {
+    testEnvironmentIdValidation(schema);
+  });
+});
+
+describe('getMigrateValidationSchema', () => {
+  const currentStackName = 'test-stack';
+  const currentEnvironmentId = 1;
+  const schema = getMigrateValidationSchema(
+    currentStackName,
+    currentEnvironmentId
+  );
+
+  describe('name validation (optional)', () => {
+    it.each([
+      {
+        name: '',
+        environmentId: 2,
+        error: '',
+        scenario: 'should be valid with empty string',
+      },
+      {
+        name: undefined,
+        environmentId: 2,
+        error: '',
+        scenario: 'should be valid with undefined',
+      },
+      {
+        name: 'mystack',
+        environmentId: 2,
+        error: '',
+        scenario: 'should be valid with lowercase alphanumeric',
+      },
+      {
+        name: 'my_stack-123',
+        environmentId: 2,
+        error: '',
+        scenario: 'should be valid with underscores and hyphens',
+      },
+      {
+        name: 'MyStack',
+        environmentId: 2,
+        error:
+          "Stack name must consist of lower case alphanumeric characters, '_' or '-'",
+        scenario: 'should fail with uppercase letters',
+      },
+      {
+        name: 'my@stack',
+        environmentId: 2,
+        error:
+          "Stack name must consist of lower case alphanumeric characters, '_' or '-'",
+        scenario: 'should fail with special characters',
+      },
+    ])('$scenario', async ({ name, environmentId, error }) => {
+      const promise = schema.validate({ name, environmentId });
+      if (error) {
+        await expect(promise).rejects.toThrow(error);
+      } else {
+        await expect(promise).resolves.toBeTruthy();
+      }
+    });
+  });
+
+  describe('environmentId validation', () => {
+    testEnvironmentIdValidation(schema);
+  });
+
+  describe('rename validation (same environment)', () => {
+    it.each([
+      {
+        name: currentStackName,
+        environmentId: currentEnvironmentId,
+        error: "Can't rename to the same name",
+        scenario: 'should fail when renaming to same name',
+      },
+      {
+        name: '',
+        environmentId: currentEnvironmentId,
+        error: 'Stack name is required when renaming',
+        scenario: 'should fail when renaming with empty name',
+      },
+      {
+        name: undefined,
+        environmentId: currentEnvironmentId,
+        error: 'Stack name is required when renaming',
+        scenario: 'should fail when renaming with undefined name',
+      },
+      {
+        name: 'new-stack-name',
+        environmentId: currentEnvironmentId,
+        error: '',
+        scenario: 'should be valid when renaming to different name',
+      },
+    ])('$scenario', async ({ name, environmentId, error }) => {
+      const promise = schema.validate({ name, environmentId });
+      if (error) {
+        await expect(promise).rejects.toThrow(error);
+      } else {
+        await expect(promise).resolves.toBeTruthy();
+      }
+    });
+  });
+
+  describe('migrate validation (different environment)', () => {
+    it.each([
+      {
+        name: '',
+        environmentId: 2,
+        error: '',
+        scenario: 'should be valid when migrating with empty name',
+      },
+      {
+        name: undefined,
+        environmentId: 2,
+        error: '',
+        scenario: 'should be valid when migrating with undefined name',
+      },
+      {
+        name: currentStackName,
+        environmentId: 2,
+        error: '',
+        scenario:
+          'should be valid when migrating with same name to different environment',
+      },
+      {
+        name: 'new-stack-name',
+        environmentId: 2,
+        error: '',
+        scenario:
+          'should be valid when migrating with different name to different environment',
+      },
+    ])('$scenario', async ({ name, environmentId, error }) => {
+      const promise = schema.validate({ name, environmentId });
+      if (error) {
+        await expect(promise).rejects.toThrow(error);
+      } else {
+        await expect(promise).resolves.toBeTruthy();
+      }
+    });
+  });
+});
+
+describe('useValidation', () => {
+  const currentStackName = 'test-stack';
+  const currentEnvironmentId = 1;
+
+  it('should start with both migrate and duplicate as false', () => {
+    const { result } = renderHook(() =>
+      useValidation({
+        values: {
+          environmentId: undefined,
+          newName: '',
+          actionType: 'migrate',
+        },
+        currentStackName,
+        currentEnvironmentId,
+      })
+    );
+
+    expect(result.current.migrate).toBe(false);
+    expect(result.current.duplicate).toBe(false);
+  });
+
+  describe('reactive updates', () => {
+    it('should revalidate when environmentId changes', async () => {
+      const { result, rerender } = renderHook(
+        ({ values }: { values: FormSubmitValues }) =>
+          useValidation({ values, currentStackName, currentEnvironmentId }),
+        {
+          initialProps: {
+            values: {
+              environmentId: undefined as number | undefined,
+              newName: 'mystack',
+              actionType: 'duplicate' as const,
+            },
+          },
+        }
+      );
+
+      await waitFor(() => {
+        expect(result.current.duplicate).toBe(false);
+      });
+
+      rerender({
+        values: {
+          environmentId: 2,
+          newName: 'mystack',
+          actionType: 'duplicate',
+        },
+      });
+
+      await waitFor(() => {
+        expect(result.current.duplicate).toBe(true);
+      });
+    });
+
+    it('should revalidate when newName changes', async () => {
+      const { result, rerender } = renderHook(
+        ({ values }: { values: FormSubmitValues }) =>
+          useValidation({ values, currentStackName, currentEnvironmentId }),
+        {
+          initialProps: {
+            values: {
+              environmentId: 2,
+              newName: '',
+              actionType: 'duplicate' as const,
+            },
+          },
+        }
+      );
+
+      await waitFor(() => {
+        expect(result.current.duplicate).toBe(false);
+      });
+
+      rerender({
+        values: {
+          environmentId: 2,
+          newName: 'mystack',
+          actionType: 'duplicate',
+        },
+      });
+
+      await waitFor(() => {
+        expect(result.current.duplicate).toBe(true);
+      });
+    });
+  });
+});
+
+function testEnvironmentIdValidation(schema: AnySchema) {
+  it('should require environmentId', async () => {
+    await expect(
+      schema.validate({ name: 'mystack', environmentId: undefined })
+    ).rejects.toThrow('Target environment must be selected');
+  });
+
+  it('should accept valid environmentId', async () => {
+    await expect(
+      schema.validate({ name: 'mystack', environmentId: 2 })
+    ).resolves.toBeTruthy();
+  });
+}
diff --git a/app/react/docker/stacks/ItemView/StackInfoTab/StackDuplicationForm/StackDuplicationForm.validation.ts b/app/react/docker/stacks/ItemView/StackInfoTab/StackDuplicationForm/StackDuplicationForm.validation.ts
new file mode 100644
index 0000000..3ce9c4a
--- /dev/null
+++ b/app/react/docker/stacks/ItemView/StackInfoTab/StackDuplicationForm/StackDuplicationForm.validation.ts
@@ -0,0 +1,133 @@
+import { object, string, number } from 'yup';
+import { useEffect, useState } from 'react';
+
+import { STACK_NAME_VALIDATION_REGEX } from '@/react/constants';
+
+import { validateForm } from '@@/form-components/validate-form';
+
+import { FormSubmitValues } from './StackDuplicationForm.types';
+
+/**
+ * since this form has two actions, we need to manage separate validation state. Ideally we would use separate forms
+ */
+export function useValidation({
+  values,
+  currentStackName,
+  currentEnvironmentId,
+}: {
+  values: FormSubmitValues;
+  currentStackName: string;
+  currentEnvironmentId: number;
+}) {
+  const [validState, setValidState] = useState({
+    migrate: false,
+    duplicate: false,
+  });
+
+  useEffect(() => {
+    async function validateSchemas() {
+      const migrateSchema = getMigrateValidationSchema(
+        currentStackName,
+        currentEnvironmentId
+      );
+
+      const migrateErrors = await validateForm(() => migrateSchema, {
+        environmentId: values.environmentId || undefined,
+        name: values.newName,
+      });
+
+      setValidState((state) => ({ ...state, migrate: !migrateErrors }));
+    }
+
+    validateSchemas();
+  }, [
+    values.environmentId,
+    values.newName,
+    currentStackName,
+    currentEnvironmentId,
+  ]);
+
+  useEffect(() => {
+    async function validateSchema() {
+      const duplicateSchema = getDuplicateValidationSchema();
+      const duplicateErrors = await validateForm(() => duplicateSchema, {
+        environmentId: values.environmentId || undefined,
+        name: values.newName,
+      });
+
+      setValidState((state) => ({ ...state, duplicate: !duplicateErrors }));
+    }
+    validateSchema();
+  }, [values.environmentId, values.newName]);
+
+  return validState;
+}
+
+const regexp = new RegExp(STACK_NAME_VALIDATION_REGEX);
+
+const baseNameValidation = string().test(
+  'valid-format-if-provided',
+  "Stack name must consist of lower case alphanumeric characters, '_' or '-'",
+  (value) => !value || regexp.test(value)
+);
+
+const baseEnvValidation = number().required(
+  'Target environment must be selected'
+);
+
+export function getBaseValidationSchema() {
+  return object({
+    name: baseNameValidation,
+    environmentId: baseEnvValidation,
+  });
+}
+
+export function getDuplicateValidationSchema() {
+  return object({
+    name: baseNameValidation.required('Stack name is required'),
+    environmentId: baseEnvValidation,
+  });
+}
+
+export function getMigrateValidationSchema(
+  currentStackName?: string,
+  currentEnvironmentId?: number
+) {
+  return object({
+    name: baseNameValidation
+      .test(
+        'required-for-rename',
+        'Stack name is required when renaming',
+        function validate(value) {
+          const { environmentId } = this.parent;
+          // If renaming (same environment), name is required
+          if (
+            currentEnvironmentId !== undefined &&
+            environmentId === currentEnvironmentId
+          ) {
+            return !!value && value.length > 0;
+          }
+          // For migration to different environment, name is optional
+          return true;
+        }
+      )
+      .test(
+        'not-same-name-for-rename',
+        "Can't rename to the same name",
+        function validate(value) {
+          const { environmentId } = this.parent;
+          // If renaming (same environment) and name matches current stack name, reject
+          if (
+            currentStackName &&
+            currentEnvironmentId !== undefined &&
+            environmentId === currentEnvironmentId &&
+            value === currentStackName
+          ) {
+            return false;
+          }
+          return true;
+        }
+      ),
+    environmentId: baseEnvValidation,
+  });
+}
diff --git a/app/react/docker/stacks/ItemView/StackInfoTab/StackDuplicationForm/StackDuplicationFormInner.test.tsx b/app/react/docker/stacks/ItemView/StackInfoTab/StackDuplicationForm/StackDuplicationFormInner.test.tsx
new file mode 100644
index 0000000..9c53d8d
--- /dev/null
+++ b/app/react/docker/stacks/ItemView/StackInfoTab/StackDuplicationForm/StackDuplicationFormInner.test.tsx
@@ -0,0 +1,523 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { Formik } from 'formik';
+import { http, HttpResponse } from 'msw';
+
+import { server } from '@/setup-tests/server';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { EnvironmentGroup } from '@/react/portainer/environments/environment-groups/types';
+import {
+  createMockEnvironment,
+  createMockEnvironmentGroup,
+} from '@/react-tools/test-mocks';
+
+import { StackDuplicationFormInner } from './StackDuplicationFormInner';
+import { FormSubmitValues } from './StackDuplicationForm.types';
+
+describe('StackDuplicationFormInner', () => {
+  describe('initial rendering', () => {
+    it('should render form', async () => {
+      renderFormInner();
+
+      expect(
+        screen.getByText(
+          'This feature allows you to duplicate or migrate this stack.'
+        )
+      ).toBeVisible();
+
+      await waitFor(() => {
+        const input = screen.getByPlaceholderText(
+          'Stack name (optional for migration)'
+        );
+        expect(input).toBeVisible();
+      });
+
+      expect(screen.getByRole('button', { name: /migrate/i })).toBeVisible();
+      expect(screen.getByRole('button', { name: /duplicate/i })).toBeVisible();
+
+      await waitFor(() => {
+        expect(
+          screen.getByTestId('stack-duplicate-name-input')
+        ).toBeInTheDocument();
+        expect(screen.getByTestId('stack-migrate-button')).toBeInTheDocument();
+        expect(
+          screen.getByTestId('stack-duplicate-button')
+        ).toBeInTheDocument();
+      });
+    });
+  });
+
+  describe('button states - migrate', () => {
+    it('should disable Migrate button when no environment is selected', async () => {
+      const { getByRole } = renderFormInner();
+
+      await waitFor(() => {
+        const migrateButton = getByRole('button', { name: /migrate/i });
+        expect(migrateButton).toBeDisabled();
+      });
+    });
+
+    it('should enable Migrate button when valid environment is selected', async () => {
+      const { getByRole } = renderFormInner({
+        initialValues: {
+          environmentId: 2,
+          newName: '',
+          actionType: 'migrate',
+        },
+      });
+
+      await waitFor(() => {
+        const migrateButton = getByRole('button', { name: /migrate/i });
+        expect(migrateButton).toBeEnabled();
+      });
+    });
+
+    it('should show "Rename" button when environmentId matches current environment', async () => {
+      const { getByRole } = renderFormInner({
+        initialValues: {
+          environmentId: 1,
+          newName: '',
+          actionType: 'migrate',
+        },
+        currentEnvironmentId: 1,
+      });
+
+      await waitFor(() => {
+        const renameButton = getByRole('button', { name: /rename/i });
+        expect(renameButton).toBeVisible();
+      });
+    });
+
+    it('should show "Migrate" button text when environmentId differs from current environment', async () => {
+      const { getByRole } = renderFormInner({
+        initialValues: {
+          environmentId: 2,
+          newName: '',
+          actionType: 'migrate',
+        },
+        currentEnvironmentId: 1,
+      });
+
+      await waitFor(() => {
+        expect(getByRole('button', { name: 'Migrate' })).toBeVisible();
+      });
+    });
+  });
+
+  describe('button states - duplicate', () => {
+    it('should disable Duplicate button when name is empty', async () => {
+      const { getByRole } = renderFormInner({
+        initialValues: {
+          environmentId: 2,
+          newName: '',
+          actionType: 'duplicate',
+        },
+      });
+
+      await waitFor(() => {
+        const duplicateButton = getByRole('button', { name: /duplicate/i });
+        expect(duplicateButton).toBeDisabled();
+      });
+    });
+
+    it('should disable Duplicate button when no environment is selected', async () => {
+      const { getByRole } = renderFormInner({
+        initialValues: {
+          environmentId: undefined,
+          newName: 'mystack',
+          actionType: 'duplicate',
+        },
+      });
+
+      await waitFor(() => {
+        const duplicateButton = getByRole('button', { name: /duplicate/i });
+        expect(duplicateButton).toBeDisabled();
+      });
+    });
+
+    it('should disable Duplicate button when yamlError is present', async () => {
+      const { getByRole } = renderFormInner({
+        yamlError: 'Invalid YAML',
+        initialValues: {
+          environmentId: 2,
+          newName: 'mystack',
+          actionType: 'duplicate',
+        },
+      });
+
+      await waitFor(() => {
+        const duplicateButton = getByRole('button', { name: /duplicate/i });
+        expect(duplicateButton).toBeDisabled();
+      });
+    });
+
+    it('should enable Duplicate button when valid name and environment selected and no yamlError', async () => {
+      const { getByRole } = renderFormInner({
+        initialValues: {
+          environmentId: 2,
+          newName: 'mystack',
+          actionType: 'duplicate',
+        },
+      });
+
+      await waitFor(() => {
+        const duplicateButton = getByRole('button', { name: /duplicate/i });
+        expect(duplicateButton).toBeEnabled();
+      });
+    });
+  });
+
+  describe('form interactions', () => {
+    it('should update newName field when user types', async () => {
+      const { getByPlaceholderText } = renderFormInner();
+      const user = userEvent.setup();
+
+      await waitFor(() => {
+        const input = getByPlaceholderText(
+          'Stack name (optional for migration)'
+        );
+        expect(input).toBeVisible();
+      });
+
+      const input = getByPlaceholderText('Stack name (optional for migration)');
+      await user.type(input, 'mystack');
+
+      expect(input).toHaveValue('mystack');
+    });
+
+    it('should display FormError for newName when validation error exists', async () => {
+      const { getByText } = renderFormInner();
+
+      // Formik with validation schema will show errors
+      // This test demonstrates the error display mechanism
+      // In a real scenario, validation would trigger after user interaction
+      await waitFor(() => {
+        const form = getByText(
+          'This feature allows you to duplicate or migrate this stack.'
+        );
+        expect(form).toBeVisible();
+      });
+    });
+  });
+
+  describe('action handlers', () => {
+    it('should call onSubmit with actionType "migrate" when Migrate button clicked', async () => {
+      const onSubmit = vi.fn();
+      const { getByRole } = renderFormInner({
+        onSubmit,
+        initialValues: {
+          environmentId: 2,
+          newName: '',
+          actionType: 'migrate',
+        },
+      });
+      const user = userEvent.setup();
+
+      await waitFor(() => {
+        const migrateButton = getByRole('button', { name: /migrate/i });
+        expect(migrateButton).toBeEnabled();
+      });
+
+      const migrateButton = getByRole('button', { name: /migrate/i });
+      await user.click(migrateButton);
+
+      await waitFor(() => {
+        expect(onSubmit).toHaveBeenCalledWith(
+          expect.objectContaining({
+            actionType: 'migrate',
+            environmentId: 2,
+            newName: '',
+          }),
+          expect.anything()
+        );
+      });
+    });
+
+    it('should call onSubmit with actionType "duplicate" when Duplicate button clicked', async () => {
+      const onSubmit = vi.fn();
+      const { getByRole } = renderFormInner({
+        onSubmit,
+        initialValues: {
+          environmentId: 2,
+          newName: 'mystack',
+          actionType: 'duplicate',
+        },
+      });
+      const user = userEvent.setup();
+
+      await waitFor(() => {
+        const duplicateButton = getByRole('button', { name: /duplicate/i });
+        expect(duplicateButton).toBeEnabled();
+      });
+
+      const duplicateButton = getByRole('button', { name: /duplicate/i });
+      await user.click(duplicateButton);
+
+      await waitFor(() => {
+        expect(onSubmit).toHaveBeenCalledWith(
+          expect.objectContaining({
+            actionType: 'duplicate',
+            environmentId: 2,
+            newName: 'mystack',
+          }),
+          expect.anything()
+        );
+      });
+    });
+  });
+
+  describe('YAML error display', () => {
+    it('should display yamlError when environment is selected and error exists', async () => {
+      const yamlError = 'Invalid YAML format';
+      renderFormInner({
+        yamlError,
+        initialValues: {
+          environmentId: 2,
+          newName: 'mystack',
+          actionType: 'duplicate',
+        },
+      });
+
+      await waitFor(() => {
+        const errorElement = screen.getByRole('alert', { name: 'Yaml Error' });
+        expect(errorElement).toBeVisible();
+      });
+    });
+
+    it('should not display yamlError when no environment is selected', async () => {
+      const yamlError = 'Invalid YAML format';
+      renderFormInner({
+        yamlError,
+        initialValues: {
+          environmentId: undefined,
+          newName: 'mystack',
+          actionType: 'duplicate',
+        },
+      });
+      await waitFor(() => {
+        expect(screen.queryByRole('alert', { name: 'Yaml Error' })).toBeNull();
+      });
+    });
+
+    it('should not display yamlError when no error exists', async () => {
+      renderFormInner({
+        initialValues: {
+          environmentId: 2,
+          newName: 'mystack',
+          actionType: 'duplicate',
+        },
+      });
+
+      await waitFor(() => {
+        expect(screen.queryByRole('alert', { name: 'Yaml Error' })).toBeNull();
+      });
+    });
+  });
+
+  describe('rename functionality', () => {
+    it('should display rename help text', () => {
+      const { getByText } = renderFormInner();
+
+      expect(
+        getByText(
+          'To rename the stack, choose the same environment when migrating.'
+        )
+      ).toBeVisible();
+    });
+
+    it('should disable rename when current environment selected with empty name', async () => {
+      const { getByRole } = renderFormInner({
+        initialValues: {
+          environmentId: 1,
+          newName: '',
+          actionType: 'migrate',
+        },
+        currentEnvironmentId: 1,
+      });
+
+      await waitFor(() => {
+        const renameButton = getByRole('button', { name: 'Rename' });
+        expect(renameButton).toBeDisabled();
+      });
+    });
+
+    it('should enable rename when current environment selected with valid name', async () => {
+      const { getByRole } = renderFormInner({
+        initialValues: {
+          environmentId: 1,
+          newName: 'newname',
+          actionType: 'migrate',
+        },
+        currentEnvironmentId: 1,
+      });
+
+      await waitFor(() => {
+        const renameButton = getByRole('button', { name: 'Rename' });
+        expect(renameButton).toBeEnabled();
+      });
+    });
+
+    it('should show "Renaming in progress..." loading text when renaming', async () => {
+      const onSubmit = vi.fn().mockImplementation(() => new Promise(() => {})); // Never resolves
+      const { getByRole } = renderFormInner({
+        onSubmit,
+        initialValues: {
+          environmentId: 1,
+          newName: 'newname',
+          actionType: 'migrate',
+        },
+        currentEnvironmentId: 1,
+        isLoading: true,
+      });
+
+      await waitFor(() => {
+        expect(
+          getByRole('button', { name: /renaming in progress/i })
+        ).toBeInTheDocument();
+      });
+    });
+
+    it('should show "Migration in progress..." loading text when migrating to different environment', async () => {
+      const onSubmit = vi.fn().mockImplementation(() => new Promise(() => {})); // Never resolves
+      const { getByRole } = renderFormInner({
+        onSubmit,
+        initialValues: {
+          environmentId: 2,
+          newName: '',
+          actionType: 'migrate',
+        },
+        currentEnvironmentId: 1,
+        isLoading: true,
+      });
+
+      await waitFor(() => {
+        expect(
+          getByRole('button', { name: /migration in progress/i })
+        ).toBeInTheDocument();
+      });
+    });
+
+    it('should disable rename button when renaming to the same name', async () => {
+      const currentStackName = 'test-stack';
+      const { getByRole } = renderFormInner({
+        currentStackName,
+        initialValues: {
+          environmentId: 1,
+          newName: currentStackName,
+          actionType: 'migrate',
+        },
+        currentEnvironmentId: 1,
+      });
+
+      await waitFor(() => {
+        const renameButton = getByRole('button', { name: 'Rename' });
+        expect(renameButton).toBeDisabled();
+      });
+    });
+
+    it('should disable rename button when user types the same name', async () => {
+      const currentStackName = 'test-stack';
+      const { getByRole, getByPlaceholderText } = renderFormInner({
+        currentStackName,
+        initialValues: {
+          environmentId: 1,
+          newName: '',
+          actionType: 'migrate',
+        },
+        currentEnvironmentId: 1,
+      });
+      const user = userEvent.setup();
+
+      // Initially rename button should be disabled with empty name
+      await waitFor(() => {
+        const renameButton = getByRole('button', { name: 'Rename' });
+        expect(renameButton).toBeDisabled();
+      });
+
+      // Type a valid different name
+      const input = getByPlaceholderText('Stack name (optional for migration)');
+      await user.type(input, 'newname');
+
+      // Button should now be enabled
+      await waitFor(() => {
+        const renameButton = getByRole('button', { name: 'Rename' });
+        expect(renameButton).toBeEnabled();
+      });
+
+      // Clear and type the same name as current stack
+      await user.clear(input);
+      await user.type(input, currentStackName);
+
+      // Now the button should be disabled again
+      await waitFor(() => {
+        const renameButton = getByRole('button', { name: 'Rename' });
+        expect(renameButton).toBeDisabled();
+      });
+    });
+
+    it('should enable rename button when renaming to a different name', async () => {
+      const currentStackName = 'test-stack';
+      const { getByRole } = renderFormInner({
+        currentStackName,
+        initialValues: {
+          environmentId: 1,
+          newName: 'new-stack-name',
+          actionType: 'migrate',
+        },
+        currentEnvironmentId: 1,
+      });
+
+      await waitFor(() => {
+        const renameButton = getByRole('button', { name: 'Rename' });
+        expect(renameButton).toBeEnabled();
+      });
+    });
+  });
+});
+
+function renderFormInner({
+  yamlError,
+  currentEnvironmentId = 1,
+  currentStackName = 'test-stack',
+  onSubmit = vi.fn(),
+  isLoading = false,
+  initialValues = {
+    environmentId: undefined,
+    newName: '',
+    actionType: 'migrate' as const,
+  },
+}: {
+  yamlError?: string;
+  currentEnvironmentId?: number;
+  currentStackName?: string;
+  onSubmit?: (values: FormSubmitValues) => void | Promise<void>;
+  initialValues?: FormSubmitValues;
+  isLoading?: boolean;
+} = {}) {
+  const mockEnvironments = [
+    createMockEnvironment({ Id: 1, Name: 'Current Environment', GroupId: 1 }),
+    createMockEnvironment({ Id: 2, Name: 'Target Environment', GroupId: 1 }),
+  ];
+
+  const mockGroups: EnvironmentGroup[] = [
+    createMockEnvironmentGroup({ Id: 1, Name: 'Unassigned' }),
+  ];
+
+  server.use(
+    http.get('/api/endpoints', () => HttpResponse.json(mockEnvironments)),
+    http.get('/api/endpoint_groups', () => HttpResponse.json(mockGroups))
+  );
+
+  const Component = withTestQueryProvider(() => (
+    <Formik initialValues={initialValues} onSubmit={onSubmit}>
+      <StackDuplicationFormInner
+        yamlError={yamlError}
+        currentEnvironmentId={currentEnvironmentId}
+        currentStackName={currentStackName}
+        isLoading={isLoading}
+      />
+    </Formik>
+  ));
+
+  return render(<Component />);
+}
diff --git a/app/react/docker/stacks/ItemView/StackInfoTab/StackDuplicationForm/StackDuplicationFormInner.tsx b/app/react/docker/stacks/ItemView/StackInfoTab/StackDuplicationForm/StackDuplicationFormInner.tsx
new file mode 100644
index 0000000..b920ac4
--- /dev/null
+++ b/app/react/docker/stacks/ItemView/StackInfoTab/StackDuplicationForm/StackDuplicationFormInner.tsx
@@ -0,0 +1,124 @@
+import { Field, Form, useFormikContext } from 'formik';
+import { Copy, ArrowRight } from 'lucide-react';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { LoadingButton } from '@@/buttons/LoadingButton';
+import { Input } from '@@/form-components/Input';
+import { FormError } from '@@/form-components/FormError';
+import { TextTip } from '@@/Tip/TextTip';
+
+import { FormSubmitValues, ActionType } from './StackDuplicationForm.types';
+import { useValidation } from './StackDuplicationForm.validation';
+import { EnvSelector } from './EnvSelector';
+
+interface Props {
+  yamlError?: string;
+  currentEnvironmentId: EnvironmentId;
+  currentStackName: string;
+  isLoading: boolean;
+}
+
+export function StackDuplicationFormInner({
+  yamlError,
+  currentEnvironmentId,
+  currentStackName,
+  isLoading,
+}: Props) {
+  const { values, errors, setFieldValue, submitForm } =
+    useFormikContext<FormSubmitValues>();
+
+  const validState = useValidation({
+    values,
+    currentStackName,
+    currentEnvironmentId,
+  });
+
+  const isEnvSelected = !!values.environmentId;
+
+  async function handleAction(type: ActionType) {
+    // Set the actionType in form values before submitting
+    await setFieldValue('actionType', type);
+    await submitForm();
+  }
+
+  const isMigrateInProgress = isLoading && values.actionType === 'migrate';
+  const isDuplicateInProgress = isLoading && values.actionType === 'duplicate';
+
+  const isMigrateDisabled = isLoading || !validState.migrate;
+  const isDuplicateDisabled = isLoading || !validState.duplicate || !!yamlError;
+
+  return (
+    <Form>
+      <TextTip color="blue">
+        <p>This feature allows you to duplicate or migrate this stack. </p>
+        <p>To rename the stack, choose the same environment when migrating.</p>
+      </TextTip>
+
+      <div className="form-group">
+        <Field
+          as={Input}
+          type="text"
+          placeholder="Stack name (optional for migration)"
+          aria-label="Stack name"
+          name="newName"
+          data-cy="stack-duplicate-name-input"
+        />
+        {errors.newName && (
+          <div className="col-sm-12">
+            <FormError>{errors.newName}</FormError>
+          </div>
+        )}
+      </div>
+
+      <EnvSelector
+        onChange={(value) => setFieldValue('environmentId', value)}
+        value={values.environmentId}
+        error={errors.environmentId}
+      />
+
+      <div className="inline-flex gap-2">
+        <LoadingButton
+          type="button"
+          color="primary"
+          size="small"
+          disabled={isMigrateDisabled}
+          isLoading={isMigrateInProgress}
+          loadingText={
+            values.environmentId === currentEnvironmentId
+              ? 'Renaming in progress...'
+              : 'Migration in progress...'
+          }
+          onClick={() => handleAction('migrate')}
+          icon={ArrowRight}
+          data-cy="stack-migrate-button"
+          className="!ml-0"
+        >
+          {values.environmentId === currentEnvironmentId ? 'Rename' : 'Migrate'}
+        </LoadingButton>
+
+        <LoadingButton
+          type="button"
+          color="primary"
+          size="small"
+          disabled={isDuplicateDisabled}
+          isLoading={isDuplicateInProgress}
+          loadingText="Duplication in progress..."
+          onClick={() => handleAction('duplicate')}
+          icon={Copy}
+          data-cy="stack-duplicate-button"
+        >
+          Duplicate
+        </LoadingButton>
+      </div>
+
+      {yamlError && isEnvSelected && (
+        <div className="form-group" role="alert" aria-label="Yaml Error">
+          <div>
+            <span className="text-danger small">{yamlError}</span>
+          </div>
+        </div>
+      )}
+    </Form>
+  );
+}
diff --git a/app/react/docker/stacks/ItemView/StackInfoTab/StackDuplicationForm/useDuplicateStackMutation.test.tsx b/app/react/docker/stacks/ItemView/StackInfoTab/StackDuplicationForm/useDuplicateStackMutation.test.tsx
new file mode 100644
index 0000000..56dc743
--- /dev/null
+++ b/app/react/docker/stacks/ItemView/StackInfoTab/StackDuplicationForm/useDuplicateStackMutation.test.tsx
@@ -0,0 +1,277 @@
+import { http, HttpResponse } from 'msw';
+
+import { server } from '@/setup-tests/server';
+
+import { StackType } from '../../../../../common/stacks/types';
+
+import { duplicateStack } from './useDuplicateStackMutation';
+
+type StackRequestBody = {
+  name: string;
+  swarmID: string;
+  env?: Array<{ name: string; value: string }>;
+};
+
+describe('Swarm stack duplication', () => {
+  it('should call getSwarm with targetEnvironmentId for Swarm stacks', async () => {
+    const swarmId = 'swarm123';
+    let swarmRequestCalled = false;
+
+    server.use(
+      http.get('/api/endpoints/:id/docker/swarm', ({ params }) => {
+        swarmRequestCalled = true;
+        expect(params.id).toBe('2');
+        return HttpResponse.json({ ID: swarmId });
+      }),
+      http.post('/api/stacks/create/:type/:method', async () =>
+        HttpResponse.json({ Id: 123 })
+      )
+    );
+
+    await duplicateStack({
+      name: 'test-stack',
+      fileContent: 'version: "3"\nservices:\n  app:\n    image: nginx',
+      targetEnvironmentId: 2,
+      type: StackType.DockerSwarm,
+      env: [{ name: 'VAR1', value: 'value1' }],
+    });
+
+    expect(swarmRequestCalled).toBe(true);
+  });
+
+  it('should call createSwarmStackFromFileContent with correct parameters', async () => {
+    const swarmId = 'swarm123';
+    let stackRequestBody: undefined | StackRequestBody;
+
+    server.use(
+      http.get('/api/endpoints/:id/docker/swarm', () =>
+        HttpResponse.json({ ID: swarmId })
+      ),
+      http.post('/api/stacks/create/:type/:method', async ({ request }) => {
+        stackRequestBody = (await request.json()) as StackRequestBody;
+
+        return HttpResponse.json({ Id: 123 });
+      })
+    );
+
+    const fileContent = 'version: "3"\nservices:\n  app:\n    image: nginx';
+    const env = [{ name: 'VAR1', value: 'value1' }];
+
+    await duplicateStack({
+      name: 'test-stack',
+      fileContent,
+      targetEnvironmentId: 2,
+      type: StackType.DockerSwarm,
+      env,
+    });
+
+    expect(stackRequestBody).toBeDefined();
+    expect(stackRequestBody?.name).toBe('test-stack');
+    expect(stackRequestBody?.swarmID).toBe(swarmId);
+  });
+
+  it('should throw error if Swarm ID is missing', async () => {
+    server.use(
+      http.get('/api/endpoints/:id/docker/swarm', () =>
+        HttpResponse.json({ ID: '' })
+      )
+    );
+
+    await expect(
+      duplicateStack({
+        name: 'test-stack',
+        fileContent: 'version: "3"\nservices:\n  app:\n    image: nginx',
+        targetEnvironmentId: 2,
+        type: StackType.DockerSwarm,
+      })
+    ).rejects.toThrow('Swarm ID is required');
+  });
+
+  it('should pass swarmID from getSwarm response', async () => {
+    const swarmId = 'custom-swarm-id-456';
+    let stackRequestBody: StackRequestBody | undefined;
+
+    server.use(
+      http.get('/api/endpoints/:id/docker/swarm', () =>
+        HttpResponse.json({ ID: swarmId })
+      ),
+      http.post('/api/stacks/create/:type/:method', async ({ request }) => {
+        stackRequestBody = (await request.json()) as StackRequestBody;
+        return HttpResponse.json({ Id: 123 });
+      })
+    );
+
+    await duplicateStack({
+      name: 'test-stack',
+      fileContent: 'version: "3"\nservices:\n  app:\n    image: nginx',
+      targetEnvironmentId: 2,
+      type: StackType.DockerSwarm,
+    });
+
+    expect(stackRequestBody?.swarmID).toBe(swarmId);
+  });
+
+  it('should pass environmentId, name, stackFileContent, env', async () => {
+    const swarmId = 'swarm123';
+    let stackRequestBody: StackRequestBody | undefined;
+
+    server.use(
+      http.get('/api/endpoints/:id/docker/swarm', () =>
+        HttpResponse.json({ ID: swarmId })
+      ),
+      http.post('/api/stacks/create/:type/:method', async ({ request }) => {
+        stackRequestBody = (await request.json()) as StackRequestBody;
+        return HttpResponse.json({ Id: 123 });
+      })
+    );
+
+    const fileContent = 'version: "3"\nservices:\n  app:\n    image: nginx';
+    const env = [
+      { name: 'VAR1', value: 'value1' },
+      { name: 'VAR2', value: 'value2' },
+    ];
+
+    await duplicateStack({
+      name: 'my-swarm-stack',
+      fileContent,
+      targetEnvironmentId: 3,
+      type: StackType.DockerSwarm,
+      env,
+    });
+
+    expect(stackRequestBody).toBeDefined();
+    expect(stackRequestBody?.name).toBe('my-swarm-stack');
+    expect(stackRequestBody?.env).toEqual(env);
+  });
+});
+
+describe('Standalone stack duplication', () => {
+  it('should call createStandaloneStackFromFileContent for non-Swarm stacks', async () => {
+    let stackRequestBody: StackRequestBody | undefined;
+
+    server.use(
+      http.post('/api/stacks/create/:type/:method', async ({ request }) => {
+        stackRequestBody = (await request.json()) as StackRequestBody;
+        return HttpResponse.json({ Id: 123 });
+      })
+    );
+
+    await duplicateStack({
+      name: 'standalone-stack',
+      fileContent: 'version: "3"\nservices:\n  app:\n    image: nginx',
+      targetEnvironmentId: 2,
+      type: StackType.DockerCompose,
+    });
+
+    expect(stackRequestBody).toBeDefined();
+    expect(stackRequestBody?.name).toBe('standalone-stack');
+  });
+
+  it('should pass environmentId, name, stackFileContent, env', async () => {
+    let stackRequestBody: StackRequestBody | undefined;
+
+    server.use(
+      http.post('/api/stacks/create/:type/:method', async ({ request }) => {
+        stackRequestBody = (await request.json()) as StackRequestBody;
+        return HttpResponse.json({ Id: 123 });
+      })
+    );
+
+    const fileContent = 'version: "3"\nservices:\n  web:\n    image: nginx';
+    const env = [{ name: 'PORT', value: '8080' }];
+
+    await duplicateStack({
+      name: 'compose-stack',
+      fileContent,
+      targetEnvironmentId: 5,
+      type: StackType.DockerCompose,
+      env,
+    });
+
+    expect(stackRequestBody).toBeDefined();
+    expect(stackRequestBody?.name).toBe('compose-stack');
+    expect(stackRequestBody?.env).toEqual(env);
+  });
+
+  it('should not call getSwarm for standalone stacks', async () => {
+    let swarmRequestCalled = false;
+
+    server.use(
+      http.get('/api/endpoints/:id/docker/swarm', () => {
+        swarmRequestCalled = true;
+        return HttpResponse.json({ ID: 'swarm123' });
+      }),
+      http.post('/api/stacks/create/:type/:method', () =>
+        HttpResponse.json({ Id: 123 })
+      )
+    );
+
+    await duplicateStack({
+      name: 'standalone-stack',
+      fileContent: 'version: "3"\nservices:\n  app:\n    image: nginx',
+      targetEnvironmentId: 2,
+      type: StackType.DockerCompose,
+    });
+
+    expect(swarmRequestCalled).toBe(false);
+  });
+});
+
+describe('error handling', () => {
+  it('should propagate errors from getSwarm', async () => {
+    server.use(
+      http.get('/api/endpoints/:id/docker/swarm', () =>
+        HttpResponse.json({ message: 'Swarm not found' }, { status: 404 })
+      )
+    );
+
+    await expect(
+      duplicateStack({
+        name: 'test-stack',
+        fileContent: 'version: "3"\nservices:\n  app:\n    image: nginx',
+        targetEnvironmentId: 2,
+        type: StackType.DockerSwarm,
+      })
+    ).rejects.toThrow();
+  });
+
+  it('should propagate errors from createSwarmStackFromFileContent', async () => {
+    server.use(
+      http.get('/api/endpoints/:id/docker/swarm', () =>
+        HttpResponse.json({ ID: 'swarm123' })
+      ),
+      http.post('/api/stacks/create/:type/:method', () =>
+        HttpResponse.json({ message: 'Stack creation failed' }, { status: 500 })
+      )
+    );
+
+    await expect(
+      duplicateStack({
+        name: 'test-stack',
+        fileContent: 'version: "3"\nservices:\n  app:\n    image: nginx',
+        targetEnvironmentId: 2,
+        type: StackType.DockerSwarm,
+      })
+    ).rejects.toThrow();
+  });
+
+  it('should propagate errors from createStandaloneStackFromFileContent', async () => {
+    server.use(
+      http.post('/api/stacks/create/:type/:method', () =>
+        HttpResponse.json(
+          { message: 'Stack name already exists' },
+          { status: 409 }
+        )
+      )
+    );
+
+    await expect(
+      duplicateStack({
+        name: 'existing-stack',
+        fileContent: 'version: "3"\nservices:\n  app:\n    image: nginx',
+        targetEnvironmentId: 2,
+        type: StackType.DockerCompose,
+      })
+    ).rejects.toThrow();
+  });
+});
diff --git a/app/react/docker/stacks/ItemView/StackInfoTab/StackDuplicationForm/useDuplicateStackMutation.ts b/app/react/docker/stacks/ItemView/StackInfoTab/StackDuplicationForm/useDuplicateStackMutation.ts
new file mode 100644
index 0000000..ebd4aec
--- /dev/null
+++ b/app/react/docker/stacks/ItemView/StackInfoTab/StackDuplicationForm/useDuplicateStackMutation.ts
@@ -0,0 +1,51 @@
+import { useMutation } from '@tanstack/react-query';
+
+import { getSwarm } from '@/react/docker/proxy/queries/useSwarm';
+import { Pair } from '@/react/portainer/settings/types';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { createStandaloneStackFromFileContent } from '../../../../../common/stacks/queries/useCreateStack/createStandaloneStackFromFileContent';
+import { createSwarmStackFromFileContent } from '../../../../../common/stacks/queries/useCreateStack/createSwarmStackFromFileContent';
+import { StackType } from '../../../../../common/stacks/types';
+
+export function useDuplicateStackMutation() {
+  return useMutation({
+    mutationFn: duplicateStack,
+  });
+}
+
+export async function duplicateStack({
+  name,
+  fileContent,
+  targetEnvironmentId,
+  type,
+  env,
+}: {
+  name: string;
+  fileContent: string;
+  targetEnvironmentId: EnvironmentId;
+  type: StackType;
+  env?: Array<Pair> | null;
+}) {
+  if (type === StackType.DockerSwarm) {
+    const swarm = await getSwarm(targetEnvironmentId);
+
+    if (!swarm.ID) {
+      throw new Error('Swarm ID is required to duplicate a Swarm stack');
+    }
+
+    return createSwarmStackFromFileContent({
+      environmentId: targetEnvironmentId,
+      name,
+      stackFileContent: fileContent,
+      swarmID: swarm.ID,
+      env,
+    });
+  }
+  return createStandaloneStackFromFileContent({
+    environmentId: targetEnvironmentId,
+    name,
+    stackFileContent: fileContent,
+    env,
+  });
+}
diff --git a/app/react/docker/stacks/ItemView/StackInfoTab/StackDuplicationForm/useMigrateStackMutation.test.tsx b/app/react/docker/stacks/ItemView/StackInfoTab/StackDuplicationForm/useMigrateStackMutation.test.tsx
new file mode 100644
index 0000000..aec69fb
--- /dev/null
+++ b/app/react/docker/stacks/ItemView/StackInfoTab/StackDuplicationForm/useMigrateStackMutation.test.tsx
@@ -0,0 +1,353 @@
+import { http, HttpResponse } from 'msw';
+
+import { server } from '@/setup-tests/server';
+
+import { StackType } from '../../../../../common/stacks/types';
+
+import { routeMigrationRequest } from './useMigrateStackMutation';
+
+type MigrateRequestBody = {
+  EndpointID: number;
+  Name?: string;
+  SwarmID?: string;
+};
+
+describe('Swarm stack migration', () => {
+  server.use(
+    http.get('/api/endpoints/:id/docker/swarm', () =>
+      HttpResponse.json({ ID: 'target-swarm-456' })
+    ),
+    http.post('/api/stacks/:id/migrate', () => HttpResponse.json({}))
+  );
+
+  it('should throw error if fromSwarmId is missing', async () => {
+    await expect(
+      routeMigrationRequest({
+        stackType: StackType.DockerSwarm,
+        id: 1,
+        fromEnvId: 1,
+        targetEnvId: 2,
+        name: 'test-stack',
+        fromSwarmId: undefined,
+      })
+    ).rejects.toThrow('Original Swarm ID is required');
+  });
+
+  it('should call getSwarm with targetEnvId', async () => {
+    let swarmRequestCalled = false;
+    let capturedTargetEnvId: string | undefined;
+
+    server.use(
+      http.get('/api/endpoints/:id/docker/swarm', ({ params }) => {
+        swarmRequestCalled = true;
+        capturedTargetEnvId = params.id as string;
+        return HttpResponse.json({ ID: 'target-swarm-456' });
+      }),
+      http.post('/api/stacks/:id/migrate', () => HttpResponse.json({}))
+    );
+
+    await routeMigrationRequest({
+      stackType: StackType.DockerSwarm,
+      id: 1,
+      fromEnvId: 1,
+      targetEnvId: 3,
+      name: 'test-stack',
+      fromSwarmId: 'source-swarm-123',
+    });
+
+    expect(swarmRequestCalled).toBe(true);
+    expect(capturedTargetEnvId).toBe('3');
+  });
+
+  it('should throw error if target Swarm ID matches source Swarm ID', async () => {
+    const sameSwarmId = 'swarm123';
+
+    server.use(
+      http.get('/api/endpoints/:id/docker/swarm', () =>
+        HttpResponse.json({ ID: sameSwarmId })
+      )
+    );
+
+    await expect(
+      routeMigrationRequest({
+        stackType: StackType.DockerSwarm,
+        id: 1,
+        fromEnvId: 1,
+        targetEnvId: 2,
+        name: 'test-stack',
+        fromSwarmId: sameSwarmId,
+      })
+    ).rejects.toThrow('same Swarm cluster');
+  });
+
+  it('should call migrateStack with targetSwarmId', async () => {
+    const targetSwarmId = 'target-swarm-456';
+    let migrateRequestBody: MigrateRequestBody | undefined;
+
+    server.use(
+      http.get('/api/endpoints/:id/docker/swarm', () =>
+        HttpResponse.json({ ID: targetSwarmId })
+      ),
+      http.post('/api/stacks/:id/migrate', async ({ request }) => {
+        migrateRequestBody = (await request.json()) as MigrateRequestBody;
+        return HttpResponse.json({});
+      })
+    );
+
+    await routeMigrationRequest({
+      stackType: StackType.DockerSwarm,
+      id: 5,
+      fromEnvId: 1,
+      targetEnvId: 2,
+      name: 'swarm-stack',
+      fromSwarmId: 'source-swarm-123',
+    });
+
+    expect(migrateRequestBody).toBeDefined();
+    expect(migrateRequestBody?.SwarmID).toBe(targetSwarmId);
+  });
+
+  it('should include name parameter if provided', async () => {
+    let migrateRequestBody: MigrateRequestBody | undefined;
+
+    server.use(
+      http.get('/api/endpoints/:id/docker/swarm', () =>
+        HttpResponse.json({ ID: 'target-swarm-456' })
+      ),
+      http.post('/api/stacks/:id/migrate', async ({ request }) => {
+        migrateRequestBody = (await request.json()) as MigrateRequestBody;
+        return HttpResponse.json({});
+      })
+    );
+
+    await routeMigrationRequest({
+      stackType: StackType.DockerSwarm,
+      id: 5,
+      fromEnvId: 1,
+      targetEnvId: 2,
+      name: 'new-stack-name',
+      fromSwarmId: 'source-swarm-123',
+    });
+
+    expect(migrateRequestBody?.Name).toBe('new-stack-name');
+  });
+});
+
+describe('Standalone stack migration', () => {
+  it('should call migrateStack without targetSwarmId for standalone stacks', async () => {
+    let migrateRequestBody: MigrateRequestBody | undefined;
+
+    server.use(
+      http.post('/api/stacks/:id/migrate', async ({ request }) => {
+        migrateRequestBody = (await request.json()) as MigrateRequestBody;
+        return HttpResponse.json({});
+      })
+    );
+
+    await routeMigrationRequest({
+      stackType: StackType.DockerCompose,
+      id: 3,
+      fromEnvId: 1,
+      targetEnvId: 2,
+      name: 'compose-stack',
+    });
+
+    expect(migrateRequestBody).toBeDefined();
+    expect(migrateRequestBody?.SwarmID).toBeUndefined();
+  });
+
+  it('should pass id, fromEnvId, targetEnvId, name', async () => {
+    let migrateRequestBody: MigrateRequestBody | undefined;
+    let migrateRequestParams: { endpointId: string | null } | undefined;
+    let stackId: string | undefined;
+
+    server.use(
+      http.post('/api/stacks/:id/migrate', async ({ request, params }) => {
+        migrateRequestBody = (await request.json()) as MigrateRequestBody;
+        stackId = params.id as string;
+        const url = new URL(request.url);
+        migrateRequestParams = {
+          endpointId: url.searchParams.get('endpointId'),
+        };
+        return HttpResponse.json({});
+      })
+    );
+
+    await routeMigrationRequest({
+      stackType: StackType.DockerCompose,
+      id: 7,
+      fromEnvId: 4,
+      targetEnvId: 5,
+      name: 'my-stack',
+    });
+
+    expect(stackId).toBe('7');
+    expect(migrateRequestBody?.EndpointID).toBe(5);
+    expect(migrateRequestBody?.Name).toBe('my-stack');
+    expect(migrateRequestParams?.endpointId).toBe('4');
+  });
+
+  it('should not call getSwarm for standalone stacks', async () => {
+    let swarmRequestCalled = false;
+
+    server.use(
+      http.get('/api/endpoints/:id/docker/swarm', () => {
+        swarmRequestCalled = true;
+        return HttpResponse.json({ ID: 'swarm123' });
+      }),
+      http.post('/api/stacks/:id/migrate', () => HttpResponse.json({}))
+    );
+
+    await routeMigrationRequest({
+      stackType: StackType.DockerCompose,
+      id: 3,
+      fromEnvId: 1,
+      targetEnvId: 2,
+      name: 'compose-stack',
+    });
+
+    expect(swarmRequestCalled).toBe(false);
+  });
+});
+
+describe('API request structure', () => {
+  it('should POST to correct URL (buildStackUrl(id, "migrate"))', async () => {
+    let requestPath: string | undefined;
+
+    server.use(
+      http.post('/api/stacks/:id/migrate', ({ request }) => {
+        requestPath = new URL(request.url).pathname;
+        return HttpResponse.json({});
+      })
+    );
+
+    await routeMigrationRequest({
+      stackType: StackType.DockerCompose,
+      id: 123,
+      fromEnvId: 1,
+      targetEnvId: 2,
+    });
+
+    expect(requestPath).toBe('/api/stacks/123/migrate');
+  });
+
+  it('should include EndpointID, Name, SwarmID in request body', async () => {
+    let requestBody: MigrateRequestBody | undefined;
+
+    server.use(
+      http.post('/api/stacks/:id/migrate', async ({ request }) => {
+        requestBody = (await request.json()) as MigrateRequestBody;
+        return HttpResponse.json({});
+      })
+    );
+
+    await routeMigrationRequest({
+      stackType: StackType.DockerCompose,
+      id: 10,
+      fromEnvId: 1,
+      targetEnvId: 3,
+      name: 'test-stack',
+    });
+
+    expect(requestBody).toBeDefined();
+    expect(requestBody).toHaveProperty('EndpointID');
+    expect(requestBody).toHaveProperty('Name');
+    expect(requestBody?.EndpointID).toBe(3);
+    expect(requestBody?.Name).toBe('test-stack');
+  });
+
+  it('should include endpointId in query params (fromEnvId)', async () => {
+    let queryParams: URLSearchParams | undefined;
+
+    server.use(
+      http.post('/api/stacks/:id/migrate', ({ request }) => {
+        queryParams = new URL(request.url).searchParams;
+        return HttpResponse.json({});
+      })
+    );
+
+    await routeMigrationRequest({
+      stackType: StackType.DockerCompose,
+      id: 10,
+      fromEnvId: 7,
+      targetEnvId: 3,
+    });
+
+    expect(queryParams?.get('endpointId')).toBe('7');
+  });
+});
+
+describe('error handling', () => {
+  it('should parse axios errors correctly', async () => {
+    server.use(
+      http.post('/api/stacks/:id/migrate', () =>
+        HttpResponse.json(
+          { message: 'Migration failed', details: 'Stack not found' },
+          { status: 404 }
+        )
+      )
+    );
+
+    await expect(
+      routeMigrationRequest({
+        stackType: StackType.DockerCompose,
+        id: 999,
+        fromEnvId: 1,
+        targetEnvId: 2,
+      })
+    ).rejects.toThrow();
+  });
+
+  it('should propagate errors from getSwarm', async () => {
+    server.use(
+      http.get('/api/endpoints/:id/docker/swarm', () =>
+        HttpResponse.json({ message: 'Swarm not available' }, { status: 503 })
+      )
+    );
+
+    await expect(
+      routeMigrationRequest({
+        stackType: StackType.DockerSwarm,
+        id: 1,
+        fromEnvId: 1,
+        targetEnvId: 2,
+        fromSwarmId: 'swarm123',
+      })
+    ).rejects.toThrow();
+  });
+
+  it('should propagate errors from API call', async () => {
+    server.use(
+      http.post('/api/stacks/:id/migrate', () =>
+        HttpResponse.json(
+          { message: 'Insufficient permissions' },
+          { status: 403 }
+        )
+      )
+    );
+
+    await expect(
+      routeMigrationRequest({
+        stackType: StackType.DockerCompose,
+        id: 1,
+        fromEnvId: 1,
+        targetEnvId: 2,
+      })
+    ).rejects.toThrow();
+  });
+
+  it('should handle network errors', async () => {
+    server.use(
+      http.post('/api/stacks/:id/migrate', () => HttpResponse.error())
+    );
+
+    await expect(
+      routeMigrationRequest({
+        stackType: StackType.DockerCompose,
+        id: 1,
+        fromEnvId: 1,
+        targetEnvId: 2,
+      })
+    ).rejects.toThrow();
+  });
+});
diff --git a/app/react/docker/stacks/ItemView/StackInfoTab/StackDuplicationForm/useMigrateStackMutation.ts b/app/react/docker/stacks/ItemView/StackInfoTab/StackDuplicationForm/useMigrateStackMutation.ts
new file mode 100644
index 0000000..eb68af5
--- /dev/null
+++ b/app/react/docker/stacks/ItemView/StackInfoTab/StackDuplicationForm/useMigrateStackMutation.ts
@@ -0,0 +1,101 @@
+import { useMutation } from '@tanstack/react-query';
+
+import { getSwarm } from '@/react/docker/proxy/queries/useSwarm';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { StackType } from '../../../../../common/stacks/types';
+import { buildStackUrl } from '../../../../../common/stacks/queries/buildUrl';
+
+export function useMigrateStackMutation() {
+  return useMutation({
+    mutationFn: routeMigrationRequest,
+  });
+}
+
+export function routeMigrationRequest({
+  stackType,
+  id,
+  fromEnvId,
+  targetEnvId,
+  name,
+  fromSwarmId,
+}: {
+  stackType: StackType;
+  fromSwarmId?: string;
+  id: number;
+  fromEnvId: EnvironmentId;
+  targetEnvId: EnvironmentId;
+  name?: string;
+}) {
+  if (stackType === StackType.DockerSwarm) {
+    return migrateSwarmStack({ id, fromEnvId, targetEnvId, name, fromSwarmId });
+  }
+
+  return migrateStack({ id, fromEnvId, targetEnvId, name });
+}
+
+export async function migrateSwarmStack({
+  id,
+  fromEnvId,
+  targetEnvId,
+  fromSwarmId,
+  name,
+}: {
+  id: number;
+  fromEnvId: EnvironmentId;
+  targetEnvId: EnvironmentId;
+  fromSwarmId?: string;
+  name?: string;
+}) {
+  if (!fromSwarmId) {
+    throw new Error('Original Swarm ID is required to migrate a Swarm stack');
+  }
+
+  const targetSwarm = await getSwarm(targetEnvId);
+  if (fromEnvId !== targetEnvId && fromSwarmId === targetSwarm.ID) {
+    throw new Error(
+      'Target environment is located in the same Swarm cluster as the current environment'
+    );
+  }
+
+  return migrateStack({
+    id,
+    fromEnvId,
+    targetEnvId,
+    name,
+    targetSwarmId: targetSwarm.ID,
+  });
+}
+
+export async function migrateStack({
+  id,
+  fromEnvId,
+  targetEnvId,
+  name,
+  targetSwarmId,
+}: {
+  id: number;
+  fromEnvId: EnvironmentId;
+  targetEnvId: EnvironmentId;
+  name?: string;
+  targetSwarmId?: string;
+}) {
+  try {
+    return await axios.post(
+      buildStackUrl(id, 'migrate'),
+      {
+        EndpointID: targetEnvId,
+        Name: name,
+        SwarmID: targetSwarmId,
+      },
+      {
+        params: {
+          endpointId: fromEnvId,
+        },
+      }
+    );
+  } catch (err) {
+    throw parseAxiosError(err);
+  }
+}
diff --git a/app/react/docker/stacks/ItemView/StackInfoTab/StackInfoTab.test.tsx b/app/react/docker/stacks/ItemView/StackInfoTab/StackInfoTab.test.tsx
new file mode 100644
index 0000000..388944b
--- /dev/null
+++ b/app/react/docker/stacks/ItemView/StackInfoTab/StackInfoTab.test.tsx
@@ -0,0 +1,349 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import { http, HttpResponse } from 'msw';
+
+import { server } from '@/setup-tests/server';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { createMockStack } from '@/react-tools/test-mocks';
+
+import { StackInfoTab } from './StackInfoTab';
+
+vi.mock('@/react/hooks/useEnvironmentId', () => ({
+  useEnvironmentId: vi.fn(() => 1),
+}));
+
+vi.mock('./AssociateStackForm', () => ({
+  AssociateStackForm: vi.fn(() => (
+    <div data-cy="associate-stack-form">AssociateStackForm</div>
+  )),
+}));
+
+vi.mock('./StackActions', () => ({
+  StackActions: vi.fn(() => <div data-cy="stack-actions">StackActions</div>),
+}));
+
+vi.mock('./StackDuplicationForm/StackDuplicationForm', () => ({
+  StackDuplicationForm: vi.fn(() => (
+    <div data-cy="stack-duplication-form">StackDuplicationForm</div>
+  )),
+}));
+
+vi.mock('@/react/portainer/gitops/GitReferenceCard', () => ({
+  GitReferenceCard: vi.fn(() => (
+    <div data-cy="git-reference-card">GitReferenceCard</div>
+  )),
+}));
+
+beforeEach(() => {
+  vi.clearAllMocks();
+});
+
+describe('initial rendering', () => {
+  it('should render stack name', () => {
+    renderComponent({ stackName: 'my-test-stack' });
+
+    expect(screen.getByText('my-test-stack')).toBeVisible();
+  });
+
+  it('should render StackActions when stack exists', () => {
+    const mockStack = createMockStack();
+    renderComponent({ stack: mockStack });
+
+    expect(screen.getByTestId('stack-actions')).toBeVisible();
+  });
+
+  it('should not render StackActions when stack is undefined', () => {
+    renderComponent({ stack: undefined });
+
+    expect(screen.queryByTestId('stack-actions')).not.toBeInTheDocument();
+  });
+
+  it('should render stack details section', () => {
+    renderComponent();
+
+    expect(screen.getByText('Stack details')).toBeVisible();
+  });
+});
+
+describe('external and orphaned warnings', () => {
+  it('should show external stack warning when isExternal is true', () => {
+    renderComponent({ isExternal: true });
+
+    expect(
+      screen.getByText(/This stack was created outside of Portainer/i)
+    ).toBeVisible();
+    expect(screen.getByText('Information')).toBeVisible();
+  });
+
+  it('should show orphaned stack warning when isOrphaned is true', () => {
+    renderComponent({ isOrphaned: true });
+
+    expect(screen.getByText(/This stack is orphaned/i)).toBeVisible();
+    expect(screen.getByText(/Associate to this environment/i)).toBeVisible();
+  });
+
+  it('should show orphaned warning when isOrphanedRunning is true', () => {
+    renderComponent({ isOrphanedRunning: true, isOrphaned: false });
+
+    expect(screen.getByText(/This stack is orphaned/i)).toBeVisible();
+  });
+
+  it('should show orphaned warning when both isOrphaned and isOrphanedRunning are true', () => {
+    renderComponent({ isOrphaned: true, isOrphanedRunning: true });
+
+    expect(screen.getByText(/This stack is orphaned/i)).toBeVisible();
+  });
+
+  it('should show both warnings when isExternal and isOrphaned are true', () => {
+    renderComponent({ isExternal: true, isOrphaned: true });
+
+    expect(
+      screen.getByText(/This stack was created outside of Portainer/i)
+    ).toBeVisible();
+    expect(screen.getByText(/This stack is orphaned/i)).toBeVisible();
+  });
+
+  it('should not show warnings when both isExternal and isOrphaned are false', () => {
+    renderComponent({ isExternal: false, isOrphaned: false });
+
+    expect(screen.queryByText('Information')).not.toBeInTheDocument();
+    expect(
+      screen.queryByText(/This stack was created outside of Portainer/i)
+    ).not.toBeInTheDocument();
+    expect(
+      screen.queryByText(/This stack is orphaned/i)
+    ).not.toBeInTheDocument();
+  });
+});
+
+describe('conditional form rendering', () => {
+  it('should render AssociateStackForm when stack is orphaned', () => {
+    const mockStack = createMockStack();
+    renderComponent({
+      stack: mockStack,
+      isOrphaned: true,
+    });
+
+    expect(screen.getByTestId('associate-stack-form')).toBeVisible();
+    expect(
+      screen.queryByTestId('stack-duplication-form')
+    ).not.toBeInTheDocument();
+    expect(screen.queryByTestId('git-reference-card')).not.toBeInTheDocument();
+  });
+
+  it('should not render AssociateStackForm when only isOrphanedRunning is true', () => {
+    const mockStack = createMockStack();
+    renderComponent({
+      stack: mockStack,
+      isOrphanedRunning: true,
+      isOrphaned: false,
+      stackFileContent: 'content',
+    });
+
+    // isOrphanedRunning alone doesn't trigger the form, only isOrphaned does
+    expect(
+      screen.queryByTestId('associate-stack-form')
+    ).not.toBeInTheDocument();
+
+    expect(screen.getByTestId('stack-duplication-form')).toBeVisible();
+  });
+
+  it('should render GitReferenceCard when stack has GitConfig and is not from template', async () => {
+    const mockStack = createMockStack({
+      GitConfig: {
+        URL: 'https://github.com/test/repo',
+        ReferenceName: 'main',
+        ConfigFilePath: 'docker-compose.yml',
+        ConfigHash: '',
+        TLSSkipVerify: false,
+      },
+      GitSourceId: 1,
+      FromAppTemplate: false,
+    });
+    renderComponent({
+      stack: mockStack,
+      isOrphaned: false,
+      isRegular: true,
+    });
+
+    await waitFor(() => {
+      expect(screen.getByTestId('git-reference-card')).toBeVisible();
+    });
+  });
+
+  it('should not render GitReferenceCard when stack is from app template', () => {
+    const mockStack = createMockStack({
+      GitConfig: {
+        URL: 'https://github.com/test/repo',
+        ReferenceName: 'main',
+        ConfigFilePath: 'docker-compose.yml',
+        ConfigHash: '',
+        TLSSkipVerify: false,
+      },
+      FromAppTemplate: true,
+    });
+    renderComponent({
+      stack: mockStack,
+      isOrphaned: false,
+      isRegular: true,
+    });
+
+    expect(screen.queryByTestId('git-reference-card')).not.toBeInTheDocument();
+  });
+
+  it('should not render GitReferenceCard when stack has no GitConfig', () => {
+    const mockStack = createMockStack({
+      GitConfig: undefined,
+    });
+    renderComponent({
+      stack: mockStack,
+      isOrphaned: false,
+      isRegular: true,
+    });
+
+    expect(screen.queryByTestId('git-reference-card')).not.toBeInTheDocument();
+  });
+
+  it('should render StackDuplicationForm when stack is regular and not orphaned and content is available', () => {
+    const mockStack = createMockStack();
+    renderComponent({
+      stack: mockStack,
+      isRegular: true,
+      isOrphaned: false,
+      stackFileContent: 'content',
+    });
+
+    expect(screen.getByTestId('stack-duplication-form')).toBeVisible();
+  });
+
+  it('should not render StackDuplicationForm when content is not available', () => {
+    const mockStack = createMockStack();
+    renderComponent({
+      stack: mockStack,
+      isRegular: true,
+      isOrphaned: false,
+      stackFileContent: '',
+    });
+
+    expect(
+      screen.queryByTestId('stack-duplication-form')
+    ).not.toBeInTheDocument();
+  });
+
+  it('should not render StackDuplicationForm when stack is not regular', () => {
+    const mockStack = createMockStack();
+    renderComponent({
+      stack: mockStack,
+      isRegular: false,
+      isOrphaned: false,
+    });
+
+    expect(
+      screen.queryByTestId('stack-duplication-form')
+    ).not.toBeInTheDocument();
+  });
+
+  it('should not render any forms when stack is undefined', () => {
+    renderComponent({ stack: undefined });
+
+    expect(
+      screen.queryByTestId('associate-stack-form')
+    ).not.toBeInTheDocument();
+    expect(
+      screen.queryByTestId('stack-duplication-form')
+    ).not.toBeInTheDocument();
+    expect(screen.queryByTestId('git-reference-card')).not.toBeInTheDocument();
+  });
+});
+
+describe('git and duplication form combination', () => {
+  it('should render both GitReferenceCard and StackDuplicationForm when conditions met', async () => {
+    const mockStack = createMockStack({
+      GitConfig: {
+        URL: 'https://github.com/test/repo',
+        ReferenceName: 'main',
+        ConfigFilePath: 'docker-compose.yml',
+        ConfigHash: '',
+        TLSSkipVerify: false,
+      },
+      GitSourceId: 1,
+      FromAppTemplate: false,
+    });
+    renderComponent({
+      stack: mockStack,
+      isRegular: true,
+      isOrphaned: false,
+      stackFileContent: 'content',
+    });
+
+    await waitFor(() => {
+      expect(screen.getByTestId('git-reference-card')).toBeVisible();
+      expect(screen.getByTestId('stack-duplication-form')).toBeVisible();
+    });
+  });
+});
+
+describe('stack file content and environment id passing', () => {
+  it('should pass stackFileContent to child components', () => {
+    const mockStack = createMockStack();
+    const stackFileContent =
+      'version: "3"\nservices:\n  web:\n    image: nginx';
+    renderComponent({
+      stack: mockStack,
+      stackFileContent,
+      isRegular: true,
+    });
+
+    expect(screen.getByTestId('stack-actions')).toBeVisible();
+    expect(screen.getByTestId('stack-duplication-form')).toBeVisible();
+  });
+
+  it('should pass environmentId to child components', () => {
+    const mockStack = createMockStack();
+    renderComponent({
+      stack: mockStack,
+      environmentId: 42,
+      isRegular: true,
+    });
+
+    expect(screen.getByTestId('stack-actions')).toBeVisible();
+  });
+});
+
+function renderComponent({
+  stack,
+  stackName = 'test-stack',
+  stackFileContent,
+  isRegular = true,
+  isExternal = false,
+  isOrphaned = false,
+  isOrphanedRunning = false,
+  environmentId = 1,
+  yamlError,
+}: Partial<React.ComponentProps<typeof StackInfoTab>> = {}) {
+  // Mock the Docker API version endpoint
+  server.use(
+    http.get('/api/endpoints/:id/docker/version', () =>
+      HttpResponse.json({ ApiVersion: '1.41' })
+    )
+  );
+
+  const Wrapped = withTestQueryProvider(
+    withTestRouter(withUserProvider(StackInfoTab))
+  );
+
+  return render(
+    <Wrapped
+      stack={stack}
+      stackName={stackName}
+      stackFileContent={stackFileContent}
+      isRegular={isRegular}
+      isExternal={isExternal}
+      isOrphaned={isOrphaned}
+      isOrphanedRunning={isOrphanedRunning}
+      environmentId={environmentId}
+      yamlError={yamlError}
+    />
+  );
+}
diff --git a/app/react/docker/stacks/ItemView/StackInfoTab/StackInfoTab.tsx b/app/react/docker/stacks/ItemView/StackInfoTab/StackInfoTab.tsx
new file mode 100644
index 0000000..bf2aa29
--- /dev/null
+++ b/app/react/docker/stacks/ItemView/StackInfoTab/StackInfoTab.tsx
@@ -0,0 +1,233 @@
+import { AlertTriangle, Loader2 } from 'lucide-react';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import {
+  Stack,
+  StackDeploymentStatus,
+  StackStatus,
+  StackType,
+} from '@/react/common/stacks/types';
+import { GitReferenceCard } from '@/react/portainer/gitops/GitReferenceCard';
+
+import { Alert } from '@@/Alert';
+import { Icon } from '@@/Icon';
+import { FormSection } from '@@/form-components/FormSection';
+
+import { useSwarmStackResources } from '../useSwarmStackServices';
+import { useComposeStackContainers } from '../useComposeStackContainers';
+
+import { StackDuplicationForm } from './StackDuplicationForm/StackDuplicationForm';
+import { StackActions } from './StackActions';
+import { AssociateStackForm } from './AssociateStackForm';
+
+interface StackInfoTabProps {
+  stack?: Stack; // will be loaded only if regular or orphaned
+  stackName: string;
+  stackFileContent?: string;
+  isRegular?: boolean;
+  isExternal: boolean;
+  isOrphaned: boolean;
+  isOrphanedRunning: boolean;
+  environmentId: number;
+  yamlError?: string;
+}
+
+export function StackInfoTab({
+  stack,
+  stackName,
+  stackFileContent,
+  isRegular,
+  isExternal,
+  isOrphaned,
+  isOrphanedRunning,
+  environmentId,
+  yamlError,
+}: StackInfoTabProps) {
+  const status = useStackStatus({
+    status: stack?.Status,
+    environmentId,
+    name: stackName,
+    type: stack?.Type,
+  });
+
+  return (
+    <>
+      <ExternalOrphanedWarning
+        isExternal={isExternal}
+        isOrphaned={isOrphaned || isOrphanedRunning}
+      />
+
+      {stack && (
+        <DeploymentStatusSection
+          status={stack.Status}
+          deploymentStatus={stack.DeploymentStatus}
+        />
+      )}
+
+      <FormSection title="Stack details">
+        <div className="form-group">
+          {stackName}
+
+          {stack && (
+            <div className="ml-3 inline-flex">
+              <StackActions
+                stack={stack}
+                fileContent={stackFileContent}
+                isRegular={isRegular}
+                environmentId={environmentId}
+                isExternal={isExternal}
+                status={status}
+              />
+            </div>
+          )}
+        </div>
+      </FormSection>
+
+      {stack && (
+        <>
+          {isOrphaned ? (
+            <AssociateStackForm
+              stackName={stackName}
+              environmentId={environmentId}
+              isOrphanedRunning={isOrphanedRunning}
+              stackId={stack.Id}
+            />
+          ) : (
+            <div className="space-y-4">
+              {!!stack.GitConfig &&
+                !stack.FromAppTemplate &&
+                !!stack.GitSourceId && (
+                  <GitReferenceCard
+                    gitConfig={stack.GitConfig}
+                    autoUpdate={stack.AutoUpdate}
+                    currentDeploymentInfo={stack.CurrentDeploymentInfo}
+                    stackType="docker"
+                    sourceId={stack.GitSourceId}
+                  />
+                )}
+
+              {isRegular && !!stackFileContent && (
+                <StackDuplicationForm
+                  yamlError={yamlError}
+                  currentEnvironmentId={environmentId}
+                  originalFileContent={stackFileContent}
+                  stack={stack}
+                />
+              )}
+            </div>
+          )}
+        </>
+      )}
+    </>
+  );
+}
+
+function DeploymentStatusSection({
+  status,
+  deploymentStatus,
+}: {
+  status: StackStatus;
+  deploymentStatus?: StackDeploymentStatus[];
+}) {
+  if (status === StackStatus.Deploying) {
+    return (
+      <FormSection title="Deployment">
+        <div className="form-group">
+          <p className="text-muted flex items-center gap-2">
+            <Loader2 className="animate-spin" size={14} />
+            Deployment in progress...
+          </p>
+        </div>
+      </FormSection>
+    );
+  }
+
+  if (status === StackStatus.Error) {
+    const errorMessage = getLastDeploymentError(deploymentStatus);
+    return (
+      <FormSection title="Deployment error">
+        <div className="form-group">
+          <Alert color="error">{errorMessage || 'Deployment failed.'}</Alert>
+        </div>
+      </FormSection>
+    );
+  }
+
+  return null;
+}
+
+function getLastDeploymentError(
+  deploymentStatus?: StackDeploymentStatus[]
+): string | undefined {
+  if (!deploymentStatus?.length) return undefined;
+  const last = deploymentStatus[deploymentStatus.length - 1];
+  return last.Status === StackStatus.Error ? last.Message : undefined;
+}
+
+function ExternalOrphanedWarning({
+  isExternal,
+  isOrphaned,
+}: {
+  isExternal: boolean;
+  isOrphaned: boolean;
+}) {
+  if (!isExternal && !isOrphaned) return null;
+
+  return (
+    <FormSection title="Information">
+      <div className="form-group">
+        <span className="small">
+          <p className="text-muted flex items-start gap-1">
+            <Icon icon={AlertTriangle} mode="warning" className="!mr-0" />
+            {isExternal && (
+              <span>
+                This stack was created outside of Portainer. Control over this
+                stack is limited.
+              </span>
+            )}
+            {isOrphaned && (
+              <span>
+                This stack is orphaned. You can re-associate it with the current
+                environment using the &quot;Associate to this environment&quot;
+                feature.
+              </span>
+            )}
+          </p>
+        </span>
+      </div>
+    </FormSection>
+  );
+}
+
+function useStackStatus({
+  status,
+  name,
+  type,
+  environmentId,
+}: {
+  status: Stack['Status'] | undefined;
+  name: string;
+  type: Stack['Type'] | undefined;
+  environmentId: EnvironmentId;
+}) {
+  const servicesQuery = useSwarmStackResources(name, {
+    enabled: type === StackType.DockerSwarm && !status,
+  });
+  const containersQuery = useComposeStackContainers(
+    { environmentId, stackName: name },
+    {
+      enabled: type === StackType.DockerCompose && !status,
+    }
+  );
+
+  const derivedSwarmStatus = servicesQuery.data?.length
+    ? StackStatus.Active
+    : StackStatus.Inactive;
+  const derivedComposeStatus = containersQuery.data?.length
+    ? StackStatus.Active
+    : StackStatus.Inactive;
+  const derivedStatus =
+    type === StackType.DockerSwarm ? derivedSwarmStatus : derivedComposeStatus;
+
+  return status || derivedStatus;
+}
diff --git a/app/react/docker/stacks/ItemView/StackInfoTab/useAssociateStackToEnvironmentMutation.test.tsx b/app/react/docker/stacks/ItemView/StackInfoTab/useAssociateStackToEnvironmentMutation.test.tsx
new file mode 100644
index 0000000..1a14656
--- /dev/null
+++ b/app/react/docker/stacks/ItemView/StackInfoTab/useAssociateStackToEnvironmentMutation.test.tsx
@@ -0,0 +1,474 @@
+import { renderHook } from '@testing-library/react-hooks';
+import { waitFor } from '@testing-library/react';
+import { http, HttpResponse } from 'msw';
+
+import { server } from '@/setup-tests/server';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { Stack } from '@/react/common/stacks/types';
+import { ResourceControlOwnership } from '@/react/portainer/access-control/types';
+
+import { useAssociateStackToEnvironmentMutation } from './useAssociateStackToEnvironmentMutation';
+
+function renderMutationHook() {
+  const Wrapper = withTestQueryProvider(({ children }) => <>{children}</>);
+
+  return renderHook(() => useAssociateStackToEnvironmentMutation(), {
+    wrapper: Wrapper,
+  });
+}
+
+describe('useAssociateStackToEnvironmentMutation', () => {
+  describe('successful association', () => {
+    it('should make PUT request to correct endpoint with params', async () => {
+      let requestUrl = '';
+      let capturedParams: URLSearchParams | undefined;
+
+      server.use(
+        http.put('/api/stacks/:id/associate', async ({ request, params }) => {
+          requestUrl = request.url;
+          capturedParams = new URL(request.url).searchParams;
+          return HttpResponse.json({
+            Id: Number(params.id),
+            Name: 'test-stack',
+            ResourceControl: {
+              Id: 1,
+              ResourceId: Number(params.id),
+              Type: 6,
+            },
+          } as Partial<Stack>);
+        }),
+        http.put('/api/resource_controls/:id', () =>
+          HttpResponse.json({ success: true })
+        )
+      );
+
+      const { result } = renderMutationHook();
+
+      result.current.mutate({
+        environmentId: 5,
+        stackId: 123,
+        isOrphanedRunning: true,
+        accessControl: {
+          ownership: ResourceControlOwnership.PRIVATE,
+          authorizedUsers: [],
+          authorizedTeams: [],
+        },
+        swarmId: 'swarm-123',
+      });
+
+      await waitFor(() => {
+        expect(result.current.isSuccess).toBe(true);
+      });
+
+      expect(requestUrl).toContain('/api/stacks/123/associate');
+      expect(capturedParams?.get('endpointId')).toBe('5');
+      expect(capturedParams?.get('orphanedRunning')).toBe('true');
+      expect(capturedParams?.get('swarmId')).toBe('swarm-123');
+    });
+
+    it('should apply resource control after association', async () => {
+      let resourceControlRequestBody: unknown;
+
+      server.use(
+        http.put('/api/stacks/:id/associate', () =>
+          HttpResponse.json({
+            Id: 123,
+            Name: 'test-stack',
+            ResourceControl: {
+              Id: 42,
+              ResourceId: 123,
+              Type: 6,
+            },
+          } as Partial<Stack>)
+        ),
+        http.put('/api/resource_controls/:id', async ({ request, params }) => {
+          resourceControlRequestBody = await request.json();
+          expect(params.id).toBe('42');
+          return HttpResponse.json({ success: true });
+        })
+      );
+
+      const { result } = renderMutationHook();
+
+      result.current.mutate({
+        environmentId: 1,
+        stackId: 123,
+        accessControl: {
+          ownership: ResourceControlOwnership.PRIVATE,
+          authorizedUsers: [1, 2],
+          authorizedTeams: [3],
+        },
+      });
+
+      await waitFor(() => {
+        expect(result.current.isSuccess).toBe(true);
+      });
+
+      expect(resourceControlRequestBody).toBeDefined();
+    });
+
+    it('should handle optional swarmId parameter', async () => {
+      let capturedParams: URLSearchParams | undefined;
+
+      server.use(
+        http.put('/api/stacks/:id/associate', async ({ request }) => {
+          capturedParams = new URL(request.url).searchParams;
+          return HttpResponse.json({
+            Id: 123,
+            Name: 'test-stack',
+            ResourceControl: {
+              Id: 1,
+              ResourceId: 123,
+              Type: 6,
+            },
+          } as Partial<Stack>);
+        }),
+        http.put('/api/resource_controls/:id', () =>
+          HttpResponse.json({ success: true })
+        )
+      );
+
+      const { result } = renderMutationHook();
+
+      result.current.mutate({
+        environmentId: 1,
+        stackId: 123,
+        accessControl: {
+          ownership: ResourceControlOwnership.PRIVATE,
+          authorizedUsers: [],
+          authorizedTeams: [],
+        },
+        // swarmId is undefined
+      });
+
+      await waitFor(() => {
+        expect(result.current.isSuccess).toBe(true);
+      });
+
+      // swarmId should not be in params when undefined
+      expect(capturedParams?.get('swarmId')).toBeNull();
+    });
+
+    it('should default orphanedRunning to false when undefined', async () => {
+      let capturedParams: URLSearchParams | undefined;
+
+      server.use(
+        http.put('/api/stacks/:id/associate', async ({ request }) => {
+          capturedParams = new URL(request.url).searchParams;
+          return HttpResponse.json({
+            Id: 123,
+            Name: 'test-stack',
+            ResourceControl: {
+              Id: 1,
+              ResourceId: 123,
+              Type: 6,
+            },
+          } as Partial<Stack>);
+        }),
+        http.put('/api/resource_controls/:id', () =>
+          HttpResponse.json({ success: true })
+        )
+      );
+
+      const { result } = renderMutationHook();
+
+      result.current.mutate({
+        environmentId: 1,
+        stackId: 123,
+        accessControl: {
+          ownership: ResourceControlOwnership.PRIVATE,
+          authorizedUsers: [],
+          authorizedTeams: [],
+        },
+        // isOrphanedRunning is undefined
+      });
+
+      await waitFor(() => {
+        expect(result.current.isSuccess).toBe(true);
+      });
+
+      expect(capturedParams?.get('orphanedRunning')).toBe('false');
+    });
+  });
+
+  describe('error handling', () => {
+    let consoleError: ReturnType<typeof vi.spyOn>;
+
+    beforeEach(() => {
+      // Suppress console.error for error tests to reduce noise
+      consoleError = vi.spyOn(console, 'error').mockImplementation(() => {});
+    });
+
+    afterEach(() => {
+      consoleError.mockRestore();
+    });
+
+    it('should handle API error when association fails', async () => {
+      server.use(
+        http.put('/api/stacks/:id/associate', () =>
+          HttpResponse.json({ message: 'Association failed' }, { status: 500 })
+        )
+      );
+
+      const { result } = renderMutationHook();
+
+      result.current.mutate({
+        environmentId: 1,
+        stackId: 123,
+        accessControl: {
+          ownership: ResourceControlOwnership.PRIVATE,
+          authorizedUsers: [],
+          authorizedTeams: [],
+        },
+      });
+
+      await waitFor(() => {
+        expect(result.current.isError).toBe(true);
+      });
+
+      expect(result.current.error).toBeDefined();
+    });
+
+    it('should throw error when ResourceControl is missing from response', async () => {
+      server.use(
+        http.put('/api/stacks/:id/associate', () =>
+          HttpResponse.json({
+            Id: 123,
+            Name: 'test-stack',
+            // ResourceControl is missing
+          } as Partial<Stack>)
+        )
+      );
+
+      const { result } = renderMutationHook();
+
+      result.current.mutate({
+        environmentId: 1,
+        stackId: 123,
+        accessControl: {
+          ownership: ResourceControlOwnership.PRIVATE,
+          authorizedUsers: [],
+          authorizedTeams: [],
+        },
+      });
+
+      await waitFor(() => {
+        expect(result.current.isError).toBe(true);
+      });
+
+      expect(result.current.error).toBeDefined();
+      expect((result.current.error as Error).message).toContain(
+        'resource control expected after creation'
+      );
+    });
+
+    it('should handle error when applying resource control fails', async () => {
+      server.use(
+        http.put('/api/stacks/:id/associate', () =>
+          HttpResponse.json({
+            Id: 123,
+            Name: 'test-stack',
+            ResourceControl: {
+              Id: 1,
+              ResourceId: 123,
+              Type: 6,
+            },
+          } as Partial<Stack>)
+        ),
+        http.put('/api/resource_controls/:id', () =>
+          HttpResponse.json(
+            { message: 'Failed to update resource control' },
+            { status: 500 }
+          )
+        )
+      );
+
+      const { result } = renderMutationHook();
+
+      result.current.mutate({
+        environmentId: 1,
+        stackId: 123,
+        accessControl: {
+          ownership: ResourceControlOwnership.PRIVATE,
+          authorizedUsers: [],
+          authorizedTeams: [],
+        },
+      });
+
+      await waitFor(() => {
+        expect(result.current.isError).toBe(true);
+      });
+
+      expect(result.current.error).toBeDefined();
+    });
+  });
+
+  describe('mutation states', () => {
+    it('should track loading state during mutation', async () => {
+      server.use(
+        http.put('/api/stacks/:id/associate', async () => {
+          await new Promise((resolve) => {
+            setTimeout(resolve, 100);
+          });
+          return HttpResponse.json({
+            Id: 123,
+            Name: 'test-stack',
+            ResourceControl: {
+              Id: 1,
+              ResourceId: 123,
+              Type: 6,
+            },
+          } as Partial<Stack>);
+        }),
+        http.put('/api/resource_controls/:id', () =>
+          HttpResponse.json({ success: true })
+        )
+      );
+
+      const { result } = renderMutationHook();
+
+      expect(result.current.isLoading).toBe(false);
+
+      result.current.mutate({
+        environmentId: 1,
+        stackId: 123,
+        accessControl: {
+          ownership: ResourceControlOwnership.PRIVATE,
+          authorizedUsers: [],
+          authorizedTeams: [],
+        },
+      });
+
+      await waitFor(() => {
+        expect(result.current.isLoading).toBe(true);
+      });
+
+      await waitFor(() => {
+        expect(result.current.isSuccess).toBe(true);
+      });
+
+      expect(result.current.isLoading).toBe(false);
+    });
+
+    it('should return stack data on success', async () => {
+      const mockStack = {
+        Id: 123,
+        Name: 'test-stack',
+        ResourceControl: {
+          Id: 1,
+          ResourceId: 123,
+          Type: 6,
+        },
+      } as Partial<Stack>;
+
+      server.use(
+        http.put('/api/stacks/:id/associate', () =>
+          HttpResponse.json(mockStack)
+        ),
+        http.put('/api/resource_controls/:id', () =>
+          HttpResponse.json({ success: true })
+        )
+      );
+
+      const { result } = renderMutationHook();
+
+      result.current.mutate({
+        environmentId: 1,
+        stackId: 123,
+        accessControl: {
+          ownership: ResourceControlOwnership.PRIVATE,
+          authorizedUsers: [],
+          authorizedTeams: [],
+        },
+      });
+
+      await waitFor(() => {
+        expect(result.current.isSuccess).toBe(true);
+      });
+
+      expect(result.current.data).toBeUndefined(); // Mutation returns void after applying resource control
+    });
+  });
+
+  describe('access control integration', () => {
+    it('should handle private ownership', async () => {
+      let resourceControlBody: unknown;
+
+      server.use(
+        http.put('/api/stacks/:id/associate', () =>
+          HttpResponse.json({
+            Id: 123,
+            Name: 'test-stack',
+            ResourceControl: {
+              Id: 1,
+              ResourceId: 123,
+              Type: 6,
+            },
+          } as Partial<Stack>)
+        ),
+        http.put('/api/resource_controls/:id', async ({ request }) => {
+          resourceControlBody = await request.json();
+          return HttpResponse.json({ success: true });
+        })
+      );
+
+      const { result } = renderMutationHook();
+
+      result.current.mutate({
+        environmentId: 1,
+        stackId: 123,
+        accessControl: {
+          ownership: ResourceControlOwnership.PRIVATE,
+          authorizedUsers: [],
+          authorizedTeams: [],
+        },
+      });
+
+      await waitFor(() => {
+        expect(result.current.isSuccess).toBe(true);
+      });
+
+      expect(resourceControlBody).toBeDefined();
+    });
+
+    it('should handle restricted ownership with users and teams', async () => {
+      let resourceControlBody: unknown;
+
+      server.use(
+        http.put('/api/stacks/:id/associate', () =>
+          HttpResponse.json({
+            Id: 123,
+            Name: 'test-stack',
+            ResourceControl: {
+              Id: 1,
+              ResourceId: 123,
+              Type: 6,
+            },
+          } as Partial<Stack>)
+        ),
+        http.put('/api/resource_controls/:id', async ({ request }) => {
+          resourceControlBody = await request.json();
+          return HttpResponse.json({ success: true });
+        })
+      );
+
+      const { result } = renderMutationHook();
+
+      result.current.mutate({
+        environmentId: 1,
+        stackId: 123,
+        accessControl: {
+          ownership: ResourceControlOwnership.RESTRICTED,
+          authorizedUsers: [1, 2, 3],
+          authorizedTeams: [10, 20],
+        },
+      });
+
+      await waitFor(() => {
+        expect(result.current.isSuccess).toBe(true);
+      });
+
+      expect(resourceControlBody).toBeDefined();
+    });
+  });
+});
diff --git a/app/react/docker/stacks/ItemView/StackInfoTab/useAssociateStackToEnvironmentMutation.ts b/app/react/docker/stacks/ItemView/StackInfoTab/useAssociateStackToEnvironmentMutation.ts
new file mode 100644
index 0000000..396cebb
--- /dev/null
+++ b/app/react/docker/stacks/ItemView/StackInfoTab/useAssociateStackToEnvironmentMutation.ts
@@ -0,0 +1,70 @@
+import { useMutation } from '@tanstack/react-query';
+
+import PortainerError from '@/portainer/error';
+import { applyResourceControl } from '@/react/portainer/access-control/access-control.service';
+import { AccessControlFormData } from '@/react/portainer/access-control/types';
+import axios from '@/portainer/services/axios/axios';
+import { buildStackUrl } from '@/react/common/stacks/queries/buildUrl';
+import { Stack } from '@/react/common/stacks/types';
+import { withError } from '@/react-tools/react-query';
+
+export function useAssociateStackToEnvironmentMutation() {
+  return useMutation({
+    mutationFn: associateStackToEnvironmentMutation,
+    ...withError('Failed to associate stack to environment'),
+  });
+}
+
+async function associateStackToEnvironmentMutation({
+  environmentId,
+  stackId,
+  isOrphanedRunning,
+  accessControl,
+  swarmId,
+}: {
+  environmentId: number;
+  stackId: number;
+  isOrphanedRunning?: boolean;
+  accessControl: AccessControlFormData;
+  swarmId?: string;
+}) {
+  const associatedStack = await associate({
+    environmentId,
+    stackId,
+    isOrphanedRunning,
+    swarmId,
+  });
+
+  const resourceControl = associatedStack.ResourceControl;
+  if (!resourceControl) {
+    throw new PortainerError('resource control expected after creation');
+  }
+
+  await applyResourceControl(accessControl, resourceControl.Id);
+}
+
+async function associate({
+  environmentId,
+  stackId,
+  isOrphanedRunning,
+  swarmId,
+}: {
+  environmentId: number;
+  stackId: number;
+  isOrphanedRunning?: boolean;
+  swarmId?: string;
+}) {
+  const { data } = await axios.put<Stack>(
+    buildStackUrl(stackId, 'associate'),
+    {},
+    {
+      params: {
+        endpointId: environmentId,
+        orphanedRunning: isOrphanedRunning ?? false,
+        swarmId,
+      },
+    }
+  );
+
+  return data;
+}
diff --git a/app/react/docker/stacks/ItemView/StackInfoTab/useStartStackMutation.ts b/app/react/docker/stacks/ItemView/StackInfoTab/useStartStackMutation.ts
new file mode 100644
index 0000000..de11a5f
--- /dev/null
+++ b/app/react/docker/stacks/ItemView/StackInfoTab/useStartStackMutation.ts
@@ -0,0 +1,30 @@
+import { useMutation } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { buildStackUrl } from '@/react/common/stacks/queries/buildUrl';
+import { Stack } from '@/react/common/stacks/types';
+
+export function useStartStackMutation() {
+  return useMutation({
+    mutationFn: startStack,
+  });
+}
+
+async function startStack({
+  id,
+  environmentId,
+}: {
+  id: Stack['Id'];
+  environmentId?: number;
+}) {
+  try {
+    const { data } = await axios.post<Stack>(
+      buildStackUrl(id, 'start'),
+      undefined,
+      { params: { endpointId: environmentId } }
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to start stack');
+  }
+}
diff --git a/app/react/docker/stacks/ItemView/StackInfoTab/useStopStackMutation.ts b/app/react/docker/stacks/ItemView/StackInfoTab/useStopStackMutation.ts
new file mode 100644
index 0000000..46ccd5a
--- /dev/null
+++ b/app/react/docker/stacks/ItemView/StackInfoTab/useStopStackMutation.ts
@@ -0,0 +1,30 @@
+import { useMutation } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { buildStackUrl } from '@/react/common/stacks/queries/buildUrl';
+import { Stack } from '@/react/common/stacks/types';
+
+export function useStopStackMutation() {
+  return useMutation({
+    mutationFn: stopStack,
+  });
+}
+
+async function stopStack({
+  id,
+  environmentId,
+}: {
+  id: Stack['Id'];
+  environmentId?: number;
+}) {
+  try {
+    const { data } = await axios.post<Stack>(
+      buildStackUrl(id, 'stop'),
+      undefined,
+      { params: { endpointId: environmentId } }
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to stop stack');
+  }
+}
diff --git a/app/react/docker/stacks/ItemView/StackServicesDatatable.tsx b/app/react/docker/stacks/ItemView/StackServicesDatatable.tsx
new file mode 100644
index 0000000..0fd2aaa
--- /dev/null
+++ b/app/react/docker/stacks/ItemView/StackServicesDatatable.tsx
@@ -0,0 +1,19 @@
+import { ListIcon } from 'lucide-react';
+
+import { ServicesDatatable } from '../../services/ListView/ServicesDatatable';
+
+import { useSwarmStackResources } from './useSwarmStackServices';
+
+export function StackServicesDatatable({ name }: { name: string }) {
+  const servicesQuery = useSwarmStackResources(name);
+  const services = servicesQuery.data;
+
+  return (
+    <ServicesDatatable
+      dataset={services}
+      titleIcon={ListIcon}
+      onRefresh={servicesQuery.refetch}
+      tableKey="stack-services"
+    />
+  );
+}
diff --git a/app/react/docker/stacks/ItemView/useComposeStackContainers.ts b/app/react/docker/stacks/ItemView/useComposeStackContainers.ts
new file mode 100644
index 0000000..88e2bd2
--- /dev/null
+++ b/app/react/docker/stacks/ItemView/useComposeStackContainers.ts
@@ -0,0 +1,23 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { COMPOSE_STACK_NAME_LABEL } from '@/react/constants';
+
+import { useContainers } from '../../containers/queries/useContainers';
+
+export function useComposeStackContainers(
+  {
+    environmentId,
+    stackName,
+  }: { environmentId: EnvironmentId | undefined; stackName: string },
+  {
+    autoRefreshRate,
+    enabled,
+  }: { autoRefreshRate?: number; enabled?: boolean } = {}
+) {
+  return useContainers(environmentId, {
+    filters: {
+      label: [`${COMPOSE_STACK_NAME_LABEL}=${stackName}`],
+    },
+    autoRefreshRate,
+    enabled,
+  });
+}
diff --git a/app/react/docker/stacks/ItemView/useSwarmStackServices.ts b/app/react/docker/stacks/ItemView/useSwarmStackServices.ts
new file mode 100644
index 0000000..7627d39
--- /dev/null
+++ b/app/react/docker/stacks/ItemView/useSwarmStackServices.ts
@@ -0,0 +1,111 @@
+import { useQueryClient } from '@tanstack/react-query';
+import _ from 'lodash';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useEnvironment } from '@/react/portainer/environments/queries';
+import { isAgentEnvironment } from '@/react/portainer/environments/utils';
+import { useTasks } from '@/react/docker/proxy/queries/tasks/useTasks';
+import { queryKeys as tasksQueryKeys } from '@/react/docker/proxy/queries/tasks/query-keys';
+import { TaskViewModel } from '@/docker/models/task';
+import { useServices } from '@/react/docker/services/queries/useServices';
+import { queryKeys as servicesQueryKeys } from '@/react/docker/services/queries/query-keys';
+import { ServiceViewModel } from '@/docker/models/service';
+import { useContainers } from '@/react/docker/containers/queries/useContainers';
+import { queryKeys as containersQueryKeys } from '@/react/docker/containers/queries/query-keys';
+import { ContainerListViewModel } from '@/react/docker/containers/types';
+import { SWARM_STACK_NAME_LABEL } from '@/react/constants';
+
+import { associateContainerToTask } from '../../tasks/utils';
+import { associateServiceTasks } from '../../services/utils';
+
+export function useSwarmStackResources(
+  stackName: string,
+  { enabled }: { enabled?: boolean } = {}
+) {
+  const queryClient = useQueryClient();
+  const environmentId = useEnvironmentId();
+  const isAgentQuery = useEnvironment(environmentId, (env) =>
+    isAgentEnvironment(env.Type)
+  );
+  const stackFilter = {
+    label: [`${SWARM_STACK_NAME_LABEL}=${stackName}`],
+  };
+
+  const isAgent = isAgentQuery.data || false;
+  const servicesQuery = useServices(
+    { environmentId, filters: stackFilter },
+    {
+      enabled,
+      select: (services) => services.map((s) => new ServiceViewModel(s)),
+    }
+  );
+  const tasksQuery = useTasks(
+    {
+      environmentId,
+      filters: stackFilter,
+    },
+    { enabled, select: (tasks) => tasks.map((t) => new TaskViewModel(t)) }
+  );
+  const containersQuery = useContainers(environmentId, {
+    enabled: enabled && isAgent,
+  });
+
+  const containerQueryIsLoading = isAgent && containersQuery.isLoading;
+
+  if (!servicesQuery.data || !tasksQuery.data || containerQueryIsLoading) {
+    return {
+      data: undefined,
+      isLoading: true,
+    };
+  }
+
+  const containers =
+    isAgent && containersQuery.data ? containersQuery.data : [];
+
+  const data = assignSwarmStackResources({
+    services: servicesQuery.data,
+    tasks: tasksQuery.data,
+    isAgent,
+    containers,
+  });
+
+  return {
+    data,
+    isLoading: false,
+    refetch: () =>
+      Promise.all(
+        _.compact([
+          queryClient.invalidateQueries(servicesQueryKeys.list(environmentId)),
+          queryClient.invalidateQueries(tasksQueryKeys.list(environmentId)),
+          isAgent &&
+            queryClient.invalidateQueries(
+              containersQueryKeys.list(environmentId)
+            ),
+        ])
+      ),
+  };
+}
+
+function assignSwarmStackResources({
+  services,
+  tasks,
+  isAgent,
+  containers,
+}: {
+  services: ServiceViewModel[];
+  tasks: TaskViewModel[];
+  isAgent: boolean;
+  containers: ContainerListViewModel[];
+}) {
+  const associatedTasks = isAgent
+    ? tasks.map((task) => associateContainerToTask(task, containers))
+    : tasks;
+
+  return services.map((service) => {
+    const serviceTasks = associateServiceTasks(service, associatedTasks);
+    return {
+      ...service,
+      Tasks: serviceTasks,
+    };
+  });
+}
diff --git a/app/react/docker/stacks/ItemView/useUpdateStackResourcesOnDeployment.ts b/app/react/docker/stacks/ItemView/useUpdateStackResourcesOnDeployment.ts
new file mode 100644
index 0000000..64e276d
--- /dev/null
+++ b/app/react/docker/stacks/ItemView/useUpdateStackResourcesOnDeployment.ts
@@ -0,0 +1,40 @@
+import { useEffect, useRef } from 'react';
+import { useQueryClient } from '@tanstack/react-query';
+
+import { Stack, StackStatus } from '@/react/common/stacks/types';
+import { queryKeys as dockerQueryKeys } from '@/react/docker/queries/utils';
+
+/**
+ * Hook to invalidate related Docker queries when a stack finishes deploying.
+ *
+ * This encapsulates the previous pattern of keeping a ref to the previous
+ * stack status and invalidating the docker root query for the environment
+ * when the stack transitions from Deploying -> not Deploying.
+ */
+export function useUpdateStackResourcesOnDeployment(stack?: Stack) {
+  const queryClient = useQueryClient();
+  const prevStatusRef = useRef<StackStatus | undefined>(undefined);
+
+  const status = stack?.Status;
+  const endpointId = stack?.EndpointId;
+  const id = stack?.Id;
+
+  useEffect(() => {
+    if (!id) {
+      return;
+    }
+
+    const prev = prevStatusRef.current;
+    prevStatusRef.current = status;
+
+    if (
+      prev === StackStatus.Deploying &&
+      status !== StackStatus.Deploying &&
+      endpointId !== undefined
+    ) {
+      queryClient.invalidateQueries(dockerQueryKeys.root(endpointId));
+    }
+  }, [status, endpointId, id, queryClient]);
+}
+
+export default useUpdateStackResourcesOnDeployment;
diff --git a/app/react/docker/stacks/ListView/StacksDatatable/StacksDatatable.tsx b/app/react/docker/stacks/ListView/StacksDatatable/StacksDatatable.tsx
new file mode 100644
index 0000000..8a660e0
--- /dev/null
+++ b/app/react/docker/stacks/ListView/StacksDatatable/StacksDatatable.tsx
@@ -0,0 +1,115 @@
+import { Layers } from 'lucide-react';
+import { Row } from '@tanstack/react-table';
+
+import { useAuthorizations, useIsEdgeAdmin } from '@/react/hooks/useUser';
+import { isBE } from '@/react/portainer/feature-flags/feature-flags.service';
+
+import { Datatable } from '@@/datatables';
+import { useRepeater } from '@@/datatables/useRepeater';
+import { defaultGlobalFilterFn } from '@@/datatables/Datatable';
+import { withGlobalFilter } from '@@/datatables/extend-options/withGlobalFilter';
+import { mergeOptions } from '@@/datatables/extend-options/mergeOptions';
+import { withColumnFilters } from '@@/datatables/extend-options/withColumnFilters';
+
+import { isExternalStack, isOrphanedStack } from '../../view-models/utils';
+
+import { TableActions } from './TableActions';
+import { TableSettingsMenus } from './TableSettingsMenus';
+import { useStore } from './store';
+import { useColumns } from './columns';
+import { DecoratedStack } from './types';
+
+export function StacksDatatable({
+  onRemove,
+  onReload,
+  isImageNotificationEnabled,
+  dataset,
+}: {
+  onRemove: (items: Array<DecoratedStack>) => void;
+  onReload: () => void;
+  isImageNotificationEnabled: boolean;
+  dataset: Array<DecoratedStack>;
+}) {
+  const tableState = useStore();
+  useRepeater(tableState.autoRefreshRate, onReload);
+  const isAdminQuery = useIsEdgeAdmin();
+  const { authorized: canManageStacks } = useAuthorizations([
+    'PortainerStackCreate',
+    'PortainerStackDelete',
+  ]);
+  const columns = useColumns(isImageNotificationEnabled);
+
+  return (
+    <Datatable<DecoratedStack>
+      settingsManager={tableState}
+      title="Stacks"
+      titleIcon={Layers}
+      renderTableActions={(selectedRows) => (
+        <TableActions selectedItems={selectedRows} onRemove={onRemove} />
+      )}
+      renderTableSettings={(tableInstance) => (
+        <TableSettingsMenus
+          tableInstance={tableInstance}
+          tableState={tableState}
+        />
+      )}
+      columns={columns}
+      dataset={dataset}
+      isRowSelectable={({ original: item }) =>
+        allowSelection(item, isAdminQuery.isAdmin, canManageStacks)
+      }
+      getRowId={(item) => item.Id.toString()}
+      initialTableState={{
+        globalFilter: {
+          showOrphanedStacks: tableState.showOrphanedStacks,
+        },
+        columnVisibility: Object.fromEntries(
+          tableState.hiddenColumns.map((col) => [col, false])
+        ),
+      }}
+      extendTableOptions={mergeOptions(
+        withGlobalFilter(globalFilterFn),
+        withColumnFilters(tableState.columnFilters, tableState.setColumnFilters)
+      )}
+      data-cy="docker-stacks-datatable"
+    />
+  );
+}
+
+function allowSelection(
+  item: DecoratedStack,
+  isAdmin: boolean,
+  canManageStacks: boolean
+) {
+  if (isExternalStack(item)) {
+    return false;
+  }
+
+  if (isBE && isOrphanedStack(item) && !isAdmin) {
+    return false;
+  }
+
+  return isAdmin || canManageStacks;
+}
+
+function globalFilterFn(
+  row: Row<DecoratedStack>,
+  columnId: string,
+  filterValue: null | { showOrphanedStacks: boolean; search: string }
+) {
+  return (
+    orphanedFilter(row, filterValue) &&
+    defaultGlobalFilterFn(row, columnId, filterValue)
+  );
+}
+
+function orphanedFilter(
+  row: Row<DecoratedStack>,
+  filterValue: null | { showOrphanedStacks: boolean; search: string }
+) {
+  if (filterValue?.showOrphanedStacks) {
+    return true;
+  }
+
+  return !isOrphanedStack(row.original);
+}
diff --git a/app/react/docker/stacks/ListView/StacksDatatable/TableActions.tsx b/app/react/docker/stacks/ListView/StacksDatatable/TableActions.tsx
new file mode 100644
index 0000000..30693d3
--- /dev/null
+++ b/app/react/docker/stacks/ListView/StacksDatatable/TableActions.tsx
@@ -0,0 +1,33 @@
+import { Authorized } from '@/react/hooks/useUser';
+
+import { AddButton } from '@@/buttons';
+import { DeleteButton } from '@@/buttons/DeleteButton';
+
+import { DecoratedStack } from './types';
+
+export function TableActions({
+  selectedItems,
+  onRemove,
+}: {
+  selectedItems: Array<DecoratedStack>;
+  onRemove: (items: Array<DecoratedStack>) => void;
+}) {
+  return (
+    <div className="flex items-center gap-2">
+      <Authorized authorizations="PortainerStackDelete">
+        <DeleteButton
+          disabled={selectedItems.length === 0}
+          onConfirmed={() => onRemove(selectedItems)}
+          confirmMessage="Do you want to remove the selected stack(s)? Associated services will be removed as well."
+          data-cy="stack-removeStackButton"
+        />
+      </Authorized>
+
+      <Authorized authorizations="PortainerStackCreate">
+        <AddButton data-cy="stack-addStackButton" to=".newstack">
+          Add stack
+        </AddButton>
+      </Authorized>
+    </div>
+  );
+}
diff --git a/app/react/docker/stacks/ListView/StacksDatatable/TableSettingsMenus.tsx b/app/react/docker/stacks/ListView/StacksDatatable/TableSettingsMenus.tsx
new file mode 100644
index 0000000..a1cfb3b
--- /dev/null
+++ b/app/react/docker/stacks/ListView/StacksDatatable/TableSettingsMenus.tsx
@@ -0,0 +1,53 @@
+import { Table } from '@tanstack/react-table';
+
+import { Authorized } from '@/react/hooks/useUser';
+
+import { ColumnVisibilityMenu } from '@@/datatables/ColumnVisibilityMenu';
+import { TableSettingsMenu } from '@@/datatables';
+import { TableSettingsMenuAutoRefresh } from '@@/datatables/TableSettingsMenuAutoRefresh';
+import { Checkbox } from '@@/form-components/Checkbox';
+
+import { TableSettings } from './store';
+import { DecoratedStack } from './types';
+
+export function TableSettingsMenus({
+  tableInstance,
+  tableState,
+}: {
+  tableInstance: Table<DecoratedStack>;
+  tableState: TableSettings;
+}) {
+  return (
+    <>
+      <ColumnVisibilityMenu<DecoratedStack>
+        table={tableInstance}
+        onChange={(hiddenColumns) => {
+          tableState.setHiddenColumns(hiddenColumns);
+        }}
+        value={tableState.hiddenColumns}
+      />
+      <TableSettingsMenu>
+        <Authorized authorizations="EndpointResourcesAccess">
+          <Checkbox
+            id="setting_all_orphaned_stacks"
+            data-cy="show-all-orphaned-stacks"
+            label="Show all orphaned stacks"
+            checked={tableState.showOrphanedStacks}
+            onChange={(e) => {
+              tableState.setShowOrphanedStacks(e.target.checked);
+              tableInstance.setGlobalFilter((filter: object) => ({
+                ...filter,
+                showOrphanedStacks: e.target.checked,
+              }));
+            }}
+          />
+        </Authorized>
+
+        <TableSettingsMenuAutoRefresh
+          value={tableState.autoRefreshRate}
+          onChange={(value) => tableState.setAutoRefreshRate(value)}
+        />
+      </TableSettingsMenu>
+    </>
+  );
+}
diff --git a/app/react/docker/stacks/ListView/StacksDatatable/columns/StackImageStatus.tsx b/app/react/docker/stacks/ListView/StacksDatatable/columns/StackImageStatus.tsx
new file mode 100644
index 0000000..3ef4f86
--- /dev/null
+++ b/app/react/docker/stacks/ListView/StacksDatatable/columns/StackImageStatus.tsx
@@ -0,0 +1,56 @@
+import { useQuery } from '@tanstack/react-query';
+import { Loader2 } from 'lucide-react';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { useEnvironment } from '@/react/portainer/environments/queries';
+import { statusIcon } from '@/react/docker/components/ImageStatus/helpers';
+
+import { Icon } from '@@/Icon';
+
+import { getStackImagesStatus } from './getStackImagesStatus';
+
+export interface Props {
+  stackId: number;
+  environmentId: number;
+}
+
+export function StackImageStatus({ stackId, environmentId }: Props) {
+  const { data, isLoading, isError } = useStackImageNotification(
+    stackId,
+    environmentId
+  );
+
+  if (isError) {
+    return null;
+  }
+
+  if (isLoading || !data) {
+    return (
+      <Icon
+        icon={Loader2}
+        size="sm"
+        className="!mr-1 animate-spin-slow align-middle"
+      />
+    );
+  }
+
+  return <Icon icon={statusIcon(data)} className="!mr-1 align-middle" />;
+}
+
+export function useStackImageNotification(
+  stackId: number,
+  environmentId?: EnvironmentId
+) {
+  const enableImageNotificationQuery = useEnvironment(
+    environmentId,
+    (environment) => environment?.EnableImageNotification
+  );
+
+  return useQuery(
+    ['stacks', stackId, 'images', 'status'],
+    () => getStackImagesStatus(stackId),
+    {
+      enabled: enableImageNotificationQuery.data,
+    }
+  );
+}
diff --git a/app/react/docker/stacks/ListView/StacksDatatable/columns/control.tsx b/app/react/docker/stacks/ListView/StacksDatatable/columns/control.tsx
new file mode 100644
index 0000000..4c417be
--- /dev/null
+++ b/app/react/docker/stacks/ListView/StacksDatatable/columns/control.tsx
@@ -0,0 +1,63 @@
+import { CellContext } from '@tanstack/react-table';
+import { AlertCircle } from 'lucide-react';
+import { PropsWithChildren } from 'react';
+
+import {
+  isExternalStack,
+  isOrphanedStack,
+  isRegularStack,
+} from '@/react/docker/stacks/view-models/utils';
+
+import { TooltipWithChildren } from '@@/Tip/TooltipWithChildren';
+import { Icon } from '@@/Icon';
+
+import { DecoratedStack } from '../types';
+
+import { columnHelper } from './helper';
+
+export const control = columnHelper.display({
+  header: 'Control',
+  id: 'control',
+  cell: ControlCell,
+  enableHiding: false,
+});
+
+function ControlCell({
+  row: { original: item },
+}: CellContext<DecoratedStack, unknown>) {
+  if (isRegularStack(item)) {
+    return <>Total</>;
+  }
+
+  if (isExternalStack(item)) {
+    return (
+      <Warning tooltip="This stack was created outside of Portainer. Control over this stack is limited.">
+        Limited
+      </Warning>
+    );
+  }
+
+  if (isOrphanedStack(item)) {
+    return (
+      <Warning tooltip="This stack was created inside an environment that is no longer registered inside Portainer.">
+        Orphaned
+      </Warning>
+    );
+  }
+
+  return null;
+}
+
+function Warning({
+  tooltip,
+  children,
+}: PropsWithChildren<{ tooltip: string }>) {
+  return (
+    <TooltipWithChildren message={tooltip}>
+      <span className="flex items-center gap-2">
+        {children}
+        <Icon icon={AlertCircle} mode="warning" />
+      </span>
+    </TooltipWithChildren>
+  );
+}
diff --git a/app/react/docker/stacks/ListView/StacksDatatable/columns/getStackImagesStatus.ts b/app/react/docker/stacks/ListView/StacksDatatable/columns/getStackImagesStatus.ts
new file mode 100644
index 0000000..1be89fa
--- /dev/null
+++ b/app/react/docker/stacks/ListView/StacksDatatable/columns/getStackImagesStatus.ts
@@ -0,0 +1,16 @@
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { ImageStatus } from '@/react/docker/components/ImageStatus/types';
+
+export async function getStackImagesStatus(id: number) {
+  try {
+    const { data } = await axios.get<ImageStatus>(
+      `/stacks/${id}/images_status`
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(
+      e,
+      `Unable to retrieve image status for stack: ${id}`
+    );
+  }
+}
diff --git a/app/react/docker/stacks/ListView/StacksDatatable/columns/helper.ts b/app/react/docker/stacks/ListView/StacksDatatable/columns/helper.ts
new file mode 100644
index 0000000..2cae65a
--- /dev/null
+++ b/app/react/docker/stacks/ListView/StacksDatatable/columns/helper.ts
@@ -0,0 +1,5 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { DecoratedStack } from '../types';
+
+export const columnHelper = createColumnHelper<DecoratedStack>();
diff --git a/app/react/docker/stacks/ListView/StacksDatatable/columns/image-notification.tsx b/app/react/docker/stacks/ListView/StacksDatatable/columns/image-notification.tsx
new file mode 100644
index 0000000..fca1fcb
--- /dev/null
+++ b/app/react/docker/stacks/ListView/StacksDatatable/columns/image-notification.tsx
@@ -0,0 +1,34 @@
+import { CellContext } from '@tanstack/react-table';
+
+import { ImageUpToDateTooltip } from '@/react/docker/components/datatable/TableColumnHeaderImageUpToDate';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { isRegularStack } from '@/react/docker/stacks/view-models/utils';
+
+import { DecoratedStack } from '../types';
+
+import { StackImageStatus } from './StackImageStatus';
+import { columnHelper } from './helper';
+
+export const imageNotificationColumn = columnHelper.display({
+  id: 'imageNotification',
+  enableHiding: false,
+  header: () => (
+    <>
+      Images up to date
+      <ImageUpToDateTooltip />
+    </>
+  ),
+  cell: Cell,
+});
+
+function Cell({
+  row: { original: item },
+}: CellContext<DecoratedStack, unknown>) {
+  const environmentId = useEnvironmentId();
+
+  if (!isRegularStack(item)) {
+    return null;
+  }
+
+  return <StackImageStatus environmentId={environmentId} stackId={item.Id} />;
+}
diff --git a/app/react/docker/stacks/ListView/StacksDatatable/columns/index.ts b/app/react/docker/stacks/ListView/StacksDatatable/columns/index.ts
new file mode 100644
index 0000000..63bcd5e
--- /dev/null
+++ b/app/react/docker/stacks/ListView/StacksDatatable/columns/index.ts
@@ -0,0 +1,56 @@
+import _ from 'lodash';
+
+import { StackType } from '@/react/common/stacks/types';
+import { isoDateFromTimestamp } from '@/portainer/filters/filters';
+import { createOwnershipColumn } from '@/react/docker/components/datatable/createOwnershipColumn';
+
+import { DecoratedStack } from '../types';
+
+import { columnHelper } from './helper';
+import { name } from './name';
+import { imageNotificationColumn } from './image-notification';
+import { control } from './control';
+
+export function useColumns(isImageNotificationEnabled: boolean) {
+  return _.compact([
+    name,
+    columnHelper.accessor(
+      (item) => (item.Type === StackType.DockerCompose ? 'Compose' : 'Swarm'),
+      {
+        id: 'type',
+        header: 'Type',
+        enableHiding: false,
+      }
+    ),
+    isImageNotificationEnabled && imageNotificationColumn,
+    control,
+    columnHelper.accessor('CreationDate', {
+      id: 'creationDate',
+      header: 'Created',
+      enableHiding: false,
+      cell: ({ getValue, row: { original: item } }) => {
+        const value = getValue();
+        if (!value) {
+          return '-';
+        }
+
+        const by = item.CreatedBy ? `by ${item.CreatedBy}` : '';
+        return `${isoDateFromTimestamp(value)} ${by}`.trim();
+      },
+    }),
+    columnHelper.accessor('UpdateDate', {
+      id: 'updateDate',
+      header: 'Updated',
+      cell: ({ getValue, row: { original: item } }) => {
+        const value = getValue();
+        if (!value) {
+          return '-';
+        }
+
+        const by = item.UpdatedBy ? `by ${item.UpdatedBy}` : '';
+        return `${isoDateFromTimestamp(value)} ${by}`.trim();
+      },
+    }),
+    createOwnershipColumn<DecoratedStack>(false),
+  ]);
+}
diff --git a/app/react/docker/stacks/ListView/StacksDatatable/columns/name.tsx b/app/react/docker/stacks/ListView/StacksDatatable/columns/name.tsx
new file mode 100644
index 0000000..78e4645
--- /dev/null
+++ b/app/react/docker/stacks/ListView/StacksDatatable/columns/name.tsx
@@ -0,0 +1,151 @@
+import { CellContext, Column } from '@tanstack/react-table';
+
+import { useIsEdgeAdmin } from '@/react/hooks/useUser';
+import { getValueAsArrayOfStrings } from '@/portainer/helpers/array';
+import { StackStatus } from '@/react/common/stacks/types';
+import {
+  isExternalStack,
+  isOrphanedStack,
+  isRegularStack,
+} from '@/react/docker/stacks/view-models/utils';
+
+import { Link } from '@@/Link';
+import { MultipleSelectionFilter } from '@@/datatables/Filter';
+
+import { DecoratedStack } from '../types';
+
+import { columnHelper } from './helper';
+
+const filterOptions = [
+  'Active Stacks',
+  'Inactive Stacks',
+  'Deploying Stacks',
+  'Error Stacks',
+] as const;
+
+type FilterOption = (typeof filterOptions)[number];
+
+export const name = columnHelper.accessor('Name', {
+  header: 'Name',
+  id: 'name',
+  cell: NameCell,
+  enableHiding: false,
+  enableColumnFilter: true,
+  filterFn: (
+    { original: stack },
+    columnId,
+    filterValue: Array<FilterOption>
+  ) => {
+    if (filterValue.length === 0) {
+      return true;
+    }
+
+    if (isExternalStack(stack) || !stack.Status) {
+      return true;
+    }
+
+    return (
+      (stack.Status === StackStatus.Active &&
+        filterValue.includes('Active Stacks')) ||
+      (stack.Status === StackStatus.Inactive &&
+        filterValue.includes('Inactive Stacks')) ||
+      (stack.Status === StackStatus.Deploying &&
+        filterValue.includes('Deploying Stacks')) ||
+      (stack.Status === StackStatus.Error &&
+        filterValue.includes('Error Stacks'))
+    );
+  },
+  meta: {
+    filter: Filter,
+  },
+});
+
+function NameCell({
+  row: { original: item },
+}: CellContext<DecoratedStack, string>) {
+  return (
+    <>
+      <NameLink item={item} />
+      {isRegularStack(item) && item.Status === StackStatus.Inactive && (
+        <span className="label label-warning image-tag space-left ml-2">
+          Inactive
+        </span>
+      )}
+      {isRegularStack(item) && item.Status === StackStatus.Deploying && (
+        <span className="label label-info image-tag space-left ml-2">
+          Deploying...
+        </span>
+      )}
+      {isRegularStack(item) && item.Status === StackStatus.Error && (
+        <span className="label label-danger image-tag space-left ml-2">
+          Error
+        </span>
+      )}
+    </>
+  );
+}
+
+function NameLink({ item }: { item: DecoratedStack }) {
+  const isAdminQuery = useIsEdgeAdmin();
+
+  const name = item.Name;
+
+  if (isExternalStack(item)) {
+    return (
+      <Link
+        to="docker.stacks.stack"
+        params={{
+          name: item.Name,
+          type: item.Type,
+          external: true,
+        }}
+        title={name}
+        data-cy="docker-external-stack-link"
+      >
+        {name}
+      </Link>
+    );
+  }
+
+  if (!isAdminQuery.isAdmin && isOrphanedStack(item)) {
+    return <>{name}</>;
+  }
+
+  return (
+    <Link
+      to="docker.stacks.stack"
+      params={{
+        name: item.Name,
+        id: item.Id,
+        type: item.Type,
+        regular: item.Regular,
+        orphaned: item.Orphaned,
+        orphanedRunning: item.OrphanedRunning,
+      }}
+      title={name}
+      data-cy={`docker-stack-link-${item.Name}`}
+    >
+      {name}
+    </Link>
+  );
+}
+
+function Filter<TData extends { Used: boolean }>({
+  column: { getFilterValue, setFilterValue, id },
+}: {
+  column: Column<TData>;
+}) {
+  const value = getFilterValue();
+
+  const valueAsArray = getValueAsArrayOfStrings(value);
+
+  return (
+    <MultipleSelectionFilter
+      options={filterOptions}
+      filterKey={id}
+      value={valueAsArray}
+      onChange={setFilterValue}
+      menuTitle="Filter by activity"
+    />
+  );
+}
diff --git a/app/react/docker/stacks/ListView/StacksDatatable/index.ts b/app/react/docker/stacks/ListView/StacksDatatable/index.ts
new file mode 100644
index 0000000..9b1d871
--- /dev/null
+++ b/app/react/docker/stacks/ListView/StacksDatatable/index.ts
@@ -0,0 +1 @@
+export { StacksDatatable } from './StacksDatatable';
diff --git a/app/react/docker/stacks/ListView/StacksDatatable/store.ts b/app/react/docker/stacks/ListView/StacksDatatable/store.ts
new file mode 100644
index 0000000..ecd457b
--- /dev/null
+++ b/app/react/docker/stacks/ListView/StacksDatatable/store.ts
@@ -0,0 +1,34 @@
+import {
+  type BasicTableSettings,
+  type FilteredColumnsTableSettings,
+  type RefreshableTableSettings,
+  type SettableColumnsTableSettings,
+  hiddenColumnsSettings,
+  refreshableSettings,
+  filteredColumnsSettings,
+} from '@@/datatables/types';
+import { useTableStateWithStorage } from '@@/datatables/useTableState';
+
+export interface TableSettings
+  extends
+    BasicTableSettings,
+    SettableColumnsTableSettings,
+    RefreshableTableSettings,
+    FilteredColumnsTableSettings {
+  showOrphanedStacks: boolean;
+  setShowOrphanedStacks(value: boolean): void;
+}
+
+const tableKey = 'docker_stacks';
+
+export function useStore() {
+  return useTableStateWithStorage<TableSettings>(tableKey, 'name', (set) => ({
+    ...hiddenColumnsSettings(set),
+    ...refreshableSettings(set),
+    ...filteredColumnsSettings(set),
+    showOrphanedStacks: false,
+    setShowOrphanedStacks(showOrphanedStacks) {
+      set((s) => ({ ...s, showOrphanedStacks }));
+    },
+  }));
+}
diff --git a/app/react/docker/stacks/ListView/StacksDatatable/types.ts b/app/react/docker/stacks/ListView/StacksDatatable/types.ts
new file mode 100644
index 0000000..afc8e09
--- /dev/null
+++ b/app/react/docker/stacks/ListView/StacksDatatable/types.ts
@@ -0,0 +1,4 @@
+import { StackViewModel } from '../../view-models/stack';
+import { ExternalStackViewModel } from '../../view-models/external-stack';
+
+export type DecoratedStack = StackViewModel | ExternalStackViewModel;
diff --git a/app/react/docker/stacks/common/NameField.tsx b/app/react/docker/stacks/common/NameField.tsx
new file mode 100644
index 0000000..152ceea
--- /dev/null
+++ b/app/react/docker/stacks/common/NameField.tsx
@@ -0,0 +1,85 @@
+import { FormikErrors } from 'formik';
+import { SchemaOf, string } from 'yup';
+import { useMemo } from 'react';
+
+import { STACK_NAME_VALIDATION_REGEX } from '@/react/constants';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { useStacks } from '@/react/common/stacks/queries/useStacks';
+import { Stack } from '@/react/common/stacks/types';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+
+export function NameField({
+  onChange,
+  value,
+  errors,
+  placeholder,
+}: {
+  onChange(value: string): void;
+  value: string;
+  errors?: FormikErrors<string>;
+  placeholder?: string;
+}) {
+  return (
+    <FormControl
+      inputId="name-input"
+      label="Name"
+      errors={errors}
+      required
+      size="xsmall"
+    >
+      <Input
+        id="name-input"
+        onChange={(e) => onChange(e.target.value)}
+        value={value}
+        placeholder={placeholder}
+        required
+        data-cy="stack-name-input"
+      />
+    </FormControl>
+  );
+}
+
+/**
+ * Stack name validation with uniqueness check
+ */
+export function nameValidation({
+  environmentId,
+  stacks = [],
+  excludeStackName,
+}: {
+  environmentId: EnvironmentId;
+  stacks?: Array<Stack>;
+  excludeStackName?: string;
+}): SchemaOf<string> {
+  return string()
+    .default('')
+    .test(
+      'unique',
+      'Name should be unique',
+      (value) =>
+        !value ||
+        excludeStackName === value ||
+        stacks.every((s) => s.EndpointId !== environmentId || s.Name !== value)
+    )
+    .matches(new RegExp(STACK_NAME_VALIDATION_REGEX), {
+      excludeEmptyString: true,
+      message:
+        "This field must consist of lower case alphanumeric characters, '_' or '-' (e.g. 'my-name', or 'abc-123').",
+    });
+}
+
+export function useNameValidation(
+  environmentId: EnvironmentId
+): SchemaOf<string> {
+  const stacksQuery = useStacks();
+
+  return useMemo(
+    () =>
+      nameValidation({ environmentId, stacks: stacksQuery.data }).required(
+        'Name is required'
+      ),
+    [environmentId, stacksQuery.data]
+  );
+}
diff --git a/app/react/docker/stacks/common/WebhookFieldset.tsx b/app/react/docker/stacks/common/WebhookFieldset.tsx
new file mode 100644
index 0000000..2b96fee
--- /dev/null
+++ b/app/react/docker/stacks/common/WebhookFieldset.tsx
@@ -0,0 +1,73 @@
+import { useState } from 'react';
+
+import { baseStackWebhookUrl } from '@/portainer/helpers/webhookHelper';
+import { Authorized, useAuthorizations } from '@/react/hooks/useUser';
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+import { WebhookSettings } from '@/react/portainer/gitops/AutoUpdateFieldset/WebhookSettings';
+
+import { FormSection } from '@@/form-components/FormSection';
+import { SwitchField } from '@@/form-components/SwitchField';
+
+export function WebhookFieldset({
+  value,
+  onChange,
+  webhookId,
+}: {
+  value: boolean;
+  onChange(value: boolean): void;
+  webhookId: string;
+}) {
+  const [hasWebhook] = useState(() => value);
+  const authQuery = useAuthorizations(
+    hasWebhook ? ['PortainerWebhookDelete'] : ['PortainerWebhookCreate']
+  );
+
+  return (
+    <Authorized
+      authorizations={[
+        'PortainerWebhookCreate',
+        'PortainerWebhookList',
+        'PortainerWebhookDelete',
+      ]}
+      adminOnlyCE
+    >
+      <AuthorizedWebhook
+        value={value}
+        onChange={onChange}
+        disabled={!authQuery.authorized}
+        webhookId={webhookId}
+      />
+    </Authorized>
+  );
+}
+
+export function AuthorizedWebhook({
+  value,
+  onChange,
+  disabled,
+  webhookId,
+}: {
+  value: boolean;
+  onChange(value: boolean): void;
+  disabled?: boolean;
+  webhookId: string;
+}) {
+  return (
+    <FormSection title="Webhooks">
+      <SwitchField
+        name="enableWebhook"
+        checked={value}
+        onChange={(checked) => onChange(checked)}
+        labelClass="col-sm-2"
+        tooltip="Create a webhook (or callback URI) to automate the update of this stack. Sending a POST request to this callback URI (without requiring any authentication) will pull the most up-to-date version of the associated image and re-deploy this stack."
+        label="Create a Stack webhook"
+        featureId={FeatureId.STACK_WEBHOOK}
+        data-cy="stack-webhook-switch"
+        disabled={disabled}
+      />
+      {value && (
+        <WebhookSettings baseUrl={baseStackWebhookUrl()} value={webhookId} />
+      )}
+    </FormSection>
+  );
+}
diff --git a/app/react/docker/stacks/common/container-names.test.ts b/app/react/docker/stacks/common/container-names.test.ts
new file mode 100644
index 0000000..c898cbe
--- /dev/null
+++ b/app/react/docker/stacks/common/container-names.test.ts
@@ -0,0 +1,224 @@
+import { describe, it, expect } from 'vitest';
+
+import {
+  extractContainerNames,
+  extractContainerNamesFromYaml,
+} from './container-names';
+
+describe('extractContainerNames', () => {
+  it('should extract container names from valid Docker Compose YAML', () => {
+    const yaml = `
+version: '3'
+services:
+  web:
+    image: nginx
+    container_name: my-nginx
+  db:
+    image: postgres
+    container_name: my-postgres
+`;
+
+    const result = extractContainerNames(yaml);
+
+    expect(result).toEqual(['my-nginx', 'my-postgres']);
+  });
+
+  it('should return unique container names when duplicates exist', () => {
+    const yaml = `
+version: '3'
+services:
+  web:
+    image: nginx
+    container_name: my-app
+  api:
+    image: node
+    container_name: my-app
+`;
+
+    const result = extractContainerNames(yaml);
+
+    expect(result).toEqual(['my-app']);
+  });
+
+  it('should handle services without container_name property', () => {
+    const yaml = `
+version: '3'
+services:
+  web:
+    image: nginx
+  db:
+    image: postgres
+    container_name: my-postgres
+`;
+
+    const result = extractContainerNames(yaml);
+
+    expect(result).toEqual(['my-postgres']);
+  });
+
+  it('should return empty array for invalid YAML syntax', () => {
+    const yaml = `
+version: '3'
+services:
+  web:
+    image: nginx
+    container_name: [invalid syntax
+`;
+
+    const result = extractContainerNames(yaml);
+
+    expect(result).toEqual([]);
+  });
+
+  it('should return empty array for empty YAML', () => {
+    const result = extractContainerNames('');
+
+    expect(result).toEqual([]);
+  });
+
+  it('should return empty array when no services are defined', () => {
+    const yaml = `
+version: '3'
+services: {}
+`;
+
+    const result = extractContainerNames(yaml);
+
+    expect(result).toEqual([]);
+  });
+
+  it('should handle nested container_name properties', () => {
+    const yaml = `
+version: '3'
+services:
+  web:
+    image: nginx
+    container_name: my-nginx
+    deploy:
+      replicas: 2
+      metadata:
+        container_name: nested-name
+`;
+
+    const result = extractContainerNames(yaml);
+
+    expect(result).toEqual(['my-nginx', 'nested-name']);
+  });
+
+  it('should handle YAML with multiple top-level sections', () => {
+    const yaml = `
+version: '3'
+services:
+  web:
+    image: nginx
+    container_name: web-container
+volumes:
+  data:
+    driver: local
+networks:
+  backend:
+    driver: bridge
+`;
+
+    const result = extractContainerNames(yaml);
+
+    expect(result).toEqual(['web-container']);
+  });
+});
+
+describe('extractContainerNamesFromYaml', () => {
+  it('should extract container names from parsed YAML object', () => {
+    const yamlObject = {
+      version: '3',
+      services: {
+        web: {
+          image: 'nginx',
+          container_name: 'my-nginx',
+        },
+        db: {
+          image: 'postgres',
+          container_name: 'my-postgres',
+        },
+      },
+    };
+
+    const result = extractContainerNamesFromYaml(yamlObject);
+
+    expect(result).toEqual(['my-nginx', 'my-postgres']);
+  });
+
+  it('should return empty array for null input', () => {
+    const result = extractContainerNamesFromYaml(null);
+
+    expect(result).toEqual([]);
+  });
+
+  it('should return empty array for undefined input', () => {
+    const result = extractContainerNamesFromYaml(undefined);
+
+    expect(result).toEqual([]);
+  });
+
+  it('should return empty array for primitive input', () => {
+    const result = extractContainerNamesFromYaml('string');
+
+    expect(result).toEqual([]);
+  });
+
+  it('should handle deeply nested objects', () => {
+    const yamlObject = {
+      level1: {
+        level2: {
+          level3: {
+            container_name: 'deep-container',
+          },
+        },
+      },
+      services: {
+        web: {
+          container_name: 'shallow-container',
+        },
+      },
+    };
+
+    const result = extractContainerNamesFromYaml(yamlObject);
+
+    expect(result).toEqual(['deep-container', 'shallow-container']);
+  });
+
+  it('should handle arrays containing objects with container_name', () => {
+    const yamlObject = {
+      services: [
+        {
+          name: 'web',
+          container_name: 'array-container-1',
+        },
+        {
+          name: 'db',
+          container_name: 'array-container-2',
+        },
+      ],
+    };
+
+    const result = extractContainerNamesFromYaml(yamlObject);
+
+    expect(result).toEqual(['array-container-1', 'array-container-2']);
+  });
+
+  it('should return unique names when duplicates exist in parsed object', () => {
+    const yamlObject = {
+      services: {
+        web: {
+          container_name: 'duplicate-name',
+        },
+        api: {
+          container_name: 'duplicate-name',
+        },
+      },
+    };
+
+    const result = extractContainerNamesFromYaml(yamlObject);
+
+    expect(result).toEqual(['duplicate-name']);
+  });
+});
diff --git a/app/react/docker/stacks/common/container-names.ts b/app/react/docker/stacks/common/container-names.ts
new file mode 100644
index 0000000..0daba67
--- /dev/null
+++ b/app/react/docker/stacks/common/container-names.ts
@@ -0,0 +1,53 @@
+import _ from 'lodash';
+import YAML from 'yaml';
+
+/**
+ * Extracts all container names from a Docker Compose YAML string
+ * @param yaml - The YAML content to parse
+ * @returns Array of unique container names found in the YAML
+ */
+export function extractContainerNames(yaml = ''): string[] {
+  let yamlObject;
+
+  try {
+    yamlObject = YAML.parse(yaml, { maxAliasCount: 10000 });
+  } catch (err) {
+    return [];
+  }
+
+  return extractContainerNamesFromYaml(yamlObject);
+}
+
+/**
+ * Extracts all container names from a Docker Compose YAML object
+ * @param yaml - The YAML object
+ * @returns Array of unique container names found in the YAML
+ */
+export function extractContainerNamesFromYaml(yaml: unknown): string[] {
+  return _.uniq(findDeepAll<string>(yaml, 'container_name'));
+}
+
+/**
+ * Recursively finds all values for a given key in a nested object structure
+ * @param obj - The object to search
+ * @param target - The key to find
+ * @param res - Accumulator for results (used internally)
+ * @returns Array of all values found for the target key
+ */
+function findDeepAll<T = unknown>(
+  obj: unknown,
+  target: string,
+  res: T[] = []
+): T[] {
+  if (typeof obj === 'object' && obj !== null) {
+    _.forEach(obj as Record<string, unknown>, (child, key) => {
+      if (key === target) {
+        res.push(child as T);
+      }
+      if (typeof child === 'object' && child !== null) {
+        findDeepAll(child, target, res);
+      }
+    });
+  }
+  return res;
+}
diff --git a/app/react/docker/stacks/common/stackYamlValidation.test.ts b/app/react/docker/stacks/common/stackYamlValidation.test.ts
new file mode 100644
index 0000000..2d118f6
--- /dev/null
+++ b/app/react/docker/stacks/common/stackYamlValidation.test.ts
@@ -0,0 +1,351 @@
+import { describe, it, expect } from 'vitest';
+
+import { validateYAML, hasYamlChanged } from './stackYamlValidation';
+
+describe('validateYAML', () => {
+  describe('YAML syntax validation', () => {
+    it('should return empty string for valid YAML', () => {
+      const yaml = `
+version: '3'
+services:
+  web:
+    image: nginx
+    container_name: my-nginx
+`;
+
+      const result = validateYAML(yaml);
+
+      expect(result).toBe('');
+    });
+
+    it('should return error message for invalid YAML syntax', () => {
+      const yaml = `
+version: '3'
+services:
+  web:
+    image: nginx
+    container_name: [invalid
+`;
+
+      const result = validateYAML(yaml);
+
+      expect(result).toContain('There is an error in the yaml syntax:');
+    });
+
+    it('should handle empty YAML string', () => {
+      const result = validateYAML('');
+
+      expect(result).toBe('');
+    });
+
+    it('should handle YAML with comments', () => {
+      const yaml = `
+# This is a comment
+version: '3'
+services:
+  web:
+    image: nginx  # inline comment
+`;
+
+      const result = validateYAML(yaml);
+
+      expect(result).toBe('');
+    });
+  });
+
+  describe('container name conflict detection', () => {
+    it('should detect single container name conflict', () => {
+      const yaml = `
+version: '3'
+services:
+  web:
+    image: nginx
+    container_name: existing-container
+`;
+      const containerNames = ['existing-container', 'other-container'];
+      const originalContainerNames: string[] = [];
+
+      const result = validateYAML(yaml, containerNames, originalContainerNames);
+
+      expect(result).toBe(
+        'This container name is already used by another container running in this environment: existing-container.'
+      );
+    });
+
+    it('should detect multiple container name conflicts', () => {
+      const yaml = `
+version: '3'
+services:
+  web:
+    image: nginx
+    container_name: existing-1
+  db:
+    image: postgres
+    container_name: existing-2
+`;
+      const containerNames = ['existing-1', 'existing-2', 'other-container'];
+      const originalContainerNames: string[] = [];
+
+      const result = validateYAML(yaml, containerNames, originalContainerNames);
+
+      expect(result).toBe(
+        'These container names are already used by another container running in this environment: existing-1, existing-2.'
+      );
+    });
+
+    it('should ignore conflicts with original container names', () => {
+      const yaml = `
+version: '3'
+services:
+  web:
+    image: nginx
+    container_name: my-container
+`;
+      const containerNames = ['my-container', 'other-container'];
+      const originalContainerNames = ['my-container'];
+
+      const result = validateYAML(yaml, containerNames, originalContainerNames);
+
+      expect(result).toBe('');
+    });
+
+    it('should detect conflict when editing container names in existing stack', () => {
+      const yaml = `
+version: '3'
+services:
+  web:
+    image: nginx
+    container_name: conflicting-name
+`;
+      const containerNames = [
+        'original-name',
+        'conflicting-name',
+        'other-container',
+      ];
+      const originalContainerNames = ['original-name'];
+
+      const result = validateYAML(yaml, containerNames, originalContainerNames);
+
+      expect(result).toBe(
+        'This container name is already used by another container running in this environment: conflicting-name.'
+      );
+    });
+
+    it('should allow renaming container in same stack', () => {
+      const yaml = `
+version: '3'
+services:
+  web:
+    image: nginx
+    container_name: new-name
+`;
+      const containerNames = ['old-name', 'other-container'];
+      const originalContainerNames = ['old-name'];
+
+      const result = validateYAML(yaml, containerNames, originalContainerNames);
+
+      expect(result).toBe('');
+    });
+
+    it('should handle empty containerNames array', () => {
+      const yaml = `
+version: '3'
+services:
+  web:
+    image: nginx
+    container_name: my-container
+`;
+
+      const result = validateYAML(yaml, [], []);
+
+      expect(result).toBe('');
+    });
+
+    it('should handle YAML without container_name properties', () => {
+      const yaml = `
+version: '3'
+services:
+  web:
+    image: nginx
+  db:
+    image: postgres
+`;
+      const containerNames = ['existing-container'];
+
+      const result = validateYAML(yaml, containerNames);
+
+      expect(result).toBe('');
+    });
+
+    it('should detect partial conflicts in multi-service stack', () => {
+      const yaml = `
+version: '3'
+services:
+  web:
+    image: nginx
+    container_name: unique-name
+  db:
+    image: postgres
+    container_name: conflicting-name
+  cache:
+    image: redis
+    container_name: another-unique
+`;
+      const containerNames = ['conflicting-name', 'other-container'];
+      const originalContainerNames: string[] = [];
+
+      const result = validateYAML(yaml, containerNames, originalContainerNames);
+
+      expect(result).toBe(
+        'This container name is already used by another container running in this environment: conflicting-name.'
+      );
+    });
+
+    it('should use default empty arrays when containerNames not provided', () => {
+      const yaml = `
+version: '3'
+services:
+  web:
+    image: nginx
+    container_name: my-container
+`;
+
+      const result = validateYAML(yaml);
+
+      expect(result).toBe('');
+    });
+  });
+
+  describe('edge cases', () => {
+    it('should handle YAML with duplicate container names in same stack', () => {
+      const yaml = `
+version: '3'
+services:
+  web:
+    image: nginx
+    container_name: duplicate-name
+  api:
+    image: node
+    container_name: duplicate-name
+`;
+      const containerNames = ['duplicate-name'];
+      const originalContainerNames: string[] = [];
+
+      const result = validateYAML(yaml, containerNames, originalContainerNames);
+
+      expect(result).toBe(
+        'This container name is already used by another container running in this environment: duplicate-name.'
+      );
+    });
+
+    it('should handle nested container_name properties', () => {
+      const yaml = `
+version: '3'
+services:
+  web:
+    image: nginx
+    container_name: main-container
+    deploy:
+      metadata:
+        container_name: nested-container
+`;
+      const containerNames = ['nested-container'];
+      const originalContainerNames: string[] = [];
+
+      const result = validateYAML(yaml, containerNames, originalContainerNames);
+
+      expect(result).toBe(
+        'This container name is already used by another container running in this environment: nested-container.'
+      );
+    });
+
+    it('should return validation error before checking conflicts for invalid YAML', () => {
+      const yaml = 'invalid: [yaml: syntax';
+      const containerNames = ['existing-container'];
+
+      const result = validateYAML(yaml, containerNames);
+
+      expect(result).toContain('There is an error in the yaml syntax:');
+    });
+  });
+});
+
+describe('hasYamlChanged', () => {
+  it('should return false for identical strings', () => {
+    const original = 'version: "3"\nservices:\n  web:\n    image: nginx';
+    const updated = 'version: "3"\nservices:\n  web:\n    image: nginx';
+
+    const result = hasYamlChanged(original, updated);
+
+    expect(result).toBe(false);
+  });
+
+  it('should return true for different content', () => {
+    const original = 'version: "3"\nservices:\n  web:\n    image: nginx';
+    const updated = 'version: "3"\nservices:\n  web:\n    image: apache';
+
+    const result = hasYamlChanged(original, updated);
+
+    expect(result).toBe(true);
+  });
+
+  it('should ignore line ending differences (LF vs CRLF)', () => {
+    const original = 'version: "3"\nservices:\n  web:\n    image: nginx';
+    const updated = 'version: "3"\r\nservices:\r\n  web:\r\n    image: nginx';
+
+    const result = hasYamlChanged(original, updated);
+
+    expect(result).toBe(false);
+  });
+
+  it('should ignore mixed line endings', () => {
+    const original = 'version: "3"\nservices:\r\n  web:\n    image: nginx';
+    const updated = 'version: "3"\r\nservices:\n  web:\r\n    image: nginx';
+
+    const result = hasYamlChanged(original, updated);
+
+    expect(result).toBe(false);
+  });
+
+  it('should detect changes when whitespace differs significantly', () => {
+    const original = 'version: "3"\nservices:\n  web:\n    image: nginx';
+    const updated = 'version: "3"\nservices:\n   web:\n    image: nginx'; // Extra space
+
+    const result = hasYamlChanged(original, updated);
+
+    expect(result).toBe(true);
+  });
+
+  it('should return false for empty strings', () => {
+    const result = hasYamlChanged('', '');
+
+    expect(result).toBe(false);
+  });
+
+  it('should return true when one string is empty', () => {
+    const original = 'version: "3"';
+    const updated = '';
+
+    const result = hasYamlChanged(original, updated);
+
+    expect(result).toBe(true);
+  });
+
+  it('should ignore old Mac line endings (CR)', () => {
+    const original = 'version: "3"\nservices:\n  web:\n    image: nginx';
+    const updated = 'version: "3"\rservices:\r  web:\r    image: nginx';
+
+    const result = hasYamlChanged(original, updated);
+
+    expect(result).toBe(false);
+  });
+
+  it('should handle strings with only line ending differences', () => {
+    const original = '\n\n\n';
+    const updated = '\r\n\r\n\r\n';
+
+    const result = hasYamlChanged(original, updated);
+
+    expect(result).toBe(false);
+  });
+});
diff --git a/app/react/docker/stacks/common/stackYamlValidation.ts b/app/react/docker/stacks/common/stackYamlValidation.ts
new file mode 100644
index 0000000..a855010
--- /dev/null
+++ b/app/react/docker/stacks/common/stackYamlValidation.ts
@@ -0,0 +1,64 @@
+import YAML from 'yaml';
+import _ from 'lodash';
+
+import { extractContainerNamesFromYaml } from './container-names';
+
+/**
+ * Validates Docker Compose YAML content
+ * @param yaml - The YAML content to validate
+ * @param containerNames - Array of container names currently running in the environment
+ * @param originalContainerNames - Array of original container names from the stack (before edit)
+ * @returns Error message if validation fails, empty string if valid
+ */
+export function validateYAML(
+  yaml: string,
+  containerNames: string[] = [],
+  originalContainerNames: string[] = []
+): string {
+  let yamlObject;
+
+  try {
+    yamlObject = YAML.parse(yaml, { maxAliasCount: 10000 });
+  } catch (err) {
+    return `There is an error in the yaml syntax: ${err}`;
+  }
+
+  const names = extractContainerNamesFromYaml(yamlObject);
+
+  // Find containers that are:
+  // 1. In the current environment (containerNames)
+  // 2. NOT in the original stack (originalContainerNames)
+  // 3. Present in the new YAML (names)
+  // This identifies conflicts with other stacks/containers
+  const duplicateContainers = _.intersection(
+    _.difference(containerNames, originalContainerNames),
+    names
+  );
+
+  if (duplicateContainers.length === 0) {
+    return '';
+  }
+
+  return `${
+    duplicateContainers.length === 1
+      ? 'This container name is'
+      : 'These container names are'
+  } already used by another container running in this environment: ${_.join(
+    duplicateContainers,
+    ', '
+  )}.`;
+}
+
+/**
+ * Checks if the YAML content has changed (ignoring line ending differences)
+ * @param original - Original YAML content
+ * @param updated - Updated YAML content
+ * @returns True if content has changed, false otherwise
+ */
+export function hasYamlChanged(original: string, updated: string): boolean {
+  return normalizeLineEndings(original) !== normalizeLineEndings(updated);
+
+  function normalizeLineEndings(str: string) {
+    return str.replace(/(\r\n|\n|\r)/gm, '');
+  }
+}
diff --git a/app/react/docker/stacks/useUpdateStack.ts b/app/react/docker/stacks/useUpdateStack.ts
new file mode 100644
index 0000000..f31f0ff
--- /dev/null
+++ b/app/react/docker/stacks/useUpdateStack.ts
@@ -0,0 +1,40 @@
+import { useMutation } from '@tanstack/react-query';
+
+import axios from '@/portainer/services/axios/axios';
+import { buildStackUrl } from '@/react/common/stacks/queries/buildUrl';
+import { Stack } from '@/react/common/stacks/types';
+import { Registry } from '@/react/portainer/registries/types/registry';
+
+import { EnvVarValues } from '@@/form-components/EnvironmentVariablesFieldset';
+
+export function useUpdateStackMutation() {
+  return useMutation({
+    mutationFn: updateStack,
+  });
+}
+
+type Payload = {
+  stackFileContent: string;
+  env?: EnvVarValues | null;
+  prune?: boolean;
+  webhook?: string;
+  repullImageAndRedeploy?: boolean;
+  rollbackTo?: number;
+  registries?: Array<Registry['Id']>;
+};
+
+type UpdateStackParams = {
+  stackId: number;
+  environmentId: number;
+  payload: Payload;
+};
+
+export async function updateStack({
+  stackId,
+  environmentId,
+  payload,
+}: UpdateStackParams): Promise<Stack> {
+  return axios.put(buildStackUrl(stackId), payload, {
+    params: { endpointId: environmentId },
+  });
+}
diff --git a/app/react/docker/stacks/view-models/external-stack.ts b/app/react/docker/stacks/view-models/external-stack.ts
new file mode 100644
index 0000000..120dbe8
--- /dev/null
+++ b/app/react/docker/stacks/view-models/external-stack.ts
@@ -0,0 +1,35 @@
+import _ from 'lodash';
+
+import { StackType } from '@/react/common/stacks/types';
+import { ResourceControlViewModel } from '@/react/portainer/access-control/models/ResourceControlViewModel';
+
+import { IResource } from '../../components/datatable/createOwnershipColumn';
+
+export class ExternalStackViewModel implements IResource {
+  Id: string;
+
+  Name: string;
+
+  ResourceControl?: ResourceControlViewModel;
+
+  Type: StackType;
+
+  CreationDate: number;
+
+  CreatedBy?: string;
+
+  UpdateDate?: number;
+
+  UpdatedBy?: string;
+
+  External: boolean;
+
+  constructor(name: string, type: StackType, creationDate: number) {
+    this.Id = `external-stack_${_.uniqueId()}`;
+    this.Name = name;
+    this.Type = type;
+    this.CreationDate = creationDate;
+
+    this.External = true;
+  }
+}
diff --git a/app/react/docker/stacks/view-models/stack.ts b/app/react/docker/stacks/view-models/stack.ts
new file mode 100644
index 0000000..d0007e4
--- /dev/null
+++ b/app/react/docker/stacks/view-models/stack.ts
@@ -0,0 +1,108 @@
+import { Stack, StackStatus, StackType } from '@/react/common/stacks/types';
+import { ResourceControlViewModel } from '@/react/portainer/access-control/models/ResourceControlViewModel';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import {
+  AutoUpdateResponse,
+  RepoConfigResponse,
+} from '@/react/portainer/gitops/types';
+
+import { EnvVar } from '@@/form-components/EnvironmentVariablesFieldset/types';
+
+import { IResource } from '../../components/datatable/createOwnershipColumn';
+
+export class StackViewModel implements IResource {
+  Id: number;
+
+  Type: StackType;
+
+  Name: string;
+
+  EndpointId: EnvironmentId;
+
+  SwarmId: string;
+
+  Env: EnvVar[];
+
+  Option: { Prune: boolean; Force: boolean } | undefined;
+
+  IsComposeFormat: boolean;
+
+  ResourceControl?: ResourceControlViewModel;
+
+  Status: StackStatus;
+
+  CreationDate: number;
+
+  CreatedBy: string;
+
+  UpdateDate: number;
+
+  UpdatedBy: string;
+
+  Regular: boolean;
+
+  External: boolean;
+
+  Orphaned: boolean;
+
+  OrphanedRunning: boolean;
+
+  GitConfig: RepoConfigResponse | undefined;
+
+  FromAppTemplate: boolean;
+
+  AdditionalFiles: string[] | undefined;
+
+  AutoUpdate: AutoUpdateResponse | undefined;
+
+  Webhook: string | undefined;
+
+  StackFileVersion: number;
+
+  PreviousDeploymentInfo: unknown;
+
+  SupportRelativePath: boolean;
+
+  FilesystemPath: string;
+
+  constructor(stack: Stack, orphaned = false) {
+    this.Id = stack.Id;
+    this.Type = stack.Type;
+    this.Name = stack.Name;
+    this.EndpointId = stack.EndpointId;
+    this.SwarmId = stack.SwarmId;
+    this.Env = stack.Env ? stack.Env : [];
+    this.Option = stack.Option;
+    this.IsComposeFormat = stack.IsComposeFormat;
+
+    if (stack.ResourceControl && stack.ResourceControl.Id !== 0) {
+      this.ResourceControl = new ResourceControlViewModel(
+        stack.ResourceControl
+      );
+    }
+
+    this.Status = stack.Status;
+
+    this.CreationDate = stack.CreationDate;
+    this.CreatedBy = stack.CreatedBy;
+
+    this.UpdateDate = stack.UpdateDate;
+    this.UpdatedBy = stack.UpdatedBy;
+
+    this.GitConfig = stack.GitConfig;
+    this.FromAppTemplate = stack.FromAppTemplate;
+    this.AdditionalFiles = stack.AdditionalFiles || undefined;
+    this.AutoUpdate = stack.AutoUpdate || undefined;
+    this.Webhook = stack.Webhook;
+    this.StackFileVersion = stack.StackFileVersion;
+    this.PreviousDeploymentInfo = stack.PreviousDeploymentInfo;
+
+    this.Regular = !orphaned;
+    this.External = false;
+    this.Orphaned = orphaned;
+    this.OrphanedRunning = false;
+
+    this.SupportRelativePath = stack.SupportRelativePath;
+    this.FilesystemPath = stack.FilesystemPath;
+  }
+}
diff --git a/app/react/docker/stacks/view-models/utils.ts b/app/react/docker/stacks/view-models/utils.ts
new file mode 100644
index 0000000..c028b33
--- /dev/null
+++ b/app/react/docker/stacks/view-models/utils.ts
@@ -0,0 +1,20 @@
+import { ExternalStackViewModel } from './external-stack';
+import { StackViewModel } from './stack';
+
+export function isExternalStack(
+  stack: StackViewModel | ExternalStackViewModel
+): stack is ExternalStackViewModel {
+  return 'External' in stack && stack.External;
+}
+
+export function isRegularStack(
+  stack: StackViewModel | ExternalStackViewModel
+): stack is StackViewModel & { Regular: true } {
+  return 'Regular' in stack && stack.Regular;
+}
+
+export function isOrphanedStack(
+  stack: StackViewModel | ExternalStackViewModel
+): stack is StackViewModel & { Orphaned: true } {
+  return 'Orphaned' in stack && stack.Orphaned;
+}
diff --git a/app/react/docker/swarm/.keep b/app/react/docker/swarm/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/docker/swarm/NodeBrowseView/.keep b/app/react/docker/swarm/NodeBrowseView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/docker/swarm/SwarmView/NodesDatatable/NodesDatatable.tsx b/app/react/docker/swarm/SwarmView/NodesDatatable/NodesDatatable.tsx
new file mode 100644
index 0000000..6a4f32a
--- /dev/null
+++ b/app/react/docker/swarm/SwarmView/NodesDatatable/NodesDatatable.tsx
@@ -0,0 +1,73 @@
+import { Trello } from 'lucide-react';
+
+import { NodeViewModel } from '@/docker/models/node';
+
+import { Datatable, TableSettingsMenu } from '@@/datatables';
+import {
+  BasicTableSettings,
+  RefreshableTableSettings,
+  createPersistedStore,
+  refreshableSettings,
+} from '@@/datatables/types';
+import { useTableState } from '@@/datatables/useTableState';
+import { useRepeater } from '@@/datatables/useRepeater';
+import { TableSettingsMenuAutoRefresh } from '@@/datatables/TableSettingsMenuAutoRefresh';
+import { withMeta } from '@@/datatables/extend-options/withMeta';
+import { mergeOptions } from '@@/datatables/extend-options/mergeOptions';
+
+import { useColumns } from './columns';
+
+const tableKey = 'nodes';
+
+interface TableSettings extends BasicTableSettings, RefreshableTableSettings {}
+
+const store = createPersistedStore<TableSettings>(
+  tableKey,
+  undefined,
+  (set) => ({
+    ...refreshableSettings(set),
+  })
+);
+
+export function NodesDatatable({
+  dataset,
+  isIpColumnVisible,
+  haveAccessToNode,
+  onRefresh,
+}: {
+  dataset?: Array<NodeViewModel>;
+  isIpColumnVisible: boolean;
+  haveAccessToNode: boolean;
+  onRefresh(): Promise<void>;
+}) {
+  const columns = useColumns(isIpColumnVisible);
+  const tableState = useTableState(store, tableKey);
+  useRepeater(tableState.autoRefreshRate, onRefresh);
+
+  return (
+    <Datatable<NodeViewModel>
+      disableSelect
+      title="Nodes"
+      titleIcon={Trello}
+      columns={columns}
+      dataset={dataset || []}
+      isLoading={!dataset}
+      settingsManager={tableState}
+      extendTableOptions={mergeOptions(
+        withMeta({
+          table: 'nodes',
+          haveAccessToNode,
+        })
+      )}
+      renderTableSettings={() => (
+        <TableSettingsMenu>
+          <TableSettingsMenuAutoRefresh
+            value={tableState.autoRefreshRate}
+            onChange={(value) => tableState.setAutoRefreshRate(value)}
+          />
+        </TableSettingsMenu>
+      )}
+      data-cy="swarm-nodes-datatable"
+    />
+  );
+}
diff --git a/app/react/docker/swarm/SwarmView/NodesDatatable/columns/availability.tsx b/app/react/docker/swarm/SwarmView/NodesDatatable/columns/availability.tsx
new file mode 100644
index 0000000..0da94e9
--- /dev/null
+++ b/app/react/docker/swarm/SwarmView/NodesDatatable/columns/availability.tsx
@@ -0,0 +1,29 @@
+import clsx from 'clsx';
+
+import { NodeViewModel } from '@/docker/models/node';
+
+import { columnHelper } from './column-helper';
+
+export const availability = columnHelper.accessor('Availability', {
+  header: 'Availability',
+  cell({ getValue }) {
+    const value = getValue();
+    return (
+      <span className={clsx('label', `label-${badgeClass(value)}`)}>
+        {value}
+      </span>
+    );
+  },
+});
+
+export function badgeClass(text: NodeViewModel['Availability']) {
+  if (text === 'pause') {
+    return 'warning';
+  }
+
+  if (text === 'drain') {
+    return 'danger';
+  }
+
+  return 'success';
+}
diff --git a/app/react/docker/swarm/SwarmView/NodesDatatable/columns/column-helper.ts b/app/react/docker/swarm/SwarmView/NodesDatatable/columns/column-helper.ts
new file mode 100644
index 0000000..ea1f2d2
--- /dev/null
+++ b/app/react/docker/swarm/SwarmView/NodesDatatable/columns/column-helper.ts
@@ -0,0 +1,5 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { NodeViewModel } from '@/docker/models/node';
+
+export const columnHelper = createColumnHelper<NodeViewModel>();
diff --git a/app/react/docker/swarm/SwarmView/NodesDatatable/columns/index.ts b/app/react/docker/swarm/SwarmView/NodesDatatable/columns/index.ts
new file mode 100644
index 0000000..0844321
--- /dev/null
+++ b/app/react/docker/swarm/SwarmView/NodesDatatable/columns/index.ts
@@ -0,0 +1,53 @@
+import _ from 'lodash';
+import { useMemo } from 'react';
+
+import { humanize } from '@/portainer/filters/filters';
+
+import { columnHelper } from './column-helper';
+import { name } from './name';
+import { status } from './status';
+import { availability } from './availability';
+
+export { name, status };
+
+export const role = columnHelper.accessor('Role', {});
+
+export const engine = columnHelper.accessor('EngineVersion', {
+  header: 'Engine',
+});
+
+export const ip = columnHelper.accessor('Addr', {
+  header: 'IP Address',
+});
+
+export const cpu = columnHelper.accessor(
+  (item) => (item.CPUs ? item.CPUs / 1000000000 : 0),
+  {
+    header: 'CPU',
+  }
+);
+
+export const memory = columnHelper.accessor('Memory', {
+  header: 'Memory',
+  cell({ getValue }) {
+    const value = getValue();
+    return humanize(value);
+  },
+});
+
+export function useColumns(isIpColumnVisible: boolean) {
+  return useMemo(
+    () =>
+      _.compact([
+        name,
+        role,
+        cpu,
+        memory,
+        engine,
+        isIpColumnVisible && ip,
+        status,
+        availability,
+      ]),
+    [isIpColumnVisible]
+  );
+}
diff --git a/app/react/docker/swarm/SwarmView/NodesDatatable/columns/name.tsx b/app/react/docker/swarm/SwarmView/NodesDatatable/columns/name.tsx
new file mode 100644
index 0000000..1d1f5fc
--- /dev/null
+++ b/app/react/docker/swarm/SwarmView/NodesDatatable/columns/name.tsx
@@ -0,0 +1,42 @@
+import { CellContext } from '@tanstack/react-table';
+
+import { NodeViewModel } from '@/docker/models/node';
+
+import { Link } from '@@/Link';
+
+import { isTableMeta } from '../types';
+
+import { columnHelper } from './column-helper';
+
+export const name = columnHelper.accessor('Hostname', {
+  header: 'Name',
+  cell: Cell,
+});
+
+function Cell({
+  getValue,
+  row: { original: item },
+  table: {
+    options: { meta },
+  },
+}: CellContext<NodeViewModel, NodeViewModel['Hostname']>) {
+  if (!isTableMeta(meta)) {
+    throw new Error('Invalid table meta');
+  }
+
+  const value = getValue();
+
+  if (!meta.haveAccessToNode) {
+    return <>{value}</>;
+  }
+
+  return (
+    <Link
+      to="docker.nodes.node"
+      params={{ id: item.Id }}
+      data-cy={`node-link-${item.Id}`}
+    >
+      {value}
+    </Link>
+  );
+}
diff --git a/app/react/docker/swarm/SwarmView/NodesDatatable/columns/status.tsx b/app/react/docker/swarm/SwarmView/NodesDatatable/columns/status.tsx
new file mode 100644
index 0000000..a61e35b
--- /dev/null
+++ b/app/react/docker/swarm/SwarmView/NodesDatatable/columns/status.tsx
@@ -0,0 +1,16 @@
+import clsx from 'clsx';
+
+import { nodeStatusBadge } from '@/docker/filters/utils';
+
+import { columnHelper } from './column-helper';
+
+export const status = columnHelper.accessor('Status', {
+  cell({ getValue }) {
+    const value = getValue();
+    return (
+      <span className={clsx('label', `label-${nodeStatusBadge(value)}`)}>
+        {value}
+      </span>
+    );
+  },
+});
diff --git a/app/react/docker/swarm/SwarmView/NodesDatatable/index.ts b/app/react/docker/swarm/SwarmView/NodesDatatable/index.ts
new file mode 100644
index 0000000..f5e6969
--- /dev/null
+++ b/app/react/docker/swarm/SwarmView/NodesDatatable/index.ts
@@ -0,0 +1 @@
+export { NodesDatatable } from './NodesDatatable';
diff --git a/app/react/docker/swarm/SwarmView/NodesDatatable/types.ts b/app/react/docker/swarm/SwarmView/NodesDatatable/types.ts
new file mode 100644
index 0000000..d9f9afb
--- /dev/null
+++ b/app/react/docker/swarm/SwarmView/NodesDatatable/types.ts
@@ -0,0 +1,14 @@
+import { TableMeta as BaseTableMeta } from '@tanstack/react-table';
+
+import { NodeViewModel } from '@/docker/models/node';
+
+export type TableMeta = BaseTableMeta<NodeViewModel> & {
+  table: 'nodes';
+  haveAccessToNode: boolean;
+};
+
+export function isTableMeta(
+  meta?: BaseTableMeta<NodeViewModel>
+): meta is TableMeta {
+  return !!meta && 'table' in meta && meta.table === 'nodes';
+}
diff --git a/app/react/docker/tasks/queries/query-keys.ts b/app/react/docker/tasks/queries/query-keys.ts
new file mode 100644
index 0000000..bf5d250
--- /dev/null
+++ b/app/react/docker/tasks/queries/query-keys.ts
@@ -0,0 +1,11 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { queryKeys as dockerQueryKeys } from '../../queries/utils';
+
+export const queryKeys = {
+  list: (environmentId: EnvironmentId) =>
+    [dockerQueryKeys.root(environmentId), 'tasks'] as const,
+
+  task: (environmentId: EnvironmentId, id: string) =>
+    [...queryKeys.list(environmentId), id] as const,
+};
diff --git a/app/react/docker/tasks/queries/useTask.ts b/app/react/docker/tasks/queries/useTask.ts
new file mode 100644
index 0000000..b546b01
--- /dev/null
+++ b/app/react/docker/tasks/queries/useTask.ts
@@ -0,0 +1,33 @@
+import { Task } from 'docker-types';
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { TaskId } from '@/react/docker/tasks/types';
+import { queryKeys } from '@/react/docker/tasks/queries/query-keys';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { withError } from '@/react-tools/react-query';
+
+import { buildDockerProxyUrl } from '../../proxy/queries/buildDockerProxyUrl';
+
+export function useTask(environmentId: EnvironmentId, taskId: TaskId) {
+  return useQuery(
+    queryKeys.task(environmentId, taskId),
+
+    () => getTask(environmentId, taskId),
+    {
+      ...withError('Unable to retrieve task'),
+    }
+  );
+}
+
+export async function getTask(environmentId: EnvironmentId, taskId: TaskId) {
+  try {
+    const { data } = await axios.get<Task>(
+      buildDockerProxyUrl(environmentId, 'tasks', taskId)
+    );
+
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to get task');
+  }
+}
diff --git a/app/react/docker/tasks/queries/useTaskLogs.ts b/app/react/docker/tasks/queries/useTaskLogs.ts
new file mode 100644
index 0000000..e3259ef
--- /dev/null
+++ b/app/react/docker/tasks/queries/useTaskLogs.ts
@@ -0,0 +1,25 @@
+import _ from 'lodash';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { TaskId, TaskLogsParams } from '@/react/docker/tasks/types';
+
+import { buildDockerProxyUrl } from '../../proxy/queries/buildDockerProxyUrl';
+
+export async function getTaskLogs(
+  environmentId: EnvironmentId,
+  taskId: TaskId,
+  params?: TaskLogsParams
+): Promise<string> {
+  try {
+    const { data } = await axios.get<string>(
+      buildDockerProxyUrl(environmentId, 'tasks', taskId, 'logs'),
+      {
+        params: _.pickBy(params),
+      }
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to get task logs');
+  }
+}
diff --git a/app/react/docker/tasks/types.ts b/app/react/docker/tasks/types.ts
new file mode 100644
index 0000000..7b45a5a
--- /dev/null
+++ b/app/react/docker/tasks/types.ts
@@ -0,0 +1,11 @@
+import { Task } from 'docker-types';
+
+export type TaskId = NonNullable<Task['ID']>;
+
+export type TaskLogsParams = {
+  stdout?: boolean;
+  stderr?: boolean;
+  timestamps?: boolean;
+  since?: number;
+  tail?: number;
+};
diff --git a/app/react/docker/tasks/utils.ts b/app/react/docker/tasks/utils.ts
new file mode 100644
index 0000000..0131428
--- /dev/null
+++ b/app/react/docker/tasks/utils.ts
@@ -0,0 +1,14 @@
+/**
+ * Associates a container object to a task by matching their IDs.
+ */
+export function associateContainerToTask<TTask extends { ContainerId: string }>(
+  task: TTask,
+  containers: Array<{ Id: string }>
+) {
+  const container = containers.find((c) => c.Id === task.ContainerId);
+
+  return {
+    ...task,
+    Container: container,
+  };
+}
diff --git a/app/react/docker/types.ts b/app/react/docker/types.ts
new file mode 100644
index 0000000..52daea9
--- /dev/null
+++ b/app/react/docker/types.ts
@@ -0,0 +1,18 @@
+import { ResourceControlResponse } from '@/react/portainer/access-control/types';
+
+interface AgentMetadata {
+  NodeName: string;
+}
+
+interface PortainerMetadata {
+  ResourceControl?: ResourceControlResponse;
+  Agent?: AgentMetadata;
+}
+
+export type PortainerResponse<T> = T & {
+  Portainer?: PortainerMetadata;
+  /**
+   * will be true if the portainer is running in this resource
+   */
+  IsPortainer?: boolean;
+};
diff --git a/app/react/docker/volumes/BrowseView/.keep b/app/react/docker/volumes/BrowseView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/docker/volumes/BrowseView/AgentVolumeBrowser.tsx b/app/react/docker/volumes/BrowseView/AgentVolumeBrowser.tsx
new file mode 100644
index 0000000..2e001f5
--- /dev/null
+++ b/app/react/docker/volumes/BrowseView/AgentVolumeBrowser.tsx
@@ -0,0 +1,48 @@
+import { ComponentProps } from 'react';
+
+import { FilesTable } from '@/react/docker/components/FilesTable';
+
+import { createPersistedStore } from '@@/datatables/types';
+import { useTableState } from '@@/datatables/useTableState';
+
+const tableKey = 'host-browser';
+
+const settingsStore = createPersistedStore(tableKey, 'Name');
+
+interface Props extends Omit<
+  ComponentProps<typeof FilesTable>,
+  'onSearchChange' | 'tableState' | 'title'
+> {
+  relativePath: string;
+}
+
+export function AgentVolumeBrowser({
+  relativePath,
+  dataset,
+  isRoot,
+  onBrowse,
+  onDelete,
+  onDownload,
+  onFileSelectedForUpload,
+  onGoToParent,
+  onRename,
+  isUploadAllowed,
+}: Props) {
+  const tableState = useTableState(settingsStore, tableKey);
+
+  return (
+    <FilesTable
+      tableState={tableState}
+      dataset={dataset}
+      title={`Volume browser - ${relativePath}`}
+      isRoot={isRoot}
+      onRename={onRename}
+      onBrowse={onBrowse}
+      onDownload={onDownload}
+      onDelete={onDelete}
+      isUploadAllowed={isUploadAllowed}
+      onFileSelectedForUpload={onFileSelectedForUpload}
+      onGoToParent={onGoToParent}
+    />
+  );
+}
diff --git a/app/react/docker/volumes/CreateView/.keep b/app/react/docker/volumes/CreateView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/docker/volumes/ItemView/.keep b/app/react/docker/volumes/ItemView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/docker/volumes/ListView/VolumesDatatable/TableActions.tsx b/app/react/docker/volumes/ListView/VolumesDatatable/TableActions.tsx
new file mode 100644
index 0000000..93e0acd
--- /dev/null
+++ b/app/react/docker/volumes/ListView/VolumesDatatable/TableActions.tsx
@@ -0,0 +1,30 @@
+import { Authorized } from '@/react/hooks/useUser';
+
+import { AddButton } from '@@/buttons';
+import { DeleteButton } from '@@/buttons/DeleteButton';
+
+import { DecoratedVolume } from '../types';
+
+export function TableActions({
+  selectedItems,
+  onRemove,
+}: {
+  selectedItems: Array<DecoratedVolume>;
+  onRemove(items: Array<DecoratedVolume>): void;
+}) {
+  return (
+    <div className="flex items-center gap-2">
+      <Authorized authorizations="DockerVolumeDelete">
+        <DeleteButton
+          disabled={selectedItems.length === 0}
+          onConfirmed={() => onRemove(selectedItems)}
+          confirmMessage="Do you want to remove the selected volume(s)?"
+          data-cy="volume-removeVolumeButton"
+        />
+      </Authorized>
+      <Authorized authorizations="DockerVolumeCreate">
+        <AddButton data-cy="volume-addVolumeButton">Add volume</AddButton>
+      </Authorized>
+    </div>
+  );
+}
diff --git a/app/react/docker/volumes/ListView/VolumesDatatable/VolumesDatatable.tsx b/app/react/docker/volumes/ListView/VolumesDatatable/VolumesDatatable.tsx
new file mode 100644
index 0000000..6fd25e3
--- /dev/null
+++ b/app/react/docker/volumes/ListView/VolumesDatatable/VolumesDatatable.tsx
@@ -0,0 +1,84 @@
+import { Database } from 'lucide-react';
+
+import { Datatable, TableSettingsMenu } from '@@/datatables';
+import { TableSettingsMenuAutoRefresh } from '@@/datatables/TableSettingsMenuAutoRefresh';
+import {
+  BasicTableSettings,
+  FilteredColumnsTableSettings,
+  filteredColumnsSettings,
+  RefreshableTableSettings,
+  createPersistedStore,
+  refreshableSettings,
+} from '@@/datatables/types';
+import { useRepeater } from '@@/datatables/useRepeater';
+import { useTableState } from '@@/datatables/useTableState';
+import { withMeta } from '@@/datatables/extend-options/withMeta';
+import { withColumnFilters } from '@@/datatables/extend-options/withColumnFilters';
+import { mergeOptions } from '@@/datatables/extend-options/mergeOptions';
+
+import { DecoratedVolume } from '../types';
+
+import { TableActions } from './TableActions';
+import { useColumns } from './columns';
+
+interface TableSettings
+  extends
+    BasicTableSettings,
+    RefreshableTableSettings,
+    FilteredColumnsTableSettings {}
+
+const storageKey = 'docker-volumes';
+const store = createPersistedStore<TableSettings>(
+  storageKey,
+  undefined,
+  (set) => ({
+    ...refreshableSettings(set),
+    ...filteredColumnsSettings(set),
+  })
+);
+
+export function VolumesDatatable({
+  dataset,
+  onRemove,
+  onRefresh,
+  isBrowseVisible,
+}: {
+  dataset?: Array<DecoratedVolume>;
+  onRemove(items: Array<DecoratedVolume>): void;
+  onRefresh(): Promise<void>;
+  isBrowseVisible: boolean;
+}) {
+  const tableState = useTableState(store, storageKey);
+  useRepeater(tableState.autoRefreshRate, onRefresh);
+  const columns = useColumns();
+
+  return (
+    <Datatable
+      title="Volumes"
+      titleIcon={Database}
+      columns={columns}
+      dataset={dataset || []}
+      isLoading={!dataset}
+      settingsManager={tableState}
+      renderTableActions={(selectedItems) => (
+        <TableActions selectedItems={selectedItems} onRemove={onRemove} />
+      )}
+      renderTableSettings={() => (
+        <TableSettingsMenu>
+          <TableSettingsMenuAutoRefresh
+            value={tableState.autoRefreshRate}
+            onChange={(value) => tableState.setAutoRefreshRate(value)}
+          />
+        </TableSettingsMenu>
+      )}
+      extendTableOptions={mergeOptions(
+        withMeta({
+          table: 'volumes',
+          isBrowseVisible,
+        }),
+        withColumnFilters(tableState.columnFilters, tableState.setColumnFilters)
+      )}
+      data-cy="docker-volumes-datatable"
+    />
+  );
+}
diff --git a/app/react/docker/volumes/ListView/VolumesDatatable/columns/helper.ts b/app/react/docker/volumes/ListView/VolumesDatatable/columns/helper.ts
new file mode 100644
index 0000000..870bfb2
--- /dev/null
+++ b/app/react/docker/volumes/ListView/VolumesDatatable/columns/helper.ts
@@ -0,0 +1,5 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { DecoratedVolume } from '../../types';
+
+export const columnHelper = createColumnHelper<DecoratedVolume>();
diff --git a/app/react/docker/volumes/ListView/VolumesDatatable/columns/index.ts b/app/react/docker/volumes/ListView/VolumesDatatable/columns/index.ts
new file mode 100644
index 0000000..18a44d5
--- /dev/null
+++ b/app/react/docker/volumes/ListView/VolumesDatatable/columns/index.ts
@@ -0,0 +1,48 @@
+import _ from 'lodash';
+import { useMemo } from 'react';
+
+import { useIsSwarm } from '@/react/docker/proxy/queries/useInfo';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { createOwnershipColumn } from '@/react/docker/components/datatable/createOwnershipColumn';
+import { isoDate, truncateLeftRight } from '@/portainer/filters/filters';
+
+import { DecoratedVolume } from '../../types';
+
+import { columnHelper } from './helper';
+import { name } from './name';
+
+export function useColumns() {
+  const environmentId = useEnvironmentId();
+  const isSwarm = useIsSwarm(environmentId);
+
+  return useMemo(
+    () =>
+      _.compact([
+        name,
+        columnHelper.accessor((item) => item.StackName || '-', {
+          header: 'Stack',
+        }),
+        columnHelper.accessor((item) => item.Driver, {
+          header: 'Driver',
+        }),
+        columnHelper.accessor((item) => item.Mountpoint, {
+          header: 'Mount point',
+          cell({ getValue }) {
+            return truncateLeftRight(getValue());
+          },
+        }),
+        columnHelper.accessor((item) => item.CreatedAt, {
+          header: 'Created',
+          cell({ getValue }) {
+            return isoDate(getValue());
+          },
+        }),
+        isSwarm &&
+          columnHelper.accessor((item) => item.NodeName || '-', {
+            header: 'Host',
+          }),
+        createOwnershipColumn<DecoratedVolume>(),
+      ]),
+    [isSwarm]
+  );
+}
diff --git a/app/react/docker/volumes/ListView/VolumesDatatable/columns/name.tsx b/app/react/docker/volumes/ListView/VolumesDatatable/columns/name.tsx
new file mode 100644
index 0000000..895794a
--- /dev/null
+++ b/app/react/docker/volumes/ListView/VolumesDatatable/columns/name.tsx
@@ -0,0 +1,116 @@
+import { CellContext, Column } from '@tanstack/react-table';
+import { Search } from 'lucide-react';
+
+import { truncate } from '@/portainer/filters/filters';
+import { getValueAsArrayOfStrings } from '@/portainer/helpers/array';
+import { Authorized } from '@/react/hooks/useUser';
+
+import { Button } from '@@/buttons';
+import { Link } from '@@/Link';
+import { MultipleSelectionFilter } from '@@/datatables/Filter';
+import { UnusedBadge } from '@@/Badge/UnusedBadge';
+
+import { DecoratedVolume } from '../../types';
+import { getTableMeta } from '../tableMeta';
+
+import { columnHelper } from './helper';
+
+export const name = columnHelper.accessor('Name', {
+  id: 'name',
+  header: 'Name',
+  cell: Cell,
+  enableColumnFilter: true,
+  filterFn: (
+    { original: { dangling } },
+    columnId,
+    filterValue: Array<'Used' | 'Unused'>
+  ) => {
+    if (filterValue.length === 0) {
+      return true;
+    }
+
+    if (filterValue.includes('Used') && !dangling) {
+      return true;
+    }
+
+    if (filterValue.includes('Unused') && dangling) {
+      return true;
+    }
+
+    return false;
+  },
+  meta: {
+    filter: FilterByUsage,
+  },
+});
+
+function FilterByUsage<TData extends { Used: boolean }>({
+  column: { getFilterValue, setFilterValue, id },
+}: {
+  column: Column<TData>;
+}) {
+  const options = ['Used', 'Unused'];
+
+  const value = getFilterValue();
+
+  const valueAsArray = getValueAsArrayOfStrings(value);
+
+  return (
+    <MultipleSelectionFilter
+      options={options}
+      filterKey={id}
+      value={valueAsArray}
+      onChange={setFilterValue}
+      menuTitle="Filter by usage"
+    />
+  );
+}
+
+function Cell({
+  getValue,
+  row: { original: item },
+  table: {
+    options: { meta },
+  },
+}: CellContext<DecoratedVolume, string>) {
+  const { isBrowseVisible } = getTableMeta(meta);
+  const name = getValue();
+
+  return (
+    <div className="flex gap-2">
+      <Link
+        to=".volume"
+        params={{
+          id: item.Name,
+          nodeName: item.NodeName,
+        }}
+        data-cy={`volume-link-${name}`}
+        title={name}
+      >
+        {truncate(name, 40)}
+      </Link>
+      {isBrowseVisible && (
+        <Authorized authorizations="DockerAgentBrowseList">
+          <Button
+            className="ml-2"
+            icon={Search}
+            color="primary"
+            size="xsmall"
+            as={Link}
+            props={{
+              to: 'docker.volumes.volume.browse',
+              params: {
+                id: item.Name,
+                nodeName: item.NodeName,
+              },
+            }}
+            data-cy={`volume-browse-button-${name}`}
+          >
+            Browse
+          </Button>
+        </Authorized>
+      )}
+      {item.dangling && <UnusedBadge />}
+    </div>
+  );
+}
diff --git a/app/react/docker/volumes/ListView/VolumesDatatable/index.ts b/app/react/docker/volumes/ListView/VolumesDatatable/index.ts
new file mode 100644
index 0000000..255fefd
--- /dev/null
+++ b/app/react/docker/volumes/ListView/VolumesDatatable/index.ts
@@ -0,0 +1 @@
+export { VolumesDatatable } from './VolumesDatatable';
diff --git a/app/react/docker/volumes/ListView/VolumesDatatable/tableMeta.ts b/app/react/docker/volumes/ListView/VolumesDatatable/tableMeta.ts
new file mode 100644
index 0000000..3638092
--- /dev/null
+++ b/app/react/docker/volumes/ListView/VolumesDatatable/tableMeta.ts
@@ -0,0 +1,27 @@
+interface TableMeta {
+  isBrowseVisible: boolean;
+  table: 'volumes';
+}
+
+function isTableMeta(meta: unknown): meta is TableMeta {
+  return (
+    !!meta &&
+    typeof meta === 'object' &&
+    'table' in meta &&
+    meta.table === 'volumes'
+  );
+}
+
+export function getTableMeta(meta?: unknown): TableMeta {
+  if (!isTableMeta(meta)) {
+    return {
+      isBrowseVisible: false,
+      table: 'volumes',
+    };
+  }
+
+  return {
+    isBrowseVisible: meta.isBrowseVisible,
+    table: 'volumes',
+  };
+}
diff --git a/app/react/docker/volumes/ListView/types.ts b/app/react/docker/volumes/ListView/types.ts
new file mode 100644
index 0000000..e6b7cd6
--- /dev/null
+++ b/app/react/docker/volumes/ListView/types.ts
@@ -0,0 +1,3 @@
+import { VolumeViewModel } from '@/docker/models/volume';
+
+export type DecoratedVolume = VolumeViewModel & { dangling: boolean };
diff --git a/app/react/docker/volumes/queries/build-url.ts b/app/react/docker/volumes/queries/build-url.ts
new file mode 100644
index 0000000..5300726
--- /dev/null
+++ b/app/react/docker/volumes/queries/build-url.ts
@@ -0,0 +1,19 @@
+import { buildDockerProxyUrl } from '@/react/docker/proxy/queries/buildDockerProxyUrl';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+export function buildUrl(
+  environmentId: EnvironmentId,
+  { action, id }: { id?: string; action?: string } = {}
+) {
+  let url = buildDockerProxyUrl(environmentId, 'volumes');
+
+  if (id) {
+    url += `/${id}`;
+  }
+
+  if (action) {
+    url += `/${action}`;
+  }
+
+  return url;
+}
diff --git a/app/react/docker/volumes/queries/query-keys.ts b/app/react/docker/volumes/queries/query-keys.ts
new file mode 100644
index 0000000..1e909fc
--- /dev/null
+++ b/app/react/docker/volumes/queries/query-keys.ts
@@ -0,0 +1,8 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { queryKeys as dockerQueryKeys } from '../../queries/utils/root';
+
+export const queryKeys = {
+  base: (environmentId: EnvironmentId) =>
+    [...dockerQueryKeys.root(environmentId), 'volumes'] as const,
+};
diff --git a/app/react/docker/volumes/queries/useCreateVolume.ts b/app/react/docker/volumes/queries/useCreateVolume.ts
new file mode 100644
index 0000000..3c143d8
--- /dev/null
+++ b/app/react/docker/volumes/queries/useCreateVolume.ts
@@ -0,0 +1,26 @@
+import { Volume, VolumeCreateOptions } from 'docker-types';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { buildUrl } from './build-url';
+
+export async function createVolume(
+  environmentId: EnvironmentId,
+  volume: VolumeCreateOptions
+) {
+  try {
+    const { data } = await axios.post<Volume>(
+      buildUrl(environmentId, { action: 'create' }),
+      volume,
+      {
+        headers: {
+          'X-Portainer-VolumeName': volume.Name || '',
+        },
+      }
+    );
+    return data;
+  } catch (error) {
+    throw parseAxiosError(error);
+  }
+}
diff --git a/app/react/docker/volumes/queries/useCreateVolumeMutation.ts b/app/react/docker/volumes/queries/useCreateVolumeMutation.ts
new file mode 100644
index 0000000..b61936a
--- /dev/null
+++ b/app/react/docker/volumes/queries/useCreateVolumeMutation.ts
@@ -0,0 +1,36 @@
+import { Volume } from 'docker-types';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { buildDockerProxyUrl } from '../../proxy/queries/buildDockerProxyUrl';
+import { withAgentTargetHeader } from '../../proxy/queries/utils';
+
+export type VolumeConfiguration = {
+  Name?: Volume['Name']; // docker auto generates if empty
+  Driver?: Volume['Driver']; // docker uses "local" if empty
+  DriverOpts?: Volume['Options'];
+  Labels?: Volume['Labels'];
+};
+
+export async function createVolume(
+  environmentId: EnvironmentId,
+  volumeConfiguration: VolumeConfiguration,
+  { nodeName }: { nodeName: string }
+) {
+  try {
+    const { data } = await axios.post<Volume>(
+      buildDockerProxyUrl(environmentId, 'volumes', 'create'),
+      volumeConfiguration,
+      {
+        headers: {
+          'X-Portainer-VolumeName': volumeConfiguration.Name,
+          ...withAgentTargetHeader(nodeName),
+        },
+      }
+    );
+    return data;
+  } catch (err) {
+    throw parseAxiosError(err, 'Unable to create volume');
+  }
+}
diff --git a/app/react/docker/volumes/queries/useRemoveVolumeMutation.ts b/app/react/docker/volumes/queries/useRemoveVolumeMutation.ts
new file mode 100644
index 0000000..853002a
--- /dev/null
+++ b/app/react/docker/volumes/queries/useRemoveVolumeMutation.ts
@@ -0,0 +1,23 @@
+import { Volume } from 'docker-types';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { buildDockerProxyUrl } from '../../proxy/queries/buildDockerProxyUrl';
+import { withAgentTargetHeader } from '../../proxy/queries/utils';
+
+export async function removeVolume(
+  environmentId: EnvironmentId,
+  name: Volume['Name'],
+  { nodeName }: { nodeName: string }
+) {
+  try {
+    await axios.delete(buildDockerProxyUrl(environmentId, 'volumes', name), {
+      headers: {
+        ...withAgentTargetHeader(nodeName),
+      },
+    });
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to remove volume');
+  }
+}
diff --git a/app/react/docker/volumes/queries/useVolume.ts b/app/react/docker/volumes/queries/useVolume.ts
new file mode 100644
index 0000000..dedfba4
--- /dev/null
+++ b/app/react/docker/volumes/queries/useVolume.ts
@@ -0,0 +1,26 @@
+import { Volume } from 'docker-types';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { buildDockerProxyUrl } from '../../proxy/queries/buildDockerProxyUrl';
+
+/**
+ * Raw docker API query
+ * @param environmentId
+ * @param name
+ * @returns
+ */
+export async function getVolume(
+  environmentId: EnvironmentId,
+  name: Volume['Name']
+) {
+  try {
+    const { data } = await axios.get(
+      buildDockerProxyUrl(environmentId, 'volumes', name)
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to retrieve volume details');
+  }
+}
diff --git a/app/react/docker/volumes/queries/useVolumes.ts b/app/react/docker/volumes/queries/useVolumes.ts
new file mode 100644
index 0000000..bf596f0
--- /dev/null
+++ b/app/react/docker/volumes/queries/useVolumes.ts
@@ -0,0 +1,67 @@
+import { useQuery } from '@tanstack/react-query';
+import { Volume } from 'docker-types';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { buildDockerProxyUrl } from '@/react/docker/proxy/queries/buildDockerProxyUrl';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { withFiltersQueryParam } from '../../proxy/queries/utils';
+
+import { queryKeys } from './query-keys';
+
+export function useVolumes<T = Volume[]>(
+  environmentId: EnvironmentId,
+  { select }: { select?: (data: Volume[]) => T } = {}
+) {
+  return useQuery(
+    queryKeys.base(environmentId),
+    () => getVolumes(environmentId),
+    { select }
+  );
+}
+
+interface VolumesResponse {
+  Volumes: Volume[];
+}
+
+type Filters = {
+  /**
+   * When set to true (or 1), returns all volumes that are not in use by a container.
+   * When set to false (or 0), only volumes that are in use by one or more containers are returned.
+   */
+  dangling?: ['true' | 'false'];
+  /**
+   * <volume-driver-name>
+   * Matches volumes based on their driver.
+   */
+  driver?: string;
+  /**
+   * <key> or <key>:<value>
+   * Matches volumes based on the presence of a label alone or a label and a value.
+   */
+  label?: string;
+  /**
+   * Matches all or part of a volume name.
+   */
+  name?: Volume['Name'];
+};
+
+export async function getVolumes(
+  environmentId: EnvironmentId,
+  filters?: Filters
+) {
+  try {
+    const { data } = await axios.get<VolumesResponse>(
+      buildDockerProxyUrl(environmentId, 'volumes'),
+      {
+        params: {
+          ...withFiltersQueryParam(filters),
+        },
+      }
+    );
+
+    return data.Volumes;
+  } catch (error) {
+    throw parseAxiosError(error, 'Unable to retrieve volumes');
+  }
+}
diff --git a/app/react/edge/components/AssociatedEdgeEnvironmentsSelector.tsx b/app/react/edge/components/AssociatedEdgeEnvironmentsSelector.tsx
new file mode 100644
index 0000000..1fdd0e3
--- /dev/null
+++ b/app/react/edge/components/AssociatedEdgeEnvironmentsSelector.tsx
@@ -0,0 +1,74 @@
+import { EdgeTypes, EnvironmentId } from '@/react/portainer/environments/types';
+import { EdgeEnvironmentsAssociationTable } from '@/react/edge/components/EdgeEnvironmentsAssociationTable';
+
+import { FormError } from '@@/form-components/FormError';
+import { ArrayError } from '@@/form-components/InputList/InputList';
+
+export function AssociatedEdgeEnvironmentsSelector({
+  onChange,
+  value,
+  error,
+}: {
+  onChange: (
+    value: EnvironmentId[],
+    meta: { type: 'add' | 'remove'; value: EnvironmentId }
+  ) => void;
+  value: EnvironmentId[];
+  error?: ArrayError<Array<EnvironmentId>>;
+}) {
+  return (
+    <>
+      <div className="col-sm-12 small text-muted">
+        You can also select environments individually by moving them to the
+        associated environments table. Simply click on any environment entry to
+        move it from one table to the other.
+      </div>
+
+      {error && (
+        <div className="col-sm-12">
+          <FormError>
+            {typeof error === 'string' ? error : error.join(', ')}
+          </FormError>
+        </div>
+      )}
+
+      <div className="col-sm-12 mt-4">
+        <div className="flex">
+          <div className="w-1/2">
+            <EdgeEnvironmentsAssociationTable
+              title="Available environments"
+              query={{
+                types: EdgeTypes,
+                excludeIds: value,
+              }}
+              onClickRow={(env) => {
+                if (!value.includes(env.Id)) {
+                  onChange([...value, env.Id], { type: 'add', value: env.Id });
+                }
+              }}
+              data-cy="edgeGroupCreate-availableEndpoints"
+            />
+          </div>
+          <div className="w-1/2">
+            <EdgeEnvironmentsAssociationTable
+              title="Associated environments"
+              query={{
+                types: EdgeTypes,
+                endpointIds: value,
+              }}
+              onClickRow={(env) => {
+                if (value.includes(env.Id)) {
+                  onChange(
+                    value.filter((id) => id !== env.Id),
+                    { type: 'remove', value: env.Id }
+                  );
+                }
+              }}
+              data-cy="edgeGroupCreate-associatedEndpointsTable"
+            />
+          </div>
+        </div>
+      </div>
+    </>
+  );
+}
diff --git a/app/react/edge/components/AssociatedEdgeGroupEnvironmentsSelector.tsx b/app/react/edge/components/AssociatedEdgeGroupEnvironmentsSelector.tsx
new file mode 100644
index 0000000..6a8ee3b
--- /dev/null
+++ b/app/react/edge/components/AssociatedEdgeGroupEnvironmentsSelector.tsx
@@ -0,0 +1,116 @@
+import { useState } from 'react';
+
+import {
+  EdgeGroupId,
+  Environment,
+  EnvironmentId,
+} from '@/react/portainer/environments/types';
+
+import { FormError } from '@@/form-components/FormError';
+import { ArrayError } from '@@/form-components/InputList/InputList';
+
+import { EdgeGroupAssociationTable } from './EdgeGroupAssociationTable';
+
+export function AssociatedEdgeGroupEnvironmentsSelector({
+  onChange,
+  value,
+  error,
+  edgeGroupId,
+}: {
+  onChange: (
+    value: EnvironmentId[],
+    meta: { type: 'add' | 'remove'; value: EnvironmentId }
+  ) => void;
+  value: EnvironmentId[];
+  error?: ArrayError<Array<EnvironmentId>>;
+  edgeGroupId?: EdgeGroupId;
+}) {
+  const [associatedEnvironments, setAssociatedEnvironments] = useState<
+    Environment[]
+  >([]);
+  const [dissociatedEnvironments, setDissociatedEnvironments] = useState<
+    Environment[]
+  >([]);
+
+  function updateEditedEnvironments(env: Environment) {
+    // If the env is associated, this update is a dissociation
+    const isAssociated = value.includes(env.Id);
+
+    setAssociatedEnvironments((prev) =>
+      isAssociated
+        ? prev.filter((prevEnv) => prevEnv.Id !== env.Id)
+        : [...prev, env]
+    );
+
+    setDissociatedEnvironments((prev) =>
+      isAssociated
+        ? [...prev, env]
+        : prev.filter((prevEnv) => prevEnv.Id !== env.Id)
+    );
+
+    const updatedValue = isAssociated
+      ? value.filter((id) => id !== env.Id)
+      : [...value, env.Id];
+
+    onChange(updatedValue, {
+      type: isAssociated ? 'remove' : 'add',
+      value: env.Id,
+    });
+  }
+
+  return (
+    <>
+      <div className="col-sm-12 small text-muted">
+        You can select which environment should be part of this group by moving
+        them to the associated environments table. Simply click on any
+        environment entry to move it from one table to the other.
+      </div>
+
+      {error && (
+        <div className="col-sm-12">
+          <FormError>
+            {typeof error === 'string' ? error : error.join(', ')}
+          </FormError>
+        </div>
+      )}
+
+      <div className="col-sm-12 mt-4">
+        <div className="flex">
+          <div className="w-1/2">
+            <EdgeGroupAssociationTable
+              title="Available environments"
+              query={{
+                excludeEdgeGroupIds: edgeGroupId ? [edgeGroupId] : [],
+              }}
+              addEnvironments={dissociatedEnvironments}
+              excludeEnvironments={associatedEnvironments}
+              onClickRow={(env) => {
+                if (!value.includes(env.Id)) {
+                  updateEditedEnvironments(env);
+                }
+              }}
+              data-cy="edgeGroupCreate-availableEndpoints"
+            />
+          </div>
+          <div className="w-1/2">
+            <EdgeGroupAssociationTable
+              title="Associated environments"
+              query={{
+                edgeGroupIds: edgeGroupId ? [edgeGroupId] : [],
+                endpointIds: edgeGroupId ? undefined : [], // workaround to avoid showing all environments for new edge group
+              }}
+              addEnvironments={associatedEnvironments}
+              excludeEnvironments={dissociatedEnvironments}
+              onClickRow={(env) => {
+                if (value.includes(env.Id)) {
+                  updateEditedEnvironments(env);
+                }
+              }}
+              data-cy="edgeGroupCreate-associatedEndpointsTable"
+            />
+          </div>
+        </div>
+      </div>
+    </>
+  );
+}
diff --git a/app/react/edge/components/ConnectivityTestModal/ConnectivityTestModal.tsx b/app/react/edge/components/ConnectivityTestModal/ConnectivityTestModal.tsx
new file mode 100644
index 0000000..076c062
--- /dev/null
+++ b/app/react/edge/components/ConnectivityTestModal/ConnectivityTestModal.tsx
@@ -0,0 +1,158 @@
+import { useState } from 'react';
+
+import { useAgentDetails } from '@/react/portainer/environments/queries/useAgentDetails';
+
+import { Code } from '@@/Code';
+import { CopyButton } from '@@/buttons/CopyButton';
+import { Modal } from '@@/modals/Modal';
+import { Button } from '@@/buttons';
+import { NavTabs } from '@@/NavTabs';
+import { NavContainer } from '@@/NavTabs/NavContainer';
+import { SwitchField } from '@@/form-components/SwitchField';
+
+export type ConnectivityEnvironment = 'docker' | 'podman' | 'kubernetes';
+
+const ALL_ENVIRONMENTS: ConnectivityEnvironment[] = [
+  'docker',
+  'podman',
+  'kubernetes',
+];
+
+const ENVIRONMENT_LABELS: Record<ConnectivityEnvironment, string> = {
+  docker: 'Docker',
+  podman: 'Podman',
+  kubernetes: 'Kubernetes',
+};
+
+interface Props {
+  onDismiss: () => void;
+  portainerUrl: string;
+  tunnelServerAddr?: string;
+  /** When provided, show only this environment. When omitted, show tabs for all environments. */
+  environment?: ConnectivityEnvironment;
+}
+
+export function ConnectivityTestModal({
+  onDismiss,
+  portainerUrl,
+  tunnelServerAddr,
+  environment,
+}: Props) {
+  const environments = environment ? [environment] : ALL_ENVIRONMENTS;
+  const [selectedTab, setSelectedTab] = useState<ConnectivityEnvironment>(
+    environments[0]
+  );
+  const [insecurePoll, setInsecurePoll] = useState(true);
+  const agentDetails = useAgentDetails();
+  const agentVersion = agentDetails?.agentVersion ?? 'latest';
+
+  const options = environments.map((env) => {
+    const command = buildCommand(
+      env,
+      portainerUrl,
+      tunnelServerAddr,
+      insecurePoll,
+      agentVersion
+    );
+    const label = ENVIRONMENT_LABELS[env];
+    return {
+      id: env,
+      label,
+      children: (
+        <>
+          <Code>{command}</Code>
+          <div className="mt-2">
+            <CopyButton
+              copyText={command}
+              data-cy="copy-connectivity-test-command-button"
+            >
+              Copy command
+            </CopyButton>
+          </div>
+        </>
+      ),
+    };
+  });
+
+  return (
+    <Modal onDismiss={onDismiss} aria-label="Test connectivity" size="lg">
+      <Modal.Header title="Test connectivity" />
+      <Modal.Body>
+        <p className="mb-4">
+          Run the command in the environment where the Edge Agent will be
+          deployed to verify it can reach the Portainer server.
+        </p>
+        <div className="mb-4">
+          <SwitchField
+            checked={insecurePoll}
+            onChange={setInsecurePoll}
+            label="Allow self-signed certificates"
+            labelClass="col-sm-4 col-lg-3"
+            tooltip="Include EDGE_INSECURE_POLL=1 in the script. Enable this if your Portainer instance uses a self-signed or untrusted certificate."
+            data-cy="connectivity-insecure-poll-switch"
+          />
+        </div>
+        <NavContainer>
+          <NavTabs
+            selectedId={selectedTab}
+            options={options}
+            onSelect={(id: ConnectivityEnvironment) => setSelectedTab(id)}
+          />
+        </NavContainer>
+      </Modal.Body>
+      <Modal.Footer>
+        <Button
+          onClick={onDismiss}
+          color="default"
+          data-cy="close-connectivity-test-modal-button"
+        >
+          Close
+        </Button>
+      </Modal.Footer>
+    </Modal>
+  );
+}
+
+function buildCommand(
+  environment: ConnectivityEnvironment,
+  portainerUrl: string,
+  tunnelServerAddr?: string,
+  allowInsecurePoll?: boolean,
+  agentVersion = 'latest'
+): string {
+  const envVars = [
+    'EDGE_CONNECTIVITY_CHECK=1',
+    `EDGE_CONNECTIVITY_CHECK_URL=${portainerUrl}`,
+    `EDGE_INSECURE_POLL=${allowInsecurePoll ? '1' : '0'}`,
+    ...(tunnelServerAddr
+      ? [`EDGE_CONNECTIVITY_CHECK_TUNNEL_ADDR=${tunnelServerAddr}`]
+      : []),
+  ];
+
+  const image = `portainer/agent:${agentVersion}`;
+
+  switch (environment) {
+    case 'kubernetes':
+      return [
+        `kubectl run portainer-connectivity-check \\`,
+        `  --rm --attach --restart=Never \\`,
+        `  --image=${image} \\`,
+        ...envVars.map((v, i) =>
+          i < envVars.length - 1 ? `  --env="${v}" \\` : `  --env="${v}"`
+        ),
+      ].join('\n');
+    case 'podman':
+      return [
+        `sudo podman run --rm \\`,
+        ...envVars.map((v) => `  -e ${v} \\`),
+        `  docker.io/${image}`,
+      ].join('\n');
+    case 'docker':
+    default:
+      return [
+        `docker run --rm \\`,
+        ...envVars.map((v) => `  -e ${v} \\`),
+        `  ${image}`,
+      ].join('\n');
+  }
+}
diff --git a/app/react/edge/components/EdgeAsyncIntervalsForm.tsx b/app/react/edge/components/EdgeAsyncIntervalsForm.tsx
new file mode 100644
index 0000000..cb27f1f
--- /dev/null
+++ b/app/react/edge/components/EdgeAsyncIntervalsForm.tsx
@@ -0,0 +1,159 @@
+import { number, object, SchemaOf } from 'yup';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { Select } from '@@/form-components/Input';
+
+import { Options, useIntervalOptions } from './useIntervalOptions';
+
+export const EDGE_ASYNC_INTERVAL_USE_DEFAULT = -1;
+
+export interface EdgeAsyncIntervalsValues {
+  PingInterval: number;
+  SnapshotInterval: number;
+  CommandInterval: number;
+}
+
+export const options: Options = [
+  { label: 'Use default interval', value: -1, isDefault: true },
+  {
+    value: 0,
+    label: 'disabled',
+  },
+  {
+    value: 60,
+    label: '1 minute',
+  },
+  {
+    value: 60 * 60,
+    label: '1 hour',
+  },
+  {
+    value: 24 * 60 * 60,
+    label: '1 day',
+  },
+  {
+    value: 7 * 24 * 60 * 60,
+    label: '1 week',
+  },
+];
+
+const defaultFieldSettings = {
+  ping: {
+    label: 'Ping interval',
+    tooltip:
+      'Interval used by this Edge agent to check in with the Portainer instance',
+  },
+  snapshot: {
+    label: 'Snapshot interval',
+    tooltip: 'Interval used by this Edge agent to snapshot the agent state',
+  },
+  command: {
+    label: 'Command interval',
+    tooltip:
+      'Interval used by this Edge agent to fetch commands from the Portainer instance',
+  },
+};
+
+interface Props {
+  values: EdgeAsyncIntervalsValues;
+  isDefaultHidden?: boolean;
+  readonly?: boolean;
+  fieldSettings?: typeof defaultFieldSettings;
+  onChange(value: EdgeAsyncIntervalsValues): void;
+}
+
+export function EdgeAsyncIntervalsForm({
+  onChange,
+  values,
+  isDefaultHidden = false,
+  readonly = false,
+  fieldSettings = defaultFieldSettings,
+}: Props) {
+  const pingIntervalOptions = useIntervalOptions(
+    'Edge.PingInterval',
+    options,
+    isDefaultHidden
+  );
+
+  const snapshotIntervalOptions = useIntervalOptions(
+    'Edge.SnapshotInterval',
+    options,
+    isDefaultHidden
+  );
+
+  const commandIntervalOptions = useIntervalOptions(
+    'Edge.CommandInterval',
+    options,
+    isDefaultHidden
+  );
+
+  return (
+    <>
+      <FormControl
+        inputId="edge_checkin_ping"
+        label={fieldSettings.ping.label}
+        tooltip={fieldSettings.ping.tooltip}
+      >
+        <Select
+          id="edge_checkin_ping"
+          value={values.PingInterval}
+          data-cy="edge-checkin-ping-interval-select"
+          name="PingInterval"
+          onChange={handleChange}
+          options={pingIntervalOptions}
+          disabled={readonly}
+        />
+      </FormControl>
+
+      <FormControl
+        inputId="edge_checkin_snapshot"
+        label={fieldSettings.snapshot.label}
+        tooltip={fieldSettings.snapshot.tooltip}
+      >
+        <Select
+          id="edge_checkin_snapshot"
+          value={values.SnapshotInterval}
+          data-cy="edge-checkin-snapshot-interval-select"
+          name="SnapshotInterval"
+          onChange={handleChange}
+          options={snapshotIntervalOptions}
+          disabled={readonly}
+        />
+      </FormControl>
+
+      <FormControl
+        inputId="edge_checkin_command"
+        label={fieldSettings.command.label}
+        tooltip={fieldSettings.command.tooltip}
+      >
+        <Select
+          id="edge_checkin_command"
+          value={values.CommandInterval}
+          data-cy="edge-checkin-command-interval-select"
+          name="CommandInterval"
+          onChange={handleChange}
+          options={commandIntervalOptions}
+          disabled={readonly}
+        />
+      </FormControl>
+    </>
+  );
+
+  function handleChange(e: React.ChangeEvent<HTMLSelectElement>) {
+    onChange({ ...values, [e.target.name]: parseInt(e.target.value, 10) });
+  }
+}
+
+const intervals = options.map((option) => option.value);
+
+export function edgeAsyncIntervalsValidation(): SchemaOf<EdgeAsyncIntervalsValues> {
+  return object({
+    PingInterval: number().required('This field is required.').oneOf(intervals),
+    SnapshotInterval: number()
+      .required('This field is required.')
+      .oneOf(intervals),
+    CommandInterval: number()
+      .required('This field is required.')
+      .oneOf(intervals),
+  });
+}
diff --git a/app/react/edge/components/EdgeCheckInIntervalField.tsx b/app/react/edge/components/EdgeCheckInIntervalField.tsx
new file mode 100644
index 0000000..344bab9
--- /dev/null
+++ b/app/react/edge/components/EdgeCheckInIntervalField.tsx
@@ -0,0 +1,69 @@
+import { FormControl, Size } from '@@/form-components/FormControl';
+import { Select } from '@@/form-components/Input';
+
+import { Options, useIntervalOptions } from './useIntervalOptions';
+
+interface Props {
+  value: number;
+  onChange(value: number): void;
+  isDefaultHidden?: boolean;
+  label?: string;
+  tooltip?: string;
+  readonly?: boolean;
+  size?: Size;
+}
+
+export const checkinIntervalOptions: Options = [
+  { label: 'Use default interval', value: 0, isDefault: true },
+  {
+    label: '5 seconds',
+    value: 5,
+  },
+  {
+    label: '10 seconds',
+    value: 10,
+  },
+  {
+    label: '30 seconds',
+    value: 30,
+  },
+  { label: '5 minutes', value: 300 },
+  { label: '1 hour', value: 3600 },
+  { label: '1 day', value: 86400 },
+];
+
+export function EdgeCheckinIntervalField({
+  value,
+  readonly,
+  onChange,
+  isDefaultHidden = false,
+  label = 'Poll frequency',
+  tooltip = 'Interval used by this Edge agent to check in with the Portainer instance. Affects Edge environment management and Edge compute features.',
+  size = 'small',
+}: Props) {
+  const options = useIntervalOptions(
+    'EdgeAgentCheckinInterval',
+    checkinIntervalOptions,
+    isDefaultHidden
+  );
+
+  return (
+    <FormControl
+      inputId="edge_checkin"
+      label={label}
+      tooltip={tooltip}
+      size={size}
+    >
+      <Select
+        value={value}
+        data-cy="edge-checkin-interval-select"
+        onChange={(e) => {
+          onChange(parseInt(e.currentTarget.value, 10));
+        }}
+        options={options}
+        disabled={readonly}
+        id="edge_checkin"
+      />
+    </FormControl>
+  );
+}
diff --git a/app/react/edge/components/EdgeEnvironmentsAssociationTable.tsx b/app/react/edge/components/EdgeEnvironmentsAssociationTable.tsx
new file mode 100644
index 0000000..d7d87ec
--- /dev/null
+++ b/app/react/edge/components/EdgeEnvironmentsAssociationTable.tsx
@@ -0,0 +1,77 @@
+import { useMemo, useState } from 'react';
+
+import { useEnvironmentList } from '@/react/portainer/environments/queries';
+import { EdgeTypes, Environment } from '@/react/portainer/environments/types';
+import { useGroups } from '@/react/portainer/environments/environment-groups/queries';
+import { useTags } from '@/portainer/tags/queries';
+import { EnvironmentsQueryParams } from '@/react/portainer/environments/environment.service';
+import { AutomationTestingProps } from '@/types';
+
+import { useTableStateWithoutStorage } from '@@/datatables/useTableState';
+import { Datatable, TableRow } from '@@/datatables';
+
+import { columns, DecoratedEnvironment } from './associationTableColumnHelper';
+
+export function EdgeEnvironmentsAssociationTable({
+  title,
+  query,
+  onClickRow = () => {},
+  'data-cy': dataCy,
+}: {
+  title: string;
+  query: EnvironmentsQueryParams;
+  onClickRow?: (env: Environment) => void;
+} & AutomationTestingProps) {
+  const tableState = useTableStateWithoutStorage('Name');
+  const [page, setPage] = useState(0);
+  const environmentsQuery = useEnvironmentList({
+    pageLimit: tableState.pageSize,
+    page: page + 1,
+    search: tableState.search,
+    sort: tableState.sortBy?.id as 'Group' | 'Name',
+    order: tableState.sortBy?.desc ? 'desc' : 'asc',
+    types: EdgeTypes,
+    ...query,
+  });
+  const groupsQuery = useGroups({
+    enabled: environmentsQuery.environments.length > 0,
+  });
+  const tagsQuery = useTags({
+    enabled: environmentsQuery.environments.length > 0,
+  });
+
+  const memoizedEnvironments: Array<DecoratedEnvironment> = useMemo(
+    () =>
+      environmentsQuery.environments.map((env) => ({
+        ...env,
+        Group: groupsQuery.data?.find((g) => g.Id === env.GroupId)?.Name || '',
+        Tags: env.TagIds.map(
+          (tagId) => tagsQuery.data?.find((t) => t.ID === tagId)?.Name || ''
+        ),
+      })),
+    [environmentsQuery.environments, groupsQuery.data, tagsQuery.data]
+  );
+
+  const { totalCount } = environmentsQuery;
+
+  return (
+    <Datatable<DecoratedEnvironment>
+      title={title}
+      columns={columns}
+      settingsManager={tableState}
+      dataset={memoizedEnvironments}
+      isServerSidePagination
+      page={page}
+      onPageChange={setPage}
+      totalCount={totalCount}
+      renderRow={(row) => (
+        <TableRow<DecoratedEnvironment>
+          cells={row.getVisibleCells()}
+          onClick={() => onClickRow(row.original)}
+        />
+      )}
+      data-cy={dataCy}
+      disableSelect
+    />
+  );
+}
diff --git a/app/react/edge/components/EdgeGroupAssociationTable.tsx b/app/react/edge/components/EdgeGroupAssociationTable.tsx
new file mode 100644
index 0000000..1f58950
--- /dev/null
+++ b/app/react/edge/components/EdgeGroupAssociationTable.tsx
@@ -0,0 +1,102 @@
+import { useMemo, useState } from 'react';
+
+import { useTags } from '@/portainer/tags/queries';
+import { useGroups } from '@/react/portainer/environments/environment-groups/queries';
+import { EnvironmentsQueryParams } from '@/react/portainer/environments/environment.service';
+import { useEnvironmentList } from '@/react/portainer/environments/queries';
+import { EdgeTypes, Environment } from '@/react/portainer/environments/types';
+import { AutomationTestingProps } from '@/types';
+import {
+  columns,
+  DecoratedEnvironment,
+} from '@/react/edge/components/associationTableColumnHelper';
+
+import { Datatable, TableRow } from '@@/datatables';
+import { useTableStateWithoutStorage } from '@@/datatables/useTableState';
+
+export function EdgeGroupAssociationTable({
+  title,
+  query,
+  onClickRow = () => {},
+  addEnvironments = [],
+  excludeEnvironments = [],
+  'data-cy': dataCy,
+}: {
+  title: string;
+  query: EnvironmentsQueryParams;
+  onClickRow?: (env: Environment) => void;
+  addEnvironments?: Environment[];
+  excludeEnvironments?: Environment[];
+} & AutomationTestingProps) {
+  const tableState = useTableStateWithoutStorage('Name');
+  const [page, setPage] = useState(0);
+  const environmentsQuery = useEnvironmentList({
+    pageLimit: tableState.pageSize,
+    page: page + 1,
+    search: tableState.search,
+    sort: tableState.sortBy?.id as 'Group' | 'Name',
+    order: tableState.sortBy?.desc ? 'desc' : 'asc',
+    types: EdgeTypes,
+    excludeIds: excludeEnvironments?.map((env) => env.Id),
+    ...query,
+  });
+
+  const groupsQuery = useGroups({
+    enabled: environmentsQuery.environments.length > 0,
+  });
+  const tagsQuery = useTags({
+    enabled: environmentsQuery.environments.length > 0,
+  });
+
+  const memoizedEnvironments: Array<DecoratedEnvironment> = useMemo(
+    () =>
+      environmentsQuery.environments.map((env) => ({
+        ...env,
+        Group: groupsQuery.data?.find((g) => g.Id === env.GroupId)?.Name || '',
+        Tags: env.TagIds.map(
+          (tagId) => tagsQuery.data?.find((t) => t.ID === tagId)?.Name || ''
+        ),
+      })),
+    [environmentsQuery.environments, groupsQuery.data, tagsQuery.data]
+  );
+
+  const { totalCount } = environmentsQuery;
+
+  const memoizedAddEnvironments: Array<DecoratedEnvironment> = useMemo(
+    () =>
+      addEnvironments.map((env) => ({
+        ...env,
+        Group: groupsQuery.data?.find((g) => g.Id === env.GroupId)?.Name || '',
+        Tags: env.TagIds.map(
+          (tagId) => tagsQuery.data?.find((t) => t.ID === tagId)?.Name || ''
+        ),
+      })),
+    [addEnvironments, groupsQuery.data, tagsQuery.data]
+  );
+
+  // Filter out environments that are already in the table, this is to prevent duplicates, which can happen when an environment is associated and then disassociated
+  const filteredAddEnvironments = memoizedAddEnvironments.filter(
+    (env) => !memoizedEnvironments.some((e) => e.Id === env.Id)
+  );
+
+  return (
+    <Datatable<DecoratedEnvironment>
+      title={title}
+      columns={columns}
+      settingsManager={tableState}
+      dataset={memoizedEnvironments.concat(filteredAddEnvironments)}
+      isServerSidePagination
+      page={page}
+      onPageChange={setPage}
+      totalCount={totalCount}
+      renderRow={(row) => (
+        <TableRow<DecoratedEnvironment>
+          cells={row.getVisibleCells()}
+          onClick={() => onClickRow(row.original)}
+        />
+      )}
+      data-cy={dataCy}
+      disableSelect
+    />
+  );
+}
diff --git a/app/react/edge/components/EdgeScriptForm/EdgeScriptForm.tsx b/app/react/edge/components/EdgeScriptForm/EdgeScriptForm.tsx
new file mode 100644
index 0000000..69ab23e
--- /dev/null
+++ b/app/react/edge/components/EdgeScriptForm/EdgeScriptForm.tsx
@@ -0,0 +1,80 @@
+import { Formik } from 'formik';
+import { PropsWithChildren } from 'react';
+
+import { OsSelector } from './OsSelector';
+import { CommandTab } from './scripts';
+import { ScriptTabs } from './ScriptTabs';
+import { EdgeScriptSettingsFieldset } from './EdgeScriptSettingsFieldset';
+import { validationSchema } from './EdgeScriptForm.validation';
+import { ScriptFormValues, OS, Platform, EdgeInfo } from './types';
+
+const edgePropertiesFormInitialValues: ScriptFormValues = {
+  allowSelfSignedCertificates: true,
+  envVars: '',
+  os: 'linux' as OS,
+  platform: 'k8s' as Platform,
+  authEnabled: true,
+  tlsEnabled: false,
+  edgeGroupsIds: [],
+  group: 0,
+  tagsIds: [],
+  edgeIdGenerator: '',
+};
+
+interface Props {
+  edgeInfo: EdgeInfo;
+  commands: CommandTab[] | Partial<Record<OS, CommandTab[]>>;
+  asyncMode?: boolean;
+  showMetaFields?: boolean;
+}
+
+export function EdgeScriptForm({
+  edgeInfo,
+  commands,
+  asyncMode,
+  showMetaFields,
+  children,
+}: PropsWithChildren<Props>) {
+  const showOsSelector = !(commands instanceof Array);
+
+  return (
+    <div className="form-horizontal">
+      <Formik
+        initialValues={edgePropertiesFormInitialValues}
+        validationSchema={() => validationSchema()}
+        onSubmit={() => {}}
+        validateOnMount
+      >
+        {({ values, setFieldValue }) => (
+          <>
+            {children}
+
+            <EdgeScriptSettingsFieldset
+              hideIdGetter={edgeInfo.id !== undefined}
+              showMetaFields={showMetaFields}
+            />
+            <div className="mt-8">
+              {showOsSelector && (
+                <OsSelector
+                  value={values.os}
+                  onChange={(value) => setFieldValue('os', value)}
+                />
+              )}
+              <ScriptTabs
+                edgeId={edgeInfo.id}
+                edgeKey={edgeInfo.key}
+                values={values}
+                commands={showOsSelector ? commands[values.os] || [] : commands}
+                platform={values.platform}
+                onPlatformChange={(platform) =>
+                  setFieldValue('platform', platform)
+                }
+                asyncMode={asyncMode}
+              />
+            </div>
+          </>
+        )}
+      </Formik>
+    </div>
+  );
+}
diff --git a/app/react/edge/components/EdgeScriptForm/EdgeScriptForm.validation.tsx b/app/react/edge/components/EdgeScriptForm/EdgeScriptForm.validation.tsx
new file mode 100644
index 0000000..a0f7887
--- /dev/null
+++ b/app/react/edge/components/EdgeScriptForm/EdgeScriptForm.validation.tsx
@@ -0,0 +1,15 @@
+import { object, boolean, string } from 'yup';
+
+export function validationSchema() {
+  return object().shape({
+    allowSelfSignedCertificates: boolean(),
+    envVars: string(),
+    edgeIdGenerator: string()
+      .required('Edge ID Generator is required')
+      .test(
+        'valid edge id generator',
+        'edge id generator cannot be empty',
+        (value) => !!(value && value.length)
+      ),
+  });
+}
diff --git a/app/react/edge/components/EdgeScriptForm/EdgeScriptSettingsFieldset.tsx b/app/react/edge/components/EdgeScriptForm/EdgeScriptSettingsFieldset.tsx
new file mode 100644
index 0000000..da5cf2e
--- /dev/null
+++ b/app/react/edge/components/EdgeScriptForm/EdgeScriptSettingsFieldset.tsx
@@ -0,0 +1,111 @@
+import { useFormikContext, Field } from 'formik';
+
+import { GroupField } from '@/react/portainer/environments/common/MetadataFieldset/GroupsField';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+import { SwitchField } from '@@/form-components/SwitchField';
+import { TextTip } from '@@/Tip/TextTip';
+import { TagSelector } from '@@/TagSelector';
+
+import { EdgeGroupsSelector } from '../../edge-stacks/components/EdgeGroupsSelector';
+
+import { ScriptFormValues } from './types';
+
+interface Props {
+  hideIdGetter?: boolean;
+  showMetaFields?: boolean;
+}
+
+export function EdgeScriptSettingsFieldset({
+  hideIdGetter,
+  showMetaFields,
+}: Props) {
+  const { values, setFieldValue, errors } =
+    useFormikContext<ScriptFormValues>();
+
+  return (
+    <>
+      {showMetaFields && (
+        <>
+          <GroupField name="group" />
+
+          <EdgeGroupsSelector
+            value={values.edgeGroupsIds}
+            onChange={(value) => setFieldValue('edgeGroupsIds', value)}
+            isGroupVisible={(group) => !group.Dynamic}
+            horizontal
+          />
+
+          <TagSelector
+            value={values.tagsIds}
+            onChange={(value) => setFieldValue('tagsIds', value)}
+          />
+        </>
+      )}
+
+      {!hideIdGetter && (
+        <>
+          <FormControl
+            label="Edge ID Generator"
+            tooltip="Enter a single-line bash command that generates a unique Edge ID. For example, you can use 'uuidgen' or 'uuid'. The result will be assigned to the 'PORTAINER_EDGE_ID' environment variable."
+            inputId="edge-id-generator-input"
+            required
+            errors={errors.edgeIdGenerator}
+          >
+            <Input
+              type="text"
+              value={values.edgeIdGenerator}
+              name="edgeIdGenerator"
+              placeholder="e.g. uuidgen"
+              id="edge-id-generator-input"
+              onChange={(e) => setFieldValue(e.target.name, e.target.value)}
+              data-cy="edge-id-generator-input"
+            />
+          </FormControl>
+          <div className="form-group">
+            <div className="col-sm-12">
+              <TextTip color="blue">
+                <code>PORTAINER_EDGE_ID</code> environment variable is required
+                to successfully connect the edge agent to Portainer
+              </TextTip>
+            </div>
+          </div>
+        </>
+      )}
+
+      <FormControl
+        label="Environment variables"
+        tooltip="Comma separated list of environment variables that will be sourced from the host where the agent is deployed."
+        inputId="env-variables-input"
+      >
+        <Field
+          name="envVars"
+          as={Input}
+          placeholder="e.g. foo=bar"
+          id="env-variables-input"
+        />
+      </FormControl>
+
+      <TextTip color="orange" className="icon-orange mb-2">
+        For security purposes, only environment variables prefixed with
+        &apos;PORTAINER_&apos; will be accessible.
+      </TextTip>
+
+      <div className="form-group">
+        <div className="col-sm-12">
+          <SwitchField
+            checked={values.allowSelfSignedCertificates}
+            data-cy="allow-self-signed-certs-switch"
+            onChange={(value) =>
+              setFieldValue('allowSelfSignedCertificates', value)
+            }
+            label="Allow self-signed certs"
+            labelClass="col-sm-3 col-lg-2"
+            tooltip="When allowing self-signed certificates the edge agent will ignore the domain validation when connecting to Portainer via HTTPS"
+          />
+        </div>
+      </div>
+    </>
+  );
+}
diff --git a/app/react/edge/components/EdgeScriptForm/OsSelector.tsx b/app/react/edge/components/EdgeScriptForm/OsSelector.tsx
new file mode 100644
index 0000000..499b1b2
--- /dev/null
+++ b/app/react/edge/components/EdgeScriptForm/OsSelector.tsx
@@ -0,0 +1,47 @@
+import { LayoutGrid } from 'lucide-react';
+
+import Linux from '@/assets/ico/linux.svg?c';
+
+import { ButtonSelector } from '@@/form-components/ButtonSelector/ButtonSelector';
+import { Icon } from '@@/Icon';
+
+import { OS } from './types';
+
+interface Props {
+  value: OS;
+  onChange(value: OS): void;
+}
+
+export function OsSelector({ onChange, value }: Props) {
+  return (
+    <div className="form-group">
+      <div className="col-sm-12">
+        <ButtonSelector
+          size="small"
+          value={value}
+          onChange={(os: OS) => onChange(os)}
+          options={[
+            {
+              value: 'linux',
+              label: (
+                <>
+                  <Icon icon={Linux} className="mr-1" />
+                  Linux & Windows WSL
+                </>
+              ),
+            },
+            {
+              value: 'win',
+              label: (
+                <>
+                  <Icon icon={LayoutGrid} className="mr-1" />
+                  Windows WCS
+                </>
+              ),
+            },
+          ]}
+        />
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/edge/components/EdgeScriptForm/ScriptTabs.tsx b/app/react/edge/components/EdgeScriptForm/ScriptTabs.tsx
new file mode 100644
index 0000000..94ec3e8
--- /dev/null
+++ b/app/react/edge/components/EdgeScriptForm/ScriptTabs.tsx
@@ -0,0 +1,81 @@
+import { useEffect } from 'react';
+
+import { useAgentDetails } from '@/react/portainer/environments/queries/useAgentDetails';
+
+import { Code } from '@@/Code';
+import { CopyButton } from '@@/buttons/CopyButton';
+import { NavTabs } from '@@/NavTabs';
+import { NavContainer } from '@@/NavTabs/NavContainer';
+
+import { ScriptFormValues, Platform } from './types';
+import { CommandTab } from './scripts';
+
+interface Props {
+  values: ScriptFormValues;
+  edgeKey: string;
+  edgeId?: string;
+  commands: CommandTab[];
+  platform?: Platform;
+  onPlatformChange?(platform: Platform): void;
+  asyncMode?: boolean;
+}
+
+export function ScriptTabs({
+  values,
+  edgeKey,
+  edgeId,
+  commands,
+  platform,
+  asyncMode = false,
+  onPlatformChange = () => {},
+}: Props) {
+  const agentDetails = useAgentDetails();
+
+  useEffect(() => {
+    if (commands.length > 0 && commands.every((p) => p.id !== platform)) {
+      onPlatformChange(commands[0].id);
+    }
+  }, [platform, onPlatformChange, commands]);
+
+  if (!agentDetails) {
+    return null;
+  }
+
+  const { agentSecret, agentVersion } = agentDetails;
+
+  const options = commands.map((c) => {
+    const cmd = c.command(
+      agentVersion,
+      edgeKey,
+      values,
+      asyncMode,
+      edgeId,
+      agentSecret
+    );
+
+    return {
+      id: c.id,
+      label: c.label,
+      children: (
+        <>
+          <Code>{cmd}</Code>
+          <div className="mt-2">
+            <CopyButton copyText={cmd} data-cy="copy-edge-script-button">
+              Copy
+            </CopyButton>
+          </div>
+        </>
+      ),
+    };
+  });
+
+  return (
+    <NavContainer>
+      <NavTabs
+        selectedId={platform}
+        options={options}
+        onSelect={(id: Platform) => onPlatformChange(id)}
+      />
+    </NavContainer>
+  );
+}
diff --git a/app/react/edge/components/EdgeScriptForm/__snapshots__/scripts.test.ts.snap b/app/react/edge/components/EdgeScriptForm/__snapshots__/scripts.test.ts.snap
new file mode 100644
index 0000000..55e0d63
--- /dev/null
+++ b/app/react/edge/components/EdgeScriptForm/__snapshots__/scripts.test.ts.snap
@@ -0,0 +1,1183 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`'buildLinuxKubernetesCommand' > should generate basic command with minimal configuration 1`] = `"curl https://downloads.portainer.io/ee2-19/portainer-edge-agent-setup.sh | bash -s -- "test-edge-id" "test-edge-key" "0" "test-secret" """`;
+
+exports[`'buildLinuxKubernetesCommand' > should generate command with all meta variables 1`] = `"curl https://downloads.portainer.io/ee2-19/portainer-edge-agent-setup.sh | bash -s -- "test-edge-id" "test-edge-key" "0" "test-secret" "EDGE_GROUPS=1:2,PORTAINER_GROUP=5,PORTAINER_TAGS=10:20""`;
+
+exports[`'buildLinuxKubernetesCommand' > should generate command with async mode enabled 1`] = `"curl https://downloads.portainer.io/ee2-19/portainer-edge-agent-setup.sh | bash -s -- "test-edge-id" "test-edge-key" "0" "test-secret" "EDGE_ASYNC=1""`;
+
+exports[`'buildLinuxKubernetesCommand' > should generate command with custom environment variables 1`] = `"curl https://downloads.portainer.io/ee2-19/portainer-edge-agent-setup.sh | bash -s -- "test-edge-id" "test-edge-key" "0" "test-secret" "MY_VAR=value1,ANOTHER_VAR=value2""`;
+
+exports[`'buildLinuxKubernetesCommand' > should generate command with edge ID generator 1`] = `
+"PORTAINER_EDGE_ID=$(uuidgen) 
+
+curl https://downloads.portainer.io/ee2-19/portainer-edge-agent-setup.sh | bash -s -- "$PORTAINER_EDGE_ID" "test-edge-key" "0" "test-secret" """
+`;
+
+exports[`'buildLinuxKubernetesCommand' > should generate command with edge groups 1`] = `"curl https://downloads.portainer.io/ee2-19/portainer-edge-agent-setup.sh | bash -s -- "test-edge-id" "test-edge-key" "0" "test-secret" "EDGE_GROUPS=1:2:3""`;
+
+exports[`'buildLinuxKubernetesCommand' > should generate command with empty agent secret 1`] = `"curl https://downloads.portainer.io/ee2-19/portainer-edge-agent-setup.sh | bash -s -- "test-edge-id" "test-edge-key" "0" "" """`;
+
+exports[`'buildLinuxKubernetesCommand' > should generate command with portainer group 1`] = `"curl https://downloads.portainer.io/ee2-19/portainer-edge-agent-setup.sh | bash -s -- "test-edge-id" "test-edge-key" "0" "test-secret" "PORTAINER_GROUP=5""`;
+
+exports[`'buildLinuxKubernetesCommand' > should generate command with self-signed certificates allowed 1`] = `"curl https://downloads.portainer.io/ee2-19/portainer-edge-agent-setup.sh | bash -s -- "test-edge-id" "test-edge-key" "1" "test-secret" """`;
+
+exports[`'buildLinuxKubernetesCommand' > should generate command with tags 1`] = `"curl https://downloads.portainer.io/ee2-19/portainer-edge-agent-setup.sh | bash -s -- "test-edge-id" "test-edge-key" "0" "test-secret" "PORTAINER_TAGS=10:20:30""`;
+
+exports[`'buildLinuxKubernetesCommand' > should generate command without agent secret 1`] = `"curl https://downloads.portainer.io/ee2-19/portainer-edge-agent-setup.sh | bash -s -- "test-edge-id" "test-edge-key" "0" "undefined" """`;
+
+exports[`'buildLinuxPodmanCommand' > should generate basic command with minimal configuration 1`] = `
+"sudo podman volume create portainer_agent_data
+
+sudo podman run -d \\
+  -v /run/podman/podman.sock:/var/run/docker.sock \\
+  -v /var/lib/containers/storage/volumes:/var/lib/docker/volumes \\
+  -v /:/host \\
+  -v portainer_agent_data:/data \\
+  --restart always \\
+  --privileged \\
+  -e EDGE=1 \\
+  -e EDGE_ID=test-edge-id \\
+  -e EDGE_KEY=test-edge-key \\
+  -e EDGE_INSECURE_POLL=0 \\
+  -e AGENT_SECRET=test-secret \\
+  -e PODMAN=1 \\
+  --name portainer_edge_agent \\
+  docker.io/portainer/agent:2.19.0
+  "
+`;
+
+exports[`'buildLinuxPodmanCommand' > should generate command with all meta variables 1`] = `
+"sudo podman volume create portainer_agent_data
+
+sudo podman run -d \\
+  -v /run/podman/podman.sock:/var/run/docker.sock \\
+  -v /var/lib/containers/storage/volumes:/var/lib/docker/volumes \\
+  -v /:/host \\
+  -v portainer_agent_data:/data \\
+  --restart always \\
+  --privileged \\
+  -e EDGE=1 \\
+  -e EDGE_ID=test-edge-id \\
+  -e EDGE_KEY=test-edge-key \\
+  -e EDGE_INSECURE_POLL=0 \\
+  -e AGENT_SECRET=test-secret \\
+  -e PODMAN=1 \\
+  -e EDGE_GROUPS=1:2 \\
+  -e PORTAINER_GROUP=5 \\
+  -e PORTAINER_TAGS=10:20 \\
+  --name portainer_edge_agent \\
+  docker.io/portainer/agent:2.19.0
+  "
+`;
+
+exports[`'buildLinuxPodmanCommand' > should generate command with async mode enabled 1`] = `
+"sudo podman volume create portainer_agent_data
+
+sudo podman run -d \\
+  -v /run/podman/podman.sock:/var/run/docker.sock \\
+  -v /var/lib/containers/storage/volumes:/var/lib/docker/volumes \\
+  -v /:/host \\
+  -v portainer_agent_data:/data \\
+  --restart always \\
+  --privileged \\
+  -e EDGE=1 \\
+  -e EDGE_ID=test-edge-id \\
+  -e EDGE_KEY=test-edge-key \\
+  -e EDGE_INSECURE_POLL=0 \\
+  -e AGENT_SECRET=test-secret \\
+  -e EDGE_ASYNC=1 \\
+  -e PODMAN=1 \\
+  --name portainer_edge_agent \\
+  docker.io/portainer/agent:2.19.0
+  "
+`;
+
+exports[`'buildLinuxPodmanCommand' > should generate command with custom environment variables 1`] = `
+"sudo podman volume create portainer_agent_data
+
+sudo podman run -d \\
+  -v /run/podman/podman.sock:/var/run/docker.sock \\
+  -v /var/lib/containers/storage/volumes:/var/lib/docker/volumes \\
+  -v /:/host \\
+  -v portainer_agent_data:/data \\
+  --restart always \\
+  --privileged \\
+  -e EDGE=1 \\
+  -e EDGE_ID=test-edge-id \\
+  -e EDGE_KEY=test-edge-key \\
+  -e EDGE_INSECURE_POLL=0 \\
+  -e AGENT_SECRET=test-secret \\
+  -e PODMAN=1 \\
+  -e MY_VAR=value1 \\
+  -e ANOTHER_VAR=value2 \\
+  --name portainer_edge_agent \\
+  docker.io/portainer/agent:2.19.0
+  "
+`;
+
+exports[`'buildLinuxPodmanCommand' > should generate command with edge ID generator 1`] = `
+"PORTAINER_EDGE_ID=$(uuidgen) 
+
+sudo podman volume create portainer_agent_data
+
+sudo podman run -d \\
+  -v /run/podman/podman.sock:/var/run/docker.sock \\
+  -v /var/lib/containers/storage/volumes:/var/lib/docker/volumes \\
+  -v /:/host \\
+  -v portainer_agent_data:/data \\
+  --restart always \\
+  --privileged \\
+  -e EDGE=1 \\
+  -e EDGE_ID=$PORTAINER_EDGE_ID \\
+  -e EDGE_KEY=test-edge-key \\
+  -e EDGE_INSECURE_POLL=0 \\
+  -e AGENT_SECRET=test-secret \\
+  -e PODMAN=1 \\
+  --name portainer_edge_agent \\
+  docker.io/portainer/agent:2.19.0
+  "
+`;
+
+exports[`'buildLinuxPodmanCommand' > should generate command with edge groups 1`] = `
+"sudo podman volume create portainer_agent_data
+
+sudo podman run -d \\
+  -v /run/podman/podman.sock:/var/run/docker.sock \\
+  -v /var/lib/containers/storage/volumes:/var/lib/docker/volumes \\
+  -v /:/host \\
+  -v portainer_agent_data:/data \\
+  --restart always \\
+  --privileged \\
+  -e EDGE=1 \\
+  -e EDGE_ID=test-edge-id \\
+  -e EDGE_KEY=test-edge-key \\
+  -e EDGE_INSECURE_POLL=0 \\
+  -e AGENT_SECRET=test-secret \\
+  -e PODMAN=1 \\
+  -e EDGE_GROUPS=1:2:3 \\
+  --name portainer_edge_agent \\
+  docker.io/portainer/agent:2.19.0
+  "
+`;
+
+exports[`'buildLinuxPodmanCommand' > should generate command with empty agent secret 1`] = `
+"sudo podman volume create portainer_agent_data
+
+sudo podman run -d \\
+  -v /run/podman/podman.sock:/var/run/docker.sock \\
+  -v /var/lib/containers/storage/volumes:/var/lib/docker/volumes \\
+  -v /:/host \\
+  -v portainer_agent_data:/data \\
+  --restart always \\
+  --privileged \\
+  -e EDGE=1 \\
+  -e EDGE_ID=test-edge-id \\
+  -e EDGE_KEY=test-edge-key \\
+  -e EDGE_INSECURE_POLL=0 \\
+  -e PODMAN=1 \\
+  --name portainer_edge_agent \\
+  docker.io/portainer/agent:2.19.0
+  "
+`;
+
+exports[`'buildLinuxPodmanCommand' > should generate command with portainer group 1`] = `
+"sudo podman volume create portainer_agent_data
+
+sudo podman run -d \\
+  -v /run/podman/podman.sock:/var/run/docker.sock \\
+  -v /var/lib/containers/storage/volumes:/var/lib/docker/volumes \\
+  -v /:/host \\
+  -v portainer_agent_data:/data \\
+  --restart always \\
+  --privileged \\
+  -e EDGE=1 \\
+  -e EDGE_ID=test-edge-id \\
+  -e EDGE_KEY=test-edge-key \\
+  -e EDGE_INSECURE_POLL=0 \\
+  -e AGENT_SECRET=test-secret \\
+  -e PODMAN=1 \\
+  -e PORTAINER_GROUP=5 \\
+  --name portainer_edge_agent \\
+  docker.io/portainer/agent:2.19.0
+  "
+`;
+
+exports[`'buildLinuxPodmanCommand' > should generate command with self-signed certificates allowed 1`] = `
+"sudo podman volume create portainer_agent_data
+
+sudo podman run -d \\
+  -v /run/podman/podman.sock:/var/run/docker.sock \\
+  -v /var/lib/containers/storage/volumes:/var/lib/docker/volumes \\
+  -v /:/host \\
+  -v portainer_agent_data:/data \\
+  --restart always \\
+  --privileged \\
+  -e EDGE=1 \\
+  -e EDGE_ID=test-edge-id \\
+  -e EDGE_KEY=test-edge-key \\
+  -e EDGE_INSECURE_POLL=1 \\
+  -e AGENT_SECRET=test-secret \\
+  -e PODMAN=1 \\
+  --name portainer_edge_agent \\
+  docker.io/portainer/agent:2.19.0
+  "
+`;
+
+exports[`'buildLinuxPodmanCommand' > should generate command with tags 1`] = `
+"sudo podman volume create portainer_agent_data
+
+sudo podman run -d \\
+  -v /run/podman/podman.sock:/var/run/docker.sock \\
+  -v /var/lib/containers/storage/volumes:/var/lib/docker/volumes \\
+  -v /:/host \\
+  -v portainer_agent_data:/data \\
+  --restart always \\
+  --privileged \\
+  -e EDGE=1 \\
+  -e EDGE_ID=test-edge-id \\
+  -e EDGE_KEY=test-edge-key \\
+  -e EDGE_INSECURE_POLL=0 \\
+  -e AGENT_SECRET=test-secret \\
+  -e PODMAN=1 \\
+  -e PORTAINER_TAGS=10:20:30 \\
+  --name portainer_edge_agent \\
+  docker.io/portainer/agent:2.19.0
+  "
+`;
+
+exports[`'buildLinuxPodmanCommand' > should generate command without agent secret 1`] = `
+"sudo podman volume create portainer_agent_data
+
+sudo podman run -d \\
+  -v /run/podman/podman.sock:/var/run/docker.sock \\
+  -v /var/lib/containers/storage/volumes:/var/lib/docker/volumes \\
+  -v /:/host \\
+  -v portainer_agent_data:/data \\
+  --restart always \\
+  --privileged \\
+  -e EDGE=1 \\
+  -e EDGE_ID=test-edge-id \\
+  -e EDGE_KEY=test-edge-key \\
+  -e EDGE_INSECURE_POLL=0 \\
+  -e PODMAN=1 \\
+  --name portainer_edge_agent \\
+  docker.io/portainer/agent:2.19.0
+  "
+`;
+
+exports[`'buildLinuxStandaloneCommand' > should generate basic command with minimal configuration 1`] = `
+"docker run -d \\
+  -v /var/run/docker.sock:/var/run/docker.sock \\
+  -v /var/lib/docker/volumes:/var/lib/docker/volumes \\
+  -v /:/host \\
+  -v portainer_agent_data:/data \\
+  --restart always \\
+  -e EDGE=1 \\
+  -e EDGE_ID=test-edge-id \\
+  -e EDGE_KEY=test-edge-key \\
+  -e EDGE_INSECURE_POLL=0 \\
+  -e AGENT_SECRET=test-secret \\
+  --name portainer_edge_agent \\
+  portainer/agent:2.19.0
+  "
+`;
+
+exports[`'buildLinuxStandaloneCommand' > should generate command with all meta variables 1`] = `
+"docker run -d \\
+  -v /var/run/docker.sock:/var/run/docker.sock \\
+  -v /var/lib/docker/volumes:/var/lib/docker/volumes \\
+  -v /:/host \\
+  -v portainer_agent_data:/data \\
+  --restart always \\
+  -e EDGE=1 \\
+  -e EDGE_ID=test-edge-id \\
+  -e EDGE_KEY=test-edge-key \\
+  -e EDGE_INSECURE_POLL=0 \\
+  -e AGENT_SECRET=test-secret \\
+  -e EDGE_GROUPS=1:2 \\
+  -e PORTAINER_GROUP=5 \\
+  -e PORTAINER_TAGS=10:20 \\
+  --name portainer_edge_agent \\
+  portainer/agent:2.19.0
+  "
+`;
+
+exports[`'buildLinuxStandaloneCommand' > should generate command with async mode enabled 1`] = `
+"docker run -d \\
+  -v /var/run/docker.sock:/var/run/docker.sock \\
+  -v /var/lib/docker/volumes:/var/lib/docker/volumes \\
+  -v /:/host \\
+  -v portainer_agent_data:/data \\
+  --restart always \\
+  -e EDGE=1 \\
+  -e EDGE_ID=test-edge-id \\
+  -e EDGE_KEY=test-edge-key \\
+  -e EDGE_INSECURE_POLL=0 \\
+  -e AGENT_SECRET=test-secret \\
+  -e EDGE_ASYNC=1 \\
+  --name portainer_edge_agent \\
+  portainer/agent:2.19.0
+  "
+`;
+
+exports[`'buildLinuxStandaloneCommand' > should generate command with custom environment variables 1`] = `
+"docker run -d \\
+  -v /var/run/docker.sock:/var/run/docker.sock \\
+  -v /var/lib/docker/volumes:/var/lib/docker/volumes \\
+  -v /:/host \\
+  -v portainer_agent_data:/data \\
+  --restart always \\
+  -e EDGE=1 \\
+  -e EDGE_ID=test-edge-id \\
+  -e EDGE_KEY=test-edge-key \\
+  -e EDGE_INSECURE_POLL=0 \\
+  -e AGENT_SECRET=test-secret \\
+  -e MY_VAR=value1 \\
+  -e ANOTHER_VAR=value2 \\
+  --name portainer_edge_agent \\
+  portainer/agent:2.19.0
+  "
+`;
+
+exports[`'buildLinuxStandaloneCommand' > should generate command with edge ID generator 1`] = `
+"PORTAINER_EDGE_ID=$(uuidgen) 
+
+docker run -d \\
+  -v /var/run/docker.sock:/var/run/docker.sock \\
+  -v /var/lib/docker/volumes:/var/lib/docker/volumes \\
+  -v /:/host \\
+  -v portainer_agent_data:/data \\
+  --restart always \\
+  -e EDGE=1 \\
+  -e EDGE_ID=$PORTAINER_EDGE_ID \\
+  -e EDGE_KEY=test-edge-key \\
+  -e EDGE_INSECURE_POLL=0 \\
+  -e AGENT_SECRET=test-secret \\
+  --name portainer_edge_agent \\
+  portainer/agent:2.19.0
+  "
+`;
+
+exports[`'buildLinuxStandaloneCommand' > should generate command with edge groups 1`] = `
+"docker run -d \\
+  -v /var/run/docker.sock:/var/run/docker.sock \\
+  -v /var/lib/docker/volumes:/var/lib/docker/volumes \\
+  -v /:/host \\
+  -v portainer_agent_data:/data \\
+  --restart always \\
+  -e EDGE=1 \\
+  -e EDGE_ID=test-edge-id \\
+  -e EDGE_KEY=test-edge-key \\
+  -e EDGE_INSECURE_POLL=0 \\
+  -e AGENT_SECRET=test-secret \\
+  -e EDGE_GROUPS=1:2:3 \\
+  --name portainer_edge_agent \\
+  portainer/agent:2.19.0
+  "
+`;
+
+exports[`'buildLinuxStandaloneCommand' > should generate command with empty agent secret 1`] = `
+"docker run -d \\
+  -v /var/run/docker.sock:/var/run/docker.sock \\
+  -v /var/lib/docker/volumes:/var/lib/docker/volumes \\
+  -v /:/host \\
+  -v portainer_agent_data:/data \\
+  --restart always \\
+  -e EDGE=1 \\
+  -e EDGE_ID=test-edge-id \\
+  -e EDGE_KEY=test-edge-key \\
+  -e EDGE_INSECURE_POLL=0 \\
+  --name portainer_edge_agent \\
+  portainer/agent:2.19.0
+  "
+`;
+
+exports[`'buildLinuxStandaloneCommand' > should generate command with portainer group 1`] = `
+"docker run -d \\
+  -v /var/run/docker.sock:/var/run/docker.sock \\
+  -v /var/lib/docker/volumes:/var/lib/docker/volumes \\
+  -v /:/host \\
+  -v portainer_agent_data:/data \\
+  --restart always \\
+  -e EDGE=1 \\
+  -e EDGE_ID=test-edge-id \\
+  -e EDGE_KEY=test-edge-key \\
+  -e EDGE_INSECURE_POLL=0 \\
+  -e AGENT_SECRET=test-secret \\
+  -e PORTAINER_GROUP=5 \\
+  --name portainer_edge_agent \\
+  portainer/agent:2.19.0
+  "
+`;
+
+exports[`'buildLinuxStandaloneCommand' > should generate command with self-signed certificates allowed 1`] = `
+"docker run -d \\
+  -v /var/run/docker.sock:/var/run/docker.sock \\
+  -v /var/lib/docker/volumes:/var/lib/docker/volumes \\
+  -v /:/host \\
+  -v portainer_agent_data:/data \\
+  --restart always \\
+  -e EDGE=1 \\
+  -e EDGE_ID=test-edge-id \\
+  -e EDGE_KEY=test-edge-key \\
+  -e EDGE_INSECURE_POLL=1 \\
+  -e AGENT_SECRET=test-secret \\
+  --name portainer_edge_agent \\
+  portainer/agent:2.19.0
+  "
+`;
+
+exports[`'buildLinuxStandaloneCommand' > should generate command with tags 1`] = `
+"docker run -d \\
+  -v /var/run/docker.sock:/var/run/docker.sock \\
+  -v /var/lib/docker/volumes:/var/lib/docker/volumes \\
+  -v /:/host \\
+  -v portainer_agent_data:/data \\
+  --restart always \\
+  -e EDGE=1 \\
+  -e EDGE_ID=test-edge-id \\
+  -e EDGE_KEY=test-edge-key \\
+  -e EDGE_INSECURE_POLL=0 \\
+  -e AGENT_SECRET=test-secret \\
+  -e PORTAINER_TAGS=10:20:30 \\
+  --name portainer_edge_agent \\
+  portainer/agent:2.19.0
+  "
+`;
+
+exports[`'buildLinuxStandaloneCommand' > should generate command without agent secret 1`] = `
+"docker run -d \\
+  -v /var/run/docker.sock:/var/run/docker.sock \\
+  -v /var/lib/docker/volumes:/var/lib/docker/volumes \\
+  -v /:/host \\
+  -v portainer_agent_data:/data \\
+  --restart always \\
+  -e EDGE=1 \\
+  -e EDGE_ID=test-edge-id \\
+  -e EDGE_KEY=test-edge-key \\
+  -e EDGE_INSECURE_POLL=0 \\
+  --name portainer_edge_agent \\
+  portainer/agent:2.19.0
+  "
+`;
+
+exports[`'buildLinuxSwarmCommand' > should generate basic command with minimal configuration 1`] = `
+"docker network create \\
+  --driver overlay \\
+  portainer_agent_network;
+
+docker service create \\
+  --name portainer_edge_agent \\
+  --network portainer_agent_network \\
+  -e EDGE=1 \\
+  -e EDGE_ID=test-edge-id \\
+  -e EDGE_KEY=test-edge-key \\
+  -e EDGE_INSECURE_POLL=0 \\
+  -e AGENT_SECRET=test-secret \\
+  -e AGENT_CLUSTER_ADDR=tasks.portainer_edge_agent \\
+  --mode global \\
+  --constraint 'node.platform.os == linux' \\
+  --mount type=bind,src=//var/run/docker.sock,dst=/var/run/docker.sock \\
+  --mount type=bind,src=//var/lib/docker/volumes,dst=/var/lib/docker/volumes \\
+  --mount type=bind,src=//,dst=/host \\
+  --mount type=volume,src=portainer_agent_data,dst=/data \\
+  portainer/agent:2.19.0
+"
+`;
+
+exports[`'buildLinuxSwarmCommand' > should generate command with all meta variables 1`] = `
+"docker network create \\
+  --driver overlay \\
+  portainer_agent_network;
+
+docker service create \\
+  --name portainer_edge_agent \\
+  --network portainer_agent_network \\
+  -e EDGE=1 \\
+  -e EDGE_ID=test-edge-id \\
+  -e EDGE_KEY=test-edge-key \\
+  -e EDGE_INSECURE_POLL=0 \\
+  -e AGENT_SECRET=test-secret \\
+  -e AGENT_CLUSTER_ADDR=tasks.portainer_edge_agent \\
+  -e EDGE_GROUPS=1:2 \\
+  -e PORTAINER_GROUP=5 \\
+  -e PORTAINER_TAGS=10:20 \\
+  --mode global \\
+  --constraint 'node.platform.os == linux' \\
+  --mount type=bind,src=//var/run/docker.sock,dst=/var/run/docker.sock \\
+  --mount type=bind,src=//var/lib/docker/volumes,dst=/var/lib/docker/volumes \\
+  --mount type=bind,src=//,dst=/host \\
+  --mount type=volume,src=portainer_agent_data,dst=/data \\
+  portainer/agent:2.19.0
+"
+`;
+
+exports[`'buildLinuxSwarmCommand' > should generate command with async mode enabled 1`] = `
+"docker network create \\
+  --driver overlay \\
+  portainer_agent_network;
+
+docker service create \\
+  --name portainer_edge_agent \\
+  --network portainer_agent_network \\
+  -e EDGE=1 \\
+  -e EDGE_ID=test-edge-id \\
+  -e EDGE_KEY=test-edge-key \\
+  -e EDGE_INSECURE_POLL=0 \\
+  -e AGENT_SECRET=test-secret \\
+  -e EDGE_ASYNC=1 \\
+  -e AGENT_CLUSTER_ADDR=tasks.portainer_edge_agent \\
+  --mode global \\
+  --constraint 'node.platform.os == linux' \\
+  --mount type=bind,src=//var/run/docker.sock,dst=/var/run/docker.sock \\
+  --mount type=bind,src=//var/lib/docker/volumes,dst=/var/lib/docker/volumes \\
+  --mount type=bind,src=//,dst=/host \\
+  --mount type=volume,src=portainer_agent_data,dst=/data \\
+  portainer/agent:2.19.0
+"
+`;
+
+exports[`'buildLinuxSwarmCommand' > should generate command with custom environment variables 1`] = `
+"docker network create \\
+  --driver overlay \\
+  portainer_agent_network;
+
+docker service create \\
+  --name portainer_edge_agent \\
+  --network portainer_agent_network \\
+  -e EDGE=1 \\
+  -e EDGE_ID=test-edge-id \\
+  -e EDGE_KEY=test-edge-key \\
+  -e EDGE_INSECURE_POLL=0 \\
+  -e AGENT_SECRET=test-secret \\
+  -e AGENT_CLUSTER_ADDR=tasks.portainer_edge_agent \\
+  -e MY_VAR=value1 \\
+  -e ANOTHER_VAR=value2 \\
+  --mode global \\
+  --constraint 'node.platform.os == linux' \\
+  --mount type=bind,src=//var/run/docker.sock,dst=/var/run/docker.sock \\
+  --mount type=bind,src=//var/lib/docker/volumes,dst=/var/lib/docker/volumes \\
+  --mount type=bind,src=//,dst=/host \\
+  --mount type=volume,src=portainer_agent_data,dst=/data \\
+  portainer/agent:2.19.0
+"
+`;
+
+exports[`'buildLinuxSwarmCommand' > should generate command with edge ID generator 1`] = `
+"PORTAINER_EDGE_ID=$(uuidgen) 
+
+docker network create \\
+  --driver overlay \\
+  portainer_agent_network;
+
+docker service create \\
+  --name portainer_edge_agent \\
+  --network portainer_agent_network \\
+  -e EDGE=1 \\
+  -e EDGE_ID=$PORTAINER_EDGE_ID \\
+  -e EDGE_KEY=test-edge-key \\
+  -e EDGE_INSECURE_POLL=0 \\
+  -e AGENT_SECRET=test-secret \\
+  -e AGENT_CLUSTER_ADDR=tasks.portainer_edge_agent \\
+  --mode global \\
+  --constraint 'node.platform.os == linux' \\
+  --mount type=bind,src=//var/run/docker.sock,dst=/var/run/docker.sock \\
+  --mount type=bind,src=//var/lib/docker/volumes,dst=/var/lib/docker/volumes \\
+  --mount type=bind,src=//,dst=/host \\
+  --mount type=volume,src=portainer_agent_data,dst=/data \\
+  portainer/agent:2.19.0
+"
+`;
+
+exports[`'buildLinuxSwarmCommand' > should generate command with edge groups 1`] = `
+"docker network create \\
+  --driver overlay \\
+  portainer_agent_network;
+
+docker service create \\
+  --name portainer_edge_agent \\
+  --network portainer_agent_network \\
+  -e EDGE=1 \\
+  -e EDGE_ID=test-edge-id \\
+  -e EDGE_KEY=test-edge-key \\
+  -e EDGE_INSECURE_POLL=0 \\
+  -e AGENT_SECRET=test-secret \\
+  -e AGENT_CLUSTER_ADDR=tasks.portainer_edge_agent \\
+  -e EDGE_GROUPS=1:2:3 \\
+  --mode global \\
+  --constraint 'node.platform.os == linux' \\
+  --mount type=bind,src=//var/run/docker.sock,dst=/var/run/docker.sock \\
+  --mount type=bind,src=//var/lib/docker/volumes,dst=/var/lib/docker/volumes \\
+  --mount type=bind,src=//,dst=/host \\
+  --mount type=volume,src=portainer_agent_data,dst=/data \\
+  portainer/agent:2.19.0
+"
+`;
+
+exports[`'buildLinuxSwarmCommand' > should generate command with empty agent secret 1`] = `
+"docker network create \\
+  --driver overlay \\
+  portainer_agent_network;
+
+docker service create \\
+  --name portainer_edge_agent \\
+  --network portainer_agent_network \\
+  -e EDGE=1 \\
+  -e EDGE_ID=test-edge-id \\
+  -e EDGE_KEY=test-edge-key \\
+  -e EDGE_INSECURE_POLL=0 \\
+  -e AGENT_CLUSTER_ADDR=tasks.portainer_edge_agent \\
+  --mode global \\
+  --constraint 'node.platform.os == linux' \\
+  --mount type=bind,src=//var/run/docker.sock,dst=/var/run/docker.sock \\
+  --mount type=bind,src=//var/lib/docker/volumes,dst=/var/lib/docker/volumes \\
+  --mount type=bind,src=//,dst=/host \\
+  --mount type=volume,src=portainer_agent_data,dst=/data \\
+  portainer/agent:2.19.0
+"
+`;
+
+exports[`'buildLinuxSwarmCommand' > should generate command with portainer group 1`] = `
+"docker network create \\
+  --driver overlay \\
+  portainer_agent_network;
+
+docker service create \\
+  --name portainer_edge_agent \\
+  --network portainer_agent_network \\
+  -e EDGE=1 \\
+  -e EDGE_ID=test-edge-id \\
+  -e EDGE_KEY=test-edge-key \\
+  -e EDGE_INSECURE_POLL=0 \\
+  -e AGENT_SECRET=test-secret \\
+  -e AGENT_CLUSTER_ADDR=tasks.portainer_edge_agent \\
+  -e PORTAINER_GROUP=5 \\
+  --mode global \\
+  --constraint 'node.platform.os == linux' \\
+  --mount type=bind,src=//var/run/docker.sock,dst=/var/run/docker.sock \\
+  --mount type=bind,src=//var/lib/docker/volumes,dst=/var/lib/docker/volumes \\
+  --mount type=bind,src=//,dst=/host \\
+  --mount type=volume,src=portainer_agent_data,dst=/data \\
+  portainer/agent:2.19.0
+"
+`;
+
+exports[`'buildLinuxSwarmCommand' > should generate command with self-signed certificates allowed 1`] = `
+"docker network create \\
+  --driver overlay \\
+  portainer_agent_network;
+
+docker service create \\
+  --name portainer_edge_agent \\
+  --network portainer_agent_network \\
+  -e EDGE=1 \\
+  -e EDGE_ID=test-edge-id \\
+  -e EDGE_KEY=test-edge-key \\
+  -e EDGE_INSECURE_POLL=1 \\
+  -e AGENT_SECRET=test-secret \\
+  -e AGENT_CLUSTER_ADDR=tasks.portainer_edge_agent \\
+  --mode global \\
+  --constraint 'node.platform.os == linux' \\
+  --mount type=bind,src=//var/run/docker.sock,dst=/var/run/docker.sock \\
+  --mount type=bind,src=//var/lib/docker/volumes,dst=/var/lib/docker/volumes \\
+  --mount type=bind,src=//,dst=/host \\
+  --mount type=volume,src=portainer_agent_data,dst=/data \\
+  portainer/agent:2.19.0
+"
+`;
+
+exports[`'buildLinuxSwarmCommand' > should generate command with tags 1`] = `
+"docker network create \\
+  --driver overlay \\
+  portainer_agent_network;
+
+docker service create \\
+  --name portainer_edge_agent \\
+  --network portainer_agent_network \\
+  -e EDGE=1 \\
+  -e EDGE_ID=test-edge-id \\
+  -e EDGE_KEY=test-edge-key \\
+  -e EDGE_INSECURE_POLL=0 \\
+  -e AGENT_SECRET=test-secret \\
+  -e AGENT_CLUSTER_ADDR=tasks.portainer_edge_agent \\
+  -e PORTAINER_TAGS=10:20:30 \\
+  --mode global \\
+  --constraint 'node.platform.os == linux' \\
+  --mount type=bind,src=//var/run/docker.sock,dst=/var/run/docker.sock \\
+  --mount type=bind,src=//var/lib/docker/volumes,dst=/var/lib/docker/volumes \\
+  --mount type=bind,src=//,dst=/host \\
+  --mount type=volume,src=portainer_agent_data,dst=/data \\
+  portainer/agent:2.19.0
+"
+`;
+
+exports[`'buildLinuxSwarmCommand' > should generate command without agent secret 1`] = `
+"docker network create \\
+  --driver overlay \\
+  portainer_agent_network;
+
+docker service create \\
+  --name portainer_edge_agent \\
+  --network portainer_agent_network \\
+  -e EDGE=1 \\
+  -e EDGE_ID=test-edge-id \\
+  -e EDGE_KEY=test-edge-key \\
+  -e EDGE_INSECURE_POLL=0 \\
+  -e AGENT_CLUSTER_ADDR=tasks.portainer_edge_agent \\
+  --mode global \\
+  --constraint 'node.platform.os == linux' \\
+  --mount type=bind,src=//var/run/docker.sock,dst=/var/run/docker.sock \\
+  --mount type=bind,src=//var/lib/docker/volumes,dst=/var/lib/docker/volumes \\
+  --mount type=bind,src=//,dst=/host \\
+  --mount type=volume,src=portainer_agent_data,dst=/data \\
+  portainer/agent:2.19.0
+"
+`;
+
+exports[`'buildWindowsStandaloneCommand' > should generate basic command with minimal configuration 1`] = `
+"docker run -d \`
+  --mount type=npipe,src=\\\\.\\pipe\\docker_engine,dst=\\\\.\\pipe\\docker_engine \`
+  --mount type=bind,src=C:\\ProgramData\\docker\\volumes,dst=C:\\ProgramData\\docker\\volumes \`
+  --mount type=volume,src=portainer_agent_data,dst=C:\\data \`
+  --restart always \`
+   -e EDGE=1 \`
+  -e EDGE_ID=test-edge-id \`
+  -e EDGE_KEY=test-edge-key \`
+  -e EDGE_INSECURE_POLL=0 \`
+  -e AGENT_SECRET=test-secret \`
+  --name portainer_edge_agent \`
+  portainer/agent:2.19.0
+  "
+`;
+
+exports[`'buildWindowsStandaloneCommand' > should generate command with all meta variables 1`] = `
+"docker run -d \`
+  --mount type=npipe,src=\\\\.\\pipe\\docker_engine,dst=\\\\.\\pipe\\docker_engine \`
+  --mount type=bind,src=C:\\ProgramData\\docker\\volumes,dst=C:\\ProgramData\\docker\\volumes \`
+  --mount type=volume,src=portainer_agent_data,dst=C:\\data \`
+  --restart always \`
+   -e EDGE=1 \`
+  -e EDGE_ID=test-edge-id \`
+  -e EDGE_KEY=test-edge-key \`
+  -e EDGE_INSECURE_POLL=0 \`
+  -e AGENT_SECRET=test-secret \`
+  -e EDGE_GROUPS=1:2 \`
+  -e PORTAINER_GROUP=5 \`
+  -e PORTAINER_TAGS=10:20 \`
+  --name portainer_edge_agent \`
+  portainer/agent:2.19.0
+  "
+`;
+
+exports[`'buildWindowsStandaloneCommand' > should generate command with async mode enabled 1`] = `
+"docker run -d \`
+  --mount type=npipe,src=\\\\.\\pipe\\docker_engine,dst=\\\\.\\pipe\\docker_engine \`
+  --mount type=bind,src=C:\\ProgramData\\docker\\volumes,dst=C:\\ProgramData\\docker\\volumes \`
+  --mount type=volume,src=portainer_agent_data,dst=C:\\data \`
+  --restart always \`
+   -e EDGE=1 \`
+  -e EDGE_ID=test-edge-id \`
+  -e EDGE_KEY=test-edge-key \`
+  -e EDGE_INSECURE_POLL=0 \`
+  -e AGENT_SECRET=test-secret \`
+  -e EDGE_ASYNC=1 \`
+  --name portainer_edge_agent \`
+  portainer/agent:2.19.0
+  "
+`;
+
+exports[`'buildWindowsStandaloneCommand' > should generate command with custom environment variables 1`] = `
+"docker run -d \`
+  --mount type=npipe,src=\\\\.\\pipe\\docker_engine,dst=\\\\.\\pipe\\docker_engine \`
+  --mount type=bind,src=C:\\ProgramData\\docker\\volumes,dst=C:\\ProgramData\\docker\\volumes \`
+  --mount type=volume,src=portainer_agent_data,dst=C:\\data \`
+  --restart always \`
+   -e EDGE=1 \`
+  -e EDGE_ID=test-edge-id \`
+  -e EDGE_KEY=test-edge-key \`
+  -e EDGE_INSECURE_POLL=0 \`
+  -e AGENT_SECRET=test-secret \`
+  -e MY_VAR=value1 \`
+  -e ANOTHER_VAR=value2 \`
+  --name portainer_edge_agent \`
+  portainer/agent:2.19.0
+  "
+`;
+
+exports[`'buildWindowsStandaloneCommand' > should generate command with edge ID generator 1`] = `
+"$Env:PORTAINER_EDGE_ID = "@(Get-MachineGUID)" 
+
+docker run -d \`
+  --mount type=npipe,src=\\\\.\\pipe\\docker_engine,dst=\\\\.\\pipe\\docker_engine \`
+  --mount type=bind,src=C:\\ProgramData\\docker\\volumes,dst=C:\\ProgramData\\docker\\volumes \`
+  --mount type=volume,src=portainer_agent_data,dst=C:\\data \`
+  --restart always \`
+   -e EDGE=1 \`
+  -e EDGE_ID=$Env:PORTAINER_EDGE_ID \`
+  -e EDGE_KEY=test-edge-key \`
+  -e EDGE_INSECURE_POLL=0 \`
+  -e AGENT_SECRET=test-secret \`
+  --name portainer_edge_agent \`
+  portainer/agent:2.19.0
+  "
+`;
+
+exports[`'buildWindowsStandaloneCommand' > should generate command with edge groups 1`] = `
+"docker run -d \`
+  --mount type=npipe,src=\\\\.\\pipe\\docker_engine,dst=\\\\.\\pipe\\docker_engine \`
+  --mount type=bind,src=C:\\ProgramData\\docker\\volumes,dst=C:\\ProgramData\\docker\\volumes \`
+  --mount type=volume,src=portainer_agent_data,dst=C:\\data \`
+  --restart always \`
+   -e EDGE=1 \`
+  -e EDGE_ID=test-edge-id \`
+  -e EDGE_KEY=test-edge-key \`
+  -e EDGE_INSECURE_POLL=0 \`
+  -e AGENT_SECRET=test-secret \`
+  -e EDGE_GROUPS=1:2:3 \`
+  --name portainer_edge_agent \`
+  portainer/agent:2.19.0
+  "
+`;
+
+exports[`'buildWindowsStandaloneCommand' > should generate command with empty agent secret 1`] = `
+"docker run -d \`
+  --mount type=npipe,src=\\\\.\\pipe\\docker_engine,dst=\\\\.\\pipe\\docker_engine \`
+  --mount type=bind,src=C:\\ProgramData\\docker\\volumes,dst=C:\\ProgramData\\docker\\volumes \`
+  --mount type=volume,src=portainer_agent_data,dst=C:\\data \`
+  --restart always \`
+   -e EDGE=1 \`
+  -e EDGE_ID=test-edge-id \`
+  -e EDGE_KEY=test-edge-key \`
+  -e EDGE_INSECURE_POLL=0 \`
+  --name portainer_edge_agent \`
+  portainer/agent:2.19.0
+  "
+`;
+
+exports[`'buildWindowsStandaloneCommand' > should generate command with portainer group 1`] = `
+"docker run -d \`
+  --mount type=npipe,src=\\\\.\\pipe\\docker_engine,dst=\\\\.\\pipe\\docker_engine \`
+  --mount type=bind,src=C:\\ProgramData\\docker\\volumes,dst=C:\\ProgramData\\docker\\volumes \`
+  --mount type=volume,src=portainer_agent_data,dst=C:\\data \`
+  --restart always \`
+   -e EDGE=1 \`
+  -e EDGE_ID=test-edge-id \`
+  -e EDGE_KEY=test-edge-key \`
+  -e EDGE_INSECURE_POLL=0 \`
+  -e AGENT_SECRET=test-secret \`
+  -e PORTAINER_GROUP=5 \`
+  --name portainer_edge_agent \`
+  portainer/agent:2.19.0
+  "
+`;
+
+exports[`'buildWindowsStandaloneCommand' > should generate command with self-signed certificates allowed 1`] = `
+"docker run -d \`
+  --mount type=npipe,src=\\\\.\\pipe\\docker_engine,dst=\\\\.\\pipe\\docker_engine \`
+  --mount type=bind,src=C:\\ProgramData\\docker\\volumes,dst=C:\\ProgramData\\docker\\volumes \`
+  --mount type=volume,src=portainer_agent_data,dst=C:\\data \`
+  --restart always \`
+   -e EDGE=1 \`
+  -e EDGE_ID=test-edge-id \`
+  -e EDGE_KEY=test-edge-key \`
+  -e EDGE_INSECURE_POLL=1 \`
+  -e AGENT_SECRET=test-secret \`
+  --name portainer_edge_agent \`
+  portainer/agent:2.19.0
+  "
+`;
+
+exports[`'buildWindowsStandaloneCommand' > should generate command with tags 1`] = `
+"docker run -d \`
+  --mount type=npipe,src=\\\\.\\pipe\\docker_engine,dst=\\\\.\\pipe\\docker_engine \`
+  --mount type=bind,src=C:\\ProgramData\\docker\\volumes,dst=C:\\ProgramData\\docker\\volumes \`
+  --mount type=volume,src=portainer_agent_data,dst=C:\\data \`
+  --restart always \`
+   -e EDGE=1 \`
+  -e EDGE_ID=test-edge-id \`
+  -e EDGE_KEY=test-edge-key \`
+  -e EDGE_INSECURE_POLL=0 \`
+  -e AGENT_SECRET=test-secret \`
+  -e PORTAINER_TAGS=10:20:30 \`
+  --name portainer_edge_agent \`
+  portainer/agent:2.19.0
+  "
+`;
+
+exports[`'buildWindowsStandaloneCommand' > should generate command without agent secret 1`] = `
+"docker run -d \`
+  --mount type=npipe,src=\\\\.\\pipe\\docker_engine,dst=\\\\.\\pipe\\docker_engine \`
+  --mount type=bind,src=C:\\ProgramData\\docker\\volumes,dst=C:\\ProgramData\\docker\\volumes \`
+  --mount type=volume,src=portainer_agent_data,dst=C:\\data \`
+  --restart always \`
+   -e EDGE=1 \`
+  -e EDGE_ID=test-edge-id \`
+  -e EDGE_KEY=test-edge-key \`
+  -e EDGE_INSECURE_POLL=0 \`
+  --name portainer_edge_agent \`
+  portainer/agent:2.19.0
+  "
+`;
+
+exports[`'buildWindowsSwarmCommand' > should generate basic command with minimal configuration 1`] = `
+"docker network create \`
+  --driver overlay \`
+  portainer_agent_network;
+
+docker service create \`
+  --name portainer_edge_agent \`
+  --network portainer_agent_network \`
+  -e EDGE=1 \`
+  -e EDGE_ID=test-edge-id \`
+  -e EDGE_KEY=test-edge-key \`
+  -e EDGE_INSECURE_POLL=0 \`
+  -e AGENT_SECRET=test-secret \`
+  -e AGENT_CLUSTER_ADDR=tasks.portainer_edge_agent \`
+  --mode global \`
+  --constraint 'node.platform.os == windows' \`
+  --mount type=npipe,src=\\\\.\\pipe\\docker_engine,dst=\\\\.\\pipe\\docker_engine \`
+  --mount type=bind,src=C:\\ProgramData\\docker\\volumes,dst=C:\\ProgramData\\docker\\volumes \`
+  --mount type=volume,src=portainer_agent_data,dst=C:\\data \`
+  portainer/agent:2.19.0
+"
+`;
+
+exports[`'buildWindowsSwarmCommand' > should generate command with all meta variables 1`] = `
+"docker network create \`
+  --driver overlay \`
+  portainer_agent_network;
+
+docker service create \`
+  --name portainer_edge_agent \`
+  --network portainer_agent_network \`
+  -e EDGE=1 \`
+  -e EDGE_ID=test-edge-id \`
+  -e EDGE_KEY=test-edge-key \`
+  -e EDGE_INSECURE_POLL=0 \`
+  -e AGENT_SECRET=test-secret \`
+  -e AGENT_CLUSTER_ADDR=tasks.portainer_edge_agent \`
+  -e EDGE_GROUPS=1:2 \`
+  -e PORTAINER_GROUP=5 \`
+  -e PORTAINER_TAGS=10:20 \`
+  --mode global \`
+  --constraint 'node.platform.os == windows' \`
+  --mount type=npipe,src=\\\\.\\pipe\\docker_engine,dst=\\\\.\\pipe\\docker_engine \`
+  --mount type=bind,src=C:\\ProgramData\\docker\\volumes,dst=C:\\ProgramData\\docker\\volumes \`
+  --mount type=volume,src=portainer_agent_data,dst=C:\\data \`
+  portainer/agent:2.19.0
+"
+`;
+
+exports[`'buildWindowsSwarmCommand' > should generate command with async mode enabled 1`] = `
+"docker network create \`
+  --driver overlay \`
+  portainer_agent_network;
+
+docker service create \`
+  --name portainer_edge_agent \`
+  --network portainer_agent_network \`
+  -e EDGE=1 \`
+  -e EDGE_ID=test-edge-id \`
+  -e EDGE_KEY=test-edge-key \`
+  -e EDGE_INSECURE_POLL=0 \`
+  -e AGENT_SECRET=test-secret \`
+  -e EDGE_ASYNC=1 \`
+  -e AGENT_CLUSTER_ADDR=tasks.portainer_edge_agent \`
+  --mode global \`
+  --constraint 'node.platform.os == windows' \`
+  --mount type=npipe,src=\\\\.\\pipe\\docker_engine,dst=\\\\.\\pipe\\docker_engine \`
+  --mount type=bind,src=C:\\ProgramData\\docker\\volumes,dst=C:\\ProgramData\\docker\\volumes \`
+  --mount type=volume,src=portainer_agent_data,dst=C:\\data \`
+  portainer/agent:2.19.0
+"
+`;
+
+exports[`'buildWindowsSwarmCommand' > should generate command with custom environment variables 1`] = `
+"docker network create \`
+  --driver overlay \`
+  portainer_agent_network;
+
+docker service create \`
+  --name portainer_edge_agent \`
+  --network portainer_agent_network \`
+  -e EDGE=1 \`
+  -e EDGE_ID=test-edge-id \`
+  -e EDGE_KEY=test-edge-key \`
+  -e EDGE_INSECURE_POLL=0 \`
+  -e AGENT_SECRET=test-secret \`
+  -e AGENT_CLUSTER_ADDR=tasks.portainer_edge_agent \`
+  -e MY_VAR=value1 \`
+  -e ANOTHER_VAR=value2 \`
+  --mode global \`
+  --constraint 'node.platform.os == windows' \`
+  --mount type=npipe,src=\\\\.\\pipe\\docker_engine,dst=\\\\.\\pipe\\docker_engine \`
+  --mount type=bind,src=C:\\ProgramData\\docker\\volumes,dst=C:\\ProgramData\\docker\\volumes \`
+  --mount type=volume,src=portainer_agent_data,dst=C:\\data \`
+  portainer/agent:2.19.0
+"
+`;
+
+exports[`'buildWindowsSwarmCommand' > should generate command with edge ID generator 1`] = `
+"$Env:PORTAINER_EDGE_ID = "@(Get-MachineGUID)" 
+
+docker network create \`
+  --driver overlay \`
+  portainer_agent_network;
+
+docker service create \`
+  --name portainer_edge_agent \`
+  --network portainer_agent_network \`
+  -e EDGE=1 \`
+  -e EDGE_ID=$Env:PORTAINER_EDGE_ID \`
+  -e EDGE_KEY=test-edge-key \`
+  -e EDGE_INSECURE_POLL=0 \`
+  -e AGENT_SECRET=test-secret \`
+  -e AGENT_CLUSTER_ADDR=tasks.portainer_edge_agent \`
+  --mode global \`
+  --constraint 'node.platform.os == windows' \`
+  --mount type=npipe,src=\\\\.\\pipe\\docker_engine,dst=\\\\.\\pipe\\docker_engine \`
+  --mount type=bind,src=C:\\ProgramData\\docker\\volumes,dst=C:\\ProgramData\\docker\\volumes \`
+  --mount type=volume,src=portainer_agent_data,dst=C:\\data \`
+  portainer/agent:2.19.0
+"
+`;
+
+exports[`'buildWindowsSwarmCommand' > should generate command with edge groups 1`] = `
+"docker network create \`
+  --driver overlay \`
+  portainer_agent_network;
+
+docker service create \`
+  --name portainer_edge_agent \`
+  --network portainer_agent_network \`
+  -e EDGE=1 \`
+  -e EDGE_ID=test-edge-id \`
+  -e EDGE_KEY=test-edge-key \`
+  -e EDGE_INSECURE_POLL=0 \`
+  -e AGENT_SECRET=test-secret \`
+  -e AGENT_CLUSTER_ADDR=tasks.portainer_edge_agent \`
+  -e EDGE_GROUPS=1:2:3 \`
+  --mode global \`
+  --constraint 'node.platform.os == windows' \`
+  --mount type=npipe,src=\\\\.\\pipe\\docker_engine,dst=\\\\.\\pipe\\docker_engine \`
+  --mount type=bind,src=C:\\ProgramData\\docker\\volumes,dst=C:\\ProgramData\\docker\\volumes \`
+  --mount type=volume,src=portainer_agent_data,dst=C:\\data \`
+  portainer/agent:2.19.0
+"
+`;
+
+exports[`'buildWindowsSwarmCommand' > should generate command with empty agent secret 1`] = `
+"docker network create \`
+  --driver overlay \`
+  portainer_agent_network;
+
+docker service create \`
+  --name portainer_edge_agent \`
+  --network portainer_agent_network \`
+  -e EDGE=1 \`
+  -e EDGE_ID=test-edge-id \`
+  -e EDGE_KEY=test-edge-key \`
+  -e EDGE_INSECURE_POLL=0 \`
+  -e AGENT_CLUSTER_ADDR=tasks.portainer_edge_agent \`
+  --mode global \`
+  --constraint 'node.platform.os == windows' \`
+  --mount type=npipe,src=\\\\.\\pipe\\docker_engine,dst=\\\\.\\pipe\\docker_engine \`
+  --mount type=bind,src=C:\\ProgramData\\docker\\volumes,dst=C:\\ProgramData\\docker\\volumes \`
+  --mount type=volume,src=portainer_agent_data,dst=C:\\data \`
+  portainer/agent:2.19.0
+"
+`;
+
+exports[`'buildWindowsSwarmCommand' > should generate command with portainer group 1`] = `
+"docker network create \`
+  --driver overlay \`
+  portainer_agent_network;
+
+docker service create \`
+  --name portainer_edge_agent \`
+  --network portainer_agent_network \`
+  -e EDGE=1 \`
+  -e EDGE_ID=test-edge-id \`
+  -e EDGE_KEY=test-edge-key \`
+  -e EDGE_INSECURE_POLL=0 \`
+  -e AGENT_SECRET=test-secret \`
+  -e AGENT_CLUSTER_ADDR=tasks.portainer_edge_agent \`
+  -e PORTAINER_GROUP=5 \`
+  --mode global \`
+  --constraint 'node.platform.os == windows' \`
+  --mount type=npipe,src=\\\\.\\pipe\\docker_engine,dst=\\\\.\\pipe\\docker_engine \`
+  --mount type=bind,src=C:\\ProgramData\\docker\\volumes,dst=C:\\ProgramData\\docker\\volumes \`
+  --mount type=volume,src=portainer_agent_data,dst=C:\\data \`
+  portainer/agent:2.19.0
+"
+`;
+
+exports[`'buildWindowsSwarmCommand' > should generate command with self-signed certificates allowed 1`] = `
+"docker network create \`
+  --driver overlay \`
+  portainer_agent_network;
+
+docker service create \`
+  --name portainer_edge_agent \`
+  --network portainer_agent_network \`
+  -e EDGE=1 \`
+  -e EDGE_ID=test-edge-id \`
+  -e EDGE_KEY=test-edge-key \`
+  -e EDGE_INSECURE_POLL=1 \`
+  -e AGENT_SECRET=test-secret \`
+  -e AGENT_CLUSTER_ADDR=tasks.portainer_edge_agent \`
+  --mode global \`
+  --constraint 'node.platform.os == windows' \`
+  --mount type=npipe,src=\\\\.\\pipe\\docker_engine,dst=\\\\.\\pipe\\docker_engine \`
+  --mount type=bind,src=C:\\ProgramData\\docker\\volumes,dst=C:\\ProgramData\\docker\\volumes \`
+  --mount type=volume,src=portainer_agent_data,dst=C:\\data \`
+  portainer/agent:2.19.0
+"
+`;
+
+exports[`'buildWindowsSwarmCommand' > should generate command with tags 1`] = `
+"docker network create \`
+  --driver overlay \`
+  portainer_agent_network;
+
+docker service create \`
+  --name portainer_edge_agent \`
+  --network portainer_agent_network \`
+  -e EDGE=1 \`
+  -e EDGE_ID=test-edge-id \`
+  -e EDGE_KEY=test-edge-key \`
+  -e EDGE_INSECURE_POLL=0 \`
+  -e AGENT_SECRET=test-secret \`
+  -e AGENT_CLUSTER_ADDR=tasks.portainer_edge_agent \`
+  -e PORTAINER_TAGS=10:20:30 \`
+  --mode global \`
+  --constraint 'node.platform.os == windows' \`
+  --mount type=npipe,src=\\\\.\\pipe\\docker_engine,dst=\\\\.\\pipe\\docker_engine \`
+  --mount type=bind,src=C:\\ProgramData\\docker\\volumes,dst=C:\\ProgramData\\docker\\volumes \`
+  --mount type=volume,src=portainer_agent_data,dst=C:\\data \`
+  portainer/agent:2.19.0
+"
+`;
+
+exports[`'buildWindowsSwarmCommand' > should generate command without agent secret 1`] = `
+"docker network create \`
+  --driver overlay \`
+  portainer_agent_network;
+
+docker service create \`
+  --name portainer_edge_agent \`
+  --network portainer_agent_network \`
+  -e EDGE=1 \`
+  -e EDGE_ID=test-edge-id \`
+  -e EDGE_KEY=test-edge-key \`
+  -e EDGE_INSECURE_POLL=0 \`
+  -e AGENT_CLUSTER_ADDR=tasks.portainer_edge_agent \`
+  --mode global \`
+  --constraint 'node.platform.os == windows' \`
+  --mount type=npipe,src=\\\\.\\pipe\\docker_engine,dst=\\\\.\\pipe\\docker_engine \`
+  --mount type=bind,src=C:\\ProgramData\\docker\\volumes,dst=C:\\ProgramData\\docker\\volumes \`
+  --mount type=volume,src=portainer_agent_data,dst=C:\\data \`
+  portainer/agent:2.19.0
+"
+`;
diff --git a/app/react/edge/components/EdgeScriptForm/index.ts b/app/react/edge/components/EdgeScriptForm/index.ts
new file mode 100644
index 0000000..f76d93c
--- /dev/null
+++ b/app/react/edge/components/EdgeScriptForm/index.ts
@@ -0,0 +1 @@
+export { EdgeScriptForm } from './EdgeScriptForm';
diff --git a/app/react/edge/components/EdgeScriptForm/scripts.test.ts b/app/react/edge/components/EdgeScriptForm/scripts.test.ts
new file mode 100644
index 0000000..cd40c07
--- /dev/null
+++ b/app/react/edge/components/EdgeScriptForm/scripts.test.ts
@@ -0,0 +1,318 @@
+import {
+  buildLinuxPodmanCommand,
+  buildLinuxStandaloneCommand,
+  buildLinuxSwarmCommand,
+  buildLinuxKubernetesCommand,
+  buildWindowsStandaloneCommand,
+  buildWindowsSwarmCommand,
+} from './scripts';
+import { ScriptFormValues } from './types';
+
+it('buildLinuxPodmanCommand should include PODMAN=1', () => {
+  const command = buildLinuxPodmanCommand(
+    '2.19.0',
+    'test-edge-key',
+    {
+      allowSelfSignedCertificates: false,
+      authEnabled: false,
+      edgeGroupsIds: [],
+      edgeIdGenerator: '',
+      envVars: '',
+      group: 0,
+      os: 'linux',
+      platform: 'podman',
+      tagsIds: [],
+      tlsEnabled: false,
+    },
+    false,
+    'test-edge-id',
+    'test-secret'
+  );
+
+  expect(command).toContain('PODMAN=1');
+});
+
+describe.each([
+  {
+    name: 'buildLinuxStandaloneCommand',
+    builder: buildLinuxStandaloneCommand,
+    defaultProperties: {
+      allowSelfSignedCertificates: false,
+      authEnabled: false,
+      edgeGroupsIds: [],
+      edgeIdGenerator: '',
+      envVars: '',
+      group: 0,
+      os: 'linux' as const,
+      platform: 'standalone' as const,
+      tagsIds: [],
+      tlsEnabled: false,
+    },
+    edgeIdGeneratorValue: 'uuidgen',
+  },
+  {
+    name: 'buildLinuxPodmanCommand',
+    builder: buildLinuxPodmanCommand,
+    defaultProperties: {
+      allowSelfSignedCertificates: false,
+      authEnabled: false,
+      edgeGroupsIds: [],
+      edgeIdGenerator: '',
+      envVars: '',
+      group: 0,
+      os: 'linux' as const,
+      platform: 'podman' as const,
+      tagsIds: [],
+      tlsEnabled: false,
+    },
+    edgeIdGeneratorValue: 'uuidgen',
+  },
+  {
+    name: 'buildLinuxSwarmCommand',
+    builder: buildLinuxSwarmCommand,
+    defaultProperties: {
+      allowSelfSignedCertificates: false,
+      authEnabled: false,
+      edgeGroupsIds: [],
+      edgeIdGenerator: '',
+      envVars: '',
+      group: 0,
+      os: 'linux' as const,
+      platform: 'swarm' as const,
+      tagsIds: [],
+      tlsEnabled: false,
+    },
+    edgeIdGeneratorValue: 'uuidgen',
+  },
+  {
+    name: 'buildLinuxKubernetesCommand',
+    builder: buildLinuxKubernetesCommand,
+    defaultProperties: {
+      allowSelfSignedCertificates: false,
+      authEnabled: false,
+      edgeGroupsIds: [],
+      edgeIdGenerator: '',
+      envVars: '',
+      group: 0,
+      os: 'linux' as const,
+      platform: 'k8s' as const,
+      tagsIds: [],
+      tlsEnabled: false,
+    },
+    edgeIdGeneratorValue: 'uuidgen',
+  },
+  {
+    name: 'buildWindowsStandaloneCommand',
+    builder: buildWindowsStandaloneCommand,
+    defaultProperties: {
+      allowSelfSignedCertificates: false,
+      authEnabled: false,
+      edgeGroupsIds: [],
+      edgeIdGenerator: '',
+      envVars: '',
+      group: 0,
+      os: 'win' as const,
+      platform: 'standalone' as const,
+      tagsIds: [],
+      tlsEnabled: false,
+    },
+    edgeIdGeneratorValue: 'Get-MachineGUID',
+  },
+  {
+    name: 'buildWindowsSwarmCommand',
+    builder: buildWindowsSwarmCommand,
+    defaultProperties: {
+      allowSelfSignedCertificates: false,
+      authEnabled: false,
+      edgeGroupsIds: [],
+      edgeIdGenerator: '',
+      envVars: '',
+      group: 0,
+      os: 'win' as const,
+      platform: 'swarm' as const,
+      tagsIds: [],
+      tlsEnabled: false,
+    },
+    edgeIdGeneratorValue: 'Get-MachineGUID',
+  },
+])('$name', ({ builder, defaultProperties, edgeIdGeneratorValue }) => {
+  it('should generate basic command with minimal configuration', () => {
+    const command = builder(
+      '2.19.0',
+      'test-edge-key',
+      defaultProperties,
+      false,
+      'test-edge-id',
+      'test-secret'
+    );
+
+    expect(command).toMatchSnapshot();
+  });
+
+  it('should generate command with async mode enabled', () => {
+    const command = builder(
+      '2.19.0',
+      'test-edge-key',
+      defaultProperties,
+      true,
+      'test-edge-id',
+      'test-secret'
+    );
+
+    expect(command).toMatchSnapshot();
+  });
+
+  it('should generate command with self-signed certificates allowed', () => {
+    const properties: ScriptFormValues = {
+      ...defaultProperties,
+      allowSelfSignedCertificates: true,
+    };
+
+    const command = builder(
+      '2.19.0',
+      'test-edge-key',
+      properties,
+      false,
+      'test-edge-id',
+      'test-secret'
+    );
+
+    expect(command).toMatchSnapshot();
+  });
+
+  it('should generate command with edge ID generator', () => {
+    const properties: ScriptFormValues = {
+      ...defaultProperties,
+      edgeIdGenerator: edgeIdGeneratorValue,
+    };
+
+    const command = builder(
+      '2.19.0',
+      'test-edge-key',
+      properties,
+      false,
+      undefined,
+      'test-secret'
+    );
+
+    expect(command).toMatchSnapshot();
+  });
+
+  it('should generate command with custom environment variables', () => {
+    const properties: ScriptFormValues = {
+      ...defaultProperties,
+      envVars: 'MY_VAR=value1,ANOTHER_VAR=value2',
+    };
+
+    const command = builder(
+      '2.19.0',
+      'test-edge-key',
+      properties,
+      false,
+      'test-edge-id',
+      'test-secret'
+    );
+
+    expect(command).toMatchSnapshot();
+  });
+
+  it('should generate command with edge groups', () => {
+    const properties: ScriptFormValues = {
+      ...defaultProperties,
+      edgeGroupsIds: [1, 2, 3],
+    };
+
+    const command = builder(
+      '2.19.0',
+      'test-edge-key',
+      properties,
+      false,
+      'test-edge-id',
+      'test-secret'
+    );
+
+    expect(command).toMatchSnapshot();
+  });
+
+  it('should generate command with portainer group', () => {
+    const properties: ScriptFormValues = {
+      ...defaultProperties,
+      group: 5,
+    };
+
+    const command = builder(
+      '2.19.0',
+      'test-edge-key',
+      properties,
+      false,
+      'test-edge-id',
+      'test-secret'
+    );
+
+    expect(command).toMatchSnapshot();
+  });
+
+  it('should generate command with tags', () => {
+    const properties: ScriptFormValues = {
+      ...defaultProperties,
+      tagsIds: [10, 20, 30],
+    };
+
+    const command = builder(
+      '2.19.0',
+      'test-edge-key',
+      properties,
+      false,
+      'test-edge-id',
+      'test-secret'
+    );
+
+    expect(command).toMatchSnapshot();
+  });
+
+  it('should generate command with all meta variables', () => {
+    const properties: ScriptFormValues = {
+      ...defaultProperties,
+      edgeGroupsIds: [1, 2],
+      group: 5,
+      tagsIds: [10, 20],
+    };
+
+    const command = builder(
+      '2.19.0',
+      'test-edge-key',
+      properties,
+      false,
+      'test-edge-id',
+      'test-secret'
+    );
+
+    expect(command).toMatchSnapshot();
+  });
+
+  it('should generate command without agent secret', () => {
+    const command = builder(
+      '2.19.0',
+      'test-edge-key',
+      defaultProperties,
+      false,
+      'test-edge-id',
+      undefined
+    );
+
+    expect(command).toMatchSnapshot();
+  });
+
+  it('should generate command with empty agent secret', () => {
+    const command = builder(
+      '2.19.0',
+      'test-edge-key',
+      defaultProperties,
+      false,
+      'test-edge-id',
+      ''
+    );
+
+    expect(command).toMatchSnapshot();
+  });
+});
diff --git a/app/react/edge/components/EdgeScriptForm/scripts.ts b/app/react/edge/components/EdgeScriptForm/scripts.ts
new file mode 100644
index 0000000..a1d8591
--- /dev/null
+++ b/app/react/edge/components/EdgeScriptForm/scripts.ts
@@ -0,0 +1,332 @@
+import _ from 'lodash';
+
+import { getAgentShortVersion } from '@/portainer/views/endpoints/helpers';
+
+import { ScriptFormValues, Platform } from './types';
+
+type CommandGenerator = (
+  agentVersion: string,
+  edgeKey: string,
+  properties: ScriptFormValues,
+  useAsyncMode: boolean,
+  edgeId?: string,
+  agentSecret?: string
+) => string;
+
+export type CommandTab = {
+  id: Platform;
+  label: string;
+  command: CommandGenerator;
+};
+
+export const commandsTabs: Record<string, CommandTab> = {
+  k8sLinux: {
+    id: 'k8s',
+    label: 'Kubernetes',
+    command: buildLinuxKubernetesCommand,
+  },
+  swarmLinux: {
+    id: 'swarm',
+    label: 'Docker Swarm',
+    command: buildLinuxSwarmCommand,
+  },
+  standaloneLinux: {
+    id: 'standalone',
+    label: 'Docker Standalone',
+    command: buildLinuxStandaloneCommand,
+  },
+  podmanLinux: {
+    id: 'podman',
+    label: 'Podman',
+    command: buildLinuxPodmanCommand,
+  },
+  swarmWindows: {
+    id: 'swarm',
+    label: 'Docker Swarm',
+    command: buildWindowsSwarmCommand,
+  },
+  standaloneWindow: {
+    id: 'standalone',
+    label: 'Docker Standalone',
+    command: buildWindowsStandaloneCommand,
+  },
+} as const;
+
+export function buildLinuxStandaloneCommand(
+  agentVersion: string,
+  edgeKey: string,
+  properties: ScriptFormValues,
+  useAsyncMode: boolean,
+  edgeId?: string,
+  agentSecret?: string
+) {
+  const { allowSelfSignedCertificates, edgeIdGenerator, envVars } = properties;
+
+  const env = buildDockerEnvVars(envVars, [
+    ...buildDefaultDockerEnvVars(
+      edgeKey,
+      allowSelfSignedCertificates,
+      !edgeIdGenerator ? edgeId : undefined,
+      agentSecret,
+      useAsyncMode
+    ),
+    ...metaEnvVars(properties),
+  ]);
+
+  return `${
+    edgeIdGenerator ? `PORTAINER_EDGE_ID=$(${edgeIdGenerator}) \n\n` : ''
+  }\
+docker run -d \\
+  -v /var/run/docker.sock:/var/run/docker.sock \\
+  -v /var/lib/docker/volumes:/var/lib/docker/volumes \\
+  -v /:/host \\
+  -v portainer_agent_data:/data \\
+  --restart always \\
+  ${env} \\
+  --name portainer_edge_agent \\
+  portainer/agent:${agentVersion}
+  `;
+}
+
+export function buildLinuxPodmanCommand(
+  agentVersion: string,
+  edgeKey: string,
+  properties: ScriptFormValues,
+  useAsyncMode: boolean,
+  edgeId?: string,
+  agentSecret?: string
+) {
+  const { allowSelfSignedCertificates, edgeIdGenerator, envVars } = properties;
+
+  const env = buildDockerEnvVars(envVars, [
+    ...buildDefaultDockerEnvVars(
+      edgeKey,
+      allowSelfSignedCertificates,
+      !edgeIdGenerator ? edgeId : undefined,
+      agentSecret,
+      useAsyncMode
+    ),
+    'PODMAN=1',
+    ...metaEnvVars(properties),
+  ]);
+
+  return `${
+    edgeIdGenerator ? `PORTAINER_EDGE_ID=$(${edgeIdGenerator}) \n\n` : ''
+  }\
+sudo podman volume create portainer_agent_data
+
+sudo podman run -d \\
+  -v /run/podman/podman.sock:/var/run/docker.sock \\
+  -v /var/lib/containers/storage/volumes:/var/lib/docker/volumes \\
+  -v /:/host \\
+  -v portainer_agent_data:/data \\
+  --restart always \\
+  --privileged \\
+  ${env} \\
+  --name portainer_edge_agent \\
+  docker.io/portainer/agent:${agentVersion}
+  `;
+}
+
+export function buildWindowsStandaloneCommand(
+  agentVersion: string,
+  edgeKey: string,
+  properties: ScriptFormValues,
+  useAsyncMode: boolean,
+  edgeId?: string,
+  agentSecret?: string
+) {
+  const { allowSelfSignedCertificates, edgeIdGenerator, envVars } = properties;
+
+  const env = buildDockerEnvVars(
+    envVars,
+    [
+      ...buildDefaultDockerEnvVars(
+        edgeKey,
+        allowSelfSignedCertificates,
+        edgeIdGenerator ? '$Env:PORTAINER_EDGE_ID' : edgeId,
+        agentSecret,
+        useAsyncMode
+      ),
+      ...metaEnvVars(properties),
+    ],
+    '`'
+  );
+
+  return `${
+    edgeIdGenerator
+      ? `$Env:PORTAINER_EDGE_ID = "@(${edgeIdGenerator})" \n\n`
+      : ''
+  }\
+docker run -d \`
+  --mount type=npipe,src=\\\\.\\pipe\\docker_engine,dst=\\\\.\\pipe\\docker_engine \`
+  --mount type=bind,src=C:\\ProgramData\\docker\\volumes,dst=C:\\ProgramData\\docker\\volumes \`
+  --mount type=volume,src=portainer_agent_data,dst=C:\\data \`
+  --restart always \`
+   ${env} \`
+  --name portainer_edge_agent \`
+  portainer/agent:${agentVersion}
+  `;
+}
+
+export function buildLinuxSwarmCommand(
+  agentVersion: string,
+  edgeKey: string,
+  properties: ScriptFormValues,
+  useAsyncMode: boolean,
+  edgeId?: string,
+  agentSecret?: string
+) {
+  const { allowSelfSignedCertificates, edgeIdGenerator, envVars } = properties;
+
+  const env = buildDockerEnvVars(envVars, [
+    ...buildDefaultDockerEnvVars(
+      edgeKey,
+      allowSelfSignedCertificates,
+      !edgeIdGenerator ? edgeId : undefined,
+      agentSecret,
+      useAsyncMode
+    ),
+    'AGENT_CLUSTER_ADDR=tasks.portainer_edge_agent',
+    ...metaEnvVars(properties),
+  ]);
+
+  return `${
+    edgeIdGenerator ? `PORTAINER_EDGE_ID=$(${edgeIdGenerator}) \n\n` : ''
+  }\
+docker network create \\
+  --driver overlay \\
+  portainer_agent_network;
+
+docker service create \\
+  --name portainer_edge_agent \\
+  --network portainer_agent_network \\
+  ${env} \\
+  --mode global \\
+  --constraint 'node.platform.os == linux' \\
+  --mount type=bind,src=//var/run/docker.sock,dst=/var/run/docker.sock \\
+  --mount type=bind,src=//var/lib/docker/volumes,dst=/var/lib/docker/volumes \\
+  --mount type=bind,src=//,dst=/host \\
+  --mount type=volume,src=portainer_agent_data,dst=/data \\
+  portainer/agent:${agentVersion}
+`;
+}
+
+export function buildWindowsSwarmCommand(
+  agentVersion: string,
+  edgeKey: string,
+  properties: ScriptFormValues,
+  useAsyncMode: boolean,
+  edgeId?: string,
+  agentSecret?: string
+) {
+  const { allowSelfSignedCertificates, edgeIdGenerator, envVars } = properties;
+
+  const env = buildDockerEnvVars(
+    envVars,
+    [
+      ...buildDefaultDockerEnvVars(
+        edgeKey,
+        allowSelfSignedCertificates,
+        edgeIdGenerator ? '$Env:PORTAINER_EDGE_ID' : edgeId,
+        agentSecret,
+        useAsyncMode
+      ),
+      'AGENT_CLUSTER_ADDR=tasks.portainer_edge_agent',
+      ...metaEnvVars(properties),
+    ],
+    '`'
+  );
+
+  return `${
+    edgeIdGenerator
+      ? `$Env:PORTAINER_EDGE_ID = "@(${edgeIdGenerator})" \n\n`
+      : ''
+  }\
+docker network create \`
+  --driver overlay \`
+  portainer_agent_network;
+
+docker service create \`
+  --name portainer_edge_agent \`
+  --network portainer_agent_network \`
+  ${env} \`
+  --mode global \`
+  --constraint 'node.platform.os == windows' \`
+  --mount type=npipe,src=\\\\.\\pipe\\docker_engine,dst=\\\\.\\pipe\\docker_engine \`
+  --mount type=bind,src=C:\\ProgramData\\docker\\volumes,dst=C:\\ProgramData\\docker\\volumes \`
+  --mount type=volume,src=portainer_agent_data,dst=C:\\data \`
+  portainer/agent:${agentVersion}
+`;
+}
+
+export function buildLinuxKubernetesCommand(
+  agentVersion: string,
+  edgeKey: string,
+  properties: ScriptFormValues,
+  useAsyncMode: boolean,
+  edgeId?: string,
+  agentSecret?: string
+) {
+  const { allowSelfSignedCertificates, edgeIdGenerator, envVars } = properties;
+
+  const agentShortVersion = getAgentShortVersion(agentVersion);
+  const allEnvVars = buildEnvVars(
+    envVars,
+    _.compact([useAsyncMode && 'EDGE_ASYNC=1', ...metaEnvVars(properties)])
+  );
+
+  const idEnvVar = edgeIdGenerator
+    ? `PORTAINER_EDGE_ID=$(${edgeIdGenerator}) \n\n`
+    : '';
+  const edgeIdVar = !edgeIdGenerator && edgeId ? edgeId : '$PORTAINER_EDGE_ID';
+  const selfSigned = allowSelfSignedCertificates ? '1' : '0';
+
+  return `${idEnvVar}curl https://downloads.portainer.io/ee${agentShortVersion}/portainer-edge-agent-setup.sh | bash -s -- "${edgeIdVar}" "${edgeKey}" "${selfSigned}" "${agentSecret}" "${allEnvVars}"`;
+}
+
+function buildDockerEnvVars(
+  envVars: string,
+  moreVars: string[],
+  lineContinuationToken = '\\'
+) {
+  const vars = moreVars.concat(envVars.split(',').filter((s) => s.length > 0));
+
+  return vars.map((s) => `-e ${s}`).join(` ${lineContinuationToken}\n  `);
+}
+
+function buildDefaultDockerEnvVars(
+  edgeKey: string,
+  allowSelfSignedCerts: boolean,
+  edgeId = '$PORTAINER_EDGE_ID',
+  agentSecret = '',
+  useAsyncMode = false
+) {
+  return _.compact([
+    'EDGE=1',
+    `EDGE_ID=${edgeId}`,
+    `EDGE_KEY=${edgeKey}`,
+    `EDGE_INSECURE_POLL=${allowSelfSignedCerts ? 1 : 0}`,
+    agentSecret ? `AGENT_SECRET=${agentSecret}` : ``,
+    useAsyncMode ? 'EDGE_ASYNC=1' : '',
+  ]);
+}
+
+const ENV_VAR_SEPARATOR = ',';
+const VAR_LIST_SEPARATOR = ':';
+function buildEnvVars(envVars: string, moreVars: string[]) {
+  return _.compact([envVars.trim(), ...moreVars]).join(ENV_VAR_SEPARATOR);
+}
+
+function metaEnvVars({
+  edgeGroupsIds,
+  group,
+  tagsIds,
+}: Pick<ScriptFormValues, 'edgeGroupsIds' | 'tagsIds' | 'group'>) {
+  return _.compact([
+    edgeGroupsIds.length &&
+      `EDGE_GROUPS=${edgeGroupsIds.join(VAR_LIST_SEPARATOR)}`,
+    group && `PORTAINER_GROUP=${group}`,
+    tagsIds.length && `PORTAINER_TAGS=${tagsIds.join(VAR_LIST_SEPARATOR)}`,
+  ]);
+}
diff --git a/app/react/edge/components/EdgeScriptForm/types.ts b/app/react/edge/components/EdgeScriptForm/types.ts
new file mode 100644
index 0000000..047d7b0
--- /dev/null
+++ b/app/react/edge/components/EdgeScriptForm/types.ts
@@ -0,0 +1,29 @@
+import { TagId } from '@/portainer/tags/types';
+import { EnvironmentGroupId } from '@/react/portainer/environments/types';
+
+import { EdgeGroup } from '../../edge-groups/types';
+
+export type Platform = 'standalone' | 'swarm' | 'podman' | 'k8s' | 'kubesolo';
+export type OS = 'win' | 'linux';
+
+export interface ScriptFormValues {
+  authEnabled: boolean;
+  tlsEnabled: boolean;
+
+  allowSelfSignedCertificates: boolean;
+  envVars: string;
+
+  os: OS;
+  platform: Platform;
+
+  edgeIdGenerator: string;
+
+  group: EnvironmentGroupId;
+  edgeGroupsIds: Array<EdgeGroup['Id']>;
+  tagsIds: Array<TagId>;
+}
+
+export interface EdgeInfo {
+  id?: string;
+  key: string;
+}
diff --git a/app/react/edge/components/associationTableColumnHelper.tsx b/app/react/edge/components/associationTableColumnHelper.tsx
new file mode 100644
index 0000000..33200ae
--- /dev/null
+++ b/app/react/edge/components/associationTableColumnHelper.tsx
@@ -0,0 +1,36 @@
+import { createColumnHelper } from '@tanstack/react-table';
+import { truncate } from 'lodash';
+
+import { Environment } from '@/react/portainer/environments/types';
+
+export type DecoratedEnvironment = Environment & {
+  Tags: string[];
+  Group: string;
+};
+
+const columHelper = createColumnHelper<DecoratedEnvironment>();
+
+export const columns = [
+  columHelper.accessor('Name', {
+    header: 'Name',
+    id: 'Name',
+    cell: ({ getValue }) => (
+      <span title={getValue()}>{truncate(getValue(), { length: 64 })}</span>
+    ),
+  }),
+  columHelper.accessor('Group', {
+    header: 'Group',
+    id: 'Group',
+    cell: ({ getValue }) => (
+      <span title={getValue()}>{truncate(getValue(), { length: 64 })}</span>
+    ),
+  }),
+  columHelper.accessor((row) => row.Tags.join(','), {
+    header: 'Tags',
+    id: 'tags',
+    enableSorting: false,
+    cell: ({ getValue }) => (
+      <span title={getValue()}>{truncate(getValue(), { length: 64 })}</span>
+    ),
+  }),
+];
diff --git a/app/react/edge/components/edge-agent-async.svg b/app/react/edge/components/edge-agent-async.svg
new file mode 100644
index 0000000..5ac438b
--- /dev/null
+++ b/app/react/edge/components/edge-agent-async.svg
@@ -0,0 +1,10 @@
+<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0_566_495341)">
+<path fill-rule="evenodd" clip-rule="evenodd" d="M17.8878 1.14478C17.8878 1.02052 17.9886 0.919784 18.1128 0.919784L21.1025 0.919784L20.6034 0.420659C20.5155 0.332791 20.5155 0.190329 20.6034 0.102461C20.6913 0.0145931 20.8337 0.0145931 20.9216 0.102461L21.8048 0.985685C21.847 1.02788 21.8707 1.08511 21.8707 1.14478C21.8707 1.20446 21.847 1.26169 21.8048 1.30388L20.9216 2.18711C20.8337 2.27498 20.6913 2.27498 20.6034 2.18711C20.5155 2.09924 20.5155 1.95678 20.6034 1.86891L21.1025 1.36978L18.1128 1.36978C17.9886 1.36978 17.8878 1.26905 17.8878 1.14478ZM21.8719 3.75998C21.8719 3.88424 21.7712 3.98498 21.6469 3.98498L18.6572 3.98498L19.1563 4.48411C19.2442 4.57197 19.2442 4.71444 19.1563 4.8023C19.0684 4.89017 18.926 4.89017 18.8381 4.8023L17.9549 3.91908C17.9127 3.87688 17.889 3.81965 17.889 3.75998C17.889 3.70031 17.9127 3.64308 17.9549 3.60088L18.8381 2.71766C18.926 2.62979 19.0684 2.62979 19.1563 2.71766C19.2442 2.80552 19.2442 2.94799 19.1563 3.03585L18.6572 3.53498L21.6469 3.53498C21.7712 3.53498 21.8719 3.63572 21.8719 3.75998ZM12.0029 2.5332C9.42495 2.5332 7.25537 4.27581 6.60571 6.64735C4.65797 7.09904 3.20686 8.84425 3.20686 10.9291C3.20686 13.3567 5.17475 15.3245 7.60226 15.3245H7.96694V19.0776C7.96694 19.2239 7.84831 19.3426 7.70198 19.3426H6.09254C5.90054 18.3678 5.0412 17.6326 4.01015 17.6326C2.83795 17.6326 1.8877 18.5829 1.8877 19.7551C1.8877 20.9273 2.83795 21.8775 4.01015 21.8775C4.95661 21.8775 5.75837 21.258 6.03208 20.4024H7.70198C8.43366 20.4024 9.02681 19.8093 9.02681 19.0776V15.3245H11.4749V19.8209C10.5573 20.055 9.87878 20.887 9.87878 21.8776C9.87878 23.0498 10.829 24 12.0012 24C13.1734 24 14.1237 23.0498 14.1237 21.8776C14.1237 20.8897 13.4487 20.0594 12.5348 19.8228V15.3245H14.9261V19.0776C14.9261 19.8093 15.5193 20.4024 16.251 20.4024H17.9681C18.2418 21.258 19.0436 21.8775 19.99 21.8775C21.1622 21.8775 22.1125 20.9273 22.1125 19.7551C22.1125 18.5829 21.1622 17.6326 19.99 17.6326C18.959 17.6326 18.0997 18.3678 17.9077 19.3426H16.251C16.1046 19.3426 15.986 19.2239 15.986 19.0776V15.3245H16.4035C18.831 15.3245 20.7989 13.3567 20.7989 10.9291C20.7989 8.84425 19.3478 7.09904 17.4 6.64736C16.7504 4.27582 14.5808 2.5332 12.0029 2.5332ZM8.05038 7.4731C8.36278 5.57283 10.0143 4.123 12.0029 4.123C13.9915 4.123 15.643 5.57283 15.9554 7.4731C16.014 7.83001 16.3063 8.10231 16.6664 8.13566C18.0922 8.26771 19.2091 9.46846 19.2091 10.9291C19.2091 12.4786 17.953 13.7347 16.4035 13.7347H7.60226C6.05278 13.7347 4.79667 12.4786 4.79667 10.9291C4.79667 9.46846 5.91353 8.26771 7.33932 8.13566C7.69948 8.10231 7.99171 7.83001 8.05038 7.4731ZM12.002 8.28697C11.0562 8.28697 10.1435 8.63556 9.43858 9.2661C9.30224 9.38805 9.09285 9.37638 8.9709 9.24004C8.84896 9.1037 8.86062 8.89431 8.99697 8.77237C9.82338 8.0332 10.8932 7.62455 12.002 7.62455C13.1108 7.62455 14.1806 8.0332 15.007 8.77237C15.1434 8.89431 15.155 9.1037 15.0331 9.24004C14.9111 9.37638 14.7018 9.38805 14.5654 9.2661C13.8605 8.63556 12.9478 8.28697 12.002 8.28697ZM12.002 9.71836C11.3599 9.71836 10.7434 9.97011 10.2849 10.4196C10.1543 10.5476 9.94456 10.5455 9.81651 10.4149C9.68847 10.2843 9.69056 10.0746 9.82119 9.94651C10.4036 9.37568 11.1865 9.05594 12.002 9.05594C12.8175 9.05594 13.6004 9.37568 14.1828 9.94651C14.3134 10.0746 14.3155 10.2843 14.1875 10.4149C14.0594 10.5455 13.8497 10.5476 13.7191 10.4196C13.2606 9.97011 12.6441 9.71836 12.002 9.71836ZM12.002 11.0908C11.7243 11.0908 11.4577 11.1997 11.2594 11.3941C11.1287 11.5221 10.919 11.52 10.791 11.3894C10.6629 11.2587 10.665 11.049 10.7957 10.921C11.1178 10.6052 11.5509 10.4284 12.002 10.4284C12.4531 10.4284 12.8862 10.6052 13.2083 10.921C13.339 11.049 13.3411 11.2587 13.213 11.3894C13.085 11.52 12.8753 11.5221 12.7446 11.3941C12.5463 11.1997 12.2797 11.0908 12.002 11.0908ZM11.6708 12.132C11.6708 11.9491 11.8191 11.8008 12.002 11.8008H12.0048C12.1877 11.8008 12.336 11.9491 12.336 12.132C12.336 12.3149 12.1877 12.4632 12.0048 12.4632H12.002C11.8191 12.4632 11.6708 12.3149 11.6708 12.132ZM4.01015 20.8177C4.597 20.8177 5.07274 20.3419 5.07274 19.7551C5.07274 19.1682 4.597 18.6925 4.01015 18.6925C3.4233 18.6925 2.94756 19.1682 2.94756 19.7551C2.94756 20.3419 3.4233 20.8177 4.01015 20.8177ZM13.0638 21.8776C13.0638 22.4644 12.5881 22.9402 12.0012 22.9402C11.4144 22.9402 10.9386 22.4644 10.9386 21.8776C10.9386 21.2907 11.4144 20.815 12.0012 20.815C12.5881 20.815 13.0638 21.2907 13.0638 21.8776ZM19.99 20.8177C20.5769 20.8177 21.0526 20.3419 21.0526 19.7551C21.0526 19.1682 20.5769 18.6925 19.99 18.6925C19.4032 18.6925 18.9275 19.1682 18.9275 19.7551C18.9275 20.3419 19.4032 20.8177 19.99 20.8177Z" fill="currentColor"/>
+</g>
+<defs>
+<clipPath id="clip0_566_495341">
+<rect width="24" height="24" fill="white"/>
+</clipPath>
+</defs>
+</svg>
diff --git a/app/react/edge/components/edge-agent-standard.svg b/app/react/edge/components/edge-agent-standard.svg
new file mode 100644
index 0000000..adb1bac
--- /dev/null
+++ b/app/react/edge/components/edge-agent-standard.svg
@@ -0,0 +1,10 @@
+<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0_566_495340)">
+<path fill-rule="evenodd" clip-rule="evenodd" d="M6.60571 6.64736C7.25537 4.27582 9.42495 2.5332 12.0029 2.5332C14.5808 2.5332 16.7504 4.27582 17.4 6.64736C19.3478 7.09905 20.7989 8.84425 20.7989 10.9292C20.7989 13.3567 18.831 15.3246 16.4035 15.3246H15.986V19.0776C15.986 19.2239 16.1046 19.3426 16.251 19.3426H17.9077C18.0997 18.3678 18.959 17.6326 19.99 17.6326C21.1622 17.6326 22.1125 18.5829 22.1125 19.7551C22.1125 20.9273 21.1622 21.8775 19.99 21.8775C19.0436 21.8775 18.2418 21.258 17.9681 20.4024H16.251C15.5193 20.4024 14.9261 19.8093 14.9261 19.0776V15.3246H12.5348V19.8228C13.4487 20.0594 14.1237 20.8897 14.1237 21.8776C14.1237 23.0498 13.1734 24 12.0012 24C10.829 24 9.87878 23.0498 9.87878 21.8776C9.87878 20.8871 10.5573 20.055 11.4749 19.8209V15.3246H9.02681V19.0776C9.02681 19.8093 8.43366 20.4024 7.70198 20.4024H6.03208C5.75837 21.258 4.95661 21.8775 4.01015 21.8775C2.83795 21.8775 1.8877 20.9273 1.8877 19.7551C1.8877 18.5829 2.83795 17.6326 4.01015 17.6326C5.0412 17.6326 5.90054 18.3678 6.09254 19.3426H7.70198C7.84831 19.3426 7.96694 19.2239 7.96694 19.0776V15.3246H7.60226C5.17475 15.3246 3.20686 13.3567 3.20686 10.9292C3.20686 8.84426 4.65797 7.09905 6.60571 6.64736ZM12.0029 4.12301C10.0143 4.12301 8.36278 5.57284 8.05038 7.4731C7.99171 7.83001 7.69948 8.10231 7.33932 8.13567C5.91353 8.26772 4.79667 9.46847 4.79667 10.9292C4.79667 12.4786 6.05278 13.7347 7.60226 13.7347H16.4035C17.953 13.7347 19.2091 12.4786 19.2091 10.9292C19.2091 9.46847 18.0922 8.26772 16.6664 8.13567C16.3063 8.10231 16.014 7.83001 15.9554 7.4731C15.643 5.57284 13.9915 4.12301 12.0029 4.12301ZM9.43858 9.26611C10.1435 8.63557 11.0562 8.28697 12.002 8.28697C12.9478 8.28697 13.8605 8.63557 14.5654 9.26611C14.7018 9.38806 14.9111 9.37639 15.0331 9.24005C15.155 9.1037 15.1434 8.89432 15.007 8.77237C14.1806 8.0332 13.1108 7.62455 12.002 7.62455C10.8932 7.62455 9.82338 8.0332 8.99697 8.77237C8.86062 8.89432 8.84896 9.1037 8.9709 9.24005C9.09285 9.37639 9.30224 9.38806 9.43858 9.26611ZM10.2849 10.4196C10.7434 9.97012 11.3599 9.71837 12.002 9.71837C12.6441 9.71837 13.2606 9.97012 13.7191 10.4196C13.8497 10.5476 14.0594 10.5455 14.1875 10.4149C14.3155 10.2843 14.3134 10.0746 14.1828 9.94652C13.6004 9.37569 12.8175 9.05595 12.002 9.05595C11.1865 9.05595 10.4036 9.37569 9.82119 9.94652C9.69056 10.0746 9.68847 10.2843 9.81651 10.4149C9.94456 10.5455 10.1543 10.5476 10.2849 10.4196ZM11.2594 11.3941C11.4577 11.1997 11.7243 11.0908 12.002 11.0908C12.2797 11.0908 12.5463 11.1997 12.7446 11.3941C12.8753 11.5221 13.085 11.52 13.213 11.3894C13.3411 11.2587 13.339 11.049 13.2083 10.921C12.8862 10.6052 12.4531 10.4284 12.002 10.4284C11.5509 10.4284 11.1178 10.6052 10.7957 10.921C10.665 11.049 10.6629 11.2587 10.791 11.3894C10.919 11.52 11.1287 11.5221 11.2594 11.3941ZM12.002 11.8008C11.8191 11.8008 11.6708 11.9491 11.6708 12.132C11.6708 12.3149 11.8191 12.4632 12.002 12.4632H12.0048C12.1877 12.4632 12.336 12.3149 12.336 12.132C12.336 11.9491 12.1877 11.8008 12.0048 11.8008H12.002ZM5.07274 19.7551C5.07274 20.3419 4.597 20.8177 4.01015 20.8177C3.4233 20.8177 2.94756 20.3419 2.94756 19.7551C2.94756 19.1682 3.4233 18.6925 4.01015 18.6925C4.597 18.6925 5.07274 19.1682 5.07274 19.7551ZM12.0012 22.9402C12.5881 22.9402 13.0638 22.4644 13.0638 21.8776C13.0638 21.2907 12.5881 20.815 12.0012 20.815C11.4144 20.815 10.9386 21.2907 10.9386 21.8776C10.9386 22.4644 11.4144 22.9402 12.0012 22.9402ZM21.0526 19.7551C21.0526 20.3419 20.5769 20.8177 19.99 20.8177C19.4032 20.8177 18.9275 20.3419 18.9275 19.7551C18.9275 19.1682 19.4032 18.6925 19.99 18.6925C20.5769 18.6925 21.0526 19.1682 21.0526 19.7551Z" fill="currentColor"/>
+</g>
+<defs>
+<clipPath id="clip0_566_495340">
+<rect width="24" height="24" fill="white"/>
+</clipPath>
+</defs>
+</svg>
diff --git a/app/react/edge/components/useIntervalOptions.ts b/app/react/edge/components/useIntervalOptions.ts
new file mode 100644
index 0000000..8d2a9dc
--- /dev/null
+++ b/app/react/edge/components/useIntervalOptions.ts
@@ -0,0 +1,67 @@
+import _ from 'lodash';
+import { useState, useEffect } from 'react';
+
+import { useSettings } from '@/react/portainer/settings/queries';
+
+type Option = {
+  label: string;
+  value: number;
+};
+
+type DefaultOption = Option & { isDefault: true };
+
+export type Options = [DefaultOption, ...Option[]];
+
+export function useIntervalOptions(
+  fieldName:
+    | 'Edge.PingInterval'
+    | 'Edge.SnapshotInterval'
+    | 'Edge.CommandInterval'
+    | 'EdgeAgentCheckinInterval',
+  initialOptions: Options,
+  isDefaultHidden: boolean
+) {
+  const [{ value: defaultValue }] = initialOptions;
+  const [options, setOptions] = useState<Option[]>(initialOptions);
+
+  const settingsQuery = useSettings(
+    (settings) => _.get(settings, fieldName, 0) as number,
+    !isDefaultHidden
+  );
+
+  useEffect(() => {
+    if (isDefaultHidden) {
+      setOptions(initialOptions.slice(1));
+    }
+
+    if (
+      !isDefaultHidden &&
+      typeof settingsQuery.data !== 'undefined' &&
+      settingsQuery.data !== defaultValue
+    ) {
+      setOptions((options) => {
+        let label = `${settingsQuery.data} seconds`;
+        const option = options.find((o) => o.value === settingsQuery.data);
+        if (option) {
+          label = option.label;
+        }
+
+        return [
+          {
+            value: defaultValue,
+            label: `Use default interval (${label})`,
+          },
+          ...options.slice(1),
+        ];
+      });
+    }
+  }, [
+    settingsQuery.data,
+    setOptions,
+    isDefaultHidden,
+    initialOptions,
+    defaultValue,
+  ]);
+
+  return options;
+}
diff --git a/app/react/edge/edge-devices/WaitingRoomView/Datatable/AssignmentDialog/AssignmentDialog.tsx b/app/react/edge/edge-devices/WaitingRoomView/Datatable/AssignmentDialog/AssignmentDialog.tsx
new file mode 100644
index 0000000..c8dccd5
--- /dev/null
+++ b/app/react/edge/edge-devices/WaitingRoomView/Datatable/AssignmentDialog/AssignmentDialog.tsx
@@ -0,0 +1,185 @@
+import { Form, Formik } from 'formik';
+
+import { addPlural } from '@/portainer/helpers/strings';
+import { useUpdateEnvironmentsRelationsMutation } from '@/react/portainer/environments/queries/useUpdateEnvironmentsRelationsMutation';
+import { notifySuccess } from '@/portainer/services/notifications';
+import { BetaAlert } from '@/react/portainer/environments/update-schedules/common/BetaAlert';
+
+import { Checkbox } from '@@/form-components/Checkbox';
+import { FormControl } from '@@/form-components/FormControl';
+import { OnSubmit, Modal } from '@@/modals';
+import { TextTip } from '@@/Tip/TextTip';
+import { Button, LoadingButton } from '@@/buttons';
+
+import { WaitingRoomEnvironment } from '../../types';
+
+import { GroupSelector, EdgeGroupsSelector, TagSelector } from './Selectors';
+import { FormValues } from './types';
+import { isAssignedToGroup } from './utils';
+import { createPayload } from './createPayload';
+
+export function AssignmentDialog({
+  onSubmit,
+  environments,
+}: {
+  onSubmit: OnSubmit<boolean>;
+  environments: Array<WaitingRoomEnvironment>;
+}) {
+  const assignRelationsMutation = useUpdateEnvironmentsRelationsMutation();
+
+  const initialValues: FormValues = {
+    group: 1,
+    overrideGroup: false,
+    edgeGroups: [],
+    overrideEdgeGroups: false,
+    tags: [],
+    overrideTags: false,
+  };
+
+  const hasPreAssignedEdgeGroups = environments.some(
+    (e) => e.EdgeGroups?.length > 0
+  );
+  const hasPreAssignedTags = environments.some((e) => e.TagIds.length > 0);
+  const hasPreAssignedGroup = environments.some((e) => isAssignedToGroup(e));
+
+  return (
+    <Modal
+      aria-label="Associate and assignment"
+      onDismiss={() => onSubmit()}
+      size="lg"
+    >
+      <Modal.Header
+        title={`Associate with assignment (${addPlural(
+          environments.length,
+          'selected edge environment'
+        )})`}
+      />
+      <Formik onSubmit={handleSubmit} initialValues={initialValues}>
+        {({ values, setFieldValue, errors }) => (
+          <Form noValidate>
+            <Modal.Body>
+              <div>
+                <FormControl
+                  size="vertical"
+                  label="Group"
+                  tooltip="For managing RBAC with user access"
+                  errors={errors.group}
+                >
+                  <GroupSelector />
+
+                  {hasPreAssignedGroup && (
+                    <div className="mt-2">
+                      <Checkbox
+                        label="Override pre-assigned group"
+                        data-cy="override-group-checkbox"
+                        id="overrideGroup"
+                        bold={false}
+                        checked={values.overrideGroup}
+                        onChange={(e) =>
+                          setFieldValue('overrideGroup', e.target.checked)
+                        }
+                      />
+                    </div>
+                  )}
+                </FormControl>
+
+                <FormControl
+                  size="vertical"
+                  label="Edge Groups"
+                  tooltip="Required to manage edge job and edge stack deployments"
+                  errors={errors.edgeGroups}
+                >
+                  <EdgeGroupsSelector />
+
+                  {hasPreAssignedEdgeGroups && (
+                    <div className="mt-2">
+                      <Checkbox
+                        label="Override pre-assigned edge groups"
+                        data-cy="override-edge-groups-checkbox"
+                        bold={false}
+                        id="overrideEdgeGroups"
+                        checked={values.overrideEdgeGroups}
+                        onChange={(e) =>
+                          setFieldValue('overrideEdgeGroups', e.target.checked)
+                        }
+                      />
+                    </div>
+                  )}
+                </FormControl>
+
+                <div className="mb-3">
+                  <TextTip color="blue">
+                    Edge group(s) created here are static only, use tags to
+                    assign to dynamic edge groups
+                  </TextTip>
+                </div>
+
+                <FormControl
+                  size="vertical"
+                  label="Tags"
+                  tooltip="Assigning tags will auto populate environments to dynamic edge groups that these tags are assigned to and any ege jobs or stacks that are deployed to that edge group"
+                  errors={errors.tags}
+                >
+                  <TagSelector />
+
+                  {hasPreAssignedTags && (
+                    <div className="mt-2">
+                      <Checkbox
+                        label="Override pre-assigned tags"
+                        data-cy="override-tags-checkbox"
+                        bold={false}
+                        id="overrideTags"
+                        checked={values.overrideTags}
+                        onChange={(e) =>
+                          setFieldValue('overrideTags', e.target.checked)
+                        }
+                      />
+                    </div>
+                  )}
+                </FormControl>
+              </div>
+            </Modal.Body>
+            <Modal.Footer>
+              <Button
+                onClick={() => onSubmit()}
+                color="default"
+                data-cy="waiting-room-cancel-assignment-button"
+              >
+                Cancel
+              </Button>
+              <LoadingButton
+                isLoading={assignRelationsMutation.isLoading}
+                data-cy="waiting-room-associate-button"
+                loadingText="Associating..."
+              >
+                Associate
+              </LoadingButton>
+            </Modal.Footer>
+            <div className="mt-2">
+              <BetaAlert
+                message={
+                  <>
+                    <b>Beta Feature</b> - This feature is currently in beta,
+                    some functions might not work as expected.
+                  </>
+                }
+              />
+            </div>
+          </Form>
+        )}
+      </Formik>
+    </Modal>
+  );
+
+  function handleSubmit(values: FormValues) {
+    assignRelationsMutation.mutate(
+      Object.fromEntries(environments.map((e) => createPayload(e, values))),
+      {
+        onSuccess: () => {
+          notifySuccess('Success', 'Edge environments assigned successfully');
+          onSubmit(true);
+        },
+      }
+    );
+  }
+}
diff --git a/app/react/edge/edge-devices/WaitingRoomView/Datatable/AssignmentDialog/Selectors/CreatableSelector.tsx b/app/react/edge/edge-devices/WaitingRoomView/Datatable/AssignmentDialog/Selectors/CreatableSelector.tsx
new file mode 100644
index 0000000..ecb3790
--- /dev/null
+++ b/app/react/edge/edge-devices/WaitingRoomView/Datatable/AssignmentDialog/Selectors/CreatableSelector.tsx
@@ -0,0 +1,62 @@
+import { useField } from 'formik';
+import _ from 'lodash';
+
+import { Select } from '@@/form-components/ReactSelect';
+import {
+  Option,
+  Option as OptionType,
+} from '@@/form-components/PortainerSelect';
+
+export function CreatableSelector({
+  name,
+  options,
+  onCreate,
+  isLoading,
+}: {
+  name: string;
+  options: Array<OptionType<number>>;
+  onCreate: (label: string) => Promise<number>;
+  isLoading: boolean;
+}) {
+  const [{ onBlur, value }, , { setValue }] = useField<Array<number>>(name);
+
+  const selectedValues = value.reduce(
+    (acc: Array<OptionType<number>>, cur) =>
+      _.compact([...acc, findOption(cur, options)]),
+    []
+  );
+
+  return (
+    <Select
+      isCreatable
+      options={options}
+      value={
+        isLoading
+          ? [...selectedValues, { label: 'Creating...', value: 0 }]
+          : selectedValues
+      }
+      isMulti
+      onCreateOption={handleCreate}
+      onChange={handleChange}
+      onBlur={onBlur}
+      isLoading={isLoading}
+      isDisabled={isLoading}
+      closeMenuOnSelect={false}
+      data-cy="edge-devices-assignment-selector"
+      id="edge-devices-assignment-selector"
+    />
+  );
+
+  async function handleCreate(label: string) {
+    const id = await onCreate(label);
+    setValue([...value, id]);
+  }
+
+  function handleChange(value: ReadonlyArray<{ value: number }>) {
+    setValue(value.map((v) => v.value));
+  }
+}
+
+function findOption<T>(option: T, options: Array<Option<T>>) {
+  return options.find((t) => t.value === option);
+}
diff --git a/app/react/edge/edge-devices/WaitingRoomView/Datatable/AssignmentDialog/Selectors/EdgeGroupSelector.tsx b/app/react/edge/edge-devices/WaitingRoomView/Datatable/AssignmentDialog/Selectors/EdgeGroupSelector.tsx
new file mode 100644
index 0000000..71a3136
--- /dev/null
+++ b/app/react/edge/edge-devices/WaitingRoomView/Datatable/AssignmentDialog/Selectors/EdgeGroupSelector.tsx
@@ -0,0 +1,41 @@
+import { notifySuccess } from '@/portainer/services/notifications';
+import { useCreateEdgeGroupMutation } from '@/react/edge/edge-groups/queries/useCreateEdgeGroupMutation';
+import { useEdgeGroups } from '@/react/edge/edge-groups/queries/useEdgeGroups';
+
+import { CreatableSelector } from './CreatableSelector';
+
+export function EdgeGroupsSelector() {
+  const createMutation = useCreateEdgeGroupMutation();
+
+  const edgeGroupsQuery = useEdgeGroups({
+    select: (edgeGroups) =>
+      edgeGroups
+        .filter((g) => !g.Dynamic)
+        .map((opt) => ({ label: opt.Name, value: opt.Id })),
+  });
+
+  if (!edgeGroupsQuery.data) {
+    return null;
+  }
+
+  const edgeGroups = edgeGroupsQuery.data;
+
+  return (
+    <CreatableSelector
+      name="edgeGroups"
+      options={edgeGroups}
+      onCreate={handleCreate}
+      isLoading={createMutation.isLoading}
+    />
+  );
+
+  async function handleCreate(newGroup: string) {
+    const group = await createMutation.mutateAsync({
+      name: newGroup,
+      dynamic: false,
+    });
+
+    notifySuccess('Edge group created', `Group ${group.Name} created`);
+    return group.Id;
+  }
+}
diff --git a/app/react/edge/edge-devices/WaitingRoomView/Datatable/AssignmentDialog/Selectors/GroupSelector.tsx b/app/react/edge/edge-devices/WaitingRoomView/Datatable/AssignmentDialog/Selectors/GroupSelector.tsx
new file mode 100644
index 0000000..7988417
--- /dev/null
+++ b/app/react/edge/edge-devices/WaitingRoomView/Datatable/AssignmentDialog/Selectors/GroupSelector.tsx
@@ -0,0 +1,67 @@
+import { useField } from 'formik';
+
+import { useGroups } from '@/react/portainer/environments/environment-groups/queries';
+import { EnvironmentGroupId } from '@/react/portainer/environments/types';
+import { useCreateGroupMutation } from '@/react/portainer/environments/environment-groups/queries/useCreateGroupMutation';
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { Select } from '@@/form-components/ReactSelect';
+
+import { FormValues } from '../types';
+
+export function GroupSelector() {
+  const [{ value, onBlur }, , { setValue }] =
+    useField<FormValues['group']>('group');
+  const createMutation = useCreateGroupMutation();
+
+  const groupsQuery = useGroups({
+    select: (groups) =>
+      groups
+        .filter((g) => g.Id !== 1)
+        .map((opt) => ({ label: opt.Name, value: opt.Id })),
+  });
+
+  if (!groupsQuery.data) {
+    return null;
+  }
+
+  const options = groupsQuery.data;
+  const selectedValue = value ? options.find((g) => g.value === value) : null;
+
+  return (
+    <Select
+      isCreatable
+      options={options}
+      value={
+        createMutation.isLoading
+          ? { label: 'Creating...', value: 0 }
+          : selectedValue
+      }
+      onCreateOption={handleCreate}
+      onChange={handleChange}
+      onBlur={onBlur}
+      isLoading={createMutation.isLoading}
+      isDisabled={createMutation.isLoading}
+      placeholder="Select a group"
+      isClearable
+      data-cy="edge-devices-assignment-selector"
+      id="edge-devices-assignment-selector"
+    />
+  );
+
+  function handleCreate(newGroup: string) {
+    createMutation.mutate(
+      { name: newGroup },
+      {
+        onSuccess: (data) => {
+          setValue(data.Id);
+          notifySuccess('Group created', `Group ${data.Name} created`);
+        },
+      }
+    );
+  }
+
+  function handleChange(value: { value: EnvironmentGroupId } | null) {
+    setValue(value ? value.value : 1);
+  }
+}
diff --git a/app/react/edge/edge-devices/WaitingRoomView/Datatable/AssignmentDialog/Selectors/TagSelector.tsx b/app/react/edge/edge-devices/WaitingRoomView/Datatable/AssignmentDialog/Selectors/TagSelector.tsx
new file mode 100644
index 0000000..d567340
--- /dev/null
+++ b/app/react/edge/edge-devices/WaitingRoomView/Datatable/AssignmentDialog/Selectors/TagSelector.tsx
@@ -0,0 +1,35 @@
+import { notifySuccess } from '@/portainer/services/notifications';
+import { useCreateTagMutation, useTags } from '@/portainer/tags/queries';
+
+import { CreatableSelector } from './CreatableSelector';
+
+export function TagSelector() {
+  const createMutation = useCreateTagMutation();
+
+  const tagsQuery = useTags({
+    select: (tags) => tags.map((opt) => ({ label: opt.Name, value: opt.ID })),
+  });
+
+  if (!tagsQuery.data) {
+    return null;
+  }
+
+  const tags = tagsQuery.data;
+
+  return (
+    <CreatableSelector
+      name="tags"
+      options={tags}
+      onCreate={handleCreate}
+      isLoading={createMutation.isLoading}
+    />
+  );
+
+  async function handleCreate(newTag: string) {
+    const tag = await createMutation.mutateAsync(newTag);
+
+    notifySuccess('Tag created', `Tag ${tag.Name} created`);
+
+    return tag.ID;
+  }
+}
diff --git a/app/react/edge/edge-devices/WaitingRoomView/Datatable/AssignmentDialog/Selectors/index.ts b/app/react/edge/edge-devices/WaitingRoomView/Datatable/AssignmentDialog/Selectors/index.ts
new file mode 100644
index 0000000..5e4f47f
--- /dev/null
+++ b/app/react/edge/edge-devices/WaitingRoomView/Datatable/AssignmentDialog/Selectors/index.ts
@@ -0,0 +1,3 @@
+export { EdgeGroupsSelector } from './EdgeGroupSelector';
+export { GroupSelector } from './GroupSelector';
+export { TagSelector } from './TagSelector';
diff --git a/app/react/edge/edge-devices/WaitingRoomView/Datatable/AssignmentDialog/createPayload.tsx b/app/react/edge/edge-devices/WaitingRoomView/Datatable/AssignmentDialog/createPayload.tsx
new file mode 100644
index 0000000..e5ab097
--- /dev/null
+++ b/app/react/edge/edge-devices/WaitingRoomView/Datatable/AssignmentDialog/createPayload.tsx
@@ -0,0 +1,30 @@
+import { EnvironmentRelationsPayload } from '@/react/portainer/environments/queries/useUpdateEnvironmentsRelationsMutation';
+
+import { WaitingRoomEnvironment } from '../../types';
+
+import { FormValues } from './types';
+import { isAssignedToGroup } from './utils';
+
+export function createPayload(
+  environment: WaitingRoomEnvironment,
+  values: FormValues
+) {
+  const relations: Partial<EnvironmentRelationsPayload> = {};
+
+  if (environment.TagIds.length === 0 || values.overrideTags) {
+    relations.tags = values.tags;
+  }
+
+  if (environment.EdgeGroups.length === 0 || values.overrideEdgeGroups) {
+    relations.edgeGroups = values.edgeGroups;
+  }
+
+  if (
+    (!isAssignedToGroup(environment) || values.overrideGroup) &&
+    values.group
+  ) {
+    relations.group = values.group;
+  }
+
+  return [environment.Id, relations];
+}
diff --git a/app/react/edge/edge-devices/WaitingRoomView/Datatable/AssignmentDialog/types.ts b/app/react/edge/edge-devices/WaitingRoomView/Datatable/AssignmentDialog/types.ts
new file mode 100644
index 0000000..c0fad7e
--- /dev/null
+++ b/app/react/edge/edge-devices/WaitingRoomView/Datatable/AssignmentDialog/types.ts
@@ -0,0 +1,12 @@
+import { TagId } from '@/portainer/tags/types';
+import { EdgeGroup } from '@/react/edge/edge-groups/types';
+import { EnvironmentGroupId } from '@/react/portainer/environments/types';
+
+export interface FormValues {
+  group: EnvironmentGroupId | null;
+  overrideGroup: boolean;
+  edgeGroups: Array<EdgeGroup['Id']>;
+  overrideEdgeGroups: boolean;
+  tags: Array<TagId>;
+  overrideTags: boolean;
+}
diff --git a/app/react/edge/edge-devices/WaitingRoomView/Datatable/AssignmentDialog/utils.ts b/app/react/edge/edge-devices/WaitingRoomView/Datatable/AssignmentDialog/utils.ts
new file mode 100644
index 0000000..b270806
--- /dev/null
+++ b/app/react/edge/edge-devices/WaitingRoomView/Datatable/AssignmentDialog/utils.ts
@@ -0,0 +1,5 @@
+import { Environment } from '@/react/portainer/environments/types';
+
+export function isAssignedToGroup(environment: Environment) {
+  return ![0, 1].includes(environment.GroupId);
+}
diff --git a/app/react/edge/edge-devices/WaitingRoomView/Datatable/Datatable.tsx b/app/react/edge/edge-devices/WaitingRoomView/Datatable/Datatable.tsx
new file mode 100644
index 0000000..ba494a2
--- /dev/null
+++ b/app/react/edge/edge-devices/WaitingRoomView/Datatable/Datatable.tsx
@@ -0,0 +1,51 @@
+import { Box } from 'lucide-react';
+
+import { Datatable as GenericDatatable } from '@@/datatables';
+import { createPersistedStore } from '@@/datatables/types';
+import { useTableState } from '@@/datatables/useTableState';
+
+import { WaitingRoomEnvironment } from '../types';
+
+import { columns } from './columns';
+import { Filter } from './Filter';
+import { TableActions } from './TableActions';
+import { useEnvironments } from './useEnvironments';
+
+const storageKey = 'edge-devices-waiting-room';
+
+const settingsStore = createPersistedStore(storageKey, 'name');
+
+export function Datatable() {
+  const tableState = useTableState(settingsStore, storageKey);
+  const {
+    data: environments,
+    totalCount,
+    isLoading,
+    page,
+    setPage,
+  } = useEnvironments({
+    pageLimit: tableState.pageSize,
+    search: tableState.search,
+    sortBy: tableState.sortBy,
+  });
+
+  return (
+    <GenericDatatable<WaitingRoomEnvironment>
+      settingsManager={tableState}
+      columns={columns}
+      dataset={environments}
+      title="Edge Devices Waiting Room"
+      titleIcon={Box}
+      renderTableActions={(selectedRows) => (
+        <TableActions selectedRows={selectedRows} />
+      )}
+      isLoading={isLoading}
+      isServerSidePagination
+      page={page}
+      onPageChange={setPage}
+      totalCount={totalCount}
+      description={<Filter />}
+      data-cy="edge-devices-waiting-room-datatable"
+    />
+  );
+}
diff --git a/app/react/edge/edge-devices/WaitingRoomView/Datatable/Filter.tsx b/app/react/edge/edge-devices/WaitingRoomView/Datatable/Filter.tsx
new file mode 100644
index 0000000..1d5d894
--- /dev/null
+++ b/app/react/edge/edge-devices/WaitingRoomView/Datatable/Filter.tsx
@@ -0,0 +1,69 @@
+import { HomepageFilter } from '@/react/portainer/HomeView/EnvironmentList/HomepageFilter';
+import { useGroups } from '@/react/portainer/environments/environment-groups/queries';
+import { useEdgeGroups } from '@/react/edge/edge-groups/queries/useEdgeGroups';
+import { useTags } from '@/portainer/tags/queries';
+
+import { PortainerSelect } from '@@/form-components/PortainerSelect';
+
+import { useFilterStore } from './filter-store';
+
+const checkInOptions = [
+  { value: 0, label: 'Show all time' },
+  { value: 60 * 60, label: 'Show past hour' },
+  { value: 60 * 60 * 24, label: 'Show past day' },
+  { value: 60 * 60 * 24 * 7, label: 'Show past week' },
+  { value: 60 * 60 * 24 * 14, label: 'Show past 14 days' },
+];
+
+export function Filter() {
+  const edgeGroupsQuery = useEdgeGroups();
+  const groupsQuery = useGroups();
+  const tagsQuery = useTags();
+
+  const filterStore = useFilterStore();
+
+  if (!edgeGroupsQuery.data || !groupsQuery.data || !tagsQuery.data) {
+    return null;
+  }
+
+  return (
+    <div className="flex w-full gap-5 [&>*]:w-1/5">
+      <HomepageFilter
+        onChange={(f) => filterStore.setEdgeGroups(f)}
+        placeHolder="Edge groups"
+        value={filterStore.edgeGroups}
+        filterOptions={edgeGroupsQuery.data.map((g) => ({
+          label: g.Name,
+          value: g.Id,
+        }))}
+      />
+      <HomepageFilter
+        onChange={(f) => filterStore.setGroups(f)}
+        placeHolder="Group"
+        value={filterStore.groups}
+        filterOptions={groupsQuery.data.map((g) => ({
+          label: g.Name,
+          value: g.Id,
+        }))}
+      />
+      <HomepageFilter
+        onChange={(f) => filterStore.setTags(f)}
+        placeHolder="Tags"
+        value={filterStore.tags}
+        filterOptions={tagsQuery.data.map((g) => ({
+          label: g.Name,
+          value: g.ID,
+        }))}
+      />
+
+      <div className="ml-auto" />
+      <PortainerSelect
+        onChange={(f) => filterStore.setCheckIn(f || 0)}
+        value={filterStore.checkIn}
+        options={checkInOptions}
+        bindToBody
+        data-cy="edge-devices-check-in-filter"
+      />
+    </div>
+  );
+}
diff --git a/app/react/edge/edge-devices/WaitingRoomView/Datatable/TableActions.tsx b/app/react/edge/edge-devices/WaitingRoomView/Datatable/TableActions.tsx
new file mode 100644
index 0000000..7edda70
--- /dev/null
+++ b/app/react/edge/edge-devices/WaitingRoomView/Datatable/TableActions.tsx
@@ -0,0 +1,135 @@
+import { Check, CheckCircle } from 'lucide-react';
+
+import { notifySuccess } from '@/portainer/services/notifications';
+import { useDeleteEnvironmentsMutation } from '@/react/portainer/environments/ListView/useDeleteEnvironmentsMutation';
+import { Environment } from '@/react/portainer/environments/types';
+import { withReactQuery } from '@/react-tools/withReactQuery';
+import { useIsPureAdmin } from '@/react/hooks/useUser';
+
+import { Button } from '@@/buttons';
+import { openModal } from '@@/modals';
+import { TooltipWithChildren } from '@@/Tip/TooltipWithChildren';
+import { DeleteButton } from '@@/buttons/DeleteButton';
+
+import { useAssociateDeviceMutation, useLicenseOverused } from '../queries';
+import { WaitingRoomEnvironment } from '../types';
+
+import { AssignmentDialog } from './AssignmentDialog/AssignmentDialog';
+
+const overusedTooltip = (
+  <>
+    Associating devices is disabled as your node count exceeds your license
+    limit
+  </>
+);
+
+export function TableActions({
+  selectedRows,
+}: {
+  selectedRows: WaitingRoomEnvironment[];
+}) {
+  const isPureAdmin = useIsPureAdmin();
+  const associateMutation = useAssociateDeviceMutation();
+  const removeMutation = useDeleteEnvironmentsMutation();
+  const licenseOverused = useLicenseOverused(selectedRows.length);
+
+  return (
+    <>
+      <DeleteButton
+        onConfirmed={() => handleRemoveDevice(selectedRows)}
+        disabled={selectedRows.length === 0}
+        data-cy="remove-device-button"
+        confirmMessage="You're about to remove edge device(s) from waiting room, which will not be shown until next agent startup."
+      >
+        Remove Device
+      </DeleteButton>
+
+      <TooltipWithChildren
+        message={
+          licenseOverused ? (
+            overusedTooltip
+          ) : (
+            <>
+              Associate device(s) and assigning edge groups, group and tags with
+              overriding options
+            </>
+          )
+        }
+      >
+        <span>
+          <Button
+            onClick={() => handleAssociateAndAssign(selectedRows)}
+            data-cy="associate-and-assign-button"
+            disabled={
+              selectedRows.length === 0 || licenseOverused || !isPureAdmin
+            }
+            color="secondary"
+            icon={CheckCircle}
+          >
+            Associate and assignment
+          </Button>
+        </span>
+      </TooltipWithChildren>
+
+      <TooltipWithChildren
+        message={
+          licenseOverused ? (
+            overusedTooltip
+          ) : (
+            <>
+              Associate device(s) based on their pre-assigned edge groups, group
+              and tags
+            </>
+          )
+        }
+      >
+        <span>
+          <Button
+            onClick={() => handleAssociateDevice(selectedRows)}
+            data-cy="associate-device-button"
+            disabled={selectedRows.length === 0 || licenseOverused}
+            icon={Check}
+          >
+            Associate Device
+          </Button>
+        </span>
+      </TooltipWithChildren>
+    </>
+  );
+
+  async function handleAssociateAndAssign(
+    environments: WaitingRoomEnvironment[]
+  ) {
+    const assigned = await openModal(withReactQuery(AssignmentDialog), {
+      environments,
+    });
+
+    if (!assigned) {
+      return;
+    }
+
+    handleAssociateDevice(environments);
+  }
+
+  function handleAssociateDevice(devices: Environment[]) {
+    associateMutation.mutate(
+      devices.map((d) => d.Id),
+      {
+        onSuccess() {
+          notifySuccess('Success', 'Edge devices associated successfully');
+        },
+      }
+    );
+  }
+
+  async function handleRemoveDevice(devices: Environment[]) {
+    removeMutation.mutate(
+      devices.map((d) => ({ id: d.Id, name: d.Name })),
+      {
+        onSuccess() {
+          notifySuccess('Success', 'Edge devices were hidden successfully');
+        },
+      }
+    );
+  }
+}
diff --git a/app/react/edge/edge-devices/WaitingRoomView/Datatable/columns.ts b/app/react/edge/edge-devices/WaitingRoomView/Datatable/columns.ts
new file mode 100644
index 0000000..f9266c0
--- /dev/null
+++ b/app/react/edge/edge-devices/WaitingRoomView/Datatable/columns.ts
@@ -0,0 +1,42 @@
+import moment from 'moment';
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { WaitingRoomEnvironment } from '../types';
+
+const columnHelper = createColumnHelper<WaitingRoomEnvironment>();
+
+export const columns = [
+  columnHelper.accessor('Name', {
+    header: 'Name',
+    id: 'Name',
+  }),
+  columnHelper.accessor('EdgeID', {
+    header: 'Edge ID',
+    id: 'EdgeID',
+  }),
+  columnHelper.accessor((row) => row.EdgeGroups.join(', '), {
+    header: 'Edge Groups',
+    id: 'edge-groups',
+    enableSorting: false,
+    cell: ({ getValue }) => getValue() || '-',
+  }),
+  columnHelper.accessor((row) => row.Group, {
+    header: 'Group',
+    id: 'Group',
+    cell: ({ getValue }) => getValue() || '-',
+  }),
+  columnHelper.accessor((row) => row.Tags.join(', '), {
+    header: 'Tags',
+    id: 'tags',
+    enableSorting: false,
+    cell: ({ getValue }) => getValue() || '-',
+  }),
+  columnHelper.accessor((row) => row.LastCheckInDate, {
+    header: 'Last Check-in',
+    id: 'LastCheckIn',
+    cell: ({ getValue }) => {
+      const value = getValue();
+      return value ? moment(value * 1000).fromNow() : '-';
+    },
+  }),
+];
diff --git a/app/react/edge/edge-devices/WaitingRoomView/Datatable/filter-store.ts b/app/react/edge/edge-devices/WaitingRoomView/Datatable/filter-store.ts
new file mode 100644
index 0000000..e692f3a
--- /dev/null
+++ b/app/react/edge/edge-devices/WaitingRoomView/Datatable/filter-store.ts
@@ -0,0 +1,41 @@
+import createStore from 'zustand';
+import { persist } from 'zustand/middleware';
+
+import { keyBuilder } from '@/react/hooks/useLocalStorage';
+
+interface TableFiltersStore {
+  groups: number[];
+  setGroups(value: number[]): void;
+  edgeGroups: number[];
+  setEdgeGroups(value: number[]): void;
+  tags: number[];
+  setTags(value: number[]): void;
+  checkIn: number;
+  setCheckIn(value: number): void;
+}
+
+export const useFilterStore = createStore<TableFiltersStore>()(
+  persist(
+    (set) => ({
+      edgeGroups: [],
+      setEdgeGroups(edgeGroups: number[]) {
+        set({ edgeGroups });
+      },
+      groups: [],
+      setGroups(groups: number[]) {
+        set({ groups });
+      },
+      tags: [],
+      setTags(tags: number[]) {
+        set({ tags });
+      },
+      checkIn: 0,
+      setCheckIn(checkIn: number) {
+        set({ checkIn });
+      },
+    }),
+    {
+      name: keyBuilder('edge-devices-meta-filters'),
+    }
+  )
+);
diff --git a/app/react/edge/edge-devices/WaitingRoomView/Datatable/index.tsx b/app/react/edge/edge-devices/WaitingRoomView/Datatable/index.tsx
new file mode 100644
index 0000000..08d7ecd
--- /dev/null
+++ b/app/react/edge/edge-devices/WaitingRoomView/Datatable/index.tsx
@@ -0,0 +1 @@
+export { Datatable } from './Datatable';
diff --git a/app/react/edge/edge-devices/WaitingRoomView/Datatable/useEnvironments.ts b/app/react/edge/edge-devices/WaitingRoomView/Datatable/useEnvironments.ts
new file mode 100644
index 0000000..f6b14c6
--- /dev/null
+++ b/app/react/edge/edge-devices/WaitingRoomView/Datatable/useEnvironments.ts
@@ -0,0 +1,140 @@
+import _ from 'lodash';
+import { useEffect, useMemo, useState } from 'react';
+
+import { useTags } from '@/portainer/tags/queries';
+import { useEdgeGroups } from '@/react/edge/edge-groups/queries/useEdgeGroups';
+import { useGroups } from '@/react/portainer/environments/environment-groups/queries';
+import { useEnvironmentList } from '@/react/portainer/environments/queries';
+import { EdgeTypes } from '@/react/portainer/environments/types';
+import {
+  Query,
+  getSortType,
+} from '@/react/portainer/environments/queries/useEnvironmentList';
+
+import { WaitingRoomEnvironment } from '../types';
+
+import { useFilterStore } from './filter-store';
+
+export function useEnvironments({
+  pageLimit = 10,
+  search,
+  sortBy,
+}: {
+  pageLimit: number;
+  search: string;
+  sortBy: { id: string; desc: boolean } | undefined;
+}) {
+  const [page, setPage] = useState(0);
+  const filterStore = useFilterStore();
+  const edgeGroupsQuery = useEdgeGroups();
+
+  const filterByEnvironmentsIds = useMemo(
+    () =>
+      filterStore.edgeGroups.length
+        ? _.compact(
+            filterStore.edgeGroups.flatMap(
+              (groupId) =>
+                edgeGroupsQuery.data?.find((g) => g.Id === groupId)?.Endpoints
+            )
+          )
+        : undefined,
+    [edgeGroupsQuery.data, filterStore.edgeGroups]
+  );
+
+  const query: Partial<Query> = useMemo(
+    () => ({
+      pageLimit,
+      edgeDeviceUntrusted: true,
+      excludeSnapshots: true,
+      types: EdgeTypes,
+      tagIds: filterStore.tags.length ? filterStore.tags : undefined,
+      groupIds: filterStore.groups.length ? filterStore.groups : undefined,
+      endpointIds: filterByEnvironmentsIds,
+      edgeCheckInPassedSeconds: filterStore.checkIn,
+      search,
+      sort: getSortType(sortBy?.id),
+      order: sortBy?.desc ? 'desc' : 'asc',
+    }),
+    [
+      filterByEnvironmentsIds,
+      filterStore.checkIn,
+      filterStore.groups,
+      filterStore.tags,
+      pageLimit,
+      search,
+      sortBy,
+    ]
+  );
+
+  useEffect(() => {
+    setPage(0);
+  }, [query]);
+
+  const environmentsQuery = useEnvironmentList({
+    page: page + 1,
+    ...query,
+  });
+
+  const groupsQuery = useGroups({
+    select: (groups) =>
+      Object.fromEntries(groups.map((g) => [g.Id, g.Name] as const)),
+  });
+
+  const environmentEdgeGroupsQuery = useEdgeGroups({
+    select: (groups) =>
+      _.groupBy(
+        groups.flatMap((group) => {
+          const envs = group.Endpoints;
+          return envs.map((id) => ({ id, group: group.Name }));
+        }),
+        (env) => env.id
+      ),
+  });
+
+  const tagsQuery = useTags({
+    select: (tags) =>
+      Object.fromEntries(tags.map((tag) => [tag.ID, tag.Name] as const)),
+  });
+
+  const envs: Array<WaitingRoomEnvironment> = useMemo(
+    () =>
+      environmentsQuery.environments.map((env) => ({
+        ...env,
+        Group: (env.GroupId !== 1 && groupsQuery.data?.[env.GroupId]) || '',
+        EdgeGroups:
+          environmentEdgeGroupsQuery.data?.[env.Id]?.map((env) => env.group) ||
+          [],
+        Tags:
+          _.compact(env.TagIds?.map((tagId) => tagsQuery.data?.[tagId])) || [],
+      })),
+    [
+      environmentEdgeGroupsQuery.data,
+      environmentsQuery.environments,
+      groupsQuery.data,
+      tagsQuery.data,
+    ]
+  );
+
+  return useMemo(
+    () => ({
+      data: envs,
+      isLoading:
+        environmentsQuery.isLoading ||
+        groupsQuery.isLoading ||
+        environmentEdgeGroupsQuery.isLoading ||
+        tagsQuery.isLoading,
+      totalCount: environmentsQuery.totalCount,
+      page,
+      setPage,
+    }),
+    [
+      environmentEdgeGroupsQuery.isLoading,
+      environmentsQuery.isLoading,
+      environmentsQuery.totalCount,
+      envs,
+      groupsQuery.isLoading,
+      page,
+      tagsQuery.isLoading,
+    ]
+  );
+}
diff --git a/app/react/edge/edge-devices/WaitingRoomView/WaitingRoomView.tsx b/app/react/edge/edge-devices/WaitingRoomView/WaitingRoomView.tsx
new file mode 100644
index 0000000..062e1dc
--- /dev/null
+++ b/app/react/edge/edge-devices/WaitingRoomView/WaitingRoomView.tsx
@@ -0,0 +1,64 @@
+import { withLimitToBE } from '@/react/hooks/useLimitToBE';
+
+import { InformationPanel } from '@@/InformationPanel';
+import { TextTip } from '@@/Tip/TextTip';
+import { PageHeader } from '@@/PageHeader';
+import { Link } from '@@/Link';
+import { Alert } from '@@/Alert';
+
+import { Datatable } from './Datatable';
+import { useLicenseOverused, useUntrustedCount } from './queries';
+
+export default withLimitToBE(WaitingRoomView);
+
+function WaitingRoomView() {
+  const untrustedCount = useUntrustedCount();
+  const licenseOverused = useLicenseOverused(untrustedCount);
+  return (
+    <>
+      <PageHeader
+        title="Waiting Room"
+        breadcrumbs={[{ label: 'Waiting Room' }]}
+        reload
+      />
+
+      <div className="row">
+        <div className="col-sm-12">
+          <InformationPanel>
+            <TextTip color="blue">
+              Only environments generated from the{' '}
+              <Link
+                to="portainer.endpoints.edgeAutoCreateScript"
+                data-cy="waitingRoom-edgeAutoCreateScriptLink"
+              >
+                auto onboarding
+              </Link>{' '}
+              script will appear here, manually added environments and edge
+              devices will bypass the waiting room.
+            </TextTip>
+          </InformationPanel>
+        </div>
+      </div>
+
+      {licenseOverused && (
+        <div className="row">
+          <div className="col-sm-12">
+            <Alert color="warn">
+              Associating all nodes in waiting room will exceed the node limit
+              of your current license. Go to{' '}
+              <Link
+                to="portainer.licenses"
+                data-cy="waitingRoom-portainerLicensesLink"
+              >
+                Licenses
+              </Link>{' '}
+              page to view the current usage.
+            </Alert>
+          </div>
+        </div>
+      )}
+
+      <Datatable />
+    </>
+  );
+}
diff --git a/app/react/edge/edge-devices/WaitingRoomView/index.ts b/app/react/edge/edge-devices/WaitingRoomView/index.ts
new file mode 100644
index 0000000..e7b0056
--- /dev/null
+++ b/app/react/edge/edge-devices/WaitingRoomView/index.ts
@@ -0,0 +1 @@
+export { default as WaitingRoomView } from './WaitingRoomView';
diff --git a/app/react/edge/edge-devices/WaitingRoomView/queries.ts b/app/react/edge/edge-devices/WaitingRoomView/queries.ts
new file mode 100644
index 0000000..253fb45
--- /dev/null
+++ b/app/react/edge/edge-devices/WaitingRoomView/queries.ts
@@ -0,0 +1,57 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { EdgeTypes, EnvironmentId } from '@/react/portainer/environments/types';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { promiseSequence } from '@/portainer/helpers/promise-utils';
+import { useIntegratedLicenseInfo } from '@/react/portainer/licenses/use-license.service';
+import { useEnvironmentList } from '@/react/portainer/environments/queries';
+import {
+  mutationOptions,
+  withError,
+  withInvalidate,
+} from '@/react-tools/react-query';
+import { queryKey as nodesCountQueryKey } from '@/react/portainer/system/useNodesCount';
+import { LicenseType } from '@/react/portainer/licenses/types';
+import { environmentQueryKeys } from '@/react/portainer/environments/queries/query-keys';
+
+export function useAssociateDeviceMutation() {
+  const queryClient = useQueryClient();
+
+  return useMutation(
+    (ids: EnvironmentId[]) =>
+      promiseSequence(ids.map((id) => () => associateDevice(id))),
+    mutationOptions(
+      withError('Failed to associate devices'),
+      withInvalidate(queryClient, [
+        environmentQueryKeys.base(),
+        nodesCountQueryKey,
+      ])
+    )
+  );
+}
+
+async function associateDevice(environmentId: EnvironmentId) {
+  try {
+    await axios.post(`/endpoints/${environmentId}/edge/trust`);
+  } catch (e) {
+    throw parseAxiosError(e as Error, 'Failed to associate device');
+  }
+}
+
+export function useLicenseOverused(moreNodes: number) {
+  const integratedInfo = useIntegratedLicenseInfo();
+
+  return (
+    !!integratedInfo &&
+    integratedInfo.licenseInfo.type === LicenseType.Essentials &&
+    integratedInfo.usedNodes + moreNodes > integratedInfo.licenseInfo.nodes
+  );
+}
+
+export function useUntrustedCount() {
+  const query = useEnvironmentList({
+    edgeDeviceUntrusted: true,
+    types: EdgeTypes,
+  });
+  return query.totalCount;
+}
diff --git a/app/react/edge/edge-devices/WaitingRoomView/types.ts b/app/react/edge/edge-devices/WaitingRoomView/types.ts
new file mode 100644
index 0000000..4843137
--- /dev/null
+++ b/app/react/edge/edge-devices/WaitingRoomView/types.ts
@@ -0,0 +1,7 @@
+import { Environment } from '@/react/portainer/environments/types';
+
+export type WaitingRoomEnvironment = Environment & {
+  EdgeGroups: string[];
+  Tags: string[];
+  Group: string;
+};
diff --git a/app/react/edge/edge-groups/CreateView/CreateView.tsx b/app/react/edge/edge-groups/CreateView/CreateView.tsx
new file mode 100644
index 0000000..9d27919
--- /dev/null
+++ b/app/react/edge/edge-groups/CreateView/CreateView.tsx
@@ -0,0 +1,55 @@
+import { useRouter } from '@uirouter/react';
+
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { PageHeader } from '@@/PageHeader';
+import { Widget } from '@@/Widget';
+
+import { useCreateEdgeGroupMutation } from '../queries/useCreateEdgeGroupMutation';
+import { EdgeGroupForm } from '../components/EdgeGroupForm/EdgeGroupForm';
+
+export function CreateView() {
+  const mutation = useCreateEdgeGroupMutation();
+  const router = useRouter();
+
+  return (
+    <>
+      <PageHeader
+        title="Create edge group"
+        breadcrumbs={[
+          { label: 'Edge groups', link: 'edge.groups' },
+          'Add edge group',
+        ]}
+      />
+
+      <div className="row">
+        <div className="col-sm-12">
+          <Widget>
+            <Widget.Body>
+              <EdgeGroupForm
+                onSubmit={({ environmentIds, ...values }) => {
+                  mutation.mutate(
+                    {
+                      endpoints: environmentIds,
+                      ...values,
+                    },
+                    {
+                      onSuccess: () => {
+                        notifySuccess(
+                          'Success',
+                          'Edge group successfully created'
+                        );
+                        router.stateService.go('^');
+                      },
+                    }
+                  );
+                }}
+                isLoading={mutation.isLoading}
+              />
+            </Widget.Body>
+          </Widget>
+        </div>
+      </div>
+    </>
+  );
+}
diff --git a/app/react/edge/edge-groups/ItemView/ItemView.tsx b/app/react/edge/edge-groups/ItemView/ItemView.tsx
new file mode 100644
index 0000000..015b1e9
--- /dev/null
+++ b/app/react/edge/edge-groups/ItemView/ItemView.tsx
@@ -0,0 +1,72 @@
+import { useCurrentStateAndParams, useRouter } from '@uirouter/react';
+
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { PageHeader } from '@@/PageHeader';
+import { Widget } from '@@/Widget';
+import { Redirect } from '@@/Redirect';
+
+import { useUpdateEdgeGroupMutation } from '../queries/useUpdateEdgeGroupMutation';
+import { EdgeGroupForm } from '../components/EdgeGroupForm/EdgeGroupForm';
+import { useEdgeGroup } from '../queries/useEdgeGroup';
+
+export function ItemView() {
+  const {
+    params: { groupId: id },
+  } = useCurrentStateAndParams();
+  const groupQuery = useEdgeGroup(id);
+  const mutation = useUpdateEdgeGroupMutation();
+  const router = useRouter();
+
+  if (groupQuery.isError) {
+    return <Redirect to="edge.groups" />;
+  }
+
+  if (!groupQuery.data) {
+    return null;
+  }
+
+  const group = groupQuery.data;
+  return (
+    <>
+      <PageHeader
+        title="Edit edge group"
+        breadcrumbs={[
+          { label: 'Edge groups', link: 'edge.groups' },
+          group.Name,
+        ]}
+      />
+
+      <div className="row">
+        <div className="col-sm-12">
+          <Widget>
+            <Widget.Body>
+              <EdgeGroupForm
+                group={group}
+                onSubmit={({ environmentIds, ...values }) => {
+                  mutation.mutate(
+                    {
+                      id,
+                      endpoints: environmentIds,
+                      ...values,
+                    },
+                    {
+                      onSuccess: () => {
+                        notifySuccess(
+                          'Success',
+                          'Edge group successfully updated'
+                        );
+                        router.stateService.go('^');
+                      },
+                    }
+                  );
+                }}
+                isLoading={mutation.isLoading}
+              />
+            </Widget.Body>
+          </Widget>
+        </div>
+      </div>
+    </>
+  );
+}
diff --git a/app/react/edge/edge-groups/ListView/EdgeGroupsDatatable.tsx b/app/react/edge/edge-groups/ListView/EdgeGroupsDatatable.tsx
new file mode 100644
index 0000000..25cb560
--- /dev/null
+++ b/app/react/edge/edge-groups/ListView/EdgeGroupsDatatable.tsx
@@ -0,0 +1,37 @@
+import { LayoutGrid } from 'lucide-react';
+
+import { Datatable } from '@@/datatables';
+import { useTableState } from '@@/datatables/useTableState';
+import { createPersistedStore } from '@@/datatables/types';
+
+import { useEdgeGroups } from '../queries/useEdgeGroups';
+
+import { columns } from './columns';
+import { TableActions } from './TableActions';
+
+const tableKey = 'edge-groups';
+
+const settingsStore = createPersistedStore(tableKey);
+
+export function EdgeGroupsDatatable() {
+  const tableState = useTableState(settingsStore, tableKey);
+  const edgeGroupsQuery = useEdgeGroups();
+
+  return (
+    <Datatable
+      title="Edge Groups"
+      titleIcon={LayoutGrid}
+      columns={columns}
+      dataset={edgeGroupsQuery.data || []}
+      settingsManager={tableState}
+      isLoading={edgeGroupsQuery.isLoading}
+      renderTableActions={(selectedItems) => (
+        <TableActions selectedItems={selectedItems} />
+      )}
+      isRowSelectable={({ original: item }) =>
+        !(item.HasEdgeStack || item.HasEdgeJob || item.HasEdgeConfig)
+      }
+      data-cy="edge-groups-datatable"
+    />
+  );
+}
diff --git a/app/react/edge/edge-groups/ListView/ListView.tsx b/app/react/edge/edge-groups/ListView/ListView.tsx
new file mode 100644
index 0000000..97aed7b
--- /dev/null
+++ b/app/react/edge/edge-groups/ListView/ListView.tsx
@@ -0,0 +1,12 @@
+import { PageHeader } from '@@/PageHeader';
+
+import { EdgeGroupsDatatable } from './EdgeGroupsDatatable';
+
+export function ListView() {
+  return (
+    <>
+      <PageHeader title="Edge Groups" breadcrumbs="Edge Groups" reload />
+      <EdgeGroupsDatatable />
+    </>
+  );
+}
diff --git a/app/react/edge/edge-groups/ListView/TableActions.tsx b/app/react/edge/edge-groups/ListView/TableActions.tsx
new file mode 100644
index 0000000..44d9744
--- /dev/null
+++ b/app/react/edge/edge-groups/ListView/TableActions.tsx
@@ -0,0 +1,38 @@
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { AddButton } from '@@/buttons';
+import { DeleteButton } from '@@/buttons/DeleteButton';
+
+import { EdgeGroup } from '../types';
+
+import { useDeleteEdgeGroupsMutation } from './useDeleteEdgeGroupMutation';
+
+export function TableActions({
+  selectedItems,
+}: {
+  selectedItems: Array<EdgeGroup>;
+}) {
+  const removeMutation = useDeleteEdgeGroupsMutation();
+
+  return (
+    <div className="flex items-center gap-2">
+      <DeleteButton
+        confirmMessage="Do you want to remove the selected Edge Group(s)?"
+        disabled={selectedItems.length === 0}
+        onConfirmed={() => handleRemove(selectedItems)}
+        data-cy="remove-edge-group-button"
+      />
+
+      <AddButton data-cy="add-edge-group-button">Add Edge group</AddButton>
+    </div>
+  );
+
+  async function handleRemove(selectedItems: Array<EdgeGroup>) {
+    const ids = selectedItems.map((item) => item.Id);
+    removeMutation.mutate(ids, {
+      onSuccess: () => {
+        notifySuccess('Success', 'Edge Group(s) removed');
+      },
+    });
+  }
+}
diff --git a/app/react/edge/edge-groups/ListView/columns/helper.ts b/app/react/edge/edge-groups/ListView/columns/helper.ts
new file mode 100644
index 0000000..d4e142b
--- /dev/null
+++ b/app/react/edge/edge-groups/ListView/columns/helper.ts
@@ -0,0 +1,5 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { EdgeGroupListItemResponse } from '../../queries/useEdgeGroups';
+
+export const columnHelper = createColumnHelper<EdgeGroupListItemResponse>();
diff --git a/app/react/edge/edge-groups/ListView/columns/index.ts b/app/react/edge/edge-groups/ListView/columns/index.ts
new file mode 100644
index 0000000..7b1d5e4
--- /dev/null
+++ b/app/react/edge/edge-groups/ListView/columns/index.ts
@@ -0,0 +1,13 @@
+import { columnHelper } from './helper';
+import { name } from './name';
+
+export const columns = [
+  name,
+  columnHelper.accessor((group) => group.TrustedEndpoints.length, {
+    header: 'Environments Count',
+  }),
+  columnHelper.accessor('Dynamic', {
+    header: 'Group Type',
+    cell: ({ getValue }) => (getValue() ? 'Dynamic' : 'Static'),
+  }),
+];
diff --git a/app/react/edge/edge-groups/ListView/columns/name.tsx b/app/react/edge/edge-groups/ListView/columns/name.tsx
new file mode 100644
index 0000000..b3819bc
--- /dev/null
+++ b/app/react/edge/edge-groups/ListView/columns/name.tsx
@@ -0,0 +1,42 @@
+import { CellContext } from '@tanstack/react-table';
+
+import { Link } from '@@/Link';
+import { Badge } from '@@/Badge';
+
+import { EdgeGroupListItemResponse } from '../../queries/useEdgeGroups';
+
+import { columnHelper } from './helper';
+
+export const name = columnHelper.accessor('Name', {
+  header: 'Name',
+  cell: NameCell,
+});
+
+function NameCell({
+  renderValue,
+  row: { original: item },
+}: CellContext<EdgeGroupListItemResponse, unknown>) {
+  const name = renderValue() || '';
+
+  if (typeof name !== 'string') {
+    return null;
+  }
+
+  return (
+    <>
+      <Link
+        to=".edit"
+        params={{ groupId: item.Id }}
+        title={name}
+        data-cy={`edge-group-link-${name}`}
+      >
+        {name}
+      </Link>
+      {(item.HasEdgeJob || item.HasEdgeStack) && (
+        <Badge type="info" className="ml-1">
+          in use
+        </Badge>
+      )}
+    </>
+  );
+}
diff --git a/app/react/edge/edge-groups/ListView/index.ts b/app/react/edge/edge-groups/ListView/index.ts
new file mode 100644
index 0000000..dd06dfd
--- /dev/null
+++ b/app/react/edge/edge-groups/ListView/index.ts
@@ -0,0 +1 @@
+export { ListView } from './ListView';
diff --git a/app/react/edge/edge-groups/ListView/useDeleteEdgeGroupMutation.ts b/app/react/edge/edge-groups/ListView/useDeleteEdgeGroupMutation.ts
new file mode 100644
index 0000000..990f714
--- /dev/null
+++ b/app/react/edge/edge-groups/ListView/useDeleteEdgeGroupMutation.ts
@@ -0,0 +1,35 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { promiseSequence } from '@/portainer/helpers/promise-utils';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import {
+  mutationOptions,
+  withError,
+  withInvalidate,
+} from '@/react-tools/react-query';
+
+import { EdgeGroup } from '../types';
+import { buildUrl } from '../queries/build-url';
+import { queryKeys } from '../queries/query-keys';
+
+export function useDeleteEdgeGroupsMutation() {
+  const queryClient = useQueryClient();
+  return useMutation(
+    (edgeGroupIds: Array<EdgeGroup['Id']>) =>
+      promiseSequence(
+        edgeGroupIds.map((edgeGroupId) => () => deleteEdgeGroup(edgeGroupId))
+      ),
+    mutationOptions(
+      withError('Unable to delete Edge Group(s)'),
+      withInvalidate(queryClient, [queryKeys.base()])
+    )
+  );
+}
+
+async function deleteEdgeGroup(id: EdgeGroup['Id']) {
+  try {
+    await axios.delete(buildUrl({ id }));
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to delete edge Group');
+  }
+}
diff --git a/app/react/edge/edge-groups/components/EdgeGroupForm/DynamicGroupFieldset.tsx b/app/react/edge/edge-groups/components/EdgeGroupForm/DynamicGroupFieldset.tsx
new file mode 100644
index 0000000..6d3f197
--- /dev/null
+++ b/app/react/edge/edge-groups/components/EdgeGroupForm/DynamicGroupFieldset.tsx
@@ -0,0 +1,45 @@
+import { useFormikContext } from 'formik';
+
+import { EdgeGroupAssociationTable } from '@/react/edge/components/EdgeGroupAssociationTable';
+import { EdgeTypes } from '@/react/portainer/environments/types';
+
+import { BoxSelector } from '@@/BoxSelector';
+import { TagSelector } from '@@/TagSelector';
+import { FormSection } from '@@/form-components/FormSection';
+
+import { tagOptions } from './tag-options';
+import { FormValues } from './types';
+
+export function DynamicGroupFieldset() {
+  const { values, setFieldValue, errors } = useFormikContext<FormValues>();
+  return (
+    <>
+      <FormSection title="Tags">
+        <BoxSelector
+          slim
+          value={values.partialMatch}
+          onChange={(partialMatch) =>
+            setFieldValue('partialMatch', partialMatch)
+          }
+          options={tagOptions}
+          radioName="partialMatch"
+        />
+        <TagSelector
+          value={values.tagIds}
+          onChange={(tagIds) => setFieldValue('tagIds', tagIds)}
+          errors={errors.tagIds}
+        />
+      </FormSection>
+
+      <EdgeGroupAssociationTable
+        data-cy="edgeGroupCreate-associatedEnvironmentsTable"
+        title="Associated environments by tags"
+        query={{
+          types: EdgeTypes,
+          tagIds: values.tagIds,
+          tagsPartialMatch: values.partialMatch,
+        }}
+      />
+    </>
+  );
+}
diff --git a/app/react/edge/edge-groups/components/EdgeGroupForm/EdgeGroupForm.tsx b/app/react/edge/edge-groups/components/EdgeGroupForm/EdgeGroupForm.tsx
new file mode 100644
index 0000000..7287875
--- /dev/null
+++ b/app/react/edge/edge-groups/components/EdgeGroupForm/EdgeGroupForm.tsx
@@ -0,0 +1,92 @@
+import { Form, Formik, useFormikContext } from 'formik';
+
+import { FormSection } from '@@/form-components/FormSection';
+import { BoxSelector } from '@@/BoxSelector';
+import { FormActions } from '@@/form-components/FormActions';
+
+import { EdgeGroup } from '../../types';
+
+import { groupTypeOptions } from './group-type-options';
+import { FormValues } from './types';
+import { useValidation } from './useValidation';
+import { DynamicGroupFieldset } from './DynamicGroupFieldset';
+import { StaticGroupFieldset } from './StaticGroupFieldset';
+import { NameField } from './NameField';
+
+export function EdgeGroupForm({
+  onSubmit,
+  isLoading,
+  group,
+}: {
+  onSubmit: (values: FormValues) => void;
+  isLoading: boolean;
+  group?: EdgeGroup;
+}) {
+  const validation = useValidation({ id: group?.Id });
+  return (
+    <Formik
+      validationSchema={validation}
+      validateOnMount
+      initialValues={
+        group
+          ? {
+              dynamic: group.Dynamic,
+              environmentIds: group.Endpoints,
+              name: group.Name,
+              partialMatch: group.PartialMatch,
+              tagIds: group.TagIds,
+              edgeGroupId: group.Id,
+            }
+          : {
+              name: '',
+              dynamic: false,
+              environmentIds: [],
+              partialMatch: false,
+              tagIds: [],
+              edgeGroupId: 0,
+            }
+      }
+      onSubmit={onSubmit}
+    >
+      <InnerForm isLoading={isLoading} isCreate={!group} />
+    </Formik>
+  );
+}
+
+function InnerForm({
+  isLoading,
+  isCreate,
+}: {
+  isLoading: boolean;
+  isCreate: boolean;
+}) {
+  const { values, setFieldValue, isValid, errors } =
+    useFormikContext<FormValues>();
+
+  return (
+    <Form className="form-horizontal">
+      <NameField errors={errors.name} />
+
+      <FormSection title="Group type">
+        <BoxSelector
+          slim
+          value={values.dynamic}
+          onChange={(dynamic) => setFieldValue('dynamic', dynamic)}
+          options={groupTypeOptions}
+          radioName="groupTypeDynamic"
+        />
+      </FormSection>
+
+      {values.dynamic ? <DynamicGroupFieldset /> : <StaticGroupFieldset />}
+
+      <FormActions
+        submitLabel={isCreate ? 'Add edge group' : 'Save edge group'}
+        isLoading={isLoading}
+        isValid={isValid}
+        data-cy="edgeGroupCreate-addGroupButton"
+        loadingText="In progress..."
+        errors={errors}
+      />
+    </Form>
+  );
+}
diff --git a/app/react/edge/edge-groups/components/EdgeGroupForm/NameField.tsx b/app/react/edge/edge-groups/components/EdgeGroupForm/NameField.tsx
new file mode 100644
index 0000000..3ea4702
--- /dev/null
+++ b/app/react/edge/edge-groups/components/EdgeGroupForm/NameField.tsx
@@ -0,0 +1,42 @@
+import { Field, FormikErrors } from 'formik';
+import { string } from 'yup';
+import { useMemo } from 'react';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+
+import { useEdgeGroups } from '../../queries/useEdgeGroups';
+import { EdgeGroup } from '../../types';
+
+export function NameField({ errors }: { errors?: FormikErrors<string> }) {
+  return (
+    <FormControl label="Name" required errors={errors} inputId="group_name">
+      <Field
+        as={Input}
+        name="name"
+        placeholder="e.g. mygroup"
+        data-cy="edgeGroupCreate-groupNameInput"
+        id="group_name"
+      />
+    </FormControl>
+  );
+}
+
+export function useNameValidation(id?: EdgeGroup['Id']) {
+  const edgeGroupsQuery = useEdgeGroups();
+
+  return useMemo(
+    () =>
+      string()
+        .required('Name is required')
+        .test({
+          name: 'is-unique',
+          test: (value) =>
+            !edgeGroupsQuery.data?.find(
+              (group) => group.Name === value && group.Id !== id
+            ),
+          message: 'Name must be unique',
+        }),
+    [edgeGroupsQuery.data, id]
+  );
+}
diff --git a/app/react/edge/edge-groups/components/EdgeGroupForm/StaticGroupFieldset.tsx b/app/react/edge/edge-groups/components/EdgeGroupForm/StaticGroupFieldset.tsx
new file mode 100644
index 0000000..aecec7f
--- /dev/null
+++ b/app/react/edge/edge-groups/components/EdgeGroupForm/StaticGroupFieldset.tsx
@@ -0,0 +1,41 @@
+import { useFormikContext } from 'formik';
+
+import { AssociatedEdgeGroupEnvironmentsSelector } from '@/react/edge/components/AssociatedEdgeGroupEnvironmentsSelector';
+
+import { FormSection } from '@@/form-components/FormSection';
+import { confirmDestructive } from '@@/modals/confirm';
+import { buildConfirmButton } from '@@/modals/utils';
+
+import { FormValues } from './types';
+
+export function StaticGroupFieldset({ isEdit }: { isEdit?: boolean }) {
+  const { values, setFieldValue, errors } = useFormikContext<FormValues>();
+
+  return (
+    <FormSection title="Associated environments">
+      <div className="form-group">
+        <AssociatedEdgeGroupEnvironmentsSelector
+          value={values.environmentIds}
+          error={errors.environmentIds}
+          onChange={async (environmentIds, meta) => {
+            if (meta.type === 'remove' && isEdit) {
+              const confirmed = await confirmDestructive({
+                title: 'Confirm action',
+                message:
+                  'Removing the environment from this group will remove its corresponding edge stacks',
+                confirmButton: buildConfirmButton('Confirm'),
+              });
+
+              if (!confirmed) {
+                return;
+              }
+            }
+
+            setFieldValue('environmentIds', environmentIds);
+          }}
+          edgeGroupId={values.edgeGroupId}
+        />
+      </div>
+    </FormSection>
+  );
+}
diff --git a/app/react/edge/edge-groups/components/EdgeGroupForm/group-type-options.tsx b/app/react/edge/edge-groups/components/EdgeGroupForm/group-type-options.tsx
new file mode 100644
index 0000000..51dffaa
--- /dev/null
+++ b/app/react/edge/edge-groups/components/EdgeGroupForm/group-type-options.tsx
@@ -0,0 +1,22 @@
+import { List, Tag } from 'lucide-react';
+
+import { BoxSelectorOption } from '@@/BoxSelector';
+
+export const groupTypeOptions: ReadonlyArray<BoxSelectorOption<boolean>> = [
+  {
+    id: 'static-group',
+    value: false,
+    label: 'Static',
+    description: 'Manually select Edge environments',
+    icon: List,
+    iconType: 'badge',
+  },
+  {
+    id: 'dynamic-group',
+    value: true,
+    label: 'Dynamic',
+    description: 'Automatically associate environments via tags',
+    icon: Tag,
+    iconType: 'badge',
+  },
+] as const;
diff --git a/app/react/edge/edge-groups/components/EdgeGroupForm/tag-options.tsx b/app/react/edge/edge-groups/components/EdgeGroupForm/tag-options.tsx
new file mode 100644
index 0000000..4b54acc
--- /dev/null
+++ b/app/react/edge/edge-groups/components/EdgeGroupForm/tag-options.tsx
@@ -0,0 +1,23 @@
+import { Tag } from 'lucide-react';
+
+import { BoxSelectorOption } from '@@/BoxSelector';
+
+export const tagOptions: ReadonlyArray<BoxSelectorOption<boolean>> = [
+  {
+    id: 'or-selector',
+    value: true,
+    label: 'Partial Match',
+    description:
+      'Associate any environment matching at least one of the selected tags',
+    icon: Tag,
+    iconType: 'badge',
+  },
+  {
+    id: 'and-selector',
+    value: false,
+    label: 'Full Match',
+    description: 'Associate any environment matching all of the selected tags',
+    icon: Tag,
+    iconType: 'badge',
+  },
+];
diff --git a/app/react/edge/edge-groups/components/EdgeGroupForm/types.tsx b/app/react/edge/edge-groups/components/EdgeGroupForm/types.tsx
new file mode 100644
index 0000000..1d67d93
--- /dev/null
+++ b/app/react/edge/edge-groups/components/EdgeGroupForm/types.tsx
@@ -0,0 +1,14 @@
+import {
+  EdgeGroupId,
+  EnvironmentId,
+} from '@/react/portainer/environments/types';
+import { TagId } from '@/portainer/tags/types';
+
+export interface FormValues {
+  edgeGroupId: EdgeGroupId;
+  name: string;
+  dynamic: boolean;
+  environmentIds: EnvironmentId[];
+  partialMatch: boolean;
+  tagIds: TagId[];
+}
diff --git a/app/react/edge/edge-groups/components/EdgeGroupForm/useValidation.tsx b/app/react/edge/edge-groups/components/EdgeGroupForm/useValidation.tsx
new file mode 100644
index 0000000..436cd68
--- /dev/null
+++ b/app/react/edge/edge-groups/components/EdgeGroupForm/useValidation.tsx
@@ -0,0 +1,28 @@
+import { SchemaOf, array, boolean, number, object } from 'yup';
+import { useMemo } from 'react';
+
+import { EdgeGroup } from '../../types';
+
+import { FormValues } from './types';
+import { useNameValidation } from './NameField';
+
+export function useValidation({
+  id,
+}: { id?: EdgeGroup['Id'] } = {}): SchemaOf<FormValues> {
+  const nameValidation = useNameValidation(id);
+  return useMemo(
+    () =>
+      object({
+        name: nameValidation,
+        dynamic: boolean().default(false),
+        environmentIds: array(number().required()),
+        partialMatch: boolean().default(false),
+        tagIds: array(number().required()).when('dynamic', {
+          is: true,
+          then: (schema) => schema.min(1, 'Tags are required'),
+        }),
+        edgeGroupId: number().default(0).notRequired(),
+      }),
+    [nameValidation]
+  );
+}
diff --git a/app/react/edge/edge-groups/queries/build-url.ts b/app/react/edge/edge-groups/queries/build-url.ts
new file mode 100644
index 0000000..dd4ae1d
--- /dev/null
+++ b/app/react/edge/edge-groups/queries/build-url.ts
@@ -0,0 +1,10 @@
+import { EdgeGroup } from '../types';
+
+export function buildUrl({
+  action,
+  id,
+}: { id?: EdgeGroup['Id']; action?: string } = {}) {
+  const baseUrl = '/edge_groups';
+  const url = id ? `${baseUrl}/${id}` : baseUrl;
+  return action ? `${url}/${action}` : url;
+}
diff --git a/app/react/edge/edge-groups/queries/query-keys.ts b/app/react/edge/edge-groups/queries/query-keys.ts
new file mode 100644
index 0000000..5123c1c
--- /dev/null
+++ b/app/react/edge/edge-groups/queries/query-keys.ts
@@ -0,0 +1,4 @@
+export const queryKeys = {
+  base: () => ['edge', 'groups'] as const,
+  item: (id: number) => [...queryKeys.base(), id] as const,
+};
diff --git a/app/react/edge/edge-groups/queries/useCreateEdgeGroupMutation.ts b/app/react/edge/edge-groups/queries/useCreateEdgeGroupMutation.ts
new file mode 100644
index 0000000..43ac8cc
--- /dev/null
+++ b/app/react/edge/edge-groups/queries/useCreateEdgeGroupMutation.ts
@@ -0,0 +1,47 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { TagId } from '@/portainer/tags/types';
+import {
+  mutationOptions,
+  withError,
+  withInvalidate,
+} from '@/react-tools/react-query';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { EdgeGroup } from '../types';
+
+import { buildUrl } from './build-url';
+import { queryKeys } from './query-keys';
+
+interface CreateGroupPayload {
+  name: string;
+  dynamic: boolean;
+  tagIds?: TagId[];
+  endpoints?: EnvironmentId[];
+  partialMatch?: boolean;
+}
+
+export async function createEdgeGroup(requestPayload: CreateGroupPayload) {
+  try {
+    const { data: group } = await axios.post<EdgeGroup>(
+      buildUrl(),
+      requestPayload
+    );
+    return group;
+  } catch (e) {
+    throw parseAxiosError(e as Error, 'Failed to create Edge group');
+  }
+}
+
+export function useCreateEdgeGroupMutation() {
+  const queryClient = useQueryClient();
+
+  return useMutation(
+    createEdgeGroup,
+    mutationOptions(
+      withError('Failed to create Edge group'),
+      withInvalidate(queryClient, [queryKeys.base()])
+    )
+  );
+}
diff --git a/app/react/edge/edge-groups/queries/useEdgeGroup.ts b/app/react/edge/edge-groups/queries/useEdgeGroup.ts
new file mode 100644
index 0000000..71ccedf
--- /dev/null
+++ b/app/react/edge/edge-groups/queries/useEdgeGroup.ts
@@ -0,0 +1,47 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import {
+  EnvironmentId,
+  EnvironmentType,
+} from '@/react/portainer/environments/types';
+import { withError } from '@/react-tools/react-query';
+
+import { EdgeGroup } from '../types';
+
+import { queryKeys } from './query-keys';
+import { buildUrl } from './build-url';
+
+export interface EdgeGroupListItemResponse extends EdgeGroup {
+  EndpointTypes: Array<EnvironmentType>;
+  HasEdgeStack?: boolean;
+  HasEdgeJob?: boolean;
+  HasEdgeConfig?: boolean;
+  TrustedEndpoints: Array<EnvironmentId>;
+}
+
+async function getEdgeGroup(id: EdgeGroup['Id']) {
+  try {
+    const { data } = await axios.get<EdgeGroup>(buildUrl({ id }));
+    return data;
+  } catch (err) {
+    throw parseAxiosError(err as Error, 'Failed fetching edge groups');
+  }
+}
+
+export function useEdgeGroup<T = EdgeGroup>(
+  id?: EdgeGroup['Id'],
+  {
+    select,
+  }: {
+    select?: (groups: EdgeGroup) => T;
+  } = {}
+) {
+  return useQuery({
+    queryKey: queryKeys.item(id!),
+    queryFn: () => getEdgeGroup(id!),
+    select,
+    enabled: !!id,
+    ...withError('Failed fetching edge group'),
+  });
+}
diff --git a/app/react/edge/edge-groups/queries/useEdgeGroups.ts b/app/react/edge/edge-groups/queries/useEdgeGroups.ts
new file mode 100644
index 0000000..d5dc91e
--- /dev/null
+++ b/app/react/edge/edge-groups/queries/useEdgeGroups.ts
@@ -0,0 +1,37 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import {
+  EnvironmentId,
+  EnvironmentType,
+} from '@/react/portainer/environments/types';
+
+import { EdgeGroup } from '../types';
+
+import { queryKeys } from './query-keys';
+import { buildUrl } from './build-url';
+
+export interface EdgeGroupListItemResponse extends EdgeGroup {
+  EndpointTypes: Array<EnvironmentType>;
+  HasEdgeStack?: boolean;
+  HasEdgeJob?: boolean;
+  HasEdgeConfig?: boolean;
+  TrustedEndpoints: Array<EnvironmentId>;
+}
+
+async function getEdgeGroups() {
+  try {
+    const { data } = await axios.get<EdgeGroupListItemResponse[]>(buildUrl());
+    return data;
+  } catch (err) {
+    throw parseAxiosError(err as Error, 'Failed fetching edge groups');
+  }
+}
+
+export function useEdgeGroups<T = EdgeGroupListItemResponse[]>({
+  select,
+}: {
+  select?: (groups: EdgeGroupListItemResponse[]) => T;
+} = {}) {
+  return useQuery(queryKeys.base(), getEdgeGroups, { select });
+}
diff --git a/app/react/edge/edge-groups/queries/useUpdateEdgeGroupMutation.ts b/app/react/edge/edge-groups/queries/useUpdateEdgeGroupMutation.ts
new file mode 100644
index 0000000..2f38967
--- /dev/null
+++ b/app/react/edge/edge-groups/queries/useUpdateEdgeGroupMutation.ts
@@ -0,0 +1,51 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { TagId } from '@/portainer/tags/types';
+import {
+  mutationOptions,
+  withError,
+  withInvalidate,
+} from '@/react-tools/react-query';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { EdgeGroup } from '../types';
+
+import { buildUrl } from './build-url';
+import { queryKeys } from './query-keys';
+
+interface UpdateGroupPayload {
+  id: EdgeGroup['Id'];
+  name: string;
+  dynamic: boolean;
+  tagIds?: TagId[];
+  endpoints?: EnvironmentId[];
+  partialMatch?: boolean;
+}
+
+export async function updateEdgeGroup({
+  id,
+  ...requestPayload
+}: UpdateGroupPayload) {
+  try {
+    const { data: group } = await axios.put<EdgeGroup>(
+      buildUrl({ id }),
+      requestPayload
+    );
+    return group;
+  } catch (e) {
+    throw parseAxiosError(e as Error, 'Failed to update Edge group');
+  }
+}
+
+export function useUpdateEdgeGroupMutation() {
+  const queryClient = useQueryClient();
+
+  return useMutation(
+    updateEdgeGroup,
+    mutationOptions(
+      withError('Failed to update Edge group'),
+      withInvalidate(queryClient, [queryKeys.base()])
+    )
+  );
+}
diff --git a/app/react/edge/edge-groups/types.ts b/app/react/edge/edge-groups/types.ts
new file mode 100644
index 0000000..2820e63
--- /dev/null
+++ b/app/react/edge/edge-groups/types.ts
@@ -0,0 +1,15 @@
+import {
+  EnvironmentId,
+  EnvironmentType,
+} from '@/react/portainer/environments/types';
+import { TagId } from '@/portainer/tags/types';
+
+export interface EdgeGroup {
+  Id: number;
+  Name: string;
+  Dynamic: boolean;
+  TagIds: TagId[];
+  Endpoints: EnvironmentId[];
+  PartialMatch: boolean;
+  EndpointTypes: EnvironmentType[];
+}
diff --git a/app/react/edge/edge-jobs/CreateView/CreateEdgeJobForm.tsx b/app/react/edge/edge-jobs/CreateView/CreateEdgeJobForm.tsx
new file mode 100644
index 0000000..e871d19
--- /dev/null
+++ b/app/react/edge/edge-jobs/CreateView/CreateEdgeJobForm.tsx
@@ -0,0 +1,168 @@
+import { Form, Formik, useFormikContext } from 'formik';
+import { useRouter } from '@uirouter/react';
+
+import { EdgeGroupsSelector } from '@/react/edge/edge-stacks/components/EdgeGroupsSelector';
+import { AssociatedEdgeEnvironmentsSelector } from '@/react/edge/components/AssociatedEdgeEnvironmentsSelector';
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { FormActions } from '@@/form-components/FormActions';
+import { FormSection } from '@@/form-components/FormSection';
+import { BoxSelector } from '@@/BoxSelector';
+import { editor, upload } from '@@/BoxSelector/common-options/build-methods';
+import { WebEditorForm } from '@@/WebEditorForm';
+import { FileUploadForm } from '@@/form-components/FileUpload';
+
+import { NameField } from '../components/EdgeJobForm/NameField';
+import { JobConfigurationFieldset } from '../components/EdgeJobForm/JobConfigurationFieldset';
+import {
+  BasePayload,
+  CreateEdgeJobPayload,
+  useCreateEdgeJobMutation,
+} from '../queries/useCreateEdgeJobMutation/useCreateEdgeJobMutation';
+import {
+  toRecurringRequest,
+  toRecurringViewModel,
+} from '../components/EdgeJobForm/parseRecurringValues';
+
+import { FormValues } from './types';
+import { useValidation } from './useValidation';
+
+export function CreateEdgeJobForm() {
+  const mutation = useCreateEdgeJobMutation();
+  const validation = useValidation();
+  const router = useRouter();
+
+  return (
+    <Formik<FormValues>
+      validationSchema={validation}
+      validateOnMount
+      initialValues={{
+        name: '',
+        method: 'editor',
+        edgeGroupIds: [],
+        environmentIds: [],
+        file: undefined,
+        fileContent: '',
+        ...toRecurringViewModel(),
+      }}
+      onSubmit={(values) => {
+        mutation.mutate(getPayload(values.method, values), {
+          onSuccess: () => {
+            notifySuccess('Success', 'Edge job successfully created');
+            router.stateService.go('^');
+          },
+        });
+      }}
+    >
+      <InnerForm isLoading={mutation.isLoading} />
+    </Formik>
+  );
+}
+
+const buildMethods = [editor, upload];
+
+function InnerForm({ isLoading }: { isLoading: boolean }) {
+  const { values, setFieldValue, isValid, errors } =
+    useFormikContext<FormValues>();
+
+  return (
+    <Form className="form-horizontal">
+      <NameField errors={errors.name} />
+
+      <JobConfigurationFieldset />
+
+      <FormSection title="Job content">
+        <BoxSelector
+          value={values.method}
+          options={buildMethods}
+          onChange={(value) => setFieldValue('method', value)}
+          radioName="build-method"
+        />
+      </FormSection>
+
+      {values.method === 'editor' && (
+        <WebEditorForm
+          data-cy="edge-job-editor"
+          id="edge-job-editor"
+          onChange={(value) => setFieldValue('fileContent', value)}
+          value={values.fileContent}
+          textTip="Define or paste the content of your script file here"
+          type="shell"
+          error={errors.fileContent}
+        />
+      )}
+
+      {values.method === 'upload' && (
+        <FileUploadForm
+          data-cy="edge-job-upload"
+          description="You can upload a script file from your computer."
+          onChange={(value) => setFieldValue('file', value)}
+          value={values.file}
+          required
+        />
+      )}
+
+      <EdgeGroupsSelector
+        onChange={(value) => setFieldValue('edgeGroupIds', value)}
+        value={values.edgeGroupIds}
+        error={errors.edgeGroupIds}
+      />
+
+      <FormSection title="Target environments">
+        <AssociatedEdgeEnvironmentsSelector
+          onChange={(value) => setFieldValue('environmentIds', value)}
+          value={values.environmentIds}
+        />
+      </FormSection>
+
+      <FormActions
+        submitLabel="Add edge job"
+        isLoading={isLoading}
+        isValid={isValid}
+        data-cy="edgeJobCreate-addJobButton"
+        loadingText="In progress..."
+        errors={errors}
+      />
+    </Form>
+  );
+}
+
+function getPayload(
+  method: 'upload' | 'editor',
+  values: FormValues
+): CreateEdgeJobPayload {
+  switch (method) {
+    case 'upload':
+      if (!values.file) {
+        throw new Error('File is required');
+      }
+
+      return {
+        method: 'file',
+        payload: {
+          ...getBasePayload(values),
+          file: values.file,
+        },
+      };
+    case 'editor':
+      return {
+        method: 'string',
+        payload: {
+          ...getBasePayload(values),
+          fileContent: values.fileContent,
+        },
+      };
+
+    default:
+      throw new Error(`Unknown method: ${method}`);
+  }
+
+  function getBasePayload(values: FormValues): BasePayload {
+    return {
+      name: values.name,
+      edgeGroups: values.edgeGroupIds,
+      endpoints: values.environmentIds,
+      ...toRecurringRequest(values),
+    };
+  }
+}
diff --git a/app/react/edge/edge-jobs/CreateView/CreateView.tsx b/app/react/edge/edge-jobs/CreateView/CreateView.tsx
new file mode 100644
index 0000000..eb69117
--- /dev/null
+++ b/app/react/edge/edge-jobs/CreateView/CreateView.tsx
@@ -0,0 +1,28 @@
+import { PageHeader } from '@@/PageHeader';
+import { Widget } from '@@/Widget';
+
+import { CreateEdgeJobForm } from './CreateEdgeJobForm';
+
+export function CreateView() {
+  return (
+    <>
+      <PageHeader
+        title="Create edge job"
+        breadcrumbs={[
+          { label: 'Edge jobs', link: 'edge.jobs' },
+          'Create edge job',
+        ]}
+      />
+
+      <div className="row">
+        <div className="col-sm-12">
+          <Widget>
+            <Widget.Body>
+              <CreateEdgeJobForm />
+            </Widget.Body>
+          </Widget>
+        </div>
+      </div>
+    </>
+  );
+}
diff --git a/app/react/edge/edge-jobs/CreateView/types.ts b/app/react/edge/edge-jobs/CreateView/types.ts
new file mode 100644
index 0000000..ca3d37c
--- /dev/null
+++ b/app/react/edge/edge-jobs/CreateView/types.ts
@@ -0,0 +1,20 @@
+import { EdgeGroup } from '@/react/edge/edge-groups/types';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { timeOptions } from '../components/EdgeJobForm/RecurringFieldset';
+
+export interface FormValues {
+  name: string;
+  recurring: boolean;
+  edgeGroupIds: Array<EdgeGroup['Id']>;
+  environmentIds: Array<EnvironmentId>;
+
+  method: 'editor' | 'upload';
+  fileContent: string;
+  file: File | undefined;
+
+  cronMethod: 'basic' | 'advanced';
+  dateTime: Date; // basic !recurring
+  recurringOption: (typeof timeOptions)[number]['value']; // basic recurring
+  cronExpression: string; // advanced
+}
diff --git a/app/react/edge/edge-jobs/CreateView/useValidation.ts b/app/react/edge/edge-jobs/CreateView/useValidation.ts
new file mode 100644
index 0000000..1076a46
--- /dev/null
+++ b/app/react/edge/edge-jobs/CreateView/useValidation.ts
@@ -0,0 +1,69 @@
+import {
+  SchemaOf,
+  array,
+  boolean,
+  date,
+  mixed,
+  number,
+  object,
+  string,
+} from 'yup';
+import { useMemo } from 'react';
+
+import { file } from '@@/form-components/yup-file-validation';
+
+import { useNameValidation } from '../components/EdgeJobForm/NameField';
+import { cronValidation } from '../components/EdgeJobForm/AdvancedCronFieldset';
+import { timeOptions } from '../components/EdgeJobForm/RecurringFieldset';
+
+import { FormValues } from './types';
+
+export function useValidation(): SchemaOf<FormValues> {
+  const nameValidation = useNameValidation();
+  return useMemo(
+    () =>
+      object({
+        name: nameValidation,
+        recurring: boolean().default(false),
+        cronExpression: string().default('').when('cronMethod', {
+          is: 'advanced',
+          then: cronValidation().required(),
+        }),
+        edgeGroupIds: array(number().required()),
+        environmentIds: array(number().required()),
+
+        method: mixed<'editor' | 'upload'>()
+          .oneOf(['editor', 'upload'])
+          .default('editor'),
+        file: file().when('method', {
+          is: 'upload',
+          then: object().required('This field is required.'),
+        }),
+        fileContent: string()
+          .default('')
+          .when('method', {
+            is: 'editor',
+            then: (schema) => schema.required('This field is required.'),
+          }),
+
+        cronMethod: mixed<'basic' | 'advanced'>()
+          .oneOf(['basic', 'advanced'])
+          .default('basic'),
+        dateTime: date()
+          .default(new Date())
+          .when(['recurring', 'cronMethod'], {
+            is: (recurring: boolean, cronMethod: 'basic' | 'advanced') =>
+              !recurring && cronMethod === 'basic',
+            then: (schema) => schema.required('This field is required.'),
+          }),
+        recurringOption: mixed()
+          .oneOf(timeOptions.map((o) => o.value))
+          .when(['recurring', 'cronMethod'], {
+            is: (recurring: boolean, cronMethod: 'basic' | 'advanced') =>
+              recurring && cronMethod === 'basic',
+            then: (schema) => schema.required('This field is required.'),
+          }),
+      }),
+    [nameValidation]
+  );
+}
diff --git a/app/react/edge/edge-jobs/ItemView/ItemView.tsx b/app/react/edge/edge-jobs/ItemView/ItemView.tsx
new file mode 100644
index 0000000..de9171d
--- /dev/null
+++ b/app/react/edge/edge-jobs/ItemView/ItemView.tsx
@@ -0,0 +1,84 @@
+import { ListIcon, WrenchIcon } from 'lucide-react';
+
+import { useIdParam } from '@/react/hooks/useIdParam';
+
+import { PageHeader } from '@@/PageHeader';
+import { Widget } from '@@/Widget';
+import { Tab, useCurrentTabIndex, WidgetTabs } from '@@/Widget/WidgetTabs';
+
+import { useEdgeJob } from '../queries/useEdgeJob';
+
+import { UpdateEdgeJobForm } from './UpdateEdgeJobForm/UpdateEdgeJobForm';
+import { ResultsDatatable } from './ResultsDatatable/ResultsDatatable';
+
+const TABS_FOR_INDEX: Tab[] = [
+  {
+    name: 'Configuration',
+    icon: WrenchIcon,
+    widget: null,
+    selectedTabParam: 'configuration',
+  },
+  {
+    name: 'Results',
+    icon: ListIcon,
+    widget: null,
+    selectedTabParam: 'results',
+  },
+];
+
+export function ItemView() {
+  const id = useIdParam();
+  const edgeJobQuery = useEdgeJob(id);
+  const currentTabIndex = useCurrentTabIndex(TABS_FOR_INDEX);
+
+  if (!edgeJobQuery.data) {
+    return null;
+  }
+
+  const edgeJob = edgeJobQuery.data;
+
+  const tabs: Tab[] = [
+    {
+      name: 'Configuration',
+      icon: WrenchIcon,
+      widget: (
+        <div className="row">
+          <div className="col-sm-12">
+            <Widget>
+              <Widget.Body>
+                <UpdateEdgeJobForm edgeJob={edgeJob} />
+              </Widget.Body>
+            </Widget>
+          </div>
+        </div>
+      ),
+      selectedTabParam: 'configuration',
+    },
+    {
+      name: 'Results',
+      icon: ListIcon,
+      widget: <ResultsDatatable jobId={edgeJob.Id} />,
+      selectedTabParam: 'results',
+    },
+  ];
+
+  return (
+    <>
+      <PageHeader
+        title="Edge job details"
+        breadcrumbs={[{ label: 'Edge jobs', link: 'edge.jobs' }, edgeJob.Name]}
+      />
+
+      {tabs.length === 1 ? (
+        <div className="row">
+          <div className="col-sm-12">{tabs[0].widget}</div>
+        </div>
+      ) : (
+        <>
+          <WidgetTabs tabs={tabs} currentTabIndex={currentTabIndex} />
+          {tabs[currentTabIndex].widget}
+        </>
+      )}
+    </>
+  );
+}
diff --git a/app/react/edge/edge-jobs/ItemView/ResultsDatatable/ResultsDatatable.tsx b/app/react/edge/edge-jobs/ItemView/ResultsDatatable/ResultsDatatable.tsx
new file mode 100644
index 0000000..bb972f9
--- /dev/null
+++ b/app/react/edge/edge-jobs/ItemView/ResultsDatatable/ResultsDatatable.tsx
@@ -0,0 +1,62 @@
+import { List } from 'lucide-react';
+
+import { queryOptionsFromTableState } from '@/react/common/api/listQueryParams';
+
+import { Datatable } from '@@/datatables';
+import { useTableState } from '@@/datatables/useTableState';
+import { withMeta } from '@@/datatables/extend-options/withMeta';
+import { mergeOptions } from '@@/datatables/extend-options/mergeOptions';
+
+import { EdgeJob, LogsStatus } from '../../types';
+import { useJobResults } from '../../queries/jobResults/useJobResults';
+
+import { columns, sortOptions } from './columns';
+import { createStore } from './datatable-store';
+
+const tableKey = 'edge-job-results';
+const store = createStore(tableKey);
+
+export function ResultsDatatable({ jobId }: { jobId: EdgeJob['Id'] }) {
+  const tableState = useTableState(store, tableKey);
+
+  const jobResultsQuery = useJobResults(jobId, {
+    ...queryOptionsFromTableState({ ...tableState }, sortOptions),
+    refetchInterval(dataset) {
+      const anyCollecting = dataset?.data?.some(
+        (r) => r.LogsStatus === LogsStatus.Pending
+      );
+
+      if (anyCollecting) {
+        return 5000;
+      }
+
+      return tableState.autoRefreshRate * 1000;
+    },
+  });
+
+  const dataset = jobResultsQuery.data?.data || [];
+
+  return (
+    <Datatable
+      title="Results"
+      titleIcon={List}
+      columns={columns}
+      disableSelect
+      dataset={dataset}
+      settingsManager={tableState}
+      isLoading={jobResultsQuery.isLoading}
+      extendTableOptions={mergeOptions(
+        withMeta({
+          table: 'edge-job-results',
+          jobId,
+        })
+      )}
+      data-cy="edge-job-results-datatable"
+      isServerSidePagination
+      page={tableState.page}
+      onPageChange={tableState.setPage}
+      onSearchChange={() => tableState.setPage(0)}
+      totalCount={jobResultsQuery.data?.totalCount || 0}
+    />
+  );
+}
diff --git a/app/react/edge/edge-jobs/ItemView/ResultsDatatable/columns.tsx b/app/react/edge/edge-jobs/ItemView/ResultsDatatable/columns.tsx
new file mode 100644
index 0000000..76bada2
--- /dev/null
+++ b/app/react/edge/edge-jobs/ItemView/ResultsDatatable/columns.tsx
@@ -0,0 +1,81 @@
+import { CellContext, createColumnHelper } from '@tanstack/react-table';
+
+import { sortOptionsFromColumns } from '@/react/common/api/sort.types';
+
+import { Button } from '@@/buttons';
+
+import { JobResult, LogsStatus } from '../../types';
+import { useDownloadLogsMutation } from '../../queries/jobResults/useDownloadLogsMutation';
+import { useClearLogsMutation } from '../../queries/jobResults/useClearLogsMutation';
+import { useCollectLogsMutation } from '../../queries/jobResults/useCollectLogsMutation';
+
+import { getTableMeta } from './types';
+
+const columnHelper = createColumnHelper<JobResult>();
+
+export const columns = [
+  columnHelper.accessor('EndpointName', {
+    header: 'Environment',
+    meta: {
+      className: 'w-1/2',
+    },
+  }),
+  columnHelper.display({
+    header: 'Actions',
+    cell: ActionsCell,
+    meta: {
+      className: 'w-1/2',
+    },
+  }),
+];
+
+function ActionsCell({
+  row: { original: item },
+  table,
+}: CellContext<JobResult, unknown>) {
+  const tableMeta = getTableMeta(table.options.meta);
+  const id = tableMeta.jobId;
+
+  const downloadLogsMutation = useDownloadLogsMutation(id);
+  const clearLogsMutations = useClearLogsMutation(id);
+  const collectLogsMutation = useCollectLogsMutation(id);
+
+  switch (item.LogsStatus) {
+    case LogsStatus.Pending:
+      return (
+        <>
+          Logs marked for collection, please wait until the logs are available.
+        </>
+      );
+
+    case LogsStatus.Collected:
+      return (
+        <>
+          <Button
+            onClick={() => downloadLogsMutation.mutate(item.EndpointId)}
+            data-cy={`edge-job-download-logs-${item.EndpointName}`}
+          >
+            Download logs
+          </Button>
+          <Button
+            onClick={() => clearLogsMutations.mutate(item.EndpointId)}
+            data-cy={`edge-job-clear-logs-${item.EndpointName}`}
+          >
+            Clear logs
+          </Button>
+        </>
+      );
+    case LogsStatus.Idle:
+    default:
+      return (
+        <Button
+          onClick={() => collectLogsMutation.mutate(item.EndpointId)}
+          data-cy={`edge-job-retrieve-logs-${item.EndpointName}`}
+        >
+          Retrieve logs
+        </Button>
+      );
+  }
+}
+
+export const sortOptions = sortOptionsFromColumns(columns);
diff --git a/app/react/edge/edge-jobs/ItemView/ResultsDatatable/datatable-store.ts b/app/react/edge/edge-jobs/ItemView/ResultsDatatable/datatable-store.ts
new file mode 100644
index 0000000..e767298
--- /dev/null
+++ b/app/react/edge/edge-jobs/ItemView/ResultsDatatable/datatable-store.ts
@@ -0,0 +1,21 @@
+import {
+  refreshableSettings,
+  createPersistedStore,
+  BasicTableSettings,
+  RefreshableTableSettings,
+  BackendPaginationTableSettings,
+  backendPaginationSettings,
+} from '@@/datatables/types';
+
+interface TableSettings
+  extends
+    BasicTableSettings,
+    RefreshableTableSettings,
+    BackendPaginationTableSettings {}
+
+export function createStore(storageKey: string) {
+  return createPersistedStore<TableSettings>(storageKey, undefined, (set) => ({
+    ...refreshableSettings(set),
+    ...backendPaginationSettings(set),
+  }));
+}
diff --git a/app/react/edge/edge-jobs/ItemView/ResultsDatatable/types.ts b/app/react/edge/edge-jobs/ItemView/ResultsDatatable/types.ts
new file mode 100644
index 0000000..841cf16
--- /dev/null
+++ b/app/react/edge/edge-jobs/ItemView/ResultsDatatable/types.ts
@@ -0,0 +1,23 @@
+import { EdgeJob } from '../../types';
+
+interface TableMeta {
+  table: 'edge-job-results';
+  jobId: EdgeJob['Id'];
+}
+
+function isTableMeta(meta: unknown): meta is TableMeta {
+  return (
+    !!meta &&
+    typeof meta === 'object' &&
+    'table' in meta &&
+    meta.table === 'edge-job-results'
+  );
+}
+
+export function getTableMeta(meta: unknown): TableMeta {
+  if (!isTableMeta(meta)) {
+    throw new Error('missing correct table meta');
+  }
+
+  return meta;
+}
diff --git a/app/react/edge/edge-jobs/ItemView/UpdateEdgeJobForm/UpdateEdgeJobForm.tsx b/app/react/edge/edge-jobs/ItemView/UpdateEdgeJobForm/UpdateEdgeJobForm.tsx
new file mode 100644
index 0000000..54ae5dc
--- /dev/null
+++ b/app/react/edge/edge-jobs/ItemView/UpdateEdgeJobForm/UpdateEdgeJobForm.tsx
@@ -0,0 +1,123 @@
+import { Form, Formik, useFormikContext } from 'formik';
+import { useRouter } from '@uirouter/react';
+
+import { EdgeGroupsSelector } from '@/react/edge/edge-stacks/components/EdgeGroupsSelector';
+import { AssociatedEdgeEnvironmentsSelector } from '@/react/edge/components/AssociatedEdgeEnvironmentsSelector';
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { FormActions } from '@@/form-components/FormActions';
+import { FormSection } from '@@/form-components/FormSection';
+import { WebEditorForm } from '@@/WebEditorForm';
+
+import { NameField } from '../../components/EdgeJobForm/NameField';
+import { JobConfigurationFieldset } from '../../components/EdgeJobForm/JobConfigurationFieldset';
+import {
+  UpdatePayload,
+  useUpdateEdgeJobMutation,
+} from '../../queries/useUpdateEdgeJobMutation';
+import {
+  toRecurringRequest,
+  toRecurringViewModel,
+} from '../../components/EdgeJobForm/parseRecurringValues';
+import { EdgeJobResponse } from '../../queries/useEdgeJob';
+import { useEdgeJobFile } from '../../queries/useEdgeJobFile';
+import { useValidation } from '../useValidation';
+
+import { FormValues } from './types';
+
+export function UpdateEdgeJobForm({ edgeJob }: { edgeJob: EdgeJobResponse }) {
+  const fileQuery = useEdgeJobFile(edgeJob.Id);
+  const mutation = useUpdateEdgeJobMutation();
+  const validation = useValidation({ id: edgeJob.Id });
+  const router = useRouter();
+
+  if (!fileQuery.isSuccess) {
+    return null;
+  }
+
+  return (
+    <Formik<FormValues>
+      validationSchema={validation}
+      validateOnMount
+      initialValues={{
+        name: edgeJob.Name,
+
+        edgeGroupIds: edgeJob.EdgeGroups || [],
+        environmentIds: edgeJob.Endpoints || [],
+        fileContent: fileQuery.data,
+        ...toRecurringViewModel({
+          cronExpression: edgeJob.CronExpression,
+          recurring: edgeJob.Recurring,
+        }),
+      }}
+      onSubmit={(values) => {
+        mutation.mutate(
+          { id: edgeJob.Id, payload: getPayload(values) },
+          {
+            onSuccess: () => {
+              notifySuccess('Success', 'Edge job successfully updated');
+              router.stateService.go('^');
+            },
+          }
+        );
+      }}
+    >
+      <InnerForm isLoading={mutation.isLoading} />
+    </Formik>
+  );
+}
+
+function InnerForm({ isLoading }: { isLoading: boolean }) {
+  const { values, setFieldValue, isValid, errors } =
+    useFormikContext<FormValues>();
+
+  return (
+    <Form className="form-horizontal">
+      <NameField errors={errors.name} />
+
+      <JobConfigurationFieldset />
+
+      <WebEditorForm
+        data-cy="edge-job-editor"
+        id="edge-job-editor"
+        onChange={(value) => setFieldValue('fileContent', value)}
+        value={values.fileContent}
+        textTip="Define or paste the content of your script file here"
+        type="shell"
+        error={errors.fileContent}
+      />
+
+      <EdgeGroupsSelector
+        onChange={(value) => setFieldValue('edgeGroupIds', value)}
+        value={values.edgeGroupIds}
+        error={errors.edgeGroupIds}
+      />
+
+      <FormSection title="Target environments">
+        <AssociatedEdgeEnvironmentsSelector
+          onChange={(value) => setFieldValue('environmentIds', value)}
+          value={values.environmentIds}
+        />
+      </FormSection>
+
+      <FormActions
+        submitLabel="Update edge job"
+        isLoading={isLoading}
+        isValid={isValid}
+        data-cy="updateJobButton"
+        loadingText="In progress..."
+        errors={errors}
+      />
+    </Form>
+  );
+}
+
+function getPayload(values: FormValues): UpdatePayload {
+  return {
+    name: values.name,
+    edgeGroups: values.edgeGroupIds,
+    endpoints: values.environmentIds,
+    fileContent: values.fileContent,
+    ...toRecurringRequest(values),
+  };
+}
diff --git a/app/react/edge/edge-jobs/ItemView/UpdateEdgeJobForm/getPayload.tsx b/app/react/edge/edge-jobs/ItemView/UpdateEdgeJobForm/getPayload.tsx
new file mode 100644
index 0000000..96ebd59
--- /dev/null
+++ b/app/react/edge/edge-jobs/ItemView/UpdateEdgeJobForm/getPayload.tsx
@@ -0,0 +1,14 @@
+import { UpdatePayload } from '../../queries/useUpdateEdgeJobMutation';
+import { toRecurringRequest } from '../../components/EdgeJobForm/parseRecurringValues';
+
+import { FormValues } from './types';
+
+export function getPayload(values: FormValues): UpdatePayload {
+  return {
+    name: values.name,
+    edgeGroups: values.edgeGroupIds,
+    endpoints: values.environmentIds,
+    fileContent: values.fileContent,
+    ...toRecurringRequest(values),
+  };
+}
diff --git a/app/react/edge/edge-jobs/ItemView/UpdateEdgeJobForm/types.ts b/app/react/edge/edge-jobs/ItemView/UpdateEdgeJobForm/types.ts
new file mode 100644
index 0000000..e9135c0
--- /dev/null
+++ b/app/react/edge/edge-jobs/ItemView/UpdateEdgeJobForm/types.ts
@@ -0,0 +1,18 @@
+import { EdgeGroup } from '@/react/edge/edge-groups/types';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { timeOptions } from '../../components/EdgeJobForm/RecurringFieldset';
+
+export interface FormValues {
+  name: string;
+  recurring: boolean;
+  edgeGroupIds: Array<EdgeGroup['Id']>;
+  environmentIds: Array<EnvironmentId>;
+
+  fileContent: string;
+
+  cronMethod: 'basic' | 'advanced';
+  dateTime: Date; // basic !recurring
+  recurringOption: (typeof timeOptions)[number]['value']; // basic recurring
+  cronExpression: string; // advanced
+}
diff --git a/app/react/edge/edge-jobs/ItemView/useValidation.ts b/app/react/edge/edge-jobs/ItemView/useValidation.ts
new file mode 100644
index 0000000..2472040
--- /dev/null
+++ b/app/react/edge/edge-jobs/ItemView/useValidation.ts
@@ -0,0 +1,60 @@
+import {
+  SchemaOf,
+  array,
+  boolean,
+  date,
+  mixed,
+  number,
+  object,
+  string,
+} from 'yup';
+import { useMemo } from 'react';
+
+import { EdgeJob } from '../types';
+import { useNameValidation } from '../components/EdgeJobForm/NameField';
+import { cronValidation } from '../components/EdgeJobForm/AdvancedCronFieldset';
+import { timeOptions } from '../components/EdgeJobForm/RecurringFieldset';
+
+import { FormValues } from './UpdateEdgeJobForm/types';
+
+export function useValidation({
+  id,
+}: {
+  id: EdgeJob['Id'];
+}): SchemaOf<FormValues> {
+  const nameValidation = useNameValidation(id);
+  return useMemo(
+    () =>
+      object({
+        name: nameValidation,
+        recurring: boolean().default(false),
+        cronExpression: string().default('').when('cronMethod', {
+          is: 'advanced',
+          then: cronValidation().required(),
+        }),
+        edgeGroupIds: array(number().required()),
+        environmentIds: array(number().required()),
+
+        fileContent: string().required('This field is required.'),
+
+        cronMethod: mixed<'basic' | 'advanced'>()
+          .oneOf(['basic', 'advanced'])
+          .default('basic'),
+        dateTime: date()
+          .default(new Date())
+          .when(['recurring', 'cronMethod'], {
+            is: (recurring: boolean, cronMethod: 'basic' | 'advanced') =>
+              !recurring && cronMethod === 'basic',
+            then: (schema) => schema.required('This field is required.'),
+          }),
+        recurringOption: mixed()
+          .oneOf(timeOptions.map((o) => o.value))
+          .when(['recurring', 'cronMethod'], {
+            is: (recurring: boolean, cronMethod: 'basic' | 'advanced') =>
+              recurring && cronMethod === 'basic',
+            then: (schema) => schema.required('This field is required.'),
+          }),
+      }),
+    [nameValidation]
+  );
+}
diff --git a/app/react/edge/edge-jobs/ListView/EdgeJobsDatatable.tsx b/app/react/edge/edge-jobs/ListView/EdgeJobsDatatable.tsx
new file mode 100644
index 0000000..ae0c294
--- /dev/null
+++ b/app/react/edge/edge-jobs/ListView/EdgeJobsDatatable.tsx
@@ -0,0 +1,34 @@
+import { Clock } from 'lucide-react';
+
+import { Datatable } from '@@/datatables';
+import { createPersistedStore } from '@@/datatables/types';
+import { useTableState } from '@@/datatables/useTableState';
+
+import { useEdgeJobs } from '../queries/useEdgeJobs';
+
+import { TableActions } from './TableActions';
+import { columns } from './columns';
+
+const tableKey = 'edge-jobs';
+
+const settingsStore = createPersistedStore(tableKey);
+
+export function EdgeJobsDatatable() {
+  const jobsQuery = useEdgeJobs();
+  const tableState = useTableState(settingsStore, tableKey);
+
+  return (
+    <Datatable
+      columns={columns}
+      isLoading={jobsQuery.isLoading}
+      dataset={jobsQuery.data || []}
+      settingsManager={tableState}
+      title="Edge Jobs"
+      titleIcon={Clock}
+      renderTableActions={(selectedItems) => (
+        <TableActions selectedItems={selectedItems} />
+      )}
+      data-cy="edge-jobs-datatable"
+    />
+  );
+}
diff --git a/app/react/edge/edge-jobs/ListView/ListView.tsx b/app/react/edge/edge-jobs/ListView/ListView.tsx
new file mode 100644
index 0000000..4481704
--- /dev/null
+++ b/app/react/edge/edge-jobs/ListView/ListView.tsx
@@ -0,0 +1,25 @@
+import { InformationPanel } from '@@/InformationPanel';
+import { PageHeader } from '@@/PageHeader';
+
+import { EdgeJobsDatatable } from './EdgeJobsDatatable';
+
+export function ListView() {
+  return (
+    <>
+      <PageHeader title="Edge Jobs" breadcrumbs="Edge Jobs" reload />
+
+      <div className="row">
+        <div className="col-sm-12">
+          <InformationPanel title="Information">
+            <p className="small text-muted">
+              Edge Jobs requires Docker Standalone and a cron implementation
+              that reads jobs from <code>/etc/cron.d</code>
+            </p>
+          </InformationPanel>
+        </div>
+      </div>
+
+      <EdgeJobsDatatable />
+    </>
+  );
+}
diff --git a/app/react/edge/edge-jobs/ListView/TableActions.tsx b/app/react/edge/edge-jobs/ListView/TableActions.tsx
new file mode 100644
index 0000000..fb82730
--- /dev/null
+++ b/app/react/edge/edge-jobs/ListView/TableActions.tsx
@@ -0,0 +1,38 @@
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { AddButton } from '@@/buttons';
+import { DeleteButton } from '@@/buttons/DeleteButton';
+
+import { EdgeJob } from '../types';
+
+import { useDeleteEdgeJobsMutation } from './useDeleteEdgeJobsMutation';
+
+export function TableActions({
+  selectedItems,
+}: {
+  selectedItems: Array<EdgeJob>;
+}) {
+  const removeMutation = useDeleteEdgeJobsMutation();
+
+  return (
+    <div className="flex items-center gap-2">
+      <DeleteButton
+        confirmMessage="Do you want to remove the selected Edge Job(s)?"
+        disabled={selectedItems.length === 0}
+        onConfirmed={() => handleRemove(selectedItems)}
+        data-cy="remove-edge-jobs-button"
+      />
+
+      <AddButton data-cy="add-edge-job-button">Add Edge job</AddButton>
+    </div>
+  );
+
+  async function handleRemove(selectedItems: Array<EdgeJob>) {
+    const ids = selectedItems.map((item) => item.Id);
+    removeMutation.mutate(ids, {
+      onSuccess: () => {
+        notifySuccess('Success', 'Edge Job(s) removed');
+      },
+    });
+  }
+}
diff --git a/app/react/edge/edge-jobs/ListView/columns.ts b/app/react/edge/edge-jobs/ListView/columns.ts
new file mode 100644
index 0000000..c75d70c
--- /dev/null
+++ b/app/react/edge/edge-jobs/ListView/columns.ts
@@ -0,0 +1,20 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { isoDateFromTimestamp } from '@/portainer/filters/filters';
+
+import { buildNameColumn } from '@@/datatables/buildNameColumn';
+
+import { EdgeJob } from '../types';
+
+const columnHelper = createColumnHelper<EdgeJob>();
+
+export const columns = [
+  buildNameColumn<EdgeJob>('Name', '.job', 'edge-job-name'),
+  columnHelper.accessor('CronExpression', {
+    header: 'Cron Expression',
+  }),
+  columnHelper.accessor('Created', {
+    header: 'Created',
+    cell: ({ getValue }) => isoDateFromTimestamp(getValue()),
+  }),
+];
diff --git a/app/react/edge/edge-jobs/ListView/index.ts b/app/react/edge/edge-jobs/ListView/index.ts
new file mode 100644
index 0000000..dd06dfd
--- /dev/null
+++ b/app/react/edge/edge-jobs/ListView/index.ts
@@ -0,0 +1 @@
+export { ListView } from './ListView';
diff --git a/app/react/edge/edge-jobs/ListView/useDeleteEdgeJobsMutation.ts b/app/react/edge/edge-jobs/ListView/useDeleteEdgeJobsMutation.ts
new file mode 100644
index 0000000..0ed6128
--- /dev/null
+++ b/app/react/edge/edge-jobs/ListView/useDeleteEdgeJobsMutation.ts
@@ -0,0 +1,35 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { promiseSequence } from '@/portainer/helpers/promise-utils';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import {
+  mutationOptions,
+  withError,
+  withInvalidate,
+} from '@/react-tools/react-query';
+
+import { EdgeJob } from '../types';
+import { buildUrl } from '../queries/build-url';
+import { queryKeys } from '../queries/query-keys';
+
+export function useDeleteEdgeJobsMutation() {
+  const queryClient = useQueryClient();
+  return useMutation(
+    (edgeJobIds: Array<EdgeJob['Id']>) =>
+      promiseSequence(
+        edgeJobIds.map((edgeJobId) => () => deleteEdgeJob(edgeJobId))
+      ),
+    mutationOptions(
+      withError('Unable to delete Edge job(s)'),
+      withInvalidate(queryClient, [queryKeys.base()])
+    )
+  );
+}
+
+async function deleteEdgeJob(id: EdgeJob['Id']) {
+  try {
+    await axios.delete(buildUrl({ id }));
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to delete edge job');
+  }
+}
diff --git a/app/react/edge/edge-jobs/components/EdgeJobForm/AdvancedCronFieldset.tsx b/app/react/edge/edge-jobs/components/EdgeJobForm/AdvancedCronFieldset.tsx
new file mode 100644
index 0000000..ed8feaa
--- /dev/null
+++ b/app/react/edge/edge-jobs/components/EdgeJobForm/AdvancedCronFieldset.tsx
@@ -0,0 +1,40 @@
+import { useField } from 'formik';
+import { string } from 'yup';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+
+import { TimeTip } from './TimeTip';
+
+export function AdvancedCronFieldset() {
+  const [{ value, onChange, name, onBlur }, { error }] =
+    useField<string>('cronExpression');
+
+  return (
+    <>
+      <FormControl label="Cron rule" inputId="edge_job_cron" errors={error}>
+        <Input
+          data-cy="edge-job-cron-input"
+          id="edge_job_cron"
+          placeholder="e.g. 0 2 * * *"
+          required
+          value={value}
+          onChange={onChange}
+          name={name}
+          onBlur={onBlur}
+        />
+      </FormControl>
+
+      <TimeTip />
+    </>
+  );
+}
+/** https://regexr.com/573i2 */
+const cronRegex =
+  /(@(annually|yearly|monthly|weekly|daily|hourly|reboot))|(@every (\d+(ns|us|µs|ms|s|m|h))+)|((((\d+,)+\d+|(\d+(\/|-)\d+)|\d+|\*) ){4,6}((\d+,)+\d+|(\d+(\/|-)\d+)|\d+|\*))/;
+
+export function cronValidation() {
+  return string()
+    .default('')
+    .matches(cronRegex, 'This field format is invalid.');
+}
diff --git a/app/react/edge/edge-jobs/components/EdgeJobForm/BasicCronFieldset.tsx b/app/react/edge/edge-jobs/components/EdgeJobForm/BasicCronFieldset.tsx
new file mode 100644
index 0000000..ccbad21
--- /dev/null
+++ b/app/react/edge/edge-jobs/components/EdgeJobForm/BasicCronFieldset.tsx
@@ -0,0 +1,32 @@
+import { useFormikContext } from 'formik';
+
+import { SwitchField } from '@@/form-components/SwitchField';
+
+import { FormValues } from '../../CreateView/types';
+
+import { RecurringFieldset, defaultCronExpression } from './RecurringFieldset';
+import { ScheduledDateFieldset } from './ScheduledDateFieldset';
+
+export function BasicCronFieldset() {
+  const { values, setFieldValue } = useFormikContext<FormValues>();
+  return (
+    <>
+      <div className="form-group">
+        <div className="col-sm-12">
+          <SwitchField
+            label="Recurring Edge job"
+            checked={values.recurring}
+            onChange={(value) => {
+              setFieldValue('recurring', value);
+              if (value) {
+                setFieldValue('recurringOption', defaultCronExpression);
+              }
+            }}
+            data-cy="edgeJobCreate-recurringSwitch"
+          />
+        </div>
+      </div>
+      {values.recurring ? <RecurringFieldset /> : <ScheduledDateFieldset />}
+    </>
+  );
+}
diff --git a/app/react/edge/edge-jobs/components/EdgeJobForm/JobConfigurationFieldset.tsx b/app/react/edge/edge-jobs/components/EdgeJobForm/JobConfigurationFieldset.tsx
new file mode 100644
index 0000000..f8f1c76
--- /dev/null
+++ b/app/react/edge/edge-jobs/components/EdgeJobForm/JobConfigurationFieldset.tsx
@@ -0,0 +1,56 @@
+import { useFormikContext } from 'formik';
+import { Calendar, Edit } from 'lucide-react';
+
+import { FormSection } from '@@/form-components/FormSection';
+import { BoxSelector, BoxSelectorOption } from '@@/BoxSelector';
+
+import { FormValues } from '../../CreateView/types';
+
+import { AdvancedCronFieldset } from './AdvancedCronFieldset';
+import { BasicCronFieldset } from './BasicCronFieldset';
+
+export const cronMethodOptions: ReadonlyArray<BoxSelectorOption<string>> = [
+  {
+    id: 'config_basic',
+    value: 'basic',
+    icon: Calendar,
+    iconType: 'badge',
+    label: 'Basic configuration',
+    description: 'Select date from calendar',
+  },
+  {
+    id: 'config_advanced',
+    value: 'advanced',
+    icon: Edit,
+    iconType: 'badge',
+    label: 'Advanced configuration',
+    description: 'Write your own cron rule',
+  },
+] as const;
+
+export function JobConfigurationFieldset() {
+  const { values, setFieldValue } = useFormikContext<FormValues>();
+
+  return (
+    <>
+      <FormSection title="Edge job configuration">
+        <BoxSelector
+          slim
+          radioName="configuration"
+          value={values.cronMethod}
+          options={cronMethodOptions}
+          onChange={(value) => {
+            setFieldValue('cronMethod', value);
+            setFieldValue('cronExpression', '');
+          }}
+        />
+      </FormSection>
+
+      {values.cronMethod === 'basic' ? (
+        <BasicCronFieldset />
+      ) : (
+        <AdvancedCronFieldset />
+      )}
+    </>
+  );
+}
diff --git a/app/react/edge/edge-jobs/components/EdgeJobForm/NameField.tsx b/app/react/edge/edge-jobs/components/EdgeJobForm/NameField.tsx
new file mode 100644
index 0000000..3ca9e19
--- /dev/null
+++ b/app/react/edge/edge-jobs/components/EdgeJobForm/NameField.tsx
@@ -0,0 +1,46 @@
+import { Field, FormikErrors } from 'formik';
+import { string } from 'yup';
+import { useMemo } from 'react';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+
+import { useEdgeJobs } from '../../queries/useEdgeJobs';
+import { EdgeJob } from '../../types';
+
+export function NameField({ errors }: { errors?: FormikErrors<string> }) {
+  return (
+    <FormControl label="Name" required errors={errors} inputId="edgejob_name">
+      <Field
+        as={Input}
+        name="name"
+        placeholder="e.g. backup-app-prod"
+        data-cy="edgejob-name-input"
+        id="edgejob_name"
+      />
+    </FormControl>
+  );
+}
+
+export function useNameValidation(id?: EdgeJob['Id']) {
+  const edgeJobsQuery = useEdgeJobs();
+
+  return useMemo(
+    () =>
+      string()
+        .required('Name is required')
+        .matches(
+          /^[a-zA-Z0-9][a-zA-Z0-9_.-]+$/,
+          'Allowed characters are: [a-zA-Z0-9_.-]'
+        )
+        .test({
+          name: 'is-unique',
+          test: (value) =>
+            !edgeJobsQuery.data?.find(
+              (job) => job.Name === value && job.Id !== id
+            ),
+          message: 'Name must be unique',
+        }),
+    [edgeJobsQuery.data, id]
+  );
+}
diff --git a/app/react/edge/edge-jobs/components/EdgeJobForm/RecurringFieldset.tsx b/app/react/edge/edge-jobs/components/EdgeJobForm/RecurringFieldset.tsx
new file mode 100644
index 0000000..807edb2
--- /dev/null
+++ b/app/react/edge/edge-jobs/components/EdgeJobForm/RecurringFieldset.tsx
@@ -0,0 +1,40 @@
+import { useField } from 'formik';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { Select } from '@@/form-components/Input';
+
+export const defaultCronExpression = '0 * * * *' as const;
+
+export const timeOptions = [
+  {
+    label: 'Every hour',
+    value: defaultCronExpression,
+  },
+  {
+    label: 'Every 2 hours',
+    value: '0 */2 * * *',
+  },
+  {
+    label: 'Every day',
+    value: '0 0 * * *',
+  },
+] as const;
+
+export function RecurringFieldset() {
+  const [{ value, onChange, name, onBlur }, { error }] =
+    useField<string>('recurringOption');
+
+  return (
+    <FormControl label="Edge job time" inputId="edge_job_value" errors={error}>
+      <Select
+        id="edge_job_value"
+        data-cy="edge-job-time-select"
+        name={name}
+        options={timeOptions}
+        value={value}
+        onChange={onChange}
+        onBlur={onBlur}
+      />
+    </FormControl>
+  );
+}
diff --git a/app/react/edge/edge-jobs/components/EdgeJobForm/ScheduledDateFieldset.tsx b/app/react/edge/edge-jobs/components/EdgeJobForm/ScheduledDateFieldset.tsx
new file mode 100644
index 0000000..64f95ef
--- /dev/null
+++ b/app/react/edge/edge-jobs/components/EdgeJobForm/ScheduledDateFieldset.tsx
@@ -0,0 +1,25 @@
+import { useField } from 'formik';
+
+import { DateTimeField } from '@@/DateTimeField';
+
+import { TimeTip } from './TimeTip';
+
+export function ScheduledDateFieldset() {
+  const [{ value }, { error }, { setValue }] = useField<Date | null>(
+    'dateTime'
+  );
+  return (
+    <>
+      <DateTimeField
+        value={value}
+        onChange={(date) => setValue(date)}
+        error={error}
+        label="Scheduled date"
+        name="dateTime"
+        data-cy="edge-job-date-time-picker"
+      />
+
+      <TimeTip />
+    </>
+  );
+}
diff --git a/app/react/edge/edge-jobs/components/EdgeJobForm/TimeTip.tsx b/app/react/edge/edge-jobs/components/EdgeJobForm/TimeTip.tsx
new file mode 100644
index 0000000..5ccc270
--- /dev/null
+++ b/app/react/edge/edge-jobs/components/EdgeJobForm/TimeTip.tsx
@@ -0,0 +1,9 @@
+import { TextTip } from '@@/Tip/TextTip';
+
+export function TimeTip() {
+  return (
+    <TextTip color="blue">
+      Time should be set according to the chosen environments&apos; timezone.
+    </TextTip>
+  );
+}
diff --git a/app/react/edge/edge-jobs/components/EdgeJobForm/parseRecurringValues.ts b/app/react/edge/edge-jobs/components/EdgeJobForm/parseRecurringValues.ts
new file mode 100644
index 0000000..91e3ddb
--- /dev/null
+++ b/app/react/edge/edge-jobs/components/EdgeJobForm/parseRecurringValues.ts
@@ -0,0 +1,79 @@
+import { addHours, getDate, getHours, getMinutes, getMonth } from 'date-fns';
+import moment from 'moment';
+
+import { defaultCronExpression, timeOptions } from './RecurringFieldset';
+
+interface RecurringViewModel {
+  cronMethod: 'basic' | 'advanced';
+  cronExpression: string;
+  recurring: boolean;
+  recurringOption: (typeof timeOptions)[number]['value'];
+  dateTime: Date;
+}
+
+interface RecurringRequestModel {
+  recurring: boolean;
+  cronExpression: string;
+}
+
+export function toRecurringRequest(
+  values: RecurringViewModel
+): RecurringRequestModel {
+  if (values.cronMethod !== 'basic') {
+    return {
+      recurring: true,
+      cronExpression: values.cronExpression,
+    };
+  }
+
+  if (values.recurring) {
+    return {
+      recurring: true,
+      cronExpression: values.recurringOption,
+    };
+  }
+
+  return {
+    recurring: false,
+    cronExpression: dateTimeToCron(values.dateTime),
+  };
+
+  function dateTimeToCron(date: Date) {
+    return [
+      getMinutes(date),
+      getHours(date),
+      getDate(date),
+      getMonth(date) + 1,
+      '*',
+    ].join(' ');
+  }
+}
+
+export function toRecurringViewModel(
+  { cronExpression, recurring }: RecurringRequestModel = {
+    cronExpression: defaultCronExpression,
+    recurring: true,
+  }
+): RecurringViewModel {
+  const defaultTime = addHours(new Date(), 1);
+  const scheduled = timeOptions.find((v) => v.value === cronExpression);
+
+  return {
+    recurring,
+    cronExpression,
+    recurringOption: scheduled?.value || defaultCronExpression,
+    cronMethod: recurring && !scheduled ? 'advanced' : 'basic',
+    dateTime: cronExpression
+      ? cronToDateTime(cronExpression, defaultTime)
+      : defaultTime,
+  };
+}
+
+function cronToDateTime(cron: string, defaultTime: Date): Date {
+  const strings = cron.split(' ');
+  if (strings.length > 4) {
+    return moment(cron, 'm H D M').toDate();
+  }
+
+  return defaultTime;
+}
diff --git a/app/react/edge/edge-jobs/queries/build-url.ts b/app/react/edge/edge-jobs/queries/build-url.ts
new file mode 100644
index 0000000..5af8083
--- /dev/null
+++ b/app/react/edge/edge-jobs/queries/build-url.ts
@@ -0,0 +1,10 @@
+import { EdgeJob } from '../types';
+
+export function buildUrl({
+  action,
+  id,
+}: { id?: EdgeJob['Id']; action?: string } = {}) {
+  const baseUrl = '/edge_jobs';
+  const url = id ? `${baseUrl}/${id}` : baseUrl;
+  return action ? `${url}/${action}` : url;
+}
diff --git a/app/react/edge/edge-jobs/queries/jobResults/build-url.ts b/app/react/edge/edge-jobs/queries/jobResults/build-url.ts
new file mode 100644
index 0000000..fc377b9
--- /dev/null
+++ b/app/react/edge/edge-jobs/queries/jobResults/build-url.ts
@@ -0,0 +1,22 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { EdgeJob } from '../../types';
+import { buildUrl as buildEdgeJobUrl } from '../build-url';
+
+export function buildUrl({
+  action,
+  id,
+  taskId,
+}: {
+  id: EdgeJob['Id'];
+  action?: 'logs';
+  taskId?: EnvironmentId;
+}) {
+  const baseUrl = buildEdgeJobUrl({ id, action: 'tasks' });
+
+  if (taskId) {
+    return `${baseUrl}/${taskId}/${action}`;
+  }
+
+  return baseUrl;
+}
diff --git a/app/react/edge/edge-jobs/queries/jobResults/query-keys.ts b/app/react/edge/edge-jobs/queries/jobResults/query-keys.ts
new file mode 100644
index 0000000..2f56a1c
--- /dev/null
+++ b/app/react/edge/edge-jobs/queries/jobResults/query-keys.ts
@@ -0,0 +1,7 @@
+import { EdgeJob } from '../../types';
+import { queryKeys as edgeJobQueryKeys } from '../query-keys';
+
+export const queryKeys = {
+  base: (id: EdgeJob['Id']) =>
+    [...edgeJobQueryKeys.item(id), 'results'] as const,
+};
diff --git a/app/react/edge/edge-jobs/queries/jobResults/useClearLogsMutation.ts b/app/react/edge/edge-jobs/queries/jobResults/useClearLogsMutation.ts
new file mode 100644
index 0000000..d8ad94b
--- /dev/null
+++ b/app/react/edge/edge-jobs/queries/jobResults/useClearLogsMutation.ts
@@ -0,0 +1,30 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { withInvalidate } from '@/react-tools/react-query';
+
+import { EdgeJob } from '../../types';
+
+import { buildUrl } from './build-url';
+import { queryKeys } from './query-keys';
+
+export function useClearLogsMutation(id: EdgeJob['Id']) {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: (environmentId: EnvironmentId) =>
+      clearLogsMutation(id, environmentId),
+    ...withInvalidate(queryClient, [queryKeys.base(id)]),
+  });
+}
+
+async function clearLogsMutation(
+  id: EdgeJob['Id'],
+  environmentId: EnvironmentId
+) {
+  try {
+    await axios.delete(buildUrl({ id, action: 'logs', taskId: environmentId }));
+  } catch (err) {
+    throw parseAxiosError(err, 'Failed clearing edge job result logs');
+  }
+}
diff --git a/app/react/edge/edge-jobs/queries/jobResults/useCollectLogsMutation.ts b/app/react/edge/edge-jobs/queries/jobResults/useCollectLogsMutation.ts
new file mode 100644
index 0000000..9f96ded
--- /dev/null
+++ b/app/react/edge/edge-jobs/queries/jobResults/useCollectLogsMutation.ts
@@ -0,0 +1,30 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { withInvalidate } from '@/react-tools/react-query';
+
+import { EdgeJob } from '../../types';
+
+import { buildUrl } from './build-url';
+import { queryKeys } from './query-keys';
+
+export function useCollectLogsMutation(id: EdgeJob['Id']) {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: (environmentId: EnvironmentId) =>
+      collectLogsMutation(id, environmentId),
+    ...withInvalidate(queryClient, [queryKeys.base(id)]),
+  });
+}
+
+async function collectLogsMutation(
+  id: EdgeJob['Id'],
+  environmentId: EnvironmentId
+) {
+  try {
+    await axios.post(buildUrl({ id, action: 'logs', taskId: environmentId }));
+  } catch (err) {
+    throw parseAxiosError(err, 'Unable to collect logs');
+  }
+}
diff --git a/app/react/edge/edge-jobs/queries/jobResults/useDownloadLogsMutation.ts b/app/react/edge/edge-jobs/queries/jobResults/useDownloadLogsMutation.ts
new file mode 100644
index 0000000..8921a49
--- /dev/null
+++ b/app/react/edge/edge-jobs/queries/jobResults/useDownloadLogsMutation.ts
@@ -0,0 +1,39 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+import { saveAs } from 'file-saver';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { withInvalidate } from '@/react-tools/react-query';
+
+import { EdgeJob } from '../../types';
+
+import { buildUrl } from './build-url';
+import { queryKeys } from './query-keys';
+
+export function useDownloadLogsMutation(id: EdgeJob['Id']) {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: (environmentId: EnvironmentId) =>
+      downloadLogsMutation(id, environmentId),
+    ...withInvalidate(queryClient, [queryKeys.base(id)]),
+  });
+}
+
+async function downloadLogsMutation(
+  id: EdgeJob['Id'],
+  environmentId: EnvironmentId
+) {
+  try {
+    const { data } = await axios.get<{ FileContent: string }>(
+      buildUrl({ id, action: 'logs', taskId: environmentId })
+    );
+    const downloadData = new Blob([data.FileContent], {
+      type: 'text/plain;charset=utf-8',
+    });
+    const logFileName = `job_${id}_task_${environmentId}.log`;
+    saveAs(downloadData, logFileName);
+    return data;
+  } catch (err) {
+    throw parseAxiosError(err, 'Unable to download file');
+  }
+}
diff --git a/app/react/edge/edge-jobs/queries/jobResults/useJobResults.ts b/app/react/edge/edge-jobs/queries/jobResults/useJobResults.ts
new file mode 100644
index 0000000..a7588d1
--- /dev/null
+++ b/app/react/edge/edge-jobs/queries/jobResults/useJobResults.ts
@@ -0,0 +1,55 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import {
+  PaginatedResults,
+  withPaginationHeaders,
+} from '@/react/common/api/pagination.types';
+import {
+  BaseQueryOptions,
+  BaseQueryParams,
+  queryParamsFromQueryOptions,
+} from '@/react/common/api/listQueryParams';
+
+import { EdgeJob, JobResult } from '../../types';
+import { sortOptions } from '../../ItemView/ResultsDatatable/columns';
+
+import { queryKeys } from './query-keys';
+
+type QueryOptions = BaseQueryOptions<typeof sortOptions>;
+
+type RefetchInterval =
+  | number
+  | false
+  | ((data: PaginatedResults<Array<JobResult>> | undefined) => number | false);
+
+export function useJobResults(
+  id: EdgeJob['Id'],
+  {
+    refetchInterval,
+    ...query
+  }: {
+    refetchInterval?: RefetchInterval;
+  } & QueryOptions = {}
+) {
+  return useQuery({
+    queryKey: [...queryKeys.base(id), query],
+    queryFn: () => getJobResults(id, queryParamsFromQueryOptions(query)),
+    refetchInterval,
+  });
+}
+
+type QueryParams = BaseQueryParams<typeof sortOptions>;
+
+async function getJobResults(id: EdgeJob['Id'], params?: QueryParams) {
+  try {
+    const response = await axios.get<Array<JobResult>>(
+      `edge_jobs/${id}/tasks`,
+      { params }
+    );
+
+    return withPaginationHeaders(response);
+  } catch (err) {
+    throw parseAxiosError(err, 'Failed fetching edge job results');
+  }
+}
diff --git a/app/react/edge/edge-jobs/queries/query-keys.ts b/app/react/edge/edge-jobs/queries/query-keys.ts
new file mode 100644
index 0000000..dd4a6c3
--- /dev/null
+++ b/app/react/edge/edge-jobs/queries/query-keys.ts
@@ -0,0 +1,7 @@
+import { EdgeJob } from '../types';
+
+export const queryKeys = {
+  base: () => ['edge', 'jobs'] as const,
+  item: (id: EdgeJob['Id']) => [...queryKeys.base(), id] as const,
+  file: (id: EdgeJob['Id']) => [...queryKeys.item(id), 'file'] as const,
+};
diff --git a/app/react/edge/edge-jobs/queries/useCreateEdgeJobMutation/createJobFromFile.ts b/app/react/edge/edge-jobs/queries/useCreateEdgeJobMutation/createJobFromFile.ts
new file mode 100644
index 0000000..822c268
--- /dev/null
+++ b/app/react/edge/edge-jobs/queries/useCreateEdgeJobMutation/createJobFromFile.ts
@@ -0,0 +1,37 @@
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EdgeGroup } from '@/react/edge/edge-groups/types';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { json2formData } from '@/portainer/helpers/json';
+
+import { EdgeJob } from '../../types';
+import { buildUrl } from '../build-url';
+
+/**
+ * Payload to create an EdgeJob from a file
+ */
+export type FileUploadPayload = {
+  Name: string;
+  CronExpression: string;
+  Recurring: boolean;
+
+  EdgeGroups: Array<EdgeGroup['Id']>;
+  Endpoints: Array<EnvironmentId>;
+  File: File;
+};
+
+export async function createJobFromFile(payload: FileUploadPayload) {
+  try {
+    const { data } = await axios.post<EdgeJob>(
+      buildUrl({ action: 'create/file' }),
+      json2formData(payload),
+      {
+        headers: {
+          'Content-Type': 'multipart/form-data',
+        },
+      }
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e as Error);
+  }
+}
diff --git a/app/react/edge/edge-jobs/queries/useCreateEdgeJobMutation/createJobFromFileContent.ts b/app/react/edge/edge-jobs/queries/useCreateEdgeJobMutation/createJobFromFileContent.ts
new file mode 100644
index 0000000..f3965bc
--- /dev/null
+++ b/app/react/edge/edge-jobs/queries/useCreateEdgeJobMutation/createJobFromFileContent.ts
@@ -0,0 +1,31 @@
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EdgeGroup } from '@/react/edge/edge-groups/types';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { EdgeJob } from '../../types';
+import { buildUrl } from '../build-url';
+
+/**
+ * Payload for creating an EdgeJob from a string
+ */
+export interface FileContentPayload {
+  name: string;
+  cronExpression: string;
+  recurring: boolean;
+
+  edgeGroups: Array<EdgeGroup['Id']>;
+  endpoints: Array<EnvironmentId>;
+  fileContent: string;
+}
+
+export async function createJobFromFileContent(payload: FileContentPayload) {
+  try {
+    const { data } = await axios.post<EdgeJob>(
+      buildUrl({ action: 'create/string' }),
+      payload
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e as Error);
+  }
+}
diff --git a/app/react/edge/edge-jobs/queries/useCreateEdgeJobMutation/useCreateEdgeJobMutation.ts b/app/react/edge/edge-jobs/queries/useCreateEdgeJobMutation/useCreateEdgeJobMutation.ts
new file mode 100644
index 0000000..2b62b5c
--- /dev/null
+++ b/app/react/edge/edge-jobs/queries/useCreateEdgeJobMutation/useCreateEdgeJobMutation.ts
@@ -0,0 +1,69 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { EdgeGroup } from '@/react/edge/edge-groups/types';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { withInvalidate } from '@/react-tools/react-query';
+
+import { queryKeys } from '../query-keys';
+
+import { createJobFromFile } from './createJobFromFile';
+import { createJobFromFileContent } from './createJobFromFileContent';
+
+export function useCreateEdgeJobMutation() {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: createEdgeJob,
+    ...withInvalidate(queryClient, [queryKeys.base()]),
+  });
+}
+
+export type BasePayload = {
+  name: string;
+  cronExpression: string;
+  recurring: boolean;
+
+  edgeGroups: Array<EdgeGroup['Id']>;
+  endpoints: Array<EnvironmentId>;
+};
+
+export type CreateEdgeJobPayload =
+  | {
+      method: 'file';
+      payload: BasePayload & {
+        /** File to upload */
+        file: File;
+      };
+    }
+  | {
+      method: 'string';
+      payload: BasePayload & {
+        /** Content of the Job file */
+        fileContent: string;
+      };
+    };
+
+function createEdgeJob({ method, payload }: CreateEdgeJobPayload) {
+  switch (method) {
+    case 'file':
+      return createJobFromFile({
+        CronExpression: payload.cronExpression,
+        Recurring: payload.recurring,
+        Name: payload.name,
+        EdgeGroups: payload.edgeGroups,
+        Endpoints: payload.endpoints,
+        File: payload.file,
+      });
+
+    case 'string':
+      return createJobFromFileContent({
+        cronExpression: payload.cronExpression,
+        recurring: payload.recurring,
+        name: payload.name,
+        edgeGroups: payload.edgeGroups,
+        endpoints: payload.endpoints,
+        fileContent: payload.fileContent,
+      });
+    default:
+      throw new Error('Invalid method');
+  }
+}
diff --git a/app/react/edge/edge-jobs/queries/useEdgeJob.ts b/app/react/edge/edge-jobs/queries/useEdgeJob.ts
new file mode 100644
index 0000000..baefa08
--- /dev/null
+++ b/app/react/edge/edge-jobs/queries/useEdgeJob.ts
@@ -0,0 +1,33 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { EdgeJob } from '../types';
+
+import { buildUrl } from './build-url';
+import { queryKeys } from './query-keys';
+
+export interface EdgeJobResponse extends Omit<EdgeJob, 'Endpoints'> {
+  Endpoints: Array<EnvironmentId> | null;
+}
+
+async function getEdgeJob(id: EdgeJobResponse['Id']) {
+  try {
+    const { data } = await axios.get<EdgeJobResponse>(buildUrl({ id }));
+    return data;
+  } catch (err) {
+    throw parseAxiosError(err, 'Failed fetching edge job');
+  }
+}
+
+export function useEdgeJob<T = EdgeJobResponse>(
+  id: EdgeJobResponse['Id'],
+  {
+    select,
+  }: {
+    select?: (job: EdgeJobResponse) => T;
+  } = {}
+) {
+  return useQuery(queryKeys.item(id), () => getEdgeJob(id), { select });
+}
diff --git a/app/react/edge/edge-jobs/queries/useEdgeJobFile.ts b/app/react/edge/edge-jobs/queries/useEdgeJobFile.ts
new file mode 100644
index 0000000..a36bbe1
--- /dev/null
+++ b/app/react/edge/edge-jobs/queries/useEdgeJobFile.ts
@@ -0,0 +1,28 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { EdgeJob } from '../types';
+
+import { buildUrl } from './build-url';
+import { queryKeys } from './query-keys';
+
+export interface EdgeJobResponse extends Omit<EdgeJob, 'Endpoints'> {
+  Endpoints: Array<EnvironmentId>;
+}
+
+async function getEdgeJobFile(id: EdgeJobResponse['Id']) {
+  try {
+    const { data } = await axios.get<{ FileContent: string }>(
+      buildUrl({ id, action: 'file' })
+    );
+    return data.FileContent;
+  } catch (err) {
+    throw parseAxiosError(err, 'Failed fetching edge job file');
+  }
+}
+
+export function useEdgeJobFile(id: EdgeJobResponse['Id']) {
+  return useQuery(queryKeys.file(id), () => getEdgeJobFile(id));
+}
diff --git a/app/react/edge/edge-jobs/queries/useEdgeJobs.ts b/app/react/edge/edge-jobs/queries/useEdgeJobs.ts
new file mode 100644
index 0000000..06e05c3
--- /dev/null
+++ b/app/react/edge/edge-jobs/queries/useEdgeJobs.ts
@@ -0,0 +1,25 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { EdgeJob } from '../types';
+
+import { buildUrl } from './build-url';
+import { queryKeys } from './query-keys';
+
+async function getEdgeJobs() {
+  try {
+    const { data } = await axios.get<EdgeJob[]>(buildUrl());
+    return data;
+  } catch (err) {
+    throw parseAxiosError(err as Error, 'Failed fetching edge jobs');
+  }
+}
+
+export function useEdgeJobs<T = EdgeJob[]>({
+  select,
+}: {
+  select?: (jobs: EdgeJob[]) => T;
+} = {}) {
+  return useQuery(queryKeys.base(), getEdgeJobs, { select });
+}
diff --git a/app/react/edge/edge-jobs/queries/useUpdateEdgeJobMutation.tsx b/app/react/edge/edge-jobs/queries/useUpdateEdgeJobMutation.tsx
new file mode 100644
index 0000000..7fb35aa
--- /dev/null
+++ b/app/react/edge/edge-jobs/queries/useUpdateEdgeJobMutation.tsx
@@ -0,0 +1,41 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withInvalidate } from '@/react-tools/react-query';
+
+import { EdgeGroup } from '../../edge-groups/types';
+
+import { queryKeys } from './query-keys';
+
+export interface UpdatePayload {
+  name?: string;
+  cronExpression?: string;
+  recurring?: boolean;
+  endpoints?: Array<EnvironmentId>;
+  edgeGroups?: Array<EdgeGroup['Id']>;
+  fileContent?: string;
+}
+
+export function useUpdateEdgeJobMutation() {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: updateEdgeJob,
+    ...withInvalidate(queryClient, [queryKeys.base()]),
+  });
+}
+
+async function updateEdgeJob({
+  id,
+  payload,
+}: {
+  id: number;
+  payload: UpdatePayload;
+}) {
+  try {
+    await axios.put(`/edge_jobs/${id}`, payload);
+  } catch (error) {
+    throw parseAxiosError(error);
+  }
+}
diff --git a/app/react/edge/edge-jobs/types.ts b/app/react/edge/edge-jobs/types.ts
new file mode 100644
index 0000000..2278204
--- /dev/null
+++ b/app/react/edge/edge-jobs/types.ts
@@ -0,0 +1,36 @@
+import {
+  Environment,
+  EnvironmentId,
+} from '@/react/portainer/environments/types';
+
+export interface EdgeJob {
+  Id: number;
+  Created: number;
+  CronExpression: string;
+  Endpoints: Record<EnvironmentId, EndpointMeta>;
+  EdgeGroups: number[] | null;
+  Name: string;
+  ScriptPath: string;
+  Recurring: boolean;
+  Version: number;
+  /** Field used for log collection of Endpoints belonging to EdgeGroups */
+  GroupLogsCollection: Record<EnvironmentId, EndpointMeta>;
+}
+
+export enum LogsStatus {
+  Idle = 1,
+  Pending = 2,
+  Collected = 3,
+}
+
+interface EndpointMeta {
+  LogsStatus: LogsStatus;
+  CollectLogs: boolean;
+}
+
+export interface JobResult {
+  Id: string;
+  EndpointId: EnvironmentId;
+  EndpointName: Environment['Name'];
+  LogsStatus: LogsStatus;
+}
diff --git a/app/react/edge/edge-stacks/CreateView/CreateForm.tsx b/app/react/edge/edge-stacks/CreateView/CreateForm.tsx
new file mode 100644
index 0000000..cd74031
--- /dev/null
+++ b/app/react/edge/edge-stacks/CreateView/CreateForm.tsx
@@ -0,0 +1,180 @@
+import { Formik } from 'formik';
+import { useState, useMemo } from 'react';
+
+import { toGitFormModel } from '@/react/portainer/gitops/types';
+import { getDefaultRelativePathModel } from '@/react/portainer/gitops/RelativePathFieldset/types';
+import { createWebhookId } from '@/portainer/helpers/webhookHelper';
+import {
+  CustomTemplate,
+  getTemplateSourceId,
+} from '@/react/portainer/templates/custom-templates/types';
+import { useCustomTemplate } from '@/react/portainer/templates/custom-templates/queries/useCustomTemplate';
+import { getVariablesFieldDefaultValues } from '@/react/portainer/custom-templates/components/CustomTemplatesVariablesField';
+import { useAppTemplate } from '@/react/portainer/templates/app-templates/queries/useAppTemplates';
+import { TemplateViewModel } from '@/react/portainer/templates/app-templates/view-model';
+import { getDefaultValues as getEnvVarDefaultValues } from '@/react/portainer/templates/app-templates/DeployFormWidget/EnvVarsFieldset';
+import { parseAutoUpdateResponse } from '@/react/portainer/gitops/AutoUpdateFieldset/utils';
+
+import { Widget } from '@@/Widget';
+
+import { DeploymentType } from '../types';
+import { getDefaultStaggerConfig } from '../components/StaggerFieldset.types';
+
+import { InnerForm } from './InnerForm';
+import { useValidation } from './CreateForm.validation';
+import { Values as TemplateValues } from './TemplateFieldset/types';
+import { getInitialTemplateValues } from './TemplateFieldset/TemplateFieldset';
+import { useTemplateParams } from './useTemplateParams';
+import { useCreate } from './useCreate';
+import { FormValues } from './types';
+
+export function CreateForm() {
+  const [webhookId] = useState(() => createWebhookId());
+
+  const [templateParams, setTemplateParams] = useTemplateParams();
+  const templateQuery = useTemplate(
+    templateParams.templateType,
+    templateParams.templateId
+  );
+
+  const validation = useValidation(templateQuery);
+  const mutation = useCreate({
+    webhookId,
+    template: templateQuery.customTemplate || templateQuery.appTemplate,
+    templateType: templateParams.templateType,
+  });
+
+  const initialValues = useInitialValues(templateQuery, templateParams);
+
+  if (!initialValues) {
+    return null;
+  }
+
+  return (
+    <div className="row">
+      <div className="col-sm-12">
+        <Widget>
+          <Widget.Body>
+            <Formik
+              initialValues={initialValues}
+              onSubmit={mutation.onSubmit}
+              validationSchema={validation}
+              validateOnMount
+            >
+              <InnerForm
+                webhookId={webhookId}
+                isLoading={mutation.isLoading}
+                onChangeTemplate={setTemplateParams}
+              />
+            </Formik>
+          </Widget.Body>
+        </Widget>
+      </div>
+    </div>
+  );
+}
+
+function getTemplateValues(
+  type: 'custom' | 'app' | undefined,
+  template: TemplateViewModel | CustomTemplate | undefined
+): TemplateValues {
+  if (!type || !template) {
+    return getInitialTemplateValues();
+  }
+
+  if (type === 'custom') {
+    const customTemplate = template as CustomTemplate;
+    return {
+      templateId: customTemplate.Id,
+      type,
+      variables: getVariablesFieldDefaultValues(customTemplate.Variables),
+      envVars: {},
+    };
+  }
+
+  const appTemplate = template as TemplateViewModel;
+
+  return {
+    templateId: appTemplate.Id,
+    type,
+    variables: [],
+    envVars: getEnvVarDefaultValues(appTemplate.Env),
+  };
+}
+
+function useTemplate(
+  type: 'app' | 'custom' | undefined,
+  id: number | undefined
+) {
+  const customTemplateQuery = useCustomTemplate(id, {
+    enabled: type === 'custom',
+  });
+  const appTemplateQuery = useAppTemplate(id, {
+    enabled: type === 'app',
+  });
+
+  return {
+    appTemplate: type === 'app' ? appTemplateQuery.data : undefined,
+    customTemplate: type === 'custom' ? customTemplateQuery.data : undefined,
+  };
+}
+
+function useInitialValues(
+  templateQuery: {
+    appTemplate: TemplateViewModel | undefined;
+    customTemplate: CustomTemplate | undefined;
+  },
+  templateParams: {
+    templateId: number | undefined;
+    templateType: 'app' | 'custom' | undefined;
+  }
+) {
+  const template = templateQuery.customTemplate || templateQuery.appTemplate;
+  const initialValues: FormValues = useMemo(
+    () => ({
+      name: '',
+      groupIds: [],
+      // if edge custom templates allow kube manifests/helm charts in future, add logic for setting this for the initial deploymentType
+      deploymentType: DeploymentType.Compose,
+      envVars: [],
+      privateRegistryId:
+        templateQuery.customTemplate?.EdgeSettings?.PrivateRegistryId ?? 0,
+      prePullImage:
+        templateQuery.customTemplate?.EdgeSettings?.PrePullImage ?? false,
+      retryDeploy:
+        templateQuery.customTemplate?.EdgeSettings?.RetryDeploy ?? false,
+      staggerConfig:
+        templateQuery.customTemplate?.EdgeSettings?.StaggerConfig ??
+        getDefaultStaggerConfig(),
+      method: templateParams.templateId ? 'template' : 'editor',
+      git: toGitFormModel(
+        getTemplateSourceId(templateQuery.customTemplate),
+        templateQuery.customTemplate?.GitConfig,
+        parseAutoUpdateResponse()
+      ),
+      relativePath:
+        templateQuery.customTemplate?.EdgeSettings?.RelativePathSettings ??
+        getDefaultRelativePathModel(),
+      enableWebhook: false,
+      fileContent: '',
+      templateValues: getTemplateValues(templateParams.templateType, template),
+      useManifestNamespaces: false,
+    }),
+    [
+      templateQuery.customTemplate,
+      templateParams.templateId,
+      templateParams.templateType,
+      template,
+    ]
+  );
+
+  if (
+    templateParams.templateId &&
+    !templateQuery.customTemplate &&
+    !templateQuery.appTemplate
+  ) {
+    return null;
+  }
+
+  return initialValues;
+}
diff --git a/app/react/edge/edge-stacks/CreateView/CreateForm.validation.ts b/app/react/edge/edge-stacks/CreateView/CreateForm.validation.ts
new file mode 100644
index 0000000..cf574af
--- /dev/null
+++ b/app/react/edge/edge-stacks/CreateView/CreateForm.validation.ts
@@ -0,0 +1,141 @@
+import {
+  SchemaOf,
+  array,
+  boolean,
+  lazy,
+  mixed,
+  number,
+  object,
+  string,
+} from 'yup';
+import { useMemo } from 'react';
+import Lazy from 'yup/lib/Lazy';
+
+import { buildGitValidationSchema } from '@/react/portainer/gitops/GitForm';
+import { relativePathValidation } from '@/react/portainer/gitops/RelativePathFieldset/validation';
+import { CustomTemplate } from '@/react/portainer/templates/custom-templates/types';
+import { TemplateViewModel } from '@/react/portainer/templates/app-templates/view-model';
+import {
+  DeployMethod,
+  GitFormModel,
+  RelativePathModel,
+} from '@/react/portainer/gitops/types';
+import { EnvironmentType } from '@/react/portainer/environments/types';
+
+import { envVarValidation } from '@@/form-components/EnvironmentVariablesFieldset';
+import { file } from '@@/form-components/yup-file-validation';
+
+import { DeploymentType } from '../types';
+import { staggerConfigValidation } from '../components/StaggerFieldset';
+import { createHasEnvironmentTypeFunction } from '../ItemView/EditEdgeStackForm/useEdgeGroupHasType';
+import { useEdgeGroups } from '../../edge-groups/queries/useEdgeGroups';
+
+import { FormValues, Method } from './types';
+import { templateFieldsetValidation } from './TemplateFieldset/validation';
+import { useNameValidation } from './NameField';
+
+export function useValidation({
+  appTemplate,
+  customTemplate,
+}: {
+  appTemplate: TemplateViewModel | undefined;
+  customTemplate: CustomTemplate | undefined;
+}): Lazy<SchemaOf<FormValues>> {
+  const nameValidation = useNameValidation();
+  const edgeGroupsQuery = useEdgeGroups();
+  const edgeGroups = edgeGroupsQuery.data;
+
+  return useMemo(
+    () =>
+      lazy((values: FormValues) =>
+        object({
+          method: mixed<Method>()
+            .oneOf(['editor', 'upload', 'repository', 'template'])
+            .required(),
+          name: nameValidation(values.groupIds),
+          groupIds: array(number().required())
+            .required()
+            .min(1, 'At least one Edge group is required'),
+          deploymentType: mixed<DeploymentType>()
+            .oneOf([DeploymentType.Compose, DeploymentType.Kubernetes])
+            .required()
+            .test(
+              'kubernetes-deployment-type-validation',
+              'Kubernetes deployment type is not compatible with the selected edge group(s), which contain Docker environments',
+              (value) => {
+                if (value !== DeploymentType.Kubernetes) {
+                  return true;
+                }
+
+                const hasType = createHasEnvironmentTypeFunction(
+                  values.groupIds,
+                  edgeGroups
+                );
+
+                const hasDockerEndpoint = hasType(
+                  EnvironmentType.EdgeAgentOnDocker
+                );
+
+                return !hasDockerEndpoint;
+              }
+            )
+            .test(
+              'compose-deployment-type-validation',
+              'Compose deployment type is not compatible with the selected edge group(s), which contain Kubernetes environments',
+              (value) => {
+                if (value !== DeploymentType.Compose) {
+                  return true;
+                }
+
+                const hasType = createHasEnvironmentTypeFunction(
+                  values.groupIds,
+                  edgeGroups
+                );
+
+                const hasKubeEndpoint = hasType(
+                  EnvironmentType.EdgeAgentOnKubernetes
+                );
+
+                return !hasKubeEndpoint;
+              }
+            ),
+          envVars: envVarValidation(),
+          privateRegistryId: number().default(0),
+          prePullImage: boolean().default(false),
+          retryDeploy: boolean().default(false),
+          enableWebhook: boolean().default(false),
+          staggerConfig: staggerConfigValidation(),
+          fileContent: string()
+            .default('')
+            .when('method', {
+              is: 'editor',
+              then: (schema) => schema.required('Config file is required'),
+            }),
+          file: file().when('method', {
+            is: 'upload',
+            then: (schema) => schema.required(),
+          }),
+          templateValues: templateFieldsetValidation({
+            customVariablesDefinitions: customTemplate?.Variables || [],
+            appTemplateVariablesDefinitions: appTemplate?.Env || [],
+          }),
+          git: mixed().when('method', {
+            is: 'repository',
+            then: () => {
+              const deploymentMethod: DeployMethod =
+                values.deploymentType === DeploymentType.Compose
+                  ? 'compose'
+                  : 'manifest';
+              return buildGitValidationSchema(deploymentMethod);
+            },
+          }) as SchemaOf<GitFormModel>,
+          relativePath: mixed().when('method', {
+            is: 'repository',
+            then: () => relativePathValidation(),
+          }) as SchemaOf<RelativePathModel>,
+          useManifestNamespaces: boolean().default(false),
+        })
+      ),
+    [appTemplate?.Env, customTemplate, edgeGroups, nameValidation]
+  );
+}
diff --git a/app/react/edge/edge-stacks/CreateView/CreateView.tsx b/app/react/edge/edge-stacks/CreateView/CreateView.tsx
new file mode 100644
index 0000000..b492dbf
--- /dev/null
+++ b/app/react/edge/edge-stacks/CreateView/CreateView.tsx
@@ -0,0 +1,20 @@
+import { PageHeader } from '@@/PageHeader';
+
+import { CreateForm } from './CreateForm';
+
+export function CreateView() {
+  return (
+    <>
+      <PageHeader
+        title="Create Edge Stack"
+        breadcrumbs={[
+          { label: 'Edge Stacks', link: 'edge.stacks' },
+          'Create Edge Stack',
+        ]}
+        reload
+      />
+
+      <CreateForm />
+    </>
+  );
+}
diff --git a/app/react/edge/edge-stacks/CreateView/DeploymentOptions.tsx b/app/react/edge/edge-stacks/CreateView/DeploymentOptions.tsx
new file mode 100644
index 0000000..133edbb
--- /dev/null
+++ b/app/react/edge/edge-stacks/CreateView/DeploymentOptions.tsx
@@ -0,0 +1,43 @@
+import { SwitchField } from '@@/form-components/SwitchField';
+
+import { FormValues } from './types';
+
+export function DeploymentOptions({
+  setFieldValue,
+  values,
+}: {
+  values: FormValues;
+  setFieldValue: <T>(field: string, value: T) => void;
+}) {
+  return (
+    <>
+      <div className="form-group">
+        <div className="col-sm-12">
+          <SwitchField
+            checked={values.prePullImage}
+            name="prePullImage"
+            label="Pre-pull images"
+            tooltip="When enabled, the image will be pre-pulled before deployment is started. This is useful in scenarios where the image download may be delayed or  intermittent and would subsequently cause the deployment to fail"
+            labelClass="col-sm-3 col-lg-2"
+            onChange={(value) => setFieldValue('prePullImage', value)}
+            data-cy="pre-pull-images-switch"
+          />
+        </div>
+      </div>
+
+      <div className="form-group">
+        <div className="col-sm-12">
+          <SwitchField
+            checked={values.retryDeploy}
+            name="retryDeploy"
+            label="Retry deployment"
+            tooltip="When enabled, this will allow the edge agent to retry deployment if failed to deploy initially"
+            labelClass="col-sm-3 col-lg-2"
+            onChange={(value) => setFieldValue('retryDeploy', value)}
+            data-cy="retry-deployment-switch"
+          />
+        </div>
+      </div>
+    </>
+  );
+}
diff --git a/app/react/edge/edge-stacks/CreateView/DockerComposeForm.tsx b/app/react/edge/edge-stacks/CreateView/DockerComposeForm.tsx
new file mode 100644
index 0000000..608e975
--- /dev/null
+++ b/app/react/edge/edge-stacks/CreateView/DockerComposeForm.tsx
@@ -0,0 +1,215 @@
+import { FormikErrors, useFormikContext } from 'formik';
+import { SetStateAction, useCallback } from 'react';
+
+import { GitForm } from '@/react/portainer/gitops/GitForm';
+import { baseEdgeStackWebhookUrl } from '@/portainer/helpers/webhookHelper';
+import { RelativePathFieldset } from '@/react/portainer/gitops/RelativePathFieldset/RelativePathFieldset';
+import { applySetStateAction } from '@/react-tools/apply-set-state-action';
+import { isBE } from '@/react/portainer/feature-flags/feature-flags.service';
+
+import { BoxSelector } from '@@/BoxSelector';
+import { FormSection } from '@@/form-components/FormSection';
+import {
+  editor,
+  git,
+  edgeStackTemplate,
+  upload,
+} from '@@/BoxSelector/common-options/build-methods';
+import { FileUploadForm } from '@@/form-components/FileUpload';
+
+import { TemplateFieldset } from './TemplateFieldset/TemplateFieldset';
+import { useRenderCustomTemplate } from './useRenderCustomTemplate';
+import { DockerFormValues } from './types';
+import { DockerContentField } from './DockerContentField';
+import { useRenderAppTemplate } from './useRenderAppTemplate';
+
+const buildMethods = [editor, upload, git, edgeStackTemplate] as const;
+
+interface Props {
+  webhookId: string;
+  onChangeTemplate: (change: {
+    templateType: 'app' | 'custom' | undefined;
+    templateId: number | undefined;
+  }) => void;
+}
+
+export function DockerComposeForm({ webhookId, onChangeTemplate }: Props) {
+  const { errors, values, setValues } = useFormikContext<DockerFormValues>();
+  const { method } = values;
+
+  const handleChange = useCallback(
+    (newValues: Partial<DockerFormValues>) => {
+      setValues((values) => ({
+        ...values,
+        ...newValues,
+      }));
+    },
+    [setValues]
+  );
+
+  const saveFileContent = useCallback(
+    (value: string) => {
+      handleChange({ fileContent: value });
+    },
+    [handleChange]
+  );
+
+  return (
+    <>
+      <FormSection title="Build Method">
+        <BoxSelector
+          options={buildMethods}
+          onChange={(value) => handleChange({ method: value })}
+          value={method}
+          radioName="method"
+          slim
+        />
+      </FormSection>
+
+      {method === edgeStackTemplate.value && (
+        <>
+          <TemplateFieldset
+            values={values.templateValues}
+            setValues={(templateAction) => {
+              const templateValues = applySetStateAction(
+                templateAction,
+                values.templateValues
+              );
+              onChangeTemplate({
+                templateId: templateValues.templateId,
+                templateType: templateValues.type,
+              });
+              setValues((values) => ({
+                ...values,
+                templateValues,
+              }));
+            }}
+            errors={errors?.templateValues}
+          />
+          {values.templateValues.type === 'app' && (
+            <AppTemplateContentField
+              values={values}
+              handleChange={handleChange}
+              errors={errors}
+              setValues={setValues}
+            />
+          )}
+          {values.templateValues.type === 'custom' && (
+            <CustomTemplateContentField
+              values={values}
+              handleChange={handleChange}
+              errors={errors}
+              setValues={setValues}
+            />
+          )}
+        </>
+      )}
+
+      {method === editor.value && (
+        <DockerContentField
+          value={values.fileContent}
+          onChange={saveFileContent}
+          error={errors?.fileContent}
+        />
+      )}
+
+      {method === upload.value && (
+        <FileUploadForm
+          value={values.file}
+          onChange={(File) => handleChange({ file: File })}
+          required
+          description="You can upload a Compose file from your computer."
+          data-cy="stack-creation-file-upload"
+        />
+      )}
+
+      {method === git.value && (
+        <>
+          <GitForm
+            errors={errors?.git}
+            value={values.git}
+            onChange={(gitValues) =>
+              setValues((values) => ({
+                ...values,
+                git: {
+                  ...values.git,
+                  ...gitValues,
+                },
+              }))
+            }
+            baseWebhookUrl={baseEdgeStackWebhookUrl()}
+            webhookId={webhookId}
+            isAutoUpdateVisible={isBE}
+          />
+
+          {isBE && (
+            <FormSection title="Advanced configurations">
+              <RelativePathFieldset
+                values={values.relativePath}
+                errors={errors.relativePath}
+                gitModel={values.git}
+                onChange={(relativePath) =>
+                  setValues((values) => ({
+                    ...values,
+                    relativePath: {
+                      ...values.relativePath,
+                      ...relativePath,
+                    },
+                  }))
+                }
+              />
+            </FormSection>
+          )}
+        </>
+      )}
+    </>
+  );
+}
+
+type TemplateContentFieldProps = {
+  values: DockerFormValues;
+  handleChange: (newValues: Partial<DockerFormValues>) => void;
+  errors?: FormikErrors<DockerFormValues>;
+  setValues: (values: SetStateAction<DockerFormValues>) => void;
+};
+
+function AppTemplateContentField({
+  values,
+  handleChange,
+  errors,
+  setValues,
+}: TemplateContentFieldProps) {
+  const { isInitialLoading } = useRenderAppTemplate(
+    values.templateValues,
+    setValues
+  );
+  return (
+    <DockerContentField
+      value={values.fileContent}
+      onChange={(value) => handleChange({ fileContent: value })}
+      error={errors?.fileContent}
+      isLoading={isInitialLoading}
+    />
+  );
+}
+
+function CustomTemplateContentField({
+  values,
+  handleChange,
+  errors,
+  setValues,
+}: TemplateContentFieldProps) {
+  const { customTemplate, isInitialLoading } = useRenderCustomTemplate(
+    values.templateValues,
+    setValues
+  );
+  return (
+    <DockerContentField
+      value={values.fileContent}
+      onChange={(value) => handleChange({ fileContent: value })}
+      error={errors?.fileContent}
+      readonly={!!customTemplate?.GitConfig}
+      isLoading={isInitialLoading}
+    />
+  );
+}
diff --git a/app/react/edge/edge-stacks/CreateView/DockerContentField.tsx b/app/react/edge/edge-stacks/CreateView/DockerContentField.tsx
new file mode 100644
index 0000000..7758b35
--- /dev/null
+++ b/app/react/edge/edge-stacks/CreateView/DockerContentField.tsx
@@ -0,0 +1,48 @@
+import { useDockerComposeSchema } from '@/react/hooks/useDockerComposeSchema/useDockerComposeSchema';
+
+import { InlineLoader } from '@@/InlineLoader';
+import { WebEditorForm } from '@@/WebEditorForm';
+
+export function DockerContentField({
+  error,
+  onChange,
+  readonly,
+  value,
+  isLoading,
+}: {
+  value: string;
+  onChange: (value: string) => void;
+  error?: string;
+  readonly?: boolean;
+  isLoading?: boolean;
+}) {
+  const dockerComposeSchemaQuery = useDockerComposeSchema();
+
+  if (isLoading || dockerComposeSchemaQuery.isInitialLoading) {
+    return <InlineLoader>Loading stack content...</InlineLoader>;
+  }
+
+  return (
+    <WebEditorForm
+      id="stack-creation-editor"
+      value={value}
+      onChange={onChange}
+      type="yaml"
+      textTip="Define or paste the content of your docker compose file here"
+      error={error}
+      readonly={readonly}
+      schema={dockerComposeSchemaQuery.data}
+      data-cy="stack-creation-editor"
+    >
+      You can get more information about Compose file format in the{' '}
+      <a
+        href="https://docs.docker.com/compose/compose-file/"
+        target="_blank"
+        rel="noreferrer"
+      >
+        official documentation
+      </a>
+      .
+    </WebEditorForm>
+  );
+}
diff --git a/app/react/edge/edge-stacks/CreateView/InnerForm.tsx b/app/react/edge/edge-stacks/CreateView/InnerForm.tsx
new file mode 100644
index 0000000..4335f09
--- /dev/null
+++ b/app/react/edge/edge-stacks/CreateView/InnerForm.tsx
@@ -0,0 +1,148 @@
+import { Form, useFormikContext } from 'formik';
+
+import { applySetStateAction } from '@/react-tools/apply-set-state-action';
+import { EnvironmentType } from '@/react/portainer/environments/types';
+import { isBE } from '@/react/portainer/feature-flags/feature-flags.service';
+
+import { EnvironmentVariablesPanel } from '@@/form-components/EnvironmentVariablesFieldset';
+import { FormActions } from '@@/form-components/FormActions';
+
+import { EdgeGroupsSelector } from '../components/EdgeGroupsSelector';
+import { EdgeStackDeploymentTypeSelector } from '../components/EdgeStackDeploymentTypeSelector';
+import { StaggerFieldset } from '../components/StaggerFieldset';
+import { PrivateRegistryFieldsetWrapper } from '../ItemView/EditEdgeStackForm/PrivateRegistryFieldsetWrapper';
+import { useEdgeGroupHasType } from '../ItemView/EditEdgeStackForm/useEdgeGroupHasType';
+import { DeploymentType } from '../types';
+
+import { DockerComposeForm } from './DockerComposeForm';
+import { KubeFormValues, KubeManifestForm } from './KubeManifestForm';
+import { NameField } from './NameField';
+import { WebhookSwitch } from './WebhookSwitch';
+import { FormValues } from './types';
+import { DeploymentOptions } from './DeploymentOptions';
+
+export function InnerForm({
+  webhookId,
+  isLoading,
+  onChangeTemplate,
+}: {
+  webhookId: string;
+  isLoading: boolean;
+  onChangeTemplate: ({
+    templateType,
+    templateId,
+  }: {
+    templateType: 'app' | 'custom' | undefined;
+    templateId: number | undefined;
+  }) => void;
+}) {
+  const { values, setFieldValue, errors, setValues, setFieldError, isValid } =
+    useFormikContext<FormValues>();
+  const { hasType } = useEdgeGroupHasType(values.groupIds);
+
+  const hasKubeEndpoint = hasType(EnvironmentType.EdgeAgentOnKubernetes);
+  const hasDockerEndpoint = hasType(EnvironmentType.EdgeAgentOnDocker);
+  const hasMultipleTypes = hasKubeEndpoint && hasDockerEndpoint;
+  const multipleTypesError = hasMultipleTypes
+    ? `There are no available deployment types when there is more than one
+          type of environment in your edge group selection (e.g. Kubernetes and
+          Docker environments). Please select edge groups that have environments
+          of the same type.`
+    : undefined;
+
+  return (
+    <Form className="form-horizontal" role="form">
+      <NameField
+        onChange={(value) => setFieldValue('name', value)}
+        value={values.name}
+        errors={errors.name}
+        placeholder="e.g. my-stack"
+      />
+
+      <EdgeGroupsSelector
+        value={values.groupIds}
+        onChange={(value) => setFieldValue('groupIds', value)}
+        error={errors.groupIds || multipleTypesError}
+      />
+
+      <EdgeStackDeploymentTypeSelector
+        value={values.deploymentType}
+        hasDockerEndpoint={hasDockerEndpoint}
+        hasKubeEndpoint={hasKubeEndpoint}
+        onChange={(value) => setFieldValue('deploymentType', value)}
+        error={errors.deploymentType}
+      />
+
+      {values.deploymentType === DeploymentType.Compose && (
+        <DockerComposeForm
+          webhookId={webhookId}
+          onChangeTemplate={onChangeTemplate}
+        />
+      )}
+
+      {values.deploymentType === DeploymentType.Kubernetes && (
+        <KubeManifestForm
+          values={values as KubeFormValues}
+          webhookId={webhookId}
+          errors={errors}
+          setValues={(kubeValues) =>
+            setValues((values) => ({
+              ...values,
+              ...applySetStateAction(kubeValues, values as KubeFormValues),
+            }))
+          }
+        />
+      )}
+
+      {isBE && (
+        <>
+          {values.method !== 'repository' && (
+            <WebhookSwitch
+              onChange={(value) => setFieldValue('enableWebhook', value)}
+              value={values.enableWebhook}
+            />
+          )}
+
+          {values.deploymentType === DeploymentType.Compose && (
+            <EnvironmentVariablesPanel
+              values={values.envVars}
+              onChange={(value) => setFieldValue('envVars', value)}
+            />
+          )}
+
+          <PrivateRegistryFieldsetWrapper
+            onChange={(value) => setFieldValue('privateRegistryId', value)}
+            value={values.privateRegistryId}
+            values={{ fileContent: values.fileContent, file: values.file }}
+            error={errors.privateRegistryId}
+            onFieldError={(message) =>
+              setFieldError('privateRegistryId', message)
+            }
+            isGit={values.method === 'repository'}
+          />
+
+          {values.deploymentType === DeploymentType.Compose && (
+            <DeploymentOptions values={values} setFieldValue={setFieldValue} />
+          )}
+
+          <StaggerFieldset
+            isEdit={false}
+            values={values.staggerConfig}
+            errors={errors.staggerConfig}
+            onChange={(newStaggerValues) =>
+              setFieldValue('staggerConfig', newStaggerValues)
+            }
+          />
+        </>
+      )}
+
+      <FormActions
+        data-cy="edgeStackCreate-createStackButton"
+        submitLabel="Deploy the stack"
+        loadingText="Deployment in progress..."
+        isValid={isValid}
+        isLoading={isLoading}
+      />
+    </Form>
+  );
+}
diff --git a/app/react/edge/edge-stacks/CreateView/KubeManifestForm.tsx b/app/react/edge/edge-stacks/CreateView/KubeManifestForm.tsx
new file mode 100644
index 0000000..4b2d350
--- /dev/null
+++ b/app/react/edge/edge-stacks/CreateView/KubeManifestForm.tsx
@@ -0,0 +1,147 @@
+import { SetStateAction } from 'react';
+import { FormikErrors } from 'formik';
+
+import { GitForm } from '@/react/portainer/gitops/GitForm';
+import { GitFormModel } from '@/react/portainer/gitops/types';
+import { baseEdgeStackWebhookUrl } from '@/portainer/helpers/webhookHelper';
+import { isBE } from '@/react/portainer/feature-flags/feature-flags.service';
+
+import { BoxSelector } from '@@/BoxSelector';
+import { WebEditorForm } from '@@/WebEditorForm';
+import { FileUploadForm } from '@@/form-components/FileUpload';
+import { SwitchField } from '@@/form-components/SwitchField';
+import { FormSection } from '@@/form-components/FormSection';
+import {
+  editor,
+  git,
+  upload,
+} from '@@/BoxSelector/common-options/build-methods';
+
+const buildMethods = [editor, upload, git] as const;
+
+export interface KubeFormValues {
+  method: 'editor' | 'upload' | 'repository' | 'template';
+  useManifestNamespaces: boolean;
+  fileContent: string;
+  file?: File;
+  git: GitFormModel;
+}
+
+export function KubeManifestForm({
+  errors,
+  values,
+  setValues,
+  webhookId,
+}: {
+  errors?: FormikErrors<KubeFormValues>;
+  values: KubeFormValues;
+  setValues: (values: SetStateAction<KubeFormValues>) => void;
+  webhookId: string;
+}) {
+  const { method } = values;
+
+  return (
+    <>
+      <div className="form-group">
+        <div className="col-sm-12">
+          <SwitchField
+            label="Use namespace(s) specified from manifest"
+            tooltip="If you have defined namespaces in your deployment file turning this on will enforce the use of those only in the deployment"
+            checked={values.useManifestNamespaces}
+            onChange={(value) =>
+              handleChange({
+                useManifestNamespaces: value,
+              })
+            }
+            data-cy="use-manifest-namespaces-switch"
+          />
+        </div>
+      </div>
+
+      <FormSection title="Build Method">
+        <BoxSelector
+          options={buildMethods}
+          onChange={(value) => handleChange({ method: value })}
+          value={method}
+          radioName="method"
+          slim
+        />
+      </FormSection>
+
+      {method === editor.value && (
+        <WebEditorForm
+          id="stack-creation-editor"
+          value={values.fileContent}
+          onChange={(value) => handleChange({ fileContent: value })}
+          type="yaml"
+          textTip="Define or paste the content of your manifest file here"
+          error={errors?.fileContent}
+          data-cy="stack-creation-editor"
+        >
+          <KubeDeployDescription />
+        </WebEditorForm>
+      )}
+
+      {method === upload.value && (
+        <FileUploadForm
+          value={values.file}
+          onChange={(file) => handleChange({ file })}
+          required
+          description="You can upload a Manifest file from your computer."
+          data-cy="stack-creation-file-upload"
+        >
+          <KubeDeployDescription />
+        </FileUploadForm>
+      )}
+
+      {method === git.value && (
+        <GitForm
+          deployMethod="manifest"
+          errors={errors?.git}
+          value={values.git}
+          onChange={(gitValues) =>
+            setValues((values) => ({
+              ...values,
+              git: {
+                ...values.git,
+                ...gitValues,
+              },
+            }))
+          }
+          baseWebhookUrl={baseEdgeStackWebhookUrl()}
+          webhookId={webhookId}
+          isAutoUpdateVisible={isBE}
+        />
+      )}
+    </>
+  );
+
+  function handleChange(newValues: Partial<KubeFormValues>) {
+    setValues((values) => ({
+      ...values,
+      ...newValues,
+    }));
+  }
+}
+
+function KubeDeployDescription() {
+  return (
+    <>
+      <div>
+        Templates allow deploying any kind of Kubernetes resource (Deployment,
+        Secret, ConfigMap...)
+      </div>
+      <div>
+        You can get more information about Kubernetes file format in the
+        <a
+          href="https://kubernetes.io/docs/concepts/overview/working-with-objects/kubernetes-objects/"
+          target="_blank"
+          rel="noreferrer"
+        >
+          official documentation
+        </a>
+        .
+      </div>
+    </>
+  );
+}
diff --git a/app/react/edge/edge-stacks/CreateView/NameField.tsx b/app/react/edge/edge-stacks/CreateView/NameField.tsx
new file mode 100644
index 0000000..9036920
--- /dev/null
+++ b/app/react/edge/edge-stacks/CreateView/NameField.tsx
@@ -0,0 +1,79 @@
+import { FormikErrors } from 'formik';
+import { SchemaOf, string } from 'yup';
+import { useMemo } from 'react';
+
+import { STACK_NAME_VALIDATION_REGEX } from '@/react/constants';
+import { EnvironmentType } from '@/react/portainer/environments/types';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+
+import { EdgeStack } from '../types';
+import { useEdgeStacks } from '../queries/useEdgeStacks';
+import { useEdgeGroups } from '../../edge-groups/queries/useEdgeGroups';
+import { EdgeGroup } from '../../edge-groups/types';
+
+export function NameField({
+  onChange,
+  value,
+  errors,
+  placeholder,
+}: {
+  onChange(value: string): void;
+  value: string;
+  errors?: FormikErrors<string>;
+  placeholder?: string;
+}) {
+  return (
+    <FormControl inputId="name-input" label="Name" errors={errors} required>
+      <Input
+        id="name-input"
+        onChange={(e) => onChange(e.target.value)}
+        placeholder={placeholder}
+        value={value}
+        required
+        data-cy="edgeStackCreate-nameInput"
+      />
+    </FormControl>
+  );
+}
+
+export function nameValidation(
+  stacks: Array<EdgeStack>,
+  isComposeStack: boolean | undefined
+): SchemaOf<string> {
+  let schema = string()
+    .required('Name is required')
+    .test('unique', 'Name should be unique', (value) =>
+      stacks.every((s) => s.Name !== value)
+    );
+
+  if (isComposeStack) {
+    schema = schema.matches(
+      new RegExp(STACK_NAME_VALIDATION_REGEX),
+      "This field must consist of lower case alphanumeric characters, '_' or '-' (e.g. 'my-name', or 'abc-123')."
+    );
+  }
+
+  return schema;
+}
+
+export function useNameValidation() {
+  const edgeStacksQuery = useEdgeStacks();
+  const edgeGroupsQuery = useEdgeGroups({
+    select: (groups) =>
+      Object.fromEntries(groups.map((g) => [g.Id, g.EndpointTypes])),
+  });
+  const edgeGroupsType = edgeGroupsQuery.data;
+
+  return useMemo(
+    () => (groupIds: Array<EdgeGroup['Id']>) =>
+      nameValidation(
+        edgeStacksQuery.data || [],
+        groupIds
+          .flatMap((g) => edgeGroupsType?.[g])
+          ?.includes(EnvironmentType.EdgeAgentOnDocker)
+      ),
+    [edgeGroupsType, edgeStacksQuery.data]
+  );
+}
diff --git a/app/react/edge/edge-stacks/CreateView/TemplateFieldset/AppTemplateFieldset.test.tsx b/app/react/edge/edge-stacks/CreateView/TemplateFieldset/AppTemplateFieldset.test.tsx
new file mode 100644
index 0000000..e78b5e0
--- /dev/null
+++ b/app/react/edge/edge-stacks/CreateView/TemplateFieldset/AppTemplateFieldset.test.tsx
@@ -0,0 +1,75 @@
+import { render, screen } from '@testing-library/react';
+import { HttpResponse, http } from 'msw';
+
+import { EnvVarType } from '@/react/portainer/templates/app-templates/view-model';
+import {
+  AppTemplate,
+  TemplateType,
+} from '@/react/portainer/templates/app-templates/types';
+import { server } from '@/setup-tests/server';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+
+import { AppTemplateFieldset } from './AppTemplateFieldset';
+
+test('renders AppTemplateFieldset component', async () => {
+  const testedEnv = {
+    name: 'VAR2',
+    label: 'Variable 2',
+    default: 'value2',
+    value: 'value2',
+    type: EnvVarType.Text,
+  };
+
+  const env = [
+    {
+      name: 'VAR1',
+      label: 'Variable 1',
+      default: 'value1',
+      value: 'value1',
+      type: EnvVarType.Text,
+    },
+    testedEnv,
+  ];
+  const template = {
+    id: 1,
+    note: 'This is a template note',
+    env,
+    type: TemplateType.ComposeStack,
+    categories: ['edge'],
+    title: 'Template title',
+    description: 'Template description',
+    administrator_only: false,
+    image: 'template-image',
+    repository: {
+      url: '',
+      stackfile: '',
+    },
+  } satisfies AppTemplate;
+
+  const values: Record<string, string> = {
+    VAR1: 'value1',
+    VAR2: 'value2',
+  };
+
+  server.use(
+    http.get('/api/templates', () =>
+      HttpResponse.json({ version: '3', templates: [template] })
+    ),
+    http.get('/api/registries', () => HttpResponse.json([]))
+  );
+
+  const onChange = vi.fn();
+  const Wrapped = withTestQueryProvider(AppTemplateFieldset);
+  render(
+    <Wrapped templateId={template.id} values={values} onChange={onChange} />
+  );
+
+  await expect(
+    screen.findByText('This is a template note')
+  ).resolves.toBeInTheDocument();
+
+  const envVarsFieldsetElement = screen.getByLabelText(testedEnv.label, {
+    exact: false,
+  });
+  expect(envVarsFieldsetElement).toBeInTheDocument();
+});
diff --git a/app/react/edge/edge-stacks/CreateView/TemplateFieldset/AppTemplateFieldset.tsx b/app/react/edge/edge-stacks/CreateView/TemplateFieldset/AppTemplateFieldset.tsx
new file mode 100644
index 0000000..e1cc754
--- /dev/null
+++ b/app/react/edge/edge-stacks/CreateView/TemplateFieldset/AppTemplateFieldset.tsx
@@ -0,0 +1,40 @@
+import { FormikErrors } from 'formik';
+
+import { TemplateViewModel } from '@/react/portainer/templates/app-templates/view-model';
+import { useAppTemplate } from '@/react/portainer/templates/app-templates/queries/useAppTemplates';
+import { TemplateNote } from '@/react/portainer/templates/components/TemplateNote';
+import {
+  EnvVarsFieldset,
+  EnvVarsValue,
+} from '@/react/portainer/templates/app-templates/DeployFormWidget/EnvVarsFieldset';
+
+export function AppTemplateFieldset({
+  templateId,
+  values,
+  onChange,
+  errors,
+}: {
+  templateId: TemplateViewModel['Id'];
+  values: EnvVarsValue;
+  onChange: (value: EnvVarsValue) => void;
+  errors?: FormikErrors<EnvVarsValue>;
+}) {
+  const templateQuery = useAppTemplate(templateId);
+  if (!templateQuery.data) {
+    return null;
+  }
+
+  const template = templateQuery.data;
+
+  return (
+    <>
+      <TemplateNote note={template.Note} />
+      <EnvVarsFieldset
+        options={template.Env || []}
+        values={values}
+        onChange={onChange}
+        errors={errors}
+      />
+    </>
+  );
+}
diff --git a/app/react/edge/edge-stacks/CreateView/TemplateFieldset/CustomTemplateFieldset.tsx b/app/react/edge/edge-stacks/CreateView/TemplateFieldset/CustomTemplateFieldset.tsx
new file mode 100644
index 0000000..f575ff5
--- /dev/null
+++ b/app/react/edge/edge-stacks/CreateView/TemplateFieldset/CustomTemplateFieldset.tsx
@@ -0,0 +1,41 @@
+import { CustomTemplatesVariablesField } from '@/react/portainer/custom-templates/components/CustomTemplatesVariablesField';
+import { CustomTemplate } from '@/react/portainer/templates/custom-templates/types';
+import { TemplateNote } from '@/react/portainer/templates/components/TemplateNote';
+import { useCustomTemplate } from '@/react/portainer/templates/custom-templates/queries/useCustomTemplate';
+
+import { ArrayError } from '@@/form-components/InputList/InputList';
+
+import { Values } from './types';
+
+export function CustomTemplateFieldset({
+  errors,
+  onChange,
+  values,
+  templateId,
+}: {
+  values: Values['variables'];
+  onChange: (values: Values['variables']) => void;
+  errors: ArrayError<Values['variables']> | undefined;
+  templateId: CustomTemplate['Id'];
+}) {
+  const templateQuery = useCustomTemplate(templateId);
+
+  if (!templateQuery.data) {
+    return null;
+  }
+
+  const template = templateQuery.data;
+
+  return (
+    <>
+      <TemplateNote note={template.Note} />
+
+      <CustomTemplatesVariablesField
+        onChange={onChange}
+        value={values}
+        definitions={template.Variables}
+        errors={errors}
+      />
+    </>
+  );
+}
diff --git a/app/react/edge/edge-stacks/CreateView/TemplateFieldset/TemplateFieldset.tsx b/app/react/edge/edge-stacks/CreateView/TemplateFieldset/TemplateFieldset.tsx
new file mode 100644
index 0000000..f479ee7
--- /dev/null
+++ b/app/react/edge/edge-stacks/CreateView/TemplateFieldset/TemplateFieldset.tsx
@@ -0,0 +1,106 @@
+import { SetStateAction } from 'react';
+import { FormikErrors } from 'formik';
+
+import { getVariablesFieldDefaultValues } from '@/react/portainer/custom-templates/components/CustomTemplatesVariablesField';
+import { TemplateViewModel } from '@/react/portainer/templates/app-templates/view-model';
+import { CustomTemplate } from '@/react/portainer/templates/custom-templates/types';
+
+import { getDefaultValues as getAppVariablesDefaultValues } from '../../../../portainer/templates/app-templates/DeployFormWidget/EnvVarsFieldset';
+
+import { TemplateSelector } from './TemplateSelector';
+import { Values } from './types';
+import { CustomTemplateFieldset } from './CustomTemplateFieldset';
+import { AppTemplateFieldset } from './AppTemplateFieldset';
+
+export function TemplateFieldset({
+  values,
+  setValues,
+  errors,
+  isLoadingValues,
+}: {
+  errors?: FormikErrors<Values>;
+  values: Values;
+  setValues: (values: SetStateAction<Values>) => void;
+  isLoadingValues?: boolean;
+}) {
+  return (
+    <>
+      <TemplateSelector
+        error={errors?.templateId}
+        value={values}
+        onChange={handleChangeTemplate}
+        isLoadingValues={isLoadingValues}
+      />
+      {values.templateId && !isLoadingValues && (
+        <>
+          {values.type === 'custom' && (
+            <CustomTemplateFieldset
+              templateId={values.templateId}
+              values={values.variables}
+              onChange={(variables) =>
+                setValues((values) => ({ ...values, variables }))
+              }
+              errors={errors?.variables}
+            />
+          )}
+
+          {values.type === 'app' && (
+            <AppTemplateFieldset
+              templateId={values.templateId}
+              values={values.envVars}
+              onChange={(envVars) =>
+                setValues((values) => ({ ...values, envVars }))
+              }
+              errors={errors?.envVars}
+            />
+          )}
+        </>
+      )}
+    </>
+  );
+
+  function handleChangeTemplate(
+    template: TemplateViewModel | CustomTemplate | undefined,
+    type: 'app' | 'custom' | undefined
+  ): void {
+    setValues(() => {
+      if (!template || !type) {
+        return {
+          type: undefined,
+          templateId: undefined,
+          variables: [],
+          envVars: {},
+        };
+      }
+
+      if (type === 'app') {
+        return {
+          templateId: template.Id,
+          type,
+          variables: [],
+          envVars: getAppVariablesDefaultValues(
+            (template as TemplateViewModel).Env || []
+          ),
+        };
+      }
+
+      return {
+        templateId: template.Id,
+        type,
+        variables: getVariablesFieldDefaultValues(
+          (template as CustomTemplate).Variables || []
+        ),
+        envVars: {},
+      };
+    });
+  }
+}
+
+export function getInitialTemplateValues(): Values {
+  return {
+    templateId: undefined,
+    type: undefined,
+    variables: [],
+    envVars: {},
+  };
+}
diff --git a/app/react/edge/edge-stacks/CreateView/TemplateFieldset/TemplateSelector.test.tsx b/app/react/edge/edge-stacks/CreateView/TemplateFieldset/TemplateSelector.test.tsx
new file mode 100644
index 0000000..c7dab62
--- /dev/null
+++ b/app/react/edge/edge-stacks/CreateView/TemplateFieldset/TemplateSelector.test.tsx
@@ -0,0 +1,157 @@
+import { vi } from 'vitest';
+import { HttpResponse, http } from 'msw';
+import { render, screen } from '@testing-library/react';
+
+import { AppTemplate } from '@/react/portainer/templates/app-templates/types';
+import { CustomTemplate } from '@/react/portainer/templates/custom-templates/types';
+import { server } from '@/setup-tests/server';
+import selectEvent from '@/react/test-utils/react-select';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { TemplateViewModel } from '@/react/portainer/templates/app-templates/view-model';
+
+import { TemplateSelector } from './TemplateSelector';
+
+test('renders TemplateSelector component', async () => {
+  renderComponent();
+
+  const templateSelectorElement = screen.getByLabelText('Template');
+  expect(templateSelectorElement).toBeInTheDocument();
+});
+
+// TODO skipped select tests because the tests take too long to run
+test.todo('selects an edge app template', async () => {
+  const onChange = vi.fn();
+
+  const selectedTemplate = {
+    title: 'App Template 2',
+    description: 'Description 2',
+    id: 2,
+    categories: ['edge'],
+  };
+
+  const { select } = renderComponent({
+    onChange,
+    appTemplates: [
+      {
+        title: 'App Template 1',
+        description: 'Description 1',
+        id: 1,
+        categories: ['edge'],
+      },
+      selectedTemplate,
+    ],
+  });
+
+  await select('app', {
+    Title: selectedTemplate.title,
+    Description: selectedTemplate.description,
+  });
+});
+
+test.todo('selects an edge custom template', async () => {
+  const onChange = vi.fn();
+
+  const selectedTemplate = {
+    Title: 'Custom Template 2',
+    Description: 'Description 2',
+    Id: 2,
+  };
+
+  const { select } = renderComponent({
+    onChange,
+    customTemplates: [
+      {
+        Title: 'Custom Template 1',
+        Description: 'Description 1',
+        Id: 1,
+      },
+      selectedTemplate,
+    ],
+  });
+
+  await select('custom', selectedTemplate);
+});
+
+test('renders with error', async () => {
+  renderComponent({
+    error: 'Invalid template',
+  });
+
+  const templateSelectorElement = screen.getByLabelText('Template');
+  expect(templateSelectorElement).toBeInTheDocument();
+
+  const errorElement = screen.getByText('Invalid template');
+  expect(errorElement).toBeInTheDocument();
+});
+
+test.todo(
+  'renders TemplateSelector component with no custom templates available',
+  async () => {
+    renderComponent({
+      customTemplates: [],
+    });
+
+    const templateSelectorElement = screen.getByLabelText('Template');
+    expect(templateSelectorElement).toBeInTheDocument();
+
+    await selectEvent.openMenu(templateSelectorElement);
+
+    const noCustomTemplatesElement = screen.getByText(
+      'No edge custom templates available'
+    );
+    expect(noCustomTemplatesElement).toBeInTheDocument();
+  }
+);
+
+function renderComponent({
+  onChange = vi.fn(),
+  appTemplates = [],
+  customTemplates = [],
+  error,
+}: {
+  onChange?: (
+    template: TemplateViewModel | CustomTemplate | undefined,
+    type: 'app' | 'custom' | undefined
+  ) => void;
+  appTemplates?: Array<Partial<AppTemplate>>;
+  customTemplates?: Array<Partial<CustomTemplate>>;
+  error?: string;
+} = {}) {
+  server.use(
+    http.get('/api/registries', async () => HttpResponse.json([])),
+    http.get('/api/templates', async () =>
+      HttpResponse.json({ templates: appTemplates, version: '3' })
+    ),
+    http.get('/api/custom_templates', async () =>
+      HttpResponse.json(customTemplates)
+    )
+  );
+
+  const Wrapped = withTestQueryProvider(TemplateSelector);
+
+  render(
+    <Wrapped
+      value={{ templateId: undefined, type: undefined }}
+      onChange={onChange}
+      error={error}
+    />
+  );
+
+  return { select };
+
+  async function select(
+    type: 'app' | 'custom',
+    template: { Title: string; Description: string }
+  ) {
+    const templateSelectorElement = screen.getByLabelText('Template');
+    await selectEvent.select(
+      templateSelectorElement,
+      `${template.Title} - ${template.Description}`
+    );
+
+    expect(onChange).toHaveBeenCalledWith({
+      template: expect.objectContaining(template),
+      type,
+    });
+  }
+}
diff --git a/app/react/edge/edge-stacks/CreateView/TemplateFieldset/TemplateSelector.tsx b/app/react/edge/edge-stacks/CreateView/TemplateFieldset/TemplateSelector.tsx
new file mode 100644
index 0000000..d66491b
--- /dev/null
+++ b/app/react/edge/edge-stacks/CreateView/TemplateFieldset/TemplateSelector.tsx
@@ -0,0 +1,184 @@
+import { useMemo } from 'react';
+import { GroupBase } from 'react-select';
+
+import { useCustomTemplates } from '@/react/portainer/templates/custom-templates/queries/useCustomTemplates';
+import { useAppTemplates } from '@/react/portainer/templates/app-templates/queries/useAppTemplates';
+import { TemplateType } from '@/react/portainer/templates/app-templates/types';
+import { TemplateViewModel } from '@/react/portainer/templates/app-templates/view-model';
+import { CustomTemplate } from '@/react/portainer/templates/custom-templates/types';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { Select as ReactSelect } from '@@/form-components/ReactSelect';
+import { InlineLoader } from '@@/InlineLoader';
+
+import { SelectedTemplateValue } from './types';
+
+export function TemplateSelector({
+  value,
+  onChange,
+  error,
+  isLoadingValues,
+}: {
+  value: SelectedTemplateValue;
+  onChange: (
+    template: TemplateViewModel | CustomTemplate | undefined,
+    type: 'app' | 'custom' | undefined
+  ) => void;
+  error?: string;
+  isLoadingValues?: boolean;
+}) {
+  const { options, getTemplate, selectedValue } = useOptions(value);
+
+  return (
+    <FormControl label="Template" inputId="template_selector" errors={error}>
+      <ReactSelect
+        inputId="template_selector"
+        formatGroupLabel={GroupLabel}
+        placeholder="Select an Edge stack template"
+        options={options}
+        value={selectedValue}
+        onChange={(value) => {
+          if (!value) {
+            onChange(undefined, undefined);
+            return;
+          }
+
+          const { templateId, type } = value;
+          if (!templateId || type === undefined) {
+            return;
+          }
+          onChange(getTemplate({ type, id: templateId }), type);
+        }}
+        data-cy="edge-stacks-create-template-selector"
+        id="edge-stacks-create-template-selector"
+      />
+      {isLoadingValues && (
+        <InlineLoader>Loading template values...</InlineLoader>
+      )}
+    </FormControl>
+  );
+}
+
+interface Option {
+  label: string;
+  templateId?: number;
+  type: 'app' | 'custom';
+}
+
+function useOptions(value: SelectedTemplateValue) {
+  const customTemplatesQuery = useCustomTemplates({
+    params: {
+      edge: true,
+    },
+  });
+
+  const appTemplatesQuery = useAppTemplates({
+    select: (templates) =>
+      templates.filter(
+        (template) =>
+          template.Categories.includes('edge') &&
+          template.Type !== TemplateType.Container
+      ),
+  });
+
+  const appTemplateOptions: Array<Option> = useMemo(
+    () =>
+      appTemplatesQuery.data?.map(
+        (template) =>
+          ({
+            label: `${template.Title} - ${template.Description}`,
+
+            templateId: template.Id,
+            type: 'app',
+          }) satisfies Option
+      ) || [],
+    [appTemplatesQuery.data]
+  );
+
+  const customTemplateOptions: Array<Option> = useMemo(
+    () =>
+      customTemplatesQuery.data && customTemplatesQuery.data.length > 0
+        ? customTemplatesQuery.data.map(
+            (template) =>
+              ({
+                label: `${template.Title} - ${template.Description}`,
+
+                templateId: template.Id,
+                type: 'custom' as 'app' | 'custom',
+              }) satisfies Option
+          )
+        : [
+            {
+              label: 'No edge custom templates available',
+
+              templateId: undefined,
+              type: 'custom' as 'app' | 'custom',
+            } satisfies Option,
+          ],
+    [customTemplatesQuery.data]
+  );
+
+  const options = useMemo(
+    () =>
+      [
+        {
+          label: 'Edge App Templates',
+          options: appTemplateOptions,
+        },
+        {
+          label: 'Edge Custom Templates',
+          options: customTemplateOptions,
+        },
+      ] as const,
+    [appTemplateOptions, customTemplateOptions]
+  );
+
+  const selectedValue: Option | undefined = useMemo(() => {
+    if (!value.templateId) {
+      return undefined;
+    }
+
+    if (value.type === 'app') {
+      return appTemplateOptions.find(
+        (template) => template.templateId === value.templateId
+      );
+    }
+
+    return customTemplateOptions.find(
+      (template) => template.templateId === value.templateId
+    );
+  }, [value.templateId, value.type, customTemplateOptions, appTemplateOptions]);
+
+  return { options, getTemplate, selectedValue };
+
+  function getTemplate({ type, id }: { type: 'app' | 'custom'; id: number }) {
+    if (type === 'app') {
+      const template = appTemplatesQuery.data?.find(
+        (template) => template.Id === id
+      );
+
+      if (!template) {
+        throw new Error(`App template not found: ${id}`);
+      }
+
+      return template;
+    }
+
+    const template = customTemplatesQuery.data?.find(
+      (template) => template.Id === id
+    );
+
+    if (!template) {
+      throw new Error(`Custom template not found: ${id}`);
+    }
+    return template;
+  }
+}
+
+function GroupLabel({ label }: GroupBase<unknown>) {
+  return (
+    <span className="font-bold text-black th-highcontrast:text-white th-dark:text-white">
+      {label}
+    </span>
+  );
+}
diff --git a/app/react/edge/edge-stacks/CreateView/TemplateFieldset/types.ts b/app/react/edge/edge-stacks/CreateView/TemplateFieldset/types.ts
new file mode 100644
index 0000000..9903a64
--- /dev/null
+++ b/app/react/edge/edge-stacks/CreateView/TemplateFieldset/types.ts
@@ -0,0 +1,12 @@
+import { VariablesFieldValue } from '@/react/portainer/custom-templates/components/CustomTemplatesVariablesField';
+import { EnvVarsValue } from '@/react/portainer/templates/app-templates/DeployFormWidget/EnvVarsFieldset';
+
+export type SelectedTemplateValue =
+  | { templateId: number; type: 'custom' }
+  | { templateId: number; type: 'app' }
+  | { templateId: undefined; type: undefined };
+
+export type Values = {
+  variables: VariablesFieldValue;
+  envVars: EnvVarsValue;
+} & SelectedTemplateValue;
diff --git a/app/react/edge/edge-stacks/CreateView/TemplateFieldset/validation.tsx b/app/react/edge/edge-stacks/CreateView/TemplateFieldset/validation.tsx
new file mode 100644
index 0000000..e7c39d3
--- /dev/null
+++ b/app/react/edge/edge-stacks/CreateView/TemplateFieldset/validation.tsx
@@ -0,0 +1,38 @@
+import { mixed, number, object, SchemaOf } from 'yup';
+
+import { variablesFieldValidation } from '@/react/portainer/custom-templates/components/CustomTemplatesVariablesField';
+import { VariableDefinition } from '@/react/portainer/custom-templates/components/CustomTemplatesVariablesDefinitionField';
+import { envVarsFieldsetValidation } from '@/react/portainer/templates/app-templates/DeployFormWidget/EnvVarsFieldset';
+import { TemplateEnv } from '@/react/portainer/templates/app-templates/types';
+
+import { Values } from './types';
+
+export function templateFieldsetValidation({
+  customVariablesDefinitions,
+  appTemplateVariablesDefinitions,
+}: {
+  customVariablesDefinitions: Array<VariableDefinition>;
+  appTemplateVariablesDefinitions: Array<TemplateEnv>;
+}): SchemaOf<Values> {
+  return object({
+    type: mixed<'app' | 'custom'>().oneOf(['custom', 'app']).optional(),
+    envVars: envVarsFieldsetValidation(appTemplateVariablesDefinitions)
+      .optional()
+      .when('type', {
+        is: 'app',
+        then: (schema: SchemaOf<unknown, never>) => schema.required(),
+      }),
+    templateId: mixed()
+      .optional()
+      .when('type', {
+        is: true,
+        then: () => number().required(),
+      }),
+    variables: variablesFieldValidation(customVariablesDefinitions)
+      .optional()
+      .when('type', {
+        is: 'custom',
+        then: (schema) => schema.required(),
+      }),
+  });
+}
diff --git a/app/react/edge/edge-stacks/CreateView/WebhookSwitch.tsx b/app/react/edge/edge-stacks/CreateView/WebhookSwitch.tsx
new file mode 100644
index 0000000..36304f7
--- /dev/null
+++ b/app/react/edge/edge-stacks/CreateView/WebhookSwitch.tsx
@@ -0,0 +1,32 @@
+import { TextTip } from '@@/Tip/TextTip';
+import { SwitchField } from '@@/form-components/SwitchField';
+
+export function WebhookSwitch({
+  value,
+  onChange,
+}: {
+  value: boolean;
+  onChange: (value: boolean) => void;
+}) {
+  return (
+    <div>
+      <div className="form-section-title"> Webhooks </div>
+      <SwitchField
+        label="Create an Edge stack webhook"
+        checked={value}
+        onChange={onChange}
+        tooltip="Create a webhook (or callback URI) to automate the update of this stack. Sending a POST request to this callback URI (without requiring any authentication) will pull the most up-to-date version of the associated image and re-deploy this stack."
+        labelClass="col-sm-3 col-lg-2"
+        data-cy="webhook-switch"
+      />
+
+      {value && (
+        <TextTip>
+          Sending environment variables to the webhook is updating the stack
+          with the new values. New variables names will be added to the stack
+          and existing variables will be updated.
+        </TextTip>
+      )}
+    </div>
+  );
+}
diff --git a/app/react/edge/edge-stacks/CreateView/tests/app-templates.test.tsx b/app/react/edge/edge-stacks/CreateView/tests/app-templates.test.tsx
new file mode 100644
index 0000000..397112b
--- /dev/null
+++ b/app/react/edge/edge-stacks/CreateView/tests/app-templates.test.tsx
@@ -0,0 +1,104 @@
+import { DefaultBodyType, HttpResponse } from 'msw';
+import { waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+
+import { http, server } from '@/setup-tests/server';
+import selectEvent from '@/react/test-utils/react-select';
+import { mockCodeMirror } from '@/setup-tests/mock-codemirror';
+
+import { renderCreateForm } from './utils.test';
+
+// keep mockTemplateId and mockTemplateType in module scope
+let mockTemplateId: number;
+let mockTemplateType: string;
+
+// browser address
+// /edge/stacks/new?templateId=54&templateType=app
+vi.mock('@uirouter/react', async (importOriginal: () => Promise<object>) => ({
+  ...(await importOriginal()),
+  useCurrentStateAndParams: vi.fn(() => ({
+    params: { templateId: mockTemplateId, templateType: mockTemplateType },
+  })),
+  useRouter: vi.fn(() => ({
+    stateService: {
+      go: vi.fn(),
+    },
+  })),
+}));
+
+mockCodeMirror();
+
+// expected form values
+const expectedAppTemplatePayload = {
+  deploymentType: 0,
+  edgeGroups: [1],
+  name: 'my-stack',
+  envVars: [{ name: 'LICENSE_KEY', value: 'license-123' }],
+  prePullImage: false,
+  registries: [],
+  retryDeploy: false,
+  staggerConfig: {
+    StaggerOption: 1,
+    StaggerParallelOption: 1,
+    DeviceNumber: 1,
+    DeviceNumberStartFrom: 0,
+    DeviceNumberIncrementBy: 2,
+    Timeout: '',
+    UpdateDelay: '',
+    UpdateFailureAction: 1,
+  },
+  useManifestNamespaces: false,
+  stackFileContent:
+    // eslint-disable-next-line no-template-curly-in-string
+    'version: "3.7"\nservices:\n  tosibox-lock-for-container:\n    container_name: tosibox-lock-for-container\n    image: tosibox/lock-for-container:latest\n    hostname: tb-lfc\n    restart: unless-stopped\n    cap_add:\n      - NET_ADMIN\n      - SYS_TIME\n      - SYS_PTRACE\n    ports:\n      - 80\n    networks:\n      - tbnet\n    volumes:\n      - tosibox-lfc:/etc/tosibox/docker_volume\n    environment:\n      - LICENSE_KEY=${LICENSE_KEY}\nvolumes:\n  tosibox-lfc:\n    name: tosibox-lfc\nnetworks:\n  tbnet:\n    name: tbnet\n    ipam:\n      config:\n        - subnet: 10.10.206.0/24\n',
+};
+
+test('The web editor should be visible for app templates', async () => {
+  setMockCreateStackUrlParams(54, 'app');
+  const { getByRole, getByLabelText } = renderCreateForm();
+
+  // Wait for the form to be rendered
+  await waitFor(() => {
+    expect(getByRole('form')).toBeInTheDocument();
+  });
+
+  // the web editor should be visible
+  expect(getByLabelText('Web editor')).toBeVisible();
+});
+
+test('The form should submit the correct request body for a given app template', async () => {
+  setMockCreateStackUrlParams(54, 'app');
+  let requestBody: DefaultBodyType;
+  server.use(
+    http.post('/api/edge_stacks/create/string', async ({ request }) => {
+      requestBody = await request.json();
+      return HttpResponse.json({});
+    })
+  );
+
+  const { getByRole, getByLabelText } = renderCreateForm();
+
+  await waitFor(() => {
+    expect(getByRole('form')).toBeInTheDocument();
+  });
+
+  // fill in the name and select the docker edge group
+  const user = userEvent.setup();
+  await user.type(getByRole('textbox', { name: 'Name *' }), 'my-stack');
+  await user.type(getByRole('textbox', { name: 'License key' }), 'license-123');
+  const selectElement = getByLabelText('Edge groups');
+  await selectEvent.select(selectElement, 'docker');
+
+  // submit the form
+  await user.click(getByRole('button', { name: /Deploy the stack/i }));
+
+  // verify the request body
+  await waitFor(() => {
+    expect(requestBody).toEqual(expectedAppTemplatePayload);
+  });
+});
+
+function setMockCreateStackUrlParams(templateId: number, templateType: string) {
+  mockTemplateId = templateId;
+  mockTemplateType = templateType;
+}
diff --git a/app/react/edge/edge-stacks/CreateView/tests/custom-templates.test.tsx b/app/react/edge/edge-stacks/CreateView/tests/custom-templates.test.tsx
new file mode 100644
index 0000000..345938e
--- /dev/null
+++ b/app/react/edge/edge-stacks/CreateView/tests/custom-templates.test.tsx
@@ -0,0 +1,107 @@
+import { DefaultBodyType, HttpResponse } from 'msw';
+import { waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+
+import { http, server } from '@/setup-tests/server';
+import selectEvent from '@/react/test-utils/react-select';
+import { mockCodeMirror } from '@/setup-tests/mock-codemirror';
+
+import { renderCreateForm } from './utils.test';
+
+// keep mockTemplateId and mockTemplateType in module scope
+let mockTemplateId: number;
+let mockTemplateType: string;
+
+// browser address
+// /edge/stacks/new?templateId=54&templateType=app
+vi.mock('@uirouter/react', async (importOriginal: () => Promise<object>) => ({
+  ...(await importOriginal()),
+  useCurrentStateAndParams: vi.fn(() => ({
+    params: { templateId: mockTemplateId, templateType: mockTemplateType },
+  })),
+  useRouter: vi.fn(() => ({
+    stateService: {
+      go: vi.fn(),
+    },
+  })),
+}));
+
+mockCodeMirror();
+
+const expectedCustomTemplatePayload = {
+  deploymentType: 0,
+  edgeGroups: [1],
+  name: 'my-stack',
+  envVars: [],
+  prePullImage: true,
+  registries: [1],
+  retryDeploy: true,
+  staggerConfig: {
+    StaggerOption: 2,
+    StaggerParallelOption: 1,
+    DeviceNumber: 1,
+    DeviceNumberStartFrom: 0,
+    DeviceNumberIncrementBy: 2,
+    Timeout: '3',
+    UpdateDelay: '3',
+    UpdateFailureAction: 3,
+  },
+  useManifestNamespaces: false,
+  repositoryReferenceName: 'refs/heads/main',
+  filePathInRepository: 'docker/voting.yaml',
+  filesystemPath: '/test',
+  supportRelativePath: true,
+  perDeviceConfigsGroupMatchType: 'file',
+  perDeviceConfigsMatchType: 'file',
+  perDeviceConfigsPath: 'test',
+  autoUpdate: null,
+};
+
+test('The web editor should be visible for custom templates', async () => {
+  setMockCreateStackUrlParams(8, 'custom');
+  const { getByRole, getByLabelText } = renderCreateForm();
+
+  // Wait for the form to be rendered
+  await waitFor(() => {
+    expect(getByRole('form')).toBeInTheDocument();
+  });
+
+  // the web editor should be visible
+  expect(getByLabelText('Web editor')).toBeVisible();
+});
+
+test('The form should submit the correct request body for a given custom template', async () => {
+  setMockCreateStackUrlParams(8, 'custom');
+  let requestBody: DefaultBodyType;
+  server.use(
+    http.post('/api/edge_stacks/create/:method', async ({ request }) => {
+      requestBody = await request.json();
+      return HttpResponse.json({});
+    })
+  );
+
+  const { getByRole, getByLabelText } = renderCreateForm();
+
+  await waitFor(() => {
+    expect(getByRole('form')).toBeInTheDocument();
+  });
+
+  // fill in the name and select the docker edge group
+  const user = userEvent.setup();
+  await user.type(getByRole('textbox', { name: 'Name *' }), 'my-stack');
+  const selectElement = getByLabelText('Edge groups');
+  await selectEvent.select(selectElement, 'docker');
+
+  // submit the form
+  await user.click(getByRole('button', { name: /Deploy the stack/i }));
+
+  // verify the request body
+  await waitFor(() => {
+    expect(requestBody).toEqual(expectedCustomTemplatePayload);
+  });
+});
+
+function setMockCreateStackUrlParams(templateId: number, templateType: string) {
+  mockTemplateId = templateId;
+  mockTemplateType = templateType;
+}
diff --git a/app/react/edge/edge-stacks/CreateView/tests/utils.test.tsx b/app/react/edge/edge-stacks/CreateView/tests/utils.test.tsx
new file mode 100644
index 0000000..11dfb6c
--- /dev/null
+++ b/app/react/edge/edge-stacks/CreateView/tests/utils.test.tsx
@@ -0,0 +1,234 @@
+import { HttpResponse } from 'msw';
+import { render, waitFor } from '@testing-library/react';
+
+import { UserViewModel } from '@/portainer/models/user';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { http, server } from '@/setup-tests/server';
+import { mockCodeMirror } from '@/setup-tests/mock-codemirror';
+
+import { CreateForm } from '../CreateForm';
+
+// app templates request
+// GET /api/templates
+const appTemplatesResponseBody = {
+  version: '3',
+  templates: [
+    {
+      id: 54,
+      type: 3,
+      title: 'TOSIBOX Lock for Container',
+      description:
+        'Lock for Container brings secure connectivity inside your industrial IoT devices',
+      administrator_only: false,
+      image: '',
+      repository: {
+        url: 'https://github.com/portainer/templates',
+        stackfile: 'stacks/tosibox/docker-compose.yml',
+      },
+      stackFile: '',
+      logo: 'https://portainer-io-assets.sfo2.digitaloceanspaces.com/logos/tosibox.png',
+      env: [
+        {
+          name: 'LICENSE_KEY',
+          label: 'License key',
+        },
+      ],
+      platform: 'linux',
+      categories: ['edge'],
+    },
+  ],
+};
+
+// app template content request
+// GET /api/templates/54/file
+const appTemplateContentResponseBody = {
+  FileContent:
+    // eslint-disable-next-line no-template-curly-in-string
+    'version: "3.7"\nservices:\n  tosibox-lock-for-container:\n    container_name: tosibox-lock-for-container\n    image: tosibox/lock-for-container:latest\n    hostname: tb-lfc\n    restart: unless-stopped\n    cap_add:\n      - NET_ADMIN\n      - SYS_TIME\n      - SYS_PTRACE\n    ports:\n      - 80\n    networks:\n      - tbnet\n    volumes:\n      - tosibox-lfc:/etc/tosibox/docker_volume\n    environment:\n      - LICENSE_KEY=${LICENSE_KEY}\nvolumes:\n  tosibox-lfc:\n    name: tosibox-lfc\nnetworks:\n  tbnet:\n    name: tbnet\n    ipam:\n      config:\n        - subnet: 10.10.206.0/24\n',
+};
+
+const customTemplatesResponseBody = [
+  {
+    Id: 8,
+    Title: 'git-with-all',
+    Description: 'test',
+    ProjectPath: '/Users/aliharris/portainer-data-ee/custom_templates/8',
+    EntryPoint: '',
+    CreatedByUserId: 1,
+    Note: '',
+    Platform: 1,
+    Logo: '',
+    Type: 2,
+    ResourceControl: {
+      Id: 9,
+      ResourceId: '8',
+      SubResourceIds: [],
+      Type: 8,
+      UserAccesses: [
+        {
+          UserId: 1,
+          AccessLevel: 1,
+        },
+      ],
+      TeamAccesses: [],
+      Public: false,
+      AdministratorsOnly: false,
+      System: false,
+    },
+    Variables: [],
+    GitConfig: {
+      URL: 'https://github.com/testA113/nginx-public',
+      ReferenceName: 'refs/heads/main',
+      ConfigFilePath: 'docker/voting.yaml',
+      Authentication: {
+        Username: '',
+        Password: '',
+      },
+      ConfigHash: '1db40a888e07da7d9455897aadd349d0bc83bd83',
+      TLSSkipVerify: false,
+    },
+    IsComposeFormat: false,
+    EdgeTemplate: true,
+    EdgeSettings: {
+      PrePullImage: true,
+      RetryDeploy: true,
+      PrivateRegistryId: 1,
+      RelativePathSettings: {
+        SupportRelativePath: true,
+        FilesystemPath: '/test',
+        SupportPerDeviceConfigs: true,
+        PerDeviceConfigsMatchType: 'file',
+        PerDeviceConfigsGroupMatchType: 'file',
+        PerDeviceConfigsPath: 'test',
+      },
+      StaggerConfig: {
+        StaggerOption: 2,
+        StaggerParallelOption: 1,
+        DeviceNumber: 1,
+        DeviceNumberStartFrom: 0,
+        DeviceNumberIncrementBy: 2,
+        Timeout: '3',
+        UpdateDelay: '3',
+        UpdateFailureAction: 3,
+      },
+    },
+  },
+];
+
+const edgeGroups = [
+  {
+    Id: 1,
+    Name: 'docker',
+    Dynamic: false,
+    TagIds: [],
+    Endpoints: [12],
+    PartialMatch: false,
+    HasEdgeStack: false,
+    HasEdgeJob: false,
+    EndpointTypes: [4],
+    TrustedEndpoints: [12],
+  },
+  {
+    Id: 2,
+    Name: 'kubernetes',
+    Dynamic: false,
+    TagIds: [],
+    Endpoints: [11],
+    PartialMatch: false,
+    HasEdgeStack: false,
+    HasEdgeJob: false,
+    EndpointTypes: [7],
+    TrustedEndpoints: [11],
+  },
+];
+
+const registries = [
+  {
+    Id: 1,
+    Type: 6,
+    Name: 'dockerhub',
+    URL: 'docker.io',
+    BaseURL: '',
+    Authentication: true,
+    Username: 'portainer-test',
+    Password: 'test',
+    ManagementConfiguration: {
+      Type: 6,
+      Authentication: true,
+      Username: 'portainer-test',
+      Password: 'test',
+      TLSConfig: {
+        TLS: false,
+        TLSSkipVerify: false,
+      },
+      Ecr: {
+        Region: '',
+      },
+    },
+    Gitlab: {
+      ProjectId: 0,
+      InstanceURL: '',
+      ProjectPath: '',
+    },
+    Quay: {
+      OrganisationName: '',
+    },
+    Ecr: {
+      Region: '',
+    },
+    RegistryAccesses: {},
+    UserAccessPolicies: null,
+    TeamAccessPolicies: null,
+    AuthorizedUsers: null,
+    AuthorizedTeams: null,
+    Github: {
+      UseOrganisation: false,
+      OrganisationName: '',
+    },
+  },
+];
+
+mockCodeMirror();
+
+test('The form should render', async () => {
+  const { getByRole } = renderCreateForm();
+
+  // Wait for the form to be rendered
+  await waitFor(() => {
+    expect(getByRole('form')).toBeInTheDocument();
+  });
+});
+
+export function renderCreateForm() {
+  // user declaration needs to go at the start for user id related requests (e.g. git credentials)
+  const user = new UserViewModel({ Username: 'user' });
+  server.use(
+    http.get('/api/templates', () =>
+      HttpResponse.json(appTemplatesResponseBody)
+    )
+  );
+  server.use(
+    http.get('/api/custom_templates', () =>
+      HttpResponse.json(customTemplatesResponseBody)
+    )
+  );
+  server.use(
+    http.get('/api/custom_templates/8', () =>
+      HttpResponse.json(customTemplatesResponseBody[0])
+    )
+  );
+  server.use(
+    http.post('/api/templates/54/file', () =>
+      HttpResponse.json(appTemplateContentResponseBody)
+    )
+  );
+  server.use(http.get('/api/edge_stacks', () => HttpResponse.json([])));
+  server.use(http.get('/api/edge_groups', () => HttpResponse.json(edgeGroups)));
+  server.use(http.get('/api/registries', () => HttpResponse.json(registries)));
+  const Wrapped = withTestQueryProvider(
+    withUserProvider(withTestRouter(CreateForm), user)
+  );
+  return render(<Wrapped />);
+}
diff --git a/app/react/edge/edge-stacks/CreateView/types.ts b/app/react/edge/edge-stacks/CreateView/types.ts
new file mode 100644
index 0000000..529a1bd
--- /dev/null
+++ b/app/react/edge/edge-stacks/CreateView/types.ts
@@ -0,0 +1,37 @@
+import { RegistryId } from '@/react/portainer/registries/types/registry';
+import {
+  GitFormModel,
+  RelativePathModel,
+} from '@/react/portainer/gitops/types';
+
+import { EnvVarValues } from '@@/form-components/EnvironmentVariablesFieldset';
+
+import { EdgeGroup } from '../../edge-groups/types';
+import { DeploymentType, StaggerConfig } from '../types';
+
+import { KubeFormValues } from './KubeManifestForm';
+import { Values as TemplateFieldsetValues } from './TemplateFieldset/types';
+
+export type Method = 'editor' | 'upload' | 'repository' | 'template';
+
+export interface DockerFormValues {
+  method: Method;
+  fileContent: string;
+  file?: File;
+  templateValues: TemplateFieldsetValues;
+  git: GitFormModel;
+  relativePath: RelativePathModel;
+}
+
+export interface FormValues extends KubeFormValues, DockerFormValues {
+  method: Method;
+  name: string;
+  groupIds: Array<EdgeGroup['Id']>;
+  deploymentType: DeploymentType;
+  envVars: EnvVarValues;
+  privateRegistryId: RegistryId;
+  prePullImage: boolean;
+  retryDeploy: boolean;
+  enableWebhook: boolean;
+  staggerConfig: StaggerConfig;
+}
diff --git a/app/react/edge/edge-stacks/CreateView/useCreate.tsx b/app/react/edge/edge-stacks/CreateView/useCreate.tsx
new file mode 100644
index 0000000..35eaeee
--- /dev/null
+++ b/app/react/edge/edge-stacks/CreateView/useCreate.tsx
@@ -0,0 +1,142 @@
+import { useRouter } from '@uirouter/react';
+
+import { TemplateViewModel } from '@/react/portainer/templates/app-templates/view-model';
+import { CustomTemplate } from '@/react/portainer/templates/custom-templates/types';
+import { notifySuccess } from '@/portainer/services/notifications';
+import { transformAutoUpdateViewModel } from '@/react/portainer/gitops/AutoUpdateFieldset/utils';
+
+import {
+  BasePayload,
+  CreateEdgeStackPayload,
+  useCreateEdgeStack,
+} from '../queries/useCreateEdgeStack/useCreateEdgeStack';
+
+import { FormValues } from './types';
+
+export function useCreate({
+  webhookId,
+  template,
+  templateType,
+}: {
+  webhookId: string;
+  template: TemplateViewModel | CustomTemplate | undefined;
+  templateType: 'app' | 'custom' | undefined;
+}) {
+  const router = useRouter();
+  const mutation = useCreateEdgeStack();
+
+  return {
+    isLoading: mutation.isLoading,
+    onSubmit: handleSubmit,
+  };
+
+  function handleSubmit(values: FormValues) {
+    const method = getMethod(
+      values.method,
+      getIsGitTemplate(template, templateType)
+    );
+
+    mutation.mutate(getPayload(method, values), {
+      onSuccess: () => {
+        notifySuccess('Success', 'Edge stack created');
+        router.stateService.go('^');
+      },
+    });
+
+    function getPayload(
+      method: 'string' | 'file' | 'git',
+      values: FormValues
+    ): CreateEdgeStackPayload {
+      switch (method) {
+        case 'file':
+          if (!values.file) {
+            throw new Error('File is required');
+          }
+
+          return {
+            method: 'file',
+            payload: {
+              ...getBasePayload(values),
+              file: values.file,
+              webhook: values.enableWebhook ? webhookId : undefined,
+            },
+          };
+        case 'string':
+          return {
+            method: 'string',
+            payload: {
+              ...getBasePayload(values),
+              fileContent: values.fileContent,
+              webhook: values.enableWebhook ? webhookId : undefined,
+            },
+          };
+        case 'git':
+          return {
+            method: 'git',
+            payload: {
+              ...getBasePayload(values),
+              git: values.git,
+              relativePathSettings: values.relativePath,
+              autoUpdate: transformAutoUpdateViewModel(
+                values.git.AutoUpdate,
+                webhookId
+              ),
+            },
+          };
+        default:
+          throw new Error(`Unknown method: ${method}`);
+      }
+    }
+
+    function getBasePayload(values: FormValues): BasePayload {
+      const templateEnvVarsAsPairs = Object.entries(
+        values.templateValues.envVars
+      ).map(([name, value]) => ({
+        name,
+        value,
+      }));
+      return {
+        deploymentType: values.deploymentType,
+        edgeGroups: values.groupIds,
+        name: values.name,
+        envVars: [...values.envVars, ...templateEnvVarsAsPairs],
+        registries: values.privateRegistryId ? [values.privateRegistryId] : [],
+        prePullImage: values.prePullImage,
+        retryDeploy: values.retryDeploy,
+        staggerConfig: values.staggerConfig,
+        useManifestNamespaces: values.useManifestNamespaces,
+      };
+    }
+  }
+}
+
+function getMethod(
+  method: 'template' | 'repository' | 'editor' | 'upload',
+  isGitTemplate: boolean
+): 'string' | 'file' | 'git' {
+  switch (method) {
+    case 'upload':
+      return 'file';
+    case 'repository':
+      return 'git';
+    case 'template':
+      if (isGitTemplate) {
+        return 'git';
+      }
+      return 'string';
+    case 'editor':
+    default:
+      return 'string';
+  }
+}
+
+function getIsGitTemplate(
+  template: TemplateViewModel | CustomTemplate | undefined,
+  templateType: 'app' | 'custom' | undefined
+) {
+  if (templateType === 'app') {
+    return false;
+  }
+
+  return !!template && !!(template as CustomTemplate).GitConfig;
+}
diff --git a/app/react/edge/edge-stacks/CreateView/useRenderAppTemplate.tsx b/app/react/edge/edge-stacks/CreateView/useRenderAppTemplate.tsx
new file mode 100644
index 0000000..90eaacb
--- /dev/null
+++ b/app/react/edge/edge-stacks/CreateView/useRenderAppTemplate.tsx
@@ -0,0 +1,87 @@
+import { SetStateAction, useEffect, useState } from 'react';
+
+import { renderTemplate } from '@/react/portainer/custom-templates/components/utils';
+import { useAppTemplate } from '@/react/portainer/templates/app-templates/queries/useAppTemplates';
+import { useAppTemplateFile } from '@/react/portainer/templates/app-templates/queries/useAppTemplateFile';
+import { TemplateViewModel } from '@/react/portainer/templates/app-templates/view-model';
+
+import { DeploymentType } from '../types';
+import { getDefaultStaggerConfig } from '../components/StaggerFieldset.types';
+
+import { DockerFormValues, FormValues } from './types';
+
+/**
+ * useRenderAppTemplate fetches the app template (file and data) and returns it
+ * as a TemplateViewModel.
+ *
+ * It also renders the template file and updates the form values.
+ */
+export function useRenderAppTemplate(
+  templateValues: DockerFormValues['templateValues'],
+  setValues: (values: SetStateAction<DockerFormValues>) => void
+) {
+  const templateQuery = useAppTemplate(templateValues.templateId, {
+    enabled: templateValues.type === 'app',
+  });
+
+  const template = templateQuery.data;
+
+  const templateFileQuery = useAppTemplateFile(templateValues.templateId, {
+    enabled: templateValues.type === 'app',
+  });
+
+  const [currentTemplateId, setCurrentTemplateId] = useState<
+    number | undefined
+  >(templateValues.templateId);
+
+  useEffect(() => {
+    if (templateValues.type === 'app' && templateFileQuery.data) {
+      const newTemplateValues = getValuesFromAppTemplate(template);
+      const newFile = renderTemplate(
+        templateFileQuery.data,
+        templateValues.variables,
+        []
+      );
+
+      setCurrentTemplateId(template?.Id);
+      setValues((values) => ({
+        ...values,
+        ...newTemplateValues,
+        fileContent: newFile,
+      }));
+    }
+  }, [
+    currentTemplateId,
+    setValues,
+    template,
+    templateFileQuery.data,
+    templateFileQuery.isInitialLoading,
+    templateValues.type,
+    templateValues.variables,
+  ]);
+
+  return {
+    appTemplate: template,
+    isInitialLoading:
+      templateQuery.isInitialLoading || templateFileQuery.isInitialLoading,
+  };
+}
+
+function getValuesFromAppTemplate(
+  template: TemplateViewModel | undefined
+): Partial<FormValues> {
+  if (!template) {
+    return {};
+  }
+
+  return {
+    deploymentType: DeploymentType.Compose,
+    ...(template
+      ? {
+          prePullImage: false,
+          retryDeploy: false,
+          staggerConfig: getDefaultStaggerConfig(),
+        }
+      : {}),
+  };
+}
diff --git a/app/react/edge/edge-stacks/CreateView/useRenderCustomTemplate.tsx b/app/react/edge/edge-stacks/CreateView/useRenderCustomTemplate.tsx
new file mode 100644
index 0000000..fb4da0b
--- /dev/null
+++ b/app/react/edge/edge-stacks/CreateView/useRenderCustomTemplate.tsx
@@ -0,0 +1,97 @@
+import { SetStateAction, useEffect, useState } from 'react';
+
+import { renderTemplate } from '@/react/portainer/custom-templates/components/utils';
+import { useCustomTemplateFile } from '@/react/portainer/templates/custom-templates/queries/useCustomTemplateFile';
+import { useCustomTemplate } from '@/react/portainer/templates/custom-templates/queries/useCustomTemplate';
+import {
+  CustomTemplate,
+  getTemplateSourceId,
+} from '@/react/portainer/templates/custom-templates/types';
+import { StackType } from '@/react/common/stacks/types';
+import { toGitFormModel } from '@/react/portainer/gitops/types';
+
+import { DeploymentType } from '../types';
+import { getDefaultStaggerConfig } from '../components/StaggerFieldset.types';
+
+import { DockerFormValues, FormValues } from './types';
+
+export function useRenderCustomTemplate(
+  templateValues: DockerFormValues['templateValues'],
+  setValues: (values: SetStateAction<DockerFormValues>) => void
+) {
+  const templateQuery = useCustomTemplate(templateValues.templateId, {
+    enabled: templateValues.type === 'custom',
+  });
+
+  const template = templateQuery.data;
+
+  const templateFileQuery = useCustomTemplateFile(
+    templateValues.templateId,
+    !!template?.GitConfig,
+    {
+      enabled: templateValues.type === 'custom',
+    }
+  );
+
+  const [currentTemplateId, setCurrentTemplateId] = useState<
+    number | undefined
+  >(templateValues.templateId);
+
+  useEffect(() => {
+    if (templateValues.type === 'custom' && templateFileQuery.data) {
+      const newTemplateValues = getValuesFromTemplate(template);
+      const newFile = renderTemplate(
+        templateFileQuery.data,
+        templateValues.variables,
+        template?.Variables || []
+      );
+
+      setCurrentTemplateId(template?.Id);
+      setValues((values) => ({
+        ...values,
+        ...newTemplateValues,
+        fileContent: newFile,
+      }));
+    }
+  }, [
+    currentTemplateId,
+    setValues,
+    template,
+    templateFileQuery.data,
+    templateFileQuery.isInitialLoading,
+    templateValues.type,
+    templateValues.variables,
+  ]);
+
+  return {
+    customTemplate: template,
+    isInitialLoading:
+      templateQuery.isInitialLoading || templateFileQuery.isInitialLoading,
+  };
+}
+
+function getValuesFromTemplate(
+  template: CustomTemplate | undefined
+): Partial<FormValues> {
+  if (!template) {
+    return {};
+  }
+
+  return {
+    deploymentType:
+      template.Type === StackType.Kubernetes
+        ? DeploymentType.Kubernetes
+        : DeploymentType.Compose,
+    git: toGitFormModel(getTemplateSourceId(template), template.GitConfig),
+    ...(template.EdgeSettings
+      ? {
+          prePullImage: template.EdgeSettings.PrePullImage || false,
+          retryDeploy: template.EdgeSettings.RetryDeploy || false,
+          privateRegistryId: template.EdgeSettings.PrivateRegistryId,
+          staggerConfig:
+            template.EdgeSettings.StaggerConfig || getDefaultStaggerConfig(),
+          ...template.EdgeSettings.RelativePathSettings,
+        }
+      : {}),
+  };
+}
diff --git a/app/react/edge/edge-stacks/CreateView/useTemplateParams.tsx b/app/react/edge/edge-stacks/CreateView/useTemplateParams.tsx
new file mode 100644
index 0000000..f3ae283
--- /dev/null
+++ b/app/react/edge/edge-stacks/CreateView/useTemplateParams.tsx
@@ -0,0 +1,28 @@
+import { useParamsState } from '@/react/hooks/useParamState';
+
+export function useTemplateParams() {
+  const [{ templateId, templateType }, setTemplateParams] = useParamsState(
+    (params) => ({
+      templateId: parseTemplateId(params.templateId),
+      templateType: parseTemplateType(params.templateType),
+    })
+  );
+
+  return [{ templateId, templateType }, setTemplateParams] as const;
+}
+
+function parseTemplateId(param?: string) {
+  if (!param) {
+    return undefined;
+  }
+
+  return parseInt(param, 10);
+}
+
+function parseTemplateType(param?: string): 'app' | 'custom' | undefined {
+  if (param === 'app' || param === 'custom') {
+    return param;
+  }
+
+  return undefined;
+}
diff --git a/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/ComposeForm.tsx b/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/ComposeForm.tsx
new file mode 100644
index 0000000..8d3fb22
--- /dev/null
+++ b/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/ComposeForm.tsx
@@ -0,0 +1,90 @@
+import { useFormikContext } from 'formik';
+
+import { useDockerComposeSchema } from '@/react/hooks/useDockerComposeSchema/useDockerComposeSchema';
+
+import { TextTip } from '@@/Tip/TextTip';
+import { WebEditorForm } from '@@/WebEditorForm';
+
+import { DeploymentType } from '../../types';
+
+import { FormValues } from './types';
+
+export function ComposeForm({
+  handleContentChange,
+  hasKubeEndpoint,
+  handleVersionChange,
+  versionOptions,
+}: {
+  hasKubeEndpoint: boolean;
+  handleContentChange: (type: DeploymentType, content: string) => void;
+  handleVersionChange: (newVersion: number) => void;
+  versionOptions: number[] | undefined;
+}) {
+  const { errors, values } = useFormikContext<FormValues>();
+  const { data: dockerComposeSchema } = useDockerComposeSchema();
+
+  return (
+    <>
+      {hasKubeEndpoint && (
+        <TextTip>
+          <p>
+            Portainer no longer supports{' '}
+            <a
+              href="https://docs.docker.com/compose/compose-file/"
+              target="_blank"
+              rel="noreferrer"
+            >
+              docker-compose
+            </a>{' '}
+            format manifests for Kubernetes deployments, and we have removed the{' '}
+            <a href="https://kompose.io/" target="_blank" rel="noreferrer">
+              Kompose
+            </a>{' '}
+            conversion tool which enables this. The reason for this is because
+            Kompose now poses a security risk, since it has a number of Common
+            Vulnerabilities and Exposures (CVEs).
+          </p>
+          <p>
+            Unfortunately, while the Kompose project has a maintainer and is
+            part of the CNCF, it is not being actively maintained. Releases are
+            very infrequent and new pull requests to the project (including ones
+            we&apos;ve submitted) are taking months to be merged, with new CVEs
+            arising in the meantime.
+          </p>
+          <p>
+            We advise installing your own instance of Kompose in a sandbox
+            environment, performing conversions of your Docker Compose files to
+            Kubernetes manifests and using those manifests to set up
+            applications.
+          </p>
+        </TextTip>
+      )}
+
+      <WebEditorForm
+        data-cy="compose-editor"
+        value={values.content}
+        type="yaml"
+        schema={dockerComposeSchema}
+        id="compose-editor"
+        textTip="Define or paste the content of your docker compose file here"
+        onChange={(value) => handleContentChange(DeploymentType.Compose, value)}
+        error={errors.content}
+        readonly={hasKubeEndpoint}
+        versions={versionOptions}
+        onVersionChange={handleVersionChange}
+      >
+        <div>
+          You can get more information about Compose file format in the{' '}
+          <a
+            href="https://docs.docker.com/compose/compose-file/"
+            target="_blank"
+            rel="noreferrer"
+          >
+            official documentation
+          </a>
+          .
+        </div>
+      </WebEditorForm>
+    </>
+  );
+}
diff --git a/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/EditEdgeStackForm.tsx b/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/EditEdgeStackForm.tsx
new file mode 100644
index 0000000..911c65e
--- /dev/null
+++ b/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/EditEdgeStackForm.tsx
@@ -0,0 +1,12 @@
+import { EdgeStack } from '@/react/edge/edge-stacks/types';
+
+import { GitForm } from './GitForm';
+import { NonGitStackForm } from './NonGitStackForm';
+
+export function EditEdgeStackForm({ edgeStack }: { edgeStack: EdgeStack }) {
+  if (edgeStack.GitConfig) {
+    return <GitForm stack={edgeStack} />;
+  }
+
+  return <NonGitStackForm edgeStack={edgeStack} />;
+}
diff --git a/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/GitForm/GitForm.test.tsx b/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/GitForm/GitForm.test.tsx
new file mode 100644
index 0000000..bbd70c7
--- /dev/null
+++ b/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/GitForm/GitForm.test.tsx
@@ -0,0 +1,94 @@
+import { render, screen } from '@testing-library/react';
+import { http, HttpResponse } from 'msw';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { UserViewModel } from '@/portainer/models/user';
+import { server } from '@/setup-tests/server';
+import { createWebhookId } from '@/portainer/helpers/webhookHelper';
+
+import { EdgeStack } from '../../../types';
+
+import { GitForm } from './GitForm';
+
+vi.mock('@/portainer/helpers/webhookHelper', async (importOriginal) => ({
+  ...(await importOriginal<
+    typeof import('@/portainer/helpers/webhookHelper')
+  >()),
+  createWebhookId: vi.fn(),
+}));
+
+function renderComponent(stack: EdgeStack) {
+  const user = new UserViewModel({ Username: 'user', Role: 1 });
+
+  const Wrapped = withTestQueryProvider(
+    withUserProvider(
+      withTestRouter(() => <GitForm stack={stack} />),
+      user
+    )
+  );
+
+  return render(<Wrapped />);
+}
+
+describe('GitForm', () => {
+  const mockStack: EdgeStack = {
+    Id: 1,
+    Name: 'test-stack',
+    EdgeGroups: [1],
+    DeploymentType: 0,
+    GitConfig: {
+      URL: 'https://github.com/test/repo',
+      ReferenceName: 'refs/heads/main',
+      ConfigFilePath: 'docker-compose.yml',
+      ConfigHash: 'abc123',
+      Authentication: {
+        Username: '',
+        Password: '',
+      },
+    },
+    GitSourceId: 1,
+    PrePullImage: false,
+    RetryDeploy: false,
+    RetryPeriod: 0,
+    EnvVars: [],
+    Registries: [],
+  } as unknown as EdgeStack;
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    vi.mocked(createWebhookId).mockReturnValue('default-webhook-id');
+    server.use(
+      http.get('/api/registries', () => HttpResponse.json([])),
+      http.get('/api/edge_groups', () => HttpResponse.json([]))
+    );
+  });
+
+  it('should not display any visible error messages on initial load', () => {
+    renderComponent(mockStack);
+
+    const errors = screen.queryAllByRole('alert');
+    expect(errors).toHaveLength(0);
+  });
+
+  it('should call createWebhookId only once even when re-renders occur', () => {
+    vi.mocked(createWebhookId).mockReturnValue('stable-webhook-id');
+
+    const user = new UserViewModel({ Username: 'user', Role: 1 });
+    const Wrapped = withTestQueryProvider(
+      withUserProvider(
+        withTestRouter(() => <GitForm stack={mockStack} />),
+        user
+      )
+    );
+
+    const { rerender } = render(<Wrapped />);
+
+    expect(vi.mocked(createWebhookId)).toHaveBeenCalledTimes(1);
+
+    rerender(<Wrapped />);
+
+    expect(vi.mocked(createWebhookId)).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/GitForm/GitForm.tsx b/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/GitForm/GitForm.tsx
new file mode 100644
index 0000000..33f169b
--- /dev/null
+++ b/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/GitForm/GitForm.tsx
@@ -0,0 +1,297 @@
+import { useState } from 'react';
+import { Form, Formik, useFormikContext } from 'formik';
+import { useRouter } from '@uirouter/react';
+import { array, number, object } from 'yup';
+
+import { AutoUpdateFieldset } from '@/react/portainer/gitops/AutoUpdateFieldset';
+import { GitSourceSelector } from '@/react/portainer/gitops/sources/GitSourceSelector';
+import {
+  parseAutoUpdateResponse,
+  transformAutoUpdateViewModel,
+} from '@/react/portainer/gitops/AutoUpdateFieldset/utils';
+import { RefField } from '@/react/portainer/gitops/RefField';
+import {
+  AutoUpdateModel,
+  RelativePathModel,
+} from '@/react/portainer/gitops/types';
+import {
+  baseEdgeStackWebhookUrl,
+  createWebhookId,
+} from '@/portainer/helpers/webhookHelper';
+import { EdgeGroup } from '@/react/edge/edge-groups/types';
+import { DeploymentType, EdgeStack } from '@/react/edge/edge-stacks/types';
+import { EdgeGroupsSelector } from '@/react/edge/edge-stacks/components/EdgeGroupsSelector';
+import { EdgeStackDeploymentTypeSelector } from '@/react/edge/edge-stacks/components/EdgeStackDeploymentTypeSelector';
+import { notifySuccess } from '@/portainer/services/notifications';
+import { EnvironmentType } from '@/react/portainer/environments/types';
+import { Registry } from '@/react/portainer/registries/types/registry';
+import { useRegistries } from '@/react/portainer/registries/queries/useRegistries';
+import { RelativePathFieldset } from '@/react/portainer/gitops/RelativePathFieldset/RelativePathFieldset';
+import { parseRelativePathResponse } from '@/react/portainer/gitops/RelativePathFieldset/utils';
+import { isBE } from '@/react/portainer/feature-flags/feature-flags.service';
+import { GitReferenceCard } from '@/react/portainer/gitops/GitReferenceCard';
+
+import { LoadingButton } from '@@/buttons';
+import { FormSection } from '@@/form-components/FormSection';
+import { TextTip } from '@@/Tip/TextTip';
+import { FormError } from '@@/form-components/FormError';
+import { EnvironmentVariablesPanel } from '@@/form-components/EnvironmentVariablesFieldset';
+import { EnvVar } from '@@/form-components/EnvironmentVariablesFieldset/types';
+import { Link } from '@@/Link';
+
+import { useEdgeGroupHasType } from '../useEdgeGroupHasType';
+import { PrivateRegistryFieldset } from '../../../components/PrivateRegistryFieldset';
+
+import {
+  UpdateEdgeStackGitPayload,
+  useUpdateEdgeStackGitMutation,
+} from './useUpdateEdgeStackGitMutation';
+
+interface FormValues {
+  groupIds: EdgeGroup['Id'][];
+  deploymentType: DeploymentType;
+  autoUpdate: AutoUpdateModel;
+  refName: string;
+  envVars: EnvVar[];
+  privateRegistryId?: Registry['Id'];
+  relativePath: RelativePathModel;
+}
+
+export function GitForm({ stack }: { stack: EdgeStack }) {
+  const router = useRouter();
+  const updateStackMutation = useUpdateEdgeStackGitMutation();
+
+  const [webhookId] = useState(
+    () => stack.AutoUpdate?.Webhook || createWebhookId()
+  );
+
+  if (!stack.GitConfig) {
+    return null;
+  }
+
+  const initialValues: FormValues = {
+    groupIds: stack.EdgeGroups,
+    deploymentType: stack.DeploymentType,
+    autoUpdate: parseAutoUpdateResponse(stack.AutoUpdate),
+    refName: stack.GitConfig.ReferenceName,
+    relativePath: parseRelativePathResponse(stack),
+    envVars: stack.EnvVars || [],
+  };
+
+  return (
+    <Formik
+      initialValues={initialValues}
+      onSubmit={handleSubmit}
+      validationSchema={formValidation()}
+    >
+      {({ values, isValid }) => {
+        return (
+          <InnerForm
+            webhookId={webhookId}
+            onUpdateSettingsClick={handleUpdateSettings}
+            isLoading={updateStackMutation.isLoading}
+            isUpdateVersion={!!updateStackMutation.variables?.updateVersion}
+            stack={stack}
+          />
+        );
+
+        async function handleUpdateSettings() {
+          if (!isValid) {
+            return;
+          }
+
+          updateStackMutation.mutate(getPayload(values, false), {
+            onSuccess() {
+              notifySuccess('Success', 'Stack updated successfully');
+              router.stateService.reload();
+            },
+          });
+        }
+      }}
+    </Formik>
+  );
+
+  async function handleSubmit(values: FormValues) {
+    updateStackMutation.mutate(getPayload(values, true), {
+      onSuccess() {
+        notifySuccess('Success', 'Stack updated successfully');
+        router.stateService.reload();
+      },
+    });
+  }
+
+  function getPayload(
+    { autoUpdate, privateRegistryId, ...values }: FormValues,
+    updateVersion: boolean
+  ): UpdateEdgeStackGitPayload {
+    return {
+      updateVersion,
+      id: stack.Id,
+      autoUpdate: transformAutoUpdateViewModel(autoUpdate, webhookId),
+      registries:
+        typeof privateRegistryId !== 'undefined'
+          ? [privateRegistryId]
+          : undefined,
+      ...values,
+    };
+  }
+}
+
+function InnerForm({
+  isLoading,
+  isUpdateVersion,
+  onUpdateSettingsClick,
+  webhookId,
+  stack,
+}: {
+  isLoading: boolean;
+  isUpdateVersion: boolean;
+  onUpdateSettingsClick(): void;
+  webhookId: string;
+  stack: EdgeStack;
+}) {
+  const registriesQuery = useRegistries();
+  const { values, setFieldValue, isValid, handleSubmit, errors, dirty } =
+    useFormikContext<FormValues>();
+
+  const { hasType } = useEdgeGroupHasType(values.groupIds);
+
+  const hasKubeEndpoint = hasType(EnvironmentType.EdgeAgentOnKubernetes);
+  const hasDockerEndpoint = hasType(EnvironmentType.EdgeAgentOnDocker);
+
+  if (!stack.GitConfig || !stack.GitSourceId) {
+    return null;
+  }
+
+  return (
+    <Form className="form-horizontal" onSubmit={handleSubmit}>
+      <EdgeGroupsSelector
+        value={values.groupIds}
+        onChange={(value) => setFieldValue('groupIds', value)}
+        error={errors.groupIds}
+      />
+
+      {hasKubeEndpoint && hasDockerEndpoint && (
+        <TextTip>
+          There are no available deployment types when there is more than one
+          type of environment in your edge group selection (e.g. Kubernetes and
+          Docker environments). Please select edge groups that have environments
+          of the same type.
+        </TextTip>
+      )}
+
+      {values.deploymentType === DeploymentType.Compose && hasKubeEndpoint && (
+        <FormError>
+          Edge groups with kubernetes environments no longer support compose
+          deployment types in Portainer. Please select edge groups that only
+          have docker environments when using compose deployment types.
+        </FormError>
+      )}
+      <EdgeStackDeploymentTypeSelector
+        value={values.deploymentType}
+        hasDockerEndpoint={hasType(EnvironmentType.EdgeAgentOnDocker)}
+        hasKubeEndpoint={hasType(EnvironmentType.EdgeAgentOnKubernetes)}
+        onChange={(value) => {
+          setFieldValue('deploymentType', value);
+        }}
+      />
+
+      <GitReferenceCard
+        stackType="edge"
+        autoUpdate={stack.AutoUpdate}
+        gitConfig={stack.GitConfig}
+        sourceId={stack.GitSourceId}
+      />
+
+      <FormSection title="Update from git repository">
+        <AutoUpdateFieldset
+          webhookId={webhookId}
+          value={values.autoUpdate}
+          onChange={(value) =>
+            setFieldValue('autoUpdate', {
+              ...values.autoUpdate,
+              ...value,
+            })
+          }
+          baseWebhookUrl={baseEdgeStackWebhookUrl()}
+          errors={errors.autoUpdate}
+        />
+      </FormSection>
+
+      <FormSection title="Advanced configuration" isFoldable>
+        <RefField
+          value={values.refName}
+          onChange={(value) => setFieldValue('refName', value)}
+          sourceId={stack.GitSourceId}
+          error={errors.refName}
+        />
+
+        <GitSourceSelector value={stack.GitSourceId} readOnly />
+        <TextTip>
+          Credentials are managed by the source.{' '}
+          <Link
+            to="portainer.gitops.sources.item"
+            params={{ sourceId: stack.GitSourceId }}
+            data-cy="source-item-link"
+          >
+            Edit source
+          </Link>
+        </TextTip>
+
+        {isBE && (
+          <RelativePathFieldset
+            values={values.relativePath}
+            isEditing
+            onChange={() => {}}
+          />
+        )}
+
+        <EnvironmentVariablesPanel
+          onChange={(value) => setFieldValue('envVars', value)}
+          values={values.envVars}
+          errors={errors.envVars}
+        />
+      </FormSection>
+
+      <PrivateRegistryFieldset
+        value={values.privateRegistryId}
+        onChange={(value) => setFieldValue('privateRegistryId', value)}
+        registries={registriesQuery.data ?? []}
+        formInvalid={!isValid}
+        method="repository"
+        errorMessage={errors.privateRegistryId}
+      />
+
+      <FormSection title="Actions">
+        <LoadingButton
+          disabled={dirty || !isValid || isLoading}
+          data-cy="pull-and-update-stack-button"
+          isLoading={isUpdateVersion && isLoading}
+          loadingText="updating stack..."
+        >
+          Pull and update stack
+        </LoadingButton>
+
+        <LoadingButton
+          type="button"
+          disabled={!dirty || !isValid || isLoading}
+          isLoading={!isUpdateVersion && isLoading}
+          loadingText="updating settings..."
+          onClick={onUpdateSettingsClick}
+          data-cy="edge-stack-update-settings-button"
+        >
+          Update settings
+        </LoadingButton>
+      </FormSection>
+    </Form>
+  );
+}
+
+function formValidation() {
+  return object({
+    groupIds: array()
+      .of(number().required())
+      .required()
+      .min(1, 'At least one edge group is required'),
+  });
+}
diff --git a/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/GitForm/index.ts b/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/GitForm/index.ts
new file mode 100644
index 0000000..9b69bdb
--- /dev/null
+++ b/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/GitForm/index.ts
@@ -0,0 +1 @@
+export { GitForm } from './GitForm';
diff --git a/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/GitForm/useUpdateEdgeStackGitMutation.ts b/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/GitForm/useUpdateEdgeStackGitMutation.ts
new file mode 100644
index 0000000..b5af2b6
--- /dev/null
+++ b/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/GitForm/useUpdateEdgeStackGitMutation.ts
@@ -0,0 +1,48 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import {
+  mutationOptions,
+  withError,
+  withInvalidate,
+} from '@/react-tools/react-query';
+import { AutoUpdateResponse } from '@/react/portainer/gitops/types';
+import { buildUrl } from '@/react/edge/edge-stacks/queries/buildUrl';
+import { DeploymentType, EdgeStack } from '@/react/edge/edge-stacks/types';
+import { EdgeGroup } from '@/react/edge/edge-groups/types';
+import { Registry } from '@/react/portainer/registries/types/registry';
+
+import { queryKeys } from '../../../queries/query-keys';
+
+export interface UpdateEdgeStackGitPayload {
+  id: EdgeStack['Id'];
+  autoUpdate: AutoUpdateResponse | null;
+  refName: string;
+  groupIds: EdgeGroup['Id'][];
+  deploymentType: DeploymentType;
+  updateVersion: boolean;
+  registries?: Array<Registry['Id']>;
+}
+
+export function useUpdateEdgeStackGitMutation() {
+  const queryClient = useQueryClient();
+
+  return useMutation(
+    updateEdgeStackGit,
+    mutationOptions(
+      withError('Failed updating stack'),
+      withInvalidate(queryClient, [queryKeys.base()])
+    )
+  );
+}
+
+async function updateEdgeStackGit({
+  id,
+  ...payload
+}: UpdateEdgeStackGitPayload) {
+  try {
+    await axios.put(buildUrl(id, 'git'), payload);
+  } catch (err) {
+    throw parseAxiosError(err as Error, 'Failed updating stack');
+  }
+}
diff --git a/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/KubernetesForm.tsx b/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/KubernetesForm.tsx
new file mode 100644
index 0000000..a493ef1
--- /dev/null
+++ b/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/KubernetesForm.tsx
@@ -0,0 +1,62 @@
+import { useFormikContext } from 'formik';
+
+import { SwitchField } from '@@/form-components/SwitchField';
+import { WebEditorForm } from '@@/WebEditorForm';
+
+import { DeploymentType } from '../../types';
+
+import { FormValues } from './types';
+
+export function KubernetesForm({
+  handleContentChange,
+  handleVersionChange,
+  versionOptions,
+}: {
+  handleContentChange: (type: DeploymentType, content: string) => void;
+  handleVersionChange: (version: number) => void;
+  versionOptions: number[] | undefined;
+}) {
+  const { errors, values, setFieldValue } = useFormikContext<FormValues>();
+
+  return (
+    <>
+      <div className="form-group">
+        <div className="col-sm-12">
+          <SwitchField
+            label="Use namespace(s) specified from manifest"
+            data-cy="use-manifest-namespaces-switch"
+            tooltip="If you have defined namespaces in your deployment file turning this on will enforce the use of those only in the deployment"
+            checked={values.useManifestNamespaces}
+            onChange={(value) => setFieldValue('useManifestNamespaces', value)}
+          />
+        </div>
+      </div>
+
+      <WebEditorForm
+        data-cy="kube-manifest-editor"
+        value={values.content}
+        type="yaml"
+        id="kube-manifest-editor"
+        textTip="Define or paste the content of your manifest here"
+        onChange={(value) =>
+          handleContentChange(DeploymentType.Kubernetes, value)
+        }
+        error={errors.content}
+        versions={versionOptions}
+        onVersionChange={handleVersionChange}
+      >
+        <p>
+          You can get more information about Kubernetes file format in the{' '}
+          <a
+            href="https://kubernetes.io/docs/concepts/overview/working-with-objects/kubernetes-objects/"
+            target="_blank"
+            rel="noreferrer"
+          >
+            official documentation
+          </a>
+          .
+        </p>
+      </WebEditorForm>
+    </>
+  );
+}
diff --git a/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/NonGitStackForm.tsx b/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/NonGitStackForm.tsx
new file mode 100644
index 0000000..371d420
--- /dev/null
+++ b/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/NonGitStackForm.tsx
@@ -0,0 +1,434 @@
+import { Form, Formik, useFormikContext } from 'formik';
+import { useState, useEffect } from 'react';
+import { array, boolean, number, object, SchemaOf, string } from 'yup';
+import { useRouter } from '@uirouter/react';
+import _ from 'lodash';
+
+import { EdgeGroupsSelector } from '@/react/edge/edge-stacks/components/EdgeGroupsSelector';
+import { EdgeStackDeploymentTypeSelector } from '@/react/edge/edge-stacks/components/EdgeStackDeploymentTypeSelector';
+import {
+  DeploymentType,
+  EdgeStack,
+  StaggerOption,
+} from '@/react/edge/edge-stacks/types';
+import { EnvironmentType } from '@/react/portainer/environments/types';
+import { WebhookSettings } from '@/react/portainer/gitops/AutoUpdateFieldset/WebhookSettings';
+import {
+  baseEdgeStackWebhookUrl,
+  createWebhookId,
+} from '@/portainer/helpers/webhookHelper';
+import { isBE } from '@/react/portainer/feature-flags/feature-flags.service';
+import { notifySuccess } from '@/portainer/services/notifications';
+import { confirmStackUpdate } from '@/react/common/stacks/common/confirm-stack-update';
+
+import { FormSection } from '@@/form-components/FormSection';
+import { TextTip } from '@@/Tip/TextTip';
+import { SwitchField } from '@@/form-components/SwitchField';
+import { LoadingButton } from '@@/buttons';
+import { FormError } from '@@/form-components/FormError';
+import {
+  EnvironmentVariablesPanel,
+  envVarValidation,
+} from '@@/form-components/EnvironmentVariablesFieldset';
+import { usePreventExit } from '@@/WebEditorForm';
+
+import {
+  getEdgeStackFile,
+  useEdgeStackFile,
+} from '../../queries/useEdgeStackFile';
+import {
+  StaggerFieldset,
+  staggerConfigValidation,
+} from '../../components/StaggerFieldset';
+import { RetryDeployToggle } from '../../components/RetryDeployToggle';
+import { PrePullToggle } from '../../components/PrePullToggle';
+import { getDefaultStaggerConfig } from '../../components/StaggerFieldset.types';
+
+import { PrivateRegistryFieldsetWrapper } from './PrivateRegistryFieldsetWrapper';
+import { FormValues } from './types';
+import { useEdgeGroupHasType } from './useEdgeGroupHasType';
+import { useStaggerUpdateStatus } from './useStaggerUpdateStatus';
+import { useUpdateEdgeStackMutation } from './useUpdateEdgeStackMutation';
+import { ComposeForm } from './ComposeForm';
+import { KubernetesForm } from './KubernetesForm';
+import { useAllowKubeToSelectCompose } from './useAllowKubeToSelectCompose';
+
+const forms = {
+  [DeploymentType.Compose]: ComposeForm,
+  [DeploymentType.Kubernetes]: KubernetesForm,
+};
+
+export function NonGitStackForm({ edgeStack }: { edgeStack: EdgeStack }) {
+  const mutation = useUpdateEdgeStackMutation();
+  const fileQuery = useEdgeStackFile(edgeStack.Id, { skipErrors: true });
+  const allowKubeToSelectCompose = useAllowKubeToSelectCompose(edgeStack);
+  const router = useRouter();
+  const [webhookId] = useState(() => edgeStack.Webhook || createWebhookId());
+
+  if (!fileQuery.isSuccess) {
+    return null;
+  }
+
+  const fileContent = fileQuery.data || '';
+
+  const formValues: FormValues = {
+    edgeGroups: edgeStack.EdgeGroups,
+    deploymentType: edgeStack.DeploymentType,
+    privateRegistryId: edgeStack.Registries?.[0],
+    content: fileContent,
+    useManifestNamespaces: edgeStack.UseManifestNamespaces,
+    prePullImage: edgeStack.PrePullImage ?? false,
+    retryDeploy: edgeStack.RetryDeploy ?? false,
+    webhookEnabled: !!edgeStack.Webhook,
+    envVars: edgeStack.EnvVars || [],
+    rollbackTo: undefined,
+    staggerConfig: edgeStack.StaggerConfig || getDefaultStaggerConfig(),
+  };
+
+  const versionOptions = getVersions(edgeStack);
+
+  return (
+    <Formik
+      initialValues={formValues}
+      onSubmit={handleSubmit}
+      validationSchema={formValidation()}
+    >
+      <InnerForm
+        edgeStack={edgeStack}
+        isLoading={mutation.isLoading}
+        allowKubeToSelectCompose={allowKubeToSelectCompose}
+        versionOptions={versionOptions}
+        isSaved={mutation.isSuccess}
+      />
+    </Formik>
+  );
+
+  async function handleSubmit(values: FormValues) {
+    let rePullImage = false;
+    if (isBE && values.deploymentType === DeploymentType.Compose) {
+      const defaultToggle = values.prePullImage;
+      const result = await confirmStackUpdate(
+        'Do you want to force an update of the stack?',
+        defaultToggle
+      );
+      if (!result) {
+        return;
+      }
+
+      rePullImage = result.repullImageAndRedeploy;
+    }
+
+    const updateVersion = !!(
+      fileContent !== values.content ||
+      values.privateRegistryId !== edgeStack.Registries?.[0] ||
+      values.useManifestNamespaces !== edgeStack.UseManifestNamespaces ||
+      values.prePullImage !== edgeStack.PrePullImage ||
+      values.retryDeploy !== edgeStack.RetryDeploy ||
+      !edgeStack.EnvVars ||
+      _.differenceWith(values.envVars, edgeStack.EnvVars, _.isEqual).length >
+        0 ||
+      rePullImage
+    );
+
+    mutation.mutate(
+      {
+        id: edgeStack.Id,
+        stackFileContent: values.content,
+        edgeGroups: values.edgeGroups,
+        deploymentType: values.deploymentType,
+        registries: values.privateRegistryId ? [values.privateRegistryId] : [],
+        useManifestNamespaces: values.useManifestNamespaces,
+        prePullImage: values.prePullImage,
+        rePullImage,
+        retryDeploy: values.retryDeploy,
+        updateVersion,
+        webhook: values.webhookEnabled ? webhookId : '',
+        envVars: values.envVars,
+        rollbackTo: values.rollbackTo,
+        staggerConfig: values.staggerConfig,
+      },
+      {
+        onSuccess: () => {
+          notifySuccess('Success', 'Stack successfully deployed');
+          router.stateService.go('^');
+        },
+      }
+    );
+  }
+}
+function getVersions(edgeStack: EdgeStack): Array<number> | undefined {
+  if (!isBE) {
+    return undefined;
+  }
+
+  return _.compact([
+    edgeStack.StackFileVersion,
+    edgeStack.PreviousDeploymentInfo?.FileVersion,
+  ]);
+}
+
+function InnerForm({
+  edgeStack,
+  isLoading,
+  allowKubeToSelectCompose,
+  versionOptions,
+  isSaved,
+}: {
+  edgeStack: EdgeStack;
+  isLoading: boolean;
+  allowKubeToSelectCompose: boolean;
+  versionOptions: number[] | undefined;
+  isSaved: boolean;
+}) {
+  const {
+    values,
+    setFieldValue,
+    isValid,
+    errors,
+    setValues,
+    setFieldError,
+    initialValues,
+  } = useFormikContext<FormValues>();
+
+  usePreventExit(initialValues.content, values.content, !isSaved);
+
+  const { getCachedContent, setContentCache } = useCachedContent();
+  const { hasType } = useEdgeGroupHasType(values.edgeGroups);
+  const staggerUpdateStatus = useStaggerUpdateStatus(edgeStack.Id);
+  const [selectedVersion, setSelectedVersion] = useState(versionOptions?.[0]);
+  const selectedParallelOption =
+    values.staggerConfig.StaggerOption === StaggerOption.Parallel;
+
+  useEffect(() => {
+    if (versionOptions && selectedVersion !== versionOptions[0]) {
+      setFieldValue('rollbackTo', selectedVersion);
+    } else {
+      setFieldValue('rollbackTo', undefined);
+    }
+  }, [selectedVersion, setFieldValue, versionOptions]);
+
+  const hasKubeEndpoint = hasType(EnvironmentType.EdgeAgentOnKubernetes);
+  const hasDockerEndpoint = hasType(EnvironmentType.EdgeAgentOnDocker);
+
+  if (isBE && !staggerUpdateStatus.isSuccess) {
+    return null;
+  }
+
+  const staggerUpdating =
+    staggerUpdateStatus.data === 'updating' && selectedParallelOption;
+
+  const DeploymentForm = forms[values.deploymentType];
+
+  return (
+    <Form className="form-horizontal">
+      <EdgeGroupsSelector
+        value={values.edgeGroups}
+        onChange={(value) => setFieldValue('edgeGroups', value)}
+        error={errors.edgeGroups}
+      />
+
+      {hasKubeEndpoint && hasDockerEndpoint && (
+        <TextTip>
+          There are no available deployment types when there is more than one
+          type of environment in your edge group selection (e.g. Kubernetes and
+          Docker environments). Please select edge groups that have environments
+          of the same type.
+        </TextTip>
+      )}
+
+      {values.deploymentType === DeploymentType.Compose && hasKubeEndpoint && (
+        <FormError>
+          Edge groups with kubernetes environments no longer support compose
+          deployment types in Portainer. Please select edge groups that only
+          have docker environments when using compose deployment types.
+        </FormError>
+      )}
+
+      <EdgeStackDeploymentTypeSelector
+        allowKubeToSelectCompose={allowKubeToSelectCompose}
+        value={values.deploymentType}
+        hasDockerEndpoint={hasType(EnvironmentType.EdgeAgentOnDocker)}
+        hasKubeEndpoint={hasType(EnvironmentType.EdgeAgentOnKubernetes)}
+        onChange={(value) => {
+          setFieldValue('content', getCachedContent(value));
+          setFieldValue('deploymentType', value);
+        }}
+      />
+
+      <DeploymentForm
+        hasKubeEndpoint={hasType(EnvironmentType.EdgeAgentOnKubernetes)}
+        handleContentChange={handleContentChange}
+        versionOptions={versionOptions}
+        handleVersionChange={handleVersionChange}
+      />
+
+      {isBE && (
+        <>
+          <FormSection title="Webhooks">
+            <div className="form-group">
+              <div className="col-sm-12">
+                <SwitchField
+                  label="Create an Edge stack webhook"
+                  data-cy="edge-stack-enable-webhook-switch"
+                  checked={values.webhookEnabled}
+                  labelClass="col-sm-3 col-lg-2"
+                  onChange={(value) => setFieldValue('webhookEnabled', value)}
+                  tooltip="Create a webhook (or callback URI) to automate the update of this stack. Sending a POST request to this callback URI (without requiring any authentication) will pull the most up-to-date version of the associated image and re-deploy this stack."
+                />
+              </div>
+            </div>
+
+            {edgeStack.Webhook && (
+              <>
+                <WebhookSettings
+                  baseUrl={baseEdgeStackWebhookUrl()}
+                  value={edgeStack.Webhook}
+                  docsLink=""
+                />
+
+                <TextTip color="orange">
+                  Sending environment variables to the webhook is updating the
+                  stack with the new values. New variables names will be added
+                  to the stack and existing variables will be updated.
+                </TextTip>
+              </>
+            )}
+          </FormSection>
+
+          <PrivateRegistryFieldsetWrapper
+            value={values.privateRegistryId}
+            onChange={(value) => setFieldValue('privateRegistryId', value)}
+            values={{
+              fileContent: values.content,
+            }}
+            onFieldError={(error) => setFieldError('privateRegistryId', error)}
+            error={errors.privateRegistryId}
+          />
+
+          {values.deploymentType === DeploymentType.Compose && (
+            <>
+              <EnvironmentVariablesPanel
+                onChange={(value) => setFieldValue('envVars', value)}
+                values={values.envVars}
+                errors={errors.envVars}
+              />
+
+              <PrePullToggle
+                onChange={(value) => setFieldValue('prePullImage', value)}
+                value={values.prePullImage}
+              />
+
+              <RetryDeployToggle
+                onChange={(value) => setFieldValue('retryDeploy', value)}
+                value={values.retryDeploy}
+              />
+            </>
+          )}
+
+          <StaggerFieldset
+            values={values.staggerConfig}
+            onChange={(newStaggerValues) =>
+              setValues((values) => ({
+                ...values,
+                staggerConfig: {
+                  ...values.staggerConfig,
+                  ...newStaggerValues,
+                },
+              }))
+            }
+            errors={errors.staggerConfig}
+          />
+        </>
+      )}
+
+      <FormSection title="Actions">
+        <div className="form-group">
+          <div className="col-sm-12">
+            <LoadingButton
+              className="!ml-0"
+              data-cy="update-stack-button"
+              size="small"
+              disabled={!isValid || staggerUpdating}
+              isLoading={isLoading}
+              button-spinner="$ctrl.actionInProgress"
+              loadingText="Update in progress..."
+            >
+              Update the stack
+            </LoadingButton>
+          </div>
+          {staggerUpdating && (
+            <div className="col-sm-12">
+              <FormError>
+                Concurrent updates in progress, stack update temporarily
+                unavailable
+              </FormError>
+            </div>
+          )}
+        </div>
+      </FormSection>
+    </Form>
+  );
+
+  function handleContentChange(type: DeploymentType, content: string) {
+    setFieldValue('content', content);
+    setContentCache(type, content);
+  }
+
+  async function handleVersionChange(newVersion: number) {
+    if (!versionOptions) {
+      return;
+    }
+
+    const fileContent = await getEdgeStackFile(edgeStack.Id, newVersion).catch(
+      () => ''
+    );
+    if (fileContent) {
+      if (versionOptions.length > 1) {
+        if (newVersion < versionOptions[0]) {
+          setSelectedVersion(newVersion);
+        } else {
+          setSelectedVersion(versionOptions[0]);
+        }
+      }
+      handleContentChange(values.deploymentType, fileContent);
+    }
+  }
+}
+
+function useCachedContent() {
+  const [cachedContent, setCachedContent] = useState({
+    [DeploymentType.Compose]: '',
+    [DeploymentType.Kubernetes]: '',
+  });
+
+  function handleChangeContent(type: DeploymentType, content: string) {
+    setCachedContent((cache) => ({ ...cache, [type]: content }));
+  }
+
+  return {
+    setContentCache: handleChangeContent,
+    getCachedContent: (type: DeploymentType) => cachedContent[type],
+  };
+}
+
+function formValidation(): SchemaOf<FormValues> {
+  return object({
+    content: string().required('Content is required'),
+    deploymentType: number()
+      .oneOf([0, 1, 2])
+      .required('Deployment type is required'),
+    privateRegistryId: number().optional(),
+    prePullImage: boolean().default(false),
+    retryDeploy: boolean().default(false),
+    useManifestNamespaces: boolean().default(false),
+    edgeGroups: array()
+      .of(number().required())
+      .required()
+      .min(1, 'At least one edge group is required'),
+    webhookEnabled: boolean().default(false),
+    versions: array().of(number().optional()).optional(),
+    envVars: envVarValidation(),
+    rollbackTo: number().optional(),
+    staggerConfig: staggerConfigValidation(),
+  });
+}
diff --git a/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/PrivateRegistryFieldsetWrapper.tsx b/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/PrivateRegistryFieldsetWrapper.tsx
new file mode 100644
index 0000000..51f8a66
--- /dev/null
+++ b/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/PrivateRegistryFieldsetWrapper.tsx
@@ -0,0 +1,92 @@
+import _ from 'lodash';
+
+import { notifyError } from '@/portainer/services/notifications';
+import {
+  PrivateRegistryFieldset,
+  REGISTRY_CREDENTIALS_ENABLED,
+} from '@/react/edge/edge-stacks/components/PrivateRegistryFieldset';
+import { useRegistries } from '@/react/portainer/registries/queries/useRegistries';
+import { isBE } from '@/react/portainer/feature-flags/feature-flags.service';
+
+import { useParseRegistries } from '../../queries/useParseRegistries';
+
+import { FormValues } from './types';
+
+export function PrivateRegistryFieldsetWrapper({
+  value,
+  error,
+  onChange,
+  onFieldError,
+  values,
+  isGit,
+}: {
+  value: FormValues['privateRegistryId'];
+  error?: string;
+  onChange: (value?: number) => void;
+  values: {
+    fileContent?: string;
+    file?: File;
+  };
+  onFieldError: (message: string) => void;
+  isGit?: boolean;
+}) {
+  const dryRunMutation = useParseRegistries();
+
+  const registriesQuery = useRegistries({ hideDefault: true });
+
+  if (!registriesQuery.data) {
+    return null;
+  }
+
+  return (
+    <PrivateRegistryFieldset
+      value={value}
+      formInvalid={!values.file && !values.fileContent && !isGit}
+      errorMessage={error}
+      registries={registriesQuery.data}
+      onReload={() => matchRegistry(values)}
+      onChange={(value) => {
+        onChange(value);
+        if (value === REGISTRY_CREDENTIALS_ENABLED) {
+          // Enabled, need to match registry
+          matchRegistry(values);
+        }
+      }}
+      method={isGit ? 'repository' : 'file'}
+    />
+  );
+
+  async function matchRegistry(values: { fileContent?: string; file?: File }) {
+    if (isGit) {
+      return;
+    }
+
+    try {
+      if (!isBE) {
+        return;
+      }
+
+      const registries = await dryRunMutation.mutateAsync(values);
+
+      if (registries.length === 0) {
+        return;
+      }
+
+      const validRegistry = onlyOne(registries);
+      if (validRegistry) {
+        onChange(registries[0]);
+      } else {
+        onChange(undefined);
+        onFieldError(
+          'Images need to be from a single registry, please edit and reload'
+        );
+      }
+    } catch (err) {
+      notifyError('Failure', err as Error, 'Unable to retrieve registries');
+    }
+  }
+
+  function onlyOne<T extends string | number>(arr: Array<T>) {
+    return _.uniq(arr).length === 1;
+  }
+}
diff --git a/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/atLeastTwo.ts b/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/atLeastTwo.ts
new file mode 100644
index 0000000..d99d90f
--- /dev/null
+++ b/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/atLeastTwo.ts
@@ -0,0 +1,3 @@
+export function atLeastTwo(a: boolean, b: boolean, c: boolean) {
+  return (a && b) || (a && c) || (b && c);
+}
diff --git a/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/types.ts b/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/types.ts
new file mode 100644
index 0000000..51c7503
--- /dev/null
+++ b/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/types.ts
@@ -0,0 +1,18 @@
+import { EdgeGroup } from '@/react/edge/edge-groups/types';
+import { DeploymentType, StaggerConfig } from '@/react/edge/edge-stacks/types';
+
+import { EnvVar } from '@@/form-components/EnvironmentVariablesFieldset/types';
+
+export interface FormValues {
+  edgeGroups: EdgeGroup['Id'][];
+  deploymentType: DeploymentType;
+  privateRegistryId?: number;
+  content: string;
+  useManifestNamespaces: boolean;
+  prePullImage: boolean;
+  retryDeploy: boolean;
+  webhookEnabled: boolean;
+  envVars: EnvVar[];
+  rollbackTo?: number;
+  staggerConfig: StaggerConfig;
+}
diff --git a/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/useAllowKubeToSelectCompose.ts b/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/useAllowKubeToSelectCompose.ts
new file mode 100644
index 0000000..46bb896
--- /dev/null
+++ b/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/useAllowKubeToSelectCompose.ts
@@ -0,0 +1,23 @@
+import _ from 'lodash';
+
+import { useEdgeGroups } from '@/react/edge/edge-groups/queries/useEdgeGroups';
+import { EnvironmentType } from '@/react/portainer/environments/types';
+
+import { DeploymentType, EdgeStack } from '../../types';
+
+export function useAllowKubeToSelectCompose(edgeStack: EdgeStack) {
+  const edgeGroupsQuery = useEdgeGroups();
+
+  const initiallyContainsKubeEnv = _.compact(
+    edgeStack.EdgeGroups.map((id) =>
+      edgeGroupsQuery.data?.find((e) => e.Id === id)
+    )
+  )
+    .flatMap((group) => group.EndpointTypes)
+    .includes(EnvironmentType.EdgeAgentOnKubernetes);
+
+  return (
+    initiallyContainsKubeEnv &&
+    edgeStack.DeploymentType === DeploymentType.Compose
+  );
+}
diff --git a/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/useEdgeGroupHasType.ts b/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/useEdgeGroupHasType.ts
new file mode 100644
index 0000000..d0223b7
--- /dev/null
+++ b/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/useEdgeGroupHasType.ts
@@ -0,0 +1,44 @@
+import _ from 'lodash';
+import { useCallback } from 'react';
+
+import { useEdgeGroups } from '@/react/edge/edge-groups/queries/useEdgeGroups';
+import { EdgeGroup } from '@/react/edge/edge-groups/types';
+import { EnvironmentType } from '@/react/portainer/environments/types';
+
+export function useEdgeGroupHasType(groupIds: Array<EdgeGroup['Id']>) {
+  const edgeGroupsQuery = useEdgeGroups();
+
+  const edgeGroups = edgeGroupsQuery.data;
+
+  const hasTypeFunction = createHasEnvironmentTypeFunction(
+    groupIds,
+    edgeGroups
+  );
+  const hasType = useCallback(
+    (type: EnvironmentType) => hasTypeFunction(type),
+    [hasTypeFunction]
+  );
+
+  return {
+    hasType,
+  };
+}
+
+/**
+ * Returns true if any of the edge groups have the given type
+ */
+export function createHasEnvironmentTypeFunction(
+  groupIds: EdgeGroup['Id'][],
+  edgeGroups?: EdgeGroup[]
+) {
+  const modelEdgeGroups = _.compact(
+    groupIds.map((id) => edgeGroups?.find((e) => e.Id === id))
+  );
+  const endpointTypes = modelEdgeGroups.flatMap((group) => group.EndpointTypes);
+
+  function hasType(type: EnvironmentType) {
+    return endpointTypes.includes(type);
+  }
+
+  return hasType;
+}
diff --git a/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/useStaggerUpdateStatus.ts b/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/useStaggerUpdateStatus.ts
new file mode 100644
index 0000000..ae209d3
--- /dev/null
+++ b/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/useStaggerUpdateStatus.ts
@@ -0,0 +1,35 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { isBE } from '@/react/portainer/feature-flags/feature-flags.service';
+
+import { EdgeStack } from '../../types';
+import { queryKeys } from '../../queries/query-keys';
+import { buildUrl } from '../../queries/buildUrl';
+
+export function staggerStatusQueryKey(edgeStackId: EdgeStack['Id']) {
+  return [...queryKeys.item(edgeStackId), 'stagger', 'status'] as const;
+}
+
+export function useStaggerUpdateStatus(edgeStackId: EdgeStack['Id']) {
+  return useQuery(
+    [...queryKeys.item(edgeStackId), 'stagger-status'],
+    () => getStaggerStatus(edgeStackId),
+    { enabled: isBE }
+  );
+}
+
+interface StaggerStatusResponse {
+  status: 'idle' | 'updating';
+}
+
+async function getStaggerStatus(edgeStackId: EdgeStack['Id']) {
+  try {
+    const { data } = await axios.get<StaggerStatusResponse>(
+      buildUrl(edgeStackId, 'stagger/status')
+    );
+    return data.status;
+  } catch (error) {
+    throw parseAxiosError(error as Error, 'Unable to retrieve stagger status');
+  }
+}
diff --git a/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/useUpdateEdgeStackMutation.ts b/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/useUpdateEdgeStackMutation.ts
new file mode 100644
index 0000000..59d311d
--- /dev/null
+++ b/app/react/edge/edge-stacks/ItemView/EditEdgeStackForm/useUpdateEdgeStackMutation.ts
@@ -0,0 +1,56 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import {
+  mutationOptions,
+  withError,
+  withInvalidate,
+} from '@/react-tools/react-query';
+import { buildUrl } from '@/react/edge/edge-stacks/queries/buildUrl';
+import {
+  DeploymentType,
+  EdgeStack,
+  StaggerConfig,
+} from '@/react/edge/edge-stacks/types';
+import { EdgeGroup } from '@/react/edge/edge-groups/types';
+import { Registry } from '@/react/portainer/registries/types/registry';
+import { Pair } from '@/react/portainer/settings/types';
+
+import { queryKeys } from '../../queries/query-keys';
+
+export interface UpdateEdgeStackPayload {
+  id: EdgeStack['Id'];
+  stackFileContent: string;
+  edgeGroups: Array<EdgeGroup['Id']>;
+  deploymentType: DeploymentType;
+  registries: Array<Registry['Id']>;
+  useManifestNamespaces: boolean;
+  prePullImage?: boolean;
+  rePullImage?: boolean;
+  retryDeploy?: boolean;
+  updateVersion: boolean;
+  webhook?: string;
+  envVars: Pair[];
+  rollbackTo?: number;
+  staggerConfig?: StaggerConfig;
+}
+
+export function useUpdateEdgeStackMutation() {
+  const queryClient = useQueryClient();
+
+  return useMutation(
+    updateEdgeStack,
+    mutationOptions(
+      withError('Failed updating stack'),
+      withInvalidate(queryClient, [queryKeys.base()])
+    )
+  );
+}
+
+async function updateEdgeStack({ id, ...payload }: UpdateEdgeStackPayload) {
+  try {
+    await axios.put(buildUrl(id), payload);
+  } catch (err) {
+    throw parseAxiosError(err as Error, 'Failed updating stack');
+  }
+}
diff --git a/app/react/edge/edge-stacks/ItemView/EnvironmentsDatatable/ActionStatus.tsx b/app/react/edge/edge-stacks/ItemView/EnvironmentsDatatable/ActionStatus.tsx
new file mode 100644
index 0000000..6232a17
--- /dev/null
+++ b/app/react/edge/edge-stacks/ItemView/EnvironmentsDatatable/ActionStatus.tsx
@@ -0,0 +1,30 @@
+import { useCurrentStateAndParams } from '@uirouter/react';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { useLogsStatus } from './useLogsStatus';
+
+interface Props {
+  environmentId: EnvironmentId;
+}
+
+export function ActionStatus({ environmentId }: Props) {
+  const {
+    params: { stackId: edgeStackId },
+  } = useCurrentStateAndParams();
+
+  const logsStatusQuery = useLogsStatus(edgeStackId, environmentId);
+
+  return <>{getStatusText(logsStatusQuery.data)}</>;
+}
+
+function getStatusText(status?: 'pending' | 'collected' | 'idle') {
+  switch (status) {
+    case 'collected':
+      return 'Logs available for download';
+    case 'pending':
+      return 'Logs marked for collection, please wait until the logs are available';
+    default:
+      return null;
+  }
+}
diff --git a/app/react/edge/edge-stacks/ItemView/EnvironmentsDatatable/EnvironmentActions.tsx b/app/react/edge/edge-stacks/ItemView/EnvironmentsDatatable/EnvironmentActions.tsx
new file mode 100644
index 0000000..15db068
--- /dev/null
+++ b/app/react/edge/edge-stacks/ItemView/EnvironmentsDatatable/EnvironmentActions.tsx
@@ -0,0 +1,44 @@
+import { Search } from 'lucide-react';
+import { useCurrentStateAndParams } from '@uirouter/react';
+
+import { Environment } from '@/react/portainer/environments/types';
+
+import { Button } from '@@/buttons';
+import { Link } from '@@/Link';
+import { Icon } from '@@/Icon';
+
+import { LogsActions } from './LogsActions';
+
+interface Props {
+  environment: Environment;
+}
+
+export function EnvironmentActions({ environment }: Props) {
+  const {
+    params: { stackId: edgeStackId },
+  } = useCurrentStateAndParams();
+
+  return (
+    <div>
+      {environment.Snapshots.length > 0 && environment.Edge.AsyncMode && (
+        <Link
+          to="edge.browse.containers"
+          params={{ environmentId: environment.Id, edgeStackId }}
+          className="hover:!no-underline"
+          data-cy="browse-snapshot-link"
+        >
+          <Button
+            color="none"
+            title="Browse Snapshot"
+            data-cy="browse-snapshot-button"
+          >
+            <Icon icon={Search} className="searchIcon" />
+          </Button>
+        </Link>
+      )}
+      {environment.Edge.AsyncMode && (
+        <LogsActions environmentId={environment.Id} edgeStackId={edgeStackId} />
+      )}
+    </div>
+  );
+}
diff --git a/app/react/edge/edge-stacks/ItemView/EnvironmentsDatatable/EnvironmentsDatatable.tsx b/app/react/edge/edge-stacks/ItemView/EnvironmentsDatatable/EnvironmentsDatatable.tsx
new file mode 100644
index 0000000..3f571ad
--- /dev/null
+++ b/app/react/edge/edge-stacks/ItemView/EnvironmentsDatatable/EnvironmentsDatatable.tsx
@@ -0,0 +1,159 @@
+import { HardDrive } from 'lucide-react';
+import { useMemo, useState } from 'react';
+
+import { EdgeStackStatus, StatusType } from '@/react/edge/edge-stacks/types';
+import { useEnvironmentList } from '@/react/portainer/environments/queries';
+import { useParamState } from '@/react/hooks/useParamState';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { isBE } from '@/react/portainer/feature-flags/feature-flags.service';
+import { useIdParam } from '@/react/hooks/useIdParam';
+
+import { Datatable } from '@@/datatables';
+import { PortainerSelect } from '@@/form-components/PortainerSelect';
+import { createPersistedStore } from '@@/datatables/types';
+import { useTableState } from '@@/datatables/useTableState';
+
+import { useEdgeStack } from '../../queries/useEdgeStack';
+
+import { EdgeStackEnvironment } from './types';
+import { columns } from './columns';
+
+const tableKey = 'edge-stacks-environment';
+
+const settingsStore = createPersistedStore(tableKey);
+
+export function EnvironmentsDatatable() {
+  const stackId = useIdParam('stackId');
+
+  const edgeStackQuery = useEdgeStack(stackId, {
+    refetchInterval(data) {
+      if (!data) {
+        return 0;
+      }
+
+      return Object.values(data.Status).some((status) =>
+        status.Status.every((s) => s.Type === StatusType.Running)
+      )
+        ? 0
+        : 10000;
+    },
+  });
+
+  const [page, setPage] = useState(0);
+  const [statusFilter, setStatusFilter] = useParamState<StatusType>(
+    'status',
+    (value) => (value ? parseInt(value, 10) : undefined)
+  );
+  const tableState = useTableState(settingsStore, tableKey);
+  const environmentsQuery = useEnvironmentList({
+    pageLimit: tableState.pageSize,
+    page: page + 1,
+    search: tableState.search,
+    sort: tableState.sortBy?.id as 'Group' | 'Name',
+    order: tableState.sortBy?.desc ? 'desc' : 'asc',
+    edgeStackId: stackId,
+    edgeStackStatus: statusFilter,
+  });
+
+  const currentFileVersion =
+    edgeStackQuery.data?.StackFileVersion?.toString() || '';
+  const gitConfigURL = edgeStackQuery.data?.GitConfig?.URL || '';
+  const gitConfigCommitHash = edgeStackQuery.data?.GitConfig?.ConfigHash || '';
+  const environments: Array<EdgeStackEnvironment> = useMemo(
+    () =>
+      environmentsQuery.environments.map(
+        (env) =>
+          ({
+            ...env,
+            TargetFileVersion: currentFileVersion,
+            GitConfigURL: gitConfigURL,
+            TargetCommitHash: gitConfigCommitHash,
+            StackStatus: getEnvStackStatus(
+              env.Id,
+              edgeStackQuery.data?.Status[env.Id]
+            ),
+          }) satisfies EdgeStackEnvironment
+      ),
+    [
+      currentFileVersion,
+      edgeStackQuery.data?.Status,
+      environmentsQuery.environments,
+      gitConfigCommitHash,
+      gitConfigURL,
+    ]
+  );
+
+  const envStatusSelectOptions = [
+    { value: StatusType.Pending, label: 'Pending' },
+    { value: StatusType.Acknowledged, label: 'Acknowledged' },
+    { value: StatusType.ImagesPulled, label: 'Images pre-pulled' },
+    { value: StatusType.Running, label: 'Deployed' },
+    { value: StatusType.Error, label: 'Failed' },
+  ];
+  if (isBE) {
+    envStatusSelectOptions.concat([
+      { value: StatusType.PausedDeploying, label: 'Paused' },
+      { value: StatusType.RollingBack, label: 'Rolling back' },
+      { value: StatusType.RolledBack, label: 'Rolled back' },
+    ]);
+  }
+
+  return (
+    <Datatable
+      columns={columns}
+      isLoading={environmentsQuery.isLoading}
+      dataset={environments}
+      settingsManager={tableState}
+      title="Environments Status"
+      titleIcon={HardDrive}
+      isServerSidePagination
+      page={page}
+      onPageChange={setPage}
+      totalCount={environmentsQuery.totalCount}
+      disableSelect
+      description={
+        <div className="w-1/4">
+          <PortainerSelect<StatusType | undefined>
+            isClearable
+            bindToBody
+            value={statusFilter}
+            onChange={(e) => setStatusFilter(e ?? undefined)}
+            options={envStatusSelectOptions}
+            data-cy="edge-stacks-environments-status-filter"
+          />
+        </div>
+      }
+      data-cy="edge-stacks-environments-datatable"
+    />
+  );
+}
+
+function getEnvStackStatus(
+  envId: EnvironmentId,
+  envStatus: EdgeStackStatus | undefined
+) {
+  const pendingStatus = {
+    Type: StatusType.Pending,
+    Error: '',
+    Time: new Date().valueOf() / 1000,
+  };
+
+  let status = envStatus;
+  if (!status) {
+    status = {
+      EndpointID: envId,
+      DeploymentInfo: {
+        Version: 0,
+        ConfigHash: '',
+        FileVersion: 0,
+      },
+      Status: [],
+    };
+  }
+
+  if (status.Status.length === 0) {
+    status.Status.push(pendingStatus);
+  }
+
+  return status;
+}
diff --git a/app/react/edge/edge-stacks/ItemView/EnvironmentsDatatable/LogsActions.tsx b/app/react/edge/edge-stacks/ItemView/EnvironmentsDatatable/LogsActions.tsx
new file mode 100644
index 0000000..35bc7d1
--- /dev/null
+++ b/app/react/edge/edge-stacks/ItemView/EnvironmentsDatatable/LogsActions.tsx
@@ -0,0 +1,122 @@
+import clsx from 'clsx';
+
+import { notifySuccess } from '@/portainer/services/notifications';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { Button } from '@@/buttons';
+import { Icon } from '@@/Icon';
+
+import { EdgeStack } from '../../types';
+
+import { useCollectLogsMutation } from './useCollectLogsMutation';
+import { useDeleteLogsMutation } from './useDeleteLogsMutation';
+import { useDownloadLogsMutation } from './useDownloadLogsMutation';
+import { useLogsStatus } from './useLogsStatus';
+
+interface Props {
+  environmentId: EnvironmentId;
+  edgeStackId: EdgeStack['Id'];
+}
+
+export function LogsActions({ environmentId, edgeStackId }: Props) {
+  const logsStatusQuery = useLogsStatus(edgeStackId, environmentId);
+  const collectLogsMutation = useCollectLogsMutation();
+  const downloadLogsMutation = useDownloadLogsMutation();
+  const deleteLogsMutation = useDeleteLogsMutation();
+
+  if (!logsStatusQuery.isSuccess) {
+    return null;
+  }
+
+  const status = logsStatusQuery.data;
+
+  const collecting = collectLogsMutation.isLoading || status === 'pending';
+
+  return (
+    <>
+      <Button
+        className="p-0"
+        color="link"
+        title="Retrieve logs"
+        onClick={handleCollectLogs}
+        data-cy="edge-stack-logs-collect-button"
+      >
+        <Icon
+          icon={clsx({
+            'file-text': !collecting,
+            loader: collecting,
+          })}
+        />
+      </Button>
+      <Button
+        className="p-0"
+        color="link"
+        title="Download logs"
+        disabled={status !== 'collected'}
+        onClick={handleDownloadLogs}
+        data-cy="edge-stack-logs-download-button"
+      >
+        <Icon
+          icon={clsx({
+            'download-cloud': !downloadLogsMutation.isLoading,
+            loader: downloadLogsMutation.isLoading,
+          })}
+        />
+      </Button>
+      <Button
+        className="p-0"
+        color="link"
+        title="Delete logs"
+        disabled={status !== 'collected'}
+        onClick={handleDeleteLogs}
+        data-cy="edge-stack-logs-delete-button"
+      >
+        <Icon
+          icon={clsx({
+            delete: !deleteLogsMutation.isLoading,
+            loader: deleteLogsMutation.isLoading,
+          })}
+        />
+      </Button>
+    </>
+  );
+
+  function handleCollectLogs() {
+    if (status === 'pending') {
+      return;
+    }
+
+    collectLogsMutation.mutate(
+      {
+        edgeStackId,
+        environmentId,
+      },
+      {
+        onSuccess() {
+          notifySuccess('Success', 'Logs Collection started');
+        },
+      }
+    );
+  }
+
+  function handleDownloadLogs() {
+    downloadLogsMutation.mutate({
+      edgeStackId,
+      environmentId,
+    });
+  }
+
+  function handleDeleteLogs() {
+    deleteLogsMutation.mutate(
+      {
+        edgeStackId,
+        environmentId,
+      },
+      {
+        onSuccess() {
+          notifySuccess('Success', 'Logs Deleted');
+        },
+      }
+    );
+  }
+}
diff --git a/app/react/edge/edge-stacks/ItemView/EnvironmentsDatatable/columns.tsx b/app/react/edge/edge-stacks/ItemView/EnvironmentsDatatable/columns.tsx
new file mode 100644
index 0000000..b0ee14e
--- /dev/null
+++ b/app/react/edge/edge-stacks/ItemView/EnvironmentsDatatable/columns.tsx
@@ -0,0 +1,305 @@
+import { CellContext, createColumnHelper } from '@tanstack/react-table';
+import { ChevronDown, ChevronRight } from 'lucide-react';
+import clsx from 'clsx';
+import { useState } from 'react';
+import _ from 'lodash';
+
+import UpdatesAvailable from '@/assets/ico/icon_updates-available.svg?c';
+import UpToDate from '@/assets/ico/icon_up-to-date.svg?c';
+import { isoDateFromTimestamp } from '@/portainer/filters/filters';
+import { isBE } from '@/react/portainer/feature-flags/feature-flags.service';
+import { getDashboardRoute } from '@/react/portainer/environments/utils';
+import { GitCommitLink } from '@/react/portainer/gitops/GitCommitLink';
+
+import { Button } from '@@/buttons';
+import { Icon } from '@@/Icon';
+import { Link } from '@@/Link';
+
+import { DeploymentStatus, EdgeStackStatus, StatusType } from '../../types';
+
+import { EnvironmentActions } from './EnvironmentActions';
+import { ActionStatus } from './ActionStatus';
+import { EdgeStackEnvironment } from './types';
+
+const columnHelper = createColumnHelper<EdgeStackEnvironment>();
+
+export const columns = _.compact([
+  columnHelper.accessor('Name', {
+    id: 'name',
+    header: 'Name',
+    cell({ row: { original: env } }) {
+      const { to, params } = getDashboardRoute(env);
+      return (
+        <Link
+          to={to}
+          params={params}
+          data-cy={`edge-stack-environment-link-${env.Name}`}
+        >
+          {env.Name}
+        </Link>
+      );
+    },
+  }),
+  columnHelper.accessor((env) => endpointStatusLabel(env.StackStatus.Status), {
+    id: 'status',
+    header: 'Status',
+    cell({ row: { original: env } }) {
+      return (
+        <ul className="list-none space-y-2">
+          {env.StackStatus.Status.map((s) => (
+            <li key={`status-${s.Type}-${s.Time}`}>
+              <Status value={s.Type} />
+            </li>
+          ))}
+        </ul>
+      );
+    },
+  }),
+  columnHelper.accessor((env) => _.last(env.StackStatus.Status)?.Time, {
+    id: 'statusDate',
+    header: 'Time',
+    cell({ row: { original: env } }) {
+      return (
+        <ul className="list-none space-y-2">
+          {env.StackStatus.Status.map((s) => (
+            <li key={`time-${s.Type}-${s.Time}`}>
+              {isoDateFromTimestamp(s.Time)}
+            </li>
+          ))}
+        </ul>
+      );
+    },
+  }),
+  ...(isBE
+    ? [
+        columnHelper.accessor((env) => endpointTargetVersionLabel(env), {
+          id: 'targetVersion',
+          header: 'Target version',
+          cell: TargetVersionCell,
+        }),
+        columnHelper.accessor(
+          (env) => endpointDeployedVersionLabel(env.StackStatus),
+          {
+            id: 'deployedVersion',
+            header: 'Deployed version',
+            cell: DeployedVersionCell,
+          }
+        ),
+      ]
+    : []),
+  columnHelper.accessor(
+    (env) =>
+      env.StackStatus.Status.find((s) => s.Type === StatusType.Error)?.Error,
+    {
+      id: 'error',
+      header: 'Error',
+      cell: ErrorCell,
+    }
+  ),
+  ...(isBE
+    ? [
+        columnHelper.display({
+          id: 'actions',
+          header: 'Actions',
+          cell({ row: { original: env } }) {
+            return <EnvironmentActions environment={env} />;
+          },
+        }),
+        columnHelper.display({
+          id: 'actionStatus',
+          header: 'Action Status',
+          cell({ row: { original: env } }) {
+            return <ActionStatus environmentId={env.Id} />;
+          },
+        }),
+      ]
+    : []),
+]);
+
+function ErrorCell({
+  getValue,
+  row,
+}: CellContext<EdgeStackEnvironment, string>) {
+  const [isExpanded, setIsExpanded] = useState(false);
+
+  const value = getValue();
+  if (!value) {
+    return '-';
+  }
+
+  return (
+    <Button
+      color="none"
+      className="flex cursor-pointer"
+      onClick={() => setIsExpanded(!isExpanded)}
+      data-cy={`edge-stack-environment-error-${row.index}`}
+    >
+      <div className="pr-1 pt-0.5">
+        <Icon icon={isExpanded ? ChevronDown : ChevronRight} />
+      </div>
+      <div
+        className={clsx('overflow-hidden whitespace-normal break-keep', {
+          'line-clamp-1': !isExpanded,
+          'min-w-[150px]': isExpanded,
+        })}
+      >
+        {value}
+      </div>
+    </Button>
+  );
+}
+
+function endpointStatusLabel(statusArray: Array<DeploymentStatus>) {
+  const labels = [];
+
+  statusArray.forEach((status) => {
+    if (status.Type === StatusType.Acknowledged) {
+      labels.push('Acknowledged');
+    }
+    if (status.Type === StatusType.ImagesPulled) {
+      labels.push('Images pre-pulled');
+    }
+    if (status.Type === StatusType.Running) {
+      labels.push('Deployed');
+    }
+    if (status.Type === StatusType.Error) {
+      labels.push('Failed');
+    }
+    if (status.Type === StatusType.PausedDeploying) {
+      labels.push('Paused');
+    }
+    if (status.Type === StatusType.RollingBack) {
+      labels.push('Rolling Back');
+    }
+    if (status.Type === StatusType.RolledBack) {
+      labels.push('Rolled Back');
+    }
+  });
+
+  if (!labels.length) {
+    labels.push('Pending');
+  }
+
+  return _.uniq(labels).join(', ');
+}
+
+function TargetVersionCell({
+  row,
+  getValue,
+}: CellContext<EdgeStackEnvironment, string>) {
+  const value = getValue();
+  if (!value) {
+    return '';
+  }
+
+  return (
+    <>
+      {row.original.TargetCommitHash ? (
+        <div>
+          <GitCommitLink
+            baseURL={row.original.GitConfigURL}
+            commitHash={row.original.TargetCommitHash}
+          />
+        </div>
+      ) : (
+        <div>{value}</div>
+      )}
+    </>
+  );
+}
+
+function endpointTargetVersionLabel(env: EdgeStackEnvironment) {
+  if (env.TargetCommitHash) {
+    return env.TargetCommitHash.slice(0, 7).toString();
+  }
+  return env.TargetFileVersion.toString() || '';
+}
+
+function DeployedVersionCell({
+  row,
+  getValue,
+}: CellContext<EdgeStackEnvironment, string>) {
+  const value = getValue();
+  if (!value || value === '0') {
+    return (
+      <div>
+        <Icon icon={UpdatesAvailable} className="!mr-2" />
+      </div>
+    );
+  }
+
+  let statusIcon = <Icon icon={UpToDate} className="!mr-2" />;
+  if (
+    (row.original.TargetCommitHash &&
+      row.original.TargetCommitHash.slice(0, 7) !== value) ||
+    (!row.original.TargetCommitHash && row.original.TargetFileVersion !== value)
+  ) {
+    statusIcon = <Icon icon={UpdatesAvailable} className="!mr-2" />;
+  }
+
+  return (
+    <>
+      {row.original.TargetCommitHash ? (
+        <div>
+          {statusIcon}
+          <GitCommitLink
+            baseURL={row.original.GitConfigURL}
+            commitHash={row.original.TargetCommitHash}
+          />
+        </div>
+      ) : (
+        <div>
+          {statusIcon}
+          {value}
+        </div>
+      )}
+    </>
+  );
+}
+
+function endpointDeployedVersionLabel(status: EdgeStackStatus) {
+  if (status.DeploymentInfo?.ConfigHash) {
+    return status.DeploymentInfo?.ConfigHash.slice(0, 7).toString();
+  }
+  return status.DeploymentInfo?.FileVersion.toString() || '';
+}
+
+function Status({ value }: { value: StatusType }) {
+  const color = getStateColor(value);
+
+  return (
+    <div className="flex items-center gap-2">
+      <span
+        className={clsx('h-2 w-2 rounded-full', {
+          'bg-orange-5': color === 'orange',
+          'bg-green-5': color === 'green',
+          'bg-error-5': color === 'red',
+        })}
+      />
+
+      <span>{_.startCase(StatusType[value])}</span>
+    </div>
+  );
+}
+
+function getStateColor(type: StatusType): 'orange' | 'green' | 'red' {
+  switch (type) {
+    case StatusType.Acknowledged:
+    case StatusType.ImagesPulled:
+    case StatusType.DeploymentReceived:
+    case StatusType.Running:
+    case StatusType.RemoteUpdateSuccess:
+    case StatusType.Removed:
+      return 'green';
+    case StatusType.Error:
+      return 'red';
+    case StatusType.Pending:
+    case StatusType.Deploying:
+    case StatusType.Removing:
+    case StatusType.PausedDeploying:
+    case StatusType.RollingBack:
+    case StatusType.RolledBack:
+    default:
+      return 'orange';
+  }
+}
diff --git a/app/react/edge/edge-stacks/ItemView/EnvironmentsDatatable/index.ts b/app/react/edge/edge-stacks/ItemView/EnvironmentsDatatable/index.ts
new file mode 100644
index 0000000..3f139b7
--- /dev/null
+++ b/app/react/edge/edge-stacks/ItemView/EnvironmentsDatatable/index.ts
@@ -0,0 +1 @@
+export { EnvironmentsDatatable } from './EnvironmentsDatatable';
diff --git a/app/react/edge/edge-stacks/ItemView/EnvironmentsDatatable/types.ts b/app/react/edge/edge-stacks/ItemView/EnvironmentsDatatable/types.ts
new file mode 100644
index 0000000..b56a2b1
--- /dev/null
+++ b/app/react/edge/edge-stacks/ItemView/EnvironmentsDatatable/types.ts
@@ -0,0 +1,10 @@
+import { Environment } from '@/react/portainer/environments/types';
+
+import { EdgeStackStatus } from '../../types';
+
+export type EdgeStackEnvironment = Environment & {
+  StackStatus: EdgeStackStatus;
+  TargetFileVersion: string;
+  GitConfigURL: string;
+  TargetCommitHash: string;
+};
diff --git a/app/react/edge/edge-stacks/ItemView/EnvironmentsDatatable/useCollectLogsMutation.ts b/app/react/edge/edge-stacks/ItemView/EnvironmentsDatatable/useCollectLogsMutation.ts
new file mode 100644
index 0000000..5404c72
--- /dev/null
+++ b/app/react/edge/edge-stacks/ItemView/EnvironmentsDatatable/useCollectLogsMutation.ts
@@ -0,0 +1,35 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+
+import { EdgeStack } from '../../types';
+
+import { logsStatusQueryKey } from './useLogsStatus';
+
+export function useCollectLogsMutation() {
+  const queryClient = useQueryClient();
+
+  return useMutation(collectLogs, {
+    onSuccess(data, variables) {
+      return queryClient.invalidateQueries(
+        logsStatusQueryKey(variables.edgeStackId, variables.environmentId)
+      );
+    },
+    ...withError('Unable to retrieve logs'),
+  });
+}
+
+interface CollectLogs {
+  edgeStackId: EdgeStack['Id'];
+  environmentId: EnvironmentId;
+}
+
+async function collectLogs({ edgeStackId, environmentId }: CollectLogs) {
+  try {
+    await axios.put(`/edge_stacks/${edgeStackId}/logs/${environmentId}`);
+  } catch (error) {
+    throw parseAxiosError(error as Error, 'Unable to start logs collection');
+  }
+}
diff --git a/app/react/edge/edge-stacks/ItemView/EnvironmentsDatatable/useDeleteLogsMutation.ts b/app/react/edge/edge-stacks/ItemView/EnvironmentsDatatable/useDeleteLogsMutation.ts
new file mode 100644
index 0000000..80e2d6c
--- /dev/null
+++ b/app/react/edge/edge-stacks/ItemView/EnvironmentsDatatable/useDeleteLogsMutation.ts
@@ -0,0 +1,40 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+
+import { EdgeStack } from '../../types';
+
+import { logsStatusQueryKey } from './useLogsStatus';
+
+export function useDeleteLogsMutation() {
+  const queryClient = useQueryClient();
+
+  return useMutation(deleteLogs, {
+    onSuccess(data, variables) {
+      return queryClient.invalidateQueries(
+        logsStatusQueryKey(variables.edgeStackId, variables.environmentId)
+      );
+    },
+    ...withError('Unable to delete logs'),
+  });
+}
+
+interface DeleteLogs {
+  edgeStackId: EdgeStack['Id'];
+  environmentId: EnvironmentId;
+}
+
+async function deleteLogs({ edgeStackId, environmentId }: DeleteLogs) {
+  try {
+    await axios.delete(`/edge_stacks/${edgeStackId}/logs/${environmentId}`, {
+      responseType: 'blob',
+      headers: {
+        Accept: 'text/yaml',
+      },
+    });
+  } catch (e) {
+    throw parseAxiosError(e as Error, '');
+  }
+}
diff --git a/app/react/edge/edge-stacks/ItemView/EnvironmentsDatatable/useDownloadLogsMutation.ts b/app/react/edge/edge-stacks/ItemView/EnvironmentsDatatable/useDownloadLogsMutation.ts
new file mode 100644
index 0000000..b7714c8
--- /dev/null
+++ b/app/react/edge/edge-stacks/ItemView/EnvironmentsDatatable/useDownloadLogsMutation.ts
@@ -0,0 +1,41 @@
+import { saveAs } from 'file-saver';
+import { useMutation } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { mutationOptions, withError } from '@/react-tools/react-query';
+
+import { EdgeStack } from '../../types';
+
+export function useDownloadLogsMutation() {
+  return useMutation(
+    downloadLogs,
+    mutationOptions(withError('Unable to download logs'))
+  );
+}
+
+interface DownloadLogs {
+  edgeStackId: EdgeStack['Id'];
+  environmentId: EnvironmentId;
+}
+
+async function downloadLogs({ edgeStackId, environmentId }: DownloadLogs) {
+  try {
+    const { headers, data } = await axios.get<Blob>(
+      `/edge_stacks/${edgeStackId}/logs/${environmentId}/file`,
+      {
+        responseType: 'blob',
+        headers: {
+          Accept: 'text/yaml',
+        },
+      }
+    );
+    const contentDispositionHeader = headers['content-disposition'];
+    const filename = contentDispositionHeader
+      .replace('attachment; filename=', '')
+      .trim();
+    saveAs(data, filename);
+  } catch (e) {
+    throw parseAxiosError(e as Error, '');
+  }
+}
diff --git a/app/react/edge/edge-stacks/ItemView/EnvironmentsDatatable/useLogsStatus.ts b/app/react/edge/edge-stacks/ItemView/EnvironmentsDatatable/useLogsStatus.ts
new file mode 100644
index 0000000..cae122d
--- /dev/null
+++ b/app/react/edge/edge-stacks/ItemView/EnvironmentsDatatable/useLogsStatus.ts
@@ -0,0 +1,51 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EdgeStack } from '@/react/edge/edge-stacks/types';
+
+import { queryKeys } from '../../queries/query-keys';
+
+export function logsStatusQueryKey(
+  edgeStackId: EdgeStack['Id'],
+  environmentId: EnvironmentId
+) {
+  return [...queryKeys.item(edgeStackId), 'logs', environmentId] as const;
+}
+
+export function useLogsStatus(
+  edgeStackId: EdgeStack['Id'],
+  environmentId: EnvironmentId
+) {
+  return useQuery(
+    logsStatusQueryKey(edgeStackId, environmentId),
+    () => getLogsStatus(edgeStackId, environmentId),
+    {
+      refetchInterval(status) {
+        if (status === 'pending') {
+          return 30 * 1000;
+        }
+
+        return false;
+      },
+    }
+  );
+}
+
+interface LogsStatusResponse {
+  status: 'collected' | 'idle' | 'pending';
+}
+
+async function getLogsStatus(
+  edgeStackId: EdgeStack['Id'],
+  environmentId: EnvironmentId
+) {
+  try {
+    const { data } = await axios.get<LogsStatusResponse>(
+      `/edge_stacks/${edgeStackId}/logs/${environmentId}`
+    );
+    return data.status;
+  } catch (error) {
+    throw parseAxiosError(error as Error, 'Unable to retrieve logs status');
+  }
+}
diff --git a/app/react/edge/edge-stacks/ItemView/ItemView.tsx b/app/react/edge/edge-stacks/ItemView/ItemView.tsx
new file mode 100644
index 0000000..d691b15
--- /dev/null
+++ b/app/react/edge/edge-stacks/ItemView/ItemView.tsx
@@ -0,0 +1,70 @@
+import { HardDriveIcon, LayersIcon } from 'lucide-react';
+
+import { EditEdgeStackForm } from '@/react/edge/edge-stacks/ItemView/EditEdgeStackForm/EditEdgeStackForm';
+import { useIdParam } from '@/react/hooks/useIdParam';
+
+import { PageHeader } from '@@/PageHeader';
+import { Widget } from '@@/Widget';
+import { Alert } from '@@/Alert';
+import { Tab, useCurrentTabIndex, WidgetTabs } from '@@/Widget/WidgetTabs';
+
+import { useEdgeStack } from '../queries/useEdgeStack';
+
+import { EnvironmentsDatatable } from './EnvironmentsDatatable';
+
+export function ItemView() {
+  const idParam = useIdParam('stackId');
+  const edgeStackQuery = useEdgeStack(idParam);
+
+  const stack = edgeStackQuery.data;
+
+  const tabs: Tab[] = [
+    {
+      name: 'Stack',
+      icon: LayersIcon,
+      widget: (
+        <div className="row">
+          <div className="col-sm-12">
+            <Widget>
+              <Widget.Body loading={edgeStackQuery.isLoading}>
+                {edgeStackQuery.isError && (
+                  <Alert color="error" title="Error loading edge stack" />
+                )}
+                {!!stack && <EditEdgeStackForm edgeStack={stack} />}
+              </Widget.Body>
+            </Widget>
+          </div>
+        </div>
+      ),
+      selectedTabParam: 'stack',
+    },
+    {
+      name: 'Environments',
+      icon: HardDriveIcon,
+      widget: <EnvironmentsDatatable />,
+      selectedTabParam: 'environments',
+    },
+  ];
+
+  const currentTabIndex = useCurrentTabIndex(tabs);
+
+  if (!edgeStackQuery.data) {
+    return null;
+  }
+
+  return (
+    <>
+      <PageHeader
+        title="Edit Edge stack"
+        breadcrumbs={[
+          { label: 'Edge Stacks', link: 'edge.stacks' },
+          stack?.Name ?? '',
+        ]}
+        reload
+      />
+
+      <WidgetTabs tabs={tabs} currentTabIndex={currentTabIndex} />
+      {tabs[currentTabIndex].widget}
+    </>
+  );
+}
diff --git a/app/react/edge/edge-stacks/ListView/EdgeStacksDatatable/DeploymentCounter.stories.tsx b/app/react/edge/edge-stacks/ListView/EdgeStacksDatatable/DeploymentCounter.stories.tsx
new file mode 100644
index 0000000..3f8b9d7
--- /dev/null
+++ b/app/react/edge/edge-stacks/ListView/EdgeStacksDatatable/DeploymentCounter.stories.tsx
@@ -0,0 +1,45 @@
+import { StoryObj, Meta } from '@storybook/react-webpack5';
+
+import { StatusType } from '../../types';
+
+import { DeploymentCounter } from './DeploymentCounter';
+
+const meta: Meta<typeof DeploymentCounter> = {
+  title: 'Components/Edge/DeploymentCounter',
+  component: DeploymentCounter,
+};
+export default meta;
+
+type Story = StoryObj<typeof DeploymentCounter>;
+
+export const Running: Story = {
+  args: {
+    count: 5,
+    total: 10,
+    type: StatusType.Running,
+  },
+};
+
+export const Error: Story = {
+  args: {
+    count: 3,
+    total: 10,
+    type: StatusType.Error,
+  },
+};
+
+export const Acknowledged: Story = {
+  args: {
+    count: 7,
+    total: 10,
+    type: StatusType.Acknowledged,
+  },
+};
+
+export const ImagesPulled: Story = {
+  args: {
+    count: 9,
+    total: 10,
+    type: StatusType.ImagesPulled,
+  },
+};
diff --git a/app/react/edge/edge-stacks/ListView/EdgeStacksDatatable/DeploymentCounter.tsx b/app/react/edge/edge-stacks/ListView/EdgeStacksDatatable/DeploymentCounter.tsx
new file mode 100644
index 0000000..cb72587
--- /dev/null
+++ b/app/react/edge/edge-stacks/ListView/EdgeStacksDatatable/DeploymentCounter.tsx
@@ -0,0 +1,84 @@
+import clsx from 'clsx';
+import { ReactNode } from 'react';
+
+import { Link } from '@@/Link';
+import { TooltipWithChildren } from '@@/Tip/TooltipWithChildren';
+
+import { EdgeStack, StatusType } from '../../types';
+
+export function DeploymentCounterLink({
+  count,
+  total,
+  type,
+  stackId,
+}: {
+  count: number;
+  total: number;
+  type: StatusType;
+  stackId: EdgeStack['Id'];
+}) {
+  return (
+    <div className="w-full text-center">
+      <Link
+        className="hover:no-underline"
+        to="edge.stacks.edit"
+        params={{ stackId, tab: 'environments', status: type }}
+        data-cy="deployment-counter-link"
+      >
+        <DeploymentCounter count={count} type={type} total={total} />
+      </Link>
+    </div>
+  );
+}
+
+export function DeploymentCounter({
+  count,
+  total,
+  type,
+}: {
+  count: number;
+  total: number;
+  type: StatusType;
+}) {
+  return (
+    <TooltipWithChildren message={getTooltip(count, total, type)}>
+      <div className="h-2 w-full overflow-hidden rounded-lg">
+        <progress
+          aria-label={`${getLabel(type)}`}
+          className={clsx('w-full bg-gray-4', {
+            'progress-filled:bg-success-7': type === StatusType.Running,
+            'progress-filled:bg-error-7': type === StatusType.Error,
+            'progress-filled:bg-blue-9': type === StatusType.Acknowledged,
+            'progress-filled:bg-yellow-7': type === StatusType.ImagesPulled,
+          })}
+          max={total}
+          value={total ? count : 0}
+        />
+      </div>
+    </TooltipWithChildren>
+  );
+}
+
+function getTooltip(count: number, total: number, type: StatusType) {
+  const label = getLabel(type);
+  return `${count} of ${total} ${label}`;
+}
+
+function getLabel(type: StatusType): ReactNode {
+  switch (type) {
+    case StatusType.Running:
+      return 'deployments running';
+    case StatusType.Completed:
+      return 'deployments completed';
+    case StatusType.DeploymentReceived:
+      return 'deployments received';
+    case StatusType.Error:
+      return 'deployments failed';
+    case StatusType.Acknowledged:
+      return 'deployments acknowledged';
+    case StatusType.ImagesPulled:
+      return 'images pre-pulled';
+    default:
+      return '';
+  }
+}
diff --git a/app/react/edge/edge-stacks/ListView/EdgeStacksDatatable/EdgeStacksDatatable.tsx b/app/react/edge/edge-stacks/ListView/EdgeStacksDatatable/EdgeStacksDatatable.tsx
new file mode 100644
index 0000000..be1f664
--- /dev/null
+++ b/app/react/edge/edge-stacks/ListView/EdgeStacksDatatable/EdgeStacksDatatable.tsx
@@ -0,0 +1,47 @@
+import { Layers } from 'lucide-react';
+
+import { Datatable } from '@@/datatables';
+import { useTableState } from '@@/datatables/useTableState';
+import { getColumnVisibilityState } from '@@/datatables/ColumnVisibilityMenu';
+
+import { useEdgeStacks } from '../../queries/useEdgeStacks';
+
+import { createStore } from './store';
+import { columns } from './columns';
+import { DecoratedEdgeStack } from './types';
+import { TableSettingsMenus } from './TableSettingsMenus';
+import { TableActions } from './TableActions';
+
+const tableKey = 'edge-stacks';
+
+const settingsStore = createStore(tableKey);
+
+export function EdgeStacksDatatable() {
+  const tableState = useTableState(settingsStore, tableKey);
+  const edgeStacksQuery = useEdgeStacks<Array<DecoratedEdgeStack>>({
+    params: { summarizeStatuses: true },
+    refetchInterval: tableState.autoRefreshRate * 1000,
+  });
+
+  return (
+    <Datatable
+      title="Edge Stacks"
+      titleIcon={Layers}
+      columns={columns}
+      dataset={edgeStacksQuery.data || []}
+      initialTableState={getColumnVisibilityState(tableState.hiddenColumns)}
+      settingsManager={tableState}
+      isLoading={edgeStacksQuery.isLoading}
+      renderTableSettings={(tableInstance) => (
+        <TableSettingsMenus
+          tableInstance={tableInstance}
+          tableState={tableState}
+        />
+      )}
+      renderTableActions={(selectedItems) => (
+        <TableActions selectedItems={selectedItems} />
+      )}
+      data-cy="edge-stacks-datatable"
+    />
+  );
+}
diff --git a/app/react/edge/edge-stacks/ListView/EdgeStacksDatatable/EdgeStacksStatus.tsx b/app/react/edge/edge-stacks/ListView/EdgeStacksDatatable/EdgeStacksStatus.tsx
new file mode 100644
index 0000000..8c64433
--- /dev/null
+++ b/app/react/edge/edge-stacks/ListView/EdgeStacksDatatable/EdgeStacksStatus.tsx
@@ -0,0 +1,98 @@
+import {
+  AlertTriangle,
+  CheckCircle,
+  type LucideIcon,
+  Loader2,
+  XCircle,
+  MinusCircle,
+  PauseCircle,
+} from 'lucide-react';
+
+import { Icon, IconMode } from '@@/Icon';
+import { Tooltip } from '@@/Tip/Tooltip';
+
+import { DecoratedEdgeStack, StatusSummary, SummarizedStatus } from './types';
+
+export function EdgeStackStatus({
+  edgeStack,
+}: {
+  edgeStack: DecoratedEdgeStack;
+}) {
+  const { StatusSummary } = edgeStack;
+
+  const { icon, label, mode, spin, tooltip } = getStatus(StatusSummary);
+
+  return (
+    <div className="mx-auto inline-flex items-center gap-2">
+      {icon && <Icon icon={icon} spin={spin} mode={mode} />}
+      {label}
+      {tooltip && <Tooltip message={tooltip} />}
+    </div>
+  );
+}
+
+function getStatus(summary?: StatusSummary): {
+  label: string;
+  icon?: LucideIcon;
+  spin?: boolean;
+  mode?: IconMode;
+  tooltip?: string;
+} {
+  if (!summary) {
+    return {
+      label: 'Unavailable',
+      icon: MinusCircle,
+      mode: 'secondary',
+      tooltip: 'Status summary is unavailable',
+    };
+  }
+  const { Status, Reason } = summary;
+
+  switch (Status) {
+    case SummarizedStatus.Deploying:
+      return {
+        label: 'Deploying',
+        icon: Loader2,
+        spin: true,
+        mode: 'primary',
+      };
+    case SummarizedStatus.Failed:
+      return {
+        label: 'Failed',
+        icon: XCircle,
+        mode: 'danger',
+      };
+    case SummarizedStatus.Paused:
+      return {
+        label: 'Paused',
+        icon: PauseCircle,
+        mode: 'warning',
+      };
+    case SummarizedStatus.PartiallyRunning:
+      return {
+        label: 'Partially Running',
+        icon: AlertTriangle,
+        mode: 'warning',
+      };
+    case SummarizedStatus.Completed:
+      return {
+        label: 'Completed',
+        icon: CheckCircle,
+        mode: 'success',
+      };
+    case SummarizedStatus.Running:
+      return {
+        label: 'Running',
+        icon: CheckCircle,
+        mode: 'success',
+      };
+    case SummarizedStatus.Unavailable:
+    default:
+      return {
+        label: 'Unavailable',
+        icon: MinusCircle,
+        mode: 'secondary',
+        tooltip: Reason,
+      };
+  }
+}
diff --git a/app/react/edge/edge-stacks/ListView/EdgeStacksDatatable/TableActions.tsx b/app/react/edge/edge-stacks/ListView/EdgeStacksDatatable/TableActions.tsx
new file mode 100644
index 0000000..ea7ebf8
--- /dev/null
+++ b/app/react/edge/edge-stacks/ListView/EdgeStacksDatatable/TableActions.tsx
@@ -0,0 +1,37 @@
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { AddButton } from '@@/buttons';
+import { DeleteButton } from '@@/buttons/DeleteButton';
+
+import { useDeleteEdgeStacksMutation } from './useDeleteEdgeStacksMutation';
+import { DecoratedEdgeStack } from './types';
+
+export function TableActions({
+  selectedItems,
+}: {
+  selectedItems: Array<DecoratedEdgeStack>;
+}) {
+  const removeMutation = useDeleteEdgeStacksMutation();
+
+  return (
+    <div className="flex items-center gap-2">
+      <DeleteButton
+        disabled={selectedItems.length === 0}
+        onConfirmed={() => handleRemove(selectedItems)}
+        confirmMessage="Are you sure you want to remove the selected Edge stack(s)?"
+        data-cy="edgeStack-removeStackButton"
+      />
+
+      <AddButton data-cy="edgeStack-addStackButton">Add stack</AddButton>
+    </div>
+  );
+
+  async function handleRemove(selectedItems: Array<DecoratedEdgeStack>) {
+    const ids = selectedItems.map((item) => item.Id);
+    removeMutation.mutate(ids, {
+      onSuccess: () => {
+        notifySuccess('Success', 'Edge stack(s) removed');
+      },
+    });
+  }
+}
diff --git a/app/react/edge/edge-stacks/ListView/EdgeStacksDatatable/TableSettingsMenus.tsx b/app/react/edge/edge-stacks/ListView/EdgeStacksDatatable/TableSettingsMenus.tsx
new file mode 100644
index 0000000..d6142c3
--- /dev/null
+++ b/app/react/edge/edge-stacks/ListView/EdgeStacksDatatable/TableSettingsMenus.tsx
@@ -0,0 +1,34 @@
+import { Table } from '@tanstack/react-table';
+
+import { ColumnVisibilityMenu } from '@@/datatables/ColumnVisibilityMenu';
+import { TableSettingsMenu } from '@@/datatables';
+import { TableSettingsMenuAutoRefresh } from '@@/datatables/TableSettingsMenuAutoRefresh';
+
+import { DecoratedEdgeStack } from './types';
+import { TableSettings } from './store';
+
+export function TableSettingsMenus({
+  tableInstance,
+  tableState,
+}: {
+  tableInstance: Table<DecoratedEdgeStack>;
+  tableState: TableSettings;
+}) {
+  return (
+    <>
+      <ColumnVisibilityMenu<DecoratedEdgeStack>
+        table={tableInstance}
+        onChange={(hiddenColumns) => {
+          tableState.setHiddenColumns(hiddenColumns);
+        }}
+        value={tableState.hiddenColumns}
+      />
+      <TableSettingsMenu>
+        <TableSettingsMenuAutoRefresh
+          value={tableState.autoRefreshRate}
+          onChange={(value) => tableState.setAutoRefreshRate(value)}
+        />
+      </TableSettingsMenu>
+    </>
+  );
+}
diff --git a/app/react/edge/edge-stacks/ListView/EdgeStacksDatatable/columns.tsx b/app/react/edge/edge-stacks/ListView/EdgeStacksDatatable/columns.tsx
new file mode 100644
index 0000000..c218be7
--- /dev/null
+++ b/app/react/edge/edge-stacks/ListView/EdgeStacksDatatable/columns.tsx
@@ -0,0 +1,200 @@
+import { createColumnHelper } from '@tanstack/react-table';
+import _ from 'lodash';
+
+import { isoDateFromTimestamp } from '@/portainer/filters/filters';
+import { isBE } from '@/react/portainer/feature-flags/feature-flags.service';
+import { GitCommitLink } from '@/react/portainer/gitops/GitCommitLink';
+
+import { buildNameColumnFromObject } from '@@/datatables/buildNameColumn';
+import { Link } from '@@/Link';
+import { Tooltip } from '@@/Tip/Tooltip';
+
+import { StatusType } from '../../types';
+
+import { EdgeStackStatus } from './EdgeStacksStatus';
+import { DecoratedEdgeStack } from './types';
+import { DeploymentCounter } from './DeploymentCounter';
+
+const columnHelper = createColumnHelper<DecoratedEdgeStack>();
+
+export const columns = _.compact([
+  buildNameColumnFromObject<DecoratedEdgeStack>({
+    nameKey: 'Name',
+    path: 'edge.stacks.edit',
+    dataCy: 'edge-stacks-name',
+    idParam: 'stackId',
+  }),
+  columnHelper.accessor(
+    (item) =>
+      item.StatusSummary?.AggregatedStatus?.[StatusType.Acknowledged] || 0,
+    {
+      header: 'Acknowledged',
+      enableSorting: false,
+      enableHiding: false,
+      cell: ({ getValue, row }) => (
+        <DeploymentCounter
+          count={getValue()}
+          type={StatusType.Acknowledged}
+          total={row.original.NumDeployments}
+        />
+      ),
+      meta: {
+        className: '[&>*]:justify-center',
+      },
+    }
+  ),
+  isBE &&
+    columnHelper.accessor(
+      (item) =>
+        item.StatusSummary?.AggregatedStatus?.[StatusType.ImagesPulled] || 0,
+      {
+        header: 'Images pre-pulled',
+        cell: ({ getValue, row: { original: item } }) => {
+          if (!item.PrePullImage) {
+            return <div className="text-center">-</div>;
+          }
+
+          return (
+            <DeploymentCounter
+              count={getValue()}
+              type={StatusType.ImagesPulled}
+              total={item.NumDeployments}
+            />
+          );
+        },
+        enableSorting: false,
+        enableHiding: false,
+        meta: {
+          className: '[&>*]:justify-center',
+        },
+      }
+    ),
+  columnHelper.accessor(
+    (item) =>
+      item.StatusSummary?.AggregatedStatus?.[StatusType.DeploymentReceived] ||
+      0,
+    {
+      header: 'Deployments received',
+      cell: ({ getValue, row }) => (
+        <DeploymentCounter
+          count={getValue()}
+          type={StatusType.Running}
+          total={row.original.NumDeployments}
+        />
+      ),
+      enableSorting: false,
+      enableHiding: false,
+      meta: {
+        className: '[&>*]:justify-center',
+      },
+    }
+  ),
+  columnHelper.accessor(
+    (item) => item.StatusSummary?.AggregatedStatus?.[StatusType.Error] || 0,
+    {
+      header: 'Deployments failed',
+      cell: ({ getValue, row }) => {
+        const count = getValue();
+
+        return (
+          <div className="flex items-center gap-2">
+            <div className="min-w-0 flex-1">
+              <DeploymentCounter
+                count={count}
+                type={StatusType.Error}
+                total={row.original.NumDeployments}
+              />
+            </div>
+            {count > 0 && (
+              <Link
+                className="hover:no-underline"
+                to="edge.stacks.edit"
+                params={{
+                  stackId: row.original.Id,
+                  tab: 'environments',
+                  status: StatusType.Error,
+                }}
+                data-cy={`edge-stacks-error-${row.original.Id}`}
+              >
+                ({count}/{row.original.NumDeployments})
+              </Link>
+            )}
+          </div>
+        );
+      },
+      enableSorting: false,
+      enableHiding: false,
+      meta: {
+        className: '[&>*]:justify-center',
+      },
+    }
+  ),
+  columnHelper.accessor('Status', {
+    header: StatusHeader,
+    cell: ({ row }) => (
+      <div className="w-full text-center">
+        <EdgeStackStatus edgeStack={row.original} />
+      </div>
+    ),
+    enableSorting: false,
+    enableHiding: false,
+    meta: {
+      className: '[&>*]:justify-center',
+    },
+  }),
+  columnHelper.accessor('CreationDate', {
+    header: 'Creation Date',
+    cell: ({ getValue }) => isoDateFromTimestamp(getValue()),
+    enableHiding: false,
+  }),
+  isBE &&
+    columnHelper.accessor(
+      (item) =>
+        item.GitConfig ? item.GitConfig.ConfigHash : item.StackFileVersion,
+      {
+        header: 'Target Version',
+        enableSorting: false,
+        cell: ({ row: { original: item } }) => {
+          if (item.GitConfig) {
+            return (
+              <div className="text-center">
+                <GitCommitLink
+                  baseURL={item.GitConfig.URL}
+                  commitHash={item.GitConfig.ConfigHash}
+                />
+              </div>
+            );
+          }
+
+          return <div className="text-center">{item.StackFileVersion}</div>;
+        },
+        meta: {
+          className: '[&>*]:justify-center',
+        },
+      }
+    ),
+]);
+
+function StatusHeader() {
+  return (
+    <>
+      Status
+      <Tooltip
+        position="top"
+        message={
+          <>
+            <div>
+              The status feature for the Edge stack is only available for Edge
+              Agent versions 2.19.0 and above.
+            </div>
+            <div>
+              To access the status of your edge stack, it is essential to
+              upgrade your Edge Agent to a corresponding version that is
+              compatible with your Portainer server.
+            </div>
+          </>
+        }
+      />
+    </>
+  );
+}
diff --git a/app/react/edge/edge-stacks/ListView/EdgeStacksDatatable/index.ts b/app/react/edge/edge-stacks/ListView/EdgeStacksDatatable/index.ts
new file mode 100644
index 0000000..d90a90b
--- /dev/null
+++ b/app/react/edge/edge-stacks/ListView/EdgeStacksDatatable/index.ts
@@ -0,0 +1 @@
+export { EdgeStacksDatatable } from './EdgeStacksDatatable';
diff --git a/app/react/edge/edge-stacks/ListView/EdgeStacksDatatable/store.ts b/app/react/edge/edge-stacks/ListView/EdgeStacksDatatable/store.ts
new file mode 100644
index 0000000..e6d9a54
--- /dev/null
+++ b/app/react/edge/edge-stacks/ListView/EdgeStacksDatatable/store.ts
@@ -0,0 +1,24 @@
+import {
+  BasicTableSettings,
+  RefreshableTableSettings,
+  SettableColumnsTableSettings,
+  createPersistedStore,
+  hiddenColumnsSettings,
+  refreshableSettings,
+} from '@@/datatables/types';
+
+export interface TableSettings
+  extends
+    BasicTableSettings,
+    SettableColumnsTableSettings,
+    RefreshableTableSettings {}
+
+export function createStore(
+  storageKey: string,
+  initialHiddenColumns: string[] = []
+) {
+  return createPersistedStore<TableSettings>(storageKey, 'name', (set) => ({
+    ...hiddenColumnsSettings(set, initialHiddenColumns),
+    ...refreshableSettings(set, 10),
+  }));
+}
diff --git a/app/react/edge/edge-stacks/ListView/EdgeStacksDatatable/types.ts b/app/react/edge/edge-stacks/ListView/EdgeStacksDatatable/types.ts
new file mode 100644
index 0000000..64f37b8
--- /dev/null
+++ b/app/react/edge/edge-stacks/ListView/EdgeStacksDatatable/types.ts
@@ -0,0 +1,21 @@
+import { EdgeStack, StatusType } from '../../types';
+
+export enum SummarizedStatus {
+  Unavailable = 'Unavailable',
+  Deploying = 'Deploying',
+  Failed = 'Failed',
+  Paused = 'Paused',
+  PartiallyRunning = 'PartiallyRunning',
+  Completed = 'Completed',
+  Running = 'Running',
+}
+
+export type StatusSummary = {
+  AggregatedStatus?: Partial<Record<StatusType, number>>;
+  Status: SummarizedStatus;
+  Reason: string;
+};
+
+export type DecoratedEdgeStack = EdgeStack & {
+  StatusSummary?: StatusSummary;
+};
diff --git a/app/react/edge/edge-stacks/ListView/EdgeStacksDatatable/useDeleteEdgeStacksMutation.ts b/app/react/edge/edge-stacks/ListView/EdgeStacksDatatable/useDeleteEdgeStacksMutation.ts
new file mode 100644
index 0000000..7684081
--- /dev/null
+++ b/app/react/edge/edge-stacks/ListView/EdgeStacksDatatable/useDeleteEdgeStacksMutation.ts
@@ -0,0 +1,35 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { promiseSequence } from '@/portainer/helpers/promise-utils';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import {
+  mutationOptions,
+  withError,
+  withInvalidate,
+} from '@/react-tools/react-query';
+
+import { EdgeStack } from '../../types';
+import { buildUrl } from '../../queries/buildUrl';
+import { queryKeys } from '../../queries/query-keys';
+
+export function useDeleteEdgeStacksMutation() {
+  const queryClient = useQueryClient();
+  return useMutation(
+    (edgeStackIds: Array<EdgeStack['Id']>) =>
+      promiseSequence(
+        edgeStackIds.map((edgeStackId) => () => deleteEdgeStack(edgeStackId))
+      ),
+    mutationOptions(
+      withError('Unable to delete Edge stack(s)'),
+      withInvalidate(queryClient, [queryKeys.base()])
+    )
+  );
+}
+
+async function deleteEdgeStack(id: EdgeStack['Id']) {
+  try {
+    await axios.delete(buildUrl(id));
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to delete edge stack');
+  }
+}
diff --git a/app/react/edge/edge-stacks/ListView/ListView.tsx b/app/react/edge/edge-stacks/ListView/ListView.tsx
new file mode 100644
index 0000000..c82caae
--- /dev/null
+++ b/app/react/edge/edge-stacks/ListView/ListView.tsx
@@ -0,0 +1,24 @@
+import { useQueryClient } from '@tanstack/react-query';
+
+import { PageHeader } from '@@/PageHeader';
+
+import { queryKeys } from '../queries/query-keys';
+
+import { EdgeStacksDatatable } from './EdgeStacksDatatable';
+
+export function ListView() {
+  const queryClient = useQueryClient();
+
+  return (
+    <>
+      <PageHeader
+        title="Edge Stacks list"
+        breadcrumbs="Edge Stacks"
+        reload
+        onReload={() => queryClient.invalidateQueries(queryKeys.base())}
+      />
+
+      <EdgeStacksDatatable />
+    </>
+  );
+}
diff --git a/app/react/edge/edge-stacks/ListView/index.ts b/app/react/edge/edge-stacks/ListView/index.ts
new file mode 100644
index 0000000..dd06dfd
--- /dev/null
+++ b/app/react/edge/edge-stacks/ListView/index.ts
@@ -0,0 +1 @@
+export { ListView } from './ListView';
diff --git a/app/react/edge/edge-stacks/components/EdgeGroupsSelector.tsx b/app/react/edge/edge-stacks/components/EdgeGroupsSelector.tsx
new file mode 100644
index 0000000..9bbcb0e
--- /dev/null
+++ b/app/react/edge/edge-stacks/components/EdgeGroupsSelector.tsx
@@ -0,0 +1,112 @@
+import _ from 'lodash';
+import { useState } from 'react';
+
+import { EdgeGroup } from '@/react/edge/edge-groups/types';
+
+import { Select } from '@@/form-components/ReactSelect';
+import { FormError } from '@@/form-components/FormError';
+import { Link } from '@@/Link';
+import { FormControl } from '@@/form-components/FormControl';
+import { FormSection } from '@@/form-components/FormSection';
+
+import { useEdgeGroups } from '../../edge-groups/queries/useEdgeGroups';
+
+type SingleValue = EdgeGroup['Id'];
+
+interface Props {
+  value: SingleValue[];
+  onChange: (value: SingleValue[]) => void;
+  error?: string | string[];
+  horizontal?: boolean;
+  isGroupVisible?(group: EdgeGroup): boolean;
+  required?: boolean;
+}
+
+export function EdgeGroupsSelector({
+  value,
+  onChange,
+  error,
+  horizontal,
+  isGroupVisible = () => true,
+  required,
+}: Props) {
+  const [inputId] = useState(() => _.uniqueId('edge-groups-selector-'));
+
+  const selector = (
+    <InnerSelector
+      value={value}
+      onChange={onChange}
+      isGroupVisible={isGroupVisible}
+      inputId={inputId}
+    />
+  );
+
+  return horizontal ? (
+    <FormControl
+      errors={error}
+      label="Edge Groups"
+      required={required}
+      inputId={inputId}
+    >
+      {selector}
+    </FormControl>
+  ) : (
+    <FormSection title={`Edge Groups${required ? ' *' : ''}`} htmlFor={inputId}>
+      <div className="form-group">
+        <div className="col-sm-12">{selector} </div>
+        {error && (
+          <div className="col-sm-12">
+            <FormError>{error}</FormError>
+          </div>
+        )}
+      </div>
+    </FormSection>
+  );
+}
+
+function InnerSelector({
+  value,
+  onChange,
+  isGroupVisible,
+  inputId,
+}: {
+  isGroupVisible(group: EdgeGroup): boolean;
+  value: SingleValue[];
+  onChange: (value: SingleValue[]) => void;
+  inputId: string;
+}) {
+  const edgeGroupsQuery = useEdgeGroups();
+
+  const items = (edgeGroupsQuery.data || []).filter(isGroupVisible);
+
+  const valueGroups = _.compact(
+    value.map((id) => items.find((item) => item.Id === id))
+  );
+
+  return items.length ? (
+    <Select
+      aria-label="Edge groups"
+      options={items}
+      isMulti
+      getOptionLabel={(item) => item.Name}
+      getOptionValue={(item) => String(item.Id)}
+      value={valueGroups}
+      onChange={(value) => {
+        onChange(value.map((item) => item.Id));
+      }}
+      placeholder="Select one or multiple group(s)"
+      closeMenuOnSelect={false}
+      data-cy="edge-stacks-groups-selector"
+      id="edge-stacks-groups-selector"
+      inputId={inputId}
+    />
+  ) : (
+    <div className="small text-muted">
+      No Edge groups are available. Head over to the{' '}
+      <Link to="edge.groups" data-cy="edge-stacks-groups-view-link">
+        Edge groups view
+      </Link>{' '}
+      to create one.
+    </div>
+  );
+}
diff --git a/app/react/edge/edge-stacks/components/EdgeStackDeploymentTypeSelector.tsx b/app/react/edge/edge-stacks/components/EdgeStackDeploymentTypeSelector.tsx
new file mode 100644
index 0000000..c25ecd7
--- /dev/null
+++ b/app/react/edge/edge-stacks/components/EdgeStackDeploymentTypeSelector.tsx
@@ -0,0 +1,61 @@
+import { DeploymentType } from '@/react/edge/edge-stacks/types';
+
+import { BoxSelector } from '@@/BoxSelector';
+import { BoxSelectorOption } from '@@/BoxSelector/types';
+import {
+  compose,
+  kubernetes,
+} from '@@/BoxSelector/common-options/deployment-methods';
+
+interface Props {
+  value: DeploymentType;
+  onChange(value: DeploymentType): void;
+  hasDockerEndpoint: boolean;
+  hasKubeEndpoint: boolean;
+  allowKubeToSelectCompose?: boolean;
+  error?: string;
+}
+
+export function EdgeStackDeploymentTypeSelector({
+  value,
+  onChange,
+  hasDockerEndpoint,
+  hasKubeEndpoint,
+  allowKubeToSelectCompose,
+  error,
+}: Props) {
+  const deploymentOptions: BoxSelectorOption<DeploymentType>[] = [
+    {
+      ...compose,
+      value: DeploymentType.Compose,
+      disabled: () => !allowKubeToSelectCompose && hasKubeEndpoint,
+      tooltip: () =>
+        hasKubeEndpoint
+          ? 'Cannot use this option with Edge Kubernetes environments'
+          : '',
+    },
+    {
+      ...kubernetes,
+      value: DeploymentType.Kubernetes,
+      disabled: () => hasDockerEndpoint,
+      tooltip: () =>
+        hasDockerEndpoint
+          ? 'Cannot use this option with Edge Docker environments'
+          : '',
+      iconType: 'logo',
+    },
+  ];
+
+  return (
+    <>
+      <div className="col-sm-12 form-section-title"> Deployment type</div>
+      <BoxSelector
+        radioName="deploymentType"
+        value={value}
+        options={deploymentOptions}
+        onChange={onChange}
+        error={error}
+      />
+    </>
+  );
+}
diff --git a/app/react/edge/edge-stacks/components/PrePullToggle.tsx b/app/react/edge/edge-stacks/components/PrePullToggle.tsx
new file mode 100644
index 0000000..616dc8c
--- /dev/null
+++ b/app/react/edge/edge-stacks/components/PrePullToggle.tsx
@@ -0,0 +1,25 @@
+import { SwitchField } from '@@/form-components/SwitchField';
+
+export function PrePullToggle({
+  value,
+  onChange,
+}: {
+  value: boolean;
+  onChange: (value: boolean) => void;
+}) {
+  return (
+    <div className="form-group">
+      <div className="col-sm-12">
+        <SwitchField
+          checked={value}
+          data-cy="kube-edge-stack-pre-pull-switch"
+          name="prePullImage"
+          label="Pre-pull images"
+          tooltip="When enabled, redeployment will be executed when image(s) is pulled successfully"
+          labelClass="col-sm-3 col-lg-2"
+          onChange={onChange}
+        />
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/edge/edge-stacks/components/PrivateRegistryFieldset.test.tsx b/app/react/edge/edge-stacks/components/PrivateRegistryFieldset.test.tsx
new file mode 100644
index 0000000..7804902
--- /dev/null
+++ b/app/react/edge/edge-stacks/components/PrivateRegistryFieldset.test.tsx
@@ -0,0 +1,400 @@
+import { vi } from 'vitest';
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+
+import { Registry } from '@/react/portainer/registries/types/registry';
+import selectEvent from '@/react/test-utils/react-select';
+
+import {
+  REGISTRY_CREDENTIALS_ENABLED,
+  PrivateRegistryFieldset,
+} from './PrivateRegistryFieldset';
+
+describe('Initial rendering', () => {
+  it('should render with use credentials switch unchecked by default', () => {
+    renderComponent();
+
+    const checkbox = screen.getByRole('checkbox', { name: /use credentials/i });
+    expect(checkbox).toBeVisible();
+    expect(checkbox).not.toBeChecked();
+  });
+
+  it('should render with use credentials switch checked when value is defined', () => {
+    renderComponent({ value: REGISTRY_CREDENTIALS_ENABLED });
+
+    const checkbox = screen.getByRole('checkbox', { name: /use credentials/i });
+    expect(checkbox).toBeChecked();
+  });
+
+  it('should disable switch when formInvalid is true', () => {
+    renderComponent({ formInvalid: true });
+
+    const checkbox = screen.getByRole('checkbox', { name: /use credentials/i });
+    expect(checkbox).toBeDisabled();
+  });
+});
+
+describe('Switch interaction', () => {
+  it('should call onChange when switch is toggled on', async () => {
+    const user = userEvent.setup();
+    const onChange = vi.fn();
+    renderComponent({ onChange });
+
+    const checkbox = screen.getByRole('checkbox', { name: /use credentials/i });
+    await user.click(checkbox);
+
+    expect(onChange).toHaveBeenCalledWith(REGISTRY_CREDENTIALS_ENABLED);
+  });
+
+  it('should call onChange with undefined when switch is toggled off', async () => {
+    const user = userEvent.setup();
+    const onChange = vi.fn();
+    renderComponent({ value: REGISTRY_CREDENTIALS_ENABLED, onChange });
+
+    expect(
+      screen.queryByLabelText('Registry', { selector: 'input' })
+    ).toBeInTheDocument();
+
+    const checkbox = screen.getByRole('checkbox', { name: /use credentials/i });
+    await user.click(checkbox);
+
+    expect(onChange).toHaveBeenCalledWith(undefined);
+  });
+
+  it('should not call onChange on initial mount', () => {
+    const onChange = vi.fn();
+    renderComponent({ onChange });
+
+    expect(onChange).not.toHaveBeenCalled();
+  });
+});
+
+describe('Registry selection', () => {
+  it('should display registry selector with all registries when switch is on', async () => {
+    const user = userEvent.setup();
+    renderComponent({ value: REGISTRY_CREDENTIALS_ENABLED });
+
+    expect(
+      screen.getByLabelText('Registry', { selector: 'input' })
+    ).toBeVisible();
+
+    const selector = screen.getByLabelText('Registry', { selector: 'input' });
+    await user.click(selector);
+
+    await waitFor(() => {
+      expect(screen.getByText('Docker Hub')).toBeVisible();
+      expect(screen.getByText('Azure Container Registry')).toBeVisible();
+      expect(screen.getByText('Private Registry')).toBeVisible();
+    });
+  });
+
+  it('should show selected registry when value is provided', async () => {
+    renderComponent({ value: 1 });
+
+    const selector = screen.getByLabelText('Registry', { selector: 'input' });
+    expect(selector).toBeVisible();
+
+    expect(screen.getByText('Docker Hub')).toBeVisible();
+  });
+
+  it('should call onChange when a registry is selected', async () => {
+    const user = userEvent.setup();
+    const onChange = vi.fn();
+    renderComponent({ value: REGISTRY_CREDENTIALS_ENABLED, onChange });
+
+    // Find the react-select input using the combobox role
+    const input = screen.getByLabelText('Registry', { selector: 'input' });
+    await selectEvent.select(input, 'Azure Container Registry', { user });
+
+    await waitFor(() => {
+      expect(onChange).toHaveBeenCalledWith(2);
+    });
+  });
+
+  it('should update selected value when value prop changes', async () => {
+    const { rerender } = renderComponent({ value: 1 });
+
+    expect(screen.getByText('Docker Hub')).toBeVisible();
+
+    rerender(
+      <PrivateRegistryFieldset
+        value={2}
+        registries={getMockRegistries()}
+        onChange={vi.fn()}
+      />
+    );
+
+    await waitFor(() => {
+      expect(screen.getByText('Azure Container Registry')).toBeVisible();
+    });
+  });
+
+  it('should call onChange when user switches between registries', async () => {
+    const user = userEvent.setup();
+    const onChange = vi.fn();
+    renderComponent({ value: 1, onChange }); // Docker Hub already selected
+
+    expect(screen.getByText('Docker Hub')).toBeVisible();
+
+    const input = screen.getByLabelText('Registry', { selector: 'input' });
+    await selectEvent.select(input, 'Azure Container Registry', { user });
+
+    await waitFor(() => {
+      expect(onChange).toHaveBeenCalledWith(2);
+    });
+  });
+});
+
+describe('Reload functionality', () => {
+  it('should show reload button when method is not repository and onReload is provided', async () => {
+    renderComponent({
+      value: REGISTRY_CREDENTIALS_ENABLED,
+      method: 'file',
+      onReload: vi.fn(),
+    });
+
+    expect(screen.getByRole('button', { name: 'Reload' })).toBeVisible();
+  });
+
+  it('should not show reload button when method is repository', () => {
+    renderComponent({
+      value: REGISTRY_CREDENTIALS_ENABLED,
+      method: 'repository',
+      onReload: vi.fn(),
+    });
+
+    expect(
+      screen.queryByTestId('private-registry-reload-button')
+    ).not.toBeInTheDocument();
+  });
+
+  it('should call onReload when reload button is clicked', async () => {
+    const user = userEvent.setup();
+    const onReload = vi.fn();
+    renderComponent({ value: 1, method: 'file', onReload });
+
+    const reloadButton = screen.getByRole('button', { name: 'Reload' });
+    await user.click(reloadButton);
+
+    expect(onReload).toHaveBeenCalledTimes(1);
+  });
+
+  it('should show blue tip when method is not repository and switch is on', () => {
+    renderComponent({ value: REGISTRY_CREDENTIALS_ENABLED, method: 'file' });
+
+    expect(
+      screen.getByText(
+        /If you make any changes to the image urls in your yaml/i
+      )
+    ).toBeVisible();
+  });
+
+  it('should not show blue tip when method is repository', () => {
+    renderComponent({
+      value: REGISTRY_CREDENTIALS_ENABLED,
+      method: 'repository',
+    });
+
+    expect(
+      screen.queryByText(
+        /If you make any changes to the image urls in your yaml/i
+      )
+    ).not.toBeInTheDocument();
+  });
+
+  it('should not call onReload when switch is toggled off', async () => {
+    const user = userEvent.setup();
+    const onReload = vi.fn();
+    renderComponent({ value: 1, method: 'file', onReload });
+
+    const checkbox = screen.getByRole('checkbox', { name: /use credentials/i });
+    await user.click(checkbox);
+
+    expect(onReload).not.toHaveBeenCalled();
+  });
+});
+
+describe('Error handling', () => {
+  it('should display error message when errorMessage is provided', async () => {
+    const errorMessage = 'Images need to be from a single registry';
+    renderComponent({ value: REGISTRY_CREDENTIALS_ENABLED, errorMessage });
+
+    expect(screen.getByText(errorMessage)).toBeVisible();
+  });
+
+  it('should not display registry selector when error message is shown', async () => {
+    const errorMessage = 'Images need to be from a single registry';
+    renderComponent({ value: REGISTRY_CREDENTIALS_ENABLED, errorMessage });
+
+    expect(
+      screen.queryByLabelText('Registry', { selector: 'input' })
+    ).not.toBeInTheDocument();
+  });
+});
+
+describe('Edge cases', () => {
+  it('should handle single registry option', async () => {
+    const user = userEvent.setup();
+    const onChange = vi.fn();
+    const [singleRegistry] = getMockRegistries();
+    renderComponent({
+      registries: [singleRegistry],
+      value: REGISTRY_CREDENTIALS_ENABLED,
+      onChange,
+    });
+
+    const input = screen.getByLabelText('Registry', { selector: 'input' });
+    await selectEvent.select(input, 'Docker Hub', { user });
+
+    await waitFor(() => {
+      expect(onChange).toHaveBeenCalledWith(1);
+    });
+  });
+
+  it('should handle empty registries array', () => {
+    renderComponent({ registries: [], value: REGISTRY_CREDENTIALS_ENABLED });
+
+    expect(
+      screen.getByLabelText('Registry', { selector: 'input' })
+    ).toBeVisible();
+  });
+
+  it('should handle undefined value', () => {
+    renderComponent({ value: undefined });
+
+    expect(
+      screen.queryByLabelText('Registry', { selector: 'input' })
+    ).not.toBeInTheDocument();
+  });
+
+  it('should handle value changing from undefined to defined', async () => {
+    const { rerender } = renderComponent({ value: undefined });
+
+    const checkbox = screen.getByRole('checkbox', { name: /use credentials/i });
+    expect(checkbox).not.toBeChecked();
+
+    rerender(
+      <PrivateRegistryFieldset
+        registries={getMockRegistries()}
+        onChange={vi.fn()}
+        value={REGISTRY_CREDENTIALS_ENABLED}
+      />
+    );
+
+    expect(checkbox).toBeChecked();
+  });
+
+  it('should preserve registry selection after reload', async () => {
+    const user = userEvent.setup();
+    const onChange = vi.fn();
+    const onReload = vi.fn();
+    renderComponent({ value: 1, method: 'file', onChange, onReload });
+
+    await waitFor(() => {
+      expect(screen.getByText('Docker Hub')).toBeVisible();
+    });
+
+    const reloadButton = screen.getByRole('button', { name: 'Reload' });
+    await user.click(reloadButton);
+
+    expect(onReload).toHaveBeenCalledTimes(1);
+    expect(onChange).not.toHaveBeenCalled(); // Registry selection unchanged
+    expect(screen.getByText('Docker Hub')).toBeVisible();
+  });
+
+  it('should handle value changing from defined to undefined', async () => {
+    const { rerender } = renderComponent({ value: 1 });
+
+    expect(screen.getByText('Docker Hub')).toBeVisible();
+
+    rerender(
+      <PrivateRegistryFieldset
+        value={undefined}
+        registries={getMockRegistries()}
+        onChange={vi.fn()}
+      />
+    );
+
+    // Registry selector should be hidden when value is undefined
+    await waitFor(() => {
+      expect(screen.queryByText('Docker Hub')).not.toBeInTheDocument();
+      expect(
+        screen.queryByLabelText('Registry', { selector: 'input' })
+      ).not.toBeInTheDocument();
+    });
+  });
+
+  it('should handle registry ID that does not exist in registries array', () => {
+    renderComponent({ value: 999 }); // Non-existent ID
+
+    const selector = screen.getByLabelText('Registry', { selector: 'input' });
+    expect(selector).toBeVisible();
+
+    // Should not crash, selector should be empty (no selection shown)
+    expect(screen.queryByText('Docker Hub')).not.toBeInTheDocument();
+    expect(
+      screen.queryByText('Azure Container Registry')
+    ).not.toBeInTheDocument();
+    expect(screen.queryByText('Private Registry')).not.toBeInTheDocument();
+  });
+});
+
+function getMockRegistries(): Registry[] {
+  return [
+    {
+      Id: 1,
+      Name: 'Docker Hub',
+      URL: 'docker.io',
+      Type: 6,
+      BaseURL: '',
+      Authentication: true,
+      Username: 'user1',
+      RegistryAccesses: null,
+      Gitlab: { ProjectId: 0, InstanceURL: '', ProjectPath: '' },
+      Quay: { OrganisationName: '' },
+      Github: { UseOrganisation: false, OrganisationName: '' },
+      Ecr: { Region: '' },
+    },
+    {
+      Id: 2,
+      Name: 'Azure Container Registry',
+      URL: 'acr.io',
+      Type: 2,
+      BaseURL: '',
+      Authentication: true,
+      Username: 'user2',
+      RegistryAccesses: null,
+      Gitlab: { ProjectId: 0, InstanceURL: '', ProjectPath: '' },
+      Quay: { OrganisationName: '' },
+      Github: { UseOrganisation: false, OrganisationName: '' },
+      Ecr: { Region: '' },
+    },
+    {
+      Id: 3,
+      Name: 'Private Registry',
+      URL: 'registry.example.com',
+      Type: 3,
+      BaseURL: '',
+      Authentication: true,
+      Username: 'user3',
+      RegistryAccesses: null,
+      Gitlab: { ProjectId: 0, InstanceURL: '', ProjectPath: '' },
+      Quay: { OrganisationName: '' },
+      Github: { UseOrganisation: false, OrganisationName: '' },
+      Ecr: { Region: '' },
+    },
+  ];
+}
+
+function renderComponent(
+  props: Partial<Parameters<typeof PrivateRegistryFieldset>[0]> = {}
+) {
+  const defaultProps = {
+    registries: getMockRegistries(),
+    onChange: vi.fn(),
+  };
+
+  const mergedProps = { ...defaultProps, ...props };
+
+  return render(<PrivateRegistryFieldset {...mergedProps} />);
+}
diff --git a/app/react/edge/edge-stacks/components/PrivateRegistryFieldset.tsx b/app/react/edge/edge-stacks/components/PrivateRegistryFieldset.tsx
new file mode 100644
index 0000000..4708c60
--- /dev/null
+++ b/app/react/edge/edge-stacks/components/PrivateRegistryFieldset.tsx
@@ -0,0 +1,100 @@
+import { RefreshCw } from 'lucide-react';
+
+import { Registry } from '@/react/portainer/registries/types/registry';
+
+import { Select } from '@@/form-components/ReactSelect';
+import { FormControl } from '@@/form-components/FormControl';
+import { Button } from '@@/buttons';
+import { FormError } from '@@/form-components/FormError';
+import { SwitchField } from '@@/form-components/SwitchField';
+import { TextTip } from '@@/Tip/TextTip';
+import { FormSection } from '@@/form-components/FormSection';
+
+interface Props {
+  value?: number;
+  registries: Registry[];
+  onReload?: () => void;
+  formInvalid?: boolean;
+  errorMessage?: string;
+  onChange: (value?: number) => void;
+  method?: 'repository' | string;
+}
+
+export const REGISTRY_CREDENTIALS_ENABLED = -1;
+
+export function PrivateRegistryFieldset({
+  value,
+  registries,
+  onReload,
+  formInvalid,
+  errorMessage,
+  onChange,
+  method,
+}: Props) {
+  const tooltipMessage =
+    'This allows you to provide credentials when using a private registry that requires authentication';
+
+  const isActive = !!value;
+
+  return (
+    <FormSection title="Registry">
+      <div className="form-group">
+        <div className="col-sm-12">
+          <SwitchField
+            checked={isActive}
+            onChange={handleCheckChange}
+            tooltip={tooltipMessage}
+            label="Use Credentials"
+            labelClass="col-sm-3 col-lg-2"
+            disabled={formInvalid}
+            data-cy="private-registry-use-credentials-switch"
+          />
+        </div>
+      </div>
+
+      {isActive && (
+        <>
+          {method !== 'repository' && (
+            <TextTip color="blue">
+              If you make any changes to the image urls in your yaml, please
+              reload or select registry manually
+            </TextTip>
+          )}
+
+          {!errorMessage ? (
+            <FormControl label="Registry" inputId="private-registry-selector">
+              <div className="flex">
+                <Select
+                  value={registries.filter((registry) => registry.Id === value)}
+                  options={registries}
+                  getOptionLabel={(registry) => registry.Name}
+                  getOptionValue={(registry) => registry.Id.toString()}
+                  onChange={(value) => onChange(value?.Id)}
+                  className="w-full"
+                  data-cy="private-registry-selector"
+                  inputId="private-registry-selector"
+                />
+                {method !== 'repository' && onReload && (
+                  <Button
+                    onClick={onReload}
+                    title="Reload"
+                    icon={RefreshCw}
+                    color="light"
+                    data-cy="private-registry-reload-button"
+                    aria-label="Reload"
+                  />
+                )}
+              </div>
+            </FormControl>
+          ) : (
+            <FormError>{errorMessage}</FormError>
+          )}
+        </>
+      )}
+    </FormSection>
+  );
+
+  function handleCheckChange(checked: boolean) {
+    onChange(checked ? REGISTRY_CREDENTIALS_ENABLED : undefined);
+  }
+}
diff --git a/app/react/edge/edge-stacks/components/RetryDeployToggle.tsx b/app/react/edge/edge-stacks/components/RetryDeployToggle.tsx
new file mode 100644
index 0000000..236a0f3
--- /dev/null
+++ b/app/react/edge/edge-stacks/components/RetryDeployToggle.tsx
@@ -0,0 +1,25 @@
+import { SwitchField } from '@@/form-components/SwitchField';
+
+export function RetryDeployToggle({
+  value,
+  onChange,
+}: {
+  value: boolean;
+  onChange: (value: boolean) => void;
+}) {
+  return (
+    <div className="form-group">
+      <div className="col-sm-12">
+        <SwitchField
+          checked={value}
+          data-cy="edge-stack-retry-deploy-toggle"
+          name="retryDeploy"
+          label="Retry deployment"
+          tooltip="When enabled, this will allow the edge agent to retry deployment if failed to deploy initially"
+          labelClass="col-sm-3 col-lg-2"
+          onChange={onChange}
+        />
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/edge/edge-stacks/components/StaggerFieldset.tsx b/app/react/edge/edge-stacks/components/StaggerFieldset.tsx
new file mode 100644
index 0000000..8e3dea4
--- /dev/null
+++ b/app/react/edge/edge-stacks/components/StaggerFieldset.tsx
@@ -0,0 +1,300 @@
+import { number, string, object, SchemaOf } from 'yup';
+import { FormikErrors } from 'formik';
+
+import { FormSection } from '@@/form-components/FormSection';
+import { RadioGroup } from '@@/RadioGroup/RadioGroup';
+import { Input } from '@@/form-components/Input';
+import { TextTip } from '@@/Tip/TextTip';
+import { FormControl } from '@@/form-components/FormControl';
+import { Button, ButtonGroup } from '@@/buttons';
+
+import { StaggerParallelFieldset } from './StaggerParallelFieldset';
+import {
+  StaggerConfig,
+  StaggerOption,
+  StaggerParallelOption,
+  UpdateFailureAction,
+} from './StaggerFieldset.types';
+
+interface Props {
+  values: StaggerConfig;
+  onChange: (value: Partial<StaggerConfig>) => void;
+  errors?: FormikErrors<StaggerConfig>;
+  isEdit?: boolean;
+}
+
+const staggerOptions = [
+  {
+    value: StaggerOption.AllAtOnce,
+    label: 'All edge devices at once',
+  },
+  {
+    value: StaggerOption.Parallel,
+    label: 'Parallel edge device(s)',
+  },
+] as const;
+
+export function StaggerFieldset({
+  values,
+  onChange,
+  errors,
+  isEdit = true,
+}: Props) {
+  return (
+    <FormSection title="Update configurations">
+      {!isEdit && (
+        <div className="form-group">
+          <div className="col-sm-12">
+            <TextTip color="blue">
+              Please note that the &apos;Update Configuration&apos; setting
+              takes effect exclusively during edge stack updates, whether
+              triggered manually, through webhook events, or via GitOps updates
+              processes
+            </TextTip>
+          </div>
+        </div>
+      )}
+
+      <div className="form-group">
+        <div className="col-sm-12">
+          <RadioGroup
+            options={staggerOptions}
+            selectedOption={values.StaggerOption}
+            onOptionChange={(value) => {
+              handleChange({ StaggerOption: value });
+            }}
+            name="StaggerOption"
+          />
+        </div>
+      </div>
+
+      {values.StaggerOption === StaggerOption.Parallel && (
+        <div className="mb-2">
+          <TextTip color="blue">
+            Specify the number of device(s) to be updated concurrently.
+            {values.StaggerParallelOption ===
+              StaggerParallelOption.Incremental && (
+              <div className="mb-2">
+                For example, if you start with 2 devices and multiply by 5, the
+                update will initially cover 2 edge devices, then 10 devices (2 x
+                5), followed by 50 devices (10 x 5), and so on.
+              </div>
+            )}
+          </TextTip>
+
+          <StaggerParallelFieldset
+            values={values}
+            onChange={handleChange}
+            errors={errors}
+          />
+
+          <FormControl
+            label="Timeout"
+            inputId="timeout"
+            errors={errors?.Timeout}
+          >
+            <div>
+              <div style={{ display: 'inline-block', width: '150px' }}>
+                <Input
+                  name="Timeout"
+                  id="stagger-timeout"
+                  placeholder="eg. 5 (optional)"
+                  value={values.Timeout}
+                  onChange={(e) =>
+                    handleChange({
+                      Timeout: e.currentTarget.value,
+                    })
+                  }
+                  data-cy="edge-stacks-stagger-timeout-input"
+                />
+              </div>
+              <span> {' minute(s) '} </span>
+            </div>
+          </FormControl>
+
+          <FormControl
+            label="Update delay"
+            inputId="update-delay"
+            errors={errors?.UpdateDelay}
+          >
+            <div>
+              <div style={{ display: 'inline-block', width: '150px' }}>
+                <Input
+                  name="UpdateDelay"
+                  data-cy="edge-stacks-stagger-update-delay-input"
+                  id="stagger-update-delay"
+                  placeholder="eg. 5 (optional)"
+                  value={values.UpdateDelay}
+                  onChange={(e) =>
+                    handleChange({
+                      UpdateDelay: e.currentTarget.value,
+                    })
+                  }
+                />
+              </div>
+              <span> {' minute(s) '} </span>
+            </div>
+          </FormControl>
+
+          <FormControl
+            label="Update failure action"
+            inputId="update-failure-action"
+            errors={errors?.UpdateFailureAction}
+          >
+            <ButtonGroup>
+              <Button
+                className="btn-box-shadow"
+                data-cy="edge-stacks-stagger-update-failure-action-continue-button"
+                color={
+                  values.UpdateFailureAction === UpdateFailureAction.Continue
+                    ? 'primary'
+                    : 'light'
+                }
+                onClick={() =>
+                  handleChange({
+                    UpdateFailureAction: UpdateFailureAction.Continue,
+                  })
+                }
+              >
+                Continue
+              </Button>
+              <Button
+                className="btn-box-shadow"
+                data-cy="edge-stacks-stagger-update-failure-action-pause-button"
+                color={
+                  values.UpdateFailureAction === UpdateFailureAction.Pause
+                    ? 'primary'
+                    : 'light'
+                }
+                onClick={() =>
+                  handleChange({
+                    UpdateFailureAction: UpdateFailureAction.Pause,
+                  })
+                }
+              >
+                Pause
+              </Button>
+              <Button
+                className="btn-box-shadow"
+                data-cy="edge-stacks-stagger-update-failure-action-rollback-button"
+                color={
+                  values.UpdateFailureAction === UpdateFailureAction.Rollback
+                    ? 'primary'
+                    : 'light'
+                }
+                onClick={() =>
+                  handleChange({
+                    UpdateFailureAction: UpdateFailureAction.Rollback,
+                  })
+                }
+              >
+                Rollback
+              </Button>
+            </ButtonGroup>
+          </FormControl>
+        </div>
+      )}
+    </FormSection>
+  );
+
+  function handleChange(partialValue: Partial<StaggerConfig>) {
+    onChange(partialValue);
+    // setControlledValues((values) => ({ ...values, ...partialValue }));
+  }
+}
+
+export function staggerConfigValidation(): SchemaOf<StaggerConfig> {
+  return object({
+    StaggerOption: number()
+      .oneOf([StaggerOption.AllAtOnce, StaggerOption.Parallel])
+      .required('Stagger option is required'),
+    StaggerParallelOption: number()
+      .when('StaggerOption', {
+        is: StaggerOption.Parallel,
+        then: (schema) =>
+          schema.oneOf([
+            StaggerParallelOption.Fixed,
+            StaggerParallelOption.Incremental,
+          ]),
+      })
+      .optional(),
+    DeviceNumber: number()
+      .default(0)
+      .when('StaggerOption', {
+        is: StaggerOption.Parallel,
+        then: (schema) =>
+          schema.when('StaggerParallelOption', {
+            is: StaggerParallelOption.Fixed,
+            then: (schema) =>
+              schema
+                .required('Devices number is at least 1')
+                .min(1, 'Devices number is at least 1'),
+          }),
+      })
+      .optional(),
+    DeviceNumberStartFrom: number()
+      .when('StaggerOption', {
+        is: StaggerOption.Parallel,
+        then: (schema) =>
+          schema.when('StaggerParallelOption', {
+            is: StaggerParallelOption.Incremental,
+            then: (schema) =>
+              schema
+                .min(1, 'Devices number start from at least 1')
+                .required('Devices number is required'),
+          }),
+      })
+      .optional(),
+    DeviceNumberIncrementBy: number()
+      .default(2)
+      .when('StaggerOption', {
+        is: StaggerOption.Parallel,
+        then: (schema) =>
+          schema.when('StaggerParallelOption', {
+            is: StaggerParallelOption.Incremental,
+            then: (schema) =>
+              schema
+                .min(2)
+                .max(10)
+                .required('Devices number increment by is required'),
+          }),
+      })
+      .optional(),
+    Timeout: string()
+      .default('')
+      .when('StaggerOption', {
+        is: StaggerOption.Parallel,
+        then: (schema) =>
+          schema.test(
+            'is-number',
+            'Timeout must be a number',
+            (value) => !Number.isNaN(Number(value))
+          ),
+      })
+      .optional(),
+    UpdateDelay: string()
+      .default('')
+      .when('StaggerOption', {
+        is: StaggerOption.Parallel,
+        then: (schema) =>
+          schema.test(
+            'is-number',
+            'Timeout must be a number',
+            (value) => !Number.isNaN(Number(value))
+          ),
+      })
+      .optional(),
+    UpdateFailureAction: number()
+      .default(UpdateFailureAction.Continue)
+      .when('StaggerOption', {
+        is: StaggerOption.Parallel,
+        then: (schema) =>
+          schema.oneOf([
+            UpdateFailureAction.Continue,
+            UpdateFailureAction.Pause,
+            UpdateFailureAction.Rollback,
+          ]),
+      })
+      .optional(),
+  });
+}
diff --git a/app/react/edge/edge-stacks/components/StaggerFieldset.types.ts b/app/react/edge/edge-stacks/components/StaggerFieldset.types.ts
new file mode 100644
index 0000000..e8c7d09
--- /dev/null
+++ b/app/react/edge/edge-stacks/components/StaggerFieldset.types.ts
@@ -0,0 +1,39 @@
+export type StaggerConfig = {
+  StaggerOption: StaggerOption;
+  StaggerParallelOption?: StaggerParallelOption;
+  DeviceNumber?: number;
+  DeviceNumberStartFrom?: number;
+  DeviceNumberIncrementBy?: number;
+  Timeout?: string;
+  UpdateDelay?: string;
+  UpdateFailureAction?: UpdateFailureAction;
+};
+
+export enum StaggerOption {
+  AllAtOnce = 1,
+  Parallel,
+}
+
+export enum StaggerParallelOption {
+  Fixed = 1,
+  Incremental,
+}
+
+export enum UpdateFailureAction {
+  Continue = 1,
+  Pause,
+  Rollback,
+}
+
+export function getDefaultStaggerConfig(): StaggerConfig {
+  return {
+    StaggerOption: StaggerOption.AllAtOnce,
+    StaggerParallelOption: StaggerParallelOption.Fixed,
+    DeviceNumber: 1,
+    DeviceNumberStartFrom: 0,
+    DeviceNumberIncrementBy: 2,
+    Timeout: '',
+    UpdateDelay: '',
+    UpdateFailureAction: UpdateFailureAction.Continue,
+  };
+}
diff --git a/app/react/edge/edge-stacks/components/StaggerParallelFieldset.tsx b/app/react/edge/edge-stacks/components/StaggerParallelFieldset.tsx
new file mode 100644
index 0000000..8581109
--- /dev/null
+++ b/app/react/edge/edge-stacks/components/StaggerParallelFieldset.tsx
@@ -0,0 +1,130 @@
+import { FormikErrors } from 'formik';
+
+import { Select, Input } from '@@/form-components/Input';
+import { FormError } from '@@/form-components/FormError';
+
+import { StaggerConfig, StaggerParallelOption } from './StaggerFieldset.types';
+
+interface Props {
+  values: StaggerConfig;
+  onChange: (value: Partial<StaggerConfig>) => void;
+  errors?: FormikErrors<StaggerConfig>;
+}
+
+export function StaggerParallelFieldset({ values, onChange, errors }: Props) {
+  const staggerParallelOptions = [
+    {
+      value: StaggerParallelOption.Fixed.toString(),
+      label: 'Number of device(s)',
+    },
+    {
+      value: StaggerParallelOption.Incremental.toString(),
+      label: 'Exponential rollout',
+    },
+  ];
+
+  const deviceNumberIncrementBy = [
+    {
+      value: '2',
+      label: '2',
+    },
+    {
+      value: '5',
+      label: '5',
+    },
+    {
+      value: '10',
+      label: '10',
+    },
+  ];
+
+  return (
+    <div
+      className='form-group mb-5 mt-2 after:clear-both after:table after:content-[""]' // to fix issues with float"
+    >
+      <div className="col-sm-3 col-lg-2">
+        <Select
+          id="stagger-parallel-option"
+          data-cy="edge-stack-stagger-parallel-option-select"
+          value={values.StaggerParallelOption?.toString()}
+          onChange={(e) =>
+            handleChange({
+              StaggerParallelOption: parseInt(e.currentTarget.value, 10),
+            })
+          }
+          options={staggerParallelOptions}
+        />
+      </div>
+
+      {values.StaggerParallelOption === StaggerParallelOption.Fixed && (
+        <div className="col-sm-9 col-lg-10">
+          <Input
+            name="DeviceNumber"
+            data-cy="edge-stack-device-number-input"
+            id="device-number"
+            type="number"
+            placeholder="eg. 1 or 10"
+            min={1}
+            value={values.DeviceNumber || ''}
+            onChange={(e) => {
+              handleChange({
+                DeviceNumber: e.currentTarget.valueAsNumber || undefined,
+              });
+            }}
+          />
+          {errors?.DeviceNumber && (
+            <FormError>{errors?.DeviceNumber}</FormError>
+          )}
+        </div>
+      )}
+
+      {values.StaggerParallelOption === StaggerParallelOption.Incremental && (
+        <div className="col-sm-9 col-lg-10">
+          <div>
+            <span> {' start with '} </span>
+            <div style={{ display: 'inline-block', width: '150px' }}>
+              <Input
+                name="DeviceNumberStartFrom"
+                data-cy="edge-stack-device-number-start-from-input"
+                type="number"
+                id="device-number-start-from"
+                min={1}
+                placeholder="eg. 1"
+                value={values.DeviceNumberStartFrom}
+                onChange={(e) =>
+                  handleChange({
+                    DeviceNumberStartFrom:
+                      e.currentTarget.value !== ''
+                        ? e.currentTarget.valueAsNumber
+                        : 0,
+                  })
+                }
+              />
+            </div>
+            <span> {' device(s) and multiply the group size by '} </span>
+            <Select
+              id="device-number-incremental"
+              data-cy="edge-stack-device-number-incremental-select"
+              value={values.DeviceNumberIncrementBy}
+              style={{ display: 'inline-block', width: '150px' }}
+              onChange={(e) =>
+                handleChange({
+                  DeviceNumberIncrementBy: parseInt(e.currentTarget.value, 10),
+                })
+              }
+              options={deviceNumberIncrementBy}
+            />
+            <span>{' for each rollout '} </span>
+          </div>
+          {errors?.DeviceNumberStartFrom && (
+            <FormError>{errors?.DeviceNumberStartFrom}</FormError>
+          )}
+        </div>
+      )}
+    </div>
+  );
+
+  function handleChange(partialValue: Partial<StaggerConfig>) {
+    onChange(partialValue);
+  }
+}
diff --git a/app/react/edge/edge-stacks/queries/buildUrl.ts b/app/react/edge/edge-stacks/queries/buildUrl.ts
new file mode 100644
index 0000000..a4bfa07
--- /dev/null
+++ b/app/react/edge/edge-stacks/queries/buildUrl.ts
@@ -0,0 +1,7 @@
+import { EdgeStack } from '../types';
+
+export function buildUrl(id?: EdgeStack['Id'], action?: string) {
+  const baseUrl = '/edge_stacks';
+  const url = id ? `${baseUrl}/${id}` : baseUrl;
+  return action ? `${url}/${action}` : url;
+}
diff --git a/app/react/edge/edge-stacks/queries/query-keys.ts b/app/react/edge/edge-stacks/queries/query-keys.ts
new file mode 100644
index 0000000..ae70107
--- /dev/null
+++ b/app/react/edge/edge-stacks/queries/query-keys.ts
@@ -0,0 +1,8 @@
+import { EdgeStack } from '../types';
+
+export const queryKeys = {
+  base: () => ['edge-stacks'] as const,
+  item: (id: EdgeStack['Id']) => [...queryKeys.base(), id] as const,
+  file: (id: EdgeStack['Id'], version?: number) =>
+    [...queryKeys.item(id), 'file', { version }] as const,
+};
diff --git a/app/react/edge/edge-stacks/queries/useCreateEdgeStack/createStackFromFile.ts b/app/react/edge/edge-stacks/queries/useCreateEdgeStack/createStackFromFile.ts
new file mode 100644
index 0000000..28c8c56
--- /dev/null
+++ b/app/react/edge/edge-stacks/queries/useCreateEdgeStack/createStackFromFile.ts
@@ -0,0 +1,45 @@
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { RegistryId } from '@/react/portainer/registries/types/registry';
+import { Pair } from '@/react/portainer/settings/types';
+import { EdgeGroup } from '@/react/edge/edge-groups/types';
+import { json2formData } from '@/portainer/helpers/json';
+
+import { DeploymentType, EdgeStack, StaggerConfig } from '../../types';
+import { buildUrl } from '../buildUrl';
+
+/**
+ * Payload to create an EdgeStack from a git repository
+ */
+export type FileUploadPayload = {
+  Name: string;
+  file: File;
+  EdgeGroups: Array<EdgeGroup['Id']>;
+  DeploymentType: DeploymentType;
+  Registries?: Array<RegistryId>;
+  /** * Uses the manifest's namespaces instead of the default one */
+  UseManifestNamespaces?: boolean;
+  PrePullImage?: boolean;
+  RetryDeploy?: boolean;
+  /** List of environment variables */
+  EnvVars?: Array<Pair>;
+  /** Configuration for stagger updates */
+  StaggerConfig?: StaggerConfig;
+  Webhook?: string;
+};
+
+export async function createStackFromFile(payload: FileUploadPayload) {
+  try {
+    const { data } = await axios.post<EdgeStack>(
+      buildUrl(undefined, 'create/file'),
+      json2formData(payload),
+      {
+        headers: {
+          'Content-Type': 'multipart/form-data',
+        },
+      }
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e as Error);
+  }
+}
diff --git a/app/react/edge/edge-stacks/queries/useCreateEdgeStack/createStackFromFileContent.ts b/app/react/edge/edge-stacks/queries/useCreateEdgeStack/createStackFromFileContent.ts
new file mode 100644
index 0000000..1523949
--- /dev/null
+++ b/app/react/edge/edge-stacks/queries/useCreateEdgeStack/createStackFromFileContent.ts
@@ -0,0 +1,47 @@
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { RegistryId } from '@/react/portainer/registries/types/registry';
+import { Pair } from '@/react/portainer/settings/types';
+import { EdgeGroup } from '@/react/edge/edge-groups/types';
+
+import { DeploymentType, EdgeStack, StaggerConfig } from '../../types';
+import { buildUrl } from '../buildUrl';
+
+/**
+ * Payload for creating an EdgeStack from a string
+ */
+export interface FileContentPayload {
+  /** Name of the stack */
+  name: string;
+  /** Content of the Stack file */
+  stackFileContent: string;
+  /** List of identifiers of EdgeGroups */
+  edgeGroups: Array<EdgeGroup['Id']>;
+  /** Deployment type to deploy this stack */
+  deploymentType: DeploymentType;
+  /** List of Registries to use for this stack */
+  registries?: Array<RegistryId>;
+  /** Uses the manifest's namespaces instead of the default one */
+  useManifestNamespaces?: boolean;
+  /** Pre Pull image */
+  prePullImage?: boolean;
+  /** Retry deploy */
+  retryDeploy?: boolean;
+  /** Optional webhook configuration */
+  webhook?: string;
+  /** List of environment variables */
+  envVars?: Array<Pair>;
+  /** Configuration for stagger updates */
+  staggerConfig?: StaggerConfig;
+}
+
+export async function createStackFromFileContent(payload: FileContentPayload) {
+  try {
+    const { data } = await axios.post<EdgeStack>(
+      buildUrl(undefined, 'create/string'),
+      payload
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e as Error);
+  }
+}
diff --git a/app/react/edge/edge-stacks/queries/useCreateEdgeStack/createStackFromGit.ts b/app/react/edge/edge-stacks/queries/useCreateEdgeStack/createStackFromGit.ts
new file mode 100644
index 0000000..de04e6f
--- /dev/null
+++ b/app/react/edge/edge-stacks/queries/useCreateEdgeStack/createStackFromGit.ts
@@ -0,0 +1,68 @@
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { RegistryId } from '@/react/portainer/registries/types/registry';
+import { Pair } from '@/react/portainer/settings/types';
+import { EdgeGroup } from '@/react/edge/edge-groups/types';
+import { AutoUpdateResponse } from '@/react/portainer/gitops/types';
+
+import { DeploymentType, EdgeStack, StaggerConfig } from '../../types';
+import { buildUrl } from '../buildUrl';
+
+/**
+ * Payload to create an EdgeStack from a git repository
+ */
+export type GitRepositoryPayload = {
+  /** Name of the stack */
+  name: string;
+  /** ID of an existing git source to use for credentials/URL. When set, repositoryUrl and auth fields are ignored. */
+  sourceId?: number;
+  /** URL of a Git repository hosting the Stack file */
+  repositoryUrl?: string;
+  /** Reference name of a Git repository hosting the Stack file */
+  repositoryReferenceName?: string;
+  /** Path to the Stack file inside the Git repository */
+  filePathInRepository?: string;
+  /** List of identifiers of EdgeGroups */
+  edgeGroups: Array<EdgeGroup['Id']>;
+  /** Deployment type to deploy this stack. Valid values are: 0 - 'compose', 1 - 'kubernetes'. Compose is enabled only for docker environments, kubernetes is enabled only for kubernetes environments */
+  deploymentType: DeploymentType;
+  /** List of Registries to use for this stack */
+  registries?: Array<RegistryId>;
+  /** Uses the manifest's namespaces instead of the default one */
+  useManifestNamespaces?: boolean;
+  /** Pre Pull image */
+  prePullImage?: boolean;
+  /** Retry deploy */
+  retryDeploy?: boolean;
+  /** TLSSkipVerify skips SSL verification when cloning the Git repository */
+  tlsSkipVerify?: boolean;
+  /** Optional GitOps update configuration */
+  autoUpdate: AutoUpdateResponse | null;
+  /** Whether the stack supports relative path volume */
+  supportRelativePath?: boolean;
+  /** Local filesystem path */
+  filesystemPath?: string;
+  /** Whether the edge stack supports per device configs */
+  supportPerDeviceConfigs?: boolean;
+  /** Per device configs match type */
+  perDeviceConfigsMatchType?: string;
+  /** Per device configs group match type */
+  perDeviceConfigsGroupMatchType?: string;
+  /** Per device configs path */
+  perDeviceConfigsPath?: string;
+  /** List of environment variables */
+  envVars?: Array<Pair>;
+  /** Configuration for stagger updates */
+  staggerConfig?: StaggerConfig;
+};
+
+export async function createStackFromGit(payload: GitRepositoryPayload) {
+  try {
+    const { data } = await axios.post<EdgeStack>(
+      buildUrl(undefined, 'create/repository'),
+      payload
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e as Error);
+  }
+}
diff --git a/app/react/edge/edge-stacks/queries/useCreateEdgeStack/useCreateEdgeStack.ts b/app/react/edge/edge-stacks/queries/useCreateEdgeStack/useCreateEdgeStack.ts
new file mode 100644
index 0000000..97cca3f
--- /dev/null
+++ b/app/react/edge/edge-stacks/queries/useCreateEdgeStack/useCreateEdgeStack.ts
@@ -0,0 +1,145 @@
+import { useMutation } from '@tanstack/react-query';
+
+import { EdgeGroup } from '@/react/edge/edge-groups/types';
+import { RegistryId } from '@/react/portainer/registries/types/registry';
+import { Pair } from '@/react/portainer/settings/types';
+import {
+  AutoUpdateResponse,
+  GitFormModel,
+  RelativePathModel,
+} from '@/react/portainer/gitops/types';
+import { withError } from '@/react-tools/react-query';
+
+import { DeploymentType, StaggerConfig } from '../../types';
+
+import { createStackFromFile } from './createStackFromFile';
+import { createStackFromFileContent } from './createStackFromFileContent';
+import { createStackFromGit } from './createStackFromGit';
+
+export function useCreateEdgeStack() {
+  return useMutation({
+    mutationFn: createEdgeStack,
+    ...withError('unable to create edge stack'),
+  });
+}
+
+export type BasePayload = {
+  /** Name of the stack */
+  name: string;
+  /** Content of the Stack file */
+  /** List of identifiers of EdgeGroups */
+  edgeGroups: Array<EdgeGroup['Id']>;
+  /** Deployment type to deploy this stack */
+  deploymentType: DeploymentType;
+  /** List of Registries to use for this stack */
+  registries?: Array<RegistryId>;
+  /** Uses the manifest's namespaces instead of the default one */
+  useManifestNamespaces?: boolean;
+  /** Pre Pull image */
+  prePullImage?: boolean;
+  /** Retry deploy */
+  retryDeploy?: boolean;
+  /** List of environment variables */
+  envVars?: Array<Pair>;
+  /** Configuration for stagger updates */
+  staggerConfig?: StaggerConfig;
+};
+
+/**
+ * Payload for creating an EdgeStack from a string
+ */
+export type CreateEdgeStackPayload =
+  | {
+      method: 'file';
+      payload: BasePayload & {
+        /** File to upload */
+        file: File;
+        /** Optional webhook configuration */
+        webhook?: string;
+      };
+    }
+  | {
+      method: 'string';
+      payload: BasePayload & {
+        /** Content of the Stack file */
+        fileContent: string;
+        /** Optional webhook configuration */
+        webhook?: string;
+      };
+    }
+  | {
+      method: 'git';
+      payload: BasePayload & {
+        git: GitFormModel;
+        relativePathSettings?: RelativePathModel;
+        autoUpdate: AutoUpdateResponse | null;
+      };
+    };
+
+function createEdgeStack({ method, payload }: CreateEdgeStackPayload) {
+  switch (method) {
+    case 'file':
+      return createStackFromFile({
+        DeploymentType: payload.deploymentType,
+        EdgeGroups: payload.edgeGroups,
+        Name: payload.name,
+        file: payload.file,
+        EnvVars: payload.envVars,
+        PrePullImage: payload.prePullImage,
+        Registries: payload.registries,
+        RetryDeploy: payload.retryDeploy,
+        StaggerConfig: payload.staggerConfig,
+        UseManifestNamespaces: payload.useManifestNamespaces,
+        Webhook: payload.webhook,
+      });
+    case 'git':
+      return createEdgeStackFromGit(payload);
+    case 'string':
+      return createStackFromFileContent({
+        deploymentType: payload.deploymentType,
+        edgeGroups: payload.edgeGroups,
+        name: payload.name,
+        envVars: payload.envVars,
+        prePullImage: payload.prePullImage,
+        registries: payload.registries,
+        retryDeploy: payload.retryDeploy,
+        staggerConfig: payload.staggerConfig,
+        useManifestNamespaces: payload.useManifestNamespaces,
+        stackFileContent: payload.fileContent,
+        webhook: payload.webhook,
+      });
+    default:
+      throw new Error('Invalid method');
+  }
+}
+
+function createEdgeStackFromGit(
+  payload: BasePayload & {
+    git: GitFormModel;
+    relativePathSettings?: RelativePathModel;
+    autoUpdate: AutoUpdateResponse | null;
+  }
+) {
+  return createStackFromGit({
+    deploymentType: payload.deploymentType,
+    edgeGroups: payload.edgeGroups,
+    name: payload.name,
+    envVars: payload.envVars,
+    prePullImage: payload.prePullImage,
+    registries: payload.registries,
+    retryDeploy: payload.retryDeploy,
+    staggerConfig: payload.staggerConfig,
+    useManifestNamespaces: payload.useManifestNamespaces,
+    sourceId: payload.git.SourceId,
+    repositoryReferenceName: payload.git.RepositoryReferenceName,
+    filePathInRepository: payload.git.ComposeFilePathInRepository,
+    filesystemPath: payload.relativePathSettings?.FilesystemPath,
+    supportRelativePath: payload.relativePathSettings?.SupportRelativePath,
+    perDeviceConfigsGroupMatchType:
+      payload.relativePathSettings?.PerDeviceConfigsGroupMatchType,
+    perDeviceConfigsMatchType:
+      payload.relativePathSettings?.PerDeviceConfigsMatchType,
+    perDeviceConfigsPath: payload.relativePathSettings?.PerDeviceConfigsPath,
+    autoUpdate: payload.autoUpdate,
+  });
+}
diff --git a/app/react/edge/edge-stacks/queries/useEdgeStack.ts b/app/react/edge/edge-stacks/queries/useEdgeStack.ts
new file mode 100644
index 0000000..7042559
--- /dev/null
+++ b/app/react/edge/edge-stacks/queries/useEdgeStack.ts
@@ -0,0 +1,43 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { withError } from '@/react-tools/react-query';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { EdgeStack } from '../types';
+
+import { buildUrl } from './buildUrl';
+import { queryKeys } from './query-keys';
+
+export function useEdgeStack(
+  id?: EdgeStack['Id'],
+  {
+    refetchInterval,
+  }: {
+    /**
+     * If set to a number, the query will continuously refetch at this frequency in milliseconds. If set to a function, the function will be executed with the latest data and query to compute a frequency Defaults to false.
+     */
+    refetchInterval?:
+      | number
+      | false
+      | ((data?: Awaited<ReturnType<typeof getEdgeStack>>) => false | number);
+  } = {}
+) {
+  return useQuery(id ? queryKeys.item(id) : [], () => getEdgeStack(id), {
+    ...withError('Failed loading Edge stack'),
+    enabled: !!id,
+    refetchInterval,
+  });
+}
+
+export async function getEdgeStack(id?: EdgeStack['Id']) {
+  if (!id) {
+    return null;
+  }
+
+  try {
+    const { data } = await axios.get<EdgeStack>(buildUrl(id));
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e as Error);
+  }
+}
diff --git a/app/react/edge/edge-stacks/queries/useEdgeStackFile.ts b/app/react/edge/edge-stacks/queries/useEdgeStackFile.ts
new file mode 100644
index 0000000..423a39b
--- /dev/null
+++ b/app/react/edge/edge-stacks/queries/useEdgeStackFile.ts
@@ -0,0 +1,44 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { EdgeStack } from '../types';
+
+import { buildUrl } from './buildUrl';
+import { queryKeys } from './query-keys';
+
+export function useEdgeStackFile(
+  id: EdgeStack['Id'],
+  { skipErrors, version }: { version?: number; skipErrors?: boolean } = {}
+) {
+  return useQuery({
+    queryKey: queryKeys.file(id, version),
+    queryFn: () =>
+      getEdgeStackFile(id, version).catch((e) => {
+        if (!skipErrors) {
+          throw e;
+        }
+
+        return '';
+      }),
+  });
+}
+
+interface StackFileResponse {
+  StackFileContent: string;
+}
+
+export async function getEdgeStackFile(id?: EdgeStack['Id'], version?: number) {
+  if (!id) {
+    return null;
+  }
+
+  try {
+    const { data } = await axios.get<StackFileResponse>(buildUrl(id, 'file'), {
+      params: { version },
+    });
+    return data.StackFileContent;
+  } catch (e) {
+    throw parseAxiosError(e as Error);
+  }
+}
diff --git a/app/react/edge/edge-stacks/queries/useEdgeStacks.ts b/app/react/edge/edge-stacks/queries/useEdgeStacks.ts
new file mode 100644
index 0000000..bb8a782
--- /dev/null
+++ b/app/react/edge/edge-stacks/queries/useEdgeStacks.ts
@@ -0,0 +1,39 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { withError } from '@/react-tools/react-query';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { EdgeStack } from '../types';
+
+import { buildUrl } from './buildUrl';
+import { queryKeys } from './query-keys';
+
+type QueryParams = {
+  summarizeStatuses?: boolean;
+};
+
+export function useEdgeStacks<T extends EdgeStack[] = EdgeStack[]>({
+  params,
+  refetchInterval,
+}: {
+  params?: QueryParams;
+  refetchInterval?: number | false | ((data?: T) => false | number);
+} = {}) {
+  return useQuery({
+    queryKey: queryKeys.base(),
+    queryFn: () => getEdgeStacks<T>(params),
+    refetchInterval,
+    ...withError('Failed loading Edge stack'),
+  });
+}
+
+async function getEdgeStacks<T extends EdgeStack[] = EdgeStack[]>(
+  params: QueryParams = {}
+) {
+  try {
+    const { data } = await axios.get<T>(buildUrl(), { params });
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e as Error);
+  }
+}
diff --git a/app/react/edge/edge-stacks/queries/useParseRegistries.ts b/app/react/edge/edge-stacks/queries/useParseRegistries.ts
new file mode 100644
index 0000000..edebf79
--- /dev/null
+++ b/app/react/edge/edge-stacks/queries/useParseRegistries.ts
@@ -0,0 +1,45 @@
+import { useMutation } from '@tanstack/react-query';
+
+import { RegistryId } from '@/react/portainer/registries/types/registry';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { json2formData } from '@/portainer/helpers/json';
+
+import { buildUrl } from './buildUrl';
+
+export function useParseRegistries() {
+  return useMutation(
+    parseRegistries
+    // handle errors in the calling function (notifyError vs setting form errors in validation)
+  );
+}
+
+export async function parseRegistries({
+  file,
+  fileContent,
+}: {
+  file?: File;
+  fileContent?: string;
+}) {
+  if (!file && !fileContent) {
+    return [];
+  }
+
+  let currentFile = file;
+  if (!file && fileContent) {
+    currentFile = new File([fileContent], 'registries.yml');
+  }
+  try {
+    const { data } = await axios.post<Array<RegistryId>>(
+      buildUrl(undefined, 'parse_registries'),
+      json2formData({ file: currentFile }),
+      {
+        headers: {
+          'Content-Type': 'multipart/form-data',
+        },
+      }
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e as Error);
+  }
+}
diff --git a/app/react/edge/edge-stacks/types.ts b/app/react/edge/edge-stacks/types.ts
new file mode 100644
index 0000000..78f3374
--- /dev/null
+++ b/app/react/edge/edge-stacks/types.ts
@@ -0,0 +1,112 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import {
+  AutoUpdateResponse,
+  RelativePathModel,
+  RepoConfigResponse,
+} from '@/react/portainer/gitops/types';
+import { RegistryId } from '@/react/portainer/registries/types/registry';
+
+import { EnvVar } from '@@/form-components/EnvironmentVariablesFieldset/types';
+
+import { EdgeGroup } from '../edge-groups/types';
+
+import { type StaggerConfig } from './components/StaggerFieldset.types';
+
+export {
+  type StaggerConfig,
+  StaggerOption,
+  StaggerParallelOption,
+  UpdateFailureAction,
+} from './components/StaggerFieldset.types';
+
+export enum StatusType {
+  /** Pending represents a pending edge stack */
+  Pending,
+  /** DeploymentReceived represents an edge environment which received the edge stack deployment */
+  DeploymentReceived,
+  /** Error represents an edge environment which failed to deploy its edge stack */
+  Error,
+  /** Acknowledged represents an acknowledged edge stack */
+  Acknowledged,
+  /** Removed represents a removed edge stack */
+  Removed,
+  /** StatusRemoteUpdateSuccess represents a successfully updated edge stack */
+  RemoteUpdateSuccess,
+  /** ImagesPulled represents a successfully images-pulling */
+  ImagesPulled,
+  /** Running represents a running Edge stack */
+  Running,
+  /** Deploying represents an Edge stack which is being deployed */
+  Deploying,
+  /** Removing represents an Edge stack which is being removed */
+  Removing,
+  /** PausedDeploying represents an Edge stack which is paused for deployment */
+  PausedDeploying,
+  /** PausedRemoving represents an Edge stack which is being rolled back */
+  RollingBack,
+  /** PausedRemoving represents an Edge stack which has been rolled back */
+  RolledBack,
+  /** Completed represents a completed Edge stack */
+  Completed,
+}
+
+export interface DeploymentStatus {
+  Type: StatusType;
+  Error: string;
+  Time: number;
+}
+
+interface EdgeStackDeploymentInfo {
+  Version: number;
+  FileVersion: number;
+  ConfigHash: string;
+}
+
+export interface EdgeStackStatus {
+  Status: Array<DeploymentStatus>;
+  EndpointID: EnvironmentId;
+  DeploymentInfo?: EdgeStackDeploymentInfo;
+}
+
+export enum DeploymentType {
+  /** represent an edge stack deployed using a compose file */
+  Compose,
+  /** represent an edge stack deployed using a kubernetes manifest file */
+  Kubernetes,
+}
+
+export type EdgeStack = Partial<RelativePathModel> & {
+  Id: number;
+  Name: string;
+  Status: { [key: EnvironmentId]: EdgeStackStatus };
+  CreationDate: number;
+  EdgeGroups: Array<EdgeGroup['Id']>;
+  ProjectPath: string;
+  EntryPoint: string;
+  Version: number;
+  NumDeployments: number;
+  ManifestPath: string;
+  DeploymentType: DeploymentType;
+  UseManifestNamespaces: boolean;
+  GitSourceId?: number;
+} & Partial<{
+    // EE
+    Registries: RegistryId[];
+    EdgeUpdateID: number;
+    ScheduledTime: string;
+    PrePullImage: boolean;
+    RePullImage: boolean;
+    AutoUpdate?: AutoUpdateResponse;
+    GitConfig?: RepoConfigResponse;
+    Prune: boolean;
+    RetryDeploy: boolean;
+    Webhook: string;
+    StackFileVersion?: number;
+    PreviousDeploymentInfo: EdgeStackDeploymentInfo;
+    EnvVars?: EnvVar[];
+    StaggerConfig?: StaggerConfig;
+    SupportRelativePath: boolean;
+    FilesystemPath?: string;
+  }>;
+
+export { DeploymentType as EditorType };
diff --git a/app/react/edge/edge-stacks/utils.test.ts b/app/react/edge/edge-stacks/utils.test.ts
new file mode 100644
index 0000000..9c899cf
--- /dev/null
+++ b/app/react/edge/edge-stacks/utils.test.ts
@@ -0,0 +1,40 @@
+import { EnvironmentType } from '@/react/portainer/environments/types';
+
+import { EditorType } from './types';
+import { getValidEditorTypes } from './utils';
+
+interface GetValidEditorTypesTest {
+  endpointTypes: EnvironmentType[];
+  expected: EditorType[];
+  title: string;
+}
+
+describe('getValidEditorTypes', () => {
+  const tests: GetValidEditorTypesTest[] = [
+    {
+      endpointTypes: [EnvironmentType.EdgeAgentOnDocker],
+      expected: [EditorType.Compose],
+      title: 'should return compose for docker envs',
+    },
+    {
+      endpointTypes: [EnvironmentType.EdgeAgentOnKubernetes],
+      expected: [EditorType.Kubernetes],
+      title: 'should return kubernetes for kubernetes envs',
+    },
+    {
+      endpointTypes: [
+        EnvironmentType.EdgeAgentOnDocker,
+        EnvironmentType.EdgeAgentOnKubernetes,
+      ],
+      expected: [],
+      title: 'should return empty for docker and kubernetes envs',
+    },
+  ];
+
+  tests.forEach((test) => {
+    // eslint-disable-next-line vitest/valid-title
+    it(test.title, () => {
+      expect(getValidEditorTypes(test.endpointTypes)).toEqual(test.expected);
+    });
+  });
+});
diff --git a/app/react/edge/edge-stacks/utils.ts b/app/react/edge/edge-stacks/utils.ts
new file mode 100644
index 0000000..82cbfec
--- /dev/null
+++ b/app/react/edge/edge-stacks/utils.ts
@@ -0,0 +1,21 @@
+import _ from 'lodash';
+
+import { EnvironmentType } from '@/react/portainer/environments/types';
+
+import { EditorType } from './types';
+
+export function getValidEditorTypes(
+  endpointTypes: EnvironmentType[],
+  allowKubeToSelectCompose?: boolean
+) {
+  const right: Partial<Record<EnvironmentType, EditorType[]>> = {
+    [EnvironmentType.EdgeAgentOnDocker]: [EditorType.Compose],
+    [EnvironmentType.EdgeAgentOnKubernetes]: allowKubeToSelectCompose
+      ? [EditorType.Kubernetes, EditorType.Compose]
+      : [EditorType.Kubernetes],
+  };
+
+  return endpointTypes.length
+    ? _.intersection(...endpointTypes.map((type) => right[type]))
+    : [EditorType.Compose, EditorType.Kubernetes];
+}
diff --git a/app/react/edge/edge-stacks/utils/uniqueStatus.ts b/app/react/edge/edge-stacks/utils/uniqueStatus.ts
new file mode 100644
index 0000000..b6d8fc2
--- /dev/null
+++ b/app/react/edge/edge-stacks/utils/uniqueStatus.ts
@@ -0,0 +1,16 @@
+import { DeploymentStatus } from '../types';
+
+/**
+ * returns the latest status object of each type
+ */
+export function uniqueStatus(statusArray: Array<DeploymentStatus> = []) {
+  // keep only the last status object of each type, assume that the last status is the most recent
+  return statusArray.reduce((acc, status) => {
+    const index = acc.findIndex((s) => s.Type === status.Type);
+    if (index === -1) {
+      return [...acc, status];
+    }
+
+    return [...acc.slice(0, index), ...acc.slice(index + 1), status];
+  }, [] as Array<DeploymentStatus>);
+}
diff --git a/app/react/hooks/current-environment-store.ts b/app/react/hooks/current-environment-store.ts
new file mode 100644
index 0000000..9630433
--- /dev/null
+++ b/app/react/hooks/current-environment-store.ts
@@ -0,0 +1,26 @@
+import { createStore } from 'zustand';
+import { persist, subscribeWithSelector } from 'zustand/middleware';
+
+import { keyBuilder } from '@/react/hooks/useLocalStorage';
+
+import { EnvironmentId } from '../portainer/environments/types';
+
+export const environmentStore = createStore<{
+  environmentId?: number;
+  setEnvironmentId(id: EnvironmentId): void;
+  clear(): void;
+}>()(
+  subscribeWithSelector(
+    persist(
+      (set) => ({
+        environmentId: undefined,
+        setEnvironmentId: (id: EnvironmentId) => set({ environmentId: id }),
+        clear: () => set({ environmentId: undefined }),
+      }),
+      {
+        name: keyBuilder('environmentId'),
+        getStorage: () => sessionStorage,
+      }
+    )
+  )
+);
diff --git a/app/react/hooks/useCanExit.ts b/app/react/hooks/useCanExit.ts
new file mode 100644
index 0000000..b7366be
--- /dev/null
+++ b/app/react/hooks/useCanExit.ts
@@ -0,0 +1,17 @@
+/**
+ * Copied from https://github.com/ui-router/react/blob/master/src/hooks/useCanExit.ts
+ * TODO: Use package version of this hook when it becomes available: https://github.com/ui-router/react/pull/1227
+ */
+import { useParentView, useTransitionHook } from '@uirouter/react';
+
+/**
+ * A hook that can stop the router from exiting the state the hook is used in.
+ * If the callback returns true/undefined (or a Promise that resolves to true/undefined), the Transition will be allowed to continue.
+ * If the callback returns false (or a Promise that resolves to false), the Transition will be cancelled.
+ */
+export function useCanExit(
+  canExitCallback: () => boolean | undefined | Promise<boolean | undefined>
+) {
+  const stateName = useParentView().context.name;
+  useTransitionHook('onBefore', { exiting: stateName }, canExitCallback);
+}
diff --git a/app/react/hooks/useCurrentEnvironment.ts b/app/react/hooks/useCurrentEnvironment.ts
new file mode 100644
index 0000000..c65ca07
--- /dev/null
+++ b/app/react/hooks/useCurrentEnvironment.ts
@@ -0,0 +1,8 @@
+import { useEnvironment } from '@/react/portainer/environments/queries';
+
+import { useEnvironmentId } from './useEnvironmentId';
+
+export function useCurrentEnvironment(force = true) {
+  const id = useEnvironmentId(force);
+  return useEnvironment(id, undefined, { excludeSnapshot: false });
+}
diff --git a/app/react/hooks/useDebounce.ts b/app/react/hooks/useDebounce.ts
new file mode 100644
index 0000000..4125df8
--- /dev/null
+++ b/app/react/hooks/useDebounce.ts
@@ -0,0 +1,65 @@
+import { debounce } from 'lodash';
+import { useState, useRef, useCallback, useEffect } from 'react';
+
+// `useRef` to keep the debouncer function (result of the _.debounce call) between rerenders.
+//
+// debouncer func is (value, onChange) => { onChange(value) };
+//
+// Previously written and used as
+// const onChangeDebouncer = useRef(debounce(onChange, 300));
+// onChangeDebouncer.current(value)
+//
+// The issue with the previous syntax is that it was holding the initial state of the `onChange` function passed to `useDebounce()`.
+// When the `onChange` function was using a dynamic context (vars in parent scope/not in its parameters)
+// then invoking the debouncer was producing a result of `onChange` computed uppon the initial state of the function, not the current state.
+//
+// Example of the issue
+//
+// function Component({ value }: { value: string; }) {
+//
+//   function onChange(v: string) {
+//     // This will always print the first value of the "value" prop + the updated value of "v"
+//     // when called from "handleChange".
+//     // This is an issue when the `onChange` is a prop of the component and the real function performs state mutations upflow based on
+//     // values that are in the parent component, as `setDebouncedValue` will only use the initial instance of the `onChange` prop, thus
+//     // the initial state of the parent component.
+//     console.log(value, v)
+//   }
+//
+//   const [debouncedValue, setDebouncedValue] = useDebounce(value, onChange);
+//
+//   function handleChange(newValue: string) {
+//     setDebouncedValue(newValue);
+//   }
+//
+//   return (<Input value={debouncedValue} onChange={(e) => handleChange(e.target.value)} />)
+// }
+export function useDebounce<T = string>(
+  value: T,
+  onChange: (value: T) => void,
+  delay = 300
+) {
+  const [debouncedValue, setDebouncedValue] = useState(value);
+
+  // Do not change. See notes above
+  const onChangeDebouncer = useRef(
+    debounce(
+      (value: T, onChangeFunc: (v: T) => void) => onChangeFunc(value),
+      delay
+    )
+  );
+
+  const handleChange = useCallback(
+    (value: T) => {
+      setDebouncedValue(value);
+      onChangeDebouncer.current(value, onChange);
+    },
+    [onChangeDebouncer, setDebouncedValue, onChange]
+  );
+
+  useEffect(() => {
+    setDebouncedValue(value);
+  }, [value]);
+
+  return [debouncedValue, handleChange] as const;
+}
diff --git a/app/react/hooks/useDebouncedValue.ts b/app/react/hooks/useDebouncedValue.ts
new file mode 100644
index 0000000..854ba3a
--- /dev/null
+++ b/app/react/hooks/useDebouncedValue.ts
@@ -0,0 +1,15 @@
+import { useEffect, useState } from 'react';
+
+export function useDebouncedValue<T>(value: T, delay = 500): T {
+  const [debouncedValue, setDebouncedValue] = useState<T>(value);
+
+  useEffect(() => {
+    const timer = setTimeout(() => setDebouncedValue(value), delay);
+
+    return () => {
+      clearTimeout(timer);
+    };
+  }, [value, delay]);
+
+  return debouncedValue;
+}
diff --git a/app/react/hooks/useDockerComposeSchema/docker-compose-schema.ts b/app/react/hooks/useDockerComposeSchema/docker-compose-schema.ts
new file mode 100644
index 0000000..6440d8f
--- /dev/null
+++ b/app/react/hooks/useDockerComposeSchema/docker-compose-schema.ts
@@ -0,0 +1,1100 @@
+// based on https://github.com/compose-spec/compose-spec/blob/master/schema/compose-spec.json
+// with added descriptions from https://github.com/microsoft/compose-language-service/blob/7a74283ddb866988fed86241f461a657f0aee6d0/src/service/providers/KeyHoverProvider.ts#L57-L184
+// hopefully https://github.com/compose-spec/compose-spec/pull/581 will apply these same changes
+export const dockerComposeSchema = {
+  $schema: 'https://json-schema.org/draft-07/schema',
+  $id: 'compose_spec.json',
+  type: 'object',
+  title: 'Compose Specification',
+  description:
+    'The Compose file is a YAML file defining a multi-containers based application.',
+
+  properties: {
+    version: {
+      type: 'string',
+      description:
+        'The version of the Docker Compose document. Declared for backward compatibility, ignored in recent versions.',
+    },
+
+    name: {
+      type: 'string',
+      description:
+        'Define the Compose project name, until user defines one explicitly.',
+    },
+
+    include: {
+      type: 'array',
+      items: {
+        $ref: '#/definitions/include',
+      },
+      description: 'Compose sub-projects to be included.',
+    },
+
+    services: {
+      type: 'object',
+      description: 'The services in your project.',
+      patternProperties: {
+        '^[a-zA-Z0-9._-]+$': {
+          $ref: '#/definitions/service',
+        },
+      },
+      additionalProperties: false,
+    },
+
+    networks: {
+      type: 'object',
+      description: 'Networks that are shared among multiple services.',
+      patternProperties: {
+        '^[a-zA-Z0-9._-]+$': {
+          $ref: '#/definitions/network',
+        },
+      },
+    },
+
+    volumes: {
+      type: 'object',
+      description: 'Named volumes that are shared among multiple services.',
+      patternProperties: {
+        '^[a-zA-Z0-9._-]+$': {
+          $ref: '#/definitions/volume',
+        },
+      },
+      additionalProperties: false,
+    },
+
+    secrets: {
+      type: 'object',
+      description: 'Secrets that are shared among multiple services.',
+      patternProperties: {
+        '^[a-zA-Z0-9._-]+$': {
+          $ref: '#/definitions/secret',
+        },
+      },
+      additionalProperties: false,
+    },
+
+    configs: {
+      type: 'object',
+      description: 'Configurations for services in the project.',
+      patternProperties: {
+        '^[a-zA-Z0-9._-]+$': {
+          $ref: '#/definitions/config',
+        },
+      },
+      additionalProperties: false,
+    },
+  },
+
+  patternProperties: { '^x-': {} },
+  additionalProperties: false,
+
+  definitions: {
+    service: {
+      type: 'object',
+
+      properties: {
+        develop: { $ref: '#/definitions/development' },
+        deploy: { $ref: '#/definitions/deployment' },
+        annotations: { $ref: '#/definitions/list_or_dict' },
+        attach: { type: ['boolean', 'string'] },
+        build: {
+          oneOf: [
+            { type: 'string' },
+            {
+              type: 'object',
+              description: 'The context used for building the image.',
+              properties: {
+                context: {
+                  type: 'string',
+                  description: 'The context used for building the image.',
+                },
+                dockerfile: {
+                  type: 'string',
+                  description: 'The Dockerfile used for building the image.',
+                },
+                dockerfile_inline: { type: 'string' },
+                entitlements: { type: 'array', items: { type: 'string' } },
+                args: {
+                  $ref: '#/definitions/list_or_dict',
+                  description: 'Arguments used during the image build process.',
+                },
+                ssh: { $ref: '#/definitions/list_or_dict' },
+                labels: { $ref: '#/definitions/list_or_dict' },
+                cache_from: { type: 'array', items: { type: 'string' } },
+                cache_to: { type: 'array', items: { type: 'string' } },
+                no_cache: { type: ['boolean', 'string'] },
+                additional_contexts: { $ref: '#/definitions/list_or_dict' },
+                network: { type: 'string' },
+                pull: { type: ['boolean', 'string'] },
+                target: { type: 'string' },
+                shm_size: { type: ['integer', 'string'] },
+                extra_hosts: { $ref: '#/definitions/extra_hosts' },
+                isolation: { type: 'string' },
+                privileged: { type: ['boolean', 'string'] },
+                secrets: { $ref: '#/definitions/service_config_or_secret' },
+                tags: { type: 'array', items: { type: 'string' } },
+                ulimits: { $ref: '#/definitions/ulimits' },
+                platforms: { type: 'array', items: { type: 'string' } },
+              },
+              additionalProperties: false,
+              patternProperties: { '^x-': {} },
+            },
+          ],
+        },
+        blkio_config: {
+          type: 'object',
+          properties: {
+            device_read_bps: {
+              type: 'array',
+              items: { $ref: '#/definitions/blkio_limit' },
+            },
+            device_read_iops: {
+              type: 'array',
+              items: { $ref: '#/definitions/blkio_limit' },
+            },
+            device_write_bps: {
+              type: 'array',
+              items: { $ref: '#/definitions/blkio_limit' },
+            },
+            device_write_iops: {
+              type: 'array',
+              items: { $ref: '#/definitions/blkio_limit' },
+            },
+            weight: { type: ['integer', 'string'] },
+            weight_device: {
+              type: 'array',
+              items: { $ref: '#/definitions/blkio_weight' },
+            },
+          },
+          additionalProperties: false,
+        },
+        cap_add: {
+          type: 'array',
+          items: { type: 'string' },
+          uniqueItems: true,
+        },
+        cap_drop: {
+          type: 'array',
+          items: { type: 'string' },
+          uniqueItems: true,
+        },
+        cgroup: { type: 'string', enum: ['host', 'private'] },
+        cgroup_parent: { type: 'string' },
+        command: {
+          $ref: '#/definitions/command',
+          description: 'The command that will be run in the container.',
+        },
+        configs: {
+          $ref: '#/definitions/service_config_or_secret',
+          description: 'Configurations the service will have access to.',
+        },
+        container_name: {
+          type: 'string',
+          description: 'The name that will be given to the container.',
+        },
+        cpu_count: {
+          oneOf: [{ type: 'string' }, { type: 'integer', minimum: 0 }],
+        },
+        cpu_percent: {
+          oneOf: [
+            { type: 'string' },
+            { type: 'integer', minimum: 0, maximum: 100 },
+          ],
+        },
+        cpu_shares: { type: ['number', 'string'] },
+        cpu_quota: { type: ['number', 'string'] },
+        cpu_period: { type: ['number', 'string'] },
+        cpu_rt_period: { type: ['number', 'string'] },
+        cpu_rt_runtime: { type: ['number', 'string'] },
+        cpus: { type: ['number', 'string'] },
+        cpuset: { type: 'string' },
+        credential_spec: {
+          type: 'object',
+          properties: {
+            config: { type: 'string' },
+            file: { type: 'string' },
+            registry: { type: 'string' },
+          },
+          additionalProperties: false,
+          patternProperties: { '^x-': {} },
+        },
+        depends_on: {
+          oneOf: [
+            { $ref: '#/definitions/list_of_strings' },
+            {
+              type: 'object',
+              additionalProperties: false,
+              patternProperties: {
+                '^[a-zA-Z0-9._-]+$': {
+                  type: 'object',
+                  additionalProperties: false,
+                  patternProperties: { '^x-': {} },
+                  properties: {
+                    restart: { type: ['boolean', 'string'] },
+                    required: {
+                      type: 'boolean',
+                      default: true,
+                    },
+                    condition: {
+                      type: 'string',
+                      enum: [
+                        'service_started',
+                        'service_healthy',
+                        'service_completed_successfully',
+                      ],
+                    },
+                  },
+                  required: ['condition'],
+                },
+              },
+            },
+          ],
+          description:
+            'Other services that this service depends on, which will be started before this one.',
+        },
+        device_cgroup_rules: { $ref: '#/definitions/list_of_strings' },
+        devices: {
+          type: 'array',
+          items: {
+            oneOf: [
+              { type: 'string' },
+              {
+                type: 'object',
+                required: ['source'],
+                properties: {
+                  source: { type: 'string' },
+                  target: { type: 'string' },
+                  permissions: { type: 'string' },
+                },
+                additionalProperties: false,
+                patternProperties: { '^x-': {} },
+              },
+            ],
+          },
+        },
+        dns: { $ref: '#/definitions/string_or_list' },
+        dns_opt: {
+          type: 'array',
+          items: { type: 'string' },
+          uniqueItems: true,
+        },
+        dns_search: { $ref: '#/definitions/string_or_list' },
+        domainname: { type: 'string' },
+        entrypoint: {
+          $ref: '#/definitions/command',
+          description: 'The entrypoint to the application in the container.',
+        },
+        env_file: {
+          $ref: '#/definitions/env_file',
+          description:
+            'Files containing environment variables that will be included.',
+        },
+        label_file: { $ref: '#/definitions/label_file' },
+        environment: {
+          $ref: '#/definitions/list_or_dict',
+          description: 'Environment variables that will be included.',
+        },
+
+        expose: {
+          type: 'array',
+          items: {
+            type: ['string', 'number'],
+          },
+          uniqueItems: true,
+          description:
+            'Ports exposed to the other services but not to the host machine.',
+        },
+        extends: {
+          oneOf: [
+            { type: 'string' },
+            {
+              type: 'object',
+
+              properties: {
+                service: { type: 'string' },
+                file: { type: 'string' },
+              },
+              required: ['service'],
+              additionalProperties: false,
+            },
+          ],
+        },
+        external_links: {
+          type: 'array',
+          items: { type: 'string' },
+          uniqueItems: true,
+        },
+        extra_hosts: { $ref: '#/definitions/extra_hosts' },
+        gpus: { $ref: '#/definitions/gpus' },
+        group_add: {
+          type: 'array',
+          items: {
+            type: ['string', 'number'],
+          },
+          uniqueItems: true,
+        },
+        healthcheck: {
+          $ref: '#/definitions/healthcheck',
+          description: 'A command for checking if the container is healthy.',
+        },
+        hostname: { type: 'string' },
+        image: {
+          type: 'string',
+          description:
+            'The image that will be pulled for the service. If `build` is specified, the built image will be given this tag.',
+        },
+        init: { type: ['boolean', 'string'] },
+        ipc: { type: 'string' },
+        isolation: { type: 'string' },
+        labels: {
+          $ref: '#/definitions/list_or_dict',
+          description: 'Labels that will be given to the container.',
+        },
+        links: { type: 'array', items: { type: 'string' }, uniqueItems: true },
+        logging: {
+          type: 'object',
+          description: 'Settings for logging for this service.',
+          properties: {
+            driver: { type: 'string' },
+            options: {
+              type: 'object',
+              patternProperties: {
+                '^.+$': { type: ['string', 'number', 'null'] },
+              },
+            },
+          },
+          additionalProperties: false,
+          patternProperties: { '^x-': {} },
+        },
+        mac_address: { type: 'string' },
+        mem_limit: { type: ['number', 'string'] },
+        mem_reservation: { type: ['string', 'integer'] },
+        mem_swappiness: { type: ['integer', 'string'] },
+        memswap_limit: { type: ['number', 'string'] },
+        network_mode: { type: 'string' },
+        networks: {
+          oneOf: [
+            { $ref: '#/definitions/list_of_strings' },
+            {
+              type: 'object',
+              properties: {},
+              patternProperties: {
+                '^[a-zA-Z0-9._-]+$': {
+                  oneOf: [
+                    { type: 'null' },
+                    {
+                      type: 'object',
+                      properties: {
+                        aliases: { $ref: '#/definitions/list_of_strings' },
+                        ipv4_address: { type: 'string' },
+                        ipv6_address: { type: 'string' },
+                        link_local_ips: {
+                          $ref: '#/definitions/list_of_strings',
+                        },
+                        priority: { type: ['number', 'string'] },
+                      },
+                      additionalProperties: false,
+                      patternProperties: { '^x-': {} },
+                    },
+                  ],
+                },
+              },
+              additionalProperties: false,
+            },
+          ],
+          description:
+            'The service will be included in these networks, allowing it to reach other containers on the same network.',
+        },
+        oom_kill_disable: { type: ['boolean', 'string'] },
+        oom_score_adj: {
+          oneOf: [
+            { type: 'string' },
+            { type: 'integer', minimum: -1000, maximum: 1000 },
+          ],
+        },
+        pid: { type: ['string', 'null'] },
+        pids_limit: { type: ['number', 'string'] },
+        platform: { type: 'string' },
+        ports: {
+          type: 'array',
+          items: {
+            oneOf: [
+              { type: ['number', 'string'] },
+              {
+                type: 'object',
+                properties: {
+                  mode: { type: 'string' },
+                  host_ip: { type: 'string' },
+                  target: { type: ['number', 'string'] },
+                  published: { type: ['number', 'string'] },
+                  protocol: { type: 'string' },
+                },
+                additionalProperties: false,
+                patternProperties: { '^x-': {} },
+              },
+            ],
+          },
+          uniqueItems: true,
+          description: 'Ports that will be exposed to the host.',
+        },
+        post_start: {
+          type: 'array',
+          items: { $ref: '#/definitions/service_hook' },
+        },
+        pre_stop: {
+          type: 'array',
+          items: { $ref: '#/definitions/service_hook' },
+        },
+        privileged: { type: ['boolean', 'string'] },
+        profiles: {
+          type: 'array',
+          items: { type: 'string' },
+          uniqueItems: true,
+          description:
+            'Profiles that this service is a part of. When the profile is started, this service will be started.',
+        },
+        pull_policy: {
+          type: 'string',
+          pattern:
+            'always|never|build|if_not_present|missing|refresh|daily|weekly|every_([0-9]+[wdhms])+',
+        },
+        pull_refresh_after: { type: 'string' },
+        read_only: { type: ['boolean', 'string'] },
+        restart: { type: 'string' },
+        runtime: {
+          type: 'string',
+        },
+        scale: {
+          type: ['integer', 'string'],
+        },
+        security_opt: {
+          type: 'array',
+          items: { type: 'string' },
+          uniqueItems: true,
+        },
+        shm_size: { type: ['number', 'string'] },
+        secrets: {
+          $ref: '#/definitions/service_config_or_secret',
+          description: 'Secrets the service will have access to.',
+        },
+        sysctls: { $ref: '#/definitions/list_or_dict' },
+        stdin_open: { type: ['boolean', 'string'] },
+        stop_grace_period: { type: 'string' },
+        stop_signal: { type: 'string' },
+        storage_opt: { type: 'object' },
+        tmpfs: { $ref: '#/definitions/string_or_list' },
+        tty: { type: ['boolean', 'string'] },
+        ulimits: { $ref: '#/definitions/ulimits' },
+        user: {
+          type: 'string',
+          description:
+            'The username under which the app in the container will be started.',
+        },
+        uts: { type: 'string' },
+        userns_mode: { type: 'string' },
+        volumes: {
+          type: 'array',
+          items: {
+            oneOf: [
+              { type: 'string' },
+              {
+                type: 'object',
+                required: ['type'],
+                properties: {
+                  type: { type: 'string' },
+                  source: { type: 'string' },
+                  target: { type: 'string' },
+                  read_only: { type: ['boolean', 'string'] },
+                  consistency: { type: 'string' },
+                  bind: {
+                    type: 'object',
+                    properties: {
+                      propagation: { type: 'string' },
+                      create_host_path: { type: ['boolean', 'string'] },
+                      selinux: { type: 'string', enum: ['z', 'Z'] },
+                    },
+                    additionalProperties: false,
+                    patternProperties: { '^x-': {} },
+                  },
+                  volume: {
+                    type: 'object',
+                    properties: {
+                      nocopy: { type: ['boolean', 'string'] },
+                    },
+                    additionalProperties: false,
+                    patternProperties: { '^x-': {} },
+                  },
+                  tmpfs: {
+                    type: 'object',
+                    properties: {
+                      size: { type: ['number', 'string'] },
+                      mode: { type: ['number', 'string'] },
+                    },
+                    additionalProperties: false,
+                    patternProperties: { '^x-': {} },
+                  },
+                },
+                additionalProperties: false,
+                patternProperties: { '^x-': {} },
+              },
+            ],
+          },
+          uniqueItems: true,
+          description:
+            'Named volumes and paths on the host mapped to paths in the container.',
+        },
+        volumes_from: {
+          type: 'array',
+          items: { type: 'string' },
+          uniqueItems: true,
+        },
+        working_dir: {
+          type: 'string',
+          description:
+            'The working directory in which the entrypoint or command will be run.',
+        },
+      },
+      patternProperties: { '^x-': {} },
+      additionalProperties: false,
+    },
+
+    healthcheck: {
+      type: 'object',
+      properties: {
+        disable: { type: ['boolean', 'string'] },
+        interval: { type: 'string' },
+        retries: { type: ['number', 'string'] },
+        test: {
+          oneOf: [
+            { type: 'string' },
+            { type: 'array', items: { type: 'string' } },
+          ],
+        },
+        timeout: { type: 'string' },
+        start_period: { type: 'string' },
+        start_interval: { type: 'string' },
+      },
+      additionalProperties: false,
+      patternProperties: { '^x-': {} },
+    },
+    development: {
+      type: ['object', 'null'],
+      properties: {
+        watch: {
+          type: 'array',
+          items: {
+            type: 'object',
+            required: ['path', 'action'],
+            properties: {
+              ignore: { $ref: '#/definitions/string_or_list' },
+              include: { $ref: '#/definitions/string_or_list' },
+              path: { type: 'string' },
+              action: {
+                type: 'string',
+                enum: [
+                  'rebuild',
+                  'sync',
+                  'restart',
+                  'sync+restart',
+                  'sync+exec',
+                ],
+              },
+              target: { type: 'string' },
+              exec: { $ref: '#/definitions/service_hook' },
+            },
+            additionalProperties: false,
+            patternProperties: { '^x-': {} },
+          },
+        },
+      },
+      additionalProperties: false,
+      patternProperties: { '^x-': {} },
+    },
+    deployment: {
+      type: ['object', 'null'],
+      properties: {
+        mode: { type: 'string' },
+        endpoint_mode: { type: 'string' },
+        replicas: { type: ['integer', 'string'] },
+        labels: { $ref: '#/definitions/list_or_dict' },
+        rollback_config: {
+          type: 'object',
+          properties: {
+            parallelism: { type: ['integer', 'string'] },
+            delay: { type: 'string' },
+            failure_action: { type: 'string' },
+            monitor: { type: 'string' },
+            max_failure_ratio: { type: ['number', 'string'] },
+            order: { type: 'string', enum: ['start-first', 'stop-first'] },
+          },
+          additionalProperties: false,
+          patternProperties: { '^x-': {} },
+        },
+        update_config: {
+          type: 'object',
+          properties: {
+            parallelism: { type: ['integer', 'string'] },
+            delay: { type: 'string' },
+            failure_action: { type: 'string' },
+            monitor: { type: 'string' },
+            max_failure_ratio: { type: ['number', 'string'] },
+            order: { type: 'string', enum: ['start-first', 'stop-first'] },
+          },
+          additionalProperties: false,
+          patternProperties: { '^x-': {} },
+        },
+        resources: {
+          type: 'object',
+          properties: {
+            limits: {
+              type: 'object',
+              properties: {
+                cpus: { type: ['number', 'string'] },
+                memory: { type: 'string' },
+                pids: { type: ['integer', 'string'] },
+              },
+              additionalProperties: false,
+              patternProperties: { '^x-': {} },
+            },
+            reservations: {
+              type: 'object',
+              properties: {
+                cpus: { type: ['number', 'string'] },
+                memory: { type: 'string' },
+                generic_resources: { $ref: '#/definitions/generic_resources' },
+                devices: { $ref: '#/definitions/devices' },
+              },
+              additionalProperties: false,
+              patternProperties: { '^x-': {} },
+            },
+          },
+          additionalProperties: false,
+          patternProperties: { '^x-': {} },
+        },
+        restart_policy: {
+          type: 'object',
+          properties: {
+            condition: { type: 'string' },
+            delay: { type: 'string' },
+            max_attempts: { type: ['integer', 'string'] },
+            window: { type: 'string' },
+          },
+          additionalProperties: false,
+          patternProperties: { '^x-': {} },
+        },
+        placement: {
+          type: 'object',
+          properties: {
+            constraints: { type: 'array', items: { type: 'string' } },
+            preferences: {
+              type: 'array',
+              items: {
+                type: 'object',
+                properties: {
+                  spread: { type: 'string' },
+                },
+                additionalProperties: false,
+                patternProperties: { '^x-': {} },
+              },
+            },
+            max_replicas_per_node: { type: ['integer', 'string'] },
+          },
+          additionalProperties: false,
+          patternProperties: { '^x-': {} },
+        },
+      },
+      additionalProperties: false,
+      patternProperties: { '^x-': {} },
+    },
+
+    generic_resources: {
+      type: 'array',
+      items: {
+        type: 'object',
+        properties: {
+          discrete_resource_spec: {
+            type: 'object',
+            properties: {
+              kind: { type: 'string' },
+              value: { type: ['number', 'string'] },
+            },
+            additionalProperties: false,
+            patternProperties: { '^x-': {} },
+          },
+        },
+        additionalProperties: false,
+        patternProperties: { '^x-': {} },
+      },
+    },
+
+    devices: {
+      type: 'array',
+      items: {
+        type: 'object',
+        properties: {
+          capabilities: { $ref: '#/definitions/list_of_strings' },
+          count: { type: ['string', 'integer'] },
+          device_ids: { $ref: '#/definitions/list_of_strings' },
+          driver: { type: 'string' },
+          options: { $ref: '#/definitions/list_or_dict' },
+        },
+        additionalProperties: false,
+        patternProperties: { '^x-': {} },
+        required: ['capabilities'],
+      },
+    },
+
+    gpus: {
+      oneOf: [
+        { type: 'string', enum: ['all'] },
+        {
+          type: 'array',
+          items: {
+            type: 'object',
+            properties: {
+              capabilities: { $ref: '#/definitions/list_of_strings' },
+              count: { type: ['string', 'integer'] },
+              device_ids: { $ref: '#/definitions/list_of_strings' },
+              driver: { type: 'string' },
+              options: { $ref: '#/definitions/list_or_dict' },
+            },
+          },
+          additionalProperties: false,
+          patternProperties: { '^x-': {} },
+        },
+      ],
+    },
+
+    include: {
+      oneOf: [
+        { type: 'string' },
+        {
+          type: 'object',
+          properties: {
+            path: { $ref: '#/definitions/string_or_list' },
+            env_file: { $ref: '#/definitions/string_or_list' },
+            project_directory: { type: 'string' },
+          },
+          additionalProperties: false,
+        },
+      ],
+    },
+
+    network: {
+      type: ['object', 'null'],
+      properties: {
+        name: { type: 'string' },
+        driver: {
+          type: 'string',
+          description: 'The driver used for this network.',
+        },
+        driver_opts: {
+          type: 'object',
+          patternProperties: {
+            '^.+$': { type: ['string', 'number'] },
+          },
+        },
+        ipam: {
+          type: 'object',
+          properties: {
+            driver: { type: 'string' },
+            config: {
+              type: 'array',
+              items: {
+                type: 'object',
+                properties: {
+                  subnet: { type: 'string' },
+                  ip_range: { type: 'string' },
+                  gateway: { type: 'string' },
+                  aux_addresses: {
+                    type: 'object',
+                    additionalProperties: false,
+                    patternProperties: { '^.+$': { type: 'string' } },
+                  },
+                },
+                additionalProperties: false,
+                patternProperties: { '^x-': {} },
+              },
+            },
+            options: {
+              type: 'object',
+              additionalProperties: false,
+              patternProperties: { '^.+$': { type: 'string' } },
+            },
+          },
+          additionalProperties: false,
+          patternProperties: { '^x-': {} },
+        },
+        external: {
+          type: ['boolean', 'string', 'object'],
+          properties: {
+            name: {
+              deprecated: true,
+              type: 'string',
+            },
+          },
+          additionalProperties: false,
+          patternProperties: { '^x-': {} },
+        },
+        internal: { type: ['boolean', 'string'] },
+        enable_ipv4: { type: ['boolean', 'string'] },
+        enable_ipv6: { type: ['boolean', 'string'] },
+        attachable: { type: ['boolean', 'string'] },
+        labels: { $ref: '#/definitions/list_or_dict' },
+      },
+      additionalProperties: false,
+      patternProperties: { '^x-': {} },
+    },
+
+    volume: {
+      type: ['object', 'null'],
+      properties: {
+        name: { type: 'string' },
+        driver: {
+          type: 'string',
+          description: 'The driver used for this volume.',
+        },
+        driver_opts: {
+          type: 'object',
+          patternProperties: {
+            '^.+$': { type: ['string', 'number'] },
+          },
+        },
+        external: {
+          type: ['boolean', 'string', 'object'],
+          properties: {
+            name: {
+              deprecated: true,
+              type: 'string',
+            },
+          },
+          additionalProperties: false,
+          patternProperties: { '^x-': {} },
+        },
+        labels: { $ref: '#/definitions/list_or_dict' },
+      },
+      additionalProperties: false,
+      patternProperties: { '^x-': {} },
+    },
+
+    secret: {
+      type: 'object',
+      properties: {
+        name: { type: 'string' },
+        environment: { type: 'string' },
+        file: { type: 'string' },
+        external: {
+          type: ['boolean', 'string', 'object'],
+          properties: {
+            name: { type: 'string' },
+          },
+        },
+        labels: { $ref: '#/definitions/list_or_dict' },
+        driver: { type: 'string' },
+        driver_opts: {
+          type: 'object',
+          patternProperties: {
+            '^.+$': { type: ['string', 'number'] },
+          },
+        },
+        template_driver: { type: 'string' },
+      },
+      additionalProperties: false,
+      patternProperties: { '^x-': {} },
+    },
+
+    config: {
+      type: 'object',
+      properties: {
+        name: { type: 'string' },
+        content: { type: 'string' },
+        environment: { type: 'string' },
+        file: { type: 'string' },
+        external: {
+          type: ['boolean', 'string', 'object'],
+          properties: {
+            name: {
+              deprecated: true,
+              type: 'string',
+            },
+          },
+        },
+        labels: { $ref: '#/definitions/list_or_dict' },
+        template_driver: { type: 'string' },
+      },
+      additionalProperties: false,
+      patternProperties: { '^x-': {} },
+    },
+
+    command: {
+      oneOf: [
+        { type: 'null' },
+        { type: 'string' },
+        { type: 'array', items: { type: 'string' } },
+      ],
+    },
+
+    service_hook: {
+      type: 'object',
+      properties: {
+        command: { $ref: '#/definitions/command' },
+        user: { type: 'string' },
+        privileged: { type: ['boolean', 'string'] },
+        working_dir: { type: 'string' },
+        environment: { $ref: '#/definitions/list_or_dict' },
+      },
+      additionalProperties: false,
+      patternProperties: { '^x-': {} },
+      required: ['command'],
+    },
+
+    env_file: {
+      oneOf: [
+        { type: 'string' },
+        {
+          type: 'array',
+          items: {
+            oneOf: [
+              { type: 'string' },
+              {
+                type: 'object',
+                additionalProperties: false,
+                properties: {
+                  path: {
+                    type: 'string',
+                  },
+                  format: {
+                    type: 'string',
+                  },
+                  required: {
+                    type: ['boolean', 'string'],
+                    default: true,
+                  },
+                },
+                required: ['path'],
+              },
+            ],
+          },
+        },
+      ],
+    },
+
+    label_file: {
+      oneOf: [
+        { type: 'string' },
+        {
+          type: 'array',
+          items: { type: 'string' },
+        },
+      ],
+    },
+
+    string_or_list: {
+      oneOf: [{ type: 'string' }, { $ref: '#/definitions/list_of_strings' }],
+    },
+
+    list_of_strings: {
+      type: 'array',
+      items: { type: 'string' },
+      uniqueItems: true,
+    },
+
+    list_or_dict: {
+      oneOf: [
+        {
+          type: 'object',
+          patternProperties: {
+            '.+': {
+              type: ['string', 'number', 'boolean', 'null'],
+            },
+          },
+          additionalProperties: false,
+        },
+        { type: 'array', items: { type: 'string' }, uniqueItems: true },
+      ],
+    },
+
+    extra_hosts: {
+      oneOf: [
+        {
+          type: 'object',
+          patternProperties: {
+            '.+': {
+              oneOf: [
+                {
+                  type: 'string',
+                },
+                {
+                  type: 'array',
+                  items: {
+                    type: 'string',
+                  },
+                  uniqueItems: false,
+                },
+              ],
+            },
+          },
+          additionalProperties: false,
+        },
+        { type: 'array', items: { type: 'string' }, uniqueItems: true },
+      ],
+    },
+
+    blkio_limit: {
+      type: 'object',
+      properties: {
+        path: { type: 'string' },
+        rate: { type: ['integer', 'string'] },
+      },
+      additionalProperties: false,
+    },
+    blkio_weight: {
+      type: 'object',
+      properties: {
+        path: { type: 'string' },
+        weight: { type: ['integer', 'string'] },
+      },
+      additionalProperties: false,
+    },
+    service_config_or_secret: {
+      type: 'array',
+      items: {
+        oneOf: [
+          { type: 'string' },
+          {
+            type: 'object',
+            properties: {
+              source: { type: 'string' },
+              target: { type: 'string' },
+              uid: { type: 'string' },
+              gid: { type: 'string' },
+              mode: { type: ['number', 'string'] },
+            },
+            additionalProperties: false,
+            patternProperties: { '^x-': {} },
+          },
+        ],
+      },
+    },
+    ulimits: {
+      type: 'object',
+      patternProperties: {
+        '^[a-z]+$': {
+          oneOf: [
+            { type: ['integer', 'string'] },
+            {
+              type: 'object',
+              properties: {
+                hard: { type: ['integer', 'string'] },
+                soft: { type: ['integer', 'string'] },
+              },
+              required: ['soft', 'hard'],
+              additionalProperties: false,
+              patternProperties: { '^x-': {} },
+            },
+          ],
+        },
+      },
+    },
+  },
+};
diff --git a/app/react/hooks/useDockerComposeSchema/useDockerComposeSchema.ts b/app/react/hooks/useDockerComposeSchema/useDockerComposeSchema.ts
new file mode 100644
index 0000000..64897ab
--- /dev/null
+++ b/app/react/hooks/useDockerComposeSchema/useDockerComposeSchema.ts
@@ -0,0 +1,37 @@
+import { JSONSchema7 } from 'json-schema';
+import { useQuery } from '@tanstack/react-query';
+import axios from 'axios';
+
+import { dockerComposeSchema } from './docker-compose-schema';
+
+const COMPOSE_SCHEMA_URL =
+  'https://raw.githubusercontent.com/compose-spec/compose-spec/master/schema/compose-spec.json';
+
+export function useDockerComposeSchema() {
+  return useQuery<JSONSchema7>(
+    ['docker-compose-schema'],
+    getDockerComposeSchema,
+    {
+      staleTime: 24 * 60 * 60 * 1000, // 24 hours
+      cacheTime: 24 * 24 * 60 * 60 * 1000, // 24 days - cacheTime is a 32 bit signed integer - so it can't be more than 24 days
+      retry: 1,
+      refetchOnWindowFocus: false,
+      // Start with local schema while fetching
+      initialData: dockerComposeSchema as JSONSchema7,
+    }
+  );
+}
+
+export async function getDockerComposeSchema() {
+  try {
+    const response = await axios.get<JSONSchema7>(COMPOSE_SCHEMA_URL);
+    // just in case a non-object is returned from a proxy
+    if (typeof response.data !== 'object') {
+      return dockerComposeSchema as JSONSchema7;
+    }
+    return response.data;
+  } catch (error) {
+    // Return the local schema as fallback for airgapped environments
+    return dockerComposeSchema as JSONSchema7;
+  }
+}
diff --git a/app/react/hooks/useEnvironmentId.ts b/app/react/hooks/useEnvironmentId.ts
new file mode 100644
index 0000000..be75e2c
--- /dev/null
+++ b/app/react/hooks/useEnvironmentId.ts
@@ -0,0 +1,25 @@
+import { useCurrentStateAndParams } from '@uirouter/react';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+/**
+ * useEnvironmentId is a hook that returns the environmentId from the url params.
+ * use only when endpointId is set in the path.
+ * for example: /kubernetes/clusters/:endpointId
+ * for `:id` paths, use a different hook
+ */
+export function useEnvironmentId(force = true): EnvironmentId {
+  const {
+    params: { endpointId: environmentId },
+  } = useCurrentStateAndParams();
+
+  if (!environmentId) {
+    if (!force) {
+      return 0;
+    }
+
+    throw new Error('endpointId url param is required');
+  }
+
+  return parseInt(environmentId, 10);
+}
diff --git a/app/react/hooks/useId.ts b/app/react/hooks/useId.ts
new file mode 100644
index 0000000..a37dca7
--- /dev/null
+++ b/app/react/hooks/useId.ts
@@ -0,0 +1,12 @@
+import { useState } from 'react';
+
+let idCounter = 0;
+
+/**
+ * Generates a stable unique ID per component instance.
+ * Replace with React.useId() after upgrading to React 18.
+ */
+export function useId() {
+  const [id] = useState(() => `ps-id-${++idCounter}`);
+  return id;
+}
diff --git a/app/react/hooks/useIdParam.ts b/app/react/hooks/useIdParam.ts
new file mode 100644
index 0000000..b1216c5
--- /dev/null
+++ b/app/react/hooks/useIdParam.ts
@@ -0,0 +1,13 @@
+import { useCurrentStateAndParams } from '@uirouter/react';
+
+export function useIdParam(param = 'id'): number {
+  const { params } = useCurrentStateAndParams();
+
+  const stringId = params[param];
+  const id = parseInt(stringId, 10);
+  if (!id || Number.isNaN(id)) {
+    throw new Error(`${param} url param is required`);
+  }
+
+  return id;
+}
diff --git a/app/react/hooks/useInfoPanelState.tsx b/app/react/hooks/useInfoPanelState.tsx
new file mode 100644
index 0000000..4ca34ff
--- /dev/null
+++ b/app/react/hooks/useInfoPanelState.tsx
@@ -0,0 +1,16 @@
+import { useUIState } from '@/react/hooks/useUIState';
+
+export function useInfoPanelState(panelId: string) {
+  const uiStateStore = useUIState();
+
+  const isVisible = !uiStateStore.dismissedInfoPanels[panelId];
+
+  return {
+    isVisible,
+    dismiss,
+  };
+
+  function dismiss() {
+    uiStateStore.dismissInfoPanel(panelId);
+  }
+}
diff --git a/app/react/hooks/useIsDeploymentOptionHidden.ts b/app/react/hooks/useIsDeploymentOptionHidden.ts
new file mode 100644
index 0000000..a8a50fe
--- /dev/null
+++ b/app/react/hooks/useIsDeploymentOptionHidden.ts
@@ -0,0 +1,25 @@
+import { useEnvironmentDeploymentOptions } from '@/react/portainer/environments/queries/useEnvironment';
+
+import { useEnvironmentId } from './useEnvironmentId';
+
+type HideDeploymentOption = 'form' | 'webEditor' | 'fileUpload';
+
+export function useIsDeploymentOptionHidden(
+  hideDeploymentOption: HideDeploymentOption
+) {
+  const environmentId = useEnvironmentId();
+  const { data: deploymentOptions } =
+    useEnvironmentDeploymentOptions(environmentId);
+
+  if (deploymentOptions) {
+    const isDeploymentOptionHidden =
+      (hideDeploymentOption === 'form' && deploymentOptions.hideAddWithForm) ||
+      (hideDeploymentOption === 'webEditor' &&
+        deploymentOptions.hideAddWithForm) ||
+      (hideDeploymentOption === 'fileUpload' &&
+        deploymentOptions.hideAddWithForm);
+    return isDeploymentOptionHidden;
+  }
+
+  return false;
+}
diff --git a/app/react/hooks/useLimitToBE.tsx b/app/react/hooks/useLimitToBE.tsx
new file mode 100644
index 0000000..8478eb3
--- /dev/null
+++ b/app/react/hooks/useLimitToBE.tsx
@@ -0,0 +1,38 @@
+import { useRouter } from '@uirouter/react';
+import { ComponentType } from 'react';
+
+import { isBE } from '@/react/portainer/feature-flags/feature-flags.service';
+
+export function useLimitToBE(defaultPath = 'portainer.home') {
+  const router = useRouter();
+  if (!isBE) {
+    router.stateService.go(defaultPath);
+    return true;
+  }
+
+  return false;
+}
+
+export function withLimitToBE<T>(
+  WrappedComponent: ComponentType<T>,
+  defaultPath = 'portainer.home'
+): ComponentType<T> {
+  // Try to create a nice displayName for React Dev Tools.
+  const displayName =
+    WrappedComponent.displayName || WrappedComponent.name || 'Component';
+
+  function WrapperComponent(props: T & JSX.IntrinsicAttributes) {
+    const isLimitedToBE = useLimitToBE(defaultPath);
+
+    if (isLimitedToBE) {
+      return null;
+    }
+
+    // eslint-disable-next-line react/jsx-props-no-spreading
+    return <WrappedComponent {...props} />;
+  }
+
+  WrapperComponent.displayName = `withLimitToBE(${displayName})`;
+
+  return WrapperComponent;
+}
diff --git a/app/react/hooks/useListSelection.ts b/app/react/hooks/useListSelection.ts
new file mode 100644
index 0000000..6e72f74
--- /dev/null
+++ b/app/react/hooks/useListSelection.ts
@@ -0,0 +1,20 @@
+import { useState } from 'react';
+
+export function useListSelection<T>(
+  initialValue: Array<T> = [],
+  compareFn: (a: T, b: T) => boolean = (a, b) => a === b
+) {
+  const [selectedItems, setSelectedItems] = useState<Array<T>>(initialValue);
+
+  function handleChangeSelect(currentItem: T, selected: boolean) {
+    if (selected) {
+      setSelectedItems((items) => [...items, currentItem]);
+    } else {
+      setSelectedItems((items) =>
+        items.filter((item) => !compareFn(item, currentItem))
+      );
+    }
+  }
+
+  return [selectedItems, handleChangeSelect] as const;
+}
diff --git a/app/react/hooks/useLocalStorage.ts b/app/react/hooks/useLocalStorage.ts
new file mode 100644
index 0000000..f299896
--- /dev/null
+++ b/app/react/hooks/useLocalStorage.ts
@@ -0,0 +1,46 @@
+import { useState, useCallback, useMemo } from 'react';
+
+const localStoragePrefix = 'portainer';
+
+export function keyBuilder(key: string) {
+  return `${localStoragePrefix}.${key}`;
+}
+
+export function useLocalStorage<T>(
+  key: string,
+  defaultValue: T,
+  storage = localStorage
+): [T, (value: T) => void] {
+  const [value, setValue] = useState(get<T>(key, defaultValue, storage));
+
+  const handleChange = useCallback(
+    (value) => {
+      setValue(value);
+      set<T>(key, value, storage);
+    },
+    [key, storage]
+  );
+
+  return useMemo(() => [value, handleChange], [value, handleChange]);
+}
+
+export function get<T>(
+  key: string,
+  defaultValue: T,
+  storage = localStorage
+): T {
+  const value = storage.getItem(keyBuilder(key));
+  if (!value) {
+    return defaultValue;
+  }
+
+  try {
+    return JSON.parse(value);
+  } catch (e) {
+    return defaultValue;
+  }
+}
+
+export function set<T>(key: string, value: T, storage = localStorage) {
+  storage.setItem(keyBuilder(key), JSON.stringify(value));
+}
diff --git a/app/react/hooks/usePaginationLimitState.ts b/app/react/hooks/usePaginationLimitState.ts
new file mode 100644
index 0000000..bfb2347
--- /dev/null
+++ b/app/react/hooks/usePaginationLimitState.ts
@@ -0,0 +1,14 @@
+import { useLocalStorage } from './useLocalStorage';
+
+export function usePaginationLimitState(
+  key: string
+): [number, (value: number) => void] {
+  const paginationKey = paginationKeyBuilder(key);
+  const [pageLimit, setPageLimit] = useLocalStorage(paginationKey, 10);
+
+  return [pageLimit, setPageLimit];
+
+  function paginationKeyBuilder(key: string) {
+    return `datatable_pagination_${key}`;
+  }
+}
diff --git a/app/react/hooks/useParamState.test.ts b/app/react/hooks/useParamState.test.ts
new file mode 100644
index 0000000..ec29bb8
--- /dev/null
+++ b/app/react/hooks/useParamState.test.ts
@@ -0,0 +1,290 @@
+import { renderHook, act } from '@testing-library/react-hooks';
+import { vi, describe, it, expect, beforeEach } from 'vitest';
+
+import { keyBuilder } from './useLocalStorage';
+import {
+  useParamState,
+  useParamsState,
+  usePersistedParamsState,
+} from './useParamState';
+
+const mockGo = vi.fn();
+let mockUrlParams: Record<string, unknown> = {};
+
+vi.mock('@uirouter/react', () => ({
+  useCurrentStateAndParams: () => ({ params: mockUrlParams }),
+  useRouter: () => ({ stateService: { go: mockGo } }),
+}));
+
+type State = {
+  status: string | null;
+  sort: string;
+  search: string;
+};
+
+function parse(params: Record<string, unknown>): State {
+  return {
+    status: typeof params.status === 'string' ? params.status : null,
+    sort: typeof params.sort === 'string' ? params.sort : 'name',
+    search: typeof params.search === 'string' ? params.search : '',
+  };
+}
+
+const STORAGE_KEY = 'test-persisted';
+const STORAGE_KEY_FULL = keyBuilder(STORAGE_KEY);
+const PERSIST = { storageKey: STORAGE_KEY, persistedKeys: ['status', 'sort'] };
+
+describe('useParamState', () => {
+  beforeEach(() => {
+    mockUrlParams = {};
+    mockGo.mockClear();
+  });
+
+  it('returns the param value from URL', () => {
+    mockUrlParams = { filter: 'active' };
+
+    const { result } = renderHook(() => useParamState('filter'));
+
+    expect(result.current[0]).toBe('active');
+  });
+
+  it('returns undefined when param is absent', () => {
+    mockUrlParams = {};
+
+    const { result } = renderHook(() => useParamState('filter'));
+
+    expect(result.current[0]).toBeUndefined();
+  });
+
+  it('applies a custom parser', () => {
+    mockUrlParams = { count: '7' };
+
+    const { result } = renderHook(() =>
+      useParamState('count', (v) => parseInt(v ?? '0', 10))
+    );
+
+    expect(result.current[0]).toBe(7);
+  });
+
+  it('setter calls router.go with the new value', () => {
+    mockUrlParams = { filter: 'active' };
+
+    const { result } = renderHook(() => useParamState('filter'));
+
+    act(() => {
+      result.current[1]('inactive');
+    });
+
+    expect(mockGo).toHaveBeenCalledWith(
+      '.',
+      { filter: 'inactive' },
+      { reload: false, location: 'replace' }
+    );
+  });
+});
+
+describe('useParamsState', () => {
+  beforeEach(() => {
+    mockUrlParams = {};
+    mockGo.mockClear();
+  });
+
+  it('returns parsed state from URL params', () => {
+    mockUrlParams = { a: '1', b: '2' };
+
+    const { result } = renderHook(() =>
+      useParamsState((params) => ({ a: params.a ?? '', b: params.b ?? '' }))
+    );
+
+    expect(result.current[0]).toEqual({ a: '1', b: '2' });
+  });
+
+  it('setState calls router.go with the partial update', () => {
+    mockUrlParams = { a: '1', b: '2' };
+
+    const { result } = renderHook(() =>
+      useParamsState((params) => ({ a: params.a ?? '', b: params.b ?? '' }))
+    );
+
+    act(() => {
+      result.current[1]({ a: 'updated' });
+    });
+
+    expect(mockGo).toHaveBeenCalledWith(
+      '.',
+      { a: 'updated' },
+      { reload: false, location: 'replace' }
+    );
+  });
+});
+
+describe('usePersistedParamsState', () => {
+  beforeEach(() => {
+    mockUrlParams = {};
+    mockGo.mockClear();
+    vi.useFakeTimers();
+    localStorage.clear();
+  });
+
+  it('returns parsed state from URL params', () => {
+    mockUrlParams = { status: 'healthy', sort: 'date', search: 'foo' };
+
+    const { result } = renderHook(() =>
+      usePersistedParamsState(parse, PERSIST)
+    );
+
+    expect(result.current[0]).toEqual({
+      status: 'healthy',
+      sort: 'date',
+      search: 'foo',
+    });
+  });
+
+  it('falls back to stored values when URL has no persisted keys', () => {
+    localStorage.setItem(
+      STORAGE_KEY_FULL,
+      JSON.stringify({ status: 'error', sort: 'date' })
+    );
+    mockUrlParams = { search: 'foo' };
+
+    const { result } = renderHook(() =>
+      usePersistedParamsState(parse, PERSIST)
+    );
+
+    expect(result.current[0].status).toBe('error');
+    expect(result.current[0].sort).toBe('date');
+    expect(result.current[0].search).toBe('foo');
+  });
+
+  it('URL params take precedence; stored values fill in missing URL params', () => {
+    localStorage.setItem(
+      STORAGE_KEY_FULL,
+      JSON.stringify({ status: 'error', sort: 'date' })
+    );
+    mockUrlParams = { status: 'healthy' };
+
+    const { result } = renderHook(() =>
+      usePersistedParamsState(parse, PERSIST)
+    );
+
+    expect(result.current[0].status).toBe('healthy');
+    expect(result.current[0].sort).toBe('date');
+  });
+
+  it('backfills URL from storage on mount when URL has no persisted keys', () => {
+    localStorage.setItem(
+      STORAGE_KEY_FULL,
+      JSON.stringify({ status: 'error', sort: 'date' })
+    );
+    mockUrlParams = {};
+
+    renderHook(() => usePersistedParamsState(parse, PERSIST));
+
+    expect(mockGo).toHaveBeenCalledWith(
+      '.',
+      { status: 'error', sort: 'date' },
+      { reload: false, location: 'replace' }
+    );
+  });
+
+  it('backfills only missing URL params when some persisted keys are in URL', () => {
+    localStorage.setItem(
+      STORAGE_KEY_FULL,
+      JSON.stringify({ status: 'error', sort: 'date' })
+    );
+    mockUrlParams = { status: 'healthy' };
+
+    renderHook(() => usePersistedParamsState(parse, PERSIST));
+
+    expect(mockGo).toHaveBeenCalledWith(
+      '.',
+      { sort: 'date' },
+      { reload: false, location: 'replace' }
+    );
+  });
+
+  it('does not backfill URL when all persisted keys are already in URL', () => {
+    localStorage.setItem(
+      STORAGE_KEY_FULL,
+      JSON.stringify({ status: 'error', sort: 'date' })
+    );
+    mockUrlParams = { status: 'healthy', sort: 'name' };
+
+    renderHook(() => usePersistedParamsState(parse, PERSIST));
+
+    expect(mockGo).not.toHaveBeenCalled();
+  });
+
+  it('syncs URL params to storage on render when all persisted keys are in URL', () => {
+    localStorage.setItem(
+      STORAGE_KEY_FULL,
+      JSON.stringify({ status: 'error', sort: 'date' })
+    );
+    mockUrlParams = { status: 'healthy', sort: 'name' };
+
+    renderHook(() => usePersistedParamsState(parse, PERSIST));
+
+    const stored = JSON.parse(localStorage.getItem(STORAGE_KEY_FULL)!);
+    expect(stored.status).toBe('healthy');
+    expect(stored.sort).toBe('name');
+  });
+
+  it('setState writes persisted keys to localStorage', () => {
+    mockUrlParams = { status: 'healthy', sort: 'name', search: 'x' };
+
+    const { result } = renderHook(() =>
+      usePersistedParamsState(parse, PERSIST)
+    );
+
+    act(() => {
+      result.current[1]({ status: 'error' } as Partial<State>);
+    });
+
+    const stored = JSON.parse(localStorage.getItem(STORAGE_KEY_FULL)!);
+    expect(stored.status).toBe('error');
+    expect(stored.sort).toBe('name');
+  });
+
+  it('setState does not write non-persisted keys to localStorage', () => {
+    mockUrlParams = { status: 'healthy', sort: 'name', search: 'x' };
+
+    const { result } = renderHook(() =>
+      usePersistedParamsState(parse, PERSIST)
+    );
+
+    act(() => {
+      result.current[1]({ search: 'new' } as Partial<State>);
+    });
+
+    const stored = JSON.parse(localStorage.getItem(STORAGE_KEY_FULL)!);
+    expect(stored).not.toHaveProperty('search');
+  });
+
+  it('does not write to storage when URL has no persisted keys and storage is empty', () => {
+    mockUrlParams = {};
+
+    renderHook(() => usePersistedParamsState(parse, PERSIST));
+
+    expect(localStorage.getItem(STORAGE_KEY_FULL)).toBeNull();
+    expect(mockGo).not.toHaveBeenCalled();
+  });
+
+  it('works without persist options (pure URL state)', () => {
+    mockUrlParams = { status: 'healthy' };
+
+    const { result } = renderHook(() => usePersistedParamsState(parse));
+
+    expect(result.current[0].status).toBe('healthy');
+
+    act(() => {
+      result.current[1]({ sort: 'date' } as Partial<State>);
+    });
+
+    expect(mockGo).toHaveBeenCalledWith(
+      '.',
+      { sort: 'date' },
+      { reload: false, location: 'replace' }
+    );
+    expect(localStorage.getItem(STORAGE_KEY_FULL)).toBeNull();
+  });
+});
diff --git a/app/react/hooks/useParamState.ts b/app/react/hooks/useParamState.ts
new file mode 100644
index 0000000..57fe336
--- /dev/null
+++ b/app/react/hooks/useParamState.ts
@@ -0,0 +1,142 @@
+import { useEffect } from 'react';
+import { useCurrentStateAndParams, useRouter } from '@uirouter/react';
+
+import { get, set } from './useLocalStorage';
+
+type PersistOptions = {
+  storageKey: string;
+  persistedKeys: string[];
+};
+
+/** Only use when you need to use/update a single param at a time. Using this to update multiple params will cause the state to get out of sync. */
+export function useParamState<T>(
+  param: string,
+  parseParam: (param: string | undefined) => T | undefined = (param) =>
+    param as unknown as T
+) {
+  const {
+    params: { [param]: paramValue },
+  } = useCurrentStateAndParams();
+  const router = useRouter();
+  const state = parseParam(paramValue);
+
+  return [
+    state,
+    (value?: T) => {
+      router.stateService.go(
+        '.',
+        { [param]: value },
+        { reload: false, location: 'replace' }
+      );
+    },
+  ] as const;
+}
+
+/** Use this when you need to use/update multiple params at once. */
+export function useParamsState<T extends Record<string, unknown>>(
+  parseParams: (params: Record<string, string | undefined>) => T
+) {
+  const { params: stateParams } = useCurrentStateAndParams();
+  const router = useRouter();
+
+  const state = parseParams(stateParams);
+
+  function setState(newState: Partial<T>) {
+    router.stateService.go('.', newState, {
+      reload: false,
+      location: 'replace',
+    });
+  }
+
+  return [state, setState] as const;
+}
+
+/** Use this when you need to use/update multiple params and persist a subset to session storage. */
+export function usePersistedParamsState<T extends Record<string, unknown>>(
+  parseParams: (params: Record<string, unknown>) => T,
+  persist?: PersistOptions
+): [T, (partial: Partial<T>) => void] {
+  const { params: stateParams } = useCurrentStateAndParams();
+  const router = useRouter();
+
+  const persistedParams = persist ? readPersisted(persist) : null;
+  const trackedKeys = persist?.persistedKeys ?? [];
+
+  const shouldHydrateFromStorage =
+    !!persistedParams &&
+    trackedKeys.length > 0 &&
+    trackedKeys.some(
+      (k) => persistedParams[k] != null && stateParams[k] == null
+    );
+
+  const effectiveParams: Record<string, unknown> = shouldHydrateFromStorage
+    ? {
+        ...stateParams,
+        ...Object.fromEntries(
+          trackedKeys
+            .filter((k) => stateParams[k] == null)
+            .map((k) => [k, persistedParams![k]])
+        ),
+      }
+    : stateParams;
+
+  const state = parseParams(effectiveParams);
+
+  useEffect(() => {
+    if (!persist || !shouldHydrateFromStorage) return;
+    const stored = readPersisted(persist);
+    const toRestore = Object.fromEntries(
+      trackedKeys
+        .filter((k) => stateParams[k] == null && stored[k] != null)
+        .map((k) => [k, stored[k]])
+    );
+    if (Object.keys(toRestore).length === 0) return;
+    router.stateService.go('.', toRestore, {
+      reload: false,
+      location: 'replace',
+    });
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [shouldHydrateFromStorage]);
+
+  useEffect(() => {
+    if (!persist || shouldHydrateFromStorage) return;
+    if (!trackedKeys.some((k) => stateParams[k] != null)) return;
+    writePersisted(persist, pickKeys(state, persist.persistedKeys));
+  });
+
+  function setState(partial: Partial<T>) {
+    if (persist) {
+      const stored = readPersisted(persist);
+      const updates = Object.fromEntries(
+        persist.persistedKeys
+          .filter((k) => k in partial)
+          .map((k) => [k, (partial as Record<string, unknown>)[k]])
+      );
+      writePersisted(persist, { ...stored, ...updates });
+    }
+    router.stateService.go('.', partial, {
+      reload: false,
+      location: 'replace',
+    });
+  }
+
+  return [state, setState];
+}
+
+function readPersisted(persist: PersistOptions): Record<string, unknown> {
+  return get<Record<string, unknown>>(persist.storageKey, {}, localStorage);
+}
+
+function writePersisted(
+  persist: PersistOptions,
+  params: Record<string, unknown>
+) {
+  set(persist.storageKey, params, localStorage);
+}
+
+function pickKeys(
+  obj: Record<string, unknown>,
+  keys: string[]
+): Record<string, unknown> {
+  return Object.fromEntries(keys.map((k) => [k, obj[k]]));
+}
diff --git a/app/react/hooks/useSessionStorage.test.ts b/app/react/hooks/useSessionStorage.test.ts
new file mode 100644
index 0000000..f6b57b7
--- /dev/null
+++ b/app/react/hooks/useSessionStorage.test.ts
@@ -0,0 +1,32 @@
+import { renderHook, act } from '@testing-library/react-hooks';
+import { describe, it, expect, beforeEach } from 'vitest';
+
+import { keyBuilder } from './useLocalStorage';
+import { useSessionStorage } from './useSessionStorage';
+
+const KEY = 'test-key';
+const STORAGE_KEY = keyBuilder(KEY);
+
+describe('useSessionStorage', () => {
+  beforeEach(() => {
+    sessionStorage.clear();
+    localStorage.clear();
+  });
+
+  it('returns defaultValue when nothing is stored', () => {
+    const { result } = renderHook(() => useSessionStorage(KEY, 42));
+
+    expect(result.current[0]).toBe(42);
+  });
+
+  it('stores value in sessionStorage, not localStorage', () => {
+    const { result } = renderHook(() => useSessionStorage(KEY, 0));
+
+    act(() => {
+      result.current[1](99);
+    });
+
+    expect(sessionStorage.getItem(STORAGE_KEY)).toBe('99');
+    expect(localStorage.getItem(STORAGE_KEY)).toBeNull();
+  });
+});
diff --git a/app/react/hooks/useSessionStorage.ts b/app/react/hooks/useSessionStorage.ts
new file mode 100644
index 0000000..cb4b425
--- /dev/null
+++ b/app/react/hooks/useSessionStorage.ts
@@ -0,0 +1,8 @@
+import { useLocalStorage } from './useLocalStorage';
+
+export function useSessionStorage<T>(
+  key: string,
+  defaultValue: T
+): [T, (value: T) => void] {
+  return useLocalStorage<T>(key, defaultValue, sessionStorage);
+}
diff --git a/app/react/hooks/useStateWrapper.ts b/app/react/hooks/useStateWrapper.ts
new file mode 100644
index 0000000..f0bbc3d
--- /dev/null
+++ b/app/react/hooks/useStateWrapper.ts
@@ -0,0 +1,19 @@
+import { useState, useCallback, useEffect } from 'react';
+
+export function useStateWrapper<T>(value: T, onChange: (value: T) => void) {
+  const [inputValue, setInputValue] = useState(value);
+
+  const updateInputValue = useCallback(
+    (value: T) => {
+      setInputValue(value);
+      onChange(value);
+    },
+    [onChange, setInputValue]
+  );
+
+  useEffect(() => {
+    setInputValue(value);
+  }, [value]);
+
+  return [inputValue, updateInputValue] as const;
+}
diff --git a/app/react/hooks/useUIState.tsx b/app/react/hooks/useUIState.tsx
new file mode 100644
index 0000000..b300510
--- /dev/null
+++ b/app/react/hooks/useUIState.tsx
@@ -0,0 +1,37 @@
+import create from 'zustand';
+import { persist } from 'zustand/middleware';
+
+import { keyBuilder } from '@/react/hooks/useLocalStorage';
+
+interface UIState {
+  dismissedInfoPanels: Record<string, boolean>;
+  dismissInfoPanel(id: string): void;
+
+  dismissedInfoHash: string;
+  dismissMotd(hash: string): void;
+
+  dismissedUpdateVersion: string;
+  dismissUpdateVersion(version: string): void;
+}
+
+export const useUIState = create<UIState>()(
+  persist(
+    (set) => ({
+      dismissedInfoPanels: {},
+      dismissInfoPanel(id: string) {
+        set((state) => ({
+          dismissedInfoPanels: { ...state.dismissedInfoPanels, [id]: true },
+        }));
+      },
+      dismissedInfoHash: '',
+      dismissMotd(hash: string) {
+        set({ dismissedInfoHash: hash });
+      },
+      dismissedUpdateVersion: '',
+      dismissUpdateVersion(version: string) {
+        set({ dismissedUpdateVersion: version });
+      },
+    }),
+    { name: keyBuilder('NEW_UI_STATE') }
+  )
+);
diff --git a/app/react/hooks/useUnauthorizedRedirect.ts b/app/react/hooks/useUnauthorizedRedirect.ts
new file mode 100644
index 0000000..d7b2a1d
--- /dev/null
+++ b/app/react/hooks/useUnauthorizedRedirect.ts
@@ -0,0 +1,40 @@
+import { useRouter } from '@uirouter/react';
+import { useEffect } from 'react';
+
+import { useAuthorizations } from './useUser';
+
+type AuthorizationOptions = {
+  authorizations: string | string[];
+  adminOnlyCE?: boolean;
+};
+
+type RedirectOptions = {
+  to: string;
+  params?: Record<string, unknown>;
+};
+
+/**
+ * Redirects to the given route if the user is not authorized.
+ * @param authorizations The authorizations to check.
+ * @param adminOnlyCE Whether to allow non-admin users in CE.
+ * @param to The route to redirect to.
+ * @param params The params to pass to the route.
+ */
+export function useUnauthorizedRedirect(
+  { authorizations, adminOnlyCE = false }: AuthorizationOptions,
+  { to, params }: RedirectOptions
+) {
+  const router = useRouter();
+
+  const isAuthorizedQuery = useAuthorizations(
+    authorizations,
+    undefined,
+    adminOnlyCE
+  );
+
+  useEffect(() => {
+    if (!isAuthorizedQuery.isLoading && !isAuthorizedQuery.authorized) {
+      router.stateService.go(to, params);
+    }
+  }, [isAuthorizedQuery, params, to, router.stateService]);
+}
diff --git a/app/react/hooks/useUpdateEffect.ts b/app/react/hooks/useUpdateEffect.ts
new file mode 100644
index 0000000..d848b53
--- /dev/null
+++ b/app/react/hooks/useUpdateEffect.ts
@@ -0,0 +1,20 @@
+import { useEffect, useRef } from 'react';
+
+/**
+ * Like `useEffect`, but skips the callback on the initial render.
+ * Only runs when a dependency changes after the component has mounted.
+ */
+export function useUpdateEffect(
+  fn: () => void,
+  deps: React.DependencyList
+): void {
+  const isFirstRender = useRef(true);
+  useEffect(() => {
+    if (isFirstRender.current) {
+      isFirstRender.current = false;
+      return;
+    }
+    fn();
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, deps);
+}
diff --git a/app/react/hooks/useUser.tsx b/app/react/hooks/useUser.tsx
new file mode 100644
index 0000000..829803e
--- /dev/null
+++ b/app/react/hooks/useUser.tsx
@@ -0,0 +1,224 @@
+import { useCurrentStateAndParams } from '@uirouter/react';
+import {
+  createContext,
+  ReactNode,
+  useContext,
+  useMemo,
+  PropsWithChildren,
+} from 'react';
+
+import { isEdgeAdmin, isPureAdmin } from '@/portainer/users/user.helpers';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { User } from '@/portainer/users/types';
+import { useLoadCurrentUser } from '@/portainer/users/queries/useLoadCurrentUser';
+
+import { useEnvironment } from '../portainer/environments/queries';
+import { isBE } from '../portainer/feature-flags/feature-flags.service';
+
+interface State {
+  user?: User;
+}
+
+export const UserContext = createContext<State | null>(null);
+UserContext.displayName = 'UserContext';
+
+/**
+ * @deprecated use `useCurrentUser` instead
+ */
+export const useUser = useCurrentUser;
+
+export function useCurrentUser() {
+  const context = useContext(UserContext);
+
+  if (context === null) {
+    throw new Error('should be nested under UserProvider');
+  }
+
+  const { user } = context;
+  if (typeof user === 'undefined') {
+    throw new Error('should be authenticated');
+  }
+
+  return useMemo(
+    () => ({
+      user,
+      isPureAdmin: isPureAdmin(user),
+    }),
+    [user]
+  );
+}
+
+export function useIsPureAdmin() {
+  const { isPureAdmin } = useCurrentUser();
+  return isPureAdmin;
+}
+
+/**
+ * Load the admin status of the user, returning true if the user is edge admin or admin.
+ * @param forceEnvironmentId to force the environment id, used where the environment id can't be loaded from the router, like sidebar
+ * @returns query result with isLoading and isAdmin - isAdmin is true if the user edge admin or admin.
+ */
+export function useIsEdgeAdmin({
+  forceEnvironmentId,
+  noEnvScope,
+}: {
+  forceEnvironmentId?: EnvironmentId;
+  noEnvScope?: boolean;
+} = {}) {
+  const { user } = useCurrentUser();
+  const {
+    params: { endpointId },
+  } = useCurrentStateAndParams();
+
+  const envId = forceEnvironmentId || endpointId;
+  const envScope = typeof noEnvScope === 'boolean' ? !noEnvScope : !!envId;
+  const envQuery = useEnvironment(envScope ? envId : undefined);
+
+  if (!envScope) {
+    return { isLoading: false, isAdmin: isEdgeAdmin(user) };
+  }
+
+  if (envQuery.isLoading) {
+    return { isLoading: true, isAdmin: false };
+  }
+
+  return {
+    isLoading: false,
+    isAdmin: isEdgeAdmin(user, envQuery.data),
+  };
+}
+
+/**
+ * Check if the user has some of the authorizations
+ *
+ * @param authorizations a list of authorizations to check
+ * @param forceEnvironmentId to force the environment id, used where the environment id can't be loaded from the router, like sidebar
+ * @param adminOnlyCE if true, will return false if the user is not an admin in CE
+ * @returns query result with isLoading and authorized - authorized is true if the user has some of the authorizations
+ */
+export function useAuthorizations(
+  authorizations: string | string[],
+  forceEnvironmentId?: EnvironmentId,
+  adminOnlyCE = false
+) {
+  const { user } = useCurrentUser();
+  const {
+    params: { endpointId },
+  } = useCurrentStateAndParams();
+  const envQuery = useEnvironment(forceEnvironmentId || endpointId);
+  const isAdminQuery = useIsEdgeAdmin({ forceEnvironmentId });
+
+  if (!user) {
+    return { authorized: false, isLoading: false };
+  }
+
+  if (envQuery.isInitialLoading || isAdminQuery.isLoading) {
+    return { authorized: false, isLoading: true };
+  }
+
+  if (isAdminQuery.isAdmin) {
+    return { authorized: true, isLoading: false };
+  }
+
+  if (!isBE && adminOnlyCE) {
+    return { authorized: false, isLoading: false };
+  }
+
+  return {
+    authorized: hasAuthorizations(user, authorizations, envQuery.data?.Id),
+    isLoading: false,
+  };
+}
+
+export function useIsEnvironmentAdmin({
+  forceEnvironmentId,
+  adminOnlyCE = true,
+}: {
+  forceEnvironmentId?: EnvironmentId;
+  adminOnlyCE?: boolean;
+} = {}) {
+  return useAuthorizations(
+    ['EndpointResourcesAccess'],
+    forceEnvironmentId,
+    adminOnlyCE
+  );
+}
+
+/**
+ * will return true if the user has some of the authorizations. assumes the user is authenticated and not an admin
+ *
+ * @private Please use `useAuthorizations` instead. Exported only for angular's authentication service app/portainer/services/authentication.js:154
+ */
+export function hasAuthorizations(
+  user: User,
+  authorizations: string | string[],
+  environmentId?: EnvironmentId
+) {
+  if (!isBE) {
+    return true;
+  }
+
+  const authorizationsArray =
+    typeof authorizations === 'string' ? [authorizations] : authorizations;
+
+  if (authorizationsArray.length === 0) {
+    return true;
+  }
+
+  if (!environmentId) {
+    return false;
+  }
+
+  const userEndpointAuthorizations =
+    user.EndpointAuthorizations?.[environmentId] || [];
+
+  return authorizationsArray.some(
+    (authorization) => userEndpointAuthorizations[authorization]
+  );
+}
+
+interface AuthorizedProps {
+  authorizations: string | string[];
+  environmentId?: EnvironmentId;
+  adminOnlyCE?: boolean;
+  childrenUnauthorized?: ReactNode;
+}
+
+export function Authorized({
+  authorizations,
+  environmentId,
+  adminOnlyCE = false,
+  children,
+  childrenUnauthorized = null,
+}: PropsWithChildren<AuthorizedProps>) {
+  const { authorized } = useAuthorizations(
+    authorizations,
+    environmentId,
+    adminOnlyCE
+  );
+
+  return authorized ? <>{children}</> : <>{childrenUnauthorized}</>;
+}
+
+interface UserProviderProps {
+  children: ReactNode;
+}
+
+export function UserProvider({ children }: UserProviderProps) {
+  const userQuery = useLoadCurrentUser();
+
+  const providerState = useMemo(
+    () => ({ user: userQuery.data }),
+    [userQuery.data]
+  );
+
+  if (!providerState.user) {
+    return null;
+  }
+
+  return (
+    <UserContext.Provider value={providerState}>
+      {children}
+    </UserContext.Provider>
+  );
+}
diff --git a/app/react/hooks/withHideOnExtension.tsx b/app/react/hooks/withHideOnExtension.tsx
new file mode 100644
index 0000000..7618870
--- /dev/null
+++ b/app/react/hooks/withHideOnExtension.tsx
@@ -0,0 +1,24 @@
+import { ComponentType } from 'react';
+
+/**
+ * Hides the wrapped component if portainer is running as a docker extension.
+ */
+export function withHideOnExtension<T>(
+  WrappedComponent: ComponentType<T>
+): ComponentType<T> {
+  // Try to create a nice displayName for React Dev Tools.
+  const displayName =
+    WrappedComponent.displayName || WrappedComponent.name || 'Component';
+
+  function WrapperComponent(props: T & JSX.IntrinsicAttributes) {
+    if (window.ddExtension) {
+      return null;
+    }
+
+    return <WrappedComponent {...props} />;
+  }
+
+  WrapperComponent.displayName = `withHideOnExtension(${displayName})`;
+
+  return WrapperComponent;
+}
diff --git a/app/react/kubernetes/DeployView/.keep b/app/react/kubernetes/DeployView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/kubernetes/DeployView/StackName/StackName.tsx b/app/react/kubernetes/DeployView/StackName/StackName.tsx
new file mode 100644
index 0000000..7c99dd0
--- /dev/null
+++ b/app/react/kubernetes/DeployView/StackName/StackName.tsx
@@ -0,0 +1,90 @@
+import { useMemo } from 'react';
+
+import { useIsEdgeAdmin } from '@/react/hooks/useUser';
+
+import { Link } from '@@/Link';
+import { TextTip } from '@@/Tip/TextTip';
+import { Tooltip } from '@@/Tip/Tooltip';
+import { AutocompleteSelect } from '@@/form-components/AutocompleteSelect';
+import { FormError } from '@@/form-components/FormError';
+
+type Props = {
+  stackName: string;
+  setStackName: (name: string) => void;
+  stacks?: string[];
+  inputClassName?: string;
+  textTip?: string;
+  error?: string;
+};
+
+export function StackName({
+  stackName,
+  setStackName,
+  stacks = [],
+  inputClassName,
+  textTip = "Enter or select a 'stack' name to group multiple deployments together, or else leave empty to ignore.",
+  error = '',
+}: Props) {
+  const isAdminQuery = useIsEdgeAdmin();
+  const stackResults = useMemo(
+    () => stacks.filter((stack) => stack.includes(stackName ?? '')),
+    [stacks, stackName]
+  );
+
+  const { isAdmin } = isAdminQuery;
+
+  const tooltip = (
+    <>
+      You may specify a stack name to label resources that you want to group.
+      This includes Deployments, DaemonSets, StatefulSets and Pods.
+      {isAdmin && (
+        <>
+          <br />
+          You can leave the stack name empty, or even turn off Kubernetes Stacks
+          functionality entirely via{' '}
+          <Link
+            to="portainer.settings"
+            target="_blank"
+            data-cy="k8s-deploy-stack-input-settings-link"
+          >
+            Kubernetes Settings
+          </Link>
+          .
+        </>
+      )}
+    </>
+  );
+
+  return (
+    <>
+      {textTip ? (
+        <TextTip className="mb-4" color="blue">
+          {textTip}
+        </TextTip>
+      ) : null}
+      <div className="form-group">
+        <label
+          htmlFor="stack_name"
+          className="col-lg-2 col-sm-3 control-label text-left"
+        >
+          Stack
+          <Tooltip message={tooltip} setHtmlMessage />
+        </label>
+        <div className={inputClassName || 'col-sm-9 col-lg-10'}>
+          <AutocompleteSelect
+            searchResults={stackResults?.map((result) => ({
+              value: result,
+              label: result,
+            }))}
+            value={stackName ?? ''}
+            onChange={setStackName}
+            placeholder="e.g. myStack"
+            inputId="stack_name"
+            data-cy="k8s-deploy-stack-input"
+          />
+          {error ? <FormError>{error}</FormError> : null}
+        </div>
+      </div>
+    </>
+  );
+}
diff --git a/app/react/kubernetes/DeployView/StackName/StackNameLabelInsight.tsx b/app/react/kubernetes/DeployView/StackName/StackNameLabelInsight.tsx
new file mode 100644
index 0000000..5cc0124
--- /dev/null
+++ b/app/react/kubernetes/DeployView/StackName/StackNameLabelInsight.tsx
@@ -0,0 +1,37 @@
+import { useCurrentUser } from '@/react/hooks/useUser';
+
+import { InsightsBox } from '@@/InsightsBox';
+import { Link } from '@@/Link';
+
+export function StackNameLabelInsight() {
+  const { isPureAdmin } = useCurrentUser();
+  const insightsBoxContent = (
+    <>
+      The stack field below was previously labelled &apos;Name&apos; but, in
+      fact, it&apos;s always been the stack name (hence the relabelling).
+      {isPureAdmin && (
+        <>
+          <br />
+          Kubernetes Stacks functionality can be turned off entirely via{' '}
+          <Link
+            to="portainer.settings"
+            target="_blank"
+            data-cy="k8s-deploy-settings-link"
+          >
+            Kubernetes Settings
+          </Link>
+          .
+        </>
+      )}
+    </>
+  );
+
+  return (
+    <InsightsBox
+      type="slim"
+      header="Stack"
+      content={insightsBoxContent}
+      insightCloseId="k8s-stacks-name"
+    />
+  );
+}
diff --git a/app/react/kubernetes/DeployView/StackName/constants.ts b/app/react/kubernetes/DeployView/StackName/constants.ts
new file mode 100644
index 0000000..5c2a018
--- /dev/null
+++ b/app/react/kubernetes/DeployView/StackName/constants.ts
@@ -0,0 +1,4 @@
+// this regex is to satisfy k8s label validation rules
+// alphanumeric, lowercase, uppercase, can contain dashes, dots and underscores, max 63 characters
+export const KUBE_STACK_NAME_VALIDATION_REGEX =
+  /^(([a-zA-Z0-9](?:(?:[-a-zA-Z0-9_.]){0,61}[a-zA-Z0-9])?))$/;
diff --git a/app/react/kubernetes/annotations/AnnotationsBeTeaser.tsx b/app/react/kubernetes/annotations/AnnotationsBeTeaser.tsx
new file mode 100644
index 0000000..b6d09a1
--- /dev/null
+++ b/app/react/kubernetes/annotations/AnnotationsBeTeaser.tsx
@@ -0,0 +1,48 @@
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+
+import { BETeaserButton } from '@@/BETeaserButton';
+import { Tooltip } from '@@/Tip/Tooltip';
+
+export function AnnotationsBeTeaser() {
+  return (
+    <div className="col-sm-12 text-muted mb-2 block px-0">
+      <div className="control-label !mb-2 text-left font-medium">
+        Annotations
+        <Tooltip
+          message={
+            <div className="vertical-center">
+              <span>
+                Allows specifying of{' '}
+                <a
+                  href="https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/"
+                  target="_black"
+                >
+                  annotations
+                </a>{' '}
+                for the object. See further Kubernetes documentation on{' '}
+                <a
+                  href="https://kubernetes.io/docs/reference/labels-annotations-taints/"
+                  target="_black"
+                >
+                  well-known annotations
+                </a>
+                .
+              </span>
+            </div>
+          }
+        />
+      </div>
+      <div className="block">
+        <BETeaserButton
+          className="!p-0"
+          heading="Add annotation"
+          buttonText="Add annotation"
+          message="Allows specifying of annotations on this resource."
+          featureId={FeatureId.K8S_ANNOTATIONS}
+          buttonClassName="!ml-0"
+          data-cy="annotations-be-teaser"
+        />
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/kubernetes/annotations/AnnotationsForm.tsx b/app/react/kubernetes/annotations/AnnotationsForm.tsx
new file mode 100644
index 0000000..3b6ed4c
--- /dev/null
+++ b/app/react/kubernetes/annotations/AnnotationsForm.tsx
@@ -0,0 +1,94 @@
+import { ChangeEvent } from 'react';
+import { Trash2 } from 'lucide-react';
+
+import { FormError } from '@@/form-components/FormError';
+import { Button } from '@@/buttons';
+import { isArrayErrorType } from '@@/form-components/formikUtils';
+
+import { Annotation, AnnotationErrors } from './types';
+
+interface Props {
+  annotations: Annotation[];
+  handleAnnotationChange: (
+    index: number,
+    key: 'key' | 'value',
+    val: string
+  ) => void;
+  removeAnnotation: (index: number) => void;
+  errors: AnnotationErrors;
+  placeholder: string[];
+}
+
+export function AnnotationsForm({
+  annotations,
+  handleAnnotationChange,
+  removeAnnotation,
+  errors,
+  placeholder,
+}: Props) {
+  const annotationErrors = isArrayErrorType<Annotation>(errors)
+    ? errors
+    : undefined;
+
+  return (
+    <>
+      {annotations.map((annotation, i) => (
+        <div className="row" key={annotation.id}>
+          <div className="form-group col-sm-4 !m-0 !pl-0">
+            <div className="input-group input-group-sm">
+              <span className="input-group-addon required">Key</span>
+              <input
+                name={`annotation_key_${i}`}
+                type="text"
+                className="form-control form-control-sm"
+                placeholder={placeholder[0]}
+                defaultValue={annotation.key}
+                onChange={(e: ChangeEvent<HTMLInputElement>) =>
+                  handleAnnotationChange(i, 'key', e.target.value)
+                }
+                data-cy={`annotation-key-${i}`}
+              />
+            </div>
+            {annotationErrors?.[i]?.key && (
+              <FormError className="!mb-0 mt-1">
+                {annotationErrors[i]?.key}
+              </FormError>
+            )}
+          </div>
+          <div className="form-group col-sm-4 !m-0 !pl-0">
+            <div className="input-group input-group-sm">
+              <span className="input-group-addon required">Value</span>
+              <input
+                name={`annotation_value_${i}`}
+                type="text"
+                className="form-control form-control-sm"
+                placeholder={placeholder[1]}
+                defaultValue={annotation.value}
+                onChange={(e: ChangeEvent<HTMLInputElement>) =>
+                  handleAnnotationChange(i, 'value', e.target.value)
+                }
+                data-cy={`annotation-value-${i}`}
+              />
+            </div>
+            {annotationErrors?.[i]?.value && (
+              <FormError className="!mb-0 mt-1">
+                {annotationErrors[i]?.value}
+              </FormError>
+            )}
+          </div>
+          <div className="col-sm-3 !m-0 !pl-0">
+            <Button
+              size="small"
+              data-cy={`remove-annotation-${i}`}
+              color="dangerlight"
+              className="btn-only-icon !ml-0"
+              type="button"
+              onClick={() => removeAnnotation(i)}
+              icon={Trash2}
+            />
+          </div>
+        </div>
+      ))}
+    </>
+  );
+}
diff --git a/app/react/kubernetes/annotations/types.ts b/app/react/kubernetes/annotations/types.ts
new file mode 100644
index 0000000..04ca9fc
--- /dev/null
+++ b/app/react/kubernetes/annotations/types.ts
@@ -0,0 +1,15 @@
+import { FormikErrors } from 'formik';
+
+export interface Annotation {
+  key: string;
+  value: string;
+  id: string;
+}
+
+export type AnnotationsPayload = Record<string, string>;
+
+export type AnnotationErrors =
+  | string
+  | string[]
+  | FormikErrors<Annotation>[]
+  | undefined;
diff --git a/app/react/kubernetes/annotations/validation.ts b/app/react/kubernetes/annotations/validation.ts
new file mode 100644
index 0000000..1d66022
--- /dev/null
+++ b/app/react/kubernetes/annotations/validation.ts
@@ -0,0 +1,68 @@
+import { SchemaOf, array, object, string } from 'yup';
+
+import { buildUniquenessTest } from '@@/form-components/validate-unique';
+
+import { Annotation } from './types';
+
+const re = /^([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]$/;
+
+export const annotationsSchema: SchemaOf<Annotation[]> = array(
+  getAnnotationValidation()
+).test(
+  'unique',
+  'Duplicate keys are not allowed.',
+  buildUniquenessTest(() => 'Duplicate keys are not allowed.', 'key')
+);
+
+function getAnnotationValidation(): SchemaOf<Annotation> {
+  return object({
+    key: string()
+      .required('Key is required.')
+      .test('is-valid', (value, { createError }) => {
+        if (!value) {
+          return true;
+        }
+        const keySegments = value.split('/');
+        if (keySegments.length > 2) {
+          return createError({
+            message:
+              'Two segments are allowed, separated by a slash (/): a prefix (optional) and a name.',
+          });
+        }
+        if (keySegments.length === 2) {
+          if (keySegments[0].length > 253) {
+            return createError({
+              message: "Prefix (before the slash) can't exceed 253 characters.",
+            });
+          }
+          if (keySegments[1].length > 63) {
+            return createError({
+              message: "Name (after the slash) can't exceed 63 characters.",
+            });
+          }
+          if (!re.test(keySegments[1])) {
+            return createError({
+              message:
+                'Start and end with alphanumeric characters only, limiting characters in between to dashes, underscores, and alphanumerics.',
+            });
+          }
+        } else if (keySegments.length === 1) {
+          if (keySegments[0].length > 63) {
+            return createError({
+              message:
+                "Name (the segment after a slash (/), or only segment if no slash) can't exceed 63 characters.",
+            });
+          }
+          if (!re.test(keySegments[0])) {
+            return createError({
+              message:
+                'Start and end with alphanumeric characters only, limiting characters in between to dashes, underscores, and alphanumerics.',
+            });
+          }
+        }
+        return true;
+      }),
+    value: string().required('Value is required.'),
+    id: string().required('ID is required.'),
+  });
+}
diff --git a/app/react/kubernetes/applications/ConsoleView/ConsoleView.tsx b/app/react/kubernetes/applications/ConsoleView/ConsoleView.tsx
new file mode 100644
index 0000000..d7a19d5
--- /dev/null
+++ b/app/react/kubernetes/applications/ConsoleView/ConsoleView.tsx
@@ -0,0 +1,169 @@
+import { useState } from 'react';
+import { useCurrentStateAndParams } from '@uirouter/react';
+import { Terminal as TerminalIcon } from 'lucide-react';
+
+import { baseHref } from '@/portainer/helpers/pathHelper';
+import { TerminalTooltip } from '@/react/components/TerminalTooltip';
+
+import { PageHeader } from '@@/PageHeader';
+import { Widget, WidgetBody } from '@@/Widget';
+import { Icon } from '@@/Icon';
+import { Button } from '@@/buttons';
+import { Input } from '@@/form-components/Input';
+import {
+  Terminal,
+  isLinuxTerminalCommand,
+  LINUX_SHELL_INIT_COMMANDS,
+} from '@@/Terminal/Terminal';
+import type { ShellState } from '@@/Terminal/Terminal';
+
+export function ConsoleView() {
+  const {
+    params: {
+      endpointId: environmentId,
+      container,
+      name: appName,
+      namespace,
+      pod: podID,
+    },
+  } = useCurrentStateAndParams();
+
+  const [command, setCommand] = useState('/bin/sh');
+  const [connect, setConnect] = useState(false);
+  const [shellState, setShellState] = useState<ShellState>('idle');
+
+  const breadcrumbs = [
+    { label: 'Namespaces', link: 'kubernetes.resourcePools' },
+    {
+      label: namespace,
+      link: 'kubernetes.resourcePools.resourcePool',
+      linkParams: { id: namespace },
+    },
+    { label: 'Applications', link: 'kubernetes.applications' },
+    {
+      label: appName,
+      link: 'kubernetes.applications.application',
+      linkParams: { name: appName, namespace },
+    },
+    'Pods',
+    podID,
+    'Containers',
+    container,
+    'Console',
+  ];
+
+  return (
+    <>
+      <PageHeader
+        title="Application console"
+        breadcrumbs={breadcrumbs}
+        reload
+      />
+      <div className="row">
+        <div className="col-sm-12">
+          <Widget>
+            <WidgetBody>
+              <div className="row">
+                <div className="col-sm-12 form-section-title">Console</div>
+              </div>
+              <div className="form-row flex">
+                <label
+                  htmlFor="consoleCommand"
+                  className="col-sm-3 col-lg-2 control-label m-0 p-0 text-left"
+                >
+                  Command
+                  <TerminalTooltip />
+                </label>
+                <div className="col-sm-8 input-group p-0">
+                  <span className="input-group-addon">
+                    <Icon icon={TerminalIcon} className="mr-1" />
+                  </span>
+                  <Input
+                    type="text"
+                    className="form-control"
+                    placeholder="/bin/bash"
+                    value={command}
+                    onChange={(e) => setCommand(e.target.value)}
+                    id="consoleCommand"
+                    disabled={connect}
+                    // eslint-disable-next-line jsx-a11y/no-autofocus
+                    autoFocus
+                    data-cy="console-command-input"
+                  />
+                </div>
+              </div>
+              <div className="row mt-4">
+                <Button
+                  className="btn btn-primary !ml-0"
+                  data-cy="connect-console-button"
+                  onClick={connect ? handleDisconnect : handleConnect}
+                  disabled={shellState === 'connecting'}
+                >
+                  {shellState === 'connected' && 'Disconnect'}
+                  {shellState === 'connecting' && 'Connecting'}
+                  {shellState !== 'connecting' &&
+                    shellState !== 'connected' &&
+                    'Connect'}
+                </Button>
+              </div>
+            </WidgetBody>
+          </Widget>
+          <div className="row">
+            <div className="col-sm-12 p-0">
+              <Terminal
+                url={buildUrl()}
+                connect={connect}
+                onStateChange={handleStateChange}
+                onResize="socket"
+                initialCommands={
+                  isLinuxTerminalCommand(command)
+                    ? LINUX_SHELL_INIT_COMMANDS
+                    : undefined
+                }
+              />
+            </div>
+          </div>
+        </div>
+      </div>
+    </>
+  );
+
+  function handleConnect() {
+    setConnect(true);
+  }
+
+  function handleDisconnect() {
+    setConnect(false);
+  }
+
+  function handleStateChange(state: ShellState) {
+    if (state === 'disconnected') {
+      setConnect(false);
+    }
+    setShellState(state);
+  }
+
+  function buildUrl() {
+    const params: Record<string, string> = {
+      endpointId: environmentId,
+      namespace,
+      podName: podID,
+      containerName: container,
+      command,
+    };
+
+    const queryParams = Object.keys(params)
+      .map((k) => `${k}=${params[k]}`)
+      .join('&');
+
+    let url = `${
+      window.location.origin
+    }${baseHref()}api/websocket/pod?${queryParams}`;
+    if (url.indexOf('https') > -1) {
+      url = url.replace('https://', 'wss://');
+    } else {
+      url = url.replace('http://', 'ws://');
+    }
+    return url;
+  }
+}
diff --git a/app/react/kubernetes/applications/ConsoleView/index.ts b/app/react/kubernetes/applications/ConsoleView/index.ts
new file mode 100644
index 0000000..bceeb0c
--- /dev/null
+++ b/app/react/kubernetes/applications/ConsoleView/index.ts
@@ -0,0 +1 @@
+export { ConsoleView } from './ConsoleView';
diff --git a/app/react/kubernetes/applications/CreateView/DataAccessPolicyFormSection.tsx b/app/react/kubernetes/applications/CreateView/DataAccessPolicyFormSection.tsx
new file mode 100644
index 0000000..b9a8964
--- /dev/null
+++ b/app/react/kubernetes/applications/CreateView/DataAccessPolicyFormSection.tsx
@@ -0,0 +1,78 @@
+import { Box, Boxes } from 'lucide-react';
+
+import { BoxSelector, BoxSelectorOption } from '@@/BoxSelector';
+import { FormSection } from '@@/form-components/FormSection';
+import { TextTip } from '@@/Tip/TextTip';
+
+import { AppDataAccessPolicy } from '../types';
+
+interface Props {
+  isEdit: boolean;
+  persistedFoldersUseExistingVolumes: boolean;
+  value: AppDataAccessPolicy;
+  onChange(value: AppDataAccessPolicy): void;
+}
+
+export function DataAccessPolicyFormSection({
+  isEdit,
+  persistedFoldersUseExistingVolumes,
+  value,
+  onChange,
+}: Props) {
+  const options = getOptions(value, isEdit, persistedFoldersUseExistingVolumes);
+
+  return (
+    <FormSection title="Data access policy" titleSize="sm">
+      <TextTip color="blue">
+        Specify how the data will be used across instances.
+      </TextTip>
+      <BoxSelector
+        slim
+        options={options}
+        value={value}
+        onChange={onChange}
+        radioName="data_access_policy"
+      />
+    </FormSection>
+  );
+}
+
+function getOptions(
+  value: AppDataAccessPolicy,
+  isEdit: boolean,
+  persistedFoldersUseExistingVolumes: boolean
+): ReadonlyArray<BoxSelectorOption<AppDataAccessPolicy>> {
+  return [
+    {
+      value: 'Isolated',
+      id: 'data_access_isolated',
+      icon: Boxes,
+      iconType: 'badge',
+      label: 'Isolated',
+      description:
+        'Application will be deployed as a StatefulSet with each instantiating their own data',
+      tooltip: () =>
+        isEdit || persistedFoldersUseExistingVolumes
+          ? 'Changing the data access policy is not allowed'
+          : '',
+      disabled: () =>
+        (isEdit && value !== 'Isolated') || persistedFoldersUseExistingVolumes,
+    },
+    {
+      value: 'Shared',
+      id: 'data_access_shared',
+      icon: Box,
+      iconType: 'badge',
+      label: 'Shared',
+      description:
+        'Application will be deployed as a Deployment with a shared storage access',
+      tooltip: () => {
+        if (persistedFoldersUseExistingVolumes) {
+          return 'Changing the data access policy is not allowed';
+        }
+        return '';
+      },
+      disabled: () => isEdit && value !== 'Shared',
+    },
+  ] as const;
+}
diff --git a/app/react/kubernetes/applications/CreateView/UpdateIngressPrompt.tsx b/app/react/kubernetes/applications/CreateView/UpdateIngressPrompt.tsx
new file mode 100644
index 0000000..08e1891
--- /dev/null
+++ b/app/react/kubernetes/applications/CreateView/UpdateIngressPrompt.tsx
@@ -0,0 +1,28 @@
+import { openSwitchPrompt } from '@@/modals/SwitchPrompt';
+import { buildConfirmButton } from '@@/modals/utils';
+
+export async function confirmUpdateAppIngress(
+  ingressesToUpdate: Array<unknown>,
+  servicePortsToUpdate: Array<unknown>
+) {
+  const hasOneIngress = ingressesToUpdate.length === 1;
+  const hasOnePort = servicePortsToUpdate.length === 1;
+  const rulePlural = !hasOneIngress ? 'rules' : 'rule';
+  const noMatchSentence = !hasOnePort
+    ? `Service ports in this application no longer match the ingress ${rulePlural}.`
+    : `A service port in this application no longer matches the ingress ${rulePlural} which may break ingress rule paths.`;
+  const inputLabel = `Update ingress ${rulePlural} to match the service port changes`;
+
+  const result = await openSwitchPrompt('Are you sure?', inputLabel, {
+    message: (
+      <ul className="ml-3">
+        <li>Updating the application may cause a service interruption.</li>
+        <li>{noMatchSentence}</li>
+      </ul>
+    ),
+    confirmButton: buildConfirmButton('Update'),
+    'data-cy': 'kube-update-ingress-prompt-switch',
+  });
+
+  return result ? { noMatch: result.value } : undefined;
+}
diff --git a/app/react/kubernetes/applications/CreateView/application-services/KubeServicesForm.tsx b/app/react/kubernetes/applications/CreateView/application-services/KubeServicesForm.tsx
new file mode 100644
index 0000000..ca27aaf
--- /dev/null
+++ b/app/react/kubernetes/applications/CreateView/application-services/KubeServicesForm.tsx
@@ -0,0 +1,218 @@
+import { useEffect, useMemo, useState } from 'react';
+import { FormikErrors } from 'formik';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import {
+  useIngressControllers,
+  useIngresses,
+} from '@/react/kubernetes/ingresses/queries';
+
+import { FormSection } from '@@/form-components/FormSection';
+
+import { ServiceFormValues, ServiceTypeOption, ServiceType } from './types';
+import { generateUniqueName } from './utils';
+import { ClusterIpServicesForm } from './cluster-ip/ClusterIpServicesForm';
+import { ServiceTabs } from './components/ServiceTabs';
+import { NodePortServicesForm } from './node-port/NodePortServicesForm';
+import { LoadBalancerServicesForm } from './load-balancer/LoadBalancerServicesForm';
+import { ServiceTabLabel } from './components/ServiceTabLabel';
+import { PublishingExplaination } from './PublishingExplaination';
+
+interface Props {
+  values: ServiceFormValues[];
+  onChange: (services: ServiceFormValues[]) => void;
+  errors?: FormikErrors<ServiceFormValues[]>;
+  appName: string;
+  selector: Record<string, string>;
+  isEditMode: boolean;
+  namespace?: string;
+}
+
+export function KubeServicesForm({
+  values: services,
+  onChange,
+  errors,
+  appName,
+  selector,
+  isEditMode,
+  namespace,
+}: Props) {
+  const [selectedServiceType, setSelectedServiceType] =
+    useState<ServiceType>('ClusterIP');
+
+  // start loading ingresses and controllers early to reduce perceived loading time
+  const environmentId = useEnvironmentId();
+  useIngresses(environmentId, { withServices: true });
+  useIngressControllers(environmentId, namespace);
+
+  // when the appName changes, update the names for each service
+  // and the serviceNames for each service port
+  const newServiceNames = useMemo(
+    () => getUniqNames(appName, services),
+    [appName, services]
+  );
+  useEffect(() => {
+    if (!isEditMode) {
+      const newServices = services.map((service, index) => {
+        const newServiceName = newServiceNames[index];
+        const newServicePorts = service.Ports.map((port) => ({
+          ...port,
+          serviceName: newServiceName,
+        }));
+        return { ...service, Name: newServiceName, Ports: newServicePorts };
+      });
+      onChange(newServices);
+    }
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [appName]);
+
+  const serviceTypeCounts = useMemo(
+    () => getServiceTypeCounts(services),
+    [services]
+  );
+
+  const serviceTypeHasErrors = useMemo(
+    () => getServiceTypeHasErrors(services, errors),
+    [services, errors]
+  );
+
+  const serviceTypeOptions: ServiceTypeOption[] = [
+    {
+      value: 'ClusterIP',
+      label: (
+        <ServiceTabLabel
+          serviceTypeLabel="ClusterIP services"
+          serviceTypeCount={serviceTypeCounts.ClusterIP}
+          serviceTypeHasErrors={serviceTypeHasErrors.ClusterIP}
+        />
+      ),
+    },
+    {
+      value: 'NodePort',
+      label: (
+        <ServiceTabLabel
+          serviceTypeLabel="NodePort services"
+          serviceTypeCount={serviceTypeCounts.NodePort}
+          serviceTypeHasErrors={serviceTypeHasErrors.NodePort}
+        />
+      ),
+    },
+    {
+      value: 'LoadBalancer',
+      label: (
+        <ServiceTabLabel
+          serviceTypeLabel="LoadBalancer services"
+          serviceTypeCount={serviceTypeCounts.LoadBalancer}
+          serviceTypeHasErrors={serviceTypeHasErrors.LoadBalancer}
+        />
+      ),
+    },
+  ];
+
+  return (
+    <div className="flex flex-col">
+      <FormSection title="Publishing the application" />
+      <PublishingExplaination />
+      <ServiceTabs
+        serviceTypeOptions={serviceTypeOptions}
+        selectedServiceType={selectedServiceType}
+        setSelectedServiceType={setSelectedServiceType}
+      />
+      {selectedServiceType === 'ClusterIP' && (
+        <ClusterIpServicesForm
+          services={services}
+          onChangeService={onChange}
+          errors={errors}
+          appName={appName}
+          selector={selector}
+          namespace={namespace}
+          isEditMode={isEditMode}
+        />
+      )}
+      {selectedServiceType === 'NodePort' && (
+        <NodePortServicesForm
+          services={services}
+          onChangeService={onChange}
+          errors={errors}
+          appName={appName}
+          selector={selector}
+          namespace={namespace}
+          isEditMode={isEditMode}
+        />
+      )}
+      {selectedServiceType === 'LoadBalancer' && (
+        <LoadBalancerServicesForm
+          services={services}
+          onChangeService={onChange}
+          errors={errors}
+          appName={appName}
+          selector={selector}
+          namespace={namespace}
+          isEditMode={isEditMode}
+        />
+      )}
+    </div>
+  );
+}
+
+function getUniqNames(appName: string, services: ServiceFormValues[]) {
+  const sortedServices = [...services].sort((a, b) =>
+    a.Name && b.Name ? a.Name.localeCompare(b.Name) : 0
+  );
+
+  const uniqueNames = sortedServices.reduce(
+    (acc: string[]) => {
+      const newIndex =
+        acc.findIndex((existingName) => existingName === appName) + 1;
+      const uniqName = acc.includes(appName)
+        ? generateUniqueName(appName, newIndex, services)
+        : appName;
+      return [...acc, uniqName];
+    },
+    [appName]
+  );
+
+  return uniqueNames;
+}
+
+/**
+ * getServiceTypeCounts returns a map of service types to the number of services of that type
+ */
+function getServiceTypeCounts(
+  services: ServiceFormValues[]
+): Record<ServiceType, number> {
+  return services.reduce(
+    (acc, service) => {
+      const type = service.Type;
+      const count = acc[type];
+      return {
+        ...acc,
+        [type]: count ? count + 1 : 1,
+      };
+    },
+    {} as Record<ServiceType, number>
+  );
+}
+
+/**
+ * getServiceTypeHasErrors returns a map of service types to whether or not they have errors
+ */
+function getServiceTypeHasErrors(
+  services: ServiceFormValues[],
+  errors: FormikErrors<ServiceFormValues[] | undefined>
+): Record<ServiceType, boolean> {
+  return services.reduce(
+    (acc, service, index) => {
+      const type = service.Type;
+      const serviceHasErrors = !!errors?.[index];
+      // if the service type already has an error, don't overwrite it
+      if (acc[type] === true) return acc;
+      // otherwise, set the error to the value of serviceHasErrors
+      return {
+        ...acc,
+        [type]: serviceHasErrors,
+      };
+    },
+    {} as Record<ServiceType, boolean>
+  );
+}
diff --git a/app/react/kubernetes/applications/CreateView/application-services/PublishingExplaination.tsx b/app/react/kubernetes/applications/CreateView/application-services/PublishingExplaination.tsx
new file mode 100644
index 0000000..a2392be
--- /dev/null
+++ b/app/react/kubernetes/applications/CreateView/application-services/PublishingExplaination.tsx
@@ -0,0 +1,90 @@
+import ingressDiagram from '@/assets/images/ingress-explanatory-diagram.png';
+
+import { FormSection } from '@@/form-components/FormSection';
+
+export function PublishingExplaination() {
+  return (
+    <FormSection title="Explanation" isFoldable titleSize="sm">
+      <div className="mb-4 flex w-full flex-col items-start lg:flex-row">
+        <img
+          src={ingressDiagram}
+          alt="ingress explaination"
+          width={646}
+          className="flex w-full max-w-2xl basis-1/2 flex-col rounded border border-solid border-gray-5 object-contain lg:w-1/2"
+        />
+        <div className="text-muted ml-8 basis-1/2 text-xs">
+          Expose the application workload via{' '}
+          <a
+            href="https://kubernetes.io/docs/concepts/services-networking/service/"
+            target="_blank"
+            rel="noopener noreferrer"
+          >
+            services
+          </a>{' '}
+          and{' '}
+          <a
+            href="https://kubernetes.io/docs/concepts/services-networking/ingress/"
+            target="_blank"
+            rel="noopener noreferrer"
+          >
+            ingresses
+          </a>
+          :
+          <ul className="ml-5 mt-3 [&>li>ul>li]:ml-5 [&>li]:mb-3">
+            <li>
+              <b>Inside</b> the cluster{' '}
+              <b>
+                <i>only</i>
+              </b>{' '}
+              - via <b>ClusterIP</b> service
+              <ul>
+                <li>
+                  <i>The default service type.</i>
+                </li>
+              </ul>
+            </li>
+            <li>
+              <b>Inside</b> the cluster via <b>ClusterIP</b> service and{' '}
+              <b>outside</b> via <b>ingress</b>
+              <ul>
+                <li>
+                  <i>
+                    An ingress manages external access to (usually ClusterIP)
+                    services within the cluster, and allows defining of routing
+                    rules, SSL termination and other advanced features.
+                  </i>
+                </li>
+              </ul>
+            </li>
+            <li>
+              <b>Inside</b> and <b>outside</b> the cluster via <b>NodePort</b>{' '}
+              service
+              <ul>
+                <li>
+                  <i>
+                    This publishes the workload on a static port on each node,
+                    allowing external access via a nodes&apos; IP address and
+                    port. Not generally recommended for Production use.
+                  </i>
+                </li>
+              </ul>
+            </li>
+            <li>
+              <b>Inside</b> and <b>outside</b> the cluster via{' '}
+              <b>LoadBalancer</b> service
+              <ul>
+                <li>
+                  <i>
+                    If running on a cloud platform, this auto provisions a cloud
+                    load balancer and assigns an external IP address or DNS to
+                    route traffic to the workload.
+                  </i>
+                </li>
+              </ul>
+            </li>
+          </ul>
+        </div>
+      </div>
+    </FormSection>
+  );
+}
diff --git a/app/react/kubernetes/applications/CreateView/application-services/cluster-ip/ClusterIpServiceForm.tsx b/app/react/kubernetes/applications/CreateView/application-services/cluster-ip/ClusterIpServiceForm.tsx
new file mode 100644
index 0000000..ac3b18e
--- /dev/null
+++ b/app/react/kubernetes/applications/CreateView/application-services/cluster-ip/ClusterIpServiceForm.tsx
@@ -0,0 +1,197 @@
+import { FormikErrors } from 'formik';
+import { ChangeEvent } from 'react';
+import { Plus, Trash2 } from 'lucide-react';
+
+import { FormError } from '@@/form-components/FormError';
+import { ButtonSelector } from '@@/form-components/ButtonSelector/ButtonSelector';
+import { Button } from '@@/buttons';
+import { Card } from '@@/primitives/Card';
+import { Widget } from '@@/Widget';
+import { isErrorType } from '@@/form-components/formikUtils';
+
+import { newPort } from '../utils';
+import {
+  ServiceFormValues,
+  ServicePort,
+  ServicePortIngressPath,
+} from '../types';
+import { ContainerPortInput } from '../components/ContainerPortInput';
+import { ServicePortInput } from '../components/ServicePortInput';
+import { AppIngressPathsForm } from '../ingress/AppIngressPathsForm';
+
+interface Props {
+  services: ServiceFormValues[];
+  serviceIndex: number;
+  onChangeService: (services: ServiceFormValues[]) => void;
+  servicePorts: ServicePort[];
+  onChangePort: (servicePorts: ServicePort[]) => void;
+  serviceName?: string;
+  errors?: string | string[] | FormikErrors<ServicePort>[];
+  namespace?: string;
+  isEditMode?: boolean;
+}
+
+export function ClusterIpServiceForm({
+  services,
+  serviceIndex,
+  onChangeService,
+  servicePorts,
+  onChangePort,
+  errors,
+  serviceName,
+  namespace,
+  isEditMode,
+}: Props) {
+  const newClusterIpPort = newPort(serviceName);
+  return (
+    <Widget key={serviceIndex}>
+      <Widget.Body>
+        <div className="flex justify-between">
+          <div className="text-muted vertical-center">ClusterIP</div>
+          <Button
+            icon={Trash2}
+            data-cy={`remove-service_${serviceIndex}`}
+            color="dangerlight"
+            className="!ml-0"
+            onClick={() => {
+              // remove the service at index in an immutable way
+              const newServices = [
+                ...services.slice(0, serviceIndex),
+                ...services.slice(serviceIndex + 1),
+              ];
+              onChangeService(newServices);
+            }}
+          >
+            Remove service
+          </Button>
+        </div>
+        <div className="control-label !mb-2 !pt-0 text-left">Ports</div>
+        <div className="flex flex-col gap-3">
+          {servicePorts.map((servicePort, portIndex) => {
+            const error = errors?.[portIndex];
+            const servicePortErrors = isErrorType<ServicePort>(error)
+              ? error
+              : undefined;
+            const ingressPathsErrors = isErrorType<ServicePortIngressPath[]>(
+              servicePortErrors?.ingressPaths
+            )
+              ? servicePortErrors?.ingressPaths
+              : undefined;
+
+            return (
+              <Card.Container key={portIndex} variant="filled">
+                <Card.Body className="flex flex-col gap-y-3">
+                  <div className="flex flex-grow flex-wrap justify-between gap-x-4 gap-y-1">
+                    <div className="inline-flex min-w-min flex-grow basis-3/4 flex-wrap gap-x-4 gap-y-1">
+                      <div className="flex min-w-min basis-1/3 flex-col">
+                        <ContainerPortInput
+                          serviceIndex={serviceIndex}
+                          portIndex={portIndex}
+                          value={servicePort.targetPort}
+                          onChange={(e: ChangeEvent<HTMLInputElement>) => {
+                            const newServicePorts = [...servicePorts];
+                            const newValue = e.target.valueAsNumber;
+                            newServicePorts[portIndex] = {
+                              ...newServicePorts[portIndex],
+                              targetPort: newValue,
+                              port: newValue,
+                            };
+                            onChangePort(newServicePorts);
+                          }}
+                        />
+                        {servicePortErrors?.targetPort && (
+                          <FormError>{servicePortErrors.targetPort}</FormError>
+                        )}
+                      </div>
+                      <div className="flex min-w-min basis-1/3 flex-col">
+                        <ServicePortInput
+                          serviceIndex={serviceIndex}
+                          portIndex={portIndex}
+                          value={servicePort.port}
+                          onChange={(e: ChangeEvent<HTMLInputElement>) => {
+                            const newServicePorts = [...servicePorts];
+                            newServicePorts[portIndex] = {
+                              ...newServicePorts[portIndex],
+                              port: e.target.valueAsNumber,
+                            };
+                            onChangePort(newServicePorts);
+                          }}
+                        />
+                        {servicePortErrors?.port && (
+                          <FormError>{servicePortErrors.port}</FormError>
+                        )}
+                      </div>
+                      <ButtonSelector
+                        className="h-[30px]"
+                        onChange={(value) => {
+                          const newServicePorts = [...servicePorts];
+                          newServicePorts[portIndex] = {
+                            ...newServicePorts[portIndex],
+                            protocol: value,
+                          };
+                          onChangePort(newServicePorts);
+                        }}
+                        value={servicePort.protocol || 'TCP'}
+                        options={[{ value: 'TCP' }, { value: 'UDP' }]}
+                      />
+                    </div>
+                    <Button
+                      disabled={servicePorts.length === 1}
+                      size="small"
+                      className="!ml-0 h-[30px]"
+                      color="dangerlight"
+                      type="button"
+                      onClick={() => {
+                        // remove the port at the index in an immutable way
+                        const newServicePorts = [
+                          ...servicePorts.slice(0, portIndex),
+                          ...servicePorts.slice(portIndex + 1),
+                        ];
+                        onChangePort(newServicePorts);
+                      }}
+                      data-cy={`k8sAppCreate-rmPortButton-${serviceIndex}-${portIndex}`}
+                      icon={Trash2}
+                    >
+                      Remove port
+                    </Button>
+                  </div>
+                  <AppIngressPathsForm
+                    servicePortIngressPaths={
+                      servicePorts[portIndex].ingressPaths
+                    }
+                    onChangeIngressPaths={(
+                      ingressPaths?: ServicePortIngressPath[]
+                    ) => {
+                      const newServicePorts = [...servicePorts];
+                      newServicePorts[portIndex].ingressPaths = ingressPaths;
+                      onChangePort(newServicePorts);
+                    }}
+                    namespace={namespace}
+                    ingressPathsErrors={ingressPathsErrors}
+                    serviceIndex={serviceIndex}
+                    portIndex={portIndex}
+                    isEditMode={isEditMode}
+                  />
+                </Card.Body>
+              </Card.Container>
+            );
+          })}
+          <div className="flex">
+            <Button
+              icon={Plus}
+              data-cy={`add-port_${serviceIndex}`}
+              color="default"
+              className="!ml-0"
+              onClick={() => {
+                const newServicesPorts = [...servicePorts, newClusterIpPort];
+                onChangePort(newServicesPorts);
+              }}
+            >
+              Add port
+            </Button>
+          </div>
+        </div>
+      </Widget.Body>
+    </Widget>
+  );
+}
diff --git a/app/react/kubernetes/applications/CreateView/application-services/cluster-ip/ClusterIpServicesForm.tsx b/app/react/kubernetes/applications/CreateView/application-services/cluster-ip/ClusterIpServicesForm.tsx
new file mode 100644
index 0000000..726a9fc
--- /dev/null
+++ b/app/react/kubernetes/applications/CreateView/application-services/cluster-ip/ClusterIpServicesForm.tsx
@@ -0,0 +1,101 @@
+import { Plus } from 'lucide-react';
+import { FormikErrors } from 'formik';
+
+import { Card } from '@@/primitives/Card';
+import { TextTip } from '@@/Tip/TextTip';
+import { Button } from '@@/buttons';
+
+import {
+  generateUniqueName,
+  newPort,
+  serviceFormDefaultValues,
+} from '../utils';
+import { ServiceFormValues, ServicePort } from '../types';
+
+import { ClusterIpServiceForm } from './ClusterIpServiceForm';
+
+interface Props {
+  services: ServiceFormValues[];
+  onChangeService: (services: ServiceFormValues[]) => void;
+  errors?: FormikErrors<ServiceFormValues[]>;
+  appName: string;
+  selector: Record<string, string>;
+  namespace?: string;
+  isEditMode?: boolean;
+}
+
+export function ClusterIpServicesForm({
+  services,
+  onChangeService,
+  errors,
+  appName,
+  selector,
+  namespace,
+  isEditMode,
+}: Props) {
+  const clusterIPServiceCount = services.filter(
+    (service) => service.Type === 'ClusterIP'
+  ).length;
+  return (
+    <Card.Container variant="filled">
+      <Card.Body className="pb-5">
+        <div className="flex flex-col gap-6">
+          <TextTip color="blue">
+            Publish <b>internally</b> in the cluster via a{' '}
+            <b>ClusterIP service</b>, optionally exposing <b>externally</b> to
+            the outside world via an <b>ingress</b>.
+          </TextTip>
+          {clusterIPServiceCount > 0 && (
+            <div className="flex w-full flex-col gap-4">
+              {services.map((service, index) =>
+                service.Type === 'ClusterIP' ? (
+                  <ClusterIpServiceForm
+                    key={index}
+                    serviceName={service.Name}
+                    servicePorts={service.Ports}
+                    errors={errors?.[index]?.Ports}
+                    onChangePort={(servicePorts: ServicePort[]) => {
+                      const newServices = [...services];
+                      newServices[index].Ports = servicePorts;
+                      onChangeService(newServices);
+                    }}
+                    services={services}
+                    serviceIndex={index}
+                    onChangeService={onChangeService}
+                    namespace={namespace}
+                    isEditMode={isEditMode}
+                  />
+                ) : null
+              )}
+            </div>
+          )}
+          <div className="flex">
+            <Button
+              color="secondary"
+              className="!ml-0"
+              icon={Plus}
+              size="small"
+              onClick={() => {
+                // create a new service form value and add it to the list of services
+                const newService = structuredClone(serviceFormDefaultValues);
+                newService.Name = generateUniqueName(
+                  appName,
+                  services.length + 1,
+                  services
+                );
+                newService.Type = 'ClusterIP';
+                const newServicePort = newPort(newService.Name);
+                newService.Ports = [newServicePort];
+                newService.Selector = selector;
+                onChangeService([...services, newService]);
+              }}
+              data-cy="k8sAppCreate-createServiceButton"
+            >
+              Create service
+            </Button>
+          </div>
+        </div>
+      </Card.Body>
+    </Card.Container>
+  );
+}
diff --git a/app/react/kubernetes/applications/CreateView/application-services/components/ContainerPortInput.tsx b/app/react/kubernetes/applications/CreateView/application-services/components/ContainerPortInput.tsx
new file mode 100644
index 0000000..43237f9
--- /dev/null
+++ b/app/react/kubernetes/applications/CreateView/application-services/components/ContainerPortInput.tsx
@@ -0,0 +1,35 @@
+import { ChangeEvent } from 'react';
+
+import { InputGroup } from '@@/form-components/InputGroup';
+
+type Props = {
+  serviceIndex: number;
+  portIndex: number;
+  onChange: (e: ChangeEvent<HTMLInputElement>) => void;
+  value?: number;
+};
+
+export function ContainerPortInput({
+  serviceIndex,
+  portIndex,
+  value,
+  onChange,
+}: Props) {
+  return (
+    <InputGroup size="small">
+      <InputGroup.Addon required>Container port</InputGroup.Addon>
+      <InputGroup.Input
+        type="number"
+        className="form-control min-w-max"
+        name={`container_port_${portIndex}`}
+        placeholder="e.g. 80"
+        min="1"
+        max="65535"
+        value={value ?? ''}
+        onChange={onChange}
+        required
+        data-cy={`k8sAppCreate-containerPort-${serviceIndex}-${portIndex}`}
+      />
+    </InputGroup>
+  );
+}
diff --git a/app/react/kubernetes/applications/CreateView/application-services/components/ServicePortInput.tsx b/app/react/kubernetes/applications/CreateView/application-services/components/ServicePortInput.tsx
new file mode 100644
index 0000000..02ec3c6
--- /dev/null
+++ b/app/react/kubernetes/applications/CreateView/application-services/components/ServicePortInput.tsx
@@ -0,0 +1,35 @@
+import { ChangeEvent } from 'react';
+
+import { InputGroup } from '@@/form-components/InputGroup';
+
+type Props = {
+  serviceIndex: number;
+  portIndex: number;
+  value?: number;
+  onChange: (e: ChangeEvent<HTMLInputElement>) => void;
+};
+
+export function ServicePortInput({
+  serviceIndex,
+  portIndex,
+  value,
+  onChange,
+}: Props) {
+  return (
+    <InputGroup size="small">
+      <InputGroup.Addon required>Service port</InputGroup.Addon>
+      <InputGroup.Input
+        type="number"
+        className="form-control min-w-max"
+        name={`service_port_${portIndex}`}
+        placeholder="e.g. 80"
+        min="1"
+        max="65535"
+        value={value ?? ''}
+        onChange={onChange}
+        required
+        data-cy={`k8sAppCreate-servicePort-${serviceIndex}-${portIndex}`}
+      />
+    </InputGroup>
+  );
+}
diff --git a/app/react/kubernetes/applications/CreateView/application-services/components/ServiceTabLabel.tsx b/app/react/kubernetes/applications/CreateView/application-services/components/ServiceTabLabel.tsx
new file mode 100644
index 0000000..090787b
--- /dev/null
+++ b/app/react/kubernetes/applications/CreateView/application-services/components/ServiceTabLabel.tsx
@@ -0,0 +1,33 @@
+import { AlertTriangle } from 'lucide-react';
+
+import { Badge } from '@@/Badge';
+import { Icon } from '@@/Icon';
+
+type Props = {
+  serviceTypeLabel: string;
+  serviceTypeCount: number;
+  serviceTypeHasErrors: boolean;
+};
+
+export function ServiceTabLabel({
+  serviceTypeLabel,
+  serviceTypeCount,
+  serviceTypeHasErrors,
+}: Props) {
+  return (
+    <div className="inline-flex items-center">
+      {serviceTypeLabel}
+      {serviceTypeCount && (
+        <Badge
+          className="ml-2 flex-none"
+          type={serviceTypeHasErrors ? 'warn' : 'info'}
+        >
+          {serviceTypeHasErrors && (
+            <Icon icon={AlertTriangle} className="!mr-1" />
+          )}
+          {serviceTypeCount}
+        </Badge>
+      )}
+    </div>
+  );
+}
diff --git a/app/react/kubernetes/applications/CreateView/application-services/components/ServiceTabs.tsx b/app/react/kubernetes/applications/CreateView/application-services/components/ServiceTabs.tsx
new file mode 100644
index 0000000..6c05efa
--- /dev/null
+++ b/app/react/kubernetes/applications/CreateView/application-services/components/ServiceTabs.tsx
@@ -0,0 +1,44 @@
+import clsx from 'clsx';
+
+import { ServiceTypeOption, ServiceType } from '../types';
+
+type Props = {
+  serviceTypeOptions: ServiceTypeOption[];
+  selectedServiceType: ServiceType;
+  setSelectedServiceType: (serviceTypeValue: ServiceType) => void;
+};
+
+export function ServiceTabs({
+  serviceTypeOptions,
+  selectedServiceType,
+  setSelectedServiceType,
+}: Props) {
+  return (
+    <div className="flex pl-2">
+      {serviceTypeOptions.map(({ label }, index) => (
+        <label
+          key={index}
+          className={clsx(
+            '!mb-0 inline-flex cursor-pointer items-center gap-2 border-0 border-b-2 border-solid bg-transparent px-4 py-2 font-medium',
+            selectedServiceType === serviceTypeOptions[index].value
+              ? 'border-blue-8 text-blue-8 th-highcontrast:border-blue-6 th-highcontrast:text-blue-6 th-dark:border-blue-6 th-dark:text-blue-6'
+              : 'border-transparent'
+          )}
+        >
+          <input
+            type="radio"
+            data-cy="service-type-radio"
+            name="widget-tabs"
+            className="hidden"
+            value={serviceTypeOptions[index].value}
+            checked={selectedServiceType === serviceTypeOptions[index].value}
+            onChange={(e) =>
+              setSelectedServiceType(e.target.value as ServiceType)
+            }
+          />
+          {label}
+        </label>
+      ))}
+    </div>
+  );
+}
diff --git a/app/react/kubernetes/applications/CreateView/application-services/ingress/AppIngressPathForm.tsx b/app/react/kubernetes/applications/CreateView/application-services/ingress/AppIngressPathForm.tsx
new file mode 100644
index 0000000..6979205
--- /dev/null
+++ b/app/react/kubernetes/applications/CreateView/application-services/ingress/AppIngressPathForm.tsx
@@ -0,0 +1,187 @@
+import { RefreshCw, Trash2 } from 'lucide-react';
+import { useEffect, useMemo, useState } from 'react';
+import { UseQueryResult } from '@tanstack/react-query';
+import { FormikErrors } from 'formik';
+
+import { Ingress } from '@/react/kubernetes/ingresses/types';
+
+import { Select } from '@@/form-components/ReactSelect';
+import { Button } from '@@/buttons';
+import { FormError } from '@@/form-components/FormError';
+import { InputGroup } from '@@/form-components/InputGroup';
+import { Link } from '@@/Link';
+
+import { IngressOption, ServicePortIngressPath } from '../types';
+
+type Props = {
+  ingressPath?: ServicePortIngressPath;
+  ingressPathErrors?: FormikErrors<ServicePortIngressPath>;
+  ingressHostOptions: IngressOption[];
+  onChangeIngressPath: (ingressPath: ServicePortIngressPath) => void;
+  onRemoveIngressPath: () => void;
+  ingressesQuery: UseQueryResult<Ingress[], unknown>;
+  namespace?: string;
+  isEditMode?: boolean;
+};
+
+export function AppIngressPathForm({
+  ingressPath,
+  ingressPathErrors,
+  ingressHostOptions,
+  onChangeIngressPath,
+  onRemoveIngressPath,
+  ingressesQuery,
+  namespace,
+  isEditMode,
+}: Props) {
+  const [selectedIngress, setSelectedIngress] = useState<IngressOption | null>(
+    ingressHostOptions[0] ?? null
+  );
+
+  // if editing allow the current value as an option,
+  // to handle the case where they disallow the ingress class after creating the path
+  const ingressHostOptionsWithCurrentValue = useMemo(() => {
+    if (
+      ingressHostOptions.length === 0 &&
+      ingressPath?.Host &&
+      ingressPath?.IngressName &&
+      isEditMode
+    ) {
+      return [
+        {
+          value: ingressPath.Host,
+          label: ingressPath.Host,
+          ingressName: ingressPath.IngressName,
+        },
+      ];
+    }
+    return ingressHostOptions;
+  }, [
+    ingressHostOptions,
+    ingressPath?.Host,
+    ingressPath?.IngressName,
+    isEditMode,
+  ]);
+
+  // when the hostname options change (e.g. after a namespace change) and the host and ingress is no longer available, update the selected ingress to the first available one
+  useEffect(() => {
+    if (ingressHostOptionsWithCurrentValue) {
+      // some rerenders might not be from a namespace or hostname change so keep the current values if they're still valid
+      const ingressHosts = ingressHostOptionsWithCurrentValue.map(
+        (i) => i.value
+      );
+      const newIngressHostValue = ingressHosts.includes(ingressPath?.Host ?? '')
+        ? ingressPath?.Host
+        : (ingressHosts[0] ?? '');
+      const ingressNames = ingressHostOptionsWithCurrentValue.map(
+        (i) => i.ingressName
+      );
+      const newIngressNameValue = ingressNames.includes(
+        ingressPath?.IngressName ?? ''
+      )
+        ? (ingressPath?.IngressName ?? '')
+        : (ingressNames[0] ?? '');
+
+      const newIngressPath = {
+        ...ingressPath,
+        Host: newIngressHostValue,
+        IngressName: newIngressNameValue,
+      };
+      // the selected option should match the new ingress path
+      const newIngressOption = newIngressPath.Host
+        ? {
+            ingressName: newIngressPath.IngressName,
+            value: newIngressPath.Host ?? '',
+            label: `${newIngressPath.Host} (${newIngressPath.IngressName})`,
+          }
+        : null;
+      onChangeIngressPath(newIngressPath);
+      setSelectedIngress(newIngressOption);
+    }
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [ingressHostOptionsWithCurrentValue]);
+
+  return (
+    <div className="flex w-full flex-wrap gap-x-4 gap-y-1">
+      <div className="flex min-w-[250px] basis-1/3 flex-col">
+        <InputGroup size="small">
+          <InputGroup.Addon>Hostname</InputGroup.Addon>
+          <Select
+            options={ingressHostOptions}
+            value={selectedIngress}
+            defaultValue={ingressHostOptions[0]}
+            placeholder="Select a hostname..."
+            size="sm"
+            onChange={(ingressOption) => {
+              setSelectedIngress(ingressOption);
+              const newIngressPath = {
+                ...ingressPath,
+                Host: ingressOption?.value,
+                IngressName: ingressOption?.ingressName,
+              };
+              onChangeIngressPath(newIngressPath);
+            }}
+            data-cy="k8sAppCreate-ingressPathHostSelect"
+            id="k8sAppCreate-ingressPathHostSelect"
+          />
+          <InputGroup.ButtonWrapper>
+            <Button
+              icon={RefreshCw}
+              color="default"
+              onClick={() => ingressesQuery.refetch()}
+              data-cy="k8sAppCreate-ingressPathHostRefreshButton"
+            />
+          </InputGroup.ButtonWrapper>
+        </InputGroup>
+        {ingressHostOptions.length === 0 && !ingressPath?.Host && (
+          <FormError>
+            No ingress hostnames are available for the namespace &apos;
+            {namespace}&apos;. Please select another namespace or{' '}
+            <Link
+              to="kubernetes.ingresses.create"
+              target="_blank"
+              rel="noopener noreferrer"
+              data-cy="k8sAppCreate-ingressPathCreateIngressLink"
+            >
+              create an ingress
+            </Link>
+            .
+          </FormError>
+        )}
+        {ingressPathErrors?.Host && ingressHostOptions.length > 0 && (
+          <FormError>{ingressPathErrors?.Host}</FormError>
+        )}
+      </div>
+      <div className="flex min-w-[250px] basis-1/3 flex-col">
+        <InputGroup size="small">
+          <InputGroup.Addon required>Path</InputGroup.Addon>
+          <InputGroup.Input
+            value={ingressPath?.Path ?? ''}
+            data-cy={`k8sAppCreate-ingressPathPathInput-${ingressPath?.Host}`}
+            placeholder="/example"
+            onChange={(e) => {
+              const newIngressPath = {
+                ...ingressPath,
+                Path: e.target.value,
+              };
+              onChangeIngressPath(newIngressPath);
+            }}
+          />
+        </InputGroup>
+        {ingressPathErrors?.Path && (
+          <FormError>{ingressPathErrors?.Path}</FormError>
+        )}
+      </div>
+      <div className="flex flex-col">
+        <Button
+          icon={Trash2}
+          color="dangerlight"
+          size="medium"
+          className="!ml-0"
+          onClick={() => onRemoveIngressPath()}
+          data-cy="k8sAppCreate-removeIngressPathButton"
+        />
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/kubernetes/applications/CreateView/application-services/ingress/AppIngressPathsForm.tsx b/app/react/kubernetes/applications/CreateView/application-services/ingress/AppIngressPathsForm.tsx
new file mode 100644
index 0000000..8affd58
--- /dev/null
+++ b/app/react/kubernetes/applications/CreateView/application-services/ingress/AppIngressPathsForm.tsx
@@ -0,0 +1,177 @@
+import { Loader2, Plus } from 'lucide-react';
+import { FormikErrors } from 'formik';
+import { useMemo } from 'react';
+
+import {
+  useIngressControllers,
+  useIngresses,
+} from '@/react/kubernetes/ingresses/queries';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+
+import { FormError } from '@@/form-components/FormError';
+import { Button } from '@@/buttons';
+import { SwitchField } from '@@/form-components/SwitchField';
+import { TextTip } from '@@/Tip/TextTip';
+import { Link } from '@@/Link';
+import { Icon } from '@@/Icon';
+
+import { ServicePortIngressPath } from '../types';
+
+import { AppIngressPathForm } from './AppIngressPathForm';
+
+type Props = {
+  servicePortIngressPaths?: ServicePortIngressPath[];
+  onChangeIngressPaths: (ingressPath: ServicePortIngressPath[]) => void;
+  namespace?: string;
+  ingressPathsErrors?: FormikErrors<ServicePortIngressPath[]>;
+  serviceIndex: number;
+  portIndex: number;
+  isEditMode?: boolean;
+};
+
+export function AppIngressPathsForm({
+  servicePortIngressPaths,
+  onChangeIngressPaths,
+  namespace,
+  ingressPathsErrors,
+  serviceIndex,
+  portIndex,
+  isEditMode,
+}: Props) {
+  const environmentId = useEnvironmentId();
+  const ingressesQuery = useIngresses(environmentId);
+  const { data: ingresses } = ingressesQuery;
+  const { data: ingressControllers, ...ingressControllersQuery } =
+    useIngressControllers(environmentId, namespace);
+
+  // filter for the ingresses that use allowed ingress controllers
+  const allowedIngressHostNameOptions = useMemo(() => {
+    const allowedIngressClasses =
+      ingressControllers
+        ?.filter((ic) => ic.Availability)
+        .map((ic) => ic.ClassName) || [];
+    const allowedIngresses =
+      ingresses?.filter((ing) => {
+        const className = ing.ClassName || 'none';
+        return (
+          allowedIngressClasses.includes(className) &&
+          ing.Namespace === namespace
+        );
+      }) || [];
+    return allowedIngresses.flatMap((ing) =>
+      ing.Hosts?.length
+        ? ing.Hosts.map((host) => ({
+            label: `${host} (${ing.Name})`,
+            value: host,
+            ingressName: ing.Name,
+          }))
+        : []
+    );
+  }, [namespace, ingressControllers, ingresses]);
+
+  if (ingressesQuery.isError || ingressControllersQuery.isError) {
+    return <FormError>Unable to load ingresses.</FormError>;
+  }
+
+  if (ingressesQuery.isLoading || ingressControllersQuery.isLoading) {
+    return (
+      <p className="text-muted mt-2 flex items-center gap-x-2 text-sm">
+        <Icon icon={Loader2} className="animate-spin-slow" />
+        Loading ingresses...
+      </p>
+    );
+  }
+
+  return (
+    <div className="flex flex-col gap-y-4">
+      <div className="!mb-0 flex w-full flex-wrap items-center gap-x-4 gap-y-2">
+        <SwitchField
+          fieldClass="w-max gap-x-8"
+          label="Expose via ingress"
+          tooltip="Expose this ClusterIP service externally using an ingress. This will create a new ingress path for the selected ingress hostname."
+          labelClass="w-max"
+          name="publish-ingress"
+          checked={!!servicePortIngressPaths?.length}
+          onChange={(value) => {
+            const newIngressPathsValue = value
+              ? [
+                  {
+                    Host: allowedIngressHostNameOptions[0]?.value ?? '',
+                    IngressName:
+                      allowedIngressHostNameOptions[0]?.ingressName ?? '',
+                    Path: '',
+                  },
+                ]
+              : [];
+            onChangeIngressPaths(newIngressPathsValue);
+          }}
+          data-cy={`applicationCreate-publishIngress-${serviceIndex}-${portIndex}`}
+        />
+        {!!servicePortIngressPaths?.length && (
+          <TextTip color="blue">
+            Select from available ingresses below, or add new or edit existing
+            ones via the{' '}
+            <Link
+              to="kubernetes.ingresses"
+              target="_blank"
+              rel="noopener noreferrer"
+              data-cy="applicationCreate-ingressesLink"
+            >
+              Ingresses screen
+            </Link>{' '}
+            and then reload the hostname dropdown.
+          </TextTip>
+        )}
+      </div>
+      {ingressesQuery.isSuccess && ingressControllersQuery.isSuccess
+        ? servicePortIngressPaths?.map((ingressPath, index) => (
+            <AppIngressPathForm
+              key={index}
+              ingressPath={ingressPath}
+              ingressPathErrors={ingressPathsErrors?.[index]}
+              ingressHostOptions={allowedIngressHostNameOptions}
+              onChangeIngressPath={(ingressPath: ServicePortIngressPath) => {
+                const newIngressPaths = structuredClone(
+                  servicePortIngressPaths
+                );
+                newIngressPaths[index] = ingressPath;
+                onChangeIngressPaths(newIngressPaths);
+              }}
+              onRemoveIngressPath={() => {
+                const newIngressPaths = structuredClone(
+                  servicePortIngressPaths
+                );
+                newIngressPaths.splice(index, 1);
+                onChangeIngressPaths(newIngressPaths);
+              }}
+              ingressesQuery={ingressesQuery}
+              namespace={namespace}
+              isEditMode={isEditMode}
+            />
+          ))
+        : null}
+      {!!servicePortIngressPaths?.length && (
+        <div className="flex w-full flex-wrap gap-2">
+          <Button
+            icon={Plus}
+            data-cy={`applicationCreate-addIngressPath-${serviceIndex}-${portIndex}`}
+            className="!ml-0"
+            size="small"
+            color="default"
+            onClick={() => {
+              const newIngressPaths = structuredClone(servicePortIngressPaths);
+              newIngressPaths.push({
+                Host: allowedIngressHostNameOptions[0]?.value,
+                IngressName: allowedIngressHostNameOptions[0]?.ingressName,
+                Path: '',
+              });
+              onChangeIngressPaths(newIngressPaths);
+            }}
+          >
+            Add path
+          </Button>
+        </div>
+      )}
+    </div>
+  );
+}
diff --git a/app/react/kubernetes/applications/CreateView/application-services/kubeServicesValidation.ts b/app/react/kubernetes/applications/CreateView/application-services/kubeServicesValidation.ts
new file mode 100644
index 0000000..c9bf2bf
--- /dev/null
+++ b/app/react/kubernetes/applications/CreateView/application-services/kubeServicesValidation.ts
@@ -0,0 +1,302 @@
+import { SchemaOf, array, object, boolean, string, mixed, number } from 'yup';
+
+import { nanNumberSchema } from '@/react-tools/yup-schemas';
+
+import { ServiceFormValues, ServicePort } from './types';
+import { prependWithSlash } from './utils';
+
+// values returned from the angular parent component (pascal case instead of camel case keys),
+// these should match the form values, but don't. Future tech debt work to update this would be nice
+
+// to make the converted values and formValues objects to be the same
+interface NodePortValues {
+  Port: number;
+  TargetPort: number;
+  NodePort: number;
+  Name?: string;
+  Protocol?: string;
+  Ingress?: string;
+}
+
+type ServiceValues = {
+  Type: number;
+  Name: string;
+  Ports: NodePortValues[];
+};
+
+type AngularIngressPath = {
+  IngressName: string;
+  Host: string;
+  Path: string;
+};
+
+type AppServicesValidationData = {
+  nodePortServices: ServiceValues[];
+  formServices: ServiceFormValues[];
+  ingressPaths?: AngularIngressPath[];
+  originalIngressPaths?: AngularIngressPath[];
+};
+
+export function kubeServicesValidation(
+  validationData?: AppServicesValidationData
+): SchemaOf<ServiceFormValues[]> {
+  return array(
+    object({
+      Headless: boolean().required(),
+      Namespace: string(),
+      Name: string(),
+      StackName: string(),
+      Type: mixed().oneOf(['ClusterIP', 'NodePort', 'LoadBalancer']),
+      ClusterIP: string(),
+      ApplicationName: string(),
+      ApplicationOwner: string(),
+      Note: string(),
+      Ingress: boolean().required(),
+      Selector: object(),
+      Ports: array(
+        object({
+          port: nanNumberSchema('Service port number is required.')
+            .required('Service port number is required.')
+            .min(1, 'Service port number must be inside the range 1-65535.')
+            .max(65535, 'Service port number must be inside the range 1-65535.')
+            .test(
+              'service-port-is-unique',
+              'Service port number must be unique.',
+              (servicePort, context) => {
+                // test for duplicate service ports within this service.
+                // yup gives access to context.parent which gives one ServicePort object.
+                // yup also gives access to all form values through this.options.context.
+                // Unfortunately, it doesn't give direct access to all Ports within the current service.
+                // To find all ports in the service for validation, I'm filtering the services by the service name,
+                // that's stored in the ServicePort object, then getting all Ports in the service.
+                if (servicePort === undefined || validationData === undefined) {
+                  return true;
+                }
+                const { formServices } = validationData;
+                const matchingService = getServiceForPort(
+                  context.parent as ServicePort,
+                  formServices
+                );
+                if (matchingService === undefined) {
+                  return true;
+                }
+                const servicePorts = matchingService.Ports;
+                const duplicateServicePortCount = servicePorts.filter(
+                  (port) => port.port === servicePort
+                ).length;
+                return duplicateServicePortCount <= 1;
+              }
+            ),
+          targetPort: nanNumberSchema('Container port number is required.')
+            .required('Container port number is required.')
+            .min(1, 'Container port number must be inside the range 1-65535.')
+            .max(
+              65535,
+              'Container port number must be inside the range 1-65535.'
+            ),
+          name: string(),
+          serviceName: string(),
+          protocol: string(),
+          nodePort: number()
+            .test(
+              'node-port-is-unique-in-service',
+              'Node port is already used in this service.',
+              (nodePort, context) => {
+                if (nodePort === undefined || validationData === undefined) {
+                  return true;
+                }
+                const { formServices } = validationData;
+                const matchingService = getServiceForPort(
+                  context.parent as ServicePort,
+                  formServices
+                );
+                if (
+                  matchingService === undefined ||
+                  matchingService.Type !== 'NodePort'
+                ) {
+                  return true;
+                }
+                const servicePorts = matchingService.Ports;
+                const duplicateNodePortCount = servicePorts.filter(
+                  (port) => port.nodePort === nodePort
+                ).length;
+                return duplicateNodePortCount <= 1;
+              }
+            )
+            .test(
+              'node-port-is-unique-in-cluster',
+              'Node port is already used.',
+              (nodePort, context) => {
+                if (nodePort === undefined || validationData === undefined) {
+                  return true;
+                }
+                const { formServices, nodePortServices } = validationData;
+                const matchingService = getServiceForPort(
+                  context.parent as ServicePort,
+                  formServices
+                );
+
+                if (
+                  matchingService === undefined ||
+                  matchingService.Type !== 'NodePort'
+                ) {
+                  return true;
+                }
+
+                // create a list of all the node ports (number[]) in the cluster, from services that aren't in the application form
+                const formServiceNames = formServices.map(
+                  (formService) => formService.Name
+                );
+                const clusterNodePortsWithoutFormServices = nodePortServices
+                  .filter(
+                    (npService) => !formServiceNames.includes(npService.Name)
+                  )
+                  .flatMap((npService) => npService.Ports)
+                  .map((npServicePorts) => npServicePorts.NodePort);
+                // node ports in the current form, excluding the current service
+                const formNodePortsWithoutCurrentService = formServices
+                  .filter(
+                    (formService) =>
+                      formService.Type === 'NodePort' &&
+                      formService.Name !== matchingService.Name
+                  )
+                  .flatMap((formService) => formService.Ports)
+                  .map((formServicePorts) => formServicePorts.nodePort);
+                return (
+                  // and the node port is not in the current form, excluding the current service
+                  // node port is not in the cluster services that aren't in the application form
+                  !clusterNodePortsWithoutFormServices.includes(nodePort) &&
+                  !formNodePortsWithoutCurrentService.includes(nodePort)
+                );
+              }
+            )
+            .test(
+              'node-port-minimum',
+              'Nodeport number must be inside the range 30000-32767 or blank for system allocated.',
+              (nodePort, context) => {
+                if (nodePort === undefined || validationData === undefined) {
+                  return true;
+                }
+                const { formServices } = validationData;
+                const matchingService = getServiceForPort(
+                  context.parent as ServicePort,
+                  formServices
+                );
+                if (!matchingService || matchingService.Type !== 'NodePort') {
+                  return true;
+                }
+                return nodePort >= 30000;
+              }
+            )
+            .test(
+              'node-port-maximum',
+              'Nodeport number must be inside the range 30000-32767 or blank for system allocated.',
+              (nodePort, context) => {
+                if (nodePort === undefined || validationData === undefined) {
+                  return true;
+                }
+                const { formServices } = validationData;
+                const matchingService = getServiceForPort(
+                  context.parent as ServicePort,
+                  formServices
+                );
+                if (!matchingService || matchingService.Type !== 'NodePort') {
+                  return true;
+                }
+                return nodePort <= 32767;
+              }
+            ),
+          ingressPaths: array(
+            object({
+              IngressName: string().required(),
+              Host: string().required('Ingress hostname is required.'),
+              Path: string()
+                .required('Ingress path is required.')
+                .test(
+                  'path-is-unique',
+                  'Ingress path is already in use for this hostname.',
+                  (path, context) => {
+                    if (
+                      path === undefined ||
+                      validationData === undefined ||
+                      !context.parent.Host
+                    ) {
+                      return true;
+                    }
+                    const ingressHostAndPath = `${
+                      context.parent.Host
+                    }${prependWithSlash(path)}`;
+                    const {
+                      ingressPaths: ingressPathsInNamespace,
+                      formServices,
+                      originalIngressPaths,
+                    } = validationData;
+
+                    // get the count of the same ingressHostAndPath in the current form values
+                    const allFormServicePortIngresses = formServices.flatMap(
+                      (service) =>
+                        service.Ports.flatMap((port) => port.ingressPaths)
+                    );
+                    const formMatchingIngressHostPathCount =
+                      allFormServicePortIngresses
+                        .filter((ingress) => ingress?.Host !== '')
+                        .map(
+                          (ingress) =>
+                            `${ingress?.Host}${prependWithSlash(ingress?.Path)}`
+                        )
+                        .filter(
+                          (formIngressHostAndPath) =>
+                            formIngressHostAndPath === ingressHostAndPath
+                        ).length;
+
+                    // get the count of the same ingressHostAndPath in the namespace and subtract the count from the original form values
+                    const nsMatchingIngressHostPathCount = (
+                      ingressPathsInNamespace ?? []
+                    )
+                      .map(
+                        (ingressPath) =>
+                          `${ingressPath.Host}${ingressPath.Path}`
+                      )
+                      .filter(
+                        (nsIngressHostAndPath) =>
+                          nsIngressHostAndPath === ingressHostAndPath
+                      ).length;
+
+                    // get the count of the same ingressHostAndPath in the original form values
+                    const originalMatchingIngressHostPathCount = (
+                      originalIngressPaths ?? []
+                    )
+                      .map(
+                        (ingressPath) =>
+                          `${ingressPath.Host}${ingressPath.Path}`
+                      )
+                      .filter(
+                        (originalIngressHostAndPath) =>
+                          originalIngressHostAndPath === ingressHostAndPath
+                      ).length;
+
+                    // for the current ingressHostAndPath to be unique, nsMatchingIngressHostPathCount - originalMatchingIngressHostPathCount + formMatchingIngressHostPathCount must be 1 or less.
+                    const pathIsUnique =
+                      formMatchingIngressHostPathCount === 1 &&
+                      nsMatchingIngressHostPathCount -
+                        originalMatchingIngressHostPathCount +
+                        formMatchingIngressHostPathCount <=
+                        1;
+                    return pathIsUnique;
+                  }
+                ),
+            })
+          ),
+        })
+      ),
+      Annotations: array(),
+    })
+  );
+}
+
+function getServiceForPort(
+  servicePort: ServicePort,
+  services: ServiceFormValues[]
+) {
+  return services.find((service) => service.Name === servicePort.serviceName);
+}
diff --git a/app/react/kubernetes/applications/CreateView/application-services/load-balancer/LoadBalancerServiceForm.tsx b/app/react/kubernetes/applications/CreateView/application-services/load-balancer/LoadBalancerServiceForm.tsx
new file mode 100644
index 0000000..be85eac
--- /dev/null
+++ b/app/react/kubernetes/applications/CreateView/application-services/load-balancer/LoadBalancerServiceForm.tsx
@@ -0,0 +1,234 @@
+import { FormikErrors } from 'formik';
+import { ChangeEvent, useRef } from 'react';
+import { Plus, Trash2 } from 'lucide-react';
+
+import { FormError } from '@@/form-components/FormError';
+import { ButtonSelector } from '@@/form-components/ButtonSelector/ButtonSelector';
+import { Button } from '@@/buttons';
+import { Widget } from '@@/Widget';
+import { Card } from '@@/primitives/Card';
+import { InputGroup } from '@@/form-components/InputGroup';
+import { isErrorType } from '@@/form-components/formikUtils';
+
+import { newPort } from '../utils';
+import { ContainerPortInput } from '../components/ContainerPortInput';
+import {
+  ServiceFormValues,
+  ServicePort,
+  ServicePortIngressPath,
+} from '../types';
+import { ServicePortInput } from '../components/ServicePortInput';
+import { AppIngressPathsForm } from '../ingress/AppIngressPathsForm';
+
+interface Props {
+  services: ServiceFormValues[];
+  serviceIndex: number;
+  onChangeService: (services: ServiceFormValues[]) => void;
+  servicePorts: ServicePort[];
+  onChangePort: (servicePorts: ServicePort[]) => void;
+  serviceName?: string;
+  errors?: string | string[] | FormikErrors<ServicePort>[];
+  namespace?: string;
+  isEditMode?: boolean;
+}
+
+export function LoadBalancerServiceForm({
+  services,
+  serviceIndex,
+  onChangeService,
+  servicePorts,
+  onChangePort,
+  errors,
+  serviceName,
+  namespace,
+  isEditMode,
+}: Props) {
+  const newLoadBalancerPort = newPort(serviceName); // If there's initially a ingress path for the service, allow editing it
+  const { current: initiallyHasIngressPath } = useRef(
+    services[serviceIndex].Ports.some((port) => port.ingressPaths?.length)
+  );
+
+  return (
+    <Widget key={serviceIndex}>
+      <Widget.Body>
+        <div className="flex justify-between">
+          <div className="text-muted vertical-center">LoadBalancer</div>
+          <Button
+            icon={Trash2}
+            data-cy={`remove-service-${serviceIndex}`}
+            color="dangerlight"
+            className="!ml-0"
+            onClick={() => {
+              // remove the service at index in an immutable way
+              const newServices = [
+                ...services.slice(0, serviceIndex),
+                ...services.slice(serviceIndex + 1),
+              ];
+              onChangeService(newServices);
+            }}
+          >
+            Remove service
+          </Button>
+        </div>
+        <div className="control-label !mb-2 !pt-0 text-left">Ports</div>
+        <div className="flex flex-col gap-3">
+          {servicePorts.map((servicePort, portIndex) => {
+            const error = errors?.[portIndex];
+            const servicePortErrors = isErrorType<ServicePort>(error)
+              ? error
+              : undefined;
+            const ingressPathsErrors = isErrorType<ServicePortIngressPath[]>(
+              servicePortErrors?.ingressPaths
+            )
+              ? servicePortErrors?.ingressPaths
+              : undefined;
+
+            return (
+              <Card.Container key={portIndex} variant="filled">
+                <Card.Body className="flex flex-col gap-y-3">
+                  <div className="flex flex-grow flex-wrap justify-between gap-x-4 gap-y-1">
+                    <div className="inline-flex min-w-min flex-grow basis-3/4 flex-wrap gap-2">
+                      <div className="flex min-w-min basis-1/4 flex-col">
+                        <ContainerPortInput
+                          serviceIndex={serviceIndex}
+                          portIndex={portIndex}
+                          value={servicePort.targetPort}
+                          onChange={(e: ChangeEvent<HTMLInputElement>) => {
+                            const newServicePorts = [...servicePorts];
+                            const newValue = e.target.valueAsNumber;
+                            newServicePorts[portIndex] = {
+                              ...newServicePorts[portIndex],
+                              targetPort: newValue,
+                              port: newValue,
+                            };
+                            onChangePort(newServicePorts);
+                          }}
+                        />
+                        {servicePortErrors?.targetPort && (
+                          <FormError>{servicePortErrors.targetPort}</FormError>
+                        )}
+                      </div>
+
+                      <div className="flex min-w-min basis-1/4 flex-col">
+                        <ServicePortInput
+                          serviceIndex={serviceIndex}
+                          portIndex={portIndex}
+                          value={servicePort.port}
+                          onChange={(e: ChangeEvent<HTMLInputElement>) => {
+                            const newServicePorts = [...servicePorts];
+                            newServicePorts[portIndex] = {
+                              ...newServicePorts[portIndex],
+                              port: e.target.valueAsNumber,
+                            };
+                            onChangePort(newServicePorts);
+                          }}
+                        />
+                        {servicePortErrors?.port && (
+                          <FormError>{servicePortErrors.port}</FormError>
+                        )}
+                      </div>
+                      <div className="flex min-w-min basis-1/4 flex-col">
+                        <InputGroup size="small">
+                          <InputGroup.Addon required>
+                            Loadbalancer port
+                          </InputGroup.Addon>
+                          <InputGroup.Input
+                            type="number"
+                            className="form-control min-w-max"
+                            name={`loadbalancer_port_${portIndex}`}
+                            placeholder="e.g. 80"
+                            min="1"
+                            max="65535"
+                            value={servicePort.port || ''}
+                            onChange={(e: ChangeEvent<HTMLInputElement>) => {
+                              const newServicePorts = [...servicePorts];
+                              newServicePorts[portIndex] = {
+                                ...newServicePorts[portIndex],
+                                port: e.target.valueAsNumber,
+                              };
+                              onChangePort(newServicePorts);
+                            }}
+                            required
+                            data-cy={`k8sAppCreate-loadbalancerPort_${portIndex}`}
+                          />
+                        </InputGroup>
+                        {servicePortErrors?.nodePort && (
+                          <FormError>{servicePortErrors.nodePort}</FormError>
+                        )}
+                      </div>
+                      <ButtonSelector
+                        className="h-[30px]"
+                        onChange={(value) => {
+                          const newServicePorts = [...servicePorts];
+                          newServicePorts[portIndex] = {
+                            ...newServicePorts[portIndex],
+                            protocol: value,
+                          };
+                          onChangePort(newServicePorts);
+                        }}
+                        value={servicePort.protocol || 'TCP'}
+                        options={[{ value: 'TCP' }, { value: 'UDP' }]}
+                      />
+                    </div>
+                    <Button
+                      disabled={servicePorts.length === 1}
+                      size="small"
+                      className="!ml-0 h-[30px]"
+                      color="dangerlight"
+                      type="button"
+                      onClick={() => {
+                        // remove the port at the index in an immutable way
+                        const newServicePorts = [
+                          ...servicePorts.slice(0, portIndex),
+                          ...servicePorts.slice(portIndex + 1),
+                        ];
+                        onChangePort(newServicePorts);
+                      }}
+                      data-cy={`k8sAppCreate-rmPortButton_${portIndex}`}
+                      icon={Trash2}
+                    >
+                      Remove port
+                    </Button>
+                  </div>
+                  {initiallyHasIngressPath && (
+                    <AppIngressPathsForm
+                      servicePortIngressPaths={
+                        servicePorts[portIndex].ingressPaths
+                      }
+                      onChangeIngressPaths={(
+                        ingressPaths?: ServicePortIngressPath[]
+                      ) => {
+                        const newServicePorts = [...servicePorts];
+                        newServicePorts[portIndex].ingressPaths = ingressPaths;
+                        onChangePort(newServicePorts);
+                      }}
+                      namespace={namespace}
+                      ingressPathsErrors={ingressPathsErrors}
+                      serviceIndex={serviceIndex}
+                      portIndex={portIndex}
+                      isEditMode={isEditMode}
+                    />
+                  )}
+                </Card.Body>
+              </Card.Container>
+            );
+          })}
+          <div className="flex">
+            <Button
+              icon={Plus}
+              data-cy={`k8sAppCreate-addPortButton_${serviceIndex}`}
+              color="default"
+              className="!ml-0"
+              onClick={() => {
+                const newServicesPorts = [...servicePorts, newLoadBalancerPort];
+                onChangePort(newServicesPorts);
+              }}
+            >
+              Add port
+            </Button>
+          </div>
+        </div>
+      </Widget.Body>
+    </Widget>
+  );
+}
diff --git a/app/react/kubernetes/applications/CreateView/application-services/load-balancer/LoadBalancerServicesForm.tsx b/app/react/kubernetes/applications/CreateView/application-services/load-balancer/LoadBalancerServicesForm.tsx
new file mode 100644
index 0000000..3433bdf
--- /dev/null
+++ b/app/react/kubernetes/applications/CreateView/application-services/load-balancer/LoadBalancerServicesForm.tsx
@@ -0,0 +1,157 @@
+import { Plus, RefreshCw } from 'lucide-react';
+import { FormikErrors } from 'formik';
+
+import { useIsEdgeAdmin } from '@/react/hooks/useUser';
+import { useEnvironment } from '@/react/portainer/environments/queries';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+
+import { Card } from '@@/primitives/Card';
+import { TextTip } from '@@/Tip/TextTip';
+import { Button } from '@@/buttons';
+import { FormError } from '@@/form-components/FormError';
+import { Link } from '@@/Link';
+
+import {
+  generateUniqueName,
+  newPort,
+  serviceFormDefaultValues,
+} from '../utils';
+import { ServiceFormValues, ServicePort } from '../types';
+
+import { LoadBalancerServiceForm } from './LoadBalancerServiceForm';
+
+interface Props {
+  services: ServiceFormValues[];
+  onChangeService: (services: ServiceFormValues[]) => void;
+  errors?: FormikErrors<ServiceFormValues[]>;
+  appName: string;
+  selector: Record<string, string>;
+  namespace?: string;
+  isEditMode?: boolean;
+}
+
+export function LoadBalancerServicesForm({
+  services,
+  onChangeService,
+  errors,
+  appName,
+  selector,
+  namespace,
+  isEditMode,
+}: Props) {
+  const isAdminQuery = useIsEdgeAdmin();
+
+  const environmentId = useEnvironmentId();
+  const { data: loadBalancerEnabled, ...loadBalancerEnabledQuery } =
+    useEnvironment(
+      environmentId,
+      (environment) => environment?.Kubernetes.Configuration.UseLoadBalancer
+    );
+
+  if (isAdminQuery.isLoading) {
+    return null;
+  }
+
+  const { isAdmin } = isAdminQuery;
+
+  const loadBalancerServiceCount = services.filter(
+    (service) => service.Type === 'LoadBalancer'
+  ).length;
+  return (
+    <Card.Container variant="filled">
+      <Card.Body className="pb-5">
+        <div className="flex flex-col gap-6">
+          <TextTip color="blue">
+            Allow access to traffic <b>external</b> to the cluster via a{' '}
+            <b>LoadBalancer service</b>. If running on a cloud platform, this
+            auto provisions a cloud load balancer.
+          </TextTip>
+          {!loadBalancerEnabled && loadBalancerEnabledQuery.isSuccess && (
+            <div className="flex flex-col">
+              <FormError>
+                {isAdmin ? (
+                  <>
+                    Load balancer use is not currently enabled in this cluster.
+                    Configure via{' '}
+                    <Link
+                      to="kubernetes.cluster.setup"
+                      target="_blank"
+                      rel="noopener noreferrer"
+                      data-cy="k8sAppCreate-clusterSetupLink"
+                    >
+                      Cluster Setup
+                    </Link>{' '}
+                    and then refresh this tab
+                  </>
+                ) : (
+                  'Load balancer use is not currently enabled in this cluster, contact your administrator.'
+                )}
+              </FormError>
+              <div className="flex">
+                <Button
+                  icon={RefreshCw}
+                  data-cy="k8sAppCreate-refreshLoadBalancerButton"
+                  color="default"
+                  className="!ml-0"
+                  onClick={() => loadBalancerEnabledQuery.refetch()}
+                >
+                  Refresh
+                </Button>
+              </div>
+            </div>
+          )}
+          {loadBalancerServiceCount > 0 && (
+            <div className="flex w-full flex-col gap-4">
+              {services.map((service, index) =>
+                service.Type === 'LoadBalancer' ? (
+                  <LoadBalancerServiceForm
+                    key={index}
+                    serviceName={service.Name}
+                    servicePorts={service.Ports}
+                    errors={errors?.[index]?.Ports}
+                    onChangePort={(servicePorts: ServicePort[]) => {
+                      const newServices = [...services];
+                      newServices[index].Ports = servicePorts;
+                      onChangeService(newServices);
+                    }}
+                    services={services}
+                    serviceIndex={index}
+                    onChangeService={onChangeService}
+                    namespace={namespace}
+                    isEditMode={isEditMode}
+                  />
+                ) : null
+              )}
+            </div>
+          )}
+          <div className="flex">
+            <Button
+              color="secondary"
+              className="!ml-0"
+              icon={Plus}
+              size="small"
+              onClick={() => {
+                // create a new service form value and add it to the list of services
+                const newService = structuredClone(serviceFormDefaultValues);
+                newService.Name = generateUniqueName(
+                  appName,
+                  services.length + 1,
+                  services
+                );
+                newService.Type = 'LoadBalancer';
+                const newServicePort = newPort(newService.Name);
+                newService.Ports = [newServicePort];
+                newService.Selector = selector;
+                onChangeService([...services, newService]);
+              }}
+              disabled={!loadBalancerEnabled}
+              data-cy="k8sAppCreate-createServiceButton"
+            >
+              Create service
+            </Button>
+          </div>
+        </div>
+      </Card.Body>
+    </Card.Container>
+  );
+}
diff --git a/app/react/kubernetes/applications/CreateView/application-services/node-port/NodePortServiceForm.tsx b/app/react/kubernetes/applications/CreateView/application-services/node-port/NodePortServiceForm.tsx
new file mode 100644
index 0000000..c000053
--- /dev/null
+++ b/app/react/kubernetes/applications/CreateView/application-services/node-port/NodePortServiceForm.tsx
@@ -0,0 +1,235 @@
+import { FormikErrors } from 'formik';
+import { ChangeEvent, useRef } from 'react';
+import { Plus, Trash2 } from 'lucide-react';
+
+import { FormError } from '@@/form-components/FormError';
+import { ButtonSelector } from '@@/form-components/ButtonSelector/ButtonSelector';
+import { Button } from '@@/buttons';
+import { Widget } from '@@/Widget';
+import { Card } from '@@/primitives/Card';
+import { InputGroup } from '@@/form-components/InputGroup';
+import { isErrorType } from '@@/form-components/formikUtils';
+
+import { newPort } from '../utils';
+import { ContainerPortInput } from '../components/ContainerPortInput';
+import {
+  ServiceFormValues,
+  ServicePort,
+  ServicePortIngressPath,
+} from '../types';
+import { ServicePortInput } from '../components/ServicePortInput';
+import { AppIngressPathsForm } from '../ingress/AppIngressPathsForm';
+
+interface Props {
+  services: ServiceFormValues[];
+  serviceIndex: number;
+  onChangeService: (services: ServiceFormValues[]) => void;
+  servicePorts: ServicePort[];
+  onChangePort: (servicePorts: ServicePort[]) => void;
+  serviceName?: string;
+  errors?: string | string[] | FormikErrors<ServicePort>[];
+  namespace?: string;
+  isEditMode?: boolean;
+}
+
+export function NodePortServiceForm({
+  services,
+  serviceIndex,
+  onChangeService,
+  servicePorts,
+  onChangePort,
+  errors,
+  serviceName,
+  namespace,
+  isEditMode,
+}: Props) {
+  const newNodePortPort = newPort(serviceName);
+  // If there's initially a ingress path for the service, allow editing it
+  const { current: initiallyHasIngressPath } = useRef(
+    services[serviceIndex].Ports.some((port) => port.ingressPaths?.length)
+  );
+
+  return (
+    <Widget key={serviceIndex}>
+      <Widget.Body>
+        <div className="flex justify-between">
+          <div className="text-muted vertical-center">NodePort</div>
+          <Button
+            icon={Trash2}
+            data-cy={`remove-service-${serviceIndex}`}
+            color="dangerlight"
+            className="!ml-0"
+            onClick={() => {
+              // remove the service at index in an immutable way
+              const newServices = [
+                ...services.slice(0, serviceIndex),
+                ...services.slice(serviceIndex + 1),
+              ];
+              onChangeService(newServices);
+            }}
+          >
+            Remove service
+          </Button>
+        </div>
+        <div className="control-label !mb-2 !pt-0 text-left">Ports</div>
+        <div className="flex flex-col gap-3">
+          {servicePorts.map((servicePort, portIndex) => {
+            const error = errors?.[portIndex];
+            const servicePortErrors = isErrorType<ServicePort>(error)
+              ? error
+              : undefined;
+            const ingressPathsErrors = isErrorType<ServicePortIngressPath[]>(
+              servicePortErrors?.ingressPaths
+            )
+              ? servicePortErrors?.ingressPaths
+              : undefined;
+
+            return (
+              <Card.Container key={portIndex} variant="filled">
+                <Card.Body className="flex flex-col gap-y-3">
+                  <div className="flex flex-grow flex-wrap justify-between gap-x-4 gap-y-1">
+                    <div className="inline-flex min-w-min flex-grow basis-3/4 flex-wrap gap-2">
+                      <div className="flex min-w-min basis-1/4 flex-col">
+                        <ContainerPortInput
+                          serviceIndex={serviceIndex}
+                          portIndex={portIndex}
+                          value={servicePort.targetPort}
+                          onChange={(e: ChangeEvent<HTMLInputElement>) => {
+                            const newServicePorts = [...servicePorts];
+                            const newValue = e.target.valueAsNumber;
+                            newServicePorts[portIndex] = {
+                              ...newServicePorts[portIndex],
+                              targetPort: newValue,
+                              port: newValue,
+                            };
+                            onChangePort(newServicePorts);
+                          }}
+                        />
+                        {servicePortErrors?.targetPort && (
+                          <FormError>{servicePortErrors.targetPort}</FormError>
+                        )}
+                      </div>
+
+                      <div className="flex min-w-min basis-1/4 flex-col">
+                        <ServicePortInput
+                          serviceIndex={serviceIndex}
+                          portIndex={portIndex}
+                          value={servicePort.port}
+                          onChange={(e: ChangeEvent<HTMLInputElement>) => {
+                            const newServicePorts = [...servicePorts];
+                            newServicePorts[portIndex] = {
+                              ...newServicePorts[portIndex],
+                              port: e.target.valueAsNumber,
+                            };
+                            onChangePort(newServicePorts);
+                          }}
+                        />
+                        {servicePortErrors?.port && (
+                          <FormError>{servicePortErrors.port}</FormError>
+                        )}
+                      </div>
+                      <div className="flex min-w-min basis-1/4 flex-col">
+                        <InputGroup size="small">
+                          <InputGroup.Addon>Nodeport</InputGroup.Addon>
+                          <InputGroup.Input
+                            type="number"
+                            className="form-control min-w-max"
+                            name={`node_port_${portIndex}`}
+                            placeholder="e.g. 30080"
+                            min="30000"
+                            max="32767"
+                            value={servicePort.nodePort ?? ''}
+                            onChange={(e: ChangeEvent<HTMLInputElement>) => {
+                              const newServicePorts = [...servicePorts];
+                              newServicePorts[portIndex] = {
+                                ...newServicePorts[portIndex],
+                                nodePort:
+                                  e.target.value === ''
+                                    ? undefined
+                                    : Number(e.target.value),
+                              };
+                              onChangePort(newServicePorts);
+                            }}
+                            data-cy={`k8sAppCreate-nodePort_${portIndex}`}
+                          />
+                        </InputGroup>
+                        {servicePortErrors?.nodePort && (
+                          <FormError>{servicePortErrors.nodePort}</FormError>
+                        )}
+                      </div>
+                      <ButtonSelector
+                        className="h-[30px]"
+                        onChange={(value) => {
+                          const newServicePorts = [...servicePorts];
+                          newServicePorts[portIndex] = {
+                            ...newServicePorts[portIndex],
+                            protocol: value,
+                          };
+                          onChangePort(newServicePorts);
+                        }}
+                        value={servicePort.protocol || 'TCP'}
+                        options={[{ value: 'TCP' }, { value: 'UDP' }]}
+                      />
+                    </div>
+                    <Button
+                      disabled={servicePorts.length === 1}
+                      size="small"
+                      className="!ml-0 h-[30px]"
+                      color="dangerlight"
+                      type="button"
+                      onClick={() => {
+                        // remove the port at the index in an immutable way
+                        const newServicePorts = [
+                          ...servicePorts.slice(0, portIndex),
+                          ...servicePorts.slice(portIndex + 1),
+                        ];
+                        onChangePort(newServicePorts);
+                      }}
+                      data-cy={`k8sAppCreate-rmPortButton_${portIndex}`}
+                      icon={Trash2}
+                    >
+                      Remove port
+                    </Button>
+                  </div>
+                  {initiallyHasIngressPath && (
+                    <AppIngressPathsForm
+                      servicePortIngressPaths={
+                        servicePorts[portIndex].ingressPaths
+                      }
+                      onChangeIngressPaths={(
+                        ingressPaths?: ServicePortIngressPath[]
+                      ) => {
+                        const newServicePorts = [...servicePorts];
+                        newServicePorts[portIndex].ingressPaths = ingressPaths;
+                        onChangePort(newServicePorts);
+                      }}
+                      namespace={namespace}
+                      ingressPathsErrors={ingressPathsErrors}
+                      serviceIndex={serviceIndex}
+                      portIndex={portIndex}
+                      isEditMode={isEditMode}
+                    />
+                  )}
+                </Card.Body>
+              </Card.Container>
+            );
+          })}
+          <div className="flex">
+            <Button
+              icon={Plus}
+              data-cy={`k8sAppCreate-addNodePortButton_${serviceIndex}`}
+              color="default"
+              className="!ml-0"
+              onClick={() => {
+                const newServicesPorts = [...servicePorts, newNodePortPort];
+                onChangePort(newServicesPorts);
+              }}
+            >
+              Add port
+            </Button>
+          </div>
+        </div>
+      </Widget.Body>
+    </Widget>
+  );
+}
diff --git a/app/react/kubernetes/applications/CreateView/application-services/node-port/NodePortServicesForm.tsx b/app/react/kubernetes/applications/CreateView/application-services/node-port/NodePortServicesForm.tsx
new file mode 100644
index 0000000..c44d01c
--- /dev/null
+++ b/app/react/kubernetes/applications/CreateView/application-services/node-port/NodePortServicesForm.tsx
@@ -0,0 +1,101 @@
+import { FormikErrors } from 'formik';
+import { Plus } from 'lucide-react';
+
+import { Card } from '@@/primitives/Card';
+import { TextTip } from '@@/Tip/TextTip';
+import { Button } from '@@/buttons';
+
+import {
+  serviceFormDefaultValues,
+  generateUniqueName,
+  newPort,
+} from '../utils';
+import { ServiceFormValues, ServicePort } from '../types';
+
+import { NodePortServiceForm } from './NodePortServiceForm';
+
+interface Props {
+  services: ServiceFormValues[];
+  onChangeService: (services: ServiceFormValues[]) => void;
+  errors?: FormikErrors<ServiceFormValues[]>;
+  appName: string;
+  selector: Record<string, string>;
+  namespace?: string;
+  isEditMode?: boolean;
+}
+
+export function NodePortServicesForm({
+  services,
+  onChangeService,
+  errors,
+  appName,
+  selector,
+  namespace,
+  isEditMode,
+}: Props) {
+  const nodePortServiceCount = services.filter(
+    (service) => service.Type === 'NodePort'
+  ).length;
+  return (
+    <Card.Container variant="filled">
+      <Card.Body className="pb-5">
+        <div className="flex flex-col gap-6">
+          <TextTip color="blue">
+            Allow access to traffic <b>external</b> to the cluster via a{' '}
+            <b>NodePort service</b>. Not generally recommended for Production
+            use.
+          </TextTip>
+          {nodePortServiceCount > 0 && (
+            <div className="flex w-full flex-col gap-4">
+              {services.map((service, index) =>
+                service.Type === 'NodePort' ? (
+                  <NodePortServiceForm
+                    key={index}
+                    serviceName={service.Name}
+                    servicePorts={service.Ports}
+                    errors={errors?.[index]?.Ports}
+                    onChangePort={(servicePorts: ServicePort[]) => {
+                      const newServices = [...services];
+                      newServices[index].Ports = servicePorts;
+                      onChangeService(newServices);
+                    }}
+                    services={services}
+                    serviceIndex={index}
+                    onChangeService={onChangeService}
+                    namespace={namespace}
+                    isEditMode={isEditMode}
+                  />
+                ) : null
+              )}
+            </div>
+          )}
+          <div className="flex">
+            <Button
+              color="secondary"
+              className="!ml-0"
+              icon={Plus}
+              size="small"
+              onClick={() => {
+                // create a new service form value and add it to the list of services
+                const newService = structuredClone(serviceFormDefaultValues);
+                newService.Name = generateUniqueName(
+                  appName,
+                  services.length + 1,
+                  services
+                );
+                newService.Type = 'NodePort';
+                const newServicePort = newPort(newService.Name);
+                newService.Ports = [newServicePort];
+                newService.Selector = selector;
+                onChangeService([...services, newService]);
+              }}
+              data-cy="k8sAppCreate-createServiceButton"
+            >
+              Create service
+            </Button>
+          </div>
+        </div>
+      </Card.Body>
+    </Card.Container>
+  );
+}
diff --git a/app/react/kubernetes/applications/CreateView/application-services/types.ts b/app/react/kubernetes/applications/CreateView/application-services/types.ts
new file mode 100644
index 0000000..2a6ed62
--- /dev/null
+++ b/app/react/kubernetes/applications/CreateView/application-services/types.ts
@@ -0,0 +1,44 @@
+import { ReactNode } from 'react';
+
+export interface ServicePort {
+  port: number;
+  targetPort?: number;
+  nodePort?: number;
+  serviceName?: string;
+  name?: string;
+  protocol?: string;
+  ingressPaths?: ServicePortIngressPath[];
+}
+
+export type ServicePortIngressPath = {
+  IngressName?: string;
+  Host?: string;
+  Path?: string;
+};
+
+export type ServiceFormValues = {
+  Headless: boolean;
+  Ports: ServicePort[];
+  Type: ServiceType;
+  Ingress: boolean;
+  ClusterIP?: string;
+  ApplicationName?: string;
+  ApplicationOwner?: string;
+  Note?: string;
+  Name?: string;
+  StackName?: string;
+  Selector?: Record<string, string>;
+  Namespace?: string;
+};
+
+export type ServiceType = 'ClusterIP' | 'NodePort' | 'LoadBalancer';
+export type ServiceTypeOption = {
+  value: ServiceType;
+  label: ReactNode;
+};
+
+export type IngressOption = {
+  label: string;
+  value: string;
+  ingressName: string;
+};
diff --git a/app/react/kubernetes/applications/CreateView/application-services/utils.ts b/app/react/kubernetes/applications/CreateView/application-services/utils.ts
new file mode 100644
index 0000000..160b972
--- /dev/null
+++ b/app/react/kubernetes/applications/CreateView/application-services/utils.ts
@@ -0,0 +1,217 @@
+import { compare } from 'fast-json-patch';
+import { Service, ServiceSpec } from 'kubernetes-types/core/v1';
+import { ObjectMeta } from 'kubernetes-types/meta/v1';
+
+import { Ingress as IngressFormValues } from '@/react/kubernetes/ingresses/types';
+
+import {
+  appNameLabel,
+  appOwnerLabel,
+  appStackNameLabel,
+} from '../../constants';
+
+import { ServiceFormValues, ServicePort } from './types';
+
+export function newPort(serviceName?: string): ServicePort {
+  return {
+    port: 80,
+    targetPort: undefined,
+    name: '',
+    protocol: 'TCP',
+    nodePort: undefined,
+    serviceName,
+  };
+}
+
+function generateIndexedName(appName: string, index: number) {
+  return index === 0 ? appName : `${appName}-${index}`;
+}
+
+function isNameUnique(name: string, services: ServiceFormValues[]) {
+  return !services.find((service) => service.Name === name);
+}
+
+export function generateUniqueName(
+  appName: string,
+  index: number,
+  services: ServiceFormValues[]
+) {
+  let initialIndex = index;
+  let uniqueName = appName;
+
+  while (!isNameUnique(uniqueName, services)) {
+    uniqueName = generateIndexedName(appName, initialIndex);
+    initialIndex++;
+  }
+
+  return uniqueName;
+}
+
+export const serviceFormDefaultValues: ServiceFormValues = {
+  Headless: false,
+  Namespace: '',
+  Name: '',
+  StackName: '',
+  Ports: [],
+  Type: 'ClusterIP',
+  ClusterIP: '',
+  ApplicationName: '',
+  ApplicationOwner: '',
+  Note: '',
+  Ingress: false,
+  Selector: {},
+};
+
+/**
+ * Generates new Ingress objects from form path data
+ * @param {IngressFormValues[]} oldIngresses - The old Ingress objects
+ * @param {ServicePort[]} newServicesPorts - The new ServicePort objects from the form
+ * @param {ServicePort[]} oldServicesPorts - The old ServicePort objects
+ * @returns {IngressFormValues[]} The new Ingress objects
+ */
+export function generateNewIngressesFromFormPaths(
+  oldIngresses?: IngressFormValues[],
+  newServicesPorts?: ServicePort[],
+  oldServicesPorts?: ServicePort[]
+): IngressFormValues[] {
+  // filter the ports to only the ones that have an ingress
+  const oldIngressPaths = oldServicesPorts
+    ?.flatMap((port) => port.ingressPaths)
+    .filter((ingressPath) => ingressPath?.IngressName);
+  const newPortsWithIngress = newServicesPorts?.filter(
+    (port) => port.ingressPaths?.length
+  );
+  // return early if possible
+  if (!oldIngresses && !newPortsWithIngress) {
+    return [];
+  }
+
+  // remove the old paths from the newIngresses copy
+  const newIngresses = structuredClone(oldIngresses) ?? [];
+  oldIngressPaths?.forEach((oldIngressPath) => {
+    if (!oldIngressPath?.Path) return;
+    const newMatchingIng = newIngresses?.find(
+      (ingress) => ingress.Name === oldIngressPath.IngressName
+    );
+    if (!newMatchingIng) return;
+
+    // remove the old path from the new ingress
+    const oldPathIndex = newMatchingIng?.Paths?.findIndex(
+      (path) =>
+        path.Path === prependWithSlash(oldIngressPath.Path) &&
+        path.Host === oldIngressPath.Host
+    );
+    if (oldPathIndex === -1 || oldPathIndex === undefined) return;
+    if (newMatchingIng.Paths) {
+      newMatchingIng.Paths = [
+        ...newMatchingIng.Paths.slice(0, oldPathIndex),
+        ...newMatchingIng.Paths.slice(oldPathIndex + 1),
+      ];
+    }
+
+    // update the new ingresses with the newMatchingIng
+    const newIngIndex = newIngresses.findIndex(
+      (ingress) => ingress.Name === newMatchingIng.Name
+    );
+    newIngresses[newIngIndex] = newMatchingIng;
+  });
+
+  // and add the new paths to return the updated ingresses
+  newPortsWithIngress?.forEach(
+    ({ ingressPaths: newIngresspaths, ...servicePort }) => {
+      newIngresspaths?.forEach((newIngressPath) => {
+        if (!newIngressPath?.Path) return;
+        const newMatchingIng = newIngresses.find(
+          (ingress) => ingress.Name === newIngressPath?.IngressName
+        );
+        if (!newMatchingIng) return;
+
+        // add the new path to the new ingress
+        if (
+          newIngressPath.Host &&
+          newIngressPath.IngressName &&
+          servicePort.serviceName &&
+          servicePort.port
+        ) {
+          newMatchingIng.Paths = [
+            ...(newMatchingIng.Paths ?? []),
+            {
+              Path: prependWithSlash(newIngressPath.Path),
+              Host: newIngressPath.Host,
+              IngressName: newIngressPath.IngressName,
+              ServiceName: servicePort.serviceName,
+              Port: servicePort.port,
+              PathType: 'Prefix',
+            },
+          ];
+        }
+        // update the new ingresses with the newMatchingIng
+        const newIngIndex = newIngresses.findIndex(
+          (ingress) => ingress.Name === newMatchingIng.Name
+        );
+        newIngresses[newIngIndex] = newMatchingIng;
+      });
+    }
+  );
+  return newIngresses;
+}
+
+/** prependWithSlash puts a '/' in front of a string if there isn't one there already. If the string is empty, it stays empty */
+export function prependWithSlash(path?: string) {
+  if (!path) return '';
+  return path.startsWith('/') ? path : `/${path}`;
+}
+
+export function getServicePatchPayload(
+  oldService: ServiceFormValues,
+  newService: ServiceFormValues
+) {
+  const oldPayload = getServicePayload(oldService);
+  const newPayload = getServicePayload(newService);
+
+  const payload = compare(oldPayload, newPayload);
+  return payload;
+}
+
+function getServicePayload(service: ServiceFormValues): Service {
+  if (!service.Name || !service.Namespace) {
+    throw new Error('Service name and namespace are required');
+  }
+
+  // metadata
+  const labels: Record<string, string> = {};
+  if (service.ApplicationName) {
+    labels[appNameLabel] = service.ApplicationName;
+  }
+  if (service.ApplicationOwner) {
+    labels[appOwnerLabel] = service.ApplicationOwner;
+  }
+  if (service.StackName) {
+    labels[appStackNameLabel] = service.StackName;
+  }
+  const metadata: ObjectMeta = {
+    name: service.Name,
+    namespace: service.Namespace,
+    labels,
+  };
+
+  // spec
+  const ports = service.Headless ? [] : service.Ports;
+  const selector = service.Selector;
+  const clusterIP = service.Headless ? 'None' : service.ClusterIP;
+  const type = service.Headless ? 'ClusterIP' : service.Type;
+  const spec: ServiceSpec = {
+    ports,
+    selector,
+    clusterIP,
+    type,
+  };
+
+  const servicePayload: Service = {
+    apiVersion: 'v1',
+    kind: 'Service',
+    metadata,
+    spec,
+  };
+  return servicePayload;
+}
diff --git a/app/react/kubernetes/applications/DetailsView/AppYAMLEditor/ApplicationYAMLEditor.tsx b/app/react/kubernetes/applications/DetailsView/AppYAMLEditor/ApplicationYAMLEditor.tsx
new file mode 100644
index 0000000..818b063
--- /dev/null
+++ b/app/react/kubernetes/applications/DetailsView/AppYAMLEditor/ApplicationYAMLEditor.tsx
@@ -0,0 +1,45 @@
+import { InlineLoader } from '@@/InlineLoader';
+import { Widget } from '@@/Widget/Widget';
+import { WidgetBody } from '@@/Widget';
+
+import { YAMLInspector } from '../../../components/YAMLInspector';
+
+import { useApplicationYAML } from './useApplicationYAML';
+
+// the yaml currently has the yaml from the app, related services and horizontal pod autoscalers
+// TODO: this could be extended to include other related resources like ingresses, etc.
+export function ApplicationYAMLEditor() {
+  const { fullApplicationYaml, isApplicationYAMLLoading } =
+    useApplicationYAML();
+
+  if (isApplicationYAMLLoading) {
+    return (
+      <div className="row">
+        <div className="col-sm-12">
+          <Widget>
+            <WidgetBody>
+              <InlineLoader>Loading application YAML...</InlineLoader>
+            </WidgetBody>
+          </Widget>
+        </div>
+      </div>
+    );
+  }
+
+  return (
+    <div className="row">
+      <div className="col-sm-12">
+        <Widget>
+          <WidgetBody>
+            <YAMLInspector
+              identifier="application-yaml"
+              data={fullApplicationYaml}
+              hideMessage
+              data-cy="application-yaml"
+            />
+          </WidgetBody>
+        </Widget>
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/kubernetes/applications/DetailsView/AppYAMLEditor/useApplicationYAML.ts b/app/react/kubernetes/applications/DetailsView/AppYAMLEditor/useApplicationYAML.ts
new file mode 100644
index 0000000..f8cadbb
--- /dev/null
+++ b/app/react/kubernetes/applications/DetailsView/AppYAMLEditor/useApplicationYAML.ts
@@ -0,0 +1,84 @@
+import { useCurrentStateAndParams } from '@uirouter/react';
+import { useMemo } from 'react';
+
+import { useServicesQuery } from '@/react/kubernetes/services/service';
+
+import { useHorizontalPodAutoScaler } from '../../queries/useHorizontalPodAutoScaler';
+import { useApplication } from '../../queries/useApplication';
+import { useApplicationServices } from '../../queries/useApplicationServices';
+import { useApplicationHorizontalPodAutoscaler } from '../../queries/useApplicationHorizontalPodAutoscaler';
+
+export function useApplicationYAML() {
+  const {
+    params: {
+      namespace,
+      name,
+      'resource-type': resourceType,
+      endpointId: environmentId,
+    },
+  } = useCurrentStateAndParams();
+  // find the application and the yaml for it
+  const { data: application, ...applicationQuery } = useApplication(
+    environmentId,
+    namespace,
+    name,
+    resourceType
+  );
+  const { data: applicationYAML, ...applicationYAMLQuery } =
+    useApplication<string>(environmentId, namespace, name, resourceType, {
+      yaml: true,
+    });
+
+  // find the matching services, then get the yaml for them
+  const { data: services, ...servicesQuery } = useApplicationServices(
+    environmentId,
+    namespace,
+    name,
+    application
+  );
+  const serviceNames =
+    services?.flatMap((service) => service.metadata?.name || []) || [];
+  const { data: servicesYAML, ...servicesYAMLQuery } = useServicesQuery<string>(
+    environmentId,
+    namespace,
+    serviceNames,
+    { yaml: true }
+  );
+
+  // find the matching autoscalar, then get the yaml for it
+  const { data: autoScalar, ...autoScalarsQuery } =
+    useApplicationHorizontalPodAutoscaler(
+      environmentId,
+      namespace,
+      name,
+      application
+    );
+  const { data: autoScalarYAML, ...autoScalarYAMLQuery } =
+    useHorizontalPodAutoScaler<string>(
+      environmentId,
+      namespace,
+      autoScalar?.metadata?.name || '',
+      { yaml: true }
+    );
+
+  const fullApplicationYaml = useMemo(() => {
+    const yamlArray = [
+      applicationYAML,
+      ...(servicesYAML || []),
+      autoScalarYAML,
+    ].flatMap((yaml) => yaml || []);
+
+    const yamlString = yamlArray.join('\n---\n');
+    return yamlString;
+  }, [applicationYAML, autoScalarYAML, servicesYAML]);
+
+  const isApplicationYAMLLoading =
+    applicationQuery.isInitialLoading ||
+    servicesQuery.isInitialLoading ||
+    autoScalarsQuery.isInitialLoading ||
+    applicationYAMLQuery.isInitialLoading ||
+    servicesYAMLQuery.isInitialLoading ||
+    autoScalarYAMLQuery.isInitialLoading;
+
+  return { fullApplicationYaml, isApplicationYAMLLoading };
+}
diff --git a/app/react/kubernetes/applications/DetailsView/ApplicationContainersDatatable/ApplicationContainersDatatable.test.tsx b/app/react/kubernetes/applications/DetailsView/ApplicationContainersDatatable/ApplicationContainersDatatable.test.tsx
new file mode 100644
index 0000000..005056b
--- /dev/null
+++ b/app/react/kubernetes/applications/DetailsView/ApplicationContainersDatatable/ApplicationContainersDatatable.test.tsx
@@ -0,0 +1,408 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { HttpResponse } from 'msw';
+import { vi } from 'vitest';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { UserViewModel } from '@/portainer/models/user';
+import { server, http } from '@/setup-tests/server';
+import { mockLocalizeDate } from '@/setup-tests/mock-localizeDate';
+
+import { confirmDelete } from '@@/modals/confirm';
+
+import { ApplicationContainersDatatable } from './ApplicationContainersDatatable';
+
+const mockUseCurrentStateAndParams = vi.fn();
+const mockUseEnvironmentId = vi.fn();
+
+mockLocalizeDate();
+
+vi.mock('@uirouter/react', async (importOriginal: () => Promise<object>) => ({
+  ...(await importOriginal()),
+  useCurrentStateAndParams: () => mockUseCurrentStateAndParams(),
+}));
+
+vi.mock('@/react/hooks/useEnvironmentId', () => ({
+  useEnvironmentId: () => mockUseEnvironmentId(),
+}));
+
+vi.mock('@@/Link', () => ({
+  Link: ({
+    children,
+    to,
+    ...rest
+  }: {
+    children: React.ReactNode;
+    to: string;
+    [key: string]: unknown;
+  }) => (
+    <a
+      href={`#${to}`}
+      {...(rest as React.AnchorHTMLAttributes<HTMLAnchorElement>)}
+    >
+      {children}
+    </a>
+  ),
+}));
+
+vi.mock('@@/modals/confirm', () => ({
+  confirmDelete: vi.fn(),
+}));
+
+const mockDeployment = {
+  kind: 'Deployment',
+  apiVersion: 'apps/v1',
+  metadata: {
+    name: 'test-app',
+    namespace: 'test-namespace',
+  },
+  spec: {
+    selector: {
+      matchLabels: { app: 'test-app' },
+    },
+    replicas: 1,
+  },
+  status: { replicas: 1, readyReplicas: 1 },
+};
+
+const mockPod = {
+  kind: 'Pod',
+  apiVersion: 'v1',
+  metadata: { name: 'test-pod-1', namespace: 'test-namespace' },
+  spec: {
+    nodeName: 'node-1',
+    containers: [
+      {
+        name: 'nginx',
+        image: 'nginx:latest',
+        imagePullPolicy: 'Always',
+      },
+    ],
+  },
+  status: {
+    phase: 'Running',
+    podIP: '10.0.0.1',
+    startTime: '2023-01-01T00:00:00Z',
+    containerStatuses: [
+      {
+        name: 'nginx',
+        ready: true,
+        restartCount: 0,
+        image: 'nginx:latest',
+        imageID: 'sha256:abc123',
+        state: { running: { startedAt: '2023-01-01T00:01:00Z' } },
+      },
+    ],
+  },
+};
+
+const mockPodsResponse = {
+  apiVersion: 'v1',
+  kind: 'PodList',
+  items: [mockPod],
+};
+
+const mockKubernetesVersion = {
+  major: '1',
+  minor: '35',
+  gitVersion: 'v1.35.0',
+  gitCommit: 'abc123',
+  gitTreeState: 'clean',
+  buildDate: '2025-01-01T00:00:00Z',
+  goVersion: 'go1.22.0',
+  compiler: 'gc',
+  platform: 'linux/amd64',
+  supportsPodRestart: true,
+};
+
+const mockEnvironment = {
+  Id: 1,
+  Name: 'Test Environment',
+  Type: 1,
+  Kubernetes: {
+    Configuration: { UseServerMetrics: false },
+  },
+};
+
+function renderComponent() {
+  const user = new UserViewModel({ Username: 'user', Role: 1 });
+  const Wrapped = withTestQueryProvider(
+    withUserProvider(
+      withTestRouter(() => <ApplicationContainersDatatable />),
+      user
+    )
+  );
+  return render(<Wrapped />);
+}
+
+describe('ApplicationContainersDatatable', () => {
+  beforeEach(() => {
+    mockUseEnvironmentId.mockReturnValue(1);
+    mockUseCurrentStateAndParams.mockReturnValue({
+      params: {
+        name: 'test-app',
+        namespace: 'test-namespace',
+        'resource-type': 'Deployment',
+      },
+    });
+    vi.mocked(confirmDelete).mockResolvedValue(true);
+
+    server.use(
+      http.get('/api/endpoints/1', () => HttpResponse.json(mockEnvironment)),
+      http.get(
+        '/api/endpoints/1/kubernetes/apis/apps/v1/namespaces/test-namespace/deployments/test-app',
+        () => HttpResponse.json(mockDeployment)
+      ),
+      http.get(
+        '/api/endpoints/1/kubernetes/api/v1/namespaces/test-namespace/pods',
+        () => HttpResponse.json(mockPodsResponse)
+      ),
+      http.get('/api/kubernetes/1/version', () =>
+        HttpResponse.json(mockKubernetesVersion)
+      )
+    );
+  });
+
+  it('renders a row for each pod', async () => {
+    const secondPod = {
+      ...mockPod,
+      metadata: { ...mockPod.metadata, name: 'test-pod-2' },
+    };
+    server.use(
+      http.get(
+        '/api/endpoints/1/kubernetes/api/v1/namespaces/test-namespace/pods',
+        () =>
+          HttpResponse.json({
+            ...mockPodsResponse,
+            items: [mockPod, secondPod],
+          })
+      )
+    );
+
+    renderComponent();
+
+    expect(await screen.findByText('test-pod-1')).toBeVisible();
+    expect(await screen.findByText('test-pod-2')).toBeVisible();
+  });
+
+  it('shows loading state while data is fetching', async () => {
+    server.use(
+      http.get(
+        '/api/endpoints/1/kubernetes/apis/apps/v1/namespaces/test-namespace/deployments/test-app',
+        () => new Promise(() => {})
+      )
+    );
+
+    renderComponent();
+
+    expect(await screen.findByText('Loading...')).toBeVisible();
+  });
+
+  it('shows "No items." when the pod list is empty', async () => {
+    server.use(
+      http.get(
+        '/api/endpoints/1/kubernetes/api/v1/namespaces/test-namespace/pods',
+        () => HttpResponse.json({ ...mockPodsResponse, items: [] })
+      )
+    );
+
+    renderComponent();
+
+    await screen.findByText('Application pods');
+    expect(await screen.findByText('No items.')).toBeVisible();
+  });
+
+  it('collapses a pod row to hide its containers', async () => {
+    const user = userEvent.setup();
+    renderComponent();
+
+    await screen.findByText('test-pod-1');
+
+    await user.click(screen.getByRole('button', { name: 'Collapse' }));
+
+    expect(await screen.queryAllByText('nginx')).toStrictEqual([]);
+  });
+
+  it('shows the Init badge for init containers', async () => {
+    const podWithInit = {
+      ...mockPod,
+      spec: {
+        ...mockPod.spec,
+        initContainers: [
+          {
+            name: 'init-setup',
+            image: 'busybox:latest',
+            imagePullPolicy: 'IfNotPresent',
+          },
+        ],
+      },
+      status: {
+        ...mockPod.status,
+        initContainerStatuses: [
+          {
+            name: 'init-setup',
+            ready: true,
+            restartCount: 0,
+            image: 'busybox:latest',
+            imageID: 'sha256:def456',
+            state: {
+              terminated: {
+                exitCode: 0,
+                startedAt: '2023-01-01T00:00:30Z',
+                finishedAt: '2023-01-01T00:00:55Z',
+              },
+            },
+          },
+        ],
+      },
+    };
+    server.use(
+      http.get(
+        '/api/endpoints/1/kubernetes/api/v1/namespaces/test-namespace/pods',
+        () => HttpResponse.json({ ...mockPodsResponse, items: [podWithInit] })
+      )
+    );
+
+    renderComponent();
+
+    await screen.findByText('test-pod-1');
+
+    expect(await screen.findByText('Init')).toBeVisible();
+  });
+
+  it('shows the Sidecar badge for sidecar init containers', async () => {
+    const podWithSidecar = {
+      ...mockPod,
+      spec: {
+        ...mockPod.spec,
+        initContainers: [
+          {
+            name: 'sidecar-proxy',
+            image: 'envoy:latest',
+            imagePullPolicy: 'IfNotPresent',
+            restartPolicy: 'Always',
+          },
+        ],
+      },
+      status: {
+        ...mockPod.status,
+        initContainerStatuses: [
+          {
+            name: 'sidecar-proxy',
+            ready: true,
+            restartCount: 0,
+            image: 'envoy:latest',
+            imageID: 'sha256:ghi789',
+            state: { running: { startedAt: '2023-01-01T00:01:00Z' } },
+          },
+        ],
+      },
+    };
+    server.use(
+      http.get(
+        '/api/endpoints/1/kubernetes/api/v1/namespaces/test-namespace/pods',
+        () =>
+          HttpResponse.json({ ...mockPodsResponse, items: [podWithSidecar] })
+      )
+    );
+
+    renderComponent();
+    await screen.findByText('test-pod-1');
+
+    expect(await screen.findByText('Sidecar')).toBeVisible();
+  });
+
+  it('shows the stats link for running containers when server metrics is enabled', async () => {
+    server.use(
+      http.get('/api/endpoints/1', () =>
+        HttpResponse.json({
+          ...mockEnvironment,
+          Kubernetes: { Configuration: { UseServerMetrics: true } },
+        })
+      )
+    );
+
+    renderComponent();
+
+    await screen.findByText('test-pod-1');
+
+    expect(
+      await screen.findByTestId('application-container-stats-nginx')
+    ).toBeVisible();
+  });
+
+  it('hides the stats link when server metrics is disabled', async () => {
+    renderComponent();
+
+    await screen.findByText('test-pod-1');
+
+    await screen.findByText('nginx');
+    expect(
+      screen.queryByTestId('application-container-stats-nginx')
+    ).not.toBeInTheDocument();
+  });
+
+  it('shows the logs link for a container that has started', async () => {
+    renderComponent();
+
+    await screen.findByText('test-pod-1');
+
+    expect(
+      await screen.findByTestId('application-container-logs-nginx')
+    ).toBeVisible();
+  });
+
+  it('does not render a restart button', async () => {
+    renderComponent();
+
+    await screen.findByText('test-pod-1');
+
+    expect(
+      screen.queryByTestId('application-pod-restart-test-pod-1')
+    ).not.toBeInTheDocument();
+  });
+
+  it('calls the delete API after the user confirms deletion', async () => {
+    let deleteRequested = false;
+    server.use(
+      http.delete(
+        '/api/kubernetes/1/namespaces/test-namespace/pods/test-pod-1',
+        () => {
+          deleteRequested = true;
+          return HttpResponse.json({});
+        }
+      )
+    );
+
+    const user = userEvent.setup();
+    renderComponent();
+
+    await screen.findByText('test-pod-1');
+    await user.click(screen.getByTestId('application-pod-delete-test-pod-1'));
+
+    await waitFor(() => {
+      expect(deleteRequested).toBe(true);
+    });
+  });
+
+  it('always shows the delete button regardless of restart strategy support', async () => {
+    server.use(
+      http.get('/api/kubernetes/1/version', () =>
+        HttpResponse.json({
+          ...mockKubernetesVersion,
+          supportsPodRestart: false,
+        })
+      )
+    );
+
+    renderComponent();
+
+    await screen.findByText('test-pod-1');
+
+    expect(
+      screen.getByTestId('application-pod-delete-test-pod-1')
+    ).toBeInTheDocument();
+  });
+});
diff --git a/app/react/kubernetes/applications/DetailsView/ApplicationContainersDatatable/ApplicationContainersDatatable.tsx b/app/react/kubernetes/applications/DetailsView/ApplicationContainersDatatable/ApplicationContainersDatatable.tsx
new file mode 100644
index 0000000..eb03077
--- /dev/null
+++ b/app/react/kubernetes/applications/DetailsView/ApplicationContainersDatatable/ApplicationContainersDatatable.tsx
@@ -0,0 +1,186 @@
+import { Server } from 'lucide-react';
+import { useCurrentStateAndParams } from '@uirouter/react';
+import { useMemo } from 'react';
+import { Pod } from 'kubernetes-types/core/v1';
+
+import { IndexOptional } from '@/react/kubernetes/configs/types';
+import { createStore } from '@/react/kubernetes/datatables/default-kube-datatable-store';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useEnvironment } from '@/react/portainer/environments/queries';
+import { useKubernetesVersion } from '@/react/kubernetes/queries/useKubernetesVersion';
+import { notifyError, notifySuccess } from '@/portainer/services/notifications';
+
+import { TableSettingsMenu, TableSettingsMenuAutoRefresh } from '@@/datatables';
+import { useTableState } from '@@/datatables/useTableState';
+import { CardExpandableList } from '@@/datatables/CardExpandableList';
+import { NestedDatatable } from '@@/datatables/NestedDatatable';
+
+import { useApplication } from '../../queries/useApplication';
+import { useApplicationPods } from '../../queries/useApplicationPods';
+import { useDeletePodMutation } from '../../queries/useDeletePodMutation';
+
+import { ContainerRowData, PodRowData } from './types';
+import { getPodColumns } from './columns/pod';
+import { getContainerColumns } from './columns/container';
+import { computeContainerStatus } from './computeContainerStatus';
+import { computePodStatus } from './computePodStatus';
+
+const storageKey = 'k8sContainersDatatable';
+const settingsStore = createStore(storageKey);
+
+export function ApplicationContainersDatatable() {
+  const environmentId = useEnvironmentId();
+  const useServerMetricsQuery = useEnvironment(
+    environmentId,
+    (env) => !!env?.Kubernetes?.Configuration.UseServerMetrics
+  );
+  const tableState = useTableState(settingsStore, storageKey);
+  const {
+    params: { name, namespace, 'resource-type': resourceType },
+  } = useCurrentStateAndParams();
+
+  const applicationQuery = useApplication(
+    environmentId,
+    namespace,
+    name,
+    resourceType,
+    {
+      autoRefreshRate: tableState.autoRefreshRate * 1000,
+    }
+  );
+  const podsQuery = useApplicationPods(
+    environmentId,
+    namespace,
+    name,
+    applicationQuery.data,
+    {
+      autoRefreshRate: tableState.autoRefreshRate * 1000,
+    }
+  );
+  const versionQuery = useKubernetesVersion(environmentId);
+  const deletePodMutation = useDeletePodMutation(
+    environmentId,
+    namespace,
+    name
+  );
+  const podRows = useContainersRowData(podsQuery.data);
+  const containerColumns = useMemo(
+    () => getContainerColumns(!!useServerMetricsQuery.data),
+    [useServerMetricsQuery.data]
+  );
+  const podColumns = useMemo(
+    () =>
+      getPodColumns({
+        supportsRestartStrategy: !!versionQuery.data?.supportsPodRestart,
+        isDeleting: deletePodMutation.isLoading,
+        isLoading: versionQuery.isLoading,
+        onDelete: (podName) => {
+          deletePodMutation.mutate(
+            { podName },
+            {
+              onSuccess: () =>
+                notifySuccess('Success', `Pod '${podName}' deleted`),
+              onError: (error) =>
+                notifyError(
+                  'Failure',
+                  error as Error,
+                  `Unable to delete pod '${podName}'`
+                ),
+            }
+          );
+        },
+      }),
+    [versionQuery, deletePodMutation]
+  );
+
+  return (
+    <div className="row">
+      <div className="col-sm-12">
+        <CardExpandableList<IndexOptional<PodRowData>>
+          dataset={podRows}
+          columns={podColumns}
+          settingsManager={tableState}
+          isLoading={
+            applicationQuery.isLoading ||
+            podsQuery.isLoading ||
+            useServerMetricsQuery.isLoading
+          }
+          title="Application pods"
+          titleIcon={Server}
+          getRowId={(row) => row.podName}
+          disableSelect
+          data-cy="k8s-application-containers-datatable"
+          getRowCanExpand={(row) => row.original.containers.length > 0}
+          renderSubRow={(row) => (
+            <div className="-m-2 overflow-hidden rounded-sm bg-[color:var(--bg-card-color)] pl-6">
+              <NestedDatatable<ContainerRowData>
+                dataset={row.original.containers}
+                columns={containerColumns}
+                getRowId={(c) => `${row.original.podName}/${c.name}`}
+                data-cy={`k8s-application-containers-${row.original.podName}-inner`}
+                enablePagination={false}
+              />
+            </div>
+          )}
+          renderTableSettings={() => (
+            <TableSettingsMenu>
+              <TableSettingsMenuAutoRefresh
+                value={tableState.autoRefreshRate}
+                onChange={(value) => tableState.setAutoRefreshRate(value)}
+              />
+            </TableSettingsMenu>
+          )}
+          initialTableState={{
+            pagination: { pageIndex: 0, pageSize: 5 },
+            expanded: true,
+          }}
+        />
+      </div>
+    </div>
+  );
+}
+
+// useContainersRowData groups containers (including init containers) under their
+// owning pod, returning one row per pod for the top-level datatable.
+function useContainersRowData(pods?: Pod[]): PodRowData[] {
+  return useMemo(() => {
+    if (!pods) {
+      return [];
+    }
+    return pods.map((pod) => {
+      const containers: ContainerRowData[] = [
+        ...(pod.spec?.containers?.map((c) => ({
+          ...c,
+          isInit: false,
+        })) ?? []),
+        ...(pod.spec?.initContainers?.map((c) => ({
+          ...c,
+          isInit: true,
+          // https://kubernetes.io/docs/concepts/workloads/pods/sidecar-containers/#sidecar-containers-and-pod-lifecycle
+          isSidecar: c.restartPolicy === 'Always',
+        })) ?? []),
+      ].map((container) => ({
+        ...container,
+        podName: pod.metadata?.name ?? '',
+        status: computeContainerStatus(
+          container.name,
+          pod.status?.containerStatuses,
+          pod.status?.initContainerStatuses
+        ),
+      }));
+
+      const statuses = pod.status?.containerStatuses ?? [];
+      return {
+        podName: pod.metadata?.name ?? '',
+        nodeName: pod.spec?.nodeName ?? '',
+        podIp: pod.status?.podIP ?? '',
+        creationDate: pod.status?.startTime ?? '',
+        status: computePodStatus(pod),
+        containers,
+        readyContainers: statuses.filter((s) => s.ready).length,
+        totalContainers:
+          statuses.length || containers.filter((c) => !c.isInit).length,
+      };
+    });
+  }, [pods]);
+}
diff --git a/app/react/kubernetes/applications/DetailsView/ApplicationContainersDatatable/columns/container.tsx b/app/react/kubernetes/applications/DetailsView/ApplicationContainersDatatable/columns/container.tsx
new file mode 100644
index 0000000..8b9c896
--- /dev/null
+++ b/app/react/kubernetes/applications/DetailsView/ApplicationContainersDatatable/columns/container.tsx
@@ -0,0 +1,175 @@
+import { CellContext, createColumnHelper } from '@tanstack/react-table';
+import { BarChart, FileText, Terminal } from 'lucide-react';
+
+import { Authorized } from '@/react/hooks/useUser';
+import { pluralize } from '@/react/common/string-utils';
+
+import { Badge } from '@@/Badge';
+import { Tooltip } from '@@/Tip/Tooltip';
+import { ExternalLink } from '@@/ExternalLink';
+import { Link } from '@@/Link';
+import { Icon } from '@@/Icon';
+import { TooltipWithChildren } from '@@/Tip/TooltipWithChildren';
+
+import { ContainerRowData } from '../types';
+
+const columnHelper = createColumnHelper<ContainerRowData>();
+
+const name = columnHelper.accessor('name', {
+  header: 'Name',
+  id: 'name',
+  cell: ({ row: { original: container } }) => (
+    <div className="flex justify-between gap-2">
+      <span>{container.name}</span>
+      <ContainerTypeBadge container={container} />
+    </div>
+  ),
+});
+
+function ContainerTypeBadge({ container }: { container: ContainerRowData }) {
+  if (container.isSidecar) {
+    return (
+      <Badge type="info">
+        Sidecar
+        <Tooltip
+          message={
+            <>
+              <ExternalLink
+                to="https://kubernetes.io/docs/concepts/workloads/pods/sidecar-containers/"
+                data-cy="sidecar-link"
+              >
+                Sidecar containers
+              </ExternalLink>{' '}
+              run continuously alongside the main application, starting before
+              other containers.
+            </>
+          }
+        />
+      </Badge>
+    );
+  }
+
+  if (container.isInit) {
+    return (
+      <Badge type="info">
+        Init
+        <Tooltip
+          message={
+            <>
+              <ExternalLink
+                to="https://kubernetes.io/docs/concepts/workloads/pods/init-containers/"
+                data-cy="init-link"
+              >
+                Init containers
+              </ExternalLink>{' '}
+              run and complete before the main application containers start.
+            </>
+          }
+        />
+      </Badge>
+    );
+  }
+
+  return null;
+}
+
+const image = columnHelper.accessor('image', {
+  header: 'Image',
+  cell: ({ getValue }) => (
+    <div className="max-w-xs truncate" title={getValue()}>
+      {getValue()}
+    </div>
+  ),
+});
+
+const imagePullPolicy = columnHelper.accessor('imagePullPolicy', {
+  header: 'Image Pull Policy',
+  id: 'imagePullPolicy',
+});
+
+const status = columnHelper.accessor('status', {
+  header: 'Status',
+  cell: StatusCell,
+});
+
+function StatusCell({
+  getValue,
+}: CellContext<ContainerRowData, ContainerRowData['status']>) {
+  const statusData = getValue();
+
+  return (
+    <Badge type={statusData.type}>
+      <div className="flex items-center gap-1">
+        <span>
+          {statusData.status}
+          {statusData.restartCount &&
+            ` (Restarted ${statusData.restartCount} ${pluralize(
+              statusData.restartCount,
+              'time'
+            )})`}
+        </span>
+      </div>
+      {statusData.message && <Tooltip message={statusData.message} />}
+    </Badge>
+  );
+}
+
+function buildActionsColumn(isServerMetricsEnabled: boolean) {
+  return columnHelper.accessor(() => '', {
+    header: 'Actions',
+    enableSorting: false,
+    cell: ({ row: { original: container } }) => (
+      <div className="flex gap-x-2">
+        {container.status.status.includes('Running') &&
+          isServerMetricsEnabled && (
+            <Link
+              className="flex items-center gap-1"
+              to="kubernetes.applications.application.stats"
+              params={{ pod: container.podName, container: container.name }}
+              data-cy={`application-container-stats-${container.name}`}
+            >
+              <TooltipWithChildren message="View statistics" position="top">
+                <Icon icon={BarChart} />
+              </TooltipWithChildren>
+            </Link>
+          )}
+        {container.status.hasLogs !== false && (
+          <Link
+            className="flex items-center gap-1"
+            to="kubernetes.applications.application.logs"
+            params={{ pod: container.podName, container: container.name }}
+            data-cy={`application-container-logs-${container.name}`}
+          >
+            <TooltipWithChildren message="View logs" position="top">
+              <Icon icon={FileText} />
+            </TooltipWithChildren>
+          </Link>
+        )}
+        {container.status.status.includes('Running') && (
+          <Authorized authorizations="K8sApplicationConsoleRW">
+            <Link
+              className="flex items-center gap-1"
+              to="kubernetes.applications.application.console"
+              params={{ pod: container.podName, container: container.name }}
+              data-cy={`application-container-console-${container.name}`}
+            >
+              <TooltipWithChildren message="Open console" position="top">
+                <Icon icon={Terminal} />
+              </TooltipWithChildren>
+            </Link>
+          </Authorized>
+        )}
+      </div>
+    ),
+  });
+}
+
+export function getContainerColumns(isServerMetricsEnabled: boolean) {
+  return [
+    name,
+    image,
+    imagePullPolicy,
+    status,
+    buildActionsColumn(isServerMetricsEnabled),
+  ];
+}
diff --git a/app/react/kubernetes/applications/DetailsView/ApplicationContainersDatatable/columns/pod.tsx b/app/react/kubernetes/applications/DetailsView/ApplicationContainersDatatable/columns/pod.tsx
new file mode 100644
index 0000000..4700982
--- /dev/null
+++ b/app/react/kubernetes/applications/DetailsView/ApplicationContainersDatatable/columns/pod.tsx
@@ -0,0 +1,144 @@
+import { createColumnHelper } from '@tanstack/react-table';
+import { Trash2 } from 'lucide-react';
+
+import { Authorized } from '@/react/hooks/useUser';
+import { formatDate } from '@/portainer/filters/filters';
+import { pluralize } from '@/react/common/string-utils';
+
+import { Badge } from '@@/Badge';
+import { Tooltip } from '@@/Tip/Tooltip';
+import { Link } from '@@/Link';
+import { Icon } from '@@/Icon';
+import { TooltipWithChildren } from '@@/Tip/TooltipWithChildren';
+import { LoadingButton } from '@@/buttons';
+import { confirmDelete } from '@@/modals/confirm';
+
+import { PodRowData } from '../types';
+
+const columnHelper = createColumnHelper<PodRowData>();
+
+const pod = columnHelper.accessor('podName', {
+  header: 'Pod',
+  id: 'podName',
+  cell: ({ row: { original: podRow } }) => {
+    const statusData = podRow.status;
+    return (
+      <div className="flex min-w-0 items-center gap-2">
+        <span className="truncate" title={podRow.podName}>
+          {podRow.podName}
+        </span>
+        <Badge type={statusData.type}>
+          <span>
+            {statusData.status}
+            {statusData.restartCount
+              ? ` (Restarted ${statusData.restartCount} ${pluralize(
+                  statusData.restartCount,
+                  'time'
+                )})`
+              : ''}
+          </span>
+          {statusData.message && <Tooltip message={statusData.message} />}
+        </Badge>
+      </div>
+    );
+  },
+});
+
+const node = columnHelper.accessor('nodeName', {
+  header: 'Node',
+  cell: ({ getValue }) => {
+    const nodeName = getValue();
+    return (
+      <Authorized
+        authorizations="K8sClusterNodeR"
+        childrenUnauthorized={nodeName}
+      >
+        <Link
+          to="kubernetes.cluster.node"
+          params={{ nodeName }}
+          data-cy={`application-container-node-${nodeName}`}
+        >
+          <div className="max-w-xs truncate" title={nodeName}>
+            {nodeName}
+          </div>
+        </Link>
+      </Authorized>
+    );
+  },
+});
+
+const podIp = columnHelper.accessor('podIp', {
+  header: 'Pod IP',
+  id: 'podIp',
+});
+
+const containers = columnHelper.accessor(
+  (row) => `${row.readyContainers}/${row.totalContainers}`,
+  {
+    id: 'containers',
+    header: 'Containers',
+    enableSorting: false,
+  }
+);
+
+const creationDate = columnHelper.accessor(
+  (row) => formatDate(row.creationDate),
+  {
+    header: 'Creation Date',
+    cell: ({ getValue }) => getValue(),
+  }
+);
+
+export const podColumns = [pod, node, podIp, containers, creationDate];
+
+interface PodColumnsOptions {
+  supportsRestartStrategy: boolean;
+  onDelete: (podName: string) => void;
+  isDeleting: boolean;
+  isLoading: boolean;
+}
+
+export function getPodColumns({
+  supportsRestartStrategy,
+  onDelete,
+  isDeleting,
+  isLoading,
+}: PodColumnsOptions) {
+  const deleteTooltip = supportsRestartStrategy
+    ? 'Delete pod. If this pod is configured with the RestartAllContainers restart strategy, containers will restart in-place automatically.'
+    : 'Delete pod';
+
+  const actions = columnHelper.display({
+    id: 'actions',
+    header: 'Actions',
+    cell: ({ row: { original: podRow } }) => (
+      <Authorized authorizations="K8sApplicationsP">
+        <div className="flex gap-x-2">
+          <TooltipWithChildren message={deleteTooltip} position="top">
+            <LoadingButton
+              color="dangerlight"
+              className="!ml-0"
+              aria-label={`Delete pod ${podRow.podName}`}
+              isLoading={isLoading || isDeleting}
+              loadingText="Loading"
+              data-cy={`application-pod-delete-${podRow.podName}`}
+              onClick={async () => {
+                const confirmed = await confirmDelete(
+                  `Are you sure you want to delete pod '${podRow.podName}'? Kubernetes will reschedule a new pod to replace it.`
+                );
+                if (!confirmed) {
+                  return;
+                }
+                onDelete(podRow.podName);
+              }}
+            >
+              <Icon icon={Trash2} />
+            </LoadingButton>
+          </TooltipWithChildren>
+        </div>
+      </Authorized>
+    ),
+  });
+
+  return [pod, node, podIp, containers, creationDate, actions];
+}
diff --git a/app/react/kubernetes/applications/DetailsView/ApplicationContainersDatatable/computeContainerStatus.test.ts b/app/react/kubernetes/applications/DetailsView/ApplicationContainersDatatable/computeContainerStatus.test.ts
new file mode 100644
index 0000000..4cc5680
--- /dev/null
+++ b/app/react/kubernetes/applications/DetailsView/ApplicationContainersDatatable/computeContainerStatus.test.ts
@@ -0,0 +1,483 @@
+import { ContainerStatus } from 'kubernetes-types/core/v1';
+
+import { computeContainerStatus } from './computeContainerStatus';
+
+// Helper to create a base ContainerStatus with required properties
+function createContainerStatus(
+  overrides: Partial<ContainerStatus>
+): ContainerStatus {
+  return {
+    name: 'test-container',
+    ready: false,
+    restartCount: 0,
+    image: 'test-image:latest',
+    imageID: 'sha256:test123',
+    ...overrides,
+  };
+}
+
+describe('computeContainerStatus', () => {
+  describe('Critical Container States', () => {
+    test('ImagePullBackOff should return danger type with no logs', () => {
+      const containerStatus = createContainerStatus({
+        state: {
+          waiting: {
+            reason: 'ImagePullBackOff',
+            message: 'Failed to pull image',
+          },
+        },
+      });
+
+      const result = computeContainerStatus('test-container', [
+        containerStatus,
+      ]);
+
+      expect(result.status).toBe('ImagePullBackOff');
+      expect(result.type).toBe('danger');
+      expect(result.hasLogs).toBe(false);
+    });
+
+    test('ImagePullBackOff with containerID should return danger type with logs', () => {
+      const containerStatus = createContainerStatus({
+        containerID: 'docker://abc123def456',
+        state: {
+          waiting: {
+            reason: 'ImagePullBackOff',
+            message: 'Failed to pull image',
+          },
+        },
+      });
+
+      const result = computeContainerStatus('test-container', [
+        containerStatus,
+      ]);
+
+      expect(result.status).toBe('ImagePullBackOff');
+      expect(result.type).toBe('danger');
+      expect(result.hasLogs).toBe(true);
+    });
+
+    test('CrashLoopBackOff should return danger type with logs if container started', () => {
+      const containerStatus = createContainerStatus({
+        restartCount: 5,
+        state: {
+          waiting: {
+            reason: 'CrashLoopBackOff',
+            message: 'Back-off restarting failed container',
+          },
+        },
+        lastState: {
+          terminated: {
+            startedAt: '2023-01-01T10:00:00Z',
+            exitCode: 1,
+          },
+        },
+      });
+
+      const result = computeContainerStatus('test-container', [
+        containerStatus,
+      ]);
+
+      expect(result.status).toBe('CrashLoopBackOff');
+      expect(result.type).toBe('danger');
+      expect(result.hasLogs).toBe(true);
+    });
+
+    test('CrashLoopBackOff with only containerID should return danger type with logs', () => {
+      const containerStatus = createContainerStatus({
+        containerID: 'docker://crashed123',
+        restartCount: 3,
+        state: {
+          waiting: {
+            reason: 'CrashLoopBackOff',
+            message: 'Back-off restarting failed container',
+          },
+        },
+      });
+
+      const result = computeContainerStatus('test-container', [
+        containerStatus,
+      ]);
+
+      expect(result.status).toBe('CrashLoopBackOff');
+      expect(result.type).toBe('danger');
+      expect(result.hasLogs).toBe(true);
+    });
+
+    test('Running and ready should return success type with logs', () => {
+      const containerStatus = createContainerStatus({
+        ready: true,
+        state: {
+          running: {
+            startedAt: '2023-01-01T10:00:00Z',
+          },
+        },
+      });
+
+      const result = computeContainerStatus('test-container', [
+        containerStatus,
+      ]);
+
+      expect(result.status).toBe('Running');
+      expect(result.type).toBe('success');
+      expect(result.hasLogs).toBe(true);
+    });
+
+    test('Running but not ready should return warn type with logs', () => {
+      const containerStatus = createContainerStatus({
+        state: {
+          running: {
+            startedAt: '2023-01-01T10:00:00Z',
+          },
+        },
+      });
+
+      const result = computeContainerStatus('test-container', [
+        containerStatus,
+      ]);
+
+      expect(result.status).toBe('Running (not ready)');
+      expect(result.type).toBe('warn');
+      expect(result.hasLogs).toBe(true);
+    });
+
+    test('OOMKilled should return danger type with logs', () => {
+      const containerStatus = createContainerStatus({
+        restartCount: 2,
+        state: {
+          terminated: {
+            reason: 'OOMKilled',
+            exitCode: 137,
+            startedAt: '2023-01-01T10:00:00Z',
+            finishedAt: '2023-01-01T10:05:00Z',
+          },
+        },
+      });
+
+      const result = computeContainerStatus('test-container', [
+        containerStatus,
+      ]);
+
+      expect(result.status).toBe('OOMKilled');
+      expect(result.type).toBe('danger');
+      expect(result.hasLogs).toBe(true);
+    });
+
+    test('Completed successfully should return success type with logs', () => {
+      const containerStatus = createContainerStatus({
+        state: {
+          terminated: {
+            reason: 'Completed',
+            exitCode: 0,
+            startedAt: '2023-01-01T10:00:00Z',
+            finishedAt: '2023-01-01T10:05:00Z',
+          },
+        },
+      });
+
+      const result = computeContainerStatus('test-container', [
+        containerStatus,
+      ]);
+
+      expect(result.status).toBe('Completed');
+      expect(result.type).toBe('success');
+      expect(result.hasLogs).toBe(true);
+    });
+
+    test('ContainerCreating should return info type with no logs', () => {
+      const containerStatus = createContainerStatus({
+        state: {
+          waiting: {
+            reason: 'ContainerCreating',
+            message: 'Container is being created',
+          },
+        },
+      });
+
+      const result = computeContainerStatus('test-container', [
+        containerStatus,
+      ]);
+
+      expect(result.status).toBe('ContainerCreating');
+      expect(result.type).toBe('info');
+      expect(result.hasLogs).toBe(false);
+    });
+
+    test('ContainerCreating with containerID should return info type with logs', () => {
+      const containerStatus = createContainerStatus({
+        containerID: 'docker://creating123',
+        state: {
+          waiting: {
+            reason: 'ContainerCreating',
+            message: 'Container is being created',
+          },
+        },
+      });
+
+      const result = computeContainerStatus('test-container', [
+        containerStatus,
+      ]);
+
+      expect(result.status).toBe('ContainerCreating');
+      expect(result.type).toBe('info');
+      expect(result.hasLogs).toBe(true);
+    });
+
+    test('PodInitializing should return info type with prefixed status', () => {
+      const containerStatus = createContainerStatus({
+        state: {
+          waiting: {
+            reason: 'PodInitializing',
+            message: 'Waiting for init containers',
+          },
+        },
+      });
+
+      const result = computeContainerStatus('test-container', [
+        containerStatus,
+      ]);
+
+      expect(result.status).toBe('Waiting (PodInitializing)');
+      expect(result.type).toBe('info');
+      expect(result.hasLogs).toBe(false);
+    });
+
+    test('Container not found should return unknown with muted type', () => {
+      const result = computeContainerStatus('nonexistent-container', []);
+
+      expect(result.status).toBe('Unknown');
+      expect(result.type).toBe('muted');
+      expect(result.hasLogs).toBeUndefined();
+    });
+
+    test('Container with no state should return unknown with muted type', () => {
+      const containerStatus = createContainerStatus({
+        state: {},
+      });
+
+      const result = computeContainerStatus('test-container', [
+        containerStatus,
+      ]);
+
+      expect(result.status).toBe('Unknown');
+      expect(result.type).toBe('muted');
+      expect(result.hasLogs).toBe(false);
+    });
+
+    test('Container with no state but with containerID should have logs available', () => {
+      const containerStatus = createContainerStatus({
+        containerID: 'docker://unknown123',
+        state: {},
+      });
+
+      const result = computeContainerStatus('test-container', [
+        containerStatus,
+      ]);
+
+      expect(result.status).toBe('Unknown');
+      expect(result.type).toBe('muted');
+      expect(result.hasLogs).toBe(true);
+    });
+
+    test('Sidecar container should be handled like regular container', () => {
+      const containerStatus = createContainerStatus({
+        ready: true,
+        state: {
+          running: {
+            startedAt: '2023-01-01T10:00:00Z',
+          },
+        },
+      });
+
+      const result = computeContainerStatus(
+        'test-container',
+        [],
+        [containerStatus]
+      ); // Sidecar containers are found in initContainerStatuses
+
+      expect(result.status).toBe('Running');
+      expect(result.type).toBe('success');
+      expect(result.hasLogs).toBe(true);
+    });
+  });
+
+  describe('Container Log Availability Tests', () => {
+    test('Container with running state should have logs', () => {
+      const containerStatus = createContainerStatus({
+        state: {
+          running: {
+            startedAt: '2023-01-01T10:00:00Z',
+          },
+        },
+      });
+
+      const result = computeContainerStatus('test-container', [
+        containerStatus,
+      ]);
+
+      expect(result.hasLogs).toBe(true);
+    });
+
+    test('Container with terminated state should have logs', () => {
+      const containerStatus = createContainerStatus({
+        state: {
+          terminated: {
+            startedAt: '2023-01-01T10:00:00Z',
+            exitCode: 0,
+          },
+        },
+      });
+
+      const result = computeContainerStatus('test-container', [
+        containerStatus,
+      ]);
+
+      expect(result.hasLogs).toBe(true);
+    });
+
+    test('Container with lastState running should have logs', () => {
+      const containerStatus = createContainerStatus({
+        state: {
+          waiting: {
+            reason: 'CrashLoopBackOff',
+          },
+        },
+        lastState: {
+          running: {
+            startedAt: '2023-01-01T10:00:00Z',
+          },
+        },
+      });
+
+      const result = computeContainerStatus('test-container', [
+        containerStatus,
+      ]);
+
+      expect(result.hasLogs).toBe(true);
+    });
+
+    test('Container with lastState terminated should have logs', () => {
+      const containerStatus = createContainerStatus({
+        state: {
+          waiting: {
+            reason: 'CrashLoopBackOff',
+          },
+        },
+        lastState: {
+          terminated: {
+            startedAt: '2023-01-01T10:00:00Z',
+            exitCode: 1,
+          },
+        },
+      });
+
+      const result = computeContainerStatus('test-container', [
+        containerStatus,
+      ]);
+
+      expect(result.hasLogs).toBe(true);
+    });
+
+    test('Container with only containerID should have logs', () => {
+      const containerStatus = createContainerStatus({
+        containerID: 'docker://abc123def456',
+        state: {
+          waiting: {
+            reason: 'Unknown',
+          },
+        },
+      });
+
+      const result = computeContainerStatus('test-container', [
+        containerStatus,
+      ]);
+
+      expect(result.hasLogs).toBe(true);
+    });
+
+    test('Container with empty containerID should not have logs', () => {
+      const containerStatus = createContainerStatus({
+        containerID: '',
+        state: {
+          waiting: {
+            reason: 'ImagePullBackOff',
+          },
+        },
+      });
+
+      const result = computeContainerStatus('test-container', [
+        containerStatus,
+      ]);
+
+      expect(result.hasLogs).toBe(false);
+    });
+
+    test('Container without containerID or start times should not have logs', () => {
+      const containerStatus = createContainerStatus({
+        state: {
+          waiting: {
+            reason: 'ImagePullBackOff',
+          },
+        },
+      });
+
+      const result = computeContainerStatus('test-container', [
+        containerStatus,
+      ]);
+
+      expect(result.hasLogs).toBe(false);
+    });
+
+    test('Container with terminated state but no startedAt should rely on containerID', () => {
+      const containerStatus = createContainerStatus({
+        containerID: 'docker://terminated123',
+        state: {
+          terminated: {
+            exitCode: 0,
+            // No startedAt field
+          },
+        },
+      });
+
+      const result = computeContainerStatus('test-container', [
+        containerStatus,
+      ]);
+
+      expect(result.hasLogs).toBe(true);
+    });
+
+    test('Multiple containers with different log availability', () => {
+      const containerWithLogs = createContainerStatus({
+        name: 'container-with-logs',
+        containerID: 'docker://logs123',
+        state: {
+          running: {
+            startedAt: '2023-01-01T10:00:00Z',
+          },
+        },
+      });
+
+      const containerWithoutLogs = createContainerStatus({
+        name: 'container-without-logs',
+        state: {
+          waiting: {
+            reason: 'ImagePullBackOff',
+          },
+        },
+      });
+
+      const resultWithLogs = computeContainerStatus('container-with-logs', [
+        containerWithLogs,
+        containerWithoutLogs,
+      ]);
+
+      const resultWithoutLogs = computeContainerStatus(
+        'container-without-logs',
+        [containerWithLogs, containerWithoutLogs]
+      );
+
+      expect(resultWithLogs.hasLogs).toBe(true);
+      expect(resultWithoutLogs.hasLogs).toBe(false);
+    });
+  });
+});
diff --git a/app/react/kubernetes/applications/DetailsView/ApplicationContainersDatatable/computeContainerStatus.ts b/app/react/kubernetes/applications/DetailsView/ApplicationContainersDatatable/computeContainerStatus.ts
new file mode 100644
index 0000000..b5ca690
--- /dev/null
+++ b/app/react/kubernetes/applications/DetailsView/ApplicationContainersDatatable/computeContainerStatus.ts
@@ -0,0 +1,360 @@
+import { ContainerStatus } from 'kubernetes-types/core/v1';
+
+import { ContainerRowData } from './types';
+
+/**
+ * Compute the status of a container, with translated messages.
+ *
+ * The cases are hardcoded, because there is not a single source that enumerates
+ * all the possible states.
+ * @param containerName - The name of the container
+ * @param containerStatuses - The statuses of the container
+ * @param initContainerStatuses - The statuses of the init container
+ * @returns The status of the container
+ */
+export function computeContainerStatus(
+  containerName: string,
+  containerStatuses?: ContainerStatus[],
+  initContainerStatuses?: ContainerStatus[]
+): ContainerRowData['status'] {
+  // Choose the correct status array based on container type
+  const statuses = [
+    ...(containerStatuses || []),
+    ...(initContainerStatuses || []),
+  ];
+  const status = statuses?.find((status) => status.name === containerName);
+
+  if (!status) {
+    return {
+      status: 'Unknown',
+      type: 'muted',
+      message: 'Container status information is not available',
+    };
+  }
+
+  const hasLogs = hasContainerEverStarted(status);
+  const { state, restartCount = 0 } = status;
+
+  // Handle waiting state with more specific reasons
+  if (state?.waiting) {
+    const { reason, message } = state.waiting;
+    if (reason) {
+      // Return specific waiting reasons that match kubectl output
+      switch (reason) {
+        case 'ImagePullBackOff':
+        case 'ErrImagePull':
+        case 'ImageInspectError':
+        case 'ErrImageNeverPull':
+          return {
+            status: reason,
+            type: 'danger',
+            message:
+              message ||
+              'Failed to pull container image. Check image name, registry access, and network connectivity.',
+            hasLogs,
+            restartCount: shouldShowRestartCount(restartCount, 'danger')
+              ? restartCount
+              : undefined,
+          };
+        case 'ContainerCreating':
+          return {
+            status: reason,
+            type: 'info',
+            message:
+              message ||
+              'Container is being created. This may take a few moments.',
+            hasLogs,
+            restartCount: shouldShowRestartCount(restartCount, 'info')
+              ? restartCount
+              : undefined,
+          };
+        case 'PodInitializing':
+          return {
+            status: `Waiting (${reason})`,
+            type: 'info',
+            message:
+              message ||
+              'Waiting for init containers to complete. Wait a few moments or check the logs of any init containers that failed to complete.',
+            hasLogs,
+            restartCount: shouldShowRestartCount(restartCount, 'info')
+              ? restartCount
+              : undefined,
+          };
+        case 'CreateContainerConfigError':
+        case 'CreateContainerError':
+          return {
+            status: reason,
+            type: 'danger',
+            message:
+              message ||
+              'Failed to create container. Check resource limits, security contexts, and volume mounts.',
+            hasLogs,
+            restartCount: shouldShowRestartCount(restartCount, 'danger')
+              ? restartCount
+              : undefined,
+          };
+        case 'InvalidImageName':
+          return {
+            status: reason,
+            type: 'danger',
+            message:
+              message ||
+              'The specified container image name is invalid or malformed.',
+            hasLogs,
+            restartCount: shouldShowRestartCount(restartCount, 'danger')
+              ? restartCount
+              : undefined,
+          };
+        case 'CrashLoopBackOff':
+          return {
+            status: reason,
+            type: 'danger',
+            message: `Container keeps crashing after startup. Check application logs and startup configuration. ${
+              message ? `Details: '${message}'` : ''
+            }`,
+            hasLogs,
+            restartCount: shouldShowRestartCount(restartCount, 'danger')
+              ? restartCount
+              : undefined,
+          };
+        case 'RunContainerError':
+          return {
+            status: reason,
+            type: 'danger',
+            message:
+              message ||
+              'Failed to start container process. Check command, arguments, and environment variables.',
+            hasLogs,
+            restartCount: shouldShowRestartCount(restartCount, 'danger')
+              ? restartCount
+              : undefined,
+          };
+        case 'KillContainerError':
+          return {
+            status: reason,
+            type: 'danger',
+            message:
+              message ||
+              'Failed to stop container gracefully. Container may be unresponsive.',
+            hasLogs,
+            restartCount: shouldShowRestartCount(restartCount, 'danger')
+              ? restartCount
+              : undefined,
+          };
+        case 'VerifyNonRootError':
+          return {
+            status: reason,
+            type: 'danger',
+            message:
+              message ||
+              'Container is trying to run as root but security policy requires non-root execution.',
+            hasLogs,
+            restartCount: shouldShowRestartCount(restartCount, 'danger')
+              ? restartCount
+              : undefined,
+          };
+        case 'ConfigError':
+          return {
+            status: reason,
+            type: 'danger',
+            message:
+              message ||
+              'Container configuration is invalid. Check resource requirements and security settings.',
+            hasLogs,
+            restartCount: shouldShowRestartCount(restartCount, 'danger')
+              ? restartCount
+              : undefined,
+          };
+        default:
+          return {
+            status: reason,
+            type: 'muted',
+            message: message || `Container is waiting: ${reason}`,
+            hasLogs,
+            restartCount: shouldShowRestartCount(restartCount, 'muted')
+              ? restartCount
+              : undefined,
+          };
+      }
+    }
+    return {
+      status: 'Waiting',
+      type: 'muted',
+      message: message || 'Container is waiting to be scheduled or started.',
+      hasLogs,
+      restartCount: shouldShowRestartCount(restartCount, 'muted')
+        ? restartCount
+        : undefined,
+    };
+  }
+
+  // Handle terminated state
+  if (state?.terminated) {
+    const { exitCode = 0, reason, message } = state.terminated;
+
+    if (reason) {
+      switch (reason) {
+        case 'Error':
+          return {
+            status: 'Error',
+            type: 'danger',
+            message: `Container exited with code ${exitCode}${
+              restartCount > 0 ? ` (restarted ${restartCount} times)` : ''
+            }. ${message || 'Check application logs for error details.'}`,
+            hasLogs,
+            restartCount: shouldShowRestartCount(restartCount, 'danger')
+              ? restartCount
+              : undefined,
+          };
+        case 'Completed':
+          return {
+            status: 'Completed',
+            type: 'success',
+            message,
+            hasLogs,
+            restartCount: shouldShowRestartCount(restartCount, 'success')
+              ? restartCount
+              : undefined,
+          };
+        case 'OOMKilled':
+          return {
+            status: 'OOMKilled',
+            type: 'danger',
+            message:
+              message ||
+              'Container was killed due to out-of-memory. Consider increasing memory limits.',
+            hasLogs,
+            restartCount: shouldShowRestartCount(restartCount, 'danger')
+              ? restartCount
+              : undefined,
+          };
+        case 'DeadlineExceeded':
+          return {
+            status: 'DeadlineExceeded',
+            type: 'danger',
+            message:
+              message ||
+              'Container was terminated because it exceeded the active deadline.',
+            hasLogs,
+            restartCount: shouldShowRestartCount(restartCount, 'danger')
+              ? restartCount
+              : undefined,
+          };
+        case 'Evicted':
+          return {
+            status: 'Evicted',
+            type: 'warn',
+            message:
+              message ||
+              'Container was evicted due to resource pressure on the node.',
+            hasLogs,
+            restartCount: shouldShowRestartCount(restartCount, 'warn')
+              ? restartCount
+              : undefined,
+          };
+        case 'NodeLost':
+          return {
+            status: 'NodeLost',
+            type: 'danger',
+            message:
+              message || 'Container was lost when the node became unreachable.',
+            hasLogs,
+            restartCount: shouldShowRestartCount(restartCount, 'danger')
+              ? restartCount
+              : undefined,
+          };
+        default:
+          return {
+            status: reason,
+            type: 'muted',
+            message: `Container terminated: ${reason}${
+              restartCount > 0 ? ` (restarted ${restartCount} times)` : ''
+            }. ${message || ''}`,
+            hasLogs,
+            restartCount: shouldShowRestartCount(restartCount, 'muted')
+              ? restartCount
+              : undefined,
+          };
+      }
+    }
+
+    if (exitCode === 0) {
+      return {
+        status: 'Completed',
+        type: 'success',
+        message,
+        hasLogs,
+        restartCount: shouldShowRestartCount(restartCount, 'success')
+          ? restartCount
+          : undefined,
+      };
+    }
+
+    return {
+      status: 'Error',
+      type: 'danger',
+      message: `Container exited with code ${exitCode}${
+        restartCount > 0 ? ` (restarted ${restartCount} times)` : ''
+      }. ${message || 'Check application logs for error details.'}`,
+      hasLogs,
+      restartCount: shouldShowRestartCount(restartCount, 'danger')
+        ? restartCount
+        : undefined,
+    };
+  }
+
+  // Handle running state
+  if (state?.running) {
+    // Check if container is ready
+    if (status.ready === false) {
+      return {
+        status: 'Running (not ready)',
+        type: 'warn',
+        message:
+          'Container is running but not ready. Check readiness probe configuration.',
+        hasLogs,
+        restartCount: shouldShowRestartCount(restartCount, 'warn')
+          ? restartCount
+          : undefined,
+      };
+    }
+    return {
+      status: 'Running',
+      type: 'success',
+      hasLogs,
+      restartCount: shouldShowRestartCount(restartCount, 'success')
+        ? restartCount
+        : undefined,
+    };
+  }
+
+  // Fallback
+  return {
+    status: 'Unknown',
+    type: 'muted',
+    message:
+      'Container state cannot be determined. Status information may be incomplete.',
+    hasLogs,
+    restartCount: shouldShowRestartCount(restartCount, 'muted')
+      ? restartCount
+      : undefined,
+  };
+}
+
+// Helper function to determine if restart count should be shown
+function shouldShowRestartCount(
+  restartCount: number,
+  type: ContainerRowData['status']['type']
+) {
+  return restartCount >= 1 && (type === 'danger' || type === 'warn');
+}
+
+function hasContainerEverStarted(status: ContainerStatus): boolean {
+  return (
+    !!status.state?.running?.startedAt ||
+    !!status.state?.terminated?.startedAt ||
+    !!status.lastState?.running?.startedAt ||
+    !!status.lastState?.terminated?.startedAt ||
+    !!status.containerID
+  );
+}
diff --git a/app/react/kubernetes/applications/DetailsView/ApplicationContainersDatatable/computePodStatus.ts b/app/react/kubernetes/applications/DetailsView/ApplicationContainersDatatable/computePodStatus.ts
new file mode 100644
index 0000000..ee51f71
--- /dev/null
+++ b/app/react/kubernetes/applications/DetailsView/ApplicationContainersDatatable/computePodStatus.ts
@@ -0,0 +1,61 @@
+import { Pod } from 'kubernetes-types/core/v1';
+
+import { ContainerStatusInfo } from './types';
+
+export function computePodStatus(pod: Pod): ContainerStatusInfo {
+  if (pod.metadata?.deletionTimestamp) {
+    return {
+      status: 'Terminating',
+      type: 'warn',
+      message: 'Pod is being deleted.',
+    };
+  }
+
+  const phase = pod.status?.phase;
+  const message = pod.status?.message;
+  const reason = pod.status?.reason;
+  const containerStatuses = pod.status?.containerStatuses ?? [];
+
+  switch (phase) {
+    case undefined:
+      return {
+        status: 'Unknown',
+        type: 'muted',
+        message: message || 'Pod status cannot be determined from the cluster.',
+      };
+    case 'Running': {
+      const total = containerStatuses.length;
+      const ready = containerStatuses.filter((c) => c.ready).length;
+      if (total > 0 && ready < total) {
+        return {
+          status: 'Running (not ready)',
+          type: 'warn',
+          message:
+            message ||
+            `${ready} of ${total} containers are ready. Check readiness probes.`,
+        };
+      }
+      return { status: 'Running', type: 'success' };
+    }
+    case 'Pending':
+      return {
+        status: 'Pending',
+        type: 'muted',
+        message: message || reason,
+      };
+    case 'Succeeded':
+      return { status: 'Succeeded', type: 'info', message };
+    case 'Failed':
+      return {
+        status: 'Failed',
+        type: 'danger',
+        message: message || reason || 'Pod failed.',
+      };
+    default:
+      return {
+        status: 'Unknown',
+        type: 'muted',
+        message: message || 'Pod status cannot be determined from the cluster.',
+      };
+  }
+}
diff --git a/app/react/kubernetes/applications/DetailsView/ApplicationContainersDatatable/index.ts b/app/react/kubernetes/applications/DetailsView/ApplicationContainersDatatable/index.ts
new file mode 100644
index 0000000..52b079c
--- /dev/null
+++ b/app/react/kubernetes/applications/DetailsView/ApplicationContainersDatatable/index.ts
@@ -0,0 +1 @@
+export { ApplicationContainersDatatable } from './ApplicationContainersDatatable';
diff --git a/app/react/kubernetes/applications/DetailsView/ApplicationContainersDatatable/types.ts b/app/react/kubernetes/applications/DetailsView/ApplicationContainersDatatable/types.ts
new file mode 100644
index 0000000..4c19927
--- /dev/null
+++ b/app/react/kubernetes/applications/DetailsView/ApplicationContainersDatatable/types.ts
@@ -0,0 +1,30 @@
+import { Container } from 'kubernetes-types/core/v1';
+
+import { BadgeType } from '@@/Badge';
+
+export interface ContainerStatusInfo {
+  status: string;
+  type: BadgeType;
+  message?: string;
+  hasLogs?: boolean;
+  startedAt?: string;
+  restartCount?: number;
+}
+
+export interface ContainerRowData extends Container {
+  podName: string;
+  status: ContainerStatusInfo;
+  isInit?: boolean;
+  isSidecar?: boolean;
+}
+
+export interface PodRowData {
+  podName: string;
+  nodeName: string;
+  podIp: string;
+  creationDate: string;
+  status: ContainerStatusInfo;
+  containers: ContainerRowData[];
+  readyContainers: number;
+  totalContainers: number;
+}
diff --git a/app/react/kubernetes/applications/DetailsView/ApplicationDetailsView.tsx b/app/react/kubernetes/applications/DetailsView/ApplicationDetailsView.tsx
new file mode 100644
index 0000000..3701eec
--- /dev/null
+++ b/app/react/kubernetes/applications/DetailsView/ApplicationDetailsView.tsx
@@ -0,0 +1,134 @@
+import { AlertTriangle, Code, History, Minimize2 } from 'lucide-react';
+import { useCurrentStateAndParams } from '@uirouter/react';
+
+import LaptopCode from '@/assets/ico/laptop-code.svg?c';
+import { useNamespaceAccessRedirect } from '@/react/kubernetes/namespaces/hooks/useNamespaceAccessRedirect';
+
+import { PageHeader } from '@@/PageHeader';
+import { Tab, WidgetTabs, useCurrentTabIndex } from '@@/Widget/WidgetTabs';
+import { Icon } from '@@/Icon';
+import { Badge } from '@@/Badge';
+
+import { EventsDatatable } from '../../components/EventsDatatable';
+
+import {
+  PlacementsDatatable,
+  usePlacementTableData,
+  usePlacementTableState,
+} from './PlacementsDatatable';
+import { ApplicationDetailsWidget } from './ApplicationDetailsWidget';
+import { ApplicationSummaryWidget } from './ApplicationSummaryWidget';
+import { ApplicationContainersDatatable } from './ApplicationContainersDatatable';
+import {
+  useApplicationEventsTableData,
+  useApplicationEventsTableState,
+} from './useApplicationEventsTableData';
+import { ApplicationYAMLEditor } from './AppYAMLEditor/ApplicationYAMLEditor';
+import { useApplicationYAML } from './AppYAMLEditor/useApplicationYAML';
+
+export function ApplicationDetailsView() {
+  const stateAndParams = useCurrentStateAndParams();
+  const {
+    params: { namespace, name },
+  } = stateAndParams;
+  useNamespaceAccessRedirect(namespace, { to: 'kubernetes.applications' });
+
+  // placements table data
+  const { placementsData, isPlacementsTableLoading, hasPlacementWarning } =
+    usePlacementTableData();
+  const placementsTableState = usePlacementTableState();
+
+  // events table data
+  const { appEventsData, appEventWarningCount, isAppEventsTableLoading } =
+    useApplicationEventsTableData();
+  const appEventsTableState = useApplicationEventsTableState();
+
+  // load app yaml data early to load from cache later
+  useApplicationYAML();
+
+  const tabs: Tab[] = [
+    {
+      name: 'Application',
+      icon: LaptopCode,
+      widget: <ApplicationSummaryWidget />,
+      selectedTabParam: 'application',
+    },
+    {
+      name: (
+        <div className="flex items-center gap-x-2">
+          Placement
+          {hasPlacementWarning && (
+            <Badge type="warnSecondary">
+              <Icon icon={AlertTriangle} className="!mr-1" />1
+            </Badge>
+          )}
+        </div>
+      ),
+      icon: Minimize2,
+      widget: (
+        <PlacementsDatatable
+          hasPlacementWarning={hasPlacementWarning}
+          tableState={placementsTableState}
+          dataset={placementsData}
+          isLoading={isPlacementsTableLoading}
+        />
+      ),
+      selectedTabParam: 'placement',
+    },
+    {
+      name: (
+        <div className="flex items-center gap-x-2">
+          Events
+          {appEventWarningCount >= 1 && (
+            <Badge type="warnSecondary">
+              <Icon icon={AlertTriangle} className="!mr-1" />
+              {appEventWarningCount}
+            </Badge>
+          )}
+        </div>
+      ),
+      icon: History,
+      widget: (
+        <EventsDatatable
+          dataset={appEventsData}
+          tableState={appEventsTableState}
+          isLoading={isAppEventsTableLoading}
+          data-cy="k8sAppDetail-eventsTable"
+        />
+      ),
+      selectedTabParam: 'events',
+    },
+    {
+      name: 'YAML',
+      icon: Code,
+      widget: <ApplicationYAMLEditor />,
+      selectedTabParam: 'YAML',
+    },
+  ];
+  const currentTabIndex = useCurrentTabIndex(tabs);
+
+  return (
+    <>
+      <PageHeader
+        title="Application details"
+        breadcrumbs={[
+          { label: 'Namespaces', link: 'kubernetes.resourcePools' },
+          {
+            label: namespace,
+            link: 'kubernetes.resourcePools.resourcePool',
+            linkParams: { id: namespace },
+          },
+          { label: 'Applications', link: 'kubernetes.applications' },
+          name,
+        ]}
+        reload
+      />
+      <>
+        <WidgetTabs tabs={tabs} currentTabIndex={currentTabIndex} />
+        {tabs[currentTabIndex].widget}
+        <ApplicationDetailsWidget />
+        <ApplicationContainersDatatable />
+      </>
+    </>
+  );
+}
diff --git a/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/ApplicationAutoScalingTable.tsx b/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/ApplicationAutoScalingTable.tsx
new file mode 100644
index 0000000..b51237d
--- /dev/null
+++ b/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/ApplicationAutoScalingTable.tsx
@@ -0,0 +1,74 @@
+import { Move } from 'lucide-react';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { Icon } from '@@/Icon';
+import { TextTip } from '@@/Tip/TextTip';
+import { Tooltip } from '@@/Tip/Tooltip';
+
+import { Application } from '../../types';
+import { useApplicationHorizontalPodAutoscaler } from '../../queries/useApplicationHorizontalPodAutoscaler';
+
+type Props = {
+  environmentId: EnvironmentId;
+  namespace: string;
+  appName: string;
+  app?: Application;
+};
+
+export function ApplicationAutoScalingTable({
+  environmentId,
+  namespace,
+  appName,
+  app,
+}: Props) {
+  const { data: appAutoScalar } = useApplicationHorizontalPodAutoscaler(
+    environmentId,
+    namespace,
+    appName,
+    app
+  );
+
+  return (
+    <>
+      <div className="text-muted mb-4 flex items-center">
+        <Icon icon={Move} className="!mr-2" />
+        Auto-scaling
+      </div>
+      {!appAutoScalar && (
+        <TextTip color="blue">
+          This application does not have an autoscaling policy defined.
+        </TextTip>
+      )}
+      {appAutoScalar && (
+        <div className="mt-4 w-3/5">
+          <table className="table">
+            <tbody>
+              <tr className="text-muted">
+                <td className="w-1/3">Minimum instances</td>
+                <td className="w-1/3">Maximum instances</td>
+                <td className="w-1/3">
+                  <div className="flex min-w-max items-center gap-1">
+                    Target CPU usage
+                    <Tooltip message="The autoscaler will ensure enough instances are running to maintain an average CPU usage across all instances." />
+                  </div>
+                </td>
+              </tr>
+              <tr>
+                <td data-cy="k8sAppDetail-minReplicas">
+                  {appAutoScalar.spec?.minReplicas}
+                </td>
+                <td data-cy="k8sAppDetail-maxReplicas">
+                  {appAutoScalar.spec?.maxReplicas}
+                </td>
+                <td data-cy="k8sAppDetail-targetCPU">
+                  {appAutoScalar.spec?.targetCPUUtilizationPercentage}%
+                </td>
+              </tr>
+            </tbody>
+          </table>
+        </div>
+      )}
+    </>
+  );
+}
diff --git a/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/ApplicationDetailsWidget.tsx b/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/ApplicationDetailsWidget.tsx
new file mode 100644
index 0000000..04798c1
--- /dev/null
+++ b/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/ApplicationDetailsWidget.tsx
@@ -0,0 +1,138 @@
+import { useCurrentStateAndParams } from '@uirouter/react';
+
+import { useNamespaceQuery } from '@/react/kubernetes/namespaces/queries/useNamespaceQuery';
+import { useStack } from '@/react/common/stacks/queries/useStack';
+import { GitReferenceCard } from '@/react/portainer/gitops/GitReferenceCard';
+
+import { Widget, WidgetBody } from '@@/Widget';
+
+import { isExternalApplication } from '../../utils';
+import { appStackIdLabel, appStackKindLabel } from '../../constants';
+import { useApplication } from '../../queries/useApplication';
+import { useApplicationServices } from '../../queries/useApplicationServices';
+import { Application } from '../../types';
+
+import { ApplicationServicesTable } from './ApplicationServicesTable';
+import { ApplicationIngressesTable } from './ApplicationIngressesTable';
+import { ApplicationAutoScalingTable } from './ApplicationAutoScalingTable';
+import { ApplicationEnvVarsTable } from './ApplicationEnvVarsTable';
+import { ApplicationVolumeConfigsTable } from './ApplicationVolumeConfigsTable';
+import { ApplicationPersistentDataTable } from './ApplicationPersistentDataTable';
+import { PlacementsTable } from './PlacementsTable';
+import { ButtonsLine } from './ButtonsLine';
+
+export function ApplicationDetailsWidget() {
+  const stateAndParams = useCurrentStateAndParams();
+  const {
+    params: {
+      namespace,
+      name,
+      'resource-type': resourceType,
+      endpointId: environmentId,
+    },
+  } = stateAndParams;
+
+  const namespaceData = useNamespaceQuery(environmentId, namespace);
+  const isSystemNamespace = namespaceData.data?.IsSystem;
+
+  const { data: app } = useApplication(
+    environmentId,
+    namespace,
+    name,
+    resourceType
+  );
+
+  const { stackId: appStackId, stackKind: appStackKind } =
+    getStackDetailsFromLabels(app);
+
+  const externalApp = !!app && isExternalApplication(app);
+
+  const isManagedStack =
+    !!appStackId && !externalApp && appStackKind !== 'edge';
+
+  const stackQuery = useStack(appStackId, { enabled: isManagedStack });
+
+  const { data: appServices } = useApplicationServices(
+    environmentId,
+    namespace,
+    name,
+    app
+  );
+
+  const stack = stackQuery?.data;
+
+  return (
+    <div className="row">
+      <div className="col-sm-12">
+        <Widget>
+          <WidgetBody>
+            {!isSystemNamespace && (
+              <>
+                {!!stack?.GitConfig && !!stack.GitSourceId && (
+                  <div className="mb-4">
+                    <GitReferenceCard
+                      autoUpdate={stack.AutoUpdate}
+                      gitConfig={stack.GitConfig}
+                      currentDeploymentInfo={stack.CurrentDeploymentInfo}
+                      stackType="kubernetes"
+                      sourceId={stack.GitSourceId}
+                    />
+                  </div>
+                )}
+
+                <div className="mb-4">
+                  <ButtonsLine
+                    app={app}
+                    environmentId={environmentId}
+                    externalApp={externalApp}
+                    name={name}
+                    namespace={namespace}
+                    appStackId={appStackId}
+                    appStackKind={appStackKind}
+                    stack={stack}
+                  />
+                </div>
+              </>
+            )}
+            <ApplicationServicesTable
+              environmentId={environmentId}
+              appServices={appServices}
+            />
+            <ApplicationIngressesTable
+              appServices={appServices}
+              environmentId={environmentId}
+              namespace={namespace}
+            />
+            <ApplicationAutoScalingTable
+              environmentId={environmentId}
+              namespace={namespace}
+              appName={name}
+              app={app}
+            />
+            <ApplicationEnvVarsTable namespace={namespace} app={app} />
+            <ApplicationVolumeConfigsTable namespace={namespace} app={app} />
+            <ApplicationPersistentDataTable
+              environmentId={environmentId}
+              namespace={namespace}
+              appName={name}
+              app={app}
+            />
+            {!externalApp && <PlacementsTable app={app} />}
+          </WidgetBody>
+        </Widget>
+      </div>
+    </div>
+  );
+}
+
+function getStackDetailsFromLabels(app?: Application): {
+  stackId?: number;
+  stackKind?: string;
+} {
+  // make undefined when missing so hooks don't run with invalid id
+  const appStackId = app?.metadata?.labels?.[appStackIdLabel]
+    ? Number(app.metadata.labels[appStackIdLabel])
+    : undefined;
+  const appStackKind = app?.metadata?.labels?.[appStackKindLabel];
+  return { stackId: appStackId, stackKind: appStackKind };
+}
diff --git a/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/ApplicationEnvVarsTable.test.tsx b/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/ApplicationEnvVarsTable.test.tsx
new file mode 100644
index 0000000..22baba6
--- /dev/null
+++ b/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/ApplicationEnvVarsTable.test.tsx
@@ -0,0 +1,702 @@
+import React from 'react';
+import { render, screen } from '@testing-library/react';
+import { vi, beforeEach, afterEach } from 'vitest';
+
+import { Application } from '../../types';
+
+import { ApplicationEnvVarsTable } from './ApplicationEnvVarsTable';
+
+// Mock icon components
+vi.mock('lucide-react', () => ({
+  Asterisk: () => <span data-cy="asterisk-icon" />,
+  File: () => <span data-cy="file-icon" />,
+  FileCode: () => <span data-cy="file-code-icon" />,
+  Key: () => <span data-cy="key-icon" />,
+  Lock: () => <span data-cy="lock-icon" />,
+}));
+
+// Mock UI components
+vi.mock('@@/Icon', () => ({
+  Icon: ({
+    icon: IconComponent,
+    ...props
+  }: {
+    icon: React.ComponentType;
+    [key: string]: unknown;
+  }) => <IconComponent {...props} />,
+}));
+
+vi.mock('@@/Tip/TextTip', () => ({
+  TextTip: ({
+    children,
+    color,
+  }: {
+    children: React.ReactNode;
+    color?: string;
+  }) => (
+    <div data-cy="text-tip" data-color={color}>
+      {children}
+    </div>
+  ),
+}));
+
+// Mock the Link component to capture routing props
+const mockLink = vi.fn();
+vi.mock('@@/Link', () => ({
+  Link: ({
+    children,
+    to,
+    params,
+    'data-cy': dataCy,
+    className,
+  }: {
+    children: React.ReactNode;
+    to: string;
+    params: Record<string, string>;
+    'data-cy'?: string;
+    className?: string;
+  }) => {
+    mockLink({ children, to, params, 'data-cy': dataCy, className });
+    return (
+      <span
+        data-cy={dataCy}
+        data-testid={dataCy}
+        role="link"
+        data-to={to}
+        data-params={JSON.stringify(params)}
+        className={className}
+      >
+        {children}
+      </span>
+    );
+  },
+}));
+
+describe('ApplicationEnvVarsTable', () => {
+  beforeEach(() => {
+    mockLink.mockClear();
+  });
+
+  afterEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('should render helpful tip when there are no environment variables', () => {
+    const app: Application = {
+      metadata: { name: 'test-pod', namespace: 'default' },
+      spec: {
+        containers: [
+          {
+            name: 'test-container',
+            image: 'test-image',
+          },
+        ],
+      },
+      kind: 'Pod',
+      apiVersion: 'v1',
+    };
+
+    render(<ApplicationEnvVarsTable namespace="default" app={app} />);
+
+    expect(
+      screen.getByText('Environment variables, ConfigMaps or Secrets')
+    ).toBeInTheDocument();
+    expect(screen.getByTestId('text-tip')).toBeInTheDocument();
+    expect(
+      screen.getByText(
+        'This application is not using any environment variable, ConfigMap or Secret.'
+      )
+    ).toBeInTheDocument();
+  });
+
+  it('should render nothing when app is undefined', () => {
+    render(<ApplicationEnvVarsTable namespace="default" app={undefined} />);
+
+    expect(
+      screen.getByText('Environment variables, ConfigMaps or Secrets')
+    ).toBeInTheDocument();
+    expect(screen.getByTestId('text-tip')).toBeInTheDocument();
+  });
+
+  it('should render regular environment variables with direct values', () => {
+    const app: Application = {
+      metadata: { name: 'test-pod', namespace: 'default' },
+      spec: {
+        containers: [
+          {
+            name: 'test-container',
+            image: 'test-image',
+            env: [
+              {
+                name: 'ENV_VAR',
+                value: 'test-value',
+              },
+            ],
+          },
+        ],
+      },
+      kind: 'Pod',
+      apiVersion: 'v1',
+    };
+
+    render(<ApplicationEnvVarsTable namespace="default" app={app} />);
+
+    expect(screen.getByText('test-container')).toBeInTheDocument();
+    expect(screen.getByText('ENV_VAR')).toBeInTheDocument();
+    expect(screen.getByText('test-value')).toBeInTheDocument();
+    expect(screen.getByText('-')).toBeInTheDocument(); // No configuration resource
+  });
+
+  it('should render configmap environment variables with correct routing', () => {
+    const app: Application = {
+      metadata: { name: 'test-pod', namespace: 'default' },
+      spec: {
+        containers: [
+          {
+            name: 'test-container',
+            image: 'test-image',
+            env: [
+              {
+                name: 'CONFIG_VAR',
+                valueFrom: {
+                  configMapKeyRef: {
+                    name: 'test-configmap',
+                    key: 'config-key',
+                  },
+                },
+              },
+            ],
+          },
+        ],
+      },
+      kind: 'Pod',
+      apiVersion: 'v1',
+    };
+
+    render(<ApplicationEnvVarsTable namespace="default" app={app} />);
+
+    expect(screen.getByText('test-container')).toBeInTheDocument();
+    expect(screen.getAllByText('CONFIG_VAR')).toHaveLength(2); // Appears in name and value columns
+    // Note: config-key is not displayed in UI - the component shows the env var name
+    expect(screen.getByText('test-configmap')).toBeInTheDocument();
+    expect(screen.getByTestId('key-icon')).toBeInTheDocument();
+    expect(screen.getByTestId('file-code-icon')).toBeInTheDocument();
+
+    // Verify the Link component was called with correct routing parameters
+    expect(mockLink).toHaveBeenCalledWith(
+      expect.objectContaining({
+        to: 'kubernetes.configmaps.configmap',
+        params: {
+          name: 'test-configmap',
+          namespace: 'default',
+        },
+        'data-cy': 'configmap-link-test-configmap',
+      })
+    );
+  });
+
+  it('should render secret environment variables with correct routing', () => {
+    const app: Application = {
+      metadata: { name: 'test-pod', namespace: 'default' },
+      spec: {
+        containers: [
+          {
+            name: 'test-container',
+            image: 'test-image',
+            env: [
+              {
+                name: 'SECRET_VAR',
+                valueFrom: {
+                  secretKeyRef: {
+                    name: 'test-secret',
+                    key: 'secret-key',
+                  },
+                },
+              },
+            ],
+          },
+        ],
+      },
+      kind: 'Pod',
+      apiVersion: 'v1',
+    };
+
+    render(<ApplicationEnvVarsTable namespace="default" app={app} />);
+
+    expect(screen.getByText('test-container')).toBeInTheDocument();
+    expect(screen.getAllByText('SECRET_VAR')).toHaveLength(2); // Appears in name and value columns
+    // Note: secret-key is not displayed in UI - the component shows the env var name
+    expect(screen.getByText('test-secret')).toBeInTheDocument();
+    expect(screen.getByTestId('key-icon')).toBeInTheDocument();
+    expect(screen.getByTestId('lock-icon')).toBeInTheDocument();
+
+    // Verify the Link component was called with correct routing parameters for secret
+    expect(mockLink).toHaveBeenCalledWith(
+      expect.objectContaining({
+        to: 'kubernetes.secrets.secret',
+        params: {
+          name: 'test-secret',
+          namespace: 'default',
+        },
+        'data-cy': 'configmap-link-test-secret',
+      })
+    );
+  });
+
+  it('should render downward API field references', () => {
+    const app: Application = {
+      metadata: { name: 'test-pod', namespace: 'default' },
+      spec: {
+        containers: [
+          {
+            name: 'test-container',
+            image: 'test-image',
+            env: [
+              {
+                name: 'POD_NAME',
+                valueFrom: {
+                  fieldRef: {
+                    fieldPath: 'metadata.name',
+                  },
+                },
+              },
+            ],
+          },
+        ],
+      },
+      kind: 'Pod',
+      apiVersion: 'v1',
+    };
+
+    render(<ApplicationEnvVarsTable namespace="default" app={app} />);
+
+    expect(screen.getByText('test-container')).toBeInTheDocument();
+    expect(screen.getByText('POD_NAME')).toBeInTheDocument();
+    expect(
+      screen.getByText(
+        (content, element) =>
+          content.includes('metadata.name') && element?.tagName === 'SPAN'
+      )
+    ).toBeInTheDocument();
+    expect(screen.getByText('downward API')).toBeInTheDocument();
+    expect(screen.getByTestId('asterisk-icon')).toBeInTheDocument();
+    expect(screen.getByText('-')).toBeInTheDocument(); // No configuration resource
+  });
+
+  it('should render envFrom configmap (entire configmap import)', () => {
+    const app: Application = {
+      metadata: { name: 'test-pod', namespace: 'default' },
+      spec: {
+        containers: [
+          {
+            name: 'test-container',
+            image: 'test-image',
+            envFrom: [
+              {
+                configMapRef: {
+                  name: 'entire-configmap',
+                },
+              },
+            ],
+          },
+        ],
+      },
+      kind: 'Pod',
+      apiVersion: 'v1',
+    };
+
+    render(<ApplicationEnvVarsTable namespace="default" app={app} />);
+
+    expect(screen.getByText('test-container')).toBeInTheDocument();
+    expect(screen.getAllByText('-')).toHaveLength(2); // EnvFrom doesn't have a specific key name or value
+    expect(screen.getByText('entire-configmap')).toBeInTheDocument();
+    expect(screen.getByTestId('file-code-icon')).toBeInTheDocument();
+
+    // Verify configmap routing
+    expect(mockLink).toHaveBeenCalledWith(
+      expect.objectContaining({
+        to: 'kubernetes.configmaps.configmap',
+        params: {
+          name: 'entire-configmap',
+          namespace: 'default',
+        },
+        'data-cy': 'configmap-link-entire-configmap',
+      })
+    );
+  });
+
+  it('should render envFrom secret (entire secret import)', () => {
+    const app: Application = {
+      metadata: { name: 'test-pod', namespace: 'default' },
+      spec: {
+        containers: [
+          {
+            name: 'test-container',
+            image: 'test-image',
+            envFrom: [
+              {
+                secretRef: {
+                  name: 'entire-secret',
+                },
+              },
+            ],
+          },
+        ],
+      },
+      kind: 'Pod',
+      apiVersion: 'v1',
+    };
+
+    render(<ApplicationEnvVarsTable namespace="default" app={app} />);
+
+    expect(screen.getByText('test-container')).toBeInTheDocument();
+    expect(screen.getAllByText('-')).toHaveLength(2); // EnvFrom doesn't have a specific key name or value
+    expect(screen.getByText('entire-secret')).toBeInTheDocument();
+    expect(screen.getByTestId('lock-icon')).toBeInTheDocument();
+
+    // Verify secret routing
+    expect(mockLink).toHaveBeenCalledWith(
+      expect.objectContaining({
+        to: 'kubernetes.secrets.secret',
+        params: {
+          name: 'entire-secret',
+          namespace: 'default',
+        },
+        'data-cy': 'configmap-link-entire-secret',
+      })
+    );
+  });
+
+  it('should render init containers with asterisk indicator', () => {
+    const app: Application = {
+      metadata: { name: 'test-pod', namespace: 'default' },
+      spec: {
+        containers: [
+          {
+            name: 'main-container',
+            image: 'main-image',
+            env: [
+              {
+                name: 'MAIN_VAR',
+                value: 'main-value',
+              },
+            ],
+          },
+        ],
+        initContainers: [
+          {
+            name: 'init-container',
+            image: 'init-image',
+            env: [
+              {
+                name: 'INIT_VAR',
+                value: 'init-value',
+              },
+            ],
+          },
+        ],
+      },
+      kind: 'Pod',
+      apiVersion: 'v1',
+    };
+
+    render(<ApplicationEnvVarsTable namespace="default" app={app} />);
+
+    // Check main container
+    expect(screen.getByText('main-container')).toBeInTheDocument();
+    expect(screen.getByText('MAIN_VAR')).toBeInTheDocument();
+    expect(screen.getByText('main-value')).toBeInTheDocument();
+
+    // Check init container
+    expect(screen.getByText('init-container')).toBeInTheDocument();
+    expect(screen.getByText('INIT_VAR')).toBeInTheDocument();
+    expect(screen.getByText('init-value')).toBeInTheDocument();
+    expect(screen.getByText('init container')).toBeInTheDocument();
+    expect(screen.getByTestId('asterisk-icon')).toBeInTheDocument();
+  });
+
+  it('should handle mixed environment variable types correctly', () => {
+    const app: Application = {
+      metadata: { name: 'test-pod', namespace: 'default' },
+      spec: {
+        containers: [
+          {
+            name: 'test-container',
+            image: 'test-image',
+            env: [
+              {
+                name: 'REGULAR_VAR',
+                value: 'regular-value',
+              },
+              {
+                name: 'CONFIG_VAR',
+                valueFrom: {
+                  configMapKeyRef: {
+                    name: 'test-configmap',
+                    key: 'config-key',
+                  },
+                },
+              },
+              {
+                name: 'SECRET_VAR',
+                valueFrom: {
+                  secretKeyRef: {
+                    name: 'test-secret',
+                    key: 'secret-key',
+                  },
+                },
+              },
+            ],
+            envFrom: [
+              {
+                configMapRef: {
+                  name: 'entire-configmap',
+                },
+              },
+            ],
+          },
+        ],
+      },
+      kind: 'Pod',
+      apiVersion: 'v1',
+    };
+
+    render(<ApplicationEnvVarsTable namespace="default" app={app} />);
+
+    expect(screen.getAllByText('test-container')).toHaveLength(4); // Should appear 4 times - once for each env var
+    expect(screen.getByText('REGULAR_VAR')).toBeInTheDocument();
+    expect(screen.getByText('regular-value')).toBeInTheDocument();
+    expect(screen.getAllByText('CONFIG_VAR')).toHaveLength(2); // Appears in name and value columns
+    // Note: config-key is not displayed in UI - the component shows the env var name
+    expect(screen.getAllByText('SECRET_VAR')).toHaveLength(2); // Appears in name and value columns
+    // Note: secret-key is not displayed in UI - the component shows the env var name
+    expect(screen.getByText('test-configmap')).toBeInTheDocument();
+    expect(screen.getByText('test-secret')).toBeInTheDocument();
+    expect(screen.getByText('entire-configmap')).toBeInTheDocument();
+
+    // Should have made multiple Link calls
+    expect(mockLink).toHaveBeenCalledTimes(3);
+
+    // Verify different routing calls
+    expect(mockLink).toHaveBeenCalledWith(
+      expect.objectContaining({
+        to: 'kubernetes.configmaps.configmap',
+      })
+    );
+
+    expect(mockLink).toHaveBeenCalledWith(
+      expect.objectContaining({
+        to: 'kubernetes.secrets.secret',
+      })
+    );
+  });
+
+  it('should handle Deployment kind applications', () => {
+    const app: Application = {
+      metadata: { name: 'test-deployment', namespace: 'default' },
+      spec: {
+        selector: {
+          matchLabels: {
+            app: 'test-app',
+          },
+        },
+        template: {
+          spec: {
+            containers: [
+              {
+                name: 'test-container',
+                image: 'test-image',
+                env: [
+                  {
+                    name: 'ENV_VAR',
+                    value: 'test-value',
+                  },
+                ],
+              },
+            ],
+          },
+        },
+      },
+      kind: 'Deployment',
+      apiVersion: 'apps/v1',
+    };
+
+    render(<ApplicationEnvVarsTable namespace="default" app={app} />);
+
+    expect(screen.getByText('test-container')).toBeInTheDocument();
+    expect(screen.getByText('ENV_VAR')).toBeInTheDocument();
+    expect(screen.getByText('test-value')).toBeInTheDocument();
+  });
+
+  it('should handle missing resource names gracefully', () => {
+    const app: Application = {
+      metadata: { name: 'test-pod', namespace: 'default' },
+      spec: {
+        containers: [
+          {
+            name: 'test-container',
+            image: 'test-image',
+            env: [
+              {
+                name: 'CONFIG_VAR',
+                valueFrom: {
+                  configMapKeyRef: {
+                    // name is undefined
+                    key: 'config-key',
+                  },
+                },
+              },
+            ],
+          },
+        ],
+      },
+      kind: 'Pod',
+      apiVersion: 'v1',
+    };
+
+    render(<ApplicationEnvVarsTable namespace="default" app={app} />);
+
+    expect(screen.getByText('test-container')).toBeInTheDocument();
+    expect(screen.getAllByText('CONFIG_VAR')).toHaveLength(2); // Appears in name and value columns
+    // Note: config-key is not displayed in UI - the component shows the env var name
+
+    // Should show dash for missing resource name
+    const dashElements = screen.getAllByText('-');
+    expect(dashElements.length).toBeGreaterThan(0);
+  });
+
+  it('should handle containers without environment variables', () => {
+    const app: Application = {
+      metadata: { name: 'test-pod', namespace: 'default' },
+      spec: {
+        containers: [
+          {
+            name: 'test-container',
+            image: 'test-image',
+            // No env or envFrom
+          },
+        ],
+      },
+      kind: 'Pod',
+      apiVersion: 'v1',
+    };
+
+    render(<ApplicationEnvVarsTable namespace="default" app={app} />);
+
+    expect(
+      screen.getByText('Environment variables, ConfigMaps or Secrets')
+    ).toBeInTheDocument();
+    expect(screen.getByTestId('text-tip')).toBeInTheDocument();
+    expect(
+      screen.getByText(
+        'This application is not using any environment variable, ConfigMap or Secret.'
+      )
+    ).toBeInTheDocument();
+  });
+
+  it('should handle environment variables without keys', () => {
+    const app: Application = {
+      metadata: { name: 'test-pod', namespace: 'default' },
+      spec: {
+        containers: [
+          {
+            name: 'test-container',
+            image: 'test-image',
+            env: [
+              {
+                name: '', // Empty name to test this edge case
+                value: 'test-value',
+              },
+            ],
+          },
+        ],
+      },
+      kind: 'Pod',
+      apiVersion: 'v1',
+    };
+
+    render(<ApplicationEnvVarsTable namespace="default" app={app} />);
+
+    expect(screen.getByText('test-container')).toBeInTheDocument();
+    expect(screen.getByText('test-value')).toBeInTheDocument();
+
+    // Should show dash for missing env var name
+    const dashElements = screen.getAllByText('-');
+    expect(dashElements.length).toBeGreaterThan(0);
+  });
+
+  it('should render multiple containers with different environment variable types', () => {
+    const app: Application = {
+      metadata: { name: 'test-pod', namespace: 'default' },
+      spec: {
+        containers: [
+          {
+            name: 'container-1',
+            image: 'image-1',
+            env: [
+              {
+                name: 'CONFIG_VAR',
+                valueFrom: {
+                  configMapKeyRef: {
+                    name: 'shared-config',
+                    key: 'config-key',
+                  },
+                },
+              },
+            ],
+          },
+          {
+            name: 'container-2',
+            image: 'image-2',
+            env: [
+              {
+                name: 'SECRET_VAR',
+                valueFrom: {
+                  secretKeyRef: {
+                    name: 'shared-config', // Same name but different type
+                    key: 'secret-key',
+                  },
+                },
+              },
+            ],
+          },
+        ],
+      },
+      kind: 'Pod',
+      apiVersion: 'v1',
+    };
+
+    render(<ApplicationEnvVarsTable namespace="default" app={app} />);
+
+    expect(screen.getByText('container-1')).toBeInTheDocument();
+    expect(screen.getByText('container-2')).toBeInTheDocument();
+    expect(screen.getAllByText('CONFIG_VAR')).toHaveLength(2); // Appears in name and value columns
+    expect(screen.getAllByText('SECRET_VAR')).toHaveLength(2); // Appears in name and value columns
+    expect(screen.getAllByText('shared-config')).toHaveLength(2);
+
+    // Should have made two Link calls - one for configmap, one for secret
+    expect(mockLink).toHaveBeenCalledTimes(2);
+
+    // Verify configmap routing
+    expect(mockLink).toHaveBeenCalledWith(
+      expect.objectContaining({
+        to: 'kubernetes.configmaps.configmap',
+        params: {
+          name: 'shared-config',
+          namespace: 'default',
+        },
+      })
+    );
+
+    // Verify secret routing
+    expect(mockLink).toHaveBeenCalledWith(
+      expect.objectContaining({
+        to: 'kubernetes.secrets.secret',
+        params: {
+          name: 'shared-config',
+          namespace: 'default',
+        },
+      })
+    );
+  });
+});
diff --git a/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/ApplicationEnvVarsTable.tsx b/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/ApplicationEnvVarsTable.tsx
new file mode 100644
index 0000000..bbfefef
--- /dev/null
+++ b/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/ApplicationEnvVarsTable.tsx
@@ -0,0 +1,221 @@
+import { Pod } from 'kubernetes-types/core/v1';
+import { Asterisk, File, FileCode, Key, Lock } from 'lucide-react';
+
+import { Icon } from '@@/Icon';
+import { TextTip } from '@@/Tip/TextTip';
+import { Link } from '@@/Link';
+
+import { Application } from '../../types';
+import { applicationIsKind } from '../../utils';
+
+type Props = {
+  namespace: string;
+  app?: Application;
+};
+
+export function ApplicationEnvVarsTable({ namespace, app }: Props) {
+  const appEnvVars = getApplicationEnvironmentVariables(app);
+
+  return (
+    <>
+      <div className="text-muted mb-4 mt-6 flex items-center">
+        <Icon icon={File} className="!mr-2" />
+        Environment variables, ConfigMaps or Secrets
+      </div>
+      {appEnvVars.length === 0 && (
+        <TextTip color="blue">
+          This application is not using any environment variable, ConfigMap or
+          Secret.
+        </TextTip>
+      )}
+      {appEnvVars.length > 0 && (
+        <table className="table">
+          <tbody>
+            <tr className="text-muted">
+              <td className="w-1/4">Container</td>
+              <td className="w-1/4">Environment variable</td>
+              <td className="w-1/4">Value</td>
+              <td className="w-1/4">Configuration</td>
+            </tr>
+            {appEnvVars.map((envVar, index) => (
+              <tr key={index}>
+                <td data-cy="k8sAppDetail-containerName">
+                  {envVar.containerName}
+                  {envVar.isInitContainer && (
+                    <span>
+                      <Icon icon={Asterisk} className="!ml-1" />
+                      {envVar.fieldPath} (
+                      <a
+                        href="https://kubernetes.io/docs/concepts/workloads/pods/init-containers/"
+                        target="_blank"
+                        rel="noopener noreferrer"
+                      >
+                        init container
+                      </a>
+                      )
+                    </span>
+                  )}
+                </td>
+                <td data-cy="k8sAppDetail-envVarName">{envVar.key || '-'}</td>
+                <td data-cy="k8sAppDetail-envVarValue">
+                  {envVar.value && <span>{envVar.value}</span>}
+                  {envVar.fieldPath && (
+                    <span>
+                      <Icon icon={Asterisk} className="!ml-1" />
+                      {envVar.fieldPath} (
+                      <a
+                        href="https://kubernetes.io/docs/tasks/inject-data-application/downward-api-volume-expose-pod-information/"
+                        target="_blank"
+                        rel="noopener noreferrer"
+                      >
+                        downward API
+                      </a>
+                      )
+                    </span>
+                  )}
+                  {envVar.type !== 'env' &&
+                    (envVar.key ? (
+                      <span className="flex items-center">
+                        <Icon icon={Key} className="!mr-1" />
+                        {envVar.key}
+                      </span>
+                    ) : (
+                      '-'
+                    ))}
+                </td>
+                <td data-cy="k8sAppDetail-configName">
+                  {!envVar.resourceName && <span>-</span>}
+                  {envVar.resourceName && (
+                    <span>
+                      <Link
+                        to={
+                          envVar.type === 'configMap'
+                            ? 'kubernetes.configmaps.configmap'
+                            : 'kubernetes.secrets.secret'
+                        }
+                        params={{
+                          name: envVar.resourceName,
+                          namespace,
+                        }}
+                        className="flex items-center"
+                        data-cy={`configmap-link-${envVar.resourceName}`}
+                      >
+                        <Icon
+                          icon={envVar.type === 'configMap' ? FileCode : Lock}
+                          className="!mr-1"
+                        />
+                        {envVar.resourceName}
+                      </Link>
+                    </span>
+                  )}
+                </td>
+              </tr>
+            ))}
+          </tbody>
+        </table>
+      )}
+    </>
+  );
+}
+
+type EnvVarType = 'env' | 'configMap' | 'secret';
+interface ContainerEnvVar {
+  key?: string;
+  value?: string;
+  fieldPath?: string;
+  containerName: string;
+  isInitContainer: boolean;
+  type: EnvVarType;
+  resourceName: string;
+}
+
+function getApplicationEnvironmentVariables(
+  app?: Application
+): ContainerEnvVar[] {
+  if (!app) {
+    return [];
+  }
+
+  const podSpec = applicationIsKind<Pod>('Pod', app)
+    ? app.spec
+    : app.spec?.template?.spec;
+  const appContainers = podSpec?.containers || [];
+  const appInitContainers = podSpec?.initContainers || [];
+
+  // get all the environment variables for each container
+  const appContainersEnvVars =
+    appContainers?.flatMap((container) => {
+      const containerEnvVars: ContainerEnvVar[] =
+        container?.env?.map((envVar) => {
+          let envtype: EnvVarType = 'env';
+          if (envVar?.valueFrom?.configMapKeyRef) {
+            envtype = 'configMap';
+          } else if (envVar?.valueFrom?.secretKeyRef) {
+            envtype = 'secret';
+          }
+          return {
+            key: envVar?.name,
+            fieldPath: envVar?.valueFrom?.fieldRef?.fieldPath,
+            containerName: container.name,
+            isInitContainer: false,
+            type: envtype,
+            resourceName:
+              envVar?.valueFrom?.configMapKeyRef?.name ||
+              envVar?.valueFrom?.secretKeyRef?.name ||
+              '',
+            value: envVar?.value,
+          };
+        }) || [];
+
+      const containerEnvFroms: ContainerEnvVar[] =
+        container?.envFrom?.map((envFrom) => ({
+          name: '',
+          resourceName:
+            envFrom?.configMapRef?.name || envFrom?.secretRef?.name || '',
+          containerName: container.name,
+          isInitContainer: false,
+          type: envFrom?.configMapRef ? 'configMap' : 'secret',
+        })) || [];
+
+      return [...containerEnvVars, ...containerEnvFroms];
+    }) || [];
+
+  const appInitContainersEnvVars =
+    appInitContainers?.flatMap((container) => {
+      const containerEnvVars: ContainerEnvVar[] =
+        container?.env?.map((envVar) => {
+          let envtype: EnvVarType = 'env';
+          if (envVar?.valueFrom?.configMapKeyRef) {
+            envtype = 'configMap';
+          } else if (envVar?.valueFrom?.secretKeyRef) {
+            envtype = 'secret';
+          }
+          return {
+            key: envVar?.name,
+            fieldPath: envVar?.valueFrom?.fieldRef?.fieldPath,
+            containerName: container.name,
+            isInitContainer: true,
+            type: envtype,
+            resourceName:
+              envVar?.valueFrom?.configMapKeyRef?.name ||
+              envVar?.valueFrom?.secretKeyRef?.name ||
+              '',
+            value: envVar?.value,
+          };
+        }) || [];
+
+      const containerEnvFroms: ContainerEnvVar[] =
+        container?.envFrom?.map((envFrom) => ({
+          name: '',
+          resourceName:
+            envFrom?.configMapRef?.name || envFrom?.secretRef?.name || '',
+          containerName: container.name,
+          isInitContainer: true,
+          type: envFrom?.configMapRef ? 'configMap' : 'secret',
+        })) || [];
+
+      return [...containerEnvVars, ...containerEnvFroms];
+    }) || [];
+
+  return [...appContainersEnvVars, ...appInitContainersEnvVars];
+}
diff --git a/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/ApplicationIngressesTable.tsx b/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/ApplicationIngressesTable.tsx
new file mode 100644
index 0000000..8fb7413
--- /dev/null
+++ b/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/ApplicationIngressesTable.tsx
@@ -0,0 +1,131 @@
+import { Service } from 'kubernetes-types/core/v1';
+import { useMemo } from 'react';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { useIngresses } from '@/react/kubernetes/ingresses/queries';
+import { Ingress } from '@/react/kubernetes/ingresses/types';
+import { Authorized } from '@/react/hooks/useUser';
+
+import { Link } from '@@/Link';
+
+type Props = {
+  environmentId: EnvironmentId;
+  namespace: string;
+  appServices?: Service[];
+};
+
+export function ApplicationIngressesTable({
+  environmentId,
+  namespace,
+  appServices,
+}: Props) {
+  const namespaceIngresses = useIngresses(environmentId, {
+    withServices: true,
+  });
+  // getIngressPathsForAppServices could be expensive, so memoize it
+  const ingressPathsForAppServices = useMemo(
+    () => getIngressPathsForAppServices(namespaceIngresses.data, appServices),
+    [namespaceIngresses.data, appServices]
+  );
+
+  if (!ingressPathsForAppServices.length) {
+    return null;
+  }
+
+  return (
+    <table className="mt-4 table">
+      <tbody>
+        <tr className="text-muted">
+          <td className="w-[15%]">Ingress name</td>
+          <td className="w-[10%]">Service name</td>
+          <td className="w-[10%]">Host</td>
+          <td className="w-[10%]">Port</td>
+          <td className="w-[10%]">Path</td>
+          <td className="w-[15%]">HTTP Route</td>
+        </tr>
+        {ingressPathsForAppServices?.map((ingressPath, index) => (
+          <tr key={index}>
+            <td>
+              <Authorized authorizations="K8sIngressesW">
+                <Link
+                  to="kubernetes.ingresses.edit"
+                  params={{ name: ingressPath.ingressName, namespace }}
+                  data-cy={`ingress-link-${ingressPath.ingressName}`}
+                >
+                  {ingressPath.ingressName}
+                </Link>
+              </Authorized>
+            </td>
+            <td>{ingressPath.serviceName}</td>
+            <td>{ingressPath.host}</td>
+            <td>{ingressPath.port}</td>
+            <td>{ingressPath.path}</td>
+            <td>
+              <a
+                target="_blank"
+                rel="noopener noreferrer"
+                href={`${ingressPath.secure ? 'https' : 'http'}://${
+                  ingressPath.host
+                }${ingressPath.path}`}
+              >
+                {ingressPath.host}
+                {ingressPath.path}
+              </a>
+            </td>
+          </tr>
+        ))}
+      </tbody>
+    </table>
+  );
+}
+
+type IngressPath = {
+  ingressName: string;
+  serviceName: string;
+  port: number;
+  secure: boolean;
+  host: string;
+  path: string;
+};
+
+function getIngressPathsForAppServices(
+  ingresses?: Ingress[],
+  services?: Service[]
+): IngressPath[] {
+  if (!ingresses || !services) {
+    return [];
+  }
+  const matchingIngressesPaths = ingresses.flatMap((ingress) => {
+    // for each ingress get an array of ingress paths that match the app services
+    if (!ingress.Paths) {
+      return [];
+    }
+    const matchingIngressPaths = ingress.Paths?.filter((path) =>
+      services?.some((service) => {
+        const servicePorts = service.spec?.ports?.map((port) => port.port);
+        // include the ingress if the ingress path has a matching service name and port
+        return (
+          path.ServiceName === service.metadata?.name &&
+          servicePorts?.includes(path.Port)
+        );
+      })
+    ).map((path) => {
+      const secure =
+        (ingress.TLS &&
+          ingress.TLS.filter(
+            (tls) => tls.Hosts && tls.Hosts.includes(path.Host)
+          ).length > 0) ??
+        false;
+      return {
+        ingressName: ingress.Name,
+        serviceName: path.ServiceName,
+        port: path.Port,
+        secure,
+        host: path.Host,
+        path: path.Path,
+      };
+    });
+    return matchingIngressPaths;
+  });
+  return matchingIngressesPaths;
+}
diff --git a/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/ApplicationPersistentDataTable.tsx b/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/ApplicationPersistentDataTable.tsx
new file mode 100644
index 0000000..af63feb
--- /dev/null
+++ b/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/ApplicationPersistentDataTable.tsx
@@ -0,0 +1,270 @@
+import { useMemo } from 'react';
+import { Asterisk, Box, Boxes, Database } from 'lucide-react';
+import { Container, Pod, Volume } from 'kubernetes-types/core/v1';
+import { StatefulSet } from 'kubernetes-types/apps/v1';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { Icon } from '@@/Icon';
+import { TextTip } from '@@/Tip/TextTip';
+import { Tooltip } from '@@/Tip/Tooltip';
+import { Link } from '@@/Link';
+
+import { Application } from '../../types';
+import { applicationIsKind } from '../../utils';
+import { useApplicationPods } from '../../queries/useApplicationPods';
+
+type Props = {
+  environmentId: EnvironmentId;
+  namespace: string;
+  appName: string;
+  app?: Application;
+};
+
+export function ApplicationPersistentDataTable({
+  namespace,
+  app,
+  environmentId,
+  appName,
+}: Props) {
+  const { data: pods } = useApplicationPods(
+    environmentId,
+    namespace,
+    appName,
+    app
+  );
+  const persistedFolders = useMemo(
+    () => getPersistedFolders(app, pods),
+    [app, pods]
+  );
+  const dataAccessPolicy = getDataAccessPolicy(app);
+
+  return (
+    <>
+      <div className="text-muted mb-4 mt-6 flex items-center">
+        <Icon icon={Database} className="!mr-2 !shrink-0" />
+        Data persistence
+      </div>
+      {!persistedFolders.length && (
+        <TextTip color="blue">
+          This application has no persisted folders.
+        </TextTip>
+      )}
+      {persistedFolders.length > 0 && (
+        <>
+          <div className="small text-muted vertical-center mb-4">
+            Data access policy:
+            {dataAccessPolicy === 'isolated' && (
+              <>
+                <Icon icon={Boxes} />
+                Isolated
+                <Tooltip message="All the instances of this application are using their own data." />
+              </>
+            )}
+            {dataAccessPolicy === 'shared' && (
+              <>
+                <Icon icon={Box} />
+                Shared
+                <Tooltip message="All the instances of this application are sharing the same data." />
+              </>
+            )}
+          </div>
+          {dataAccessPolicy === 'isolated' && (
+            <table className="table">
+              <thead>
+                <tr className="text-muted">
+                  <td className="w-1/4">Container name</td>
+                  <td className="w-1/4">Pod name</td>
+                  <td className="w-1/4">Persisted folder</td>
+                  <td className="w-1/4">Persistence</td>
+                </tr>
+              </thead>
+              <tbody>
+                {persistedFolders.map((persistedFolder, index) => (
+                  <tr key={index}>
+                    <td>
+                      {persistedFolder.volumeMount.container.name}
+                      {persistedFolder.isContainerInit && (
+                        <span>
+                          <Icon icon={Asterisk} className="!mr-1" />(
+                          <a
+                            href="https://kubernetes.io/docs/concepts/workloads/pods/init-containers/"
+                            target="_blank"
+                            rel="noopener noreferrer"
+                          >
+                            init container
+                          </a>
+                          )
+                        </span>
+                      )}
+                    </td>
+                    <td>{persistedFolder.volumeMount?.pod?.metadata?.name}</td>
+                    <td>{persistedFolder.volumeMount.mountPath}</td>
+                    <td>
+                      {persistedFolder.volume.persistentVolumeClaim && (
+                        <Link
+                          className="hyperlink flex items-center"
+                          to="kubernetes.volumes.volume"
+                          params={{
+                            name: `${persistedFolder.volume.persistentVolumeClaim.claimName}-${persistedFolder.volumeMount?.pod?.metadata?.name}`,
+                            namespace,
+                          }}
+                          data-cy={`k8sAppDetail-volMountPath-${index}`}
+                        >
+                          <Icon icon={Database} className="!mr-1 shrink-0" />
+                          {`${persistedFolder.volume.persistentVolumeClaim.claimName}-${persistedFolder.volumeMount?.pod?.metadata?.name}`}
+                        </Link>
+                      )}
+                      {persistedFolder.volume.hostPath &&
+                        `${persistedFolder.volume.hostPath.path} on host filesystem`}
+                    </td>
+                  </tr>
+                ))}
+              </tbody>
+            </table>
+          )}
+          {dataAccessPolicy === 'shared' && (
+            <table className="table">
+              <thead>
+                <tr className="text-muted">
+                  <td className="w-1/3">Persisted folder</td>
+                  <td className="w-2/3">Persistence</td>
+                </tr>
+              </thead>
+              <tbody className="border-t-0">
+                {persistedFolders.map((persistedFolder, index) => (
+                  <tr key={index}>
+                    <td data-cy="k8sAppDetail-volMountPath">
+                      {persistedFolder.volumeMount.mountPath}
+                    </td>
+                    <td>
+                      {persistedFolder.volume.persistentVolumeClaim && (
+                        <Link
+                          className="hyperlink flex items-center"
+                          to="kubernetes.volumes.volume"
+                          params={{
+                            name: persistedFolder.volume.persistentVolumeClaim
+                              .claimName,
+                            namespace,
+                          }}
+                          data-cy={`k8sAppDetail-volMountPath-${index}`}
+                        >
+                          <Icon icon={Database} className="!mr-1 shrink-0" />
+                          {
+                            persistedFolder.volume.persistentVolumeClaim
+                              .claimName
+                          }
+                        </Link>
+                      )}
+                      {persistedFolder.volume.hostPath &&
+                        `${persistedFolder.volume.hostPath.path} on host filesystem`}
+                    </td>
+                  </tr>
+                ))}
+              </tbody>
+            </table>
+          )}
+        </>
+      )}
+    </>
+  );
+}
+
+function getDataAccessPolicy(app?: Application) {
+  if (!app || applicationIsKind<Pod>('Pod', app)) {
+    return 'none';
+  }
+  if (applicationIsKind<StatefulSet>('StatefulSet', app)) {
+    return 'isolated';
+  }
+  return 'shared';
+}
+
+function getPodsMatchingContainer(pods: Pod[], container: Container) {
+  const matchingPods = pods.filter((pod) => {
+    const podContainers = pod.spec?.containers || [];
+    const podInitContainers = pod.spec?.initContainers || [];
+    const podAllContainers = [...podContainers, ...podInitContainers];
+    return podAllContainers.some(
+      (podContainer) =>
+        podContainer.name === container.name &&
+        podContainer.image === container.image
+    );
+  });
+  return matchingPods;
+}
+
+function getPersistedFolders(app?: Application, pods?: Pod[]) {
+  if (!app || !pods) {
+    return [];
+  }
+
+  const podSpec = applicationIsKind<Pod>('Pod', app)
+    ? app.spec
+    : app.spec?.template?.spec;
+
+  const appVolumes = podSpec?.volumes || [];
+  const appVolumeClaimVolumes = getVolumeClaimTemplates(app, appVolumes);
+  const appAllVolumes = [...appVolumes, ...appVolumeClaimVolumes];
+
+  const appContainers = podSpec?.containers || [];
+  const appInitContainers = podSpec?.initContainers || [];
+  const appAllContainers = [...appContainers, ...appInitContainers];
+
+  // for each volume, find the volumeMounts that match it
+  const persistedFolders = appAllVolumes.flatMap((volume) => {
+    if (volume.persistentVolumeClaim || volume.hostPath) {
+      const volumeMounts = appAllContainers.flatMap((container) => {
+        const matchingPods = getPodsMatchingContainer(pods, container);
+        return (
+          container.volumeMounts?.flatMap(
+            (containerVolumeMount) =>
+              matchingPods.map((pod) => ({
+                ...containerVolumeMount,
+                container,
+                pod,
+              })) || []
+          ) || []
+        );
+      });
+      const uniqueMatchingVolumeMounts = volumeMounts.filter(
+        (volumeMount, index, self) =>
+          self.indexOf(volumeMount) === index && // remove volumeMounts with duplicate names
+          volumeMount.name === volume.name // remove volumeMounts that don't match the volume
+      );
+      return uniqueMatchingVolumeMounts.map((volumeMount) => ({
+        volume,
+        volumeMount,
+        isContainerInit: appInitContainers.some(
+          (container) => container.name === volumeMount.container.name
+        ),
+      }));
+    }
+    return [];
+  });
+  return persistedFolders;
+}
+
+function getVolumeClaimTemplates(app: Application, volumes: Volume[]) {
+  if (
+    applicationIsKind<StatefulSet>('StatefulSet', app) &&
+    app.spec?.volumeClaimTemplates
+  ) {
+    const volumeClaimTemplates: Volume[] = app.spec.volumeClaimTemplates.map(
+      (vc) => ({
+        name: vc.metadata?.name || '',
+        persistentVolumeClaim: { claimName: vc.metadata?.name || '' },
+      })
+    );
+    const newPVC = volumeClaimTemplates.filter(
+      (vc) =>
+        !volumes.find(
+          (v) =>
+            v.persistentVolumeClaim?.claimName ===
+            vc.persistentVolumeClaim?.claimName
+        )
+    );
+    return newPVC;
+  }
+  return [];
+}
diff --git a/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/ApplicationServicesTable.tsx b/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/ApplicationServicesTable.tsx
new file mode 100644
index 0000000..1b7b053
--- /dev/null
+++ b/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/ApplicationServicesTable.tsx
@@ -0,0 +1,130 @@
+import { Service } from 'kubernetes-types/core/v1';
+import { ExternalLink } from 'lucide-react';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { useEnvironment } from '@/react/portainer/environments/queries';
+
+import { Icon } from '@@/Icon';
+import { TextTip } from '@@/Tip/TextTip';
+
+type Props = {
+  environmentId: EnvironmentId;
+  appServices?: Service[];
+};
+
+export function ApplicationServicesTable({
+  environmentId,
+  appServices,
+}: Props) {
+  const { data: environment } = useEnvironment(environmentId);
+  return (
+    <>
+      <div className="text-muted mb-4 flex items-center">
+        <Icon icon={ExternalLink} className="!mr-2" />
+        Accessing the application
+      </div>
+      {appServices && appServices.length === 0 && (
+        <TextTip color="blue" className="mb-4">
+          This application is not exposing any port.
+        </TextTip>
+      )}
+      {appServices && appServices.length > 0 && (
+        <>
+          <TextTip color="blue" className="mb-4">
+            This application is exposed through service(s) as below:
+          </TextTip>
+          <table className="table">
+            <tbody>
+              <tr className="text-muted">
+                <td className="w-[15%]">Service name</td>
+                <td className="w-[10%]">Type</td>
+                <td className="w-[10%]">Cluster IP</td>
+                <td className="w-[10%]">External IP</td>
+                <td className="w-[10%]">Container port</td>
+                <td className="w-[15%]">Service port(s)</td>
+              </tr>
+              {appServices.map((service) => (
+                <tr key={service.metadata?.name}>
+                  <td>{service.metadata?.name}</td>
+                  <td>{service.spec?.type}</td>
+                  <td>{service.spec?.clusterIP}</td>
+                  {service.spec?.type === 'LoadBalancer' && (
+                    <td>
+                      {service.status?.loadBalancer?.ingress?.[0] &&
+                        service.spec?.ports?.[0] && (
+                          <a
+                            className="vertical-center hyperlink"
+                            target="_blank"
+                            rel="noopener noreferrer"
+                            href={`http://${service.status.loadBalancer.ingress[0].ip}:${service.spec.ports[0].port}`}
+                          >
+                            <Icon icon={ExternalLink} className="!mr-1" />
+                            <span data-cy="k8sAppDetail-containerPort">
+                              Access
+                            </span>
+                          </a>
+                        )}
+                      {!service.status?.loadBalancer?.ingress && (
+                        <div>
+                          {service.spec.externalIPs?.[0]
+                            ? service.spec.externalIPs[0]
+                            : 'pending...'}
+                        </div>
+                      )}
+                    </td>
+                  )}
+                  {service.spec?.type !== 'LoadBalancer' && (
+                    <td>
+                      {service.spec?.externalIPs?.[0]
+                        ? service.spec.externalIPs[0]
+                        : '-'}
+                    </td>
+                  )}
+                  <td data-cy="k8sAppDetail-containerPort">
+                    {service.spec?.ports?.map((port) => (
+                      <div key={port.name}>{port.targetPort}</div>
+                    ))}
+                  </td>
+                  <td>
+                    {service.spec?.ports?.map((port) => (
+                      <div key={port.name}>
+                        {environment?.PublicURL && port.nodePort && (
+                          <a
+                            className="vertical-center hyperlink"
+                            href={`http://${environment?.PublicURL}:${port.nodePort}`}
+                            target="_blank"
+                            rel="noopener noreferrer"
+                          >
+                            <Icon icon={ExternalLink} className="!mr-1" />
+                            <span data-cy="k8sAppDetail-containerPort">
+                              {port.port}
+                            </span>
+                            <span>{port.nodePort ? ' : ' : ''}</span>
+                            <span data-cy="k8sAppDetail-nodePort">
+                              {port.nodePort}/{port.protocol}
+                            </span>
+                          </a>
+                        )}
+                        {!environment?.PublicURL && (
+                          <div>
+                            <span data-cy="k8sAppDetail-servicePort">
+                              {port.port}
+                            </span>
+                            <span>{port.nodePort ? ' : ' : ''}</span>
+                            <span data-cy="k8sAppDetail-nodePort">
+                              {port.nodePort}/{port.protocol}
+                            </span>
+                          </div>
+                        )}
+                      </div>
+                    ))}
+                  </td>
+                </tr>
+              ))}
+            </tbody>
+          </table>
+        </>
+      )}
+    </>
+  );
+}
diff --git a/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/ApplicationVolumeConfigsTable.test.tsx b/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/ApplicationVolumeConfigsTable.test.tsx
new file mode 100644
index 0000000..2fce798
--- /dev/null
+++ b/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/ApplicationVolumeConfigsTable.test.tsx
@@ -0,0 +1,583 @@
+import React from 'react';
+import { render, screen } from '@testing-library/react';
+import { vi, beforeEach, afterEach } from 'vitest';
+
+import { Application } from '../../types';
+
+import { ApplicationVolumeConfigsTable } from './ApplicationVolumeConfigsTable';
+
+// Mock icon components
+vi.mock('lucide-react', () => ({
+  Asterisk: () => <span data-cy="asterisk-icon" />,
+  Plus: () => <span data-cy="plus-icon" />,
+}));
+
+// Mock UI components
+vi.mock('@@/Icon', () => ({
+  Icon: ({
+    icon: IconComponent,
+    ...props
+  }: {
+    icon: React.ComponentType;
+    [key: string]: unknown;
+  }) => <IconComponent {...props} />,
+}));
+
+// Mock the Link component to capture routing props
+const mockLink = vi.fn();
+vi.mock('@@/Link', () => ({
+  Link: ({
+    children,
+    to,
+    params,
+    'data-cy': dataCy,
+    className,
+  }: {
+    children: React.ReactNode;
+    to: string;
+    params: Record<string, string>;
+    'data-cy'?: string;
+    className?: string;
+  }) => {
+    mockLink({ children, to, params, 'data-cy': dataCy, className });
+    return (
+      <span
+        data-cy={dataCy}
+        data-testid={dataCy}
+        role="link"
+        data-to={to}
+        data-params={JSON.stringify(params)}
+        className={className}
+      >
+        {children}
+      </span>
+    );
+  },
+}));
+
+describe('ApplicationVolumeConfigsTable', () => {
+  beforeEach(() => {
+    mockLink.mockClear();
+  });
+
+  afterEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('should render nothing when there are no volume configurations', () => {
+    const app: Application = {
+      metadata: { name: 'test-pod', namespace: 'default' },
+      spec: {
+        containers: [
+          {
+            name: 'test-container',
+            image: 'test-image',
+          },
+        ],
+      },
+      kind: 'Pod',
+      apiVersion: 'v1',
+    };
+
+    const { container } = render(
+      <ApplicationVolumeConfigsTable namespace="default" app={app} />
+    );
+
+    expect(container.firstChild).toBeNull();
+  });
+
+  it('should render nothing when app is undefined', () => {
+    const { container } = render(
+      <ApplicationVolumeConfigsTable namespace="default" app={undefined} />
+    );
+
+    expect(container.firstChild).toBeNull();
+  });
+
+  it('should render volume configurations from configmaps with items', () => {
+    const app: Application = {
+      metadata: { name: 'test-pod', namespace: 'default' },
+      spec: {
+        containers: [
+          {
+            name: 'test-container',
+            image: 'test-image',
+            volumeMounts: [
+              {
+                name: 'config-volume',
+                mountPath: '/etc/config',
+              },
+            ],
+          },
+        ],
+        volumes: [
+          {
+            name: 'config-volume',
+            configMap: {
+              name: 'test-configmap',
+              items: [
+                {
+                  key: 'config-key',
+                  path: 'config.yaml',
+                },
+              ],
+            },
+          },
+        ],
+      },
+      kind: 'Pod',
+      apiVersion: 'v1',
+    };
+
+    render(<ApplicationVolumeConfigsTable namespace="default" app={app} />);
+
+    expect(screen.getByText('test-container')).toBeInTheDocument();
+    expect(screen.getByText('/etc/config/config.yaml')).toBeInTheDocument();
+    expect(screen.getByText('config-key')).toBeInTheDocument();
+    expect(screen.getAllByTestId('plus-icon')).toHaveLength(2); // One for value, one for link
+    expect(screen.getByText('test-configmap')).toBeInTheDocument();
+
+    // Verify the Link component was called with correct routing parameters
+    expect(mockLink).toHaveBeenCalledWith(
+      expect.objectContaining({
+        to: 'kubernetes.configmaps.configmap',
+        params: {
+          name: 'test-configmap',
+          namespace: 'default',
+        },
+        'data-cy': 'config-link-test-configmap',
+      })
+    );
+  });
+
+  it('should render volume configurations from secrets with items', () => {
+    const app: Application = {
+      metadata: { name: 'test-pod', namespace: 'default' },
+      spec: {
+        containers: [
+          {
+            name: 'test-container',
+            image: 'test-image',
+            volumeMounts: [
+              {
+                name: 'secret-volume',
+                mountPath: '/etc/secrets',
+              },
+            ],
+          },
+        ],
+        volumes: [
+          {
+            name: 'secret-volume',
+            secret: {
+              secretName: 'test-secret',
+              items: [
+                {
+                  key: 'secret-key',
+                  path: 'secret.txt',
+                },
+              ],
+            },
+          },
+        ],
+      },
+      kind: 'Pod',
+      apiVersion: 'v1',
+    };
+
+    render(<ApplicationVolumeConfigsTable namespace="default" app={app} />);
+
+    expect(screen.getByText('test-container')).toBeInTheDocument();
+    expect(screen.getByText('/etc/secrets/secret.txt')).toBeInTheDocument();
+    expect(screen.getByText('secret-key')).toBeInTheDocument();
+    expect(screen.getAllByTestId('plus-icon')).toHaveLength(2); // One for value, one for link
+    expect(screen.getByText('test-secret')).toBeInTheDocument();
+
+    // Verify the Link component was called with correct routing parameters for secret
+    expect(mockLink).toHaveBeenCalledWith(
+      expect.objectContaining({
+        to: 'kubernetes.secrets.secret',
+        params: {
+          name: 'test-secret',
+          namespace: 'default',
+        },
+        'data-cy': 'secret-link-test-secret',
+      })
+    );
+  });
+
+  it('should render init containers with asterisk indicator', () => {
+    const app: Application = {
+      metadata: { name: 'test-pod', namespace: 'default' },
+      spec: {
+        containers: [
+          {
+            name: 'main-container',
+            image: 'main-image',
+            volumeMounts: [
+              {
+                name: 'config-volume',
+                mountPath: '/etc/config',
+              },
+            ],
+          },
+        ],
+        initContainers: [
+          {
+            name: 'init-container',
+            image: 'init-image',
+            volumeMounts: [
+              {
+                name: 'config-volume',
+                mountPath: '/etc/init-config',
+              },
+            ],
+          },
+        ],
+        volumes: [
+          {
+            name: 'config-volume',
+            configMap: {
+              name: 'shared-config',
+            },
+          },
+        ],
+      },
+      kind: 'Pod',
+      apiVersion: 'v1',
+    };
+
+    render(<ApplicationVolumeConfigsTable namespace="default" app={app} />);
+
+    // Check main container
+    expect(screen.getByText('main-container')).toBeInTheDocument();
+    expect(screen.getByText('/etc/config')).toBeInTheDocument();
+
+    // Check init container
+    expect(screen.getByText('init-container')).toBeInTheDocument();
+    expect(screen.getByText('/etc/init-config')).toBeInTheDocument();
+    expect(screen.getByTestId('asterisk-icon')).toBeInTheDocument();
+    expect(screen.getByText('init container')).toBeInTheDocument();
+  });
+
+  it('should render secret volume configurations correctly based on type', () => {
+    const app: Application = {
+      metadata: { name: 'test-pod', namespace: 'default' },
+      spec: {
+        containers: [
+          {
+            name: 'test-container',
+            image: 'test-image',
+            volumeMounts: [
+              {
+                name: 'secret-volume',
+                mountPath: '/etc/secrets',
+              },
+            ],
+          },
+        ],
+        volumes: [
+          {
+            name: 'secret-volume',
+            secret: {
+              secretName: 'test-secret',
+            },
+          },
+        ],
+      },
+      kind: 'Pod',
+      apiVersion: 'v1',
+    };
+
+    render(<ApplicationVolumeConfigsTable namespace="default" app={app} />);
+
+    expect(screen.getByText('test-container')).toBeInTheDocument();
+    expect(screen.getByText('test-secret')).toBeInTheDocument();
+
+    // Should route to secret page because type is 'secret'
+    expect(mockLink).toHaveBeenCalledWith(
+      expect.objectContaining({
+        to: 'kubernetes.secrets.secret',
+        params: {
+          name: 'test-secret',
+          namespace: 'default',
+        },
+        'data-cy': 'secret-link-test-secret',
+      })
+    );
+  });
+
+  it('should render configmap volume configurations correctly based on type', () => {
+    const app: Application = {
+      metadata: { name: 'test-pod', namespace: 'default' },
+      spec: {
+        containers: [
+          {
+            name: 'test-container',
+            image: 'test-image',
+            volumeMounts: [
+              {
+                name: 'config-volume',
+                mountPath: '/etc/config',
+              },
+            ],
+          },
+        ],
+        volumes: [
+          {
+            name: 'config-volume',
+            configMap: {
+              name: 'test-configmap',
+            },
+          },
+        ],
+      },
+      kind: 'Pod',
+      apiVersion: 'v1',
+    };
+
+    render(<ApplicationVolumeConfigsTable namespace="default" app={app} />);
+
+    expect(screen.getByText('test-container')).toBeInTheDocument();
+    expect(screen.getByText('test-configmap')).toBeInTheDocument();
+
+    // Should route to configmap page because type is 'configMap'
+    expect(mockLink).toHaveBeenCalledWith(
+      expect.objectContaining({
+        to: 'kubernetes.configmaps.configmap',
+        params: {
+          name: 'test-configmap',
+          namespace: 'default',
+        },
+        'data-cy': 'config-link-test-configmap',
+      })
+    );
+  });
+
+  it('should handle volumes without items (entire volume mount)', () => {
+    const app: Application = {
+      metadata: { name: 'test-pod', namespace: 'default' },
+      spec: {
+        containers: [
+          {
+            name: 'test-container',
+            image: 'test-image',
+            volumeMounts: [
+              {
+                name: 'config-volume',
+                mountPath: '/etc/config',
+              },
+            ],
+          },
+        ],
+        volumes: [
+          {
+            name: 'config-volume',
+            configMap: {
+              name: 'test-configmap',
+              // No items - entire configmap is mounted
+            },
+          },
+        ],
+      },
+      kind: 'Pod',
+      apiVersion: 'v1',
+    };
+
+    render(<ApplicationVolumeConfigsTable namespace="default" app={app} />);
+
+    expect(screen.getByText('test-container')).toBeInTheDocument();
+    expect(screen.getByText('/etc/config')).toBeInTheDocument();
+    expect(screen.getByText('-')).toBeInTheDocument(); // No specific key
+    expect(screen.getByText('test-configmap')).toBeInTheDocument();
+  });
+
+  it('should handle multiple volumes with different types correctly', () => {
+    const app: Application = {
+      metadata: { name: 'test-pod', namespace: 'default' },
+      spec: {
+        containers: [
+          {
+            name: 'test-container',
+            image: 'test-image',
+            volumeMounts: [
+              {
+                name: 'secret-volume',
+                mountPath: '/etc/secrets',
+              },
+              {
+                name: 'config-volume',
+                mountPath: '/etc/config',
+              },
+            ],
+          },
+        ],
+        volumes: [
+          {
+            name: 'secret-volume',
+            secret: {
+              secretName: 'test-secret',
+            },
+          },
+          {
+            name: 'config-volume',
+            configMap: {
+              name: 'test-configmap',
+            },
+          },
+        ],
+      },
+      kind: 'Pod',
+      apiVersion: 'v1',
+    };
+
+    render(<ApplicationVolumeConfigsTable namespace="default" app={app} />);
+
+    expect(screen.getAllByText('test-container')).toHaveLength(2); // Should appear twice - once for each volume
+    expect(screen.getByText('test-secret')).toBeInTheDocument();
+    expect(screen.getByText('test-configmap')).toBeInTheDocument();
+
+    // Should have made two Link calls - one for secret, one for configmap
+    expect(mockLink).toHaveBeenCalledTimes(2);
+
+    // Verify secret link
+    expect(mockLink).toHaveBeenCalledWith(
+      expect.objectContaining({
+        to: 'kubernetes.secrets.secret',
+        params: {
+          name: 'test-secret',
+          namespace: 'default',
+        },
+        'data-cy': 'secret-link-test-secret',
+      })
+    );
+
+    // Verify configmap link
+    expect(mockLink).toHaveBeenCalledWith(
+      expect.objectContaining({
+        to: 'kubernetes.configmaps.configmap',
+        params: {
+          name: 'test-configmap',
+          namespace: 'default',
+        },
+        'data-cy': 'config-link-test-configmap',
+      })
+    );
+  });
+
+  it('should handle containers without volume mounts', () => {
+    const app: Application = {
+      metadata: { name: 'test-pod', namespace: 'default' },
+      spec: {
+        containers: [
+          {
+            name: 'test-container',
+            image: 'test-image',
+            // No volumeMounts
+          },
+        ],
+        volumes: [
+          {
+            name: 'config-volume',
+            configMap: {
+              name: 'test-configmap',
+            },
+          },
+        ],
+      },
+      kind: 'Pod',
+      apiVersion: 'v1',
+    };
+
+    const { container } = render(
+      <ApplicationVolumeConfigsTable namespace="default" app={app} />
+    );
+
+    // Should render nothing because there are no matching volume mounts
+    expect(container.firstChild).toBeNull();
+  });
+
+  it('should handle Deployment kind applications', () => {
+    const app: Application = {
+      metadata: { name: 'test-deployment', namespace: 'default' },
+      spec: {
+        selector: {
+          matchLabels: {
+            app: 'test-app',
+          },
+        },
+        template: {
+          spec: {
+            containers: [
+              {
+                name: 'test-container',
+                image: 'test-image',
+                volumeMounts: [
+                  {
+                    name: 'config-volume',
+                    mountPath: '/etc/config',
+                  },
+                ],
+              },
+            ],
+            volumes: [
+              {
+                name: 'config-volume',
+                configMap: {
+                  name: 'test-configmap',
+                },
+              },
+            ],
+          },
+        },
+      },
+      kind: 'Deployment',
+      apiVersion: 'apps/v1',
+    };
+
+    render(<ApplicationVolumeConfigsTable namespace="default" app={app} />);
+
+    expect(screen.getByText('test-container')).toBeInTheDocument();
+    expect(screen.getByText('/etc/config')).toBeInTheDocument();
+    expect(screen.getByText('test-configmap')).toBeInTheDocument();
+  });
+
+  it('should handle missing volume config names', () => {
+    const app: Application = {
+      metadata: { name: 'test-pod', namespace: 'default' },
+      spec: {
+        containers: [
+          {
+            name: 'test-container',
+            image: 'test-image',
+            volumeMounts: [
+              {
+                name: 'config-volume',
+                mountPath: '/etc/config',
+              },
+            ],
+          },
+        ],
+        volumes: [
+          {
+            name: 'config-volume',
+            configMap: {
+              // name is undefined
+            },
+          },
+        ],
+      },
+      kind: 'Pod',
+      apiVersion: 'v1',
+    };
+
+    render(<ApplicationVolumeConfigsTable namespace="default" app={app} />);
+
+    expect(screen.getByText('test-container')).toBeInTheDocument();
+    expect(screen.getByText('/etc/config')).toBeInTheDocument();
+
+    // Should show dash for missing volume config name
+    const dashElements = screen.getAllByText('-');
+    expect(dashElements.length).toBeGreaterThan(0);
+  });
+});
diff --git a/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/ApplicationVolumeConfigsTable.tsx b/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/ApplicationVolumeConfigsTable.tsx
new file mode 100644
index 0000000..d3b4183
--- /dev/null
+++ b/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/ApplicationVolumeConfigsTable.tsx
@@ -0,0 +1,177 @@
+import { KeyToPath, Pod, VolumeMount } from 'kubernetes-types/core/v1';
+import { Asterisk, Plus } from 'lucide-react';
+
+import { Icon } from '@@/Icon';
+import { Link } from '@@/Link';
+
+import { Application } from '../../types';
+import { applicationIsKind } from '../../utils';
+
+type VolumeConfigType = 'configMap' | 'secret';
+
+type AppVolumeConfig = {
+  volumeConfigName: string | undefined;
+  containerVolumeMount: VolumeMount | undefined;
+  containerName: string;
+  isInitContainer: boolean;
+  item: KeyToPath;
+  type: VolumeConfigType;
+};
+
+type Props = {
+  namespace: string;
+  app?: Application;
+};
+
+export function ApplicationVolumeConfigsTable({ namespace, app }: Props) {
+  const containerVolumeConfigs = getApplicationVolumeConfigs(app);
+
+  if (containerVolumeConfigs.length === 0) {
+    return null;
+  }
+
+  return (
+    <table className="table">
+      <tbody>
+        <tr className="text-muted">
+          <td className="w-1/4">Container</td>
+          <td className="w-1/4">Configuration path</td>
+          <td className="w-1/4">Value</td>
+          <td className="w-1/4">Configuration</td>
+        </tr>
+        {containerVolumeConfigs.map(
+          (
+            {
+              containerVolumeMount,
+              isInitContainer,
+              containerName,
+              item,
+              volumeConfigName,
+              type,
+            },
+            index
+          ) => (
+            <tr key={index}>
+              <td>
+                {containerName}
+                {isInitContainer && (
+                  <span>
+                    <Icon icon={Asterisk} />(
+                    <a
+                      href="https://kubernetes.io/docs/concepts/workloads/pods/init-containers/"
+                      target="_blank"
+                      rel="noopener noreferrer"
+                    >
+                      init container
+                    </a>
+                    )
+                  </span>
+                )}
+              </td>
+              <td>
+                {item.path
+                  ? `${containerVolumeMount?.mountPath}/${item.path}`
+                  : `${containerVolumeMount?.mountPath}`}
+              </td>
+              <td>
+                {item.key && (
+                  <div className="flex items-center">
+                    <Icon icon={Plus} className="!mr-1" />
+                    {item.key}
+                  </div>
+                )}
+                {!item.key && '-'}
+              </td>
+              <td>
+                {type === 'secret' ? (
+                  <Link
+                    className="flex items-center"
+                    to="kubernetes.secrets.secret"
+                    params={{ name: volumeConfigName, namespace }}
+                    data-cy={`secret-link-${volumeConfigName}`}
+                  >
+                    <Icon icon={Plus} className="!mr-1" />
+                    {volumeConfigName}
+                  </Link>
+                ) : (
+                  <Link
+                    className="flex items-center"
+                    to="kubernetes.configmaps.configmap"
+                    params={{ name: volumeConfigName, namespace }}
+                    data-cy={`config-link-${volumeConfigName}`}
+                  >
+                    <Icon icon={Plus} className="!mr-1" />
+                    {volumeConfigName}
+                  </Link>
+                )}
+                {!volumeConfigName && '-'}
+              </td>
+            </tr>
+          )
+        )}
+      </tbody>
+    </table>
+  );
+}
+
+// getApplicationVolumeConfigs returns a list of volume configs / secrets for each container and each item within the matching volume
+function getApplicationVolumeConfigs(app?: Application): AppVolumeConfig[] {
+  if (!app) {
+    return [];
+  }
+
+  const podSpec = applicationIsKind<Pod>('Pod', app)
+    ? app.spec
+    : app.spec?.template?.spec;
+  const appContainers = podSpec?.containers || [];
+  const appInitContainers = podSpec?.initContainers || [];
+  const appVolumes = podSpec?.volumes || [];
+  const allContainers = [...appContainers, ...appInitContainers];
+
+  const appVolumeConfigs = allContainers.flatMap((container) => {
+    // for each container, get the volume mount paths
+    const matchingVolumes = appVolumes
+      // filter app volumes by config map or secret
+      .filter((volume) => volume.configMap || volume.secret)
+      .flatMap((volume) => {
+        // flatten by volume items if there are any
+        const volConfigMapItems =
+          volume.configMap?.items || volume.secret?.items || [];
+        const volumeConfigName =
+          volume.configMap?.name || volume.secret?.secretName;
+        const containerVolumeMount = container.volumeMounts?.find(
+          (volumeMount) => volumeMount.name === volume.name
+        );
+        const type: VolumeConfigType = volume.configMap
+          ? 'configMap'
+          : 'secret';
+
+        if (volConfigMapItems.length === 0) {
+          return [
+            {
+              volumeConfigName,
+              containerVolumeMount,
+              containerName: container.name,
+              isInitContainer: appInitContainers.includes(container),
+              item: {} as KeyToPath,
+              type,
+            },
+          ];
+        }
+        // if there are items, return a volume config for each item
+        return volConfigMapItems.map((item) => ({
+          volumeConfigName,
+          containerVolumeMount,
+          containerName: container.name,
+          isInitContainer: appInitContainers.includes(container),
+          item,
+          type,
+        }));
+      })
+      // only return the app volumes where the container volumeMounts include the volume name (from map step above)
+      .filter((volume) => volume.containerVolumeMount);
+    return matchingVolumes;
+  });
+
+  return appVolumeConfigs;
+}
diff --git a/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/ButtonsLine.tsx b/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/ButtonsLine.tsx
new file mode 100644
index 0000000..fd16877
--- /dev/null
+++ b/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/ButtonsLine.tsx
@@ -0,0 +1,91 @@
+import { Pod } from 'kubernetes-types/core/v1';
+
+import { Stack } from '@/react/common/stacks/types';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { isGitConfigDiverged } from '@/react/portainer/gitops/utils';
+
+import { AddButton } from '@@/buttons';
+
+import { useAppStackFile } from '../../queries/useAppStackFile';
+import { Application } from '../../types';
+import { applicationIsKind } from '../../utils';
+
+import { EditButtons } from './EditButtons';
+import { RedeployApplicationButton } from './RedeployApplicationButton';
+import { RestartApplicationButton } from './RestartApplicationButton';
+import { RollbackApplicationButton } from './RollbackApplicationButton';
+
+export function ButtonsLine({
+  stack,
+  environmentId,
+  externalApp,
+  appStackId,
+  appStackKind,
+  app,
+  name,
+  namespace,
+}: {
+  stack?: Stack;
+  externalApp: boolean;
+  environmentId: EnvironmentId;
+  appStackId?: number;
+  appStackKind?: string;
+  namespace: string;
+  app?: Application;
+  name: string;
+}) {
+  const appStackFileQuery = useAppStackFile(
+    {
+      id: stack?.Id ?? appStackId,
+      kind: appStackKind,
+    },
+    {
+      enabled:
+        !!stack &&
+        (!stack.GitConfig ||
+          !isGitConfigDiverged(stack.GitConfig, stack.CurrentDeploymentInfo)),
+    }
+  );
+  const appStackFileContent = appStackFileQuery.data;
+
+  return (
+    <div className="flex flex-wrap gap-2">
+      <EditButtons
+        isEdge={appStackKind === 'edge'}
+        stackId={stack?.Id ?? appStackId}
+        externalApp={externalApp}
+        stack={stack}
+      />
+      {!applicationIsKind<Pod>('Pod', app) && (
+        <>
+          <RestartApplicationButton />
+          <RedeployApplicationButton
+            environmentId={environmentId}
+            namespace={namespace}
+            appName={name}
+            app={app}
+          />
+        </>
+      )}
+      {!externalApp && (
+        <RollbackApplicationButton
+          environmentId={environmentId}
+          namespace={namespace}
+          appName={name}
+          app={app}
+        />
+      )}
+      {appStackFileContent && (
+        <AddButton
+          to="kubernetes.templates.custom.new"
+          data-cy="k8sAppDetail-createCustomTemplateButton"
+          params={{
+            fileContent: appStackFileContent,
+          }}
+        >
+          Create template from application
+        </AddButton>
+      )}
+    </div>
+  );
+}
diff --git a/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/EdgeEditButton.test.tsx b/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/EdgeEditButton.test.tsx
new file mode 100644
index 0000000..73ce756
--- /dev/null
+++ b/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/EdgeEditButton.test.tsx
@@ -0,0 +1,67 @@
+import { render, screen } from '@testing-library/react';
+import { vi } from 'vitest';
+
+import { EdgeEditButton } from './EdgeEditButton';
+
+const mockUseIsEdgeAdmin = vi.fn();
+
+vi.mock('@/react/hooks/useUser', () => ({
+  useIsEdgeAdmin: () => mockUseIsEdgeAdmin(),
+}));
+
+vi.mock('@@/Tip/TooltipWithChildren', () => ({
+  TooltipWithChildren: ({
+    children,
+    message,
+  }: {
+    children: React.ReactNode;
+    message: string;
+  }) => (
+    <div data-cy="tooltip" data-message={message}>
+      {children}
+    </div>
+  ),
+}));
+
+vi.mock('@@/Link', () => ({
+  Link: ({ children }: { children: React.ReactNode }) => (
+    <a href="/">{children}</a>
+  ),
+}));
+
+describe('EdgeEditButton', () => {
+  it('renders disabled button without tooltip while loading', () => {
+    mockUseIsEdgeAdmin.mockReturnValue({ isLoading: true, isAdmin: false });
+
+    render(<EdgeEditButton stackId={1} />);
+
+    const button = screen.getByRole('button');
+    expect(button).toBeDisabled();
+    expect(screen.queryByTestId('tooltip')).not.toBeInTheDocument();
+  });
+
+  it('renders enabled button without tooltip for edge admin', () => {
+    mockUseIsEdgeAdmin.mockReturnValue({ isLoading: false, isAdmin: true });
+
+    render(<EdgeEditButton stackId={1} />);
+
+    const button = screen.getByRole('link');
+    expect(button).not.toBeDisabled();
+    expect(screen.queryByTestId('tooltip')).not.toBeInTheDocument();
+  });
+
+  it('renders disabled button with tooltip for non-admin', () => {
+    mockUseIsEdgeAdmin.mockReturnValue({ isLoading: false, isAdmin: false });
+
+    render(<EdgeEditButton stackId={1} />);
+
+    const button = screen.getByRole('button');
+    expect(button).toBeDisabled();
+
+    const tooltip = screen.getByTestId('tooltip');
+    expect(tooltip).toHaveAttribute(
+      'data-message',
+      'This application is managed by an edge stack and can only be edited by an edge administrator'
+    );
+  });
+});
diff --git a/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/EdgeEditButton.tsx b/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/EdgeEditButton.tsx
new file mode 100644
index 0000000..8a51b1c
--- /dev/null
+++ b/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/EdgeEditButton.tsx
@@ -0,0 +1,36 @@
+import { useIsEdgeAdmin } from '@/react/hooks/useUser';
+
+import { TooltipWithChildren } from '@@/Tip/TooltipWithChildren';
+
+import { EditButton } from './EditButton';
+
+interface Props {
+  stackId: number | undefined;
+}
+
+export function EdgeEditButton({ stackId }: Props) {
+  const edgeAdminQuery = useIsEdgeAdmin();
+
+  const isDisabled =
+    edgeAdminQuery.isLoading || !edgeAdminQuery.isAdmin || !stackId;
+
+  const button = (
+    <EditButton
+      to="edge.stacks.edit"
+      params={{ stackId }}
+      disabled={isDisabled}
+    >
+      Manage edge stack
+    </EditButton>
+  );
+
+  if (edgeAdminQuery.isLoading || edgeAdminQuery.isAdmin || !stackId) {
+    return button;
+  }
+
+  return (
+    <TooltipWithChildren message="This application is managed by an edge stack and can only be edited by an edge administrator">
+      <span>{button}</span>
+    </TooltipWithChildren>
+  );
+}
diff --git a/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/EditButton.tsx b/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/EditButton.tsx
new file mode 100644
index 0000000..86bd3fb
--- /dev/null
+++ b/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/EditButton.tsx
@@ -0,0 +1,34 @@
+import { PencilIcon } from 'lucide-react';
+import { PropsWithChildren } from 'react';
+
+import { Button } from '@@/buttons';
+import { Link } from '@@/Link';
+
+interface Props {
+  to: string;
+  params?: Record<string, unknown>;
+
+  disabled?: boolean;
+}
+
+export function EditButton({
+  to = '',
+  params,
+  children,
+  disabled,
+}: PropsWithChildren<Props>) {
+  return (
+    <Button
+      type="button"
+      color="light"
+      size="small"
+      data-cy="k8sAppDetail-editAppButton"
+      disabled={disabled}
+      as={disabled ? 'button' : Link}
+      props={disabled ? undefined : { to, params }}
+      icon={PencilIcon}
+    >
+      {children}
+    </Button>
+  );
+}
diff --git a/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/EditButtons.tsx b/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/EditButtons.tsx
new file mode 100644
index 0000000..3fc4cca
--- /dev/null
+++ b/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/EditButtons.tsx
@@ -0,0 +1,41 @@
+import { Stack } from '@/react/common/stacks/types';
+import { Authorized } from '@/react/hooks/useUser';
+import { EditGitSettingsButton } from '@/react/common/stacks/EditGitSettingsButton';
+import { GitPullButton } from '@/react/common/stacks/GitPullButton';
+
+import { EdgeEditButton } from './EdgeEditButton';
+import { EditButton } from './EditButton';
+
+type Props = {
+  isEdge?: boolean;
+  stackId?: number;
+  externalApp?: boolean;
+  stack?: Stack;
+};
+
+export function EditButtons({ isEdge, stackId, externalApp, stack }: Props) {
+  if (isEdge) {
+    return (
+      <Authorized authorizations="K8sApplicationDetailsW">
+        <EdgeEditButton stackId={stackId} />
+      </Authorized>
+    );
+  }
+
+  if (stack?.GitConfig) {
+    return (
+      <>
+        {!stack.FromAppTemplate && <EditGitSettingsButton stack={stack} />}
+        <GitPullButton stack={stack} />
+      </>
+    );
+  }
+
+  return (
+    <Authorized authorizations="K8sApplicationDetailsW">
+      <EditButton to=".edit">
+        {externalApp ? 'Edit external application' : 'Edit this application'}
+      </EditButton>
+    </Authorized>
+  );
+}
diff --git a/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/PlacementsTable.tsx b/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/PlacementsTable.tsx
new file mode 100644
index 0000000..4e71411
--- /dev/null
+++ b/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/PlacementsTable.tsx
@@ -0,0 +1,84 @@
+import { Minimize2 } from 'lucide-react';
+import { NodeSelectorRequirement, Pod } from 'kubernetes-types/core/v1';
+import { useMemo } from 'react';
+
+import { Icon } from '@@/Icon';
+import { TextTip } from '@@/Tip/TextTip';
+
+import { Application } from '../../types';
+import { applicationIsKind } from '../../utils';
+
+type Props = {
+  app?: Application;
+};
+
+export function PlacementsTable({ app }: Props) {
+  const formPlacements = useAppPlacements(app);
+  return (
+    <>
+      <div className="text-muted mb-4 mt-6 flex items-center">
+        <Icon icon={Minimize2} className="!mr-2" />
+        Placement preferences and constraints
+      </div>
+      {!formPlacements.length && (
+        <TextTip color="blue">
+          This application has no pod preference or constraint rules from the
+          application form. See the application YAML for other placement rules.
+        </TextTip>
+      )}
+      {formPlacements.length > 0 && (
+        <table className="table">
+          <thead>
+            <tr className="text-muted">
+              <td className="w-1/3">Key</td>
+              <td className="w-2/3">Value(s)</td>
+            </tr>
+          </thead>
+          <tbody>
+            {formPlacements.map((placement, i) => (
+              <tr key={i}>
+                <td>{placement.key}</td>
+                <td>{placement.values?.join(', ')}</td>
+              </tr>
+            ))}
+          </tbody>
+        </table>
+      )}
+    </>
+  );
+}
+
+// useAppPlacements is a custom hook that returns the placements that relate to the Portainer application form.
+function useAppPlacements(app?: Application): NodeSelectorRequirement[] {
+  const formPlacements = useMemo(() => {
+    if (!app) {
+      return [];
+    }
+    // firstly get the pod spec
+    const podSpec = applicationIsKind<Pod>('Pod', app)
+      ? app.spec
+      : app.spec?.template?.spec;
+
+    // secondly filter all placements to get the placements that are related to the Portainer form. They are:
+    // - preference (s) in spec.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution
+    const placements =
+      podSpec?.affinity?.nodeAffinity
+        ?.preferredDuringSchedulingIgnoredDuringExecution;
+
+    // - matchExpressions in preference
+    const placementsWithMatchExpressions = placements?.filter(
+      (placement) => placement?.preference?.matchExpressions
+    );
+
+    // - only matchExpressions items with the operator: In
+    const portainerPlacements =
+      placementsWithMatchExpressions?.flatMap(
+        (placement) =>
+          placement?.preference?.matchExpressions?.filter(
+            (expression) => expression?.operator === 'In'
+          ) || []
+      ) || [];
+    return portainerPlacements;
+  }, [app]);
+  return formPlacements;
+}
diff --git a/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/RedeployApplicationButton.tsx b/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/RedeployApplicationButton.tsx
new file mode 100644
index 0000000..1ea80a4
--- /dev/null
+++ b/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/RedeployApplicationButton.tsx
@@ -0,0 +1,101 @@
+import { RotateCw } from 'lucide-react';
+import { Pod } from 'kubernetes-types/core/v1';
+import { useRouter } from '@uirouter/react';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { notifySuccess, notifyError } from '@/portainer/services/notifications';
+import { Authorized } from '@/react/hooks/useUser';
+
+import { confirm } from '@@/modals/confirm';
+import { ModalType } from '@@/modals';
+import { buildConfirmButton } from '@@/modals/utils';
+import { Button } from '@@/buttons';
+import { Icon } from '@@/Icon';
+
+import { Application } from '../../types';
+import {
+  applicationIsKind,
+  matchLabelsToLabelSelectorValue,
+} from '../../utils';
+import { useRedeployApplicationMutation } from '../../queries/useRedeployApplicationMutation';
+
+type Props = {
+  environmentId: EnvironmentId;
+  namespace: string;
+  appName: string;
+  app?: Application;
+};
+
+export function RedeployApplicationButton({
+  environmentId,
+  namespace,
+  appName,
+  app,
+}: Props) {
+  const router = useRouter();
+  const redeployAppMutation = useRedeployApplicationMutation(
+    environmentId,
+    namespace,
+    appName
+  );
+
+  return (
+    <Authorized authorizations="K8sPodDelete">
+      <Button
+        type="button"
+        size="small"
+        color="light"
+        className="!ml-0"
+        disabled={redeployAppMutation.isLoading || !app}
+        onClick={() => redeployApplication()}
+        data-cy="k8sAppDetail-redeployButton"
+      >
+        <Icon icon={RotateCw} className="mr-1" />
+        Redeploy
+      </Button>
+    </Authorized>
+  );
+
+  async function redeployApplication() {
+    // validate
+    if (!app || applicationIsKind<Pod>('Pod', app)) {
+      return;
+    }
+    try {
+      if (!app?.spec?.selector?.matchLabels) {
+        throw new Error(
+          `Application has no 'matchLabels' selector to redeploy pods.`
+        );
+      }
+    } catch (error) {
+      notifyError('Failure', error as Error);
+      return;
+    }
+
+    // confirm the action
+    const confirmed = await confirm({
+      title: 'Are you sure?',
+      modalType: ModalType.Warn,
+      confirmButton: buildConfirmButton('Redeploy'),
+      message:
+        'Redeploying terminates and restarts the application, which will cause service interruption. Do you wish to continue?',
+    });
+    if (!confirmed) {
+      return;
+    }
+
+    // using the matchlabels object, delete the associated pods with redeployAppMutation
+    const labelSelector = matchLabelsToLabelSelectorValue(
+      app?.spec?.selector?.matchLabels
+    );
+    redeployAppMutation.mutateAsync(
+      { labelSelector },
+      {
+        onSuccess: () => {
+          notifySuccess('Success', 'Application successfully redeployed');
+          router.stateService.reload();
+        },
+      }
+    );
+  }
+}
diff --git a/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/RestartApplicationButton.tsx b/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/RestartApplicationButton.tsx
new file mode 100644
index 0000000..c038a2e
--- /dev/null
+++ b/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/RestartApplicationButton.tsx
@@ -0,0 +1,16 @@
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+
+import { BETeaserButton } from '@@/BETeaserButton';
+
+export function RestartApplicationButton() {
+  return (
+    <BETeaserButton
+      buttonClassName="!ml-0"
+      data-cy="k8sAppDetail-restartButton"
+      heading="Rolling restart"
+      featureId={FeatureId.K8S_ROLLING_RESTART}
+      message="A rolling restart of the application is performed."
+      buttonText="Rolling restart"
+    />
+  );
+}
diff --git a/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/RollbackApplicationButton.tsx b/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/RollbackApplicationButton.tsx
new file mode 100644
index 0000000..e03ad67
--- /dev/null
+++ b/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/RollbackApplicationButton.tsx
@@ -0,0 +1,151 @@
+import { Pod } from 'kubernetes-types/core/v1';
+import { RotateCcw } from 'lucide-react';
+import { useRouter } from '@uirouter/react';
+
+import { Authorized } from '@/react/hooks/useUser';
+import { notifySuccess, notifyError } from '@/portainer/services/notifications';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { Button } from '@@/buttons';
+import { Icon } from '@@/Icon';
+import { confirm } from '@@/modals/confirm';
+import { ModalType } from '@@/modals';
+import { buildConfirmButton } from '@@/modals/utils';
+import { TooltipWithChildren } from '@@/Tip/TooltipWithChildren';
+import { Tooltip } from '@@/Tip/Tooltip';
+
+import {
+  applicationIsKind,
+  getRollbackPatchPayload,
+  matchLabelsToLabelSelectorValue,
+} from '../../utils';
+import { Application } from '../../types';
+import { appDeployMethodLabel } from '../../constants';
+import { useApplicationRevisionList } from '../../queries/useApplicationRevisionList';
+import { usePatchApplicationMutation } from '../../queries/usePatchApplicationMutation';
+
+type Props = {
+  environmentId: EnvironmentId;
+  namespace: string;
+  appName: string;
+  app?: Application;
+};
+
+export function RollbackApplicationButton({
+  environmentId,
+  namespace,
+  appName,
+  app,
+}: Props) {
+  const router = useRouter();
+  const labelSelector = applicationIsKind<Pod>('Pod', app)
+    ? ''
+    : matchLabelsToLabelSelectorValue(app?.spec?.selector?.matchLabels);
+  const appRevisionListQuery = useApplicationRevisionList(
+    environmentId,
+    namespace,
+    appName,
+    app?.metadata?.uid,
+    labelSelector,
+    app?.kind
+  );
+  const appRevisionList = appRevisionListQuery.data;
+  const appRevisions = appRevisionList?.items;
+  const appDeployMethod =
+    app?.metadata?.labels?.[appDeployMethodLabel] || 'application form';
+
+  const patchAppMutation = usePatchApplicationMutation(
+    environmentId,
+    namespace,
+    appName
+  );
+
+  const isRollbackNotAvailable =
+    !app ||
+    !appRevisions ||
+    appRevisions?.length < 2 ||
+    appDeployMethod !== 'application form' ||
+    patchAppMutation.isLoading;
+
+  const rollbackButton = (
+    <Button
+      ng-if="!ctrl.isExternalApplication()"
+      type="button"
+      color="light"
+      size="small"
+      className="!ml-0"
+      disabled={isRollbackNotAvailable}
+      onClick={() => rollbackApplication()}
+      data-cy="k8sAppDetail-rollbackButton"
+    >
+      <Icon icon={RotateCcw} className="mr-1" />
+      Rollback to previous configuration
+    </Button>
+  );
+
+  return (
+    <Authorized authorizations="K8sApplicationDetailsW">
+      <div className="flex gap-x-2">
+        {isRollbackNotAvailable ? (
+          <TooltipWithChildren message="Cannot roll back to previous configuration as none currently exists">
+            <span>{rollbackButton}</span>
+          </TooltipWithChildren>
+        ) : (
+          rollbackButton
+        )}
+        <Tooltip message="Only one level of rollback is available, i.e. if you roll back from v2 to v1, and then roll back again, you will end up back at v2. Note that service changes and autoscaler rule changes are not included in rollback functionality. This is how Kubernetes works natively." />
+      </div>
+    </Authorized>
+  );
+
+  async function rollbackApplication() {
+    // exit early if the application is a pod or there are no revisions
+    if (
+      !app?.kind ||
+      applicationIsKind<Pod>('Pod', app) ||
+      !appRevisionList?.items?.length
+    ) {
+      return;
+    }
+
+    // confirm the action
+    const confirmed = await confirm({
+      title: 'Are you sure?',
+      modalType: ModalType.Warn,
+      confirmButton: buildConfirmButton('Rollback'),
+      message:
+        'Rolling back the application to a previous configuration may cause service interruption. Do you wish to continue?',
+    });
+    if (!confirmed) {
+      return;
+    }
+
+    try {
+      const patch = getRollbackPatchPayload(app, appRevisionList);
+      patchAppMutation.mutateAsync(
+        {
+          appKind: app.kind,
+          patch,
+          contentType:
+            app.kind === 'Deployment'
+              ? 'application/json-patch+json'
+              : 'application/strategic-merge-patch+json',
+        },
+        {
+          onSuccess: () => {
+            notifySuccess('Success', 'Application successfully rolled back');
+            router.stateService.reload();
+          },
+          onError: (error) =>
+            notifyError(
+              'Failure',
+              error as Error,
+              'Unable to rollback the application'
+            ),
+        }
+      );
+    } catch (error) {
+      notifyError('Failure', error as Error);
+    }
+  }
+}
diff --git a/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/index.ts b/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/index.ts
new file mode 100644
index 0000000..2f2d276
--- /dev/null
+++ b/app/react/kubernetes/applications/DetailsView/ApplicationDetailsWidget/index.ts
@@ -0,0 +1 @@
+export { ApplicationDetailsWidget } from './ApplicationDetailsWidget';
diff --git a/app/react/kubernetes/applications/DetailsView/ApplicationEventsDatatable.tsx b/app/react/kubernetes/applications/DetailsView/ApplicationEventsDatatable.tsx
new file mode 100644
index 0000000..8f4289f
--- /dev/null
+++ b/app/react/kubernetes/applications/DetailsView/ApplicationEventsDatatable.tsx
@@ -0,0 +1,106 @@
+import { useCurrentStateAndParams } from '@uirouter/react';
+import { useMemo } from 'react';
+import { compact } from 'lodash';
+
+import { createStore } from '@/react/kubernetes/datatables/default-kube-datatable-store';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { useTableState } from '@@/datatables/useTableState';
+
+import { EventsDatatable } from '../../components/EventsDatatable';
+import { useEvents } from '../../queries/useEvents';
+import { AppKind } from '../types';
+import { useApplication } from '../queries/useApplication';
+import { useApplicationServices } from '../queries/useApplicationServices';
+import { useApplicationPods } from '../queries/useApplicationPods';
+
+const storageKey = 'k8sAppEventsDatatable';
+const settingsStore = createStore(storageKey, { id: 'Date', desc: true });
+
+export function ApplicationEventsDatatable() {
+  const tableState = useTableState(settingsStore, storageKey);
+  const {
+    params: {
+      namespace,
+      name,
+      'resource-type': appKind,
+      endpointId: environmentId,
+    },
+  } = useCurrentStateAndParams();
+
+  const { relatedEvents, isInitialLoading } = useApplicationEvents(
+    environmentId,
+    namespace,
+    name,
+    appKind,
+    {
+      autoRefreshRate: tableState.autoRefreshRate,
+    }
+  );
+
+  return (
+    <EventsDatatable
+      dataset={relatedEvents}
+      tableState={tableState}
+      isLoading={isInitialLoading}
+      data-cy="k8sAppDetail-eventsTable"
+      noWidget
+    />
+  );
+}
+
+export function useApplicationEvents(
+  environmentId: EnvironmentId,
+  namespace: string,
+  name: string,
+  appKind?: AppKind,
+  options?: { autoRefreshRate?: number; yaml?: boolean }
+) {
+  const { data: application, ...applicationQuery } = useApplication(
+    environmentId,
+    namespace,
+    name,
+    appKind
+  );
+  const servicesQuery = useApplicationServices(
+    environmentId,
+    namespace,
+    name,
+    application
+  );
+  const podsQuery = useApplicationPods(
+    environmentId,
+    namespace,
+    name,
+    application
+  );
+
+  // related events are events that have the application id, or the id of a service or pod from the application
+  const relatedUids = useMemo(() => {
+    const serviceIds = compact(
+      servicesQuery.data?.map((service) => service?.metadata?.uid)
+    );
+    const podIds = compact(podsQuery.data?.map((pod) => pod?.metadata?.uid));
+    return [application?.metadata?.uid, ...serviceIds, ...podIds];
+  }, [application?.metadata?.uid, podsQuery.data, servicesQuery.data]);
+
+  const relatedUidsSet = useMemo(() => new Set(relatedUids), [relatedUids]);
+  const { data: events, ...eventsQuery } = useEvents(environmentId, {
+    namespace,
+    queryOptions: {
+      autoRefreshRate: options?.autoRefreshRate
+        ? options.autoRefreshRate * 1000
+        : undefined,
+      select: (data) =>
+        data.filter((event) => relatedUidsSet.has(event.involvedObject.uid)),
+    },
+  });
+
+  const isInitialLoading =
+    applicationQuery.isInitialLoading ||
+    servicesQuery.isInitialLoading ||
+    podsQuery.isInitialLoading ||
+    eventsQuery.isInitialLoading;
+
+  return { relatedEvents: events || [], isInitialLoading };
+}
diff --git a/app/react/kubernetes/applications/DetailsView/ApplicationSummaryWidget.tsx b/app/react/kubernetes/applications/DetailsView/ApplicationSummaryWidget.tsx
new file mode 100644
index 0000000..5071429
--- /dev/null
+++ b/app/react/kubernetes/applications/DetailsView/ApplicationSummaryWidget.tsx
@@ -0,0 +1,333 @@
+import { User, Clock, Info } from 'lucide-react';
+import moment from 'moment';
+import { useEffect, useState } from 'react';
+import { Pod } from 'kubernetes-types/core/v1';
+import { useCurrentStateAndParams } from '@uirouter/react';
+
+import { Authorized } from '@/react/hooks/useUser';
+import { notifyError, notifySuccess } from '@/portainer/services/notifications';
+import { usePublicSettings } from '@/react/portainer/settings/queries';
+import { GlobalDeploymentOptions } from '@/react/portainer/settings/types';
+
+import { DetailsTable } from '@@/DetailsTable';
+import { Link } from '@@/Link';
+import { LoadingButton } from '@@/buttons';
+import { WidgetBody, Widget } from '@@/Widget';
+import { InlineLoader } from '@@/InlineLoader';
+import { Icon } from '@@/Icon';
+import { Note } from '@@/Note';
+import { ExternalBadge } from '@@/Badge/ExternalBadge';
+import { SystemBadge } from '@@/Badge/SystemBadge';
+
+import {
+  appStackNameLabel,
+  appKindToDeploymentTypeMap,
+  appOwnerLabel,
+  appDeployMethodLabel,
+  appNoteAnnotation,
+} from '../constants';
+import {
+  applicationIsKind,
+  getResourceRequests,
+  getRunningPods,
+  getTotalPods,
+  isExternalApplication,
+} from '../utils';
+import { Application, ApplicationPatch } from '../types';
+import { useNamespaceQuery } from '../../namespaces/queries/useNamespaceQuery';
+import { useApplication } from '../queries/useApplication';
+import { usePatchApplicationMutation } from '../queries/usePatchApplicationMutation';
+import { bytesToReadableFormat } from '../../utils';
+
+export function ApplicationSummaryWidget() {
+  const stateAndParams = useCurrentStateAndParams();
+  const {
+    params: {
+      namespace,
+      name,
+      'resource-type': resourceType,
+      endpointId: environmentId,
+    },
+  } = stateAndParams;
+  const { data: application, ...applicationQuery } = useApplication(
+    environmentId,
+    namespace,
+    name,
+    resourceType
+  );
+  const namespaceData = useNamespaceQuery(environmentId, namespace);
+  const isSystemNamespace = namespaceData.data?.IsSystem;
+
+  const externalApplication = application && isExternalApplication(application);
+  const applicationRequests = application && getResourceRequests(application);
+  const applicationOwner = application?.metadata?.labels?.[appOwnerLabel];
+  const applicationDeployMethod = getApplicationDeployMethod(application);
+  const applicationNote =
+    application?.metadata?.annotations?.[appNoteAnnotation];
+
+  const [applicationNoteFormValues, setApplicationNoteFormValues] =
+    useState('');
+
+  useEffect(() => {
+    setApplicationNoteFormValues(applicationNote || '');
+  }, [applicationNote]);
+
+  const globalDeploymentOptionsQuery =
+    usePublicSettings<GlobalDeploymentOptions>({
+      select: (settings) => settings.GlobalDeploymentOptions,
+    });
+
+  const failedCreateCondition = application?.status?.conditions?.find(
+    (condition) => condition.reason === 'FailedCreate'
+  );
+  const patchApplicationMutation = usePatchApplicationMutation(
+    environmentId,
+    namespace,
+    name
+  );
+
+  return (
+    <div className="row">
+      <div className="col-sm-12">
+        <Widget>
+          <WidgetBody>
+            {applicationQuery.isLoading && (
+              <InlineLoader>Loading application...</InlineLoader>
+            )}
+            {application && (
+              <>
+                {failedCreateCondition && (
+                  <div
+                    className="alert alert-danger mb-2 flex items-start gap-1"
+                    data-cy="k8sAppDetail-failedCreateMessage"
+                  >
+                    <div className="mt-0.5">
+                      <Icon
+                        icon={Info}
+                        className="mr-1 shrink-0"
+                        mode="danger"
+                      />
+                    </div>
+                    <div>
+                      <div className="font-semibold">
+                        Failed to create application
+                      </div>
+                      {failedCreateCondition.message}
+                    </div>
+                  </div>
+                )}
+                <DetailsTable dataCy="k8sAppDetail-table">
+                  <tr>
+                    <td>Name</td>
+                    <td>
+                      <div
+                        className="flex items-center gap-x-2"
+                        data-cy="k8sAppDetail-appName"
+                      >
+                        {name}
+                        {externalApplication && !isSystemNamespace && (
+                          <ExternalBadge />
+                        )}
+                      </div>
+                    </td>
+                  </tr>
+                  {globalDeploymentOptionsQuery.data &&
+                    !globalDeploymentOptionsQuery.data
+                      .hideStacksFunctionality && (
+                      <tr>
+                        <td>Stack</td>
+                        <td data-cy="k8sAppDetail-stackName">
+                          {application?.metadata?.labels?.[appStackNameLabel] ||
+                            '-'}
+                        </td>
+                      </tr>
+                    )}
+                  <tr>
+                    <td>Namespace</td>
+                    <td>
+                      <div
+                        className="flex items-center gap-x-2"
+                        data-cy="k8sAppDetail-resourcePoolName"
+                      >
+                        <Link
+                          to="kubernetes.resourcePools.resourcePool"
+                          data-cy="k8sAppDetail-namespaceLink"
+                          params={{ id: namespace }}
+                        >
+                          {namespace}
+                        </Link>
+                        {isSystemNamespace && <SystemBadge />}
+                      </div>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td>Application type</td>
+                    <td data-cy="k8sAppDetail-appType">
+                      {application?.kind || '-'}
+                    </td>
+                  </tr>
+                  {application?.kind && (
+                    <tr>
+                      <td>Status</td>
+                      {applicationIsKind<Pod>('Pod', application) && (
+                        <td data-cy="k8sAppDetail-appType">
+                          {application?.status?.phase}
+                        </td>
+                      )}
+                      {!applicationIsKind<Pod>('Pod', application) && (
+                        <td data-cy="k8sAppDetail-appType">
+                          {appKindToDeploymentTypeMap[application.kind]}
+                          <code
+                            className="ml-1"
+                            data-cy="k8sAppDetail-runningPods"
+                          >
+                            {getRunningPods(application)}
+                          </code>{' '}
+                          /{' '}
+                          <code data-cy="k8sAppDetail-totalPods">
+                            {getTotalPods(application)}
+                          </code>
+                        </td>
+                      )}
+                    </tr>
+                  )}
+                  {(!!applicationRequests?.cpu ||
+                    !!applicationRequests?.memoryBytes) && (
+                    <tr>
+                      <td>
+                        Resource reservations
+                        {!applicationIsKind<Pod>('Pod', application) && (
+                          <div className="text-muted small">per instance</div>
+                        )}
+                      </td>
+                      <td>
+                        {!!applicationRequests?.cpu && (
+                          <div data-cy="k8sAppDetail-cpuReservation">
+                            CPU {applicationRequests.cpu}
+                          </div>
+                        )}
+                        {!!applicationRequests?.memoryBytes && (
+                          <div data-cy="k8sAppDetail-memoryReservation">
+                            Memory{' '}
+                            {bytesToReadableFormat(
+                              applicationRequests.memoryBytes
+                            )}
+                          </div>
+                        )}
+                      </td>
+                    </tr>
+                  )}
+                  <tr>
+                    <td>Creation</td>
+                    <td>
+                      <div className="flex flex-wrap items-center gap-3">
+                        {applicationOwner && (
+                          <span
+                            className="flex items-center gap-1"
+                            data-cy="k8sAppDetail-owner"
+                          >
+                            <User />
+                            {applicationOwner}
+                          </span>
+                        )}
+                        <span
+                          className="flex items-center gap-1"
+                          data-cy="k8sAppDetail-creationDate"
+                        >
+                          <Clock />
+                          {moment(
+                            application?.metadata?.creationTimestamp
+                          ).format('YYYY-MM-DD HH:mm:ss')}
+                        </span>
+                        {(!externalApplication || isSystemNamespace) && (
+                          <span
+                            className="flex items-center gap-1"
+                            data-cy="k8sAppDetail-creationMethod"
+                          >
+                            <Clock />
+                            Deployed from {applicationDeployMethod}
+                          </span>
+                        )}
+                      </div>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td colSpan={2}>
+                      <form className="form-horizontal">
+                        <Note
+                          value={applicationNoteFormValues}
+                          onChange={setApplicationNoteFormValues}
+                          defaultIsOpen
+                          isExpandable
+                        />
+                        <Authorized authorizations="K8sApplicationDetailsW">
+                          <div className="form-group">
+                            <div className="col-sm-12">
+                              <LoadingButton
+                                color="primary"
+                                size="small"
+                                className="!ml-0"
+                                type="button"
+                                onClick={() => patchApplicationNote()}
+                                disabled={
+                                  // disable if there is no change to the note, or it's updating
+                                  applicationNoteFormValues ===
+                                    (applicationNote || '') ||
+                                  patchApplicationMutation.isLoading
+                                }
+                                data-cy="k8sAppDetail-saveNoteButton"
+                                isLoading={patchApplicationMutation.isLoading}
+                                loadingText={
+                                  applicationNote ? 'Updating' : 'Saving'
+                                }
+                              >
+                                {applicationNote ? 'Update' : 'Save'} note
+                              </LoadingButton>
+                            </div>
+                          </div>
+                        </Authorized>
+                      </form>
+                    </td>
+                  </tr>
+                </DetailsTable>
+              </>
+            )}
+          </WidgetBody>
+        </Widget>
+      </div>
+    </div>
+  );
+
+  async function patchApplicationNote() {
+    const patch: ApplicationPatch = [
+      {
+        op: 'replace',
+        path: `/metadata/annotations/${appNoteAnnotation}`,
+        value: applicationNoteFormValues,
+      },
+    ];
+    if (application?.kind) {
+      try {
+        await patchApplicationMutation.mutateAsync({
+          appKind: application.kind,
+          patch,
+        });
+        notifySuccess('Success', 'Application successfully updated');
+      } catch (error) {
+        notifyError(
+          `Failed to ${applicationNote ? 'update' : 'save'} note`,
+          error as Error
+        );
+      }
+    }
+  }
+}
+
+function getApplicationDeployMethod(application?: Application) {
+  if (!application?.metadata?.labels?.[appDeployMethodLabel])
+    return 'application form';
+  if (application?.metadata?.labels?.[appDeployMethodLabel] === 'content') {
+    return 'manifest';
+  }
+  return application?.metadata?.labels?.[appDeployMethodLabel];
+}
diff --git a/app/react/kubernetes/applications/DetailsView/PlacementsDatatable/PlacementsDatatable.tsx b/app/react/kubernetes/applications/DetailsView/PlacementsDatatable/PlacementsDatatable.tsx
new file mode 100644
index 0000000..100619c
--- /dev/null
+++ b/app/react/kubernetes/applications/DetailsView/PlacementsDatatable/PlacementsDatatable.tsx
@@ -0,0 +1,73 @@
+import { Minimize2 } from 'lucide-react';
+
+import {
+  BasicTableSettings,
+  RefreshableTableSettings,
+} from '@@/datatables/types';
+import { ExpandableDatatable } from '@@/datatables/ExpandableDatatable';
+import { TableSettingsMenu } from '@@/datatables';
+import { TableSettingsMenuAutoRefresh } from '@@/datatables/TableSettingsMenuAutoRefresh';
+import { TextTip } from '@@/Tip/TextTip';
+
+import { NodePlacementRowData } from '../types';
+
+import { SubRow } from './PlacementsDatatableSubRow';
+import { columns } from './columns';
+
+interface TableSettings extends BasicTableSettings, RefreshableTableSettings {}
+
+type Props = {
+  isLoading: boolean;
+  dataset: NodePlacementRowData[];
+  hasPlacementWarning: boolean;
+  tableState: TableSettings & {
+    setSearch: (value: string) => void;
+    search: string;
+  };
+};
+
+export function PlacementsDatatable({
+  isLoading,
+  dataset,
+  hasPlacementWarning,
+  tableState,
+}: Props) {
+  return (
+    <ExpandableDatatable
+      isLoading={isLoading}
+      getRowCanExpand={(row) => !row.original.acceptsApplication}
+      title="Nodes vs. placement constraints/preferences"
+      titleIcon={Minimize2}
+      dataset={dataset}
+      settingsManager={tableState}
+      getRowId={(row) => row.name}
+      columns={columns}
+      disableSelect
+      description={
+        hasPlacementWarning ? (
+          <TextTip>
+            Based on the placement rules, the application pod can&apos;t be
+            scheduled on any nodes.
+          </TextTip>
+        ) : (
+          <TextTip color="blue">
+            The table below shows whether or not this application can be
+            deployed on the nodes listed.
+          </TextTip>
+        )
+      }
+      renderTableSettings={() => (
+        <TableSettingsMenu>
+          <TableSettingsMenuAutoRefresh
+            value={tableState.autoRefreshRate}
+            onChange={tableState.setAutoRefreshRate}
+          />
+        </TableSettingsMenu>
+      )}
+      renderSubRow={(row) => (
+        <SubRow node={row.original} cellCount={row.getVisibleCells().length} />
+      )}
+      data-cy="kubernetes-application-placements-datatable"
+    />
+  );
+}
diff --git a/app/react/kubernetes/applications/DetailsView/PlacementsDatatable/PlacementsDatatableSubRow.tsx b/app/react/kubernetes/applications/DetailsView/PlacementsDatatable/PlacementsDatatableSubRow.tsx
new file mode 100644
index 0000000..22a5029
--- /dev/null
+++ b/app/react/kubernetes/applications/DetailsView/PlacementsDatatable/PlacementsDatatableSubRow.tsx
@@ -0,0 +1,191 @@
+import clsx from 'clsx';
+import { Fragment } from 'react';
+import { Taint } from 'kubernetes-types/core/v1';
+
+import { nodeAffinityValues } from '@/kubernetes/filters/application';
+import { useAuthorizations } from '@/react/hooks/useUser';
+
+import { Affinity, Label, NodePlacementRowData } from '../types';
+
+interface SubRowProps {
+  node: NodePlacementRowData;
+  cellCount: number;
+}
+
+export function SubRow({ node, cellCount }: SubRowProps) {
+  const { authorized } = useAuthorizations(
+    'K8sApplicationErrorDetailsR',
+    undefined,
+    true
+  );
+
+  if (!authorized) {
+    <>
+      {isDefined(node.unmetTaints) && (
+        <tr
+          className={clsx({
+            'datatable-highlighted': node.highlighted,
+            'datatable-unhighlighted': !node.highlighted,
+          })}
+        >
+          <td colSpan={cellCount}>
+            Placement constraint not respected for that node.
+          </td>
+        </tr>
+      )}
+
+      {(isDefined(node.unmatchedNodeSelectorLabels) ||
+        isDefined(node.unmatchedNodeAffinities)) && (
+        <tr
+          className={clsx({
+            'datatable-highlighted': node.highlighted,
+            'datatable-unhighlighted': !node.highlighted,
+          })}
+        >
+          <td colSpan={cellCount}>
+            Placement label not respected for that node.
+          </td>
+        </tr>
+      )}
+    </>;
+  }
+
+  return (
+    <>
+      {isDefined(node.unmetTaints) && (
+        <UnmetTaintsInfo
+          taints={node.unmetTaints}
+          cellCount={cellCount}
+          isHighlighted={node.highlighted}
+        />
+      )}
+      {isDefined(node.unmatchedNodeSelectorLabels) && (
+        <UnmatchedLabelsInfo
+          labels={node.unmatchedNodeSelectorLabels}
+          cellCount={cellCount}
+          isHighlighted={node.highlighted}
+        />
+      )}
+      {isDefined(node.unmatchedNodeAffinities) && (
+        <UnmatchedAffinitiesInfo
+          affinities={node.unmatchedNodeAffinities}
+          cellCount={cellCount}
+          isHighlighted={node.highlighted}
+        />
+      )}
+    </>
+  );
+}
+
+function isDefined<T>(arr?: Array<T>): arr is Array<T> {
+  return !!arr && arr.length > 0;
+}
+
+function UnmetTaintsInfo({
+  taints,
+  isHighlighted,
+  cellCount,
+}: {
+  taints: Array<Taint>;
+  isHighlighted: boolean;
+  cellCount: number;
+}) {
+  return (
+    <>
+      {taints.map((taint) => (
+        <tr
+          className={clsx({
+            'datatable-highlighted': isHighlighted,
+            'datatable-unhighlighted': !isHighlighted,
+          })}
+          key={taint.key}
+        >
+          <td colSpan={cellCount}>
+            This application is missing a toleration for the taint
+            <code className="space-left">
+              {taint.key}
+              {taint.value ? `=${taint.value}` : ''}:{taint.effect}
+            </code>
+          </td>
+        </tr>
+      ))}
+    </>
+  );
+}
+
+function UnmatchedLabelsInfo({
+  labels,
+  isHighlighted,
+  cellCount,
+}: {
+  labels: Array<Label>;
+  isHighlighted: boolean;
+  cellCount: number;
+}) {
+  return (
+    <>
+      {labels.map((label) => (
+        <tr
+          className={clsx({
+            'datatable-highlighted': isHighlighted,
+            'datatable-unhighlighted': !isHighlighted,
+          })}
+          key={label.key}
+        >
+          <td colSpan={cellCount}>
+            This application can only be scheduled on a node where the label{' '}
+            <code>{label.key}</code> is set to <code>{label.value}</code>
+          </td>
+        </tr>
+      ))}
+    </>
+  );
+}
+
+function UnmatchedAffinitiesInfo({
+  affinities,
+  isHighlighted,
+  cellCount,
+}: {
+  affinities: Array<Affinity>;
+  isHighlighted: boolean;
+  cellCount: number;
+}) {
+  return (
+    <>
+      <tr
+        className={clsx({
+          'datatable-highlighted': isHighlighted,
+          'datatable-unhighlighted': !isHighlighted,
+        })}
+      >
+        <td colSpan={cellCount}>
+          This application can only be scheduled on nodes respecting one of the
+          following labels combination:
+        </td>
+      </tr>
+      {affinities.map((aff) => (
+        <tr
+          className={clsx({
+            'datatable-highlighted': isHighlighted,
+            'datatable-unhighlighted': !isHighlighted,
+          })}
+          key={aff.map((term) => term.key).join('')}
+        >
+          <td />
+          <td colSpan={cellCount - 1}>
+            {aff.map((term, index) => (
+              <Fragment key={index}>
+                <code>
+                  {term.key} {term.operator}{' '}
+                  {nodeAffinityValues(term.values, term.operator)}
+                </code>
+                <span>{index === aff.length - 1 ? '' : ' + '}</span>
+              </Fragment>
+            ))}
+          </td>
+        </tr>
+      ))}
+    </>
+  );
+}
diff --git a/app/react/kubernetes/applications/DetailsView/PlacementsDatatable/columns/helper.ts b/app/react/kubernetes/applications/DetailsView/PlacementsDatatable/columns/helper.ts
new file mode 100644
index 0000000..9025579
--- /dev/null
+++ b/app/react/kubernetes/applications/DetailsView/PlacementsDatatable/columns/helper.ts
@@ -0,0 +1,5 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { NodePlacementRowData } from '../../types';
+
+export const columnHelper = createColumnHelper<NodePlacementRowData>();
diff --git a/app/react/kubernetes/applications/DetailsView/PlacementsDatatable/columns/index.tsx b/app/react/kubernetes/applications/DetailsView/PlacementsDatatable/columns/index.tsx
new file mode 100644
index 0000000..993c40f
--- /dev/null
+++ b/app/react/kubernetes/applications/DetailsView/PlacementsDatatable/columns/index.tsx
@@ -0,0 +1,15 @@
+import { buildExpandColumn } from '@@/datatables/expand-column';
+
+import { NodePlacementRowData } from '../../types';
+
+import { columnHelper } from './helper';
+import { status } from './status';
+
+export const columns = [
+  buildExpandColumn<NodePlacementRowData>(),
+  status,
+  columnHelper.accessor('name', {
+    header: 'Node',
+    id: 'node',
+  }),
+];
diff --git a/app/react/kubernetes/applications/DetailsView/PlacementsDatatable/columns/status.tsx b/app/react/kubernetes/applications/DetailsView/PlacementsDatatable/columns/status.tsx
new file mode 100644
index 0000000..01f2d98
--- /dev/null
+++ b/app/react/kubernetes/applications/DetailsView/PlacementsDatatable/columns/status.tsx
@@ -0,0 +1,27 @@
+import { Check, X } from 'lucide-react';
+
+import { Icon } from '@@/Icon';
+
+import { columnHelper } from './helper';
+
+export const status = columnHelper.accessor('acceptsApplication', {
+  header: '',
+  id: 'status',
+  enableSorting: false,
+  cell: ({ getValue }) => {
+    const acceptsApplication = getValue();
+    return (
+      <div className="flex h-full items-center">
+        <Icon
+          icon={acceptsApplication ? Check : X}
+          mode={acceptsApplication ? 'success' : 'danger'}
+          size="sm"
+        />
+      </div>
+    );
+  },
+  meta: {
+    width: 30,
+  },
+  enableResizing: false,
+});
diff --git a/app/react/kubernetes/applications/DetailsView/PlacementsDatatable/index.ts b/app/react/kubernetes/applications/DetailsView/PlacementsDatatable/index.ts
new file mode 100644
index 0000000..4675b3a
--- /dev/null
+++ b/app/react/kubernetes/applications/DetailsView/PlacementsDatatable/index.ts
@@ -0,0 +1,5 @@
+export { PlacementsDatatable } from './PlacementsDatatable';
+export {
+  usePlacementTableState,
+  usePlacementTableData,
+} from './usePlacementTableData';
diff --git a/app/react/kubernetes/applications/DetailsView/PlacementsDatatable/usePlacementTableData.tsx b/app/react/kubernetes/applications/DetailsView/PlacementsDatatable/usePlacementTableData.tsx
new file mode 100644
index 0000000..b0cdbab
--- /dev/null
+++ b/app/react/kubernetes/applications/DetailsView/PlacementsDatatable/usePlacementTableData.tsx
@@ -0,0 +1,274 @@
+import { useCurrentStateAndParams } from '@uirouter/react';
+import { useMemo } from 'react';
+import { Pod, Taint, Node } from 'kubernetes-types/core/v1';
+import _ from 'lodash';
+
+import { KubernetesPodNodeAffinityNodeSelectorRequirementOperators } from '@/kubernetes/pod/models';
+import { useNodesQuery } from '@/react/kubernetes/cluster/queries/useNodesQuery';
+
+import {
+  BasicTableSettings,
+  RefreshableTableSettings,
+  createPersistedStore,
+  refreshableSettings,
+} from '@@/datatables/types';
+import { useTableState } from '@@/datatables/useTableState';
+
+import { Affinity, Label, NodePlacementRowData } from '../types';
+import { useApplication } from '../../queries/useApplication';
+import { useApplicationPods } from '../../queries/useApplicationPods';
+
+interface TableSettings extends BasicTableSettings, RefreshableTableSettings {}
+
+function createStore(storageKey: string) {
+  return createPersistedStore<TableSettings>(storageKey, 'node', (set) => ({
+    ...refreshableSettings(set),
+  }));
+}
+
+const storageKey = 'kubernetes.application.placements';
+const placementsSettingsStore = createStore(storageKey);
+
+export function usePlacementTableState() {
+  return useTableState(placementsSettingsStore, storageKey);
+}
+
+export function usePlacementTableData() {
+  const placementsTableState = usePlacementTableState();
+  const autoRefreshRate = placementsTableState.autoRefreshRate * 1000; // ms to seconds
+
+  const stateAndParams = useCurrentStateAndParams();
+  const {
+    params: {
+      namespace,
+      name,
+      'resource-type': resourceType,
+      endpointId: environmentId,
+    },
+  } = stateAndParams;
+  const { data: application, ...applicationQuery } = useApplication(
+    environmentId,
+    namespace,
+    name,
+    resourceType,
+    { autoRefreshRate }
+  );
+  const { data: pods, ...podsQuery } = useApplicationPods(
+    environmentId,
+    namespace,
+    name,
+    application,
+    { autoRefreshRate }
+  );
+  const { data: nodes, ...nodesQuery } = useNodesQuery(environmentId, {
+    autoRefreshRate,
+  });
+
+  const placementsData = useMemo(
+    () => (nodes && pods ? computePlacements(nodes, pods) : []),
+    [nodes, pods]
+  );
+
+  const isPlacementsTableLoading =
+    applicationQuery.isLoading || nodesQuery.isLoading || podsQuery.isLoading;
+
+  const hasPlacementWarning = useMemo(() => {
+    const notAllowedOnEveryNode = placementsData.every(
+      (nodePlacement) => !nodePlacement.acceptsApplication
+    );
+    return !isPlacementsTableLoading && notAllowedOnEveryNode;
+  }, [isPlacementsTableLoading, placementsData]);
+
+  return {
+    placementsData,
+    isPlacementsTableLoading,
+    hasPlacementWarning,
+  };
+}
+
+export function computePlacements(
+  nodes: Node[],
+  pods: Pod[]
+): NodePlacementRowData[] {
+  const pod = pods?.[0];
+  if (!pod) {
+    return [];
+  }
+
+  const placementDataFromTolerations: NodePlacementRowData[] =
+    computeTolerations(nodes, pod);
+  const placementDataFromAffinities: NodePlacementRowData[] = computeAffinities(
+    nodes,
+    placementDataFromTolerations,
+    pod
+  );
+  return placementDataFromAffinities;
+}
+
+function computeTolerations(nodes: Node[], pod: Pod): NodePlacementRowData[] {
+  const tolerations = pod.spec?.tolerations || [];
+  const nodePlacements: NodePlacementRowData[] = nodes.map((node) => {
+    let acceptsApplication = true;
+    const unmetTaints: Taint[] = [];
+    const taints = node.spec?.taints || [];
+    taints.forEach((taint) => {
+      const matchKeyMatchValueMatchEffect = _.find(tolerations, {
+        key: taint.key,
+        operator: 'Equal',
+        value: taint.value,
+        effect: taint.effect,
+      });
+      const matchKeyAnyValueMatchEffect = _.find(tolerations, {
+        key: taint.key,
+        operator: 'Exists',
+        effect: taint.effect,
+      });
+      const matchKeyMatchValueAnyEffect = _.find(tolerations, {
+        key: taint.key,
+        operator: 'Equal',
+        value: taint.value,
+        effect: '',
+      });
+      const matchKeyAnyValueAnyEffect = _.find(tolerations, {
+        key: taint.key,
+        operator: 'Exists',
+        effect: '',
+      });
+      const anyKeyAnyValueAnyEffect = _.find(tolerations, {
+        key: '',
+        operator: 'Exists',
+        effect: '',
+      });
+      if (
+        !matchKeyMatchValueMatchEffect &&
+        !matchKeyAnyValueMatchEffect &&
+        !matchKeyMatchValueAnyEffect &&
+        !matchKeyAnyValueAnyEffect &&
+        !anyKeyAnyValueAnyEffect
+      ) {
+        acceptsApplication = false;
+        unmetTaints?.push(taint);
+      } else {
+        acceptsApplication = true;
+      }
+    });
+    return {
+      name: node.metadata?.name || '',
+      acceptsApplication,
+      unmetTaints,
+      highlighted: false,
+    };
+  });
+
+  return nodePlacements;
+}
+
+function getUnmatchedNodeSelectorLabels(node: Node, pod: Pod): Label[] {
+  const nodeLabels = node.metadata?.labels || {};
+  const podNodeSelectorLabels = pod.spec?.nodeSelector || {};
+
+  return Object.entries(podNodeSelectorLabels)
+    .filter(([key, value]) => nodeLabels[key] !== value)
+    .map(([key, value]) => ({
+      key,
+      value,
+    }));
+}
+
+// Function to get unmatched required node affinities
+function getUnmatchedRequiredNodeAffinities(node: Node, pod: Pod): Affinity[] {
+  const basicNodeAffinity =
+    pod.spec?.affinity?.nodeAffinity
+      ?.requiredDuringSchedulingIgnoredDuringExecution;
+
+  const unmatchedRequiredNodeAffinities: Affinity[] =
+    basicNodeAffinity?.nodeSelectorTerms
+      .map(
+        (selectorTerm) =>
+          selectorTerm.matchExpressions?.flatMap((matchExpression) => {
+            const exists = !!node.metadata?.labels?.[matchExpression.key];
+            const isIn =
+              exists &&
+              _.includes(
+                matchExpression.values,
+                node.metadata?.labels?.[matchExpression.key]
+              );
+
+            // Check if the match expression is satisfied
+            if (
+              (matchExpression.operator === 'Exists' && exists) ||
+              (matchExpression.operator === 'DoesNotExist' && !exists) ||
+              (matchExpression.operator === 'In' && isIn) ||
+              (matchExpression.operator === 'NotIn' && !isIn) ||
+              (matchExpression.operator === 'Gt' &&
+                exists &&
+                parseInt(
+                  node.metadata?.labels?.[matchExpression.key] || '',
+                  10
+                ) > parseInt(matchExpression.values?.[0] || '', 10)) ||
+              (matchExpression.operator === 'Lt' &&
+                exists &&
+                parseInt(
+                  node.metadata?.labels?.[matchExpression.key] || '',
+                  10
+                ) < parseInt(matchExpression.values?.[0] || '', 10))
+            ) {
+              return [];
+            }
+
+            // Return the unmatched affinity
+            return [
+              {
+                key: matchExpression.key,
+                operator:
+                  matchExpression.operator as KubernetesPodNodeAffinityNodeSelectorRequirementOperators,
+                values: matchExpression.values?.join(', ') || '',
+              },
+            ];
+          }) || []
+      )
+      .filter((unmatchedAffinity) => unmatchedAffinity.length > 0) || [];
+  return unmatchedRequiredNodeAffinities;
+}
+
+// Node requirement depending on the operator value
+// https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity
+function computeAffinities(
+  nodes: Node[],
+  nodePlacements: NodePlacementRowData[],
+  pod: Pod
+): NodePlacementRowData[] {
+  const nodePlacementsFromAffinities: NodePlacementRowData[] = nodes.map(
+    (node, nodeIndex) => {
+      let { acceptsApplication } = nodePlacements[nodeIndex];
+
+      // check node selectors for unmatched labels
+      const unmatchedNodeSelectorLabels = getUnmatchedNodeSelectorLabels(
+        node,
+        pod
+      );
+
+      // check node affinities that are required during scheduling
+      const unmatchedRequiredNodeAffinities =
+        getUnmatchedRequiredNodeAffinities(node, pod);
+
+      // If there are any unmatched affinities or node labels, the node does not accept the application
+      if (
+        unmatchedRequiredNodeAffinities.length ||
+        unmatchedNodeSelectorLabels.length
+      ) {
+        acceptsApplication = false;
+      }
+
+      const nodePlacementRowData: NodePlacementRowData = {
+        ...nodePlacements[nodeIndex],
+        acceptsApplication,
+        unmatchedNodeSelectorLabels,
+        unmatchedNodeAffinities: unmatchedRequiredNodeAffinities,
+      };
+
+      return nodePlacementRowData;
+    }
+  );
+  return nodePlacementsFromAffinities;
+}
diff --git a/app/react/kubernetes/applications/DetailsView/index.ts b/app/react/kubernetes/applications/DetailsView/index.ts
new file mode 100644
index 0000000..19efd91
--- /dev/null
+++ b/app/react/kubernetes/applications/DetailsView/index.ts
@@ -0,0 +1,3 @@
+export { ApplicationSummaryWidget } from './ApplicationSummaryWidget';
+export { ApplicationDetailsWidget } from './ApplicationDetailsWidget/ApplicationDetailsWidget';
+export { ApplicationEventsDatatable } from './ApplicationEventsDatatable';
diff --git a/app/react/kubernetes/applications/DetailsView/types.ts b/app/react/kubernetes/applications/DetailsView/types.ts
new file mode 100644
index 0000000..860e9ee
--- /dev/null
+++ b/app/react/kubernetes/applications/DetailsView/types.ts
@@ -0,0 +1,25 @@
+import { Taint } from 'kubernetes-types/core/v1';
+
+import { KubernetesPodNodeAffinityNodeSelectorRequirementOperators } from '@/kubernetes/pod/models';
+
+export interface Label {
+  key: string;
+  value: string;
+}
+
+interface AffinityTerm {
+  key: string;
+  operator: KubernetesPodNodeAffinityNodeSelectorRequirementOperators;
+  values: string;
+}
+
+export type Affinity = Array<AffinityTerm>;
+
+export type NodePlacementRowData = {
+  name: string;
+  acceptsApplication: boolean;
+  unmetTaints?: Array<Taint>;
+  unmatchedNodeSelectorLabels?: Array<Label>;
+  highlighted: boolean;
+  unmatchedNodeAffinities?: Array<Affinity>;
+};
diff --git a/app/react/kubernetes/applications/DetailsView/useApplicationEventsTableData.tsx b/app/react/kubernetes/applications/DetailsView/useApplicationEventsTableData.tsx
new file mode 100644
index 0000000..099fcad
--- /dev/null
+++ b/app/react/kubernetes/applications/DetailsView/useApplicationEventsTableData.tsx
@@ -0,0 +1,84 @@
+import { useCurrentStateAndParams } from '@uirouter/react';
+import { useMemo } from 'react';
+
+import { createStore } from '@/react/kubernetes/datatables/default-kube-datatable-store';
+
+import { useTableState } from '@@/datatables/useTableState';
+
+import { useEvents } from '../../queries/useEvents';
+import { useApplication } from '../queries/useApplication';
+import { useApplicationServices } from '../queries/useApplicationServices';
+import { useApplicationPods } from '../queries/useApplicationPods';
+
+const storageKey = 'k8sAppEventsDatatable';
+const settingsStore = createStore(storageKey, { id: 'Date', desc: true });
+
+export function useApplicationEventsTableState() {
+  return useTableState(settingsStore, storageKey);
+}
+
+export function useApplicationEventsTableData() {
+  const appEventsTableState = useTableState(settingsStore, storageKey);
+  const {
+    params: {
+      namespace,
+      name,
+      'resource-type': resourceType,
+      endpointId: environmentId,
+    },
+  } = useCurrentStateAndParams();
+
+  const { data: application, ...applicationQuery } = useApplication(
+    environmentId,
+    namespace,
+    name,
+    resourceType
+  );
+  const { data: services, ...servicesQuery } = useApplicationServices(
+    environmentId,
+    namespace,
+    name,
+    application
+  );
+  const { data: pods, ...podsQuery } = useApplicationPods(
+    environmentId,
+    namespace,
+    name,
+    application
+  );
+  const { data: events, ...eventsQuery } = useEvents(environmentId, {
+    namespace,
+    queryOptions: {
+      autoRefreshRate: appEventsTableState.autoRefreshRate * 1000,
+    },
+  });
+
+  // related events are events that have the application id, or the id of a service or pod from the application
+  const appEventsData = useMemo(() => {
+    const serviceIds = services?.map((service) => service?.metadata?.uid);
+    const podIds = pods?.map((pod) => pod?.metadata?.uid);
+    return (
+      events?.filter(
+        (event) =>
+          event.involvedObject.uid === application?.metadata?.uid ||
+          serviceIds?.includes(event.involvedObject.uid) ||
+          podIds?.includes(event.involvedObject.uid)
+      ) || []
+    );
+  }, [application?.metadata?.uid, events, pods, services]);
+
+  const appEventWarningCount = useMemo(
+    () => appEventsData.filter((event) => event.type === 'Warning').length,
+    [appEventsData]
+  );
+
+  return {
+    appEventsData,
+    appEventWarningCount,
+    isAppEventsTableLoading:
+      applicationQuery.isLoading ||
+      servicesQuery.isLoading ||
+      podsQuery.isLoading ||
+      eventsQuery.isLoading,
+  };
+}
diff --git a/app/react/kubernetes/applications/ListView/ApplicationsDatatable/ApplicationsDatatable.test.tsx b/app/react/kubernetes/applications/ListView/ApplicationsDatatable/ApplicationsDatatable.test.tsx
new file mode 100644
index 0000000..fed6b54
--- /dev/null
+++ b/app/react/kubernetes/applications/ListView/ApplicationsDatatable/ApplicationsDatatable.test.tsx
@@ -0,0 +1,170 @@
+import { render, screen } from '@testing-library/react';
+import { vi } from 'vitest';
+import { HttpResponse } from 'msw';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { UserViewModel } from '@/portainer/models/user';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { http, server } from '@/setup-tests/server';
+import { createMockEnvironment } from '@/react-tools/test-mocks';
+
+import { PodKubernetesInstanceLabel, PodManagedByLabel } from '../../constants';
+
+import { ApplicationsDatatable } from './ApplicationsDatatable';
+
+const mockUseCurrentStateAndParams = vi.fn();
+const mockUseEnvironmentId = vi.fn();
+
+vi.mock('@uirouter/react', async (importOriginal: () => Promise<object>) => ({
+  ...(await importOriginal()),
+  useCurrentStateAndParams: () => mockUseCurrentStateAndParams(),
+}));
+
+vi.mock('@/react/hooks/useEnvironmentId', () => ({
+  useEnvironmentId: () => mockUseEnvironmentId(),
+}));
+
+vi.mock('@/react/kubernetes/applications/queries/useApplications', () => ({
+  useApplications: () => ({
+    data: [
+      {
+        Id: '1',
+        Name: 'app1',
+        CreationDate: '2021-10-01T00:00:00Z',
+        ResourcePool: 'namespace1',
+        Image: 'image1',
+        ApplicationType: 'Pod',
+        Kind: 'Pod',
+        DeploymentType: 'Replicated',
+        Status: 'status1',
+        TotalPodsCount: 1,
+        RunningPodsCount: 1,
+        Metadata: {
+          labels: {
+            [PodKubernetesInstanceLabel]: 'helm-release-1',
+            [PodManagedByLabel]: 'Helm',
+          },
+        },
+      },
+      {
+        Id: '2',
+        Name: 'app2',
+        CreationDate: '2021-10-01T00:00:00Z',
+        ResourcePool: 'namespace1',
+        Image: 'image1',
+        ApplicationType: 'Pod',
+        Kind: 'Pod',
+        DeploymentType: 'Replicated',
+        Status: 'status1',
+        TotalPodsCount: 1,
+        RunningPodsCount: 1,
+        Metadata: {
+          labels: {
+            [PodKubernetesInstanceLabel]: 'helm-release-1',
+            [PodManagedByLabel]: 'Helm',
+          },
+        },
+      },
+      {
+        Id: '3',
+        Name: 'app3',
+        CreationDate: '2021-10-01T00:00:00Z',
+        ResourcePool: 'namespace2',
+        Image: 'image1',
+        ApplicationType: 'Pod',
+        Kind: 'Pod',
+        DeploymentType: 'Replicated',
+        Status: 'status1',
+        TotalPodsCount: 1,
+        RunningPodsCount: 1,
+        Metadata: {
+          labels: {
+            [PodKubernetesInstanceLabel]: 'helm-release-1',
+            [PodManagedByLabel]: 'Helm',
+          },
+        },
+      },
+    ],
+    isLoading: false,
+  }),
+}));
+
+vi.mock('@@/Link', () => ({
+  Link: ({ children }: { children: React.ReactNode }) => (
+    <span data-testid="mock-link">{children}</span>
+  ),
+}));
+
+vi.mock('@/react/kubernetes/components/CreateFromManifestButton', () => ({
+  CreateFromManifestButton: ({
+    children,
+    ...props
+  }: {
+    children?: React.ReactNode;
+    'data-cy'?: string;
+  }) => (
+    <button type="button" data-testid="mock-create-manifest-button" {...props}>
+      {children || 'Create from manifest'}
+    </button>
+  ),
+}));
+
+function renderComponent() {
+  server.use(
+    http.get('/api/endpoints/:endpointId', () =>
+      HttpResponse.json(createMockEnvironment())
+    )
+  );
+
+  const user = new UserViewModel({ Username: 'user' });
+
+  const Wrapped = withTestQueryProvider(
+    withUserProvider(withTestRouter(ApplicationsDatatable), user)
+  );
+
+  return render(
+    <Wrapped
+      tableState={{
+        search: '',
+        setSearch: () => {},
+        namespace: '',
+        setNamespace: () => {},
+        showSystemResources: false,
+        autoRefreshRate: 0,
+        setAutoRefreshRate: () => {},
+        setShowSystemResources: () => {},
+        sortBy: { id: 'Name', desc: false },
+        setSortBy: () => {},
+        pageSize: 10,
+        setPageSize: () => {},
+      }}
+    />
+  );
+}
+
+describe('ApplicationsDatatable', () => {
+  beforeEach(() => {
+    mockUseEnvironmentId.mockReturnValue(3);
+    mockUseCurrentStateAndParams.mockReturnValue({
+      params: {},
+    });
+  });
+
+  it('should group helm apps by namespace and instance label', async () => {
+    renderComponent();
+
+    const helmReleases = await screen.findAllByText('helm-release-1');
+    expect(helmReleases).toHaveLength(2);
+
+    // Should show both namespaces in table cells
+    const namespace1Cells = await screen.findAllByRole('cell', {
+      name: 'namespace1',
+    });
+    const namespace2Cells = await screen.findAllByRole('cell', {
+      name: 'namespace2',
+    });
+    expect(namespace1Cells.length).toBeGreaterThan(0);
+    expect(namespace2Cells.length).toBeGreaterThan(0);
+  });
+});
diff --git a/app/react/kubernetes/applications/ListView/ApplicationsDatatable/ApplicationsDatatable.tsx b/app/react/kubernetes/applications/ListView/ApplicationsDatatable/ApplicationsDatatable.tsx
new file mode 100644
index 0000000..4706d3a
--- /dev/null
+++ b/app/react/kubernetes/applications/ListView/ApplicationsDatatable/ApplicationsDatatable.tsx
@@ -0,0 +1,248 @@
+import { useMemo } from 'react';
+import { BoxIcon } from 'lucide-react';
+import { groupBy, partition } from 'lodash';
+import { useRouter } from '@uirouter/react';
+
+import { DefaultDatatableSettings } from '@/react/kubernetes/datatables/DefaultDatatableSettings';
+import { SystemResourceDescription } from '@/react/kubernetes/datatables/SystemResourceDescription';
+import { CreateFromManifestButton } from '@/react/kubernetes/components/CreateFromManifestButton';
+import { useNamespacesQuery } from '@/react/kubernetes/namespaces/queries/useNamespacesQuery';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useAuthorizations } from '@/react/hooks/useUser';
+import { isSystemNamespace } from '@/react/kubernetes/namespaces/queries/useIsSystemNamespace';
+import { KubernetesApplicationTypes } from '@/kubernetes/models/application/models/appConstants';
+import { useEnvironment } from '@/react/portainer/environments/queries';
+import { useIngresses } from '@/react/kubernetes/ingresses/queries';
+
+import { TableSettingsMenu } from '@@/datatables';
+import { DeleteButton } from '@@/buttons/DeleteButton';
+import { AddButton } from '@@/buttons';
+import { ExpandableDatatable } from '@@/datatables/ExpandableDatatable';
+
+import { NamespaceFilter } from '../ApplicationsStacksDatatable/NamespaceFilter';
+import {
+  HelmReleaseNameAnnotation,
+  PodKubernetesInstanceLabel,
+  PodManagedByLabel,
+} from '../../constants';
+import { useApplications } from '../../queries/useApplications';
+import { ApplicationsTableSettings } from '../useKubeAppsTableStore';
+import { useDeleteApplicationsMutation } from '../../queries/useDeleteApplicationsMutation';
+import { getStacksFromApplications } from '../ApplicationsStacksDatatable/getStacksFromApplications';
+
+import { Application, ApplicationRowData, ConfigKind } from './types';
+import { useColumns } from './useColumns';
+import { getPublishedUrls } from './PublishedPorts';
+import { SubRow } from './SubRow';
+import { HelmInsightsBox } from './HelmInsightsBox';
+
+export function ApplicationsDatatable({
+  tableState,
+  hideStacks = false,
+}: {
+  hideStacks?: boolean;
+  tableState: ApplicationsTableSettings & {
+    setSearch: (value: string) => void;
+    search: string;
+  };
+}) {
+  const router = useRouter();
+  const environmentId = useEnvironmentId();
+  const restrictSecretsQuery = useEnvironment(
+    environmentId,
+    (env) => env.Kubernetes.Configuration.RestrictSecrets
+  );
+  const namespaceListQuery = useNamespacesQuery(environmentId);
+  const { authorized: hasWriteAuth } = useAuthorizations(
+    'K8sApplicationsW',
+    undefined,
+    false
+  );
+  const applicationsQuery = useApplications(environmentId, {
+    refetchInterval: tableState.autoRefreshRate * 1000,
+    namespace: tableState.namespace,
+  });
+  const ingressesQuery = useIngresses(environmentId);
+  const ingresses = ingressesQuery.data ?? [];
+  const applications = useApplicationsRowData(applicationsQuery.data);
+  const filteredApplications = tableState.showSystemResources
+    ? applications
+    : applications.filter(
+        (application) =>
+          !isSystemNamespace(application.ResourcePool, namespaceListQuery.data)
+      );
+  const stacks = getStacksFromApplications(filteredApplications);
+  const removeApplicationsMutation = useDeleteApplicationsMutation({
+    environmentId,
+    stacks,
+    ingresses,
+    reportStacks: false,
+  });
+
+  const columns = useColumns(hideStacks);
+
+  return (
+    <ExpandableDatatable
+      data-cy="k8sApp-appTable"
+      dataset={filteredApplications ?? []}
+      settingsManager={tableState}
+      columns={columns}
+      title="Applications"
+      titleIcon={BoxIcon}
+      isLoading={applicationsQuery.isLoading}
+      disableSelect={!hasWriteAuth}
+      isRowSelectable={(row) =>
+        !isSystemNamespace(row.original.ResourcePool, namespaceListQuery.data)
+      }
+      getRowCanExpand={(row) => isExpandable(row.original)}
+      renderSubRow={(row) => (
+        <SubRow
+          item={row.original}
+          hideStacks={hideStacks}
+          areSecretsRestricted={!!restrictSecretsQuery.data}
+          selectDisabled={!hasWriteAuth}
+        />
+      )}
+      renderTableActions={(selectedItems) =>
+        hasWriteAuth && (
+          <>
+            <DeleteButton
+              data-cy="k8sApp-removeAppButton"
+              disabled={selectedItems.length === 0}
+              isLoading={removeApplicationsMutation.isLoading}
+              confirmMessage="Do you want to remove the selected application(s)?"
+              onConfirmed={() => handleRemoveApplications(selectedItems)}
+            />
+            <AddButton data-cy="k8sApp-addApplicationButton" color="secondary">
+              Add with form
+            </AddButton>
+            <CreateFromManifestButton data-cy="k8sApp-deployFromManifestButton" />
+          </>
+        )
+      }
+      renderTableSettings={() => (
+        <TableSettingsMenu>
+          <DefaultDatatableSettings settings={tableState} />
+        </TableSettingsMenu>
+      )}
+      description={
+        <div className="w-full">
+          <div className="float-right min-w-[140px]">
+            <NamespaceFilter
+              namespaces={namespaceListQuery.data ?? []}
+              value={tableState.namespace}
+              onChange={tableState.setNamespace}
+              showSystem={tableState.showSystemResources}
+            />
+          </div>
+          <div className="space-y-2">
+            <SystemResourceDescription
+              showSystemResources={tableState.showSystemResources}
+            />
+            <div className="w-fit">
+              <HelmInsightsBox />
+            </div>
+          </div>
+        </div>
+      }
+    />
+  );
+
+  function handleRemoveApplications(applications: ApplicationRowData[]) {
+    removeApplicationsMutation.mutate(applications, {
+      onSuccess: () => {
+        router.stateService.reload();
+      },
+    });
+  }
+}
+
+function useApplicationsRowData(
+  applications?: Application[]
+): ApplicationRowData[] {
+  return useMemo(() => separateHelmApps(applications ?? []), [applications]);
+}
+
+function separateHelmApps(applications: Application[]): ApplicationRowData[] {
+  const [helmApps, nonHelmApps] = partition(
+    applications,
+    (app) =>
+      app.Metadata?.labels &&
+      (app.Metadata.annotations?.[HelmReleaseNameAnnotation] ||
+        app.Metadata.labels[PodKubernetesInstanceLabel]) &&
+      app.Metadata.labels[PodManagedByLabel] === 'Helm'
+  );
+
+  const groupedHelmApps: Record<string, Application[]> = groupBy(
+    helmApps,
+    (app) =>
+      `${app.ResourcePool}/${
+        // Prioritize the official Helm annotation over the instance label
+        // meta.helm.sh/release-name is the authoritative source for Helm release names
+        app.Metadata?.annotations?.[HelmReleaseNameAnnotation] ??
+        app.Metadata?.labels[PodKubernetesInstanceLabel] ??
+        ''
+      }`
+  );
+
+  // build the helm apps row data from the grouped helm apps
+  const helmAppsRowData = Object.entries(groupedHelmApps).reduce<
+    ApplicationRowData[]
+  >((helmApps, [groupKey, apps]) => {
+    const instanceLabel = groupKey.split('/')[1];
+    const helmApp = buildHelmAppRowData(instanceLabel, apps);
+    return [...helmApps, helmApp];
+  }, []);
+
+  return [...helmAppsRowData, ...nonHelmApps];
+}
+
+function buildHelmAppRowData(
+  appName: string,
+  apps: Application[]
+): ApplicationRowData {
+  const id = `${apps[0].ResourcePool}-${appName
+    .toLowerCase()
+    .replaceAll(' ', '-')}`;
+  const { earliestCreationDate, runningPods, totalPods } = apps.reduce(
+    (acc, app) => ({
+      earliestCreationDate:
+        new Date(app.CreationDate) < new Date(acc.earliestCreationDate)
+          ? app.CreationDate
+          : acc.earliestCreationDate,
+      runningPods: acc.runningPods + app.RunningPodsCount,
+      totalPods: acc.totalPods + app.TotalPodsCount,
+    }),
+    {
+      earliestCreationDate: apps[0].CreationDate,
+      runningPods: 0,
+      totalPods: 0,
+    }
+  );
+  const helmApp: ApplicationRowData = {
+    ...apps[0],
+    Name: appName,
+    Id: id,
+    KubernetesApplications: apps,
+    ApplicationType: KubernetesApplicationTypes.Helm,
+    Status: runningPods < totalPods ? 'Not ready' : 'Ready',
+    CreationDate: earliestCreationDate,
+    RunningPodsCount: runningPods,
+    TotalPodsCount: totalPods,
+  };
+  return helmApp;
+}
+
+function isExpandable(item: ApplicationRowData) {
+  return (
+    !!item.KubernetesApplications ||
+    !!getPublishedUrls(item).length ||
+    hasConfigurationSecrets(item)
+  );
+}
+
+function hasConfigurationSecrets(item: Application) {
+  return !!item.Configurations?.some(
+    (config) => config.Data && config.Kind === ConfigKind.Secret
+  );
+}
diff --git a/app/react/kubernetes/applications/ListView/ApplicationsDatatable/ConfigurationDetails.tsx b/app/react/kubernetes/applications/ListView/ApplicationsDatatable/ConfigurationDetails.tsx
new file mode 100644
index 0000000..fa03554
--- /dev/null
+++ b/app/react/kubernetes/applications/ListView/ApplicationsDatatable/ConfigurationDetails.tsx
@@ -0,0 +1,56 @@
+import { useAuthorizations } from '@/react/hooks/useUser';
+
+import { SensitiveDetails } from './SensitiveDetails';
+import { Application, ConfigKind } from './types';
+
+export function ConfigurationDetails({
+  item,
+  areSecretsRestricted,
+  username,
+}: {
+  item: Application;
+  areSecretsRestricted: boolean;
+  username: string;
+}) {
+  const isEnvironmentAdminQuery = useAuthorizations(['K8sResourcePoolsW']);
+
+  const secrets = item.Configurations?.filter(
+    (config) => config.Data && config.Kind === ConfigKind.Secret
+  );
+
+  if (isEnvironmentAdminQuery.isLoading || !secrets || secrets.length === 0) {
+    return null;
+  }
+
+  return (
+    <>
+      <div className="col-xs-12 !px-0 !py-1 text-[13px]"> Secrets </div>
+      <table className="w-1/2">
+        <tbody>
+          <tr>
+            <td>
+              {secrets.map((secret) =>
+                Object.entries(secret.Data || {}).map(([key, value]) => (
+                  <SensitiveDetails
+                    key={key}
+                    name={key}
+                    value={value}
+                    canSeeValue={canSeeValue(secret)}
+                  />
+                ))
+              )}
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </>
+  );
+
+  function canSeeValue(secret: { ConfigurationOwner: string }) {
+    return (
+      !areSecretsRestricted ||
+      isEnvironmentAdminQuery.authorized ||
+      secret.ConfigurationOwner === username
+    );
+  }
+}
diff --git a/app/react/kubernetes/applications/ListView/ApplicationsDatatable/EdgeStackBadge.tsx b/app/react/kubernetes/applications/ListView/ApplicationsDatatable/EdgeStackBadge.tsx
new file mode 100644
index 0000000..c20db1d
--- /dev/null
+++ b/app/react/kubernetes/applications/ListView/ApplicationsDatatable/EdgeStackBadge.tsx
@@ -0,0 +1,9 @@
+import { Badge } from '@@/Badge';
+
+export function EdgeStackBadge({ className }: { className?: string }) {
+  return (
+    <Badge type="success" className={className}>
+      Edge Stack
+    </Badge>
+  );
+}
diff --git a/app/react/kubernetes/applications/ListView/ApplicationsDatatable/HelmInsightsBox.tsx b/app/react/kubernetes/applications/ListView/ApplicationsDatatable/HelmInsightsBox.tsx
new file mode 100644
index 0000000..46a3b05
--- /dev/null
+++ b/app/react/kubernetes/applications/ListView/ApplicationsDatatable/HelmInsightsBox.tsx
@@ -0,0 +1,17 @@
+import { InsightsBox } from '@@/InsightsBox';
+
+export function HelmInsightsBox() {
+  return (
+    <InsightsBox
+      header="Helm option"
+      content={
+        <span>
+          From 2.20 and on, the Helm menu sidebar option has moved to the{' '}
+          <strong>Create from code screen</strong> - accessed via the button
+          above.
+        </span>
+      }
+      insightCloseId="k8s-helm"
+    />
+  );
+}
diff --git a/app/react/kubernetes/applications/ListView/ApplicationsDatatable/InnerTable.test.tsx b/app/react/kubernetes/applications/ListView/ApplicationsDatatable/InnerTable.test.tsx
new file mode 100644
index 0000000..85d4326
--- /dev/null
+++ b/app/react/kubernetes/applications/ListView/ApplicationsDatatable/InnerTable.test.tsx
@@ -0,0 +1,43 @@
+import { render, screen } from '@testing-library/react';
+import { vi } from 'vitest';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+
+import { InnerTable } from './InnerTable';
+import { Application } from './types';
+
+// Mock the necessary hooks
+const mockUseEnvironmentId = vi.fn(() => 1);
+
+vi.mock('@/react/hooks/useEnvironmentId', () => ({
+  useEnvironmentId: () => mockUseEnvironmentId(),
+}));
+
+describe('InnerTable', () => {
+  it('should render all rows from the dataset', () => {
+    const mockApplications: Application[] = Array.from(
+      { length: 11 },
+      (_, index) => ({
+        Id: `app-${index}`,
+        Name: `Application ${index}`,
+        Image: `image-${index}`,
+        CreationDate: new Date().toISOString(),
+        ResourcePool: 'default',
+        ApplicationType: 'Deployment',
+        Status: 'Ready',
+        TotalPodsCount: 1,
+        RunningPodsCount: 1,
+        DeploymentType: 'Replicated',
+      })
+    );
+
+    const Wrapped = withTestQueryProvider(withTestRouter(InnerTable));
+    render(<Wrapped dataset={mockApplications} hideStacks={false} />);
+
+    // Verify that all 11 rows are rendered
+    const rows = screen.getAllByRole('row');
+    // Subtract 1 for the header row
+    expect(rows.length - 1).toBe(11);
+  });
+});
diff --git a/app/react/kubernetes/applications/ListView/ApplicationsDatatable/InnerTable.tsx b/app/react/kubernetes/applications/ListView/ApplicationsDatatable/InnerTable.tsx
new file mode 100644
index 0000000..ccb1b2d
--- /dev/null
+++ b/app/react/kubernetes/applications/ListView/ApplicationsDatatable/InnerTable.tsx
@@ -0,0 +1,23 @@
+import { NestedDatatable } from '@@/datatables/NestedDatatable';
+
+import { Application } from './types';
+import { useBaseColumns } from './useColumns';
+
+export function InnerTable({
+  dataset,
+  hideStacks,
+}: {
+  dataset: Array<Application>;
+  hideStacks: boolean;
+}) {
+  const columns = useBaseColumns(hideStacks);
+
+  return (
+    <NestedDatatable
+      dataset={dataset}
+      columns={columns}
+      data-cy="applications-nested-datatable"
+      enablePagination={false}
+    />
+  );
+}
diff --git a/app/react/kubernetes/applications/ListView/ApplicationsDatatable/PublishedPorts.tsx b/app/react/kubernetes/applications/ListView/ApplicationsDatatable/PublishedPorts.tsx
new file mode 100644
index 0000000..80309d5
--- /dev/null
+++ b/app/react/kubernetes/applications/ListView/ApplicationsDatatable/PublishedPorts.tsx
@@ -0,0 +1,81 @@
+import { ExternalLinkIcon } from 'lucide-react';
+
+import { getSchemeFromPort } from '@/react/common/network-utils';
+
+import { Icon } from '@@/Icon';
+
+import { Application } from './types';
+
+export function PublishedPorts({ item }: { item: Application }) {
+  const urlsWithTypes = getPublishedUrls(item);
+
+  if (urlsWithTypes.length === 0) {
+    return null;
+  }
+
+  return (
+    <div className="published-url-container flex">
+      <div className="text-muted mr-12">Published URL(s)</div>
+      <div className="flex flex-col">
+        {urlsWithTypes.map(({ url, type }) => (
+          <a
+            key={url}
+            href={url}
+            target="_blank"
+            className="publish-url-link vertical-center mb-1"
+            rel="noreferrer"
+          >
+            <Icon icon={ExternalLinkIcon} />
+            {type && (
+              <span className="text-muted inline-block w-24">{type}</span>
+            )}
+            <span>{url}</span>
+          </a>
+        ))}
+      </div>
+    </div>
+  );
+}
+
+function getClusterIPUrls(services?: Application['Services']) {
+  return (
+    services?.flatMap(
+      (service) =>
+        (service.spec?.type === 'ClusterIP' &&
+          service.spec?.ports?.map((port) => ({
+            url: `${getSchemeFromPort(port.port)}://${
+              service?.spec?.clusterIP
+            }:${port.port}`,
+            type: 'ClusterIP',
+          }))) ||
+        []
+    ) || []
+  );
+}
+
+function getNodePortUrls(services?: Application['Services']) {
+  return (
+    services?.flatMap(
+      (service) =>
+        (service.spec?.type === 'NodePort' &&
+          service.spec?.ports?.map((port) => ({
+            url: `${getSchemeFromPort(port.port)}://${
+              window.location.hostname
+            }:${port.nodePort}`,
+            type: 'NodePort',
+          }))) ||
+        []
+    ) || []
+  );
+}
+
+export function getPublishedUrls(item: Application) {
+  // Get URLs from clusterIP and nodePort services
+  const clusterIPs = getClusterIPUrls(item.Services);
+  const nodePortUrls = getNodePortUrls(item.Services);
+
+  // combine all urls
+  const publishedUrls = [...clusterIPs, ...nodePortUrls];
+
+  return publishedUrls.length > 0 ? publishedUrls : [];
+}
diff --git a/app/react/kubernetes/applications/ListView/ApplicationsDatatable/SensitiveDetails.module.css b/app/react/kubernetes/applications/ListView/ApplicationsDatatable/SensitiveDetails.module.css
new file mode 100644
index 0000000..82b4e5f
--- /dev/null
+++ b/app/react/kubernetes/applications/ListView/ApplicationsDatatable/SensitiveDetails.module.css
@@ -0,0 +1,11 @@
+.sensitive-details-container {
+  display: grid;
+  grid-template-columns: 25ch 25ch auto;
+  gap: 20px;
+  align-items: start;
+}
+
+.show-hide-container {
+  display: flex;
+  justify-content: space-between;
+}
diff --git a/app/react/kubernetes/applications/ListView/ApplicationsDatatable/SensitiveDetails.tsx b/app/react/kubernetes/applications/ListView/ApplicationsDatatable/SensitiveDetails.tsx
new file mode 100644
index 0000000..15f8b42
--- /dev/null
+++ b/app/react/kubernetes/applications/ListView/ApplicationsDatatable/SensitiveDetails.tsx
@@ -0,0 +1,61 @@
+import { useState } from 'react';
+import { EyeIcon, EyeOffIcon } from 'lucide-react';
+
+import { RestrictedSecretBadge } from '@/react/kubernetes/configs/RestrictedSecretBadge';
+
+import { Button, CopyButton } from '@@/buttons';
+
+import styles from './SensitiveDetails.module.css';
+
+export function SensitiveDetails({
+  name,
+  value,
+  canSeeValue,
+}: {
+  name: string;
+  value: string;
+  canSeeValue?: boolean;
+}) {
+  return (
+    <div className={styles.sensitiveDetailsContainer}>
+      <div className="text-wrap">{name}</div>
+      {canSeeValue ? (
+        <>
+          <ShowHide value={value} useAsterisk />
+          <CopyButton copyText={value} data-cy="copy-button" />
+        </>
+      ) : (
+        <RestrictedSecretBadge />
+      )}
+    </div>
+  );
+}
+
+function ShowHide({
+  value,
+  useAsterisk,
+}: {
+  value: string;
+  useAsterisk: boolean;
+}) {
+  const [show, setShow] = useState(false);
+
+  return (
+    <div className={styles.showHideContainer}>
+      <div className="small text-muted text-wrap">
+        {show ? value : useAsterisk && '********'}
+      </div>
+
+      <Button
+        color="link"
+        type="button"
+        onClick={() => setShow((show) => !show)}
+        title="Show/Hide value"
+        icon={show ? EyeIcon : EyeOffIcon}
+        data-cy="show-hide-button"
+      >
+        {show ? 'Hide' : 'Show'}
+      </Button>
+    </div>
+  );
+}
diff --git a/app/react/kubernetes/applications/ListView/ApplicationsDatatable/SubRow.tsx b/app/react/kubernetes/applications/ListView/ApplicationsDatatable/SubRow.tsx
new file mode 100644
index 0000000..6a32865
--- /dev/null
+++ b/app/react/kubernetes/applications/ListView/ApplicationsDatatable/SubRow.tsx
@@ -0,0 +1,49 @@
+import clsx from 'clsx';
+
+import { useCurrentUser } from '@/react/hooks/useUser';
+
+import { ConfigurationDetails } from './ConfigurationDetails';
+import { InnerTable } from './InnerTable';
+import { PublishedPorts } from './PublishedPorts';
+import { ApplicationRowData } from './types';
+
+export function SubRow({
+  item,
+  hideStacks,
+  areSecretsRestricted,
+  selectDisabled,
+}: {
+  item: ApplicationRowData;
+  hideStacks: boolean;
+  areSecretsRestricted: boolean;
+  selectDisabled: boolean;
+}) {
+  const {
+    user: { Username: username },
+  } = useCurrentUser();
+  const colSpan = hideStacks ? 7 : 8;
+  const alignColSpan = selectDisabled ? 1 : 2;
+
+  return (
+    <tr className={clsx({ 'secondary-body': !item.KubernetesApplications })}>
+      <td colSpan={alignColSpan} />
+      <td colSpan={colSpan} className="datatable-padding-vertical">
+        {item.KubernetesApplications ? (
+          <InnerTable
+            dataset={item.KubernetesApplications}
+            hideStacks={hideStacks}
+          />
+        ) : (
+          <>
+            <PublishedPorts item={item} />
+            <ConfigurationDetails
+              item={item}
+              areSecretsRestricted={areSecretsRestricted}
+              username={username}
+            />
+          </>
+        )}
+      </td>
+    </tr>
+  );
+}
diff --git a/app/react/kubernetes/applications/ListView/ApplicationsDatatable/columns.helper.tsx b/app/react/kubernetes/applications/ListView/ApplicationsDatatable/columns.helper.tsx
new file mode 100644
index 0000000..af2f8dc
--- /dev/null
+++ b/app/react/kubernetes/applications/ListView/ApplicationsDatatable/columns.helper.tsx
@@ -0,0 +1,5 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { ApplicationRowData } from './types';
+
+export const helper = createColumnHelper<ApplicationRowData>();
diff --git a/app/react/kubernetes/applications/ListView/ApplicationsDatatable/columns.name.tsx b/app/react/kubernetes/applications/ListView/ApplicationsDatatable/columns.name.tsx
new file mode 100644
index 0000000..1606465
--- /dev/null
+++ b/app/react/kubernetes/applications/ListView/ApplicationsDatatable/columns.name.tsx
@@ -0,0 +1,55 @@
+import { CellContext } from '@tanstack/react-table';
+
+import { useIsSystemNamespace } from '@/react/kubernetes/namespaces/queries/useIsSystemNamespace';
+import { EdgeStackBadge } from '@/react/kubernetes/applications/ListView/ApplicationsDatatable/EdgeStackBadge';
+
+import { Link } from '@@/Link';
+import { SystemBadge } from '@@/Badge/SystemBadge';
+import { ExternalBadge } from '@@/Badge/ExternalBadge';
+
+import { helper } from './columns.helper';
+import { ApplicationRowData } from './types';
+
+export const name = helper.accessor('Name', {
+  header: 'Name',
+  cell: Cell,
+});
+
+function Cell({
+  row: { original: item },
+}: CellContext<ApplicationRowData, string>) {
+  const isSystem = useIsSystemNamespace(item.ResourcePool);
+  const isEdgeStack = !isSystem && item.StackKind === 'edge';
+
+  return (
+    <div className="flex items-center gap-2">
+      {item.KubernetesApplications ? (
+        <Link
+          data-cy="application-helm-link"
+          to="kubernetes.helm"
+          params={{ name: item.Name, namespace: item.ResourcePool }}
+        >
+          {item.Name}
+        </Link>
+      ) : (
+        <Link
+          data-cy="application-link"
+          to="kubernetes.applications.application"
+          params={{
+            name: item.Name,
+            namespace: item.ResourcePool,
+            'resource-type': item.ApplicationType,
+          }}
+        >
+          {item.Name}
+        </Link>
+      )}
+
+      {isSystem && <SystemBadge className="ml-auto" />}
+      {isEdgeStack && <EdgeStackBadge className="ml-auto" />}
+      {!isSystem && !item.ApplicationOwner && (
+        <ExternalBadge className="ml-auto" />
+      )}
+    </div>
+  );
+}
diff --git a/app/react/kubernetes/applications/ListView/ApplicationsDatatable/columns.status.module.css b/app/react/kubernetes/applications/ListView/ApplicationsDatatable/columns.status.module.css
new file mode 100644
index 0000000..7dcd859
--- /dev/null
+++ b/app/react/kubernetes/applications/ListView/ApplicationsDatatable/columns.status.module.css
@@ -0,0 +1,13 @@
+.status-indicator {
+  padding: 0 !important;
+  margin-right: 1ch;
+  border-radius: 50%;
+  background-color: var(--red-3);
+  height: 10px;
+  width: 10px;
+  display: inline-block;
+}
+
+.status-indicator.ok {
+  background-color: var(--green-3);
+}
diff --git a/app/react/kubernetes/applications/ListView/ApplicationsDatatable/columns.status.tsx b/app/react/kubernetes/applications/ListView/ApplicationsDatatable/columns.status.tsx
new file mode 100644
index 0000000..6f3b6e4
--- /dev/null
+++ b/app/react/kubernetes/applications/ListView/ApplicationsDatatable/columns.status.tsx
@@ -0,0 +1,91 @@
+import { CellContext, Row } from '@tanstack/react-table';
+import clsx from 'clsx';
+
+import {
+  KubernetesApplicationDeploymentTypes,
+  KubernetesApplicationTypes,
+} from '@/kubernetes/models/application/models/appConstants';
+
+import { filterHOC } from '@@/datatables/Filter';
+
+import styles from './columns.status.module.css';
+import { helper } from './columns.helper';
+import { ApplicationRowData } from './types';
+
+export const status = helper.accessor(getStatusSummary, {
+  header: 'Status',
+  cell: Cell,
+  meta: {
+    filter: filterHOC('Filter by status'),
+  },
+  enableColumnFilter: true,
+  filterFn: (row: Row<ApplicationRowData>, _: string, filterValue: string[]) =>
+    filterValue.length === 0 ||
+    filterValue.includes(getStatusSummary(row.original)),
+});
+
+function Cell({
+  row: { original: item },
+}: CellContext<ApplicationRowData, string>) {
+  if (
+    item.ApplicationType === KubernetesApplicationTypes.Pod &&
+    item.Pods &&
+    item.Pods.length > 0
+  ) {
+    return item.Pods[0].Status;
+  }
+
+  return (
+    <>
+      <span
+        className={clsx([
+          styles.statusIndicator,
+          {
+            [styles.ok]:
+              (item.TotalPodsCount > 0 &&
+                item.TotalPodsCount === item.RunningPodsCount) ||
+              item.Status === 'Ready',
+          },
+        ])}
+      />
+      {item.ApplicationType !== KubernetesApplicationTypes.Helm && (
+        <>
+          {item.DeploymentType ===
+            KubernetesApplicationDeploymentTypes.Replicated && (
+            <span className="mr-1">Replicated</span>
+          )}
+          {item.DeploymentType ===
+            KubernetesApplicationDeploymentTypes.Global && (
+            <span className="mr-1">Global</span>
+          )}
+          {item.RunningPodsCount >= 0 && item.TotalPodsCount >= 0 && (
+            <span>
+              <code aria-label="Running Pods" title="Running Pods">
+                {item.RunningPodsCount}
+              </code>{' '}
+              /{' '}
+              <code aria-label="Total Pods" title="Total Pods">
+                {item.TotalPodsCount}
+              </code>
+            </span>
+          )}
+        </>
+      )}
+      {item.KubernetesApplications && <span>{item.Status}</span>}
+    </>
+  );
+}
+
+function getStatusSummary(item: ApplicationRowData): 'Ready' | 'Not Ready' {
+  if (
+    item.ApplicationType === KubernetesApplicationTypes.Pod &&
+    item.Pods &&
+    item.Pods.length > 0
+  ) {
+    return item.Pods[0].Status === 'Running' ? 'Ready' : 'Not Ready';
+  }
+  return item.TotalPodsCount > 0 &&
+    item.TotalPodsCount === item.RunningPodsCount
+    ? 'Ready'
+    : 'Not Ready';
+}
diff --git a/app/react/kubernetes/applications/ListView/ApplicationsDatatable/columns.tsx b/app/react/kubernetes/applications/ListView/ApplicationsDatatable/columns.tsx
new file mode 100644
index 0000000..9c7282e
--- /dev/null
+++ b/app/react/kubernetes/applications/ListView/ApplicationsDatatable/columns.tsx
@@ -0,0 +1,117 @@
+import { CellContext, Row } from '@tanstack/react-table';
+import { useRef } from 'react';
+
+import { isoDate } from '@/portainer/filters/filters';
+import { useIsSystemNamespace } from '@/react/kubernetes/namespaces/queries/useIsSystemNamespace';
+
+import { Link } from '@@/Link';
+import { SystemBadge } from '@@/Badge/SystemBadge';
+import { filterHOC } from '@@/datatables/Filter';
+import { TooltipWithChildren } from '@@/Tip/TooltipWithChildren';
+
+import { Application } from './types';
+import { helper } from './columns.helper';
+
+export const stackName = helper.accessor('StackName', {
+  header: 'Stack',
+  cell: ({ getValue }) => getValue() || '-',
+});
+
+export const namespace = helper.accessor('ResourcePool', {
+  header: 'Namespace',
+  cell: NamespaceCell,
+});
+
+function NamespaceCell({ row, getValue }: CellContext<Application, string>) {
+  const value = getValue();
+  const isSystem = useIsSystemNamespace(value);
+  return (
+    <div className="flex gap-2">
+      <Link
+        to="kubernetes.resourcePools.resourcePool"
+        params={{ id: value }}
+        data-cy={`app-namespace-link-${row.original.Name}`}
+      >
+        {value}
+      </Link>
+      {isSystem && <SystemBadge className="ml-auto" />}
+    </div>
+  );
+}
+
+export const image = helper.accessor('Image', {
+  header: 'Image',
+  cell: ({ row: { original: item } }) => (
+    <ImageCell image={item.Image} imageCount={item.Containers?.length || 0} />
+  ),
+});
+
+function ImageCell({
+  image,
+  imageCount,
+}: {
+  image: string;
+  imageCount: number;
+}) {
+  const contentRef = useRef<HTMLDivElement>(null);
+  const isTruncated = isWidthTruncated();
+
+  const imageElement = (
+    <div
+      className="inline-block max-w-xs truncate"
+      ref={contentRef}
+      title={image}
+    >
+      {image}
+    </div>
+  );
+
+  if (isTruncated) {
+    return (
+      <TooltipWithChildren message={image}>{imageElement}</TooltipWithChildren>
+    );
+  }
+
+  return (
+    <div>
+      {imageElement}
+      {imageCount > 1 && <> + {imageCount - 1}</>}
+    </div>
+  );
+
+  function isWidthTruncated() {
+    const el = contentRef.current;
+    return el && el.scrollWidth > el.clientWidth;
+  }
+}
+
+export const appType = helper.accessor('ApplicationType', {
+  header: 'Application type',
+  meta: {
+    filter: filterHOC('Filter by application type'),
+  },
+  enableColumnFilter: true,
+  filterFn: (row: Row<Application>, _: string, filterValue: string[]) =>
+    filterValue.length === 0 ||
+    (!!row.original.ApplicationType &&
+      filterValue.includes(row.original.ApplicationType)),
+});
+
+export const published = helper.accessor('Services', {
+  header: 'Published',
+  cell: ({ row: { original: item } }) =>
+    item.Services?.length === 0 ? 'No' : 'Yes',
+  enableSorting: false,
+});
+
+export const created = helper.accessor('CreationDate', {
+  header: 'Created',
+  cell({ row: { original: item } }) {
+    return (
+      <>
+        {isoDate(item.CreationDate)}{' '}
+        {item.ApplicationOwner ? ` by ${item.ApplicationOwner}` : ''}
+      </>
+    );
+  },
+});
diff --git a/app/react/kubernetes/applications/ListView/ApplicationsDatatable/index.ts b/app/react/kubernetes/applications/ListView/ApplicationsDatatable/index.ts
new file mode 100644
index 0000000..0864b2a
--- /dev/null
+++ b/app/react/kubernetes/applications/ListView/ApplicationsDatatable/index.ts
@@ -0,0 +1 @@
+export { ApplicationsDatatable } from './ApplicationsDatatable';
diff --git a/app/react/kubernetes/applications/ListView/ApplicationsDatatable/types.ts b/app/react/kubernetes/applications/ListView/ApplicationsDatatable/types.ts
new file mode 100644
index 0000000..ec8e4d4
--- /dev/null
+++ b/app/react/kubernetes/applications/ListView/ApplicationsDatatable/types.ts
@@ -0,0 +1,62 @@
+import { Service } from 'kubernetes-types/core/v1';
+import { HorizontalPodAutoscaler } from 'kubernetes-types/autoscaling/v2';
+
+import { AppType, DeploymentType } from '../../types';
+
+export interface ApplicationRowData extends Application {
+  KubernetesApplications?: Array<Application>;
+}
+
+export interface Application {
+  Id: string;
+  Name: string;
+  Image: string;
+  Containers?: Array<unknown>;
+  Services?: Array<Service>;
+  CreationDate: string;
+  ApplicationOwner?: string;
+  StackName?: string;
+  StackKind?: string;
+  ResourcePool: string;
+  ApplicationType: AppType;
+  Metadata?: {
+    labels: Record<string, string>;
+    annotations: Record<string, string>;
+  };
+  Status: 'Ready' | string;
+  TotalPodsCount: number;
+  RunningPodsCount: number;
+  DeploymentType: DeploymentType;
+  Pods?: Array<{
+    Status: string;
+  }>;
+  Configurations?: Array<{
+    Data?: object;
+    Kind: ConfigKind;
+    ConfigurationOwner: string;
+  }>;
+  LoadBalancerIPAddress?: string;
+  PublishedPorts?: Array<{
+    IngressRules: Array<{
+      Host: string;
+      IP: string;
+      Path: string;
+      TLS: Array<{
+        hosts: Array<string>;
+      }>;
+    }>;
+    Port: number;
+  }>;
+  Resource?: {
+    CpuLimit?: number;
+    CpuRequest?: number;
+    MemoryLimit?: number;
+    MemoryRequest?: number;
+  };
+  HorizontalPodAutoscaler?: HorizontalPodAutoscaler;
+}
+
+export enum ConfigKind {
+  ConfigMap = 1,
+  Secret,
+}
diff --git a/app/react/kubernetes/applications/ListView/ApplicationsDatatable/useColumns.tsx b/app/react/kubernetes/applications/ListView/ApplicationsDatatable/useColumns.tsx
new file mode 100644
index 0000000..541479f
--- /dev/null
+++ b/app/react/kubernetes/applications/ListView/ApplicationsDatatable/useColumns.tsx
@@ -0,0 +1,34 @@
+import _ from 'lodash';
+
+import { buildExpandColumn } from '@@/datatables/expand-column';
+
+import { name } from './columns.name';
+import { status } from './columns.status';
+import {
+  appType,
+  created,
+  image,
+  namespace,
+  published,
+  stackName,
+} from './columns';
+import { Application } from './types';
+
+export function useColumns(hideStacks: boolean) {
+  const baseColumns = useBaseColumns(hideStacks);
+
+  return _.compact([buildExpandColumn<Application>(), ...baseColumns]);
+}
+
+export function useBaseColumns(hideStacks: boolean) {
+  return _.compact([
+    name,
+    !hideStacks && stackName,
+    namespace,
+    image,
+    appType,
+    status,
+    published,
+    created,
+  ]);
+}
diff --git a/app/react/kubernetes/applications/ListView/ApplicationsStacksDatatable/ApplicationsStacksDatatable.tsx b/app/react/kubernetes/applications/ListView/ApplicationsStacksDatatable/ApplicationsStacksDatatable.tsx
new file mode 100644
index 0000000..f0e1bf6
--- /dev/null
+++ b/app/react/kubernetes/applications/ListView/ApplicationsStacksDatatable/ApplicationsStacksDatatable.tsx
@@ -0,0 +1,118 @@
+import { List } from 'lucide-react';
+import { useRouter } from '@uirouter/react';
+
+import { Authorized, useAuthorizations } from '@/react/hooks/useUser';
+import { SystemResourceDescription } from '@/react/kubernetes/datatables/SystemResourceDescription';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { isSystemNamespace } from '@/react/kubernetes/namespaces/queries/useIsSystemNamespace';
+import { useNamespacesQuery } from '@/react/kubernetes/namespaces/queries/useNamespacesQuery';
+import { DefaultDatatableSettings } from '@/react/kubernetes/datatables/DefaultDatatableSettings';
+import { useIngresses } from '@/react/kubernetes/ingresses/queries';
+
+import { ExpandableDatatable } from '@@/datatables/ExpandableDatatable';
+import { TableSettingsMenu } from '@@/datatables';
+import { DeleteButton } from '@@/buttons/DeleteButton';
+
+import { useApplications } from '../../queries/useApplications';
+import { ApplicationsTableSettings } from '../useKubeAppsTableStore';
+import { useDeleteApplicationsMutation } from '../../queries/useDeleteApplicationsMutation';
+
+import { columns } from './columns';
+import { SubRows } from './SubRows';
+import { NamespaceFilter } from './NamespaceFilter';
+import { getStacksFromApplications } from './getStacksFromApplications';
+import { Stack } from './types';
+
+export function ApplicationsStacksDatatable({
+  tableState,
+}: {
+  tableState: ApplicationsTableSettings & {
+    setSearch: (value: string) => void;
+    search: string;
+  };
+}) {
+  const router = useRouter();
+  const environmentId = useEnvironmentId();
+  const namespaceListQuery = useNamespacesQuery(environmentId);
+  const { authorized: hasWriteAuth } = useAuthorizations('K8sApplicationsW');
+  const applicationsQuery = useApplications(environmentId, {
+    refetchInterval: tableState.autoRefreshRate * 1000,
+    namespace: tableState.namespace,
+  });
+  const ingressesQuery = useIngresses(environmentId);
+  const ingresses = ingressesQuery.data ?? [];
+  const applications = applicationsQuery.data ?? [];
+  const filteredApplications = tableState.showSystemResources
+    ? applications
+    : applications.filter(
+        (item) =>
+          !isSystemNamespace(item.ResourcePool, namespaceListQuery.data ?? [])
+      );
+  const stacks = getStacksFromApplications(filteredApplications);
+  const removeApplicationsMutation = useDeleteApplicationsMutation({
+    environmentId,
+    stacks,
+    ingresses,
+    reportStacks: true,
+  });
+
+  return (
+    <ExpandableDatatable
+      getRowCanExpand={(row) => row.original.Applications.length > 0}
+      title="Stacks"
+      titleIcon={List}
+      dataset={stacks}
+      isLoading={applicationsQuery.isLoading || namespaceListQuery.isLoading}
+      columns={columns}
+      settingsManager={tableState}
+      disableSelect={!hasWriteAuth}
+      renderSubRow={(row) => (
+        <SubRows stack={row.original} span={row.getVisibleCells().length} />
+      )}
+      description={
+        <div className="w-full">
+          <div className="float-right mr-2 min-w-[140px]">
+            <NamespaceFilter
+              namespaces={namespaceListQuery.data ?? []}
+              value={tableState.namespace}
+              onChange={tableState.setNamespace}
+              showSystem={tableState.showSystemResources}
+            />
+          </div>
+
+          <div className="space-y-2">
+            <SystemResourceDescription
+              showSystemResources={tableState.showSystemResources}
+            />
+          </div>
+        </div>
+      }
+      renderTableActions={(selectedItems) => (
+        <Authorized authorizations="K8sApplicationsW">
+          <DeleteButton
+            confirmMessage="Are you sure that you want to remove the selected stack(s) ? This will remove all the applications associated to the stack(s)."
+            disabled={selectedItems.length === 0}
+            onConfirmed={() => handleRemoveStacks(selectedItems)}
+            data-cy="k8sApp-removeStackButton"
+          />
+        </Authorized>
+      )}
+      renderTableSettings={() => (
+        <TableSettingsMenu>
+          <DefaultDatatableSettings settings={tableState} />
+        </TableSettingsMenu>
+      )}
+      getRowId={(row) => `${row.Name}-${row.ResourcePool}`}
+      data-cy="applications-stacks-datatable"
+    />
+  );
+
+  function handleRemoveStacks(selectedItems: Stack[]) {
+    const applications = selectedItems.flatMap((stack) => stack.Applications);
+    removeApplicationsMutation.mutate(applications, {
+      onSuccess: () => {
+        router.stateService.reload();
+      },
+    });
+  }
+}
diff --git a/app/react/kubernetes/applications/ListView/ApplicationsStacksDatatable/NamespaceFilter.tsx b/app/react/kubernetes/applications/ListView/ApplicationsStacksDatatable/NamespaceFilter.tsx
new file mode 100644
index 0000000..4acca25
--- /dev/null
+++ b/app/react/kubernetes/applications/ListView/ApplicationsStacksDatatable/NamespaceFilter.tsx
@@ -0,0 +1,74 @@
+import { Filter } from 'lucide-react';
+import { useEffect } from 'react';
+
+import { PortainerNamespace } from '@/react/kubernetes/namespaces/types';
+
+import { Icon } from '@@/Icon';
+import { Select } from '@@/form-components/Input';
+import { InputGroup } from '@@/form-components/InputGroup';
+
+function transformNamespaces(
+  namespaces: PortainerNamespace[],
+  showSystem?: boolean
+) {
+  const transformedNamespaces = namespaces
+    .map(({ Name, IsSystem }) => ({
+      label: IsSystem ? `${Name} - system` : Name,
+      value: Name,
+      isSystem: IsSystem,
+    }))
+    .sort((a, b) => a.label.localeCompare(b.label));
+  if (showSystem === undefined) {
+    return transformedNamespaces;
+  }
+  // only filter when showSystem is set
+  return transformedNamespaces.filter((ns) => showSystem || !ns.isSystem);
+}
+
+export function NamespaceFilter({
+  namespaces,
+  value,
+  onChange,
+  showSystem,
+}: {
+  namespaces: PortainerNamespace[];
+  value: string;
+  onChange: (value: string) => void;
+  showSystem?: boolean;
+}) {
+  const transformedNamespaces = transformNamespaces(namespaces, showSystem);
+
+  // sync value with displayed namespaces
+  useEffect(() => {
+    const names = transformedNamespaces.map((ns) => ns.value);
+    const isSelectedNamespaceFound = names.some((ns) => ns === value);
+    if (value && !isSelectedNamespaceFound) {
+      const newNamespaceValue =
+        names.length > 0
+          ? names.find((ns) => ns === 'default') || names[0]
+          : '';
+      onChange(newNamespaceValue);
+    }
+  }, [value, onChange, transformedNamespaces, showSystem]);
+
+  return (
+    <InputGroup>
+      <InputGroup.Addon>
+        <div className="flex items-center gap-1">
+          <Icon icon={Filter} />
+          Namespace
+        </div>
+      </InputGroup.Addon>
+      <Select
+        className="!h-[30px] py-1"
+        data-cy="app-stacks-namespace-filter"
+        value={value || ''}
+        onChange={(e) => onChange(e.target.value)}
+        options={[
+          { label: 'All namespaces', value: '' },
+          ...transformedNamespaces,
+        ]}
+      />
+    </InputGroup>
+  );
+}
diff --git a/app/react/kubernetes/applications/ListView/ApplicationsStacksDatatable/SubRows.tsx b/app/react/kubernetes/applications/ListView/ApplicationsStacksDatatable/SubRows.tsx
new file mode 100644
index 0000000..7377454
--- /dev/null
+++ b/app/react/kubernetes/applications/ListView/ApplicationsStacksDatatable/SubRows.tsx
@@ -0,0 +1,42 @@
+import clsx from 'clsx';
+
+import KubernetesApplicationHelper from '@/kubernetes/helpers/application';
+import KubernetesNamespaceHelper from '@/kubernetes/helpers/namespaceHelper';
+
+import { Link } from '@@/Link';
+import { ExternalBadge } from '@@/Badge/ExternalBadge';
+
+import { Stack } from './types';
+
+export function SubRows({ stack, span }: { stack: Stack; span: number }) {
+  return (
+    <>
+      {stack.Applications.map((app) => (
+        <tr
+          className={clsx({
+            'datatable-highlighted': stack.Highlighted,
+            'datatable-unhighlighted': !stack.Highlighted,
+          })}
+          key={app.Name}
+        >
+          <td />
+          <td colSpan={span - 1}>
+            <div className="flex gap-2">
+              <Link
+                to="kubernetes.applications.application"
+                params={{ name: app.Name, namespace: app.ResourcePool }}
+                data-cy={`app-stack-application-link-${app.Name}`}
+              >
+                {app.Name}
+              </Link>
+              {KubernetesNamespaceHelper.isSystemNamespace(app.ResourcePool) &&
+                KubernetesApplicationHelper.isExternalApplication(app) && (
+                  <ExternalBadge />
+                )}
+            </div>
+          </td>
+        </tr>
+      ))}
+    </>
+  );
+}
diff --git a/app/react/kubernetes/applications/ListView/ApplicationsStacksDatatable/columns.tsx b/app/react/kubernetes/applications/ListView/ApplicationsStacksDatatable/columns.tsx
new file mode 100644
index 0000000..833bad5
--- /dev/null
+++ b/app/react/kubernetes/applications/ListView/ApplicationsStacksDatatable/columns.tsx
@@ -0,0 +1,70 @@
+import { FileText } from 'lucide-react';
+import { CellContext, createColumnHelper } from '@tanstack/react-table';
+
+import { useIsSystemNamespace } from '@/react/kubernetes/namespaces/queries/useIsSystemNamespace';
+
+import { buildExpandColumn } from '@@/datatables/expand-column';
+import { Link } from '@@/Link';
+import { Icon } from '@@/Icon';
+import { SystemBadge } from '@@/Badge/SystemBadge';
+
+import { Stack } from './types';
+
+export const columnHelper = createColumnHelper<Stack>();
+
+const namespace = columnHelper.accessor('ResourcePool', {
+  id: 'namespace',
+  header: 'Namespace',
+  cell: NamespaceCell,
+});
+
+function NamespaceCell({ row, getValue }: CellContext<Stack, string>) {
+  const value = getValue();
+  const isSystem = useIsSystemNamespace(value);
+  return (
+    <div className="flex gap-2">
+      <Link
+        to="kubernetes.resourcePools.resourcePool"
+        params={{ id: value }}
+        data-cy={`app-stack-namespace-link-${row.original.Name}`}
+      >
+        {value}
+      </Link>
+      {isSystem && <SystemBadge className="ml-auto" />}
+    </div>
+  );
+}
+
+const name = columnHelper.accessor('Name', {
+  id: 'name',
+  header: 'Stack',
+});
+
+const applications = columnHelper.accessor((row) => row.Applications.length, {
+  id: 'applications',
+  header: 'Applications',
+});
+
+const actions = columnHelper.display({
+  id: 'actions',
+  header: 'Actions',
+  cell: ({ row: { original: item } }) => (
+    <Link
+      to="kubernetes.stacks.stack.logs"
+      params={{ namespace: item.ResourcePool, name: item.Name }}
+      className="flex items-center gap-1"
+      data-cy={`app-stack-logs-link-${item.Name}`}
+    >
+      <Icon icon={FileText} />
+      Logs
+    </Link>
+  ),
+});
+
+export const columns = [
+  buildExpandColumn<Stack>(),
+  name,
+  namespace,
+  applications,
+  actions,
+];
diff --git a/app/react/kubernetes/applications/ListView/ApplicationsStacksDatatable/getStacksFromApplications.test.ts b/app/react/kubernetes/applications/ListView/ApplicationsStacksDatatable/getStacksFromApplications.test.ts
new file mode 100644
index 0000000..df4b51d
--- /dev/null
+++ b/app/react/kubernetes/applications/ListView/ApplicationsStacksDatatable/getStacksFromApplications.test.ts
@@ -0,0 +1,159 @@
+import { Application } from '../ApplicationsDatatable/types';
+
+import { getStacksFromApplications } from './getStacksFromApplications';
+import { Stack } from './types';
+
+describe('getStacksFromApplications', () => {
+  test('should return an empty array when passed an empty array', () => {
+    expect(getStacksFromApplications([])).toHaveLength(0);
+  });
+
+  test('should return an empty array when passed a list of applications without stacks', () => {
+    const appsWithoutStacks: Application[] = [
+      {
+        StackName: '',
+        Id: '1',
+        Name: 'app1',
+        CreationDate: '2021-10-01T00:00:00Z',
+        ResourcePool: 'namespace1',
+        Image: 'image1',
+        ApplicationType: 'Pod',
+        DeploymentType: 'Replicated',
+        Status: 'status1',
+        TotalPodsCount: 1,
+        RunningPodsCount: 1,
+      },
+      {
+        StackName: '',
+        Id: '1',
+        Name: 'app2',
+        CreationDate: '2021-10-01T00:00:00Z',
+        ResourcePool: 'namespace1',
+        Image: 'image1',
+        ApplicationType: 'Pod',
+        DeploymentType: 'Replicated',
+        Status: 'status1',
+        TotalPodsCount: 1,
+        RunningPodsCount: 1,
+      },
+      {
+        StackName: '',
+        Id: '1',
+        Name: 'app3',
+        CreationDate: '2021-10-01T00:00:00Z',
+        ResourcePool: 'namespace1',
+        Image: 'image1',
+        ApplicationType: 'Pod',
+        DeploymentType: 'Replicated',
+        Status: 'status1',
+        TotalPodsCount: 1,
+        RunningPodsCount: 1,
+      },
+    ];
+    expect(getStacksFromApplications(appsWithoutStacks)).toHaveLength(0);
+  });
+
+  test('should return a list of stacks when passed a list of applications with stacks', () => {
+    const appsWithStacks: Application[] = [
+      {
+        StackName: 'stack1',
+        Id: '1',
+        Name: 'app1',
+        CreationDate: '2021-10-01T00:00:00Z',
+        ResourcePool: 'namespace1',
+        Image: 'image1',
+        ApplicationType: 'Pod',
+        DeploymentType: 'Replicated',
+        Status: 'status1',
+        TotalPodsCount: 1,
+        RunningPodsCount: 1,
+      },
+      {
+        StackName: 'stack1',
+        Id: '1',
+        Name: 'app2',
+        CreationDate: '2021-10-01T00:00:00Z',
+        ResourcePool: 'namespace1',
+        Image: 'image1',
+        ApplicationType: 'Pod',
+        DeploymentType: 'Replicated',
+        Status: 'status1',
+        TotalPodsCount: 1,
+        RunningPodsCount: 1,
+      },
+      {
+        StackName: 'stack2',
+        Id: '1',
+        Name: 'app3',
+        CreationDate: '2021-10-01T00:00:00Z',
+        ResourcePool: 'namespace1',
+        Image: 'image1',
+        ApplicationType: 'Pod',
+        DeploymentType: 'Replicated',
+        Status: 'status1',
+        TotalPodsCount: 1,
+        RunningPodsCount: 1,
+      },
+    ];
+
+    const expectedStacksWithApps: Stack[] = [
+      {
+        Name: 'stack1',
+        ResourcePool: 'namespace1',
+        Applications: [
+          {
+            StackName: 'stack1',
+            Id: '1',
+            Name: 'app1',
+            CreationDate: '2021-10-01T00:00:00Z',
+            ResourcePool: 'namespace1',
+            Image: 'image1',
+            ApplicationType: 'Pod',
+            DeploymentType: 'Replicated',
+            Status: 'status1',
+            TotalPodsCount: 1,
+            RunningPodsCount: 1,
+          },
+          {
+            StackName: 'stack1',
+            Id: '1',
+            Name: 'app2',
+            CreationDate: '2021-10-01T00:00:00Z',
+            ResourcePool: 'namespace1',
+            Image: 'image1',
+            ApplicationType: 'Pod',
+            DeploymentType: 'Replicated',
+            Status: 'status1',
+            TotalPodsCount: 1,
+            RunningPodsCount: 1,
+          },
+        ],
+        Highlighted: false,
+      },
+      {
+        Name: 'stack2',
+        ResourcePool: 'namespace1',
+        Applications: [
+          {
+            StackName: 'stack2',
+            Id: '1',
+            Name: 'app3',
+            CreationDate: '2021-10-01T00:00:00Z',
+            ResourcePool: 'namespace1',
+            Image: 'image1',
+            ApplicationType: 'Pod',
+            DeploymentType: 'Replicated',
+            Status: 'status1',
+            TotalPodsCount: 1,
+            RunningPodsCount: 1,
+          },
+        ],
+        Highlighted: false,
+      },
+    ];
+
+    expect(getStacksFromApplications(appsWithStacks)).toEqual(
+      expectedStacksWithApps
+    );
+  });
+});
diff --git a/app/react/kubernetes/applications/ListView/ApplicationsStacksDatatable/getStacksFromApplications.ts b/app/react/kubernetes/applications/ListView/ApplicationsStacksDatatable/getStacksFromApplications.ts
new file mode 100644
index 0000000..480cc8d
--- /dev/null
+++ b/app/react/kubernetes/applications/ListView/ApplicationsStacksDatatable/getStacksFromApplications.ts
@@ -0,0 +1,36 @@
+import { Application } from '../ApplicationsDatatable/types';
+
+import { Stack } from './types';
+
+export function getStacksFromApplications(applications: Application[]) {
+  const res = applications.reduce<Stack[]>((stacks, app) => {
+    const updatedStacks = stacks.map((stack) => {
+      if (
+        stack.Name === app.StackName &&
+        stack.ResourcePool === app.ResourcePool
+      ) {
+        return {
+          ...stack,
+          Applications: [...stack.Applications, app],
+        };
+      }
+      return stack;
+    });
+
+    const stackExists = updatedStacks.some(
+      (stack) =>
+        stack.Name === app.StackName && stack.ResourcePool === app.ResourcePool
+    );
+
+    if (!stackExists && app.StackName) {
+      updatedStacks.push({
+        Name: app.StackName,
+        ResourcePool: app.ResourcePool,
+        Applications: [app],
+        Highlighted: false,
+      });
+    }
+    return updatedStacks;
+  }, []);
+  return res;
+}
diff --git a/app/react/kubernetes/applications/ListView/ApplicationsStacksDatatable/index.ts b/app/react/kubernetes/applications/ListView/ApplicationsStacksDatatable/index.ts
new file mode 100644
index 0000000..f2f98da
--- /dev/null
+++ b/app/react/kubernetes/applications/ListView/ApplicationsStacksDatatable/index.ts
@@ -0,0 +1 @@
+export { ApplicationsStacksDatatable } from './ApplicationsStacksDatatable';
diff --git a/app/react/kubernetes/applications/ListView/ApplicationsStacksDatatable/types.ts b/app/react/kubernetes/applications/ListView/ApplicationsStacksDatatable/types.ts
new file mode 100644
index 0000000..75f0a88
--- /dev/null
+++ b/app/react/kubernetes/applications/ListView/ApplicationsStacksDatatable/types.ts
@@ -0,0 +1,8 @@
+import { Application } from '../ApplicationsDatatable/types';
+
+export type Stack = {
+  Name: string;
+  ResourcePool: string;
+  Applications: Application[];
+  Highlighted: boolean;
+};
diff --git a/app/react/kubernetes/applications/ListView/ApplicationsView.tsx b/app/react/kubernetes/applications/ListView/ApplicationsView.tsx
new file mode 100644
index 0000000..38a31e6
--- /dev/null
+++ b/app/react/kubernetes/applications/ListView/ApplicationsView.tsx
@@ -0,0 +1,50 @@
+import { BoxIcon, List } from 'lucide-react';
+
+import { usePublicSettings } from '@/react/portainer/settings/queries/usePublicSettings';
+
+import { PageHeader } from '@@/PageHeader';
+import { Tab, WidgetTabs, useCurrentTabIndex } from '@@/Widget/WidgetTabs';
+
+import { ApplicationsDatatable } from './ApplicationsDatatable';
+import { ApplicationsStacksDatatable } from './ApplicationsStacksDatatable';
+import { useKubeAppsTableStore } from './useKubeAppsTableStore';
+
+export function ApplicationsView() {
+  const tableState = useKubeAppsTableStore('kubernetes.applications', 'Name');
+  const hideStacksQuery = usePublicSettings({
+    select: (settings) =>
+      settings.GlobalDeploymentOptions.hideStacksFunctionality,
+  });
+  const hideStacks = hideStacksQuery.isLoading || !!hideStacksQuery.data;
+
+  const tabs: Tab[] = [
+    {
+      name: 'Applications',
+      icon: BoxIcon,
+      widget: <ApplicationsDatatable tableState={tableState} />,
+      selectedTabParam: 'applications',
+    },
+    {
+      name: 'Stacks',
+      icon: List,
+      widget: <ApplicationsStacksDatatable tableState={tableState} />,
+      selectedTabParam: 'stacks',
+    },
+  ];
+
+  const currentTabIndex = useCurrentTabIndex(tabs);
+
+  return (
+    <>
+      <PageHeader title="Application list" breadcrumbs="Applications" reload />
+      {hideStacks ? (
+        <ApplicationsDatatable tableState={tableState} hideStacks />
+      ) : (
+        <>
+          <WidgetTabs tabs={tabs} currentTabIndex={currentTabIndex} />
+          <div className="content">{tabs[currentTabIndex].widget}</div>
+        </>
+      )}
+    </>
+  );
+}
diff --git a/app/react/kubernetes/applications/ListView/useKubeAppsTableStore.ts b/app/react/kubernetes/applications/ListView/useKubeAppsTableStore.ts
new file mode 100644
index 0000000..92c0eb7
--- /dev/null
+++ b/app/react/kubernetes/applications/ListView/useKubeAppsTableStore.ts
@@ -0,0 +1,55 @@
+import { useState } from 'react';
+
+import { TableSettings } from '@/react/kubernetes/datatables/DefaultDatatableSettings';
+
+import {
+  refreshableSettings,
+  createPersistedStore,
+  ZustandSetFunc,
+} from '@@/datatables/types';
+import { useTableState } from '@@/datatables/useTableState';
+
+import { systemResourcesSettings } from '../../datatables/SystemResourcesSettings';
+
+interface NamespaceSelectSettings {
+  namespace: string;
+  setNamespace: (namespace: string) => void;
+}
+export type ApplicationsTableSettings = NamespaceSelectSettings & TableSettings;
+
+export function namespaceSelectSettings<T extends NamespaceSelectSettings>(
+  set: ZustandSetFunc<T>,
+  namespace = 'default'
+): NamespaceSelectSettings {
+  return {
+    namespace,
+    setNamespace: (namespace: string) => set((s) => ({ ...s, namespace })),
+  };
+}
+
+export function createStore<T extends ApplicationsTableSettings>(
+  storageKey: string,
+  initialSortBy?: string | { id: string; desc: boolean },
+  create: (
+    set: ZustandSetFunc<T>
+  ) => Omit<T, keyof ApplicationsTableSettings> = () => ({}) as T
+) {
+  return createPersistedStore<T>(
+    storageKey,
+    initialSortBy,
+    (set) =>
+      ({
+        ...refreshableSettings(set),
+        ...systemResourcesSettings(set),
+        ...namespaceSelectSettings(set),
+        ...create(set),
+      }) as T
+  );
+}
+
+export function useKubeAppsTableStore<T extends ApplicationsTableSettings>(
+  ...args: Parameters<typeof createStore<T>>
+) {
+  const [store] = useState(() => createStore(...args));
+  return useTableState(store, args[0]);
+}
diff --git a/app/react/kubernetes/applications/LogsView/.keep b/app/react/kubernetes/applications/LogsView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/kubernetes/applications/StatsView/.keep b/app/react/kubernetes/applications/StatsView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/kubernetes/applications/components/AppDeploymentTypeFormSection/AppDeploymentTypeFormSection.tsx b/app/react/kubernetes/applications/components/AppDeploymentTypeFormSection/AppDeploymentTypeFormSection.tsx
new file mode 100644
index 0000000..ce2fbd3
--- /dev/null
+++ b/app/react/kubernetes/applications/components/AppDeploymentTypeFormSection/AppDeploymentTypeFormSection.tsx
@@ -0,0 +1,70 @@
+import { Boxes, Sliders } from 'lucide-react';
+import { FormikErrors } from 'formik';
+
+import { BoxSelector, BoxSelectorOption } from '@@/BoxSelector';
+import { FormSection } from '@@/form-components/FormSection';
+import { TextTip } from '@@/Tip/TextTip';
+import { FormError } from '@@/form-components/FormError';
+
+import { DeploymentType } from '../../types';
+
+interface Props {
+  values: DeploymentType;
+  onChange(values: DeploymentType): void;
+  errors: FormikErrors<DeploymentType>;
+  supportGlobalDeployment: boolean;
+}
+
+export function AppDeploymentTypeFormSection({
+  values,
+  onChange,
+  errors,
+  supportGlobalDeployment,
+}: Props) {
+  const options = getOptions(supportGlobalDeployment);
+
+  return (
+    <FormSection title="Deployment">
+      <TextTip color="blue">
+        Select how you want to deploy your application inside the cluster.
+      </TextTip>
+      <BoxSelector
+        slim
+        options={options}
+        value={values}
+        onChange={onChange}
+        radioName="deploymentType"
+      />
+      {!!errors && <FormError>{errors}</FormError>}
+    </FormSection>
+  );
+}
+
+function getOptions(
+  supportGlobalDeployment: boolean
+): ReadonlyArray<BoxSelectorOption<DeploymentType>> {
+  return [
+    {
+      id: 'deployment_replicated',
+      label: 'Replicated',
+      value: 'Replicated',
+      icon: Sliders,
+      iconType: 'badge',
+      description: 'Run one or multiple instances of this container',
+    },
+    {
+      id: 'deployment_global',
+      disabled: () => !supportGlobalDeployment,
+      tooltip: () =>
+        !supportGlobalDeployment
+          ? 'The storage or access policy used for persisted folders cannot be used with this option'
+          : '',
+      label: 'Global',
+      description:
+        'Application will be deployed as a DaemonSet with an instance on each node of the cluster',
+      value: 'Global',
+      icon: Boxes,
+      iconType: 'badge',
+    },
+  ] as const;
+}
diff --git a/app/react/kubernetes/applications/components/AppDeploymentTypeFormSection/deploymentTypeValidation.ts b/app/react/kubernetes/applications/components/AppDeploymentTypeFormSection/deploymentTypeValidation.ts
new file mode 100644
index 0000000..f749058
--- /dev/null
+++ b/app/react/kubernetes/applications/components/AppDeploymentTypeFormSection/deploymentTypeValidation.ts
@@ -0,0 +1,25 @@
+import { SchemaOf, mixed } from 'yup';
+
+import { DeploymentType } from '../../types';
+
+type ValidationData = {
+  isQuotaExceeded: boolean;
+};
+
+export function deploymentTypeValidation(
+  validationData?: ValidationData
+): SchemaOf<DeploymentType> {
+  return mixed()
+    .oneOf(['Replicated', 'Global'])
+    .test(
+      'exhaused',
+      `This application would exceed available resources. Please review resource reservations or the instance count.`,
+      (value) => {
+        // ignore this validation if the user has selected Replicated, in this case, the isQuotaExceeded will below the instance count input
+        if (value === 'Replicated') {
+          return true;
+        }
+        return !validationData?.isQuotaExceeded;
+      }
+    );
+}
diff --git a/app/react/kubernetes/applications/components/ApplicationSummarySection/ApplicationSummarySection.tsx b/app/react/kubernetes/applications/components/ApplicationSummarySection/ApplicationSummarySection.tsx
new file mode 100644
index 0000000..25752c9
--- /dev/null
+++ b/app/react/kubernetes/applications/components/ApplicationSummarySection/ApplicationSummarySection.tsx
@@ -0,0 +1,73 @@
+import { FormSection } from '@@/form-components/FormSection';
+import { TextTip } from '@@/Tip/TextTip';
+
+import { ApplicationFormValues } from '../../types';
+
+import { getAppResourceSummaries, getArticle } from './utils';
+import { Summary } from './types';
+
+type Props = {
+  formValues: ApplicationFormValues;
+  oldFormValues: ApplicationFormValues;
+};
+
+export function ApplicationSummarySection({
+  formValues,
+  oldFormValues,
+}: Props) {
+  // extract cpu and memory requests & limits for pod
+  const limits = {
+    cpu: formValues.CpuLimit,
+    memory: formValues.MemoryLimit,
+  };
+  const appResourceSummaries = getAppResourceSummaries(
+    formValues,
+    oldFormValues
+  );
+
+  if (!appResourceSummaries || appResourceSummaries?.length === 0) {
+    return null;
+  }
+
+  return (
+    <FormSection title="Summary" isFoldable defaultFolded={false}>
+      <TextTip color="blue">
+        Portainer will execute the following Kubernetes actions.
+      </TextTip>
+      <ul className="small text-muted ml-5 w-full">
+        {appResourceSummaries.map((summary) => (
+          <SummaryItem key={JSON.stringify(summary)} summary={summary} />
+        ))}
+        {!!limits.memory && (
+          <li>
+            Set the memory resources limits and requests to{' '}
+            <code>{limits.memory}M</code>
+          </li>
+        )}
+        {!!limits.cpu && (
+          <li>
+            Set the CPU resources limits and requests to{' '}
+            <code>{limits.cpu}</code>
+          </li>
+        )}
+      </ul>
+    </FormSection>
+  );
+}
+
+function SummaryItem({ summary }: { summary: Summary }) {
+  return (
+    <li>
+      {`${summary.action} ${getArticle(summary.kind, summary.action)} `}
+      <span className="bold">{summary.kind}</span>
+      {' named '}
+      <code>{summary.name}</code>
+      {!!summary.type && (
+        <span>
+          {' of type '}
+          <code>{summary.type}</code>
+        </span>
+      )}
+    </li>
+  );
+}
diff --git a/app/react/kubernetes/applications/components/ApplicationSummarySection/index.ts b/app/react/kubernetes/applications/components/ApplicationSummarySection/index.ts
new file mode 100644
index 0000000..320dec8
--- /dev/null
+++ b/app/react/kubernetes/applications/components/ApplicationSummarySection/index.ts
@@ -0,0 +1 @@
+export { ApplicationSummarySection } from './ApplicationSummarySection';
diff --git a/app/react/kubernetes/applications/components/ApplicationSummarySection/types.ts b/app/react/kubernetes/applications/components/ApplicationSummarySection/types.ts
new file mode 100644
index 0000000..92268b4
--- /dev/null
+++ b/app/react/kubernetes/applications/components/ApplicationSummarySection/types.ts
@@ -0,0 +1,21 @@
+import { AppKind } from '../../types';
+
+export type KubernetesResourceAction = 'Create' | 'Update' | 'Delete';
+
+export type KubernetesResourceType =
+  | AppKind
+  | 'Namespace'
+  | 'ResourceQuota'
+  | 'ConfigMap'
+  | 'Secret'
+  | 'PersistentVolumeClaim'
+  | 'Service'
+  | 'Ingress'
+  | 'HorizontalPodAutoscaler';
+
+export type Summary = {
+  action: KubernetesResourceAction;
+  kind: KubernetesResourceType;
+  name: string;
+  type?: string;
+};
diff --git a/app/react/kubernetes/applications/components/ApplicationSummarySection/utils.test.ts b/app/react/kubernetes/applications/components/ApplicationSummarySection/utils.test.ts
new file mode 100644
index 0000000..c3a39f1
--- /dev/null
+++ b/app/react/kubernetes/applications/components/ApplicationSummarySection/utils.test.ts
@@ -0,0 +1,532 @@
+import { ApplicationFormValues } from '../../types';
+
+import { Summary } from './types';
+import { getAppResourceSummaries } from './utils';
+
+const complicatedStatefulSet: ApplicationFormValues = {
+  ApplicationType: 'StatefulSet',
+  ResourcePool: {
+    Namespace: {
+      Id: '9ef75267-3cf4-46f6-879a-5baeceb5c477',
+      Name: 'default',
+      CreationDate: '2023-08-30T18:55:34Z',
+      Status: 'Active',
+      Yaml: '',
+      IsSystem: false,
+      Annotations: [],
+    },
+    Ingresses: [],
+    Yaml: '',
+    $$hashKey: 'object:702',
+  },
+  Name: 'my-app',
+  StackName: '',
+  ApplicationOwner: '',
+  ImageModel: {
+    UseRegistry: true,
+    Registry: {
+      Id: 0,
+      Type: 0,
+      Name: 'Docker Hub (anonymous)',
+      URL: 'docker.io',
+    },
+    Image: 'caddy',
+  },
+  Note: '',
+  MemoryLimit: 512,
+  CpuLimit: 0.5,
+  DeploymentType: 'Replicated',
+  ReplicaCount: 1,
+  AutoScaler: {
+    isUsed: true,
+    minReplicas: 1,
+    maxReplicas: 3,
+    targetCpuUtilizationPercentage: 50,
+  },
+  Containers: [],
+  Services: [
+    {
+      Headless: false,
+      Namespace: '',
+      Name: 'my-app',
+      StackName: '',
+      Ports: [
+        {
+          port: 80,
+          targetPort: 80,
+          name: '',
+          protocol: 'TCP',
+          serviceName: 'my-app',
+          ingressPaths: [
+            {
+              Host: '127.0.0.1.nip.io',
+              IngressName: 'default-ingress-3',
+              Path: '/test',
+            },
+          ],
+        },
+      ],
+      Type: 'ClusterIP',
+      ClusterIP: '',
+      ApplicationName: '',
+      ApplicationOwner: '',
+      Note: '',
+      Ingress: false,
+    },
+    {
+      Headless: false,
+      Namespace: '',
+      Name: 'my-app-2',
+      StackName: '',
+      Ports: [
+        {
+          port: 80,
+          targetPort: 80,
+          name: '',
+          protocol: 'TCP',
+          nodePort: 30080,
+          serviceName: 'my-app-2',
+        },
+      ],
+      Type: 'NodePort',
+      ClusterIP: '',
+      ApplicationName: '',
+      ApplicationOwner: '',
+      Note: '',
+      Ingress: false,
+    },
+    {
+      Headless: false,
+      Namespace: '',
+      Name: 'my-app-3',
+      StackName: '',
+      Ports: [
+        {
+          port: 80,
+          targetPort: 80,
+          name: '',
+          protocol: 'TCP',
+          serviceName: 'my-app-3',
+        },
+      ],
+      Type: 'LoadBalancer',
+      ClusterIP: '',
+      ApplicationName: '',
+      ApplicationOwner: '',
+      Note: '',
+      Ingress: false,
+    },
+  ],
+  EnvironmentVariables: [],
+  DataAccessPolicy: 'Isolated',
+  PersistedFolders: [
+    {
+      persistentVolumeClaimName: 'my-app-6be07c40-de3a-4775-a29b-19a60890052e',
+      containerPath: 'test',
+      size: '1',
+      sizeUnit: 'GB',
+      storageClass: {
+        Name: 'local-path',
+        AccessModes: ['RWO', 'RWX'],
+        Provisioner: 'rancher.io/local-path',
+        AllowVolumeExpansion: true,
+      },
+      useNewVolume: true,
+      needsDeletion: false,
+    },
+  ],
+  ConfigMaps: [],
+  Secrets: [],
+  PlacementType: 'preferred',
+  Placements: [],
+  Annotations: [],
+};
+
+const complicatedStatefulSetNoServices: ApplicationFormValues = {
+  ApplicationType: 'StatefulSet',
+  ResourcePool: {
+    Namespace: {
+      Id: '9ef75267-3cf4-46f6-879a-5baeceb5c477',
+      Name: 'default',
+      CreationDate: '2023-08-30T18:55:34Z',
+      Status: 'Active',
+      Yaml: '',
+      IsSystem: false,
+      Annotations: [],
+    },
+    Ingresses: [],
+    Yaml: '',
+    $$hashKey: 'object:129',
+  },
+  Name: 'my-app',
+  StackName: 'my-app',
+  ApplicationOwner: 'admin',
+  ImageModel: {
+    UseRegistry: true,
+    Registry: {
+      Id: 0,
+      Type: 0,
+      Name: 'Docker Hub (anonymous)',
+      URL: 'docker.io',
+    },
+    Image: 'caddy:latest',
+  },
+  Note: '',
+  MemoryLimit: 512,
+  CpuLimit: 0.5,
+  DeploymentType: 'Replicated',
+  ReplicaCount: 1,
+  AutoScaler: {
+    minReplicas: 1,
+    maxReplicas: 3,
+    targetCpuUtilizationPercentage: 50,
+    isUsed: true,
+  },
+  Containers: [
+    {
+      Type: 2,
+      PodName: 'my-app-0',
+      Name: 'my-app',
+      Image: 'caddy:latest',
+      ImagePullPolicy: 'Always',
+      Status: 'Terminated',
+      Limits: {
+        cpu: '500m',
+        memory: '512M',
+      },
+      Requests: {
+        cpu: '500m',
+        memory: '512M',
+      },
+      VolumeMounts: [
+        {
+          name: 'test-6be07c40-de3a-4775-a29b-19a60890052e-test-0',
+          mountPath: '/test',
+        },
+        {
+          name: 'kube-api-access-n4vht',
+          readOnly: true,
+          mountPath: '/var/run/secrets/kubernetes.io/serviceaccount',
+        },
+      ],
+      ConfigurationVolumes: [],
+      PersistedFolders: [
+        {
+          MountPath: '/test',
+          persistentVolumeClaimName:
+            'test-6be07c40-de3a-4775-a29b-19a60890052e-test-0',
+          HostPath: '',
+        },
+      ],
+    },
+  ],
+  Services: [],
+  EnvironmentVariables: [],
+  DataAccessPolicy: 'Isolated',
+  PersistedFolders: [
+    {
+      persistentVolumeClaimName:
+        'test-6be07c40-de3a-4775-a29b-19a60890052e-test-0',
+      needsDeletion: false,
+      containerPath: '/test',
+      size: '1',
+      sizeUnit: 'GB',
+      storageClass: {
+        Name: 'local-path',
+        AccessModes: ['RWO', 'RWX'],
+        Provisioner: 'rancher.io/local-path',
+        AllowVolumeExpansion: true,
+      },
+      useNewVolume: true,
+    },
+  ],
+  ConfigMaps: [],
+  Secrets: [],
+  PlacementType: 'preferred',
+  Placements: [],
+  Annotations: [],
+};
+
+const createComplicatedStatefulSetSummaries: Array<Summary> = [
+  {
+    action: 'Create',
+    kind: 'StatefulSet',
+    name: 'my-app',
+  },
+  {
+    action: 'Create',
+    kind: 'Service',
+    name: 'my-app',
+    type: 'ClusterIP',
+  },
+  {
+    action: 'Create',
+    kind: 'Service',
+    name: 'my-app-2',
+    type: 'NodePort',
+  },
+  {
+    action: 'Create',
+    kind: 'Service',
+    name: 'my-app-3',
+    type: 'LoadBalancer',
+  },
+  {
+    action: 'Create',
+    kind: 'Service',
+    name: 'headless-my-app',
+    type: 'ClusterIP',
+  },
+  {
+    action: 'Update',
+    kind: 'Ingress',
+    name: 'default-ingress-3',
+  },
+  {
+    action: 'Create',
+    kind: 'PersistentVolumeClaim',
+    name: 'my-app-6be07c40-de3a-4775-a29b-19a60890052e-my-app-0',
+  },
+  {
+    action: 'Create',
+    kind: 'HorizontalPodAutoscaler',
+    name: 'my-app',
+  },
+];
+
+const simpleDaemonset: ApplicationFormValues = {
+  ApplicationType: 'DaemonSet',
+  ResourcePool: {
+    Namespace: {
+      Id: '49acd824-0ee4-46d1-b1e2-3d36a64ce7e4',
+      Name: 'default',
+      CreationDate: '2023-12-19T06:40:12Z',
+      Status: 'Active',
+      Yaml: '',
+      IsSystem: false,
+      Annotations: [],
+    },
+    Ingresses: [],
+    Yaml: '',
+    $$hashKey: 'object:418',
+  },
+  Name: 'my-app',
+  StackName: '',
+  ApplicationOwner: '',
+  ImageModel: {
+    UseRegistry: true,
+    Registry: {
+      Id: 0,
+      Type: 0,
+      Name: 'Docker Hub (anonymous)',
+      URL: 'docker.io',
+    },
+    Image: 'caddy',
+  },
+  Note: '',
+  MemoryLimit: 0,
+  CpuLimit: 0,
+  DeploymentType: 'Global',
+  ReplicaCount: 1,
+  Containers: [],
+  DataAccessPolicy: 'Shared',
+  PersistedFolders: [
+    {
+      persistentVolumeClaimName: 'my-app-7c114420-a5d0-491c-8bd6-ec70c3d380be',
+      containerPath: '/test',
+      size: '1',
+      sizeUnit: 'GB',
+      storageClass: {
+        Name: 'oci',
+        AccessModes: ['RWO', 'RWX'],
+        Provisioner: 'oracle.com/oci',
+        AllowVolumeExpansion: true,
+      },
+      useNewVolume: true,
+      needsDeletion: false,
+    },
+  ],
+  PlacementType: 'preferred',
+};
+
+const createSimpleDaemonsetSummaries: Array<Summary> = [
+  {
+    action: 'Create',
+    kind: 'DaemonSet',
+    name: 'my-app',
+  },
+  {
+    action: 'Create',
+    kind: 'PersistentVolumeClaim',
+    name: 'my-app-7c114420-a5d0-491c-8bd6-ec70c3d380be',
+  },
+];
+
+const simpleDeployment: ApplicationFormValues = {
+  ApplicationType: 'Deployment',
+  ResourcePool: {
+    Namespace: {
+      Id: '49acd824-0ee4-46d1-b1e2-3d36a64ce7e4',
+      Name: 'default',
+      CreationDate: '2023-12-19T06:40:12Z',
+      Status: 'Active',
+      Yaml: '',
+      IsSystem: false,
+      Annotations: [],
+    },
+    Ingresses: [],
+    Yaml: '',
+    $$hashKey: 'object:582',
+  },
+  Name: 'my-app',
+  StackName: '',
+  ApplicationOwner: '',
+  ImageModel: {
+    UseRegistry: true,
+    Registry: {
+      Id: 0,
+      Type: 0,
+      Name: 'Docker Hub (anonymous)',
+      URL: 'docker.io',
+    },
+    Image: 'caddy',
+  },
+  Note: '',
+  MemoryLimit: 512,
+  CpuLimit: 0.5,
+  DeploymentType: 'Replicated',
+  ReplicaCount: 1,
+  Containers: [],
+  DataAccessPolicy: 'Isolated',
+  PlacementType: 'preferred',
+};
+
+const createSimpleDeploymentSummaries: Array<Summary> = [
+  {
+    action: 'Create',
+    kind: 'Deployment',
+    name: 'my-app',
+  },
+];
+
+describe('getCreateAppSummaries', () => {
+  const tests: {
+    oldFormValues?: ApplicationFormValues;
+    newFormValues: ApplicationFormValues;
+    expected: Array<Summary>;
+    title: string;
+  }[] = [
+    {
+      oldFormValues: undefined,
+      newFormValues: complicatedStatefulSet,
+      expected: createComplicatedStatefulSetSummaries,
+      title: 'should return create summaries for a complicated statefulset',
+    },
+    {
+      oldFormValues: undefined,
+      newFormValues: simpleDaemonset,
+      expected: createSimpleDaemonsetSummaries,
+      title: 'should return create summaries for a simple daemonset',
+    },
+    {
+      oldFormValues: undefined,
+      newFormValues: simpleDeployment,
+      expected: createSimpleDeploymentSummaries,
+      title: 'should return create summaries for a simple deployment',
+    },
+  ];
+  tests.forEach((test) => {
+    // eslint-disable-next-line vitest/valid-title
+    it(test.title, () => {
+      expect(
+        getAppResourceSummaries(test.newFormValues, test.oldFormValues)
+      ).toEqual(test.expected);
+    });
+  });
+});
+
+const updateComplicatedStatefulSetSummaries: Array<Summary> = [
+  {
+    action: 'Update',
+    kind: 'StatefulSet',
+    name: 'my-app',
+  },
+  {
+    action: 'Delete',
+    kind: 'Service',
+    name: 'my-app',
+    type: 'ClusterIP',
+  },
+  {
+    action: 'Delete',
+    kind: 'Service',
+    name: 'my-app-2',
+    type: 'NodePort',
+  },
+  {
+    action: 'Delete',
+    kind: 'Service',
+    name: 'my-app-3',
+    type: 'LoadBalancer',
+  },
+  {
+    action: 'Create',
+    kind: 'PersistentVolumeClaim',
+    name: 'test-6be07c40-de3a-4775-a29b-19a60890052e-test-0-my-app-0',
+  },
+];
+
+const updateDeploymentToStatefulSetSummaries: Array<Summary> = [
+  {
+    action: 'Delete',
+    kind: 'Deployment',
+    name: 'my-app',
+  },
+  {
+    action: 'Create',
+    kind: 'StatefulSet',
+    name: 'my-app',
+  },
+  {
+    action: 'Create',
+    kind: 'PersistentVolumeClaim',
+    name: 'test-6be07c40-de3a-4775-a29b-19a60890052e-test-0-my-app-0',
+  },
+  {
+    action: 'Create',
+    kind: 'HorizontalPodAutoscaler',
+    name: 'my-app',
+  },
+];
+
+describe('getUpdateAppSummaries', () => {
+  const tests: {
+    oldFormValues: ApplicationFormValues;
+    newFormValues: ApplicationFormValues;
+    expected: Array<Summary>;
+    title: string;
+  }[] = [
+    {
+      oldFormValues: complicatedStatefulSet,
+      newFormValues: complicatedStatefulSetNoServices,
+      expected: updateComplicatedStatefulSetSummaries,
+      title:
+        'should return update summaries for removing services from statefulset',
+    },
+    {
+      oldFormValues: simpleDeployment,
+      newFormValues: complicatedStatefulSetNoServices,
+      expected: updateDeploymentToStatefulSetSummaries,
+      title:
+        'should return update summaries for changing deployment to statefulset',
+    },
+  ];
+  tests.forEach((test) => {
+    // eslint-disable-next-line vitest/valid-title
+    it(test.title, () => {
+      expect(
+        getAppResourceSummaries(test.newFormValues, test.oldFormValues)
+      ).toEqual(test.expected);
+    });
+  });
+});
diff --git a/app/react/kubernetes/applications/components/ApplicationSummarySection/utils.ts b/app/react/kubernetes/applications/components/ApplicationSummarySection/utils.ts
new file mode 100644
index 0000000..46babdb
--- /dev/null
+++ b/app/react/kubernetes/applications/components/ApplicationSummarySection/utils.ts
@@ -0,0 +1,397 @@
+import { Ingress } from '@/react/kubernetes/ingresses/types';
+
+import { ServiceFormValues } from '../../CreateView/application-services/types';
+import { ApplicationFormValues } from '../../types';
+import {
+  generateNewIngressesFromFormPaths,
+  getServicePatchPayload,
+} from '../../CreateView/application-services/utils';
+
+import {
+  KubernetesResourceType,
+  KubernetesResourceAction,
+  Summary,
+} from './types';
+
+export function getArticle(
+  resourceType: KubernetesResourceType,
+  resourceAction: KubernetesResourceAction
+) {
+  if (resourceAction === 'Delete' || resourceAction === 'Update') {
+    return 'the';
+  }
+  if (resourceAction === 'Create' && resourceType === 'Ingress') {
+    return 'an';
+  }
+  return 'a';
+}
+
+/**
+ * generateResourceSummaryList maps formValues to create and update summaries
+ */
+export function getAppResourceSummaries(
+  newFormValues: ApplicationFormValues,
+  oldFormValues?: ApplicationFormValues
+): Array<Summary> {
+  if (!oldFormValues?.Name) {
+    return getCreatedApplicationResourcesNew(newFormValues);
+  }
+  return getUpdatedApplicationResources(newFormValues, oldFormValues);
+}
+
+function getCreatedApplicationResourcesNew(
+  formValues: ApplicationFormValues
+): Array<Summary> {
+  // app summary
+  const appSummary: Summary = {
+    action: 'Create',
+    kind: formValues.ApplicationType,
+    name: formValues.Name,
+  };
+
+  // service summaries
+  const serviceFormSummaries: Array<Summary> =
+    formValues.Services?.map((service) => ({
+      action: 'Create',
+      kind: 'Service',
+      name: service.Name || '',
+      type: service.Type,
+    })) || [];
+  // statefulsets require a headless service (https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#limitations)
+  // create a headless service summary if the application is a statefulset
+  const headlessSummary: Array<Summary> =
+    formValues.ApplicationType === 'StatefulSet'
+      ? [
+          {
+            action: 'Create',
+            kind: 'Service',
+            name: `headless-${formValues.Name}`,
+            type: 'ClusterIP',
+          },
+        ]
+      : [];
+  const serviceSummaries = [...serviceFormSummaries, ...headlessSummary];
+
+  // ingress summaries
+  const ingressesSummaries: Array<Summary> =
+    formValues.Services?.flatMap((service) => {
+      // a single service port can have multiple ingress paths (and even use different ingresses)
+      const servicePathsIngressNames = service.Ports.flatMap(
+        (port) => port.ingressPaths?.map((path) => path.IngressName) || []
+      );
+      const uniqueIngressNames = [...new Set(servicePathsIngressNames)];
+      return uniqueIngressNames.map((ingressName) => ({
+        action: 'Update',
+        kind: 'Ingress',
+        name: ingressName || '',
+      }));
+    }) || [];
+
+  // persistent volume claim (pvc) summaries
+  const pvcSummaries: Array<Summary> = getPVCSummaries(formValues);
+
+  // horizontal pod autoscaler summaries
+  const hpaSummary: Array<Summary> =
+    formValues.AutoScaler?.isUsed === true &&
+    formValues.DeploymentType !== 'Global'
+      ? [
+          {
+            action: 'Create',
+            kind: 'HorizontalPodAutoscaler',
+            name: formValues.Name,
+          },
+        ]
+      : [];
+
+  return [
+    appSummary,
+    ...serviceSummaries,
+    ...ingressesSummaries,
+    ...pvcSummaries,
+    ...hpaSummary,
+  ];
+}
+
+function getUpdatedApplicationResources(
+  newFormValues: ApplicationFormValues,
+  oldFormValues: ApplicationFormValues
+) {
+  // app summaries
+  const updateAppSummaries: Array<Summary> =
+    oldFormValues.ApplicationType !== newFormValues.ApplicationType
+      ? [
+          {
+            action: 'Delete',
+            kind: oldFormValues.ApplicationType,
+            name: oldFormValues.Name,
+          },
+          {
+            action: 'Create',
+            kind: newFormValues.ApplicationType,
+            name: newFormValues.Name,
+          },
+        ]
+      : [
+          {
+            action: 'Update',
+            kind: newFormValues.ApplicationType,
+            name: newFormValues.Name,
+          },
+        ];
+
+  // service summaries
+  const serviceSummaries: Array<Summary> = getServiceUpdateResourceSummary(
+    oldFormValues.Services,
+    newFormValues.Services
+  );
+
+  // ingress summaries
+  const oldServicePorts = oldFormValues.Services?.flatMap(
+    (service) => service.Ports
+  );
+  const oldIngresses = generateNewIngressesFromFormPaths(
+    oldFormValues.OriginalIngresses,
+    oldServicePorts,
+    oldServicePorts
+  );
+  const newServicePorts = newFormValues.Services?.flatMap(
+    (service) => service.Ports
+  );
+  const newIngresses = generateNewIngressesFromFormPaths(
+    newFormValues.OriginalIngresses,
+    newServicePorts,
+    oldServicePorts
+  );
+  const ingressSummaries = getIngressUpdateSummary(oldIngresses, newIngresses);
+
+  // persistent volume claim (pvc) summaries
+  const pvcSummaries: Array<Summary> = getPVCSummaries(
+    newFormValues,
+    oldFormValues
+  );
+
+  // TODO: horizontal pod autoscaler summaries
+  const createHPASummary: Array<Summary> =
+    newFormValues.AutoScaler?.isUsed && !oldFormValues.AutoScaler?.isUsed
+      ? [
+          {
+            action: 'Create',
+            kind: 'HorizontalPodAutoscaler',
+            name: newFormValues.Name,
+          },
+        ]
+      : [];
+  const deleteHPASummary: Array<Summary> =
+    !newFormValues.AutoScaler?.isUsed && oldFormValues.AutoScaler?.isUsed
+      ? [
+          {
+            action: 'Delete',
+            kind: 'HorizontalPodAutoscaler',
+            name: oldFormValues.Name,
+          },
+        ]
+      : [];
+  const isHPAUpdated =
+    newFormValues.AutoScaler?.isUsed &&
+    oldFormValues.AutoScaler?.isUsed &&
+    (newFormValues.AutoScaler?.minReplicas !==
+      oldFormValues.AutoScaler?.minReplicas ||
+      newFormValues.AutoScaler?.maxReplicas !==
+        oldFormValues.AutoScaler?.maxReplicas ||
+      newFormValues.AutoScaler?.targetCpuUtilizationPercentage !==
+        oldFormValues.AutoScaler?.targetCpuUtilizationPercentage);
+  const updateHPASummary: Array<Summary> = isHPAUpdated
+    ? [
+        {
+          action: 'Update',
+          kind: 'HorizontalPodAutoscaler',
+          name: newFormValues.Name,
+        },
+      ]
+    : [];
+  const hpaSummaries = [
+    ...createHPASummary,
+    ...deleteHPASummary,
+    ...updateHPASummary,
+  ];
+
+  return [
+    ...updateAppSummaries,
+    ...serviceSummaries,
+    ...ingressSummaries,
+    ...pvcSummaries,
+    ...hpaSummaries,
+  ];
+}
+
+function getPVCSummaries(
+  newFormValues: ApplicationFormValues,
+  oldFormValues?: ApplicationFormValues
+): Array<Summary> {
+  // only create pvc summaries for new pvcs
+  const newVolumeClaims =
+    newFormValues.PersistedFolders?.filter((volume) => {
+      // if the volume is an existing volume
+      if (volume.existingVolume?.PersistentVolumeClaim.Name) {
+        return false;
+      }
+      // to be sure the volume is new, check if it was in the old form values
+      const oldVolume = oldFormValues?.PersistedFolders?.find(
+        (oldVolume) =>
+          oldVolume.persistentVolumeClaimName ===
+          volume.persistentVolumeClaimName
+      );
+      if (oldVolume) {
+        return false;
+      }
+      return true;
+    }) || [];
+
+  if (newFormValues.DataAccessPolicy === 'Shared') {
+    return newVolumeClaims.map((newVolume) => {
+      const name =
+        newVolume.existingVolume?.PersistentVolumeClaim.Name ||
+        newVolume.persistentVolumeClaimName ||
+        '';
+      return {
+        action: 'Create',
+        kind: 'PersistentVolumeClaim',
+        name,
+      };
+    });
+  }
+
+  if (newFormValues.DataAccessPolicy === 'Isolated') {
+    // apps with a isolated data access policy are statefulsets.
+    // statefulset pvcs are defined in spec.volumeClaimTemplates.
+    // they aren't directly created with manifests, but are created when the statefulset is created (1 PVC PER POD), so should be included
+    // https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#stable-storage
+
+    // for each volume claim, there is a PVC created per pod
+    const newFormReplicas = newFormValues.ReplicaCount || 0;
+    const newPVCAppendedIndexStrings = Array.from(
+      { length: newFormReplicas },
+      (_, i) => i
+    );
+    const PVCSummariesFromNewVolumeClaims: Summary[] = newVolumeClaims.flatMap(
+      (volume) =>
+        newPVCAppendedIndexStrings.map((appendedIndex) => {
+          const prefixName =
+            volume.existingVolume?.PersistentVolumeClaim.Name ||
+            volume.persistentVolumeClaimName ||
+            '';
+          return {
+            action: 'Create',
+            kind: 'PersistentVolumeClaim',
+            // name in the same way that the statefulset would name it
+            name: `${prefixName}-${newFormValues.Name}-${appendedIndex}`,
+          };
+        })
+    );
+    // kubernetes blocks editing statefulset volume claims, so we don't need to handle updating them
+    return PVCSummariesFromNewVolumeClaims;
+  }
+
+  return [];
+}
+
+// getServiceUpdateResourceSummary replicates KubernetesServiceService.patch
+function getServiceUpdateResourceSummary(
+  oldServices?: Array<ServiceFormValues>,
+  newServices?: Array<ServiceFormValues>
+): Array<Summary> {
+  const updateAndCreateSummaries =
+    newServices?.flatMap<Summary>((newService) => {
+      const oldServiceMatched = oldServices?.find(
+        (oldService) => oldService.Name === newService.Name
+      );
+      if (oldServiceMatched) {
+        return getServiceUpdateSummary(oldServiceMatched, newService);
+      }
+      return [
+        {
+          action: 'Create',
+          kind: 'Service',
+          name: newService.Name || '',
+          type: newService.Type || 'ClusterIP',
+        },
+      ];
+    }) || [];
+
+  const deleteSummaries =
+    oldServices?.flatMap<Summary>((oldService) => {
+      const newServiceMatched = newServices?.find(
+        (newService) => newService.Name === oldService.Name
+      );
+      if (newServiceMatched) {
+        return [];
+      }
+      return [
+        {
+          action: 'Delete',
+          kind: 'Service',
+          name: oldService.Name || '',
+          type: oldService.Type || 'ClusterIP',
+        },
+      ];
+    }) || [];
+
+  return [...updateAndCreateSummaries, ...deleteSummaries];
+}
+
+function getServiceUpdateSummary(
+  oldService: ServiceFormValues,
+  newService: ServiceFormValues
+): Array<Summary> {
+  const payload = getServicePatchPayload(oldService, newService);
+  if (payload.length) {
+    return [
+      {
+        action: 'Update',
+        kind: 'Service',
+        name: oldService.Name || '',
+        type: oldService.Type || 'ClusterIP',
+      },
+    ];
+  }
+  return [];
+}
+
+export function getIngressUpdateSummary(
+  oldIngresses: Array<Ingress>,
+  newIngresses: Array<Ingress>
+): Array<Summary> {
+  const ingressesSummaries = newIngresses.flatMap((newIng) => {
+    const oldIng = oldIngresses.find((oldIng) => oldIng.Name === newIng.Name);
+    if (oldIng) {
+      return getIngressUpdateResourceSummary(oldIng, newIng);
+    }
+    return [];
+  });
+  return ingressesSummaries;
+}
+
+// getIngressUpdateResourceSummary checks if any ingress paths have been changed
+function getIngressUpdateResourceSummary(
+  oldIngress: Ingress,
+  newIngress: Ingress
+): Array<Summary> {
+  const newIngressPaths = newIngress.Paths?.flatMap((path) => path.Path) || [];
+  const oldIngressPaths = oldIngress.Paths?.flatMap((path) => path.Path) || [];
+  const isAnyNewPathMissingOldPath = newIngressPaths.some(
+    (path) => !oldIngressPaths.includes(path)
+  );
+  const isAnyOldPathMissingNewPath = oldIngressPaths.some(
+    (path) => !newIngressPaths.includes(path)
+  );
+  if (isAnyNewPathMissingOldPath || isAnyOldPathMissingNewPath) {
+    return [
+      {
+        action: 'Update',
+        kind: 'Ingress',
+        name: oldIngress.Name,
+      },
+    ];
+  }
+  return [];
+}
diff --git a/app/react/kubernetes/applications/components/AutoScalingFormSection/AutoScalingFormSection.tsx b/app/react/kubernetes/applications/components/AutoScalingFormSection/AutoScalingFormSection.tsx
new file mode 100644
index 0000000..16a0cd5
--- /dev/null
+++ b/app/react/kubernetes/applications/components/AutoScalingFormSection/AutoScalingFormSection.tsx
@@ -0,0 +1,152 @@
+import { FormikErrors } from 'formik';
+
+import { useIsEdgeAdmin } from '@/react/hooks/useUser';
+
+import { SwitchField } from '@@/form-components/SwitchField';
+import { Link } from '@@/Link';
+import { TextTip } from '@@/Tip/TextTip';
+import { Input } from '@@/form-components/Input';
+import { FormError } from '@@/form-components/FormError';
+import { Tooltip } from '@@/Tip/Tooltip';
+
+import { AutoScalingFormValues } from './types';
+
+type Props = {
+  values: AutoScalingFormValues;
+  onChange: (values: AutoScalingFormValues) => void;
+  errors: FormikErrors<AutoScalingFormValues>;
+  isMetricsEnabled: boolean;
+};
+
+export function AutoScalingFormSection({
+  values,
+  onChange,
+  errors,
+  isMetricsEnabled,
+}: Props) {
+  return (
+    <>
+      {!isMetricsEnabled && <NoMetricsServerWarning />}
+      <SwitchField
+        disabled={!isMetricsEnabled}
+        data-cy="k8sAppCreate-autoScaleSwitch"
+        label="Enable auto scaling for this application"
+        labelClass="col-sm-3 col-lg-2"
+        checked={values.isUsed}
+        onChange={(value: boolean) => {
+          // when enabling the auto scaler, set the default values
+          const newValues =
+            !values.isUsed && value
+              ? {
+                  minReplicas: 1,
+                  maxReplicas: 3,
+                  targetCpuUtilizationPercentage: 50,
+                }
+              : {};
+          onChange({
+            ...values,
+            ...newValues,
+            isUsed: value,
+          });
+        }}
+      />
+      {values.isUsed && (
+        <div className="my-3 grid w-full grid-cols-1 gap-x-4 gap-y-2 md:grid-cols-3">
+          <div className="flex min-w-fit flex-col">
+            <label htmlFor="min-instances" className="text-xs font-normal">
+              Minimum instances
+            </label>
+            <Input
+              id="min-instances"
+              type="number"
+              min="1"
+              value={values.minReplicas}
+              max={values.maxReplicas || 1}
+              onChange={(e) =>
+                onChange({
+                  ...values,
+                  minReplicas: e.target.valueAsNumber,
+                })
+              }
+              data-cy="k8sAppCreate-autoScaleMin"
+            />
+            {errors?.minReplicas && <FormError>{errors.minReplicas}</FormError>}
+          </div>
+          <div className="flex min-w-fit flex-col">
+            <label htmlFor="max-instances" className="text-xs font-normal">
+              Maximum instances
+            </label>
+            <Input
+              id="max-instances"
+              type="number"
+              value={values.maxReplicas}
+              min={values.minReplicas || 1}
+              onChange={(e) =>
+                onChange({
+                  ...values,
+                  maxReplicas: e.target.valueAsNumber,
+                })
+              }
+              data-cy="k8sAppCreate-autoScaleMax"
+            />
+            {errors?.maxReplicas && <FormError>{errors.maxReplicas}</FormError>}
+          </div>
+          <div className="flex min-w-fit flex-col">
+            <label
+              htmlFor="cpu-threshold"
+              className="flex items-center text-xs font-normal"
+            >
+              Target CPU usage (<b>%</b>)
+              <Tooltip message="The autoscaler will ensure enough instances are running to maintain an average CPU usage across all instances." />
+            </label>
+            <Input
+              id="cpu-threshold"
+              type="number"
+              value={values.targetCpuUtilizationPercentage}
+              min="1"
+              max="100"
+              onChange={(e) =>
+                onChange({
+                  ...values,
+                  targetCpuUtilizationPercentage: e.target.valueAsNumber,
+                })
+              }
+              data-cy="k8sAppCreate-targetCPUInput"
+            />
+            {errors?.targetCpuUtilizationPercentage && (
+              <FormError>{errors.targetCpuUtilizationPercentage}</FormError>
+            )}
+          </div>
+        </div>
+      )}
+    </>
+  );
+}
+
+function NoMetricsServerWarning() {
+  const isAdminQuery = useIsEdgeAdmin();
+  if (isAdminQuery.isLoading) {
+    return null;
+  }
+
+  const { isAdmin } = isAdminQuery;
+
+  return (
+    <TextTip color="orange">
+      {isAdmin && (
+        <>
+          Server metrics features must be enabled in the{' '}
+          <Link
+            to="kubernetes.cluster.setup"
+            data-cy="environment-configuration-view"
+          >
+            environment configuration view
+          </Link>
+          .
+        </>
+      )}
+      {!isAdmin &&
+        'This feature is currently disabled and must be enabled by an administrator user.'}
+    </TextTip>
+  );
+}
diff --git a/app/react/kubernetes/applications/components/AutoScalingFormSection/autoScalingValidation.ts b/app/react/kubernetes/applications/components/AutoScalingFormSection/autoScalingValidation.ts
new file mode 100644
index 0000000..e763c88
--- /dev/null
+++ b/app/react/kubernetes/applications/components/AutoScalingFormSection/autoScalingValidation.ts
@@ -0,0 +1,70 @@
+import { SchemaOf, boolean, number, object } from 'yup';
+
+import { nanNumberSchema } from '@/react-tools/yup-schemas';
+
+import { AutoScalingFormValues } from './types';
+
+type ValidationData = {
+  autoScalerOverflow: boolean;
+};
+
+export function autoScalingValidation(
+  validationData?: ValidationData
+): SchemaOf<AutoScalingFormValues> {
+  const { autoScalerOverflow } = validationData || {};
+  return object({
+    isUsed: boolean().required(),
+    minReplicas: number().when('isUsed', (isUsed: boolean) =>
+      isUsed
+        ? nanNumberSchema('Minimum instances is required.')
+            .required('Minimum instances is required.')
+            .min(1, 'Minimum instances must be greater than 0.')
+            .test(
+              'maxReplicas',
+              'Minimum instances must be less than maximum instances.',
+              // eslint-disable-next-line func-names
+              function (this, value?: number): boolean {
+                if (!value) {
+                  return true;
+                }
+                const { maxReplicas } = this.parent as AutoScalingFormValues;
+                return !maxReplicas || value < maxReplicas;
+              }
+            )
+        : number()
+    ),
+    maxReplicas: number().when('isUsed', (isUsed: boolean) =>
+      isUsed
+        ? nanNumberSchema('Maximum instances is required.')
+            .required('Maximum instances is required.')
+            .test(
+              'minReplicas',
+              'Maximum instances must be greater than minimum instances.',
+              // eslint-disable-next-line func-names
+              function (this, value?: number): boolean {
+                if (!value) {
+                  return false;
+                }
+                const { minReplicas } = this.parent as AutoScalingFormValues;
+                return !minReplicas || value > minReplicas;
+              }
+            )
+            .test(
+              'overflow',
+              'This application would exceed available resources. Please reduce the maximum instances or the resource reservations.',
+              () => !autoScalerOverflow
+            )
+        : number()
+    ),
+    targetCpuUtilizationPercentage: number().when(
+      'isUsed',
+      (isUsed: boolean) =>
+        isUsed
+          ? nanNumberSchema('Target CPU utilization percentage is required.')
+              .min(0, 'Target CPU usage must be greater than 0.')
+              .max(100, 'Target CPU usage must be smaller than 100.')
+              .required('Target CPU utilization percentage is required.')
+          : number()
+    ),
+  });
+}
diff --git a/app/react/kubernetes/applications/components/AutoScalingFormSection/index.ts b/app/react/kubernetes/applications/components/AutoScalingFormSection/index.ts
new file mode 100644
index 0000000..89d5874
--- /dev/null
+++ b/app/react/kubernetes/applications/components/AutoScalingFormSection/index.ts
@@ -0,0 +1,2 @@
+export { AutoScalingFormSection } from './AutoScalingFormSection';
+export { autoScalingValidation } from './autoScalingValidation';
diff --git a/app/react/kubernetes/applications/components/AutoScalingFormSection/types.ts b/app/react/kubernetes/applications/components/AutoScalingFormSection/types.ts
new file mode 100644
index 0000000..e53dc22
--- /dev/null
+++ b/app/react/kubernetes/applications/components/AutoScalingFormSection/types.ts
@@ -0,0 +1,6 @@
+export type AutoScalingFormValues = {
+  isUsed: boolean;
+  minReplicas?: number;
+  maxReplicas?: number;
+  targetCpuUtilizationPercentage?: number;
+};
diff --git a/app/react/kubernetes/applications/components/ConfigurationsFormSection/ConfigMapsFormSection.tsx b/app/react/kubernetes/applications/components/ConfigurationsFormSection/ConfigMapsFormSection.tsx
new file mode 100644
index 0000000..0376114
--- /dev/null
+++ b/app/react/kubernetes/applications/components/ConfigurationsFormSection/ConfigMapsFormSection.tsx
@@ -0,0 +1,81 @@
+import { FormikErrors } from 'formik';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useK8sConfigMaps } from '@/react/kubernetes/configs/queries/useK8sConfigMaps';
+
+import { FormSection } from '@@/form-components/FormSection/FormSection';
+import { TextTip } from '@@/Tip/TextTip';
+import { InputList } from '@@/form-components/InputList';
+import { InlineLoader } from '@@/InlineLoader';
+
+import { ConfigurationItem } from './ConfigurationItem';
+import { ConfigurationFormValues } from './types';
+
+type Props = {
+  values: ConfigurationFormValues[];
+  onChange: (values: ConfigurationFormValues[]) => void;
+  errors: FormikErrors<ConfigurationFormValues[]>;
+  namespace: string;
+};
+
+export function ConfigMapsFormSection({
+  values,
+  onChange,
+  errors,
+  namespace,
+}: Props) {
+  const configMapsQuery = useK8sConfigMaps(useEnvironmentId(), namespace);
+  const configMaps = configMapsQuery.data || [];
+
+  if (configMapsQuery.isLoading) {
+    return <InlineLoader>Loading ConfigMaps...</InlineLoader>;
+  }
+
+  return (
+    <FormSection title="ConfigMaps" titleSize="sm">
+      {!!values.length && (
+        <TextTip color="blue">
+          Portainer will automatically expose all the keys of a ConfigMap as
+          environment variables. This behavior can be overridden to filesystem
+          mounts for each key via the override option.
+        </TextTip>
+      )}
+
+      <InputList<ConfigurationFormValues>
+        value={values}
+        onChange={onChange}
+        errors={errors}
+        isDeleteButtonHidden
+        data-cy="k8sAppCreate-config"
+        disabled={configMaps.length === 0}
+        addButtonError={
+          configMaps.length === 0
+            ? 'There are no ConfigMaps available in this namespace.'
+            : undefined
+        }
+        renderItem={(item, onChange, index, error) => (
+          <ConfigurationItem
+            item={item}
+            onChange={onChange}
+            error={error}
+            configurations={configMaps}
+            onRemoveItem={() => onRemoveItem(index)}
+            index={index}
+            configurationType="ConfigMap"
+          />
+        )}
+        itemBuilder={() => ({
+          selectedConfigMap: configMaps[0]?.metadata?.name || '',
+          overriden: false,
+          overridenKeys: [],
+          selectedConfiguration: configMaps[0],
+        })}
+        addLabel="Add ConfigMap"
+      />
+    </FormSection>
+  );
+
+  function onRemoveItem(index: number) {
+    onChange(values.filter((_, i) => i !== index));
+  }
+}
diff --git a/app/react/kubernetes/applications/components/ConfigurationsFormSection/ConfigurationItem.tsx b/app/react/kubernetes/applications/components/ConfigurationsFormSection/ConfigurationItem.tsx
new file mode 100644
index 0000000..1a5e172
--- /dev/null
+++ b/app/react/kubernetes/applications/components/ConfigurationsFormSection/ConfigurationItem.tsx
@@ -0,0 +1,161 @@
+import clsx from 'clsx';
+import { List, RotateCw, Trash2 } from 'lucide-react';
+import { ConfigMap, Secret } from 'kubernetes-types/core/v1';
+import { SingleValue } from 'react-select';
+
+import { InputGroup } from '@@/form-components/InputGroup';
+import { Select } from '@@/form-components/ReactSelect';
+import { FormError } from '@@/form-components/FormError';
+import { ItemError } from '@@/form-components/InputList/InputList';
+import { isErrorType } from '@@/form-components/formikUtils';
+import { Button } from '@@/buttons';
+import { TextTip } from '@@/Tip/TextTip';
+
+import {
+  ConfigurationFormValues,
+  ConfigurationOverrideKey,
+  ConfigurationType,
+} from './types';
+import { ConfigurationData } from './ConfigurationKey';
+
+type Props = {
+  item: ConfigurationFormValues;
+  onChange: (values: ConfigurationFormValues) => void;
+  onRemoveItem: () => void;
+  configurations: Array<ConfigMap | Secret>;
+  index: number;
+  error?: ItemError<ConfigurationFormValues>;
+  configurationType: ConfigurationType;
+};
+
+export function ConfigurationItem({
+  item,
+  onChange,
+  error,
+  configurations,
+  index,
+  onRemoveItem,
+  configurationType,
+}: Props) {
+  // rule out the error being of type string
+  const formikError = isErrorType(error) ? error : undefined;
+  const configurationData = item.selectedConfiguration.data || {};
+
+  return (
+    <div className="flex flex-col gap-y-2">
+      <div className="flex items-start gap-x-2 gap-y-2">
+        <div>
+          <InputGroup size="small" className="min-w-[250px]">
+            <InputGroup.Addon>Name</InputGroup.Addon>
+            <Select
+              options={configurations}
+              isMulti={false}
+              getOptionLabel={(option) => option.metadata?.name || ''}
+              noOptionsMessage={() => 'No ConfigMaps found.'}
+              value={configurations.find(
+                (configuration) =>
+                  configuration.metadata?.name ===
+                  item.selectedConfiguration.metadata?.name
+              )}
+              onChange={onSelectConfigMap}
+              size="sm"
+              data-cy={`k8sAppCreate-add${configurationType}Select_${index}`}
+              id={`k8sAppCreate-add${configurationType}Select_${index}`}
+            />
+          </InputGroup>
+          {formikError?.selectedConfiguration && (
+            <FormError>{formikError?.selectedConfiguration}</FormError>
+          )}
+        </div>
+        <InputGroup size="small">
+          <InputGroup.ButtonWrapper>
+            <Button
+              color="light"
+              size="medium"
+              className={clsx('!ml-0', { active: !item.overriden })}
+              onClick={() => onToggleOverride(false)}
+              icon={RotateCw}
+              data-cy={`k8sAppCreate-add${configurationType}AutoButton_${index}`}
+            >
+              Auto
+            </Button>
+            <Button
+              color="light"
+              size="medium"
+              className={clsx('!ml-0 mr-1', { active: item.overriden })}
+              onClick={() => onToggleOverride(true)}
+              icon={List}
+              data-cy={`k8sAppCreate-add${configurationType}OverrideButton_${index}`}
+            >
+              Override
+            </Button>
+          </InputGroup.ButtonWrapper>
+        </InputGroup>
+        <Button
+          color="dangerlight"
+          size="medium"
+          onClick={onRemoveItem}
+          className="vertical-center btn-only-icon !ml-0"
+          icon={Trash2}
+          data-cy={`k8sAppCreate-remove${configurationType}Button_${index}`}
+        />
+      </div>
+      {!item.overriden && (
+        <TextTip color="blue">
+          The following keys will be loaded from the{' '}
+          <code>{item.selectedConfiguration.metadata?.name}</code>{' '}
+          {configurationType} as environment variables:
+          {Object.keys(configurationData).map((key, index) => (
+            <span key={key}>
+              <code>{key}</code>
+              {index < Object.keys(configurationData).length - 1 ? ', ' : ''}
+            </span>
+          ))}
+        </TextTip>
+      )}
+      {item.overriden &&
+        item.overridenKeys.map((overridenKey, keyIndex) => (
+          <ConfigurationData
+            key={overridenKey.key}
+            value={overridenKey}
+            onChange={(value: ConfigurationOverrideKey) => {
+              const newOverridenKeys = [...item.overridenKeys];
+              newOverridenKeys[keyIndex] = value;
+              onChange({ ...item, overridenKeys: newOverridenKeys });
+            }}
+            overrideKeysErrors={formikError?.overridenKeys}
+            configurationType={configurationType}
+            configurationIndex={index}
+            keyIndex={keyIndex}
+          />
+        ))}
+    </div>
+  );
+
+  function onSelectConfigMap(configMap: SingleValue<ConfigMap | Secret>) {
+    if (configMap) {
+      onChange({
+        ...item,
+        overriden: false,
+        selectedConfiguration: configMap,
+        overridenKeys: Object.keys(configMap.data || {}).map((key) => ({
+          key,
+          path: '',
+          type: 'NONE',
+        })),
+      });
+    }
+  }
+
+  function onToggleOverride(overriden: boolean) {
+    onChange({
+      ...item,
+      overriden,
+      overridenKeys: Object.keys(configurationData).map((key) => ({
+        key,
+        path: '',
+        type: overriden ? 'ENVIRONMENT' : 'NONE',
+      })),
+    });
+  }
+}
diff --git a/app/react/kubernetes/applications/components/ConfigurationsFormSection/ConfigurationKey.tsx b/app/react/kubernetes/applications/components/ConfigurationsFormSection/ConfigurationKey.tsx
new file mode 100644
index 0000000..fda31c3
--- /dev/null
+++ b/app/react/kubernetes/applications/components/ConfigurationsFormSection/ConfigurationKey.tsx
@@ -0,0 +1,101 @@
+import clsx from 'clsx';
+import { RotateCw, List } from 'lucide-react';
+import { FormikErrors } from 'formik';
+
+import { InputGroup } from '@@/form-components/InputGroup';
+import { Button } from '@@/buttons';
+import { FormError } from '@@/form-components/FormError';
+import { isArrayErrorType } from '@@/form-components/formikUtils';
+
+import { ConfigurationOverrideKey, ConfigurationType } from './types';
+
+type Props = {
+  value: ConfigurationOverrideKey;
+  onChange: (value: ConfigurationOverrideKey) => void;
+  configurationIndex: number;
+  keyIndex: number;
+  overrideKeysErrors?:
+    | string
+    | string[]
+    | FormikErrors<ConfigurationOverrideKey>[];
+  configurationType: ConfigurationType;
+};
+
+export function ConfigurationData({
+  value,
+  onChange,
+  overrideKeysErrors,
+  configurationIndex,
+  keyIndex,
+  configurationType,
+}: Props) {
+  const dataCyType = configurationType.toLowerCase();
+
+  // rule out the error (from formik) being of type string
+  const overriddenKeyError = isArrayErrorType(overrideKeysErrors)
+    ? overrideKeysErrors[keyIndex]
+    : undefined;
+  return (
+    <div className="flex flex-wrap items-start gap-x-2 gap-y-2">
+      <InputGroup size="small" className="min-w-[250px]">
+        <InputGroup.Addon>Key</InputGroup.Addon>
+        <InputGroup.Input
+          type="text"
+          value={value.key}
+          disabled
+          data-cy={`k8sAppCreate-${dataCyType}KeyInput_${configurationIndex}_${keyIndex}`}
+        />
+      </InputGroup>
+      <InputGroup size="small">
+        <InputGroup.ButtonWrapper>
+          <Button
+            color="light"
+            size="medium"
+            className={clsx('!ml-0', { active: value.type === 'ENVIRONMENT' })}
+            onClick={() =>
+              onChange({
+                ...value,
+                path: '',
+                type: 'ENVIRONMENT',
+              })
+            }
+            icon={RotateCw}
+            data-cy={`k8sAppCreate-${dataCyType}AutoButton_${configurationIndex}_${keyIndex}`}
+          >
+            Environment
+          </Button>
+          <Button
+            color="light"
+            size="medium"
+            className={clsx('!ml-0 mr-1', {
+              active: value.type === 'FILESYSTEM',
+            })}
+            onClick={() => onChange({ ...value, path: '', type: 'FILESYSTEM' })}
+            icon={List}
+            data-cy={`k8sAppCreate-${dataCyType}OverrideButton_${configurationIndex}_${keyIndex}`}
+          >
+            File system
+          </Button>
+        </InputGroup.ButtonWrapper>
+      </InputGroup>
+
+      {value.type === 'FILESYSTEM' && (
+        <div>
+          <InputGroup size="small" className="min-w-[250px]">
+            <InputGroup.Addon required>Path on disk</InputGroup.Addon>
+            <InputGroup.Input
+              type="text"
+              value={value.path}
+              placeholder="e.g. /etc/myapp/conf.d"
+              onChange={(e) => onChange({ ...value, path: e.target.value })}
+              data-cy={`k8sAppCreate-${dataCyType}PathOnDiskInput_${configurationIndex}_${keyIndex}`}
+            />
+          </InputGroup>
+          {overriddenKeyError?.path && (
+            <FormError>{overriddenKeyError.path}</FormError>
+          )}
+        </div>
+      )}
+    </div>
+  );
+}
diff --git a/app/react/kubernetes/applications/components/ConfigurationsFormSection/SecretsFormSection.tsx b/app/react/kubernetes/applications/components/ConfigurationsFormSection/SecretsFormSection.tsx
new file mode 100644
index 0000000..220b975
--- /dev/null
+++ b/app/react/kubernetes/applications/components/ConfigurationsFormSection/SecretsFormSection.tsx
@@ -0,0 +1,81 @@
+import { FormikErrors } from 'formik';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useK8sSecrets } from '@/react/kubernetes/configs/queries/useK8sSecrets';
+
+import { FormSection } from '@@/form-components/FormSection/FormSection';
+import { TextTip } from '@@/Tip/TextTip';
+import { InputList } from '@@/form-components/InputList';
+import { InlineLoader } from '@@/InlineLoader';
+
+import { ConfigurationItem } from './ConfigurationItem';
+import { ConfigurationFormValues } from './types';
+
+type Props = {
+  values: ConfigurationFormValues[];
+  onChange: (values: ConfigurationFormValues[]) => void;
+  errors: FormikErrors<ConfigurationFormValues[]>;
+  namespace: string;
+};
+
+export function SecretsFormSection({
+  values,
+  onChange,
+  errors,
+  namespace,
+}: Props) {
+  const secretsQuery = useK8sSecrets(useEnvironmentId(), namespace);
+  const secrets = secretsQuery.data || [];
+
+  if (secretsQuery.isLoading) {
+    return <InlineLoader>Loading Secrets...</InlineLoader>;
+  }
+
+  return (
+    <FormSection title="Secrets" titleSize="sm">
+      {!!values.length && (
+        <TextTip color="blue">
+          Portainer will automatically expose all the keys of a Secret as
+          environment variables. This behavior can be overridden to filesystem
+          mounts for each key via the override option.
+        </TextTip>
+      )}
+
+      <InputList<ConfigurationFormValues>
+        value={values}
+        onChange={onChange}
+        errors={errors}
+        isDeleteButtonHidden
+        data-cy="k8sAppCreate-secret"
+        disabled={secrets.length === 0}
+        addButtonError={
+          secrets.length === 0
+            ? 'There are no Secrets available in this namespace.'
+            : undefined
+        }
+        renderItem={(item, onChange, index, error) => (
+          <ConfigurationItem
+            item={item}
+            onChange={onChange}
+            error={error}
+            configurations={secrets}
+            onRemoveItem={() => onRemoveItem(index)}
+            index={index}
+            configurationType="Secret"
+          />
+        )}
+        itemBuilder={() => ({
+          selectedConfigMap: secrets[0]?.metadata?.name || '',
+          overriden: false,
+          overridenKeys: [],
+          selectedConfiguration: secrets[0],
+        })}
+        addLabel="Add Secret"
+      />
+    </FormSection>
+  );
+
+  function onRemoveItem(index: number) {
+    onChange(values.filter((_, i) => i !== index));
+  }
+}
diff --git a/app/react/kubernetes/applications/components/ConfigurationsFormSection/configurationValidationSchema.ts b/app/react/kubernetes/applications/components/ConfigurationsFormSection/configurationValidationSchema.ts
new file mode 100644
index 0000000..b64a7f4
--- /dev/null
+++ b/app/react/kubernetes/applications/components/ConfigurationsFormSection/configurationValidationSchema.ts
@@ -0,0 +1,40 @@
+import { SchemaOf, array, boolean, mixed, object, string } from 'yup';
+
+import { ConfigurationFormValues } from './types';
+
+export function configurationsValidationSchema(
+  validationData?: ConfigurationFormValues[]
+): SchemaOf<ConfigurationFormValues[]> {
+  return array(
+    object({
+      overriden: boolean().required(),
+      // skip validation for selectedConfiguration because it comes directly from a select dropdown
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      selectedConfiguration: object({} as any).required(),
+      overridenKeys: array(
+        object({
+          key: string().required(),
+          path: string().when('type', {
+            is: 'FILESYSTEM',
+            then: string()
+              .test(
+                'No duplicates globally',
+                'This path is already used.',
+                (path?: string) => {
+                  const allPaths = validationData
+                    ?.flatMap((configmap) => configmap.overridenKeys)
+                    .map((k) => k.path);
+                  if (!allPaths) return true;
+                  return (
+                    allPaths.filter((p) => p === path && p !== '').length <= 1
+                  );
+                }
+              )
+              .required('Path is required.'),
+          }),
+          type: mixed().oneOf(['NONE', 'ENVIRONMENT', 'FILESYSTEM']),
+        })
+      ).required(),
+    })
+  );
+}
diff --git a/app/react/kubernetes/applications/components/ConfigurationsFormSection/types.ts b/app/react/kubernetes/applications/components/ConfigurationsFormSection/types.ts
new file mode 100644
index 0000000..f21c7b5
--- /dev/null
+++ b/app/react/kubernetes/applications/components/ConfigurationsFormSection/types.ts
@@ -0,0 +1,17 @@
+import { ConfigMap, Secret } from 'kubernetes-types/core/v1';
+
+export type ConfigurationFormValues = {
+  overriden: boolean;
+  overridenKeys: ConfigurationOverrideKey[];
+  selectedConfiguration: ConfigMap | Secret;
+};
+
+export type ConfigurationOverrideKey = {
+  key: string;
+  type: ConfigurationOverrideKeyType;
+  path?: string;
+};
+
+export type ConfigurationType = 'ConfigMap' | 'Secret';
+
+type ConfigurationOverrideKeyType = 'NONE' | 'ENVIRONMENT' | 'FILESYSTEM';
diff --git a/app/react/kubernetes/applications/components/EditYamlFormSection.tsx b/app/react/kubernetes/applications/components/EditYamlFormSection.tsx
new file mode 100644
index 0000000..aeb3b97
--- /dev/null
+++ b/app/react/kubernetes/applications/components/EditYamlFormSection.tsx
@@ -0,0 +1,103 @@
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useEnvironmentDeploymentOptions } from '@/react/portainer/environments/queries/useEnvironment';
+import { useAuthorizations } from '@/react/hooks/useUser';
+
+import { WebEditorForm } from '@@/WebEditorForm';
+import { TextTip } from '@@/Tip/TextTip';
+
+type StackFileContent = string;
+
+type Props = {
+  values: StackFileContent;
+  onChange: (values: StackFileContent) => void;
+  isComposeFormat?: boolean;
+};
+
+export function EditYamlFormSection({
+  values,
+  onChange,
+  isComposeFormat,
+}: Props) {
+  // check if the user is allowed to edit the yaml
+  const environmentId = useEnvironmentId();
+  const { data: deploymentOptions } =
+    useEnvironmentDeploymentOptions(environmentId);
+  const { authorized: roleHasAuth } = useAuthorizations('K8sYAMLW');
+  const isAllowedToEdit = roleHasAuth && !deploymentOptions?.hideWebEditor;
+  const formId = 'kubernetes-deploy-editor';
+
+  return (
+    <div>
+      <WebEditorForm
+        data-cy="k8s-yaml-editor"
+        value={values}
+        readonly={!isAllowedToEdit}
+        titleContent={<TitleContent isComposeFormat={isComposeFormat} />}
+        onChange={(values) => onChange(values)}
+        id={formId}
+        textTip="Define or paste the content of your manifest file here"
+        type="yaml"
+      />
+    </div>
+  );
+}
+
+function TitleContent({ isComposeFormat }: { isComposeFormat?: boolean }) {
+  return (
+    <>
+      {isComposeFormat && (
+        <TextTip color="orange">
+          <p>
+            Portainer no longer supports{' '}
+            <a
+              href="https://docs.docker.com/compose/compose-file/"
+              target="_blank"
+              rel="noreferrer"
+            >
+              docker-compose
+            </a>{' '}
+            format manifests for Kubernetes deployments, and we have removed the{' '}
+            <a href="https://kompose.io/" target="_blank" rel="noreferrer">
+              Kompose
+            </a>{' '}
+            conversion tool which enables this. The reason for this is because
+            Kompose now poses a security risk, since it has a number of Common
+            Vulnerabilities and Exposures (CVEs).
+          </p>
+          <p>
+            Unfortunately, while the Kompose project has a maintainer and is
+            part of the CNCF, it is not being actively maintained. Releases are
+            very infrequent and new pull requests to the project (including ones
+            we&apos;ve submitted) are taking months to be merged, with new CVEs
+            arising in the meantime.
+          </p>
+          <p>
+            We advise installing your own instance of Kompose in a sandbox
+            environment, performing conversions of your Docker Compose files to
+            Kubernetes manifests and using those manifests to set up
+            applications.
+          </p>
+        </TextTip>
+      )}
+      {!isComposeFormat && (
+        <TextTip color="blue">
+          <p>
+            This feature allows you to deploy any kind of Kubernetes resource in
+            this environment (Deployment, Secret, ConfigMap...).
+          </p>
+          <p>
+            You can get more information about Kubernetes file format in the{' '}
+            <a
+              href="https://kubernetes.io/docs/concepts/overview/working-with-objects/kubernetes-objects/"
+              target="_blank"
+              rel="noreferrer"
+            >
+              official documentation
+            </a>
+            .
+          </p>
+        </TextTip>
+      )}
+    </>
+  );
+}
diff --git a/app/react/kubernetes/applications/components/EnvironmentVariablesFormSection/EnvironmentVariablesFormSection.tsx b/app/react/kubernetes/applications/components/EnvironmentVariablesFormSection/EnvironmentVariablesFormSection.tsx
new file mode 100644
index 0000000..6d83212
--- /dev/null
+++ b/app/react/kubernetes/applications/components/EnvironmentVariablesFormSection/EnvironmentVariablesFormSection.tsx
@@ -0,0 +1,30 @@
+import { FormSection } from '@@/form-components/FormSection';
+import {
+  EnvVarValues,
+  EnvironmentVariablesFieldset,
+} from '@@/form-components/EnvironmentVariablesFieldset';
+import { ArrayError } from '@@/form-components/InputList/InputList';
+
+type Props = {
+  values: EnvVarValues;
+  onChange(value: EnvVarValues): void;
+  errors?: ArrayError<EnvVarValues>;
+};
+
+export function EnvironmentVariablesFormSection({
+  values,
+  onChange,
+  errors,
+}: Props) {
+  return (
+    <FormSection title="Environment variables" titleSize="sm">
+      <div className="mb-4">
+        <EnvironmentVariablesFieldset
+          values={values}
+          onChange={onChange}
+          errors={errors}
+        />
+      </div>
+    </FormSection>
+  );
+}
diff --git a/app/react/kubernetes/applications/components/EnvironmentVariablesFormSection/kubeEnvVarValidationSchema.ts b/app/react/kubernetes/applications/components/EnvironmentVariablesFormSection/kubeEnvVarValidationSchema.ts
new file mode 100644
index 0000000..bd79548
--- /dev/null
+++ b/app/react/kubernetes/applications/components/EnvironmentVariablesFormSection/kubeEnvVarValidationSchema.ts
@@ -0,0 +1,27 @@
+import { SchemaOf, array, bool, object, string } from 'yup';
+
+import { EnvVar } from '@@/form-components/EnvironmentVariablesFieldset/types';
+import { buildUniquenessTest } from '@@/form-components/validate-unique';
+
+export function kubeEnvVarValidationSchema(): SchemaOf<EnvVar[]> {
+  return array(
+    object({
+      name: string()
+        .required('Environment variable name is required')
+        .matches(
+          /^[a-zA-Z][a-zA-Z0-9_.-]*$/,
+          `This field must consist of alphabetic characters, digits, '_', '-', or '.', and must not start with a digit (e.g. 'my.env-name', or 'MY_ENV.NAME', or 'MyEnvName1'`
+        ),
+      value: string().default(''),
+      needsDeletion: bool().default(false),
+      isNew: bool().default(false),
+    })
+  ).test(
+    'unique',
+    'This environment variable is already defined',
+    buildUniquenessTest(
+      () => 'This environment variable is already defined',
+      'name'
+    )
+  );
+}
diff --git a/app/react/kubernetes/applications/components/NameFormSection/NameFormSection.tsx b/app/react/kubernetes/applications/components/NameFormSection/NameFormSection.tsx
new file mode 100644
index 0000000..99c7ba7
--- /dev/null
+++ b/app/react/kubernetes/applications/components/NameFormSection/NameFormSection.tsx
@@ -0,0 +1,38 @@
+import { FormikErrors } from 'formik';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+
+type Props = {
+  onChange: (value: string) => void;
+  values: string;
+  errors: FormikErrors<string>;
+  isEdit: boolean;
+};
+
+export function NameFormSection({
+  onChange,
+  values: appName,
+  errors,
+  isEdit,
+}: Props) {
+  return (
+    <FormControl
+      label="Name"
+      inputId="application_name"
+      errors={errors}
+      required
+    >
+      <Input
+        type="text"
+        value={appName ?? ''}
+        onChange={(e) => onChange(e.target.value)}
+        autoFocus
+        placeholder="e.g. my-app"
+        disabled={isEdit}
+        id="application_name"
+        data-cy="k8sAppCreate-applicationName"
+      />
+    </FormControl>
+  );
+}
diff --git a/app/react/kubernetes/applications/components/NameFormSection/index.ts b/app/react/kubernetes/applications/components/NameFormSection/index.ts
new file mode 100644
index 0000000..31c7580
--- /dev/null
+++ b/app/react/kubernetes/applications/components/NameFormSection/index.ts
@@ -0,0 +1,2 @@
+export { NameFormSection } from './NameFormSection';
+export { appNameValidation } from './nameValidation';
diff --git a/app/react/kubernetes/applications/components/NameFormSection/nameValidation.ts b/app/react/kubernetes/applications/components/NameFormSection/nameValidation.ts
new file mode 100644
index 0000000..be9811e
--- /dev/null
+++ b/app/react/kubernetes/applications/components/NameFormSection/nameValidation.ts
@@ -0,0 +1,43 @@
+import { SchemaOf, string as yupString } from 'yup';
+
+type ValidationData = {
+  existingNames: string[];
+  isEdit: boolean;
+  originalName?: string;
+};
+
+export function appNameValidation(
+  validationData?: ValidationData
+): SchemaOf<string> {
+  return yupString()
+    .required('This field is required.')
+    .test(
+      'is-unique',
+      'An application with the same name already exists inside the selected namespace.',
+      (appName) => {
+        if (!validationData || !appName) {
+          return true;
+        }
+        // if creating, check if the name is unique
+        if (!validationData.isEdit) {
+          return !validationData.existingNames.includes(appName);
+        }
+        // if editing, the original name will be in the list of existing names
+        // remove it before checking if the name is unique
+        const updatedExistingNames = validationData.existingNames.filter(
+          (name) => name !== validationData.originalName
+        );
+        return !updatedExistingNames.includes(appName);
+      }
+    )
+    .test(
+      'is-valid',
+      "This field must consist of lower case alphanumeric characters or '-', contain at most 63 characters, start with an alphabetic character, and end with an alphanumeric character (e.g. 'my-name', or 'abc-123').",
+      (appName) => {
+        if (!appName) {
+          return true;
+        }
+        return /^[a-z]([a-z0-9-]{0,61}[a-z0-9])?$/g.test(appName);
+      }
+    );
+}
diff --git a/app/react/kubernetes/applications/components/NamespaceSelector/NamespaceSelector.test.tsx b/app/react/kubernetes/applications/components/NamespaceSelector/NamespaceSelector.test.tsx
new file mode 100644
index 0000000..b2f3968
--- /dev/null
+++ b/app/react/kubernetes/applications/components/NamespaceSelector/NamespaceSelector.test.tsx
@@ -0,0 +1,36 @@
+import { vi } from 'vitest';
+
+import { filterNamespaces } from '@/react/kubernetes/applications/components/NamespaceSelector/NamespaceSelector';
+
+const mockUseNamespacesQuery = vi.fn(() => ({
+  data: { 1: { Name: 'gamma' }, 2: { Name: 'alpha' }, 3: { Name: 'beta' } },
+  isLoading: false,
+}));
+
+const mockUseEnvironmentId = vi.fn(() => 1);
+
+vi.mock('@/react/kubernetes/namespaces/queries/useNamespacesQuery', () => ({
+  useNamespacesQuery: () => mockUseNamespacesQuery(),
+}));
+
+vi.mock('@/react/hooks/useEnvironmentId', () => ({
+  useEnvironmentId: () => mockUseEnvironmentId(),
+}));
+
+describe('CustomResourceDetailsView', () => {
+  it('renders the correct summary widget details for a custom resource', async () => {
+    const mockNamespaces = [
+      { Name: 'gamma', IsSystem: false },
+      { Name: 'alpha', IsSystem: false },
+      { Name: 'beta', IsSystem: false },
+    ];
+
+    const namespaceSelect = filterNamespaces(mockNamespaces);
+
+    expect(namespaceSelect).toStrictEqual([
+      { label: 'alpha', value: 'alpha' },
+      { label: 'beta', value: 'beta' },
+      { label: 'gamma', value: 'gamma' },
+    ]);
+  });
+});
diff --git a/app/react/kubernetes/applications/components/NamespaceSelector/NamespaceSelector.tsx b/app/react/kubernetes/applications/components/NamespaceSelector/NamespaceSelector.tsx
new file mode 100644
index 0000000..3d3b2e3
--- /dev/null
+++ b/app/react/kubernetes/applications/components/NamespaceSelector/NamespaceSelector.tsx
@@ -0,0 +1,60 @@
+import { FormikErrors } from 'formik';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useNamespacesQuery } from '@/react/kubernetes/namespaces/queries/useNamespacesQuery';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { PortainerSelect } from '@@/form-components/PortainerSelect';
+
+export function filterNamespaces(
+  namespaces: { IsSystem: boolean; Name: string }[] | undefined
+) {
+  return Object.values(namespaces ?? {})
+    .filter((ns) => !ns.IsSystem)
+    .map((ns) => ({
+      label: ns.Name,
+      value: ns.Name,
+    }))
+    .sort((a, b) => a.label.localeCompare(b.label));
+}
+
+type Props = {
+  onChange: (value: string) => void;
+  values: string;
+  errors: FormikErrors<string>;
+  isEdit: boolean;
+};
+
+export function NamespaceSelector({
+  values: value,
+  onChange,
+  errors,
+  isEdit,
+}: Props) {
+  const environmentId = useEnvironmentId();
+  const { data: namespaces, ...namespacesQuery } =
+    useNamespacesQuery(environmentId);
+  const namespaceNames = filterNamespaces(namespaces);
+
+  return (
+    <FormControl
+      label="Namespace"
+      inputId="namespace-selector"
+      isLoading={namespacesQuery.isLoading}
+      errors={errors}
+    >
+      {namespaceNames.length > 0 && (
+        <PortainerSelect
+          value={value}
+          options={namespaceNames}
+          onChange={onChange}
+          disabled={isEdit}
+          noOptionsMessage={() => 'No namespaces found'}
+          placeholder="No namespaces found" // will only show when there are no options
+          inputId="namespace-selector"
+          data-cy="k8sAppCreate-nsSelect"
+        />
+      )}
+    </FormControl>
+  );
+}
diff --git a/app/react/kubernetes/applications/components/NamespaceSelector/index.ts b/app/react/kubernetes/applications/components/NamespaceSelector/index.ts
new file mode 100644
index 0000000..574ce18
--- /dev/null
+++ b/app/react/kubernetes/applications/components/NamespaceSelector/index.ts
@@ -0,0 +1,2 @@
+export { NamespaceSelector } from './NamespaceSelector';
+export { namespaceSelectorValidation } from './namespaceSelectorValidation';
diff --git a/app/react/kubernetes/applications/components/NamespaceSelector/namespaceSelectorValidation.ts b/app/react/kubernetes/applications/components/NamespaceSelector/namespaceSelectorValidation.ts
new file mode 100644
index 0000000..d00b5cc
--- /dev/null
+++ b/app/react/kubernetes/applications/components/NamespaceSelector/namespaceSelectorValidation.ts
@@ -0,0 +1,38 @@
+import { SchemaOf, string } from 'yup';
+
+type ValidationData = {
+  hasQuota: boolean;
+  isResourceQuotaCapacityExceeded: boolean;
+  namespaceOptionCount: number;
+  isEnvironmentAdmin: boolean;
+};
+
+const emptyValue =
+  'You do not have access to any namespace. Contact your administrator to get access to a namespace.';
+
+export function namespaceSelectorValidation(
+  validationData?: ValidationData
+): SchemaOf<string> {
+  const {
+    hasQuota,
+    isResourceQuotaCapacityExceeded,
+    namespaceOptionCount,
+    isEnvironmentAdmin,
+  } = validationData || {};
+  return string()
+    .required(emptyValue)
+    .typeError(emptyValue)
+    .test(
+      'resourceQuotaCapacityExceeded',
+      `This namespace has exhausted its resource capacity and you will not be able to deploy the application.${
+        isEnvironmentAdmin
+          ? ''
+          : ' Contact your administrator to expand the capacity of the namespace.'
+      }`,
+      () => {
+        const hasQuotaExceeded = hasQuota && isResourceQuotaCapacityExceeded;
+        return !hasQuotaExceeded;
+      }
+    )
+    .test('namespaceOptionCount', emptyValue, () => !!namespaceOptionCount);
+}
diff --git a/app/react/kubernetes/applications/components/PersistedFoldersFormSection/PersistedFolderItem.tsx b/app/react/kubernetes/applications/components/PersistedFoldersFormSection/PersistedFolderItem.tsx
new file mode 100644
index 0000000..5e3353d
--- /dev/null
+++ b/app/react/kubernetes/applications/components/PersistedFoldersFormSection/PersistedFolderItem.tsx
@@ -0,0 +1,240 @@
+import clsx from 'clsx';
+
+import { StorageClass } from '@/react/portainer/environments/types';
+
+import { ItemError } from '@@/form-components/InputList/InputList';
+import { Option } from '@@/form-components/PortainerSelect';
+import { InputGroup } from '@@/form-components/InputGroup';
+import { Select } from '@@/form-components/ReactSelect';
+import { Input } from '@@/form-components/Input';
+import { isErrorType } from '@@/form-components/formikUtils';
+import { FormError } from '@@/form-components/FormError';
+import { ButtonSelector } from '@@/form-components/ButtonSelector/ButtonSelector';
+
+import { ApplicationFormValues } from '../../types';
+
+import { ExistingVolume, PersistedFolderFormValue } from './types';
+
+type Props = {
+  initialValues?: PersistedFolderFormValue[];
+  item: PersistedFolderFormValue;
+  onChange: (value: PersistedFolderFormValue) => void;
+  error: ItemError<PersistedFolderFormValue>;
+  storageClasses: StorageClass[];
+  index: number;
+  PVCOptions: Option<string>[];
+  availableVolumes: ExistingVolume[];
+  isEdit: boolean;
+  applicationValues: ApplicationFormValues;
+};
+
+export function PersistedFolderItem({
+  initialValues,
+  item,
+  onChange,
+  error,
+  storageClasses,
+  index,
+  PVCOptions,
+  availableVolumes,
+  isEdit,
+  applicationValues,
+}: Props) {
+  // rule out the error being of type string
+  const formikError = isErrorType(error) ? error : undefined;
+
+  return (
+    <div className="flex flex-wrap items-start gap-x-2 gap-y-2">
+      <div>
+        <InputGroup
+          size="small"
+          className={clsx('min-w-[250px]', item.needsDeletion && 'striked')}
+        >
+          <InputGroup.Addon required>Path in container</InputGroup.Addon>
+          <Input
+            type="text"
+            placeholder="e.g. /data"
+            disabled={
+              (isEdit && isExistingPersistedFolder()) ||
+              applicationValues.Containers.length > 1
+            }
+            value={item.containerPath}
+            onChange={(e) =>
+              onChange({
+                ...item,
+                containerPath: e.target.value,
+              })
+            }
+            data-cy={`k8sAppCreate-containerPathInput_${index}`}
+          />
+        </InputGroup>
+        {formikError?.containerPath && (
+          <FormError>{formikError?.containerPath}</FormError>
+        )}
+      </div>
+      {isToggleVolumeTypeVisible() && (
+        <ButtonSelector<boolean>
+          onChange={(isNewVolume) =>
+            onChange({
+              ...item,
+              useNewVolume: isNewVolume,
+              size: isNewVolume ? item.size : '',
+              existingVolume: isNewVolume ? undefined : availableVolumes[0],
+            })
+          }
+          value={item.useNewVolume}
+          options={[
+            { value: true, label: 'New volume' },
+            {
+              value: false,
+              label: 'Existing volume',
+              disabled: PVCOptions.length === 0,
+            },
+          ]}
+        />
+      )}
+      {item.useNewVolume && (
+        <>
+          <div>
+            <InputGroup
+              size="small"
+              className={clsx(
+                'flex min-w-fit',
+                item.needsDeletion && 'striked'
+              )}
+            >
+              <InputGroup.Addon className="min-w-fit" required>
+                Requested size
+              </InputGroup.Addon>
+              <Input
+                className="-mr-[1px] !w-20 !rounded-none"
+                type="number"
+                placeholder="e.g. 20"
+                min="0"
+                disabled={
+                  (isEdit && isExistingPersistedFolder()) ||
+                  applicationValues.Containers.length > 1
+                }
+                value={item.size}
+                onChange={(e) =>
+                  onChange({
+                    ...item,
+                    size: e.target.value,
+                  })
+                }
+                data-cy={`k8sAppCreate-persistentFolderSizeInput_${index}`}
+              />
+              <Select<Option<string>>
+                size="sm"
+                className="min-w-fit"
+                options={[
+                  { label: 'MB', value: 'MB' },
+                  { label: 'GB', value: 'GB' },
+                  { label: 'TB', value: 'TB' },
+                ]}
+                value={{
+                  label: item.sizeUnit ?? '',
+                  value: item.sizeUnit ?? '',
+                }}
+                onChange={(option) =>
+                  onChange({ ...item, sizeUnit: option?.value ?? 'GB' })
+                }
+                isDisabled={
+                  (isEdit && isExistingPersistedFolder()) ||
+                  applicationValues.Containers.length > 1
+                }
+                data-cy={`k8sAppCreate-persistentFolderSizeUnitSelect_${index}`}
+                id={`k8sAppCreate-persistentFolderSizeUnitSelect_${index}`}
+              />
+            </InputGroup>
+            {formikError?.size && <FormError>{formikError?.size}</FormError>}
+          </div>
+          <InputGroup
+            size="small"
+            className={clsx(item.needsDeletion && 'striked')}
+          >
+            <InputGroup.Addon>Storage</InputGroup.Addon>
+            <Select<Option<string>>
+              className="w-40"
+              size="sm"
+              options={storageClasses.map((sc) => ({
+                label: sc.Name,
+                value: sc.Name,
+              }))}
+              value={getStorageClassValue(storageClasses, item)}
+              onChange={(option) =>
+                onChange({
+                  ...item,
+                  storageClass:
+                    storageClasses.find((sc) => sc.Name === option?.value) ??
+                    storageClasses[0],
+                })
+              }
+              isDisabled={
+                (isEdit && isExistingPersistedFolder()) ||
+                applicationValues.Containers.length > 1 ||
+                storageClasses.length <= 1
+              }
+              data-cy={`k8sAppCreate-storageSelect_${index}`}
+              id={`k8sAppCreate-storageSelect_${index}`}
+            />
+          </InputGroup>
+        </>
+      )}
+      {!item.useNewVolume && (
+        <InputGroup
+          size="small"
+          className={clsx(item.needsDeletion && 'striked')}
+        >
+          <InputGroup.Addon>Volume</InputGroup.Addon>
+          <Select<Option<string>>
+            className="w-[440px]"
+            size="sm"
+            options={PVCOptions}
+            value={PVCOptions.find(
+              (pvc) => pvc.value === item.persistentVolumeClaimName
+            )}
+            onChange={(option) =>
+              onChange({
+                ...item,
+                persistentVolumeClaimName: option?.value,
+                existingVolume: availableVolumes.find(
+                  (pvc) => pvc.PersistentVolumeClaim.Name === option?.value
+                ),
+              })
+            }
+            isDisabled={
+              (isEdit && isExistingPersistedFolder()) ||
+              applicationValues.Containers.length > 1 ||
+              availableVolumes.length < 1
+            }
+            data-cy={`k8sAppCreate-pvcSelect_${index}`}
+            id={`k8sAppCreate-pvcSelect_${index}`}
+          />
+        </InputGroup>
+      )}
+    </div>
+  );
+
+  function isExistingPersistedFolder() {
+    return !!initialValues?.[index]?.persistentVolumeClaimName;
+  }
+
+  function isToggleVolumeTypeVisible() {
+    return (
+      !(isEdit && isExistingPersistedFolder()) && // if it's not an edit of an existing persisted folder
+      applicationValues.Containers.length <= 1 // and if there is only one container);
+    );
+  }
+}
+
+function getStorageClassValue(
+  storageClasses: StorageClass[],
+  persistedFolder: PersistedFolderFormValue
+) {
+  const matchingClass =
+    storageClasses.find(
+      (sc) => sc.Name === persistedFolder.storageClass?.Name
+    ) ?? storageClasses[0];
+  return { label: matchingClass?.Name, value: matchingClass?.Name };
+}
diff --git a/app/react/kubernetes/applications/components/PersistedFoldersFormSection/PersistedFoldersFormSection.tsx b/app/react/kubernetes/applications/components/PersistedFoldersFormSection/PersistedFoldersFormSection.tsx
new file mode 100644
index 0000000..5581ed4
--- /dev/null
+++ b/app/react/kubernetes/applications/components/PersistedFoldersFormSection/PersistedFoldersFormSection.tsx
@@ -0,0 +1,121 @@
+import { FormikErrors } from 'formik';
+import { useMemo } from 'react';
+import uuidv4 from 'uuid/v4';
+
+import { useCurrentEnvironment } from '@/react/hooks/useCurrentEnvironment';
+import { StorageClass } from '@/react/portainer/environments/types';
+
+import { Option } from '@@/form-components/PortainerSelect';
+import { InlineLoader } from '@@/InlineLoader';
+import { FormSection } from '@@/form-components/FormSection';
+import { InputList } from '@@/form-components/InputList';
+import { TextTip } from '@@/Tip/TextTip';
+
+import { ApplicationFormValues } from '../../types';
+
+import { ExistingVolume, PersistedFolderFormValue } from './types';
+import { PersistedFolderItem } from './PersistedFolderItem';
+
+type Props = {
+  values: PersistedFolderFormValue[];
+  initialValues: PersistedFolderFormValue[];
+  onChange: (values: PersistedFolderFormValue[]) => void;
+  errors: FormikErrors<PersistedFolderFormValue[]>;
+  isAddPersistentFolderButtonShown: unknown;
+  isEdit: boolean;
+  applicationValues: ApplicationFormValues;
+  availableVolumes: ExistingVolume[];
+};
+
+export function PersistedFoldersFormSection({
+  values,
+  initialValues,
+  onChange,
+  errors,
+  isAddPersistentFolderButtonShown,
+  isEdit,
+  applicationValues,
+  availableVolumes,
+}: Props) {
+  const environmentQuery = useCurrentEnvironment();
+  const storageClasses =
+    environmentQuery.data?.Kubernetes.Configuration.StorageClasses ?? [];
+  const PVCOptions = usePVCOptions(availableVolumes);
+
+  return (
+    <FormSection title="Persisted folders" titleSize="sm">
+      {storageClasses.length === 0 && (
+        <TextTip color="blue">
+          No storage option is available to persist data, contact your
+          administrator to enable a storage option.
+        </TextTip>
+      )}
+      {environmentQuery.isLoading && (
+        <InlineLoader>Loading volumes...</InlineLoader>
+      )}
+      <InputList<PersistedFolderFormValue>
+        value={values}
+        onChange={onChange}
+        errors={errors}
+        isDeleteButtonHidden={
+          isEdit && applicationValues.ApplicationType === 'StatefulSet'
+        }
+        canUndoDelete={isEdit}
+        data-cy="k8sAppCreate-persistentFolder"
+        disabled={storageClasses.length === 0}
+        addButtonError={getAddButtonError(storageClasses)}
+        isAddButtonHidden={!isAddPersistentFolderButtonShown}
+        renderItem={(item, onChange, index, error) => (
+          <PersistedFolderItem
+            item={item}
+            onChange={onChange}
+            error={error}
+            PVCOptions={PVCOptions}
+            availableVolumes={availableVolumes}
+            storageClasses={storageClasses ?? []}
+            index={index}
+            isEdit={isEdit}
+            applicationValues={applicationValues}
+            initialValues={initialValues}
+          />
+        )}
+        itemBuilder={() => ({
+          persistentVolumeClaimName: getNewPVCName(applicationValues.Name),
+          containerPath: '',
+          size: '',
+          sizeUnit: 'GB',
+          storageClass: storageClasses[0],
+          useNewVolume: true,
+          existingVolume: undefined,
+          needsDeletion: false,
+        })}
+        addLabel="Add persisted folder"
+      />
+    </FormSection>
+  );
+}
+
+function usePVCOptions(existingPVCs: ExistingVolume[]): Option<string>[] {
+  return useMemo(
+    () =>
+      existingPVCs.map((pvc) => ({
+        label: pvc.PersistentVolumeClaim.Name ?? '',
+        value: pvc.PersistentVolumeClaim.Name ?? '',
+      })),
+    [existingPVCs]
+  );
+}
+
+function getAddButtonError(storageClasses: StorageClass[]) {
+  if (storageClasses.length === 0) {
+    return 'No storage option available';
+  }
+  return '';
+}
+
+function getNewPVCName(applicationName: string) {
+  const name = `${applicationName}-${uuidv4()}`;
+  // limit it to 63 characters to avoid exceeding the limit for the volume name
+  const nameLimited = name.length > 63 ? name.substring(0, 63) : name;
+  return nameLimited;
+}
diff --git a/app/react/kubernetes/applications/components/PersistedFoldersFormSection/index.ts b/app/react/kubernetes/applications/components/PersistedFoldersFormSection/index.ts
new file mode 100644
index 0000000..40fae47
--- /dev/null
+++ b/app/react/kubernetes/applications/components/PersistedFoldersFormSection/index.ts
@@ -0,0 +1 @@
+export { PersistedFoldersFormSection } from './PersistedFoldersFormSection';
diff --git a/app/react/kubernetes/applications/components/PersistedFoldersFormSection/persistedFoldersValidation.ts b/app/react/kubernetes/applications/components/PersistedFoldersFormSection/persistedFoldersValidation.ts
new file mode 100644
index 0000000..e814a5b
--- /dev/null
+++ b/app/react/kubernetes/applications/components/PersistedFoldersFormSection/persistedFoldersValidation.ts
@@ -0,0 +1,112 @@
+import { SchemaOf, array, boolean, object, string } from 'yup';
+import filesizeParser from 'filesize-parser';
+import _ from 'lodash';
+
+import { StorageClass } from '@/react/portainer/environments/types';
+
+import { buildUniquenessTest } from '@@/form-components/validate-unique';
+
+import { ExistingVolume, PersistedFolderFormValue } from './types';
+
+type FormData = {
+  namespaceQuotas: unknown;
+  persistedFolders: PersistedFolderFormValue[];
+  storageAvailabilities: Record<string, number>;
+};
+
+export function persistedFoldersValidation(
+  formData?: FormData
+): SchemaOf<PersistedFolderFormValue[]> {
+  return array(
+    object({
+      persistentVolumeClaimName: string(),
+      containerPath: string().required('Path is required.'),
+      size: string().when('useNewVolume', {
+        is: true,
+        then: string()
+          .test(
+            'quotaExceeded',
+            'Requested size exceeds available quota for this storage class.',
+            function quotaExceeded(this) {
+              const persistedFolderFormValue = this
+                .parent as PersistedFolderFormValue;
+              const quota = formData?.namespaceQuotas;
+              let quotaExceeded = false;
+              if (quota) {
+                const pfs = formData?.persistedFolders;
+                const groups = _.groupBy(pfs, 'storageClass.Name');
+                _.forOwn(groups, (storagePfs, storageClassName) => {
+                  if (
+                    storageClassName ===
+                    persistedFolderFormValue.storageClass.Name
+                  ) {
+                    const newPfs = _.filter(storagePfs, {
+                      persistentVolumeClaimName: '',
+                    });
+                    const requestedSize = _.reduce(
+                      newPfs,
+                      (sum, pf) =>
+                        pf.useNewVolume && pf.size
+                          ? sum +
+                            filesizeParser(`${pf.size}${pf.sizeUnit}`, {
+                              base: 10,
+                            })
+                          : sum,
+                      0
+                    );
+                    if (
+                      formData?.storageAvailabilities[storageClassName] <
+                      requestedSize
+                    ) {
+                      quotaExceeded = true;
+                    }
+                  }
+                });
+              }
+              return !quotaExceeded;
+            }
+          )
+          .required('Size is required.'),
+      }),
+      sizeUnit: string().when('useNewVolume', {
+        is: true,
+        then: string().required('Size unit is required.'),
+      }),
+      storageClass: storageClassValidation(),
+      useNewVolume: boolean().required(),
+      existingVolume: existingVolumeValidation().nullable(),
+      needsDeletion: boolean(),
+    })
+  ).test(
+    'containerPath',
+    'This path is already defined.',
+    buildUniquenessTest(() => 'This path is already defined.', 'containerPath')
+  );
+}
+
+function storageClassValidation(): SchemaOf<StorageClass> {
+  return object({
+    Name: string().required(),
+    AccessModes: array(string().required()).required(),
+    AllowVolumeExpansion: boolean().required(),
+    Provisioner: string().required(),
+  });
+}
+
+function existingVolumeValidation(): SchemaOf<ExistingVolume> {
+  return object({
+    PersistentVolumeClaim: object({
+      Id: string().required(),
+      Name: string().required(),
+      Namespace: string().required(),
+      Storage: string().required(),
+      storageClass: storageClassValidation(),
+      CreationDate: string().required(),
+      ApplicationOwner: string(),
+      ApplicationName: string(),
+      PreviousName: string(),
+      MountPath: string(),
+      Yaml: string(),
+    }),
+  });
+}
diff --git a/app/react/kubernetes/applications/components/PersistedFoldersFormSection/types.ts b/app/react/kubernetes/applications/components/PersistedFoldersFormSection/types.ts
new file mode 100644
index 0000000..ba728f4
--- /dev/null
+++ b/app/react/kubernetes/applications/components/PersistedFoldersFormSection/types.ts
@@ -0,0 +1,28 @@
+import { StorageClass } from '@/react/portainer/environments/types';
+
+export type PersistedFolderFormValue = {
+  containerPath: string;
+  storageClass: StorageClass;
+  useNewVolume: boolean;
+  persistentVolumeClaimName?: string; // empty for new volumes, set for existing volumes
+  sizeUnit?: string;
+  size?: string;
+  existingVolume?: ExistingVolume;
+  needsDeletion?: boolean;
+};
+
+export type ExistingVolume = {
+  PersistentVolumeClaim: {
+    Id: string;
+    Name: string;
+    Namespace: string;
+    Storage: string;
+    storageClass: StorageClass;
+    CreationDate: string;
+    ApplicationOwner?: string;
+    ApplicationName?: string;
+    PreviousName?: string;
+    MountPath?: string;
+    Yaml?: string;
+  };
+};
diff --git a/app/react/kubernetes/applications/components/PlacementFormSection/PlacementFormSection.tsx b/app/react/kubernetes/applications/components/PlacementFormSection/PlacementFormSection.tsx
new file mode 100644
index 0000000..d1f72d8
--- /dev/null
+++ b/app/react/kubernetes/applications/components/PlacementFormSection/PlacementFormSection.tsx
@@ -0,0 +1,145 @@
+import { FormikErrors } from 'formik';
+import { useMemo } from 'react';
+
+import { useNodesQuery } from '@/react/kubernetes/cluster/queries/useNodesQuery';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+
+import { FormSection } from '@@/form-components/FormSection';
+import { TextTip } from '@@/Tip/TextTip';
+import { InputList } from '@@/form-components/InputList';
+
+import { PlacementsFormValues, NodeLabels, Placement } from './types';
+import { PlacementItem } from './PlacementItem';
+import { PlacementTypeBoxSelector } from './PlacementTypeBoxSelector';
+
+type Props = {
+  values: PlacementsFormValues;
+  onChange: (values: PlacementsFormValues) => void;
+  errors?: FormikErrors<PlacementsFormValues>;
+};
+
+export function PlacementFormSection({ values, onChange, errors }: Props) {
+  // node labels are all of the unique node labels across all nodes
+  const nodesLabels = useNodeLabels();
+  // available node labels are the node labels that are not already in use by a placement
+  const availableNodeLabels = useAvailableNodeLabels(
+    nodesLabels,
+    values.placements
+  );
+  const firstAvailableNodeLabel = Object.keys(availableNodeLabels)[0] || '';
+  const firstAvailableNodeLabelValue =
+    availableNodeLabels[firstAvailableNodeLabel]?.[0] || '';
+  const nonDeletedPlacements = values.placements.filter(
+    (placement) => !placement.needsDeletion
+  );
+
+  return (
+    <div className="flex flex-col">
+      <FormSection title="Placement preferences and constraints" titleSize="sm">
+        {values.placements?.length > 0 && (
+          <TextTip color="blue">
+            Deploy this application on nodes that respect <b>ALL</b> of the
+            following placement rules. Placement rules are based on node labels.
+          </TextTip>
+        )}
+        <InputList<Placement>
+          value={values.placements}
+          onChange={(placements) => onChange({ ...values, placements })}
+          renderItem={(item, onChange, index, error) => (
+            <PlacementItem
+              item={item}
+              onChange={onChange}
+              error={error}
+              index={index}
+              nodesLabels={nodesLabels}
+              availableNodeLabels={availableNodeLabels}
+            />
+          )}
+          itemBuilder={() => ({
+            label: firstAvailableNodeLabel,
+            value: firstAvailableNodeLabelValue,
+            needsDeletion: false,
+          })}
+          errors={errors?.placements}
+          addLabel="Add rule"
+          canUndoDelete
+          data-cy="k8sAppCreate-placement"
+          disabled={Object.keys(availableNodeLabels).length === 0}
+          addButtonError={
+            Object.keys(availableNodeLabels).length === 0
+              ? 'There are no node labels available to add.'
+              : ''
+          }
+        />
+      </FormSection>
+      {nonDeletedPlacements.length >= 1 && (
+        <FormSection
+          title="Placement policy"
+          titleSize="sm"
+          titleClassName="control-label !text-[0.9em]"
+        >
+          <TextTip color="blue">
+            Specify the policy associated to the placement rules.
+          </TextTip>
+          <PlacementTypeBoxSelector
+            placementType={values.placementType}
+            onChange={(placementType) => onChange({ ...values, placementType })}
+          />
+        </FormSection>
+      )}
+    </div>
+  );
+}
+
+function useAvailableNodeLabels(
+  nodeLabels: NodeLabels,
+  placements: Placement[]
+): NodeLabels {
+  return useMemo(() => {
+    const existingPlacementLabels = placements.map(
+      (placement) => placement.label
+    );
+    const availableNodeLabels = Object.keys(nodeLabels).filter(
+      (label) => !existingPlacementLabels.includes(label)
+    );
+    return availableNodeLabels.reduce((acc, label) => {
+      acc[label] = nodeLabels[label];
+      return acc;
+    }, {} as NodeLabels);
+  }, [nodeLabels, placements]);
+}
+
+function useNodeLabels(): NodeLabels {
+  const environmentId = useEnvironmentId();
+  const { data: nodes } = useNodesQuery(environmentId);
+
+  // all node label pairs (some might have the same key but different values)
+  const nodeLabelPairs =
+    nodes?.flatMap((node) =>
+      Object.entries(node.metadata?.labels || {}).map(([k, v]) => ({
+        key: k,
+        value: v,
+      }))
+    ) || [];
+
+  // create a NodeLabels object with each label key's possible values, without duplicate keys or values. e.g. { 'beta.kubernetes.io/arch': ['amd64', 'arm64'] }
+  // in multinode clusters, there can be multiple nodes with the same label key
+  const allNodesLabels = nodeLabelPairs.map((pair) => pair.key);
+  const uniqueNodesLabels = new Set(allNodesLabels);
+  const nodesLabels: NodeLabels = Array.from(uniqueNodesLabels).reduce(
+    (acc: NodeLabels, key) => {
+      // get all possible values for a given node label key
+      const allNodeValuesForKey = nodeLabelPairs
+        .filter((pair) => pair.key === key)
+        .map((pair) => pair.value);
+      // in multinode clusters, there can be duplicate values for a given key, so remove them
+      const uniqueValues = Array.from(new Set(allNodeValuesForKey));
+
+      acc[key] = uniqueValues;
+      return acc;
+    },
+    {} as NodeLabels
+  );
+
+  return nodesLabels;
+}
diff --git a/app/react/kubernetes/applications/components/PlacementFormSection/PlacementItem.tsx b/app/react/kubernetes/applications/components/PlacementFormSection/PlacementItem.tsx
new file mode 100644
index 0000000..e5cf3e1
--- /dev/null
+++ b/app/react/kubernetes/applications/components/PlacementFormSection/PlacementItem.tsx
@@ -0,0 +1,78 @@
+import clsx from 'clsx';
+
+import { ItemProps } from '@@/form-components/InputList';
+import { Select } from '@@/form-components/ReactSelect';
+import { isErrorType } from '@@/form-components/formikUtils';
+import { FormError } from '@@/form-components/FormError';
+
+import { NodeLabels, Placement } from './types';
+
+interface PlacementItemProps extends ItemProps<Placement> {
+  nodesLabels: NodeLabels;
+  availableNodeLabels: NodeLabels;
+}
+
+export function PlacementItem({
+  onChange,
+  item,
+  error,
+  index,
+  nodesLabels,
+  availableNodeLabels,
+}: PlacementItemProps) {
+  const labelOptions = Object.keys(availableNodeLabels).map((label) => ({
+    label,
+    value: label,
+  }));
+  const valueOptions = nodesLabels[item.label]?.map((value) => ({
+    label: value,
+    value,
+  }));
+  const placementError = isErrorType(error) ? error : undefined;
+  return (
+    <div className="w-full">
+      <div className="flex w-full gap-2">
+        <div className="grow basis-1/2">
+          <Select
+            options={labelOptions}
+            value={{ label: item.label, value: item.label }}
+            noOptionsMessage={() => 'No available node labels.'}
+            onChange={(labelOption) => {
+              const newValues = nodesLabels[labelOption?.value || ''];
+              onChange({
+                ...item,
+                value: newValues?.[0] || '',
+                label: labelOption?.value || '',
+              });
+            }}
+            size="sm"
+            className={clsx({ striked: !!item.needsDeletion })}
+            isDisabled={!!item.needsDeletion}
+            data-cy={`k8sAppCreate-placementLabel_${index}`}
+            id={`k8sAppCreate-placementLabel_${index}`}
+          />
+          {placementError?.label && (
+            <FormError>{placementError.label}</FormError>
+          )}
+        </div>
+        <div className="grow basis-1/2">
+          <Select
+            options={valueOptions}
+            value={valueOptions?.find((option) => option.value === item.value)}
+            onChange={(valueOption) =>
+              onChange({ ...item, value: valueOption?.value || '' })
+            }
+            size="sm"
+            className={clsx({ striked: !!item.needsDeletion })}
+            isDisabled={!!item.needsDeletion}
+            data-cy={`k8sAppCreate-placementName_${index}`}
+            id={`k8sAppCreate-placementName_${index}`}
+          />
+          {placementError?.value && (
+            <FormError>{placementError.value}</FormError>
+          )}
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/kubernetes/applications/components/PlacementFormSection/PlacementTypeBoxSelector.tsx b/app/react/kubernetes/applications/components/PlacementFormSection/PlacementTypeBoxSelector.tsx
new file mode 100644
index 0000000..381e5fd
--- /dev/null
+++ b/app/react/kubernetes/applications/components/PlacementFormSection/PlacementTypeBoxSelector.tsx
@@ -0,0 +1,48 @@
+import { Sliders, AlignJustify } from 'lucide-react';
+
+import { BoxSelector, BoxSelectorOption } from '@@/BoxSelector';
+
+import { PlacementType } from './types';
+
+type Props = {
+  placementType: PlacementType;
+  onChange: (placementType: PlacementType) => void;
+};
+
+export const placementOptions: ReadonlyArray<BoxSelectorOption<PlacementType>> =
+  [
+    {
+      id: 'placement_hard',
+      value: 'mandatory',
+      icon: Sliders,
+      iconType: 'badge',
+      label: 'Mandatory',
+      description: (
+        <>
+          Schedule this application <b>ONLY</b> on nodes that match <b>ALL</b>{' '}
+          Rules
+        </>
+      ),
+    },
+    {
+      id: 'placement_soft',
+      value: 'preferred',
+      icon: AlignJustify,
+      iconType: 'badge',
+      label: 'Preferred',
+      description:
+        'Schedule this application on nodes that match the rules if possible',
+    },
+  ] as const;
+
+export function PlacementTypeBoxSelector({ placementType, onChange }: Props) {
+  return (
+    <BoxSelector<PlacementType>
+      value={placementType}
+      options={placementOptions}
+      onChange={(placementType) => onChange(placementType)}
+      radioName="placementType"
+      slim
+    />
+  );
+}
diff --git a/app/react/kubernetes/applications/components/PlacementFormSection/index.ts b/app/react/kubernetes/applications/components/PlacementFormSection/index.ts
new file mode 100644
index 0000000..fd63566
--- /dev/null
+++ b/app/react/kubernetes/applications/components/PlacementFormSection/index.ts
@@ -0,0 +1,2 @@
+export { PlacementFormSection } from './PlacementFormSection';
+export { placementsValidation as placementValidation } from './placementValidation';
diff --git a/app/react/kubernetes/applications/components/PlacementFormSection/placementValidation.ts b/app/react/kubernetes/applications/components/PlacementFormSection/placementValidation.ts
new file mode 100644
index 0000000..52e98ed
--- /dev/null
+++ b/app/react/kubernetes/applications/components/PlacementFormSection/placementValidation.ts
@@ -0,0 +1,16 @@
+import { SchemaOf, array, boolean, mixed, object, string } from 'yup';
+
+import { PlacementsFormValues } from './types';
+
+export function placementsValidation(): SchemaOf<PlacementsFormValues> {
+  return object({
+    placementType: mixed().oneOf(['mandatory', 'preferred']).required(),
+    placements: array(
+      object({
+        label: string().required('Node label is required.'),
+        value: string().required('Node value is required.'),
+        needsDeletion: boolean(),
+      }).required()
+    ),
+  });
+}
diff --git a/app/react/kubernetes/applications/components/PlacementFormSection/types.ts b/app/react/kubernetes/applications/components/PlacementFormSection/types.ts
new file mode 100644
index 0000000..ef8ab0f
--- /dev/null
+++ b/app/react/kubernetes/applications/components/PlacementFormSection/types.ts
@@ -0,0 +1,14 @@
+export type Placement = {
+  label: string;
+  value: string;
+  needsDeletion?: boolean;
+};
+
+export type PlacementType = 'mandatory' | 'preferred';
+
+export type PlacementsFormValues = {
+  placementType: PlacementType;
+  placements: Placement[];
+};
+
+export type NodeLabels = Record<string, string[]>;
diff --git a/app/react/kubernetes/applications/components/ReplicationFormSection/ReplicationFormSection.tsx b/app/react/kubernetes/applications/components/ReplicationFormSection/ReplicationFormSection.tsx
new file mode 100644
index 0000000..c1075ce
--- /dev/null
+++ b/app/react/kubernetes/applications/components/ReplicationFormSection/ReplicationFormSection.tsx
@@ -0,0 +1,60 @@
+import { FormikErrors } from 'formik';
+import { round } from 'lodash';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+import { TextTip } from '@@/Tip/TextTip';
+
+import { ReplicaCountFormValues } from './types';
+
+type Props = {
+  values: ReplicaCountFormValues;
+  onChange: (values: ReplicaCountFormValues) => void;
+  errors: FormikErrors<ReplicaCountFormValues>;
+  cpuLimit: number;
+  memoryLimit: number;
+  resourceReservationsOverflow: boolean;
+  supportScalableReplicaDeployment: boolean;
+};
+
+export function ReplicationFormSection({
+  values,
+  onChange,
+  errors,
+  supportScalableReplicaDeployment,
+  cpuLimit,
+  memoryLimit,
+  resourceReservationsOverflow,
+}: Props) {
+  const hasResourceLimit = cpuLimit !== 0 || memoryLimit !== 0;
+
+  return (
+    <>
+      <FormControl
+        label="Instance count"
+        required
+        errors={errors?.replicaCount}
+      >
+        <Input
+          type="number"
+          min="0"
+          max="9999"
+          value={values.replicaCount}
+          disabled={!supportScalableReplicaDeployment}
+          onChange={(e) => onChange({ replicaCount: e.target.valueAsNumber })}
+          className="w-1/4"
+          data-cy="k8sAppCreate-replicaCountInput"
+        />
+      </FormControl>
+      {!resourceReservationsOverflow &&
+        values.replicaCount > 1 &&
+        hasResourceLimit && (
+          <TextTip color="blue">
+            This application will reserve the following resources:{' '}
+            <b>{round(cpuLimit * values.replicaCount, 2)} CPU</b> and{' '}
+            <b>{memoryLimit * values.replicaCount} MB</b> of memory.
+          </TextTip>
+        )}
+    </>
+  );
+}
diff --git a/app/react/kubernetes/applications/components/ReplicationFormSection/index.ts b/app/react/kubernetes/applications/components/ReplicationFormSection/index.ts
new file mode 100644
index 0000000..318f6a0
--- /dev/null
+++ b/app/react/kubernetes/applications/components/ReplicationFormSection/index.ts
@@ -0,0 +1,2 @@
+export { ReplicationFormSection } from './ReplicationFormSection';
+export { replicationValidation } from './replicationValidation';
diff --git a/app/react/kubernetes/applications/components/ReplicationFormSection/replicationValidation.ts b/app/react/kubernetes/applications/components/ReplicationFormSection/replicationValidation.ts
new file mode 100644
index 0000000..6818401
--- /dev/null
+++ b/app/react/kubernetes/applications/components/ReplicationFormSection/replicationValidation.ts
@@ -0,0 +1,54 @@
+import { SchemaOf, object } from 'yup';
+
+import { nanNumberSchema } from '@/react-tools/yup-schemas';
+
+import { ReplicaCountFormValues } from './types';
+
+type ValidationData = {
+  resourceReservationsOverflow: boolean;
+  quotaExceeded: boolean;
+  nonScalableStorage: string;
+  supportScalableReplicaDeployment: boolean;
+};
+
+export function replicationValidation(
+  validationData?: ValidationData
+): SchemaOf<ReplicaCountFormValues> {
+  const {
+    resourceReservationsOverflow,
+    quotaExceeded,
+    nonScalableStorage,
+    supportScalableReplicaDeployment,
+  } = validationData || {};
+  return object({
+    replicaCount: nanNumberSchema('Instance count is required')
+      .min(0, 'Instance count must be greater than or equal to 0.')
+      .test(
+        'overflow',
+        'This application would exceed available resources. Please review resource reservations or the instance count.',
+        (value) => {
+          // the user can't fix the error here with 1 replica. There are validation errors in the resource reservations section that are helpful in a case of resourceReservationsOverflow.
+          if (value === 1) {
+            return true;
+          }
+          return !resourceReservationsOverflow;
+        }
+      )
+      .test(
+        'quota',
+        'This application would exceed available storage. Please review the persisted folders or the instance count.',
+        () => !quotaExceeded // must not have quota exceeded
+      )
+      .test(
+        'scalable',
+        `The following storage option(s) do not support concurrent access from multiples instances: ${nonScalableStorage}. You will not be able to scale that application.`,
+        (value) => {
+          if (!value || value <= 1) {
+            return true;
+          }
+          return !!supportScalableReplicaDeployment;
+        } // must have support scalable replica deployment
+      )
+      .required('Instance count is required.'),
+  });
+}
diff --git a/app/react/kubernetes/applications/components/ReplicationFormSection/types.ts b/app/react/kubernetes/applications/components/ReplicationFormSection/types.ts
new file mode 100644
index 0000000..87179fe
--- /dev/null
+++ b/app/react/kubernetes/applications/components/ReplicationFormSection/types.ts
@@ -0,0 +1,3 @@
+export type ReplicaCountFormValues = {
+  replicaCount: number;
+};
diff --git a/app/react/kubernetes/applications/components/ResourceReservationFormSection/ResourceReservationFormSection.tsx b/app/react/kubernetes/applications/components/ResourceReservationFormSection/ResourceReservationFormSection.tsx
new file mode 100644
index 0000000..52fe734
--- /dev/null
+++ b/app/react/kubernetes/applications/components/ResourceReservationFormSection/ResourceReservationFormSection.tsx
@@ -0,0 +1,101 @@
+import { FormikErrors } from 'formik';
+
+import { FormSection } from '@@/form-components/FormSection';
+import { TextTip } from '@@/Tip/TextTip';
+import { SliderWithInput } from '@@/form-components/Slider/SliderWithInput';
+import { FormControl } from '@@/form-components/FormControl';
+import { FormError } from '@@/form-components/FormError';
+import { Slider } from '@@/form-components/Slider';
+
+import { ResourceQuotaFormValues } from './types';
+
+type Props = {
+  values: ResourceQuotaFormValues;
+  onChange: (values: ResourceQuotaFormValues) => void;
+  errors: FormikErrors<ResourceQuotaFormValues>;
+  namespaceHasQuota: boolean;
+  resourceQuotaCapacityExceeded: boolean;
+  minMemoryLimit: number;
+  minCpuLimit: number;
+  maxMemoryLimit: number;
+  maxCpuLimit: number;
+};
+
+export function ResourceReservationFormSection({
+  values,
+  onChange,
+  errors,
+  namespaceHasQuota,
+  resourceQuotaCapacityExceeded,
+  minMemoryLimit,
+  minCpuLimit,
+  maxMemoryLimit,
+  maxCpuLimit,
+}: Props) {
+  return (
+    <FormSection title="Resource reservations" titleSize="md">
+      {!namespaceHasQuota && (
+        <TextTip color="blue">
+          Resource reservations are applied per instance of the application.
+        </TextTip>
+      )}
+      {namespaceHasQuota && !resourceQuotaCapacityExceeded && (
+        <TextTip color="blue">
+          A resource quota is set on this namespace, you must specify resource
+          reservations. Resource reservations are applied per instance of the
+          application. Maximums are inherited from the namespace quota.
+        </TextTip>
+      )}
+      <FormControl
+        className="flex flex-row"
+        label="Memory limit (MB)"
+        tooltip="An instance of this application will reserve this amount of memory. If the instance memory usage exceeds the reservation, it might be subject to OOM."
+      >
+        <div className="col-xs-10">
+          {maxMemoryLimit > 0 && (
+            <SliderWithInput
+              value={Number(values.memoryLimit) || 0}
+              onChange={(value) => onChange({ ...values, memoryLimit: value })}
+              min={minMemoryLimit}
+              max={maxMemoryLimit}
+              step={128}
+              dataCy="k8sAppCreate-memoryLimit"
+              visibleTooltip
+            />
+          )}
+          {errors?.memoryLimit && (
+            <FormError className="pt-1">{errors.memoryLimit}</FormError>
+          )}
+        </div>
+      </FormControl>
+      <FormControl
+        className="flex flex-row"
+        label="CPU limit"
+        tooltip="An instance of this application will reserve this amount of CPU. If the instance CPU usage exceeds the reservation, it might be subject to CPU throttling."
+      >
+        <div className="col-xs-10">
+          {maxCpuLimit > 0 && (
+            <Slider
+              onChange={(value) =>
+                onChange(
+                  typeof value === 'number'
+                    ? { ...values, cpuLimit: value }
+                    : { ...values, cpuLimit: value[0] ?? 0 }
+                )
+              }
+              value={values.cpuLimit}
+              min={minCpuLimit}
+              max={maxCpuLimit}
+              step={0.1}
+              dataCy="k8sAppCreate-cpuLimitSlider"
+              visibleTooltip
+            />
+          )}
+          {errors?.cpuLimit && (
+            <FormError className="pt-1">{errors.cpuLimit}</FormError>
+          )}
+        </div>
+      </FormControl>
+    </FormSection>
+  );
+}
diff --git a/app/react/kubernetes/applications/components/ResourceReservationFormSection/index.ts b/app/react/kubernetes/applications/components/ResourceReservationFormSection/index.ts
new file mode 100644
index 0000000..7aa4471
--- /dev/null
+++ b/app/react/kubernetes/applications/components/ResourceReservationFormSection/index.ts
@@ -0,0 +1,2 @@
+export { ResourceReservationFormSection } from './ResourceReservationFormSection';
+export { resourceReservationValidation } from './resourceReservationValidation';
diff --git a/app/react/kubernetes/applications/components/ResourceReservationFormSection/resourceReservationValidation.ts b/app/react/kubernetes/applications/components/ResourceReservationFormSection/resourceReservationValidation.ts
new file mode 100644
index 0000000..1abc32b
--- /dev/null
+++ b/app/react/kubernetes/applications/components/ResourceReservationFormSection/resourceReservationValidation.ts
@@ -0,0 +1,121 @@
+import { SchemaOf, TestContext, number, object } from 'yup';
+
+import KubernetesResourceReservationHelper from '@/kubernetes/helpers/resourceReservationHelper';
+import { nanNumberSchema } from '@/react-tools/yup-schemas';
+
+import { ResourceQuotaFormValues } from './types';
+
+type NodeLimit = {
+  CPU: number;
+  Memory: number;
+};
+
+type NodesLimits = Record<string, NodeLimit>;
+
+type ValidationData = {
+  maxMemoryLimit: number;
+  maxCpuLimit: number;
+  isEnvironmentAdmin: boolean;
+  nodeLimits: NodesLimits;
+  isExistingCPUReservationUnchanged: boolean;
+  isExistingMemoryReservationUnchanged: boolean;
+};
+
+export function resourceReservationValidation(
+  validationData?: ValidationData
+): SchemaOf<ResourceQuotaFormValues> {
+  return object().shape({
+    memoryLimit: nanNumberSchema('Memory limit is required.')
+      .min(0, 'Value must be greater than or equal to 0.')
+      .test(
+        'exhaused',
+        `The memory capacity for this namespace has been exhausted, so you cannot deploy the application.${
+          validationData?.isEnvironmentAdmin
+            ? ''
+            : ' Contact your administrator to expand the memory capacity of the namespace.'
+        }`,
+        () => !!validationData && validationData.maxMemoryLimit > 0
+      )
+      .max(validationData?.maxMemoryLimit || 0, ({ value }) =>
+        // when the existing reservation is unchanged and exceeds the new limit, show a different error message
+        // https://portainer.atlassian.net/browse/EE-5933?focusedCommentId=29308
+        validationData?.isExistingMemoryReservationUnchanged
+          ? `Value must be between 0 and ${validationData?.maxMemoryLimit}MB now - the previous value of ${value} exceeds this.`
+          : `Value must be between 0 and ${validationData?.maxMemoryLimit}MB.`
+      )
+      .test(
+        'hasSuitableNode',
+        `These reservations would exceed the resources currently available in the cluster.`,
+        (value: number | undefined, context: TestContext) => {
+          if (!validationData || value === undefined) {
+            // explicitely check for undefined, since 0 is a valid value
+            return true;
+          }
+          const { memoryLimit, cpuLimit } = context.parent;
+          return hasSuitableNode(
+            memoryLimit,
+            cpuLimit,
+            validationData.nodeLimits
+          );
+        }
+      )
+      .required('Memory limit is required.'),
+    cpuLimit: number()
+      .min(0)
+      .test(
+        'exhaused',
+        `The CPU capacity for this namespace has been exhausted, so you cannot deploy the application.${
+          validationData?.isEnvironmentAdmin
+            ? ''
+            : ' Contact your administrator to expand the CPU capacity of the namespace.'
+        }`,
+        () => !!validationData && validationData.maxCpuLimit > 0
+      )
+      .max(validationData?.maxCpuLimit || 0, ({ value }) =>
+        // when the existing reservation is unchanged and exceeds the new limit, show a different error message
+        // https://portainer.atlassian.net/browse/EE-5933?focusedCommentId=29308
+        validationData?.isExistingCPUReservationUnchanged
+          ? `Value must be between 0 and ${validationData?.maxCpuLimit} now - the previous value of ${value} exceeds this.`
+          : `Value must be between 0 and ${validationData?.maxCpuLimit}.`
+      )
+      .test(
+        'hasSuitableNode',
+        `These reservations would exceed the resources currently available in the cluster.`,
+        (value: number | undefined, context: TestContext) => {
+          if (!validationData || value === undefined) {
+            // explicitely check for undefined, since 0 is a valid value
+            return true;
+          }
+          const { memoryLimit, cpuLimit } = context.parent;
+          return hasSuitableNode(
+            memoryLimit,
+            cpuLimit,
+            validationData.nodeLimits
+          );
+        }
+      )
+      .required(),
+  });
+}
+
+function hasSuitableNode(
+  memoryLimit: number,
+  cpuLimit: number,
+  nodeLimits: NodesLimits
+) {
+  const nanParsedMemoryLimit = Number.isNaN(memoryLimit) ? 0 : memoryLimit;
+  const nanParsedCPULimit = Number.isNaN(cpuLimit) ? 0 : cpuLimit;
+  // transform the nodelimits from bytes to MB
+  const limits = Object.values(nodeLimits).map((nodeLimit) => ({
+    ...nodeLimit,
+    Memory: KubernetesResourceReservationHelper.megaBytesValue(
+      nodeLimit.Memory
+    ),
+  }));
+  // make sure there's a node available with enough memory and cpu
+  return limits.some(
+    (nodeLimit) =>
+      nodeLimit.Memory >= nanParsedMemoryLimit &&
+      nodeLimit.CPU >= nanParsedCPULimit
+  );
+}
diff --git a/app/react/kubernetes/applications/components/ResourceReservationFormSection/types.ts b/app/react/kubernetes/applications/components/ResourceReservationFormSection/types.ts
new file mode 100644
index 0000000..21a414d
--- /dev/null
+++ b/app/react/kubernetes/applications/components/ResourceReservationFormSection/types.ts
@@ -0,0 +1,4 @@
+export type ResourceQuotaFormValues = {
+  memoryLimit: number;
+  cpuLimit: number;
+};
diff --git a/app/react/kubernetes/applications/constants.ts b/app/react/kubernetes/applications/constants.ts
new file mode 100644
index 0000000..66bc265
--- /dev/null
+++ b/app/react/kubernetes/applications/constants.ts
@@ -0,0 +1,39 @@
+import { AppKind, DeploymentType } from './types';
+
+// Portainer specific labels
+export const appStackNameLabel = 'io.portainer.kubernetes.application.stack';
+export const appStackIdLabel = 'io.portainer.kubernetes.application.stackid';
+export const appStackKindLabel =
+  'io.portainer.kubernetes.application.stackKind';
+export const appOwnerLabel = 'io.portainer.kubernetes.application.owner';
+export const appNoteAnnotation = 'io.portainer.kubernetes.application.note';
+export const appDeployMethodLabel = 'io.portainer.kubernetes.application.kind';
+export const defaultDeploymentUniqueLabel = 'pod-template-hash';
+export const appNameLabel = 'io.portainer.kubernetes.application.name';
+export const PodKubernetesInstanceLabel = 'app.kubernetes.io/instance';
+export const PodManagedByLabel = 'app.kubernetes.io/managed-by';
+export const HelmReleaseNameAnnotation = 'meta.helm.sh/release-name';
+
+export const appRevisionAnnotation = 'deployment.kubernetes.io/revision';
+
+// unchangedAnnotationKeysForRollbackPatch lists the annotations that should be preserved from the deployment and not
+// copied from the replicaset when rolling a deployment back
+export const unchangedAnnotationKeysForRollbackPatch = [
+  'kubectl.kubernetes.io/last-applied-configuration',
+  appRevisionAnnotation,
+  'deployment.kubernetes.io/revision-history',
+  'deployment.kubernetes.io/desired-replicas',
+  'deployment.kubernetes.io/max-replicas',
+  'deprecated.deployment.rollback.to',
+  'deprecated.daemonset.template.generation',
+];
+
+export const appKindToDeploymentTypeMap: Record<
+  AppKind,
+  DeploymentType | null
+> = {
+  Deployment: 'Replicated',
+  StatefulSet: 'Replicated',
+  DaemonSet: 'Global',
+  Pod: null,
+} as const;
diff --git a/app/react/kubernetes/applications/queries/getPods.ts b/app/react/kubernetes/applications/queries/getPods.ts
new file mode 100644
index 0000000..4e870a2
--- /dev/null
+++ b/app/react/kubernetes/applications/queries/getPods.ts
@@ -0,0 +1,37 @@
+import { Pod, PodList } from 'kubernetes-types/core/v1';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios from '@/portainer/services/axios/axios';
+
+import { parseKubernetesAxiosError } from '../../axiosError';
+
+export async function getPods(
+  environmentId: EnvironmentId,
+  namespace: string,
+  labelSelector?: string
+) {
+  try {
+    const { data } = await axios.get<PodList>(
+      `/endpoints/${environmentId}/kubernetes/api/v1/namespaces/${namespace}/pods`,
+      {
+        params: {
+          labelSelector,
+        },
+      }
+    );
+    const items = (data.items || []).map(
+      (pod) =>
+        <Pod>{
+          ...pod,
+          kind: 'Pod',
+          apiVersion: data.apiVersion,
+        }
+    );
+    return items;
+  } catch (e) {
+    throw parseKubernetesAxiosError(
+      e,
+      `Unable to retrieve Pods in namespace '${namespace}'`
+    );
+  }
+}
diff --git a/app/react/kubernetes/applications/queries/query-keys.ts b/app/react/kubernetes/applications/queries/query-keys.ts
new file mode 100644
index 0000000..7175eb3
--- /dev/null
+++ b/app/react/kubernetes/applications/queries/query-keys.ts
@@ -0,0 +1,106 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+export type GetAppsParams = {
+  namespace?: string;
+  nodeName?: string;
+};
+
+export const queryKeys = {
+  applications: (environmentId: EnvironmentId, params?: GetAppsParams) =>
+    [
+      'environments',
+      environmentId,
+      'kubernetes',
+      'applications',
+      params,
+    ] as const,
+  application: (
+    environmentId: EnvironmentId,
+    namespace: string,
+    name: string,
+    yaml?: boolean
+  ) =>
+    [
+      'environments',
+      environmentId,
+      'kubernetes',
+      'applications',
+      namespace,
+      name,
+      yaml,
+    ] as const,
+  applicationRevisions: (
+    environmentId: EnvironmentId,
+    namespace: string,
+    name: string,
+    labelSelector?: string
+  ) =>
+    [
+      'environments',
+      environmentId,
+      'kubernetes',
+      'applications',
+      namespace,
+      name,
+      'revisions',
+      labelSelector,
+    ] as const,
+  applicationServices: (
+    environmentId: EnvironmentId,
+    namespace: string,
+    name: string
+  ) =>
+    [
+      'environments',
+      environmentId,
+      'kubernetes',
+      'applications',
+      namespace,
+      name,
+      'services',
+    ] as const,
+  ingressesForApplication: (
+    environmentId: EnvironmentId,
+    namespace: string,
+    name: string
+  ) =>
+    [
+      'environments',
+      environmentId,
+      'kubernetes',
+      'applications',
+      namespace,
+      name,
+      'ingresses',
+    ] as const,
+  applicationHorizontalPodAutoscalers: (
+    environmentId: EnvironmentId,
+    namespace: string,
+    name: string
+  ) =>
+    [
+      'environments',
+      environmentId,
+      'kubernetes',
+      'applications',
+      namespace,
+      name,
+      'horizontalpodautoscalers',
+    ] as const,
+  applicationPods: (
+    environmentId: EnvironmentId,
+    namespace: string,
+    name: string
+  ) =>
+    [
+      'environments',
+      environmentId,
+      'kubernetes',
+      'applications',
+      namespace,
+      name,
+      'pods',
+    ] as const,
+  appStackFile: (id?: number, kind?: string) =>
+    ['app-stack-file', id, kind] as const,
+};
diff --git a/app/react/kubernetes/applications/queries/useAppStackFile.test.tsx b/app/react/kubernetes/applications/queries/useAppStackFile.test.tsx
new file mode 100644
index 0000000..cc22042
--- /dev/null
+++ b/app/react/kubernetes/applications/queries/useAppStackFile.test.tsx
@@ -0,0 +1,79 @@
+import { renderHook } from '@testing-library/react-hooks';
+import { waitFor } from '@testing-library/react';
+import { describe, it, expect, beforeEach } from 'vitest';
+import { HttpResponse } from 'msw';
+
+import { server, http } from '@/setup-tests/server';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { suppressConsoleLogs } from '@/setup-tests/suppress-console';
+
+import { useAppStackFile } from './useAppStackFile';
+
+function renderQueryHook(
+  id: number | undefined,
+  kind: 'edge' | 'compose' | 'kubernetes'
+) {
+  return renderHook(() => useAppStackFile({ id, kind }), {
+    wrapper: withTestQueryProvider(({ children }) => <>{children}</>),
+  });
+}
+
+describe('useAppStackFile', () => {
+  beforeEach(() => {
+    server.resetHandlers();
+  });
+
+  it('should return undefined when id is not provided', async () => {
+    const { result } = renderQueryHook(undefined, 'kubernetes');
+
+    await waitFor(() => {
+      expect(result.current.data).toBeUndefined();
+    });
+  });
+
+  it('should fetch regular stack file', async () => {
+    const mockContent = 'version: "3.8"\nservices:\n  web:\n    image: nginx';
+
+    server.use(
+      http.get('/api/stacks/456/file', () =>
+        HttpResponse.json({ StackFileContent: mockContent })
+      )
+    );
+
+    const { result } = renderQueryHook(456, 'kubernetes');
+
+    await waitFor(() => {
+      expect(result.current.isSuccess).toBe(true);
+    });
+
+    expect(result.current.data).toBe(mockContent);
+  });
+
+  it('should handle fetch error for regular stack', async () => {
+    const restoreConsole = suppressConsoleLogs();
+    server.use(
+      http.get('/api/stacks/999/file', () =>
+        HttpResponse.json({ message: 'Stack not found' }, { status: 404 })
+      )
+    );
+
+    const { result } = renderQueryHook(999, 'kubernetes');
+
+    await waitFor(() => {
+      expect(result.current.isError).toBe(true);
+    });
+
+    restoreConsole();
+  });
+
+  it('should not fetch when query is disabled', async () => {
+    const { result } = renderQueryHook(undefined, 'kubernetes');
+
+    // Wait a bit to ensure no fetch happens
+    await new Promise((resolve) => {
+      setTimeout(resolve, 100);
+    });
+
+    expect(result.current.data).toBeUndefined();
+  });
+});
diff --git a/app/react/kubernetes/applications/queries/useAppStackFile.ts b/app/react/kubernetes/applications/queries/useAppStackFile.ts
new file mode 100644
index 0000000..c9f1aae
--- /dev/null
+++ b/app/react/kubernetes/applications/queries/useAppStackFile.ts
@@ -0,0 +1,41 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { withError } from '@/react-tools/react-query';
+import { getEdgeStackFile } from '@/react/edge/edge-stacks/queries/useEdgeStackFile';
+import { getStackFile } from '@/react/common/stacks/queries/useStackFile';
+
+import { queryKeys } from './query-keys';
+
+export function useAppStackFile(
+  {
+    id,
+    kind,
+  }: {
+    id: number | undefined;
+    kind?: 'edge' | 'compose' | 'kubernetes' | (string & NonNullable<unknown>);
+  },
+  { enabled }: { enabled?: boolean } = {}
+) {
+  return useQuery(
+    queryKeys.appStackFile(id, kind),
+    async ({ signal }) => {
+      if (!id) {
+        return undefined;
+      }
+
+      if (kind === 'edge') {
+        return getEdgeStackFile(id);
+      }
+
+      const stackFile = await getStackFile({
+        stackId: id,
+        options: { signal },
+      });
+      return stackFile?.StackFileContent;
+    },
+    {
+      enabled: !!id && enabled,
+      ...withError('Failed to load app stack file'),
+    }
+  );
+}
diff --git a/app/react/kubernetes/applications/queries/useApplication.ts b/app/react/kubernetes/applications/queries/useApplication.ts
new file mode 100644
index 0000000..54a913a
--- /dev/null
+++ b/app/react/kubernetes/applications/queries/useApplication.ts
@@ -0,0 +1,168 @@
+import { UseQueryResult, useQuery } from '@tanstack/react-query';
+import { DaemonSet, Deployment, StatefulSet } from 'kubernetes-types/apps/v1';
+import { Pod } from 'kubernetes-types/core/v1';
+
+import { withError } from '@/react-tools/react-query';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { isFulfilled } from '@/portainer/helpers/promise-utils';
+import axios from '@/portainer/services/axios/axios';
+
+import { AppKind, Application } from '../types';
+import { parseKubernetesAxiosError } from '../../axiosError';
+
+import { queryKeys } from './query-keys';
+
+/**
+ * @returns an application from the Kubernetes API proxy (deployment, statefulset, daemonSet or pod)
+ * when yaml is set to true, the expected return type is a string
+ */
+export function useApplication<T extends Application | string = Application>(
+  environmentId: EnvironmentId,
+  namespace: string,
+  name: string,
+  appKind?: AppKind,
+  options?: { autoRefreshRate?: number; yaml?: boolean }
+): UseQueryResult<T> {
+  return useQuery(
+    queryKeys.application(environmentId, namespace, name, options?.yaml),
+    () =>
+      getApplication<T>(environmentId, namespace, name, appKind, options?.yaml),
+    {
+      ...withError('Unable to retrieve application'),
+      refetchInterval() {
+        return options?.autoRefreshRate ?? false;
+      },
+    }
+  );
+}
+
+// if not known, get the type of an application (Deployment, DaemonSet, StatefulSet or naked pod) by name
+async function getApplication<T extends Application | string = Application>(
+  environmentId: EnvironmentId,
+  namespace: string,
+  name: string,
+  appKind?: AppKind,
+  yaml?: boolean
+) {
+  // if resourceType is known, get the application by type and name
+  if (appKind) {
+    switch (appKind) {
+      case 'Deployment':
+      case 'DaemonSet':
+      case 'StatefulSet':
+        return getApplicationByKind<T>(
+          environmentId,
+          namespace,
+          appKind,
+          name,
+          yaml
+        );
+      case 'Pod':
+        return getPod(environmentId, namespace, name, yaml);
+      default:
+        throw new Error('Unknown resource type');
+    }
+  }
+
+  // if resourceType is not known, get the application by name and return the first one that is fulfilled
+  const [deployment, daemonSet, statefulSet, pod] = await Promise.allSettled([
+    getApplicationByKind<Deployment>(
+      environmentId,
+      namespace,
+      'Deployment',
+      name,
+      yaml
+    ),
+    getApplicationByKind<DaemonSet>(
+      environmentId,
+      namespace,
+      'DaemonSet',
+      name,
+      yaml
+    ),
+    getApplicationByKind<StatefulSet>(
+      environmentId,
+      namespace,
+      'StatefulSet',
+      name,
+      yaml
+    ),
+    getPod(environmentId, namespace, name, yaml),
+  ]);
+
+  if (isFulfilled(deployment)) {
+    return deployment.value;
+  }
+  if (isFulfilled(daemonSet)) {
+    return daemonSet.value;
+  }
+  if (isFulfilled(statefulSet)) {
+    return statefulSet.value;
+  }
+  if (isFulfilled(pod)) {
+    return pod.value;
+  }
+  throw new Error('Unable to retrieve application');
+}
+
+async function getPod<T extends Pod | string = Pod>(
+  environmentId: EnvironmentId,
+  namespace: string,
+  name: string,
+  yaml?: boolean
+) {
+  try {
+    const { data } = await axios.get<T>(
+      `/endpoints/${environmentId}/kubernetes/api/v1/namespaces/${namespace}/pods/${name}`,
+      {
+        headers: { Accept: yaml ? 'application/yaml' : 'application/json' },
+      }
+    );
+    return data;
+  } catch (e) {
+    throw parseKubernetesAxiosError(e, 'Unable to retrieve pod');
+  }
+}
+
+async function getApplicationByKind<
+  T extends Application | string = Application,
+>(
+  environmentId: EnvironmentId,
+  namespace: string,
+  appKind: 'Deployment' | 'DaemonSet' | 'StatefulSet',
+  name: string,
+  yaml?: boolean
+) {
+  try {
+    const { data } = await axios.get<T>(
+      buildUrl(environmentId, namespace, `${appKind}s`, name),
+      {
+        headers: { Accept: yaml ? 'application/yaml' : 'application/json' },
+        // this logic is to get the latest YAML response
+        // axios-cache-adapter looks for the response headers to determine if the response should be cached
+        // to avoid writing requestInterceptor, adding a query param to the request url
+        params: yaml
+          ? {
+              _: Date.now(),
+            }
+          : null,
+      }
+    );
+    return data;
+  } catch (e) {
+    throw parseKubernetesAxiosError(e, 'Unable to retrieve application');
+  }
+}
+
+function buildUrl(
+  environmentId: EnvironmentId,
+  namespace: string,
+  appKind: 'Deployments' | 'DaemonSets' | 'StatefulSets',
+  name?: string
+) {
+  let baseUrl = `/endpoints/${environmentId}/kubernetes/apis/apps/v1/namespaces/${namespace}/${appKind.toLowerCase()}`;
+  if (name) {
+    baseUrl += `/${name}`;
+  }
+  return baseUrl;
+}
diff --git a/app/react/kubernetes/applications/queries/useApplicationHorizontalPodAutoscaler.ts b/app/react/kubernetes/applications/queries/useApplicationHorizontalPodAutoscaler.ts
new file mode 100644
index 0000000..f19a9d7
--- /dev/null
+++ b/app/react/kubernetes/applications/queries/useApplicationHorizontalPodAutoscaler.ts
@@ -0,0 +1,94 @@
+import { useQuery } from '@tanstack/react-query';
+import {
+  HorizontalPodAutoscaler,
+  HorizontalPodAutoscalerList,
+} from 'kubernetes-types/autoscaling/v1';
+
+import { withError } from '@/react-tools/react-query';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios from '@/portainer/services/axios/axios';
+
+import type { Application } from '../types';
+import { parseKubernetesAxiosError } from '../../axiosError';
+
+import { queryKeys } from './query-keys';
+
+// useApplicationHorizontalPodAutoscalers returns a query for horizontal pod autoscalers that are related to the application
+export function useApplicationHorizontalPodAutoscaler(
+  environmentId: EnvironmentId,
+  namespace: string,
+  appName: string,
+  app?: Application
+) {
+  return useQuery(
+    queryKeys.applicationHorizontalPodAutoscalers(
+      environmentId,
+      namespace,
+      appName
+    ),
+    async () => {
+      if (!app) {
+        return null;
+      }
+      const horizontalPodAutoscalers =
+        await getNamespaceHorizontalPodAutoscalers(environmentId, namespace);
+      const matchingHorizontalPodAutoscaler =
+        getMatchingHorizontalPodAutoscaler(
+          horizontalPodAutoscalers,
+          namespace,
+          appName,
+          app.kind || ''
+        );
+      return matchingHorizontalPodAutoscaler;
+    },
+    {
+      ...withError(
+        `Unable to get horizontal pod autoscaler${
+          app ? ` for ${app.metadata?.name}` : ''
+        }`
+      ),
+      enabled: !!app,
+    }
+  );
+}
+
+export function getMatchingHorizontalPodAutoscaler(
+  horizontalPodAutoscalers: HorizontalPodAutoscaler[],
+  appNamespace: string,
+  appName: string,
+  appKind: string
+) {
+  const matchingHorizontalPodAutoscaler =
+    horizontalPodAutoscalers.find((horizontalPodAutoscaler) => {
+      if (horizontalPodAutoscaler.metadata?.namespace !== appNamespace) {
+        return false;
+      }
+      const scaleTargetRef = horizontalPodAutoscaler.spec?.scaleTargetRef;
+      if (scaleTargetRef) {
+        const scaleTargetRefName = scaleTargetRef.name;
+        const scaleTargetRefKind = scaleTargetRef.kind;
+        // include the horizontal pod autoscaler if the scale target ref name and kind match the application name and kind
+        return scaleTargetRefName === appName && scaleTargetRefKind === appKind;
+      }
+      return false;
+    }) || null;
+  return matchingHorizontalPodAutoscaler;
+}
+
+async function getNamespaceHorizontalPodAutoscalers(
+  environmentId: EnvironmentId,
+  namespace: string
+) {
+  try {
+    const { data: autoScalarList } =
+      await axios.get<HorizontalPodAutoscalerList>(
+        `/endpoints/${environmentId}/kubernetes/apis/autoscaling/v1/namespaces/${namespace}/horizontalpodautoscalers`
+      );
+    return autoScalarList.items;
+  } catch (e) {
+    throw parseKubernetesAxiosError(
+      e,
+      'Unable to retrieve horizontal pod autoscalers'
+    );
+  }
+}
diff --git a/app/react/kubernetes/applications/queries/useApplicationPods.ts b/app/react/kubernetes/applications/queries/useApplicationPods.ts
new file mode 100644
index 0000000..4776924
--- /dev/null
+++ b/app/react/kubernetes/applications/queries/useApplicationPods.ts
@@ -0,0 +1,44 @@
+import { useQuery } from '@tanstack/react-query';
+import { Pod } from 'kubernetes-types/core/v1';
+
+import { withError } from '@/react-tools/react-query';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { applicationIsKind, matchLabelsToLabelSelectorValue } from '../utils';
+import { Application } from '../types';
+
+import { queryKeys } from './query-keys';
+import { getPods } from './getPods';
+
+// useApplicationPods returns a query for pods that are related to the application by the application selector labels
+export function useApplicationPods(
+  environmentId: EnvironmentId,
+  namespace: string,
+  appName: string,
+  app?: Application,
+  options?: { autoRefreshRate?: number }
+) {
+  return useQuery(
+    queryKeys.applicationPods(environmentId, namespace, appName),
+    async () => {
+      if (applicationIsKind<Pod>('Pod', app)) {
+        return [app];
+      }
+      const appSelector = app?.spec?.selector;
+      const labelSelector = matchLabelsToLabelSelectorValue(
+        appSelector?.matchLabels
+      );
+
+      // get all pods in the namespace using the application selector as the label selector query param
+      const pods = await getPods(environmentId, namespace, labelSelector);
+      return pods;
+    },
+    {
+      ...withError(`Unable to get pods for ${appName}`),
+      enabled: !!app,
+      refetchInterval() {
+        return options?.autoRefreshRate ?? false;
+      },
+    }
+  );
+}
diff --git a/app/react/kubernetes/applications/queries/useApplicationRevisionList.ts b/app/react/kubernetes/applications/queries/useApplicationRevisionList.ts
new file mode 100644
index 0000000..233d6f0
--- /dev/null
+++ b/app/react/kubernetes/applications/queries/useApplicationRevisionList.ts
@@ -0,0 +1,173 @@
+import { useQuery } from '@tanstack/react-query';
+import {
+  ReplicaSetList,
+  ControllerRevisionList,
+} from 'kubernetes-types/apps/v1';
+
+import { withError } from '@/react-tools/react-query';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { AppKind } from '../types';
+import { appRevisionAnnotation } from '../constants';
+import { filterRevisionsByOwnerUid } from '../utils';
+import { parseKubernetesAxiosError } from '../../axiosError';
+
+import { queryKeys } from './query-keys';
+
+// useQuery to get an application's previous revision by environmentId, namespace, appKind and labelSelector
+export function useApplicationRevisionList(
+  environmentId: EnvironmentId,
+  namespace: string,
+  name: string,
+  deploymentUid?: string,
+  labelSelector?: string,
+  appKind?: AppKind
+) {
+  return useQuery(
+    queryKeys.applicationRevisions(
+      environmentId,
+      namespace,
+      name,
+      labelSelector
+    ),
+    () =>
+      getApplicationRevisionList(
+        environmentId,
+        namespace,
+        deploymentUid,
+        appKind,
+        labelSelector
+      ),
+    {
+      ...withError('Unable to retrieve application revisions'),
+      enabled: !!labelSelector && !!appKind && !!deploymentUid,
+    }
+  );
+}
+
+async function getApplicationRevisionList(
+  environmentId: EnvironmentId,
+  namespace: string,
+  deploymentUid?: string,
+  appKind?: AppKind,
+  labelSelector?: string
+) {
+  if (!deploymentUid) {
+    throw new Error('deploymentUid is required');
+  }
+  try {
+    switch (appKind) {
+      case 'Deployment': {
+        const replicaSetList = await getReplicaSetList(
+          environmentId,
+          namespace,
+          labelSelector
+        );
+        const replicaSets = replicaSetList.items;
+        // keep only replicaset(s) which are owned by the deployment with the given uid
+        const replicaSetsWithOwnerId = filterRevisionsByOwnerUid(
+          replicaSets,
+          deploymentUid
+        );
+        // keep only replicaset(s) that have been a version of the Deployment
+        const replicaSetsWithRevisionAnnotations =
+          replicaSetsWithOwnerId.filter(
+            (rs) => !!rs.metadata?.annotations?.[appRevisionAnnotation]
+          );
+
+        return {
+          ...replicaSetList,
+          items: replicaSetsWithRevisionAnnotations,
+        } as ReplicaSetList;
+      }
+      case 'DaemonSet':
+      case 'StatefulSet': {
+        const controllerRevisionList = await getControllerRevisionList(
+          environmentId,
+          namespace,
+          labelSelector
+        );
+        const controllerRevisions = controllerRevisionList.items;
+        // ensure the controller reference(s) is owned by the deployment with the given uid
+        const controllerRevisionsWithOwnerId = filterRevisionsByOwnerUid(
+          controllerRevisions,
+          deploymentUid
+        );
+
+        return {
+          ...controllerRevisionList,
+          items: controllerRevisionsWithOwnerId,
+        } as ControllerRevisionList;
+      }
+      default:
+        throw new Error(`Unknown application kind ${appKind}`);
+    }
+  } catch (e) {
+    throw parseAxiosError(
+      e as Error,
+      `Unable to retrieve revisions for ${appKind}`
+    );
+  }
+}
+
+async function getReplicaSetList(
+  environmentId: EnvironmentId,
+  namespace: string,
+  labelSelector?: string
+) {
+  try {
+    const { data } = await axios.get<ReplicaSetList>(
+      buildUrl(environmentId, namespace, 'ReplicaSets'),
+      {
+        params: {
+          labelSelector,
+        },
+      }
+    );
+    return data;
+  } catch (e) {
+    throw parseKubernetesAxiosError(e, 'Unable to retrieve ReplicaSets');
+  }
+}
+
+async function getControllerRevisionList(
+  environmentId: EnvironmentId,
+  namespace: string,
+  labelSelector?: string
+) {
+  try {
+    const { data } = await axios.get<ControllerRevisionList>(
+      buildUrl(environmentId, namespace, 'ControllerRevisions'),
+      {
+        params: {
+          labelSelector,
+        },
+      }
+    );
+    return data;
+  } catch (e) {
+    throw parseKubernetesAxiosError(
+      e,
+      'Unable to retrieve ControllerRevisions'
+    );
+  }
+}
+
+function buildUrl(
+  environmentId: EnvironmentId,
+  namespace: string,
+  appKind:
+    | 'Deployments'
+    | 'DaemonSets'
+    | 'StatefulSets'
+    | 'ReplicaSets'
+    | 'ControllerRevisions',
+  name?: string
+) {
+  let baseUrl = `/endpoints/${environmentId}/kubernetes/apis/apps/v1/namespaces/${namespace}/${appKind.toLowerCase()}`;
+  if (name) {
+    baseUrl += `/${name}`;
+  }
+  return baseUrl;
+}
diff --git a/app/react/kubernetes/applications/queries/useApplicationServices.ts b/app/react/kubernetes/applications/queries/useApplicationServices.ts
new file mode 100644
index 0000000..ff781dc
--- /dev/null
+++ b/app/react/kubernetes/applications/queries/useApplicationServices.ts
@@ -0,0 +1,57 @@
+import { useQuery } from '@tanstack/react-query';
+import { Pod } from 'kubernetes-types/core/v1';
+
+import { withError } from '@/react-tools/react-query';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { getNamespaceServices } from '../../services/service';
+import type { Application } from '../types';
+import { applicationIsKind } from '../utils';
+
+import { queryKeys } from './query-keys';
+
+// useApplicationServices returns a query for services that are related to the application (this doesn't include ingresses)
+// Filtering the services by the application selector labels is done in the front end because:
+// - The label selector query param in the kubernetes API filters by metadata.labels, but we need to filter the services by spec.selector
+// - The field selector query param in the kubernetes API can filter the services by spec.selector, but it doesn't support chaining with 'OR',
+//   so we can't filter by services with at least one matching label. See: https://kubernetes.io/docs/concepts/overview/working-with-objects/field-selectors/#chained-selectors
+export function useApplicationServices(
+  environmentId: EnvironmentId,
+  namespace: string,
+  appName: string,
+  app?: Application
+) {
+  return useQuery(
+    queryKeys.applicationServices(environmentId, namespace, appName),
+    async () => {
+      if (!app) {
+        return [];
+      }
+
+      // get the selector labels for the application
+      const appSelectorLabels = applicationIsKind<Pod>('Pod', app)
+        ? app.metadata?.labels
+        : app.spec?.template?.metadata?.labels;
+
+      // get all services in the namespace and filter them by the application selector labels
+      const services = await getNamespaceServices(environmentId, namespace);
+      const filteredServices = services.filter((service) => {
+        if (service.spec?.selector && appSelectorLabels) {
+          const serviceSelectorLabels = service.spec.selector;
+          // include the service if the service selector label matches at least one application selector label
+          return Object.keys(appSelectorLabels).some(
+            (key) =>
+              serviceSelectorLabels[key] &&
+              serviceSelectorLabels[key] === appSelectorLabels[key]
+          );
+        }
+        return false;
+      });
+      return filteredServices;
+    },
+    {
+      ...withError(`Unable to get services for ${appName}`),
+      enabled: !!app,
+    }
+  );
+}
diff --git a/app/react/kubernetes/applications/queries/useApplications.ts b/app/react/kubernetes/applications/queries/useApplications.ts
new file mode 100644
index 0000000..0859eed
--- /dev/null
+++ b/app/react/kubernetes/applications/queries/useApplications.ts
@@ -0,0 +1,53 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { withError } from '@/react-tools/react-query';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { Application } from '../ListView/ApplicationsDatatable/types';
+
+import { queryKeys } from './query-keys';
+
+type GetAppsParams = {
+  namespace?: string;
+  nodeName?: string;
+};
+
+type GetAppsQueryOptions = {
+  refetchInterval?: number;
+} & GetAppsParams;
+
+/**
+ * @returns a UseQueryResult that can be used to fetch a list of applications from an array of namespaces.
+ * This api call goes to the portainer api, not the kubernetes proxy api.
+ */
+export function useApplications(
+  environmentId: EnvironmentId,
+  queryOptions?: GetAppsQueryOptions
+) {
+  const { refetchInterval, ...params } = queryOptions ?? {};
+  return useQuery(
+    queryKeys.applications(environmentId, params),
+    () => getApplications(environmentId, params),
+    {
+      refetchInterval,
+      ...withError('Unable to retrieve applications'),
+    }
+  );
+}
+
+// get all applications from a namespace
+export async function getApplications(
+  environmentId: EnvironmentId,
+  params?: GetAppsParams
+) {
+  try {
+    const { data } = await axios.get<Application[]>(
+      `/kubernetes/${environmentId}/applications`,
+      { params }
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to retrieve applications');
+  }
+}
diff --git a/app/react/kubernetes/applications/queries/useDeleteApplicationsMutation.ts b/app/react/kubernetes/applications/queries/useDeleteApplicationsMutation.ts
new file mode 100644
index 0000000..9654179
--- /dev/null
+++ b/app/react/kubernetes/applications/queries/useDeleteApplicationsMutation.ts
@@ -0,0 +1,305 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+import { HorizontalPodAutoscaler } from 'kubernetes-types/autoscaling/v2';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { getAllSettledItems } from '@/portainer/helpers/promise-utils';
+import { withError } from '@/react-tools/react-query';
+import { notifyError, notifySuccess } from '@/portainer/services/notifications';
+import { pluralize } from '@/portainer/helpers/strings';
+import { uninstallHelmApplication } from '@/react/kubernetes/helm/helmReleaseQueries/useUninstallHelmAppMutation';
+
+import { parseKubernetesAxiosError } from '../../axiosError';
+import { ApplicationRowData } from '../ListView/ApplicationsDatatable/types';
+import { Stack } from '../ListView/ApplicationsStacksDatatable/types';
+import { deleteServices } from '../../services/service';
+import { updateIngress } from '../../ingresses/service';
+import { Ingress } from '../../ingresses/types';
+
+import { queryKeys } from './query-keys';
+
+export function useDeleteApplicationsMutation({
+  environmentId,
+  stacks,
+  ingresses,
+  reportStacks,
+}: {
+  environmentId: EnvironmentId;
+  stacks: Stack[];
+  ingresses: Ingress[];
+  reportStacks?: boolean;
+}) {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: (applications: ApplicationRowData[]) =>
+      deleteApplications(applications, stacks, ingresses, environmentId),
+    // apps and stacks deletions results (success and error) are handled here
+    onSuccess: ({
+      settledAppDeletions,
+      settledStackDeletions,
+      settledIngressUpdates,
+      settledHpaDeletions,
+    }) => {
+      // one error notification per rejected item
+      settledAppDeletions.rejectedItems.forEach(({ item, reason }) => {
+        notifyError(
+          `Failed to remove application '${item.Name}'`,
+          new Error(reason)
+        );
+      });
+      settledStackDeletions.rejectedItems.forEach(({ item, reason }) => {
+        notifyError(`Failed to remove stack '${item.Name}'`, new Error(reason));
+      });
+      settledIngressUpdates.rejectedItems.forEach(({ item, reason }) => {
+        notifyError(
+          `Failed to update ingress paths for '${item.Name}'`,
+          new Error(reason)
+        );
+      });
+      settledHpaDeletions.rejectedItems.forEach(({ item, reason }) => {
+        notifyError(
+          `Failed to remove horizontal pod autoscaler for '${item.metadata?.name}'`,
+          new Error(reason)
+        );
+      });
+
+      // one success notification for all fulfilled items
+      if (settledAppDeletions.fulfilledItems.length && !reportStacks) {
+        notifySuccess(
+          `${pluralize(
+            settledAppDeletions.fulfilledItems.length,
+            'Application'
+          )} successfully removed`,
+          settledAppDeletions.fulfilledItems.map((item) => item.Name).join(', ')
+        );
+      }
+      if (settledStackDeletions.fulfilledItems.length && reportStacks) {
+        notifySuccess(
+          `${pluralize(
+            settledStackDeletions.fulfilledItems.length,
+            'Stack'
+          )} successfully removed`,
+          settledStackDeletions.fulfilledItems
+            .map((item) => item.Name)
+            .join(', ')
+        );
+      }
+      // dont notify successful ingress updates to avoid notification spam
+      queryClient.invalidateQueries(queryKeys.applications(environmentId));
+    },
+    // failed service deletions are handled here
+    onError: (error: unknown) => {
+      notifyError('Unable to remove applications', error as Error);
+    },
+    ...withError('Unable to remove applications'),
+  });
+}
+
+async function deleteApplications(
+  applications: ApplicationRowData[],
+  stacks: Stack[],
+  ingresses: Ingress[],
+  environmentId: EnvironmentId
+) {
+  const settledAppDeletions = await getAllSettledItems(
+    applications,
+    (application) => deleteApplication(application, stacks, environmentId)
+  );
+
+  // Delete stacks that have no applications left (stacks object has been mutated by deleteApplication)
+  const stacksToDelete = stacks.filter(
+    (stack) => stack.Applications.length === 0
+  );
+  const settledStackDeletions = await getAllSettledItems(
+    stacksToDelete,
+    (stack) => deleteStack(stack, environmentId)
+  );
+
+  // update associated k8s ressources
+  // helm uninstall will update associated k8s ressources for helm apps, so don't manually delete Helm app associated k8s resources
+  const nonHelmApplications = applications.filter(
+    (app) => app.ApplicationType !== 'Helm'
+  );
+  const servicesToDelete = getServicesFromApplications(nonHelmApplications);
+  // axios error handling is done inside deleteServices already
+  if (Object.keys(servicesToDelete).length > 0) {
+    await deleteServices({
+      environmentId,
+      data: servicesToDelete,
+    });
+  }
+  const hpasToDelete = nonHelmApplications
+    .map((app) => app.HorizontalPodAutoscaler)
+    .filter((hpa) => !!hpa);
+  const settledHpaDeletions = await getAllSettledItems(hpasToDelete, (hpa) =>
+    deleteHorizontalPodAutoscaler(hpa, environmentId)
+  );
+  const updatedIngresses = getUpdatedIngressesWithRemovedPaths(
+    ingresses,
+    servicesToDelete
+  );
+  const settledIngressUpdates = await getAllSettledItems(
+    updatedIngresses,
+    (ingress) => updateIngress(environmentId, ingress)
+  );
+
+  return {
+    settledAppDeletions,
+    settledStackDeletions,
+    settledIngressUpdates,
+    settledHpaDeletions,
+  };
+}
+
+function getServicesFromApplications(
+  applications: ApplicationRowData[]
+): Record<string, string[]> {
+  return applications.reduce<Record<string, string[]>>(
+    (namespaceServicesMap, application) => {
+      const serviceNames =
+        application.Services?.map((service) => service.metadata?.name).filter(
+          (name) => name !== undefined
+        ) || [];
+      const existingServices =
+        namespaceServicesMap[application.ResourcePool] || [];
+      const uniqueServicesForNamespace = Array.from(
+        new Set([...existingServices, ...serviceNames])
+      );
+      return {
+        ...namespaceServicesMap,
+        [application.ResourcePool]: uniqueServicesForNamespace,
+      };
+    },
+    {}
+  );
+}
+
+// return a list of ingresses, which need updated because their paths should be removed for deleted services.
+function getUpdatedIngressesWithRemovedPaths(
+  ingresses: Ingress[],
+  servicesToDelete: Record<string, string[]>
+) {
+  return ingresses.reduce<Ingress[]>((updatedIngresses, ingress) => {
+    if (!ingress.Paths) {
+      return updatedIngresses;
+    }
+    const servicesInNamespace = servicesToDelete[ingress.Namespace] || [];
+    // filter out the paths for services that are in the list of services to delete
+    const updatedIngressPaths =
+      ingress.Paths.filter(
+        (path) => !servicesInNamespace.includes(path.ServiceName)
+      ) ?? [];
+    if (updatedIngressPaths.length !== ingress.Paths?.length) {
+      return [...updatedIngresses, { ...ingress, Paths: updatedIngressPaths }];
+    }
+    return updatedIngresses;
+  }, []);
+}
+
+async function deleteStack(stack: Stack, environmentId: EnvironmentId) {
+  try {
+    await axios.delete(`/stacks/name/${stack.Name}`, {
+      params: {
+        external: false,
+        name: stack.Name,
+        endpointId: environmentId,
+        namespace: stack.ResourcePool,
+      },
+    });
+  } catch (error) {
+    throw parseAxiosError(error, 'Unable to remove stack');
+  }
+}
+
+async function deleteApplication(
+  application: ApplicationRowData,
+  stacks: Stack[],
+  environmentId: EnvironmentId
+) {
+  switch (application.ApplicationType) {
+    case 'Deployment':
+    case 'DaemonSet':
+    case 'StatefulSet':
+      await deleteKubernetesApplication(application, stacks, environmentId);
+      break;
+    case 'Pod':
+      await deletePodApplication(application, stacks, environmentId);
+      break;
+    case 'Helm':
+      await uninstallHelmApplication(
+        environmentId,
+        application.Name,
+        application.ResourcePool
+      );
+      break;
+    default:
+      throw new Error(
+        `Unknown application type: ${application.ApplicationType}`
+      );
+  }
+}
+
+async function deleteKubernetesApplication(
+  application: ApplicationRowData,
+  stacks: Stack[],
+  environmentId: EnvironmentId
+) {
+  try {
+    await axios.delete(
+      `/endpoints/${environmentId}/kubernetes/apis/apps/v1/namespaces/${
+        application.ResourcePool
+      }/${application.ApplicationType.toLowerCase()}s/${application.Name}`
+    );
+    removeApplicationFromStack(application, stacks);
+  } catch (error) {
+    throw parseKubernetesAxiosError(error, 'Unable to remove application');
+  }
+}
+
+async function deletePodApplication(
+  application: ApplicationRowData,
+  stacks: Stack[],
+  environmentId: EnvironmentId
+) {
+  try {
+    await axios.delete(
+      `/endpoints/${environmentId}/kubernetes/api/v1/namespaces/${application.ResourcePool}/pods/${application.Name}`
+    );
+    removeApplicationFromStack(application, stacks);
+  } catch (error) {
+    throw parseKubernetesAxiosError(error, 'Unable to remove application');
+  }
+}
+
+async function deleteHorizontalPodAutoscaler(
+  hpa: HorizontalPodAutoscaler,
+  environmentId: EnvironmentId
+) {
+  try {
+    await axios.delete(
+      `/endpoints/${environmentId}/kubernetes/apis/autoscaling/v2/namespaces/${hpa.metadata?.namespace}/horizontalpodautoscalers/${hpa.metadata?.name}`
+    );
+  } catch (error) {
+    throw parseKubernetesAxiosError(
+      error,
+      'Unable to remove horizontal pod autoscaler'
+    );
+  }
+}
+
+// mutate the stacks array to remove the application
+function removeApplicationFromStack(
+  application: ApplicationRowData,
+  stacks: Stack[]
+) {
+  const stack = stacks.find(
+    (stack) =>
+      stack.Name === application.StackName &&
+      stack.ResourcePool === application.ResourcePool
+  );
+  if (stack) {
+    stack.Applications = stack.Applications.filter(
+      (app) => app.Name !== application.Name
+    );
+  }
+}
diff --git a/app/react/kubernetes/applications/queries/useDeletePodMutation.ts b/app/react/kubernetes/applications/queries/useDeletePodMutation.ts
new file mode 100644
index 0000000..260d454
--- /dev/null
+++ b/app/react/kubernetes/applications/queries/useDeletePodMutation.ts
@@ -0,0 +1,43 @@
+import { useMutation } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { queryClient, withError } from '@/react-tools/react-query';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { queryKeys } from './query-keys';
+
+export function useDeletePodMutation(
+  environmentId: EnvironmentId,
+  namespace: string,
+  appName: string
+) {
+  return useMutation(
+    ({ podName }: { podName: string }) =>
+      deletePod(environmentId, namespace, podName),
+    {
+      onSuccess: () => {
+        queryClient.invalidateQueries(
+          queryKeys.applicationPods(environmentId, namespace, appName)
+        );
+      },
+      ...withError('Unable to delete pod'),
+    }
+  );
+}
+
+async function deletePod(
+  environmentId: EnvironmentId,
+  namespace: string,
+  podName: string
+) {
+  try {
+    await axios.delete(
+      `/kubernetes/${environmentId}/namespaces/${namespace}/pods/${podName}`
+    );
+  } catch (error) {
+    throw parseAxiosError(
+      error as Error,
+      `Failed to delete pod ${podName} in namespace ${namespace}`
+    );
+  }
+}
diff --git a/app/react/kubernetes/applications/queries/useHorizontalPodAutoScaler.ts b/app/react/kubernetes/applications/queries/useHorizontalPodAutoScaler.ts
new file mode 100644
index 0000000..ec29065
--- /dev/null
+++ b/app/react/kubernetes/applications/queries/useHorizontalPodAutoScaler.ts
@@ -0,0 +1,70 @@
+import { HorizontalPodAutoscaler } from 'kubernetes-types/autoscaling/v1';
+import { useQuery } from '@tanstack/react-query';
+
+import axios from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { withError } from '@/react-tools/react-query';
+
+import { parseKubernetesAxiosError } from '../../axiosError';
+
+// when yaml is set to true, the expected return type is a string
+export function useHorizontalPodAutoScaler<
+  T extends HorizontalPodAutoscaler | string = HorizontalPodAutoscaler,
+>(
+  environmentId: EnvironmentId,
+  namespace: string,
+  name?: string,
+  options?: { yaml?: boolean }
+) {
+  return useQuery(
+    [
+      'environments',
+      environmentId,
+      'kubernetes',
+      'namespaces',
+      namespace,
+      'horizontalpodautoscalers',
+      name,
+      options?.yaml,
+    ],
+    () =>
+      name
+        ? getNamespaceHorizontalPodAutoscaler<T>(
+            environmentId,
+            namespace,
+            name,
+            options
+          )
+        : undefined,
+    {
+      ...withError('Unable to get horizontal pod autoscaler'),
+      enabled: !!name,
+    }
+  );
+}
+
+export async function getNamespaceHorizontalPodAutoscaler<
+  T extends HorizontalPodAutoscaler | string = HorizontalPodAutoscaler,
+>(
+  environmentId: EnvironmentId,
+  namespace: string,
+  name: string,
+  options?: { yaml?: boolean }
+) {
+  try {
+    const { data: autoScalar } = await axios.get<T>(
+      `/endpoints/${environmentId}/kubernetes/apis/autoscaling/v1/namespaces/${namespace}/horizontalpodautoscalers/${name}`,
+      {
+        headers: {
+          Accept: options?.yaml ? 'application/yaml' : 'application/json',
+        },
+      }
+    );
+    return autoScalar;
+  } catch (e) {
+    throw parseKubernetesAxiosError(
+      e,
+      'Unable to retrieve horizontal pod autoscaler'
+    );
+  }
+}
diff --git a/app/react/kubernetes/applications/queries/usePatchApplicationMutation.ts b/app/react/kubernetes/applications/queries/usePatchApplicationMutation.ts
new file mode 100644
index 0000000..bd01251
--- /dev/null
+++ b/app/react/kubernetes/applications/queries/usePatchApplicationMutation.ts
@@ -0,0 +1,155 @@
+import { useMutation } from '@tanstack/react-query';
+import { Deployment, DaemonSet, StatefulSet } from 'kubernetes-types/apps/v1';
+import { Pod } from 'kubernetes-types/core/v1';
+
+import { queryClient } from '@/react-tools/react-query';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import type { AppKind, ApplicationPatch, Application } from '../types';
+import { parseKubernetesAxiosError } from '../../axiosError';
+
+import { queryKeys } from './query-keys';
+
+// useQuery to patch an application by environmentId, namespace, name and patch payload
+export function usePatchApplicationMutation(
+  environmentId: EnvironmentId,
+  namespace: string,
+  name: string
+) {
+  return useMutation(
+    ({
+      appKind,
+      patch,
+      contentType = 'application/json-patch+json',
+    }: {
+      appKind: AppKind;
+      patch: ApplicationPatch;
+      contentType?:
+        | 'application/json-patch+json'
+        | 'application/strategic-merge-patch+json';
+    }) =>
+      patchApplication(
+        environmentId,
+        namespace,
+        appKind,
+        name,
+        patch,
+        contentType
+      ),
+    {
+      onSuccess: () => {
+        queryClient.invalidateQueries(
+          queryKeys.application(environmentId, namespace, name)
+        );
+      },
+      // patch application is used for patching and rollbacks, so handle the error where it's used instead of here
+    }
+  );
+}
+
+async function patchApplication(
+  environmentId: EnvironmentId,
+  namespace: string,
+  appKind: AppKind,
+  name: string,
+  patch: ApplicationPatch,
+  contentType: string = 'application/json-patch+json'
+) {
+  switch (appKind) {
+    case 'Deployment':
+      return patchApplicationByKind<Deployment>(
+        environmentId,
+        namespace,
+        appKind,
+        name,
+        patch,
+        contentType
+      );
+    case 'DaemonSet':
+      return patchApplicationByKind<DaemonSet>(
+        environmentId,
+        namespace,
+        appKind,
+        name,
+        patch,
+        contentType
+      );
+    case 'StatefulSet':
+      return patchApplicationByKind<StatefulSet>(
+        environmentId,
+        namespace,
+        appKind,
+        name,
+        patch,
+        contentType
+      );
+    case 'Pod':
+      return patchPod(environmentId, namespace, name, patch);
+    default:
+      throw new Error(`Unknown application kind ${appKind}`);
+  }
+}
+
+async function patchApplicationByKind<T extends Application>(
+  environmentId: EnvironmentId,
+  namespace: string,
+  appKind: 'Deployment' | 'DaemonSet' | 'StatefulSet',
+  name: string,
+  patch: ApplicationPatch,
+  contentType = 'application/json-patch+json'
+) {
+  try {
+    const res = await axios.patch<T>(
+      buildUrl(environmentId, namespace, `${appKind}s`, name),
+      patch,
+      {
+        headers: {
+          'Content-Type': contentType,
+        },
+      }
+    );
+    return res;
+  } catch (e) {
+    throw parseKubernetesAxiosError(e, 'Unable to patch application');
+  }
+}
+
+async function patchPod(
+  environmentId: EnvironmentId,
+  namespace: string,
+  name: string,
+  patch: ApplicationPatch
+) {
+  try {
+    return await axios.patch<Pod>(
+      `/endpoints/${environmentId}/kubernetes/api/v1/namespaces/${namespace}/pods/${name}`,
+      patch,
+      {
+        headers: {
+          'Content-Type': 'application/json-patch+json',
+        },
+      }
+    );
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to update pod');
+  }
+}
+
+function buildUrl(
+  environmentId: EnvironmentId,
+  namespace: string,
+  appKind:
+    | 'Deployments'
+    | 'DaemonSets'
+    | 'StatefulSets'
+    | 'ReplicaSets'
+    | 'ControllerRevisions',
+  name?: string
+) {
+  let baseUrl = `/endpoints/${environmentId}/kubernetes/apis/apps/v1/namespaces/${namespace}/${appKind.toLowerCase()}`;
+  if (name) {
+    baseUrl += `/${name}`;
+  }
+  return baseUrl;
+}
diff --git a/app/react/kubernetes/applications/queries/useRedeployApplicationMutation.ts b/app/react/kubernetes/applications/queries/useRedeployApplicationMutation.ts
new file mode 100644
index 0000000..d8d4b21
--- /dev/null
+++ b/app/react/kubernetes/applications/queries/useRedeployApplicationMutation.ts
@@ -0,0 +1,72 @@
+import { useMutation } from '@tanstack/react-query';
+import { Pod } from 'kubernetes-types/core/v1';
+
+import { queryClient, withError } from '@/react-tools/react-query';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios from '@/portainer/services/axios/axios';
+
+import { parseKubernetesAxiosError } from '../../axiosError';
+
+import { queryKeys } from './query-keys';
+import { getPods } from './getPods';
+
+// useRedeployApplicationMutation gets all the pods for an application (using the matchLabels field in the labelSelector query param) and then deletes all of them, so that they are recreated
+export function useRedeployApplicationMutation(
+  environmentId: number,
+  namespace: string,
+  name: string
+) {
+  return useMutation(
+    async ({ labelSelector }: { labelSelector: string }) => {
+      try {
+        // get only the pods that match the labelSelector for the application
+        const pods = await getPods(environmentId, namespace, labelSelector);
+        // delete all the pods to redeploy the application
+        await Promise.all(
+          pods.map((pod) => {
+            if (pod?.metadata?.name) {
+              return deletePod(environmentId, namespace, pod.metadata.name);
+            }
+            return Promise.resolve();
+          })
+        );
+      } catch (error) {
+        throw new Error(`Unable to redeploy application: ${error}`, {
+          cause: error,
+        });
+      }
+    },
+    {
+      onSuccess: () => {
+        queryClient.invalidateQueries(
+          queryKeys.application(environmentId, namespace, name)
+        );
+      },
+      ...withError('Unable to redeploy application'),
+    }
+  );
+}
+
+async function deletePod(
+  environmentId: EnvironmentId,
+  namespace: string,
+  name: string
+) {
+  try {
+    return await axios.delete<Pod>(buildUrl(environmentId, namespace, name));
+  } catch (e) {
+    throw parseKubernetesAxiosError(e as Error, 'Unable to delete pod');
+  }
+}
+
+function buildUrl(
+  environmentId: EnvironmentId,
+  namespace: string,
+  name?: string
+) {
+  let baseUrl = `/endpoints/${environmentId}/kubernetes/api/v1/namespaces/${namespace}/pods`;
+  if (name) {
+    baseUrl += `/${name}`;
+  }
+  return baseUrl;
+}
diff --git a/app/react/kubernetes/applications/queries/useRestartPodMutation.ts b/app/react/kubernetes/applications/queries/useRestartPodMutation.ts
new file mode 100644
index 0000000..47550ca
--- /dev/null
+++ b/app/react/kubernetes/applications/queries/useRestartPodMutation.ts
@@ -0,0 +1,43 @@
+import { useMutation } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { queryClient, withError } from '@/react-tools/react-query';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { queryKeys } from './query-keys';
+
+export function useRestartPodMutation(
+  environmentId: EnvironmentId,
+  namespace: string,
+  appName: string
+) {
+  return useMutation(
+    ({ podName }: { podName: string }) =>
+      restartPod(environmentId, namespace, podName),
+    {
+      onSuccess: () => {
+        queryClient.invalidateQueries(
+          queryKeys.applicationPods(environmentId, namespace, appName)
+        );
+      },
+      ...withError('Unable to restart pod'),
+    }
+  );
+}
+
+async function restartPod(
+  environmentId: EnvironmentId,
+  namespace: string,
+  podName: string
+) {
+  try {
+    await axios.post(
+      `/kubernetes/${environmentId}/namespaces/${namespace}/pods/${podName}/restart`
+    );
+  } catch (error) {
+    throw parseAxiosError(
+      error as Error,
+      `Failed to restart pod ${podName} in namespace ${namespace}`
+    );
+  }
+}
diff --git a/app/react/kubernetes/applications/types.ts b/app/react/kubernetes/applications/types.ts
new file mode 100644
index 0000000..22c3e6b
--- /dev/null
+++ b/app/react/kubernetes/applications/types.ts
@@ -0,0 +1,108 @@
+import {
+  DaemonSet,
+  DaemonSetList,
+  Deployment,
+  DeploymentList,
+  StatefulSet,
+  StatefulSetList,
+  ReplicaSet,
+  ControllerRevision,
+} from 'kubernetes-types/apps/v1';
+import { Container, Pod, PodList, Volume } from 'kubernetes-types/core/v1';
+import { RawExtension } from 'kubernetes-types/runtime';
+import { OwnerReference } from 'kubernetes-types/meta/v1';
+
+import { EnvVarValues } from '@@/form-components/EnvironmentVariablesFieldset';
+
+import { Annotation } from '../annotations/types';
+import { Ingress } from '../ingresses/types';
+
+import { AutoScalingFormValues } from './components/AutoScalingFormSection/types';
+import { ServiceFormValues } from './CreateView/application-services/types';
+import { PersistedFolderFormValue } from './components/PersistedFoldersFormSection/types';
+import { ConfigurationFormValues } from './components/ConfigurationsFormSection/types';
+import {
+  Placement,
+  PlacementType,
+} from './components/PlacementFormSection/types';
+
+export type ApplicationFormValues = {
+  Containers: Array<unknown>;
+  ApplicationType: AppKind;
+  ResourcePool: unknown;
+  Name: string;
+  StackName?: string;
+  ApplicationOwner?: string;
+  ImageModel: unknown;
+  Note?: string;
+  MemoryLimit?: number;
+  CpuLimit?: number;
+  DeploymentType?: DeploymentType;
+  ReplicaCount?: number;
+  AutoScaler?: AutoScalingFormValues;
+  Services?: Array<ServiceFormValues>;
+  OriginalIngresses?: Array<Ingress>;
+  EnvironmentVariables?: EnvVarValues;
+  DataAccessPolicy?: AppDataAccessPolicy;
+  PersistedFolders?: Array<PersistedFolderFormValue>;
+  ConfigMaps?: Array<ConfigurationFormValues>;
+  Secrets?: Array<ConfigurationFormValues>;
+  PlacementType?: PlacementType;
+  Placements?: Array<Placement>;
+  Annotations?: Array<Annotation>;
+};
+
+export type Application = Deployment | DaemonSet | StatefulSet | Pod;
+
+// Revisions are have the previous application state and are used for rolling back applications to their previous state.
+// Deployments use ReplicaSets, StatefulSets and DaemonSets use ControllerRevisions, and Pods don't have revisions.
+export type Revision = ReplicaSet | ControllerRevision;
+
+export type ApplicationList =
+  | DeploymentList
+  | DaemonSetList
+  | StatefulSetList
+  | PodList;
+
+export type AppKind = 'Deployment' | 'DaemonSet' | 'StatefulSet' | 'Pod';
+
+export type AppType = AppKind | 'Helm';
+
+export type DeploymentType = 'Replicated' | 'Global';
+
+export type AppDataAccessPolicy = 'Isolated' | 'Shared';
+
+type Patch = {
+  op: 'replace' | 'add' | 'remove';
+  path: string;
+  value: string | number | boolean | null | Record<string, unknown>;
+}[];
+
+export type ApplicationPatch = Patch | RawExtension;
+
+export interface ConfigmapRef {
+  name: string;
+}
+
+export interface ValueFrom {
+  configMapRef?: ConfigmapRef;
+  secretRef?: ConfigmapRef;
+}
+
+export interface Job {
+  name?: string;
+  namespace: string;
+  creationDate?: string;
+  uid?: string;
+  containers: Container[];
+}
+
+export interface K8sPod extends Job {
+  ownerReferences: OwnerReference[];
+  volumes?: Volume[];
+  nodeName?: string;
+}
+
+export interface CronJob extends Job {
+  schedule: string;
+}
diff --git a/app/react/kubernetes/applications/useCronJobs.ts b/app/react/kubernetes/applications/useCronJobs.ts
new file mode 100644
index 0000000..da89497
--- /dev/null
+++ b/app/react/kubernetes/applications/useCronJobs.ts
@@ -0,0 +1,77 @@
+import { CronJob, CronJobList } from 'kubernetes-types/batch/v1';
+import { useQuery } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { withError } from '@/react-tools/react-query';
+import axios from '@/portainer/services/axios/axios';
+
+import { parseKubernetesAxiosError } from '../axiosError';
+
+const queryKeys = {
+  cronJobsForCluster: (environmentId: EnvironmentId) => [
+    'environments',
+    environmentId,
+    'kubernetes',
+    'cronjobs',
+  ],
+};
+
+export function useCronJobs(
+  environmentId: EnvironmentId,
+  namespaces?: string[]
+) {
+  return useQuery(
+    queryKeys.cronJobsForCluster(environmentId),
+    () => getCronJobsForCluster(environmentId, namespaces),
+    {
+      ...withError('Unable to retrieve CronJobs'),
+      enabled: !!namespaces?.length,
+    }
+  );
+}
+
+export async function getCronJobsForCluster(
+  environmentId: EnvironmentId,
+  namespaceNames?: string[]
+) {
+  if (!namespaceNames) {
+    return [];
+  }
+  const jobs = await Promise.all(
+    namespaceNames.map((namespace) =>
+      getNamespaceCronJobs(environmentId, namespace)
+    )
+  );
+  return jobs.flat();
+}
+
+export async function getNamespaceCronJobs(
+  environmentId: EnvironmentId,
+  namespace: string,
+  labelSelector?: string
+) {
+  try {
+    const { data } = await axios.get<CronJobList>(
+      `/endpoints/${environmentId}/kubernetes/apis/batch/v1/namespaces/${namespace}/cronjobs`,
+      {
+        params: {
+          labelSelector,
+        },
+      }
+    );
+    const items = (data.items || []).map(
+      (cronJob) =>
+        <CronJob>{
+          ...cronJob,
+          kind: 'CronJob',
+          apiVersion: data.apiVersion,
+        }
+    );
+    return items;
+  } catch (e) {
+    throw parseKubernetesAxiosError(
+      e,
+      `Unable to retrieve CronJobs in namespace '${namespace}'`
+    );
+  }
+}
diff --git a/app/react/kubernetes/applications/useJobs.ts b/app/react/kubernetes/applications/useJobs.ts
new file mode 100644
index 0000000..85ec6b6
--- /dev/null
+++ b/app/react/kubernetes/applications/useJobs.ts
@@ -0,0 +1,74 @@
+import { Job, JobList } from 'kubernetes-types/batch/v1';
+import { useQuery } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { withError } from '@/react-tools/react-query';
+import axios from '@/portainer/services/axios/axios';
+
+import { parseKubernetesAxiosError } from '../axiosError';
+
+const queryKeys = {
+  jobsForCluster: (environmentId: EnvironmentId) => [
+    'environments',
+    environmentId,
+    'kubernetes',
+    'jobs',
+  ],
+};
+
+export function useJobs(environmentId: EnvironmentId, namespaces?: string[]) {
+  return useQuery(
+    queryKeys.jobsForCluster(environmentId),
+    () => getJobsForCluster(environmentId, namespaces),
+    {
+      ...withError('Unable to retrieve Jobs'),
+      enabled: !!namespaces?.length,
+    }
+  );
+}
+
+export async function getJobsForCluster(
+  environmentId: EnvironmentId,
+  namespaceNames?: string[]
+) {
+  if (!namespaceNames) {
+    return [];
+  }
+  const jobs = await Promise.all(
+    namespaceNames.map((namespace) =>
+      getNamespaceJobs(environmentId, namespace)
+    )
+  );
+  return jobs.flat();
+}
+
+export async function getNamespaceJobs(
+  environmentId: EnvironmentId,
+  namespace: string,
+  labelSelector?: string
+) {
+  try {
+    const { data } = await axios.get<JobList>(
+      `/endpoints/${environmentId}/kubernetes/apis/batch/v1/namespaces/${namespace}/jobs`,
+      {
+        params: {
+          labelSelector,
+        },
+      }
+    );
+    const items = (data.items || []).map(
+      (job) =>
+        <Job>{
+          ...job,
+          kind: 'Job',
+          apiVersion: data.apiVersion,
+        }
+    );
+    return items;
+  } catch (e) {
+    throw parseKubernetesAxiosError(
+      e,
+      `Unable to retrieve Jobs in namespace '${namespace}'`
+    );
+  }
+}
diff --git a/app/react/kubernetes/applications/utils.ts b/app/react/kubernetes/applications/utils.ts
new file mode 100644
index 0000000..409c731
--- /dev/null
+++ b/app/react/kubernetes/applications/utils.ts
@@ -0,0 +1,281 @@
+import {
+  Deployment,
+  DaemonSet,
+  StatefulSet,
+  ReplicaSet,
+  ReplicaSetList,
+  ControllerRevisionList,
+  ControllerRevision,
+} from 'kubernetes-types/apps/v1';
+import { Pod } from 'kubernetes-types/core/v1';
+
+import { parseCPU, safeFilesizeParser } from '@/react/kubernetes/utils';
+
+import { Application, ApplicationPatch, Revision } from './types';
+import {
+  appOwnerLabel,
+  defaultDeploymentUniqueLabel,
+  unchangedAnnotationKeysForRollbackPatch,
+  appRevisionAnnotation,
+} from './constants';
+
+// type guard to check if an application is a deployment, daemonset, statefulset or pod
+export function applicationIsKind<T extends Application>(
+  appKind: 'Deployment' | 'DaemonSet' | 'StatefulSet' | 'Pod',
+  application?: Application
+): application is T {
+  return application?.kind === appKind;
+}
+
+// the application is external if it has no owner label
+export function isExternalApplication(application: Application) {
+  return !application.metadata?.labels?.[appOwnerLabel];
+}
+
+function getDeploymentRunningPods(deployment: Deployment): number {
+  const availableReplicas = deployment.status?.availableReplicas ?? 0;
+  const totalReplicas = deployment.spec?.replicas ?? 0;
+  const unavailableReplicas = deployment.status?.unavailableReplicas ?? 0;
+  return availableReplicas || totalReplicas - unavailableReplicas;
+}
+
+function getDaemonSetRunningPods(daemonSet: DaemonSet): number {
+  const numberAvailable = daemonSet.status?.numberAvailable ?? 0;
+  const desiredNumberScheduled = daemonSet.status?.desiredNumberScheduled ?? 0;
+  const numberUnavailable = daemonSet.status?.numberUnavailable ?? 0;
+  return numberAvailable || desiredNumberScheduled - numberUnavailable;
+}
+
+function getStatefulSetRunningPods(statefulSet: StatefulSet): number {
+  return statefulSet.status?.readyReplicas ?? 0;
+}
+
+export function getRunningPods(
+  application: Deployment | DaemonSet | StatefulSet
+): number {
+  switch (application.kind) {
+    case 'Deployment':
+      return getDeploymentRunningPods(application);
+    case 'DaemonSet':
+      return getDaemonSetRunningPods(application);
+    case 'StatefulSet':
+      return getStatefulSetRunningPods(application);
+    default:
+      throw new Error('Unknown application type');
+  }
+}
+
+export function getTotalPods(
+  application: Deployment | DaemonSet | StatefulSet
+): number {
+  switch (application.kind) {
+    case 'Deployment':
+    case 'StatefulSet':
+      return application.spec?.replicas ?? 0;
+    case 'DaemonSet':
+      return application.status?.desiredNumberScheduled ?? 0;
+    default:
+      throw new Error('Unknown application type');
+  }
+}
+
+// getResourceRequests returns the total cpu and memory requests for all containers in an application
+export function getResourceRequests(application: Application) {
+  const appContainers = applicationIsKind<Pod>('Pod', application)
+    ? application.spec?.containers
+    : application.spec?.template.spec?.containers;
+
+  if (!appContainers) return null;
+
+  const requests = appContainers.reduce(
+    (acc, container) => {
+      const cpu = container.resources?.requests?.cpu;
+      const memory = container.resources?.requests?.memory;
+      if (cpu) acc.cpu += parseCPU(cpu);
+      if (memory) acc.memoryBytes += safeFilesizeParser(memory);
+      return acc;
+    },
+    { cpu: 0, memoryBytes: 0 }
+  );
+
+  return requests;
+}
+
+// getResourceLimits returns the total cpu and memory limits for all containers in an application
+export function getResourceLimits(application: Application) {
+  const appContainers = applicationIsKind<Pod>('Pod', application)
+    ? application.spec?.containers
+    : application.spec?.template.spec?.containers;
+
+  if (!appContainers) return null;
+
+  const limits = appContainers.reduce(
+    (acc, container) => {
+      const cpu = container.resources?.limits?.cpu;
+      const memory = container.resources?.limits?.memory;
+      if (cpu) acc.cpu += parseCPU(cpu);
+      if (memory) acc.memory += safeFilesizeParser(memory);
+      return acc;
+    },
+    { cpu: 0, memory: 0 }
+  );
+
+  return limits;
+}
+
+// matchLabelsToLabelSelectorValue converts a map of labels to a label selector value that can be used in the
+// labelSelector param for the kube api to filter kube resources by labels
+export function matchLabelsToLabelSelectorValue(obj?: Record<string, string>) {
+  if (!obj) return '';
+  return Object.entries(obj)
+    .map(([key, value]) => `${key}=${value}`)
+    .join(',');
+}
+
+// filterRevisionsByOwnerUid filters a list of revisions to only include revisions that have the given uid in their
+// ownerReferences
+export function filterRevisionsByOwnerUid<T extends Revision>(
+  revisions: T[],
+  uid: string
+) {
+  return revisions.filter((revision) => {
+    const ownerReferencesUids =
+      revision.metadata?.ownerReferences?.map((or) => or.uid) || [];
+    return ownerReferencesUids.includes(uid);
+  });
+}
+
+// getRollbackPatchPayload returns the patch payload to rollback a deployment to the previous revision
+// the patch should be able to update the deployment's template to the previous revision's template
+export function getRollbackPatchPayload(
+  application: Deployment | StatefulSet | DaemonSet,
+  revisionList: ReplicaSetList | ControllerRevisionList
+): ApplicationPatch {
+  switch (revisionList.kind) {
+    case 'ControllerRevisionList': {
+      const previousRevision = getPreviousControllerRevision(
+        revisionList.items
+      );
+      if (!previousRevision.data) {
+        throw new Error('No data found in the previous revision.');
+      }
+      // payload matches the strategic merge patch format for a StatefulSet and DaemonSet
+      return previousRevision.data;
+    }
+    case 'ReplicaSetList': {
+      const previousRevision = getPreviousReplicaSetRevision(
+        revisionList.items
+      );
+
+      // remove hash label before patching back into the deployment
+      const revisionTemplate = previousRevision.spec?.template;
+      if (revisionTemplate?.metadata?.labels) {
+        delete revisionTemplate.metadata.labels[defaultDeploymentUniqueLabel];
+      }
+
+      // build the patch payload for the deployment from the replica set
+      // keep the annotations to skip from the deployment, in the patch
+      const applicationAnnotations = application.metadata?.annotations || {};
+      const applicationAnnotationsInPatch =
+        unchangedAnnotationKeysForRollbackPatch.reduce(
+          (acc, annotationKey) => {
+            if (applicationAnnotations[annotationKey]) {
+              acc[annotationKey] = applicationAnnotations[annotationKey];
+            }
+            return acc;
+          },
+          {} as Record<string, string>
+        );
+
+      // add any annotations from the target revision that shouldn't be skipped
+      const revisionAnnotations = previousRevision.metadata?.annotations || {};
+      const revisionAnnotationsInPatch = Object.entries(
+        revisionAnnotations
+      ).reduce(
+        (acc, [annotationKey, annotationValue]) => {
+          if (
+            !unchangedAnnotationKeysForRollbackPatch.includes(annotationKey)
+          ) {
+            acc[annotationKey] = annotationValue;
+          }
+          return acc;
+        },
+        {} as Record<string, string>
+      );
+
+      const patchAnnotations = {
+        ...applicationAnnotationsInPatch,
+        ...revisionAnnotationsInPatch,
+      };
+
+      // Create a patch of the Deployment that replaces spec.template
+      const deploymentRollbackPatch = [
+        {
+          op: 'replace',
+          path: '/spec/template',
+          value: revisionTemplate,
+        },
+        {
+          op: 'replace',
+          path: '/metadata/annotations',
+          value: patchAnnotations,
+        },
+      ].filter((p) => !!p.value); // remove any patch that has no value
+      // payload matches the json patch format for a Deployment
+      return deploymentRollbackPatch;
+    }
+    default:
+      throw new Error(`Unknown revision list kind ${revisionList.kind}.`);
+  }
+}
+
+function getPreviousReplicaSetRevision(replicaSets: ReplicaSet[]) {
+  // sort replicaset(s) using the revision annotation number (old to new).
+  // Kubectl uses the same revision annotation key to determine the previous version
+  // (see the Revision function, and where it's used https://github.com/kubernetes/kubectl/blob/27ec3dafa658d8873b3d9287421d636048b51921/pkg/util/deployment/deployment.go#LL70C11-L70C11)
+  const sortedReplicaSets = replicaSets.sort((a, b) => {
+    const aRevision =
+      Number(a.metadata?.annotations?.[appRevisionAnnotation]) || 0;
+    const bRevision =
+      Number(b.metadata?.annotations?.[appRevisionAnnotation]) || 0;
+    return aRevision - bRevision;
+  });
+
+  // if there are less than 2 revisions, there is no previous revision to rollback to
+  if (sortedReplicaSets.length < 2) {
+    throw new Error(
+      'There are no previous revisions to rollback to. Please check the application revisions.'
+    );
+  }
+
+  // get the second to last revision
+  const previousRevision = sortedReplicaSets[sortedReplicaSets.length - 2];
+  return previousRevision;
+}
+
+function getPreviousControllerRevision(
+  controllerRevisions: ControllerRevision[]
+) {
+  // sort the list of ControllerRevisions by revision, using the creationTimestamp as a tie breaker (old to new)
+  const sortedControllerRevisions = controllerRevisions.sort((a, b) => {
+    if (a.revision === b.revision) {
+      return (
+        new Date(a.metadata?.creationTimestamp || '').getTime() -
+        new Date(b.metadata?.creationTimestamp || '').getTime()
+      );
+    }
+    return a.revision - b.revision;
+  });
+
+  // if there are less than 2 revisions, there is no previous revision to rollback to
+  if (sortedControllerRevisions.length < 2) {
+    throw new Error(
+      'There are no previous revisions to rollback to. Please check the application revisions.'
+    );
+  }
+
+  // get the second to last revision
+  const previousRevision =
+    sortedControllerRevisions[sortedControllerRevisions.length - 2];
+  return previousRevision;
+}
diff --git a/app/react/kubernetes/applications/utils/cpuHumanValue.ts b/app/react/kubernetes/applications/utils/cpuHumanValue.ts
new file mode 100644
index 0000000..d5d611e
--- /dev/null
+++ b/app/react/kubernetes/applications/utils/cpuHumanValue.ts
@@ -0,0 +1,5 @@
+import _ from 'lodash';
+
+export function cpuHumanValue(value: number) {
+  return _.round(value, 2);
+}
diff --git a/app/react/kubernetes/axiosError.ts b/app/react/kubernetes/axiosError.ts
new file mode 100644
index 0000000..900b716
--- /dev/null
+++ b/app/react/kubernetes/axiosError.ts
@@ -0,0 +1,28 @@
+import { Status } from 'kubernetes-types/meta/v1';
+import { AxiosError } from 'axios';
+
+import {
+  defaultErrorParser,
+  parseAxiosError,
+} from '../portainer/services/axios/utils/parseAxiosError';
+
+export function kubernetesErrorParser(axiosError: AxiosError) {
+  const responseStatus = axiosError.response?.data as Status;
+  if (responseStatus?.message) {
+    return {
+      error: new Error(responseStatus.message),
+      details: responseStatus.message,
+    };
+  }
+  return defaultErrorParser(axiosError);
+}
+
+/**
+ * Parses an Axios error response from the Kubernetes API.
+ * @param err The Axios error object.
+ * @param msg An optional error message to prepend.
+ * @returns An error object with an error message and details.
+ */
+export function parseKubernetesAxiosError(err: unknown, msg = '') {
+  return parseAxiosError(err, msg, kubernetesErrorParser);
+}
diff --git a/app/react/kubernetes/cluster/ClusterView/ClusterResourceReservation.test.tsx b/app/react/kubernetes/cluster/ClusterView/ClusterResourceReservation.test.tsx
new file mode 100644
index 0000000..454d467
--- /dev/null
+++ b/app/react/kubernetes/cluster/ClusterView/ClusterResourceReservation.test.tsx
@@ -0,0 +1,211 @@
+import { render, screen, within } from '@testing-library/react';
+import { HttpResponse } from 'msw';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { server, http } from '@/setup-tests/server';
+import {
+  createMockEnvironment,
+  createMockQueryResult,
+} from '@/react-tools/test-mocks';
+
+import { ClusterResourceReservation } from './ClusterResourceReservation';
+
+const mockUseAuthorizations = vi.fn();
+const mockUseEnvironmentId = vi.fn(() => 3);
+const mockUseCurrentEnvironment = vi.fn();
+
+// Set up mock implementations for hooks
+vi.mock('@/react/hooks/useUser', () => ({
+  useAuthorizations: () => mockUseAuthorizations(),
+}));
+
+vi.mock('@/react/hooks/useEnvironmentId', () => ({
+  useEnvironmentId: () => mockUseEnvironmentId(),
+}));
+
+vi.mock('@/react/hooks/useCurrentEnvironment', () => ({
+  useCurrentEnvironment: () => mockUseCurrentEnvironment(),
+}));
+
+function renderComponent() {
+  const Wrapped = withTestQueryProvider(ClusterResourceReservation);
+  return render(<Wrapped />);
+}
+
+describe('ClusterResourceReservation', () => {
+  beforeEach(() => {
+    // Set the return values for the hooks
+    mockUseAuthorizations.mockReturnValue({
+      authorized: true,
+      isLoading: false,
+    });
+
+    mockUseEnvironmentId.mockReturnValue(3);
+
+    const mockEnvironment = createMockEnvironment();
+    mockEnvironment.Kubernetes.Configuration.UseServerMetrics = true;
+    mockUseCurrentEnvironment.mockReturnValue(
+      createMockQueryResult(mockEnvironment)
+    );
+
+    // Setup default mock responses
+    server.use(
+      http.get('/api/kubernetes/3/nodes', () =>
+        HttpResponse.json([
+          {
+            status: {
+              allocatable: {
+                cpu: '4',
+                memory: '8Gi',
+              },
+            },
+          },
+        ])
+      ),
+      http.get('/api/kubernetes/3/metrics/nodes', () =>
+        HttpResponse.json({
+          items: [
+            {
+              usage: {
+                cpu: '2',
+                memory: '4Gi',
+              },
+            },
+          ],
+        })
+      ),
+      http.get('/api/kubernetes/3/metrics/applications_resources', () =>
+        HttpResponse.json({
+          CpuRequest: 1,
+          MemoryRequest: '2Gi',
+        })
+      )
+    );
+  });
+
+  it('should display resource limits, reservations and usage when all APIs respond successfully', async () => {
+    renderComponent();
+
+    expect(
+      await within(await screen.findByTestId('memory-reservation')).findByText(
+        '2048 / 8192 MiB - 25%'
+      )
+    ).toBeVisible();
+
+    expect(
+      await within(await screen.findByTestId('memory-usage')).findByText(
+        '4096 / 8192 MiB - 50%'
+      )
+    ).toBeVisible();
+
+    expect(
+      await within(await screen.findByTestId('cpu-reservation')).findByText(
+        '1 / 4 - 25%'
+      )
+    ).toBeVisible();
+
+    expect(
+      await within(await screen.findByTestId('cpu-usage')).findByText(
+        '2 / 4 - 50%'
+      )
+    ).toBeVisible();
+  });
+
+  it('should not display resource usage if user does not have K8sClusterNodeR authorization', async () => {
+    mockUseAuthorizations.mockReturnValue({
+      authorized: false,
+      isLoading: false,
+    });
+
+    renderComponent();
+
+    // Should only show reservation bars
+    expect(
+      await within(await screen.findByTestId('memory-reservation')).findByText(
+        '2048 / 8192 MiB - 25%'
+      )
+    ).toBeVisible();
+
+    expect(
+      await within(await screen.findByTestId('cpu-reservation')).findByText(
+        '1 / 4 - 25%'
+      )
+    ).toBeVisible();
+
+    // Usage bars should not be present
+    expect(screen.queryByTestId('memory-usage')).not.toBeInTheDocument();
+    expect(screen.queryByTestId('cpu-usage')).not.toBeInTheDocument();
+  });
+
+  it('should not display resource usage if metrics server is not enabled', async () => {
+    const disabledMetricsEnvironment = createMockEnvironment();
+    disabledMetricsEnvironment.Kubernetes.Configuration.UseServerMetrics = false;
+    mockUseCurrentEnvironment.mockReturnValue(
+      createMockQueryResult(disabledMetricsEnvironment)
+    );
+
+    renderComponent();
+
+    // Should only show reservation bars
+    expect(
+      await within(await screen.findByTestId('memory-reservation')).findByText(
+        '2048 / 8192 MiB - 25%'
+      )
+    ).toBeVisible();
+
+    expect(
+      await within(await screen.findByTestId('cpu-reservation')).findByText(
+        '1 / 4 - 25%'
+      )
+    ).toBeVisible();
+
+    // Usage bars should not be present
+    expect(screen.queryByTestId('memory-usage')).not.toBeInTheDocument();
+    expect(screen.queryByTestId('cpu-usage')).not.toBeInTheDocument();
+  });
+
+  it('should display warning if metrics server is enabled but usage query fails', async () => {
+    server.use(
+      http.get('/api/kubernetes/3/metrics/nodes', () => HttpResponse.error())
+    );
+
+    // Mock console.error so test logs are not polluted
+    vi.spyOn(console, 'error').mockImplementation(() => {});
+
+    renderComponent();
+
+    expect(
+      await within(await screen.findByTestId('memory-reservation')).findByText(
+        '2048 / 8192 MiB - 25%'
+      )
+    ).toBeVisible();
+
+    expect(
+      await within(await screen.findByTestId('memory-usage')).findByText(
+        '0 / 8192 MiB - 0%'
+      )
+    ).toBeVisible();
+
+    expect(
+      await within(await screen.findByTestId('cpu-reservation')).findByText(
+        '1 / 4 - 25%'
+      )
+    ).toBeVisible();
+
+    expect(
+      await within(await screen.findByTestId('cpu-usage')).findByText(
+        '0 / 4 - 0%'
+      )
+    ).toBeVisible();
+
+    // Should show the warning message
+    expect(
+      await screen.findByText(
+        /Resource usage is not currently available as Metrics Server is not responding/
+      )
+    ).toBeVisible();
+
+    // Restore console.error
+    vi.spyOn(console, 'error').mockRestore();
+  });
+});
diff --git a/app/react/kubernetes/cluster/ClusterView/ClusterResourceReservation.tsx b/app/react/kubernetes/cluster/ClusterView/ClusterResourceReservation.tsx
new file mode 100644
index 0000000..bbca6ff
--- /dev/null
+++ b/app/react/kubernetes/cluster/ClusterView/ClusterResourceReservation.tsx
@@ -0,0 +1,40 @@
+import { Widget, WidgetBody } from '@/react/components/Widget';
+import { ResourceReservation } from '@/react/kubernetes/components/ResourceReservation';
+
+import { useClusterResourceReservationData } from './useClusterResourceReservationData';
+
+export function ClusterResourceReservation() {
+  // Load all data required for this component
+  const {
+    cpuLimit,
+    memoryLimit,
+    isLoading,
+    displayResourceUsage,
+    resourceUsage,
+    resourceReservation,
+    displayWarning,
+  } = useClusterResourceReservationData();
+
+  return (
+    <div className="row">
+      <div className="col-sm-12">
+        <Widget>
+          <WidgetBody>
+            <ResourceReservation
+              isLoading={isLoading}
+              displayResourceUsage={displayResourceUsage}
+              resourceReservation={resourceReservation}
+              resourceUsage={resourceUsage}
+              cpuLimit={cpuLimit}
+              memoryLimit={memoryLimit}
+              memoryUnit="MiB"
+              description="Resource reservation represents the total amount of resource assigned to all the applications inside the cluster."
+              displayWarning={displayWarning}
+              warningMessage="Resource usage is not currently available as Metrics Server is not responding. If you've recently upgraded, Metrics Server may take a while to restart, so please check back shortly."
+            />
+          </WidgetBody>
+        </Widget>
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/kubernetes/cluster/ClusterView/ClusterView.tsx b/app/react/kubernetes/cluster/ClusterView/ClusterView.tsx
new file mode 100644
index 0000000..57cd3ca
--- /dev/null
+++ b/app/react/kubernetes/cluster/ClusterView/ClusterView.tsx
@@ -0,0 +1,33 @@
+import { useCurrentEnvironment } from '@/react/hooks/useCurrentEnvironment';
+import { PageHeader } from '@/react/components/PageHeader';
+import { NodesDatatable } from '@/react/kubernetes/cluster/HomeView/NodesDatatable';
+
+import { ClusterResourceReservation } from './ClusterResourceReservation';
+
+export function ClusterView() {
+  const { data: environment } = useCurrentEnvironment();
+
+  return (
+    <>
+      <PageHeader
+        title="Cluster"
+        breadcrumbs={[
+          { label: 'Environments', link: 'portainer.endpoints' },
+          {
+            label: environment?.Name || '',
+            link: 'portainer.endpoints.endpoint',
+            linkParams: { id: environment?.Id },
+          },
+          'Cluster information',
+        ]}
+        reload
+      />
+
+      <ClusterResourceReservation />
+
+      <div className="row">
+        <NodesDatatable />
+      </div>
+    </>
+  );
+}
diff --git a/app/react/kubernetes/cluster/ClusterView/index.ts b/app/react/kubernetes/cluster/ClusterView/index.ts
new file mode 100644
index 0000000..d9b624c
--- /dev/null
+++ b/app/react/kubernetes/cluster/ClusterView/index.ts
@@ -0,0 +1 @@
+export { ClusterView } from './ClusterView';
diff --git a/app/react/kubernetes/cluster/ClusterView/queries/index.ts b/app/react/kubernetes/cluster/ClusterView/queries/index.ts
new file mode 100644
index 0000000..f4d8693
--- /dev/null
+++ b/app/react/kubernetes/cluster/ClusterView/queries/index.ts
@@ -0,0 +1,3 @@
+export * from './useClusterResourceLimitsQuery';
+export * from './useClusterResourceReservationQuery';
+export * from './useClusterResourceUsageQuery';
diff --git a/app/react/kubernetes/cluster/ClusterView/queries/useClusterResourceLimitsQuery.ts b/app/react/kubernetes/cluster/ClusterView/queries/useClusterResourceLimitsQuery.ts
new file mode 100644
index 0000000..e85c99a
--- /dev/null
+++ b/app/react/kubernetes/cluster/ClusterView/queries/useClusterResourceLimitsQuery.ts
@@ -0,0 +1,47 @@
+import { round, reduce } from 'lodash';
+import filesizeParser from 'filesize-parser';
+import { useQuery } from '@tanstack/react-query';
+import { Node } from 'kubernetes-types/core/v1';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { withError } from '@/react-tools/react-query';
+import { getMebibytes, parseCPU } from '@/react/kubernetes/utils';
+
+import { getNodes } from '../../queries/useNodesQuery';
+
+export function useClusterResourceLimitsQuery(environmentId: EnvironmentId) {
+  return useQuery(
+    [environmentId, 'clusterResourceLimits'],
+    async () => getNodes(environmentId),
+    {
+      ...withError('Unable to retrieve resource limit data', 'Failure'),
+      enabled: !!environmentId,
+      select: aggregateResourceLimits,
+    }
+  );
+}
+
+/**
+ * Processes node data to calculate total CPU and memory limits for the cluster
+ * and sets the state for memory limit in MB and CPU limit rounded to 3 decimal places.
+ */
+function aggregateResourceLimits(nodes: Node[]) {
+  const processedNodes = nodes.map((node) => ({
+    ...node,
+    memory: filesizeParser(node.status?.allocatable?.memory ?? ''),
+    cpu: parseCPU(node.status?.allocatable?.cpu ?? ''),
+  }));
+
+  return {
+    nodes: processedNodes,
+    memoryLimit: reduce(
+      processedNodes,
+      (acc, node) => getMebibytes(node.memory || 0) + acc,
+      0
+    ),
+    cpuLimit: round(
+      reduce(processedNodes, (acc, node) => (node.cpu || 0) + acc, 0),
+      3
+    ),
+  };
+}
diff --git a/app/react/kubernetes/cluster/ClusterView/queries/useClusterResourceReservationQuery.ts b/app/react/kubernetes/cluster/ClusterView/queries/useClusterResourceReservationQuery.ts
new file mode 100644
index 0000000..555be2d
--- /dev/null
+++ b/app/react/kubernetes/cluster/ClusterView/queries/useClusterResourceReservationQuery.ts
@@ -0,0 +1,28 @@
+import { useQuery } from '@tanstack/react-query';
+import { Node } from 'kubernetes-types/core/v1';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { getTotalResourcesForAllApplications } from '@/react/kubernetes/metrics/queries/useMetricsForApplications';
+import { getMebibytes, safeFilesizeParser } from '@/react/kubernetes/utils';
+
+export function useClusterResourceReservationQuery(
+  environmentId: EnvironmentId,
+  nodes: Node[]
+) {
+  return useQuery(
+    [environmentId, 'clusterResourceReservation'],
+    () => getTotalResourcesForAllApplications(environmentId),
+    {
+      enabled: !!environmentId && nodes.length > 0,
+      select: (data) => ({
+        cpu: data.CpuRequest,
+        // MemoryRequest may be a string like "2Gi"; convert to bytes first
+        memory: getMebibytes(
+          typeof data.MemoryRequest === 'number'
+            ? data.MemoryRequest
+            : safeFilesizeParser(data.MemoryRequest)
+        ),
+      }),
+    }
+  );
+}
diff --git a/app/react/kubernetes/cluster/ClusterView/queries/useClusterResourceUsageQuery.ts b/app/react/kubernetes/cluster/ClusterView/queries/useClusterResourceUsageQuery.ts
new file mode 100644
index 0000000..4760326
--- /dev/null
+++ b/app/react/kubernetes/cluster/ClusterView/queries/useClusterResourceUsageQuery.ts
@@ -0,0 +1,44 @@
+import { useQuery } from '@tanstack/react-query';
+import { Node } from 'kubernetes-types/core/v1';
+import filesizeParser from 'filesize-parser';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { getMetricsForAllNodes } from '@/react/kubernetes/metrics/metrics';
+import { withError } from '@/react-tools/react-query';
+import { NodeMetrics } from '@/react/kubernetes/metrics/types';
+import { getMebibytes, parseCPU } from '@/react/kubernetes/utils';
+
+export function useClusterResourceUsageQuery(
+  environmentId: EnvironmentId,
+  serverMetricsEnabled: boolean,
+  authorized: boolean,
+  nodes: Node[]
+) {
+  return useQuery(
+    [environmentId, 'clusterResourceUsage'],
+    () => getMetricsForAllNodes(environmentId),
+    {
+      enabled:
+        authorized &&
+        serverMetricsEnabled &&
+        !!environmentId &&
+        nodes.length > 0,
+      select: aggregateResourceUsage,
+      ...withError('Unable to retrieve resource usage data.', 'Failure'),
+    }
+  );
+}
+
+function aggregateResourceUsage(data: NodeMetrics) {
+  return data.items.reduce(
+    (total, item) => ({
+      cpu: total.cpu + parseCPU(item.usage.cpu),
+      // item.usage.memory is a string with a KiB unit. Get the bytes then the MiB
+      memory: total.memory + getMebibytes(filesizeParser(item.usage.memory)),
+    }),
+    {
+      cpu: 0,
+      memory: 0,
+    }
+  );
+}
diff --git a/app/react/kubernetes/cluster/ClusterView/useClusterResourceReservationData.tsx b/app/react/kubernetes/cluster/ClusterView/useClusterResourceReservationData.tsx
new file mode 100644
index 0000000..276c7ff
--- /dev/null
+++ b/app/react/kubernetes/cluster/ClusterView/useClusterResourceReservationData.tsx
@@ -0,0 +1,72 @@
+import { useAuthorizations } from '@/react/hooks/useUser';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { getSafeValue } from '@/react/kubernetes/utils';
+import { useCurrentEnvironment } from '@/react/hooks/useCurrentEnvironment';
+
+import {
+  useClusterResourceLimitsQuery,
+  useClusterResourceReservationQuery,
+  useClusterResourceUsageQuery,
+} from './queries';
+
+export function useClusterResourceReservationData() {
+  const { data: environment } = useCurrentEnvironment();
+  const environmentId = useEnvironmentId();
+
+  // Check if server metrics is enabled
+  const serverMetricsEnabled =
+    environment?.Kubernetes?.Configuration?.UseServerMetrics || false;
+
+  // User needs to have K8sClusterNodeR authorization to view resource usage data
+  const { authorized: hasK8sClusterNodeR } = useAuthorizations(
+    ['K8sClusterNodeR'],
+    undefined,
+    true
+  );
+
+  // Get resource limits for the cluster
+  const { data: resourceLimits, isLoading: isResourceLimitLoading } =
+    useClusterResourceLimitsQuery(environmentId);
+
+  // Get resource reservation info for the cluster
+  const {
+    data: resourceReservation,
+    isFetching: isResourceReservationLoading,
+  } = useClusterResourceReservationQuery(
+    environmentId,
+    resourceLimits?.nodes || []
+  );
+
+  // Get resource usage info for the cluster
+  const {
+    data: resourceUsage,
+    isFetching: isResourceUsageLoading,
+    isError: isResourceUsageError,
+  } = useClusterResourceUsageQuery(
+    environmentId,
+    serverMetricsEnabled,
+    hasK8sClusterNodeR,
+    resourceLimits?.nodes || []
+  );
+
+  return {
+    memoryLimit: getSafeValue(resourceLimits?.memoryLimit || 0),
+    cpuLimit: getSafeValue(resourceLimits?.cpuLimit || 0),
+    displayResourceUsage: hasK8sClusterNodeR && serverMetricsEnabled,
+    resourceUsage: {
+      cpu: getSafeValue(resourceUsage?.cpu || 0),
+      memory: getSafeValue(resourceUsage?.memory || 0),
+    },
+    resourceReservation: {
+      cpu: getSafeValue(resourceReservation?.cpu || 0),
+      memory: getSafeValue(resourceReservation?.memory || 0),
+    },
+    isLoading:
+      isResourceLimitLoading ||
+      isResourceReservationLoading ||
+      isResourceUsageLoading,
+    // Display warning if server metrics isn't responding but should be
+    displayWarning:
+      hasK8sClusterNodeR && serverMetricsEnabled && isResourceUsageError,
+  };
+}
diff --git a/app/react/kubernetes/cluster/ConfigureView/ConfigureForm/ConfigureForm.tsx b/app/react/kubernetes/cluster/ConfigureView/ConfigureForm/ConfigureForm.tsx
new file mode 100644
index 0000000..4d67f96
--- /dev/null
+++ b/app/react/kubernetes/cluster/ConfigureView/ConfigureForm/ConfigureForm.tsx
@@ -0,0 +1,468 @@
+import { Formik, Form, FormikProps, FormikHelpers } from 'formik';
+import { useCallback, useEffect, useMemo } from 'react';
+import _ from 'lodash';
+import { useTransitionHook } from '@uirouter/react';
+
+import { useCurrentEnvironment } from '@/react/hooks/useCurrentEnvironment';
+import { IngressClassDatatable } from '@/react/kubernetes/cluster/ingressClass/IngressClassDatatable';
+import {
+  Environment,
+  EnvironmentId,
+} from '@/react/portainer/environments/types';
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+
+import { FormSection } from '@@/form-components/FormSection';
+import { TextTip } from '@@/Tip/TextTip';
+import { SwitchField } from '@@/form-components/SwitchField';
+import { FormActions } from '@@/form-components/FormActions';
+import { confirmGenericDiscard } from '@@/modals/confirm';
+import { InsightsBox } from '@@/InsightsBox';
+
+import { useIngressControllerClassMapQuery } from '../../ingressClass/useIngressControllerClassMap';
+import { IngressControllerClassMap } from '../../ingressClass/types';
+import { useIsRBACEnabled } from '../../useIsRBACEnabled';
+import { getIngressClassesFormValues } from '../../ingressClass/IngressClassDatatable/utils';
+
+import { useStorageClassesFormValues } from './useStorageClasses';
+import { ConfigureFormValues, StorageClassFormValues } from './types';
+import { configureValidationSchema } from './validation';
+import { RBACAlert } from './RBACAlert';
+import { EnableMetricsInput } from './EnableMetricsInput';
+import { StorageClassDatatable } from './StorageClassDatatable';
+import { useConfigureClusterMutation } from './useConfigureClusterMutation';
+import { handleSubmitConfigureCluster } from './handleSubmitConfigureCluster';
+
+export function ConfigureForm() {
+  const configureClusterMutation = useConfigureClusterMutation();
+  // get the initial values
+  const { data: environment } = useCurrentEnvironment();
+  const { data: storageClassFormValues } =
+    useStorageClassesFormValues(environment);
+  const { data: ingressClasses, ...ingressClassesQuery } =
+    useIngressControllerClassMapQuery({
+      environmentId: environment?.Id,
+    });
+  const initialValues = useInitialValues(
+    environment,
+    storageClassFormValues,
+    ingressClasses
+  );
+
+  // Wait for ingress classes before rendering; enableReinitialize would otherwise re-seed the form once the late query lands and discard in-flight edits (QE-4214)
+  if (!initialValues || !environment || ingressClassesQuery.isLoading) {
+    return null;
+  }
+
+  return (
+    <Formik<ConfigureFormValues>
+      initialValues={initialValues}
+      onSubmit={(
+        values: ConfigureFormValues,
+        formikHelpers: FormikHelpers<ConfigureFormValues>
+      ) => {
+        handleSubmitConfigureCluster(
+          values,
+          initialValues,
+          configureClusterMutation,
+          formikHelpers,
+          environment
+        );
+      }}
+      validationSchema={configureValidationSchema}
+      validateOnMount
+      enableReinitialize // enableReinitialize is needed to update the form values when the ingress classes data is fetched
+    >
+      {(formikProps) => (
+        <InnerForm
+          // eslint-disable-next-line react/jsx-props-no-spreading
+          {...formikProps}
+          isIngressClassesLoading={ingressClassesQuery.isLoading}
+          environmentId={environment.Id}
+        />
+      )}
+    </Formik>
+  );
+}
+
+function InnerForm({
+  initialValues,
+  setFieldValue,
+  isValid,
+  isSubmitting,
+  values,
+  errors,
+  isIngressClassesLoading,
+  environmentId,
+}: FormikProps<ConfigureFormValues> & {
+  isIngressClassesLoading: boolean;
+  environmentId: EnvironmentId;
+}) {
+  const { data: isRBACEnabled, ...isRBACEnabledQuery } =
+    useIsRBACEnabled(environmentId);
+
+  const onChangeControllers = useCallback(
+    (controllerClassMap: IngressControllerClassMap[]) =>
+      setFieldValue('ingressClasses', controllerClassMap),
+    [setFieldValue]
+  );
+
+  // when navigating away from the page with unsaved changes, show a portainer prompt to confirm
+  useTransitionHook('onBefore', {}, async () => {
+    if (!isFormChanged(values, initialValues)) {
+      return true;
+    }
+    const confirmed = await confirmGenericDiscard();
+    return confirmed;
+  });
+
+  // when reloading or exiting the page with unsaved changes, show a browser prompt to confirm
+  useEffect(() => {
+    // the handler for showing the prompt
+    // https://developer.mozilla.org/en-US/docs/Web/API/WindowEventHandlers/onbeforeunload
+    function handler(event: BeforeUnloadEvent) {
+      event.preventDefault();
+      // eslint-disable-next-line no-param-reassign
+      event.returnValue = '';
+    }
+
+    // if the form is changed, then set the onbeforeunload
+    if (isFormChanged(values, initialValues)) {
+      window.addEventListener('beforeunload', handler);
+      return () => {
+        window.removeEventListener('beforeunload', handler);
+      };
+    }
+    return () => {};
+  }, [values, initialValues]);
+
+  return (
+    <Form className="form-horizontal">
+      <div className="flex flex-col">
+        <FormSection title="Networking - Services">
+          <div className="form-group">
+            <div className="col-sm-12">
+              <TextTip color="blue" inline={false}>
+                Enabling the load balancer feature will allow users to expose
+                applications they deploy over an external IP address assigned by
+                the cloud provider.
+              </TextTip>
+            </div>
+          </div>
+          <div className="form-group">
+            <div className="col-sm-12">
+              <TextTip color="orange" inline={false}>
+                If you want to use this feature, ensure your cloud provider
+                allows you to create load balancers. This may incur costs.
+              </TextTip>
+            </div>
+          </div>
+          <div className="form-group">
+            <div className="col-sm-12">
+              <SwitchField
+                name="useLoadBalancer"
+                data-cy="kubeSetup-loadBalancerToggle"
+                label="Allow users to use external load balancers"
+                labelClass="col-sm-5 col-lg-4"
+                checked={values.useLoadBalancer}
+                onChange={(checked) =>
+                  setFieldValue('useLoadBalancer', checked)
+                }
+              />
+            </div>
+          </div>
+        </FormSection>
+        <FormSection title="Networking - Ingresses">
+          <IngressClassDatatable
+            onChange={onChangeControllers}
+            description="Enabling ingress controllers in your cluster allows them to be available in the Portainer UI for users to publish applications over HTTP/HTTPS. A controller must have a class name for it to be included here."
+            values={values.ingressClasses}
+            initialValues={initialValues.ingressClasses}
+            isLoading={isIngressClassesLoading}
+            view="cluster"
+            noIngressControllerLabel="No supported ingress controllers found."
+          />
+          <div className="form-group">
+            <div className="col-sm-12">
+              <SwitchField
+                name="allowNoneIngressClass"
+                data-cy="kubeSetup-allowNoneIngressClass"
+                label='Allow ingress class to be set to "none"'
+                tooltip='This allows users setting up ingresses to select "none" as the ingress class.'
+                labelClass="col-sm-5 col-lg-4"
+                checked={values.allowNoneIngressClass}
+                onChange={(checked) => {
+                  setFieldValue('allowNoneIngressClass', checked);
+                  // add or remove the none ingress class from the ingress classes list
+                  if (checked) {
+                    setFieldValue(
+                      'ingressClasses',
+                      getIngressClassesFormValues(
+                        checked,
+                        initialValues.ingressClasses
+                      )
+                    );
+                  }
+                }}
+              />
+            </div>
+          </div>
+          <div className="form-group">
+            <div className="col-sm-12">
+              <SwitchField
+                name="ingressAvailabilityPerNamespace"
+                data-cy="kubeSetup-ingressAvailabilityPerNamespace"
+                label="Configure ingress controller availability per namespace"
+                tooltip="This allows an administrator to configure, in each namespace, which ingress controllers will be available for users to select when setting up ingresses for applications."
+                labelClass="col-sm-5 col-lg-4"
+                checked={values.ingressAvailabilityPerNamespace}
+                onChange={(checked) =>
+                  setFieldValue('ingressAvailabilityPerNamespace', checked)
+                }
+              />
+            </div>
+          </div>
+          <div className="form-group">
+            <div className="col-sm-12">
+              <SwitchField
+                name="restrictStandardUserIngressW"
+                data-cy="kubeSetup-restrictStandardUserIngressWToggle"
+                label="Only allow admins to deploy ingresses"
+                featureId={FeatureId.K8S_ADM_ONLY_USR_INGRESS_DEPLY}
+                tooltip="Enforces only allowing admins to deploy ingresses (and disallows standard users from doing so)."
+                labelClass="col-sm-5 col-lg-4"
+                checked={values.restrictStandardUserIngressW}
+                onChange={(checked) =>
+                  setFieldValue('restrictStandardUserIngressW', checked)
+                }
+              />
+            </div>
+          </div>
+          <div className="form-group">
+            <div className="col-sm-12">
+              <TextTip color="blue" inline={false}>
+                You may set up ingress defaults (hostnames and annotations) via
+                Create/Edit ingress. Users may then select them via the hostname
+                dropdown in Create/Edit application.
+              </TextTip>
+            </div>
+          </div>
+        </FormSection>
+        <FormSection title="Change Window Settings">
+          <div className="form-group">
+            <div className="col-sm-12">
+              <SwitchField
+                name="changeWindow.Enabled"
+                data-cy="kubeSetup-changeWindowEnabledToggle"
+                label="Enable Change Window"
+                tooltip="GitOps updates to stacks or applications outside the defined change window will not occur."
+                labelClass="col-sm-5 col-lg-4"
+                checked={false}
+                featureId={FeatureId.HIDE_AUTO_UPDATE_WINDOW}
+                onChange={() => {}}
+              />
+            </div>
+          </div>
+        </FormSection>
+        <FormSection title="Security">
+          <div className="form-group">
+            <div className="col-sm-12">
+              {!isRBACEnabled && isRBACEnabledQuery.isSuccess && <RBACAlert />}
+            </div>
+          </div>
+          <div className="form-group">
+            <div className="col-sm-12">
+              <TextTip color="blue" inline={false}>
+                <p>
+                  By default, all the users have access to the default
+                  namespace. Enable this option to set accesses on the default
+                  namespace.
+                </p>
+              </TextTip>
+            </div>
+          </div>
+          <div className="form-group">
+            <div className="col-sm-12">
+              <SwitchField
+                name="restrictDefaultNamespace"
+                data-cy="kubeSetup-restrictDefaultNsToggle"
+                label="Restrict access to the default namespace"
+                labelClass="col-sm-5 col-lg-4"
+                checked={values.restrictDefaultNamespace}
+                onChange={(checked) =>
+                  setFieldValue('restrictDefaultNamespace', checked)
+                }
+              />
+            </div>
+          </div>
+          <div className="form-group">
+            <div className="col-sm-12">
+              <SwitchField
+                name="restrictSecrets"
+                data-cy="kubeSetup-restrictSecretsToggle"
+                label="Restrict secret contents access for non-admins (UI only)"
+                tooltip="This hides the ability to view or edit in the UI the contents of secrets that a non-admin user did not create themselves but does not prevent it via the command line."
+                labelClass="col-sm-5 col-lg-4"
+                checked={false}
+                featureId={FeatureId.K8S_ADM_ONLY_SECRETS}
+                onChange={() => {}}
+              />
+            </div>
+          </div>
+        </FormSection>
+        <FormSection title="Resources and Metrics">
+          <InsightsBox
+            insightCloseId="resourceOverCommit"
+            className="mb-4"
+            header="Allow resource over-commit - UI-only change in 2.20"
+            content="Resource over-commit has always been ENABLED in Portainer CE. However, the toggle was incorrectly shown as OFF. This has now been corrected but please note that no functionality has been removed."
+          />
+          <div className="form-group">
+            <div className="col-sm-12">
+              <TextTip color="blue" inline={false}>
+                <p>
+                  By DISABLING resource over-commit (highly recommended), you
+                  can ONLY assign namespaces CPU and memory resources that are
+                  less (in aggregate) than the cluster total minus any system
+                  resource reservation.
+                </p>
+              </TextTip>
+            </div>
+          </div>
+          <div className="form-group">
+            <div className="col-sm-12">
+              <TextTip color="orange" inline={false}>
+                <p>
+                  By ENABLING resource over-commit, you can assign namespaces
+                  more resources than are physically available in the cluster.
+                  This may lead to unexpected deployment failures if there are
+                  insufficient resources to service demand.
+                </p>
+              </TextTip>
+            </div>
+          </div>
+          <div className="form-group">
+            <div className="col-sm-12">
+              <SwitchField
+                label="Allow resource over-commit"
+                labelClass="col-sm-5 col-lg-4"
+                name="resourceOverCommitPercentage"
+                checked
+                featureId={FeatureId.K8S_SETUP_DEFAULT}
+                onChange={(checked: boolean) => {
+                  setFieldValue('enableResourceOverCommit', checked);
+                  // set 20% as the default resourceOverCommitPercentage value
+                  if (!checked) {
+                    setFieldValue('resourceOverCommitPercentage', 20);
+                  }
+                }}
+                data-cy="kubeSetup-resourceOverCommitToggle"
+              />
+            </div>
+          </div>
+          <EnableMetricsInput
+            environmentId={environmentId}
+            error={errors.useServerMetrics}
+            value={values.useServerMetrics}
+          />
+        </FormSection>
+        <FormSection title="Available storage options">
+          {initialValues.storageClasses.length === 0 && (
+            <div className="form-group">
+              <div className="col-sm-12">
+                <TextTip color="orange" inline={false}>
+                  Unable to detect any storage class available to persist data.
+                  Users won&apos;t be able to persist application data inside
+                  this cluster.
+                </TextTip>
+              </div>
+            </div>
+          )}
+          {initialValues.storageClasses.length > 0 && (
+            <>
+              <div className="form-group">
+                <div className="col-sm-12">
+                  <TextTip color="blue" inline={false}>
+                    <p>
+                      Select which storage options will be available for use
+                      when deploying applications. Have a look at your storage
+                      driver documentation to figure out which access policy to
+                      configure and if the volume expansion capability is
+                      supported.
+                    </p>
+                    <p>
+                      You can find more information about access modes{' '}
+                      <a
+                        href="https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes"
+                        target="_blank"
+                        rel="noreferrer"
+                      >
+                        in the official Kubernetes documentation
+                      </a>
+                      .
+                    </p>
+                  </TextTip>
+                </div>
+              </div>
+              <StorageClassDatatable
+                storageClassValues={values.storageClasses}
+              />
+            </>
+          )}
+        </FormSection>
+        <FormActions
+          submitLabel="Save configuration"
+          loadingText="Saving configuration"
+          isLoading={isSubmitting}
+          isValid={
+            isValid &&
+            !isIngressClassesLoading &&
+            isFormChanged(values, initialValues)
+          }
+          data-cy="kubeSetup-saveConfigurationButton"
+        />
+      </div>
+    </Form>
+  );
+}
+
+function useInitialValues(
+  environment?: Environment | null,
+  storageClassFormValues?: StorageClassFormValues[],
+  ingressClasses?: IngressControllerClassMap[]
+): ConfigureFormValues | undefined {
+  return useMemo(() => {
+    if (!environment) {
+      return undefined;
+    }
+    const allowNoneIngressClass =
+      !!environment.Kubernetes.Configuration.AllowNoneIngressClass;
+
+    return {
+      storageClasses: storageClassFormValues || [],
+      useLoadBalancer: !!environment.Kubernetes.Configuration.UseLoadBalancer,
+      useServerMetrics: !!environment.Kubernetes.Configuration.UseServerMetrics,
+      enableResourceOverCommit:
+        !!environment.Kubernetes.Configuration.EnableResourceOverCommit,
+      resourceOverCommitPercentage:
+        environment.Kubernetes.Configuration.ResourceOverCommitPercentage || 20,
+      restrictDefaultNamespace:
+        !!environment.Kubernetes.Configuration.RestrictDefaultNamespace,
+      restrictStandardUserIngressW:
+        !!environment.Kubernetes.Configuration.RestrictStandardUserIngressW,
+      ingressAvailabilityPerNamespace:
+        !!environment.Kubernetes.Configuration.IngressAvailabilityPerNamespace,
+      allowNoneIngressClass,
+      ingressClasses:
+        getIngressClassesFormValues(allowNoneIngressClass, ingressClasses) ||
+        [],
+    };
+  }, [environment, ingressClasses, storageClassFormValues]);
+}
+
+function isFormChanged(
+  values: ConfigureFormValues,
+  initialValues: ConfigureFormValues
+) {
+  // check if the form values are different from the initial values
+  return !_.isEqual(values, initialValues);
+}
diff --git a/app/react/kubernetes/cluster/ConfigureView/ConfigureForm/EnableMetricsInput.tsx b/app/react/kubernetes/cluster/ConfigureView/ConfigureForm/EnableMetricsInput.tsx
new file mode 100644
index 0000000..1c470a5
--- /dev/null
+++ b/app/react/kubernetes/cluster/ConfigureView/ConfigureForm/EnableMetricsInput.tsx
@@ -0,0 +1,106 @@
+import { Field, useFormikContext } from 'formik';
+import { useState } from 'react';
+import { CheckCircle, XCircle } from 'lucide-react';
+
+import { useGetMetricsMutation } from '@/react/kubernetes/queries/useGetMetricsMutation';
+
+import { TextTip } from '@@/Tip/TextTip';
+import { FormControl } from '@@/form-components/FormControl';
+import { Switch } from '@@/form-components/SwitchField/Switch';
+import { InlineLoader } from '@@/InlineLoader';
+
+import { ConfigureFormValues } from './types';
+
+type Props = {
+  environmentId: number;
+  value: boolean;
+  error?: string;
+};
+
+export function EnableMetricsInput({ value, error, environmentId }: Props) {
+  const { setFieldValue } = useFormikContext<ConfigureFormValues>();
+  const [metricsFound, setMetricsFound] = useState<boolean>();
+  const getMetricsMutation = useGetMetricsMutation();
+  return (
+    <div className="mb-4">
+      <TextTip color="blue">
+        <p>
+          Enabling the metrics feature allows users to use horizontal pod
+          autoscaling and to see container and node resource usage. This
+          requires{' '}
+          <a
+            href="https://kubernetes.io/docs/tasks/debug-application-cluster/resource-metrics-pipeline/#metrics-server"
+            target="_blank"
+            rel="noreferrer"
+          >
+            metrics server
+          </a>{' '}
+          or{' '}
+          <a
+            href="https://github.com/kubernetes-sigs/prometheus-adapter"
+            target="_blank"
+            rel="noreferrer"
+          >
+            prometheus
+          </a>{' '}
+          to be running in your cluster.
+        </p>
+        <p>
+          On any subsequent disabling of the feature, existing deployed
+          applications with autoscaling will still autoscale (you would have to
+          remove their autoscaler definitions to stop this).
+        </p>
+      </TextTip>
+      <FormControl
+        label="Enable features using the metrics API"
+        className="mb-0"
+        size="large"
+        errors={error}
+        inputId="kubeSetup-metricsToggle"
+      >
+        <Field
+          name="useServerMetrics"
+          as={Switch}
+          checked={value}
+          id="kubeSetup-metricsToggle"
+          onChange={(checked: boolean) => {
+            // if turning off, just set the value
+            if (!checked) {
+              setFieldValue('useServerMetrics', checked);
+              return;
+            }
+            // if turning on, see if the metrics server is available, then set the value to on if it is
+            getMetricsMutation.mutate(environmentId, {
+              onSuccess: () => {
+                setMetricsFound(true);
+                setFieldValue('useServerMetrics', checked);
+              },
+              onError: () => {
+                setMetricsFound(false);
+              },
+            });
+          }}
+          data-cy="kubeSetup-metricsToggle"
+        />
+      </FormControl>
+      {getMetricsMutation.isLoading && (
+        <InlineLoader size="sm">Checking metrics API...</InlineLoader>
+      )}
+      {!getMetricsMutation.isLoading && (
+        <>
+          {metricsFound === false && (
+            <TextTip color="red" icon={XCircle}>
+              Unable to reach metrics API, make sure metrics server is properly
+              deployed inside that cluster.
+            </TextTip>
+          )}
+          {metricsFound === true && (
+            <TextTip color="green" icon={CheckCircle}>
+              Successfully reached metrics API
+            </TextTip>
+          )}
+        </>
+      )}
+    </div>
+  );
+}
diff --git a/app/react/kubernetes/cluster/ConfigureView/ConfigureForm/RBACAlert.tsx b/app/react/kubernetes/cluster/ConfigureView/ConfigureForm/RBACAlert.tsx
new file mode 100644
index 0000000..e464904
--- /dev/null
+++ b/app/react/kubernetes/cluster/ConfigureView/ConfigureForm/RBACAlert.tsx
@@ -0,0 +1,42 @@
+import { Alert } from '@@/Alert';
+
+export function RBACAlert() {
+  return (
+    <Alert color="warn" className="mb-4">
+      <div className="flex flex-col">
+        <p>
+          Your cluster does not have Kubernetes role-based access control (RBAC)
+          enabled.
+        </p>
+        <p>
+          This means you can&apos;t use Portainer RBAC functionality to regulate
+          access to environment resources based on user roles.
+        </p>
+        <p className="mb-0">
+          To enable RBAC, start the&nbsp;
+          <a
+            className="th-highcontrast:text-blue-4 th-dark:text-blue-7"
+            href="https://kubernetes.io/docs/concepts/overview/components/#kube-apiserver"
+            target="_blank"
+            rel="noreferrer"
+          >
+            API server
+          </a>
+          &nbsp;with the&nbsp;
+          <code className="bg-gray-4 box-decoration-clone th-highcontrast:bg-black th-dark:bg-black">
+            --authorization-mode
+          </code>
+          &nbsp;flag set to a comma-separated list that includes&nbsp;
+          <code className="bg-gray-4 th-highcontrast:bg-black th-dark:bg-black">
+            RBAC
+          </code>
+          , for example:&nbsp;
+          <code className="bg-gray-4 box-decoration-clone th-highcontrast:bg-black th-dark:bg-black">
+            kube-apiserver --authorization-mode=Example1,RBAC,Example2
+          </code>
+          .
+        </p>
+      </div>
+    </Alert>
+  );
+}
diff --git a/app/react/kubernetes/cluster/ConfigureView/ConfigureForm/StorageAccessModeSelector.tsx b/app/react/kubernetes/cluster/ConfigureView/ConfigureForm/StorageAccessModeSelector.tsx
new file mode 100644
index 0000000..06759a0
--- /dev/null
+++ b/app/react/kubernetes/cluster/ConfigureView/ConfigureForm/StorageAccessModeSelector.tsx
@@ -0,0 +1,61 @@
+import { components, MultiValueGenericProps } from 'react-select';
+
+import { Select } from '@@/form-components/ReactSelect';
+
+interface Option {
+  Name: string;
+  Description: string;
+}
+
+interface Props {
+  value: Option[];
+  onChange(value: readonly Option[]): void;
+  options: Option[];
+  inputId?: string;
+  storageClassName: string;
+}
+
+export function StorageAccessModeSelector({
+  value,
+  onChange,
+  options,
+  inputId,
+  storageClassName,
+}: Props) {
+  return (
+    <Select
+      isMulti
+      getOptionLabel={(option) => option.Description}
+      getOptionValue={(option) => option.Name}
+      components={{ MultiValueLabel }}
+      options={options}
+      value={value}
+      closeMenuOnSelect={false}
+      onChange={(value) => onChange(value)}
+      inputId={inputId}
+      placeholder="Not configured"
+      data-cy={`kubeSetup-storageAccessSelect${storageClassName}`}
+      id={`kubeSetup-storageAccessSelect${storageClassName}`}
+    />
+  );
+}
+
+function MultiValueLabel({
+  data,
+  innerProps,
+  selectProps,
+}: MultiValueGenericProps<Option>) {
+  if (!data || !data.Name) {
+    throw new Error('missing option name');
+  }
+
+  return (
+    <components.MultiValueLabel
+      data={data}
+      innerProps={innerProps}
+      selectProps={selectProps}
+    >
+      {data.Name}
+    </components.MultiValueLabel>
+  );
+}
diff --git a/app/react/kubernetes/cluster/ConfigureView/ConfigureForm/StorageClassDatatable.tsx b/app/react/kubernetes/cluster/ConfigureView/ConfigureForm/StorageClassDatatable.tsx
new file mode 100644
index 0000000..3b6a1bc
--- /dev/null
+++ b/app/react/kubernetes/cluster/ConfigureView/ConfigureForm/StorageClassDatatable.tsx
@@ -0,0 +1,104 @@
+import { useFormikContext } from 'formik';
+
+import { TextTip } from '@@/Tip/TextTip';
+import { Switch } from '@@/form-components/SwitchField/Switch';
+
+import { StorageAccessModeSelector } from './StorageAccessModeSelector';
+import { ConfigureFormValues, StorageClassFormValues } from './types';
+import { availableStorageClassPolicies } from './useStorageClasses';
+
+type Props = {
+  storageClassValues: StorageClassFormValues[];
+};
+
+export function StorageClassDatatable({ storageClassValues }: Props) {
+  const { setFieldValue } = useFormikContext<ConfigureFormValues>();
+  return (
+    <div className="form-group">
+      <div className="col-sm-12 mt-2.5">
+        <table className="table table-fixed">
+          <tbody>
+            <tr className="text-muted">
+              <td>Storage</td>
+              <td>Shared access policy</td>
+              <td>Volume expansion</td>
+            </tr>
+            {storageClassValues.map((storageClassValue, index) => (
+              <tr
+                key={`${storageClassValue.Name}${storageClassValue.Provisioner}`}
+              >
+                <td>
+                  <div className="flex h-full flex-row items-center">
+                    <Switch
+                      checked={storageClassValue.selected}
+                      onChange={(checked) =>
+                        setFieldValue(
+                          `storageClasses.${index}.selected`,
+                          checked
+                        )
+                      }
+                      className="mb-0 mr-2"
+                      id={`kubeSetup-storageToggle${storageClassValue.Name}`}
+                      name={`kubeSetup-storageToggle${storageClassValue.Name}`}
+                      data-cy={`kubeSetup-storageToggle${storageClassValue.Name}`}
+                    />
+                    <span>{storageClassValue.Name}</span>
+                  </div>
+                </td>
+                <td>
+                  <StorageAccessModeSelector
+                    options={availableStorageClassPolicies}
+                    value={storageClassValue.AccessModes}
+                    onChange={(accessModes) => {
+                      setFieldValue(
+                        `storageClasses.${index}.AccessModes`,
+                        accessModes
+                      );
+                    }}
+                    storageClassName={storageClassValue.Name}
+                  />
+                </td>
+                <td>
+                  <div className="flex h-full flex-row items-center">
+                    <Switch
+                      checked={storageClassValue.AllowVolumeExpansion}
+                      onChange={(checked) =>
+                        setFieldValue(
+                          `storageClasses.${index}.AllowVolumeExpansion`,
+                          checked
+                        )
+                      }
+                      className="mb-0 mr-2"
+                      data-cy={`kubeSetup-storageExpansionToggle${storageClassValue.Name}`}
+                      id={`kubeSetup-storageExpansionToggle${storageClassValue.Name}`}
+                      name={`kubeSetup-storageExpansionToggle${storageClassValue.Name}`}
+                    />
+                  </div>
+                </td>
+              </tr>
+            ))}
+          </tbody>
+        </table>
+      </div>
+      {!hasValidStorageConfiguration(storageClassValues) && (
+        <div className="col-sm-12">
+          <TextTip color="orange">
+            Shared access policy configuration required.
+          </TextTip>
+        </div>
+      )}
+    </div>
+  );
+}
+
+function hasValidStorageConfiguration(
+  storageClassValues: StorageClassFormValues[]
+) {
+  return storageClassValues.every(
+    (storageClassValue) =>
+      // if the storage class is not selected, it's valid
+      !storageClassValue.selected ||
+      // if the storage class is selected, it must have at least one access mode
+      storageClassValue.AccessModes.length > 0
+  );
+}
diff --git a/app/react/kubernetes/cluster/ConfigureView/ConfigureForm/handleSubmitConfigureCluster.ts b/app/react/kubernetes/cluster/ConfigureView/ConfigureForm/handleSubmitConfigureCluster.ts
new file mode 100644
index 0000000..4bae893
--- /dev/null
+++ b/app/react/kubernetes/cluster/ConfigureView/ConfigureForm/handleSubmitConfigureCluster.ts
@@ -0,0 +1,128 @@
+import { FormikHelpers } from 'formik';
+import { StorageClass } from 'kubernetes-types/storage/v1';
+import { compare } from 'fast-json-patch';
+import { UseMutationResult } from '@tanstack/react-query';
+
+import { notifyError, notifySuccess } from '@/portainer/services/notifications';
+import { UpdateEnvironmentPayload } from '@/react/portainer/environments/queries/useUpdateEnvironmentMutation';
+import { Environment } from '@/react/portainer/environments/types';
+
+import { ConfigureFormValues, StorageClassFormValues } from './types';
+import { ConfigureClusterPayloads } from './useConfigureClusterMutation';
+
+// handle the form submission
+export async function handleSubmitConfigureCluster(
+  values: ConfigureFormValues,
+  initialValues: ConfigureFormValues | undefined,
+  configureClusterMutation: UseMutationResult<
+    void,
+    unknown,
+    ConfigureClusterPayloads,
+    unknown
+  >,
+  { resetForm }: FormikHelpers<ConfigureFormValues>,
+  environment?: Environment
+) {
+  if (!environment) {
+    notifyError('Unable to save configuration: environment not found');
+    return;
+  }
+
+  // transform the form values into the environment object
+  const selectedStorageClasses = values.storageClasses.filter(
+    (storageClass) => storageClass.selected
+  );
+  const updatedEnvironment = assignFormValuesToEnvironment(
+    environment,
+    values,
+    selectedStorageClasses
+  );
+  const storageClassPatches = createStorageClassPatches(
+    selectedStorageClasses,
+    initialValues?.storageClasses
+  );
+
+  // update the environment using a react query mutation
+  await configureClusterMutation.mutateAsync(
+    {
+      id: environment.Id,
+      updateEnvironmentPayload: updatedEnvironment,
+      initialIngressControllers: initialValues?.ingressClasses ?? [],
+      ingressControllers: values.ingressClasses,
+      storageClassPatches,
+    },
+    {
+      onSuccess: () => {
+        notifySuccess('Success', 'Configuration successfully applied');
+        resetForm();
+      },
+    }
+  );
+}
+
+function createStorageClassPatches(
+  storageClasses: StorageClassFormValues[],
+  oldStorageClasses?: StorageClassFormValues[]
+) {
+  const storageClassPatches = storageClasses.flatMap((storageClass) => {
+    const oldStorageClass = oldStorageClasses?.find(
+      (sc) => sc.Name === storageClass.Name
+    );
+    if (!oldStorageClass) {
+      return [];
+    }
+    const newPayload = createStorageClassPayload(storageClass);
+    const oldPayload = createStorageClassPayload(oldStorageClass);
+    const patch = compare(oldPayload, newPayload);
+    return [{ name: storageClass.Name, patch }];
+  });
+  return storageClassPatches;
+}
+
+function createStorageClassPayload(storageClass: StorageClassFormValues) {
+  const payload: StorageClass = {
+    provisioner: storageClass.Provisioner,
+    allowVolumeExpansion: storageClass.AllowVolumeExpansion,
+    metadata: {
+      uid: '',
+      name: storageClass.Name,
+      namespace: '',
+      labels: {},
+      annotations: {},
+    },
+  };
+  return payload;
+}
+
+function assignFormValuesToEnvironment(
+  environment: Environment,
+  values: ConfigureFormValues,
+  selectedStorageClasses: StorageClassFormValues[]
+) {
+  // note that the ingress datatable form values are omitted and included in another call
+  const updatedEnvironment: Partial<UpdateEnvironmentPayload> = {
+    Kubernetes: {
+      ...environment.Kubernetes,
+      Configuration: {
+        ...environment.Kubernetes.Configuration,
+        UseLoadBalancer: values.useLoadBalancer,
+        UseServerMetrics: values.useServerMetrics,
+        EnableResourceOverCommit: values.enableResourceOverCommit,
+        ResourceOverCommitPercentage: values.resourceOverCommitPercentage,
+        RestrictDefaultNamespace: values.restrictDefaultNamespace,
+        RestrictStandardUserIngressW: values.restrictStandardUserIngressW,
+        IngressAvailabilityPerNamespace: values.ingressAvailabilityPerNamespace,
+        AllowNoneIngressClass: values.allowNoneIngressClass,
+        StorageClasses: selectedStorageClasses.map((storageClass) => ({
+          Name: storageClass.Name,
+          AccessModes: storageClass.AccessModes.map(
+            (accessMode) => accessMode.Name
+          ),
+          AllowVolumeExpansion: storageClass.AllowVolumeExpansion,
+          Provisioner: storageClass.Provisioner,
+        })),
+      },
+    },
+  };
+  return updatedEnvironment;
+}
diff --git a/app/react/kubernetes/cluster/ConfigureView/ConfigureForm/index.ts b/app/react/kubernetes/cluster/ConfigureView/ConfigureForm/index.ts
new file mode 100644
index 0000000..aaab16e
--- /dev/null
+++ b/app/react/kubernetes/cluster/ConfigureView/ConfigureForm/index.ts
@@ -0,0 +1 @@
+export { ConfigureForm } from './ConfigureForm';
diff --git a/app/react/kubernetes/cluster/ConfigureView/ConfigureForm/types.ts b/app/react/kubernetes/cluster/ConfigureView/ConfigureForm/types.ts
new file mode 100644
index 0000000..5572845
--- /dev/null
+++ b/app/react/kubernetes/cluster/ConfigureView/ConfigureForm/types.ts
@@ -0,0 +1,28 @@
+import { IngressControllerClassMap } from '../../ingressClass/types';
+
+export type AccessMode = {
+  Description: string;
+  Name: string;
+  selected: boolean;
+};
+
+export type StorageClassFormValues = {
+  Name: string;
+  AccessModes: AccessMode[];
+  Provisioner: string;
+  AllowVolumeExpansion: boolean;
+  selected: boolean;
+};
+
+export type ConfigureFormValues = {
+  useLoadBalancer: boolean;
+  useServerMetrics: boolean;
+  enableResourceOverCommit: boolean;
+  resourceOverCommitPercentage: number;
+  restrictDefaultNamespace: boolean;
+  restrictStandardUserIngressW: boolean;
+  ingressAvailabilityPerNamespace: boolean;
+  allowNoneIngressClass: boolean;
+  storageClasses: StorageClassFormValues[];
+  ingressClasses: IngressControllerClassMap[];
+};
diff --git a/app/react/kubernetes/cluster/ConfigureView/ConfigureForm/useConfigureClusterMutation.ts b/app/react/kubernetes/cluster/ConfigureView/ConfigureForm/useConfigureClusterMutation.ts
new file mode 100644
index 0000000..e5a3cb5
--- /dev/null
+++ b/app/react/kubernetes/cluster/ConfigureView/ConfigureForm/useConfigureClusterMutation.ts
@@ -0,0 +1,76 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+import { Operation } from 'fast-json-patch';
+import _ from 'lodash';
+
+import { withError, withInvalidate } from '@/react-tools/react-query';
+import { environmentQueryKeys } from '@/react/portainer/environments/queries/query-keys';
+import {
+  UpdateEnvironmentPayload,
+  updateEnvironment,
+} from '@/react/portainer/environments/queries/useUpdateEnvironmentMutation';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { updateIngressControllerClassMap } from '../../ingressClass/useIngressControllerClassMap';
+import { IngressControllerClassMap } from '../../ingressClass/types';
+
+export type ConfigureClusterPayloads = {
+  id: number;
+  updateEnvironmentPayload: Partial<UpdateEnvironmentPayload>;
+  initialIngressControllers: IngressControllerClassMap[];
+  ingressControllers: IngressControllerClassMap[];
+  storageClassPatches: {
+    name: string;
+    patch: Operation[];
+  }[];
+};
+
+// useConfigureClusterMutation updates the environment, the ingress classes and the storage classes
+export function useConfigureClusterMutation() {
+  const queryClient = useQueryClient();
+  return useMutation(
+    async ({
+      id,
+      updateEnvironmentPayload,
+      initialIngressControllers,
+      ingressControllers,
+      storageClassPatches,
+    }: ConfigureClusterPayloads) => {
+      await updateEnvironment({ id, payload: updateEnvironmentPayload });
+      await Promise.all(
+        storageClassPatches.map(({ name, patch }) =>
+          patchStorageClass(id, name, patch)
+        )
+      );
+      // only update the ingress classes if they have changed
+      if (!_.isEqual(initialIngressControllers, ingressControllers)) {
+        await updateIngressControllerClassMap(id, ingressControllers);
+      }
+    },
+    {
+      ...withInvalidate(queryClient, [environmentQueryKeys.base()], {
+        skipRefresh: true,
+      }),
+      ...withError('Unable to apply configuration', 'Failure'),
+    }
+  );
+}
+
+async function patchStorageClass(
+  environmentId: number,
+  name: string,
+  storageClassPatch: Operation[]
+) {
+  try {
+    await axios.patch(
+      `/endpoints/${environmentId}/kubernetes/apis/storage.k8s.io/v1/storageclasses/${name}`,
+      storageClassPatch,
+      {
+        headers: {
+          'Content-Type': 'application/json-patch+json',
+        },
+      }
+    );
+  } catch (e) {
+    throw parseAxiosError(e, `Unable to patch StorageClass ${name}`);
+  }
+}
diff --git a/app/react/kubernetes/cluster/ConfigureView/ConfigureForm/useStorageClasses.ts b/app/react/kubernetes/cluster/ConfigureView/ConfigureForm/useStorageClasses.ts
new file mode 100644
index 0000000..17c534b
--- /dev/null
+++ b/app/react/kubernetes/cluster/ConfigureView/ConfigureForm/useStorageClasses.ts
@@ -0,0 +1,130 @@
+import { useQuery } from '@tanstack/react-query';
+import { StorageClass, StorageClassList } from 'kubernetes-types/storage/v1';
+
+import axios from '@/portainer/services/axios/axios';
+import {
+  Environment,
+  EnvironmentId,
+} from '@/react/portainer/environments/types';
+import { withError } from '@/react-tools/react-query';
+
+import { parseKubernetesAxiosError } from '../../../axiosError';
+
+import { AccessMode, StorageClassFormValues } from './types';
+
+export const availableStorageClassPolicies = [
+  {
+    Name: 'RWO',
+    Description: 'Allow read-write from a single pod only (RWO)',
+    selected: true,
+  },
+  {
+    Name: 'RWX',
+    Description:
+      'Allow read-write access from one or more pods concurrently (RWX)',
+    selected: false,
+  },
+];
+
+export function useStorageClasses(environment?: Environment | null) {
+  return useQuery(
+    [
+      'environments',
+      environment?.Id,
+      'kubernetes',
+      'storageclasses',
+      // include the storage classes in the cache key to force a refresh when the storage classes change in the environment object
+      JSON.stringify(environment?.Kubernetes.Configuration.StorageClasses),
+    ],
+    async () => {
+      if (!environment) {
+        return [];
+      }
+      const storageClasses = await getStorageClasses(environment.Id);
+      return storageClasses;
+    },
+    {
+      ...withError('Failure', `Unable to get Storage Classes`),
+      enabled: !!environment,
+    }
+  );
+}
+
+export function useStorageClassesFormValues(environment?: Environment | null) {
+  return useQuery(
+    [
+      'environments',
+      environment?.Id,
+      'kubernetes',
+      'storageclasses',
+      // include the storage classes in the cache key to force a refresh when the storage classes change in the environment object
+      JSON.stringify(environment?.Kubernetes.Configuration.StorageClasses),
+    ],
+    async () => {
+      if (!environment) {
+        return [];
+      }
+      const storageClasses = await getStorageClasses(environment.Id);
+      const storageClassFormValues = transformStorageClassesToFormValues(
+        storageClasses,
+        environment
+      );
+      return storageClassFormValues;
+    },
+    {
+      ...withError('Failure', `Unable to get Storage Classes`),
+      enabled: !!environment,
+    }
+  );
+}
+
+async function getStorageClasses(
+  environmentId: EnvironmentId
+): Promise<StorageClass[]> {
+  try {
+    const { data: storageClassList } = await axios.get<StorageClassList>(
+      `/endpoints/${environmentId}/kubernetes/apis/storage.k8s.io/v1/storageclasses`
+    );
+    return storageClassList.items;
+  } catch (e) {
+    throw parseKubernetesAxiosError(e, 'Unable to retrieve Storage Classes');
+  }
+}
+
+function transformStorageClassesToFormValues(
+  storageClasses: StorageClass[],
+  environment: Environment
+) {
+  const storageClassFormValues: StorageClassFormValues[] = storageClasses.map(
+    (storageClass) => {
+      const enabledStorage =
+        environment.Kubernetes.Configuration.StorageClasses?.find(
+          (sc) => sc.Name === storageClass.metadata?.name
+        );
+      let selected = false;
+      let AccessModes: AccessMode[];
+      if (enabledStorage) {
+        selected = true;
+        AccessModes =
+          enabledStorage.AccessModes.flatMap(
+            (name) =>
+              availableStorageClassPolicies.find(
+                (accessMode) => accessMode.Name === name
+              ) || []
+          ) || [];
+      } else {
+        // set a default access mode if the storage class is not enabled and there are available access modes
+        AccessModes = [availableStorageClassPolicies[0]];
+      }
+
+      return {
+        Name: storageClass.metadata?.name || '',
+        Provisioner: storageClass.provisioner,
+        AllowVolumeExpansion: !!storageClass.allowVolumeExpansion,
+        selected,
+        AccessModes,
+      };
+    }
+  );
+  return storageClassFormValues;
+}
diff --git a/app/react/kubernetes/cluster/ConfigureView/ConfigureForm/validation.ts b/app/react/kubernetes/cluster/ConfigureView/ConfigureForm/validation.ts
new file mode 100644
index 0000000..8313118
--- /dev/null
+++ b/app/react/kubernetes/cluster/ConfigureView/ConfigureForm/validation.ts
@@ -0,0 +1,80 @@
+import { object, string, boolean, array, number, SchemaOf } from 'yup';
+
+import { isBE } from '@/react/portainer/feature-flags/feature-flags.service';
+
+import { IngressControllerClassMap } from '../../ingressClass/types';
+
+import { ConfigureFormValues } from './types';
+
+// Define Yup schema for AccessMode
+const accessModeSchema = object().shape({
+  Description: string().required(),
+  Name: string().required(),
+  selected: boolean().required(),
+});
+
+// Define Yup schema for StorageClassFormValues
+const storageClassFormValuesSchema = array()
+  .of(
+    object().shape({
+      Name: string().required(),
+      AccessModes: array().of(accessModeSchema).required(),
+      Provisioner: string().required(),
+      AllowVolumeExpansion: boolean().required(),
+      selected: boolean().required(),
+    })
+  )
+  .test(
+    // invalid if any storage class is not selected or
+    // if it's selected and at least one access mode is selected
+    'accessModes',
+    'Shared access policy configuration required.',
+    (storageClasses) => {
+      const isValid = storageClasses?.every(
+        (value) =>
+          !value.selected ||
+          (value.AccessModes && value.AccessModes?.length > 0)
+      );
+      return isValid || false;
+    }
+  );
+
+// Define Yup schema for EndpointChangeWindow
+const endpointChangeWindowSchema = object().shape({
+  Enabled: boolean().required(),
+  StartTime: string().test(
+    'startTime should not be the same as endTime',
+    'The chosen time configuration is invalid.',
+    (value, context) => {
+      const { EndTime, Enabled } = context.parent;
+      return !Enabled || value !== EndTime;
+    }
+  ),
+  EndTime: string(),
+});
+
+// Define Yup schema for IngressControllerClassMap
+const ingressControllerClassMapSchema: SchemaOf<IngressControllerClassMap> =
+  object().shape({
+    Name: string().required(),
+    ClassName: string().required(),
+    Type: string().required(),
+    Availability: boolean().required(),
+    New: boolean().required(),
+    Used: boolean().required(),
+  });
+
+// Define Yup schema for ConfigureFormValues
+export const configureValidationSchema: SchemaOf<ConfigureFormValues> = object({
+  useLoadBalancer: boolean().required(),
+  useServerMetrics: boolean().required(),
+  enableResourceOverCommit: boolean().required(),
+  resourceOverCommitPercentage: number().required(),
+  restrictDefaultNamespace: boolean().required(),
+  restrictStandardUserIngressW: boolean().required(),
+  ingressAvailabilityPerNamespace: boolean().required(),
+  allowNoneIngressClass: boolean().required(),
+  changeWindow: isBE ? endpointChangeWindowSchema.required() : undefined,
+  storageClasses: storageClassFormValuesSchema.required(),
+  ingressClasses: array().of(ingressControllerClassMapSchema).required(),
+});
diff --git a/app/react/kubernetes/cluster/ConfigureView/ConfigureView.tsx b/app/react/kubernetes/cluster/ConfigureView/ConfigureView.tsx
new file mode 100644
index 0000000..edd3938
--- /dev/null
+++ b/app/react/kubernetes/cluster/ConfigureView/ConfigureView.tsx
@@ -0,0 +1,51 @@
+import { useCurrentEnvironment } from '@/react/hooks/useCurrentEnvironment';
+import { useUnauthorizedRedirect } from '@/react/hooks/useUnauthorizedRedirect';
+
+import { PageHeader } from '@@/PageHeader';
+import { Widget, WidgetBody } from '@@/Widget';
+
+import { ConfigureForm } from './ConfigureForm';
+
+export function ConfigureView() {
+  const { data: environment } = useCurrentEnvironment();
+
+  useUnauthorizedRedirect(
+    {
+      authorizations: 'K8sClusterW',
+      adminOnlyCE: false,
+    },
+    {
+      params: {
+        id: environment?.Id,
+      },
+      to: 'kubernetes.dashboard',
+    }
+  );
+
+  return (
+    <>
+      <PageHeader
+        title="Kubernetes features configuration"
+        breadcrumbs={[
+          { label: 'Environments', link: 'portainer.endpoints' },
+          {
+            label: environment?.Name || '',
+            link: 'portainer.endpoints.endpoint',
+            linkParams: { id: environment?.Id },
+          },
+          'Kubernetes configuration',
+        ]}
+        reload
+      />
+      <div className="row">
+        <div className="col-sm-12">
+          <Widget>
+            <WidgetBody>
+              <ConfigureForm />
+            </WidgetBody>
+          </Widget>
+        </div>
+      </div>
+    </>
+  );
+}
diff --git a/app/react/kubernetes/cluster/ConfigureView/index.ts b/app/react/kubernetes/cluster/ConfigureView/index.ts
new file mode 100644
index 0000000..155f7be
--- /dev/null
+++ b/app/react/kubernetes/cluster/ConfigureView/index.ts
@@ -0,0 +1 @@
+export { ConfigureView } from './ConfigureView';
diff --git a/app/react/kubernetes/cluster/HomeView/NodesDatatable/NodesDatatable.tsx b/app/react/kubernetes/cluster/HomeView/NodesDatatable/NodesDatatable.tsx
new file mode 100644
index 0000000..80de750
--- /dev/null
+++ b/app/react/kubernetes/cluster/HomeView/NodesDatatable/NodesDatatable.tsx
@@ -0,0 +1,97 @@
+import { Node, Endpoints } from 'kubernetes-types/core/v1';
+import { HardDrive } from 'lucide-react';
+import { useMemo } from 'react';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { createStore } from '@/react/kubernetes/datatables/default-kube-datatable-store';
+import { IndexOptional } from '@/react/kubernetes/configs/types';
+import { useEnvironment } from '@/react/portainer/environments/queries';
+
+import { Datatable, TableSettingsMenu } from '@@/datatables';
+import { useTableState } from '@@/datatables/useTableState';
+import { TableSettingsMenuAutoRefresh } from '@@/datatables/TableSettingsMenuAutoRefresh';
+
+import { useKubernetesEndpointsQuery } from '../../kubernetesEndpoint.service';
+import { useNodesQuery } from '../../queries/useNodesQuery';
+import { getNodeApiDetails, isNodePublished } from '../../nodeUtils';
+
+import { getColumns } from './columns';
+import { NodeRowData } from './types';
+
+const storageKey = 'k8sNodesDatatable';
+const settingsStore = createStore(storageKey);
+
+export function NodesDatatable() {
+  const tableState = useTableState(settingsStore, storageKey);
+  const environmentId = useEnvironmentId();
+  const { data: nodes, ...nodesQuery } = useNodesQuery(environmentId, {
+    autoRefreshRate: tableState.autoRefreshRate * 1000,
+  });
+  const { data: kubernetesEndpoints, ...kubernetesEndpointsQuery } =
+    useKubernetesEndpointsQuery(environmentId, {
+      autoRefreshRate: tableState.autoRefreshRate * 1000,
+    });
+  const { data: environment, ...environmentQuery } =
+    useEnvironment(environmentId);
+  const environmentUrl = environment?.URL;
+  const isServerMetricsEnabled =
+    !!environment?.Kubernetes?.Configuration.UseServerMetrics;
+  const nodeRowData = useNodeRowData(
+    nodes,
+    kubernetesEndpoints,
+    environmentUrl
+  );
+
+  return (
+    <Datatable<IndexOptional<NodeRowData>>
+      disableSelect
+      dataset={nodeRowData ?? []}
+      columns={getColumns(isServerMetricsEnabled)}
+      settingsManager={tableState}
+      isLoading={
+        nodesQuery.isLoading ||
+        kubernetesEndpointsQuery.isLoading ||
+        environmentQuery.isLoading
+      }
+      title="Nodes"
+      titleIcon={HardDrive}
+      getRowId={(row) => row.metadata?.uid ?? ''}
+      renderTableSettings={() => (
+        <TableSettingsMenu>
+          <TableSettingsMenuAutoRefresh
+            value={tableState.autoRefreshRate}
+            onChange={(value) => tableState.setAutoRefreshRate(value)}
+          />
+        </TableSettingsMenu>
+      )}
+      data-cy="k8s-nodes-datatable"
+    />
+  );
+}
+
+/**
+ * This function is used to add the isApi property to the node row data.
+ */
+function useNodeRowData(
+  nodes?: Node[],
+  kubernetesEndpoints?: Endpoints[],
+  environmentUrl?: string
+): NodeRowData[] {
+  return useMemo<NodeRowData[]>(() => {
+    if (!nodes || !kubernetesEndpoints) {
+      return [];
+    }
+    const nodeRowData = nodes.map((node) => {
+      // if the node address is in the endpoints subset addresses, then it is an api node
+      const { isApi } = getNodeApiDetails(node, kubernetesEndpoints);
+      const isPublishedNode = isNodePublished(node, environmentUrl);
+      return {
+        ...node,
+        isApi,
+        isPublishedNode,
+        Name: `${node.metadata?.name}${isApi ? 'api' : ''}`,
+      };
+    });
+    return nodeRowData;
+  }, [nodes, kubernetesEndpoints, environmentUrl]);
+}
diff --git a/app/react/kubernetes/cluster/HomeView/NodesDatatable/columns/actions.tsx b/app/react/kubernetes/cluster/HomeView/NodesDatatable/columns/actions.tsx
new file mode 100644
index 0000000..1117509
--- /dev/null
+++ b/app/react/kubernetes/cluster/HomeView/NodesDatatable/columns/actions.tsx
@@ -0,0 +1,50 @@
+import { CellContext } from '@tanstack/react-table';
+import { BarChart } from 'lucide-react';
+
+import { Link } from '@@/Link';
+import { Icon } from '@@/Icon';
+import { TooltipWithChildren } from '@@/Tip/TooltipWithChildren';
+
+import { NodeRowData } from '../types';
+
+import { columnHelper } from './helper';
+
+export function getActions(metricsEnabled: boolean) {
+  return columnHelper.accessor(() => '', {
+    header: 'Actions',
+    enableSorting: false,
+    cell: (props) => (
+      <ActionsCell
+        // eslint-disable-next-line react/jsx-props-no-spreading
+        {...props}
+        metricsEnabled={metricsEnabled}
+      />
+    ),
+  });
+}
+
+function ActionsCell({
+  row: { original: node },
+  metricsEnabled,
+}: CellContext<NodeRowData, string> & {
+  metricsEnabled: boolean;
+}) {
+  const nodeName = node.metadata?.name;
+
+  return (
+    <div className="flex gap-1.5">
+      {metricsEnabled && (
+        <Link
+          to="kubernetes.cluster.node.stats"
+          params={{ nodeName }}
+          className="flex items-center p-1"
+          data-cy="nodeStatsButton"
+        >
+          <TooltipWithChildren message="Stats" position="top">
+            <Icon icon={BarChart} />
+          </TooltipWithChildren>
+        </Link>
+      )}
+    </div>
+  );
+}
diff --git a/app/react/kubernetes/cluster/HomeView/NodesDatatable/columns/cachedImages.test.tsx b/app/react/kubernetes/cluster/HomeView/NodesDatatable/columns/cachedImages.test.tsx
new file mode 100644
index 0000000..a47b362
--- /dev/null
+++ b/app/react/kubernetes/cluster/HomeView/NodesDatatable/columns/cachedImages.test.tsx
@@ -0,0 +1,147 @@
+import type { CellContext } from '@tanstack/react-table';
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+
+import type { NodeRowData } from '../types';
+
+import { cachedImages } from './cachedImages';
+
+type CellFn = (ctx: CellContext<NodeRowData, number>) => React.ReactNode;
+
+function makeNode(
+  images: Array<{ names?: string[]; sizeBytes?: number }> = [],
+  name = 'test-node'
+): NodeRowData {
+  return {
+    isApi: false,
+    isPublishedNode: false,
+    Name: name,
+    metadata: { name },
+    status: { images },
+  };
+}
+
+function renderCell(node: NodeRowData) {
+  const ctx = {
+    row: { original: node },
+  } as unknown as CellContext<NodeRowData, number>;
+
+  const cellFn = cachedImages.cell as unknown as CellFn;
+  function CellWrapper() {
+    return <>{cellFn(ctx)}</>;
+  }
+
+  const Wrapped = withTestQueryProvider(CellWrapper);
+  return render(<Wrapped />);
+}
+
+describe('cachedImages column', () => {
+  describe('cell button', () => {
+    it('shows the image count', () => {
+      const node = makeNode([
+        { names: ['nginx:latest'], sizeBytes: 100000000 },
+        { names: ['redis:latest'], sizeBytes: 50000000 },
+      ]);
+
+      renderCell(node);
+
+      expect(screen.getByRole('button', { name: /2/i })).toBeVisible();
+    });
+
+    it('shows zero when node has no cached images', () => {
+      renderCell(makeNode([]));
+
+      expect(screen.getByRole('button', { name: /0/i })).toBeVisible();
+    });
+
+    it('uses the node name in data-cy attribute', () => {
+      renderCell(makeNode([], 'worker-1'));
+
+      expect(
+        document.querySelector('[data-cy="node-cached-images-worker-1"]')
+      ).not.toBeNull();
+    });
+  });
+
+  describe('modal', () => {
+    it('opens when the button is clicked', async () => {
+      const user = userEvent.setup();
+      const node = makeNode([
+        { names: ['nginx:latest'], sizeBytes: 100000000 },
+      ]);
+
+      renderCell(node);
+
+      await user.click(screen.getByRole('button', { name: /1/i }));
+
+      expect(
+        screen.getByRole('dialog', { name: /Cached images on test-node/i })
+      ).toBeVisible();
+    });
+
+    it('shows image names in the datatable', async () => {
+      const user = userEvent.setup();
+      const node = makeNode([
+        { names: ['nginx:latest', 'nginx:1.21'], sizeBytes: 100000000 },
+        { names: ['redis:latest'], sizeBytes: 50000000 },
+      ]);
+
+      renderCell(node);
+      await user.click(screen.getByRole('button', { name: /2/i }));
+
+      expect(screen.getByTitle('nginx:latest')).toBeVisible();
+      expect(screen.getByTitle('redis:latest')).toBeVisible();
+    });
+
+    it('shows the empty-state message when the node has no images', async () => {
+      const user = userEvent.setup();
+
+      renderCell(makeNode([]));
+      await user.click(screen.getByRole('button', { name: /0/i }));
+
+      expect(
+        screen.getByText('No cached images reported on this node.')
+      ).toBeVisible();
+    });
+
+    it('shows <untagged> for images without names', async () => {
+      const user = userEvent.setup();
+      const node = makeNode([{ names: [], sizeBytes: 10000000 }]);
+
+      renderCell(node);
+      await user.click(screen.getByRole('button', { name: /1/i }));
+
+      expect(screen.getByTitle('<untagged>')).toBeVisible();
+    });
+
+    it('shows the correct alias count', async () => {
+      const user = userEvent.setup();
+      // 3 names → primary + 2 aliases
+      const node = makeNode([
+        {
+          names: ['nginx:latest', 'nginx:1.21', 'nginx:stable'],
+          sizeBytes: 100000000,
+        },
+      ]);
+
+      renderCell(node);
+      await user.click(screen.getByRole('button', { name: /1/i }));
+
+      expect(screen.getByText('2 aliases')).toBeVisible();
+    });
+
+    it('uses singular "alias" when there is exactly one alias', async () => {
+      const user = userEvent.setup();
+      const node = makeNode([
+        { names: ['nginx:latest', 'nginx:1.21'], sizeBytes: 100000000 },
+      ]);
+
+      renderCell(node);
+      await user.click(screen.getByRole('button', { name: /1/i }));
+
+      expect(screen.getByText('1 alias')).toBeVisible();
+    });
+  });
+});
diff --git a/app/react/kubernetes/cluster/HomeView/NodesDatatable/columns/cachedImages.tsx b/app/react/kubernetes/cluster/HomeView/NodesDatatable/columns/cachedImages.tsx
new file mode 100644
index 0000000..bab7004
--- /dev/null
+++ b/app/react/kubernetes/cluster/HomeView/NodesDatatable/columns/cachedImages.tsx
@@ -0,0 +1,190 @@
+import { CellContext, createColumnHelper } from '@tanstack/react-table';
+import { Layers } from 'lucide-react';
+import { useMemo, useState } from 'react';
+
+import { humanize } from '@/portainer/filters/filters';
+import { pluralize } from '@/portainer/helpers/strings';
+
+import { Button } from '@@/buttons';
+import { Datatable } from '@@/datatables';
+import { useTableStateWithoutStorage } from '@@/datatables/useTableState';
+import { Modal } from '@@/modals';
+import { ModalBody } from '@@/modals/Modal/ModalBody';
+
+import { NodeRowData } from '../types';
+
+import { columnHelper } from './helper';
+
+interface CachedImageRow {
+  id: string;
+  image: string;
+  aliases: string;
+  aliasesCount: number;
+  sizeBytes: number;
+}
+
+type NodeImage = NonNullable<
+  NonNullable<NodeRowData['status']>['images']
+>[number];
+
+const imageColumnHelper = createColumnHelper<CachedImageRow>();
+
+const columns = [
+  imageColumnHelper.accessor('image', {
+    id: 'image',
+    header: 'Image',
+    meta: {
+      width: '70%',
+    },
+    cell: ({ getValue }) => {
+      const imageName = getValue();
+      return (
+        <span className="block truncate text-sm font-medium" title={imageName}>
+          {imageName}
+        </span>
+      );
+    },
+  }),
+  imageColumnHelper.accessor('aliases', {
+    id: 'aliases',
+    header: 'Aliases',
+    sortingFn: (left, right) =>
+      left.original.aliasesCount - right.original.aliasesCount,
+    meta: {
+      width: '15%',
+      className: 'whitespace-nowrap',
+    },
+    cell: ({ row }) => {
+      const { aliasesCount } = row.original;
+      return (
+        <span className="text-muted text-sm">
+          {aliasesCount} alias{aliasesCount !== 1 ? 'es' : ''}
+        </span>
+      );
+    },
+  }),
+  imageColumnHelper.accessor('sizeBytes', {
+    id: 'sizeBytes',
+    header: 'Size',
+    sortingFn: 'alphanumeric',
+    meta: {
+      width: '15%',
+      className: 'whitespace-nowrap',
+    },
+    cell: ({ getValue }) => (
+      <span className="text-sm">{humanize(getValue() ?? 0)}</span>
+    ),
+  }),
+];
+
+export const cachedImages = columnHelper.accessor(
+  (node) => node.status?.images?.length ?? 0,
+  {
+    id: 'cachedImages',
+    header: 'Cached Images',
+    cell: (props) => (
+      <CachedImagesCell
+        // eslint-disable-next-line react/jsx-props-no-spreading
+        {...props}
+      />
+    ),
+  }
+);
+
+function CachedImagesCell({
+  row: { original: node },
+}: CellContext<NodeRowData, number>) {
+  const [isModalOpen, setIsModalOpen] = useState(false);
+  const nodeName = node.metadata?.name ?? 'node';
+  const images: NodeImage[] = node.status?.images ?? [];
+
+  return (
+    <>
+      <Button
+        color="link"
+        onClick={() => setIsModalOpen(true)}
+        icon={Layers}
+        className="!px-0"
+        data-cy={`node-cached-images-${nodeName}`}
+      >
+        {images.length}
+      </Button>
+
+      {isModalOpen && (
+        <CachedImagesModal
+          nodeName={nodeName}
+          images={images}
+          onDismiss={() => setIsModalOpen(false)}
+        />
+      )}
+    </>
+  );
+}
+
+function CachedImagesModal({
+  nodeName,
+  images,
+  onDismiss,
+}: {
+  nodeName: string;
+  images: NodeImage[];
+  onDismiss: () => void;
+}) {
+  const tableState = useTableStateWithoutStorage('sizeBytes', true);
+
+  const rows = useMemo(
+    () =>
+      [...images]
+        .sort((left, right) => (right.sizeBytes ?? 0) - (left.sizeBytes ?? 0))
+        .map((image, index) => {
+          const names = image.names ?? [];
+          const primaryName = names[0] ?? '<untagged>';
+          const aliases = names.slice(1).join(' ');
+          const sizeBytes = image.sizeBytes ?? 0;
+          return {
+            id: `${primaryName}-${sizeBytes}-${index}`,
+            image: primaryName,
+            aliases,
+            aliasesCount: Math.max(names.length - 1, 0),
+            sizeBytes,
+          };
+        }),
+    [images]
+  );
+  const totalSizeBytes = useMemo(
+    () => rows.reduce((current, image) => current + image.sizeBytes, 0),
+    [rows]
+  );
+
+  return (
+    <Modal
+      onDismiss={onDismiss}
+      aria-label={`Cached images on ${nodeName}`}
+      dialogClassName="w-[min(1320px,calc(100vw-2rem))]"
+      className="pr-10 pt-7"
+    >
+      <ModalBody>
+        {images.length === 0 && (
+          <div className="text-muted">
+            No cached images reported on this node.
+          </div>
+        )}
+        {images.length > 0 && (
+          <Datatable<CachedImageRow>
+            disableSelect
+            dataset={rows}
+            columns={columns}
+            settingsManager={tableState}
+            title={`Cached Images on ${nodeName}`}
+            titleIcon={Layers}
+            description={`${pluralize(rows.length, 'image')}, ${humanize(
+              totalSizeBytes
+            )} total`}
+            getRowId={(row) => row.id}
+            data-cy="cached-images-datatable"
+          />
+        )}
+      </ModalBody>
+    </Modal>
+  );
+}
diff --git a/app/react/kubernetes/cluster/HomeView/NodesDatatable/columns/conditions.tsx b/app/react/kubernetes/cluster/HomeView/NodesDatatable/columns/conditions.tsx
new file mode 100644
index 0000000..633a5c2
--- /dev/null
+++ b/app/react/kubernetes/cluster/HomeView/NodesDatatable/columns/conditions.tsx
@@ -0,0 +1,53 @@
+import { NodeCondition } from 'kubernetes-types/core/v1';
+import { CellContext } from '@tanstack/react-table';
+
+import { Badge } from '@@/Badge';
+import { Tooltip } from '@@/Tip/Tooltip';
+
+import { NodeRowData } from '../types';
+
+import { columnHelper } from './helper';
+
+export const conditions = columnHelper.accessor((row) => getConditions(row), {
+  header: () => (
+    <>
+      Conditions
+      <Tooltip
+        position="top"
+        message="Empty indicates the node is healthy. Orange indicates the node is experiencing MemoryPressure, DiskPressure, NetworkUnavailable or PIDPressure."
+      />
+    </>
+  ),
+  id: 'conditions',
+  cell: ConditionsCell,
+});
+
+function ConditionsCell({
+  row: { original: node },
+}: CellContext<NodeRowData, NodeCondition[]>) {
+  const conditions = getConditions(node);
+
+  return (
+    <div className="flex flex-wrap gap-1">
+      {conditions.length > 0
+        ? conditions.map((condition) => (
+            <Badge
+              key={condition.type?.toString()}
+              type={condition.status === 'True' ? 'warn' : 'success'}
+            >
+              {condition.type}
+            </Badge>
+          ))
+        : '-'}
+    </div>
+  );
+}
+
+function getConditions(node: NodeRowData) {
+  return (
+    // exclude the Ready condition and search for unhealthy conditions
+    node.status?.conditions?.filter(
+      (condition) => condition.type !== 'Ready' && condition.status === 'True'
+    ) ?? []
+  );
+}
diff --git a/app/react/kubernetes/cluster/HomeView/NodesDatatable/columns/cpu.tsx b/app/react/kubernetes/cluster/HomeView/NodesDatatable/columns/cpu.tsx
new file mode 100644
index 0000000..696beb9
--- /dev/null
+++ b/app/react/kubernetes/cluster/HomeView/NodesDatatable/columns/cpu.tsx
@@ -0,0 +1,14 @@
+import { parseCPU } from '@/react/kubernetes/utils';
+
+import { NodeRowData } from '../types';
+
+import { columnHelper } from './helper';
+
+export const cpu = columnHelper.accessor((row) => getCPU(row), {
+  header: 'CPU',
+  cell: ({ row: { original: node } }) => getCPU(node),
+});
+
+function getCPU(node: NodeRowData) {
+  return parseCPU(node.status?.allocatable?.cpu ?? '');
+}
diff --git a/app/react/kubernetes/cluster/HomeView/NodesDatatable/columns/helper.ts b/app/react/kubernetes/cluster/HomeView/NodesDatatable/columns/helper.ts
new file mode 100644
index 0000000..456ee2d
--- /dev/null
+++ b/app/react/kubernetes/cluster/HomeView/NodesDatatable/columns/helper.ts
@@ -0,0 +1,5 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { NodeRowData } from '../types';
+
+export const columnHelper = createColumnHelper<NodeRowData>();
diff --git a/app/react/kubernetes/cluster/HomeView/NodesDatatable/columns/index.ts b/app/react/kubernetes/cluster/HomeView/NodesDatatable/columns/index.ts
new file mode 100644
index 0000000..d46bffd
--- /dev/null
+++ b/app/react/kubernetes/cluster/HomeView/NodesDatatable/columns/index.ts
@@ -0,0 +1,39 @@
+import { name } from './name';
+import { role } from './role';
+import { status } from './status';
+import { conditions } from './conditions';
+import { cpu } from './cpu';
+import { memory } from './memory';
+import { version } from './version';
+import { ip } from './ip';
+import { cachedImages } from './cachedImages';
+import { getActions } from './actions';
+
+export function getColumns(isServerMetricsEnabled: boolean) {
+  if (!isServerMetricsEnabled) {
+    return [
+      name,
+      role,
+      status,
+      conditions,
+      cpu,
+      memory,
+      version,
+      ip,
+      cachedImages,
+    ];
+  }
+
+  return [
+    name,
+    role,
+    status,
+    conditions,
+    cpu,
+    memory,
+    version,
+    ip,
+    cachedImages,
+    getActions(isServerMetricsEnabled),
+  ];
+}
diff --git a/app/react/kubernetes/cluster/HomeView/NodesDatatable/columns/ip.tsx b/app/react/kubernetes/cluster/HomeView/NodesDatatable/columns/ip.tsx
new file mode 100644
index 0000000..8e4ee64
--- /dev/null
+++ b/app/react/kubernetes/cluster/HomeView/NodesDatatable/columns/ip.tsx
@@ -0,0 +1,11 @@
+import { getInternalNodeIpAddress } from '../../../nodeUtils';
+
+import { columnHelper } from './helper';
+
+export const ip = columnHelper.accessor(
+  (row) => getInternalNodeIpAddress(row) ?? '-',
+  {
+    header: 'IP Address',
+    cell: ({ row }) => getInternalNodeIpAddress(row.original) ?? '-',
+  }
+);
diff --git a/app/react/kubernetes/cluster/HomeView/NodesDatatable/columns/memory.tsx b/app/react/kubernetes/cluster/HomeView/NodesDatatable/columns/memory.tsx
new file mode 100644
index 0000000..3fbd27b
--- /dev/null
+++ b/app/react/kubernetes/cluster/HomeView/NodesDatatable/columns/memory.tsx
@@ -0,0 +1,24 @@
+import {
+  bytesToReadableFormat,
+  safeFilesizeParser,
+} from '@/react/kubernetes/utils';
+
+import { NodeRowData } from '../types';
+
+import { columnHelper } from './helper';
+
+export const memory = columnHelper.accessor((row) => getMemory(row), {
+  header: 'Memory',
+  cell: ({ row: { original: node } }) => getMemory(node),
+});
+
+function getMemory(node: NodeRowData) {
+  return bytesToReadableFormat(
+    safeFilesizeParser(node.status?.allocatable?.memory ?? ''),
+    {
+      standard: 'iec',
+      exponent: 2, // MiB
+      round: 0,
+    }
+  );
+}
diff --git a/app/react/kubernetes/cluster/HomeView/NodesDatatable/columns/name.tsx b/app/react/kubernetes/cluster/HomeView/NodesDatatable/columns/name.tsx
new file mode 100644
index 0000000..cf12529
--- /dev/null
+++ b/app/react/kubernetes/cluster/HomeView/NodesDatatable/columns/name.tsx
@@ -0,0 +1,44 @@
+import { CellContext } from '@tanstack/react-table';
+
+import { Authorized } from '@/react/hooks/useUser';
+
+import { Link } from '@@/Link';
+import { Badge } from '@@/Badge';
+
+import { NodeRowData } from '../types';
+
+import { columnHelper } from './helper';
+
+export const name = columnHelper.accessor('Name', {
+  header: 'Name',
+  cell: NameCell,
+  id: 'name',
+});
+
+function NameCell({
+  row: { original: node },
+}: CellContext<NodeRowData, string>) {
+  const nodeName = node.metadata?.name;
+  return (
+    <div className="flex gap-2 whitespace-nowrap">
+      <Authorized
+        authorizations="K8sClusterNodeR"
+        childrenUnauthorized={nodeName}
+        adminOnlyCE
+      >
+        <Link
+          to="kubernetes.cluster.node"
+          params={{ nodeName }}
+          data-cy={`node-name-link-${nodeName}`}
+        >
+          {nodeName}
+        </Link>
+      </Authorized>
+
+      <div className="ml-auto flex gap-2">
+        {node.isApi && <Badge type="info">api</Badge>}
+        {node.isPublishedNode && <Badge type="success">environment IP</Badge>}
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/kubernetes/cluster/HomeView/NodesDatatable/columns/role.tsx b/app/react/kubernetes/cluster/HomeView/NodesDatatable/columns/role.tsx
new file mode 100644
index 0000000..37cc7ce
--- /dev/null
+++ b/app/react/kubernetes/cluster/HomeView/NodesDatatable/columns/role.tsx
@@ -0,0 +1,8 @@
+import { getRole } from '../../../nodeUtils';
+
+import { columnHelper } from './helper';
+
+export const role = columnHelper.accessor((row) => getRole(row), {
+  header: 'Role',
+  cell: ({ row: { original: node } }) => getRole(node),
+});
diff --git a/app/react/kubernetes/cluster/HomeView/NodesDatatable/columns/status.tsx b/app/react/kubernetes/cluster/HomeView/NodesDatatable/columns/status.tsx
new file mode 100644
index 0000000..687355b
--- /dev/null
+++ b/app/react/kubernetes/cluster/HomeView/NodesDatatable/columns/status.tsx
@@ -0,0 +1,44 @@
+import { CellContext } from '@tanstack/react-table';
+
+import { StatusBadge } from '@@/StatusBadge';
+
+import { NodeRowData } from '../types';
+
+import { columnHelper } from './helper';
+
+export const status = columnHelper.accessor((row) => getStatus(row), {
+  header: 'Status',
+  cell: StatusCell,
+});
+
+function StatusCell({
+  row: { original: node },
+}: CellContext<NodeRowData, string>) {
+  const status = getStatus(node);
+
+  const isDeleting =
+    node.metadata?.annotations?.['portainer.io/removing-node'] === 'true';
+  if (isDeleting) {
+    return <StatusBadge color="warning">Removing</StatusBadge>;
+  }
+
+  return (
+    <div className="inline-flex gap-x-2 whitespace-nowrap">
+      <StatusBadge color={status === 'Ready' ? 'success' : 'warning'}>
+        {status}
+      </StatusBadge>
+      {node.spec?.unschedulable && (
+        <StatusBadge color="warning">SchedulingDisabled</StatusBadge>
+      )}
+    </div>
+  );
+}
+
+function getStatus(node: NodeRowData) {
+  return (
+    // only look for the ready type to identify if the node is either ready or not ready
+    node.status?.conditions?.find(
+      (condition) => condition.status === 'True' && condition.type === 'Ready'
+    )?.type ?? 'Not Ready'
+  );
+}
diff --git a/app/react/kubernetes/cluster/HomeView/NodesDatatable/columns/version.tsx b/app/react/kubernetes/cluster/HomeView/NodesDatatable/columns/version.tsx
new file mode 100644
index 0000000..d056801
--- /dev/null
+++ b/app/react/kubernetes/cluster/HomeView/NodesDatatable/columns/version.tsx
@@ -0,0 +1,10 @@
+import { columnHelper } from './helper';
+
+export const version = columnHelper.accessor(
+  (row) => row.status?.nodeInfo?.kubeletVersion ?? '',
+  {
+    header: 'Version',
+    cell: ({ row: { original: node } }) =>
+      node.status?.nodeInfo?.kubeletVersion ?? '',
+  }
+);
diff --git a/app/react/kubernetes/cluster/HomeView/NodesDatatable/index.ts b/app/react/kubernetes/cluster/HomeView/NodesDatatable/index.ts
new file mode 100644
index 0000000..f5e6969
--- /dev/null
+++ b/app/react/kubernetes/cluster/HomeView/NodesDatatable/index.ts
@@ -0,0 +1 @@
+export { NodesDatatable } from './NodesDatatable';
diff --git a/app/react/kubernetes/cluster/HomeView/NodesDatatable/types.ts b/app/react/kubernetes/cluster/HomeView/NodesDatatable/types.ts
new file mode 100644
index 0000000..5c7d50b
--- /dev/null
+++ b/app/react/kubernetes/cluster/HomeView/NodesDatatable/types.ts
@@ -0,0 +1,7 @@
+import { Node } from 'kubernetes-types/core/v1';
+
+export interface NodeRowData extends Node {
+  isApi: boolean;
+  isPublishedNode: boolean;
+  Name: string;
+}
diff --git a/app/react/kubernetes/cluster/KubectlShell/KubectlShellView.test.tsx b/app/react/kubernetes/cluster/KubectlShell/KubectlShellView.test.tsx
new file mode 100644
index 0000000..f55b507
--- /dev/null
+++ b/app/react/kubernetes/cluster/KubectlShell/KubectlShellView.test.tsx
@@ -0,0 +1,152 @@
+import { render, screen, act } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { vi } from 'vitest';
+
+import { terminalClose } from '@/portainer/services/terminal-window';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+
+import { Terminal } from '@@/Terminal/Terminal';
+import type { ShellState } from '@@/Terminal/Terminal';
+
+import { KubectlShellView } from './KubectlShellView';
+
+vi.mock('@@/Terminal/Terminal', () => ({
+  Terminal: vi.fn(() => null),
+  LINUX_SHELL_INIT_COMMANDS: [],
+}));
+
+vi.mock('@/react/hooks/useEnvironmentId', () => ({
+  useEnvironmentId: () => 1,
+}));
+
+vi.mock('@/portainer/helpers/pathHelper', () => ({
+  baseHref: vi.fn().mockReturnValue('/portainer/'),
+}));
+
+vi.mock('@/portainer/services/terminal-window', () => ({
+  terminalClose: vi.fn(),
+}));
+
+function getTerminalProps() {
+  return vi.mocked(Terminal).mock.calls[0][0] as {
+    url: string;
+    connect: boolean;
+    onStateChange?: (state: ShellState) => void;
+  };
+}
+
+function triggerStateChange(state: ShellState) {
+  act(() => {
+    getTerminalProps().onStateChange?.(state);
+  });
+}
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  Object.defineProperty(window, 'location', {
+    value: { protocol: 'https:', host: 'localhost:3000' },
+    writable: true,
+  });
+});
+
+describe('KubectlShellView', () => {
+  describe('URL construction', () => {
+    it('builds wss:// URL when location is https', () => {
+      renderComponent();
+      expect(getTerminalProps().url).toBe(
+        'wss://localhost:3000/portainer/api/websocket/kubernetes-shell?endpointId=1'
+      );
+    });
+
+    it('builds ws:// URL when location is http', () => {
+      Object.defineProperty(window, 'location', {
+        value: { protocol: 'http:', host: 'localhost:3000' },
+        writable: true,
+      });
+      renderComponent();
+      expect(getTerminalProps().url).toBe(
+        'ws://localhost:3000/portainer/api/websocket/kubernetes-shell?endpointId=1'
+      );
+    });
+
+    it('passes connect=true to Terminal', () => {
+      renderComponent();
+      expect(getTerminalProps().connect).toBe(true);
+    });
+  });
+
+  describe('shell state', () => {
+    it('shows loading indicator when connecting', () => {
+      renderComponent();
+      triggerStateChange('connecting');
+      expect(screen.getByText('Loading Terminal...')).toBeInTheDocument();
+    });
+
+    it('shows disconnected panel when disconnected', () => {
+      renderComponent();
+      triggerStateChange('disconnected');
+      expect(screen.getByText('Console disconnected')).toBeInTheDocument();
+    });
+
+    it('calls terminalClose when state becomes disconnected', () => {
+      renderComponent();
+      triggerStateChange('disconnected');
+      expect(vi.mocked(terminalClose)).toHaveBeenCalled();
+    });
+
+    it('shows nothing initially (idle state)', () => {
+      renderComponent();
+      expect(screen.queryByText('Loading Terminal...')).not.toBeInTheDocument();
+      expect(
+        screen.queryByText('Console disconnected')
+      ).not.toBeInTheDocument();
+    });
+  });
+
+  describe('disconnected buttons', () => {
+    beforeEach(() => {
+      renderComponent();
+      triggerStateChange('disconnected');
+    });
+
+    it('renders Reload button', () => {
+      expect(screen.getByTestId('k8sShell-reloadButton')).toHaveTextContent(
+        'Reload'
+      );
+    });
+
+    it('renders Close button', () => {
+      expect(screen.getByTestId('k8sShell-closeButton')).toHaveTextContent(
+        'Close'
+      );
+    });
+
+    it('reloads page when Reload is clicked', async () => {
+      const user = userEvent.setup();
+      const mockReload = vi.fn();
+      Object.defineProperty(window, 'location', {
+        value: { ...window.location, reload: mockReload },
+        writable: true,
+      });
+      await user.click(screen.getByTestId('k8sShell-reloadButton'));
+      expect(mockReload).toHaveBeenCalled();
+    });
+
+    it('closes window when Close is clicked', async () => {
+      const user = userEvent.setup();
+      const mockClose = vi.fn();
+      Object.defineProperty(window, 'close', {
+        value: mockClose,
+        writable: true,
+      });
+      await user.click(screen.getByTestId('k8sShell-closeButton'));
+      expect(mockClose).toHaveBeenCalled();
+    });
+  });
+});
+
+function renderComponent() {
+  const Wrapper = withTestQueryProvider(KubectlShellView);
+
+  return render(<Wrapper />);
+}
diff --git a/app/react/kubernetes/cluster/KubectlShell/KubectlShellView.tsx b/app/react/kubernetes/cluster/KubectlShell/KubectlShellView.tsx
new file mode 100644
index 0000000..9c58481
--- /dev/null
+++ b/app/react/kubernetes/cluster/KubectlShell/KubectlShellView.tsx
@@ -0,0 +1,94 @@
+import { useState } from 'react';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { baseHref } from '@/portainer/helpers/pathHelper';
+import { terminalClose } from '@/portainer/services/terminal-window';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { useEnvironment } from '@/react/portainer/environments/queries';
+import { isVersionSmaller } from '@/react/common/semver-utils';
+
+import { Alert } from '@@/Alert';
+import { Button } from '@@/buttons';
+import { Terminal, LINUX_SHELL_INIT_COMMANDS } from '@@/Terminal/Terminal';
+import type { ShellState } from '@@/Terminal/Terminal';
+
+const RESIZE_LAST_UNSUPPORTED_AGENT_VERSION = '2.40.0';
+
+export function KubectlShellView() {
+  const environmentId = useEnvironmentId();
+  const [shellState, setShellState] = useState<ShellState>('idle');
+  const { data: agentVersion } = useEnvironment(
+    environmentId,
+    (env) => env.Agent.Version
+  );
+  const supportsResizeOverSocket =
+    !!agentVersion &&
+    isVersionSmaller(RESIZE_LAST_UNSUPPORTED_AGENT_VERSION, agentVersion);
+
+  return (
+    <div className="fixed bottom-0 left-0 right-0 top-0 z-[10000] bg-black text-white">
+      {shellState === 'connecting' && (
+        <div className="px-4 pt-2">Loading Terminal...</div>
+      )}
+      {shellState === 'disconnected' && (
+        <div className="p-4">
+          <Alert color="info" title="Console disconnected">
+            <div className="mt-4 flex items-center gap-2">
+              <Button
+                onClick={() => window.location.reload()}
+                data-cy="k8sShell-reloadButton"
+              >
+                Reload
+              </Button>
+              <Button
+                onClick={() => window.close()}
+                color="default"
+                data-cy="k8sShell-closeButton"
+              >
+                Close
+              </Button>
+            </div>
+          </Alert>
+        </div>
+      )}
+      <Terminal
+        url={buildUrl(environmentId)}
+        connect
+        onStateChange={onStateChange}
+        initialCommands={[
+          ...LINUX_SHELL_INIT_COMMANDS,
+
+          '# Run kubectl commands inside here',
+          '# e.g. kubectl get all',
+          '',
+        ]}
+        onResize={supportsResizeOverSocket ? 'socket' : null}
+      />
+    </div>
+  );
+
+  function onStateChange(state: ShellState) {
+    if (state === 'disconnected') {
+      terminalClose();
+    }
+    setShellState(state);
+  }
+
+  function buildUrl(environmentId: EnvironmentId) {
+    const params = {
+      endpointId: environmentId,
+    };
+
+    const wsProtocol =
+      window.location.protocol === 'https:' ? 'wss://' : 'ws://';
+    const path = `${baseHref()}api/websocket/kubernetes-shell`;
+    const base = path.startsWith('http')
+      ? path.replace(/^https?:\/\//i, '')
+      : window.location.host + path;
+
+    const queryParams = Object.entries(params)
+      .map(([k, v]) => `${k}=${v}`)
+      .join('&');
+    return `${wsProtocol}${base}?${queryParams}`;
+  }
+}
diff --git a/app/react/kubernetes/cluster/NodeStatsView/.keep b/app/react/kubernetes/cluster/NodeStatsView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/kubernetes/cluster/NodeView/ConfirmUpdateNode.tsx b/app/react/kubernetes/cluster/NodeView/ConfirmUpdateNode.tsx
new file mode 100644
index 0000000..e4ae847
--- /dev/null
+++ b/app/react/kubernetes/cluster/NodeView/ConfirmUpdateNode.tsx
@@ -0,0 +1,46 @@
+import { ModalType } from '@@/modals';
+import { confirm } from '@@/modals/confirm';
+import { buildConfirmButton } from '@@/modals/utils';
+
+export function confirmUpdateNode(
+  taintsWarning: boolean,
+  labelsWarning: boolean,
+  cordonWarning: boolean,
+  drainWarning: boolean
+) {
+  let message;
+  if (taintsWarning && !labelsWarning) {
+    message =
+      'Changes to taints will immediately deschedule applications running on this node without the corresponding tolerations. Do you wish to continue?';
+  } else if (!taintsWarning && labelsWarning) {
+    message =
+      'Removing or changing a label that is used might prevent applications from being scheduled on this node in the future. Do you wish to continue?';
+  } else if (taintsWarning && labelsWarning) {
+    message = (
+      <>
+        <p>
+          Changes to taints will immediately deschedule applications running on
+          this node without the corresponding tolerations.
+        </p>
+        <p>
+          Removing or changing a label that is used might prevent applications
+          from scheduling on this node in the future.
+        </p>
+        <p>Do you wish to continue?</p>
+      </>
+    );
+  } else if (cordonWarning) {
+    message =
+      'Marking this node as unschedulable will effectively cordon the node and prevent any new workload from being scheduled on that node. Are you sure?';
+  } else if (drainWarning) {
+    message =
+      'Draining this node will cause all workloads to be evicted from that node. This might lead to some service interruption. Are you sure?';
+  }
+
+  return confirm({
+    title: 'Are you sure?',
+    modalType: ModalType.Warn,
+    message,
+    confirmButton: buildConfirmButton('Update', 'primary'),
+  });
+}
diff --git a/app/react/kubernetes/cluster/NodeView/NodeApplicationsDatatable/NodeApplicationsDatatable.tsx b/app/react/kubernetes/cluster/NodeView/NodeApplicationsDatatable/NodeApplicationsDatatable.tsx
new file mode 100644
index 0000000..788345d
--- /dev/null
+++ b/app/react/kubernetes/cluster/NodeView/NodeApplicationsDatatable/NodeApplicationsDatatable.tsx
@@ -0,0 +1,61 @@
+import { useCurrentStateAndParams } from '@uirouter/react';
+
+import LaptopCode from '@/assets/ico/laptop-code.svg?c';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useApplications } from '@/react/kubernetes/applications/queries/useApplications';
+
+import { Datatable, TableSettingsMenu } from '@@/datatables';
+import { TableSettingsMenuAutoRefresh } from '@@/datatables/TableSettingsMenuAutoRefresh';
+import { useTableStateWithStorage } from '@@/datatables/useTableState';
+import {
+  BasicTableSettings,
+  refreshableSettings,
+  RefreshableTableSettings,
+} from '@@/datatables/types';
+
+import { useColumns } from './columns';
+
+interface TableSettings extends BasicTableSettings, RefreshableTableSettings {}
+
+export function NodeApplicationsDatatable() {
+  const tableState = useTableStateWithStorage<TableSettings>(
+    'kube-node-apps',
+    'Name',
+    (set) => ({
+      ...refreshableSettings(set),
+    })
+  );
+
+  const envId = useEnvironmentId();
+  const {
+    params: { nodeName },
+  } = useCurrentStateAndParams();
+  const applicationsQuery = useApplications(envId, {
+    nodeName,
+    refetchInterval: tableState.autoRefreshRate * 1000,
+  });
+  const applications = applicationsQuery.data ?? [];
+
+  const columns = useColumns();
+
+  return (
+    <Datatable
+      dataset={applications}
+      settingsManager={tableState}
+      columns={columns}
+      disableSelect
+      title="Applications running on this node"
+      titleIcon={LaptopCode}
+      isLoading={applicationsQuery.isLoading}
+      renderTableSettings={() => (
+        <TableSettingsMenu>
+          <TableSettingsMenuAutoRefresh
+            value={tableState.autoRefreshRate}
+            onChange={tableState.setAutoRefreshRate}
+          />
+        </TableSettingsMenu>
+      )}
+      data-cy="node-applications-datatable"
+    />
+  );
+}
diff --git a/app/react/kubernetes/cluster/NodeView/NodeApplicationsDatatable/columns.helper.tsx b/app/react/kubernetes/cluster/NodeView/NodeApplicationsDatatable/columns.helper.tsx
new file mode 100644
index 0000000..25f184b
--- /dev/null
+++ b/app/react/kubernetes/cluster/NodeView/NodeApplicationsDatatable/columns.helper.tsx
@@ -0,0 +1,5 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { Application } from '@/react/kubernetes/applications/ListView/ApplicationsDatatable/types';
+
+export const helper = createColumnHelper<Application>();
diff --git a/app/react/kubernetes/cluster/NodeView/NodeApplicationsDatatable/columns.name.tsx b/app/react/kubernetes/cluster/NodeView/NodeApplicationsDatatable/columns.name.tsx
new file mode 100644
index 0000000..bcc246d
--- /dev/null
+++ b/app/react/kubernetes/cluster/NodeView/NodeApplicationsDatatable/columns.name.tsx
@@ -0,0 +1,39 @@
+import { CellContext } from '@tanstack/react-table';
+
+import { isExternalApplication } from '@/react/kubernetes/applications/utils';
+import { useIsSystemNamespace } from '@/react/kubernetes/namespaces/queries/useIsSystemNamespace';
+import { Application } from '@/react/kubernetes/applications/ListView/ApplicationsDatatable/types';
+
+import { Link } from '@@/Link';
+import { SystemBadge } from '@@/Badge/SystemBadge';
+import { ExternalBadge } from '@@/Badge/ExternalBadge';
+
+import { helper } from './columns.helper';
+
+export const name = helper.accessor('Name', {
+  header: 'Name',
+  cell: Cell,
+});
+
+function Cell({ row: { original: item } }: CellContext<Application, string>) {
+  const isSystem = useIsSystemNamespace(item.ResourcePool);
+  return (
+    <div className="flex items-center gap-2">
+      <Link
+        to="kubernetes.applications.application"
+        params={{ name: item.Name, namespace: item.ResourcePool }}
+        data-cy={`application-link-${item.Name}`}
+      >
+        {item.Name}
+      </Link>
+
+      {isSystem ? (
+        <SystemBadge className="ml-auto" />
+      ) : (
+        isExternalApplication({ metadata: item.Metadata }) && (
+          <ExternalBadge className="ml-auto" />
+        )
+      )}
+    </div>
+  );
+}
diff --git a/app/react/kubernetes/cluster/NodeView/NodeApplicationsDatatable/columns.tsx b/app/react/kubernetes/cluster/NodeView/NodeApplicationsDatatable/columns.tsx
new file mode 100644
index 0000000..6892d47
--- /dev/null
+++ b/app/react/kubernetes/cluster/NodeView/NodeApplicationsDatatable/columns.tsx
@@ -0,0 +1,82 @@
+import _, { round } from 'lodash';
+import { useMemo } from 'react';
+
+import { truncate } from '@/portainer/filters/filters';
+import { usePublicSettings } from '@/react/portainer/settings/queries';
+import { bytesToReadableFormat } from '@/react/kubernetes/utils';
+
+import { Link } from '@@/Link';
+
+import { helper } from './columns.helper';
+import { name } from './columns.name';
+
+export function useColumns() {
+  const hideStacksQuery = usePublicSettings<boolean>({
+    select: (settings) =>
+      settings.GlobalDeploymentOptions.hideStacksFunctionality,
+  });
+
+  return useMemo(
+    () =>
+      _.compact([
+        name,
+        !hideStacksQuery.data &&
+          helper.accessor('StackName', {
+            header: 'Stack',
+            cell: ({ getValue }) => getValue() || '-',
+          }),
+        helper.accessor((item) => item.ResourcePool, {
+          header: 'Namespace',
+          cell: ({ getValue }) => {
+            const namespace = getValue();
+            return (
+              <Link
+                to="kubernetes.resourcePools.resourcePool"
+                params={{ id: namespace }}
+                data-cy={`namespace-link-${namespace}`}
+              >
+                {namespace}
+              </Link>
+            );
+          },
+        }),
+        helper.accessor('Image', {
+          header: 'Image',
+          cell: ({ row: { original: item } }) => {
+            const containersLength = item.Containers?.length || 0;
+            return (
+              <div title={item.Image}>
+                {truncate(item.Image, 64)}
+                {containersLength > 1 && <>+ {containersLength - 1}</>}
+              </div>
+            );
+          },
+        }),
+        helper.accessor((row) => row.Resource?.CpuRequest, {
+          header: 'CPU reservation',
+          cell: ({ getValue }) =>
+            typeof getValue() === 'number' ? round(getValue() || 0, 2) : '-',
+        }),
+        helper.accessor((row) => row.Resource?.CpuLimit, {
+          header: 'CPU Limit',
+          cell: ({ getValue }) =>
+            typeof getValue() === 'number' ? round(getValue() || 0, 2) : '-',
+        }),
+        helper.accessor((row) => row.Resource?.MemoryRequest, {
+          header: 'Memory reservation',
+          cell: ({ getValue }) =>
+            typeof getValue() === 'number'
+              ? bytesToReadableFormat(getValue() || 0)
+              : '-',
+        }),
+        helper.accessor((row) => row.Resource?.MemoryLimit, {
+          header: 'Memory Limit',
+          cell: ({ getValue }) =>
+            typeof getValue() === 'number'
+              ? bytesToReadableFormat(getValue() || 0)
+              : '-',
+        }),
+      ]),
+    [hideStacksQuery.data]
+  );
+}
diff --git a/app/react/kubernetes/cluster/NodeView/NodeApplicationsDatatable/types.ts b/app/react/kubernetes/cluster/NodeView/NodeApplicationsDatatable/types.ts
new file mode 100644
index 0000000..7677395
--- /dev/null
+++ b/app/react/kubernetes/cluster/NodeView/NodeApplicationsDatatable/types.ts
@@ -0,0 +1,6 @@
+import { KubernetesApplication } from '@/kubernetes/models/application/models';
+
+export type NodeApplication = KubernetesApplication & {
+  CPU: number;
+  Memory: number;
+};
diff --git a/app/react/kubernetes/cluster/NodeView/NodeDetails/NodeDetails.test.tsx b/app/react/kubernetes/cluster/NodeView/NodeDetails/NodeDetails.test.tsx
new file mode 100644
index 0000000..2a625d2
--- /dev/null
+++ b/app/react/kubernetes/cluster/NodeView/NodeDetails/NodeDetails.test.tsx
@@ -0,0 +1,334 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { vi, describe, it, expect, beforeEach } from 'vitest';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { UserViewModel } from '@/portainer/models/user';
+import { server } from '@/setup-tests/server';
+import { useAuthorizations } from '@/react/hooks/useUser';
+import { select } from '@/react/test-utils/react-select';
+
+import { confirmUpdateNode } from '../ConfirmUpdateNode';
+
+import { NodeDetails } from './NodeDetails';
+
+// Mocks
+
+vi.mock('../ConfirmUpdateNode', () => ({
+  confirmUpdateNode: vi.fn(),
+}));
+
+vi.mock('@/portainer/services/notifications', () => ({
+  notifySuccess: vi.fn(),
+}));
+
+vi.mock(
+  '@/react/hooks/useUser',
+  async (importOriginal: () => Promise<object>) => {
+    const actual = await importOriginal();
+    return {
+      ...actual,
+      useAuthorizations: vi.fn(),
+    };
+  }
+);
+
+vi.mock('@uirouter/react', async (importOriginal: () => Promise<object>) => ({
+  ...(await importOriginal()),
+
+  useCurrentStateAndParams: vi.fn(() => ({
+    params: { endpointId: 1, name: 'test-node' },
+  })),
+
+  useRouter: vi.fn(() => ({
+    stateService: {
+      reload: vi.fn(),
+    },
+  })),
+}));
+
+// Sample test data
+const mockNode = {
+  metadata: {
+    name: 'test-node',
+    labels: {
+      'kubernetes.io/hostname': 'test-node',
+      'node-role.kubernetes.io/control-plane': '',
+      'custom-label': 'custom-value',
+    },
+  },
+  spec: {
+    taints: [
+      {
+        key: 'node-role.kubernetes.io/control-plane',
+        effect: 'NoSchedule',
+        value: '',
+      },
+    ],
+    unschedulable: false,
+  },
+  status: {
+    conditions: [
+      {
+        type: 'Ready',
+        status: 'True',
+      },
+    ],
+    allocatable: {
+      memory: '2Gi',
+      cpu: '2',
+    },
+  },
+};
+
+const mockNodes = [
+  mockNode,
+  {
+    metadata: { name: 'node-2' },
+    spec: { unschedulable: false },
+    status: {
+      conditions: [{ type: 'Ready', status: 'True' }],
+      allocatable: {
+        memory: '2Gi',
+        cpu: '2',
+      },
+    },
+  },
+];
+
+const mockApplications = [
+  {
+    Name: 'test-app',
+    Namespace: 'default',
+  },
+];
+
+const mockPortainerApplications = [
+  {
+    Name: 'portainer',
+    Namespace: 'portainer',
+  },
+];
+
+const mockEndpoints: unknown[] = [];
+
+function setupMocks({
+  applications = mockApplications,
+  nodes = mockNodes,
+  hasWriteAccess = true,
+} = {}) {
+  vi.mocked(useAuthorizations).mockReturnValue({
+    authorized: hasWriteAccess,
+    isLoading: false,
+  });
+
+  server.use(
+    http.get('/api/endpoints/1/kubernetes/api/v1/nodes/test-node', () =>
+      HttpResponse.json(mockNode)
+    ),
+    http.get('/api/kubernetes/1/nodes', () => HttpResponse.json(nodes)),
+    http.get('/api/kubernetes/1/applications', () =>
+      HttpResponse.json(applications)
+    ),
+    http.get('/api/endpoints/1/kubernetes/api/v1/endpoints', () =>
+      HttpResponse.json({ items: mockEndpoints })
+    ),
+    http.patch('/api/endpoints/1/kubernetes/api/v1/nodes/test-node', () =>
+      HttpResponse.json(mockNode)
+    ),
+    http.post('/api/endpoints/1/kubernetes/api/v1/nodes/test-node/drain', () =>
+      HttpResponse.json({})
+    ),
+    http.get('/api/kubernetes/1/metrics/nodes/test-node', () =>
+      HttpResponse.json({
+        usage: {
+          memory: '1000000000',
+          cpu: '1000m',
+        },
+      })
+    ),
+    http.get('/api/kubernetes/1/metrics/applications_resources', () =>
+      HttpResponse.json({
+        MemoryRequest: 500000000,
+        CpuRequest: 500,
+      })
+    )
+  );
+}
+
+function renderComponent() {
+  const user = new UserViewModel({ Username: 'admin' });
+
+  const Wrapped = withTestQueryProvider(
+    withUserProvider(
+      withTestRouter(() => (
+        <NodeDetails nodeName="test-node" environmentId={1} />
+      )),
+      user
+    )
+  );
+
+  return render(<Wrapped />);
+}
+
+describe('NodeDetails', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    setupMocks();
+  });
+
+  it('shows drain warning when selecting Drain availability', async () => {
+    const user = userEvent.setup();
+    renderComponent();
+
+    // Wait for component to load
+    await waitFor(() => {
+      expect(screen.getByText('test-node')).toBeInTheDocument();
+    });
+
+    // Find the availability select and select Drain
+    const availabilitySelect = screen.getByLabelText('Availability');
+    await select(availabilitySelect, 'Drain', { user });
+
+    // Try to submit the form to trigger validation
+    const submitButton = screen.getByRole('button', { name: /update node/i });
+    await user.click(submitButton);
+
+    // Check that the confirmation modal is called with drain warning
+    await waitFor(() => {
+      expect(vi.mocked(confirmUpdateNode)).toHaveBeenCalledWith(
+        false, // taintsWarning
+        false, // labelsWarning
+        false, // cordonWarning
+        true // drainWarning
+      );
+    });
+  });
+
+  it('prevents submission when Portainer is running on node', async () => {
+    const user = userEvent.setup();
+    setupMocks({ applications: mockPortainerApplications });
+
+    renderComponent();
+
+    await waitFor(() => {
+      expect(screen.getByText('test-node')).toBeInTheDocument();
+    });
+
+    const availabilitySelect = screen.getByLabelText('Availability');
+    await select(availabilitySelect, 'Drain', { user });
+
+    await waitFor(() => {
+      expect(
+        screen.getByText(/cannot drain node where.*portainer.*running/i)
+      ).toBeInTheDocument();
+    });
+
+    const submitButton = screen.getByRole('button', { name: /update node/i });
+    expect(submitButton).toBeDisabled();
+  });
+
+  it('prevents drain when only one node in cluster', async () => {
+    const user = userEvent.setup();
+    setupMocks({ nodes: [mockNode] });
+
+    renderComponent();
+
+    await waitFor(() => {
+      expect(screen.getByText('test-node')).toBeInTheDocument();
+    });
+
+    const availabilitySelect = screen.getByLabelText('Availability');
+    await select(availabilitySelect, 'Drain', { user });
+
+    await waitFor(() => {
+      expect(
+        screen.getByText(/cannot drain.*only node.*cluster/i)
+      ).toBeInTheDocument();
+    });
+
+    const submitButton = screen.getByRole('button', { name: /update node/i });
+    expect(submitButton).toBeDisabled();
+  });
+
+  it('prevents drain when another node is already draining', async () => {
+    const user = userEvent.setup();
+    const drainingNodes = [
+      mockNode,
+      {
+        ...mockNodes[1],
+        metadata: {
+          ...mockNodes[1].metadata,
+          labels: {
+            'io.portainer/node-status-drain': '',
+          },
+        },
+        spec: { unschedulable: true },
+      },
+    ];
+    setupMocks({ nodes: drainingNodes });
+
+    renderComponent();
+
+    await waitFor(() => {
+      expect(screen.getByText('test-node')).toBeInTheDocument();
+    });
+
+    const availabilitySelect = screen.getByLabelText('Availability');
+    await select(availabilitySelect, 'Drain', { user });
+
+    await waitFor(() => {
+      expect(
+        screen.getByText(/cannot drain.*another node.*currently.*drained/i)
+      ).toBeInTheDocument();
+    });
+  });
+
+  it('shows cordon warning when submitting with Pause availability', async () => {
+    const user = userEvent.setup();
+    vi.mocked(confirmUpdateNode).mockResolvedValue(true);
+
+    renderComponent();
+
+    await waitFor(() => {
+      expect(screen.getByText('test-node')).toBeInTheDocument();
+    });
+
+    const availabilitySelect = screen.getByLabelText('Availability');
+    await select(availabilitySelect, 'Pause', { user });
+
+    const submitButton = screen.getByRole('button', { name: /update node/i });
+    await user.click(submitButton);
+
+    // Verify confirmation modal was called with cordon warning
+    await waitFor(() => {
+      expect(vi.mocked(confirmUpdateNode)).toHaveBeenCalledWith(
+        false, // taintsWarning
+        false, // labelsWarning
+        true, // cordonWarning
+        false // drainWarning
+      );
+    });
+  });
+
+  it('does not show form actions when user lacks write access', async () => {
+    setupMocks({ hasWriteAccess: false });
+
+    renderComponent();
+
+    await waitFor(() => {
+      expect(screen.getByText('test-node')).toBeInTheDocument();
+    });
+
+    // Form actions should not be present
+    expect(
+      screen.queryByRole('button', { name: /update node/i })
+    ).not.toBeInTheDocument();
+    expect(
+      screen.queryByRole('button', { name: /cancel/i })
+    ).not.toBeInTheDocument();
+  });
+});
diff --git a/app/react/kubernetes/cluster/NodeView/NodeDetails/NodeDetails.tsx b/app/react/kubernetes/cluster/NodeView/NodeDetails/NodeDetails.tsx
new file mode 100644
index 0000000..2e50820
--- /dev/null
+++ b/app/react/kubernetes/cluster/NodeView/NodeDetails/NodeDetails.tsx
@@ -0,0 +1,241 @@
+import { Node } from 'kubernetes-types/core/v1';
+import { Form, Formik, useFormikContext } from 'formik';
+import { useRouter } from '@uirouter/react';
+
+import { KubernetesEndpoint } from '@/kubernetes/endpoint/models';
+import { useAuthorizations } from '@/react/hooks/useUser';
+import { notifySuccess } from '@/portainer/services/notifications';
+import { useApplications } from '@/react/kubernetes/applications/queries/useApplications';
+
+import { Loading } from '@@/Widget';
+import { Alert } from '@@/Alert';
+import { FormActions } from '@@/form-components/FormActions';
+import { Button } from '@@/buttons';
+import { isArrayErrorType } from '@@/form-components/formikUtils';
+
+import { useNodeQuery } from '../../queries/useNodeQuery';
+import { useKubernetesEndpointsQuery } from '../../kubernetesEndpoint.service';
+import { getAvailability } from '../../nodeUtils';
+import { confirmUpdateNode } from '../ConfirmUpdateNode';
+import { useUpdateNodeMutation } from '../../queries/useUpdateNodeMutation';
+import { useDrainNodeMutation } from '../../queries/useDrainNodeMutation';
+import { useNodesQuery } from '../../queries/useNodesQuery';
+
+import { NodeLabels } from './NodeLabels';
+import { NodeSummary } from './NodeSummary';
+import { NodeTaints } from './NodeTaints';
+import { NodeResourceReservation } from './NodeResourceReservation';
+import { NodeFormValues } from './types';
+import { createLabel, createTaint } from './nodeFormUtils';
+import { createValidationSchema } from './validation';
+
+type Props = {
+  nodeName: string;
+  environmentId: number;
+};
+
+export function NodeDetails({ nodeName, environmentId }: Props) {
+  const router = useRouter();
+  const nodeQuery = useNodeQuery(environmentId, nodeName);
+  const nodesAvailabilityQuery = useNodesQuery(environmentId, {
+    select: (nodes) => nodes.map(getAvailability),
+  });
+  const applicationsQuery = useApplications(environmentId, {
+    nodeName,
+  });
+  const applications = applicationsQuery.data ?? [];
+  const endpointsQuery = useKubernetesEndpointsQuery(environmentId);
+  const updateNodeMutation = useUpdateNodeMutation(environmentId, nodeName);
+  const drainNodeMutation = useDrainNodeMutation(environmentId, nodeName);
+
+  if (nodeQuery.isInitialLoading || endpointsQuery.isInitialLoading) {
+    return <Loading />;
+  }
+
+  if (nodeQuery.isError) {
+    return <Alert color="error">Error loading node details</Alert>;
+  }
+  if (applicationsQuery.isError) {
+    return <Alert color="error">Error loading applications</Alert>;
+  }
+  if (nodesAvailabilityQuery.isError) {
+    return <Alert color="error">Error loading nodes availability</Alert>;
+  }
+  // continue even if endpointsQuery is error, because it's not critical for the node details page
+
+  if (!nodeQuery.data) {
+    return <Alert color="error">Node not found</Alert>;
+  }
+
+  const nodeFormValues = getNodeFormValues(nodeQuery.data);
+  const isOnlyNode = nodesAvailabilityQuery.data?.length === 1;
+  const containsPortainer = applications.some(
+    (app) => app.Name === 'portainer'
+  );
+  const hasDrainOperation = !!nodesAvailabilityQuery.data?.some(
+    (availability) => availability === 'Drain'
+  );
+  return (
+    <Formik
+      initialValues={nodeFormValues}
+      onSubmit={handleSubmit}
+      enableReinitialize
+      validationSchema={createValidationSchema(
+        isOnlyNode,
+        hasDrainOperation,
+        containsPortainer
+      )}
+    >
+      <NodeDetailsForm
+        node={nodeQuery.data}
+        endpoints={endpointsQuery.data ?? []}
+        nodeName={nodeName}
+        environmentId={environmentId}
+      />
+    </Formik>
+  );
+
+  async function handleSubmit(values: NodeFormValues) {
+    const node = nodeQuery.data;
+    if (!node) {
+      return;
+    }
+
+    // gather warnings
+    const taintsWarning = values.taints.some(
+      (taint) => taint.isChanged || taint.isNew || taint.needsDeletion
+    );
+    const labelsWarning = values.labels.some(
+      (label) => label.isChanged || label.isNew || label.needsDeletion
+    );
+    const cordonWarning = values.availability === 'Pause';
+    const drainWarning = values.availability === 'Drain';
+
+    // if there are warnings, confirm the update
+    if (taintsWarning || labelsWarning || cordonWarning || drainWarning) {
+      const confirmed = await confirmUpdateNode(
+        taintsWarning,
+        labelsWarning,
+        cordonWarning,
+        drainWarning
+      );
+      if (!confirmed) {
+        return;
+      }
+    }
+
+    // errors are handled in the useQuery mutations
+    await updateNodeMutation.mutateAsync({
+      formValues: values,
+      node,
+    });
+    if (values.availability === 'Drain') {
+      await drainNodeMutation.mutateAsync();
+    }
+    notifySuccess('Success', 'Node updated successfully');
+
+    router.stateService.reload();
+  }
+}
+
+function NodeDetailsForm({
+  node,
+  endpoints,
+  nodeName,
+  environmentId,
+}: {
+  node: Node;
+  endpoints: KubernetesEndpoint[];
+  nodeName: string;
+  environmentId: number;
+}) {
+  const {
+    isSubmitting,
+    isValid,
+    resetForm,
+    dirty,
+    values,
+    setFieldValue,
+    errors,
+  } = useFormikContext<NodeFormValues>();
+  const { authorized: hasNodeWriteAccess } =
+    useAuthorizations('K8sClusterNodeW');
+  const labelErrors = isArrayErrorType(errors.labels)
+    ? errors.labels
+    : undefined;
+  const taintErrors = isArrayErrorType(errors.taints)
+    ? errors.taints
+    : undefined;
+
+  return (
+    <Form className="form-horizontal">
+      <NodeSummary
+        node={node}
+        endpoints={endpoints}
+        availability={values.availability}
+        error={errors.availability}
+        onChangeAvailability={(availability) => {
+          setFieldValue('availability', availability);
+        }}
+        hasNodeWriteAccess={hasNodeWriteAccess}
+      />
+      <NodeResourceReservation
+        nodeName={nodeName}
+        environmentId={environmentId}
+        node={node}
+      />
+      <NodeLabels
+        labels={values.labels}
+        onChangeLabels={(labels) => setFieldValue('labels', labels)}
+        errors={labelErrors ?? []}
+        hasNodeWriteAccess={hasNodeWriteAccess}
+      />
+      <NodeTaints
+        taints={values.taints}
+        onChangeTaints={(taints) => setFieldValue('taints', taints)}
+        errors={taintErrors ?? []}
+        hasNodeWriteAccess={hasNodeWriteAccess}
+      />
+      {hasNodeWriteAccess && (
+        <FormActions
+          submitLabel="Update node"
+          loadingText="Updating node..."
+          isLoading={isSubmitting}
+          isValid={isValid && !isSubmitting}
+          data-cy="node-saveButton"
+        >
+          <Button
+            color="default"
+            disabled={isSubmitting || !dirty}
+            onClick={() => resetForm()}
+            data-cy="node-update-cancel"
+          >
+            Cancel
+          </Button>
+        </FormActions>
+      )}
+    </Form>
+  );
+}
+
+function getNodeFormValues(node: Node): NodeFormValues {
+  const availability = getAvailability(node);
+  const labels = Object.entries(node.metadata?.labels ?? {})
+    .map(createLabel)
+    .sort((a, b) => a.key.localeCompare(b.key))
+    .sort((a, b) => {
+      if (a.isSystem && !b.isSystem) {
+        return -1;
+      }
+      if (!a.isSystem && b.isSystem) {
+        return 1;
+      }
+      return 0;
+    });
+  const taints = node.spec?.taints?.map(createTaint) ?? [];
+  return {
+    availability,
+    labels,
+    taints,
+  };
+}
diff --git a/app/react/kubernetes/cluster/NodeView/NodeDetails/NodeLabels.tsx b/app/react/kubernetes/cluster/NodeView/NodeDetails/NodeLabels.tsx
new file mode 100644
index 0000000..3e6dafd
--- /dev/null
+++ b/app/react/kubernetes/cluster/NodeView/NodeDetails/NodeLabels.tsx
@@ -0,0 +1,105 @@
+import clsx from 'clsx';
+import { FormikErrors } from 'formik';
+
+import { FormSection } from '@@/form-components/FormSection';
+import { InputList } from '@@/form-components/InputList';
+import { ItemProps } from '@@/form-components/InputList/InputList';
+import { isErrorType } from '@@/form-components/formikUtils';
+import { FormError } from '@@/form-components/FormError';
+import { InputGroup } from '@@/form-components/InputGroup';
+import { Badge } from '@@/Badge';
+
+import { NodeLabel } from './types';
+import { createNewLabel } from './nodeFormUtils';
+
+interface Props {
+  labels: NodeLabel[];
+  errors: FormikErrors<NodeLabel[]>;
+  onChangeLabels: (labels: NodeLabel[]) => void;
+  hasNodeWriteAccess: boolean;
+}
+
+export function NodeLabels({
+  labels,
+  onChangeLabels,
+  errors,
+  hasNodeWriteAccess,
+}: Props) {
+  return (
+    <FormSection title="Labels">
+      <InputList<NodeLabel>
+        value={labels}
+        onChange={onChangeLabels}
+        data-cy="node-labels-input"
+        item={NodeLabelItem}
+        addLabel="Add label"
+        canUndoDelete
+        itemBuilder={createNewLabel}
+        errors={errors}
+        readOnly={!hasNodeWriteAccess}
+      />
+    </FormSection>
+  );
+}
+
+function NodeLabelItem({
+  onChange,
+  item,
+  error,
+  disabled,
+  readOnly,
+  index,
+}: ItemProps<NodeLabel>) {
+  const formikError = isErrorType(error) ? error : undefined;
+  return (
+    <div className="flex flex-wrap items-start gap-2">
+      <div className="w-64 flex-none">
+        <InputGroup
+          size="small"
+          className={clsx(item.needsDeletion && 'striked')}
+        >
+          <InputGroup.Addon>Name</InputGroup.Addon>
+          <InputGroup.Input
+            placeholder="e.g. foo.bar"
+            value={item.key}
+            onChange={(e) => handleChange('key', e.target.value)}
+            disabled={disabled || item.isSystem}
+            readOnly={readOnly}
+            type="text"
+            data-cy={`node-label-key-input_${index}`}
+          />
+        </InputGroup>
+        {!!formikError?.key && <FormError>{formikError.key}</FormError>}
+      </div>
+      <div className="w-64 flex-none">
+        <InputGroup
+          size="small"
+          className={clsx(item.needsDeletion && 'striked')}
+        >
+          <InputGroup.Addon>Value</InputGroup.Addon>
+          <InputGroup.Input
+            placeholder="e.g. true"
+            value={item.value}
+            onChange={(e) => handleChange('value', e.target.value)}
+            disabled={disabled || item.isSystem}
+            readOnly={readOnly}
+            type="text"
+            data-cy={`node-label-value-input_${index}`}
+          />
+        </InputGroup>
+        {!!formikError?.value && <FormError>{formikError.value}</FormError>}
+      </div>
+      {item.isSystem && (
+        <div className="flex flex-none items-center">
+          <Badge type="info" className="my-auto">
+            System
+          </Badge>
+        </div>
+      )}
+    </div>
+  );
+
+  function handleChange(key: keyof NodeLabel, value: string | number) {
+    onChange({ ...item, [key]: value, isChanged: true });
+  }
+}
diff --git a/app/react/kubernetes/cluster/NodeView/NodeDetails/NodeResourceReservation.tsx b/app/react/kubernetes/cluster/NodeView/NodeDetails/NodeResourceReservation.tsx
new file mode 100644
index 0000000..ae3ee4b
--- /dev/null
+++ b/app/react/kubernetes/cluster/NodeView/NodeDetails/NodeResourceReservation.tsx
@@ -0,0 +1,79 @@
+import { Node } from 'kubernetes-types/core/v1';
+
+import { ResourceReservation } from '@/react/kubernetes/components/ResourceReservation';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { useNodeMetricsQuery } from '@/react/kubernetes/metrics/queries/useNodeMetricsQuery';
+import { useMetricsForApplicationsQuery } from '@/react/kubernetes/metrics/queries/useMetricsForApplications';
+import {
+  ApplicationResource,
+  NodeMetric,
+} from '@/react/kubernetes/metrics/types';
+import {
+  getMebibytes,
+  parseCPU,
+  safeFilesizeParser,
+} from '@/react/kubernetes/utils';
+
+export function NodeResourceReservation({
+  node,
+  nodeName,
+  environmentId,
+}: {
+  node: Node;
+  nodeName: string;
+  environmentId: EnvironmentId;
+}) {
+  const nodeMetricsQuery = useNodeMetricsQuery(nodeName, environmentId, {
+    select: parseNodeMetrics,
+    // avoid repeat queries for when the metrics server is not available
+    retry: false,
+  });
+  const applicationsMetricsQuery = useMetricsForApplicationsQuery(
+    environmentId,
+    nodeName,
+    {
+      select: parseApplicationMetrics,
+    }
+  );
+
+  const memoryUsed = nodeMetricsQuery.data?.memoryUsed ?? 0;
+  const cpuUsed = nodeMetricsQuery.data?.cpuUsed ?? 0;
+  const memoryReservation = applicationsMetricsQuery.data?.memoryRequested ?? 0;
+  const cpuReservation = applicationsMetricsQuery.data?.cpuRequested ?? 0;
+  const memoryAvailable = getMebibytes(
+    safeFilesizeParser(node.status?.allocatable?.memory ?? 0)
+  );
+  const cpuAvailable = parseCPU(node.status?.allocatable?.cpu ?? '');
+
+  return (
+    <ResourceReservation
+      displayResourceUsage={!!nodeMetricsQuery.data}
+      resourceReservation={{
+        cpu: cpuReservation,
+        memory: memoryReservation,
+      }}
+      resourceUsage={{
+        cpu: cpuUsed,
+        memory: memoryUsed,
+      }}
+      cpuLimit={cpuAvailable}
+      memoryLimit={memoryAvailable}
+      memoryUnit="MiB"
+      description="Resource reservation represents the total amount of resource assigned to all the applications running on this node."
+    />
+  );
+}
+
+function parseNodeMetrics(nodeMetrics: NodeMetric) {
+  return {
+    memoryUsed: getMebibytes(safeFilesizeParser(nodeMetrics?.usage?.memory)),
+    cpuUsed: parseCPU(nodeMetrics?.usage?.cpu),
+  };
+}
+
+function parseApplicationMetrics(applicationMetrics: ApplicationResource) {
+  return {
+    memoryRequested: getMebibytes(applicationMetrics?.MemoryRequest),
+    cpuRequested: applicationMetrics?.CpuRequest,
+  };
+}
diff --git a/app/react/kubernetes/cluster/NodeView/NodeDetails/NodeSummary.tsx b/app/react/kubernetes/cluster/NodeView/NodeDetails/NodeSummary.tsx
new file mode 100644
index 0000000..909f663
--- /dev/null
+++ b/app/react/kubernetes/cluster/NodeView/NodeDetails/NodeSummary.tsx
@@ -0,0 +1,170 @@
+import { Node, Endpoints } from 'kubernetes-types/core/v1';
+import { useMemo } from 'react';
+
+import { formatDate } from '@/portainer/filters/filters';
+import {
+  getRole,
+  getInternalNodeIpAddress,
+  getNodeApiDetails,
+  getNodeStatus,
+  getAvailability,
+} from '@/react/kubernetes/cluster/nodeUtils';
+
+import { Badge } from '@@/Badge';
+import { DetailsTable } from '@@/DetailsTable';
+import { StatusBadge, StatusBadgeType } from '@@/StatusBadge';
+import { PortainerSelect, Option } from '@@/form-components/PortainerSelect';
+import { FormError } from '@@/form-components/FormError';
+
+import { NodeAvailability } from '../../types';
+
+type Props = {
+  node: Node;
+  endpoints: Endpoints[];
+  availability: NodeAvailability;
+  error?: string;
+  onChangeAvailability: (availability: NodeAvailability) => void;
+  hasNodeWriteAccess: boolean;
+};
+
+const availabilityOptions: Option<NodeAvailability>[] = [
+  {
+    label: 'Active',
+    value: 'Active',
+  },
+  {
+    label: 'Pause',
+    value: 'Pause',
+  },
+  {
+    label: 'Drain',
+    value: 'Drain',
+  },
+];
+
+export function NodeSummary({
+  node,
+  endpoints,
+  availability,
+  onChangeAvailability,
+  hasNodeWriteAccess,
+  error,
+}: Props) {
+  const parsedNode = useMemo(
+    () => parseNodeValues(node, endpoints),
+    [node, endpoints]
+  );
+
+  return (
+    <DetailsTable dataCy="node-summary">
+      <tr>
+        <td className="col-sm-3">Hostname</td>
+        <td>
+          {parsedNode.name}
+          {parsedNode.isApi && (
+            <Badge type="info" className="ml-2">
+              api
+            </Badge>
+          )}
+        </td>
+      </tr>
+      {parsedNode.isApi && (
+        <tr>
+          <td>Kubernetes API</td>
+          <td>{`${parsedNode.ipAddress}:${parsedNode.apiPort}`}</td>
+        </tr>
+      )}
+      <tr>
+        <td>Role</td>
+        <td>{parsedNode.role}</td>
+      </tr>
+      <tr>
+        <td>Kubelet version</td>
+        <td>{parsedNode.version || '-'}</td>
+      </tr>
+      <tr>
+        <td>Creation date</td>
+        <td>{parsedNode.creationDate || '-'}</td>
+      </tr>
+      <tr>
+        <td>Status</td>
+        <td>
+          <div className="flex items-center">
+            <StatusBadge color={parsedNode.statusType}>
+              {parsedNode.status}
+            </StatusBadge>
+            {parsedNode.status === 'Warning' && parsedNode.warningMessage && (
+              <span className="text-warning ml-2">
+                {parsedNode.warningMessage}
+              </span>
+            )}
+          </div>
+        </td>
+      </tr>
+      <tr>
+        <td>Availability</td>
+        <td>
+          {hasNodeWriteAccess ? (
+            <>
+              <PortainerSelect
+                options={availabilityOptions}
+                value={availability}
+                onChange={(value) => {
+                  if (value) {
+                    onChangeAvailability(value);
+                  }
+                }}
+                data-cy="node-availability-select"
+                inputId="node-availability-select"
+                aria-label="Availability"
+              />
+              <FormError>{error}</FormError>
+            </>
+          ) : (
+            availability
+          )}
+        </td>
+      </tr>
+    </DetailsTable>
+  );
+}
+
+interface ParsedNodeData {
+  name: string;
+  isApi: boolean;
+  ipAddress?: string;
+  apiPort?: number;
+  role: string;
+  version?: string;
+  creationDate?: string;
+  status: string;
+  statusType: StatusBadgeType;
+  warningMessage?: string;
+  availability: NodeAvailability;
+}
+
+function parseNodeValues(node: Node, endpoints: Endpoints[]): ParsedNodeData {
+  const name = node.metadata?.name || '';
+  const ipAddress = getInternalNodeIpAddress(node);
+  const { apiPort, isApi } = getNodeApiDetails(node, endpoints);
+  const role = getRole(node);
+  const version = node.status?.nodeInfo?.kubeletVersion;
+  const creationDate = node.metadata?.creationTimestamp
+    ? formatDate(node.metadata.creationTimestamp)
+    : undefined;
+  const { status, statusType, warningMessage } = getNodeStatus(node);
+  const availability = getAvailability(node);
+  return {
+    name,
+    isApi,
+    ipAddress,
+    apiPort,
+    role,
+    version,
+    creationDate,
+    status,
+    statusType,
+    availability,
+    warningMessage,
+  };
+}
diff --git a/app/react/kubernetes/cluster/NodeView/NodeDetails/NodeTaints.tsx b/app/react/kubernetes/cluster/NodeView/NodeDetails/NodeTaints.tsx
new file mode 100644
index 0000000..2c599c0
--- /dev/null
+++ b/app/react/kubernetes/cluster/NodeView/NodeDetails/NodeTaints.tsx
@@ -0,0 +1,124 @@
+import clsx from 'clsx';
+import { FormikErrors } from 'formik';
+
+import { FormSection } from '@@/form-components/FormSection';
+import { InputList } from '@@/form-components/InputList';
+import { ItemProps } from '@@/form-components/InputList/InputList';
+import { isErrorType } from '@@/form-components/formikUtils';
+import { FormError } from '@@/form-components/FormError';
+import { InputGroup } from '@@/form-components/InputGroup';
+import { Option, PortainerSelect } from '@@/form-components/PortainerSelect';
+
+import { TaintEffect } from '../../types';
+
+import { NodeTaint } from './types';
+import { createNewTaint } from './nodeFormUtils';
+
+interface Props {
+  taints: NodeTaint[];
+  errors: FormikErrors<NodeTaint[]>;
+  onChangeTaints: (taints: NodeTaint[]) => void;
+  hasNodeWriteAccess: boolean;
+}
+
+const taintEffectOptions: Option<TaintEffect>[] = [
+  { label: 'NoSchedule', value: 'NoSchedule' },
+  { label: 'PreferNoSchedule', value: 'PreferNoSchedule' },
+  { label: 'NoExecute', value: 'NoExecute' },
+];
+
+export function NodeTaints({
+  taints,
+  onChangeTaints,
+  errors,
+  hasNodeWriteAccess,
+}: Props) {
+  return (
+    <FormSection title="Taints">
+      <InputList<NodeTaint>
+        value={taints}
+        onChange={onChangeTaints}
+        data-cy="node-taints-input"
+        item={NodeTaintItem}
+        addLabel="Add taint"
+        canUndoDelete
+        itemBuilder={createNewTaint}
+        errors={errors}
+        readOnly={!hasNodeWriteAccess}
+      />
+    </FormSection>
+  );
+}
+
+function NodeTaintItem({
+  onChange,
+  item,
+  error,
+  disabled,
+  readOnly,
+  index,
+}: ItemProps<NodeTaint>) {
+  const formikError = isErrorType(error) ? error : undefined;
+  return (
+    <div className="flex flex-wrap items-start gap-2">
+      <div className="w-64 flex-none">
+        <InputGroup
+          size="small"
+          className={clsx(item.needsDeletion && 'striked')}
+        >
+          <InputGroup.Addon>Key</InputGroup.Addon>
+          <InputGroup.Input
+            placeholder="e.g. foo"
+            value={item.key}
+            onChange={(e) => handleChange('key', e.target.value)}
+            disabled={disabled}
+            readOnly={readOnly}
+            type="text"
+            data-cy={`node-taint-key-input_${index}`}
+          />
+        </InputGroup>
+        {!!formikError?.key && <FormError>{formikError.key}</FormError>}
+      </div>
+      <div className="w-64 flex-none">
+        <InputGroup
+          size="small"
+          className={clsx(item.needsDeletion && 'striked')}
+        >
+          <InputGroup.Addon>Value</InputGroup.Addon>
+          <InputGroup.Input
+            placeholder="e.g. bar"
+            value={item.value}
+            onChange={(e) => handleChange('value', e.target.value)}
+            disabled={disabled}
+            readOnly={readOnly}
+            type="text"
+            data-cy={`node-taint-value-input_${index}`}
+          />
+        </InputGroup>
+        {!!formikError?.value && <FormError>{formikError.value}</FormError>}
+      </div>
+      <div className="w-44 flex-none">
+        <InputGroup
+          size="small"
+          className={clsx(item.needsDeletion && 'striked')}
+        >
+          <InputGroup.Addon>Effect</InputGroup.Addon>
+          <PortainerSelect
+            value={item.effect}
+            onChange={(value) => handleChange('effect', value as TaintEffect)}
+            options={taintEffectOptions}
+            disabled={disabled || readOnly}
+            data-cy={`node-taint-effect-select_${index}`}
+            // className={clsx(item.needsDeletion && 'striked')}
+            size="sm"
+          />
+        </InputGroup>
+        {!!formikError?.effect && <FormError>{formikError.effect}</FormError>}
+      </div>
+    </div>
+  );
+
+  function handleChange(key: keyof NodeTaint, value: string | TaintEffect) {
+    onChange({ ...item, [key]: value, isChanged: true });
+  }
+}
diff --git a/app/react/kubernetes/cluster/NodeView/NodeDetails/nodeFormUtils.ts b/app/react/kubernetes/cluster/NodeView/NodeDetails/nodeFormUtils.ts
new file mode 100644
index 0000000..c7a6279
--- /dev/null
+++ b/app/react/kubernetes/cluster/NodeView/NodeDetails/nodeFormUtils.ts
@@ -0,0 +1,59 @@
+import { Taint } from 'kubernetes-types/core/v1';
+
+import { TaintEffect } from '../../types';
+import { isSystemLabel } from '../../nodeUtils';
+
+import { NodeTaint, NodeLabel } from './types';
+
+export function createNewLabel(): NodeLabel {
+  return {
+    key: '',
+    value: '',
+    needsDeletion: false,
+    isNew: true,
+    isChanged: false,
+    isSystem: false,
+  };
+}
+
+export function createNewTaint(): NodeTaint {
+  return {
+    key: '',
+    value: '',
+    effect: 'NoSchedule',
+    needsDeletion: false,
+    isNew: true,
+    isChanged: false,
+  };
+}
+
+export function createTaint(taint: Taint): NodeTaint {
+  return {
+    key: taint.key,
+    value: taint.value ?? '',
+    // We need to cast the effect to the correct type. This seems reasonable because of the docs
+    // https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/#concepts
+    // The allowed values for the effect field are: NoExecute, NoSchedule, PreferNoSchedule
+    effect: taint.effect as TaintEffect,
+    needsDeletion: false,
+    isNew: false,
+    isChanged: false,
+  };
+}
+
+export function createLabel(label: [string, string]): NodeLabel {
+  const [key, value] = label;
+  const isSystem = isSystemLabel(key);
+  const baseLabelValues = {
+    key,
+    value,
+    isNew: false,
+    isUsed: false,
+    isChanged: false,
+  };
+  if (isSystem) {
+    // omit needsDeletion, so the delete button is hidden
+    return { ...baseLabelValues, isSystem: true };
+  }
+  return { ...baseLabelValues, needsDeletion: false, isSystem: false };
+}
diff --git a/app/react/kubernetes/cluster/NodeView/NodeDetails/types.ts b/app/react/kubernetes/cluster/NodeView/NodeDetails/types.ts
new file mode 100644
index 0000000..bb88eca
--- /dev/null
+++ b/app/react/kubernetes/cluster/NodeView/NodeDetails/types.ts
@@ -0,0 +1,30 @@
+import { NodeAvailability, TaintEffect } from '../../types';
+
+export interface NodeLabel {
+  key: string;
+  value: string;
+  needsDeletion?: boolean;
+  isNew: boolean;
+  isChanged: boolean;
+  isSystem: boolean;
+}
+
+export interface NodeTaint {
+  key: string;
+  value: string;
+  effect: TaintEffect;
+  needsDeletion?: boolean;
+  isNew: boolean;
+  isChanged: boolean;
+}
+
+export interface NodeFormValues {
+  availability: NodeAvailability;
+  labels: NodeLabel[];
+  taints: NodeTaint[];
+}
+
+export interface NodeValidationData {
+  isDrainOperationInProgress: boolean;
+  isContainsPortainer: boolean;
+}
diff --git a/app/react/kubernetes/cluster/NodeView/NodeDetails/validation.ts b/app/react/kubernetes/cluster/NodeView/NodeDetails/validation.ts
new file mode 100644
index 0000000..c53f5ae
--- /dev/null
+++ b/app/react/kubernetes/cluster/NodeView/NodeDetails/validation.ts
@@ -0,0 +1,149 @@
+import { array, string, boolean, object } from 'yup';
+
+import { buildUniquenessTest } from '@@/form-components/validate-unique';
+
+// https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set
+// Labels are key/value pairs. Valid label keys have two segments: an optional prefix and name, separated by a slash (/). The name segment is required and must be 63 characters or less, beginning and ending with an alphanumeric character ([a-z0-9A-Z]) with dashes (-), underscores (_), dots (.), and alphanumerics between. The prefix is optional. If specified, the prefix must be a DNS subdomain: a series of DNS labels separated by dots (.), not longer than 253 characters in total, followed by a slash (/).
+// Valid label value:
+// must be 63 characters or less (can be empty),
+// unless empty, must begin and end with an alphanumeric character ([a-z0-9A-Z]),
+// could contain dashes (-), underscores (_), dots (.), and alphanumerics between.
+const labelKeyValidation = string()
+  .required('Label key is required')
+  .test(
+    'prefix-test',
+    'Label key prefix must be a valid DNS subdomain',
+    (value) => {
+      if (!value) return true; // handled by required()
+
+      const parts = value.split('/');
+      if (parts.length === 1) return true; // no prefix is valid
+      if (parts.length > 2) return false; // only one slash allowed
+
+      const [prefix] = parts;
+
+      // Prefix validation: DNS subdomain rules
+      if (prefix.length > 253) return false;
+      if (prefix === '') return false; // empty prefix not allowed if slash present
+
+      // DNS subdomain: series of DNS labels separated by dots
+      const labels = prefix.split('.');
+      return labels.every((label) => {
+        // Each DNS label must be 1-63 chars, start/end with alphanumeric, contain only alphanumeric and hyphens
+        if (label.length === 0 || label.length > 63) return false;
+        if (!/^[a-zA-Z0-9]/.test(label) || !/[a-zA-Z0-9]$/.test(label))
+          return false;
+        if (!/^[a-zA-Z0-9-]+$/.test(label)) return false;
+        return true;
+      });
+    }
+  )
+  .test(
+    'name-test',
+    'Label key must start and end with an alphanumeric character, and contain only alphanumeric characters, hyphens, underscores, and dots',
+    (value) => {
+      if (!value) return true; // handled by required()
+
+      const parts = value.split('/');
+      const name = parts[parts.length - 1]; // name is always the last part
+
+      // Name validation
+      if (name.length === 0 || name.length > 63) return false;
+      if (!/^[a-zA-Z0-9]/.test(name) || !/[a-zA-Z0-9]$/.test(name))
+        return false;
+      if (!/^[a-zA-Z0-9._-]+$/.test(name)) return false;
+
+      return true;
+    }
+  );
+
+const labelValueValidation = string()
+  .max(63, 'Label value must be 63 characters or less')
+  .test(
+    'value-format',
+    'Label value must start/end with alphanumeric and contain only alphanumeric, hyphens, underscores, and dots',
+    (value) => {
+      if (!value || value === '') return true; // empty values are allowed
+
+      // Must start and end with alphanumeric
+      if (!/^[a-zA-Z0-9]/.test(value) || !/[a-zA-Z0-9]$/.test(value))
+        return false;
+
+      // Can only contain alphanumeric, hyphens, underscores, and dots
+      if (!/^[a-zA-Z0-9._-]+$/.test(value)) return false;
+
+      return true;
+    }
+  );
+
+const labelSchema = object({
+  key: labelKeyValidation,
+  value: labelValueValidation,
+  needsDeletion: boolean().default(false),
+  isNew: boolean().default(false),
+  isUsed: boolean().default(false),
+  isChanged: boolean().default(false),
+});
+
+const taintSchema = object({
+  key: string().required('Taint key is required'),
+  value: string(),
+  effect: string()
+    .oneOf(['NoSchedule', 'PreferNoSchedule', 'NoExecute'])
+    .required('Effect is required'),
+  needsDeletion: boolean().default(false),
+  isNew: boolean().default(false),
+  isChanged: boolean().default(false),
+});
+
+export function createValidationSchema(
+  isOnlyNode: boolean,
+  hasDrainOperation: boolean,
+  containsPortainer: boolean
+) {
+  return object({
+    availability: string()
+      .oneOf(['Active', 'Pause', 'Drain'])
+      .test(
+        'only-node-drain',
+        'Cannot drain the only node in cluster',
+        (value) => {
+          if (value === 'Drain' && isOnlyNode) {
+            return false;
+          }
+          return true;
+        }
+      )
+      .test(
+        'other-node-drain',
+        'Cannot drain node when another node is currently being drained',
+        (value) => {
+          if (value === 'Drain' && hasDrainOperation) {
+            return false;
+          }
+          return true;
+        }
+      )
+      .test(
+        'portainer-drain',
+        'Cannot drain node where the Portainer instance is running',
+        (value) => {
+          if (value === 'Drain' && containsPortainer) {
+            return false;
+          }
+          return true;
+        }
+      )
+      .required('Availability is required'),
+    labels: array(labelSchema).test(
+      'unique-label-keys',
+      'Duplicate label keys are not allowed',
+      buildUniquenessTest(() => 'This label key is already defined', 'key')
+    ),
+    taints: array(taintSchema).test(
+      'unique-taint-keys',
+      'Duplicate taint keys are not allowed',
+      buildUniquenessTest(() => 'This taint key is already defined', 'key')
+    ),
+  });
+}
diff --git a/app/react/kubernetes/cluster/NodeView/NodeView.test.tsx b/app/react/kubernetes/cluster/NodeView/NodeView.test.tsx
new file mode 100644
index 0000000..94754a4
--- /dev/null
+++ b/app/react/kubernetes/cluster/NodeView/NodeView.test.tsx
@@ -0,0 +1,118 @@
+import { render, screen } from '@testing-library/react';
+import { vi } from 'vitest';
+import { ReactNode } from 'react';
+
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { UserViewModel } from '@/portainer/models/user';
+
+import { NodeView } from './NodeView';
+
+let mockParams: { endpointId: number; nodeName: string; tab?: string } = {
+  endpointId: 1,
+  nodeName: 'test-node',
+};
+
+// Mock Link component to avoid ui-router relative state resolution in tests
+vi.mock('@@/Link', () => ({
+  Link: ({
+    children,
+    'data-cy': dataCy,
+    params,
+    ...props
+  }: {
+    children: ReactNode;
+    'data-cy'?: string;
+    params?: { tab?: string };
+  }) => (
+    <a
+      {...props}
+      data-cy={dataCy}
+      href={`#?tab=${params?.tab ?? ''}`}
+      onClick={() => {
+        if (params?.tab) {
+          mockParams = { ...mockParams, tab: params.tab };
+        }
+      }}
+    >
+      {children}
+    </a>
+  ),
+}));
+
+vi.mock('@uirouter/react', async (importOriginal: () => Promise<object>) => ({
+  ...(await importOriginal()),
+  useCurrentStateAndParams: vi.fn(() => ({ params: mockParams })),
+}));
+
+vi.mock('./NodeApplicationsDatatable/NodeApplicationsDatatable', () => ({
+  NodeApplicationsDatatable: () => <div data-cy="apps-table" />,
+}));
+
+vi.mock('./NodeDetails/NodeDetails', () => ({
+  NodeDetails: () => <div data-cy="node-details">Node details content</div>,
+}));
+
+vi.mock('../../components/EventsDatatable/ResourceEventsDatatable', () => ({
+  ResourceEventsDatatable: () => (
+    <div data-cy="events-table">Events content</div>
+  ),
+}));
+
+vi.mock('./NodeYamlInspector', () => ({
+  NodeYamlInspector: () => <div data-cy="yaml-view">YAML content</div>,
+}));
+
+vi.mock('@/react/hooks/useEnvironmentId', () => ({
+  useEnvironmentId: () => 1,
+}));
+
+vi.mock('../queries/useNodeQuery', () => ({
+  useNodeQuery: () => ({ isInitialLoading: false, data: 'uid-123' }),
+}));
+
+vi.mock('../../queries/useEvents', () => ({
+  useEventWarningsCount: () => 0,
+}));
+
+function getWrapped() {
+  const user = new UserViewModel({ Username: 'admin' });
+  const routerConfig = [{ name: 'root', url: '/' }];
+  return withTestQueryProvider(
+    withUserProvider(
+      withTestRouter(NodeView, { route: 'root', stateConfig: routerConfig }),
+      user
+    )
+  );
+}
+
+describe('NodeView tabs', () => {
+  it('switches tabs when user clicks different tab', async () => {
+    const Wrapped = getWrapped();
+    const utils = render(<Wrapped />);
+
+    // initial tab is first: Node details
+    expect(screen.queryByTestId('node-details')).toBeVisible();
+    expect(screen.queryByTestId('events-table')).toBeNull();
+    expect(screen.queryByTestId('yaml-view')).toBeNull();
+
+    // click Events tab and rerender
+    screen.getByTestId('tab-1').click();
+    utils.rerender(<Wrapped />);
+    expect(screen.queryByTestId('node-details')).toBeNull();
+    expect(screen.queryByTestId('events-table')).toBeVisible();
+
+    // click YAML tab and rerender
+    screen.getByTestId('tab-2').click();
+    utils.rerender(<Wrapped />);
+    expect(screen.queryByTestId('events-table')).toBeNull();
+    expect(screen.queryByTestId('yaml-view')).toBeVisible();
+
+    // back to Node tab (namespace) and rerender
+    screen.getByTestId('tab-0').click();
+    utils.rerender(<Wrapped />);
+    expect(screen.queryByTestId('yaml-view')).toBeNull();
+    expect(screen.queryByTestId('node-details')).toBeVisible();
+  });
+});
diff --git a/app/react/kubernetes/cluster/NodeView/NodeView.tsx b/app/react/kubernetes/cluster/NodeView/NodeView.tsx
new file mode 100644
index 0000000..7fd5c70
--- /dev/null
+++ b/app/react/kubernetes/cluster/NodeView/NodeView.tsx
@@ -0,0 +1,137 @@
+import { useCurrentStateAndParams } from '@uirouter/react';
+import { AlertTriangle, Code, History, HardDrive } from 'lucide-react';
+import { useMemo } from 'react';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+
+import { PageHeader } from '@@/PageHeader';
+import { Widget, WidgetBody, WidgetTabs } from '@@/Widget';
+import { Tab, useCurrentTabIndex } from '@@/Widget/WidgetTabs';
+import { Badge } from '@@/Badge';
+import { Icon } from '@@/Icon';
+
+import { useEventWarningsCount } from '../../queries/useEvents';
+import { ResourceEventsDatatable } from '../../components/EventsDatatable/ResourceEventsDatatable';
+import { useNodeQuery } from '../queries/useNodeQuery';
+
+import { NodeApplicationsDatatable } from './NodeApplicationsDatatable/NodeApplicationsDatatable';
+import { NodeDetails } from './NodeDetails/NodeDetails';
+import { NodeYamlInspector } from './NodeYamlInspector';
+
+export function NodeView() {
+  const stateAndParams = useCurrentStateAndParams();
+  const environmentId = useEnvironmentId();
+  const {
+    params: { nodeName },
+  } = stateAndParams;
+
+  const nodeIdQuery = useNodeQuery(environmentId, nodeName, {
+    select: (node) => node.metadata?.uid,
+  });
+  const eventWarningCount = useEventWarningsCount(environmentId, {
+    params: {
+      resourceId: nodeIdQuery.data,
+    },
+    queryOptions: {
+      enabled: !!nodeIdQuery.data,
+    },
+  });
+
+  const tabs = useMemo(
+    () =>
+      buildTabs(
+        eventWarningCount,
+        nodeIdQuery.isInitialLoading,
+        nodeName,
+        environmentId,
+        nodeIdQuery.data
+      ),
+    [
+      eventWarningCount,
+      nodeIdQuery.isInitialLoading,
+      nodeIdQuery.data,
+      nodeName,
+      environmentId,
+    ]
+  );
+  const currentTabIndex = useCurrentTabIndex(tabs);
+
+  return (
+    <>
+      <PageHeader
+        title="Node details"
+        breadcrumbs={[
+          { label: 'Cluster', link: 'kubernetes.cluster' },
+          nodeName,
+        ]}
+        reload
+      />
+      <>
+        <WidgetTabs tabs={tabs} currentTabIndex={currentTabIndex} />
+        {tabs[currentTabIndex].widget}
+        <NodeApplicationsDatatable />
+      </>
+    </>
+  );
+}
+
+function buildTabs(
+  eventWarningCount: number,
+  isLoading: boolean,
+  nodeName: string,
+  environmentId: number,
+  nodeId?: string
+): Tab[] {
+  return [
+    {
+      name: 'Node',
+      icon: HardDrive,
+      widget: (
+        <div className="row">
+          <div className="col-sm-12">
+            <Widget>
+              <WidgetBody>
+                <NodeDetails
+                  nodeName={nodeName}
+                  environmentId={environmentId}
+                />
+              </WidgetBody>
+            </Widget>
+          </div>
+        </div>
+      ),
+      selectedTabParam: 'namespace',
+    },
+    {
+      name: (
+        <div className="flex items-center gap-x-2">
+          Events
+          {eventWarningCount >= 1 && (
+            <Badge type="warnSecondary">
+              <Icon icon={AlertTriangle} className="!mr-1" />
+              {eventWarningCount}
+            </Badge>
+          )}
+        </div>
+      ),
+      icon: History,
+      widget: (
+        <ResourceEventsDatatable
+          storageKey="kubernetes.node.events"
+          resourceId={nodeId}
+          isLoading={isLoading}
+          noWidget={false}
+        />
+      ),
+      selectedTabParam: 'events',
+    },
+    {
+      name: 'YAML',
+      icon: Code,
+      widget: (
+        <NodeYamlInspector environmentId={environmentId} nodeName={nodeName} />
+      ),
+      selectedTabParam: 'yaml',
+    },
+  ];
+}
diff --git a/app/react/kubernetes/cluster/NodeView/NodeYamlInspector.test.tsx b/app/react/kubernetes/cluster/NodeView/NodeYamlInspector.test.tsx
new file mode 100644
index 0000000..de53560
--- /dev/null
+++ b/app/react/kubernetes/cluster/NodeView/NodeYamlInspector.test.tsx
@@ -0,0 +1,130 @@
+import { render, screen } from '@testing-library/react';
+import { vi } from 'vitest';
+
+import { confirm } from '@@/modals/confirm';
+
+import { NodeYamlInspector } from './NodeYamlInspector';
+
+const sampleNodeYaml: string = `apiVersion: v1
+kind: Node
+metadata:
+  name: test-node
+  labels:
+    kubernetes.io/hostname: test-node
+    node-role.kubernetes.io/worker: ""
+spec:
+  podCIDR: 10.244.1.0/24
+  podCIDRs:
+  - 10.244.1.0/24
+status:
+  addresses:
+  - address: 192.168.1.100
+    type: InternalIP
+  - address: test-node
+    type: Hostname
+  capacity:
+    cpu: "4"
+    memory: 8Gi
+    pods: "110"
+  conditions:
+  - type: Ready
+    status: "True"`;
+
+// Mock the useNodeQuery hook
+vi.mock('../queries/useNodeQuery', () => ({
+  useNodeQuery: vi.fn(() => ({
+    data: sampleNodeYaml,
+    isInitialLoading: false,
+    isError: false,
+  })),
+}));
+
+// Mock the useAuthorizations hook
+vi.mock('@/react/hooks/useUser', () => ({
+  useAuthorizations: vi.fn(() => ({
+    authorized: true,
+    isLoading: false,
+  })),
+}));
+
+// Mock the confirm modal
+vi.mock('@@/modals/confirm', () => ({
+  confirm: vi.fn(() => Promise.resolve(true)),
+  buildConfirmButton: vi.fn((label) => ({ label })),
+}));
+
+// Mock the Widget components
+vi.mock('@@/Widget', () => ({
+  Widget: ({ children }: { children: React.ReactNode }) => (
+    <div data-cy="widget">{children}</div>
+  ),
+  WidgetBody: ({ children }: { children: React.ReactNode }) => (
+    <div data-cy="widget-body">{children}</div>
+  ),
+}));
+
+// Mock the YAMLInspector component to simulate its behavior
+vi.mock('../../components/YAMLInspector', () => ({
+  YAMLInspector: ({
+    data,
+    confirmMessage,
+    'data-cy': dataCy,
+  }: {
+    data: string;
+    confirmMessage?: string;
+    'data-cy'?: string;
+  }) => (
+    <div data-cy={dataCy}>
+      <textarea data-cy="yaml-editor" defaultValue={data} onChange={() => {}} />
+      <button
+        data-cy="apply-changes-button"
+        type="button"
+        onClick={() => {
+          if (confirmMessage) {
+            confirm({
+              message: confirmMessage,
+              title: 'Are you sure?',
+            });
+          }
+        }}
+      >
+        Apply changes
+      </button>
+    </div>
+  ),
+}));
+
+function renderComponent({
+  environmentId = 1,
+  nodeName = 'test-node',
+}: {
+  environmentId?: number;
+  nodeName?: string;
+} = {}) {
+  return render(
+    <NodeYamlInspector environmentId={environmentId} nodeName={nodeName} />
+  );
+}
+
+beforeEach(() => {
+  vi.clearAllMocks();
+});
+
+test('renders NodeYamlInspector with node YAML data', () => {
+  renderComponent();
+
+  expect(screen.getByTestId('node-yaml')).toBeInTheDocument();
+  expect(screen.getByTestId('yaml-editor')).toBeInTheDocument();
+  expect(screen.getByText(/kind: Node/)).toBeInTheDocument();
+});
+
+test('passes correct props to YAMLInspector', () => {
+  renderComponent({ environmentId: 2, nodeName: 'worker-node' });
+
+  const yamlInspector = screen.getByTestId('node-yaml');
+  expect(yamlInspector).toBeInTheDocument();
+
+  // Verify the YAML editor contains the sample data
+  const editor = screen.getByTestId('yaml-editor');
+  expect(editor).toHaveValue(sampleNodeYaml);
+});
diff --git a/app/react/kubernetes/cluster/NodeView/NodeYamlInspector.tsx b/app/react/kubernetes/cluster/NodeView/NodeYamlInspector.tsx
new file mode 100644
index 0000000..1c62566
--- /dev/null
+++ b/app/react/kubernetes/cluster/NodeView/NodeYamlInspector.tsx
@@ -0,0 +1,34 @@
+import { WidgetBody, Widget } from '@@/Widget';
+
+import { YAMLInspector } from '../../components/YAMLInspector';
+import { useNodeQuery } from '../queries/useNodeQuery';
+
+export function NodeYamlInspector({
+  environmentId,
+  nodeName,
+}: {
+  environmentId: number;
+  nodeName: string;
+}) {
+  const nodeYamlQuery = useNodeQuery<string>(environmentId, nodeName, {
+    isYaml: true,
+  });
+  return (
+    <div className="row">
+      <div className="col-sm-12">
+        <Widget>
+          <WidgetBody>
+            <YAMLInspector
+              identifier="node-yaml"
+              data={nodeYamlQuery.data || ''}
+              data-cy="node-yaml"
+              isLoading={nodeYamlQuery.isInitialLoading}
+              isError={nodeYamlQuery.isError}
+              hideMessage
+            />
+          </WidgetBody>
+        </Widget>
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/kubernetes/cluster/RegistriesView/.keep b/app/react/kubernetes/cluster/RegistriesView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/kubernetes/cluster/RegistryAccessView/.keep b/app/react/kubernetes/cluster/RegistryAccessView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/kubernetes/cluster/RegistryAccessView/AccessTable.test.tsx b/app/react/kubernetes/cluster/RegistryAccessView/AccessTable.test.tsx
new file mode 100644
index 0000000..1595547
--- /dev/null
+++ b/app/react/kubernetes/cluster/RegistryAccessView/AccessTable.test.tsx
@@ -0,0 +1,185 @@
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { vi } from 'vitest';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+
+import { AccessTable } from './AccessTable';
+
+// Mock lucide-react icons used by the component and Datatable
+vi.mock('lucide-react', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('lucide-react')>();
+  return {
+    ...actual,
+    UserX: () => <span data-testid="user-x-icon" />,
+    Search: () => <span data-testid="search-icon" />,
+  };
+});
+
+// Mock DeleteButton to capture props
+const mockDeleteButton = vi.fn();
+vi.mock('@@/buttons/DeleteButton', () => ({
+  DeleteButton: (props: {
+    disabled: boolean;
+    onConfirmed: () => void;
+    'data-cy': string;
+  }) => {
+    const { disabled, onConfirmed, 'data-cy': dataCy } = props;
+    mockDeleteButton(props);
+    return (
+      <button
+        type="button"
+        onClick={onConfirmed}
+        disabled={disabled}
+        data-cy={dataCy}
+      >
+        Remove
+      </button>
+    );
+  },
+}));
+
+describe('AccessTable', () => {
+  const mockOnRemove = vi.fn();
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('should render namespace values in the table', () => {
+    const dataset = [
+      { value: 'namespace-1' },
+      { value: 'namespace-2' },
+      { value: 'namespace-3' },
+    ];
+
+    const Wrapped = withTestQueryProvider(AccessTable);
+
+    render(<Wrapped dataset={dataset} onRemove={mockOnRemove} />);
+
+    expect(screen.getByText('namespace-1')).toBeInTheDocument();
+    expect(screen.getByText('namespace-2')).toBeInTheDocument();
+    expect(screen.getByText('namespace-3')).toBeInTheDocument();
+  });
+
+  it('should render the column header', () => {
+    const dataset = [{ value: 'namespace-1' }];
+
+    const Wrapped = withTestQueryProvider(AccessTable);
+
+    render(<Wrapped dataset={dataset} onRemove={mockOnRemove} />);
+
+    expect(screen.getByText('Namespace')).toBeInTheDocument();
+  });
+
+  it('should render delete button with correct data-cy attribute', () => {
+    const dataset = [{ value: 'namespace-1' }];
+
+    const Wrapped = withTestQueryProvider(AccessTable);
+
+    render(<Wrapped dataset={dataset} onRemove={mockOnRemove} />);
+
+    expect(screen.getByRole('button', { name: /remove/i })).toBeInTheDocument();
+    expect(screen.getByTestId('remove-registry-access-button')).toHaveAttribute(
+      'data-cy',
+      'remove-registry-access-button'
+    );
+  });
+
+  it('should allow multiple namespaces to be selected', async () => {
+    const user = userEvent.setup();
+    const dataset = [
+      { value: 'namespace-1' },
+      { value: 'namespace-2' },
+      { value: 'namespace-3' },
+    ];
+
+    const Wrapped = withTestQueryProvider(AccessTable);
+
+    render(<Wrapped dataset={dataset} onRemove={mockOnRemove} />);
+
+    // Select multiple namespaces
+    const checkboxes = screen.getAllByRole('checkbox');
+    await user.click(checkboxes[1]); // namespace-1
+    await user.click(checkboxes[2]); // namespace-2
+
+    // Click delete button
+    const deleteButton = screen.getByRole('button', { name: /remove/i });
+    await user.click(deleteButton);
+
+    // Verify onRemove was called with both selected items
+    expect(mockOnRemove).toHaveBeenCalledWith([
+      { value: 'namespace-1' },
+      { value: 'namespace-2' },
+    ]);
+  });
+
+  it('should use value field as unique row identifier', () => {
+    // This test verifies the fix for the selection bug
+    const dataset = [
+      { value: 'namespace-1' },
+      { value: 'namespace-2' },
+      { value: 'namespace-3' },
+    ];
+
+    const Wrapped = withTestQueryProvider(AccessTable);
+
+    const { container } = render(
+      <Wrapped dataset={dataset} onRemove={mockOnRemove} />
+    );
+
+    // All three rows should render independently
+    expect(screen.getByText('namespace-1')).toBeInTheDocument();
+    expect(screen.getByText('namespace-2')).toBeInTheDocument();
+    expect(screen.getByText('namespace-3')).toBeInTheDocument();
+
+    // Should have 3 data rows + 1 header row
+    const rows = container.querySelectorAll('tbody tr');
+    expect(rows.length).toBeGreaterThanOrEqual(3);
+  });
+
+  it('should only select the clicked item without selecting other items', async () => {
+    // This test specifically verifies the bug fix where selecting one row would select all rows
+    const user = userEvent.setup();
+    const dataset = [
+      { value: 'namespace-1' },
+      { value: 'namespace-2' },
+      { value: 'namespace-3' },
+    ];
+
+    const Wrapped = withTestQueryProvider(AccessTable);
+
+    render(<Wrapped dataset={dataset} onRemove={mockOnRemove} />);
+
+    // Get all checkboxes (first one is "select all", rest are individual rows)
+    const checkboxes = screen.getAllByRole('checkbox');
+
+    // Initially, no checkboxes should be checked
+    expect(checkboxes[0]).not.toBeChecked(); // select all
+    expect(checkboxes[1]).not.toBeChecked(); // namespace-1
+    expect(checkboxes[2]).not.toBeChecked(); // namespace-2
+    expect(checkboxes[3]).not.toBeChecked(); // namespace-3
+
+    // Click only the second row (namespace-1)
+    await user.click(checkboxes[1]);
+
+    // Only the clicked checkbox should be checked
+    expect(checkboxes[1]).toBeChecked(); // namespace-1 is checked
+    expect(checkboxes[2]).not.toBeChecked(); // namespace-2 is NOT checked
+    expect(checkboxes[3]).not.toBeChecked(); // namespace-3 is NOT checked
+
+    // Click delete button and verify only the selected item is passed
+    const deleteButton = screen.getByRole('button', { name: /remove/i });
+    await user.click(deleteButton);
+
+    // Verify onRemove was called with ONLY the selected item, not all items
+    expect(mockOnRemove).toHaveBeenCalledTimes(1);
+    expect(mockOnRemove).toHaveBeenCalledWith([{ value: 'namespace-1' }]);
+    expect(mockOnRemove).not.toHaveBeenCalledWith(
+      expect.arrayContaining([
+        { value: 'namespace-2' },
+        { value: 'namespace-3' },
+      ])
+    );
+  });
+});
diff --git a/app/react/kubernetes/cluster/RegistryAccessView/AccessTable.tsx b/app/react/kubernetes/cluster/RegistryAccessView/AccessTable.tsx
new file mode 100644
index 0000000..47d544b
--- /dev/null
+++ b/app/react/kubernetes/cluster/RegistryAccessView/AccessTable.tsx
@@ -0,0 +1,60 @@
+import { UserX } from 'lucide-react';
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { Datatable } from '@@/datatables';
+import { createPersistedStore } from '@@/datatables/types';
+import { useTableState } from '@@/datatables/useTableState';
+import { DeleteButton } from '@@/buttons/DeleteButton';
+
+type Item = { value: string };
+
+const columnHelper = createColumnHelper<Item>();
+
+const columns = [
+  columnHelper.accessor('value', {
+    header: 'Namespace',
+  }),
+];
+
+const tableKey = 'kube-access-table';
+
+const store = createPersistedStore(tableKey);
+
+export function AccessTable({
+  dataset,
+  onRemove,
+}: {
+  dataset: Array<Item>;
+  onRemove: (selectedItems: Array<Item>) => void;
+}) {
+  const tableState = useTableState(store, tableKey);
+
+  return (
+    <Datatable
+      title="Access"
+      titleIcon={UserX}
+      dataset={dataset}
+      columns={columns}
+      settingsManager={tableState}
+      getRowId={(row) => row.value}
+      renderTableActions={(selectedItems) => (
+        <DeleteButton
+          disabled={selectedItems.length === 0}
+          confirmMessage={
+            <>
+              <p>
+                This registry might be used by one or more applications inside
+                this environment. Removing the registry access could lead to a
+                service interruption for these applications.
+              </p>
+              <p>Are you sure you wish to continue?</p>
+            </>
+          }
+          onConfirmed={() => onRemove(selectedItems)}
+          data-cy="remove-registry-access-button"
+        />
+      )}
+      data-cy="registry-access-datatable"
+    />
+  );
+}
diff --git a/app/react/kubernetes/cluster/RegistryAccessView/NamespacesSelector.tsx b/app/react/kubernetes/cluster/RegistryAccessView/NamespacesSelector.tsx
new file mode 100644
index 0000000..5c2da73
--- /dev/null
+++ b/app/react/kubernetes/cluster/RegistryAccessView/NamespacesSelector.tsx
@@ -0,0 +1,64 @@
+import _ from 'lodash';
+import { useMemo } from 'react';
+
+import { Select } from '@@/form-components/ReactSelect';
+
+interface Namespace {
+  id: string;
+  name: string;
+}
+
+interface Props {
+  name?: string;
+  value: string[];
+  onChange(value: string[]): void;
+  namespaces: Namespace[];
+  dataCy: string;
+  inputId?: string;
+  placeholder?: string;
+  allowSelectAll?: boolean;
+}
+
+export function NamespacesSelector({
+  name,
+  value,
+  onChange,
+  namespaces,
+  dataCy,
+  inputId,
+  placeholder,
+  allowSelectAll,
+}: Props) {
+  const options = useMemo(() => {
+    if (allowSelectAll) {
+      return [{ id: 'all', name: 'Select all' }, ...namespaces];
+    }
+    return namespaces;
+  }, [namespaces, allowSelectAll]);
+  return (
+    <Select
+      name={name}
+      isMulti
+      getOptionLabel={(namespace) => namespace.name}
+      getOptionValue={(namespace) => String(namespace.id)}
+      options={options}
+      value={_.compact(
+        value.map((namespaceName) =>
+          namespaces.find((namespace) => namespace.name === namespaceName)
+        )
+      )}
+      closeMenuOnSelect={false}
+      onChange={(selectedNamespaces) => {
+        if (selectedNamespaces.some((namespace) => namespace.id === 'all')) {
+          onChange(namespaces.map((namespace) => namespace.name));
+        } else {
+          onChange(selectedNamespaces.map((namespace) => namespace.name));
+        }
+      }}
+      data-cy={dataCy}
+      id={dataCy}
+      inputId={inputId}
+      placeholder={placeholder}
+    />
+  );
+}
diff --git a/app/react/kubernetes/cluster/ingressClass/IngressClassDatatable/IngressClassDatatable.tsx b/app/react/kubernetes/cluster/ingressClass/IngressClassDatatable/IngressClassDatatable.tsx
new file mode 100644
index 0000000..65dacec
--- /dev/null
+++ b/app/react/kubernetes/cluster/ingressClass/IngressClassDatatable/IngressClassDatatable.tsx
@@ -0,0 +1,210 @@
+import Route from '@/assets/ico/route.svg?c';
+
+import { confirm } from '@@/modals/confirm';
+import { ModalType } from '@@/modals';
+import { Datatable } from '@@/datatables';
+import { Button, ButtonGroup } from '@@/buttons';
+import { createPersistedStore } from '@@/datatables/types';
+import { buildConfirmButton } from '@@/modals/utils';
+import { useTableState } from '@@/datatables/useTableState';
+import { TextTip } from '@@/Tip/TextTip';
+
+import { IngressControllerClassMap } from '../types';
+
+import { columns } from './columns';
+
+const storageKey = 'ingressClasses';
+const settingsStore = createPersistedStore(storageKey, 'name');
+
+interface Props {
+  onChange: (controllerClassMap: IngressControllerClassMap[]) => void; // angular function to save the ingress class list
+  description: string;
+  values: IngressControllerClassMap[] | undefined;
+  initialValues: IngressControllerClassMap[] | undefined;
+  isLoading: boolean;
+  noIngressControllerLabel: string;
+  view: 'namespace' | 'cluster';
+}
+
+export function IngressClassDatatable({
+  onChange,
+  description,
+  initialValues,
+  values,
+  isLoading,
+  noIngressControllerLabel,
+  view,
+}: Props) {
+  const tableState = useTableState(settingsStore, storageKey);
+
+  return (
+    <div className="-mx-[15px]">
+      <Datatable
+        settingsManager={tableState}
+        dataset={values || []}
+        columns={columns}
+        isLoading={isLoading}
+        title="Ingress Controllers"
+        titleIcon={Route}
+        getRowId={(row) => `${row.Name}-${row.ClassName}-${row.Type}`}
+        renderTableActions={(selectedRows) => renderTableActions(selectedRows)}
+        description={renderIngressClassDescription()}
+        data-cy="ingress-class-datatable"
+      />
+    </div>
+  );
+
+  function renderTableActions(selectedRows: IngressControllerClassMap[]) {
+    return (
+      <div className="flex items-start">
+        <ButtonGroup>
+          <Button
+            data-cy="disallow-ingress-controllers-button"
+            disabled={
+              selectedRows.filter((row) => row.Availability === true).length ===
+              0
+            }
+            color="dangerlight"
+            size="small"
+            onClick={() =>
+              updateIngressControllers(selectedRows, values || [], false)
+            }
+          >
+            Disallow selected
+          </Button>
+          <Button
+            data-cy="allow-ingress-controllers-button"
+            disabled={
+              selectedRows.filter((row) => row.Availability === false)
+                .length === 0
+            }
+            color="default"
+            size="small"
+            onClick={() =>
+              updateIngressControllers(selectedRows, values || [], true)
+            }
+          >
+            Allow selected
+          </Button>
+        </ButtonGroup>
+      </div>
+    );
+  }
+
+  function renderIngressClassDescription() {
+    return (
+      <div className="flex flex-col gap-3">
+        {!isLoading && values && values.length === 0 && (
+          <TextTip>{noIngressControllerLabel}</TextTip>
+        )}
+        <div className="text-muted flex w-full flex-col !text-xs">
+          <div className="mt-1">{description}</div>
+          {initialValues &&
+            values &&
+            isUnsavedChanges(initialValues, values) && (
+              <TextTip>Unsaved changes.</TextTip>
+            )}
+        </div>
+      </div>
+    );
+  }
+
+  async function updateIngressControllers(
+    selectedRows: IngressControllerClassMap[],
+    values: IngressControllerClassMap[],
+    availability: boolean
+  ) {
+    const updatedIngressControllers = getUpdatedIngressControllers(
+      selectedRows,
+      values || [],
+      availability
+    );
+
+    if (values && values.length) {
+      const newAllowed = updatedIngressControllers.map(
+        (ingController) => ingController.Availability
+      );
+      if (view === 'namespace') {
+        onChange(updatedIngressControllers);
+        return;
+      }
+
+      const usedControllersToDisallow = values.filter(
+        (ingController, index) => {
+          // if any of the current controllers are allowed, and are used, then become disallowed, then add the controller to a new list
+          if (
+            ingController.Availability &&
+            ingController.Used &&
+            !newAllowed[index]
+          ) {
+            return true;
+          }
+          return false;
+        }
+      );
+
+      if (usedControllersToDisallow.length > 0) {
+        const confirmed = await confirm({
+          title: 'Disallow in-use ingress controllers?',
+          modalType: ModalType.Warn,
+          message: (
+            <div>
+              <p>
+                There are ingress controllers you want to disallow that are in
+                use:
+              </p>
+              <ul className="ml-6">
+                {usedControllersToDisallow.map((controller) => (
+                  <li key={controller.ClassName}>{controller.ClassName}</li>
+                ))}
+              </ul>
+              <p>
+                No new ingress rules can be created for the disallowed
+                controllers.
+              </p>
+            </div>
+          ),
+          confirmButton: buildConfirmButton('Disallow', 'warning'),
+        });
+
+        if (!confirmed) {
+          return;
+        }
+      }
+      onChange(updatedIngressControllers);
+    }
+  }
+}
+
+function isUnsavedChanges(
+  oldIngressControllers: IngressControllerClassMap[],
+  newIngressControllers: IngressControllerClassMap[]
+) {
+  if (oldIngressControllers.length !== newIngressControllers.length) {
+    return true;
+  }
+  for (let i = 0; i < newIngressControllers.length; i += 1) {
+    if (
+      oldIngressControllers[i]?.Availability !==
+      newIngressControllers[i]?.Availability
+    ) {
+      return true;
+    }
+  }
+  return false;
+}
+
+function getUpdatedIngressControllers(
+  selectedRows: IngressControllerClassMap[],
+  allRows: IngressControllerClassMap[],
+  allow: boolean
+) {
+  const selectedRowClassNames = selectedRows.map((row) => row.ClassName);
+  const updatedIngressControllers = allRows?.map((row) => {
+    if (selectedRowClassNames.includes(row.ClassName)) {
+      return { ...row, Availability: allow };
+    }
+    return row;
+  });
+  return updatedIngressControllers;
+}
diff --git a/app/react/kubernetes/cluster/ingressClass/IngressClassDatatable/IngressClassDatatableAngular.tsx b/app/react/kubernetes/cluster/ingressClass/IngressClassDatatable/IngressClassDatatableAngular.tsx
new file mode 100644
index 0000000..248fdaa
--- /dev/null
+++ b/app/react/kubernetes/cluster/ingressClass/IngressClassDatatable/IngressClassDatatableAngular.tsx
@@ -0,0 +1,269 @@
+import { useEffect, useState } from 'react';
+
+import Route from '@/assets/ico/route.svg?c';
+
+import { confirm } from '@@/modals/confirm';
+import { ModalType } from '@@/modals';
+import { Datatable } from '@@/datatables';
+import { Button, ButtonGroup } from '@@/buttons';
+import { createPersistedStore } from '@@/datatables/types';
+import { buildConfirmButton } from '@@/modals/utils';
+import { useTableState } from '@@/datatables/useTableState';
+import { TextTip } from '@@/Tip/TextTip';
+
+import { IngressControllerClassMap } from '../types';
+
+import { columns } from './columns';
+
+const storageKey = 'ingressClasses';
+const settingsStore = createPersistedStore(storageKey, 'name');
+
+interface Props {
+  onChangeControllers: (
+    controllerClassMap: IngressControllerClassMap[]
+  ) => void; // angular function to save the ingress class list
+  description: string;
+  ingressControllers: IngressControllerClassMap[] | undefined;
+  initialIngressControllers: IngressControllerClassMap[] | undefined;
+  allowNoneIngressClass: boolean;
+  isLoading: boolean;
+  view: string;
+}
+
+// This is a legacy component that has more state logic than the new one, for angular views
+// Delete this component when the namespace edit view is migrated to react
+export function IngressClassDatatableAngular({
+  onChangeControllers,
+  description,
+  initialIngressControllers,
+  ingressControllers,
+  allowNoneIngressClass,
+  isLoading,
+  view,
+}: Props) {
+  const tableState = useTableState(settingsStore, storageKey);
+
+  const [ingControllerFormValues, setIngControllerFormValues] = useState(
+    ingressControllers || []
+  );
+
+  // set the ingress controller form values when the ingress controller list changes
+  // and the ingress controller form values are not set
+  useEffect(() => {
+    if (
+      ingressControllers &&
+      ingControllerFormValues.length !== ingressControllers.length
+    ) {
+      setIngControllerFormValues(ingressControllers);
+    }
+  }, [ingressControllers, ingControllerFormValues]);
+
+  useEffect(() => {
+    if (allowNoneIngressClass === undefined || isLoading) {
+      return;
+    }
+
+    let newIngFormValues: IngressControllerClassMap[];
+    const isCustomTypeExist = ingControllerFormValues.some(
+      (ic) => ic.Type === 'custom'
+    );
+    if (allowNoneIngressClass) {
+      newIngFormValues = [...ingControllerFormValues];
+      // add the ingress controller type 'custom' with a 'none' ingress class name
+      if (!isCustomTypeExist) {
+        newIngFormValues.push({
+          Name: 'none',
+          ClassName: 'none',
+          Type: 'custom',
+          Availability: true,
+          New: false,
+          Used: false,
+        });
+      }
+    } else {
+      newIngFormValues = ingControllerFormValues.filter(
+        (ingController) => ingController.ClassName !== 'none'
+      );
+    }
+    setIngControllerFormValues(newIngFormValues);
+    onChangeControllers(newIngFormValues);
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [allowNoneIngressClass, onChangeControllers]);
+
+  return (
+    <div className="-mx-[15px]">
+      <Datatable
+        settingsManager={tableState}
+        dataset={ingControllerFormValues || []}
+        columns={columns}
+        isLoading={isLoading}
+        title="Ingress Controllers"
+        titleIcon={Route}
+        getRowId={(row) => `${row.Name}-${row.ClassName}-${row.Type}`}
+        renderTableActions={(selectedRows) => renderTableActions(selectedRows)}
+        description={renderIngressClassDescription()}
+        data-cy="k8s-ingress-classes-datatable"
+      />
+    </div>
+  );
+
+  function renderTableActions(selectedRows: IngressControllerClassMap[]) {
+    return (
+      <div className="flex items-start">
+        <ButtonGroup>
+          <Button
+            disabled={
+              selectedRows.filter((row) => row.Availability === true).length ===
+              0
+            }
+            color="dangerlight"
+            size="small"
+            onClick={() =>
+              updateIngressControllers(
+                selectedRows,
+                ingControllerFormValues || [],
+                false
+              )
+            }
+            data-cy="k8s-disallow-selected-ingress-controllers-button"
+          >
+            Disallow selected
+          </Button>
+          <Button
+            disabled={
+              selectedRows.filter((row) => row.Availability === false)
+                .length === 0
+            }
+            color="default"
+            size="small"
+            onClick={() =>
+              updateIngressControllers(
+                selectedRows,
+                ingControllerFormValues || [],
+                true
+              )
+            }
+            data-cy="k8s-allow-selected-ingress-controllers-button"
+          >
+            Allow selected
+          </Button>
+        </ButtonGroup>
+      </div>
+    );
+  }
+
+  function renderIngressClassDescription() {
+    return (
+      <div className="text-muted flex w-full flex-col !text-xs">
+        <div className="mt-1">{description}</div>
+        {initialIngressControllers &&
+          ingControllerFormValues &&
+          isUnsavedChanges(
+            initialIngressControllers,
+            ingControllerFormValues
+          ) && <TextTip>Unsaved changes.</TextTip>}
+      </div>
+    );
+  }
+
+  async function updateIngressControllers(
+    selectedRows: IngressControllerClassMap[],
+    ingControllerFormValues: IngressControllerClassMap[],
+    availability: boolean
+  ) {
+    const updatedIngressControllers = getUpdatedIngressControllers(
+      selectedRows,
+      ingControllerFormValues || [],
+      availability
+    );
+
+    if (ingressControllers && ingressControllers.length) {
+      const newAllowed = updatedIngressControllers.map(
+        (ingController) => ingController.Availability
+      );
+      if (view === 'namespace') {
+        setIngControllerFormValues(updatedIngressControllers);
+        onChangeControllers(updatedIngressControllers);
+        return;
+      }
+
+      const usedControllersToDisallow = ingressControllers.filter(
+        (ingController, index) => {
+          // if any of the current controllers are allowed, and are used, then become disallowed, then add the controller to a new list
+          if (
+            ingController.Availability &&
+            ingController.Used &&
+            !newAllowed[index]
+          ) {
+            return true;
+          }
+          return false;
+        }
+      );
+
+      if (usedControllersToDisallow.length > 0) {
+        const confirmed = await confirm({
+          title: 'Disallow in-use ingress controllers?',
+          modalType: ModalType.Warn,
+          message: (
+            <div>
+              <p>
+                There are ingress controllers you want to disallow that are in
+                use:
+              </p>
+              <ul className="ml-6">
+                {usedControllersToDisallow.map((controller) => (
+                  <li key={controller.ClassName}>{controller.ClassName}</li>
+                ))}
+              </ul>
+              <p>
+                No new ingress rules can be created for the disallowed
+                controllers.
+              </p>
+            </div>
+          ),
+          confirmButton: buildConfirmButton('Disallow', 'warning'),
+        });
+
+        if (!confirmed) {
+          return;
+        }
+      }
+      setIngControllerFormValues(updatedIngressControllers);
+      onChangeControllers(updatedIngressControllers);
+    }
+  }
+}
+
+function isUnsavedChanges(
+  oldIngressControllers: IngressControllerClassMap[],
+  newIngressControllers: IngressControllerClassMap[]
+) {
+  if (oldIngressControllers.length !== newIngressControllers.length) {
+    return true;
+  }
+  for (let i = 0; i < newIngressControllers.length; i += 1) {
+    if (
+      oldIngressControllers[i]?.Availability !==
+      newIngressControllers[i]?.Availability
+    ) {
+      return true;
+    }
+  }
+  return false;
+}
+
+function getUpdatedIngressControllers(
+  selectedRows: IngressControllerClassMap[],
+  allRows: IngressControllerClassMap[],
+  allow: boolean
+) {
+  const selectedRowClassNames = selectedRows.map((row) => row.ClassName);
+  const updatedIngressControllers = allRows?.map((row) => {
+    if (selectedRowClassNames.includes(row.ClassName)) {
+      return { ...row, Availability: allow };
+    }
+    return row;
+  });
+  return updatedIngressControllers;
+}
diff --git a/app/react/kubernetes/cluster/ingressClass/IngressClassDatatable/RowContext.tsx b/app/react/kubernetes/cluster/ingressClass/IngressClassDatatable/RowContext.tsx
new file mode 100644
index 0000000..66af358
--- /dev/null
+++ b/app/react/kubernetes/cluster/ingressClass/IngressClassDatatable/RowContext.tsx
@@ -0,0 +1,11 @@
+import { Environment } from '@/react/portainer/environments/types';
+
+import { createRowContext } from '@@/datatables/RowContext';
+
+interface RowContextState {
+  environment: Environment;
+}
+
+const { RowProvider, useRowContext } = createRowContext<RowContextState>();
+
+export { RowProvider, useRowContext };
diff --git a/app/react/kubernetes/cluster/ingressClass/IngressClassDatatable/columns/availability.tsx b/app/react/kubernetes/cluster/ingressClass/IngressClassDatatable/columns/availability.tsx
new file mode 100644
index 0000000..0c78b90
--- /dev/null
+++ b/app/react/kubernetes/cluster/ingressClass/IngressClassDatatable/columns/availability.tsx
@@ -0,0 +1,28 @@
+import { CellContext } from '@tanstack/react-table';
+import { Check, X } from 'lucide-react';
+
+import { Badge } from '@@/Badge';
+import { Icon } from '@@/Icon';
+
+import type { IngressControllerClassMap } from '../../types';
+
+import { columnHelper } from './helper';
+
+export const availability = columnHelper.accessor('Availability', {
+  header: 'Availability',
+  cell: Cell,
+  id: 'availability',
+  invertSorting: true,
+  sortingFn: 'basic',
+});
+
+function Cell({ getValue }: CellContext<IngressControllerClassMap, boolean>) {
+  const availability = getValue();
+
+  return (
+    <Badge type={availability ? 'success' : 'danger'}>
+      <Icon icon={availability ? Check : X} className="!mr-1" />
+      {availability ? 'Allowed' : 'Disallowed'}
+    </Badge>
+  );
+}
diff --git a/app/react/kubernetes/cluster/ingressClass/IngressClassDatatable/columns/helper.ts b/app/react/kubernetes/cluster/ingressClass/IngressClassDatatable/columns/helper.ts
new file mode 100644
index 0000000..9014d0e
--- /dev/null
+++ b/app/react/kubernetes/cluster/ingressClass/IngressClassDatatable/columns/helper.ts
@@ -0,0 +1,5 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { IngressControllerClassMap } from '../../types';
+
+export const columnHelper = createColumnHelper<IngressControllerClassMap>();
diff --git a/app/react/kubernetes/cluster/ingressClass/IngressClassDatatable/columns/index.ts b/app/react/kubernetes/cluster/ingressClass/IngressClassDatatable/columns/index.ts
new file mode 100644
index 0000000..91e91c3
--- /dev/null
+++ b/app/react/kubernetes/cluster/ingressClass/IngressClassDatatable/columns/index.ts
@@ -0,0 +1,5 @@
+import { availability } from './availability';
+import { type } from './type';
+import { name } from './name';
+
+export const columns = [name, type, availability];
diff --git a/app/react/kubernetes/cluster/ingressClass/IngressClassDatatable/columns/name.tsx b/app/react/kubernetes/cluster/ingressClass/IngressClassDatatable/columns/name.tsx
new file mode 100644
index 0000000..196d1eb
--- /dev/null
+++ b/app/react/kubernetes/cluster/ingressClass/IngressClassDatatable/columns/name.tsx
@@ -0,0 +1,27 @@
+import { CellContext } from '@tanstack/react-table';
+
+import { Badge } from '@@/Badge';
+
+import type { IngressControllerClassMap } from '../../types';
+
+import { columnHelper } from './helper';
+
+export const name = columnHelper.accessor('ClassName', {
+  header: 'Ingress class',
+  cell: NameCell,
+  id: 'name',
+});
+
+function NameCell({
+  row,
+  getValue,
+}: CellContext<IngressControllerClassMap, string>) {
+  const className = getValue();
+
+  return (
+    <span className="flex flex-nowrap gap-2">
+      {className}
+      {row.original.New && <Badge className="ml-auto">Newly detected</Badge>}
+    </span>
+  );
+}
diff --git a/app/react/kubernetes/cluster/ingressClass/IngressClassDatatable/columns/type.tsx b/app/react/kubernetes/cluster/ingressClass/IngressClassDatatable/columns/type.tsx
new file mode 100644
index 0000000..0bf2109
--- /dev/null
+++ b/app/react/kubernetes/cluster/ingressClass/IngressClassDatatable/columns/type.tsx
@@ -0,0 +1,10 @@
+import { columnHelper } from './helper';
+
+export const type = columnHelper.accessor('Type', {
+  header: 'Ingress controller type',
+  cell: ({ getValue }) => {
+    const type = getValue();
+    return type || '-';
+  },
+  id: 'type',
+});
diff --git a/app/react/kubernetes/cluster/ingressClass/IngressClassDatatable/index.ts b/app/react/kubernetes/cluster/ingressClass/IngressClassDatatable/index.ts
new file mode 100644
index 0000000..0f508c5
--- /dev/null
+++ b/app/react/kubernetes/cluster/ingressClass/IngressClassDatatable/index.ts
@@ -0,0 +1 @@
+export * from './IngressClassDatatable';
diff --git a/app/react/kubernetes/cluster/ingressClass/IngressClassDatatable/types.ts b/app/react/kubernetes/cluster/ingressClass/IngressClassDatatable/types.ts
new file mode 100644
index 0000000..82f8774
--- /dev/null
+++ b/app/react/kubernetes/cluster/ingressClass/IngressClassDatatable/types.ts
@@ -0,0 +1,27 @@
+import {
+  PaginationTableSettings,
+  SortableTableSettings,
+} from '@/react/components/datatables/types';
+
+export interface TableSettings
+  extends SortableTableSettings, PaginationTableSettings {}
+
+export type SupportedIngControllerTypes =
+  | 'nginx'
+  | 'traefik'
+  | 'other'
+  | 'custom';
+
+// Not having 'extends Record<string, unknown>' fixes validation type errors from yup
+export interface IngressControllerClassMap {
+  Name: string;
+  ClassName: string;
+  Type: string;
+  Availability: boolean;
+  New: boolean;
+  Used: boolean; // if the controller is used by any ingress in the cluster
+}
+
+// Record<string, unknown> fixes type errors when using the type with a react datatable
+export interface IngressControllerClassMapRowData
+  extends Record<string, unknown>, IngressControllerClassMap {}
diff --git a/app/react/kubernetes/cluster/ingressClass/IngressClassDatatable/useIngressControllerClassMap.ts b/app/react/kubernetes/cluster/ingressClass/IngressClassDatatable/useIngressControllerClassMap.ts
new file mode 100644
index 0000000..607b6e2
--- /dev/null
+++ b/app/react/kubernetes/cluster/ingressClass/IngressClassDatatable/useIngressControllerClassMap.ts
@@ -0,0 +1,94 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import PortainerError from '@/portainer/error';
+import axios from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+
+import { IngressControllerClassMapRowData } from './types';
+
+export function useIngressControllerClassMapQuery({
+  environmentId,
+  namespace,
+  allowedOnly,
+}: {
+  environmentId?: EnvironmentId;
+  namespace?: string;
+  allowedOnly?: boolean;
+}) {
+  return useQuery(
+    [
+      'environments',
+      environmentId,
+      'ingresscontrollers',
+      namespace,
+      allowedOnly,
+    ],
+    () => {
+      if (!environmentId) {
+        return [];
+      }
+      return getIngressControllerClassMap({
+        environmentId,
+        namespace,
+        allowedOnly,
+      });
+    },
+    {
+      ...withError('Failure', 'Unable to get ingress controllers.'),
+      enabled: !!environmentId,
+    }
+  );
+}
+
+// get all supported ingress classes and controllers for the cluster
+// allowedOnly set to true will hide globally disallowed ingresscontrollers
+export async function getIngressControllerClassMap({
+  environmentId,
+  namespace,
+  allowedOnly,
+}: {
+  environmentId: EnvironmentId;
+  namespace?: string;
+  allowedOnly?: boolean;
+}) {
+  try {
+    const { data: controllerMaps } = await axios.get<
+      IngressControllerClassMapRowData[]
+    >(
+      buildUrl(environmentId, namespace),
+      allowedOnly ? { params: { allowedOnly: true } } : undefined
+    );
+    return controllerMaps;
+  } catch (e) {
+    throw new PortainerError('Unable to get ingress controllers.', e as Error);
+  }
+}
+
+// get all supported ingress classes and controllers for the cluster
+export async function updateIngressControllerClassMap(
+  environmentId: EnvironmentId,
+  ingressControllerClassMap: IngressControllerClassMapRowData[],
+  namespace?: string
+) {
+  try {
+    const { data: controllerMaps } = await axios.put<
+      IngressControllerClassMapRowData[]
+    >(buildUrl(environmentId, namespace), ingressControllerClassMap);
+    return controllerMaps;
+  } catch (e) {
+    throw new PortainerError(
+      'Unable to update ingress controllers.',
+      e as Error
+    );
+  }
+}
+
+function buildUrl(environmentId: EnvironmentId, namespace?: string) {
+  let url = `kubernetes/${environmentId}/`;
+  if (namespace) {
+    url += `namespaces/${namespace}/`;
+  }
+  url += 'ingresscontrollers';
+  return url;
+}
diff --git a/app/react/kubernetes/cluster/ingressClass/IngressClassDatatable/utils.ts b/app/react/kubernetes/cluster/ingressClass/IngressClassDatatable/utils.ts
new file mode 100644
index 0000000..79332ed
--- /dev/null
+++ b/app/react/kubernetes/cluster/ingressClass/IngressClassDatatable/utils.ts
@@ -0,0 +1,37 @@
+import { IngressControllerClassMap } from '../types';
+
+export function getIngressClassesFormValues(
+  allowNoneIngressClass: boolean,
+  ingressClasses?: IngressControllerClassMap[]
+) {
+  const ingressClassesFormValues = ingressClasses ? [...ingressClasses] : [];
+  const noneIngressClassIndex = ingressClassesFormValues.findIndex(
+    (ingressClass) =>
+      ingressClass.Name === 'none' &&
+      ingressClass.ClassName === 'none' &&
+      ingressClass.Type === 'custom'
+  );
+  // add the none ingress class if it doesn't exist
+  if (allowNoneIngressClass && noneIngressClassIndex === -1) {
+    return [
+      ...ingressClassesFormValues,
+      {
+        Name: 'none',
+        ClassName: 'none',
+        Type: 'custom',
+        Availability: true,
+        New: false,
+        Used: false,
+      },
+    ];
+  }
+  // remove the none ingress class if it exists
+  if (!allowNoneIngressClass && noneIngressClassIndex > -1) {
+    return [
+      ...ingressClassesFormValues.slice(0, noneIngressClassIndex),
+      ...ingressClassesFormValues.slice(noneIngressClassIndex + 1),
+    ];
+  }
+  // otherwise return the ingress classes as is
+  return ingressClassesFormValues;
+}
diff --git a/app/react/kubernetes/cluster/ingressClass/ingressClass.service.ts b/app/react/kubernetes/cluster/ingressClass/ingressClass.service.ts
new file mode 100644
index 0000000..85282e3
--- /dev/null
+++ b/app/react/kubernetes/cluster/ingressClass/ingressClass.service.ts
@@ -0,0 +1,21 @@
+import { IngressClassList } from 'kubernetes-types/networking/v1';
+
+import axios from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { parseKubernetesAxiosError } from '../../axiosError';
+
+export async function getAllIngressClasses(environmentId: EnvironmentId) {
+  try {
+    const {
+      data: { items },
+    } = await axios.get<IngressClassList>(urlBuilder(environmentId));
+    return items;
+  } catch (e) {
+    throw parseKubernetesAxiosError(e, 'Unable to retrieve ingress classes');
+  }
+}
+
+function urlBuilder(environmentId: EnvironmentId) {
+  return `endpoints/${environmentId}/kubernetes/apis/networking.k8s.io/v1/ingressclasses`;
+}
diff --git a/app/react/kubernetes/cluster/ingressClass/types.ts b/app/react/kubernetes/cluster/ingressClass/types.ts
new file mode 100644
index 0000000..f0d5df4
--- /dev/null
+++ b/app/react/kubernetes/cluster/ingressClass/types.ts
@@ -0,0 +1,14 @@
+export type SupportedIngControllerTypes =
+  | 'nginx'
+  | 'traefik'
+  | 'other'
+  | 'custom';
+
+export interface IngressControllerClassMap {
+  Name: string;
+  ClassName: string;
+  Type: string;
+  Availability: boolean;
+  New: boolean;
+  Used: boolean; // if the controller is used by any ingress in the cluster
+}
diff --git a/app/react/kubernetes/cluster/ingressClass/useIngressControllerClassMap.ts b/app/react/kubernetes/cluster/ingressClass/useIngressControllerClassMap.ts
new file mode 100644
index 0000000..94bb9aa
--- /dev/null
+++ b/app/react/kubernetes/cluster/ingressClass/useIngressControllerClassMap.ts
@@ -0,0 +1,93 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+
+import { IngressControllerClassMap } from './types';
+
+export function useIngressControllerClassMapQuery({
+  environmentId,
+  namespace,
+  allowedOnly,
+}: {
+  environmentId?: EnvironmentId;
+  namespace?: string;
+  allowedOnly?: boolean;
+}) {
+  return useQuery(
+    [
+      'environments',
+      environmentId,
+      'ingresscontrollers',
+      namespace,
+      allowedOnly,
+    ],
+    () => {
+      if (!environmentId) {
+        return [];
+      }
+      return getIngressControllerClassMap({
+        environmentId,
+        namespace,
+        allowedOnly,
+      });
+    },
+    {
+      ...withError('Failure', 'Unable to get ingress controllers.'),
+      enabled: !!environmentId,
+    }
+  );
+}
+
+// get all supported ingress classes and controllers for the cluster
+// allowedOnly set to true will hide globally disallowed ingresscontrollers
+export async function getIngressControllerClassMap({
+  environmentId,
+  namespace,
+  allowedOnly,
+}: {
+  environmentId: EnvironmentId;
+  namespace?: string;
+  allowedOnly?: boolean;
+}) {
+  try {
+    const { data: controllerMaps } = await axios.get<
+      IngressControllerClassMap[]
+    >(
+      buildUrl(environmentId, namespace),
+      allowedOnly ? { params: { allowedOnly: true } } : undefined
+    );
+    return controllerMaps;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to get ingress controllers.');
+  }
+}
+
+// get all supported ingress classes and controllers for the cluster
+export async function updateIngressControllerClassMap(
+  environmentId: EnvironmentId,
+  ingressControllerClassMap: IngressControllerClassMap[],
+  namespace?: string
+) {
+  if (ingressControllerClassMap.length === 0) {
+    return [];
+  }
+  try {
+    const { data: controllerMaps } = await axios.put<
+      IngressControllerClassMap[]
+    >(buildUrl(environmentId, namespace), ingressControllerClassMap);
+    return controllerMaps;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to update ingress controllers.');
+  }
+}
+
+function buildUrl(environmentId: EnvironmentId, namespace?: string) {
+  let url = `kubernetes/${environmentId}/`;
+  if (namespace) {
+    url += `namespaces/${namespace}/`;
+  }
+  url += 'ingresscontrollers';
+  return url;
+}
diff --git a/app/react/kubernetes/cluster/kubernetesEndpoint.service.ts b/app/react/kubernetes/cluster/kubernetesEndpoint.service.ts
new file mode 100644
index 0000000..342eeac
--- /dev/null
+++ b/app/react/kubernetes/cluster/kubernetesEndpoint.service.ts
@@ -0,0 +1,35 @@
+import { EndpointsList } from 'kubernetes-types/core/v1';
+import { useQuery } from '@tanstack/react-query';
+
+import axios from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { withError } from '@/react-tools/react-query';
+
+import { parseKubernetesAxiosError } from '../axiosError';
+
+async function getKubernetesEndpoints(environmentId: EnvironmentId) {
+  try {
+    const { data: endpointsList } = await axios.get<EndpointsList>(
+      `/endpoints/${environmentId}/kubernetes/api/v1/endpoints`
+    );
+    return endpointsList.items;
+  } catch (e) {
+    throw parseKubernetesAxiosError(e, 'Unable to retrieve endpoints');
+  }
+}
+
+export function useKubernetesEndpointsQuery(
+  environmentId: EnvironmentId,
+  options?: { autoRefreshRate?: number }
+) {
+  return useQuery(
+    ['environments', environmentId, 'kubernetes', 'endpoints'],
+    () => getKubernetesEndpoints(environmentId),
+    {
+      ...withError('Unable to retrieve Kubernetes endpoints'),
+      refetchInterval() {
+        return options?.autoRefreshRate ?? false;
+      },
+    }
+  );
+}
diff --git a/app/react/kubernetes/cluster/nodeUtils.ts b/app/react/kubernetes/cluster/nodeUtils.ts
new file mode 100644
index 0000000..b43a72d
--- /dev/null
+++ b/app/react/kubernetes/cluster/nodeUtils.ts
@@ -0,0 +1,240 @@
+import { Node, Endpoints, EndpointAddress } from 'kubernetes-types/core/v1';
+
+import { StatusBadgeType } from '@@/StatusBadge';
+
+import { NodeAvailability } from './types';
+
+const LABEL_NODE_ROLE_PREFIX = 'node-role.kubernetes.io/'; // Node role labels: https://kubernetes.io/docs/concepts/architecture/nodes/#node-roles
+const NODE_LABEL_ROLE = 'kubernetes.io/role';
+const NODE_LABEL_ROLE_ALT = 'node.kubernetes.io/role';
+
+export function getNodeRoles(node: Node): string[] {
+  // Mirrors kubectl role detection
+  const labels = node.metadata?.labels ?? {};
+
+  const entries = Object.entries(labels);
+
+  const rolesFromPrefix = entries
+    .filter(([key]) => key.startsWith(LABEL_NODE_ROLE_PREFIX))
+    .map(([key]) => key.slice(LABEL_NODE_ROLE_PREFIX.length))
+    .filter((role) => role.length > 0);
+
+  const rolesFromValue = entries
+    .filter(
+      ([key, value]) =>
+        (key === NODE_LABEL_ROLE || key === NODE_LABEL_ROLE_ALT) && value !== ''
+    )
+    .map(([, value]) => value);
+
+  return Array.from(new Set<string>([...rolesFromPrefix, ...rolesFromValue]));
+}
+
+/**
+ * Returns the role of the node based on the labels.
+ * @param node The node to get the role of.
+ * It uses similar logic to https://github.com/kubernetes/kubectl/blob/04bb64c802171066ed0d886c437590c0b7ff1ed3/pkg/describe/describe.go#L5523C1-L5541C2 ,
+ * but only returns 'Control plane' or 'Worker'. It also has an additional check for microk8s.
+ */
+export function getRole(node: Node) {
+  const roles = getNodeRoles(node);
+  const isControlPlane =
+    roles.includes('control-plane') || roles.includes('master');
+  const isMicrok8sControlPlane =
+    node.metadata?.labels?.['node.kubernetes.io/microk8s-controlplane'] !==
+    undefined;
+
+  if (isControlPlane || isMicrok8sControlPlane) {
+    return 'Control plane';
+  }
+  return 'Worker';
+}
+
+type ApiDetails = {
+  isApi: boolean;
+  apiPort?: number;
+};
+
+/**
+ * Determines if a node is serving the Kubernetes API and retrieves its port
+ */
+export function getNodeApiDetails(
+  node: Node,
+  endpoints: Endpoints[]
+): ApiDetails {
+  // Avoid misclassification of worker nodes as API nodes
+  if (getRole(node) !== 'Control plane') {
+    return { isApi: false };
+  }
+  const nodeName = node.metadata?.name;
+  const nodeIpAddress = getInternalNodeIpAddress(node);
+  const kubernetesEndpoint = endpoints.find(
+    (e) => e.metadata?.name === 'kubernetes'
+  ); // In-cluster 'kubernetes' Service for API discovery: https://kubernetes.io/docs/concepts/services-networking/service/#discovering-services
+
+  type AddressPortPair = { address: EndpointAddress; port?: number };
+
+  const addressPortPairs =
+    kubernetesEndpoint?.subsets?.reduce<AddressPortPair[]>((acc, subset) => {
+      const port = subset.ports?.[0]?.port; // Control plane ports (apiserver typically 6443): https://kubernetes.io/docs/reference/ports-and-protocols/#control-plane
+      const pairs: AddressPortPair[] = (subset.addresses ?? []).map(
+        (address) => ({ address, port })
+      );
+      return acc.concat(pairs);
+    }, []) ?? [];
+
+  const nodeNameMatch = addressPortPairs.find(
+    ({ address }) =>
+      address.nodeName && nodeName && address.nodeName === nodeName
+  ); // Use EndpointAddress.nodeName to associate endpoints to nodes: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#endpointaddress-v1-core
+
+  if (nodeNameMatch) {
+    return { isApi: true, apiPort: nodeNameMatch.port };
+  }
+
+  const ipMatch = nodeIpAddress
+    ? addressPortPairs.find(({ address }) => address.ip === nodeIpAddress)
+    : undefined;
+
+  if (ipMatch) {
+    return { isApi: true, apiPort: ipMatch.port };
+  }
+
+  return { isApi: false };
+}
+
+export function getInternalNodeIpAddress(node?: Node) {
+  return node?.status?.addresses?.find(
+    (address) => address.type === 'InternalIP'
+  )?.address;
+}
+
+/**
+ * If the environment url includes the node address, then it is a published node
+ */
+export function isNodePublished(node: Node, environmentUrl?: string) {
+  const nodeAddress = getInternalNodeIpAddress(node);
+  return (
+    !!nodeAddress && !!environmentUrl && environmentUrl?.includes(nodeAddress)
+  );
+}
+
+const KubernetesNodeConditionTypes = Object.freeze({
+  READY: 'Ready',
+  MEMORY_PRESSURE: 'MemoryPressure',
+  PID_PRESSURE: 'PIDPressure',
+  DISK_PRESSURE: 'DiskPressure',
+  NETWORK_UNAVAILABLE: 'NetworkUnavailable',
+});
+
+/**
+ * Returns the status of the node based on the conditions
+ * @returns The status of the node. One of 'Ready', 'Warning', 'Unhealthy'
+ */
+export function getNodeStatus(node: Node): {
+  status: string;
+  statusType: StatusBadgeType;
+  warningMessage?: string;
+} {
+  const readyCondition = node.status?.conditions?.find(
+    (c) => c.type === 'Ready'
+  );
+
+  // Helper to check for specific condition type
+  function hasCondition(type: string): boolean {
+    return (
+      node.status?.conditions?.some(
+        (c) => c.type === type && c.status === 'True'
+      ) || false
+    );
+  }
+
+  // ready
+  if (readyCondition?.status === 'True') {
+    // check for warnings
+    const conditions: Conditions = {
+      MemoryPressure: hasCondition(
+        KubernetesNodeConditionTypes.MEMORY_PRESSURE
+      ),
+      PIDPressure: hasCondition(KubernetesNodeConditionTypes.PID_PRESSURE),
+      DiskPressure: hasCondition(KubernetesNodeConditionTypes.DISK_PRESSURE),
+      NetworkUnavailable: hasCondition(
+        KubernetesNodeConditionTypes.NETWORK_UNAVAILABLE
+      ),
+    };
+    // ready with warnings
+    if (Object.values(conditions).some(Boolean)) {
+      return {
+        status: 'Warning',
+        statusType: 'warning',
+        warningMessage: getNodeStatusMessage(conditions),
+      };
+    }
+    // ready with no warnings
+    return {
+      status: 'Ready',
+      statusType: 'success',
+    };
+  }
+  // unknown
+  if (readyCondition?.status === 'Unknown') {
+    return {
+      status: 'Warning',
+      statusType: 'warning',
+    };
+  }
+  // not ready
+  return {
+    status: 'Unhealthy',
+    statusType: 'danger',
+  };
+}
+
+type Conditions = {
+  MemoryPressure: boolean;
+  PIDPressure: boolean;
+  DiskPressure: boolean;
+  NetworkUnavailable: boolean;
+};
+
+function getNodeStatusMessage(conditions: Conditions) {
+  if (conditions.MemoryPressure) {
+    return 'Node memory is running low';
+  }
+  if (conditions.PIDPressure) {
+    return 'Too many processes running on the node';
+  }
+  if (conditions.DiskPressure) {
+    return 'Node disk capacity is running low';
+  }
+  if (conditions.NetworkUnavailable) {
+    return 'Incorrect node network configuration';
+  }
+  return undefined;
+}
+
+export const KubernetesPortainerNodeDrainLabel =
+  'io.portainer/node-status-drain';
+
+export function getAvailability(node: Node): NodeAvailability {
+  if (!node.spec?.unschedulable) {
+    return 'Active';
+  }
+  if (
+    Object.keys(node.metadata?.labels ?? {}).includes(
+      KubernetesPortainerNodeDrainLabel
+    )
+  ) {
+    return 'Drain';
+  }
+  return 'Pause';
+}
+
+export function isSystemLabel(labelKey: string): boolean {
+  return (
+    labelKey.startsWith('beta.kubernetes.io') ||
+    labelKey.startsWith('kubernetes.io') ||
+    labelKey === 'node-role.kubernetes.io/master' ||
+    labelKey.startsWith('node-role.kubernetes.io/control-plane') ||
+    labelKey.startsWith('node.kubernetes.io')
+  );
+}
diff --git a/app/react/kubernetes/cluster/queries/query-keys.ts b/app/react/kubernetes/cluster/queries/query-keys.ts
new file mode 100644
index 0000000..1dbc2bc
--- /dev/null
+++ b/app/react/kubernetes/cluster/queries/query-keys.ts
@@ -0,0 +1,16 @@
+export const queryKeys = {
+  nodes: (environmentId: number) => [
+    'environments',
+    environmentId,
+    'kubernetes',
+    'nodes',
+  ],
+  node: (environmentId: number, nodeName: string, isYaml?: boolean) => [
+    'environments',
+    environmentId,
+    'kubernetes',
+    'nodes',
+    nodeName,
+    isYaml ? 'yaml' : undefined,
+  ],
+};
diff --git a/app/react/kubernetes/cluster/queries/useDrainNodeMutation.ts b/app/react/kubernetes/cluster/queries/useDrainNodeMutation.ts
new file mode 100644
index 0000000..a9693d9
--- /dev/null
+++ b/app/react/kubernetes/cluster/queries/useDrainNodeMutation.ts
@@ -0,0 +1,34 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { withInvalidate, withError } from '@/react-tools/react-query';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { queryKeys as applicationQueryKeys } from '../../applications/queries/query-keys';
+
+import { queryKeys } from './query-keys';
+
+export function useDrainNodeMutation(
+  environmentId: EnvironmentId,
+  nodeName: string
+) {
+  const queryClient = useQueryClient();
+
+  return useMutation(() => drainNode(environmentId, nodeName), {
+    ...withInvalidate(queryClient, [
+      queryKeys.nodes(environmentId),
+      queryKeys.node(environmentId, nodeName),
+      // invalidate apps, since drain can evict pods
+      applicationQueryKeys.applications(environmentId),
+    ]),
+    ...withError('Unable to drain node'),
+  });
+}
+
+async function drainNode(environmentId: EnvironmentId, nodeName: string) {
+  try {
+    await axios.post(`/kubernetes/${environmentId}/nodes/${nodeName}/drain`);
+  } catch (error) {
+    throw parseAxiosError(error);
+  }
+}
diff --git a/app/react/kubernetes/cluster/queries/useNodeQuery.ts b/app/react/kubernetes/cluster/queries/useNodeQuery.ts
new file mode 100644
index 0000000..1f46114
--- /dev/null
+++ b/app/react/kubernetes/cluster/queries/useNodeQuery.ts
@@ -0,0 +1,49 @@
+import { Node } from 'kubernetes-types/core/v1';
+import { useQuery } from '@tanstack/react-query';
+
+import axios from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { withError } from '@/react-tools/react-query';
+
+import { parseKubernetesAxiosError } from '../../axiosError';
+
+import { queryKeys } from './query-keys';
+
+async function getNode(
+  environmentId: EnvironmentId,
+  nodeName: string,
+  isYaml?: boolean
+) {
+  try {
+    const { data: node } = await axios.get<Node>(
+      `/endpoints/${environmentId}/kubernetes/api/v1/nodes/${nodeName}`,
+      {
+        headers: {
+          Accept: isYaml ? 'application/yaml' : undefined,
+        },
+      }
+    );
+    return node;
+  } catch (e) {
+    throw parseKubernetesAxiosError(e, 'Unable to get node details');
+  }
+}
+
+export function useNodeQuery<T = Node>(
+  environmentId: EnvironmentId,
+  nodeName: string,
+  queryOptions?: {
+    select?: (data: Node) => T;
+    enabled?: boolean;
+    isYaml?: boolean;
+  }
+) {
+  return useQuery(
+    queryKeys.node(environmentId, nodeName, queryOptions?.isYaml),
+    () => getNode(environmentId, nodeName, queryOptions?.isYaml),
+    {
+      ...withError('Unable to get node details'),
+      ...queryOptions,
+    }
+  );
+}
diff --git a/app/react/kubernetes/cluster/queries/useNodesQuery.ts b/app/react/kubernetes/cluster/queries/useNodesQuery.ts
new file mode 100644
index 0000000..84ad100
--- /dev/null
+++ b/app/react/kubernetes/cluster/queries/useNodesQuery.ts
@@ -0,0 +1,41 @@
+import { Node } from 'kubernetes-types/core/v1';
+import { useQuery } from '@tanstack/react-query';
+
+import axios from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { withError } from '@/react-tools/react-query';
+
+import { parseKubernetesAxiosError } from '../../axiosError';
+
+import { queryKeys } from './query-keys';
+
+// getNodes is used to get a list of nodes using the kubernetes API
+export async function getNodes(environmentId: EnvironmentId) {
+  try {
+    const { data: nodes } = await axios.get<Node[]>(
+      `/kubernetes/${environmentId}/nodes`
+    );
+    return nodes;
+  } catch (e) {
+    throw parseKubernetesAxiosError(e, 'Unable to get nodes');
+  }
+}
+
+// useNodesQuery is used to get an array of nodes using the kubernetes API
+export function useNodesQuery<T = Node[]>(
+  environmentId: EnvironmentId,
+  options?: { autoRefreshRate?: number; select?: (nodes: Node[]) => T }
+) {
+  return useQuery(
+    queryKeys.nodes(environmentId),
+    async () => getNodes(environmentId),
+    {
+      ...withError(
+        'Failed to get nodes from the Kubernetes api',
+        'Failed to get nodes'
+      ),
+      refetchInterval: options?.autoRefreshRate ?? false,
+      select: options?.select,
+    }
+  );
+}
diff --git a/app/react/kubernetes/cluster/queries/useUpdateNodeMutation.test.ts b/app/react/kubernetes/cluster/queries/useUpdateNodeMutation.test.ts
new file mode 100644
index 0000000..c9f5020
--- /dev/null
+++ b/app/react/kubernetes/cluster/queries/useUpdateNodeMutation.test.ts
@@ -0,0 +1,157 @@
+import { KubernetesPortainerNodeDrainLabel } from '../nodeUtils';
+import { NodeFormValues } from '../NodeView/NodeDetails/types';
+
+import { buildSpec, buildLabels } from './useUpdateNodeMutation';
+
+// Test helper to create form values
+function createTestFormValues(
+  overrides: Partial<NodeFormValues> = {}
+): NodeFormValues {
+  return {
+    availability: 'Active',
+    labels: [],
+    taints: [],
+    ...overrides,
+  };
+}
+
+describe('Node availability states', () => {
+  it('should handle all availability transitions correctly', () => {
+    const activeResult = buildSpec(
+      createTestFormValues({ availability: 'Active' })
+    );
+    const pauseResult = buildSpec(
+      createTestFormValues({ availability: 'Pause' })
+    );
+    const drainResult = buildSpec(
+      createTestFormValues({ availability: 'Drain' })
+    );
+
+    expect(activeResult.unschedulable).toBeUndefined();
+    expect(pauseResult.unschedulable).toBe(true);
+    expect(drainResult.unschedulable).toBe(true);
+  });
+
+  it('should add drain label only for Drain availability', () => {
+    const originalLabels = { 'kubernetes.io/hostname': 'test-node' };
+
+    const drainResult = buildLabels(
+      createTestFormValues({ availability: 'Drain' }),
+      originalLabels
+    );
+    const pauseResult = buildLabels(
+      createTestFormValues({ availability: 'Pause' }),
+      originalLabels
+    );
+
+    expect(drainResult[KubernetesPortainerNodeDrainLabel]).toBe('');
+    expect(pauseResult[KubernetesPortainerNodeDrainLabel]).toBeUndefined();
+  });
+});
+
+describe('Taint management', () => {
+  it('should filter out taints marked for deletion', () => {
+    const formValues = createTestFormValues({
+      taints: [
+        {
+          key: 'keep-taint',
+          value: 'value',
+          effect: 'NoSchedule',
+          isNew: false,
+          isChanged: false,
+        },
+        {
+          key: 'delete-taint',
+          value: 'value',
+          effect: 'NoExecute',
+          isNew: false,
+          isChanged: false,
+          needsDeletion: true,
+        },
+      ],
+    });
+    const result = buildSpec(formValues);
+
+    expect(result.taints).toHaveLength(1);
+    expect(result.taints?.[0].key).toBe('keep-taint');
+  });
+});
+
+describe('Label management', () => {
+  const originalLabels = {
+    'kubernetes.io/hostname': 'test-node',
+    'node-role.kubernetes.io/control-plane': '',
+    'beta.kubernetes.io/arch': 'amd64',
+    'node.kubernetes.io/microk8s-controlplane': 'microk8s-controlplane',
+    'user-label': 'old-value',
+  };
+
+  it('should preserve all system label types and filter user labels', () => {
+    const formValues = createTestFormValues({
+      labels: [
+        {
+          key: 'new-user-label',
+          value: 'new-value',
+          isNew: true,
+          isChanged: false,
+          isSystem: false,
+        },
+        {
+          key: 'delete-label',
+          value: 'delete-value',
+          isNew: false,
+          isChanged: false,
+          isSystem: false,
+          needsDeletion: true,
+        },
+      ],
+    });
+    const result = buildLabels(formValues, originalLabels);
+
+    expect(result['kubernetes.io/hostname']).toBe('test-node');
+    expect(result['node-role.kubernetes.io/control-plane']).toBe('');
+    expect(result['beta.kubernetes.io/arch']).toBe('amd64');
+    expect(result['node.kubernetes.io/microk8s-controlplane']).toBe(
+      'microk8s-controlplane'
+    );
+
+    expect(result['new-user-label']).toBe('new-value');
+    expect(result['delete-label']).toBeUndefined();
+    expect(result['user-label']).toBeUndefined();
+  });
+
+  it('should handle empty values and missing keys', () => {
+    const formValues = createTestFormValues({
+      labels: [
+        {
+          key: 'empty-value-label',
+          value: '',
+          isNew: true,
+          isChanged: false,
+          isSystem: false,
+        },
+        {
+          key: '',
+          value: 'some-value',
+          isNew: true,
+          isChanged: false,
+          isSystem: false,
+        },
+      ],
+    });
+    const result = buildLabels(formValues, {});
+
+    expect(result['empty-value-label']).toBe('');
+    expect(Object.keys(result)).not.toContain('');
+  });
+
+  it('should handle completely empty node state', () => {
+    const formValues = createTestFormValues();
+    const specResult = buildSpec(formValues);
+    const labelsResult = buildLabels(formValues, {});
+
+    expect(specResult.unschedulable).toBeUndefined();
+    expect(specResult.taints).toBeUndefined();
+    expect(Object.keys(labelsResult)).toHaveLength(0);
+  });
+});
diff --git a/app/react/kubernetes/cluster/queries/useUpdateNodeMutation.ts b/app/react/kubernetes/cluster/queries/useUpdateNodeMutation.ts
new file mode 100644
index 0000000..30e1e96
--- /dev/null
+++ b/app/react/kubernetes/cluster/queries/useUpdateNodeMutation.ts
@@ -0,0 +1,165 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+import { Operation, compare } from 'fast-json-patch';
+import { Node } from 'kubernetes-types/core/v1';
+
+import axios from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { withError, withInvalidate } from '@/react-tools/react-query';
+
+import { parseKubernetesAxiosError } from '../../axiosError';
+import { isSystemLabel, KubernetesPortainerNodeDrainLabel } from '../nodeUtils';
+import { NodeFormValues } from '../NodeView/NodeDetails/types';
+
+import { queryKeys } from './query-keys';
+
+export function useUpdateNodeMutation(
+  environmentId: EnvironmentId,
+  nodeName: string
+) {
+  const queryClient = useQueryClient();
+
+  return useMutation(
+    ({ formValues, node }: { formValues: NodeFormValues; node: Node }) =>
+      updateNode(environmentId, nodeName, formValues, node),
+    {
+      ...withInvalidate(queryClient, [
+        queryKeys.nodes(environmentId),
+        queryKeys.node(environmentId, nodeName),
+      ]),
+      ...withError('Unable to update node'),
+    }
+  );
+}
+
+async function updateNode(
+  environmentId: EnvironmentId,
+  nodeName: string,
+  formValues: NodeFormValues,
+  originalNode: Node
+) {
+  try {
+    const patch = createNodePatch(formValues, originalNode);
+    const { data } = await axios.patch<Node>(
+      `/endpoints/${environmentId}/kubernetes/api/v1/nodes/${nodeName}`,
+      patch,
+      {
+        headers: {
+          'Content-Type': 'application/json-patch+json',
+        },
+      }
+    );
+    return data;
+  } catch (e) {
+    throw parseKubernetesAxiosError(e, 'Unable to update node');
+  }
+}
+
+function createNodePatch(
+  formValues: NodeFormValues,
+  originalNode: Node
+): Operation[] {
+  const newNode = formValuesToNode(formValues, originalNode);
+  const oldPayload = createNodePatchPayload(originalNode);
+  const newPayload = createNodePatchPayload(newNode);
+  return compare(oldPayload, newPayload);
+}
+
+function formValuesToNode(
+  formValues: NodeFormValues,
+  originalNode: Node
+): Node {
+  const node = structuredClone(originalNode);
+  const newSpec = buildSpec(formValues);
+
+  return {
+    ...node,
+    metadata: {
+      ...node.metadata,
+      labels: buildLabels(formValues, node.metadata?.labels || {}),
+    },
+    spec: {
+      ...node.spec,
+      ...newSpec,
+      // Only use the taints from the newSpec, not the original node
+      taints: newSpec.taints,
+      // Explicitly handle unschedulable for Active state
+      ...(formValues.availability === 'Active' && { unschedulable: undefined }),
+    },
+  };
+}
+
+export function buildSpec(formValues: NodeFormValues) {
+  const spec: {
+    unschedulable?: boolean;
+    taints?: Array<{ key: string; value: string; effect: string }>;
+  } = {};
+
+  if (formValues.availability !== 'Active') {
+    spec.unschedulable = true;
+  }
+
+  const filteredTaints = formValues.taints.filter(
+    (taint) => !taint.needsDeletion
+  );
+
+  if (filteredTaints.length > 0) {
+    spec.taints = filteredTaints.map((taint) => ({
+      key: taint.key,
+      value: taint.value,
+      effect: taint.effect,
+    }));
+  }
+
+  return spec;
+}
+
+export function buildLabels(
+  formValues: NodeFormValues,
+  originalLabels: Record<string, string>
+): Record<string, string> {
+  const systemLabels = getSystemLabels(originalLabels);
+  const drainLabel = getDrainLabel(formValues.availability);
+  const userLabels = getUserLabels(formValues.labels);
+
+  return {
+    ...systemLabels,
+    ...drainLabel,
+    ...userLabels,
+  };
+}
+
+function getSystemLabels(originalLabels: Record<string, string>) {
+  return Object.fromEntries(
+    Object.entries(originalLabels).filter(([key]) => isSystemLabel(key))
+  );
+}
+
+function getDrainLabel(availability: string): Record<string, string> {
+  return availability === 'Drain'
+    ? { [KubernetesPortainerNodeDrainLabel]: '' }
+    : {};
+}
+
+function getUserLabels(formLabels: NodeFormValues['labels']) {
+  return Object.fromEntries(
+    formLabels
+      .filter(
+        (label) =>
+          !label.needsDeletion && label.key && !isSystemLabel(label.key)
+      )
+      .map((label) => [label.key, label.value || ''])
+  );
+}
+
+function createNodePatchPayload(node: Node) {
+  return {
+    metadata: {
+      name: node.metadata?.name,
+      labels: node.metadata?.labels,
+    },
+    spec: {
+      taints: node.spec?.taints,
+      unschedulable: node.spec?.unschedulable,
+    },
+  };
+}
diff --git a/app/react/kubernetes/cluster/types.ts b/app/react/kubernetes/cluster/types.ts
new file mode 100644
index 0000000..8413cc7
--- /dev/null
+++ b/app/react/kubernetes/cluster/types.ts
@@ -0,0 +1,3 @@
+export type NodeAvailability = 'Active' | 'Pause' | 'Drain';
+
+export type TaintEffect = 'NoSchedule' | 'PreferNoSchedule' | 'NoExecute';
diff --git a/app/react/kubernetes/cluster/useIsRBACEnabled.ts b/app/react/kubernetes/cluster/useIsRBACEnabled.ts
new file mode 100644
index 0000000..f720a78
--- /dev/null
+++ b/app/react/kubernetes/cluster/useIsRBACEnabled.ts
@@ -0,0 +1,27 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { withError } from '@/react-tools/react-query';
+
+export function useIsRBACEnabled(environmentId: EnvironmentId) {
+  return useQuery<boolean, Error>(
+    ['environments', environmentId, 'rbacEnabled'],
+    () => getIsRBACEnabled(environmentId),
+    {
+      enabled: !!environmentId,
+      ...withError('Unable to check if RBAC is enabled.'),
+    }
+  );
+}
+
+async function getIsRBACEnabled(environmentId: EnvironmentId) {
+  try {
+    const { data } = await axios.get<boolean>(
+      `kubernetes/${environmentId}/rbac_enabled`
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to check if RBAC is enabled.');
+  }
+}
diff --git a/app/react/kubernetes/components/CreateFromManifestButton.tsx b/app/react/kubernetes/components/CreateFromManifestButton.tsx
new file mode 100644
index 0000000..9e5afd8
--- /dev/null
+++ b/app/react/kubernetes/components/CreateFromManifestButton.tsx
@@ -0,0 +1,48 @@
+import { useCurrentStateAndParams } from '@uirouter/react';
+import { Plus } from 'lucide-react';
+
+import { AutomationTestingProps } from '@/types';
+
+import { MenuButton, MenuButtonLink } from '@@/buttons/MenuButton';
+import { Icon } from '@@/Icon';
+
+export function CreateFromManifestButton({
+  params = {},
+  'data-cy': dataCy,
+}: { params?: object } & AutomationTestingProps) {
+  const { state } = useCurrentStateAndParams();
+  return (
+    <MenuButton
+      items={[
+        <MenuButtonLink
+          key="manifest"
+          to="kubernetes.deploy"
+          params={{
+            referrer: state.name,
+            ...params,
+          }}
+          label="Create from manifest"
+          data-cy={`${dataCy}-manifest`}
+        >
+          Manifest
+        </MenuButtonLink>,
+        <MenuButtonLink
+          key="helm"
+          to="kubernetes.helminstall"
+          params={{
+            referrer: state.name,
+            ...params,
+          }}
+          label="Create from Helm chart"
+          data-cy={`${dataCy}-helm`}
+        >
+          Helm chart
+        </MenuButtonLink>,
+      ]}
+      data-cy={dataCy}
+    >
+      <Icon icon={Plus} size="xs" />
+      Create from code
+    </MenuButton>
+  );
+}
diff --git a/app/react/kubernetes/components/EventsDatatable/EventsDatatable.test.tsx b/app/react/kubernetes/components/EventsDatatable/EventsDatatable.test.tsx
new file mode 100644
index 0000000..c5dc49c
--- /dev/null
+++ b/app/react/kubernetes/components/EventsDatatable/EventsDatatable.test.tsx
@@ -0,0 +1,83 @@
+import { render, screen } from '@testing-library/react';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { UserViewModel } from '@/portainer/models/user';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { TableSettings } from '@/react/kubernetes/datatables/DefaultDatatableSettings';
+
+import { TableState } from '@@/datatables/useTableState';
+
+import { Event } from '../../queries/types';
+
+import { EventsDatatable } from './EventsDatatable';
+
+// Mock the necessary hooks and dependencies
+const mockTableState: TableState<TableSettings> = {
+  sortBy: { id: 'Date', desc: true },
+  pageSize: 10,
+  search: '',
+  autoRefreshRate: 0,
+  showSystemResources: false,
+  setSortBy: vi.fn(),
+  setPageSize: vi.fn(),
+  setSearch: vi.fn(),
+  setAutoRefreshRate: vi.fn(),
+  setShowSystemResources: vi.fn(),
+};
+
+vi.mock('../../datatables/default-kube-datatable-store', () => ({
+  useKubeStore: () => mockTableState,
+}));
+
+function renderComponent() {
+  const user = new UserViewModel({ Username: 'user' });
+
+  const events: Event[] = [
+    {
+      type: 'Warning',
+      name: 'name',
+      message: 'not sure if this what you want to do',
+      namespace: 'default',
+      reason: 'unknown',
+      count: 1,
+      eventTime: new Date('2025-01-02T15:04:05Z'),
+      uid: '4500fc9c-0cc8-4695-b4c4-989ac021d1d6',
+      involvedObject: {
+        kind: 'configMap',
+        uid: '35',
+        name: 'name',
+        namespace: 'default',
+      },
+    },
+  ];
+
+  const Wrapped = withTestQueryProvider(
+    withUserProvider(
+      withTestRouter(() => (
+        <EventsDatatable
+          dataset={events}
+          tableState={mockTableState}
+          isLoading={false}
+          data-cy="k8sNodeDetail-eventsTable"
+          noWidget
+        />
+      )),
+      user
+    )
+  );
+  return { ...render(<Wrapped />), events };
+}
+
+describe('EventsDatatable', () => {
+  it('should display events when data is loaded', async () => {
+    const { events } = renderComponent();
+    const event = events[0];
+
+    expect(screen.getByText(event.message || '')).toBeInTheDocument();
+    expect(screen.getAllByText(event.type || '')).toHaveLength(2);
+    expect(screen.getAllByText(event.involvedObject.kind || '')).toHaveLength(
+      2
+    );
+  });
+});
diff --git a/app/react/kubernetes/components/EventsDatatable/EventsDatatable.tsx b/app/react/kubernetes/components/EventsDatatable/EventsDatatable.tsx
new file mode 100644
index 0000000..fd06353
--- /dev/null
+++ b/app/react/kubernetes/components/EventsDatatable/EventsDatatable.tsx
@@ -0,0 +1,55 @@
+import { History } from 'lucide-react';
+import { ReactNode } from 'react';
+
+import { Event } from '@/react/kubernetes/queries/types';
+import { IndexOptional } from '@/react/kubernetes/configs/types';
+import { TableSettings } from '@/react/kubernetes/datatables/DefaultDatatableSettings';
+
+import { Datatable, TableSettingsMenu } from '@@/datatables';
+import { TableSettingsMenuAutoRefresh } from '@@/datatables/TableSettingsMenuAutoRefresh';
+import { TableState } from '@@/datatables/useTableState';
+
+import { columns } from './columns';
+
+type Props = {
+  dataset: Event[];
+  tableState: TableState<TableSettings>;
+  isLoading: boolean;
+  'data-cy': string;
+  noWidget?: boolean;
+  title?: ReactNode;
+  titleIcon?: ReactNode;
+};
+
+export function EventsDatatable({
+  dataset,
+  tableState,
+  isLoading,
+  'data-cy': dataCy,
+  noWidget,
+  title = 'Events',
+  titleIcon = History,
+}: Props) {
+  return (
+    <Datatable<IndexOptional<Event>>
+      dataset={dataset}
+      columns={columns}
+      settingsManager={tableState}
+      isLoading={isLoading}
+      title={title}
+      titleIcon={titleIcon}
+      getRowId={(row) => row.uid || ''}
+      disableSelect
+      renderTableSettings={() => (
+        <TableSettingsMenu>
+          <TableSettingsMenuAutoRefresh
+            value={tableState.autoRefreshRate}
+            onChange={(value) => tableState.setAutoRefreshRate(value)}
+          />
+        </TableSettingsMenu>
+      )}
+      data-cy={dataCy}
+      noWidget={noWidget}
+    />
+  );
+}
diff --git a/app/react/kubernetes/components/EventsDatatable/ResourceEventsDatatable.tsx b/app/react/kubernetes/components/EventsDatatable/ResourceEventsDatatable.tsx
new file mode 100644
index 0000000..24bb643
--- /dev/null
+++ b/app/react/kubernetes/components/EventsDatatable/ResourceEventsDatatable.tsx
@@ -0,0 +1,55 @@
+import { useCurrentStateAndParams } from '@uirouter/react';
+
+import { useKubeStore } from '@/react/kubernetes/datatables/default-kube-datatable-store';
+import { useEvents } from '@/react/kubernetes/queries/useEvents';
+import { EventsDatatable } from '@/react/kubernetes/components/EventsDatatable';
+
+type Props = {
+  storageKey: string;
+  /** if undefined, all resources for the namespace (or cluster are returned) */
+  resourceId?: string;
+  /** if undefined, events are fetched for the cluster */
+  namespace?: string;
+  noWidget?: boolean;
+  isLoading?: boolean;
+};
+
+/** ResourceEventsDatatable returns the EventsDatatable for all events that relate to a specific resource id */
+export function ResourceEventsDatatable({
+  storageKey,
+  resourceId,
+  namespace,
+  noWidget = true,
+  isLoading = false,
+}: Props) {
+  const tableState = useKubeStore(storageKey, {
+    id: 'Date',
+    desc: true,
+  });
+
+  const {
+    params: { endpointId },
+  } = useCurrentStateAndParams();
+
+  const params = resourceId ? { resourceId: `${resourceId}` } : {};
+  const resourceEventsQuery = useEvents(endpointId, {
+    namespace,
+    params,
+    queryOptions: {
+      autoRefreshRate: tableState.autoRefreshRate
+        ? tableState.autoRefreshRate * 1000
+        : undefined,
+    },
+  });
+  const nodeEvents = resourceEventsQuery.data || [];
+
+  return (
+    <EventsDatatable
+      dataset={nodeEvents}
+      tableState={tableState}
+      isLoading={resourceEventsQuery.isLoading || isLoading}
+      data-cy="k8sNodeDetail-eventsTable"
+      noWidget={noWidget}
+    />
+  );
+}
diff --git a/app/react/kubernetes/components/EventsDatatable/columns/date.tsx b/app/react/kubernetes/components/EventsDatatable/columns/date.tsx
new file mode 100644
index 0000000..d64132e
--- /dev/null
+++ b/app/react/kubernetes/components/EventsDatatable/columns/date.tsx
@@ -0,0 +1,11 @@
+import { formatDate } from '@/portainer/filters/filters';
+
+import { columnHelper } from './helper';
+
+export const date = columnHelper.accessor(
+  (event) => formatDate(event.lastTimestamp || event.eventTime),
+  {
+    header: 'Date',
+    id: 'Date',
+  }
+);
diff --git a/app/react/kubernetes/components/EventsDatatable/columns/eventType.tsx b/app/react/kubernetes/components/EventsDatatable/columns/eventType.tsx
new file mode 100644
index 0000000..d2f24e3
--- /dev/null
+++ b/app/react/kubernetes/components/EventsDatatable/columns/eventType.tsx
@@ -0,0 +1,34 @@
+import { Row } from '@tanstack/react-table';
+
+import { Event } from '@/react/kubernetes/queries/types';
+
+import { Badge, BadgeType } from '@@/Badge';
+import { filterHOC } from '@@/datatables/Filter';
+
+import { columnHelper } from './helper';
+
+export const eventType = columnHelper.accessor('type', {
+  header: 'Type',
+  cell: ({ getValue }) => (
+    <Badge type={getBadgeColor(getValue())}>{getValue()}</Badge>
+  ),
+
+  meta: {
+    filter: filterHOC('Filter by event type'),
+  },
+  enableColumnFilter: true,
+  filterFn: (row: Row<Event>, _: string, filterValue: string[]) =>
+    filterValue.length === 0 ||
+    (!!row.original.type && filterValue.includes(row.original.type)),
+});
+
+function getBadgeColor(status?: string): BadgeType {
+  switch (status?.toLowerCase()) {
+    case 'normal':
+      return 'info';
+    case 'warning':
+      return 'warn';
+    default:
+      return 'danger';
+  }
+}
diff --git a/app/react/kubernetes/components/EventsDatatable/columns/helper.ts b/app/react/kubernetes/components/EventsDatatable/columns/helper.ts
new file mode 100644
index 0000000..dbb2a57
--- /dev/null
+++ b/app/react/kubernetes/components/EventsDatatable/columns/helper.ts
@@ -0,0 +1,5 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { Event } from '@/react/kubernetes/queries/types';
+
+export const columnHelper = createColumnHelper<Event>();
diff --git a/app/react/kubernetes/components/EventsDatatable/columns/index.ts b/app/react/kubernetes/components/EventsDatatable/columns/index.ts
new file mode 100644
index 0000000..f496580
--- /dev/null
+++ b/app/react/kubernetes/components/EventsDatatable/columns/index.ts
@@ -0,0 +1,7 @@
+import { date } from './date';
+import { kind } from './kind';
+import { eventType } from './eventType';
+import { message } from './message';
+import { name } from './name';
+
+export const columns = [date, name, kind, eventType, message];
diff --git a/app/react/kubernetes/components/EventsDatatable/columns/kind.tsx b/app/react/kubernetes/components/EventsDatatable/columns/kind.tsx
new file mode 100644
index 0000000..efc69fe
--- /dev/null
+++ b/app/react/kubernetes/components/EventsDatatable/columns/kind.tsx
@@ -0,0 +1,22 @@
+import { Row } from '@tanstack/react-table';
+
+import { Event } from '@/react/kubernetes/queries/types';
+
+import { filterHOC } from '@@/datatables/Filter';
+
+import { columnHelper } from './helper';
+
+export const kind = columnHelper.accessor(
+  (event) => event.involvedObject.kind,
+  {
+    header: 'Kind',
+    meta: {
+      filter: filterHOC('Filter by kind'),
+    },
+    enableColumnFilter: true,
+    filterFn: (row: Row<Event>, _: string, filterValue: string[]) =>
+      filterValue.length === 0 ||
+      (!!row.original.involvedObject.kind &&
+        filterValue.includes(row.original.involvedObject.kind)),
+  }
+);
diff --git a/app/react/kubernetes/components/EventsDatatable/columns/message.tsx b/app/react/kubernetes/components/EventsDatatable/columns/message.tsx
new file mode 100644
index 0000000..ec3b770
--- /dev/null
+++ b/app/react/kubernetes/components/EventsDatatable/columns/message.tsx
@@ -0,0 +1,5 @@
+import { columnHelper } from './helper';
+
+export const message = columnHelper.accessor('message', {
+  header: 'Message',
+});
diff --git a/app/react/kubernetes/components/EventsDatatable/columns/name.tsx b/app/react/kubernetes/components/EventsDatatable/columns/name.tsx
new file mode 100644
index 0000000..26bc0c8
--- /dev/null
+++ b/app/react/kubernetes/components/EventsDatatable/columns/name.tsx
@@ -0,0 +1,16 @@
+import { columnHelper } from './helper';
+
+export const name = columnHelper.accessor(
+  (event) => event.involvedObject.name ?? '-',
+  {
+    header: 'Name',
+    cell: ({ getValue }) => {
+      const name = getValue();
+      return (
+        <span title={name} className="ellipsis max-w-sm">
+          {name}
+        </span>
+      );
+    },
+  }
+);
diff --git a/app/react/kubernetes/components/EventsDatatable/index.ts b/app/react/kubernetes/components/EventsDatatable/index.ts
new file mode 100644
index 0000000..79b6c37
--- /dev/null
+++ b/app/react/kubernetes/components/EventsDatatable/index.ts
@@ -0,0 +1 @@
+export { EventsDatatable } from './EventsDatatable';
diff --git a/app/react/kubernetes/components/IntegratedAppsDatatable/IntegratedAppsDatatable.tsx b/app/react/kubernetes/components/IntegratedAppsDatatable/IntegratedAppsDatatable.tsx
new file mode 100644
index 0000000..8e0a856
--- /dev/null
+++ b/app/react/kubernetes/components/IntegratedAppsDatatable/IntegratedAppsDatatable.tsx
@@ -0,0 +1,62 @@
+import LaptopCode from '@/assets/ico/laptop-code.svg?c';
+
+import { Datatable, TableSettingsMenu } from '@@/datatables';
+import { useRepeater } from '@@/datatables/useRepeater';
+import { TableSettingsMenuAutoRefresh } from '@@/datatables/TableSettingsMenuAutoRefresh';
+import { useTableStateWithStorage } from '@@/datatables/useTableState';
+import {
+  BasicTableSettings,
+  refreshableSettings,
+  RefreshableTableSettings,
+} from '@@/datatables/types';
+
+import { columns } from './columns';
+import { IntegratedApp } from './types';
+
+interface TableSettings extends BasicTableSettings, RefreshableTableSettings {}
+
+export function IntegratedAppsDatatable({
+  dataset,
+  onRefresh,
+  isLoading,
+  tableKey,
+  tableTitle,
+  dataCy,
+}: {
+  dataset: Array<IntegratedApp>;
+  onRefresh: () => void;
+  isLoading: boolean;
+  tableKey: string;
+  tableTitle: string;
+  dataCy: string;
+}) {
+  const tableState = useTableStateWithStorage<TableSettings>(
+    tableKey,
+    'Name',
+    (set) => ({
+      ...refreshableSettings(set),
+    })
+  );
+  useRepeater(tableState.autoRefreshRate, onRefresh);
+
+  return (
+    <Datatable
+      dataset={dataset}
+      settingsManager={tableState}
+      columns={columns}
+      disableSelect
+      title={tableTitle}
+      titleIcon={LaptopCode}
+      isLoading={isLoading}
+      renderTableSettings={() => (
+        <TableSettingsMenu>
+          <TableSettingsMenuAutoRefresh
+            value={tableState.autoRefreshRate}
+            onChange={tableState.setAutoRefreshRate}
+          />
+        </TableSettingsMenu>
+      )}
+      data-cy={dataCy}
+    />
+  );
+}
diff --git a/app/react/kubernetes/components/IntegratedAppsDatatable/columns.helper.tsx b/app/react/kubernetes/components/IntegratedAppsDatatable/columns.helper.tsx
new file mode 100644
index 0000000..7a920cc
--- /dev/null
+++ b/app/react/kubernetes/components/IntegratedAppsDatatable/columns.helper.tsx
@@ -0,0 +1,5 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { IntegratedApp } from './types';
+
+export const helper = createColumnHelper<IntegratedApp>();
diff --git a/app/react/kubernetes/components/IntegratedAppsDatatable/columns.name.tsx b/app/react/kubernetes/components/IntegratedAppsDatatable/columns.name.tsx
new file mode 100644
index 0000000..118f9cb
--- /dev/null
+++ b/app/react/kubernetes/components/IntegratedAppsDatatable/columns.name.tsx
@@ -0,0 +1,23 @@
+import { CellContext } from '@tanstack/react-table';
+
+import { Link } from '@@/Link';
+
+import { helper } from './columns.helper';
+import { IntegratedApp } from './types';
+
+export const name = helper.accessor('Name', {
+  header: 'Name',
+  cell: Cell,
+});
+
+function Cell({ row: { original: item } }: CellContext<IntegratedApp, string>) {
+  return (
+    <Link
+      to="kubernetes.applications.application"
+      params={{ name: item.Name, namespace: item.ResourcePool }}
+      data-cy={`application-link-${item.Name}`}
+    >
+      {item.Name}
+    </Link>
+  );
+}
diff --git a/app/react/kubernetes/components/IntegratedAppsDatatable/columns.tsx b/app/react/kubernetes/components/IntegratedAppsDatatable/columns.tsx
new file mode 100644
index 0000000..b98c2aa
--- /dev/null
+++ b/app/react/kubernetes/components/IntegratedAppsDatatable/columns.tsx
@@ -0,0 +1,22 @@
+import { truncate } from '@/portainer/filters/filters';
+
+import { helper } from './columns.helper';
+import { name } from './columns.name';
+
+export const columns = [
+  name,
+  helper.accessor('StackName', {
+    header: 'Stack',
+    cell: ({ getValue }) => getValue() || '-',
+  }),
+
+  helper.accessor('Image', {
+    header: 'Image',
+    cell: ({ row: { original: item } }) => (
+      <>
+        <span title={item.Image}>{truncate(item.Image, 64)}</span>
+        {item.Containers?.length > 1 && <>+ {item.Containers.length - 1}</>}
+      </>
+    ),
+  }),
+];
diff --git a/app/react/kubernetes/components/IntegratedAppsDatatable/types.ts b/app/react/kubernetes/components/IntegratedAppsDatatable/types.ts
new file mode 100644
index 0000000..0d858b0
--- /dev/null
+++ b/app/react/kubernetes/components/IntegratedAppsDatatable/types.ts
@@ -0,0 +1,3 @@
+import { KubernetesApplication } from '@/kubernetes/models/application/models';
+
+export type IntegratedApp = KubernetesApplication;
diff --git a/app/react/kubernetes/components/K8sRegistryAccessNotice.test.tsx b/app/react/kubernetes/components/K8sRegistryAccessNotice.test.tsx
new file mode 100644
index 0000000..0ae2b0c
--- /dev/null
+++ b/app/react/kubernetes/components/K8sRegistryAccessNotice.test.tsx
@@ -0,0 +1,443 @@
+import { render, screen } from '@testing-library/react';
+import { describe, it, expect, vi } from 'vitest';
+
+import { useIsPureAdmin, useIsEnvironmentAdmin } from '@/react/hooks/useUser';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useDebouncedValue } from '@/react/hooks/useDebouncedValue';
+import { useRegistries } from '@/react/portainer/registries/queries/useRegistries';
+import { useEnvironmentRegistries } from '@/react/portainer/environments/queries/useEnvironmentRegistries';
+
+import {
+  getFirstNamespaceFromManifest,
+  hasNonDefaultServiceAccount,
+  K8sRegistryAccessNotice,
+} from './K8sRegistryAccessNotice';
+
+vi.mock('@/react/hooks/useUser');
+vi.mock('@/react/hooks/useEnvironmentId');
+vi.mock('@/react/hooks/useDebouncedValue');
+vi.mock('@/react/portainer/registries/queries/useRegistries');
+vi.mock('@/react/portainer/environments/queries/useEnvironmentRegistries');
+vi.mock('@@/Tip/TextTip', () => ({
+  TextTip: ({
+    children,
+    className,
+  }: {
+    children: React.ReactNode;
+    className?: string;
+  }) => (
+    <div role="note" className={className}>
+      {children}
+    </div>
+  ),
+}));
+vi.mock('@@/Tip/TooltipWithChildren', () => ({
+  TooltipWithChildren: ({ children }: { children: React.ReactNode }) => (
+    <>{children}</>
+  ),
+}));
+vi.mock('@@/Link', () => ({
+  Link: ({
+    children,
+    'data-cy': dataCy,
+  }: {
+    children: React.ReactNode;
+    'data-cy'?: string;
+  }) => (
+    <a href="." data-cy={dataCy}>
+      {children}
+    </a>
+  ),
+}));
+vi.mock('@@/InlineLoader', () => ({
+  InlineLoader: ({ children }: { children: React.ReactNode }) => (
+    <>{children}</>
+  ),
+}));
+
+const mockUseIsPureAdmin = vi.mocked(useIsPureAdmin);
+const mockUseIsEnvironmentAdmin = vi.mocked(useIsEnvironmentAdmin);
+const mockUseEnvironmentId = vi.mocked(useEnvironmentId);
+const mockUseDebouncedValue = vi.mocked(useDebouncedValue);
+const mockUseRegistries = vi.mocked(useRegistries);
+const mockUseEnvironmentRegistries = vi.mocked(useEnvironmentRegistries);
+
+type MockRegistry = { Id: number; Name: string; URL: string };
+
+function setupMocks({
+  isPureAdmin = false,
+  isEnvAdmin = false,
+  isEnvAdminLoading = false,
+  environmentIdFromRoute = 1,
+  allRegistries = [] as MockRegistry[],
+  allRegistriesLoading = false,
+  nsRegistries = [] as MockRegistry[],
+  nsRegistriesLoading = false,
+} = {}) {
+  mockUseIsPureAdmin.mockReturnValue(isPureAdmin);
+  mockUseIsEnvironmentAdmin.mockReturnValue({
+    authorized: isEnvAdmin,
+    isLoading: isEnvAdminLoading,
+  });
+  mockUseEnvironmentId.mockReturnValue(environmentIdFromRoute);
+  mockUseDebouncedValue.mockImplementation((v) => v);
+  mockUseRegistries.mockReturnValue({
+    data: allRegistries,
+    isLoading: allRegistriesLoading,
+  } as unknown as ReturnType<typeof useRegistries>);
+  mockUseEnvironmentRegistries.mockReturnValue({
+    data: nsRegistries,
+    isLoading: nsRegistriesLoading,
+  } as unknown as ReturnType<typeof useEnvironmentRegistries>);
+}
+
+describe('K8sRegistryAccessNotice', () => {
+  beforeEach(() => {
+    setupMocks();
+  });
+
+  describe('renders nothing', () => {
+    it('when namespace is not provided or determinable from manifest', () => {
+      const { container } = render(<K8sRegistryAccessNotice />);
+      expect(container).toBeEmptyDOMElement();
+    });
+
+    it('when environmentId cannot be determined from route or prop', () => {
+      mockUseEnvironmentId.mockReturnValue(0);
+      const { container } = render(
+        <K8sRegistryAccessNotice namespace="my-ns" />
+      );
+      expect(container).toBeEmptyDOMElement();
+    });
+  });
+
+  it('renders an invisible placeholder while loading to prevent layout shift', () => {
+    setupMocks({ nsRegistriesLoading: true });
+    render(<K8sRegistryAccessNotice namespace="my-ns" />);
+    expect(screen.getByRole('note')).toHaveClass('invisible');
+  });
+
+  describe('no registries configured at all', () => {
+    it('shows add-registry and setup-access links for pure admins', () => {
+      setupMocks({ isPureAdmin: true });
+      render(<K8sRegistryAccessNotice namespace="my-ns" environmentId={2} />);
+      expect(screen.getByText(/no registries configured/i)).toBeVisible();
+      expect(screen.getByTestId('add-registry-link')).toBeVisible();
+      expect(screen.getByTestId('setup-registry-access-link')).toBeVisible();
+    });
+
+    it('shows a contact-admin message for non-admins', () => {
+      setupMocks({ isPureAdmin: false });
+      render(<K8sRegistryAccessNotice namespace="my-ns" />);
+      expect(screen.getByText(/no registries configured/i)).toBeVisible();
+      expect(
+        screen.getByText(/contact your portainer administrator/i)
+      ).toBeVisible();
+    });
+  });
+
+  describe('namespace has no registry access', () => {
+    it('shows a setup link for environment admins', () => {
+      setupMocks({
+        isEnvAdmin: true,
+        allRegistries: [
+          { Id: 1, Name: 'Global Registry', URL: 'registry.example.com' },
+        ],
+      });
+      render(<K8sRegistryAccessNotice namespace="my-ns" environmentId={2} />);
+      expect(screen.getByText(/registry access not configured/i)).toBeVisible();
+      expect(screen.getByTestId('setup-registry-access-link')).toBeVisible();
+    });
+
+    it('shows a contact-admin message for regular users', () => {
+      setupMocks({
+        isEnvAdmin: false,
+        allRegistries: [
+          { Id: 1, Name: 'Global Registry', URL: 'registry.example.com' },
+        ],
+      });
+      render(<K8sRegistryAccessNotice namespace="my-ns" />);
+      expect(screen.getByText(/registry access not configured/i)).toBeVisible();
+      expect(
+        screen.getByText(
+          /contact your portainer administrator to set up registry access/i
+        )
+      ).toBeVisible();
+    });
+  });
+
+  describe('namespace has registry access', () => {
+    const registries: MockRegistry[] = [
+      { Id: 1, Name: 'Registry A', URL: 'registry-a.example.com' },
+      { Id: 2, Name: 'Registry B', URL: 'registry-b.example.com' },
+    ];
+
+    it('shows the correct count (plural) of accessible registries', () => {
+      setupMocks({ allRegistries: registries, nsRegistries: registries });
+      render(<K8sRegistryAccessNotice namespace="my-ns" />);
+      expect(screen.getByText(/2 registries/i)).toBeVisible();
+    });
+
+    it('uses singular "registry" for a single accessible registry', () => {
+      setupMocks({
+        allRegistries: [registries[0]],
+        nsRegistries: [registries[0]],
+      });
+      render(<K8sRegistryAccessNotice namespace="my-ns" />);
+      expect(screen.getByText(/1 registry/i)).toBeVisible();
+    });
+
+    it('always includes "will work automatically" regardless of view type', () => {
+      setupMocks({
+        allRegistries: [registries[0]],
+        nsRegistries: [registries[0]],
+      });
+      render(<K8sRegistryAccessNotice namespace="my-ns" />);
+      expect(screen.getByText(/will work automatically/i)).toBeVisible();
+    });
+
+    it('shows a manage-access link for environment admins', () => {
+      setupMocks({
+        isEnvAdmin: true,
+        allRegistries: [registries[0]],
+        nsRegistries: [registries[0]],
+      });
+      render(<K8sRegistryAccessNotice namespace="my-ns" environmentId={2} />);
+      expect(screen.getByTestId('manage-registry-access-link')).toBeVisible();
+    });
+
+    it('hides the notice when a custom service account is detected in the manifest', () => {
+      const manifest = `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app
+  namespace: my-ns
+spec:
+  template:
+    spec:
+      serviceAccountName: custom-sa
+      containers:
+        - name: app
+          image: nginx
+`;
+      setupMocks({
+        allRegistries: [registries[0]],
+        nsRegistries: [registries[0]],
+      });
+      const { container } = render(
+        <K8sRegistryAccessNotice manifestContent={manifest} />
+      );
+      expect(container).toBeEmptyDOMElement();
+    });
+  });
+});
+
+describe('getFirstNamespaceFromManifest', () => {
+  it('returns the namespace from a single-document manifest', () => {
+    const manifest = `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx
+  namespace: my-namespace
+spec:
+  replicas: 1
+`;
+    expect(getFirstNamespaceFromManifest(manifest)).toBe('my-namespace');
+  });
+
+  it('returns the first namespace from a multi-document manifest', () => {
+    const manifest = `
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: config
+  namespace: first-ns
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app
+  namespace: second-ns
+`;
+    expect(getFirstNamespaceFromManifest(manifest)).toBe('first-ns');
+  });
+
+  it('returns undefined when no namespace is present', () => {
+    const manifest = `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx
+spec:
+  replicas: 1
+`;
+    expect(getFirstNamespaceFromManifest(manifest)).toBeUndefined();
+  });
+
+  it('returns undefined for an empty string', () => {
+    expect(getFirstNamespaceFromManifest('')).toBeUndefined();
+  });
+
+  it('skips invalid YAML documents and continues', () => {
+    const manifest = `
+invalid: yaml: [broken
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: valid
+  namespace: good-ns
+`;
+    expect(getFirstNamespaceFromManifest(manifest)).toBe('good-ns');
+  });
+
+  it('returns undefined when manifest has only cluster-scoped resources', () => {
+    const manifest = `
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: my-namespace
+`;
+    expect(getFirstNamespaceFromManifest(manifest)).toBeUndefined();
+  });
+});
+
+describe('hasNonDefaultServiceAccount', () => {
+  it('returns false when no serviceAccountName is set', () => {
+    const manifest = `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app
+  namespace: default
+spec:
+  template:
+    spec:
+      containers:
+        - name: app
+          image: nginx
+`;
+    expect(hasNonDefaultServiceAccount(manifest)).toBe(false);
+  });
+
+  it('returns false when serviceAccountName is "default"', () => {
+    const manifest = `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app
+spec:
+  template:
+    spec:
+      serviceAccountName: default
+      containers:
+        - name: app
+          image: nginx
+`;
+    expect(hasNonDefaultServiceAccount(manifest)).toBe(false);
+  });
+
+  it('returns true when a Deployment uses a custom serviceAccountName', () => {
+    const manifest = `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app
+spec:
+  template:
+    spec:
+      serviceAccountName: my-service-account
+      containers:
+        - name: app
+          image: nginx
+`;
+    expect(hasNonDefaultServiceAccount(manifest)).toBe(true);
+  });
+
+  it('returns true when a Pod uses a custom serviceAccountName', () => {
+    const manifest = `
+apiVersion: v1
+kind: Pod
+metadata:
+  name: my-pod
+spec:
+  serviceAccountName: custom-sa
+  containers:
+    - name: app
+      image: nginx
+`;
+    expect(hasNonDefaultServiceAccount(manifest)).toBe(true);
+  });
+
+  it('returns true when a CronJob uses a custom serviceAccountName', () => {
+    const manifest = `
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: my-job
+spec:
+  schedule: "* * * * *"
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          serviceAccountName: cron-sa
+          containers:
+            - name: job
+              image: busybox
+`;
+    expect(hasNonDefaultServiceAccount(manifest)).toBe(true);
+  });
+
+  it('returns true when any doc in a multi-doc manifest has a custom SA', () => {
+    const manifest = `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app-a
+spec:
+  template:
+    spec:
+      containers:
+        - name: a
+          image: nginx
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app-b
+spec:
+  template:
+    spec:
+      serviceAccountName: special-sa
+      containers:
+        - name: b
+          image: nginx
+`;
+    expect(hasNonDefaultServiceAccount(manifest)).toBe(true);
+  });
+
+  it('returns false for an empty string', () => {
+    expect(hasNonDefaultServiceAccount('')).toBe(false);
+  });
+
+  it('skips invalid YAML and returns false when no valid custom SA found', () => {
+    const manifest = `
+invalid: yaml: [broken
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app
+spec:
+  template:
+    spec:
+      containers:
+        - name: app
+          image: nginx
+`;
+    expect(hasNonDefaultServiceAccount(manifest)).toBe(false);
+  });
+});
diff --git a/app/react/kubernetes/components/K8sRegistryAccessNotice.tsx b/app/react/kubernetes/components/K8sRegistryAccessNotice.tsx
new file mode 100644
index 0000000..119b3f6
--- /dev/null
+++ b/app/react/kubernetes/components/K8sRegistryAccessNotice.tsx
@@ -0,0 +1,252 @@
+import YAML from 'yaml';
+
+import { useRegistries } from '@/react/portainer/registries/queries/useRegistries';
+import { useEnvironmentRegistries } from '@/react/portainer/environments/queries/useEnvironmentRegistries';
+import { useIsPureAdmin, useIsEnvironmentAdmin } from '@/react/hooks/useUser';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useDebouncedValue } from '@/react/hooks/useDebouncedValue';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { pluralize } from '@/react/common/string-utils';
+
+import { TextTip } from '@@/Tip/TextTip';
+import { TooltipWithChildren } from '@@/Tip/TooltipWithChildren';
+import { Link } from '@@/Link';
+import { InlineLoader } from '@@/InlineLoader';
+
+interface PodSpec {
+  serviceAccountName?: string;
+}
+
+interface KubeDocShape {
+  metadata?: { namespace?: string };
+  spec?: {
+    serviceAccountName?: string;
+    template?: { spec?: PodSpec };
+    jobTemplate?: { spec?: { template?: { spec?: PodSpec } } };
+  };
+}
+
+interface Props {
+  /** Direct namespace — used by Helm views where namespace is explicitly selected. */
+  namespace?: string;
+  /** Used for detecting custom service accounts to avoid showing the notice when they are used. */
+  manifestContent?: string;
+  environmentId?: EnvironmentId;
+}
+
+export function K8sRegistryAccessNotice({
+  namespace,
+  manifestContent,
+  environmentId: environmentIdProp,
+}: Props) {
+  const environmentIdFromRoute = useEnvironmentId(false);
+  // useEnvironmentId(false) returns 0 when no endpointId in route params
+  const environmentId =
+    environmentIdProp ??
+    (environmentIdFromRoute !== 0 ? environmentIdFromRoute : undefined);
+
+  const debouncedContent = useDebouncedValue(manifestContent ?? '');
+  const effectiveNamespace =
+    namespace || getFirstNamespaceFromManifest(debouncedContent) || undefined;
+  const hasCustomSA = manifestContent
+    ? hasNonDefaultServiceAccount(debouncedContent)
+    : false;
+
+  const isPureAdmin = useIsPureAdmin();
+  const { authorized: isEnvAdmin, isLoading: isEnvAdminLoading } =
+    useIsEnvironmentAdmin();
+
+  const allRegistriesQuery = useRegistries({
+    hideDefault: true,
+    enabled: !!effectiveNamespace,
+    showError: false,
+  });
+
+  const nsRegistriesQuery = useEnvironmentRegistries(environmentId ?? 0, {
+    namespace: effectiveNamespace,
+    hideDefault: true,
+    enabled: !!effectiveNamespace && environmentId !== undefined,
+  });
+
+  const isLoading =
+    nsRegistriesQuery.isLoading ||
+    (isPureAdmin && allRegistriesQuery.isLoading) ||
+    isEnvAdminLoading;
+
+  if (!effectiveNamespace || environmentId === undefined) {
+    return null;
+  }
+
+  // show hidden text tip to avoid layout shift when changing namespaces
+  if (isLoading) {
+    return (
+      <TextTip
+        color="blue"
+        className="pointer-events-none invisible"
+        inline={false}
+      >
+        <InlineLoader size="xs">Loading...</InlineLoader>
+      </TextTip>
+    );
+  }
+
+  const allRegistries = allRegistriesQuery.data ?? [];
+  const nsRegistries = nsRegistriesQuery.data ?? [];
+
+  // Ignore when custom service accounts are known to be used
+  if (nsRegistries.length > 0 && hasCustomSA) {
+    return null;
+  }
+
+  // No registries configured (non admin roles don't get the list of all registries, so check for nsRegistries here too)
+  if (allRegistries.length === 0 && nsRegistries.length === 0) {
+    return (
+      <TextTip color="blue" inline={false}>
+        No registries configured for the namespace &apos;{effectiveNamespace}
+        &apos;.
+        {isPureAdmin ? (
+          <>
+            {' '}
+            To pull private images automatically,{' '}
+            <Link
+              to="portainer.registries.new"
+              data-cy="add-registry-link"
+              target="_blank"
+              rel="noopener noreferrer"
+            >
+              add a registry
+            </Link>{' '}
+            and{' '}
+            <Link
+              to="kubernetes.registries"
+              params={{ endpointId: environmentId }}
+              data-cy="setup-registry-access-link"
+              target="_blank"
+              rel="noopener noreferrer"
+            >
+              set up registry access
+            </Link>{' '}
+            .
+          </>
+        ) : (
+          ' To pull private images automatically, contact your Portainer administrator to add a registry and set up registry access.'
+        )}
+      </TextTip>
+    );
+  }
+
+  // Registries available but namespace has no registry access
+  if (nsRegistries.length === 0) {
+    return (
+      <TextTip color="blue" inline={false}>
+        Registry access not configured for the namespace &apos;
+        {effectiveNamespace}
+        &apos;.
+        {isEnvAdmin ? (
+          <>
+            {' '}
+            To pull private images automatically,{' '}
+            <Link
+              to="kubernetes.registries"
+              params={{ endpointId: environmentId }}
+              data-cy="setup-registry-access-link"
+              target="_blank"
+              rel="noopener noreferrer"
+            >
+              set up registry access
+            </Link>
+            .
+          </>
+        ) : (
+          ' To pull private images automatically, contact your Portainer administrator to set up registry access.'
+        )}
+      </TextTip>
+    );
+  }
+
+  // Registries available and accessible to this namespace
+  const registryCount = nsRegistries.length;
+
+  return (
+    <TextTip color="blue" inline={false}>
+      <TooltipWithChildren
+        message={
+          <ul className="list-disk mb-0 !pl-4">
+            {nsRegistries.map((r) => (
+              <li key={r.Id}>
+                {r.Name}: {r.URL}
+              </li>
+            ))}
+          </ul>
+        }
+      >
+        <span className="cursor-help underline">
+          {registryCount} {pluralize(registryCount, 'registry', 'registries')}
+        </span>
+      </TooltipWithChildren>{' '}
+      available for namespace &apos;{effectiveNamespace}&apos; - pulling images
+      from {pluralize(registryCount, 'this registry', 'these registries')} will
+      work automatically (unless using a non default service account).
+      {isEnvAdmin && (
+        <>
+          {' '}
+          <Link
+            to="kubernetes.registries"
+            params={{ endpointId: environmentId }}
+            data-cy="manage-registry-access-link"
+            target="_blank"
+            rel="noopener noreferrer"
+          >
+            Manage access
+          </Link>
+        </>
+      )}
+    </TextTip>
+  );
+}
+
+export function getFirstNamespaceFromManifest(
+  manifest: string
+): string | undefined {
+  return manifest
+    .split('---')
+    .flatMap((doc) => {
+      try {
+        const parsed: unknown = YAML.parse(doc);
+        if (!isKubeDocShape(parsed)) {
+          return [];
+        }
+        return parsed.metadata?.namespace ? [parsed.metadata.namespace] : [];
+      } catch {
+        return [];
+      }
+    })
+    .at(0);
+}
+
+export function hasNonDefaultServiceAccount(manifest: string): boolean {
+  return manifest.split('---').some((doc) => {
+    try {
+      const parsed: unknown = YAML.parse(doc);
+      if (!isKubeDocShape(parsed)) {
+        return false;
+      }
+      const sa = getPodSpecServiceAccountName(parsed);
+      return !!sa && sa !== 'default';
+    } catch {
+      return false;
+    }
+  });
+}
+
+function isKubeDocShape(value: unknown): value is KubeDocShape {
+  return value !== null && typeof value === 'object';
+}
+
+function getPodSpecServiceAccountName(doc: KubeDocShape): string | undefined {
+  return (
+    doc.spec?.serviceAccountName ||
+    doc.spec?.template?.spec?.serviceAccountName ||
+    doc.spec?.jobTemplate?.spec?.template?.spec?.serviceAccountName
+  );
+}
diff --git a/app/react/kubernetes/components/ResourceReservation.tsx b/app/react/kubernetes/components/ResourceReservation.tsx
new file mode 100644
index 0000000..2115a97
--- /dev/null
+++ b/app/react/kubernetes/components/ResourceReservation.tsx
@@ -0,0 +1,131 @@
+import { round } from 'lodash';
+import { AlertTriangle } from 'lucide-react';
+
+import { FormSectionTitle } from '@/react/components/form-components/FormSectionTitle';
+import { TextTip } from '@/react/components/Tip/TextTip';
+import { ResourceUsageItem } from '@/react/kubernetes/components/ResourceUsageItem';
+import { getPercentageString, getSafeValue } from '@/react/kubernetes/utils';
+
+import { Icon } from '@@/Icon';
+
+interface ResourceMetrics {
+  cpu: number;
+  memory: number;
+}
+
+interface Props {
+  displayResourceUsage: boolean;
+  resourceReservation: ResourceMetrics;
+  resourceUsage: ResourceMetrics;
+  cpuLimit: number;
+  memoryLimit: number;
+  description: string;
+  isLoading?: boolean;
+  title?: string;
+  displayWarning?: boolean;
+  warningMessage?: string;
+  memoryUnit?: string;
+}
+
+export function ResourceReservation({
+  displayResourceUsage,
+  resourceReservation,
+  resourceUsage,
+  cpuLimit,
+  memoryLimit,
+  description,
+  title = 'Resource reservation',
+  isLoading = false,
+  displayWarning = false,
+  warningMessage = '',
+  memoryUnit = 'MB',
+}: Props) {
+  const memoryReservationAnnotation = `${getSafeValue(
+    resourceReservation.memory
+  )} / ${memoryLimit} ${memoryUnit} ${getPercentageString(
+    resourceReservation.memory,
+    memoryLimit
+  )}`;
+
+  const memoryUsageAnnotation = `${getSafeValue(
+    resourceUsage.memory
+  )} / ${memoryLimit} ${memoryUnit} ${getPercentageString(
+    resourceUsage.memory,
+    memoryLimit
+  )}`;
+
+  const cpuReservationAnnotation = `${round(
+    getSafeValue(resourceReservation.cpu),
+    2
+  )} / ${round(getSafeValue(cpuLimit), 2)} ${getPercentageString(
+    resourceReservation.cpu,
+    cpuLimit
+  )}`;
+
+  const cpuUsageAnnotation = `${round(
+    getSafeValue(resourceUsage.cpu),
+    2
+  )} / ${round(getSafeValue(cpuLimit), 2)} ${getPercentageString(
+    resourceUsage.cpu,
+    cpuLimit
+  )}`;
+
+  return (
+    <>
+      <FormSectionTitle>{title}</FormSectionTitle>
+      <TextTip color="blue" className="mb-2">
+        {description}
+      </TextTip>
+      <div className="form-horizontal">
+        {memoryLimit > 0 && (
+          <ResourceUsageItem
+            value={resourceReservation.memory}
+            total={memoryLimit}
+            label="Memory reservation"
+            annotation={memoryReservationAnnotation}
+            isLoading={isLoading}
+            dataCy="memory-reservation"
+          />
+        )}
+        {displayResourceUsage && memoryLimit > 0 && (
+          <ResourceUsageItem
+            value={resourceUsage.memory}
+            total={memoryLimit}
+            label="Memory usage"
+            annotation={memoryUsageAnnotation}
+            isLoading={isLoading}
+            dataCy="memory-usage"
+          />
+        )}
+        {cpuLimit > 0 && (
+          <ResourceUsageItem
+            value={resourceReservation.cpu}
+            total={cpuLimit}
+            label="CPU reservation"
+            annotation={cpuReservationAnnotation}
+            isLoading={isLoading}
+            dataCy="cpu-reservation"
+          />
+        )}
+        {displayResourceUsage && cpuLimit > 0 && (
+          <ResourceUsageItem
+            value={resourceUsage.cpu}
+            total={cpuLimit}
+            label="CPU usage"
+            annotation={cpuUsageAnnotation}
+            isLoading={isLoading}
+            dataCy="cpu-usage"
+          />
+        )}
+        {displayWarning && (
+          <div className="form-group">
+            <span className="col-sm-12 text-warning small vertical-center">
+              <Icon icon={AlertTriangle} mode="warning" />
+              {warningMessage}
+            </span>
+          </div>
+        )}
+      </div>
+    </>
+  );
+}
diff --git a/app/react/kubernetes/components/ResourceUsageItem.tsx b/app/react/kubernetes/components/ResourceUsageItem.tsx
new file mode 100644
index 0000000..7938573
--- /dev/null
+++ b/app/react/kubernetes/components/ResourceUsageItem.tsx
@@ -0,0 +1,42 @@
+import { FormControl } from '@@/form-components/FormControl';
+import { ProgressBar } from '@@/ProgressBar';
+
+interface ResourceUsageItemProps {
+  value: number;
+  total: number;
+  annotation?: React.ReactNode;
+  label: string;
+  isLoading?: boolean;
+  dataCy?: string;
+}
+
+export function ResourceUsageItem({
+  value,
+  total,
+  annotation,
+  label,
+  isLoading = false,
+  dataCy,
+}: ResourceUsageItemProps) {
+  return (
+    <FormControl
+      label={label}
+      isLoading={isLoading}
+      className={isLoading ? 'mb-1.5' : ''}
+      dataCy={dataCy}
+    >
+      <div className="mt-1 flex items-center gap-2">
+        <ProgressBar
+          steps={[
+            {
+              value,
+              className: 'progress-bar',
+            },
+          ]}
+          total={total}
+        />
+        <div className="flex shrink-0 text-xs">{annotation}</div>
+      </div>
+    </FormControl>
+  );
+}
diff --git a/app/react/kubernetes/components/YAMLInspector.tsx b/app/react/kubernetes/components/YAMLInspector.tsx
new file mode 100644
index 0000000..5740b73
--- /dev/null
+++ b/app/react/kubernetes/components/YAMLInspector.tsx
@@ -0,0 +1,95 @@
+import { useMemo, useState } from 'react';
+import YAML from 'yaml';
+import { Minus, Plus } from 'lucide-react';
+
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+import { AutomationTestingProps } from '@/types';
+
+import { WebEditorForm } from '@@/WebEditorForm';
+import { Button } from '@@/buttons';
+import { BETeaserButton } from '@@/BETeaserButton';
+import { Alert } from '@@/Alert';
+import { Loading } from '@@/Widget/Loading';
+
+type Props = {
+  identifier: string;
+  data: string;
+  hideMessage?: boolean;
+  isLoading?: boolean;
+  isError?: boolean;
+} & AutomationTestingProps;
+
+export function YAMLInspector({
+  identifier,
+  data,
+  hideMessage,
+  'data-cy': dataCy,
+  isLoading,
+  isError,
+}: Props) {
+  const [expanded, setExpanded] = useState(false);
+  const yaml = useMemo(() => cleanYamlUnwantedFields(data), [data]);
+
+  if (isLoading) {
+    return <Loading />;
+  }
+
+  if (isError) {
+    return <Alert color="error">Error loading YAML</Alert>;
+  }
+
+  return (
+    <div>
+      <WebEditorForm
+        data-cy={dataCy}
+        value={yaml}
+        textTip={
+          hideMessage
+            ? undefined
+            : 'Define or paste the content of your manifest here'
+        }
+        readonly
+        hideTitle
+        id={identifier}
+        type="yaml"
+        height={expanded ? '800px' : '500px'}
+        onChange={() => {}} // all kube yaml inspectors in CE are read only
+      />
+      <div className="flex items-center justify-between py-5">
+        <Button
+          icon={expanded ? Minus : Plus}
+          data-cy={`expand-collapse-yaml-${identifier}`}
+          color="default"
+          className="!ml-0"
+          onClick={() => setExpanded(!expanded)}
+        >
+          {expanded ? 'Collapse' : 'Expand'}
+        </Button>
+        <BETeaserButton
+          featureId={FeatureId.K8S_EDIT_YAML}
+          heading="Apply YAML changes"
+          message="Applies any changes that you make in the YAML editor by calling the Kubernetes API to patch the relevant resources. Any resource removals or unexpected resource additions that you make in the YAML will be ignored. Note that editing is disabled for resources in namespaces marked as system."
+          buttonText="Apply changes"
+          data-cy="yaml-inspector-apply-changes-teaser-button"
+        />
+      </div>
+    </div>
+  );
+}
+
+export function cleanYamlUnwantedFields(yml: string) {
+  try {
+    const ymls = yml.split('---');
+    const cleanYmls = ymls.map((yml) => {
+      const y = YAML.parse(yml);
+      if (y.metadata) {
+        const { managedFields, resourceVersion, ...metadata } = y.metadata;
+        y.metadata = metadata;
+      }
+      return YAML.stringify(y);
+    });
+    return cleanYmls.join('---\n');
+  } catch (e) {
+    return yml;
+  }
+}
diff --git a/app/react/kubernetes/components/YamlInspector.test.tsx b/app/react/kubernetes/components/YamlInspector.test.tsx
new file mode 100644
index 0000000..d33e57a
--- /dev/null
+++ b/app/react/kubernetes/components/YamlInspector.test.tsx
@@ -0,0 +1,156 @@
+import { render, screen } from '@testing-library/react';
+import { vi } from 'vitest';
+import userEvent from '@testing-library/user-event';
+
+import { AutomationTestingProps } from '@/types';
+
+import { YAMLInspector } from './YAMLInspector';
+
+vi.mock('@/react/hooks/useEnvironmentId', () => ({
+  useEnvironmentId: vi.fn(() => 1),
+}));
+
+vi.mock('@/react/portainer/environments/queries/useEnvironment', () => ({
+  useEnvironmentDeploymentOptions: vi.fn(() => ({
+    data: { hideWebEditor: false },
+  })),
+}));
+
+vi.mock('@/react/hooks/useUser', () => ({
+  useAuthorizations: vi.fn(() => ({ authorized: true })),
+}));
+
+vi.mock('@@/modals/confirm', () => ({
+  confirm: vi.fn(() => Promise.resolve(true)),
+  buildConfirmButton: vi.fn((label) => ({ label })),
+}));
+
+vi.mock('./YAMLReplace/proxy/applyPatch', () => ({
+  applyPatch: vi.fn(() => Promise.resolve()),
+}));
+
+vi.mock('@@/Widget', () => ({
+  Loading: () => <div data-cy="loading-widget">Loading</div>,
+}));
+
+vi.mock('@@/Alert', () => ({
+  Alert: ({ children }: { children: React.ReactNode }) => <div>{children}</div>,
+}));
+
+vi.mock('@@/WebEditorForm', () => ({
+  WebEditorForm: ({
+    value,
+    onChange,
+    id,
+    readonly,
+  }: {
+    value: string;
+    onChange?: (value: string) => void;
+    id: string;
+    readonly?: boolean;
+  }) => (
+    <textarea
+      data-cy={id}
+      value={value}
+      onChange={(e) => onChange && onChange(e.target.value)}
+      aria-readonly={readonly || false}
+    />
+  ),
+}));
+
+// mock the YAMLReplace component to avoid YAML parsing issues
+vi.mock('./YAMLReplace', () => ({
+  YAMLReplace: ({
+    yml,
+    originalYml,
+    disabled,
+  }: {
+    yml: string;
+    originalYml: string;
+    disabled: boolean;
+  }) => (
+    <button
+      data-cy="apply-changes-button"
+      disabled={disabled || yml === originalYml}
+      type="button"
+    >
+      Apply changes
+    </button>
+  ),
+}));
+
+vi.mock('@uirouter/react', () => ({
+  useCurrentStateAndParams: vi.fn(() => ({ params: {} })),
+  useRouter: vi.fn(() => ({
+    stateService: { reload: vi.fn() },
+  })),
+}));
+
+vi.mock('@tanstack/react-query', () => ({
+  useQueryClient: vi.fn(() => ({
+    invalidateQueries: vi.fn(),
+  })),
+}));
+
+const sampleYaml = `apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: test-configmap
+  namespace: default
+  managedFields:
+    - manager: kubectl
+      operation: Update
+      apiVersion: v1
+  resourceVersion: "12345"
+data:
+  key1: value1
+  key2: value2`;
+
+interface RenderProps extends Partial<AutomationTestingProps> {
+  identifier?: string;
+  data?: string;
+  hideMessage?: boolean;
+  isLoading?: boolean;
+  isError?: boolean;
+}
+
+function renderComponent({
+  identifier = 'test-yaml',
+  data = sampleYaml,
+  hideMessage = false,
+  isLoading = false,
+  isError = false,
+  'data-cy': dataCy = 'test-yaml-inspector',
+}: RenderProps = {}) {
+  return render(
+    <YAMLInspector
+      identifier={identifier}
+      data={data}
+      hideMessage={hideMessage}
+      isLoading={isLoading}
+      isError={isError}
+      data-cy={dataCy}
+    />
+  );
+}
+
+test('renders WebEditorForm with cleaned YAML', () => {
+  renderComponent();
+
+  const renderedContent = screen.getByText(/ConfigMap/);
+  expect(renderedContent).toBeInTheDocument();
+});
+
+test('toggles expand/collapse when button is clicked', async () => {
+  const user = userEvent.setup();
+  renderComponent();
+
+  const expandButton = screen.getByText('Expand');
+  expect(expandButton).toBeInTheDocument();
+
+  await user.click(expandButton);
+  expect(screen.getByText('Collapse')).toBeInTheDocument();
+
+  await user.click(screen.getByText('Collapse'));
+  expect(screen.getByText('Expand')).toBeInTheDocument();
+});
diff --git a/app/react/kubernetes/configs/ListView/ConfigMapsDatatable/ConfigMapsDatatable.tsx b/app/react/kubernetes/configs/ListView/ConfigMapsDatatable/ConfigMapsDatatable.tsx
new file mode 100644
index 0000000..0dbea26
--- /dev/null
+++ b/app/react/kubernetes/configs/ListView/ConfigMapsDatatable/ConfigMapsDatatable.tsx
@@ -0,0 +1,158 @@
+import { useMemo } from 'react';
+import { FileCode } from 'lucide-react';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { Authorized, useAuthorizations } from '@/react/hooks/useUser';
+import { DefaultDatatableSettings } from '@/react/kubernetes/datatables/DefaultDatatableSettings';
+import { createStore } from '@/react/kubernetes/datatables/default-kube-datatable-store';
+import { SystemResourceDescription } from '@/react/kubernetes/datatables/SystemResourceDescription';
+import { useIsDeploymentOptionHidden } from '@/react/hooks/useIsDeploymentOptionHidden';
+import { pluralize } from '@/portainer/helpers/strings';
+import { useNamespacesQuery } from '@/react/kubernetes/namespaces/queries/useNamespacesQuery';
+import { PortainerNamespace } from '@/react/kubernetes/namespaces/types';
+import { CreateFromManifestButton } from '@/react/kubernetes/components/CreateFromManifestButton';
+import { isSystemNamespace } from '@/react/kubernetes/namespaces/queries/useIsSystemNamespace';
+
+import { Datatable, TableSettingsMenu } from '@@/datatables';
+import { AddButton } from '@@/buttons';
+import { useTableState } from '@@/datatables/useTableState';
+import { DeleteButton } from '@@/buttons/DeleteButton';
+
+import { IndexOptional, Configuration } from '../../types';
+import { useDeleteConfigMaps } from '../../queries/useDeleteConfigMaps';
+import { useConfigMapsForCluster } from '../../queries/useConfigmapsForCluster';
+
+import { ConfigMapRowData } from './types';
+import { columns } from './columns';
+
+const storageKey = 'k8sConfigMapsDatatable';
+const settingsStore = createStore(storageKey);
+
+export function ConfigMapsDatatable() {
+  const tableState = useTableState(settingsStore, storageKey);
+  const { authorized: canWrite } = useAuthorizations(['K8sConfigMapsW']);
+  const readOnly = !canWrite;
+  const { authorized: canAccessSystemResources } = useAuthorizations(
+    'K8sAccessSystemNamespaces'
+  );
+
+  const environmentId = useEnvironmentId();
+  const namespacesQuery = useNamespacesQuery(environmentId, {
+    autoRefreshRate: tableState.autoRefreshRate * 1000,
+  });
+  const configMapsQuery = useConfigMapsForCluster(environmentId, {
+    autoRefreshRate: tableState.autoRefreshRate * 1000,
+    select: (configMaps) =>
+      configMaps.filter(
+        (configmap) =>
+          (canAccessSystemResources && tableState.showSystemResources) ||
+          !isSystemNamespace(configmap.Namespace, namespacesQuery.data)
+      ),
+    isUsed: true,
+  });
+
+  const configMapRowData = useConfigMapRowData(
+    configMapsQuery.data ?? [],
+    namespacesQuery.data
+  );
+
+  return (
+    <Datatable<IndexOptional<ConfigMapRowData>>
+      dataset={configMapRowData}
+      columns={columns}
+      settingsManager={tableState}
+      isLoading={configMapsQuery.isLoading || namespacesQuery.isLoading}
+      emptyContentLabel="No ConfigMaps found"
+      title="ConfigMaps"
+      titleIcon={FileCode}
+      getRowId={(row) => row.UID ?? ''}
+      isRowSelectable={({ original: configmap }) =>
+        !isSystemNamespace(configmap.Namespace, namespacesQuery.data)
+      }
+      disableSelect={readOnly}
+      renderTableActions={(selectedRows) => (
+        <TableActions selectedItems={selectedRows} />
+      )}
+      renderTableSettings={() => (
+        <TableSettingsMenu>
+          <DefaultDatatableSettings settings={tableState} />
+        </TableSettingsMenu>
+      )}
+      description={
+        <SystemResourceDescription
+          showSystemResources={tableState.showSystemResources}
+        />
+      }
+      data-cy="k8s-configmaps-datatable"
+    />
+  );
+}
+
+function useConfigMapRowData(
+  configMaps: Configuration[],
+  namespaces?: PortainerNamespace[]
+): ConfigMapRowData[] {
+  return useMemo(
+    () =>
+      configMaps?.map((configMap) => ({
+        ...configMap,
+        inUse: configMap.IsUsed,
+        isSystem: namespaces
+          ? (namespaces.find(
+              (namespace) => namespace.Name === configMap.Namespace
+            )?.IsSystem ?? false)
+          : false,
+      })) || [],
+    [configMaps, namespaces]
+  );
+}
+
+function TableActions({
+  selectedItems,
+}: {
+  selectedItems: ConfigMapRowData[];
+}) {
+  const isAddConfigMapHidden = useIsDeploymentOptionHidden('form');
+  const environmentId = useEnvironmentId();
+  const deleteConfigMapMutation = useDeleteConfigMaps(environmentId);
+
+  return (
+    <Authorized authorizations="K8sConfigMapsW">
+      <DeleteButton
+        disabled={selectedItems.length === 0}
+        onConfirmed={() => handleRemoveClick(selectedItems)}
+        confirmMessage={`Are you sure you want to remove the selected ${pluralize(
+          selectedItems.length,
+          'ConfigMap'
+        )}`}
+        data-cy="k8sConfig-removeConfigButton"
+      />
+
+      {!isAddConfigMapHidden && (
+        <AddButton
+          to="kubernetes.configmaps.new"
+          data-cy="k8sConfig-addConfigWithFormButton"
+          color="secondary"
+        >
+          Add with form
+        </AddButton>
+      )}
+
+      <CreateFromManifestButton
+        params={{
+          tab: 'configmaps',
+        }}
+        data-cy="k8sConfig-deployFromManifestButton"
+      />
+    </Authorized>
+  );
+
+  async function handleRemoveClick(configMaps: ConfigMapRowData[]) {
+    const configMapsToDelete = configMaps.map((configMap) => ({
+      namespace: configMap.Namespace ?? '',
+      name: configMap.Name ?? '',
+    }));
+
+    await deleteConfigMapMutation.mutateAsync(configMapsToDelete);
+  }
+}
diff --git a/app/react/kubernetes/configs/ListView/ConfigMapsDatatable/columns/created.tsx b/app/react/kubernetes/configs/ListView/ConfigMapsDatatable/columns/created.tsx
new file mode 100644
index 0000000..c6b0757
--- /dev/null
+++ b/app/react/kubernetes/configs/ListView/ConfigMapsDatatable/columns/created.tsx
@@ -0,0 +1,17 @@
+import { formatDate } from '@/portainer/filters/filters';
+
+import { ConfigMapRowData } from '../types';
+
+import { columnHelper } from './helper';
+
+export const created = columnHelper.accessor((row) => getCreatedAtText(row), {
+  header: 'Created',
+  id: 'created',
+  cell: ({ row }) => getCreatedAtText(row.original),
+});
+
+function getCreatedAtText(row: ConfigMapRowData) {
+  const owner = row.ConfigurationOwner || row.ConfigurationOwnerId;
+  const date = formatDate(row.CreationDate);
+  return owner ? `${date} by ${owner}` : date;
+}
diff --git a/app/react/kubernetes/configs/ListView/ConfigMapsDatatable/columns/helper.ts b/app/react/kubernetes/configs/ListView/ConfigMapsDatatable/columns/helper.ts
new file mode 100644
index 0000000..4298845
--- /dev/null
+++ b/app/react/kubernetes/configs/ListView/ConfigMapsDatatable/columns/helper.ts
@@ -0,0 +1,5 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { ConfigMapRowData } from '../types';
+
+export const columnHelper = createColumnHelper<ConfigMapRowData>();
diff --git a/app/react/kubernetes/configs/ListView/ConfigMapsDatatable/columns/index.ts b/app/react/kubernetes/configs/ListView/ConfigMapsDatatable/columns/index.ts
new file mode 100644
index 0000000..006a506
--- /dev/null
+++ b/app/react/kubernetes/configs/ListView/ConfigMapsDatatable/columns/index.ts
@@ -0,0 +1,5 @@
+import { name } from './name';
+import { namespace } from './namespace';
+import { created } from './created';
+
+export const columns = [name, namespace, created];
diff --git a/app/react/kubernetes/configs/ListView/ConfigMapsDatatable/columns/name.tsx b/app/react/kubernetes/configs/ListView/ConfigMapsDatatable/columns/name.tsx
new file mode 100644
index 0000000..0659943
--- /dev/null
+++ b/app/react/kubernetes/configs/ListView/ConfigMapsDatatable/columns/name.tsx
@@ -0,0 +1,67 @@
+import { CellContext } from '@tanstack/react-table';
+
+import { Authorized } from '@/react/hooks/useUser';
+
+import { ExternalBadge } from '@@/Badge/ExternalBadge';
+import { SystemBadge } from '@@/Badge/SystemBadge';
+import { UnusedBadge } from '@@/Badge/UnusedBadge';
+import { Link } from '@@/Link';
+
+import { ConfigMapRowData } from '../types';
+
+import { columnHelper } from './helper';
+
+export const name = columnHelper.accessor(
+  (row) => {
+    const name = row.Name;
+
+    const isSystemToken = name?.includes('default-token-');
+    const isSystemConfigMap = isSystemToken || row.isSystem;
+    const hasConfigurationOwner = !!(
+      row.ConfigurationOwner || row.ConfigurationOwnerId
+    );
+    return `${name} ${isSystemConfigMap ? 'system' : ''} ${
+      !isSystemToken && !hasConfigurationOwner ? 'external' : ''
+    } ${!row.inUse && !isSystemConfigMap ? 'unused' : ''}`;
+  },
+  {
+    header: 'Name',
+    cell: Cell,
+    id: 'name',
+  }
+);
+
+function Cell({ row }: CellContext<ConfigMapRowData, string>) {
+  const name = row.original.Name;
+  const isSystemToken = name?.includes('default-token-');
+  const isSystemConfigMap = isSystemToken || row.original.isSystem;
+
+  const hasConfigurationOwner = !!(
+    row.original.ConfigurationOwner || row.original.ConfigurationOwnerId
+  );
+
+  return (
+    <Authorized authorizations="K8sConfigMapsR" childrenUnauthorized={name}>
+      <div className="flex gap-2">
+        <Link
+          to="kubernetes.configmaps.configmap"
+          params={{
+            namespace: row.original.Namespace,
+            name,
+          }}
+          title={name}
+          className="w-fit max-w-xs truncate xl:max-w-sm 2xl:max-w-md"
+          data-cy={`configmap-name-link-${name}`}
+        >
+          {name}
+        </Link>
+
+        <div className="ml-auto flex gap-2">
+          {isSystemConfigMap && <SystemBadge />}
+          {!isSystemToken && !hasConfigurationOwner && <ExternalBadge />}
+          {!row.original.inUse && !isSystemConfigMap && <UnusedBadge />}
+        </div>
+      </div>
+    </Authorized>
+  );
+}
diff --git a/app/react/kubernetes/configs/ListView/ConfigMapsDatatable/columns/namespace.tsx b/app/react/kubernetes/configs/ListView/ConfigMapsDatatable/columns/namespace.tsx
new file mode 100644
index 0000000..b084039
--- /dev/null
+++ b/app/react/kubernetes/configs/ListView/ConfigMapsDatatable/columns/namespace.tsx
@@ -0,0 +1,40 @@
+import { Row } from '@tanstack/react-table';
+
+import { filterHOC } from '@/react/components/datatables/Filter';
+
+import { Link } from '@@/Link';
+
+import { ConfigMapRowData } from '../types';
+
+import { columnHelper } from './helper';
+
+export const namespace = columnHelper.accessor('Namespace', {
+  header: 'Namespace',
+  id: 'namespace',
+  cell: ({ getValue }) => {
+    const namespace = getValue();
+    return (
+      <Link
+        to="kubernetes.resourcePools.resourcePool"
+        params={{
+          id: namespace,
+        }}
+        title={namespace}
+        data-cy={`configmap-namespace-link-${namespace}`}
+      >
+        {namespace}
+      </Link>
+    );
+  },
+  meta: {
+    filter: filterHOC('Filter by namespace'),
+  },
+  enableColumnFilter: true,
+  filterFn: (
+    row: Row<ConfigMapRowData>,
+    _columnId: string,
+    filterValue: string[]
+  ) =>
+    filterValue.length === 0 ||
+    filterValue.includes(row.original.Namespace ?? ''),
+});
diff --git a/app/react/kubernetes/configs/ListView/ConfigMapsDatatable/index.ts b/app/react/kubernetes/configs/ListView/ConfigMapsDatatable/index.ts
new file mode 100644
index 0000000..ca13790
--- /dev/null
+++ b/app/react/kubernetes/configs/ListView/ConfigMapsDatatable/index.ts
@@ -0,0 +1 @@
+export { ConfigMapsDatatable } from './ConfigMapsDatatable';
diff --git a/app/react/kubernetes/configs/ListView/ConfigMapsDatatable/types.ts b/app/react/kubernetes/configs/ListView/ConfigMapsDatatable/types.ts
new file mode 100644
index 0000000..8742e2e
--- /dev/null
+++ b/app/react/kubernetes/configs/ListView/ConfigMapsDatatable/types.ts
@@ -0,0 +1,6 @@
+import { Configuration } from '../../types';
+
+export interface ConfigMapRowData extends Configuration {
+  inUse: boolean;
+  isSystem: boolean;
+}
diff --git a/app/react/kubernetes/configs/ListView/ConfigMapsDatatable/utils.test.ts b/app/react/kubernetes/configs/ListView/ConfigMapsDatatable/utils.test.ts
new file mode 100644
index 0000000..0d57781
--- /dev/null
+++ b/app/react/kubernetes/configs/ListView/ConfigMapsDatatable/utils.test.ts
@@ -0,0 +1,110 @@
+import { CronJob, Job, K8sPod } from '../../../applications/types';
+import { Configuration } from '../../types';
+
+import { getIsConfigMapInUse } from './utils';
+
+describe('getIsConfigMapInUse', () => {
+  it('should return false when no resources reference the configMap', () => {
+    const configMap: Configuration = {
+      Name: 'my-configmap',
+      Namespace: 'default',
+      UID: '',
+      Type: 1,
+      ConfigurationOwner: '',
+      ConfigurationOwnerId: '',
+      IsUsed: false,
+      Yaml: '',
+    };
+    const pods: K8sPod[] = [];
+    const jobs: Job[] = [];
+    const cronJobs: CronJob[] = [];
+
+    expect(getIsConfigMapInUse(configMap, pods, jobs, cronJobs)).toBe(false);
+  });
+
+  it('should return true when a pod references the configMap', () => {
+    const configMap: Configuration = {
+      Name: 'my-configmap',
+      Namespace: 'default',
+      UID: '',
+      Type: 1,
+      ConfigurationOwner: '',
+      ConfigurationOwnerId: '',
+      IsUsed: false,
+      Yaml: '',
+    };
+    const pods: K8sPod[] = [
+      {
+        namespace: 'default',
+        containers: [
+          {
+            name: 'container1',
+            envFrom: [{ configMapRef: { name: 'my-configmap' } }],
+          },
+        ],
+        ownerReferences: [],
+      },
+    ];
+    const jobs: Job[] = [];
+    const cronJobs: CronJob[] = [];
+
+    expect(getIsConfigMapInUse(configMap, pods, jobs, cronJobs)).toBe(true);
+  });
+
+  it('should return true when a job references the configMap', () => {
+    const configMap: Configuration = {
+      Name: 'my-configmap',
+      Namespace: 'default',
+      UID: '',
+      Type: 1,
+      ConfigurationOwner: '',
+      ConfigurationOwnerId: '',
+      IsUsed: false,
+      Yaml: '',
+    };
+    const pods: K8sPod[] = [];
+    const jobs: Job[] = [
+      {
+        namespace: 'default',
+        containers: [
+          {
+            name: 'container1',
+            envFrom: [{ configMapRef: { name: 'my-configmap' } }],
+          },
+        ],
+      },
+    ];
+    const cronJobs: CronJob[] = [];
+
+    expect(getIsConfigMapInUse(configMap, pods, jobs, cronJobs)).toBe(true);
+  });
+
+  it('should return true when a cronJob references the configMap', () => {
+    const configMap: Configuration = {
+      Name: 'my-configmap',
+      Namespace: 'default',
+      UID: '',
+      Type: 1,
+      ConfigurationOwner: '',
+      ConfigurationOwnerId: '',
+      IsUsed: false,
+      Yaml: '',
+    };
+    const pods: K8sPod[] = [];
+    const jobs: Job[] = [];
+    const cronJobs: CronJob[] = [
+      {
+        namespace: 'default',
+        schedule: '0 0 * * *',
+        containers: [
+          {
+            name: 'container1',
+            envFrom: [{ configMapRef: { name: 'my-configmap' } }],
+          },
+        ],
+      },
+    ];
+
+    expect(getIsConfigMapInUse(configMap, pods, jobs, cronJobs)).toBe(true);
+  });
+});
diff --git a/app/react/kubernetes/configs/ListView/ConfigMapsDatatable/utils.ts b/app/react/kubernetes/configs/ListView/ConfigMapsDatatable/utils.ts
new file mode 100644
index 0000000..0f96b03
--- /dev/null
+++ b/app/react/kubernetes/configs/ListView/ConfigMapsDatatable/utils.ts
@@ -0,0 +1,67 @@
+import { PodSpec } from 'kubernetes-types/core/v1';
+
+import { Configuration } from '../../types';
+import { Job, CronJob, K8sPod } from '../../../applications/types';
+
+/**
+ * getIsConfigMapInUse returns true if the configmap is referenced by any pod, job, or cronjob in the same namespace
+ */
+export function getIsConfigMapInUse(
+  configMap: Configuration,
+  pods: K8sPod[],
+  jobs: Job[],
+  cronJobs: CronJob[]
+) {
+  // get all podspecs from pods, jobs and cronjobs that are in the same namespace
+  const podsInNamespace = pods.filter(
+    (pod) => pod.namespace === configMap.Namespace
+  );
+  const jobsInNamespace = jobs.filter(
+    (job) => job.namespace === configMap.Namespace
+  );
+  const cronJobsInNamespace = cronJobs.filter(
+    (cronJob) => cronJob.namespace === configMap.Namespace
+  );
+  const allPodSpecs = [
+    ...podsInNamespace,
+    ...jobsInNamespace,
+    ...cronJobsInNamespace,
+  ];
+
+  // check if the configmap is referenced by any pod, job or cronjob in the namespace
+  const isReferenced = allPodSpecs.some((podSpec) => {
+    if (!podSpec || !configMap.Namespace) {
+      return false;
+    }
+    return doesPodSpecReferenceConfigMap(podSpec, configMap.Name);
+  });
+
+  return isReferenced;
+}
+
+/**
+ * Checks if a PodSpec references a specific ConfigMap.
+ * @param podSpec - The PodSpec object to check.
+ * @param configmapName - The name of the ConfigMap to check for references.
+ * @returns A boolean indicating whether the PodSpec references the ConfigMap.
+ */
+function doesPodSpecReferenceConfigMap(
+  podSpec: PodSpec,
+  configmapName: string
+) {
+  const hasEnvVarReference = podSpec?.containers.some((container) => {
+    const valueFromEnv = container.env?.some(
+      (envVar) => envVar.valueFrom?.configMapKeyRef?.name === configmapName
+    );
+    const envFromEnv = container.envFrom?.some(
+      (envVar) => envVar.configMapRef?.name === configmapName
+    );
+    return valueFromEnv || envFromEnv;
+  });
+
+  const hasVolumeReference = podSpec?.volumes?.some(
+    (volume) => volume.configMap?.name === configmapName
+  );
+
+  return hasEnvVarReference || hasVolumeReference;
+}
diff --git a/app/react/kubernetes/configs/ListView/ConfigmapsAndSecretsView.tsx b/app/react/kubernetes/configs/ListView/ConfigmapsAndSecretsView.tsx
new file mode 100644
index 0000000..0a1ade3
--- /dev/null
+++ b/app/react/kubernetes/configs/ListView/ConfigmapsAndSecretsView.tsx
@@ -0,0 +1,39 @@
+import { FileCode, Lock } from 'lucide-react';
+
+import { PageHeader } from '@@/PageHeader';
+import { Tab, WidgetTabs, useCurrentTabIndex } from '@@/Widget/WidgetTabs';
+
+import { ConfigMapsDatatable } from './ConfigMapsDatatable';
+import { SecretsDatatable } from './SecretsDatatable';
+
+const tabs: Tab[] = [
+  {
+    name: 'ConfigMaps',
+    icon: FileCode,
+    widget: <ConfigMapsDatatable />,
+    selectedTabParam: 'configmaps',
+  },
+  {
+    name: 'Secrets',
+    icon: Lock,
+    widget: <SecretsDatatable />,
+    selectedTabParam: 'secrets',
+  },
+];
+
+export function ConfigmapsAndSecretsView() {
+  const currentTabIndex = useCurrentTabIndex(tabs);
+  return (
+    <>
+      <PageHeader
+        title="ConfigMap & Secret lists"
+        breadcrumbs="ConfigMaps & Secrets"
+        reload
+      />
+      <>
+        <WidgetTabs tabs={tabs} currentTabIndex={currentTabIndex} />
+        <div className="content">{tabs[currentTabIndex].widget}</div>
+      </>
+    </>
+  );
+}
diff --git a/app/react/kubernetes/configs/ListView/SecretsDatatable/SecretsDatatable.tsx b/app/react/kubernetes/configs/ListView/SecretsDatatable/SecretsDatatable.tsx
new file mode 100644
index 0000000..1c15eb5
--- /dev/null
+++ b/app/react/kubernetes/configs/ListView/SecretsDatatable/SecretsDatatable.tsx
@@ -0,0 +1,171 @@
+import { useMemo } from 'react';
+import { Lock } from 'lucide-react';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { Authorized, useAuthorizations } from '@/react/hooks/useUser';
+import { DefaultDatatableSettings } from '@/react/kubernetes/datatables/DefaultDatatableSettings';
+import { createStore } from '@/react/kubernetes/datatables/default-kube-datatable-store';
+import { SystemResourceDescription } from '@/react/kubernetes/datatables/SystemResourceDescription';
+import { useIsDeploymentOptionHidden } from '@/react/hooks/useIsDeploymentOptionHidden';
+import { pluralize } from '@/portainer/helpers/strings';
+import { useNamespacesQuery } from '@/react/kubernetes/namespaces/queries/useNamespacesQuery';
+import { PortainerNamespace } from '@/react/kubernetes/namespaces/types';
+import { CreateFromManifestButton } from '@/react/kubernetes/components/CreateFromManifestButton';
+import { isSystemNamespace } from '@/react/kubernetes/namespaces/queries/useIsSystemNamespace';
+
+import { Datatable, TableSettingsMenu } from '@@/datatables';
+import { AddButton } from '@@/buttons';
+import { useTableState } from '@@/datatables/useTableState';
+import { DeleteButton } from '@@/buttons/DeleteButton';
+
+import { useSecretsForCluster } from '../../queries/useSecretsForCluster';
+import { useDeleteSecrets } from '../../queries/useDeleteSecrets';
+import { IndexOptional, Configuration } from '../../types';
+
+import { SecretRowData } from './types';
+import { columns } from './columns';
+
+const storageKey = 'k8sSecretsDatatable';
+const settingsStore = createStore(storageKey);
+
+export function SecretsDatatable() {
+  const tableState = useTableState(settingsStore, storageKey);
+  const { authorized: canWrite } = useAuthorizations(['K8sSecretsW']);
+  const readOnly = !canWrite;
+  const { authorized: canAccessSystemResources } = useAuthorizations(
+    'K8sAccessSystemNamespaces'
+  );
+  const isAddSecretHidden = useIsDeploymentOptionHidden('form');
+
+  const environmentId = useEnvironmentId();
+  const namespacesQuery = useNamespacesQuery(environmentId, {
+    autoRefreshRate: tableState.autoRefreshRate * 1000,
+  });
+  const secretsQuery = useSecretsForCluster(environmentId, {
+    autoRefreshRate: tableState.autoRefreshRate * 1000,
+    select: (secrets) =>
+      secrets.filter(
+        (secret) =>
+          (canAccessSystemResources && tableState.showSystemResources) ||
+          !isSystemNamespace(secret.Namespace, namespacesQuery.data)
+      ),
+    isUsed: true,
+  });
+
+  const secretRowData = useSecretRowData(
+    secretsQuery.data ?? [],
+    namespacesQuery.data
+  );
+
+  return (
+    <Datatable<IndexOptional<SecretRowData>>
+      dataset={secretRowData || []}
+      columns={columns}
+      settingsManager={tableState}
+      isLoading={secretsQuery.isLoading || namespacesQuery.isLoading}
+      emptyContentLabel="No secrets found"
+      title="Secrets"
+      titleIcon={Lock}
+      getRowId={(row) => row.UID ?? ''}
+      isRowSelectable={({ original: secret }) =>
+        !isSystemNamespace(secret.Namespace, namespacesQuery.data)
+      }
+      disableSelect={readOnly}
+      renderTableActions={(selectedRows) => (
+        <TableActions
+          selectedItems={selectedRows}
+          isAddSecretHidden={isAddSecretHidden}
+        />
+      )}
+      renderTableSettings={() => (
+        <TableSettingsMenu>
+          <DefaultDatatableSettings settings={tableState} />
+        </TableSettingsMenu>
+      )}
+      description={
+        <SystemResourceDescription
+          showSystemResources={tableState.showSystemResources}
+        />
+      }
+      data-cy="k8s-secrets-datatable"
+    />
+  );
+}
+
+// useSecretRowData appends derived display properties to the secret data
+function useSecretRowData(
+  secrets: Configuration[],
+  namespaces?: PortainerNamespace[]
+): SecretRowData[] {
+  return useMemo(
+    () =>
+      secrets?.map((secret) => {
+        const registryIdStr = secret.Annotations?.['portainer.io/registry.id'];
+        const registryId = registryIdStr
+          ? parseInt(registryIdStr, 10) || undefined
+          : undefined;
+        return {
+          ...secret,
+          inUse: secret.IsUsed,
+          isSystem: namespaces
+            ? (namespaces.find(
+                (namespace) => namespace.Name === secret.Namespace
+              )?.IsSystem ?? false)
+            : false,
+          registryId,
+        };
+      }) || [],
+    [secrets, namespaces]
+  );
+}
+
+function TableActions({
+  selectedItems,
+  isAddSecretHidden,
+}: {
+  selectedItems: SecretRowData[];
+  isAddSecretHidden: boolean;
+}) {
+  const environmentId = useEnvironmentId();
+  const deleteSecretMutation = useDeleteSecrets(environmentId);
+
+  async function handleRemoveClick(secrets: SecretRowData[]) {
+    const secretsToDelete = secrets.map((secret) => ({
+      namespace: secret.Namespace ?? '',
+      name: secret.Name ?? '',
+    }));
+
+    await deleteSecretMutation.mutateAsync(secretsToDelete);
+  }
+
+  return (
+    <Authorized authorizations="K8sSecretsW">
+      <DeleteButton
+        disabled={selectedItems.length === 0}
+        onConfirmed={() => handleRemoveClick(selectedItems)}
+        data-cy="k8sSecret-removeSecretButton"
+        confirmMessage={`Are you sure you want to remove the selected ${pluralize(
+          selectedItems.length,
+          'secret'
+        )}?`}
+      />
+
+      {!isAddSecretHidden && (
+        <AddButton
+          to="kubernetes.secrets.new"
+          data-cy="k8sSecret-addSecretWithFormButton"
+          color="secondary"
+        >
+          Add with form
+        </AddButton>
+      )}
+
+      <CreateFromManifestButton
+        params={{
+          tab: 'secrets',
+        }}
+        data-cy="k8sSecret-deployFromManifestButton"
+      />
+    </Authorized>
+  );
+}
diff --git a/app/react/kubernetes/configs/ListView/SecretsDatatable/columns/created.tsx b/app/react/kubernetes/configs/ListView/SecretsDatatable/columns/created.tsx
new file mode 100644
index 0000000..02369db
--- /dev/null
+++ b/app/react/kubernetes/configs/ListView/SecretsDatatable/columns/created.tsx
@@ -0,0 +1,17 @@
+import { formatDate } from '@/portainer/filters/filters';
+
+import { SecretRowData } from '../types';
+
+import { columnHelper } from './helper';
+
+export const created = columnHelper.accessor((row) => getCreatedAtText(row), {
+  header: 'Created',
+  id: 'created',
+  cell: ({ row }) => getCreatedAtText(row.original),
+});
+
+function getCreatedAtText(row: SecretRowData) {
+  const owner = row.ConfigurationOwner || row.ConfigurationOwnerId;
+  const date = formatDate(row.CreationDate);
+  return owner ? `${date} by ${owner}` : date;
+}
diff --git a/app/react/kubernetes/configs/ListView/SecretsDatatable/columns/helper.ts b/app/react/kubernetes/configs/ListView/SecretsDatatable/columns/helper.ts
new file mode 100644
index 0000000..6b59bd7
--- /dev/null
+++ b/app/react/kubernetes/configs/ListView/SecretsDatatable/columns/helper.ts
@@ -0,0 +1,5 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { SecretRowData } from '../types';
+
+export const columnHelper = createColumnHelper<SecretRowData>();
diff --git a/app/react/kubernetes/configs/ListView/SecretsDatatable/columns/index.ts b/app/react/kubernetes/configs/ListView/SecretsDatatable/columns/index.ts
new file mode 100644
index 0000000..006a506
--- /dev/null
+++ b/app/react/kubernetes/configs/ListView/SecretsDatatable/columns/index.ts
@@ -0,0 +1,5 @@
+import { name } from './name';
+import { namespace } from './namespace';
+import { created } from './created';
+
+export const columns = [name, namespace, created];
diff --git a/app/react/kubernetes/configs/ListView/SecretsDatatable/columns/name.tsx b/app/react/kubernetes/configs/ListView/SecretsDatatable/columns/name.tsx
new file mode 100644
index 0000000..316fb21
--- /dev/null
+++ b/app/react/kubernetes/configs/ListView/SecretsDatatable/columns/name.tsx
@@ -0,0 +1,78 @@
+import { CellContext } from '@tanstack/react-table';
+
+import { Authorized } from '@/react/hooks/useUser';
+
+import { SystemBadge } from '@@/Badge/SystemBadge';
+import { ExternalBadge } from '@@/Badge/ExternalBadge';
+import { UnusedBadge } from '@@/Badge/UnusedBadge';
+import { Link } from '@@/Link';
+import { Tooltip } from '@@/Tip/Tooltip';
+
+import { SecretRowData } from '../types';
+import { RegistryBadge } from '../../../secrets/RegistryBadge';
+
+import { columnHelper } from './helper';
+
+export const name = columnHelper.accessor(
+  (row) => {
+    const name = row.Name;
+
+    const isSystemToken = name?.includes('default-token-');
+    const isSystemConfigMap = isSystemToken || row.isSystem;
+    const hasConfigurationOwner = !!(
+      row.ConfigurationOwner || row.ConfigurationOwnerId
+    );
+    return `${name} ${isSystemConfigMap ? 'system' : ''} ${
+      !isSystemToken && !hasConfigurationOwner && !row.registryId
+        ? 'external'
+        : ''
+    } ${!row.inUse && !isSystemConfigMap ? 'unused' : ''}`;
+  },
+  {
+    header: 'Name',
+    cell: Cell,
+    id: 'name',
+  }
+);
+
+function Cell({ row }: CellContext<SecretRowData, string>) {
+  const name = row.original.Name;
+
+  const isSystemToken = name?.includes('default-token-');
+  const isSystemSecret = isSystemToken || row.original.isSystem;
+
+  const hasConfigurationOwner = !!(
+    row.original.ConfigurationOwner || row.original.ConfigurationOwnerId
+  );
+
+  return (
+    <Authorized authorizations="K8sSecretsR" childrenUnauthorized={name}>
+      <div className="flex gap-2">
+        <Link
+          to="kubernetes.secrets.secret"
+          params={{
+            namespace: row.original.Namespace,
+            name,
+          }}
+          title={name}
+          className="w-fit max-w-xs truncate xl:max-w-sm 2xl:max-w-md"
+          data-cy={`secret-name-link-${name}`}
+        >
+          {name}
+        </Link>
+        <div className="ml-auto flex gap-2">
+          {isSystemSecret && <SystemBadge />}
+          {!isSystemToken &&
+            !hasConfigurationOwner &&
+            !row.original.registryId && <ExternalBadge />}
+          {!row.original.inUse && !isSystemSecret && <UnusedBadge />}
+          {row.original.registryId && (
+            <RegistryBadge registryId={row.original.registryId}>
+              <Tooltip message="This registry secret was created by Portainer to allow pulling images." />
+            </RegistryBadge>
+          )}
+        </div>
+      </div>
+    </Authorized>
+  );
+}
diff --git a/app/react/kubernetes/configs/ListView/SecretsDatatable/columns/namespace.tsx b/app/react/kubernetes/configs/ListView/SecretsDatatable/columns/namespace.tsx
new file mode 100644
index 0000000..52292fd
--- /dev/null
+++ b/app/react/kubernetes/configs/ListView/SecretsDatatable/columns/namespace.tsx
@@ -0,0 +1,41 @@
+import { Row } from '@tanstack/react-table';
+
+import { filterHOC } from '@/react/components/datatables/Filter';
+
+import { Link } from '@@/Link';
+
+import { SecretRowData } from '../types';
+
+import { columnHelper } from './helper';
+
+export const namespace = columnHelper.accessor((row) => row.Namespace, {
+  header: 'Namespace',
+  id: 'namespace',
+  cell: ({ getValue }) => {
+    const namespace = getValue();
+
+    return (
+      <Link
+        to="kubernetes.resourcePools.resourcePool"
+        params={{
+          id: namespace,
+        }}
+        title={namespace}
+        data-cy={`secret-namespace-link-${namespace}`}
+      >
+        {namespace}
+      </Link>
+    );
+  },
+  meta: {
+    filter: filterHOC('Filter by namespace'),
+  },
+  enableColumnFilter: true,
+  filterFn: (
+    row: Row<SecretRowData>,
+    _columnId: string,
+    filterValue: string[]
+  ) =>
+    filterValue.length === 0 ||
+    filterValue.includes(row.original.Namespace ?? ''),
+});
diff --git a/app/react/kubernetes/configs/ListView/SecretsDatatable/index.ts b/app/react/kubernetes/configs/ListView/SecretsDatatable/index.ts
new file mode 100644
index 0000000..639c677
--- /dev/null
+++ b/app/react/kubernetes/configs/ListView/SecretsDatatable/index.ts
@@ -0,0 +1 @@
+export { SecretsDatatable } from './SecretsDatatable';
diff --git a/app/react/kubernetes/configs/ListView/SecretsDatatable/types.ts b/app/react/kubernetes/configs/ListView/SecretsDatatable/types.ts
new file mode 100644
index 0000000..ff73c68
--- /dev/null
+++ b/app/react/kubernetes/configs/ListView/SecretsDatatable/types.ts
@@ -0,0 +1,7 @@
+import { Configuration } from '../../types';
+
+export interface SecretRowData extends Configuration {
+  inUse: boolean;
+  isSystem: boolean;
+  registryId?: number;
+}
diff --git a/app/react/kubernetes/configs/ListView/SecretsDatatable/utils.test.ts b/app/react/kubernetes/configs/ListView/SecretsDatatable/utils.test.ts
new file mode 100644
index 0000000..fdb6fef
--- /dev/null
+++ b/app/react/kubernetes/configs/ListView/SecretsDatatable/utils.test.ts
@@ -0,0 +1,110 @@
+import { CronJob, Job, K8sPod } from '../../../applications/types';
+import { Configuration } from '../../types';
+
+import { getIsSecretInUse } from './utils';
+
+describe('getIsSecretInUse', () => {
+  it('should return false when no resources reference the secret', () => {
+    const secret: Configuration = {
+      Name: 'my-secret',
+      Namespace: 'default',
+      UID: '',
+      Type: 1,
+      ConfigurationOwner: '',
+      ConfigurationOwnerId: '',
+      IsUsed: false,
+      Yaml: '',
+    };
+    const pods: K8sPod[] = [];
+    const jobs: Job[] = [];
+    const cronJobs: CronJob[] = [];
+
+    expect(getIsSecretInUse(secret, pods, jobs, cronJobs)).toBe(false);
+  });
+
+  it('should return true when a pod references the secret', () => {
+    const secret: Configuration = {
+      Name: 'my-secret',
+      Namespace: 'default',
+      UID: '',
+      Type: 1,
+      ConfigurationOwner: '',
+      ConfigurationOwnerId: '',
+      IsUsed: false,
+      Yaml: '',
+    };
+    const pods: K8sPod[] = [
+      {
+        namespace: 'default',
+        containers: [
+          {
+            name: 'container1',
+            envFrom: [{ secretRef: { name: 'my-secret' } }],
+          },
+        ],
+        ownerReferences: [],
+      },
+    ];
+    const jobs: Job[] = [];
+    const cronJobs: CronJob[] = [];
+
+    expect(getIsSecretInUse(secret, pods, jobs, cronJobs)).toBe(true);
+  });
+
+  it('should return true when a job references the secret', () => {
+    const secret: Configuration = {
+      Name: 'my-secret',
+      Namespace: 'default',
+      UID: '',
+      Type: 1,
+      ConfigurationOwner: '',
+      ConfigurationOwnerId: '',
+      IsUsed: false,
+      Yaml: '',
+    };
+    const pods: K8sPod[] = [];
+    const jobs: Job[] = [
+      {
+        namespace: 'default',
+        containers: [
+          {
+            name: 'container1',
+            envFrom: [{ secretRef: { name: 'my-secret' } }],
+          },
+        ],
+      },
+    ];
+    const cronJobs: CronJob[] = [];
+
+    expect(getIsSecretInUse(secret, pods, jobs, cronJobs)).toBe(true);
+  });
+
+  it('should return true when a cronJob references the secret', () => {
+    const secret: Configuration = {
+      Name: 'my-secret',
+      Namespace: 'default',
+      UID: '',
+      Type: 1,
+      ConfigurationOwner: '',
+      ConfigurationOwnerId: '',
+      IsUsed: false,
+      Yaml: '',
+    };
+    const pods: K8sPod[] = [];
+    const jobs: Job[] = [];
+    const cronJobs: CronJob[] = [
+      {
+        namespace: 'default',
+        schedule: '0 0 * * *',
+        containers: [
+          {
+            name: 'container1',
+            envFrom: [{ secretRef: { name: 'my-secret' } }],
+          },
+        ],
+      },
+    ];
+
+    expect(getIsSecretInUse(secret, pods, jobs, cronJobs)).toBe(true);
+  });
+});
diff --git a/app/react/kubernetes/configs/ListView/SecretsDatatable/utils.ts b/app/react/kubernetes/configs/ListView/SecretsDatatable/utils.ts
new file mode 100644
index 0000000..fe88c47
--- /dev/null
+++ b/app/react/kubernetes/configs/ListView/SecretsDatatable/utils.ts
@@ -0,0 +1,64 @@
+import { PodSpec } from 'kubernetes-types/core/v1';
+
+import { Configuration } from '../../types';
+import { Job, CronJob, K8sPod } from '../../../applications/types';
+
+/**
+ * getIsSecretInUse returns true if the secret is referenced by any pod, job, or cronjob in the same namespace
+ */
+export function getIsSecretInUse(
+  secret: Configuration,
+  pods: K8sPod[],
+  jobs: Job[],
+  cronJobs: CronJob[]
+) {
+  // get all podspecs from pods, jobs and cronjobs that are in the same namespace
+  const podsInNamespace = pods.filter(
+    (pod) => pod.namespace === secret.Namespace
+  );
+  const jobsInNamespace = jobs.filter(
+    (job) => job.namespace === secret.Namespace
+  );
+  const cronJobsInNamespace = cronJobs.filter(
+    (cronJob) => cronJob.namespace === secret.Namespace
+  );
+  const allPodSpecs = [
+    ...podsInNamespace,
+    ...jobsInNamespace,
+    ...cronJobsInNamespace,
+  ];
+
+  // check if the secret is referenced by any pod, job or cronjob in the namespace
+  const isReferenced = allPodSpecs.some((podSpec) => {
+    if (!podSpec || !secret.Name) {
+      return false;
+    }
+    return doesPodSpecReferenceSecret(podSpec, secret.Name);
+  });
+
+  return isReferenced;
+}
+
+/**
+ * Checks if a PodSpec references a specific Secret.
+ * @param podSpec - The PodSpec object to check.
+ * @param secretName - The name of the Secret to check for references.
+ * @returns A boolean indicating whether the PodSpec references the Secret.
+ */
+function doesPodSpecReferenceSecret(podSpec: PodSpec, secretName: string) {
+  const hasEnvVarReference = podSpec?.containers.some((container) => {
+    const valueFromEnv = container.env?.some(
+      (envVar) => envVar.valueFrom?.secretKeyRef?.name === secretName
+    );
+    const envFromEnv = container.envFrom?.some(
+      (envVar) => envVar.secretRef?.name === secretName
+    );
+    return valueFromEnv || envFromEnv;
+  });
+
+  const hasVolumeReference = podSpec?.volumes?.some(
+    (volume) => volume.secret?.secretName === secretName
+  );
+
+  return hasEnvVarReference || hasVolumeReference;
+}
diff --git a/app/react/kubernetes/configs/ListView/index.ts b/app/react/kubernetes/configs/ListView/index.ts
new file mode 100644
index 0000000..53b7413
--- /dev/null
+++ b/app/react/kubernetes/configs/ListView/index.ts
@@ -0,0 +1 @@
+export { ConfigmapsAndSecretsView } from './ConfigmapsAndSecretsView';
diff --git a/app/react/kubernetes/configs/RestrictedSecretBadge.tsx b/app/react/kubernetes/configs/RestrictedSecretBadge.tsx
new file mode 100644
index 0000000..3b33fc6
--- /dev/null
+++ b/app/react/kubernetes/configs/RestrictedSecretBadge.tsx
@@ -0,0 +1,12 @@
+import { Badge } from '@@/Badge';
+import { TooltipWithChildren } from '@@/Tip/TooltipWithChildren';
+
+export function RestrictedSecretBadge() {
+  return (
+    <TooltipWithChildren message="You can only view details of secrets you've created yourself in Portainer">
+      <div className="min-w-min">
+        <Badge type="warn">Restricted</Badge>
+      </div>
+    </TooltipWithChildren>
+  );
+}
diff --git a/app/react/kubernetes/configs/configmap.service.ts b/app/react/kubernetes/configs/configmap.service.ts
new file mode 100644
index 0000000..3a6ef24
--- /dev/null
+++ b/app/react/kubernetes/configs/configmap.service.ts
@@ -0,0 +1,161 @@
+import { ConfigMap, ConfigMapList } from 'kubernetes-types/core/v1';
+import { useMutation, useQuery } from '@tanstack/react-query';
+
+import { queryClient, withError } from '@/react-tools/react-query';
+import axios from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import {
+  error as notifyError,
+  notifySuccess,
+} from '@/portainer/services/notifications';
+import { isFulfilled, isRejected } from '@/portainer/helpers/promise-utils';
+import { pluralize } from '@/portainer/helpers/strings';
+
+import { parseKubernetesAxiosError } from '../axiosError';
+
+export const configMapQueryKeys = {
+  configMaps: (environmentId: EnvironmentId, namespace?: string) => [
+    'environments',
+    environmentId,
+    'kubernetes',
+    'configmaps',
+    'namespaces',
+    namespace,
+  ],
+  configMapsForCluster: (environmentId: EnvironmentId) => [
+    'environments',
+    environmentId,
+    'kubernetes',
+    'configmaps',
+  ],
+};
+
+// returns a usequery hook for the list of configmaps from the kubernetes API
+export function useConfigMaps(
+  environmentId: EnvironmentId,
+  namespace?: string
+) {
+  return useQuery(
+    configMapQueryKeys.configMaps(environmentId, namespace),
+    () => (namespace ? getConfigMaps(environmentId, namespace) : []),
+    {
+      onError: (err) => {
+        notifyError(
+          'Failure',
+          err as Error,
+          `Unable to get ConfigMaps in namespace '${namespace}'`
+        );
+      },
+      enabled: !!namespace,
+    }
+  );
+}
+
+export function useConfigMapsForCluster(
+  environmentId: EnvironmentId,
+  namespaces?: string[],
+  options?: { autoRefreshRate?: number }
+) {
+  return useQuery(
+    configMapQueryKeys.configMapsForCluster(environmentId),
+    () => namespaces && getConfigMapsForCluster(environmentId, namespaces),
+    {
+      ...withError('Unable to retrieve ConfigMaps for cluster'),
+      enabled: !!namespaces?.length,
+      refetchInterval() {
+        return options?.autoRefreshRate ?? false;
+      },
+    }
+  );
+}
+
+export function useMutationDeleteConfigMaps(environmentId: EnvironmentId) {
+  return useMutation(
+    async (configMaps: { namespace: string; name: string }[]) => {
+      const promises = await Promise.allSettled(
+        configMaps.map(({ namespace, name }) =>
+          deleteConfigMap(environmentId, namespace, name)
+        )
+      );
+      const successfulConfigMaps = promises
+        .filter(isFulfilled)
+        .map((_, index) => configMaps[index].name);
+      const failedConfigMaps = promises
+        .filter(isRejected)
+        .map(({ reason }, index) => ({
+          name: configMaps[index].name,
+          reason,
+        }));
+      return { failedConfigMaps, successfulConfigMaps };
+    },
+    {
+      ...withError('Unable to remove ConfigMaps'),
+      onSuccess: ({ failedConfigMaps, successfulConfigMaps }) => {
+        // Promise.allSettled can also resolve with errors, so check for errors here
+        queryClient.invalidateQueries(
+          configMapQueryKeys.configMapsForCluster(environmentId)
+        );
+        // show an error message for each configmap that failed to delete
+        failedConfigMaps.forEach(({ name, reason }) => {
+          notifyError(
+            `Failed to remove ConfigMap '${name}'`,
+            new Error(reason.message) as Error
+          );
+        });
+        // show one summary message for all successful deletes
+        if (successfulConfigMaps.length) {
+          notifySuccess(
+            `${pluralize(
+              successfulConfigMaps.length,
+              'ConfigMap'
+            )} successfully removed`,
+            successfulConfigMaps.join(', ')
+          );
+        }
+      },
+    }
+  );
+}
+
+async function getConfigMapsForCluster(
+  environmentId: EnvironmentId,
+  namespaces: string[]
+) {
+  const configMaps = await Promise.all(
+    namespaces.map((namespace) => getConfigMaps(environmentId, namespace))
+  );
+  return configMaps.flat();
+}
+
+// get all configmaps for a namespace
+async function getConfigMaps(environmentId: EnvironmentId, namespace: string) {
+  try {
+    const { data } = await axios.get<ConfigMapList>(
+      buildUrl(environmentId, namespace)
+    );
+    const configMapsWithKind: ConfigMap[] = data.items.map((configmap) => ({
+      ...configmap,
+      kind: 'ConfigMap',
+    }));
+    return configMapsWithKind;
+  } catch (e) {
+    throw parseKubernetesAxiosError(e, 'Unable to retrieve ConfigMaps');
+  }
+}
+
+async function deleteConfigMap(
+  environmentId: EnvironmentId,
+  namespace: string,
+  name: string
+) {
+  try {
+    await axios.delete(buildUrl(environmentId, namespace, name));
+  } catch (e) {
+    throw parseKubernetesAxiosError(e, 'Unable to remove ConfigMap');
+  }
+}
+
+function buildUrl(environmentId: number, namespace: string, name?: string) {
+  const url = `/endpoints/${environmentId}/kubernetes/api/v1/namespaces/${namespace}/configmaps`;
+  return name ? `${url}/${name}` : url;
+}
diff --git a/app/react/kubernetes/configs/constants.ts b/app/react/kubernetes/configs/constants.ts
new file mode 100644
index 0000000..c0d15a5
--- /dev/null
+++ b/app/react/kubernetes/configs/constants.ts
@@ -0,0 +1,11 @@
+export const ConfigurationOwnerUsernameLabel =
+  'io.portainer.kubernetes.configuration.owner';
+
+export const ConfigurationOwnerIdLabel =
+  'io.portainer.kubernetes.configuration.owner.id';
+
+export const PortainerNamespaceAccessesConfigMap = {
+  namespace: 'portainer',
+  configMapName: 'portainer-config',
+  accessKey: 'NamespaceAccessPolicies',
+};
diff --git a/app/react/kubernetes/configs/queries/query-keys.ts b/app/react/kubernetes/configs/queries/query-keys.ts
new file mode 100644
index 0000000..5a3728d
--- /dev/null
+++ b/app/react/kubernetes/configs/queries/query-keys.ts
@@ -0,0 +1,52 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { ConfigMapQueryParams, SecretQueryParams } from './types';
+
+export const configMapQueryKeys = {
+  configMap: (
+    environmentId: EnvironmentId,
+    namespace: string,
+    configMap: string
+  ) => [
+    'environments',
+    environmentId,
+    'kubernetes',
+    'configmaps',
+    'namespaces',
+    namespace,
+    configMap,
+  ],
+  configMaps: (environmentId: EnvironmentId, namespace?: string) => [
+    'environments',
+    environmentId,
+    'kubernetes',
+    'configmaps',
+    'namespaces',
+    namespace,
+  ],
+  configMapsForCluster: (
+    environmentId: EnvironmentId,
+    params?: ConfigMapQueryParams
+  ) =>
+    params
+      ? ['environments', environmentId, 'kubernetes', 'configmaps', params]
+      : ['environments', environmentId, 'kubernetes', 'configmaps'],
+};
+
+export const secretQueryKeys = {
+  secrets: (environmentId: EnvironmentId, namespace?: string) => [
+    'environments',
+    environmentId,
+    'kubernetes',
+    'secrets',
+    'namespaces',
+    namespace,
+  ],
+  secretsForCluster: (
+    environmentId: EnvironmentId,
+    params?: SecretQueryParams
+  ) =>
+    params
+      ? ['environments', environmentId, 'kubernetes', 'secrets', params]
+      : ['environments', environmentId, 'kubernetes', 'secrets'],
+};
diff --git a/app/react/kubernetes/configs/queries/types.ts b/app/react/kubernetes/configs/queries/types.ts
new file mode 100644
index 0000000..778cfcb
--- /dev/null
+++ b/app/react/kubernetes/configs/queries/types.ts
@@ -0,0 +1,2 @@
+export type ConfigMapQueryParams = { isUsed?: boolean };
+export type SecretQueryParams = { isUsed?: boolean };
diff --git a/app/react/kubernetes/configs/queries/useConfigMap.ts b/app/react/kubernetes/configs/queries/useConfigMap.ts
new file mode 100644
index 0000000..e16369b
--- /dev/null
+++ b/app/react/kubernetes/configs/queries/useConfigMap.ts
@@ -0,0 +1,51 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { Configuration } from '../types';
+
+import { configMapQueryKeys } from './query-keys';
+import { ConfigMapQueryParams } from './types';
+
+export function useConfigMap<T = Configuration>(
+  environmentId: EnvironmentId,
+  namespace: string,
+  configMap: string,
+  options?: {
+    autoRefreshRate?: number;
+    select?: (data: Configuration) => T;
+    enabled?: boolean;
+  } & ConfigMapQueryParams
+) {
+  return useQuery(
+    configMapQueryKeys.configMap(environmentId, namespace, configMap),
+    () => getConfigMap(environmentId, namespace, configMap, { withData: true }),
+    {
+      select: options?.select,
+      enabled: options?.enabled,
+      refetchInterval: () => options?.autoRefreshRate ?? false,
+      // handle error from the callers (some callers shouldn't display an error)
+    }
+  );
+}
+
+// get a configmap
+export async function getConfigMap(
+  environmentId: EnvironmentId,
+  namespace: string,
+  configMap: string,
+  params?: { withData?: boolean }
+) {
+  try {
+    const { data } = await axios.get<Configuration>(
+      `/kubernetes/${environmentId}/namespaces/${namespace}/configmaps/${configMap}`,
+      { params }
+    );
+    return data;
+  } catch (e) {
+    // use parseAxiosError instead of parseKubernetesAxiosError
+    // because this is an internal portainer api endpoint, not through the kube proxy
+    throw parseAxiosError(e, 'Unable to retrieve ConfigMaps');
+  }
+}
diff --git a/app/react/kubernetes/configs/queries/useConfigMaps.ts b/app/react/kubernetes/configs/queries/useConfigMaps.ts
new file mode 100644
index 0000000..96dfad1
--- /dev/null
+++ b/app/react/kubernetes/configs/queries/useConfigMaps.ts
@@ -0,0 +1,39 @@
+import { useQuery } from '@tanstack/react-query';
+import { ConfigMap, ConfigMapList } from 'kubernetes-types/core/v1';
+
+import axios from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { withError } from '@/react-tools/react-query';
+
+import { parseKubernetesAxiosError } from '../../axiosError';
+
+import { configMapQueryKeys } from './query-keys';
+
+// returns a usequery hook for the list of configmaps within a namespace from the kubernetes API
+export function useConfigMaps(environmentId: EnvironmentId, namespace: string) {
+  return useQuery(
+    configMapQueryKeys.configMaps(environmentId, namespace),
+    () => (namespace ? getConfigMaps(environmentId, namespace) : []),
+    {
+      ...withError(`Unable to get ConfigMaps in namespace '${namespace}'`),
+      enabled: !!namespace,
+    }
+  );
+}
+
+// get all configmaps for a namespace
+async function getConfigMaps(environmentId: EnvironmentId, namespace?: string) {
+  try {
+    const { data } = await axios.get<ConfigMapList>(
+      `/endpoints/${environmentId}/kubernetes/api/v1/namespaces/${namespace}/configmaps`
+    );
+    // when fetching a list, the kind isn't appended to the items, so we need to add it
+    const configmaps: ConfigMap[] = data.items.map((configmap) => ({
+      ...configmap,
+      kind: 'ConfigMap',
+    }));
+    return configmaps;
+  } catch (e) {
+    throw parseKubernetesAxiosError(e, 'Unable to retrieve ConfigMaps');
+  }
+}
diff --git a/app/react/kubernetes/configs/queries/useConfigmapsForCluster.ts b/app/react/kubernetes/configs/queries/useConfigmapsForCluster.ts
new file mode 100644
index 0000000..22ccbd4
--- /dev/null
+++ b/app/react/kubernetes/configs/queries/useConfigmapsForCluster.ts
@@ -0,0 +1,53 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { withError } from '@/react-tools/react-query';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { Configuration } from '../types';
+
+import { configMapQueryKeys } from './query-keys';
+import { ConfigMapQueryParams } from './types';
+
+export function useConfigMapsForCluster<TData = Configuration[]>(
+  environmentId: EnvironmentId,
+  options?: {
+    autoRefreshRate?: number;
+    select?: (data: Configuration[]) => TData;
+  } & ConfigMapQueryParams
+) {
+  const { autoRefreshRate, select, ...params } = options ?? {};
+  return useQuery(
+    configMapQueryKeys.configMapsForCluster(environmentId, params),
+    () =>
+      getConfigMapsForCluster(environmentId, {
+        ...params,
+        isUsed: params?.isUsed,
+      }),
+    {
+      ...withError('Unable to retrieve ConfigMaps for cluster'),
+      refetchInterval() {
+        return options?.autoRefreshRate ?? false;
+      },
+      select,
+    }
+  );
+}
+
+// get all configmaps for a cluster
+async function getConfigMapsForCluster(
+  environmentId: EnvironmentId,
+  params?: { withData?: boolean; isUsed?: boolean }
+) {
+  try {
+    const { data } = await axios.get<Configuration[]>(
+      `/kubernetes/${environmentId}/configmaps`,
+      { params }
+    );
+    return data;
+  } catch (e) {
+    // use parseAxiosError instead of parseKubernetesAxiosError
+    // because this is an internal portainer api endpoint, not through the kube proxy
+    throw parseAxiosError(e, 'Unable to retrieve ConfigMaps');
+  }
+}
diff --git a/app/react/kubernetes/configs/queries/useDeleteConfigMaps.ts b/app/react/kubernetes/configs/queries/useDeleteConfigMaps.ts
new file mode 100644
index 0000000..c7dd4d3
--- /dev/null
+++ b/app/react/kubernetes/configs/queries/useDeleteConfigMaps.ts
@@ -0,0 +1,77 @@
+import { useMutation } from '@tanstack/react-query';
+
+import { queryClient, withError } from '@/react-tools/react-query';
+import axios from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import {
+  error as notifyError,
+  notifySuccess,
+} from '@/portainer/services/notifications';
+import { isFulfilled, isRejected } from '@/portainer/helpers/promise-utils';
+import { pluralize } from '@/portainer/helpers/strings';
+
+import { parseKubernetesAxiosError } from '../../axiosError';
+
+import { configMapQueryKeys } from './query-keys';
+
+export function useDeleteConfigMaps(environmentId: EnvironmentId) {
+  return useMutation(
+    async (configMaps: { namespace: string; name: string }[]) => {
+      const promises = await Promise.allSettled(
+        configMaps.map(({ namespace, name }) =>
+          deleteConfigMap(environmentId, namespace, name)
+        )
+      );
+      const successfulConfigMaps = promises
+        .filter(isFulfilled)
+        .map((_, index) => configMaps[index].name);
+      const failedConfigMaps = promises
+        .filter(isRejected)
+        .map(({ reason }, index) => ({
+          name: configMaps[index].name,
+          reason,
+        }));
+      return { failedConfigMaps, successfulConfigMaps };
+    },
+    {
+      ...withError('Unable to remove ConfigMaps'),
+      onSuccess: ({ failedConfigMaps, successfulConfigMaps }) => {
+        // Promise.allSettled can also resolve with errors, so check for errors here
+        // show an error message for each configmap that failed to delete
+        failedConfigMaps.forEach(({ name, reason }) => {
+          notifyError(
+            `Failed to remove ConfigMap '${name}'`,
+            new Error(reason.message) as Error
+          );
+        });
+        // show one summary message for all successful deletes
+        if (successfulConfigMaps.length) {
+          notifySuccess(
+            `${pluralize(
+              successfulConfigMaps.length,
+              'ConfigMap'
+            )} successfully removed`,
+            successfulConfigMaps.join(', ')
+          );
+        }
+        queryClient.invalidateQueries({
+          queryKey: configMapQueryKeys.configMapsForCluster(environmentId),
+        });
+      },
+    }
+  );
+}
+
+async function deleteConfigMap(
+  environmentId: EnvironmentId,
+  namespace: string,
+  name: string
+) {
+  try {
+    await axios.delete(
+      `/endpoints/${environmentId}/kubernetes/api/v1/namespaces/${namespace}/configmaps/${name}`
+    );
+  } catch (e) {
+    throw parseKubernetesAxiosError(e, 'Unable to remove ConfigMap');
+  }
+}
diff --git a/app/react/kubernetes/configs/queries/useDeleteSecrets.ts b/app/react/kubernetes/configs/queries/useDeleteSecrets.ts
new file mode 100644
index 0000000..9e70866
--- /dev/null
+++ b/app/react/kubernetes/configs/queries/useDeleteSecrets.ts
@@ -0,0 +1,76 @@
+import { useMutation } from '@tanstack/react-query';
+
+import { queryClient, withError } from '@/react-tools/react-query';
+import axios from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import {
+  error as notifyError,
+  notifySuccess,
+} from '@/portainer/services/notifications';
+import { isFulfilled, isRejected } from '@/portainer/helpers/promise-utils';
+import { pluralize } from '@/portainer/helpers/strings';
+
+import { parseKubernetesAxiosError } from '../../axiosError';
+
+import { secretQueryKeys } from './query-keys';
+
+export function useDeleteSecrets(environmentId: EnvironmentId) {
+  return useMutation(
+    async (secrets: { namespace: string; name: string }[]) => {
+      const promises = await Promise.allSettled(
+        secrets.map(({ namespace, name }) =>
+          deleteSecret(environmentId, namespace, name)
+        )
+      );
+      const successfulSecrets = promises
+        .filter(isFulfilled)
+        .map((_, index) => secrets[index].name);
+      const failedSecrets = promises
+        .filter(isRejected)
+        .map(({ reason }, index) => ({
+          name: secrets[index].name,
+          reason,
+        }));
+      return { failedSecrets, successfulSecrets };
+    },
+    {
+      ...withError('Unable to remove secrets'),
+      onSuccess: ({ failedSecrets, successfulSecrets }) => {
+        // show an error message for each secret that failed to delete
+        failedSecrets.forEach(({ name, reason }) => {
+          notifyError(
+            `Failed to remove secret '${name}'`,
+            new Error(reason.message) as Error
+          );
+        });
+        // show one summary message for all successful deletes
+        if (successfulSecrets.length) {
+          notifySuccess(
+            `${pluralize(
+              successfulSecrets.length,
+              'Secret'
+            )} successfully removed`,
+            successfulSecrets.join(', ')
+          );
+        }
+        queryClient.invalidateQueries({
+          queryKey: secretQueryKeys.secretsForCluster(environmentId),
+        });
+      },
+    }
+  );
+}
+
+async function deleteSecret(
+  environmentId: EnvironmentId,
+  namespace: string,
+  name: string
+) {
+  try {
+    await axios.delete(
+      `/endpoints/${environmentId}/kubernetes/api/v1/namespaces/${namespace}/secrets/${name}`
+    );
+  } catch (e) {
+    throw parseKubernetesAxiosError(e, 'Unable to remove secret');
+  }
+}
diff --git a/app/react/kubernetes/configs/queries/useK8sConfigMaps.ts b/app/react/kubernetes/configs/queries/useK8sConfigMaps.ts
new file mode 100644
index 0000000..8c25e7d
--- /dev/null
+++ b/app/react/kubernetes/configs/queries/useK8sConfigMaps.ts
@@ -0,0 +1,63 @@
+import { ConfigMap, ConfigMapList } from 'kubernetes-types/core/v1';
+import { useQuery } from '@tanstack/react-query';
+
+import axios from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { error as notifyError } from '@/portainer/services/notifications';
+
+import { parseKubernetesAxiosError } from '../../axiosError';
+
+export const configMapQueryKeys = {
+  configMaps: (environmentId: EnvironmentId, namespace?: string) => [
+    'environments',
+    environmentId,
+    'kubernetes',
+    'configmaps',
+    'namespaces',
+    namespace,
+  ],
+};
+
+/**
+ * returns a usequery hook for the list of configmaps from the kubernetes API
+ */
+export function useK8sConfigMaps(
+  environmentId: EnvironmentId,
+  namespace?: string
+) {
+  return useQuery(
+    configMapQueryKeys.configMaps(environmentId, namespace),
+    () => (namespace ? getConfigMaps(environmentId, namespace) : []),
+    {
+      onError: (err) => {
+        notifyError(
+          'Failure',
+          err as Error,
+          `Unable to get ConfigMaps in namespace '${namespace}'`
+        );
+      },
+      enabled: !!namespace,
+    }
+  );
+}
+
+// get all configmaps for a namespace
+async function getConfigMaps(environmentId: EnvironmentId, namespace: string) {
+  try {
+    const { data } = await axios.get<ConfigMapList>(
+      buildUrl(environmentId, namespace)
+    );
+    const configMapsWithKind: ConfigMap[] = data.items.map((configmap) => ({
+      ...configmap,
+      kind: 'ConfigMap',
+    }));
+    return configMapsWithKind;
+  } catch (e) {
+    throw parseKubernetesAxiosError(e, 'Unable to retrieve ConfigMaps');
+  }
+}
+
+function buildUrl(environmentId: number, namespace: string, name?: string) {
+  const url = `/endpoints/${environmentId}/kubernetes/api/v1/namespaces/${namespace}/configmaps`;
+  return name ? `${url}/${name}` : url;
+}
diff --git a/app/react/kubernetes/configs/queries/useK8sSecrets.ts b/app/react/kubernetes/configs/queries/useK8sSecrets.ts
new file mode 100644
index 0000000..19480fa
--- /dev/null
+++ b/app/react/kubernetes/configs/queries/useK8sSecrets.ts
@@ -0,0 +1,63 @@
+import { Secret, SecretList } from 'kubernetes-types/core/v1';
+import { useQuery } from '@tanstack/react-query';
+
+import axios from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { error as notifyError } from '@/portainer/services/notifications';
+
+import { parseKubernetesAxiosError } from '../../axiosError';
+
+export const secretQueryKeys = {
+  secrets: (environmentId: EnvironmentId, namespace?: string) => [
+    'environments',
+    environmentId,
+    'kubernetes',
+    'secrets',
+    'namespaces',
+    namespace,
+  ],
+};
+
+/**
+ * returns a usequery hook for the list of secrets from the kubernetes API
+ */
+export function useK8sSecrets(
+  environmentId: EnvironmentId,
+  namespace?: string
+) {
+  return useQuery(
+    secretQueryKeys.secrets(environmentId, namespace),
+    () => (namespace ? getSecrets(environmentId, namespace) : []),
+    {
+      onError: (err) => {
+        notifyError(
+          'Failure',
+          err as Error,
+          `Unable to get secrets in namespace '${namespace}'`
+        );
+      },
+      enabled: !!namespace,
+    }
+  );
+}
+
+// get all secrets for a namespace
+async function getSecrets(environmentId: EnvironmentId, namespace: string) {
+  try {
+    const { data } = await axios.get<SecretList>(
+      buildUrl(environmentId, namespace)
+    );
+    const secretsWithKind: Secret[] = data.items.map((secret) => ({
+      ...secret,
+      kind: 'Secret',
+    }));
+    return secretsWithKind;
+  } catch (e) {
+    throw parseKubernetesAxiosError(e, 'Unable to retrieve secrets');
+  }
+}
+
+function buildUrl(environmentId: number, namespace: string, name?: string) {
+  const url = `/endpoints/${environmentId}/kubernetes/api/v1/namespaces/${namespace}/secrets`;
+  return name ? `${url}/${name}` : url;
+}
diff --git a/app/react/kubernetes/configs/queries/useSecrets.ts b/app/react/kubernetes/configs/queries/useSecrets.ts
new file mode 100644
index 0000000..bc5cf07
--- /dev/null
+++ b/app/react/kubernetes/configs/queries/useSecrets.ts
@@ -0,0 +1,40 @@
+import { useQuery } from '@tanstack/react-query';
+import { Secret, SecretList } from 'kubernetes-types/core/v1';
+
+import { withError } from '@/react-tools/react-query';
+import axios from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { parseKubernetesAxiosError } from '../../axiosError';
+
+import { secretQueryKeys } from './query-keys';
+
+// returns a usequery hook for the list of secrets from the kubernetes API
+export function useSecrets(environmentId: EnvironmentId, namespace?: string) {
+  return useQuery(
+    secretQueryKeys.secrets(environmentId, namespace),
+    () => (namespace ? getSecrets(environmentId, namespace) : []),
+    {
+      ...withError(`Unable to get secrets in namespace '${namespace}'`),
+      enabled: !!namespace,
+      retry: 1,
+    }
+  );
+}
+
+// get all secrets for a namespace
+async function getSecrets(environmentId: EnvironmentId, namespace: string) {
+  try {
+    const { data } = await axios.get<SecretList>(
+      `/endpoints/${environmentId}/kubernetes/api/v1/namespaces/${namespace}/secrets`
+    );
+    // when fetching a list, the kind isn't appended to the items, so we need to add it
+    const secrets: Secret[] = data.items.map((secret) => ({
+      ...secret,
+      kind: 'Secret',
+    }));
+    return secrets;
+  } catch (e) {
+    throw parseKubernetesAxiosError(e, 'Unable to retrieve secrets');
+  }
+}
diff --git a/app/react/kubernetes/configs/queries/useSecretsForCluster.ts b/app/react/kubernetes/configs/queries/useSecretsForCluster.ts
new file mode 100644
index 0000000..75b1a7e
--- /dev/null
+++ b/app/react/kubernetes/configs/queries/useSecretsForCluster.ts
@@ -0,0 +1,59 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { withError } from '@/react-tools/react-query';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { Configuration } from '../types';
+
+import { SecretQueryParams } from './types';
+import { secretQueryKeys } from './query-keys';
+
+export function useSecretsForCluster<TData = Configuration[]>(
+  environmentId: EnvironmentId,
+  options?: {
+    autoRefreshRate?: number;
+    select?: (data: Configuration[]) => TData;
+  } & SecretQueryParams
+) {
+  const { autoRefreshRate, select, ...params } = options ?? {};
+  return useQuery(
+    secretQueryKeys.secretsForCluster(environmentId, params),
+    () =>
+      getSecretsForCluster(environmentId, {
+        ...params,
+        isUsed: params?.isUsed,
+      }),
+    {
+      ...withError('Unable to retrieve secrets for cluster'),
+      refetchInterval() {
+        return options?.autoRefreshRate ?? false;
+      },
+      select,
+    }
+  );
+}
+
+async function getSecretsForCluster(
+  environmentId: EnvironmentId,
+  params?: { withData?: boolean; isUsed?: boolean }
+) {
+  const secrets = await getSecrets(environmentId, params);
+  return secrets;
+}
+
+// get all secrets for a cluster
+async function getSecrets(
+  environmentId: EnvironmentId,
+  params?: { withData?: boolean; isUsed?: boolean } | undefined
+) {
+  try {
+    const { data } = await axios.get<Configuration[]>(
+      `/kubernetes/${environmentId}/secrets`,
+      { params }
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to retrieve secrets');
+  }
+}
diff --git a/app/react/kubernetes/configs/queries/useUpdateK8sConfigMapMutation.ts b/app/react/kubernetes/configs/queries/useUpdateK8sConfigMapMutation.ts
new file mode 100644
index 0000000..74b0696
--- /dev/null
+++ b/app/react/kubernetes/configs/queries/useUpdateK8sConfigMapMutation.ts
@@ -0,0 +1,86 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+import { ConfigMap } from 'kubernetes-types/core/v1';
+
+import axios from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { withInvalidate } from '@/react-tools/react-query';
+
+import { parseKubernetesAxiosError } from '../../axiosError';
+
+import { configMapQueryKeys } from './useK8sConfigMaps';
+
+/**
+ * useUpdateK8sConfigMapMutation returns a mutation hook for updating a Kubernetes ConfigMap using the Kubernetes proxy API.
+ */
+export function useUpdateK8sConfigMapMutation(
+  environmentId: EnvironmentId,
+  namespace: string
+) {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: ({
+      configMap,
+      configMapName,
+    }: {
+      configMap: ConfigMap;
+      configMapName: string;
+    }) => {
+      if (!configMap.metadata?.uid) {
+        return createConfigMap(
+          environmentId,
+          namespace,
+          configMapName,
+          configMap
+        );
+      }
+      return updateConfigMap(
+        environmentId,
+        namespace,
+        configMapName,
+        configMap
+      );
+    },
+    ...withInvalidate(queryClient, [
+      configMapQueryKeys.configMaps(environmentId, namespace),
+    ]),
+    // handle success notifications in the calling component
+  });
+}
+
+async function updateConfigMap(
+  environmentId: EnvironmentId,
+  namespace: string,
+  configMap: string,
+  data: ConfigMap
+) {
+  try {
+    return await axios.put(
+      `/endpoints/${environmentId}/kubernetes/api/v1/namespaces/${namespace}/configmaps/${configMap}`,
+      data
+    );
+  } catch (e) {
+    throw parseKubernetesAxiosError(
+      e,
+      `Unable to update ConfigMap '${configMap}'`
+    );
+  }
+}
+
+function createConfigMap(
+  environmentId: EnvironmentId,
+  namespace: string,
+  configMap: string,
+  data: ConfigMap
+) {
+  try {
+    return axios.post(
+      `/endpoints/${environmentId}/kubernetes/api/v1/namespaces/${namespace}/configmaps`,
+      data
+    );
+  } catch (e) {
+    throw parseKubernetesAxiosError(
+      e,
+      `Unable to create ConfigMap '${configMap}'`
+    );
+  }
+}
diff --git a/app/react/kubernetes/configs/secrets/ItemView/LinkedServiceAccountsRow.test.tsx b/app/react/kubernetes/configs/secrets/ItemView/LinkedServiceAccountsRow.test.tsx
new file mode 100644
index 0000000..71d8889
--- /dev/null
+++ b/app/react/kubernetes/configs/secrets/ItemView/LinkedServiceAccountsRow.test.tsx
@@ -0,0 +1,321 @@
+import { act, render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { HttpResponse, http } from 'msw';
+import { ReactNode } from 'react';
+import { vi } from 'vitest';
+
+import { server } from '@/setup-tests/server';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { useAuthorizations } from '@/react/hooks/useUser';
+import { useGetAllServiceAccountsQuery } from '@/react/kubernetes/more-resources/ServiceAccountsView/ServiceAccountsDatatable/queries/useGetAllServiceAccountsQuery';
+
+import { LinkedServiceAccountsRow } from './LinkedServiceAccountsRow';
+
+vi.mock(
+  '@/react/hooks/useUser',
+  async (importOriginal: () => Promise<object>) => ({
+    ...(await importOriginal()),
+    useAuthorizations: vi.fn(),
+  })
+);
+
+vi.mock('@/react/hooks/useEnvironmentId', () => ({
+  useEnvironmentId: () => 1,
+}));
+
+vi.mock(
+  '@/react/kubernetes/more-resources/ServiceAccountsView/ServiceAccountsDatatable/queries/useGetAllServiceAccountsQuery'
+);
+
+vi.mock(
+  '@/react/kubernetes/configs/secrets/queries/useSecretsLinkedToDefaultSA',
+  () => ({
+    useSecretsLinkedToDefaultSA: () => ({ data: [], isLoading: false }),
+  })
+);
+
+vi.mock('@/portainer/services/notifications', () => ({
+  notifySuccess: vi.fn(),
+  notifyError: vi.fn(),
+}));
+
+vi.mock('@@/Link', () => ({
+  Link: ({ children }: { children: ReactNode }) => <>{children}</>,
+}));
+
+vi.mock('@@/Tip/Tooltip', () => ({ Tooltip: () => null }));
+
+vi.mock('@@/Tip/TooltipWithChildren', () => ({
+  TooltipWithChildren: ({ children }: { children: ReactNode }) => (
+    <>{children}</>
+  ),
+}));
+
+// Captures the latest onChange so tests can programmatically drive selection
+let latestOnChange: ((v: string[]) => void) | undefined;
+vi.mock('@@/form-components/PortainerSelect', () => ({
+  MultiSelect: ({ onChange }: { onChange: (v: string[]) => void }) => {
+    latestOnChange = onChange;
+    return <div data-testid="multi-select" />;
+  },
+}));
+
+const LinkedServiceAccountsRowWithQuery = withTestQueryProvider(
+  LinkedServiceAccountsRow
+);
+
+type RowProps = React.ComponentProps<typeof LinkedServiceAccountsRow>;
+
+function renderRow(props: Partial<RowProps> = {}) {
+  return render(
+    <LinkedServiceAccountsRowWithQuery
+      secretName="my-secret"
+      namespace="default"
+      isSystem={false}
+      {...props}
+    />
+  );
+}
+
+describe('LinkedServiceAccountsRow', () => {
+  beforeEach(() => {
+    latestOnChange = undefined;
+    vi.mocked(useAuthorizations).mockImplementation(() => ({
+      authorized: false,
+      isLoading: false,
+    }));
+    vi.mocked(useGetAllServiceAccountsQuery).mockReturnValue({
+      data: [],
+      isLoading: false,
+    } as unknown as ReturnType<typeof useGetAllServiceAccountsQuery>);
+  });
+
+  describe('loading state', () => {
+    it('shows a loading indicator while service accounts are being fetched', () => {
+      vi.mocked(useGetAllServiceAccountsQuery).mockReturnValue({
+        data: undefined,
+        isLoading: true,
+      } as unknown as ReturnType<typeof useGetAllServiceAccountsQuery>);
+      renderRow();
+      expect(screen.getByText(/loading service accounts/i)).toBeVisible();
+    });
+  });
+
+  describe('empty state', () => {
+    it('shows guidance text when no service accounts are linked to the secret', () => {
+      renderRow();
+      expect(screen.getByText(/No service accounts linked/)).toBeVisible();
+    });
+  });
+
+  describe('linked service account badges', () => {
+    it('shows a badge for each service account that references this secret', () => {
+      vi.mocked(useGetAllServiceAccountsQuery).mockReturnValue({
+        data: [
+          {
+            name: 'app-sa',
+            namespace: 'default',
+            imagePullSecrets: [{ name: 'my-secret' }],
+          },
+          {
+            name: 'other-sa',
+            namespace: 'default',
+            imagePullSecrets: [{ name: 'my-secret' }],
+          },
+        ],
+        isLoading: false,
+      } as unknown as ReturnType<typeof useGetAllServiceAccountsQuery>);
+      renderRow({ secretName: 'my-secret' });
+      expect(screen.getByText('app-sa')).toBeVisible();
+      expect(screen.getByText('other-sa')).toBeVisible();
+    });
+
+    it('only shows service accounts from the matching namespace', () => {
+      vi.mocked(useGetAllServiceAccountsQuery).mockReturnValue({
+        data: [
+          {
+            name: 'in-namespace-sa',
+            namespace: 'default',
+            imagePullSecrets: [{ name: 'my-secret' }],
+          },
+          {
+            name: 'other-namespace-sa',
+            namespace: 'staging',
+            imagePullSecrets: [{ name: 'my-secret' }],
+          },
+        ],
+        isLoading: false,
+      } as unknown as ReturnType<typeof useGetAllServiceAccountsQuery>);
+      renderRow({ namespace: 'default' });
+      expect(screen.getByText('in-namespace-sa')).toBeVisible();
+      expect(screen.queryByText('other-namespace-sa')).not.toBeInTheDocument();
+    });
+
+    it('shows a "+N more" badge when there are more than 5 linked SAs', () => {
+      vi.mocked(useGetAllServiceAccountsQuery).mockReturnValue({
+        data: Array.from({ length: 7 }, (_, i) => ({
+          name: `sa-${i}`,
+          namespace: 'default',
+          imagePullSecrets: [{ name: 'my-secret' }],
+        })),
+        isLoading: false,
+      } as unknown as ReturnType<typeof useGetAllServiceAccountsQuery>);
+      renderRow();
+      expect(screen.getByText(/\+ 2 more/)).toBeVisible();
+    });
+  });
+
+  describe('edit button visibility by role', () => {
+    it('does not show edit button for a user without write permission', () => {
+      vi.mocked(useAuthorizations).mockImplementation(() => ({
+        authorized: false,
+        isLoading: false,
+      }));
+      renderRow();
+      expect(
+        screen.queryByRole('button', { name: /edit/i })
+      ).not.toBeInTheDocument();
+    });
+
+    it('does not show edit button for system secrets, even for an admin', () => {
+      vi.mocked(useAuthorizations).mockImplementation(() => ({
+        authorized: true,
+        isLoading: false,
+      }));
+      renderRow({ isSystem: true });
+      expect(
+        screen.queryByRole('button', { name: /edit/i })
+      ).not.toBeInTheDocument();
+    });
+
+    it('shows edit button for an authorized user on a non-system secret', () => {
+      vi.mocked(useAuthorizations).mockImplementation((permission) => ({
+        authorized: permission === 'K8sServiceAccountsW',
+        isLoading: false,
+      }));
+      renderRow({ isSystem: false });
+      expect(screen.getByRole('button', { name: /edit/i })).toBeVisible();
+    });
+  });
+
+  describe('edit flow', () => {
+    beforeEach(() => {
+      vi.mocked(useAuthorizations).mockImplementation((permission) => ({
+        authorized: permission === 'K8sServiceAccountsW',
+        isLoading: false,
+      }));
+    });
+
+    it('shows save and cancel buttons when editing', async () => {
+      renderRow();
+      await userEvent.click(screen.getByRole('button', { name: /edit/i }));
+      expect(screen.getByRole('button', { name: /save/i })).toBeVisible();
+      expect(screen.getByRole('button', { name: /cancel/i })).toBeVisible();
+    });
+
+    it('returns to view mode when cancel is clicked', async () => {
+      renderRow();
+      await userEvent.click(screen.getByRole('button', { name: /edit/i }));
+      await userEvent.click(screen.getByRole('button', { name: /cancel/i }));
+      expect(screen.getByRole('button', { name: /edit/i })).toBeVisible();
+      expect(
+        screen.queryByRole('button', { name: /save/i })
+      ).not.toBeInTheDocument();
+    });
+
+    it('sends a PUT to the correct path and body when linking a new service account', async () => {
+      vi.mocked(useGetAllServiceAccountsQuery).mockReturnValue({
+        data: [{ name: 'app-sa', namespace: 'default', imagePullSecrets: [] }],
+        isLoading: false,
+      } as unknown as ReturnType<typeof useGetAllServiceAccountsQuery>);
+
+      let capturedPath: string | undefined;
+      let capturedBody: unknown;
+
+      server.use(
+        http.put(
+          '/api/kubernetes/:envId/namespaces/:namespace/service_accounts/:name/image_pull_secrets',
+          async ({ request }) => {
+            capturedPath = request.url;
+            capturedBody = await request.json();
+            return new HttpResponse(null, { status: 204 });
+          }
+        )
+      );
+
+      renderRow({ secretName: 'my-secret', namespace: 'default' });
+
+      await userEvent.click(screen.getByRole('button', { name: /edit/i }));
+      await act(async () => {
+        latestOnChange!(['app-sa']);
+      });
+      await userEvent.click(screen.getByRole('button', { name: /save/i }));
+
+      await waitFor(() => {
+        expect(capturedPath).toContain(
+          '/api/kubernetes/1/namespaces/default/service_accounts/app-sa/image_pull_secrets'
+        );
+        expect(capturedBody).toEqual({ secretNames: ['my-secret'] });
+      });
+    });
+
+    it('sends a PUT preserving remaining secrets when removing the secret from a linked SA', async () => {
+      vi.mocked(useGetAllServiceAccountsQuery).mockReturnValue({
+        data: [
+          {
+            name: 'app-sa',
+            namespace: 'default',
+            imagePullSecrets: [{ name: 'my-secret' }, { name: 'other-secret' }],
+          },
+        ],
+        isLoading: false,
+      } as unknown as ReturnType<typeof useGetAllServiceAccountsQuery>);
+
+      let capturedBody: unknown;
+
+      server.use(
+        http.put(
+          '/api/kubernetes/:envId/namespaces/:namespace/service_accounts/:name/image_pull_secrets',
+          async ({ request }) => {
+            capturedBody = await request.json();
+            return new HttpResponse(null, { status: 204 });
+          }
+        )
+      );
+
+      renderRow({ secretName: 'my-secret', namespace: 'default' });
+
+      await userEvent.click(screen.getByRole('button', { name: /edit/i }));
+      await act(async () => {
+        latestOnChange!([]);
+      });
+      await userEvent.click(screen.getByRole('button', { name: /save/i }));
+
+      await waitFor(() => {
+        expect(capturedBody).toEqual({ secretNames: ['other-secret'] });
+      });
+    });
+  });
+
+  describe('admin vs standard user role', () => {
+    it('admin with registry access can enter edit mode', async () => {
+      vi.mocked(useAuthorizations).mockImplementation(() => ({
+        authorized: true,
+        isLoading: false,
+      }));
+      renderRow({ isSystem: false });
+      await userEvent.click(screen.getByRole('button', { name: /edit/i }));
+      expect(screen.getByRole('button', { name: /save/i })).toBeVisible();
+    });
+
+    it('standard user with write permission but no registry access can also edit', async () => {
+      vi.mocked(useAuthorizations).mockImplementation((permission) => ({
+        authorized: permission === 'K8sServiceAccountsW',
+        isLoading: false,
+      }));
+      renderRow({ isSystem: false });
+      await userEvent.click(screen.getByRole('button', { name: /edit/i }));
+      expect(screen.getByRole('button', { name: /save/i })).toBeVisible();
+    });
+  });
+});
diff --git a/app/react/kubernetes/configs/secrets/ItemView/LinkedServiceAccountsRow.tsx b/app/react/kubernetes/configs/secrets/ItemView/LinkedServiceAccountsRow.tsx
new file mode 100644
index 0000000..8e2e186
--- /dev/null
+++ b/app/react/kubernetes/configs/secrets/ItemView/LinkedServiceAccountsRow.tsx
@@ -0,0 +1,281 @@
+import { PencilIcon } from 'lucide-react';
+import { useState } from 'react';
+import { compact } from 'lodash';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useAuthorizations } from '@/react/hooks/useUser';
+import { useGetAllServiceAccountsQuery } from '@/react/kubernetes/more-resources/ServiceAccountsView/ServiceAccountsDatatable/queries/useGetAllServiceAccountsQuery';
+import {
+  SAImagePullSecretsUpdate,
+  useUpdateLinkedServiceAccountsMutation,
+} from '@/react/kubernetes/configs/secrets/queries/useUpdateLinkedServiceAccountsMutation';
+
+import { Badge } from '@@/Badge';
+import { Button } from '@@/buttons/Button';
+import { LoadingButton } from '@@/buttons/LoadingButton';
+import { DetailsRow } from '@@/DetailsTable/DetailsRow';
+import { Link } from '@@/Link';
+import { MultiSelect } from '@@/form-components/PortainerSelect';
+import {
+  DisabledMultiValue,
+  DisabledMultiValueRemove,
+  DisabledOption,
+  preserveProtectedValues,
+} from '@@/form-components/DisabledMultiValue';
+import { Tooltip } from '@@/Tip/Tooltip';
+import { InlineLoader } from '@@/InlineLoader';
+
+import { useSecretsLinkedToDefaultSA } from '../queries/useSecretsLinkedToDefaultSA';
+
+const MAX_VISIBLE_SERVICE_ACCOUNTS = 5;
+
+const registryAccessAdminMessage = (
+  <span>
+    This secret is linked to the default service account from the{' '}
+    <Link to="kubernetes.registries" data-cy="registry-access-link">
+      registry access
+    </Link>{' '}
+    settings to allow pods to pull images automatically in this namespace.
+    Update the settings to remove the link.
+  </span>
+);
+
+const registryAccessUserMessage = (
+  <span>
+    This secret is linked to the default service account from the registry
+    access settings to allow pods to pull images automatically in this
+    namespace. Contact your administrator to update the settings.
+  </span>
+);
+
+type Props = {
+  secretName: string;
+  namespace: string;
+  isSystem: boolean;
+};
+
+type ServiceAccount = {
+  name: string;
+  imagePullSecrets?: { name: string }[];
+};
+
+export function LinkedServiceAccountsRow({
+  secretName,
+  namespace,
+  isSystem,
+}: Props) {
+  const environmentId = useEnvironmentId();
+  const serviceAccountsQuery = useGetAllServiceAccountsQuery(environmentId);
+  const allServiceAccounts = serviceAccountsQuery.data ?? [];
+
+  const secretsBoundToDefaultSA = useSecretsLinkedToDefaultSA(namespace);
+  const isSecretLinkedToDefaultSA =
+    secretsBoundToDefaultSA.data?.includes(secretName);
+  const isLoading =
+    secretsBoundToDefaultSA.isLoading || serviceAccountsQuery.isLoading;
+
+  const namespaceSAs: ServiceAccount[] = allServiceAccounts.filter(
+    (sa) => sa.namespace === namespace
+  );
+
+  return (
+    <DetailsRow
+      label={
+        <span className="flex items-center">
+          Linked service accounts
+          <Tooltip message="Service accounts that use this secret as an image pull secret." />
+        </span>
+      }
+    >
+      {isLoading ? (
+        <InlineLoader>Loading service accounts...</InlineLoader>
+      ) : (
+        <LinkedServiceAccountsContent
+          secretName={secretName}
+          namespace={namespace}
+          isSystem={isSystem}
+          namespaceSAs={namespaceSAs}
+          isSecretLinkedToDefaultSA={isSecretLinkedToDefaultSA}
+        />
+      )}
+    </DetailsRow>
+  );
+}
+
+type LinkedServiceAccountsContentProps = {
+  secretName: string;
+  namespace: string;
+  isSystem: boolean;
+  namespaceSAs: ServiceAccount[];
+  isSecretLinkedToDefaultSA?: boolean;
+};
+
+function LinkedServiceAccountsContent({
+  secretName,
+  namespace,
+  isSystem,
+  namespaceSAs,
+  isSecretLinkedToDefaultSA,
+}: LinkedServiceAccountsContentProps) {
+  const environmentId = useEnvironmentId();
+  const { authorized: canEdit } = useAuthorizations('K8sServiceAccountsW');
+  const { authorized: canUpdateRegistryAccess } = useAuthorizations(
+    'PortainerRegistryUpdateAccess'
+  );
+  const linkedSAsMutation =
+    useUpdateLinkedServiceAccountsMutation(environmentId);
+  const [isEditing, setIsEditing] = useState(false);
+  const [selectedSANames, setSelectedSANames] = useState<string[]>([]);
+
+  const linkedNames = namespaceSAs
+    .filter((sa) => sa.imagePullSecrets?.some((s) => s.name === secretName))
+    .map((sa) => sa.name);
+  const protectedSANames =
+    isSecretLinkedToDefaultSA && linkedNames.includes('default')
+      ? ['default']
+      : [];
+  const registryDisabledMessage = canUpdateRegistryAccess
+    ? registryAccessAdminMessage
+    : registryAccessUserMessage;
+  const saOptions: DisabledOption<string>[] = namespaceSAs.map((sa) => {
+    const isProtected = isSecretLinkedToDefaultSA && sa.name === 'default';
+    return {
+      value: sa.name,
+      label: sa.name,
+      disabled: isProtected,
+      disabledMessage: isProtected ? registryDisabledMessage : undefined,
+    };
+  });
+  const visible = linkedNames.slice(0, MAX_VISIBLE_SERVICE_ACCOUNTS);
+  const hidden = linkedNames.slice(MAX_VISIBLE_SERVICE_ACCOUNTS);
+
+  return isEditing ? (
+    <div className="flex flex-wrap items-center gap-2">
+      <MultiSelect<string>
+        value={selectedSANames}
+        options={saOptions}
+        onChange={(names) =>
+          setSelectedSANames(preserveProtectedValues(names, protectedSANames))
+        }
+        placeholder="Select service accounts..."
+        disabled={linkedSAsMutation.isLoading}
+        data-cy="k8sSecretDetail-linkedSAs-select"
+        components={{
+          MultiValue: DisabledMultiValue,
+          MultiValueRemove: DisabledMultiValueRemove,
+        }}
+      />
+      <div className="inline-flex gap-2">
+        <LoadingButton
+          size="small"
+          isLoading={linkedSAsMutation.isLoading}
+          loadingText="Saving..."
+          onClick={handleSave}
+          data-cy="k8sSecretDetail-linkedSAs-save"
+          // match the height of the portainer-select component
+          className="h-[34px]"
+        >
+          Save
+        </LoadingButton>
+        <Button
+          size="small"
+          color="default"
+          disabled={linkedSAsMutation.isLoading}
+          onClick={() => setIsEditing(false)}
+          data-cy="k8sSecretDetail-linkedSAs-cancel"
+          // match the height of the portainer-select component
+          className="h-[34px]"
+        >
+          Cancel
+        </Button>
+      </div>
+    </div>
+  ) : (
+    <div className="flex items-center gap-2">
+      {visible.length > 0 ? (
+        <div className="flex h-fit flex-wrap gap-2">
+          {visible.map((saName) => (
+            <Badge key={saName} type="info" className="min-w-max">
+              <Link
+                to="kubernetes.moreResources.serviceAccounts.serviceAccount"
+                params={{ namespace, name: saName }}
+                data-cy={`linked-service-account-link-${saName}`}
+                className="!text-inherit"
+              >
+                {saName}
+              </Link>
+            </Badge>
+          ))}
+          {hidden.length > 0 && (
+            <Badge type="muted" className="min-w-max cursor-default">
+              + {hidden.length} more
+            </Badge>
+          )}
+        </div>
+      ) : (
+        <span className="text-muted">
+          No service accounts linked. Without a link, pods must specify this
+          secret manually. Link to a{' '}
+          <Link
+            to="kubernetes.moreResources.serviceAccounts"
+            data-cy="service-account-link"
+          >
+            service account
+          </Link>{' '}
+          so pods using it can pull images automatically - or link to the{' '}
+          <code>default</code> service account to cover all pods in this
+          namespace that don&apos;t specify one.
+        </span>
+      )}
+      {canEdit && !isSystem && (
+        <div>
+          <Button
+            color="light"
+            size="small"
+            icon={PencilIcon}
+            onClick={() => {
+              setSelectedSANames(linkedNames);
+              setIsEditing(true);
+            }}
+            data-cy="k8sSecretDetail-linkedSAs-edit"
+            // match the height of the portainer-select component
+            className="h-[34px]"
+          >
+            Edit
+          </Button>
+        </div>
+      )}
+    </div>
+  );
+
+  function handleSave() {
+    const previousSet = new Set(linkedNames);
+    const nextSet = new Set(selectedSANames);
+
+    const toAdd = selectedSANames.filter((n) => !previousSet.has(n));
+    const toRemove = linkedNames.filter((n) => !nextSet.has(n));
+
+    const updates: Array<SAImagePullSecretsUpdate | undefined> = [
+      ...toAdd,
+      ...toRemove,
+    ].map((saName) => {
+      const sa = namespaceSAs.find((s) => s.name === saName);
+      if (!sa) {
+        return undefined;
+      }
+      const currentSecrets = sa.imagePullSecrets?.map((s) => s.name) ?? [];
+      const newSecrets = toAdd.includes(saName)
+        ? [...new Set([...currentSecrets, secretName])]
+        : currentSecrets.filter((s) => s !== secretName);
+      return { saName, namespace, newSecrets };
+    });
+
+    linkedSAsMutation.mutate(compact(updates), {
+      onSuccess: ({ rejectedItems }) => {
+        if (rejectedItems.length === 0) {
+          setIsEditing(false);
+        }
+      },
+    });
+  }
+}
diff --git a/app/react/kubernetes/configs/secrets/ItemView/SecretDetailsTable.test.tsx b/app/react/kubernetes/configs/secrets/ItemView/SecretDetailsTable.test.tsx
new file mode 100644
index 0000000..6ab2e37
--- /dev/null
+++ b/app/react/kubernetes/configs/secrets/ItemView/SecretDetailsTable.test.tsx
@@ -0,0 +1,75 @@
+import { render, screen } from '@testing-library/react';
+import { ReactNode } from 'react';
+import { vi } from 'vitest';
+
+import { SecretDetailsTable } from './SecretDetailsTable';
+
+vi.mock('@/react/hooks/useEnvironmentId', () => ({
+  useEnvironmentId: () => 1,
+}));
+
+vi.mock('@/react/hooks/useUser', () => ({
+  useAuthorizations: () => ({ authorized: false }),
+}));
+
+vi.mock(
+  '@/react/kubernetes/more-resources/ServiceAccountsView/ServiceAccountsDatatable/queries/useGetAllServiceAccountsQuery',
+  () => ({
+    useGetAllServiceAccountsQuery: () => ({ data: [] }),
+  })
+);
+
+vi.mock(
+  '@/react/kubernetes/configs/secrets/queries/useUpdateLinkedServiceAccountsMutation',
+  () => ({
+    useUpdateLinkedServiceAccountsMutation: () => ({
+      isLoading: false,
+      mutate: vi.fn(),
+    }),
+  })
+);
+
+vi.mock(
+  '@/react/kubernetes/configs/secrets/queries/useSecretsLinkedToDefaultSA',
+  () => ({
+    useSecretsLinkedToDefaultSA: () => ({ data: [], isLoading: false }),
+  })
+);
+
+vi.mock('@@/Link', () => ({
+  Link: ({ children }: { children: ReactNode }) => <span>{children}</span>,
+}));
+
+describe('SecretDetailsTable', () => {
+  it('shows linked service accounts for docker config secrets', () => {
+    render(
+      <SecretDetailsTable
+        name="registry-creds"
+        namespace="default"
+        secretTypeLabel="Dockerconfigjson"
+        isSystem={false}
+      />
+    );
+
+    expect(screen.getByText('Linked service accounts')).toBeVisible();
+    expect(screen.getByText(/No service accounts linked\./)).toBeVisible();
+  });
+
+  it('hides linked service accounts for non-image-pull secret types', () => {
+    render(
+      <SecretDetailsTable
+        name="app-secret"
+        namespace="default"
+        secretTypeLabel="Opaque"
+        isSystem={false}
+      />
+    );
+
+    expect(
+      screen.queryByText('Linked service accounts')
+    ).not.toBeInTheDocument();
+    expect(
+      screen.queryByText(/No service accounts linked\./)
+    ).not.toBeInTheDocument();
+  });
+});
diff --git a/app/react/kubernetes/configs/secrets/ItemView/SecretDetailsTable.tsx b/app/react/kubernetes/configs/secrets/ItemView/SecretDetailsTable.tsx
new file mode 100644
index 0000000..17de126
--- /dev/null
+++ b/app/react/kubernetes/configs/secrets/ItemView/SecretDetailsTable.tsx
@@ -0,0 +1,86 @@
+import { KubernetesSecretTypeOptions } from '@/kubernetes/models/configuration/models';
+
+import { SystemBadge } from '@@/Badge/SystemBadge';
+import { DetailsRow } from '@@/DetailsTable/DetailsRow';
+import { DetailsTable } from '@@/DetailsTable/DetailsTable';
+import { Link } from '@@/Link';
+import { Tooltip } from '@@/Tip/Tooltip';
+
+import { RegistryBadge } from '../RegistryBadge';
+
+import { LinkedServiceAccountsRow } from './LinkedServiceAccountsRow';
+
+type Props = {
+  name: string;
+  namespace: string;
+  secretTypeLabel: string;
+  // Passed from Angular as ctrl.isSystemNamespace() — true when the namespace is a system namespace
+  isSystem: boolean;
+  // Angular passes annotation values as strings; accept both and parse internally
+  registryId?: number | string;
+};
+
+export function SecretDetailsTable({
+  name,
+  namespace,
+  secretTypeLabel,
+  isSystem,
+  registryId,
+}: Props) {
+  const parsedRegistryId =
+    registryId !== undefined && registryId !== ''
+      ? parseInt(String(registryId), 10) || undefined
+      : undefined;
+  const supportsImagePullSecrets = isImagePullSecretSecretType(secretTypeLabel);
+
+  return (
+    <DetailsTable
+      dataCy="k8sConfigDetail-configTable"
+      className="[&_td:first-child]:w-2/5"
+    >
+      <DetailsRow label="Name">
+        {name} {isSystem && <SystemBadge />}
+      </DetailsRow>
+      <DetailsRow label="Namespace">
+        <Link
+          to="kubernetes.resourcePools.resourcePool"
+          params={{ id: namespace }}
+          data-cy={`namespace-link-${namespace}`}
+        >
+          {namespace}
+        </Link>{' '}
+        {isSystem && <SystemBadge />}
+      </DetailsRow>
+      {secretTypeLabel && (
+        <DetailsRow label="Secret Type">{secretTypeLabel}</DetailsRow>
+      )}
+      {parsedRegistryId && (
+        <DetailsRow label="Registry">
+          <RegistryBadge registryId={parsedRegistryId}>
+            <Tooltip message="This registry secret was created by Portainer to allow pulling images. Manually editing this secret is disabled." />
+          </RegistryBadge>
+        </DetailsRow>
+      )}
+      {supportsImagePullSecrets && (
+        <LinkedServiceAccountsRow
+          secretName={name}
+          namespace={namespace}
+          isSystem={isSystem}
+        />
+      )}
+    </DetailsTable>
+  );
+}
+
+const IMAGE_PULL_SECRET_TYPES = new Set(
+  [
+    KubernetesSecretTypeOptions.DOCKERCFG.name,
+    KubernetesSecretTypeOptions.DOCKERCFG.value,
+    KubernetesSecretTypeOptions.DOCKERCONFIGJSON.name,
+    KubernetesSecretTypeOptions.DOCKERCONFIGJSON.value,
+  ].map((type) => type.toLowerCase())
+);
+
+function isImagePullSecretSecretType(secretTypeLabel: string) {
+  return IMAGE_PULL_SECRET_TYPES.has(secretTypeLabel.toLowerCase());
+}
diff --git a/app/react/kubernetes/configs/secrets/ItemView/SecretDetailsWidget.tsx b/app/react/kubernetes/configs/secrets/ItemView/SecretDetailsWidget.tsx
new file mode 100644
index 0000000..7b0ffef
--- /dev/null
+++ b/app/react/kubernetes/configs/secrets/ItemView/SecretDetailsWidget.tsx
@@ -0,0 +1,37 @@
+import { Widget, WidgetBody } from '@@/Widget';
+
+import { SecretDetailsTable } from './SecretDetailsTable';
+
+type Props = {
+  name: string;
+  namespace: string;
+  secretTypeLabel: string;
+  isSystem: boolean;
+  registryId?: number | string;
+};
+
+export function SecretDetailsWidget({
+  name,
+  namespace,
+  secretTypeLabel,
+  isSystem,
+  registryId,
+}: Props) {
+  return (
+    <div className="row">
+      <div className="col-sm-12">
+        <Widget>
+          <WidgetBody>
+            <SecretDetailsTable
+              name={name}
+              namespace={namespace}
+              secretTypeLabel={secretTypeLabel}
+              isSystem={isSystem}
+              registryId={registryId}
+            />
+          </WidgetBody>
+        </Widget>
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/kubernetes/configs/secrets/ItemView/SecretItemTabsWidget.tsx b/app/react/kubernetes/configs/secrets/ItemView/SecretItemTabsWidget.tsx
new file mode 100644
index 0000000..449e378
--- /dev/null
+++ b/app/react/kubernetes/configs/secrets/ItemView/SecretItemTabsWidget.tsx
@@ -0,0 +1,92 @@
+import { AlertTriangle, Code, History, Lock } from 'lucide-react';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useEventWarningsCount } from '@/react/kubernetes/queries/useEvents';
+
+import { Badge } from '@@/Badge';
+import { Icon } from '@@/Icon';
+import { WidgetTabs, useCurrentTabIndex, Tab } from '@@/Widget/WidgetTabs';
+
+import { ResourceEventsDatatable } from '../../../components/EventsDatatable/ResourceEventsDatatable';
+
+import { SecretDetailsWidget } from './SecretDetailsWidget';
+import { SecretYAMLWidget } from './SecretYAMLWidget';
+
+type Props = {
+  name: string;
+  namespace: string;
+  secretTypeLabel: string;
+  isSystem: boolean;
+  registryId?: number | string;
+  resourceId?: string;
+};
+
+export function SecretItemTabsWidget({
+  name,
+  namespace,
+  secretTypeLabel,
+  isSystem,
+  registryId,
+  resourceId,
+}: Props) {
+  const environmentId = useEnvironmentId();
+  const eventWarningCount = useEventWarningsCount(environmentId, {
+    namespace,
+    params: { resourceId },
+  });
+
+  const tabs: Tab[] = [
+    {
+      name: 'Secret',
+      icon: Lock,
+      widget: (
+        <SecretDetailsWidget
+          name={name}
+          namespace={namespace}
+          secretTypeLabel={secretTypeLabel}
+          isSystem={isSystem}
+          registryId={registryId}
+        />
+      ),
+      selectedTabParam: 'secret',
+    },
+    {
+      name: (
+        <div className="flex items-center gap-x-2">
+          Events
+          {eventWarningCount >= 1 && (
+            <Badge type="warnSecondary">
+              <Icon icon={AlertTriangle} className="!mr-1" />
+              {eventWarningCount}
+            </Badge>
+          )}
+        </div>
+      ),
+      icon: History,
+      widget: (
+        <ResourceEventsDatatable
+          namespace={namespace}
+          resourceId={resourceId}
+          storageKey="kubernetes.secret.events"
+          noWidget={false}
+        />
+      ),
+      selectedTabParam: 'events',
+    },
+    {
+      name: 'YAML',
+      icon: Code,
+      widget: <SecretYAMLWidget name={name} namespace={namespace} />,
+      selectedTabParam: 'YAML',
+    },
+  ];
+
+  const currentTabIndex = useCurrentTabIndex(tabs);
+
+  return (
+    <>
+      <WidgetTabs tabs={tabs} currentTabIndex={currentTabIndex} />
+      {tabs[currentTabIndex].widget}
+    </>
+  );
+}
diff --git a/app/react/kubernetes/configs/secrets/ItemView/SecretYAMLWidget.tsx b/app/react/kubernetes/configs/secrets/ItemView/SecretYAMLWidget.tsx
new file mode 100644
index 0000000..b94b200
--- /dev/null
+++ b/app/react/kubernetes/configs/secrets/ItemView/SecretYAMLWidget.tsx
@@ -0,0 +1,38 @@
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+
+import { Widget, WidgetBody } from '@@/Widget';
+
+import { YAMLInspector } from '../../../components/YAMLInspector';
+import { useSecretYAML } from '../queries/useSecretYAML';
+
+type Props = {
+  name: string;
+  namespace: string;
+};
+
+export function SecretYAMLWidget({ name, namespace }: Props) {
+  const environmentId = useEnvironmentId();
+  const {
+    data = '',
+    isLoading,
+    isError,
+  } = useSecretYAML(environmentId, namespace, name);
+
+  return (
+    <div className="row">
+      <div className="col-sm-12">
+        <Widget>
+          <WidgetBody>
+            <YAMLInspector
+              identifier={`secret-${namespace}-${name}`}
+              data={data}
+              isLoading={isLoading}
+              isError={isError}
+              data-cy="k8sConfigDetail-yamlInspector"
+            />
+          </WidgetBody>
+        </Widget>
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/kubernetes/configs/secrets/RegistryBadge.tsx b/app/react/kubernetes/configs/secrets/RegistryBadge.tsx
new file mode 100644
index 0000000..b73ffd2
--- /dev/null
+++ b/app/react/kubernetes/configs/secrets/RegistryBadge.tsx
@@ -0,0 +1,51 @@
+import { useCurrentUser } from '@/react/hooks/useUser';
+import { useRegistry } from '@/react/portainer/registries/queries/useRegistry';
+
+import { Badge } from '@@/Badge';
+import { Link } from '@@/Link';
+import { InlineLoader } from '@@/InlineLoader/InlineLoader';
+import { Tooltip } from '@@/Tip/Tooltip';
+
+type Props = {
+  registryId: number;
+  children?: React.ReactNode;
+  dataCy?: string;
+};
+
+export function RegistryBadge({ registryId, children, dataCy }: Props) {
+  const registryQuery = useRegistry(registryId, false);
+  const { isPureAdmin } = useCurrentUser();
+
+  if (registryQuery.isLoading) {
+    return <InlineLoader>Loading registry...</InlineLoader>;
+  }
+
+  if (registryQuery.isError || !registryQuery.data) {
+    return (
+      <Badge type="warn">
+        Registry not found
+        <Tooltip message="The registry associated with this secret could not be found. It may have been deleted." />
+      </Badge>
+    );
+  }
+
+  const { Name } = registryQuery.data;
+
+  return (
+    <Badge type="muted" data-cy={dataCy}>
+      {isPureAdmin ? (
+        <Link
+          to="portainer.registries.registry"
+          params={{ id: registryId }}
+          className="!text-inherit"
+          data-cy={dataCy ? `${dataCy}-link` : 'registry-badge-link'}
+        >
+          {Name}
+        </Link>
+      ) : (
+        Name
+      )}
+      {children}
+    </Badge>
+  );
+}
diff --git a/app/react/kubernetes/configs/secrets/queries/useSecretYAML.ts b/app/react/kubernetes/configs/secrets/queries/useSecretYAML.ts
new file mode 100644
index 0000000..2cee479
--- /dev/null
+++ b/app/react/kubernetes/configs/secrets/queries/useSecretYAML.ts
@@ -0,0 +1,41 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { queryKeys as environmentQueryKeys } from '@/react/kubernetes/queries/query-keys';
+import axios from '@/portainer/services/axios/axios';
+
+import { parseKubernetesAxiosError } from '../../../axiosError';
+
+export function useSecretYAML(
+  environmentId: EnvironmentId,
+  namespace: string,
+  name: string
+) {
+  return useQuery(
+    [
+      ...environmentQueryKeys.base(environmentId),
+      'secrets',
+      namespace,
+      name,
+      'yaml',
+    ],
+    () => getSecretYAML(environmentId, namespace, name),
+    { enabled: !!namespace && !!name }
+  );
+}
+
+async function getSecretYAML(
+  environmentId: EnvironmentId,
+  namespace: string,
+  name: string
+) {
+  try {
+    const { data } = await axios.get<string>(
+      `/endpoints/${environmentId}/kubernetes/api/v1/namespaces/${namespace}/secrets/${name}`,
+      { headers: { Accept: 'application/yaml' } }
+    );
+    return data;
+  } catch (e) {
+    throw parseKubernetesAxiosError(e, 'Unable to retrieve secret YAML');
+  }
+}
diff --git a/app/react/kubernetes/configs/secrets/queries/useSecretsLinkedToDefaultSA.ts b/app/react/kubernetes/configs/secrets/queries/useSecretsLinkedToDefaultSA.ts
new file mode 100644
index 0000000..59b7f49
--- /dev/null
+++ b/app/react/kubernetes/configs/secrets/queries/useSecretsLinkedToDefaultSA.ts
@@ -0,0 +1,25 @@
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useEnvironmentRegistries } from '@/react/portainer/environments/queries/useEnvironmentRegistries';
+import { Registry } from '@/react/portainer/registries/types/registry';
+
+/** get all secrets linked to the default service account in the namespace using the registry access settings */
+export function useSecretsLinkedToDefaultSA(namespace: string) {
+  const environmentId = useEnvironmentId();
+  return useEnvironmentRegistries(environmentId, {
+    select: (registries) =>
+      filterRegistrySecretNamesForNamespace(registries, namespace),
+  });
+
+  function filterRegistrySecretNamesForNamespace(
+    registries: Registry[],
+    namespace: string
+  ) {
+    return registries
+      .filter((registry) =>
+        registry.RegistryAccesses?.[environmentId]?.Namespaces?.includes(
+          namespace
+        )
+      )
+      .map((registry) => `registry-${registry.Id}`);
+  }
+}
diff --git a/app/react/kubernetes/configs/secrets/queries/useUpdateLinkedServiceAccountsMutation.ts b/app/react/kubernetes/configs/secrets/queries/useUpdateLinkedServiceAccountsMutation.ts
new file mode 100644
index 0000000..a0cccc0
--- /dev/null
+++ b/app/react/kubernetes/configs/secrets/queries/useUpdateLinkedServiceAccountsMutation.ts
@@ -0,0 +1,69 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { getAllSettledItems } from '@/portainer/helpers/promise-utils';
+import { withError } from '@/react-tools/react-query';
+import { notifyError, notifySuccess } from '@/portainer/services/notifications';
+import { pluralize } from '@/portainer/helpers/strings';
+import { queryKeys } from '@/react/kubernetes/more-resources/ServiceAccountsView/queries/query-keys';
+import { secretQueryKeys } from '@/react/kubernetes/configs/queries/query-keys';
+
+export type SAImagePullSecretsUpdate = {
+  saName: string;
+  namespace: string;
+  newSecrets: string[];
+};
+
+export function useUpdateLinkedServiceAccountsMutation(
+  environmentId: EnvironmentId
+) {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: (updates: SAImagePullSecretsUpdate[]) =>
+      updateLinkedServiceAccounts(updates, environmentId),
+    onSuccess: async ({ fulfilledItems, rejectedItems }) => {
+      rejectedItems.forEach(({ item, reason }) => {
+        notifyError(
+          `Failed to update service account '${item.saName}'`,
+          new Error(reason)
+        );
+      });
+      if (fulfilledItems.length) {
+        notifySuccess(
+          `${pluralize(fulfilledItems.length, 'Service account')} updated`,
+          fulfilledItems.map((item) => item.saName).join(', ')
+        );
+      }
+      // use await to wait for refetches before showing the mutation as complete
+      await queryClient.invalidateQueries(queryKeys.base(environmentId));
+      // just trigger the invalidation for secrets without waiting the refetch
+      queryClient.invalidateQueries(
+        secretQueryKeys.secretsForCluster(environmentId)
+      );
+    },
+    ...withError('Unable to update linked service accounts'),
+  });
+}
+
+function updateLinkedServiceAccounts(
+  updates: Array<SAImagePullSecretsUpdate>,
+  environmentId: EnvironmentId
+) {
+  return getAllSettledItems(updates, updateServiceAccount);
+
+  async function updateServiceAccount({
+    saName,
+    namespace,
+    newSecrets,
+  }: SAImagePullSecretsUpdate) {
+    try {
+      await axios.put(
+        `kubernetes/${environmentId}/namespaces/${namespace}/service_accounts/${saName}/image_pull_secrets`,
+        { secretNames: newSecrets }
+      );
+    } catch (e) {
+      throw parseAxiosError(e, 'Unable to update service account');
+    }
+  }
+}
diff --git a/app/react/kubernetes/configs/secrets/summary-utils.ts b/app/react/kubernetes/configs/secrets/summary-utils.ts
new file mode 100644
index 0000000..ec1eeb2
--- /dev/null
+++ b/app/react/kubernetes/configs/secrets/summary-utils.ts
@@ -0,0 +1,32 @@
+import { KubernetesResourceAction } from '../../summary/types';
+
+export type SummaryAction = {
+  action: KubernetesResourceAction;
+  kind: string;
+  name: string;
+  type?: string;
+};
+
+/**
+ * Converts configuration form values to summary actions for display
+ */
+export function getConfigurationActions({
+  isCreate,
+  secretName,
+  secretType,
+}: {
+  isCreate: boolean;
+  secretName: string;
+  secretType: string;
+}): SummaryAction[] {
+  const action = isCreate ? 'Create' : 'Update';
+
+  return [
+    {
+      action,
+      kind: 'Secret',
+      name: secretName,
+      type: secretType,
+    },
+  ];
+}
diff --git a/app/react/kubernetes/configs/types.ts b/app/react/kubernetes/configs/types.ts
new file mode 100644
index 0000000..5e3a889
--- /dev/null
+++ b/app/react/kubernetes/configs/types.ts
@@ -0,0 +1,24 @@
+export interface Configuration {
+  UID: string;
+  Name: string;
+  Type: number;
+  Namespace: string;
+  CreationDate?: string;
+
+  ConfigurationOwner: string; // username
+  ConfigurationOwnerId: string; // user id
+
+  IsUsed: boolean;
+  Data?: Record<string, string>;
+  Yaml: string;
+
+  SecretType?: string;
+  IsRegistrySecret?: boolean;
+  IsSecret?: boolean;
+  Annotations?: Record<string, string>;
+  Labels?: Record<string, string>;
+}
+
+// Workaround for the TS error `Type 'ConfigMap' does not satisfy the constraint 'Record<string, unknown>'` for the datatable
+// https://github.com/microsoft/TypeScript/issues/15300#issuecomment-1320480061
+export type IndexOptional<T> = Pick<T, keyof T>;
diff --git a/app/react/kubernetes/dashboard/DashboardView.tsx b/app/react/kubernetes/dashboard/DashboardView.tsx
new file mode 100644
index 0000000..4318df9
--- /dev/null
+++ b/app/react/kubernetes/dashboard/DashboardView.tsx
@@ -0,0 +1,125 @@
+import { Box, Database, FileCode, Layers, Lock, Shuffle } from 'lucide-react';
+import { useQueryClient } from '@tanstack/react-query';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import Route from '@/assets/ico/route.svg?c';
+
+import { DashboardGrid } from '@@/DashboardItem/DashboardGrid';
+import { DashboardItem } from '@@/DashboardItem/DashboardItem';
+import { PageHeader } from '@@/PageHeader';
+
+import { EnvironmentInfo } from './EnvironmentInfo';
+import { useGetApplicationsCountQuery } from './queries/getApplicationsCountQuery';
+import { useGetConfigMapsCountQuery } from './queries/getConfigMapsCountQuery';
+import { useGetIngressesCountQuery } from './queries/getIngressesCountQuery';
+import { useGetSecretsCountQuery } from './queries/getSecretsCountQuery';
+import { useGetServicesCountQuery } from './queries/getServicesCountQuery';
+import { useGetVolumesCountQuery } from './queries/getVolumesCountQuery';
+import { useGetNamespacesCountQuery } from './queries/getNamespacesCountQuery';
+
+export function DashboardView() {
+  const queryClient = useQueryClient();
+  const environmentId = useEnvironmentId();
+
+  const applicationsCountQuery = useGetApplicationsCountQuery(environmentId);
+  const configMapsCountQuery = useGetConfigMapsCountQuery(environmentId);
+  const ingressesCountQuery = useGetIngressesCountQuery(environmentId);
+  const secretsCountQuery = useGetSecretsCountQuery(environmentId);
+  const servicesCountQuery = useGetServicesCountQuery(environmentId);
+  const volumesCountQuery = useGetVolumesCountQuery(environmentId);
+  const namespacesCountQuery = useGetNamespacesCountQuery(environmentId);
+
+  const dashboard = {
+    applicationsCount: applicationsCountQuery.data,
+    configMapsCount: configMapsCountQuery.data,
+    ingressesCount: ingressesCountQuery.data,
+    secretsCount: secretsCountQuery.data,
+    servicesCount: servicesCountQuery.data,
+    volumesCount: volumesCountQuery.data,
+    namespacesCount: namespacesCountQuery.data,
+  };
+
+  return (
+    <>
+      <PageHeader
+        title="Dashboard"
+        breadcrumbs={[{ label: 'Environment summary' }]}
+        reload
+        onReload={() =>
+          queryClient.invalidateQueries(['environments', environmentId])
+        }
+      />
+      <div className="col-sm-12 flex flex-col gap-y-5">
+        <EnvironmentInfo />
+        <DashboardGrid>
+          <DashboardItem
+            value={dashboard?.namespacesCount}
+            isLoading={namespacesCountQuery.isInitialLoading}
+            isRefetching={namespacesCountQuery.isRefetching}
+            icon={Layers}
+            to="kubernetes.resourcePools"
+            type="Namespace"
+            data-cy="dashboard-namespace"
+          />
+          <DashboardItem
+            value={dashboard?.applicationsCount}
+            isLoading={applicationsCountQuery.isInitialLoading}
+            isRefetching={applicationsCountQuery.isRefetching}
+            icon={Box}
+            to="kubernetes.applications"
+            type="Application"
+            data-cy="dashboard-application"
+          />
+          <DashboardItem
+            value={dashboard?.servicesCount}
+            isLoading={servicesCountQuery.isInitialLoading}
+            isRefetching={servicesCountQuery.isRefetching}
+            icon={Shuffle}
+            to="kubernetes.services"
+            type="Service"
+            data-cy="dashboard-service"
+          />
+          <DashboardItem
+            value={dashboard?.ingressesCount}
+            isLoading={ingressesCountQuery.isInitialLoading}
+            isRefetching={ingressesCountQuery.isRefetching}
+            icon={Route}
+            to="kubernetes.ingresses"
+            type="Ingress"
+            pluralType="Ingresses"
+            data-cy="dashboard-ingress"
+          />
+          <DashboardItem
+            value={dashboard?.configMapsCount}
+            isLoading={configMapsCountQuery.isInitialLoading}
+            isRefetching={configMapsCountQuery.isRefetching}
+            icon={FileCode}
+            to="kubernetes.configurations"
+            params={{ tab: 'configmaps' }}
+            type="ConfigMap"
+            data-cy="dashboard-configmaps"
+          />
+          <DashboardItem
+            value={dashboard?.secretsCount}
+            isLoading={secretsCountQuery.isInitialLoading}
+            isRefetching={secretsCountQuery.isRefetching}
+            icon={Lock}
+            to="kubernetes.configurations"
+            params={{ tab: 'secrets' }}
+            type="Secret"
+            data-cy="dashboard-secrets"
+          />
+          <DashboardItem
+            value={dashboard?.volumesCount}
+            isLoading={volumesCountQuery.isInitialLoading}
+            isRefetching={volumesCountQuery.isRefetching}
+            icon={Database}
+            to="kubernetes.volumes.index"
+            type="Volume"
+            data-cy="dashboard-volume"
+          />
+        </DashboardGrid>
+      </div>
+    </>
+  );
+}
diff --git a/app/react/kubernetes/dashboard/EnvironmentInfo.tsx b/app/react/kubernetes/dashboard/EnvironmentInfo.tsx
new file mode 100644
index 0000000..b750cac
--- /dev/null
+++ b/app/react/kubernetes/dashboard/EnvironmentInfo.tsx
@@ -0,0 +1,50 @@
+import { Gauge } from 'lucide-react';
+
+import { stripProtocol } from '@/react/common/string-utils';
+import { useTagsForEnvironment } from '@/portainer/tags/queries';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useEnvironment } from '@/react/portainer/environments/queries';
+
+import { Widget, WidgetTitle, WidgetBody } from '@@/Widget';
+
+export function EnvironmentInfo() {
+  const environmentId = useEnvironmentId();
+  const { data: environmentData, ...environmentQuery } =
+    useEnvironment(environmentId);
+  const tagsQuery = useTagsForEnvironment(environmentId);
+  const tagNames = tagsQuery.tags?.map((tag) => tag.Name).join(', ') || '-';
+
+  return (
+    <Widget>
+      <WidgetTitle icon={Gauge} title="Environment info" />
+      <WidgetBody loading={environmentQuery.isLoading}>
+        {environmentQuery.isError && <div>Failed to load environment</div>}
+        {environmentData && (
+          <table className="table">
+            <tbody>
+              <tr>
+                <td className="!border-none">Environment</td>
+                <td
+                  className="!border-none"
+                  data-cy="dashboard-environmentName"
+                >
+                  {environmentData.Name}
+                </td>
+              </tr>
+              <tr>
+                <td className="!border-t">URL</td>
+                <td className="!border-t" data-cy="dashboard-environmenturl">
+                  {stripProtocol(environmentData.URL) || '-'}
+                </td>
+              </tr>
+              <tr>
+                <td>Tags</td>
+                <td data-cy="dashboard-environmentTags">{tagNames}</td>
+              </tr>
+            </tbody>
+          </table>
+        )}
+      </WidgetBody>
+    </Widget>
+  );
+}
diff --git a/app/react/kubernetes/dashboard/index.ts b/app/react/kubernetes/dashboard/index.ts
new file mode 100644
index 0000000..ea829db
--- /dev/null
+++ b/app/react/kubernetes/dashboard/index.ts
@@ -0,0 +1 @@
+export { DashboardView } from './DashboardView';
diff --git a/app/react/kubernetes/dashboard/queries/getApplicationsCountQuery.ts b/app/react/kubernetes/dashboard/queries/getApplicationsCountQuery.ts
new file mode 100644
index 0000000..b684893
--- /dev/null
+++ b/app/react/kubernetes/dashboard/queries/getApplicationsCountQuery.ts
@@ -0,0 +1,41 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { withError } from '@/react-tools/react-query';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+const queryKeys = {
+  list: (environmentId: EnvironmentId) =>
+    ['environments', environmentId, 'dashboard', 'applicationsCount'] as const,
+};
+
+export function useGetApplicationsCountQuery(
+  environmentId: EnvironmentId,
+  options?: { autoRefreshRate?: number }
+) {
+  return useQuery(
+    queryKeys.list(environmentId),
+    async () => getApplicationsCount(environmentId),
+    {
+      ...withError('Unable to get applications count'),
+      refetchInterval() {
+        return options?.autoRefreshRate ?? false;
+      },
+    }
+  );
+}
+
+async function getApplicationsCount(environmentId: EnvironmentId) {
+  try {
+    const { data: applicationsCount } = await axios.get<number>(
+      `kubernetes/${environmentId}/applications/count`
+    );
+
+    return applicationsCount;
+  } catch (e) {
+    throw parseAxiosError(
+      e,
+      'Unable to get dashboard stats. Some counts may be inaccurate.'
+    );
+  }
+}
diff --git a/app/react/kubernetes/dashboard/queries/getConfigMapsCountQuery.ts b/app/react/kubernetes/dashboard/queries/getConfigMapsCountQuery.ts
new file mode 100644
index 0000000..b8b302f
--- /dev/null
+++ b/app/react/kubernetes/dashboard/queries/getConfigMapsCountQuery.ts
@@ -0,0 +1,41 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { withError } from '@/react-tools/react-query';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+const queryKeys = {
+  list: (environmentId: EnvironmentId) =>
+    ['environments', environmentId, 'dashboard', 'configMapsCount'] as const,
+};
+
+export function useGetConfigMapsCountQuery(
+  environmentId: EnvironmentId,
+  options?: { autoRefreshRate?: number }
+) {
+  return useQuery(
+    queryKeys.list(environmentId),
+    async () => getConfigMapsCount(environmentId),
+    {
+      ...withError('Unable to get applications count'),
+      refetchInterval() {
+        return options?.autoRefreshRate ?? false;
+      },
+    }
+  );
+}
+
+async function getConfigMapsCount(environmentId: EnvironmentId) {
+  try {
+    const { data: configMapsCount } = await axios.get<number>(
+      `kubernetes/${environmentId}/configmaps/count`
+    );
+
+    return configMapsCount;
+  } catch (e) {
+    throw parseAxiosError(
+      e,
+      'Unable to get dashboard stats. Some counts may be inaccurate.'
+    );
+  }
+}
diff --git a/app/react/kubernetes/dashboard/queries/getIngressesCountQuery.ts b/app/react/kubernetes/dashboard/queries/getIngressesCountQuery.ts
new file mode 100644
index 0000000..ee754b9
--- /dev/null
+++ b/app/react/kubernetes/dashboard/queries/getIngressesCountQuery.ts
@@ -0,0 +1,41 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { withError } from '@/react-tools/react-query';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+const queryKeys = {
+  list: (environmentId: EnvironmentId) =>
+    ['environments', environmentId, 'dashboard', 'ingressesCount'] as const,
+};
+
+export function useGetIngressesCountQuery(
+  environmentId: EnvironmentId,
+  options?: { autoRefreshRate?: number }
+) {
+  return useQuery(
+    queryKeys.list(environmentId),
+    async () => getIngressesCount(environmentId),
+    {
+      ...withError('Unable to get ingresses count'),
+      refetchInterval() {
+        return options?.autoRefreshRate ?? false;
+      },
+    }
+  );
+}
+
+async function getIngressesCount(environmentId: EnvironmentId) {
+  try {
+    const { data: ingressesCount } = await axios.get<number>(
+      `kubernetes/${environmentId}/ingresses/count`
+    );
+
+    return ingressesCount;
+  } catch (e) {
+    throw parseAxiosError(
+      e,
+      'Unable to get dashboard stats. Some counts may be inaccurate.'
+    );
+  }
+}
diff --git a/app/react/kubernetes/dashboard/queries/getNamespacesCountQuery.ts b/app/react/kubernetes/dashboard/queries/getNamespacesCountQuery.ts
new file mode 100644
index 0000000..e24307b
--- /dev/null
+++ b/app/react/kubernetes/dashboard/queries/getNamespacesCountQuery.ts
@@ -0,0 +1,41 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { withError } from '@/react-tools/react-query';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+const queryKeys = {
+  list: (environmentId: EnvironmentId) =>
+    ['environments', environmentId, 'dashboard', 'namespacesCount'] as const,
+};
+
+export function useGetNamespacesCountQuery(
+  environmentId: EnvironmentId,
+  options?: { autoRefreshRate?: number }
+) {
+  return useQuery(
+    queryKeys.list(environmentId),
+    async () => getNamespacesCount(environmentId),
+    {
+      ...withError('Unable to get namespaces count'),
+      refetchInterval() {
+        return options?.autoRefreshRate ?? false;
+      },
+    }
+  );
+}
+
+async function getNamespacesCount(environmentId: EnvironmentId) {
+  try {
+    const { data: namespacesCount } = await axios.get<number>(
+      `kubernetes/${environmentId}/namespaces/count`
+    );
+
+    return namespacesCount;
+  } catch (e) {
+    throw parseAxiosError(
+      e,
+      'Unable to get dashboard stats. Some counts may be inaccurate.'
+    );
+  }
+}
diff --git a/app/react/kubernetes/dashboard/queries/getSecretsCountQuery.ts b/app/react/kubernetes/dashboard/queries/getSecretsCountQuery.ts
new file mode 100644
index 0000000..2d2c570
--- /dev/null
+++ b/app/react/kubernetes/dashboard/queries/getSecretsCountQuery.ts
@@ -0,0 +1,41 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { withError } from '@/react-tools/react-query';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+const queryKeys = {
+  list: (environmentId: EnvironmentId) =>
+    ['environments', environmentId, 'dashboard', 'secretsCount'] as const,
+};
+
+export function useGetSecretsCountQuery(
+  environmentId: EnvironmentId,
+  options?: { autoRefreshRate?: number }
+) {
+  return useQuery(
+    queryKeys.list(environmentId),
+    async () => getSecretsCount(environmentId),
+    {
+      ...withError('Unable to get secrets count'),
+      refetchInterval() {
+        return options?.autoRefreshRate ?? false;
+      },
+    }
+  );
+}
+
+async function getSecretsCount(environmentId: EnvironmentId) {
+  try {
+    const { data: secretsCount } = await axios.get<number>(
+      `kubernetes/${environmentId}/secrets/count`
+    );
+
+    return secretsCount;
+  } catch (e) {
+    throw parseAxiosError(
+      e,
+      'Unable to get dashboard stats. Some counts may be inaccurate.'
+    );
+  }
+}
diff --git a/app/react/kubernetes/dashboard/queries/getServicesCountQuery.ts b/app/react/kubernetes/dashboard/queries/getServicesCountQuery.ts
new file mode 100644
index 0000000..9a88c60
--- /dev/null
+++ b/app/react/kubernetes/dashboard/queries/getServicesCountQuery.ts
@@ -0,0 +1,41 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { withError } from '@/react-tools/react-query';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+const queryKeys = {
+  list: (environmentId: EnvironmentId) =>
+    ['environments', environmentId, 'dashboard', 'servicesCount'] as const,
+};
+
+export function useGetServicesCountQuery(
+  environmentId: EnvironmentId,
+  options?: { autoRefreshRate?: number }
+) {
+  return useQuery(
+    queryKeys.list(environmentId),
+    async () => getServicesCount(environmentId),
+    {
+      ...withError('Unable to get services count'),
+      refetchInterval() {
+        return options?.autoRefreshRate ?? false;
+      },
+    }
+  );
+}
+
+async function getServicesCount(environmentId: EnvironmentId) {
+  try {
+    const { data: servicesCount } = await axios.get<number>(
+      `kubernetes/${environmentId}/services/count`
+    );
+
+    return servicesCount;
+  } catch (e) {
+    throw parseAxiosError(
+      e,
+      'Unable to get dashboard stats. Some counts may be inaccurate.'
+    );
+  }
+}
diff --git a/app/react/kubernetes/dashboard/queries/getVolumesCountQuery.ts b/app/react/kubernetes/dashboard/queries/getVolumesCountQuery.ts
new file mode 100644
index 0000000..0ac349d
--- /dev/null
+++ b/app/react/kubernetes/dashboard/queries/getVolumesCountQuery.ts
@@ -0,0 +1,41 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { withError } from '@/react-tools/react-query';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+const queryKeys = {
+  list: (environmentId: EnvironmentId) =>
+    ['environments', environmentId, 'dashboard', 'volumesCount'] as const,
+};
+
+export function useGetVolumesCountQuery(
+  environmentId: EnvironmentId,
+  options?: { autoRefreshRate?: number }
+) {
+  return useQuery(
+    queryKeys.list(environmentId),
+    async () => getVolumesCount(environmentId),
+    {
+      ...withError('Unable to get volumes count'),
+      refetchInterval() {
+        return options?.autoRefreshRate ?? false;
+      },
+    }
+  );
+}
+
+async function getVolumesCount(environmentId: EnvironmentId) {
+  try {
+    const { data: volumesCount } = await axios.get<number>(
+      `kubernetes/${environmentId}/volumes/count`
+    );
+
+    return volumesCount;
+  } catch (e) {
+    throw parseAxiosError(
+      e,
+      'Unable to get dashboard stats. Some counts may be inaccurate.'
+    );
+  }
+}
diff --git a/app/react/kubernetes/dashboard/types.ts b/app/react/kubernetes/dashboard/types.ts
new file mode 100644
index 0000000..165b2bd
--- /dev/null
+++ b/app/react/kubernetes/dashboard/types.ts
@@ -0,0 +1,9 @@
+export type K8sDashboard = {
+  namespacesCount: number;
+  applicationsCount: number;
+  servicesCount: number;
+  ingressesCount: number;
+  configMapsCount: number;
+  secretsCount: number;
+  volumesCount: number;
+};
diff --git a/app/react/kubernetes/datatables/DefaultDatatableSettings.tsx b/app/react/kubernetes/datatables/DefaultDatatableSettings.tsx
new file mode 100644
index 0000000..4564452
--- /dev/null
+++ b/app/react/kubernetes/datatables/DefaultDatatableSettings.tsx
@@ -0,0 +1,42 @@
+import { TableSettingsMenuAutoRefresh } from '@@/datatables/TableSettingsMenuAutoRefresh';
+import {
+  BasicTableSettings,
+  RefreshableTableSettings,
+} from '@@/datatables/types';
+
+import {
+  SystemResourcesSettings,
+  SystemResourcesTableSettings,
+} from './SystemResourcesSettings';
+
+export interface TableSettings
+  extends
+    BasicTableSettings,
+    RefreshableTableSettings,
+    SystemResourcesTableSettings {}
+
+export function DefaultDatatableSettings({
+  settings,
+}: {
+  settings: TableSettings;
+}) {
+  return (
+    <>
+      <SystemResourcesSettings
+        value={settings.showSystemResources}
+        onChange={(value) => {
+          settings.setShowSystemResources(value);
+        }}
+      />
+
+      <TableSettingsMenuAutoRefresh
+        value={settings.autoRefreshRate}
+        onChange={handleRefreshRateChange}
+      />
+    </>
+  );
+
+  function handleRefreshRateChange(autoRefreshRate: number) {
+    settings.setAutoRefreshRate(autoRefreshRate);
+  }
+}
diff --git a/app/react/kubernetes/datatables/SystemResourceDescription.tsx b/app/react/kubernetes/datatables/SystemResourceDescription.tsx
new file mode 100644
index 0000000..3aae630
--- /dev/null
+++ b/app/react/kubernetes/datatables/SystemResourceDescription.tsx
@@ -0,0 +1,17 @@
+import { Authorized } from '@/react/hooks/useUser';
+
+import { TextTip } from '@@/Tip/TextTip';
+
+interface Props {
+  showSystemResources?: boolean;
+}
+
+export function SystemResourceDescription({ showSystemResources }: Props) {
+  return showSystemResources === false ? (
+    <Authorized authorizations="K8sAccessSystemNamespaces" adminOnlyCE>
+      <TextTip color="blue" className="!mb-0">
+        System resources are hidden, this can be changed in the table settings
+      </TextTip>
+    </Authorized>
+  ) : null;
+}
diff --git a/app/react/kubernetes/datatables/SystemResourcesSettings.tsx b/app/react/kubernetes/datatables/SystemResourcesSettings.tsx
new file mode 100644
index 0000000..ada6e19
--- /dev/null
+++ b/app/react/kubernetes/datatables/SystemResourcesSettings.tsx
@@ -0,0 +1,43 @@
+import { Authorized } from '@/react/hooks/useUser';
+
+import { ZustandSetFunc } from '@@/datatables/types';
+import { Checkbox } from '@@/form-components/Checkbox';
+
+export function SystemResourcesSettings({
+  value,
+  onChange,
+}: {
+  value: boolean;
+  onChange: (value: boolean) => void;
+}) {
+  return (
+    <Authorized authorizations="K8sAccessSystemNamespaces" adminOnlyCE>
+      <Checkbox
+        id="show-system-resources"
+        data-cy="show-system-resources"
+        label="Show system resources"
+        checked={value}
+        onChange={(e) => onChange(e.target.checked)}
+      />
+    </Authorized>
+  );
+}
+
+export interface SystemResourcesTableSettings {
+  showSystemResources: boolean;
+  setShowSystemResources: (value: boolean) => void;
+}
+
+export function systemResourcesSettings<T extends SystemResourcesTableSettings>(
+  set: ZustandSetFunc<T>
+): SystemResourcesTableSettings {
+  return {
+    showSystemResources: false,
+    setShowSystemResources(showSystemResources: boolean) {
+      set((s) => ({
+        ...s,
+        showSystemResources,
+      }));
+    },
+  };
+}
diff --git a/app/react/kubernetes/datatables/default-kube-datatable-store.ts b/app/react/kubernetes/datatables/default-kube-datatable-store.ts
new file mode 100644
index 0000000..59cc123
--- /dev/null
+++ b/app/react/kubernetes/datatables/default-kube-datatable-store.ts
@@ -0,0 +1,36 @@
+import { useState } from 'react';
+
+import {
+  refreshableSettings,
+  createPersistedStore,
+  ZustandSetFunc,
+} from '@@/datatables/types';
+import { useTableState } from '@@/datatables/useTableState';
+
+import { TableSettings } from './DefaultDatatableSettings';
+import { systemResourcesSettings } from './SystemResourcesSettings';
+
+export function createStore<T extends TableSettings>(
+  storageKey: string,
+  initialSortBy?: string | { id: string; desc: boolean },
+  create: (set: ZustandSetFunc<T>) => Omit<T, keyof TableSettings> = () =>
+    ({}) as T
+) {
+  return createPersistedStore<T>(
+    storageKey,
+    initialSortBy,
+    (set) =>
+      ({
+        ...refreshableSettings(set),
+        ...systemResourcesSettings(set),
+        ...create(set),
+      }) as T
+  );
+}
+
+export function useKubeStore<T extends TableSettings>(
+  ...args: Parameters<typeof createStore<T>>
+) {
+  const [store] = useState(() => createStore(...args));
+  return useTableState(store, args[0]);
+}
diff --git a/app/react/kubernetes/helm/HelmApplicationView/ChartActions/ChartActions.tsx b/app/react/kubernetes/helm/HelmApplicationView/ChartActions/ChartActions.tsx
new file mode 100644
index 0000000..3161dd8
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmApplicationView/ChartActions/ChartActions.tsx
@@ -0,0 +1,58 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { HelmRelease } from '../../types';
+
+import { RollbackButton } from './RollbackButton';
+import { UninstallButton } from './UninstallButton';
+import { UpgradeButton } from './UpgradeButton';
+
+type Props = {
+  environmentId: EnvironmentId;
+  releaseName: string;
+  namespace: string;
+  latestRevision?: number;
+  earlistRevision?: number;
+  selectedRevision?: number;
+  release?: HelmRelease;
+  updateRelease: (release: HelmRelease) => void;
+};
+
+export function ChartActions({
+  environmentId,
+  releaseName,
+  namespace,
+  latestRevision,
+  earlistRevision,
+  selectedRevision,
+  release,
+  updateRelease,
+}: Props) {
+  const showRollbackButton =
+    latestRevision && earlistRevision && latestRevision > earlistRevision;
+
+  return (
+    <div className="inline-flex flex-wrap gap-2">
+      <UpgradeButton
+        environmentId={environmentId}
+        releaseName={releaseName}
+        namespace={namespace}
+        release={release}
+        updateRelease={updateRelease}
+      />
+      {showRollbackButton && (
+        <RollbackButton
+          latestRevision={latestRevision}
+          selectedRevision={selectedRevision}
+          environmentId={environmentId}
+          releaseName={releaseName}
+          namespace={namespace}
+        />
+      )}
+      <UninstallButton
+        environmentId={environmentId}
+        releaseName={releaseName}
+        namespace={namespace}
+      />
+    </div>
+  );
+}
diff --git a/app/react/kubernetes/helm/HelmApplicationView/ChartActions/RollbackButton.test.tsx b/app/react/kubernetes/helm/HelmApplicationView/ChartActions/RollbackButton.test.tsx
new file mode 100644
index 0000000..e7bd95b
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmApplicationView/ChartActions/RollbackButton.test.tsx
@@ -0,0 +1,169 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { HttpResponse, http } from 'msw';
+import { vi, type Mock } from 'vitest';
+
+import { server } from '@/setup-tests/server';
+import { notifySuccess } from '@/portainer/services/notifications';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+
+import { confirm } from '@@/modals/confirm';
+
+import { RollbackButton } from './RollbackButton';
+
+// Mock the confirm modal function
+vi.mock('@@/modals/confirm', () => ({
+  confirm: vi.fn(() => Promise.resolve(false)),
+  buildConfirmButton: vi.fn((label) => ({ label })),
+}));
+
+// Mock the notifications service
+vi.mock('@/portainer/services/notifications', () => ({
+  notifySuccess: vi.fn(),
+}));
+
+function renderButton(props = {}) {
+  const defaultProps = {
+    latestRevision: 3, // So we're rolling back to revision 2
+    selectedRevision: 3, // This simulates the selectedRevision from URL params
+    environmentId: 1,
+    releaseName: 'test-release',
+    namespace: 'default',
+    ...props,
+  };
+
+  const Wrapped = withTestQueryProvider(
+    withTestRouter(RollbackButton, {
+      route: '/?revision=3',
+    })
+  );
+  return render(<Wrapped {...defaultProps} />);
+}
+
+describe('RollbackButton', () => {
+  test('should display the revision to rollback to', () => {
+    renderButton();
+
+    const button = screen.getByRole('button', { name: /Rollback to #2/i });
+    expect(button).toBeInTheDocument();
+  });
+
+  test('should be disabled when the rollback mutation is loading', async () => {
+    const resolveRequest = vi.fn();
+    const requestPromise = new Promise<void>((resolve) => {
+      resolveRequest.mockImplementation(() => resolve());
+    });
+
+    server.use(
+      http.post(
+        '/api/endpoints/1/kubernetes/helm/test-release/rollback',
+        () =>
+          new Promise((resolve) => {
+            // Keep request pending to simulate loading state
+            requestPromise
+              .then(() => {
+                resolve(HttpResponse.json({}));
+                return null;
+              })
+              .catch(() => {});
+          })
+      )
+    );
+
+    renderButton();
+
+    const user = userEvent.setup();
+    const button = screen.getByRole('button', { name: /Rollback to #2/i });
+
+    (confirm as Mock).mockResolvedValueOnce(true);
+    await user.click(button);
+
+    await waitFor(() => {
+      expect(screen.getByText('Rolling back...')).toBeInTheDocument();
+    });
+
+    resolveRequest();
+  });
+
+  test('should show a confirmation modal before executing the rollback', async () => {
+    renderButton();
+
+    const user = userEvent.setup();
+    const button = screen.getByRole('button', { name: /Rollback to #2/i });
+
+    await user.click(button);
+
+    expect(confirm).toHaveBeenCalledWith(
+      expect.objectContaining({
+        title: 'Are you sure?',
+        message: expect.stringContaining(
+          'Rolling back will restore the application to revision #2'
+        ),
+      })
+    );
+  });
+
+  test('should execute the rollback mutation with correct query params when confirmed', async () => {
+    let requestParams: Record<string, string> = {};
+
+    server.use(
+      http.post(
+        '/api/endpoints/1/kubernetes/helm/test-release/rollback',
+        ({ request }) => {
+          const url = new URL(request.url);
+          requestParams = Object.fromEntries(url.searchParams.entries());
+          return HttpResponse.json({});
+        }
+      )
+    );
+
+    renderButton();
+
+    const user = userEvent.setup();
+    const button = screen.getByRole('button', { name: /Rollback to #2/i });
+
+    (confirm as Mock).mockResolvedValueOnce(true);
+    await user.click(button);
+
+    await waitFor(() => {
+      expect(Object.keys(requestParams).length).toBeGreaterThan(0);
+    });
+
+    expect(requestParams.namespace).toBe('default');
+    expect(requestParams.revision).toBe('2');
+
+    expect(notifySuccess).toHaveBeenCalledWith(
+      'Success',
+      'Application rolled back to revision #2 successfully.'
+    );
+  });
+
+  test('should not execute the rollback if confirmation is cancelled', async () => {
+    let wasRequestMade = false;
+
+    server.use(
+      http.post(
+        '/api/endpoints/1/kubernetes/helm/test-release/rollback',
+        () => {
+          wasRequestMade = true;
+          return HttpResponse.json({});
+        }
+      )
+    );
+
+    renderButton();
+
+    const user = userEvent.setup();
+    const button = screen.getByRole('button', { name: /Rollback to #2/i });
+
+    (confirm as Mock).mockResolvedValueOnce(false);
+    await user.click(button);
+
+    await waitFor(() => {
+      expect(confirm).toHaveBeenCalled();
+    });
+
+    expect(wasRequestMade).toBe(false);
+  });
+});
diff --git a/app/react/kubernetes/helm/HelmApplicationView/ChartActions/RollbackButton.tsx b/app/react/kubernetes/helm/HelmApplicationView/ChartActions/RollbackButton.tsx
new file mode 100644
index 0000000..5fba1b1
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmApplicationView/ChartActions/RollbackButton.tsx
@@ -0,0 +1,82 @@
+import { RotateCcw } from 'lucide-react';
+import { useRouter } from '@uirouter/react';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { LoadingButton } from '@@/buttons';
+import { buildConfirmButton } from '@@/modals/utils';
+import { confirm } from '@@/modals/confirm';
+import { ModalType } from '@@/modals';
+
+import { useHelmRollbackMutation } from '../../helmReleaseQueries/useHelmRollbackMutation';
+
+type Props = {
+  latestRevision: number;
+  selectedRevision?: number;
+  environmentId: EnvironmentId;
+  releaseName: string;
+  namespace?: string;
+};
+
+export function RollbackButton({
+  latestRevision,
+  selectedRevision,
+  environmentId,
+  releaseName,
+  namespace,
+}: Props) {
+  // when the latest revision is selected, rollback to the previous revision
+  // otherwise, rollback to the selected revision
+  const rollbackRevision =
+    selectedRevision === latestRevision ? latestRevision - 1 : selectedRevision;
+  const router = useRouter();
+  const rollbackMutation = useHelmRollbackMutation(environmentId);
+
+  return (
+    <LoadingButton
+      onClick={handleClick}
+      isLoading={rollbackMutation.isLoading}
+      loadingText="Rolling back..."
+      data-cy="rollback-button"
+      icon={RotateCcw}
+      color="default"
+      size="medium"
+    >
+      Rollback to #{rollbackRevision}
+    </LoadingButton>
+  );
+
+  async function handleClick() {
+    const confirmed = await confirm({
+      title: 'Are you sure?',
+      modalType: ModalType.Warn,
+      confirmButton: buildConfirmButton('Rollback'),
+      message: `Rolling back will restore the application to revision #${rollbackRevision}, which could cause service interruption. Do you wish to continue?`,
+    });
+    if (!confirmed) {
+      return;
+    }
+
+    rollbackMutation.mutate(
+      {
+        releaseName,
+        params: { namespace, revision: rollbackRevision },
+      },
+      {
+        onSuccess: () => {
+          notifySuccess(
+            'Success',
+            `Application rolled back to revision #${rollbackRevision} successfully.`
+          );
+          // set the revision url param to undefined to refresh the page at the latest revision
+          router.stateService.go('kubernetes.helm', {
+            namespace,
+            name: releaseName,
+            revision: undefined,
+          });
+        },
+      }
+    );
+  }
+}
diff --git a/app/react/kubernetes/helm/HelmApplicationView/ChartActions/UninstallButton.tsx b/app/react/kubernetes/helm/HelmApplicationView/ChartActions/UninstallButton.tsx
new file mode 100644
index 0000000..1d69453
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmApplicationView/ChartActions/UninstallButton.tsx
@@ -0,0 +1,47 @@
+import { useRouter } from '@uirouter/react';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { DeleteButton } from '@@/buttons/DeleteButton';
+
+import { useUninstallHelmAppMutation } from '../../helmReleaseQueries/useUninstallHelmAppMutation';
+
+export function UninstallButton({
+  environmentId,
+  releaseName,
+  namespace,
+}: {
+  environmentId: EnvironmentId;
+  releaseName: string;
+  namespace?: string;
+}) {
+  const uninstallHelmAppMutation = useUninstallHelmAppMutation(environmentId);
+  const router = useRouter();
+
+  return (
+    <DeleteButton
+      size="medium"
+      data-cy="k8sApp-removeHelmChartButton"
+      isLoading={uninstallHelmAppMutation.isLoading}
+      confirmMessage="Do you want to remove the selected Helm chart? This will delete all resources associated with the Helm chart."
+      onConfirmed={handleUninstall}
+    >
+      Uninstall
+    </DeleteButton>
+  );
+
+  function handleUninstall() {
+    uninstallHelmAppMutation.mutate(
+      { releaseName, namespace },
+      {
+        onSuccess: () => {
+          router.stateService.go('kubernetes.applications', {
+            endpointId: environmentId,
+          });
+          notifySuccess('Success', 'Helm chart uninstalled successfully');
+        },
+      }
+    );
+  }
+}
diff --git a/app/react/kubernetes/helm/HelmApplicationView/ChartActions/UpgradeButton.test.tsx b/app/react/kubernetes/helm/HelmApplicationView/ChartActions/UpgradeButton.test.tsx
new file mode 100644
index 0000000..c5ae166
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmApplicationView/ChartActions/UpgradeButton.test.tsx
@@ -0,0 +1,245 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { vi } from 'vitest';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+
+import {
+  useHelmRepoVersions,
+  ChartVersion,
+} from '../../helmChartSourceQueries/useHelmRepoVersions';
+import { HelmRelease } from '../../types';
+
+import { openUpgradeHelmModal } from './UpgradeHelmModal';
+import { UpgradeButton } from './UpgradeButton';
+
+// Mock the upgrade modal function
+vi.mock('./UpgradeHelmModal', () => ({
+  openUpgradeHelmModal: vi.fn(() => Promise.resolve(undefined)),
+}));
+
+// Mock the notifications service
+vi.mock('@/portainer/services/notifications', () => ({
+  notifySuccess: vi.fn(),
+}));
+
+vi.mock('../../helmChartSourceQueries/useHelmRepositories', async () => {
+  const actual = await vi.importActual(
+    '../../helmChartSourceQueries/useHelmRepositories'
+  );
+  return {
+    ...actual,
+    useUserHelmRepositories: vi.fn(() => ({
+      data: ['repo1', 'repo2'],
+      isInitialLoading: false,
+      isError: false,
+    })),
+  };
+});
+
+vi.mock('../../helmChartSourceQueries/useHelmRepoVersions', async () => {
+  const actual = await vi.importActual(
+    '../../helmChartSourceQueries/useHelmRepoVersions'
+  );
+  return {
+    ...actual,
+    useHelmRepoVersions: vi.fn(),
+  };
+});
+
+// Mock the useHelmRelease hook
+vi.mock('../../helmReleaseQueries/useHelmRelease', async () => {
+  const actual = await vi.importActual(
+    '../../helmReleaseQueries/useHelmRelease'
+  );
+  return {
+    ...actual,
+    useHelmRelease: vi.fn(() => ({
+      data: '1.0.0',
+    })),
+  };
+});
+
+// Mock the useUpdateHelmReleaseMutation hook
+vi.mock('../../helmReleaseQueries/useUpdateHelmReleaseMutation', async () => {
+  const actual = await vi.importActual(
+    '../../helmReleaseQueries/useUpdateHelmReleaseMutation'
+  );
+  return {
+    ...actual,
+    useUpdateHelmReleaseMutation: vi.fn(() => ({
+      mutate: vi.fn(),
+      isLoading: false,
+    })),
+  };
+});
+
+function renderButton(props = {}) {
+  const defaultProps = {
+    environmentId: 1,
+    releaseName: 'test-release',
+    namespace: 'default',
+    release: {
+      name: 'test-release',
+      chart: {
+        metadata: {
+          name: 'test-chart',
+          version: '1.0.0',
+        },
+      },
+      values: {
+        userSuppliedValues: '{}',
+      },
+      manifest: '',
+    } as HelmRelease,
+    updateRelease: vi.fn(),
+    ...props,
+  };
+
+  const Wrapped = withTestQueryProvider(
+    withUserProvider(withTestRouter(UpgradeButton))
+  );
+  return render(<Wrapped {...defaultProps} />);
+}
+
+describe('UpgradeButton', () => {
+  beforeEach(() => {
+    // Set up default mock return values
+    vi.mocked(useHelmRepoVersions).mockReturnValue({
+      data: [
+        { Version: '1.0.0', Repo: 'stable' },
+        { Version: '1.1.0', Repo: 'stable' },
+      ],
+      isInitialLoading: false,
+      isError: false,
+      isFetching: false,
+      refetch: vi.fn(() => Promise.resolve([])),
+    });
+  });
+
+  test('should display the upgrade button', () => {
+    renderButton();
+
+    const button = screen.getByRole('button', { name: /Upgrade/i });
+    expect(button).toBeInTheDocument();
+  });
+
+  test('should be disabled when no versions are available', () => {
+    const data: ChartVersion[] = [];
+    vi.mocked(useHelmRepoVersions).mockReturnValue({
+      data,
+      isInitialLoading: false,
+      isError: false,
+      isFetching: false,
+      refetch: vi.fn(() => Promise.resolve([])),
+    });
+
+    renderButton();
+
+    const button = screen.getByRole('button', { name: /Upgrade/i });
+    expect(button).toBeDisabled();
+  });
+
+  test('should show loading state when checking for versions', () => {
+    vi.mocked(useHelmRepoVersions).mockReturnValue({
+      data: [],
+      isInitialLoading: true,
+      isError: false,
+      isFetching: true,
+      refetch: vi.fn(() => Promise.resolve([])),
+    });
+
+    renderButton();
+
+    expect(
+      screen.getByText('Checking for new versions...')
+    ).toBeInTheDocument();
+  });
+
+  test('should show "No versions available" when no versions are found', () => {
+    const data: ChartVersion[] = [];
+    vi.mocked(useHelmRepoVersions).mockReturnValue({
+      data,
+      isInitialLoading: false,
+      isError: false,
+      isFetching: false,
+      refetch: vi.fn(() => Promise.resolve([])),
+    });
+
+    renderButton();
+
+    expect(screen.getByText(/No versions available/)).toBeInTheDocument();
+  });
+
+  test('should open upgrade modal when clicked', async () => {
+    const user = userEvent.setup();
+    const mockRelease = {
+      name: 'test-release',
+      chart: {
+        metadata: {
+          name: 'test-chart',
+          version: '1.0.0',
+          appVersion: '1.0.0',
+        },
+      },
+      values: {
+        userSuppliedValues: '{}',
+      },
+      manifest: '',
+      namespace: 'default',
+    } as HelmRelease;
+
+    vi.mocked(useHelmRepoVersions).mockReturnValue({
+      data: [
+        { Version: '1.0.0', Repo: 'stable' },
+        { Version: '1.1.0', Repo: 'stable' },
+      ],
+      isInitialLoading: false,
+      isError: false,
+      isFetching: false,
+      refetch: vi.fn(() => Promise.resolve([])),
+    });
+
+    renderButton({ release: mockRelease });
+
+    const button = screen.getByRole('button', { name: /Upgrade/i });
+    await user.click(button);
+
+    await waitFor(() => {
+      expect(openUpgradeHelmModal).toHaveBeenCalledWith(
+        expect.objectContaining({
+          name: 'test-release',
+          chart: 'test-chart',
+          namespace: 'default',
+          values: '{}',
+          version: '1.0.0',
+        }),
+        expect.arrayContaining([
+          { Version: '1.0.0', Repo: 'stable' },
+          { Version: '1.1.0', Repo: 'stable' },
+        ]),
+        '', // releaseManifest
+        1 // environmentId
+      );
+    });
+  });
+
+  test('should not execute the upgrade if modal is cancelled', async () => {
+    const mockUpdateRelease = vi.fn();
+    vi.mocked(openUpgradeHelmModal).mockResolvedValueOnce(undefined);
+
+    const user = userEvent.setup();
+    renderButton({ updateRelease: mockUpdateRelease });
+
+    const button = screen.getByRole('button', { name: /Upgrade/i });
+    await user.click(button);
+
+    await waitFor(() => {
+      expect(openUpgradeHelmModal).toHaveBeenCalled();
+    });
+
+    expect(mockUpdateRelease).not.toHaveBeenCalled();
+  });
+});
diff --git a/app/react/kubernetes/helm/HelmApplicationView/ChartActions/UpgradeButton.tsx b/app/react/kubernetes/helm/HelmApplicationView/ChartActions/UpgradeButton.tsx
new file mode 100644
index 0000000..b62dbe7
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmApplicationView/ChartActions/UpgradeButton.tsx
@@ -0,0 +1,220 @@
+import { ArrowUp } from 'lucide-react';
+import { useRouter } from '@uirouter/react';
+import { useState } from 'react';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { notifySuccess } from '@/portainer/services/notifications';
+import { semverCompare } from '@/react/common/semver-utils';
+
+import { Button, LoadingButton } from '@@/buttons';
+import { InlineLoader } from '@@/InlineLoader';
+import { Tooltip } from '@@/Tip/Tooltip';
+import { Link } from '@@/Link';
+
+import { HelmRelease, UpdateHelmReleasePayload } from '../../types';
+import { useUpdateHelmReleaseMutation } from '../../helmReleaseQueries/useUpdateHelmReleaseMutation';
+import { useHelmRepoVersions } from '../../helmChartSourceQueries/useHelmRepoVersions';
+import { useHelmRelease } from '../../helmReleaseQueries/useHelmRelease';
+import {
+  flattenHelmRegistries,
+  useUserHelmRepositories,
+} from '../../helmChartSourceQueries/useHelmRepositories';
+
+import { openUpgradeHelmModal } from './UpgradeHelmModal';
+
+export function UpgradeButton({
+  environmentId,
+  releaseName,
+  namespace,
+  release,
+  updateRelease,
+}: {
+  environmentId: EnvironmentId;
+  releaseName: string;
+  namespace: string;
+  release?: HelmRelease;
+  updateRelease: (release: HelmRelease) => void;
+}) {
+  const router = useRouter();
+  const [useCache, setUseCache] = useState(true);
+  const updateHelmReleaseMutation = useUpdateHelmReleaseMutation(environmentId);
+
+  const userRepositoriesQuery = useUserHelmRepositories({
+    select: flattenHelmRegistries,
+  });
+  const helmRepoVersionsQuery = useHelmRepoVersions(
+    release?.chart.metadata?.name || '',
+    60 * 60 * 1000, // 1 hour
+    userRepositoriesQuery.data?.map((repo) => ({
+      repo,
+    })),
+    useCache
+  );
+  const versions = helmRepoVersionsQuery.data;
+
+  // Combined loading state
+  const isLoading =
+    userRepositoriesQuery.isInitialLoading || helmRepoVersionsQuery.isFetching; // use 'isFetching' for helmRepoVersionsQuery because we want to show when it's refetching
+  const isError =
+    userRepositoriesQuery.isError || helmRepoVersionsQuery.isError;
+  const latestVersionQuery = useHelmRelease(
+    environmentId,
+    releaseName,
+    namespace,
+    {
+      select: (data) => data.chart.metadata?.version,
+    }
+  );
+  const latestVersionAvailable = versions[0]?.Version ?? '';
+  const isNewVersionAvailable = Boolean(
+    latestVersionQuery?.data &&
+    semverCompare(latestVersionAvailable, latestVersionQuery?.data) === 1
+  );
+
+  const currentRepo = versions?.find(
+    (v) =>
+      v.Repo === release?.chartReference?.repoURL &&
+      v.AppVersion === release?.chart.metadata?.appVersion &&
+      v.Version === release?.chart.metadata?.version
+  )?.Repo;
+
+  const editableHelmRelease: UpdateHelmReleasePayload = {
+    name: releaseName,
+    namespace: namespace || '',
+    values: release?.values?.userSuppliedValues,
+    chart: release?.chart.metadata?.name || '',
+    appVersion: release?.chart.metadata?.appVersion,
+    version: release?.chart.metadata?.version,
+    repo: currentRepo ?? '',
+  };
+
+  const filteredVersions = currentRepo
+    ? versions?.filter((v) => v.Repo === currentRepo) || []
+    : versions || [];
+
+  return (
+    <div className="relative">
+      <LoadingButton
+        color="secondary"
+        data-cy="k8sApp-upgradeHelmChartButton"
+        onClick={handleUpgrade}
+        disabled={
+          versions.length === 0 ||
+          isLoading ||
+          isError ||
+          release?.info?.status?.startsWith('pending')
+        }
+        loadingText="Upgrading..."
+        isLoading={updateHelmReleaseMutation.isLoading}
+        icon={ArrowUp}
+        size="medium"
+      >
+        Edit/Upgrade
+      </LoadingButton>
+      {isLoading && (
+        <InlineLoader
+          size="xs"
+          className="absolute -bottom-5 left-0 right-0 whitespace-nowrap"
+        >
+          Checking for new versions...
+        </InlineLoader>
+      )}
+      {!isLoading && !isError && (
+        <span className="text-muted absolute -bottom-5 left-0 right-0 flex items-center whitespace-nowrap text-center text-xs">
+          {getStatusMessage(
+            versions.length === 0,
+            latestVersionAvailable,
+            isNewVersionAvailable
+          )}
+          {versions.length === 0 && (
+            <Tooltip
+              message={
+                <div>
+                  Portainer is unable to find any versions for this chart in the
+                  repositories saved. Try adding a new repository which contains
+                  the chart in the{' '}
+                  <Link
+                    to="portainer.account"
+                    params={{ '#': 'helm-repositories' }}
+                    data-cy="user-settings-link"
+                  >
+                    Helm repositories settings
+                  </Link>
+                </div>
+              }
+            />
+          )}
+          <Button
+            data-cy="k8sApp-refreshHelmChartVersionsButton"
+            color="link"
+            size="xsmall"
+            onClick={handleRefreshVersions}
+            type="button"
+          >
+            Refresh
+          </Button>
+        </span>
+      )}
+    </div>
+  );
+
+  function handleRefreshVersions() {
+    if (useCache) {
+      // clicking 'refresh versions' should get the latest versions from the repo, not the cached versions
+      setUseCache(false);
+    }
+    helmRepoVersionsQuery.refetch();
+  }
+
+  async function handleUpgrade() {
+    const submittedUpgradeValues = await openUpgradeHelmModal(
+      editableHelmRelease,
+      filteredVersions,
+      release?.manifest || '',
+      environmentId
+    );
+
+    if (submittedUpgradeValues) {
+      upgrade(submittedUpgradeValues, release);
+    }
+
+    function upgrade(payload: UpdateHelmReleasePayload, release?: HelmRelease) {
+      if (release?.info) {
+        const updatedRelease = {
+          ...release,
+          info: {
+            ...release.info,
+            status: 'pending-upgrade',
+            description: 'Preparing upgrade',
+          },
+        };
+        updateRelease(updatedRelease);
+      }
+      updateHelmReleaseMutation.mutate(payload, {
+        onSuccess: () => {
+          notifySuccess('Success', 'Helm chart upgraded successfully');
+          // set the revision url param to undefined to refresh the page at the latest revision
+          router.stateService.go('kubernetes.helm', {
+            namespace,
+            name: releaseName,
+            revision: undefined,
+          });
+        },
+      });
+    }
+  }
+}
+
+function getStatusMessage(
+  hasNoAvailableVersions: boolean,
+  latestVersionAvailable: string,
+  isNewVersionAvailable: boolean
+) {
+  if (hasNoAvailableVersions) {
+    return 'No versions available ';
+  }
+  if (isNewVersionAvailable) {
+    return `New version available (${latestVersionAvailable}) `;
+  }
+  return 'Latest version installed';
+}
diff --git a/app/react/kubernetes/helm/HelmApplicationView/ChartActions/UpgradeHelmModal.tsx b/app/react/kubernetes/helm/HelmApplicationView/ChartActions/UpgradeHelmModal.tsx
new file mode 100644
index 0000000..a26c867
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmApplicationView/ChartActions/UpgradeHelmModal.tsx
@@ -0,0 +1,240 @@
+import { useMemo, useState } from 'react';
+import { ArrowUp } from 'lucide-react';
+
+import { withReactQuery } from '@/react-tools/withReactQuery';
+import { withCurrentUser } from '@/react-tools/withCurrentUser';
+import { ChartVersion } from '@/react/kubernetes/helm/helmChartSourceQueries/useHelmRepoVersions';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { K8sRegistryAccessNotice } from '@/react/kubernetes/components/K8sRegistryAccessNotice';
+import { withUIRouter } from '@/react-tools/withUIRouter';
+
+import { Modal, OnSubmit, openModal } from '@@/modals';
+import { confirm } from '@@/modals/confirm';
+import { Button } from '@@/buttons';
+import { Input } from '@@/form-components/Input';
+import { FormControl } from '@@/form-components/FormControl';
+import { WidgetIcon } from '@@/Widget/WidgetIcon';
+import { Checkbox } from '@@/form-components/Checkbox';
+import { Option, PortainerSelect } from '@@/form-components/PortainerSelect';
+
+import { UpdateHelmReleasePayload } from '../../types';
+import { HelmValuesInput } from '../../components/HelmValuesInput';
+import { useHelmChartValues } from '../../helmChartSourceQueries/useHelmChartValues';
+import { ManifestPreviewFormSection } from '../../components/ManifestPreviewFormSection';
+
+interface Props {
+  onSubmit: OnSubmit<UpdateHelmReleasePayload>;
+  helmReleaseInitialValues: UpdateHelmReleasePayload;
+  releaseManifest: string;
+  versions: ChartVersion[];
+  chartName: string;
+  environmentId: EnvironmentId;
+}
+
+export function UpgradeHelmModal({
+  helmReleaseInitialValues,
+  releaseManifest,
+  versions,
+  onSubmit,
+  chartName,
+  environmentId,
+}: Props) {
+  const versionOptions: Option<ChartVersion>[] = versions.map((version) => {
+    const repo =
+      helmReleaseInitialValues.repo === version.Repo ? version.Repo : '';
+    const isCurrentVersion =
+      version.AppVersion === helmReleaseInitialValues.appVersion &&
+      version.Version === helmReleaseInitialValues.version;
+
+    const label = `${repo}@${version.Version}${
+      isCurrentVersion ? ' (current)' : ''
+    }`;
+
+    return {
+      repo,
+      label,
+      value: version,
+    };
+  });
+
+  const defaultVersion =
+    versionOptions.find(
+      (v) =>
+        v.value.AppVersion === helmReleaseInitialValues.appVersion &&
+        v.value.Version === helmReleaseInitialValues.version &&
+        v.value.Repo === helmReleaseInitialValues.repo
+    )?.value || versionOptions[0]?.value;
+  const [version, setVersion] = useState<ChartVersion>(defaultVersion);
+  const [userValues, setUserValues] = useState<string>(
+    helmReleaseInitialValues.values || ''
+  );
+  const [atomic, setAtomic] = useState<boolean>(true);
+  const [previewIsValid, setPreviewIsValid] = useState<boolean>(false);
+
+  const chartValuesRefQuery = useHelmChartValues({
+    chart: chartName,
+    repo: version.Repo,
+    version: version.Version,
+  });
+
+  const submitPayload = useMemo(
+    () => ({
+      name: helmReleaseInitialValues.name,
+      values: userValues,
+      namespace: helmReleaseInitialValues.namespace,
+      chart: helmReleaseInitialValues.chart,
+      repo: version.Repo,
+      version: version.Version,
+      atomic,
+    }),
+    [helmReleaseInitialValues, userValues, version, atomic]
+  );
+
+  return (
+    <Modal
+      onDismiss={() => onSubmit()}
+      size="xl"
+      className="flex h-[80vh] flex-col px-0"
+      aria-label="upgrade-helm"
+    >
+      <Modal.Header
+        title={
+          <div className="inline-flex items-center gap-1 px-5">
+            <WidgetIcon icon={ArrowUp} />
+            <h2 className="m-0 ml-1 text-base">Upgrade</h2>
+          </div>
+        }
+      />
+      <div className="flex-1 overflow-y-auto px-5">
+        <Modal.Body>
+          <div className="form-horizontal">
+            <FormControl
+              label="Release name"
+              inputId="release-name-input"
+              size="medium"
+            >
+              <Input
+                id="release-name-input"
+                value={helmReleaseInitialValues.name}
+                readOnly
+                disabled
+                data-cy="helm-release-name-input"
+              />
+            </FormControl>
+            <FormControl
+              label="Namespace"
+              inputId="namespace-input"
+              size="medium"
+            >
+              <div className="mb-1">
+                <K8sRegistryAccessNotice
+                  namespace={helmReleaseInitialValues.namespace}
+                  environmentId={environmentId}
+                />
+              </div>
+              <Input
+                id="namespace-input"
+                value={helmReleaseInitialValues.namespace}
+                readOnly
+                disabled
+                data-cy="helm-namespace-input"
+              />
+            </FormControl>
+            <FormControl label="Version" inputId="version-input" size="medium">
+              <PortainerSelect<ChartVersion>
+                value={version}
+                options={versionOptions}
+                onChange={(version) => {
+                  if (version) {
+                    setVersion(version);
+                  }
+                }}
+                data-cy="helm-version-input"
+              />
+            </FormControl>
+            <FormControl
+              label="Rollback on failure"
+              tooltip="Enables automatic rollback on failure. It may increase the time to upgrade."
+              inputId="atomic-input"
+              size="medium"
+            >
+              <Checkbox
+                id="atomic-input"
+                checked={atomic}
+                data-cy="atomic-checkbox"
+                onChange={(e) => setAtomic(e.target.checked)}
+              />
+            </FormControl>
+            <HelmValuesInput
+              values={userValues}
+              setValues={setUserValues}
+              valuesRef={chartValuesRefQuery.data?.values ?? ''}
+              isValuesRefLoading={chartValuesRefQuery.isInitialLoading}
+            />
+            <div className="mb-10">
+              <ManifestPreviewFormSection
+                payload={submitPayload}
+                onChangePreviewValidation={setPreviewIsValid}
+                title="Manifest changes"
+                currentManifest={releaseManifest}
+                environmentId={environmentId}
+              />
+            </div>
+          </div>
+        </Modal.Body>
+      </div>
+      <div className="border-0 border-t border-solid border-gray-5 px-5 th-highcontrast:border-white th-dark:border-gray-7">
+        <Modal.Footer>
+          <Button
+            onClick={() => onSubmit()}
+            color="secondary"
+            key="cancel-button"
+            size="medium"
+            data-cy="cancel-button-cy"
+          >
+            Cancel
+          </Button>
+          <Button
+            onClick={async () => {
+              if (!previewIsValid) {
+                const confirmed = await confirm({
+                  title: 'Chart validation failed',
+                  message:
+                    'The Helm manifest preview validation failed, which may indicate configuration issues. This can be normal when creating new resources. Do you want to proceed with the upgrade?',
+                });
+                if (!confirmed) {
+                  return;
+                }
+              }
+              onSubmit(submitPayload);
+            }}
+            color="primary"
+            key="update-button"
+            size="medium"
+            data-cy="update-button-cy"
+          >
+            Upgrade
+          </Button>
+        </Modal.Footer>
+      </div>
+    </Modal>
+  );
+}
+
+export async function openUpgradeHelmModal(
+  helmReleaseInitialValues: UpdateHelmReleasePayload,
+  versions: ChartVersion[],
+  releaseManifest: string,
+  environmentId: EnvironmentId
+) {
+  return openModal(
+    withUIRouter(withReactQuery(withCurrentUser(UpgradeHelmModal))),
+    {
+      helmReleaseInitialValues,
+      versions,
+      chartName: helmReleaseInitialValues.chart,
+      releaseManifest,
+      environmentId,
+    }
+  );
+}
diff --git a/app/react/kubernetes/helm/HelmApplicationView/HelmApplicationView.test.tsx b/app/react/kubernetes/helm/HelmApplicationView/HelmApplicationView.test.tsx
new file mode 100644
index 0000000..6cefd0f
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmApplicationView/HelmApplicationView.test.tsx
@@ -0,0 +1,310 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import { HttpResponse } from 'msw';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { server, http } from '@/setup-tests/server';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { UserViewModel } from '@/portainer/models/user';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { mockCodeMirror } from '@/setup-tests/mock-codemirror';
+import { mockLocalizeDate } from '@/setup-tests/mock-localizeDate';
+
+import { HelmApplicationView } from './HelmApplicationView';
+
+// Prevent importing @uirouter/react-hybrid (via withUIRouter), which replaces
+// UIView with AngularUIView and breaks the pure-React test router.
+vi.mock('./ChartActions/UpgradeHelmModal', () => ({
+  openUpgradeHelmModal: vi.fn(() => Promise.resolve(undefined)),
+}));
+
+// Mock the necessary hooks and dependencies
+const mockUseCurrentStateAndParams = vi.fn();
+const mockUseEnvironmentId = vi.fn();
+mockLocalizeDate();
+
+vi.mock('@uirouter/react', async (importOriginal: () => Promise<object>) => ({
+  ...(await importOriginal()),
+  useCurrentStateAndParams: () => mockUseCurrentStateAndParams(),
+}));
+
+vi.mock('@/react/hooks/useEnvironmentId', () => ({
+  useEnvironmentId: () => mockUseEnvironmentId(),
+}));
+
+mockCodeMirror();
+
+const minimalHelmRelease = {
+  name: 'test-release',
+  version: '1',
+  namespace: 'default',
+  chart: {
+    metadata: {
+      name: 'test-chart',
+      version: '2.2.2',
+    },
+  },
+  info: {
+    status: 'deployed',
+    last_deployed: '2021-01-01T00:00:00Z',
+    // notes: 'This is a test note', // can be missing for a minimal release
+  },
+  manifest: 'This is a test manifest',
+};
+
+// Create a more complete helm release object for testing
+const completeHelmRelease = {
+  name: 'test-release',
+  version: '1',
+  namespace: 'default',
+  chart: {
+    metadata: {
+      name: 'test-chart',
+      appVersion: '1.0.0',
+      version: '2.2.2',
+    },
+  },
+  info: {
+    status: 'deployed',
+    last_deployed: '2021-01-01T00:00:00Z',
+    notes: 'This is a test note',
+    resources: [
+      {
+        kind: 'Deployment',
+        name: 'test-deployment',
+        namespace: 'default',
+        uid: 'test-deployment-uid',
+        status: {
+          healthSummary: {
+            status: 'Healthy',
+            reason: 'Running',
+            message: 'All replicas are ready',
+          },
+        },
+        metadata: {
+          name: 'test-deployment',
+          namespace: 'default',
+        },
+      },
+      {
+        kind: 'Service',
+        name: 'test-service',
+        namespace: 'default',
+        uid: 'test-service-uid',
+        status: {
+          healthSummary: {
+            status: 'Healthy',
+            reason: 'Available',
+            message: 'Service is available',
+          },
+        },
+        metadata: {
+          name: 'test-service',
+          namespace: 'default',
+        },
+      },
+    ],
+  },
+  manifest: 'This is a test manifest',
+  values: {
+    // Add some values to ensure the Values tab is present
+    replicaCount: 1,
+    image: {
+      repository: 'nginx',
+      tag: 'latest',
+    },
+  },
+  resources: [
+    {
+      kind: 'Deployment',
+      name: 'test-deployment',
+      namespace: 'default',
+      status: {
+        healthSummary: {
+          status: 'Healthy',
+          reason: 'Running',
+          message: 'All replicas are ready',
+        },
+      },
+      metadata: {
+        name: 'test-deployment',
+        namespace: 'default',
+      },
+    },
+  ],
+};
+
+const helmReleaseHistory = [
+  {
+    version: 1,
+    updated: '2023-06-01T12:00:00Z',
+    status: 'deployed',
+    chart: 'test-chart-1.0.0',
+    app_version: '1.0.0',
+    description: 'Install complete',
+  },
+];
+
+// Common MSW handlers for all tests
+function createCommonHandlers() {
+  return [
+    http.get('/api/users/undefined/helm/repositories', () =>
+      HttpResponse.json({
+        GlobalRepository: 'https://charts.helm.sh/stable',
+        UserRepositories: [{ Id: '1', URL: 'https://charts.helm.sh/stable' }],
+      })
+    ),
+    http.get('/api/templates/helm', () =>
+      HttpResponse.json({
+        entries: {
+          'test-chart': [{ version: '1.0.0' }],
+        },
+      })
+    ),
+    http.get('/api/endpoints/3/kubernetes/helm/test-release/history', () =>
+      HttpResponse.json(helmReleaseHistory)
+    ),
+    http.get('/api/kubernetes/3/namespaces', () =>
+      HttpResponse.json([
+        {
+          Id: 'default',
+          Name: 'default',
+          Status: { phase: 'Active' },
+          Annotations: null,
+          CreationDate: '2021-01-01T00:00:00Z',
+          NamespaceOwner: '',
+          IsSystem: false,
+          IsDefault: true,
+        },
+      ])
+    ),
+    http.get('/api/kubernetes/3/namespaces/default/events', () =>
+      HttpResponse.json([])
+    ),
+    http.get('/api/kubernetes/3/namespaces/default', () =>
+      HttpResponse.json({
+        Id: 'default',
+        Name: 'default',
+        Status: { phase: 'Active' },
+        Annotations: {},
+        CreationDate: '2021-01-01T00:00:00Z',
+        NamespaceOwner: '',
+        IsSystem: false,
+        IsDefault: true,
+      })
+    ),
+  ];
+}
+
+function setupMockHandlers(helmReleaseHandler: ReturnType<typeof http.get>) {
+  server.use(helmReleaseHandler, ...createCommonHandlers());
+}
+
+function renderComponent() {
+  const user = new UserViewModel({ Username: 'user' });
+  const Wrapped = withTestQueryProvider(
+    withUserProvider(withTestRouter(HelmApplicationView), user)
+  );
+  return render(<Wrapped />);
+}
+
+describe('HelmApplicationView', () => {
+  beforeEach(() => {
+    // Set up default mock values
+    mockUseEnvironmentId.mockReturnValue(3);
+    mockUseCurrentStateAndParams.mockReturnValue({
+      params: {
+        name: 'test-release',
+        namespace: 'default',
+      },
+    });
+  });
+
+  it('should display helm release details for minimal release when data is loaded', async () => {
+    vi.spyOn(console, 'error').mockImplementation(() => {});
+
+    setupMockHandlers(
+      http.get('/api/endpoints/3/kubernetes/helm/test-release', () =>
+        HttpResponse.json(minimalHelmRelease)
+      )
+    );
+
+    const { findByText, findAllByText } = renderComponent();
+
+    // Check for the page header
+    expect(await findByText('Helm details')).toBeInTheDocument();
+
+    // Check for the details content - these values should appear somewhere in the card
+    expect(await findByText('default')).toBeInTheDocument(); // namespace
+    expect(await findByText('test-chart-2.2.2')).toBeInTheDocument(); // chart version
+    expect(await findByText('test-chart')).toBeInTheDocument(); // chart name
+    expect(await findByText('#1')).toBeInTheDocument(); // revision
+    expect(await findByText('Jan 1, 2021, 12:00 AM')).toBeInTheDocument(); // last deployed
+
+    // Check for the actual values
+    expect(await findAllByText(/test-release/)).toHaveLength(2); // title and breadcrumb
+    expect(await findAllByText(/test-chart/)).toHaveLength(2); // chart name appears twice
+
+    // There shouldn't be a notes tab when there are no notes
+    expect(screen.queryByText(/Notes/)).not.toBeInTheDocument();
+
+    // There shouldn't be an app version badge when it's missing
+    expect(screen.queryByText(/App version/)).not.toBeInTheDocument();
+
+    // Ensure there are no console errors
+    // eslint-disable-next-line no-console
+    expect(console.error).not.toHaveBeenCalled();
+
+    // Restore console.error
+    vi.spyOn(console, 'error').mockRestore();
+  });
+
+  it('should display error message when API request fails', async () => {
+    // Mock API failure
+    setupMockHandlers(
+      http.get('/api/endpoints/3/kubernetes/helm/test-release', () =>
+        HttpResponse.error()
+      )
+    );
+
+    // Mock console.error to prevent test output pollution
+    vi.spyOn(console, 'error').mockImplementation(() => {});
+
+    renderComponent();
+
+    // Wait for the error message to appear
+    expect(
+      await screen.findByText(
+        'Failed to load Helm application details',
+        {},
+        { timeout: 6500 }
+      )
+    ).toBeInTheDocument();
+
+    // Restore console.error
+    vi.spyOn(console, 'error').mockRestore();
+  });
+
+  it('should display additional details when available in helm release', async () => {
+    setupMockHandlers(
+      http.get('/api/endpoints/3/kubernetes/helm/test-release', () =>
+        HttpResponse.json(completeHelmRelease)
+      )
+    );
+
+    const { findByText } = renderComponent();
+
+    expect(await findByText('Helm details')).toBeInTheDocument();
+
+    await waitFor(() => {
+      // Look for specific tab text
+      expect(screen.getByText('Resources')).toBeInTheDocument();
+      expect(screen.getByText('Values')).toBeInTheDocument();
+      expect(screen.getByText('Manifest')).toBeInTheDocument();
+      expect(screen.getByText('Notes')).toBeInTheDocument();
+      expect(screen.getByText('Events')).toBeInTheDocument();
+    });
+
+    // Check for the app version in the summary section
+    expect(await screen.findByText('1.0.0')).toBeInTheDocument();
+  });
+}, 7000);
diff --git a/app/react/kubernetes/helm/HelmApplicationView/HelmApplicationView.tsx b/app/react/kubernetes/helm/HelmApplicationView/HelmApplicationView.tsx
new file mode 100644
index 0000000..411b2ee
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmApplicationView/HelmApplicationView.tsx
@@ -0,0 +1,160 @@
+import { useCurrentStateAndParams } from '@uirouter/react';
+import { useQueryClient } from '@tanstack/react-query';
+
+import helm from '@/assets/ico/vendor/helm.svg?c';
+import { PageHeader } from '@/react/components/PageHeader';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { Authorized } from '@/react/hooks/useUser';
+import { useNamespaceAccessRedirect } from '@/react/kubernetes/namespaces/hooks/useNamespaceAccessRedirect';
+
+import { WidgetTitle, WidgetBody, Widget, Loading } from '@@/Widget';
+import { Card } from '@@/primitives/Card';
+import { Alert } from '@@/Alert';
+
+import { HelmRelease } from '../types';
+import { useIsSystemNamespace } from '../../namespaces/queries/useIsSystemNamespace';
+import { useHelmRelease } from '../helmReleaseQueries/useHelmRelease';
+import { useHelmHistory } from '../helmReleaseQueries/useHelmHistory';
+
+import { HelmSummary } from './HelmSummary';
+import { ReleaseTabs } from './ReleaseDetails/ReleaseTabs';
+import { ChartActions } from './ChartActions/ChartActions';
+import { HelmRevisionList } from './HelmRevisionList';
+import { HelmRevisionListSheet } from './HelmRevisionListSheet';
+
+export function HelmApplicationView() {
+  const environmentId = useEnvironmentId();
+  const queryClient = useQueryClient();
+  const { params } = useCurrentStateAndParams();
+  const { name, namespace, revision } = params;
+  useNamespaceAccessRedirect(namespace, { to: 'kubernetes.applications' });
+  const helmHistoryQuery = useHelmHistory(environmentId, name, namespace);
+  const latestRevision = helmHistoryQuery.data?.[0]?.version;
+  const earlistRevision =
+    helmHistoryQuery.data?.[helmHistoryQuery.data.length - 1]?.version;
+  // when loading the page fresh, the revision is undefined, so use the latest revision
+  const selectedRevision = revision ? parseInt(revision, 10) : latestRevision;
+
+  const helmReleaseQuery = useHelmRelease(environmentId, name, namespace, {
+    showResources: true,
+    revision: selectedRevision,
+  });
+
+  const isSystemNamespace = useIsSystemNamespace(namespace);
+
+  return (
+    <>
+      <PageHeader
+        title="Helm details"
+        breadcrumbs={[
+          { label: 'Applications', link: 'kubernetes.applications' },
+          name,
+        ]}
+        reload
+      />
+
+      <div className="row">
+        <div className="col-sm-12">
+          <Widget className="overflow-hidden">
+            <div className="flex">
+              <div className="min-w-0 flex-1">
+                {name && (
+                  <WidgetTitle icon={helm} title={name}>
+                    <div className="flex flex-wrap gap-2">
+                      <div className="2xl:hidden">
+                        <HelmRevisionListSheet
+                          currentRevision={helmReleaseQuery.data?.version}
+                          history={helmHistoryQuery.data}
+                        />
+                      </div>
+                      <Authorized authorizations="K8sApplicationsW">
+                        {!isSystemNamespace && (
+                          <ChartActions
+                            environmentId={environmentId}
+                            releaseName={String(name)}
+                            namespace={String(namespace)}
+                            latestRevision={latestRevision ?? 1}
+                            earlistRevision={earlistRevision}
+                            selectedRevision={selectedRevision}
+                            release={helmReleaseQuery.data}
+                            updateRelease={(updatedRelease: HelmRelease) => {
+                              queryClient.setQueryData(
+                                [
+                                  environmentId,
+                                  'helm',
+                                  'releases',
+                                  namespace,
+                                  name,
+                                  true,
+                                ],
+                                updatedRelease
+                              );
+                            }}
+                          />
+                        )}
+                      </Authorized>
+                    </div>
+                  </WidgetTitle>
+                )}
+                <WidgetBody className="!pt-2.5">
+                  <HelmDetails
+                    isLoading={helmReleaseQuery.isInitialLoading}
+                    isError={helmReleaseQuery.isError}
+                    release={helmReleaseQuery.data}
+                    selectedRevision={selectedRevision}
+                  />
+                </WidgetBody>
+              </div>
+              <div className="hidden w-80 2xl:!block">
+                <HelmRevisionList
+                  currentRevision={helmReleaseQuery.data?.version}
+                  history={helmHistoryQuery.data}
+                />
+              </div>
+            </div>
+          </Widget>
+        </div>
+      </div>
+    </>
+  );
+}
+
+type HelmDetailsProps = {
+  isLoading: boolean;
+  isError: boolean;
+  selectedRevision?: number;
+  release?: HelmRelease;
+};
+
+function HelmDetails({
+  isLoading,
+  isError,
+  release,
+  selectedRevision,
+}: HelmDetailsProps) {
+  if (isLoading) {
+    return <Loading />;
+  }
+
+  if (isError) {
+    return (
+      <Alert color="error" title="Failed to load Helm application details" />
+    );
+  }
+
+  if (!release || !selectedRevision) {
+    return <Alert color="error" title="No Helm application details found" />;
+  }
+
+  return (
+    <>
+      <HelmSummary release={release} />
+      <div className="my-6 h-[1px] w-full bg-gray-5 th-highcontrast:bg-white th-dark:bg-gray-7" />
+      <Card.Container variant="default">
+        <Card.Body>
+          <ReleaseTabs release={release} selectedRevision={selectedRevision} />
+        </Card.Body>
+      </Card.Container>
+    </>
+  );
+}
diff --git a/app/react/kubernetes/helm/HelmApplicationView/HelmRevisionItem.test.tsx b/app/react/kubernetes/helm/HelmApplicationView/HelmRevisionItem.test.tsx
new file mode 100644
index 0000000..638197a
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmApplicationView/HelmRevisionItem.test.tsx
@@ -0,0 +1,116 @@
+import { render, screen } from '@testing-library/react';
+import { describe, expect, it } from 'vitest';
+
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { mockLocalizeDate } from '@/setup-tests/mock-localizeDate';
+
+import { HelmRelease } from '../types';
+
+import { HelmRevisionItem } from './HelmRevisionItem';
+
+const mockHelmRelease: HelmRelease = {
+  name: 'my-release',
+  version: 1,
+  info: {
+    status: 'deployed',
+    last_deployed: '2024-01-01T00:00:00Z',
+  },
+  chart: {
+    metadata: {
+      name: 'my-app',
+      version: '1.0.0',
+    },
+  },
+  manifest: 'apiVersion: v1\nkind: Service\nmetadata:\n  name: my-service',
+};
+
+mockLocalizeDate();
+
+vi.mock('@uirouter/react', () => ({
+  useCurrentStateAndParams: () => ({
+    params: {
+      namespace: 'default',
+      name: 'my-release',
+    },
+  }),
+}));
+
+const mockUseCurrentStateAndParams = vi.fn();
+
+vi.mock('@uirouter/react', async (importOriginal: () => Promise<object>) => ({
+  ...(await importOriginal()),
+  useCurrentStateAndParams: () => mockUseCurrentStateAndParams(),
+}));
+
+function getTestComponent() {
+  return withTestRouter(HelmRevisionItem);
+}
+
+describe('HelmRevisionItem', () => {
+  it('should display correct revision details', () => {
+    const TestComponent = getTestComponent();
+    render(
+      <TestComponent
+        item={mockHelmRelease}
+        namespace="default"
+        name="my-release"
+      />
+    );
+
+    // Check status badge
+    expect(screen.getByText('Deployed')).toBeInTheDocument();
+
+    // Check revision number
+    expect(screen.getByText('Revision #1')).toBeInTheDocument();
+
+    // Check chart name and version
+    expect(screen.getByText('my-app-1.0.0')).toBeInTheDocument();
+
+    // Check deployment date
+    expect(screen.getByText('Jan 1, 2024, 12:00 AM')).toBeInTheDocument();
+  });
+
+  it('should have selected class when currentRevision matches item version', () => {
+    const TestComponent = getTestComponent();
+    const { container } = render(
+      <TestComponent
+        item={mockHelmRelease}
+        currentRevision={1}
+        namespace="default"
+        name="my-release"
+      />
+    );
+
+    const blocklistItem = container.querySelector('.blocklist-item');
+    expect(blocklistItem).toHaveClass('blocklist-item--selected');
+  });
+
+  it('should not have selected class when currentRevision does not match item version', () => {
+    const TestComponent = getTestComponent();
+    const { container } = render(
+      <TestComponent
+        item={mockHelmRelease}
+        currentRevision={2}
+        namespace="default"
+        name="my-release"
+      />
+    );
+
+    const blocklistItem = container.querySelector('.blocklist-item');
+    expect(blocklistItem).not.toHaveClass('blocklist-item--selected');
+  });
+
+  it('should not have selected class when currentRevision is undefined', () => {
+    const TestComponent = getTestComponent();
+    const { container } = render(
+      <TestComponent
+        item={mockHelmRelease}
+        namespace="default"
+        name="my-release"
+      />
+    );
+
+    const blocklistItem = container.querySelector('.blocklist-item');
+    expect(blocklistItem).not.toHaveClass('blocklist-item--selected');
+  });
+});
diff --git a/app/react/kubernetes/helm/HelmApplicationView/HelmRevisionItem.tsx b/app/react/kubernetes/helm/HelmApplicationView/HelmRevisionItem.tsx
new file mode 100644
index 0000000..2364c31
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmApplicationView/HelmRevisionItem.tsx
@@ -0,0 +1,49 @@
+import { localizeDate } from '@/react/common/date-utils';
+
+import { BlocklistItem } from '@@/Blocklist/BlocklistItem';
+import { Link } from '@@/Link';
+import { Badge } from '@@/Badge';
+
+import { HelmRelease } from '../types';
+import { getStatusColor, getStatusText } from '../helm-status-utils';
+
+export function HelmRevisionItem({
+  item,
+  currentRevision,
+  namespace,
+  name,
+}: {
+  item: HelmRelease;
+  currentRevision?: number;
+  namespace: string;
+  name: string;
+}) {
+  return (
+    <BlocklistItem
+      data-cy="helm-history-item"
+      isSelected={item.version === currentRevision}
+      as={Link}
+      to="kubernetes.helm"
+      params={{ namespace, name, revision: item.version }}
+    >
+      <div className="flex w-full flex-col gap-2">
+        <div className="flex flex-wrap justify-between gap-1">
+          <Badge type={getStatusColor(item.info?.status)}>
+            {getStatusText(item.info?.status)}
+          </Badge>
+          <span className="text-muted text-xs">Revision #{item.version}</span>
+        </div>
+        <div className="flex flex-wrap justify-between gap-1">
+          <span className="text-muted text-xs">
+            {item.chart.metadata?.name}-{item.chart.metadata?.version}
+          </span>
+          {item.info?.last_deployed && (
+            <span className="text-muted text-xs">
+              {localizeDate(new Date(item.info.last_deployed))}
+            </span>
+          )}
+        </div>
+      </div>
+    </BlocklistItem>
+  );
+}
diff --git a/app/react/kubernetes/helm/HelmApplicationView/HelmRevisionList.tsx b/app/react/kubernetes/helm/HelmApplicationView/HelmRevisionList.tsx
new file mode 100644
index 0000000..f7ae7c5
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmApplicationView/HelmRevisionList.tsx
@@ -0,0 +1,43 @@
+import { useCurrentStateAndParams } from '@uirouter/react';
+import { History } from 'lucide-react';
+
+import { WidgetIcon } from '@@/Widget/WidgetIcon';
+
+import { HelmRelease } from '../types';
+
+import { HelmRevisionItem } from './HelmRevisionItem';
+
+export function HelmRevisionList({
+  currentRevision,
+  history,
+}: {
+  currentRevision?: number;
+  history: HelmRelease[] | undefined;
+}) {
+  const { params } = useCurrentStateAndParams();
+  const { name, namespace } = params;
+
+  if (!history) {
+    return null;
+  }
+
+  return (
+    <div className="h-0 min-h-full overflow-y-auto [scrollbar-gutter:stable]">
+      <div className="p-5 pb-2.5">
+        <span className="vertical-center mb-5">
+          <WidgetIcon icon={History} />
+          <h2 className="m-0 ml-1 text-base">Revisions</h2>
+        </span>
+        {history?.map((historyItem) => (
+          <HelmRevisionItem
+            key={historyItem.version}
+            item={historyItem}
+            namespace={namespace}
+            name={name}
+            currentRevision={currentRevision}
+          />
+        ))}
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/kubernetes/helm/HelmApplicationView/HelmRevisionListSheet.tsx b/app/react/kubernetes/helm/HelmApplicationView/HelmRevisionListSheet.tsx
new file mode 100644
index 0000000..e71db20
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmApplicationView/HelmRevisionListSheet.tsx
@@ -0,0 +1,40 @@
+import { Eye } from 'lucide-react';
+
+import { Icon } from '@@/Icon';
+import {
+  Sheet,
+  SheetContent,
+  SheetDescription,
+  SheetHeader,
+  SheetTrigger,
+} from '@@/Sheet';
+
+import { HelmRelease } from '../types';
+
+import { HelmRevisionList } from './HelmRevisionList';
+
+export function HelmRevisionListSheet({
+  currentRevision,
+  history,
+}: {
+  currentRevision: number | undefined;
+  history: HelmRelease[] | undefined;
+}) {
+  return (
+    <Sheet>
+      <SheetTrigger className="btn btn-link">
+        <Icon icon={Eye} />
+        View revisions
+      </SheetTrigger>
+      <SheetContent className="!w-80 overflow-auto !p-0 !pt-1">
+        <div className="sr-only">
+          <SheetHeader title="Revisions" />
+          <SheetDescription>
+            View the history of this Helm application.
+          </SheetDescription>
+        </div>
+        <HelmRevisionList currentRevision={currentRevision} history={history} />
+      </SheetContent>
+    </Sheet>
+  );
+}
diff --git a/app/react/kubernetes/helm/HelmApplicationView/HelmSummary.tsx b/app/react/kubernetes/helm/HelmApplicationView/HelmSummary.tsx
new file mode 100644
index 0000000..1f59b4c
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmApplicationView/HelmSummary.tsx
@@ -0,0 +1,132 @@
+import { Badge } from '@/react/components/Badge';
+import { localizeDate } from '@/react/common/date-utils';
+
+import { Alert } from '@@/Alert';
+import { Card } from '@@/primitives/Card';
+
+import { HelmRelease } from '../types';
+import {
+  DeploymentStatus,
+  getStatusColor,
+  getStatusText,
+} from '../helm-status-utils';
+
+interface Props {
+  release: HelmRelease;
+}
+
+export function HelmSummary({ release }: Props) {
+  const isSuccess =
+    release.info?.status === DeploymentStatus.DEPLOYED ||
+    release.info?.status === DeploymentStatus.SUPERSEDED;
+
+  return (
+    <div>
+      <div className="mt-4 flex flex-col gap-y-4">
+        <div>
+          <Badge type={getStatusColor(release.info?.status)}>
+            {getStatusText(release.info?.status)}
+          </Badge>
+        </div>
+        {!!release.info?.description && !isSuccess && (
+          <Alert color={getAlertColor(release.info?.status)}>
+            {release.info?.description}
+          </Alert>
+        )}
+        <Card.Container variant="filled">
+          <Card.Body>
+            <div className="form-section-title">Details</div>
+            <div
+              className="grid grid-cols-1 gap-x-6 gap-y-1 text-sm lg:grid-cols-2 xl:grid-cols-3"
+              data-cy="helm-release-info"
+            >
+              {!!release.namespace && (
+                <div className="min-w-0">
+                  <span className="text-muted">Namespace: </span>
+                  <span data-cy="helm-info-namespace">{release.namespace}</span>
+                </div>
+              )}
+              {!!release.version && (
+                <div className="min-w-0">
+                  <span className="text-muted">Revision: </span>
+                  <span data-cy="helm-info-revision">#{release.version}</span>
+                </div>
+              )}
+              {!!release.chart?.metadata?.name && (
+                <div className="min-w-0">
+                  <span className="text-muted">Chart: </span>
+                  <span data-cy="helm-info-chart">
+                    {release.chart.metadata.name}
+                  </span>
+                </div>
+              )}
+              <ChartReferenceBadge chartReference={release.chartReference} />
+              {!!release.chart?.metadata?.appVersion && (
+                <div className="min-w-0">
+                  <span className="text-muted">App version: </span>
+                  <span data-cy="helm-info-app-version">
+                    {release.chart.metadata.appVersion}
+                  </span>
+                </div>
+              )}
+              {!!release.chart?.metadata?.version && (
+                <div className="min-w-0">
+                  <span className="text-muted">Chart version: </span>
+                  <span className="inline-flex flex-wrap items-center gap-1">
+                    <span data-cy="helm-info-chart-version">
+                      {release.chart.metadata.name}-
+                      {release.chart.metadata.version}
+                    </span>
+                  </span>
+                </div>
+              )}
+              {!!release.info?.last_deployed && (
+                <div className="min-w-0">
+                  <span className="text-muted">Last deployed: </span>
+                  <span data-cy="helm-info-last-deployed">
+                    {localizeDate(new Date(release.info.last_deployed))}
+                  </span>
+                </div>
+              )}
+            </div>
+          </Card.Body>
+        </Card.Container>
+      </div>
+    </div>
+  );
+}
+
+function ChartReferenceBadge({
+  chartReference,
+}: {
+  chartReference: HelmRelease['chartReference'];
+}) {
+  // CE only supports Helm repositories (not OCI registries)
+  if (!chartReference?.repoURL) {
+    return null;
+  }
+
+  return (
+    <div className="min-w-0">
+      <span className="text-muted">Chart source: </span>
+      <span>{chartReference.repoURL}</span>
+    </div>
+  );
+}
+
+function getAlertColor(status?: string) {
+  switch (status?.toLowerCase()) {
+    case DeploymentStatus.DEPLOYED:
+      return 'success';
+    case DeploymentStatus.FAILED:
+      return 'error';
+    case DeploymentStatus.PENDING:
+    case DeploymentStatus.PENDINGUPGRADE:
+    case DeploymentStatus.PENDINGROLLBACK:
+    case DeploymentStatus.UNINSTALLING:
+      return 'warn';
+    case DeploymentStatus.SUPERSEDED:
+    default:
+      return 'info';
+  }
+}
diff --git a/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/DiffControl.test.tsx b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/DiffControl.test.tsx
new file mode 100644
index 0000000..109d982
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/DiffControl.test.tsx
@@ -0,0 +1,193 @@
+import { fireEvent, render } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { vi } from 'vitest';
+
+import { DiffControl, DiffViewMode } from './DiffControl';
+
+// Create a mock for useDebounce that directly passes the setter function
+vi.mock('@/react/hooks/useDebounce', () => ({
+  useDebounce: (initialValue: number, setter: (value: number) => void) =>
+    // Return the initial value and a function that directly calls the setter
+    [initialValue, setter],
+}));
+
+function renderComponent({
+  selectedRevisionNumber = 5,
+  latestRevisionNumber = 10,
+  compareRevisionNumber = 4,
+  setCompareRevisionNumber = vi.fn(),
+  earliestRevisionNumber = 1,
+  diffViewMode = 'view' as DiffViewMode,
+  setDiffViewMode = vi.fn(),
+  isUserSupplied = false,
+  setIsUserSupplied = vi.fn(),
+  showUserSuppliedCheckbox = false,
+} = {}) {
+  return render(
+    <DiffControl
+      selectedRevisionNumber={selectedRevisionNumber}
+      latestRevisionNumber={latestRevisionNumber}
+      compareRevisionNumber={compareRevisionNumber}
+      setCompareRevisionNumber={setCompareRevisionNumber}
+      earliestRevisionNumber={earliestRevisionNumber}
+      diffViewMode={diffViewMode}
+      setDiffViewMode={setDiffViewMode}
+      isUserSupplied={isUserSupplied}
+      setIsUserSupplied={setIsUserSupplied}
+      showUserSuppliedCheckbox={showUserSuppliedCheckbox}
+    />
+  );
+}
+
+describe('DiffControl', () => {
+  it('should only render the user supplied checkbox when latestRevisionNumber is 1 and showUserSuppliedCheckbox is true', () => {
+    const { queryByLabelText } = renderComponent({
+      latestRevisionNumber: 1,
+      showUserSuppliedCheckbox: true,
+      setIsUserSupplied: vi.fn(),
+    });
+    expect(queryByLabelText('View')).toBeNull();
+    expect(queryByLabelText('Diff with previous')).toBeNull();
+    expect(queryByLabelText('Diff with specific revision:')).toBeNull();
+    expect(queryByLabelText('User defined only')).toBeInTheDocument();
+  });
+
+  it('should not render any controls when latestRevisionNumber is 1 and showUserSuppliedCheckbox is false', () => {
+    const { queryByLabelText } = renderComponent({
+      latestRevisionNumber: 1,
+      showUserSuppliedCheckbox: false,
+    });
+    expect(queryByLabelText('Diff with previous')).toBeNull();
+    expect(queryByLabelText('Diff with specific revision:')).toBeNull();
+    expect(queryByLabelText('View')).toBeNull();
+    expect(queryByLabelText('User defined only')).toBeNull();
+  });
+
+  it('should render view option', () => {
+    const { getByLabelText } = renderComponent();
+    expect(getByLabelText('View')).toBeInTheDocument();
+  });
+
+  it('should render "Diff with previous" option when earliestRevisionNumber < selectedRevisionNumber', () => {
+    const { getByLabelText } = renderComponent({
+      earliestRevisionNumber: 3,
+      selectedRevisionNumber: 5,
+    });
+    expect(getByLabelText('Diff with previous')).toBeInTheDocument();
+  });
+
+  it('should render "Diff with previous" option as disabled when earliestRevisionNumber >= selectedRevisionNumber', () => {
+    const { getByLabelText } = renderComponent({
+      earliestRevisionNumber: 5,
+      selectedRevisionNumber: 5,
+    });
+
+    expect(getByLabelText('View')).toBeInTheDocument();
+    expect(getByLabelText('Diff with specific revision:')).toBeInTheDocument();
+    // 'Diff with previous' should exist and be disabled
+    const diffWithPreviousOption = getByLabelText('Diff with previous');
+    expect(diffWithPreviousOption).toBeInTheDocument();
+    expect(diffWithPreviousOption).toBeDisabled();
+  });
+
+  it('should render "Diff with specific revision" option', () => {
+    const { getByLabelText } = renderComponent();
+    expect(getByLabelText('Diff with specific revision:')).toBeInTheDocument();
+  });
+
+  it('should render user supplied checkbox when showUserSuppliedCheckbox is true', () => {
+    const { getByLabelText } = renderComponent({
+      showUserSuppliedCheckbox: true,
+    });
+    expect(getByLabelText('User defined only')).toBeInTheDocument();
+  });
+
+  it('should not render user supplied checkbox when showUserSuppliedCheckbox is false', () => {
+    const { queryByLabelText } = renderComponent({
+      showUserSuppliedCheckbox: false,
+    });
+    expect(queryByLabelText('User defined only')).not.toBeInTheDocument();
+  });
+
+  it('should call setDiffViewMode when a radio option is selected', async () => {
+    const user = userEvent.setup();
+    const setDiffViewMode = vi.fn();
+
+    const { getByLabelText } = renderComponent({
+      setDiffViewMode,
+      diffViewMode: 'view',
+    });
+
+    await user.click(getByLabelText('Diff with specific revision:'));
+    expect(setDiffViewMode).toHaveBeenCalledWith('specific');
+  });
+
+  it('should call setIsUserSupplied when checkbox is clicked', async () => {
+    const user = userEvent.setup();
+    const setIsUserSupplied = vi.fn();
+
+    const { getByLabelText } = renderComponent({
+      setIsUserSupplied,
+      isUserSupplied: false,
+      showUserSuppliedCheckbox: true,
+    });
+
+    await user.click(getByLabelText('User defined only'));
+    expect(setIsUserSupplied).toHaveBeenCalledWith(true);
+  });
+});
+
+describe('DiffWithSpecificRevision', () => {
+  it('should display input with compareRevisionNumber value when not NaN', () => {
+    const compareRevisionNumber = 3;
+    const { getByRole } = renderComponent({
+      diffViewMode: 'specific',
+      compareRevisionNumber,
+    });
+
+    const input = getByRole('spinbutton');
+    expect(input).toHaveValue(compareRevisionNumber);
+  });
+
+  it('should handle input values and constraints properly', () => {
+    const setCompareRevisionNumber = vi.fn();
+    const earliestRevisionNumber = 2;
+    const latestRevisionNumber = 10;
+
+    const { getByRole } = renderComponent({
+      diffViewMode: 'specific',
+      earliestRevisionNumber,
+      latestRevisionNumber,
+      setCompareRevisionNumber,
+      compareRevisionNumber: 4,
+    });
+
+    // Check that input has the right min/max attributes
+    const input = getByRole('spinbutton');
+    expect(input).toHaveAttribute('min', earliestRevisionNumber.toString());
+    expect(input).toHaveAttribute('max', latestRevisionNumber.toString());
+
+    fireEvent.change(input, { target: { valueAsNumber: 11 } });
+    expect(setCompareRevisionNumber).toHaveBeenLastCalledWith(
+      latestRevisionNumber
+    );
+
+    fireEvent.change(input, { target: { valueAsNumber: 1 } });
+    expect(setCompareRevisionNumber).toHaveBeenLastCalledWith(
+      earliestRevisionNumber
+    );
+
+    fireEvent.change(input, { target: { valueAsNumber: 5 } });
+    expect(setCompareRevisionNumber).toHaveBeenLastCalledWith(5);
+  });
+
+  it('should handle NaN values in the input as empty string', () => {
+    const { getByRole } = renderComponent({
+      diffViewMode: 'specific',
+      compareRevisionNumber: NaN,
+    });
+
+    const input = getByRole('spinbutton') as HTMLInputElement;
+    expect(input.value).toBe('');
+  });
+});
diff --git a/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/DiffControl.tsx b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/DiffControl.tsx
new file mode 100644
index 0000000..254a868
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/DiffControl.tsx
@@ -0,0 +1,146 @@
+import { ChangeEvent } from 'react';
+
+import { useDebounce } from '@/react/hooks/useDebounce';
+
+import { RadioGroup, RadioGroupOption } from '@@/RadioGroup/RadioGroup';
+import { Input } from '@@/form-components/Input';
+import { Checkbox } from '@@/form-components/Checkbox';
+
+import {
+  LatestRevisionNumber,
+  EarliestRevisionNumber,
+  CompareRevisionNumber,
+  SelectedRevisionNumber,
+} from './types';
+
+export type DiffViewMode = 'view' | 'previous' | 'specific';
+
+type Props = {
+  selectedRevisionNumber: SelectedRevisionNumber;
+  latestRevisionNumber: LatestRevisionNumber;
+  compareRevisionNumber: CompareRevisionNumber;
+  setCompareRevisionNumber: (
+    compareRevisionNumber: CompareRevisionNumber
+  ) => void;
+  earliestRevisionNumber: EarliestRevisionNumber;
+  diffViewMode: DiffViewMode;
+  setDiffViewMode: (diffViewMode: DiffViewMode) => void;
+  isUserSupplied?: boolean;
+  setIsUserSupplied?: (isUserSupplied: boolean) => void;
+  showUserSuppliedCheckbox?: boolean;
+};
+
+export function DiffControl({
+  selectedRevisionNumber,
+  latestRevisionNumber,
+  compareRevisionNumber,
+  setCompareRevisionNumber,
+  earliestRevisionNumber,
+  diffViewMode,
+  setDiffViewMode,
+  isUserSupplied,
+  setIsUserSupplied,
+  showUserSuppliedCheckbox,
+}: Props) {
+  // If there is a different version to compare, show view option radio group
+  const showViewOptions = latestRevisionNumber > earliestRevisionNumber;
+
+  // to show the previous option, the earliest revision number available must be less than the selected revision number. (compare is still allowed, because we can still compare with a later revision)
+  const disabledPreviousOption =
+    earliestRevisionNumber >= selectedRevisionNumber;
+
+  const options: Array<RadioGroupOption<DiffViewMode>> = [
+    { label: 'View', value: 'view' },
+    {
+      label: 'Diff with previous',
+      value: 'previous',
+      disabled: disabledPreviousOption,
+    },
+    {
+      label: (
+        <DiffWithSpecificRevision
+          latestRevisionNumber={latestRevisionNumber}
+          earliestRevisionNumber={earliestRevisionNumber}
+          compareRevisionNumber={compareRevisionNumber}
+          setCompareRevisionNumber={setCompareRevisionNumber}
+        />
+      ),
+      value: 'specific',
+    },
+  ];
+
+  return (
+    <div className="flex flex-wrap items-center gap-x-16 gap-y-1">
+      {showViewOptions && (
+        <RadioGroup
+          options={options}
+          selectedOption={diffViewMode}
+          name="diffControl"
+          onOptionChange={setDiffViewMode}
+          groupClassName="inline-flex flex-wrap gap-x-16 gap-y-1"
+          itemClassName="control-label !p-0 text-left font-normal"
+        />
+      )}
+      {!!showUserSuppliedCheckbox && !!setIsUserSupplied && (
+        <Checkbox
+          label="User defined only"
+          id="values-details-user-supplied"
+          checked={isUserSupplied}
+          onChange={() => setIsUserSupplied(!isUserSupplied)}
+          data-cy="values-details-user-supplied"
+          className="control-label font-normal"
+          bold={false}
+        />
+      )}
+    </div>
+  );
+}
+
+function DiffWithSpecificRevision({
+  latestRevisionNumber,
+  earliestRevisionNumber,
+  compareRevisionNumber,
+  setCompareRevisionNumber,
+}: {
+  latestRevisionNumber: LatestRevisionNumber;
+  earliestRevisionNumber: EarliestRevisionNumber;
+  compareRevisionNumber: CompareRevisionNumber;
+  setCompareRevisionNumber: (
+    compareRevisionNumber: CompareRevisionNumber
+  ) => void;
+}) {
+  // the revision number is debounced to avoid too many requests to the backend
+  const [
+    debouncedSetCompareRevisionNumber,
+    setDebouncedSetCompareRevisionNumber,
+  ] = useDebounce(compareRevisionNumber, setCompareRevisionNumber, 500);
+
+  return (
+    <>
+      <span>Diff with specific revision:</span>
+      <Input
+        type="number"
+        min={earliestRevisionNumber}
+        max={latestRevisionNumber}
+        value={debouncedSetCompareRevisionNumber}
+        onChange={handleSpecificRevisionChange}
+        className="ml-2 w-20"
+        data-cy="revision-specific-input"
+      />
+    </>
+  );
+
+  function handleSpecificRevisionChange(e: ChangeEvent<HTMLInputElement>) {
+    const inputNumber = e.target.valueAsNumber;
+    // handle out of range values
+    if (inputNumber > latestRevisionNumber) {
+      setCompareRevisionNumber(latestRevisionNumber);
+      return;
+    }
+    if (inputNumber < earliestRevisionNumber) {
+      setCompareRevisionNumber(earliestRevisionNumber);
+      return;
+    }
+    setDebouncedSetCompareRevisionNumber(inputNumber);
+  }
+}
diff --git a/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/DiffViewSection.tsx b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/DiffViewSection.tsx
new file mode 100644
index 0000000..7871cbf
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/DiffViewSection.tsx
@@ -0,0 +1,55 @@
+import { AutomationTestingProps } from '@/types';
+
+import { DiffViewer } from '@@/CodeEditor/DiffViewer';
+import { Loading } from '@@/Widget';
+import { Alert } from '@@/Alert';
+
+import { CompareRevisionNumberFetched, SelectedRevisionNumber } from './types';
+
+interface Props extends AutomationTestingProps {
+  isCompareReleaseLoading: boolean;
+  isCompareReleaseError: boolean;
+  compareRevisionNumberFetched?: CompareRevisionNumberFetched;
+  selectedRevisionNumber: SelectedRevisionNumber;
+  newText: string;
+  originalText: string;
+  id: string;
+}
+
+export function DiffViewSection({
+  isCompareReleaseLoading,
+  isCompareReleaseError,
+  compareRevisionNumberFetched,
+  selectedRevisionNumber,
+  newText,
+  originalText,
+  id,
+  'data-cy': dataCy,
+}: Props) {
+  if (isCompareReleaseLoading) {
+    return <Loading />;
+  }
+
+  if (isCompareReleaseError) {
+    return <Alert color="error">Error loading compare values</Alert>;
+  }
+
+  return (
+    <DiffViewer
+      newCode={newText}
+      originalCode={originalText}
+      id={id}
+      data-cy={dataCy}
+      placeholder="No values found"
+      fileNames={{
+        original: compareRevisionNumberFetched
+          ? `Revision #${compareRevisionNumberFetched}`
+          : 'No revision selected',
+        modified: `Revision #${selectedRevisionNumber}`,
+      }}
+      className="mt-2"
+      type="yaml"
+      height="60vh"
+    />
+  );
+}
diff --git a/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/HelmEventsDatatable.test.tsx b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/HelmEventsDatatable.test.tsx
new file mode 100644
index 0000000..67ff7d1
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/HelmEventsDatatable.test.tsx
@@ -0,0 +1,192 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import { HttpResponse } from 'msw';
+
+import { Event } from '@/react/kubernetes/queries/types';
+import { server, http } from '@/setup-tests/server';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { UserViewModel } from '@/portainer/models/user';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { mockLocalizeDate } from '@/setup-tests/mock-localizeDate';
+
+import { GenericResource } from '../../types';
+
+import {
+  HelmEventsDatatable,
+  filterRelatedEvents,
+} from './HelmEventsDatatable';
+
+const mockUseEnvironmentId = vi.fn();
+mockLocalizeDate();
+
+vi.mock('@/react/hooks/useEnvironmentId', () => ({
+  useEnvironmentId: () => mockUseEnvironmentId(),
+}));
+
+const testResources: GenericResource[] = [
+  {
+    kind: 'Deployment',
+    status: {
+      healthSummary: {
+        status: 'Healthy',
+        reason: 'Running',
+        message: 'All replicas are ready',
+      },
+    },
+    metadata: {
+      name: 'test-deployment',
+      namespace: 'default',
+      uid: 'test-deployment-uid',
+    },
+  },
+  {
+    kind: 'Service',
+    status: {
+      healthSummary: {
+        status: 'Healthy',
+        reason: 'Available',
+        message: 'Service is available',
+      },
+    },
+    metadata: {
+      name: 'test-service',
+      namespace: 'default',
+      uid: 'test-service-uid',
+    },
+  },
+];
+
+const mockEventsResponse: Event[] = [
+  {
+    name: 'test-deployment-123456',
+    namespace: 'default',
+    reason: 'CreatedLoadBalancer',
+    eventTime: new Date('2023-01-01T00:00:00Z'),
+    uid: 'event-uid-1',
+    involvedObject: {
+      kind: 'Deployment',
+      name: 'test-deployment',
+      uid: 'test-deployment-uid',
+      namespace: 'default',
+    },
+    message: 'Scaled up replica set test-deployment-abc123 to 1',
+    firstTimestamp: new Date('2023-01-01T00:00:00Z'),
+    lastTimestamp: new Date('2023-01-01T00:00:00Z'),
+    count: 1,
+    type: 'Normal',
+  },
+  {
+    name: 'test-service-123456',
+    namespace: 'default',
+    uid: 'event-uid-2',
+    eventTime: new Date('2023-01-01T00:00:00Z'),
+    involvedObject: {
+      kind: 'Service',
+      namespace: 'default',
+      name: 'test-service',
+      uid: 'test-service-uid',
+    },
+    reason: 'CreatedLoadBalancer',
+    message: 'Created load balancer',
+    firstTimestamp: new Date('2023-01-01T00:00:00Z'),
+    lastTimestamp: new Date('2023-01-01T00:00:00Z'),
+    count: 1,
+    type: 'Normal',
+  },
+];
+
+const mixedEventsResponse: Event[] = [
+  {
+    name: 'test-deployment-123456',
+    namespace: 'default',
+    uid: 'event-uid-1',
+    eventTime: new Date('2023-01-01T00:00:00Z'),
+    involvedObject: {
+      kind: 'Deployment',
+      namespace: 'default',
+      name: 'test-deployment',
+      uid: 'test-deployment-uid', // This matches a resource UID
+    },
+    reason: 'ScalingReplicaSet',
+    message: 'Scaled up replica set test-deployment-abc123 to 1',
+
+    firstTimestamp: new Date('2023-01-01T00:00:00Z'),
+    lastTimestamp: new Date('2023-01-01T00:00:00Z'),
+    count: 1,
+    type: 'Normal',
+  },
+  {
+    name: 'unrelated-pod-123456',
+    namespace: 'default',
+    uid: 'event-uid-3',
+    eventTime: new Date('2023-01-01T00:00:00Z'),
+    involvedObject: {
+      kind: 'Pod',
+      namespace: 'default',
+      name: 'unrelated-pod',
+      uid: 'unrelated-pod-uid', // This does NOT match any resource UIDs
+    },
+    reason: 'Scheduled',
+    message: 'Successfully assigned unrelated-pod to node',
+    type: 'Normal',
+    firstTimestamp: new Date('2023-01-01T00:00:00Z'),
+    lastTimestamp: new Date('2023-01-01T00:00:00Z'),
+    count: 1,
+  },
+];
+
+function renderComponent() {
+  const user = new UserViewModel({ Username: 'user' });
+  mockUseEnvironmentId.mockReturnValue(3);
+
+  const HelmEventsDatatableWithProviders = withTestQueryProvider(
+    withUserProvider(withTestRouter(HelmEventsDatatable), user)
+  );
+
+  return render(
+    <HelmEventsDatatableWithProviders
+      namespace="default"
+      releaseResources={testResources}
+    />
+  );
+}
+
+describe('HelmEventsDatatable', () => {
+  beforeEach(() => {
+    server.use(
+      http.get(
+        '/api/endpoints/3/kubernetes/api/v1/namespaces/default/events',
+        () => HttpResponse.json(mockEventsResponse)
+      )
+    );
+  });
+
+  it('should render events datatable with correct title', async () => {
+    renderComponent();
+
+    await waitFor(() => {
+      expect(
+        screen.getByText(
+          'Only events for resources currently in the cluster will be displayed.'
+        )
+      ).toBeInTheDocument();
+    });
+
+    expect(screen.getByRole('table')).toBeInTheDocument();
+  });
+
+  it('should correctly filter related events using the filterRelatedEvents function', () => {
+    const filteredEvents = filterRelatedEvents(
+      mixedEventsResponse as Event[],
+      testResources
+    );
+
+    expect(filteredEvents.length).toBe(1);
+    expect(filteredEvents[0].involvedObject.uid).toBe('test-deployment-uid');
+
+    const unrelatedEvents = filteredEvents.filter(
+      (e) => e.involvedObject.uid === 'unrelated-pod-uid'
+    );
+    expect(unrelatedEvents.length).toBe(0);
+  });
+});
diff --git a/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/HelmEventsDatatable.tsx b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/HelmEventsDatatable.tsx
new file mode 100644
index 0000000..9dd161f
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/HelmEventsDatatable.tsx
@@ -0,0 +1,78 @@
+import { compact } from 'lodash';
+
+import { Event } from '@/react/kubernetes/queries/types';
+import { createStore } from '@/react/kubernetes/datatables/default-kube-datatable-store';
+import { EventsDatatable } from '@/react/kubernetes/components/EventsDatatable';
+import { useEvents } from '@/react/kubernetes/queries/useEvents';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+
+import { useTableState } from '@@/datatables/useTableState';
+import { Widget } from '@@/Widget';
+import { TextTip } from '@@/Tip/TextTip';
+
+import { GenericResource } from '../../types';
+
+export const storageKey = 'k8sHelmEventsDatatable';
+export const settingsStore = createStore(storageKey, {
+  id: 'Date',
+  desc: true,
+});
+
+export function HelmEventsDatatable({
+  namespace,
+  releaseResources,
+}: {
+  namespace: string;
+  releaseResources: GenericResource[];
+}) {
+  const environmentId = useEnvironmentId();
+  const tableState = useTableState(settingsStore, storageKey);
+
+  const eventsQuery = useEvents(environmentId, {
+    namespace,
+    queryOptions: {
+      autoRefreshRate: tableState.autoRefreshRate * 1000,
+      select: (data) => filterRelatedEvents(data, releaseResources),
+    },
+  });
+
+  return (
+    <Widget>
+      <EventsDatatable
+        dataset={eventsQuery.data || []}
+        title={
+          <TextTip inline color="blue" className="!text-xs">
+            Only events for resources currently in the cluster will be
+            displayed.
+          </TextTip>
+        }
+        titleIcon={null}
+        tableState={tableState}
+        isLoading={eventsQuery.isInitialLoading}
+        data-cy="k8sAppDetail-eventsTable"
+        // no widget to avoid extra padding from app/react/components/datatables/TableContainer.tsx
+        noWidget
+      />
+    </Widget>
+  );
+}
+
+export function useHelmEventsTableState() {
+  return useTableState(settingsStore, storageKey);
+}
+
+export function filterRelatedEvents(
+  events: Event[],
+  resources: GenericResource[]
+) {
+  const relatedUids = getReleaseUids(resources);
+  const relatedUidsSet = new Set(relatedUids);
+  return events.filter(
+    (event) =>
+      event.involvedObject.uid && relatedUidsSet.has(event.involvedObject.uid)
+  );
+}
+
+function getReleaseUids(resources: GenericResource[]) {
+  return compact(resources.map((resource) => resource.metadata.uid));
+}
diff --git a/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ManifestDetails.tsx b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ManifestDetails.tsx
new file mode 100644
index 0000000..c87ad17
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ManifestDetails.tsx
@@ -0,0 +1,58 @@
+import { ReactNode } from 'react';
+
+import { CodeEditor } from '@@/CodeEditor';
+
+import { DiffViewMode } from './DiffControl';
+import { DiffViewSection } from './DiffViewSection';
+import { SelectedRevisionNumber, CompareRevisionNumberFetched } from './types';
+
+type Props = {
+  manifest: string;
+  selectedRevisionNumber: SelectedRevisionNumber;
+  diffViewMode: DiffViewMode;
+  compareManifest?: string;
+  compareRevisionNumberFetched?: CompareRevisionNumberFetched;
+  isCompareReleaseLoading: boolean;
+  isCompareReleaseError: boolean;
+  diffControl: ReactNode;
+};
+
+export function ManifestDetails({
+  manifest,
+  selectedRevisionNumber,
+  diffViewMode,
+  compareManifest,
+  compareRevisionNumberFetched,
+  isCompareReleaseLoading,
+  isCompareReleaseError,
+  diffControl,
+}: Props) {
+  return (
+    <>
+      {diffControl}
+      {diffViewMode === 'view' ? (
+        <CodeEditor
+          id="helm-manifest"
+          type="yaml"
+          data-cy="helm-manifest"
+          value={manifest}
+          readonly
+          fileName={`Revision #${selectedRevisionNumber}`}
+          placeholder="No manifest found"
+          height="60vh"
+        />
+      ) : (
+        <DiffViewSection
+          isCompareReleaseLoading={isCompareReleaseLoading}
+          isCompareReleaseError={isCompareReleaseError}
+          compareRevisionNumberFetched={compareRevisionNumberFetched}
+          selectedRevisionNumber={selectedRevisionNumber}
+          newText={manifest}
+          originalText={compareManifest ?? ''}
+          id="helm-manifest-diff-viewer"
+          data-cy="helm-manifest-diff-viewer"
+        />
+      )}
+    </>
+  );
+}
diff --git a/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/NotesDetails.tsx b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/NotesDetails.tsx
new file mode 100644
index 0000000..5362974
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/NotesDetails.tsx
@@ -0,0 +1,48 @@
+import Markdown from 'markdown-to-jsx';
+import { ReactNode } from 'react';
+
+import { DiffViewMode } from './DiffControl';
+import { DiffViewSection } from './DiffViewSection';
+import { SelectedRevisionNumber, CompareRevisionNumberFetched } from './types';
+
+type Props = {
+  notes: string;
+  selectedRevisionNumber: SelectedRevisionNumber;
+  diffViewMode: DiffViewMode;
+  compareNotes?: string;
+  compareRevisionNumberFetched?: CompareRevisionNumberFetched;
+  isCompareReleaseLoading: boolean;
+  isCompareReleaseError: boolean;
+  diffControl: ReactNode;
+};
+
+export function NotesDetails({
+  notes,
+  selectedRevisionNumber,
+  diffViewMode,
+  compareNotes,
+  compareRevisionNumberFetched,
+  isCompareReleaseLoading,
+  isCompareReleaseError,
+  diffControl,
+}: Props) {
+  return (
+    <>
+      {diffControl}
+      {diffViewMode === 'view' ? (
+        <Markdown className="mt-6 list-inside">{notes}</Markdown>
+      ) : (
+        <DiffViewSection
+          isCompareReleaseLoading={isCompareReleaseLoading}
+          isCompareReleaseError={isCompareReleaseError}
+          compareRevisionNumberFetched={compareRevisionNumberFetched}
+          selectedRevisionNumber={selectedRevisionNumber}
+          newText={notes}
+          originalText={compareNotes ?? ''}
+          id="helm-notes-diff-viewer"
+          data-cy="helm-notes-diff-viewer"
+        />
+      )}
+    </>
+  );
+}
diff --git a/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ReleaseTabs.tsx b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ReleaseTabs.tsx
new file mode 100644
index 0000000..d8a84a2
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ReleaseTabs.tsx
@@ -0,0 +1,282 @@
+import { useState } from 'react';
+import { compact } from 'lodash';
+import { useCurrentStateAndParams, useRouter } from '@uirouter/react';
+import { AlertTriangle } from 'lucide-react';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useEvents } from '@/react/kubernetes/queries/useEvents';
+
+import { NavTabs, Option } from '@@/NavTabs';
+import { Badge } from '@@/Badge';
+import { Icon } from '@@/Icon';
+
+import { HelmRelease } from '../../types';
+import { useHelmHistory } from '../../helmReleaseQueries/useHelmHistory';
+
+import { ManifestDetails } from './ManifestDetails';
+import { NotesDetails } from './NotesDetails';
+import { ValuesDetails } from './ValuesDetails';
+import { ResourcesTable } from './ResourcesTable/ResourcesTable';
+import { DiffControl, DiffViewMode } from './DiffControl';
+import { useHelmReleaseToCompare } from './useHelmReleaseToCompare';
+import {
+  filterRelatedEvents,
+  HelmEventsDatatable,
+  useHelmEventsTableState,
+} from './HelmEventsDatatable';
+
+type Props = {
+  release: HelmRelease;
+  selectedRevision: number;
+};
+
+type Tab = 'values' | 'notes' | 'manifest' | 'resources' | 'events';
+
+export function ReleaseTabs({ release, selectedRevision }: Props) {
+  const {
+    params: { tab },
+  } = useCurrentStateAndParams();
+  const router = useRouter();
+  const environmentId = useEnvironmentId();
+  // state is here so that the state isn't lost when the tab changes
+  const [isUserSupplied, setIsUserSupplied] = useState(true);
+  // start with NaN so that the input is empty (see <Input /> for more details)
+  const [selectedCompareRevisionNumber, setSelectedCompareRevisionNumber] =
+    useState(NaN);
+  const [diffViewMode, setDiffViewMode] = useState<DiffViewMode>('view');
+
+  const historyQuery = useHelmHistory(
+    environmentId,
+    release.name,
+    release.namespace ?? ''
+  );
+  const earliestRevisionNumber =
+    historyQuery.data?.[historyQuery.data.length - 1]?.version ??
+    release.version ??
+    1;
+  const latestRevisionNumber =
+    historyQuery.data?.[0]?.version ?? release.version ?? 1;
+  const { compareRelease, isCompareReleaseLoading, isCompareReleaseError } =
+    useHelmReleaseToCompare(
+      release,
+      earliestRevisionNumber,
+      latestRevisionNumber,
+      diffViewMode,
+      selectedRevision,
+      selectedCompareRevisionNumber
+    );
+
+  const { autoRefreshRate } = useHelmEventsTableState();
+  const { data: eventWarningCount } = useEvents(environmentId, {
+    namespace: release.namespace ?? '',
+    queryOptions: {
+      autoRefreshRate: autoRefreshRate * 1000,
+      select: (data) => {
+        const relatedEvents = filterRelatedEvents(
+          data,
+          release.info?.resources ?? []
+        );
+        return relatedEvents.filter((e) => e.type === 'Warning').length;
+      },
+    },
+  });
+
+  return (
+    <NavTabs<Tab>
+      onSelect={setTab}
+      selectedId={parseValidTab(tab, !!release.info?.notes)}
+      type="pills"
+      justified
+      options={helmTabs(
+        release,
+        isUserSupplied,
+        setIsUserSupplied,
+        earliestRevisionNumber,
+        latestRevisionNumber,
+        selectedRevision,
+        selectedCompareRevisionNumber,
+        setSelectedCompareRevisionNumber,
+        diffViewMode,
+        handleDiffViewChange,
+        isCompareReleaseLoading,
+        isCompareReleaseError,
+        eventWarningCount ?? 0,
+        compareRelease
+      )}
+    />
+  );
+
+  function handleDiffViewChange(diffViewMode: DiffViewMode) {
+    setDiffViewMode(diffViewMode);
+
+    if (latestRevisionNumber === earliestRevisionNumber) {
+      return;
+    }
+
+    // if the input for compare revision number is NaN, set it to the previous revision number
+    if (
+      Number.isNaN(selectedCompareRevisionNumber) &&
+      diffViewMode === 'specific'
+    ) {
+      if (selectedRevision > earliestRevisionNumber) {
+        setSelectedCompareRevisionNumber(selectedRevision - 1);
+        return;
+      }
+      // it could be useful to compare to the latest revision number if the selected revision number is the earliest revision number
+      setSelectedCompareRevisionNumber(latestRevisionNumber);
+    }
+  }
+
+  function setTab(tab: Tab) {
+    router.stateService.go('kubernetes.helm', {
+      tab,
+    });
+  }
+}
+
+function helmTabs(
+  release: HelmRelease,
+  isUserSupplied: boolean,
+  setIsUserSupplied: (isUserSupplied: boolean) => void,
+  earliestRevisionNumber: number,
+  latestRevisionNumber: number,
+  selectedRevisionNumber: number,
+  compareRevisionNumber: number,
+  setCompareRevisionNumber: (compareRevisionNumber: number) => void,
+  diffViewMode: DiffViewMode,
+  setDiffViewMode: (diffViewMode: DiffViewMode) => void,
+  isCompareReleaseLoading: boolean,
+  isCompareReleaseError: boolean,
+  eventWarningCount: number,
+  compareRelease?: HelmRelease
+): Option<Tab>[] {
+  // as long as the latest revision number is greater than the earliest revision number, there are changes to compare
+  const showDiffControl = latestRevisionNumber > earliestRevisionNumber;
+
+  return compact([
+    {
+      label: 'Resources',
+      id: 'resources',
+      children: <ResourcesTable />,
+    },
+    {
+      label: (
+        <>
+          Events
+          {eventWarningCount >= 1 && (
+            <Badge type="warnSecondary">
+              <Icon icon={AlertTriangle} className="!mr-1" />
+              {eventWarningCount}
+            </Badge>
+          )}
+        </>
+      ),
+      id: 'events',
+      children: (
+        <HelmEventsDatatable
+          namespace={release.namespace ?? ''}
+          releaseResources={release.info?.resources ?? []}
+        />
+      ),
+    },
+    {
+      label: 'Values',
+      id: 'values',
+      children: (
+        <ValuesDetails
+          values={release.values}
+          isUserSupplied={isUserSupplied}
+          selectedRevisionNumber={selectedRevisionNumber}
+          diffViewMode={diffViewMode}
+          compareValues={compareRelease?.values}
+          compareRevisionNumberFetched={compareRelease?.version}
+          isCompareReleaseLoading={isCompareReleaseLoading}
+          isCompareReleaseError={isCompareReleaseError}
+          diffControl={
+            <DiffControl
+              selectedRevisionNumber={selectedRevisionNumber}
+              latestRevisionNumber={latestRevisionNumber}
+              earliestRevisionNumber={earliestRevisionNumber}
+              compareRevisionNumber={compareRevisionNumber}
+              setCompareRevisionNumber={setCompareRevisionNumber}
+              diffViewMode={diffViewMode}
+              setDiffViewMode={setDiffViewMode}
+              isUserSupplied={isUserSupplied}
+              setIsUserSupplied={setIsUserSupplied}
+              showUserSuppliedCheckbox
+            />
+          }
+        />
+      ),
+    },
+    {
+      label: 'Manifest',
+      id: 'manifest',
+      children: (
+        <ManifestDetails
+          manifest={release.manifest}
+          selectedRevisionNumber={selectedRevisionNumber}
+          diffViewMode={diffViewMode}
+          compareManifest={compareRelease?.manifest}
+          compareRevisionNumberFetched={compareRelease?.version}
+          isCompareReleaseLoading={isCompareReleaseLoading}
+          isCompareReleaseError={isCompareReleaseError}
+          diffControl={
+            showDiffControl && (
+              <DiffControl
+                selectedRevisionNumber={selectedRevisionNumber}
+                latestRevisionNumber={latestRevisionNumber}
+                earliestRevisionNumber={earliestRevisionNumber}
+                compareRevisionNumber={compareRevisionNumber}
+                setCompareRevisionNumber={setCompareRevisionNumber}
+                diffViewMode={diffViewMode}
+                setDiffViewMode={setDiffViewMode}
+              />
+            )
+          }
+        />
+      ),
+    },
+    !!release.info?.notes && {
+      label: 'Notes',
+      id: 'notes',
+      children: (
+        <NotesDetails
+          notes={release.info.notes}
+          selectedRevisionNumber={selectedRevisionNumber}
+          diffViewMode={diffViewMode}
+          compareNotes={compareRelease?.info?.notes}
+          compareRevisionNumberFetched={compareRelease?.version}
+          isCompareReleaseLoading={isCompareReleaseLoading}
+          isCompareReleaseError={isCompareReleaseError}
+          diffControl={
+            showDiffControl && (
+              <DiffControl
+                selectedRevisionNumber={selectedRevisionNumber}
+                latestRevisionNumber={latestRevisionNumber}
+                earliestRevisionNumber={earliestRevisionNumber}
+                compareRevisionNumber={compareRevisionNumber}
+                setCompareRevisionNumber={setCompareRevisionNumber}
+                diffViewMode={diffViewMode}
+                setDiffViewMode={setDiffViewMode}
+              />
+            )
+          }
+        />
+      ),
+    },
+  ]);
+}
+
+function parseValidTab(tab: string, hasNotes: boolean): Tab {
+  if (
+    tab === 'values' ||
+    (tab === 'notes' && hasNotes) ||
+    tab === 'manifest' ||
+    tab === 'resources' ||
+    tab === 'events'
+  ) {
+    return tab;
+  }
+  return 'resources';
+}
diff --git a/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ResourcesTable/DescribeModal.test.tsx b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ResourcesTable/DescribeModal.test.tsx
new file mode 100644
index 0000000..4442ca8
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ResourcesTable/DescribeModal.test.tsx
@@ -0,0 +1,133 @@
+import { render, screen } from '@testing-library/react';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+
+import { DescribeModal } from './DescribeModal';
+
+const mockUseDescribeResource = vi.fn();
+
+// Mock the CodeEditor component instead of yaml-schema
+vi.mock('@@/CodeEditor', () => ({
+  CodeEditor: ({
+    value,
+    'data-cy': dataCy,
+  }: {
+    value: string;
+    'data-cy'?: string;
+  }) => <div data-cy={dataCy}>{value}</div>,
+}));
+
+vi.mock('./queries/useDescribeResource', () => ({
+  useDescribeResource: (...args: unknown[]) => mockUseDescribeResource(...args),
+}));
+
+function renderComponent({
+  name = 'test-resource',
+  resourceType = 'Deployment',
+  namespace = 'default',
+  onDismiss = vi.fn(),
+} = {}) {
+  const Wrapped = withTestQueryProvider(DescribeModal);
+  return render(
+    <Wrapped
+      name={name}
+      resourceType={resourceType}
+      namespace={namespace}
+      onDismiss={onDismiss}
+    />
+  );
+}
+
+describe('DescribeModal', () => {
+  beforeEach(() => {
+    mockUseDescribeResource.mockReset();
+  });
+
+  it('should display loading state initially', () => {
+    mockUseDescribeResource.mockReturnValue({
+      isLoading: true,
+      data: undefined,
+      isError: false,
+    });
+
+    renderComponent();
+    expect(screen.getByText('Loading...')).toBeInTheDocument();
+  });
+
+  it('should display resource details when data is loaded successfully', () => {
+    const mockDescribeData = {
+      describe: 'Name: test-resource\nNamespace: default\nStatus: Running',
+    };
+
+    mockUseDescribeResource.mockReturnValue({
+      isLoading: false,
+      data: mockDescribeData,
+      isError: false,
+    });
+
+    renderComponent();
+
+    // Check for modal title
+    expect(screen.getByText('Describe Deployment')).toBeInTheDocument();
+
+    // Check for content
+    const editor = screen.getByTestId('describe-resource');
+    expect(editor).toBeInTheDocument();
+    expect(editor).toHaveTextContent('Name: test-resource');
+    expect(editor).toHaveTextContent('Namespace: default');
+    expect(editor).toHaveTextContent('Status: Running');
+  });
+
+  it('should display error message when query fails', () => {
+    mockUseDescribeResource.mockReturnValue({
+      isLoading: false,
+      data: undefined,
+      isError: true,
+    });
+
+    renderComponent();
+
+    expect(
+      screen.getByText('Error loading resource details')
+    ).toBeInTheDocument();
+  });
+
+  it('should call onDismiss when modal is closed', () => {
+    mockUseDescribeResource.mockReturnValue({
+      isLoading: false,
+      data: { describe: '' },
+      isError: false,
+    });
+
+    const onDismiss = vi.fn();
+    renderComponent({ onDismiss });
+
+    // Find and click the close button
+    const closeButton = screen.getByText('×');
+    closeButton.click();
+
+    expect(onDismiss).toHaveBeenCalled();
+  });
+
+  it('should pass correct parameters to useDescribeResource', () => {
+    mockUseDescribeResource.mockReturnValue({
+      isLoading: true,
+      data: undefined,
+      isError: false,
+    });
+
+    const props = {
+      name: 'my-resource',
+      resourceType: 'Pod',
+      namespace: 'kube-system',
+    };
+
+    renderComponent(props);
+
+    expect(mockUseDescribeResource).toHaveBeenCalledWith(
+      props.name,
+      props.resourceType,
+      props.namespace
+    );
+  });
+});
diff --git a/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ResourcesTable/DescribeModal.tsx b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ResourcesTable/DescribeModal.tsx
new file mode 100644
index 0000000..f75fbf8
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ResourcesTable/DescribeModal.tsx
@@ -0,0 +1,57 @@
+import { Alert } from '@@/Alert';
+import { InlineLoader } from '@@/InlineLoader';
+import { Modal } from '@@/modals';
+import { ModalBody } from '@@/modals/Modal/ModalBody';
+import { ModalHeader } from '@@/modals/Modal/ModalHeader';
+import { CodeEditor } from '@@/CodeEditor';
+
+import { useDescribeResource } from './queries/useDescribeResource';
+
+type Props = {
+  name: string;
+  resourceType?: string;
+  namespace?: string;
+  onDismiss: () => void;
+};
+
+export function DescribeModal({
+  name,
+  resourceType,
+  namespace,
+  onDismiss,
+}: Props) {
+  const title = `Describe ${resourceType}`;
+
+  const { data, isLoading, isError } = useDescribeResource(
+    name,
+    resourceType,
+    namespace
+  );
+
+  return (
+    <Modal onDismiss={onDismiss} size="lg" aria-label={title}>
+      <ModalHeader title={title} />
+      <ModalBody>
+        {isLoading ? (
+          <InlineLoader>Loading...</InlineLoader>
+        ) : (
+          <>
+            {isError ? (
+              <Alert color="error" title="Error">
+                Error loading resource details
+              </Alert>
+            ) : (
+              <CodeEditor
+                id="describe-resource"
+                data-cy="describe-resource"
+                readonly
+                value={data?.describe}
+                type="yaml"
+              />
+            )}
+          </>
+        )}
+      </ModalBody>
+    </Modal>
+  );
+}
diff --git a/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ResourcesTable/ResourcesTable.test.tsx b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ResourcesTable/ResourcesTable.test.tsx
new file mode 100644
index 0000000..100b68f
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ResourcesTable/ResourcesTable.test.tsx
@@ -0,0 +1,191 @@
+import { render, screen, cleanup } from '@testing-library/react';
+import { describe, it, expect, vi, afterEach } from 'vitest';
+
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { GenericResource } from '@/react/kubernetes/helm/types';
+
+import { ResourcesTable } from './ResourcesTable';
+
+// Mock the necessary hooks
+const mockUseCurrentStateAndParams = vi.fn();
+const mockUseEnvironmentId = vi.fn();
+const mockUseHelmRelease = vi.fn();
+
+vi.mock('@uirouter/react', async (importOriginal: () => Promise<object>) => ({
+  ...(await importOriginal()),
+  useCurrentStateAndParams: () => mockUseCurrentStateAndParams(),
+}));
+
+vi.mock('@/react/hooks/useEnvironmentId', () => ({
+  useEnvironmentId: () => mockUseEnvironmentId(),
+}));
+
+vi.mock('@/react/kubernetes/helm/helmReleaseQueries/useHelmRelease', () => ({
+  useHelmRelease: () => mockUseHelmRelease(),
+}));
+
+const successResources = [
+  {
+    kind: 'ValidatingWebhookConfiguration',
+    apiVersion: 'admissionregistration.k8s.io/v1',
+    metadata: {
+      name: 'ingress-nginx-1743063493-admission',
+      uid: 'e5388792-c184-479d-9133-390759c4bded',
+      labels: {
+        'app.kubernetes.io/name': 'ingress-nginx',
+      },
+    },
+    status: {
+      healthSummary: {
+        status: 'Healthy',
+        reason: 'Exists',
+      },
+    },
+  },
+  {
+    kind: 'Deployment',
+    apiVersion: 'apps/v1',
+    metadata: {
+      name: 'ingress-nginx-1743063493-controller2',
+      namespace: 'default',
+      uid: 'dcfe325b-7065-47ed-91e3-47f60301cf2e',
+      labels: {
+        'app.kubernetes.io/name': 'ingress-nginx',
+      },
+    },
+    status: {
+      healthSummary: {
+        status: 'Healthy',
+        reason: 'MinimumReplicasAvailable',
+        message: 'Deployment has minimum availability.',
+      },
+    },
+  },
+  {
+    kind: 'Pod',
+    apiVersion: 'v1',
+    metadata: {
+      name: 'ingress-nginx-1743063493-controller2-54d8f7d8c5-lsf9p',
+      generateName: 'ingress-nginx-1743063493-controller2-54d8f7d8c5-',
+      namespace: 'default',
+      uid: '7176ad7c-0f83-4a65-a45e-d40076adc302',
+      labels: {
+        'app.kubernetes.io/name': 'ingress-nginx',
+        'pod-template-hash': '54d8f7d8c5',
+      },
+    },
+    status: {
+      phase: 'Running',
+      healthSummary: {
+        status: 'Unknown',
+        reason: 'Running',
+      },
+      hostIP: '198.19.249.2',
+      startTime: '2025-03-27T20:39:05Z',
+    },
+  },
+];
+const failedResources = [
+  {
+    kind: 'PodDisruptionBudget',
+    metadata: {
+      name: 'probe-failure-nginx-bad',
+      namespace: 'my-namespace',
+      uid: 'e4e15f7a-9a68-448e-86b3-d74ef29c718c',
+      labels: {
+        'app.kubernetes.io/name': 'nginx',
+      },
+    },
+    status: {
+      healthSummary: {
+        status: 'Unhealthy',
+        reason: 'InsufficientPods',
+      },
+    },
+  },
+  {
+    kind: 'Service',
+    apiVersion: 'v1',
+    metadata: {
+      name: 'probe-failure-nginx',
+      namespace: 'my-namespace',
+      uid: 'de9cdffc-6af8-43b2-9750-3ac764b25627',
+      labels: {
+        'app.kubernetes.io/name': 'nginx',
+      },
+    },
+    status: {
+      healthSummary: {
+        status: 'Healthy',
+        reason: 'Exists',
+      },
+    },
+  },
+];
+
+function renderResourcesTable(resources: GenericResource[]) {
+  // Setup mock return values
+  mockUseEnvironmentId.mockReturnValue(3);
+  mockUseCurrentStateAndParams.mockReturnValue({
+    params: {
+      name: 'test-release',
+      namespace: 'default',
+    },
+  });
+  mockUseHelmRelease.mockReturnValue({
+    data: {
+      info: {
+        resources,
+      },
+    },
+    isLoading: false,
+    error: null,
+  });
+
+  const Wrapped = withTestQueryProvider(withTestRouter(ResourcesTable));
+  return render(<Wrapped />);
+}
+
+afterEach(() => {
+  cleanup();
+  vi.clearAllMocks();
+});
+
+describe('ResourcesTable', () => {
+  it('should show successful resources, including a link for the deployment and a message', () => {
+    renderResourcesTable(successResources);
+
+    // Check that the deployment is rendered with a link
+    const deploymentLink = screen.getByText(
+      'ingress-nginx-1743063493-controller2'
+    );
+    expect(deploymentLink).toBeInTheDocument();
+    expect(deploymentLink.closest('a')).toHaveTextContent(
+      'ingress-nginx-1743063493-controller2'
+    );
+
+    // Check that success badge is rendered
+    const successBadge = screen.getByText(
+      (content, element) =>
+        content.includes('MinimumReplicasAvailable') &&
+        element !== null &&
+        element.className.includes('bg-success')
+    );
+    expect(successBadge).toBeInTheDocument();
+  });
+
+  it('should show error badges for failed resources', () => {
+    renderResourcesTable(failedResources);
+    expect(screen.getByText('probe-failure-nginx-bad')).toBeInTheDocument();
+
+    // Check for the unhealthy status badge and make sure it has the error styling
+    const errorBadge = screen.getByText(
+      (content, element) =>
+        content.includes('InsufficientPods') &&
+        element !== null &&
+        element.className.includes('bg-error')
+    );
+    expect(errorBadge).toBeInTheDocument();
+  });
+});
diff --git a/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ResourcesTable/ResourcesTable.tsx b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ResourcesTable/ResourcesTable.tsx
new file mode 100644
index 0000000..e661e96
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ResourcesTable/ResourcesTable.tsx
@@ -0,0 +1,78 @@
+import { useCurrentStateAndParams } from '@uirouter/react';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useHelmRelease } from '@/react/kubernetes/helm/helmReleaseQueries/useHelmRelease';
+
+import { Datatable, TableSettingsMenu } from '@@/datatables';
+import {
+  createPersistedStore,
+  refreshableSettings,
+  TableSettingsWithRefreshable,
+} from '@@/datatables/types';
+import { useTableState } from '@@/datatables/useTableState';
+import { Widget } from '@@/Widget';
+import { TableSettingsMenuAutoRefresh } from '@@/datatables/TableSettingsMenuAutoRefresh';
+import { TextTip } from '@@/Tip/TextTip';
+
+import { columns } from './columns';
+import { useResourceRows } from './useResourceRows';
+
+const storageKey = 'helm-resources';
+
+export function createStore(storageKey: string) {
+  return createPersistedStore<TableSettingsWithRefreshable>(
+    storageKey,
+    'name',
+    (set) => ({
+      ...refreshableSettings(set),
+    })
+  );
+}
+
+const settingsStore = createStore('helm-resources');
+
+export function ResourcesTable() {
+  const environmentId = useEnvironmentId();
+  const { params } = useCurrentStateAndParams();
+  const { name, namespace, revision } = params;
+  const revisionNumber = revision ? parseInt(revision, 10) : undefined;
+
+  const tableState = useTableState(settingsStore, storageKey);
+  const helmReleaseQuery = useHelmRelease(environmentId, name, namespace, {
+    showResources: true,
+    refetchInterval: tableState.autoRefreshRate * 1000,
+    revision: revisionNumber,
+  });
+  const rows = useResourceRows(helmReleaseQuery.data?.info?.resources);
+
+  return (
+    <Widget>
+      <Datatable
+        // no widget to avoid extra padding from app/react/components/datatables/TableContainer.tsx
+        noWidget
+        isLoading={helmReleaseQuery.isLoading}
+        dataset={rows}
+        columns={columns}
+        includeSearch
+        settingsManager={tableState}
+        emptyContentLabel="No resources found"
+        title={
+          <TextTip inline color="blue" className="!text-xs">
+            Only resources currently in the cluster will be displayed.
+          </TextTip>
+        }
+        disableSelect
+        getRowId={(row) => row.id}
+        data-cy="helm-resources-datatable"
+        renderTableSettings={() => (
+          <TableSettingsMenu>
+            <TableSettingsMenuAutoRefresh
+              value={tableState.autoRefreshRate}
+              onChange={(value) => tableState.setAutoRefreshRate(value)}
+            />
+          </TableSettingsMenu>
+        )}
+      />
+    </Widget>
+  );
+}
diff --git a/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ResourcesTable/columns/actions.tsx b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ResourcesTable/columns/actions.tsx
new file mode 100644
index 0000000..122e392
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ResourcesTable/columns/actions.tsx
@@ -0,0 +1,46 @@
+import { useState } from 'react';
+import { CellContext } from '@tanstack/react-table';
+import { FileText } from 'lucide-react';
+
+import { Button } from '@@/buttons';
+import { Icon } from '@@/Icon';
+
+import { ResourceRow } from '../types';
+import { DescribeModal } from '../DescribeModal';
+
+import { columnHelper } from './helper';
+
+export const actions = columnHelper.accessor((row) => row.status.label, {
+  header: 'Actions',
+  id: 'actions',
+  cell: Cell,
+  enableSorting: false,
+});
+
+function Cell({ row }: CellContext<ResourceRow, string>) {
+  const { describe } = row.original;
+  const [modalOpen, setModalOpen] = useState(false);
+
+  return (
+    <>
+      <Button
+        color="link"
+        data-cy="helm-resource-describe"
+        onClick={() => setModalOpen(true)}
+        className="!ml-0 pl-0"
+      >
+        <Icon icon={FileText} />
+        Describe
+      </Button>
+
+      {modalOpen && (
+        <DescribeModal
+          name={describe.name}
+          resourceType={describe.resourceType}
+          namespace={describe.namespace}
+          onDismiss={() => setModalOpen(false)}
+        />
+      )}
+    </>
+  );
+}
diff --git a/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ResourcesTable/columns/helper.ts b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ResourcesTable/columns/helper.ts
new file mode 100644
index 0000000..4ba2602
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ResourcesTable/columns/helper.ts
@@ -0,0 +1,5 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { ResourceRow } from '../types';
+
+export const columnHelper = createColumnHelper<ResourceRow>();
diff --git a/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ResourcesTable/columns/index.ts b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ResourcesTable/columns/index.ts
new file mode 100644
index 0000000..3f40e40
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ResourcesTable/columns/index.ts
@@ -0,0 +1,7 @@
+import { name } from './name';
+import { resourceType } from './resourceType';
+import { status } from './status';
+import { statusMessage } from './statusMessage';
+import { actions } from './actions';
+
+export const columns = [name, resourceType, status, statusMessage, actions];
diff --git a/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ResourcesTable/columns/name.tsx b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ResourcesTable/columns/name.tsx
new file mode 100644
index 0000000..0b8c2aa
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ResourcesTable/columns/name.tsx
@@ -0,0 +1,37 @@
+import { CellContext } from '@tanstack/react-table';
+
+import { Link } from '@@/Link';
+
+import { ResourceRow } from '../types';
+
+import { columnHelper } from './helper';
+
+// `${row.name.label}/${row.resourceType}` reduces shuffling when the name is the same but the resourceType is different
+export const name = columnHelper.accessor(
+  (row) => `${row.name.label}/${row.resourceType}`,
+  {
+    header: 'Name',
+    cell: Cell,
+    id: 'name',
+  }
+);
+
+function Cell({ row }: CellContext<ResourceRow, string>) {
+  const { name } = row.original;
+
+  if (name.link && name.link.to) {
+    return (
+      <Link
+        to={name.link.to}
+        params={name.link.params}
+        title={name.label}
+        className="w-fit max-w-xs truncate xl:max-w-sm 2xl:max-w-md"
+        data-cy={`helm-resource-link-${name.label}`}
+      >
+        {name.label}
+      </Link>
+    );
+  }
+
+  return name.label;
+}
diff --git a/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ResourcesTable/columns/resourceType.tsx b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ResourcesTable/columns/resourceType.tsx
new file mode 100644
index 0000000..aec7783
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ResourcesTable/columns/resourceType.tsx
@@ -0,0 +1,20 @@
+import { Row } from '@tanstack/react-table';
+
+import { filterHOC } from '@@/datatables/Filter';
+
+import { ResourceRow } from '../types';
+
+import { columnHelper } from './helper';
+
+export const resourceType = columnHelper.accessor((row) => row.resourceType, {
+  header: 'Resource type',
+  id: 'resourceType',
+  meta: {
+    filter: filterHOC('Filter by resource type'),
+  },
+  enableColumnFilter: true,
+  filterFn: (row: Row<ResourceRow>, _: string, filterValue: string[]) =>
+    filterValue.length === 0 ||
+    (!!row.original.resourceType &&
+      filterValue.includes(row.original.resourceType)),
+});
diff --git a/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ResourcesTable/columns/status.tsx b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ResourcesTable/columns/status.tsx
new file mode 100644
index 0000000..1e7bbb8
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ResourcesTable/columns/status.tsx
@@ -0,0 +1,38 @@
+import { CellContext, Row } from '@tanstack/react-table';
+
+import { StatusBadge } from '@@/StatusBadge';
+import { filterHOC } from '@@/datatables/Filter';
+
+import { ResourceRow } from '../types';
+
+import { columnHelper } from './helper';
+
+export const status = columnHelper.accessor((row) => row.status.label, {
+  header: 'Status',
+  id: 'status',
+  cell: Cell,
+  meta: {
+    filter: filterHOC(
+      'Filter by status',
+      // don't include empty values in the filter options
+      (rows: Row<ResourceRow>[]) =>
+        Array.from(
+          new Set(rows.map((row) => row.original.status.label).filter(Boolean))
+        )
+    ),
+  },
+  enableColumnFilter: true,
+  filterFn: (row: Row<ResourceRow>, _: string, filterValue: string[]) =>
+    filterValue.length === 0 ||
+    (!!row.original.status.label &&
+      filterValue.includes(row.original.status.label)),
+});
+
+function Cell({ row }: CellContext<ResourceRow, string>) {
+  const { status } = row.original;
+  if (!status.label) {
+    return '-';
+  }
+
+  return <StatusBadge color={status.type}>{status.label}</StatusBadge>;
+}
diff --git a/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ResourcesTable/columns/statusMessage.tsx b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ResourcesTable/columns/statusMessage.tsx
new file mode 100644
index 0000000..5b5b813
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ResourcesTable/columns/statusMessage.tsx
@@ -0,0 +1,11 @@
+import { columnHelper } from './helper';
+
+export const statusMessage = columnHelper.accessor((row) => row.statusMessage, {
+  header: 'Status message',
+  id: 'statusMessage',
+  cell: ({ row }) => (
+    <div className="whitespace-pre-wrap">
+      <span>{row.original.statusMessage || '-'}</span>
+    </div>
+  ),
+});
diff --git a/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ResourcesTable/queries/useDescribeResource.ts b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ResourcesTable/queries/useDescribeResource.ts
new file mode 100644
index 0000000..40326c1
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ResourcesTable/queries/useDescribeResource.ts
@@ -0,0 +1,62 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+
+type DescribeAPIParams = {
+  name: string;
+  kind: string;
+  namespace?: string;
+};
+
+type DescribeResourceResponse = {
+  describe: string;
+};
+
+async function getDescribeResource(
+  environmentId: number,
+  name: string,
+  resourceType?: string,
+  namespace?: string
+) {
+  try {
+    // This should never happen, but to keep the linter happy...
+    if (!name || !resourceType) {
+      throw new Error('Name and kind are required');
+    }
+
+    const params: DescribeAPIParams = {
+      name,
+      namespace,
+      kind: resourceType,
+    };
+
+    const { data } = await axios.get<DescribeResourceResponse>(
+      `kubernetes/${environmentId}/describe`,
+      {
+        params,
+      }
+    );
+    return data;
+  } catch (err) {
+    throw parseAxiosError(err, 'Unable to retrieve resource details');
+  }
+}
+
+export function useDescribeResource(
+  name: string,
+  resourceType?: string,
+  namespace?: string
+) {
+  const environmentId = useEnvironmentId();
+
+  return useQuery(
+    [environmentId, 'kubernetes', 'describe', namespace, resourceType, name],
+    () => getDescribeResource(environmentId, name, resourceType, namespace),
+    {
+      enabled: !!environmentId && !!name && !!resourceType,
+      ...withError('Enable to retrieve data for resource'),
+    }
+  );
+}
diff --git a/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ResourcesTable/types.ts b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ResourcesTable/types.ts
new file mode 100644
index 0000000..ebc1bc1
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ResourcesTable/types.ts
@@ -0,0 +1,27 @@
+import { StatusBadgeType } from '@@/StatusBadge';
+
+export type ResourceLink = {
+  to?: string;
+  params?: Record<string, string>;
+};
+
+export type ResourceRow = {
+  // for the table row id
+  id: string;
+  // for the table row name (link to resource if available)
+  name: {
+    label: string;
+    link: ResourceLink | null;
+  };
+  resourceType: string;
+  describe: {
+    name: string;
+    resourceType?: string;
+    namespace?: string;
+  };
+  status: {
+    label: string;
+    type: StatusBadgeType;
+  };
+  statusMessage: string;
+};
diff --git a/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ResourcesTable/useResourceRows.ts b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ResourcesTable/useResourceRows.ts
new file mode 100644
index 0000000..c16b0e8
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ResourcesTable/useResourceRows.ts
@@ -0,0 +1,97 @@
+import { useMemo } from 'react';
+
+import { GenericResource } from '@/react/kubernetes/helm/types';
+
+import { StatusBadgeType } from '@@/StatusBadge';
+
+import { ResourceLink, ResourceRow } from './types';
+
+// from defined routes in app/kubernetes/__module.js
+const kindToUrlMap = {
+  Deployment: 'kubernetes.applications.application',
+  DaemonSet: 'kubernetes.applications.application',
+  StatefulSet: 'kubernetes.applications.application',
+  Pod: 'kubernetes.applications.application',
+  Ingress: 'kubernetes.ingresses',
+  ConfigMap: 'kubernetes.configmaps.configmap',
+  Secret: 'kubernetes.secrets.secret',
+  PersistentVolumeClaim: 'kubernetes.volumes.volume',
+};
+
+const statusToColorMap: Record<string, StatusBadgeType> = {
+  Healthy: 'success',
+  Progressing: 'warning',
+  Degraded: 'danger',
+  Failed: 'danger',
+  Unhealthy: 'danger',
+  Unknown: 'mutedLite',
+};
+
+export function useResourceRows(resources?: GenericResource[]): ResourceRow[] {
+  return useMemo(() => getResourceRows(resources), [resources]);
+}
+
+function getResourceRows(resources?: GenericResource[]): ResourceRow[] {
+  if (!resources) {
+    return [];
+  }
+
+  return resources.map(getResourceRow);
+}
+
+function getResourceRow(resource: GenericResource): ResourceRow {
+  const {
+    reason = '',
+    status = '',
+    message = '',
+  } = resource.status.healthSummary || {};
+
+  return {
+    id: `${resource.kind}/${resource.metadata.name}/${resource.metadata.namespace}`,
+    name: {
+      label: resource.metadata.name,
+      link: getResourceLink(resource),
+    },
+    resourceType: resource.kind ?? '-',
+    describe: {
+      name: resource.metadata.name,
+      namespace: resource.metadata.namespace,
+      resourceType: resource.kind,
+    },
+    status: {
+      label: reason ?? 'Unknown',
+      type: statusToColorMap[status] ?? 'default',
+    },
+    statusMessage: message ?? '-',
+  };
+}
+
+function getResourceLink(resource: GenericResource): ResourceLink | null {
+  const { namespace, name } = resource.metadata;
+
+  const to = kindToUrlMap[resource.kind as keyof typeof kindToUrlMap];
+
+  // If the resource kind is not supported, return null
+  if (!to) {
+    return null;
+  }
+
+  // If the resource is not namespaced, return the link to the resource with the name only
+  if (!namespace) {
+    return {
+      to,
+      params: {
+        name,
+      },
+    };
+  }
+
+  // If the resource is namespaced, return the link to the resource with the namespace and name
+  return {
+    to,
+    params: {
+      namespace,
+      name,
+    },
+  };
+}
diff --git a/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ValuesDetails.tsx b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ValuesDetails.tsx
new file mode 100644
index 0000000..6aea145
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ValuesDetails.tsx
@@ -0,0 +1,74 @@
+import { ReactNode } from 'react';
+
+import { CodeEditor } from '@@/CodeEditor';
+
+import { Values } from '../../types';
+
+import { DiffViewMode } from './DiffControl';
+import { DiffViewSection } from './DiffViewSection';
+import { SelectedRevisionNumber, CompareRevisionNumberFetched } from './types';
+
+interface Props {
+  values?: Values;
+  isUserSupplied: boolean;
+  selectedRevisionNumber: SelectedRevisionNumber;
+  diffViewMode: DiffViewMode;
+  compareValues?: Values;
+  compareRevisionNumberFetched?: CompareRevisionNumberFetched;
+  isCompareReleaseLoading: boolean;
+  isCompareReleaseError: boolean;
+  diffControl: ReactNode;
+}
+
+export function ValuesDetails({
+  values,
+  isUserSupplied,
+  selectedRevisionNumber,
+  diffViewMode,
+  compareValues,
+  compareRevisionNumberFetched,
+  isCompareReleaseLoading,
+  isCompareReleaseError,
+  diffControl,
+}: Props) {
+  return (
+    <>
+      {diffControl}
+      {diffViewMode === 'view' ? (
+        <CodeEditor
+          type="yaml"
+          id="values-details-code-editor"
+          data-cy="values-details-code-editor"
+          value={
+            isUserSupplied
+              ? (values?.userSuppliedValues ?? '')
+              : (values?.computedValues ?? '')
+          }
+          readonly
+          fileName={`Revision #${selectedRevisionNumber}`}
+          placeholder="No values found"
+          height="60vh"
+        />
+      ) : (
+        <DiffViewSection
+          isCompareReleaseLoading={isCompareReleaseLoading}
+          isCompareReleaseError={isCompareReleaseError}
+          compareRevisionNumberFetched={compareRevisionNumberFetched}
+          selectedRevisionNumber={selectedRevisionNumber}
+          newText={
+            isUserSupplied
+              ? (values?.userSuppliedValues ?? '')
+              : (values?.computedValues ?? '')
+          }
+          originalText={
+            isUserSupplied
+              ? (compareValues?.userSuppliedValues ?? '')
+              : (compareValues?.computedValues ?? '')
+          }
+          id="values-details-diff-viewer"
+          data-cy="values-details-diff-viewer"
+        />
+      )}
+    </>
+  );
+}
diff --git a/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/types.ts b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/types.ts
new file mode 100644
index 0000000..0b038a0
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/types.ts
@@ -0,0 +1,26 @@
+// exporting as types here allows the JSDocs to be reused, improving readability
+
+/**
+ * The revision number of the latest release.
+ */
+export type LatestRevisionNumber = number;
+
+/**
+ * The revision number selected in the UI.
+ */
+export type SelectedRevisionNumber = number;
+
+/**
+ * The revision number to compare with.
+ */
+export type CompareRevisionNumber = number;
+
+/**
+ * The earliest revision number available for the chart.
+ */
+export type EarliestRevisionNumber = number;
+
+/**
+ * The revision number that's being fetched (instead of the form state).
+ */
+export type CompareRevisionNumberFetched = number;
diff --git a/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/useHelmReleaseToCompare.ts b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/useHelmReleaseToCompare.ts
new file mode 100644
index 0000000..e15e189
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/useHelmReleaseToCompare.ts
@@ -0,0 +1,60 @@
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+
+import { HelmRelease } from '../../types';
+import { useHelmRelease } from '../../helmReleaseQueries/useHelmRelease';
+
+import { DiffViewMode } from './DiffControl';
+
+/** useHelmReleaseToCompare is a hook that returns the release to compare to based on the diffViewMode, selectedRevisionNumber and selectedCompareRevisionNumber */
+export function useHelmReleaseToCompare(
+  release: HelmRelease,
+  earliestRevisionNumber: number,
+  latestRevisionNumber: number,
+  diffViewMode: DiffViewMode,
+  selectedRevisionNumber: number,
+  selectedCompareRevisionNumber: number
+) {
+  const environmentId = useEnvironmentId();
+  // the selectedCompareRevisionNumber is the number selected in the input field, but the compareRevisionNumber is the revision number of the release to compare to
+  const compareRevisionNumber = getCompareReleaseVersion(
+    diffViewMode,
+    selectedRevisionNumber,
+    selectedCompareRevisionNumber
+  );
+  const enabled =
+    compareRevisionNumber <= latestRevisionNumber &&
+    compareRevisionNumber >= earliestRevisionNumber;
+
+  // a 1 hour stale time is nice because past releases are not likely to change
+  const compareReleaseQuery = useHelmRelease(
+    environmentId,
+    release.name,
+    release.namespace ?? '',
+    {
+      showResources: false,
+      enabled,
+      staleTime: 60 * 60 * 1000,
+      revision: compareRevisionNumber,
+    }
+  );
+  return {
+    compareRelease: compareReleaseQuery.data,
+    isCompareReleaseLoading: compareReleaseQuery.isInitialLoading,
+    isCompareReleaseError: compareReleaseQuery.isError,
+  };
+}
+
+// getCompareReleaseVersion is a helper function that returns the revision number that should be fetched based on the diffViewMode, selectedRevisionNumber and selectedCompareRevisionNumber
+function getCompareReleaseVersion(
+  diffViewMode: DiffViewMode,
+  selectedRevisionNumber: number,
+  selectedCompareRevisionNumber: number
+) {
+  if (diffViewMode === 'previous') {
+    return selectedRevisionNumber - 1;
+  }
+  if (diffViewMode === 'specific') {
+    return selectedCompareRevisionNumber;
+  }
+  return selectedRevisionNumber;
+}
diff --git a/app/react/kubernetes/helm/HelmApplicationView/index.ts b/app/react/kubernetes/helm/HelmApplicationView/index.ts
new file mode 100644
index 0000000..e3adc8d
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmApplicationView/index.ts
@@ -0,0 +1 @@
+export { HelmApplicationView } from './HelmApplicationView';
diff --git a/app/react/kubernetes/helm/HelmTemplates/HelmIcon.tsx b/app/react/kubernetes/helm/HelmTemplates/HelmIcon.tsx
new file mode 100644
index 0000000..f904a3a
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmTemplates/HelmIcon.tsx
@@ -0,0 +1,5 @@
+import helm from '@/assets/ico/vendor/helm.svg?c';
+
+import { BadgeIcon } from '@@/BadgeIcon';
+
+export const HelmIcon = <BadgeIcon icon={helm} />;
diff --git a/app/react/kubernetes/helm/HelmTemplates/HelmTemplates.tsx b/app/react/kubernetes/helm/HelmTemplates/HelmTemplates.tsx
new file mode 100644
index 0000000..7425f1c
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmTemplates/HelmTemplates.tsx
@@ -0,0 +1,90 @@
+import { useState } from 'react';
+
+import { useCurrentUser } from '@/react/hooks/useUser';
+
+import { FormSection } from '@@/form-components/FormSection';
+
+import { useHelmHTTPChartList } from '../helmChartSourceQueries/useHelmChartList';
+import { Chart } from '../types';
+import {
+  HelmRegistrySelect,
+  RepoValue,
+} from '../components/HelmRegistrySelect';
+import { useHelmRepoOptions } from '../helmChartSourceQueries/useHelmRepositories';
+import { HelmInstallForm } from '../install/HelmInstallForm';
+
+import { HelmTemplatesSelectedItem } from './HelmTemplatesSelectedItem';
+import { HelmTemplatesList } from './HelmTemplatesList';
+
+interface Props {
+  onSelectHelmChart: (chartName: string) => void;
+  namespace?: string;
+  name?: string;
+}
+
+export function HelmTemplates({ onSelectHelmChart, namespace, name }: Props) {
+  const [selectedChart, setSelectedChart] = useState<Chart | null>(null);
+  const [selectedRepo, setSelectedRepo] = useState<RepoValue | null>(null);
+  const { user } = useCurrentUser();
+  const chartListQuery = useHelmHTTPChartList(
+    user.Id,
+    selectedRepo?.repoUrl ?? '',
+    !!selectedRepo?.repoUrl
+  );
+  const repoOptionsQuery = useHelmRepoOptions();
+  const isRepoAvailable =
+    !!repoOptionsQuery.data && repoOptionsQuery.data.length > 0;
+
+  return (
+    <div className="row">
+      <div className="col-sm-12 p-0">
+        <FormSection title="Helm chart">
+          {selectedChart ? (
+            <>
+              <HelmTemplatesSelectedItem
+                selectedChart={selectedChart}
+                clearHelmChart={clearHelmChart}
+              />
+              <HelmInstallForm
+                selectedChart={selectedChart}
+                namespace={namespace}
+                name={name}
+                isRepoAvailable={isRepoAvailable}
+              />
+            </>
+          ) : (
+            <>
+              <HelmRegistrySelect
+                selectedRegistry={selectedRepo}
+                onRegistryChange={setSelectedRepo}
+                namespace={namespace}
+                isRepoAvailable={isRepoAvailable}
+                isLoading={repoOptionsQuery.isLoading}
+                isError={repoOptionsQuery.isError}
+                repoOptions={repoOptionsQuery.data ?? []}
+              />
+              {selectedRepo && (
+                <HelmTemplatesList
+                  charts={chartListQuery.data ?? []}
+                  selectAction={handleChartSelection}
+                  isLoadingCharts={chartListQuery.isInitialLoading}
+                  selectedRegistry={selectedRepo}
+                />
+              )}
+            </>
+          )}
+        </FormSection>
+      </div>
+    </div>
+  );
+
+  function clearHelmChart() {
+    setSelectedChart(null);
+    onSelectHelmChart('');
+  }
+
+  function handleChartSelection(chart: Chart) {
+    setSelectedChart(chart);
+    onSelectHelmChart(chart.name);
+  }
+}
diff --git a/app/react/kubernetes/helm/HelmTemplates/HelmTemplatesList.test.tsx b/app/react/kubernetes/helm/HelmTemplates/HelmTemplatesList.test.tsx
new file mode 100644
index 0000000..bfaa6e7
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmTemplates/HelmTemplatesList.test.tsx
@@ -0,0 +1,264 @@
+import { render, screen, fireEvent } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { UserViewModel } from '@/portainer/models/user';
+
+import { Chart } from '../types';
+
+import { HelmTemplatesList } from './HelmTemplatesList';
+
+// Sample test data
+const mockCharts: Chart[] = [
+  {
+    name: 'test-chart-1',
+    description: 'Test Chart 1 Description',
+    repo: 'https://example.com',
+    annotations: {
+      category: 'database',
+    },
+    version: '1.0.0',
+    versions: ['1.0.0', '1.0.1'],
+  },
+  {
+    name: 'test-chart-2',
+    description: 'Test Chart 2 Description',
+    repo: 'https://example.com',
+    annotations: {
+      category: 'database',
+    },
+    version: '1.0.0',
+    versions: ['1.0.0', '1.0.1'],
+  },
+  {
+    name: 'nginx-chart',
+    description: 'Nginx Web Server',
+    repo: 'https://example.com/2',
+    annotations: {
+      category: 'web',
+    },
+    version: '1.0.0',
+    versions: ['1.0.0', '1.0.1'],
+  },
+];
+
+const selectActionMock = vi.fn();
+
+const mockUseEnvironmentId = vi.fn(() => 1);
+
+vi.mock('@/react/hooks/useEnvironmentId', () => ({
+  useEnvironmentId: () => mockUseEnvironmentId(),
+}));
+
+// Mock the helm registries query
+vi.mock('../queries/useHelmRegistries', () => ({
+  useHelmRegistries: vi.fn(() => ({
+    data: ['https://example.com', 'https://example.com/2'],
+    isInitialLoading: false,
+    isError: false,
+  })),
+}));
+
+// Mock the environment registries query
+vi.mock(
+  '@/react/portainer/environments/queries/useEnvironmentRegistries',
+  () => ({
+    useEnvironmentRegistries: vi.fn(() => ({
+      data: [
+        { Id: 1, URL: 'https://registry.example.com' },
+        { Id: 2, URL: 'https://registry2.example.com' },
+      ],
+      isInitialLoading: false,
+      isError: false,
+    })),
+  })
+);
+
+function renderComponent({
+  loading = false,
+  charts = mockCharts,
+  selectAction = selectActionMock,
+  selectedRegistry = {
+    repoUrl: 'https://example.com',
+    name: 'Test Registry',
+  },
+}: {
+  loading?: boolean;
+  charts?: Chart[];
+  selectAction?: (chart: Chart) => void;
+  selectedRegistry?: {
+    repoUrl?: string;
+    name?: string;
+  } | null;
+} = {}) {
+  const user = new UserViewModel({ Username: 'user' });
+
+  const Wrapped = withTestQueryProvider(
+    withUserProvider(
+      withTestRouter(() => (
+        <HelmTemplatesList
+          isLoadingCharts={loading}
+          charts={charts}
+          selectAction={selectAction}
+          selectedRegistry={selectedRegistry}
+        />
+      )),
+      user
+    )
+  );
+  return { ...render(<Wrapped />), user };
+}
+
+describe('HelmTemplatesList', () => {
+  beforeEach(() => {
+    selectActionMock.mockClear();
+  });
+
+  it('should display title and charts list', async () => {
+    renderComponent();
+
+    // Check for the title with registry name
+    expect(
+      screen.getByText('Select a helm chart from Test Registry')
+    ).toBeInTheDocument();
+
+    // Check for charts
+    expect(screen.getByText('test-chart-1')).toBeInTheDocument();
+    expect(screen.getByText('Test Chart 1 Description')).toBeInTheDocument();
+    expect(screen.getByText('nginx-chart')).toBeInTheDocument();
+    expect(screen.getByText('Nginx Web Server')).toBeInTheDocument();
+    expect(screen.getByText('https://example.com/2')).toBeInTheDocument();
+  });
+
+  it('should call selectAction when a chart is clicked', async () => {
+    renderComponent();
+
+    // Find the first chart item
+    const firstChartItem = screen.getByText('test-chart-1').closest('button');
+    expect(firstChartItem).not.toBeNull();
+
+    // Click on the chart item
+    if (firstChartItem) {
+      fireEvent.click(firstChartItem);
+    }
+
+    // Check if selectAction was called with the correct chart
+    expect(selectActionMock).toHaveBeenCalledWith(mockCharts[0]);
+  });
+
+  it('should filter charts by text search', async () => {
+    renderComponent();
+    const user = userEvent.setup();
+
+    // Find search input and type "nginx"
+    const searchInput = screen.getByPlaceholderText('Search...');
+    await user.type(searchInput, 'nginx');
+
+    // Wait 300ms for debounce
+    await new Promise((resolve) => {
+      setTimeout(() => {
+        resolve(undefined);
+      }, 300);
+    });
+
+    // Should show only nginx chart
+    expect(screen.getByText('nginx-chart')).toBeInTheDocument();
+    expect(screen.queryByText('test-chart-1')).not.toBeInTheDocument();
+    expect(screen.queryByText('test-chart-2')).not.toBeInTheDocument();
+  });
+
+  it('should filter charts by category', async () => {
+    renderComponent();
+    const user = userEvent.setup();
+
+    // Find the category select
+    const categorySelect = screen.getByText('Select a category');
+    await user.click(categorySelect);
+
+    // Select "web" category
+    const webCategory = screen.getByText('web', {
+      selector: '[tabindex="-1"]',
+    });
+    await user.click(webCategory);
+
+    // Should show only web category charts
+    expect(screen.queryByText('nginx-chart')).toBeInTheDocument();
+    expect(screen.queryByText('test-chart-1')).not.toBeInTheDocument();
+    expect(screen.queryByText('test-chart-2')).not.toBeInTheDocument();
+  });
+
+  it('should show loading message when loading prop is true', async () => {
+    renderComponent({ loading: true, charts: [] });
+
+    // Check for loading message
+    expect(screen.getByText('Loading helm charts...')).toBeInTheDocument();
+    expect(
+      screen.getByText('Initial download of Helm charts can take a few minutes')
+    ).toBeInTheDocument();
+  });
+
+  it('should show empty message when no charts are available and a registry is selected', async () => {
+    renderComponent({
+      charts: [],
+      selectedRegistry: {
+        repoUrl: 'https://example.com',
+        name: 'Test Registry',
+      },
+    });
+
+    // Check for empty message
+    expect(
+      screen.getByText('No helm charts available in this repository.')
+    ).toBeInTheDocument();
+  });
+
+  it("should show 'select registry' message when no charts are available and no registry is selected", async () => {
+    renderComponent({ charts: [], selectedRegistry: null });
+
+    // Check for message
+    expect(
+      screen.getByText(
+        'Please select a repository to view available Helm charts.'
+      )
+    ).toBeInTheDocument();
+  });
+
+  it('should show no results message when search has no matches', async () => {
+    renderComponent();
+    const user = userEvent.setup();
+
+    // Find search input and type text that won't match any charts
+    const searchInput = screen.getByPlaceholderText('Search...');
+    await user.type(searchInput, 'nonexistent chart');
+
+    // Wait 300ms for debounce
+    await new Promise((resolve) => {
+      setTimeout(() => {
+        resolve(undefined);
+      }, 300);
+    });
+
+    // Check for no results message
+    expect(screen.getByText('No Helm charts found')).toBeInTheDocument();
+  });
+
+  it('should handle keyboard navigation and selection', async () => {
+    renderComponent();
+    const user = userEvent.setup();
+
+    // Find the first chart item
+    const firstChartItem = screen.getByText('test-chart-1').closest('button');
+    expect(firstChartItem).not.toBeNull();
+
+    // Focus and press Enter
+    if (firstChartItem) {
+      (firstChartItem as HTMLElement).focus();
+      await user.keyboard('{Enter}');
+    }
+
+    // Check if selectAction was called with the correct chart
+    expect(selectActionMock).toHaveBeenCalledWith(mockCharts[0]);
+  });
+});
diff --git a/app/react/kubernetes/helm/HelmTemplates/HelmTemplatesList.tsx b/app/react/kubernetes/helm/HelmTemplates/HelmTemplatesList.tsx
new file mode 100644
index 0000000..b173d19
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmTemplates/HelmTemplatesList.tsx
@@ -0,0 +1,160 @@
+import { useState, useMemo } from 'react';
+
+import { PortainerSelect } from '@/react/components/form-components/PortainerSelect';
+
+import { SearchBar } from '@@/datatables/SearchBar';
+import { InlineLoader } from '@@/InlineLoader';
+
+import { Chart } from '../types';
+import { RepoValue } from '../components/HelmRegistrySelect';
+
+import { HelmTemplatesListItem } from './HelmTemplatesListItem';
+
+interface Props {
+  isLoadingCharts: boolean;
+  charts?: Chart[];
+  selectAction: (chart: Chart) => void;
+  selectedRegistry: RepoValue | null;
+}
+
+export function HelmTemplatesList({
+  isLoadingCharts,
+  charts = [],
+  selectAction,
+  selectedRegistry,
+}: Props) {
+  const [textFilter, setTextFilter] = useState('');
+  const [selectedCategory, setSelectedCategory] = useState<string | null>(null);
+
+  const categories = useMemo(() => getCategories(charts), [charts]);
+
+  const filteredCharts = useMemo(
+    () => getFilteredCharts(charts, textFilter, selectedCategory),
+    [charts, textFilter, selectedCategory]
+  );
+
+  const isSelectedRegistryEmpty =
+    !isLoadingCharts && charts.length === 0 && selectedRegistry;
+
+  return (
+    <section className="datatable" aria-label="Helm charts">
+      <div className="toolBar vertical-center relative w-full !gap-x-5 !gap-y-1 overflow-auto !px-0">
+        <div className="toolBarTitle vertical-center whitespace-nowrap">
+          Select a helm chart from {selectedRegistry?.name}
+        </div>
+
+        <SearchBar
+          value={textFilter}
+          onChange={(value) => setTextFilter(value)}
+          placeholder="Search..."
+          data-cy="helm-templates-search"
+          className="!mr-0 h-9"
+        />
+
+        <div className="w-full flex-none sm:w-1/4">
+          <PortainerSelect
+            placeholder="Select a category"
+            value={selectedCategory}
+            options={categories}
+            onChange={setSelectedCategory}
+            isClearable
+            bindToBody
+            data-cy="helm-category-select"
+          />
+        </div>
+      </div>
+
+      <div className="blocklist !px-0" role="list">
+        {filteredCharts.map((chart) => (
+          <HelmTemplatesListItem
+            key={chart.name}
+            model={chart}
+            onSelect={selectAction}
+          />
+        ))}
+
+        {filteredCharts.length === 0 && textFilter && !isLoadingCharts && (
+          <div className="text-muted small mt-4">No Helm charts found</div>
+        )}
+
+        {isLoadingCharts && (
+          <div className="flex flex-col">
+            <InlineLoader className="justify-center">
+              Loading helm charts...
+            </InlineLoader>
+            {charts.length === 0 && (
+              <div className="text-muted text-center">
+                Initial download of Helm charts can take a few minutes
+              </div>
+            )}
+          </div>
+        )}
+
+        {isSelectedRegistryEmpty && (
+          <div className="text-muted text-center">
+            No helm charts available in this repository.
+          </div>
+        )}
+
+        {!selectedRegistry && (
+          <div className="text-muted text-center">
+            Please select a repository to view available Helm charts.
+          </div>
+        )}
+      </div>
+    </section>
+  );
+}
+
+/**
+ * Get categories from charts
+ * @param charts - The charts to get the categories from
+ * @returns Categories
+ */
+function getCategories(charts: Chart[]) {
+  const annotationCategories = charts
+    .map((chart) => chart.annotations?.category) // get category
+    .filter((c): c is string => !!c); // filter out nulls/undefined
+
+  const availableCategories = [...new Set(annotationCategories)].sort(); // unique and sort
+
+  // Create options array in the format expected by PortainerSelect
+  return availableCategories.map((cat) => ({
+    label: cat,
+    value: cat,
+  }));
+}
+
+/**
+ * Get filtered charts
+ * @param charts - The charts to get the filtered charts from
+ * @param textFilter - The text filter
+ * @param selectedCategory - The selected category
+ * @returns Filtered charts
+ */
+function getFilteredCharts(
+  charts: Chart[],
+  textFilter: string,
+  selectedCategory: string | null
+) {
+  return charts.filter((chart) => {
+    // Text filter
+    if (
+      textFilter &&
+      !chart.name.toLowerCase().includes(textFilter.toLowerCase()) &&
+      !chart.description.toLowerCase().includes(textFilter.toLowerCase())
+    ) {
+      return false;
+    }
+
+    // Category filter
+    if (
+      selectedCategory &&
+      (!chart.annotations || chart.annotations.category !== selectedCategory)
+    ) {
+      return false;
+    }
+
+    return true;
+  });
+}
diff --git a/app/react/kubernetes/helm/HelmTemplates/HelmTemplatesListItem.tsx b/app/react/kubernetes/helm/HelmTemplates/HelmTemplatesListItem.tsx
new file mode 100644
index 0000000..a1ee6a4
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmTemplates/HelmTemplatesListItem.tsx
@@ -0,0 +1,61 @@
+import React from 'react';
+
+import { FallbackImage } from '@/react/components/FallbackImage';
+
+import { Chart } from '../types';
+
+import { HelmIcon } from './HelmIcon';
+
+interface HelmTemplatesListItemProps {
+  model: Chart;
+  onSelect: (model: Chart) => void;
+  actions?: React.ReactNode;
+}
+
+export function HelmTemplatesListItem(props: HelmTemplatesListItemProps) {
+  const { model, onSelect, actions } = props;
+
+  function handleSelect() {
+    onSelect(model);
+  }
+
+  return (
+    <button
+      type="button"
+      className="blocklist-item !mx-0 bg-inherit text-start"
+      onClick={handleSelect}
+      tabIndex={0}
+    >
+      <div className="blocklist-item-box">
+        <span className="shrink-0">
+          <FallbackImage
+            src={model.icon}
+            fallbackIcon={HelmIcon}
+            className="blocklist-item-logo h-16 w-auto"
+            alt="Helm chart icon"
+          />
+        </span>
+
+        <div className="col-sm-12 flex flex-wrap justify-between gap-2">
+          <div className="blocklist-item-line">
+            <div>
+              <div className="blocklist-item-title">{model.name}</div>
+              <div className="small text-muted mt-1">{model.repo}</div>
+            </div>
+          </div>
+
+          <span className="blocklist-item-actions">{actions}</span>
+
+          <div className="blocklist-item-line w-full">
+            <span className="blocklist-item-desc">{model.description}</span>
+            {model.annotations?.category && (
+              <span className="small text-muted">
+                {model.annotations.category}
+              </span>
+            )}
+          </div>
+        </div>
+      </div>
+    </button>
+  );
+}
diff --git a/app/react/kubernetes/helm/HelmTemplates/HelmTemplatesSelectedItem.test.tsx b/app/react/kubernetes/helm/HelmTemplates/HelmTemplatesSelectedItem.test.tsx
new file mode 100644
index 0000000..2bbe569
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmTemplates/HelmTemplatesSelectedItem.test.tsx
@@ -0,0 +1,67 @@
+import { render, screen } from '@testing-library/react';
+import { vi } from 'vitest';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { UserViewModel } from '@/portainer/models/user';
+
+import { Chart } from '../types';
+
+import { HelmTemplatesSelectedItem } from './HelmTemplatesSelectedItem';
+
+// Sample test data
+const mockChart: Chart = {
+  name: 'test-chart',
+  description: 'Test Chart Description',
+  repo: 'https://example.com',
+  icon: 'test-icon-url',
+  annotations: {
+    category: 'database',
+  },
+  version: '1.0.1',
+  versions: ['1.0.0', '1.0.1'],
+};
+
+const clearHelmChartMock = vi.fn();
+const mockRouterStateService = {
+  go: vi.fn(),
+};
+
+function renderComponent({ selectedChart = mockChart, isAdmin = true } = {}) {
+  const user = new UserViewModel({ Username: 'user', Role: isAdmin ? 1 : 2 });
+
+  const Wrapped = withTestQueryProvider(
+    withUserProvider(
+      withTestRouter(() => (
+        <HelmTemplatesSelectedItem
+          selectedChart={selectedChart}
+          clearHelmChart={clearHelmChartMock}
+        />
+      )),
+      user
+    )
+  );
+
+  return {
+    ...render(<Wrapped />),
+    user,
+    mockRouterStateService,
+  };
+}
+
+describe('HelmTemplatesSelectedItem', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('should display selected chart information', () => {
+    renderComponent();
+
+    // Check for chart details
+    expect(screen.getByText('test-chart')).toBeInTheDocument();
+    expect(screen.getByText('Test Chart Description')).toBeInTheDocument();
+    expect(screen.getByText('Clear selection')).toBeInTheDocument();
+    expect(screen.getByText('https://example.com')).toBeInTheDocument();
+  });
+});
diff --git a/app/react/kubernetes/helm/HelmTemplates/HelmTemplatesSelectedItem.tsx b/app/react/kubernetes/helm/HelmTemplates/HelmTemplatesSelectedItem.tsx
new file mode 100644
index 0000000..f764d75
--- /dev/null
+++ b/app/react/kubernetes/helm/HelmTemplates/HelmTemplatesSelectedItem.tsx
@@ -0,0 +1,58 @@
+import { X } from 'lucide-react';
+
+import { Widget } from '@@/Widget';
+import { Button } from '@@/buttons/Button';
+import { FallbackImage } from '@@/FallbackImage';
+import { Icon } from '@@/Icon';
+
+import { Chart } from '../types';
+
+import { HelmIcon } from './HelmIcon';
+
+type Props = {
+  selectedChart: Chart;
+  clearHelmChart: () => void;
+};
+
+export function HelmTemplatesSelectedItem({
+  selectedChart,
+  clearHelmChart,
+}: Props) {
+  return (
+    <Widget>
+      <div className="flex">
+        <div className="m-2 basis-3/4 rounded-lg bg-gray-4 th-highcontrast:bg-black th-highcontrast:text-white th-dark:bg-gray-iron-10 th-dark:text-white">
+          <div className="vertical-center p-5">
+            <FallbackImage
+              src={selectedChart.icon}
+              fallbackIcon={HelmIcon}
+              className="h-16 w-16 flex-none"
+            />
+            <div className="col-sm-12">
+              <div>
+                <div className="text-2xl font-bold">{selectedChart.name}</div>
+                <div className="small text-muted mt-1">
+                  {selectedChart.repo}
+                </div>
+              </div>
+              <div className="mt-2 text-xs">{selectedChart.description}</div>
+            </div>
+          </div>
+        </div>
+        <div className="basis-1/4">
+          <div className="vertical-center h-full w-full justify-end pr-5">
+            <Button
+              color="link"
+              className="!text-gray-8 hover:no-underline th-highcontrast:!text-white th-dark:!text-white"
+              onClick={clearHelmChart}
+              data-cy="clear-selection"
+            >
+              Clear selection
+              <Icon icon={X} className="ml-1" />
+            </Button>
+          </div>
+        </div>
+      </div>
+    </Widget>
+  );
+}
diff --git a/app/react/kubernetes/helm/components/HelmRegistrySelect.test.tsx b/app/react/kubernetes/helm/components/HelmRegistrySelect.test.tsx
new file mode 100644
index 0000000..af88a19
--- /dev/null
+++ b/app/react/kubernetes/helm/components/HelmRegistrySelect.test.tsx
@@ -0,0 +1,247 @@
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { vi } from 'vitest';
+
+import selectEvent from '@/react/test-utils/react-select';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { UserViewModel } from '@/portainer/models/user';
+import { RegistryTypes } from '@/react/portainer/registries/types/registry';
+import { useCurrentUser } from '@/react/hooks/useUser';
+import { User, Role } from '@/portainer/users/types';
+
+import { HelmRegistrySelect, RepoValue } from './HelmRegistrySelect';
+
+// Mock the hooks with factory functions - preserve other exports
+vi.mock('@/react/hooks/useUser', async () => {
+  const actual = await vi.importActual('@/react/hooks/useUser');
+  return {
+    ...actual,
+    useCurrentUser: vi.fn(),
+  };
+});
+
+const mockOnRegistryChange = vi.fn();
+
+const defaultProps = {
+  selectedRegistry: null,
+  onRegistryChange: mockOnRegistryChange,
+  isRepoAvailable: true,
+  isLoading: false,
+  isError: false,
+  repoOptions: [],
+};
+
+const mockRepoOptions = [
+  {
+    label: 'Custom Repositories',
+    options: [
+      {
+        value: {
+          repoUrl: 'https://charts.bitnami.com/bitnami',
+          name: 'Bitnami',
+          type: RegistryTypes.CUSTOM,
+        },
+        label: 'Bitnami',
+      },
+      {
+        value: {
+          repoUrl: 'https://kubernetes-charts.storage.googleapis.com',
+          name: 'Stable',
+          type: RegistryTypes.CUSTOM,
+        },
+        label: 'Stable',
+      },
+    ],
+  },
+];
+
+interface MockUserHookReturn {
+  user: User;
+  isPureAdmin: boolean;
+}
+
+interface UserProps {
+  isPureAdmin?: boolean;
+}
+
+// Get the mocked functions
+const mockUseCurrentUser = vi.mocked(useCurrentUser);
+
+function renderComponent(props = {}, userProps: UserProps = {}) {
+  const userResult: MockUserHookReturn = {
+    user: {
+      Id: 1,
+      Username: 'admin',
+      Role: Role.Admin,
+      EndpointAuthorizations: {},
+      UseCache: false,
+      ThemeSettings: {
+        color: 'auto',
+      },
+    },
+    isPureAdmin: userProps.isPureAdmin || false,
+  };
+
+  mockUseCurrentUser.mockReturnValue(userResult);
+
+  const Component = withTestQueryProvider(
+    withUserProvider(
+      withTestRouter(HelmRegistrySelect),
+      new UserViewModel({ Username: 'admin', Role: 1 })
+    )
+  );
+
+  return render(<Component {...defaultProps} {...props} />);
+}
+
+describe('HelmRegistrySelect', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mockUseCurrentUser.mockClear();
+  });
+
+  describe('Basic rendering', () => {
+    it('should render with default placeholder', () => {
+      renderComponent();
+      expect(screen.getByText('Select a repository')).toBeInTheDocument();
+    });
+
+    it('should render with custom placeholder', () => {
+      renderComponent({ placeholder: 'Custom placeholder' });
+      expect(screen.getByText('Custom placeholder')).toBeInTheDocument();
+    });
+
+    it('should render loading state', () => {
+      renderComponent({ isLoading: true });
+      expect(screen.getByRole('combobox')).toBeInTheDocument();
+    });
+
+    it('should render error state', () => {
+      renderComponent({ isError: true });
+      expect(
+        screen.getByText('Unable to load registry options.')
+      ).toBeInTheDocument();
+    });
+  });
+
+  describe('Repository options', () => {
+    it('should display repository options', async () => {
+      const user = userEvent.setup();
+      renderComponent({ repoOptions: mockRepoOptions });
+
+      const select = screen.getByRole('combobox');
+      await user.click(select);
+
+      screen.getAllByText('Bitnami').forEach((el) => expect(el).toBeVisible());
+      screen.getAllByText('Stable').forEach((el) => expect(el).toBeVisible());
+    });
+
+    it.skip('should call onRegistryChange when option is selected', async () => {
+      // Skipping this test due to react-select testing complexity
+      // The onChange functionality is covered by integration tests
+      renderComponent({ repoOptions: mockRepoOptions });
+
+      const select = screen.getByRole('combobox');
+      await selectEvent.select(select, 'Bitnami');
+
+      expect(mockOnRegistryChange).toHaveBeenCalledWith({
+        repoUrl: 'https://charts.bitnami.com/bitnami',
+        name: 'Bitnami',
+        type: RegistryTypes.CUSTOM,
+      });
+    });
+
+    it('should show selected repository value', () => {
+      const selectedRegistry: RepoValue = {
+        repoUrl: 'https://charts.bitnami.com/bitnami',
+        name: 'Bitnami',
+        type: RegistryTypes.CUSTOM,
+      };
+
+      renderComponent({
+        selectedRegistry,
+        repoOptions: mockRepoOptions,
+      });
+
+      // Since the component uses PortainerSelect which manages the display value,
+      // we verify the props are correctly passed by checking the select element exists
+      expect(screen.getByRole('combobox')).toBeInTheDocument();
+    });
+  });
+
+  describe('No repositories warning', () => {
+    it('should show no repositories warning when no repos are available', () => {
+      renderComponent({
+        isRepoAvailable: false,
+        namespace: 'test-namespace',
+      });
+
+      expect(
+        screen.getByText(/There are no repositories available./)
+      ).toBeInTheDocument();
+    });
+
+    it('should not show warning when loading', () => {
+      renderComponent({
+        isRepoAvailable: false,
+        namespace: 'test-namespace',
+        isLoading: true,
+      });
+
+      expect(
+        screen.queryByText('There are no repositories available.')
+      ).not.toBeInTheDocument();
+    });
+
+    it('should not show warning when no namespace is provided', () => {
+      renderComponent({
+        isRepoAvailable: false,
+      });
+
+      expect(
+        screen.queryByText('There are no repositories available.')
+      ).not.toBeInTheDocument();
+    });
+  });
+
+  describe('Tooltip content', () => {
+    it('should render the component with label and tooltip', () => {
+      renderComponent({}, { isPureAdmin: true });
+
+      // Verify that the component renders the main label
+      expect(screen.getByText('Helm chart source')).toBeInTheDocument();
+
+      expect(screen.getByRole('combobox')).toBeInTheDocument();
+    });
+  });
+
+  describe('Loading and error states', () => {
+    it('should not show no repos warning when loading', () => {
+      renderComponent({
+        isLoading: true,
+        isRepoAvailable: false,
+        repoOptions: [],
+        namespace: 'test-namespace',
+      });
+
+      expect(
+        screen.queryByText('There are no repositories available.')
+      ).not.toBeInTheDocument();
+    });
+
+    it('should show error when API fails', () => {
+      renderComponent({
+        isLoading: false,
+        isError: true,
+        isRepoAvailable: false,
+        namespace: 'test-namespace',
+      });
+
+      expect(
+        screen.getByText('Unable to load registry options.')
+      ).toBeInTheDocument();
+    });
+  });
+});
diff --git a/app/react/kubernetes/helm/components/HelmRegistrySelect.tsx b/app/react/kubernetes/helm/components/HelmRegistrySelect.tsx
new file mode 100644
index 0000000..55569f9
--- /dev/null
+++ b/app/react/kubernetes/helm/components/HelmRegistrySelect.tsx
@@ -0,0 +1,156 @@
+import { GroupBase } from 'react-select';
+
+import {
+  PortainerSelect,
+  Option,
+} from '@/react/components/form-components/PortainerSelect';
+import { useCurrentUser } from '@/react/hooks/useUser';
+import { RegistryTypes } from '@/react/portainer/registries/types/registry';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { Alert } from '@@/Alert';
+import { Link } from '@@/Link';
+import { TextTip } from '@@/Tip/TextTip';
+
+export type RepoValue = {
+  repoUrl?: string; // set for traditional https helm repos
+  name?: string;
+  type?: RegistryTypes;
+};
+
+interface Props {
+  selectedRegistry: RepoValue | null;
+  onRegistryChange: (registry: RepoValue | null) => void;
+  namespace?: string;
+  placeholder?: string;
+  'data-cy'?: string;
+  isRepoAvailable: boolean;
+  isLoading: boolean;
+  isError: boolean;
+  repoOptions: GroupBase<Option<RepoValue>>[];
+}
+
+export function HelmRegistrySelect({
+  selectedRegistry,
+  onRegistryChange,
+  namespace,
+  placeholder = 'Select a repository',
+  'data-cy': dataCy = 'helm-registry-select',
+  isRepoAvailable,
+  isLoading,
+  isError,
+  repoOptions,
+}: Props) {
+  const { isPureAdmin } = useCurrentUser();
+
+  return (
+    <FormControl
+      label="Helm chart source"
+      tooltip={<HelmChartSourceTooltip isPureAdmin={isPureAdmin} />}
+    >
+      <PortainerSelect<RepoValue>
+        placeholder={placeholder}
+        value={selectedRegistry ?? {}}
+        options={repoOptions}
+        isLoading={isLoading}
+        onChange={onRegistryChange}
+        isClearable
+        bindToBody
+        data-cy={dataCy}
+      />
+      <NoReposWarning
+        hasNoRepos={!isRepoAvailable}
+        isLoading={isLoading}
+        namespace={namespace}
+        isPureAdmin={isPureAdmin}
+      />
+      {isError && <Alert color="error">Unable to load registry options.</Alert>}
+    </FormControl>
+  );
+}
+
+function HelmChartSourceTooltip({ isPureAdmin }: { isPureAdmin: boolean }) {
+  if (isPureAdmin) {
+    return (
+      <>
+        <CreateUserRepoMessage />
+        <br />
+        <CreateGlobalRepoMessage />
+      </>
+    );
+  }
+
+  // Non-admin
+  return <CreateUserRepoMessage />;
+}
+
+function NoReposWarning({
+  hasNoRepos,
+  isLoading,
+  namespace,
+  isPureAdmin,
+}: {
+  hasNoRepos: boolean;
+  isLoading: boolean;
+  namespace?: string;
+  isPureAdmin: boolean;
+}) {
+  if (!hasNoRepos || isLoading || !namespace) {
+    return null;
+  }
+
+  return (
+    <TextTip color="blue" className="mt-2">
+      There are no repositories available.
+      <CreateRepoMessage isPureAdmin={isPureAdmin} />
+    </TextTip>
+  );
+}
+
+function CreateRepoMessage({ isPureAdmin }: { isPureAdmin: boolean }) {
+  if (isPureAdmin) {
+    return (
+      <>
+        <CreateUserRepoMessage />
+        <br />
+        <CreateGlobalRepoMessage />
+      </>
+    );
+  }
+
+  // Non-admin
+  return <CreateUserRepoMessage />;
+}
+
+function CreateUserRepoMessage() {
+  return (
+    <>
+      You can define <b>repositories</b> in the{' '}
+      <Link
+        to="portainer.account"
+        params={{ '#': 'helm-repositories' }}
+        data-cy="helm-repositories-link"
+      >
+        User settings - Helm repositories
+      </Link>
+      .
+    </>
+  );
+}
+
+function CreateGlobalRepoMessage() {
+  return (
+    <>
+      You can also define repositories in the{' '}
+      <Link
+        to="portainer.settings"
+        params={{ '#': 'kubernetes-settings' }}
+        data-cy="portainer-settings-link"
+        target="_blank"
+      >
+        Portainer settings
+      </Link>
+      .
+    </>
+  );
+}
diff --git a/app/react/kubernetes/helm/components/HelmValuesInput.tsx b/app/react/kubernetes/helm/components/HelmValuesInput.tsx
new file mode 100644
index 0000000..33ddb2a
--- /dev/null
+++ b/app/react/kubernetes/helm/components/HelmValuesInput.tsx
@@ -0,0 +1,80 @@
+import { FormControl } from '@@/form-components/FormControl';
+import { CodeEditor } from '@@/CodeEditor';
+import { ShortcutsTooltip } from '@@/CodeEditor/ShortcutsTooltip';
+
+type Props = {
+  values: string;
+  setValues: (values: string) => void;
+  valuesRef: string;
+  isValuesRefLoading: boolean;
+};
+
+export function HelmValuesInput({
+  values,
+  setValues,
+  valuesRef,
+  isValuesRefLoading,
+}: Props) {
+  return (
+    <div className="grid grid-cols-2 gap-4">
+      <FormControl
+        label="User-defined values"
+        inputId="user-values-editor"
+        size="vertical"
+        className="!mx-0 [&>label]:!mb-1"
+        tooltip={
+          <>
+            User-defined values will override the default chart values.
+            <br />
+            You can get more information about the Helm values file format in
+            the{' '}
+            <a
+              href="https://helm.sh/docs/chart_template_guide/values_files/"
+              target="_blank"
+              data-cy="helm-values-reference-link"
+              rel="noreferrer"
+            >
+              official documentation
+            </a>
+            .
+          </>
+        }
+      >
+        <CodeEditor
+          id="user-values-editor"
+          value={values}
+          onChange={setValues}
+          height="50vh"
+          type="yaml"
+          data-cy="helm-user-values-editor"
+          placeholder="Define or paste the content of your values yaml file here"
+          showToolbar={false}
+        />
+      </FormControl>
+      <FormControl
+        label={
+          <div className="flex w-full justify-between">
+            Values reference (read-only)
+            <ShortcutsTooltip />
+          </div>
+        }
+        inputId="values-reference"
+        size="vertical"
+        isLoading={isValuesRefLoading}
+        loadingText="Loading values..."
+        className="!mx-0 [&>label]:!mb-1 [&>label]:w-full"
+      >
+        <CodeEditor
+          id="values-reference"
+          value={valuesRef}
+          height="50vh"
+          type="yaml"
+          readonly
+          data-cy="helm-values-reference"
+          placeholder="No values reference found"
+          showToolbar={false}
+        />
+      </FormControl>
+    </div>
+  );
+}
diff --git a/app/react/kubernetes/helm/components/ManifestPreviewFormSection.test.tsx b/app/react/kubernetes/helm/components/ManifestPreviewFormSection.test.tsx
new file mode 100644
index 0000000..1a3b565
--- /dev/null
+++ b/app/react/kubernetes/helm/components/ManifestPreviewFormSection.test.tsx
@@ -0,0 +1,204 @@
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { vi } from 'vitest';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { UserViewModel } from '@/portainer/models/user';
+
+import { ManifestPreviewFormSection } from './ManifestPreviewFormSection';
+
+// Mock the necessary hooks
+const mockUseHelmDryRun = vi.fn();
+const mockUseDebouncedValue = vi.fn();
+
+vi.mock('../helmReleaseQueries/useHelmDryRun', () => ({
+  useHelmDryRun: (...args: unknown[]) => mockUseHelmDryRun(...args),
+}));
+
+vi.mock('@/react/hooks/useDebouncedValue', () => ({
+  useDebouncedValue: (value: unknown, delay: number) =>
+    mockUseDebouncedValue(value, delay),
+}));
+
+// Mock the CodeEditor and DiffViewer components
+vi.mock('@@/CodeEditor', () => ({
+  CodeEditor: ({
+    'data-cy': dataCy,
+    value,
+  }: {
+    'data-cy'?: string;
+    value: string;
+  }) => (
+    <div data-cy={dataCy} data-testid="code-editor">
+      {value}
+    </div>
+  ),
+}));
+
+vi.mock('@@/CodeEditor/DiffViewer', () => ({
+  DiffViewer: ({
+    'data-cy': dataCy,
+    originalCode,
+    newCode,
+  }: {
+    'data-cy'?: string;
+    originalCode: string;
+    newCode: string;
+  }) => (
+    <div data-cy={dataCy} data-testid="diff-viewer">
+      <div data-testid="original-code">{originalCode}</div>
+      <div data-testid="new-code">{newCode}</div>
+    </div>
+  ),
+}));
+
+const mockOnChangePreviewValidation = vi.fn();
+
+const defaultProps = {
+  payload: {
+    name: 'test-release',
+    namespace: 'test-namespace',
+    chart: 'test-chart',
+    version: '1.0.0',
+    repo: 'test-repo',
+  },
+  onChangePreviewValidation: mockOnChangePreviewValidation,
+  title: 'Manifest Preview',
+  environmentId: 1,
+};
+
+function renderComponent(props = {}) {
+  const user = new UserViewModel({ Username: 'user', Role: 1 });
+
+  const Component = withTestQueryProvider(
+    withUserProvider(
+      withTestRouter(() => (
+        <ManifestPreviewFormSection {...defaultProps} {...props} />
+      )),
+      user
+    )
+  );
+
+  return render(<Component />);
+}
+
+describe('ManifestPreviewFormSection', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    // Default mock for useDebouncedValue - returns the value as-is
+    mockUseDebouncedValue.mockImplementation((value) => value);
+  });
+
+  it('should show loading and no form section when loading', () => {
+    mockUseHelmDryRun.mockReturnValue({
+      isInitialLoading: true,
+      isError: false,
+      data: undefined,
+    });
+
+    renderComponent();
+
+    expect(
+      screen.getByText('Generating manifest preview...')
+    ).toBeInTheDocument();
+    expect(screen.queryByText('Manifest Preview')).not.toBeInTheDocument();
+  });
+
+  it("should show error when there's an error", async () => {
+    mockUseHelmDryRun.mockReturnValue({
+      isInitialLoading: false,
+      isError: true,
+      error: { message: 'Invalid chart configuration' },
+      data: undefined,
+    });
+
+    renderComponent();
+
+    expect(screen.queryByText('Manifest Preview')).toBeInTheDocument();
+    // there should be an error badge
+    expect(
+      screen.queryByTestId('helm-manifest-preview-error-badge')
+    ).toBeInTheDocument();
+    const expandButton = screen.getByLabelText('Expand');
+    await userEvent.click(expandButton);
+
+    expect(
+      screen.getByText('Error with Helm chart configuration')
+    ).toBeInTheDocument();
+    expect(screen.getByText('Invalid chart configuration')).toBeInTheDocument();
+  });
+
+  it('should show single code editor when only the generated manifest is available', async () => {
+    const mockManifest = 'apiVersion: v1\nkind: Pod\nmetadata:\n  name: test';
+
+    mockUseHelmDryRun.mockReturnValue({
+      isInitialLoading: false,
+      isError: false,
+      data: { manifest: mockManifest },
+    });
+
+    renderComponent();
+
+    expect(screen.getByText('Manifest Preview')).toBeInTheDocument();
+
+    // Expand the FormSection to see the content
+    const expandButton = screen.getByLabelText('Expand');
+    await userEvent.click(expandButton);
+
+    // Check that the manifest content is rendered (from the HTML, we can see it's there)
+    expect(
+      screen.getByText(/apiVersion/, { exact: false })
+    ).toBeInTheDocument();
+    expect(screen.getByText(/test/, { exact: false })).toBeInTheDocument();
+  });
+
+  it('should show the diff when the current and generated manifest are available', async () => {
+    const currentManifest = 'apiVersion: v1\nkind: Pod\nmetadata:\n  name: old';
+    const newManifest = 'apiVersion: v1\nkind: Pod\nmetadata:\n  name: new';
+
+    mockUseHelmDryRun.mockReturnValue({
+      isInitialLoading: false,
+      isError: false,
+      data: { manifest: newManifest },
+    });
+
+    renderComponent({ currentManifest });
+
+    expect(screen.getByText('Manifest Preview')).toBeInTheDocument();
+
+    // Expand the FormSection to see the content
+    const expandButton = screen.getByLabelText('Expand');
+    await userEvent.click(expandButton);
+
+    // Check that both old and new manifest content is rendered
+    expect(screen.getByText(/old/, { exact: false })).toBeInTheDocument();
+    expect(screen.getByText(/new/, { exact: false })).toBeInTheDocument();
+  });
+
+  it('should call onChangePreviewValidation with correct validation state', () => {
+    mockUseHelmDryRun.mockReturnValue({
+      isInitialLoading: false,
+      isError: false,
+      data: { manifest: 'test' },
+    });
+
+    renderComponent();
+
+    expect(mockOnChangePreviewValidation).toHaveBeenCalledWith(true);
+  });
+
+  it('should call onChangePreviewValidation with false when error occurs', () => {
+    mockUseHelmDryRun.mockReturnValue({
+      isInitialLoading: false,
+      isError: true,
+      error: { message: 'Error' },
+      data: undefined,
+    });
+
+    renderComponent();
+
+    expect(mockOnChangePreviewValidation).toHaveBeenCalledWith(false);
+  });
+});
diff --git a/app/react/kubernetes/helm/components/ManifestPreviewFormSection.tsx b/app/react/kubernetes/helm/components/ManifestPreviewFormSection.tsx
new file mode 100644
index 0000000..282450d
--- /dev/null
+++ b/app/react/kubernetes/helm/components/ManifestPreviewFormSection.tsx
@@ -0,0 +1,126 @@
+import { useEffect, useState } from 'react';
+import { AlertTriangle } from 'lucide-react';
+
+import { useDebouncedValue } from '@/react/hooks/useDebouncedValue';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { ExpandableMessageByLines } from '@@/ExpandableMessageByLines';
+import { FormSection } from '@@/form-components/FormSection';
+import { CodeEditor } from '@@/CodeEditor';
+import { DiffViewer } from '@@/CodeEditor/DiffViewer';
+import { InlineLoader } from '@@/InlineLoader';
+import { Alert } from '@@/Alert';
+import { TextTip } from '@@/Tip/TextTip';
+import { Badge } from '@@/Badge';
+import { Icon } from '@@/Icon';
+
+import { useHelmDryRun } from '../helmReleaseQueries/useHelmDryRun';
+import { UpdateHelmReleasePayload } from '../types';
+
+type Props = {
+  payload: UpdateHelmReleasePayload;
+  onChangePreviewValidation: (isValid: boolean) => void;
+  currentManifest?: string; // only true on upgrade, not install
+  title: string;
+  environmentId: EnvironmentId;
+};
+
+export function ManifestPreviewFormSection({
+  payload,
+  currentManifest,
+  onChangePreviewValidation,
+  title,
+  environmentId,
+}: Props) {
+  const debouncedPayload = useDebouncedValue(payload, 500);
+  const manifestPreviewQuery = useHelmDryRun(environmentId, debouncedPayload);
+  const [isFolded, setIsFolded] = useState(true);
+
+  useEffect(() => {
+    onChangePreviewValidation(!manifestPreviewQuery.isError);
+  }, [manifestPreviewQuery.isError, onChangePreviewValidation]);
+
+  if (
+    !debouncedPayload.name ||
+    !debouncedPayload.namespace ||
+    !debouncedPayload.chart
+  ) {
+    return null;
+  }
+
+  // only show loading state or the error to keep the view simple (omitting the preview section because there is nothing to preview)
+  if (manifestPreviewQuery.isInitialLoading) {
+    return <InlineLoader>Generating manifest preview...</InlineLoader>;
+  }
+
+  return (
+    <FormSection
+      title={
+        <>
+          {title}
+          {manifestPreviewQuery.isError && (
+            <Badge
+              type="dangerSecondary"
+              className="ml-2"
+              data-cy="helm-manifest-preview-error-badge"
+            >
+              <Icon icon={AlertTriangle} size="md" />
+            </Badge>
+          )}
+        </>
+      }
+      isFoldable
+      defaultFolded={isFolded}
+      setIsDefaultFolded={setIsFolded}
+    >
+      {manifestPreviewQuery.isError ? (
+        <Alert color="error" title="Error with Helm chart configuration">
+          <ExpandableMessageByLines>
+            {manifestPreviewQuery.error?.message ||
+              'Error generating manifest preview'}
+          </ExpandableMessageByLines>
+        </Alert>
+      ) : (
+        <ManifestPreview
+          currentManifest={currentManifest}
+          newManifest={manifestPreviewQuery.data?.manifest ?? ''}
+        />
+      )}
+    </FormSection>
+  );
+}
+
+function ManifestPreview({
+  currentManifest,
+  newManifest,
+}: {
+  currentManifest?: string;
+  newManifest: string;
+}) {
+  if (!newManifest) {
+    return <TextTip color="blue">No manifest preview available</TextTip>;
+  }
+
+  if (currentManifest) {
+    return (
+      <DiffViewer
+        originalCode={currentManifest}
+        newCode={newManifest}
+        id="manifest-preview"
+        data-cy="manifest-diff-preview"
+        type="yaml"
+      />
+    );
+  }
+
+  return (
+    <CodeEditor
+      id="manifest-preview"
+      value={newManifest}
+      data-cy="manifest-preview"
+      type="yaml"
+      readonly
+      showToolbar={false}
+    />
+  );
+}
diff --git a/app/react/kubernetes/helm/helm-status-utils.ts b/app/react/kubernetes/helm/helm-status-utils.ts
new file mode 100644
index 0000000..60fd83e
--- /dev/null
+++ b/app/react/kubernetes/helm/helm-status-utils.ts
@@ -0,0 +1,48 @@
+export enum DeploymentStatus {
+  DEPLOYED = 'deployed',
+  FAILED = 'failed',
+  PENDING = 'pending-install',
+  PENDINGUPGRADE = 'pending-upgrade',
+  PENDINGROLLBACK = 'pending-rollback',
+  SUPERSEDED = 'superseded',
+  UNINSTALLED = 'uninstalled',
+  UNINSTALLING = 'uninstalling',
+}
+
+export function getStatusColor(status?: string) {
+  switch (status?.toLowerCase()) {
+    case DeploymentStatus.DEPLOYED:
+      return 'success';
+    case DeploymentStatus.FAILED:
+      return 'danger';
+    case DeploymentStatus.PENDING:
+    case DeploymentStatus.PENDINGUPGRADE:
+    case DeploymentStatus.PENDINGROLLBACK:
+    case DeploymentStatus.UNINSTALLING:
+      return 'warn';
+    case DeploymentStatus.SUPERSEDED:
+    default:
+      return 'muted';
+  }
+}
+
+export function getStatusText(status?: string) {
+  switch (status?.toLowerCase()) {
+    case DeploymentStatus.DEPLOYED:
+      return 'Deployed';
+    case DeploymentStatus.FAILED:
+      return 'Failed';
+    case DeploymentStatus.PENDING:
+      return 'Pending install';
+    case DeploymentStatus.PENDINGUPGRADE:
+      return 'Pending upgrade';
+    case DeploymentStatus.PENDINGROLLBACK:
+      return 'Pending rollback';
+    case DeploymentStatus.UNINSTALLING:
+      return 'Uninstalling';
+    case DeploymentStatus.SUPERSEDED:
+      return 'Superseded';
+    default:
+      return 'Unknown';
+  }
+}
diff --git a/app/react/kubernetes/helm/helmChartSourceQueries/query-keys.ts b/app/react/kubernetes/helm/helmChartSourceQueries/query-keys.ts
new file mode 100644
index 0000000..d9b7531
--- /dev/null
+++ b/app/react/kubernetes/helm/helmChartSourceQueries/query-keys.ts
@@ -0,0 +1,29 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { UserId } from '@/portainer/users/types';
+
+export const queryKeys = {
+  // Environment-scoped Helm queries (following kubernetes pattern)
+  base: (environmentId: EnvironmentId) =>
+    ['environments', environmentId, 'kubernetes', 'helm'] as const,
+
+  // User's helm repositories/registries
+  registries: (userId: UserId) => ['helm', 'registries', userId] as const,
+
+  // Chart repository searches (global, not environment-specific)
+  repositories: (chart: string, repo?: string, useCache?: boolean) =>
+    ['helm', 'repositories', chart, repo, useCache] as const,
+
+  // Chart listings from repositories (user-specific)
+  charts: (userId: UserId, repository: string) =>
+    ['helm', 'charts', userId, repository] as const,
+
+  // Chart values (global, cached by chart/version)
+  chartValues: (repo: string, chart: string, version: string | 'latest') =>
+    ['helm', 'chart-values', repo, chart, version] as const,
+
+  chartVersions: (
+    sourceId: number | string,
+    chart: string,
+    useCache?: boolean
+  ) => ['helm', 'registries', sourceId, chart, 'versions', useCache] as const,
+};
diff --git a/app/react/kubernetes/helm/helmChartSourceQueries/useHelmChartList.ts b/app/react/kubernetes/helm/helmChartSourceQueries/useHelmChartList.ts
new file mode 100644
index 0000000..e2c1a1f
--- /dev/null
+++ b/app/react/kubernetes/helm/helmChartSourceQueries/useHelmChartList.ts
@@ -0,0 +1,59 @@
+import { compact } from 'lodash';
+import { useQuery } from '@tanstack/react-query';
+
+import axios from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+
+import { Chart, HelmChartsResponse } from '../types';
+
+import { queryKeys } from './query-keys';
+
+/**
+ * React hook to fetch helm charts from the provided HTTP repository.
+ * Charts are loaded from the specified repository URL.
+ *
+ * @param userId User ID
+ * @param repository Repository URL to fetch charts from
+ * @param enabled Flag indicating if the query should be enabled
+ * @returns Query result containing helm charts
+ */
+export function useHelmHTTPChartList(
+  userId: number,
+  repository: string,
+  enabled: boolean
+) {
+  return useQuery({
+    queryKey: queryKeys.charts(userId, repository),
+    queryFn: () => getChartsFromRepo(repository),
+    enabled: !!userId && !!repository && enabled,
+    // one request takes a long time, so fail early to get feedback to the user faster
+    retry: false,
+    ...withError(`Unable to retrieve Helm charts from ${repository}`),
+    cacheTime: 1000 * 60 * 60 * 8, // 8 hours so that the chart list populates faster (keep stale time the same to always revalidate)
+  });
+}
+
+async function getChartsFromRepo(repo: string): Promise<Chart[]> {
+  try {
+    // Construct the URL with required repo parameter
+    const response = await axios.get<HelmChartsResponse>('templates/helm', {
+      params: { repo },
+    });
+
+    return compact(
+      Object.values(response.data.entries).map((versions) =>
+        versions[0]
+          ? {
+              ...versions[0],
+              repo,
+              // versions are within this response too, so we don't need a new query to fetch versions when this is used
+              versions: versions.map((v) => v.version),
+            }
+          : null
+      )
+    );
+  } catch (error) {
+    // Ignore errors from chart repositories as some may error but others may not
+    return [];
+  }
+}
diff --git a/app/react/kubernetes/helm/helmChartSourceQueries/useHelmChartValues.ts b/app/react/kubernetes/helm/helmChartSourceQueries/useHelmChartValues.ts
new file mode 100644
index 0000000..503fb71
--- /dev/null
+++ b/app/react/kubernetes/helm/helmChartSourceQueries/useHelmChartValues.ts
@@ -0,0 +1,46 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+
+import { queryKeys } from './query-keys';
+
+type Params = {
+  /** The name of the chart to get the values for */
+  chart: string;
+  /** The repository URL or registry ID */
+  repo: string;
+  /** The version of the chart to get the values for */
+  version?: string;
+};
+
+export function useHelmChartValues(params: Params, isLatestVersion = false) {
+  const hasValidRepoUrl = !!params.repo;
+  return useQuery({
+    queryKey: queryKeys.chartValues(
+      params.repo,
+      params.chart,
+      // if the latest version is fetched, use the latest version key to cache the latest version
+      isLatestVersion ? 'latest' : params.version || 'latest'
+    ),
+    queryFn: () => getHelmChartValues(params),
+    enabled: !!params.chart && hasValidRepoUrl,
+    select: (data) => ({
+      values: data,
+    }),
+    retry: 1,
+    staleTime: 60 * 1000 * 20, // 60 minutes, because values are not expected to change often
+    ...withError('Unable to get Helm chart values'),
+  });
+}
+
+async function getHelmChartValues(params: Params) {
+  try {
+    const response = await axios.get<string>(`/templates/helm/values`, {
+      params,
+    });
+    return response.data;
+  } catch (err) {
+    throw parseAxiosError(err, 'Unable to get Helm chart values');
+  }
+}
diff --git a/app/react/kubernetes/helm/helmChartSourceQueries/useHelmRepoVersions.ts b/app/react/kubernetes/helm/helmChartSourceQueries/useHelmRepoVersions.ts
new file mode 100644
index 0000000..77b774a
--- /dev/null
+++ b/app/react/kubernetes/helm/helmChartSourceQueries/useHelmRepoVersions.ts
@@ -0,0 +1,103 @@
+import { useQueries } from '@tanstack/react-query';
+import { useMemo } from 'react';
+import { compact, flatMap } from 'lodash';
+
+import { withError } from '@/react-tools/react-query';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { queryKeys } from './query-keys';
+
+interface HelmSearch {
+  entries: Entries;
+}
+
+interface Entries {
+  [key: string]: { version: string; appVersion: string }[];
+}
+
+export interface ChartVersion {
+  Chart?: string;
+  Repo: string;
+  Label?: string;
+  Version: string;
+  AppVersion?: string;
+}
+
+type RepoSource = {
+  repo?: string;
+};
+
+/**
+ * React hook to get a list of available versions for a chart from specified repositories
+ *
+ * @param chart The chart name to get versions for
+ * @param repositories Array of repository URLs to search in
+ * @param staleTime Stale time for the query
+ * @param useCache Whether to use the cache for the query
+ */
+export function useHelmRepoVersions(
+  chart: string,
+  staleTime: number,
+  repoSources: RepoSource[] = [],
+  useCache: boolean = true
+) {
+  // Fetch versions from each repository in parallel as separate queries
+  const versionQueries = useQueries({
+    queries: useMemo(
+      () =>
+        repoSources.map(({ repo }) => ({
+          queryKey: queryKeys.chartVersions(repo || '', chart),
+          queryFn: () => getSearchHelmRepo({ repo, chart, useCache }),
+          enabled: !!chart && !!repo,
+          staleTime,
+          ...withError(`Unable to retrieve versions from ${repo}`),
+        })),
+      [repoSources, chart, staleTime, useCache]
+    ),
+  });
+
+  // Combine the results from all repositories for easier consumption
+  const allVersions = useMemo(() => {
+    const successfulResults = compact(versionQueries.map((q) => q.data));
+    return flatMap(successfulResults);
+  }, [versionQueries]);
+
+  return {
+    data: allVersions,
+    isInitialLoading: versionQueries.some((q) => q.isInitialLoading),
+    isError: versionQueries.some((q) => q.isError),
+    isFetching: versionQueries.some((q) => q.isFetching),
+    refetch: () => Promise.all(versionQueries.map((q) => q.refetch())),
+  };
+}
+
+type SearchRepoParams = {
+  repo?: string;
+  chart: string;
+  useCache?: boolean;
+};
+
+/**
+ * Get Helm repositories for user
+ */
+async function getSearchHelmRepo(
+  params: SearchRepoParams
+): Promise<ChartVersion[]> {
+  try {
+    const { data } = await axios.get<HelmSearch>(`templates/helm`, {
+      params,
+    });
+    // if separated by '/', take the last part
+    const chartKey = params.chart.split('/').pop() || params.chart;
+    const versions = data.entries[chartKey];
+    return (
+      versions?.map((v) => ({
+        Repo: params.repo ?? '',
+        Version: v.version,
+        AppVersion: v.appVersion,
+      })) ?? []
+    );
+  } catch (err) {
+    throw parseAxiosError(err, 'Unable to retrieve helm repositories for user');
+  }
+}
diff --git a/app/react/kubernetes/helm/helmChartSourceQueries/useHelmRepositories.ts b/app/react/kubernetes/helm/helmChartSourceQueries/useHelmRepositories.ts
new file mode 100644
index 0000000..4a38a66
--- /dev/null
+++ b/app/react/kubernetes/helm/helmChartSourceQueries/useHelmRepositories.ts
@@ -0,0 +1,92 @@
+import { useQuery } from '@tanstack/react-query';
+import { compact } from 'lodash';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { UserId } from '@/portainer/users/types';
+import { withError } from '@/react-tools/react-query';
+import { useCurrentUser } from '@/react/hooks/useUser';
+import { Option } from '@/react/components/form-components/PortainerSelect';
+
+import { HelmRegistriesResponse } from '../types';
+import { RepoValue } from '../components/HelmRegistrySelect';
+
+import { queryKeys } from './query-keys';
+
+/**
+ * Hook to fetch all Helm registries for the current user
+ */
+export function useUserHelmRepositories<T = string[]>({
+  select,
+}: {
+  select?: (registries: HelmRegistriesResponse) => T;
+} = {}) {
+  const { user } = useCurrentUser();
+  return useQuery(
+    queryKeys.registries(user.Id),
+    async () => getUserHelmRepositories(user.Id),
+    {
+      enabled: !!user.Id,
+      select,
+      ...withError('Unable to retrieve helm registries'),
+    }
+  );
+}
+
+export function useHelmRepoOptions() {
+  return useUserHelmRepositories({
+    select: (registries) => {
+      const registryArray = flattenHelmRegistries(registries);
+      const repoOptions = registryArray
+        .map<Option<RepoValue>>((registry) => ({
+          label: registry,
+          value: {
+            repoUrl: registry,
+            isOCI: false,
+            name: registry,
+          },
+        }))
+        .sort((a, b) => a.label.localeCompare(b.label));
+      return [
+        {
+          label: 'Helm Repositories',
+          options: repoOptions,
+        },
+        {
+          label: 'OCI Registries',
+          options: [
+            {
+              label:
+                'Installing from an OCI registry is a Portainer Business Feature',
+              value: {},
+              disabled: true,
+            },
+          ],
+        },
+      ];
+    },
+  });
+}
+
+/**
+ * Get Helm repositories for user
+ */
+async function getUserHelmRepositories(userId: UserId) {
+  try {
+    const { data } = await axios.get<HelmRegistriesResponse>(
+      `users/${userId}/helm/repositories`
+    );
+    return data;
+  } catch (err) {
+    throw parseAxiosError(err, 'Unable to retrieve helm repositories for user');
+  }
+}
+
+/** get the unique global and user registries in one array */
+export function flattenHelmRegistries(registries: HelmRegistriesResponse) {
+  // compact will remove the global repository if it's empty
+  const repos = compact([
+    registries.GlobalRepository.toLowerCase(),
+    ...registries.UserRepositories.map((repo) => repo.URL.toLowerCase()),
+  ]);
+  return [...new Set(repos)];
+}
diff --git a/app/react/kubernetes/helm/helmReleaseQueries/query-keys.ts b/app/react/kubernetes/helm/helmReleaseQueries/query-keys.ts
new file mode 100644
index 0000000..c12ad5c
--- /dev/null
+++ b/app/react/kubernetes/helm/helmReleaseQueries/query-keys.ts
@@ -0,0 +1,47 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { environmentQueryKeys } from '@/react/portainer/environments/queries/query-keys';
+
+import { UpdateHelmReleasePayload } from '../types';
+
+export const queryKeys = {
+  // Environment-scoped Helm queries (following kubernetes pattern)
+  base: (environmentId: EnvironmentId) =>
+    [
+      ...environmentQueryKeys.item(environmentId),
+      'kubernetes',
+      'helm',
+    ] as const,
+
+  // Helm releases (environment-specific)
+  releases: (environmentId: EnvironmentId) =>
+    [...queryKeys.base(environmentId), 'releases'] as const,
+
+  release: (
+    environmentId: EnvironmentId,
+    namespace: string,
+    name: string,
+    revision?: number,
+    showResources?: boolean
+  ) =>
+    [
+      ...queryKeys.releases(environmentId),
+      namespace,
+      name,
+      revision,
+      showResources,
+    ] as const,
+
+  releaseHistory: (
+    environmentId: EnvironmentId,
+    namespace: string,
+    name: string
+  ) =>
+    [...queryKeys.release(environmentId, namespace, name), 'history'] as const,
+
+  // Environment-specific install operations
+  installDryRun: (
+    environmentId: EnvironmentId,
+    payload: UpdateHelmReleasePayload
+  ) =>
+    [...queryKeys.base(environmentId), 'install', 'dry-run', payload] as const,
+};
diff --git a/app/react/kubernetes/helm/helmReleaseQueries/useHelmDryRun.ts b/app/react/kubernetes/helm/helmReleaseQueries/useHelmDryRun.ts
new file mode 100644
index 0000000..f36c420
--- /dev/null
+++ b/app/react/kubernetes/helm/helmReleaseQueries/useHelmDryRun.ts
@@ -0,0 +1,38 @@
+import { useQuery, UseQueryResult } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import PortainerError from '@/portainer/error';
+
+import { HelmRelease, UpdateHelmReleasePayload } from '../types';
+
+import { updateHelmRelease } from './useUpdateHelmReleaseMutation';
+import { queryKeys } from './query-keys';
+
+export function useHelmDryRun(
+  environmentId: EnvironmentId,
+  payload: UpdateHelmReleasePayload
+): UseQueryResult<HelmRelease, PortainerError> {
+  return useQuery({
+    queryKey: queryKeys.installDryRun(environmentId, payload),
+    queryFn: () =>
+      // use updateHelmRelease as if it were a get request with dryRun. The payload is debounced to prevent too many requests.
+      updateHelmRelease(
+        environmentId,
+        payload,
+        { dryRun: true },
+        {
+          errorMessage: 'Unable to get Helm manifest preview',
+        }
+      ),
+    // don't display error toast, handle it within the component
+    enabled:
+      !!payload.repo &&
+      !!payload.chart &&
+      !!payload.name &&
+      !!payload.namespace &&
+      !!payload.version,
+    retry: false,
+    refetchOnWindowFocus: false,
+    staleTime: 1000 * 60, // small 1 minute stale time to reduce the number of requests
+  });
+}
diff --git a/app/react/kubernetes/helm/helmReleaseQueries/useHelmHistory.ts b/app/react/kubernetes/helm/helmReleaseQueries/useHelmHistory.ts
new file mode 100644
index 0000000..413649b
--- /dev/null
+++ b/app/react/kubernetes/helm/helmReleaseQueries/useHelmHistory.ts
@@ -0,0 +1,46 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { withError } from '@/react-tools/react-query';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { HelmRelease } from '../types';
+
+import { queryKeys } from './query-keys';
+
+export function useHelmHistory(
+  environmentId: EnvironmentId,
+  name: string,
+  namespace: string
+) {
+  return useQuery(
+    queryKeys.releaseHistory(environmentId, namespace, name),
+    () => getHelmHistory(environmentId, name, namespace),
+    {
+      enabled: !!environmentId && !!name && !!namespace,
+      ...withError('Unable to retrieve helm application history'),
+      retry: 3,
+      // occasionally the application shows before the release is created, take some more time to refetch
+      retryDelay: 2000,
+    }
+  );
+}
+
+async function getHelmHistory(
+  environmentId: EnvironmentId,
+  name: string,
+  namespace: string
+) {
+  try {
+    const response = await axios.get<HelmRelease[]>(
+      `endpoints/${environmentId}/kubernetes/helm/${name}/history`,
+      {
+        params: { namespace },
+      }
+    );
+
+    return response.data;
+  } catch (error) {
+    throw parseAxiosError(error, 'Unable to retrieve helm application history');
+  }
+}
diff --git a/app/react/kubernetes/helm/helmReleaseQueries/useHelmRelease.ts b/app/react/kubernetes/helm/helmReleaseQueries/useHelmRelease.ts
new file mode 100644
index 0000000..24af354
--- /dev/null
+++ b/app/react/kubernetes/helm/helmReleaseQueries/useHelmRelease.ts
@@ -0,0 +1,78 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { withError } from '@/react-tools/react-query';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { HelmRelease } from '../types';
+
+import { queryKeys } from './query-keys';
+
+type Options<T> = {
+  select?: (data: HelmRelease) => T;
+  showResources?: boolean;
+  refetchInterval?: number;
+  enabled?: boolean;
+  staleTime?: number;
+  /** when the revision is undefined, the latest revision is fetched */
+  revision?: number;
+};
+/**
+ * React hook to fetch a specific Helm release
+ */
+export function useHelmRelease<T = HelmRelease>(
+  environmentId: EnvironmentId,
+  name: string,
+  namespace: string,
+  options: Options<T> = {}
+) {
+  const { select, showResources, refetchInterval, revision, staleTime } =
+    options;
+  return useQuery(
+    queryKeys.release(environmentId, namespace, name, revision, showResources),
+    () =>
+      getHelmRelease(environmentId, name, {
+        namespace,
+        showResources,
+        revision,
+      }),
+    {
+      enabled:
+        !!environmentId && !!name && !!namespace && (options.enabled ?? true),
+      ...withError('Unable to retrieve helm application details'),
+      retry: 3,
+      // occasionally the application shows before the release is created, take some more time to refetch
+      retryDelay: 2000,
+      select,
+      refetchInterval,
+      staleTime,
+    }
+  );
+}
+
+type Params = {
+  namespace: string;
+  showResources?: boolean;
+  revision?: number;
+};
+
+/**
+ * Get a specific Helm release
+ */
+async function getHelmRelease(
+  environmentId: EnvironmentId,
+  name: string,
+  params: Params
+) {
+  try {
+    const { data } = await axios.get<HelmRelease>(
+      `endpoints/${environmentId}/kubernetes/helm/${name}`,
+      {
+        params,
+      }
+    );
+    return data;
+  } catch (err) {
+    throw parseAxiosError(err, 'Unable to retrieve helm application details');
+  }
+}
diff --git a/app/react/kubernetes/helm/helmReleaseQueries/useHelmRollbackMutation.ts b/app/react/kubernetes/helm/helmReleaseQueries/useHelmRollbackMutation.ts
new file mode 100644
index 0000000..4b246f8
--- /dev/null
+++ b/app/react/kubernetes/helm/helmReleaseQueries/useHelmRollbackMutation.ts
@@ -0,0 +1,63 @@
+import { useMutation } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import {
+  queryClient,
+  withInvalidate,
+  withError,
+} from '@/react-tools/react-query';
+import axios from '@/portainer/services/axios/axios';
+import { queryKeys as applicationsQueryKeys } from '@/react/kubernetes/applications/queries/query-keys';
+
+import { queryKeys } from './query-keys';
+
+/**
+ * Parameters for helm rollback operation
+ *
+ * @see https://helm.sh/docs/helm/helm_rollback/
+ */
+interface RollbackQueryParams {
+  /** Optional namespace for the release (defaults to "default" if not specified) */
+  namespace?: string;
+  /** Revision to rollback to (if omitted or set to 0, rolls back to the previous release) */
+  revision?: number;
+  /** If set, waits until resources are in a ready state before marking the release as successful (default: false) */
+  wait?: boolean;
+  /** If set and --wait enabled, waits until all Jobs have been completed before marking the release as successful (default: false) */
+  waitForJobs?: boolean;
+  /** Performs pods restart for the resources if applicable (default: true) */
+  recreate?: boolean;
+  /** Force resource update through delete/recreate if needed (default: false) */
+  force?: boolean;
+  /** Time to wait for any individual Kubernetes operation in seconds (default: 300) */
+  timeout?: number;
+}
+
+interface RollbackPayload {
+  releaseName: string;
+  params: RollbackQueryParams;
+}
+
+async function rollbackRelease({
+  releaseName,
+  params,
+  environmentId,
+}: RollbackPayload & { environmentId: EnvironmentId }) {
+  return axios.post<Record<string, unknown>>(
+    `/endpoints/${environmentId}/kubernetes/helm/${releaseName}/rollback`,
+    null,
+    { params }
+  );
+}
+
+export function useHelmRollbackMutation(environmentId: EnvironmentId) {
+  return useMutation({
+    mutationFn: ({ releaseName, params }: RollbackPayload) =>
+      rollbackRelease({ releaseName, params, environmentId }),
+    ...withError('Unable to rollback Helm release'),
+    ...withInvalidate(queryClient, [
+      queryKeys.releases(environmentId),
+      applicationsQueryKeys.applications(environmentId),
+    ]),
+  });
+}
diff --git a/app/react/kubernetes/helm/helmReleaseQueries/useUninstallHelmAppMutation.ts b/app/react/kubernetes/helm/helmReleaseQueries/useUninstallHelmAppMutation.ts
new file mode 100644
index 0000000..cb75ac0
--- /dev/null
+++ b/app/react/kubernetes/helm/helmReleaseQueries/useUninstallHelmAppMutation.ts
@@ -0,0 +1,42 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError, withInvalidate } from '@/react-tools/react-query';
+import { queryKeys as applicationsQueryKeys } from '@/react/kubernetes/applications/queries/query-keys';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { queryKeys } from './query-keys';
+
+export function useUninstallHelmAppMutation(environmentId: EnvironmentId) {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: ({
+      releaseName,
+      namespace,
+    }: {
+      releaseName: string;
+      namespace?: string;
+    }) => uninstallHelmApplication(environmentId, releaseName, namespace),
+    ...withInvalidate(queryClient, [
+      queryKeys.releases(environmentId),
+      applicationsQueryKeys.applications(environmentId),
+    ]),
+    ...withError('Unable to uninstall helm application'),
+  });
+}
+
+export async function uninstallHelmApplication(
+  environmentId: EnvironmentId,
+  releaseName: string,
+  namespace?: string
+) {
+  try {
+    await axios.delete(
+      `/endpoints/${environmentId}/kubernetes/helm/${releaseName}`,
+      { params: { namespace } }
+    );
+  } catch (error) {
+    // parseAxiosError, because it's a regular portainer api error
+    throw parseAxiosError(error, 'Unable to remove application');
+  }
+}
diff --git a/app/react/kubernetes/helm/helmReleaseQueries/useUpdateHelmReleaseMutation.ts b/app/react/kubernetes/helm/helmReleaseQueries/useUpdateHelmReleaseMutation.ts
new file mode 100644
index 0000000..9629561
--- /dev/null
+++ b/app/react/kubernetes/helm/helmReleaseQueries/useUpdateHelmReleaseMutation.ts
@@ -0,0 +1,54 @@
+import { useQueryClient, useMutation } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError, withInvalidate } from '@/react-tools/react-query';
+import { queryKeys as applicationsQueryKeys } from '@/react/kubernetes/applications/queries/query-keys';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { HelmRelease, UpdateHelmReleasePayload } from '../types';
+
+import { queryKeys } from './query-keys';
+
+export function useUpdateHelmReleaseMutation(environmentId: EnvironmentId) {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: (payload: UpdateHelmReleasePayload) =>
+      updateHelmRelease(environmentId, payload),
+    ...withInvalidate(queryClient, [
+      queryKeys.releases(environmentId),
+      applicationsQueryKeys.applications(environmentId),
+    ]),
+    ...withError('Unable to update Helm release'),
+  });
+}
+
+type UpdateHelmReleaseParams = {
+  dryRun?: boolean;
+};
+
+type UpdateHelmReleaseOptions = {
+  errorMessage?: string;
+};
+
+export async function updateHelmRelease(
+  environmentId: EnvironmentId,
+  payload: UpdateHelmReleasePayload,
+  params: UpdateHelmReleaseParams = {},
+  options: UpdateHelmReleaseOptions = {}
+) {
+  try {
+    const { data } = await axios.post<HelmRelease>(
+      `endpoints/${environmentId}/kubernetes/helm`,
+      payload,
+      {
+        params,
+      }
+    );
+    return data;
+  } catch (err) {
+    throw parseAxiosError(
+      err,
+      options.errorMessage ?? 'Unable to update helm release'
+    );
+  }
+}
diff --git a/app/react/kubernetes/helm/install/HelmInstallForm.test.tsx b/app/react/kubernetes/helm/install/HelmInstallForm.test.tsx
new file mode 100644
index 0000000..73daa3d
--- /dev/null
+++ b/app/react/kubernetes/helm/install/HelmInstallForm.test.tsx
@@ -0,0 +1,173 @@
+import { http, HttpResponse } from 'msw';
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { vi } from 'vitest';
+
+import { server } from '@/setup-tests/server';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { UserViewModel } from '@/portainer/models/user';
+
+import { Chart } from '../types';
+
+import { HelmInstallForm } from './HelmInstallForm';
+
+const mockNotifySuccess = vi.fn();
+const mockRouterGo = vi.fn();
+
+// Mock the router hook to provide endpointId
+vi.mock('@uirouter/react', async (importOriginal: () => Promise<object>) => ({
+  ...(await importOriginal()),
+  useCurrentStateAndParams: vi.fn(() => ({
+    params: { endpointId: '1' },
+  })),
+  useRouter: vi.fn(() => ({
+    stateService: {
+      go: vi.fn((...args) => mockRouterGo(...args)),
+    },
+  })),
+}));
+
+// Mock dependencies
+vi.mock('@/portainer/services/notifications', () => ({
+  notifySuccess: vi.fn((title: string, text: string) =>
+    mockNotifySuccess(title, text)
+  ),
+}));
+
+vi.mock('@@/modals/confirm', () => ({
+  confirm: vi.fn().mockResolvedValue(true),
+  confirmGenericDiscard: vi.fn().mockResolvedValue(true),
+}));
+
+// Sample test data
+const mockChart: Chart = {
+  name: 'test-chart',
+  description: 'Test Chart Description',
+  repo: 'https://example.com',
+  icon: 'test-icon-url',
+  annotations: {
+    category: 'database',
+  },
+  version: '1.0.1',
+  versions: ['1.0.0', '1.0.1'],
+};
+
+function renderComponent({
+  selectedChart = mockChart,
+  namespace = 'test-namespace',
+  name = 'test-name',
+  isAdmin = true,
+} = {}) {
+  server.use(
+    http.get('/api/templates/helm', () =>
+      HttpResponse.json({
+        entries: {
+          'test-chart': [
+            { version: '1.0.0', appVersion: '1.0.0' },
+            { version: '0.9.0', appVersion: '0.9.0' },
+          ],
+        },
+      })
+    ),
+    http.post('/api/endpoints/:endpointId/kubernetes/helm', () =>
+      HttpResponse.json({})
+    )
+  );
+
+  const user = new UserViewModel({ Username: 'user', Role: isAdmin ? 1 : 2 });
+
+  const Wrapped = withTestQueryProvider(
+    withUserProvider(
+      withTestRouter(() => (
+        <HelmInstallForm
+          selectedChart={selectedChart}
+          namespace={namespace}
+          name={name}
+          isRepoAvailable
+        />
+      )),
+      user
+    )
+  );
+
+  return render(<Wrapped />);
+}
+
+describe('HelmInstallForm', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('should not display any visible error messages on initial load', async () => {
+    renderComponent({ namespace: '' });
+
+    await waitFor(() => {
+      // Check that no error messages (role="alert") are visible
+      expect(screen.queryByRole('alert')).not.toBeInTheDocument();
+    });
+  });
+
+  it('should render the form with version selector and values editor', async () => {
+    renderComponent();
+
+    expect(screen.getByText('Version')).toBeInTheDocument();
+    expect(screen.getByText('Install')).toBeInTheDocument();
+  });
+
+  it('should install helm chart when install button is clicked', async () => {
+    const user = userEvent.setup();
+    let capturedBody: unknown = null;
+
+    renderComponent();
+
+    server.use(
+      http.post(
+        '/api/endpoints/:endpointId/kubernetes/helm',
+        async ({ request }) => {
+          const url = new URL(request.url);
+          if (!url.searchParams.get('dryRun')) {
+            capturedBody = await request.json();
+          }
+          return HttpResponse.json({});
+        }
+      )
+    );
+
+    await screen.findByText('1.0.0 (latest)');
+    await user.click(screen.getByText('Install'));
+
+    await waitFor(() => {
+      expect(capturedBody).toMatchObject({
+        name: 'test-name',
+        repo: 'https://example.com',
+        chart: 'test-chart',
+        values: '',
+        namespace: 'test-namespace',
+        version: '1.0.0',
+      });
+    });
+  });
+
+  it('should disable install button when namespace or name is undefined', () => {
+    renderComponent({ namespace: '' });
+    expect(screen.getByText('Install')).toBeDisabled();
+  });
+
+  it('should call success handlers when installation succeeds', async () => {
+    const user = userEvent.setup();
+    renderComponent();
+
+    await screen.findByText('1.0.0 (latest)');
+    await user.click(screen.getByText('Install'));
+
+    await waitFor(() => {
+      expect(mockNotifySuccess).toHaveBeenCalledWith(
+        'Success',
+        'Helm chart successfully installed'
+      );
+      expect(mockRouterGo).toHaveBeenCalledWith('kubernetes.applications');
+    });
+  });
+});
diff --git a/app/react/kubernetes/helm/install/HelmInstallForm.tsx b/app/react/kubernetes/helm/install/HelmInstallForm.tsx
new file mode 100644
index 0000000..b8484da
--- /dev/null
+++ b/app/react/kubernetes/helm/install/HelmInstallForm.tsx
@@ -0,0 +1,122 @@
+import { useRef, useState } from 'react';
+import { Formik, FormikProps } from 'formik';
+import { useRouter } from '@uirouter/react';
+
+import { notifySuccess } from '@/portainer/services/notifications';
+import { useCanExit } from '@/react/hooks/useCanExit';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+
+import { confirm, confirmGenericDiscard } from '@@/modals/confirm';
+import { Option } from '@@/form-components/PortainerSelect';
+
+import { Chart } from '../types';
+import { useUpdateHelmReleaseMutation } from '../helmReleaseQueries/useUpdateHelmReleaseMutation';
+import {
+  ChartVersion,
+  useHelmRepoVersions,
+} from '../helmChartSourceQueries/useHelmRepoVersions';
+
+import { HelmInstallInnerForm } from './HelmInstallInnerForm';
+import { HelmInstallFormValues } from './types';
+
+type Props = {
+  selectedChart: Chart;
+  namespace?: string;
+  name?: string;
+  isRepoAvailable: boolean;
+};
+
+export function HelmInstallForm({
+  selectedChart,
+  namespace,
+  name,
+  isRepoAvailable,
+}: Props) {
+  const environmentId = useEnvironmentId();
+  const [previewIsValid, setPreviewIsValid] = useState(false);
+  const router = useRouter();
+  const helmRepoVersionsQuery = useHelmRepoVersions(
+    selectedChart.name,
+    60 * 60 * 1000, // 1 hour
+    [
+      {
+        repo: selectedChart.repo,
+      },
+    ]
+  );
+  const versions = helmRepoVersionsQuery.data;
+  const versionOptions: Option<ChartVersion>[] = versions.map(
+    (version, index) => ({
+      label: index === 0 ? `${version.Version} (latest)` : version.Version,
+      value: version,
+    })
+  );
+  const defaultVersion = versionOptions[0]?.value;
+  const initialValues: HelmInstallFormValues = {
+    values: '',
+    version: defaultVersion?.Version ?? '',
+    repo: defaultVersion?.Repo ?? selectedChart.repo ?? '',
+  };
+
+  const installHelmChartMutation = useUpdateHelmReleaseMutation(environmentId);
+
+  const formikRef = useRef<FormikProps<HelmInstallFormValues>>(null);
+  useCanExit(() => !formikRef.current?.dirty || confirmGenericDiscard());
+
+  return (
+    <Formik
+      innerRef={formikRef}
+      initialValues={initialValues}
+      enableReinitialize
+      onSubmit={handleSubmit}
+    >
+      <HelmInstallInnerForm
+        selectedChart={selectedChart}
+        namespace={namespace}
+        name={name}
+        versionOptions={versionOptions}
+        isVersionsLoading={helmRepoVersionsQuery.isInitialLoading}
+        isRepoAvailable={isRepoAvailable}
+        setPreviewIsValid={setPreviewIsValid}
+      />
+    </Formik>
+  );
+
+  async function handleSubmit(values: HelmInstallFormValues) {
+    if (!name || !namespace) {
+      // Theoretically this should never happen and is mainly to keep typescript happy
+      return;
+    }
+
+    if (!previewIsValid) {
+      const confirmed = await confirm({
+        title: 'Chart validation failed',
+        message:
+          'The Helm manifest preview validation failed, which may indicate configuration issues. This can be normal when creating new resources. Do you want to proceed with the installation?',
+      });
+      if (!confirmed) {
+        return;
+      }
+    }
+
+    await installHelmChartMutation.mutateAsync(
+      {
+        name,
+        repo: selectedChart.repo,
+        chart: selectedChart.name,
+        values: values.values,
+        namespace,
+        version: values.version,
+      },
+      {
+        onSuccess() {
+          notifySuccess('Success', 'Helm chart successfully installed');
+
+          // Reset the form so page can be navigated away from without getting "Are you sure?"
+          formikRef.current?.resetForm();
+          router.stateService.go('kubernetes.applications');
+        },
+      }
+    );
+  }
+}
diff --git a/app/react/kubernetes/helm/install/HelmInstallInnerForm.tsx b/app/react/kubernetes/helm/install/HelmInstallInnerForm.tsx
new file mode 100644
index 0000000..922f1dc
--- /dev/null
+++ b/app/react/kubernetes/helm/install/HelmInstallInnerForm.tsx
@@ -0,0 +1,140 @@
+import { Form, useFormikContext } from 'formik';
+import { useMemo } from 'react';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { Option, PortainerSelect } from '@@/form-components/PortainerSelect';
+import { FormSection } from '@@/form-components/FormSection';
+import { LoadingButton } from '@@/buttons';
+
+import { Chart } from '../types';
+import { useHelmChartValues } from '../helmChartSourceQueries/useHelmChartValues';
+import { HelmValuesInput } from '../components/HelmValuesInput';
+import { ChartVersion } from '../helmChartSourceQueries/useHelmRepoVersions';
+import { ManifestPreviewFormSection } from '../components/ManifestPreviewFormSection';
+
+import { HelmInstallFormValues } from './types';
+
+type Props = {
+  selectedChart: Chart;
+  namespace?: string;
+  name?: string;
+  versionOptions: Option<ChartVersion>[];
+  isVersionsLoading: boolean;
+  isRepoAvailable: boolean;
+  setPreviewIsValid: (isValid: boolean) => void;
+};
+
+export function HelmInstallInnerForm({
+  selectedChart,
+  namespace,
+  name,
+  versionOptions,
+  isVersionsLoading,
+  isRepoAvailable,
+  setPreviewIsValid,
+}: Props) {
+  const environmentId = useEnvironmentId();
+  const { values, setFieldValue, isSubmitting } =
+    useFormikContext<HelmInstallFormValues>();
+
+  const selectedVersion: ChartVersion | undefined = useMemo(
+    () =>
+      versionOptions.find(
+        (v) =>
+          v.value.Version === values.version &&
+          v.value.Repo === selectedChart.repo
+      )?.value ?? versionOptions[0]?.value,
+    [versionOptions, values.version, selectedChart.repo]
+  );
+
+  const repoParams = {
+    repo: selectedChart.repo,
+  };
+  // use isLatestVersionFetched to cache the latest version, to avoid duplicate fetches
+  const isLatestVersionFetched =
+    // if no version is selected, the latest version gets fetched
+    !versionOptions.length ||
+    // otherwise check if the selected version is the latest version
+    (selectedVersion?.Version === versionOptions[0]?.value.Version &&
+      selectedVersion?.Repo === versionOptions[0]?.value.Repo);
+  const chartValuesRefQuery = useHelmChartValues(
+    {
+      chart: selectedChart.name,
+      version: values?.version,
+      ...repoParams,
+    },
+    isLatestVersionFetched
+  );
+
+  const payload = useMemo(
+    () => ({
+      name: name || '',
+      namespace: namespace || '',
+      chart: selectedChart.name,
+      version: values?.version,
+      repo: selectedChart.repo,
+      values: values.values,
+    }),
+    [
+      name,
+      namespace,
+      selectedChart.name,
+      values?.version,
+      selectedChart.repo,
+      values.values,
+    ]
+  );
+
+  return (
+    <Form className="form-horizontal">
+      <div className="form-group !m-0">
+        <FormSection title="Configuration" className="mt-4">
+          <FormControl
+            label="Version"
+            inputId="version-input"
+            isLoading={isVersionsLoading}
+            loadingText="Loading versions..."
+          >
+            <PortainerSelect<ChartVersion>
+              value={selectedVersion}
+              options={versionOptions}
+              noOptionsMessage={() => 'No versions found'}
+              placeholder="Select a version"
+              onChange={(version) => {
+                if (version) {
+                  setFieldValue('version', version.Version);
+                  setFieldValue('repo', version.Repo);
+                }
+              }}
+              data-cy="helm-version-input"
+            />
+          </FormControl>
+          <HelmValuesInput
+            values={values.values}
+            setValues={(values) => setFieldValue('values', values)}
+            valuesRef={chartValuesRefQuery.data?.values ?? ''}
+            isValuesRefLoading={chartValuesRefQuery.isInitialLoading}
+          />
+        </FormSection>
+        <ManifestPreviewFormSection
+          payload={payload}
+          onChangePreviewValidation={setPreviewIsValid}
+          title="Manifest preview"
+          environmentId={environmentId}
+        />
+      </div>
+
+      <LoadingButton
+        className="!ml-0 mt-5"
+        loadingText="Installing Helm chart"
+        isLoading={isSubmitting}
+        disabled={!namespace || !name || !isRepoAvailable}
+        data-cy="helm-install"
+      >
+        Install
+      </LoadingButton>
+    </Form>
+  );
+}
diff --git a/app/react/kubernetes/helm/install/HelmInstallView.tsx b/app/react/kubernetes/helm/install/HelmInstallView.tsx
new file mode 100644
index 0000000..afc2376
--- /dev/null
+++ b/app/react/kubernetes/helm/install/HelmInstallView.tsx
@@ -0,0 +1,85 @@
+import { useState, useMemo } from 'react';
+
+import { useNamespacesQuery } from '@/react/kubernetes/namespaces/queries/useNamespacesQuery';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+
+import { PageHeader } from '@@/PageHeader';
+import { Widget, WidgetBody } from '@@/Widget';
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+import { PortainerSelect } from '@@/form-components/PortainerSelect';
+import { FormSection } from '@@/form-components/FormSection';
+
+import { HelmTemplates } from '../HelmTemplates/HelmTemplates';
+import { K8sRegistryAccessNotice } from '../../components/K8sRegistryAccessNotice';
+
+export function HelmInstallView() {
+  const environmentId = useEnvironmentId();
+  const [namespace, setNamespace] = useState('');
+  const [name, setName] = useState('');
+
+  const namespacesQuery = useNamespacesQuery(environmentId);
+  const namespaces = useMemo(
+    () =>
+      Object.values(namespacesQuery.data ?? {}).map((ns) => ({
+        label: ns.Name,
+        value: ns.Name,
+      })),
+    [namespacesQuery.data]
+  );
+
+  const defaultNamespace =
+    namespaces.find((ns) => ns.value === 'default')?.value ||
+    namespaces[0]?.value ||
+    '';
+
+  // Set default namespace if not set
+  if (!namespace && defaultNamespace) {
+    setNamespace(defaultNamespace);
+  }
+
+  return (
+    <>
+      <PageHeader title="Helm install" breadcrumbs="Helm install" reload />
+      <div className="row">
+        <div className="col-sm-12 form-horizontal">
+          <Widget>
+            <WidgetBody>
+              <FormSection title="Deploy to">
+                <FormControl label="Namespace" required>
+                  <div className="mb-1">
+                    <K8sRegistryAccessNotice
+                      namespace={namespace}
+                      environmentId={environmentId}
+                    />
+                  </div>
+                  <PortainerSelect
+                    value={namespace}
+                    onChange={setNamespace}
+                    options={namespaces}
+                    data-cy="namespace-select"
+                  />
+                </FormControl>
+
+                <FormControl label="Release name" required>
+                  <Input
+                    value={name}
+                    onChange={(e) => setName(e.target.value)}
+                    placeholder="e.g. my-app"
+                    data-cy="k8sHelmInstall-nameInput"
+                  />
+                </FormControl>
+              </FormSection>
+
+              <HelmTemplates
+                namespace={namespace}
+                name={name}
+                onSelectHelmChart={() => {}}
+              />
+            </WidgetBody>
+          </Widget>
+        </div>
+      </div>
+    </>
+  );
+}
diff --git a/app/react/kubernetes/helm/install/types.ts b/app/react/kubernetes/helm/install/types.ts
new file mode 100644
index 0000000..f59cba3
--- /dev/null
+++ b/app/react/kubernetes/helm/install/types.ts
@@ -0,0 +1,7 @@
+export type HelmInstallFormValues = {
+  values: string;
+  version: string;
+  repo: string;
+  chartName?: string;
+  chartRepo?: string;
+};
diff --git a/app/react/kubernetes/helm/types.ts b/app/react/kubernetes/helm/types.ts
new file mode 100644
index 0000000..f0c8ff2
--- /dev/null
+++ b/app/react/kubernetes/helm/types.ts
@@ -0,0 +1,131 @@
+interface ResourceStatus {
+  phase?: string;
+  reason?: string;
+  message?: string;
+  healthSummary?: {
+    status: string;
+    reason: string;
+    message?: string;
+  };
+}
+
+// A resource has a bunch of common fields that are shared by all kubernetes resources, so can be used when we're unsure about the resource type we have
+export interface GenericResource {
+  apiVersion?: string;
+  kind?: string;
+  metadata: {
+    name: string;
+    namespace?: string;
+    uid?: string;
+  };
+  status: ResourceStatus;
+}
+
+export interface HelmRelease {
+  /** The name of the release */
+  name: string;
+  /** Information about the release */
+  info?: {
+    status?: string;
+    notes?: string;
+    description?: string;
+    resources?: GenericResource[];
+    last_deployed: string;
+  };
+  /** The chart that was released */
+  chart: HelmChart;
+  /** Extra values added to the chart that override the default values */
+  config?: Record<string, unknown>;
+  /** String representation of the rendered template */
+  manifest: string;
+  /** All hooks declared for this release */
+  hooks?: unknown[];
+  /** Integer representing the revision of the release */
+  version?: number;
+  /** Kubernetes namespace of the release */
+  namespace?: string;
+  /** Labels that identify the source of the chart (repo, path, etc.) */
+  chartReference?: ChartReference;
+  /** Values of the release */
+  values?: Values;
+}
+
+export interface Values {
+  /** User supplied values */
+  userSuppliedValues?: string;
+  /** Computed values */
+  computedValues?: string;
+}
+
+export interface HelmChart {
+  /** Raw contents of the files originally contained in the chart archive. Only used in special cases like `helm show values` */
+  raw?: unknown[];
+  /** Contents of the Chartfile */
+  metadata?: {
+    name?: string;
+    version?: string;
+    appVersion?: string;
+  };
+  /** Contents of Chart.lock */
+  lock?: unknown;
+  /** Templates for this chart */
+  templates?: unknown[];
+  /** Default config for this chart */
+  values?: Record<string, unknown>;
+  /** Optional JSON schema for imposing structure on Values */
+  schema?: unknown;
+  /** Miscellaneous files in a chart archive (e.g. README, LICENSE) */
+  files?: unknown[];
+}
+
+export interface ChartReference {
+  /** Local or packaged chart path used during install/upgrade */
+  chartPath?: string;
+  /** Helm repository URL if the chart came from a repo (CE only) */
+  repoURL?: string;
+  /** Registry identifier if coming from an OCI registry */
+  registryID?: number;
+}
+
+export interface Chart extends HelmChartResponse {
+  repo: string;
+}
+
+export interface HelmChartResponse {
+  name: string;
+  description: string;
+  icon?: string;
+  annotations?: {
+    category?: string;
+  };
+  version: string;
+  versions: string[];
+}
+
+export interface HelmRegistryResponse {
+  Id: number;
+  UserId: number;
+  URL: string;
+}
+
+export interface HelmRegistriesResponse {
+  GlobalRepository: string;
+  UserRepositories: HelmRegistryResponse[];
+}
+
+export interface HelmChartsResponse {
+  entries: Record<string, HelmChartResponse[]>;
+  apiVersion: string;
+  generated: string;
+}
+
+export interface UpdateHelmReleasePayload {
+  namespace: string;
+  values?: string;
+  repo: string;
+  name: string;
+  chart: string;
+  appVersion?: string;
+  version?: string;
+  atomic?: boolean;
+}
diff --git a/app/react/kubernetes/ingresses/CreateIngressView/CreateIngressView.tsx b/app/react/kubernetes/ingresses/CreateIngressView/CreateIngressView.tsx
new file mode 100644
index 0000000..554155d
--- /dev/null
+++ b/app/react/kubernetes/ingresses/CreateIngressView/CreateIngressView.tsx
@@ -0,0 +1,859 @@
+import { useState, useEffect, useMemo, useCallback, ReactNode } from 'react';
+import { useCurrentStateAndParams, useRouter } from '@uirouter/react';
+import { v4 as uuidv4 } from 'uuid';
+import { debounce } from 'lodash';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useK8sSecrets } from '@/react/kubernetes/configs/queries/useK8sSecrets';
+import { notifyError, notifySuccess } from '@/portainer/services/notifications';
+import { useAuthorizations } from '@/react/hooks/useUser';
+import { Annotation } from '@/react/kubernetes/annotations/types';
+import { prepareAnnotations } from '@/react/kubernetes/utils';
+import { useNamespaceAccessRedirect } from '@/react/kubernetes/namespaces/hooks/useNamespaceAccessRedirect';
+
+import { Link } from '@@/Link';
+import { PageHeader } from '@@/PageHeader';
+import { Option } from '@@/form-components/Input/Select';
+import { Button } from '@@/buttons';
+
+import { useNamespacesQuery } from '../../namespaces/queries/useNamespacesQuery';
+import { Ingress, IngressController } from '../types';
+import {
+  useCreateIngress,
+  useIngresses,
+  useUpdateIngress,
+  useIngressControllers,
+} from '../queries';
+import { useNamespaceServices } from '../../services/useNamespaceServices';
+
+import {
+  Rule,
+  Path,
+  Host,
+  GroupedServiceOptions,
+  IngressErrors,
+} from './types';
+import { IngressForm } from './IngressForm';
+import {
+  prepareTLS,
+  preparePaths,
+  prepareRuleFromIngress,
+  checkIfPathExistsWithHost,
+} from './utils';
+
+export function CreateIngressView() {
+  const environmentId = useEnvironmentId();
+  const { params } = useCurrentStateAndParams();
+  useNamespaceAccessRedirect(params.namespace, { to: 'kubernetes.ingresses' });
+  const { authorized: isAuthorizedToAddEdit } = useAuthorizations([
+    'K8sIngressesW',
+  ]);
+
+  const router = useRouter();
+  const isEdit = !!params.namespace;
+
+  useEffect(() => {
+    if (!isAuthorizedToAddEdit) {
+      const message = `Not authorized to ${isEdit ? 'edit' : 'add'} ingresses`;
+      notifyError('Error', new Error(message));
+      router.stateService.go('kubernetes.ingresses');
+    }
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [isAuthorizedToAddEdit, isEdit]);
+
+  const [namespace, setNamespace] = useState<string>(params.namespace || '');
+  const [ingressRule, setIngressRule] = useState<Rule>({} as Rule);
+  // isEditClassNameSet is used to prevent premature validation of the classname in the edit view
+  const [isEditClassNameSet, setIsEditClassNameSet] = useState<boolean>(false);
+
+  const [errors, setErrors] = useState<IngressErrors>({});
+
+  const { data: namespaces, ...namespacesQuery } =
+    useNamespacesQuery(environmentId);
+
+  const { data: allServices } = useNamespaceServices(environmentId, namespace);
+  const secretsResults = useK8sSecrets(environmentId, namespace);
+  const ingressesResults = useIngresses(environmentId);
+  const { data: ingressControllers, ...ingressControllersQuery } =
+    useIngressControllers(environmentId, namespace);
+
+  const createIngressMutation = useCreateIngress();
+  const updateIngressMutation = useUpdateIngress();
+
+  const [ingressNames, ingresses, ruleCounterByNamespace, hostWithTLS] =
+    useMemo((): [
+      string[],
+      Ingress[],
+      Record<string, number>,
+      Record<string, string>,
+    ] => {
+      const ruleCounterByNamespace: Record<string, number> = {};
+      const hostWithTLS: Record<string, string> = {};
+      ingressesResults.data?.forEach((ingress: Ingress) => {
+        ingress.TLS?.forEach((tls) => {
+          tls.Hosts.forEach((host) => {
+            hostWithTLS[host] = tls.SecretName;
+          });
+        });
+      });
+      const ingressNames: string[] = [];
+      ingressesResults.data?.forEach((ing: Ingress) => {
+        ruleCounterByNamespace[ing.Namespace] =
+          ruleCounterByNamespace[ing.Namespace] || 0;
+        const n = ing.Name.match(/^(.*)-(\d+)$/);
+        if (n?.length === 3) {
+          ruleCounterByNamespace[ing.Namespace] = Math.max(
+            ruleCounterByNamespace[ing.Namespace],
+            Number(n[2])
+          );
+        }
+        if (ing.Namespace === namespace) {
+          ingressNames.push(ing.Name);
+        }
+      });
+      return [
+        ingressNames || [],
+        ingressesResults.data || [],
+        ruleCounterByNamespace,
+        hostWithTLS,
+      ];
+    }, [ingressesResults.data, namespace]);
+
+  const namespaceOptions = useMemo(
+    () =>
+      Object.entries(namespaces || {})
+        .filter(([, ns]) => !ns.IsSystem)
+        .map(([, ns]) => ({
+          label: ns.Name,
+          value: ns.Name,
+        })),
+    [namespaces]
+  );
+
+  const serviceOptions: GroupedServiceOptions = useMemo(() => {
+    const groupedOptions: GroupedServiceOptions = (
+      allServices?.reduce<GroupedServiceOptions>(
+        (groupedOptions, service) => {
+          // add a new option to the group that matches the service type
+          const newGroupedOptions = groupedOptions.map((group) => {
+            if (group.label === service.Type) {
+              return {
+                ...group,
+                options: [
+                  ...group.options,
+                  {
+                    label: service.Name,
+                    selectedLabel: `${service.Name} (${service.Type})`,
+                    value: service.Name,
+                  },
+                ],
+              };
+            }
+            return group;
+          });
+          return newGroupedOptions;
+        },
+        [
+          { label: 'ClusterIP', options: [] },
+          { label: 'NodePort', options: [] },
+          { label: 'LoadBalancer', options: [] },
+        ] as GroupedServiceOptions
+      ) || []
+    ).filter((group) => group.options.length > 0);
+    return groupedOptions;
+  }, [allServices]);
+
+  const servicePorts = useMemo(
+    () =>
+      allServices
+        ? Object.fromEntries(
+            allServices?.map((service) => [
+              service.Name,
+              service.Ports?.map((port) => ({
+                label: String(port.Port),
+                value: String(port.Port),
+              })) ?? [],
+            ])
+          )
+        : {},
+    [allServices]
+  );
+
+  const existingIngressClass = useMemo(
+    () =>
+      ingressControllers?.find(
+        (controller) =>
+          controller.ClassName === ingressRule.IngressClassName ||
+          (controller.Type === 'custom' && ingressRule.IngressClassName === '')
+      ),
+    [ingressControllers, ingressRule.IngressClassName]
+  );
+
+  const ingressClassOptions: Option<string>[] = useMemo(() => {
+    const allowedIngressClassOptions =
+      ingressControllers
+        ?.filter((controller) => !!controller.Availability)
+        .map((cls) => ({
+          label: cls.ClassName,
+          value: cls.ClassName,
+        })) || [];
+
+    // if the ingress class is not set, return only the allowed ingress classes
+    if (ingressRule.IngressClassName === '' || !isEdit) {
+      return allowedIngressClassOptions;
+    }
+
+    // if the ingress class is set and it exists (even if disallowed), return the allowed ingress classes + the disallowed option
+    const disallowedIngressClasses =
+      ingressControllers
+        ?.filter(
+          (controller) =>
+            !controller.Availability &&
+            existingIngressClass?.ClassName === controller.ClassName
+        )
+        .map((controller) => ({
+          label: `${controller.ClassName} - DISALLOWED`,
+          value: controller.ClassName,
+        })) || [];
+
+    const existingIngressClassFound = ingressControllers?.find(
+      (controller) => existingIngressClass?.ClassName === controller.ClassName
+    );
+    if (existingIngressClassFound) {
+      return [...allowedIngressClassOptions, ...disallowedIngressClasses];
+    }
+
+    // if the ingress class is set and it doesn't exist, return the allowed ingress classes + the not found option
+    const notFoundIngressClassOption = {
+      label: `${ingressRule.IngressClassName} - NOT FOUND`,
+      value: ingressRule.IngressClassName || '',
+    };
+    return [...allowedIngressClassOptions, notFoundIngressClassOption];
+  }, [
+    existingIngressClass?.ClassName,
+    ingressControllers,
+    ingressRule.IngressClassName,
+    isEdit,
+  ]);
+
+  const handleIngressChange = useCallback(
+    (key: string, val: string) => {
+      setIngressRule((prevRules) => {
+        const rule = { ...prevRules, [key]: val };
+        if (key === 'IngressClassName') {
+          rule.IngressType = ingressControllers?.find(
+            (c) => c.ClassName === val
+          )?.Type;
+        }
+        return rule;
+      });
+    },
+    [ingressControllers]
+  );
+
+  // when them selected ingress class option update is no longer available set to an empty value
+  useEffect(() => {
+    const ingressClasses = ingressClassOptions.map((option) => option.value);
+    if (
+      !ingressClasses.includes(ingressRule.IngressClassName) &&
+      ingressControllersQuery.isSuccess
+    ) {
+      handleIngressChange('IngressClassName', '');
+    }
+  }, [
+    handleIngressChange,
+    ingressClassOptions,
+    ingressControllersQuery.isSuccess,
+    ingressRule.IngressClassName,
+  ]);
+
+  const secrets = secretsResults?.data?.filter(
+    (config) =>
+      config.type === 'kubernetes.io/tls' &&
+      config.metadata?.namespace === namespace
+  );
+  const tlsOptions: Option<string>[] = useMemo(
+    () => [
+      { label: 'No TLS', value: '' },
+      ...(secrets?.map((config) => ({
+        label: config.metadata?.name as string,
+        value: config.metadata?.name as string,
+      })) || []),
+    ],
+    [secrets]
+  );
+
+  useEffect(() => {
+    if (
+      !!params.name &&
+      ingressesResults.data &&
+      !ingressRule.IngressName &&
+      !ingressControllersQuery.isLoading &&
+      !ingressControllersQuery.isLoading
+    ) {
+      // if it is an edit screen, prepare the rule from the ingress
+      const ing = ingressesResults.data?.find(
+        (ing) => ing.Name === params.name && ing.Namespace === params.namespace
+      );
+      if (ing) {
+        const type = ingressControllers?.find(
+          (c) =>
+            c.ClassName === ing.ClassName ||
+            (c.Type === 'custom' && !ing.ClassName)
+        )?.Type;
+        const r = prepareRuleFromIngress(ing, type);
+        r.IngressType = type || r.IngressType;
+        setIngressRule(r);
+        setIsEditClassNameSet(true);
+      }
+    }
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [
+    params.name,
+    ingressesResults.data,
+    ingressControllers,
+    ingressRule.IngressName,
+    params.namespace,
+  ]);
+
+  useEffect(() => {
+    // for each host, if the tls selection doesn't exist as an option, change it to the first option
+    if (ingressRule?.Hosts?.length) {
+      ingressRule.Hosts.forEach((host, hIndex) => {
+        const secret = host.Secret || '';
+        const tlsOptionVals = tlsOptions.map((o) => o.value);
+        if (tlsOptions?.length && !tlsOptionVals?.includes(secret)) {
+          handleTLSChange(hIndex, tlsOptionVals[0]);
+        }
+      });
+    }
+  }, [tlsOptions, ingressRule.Hosts]);
+
+  useEffect(() => {
+    // for each path in each host, if the service port doesn't exist as an option, change it to the first option
+    if (ingressRule?.Hosts?.length) {
+      ingressRule.Hosts.forEach((host, hIndex) => {
+        host?.Paths?.forEach((path, pIndex) => {
+          const serviceName = path.ServiceName;
+          const currentServicePorts = servicePorts[serviceName]?.map(
+            (p) => p.value
+          );
+          if (
+            currentServicePorts?.length &&
+            !currentServicePorts?.includes(String(path.ServicePort))
+          ) {
+            handlePathChange(
+              hIndex,
+              pIndex,
+              'ServicePort',
+              currentServicePorts[0]
+            );
+          }
+        });
+      });
+    }
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [ingressRule, servicePorts]);
+
+  const validate = useCallback(
+    (
+      ingressRule: Rule,
+      ingressNames: string[],
+      groupedServiceOptions: GroupedServiceOptions,
+      existingIngressClass?: IngressController
+    ) => {
+      const errors: Record<string, ReactNode> = {};
+      const rule = { ...ingressRule };
+
+      // User cannot edit the namespace and the ingress name
+      if (!isEdit) {
+        if (!rule.Namespace) {
+          errors.namespace = 'Namespace is required';
+        }
+
+        const nameRegex = /^[a-z]([a-z0-9-]{0,61}[a-z0-9])?$/;
+        if (!rule.IngressName) {
+          errors.ingressName = 'Ingress name is required';
+        } else if (!nameRegex.test(rule.IngressName)) {
+          errors.ingressName =
+            "This field must consist of lower case alphanumeric characters or '-', contain at most 63 characters, start with an alphabetic character, and end with an alphanumeric character (e.g. 'my-name', or 'abc-123').";
+        } else if (ingressNames.includes(rule.IngressName)) {
+          errors.ingressName = 'Ingress name already exists';
+        }
+
+        if (
+          (!ingressClassOptions.length || !rule.IngressClassName) &&
+          ingressControllersQuery.isSuccess
+        ) {
+          errors.className = 'Ingress class is required';
+        }
+      }
+
+      if (isEdit && !ingressRule.IngressClassName && isEditClassNameSet) {
+        errors.className =
+          'No ingress class is currently set for this ingress - use of the Portainer UI requires one to be set.';
+      }
+
+      if (
+        isEdit &&
+        (!existingIngressClass ||
+          (existingIngressClass && !existingIngressClass.Availability)) &&
+        ingressRule.IngressClassName
+      ) {
+        if (!rule.IngressType) {
+          errors.className =
+            'Currently set to an ingress class that cannot be found in the cluster - you must select a valid class.';
+        } else {
+          errors.className =
+            'Currently set to an ingress class that you do not have access to - you must select a valid class.';
+        }
+      }
+
+      const duplicatedAnnotations: string[] = [];
+      const re = /^([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]$/;
+      rule.Annotations?.forEach((a, i) => {
+        if (!a.key) {
+          errors[`annotations.key[${i}]`] = 'Key is required.';
+        } else if (duplicatedAnnotations.includes(a.key)) {
+          errors[`annotations.key[${i}]`] =
+            'Key is a duplicate of an existing one.';
+        } else {
+          const key = a.key.split('/');
+          if (key.length > 2) {
+            errors[`annotations.key[${i}]`] =
+              'Two segments are allowed, separated by a slash (/): a prefix (optional) and a name.';
+          } else if (key.length === 2) {
+            if (key[0].length > 253) {
+              errors[`annotations.key[${i}]`] =
+                "Prefix (before the slash) can't exceed 253 characters.";
+            } else if (key[1].length > 63) {
+              errors[`annotations.key[${i}]`] =
+                "Name (after the slash) can't exceed 63 characters.";
+            } else if (!re.test(key[1])) {
+              errors[`annotations.key[${i}]`] =
+                'Start and end with alphanumeric characters only, limiting characters in between to dashes, underscores, and alphanumerics.';
+            }
+          } else if (key.length === 1) {
+            if (key[0].length > 63) {
+              errors[`annotations.key[${i}]`] =
+                "Name (the segment after a slash (/), or only segment if no slash) can't exceed 63 characters.";
+            } else if (!re.test(key[0])) {
+              errors[`annotations.key[${i}]`] =
+                'Start and end with alphanumeric characters only, limiting characters in between to dashes, underscores, and alphanumerics.';
+            }
+          }
+        }
+        if (!a.value) {
+          errors[`annotations.value[${i}]`] = 'Value is required.';
+        }
+        duplicatedAnnotations.push(a.key);
+      });
+
+      const duplicatedHosts: string[] = [];
+      // Check if the paths are duplicates
+      rule.Hosts?.forEach((host, hi) => {
+        if (!host.NoHost) {
+          if (!host.Host) {
+            errors[`hosts[${hi}].host`] = 'Host is required';
+          } else if (duplicatedHosts.includes(host.Host)) {
+            errors[`hosts[${hi}].host`] = 'Host cannot be duplicated';
+          }
+          duplicatedHosts.push(host.Host);
+        }
+
+        // Validate service
+        host.Paths?.forEach((path, pi) => {
+          if (!path.ServiceName) {
+            errors[`hosts[${hi}].paths[${pi}].servicename`] =
+              'Service name is required';
+          }
+
+          const availableServiceNames = groupedServiceOptions.flatMap(
+            (optionGroup) => optionGroup.options.map((option) => option.value)
+          );
+
+          if (
+            isEdit &&
+            path.ServiceName &&
+            !availableServiceNames.find((sn) => sn === path.ServiceName)
+          ) {
+            errors[`hosts[${hi}].paths[${pi}].servicename`] = (
+              <span>
+                Currently set to {path.ServiceName}, which does not exist. You
+                can create a service with this name for a particular deployment
+                via{' '}
+                <Link
+                  to="kubernetes.applications"
+                  params={{ id: environmentId }}
+                  className="text-primary"
+                  target="_blank"
+                  data-cy="ingresses-create-application-link"
+                >
+                  Applications
+                </Link>
+                , and on returning here it will be picked up.
+              </span>
+            );
+          }
+
+          if (!path.ServicePort) {
+            errors[`hosts[${hi}].paths[${pi}].serviceport`] =
+              'Service port is required';
+          }
+        });
+        // Validate paths
+        const paths = host.Paths.map((path) => path.Route);
+        paths.forEach((item, idx) => {
+          if (!item) {
+            errors[`hosts[${hi}].paths[${idx}].path`] = 'Path cannot be empty';
+          } else if (paths.indexOf(item) !== idx) {
+            errors[`hosts[${hi}].paths[${idx}].path`] =
+              'Paths cannot be duplicated';
+          } else {
+            // Validate host and path combination globally
+            const isExists = checkIfPathExistsWithHost(
+              ingresses,
+              host.Host,
+              item,
+              params.name
+            );
+            if (isExists) {
+              errors[`hosts[${hi}].paths[${idx}].path`] =
+                'Path is already in use with the same host';
+            }
+          }
+        });
+      });
+
+      setErrors(errors);
+      if (Object.keys(errors).length > 0) {
+        return false;
+      }
+      return true;
+    },
+    [
+      isEdit,
+      isEditClassNameSet,
+      ingressClassOptions.length,
+      ingressControllersQuery.isSuccess,
+      environmentId,
+      ingresses,
+      params.name,
+    ]
+  );
+
+  const debouncedValidate = useMemo(() => debounce(validate, 500), [validate]);
+
+  useEffect(() => {
+    if (namespace.length > 0) {
+      debouncedValidate(
+        ingressRule,
+        ingressNames || [],
+        serviceOptions || [],
+        existingIngressClass
+      );
+    }
+  }, [
+    ingressRule,
+    namespace,
+    ingressNames,
+    serviceOptions,
+    existingIngressClass,
+    debouncedValidate,
+  ]);
+
+  return (
+    <>
+      <PageHeader
+        title={isEdit ? 'Edit ingress' : 'Create ingress'}
+        breadcrumbs={[
+          {
+            link: 'kubernetes.ingresses',
+            label: 'Ingresses',
+          },
+          {
+            label: isEdit ? 'Edit ingress' : 'Create ingress',
+          },
+        ]}
+        reload
+      />
+      <div className="row ingress-rules">
+        <div className="col-sm-12">
+          <IngressForm
+            environmentID={environmentId}
+            isEdit={isEdit}
+            rule={ingressRule}
+            ingressClassOptions={ingressClassOptions}
+            isIngressClassOptionsLoading={ingressControllersQuery.isLoading}
+            errors={errors}
+            servicePorts={servicePorts}
+            tlsOptions={tlsOptions}
+            serviceOptions={serviceOptions}
+            addNewIngressHost={addNewIngressHost}
+            handleTLSChange={handleTLSChange}
+            handleHostChange={handleHostChange}
+            handleIngressChange={handleIngressChange}
+            handlePathChange={handlePathChange}
+            addNewIngressRoute={addNewIngressRoute}
+            removeIngressHost={removeIngressHost}
+            removeIngressRoute={removeIngressRoute}
+            addNewAnnotation={addNewAnnotation}
+            removeAnnotation={removeAnnotation}
+            reloadTLSCerts={reloadTLSCerts}
+            handleAnnotationChange={handleAnnotationChange}
+            namespace={namespace}
+            handleNamespaceChange={handleNamespaceChange}
+            namespacesOptions={namespaceOptions}
+            isNamespaceOptionsLoading={namespacesQuery.isLoading}
+            // wait for ingress results too to set a name that's not taken with handleNamespaceChange()
+            isIngressNamesLoading={ingressesResults.isLoading}
+          />
+        </div>
+        {namespace && (
+          <div className="col-sm-12">
+            <Button
+              onClick={() => handleCreateIngressRules()}
+              data-cy="ingresses-create-button"
+              disabled={Object.keys(errors).length > 0}
+            >
+              {isEdit ? 'Update' : 'Create'}
+            </Button>
+          </div>
+        )}
+      </div>
+    </>
+  );
+
+  function handleNamespaceChange(ns: string) {
+    setNamespace(ns);
+    if (!isEdit) {
+      addNewIngress(ns);
+    }
+  }
+
+  function handleTLSChange(hostIndex: number, tls: string) {
+    setIngressRule((prevRules) => {
+      const rule = { ...prevRules };
+      rule.Hosts[hostIndex] = { ...rule.Hosts[hostIndex], Secret: tls };
+      return rule;
+    });
+  }
+
+  function handleHostChange(hostIndex: number, val: string) {
+    setIngressRule((prevRules) => {
+      const rule = { ...prevRules };
+      rule.Hosts[hostIndex] = { ...rule.Hosts[hostIndex], Host: val };
+      rule.Hosts[hostIndex].Secret =
+        hostWithTLS[val] || rule.Hosts[hostIndex].Secret;
+      return rule;
+    });
+  }
+
+  function handlePathChange(
+    hostIndex: number,
+    pathIndex: number,
+    key: 'Route' | 'PathType' | 'ServiceName' | 'ServicePort',
+    val: string
+  ) {
+    setIngressRule((prevRules) => {
+      const rule = { ...prevRules };
+      const h = { ...rule.Hosts[hostIndex] };
+      h.Paths[pathIndex] = {
+        ...h.Paths[pathIndex],
+        [key]: key === 'ServicePort' ? Number(val) : val,
+      };
+
+      // set the first port of the service as the default port
+      if (
+        key === 'ServiceName' &&
+        servicePorts[val] &&
+        servicePorts[val].length > 0
+      ) {
+        h.Paths[pathIndex].ServicePort = Number(servicePorts[val][0].value);
+      }
+
+      rule.Hosts[hostIndex] = h;
+      return rule;
+    });
+  }
+
+  function handleAnnotationChange(
+    index: number,
+    key: 'key' | 'value',
+    val: string
+  ) {
+    setIngressRule((prevRules) => {
+      const rules = { ...prevRules };
+
+      rules.Annotations = rules.Annotations || [];
+      rules.Annotations[index] = rules.Annotations[index] || {
+        key: '',
+        value: '',
+      };
+      rules.Annotations[index][key] = val;
+
+      return rules;
+    });
+  }
+
+  function addNewIngress(namespace: string) {
+    const newKey = `${namespace}-ingress-${
+      (ruleCounterByNamespace[namespace] || 0) + 1
+    }`;
+
+    const host: Host = {
+      Host: '',
+      Secret: '',
+      Paths: [],
+      Key: uuidv4(),
+    };
+
+    const rule: Rule = {
+      Key: uuidv4(),
+      Namespace: namespace,
+      IngressName: newKey,
+      IngressClassName: ingressRule.IngressClassName || '',
+      IngressType: ingressRule.IngressType || '',
+      Hosts: [host],
+    };
+
+    setIngressRule(rule);
+  }
+
+  function addNewIngressHost(noHost = false) {
+    const rule = { ...ingressRule };
+
+    const path: Path = {
+      Key: uuidv4(),
+      ServiceName: '',
+      ServicePort: 0,
+      Route: '',
+      PathType: 'Prefix',
+    };
+
+    const host: Host = {
+      Host: '',
+      Secret: '',
+      Paths: noHost ? [path] : [],
+      NoHost: noHost,
+      Key: uuidv4(),
+    };
+
+    rule.Hosts.push(host);
+    setIngressRule(rule);
+  }
+
+  function addNewIngressRoute(hostIndex: number) {
+    const rule = { ...ingressRule };
+
+    const path: Path = {
+      ServiceName: '',
+      ServicePort: 0,
+      Route: '',
+      PathType: 'Prefix',
+      Key: uuidv4(),
+    };
+
+    rule.Hosts[hostIndex].Paths.push(path);
+    setIngressRule(rule);
+  }
+
+  function addNewAnnotation(type?: 'rewrite' | 'regex' | 'ingressClass') {
+    const rule = { ...ingressRule };
+
+    const annotation: Annotation = {
+      key: '',
+      value: '',
+      id: uuidv4(),
+    };
+    switch (type) {
+      case 'rewrite':
+        annotation.key = 'nginx.ingress.kubernetes.io/rewrite-target';
+        annotation.value = '/$1';
+        break;
+      case 'regex':
+        annotation.key = 'nginx.ingress.kubernetes.io/use-regex';
+        annotation.value = 'true';
+        break;
+      case 'ingressClass':
+        annotation.key = 'kubernetes.io/ingress.class';
+        annotation.value = '';
+        break;
+      default:
+        break;
+    }
+    rule.Annotations = rule.Annotations || [];
+    rule.Annotations?.push(annotation);
+    setIngressRule(rule);
+  }
+
+  function removeAnnotation(index: number) {
+    const rule = { ...ingressRule };
+
+    if (index > -1) {
+      rule.Annotations?.splice(index, 1);
+    }
+
+    setIngressRule(rule);
+  }
+
+  function removeIngressRoute(hostIndex: number, pathIndex: number) {
+    const rule = { ...ingressRule, Hosts: [...ingressRule.Hosts] };
+    if (hostIndex > -1 && pathIndex > -1) {
+      rule.Hosts[hostIndex].Paths.splice(pathIndex, 1);
+    }
+    setIngressRule(rule);
+  }
+
+  function removeIngressHost(hostIndex: number) {
+    const rule = { ...ingressRule, Hosts: [...ingressRule.Hosts] };
+    if (hostIndex > -1) {
+      rule.Hosts.splice(hostIndex, 1);
+    }
+    setIngressRule(rule);
+  }
+
+  function reloadTLSCerts() {
+    secretsResults.refetch();
+  }
+
+  function handleCreateIngressRules() {
+    const rule = { ...ingressRule };
+
+    const classNameToSend =
+      rule.IngressClassName === 'none' ? '' : rule.IngressClassName;
+
+    const ingress: Ingress = {
+      Namespace: namespace,
+      Name: rule.IngressName,
+      ClassName: classNameToSend,
+      Hosts: rule.Hosts.map((host) => host.Host),
+      Paths: preparePaths(rule.IngressName, rule.Hosts),
+      TLS: prepareTLS(rule.Hosts),
+      Annotations: prepareAnnotations(rule.Annotations || []),
+      Labels: rule.Labels,
+    };
+
+    if (isEdit) {
+      updateIngressMutation.mutate(
+        { environmentId, ingress },
+        {
+          onSuccess: () => {
+            notifySuccess('Success', 'Ingress updated successfully');
+            router.stateService.go('kubernetes.ingresses');
+          },
+        }
+      );
+    } else {
+      createIngressMutation.mutate(
+        { environmentId, ingress },
+        {
+          onSuccess: () => {
+            notifySuccess('Success', 'Ingress created successfully');
+            router.stateService.go('kubernetes.ingresses');
+          },
+        }
+      );
+    }
+  }
+}
diff --git a/app/react/kubernetes/ingresses/CreateIngressView/IngressForm.tsx b/app/react/kubernetes/ingresses/CreateIngressView/IngressForm.tsx
new file mode 100644
index 0000000..5cf6074
--- /dev/null
+++ b/app/react/kubernetes/ingresses/CreateIngressView/IngressForm.tsx
@@ -0,0 +1,815 @@
+import { ChangeEvent, useEffect } from 'react';
+import { Plus, RefreshCw, Trash2 } from 'lucide-react';
+
+import Route from '@/assets/ico/route.svg?c';
+
+import { Link } from '@@/Link';
+import { Option } from '@@/form-components/Input/Select';
+import { FormError } from '@@/form-components/FormError';
+import { Widget, WidgetBody, WidgetTitle } from '@@/Widget';
+import { Tooltip } from '@@/Tip/Tooltip';
+import { Button } from '@@/buttons';
+import { TooltipWithChildren } from '@@/Tip/TooltipWithChildren';
+import { TextTip } from '@@/Tip/TextTip';
+import { InlineLoader } from '@@/InlineLoader';
+import { Select } from '@@/form-components/ReactSelect';
+import { Card } from '@@/primitives/Card';
+import { InputGroup } from '@@/form-components/InputGroup';
+import { Input } from '@@/form-components/Input';
+
+import { AnnotationsForm } from '../../annotations/AnnotationsForm';
+
+import {
+  GroupedServiceOptions,
+  IngressErrors,
+  Rule,
+  ServicePorts,
+} from './types';
+
+import '../style.css';
+
+const PathTypes: Record<string, string[]> = {
+  nginx: ['ImplementationSpecific', 'Prefix', 'Exact'],
+  traefik: ['Prefix', 'Exact'],
+  other: ['Prefix', 'Exact'],
+};
+const PlaceholderAnnotations: Record<string, string[]> = {
+  nginx: ['e.g. nginx.ingress.kubernetes.io/rewrite-target', '/$1'],
+  traefik: ['e.g. traefik.ingress.kubernetes.io/router.tls', 'true'],
+  other: ['e.g. app.kubernetes.io/name', 'examplename'],
+};
+
+interface Props {
+  environmentID: number;
+  rule: Rule;
+
+  errors: IngressErrors;
+  isEdit: boolean;
+  namespace: string;
+
+  servicePorts: ServicePorts;
+  ingressClassOptions: Option<string>[];
+  isIngressClassOptionsLoading: boolean;
+  serviceOptions: GroupedServiceOptions;
+  tlsOptions: Option<string>[];
+  namespacesOptions: Option<string>[];
+  isNamespaceOptionsLoading: boolean;
+  isIngressNamesLoading: boolean;
+
+  removeIngressRoute: (hostIndex: number, pathIndex: number) => void;
+  removeIngressHost: (hostIndex: number) => void;
+  removeAnnotation: (index: number) => void;
+
+  addNewIngressHost: (noHost?: boolean) => void;
+  addNewIngressRoute: (hostIndex: number) => void;
+  addNewAnnotation: (type?: 'rewrite' | 'regex' | 'ingressClass') => void;
+
+  handleNamespaceChange: (val: string) => void;
+  handleHostChange: (hostIndex: number, val: string) => void;
+  handleTLSChange: (hostIndex: number, tls: string) => void;
+  handleIngressChange: (
+    key: 'IngressName' | 'IngressClassName',
+    value: string
+  ) => void;
+  handleAnnotationChange: (
+    index: number,
+    key: 'key' | 'value',
+    val: string
+  ) => void;
+  handlePathChange: (
+    hostIndex: number,
+    pathIndex: number,
+    key: 'Route' | 'PathType' | 'ServiceName' | 'ServicePort',
+    val: string
+  ) => void;
+
+  reloadTLSCerts: () => void;
+}
+
+export function IngressForm({
+  environmentID,
+  rule,
+  isEdit,
+  servicePorts,
+  tlsOptions,
+  handleTLSChange,
+  addNewIngressHost,
+  serviceOptions,
+  handleHostChange,
+  handleIngressChange,
+  handlePathChange,
+  addNewIngressRoute,
+  removeIngressRoute,
+  removeIngressHost,
+  addNewAnnotation,
+  removeAnnotation,
+  reloadTLSCerts,
+  handleAnnotationChange,
+  ingressClassOptions,
+  isIngressClassOptionsLoading,
+  errors,
+  namespacesOptions,
+  isNamespaceOptionsLoading,
+  isIngressNamesLoading,
+  handleNamespaceChange,
+  namespace,
+}: Props) {
+  const hasNoHostRule = rule.Hosts?.some((host) => host.NoHost);
+  const placeholderAnnotation =
+    PlaceholderAnnotations[rule.IngressType || 'other'] ||
+    PlaceholderAnnotations.other;
+  const pathTypes = PathTypes[rule.IngressType || 'other'] || PathTypes.other;
+
+  // when the namespace options update the value to an available one
+  useEffect(() => {
+    const namespaces = namespacesOptions.map((option) => option.value);
+    if (
+      !isEdit &&
+      !namespaces.includes(namespace) &&
+      namespaces.length > 0 &&
+      !isIngressNamesLoading
+    ) {
+      handleNamespaceChange(namespaces[0]);
+    }
+  }, [
+    namespacesOptions,
+    namespace,
+    handleNamespaceChange,
+    isNamespaceOptionsLoading,
+    isEdit,
+    isIngressNamesLoading,
+  ]);
+
+  return (
+    <Widget>
+      <WidgetTitle icon={Route} title="Ingress" />
+      <WidgetBody key={rule.Key + rule.Namespace}>
+        <div className="row">
+          <div className="form-horizontal">
+            <div className="form-group">
+              <label
+                className="control-label text-muted col-sm-3 col-lg-2"
+                htmlFor="namespace"
+              >
+                Namespace
+              </label>
+              {isNamespaceOptionsLoading && (
+                <div className="col-sm-4">
+                  <InlineLoader className="pt-2">
+                    Loading namespaces...
+                  </InlineLoader>
+                </div>
+              )}
+              {!isNamespaceOptionsLoading && (
+                <div className={`col-sm-4 ${isEdit && 'control-label'}`}>
+                  {isEdit ? (
+                    namespace
+                  ) : (
+                    <Select
+                      name="namespaces"
+                      options={namespacesOptions}
+                      value={
+                        namespace
+                          ? { value: namespace, label: namespace }
+                          : null
+                      }
+                      isDisabled={isEdit}
+                      onChange={(val) =>
+                        handleNamespaceChange(val?.value || '')
+                      }
+                      placeholder={
+                        namespacesOptions.length
+                          ? 'Select a namespace'
+                          : 'No namespaces available'
+                      }
+                      noOptionsMessage={() => 'No namespaces available'}
+                      data-cy="k8sAppCreate-namespaceSelect"
+                      id="k8sAppCreate-namespaceSelect"
+                    />
+                  )}
+                </div>
+              )}
+            </div>
+          </div>
+        </div>
+
+        {namespace && (
+          <div className="row">
+            <div className="form-horizontal">
+              <div className="form-group">
+                <label
+                  className="control-label text-muted col-sm-3 col-lg-2 required"
+                  htmlFor="ingress_name"
+                >
+                  Ingress name
+                </label>
+                <div className="col-sm-4">
+                  {isEdit ? (
+                    rule.IngressName
+                  ) : (
+                    <Input
+                      name="ingress_name"
+                      type="text"
+                      className="form-control"
+                      placeholder="Ingress name"
+                      defaultValue={rule.IngressName}
+                      onChange={(e: ChangeEvent<HTMLInputElement>) =>
+                        handleIngressChange('IngressName', e.target.value)
+                      }
+                      disabled={isEdit}
+                      data-cy="k8sAppCreate-ingressNameInput"
+                    />
+                  )}
+                  {errors.ingressName && !isEdit && (
+                    <FormError className="error-inline mt-1">
+                      {errors.ingressName}
+                    </FormError>
+                  )}
+                </div>
+              </div>
+
+              <div className="form-group" key={ingressClassOptions.toString()}>
+                <label
+                  className="control-label text-muted col-sm-3 col-lg-2 required"
+                  htmlFor="ingress_class"
+                >
+                  Ingress class
+                </label>
+                <div className="col-sm-4">
+                  {isIngressClassOptionsLoading && (
+                    <InlineLoader className="pt-2">
+                      Loading ingress classes...
+                    </InlineLoader>
+                  )}
+                  {!isIngressClassOptionsLoading && (
+                    <>
+                      <Select
+                        name="ingress_class"
+                        placeholder={
+                          ingressClassOptions.length
+                            ? 'Select an ingress class'
+                            : 'No ingress classes available'
+                        }
+                        options={ingressClassOptions}
+                        value={
+                          rule.IngressClassName
+                            ? {
+                                label: rule.IngressClassName,
+                                value: rule.IngressClassName,
+                              }
+                            : null
+                        }
+                        onChange={(ingressClassOption) =>
+                          handleIngressChange(
+                            'IngressClassName',
+                            ingressClassOption?.value || ''
+                          )
+                        }
+                        noOptionsMessage={() => 'No ingress classes available'}
+                        data-cy="k8sAppCreate-ingressClassSelect"
+                        id="k8sAppCreate-ingressClassSelect"
+                      />
+                      {errors.className && (
+                        <FormError className="error-inline mt-1">
+                          {errors.className}
+                        </FormError>
+                      )}
+                    </>
+                  )}
+                </div>
+              </div>
+            </div>
+
+            <div className="col-sm-12 text-muted !mb-0 px-0">
+              <div className="control-label !mb-3 text-left font-medium">
+                Annotations
+                <Tooltip
+                  message={
+                    <div className="vertical-center">
+                      <span>
+                        Allows specifying of{' '}
+                        <a
+                          href="https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/"
+                          target="_black"
+                        >
+                          annotations
+                        </a>{' '}
+                        for the object. See further Kubernetes documentation on{' '}
+                        <a
+                          href="https://kubernetes.io/docs/reference/labels-annotations-taints/"
+                          target="_black"
+                        >
+                          well-known annotations
+                        </a>
+                        .
+                      </span>
+                    </div>
+                  }
+                />
+              </div>
+            </div>
+
+            {rule?.Annotations && (
+              <AnnotationsForm
+                placeholder={placeholderAnnotation}
+                annotations={rule.Annotations}
+                handleAnnotationChange={handleAnnotationChange}
+                removeAnnotation={removeAnnotation}
+                errors={errors.annotations}
+              />
+            )}
+
+            <div className="col-sm-12 anntation-actions p-0">
+              <TooltipWithChildren message="Use annotations to configure options for an ingress. Review Nginx or Traefik documentation to find the annotations supported by your choice of ingress type.">
+                <span>
+                  <Button
+                    className="btn btn-sm btn-light !ml-0 mb-2"
+                    data-cy="add-annotation-button"
+                    onClick={() => addNewAnnotation()}
+                    icon={Plus}
+                  >
+                    {' '}
+                    Add annotation
+                  </Button>
+                </span>
+              </TooltipWithChildren>
+
+              {rule.IngressType === 'nginx' && (
+                <>
+                  <TooltipWithChildren message="When the exposed URLs for your applications differ from the specified paths in the ingress, use the rewrite target annotation to denote the path to redirect to.">
+                    <span>
+                      <Button
+                        className="btn btn-sm btn-light mb-2 ml-2"
+                        onClick={() => addNewAnnotation('rewrite')}
+                        icon={Plus}
+                        data-cy="add-rewrite-annotation"
+                      >
+                        Add rewrite annotation
+                      </Button>
+                    </span>
+                  </TooltipWithChildren>
+
+                  <TooltipWithChildren message="Enable use of regular expressions in ingress paths (set in the ingress details of an application). Use this along with rewrite-target to specify the regex capturing group to be replaced, e.g. path regex of ^/foo/(,*) and rewrite-target of /bar/$1 rewrites example.com/foo/account to example.com/bar/account.">
+                    <span>
+                      <Button
+                        className="btn btn-sm btn-light mb-2 ml-2"
+                        onClick={() => addNewAnnotation('regex')}
+                        icon={Plus}
+                        data-cy="add-regex-annotation"
+                      >
+                        Add regular expression annotation
+                      </Button>
+                    </span>
+                  </TooltipWithChildren>
+                </>
+              )}
+
+              {rule.IngressType === 'custom' && (
+                <Button
+                  className="btn btn-sm btn-light mb-2 ml-2"
+                  onClick={() => addNewAnnotation('ingressClass')}
+                  icon={Plus}
+                  data-cy="add-ingress-class-annotation"
+                >
+                  Add kubernetes.io/ingress.class annotation
+                </Button>
+              )}
+            </div>
+
+            <div className="col-sm-12 text-muted px-0">Rules</div>
+          </div>
+        )}
+
+        {namespace &&
+          rule?.Hosts?.map((host, hostIndex) => (
+            <Card.Container key={host.Key} variant="filled" className="mb-5">
+              <Card.Body>
+                <div className="flex flex-col">
+                  <div className="row rule-actions">
+                    <div className="col-sm-3 p-0">
+                      {!host.NoHost ? 'Rule' : 'Fallback rule'}
+                    </div>
+                    <div className="col-sm-9 p-0 text-right">
+                      <Button
+                        className="btn btn-sm ml-2"
+                        color="dangerlight"
+                        type="button"
+                        data-cy={`k8sAppCreate-rmHostButton_${hostIndex}`}
+                        onClick={() => removeIngressHost(hostIndex)}
+                        disabled={rule.Hosts.length === 1}
+                        icon={Trash2}
+                      >
+                        Remove rule
+                      </Button>
+                    </div>
+                  </div>
+                  {!host.NoHost && (
+                    <div className="row">
+                      <div className="form-group col-sm-6 col-lg-4 !pl-0 !pr-2">
+                        <InputGroup size="small">
+                          <InputGroup.Addon
+                            required
+                            as="label"
+                            htmlFor={`ingress_host_${hostIndex}`}
+                          >
+                            Hostname
+                          </InputGroup.Addon>
+                          <InputGroup.Input
+                            name={`ingress_host_${hostIndex}`}
+                            data-cy={`ingress-host_${hostIndex}`}
+                            id={`ingress_host_${hostIndex}`}
+                            type="text"
+                            className="form-control form-control-sm"
+                            placeholder="e.g. example.com"
+                            defaultValue={host.Host}
+                            onChange={(e: ChangeEvent<HTMLInputElement>) =>
+                              handleHostChange(hostIndex, e.target.value)
+                            }
+                          />
+                        </InputGroup>
+
+                        {errors[`hosts[${hostIndex}].host`] && (
+                          <FormError className="!mb-0 mt-1">
+                            {errors[`hosts[${hostIndex}].host`]}
+                          </FormError>
+                        )}
+                      </div>
+
+                      <div className="form-group col-sm-6 col-lg-4 !pl-2 !pr-0">
+                        <InputGroup size="small">
+                          <InputGroup.Addon
+                            as="label"
+                            htmlFor={`ingress_tls_${hostIndex}`}
+                          >
+                            TLS secret
+                          </InputGroup.Addon>
+                          <Select
+                            key={tlsOptions.toString() + host.Secret}
+                            name={`ingress_tls_${hostIndex}`}
+                            inputId={`ingress_tls_${hostIndex}`}
+                            options={tlsOptions}
+                            value={
+                              host.Secret !== undefined
+                                ? {
+                                    value: host.Secret,
+                                    label: host.Secret || 'No TLS',
+                                  }
+                                : null
+                            }
+                            onChange={(TLSOption) =>
+                              handleTLSChange(hostIndex, TLSOption?.value || '')
+                            }
+                            placeholder={
+                              tlsOptions.length
+                                ? 'Select a TLS secret'
+                                : 'No TLS secrets available'
+                            }
+                            noOptionsMessage={() => 'No TLS secrets available'}
+                            size="sm"
+                            data-cy={`k8sAppCreate-tlsSelect_${hostIndex}`}
+                            id={`k8sAppCreate-tlsSelect_${hostIndex}`}
+                          />
+                          {!host.NoHost && (
+                            <div className="input-group-btn">
+                              <Button
+                                className="btn btn-light btn-sm !ml-0 !rounded-l-none"
+                                onClick={() => reloadTLSCerts()}
+                                icon={RefreshCw}
+                                data-cy={`k8sAppCreate-tlsRefreshButton_${hostIndex}`}
+                              />
+                            </div>
+                          )}
+                        </InputGroup>
+                      </div>
+
+                      <div className="col-sm-12 col-lg-4 flex h-[30px] items-center pl-2">
+                        <TextTip color="blue">
+                          You may also use the{' '}
+                          <Link
+                            to="kubernetes.secrets.new"
+                            params={{ id: environmentID }}
+                            className="text-primary"
+                            target="_blank"
+                            data-cy={`k8sAppCreate-createSecretLink_${hostIndex}`}
+                          >
+                            Create secret
+                          </Link>{' '}
+                          function, and reload the dropdown.
+                        </TextTip>
+                      </div>
+                    </div>
+                  )}
+                  {host.NoHost && (
+                    <TextTip color="blue">
+                      A fallback rule has no host specified. This rule only
+                      applies when an inbound request has a hostname that does
+                      not match with any of your other rules.
+                    </TextTip>
+                  )}
+
+                  <div className="row">
+                    <div className="col-sm-12 text-muted !mb-0 mt-2 px-0">
+                      Paths
+                    </div>
+                  </div>
+
+                  {!host.Paths.length && (
+                    <TextTip className="mt-2" color="blue">
+                      You may save the ingress without a path and it will then
+                      be an <b>ingress default</b> that a user may select via
+                      the hostname dropdown in Create/Edit application.
+                    </TextTip>
+                  )}
+
+                  {host.Paths.map((path, pathIndex) => (
+                    <div
+                      className="row path !mb-5 mt-5"
+                      key={`path_${path.Key}}`}
+                    >
+                      <div className="form-group col-sm-3 col-xl-2 !m-0 !pl-0">
+                        <InputGroup size="small">
+                          <InputGroup.Addon
+                            required
+                            as="label"
+                            htmlFor={`ingress_service_${hostIndex}_${pathIndex}`}
+                          >
+                            Service
+                          </InputGroup.Addon>
+                          <Select
+                            key={serviceOptions.toString() + path.ServiceName}
+                            name={`ingress_service_${hostIndex}_${pathIndex}`}
+                            id={`ingress_service_${hostIndex}_${pathIndex}`}
+                            options={serviceOptions}
+                            value={
+                              path.ServiceName
+                                ? {
+                                    value: path.ServiceName,
+                                    label: getServiceLabel(
+                                      serviceOptions,
+                                      path.ServiceName
+                                    ),
+                                  }
+                                : null
+                            }
+                            onChange={(serviceOption) =>
+                              handlePathChange(
+                                hostIndex,
+                                pathIndex,
+                                'ServiceName',
+                                serviceOption?.value || ''
+                              )
+                            }
+                            placeholder={
+                              serviceOptions.length
+                                ? 'Select a service'
+                                : 'No services available'
+                            }
+                            noOptionsMessage={() => 'No services available'}
+                            size="sm"
+                            data-cy={`k8sAppCreate-serviceSelect_${hostIndex}_${pathIndex}`}
+                          />
+                        </InputGroup>
+                        {errors[
+                          `hosts[${hostIndex}].paths[${pathIndex}].servicename`
+                        ] && (
+                          <FormError className="error-inline !mb-0 mt-1">
+                            {
+                              errors[
+                                `hosts[${hostIndex}].paths[${pathIndex}].servicename`
+                              ]
+                            }
+                          </FormError>
+                        )}
+                      </div>
+
+                      <div className="form-group col-sm-2 col-xl-2 !m-0 min-w-[170px] !pl-0">
+                        {servicePorts && (
+                          <>
+                            <InputGroup size="small">
+                              <InputGroup.Addon
+                                required
+                                as="label"
+                                htmlFor={`ingress_servicePort_${hostIndex}_${pathIndex}`}
+                              >
+                                Service port
+                              </InputGroup.Addon>
+                              <Select
+                                key={servicePorts.toString() + path.ServicePort}
+                                name={`ingress_servicePort_${hostIndex}_${pathIndex}`}
+                                id={`ingress_servicePort_${hostIndex}_${pathIndex}`}
+                                options={
+                                  servicePorts[path.ServiceName]?.map(
+                                    (portOption) => ({
+                                      ...portOption,
+                                      value: portOption.value.toString(),
+                                    })
+                                  ) || []
+                                }
+                                onChange={(option) =>
+                                  handlePathChange(
+                                    hostIndex,
+                                    pathIndex,
+                                    'ServicePort',
+                                    option?.value || ''
+                                  )
+                                }
+                                value={
+                                  path.ServicePort
+                                    ? {
+                                        label: path.ServicePort.toString(),
+                                        value: path.ServicePort.toString(),
+                                      }
+                                    : null
+                                }
+                                placeholder={
+                                  servicePorts[path.ServiceName]?.length
+                                    ? 'Select a port'
+                                    : 'No ports available'
+                                }
+                                noOptionsMessage={() => 'No ports available'}
+                                size="sm"
+                                data-cy={`k8sAppCreate-servicePortSelect_${hostIndex}_${pathIndex}`}
+                              />
+                            </InputGroup>
+                            {errors[
+                              `hosts[${hostIndex}].paths[${pathIndex}].serviceport`
+                            ] && (
+                              <FormError className="!mb-0 mt-1">
+                                {
+                                  errors[
+                                    `hosts[${hostIndex}].paths[${pathIndex}].serviceport`
+                                  ]
+                                }
+                              </FormError>
+                            )}
+                          </>
+                        )}
+                      </div>
+
+                      <div className="form-group col-sm-3 col-xl-2 !m-0 !pl-0">
+                        <InputGroup size="small">
+                          <InputGroup.Addon
+                            as="label"
+                            htmlFor={`ingress_pathType_${hostIndex}_${pathIndex}`}
+                          >
+                            Path type
+                          </InputGroup.Addon>
+                          <Select
+                            key={servicePorts.toString() + path.PathType}
+                            name={`ingress_pathType_${hostIndex}_${pathIndex}`}
+                            id={`ingress_pathType_${hostIndex}_${pathIndex}`}
+                            options={
+                              pathTypes?.map((type) => ({
+                                label: type,
+                                value: type,
+                              })) || []
+                            }
+                            onChange={(option) =>
+                              handlePathChange(
+                                hostIndex,
+                                pathIndex,
+                                'PathType',
+                                option?.value || ''
+                              )
+                            }
+                            value={
+                              path.PathType
+                                ? {
+                                    label: path.PathType,
+                                    value: path.PathType,
+                                  }
+                                : null
+                            }
+                            placeholder={
+                              pathTypes?.length
+                                ? 'Select a path type'
+                                : 'No path types available'
+                            }
+                            noOptionsMessage={() => 'No path types available'}
+                            size="sm"
+                            data-cy={`k8sAppCreate-pathTypeSelect_${hostIndex}_${pathIndex}`}
+                          />
+                        </InputGroup>
+                        {errors[
+                          `hosts[${hostIndex}].paths[${pathIndex}].pathType`
+                        ] && (
+                          <FormError className="!mb-0 mt-1">
+                            {
+                              errors[
+                                `hosts[${hostIndex}].paths[${pathIndex}].pathType`
+                              ]
+                            }
+                          </FormError>
+                        )}
+                      </div>
+
+                      <div className="form-group col-sm-3 col-xl-3 !m-0 !pl-0">
+                        <InputGroup size="small">
+                          <InputGroup.Addon
+                            required
+                            as="label"
+                            htmlFor={`ingress_route_${hostIndex}-${pathIndex}`}
+                          >
+                            Path
+                          </InputGroup.Addon>
+                          <InputGroup.Input
+                            className="form-control"
+                            name={`ingress_route_${hostIndex}-${pathIndex}`}
+                            id={`ingress_route_${hostIndex}-${pathIndex}`}
+                            placeholder="/example"
+                            data-pattern="/^(\/?[a-zA-Z0-9]+([a-zA-Z0-9-/_]*[a-zA-Z0-9])?|[a-zA-Z0-9]+)|(\/){1}$/"
+                            data-cy={`k8sAppCreate-route_${hostIndex}-${pathIndex}`}
+                            defaultValue={path.Route}
+                            onChange={(e: ChangeEvent<HTMLInputElement>) =>
+                              handlePathChange(
+                                hostIndex,
+                                pathIndex,
+                                'Route',
+                                e.target.value
+                              )
+                            }
+                          />
+                        </InputGroup>
+                        {errors[
+                          `hosts[${hostIndex}].paths[${pathIndex}].path`
+                        ] && (
+                          <FormError className="!mb-0 mt-1">
+                            {
+                              errors[
+                                `hosts[${hostIndex}].paths[${pathIndex}].path`
+                              ]
+                            }
+                          </FormError>
+                        )}
+                      </div>
+
+                      <div className="form-group col-sm-1 !m-0 !pl-0">
+                        <Button
+                          className="!ml-0 h-[30px]"
+                          color="dangerlight"
+                          type="button"
+                          data-cy={`k8sAppCreate-rmPortButton_${hostIndex}-${pathIndex}`}
+                          onClick={() =>
+                            removeIngressRoute(hostIndex, pathIndex)
+                          }
+                          icon={Trash2}
+                          size="small"
+                          disabled={host.Paths.length === 1 && host.NoHost}
+                        />
+                      </div>
+                    </div>
+                  ))}
+
+                  <div className="row mt-5">
+                    <Button
+                      className="!ml-0"
+                      type="button"
+                      onClick={() => addNewIngressRoute(hostIndex)}
+                      icon={Plus}
+                      data-cy={`k8sAppCreate-addPathButton_${hostIndex}`}
+                    >
+                      Add path
+                    </Button>
+                  </div>
+                </div>
+              </Card.Body>
+            </Card.Container>
+          ))}
+
+        {namespace && (
+          <div className="row rules-action p-0">
+            <div className="col-sm-12 vertical-center p-0">
+              <Button
+                className="!ml-0"
+                type="button"
+                onClick={() => addNewIngressHost()}
+                icon={Plus}
+                data-cy="k8sAppCreate-addHostButton"
+              >
+                Add new host
+              </Button>
+
+              <Button
+                className="ml-2"
+                type="button"
+                onClick={() => addNewIngressHost(true)}
+                disabled={hasNoHostRule}
+                icon={Plus}
+                data-cy="k8sAppCreate-addFallbackButton"
+              >
+                Add fallback rule
+              </Button>
+              <Tooltip message="A fallback rule will be applied to all requests that do not match any of the defined hosts." />
+            </div>
+          </div>
+        )}
+      </WidgetBody>
+    </Widget>
+  );
+}
+
+function getServiceLabel(options: GroupedServiceOptions, value: string) {
+  const allOptions = options.flatMap((group) => group.options);
+  const option = allOptions.find((o) => o.value === value);
+  return option?.selectedLabel || '';
+}
diff --git a/app/react/kubernetes/ingresses/CreateIngressView/index.tsx b/app/react/kubernetes/ingresses/CreateIngressView/index.tsx
new file mode 100644
index 0000000..2b0ad59
--- /dev/null
+++ b/app/react/kubernetes/ingresses/CreateIngressView/index.tsx
@@ -0,0 +1 @@
+export { CreateIngressView } from './CreateIngressView';
diff --git a/app/react/kubernetes/ingresses/CreateIngressView/types.ts b/app/react/kubernetes/ingresses/CreateIngressView/types.ts
new file mode 100644
index 0000000..6a72367
--- /dev/null
+++ b/app/react/kubernetes/ingresses/CreateIngressView/types.ts
@@ -0,0 +1,49 @@
+import { ReactNode } from 'react';
+
+import { Option } from '@@/form-components/Input/Select';
+
+import { Annotation, AnnotationErrors } from '../../annotations/types';
+
+export interface Path {
+  Key: string;
+  Route: string;
+  ServiceName: string;
+  ServicePort: number;
+  PathType?: string;
+}
+
+export interface Host {
+  Key: string;
+  Host: string;
+  Secret: string;
+  Paths: Path[];
+  NoHost?: boolean;
+}
+
+export interface Rule {
+  Key: string;
+  IngressName: string;
+  Namespace: string;
+  IngressClassName: string;
+  Hosts: Host[];
+  Annotations?: Annotation[];
+  IngressType?: string;
+  Labels?: Record<string, string>;
+}
+
+export interface ServicePorts {
+  [serviceName: string]: Option<string>[];
+}
+
+interface ServiceOption extends Option<string> {
+  selectedLabel: string;
+}
+
+export type GroupedServiceOptions = {
+  label: string;
+  options: ServiceOption[];
+}[];
+
+export type IngressErrors = Record<string, ReactNode> & {
+  annotations?: AnnotationErrors;
+};
diff --git a/app/react/kubernetes/ingresses/CreateIngressView/utils.ts b/app/react/kubernetes/ingresses/CreateIngressView/utils.ts
new file mode 100644
index 0000000..120a1e7
--- /dev/null
+++ b/app/react/kubernetes/ingresses/CreateIngressView/utils.ts
@@ -0,0 +1,129 @@
+import { v4 as uuidv4 } from 'uuid';
+
+import { SupportedIngControllerTypes } from '@/react/kubernetes/cluster/ingressClass/types';
+
+import { TLS, Ingress } from '../types';
+import { Annotation } from '../../annotations/types';
+
+import { Host, Rule } from './types';
+
+const ignoreAnnotationsForEdit = [
+  'kubectl.kubernetes.io/last-applied-configuration',
+];
+
+export function prepareTLS(hosts: Host[]) {
+  const tls: TLS[] = [];
+  hosts.forEach((host) => {
+    if (host.Secret && host.Host) {
+      tls.push({
+        Hosts: [host.Host],
+        SecretName: host.Secret,
+      });
+    }
+  });
+  return tls;
+}
+
+export function preparePaths(ingressName: string, hosts: Host[]) {
+  return hosts.flatMap((host) =>
+    host.Paths.map((p) => ({
+      ServiceName: p.ServiceName,
+      Host: host.Host,
+      Path: p.Route,
+      Port: p.ServicePort,
+      PathType: p.PathType || 'Prefix',
+      IngressName: ingressName,
+    }))
+  );
+}
+
+function getSecretByHost(host: string, tls?: TLS[]) {
+  let secret = '';
+  if (tls) {
+    tls.forEach((t) => {
+      if (t.Hosts.indexOf(host) !== -1) {
+        secret = t.SecretName;
+      }
+    });
+  }
+  return secret;
+}
+
+export function prepareRuleHostsFromIngress(ing: Ingress) {
+  const hosts = ing.Hosts?.map((host) => {
+    const h: Host = {} as Host;
+    h.Host = host;
+    h.Secret = getSecretByHost(host, ing.TLS);
+    h.Paths = [];
+    ing.Paths?.forEach((path) => {
+      if (path.Host === host) {
+        h.Paths.push({
+          Route: path.Path,
+          ServiceName: path.ServiceName,
+          ServicePort: path.Port,
+          PathType: path.PathType,
+          Key: Math.random().toString(),
+        });
+      }
+    });
+    if (!host) {
+      h.NoHost = true;
+    }
+    h.Key = uuidv4();
+    return h;
+  });
+
+  return hosts;
+}
+
+export function getAnnotationsForEdit(
+  annotations: Record<string, string>
+): Annotation[] {
+  const result: Annotation[] = [];
+  Object.keys(annotations).forEach((k) => {
+    if (ignoreAnnotationsForEdit.indexOf(k) === -1) {
+      result.push({
+        key: k,
+        value: annotations[k],
+        id: uuidv4(),
+      });
+    }
+  });
+  return result;
+}
+
+export function prepareRuleFromIngress(
+  ing: Ingress,
+  type?: SupportedIngControllerTypes
+): Rule {
+  return {
+    Key: uuidv4(),
+    IngressName: ing.Name,
+    Namespace: ing.Namespace,
+    IngressClassName: type === 'custom' ? 'none' : ing.ClassName,
+    Hosts: prepareRuleHostsFromIngress(ing) || [],
+    Annotations: ing.Annotations ? getAnnotationsForEdit(ing.Annotations) : [],
+    IngressType: ing.Type,
+    Labels: ing.Labels,
+  };
+}
+
+export function checkIfPathExistsWithHost(
+  ingresses: Ingress[],
+  host: string,
+  path: string,
+  ingressName?: string
+) {
+  let exists = false;
+  ingresses.forEach((ingress) => {
+    if (ingressName && ingress.Name === ingressName) {
+      return;
+    }
+    ingress.Paths?.forEach((p) => {
+      if (p.Host === host && p.Path === path) {
+        exists = true;
+      }
+    });
+  });
+  return exists;
+}
diff --git a/app/react/kubernetes/ingresses/IngressDatatable/IngressDatatable.tsx b/app/react/kubernetes/ingresses/IngressDatatable/IngressDatatable.tsx
new file mode 100644
index 0000000..e8e564d
--- /dev/null
+++ b/app/react/kubernetes/ingresses/IngressDatatable/IngressDatatable.tsx
@@ -0,0 +1,169 @@
+import { useRouter } from '@uirouter/react';
+import { useMemo } from 'react';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useAuthorizations, Authorized } from '@/react/hooks/useUser';
+import Route from '@/assets/ico/route.svg?c';
+import { useIsDeploymentOptionHidden } from '@/react/hooks/useIsDeploymentOptionHidden';
+import { DefaultDatatableSettings } from '@/react/kubernetes/datatables/DefaultDatatableSettings';
+import { createStore } from '@/react/kubernetes/datatables/default-kube-datatable-store';
+import { SystemResourceDescription } from '@/react/kubernetes/datatables/SystemResourceDescription';
+
+import { Datatable, TableSettingsMenu } from '@@/datatables';
+import { AddButton } from '@@/buttons';
+import { useTableState } from '@@/datatables/useTableState';
+import { DeleteButton } from '@@/buttons/DeleteButton';
+
+import { DeleteIngressesRequest, Ingress } from '../types';
+import { useDeleteIngresses, useIngresses } from '../queries';
+import { useNamespacesQuery } from '../../namespaces/queries/useNamespacesQuery';
+import { Namespaces, PortainerNamespace } from '../../namespaces/types';
+import { CreateFromManifestButton } from '../../components/CreateFromManifestButton';
+
+import { columns } from './columns';
+
+import '../style.css';
+
+interface SelectedIngress {
+  Namespace: string;
+  Name: string;
+}
+const storageKey = 'ingressClassesNameSpace';
+
+const settingsStore = createStore(storageKey, 'name');
+
+export function IngressDatatable() {
+  const tableState = useTableState(settingsStore, storageKey);
+  const environmentId = useEnvironmentId();
+
+  const { authorized: canAccessSystemResources } = useAuthorizations(
+    'K8sAccessSystemNamespaces'
+  );
+  const namespacesQuery = useNamespacesQuery(environmentId);
+  const { data: ingresses, ...ingressesQuery } = useIngresses(environmentId, {
+    autoRefreshRate: tableState.autoRefreshRate * 1000,
+    withServices: true,
+  });
+
+  const namespacesMap = useMemo(() => {
+    const namespacesMap = namespacesQuery.data?.reduce<
+      Record<string, PortainerNamespace>
+    >((acc, namespace) => {
+      acc[namespace.Name] = namespace;
+      return acc;
+    }, {});
+    return namespacesMap ?? {};
+  }, [namespacesQuery.data]);
+
+  const filteredIngresses = useMemo(
+    () =>
+      ingresses?.filter(
+        (ingress) =>
+          (canAccessSystemResources && tableState.showSystemResources) ||
+          !namespacesMap?.[ingress.Namespace].IsSystem
+      ) || [],
+    [ingresses, tableState, canAccessSystemResources, namespacesMap]
+  );
+
+  const ingressesWithIsSystem = useIngressesRowData(
+    filteredIngresses || [],
+    namespacesMap
+  );
+
+  const isAddIngressHidden = useIsDeploymentOptionHidden('form');
+
+  const deleteIngressesMutation = useDeleteIngresses();
+
+  const router = useRouter();
+
+  return (
+    <Datatable
+      settingsManager={tableState}
+      dataset={ingressesWithIsSystem}
+      columns={columns}
+      isLoading={ingressesQuery.isLoading || namespacesQuery.isLoading}
+      emptyContentLabel="No supported ingresses found"
+      title="Ingresses"
+      titleIcon={Route}
+      getRowId={(row) => row.Name + row.Type + row.Namespace}
+      isRowSelectable={(row) =>
+        !namespacesMap?.[row.original.Namespace].IsSystem
+      }
+      renderTableActions={tableActions}
+      renderTableSettings={() => (
+        <TableSettingsMenu>
+          <DefaultDatatableSettings settings={tableState} />
+        </TableSettingsMenu>
+      )}
+      description={
+        <SystemResourceDescription
+          showSystemResources={tableState.showSystemResources}
+        />
+      }
+      disableSelect={useCheckboxes()}
+      data-cy="k8s-ingresses-datatable"
+    />
+  );
+
+  // useIngressesRowData appends the `isSyetem` property to the service data
+  function useIngressesRowData(
+    ingresses: Ingress[],
+    namespaces?: Namespaces
+  ): Ingress[] {
+    return useMemo(
+      () =>
+        ingresses.map((r) => ({
+          ...r,
+          IsSystem: namespaces ? namespaces?.[r.Namespace].IsSystem : false,
+        })),
+      [ingresses, namespaces]
+    );
+  }
+
+  function tableActions(selectedFlatRows: Ingress[]) {
+    return (
+      <Authorized authorizations="K8sIngressesW">
+        <DeleteButton
+          disabled={selectedFlatRows.length === 0}
+          onConfirmed={() => handleRemoveClick(selectedFlatRows)}
+          confirmMessage="Are you sure you want to delete the selected ingresses?"
+          data-cy="remove-ingresses-button"
+        />
+
+        {!isAddIngressHidden && (
+          <AddButton
+            to=".create"
+            color="secondary"
+            data-cy="add-ingress-button"
+          >
+            Add with form
+          </AddButton>
+        )}
+
+        <CreateFromManifestButton data-cy="k8s-ingress-deploy-button" />
+      </Authorized>
+    );
+  }
+
+  function useCheckboxes() {
+    const { authorized } = useAuthorizations(['K8sIngressesW']);
+    return !authorized;
+  }
+
+  async function handleRemoveClick(ingresses: SelectedIngress[]) {
+    const payload: DeleteIngressesRequest = {} as DeleteIngressesRequest;
+    ingresses.forEach((ingress) => {
+      payload[ingress.Namespace] = payload[ingress.Namespace] || [];
+      payload[ingress.Namespace].push(ingress.Name);
+    });
+
+    deleteIngressesMutation.mutate(
+      { environmentId, data: payload },
+      {
+        onSuccess: () => {
+          router.stateService.reload();
+        },
+      }
+    );
+  }
+}
diff --git a/app/react/kubernetes/ingresses/IngressDatatable/columns/className.tsx b/app/react/kubernetes/ingresses/IngressDatatable/columns/className.tsx
new file mode 100644
index 0000000..cc864c1
--- /dev/null
+++ b/app/react/kubernetes/ingresses/IngressDatatable/columns/className.tsx
@@ -0,0 +1,7 @@
+import { columnHelper } from './helper';
+
+export const className = columnHelper.accessor('ClassName', {
+  header: 'Class Name',
+  id: 'className',
+  cell: ({ row }) => row.original.ClassName || '-',
+});
diff --git a/app/react/kubernetes/ingresses/IngressDatatable/columns/created.tsx b/app/react/kubernetes/ingresses/IngressDatatable/columns/created.tsx
new file mode 100644
index 0000000..b64af9f
--- /dev/null
+++ b/app/react/kubernetes/ingresses/IngressDatatable/columns/created.tsx
@@ -0,0 +1,24 @@
+import { formatDate } from '@/portainer/filters/filters';
+import { appOwnerLabel } from '@/react/kubernetes/applications/constants';
+
+import { columnHelper } from './helper';
+
+export const created = columnHelper.accessor(
+  (row) => {
+    const owner = row.Labels?.['io.portainer.kubernetes.ingress.owner'];
+    const date = formatDate(row.CreationDate);
+    return owner ? `${date} by ${owner}` : date;
+  },
+  {
+    header: 'Created',
+    cell: ({ row, getValue }) => {
+      const date = formatDate(getValue());
+      const owner =
+        row.original.Labels?.['io.portainer.kubernetes.ingress.owner'] ||
+        row.original.Labels?.[appOwnerLabel];
+
+      return owner ? `${date} by ${owner}` : date;
+    },
+    id: 'created',
+  }
+);
diff --git a/app/react/kubernetes/ingresses/IngressDatatable/columns/helper.ts b/app/react/kubernetes/ingresses/IngressDatatable/columns/helper.ts
new file mode 100644
index 0000000..a496dfa
--- /dev/null
+++ b/app/react/kubernetes/ingresses/IngressDatatable/columns/helper.ts
@@ -0,0 +1,5 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { Ingress } from '../../types';
+
+export const columnHelper = createColumnHelper<Ingress>();
diff --git a/app/react/kubernetes/ingresses/IngressDatatable/columns/index.ts b/app/react/kubernetes/ingresses/IngressDatatable/columns/index.ts
new file mode 100644
index 0000000..8de5fac
--- /dev/null
+++ b/app/react/kubernetes/ingresses/IngressDatatable/columns/index.ts
@@ -0,0 +1,15 @@
+import { name } from './name';
+import { type } from './type';
+import { namespace } from './namespace';
+import { className } from './className';
+import { ingressRules } from './ingressRules';
+import { created } from './created';
+
+export const columns = [
+  name,
+  namespace,
+  className,
+  type,
+  ingressRules,
+  created,
+];
diff --git a/app/react/kubernetes/ingresses/IngressDatatable/columns/ingressRules.tsx b/app/react/kubernetes/ingresses/IngressDatatable/columns/ingressRules.tsx
new file mode 100644
index 0000000..4978255
--- /dev/null
+++ b/app/react/kubernetes/ingresses/IngressDatatable/columns/ingressRules.tsx
@@ -0,0 +1,76 @@
+import { CellContext } from '@tanstack/react-table';
+import { AlertTriangle, ArrowRight } from 'lucide-react';
+
+import { Icon } from '@@/Icon';
+import { Badge } from '@@/Badge';
+
+import { Ingress, TLS } from '../../types';
+
+import { columnHelper } from './helper';
+
+export const ingressRules = columnHelper.accessor(
+  ({ Paths, TLS }) =>
+    // return an accessor function with all the useful text to search for
+    Paths?.map((path) => {
+      const isHttp = isHTTP(TLS || [], path.Host);
+      return `${isHttp ? 'http' : 'https'}://${path.Host}${path.Path}${
+        path.ServiceName
+      }:${path.Port} ${!path.HasService && "Service doesn't exist"}`;
+    }).join(','),
+  {
+    header: 'Rules and Paths',
+    id: 'ingressRules',
+    cell: Cell,
+  }
+);
+
+function Cell({ row }: CellContext<Ingress, string>) {
+  const paths = row.original.Paths;
+
+  if (!paths) {
+    return <div />;
+  }
+
+  return (
+    <div className="flex flex-col gap-y-0.5 whitespace-nowrap">
+      {paths.map((path) => (
+        <div key={`${path.Host}${path.Path}${path.ServiceName}:${path.Port}`}>
+          <span className="flex flex-nowrap items-center gap-1 px-2">
+            {link(
+              path.Host,
+              path.Path,
+              isHTTP(row.original.TLS || [], path.Host)
+            )}
+            <Icon icon={ArrowRight} />
+            {`${path.ServiceName}:${path.Port}`}
+            {!path.HasService && (
+              <Badge type="warn" className="ml-1 gap-1">
+                <Icon icon={AlertTriangle} />
+                Service doesn&apos;t exist
+              </Badge>
+            )}
+          </span>
+        </div>
+      ))}
+    </div>
+  );
+}
+
+function isHTTP(TLSs: TLS[], host: string) {
+  return TLSs.filter((t) => t.Hosts.indexOf(host) !== -1).length === 0;
+}
+
+function link(host: string, path: string, isHttp: boolean) {
+  if (!host) {
+    return path;
+  }
+  return (
+    <a
+      href={`${isHttp ? 'http' : 'https'}://${host}${path}`}
+      target="_blank"
+      rel="noreferrer"
+    >
+      {`${isHttp ? 'http' : 'https'}://${host}${path}`}
+    </a>
+  );
+}
diff --git a/app/react/kubernetes/ingresses/IngressDatatable/columns/name.tsx b/app/react/kubernetes/ingresses/IngressDatatable/columns/name.tsx
new file mode 100644
index 0000000..2551e0b
--- /dev/null
+++ b/app/react/kubernetes/ingresses/IngressDatatable/columns/name.tsx
@@ -0,0 +1,41 @@
+import { CellContext } from '@tanstack/react-table';
+
+import { Authorized } from '@/react/hooks/useUser';
+
+import { SystemBadge } from '@@/Badge/SystemBadge';
+import { Link } from '@@/Link';
+
+import { Ingress } from '../../types';
+
+import { columnHelper } from './helper';
+
+export const name = columnHelper.accessor('Name', {
+  header: 'Name',
+  cell: Cell,
+  id: 'name',
+});
+
+function Cell({ row, getValue }: CellContext<Ingress, string>) {
+  const name = getValue();
+  const namespace = row.original.Namespace;
+
+  return (
+    <div className="flex flex-nowrap gap-2 whitespace-nowrap">
+      <Authorized authorizations="K8sIngressesW" childrenUnauthorized={name}>
+        <Link
+          to="kubernetes.ingresses.edit"
+          params={{
+            uid: row.original.UID,
+            namespace,
+            name,
+          }}
+          title={name}
+          data-cy={`ingress-name-link-${name}`}
+        >
+          {name}
+        </Link>
+      </Authorized>
+      {row.original.IsSystem && <SystemBadge className="ml-auto" />}
+    </div>
+  );
+}
diff --git a/app/react/kubernetes/ingresses/IngressDatatable/columns/namespace.tsx b/app/react/kubernetes/ingresses/IngressDatatable/columns/namespace.tsx
new file mode 100644
index 0000000..a850f02
--- /dev/null
+++ b/app/react/kubernetes/ingresses/IngressDatatable/columns/namespace.tsx
@@ -0,0 +1,41 @@
+import { CellContext, Row } from '@tanstack/react-table';
+
+import { filterHOC } from '@@/datatables/Filter';
+import { Link } from '@@/Link';
+
+import { Ingress } from '../../types';
+
+import { columnHelper } from './helper';
+
+export const namespace = columnHelper.accessor('Namespace', {
+  header: 'Namespace',
+  id: 'namespace',
+  cell: Cell,
+  filterFn: (row: Row<Ingress>, columnId: string, filterValue: string[]) => {
+    if (filterValue.length === 0) {
+      return true;
+    }
+    return filterValue.includes(row.original.Namespace);
+  },
+
+  meta: {
+    filter: filterHOC('Filter by namespace'),
+  },
+  enableColumnFilter: true,
+});
+
+function Cell({ getValue, row }: CellContext<Ingress, string>) {
+  const namespace = getValue();
+  return (
+    <Link
+      to="kubernetes.resourcePools.resourcePool"
+      params={{
+        id: namespace,
+      }}
+      title={namespace}
+      data-cy={`ingress-namespace-link-${row.original.Name}`}
+    >
+      {namespace}
+    </Link>
+  );
+}
diff --git a/app/react/kubernetes/ingresses/IngressDatatable/columns/type.tsx b/app/react/kubernetes/ingresses/IngressDatatable/columns/type.tsx
new file mode 100644
index 0000000..8ad56b9
--- /dev/null
+++ b/app/react/kubernetes/ingresses/IngressDatatable/columns/type.tsx
@@ -0,0 +1,7 @@
+import { columnHelper } from './helper';
+
+export const type = columnHelper.accessor('Type', {
+  header: 'Type',
+  id: 'type',
+  cell: ({ row }) => row.original.Type || '-',
+});
diff --git a/app/react/kubernetes/ingresses/IngressDatatable/index.tsx b/app/react/kubernetes/ingresses/IngressDatatable/index.tsx
new file mode 100644
index 0000000..a66a66d
--- /dev/null
+++ b/app/react/kubernetes/ingresses/IngressDatatable/index.tsx
@@ -0,0 +1,20 @@
+import { PageHeader } from '@@/PageHeader';
+
+import { IngressDatatable } from './IngressDatatable';
+
+export function IngressesDatatableView() {
+  return (
+    <>
+      <PageHeader
+        title="Ingress list"
+        breadcrumbs={[
+          {
+            label: 'Ingresses',
+          },
+        ]}
+        reload
+      />
+      <IngressDatatable />
+    </>
+  );
+}
diff --git a/app/react/kubernetes/ingresses/queries.ts b/app/react/kubernetes/ingresses/queries.ts
new file mode 100644
index 0000000..ce6f922
--- /dev/null
+++ b/app/react/kubernetes/ingresses/queries.ts
@@ -0,0 +1,147 @@
+import { useQuery, useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import {
+  mutationOptions,
+  withError,
+  withInvalidate,
+} from '@/react-tools/react-query';
+
+import {
+  getIngresses,
+  getIngress,
+  createIngress,
+  deleteIngresses,
+  updateIngress,
+  getIngressControllers,
+} from './service';
+import { DeleteIngressesRequest, Ingress } from './types';
+
+const queryKeys = {
+  base: ['environments', 'kubernetes', 'ingress'] as const,
+  clusterIngresses: (environmentId: EnvironmentId) =>
+    [...queryKeys.base, String(environmentId)] as const,
+  namespaceIngresses: (
+    environmentId: EnvironmentId,
+    namespace: string,
+    ingress: string
+  ) => [...queryKeys.base, String(environmentId), namespace, ingress] as const,
+  ingress: (environmentId: EnvironmentId, namespace: string, name: string) =>
+    [...queryKeys.base, String(environmentId), namespace, name] as const,
+  ingressControllers: (environmentId: EnvironmentId, namespace: string) => [
+    ...queryKeys.base,
+    String(environmentId),
+    namespace,
+    'ingresscontrollers',
+  ],
+};
+
+export function useIngress(
+  environmentId: EnvironmentId,
+  namespace: string,
+  name: string
+) {
+  return useQuery(
+    queryKeys.ingress(environmentId, namespace, name),
+    async () => {
+      const ing = await getIngress(environmentId, namespace, name);
+      return ing;
+    },
+    {
+      ...withError('Unable to get ingress'),
+    }
+  );
+}
+
+export function useIngresses(
+  environmentId: EnvironmentId,
+  options?: {
+    autoRefreshRate?: number;
+    enabled?: boolean;
+    withServices?: boolean;
+  }
+) {
+  const { enabled, autoRefreshRate, ...params } = options ?? {};
+
+  return useQuery(
+    [...queryKeys.clusterIngresses(environmentId), params],
+    async () => getIngresses(environmentId, params),
+    {
+      ...withError('Unable to get ingresses'),
+      refetchInterval: autoRefreshRate,
+      enabled,
+    }
+  );
+}
+
+export function useCreateIngress() {
+  const queryClient = useQueryClient();
+  return useMutation(
+    ({
+      environmentId,
+      ingress,
+    }: {
+      environmentId: EnvironmentId;
+      ingress: Ingress;
+    }) => createIngress(environmentId, ingress),
+    mutationOptions(
+      withError('Unable to create ingress controller'),
+      withInvalidate(queryClient, [queryKeys.base])
+    )
+  );
+}
+
+export function useUpdateIngress() {
+  const queryClient = useQueryClient();
+  return useMutation(
+    ({
+      environmentId,
+      ingress,
+    }: {
+      environmentId: EnvironmentId;
+      ingress: Ingress;
+    }) => updateIngress(environmentId, ingress),
+    mutationOptions(
+      withError('Unable to update ingress controller'),
+      withInvalidate(queryClient, [queryKeys.base])
+    )
+  );
+}
+
+export function useDeleteIngresses() {
+  const queryClient = useQueryClient();
+  return useMutation(
+    ({
+      environmentId,
+      data,
+    }: {
+      environmentId: EnvironmentId;
+      data: DeleteIngressesRequest;
+    }) => deleteIngresses(environmentId, data),
+    mutationOptions(
+      withError('Unable to update ingress controller'),
+      withInvalidate(queryClient, [queryKeys.base])
+    )
+  );
+}
+
+/**
+ * Ingress Controllers
+ */
+export function useIngressControllers(
+  environmentId: EnvironmentId,
+  namespace?: string,
+  allowedOnly?: boolean
+) {
+  return useQuery(
+    queryKeys.ingressControllers(environmentId, namespace ?? ''),
+    async () =>
+      namespace
+        ? getIngressControllers(environmentId, namespace, allowedOnly)
+        : [],
+    {
+      enabled: !!namespace,
+      ...withError('Unable to get ingress controllers'),
+    }
+  );
+}
diff --git a/app/react/kubernetes/ingresses/service.ts b/app/react/kubernetes/ingresses/service.ts
new file mode 100644
index 0000000..5804fdc
--- /dev/null
+++ b/app/react/kubernetes/ingresses/service.ts
@@ -0,0 +1,103 @@
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { Ingress, DeleteIngressesRequest, IngressController } from './types';
+
+export async function getIngress(
+  environmentId: EnvironmentId,
+  namespace: string,
+  ingressName: string
+) {
+  try {
+    const { data: ingress } = await axios.get<Ingress[]>(
+      buildUrl(environmentId, namespace, ingressName)
+    );
+    return ingress[0];
+  } catch (e) {
+    throw parseAxiosError(e as Error, 'Unable to retrieve the ingress');
+  }
+}
+
+export async function getIngresses(
+  environmentId: EnvironmentId,
+  params?: { withServices?: boolean }
+) {
+  try {
+    const { data: ingresses } = await axios.get<Ingress[]>(
+      `kubernetes/${environmentId}/ingresses`,
+      { params }
+    );
+    return ingresses;
+  } catch (e) {
+    throw parseAxiosError(e as Error, 'Unable to retrieve ingresses');
+  }
+}
+
+export async function getIngressControllers(
+  environmentId: EnvironmentId,
+  namespace: string,
+  allowedOnly?: boolean
+) {
+  try {
+    const { data: ingresscontrollers } = await axios.get<IngressController[]>(
+      `kubernetes/${environmentId}/namespaces/${namespace}/ingresscontrollers`,
+      allowedOnly ? { params: { allowedOnly: true } } : undefined
+    );
+    return ingresscontrollers;
+  } catch (e) {
+    throw parseAxiosError(e as Error, 'Unable to retrieve ingresses');
+  }
+}
+
+export async function createIngress(
+  environmentId: EnvironmentId,
+  ingress: Ingress
+) {
+  try {
+    return await axios.post(
+      buildUrl(environmentId, ingress.Namespace),
+      ingress
+    );
+  } catch (e) {
+    throw parseAxiosError(e as Error, 'Unable to create an ingress');
+  }
+}
+
+export async function updateIngress(
+  environmentId: EnvironmentId,
+  ingress: Ingress
+) {
+  try {
+    await axios.put(buildUrl(environmentId, ingress.Namespace), ingress);
+  } catch (e) {
+    throw parseAxiosError(e as Error, 'Unable to update an ingress');
+  }
+}
+
+export async function deleteIngresses(
+  environmentId: EnvironmentId,
+  data: DeleteIngressesRequest
+) {
+  try {
+    return await axios.post(
+      `kubernetes/${environmentId}/ingresses/delete`,
+      data
+    );
+  } catch (e) {
+    throw parseAxiosError(e as Error, 'Unable to delete ingresses');
+  }
+}
+
+function buildUrl(
+  environmentId: EnvironmentId,
+  namespace: string,
+  ingressName?: string
+) {
+  let url = `kubernetes/${environmentId}/namespaces/${namespace}/ingresses`;
+
+  if (ingressName) {
+    url += `/${ingressName}`;
+  }
+
+  return url;
+}
diff --git a/app/react/kubernetes/ingresses/style.css b/app/react/kubernetes/ingresses/style.css
new file mode 100644
index 0000000..7f189cc
--- /dev/null
+++ b/app/react/kubernetes/ingresses/style.css
@@ -0,0 +1,29 @@
+.ingress-rules .bordered {
+  border: 1px solid var(--border-color);
+  border-radius: 5px;
+}
+
+.ingress-rules .rule {
+  background-color: var(--bg-body-color);
+}
+
+.anntation-actions button > span,
+.rules-action button > span,
+.rule button > span {
+  display: inline-flex;
+  align-items: center;
+  gap: 5px;
+}
+
+.error-inline {
+  display: block;
+}
+
+.error-inline svg {
+  margin-right: 5px;
+}
+
+.error-inline svg,
+.error-inline span {
+  display: inline;
+}
diff --git a/app/react/kubernetes/ingresses/types.ts b/app/react/kubernetes/ingresses/types.ts
new file mode 100644
index 0000000..43ae701
--- /dev/null
+++ b/app/react/kubernetes/ingresses/types.ts
@@ -0,0 +1,51 @@
+import {
+  PaginationTableSettings,
+  SortableTableSettings,
+} from '@/react/components/datatables/types';
+import { SupportedIngControllerTypes } from '@/react/kubernetes/cluster/ingressClass/types';
+
+export interface TableSettings
+  extends SortableTableSettings, PaginationTableSettings {}
+
+export interface Path {
+  IngressName: string;
+  ServiceName: string;
+  Host: string;
+  Port: number;
+  Path: string;
+  PathType: string;
+  HasService?: boolean;
+}
+
+export interface TLS {
+  Hosts: string[];
+  SecretName: string;
+}
+
+export type Ingress = {
+  Name: string;
+  UID?: string;
+  Namespace: string;
+  ClassName: string;
+  Annotations?: Record<string, string>;
+  Hosts?: string[];
+  Paths: Path[] | null;
+  TLS?: TLS[];
+  Type?: string;
+  Labels?: Record<string, string>;
+  CreationDate?: string;
+
+  IsSystem?: boolean;
+};
+
+export interface DeleteIngressesRequest {
+  [key: string]: string[];
+}
+
+export interface IngressController {
+  Name: string;
+  ClassName: string;
+  Availability: string;
+  Type: SupportedIngControllerTypes;
+  New: boolean;
+}
diff --git a/app/react/kubernetes/metrics/metrics.ts b/app/react/kubernetes/metrics/metrics.ts
new file mode 100644
index 0000000..ccbe2a3
--- /dev/null
+++ b/app/react/kubernetes/metrics/metrics.ts
@@ -0,0 +1,30 @@
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { NodeMetrics } from './types';
+
+export async function getMetricsForAllNodes(environmentId: EnvironmentId) {
+  try {
+    const { data: nodes } = await axios.get<NodeMetrics>(
+      `kubernetes/${environmentId}/metrics/nodes`
+    );
+    return nodes;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to retrieve metrics for all nodes');
+  }
+}
+
+export async function getMetricsForPod(
+  environmentId: EnvironmentId,
+  namespace: string,
+  podName: string
+) {
+  try {
+    const { data: pod } = await axios.get(
+      `kubernetes/${environmentId}/metrics/pods/namespace/${namespace}/${podName}`
+    );
+    return pod;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to retrieve metrics for pod');
+  }
+}
diff --git a/app/react/kubernetes/metrics/queries/query-keys.ts b/app/react/kubernetes/metrics/queries/query-keys.ts
new file mode 100644
index 0000000..49c6d51
--- /dev/null
+++ b/app/react/kubernetes/metrics/queries/query-keys.ts
@@ -0,0 +1,21 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { queryKeys as namespaceQueryKeys } from '@/react/kubernetes/namespaces/queries/queryKeys';
+import { queryKeys as nodeQueryKeys } from '@/react/kubernetes/cluster/queries/query-keys';
+
+export const queryKeys = {
+  namespaceMetrics: (environmentId: EnvironmentId, namespaceName: string) => [
+    ...namespaceQueryKeys.namespace(environmentId, namespaceName),
+    'metrics',
+  ],
+  nodeMetrics: (environmentId: EnvironmentId, nodeName: string) => [
+    ...nodeQueryKeys.node(environmentId, nodeName),
+    'metrics',
+  ],
+  applicationMetrics: (environmentId: EnvironmentId, nodeName?: string) => [
+    environmentId,
+    'kubernetes',
+    'metrics',
+    'applications',
+    nodeName,
+  ],
+};
diff --git a/app/react/kubernetes/metrics/queries/useMetricsForApplications.ts b/app/react/kubernetes/metrics/queries/useMetricsForApplications.ts
new file mode 100644
index 0000000..321cdb4
--- /dev/null
+++ b/app/react/kubernetes/metrics/queries/useMetricsForApplications.ts
@@ -0,0 +1,42 @@
+import { useQuery, UseQueryOptions } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { ApplicationResource } from '../types';
+
+import { queryKeys } from './query-keys';
+
+export function useMetricsForApplicationsQuery<T = ApplicationResource>(
+  environmentId: EnvironmentId,
+  nodeName?: string,
+  queryOptions?: UseQueryOptions<ApplicationResource, unknown, T>
+) {
+  return useQuery({
+    queryKey: queryKeys.applicationMetrics(environmentId, nodeName),
+    queryFn: () => getTotalResourcesForAllApplications(environmentId, nodeName),
+    ...queryOptions,
+  });
+}
+
+export async function getTotalResourcesForAllApplications(
+  environmentId: EnvironmentId,
+  nodeName?: string
+) {
+  try {
+    const { data: resources } = await axios.get<ApplicationResource>(
+      `kubernetes/${environmentId}/metrics/applications_resources`,
+      {
+        params: {
+          node: nodeName,
+        },
+      }
+    );
+    return resources;
+  } catch (e) {
+    throw parseAxiosError(
+      e,
+      'Unable to retrieve total resources for all applications'
+    );
+  }
+}
diff --git a/app/react/kubernetes/metrics/queries/useNamespaceMetricsQuery.ts b/app/react/kubernetes/metrics/queries/useNamespaceMetricsQuery.ts
new file mode 100644
index 0000000..160d0a0
--- /dev/null
+++ b/app/react/kubernetes/metrics/queries/useNamespaceMetricsQuery.ts
@@ -0,0 +1,34 @@
+import { useQuery, UseQueryOptions } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { PodMetrics } from '../types';
+
+import { queryKeys } from './query-keys';
+
+export function useNamespaceMetricsQuery<T = PodMetrics>(
+  environmentId: EnvironmentId,
+  namespaceName: string,
+  queryOptions?: UseQueryOptions<PodMetrics, unknown, T>
+) {
+  return useQuery({
+    queryKey: queryKeys.namespaceMetrics(environmentId, namespaceName),
+    queryFn: () => getMetricsForNamespace(environmentId, namespaceName),
+    ...queryOptions,
+  });
+}
+
+export async function getMetricsForNamespace(
+  environmentId: EnvironmentId,
+  namespaceName: string
+) {
+  try {
+    const { data: pods } = await axios.get<PodMetrics>(
+      `kubernetes/${environmentId}/metrics/pods/namespace/${namespaceName}`
+    );
+    return pods;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to retrieve metrics for all pods');
+  }
+}
diff --git a/app/react/kubernetes/metrics/queries/useNodeMetricsQuery.ts b/app/react/kubernetes/metrics/queries/useNodeMetricsQuery.ts
new file mode 100644
index 0000000..ccbe2bf
--- /dev/null
+++ b/app/react/kubernetes/metrics/queries/useNodeMetricsQuery.ts
@@ -0,0 +1,33 @@
+import { useQuery, UseQueryOptions } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { NodeMetric } from '../types';
+
+export function useNodeMetricsQuery<T = NodeMetric>(
+  nodeName: string,
+  environmentId: EnvironmentId,
+  queryOptions?: UseQueryOptions<NodeMetric, unknown, T>
+) {
+  return useQuery({
+    queryKey: [environmentId, 'node-metrics', nodeName],
+    queryFn: () => getMetricsForNode(environmentId, nodeName),
+    ...queryOptions,
+  });
+}
+
+export async function getMetricsForNode(
+  environmentId: EnvironmentId,
+  nodeName: string
+) {
+  try {
+    const { data: node } = await axios.get<NodeMetric>(
+      `kubernetes/${environmentId}/metrics/nodes/${nodeName}`
+    );
+
+    return node;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to retrieve metrics for node');
+  }
+}
diff --git a/app/react/kubernetes/metrics/types.ts b/app/react/kubernetes/metrics/types.ts
new file mode 100644
index 0000000..964fb55
--- /dev/null
+++ b/app/react/kubernetes/metrics/types.ts
@@ -0,0 +1,44 @@
+export type PodMetrics = {
+  items?: PodMetric[];
+};
+
+export type PodMetric = {
+  containers: ContainerMetric[];
+};
+
+type ContainerMetric = {
+  usage: ResourceUsage;
+};
+
+type ResourceUsage = {
+  cpu: string;
+  memory: string;
+};
+
+export type NodeMetrics = {
+  items: NodeMetric[];
+};
+
+export type NodeMetric = {
+  metadata: NodeMetricMetadata;
+  timestamp: Date;
+  usage: Usage;
+  window: string;
+};
+
+export type NodeMetricMetadata = {
+  creationTimestamp: Date;
+  name: string;
+};
+
+export type Usage = {
+  cpu: string;
+  memory: string;
+};
+
+export type ApplicationResource = {
+  CpuRequest: number;
+  CpuLimit: number;
+  MemoryRequest: number;
+  MemoryLimit: number;
+};
diff --git a/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRoleBindingsDatatable/ClusterRoleBindingsDatatable.tsx b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRoleBindingsDatatable/ClusterRoleBindingsDatatable.tsx
new file mode 100644
index 0000000..8fb9d2e
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRoleBindingsDatatable/ClusterRoleBindingsDatatable.tsx
@@ -0,0 +1,170 @@
+import { Trash2, Link as LinkIcon } from 'lucide-react';
+import { useRouter } from '@uirouter/react';
+import { Row } from '@tanstack/react-table';
+import clsx from 'clsx';
+import { useMemo } from 'react';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useAuthorizations, Authorized } from '@/react/hooks/useUser';
+import { notifyError, notifySuccess } from '@/portainer/services/notifications';
+import { SystemResourceDescription } from '@/react/kubernetes/datatables/SystemResourceDescription';
+import { createStore } from '@/react/kubernetes/datatables/default-kube-datatable-store';
+import { CreateFromManifestButton } from '@/react/kubernetes/components/CreateFromManifestButton';
+
+import { confirmDelete } from '@@/modals/confirm';
+import { Datatable, Table, TableSettingsMenu } from '@@/datatables';
+import { LoadingButton } from '@@/buttons';
+import { useTableState } from '@@/datatables/useTableState';
+
+import { DefaultDatatableSettings } from '../../../datatables/DefaultDatatableSettings';
+
+import { ClusterRoleBinding } from './types';
+import { columns } from './columns';
+import { useClusterRoleBindings } from './queries/useClusterRoleBindings';
+import { useDeleteClusterRoleBindingsMutation } from './queries/useDeleteClusterRoleBindingsMutation';
+
+const storageKey = 'clusterRoleBindings';
+const settingsStore = createStore(storageKey);
+
+export function ClusterRoleBindingsDatatable() {
+  const environmentId = useEnvironmentId();
+  const tableState = useTableState(settingsStore, storageKey);
+  const clusterRoleBindingsQuery = useClusterRoleBindings(environmentId, {
+    autoRefreshRate: tableState.autoRefreshRate * 1000,
+  });
+
+  const filteredClusterRoleBindings = useMemo(
+    () =>
+      clusterRoleBindingsQuery.data?.filter(
+        (crb) => tableState.showSystemResources || !crb.isSystem
+      ),
+    [clusterRoleBindingsQuery.data, tableState.showSystemResources]
+  );
+
+  const { authorized: isAuthorizedToAddOrEdit } = useAuthorizations([
+    'K8sClusterRoleBindingsW',
+  ]);
+
+  return (
+    <Datatable
+      dataset={filteredClusterRoleBindings || []}
+      columns={columns}
+      settingsManager={tableState}
+      isLoading={clusterRoleBindingsQuery.isLoading}
+      emptyContentLabel="No supported cluster role bindings found"
+      title="Cluster Role Bindings"
+      titleIcon={LinkIcon}
+      getRowId={(row) => row.uid}
+      isRowSelectable={(row) => !row.original.isSystem}
+      renderTableActions={(selectedRows) => (
+        <TableActions selectedItems={selectedRows} />
+      )}
+      renderTableSettings={() => (
+        <TableSettingsMenu>
+          <DefaultDatatableSettings settings={tableState} />
+        </TableSettingsMenu>
+      )}
+      description={
+        <SystemResourceDescription
+          showSystemResources={tableState.showSystemResources}
+        />
+      }
+      disableSelect={!isAuthorizedToAddOrEdit}
+      renderRow={renderRow}
+      data-cy="k8s-cluster-role-bindings-datatable"
+    />
+  );
+}
+
+// needed to apply custom styling to the row and not globally required in the AC's for this ticket.
+function renderRow(row: Row<ClusterRoleBinding>, highlightedItemId?: string) {
+  return (
+    <Table.Row<ClusterRoleBinding>
+      cells={row.getVisibleCells()}
+      className={clsx('[&>td]:!py-4 [&>td]:!align-top', {
+        active: highlightedItemId === row.id,
+      })}
+    />
+  );
+}
+
+interface SelectedRole {
+  name: string;
+}
+
+type TableActionsProps = {
+  selectedItems: ClusterRoleBinding[];
+};
+
+function TableActions({ selectedItems }: TableActionsProps) {
+  const environmentId = useEnvironmentId();
+  const deleteClusterRoleBindingsMutation =
+    useDeleteClusterRoleBindingsMutation(environmentId);
+  const router = useRouter();
+
+  async function handleRemoveClick(roles: SelectedRole[]) {
+    const confirmed = await confirmDelete(
+      <>
+        <p>
+          Are you sure you want to delete the selected cluster role binding(s)?
+        </p>
+        <ul className="mt-2 max-h-96 list-inside overflow-hidden overflow-y-auto text-sm">
+          {roles.map((s, index) => (
+            <li key={index}>{s.name}</li>
+          ))}
+        </ul>
+      </>
+    );
+    if (!confirmed) {
+      return null;
+    }
+
+    const payload: string[] = [];
+    roles.forEach((r) => {
+      payload.push(r.name);
+    });
+
+    deleteClusterRoleBindingsMutation.mutate(
+      { environmentId, data: payload },
+      {
+        onSuccess: () => {
+          notifySuccess(
+            'Roles successfully removed',
+            roles.map((r) => `${r.name}`).join(', ')
+          );
+          router.stateService.reload();
+        },
+        onError: (error) => {
+          notifyError(
+            'Unable to delete cluster role bindings',
+            error as Error,
+            roles.map((r) => `${r.name}`).join(', ')
+          );
+        },
+      }
+    );
+    return roles;
+  }
+
+  return (
+    <Authorized authorizations="K8sClusterRoleBindingsW">
+      <LoadingButton
+        className="btn-wrapper"
+        color="dangerlight"
+        disabled={selectedItems.length === 0}
+        onClick={() => handleRemoveClick(selectedItems)}
+        icon={Trash2}
+        isLoading={deleteClusterRoleBindingsMutation.isLoading}
+        loadingText="Removing cluster role bindings..."
+        data-cy="k8s-cluster-role-bindings-remove-button"
+      >
+        Remove
+      </LoadingButton>
+
+      <CreateFromManifestButton
+        params={{ tab: 'clusterRoleBindings' }}
+        data-cy="k8s-cluster-role-bindings-deploy-button"
+      />
+    </Authorized>
+  );
+}
diff --git a/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRoleBindingsDatatable/columns/created.tsx b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRoleBindingsDatatable/columns/created.tsx
new file mode 100644
index 0000000..c9c4562
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRoleBindingsDatatable/columns/created.tsx
@@ -0,0 +1,12 @@
+import { formatDate } from '@/portainer/filters/filters';
+
+import { columnHelper } from './helper';
+
+export const created = columnHelper.accessor(
+  (row) => formatDate(row.creationDate),
+  {
+    header: 'Created',
+    id: 'created',
+    cell: ({ getValue }) => getValue(),
+  }
+);
diff --git a/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRoleBindingsDatatable/columns/helper.ts b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRoleBindingsDatatable/columns/helper.ts
new file mode 100644
index 0000000..49567a3
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRoleBindingsDatatable/columns/helper.ts
@@ -0,0 +1,5 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { ClusterRoleBinding } from '../types';
+
+export const columnHelper = createColumnHelper<ClusterRoleBinding>();
diff --git a/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRoleBindingsDatatable/columns/index.tsx b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRoleBindingsDatatable/columns/index.tsx
new file mode 100644
index 0000000..5fcf659
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRoleBindingsDatatable/columns/index.tsx
@@ -0,0 +1,17 @@
+import { name } from './name';
+import { roleName } from './roleName';
+import { kind } from './kind';
+import { created } from './created';
+import { subjectKind } from './subjectKind';
+import { subjectName } from './subjectName';
+import { subjectNamespace } from './subjectNamespace';
+
+export const columns = [
+  name,
+  roleName,
+  kind,
+  subjectKind,
+  subjectName,
+  subjectNamespace,
+  created,
+];
diff --git a/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRoleBindingsDatatable/columns/kind.tsx b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRoleBindingsDatatable/columns/kind.tsx
new file mode 100644
index 0000000..5ad647d
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRoleBindingsDatatable/columns/kind.tsx
@@ -0,0 +1,6 @@
+import { columnHelper } from './helper';
+
+export const kind = columnHelper.accessor('roleRef.kind', {
+  header: 'Role Kind',
+  id: 'roleKind',
+});
diff --git a/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRoleBindingsDatatable/columns/name.tsx b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRoleBindingsDatatable/columns/name.tsx
new file mode 100644
index 0000000..b2b817a
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRoleBindingsDatatable/columns/name.tsx
@@ -0,0 +1,29 @@
+import { SystemBadge } from '@@/Badge/SystemBadge';
+import { Link } from '@@/Link';
+
+import { columnHelper } from './helper';
+
+export const name = columnHelper.accessor(
+  (row) => {
+    if (row.isSystem) {
+      return `${row.name} system`;
+    }
+    return row.name;
+  },
+  {
+    header: 'Name',
+    id: 'name',
+    cell: ({ row }) => (
+      <div className="flex gap-2">
+        <Link
+          to="kubernetes.moreResources.clusterRoleBinding"
+          params={{ name: row.original.name }}
+          data-cy={`clusterrolebinding-name-link-${row.original.name}`}
+        >
+          {row.original.name}
+        </Link>
+        {row.original.isSystem && <SystemBadge className="ml-auto" />}
+      </div>
+    ),
+  }
+);
diff --git a/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRoleBindingsDatatable/columns/roleName.tsx b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRoleBindingsDatatable/columns/roleName.tsx
new file mode 100644
index 0000000..69fb3a6
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRoleBindingsDatatable/columns/roleName.tsx
@@ -0,0 +1,6 @@
+import { columnHelper } from './helper';
+
+export const roleName = columnHelper.accessor('roleRef.name', {
+  header: 'Role Name',
+  id: 'roleName',
+});
diff --git a/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRoleBindingsDatatable/columns/subjectKind.tsx b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRoleBindingsDatatable/columns/subjectKind.tsx
new file mode 100644
index 0000000..49c43cb
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRoleBindingsDatatable/columns/subjectKind.tsx
@@ -0,0 +1,13 @@
+import { columnHelper } from './helper';
+
+export const subjectKind = columnHelper.accessor(
+  (row) => row.subjects?.map((sub) => sub.kind).join(', '),
+  {
+    header: 'Subject Kind',
+    id: 'subjectKind',
+    cell: ({ row }) =>
+      row.original.subjects?.map((sub, index) => (
+        <div key={index}>{sub.kind}</div>
+      )) || '-',
+  }
+);
diff --git a/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRoleBindingsDatatable/columns/subjectName.tsx b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRoleBindingsDatatable/columns/subjectName.tsx
new file mode 100644
index 0000000..b760c35
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRoleBindingsDatatable/columns/subjectName.tsx
@@ -0,0 +1,13 @@
+import { columnHelper } from './helper';
+
+export const subjectName = columnHelper.accessor(
+  (row) => row.subjects?.map((sub) => sub.name).join(' '),
+  {
+    header: 'Subject Name',
+    id: 'subjectName',
+    cell: ({ row }) =>
+      row.original.subjects?.map((sub, index) => (
+        <div key={index}>{sub.name}</div>
+      )) || '-',
+  }
+);
diff --git a/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRoleBindingsDatatable/columns/subjectNamespace.tsx b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRoleBindingsDatatable/columns/subjectNamespace.tsx
new file mode 100644
index 0000000..68f3145
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRoleBindingsDatatable/columns/subjectNamespace.tsx
@@ -0,0 +1,42 @@
+import { Link } from '@@/Link';
+import { filterHOC } from '@@/datatables/Filter';
+
+import { filterFn, filterNamespaceOptionsTransformer } from '../../utils';
+
+import { columnHelper } from './helper';
+
+export const subjectNamespace = columnHelper.accessor(
+  (row) => row.subjects?.flatMap((sub) => sub.namespace || '-') || [],
+  {
+    header: 'Subject Namespace',
+    id: 'subjectNamespace',
+    cell: ({ row }) =>
+      row.original.subjects?.map((sub, index) => (
+        <div key={index}>
+          {sub.namespace ? (
+            <Link
+              to="kubernetes.resourcePools.resourcePool"
+              params={{
+                id: sub.namespace,
+              }}
+              title={sub.namespace}
+              data-cy={`subject-namespace-link-${row.original.name}_${index}`}
+            >
+              {sub.namespace}
+            </Link>
+          ) : (
+            '-'
+          )}
+        </div>
+      )) || '-',
+    enableColumnFilter: true,
+    // use a custom filter, to remove empty namespace values
+    meta: {
+      filter: filterHOC(
+        'Filter by subject namespace',
+        filterNamespaceOptionsTransformer
+      ),
+    },
+    filterFn,
+  }
+);
diff --git a/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRoleBindingsDatatable/queries/query-keys.ts b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRoleBindingsDatatable/queries/query-keys.ts
new file mode 100644
index 0000000..9905810
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRoleBindingsDatatable/queries/query-keys.ts
@@ -0,0 +1,11 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+export const queryKeys = {
+  list: (environmentId: EnvironmentId) =>
+    [
+      'environments',
+      environmentId,
+      'kubernetes',
+      'cluster_role_bindings',
+    ] as const,
+};
diff --git a/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRoleBindingsDatatable/queries/useClusterRoleBindings.ts b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRoleBindingsDatatable/queries/useClusterRoleBindings.ts
new file mode 100644
index 0000000..2824828
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRoleBindingsDatatable/queries/useClusterRoleBindings.ts
@@ -0,0 +1,41 @@
+import { compact } from 'lodash';
+import { useQuery } from '@tanstack/react-query';
+
+import { withError } from '@/react-tools/react-query';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { ClusterRoleBinding } from '../types';
+
+import { queryKeys } from './query-keys';
+
+export function useClusterRoleBindings(
+  environmentId: EnvironmentId,
+  options?: { autoRefreshRate?: number }
+) {
+  return useQuery(
+    queryKeys.list(environmentId),
+    async () => {
+      const cluerRoleBindings = await getClusterRoleBindings(environmentId);
+      return compact(cluerRoleBindings);
+    },
+    {
+      ...withError('Unable to get cluster role bindings'),
+      refetchInterval() {
+        return options?.autoRefreshRate ?? false;
+      },
+    }
+  );
+}
+
+async function getClusterRoleBindings(environmentId: EnvironmentId) {
+  try {
+    const { data: roles } = await axios.get<ClusterRoleBinding[]>(
+      `kubernetes/${environmentId}/cluster_role_bindings`
+    );
+
+    return roles;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to get cluster role bindings');
+  }
+}
diff --git a/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRoleBindingsDatatable/queries/useDeleteClusterRoleBindingsMutation.ts b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRoleBindingsDatatable/queries/useDeleteClusterRoleBindingsMutation.ts
new file mode 100644
index 0000000..ebdf400
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRoleBindingsDatatable/queries/useDeleteClusterRoleBindingsMutation.ts
@@ -0,0 +1,34 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { withError, withInvalidate } from '@/react-tools/react-query';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { queryKeys } from './query-keys';
+
+export function useDeleteClusterRoleBindingsMutation(
+  environmentId: EnvironmentId
+) {
+  const queryClient = useQueryClient();
+  return useMutation(deleteClusterRoleBindings, {
+    ...withInvalidate(queryClient, [queryKeys.list(environmentId)]),
+    ...withError('Unable to delete cluster role bindings'),
+  });
+}
+
+export async function deleteClusterRoleBindings({
+  environmentId,
+  data,
+}: {
+  environmentId: EnvironmentId;
+  data: string[];
+}) {
+  try {
+    return await axios.post(
+      `kubernetes/${environmentId}/cluster_role_bindings/delete`,
+      data
+    );
+  } catch (e) {
+    throw parseAxiosError(e, `Unable to delete cluster role bindings`);
+  }
+}
diff --git a/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRoleBindingsDatatable/types.ts b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRoleBindingsDatatable/types.ts
new file mode 100644
index 0000000..472e9bf
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRoleBindingsDatatable/types.ts
@@ -0,0 +1,22 @@
+export type ClusterRoleRef = {
+  name: string;
+  kind: string;
+  apiGroup?: string;
+};
+
+export type ClusterRoleSubject = {
+  name: string;
+  kind: string;
+  apiGroup?: string;
+  namespace?: string;
+};
+
+export type ClusterRoleBinding = {
+  name: string;
+  uid: string;
+  namespace: string;
+  roleRef: ClusterRoleRef;
+  subjects: ClusterRoleSubject[] | null;
+  creationDate: string;
+  isSystem: boolean;
+};
diff --git a/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRolesDatatable/ClusterRolesDatatable.tsx b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRolesDatatable/ClusterRolesDatatable.tsx
new file mode 100644
index 0000000..1c9b7c5
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRolesDatatable/ClusterRolesDatatable.tsx
@@ -0,0 +1,206 @@
+import { Trash2, UserCheck } from 'lucide-react';
+import { useRouter } from '@uirouter/react';
+import { useMemo } from 'react';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useAuthorizations, Authorized } from '@/react/hooks/useUser';
+import { notifyError, notifySuccess } from '@/portainer/services/notifications';
+import { SystemResourceDescription } from '@/react/kubernetes/datatables/SystemResourceDescription';
+import { createStore } from '@/react/kubernetes/datatables/default-kube-datatable-store';
+import { CreateFromManifestButton } from '@/react/kubernetes/components/CreateFromManifestButton';
+
+import { confirmDelete } from '@@/modals/confirm';
+import { Datatable, TableSettingsMenu } from '@@/datatables';
+import { LoadingButton } from '@@/buttons';
+import { useTableState } from '@@/datatables/useTableState';
+
+import { DefaultDatatableSettings } from '../../../datatables/DefaultDatatableSettings';
+import { useClusterRoleBindings } from '../ClusterRoleBindingsDatatable/queries/useClusterRoleBindings';
+import { useRoleBindings } from '../../RolesView/RoleBindingsDatatable/queries/useRoleBindings';
+import { ClusterRoleBinding } from '../ClusterRoleBindingsDatatable/types';
+import { RoleBinding } from '../../RolesView/RoleBindingsDatatable/types';
+
+import { ClusterRole, ClusterRoleRowData } from './types';
+import { columns } from './columns';
+import { useClusterRoles } from './queries/useClusterRoles';
+import { useDeleteClusterRolesMutation } from './queries/useDeleteClusterRolesMutation';
+
+const storageKey = 'clusterRoles';
+const settingsStore = createStore(storageKey);
+
+export function ClusterRolesDatatable() {
+  const environmentId = useEnvironmentId();
+  const tableState = useTableState(settingsStore, storageKey);
+
+  const clusterRolesQuery = useClusterRoles(environmentId, {
+    autoRefreshRate: tableState.autoRefreshRate * 1000,
+  });
+  const clusterRoleBindingsQuery = useClusterRoleBindings(environmentId);
+  const roleBindingsQuery = useRoleBindings(environmentId);
+
+  const clusterRolesWithUnusedFlag = useClusterRolesWithUnusedFlag(
+    clusterRolesQuery.data,
+    clusterRoleBindingsQuery.data,
+    roleBindingsQuery.data
+  );
+
+  const filteredClusterRoles = useMemo(
+    () =>
+      clusterRolesWithUnusedFlag.filter(
+        (cr) => tableState.showSystemResources || !cr.isSystem
+      ),
+    [clusterRolesWithUnusedFlag, tableState.showSystemResources]
+  );
+
+  const isLoading =
+    clusterRolesQuery.isLoading ||
+    clusterRoleBindingsQuery.isLoading ||
+    roleBindingsQuery.isLoading;
+
+  const { authorized: isAuthorizedToAddEdit } = useAuthorizations([
+    'K8sClusterRolesW',
+  ]);
+
+  return (
+    <Datatable
+      dataset={filteredClusterRoles || []}
+      columns={columns}
+      isLoading={isLoading}
+      settingsManager={tableState}
+      emptyContentLabel="No supported cluster roles found"
+      title="Cluster Roles"
+      titleIcon={UserCheck}
+      getRowId={(row) => row.uid}
+      isRowSelectable={(row) => !row.original.isSystem}
+      renderTableActions={(selectedRows) => (
+        <TableActions selectedItems={selectedRows} />
+      )}
+      renderTableSettings={() => (
+        <TableSettingsMenu>
+          <DefaultDatatableSettings settings={tableState} />
+        </TableSettingsMenu>
+      )}
+      description={
+        <SystemResourceDescription
+          showSystemResources={tableState.showSystemResources}
+        />
+      }
+      disableSelect={!isAuthorizedToAddEdit}
+      data-cy="k8s-clusterroles-datatable"
+    />
+  );
+}
+
+interface SelectedRole {
+  name: string;
+}
+
+type TableActionsProps = {
+  selectedItems: ClusterRole[];
+};
+
+function TableActions({ selectedItems }: TableActionsProps) {
+  const environmentId = useEnvironmentId();
+  const deleteClusterRolesMutation =
+    useDeleteClusterRolesMutation(environmentId);
+  const router = useRouter();
+
+  async function handleRemoveClick(roles: SelectedRole[]) {
+    const confirmed = await confirmDelete(
+      <>
+        <p>Are you sure you want to delete the selected cluster role(s)?</p>
+        <ul className="mt-2 max-h-96 list-inside overflow-hidden overflow-y-auto text-sm">
+          {roles.map((s, index) => (
+            <li key={index}>{s.name}</li>
+          ))}
+        </ul>
+      </>
+    );
+    if (!confirmed) {
+      return null;
+    }
+
+    const payload: string[] = [];
+    roles.forEach((r) => {
+      payload.push(r.name);
+    });
+
+    deleteClusterRolesMutation.mutate(
+      { environmentId, data: payload },
+      {
+        onSuccess: () => {
+          notifySuccess(
+            'Roles successfully removed',
+            roles.map((r) => `${r.name}`).join(', ')
+          );
+          router.stateService.reload();
+        },
+        onError: (error) => {
+          notifyError(
+            'Unable to delete cluster roles',
+            error as Error,
+            roles.map((r) => `${r.name}`).join(', ')
+          );
+        },
+      }
+    );
+    return roles;
+  }
+
+  return (
+    <Authorized authorizations="K8sClusterRolesW">
+      <LoadingButton
+        className="btn-wrapper"
+        color="dangerlight"
+        disabled={selectedItems.length === 0}
+        onClick={() => handleRemoveClick(selectedItems)}
+        icon={Trash2}
+        isLoading={deleteClusterRolesMutation.isLoading}
+        loadingText="Removing cluster roles..."
+        data-cy="k8sClusterRoles-removeRoleButton"
+      >
+        Remove
+      </LoadingButton>
+
+      <CreateFromManifestButton
+        params={{ tab: 'clusterRoles' }}
+        data-cy="k8s-cluster-roles-deploy-button"
+      />
+    </Authorized>
+  );
+}
+
+// Updated custom hook
+function useClusterRolesWithUnusedFlag(
+  clusterRoles?: ClusterRole[],
+  clusterRoleBindings?: ClusterRoleBinding[],
+  roleBindings?: RoleBinding[]
+): ClusterRoleRowData[] {
+  return useMemo(() => {
+    if (!clusterRoles || !clusterRoleBindings || !roleBindings) {
+      return [];
+    }
+
+    const usedRoleNames = new Set<string>();
+
+    // Check ClusterRoleBindings
+    clusterRoleBindings.forEach((binding) => {
+      if (binding.roleRef.kind === 'ClusterRole') {
+        usedRoleNames.add(binding.roleRef.name);
+      }
+    });
+
+    // Check RoleBindings
+    roleBindings.forEach((binding) => {
+      if (binding.roleRef.kind === 'ClusterRole') {
+        usedRoleNames.add(binding.roleRef.name);
+      }
+    });
+
+    // Mark cluster roles as unused if they're not in the usedRoleNames set
+    return clusterRoles.map((clusterRole) => ({
+      ...clusterRole,
+      isUnused: !usedRoleNames.has(clusterRole.name) && !clusterRole.isSystem,
+    }));
+  }, [clusterRoles, clusterRoleBindings, roleBindings]);
+}
diff --git a/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRolesDatatable/columns/created.tsx b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRolesDatatable/columns/created.tsx
new file mode 100644
index 0000000..c9c4562
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRolesDatatable/columns/created.tsx
@@ -0,0 +1,12 @@
+import { formatDate } from '@/portainer/filters/filters';
+
+import { columnHelper } from './helper';
+
+export const created = columnHelper.accessor(
+  (row) => formatDate(row.creationDate),
+  {
+    header: 'Created',
+    id: 'created',
+    cell: ({ getValue }) => getValue(),
+  }
+);
diff --git a/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRolesDatatable/columns/helper.ts b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRolesDatatable/columns/helper.ts
new file mode 100644
index 0000000..4b22ca8
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRolesDatatable/columns/helper.ts
@@ -0,0 +1,5 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { ClusterRoleRowData } from '../types';
+
+export const columnHelper = createColumnHelper<ClusterRoleRowData>();
diff --git a/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRolesDatatable/columns/index.tsx b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRolesDatatable/columns/index.tsx
new file mode 100644
index 0000000..0c7a4f3
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRolesDatatable/columns/index.tsx
@@ -0,0 +1,4 @@
+import { name } from './name';
+import { created } from './created';
+
+export const columns = [name, created];
diff --git a/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRolesDatatable/columns/name.tsx b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRolesDatatable/columns/name.tsx
new file mode 100644
index 0000000..811107e
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRolesDatatable/columns/name.tsx
@@ -0,0 +1,34 @@
+import { SystemBadge } from '@@/Badge/SystemBadge';
+import { UnusedBadge } from '@@/Badge/UnusedBadge';
+import { Link } from '@@/Link';
+
+import { columnHelper } from './helper';
+
+export const name = columnHelper.accessor(
+  (row) => {
+    let result = row.name;
+    if (row.isSystem) {
+      result += ' system';
+    }
+    return result;
+  },
+  {
+    header: 'Name',
+    id: 'name',
+    cell: ({ row }) => (
+      <div className="flex gap-2">
+        <Link
+          to="kubernetes.moreResources.clusterRole"
+          params={{ name: row.original.name }}
+          data-cy={`clusterrole-name-link-${row.original.name}`}
+        >
+          {row.original.name}
+        </Link>
+        <div className="ml-auto flex gap-2">
+          {row.original.isSystem && <SystemBadge />}
+          {row.original.isUnused && <UnusedBadge />}
+        </div>
+      </div>
+    ),
+  }
+);
diff --git a/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRolesDatatable/queries/query-keys.ts b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRolesDatatable/queries/query-keys.ts
new file mode 100644
index 0000000..ddbc663
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRolesDatatable/queries/query-keys.ts
@@ -0,0 +1,6 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+export const queryKeys = {
+  list: (environmentId: EnvironmentId) =>
+    ['environments', environmentId, 'kubernetes', 'cluster_roles'] as const,
+};
diff --git a/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRolesDatatable/queries/useClusterRoles.ts b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRolesDatatable/queries/useClusterRoles.ts
new file mode 100644
index 0000000..88c30fc
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRolesDatatable/queries/useClusterRoles.ts
@@ -0,0 +1,39 @@
+import { compact } from 'lodash';
+import { useQuery } from '@tanstack/react-query';
+
+import { withError } from '@/react-tools/react-query';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { ClusterRole } from '../types';
+
+import { queryKeys } from './query-keys';
+
+export function useClusterRoles(
+  environmentId: EnvironmentId,
+  options?: { autoRefreshRate?: number }
+) {
+  return useQuery(
+    queryKeys.list(environmentId),
+    async () => {
+      const clusterRoles = await getClusterRoles(environmentId);
+      return compact(clusterRoles);
+    },
+    {
+      ...withError('Unable to get cluster roles'),
+      refetchInterval: options?.autoRefreshRate,
+    }
+  );
+}
+
+async function getClusterRoles(environmentId: EnvironmentId) {
+  try {
+    const { data: roles } = await axios.get<ClusterRole[]>(
+      `kubernetes/${environmentId}/cluster_roles`
+    );
+
+    return roles;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to get cluster roles');
+  }
+}
diff --git a/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRolesDatatable/queries/useDeleteClusterRolesMutation.ts b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRolesDatatable/queries/useDeleteClusterRolesMutation.ts
new file mode 100644
index 0000000..9ddb3e8
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRolesDatatable/queries/useDeleteClusterRolesMutation.ts
@@ -0,0 +1,33 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { withError } from '@/react-tools/react-query';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { queryKeys } from './query-keys';
+
+export function useDeleteClusterRolesMutation(environmentId: EnvironmentId) {
+  const queryClient = useQueryClient();
+  return useMutation(deleteClusterRoles, {
+    onSuccess: () =>
+      queryClient.invalidateQueries(queryKeys.list(environmentId)),
+    ...withError('Unable to delete cluster roles'),
+  });
+}
+
+export async function deleteClusterRoles({
+  environmentId,
+  data,
+}: {
+  environmentId: EnvironmentId;
+  data: string[];
+}) {
+  try {
+    return await axios.post(
+      `kubernetes/${environmentId}/cluster_roles/delete`,
+      data
+    );
+  } catch (e) {
+    throw parseAxiosError(e, `Unable to delete cluster roles`);
+  }
+}
diff --git a/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRolesDatatable/types.ts b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRolesDatatable/types.ts
new file mode 100644
index 0000000..b3de8ca
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRolesDatatable/types.ts
@@ -0,0 +1,14 @@
+export type ClusterRole = {
+  name: string;
+  creationDate: string;
+  uid: string;
+  isSystem: boolean;
+};
+
+export type ClusterRoleRowData = ClusterRole & {
+  isUnused: boolean;
+};
+
+export type DeleteRequestPayload = {
+  clusterRoles: string[];
+};
diff --git a/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRolesView.tsx b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRolesView.tsx
new file mode 100644
index 0000000..a8a5129
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ClusterRolesView/ClusterRolesView.tsx
@@ -0,0 +1,50 @@
+import { UserCheck, Link } from 'lucide-react';
+
+import { useUnauthorizedRedirect } from '@/react/hooks/useUnauthorizedRedirect';
+
+import { PageHeader } from '@@/PageHeader';
+import { Tab, WidgetTabs, useCurrentTabIndex } from '@@/Widget/WidgetTabs';
+
+import { ClusterRolesDatatable } from './ClusterRolesDatatable/ClusterRolesDatatable';
+import { ClusterRoleBindingsDatatable } from './ClusterRoleBindingsDatatable/ClusterRoleBindingsDatatable';
+
+export function ClusterRolesView() {
+  useUnauthorizedRedirect(
+    {
+      authorizations: ['K8sClusterRoleBindingsW', 'K8sClusterRolesW'],
+      adminOnlyCE: true,
+    },
+    { to: 'kubernetes.dashboard' }
+  );
+
+  const tabs: Tab[] = [
+    {
+      name: 'Cluster Roles',
+      icon: UserCheck,
+      widget: <ClusterRolesDatatable />,
+      selectedTabParam: 'clusterRoles',
+    },
+    {
+      name: 'Cluster Role Bindings',
+      icon: Link,
+      widget: <ClusterRoleBindingsDatatable />,
+      selectedTabParam: 'clusterRoleBindings',
+    },
+  ];
+
+  const currentTabIndex = useCurrentTabIndex(tabs);
+
+  return (
+    <>
+      <PageHeader
+        title="Cluster Role list"
+        breadcrumbs="Cluster Roles"
+        reload
+      />
+      <>
+        <WidgetTabs tabs={tabs} currentTabIndex={currentTabIndex} />
+        <div className="content">{tabs[currentTabIndex].widget}</div>
+      </>
+    </>
+  );
+}
diff --git a/app/react/kubernetes/more-resources/ClusterRolesView/index.tsx b/app/react/kubernetes/more-resources/ClusterRolesView/index.tsx
new file mode 100644
index 0000000..ce13ef9
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ClusterRolesView/index.tsx
@@ -0,0 +1 @@
+export { ClusterRolesView } from './ClusterRolesView';
diff --git a/app/react/kubernetes/more-resources/ClusterRolesView/utils.ts b/app/react/kubernetes/more-resources/ClusterRolesView/utils.ts
new file mode 100644
index 0000000..b094cf5
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ClusterRolesView/utils.ts
@@ -0,0 +1,52 @@
+import { Row } from '@tanstack/react-table';
+
+import { RoleBinding } from '../RolesView/RoleBindingsDatatable/types';
+
+import { ClusterRoleBinding } from './ClusterRoleBindingsDatatable/types';
+
+/**
+ * Transforms the rows of a table to get a unique list of namespaces to use as filter options.
+ * One row can have multiple subject namespaces.
+ * @param rows - The rows of the table.
+ * @param id - The ID of the column containing the subject namespaces.
+ * @returns An array of unique subject namespace options.
+ */
+export function filterNamespaceOptionsTransformer<
+  TData extends ClusterRoleBinding | RoleBinding,
+>(rows: Row<TData>[], id: string) {
+  const options = new Set<string>();
+  rows.forEach(({ getValue }) => {
+    const value = getValue<string[]>(id);
+    if (!value) {
+      return;
+    }
+    value.forEach((v) => {
+      if (v && v !== '-') {
+        options.add(v);
+      }
+    });
+  });
+  return Array.from(options);
+}
+
+/**
+ * Filters the rows of a table based on the selected namespaces.
+ * @param row - The row to filter.
+ * @param _columnId - The ID of the column being filtered.
+ * @param filterValue - The selected namespaces to filter by.
+ * @returns True if the row should be shown, false otherwise.
+ */
+export function filterFn(
+  row: Row<ClusterRoleBinding | RoleBinding>,
+  _columnId: string,
+  filterValue: string[]
+) {
+  // when no filter is set, show all rows
+  if (filterValue.length === 0) {
+    return true;
+  }
+  const subjectNamespaces = row.original.subjects?.flatMap(
+    (sub) => sub.namespace ?? []
+  );
+  return filterValue.some((v) => subjectNamespaces?.includes(v));
+}
diff --git a/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/CronJobsDatatable.tsx b/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/CronJobsDatatable.tsx
new file mode 100644
index 0000000..9fbcb5f
--- /dev/null
+++ b/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/CronJobsDatatable.tsx
@@ -0,0 +1,192 @@
+import { useMemo } from 'react';
+import { Trash2, CalendarSync } from 'lucide-react';
+import { useRouter } from '@uirouter/react';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { Authorized, useAuthorizations } from '@/react/hooks/useUser';
+import { notifyError, notifySuccess } from '@/portainer/services/notifications';
+import { SystemResourceDescription } from '@/react/kubernetes/datatables/SystemResourceDescription';
+import {
+  DefaultDatatableSettings,
+  TableSettings as KubeTableSettings,
+} from '@/react/kubernetes/datatables/DefaultDatatableSettings';
+import { useKubeStore } from '@/react/kubernetes/datatables/default-kube-datatable-store';
+import { CreateFromManifestButton } from '@/react/kubernetes/components/CreateFromManifestButton';
+
+import { confirmDelete } from '@@/modals/confirm';
+import { TableSettingsMenu } from '@@/datatables';
+import { CardExpandableList } from '@@/datatables/CardExpandableList';
+import { LoadingButton } from '@@/buttons';
+import {
+  type FilteredColumnsTableSettings,
+  filteredColumnsSettings,
+} from '@@/datatables/types';
+import { mergeOptions } from '@@/datatables/extend-options/mergeOptions';
+import { withColumnFilters } from '@@/datatables/extend-options/withColumnFilters';
+
+import { Job } from '../JobsDatatable/types';
+
+import { useCronJobs } from './queries/useCronJobs';
+import { columns } from './columns';
+import { CronJob } from './types';
+import { useDeleteCronJobsMutation } from './queries/useDeleteCronJobsMutation';
+import { CronJobsExecutionsInnerDatatable } from './CronJobsExecutionsInnerDatatable';
+
+const storageKey = 'cronJobs';
+
+interface TableSettings
+  extends KubeTableSettings, FilteredColumnsTableSettings {}
+
+interface CronJobsExecutionsProps {
+  item: Job[];
+}
+
+export function CronJobsDatatable() {
+  const environmentId = useEnvironmentId();
+  const tableState = useKubeStore<TableSettings>(
+    storageKey,
+    undefined,
+    (set) => ({
+      ...filteredColumnsSettings(set),
+    })
+  );
+
+  const cronJobsQuery = useCronJobs(environmentId, {
+    refetchInterval: tableState.autoRefreshRate * 1000,
+  });
+  const cronJobsRowData = cronJobsQuery.data;
+
+  const { authorized: canAccessSystemResources } = useAuthorizations(
+    'K8sAccessSystemNamespaces'
+  );
+  const filteredCronJobs = useMemo(
+    () =>
+      tableState.showSystemResources
+        ? cronJobsRowData
+        : cronJobsRowData?.filter(
+            (cronJob) =>
+              (canAccessSystemResources && tableState.showSystemResources) ||
+              !cronJob.IsSystem
+          ),
+    [cronJobsRowData, tableState.showSystemResources, canAccessSystemResources]
+  );
+
+  return (
+    <CardExpandableList
+      dataset={filteredCronJobs || []}
+      columns={columns}
+      settingsManager={tableState}
+      isLoading={cronJobsQuery.isLoading}
+      title="Cron Jobs"
+      titleIcon={CalendarSync}
+      getRowId={(row) => row.Id}
+      isRowSelectable={(row) => !row.original.IsSystem}
+      renderTableActions={(selectedRows) => (
+        <TableActions selectedItems={selectedRows} />
+      )}
+      renderTableSettings={() => (
+        <TableSettingsMenu>
+          <DefaultDatatableSettings settings={tableState} />
+        </TableSettingsMenu>
+      )}
+      description={
+        <SystemResourceDescription
+          showSystemResources={tableState.showSystemResources}
+        />
+      }
+      data-cy="k8s-cronJobs-datatable"
+      extendTableOptions={mergeOptions(
+        withColumnFilters(tableState.columnFilters, tableState.setColumnFilters)
+      )}
+      getRowCanExpand={(row) => (row.original.Jobs ?? []).length > 0}
+      renderSubRow={(row) => <SubRow item={row.original.Jobs ?? []} />}
+    />
+  );
+}
+
+function SubRow({ item }: CronJobsExecutionsProps) {
+  return <CronJobsExecutionsInnerDatatable item={item} />;
+}
+
+interface SelectedCronJob {
+  Namespace: string;
+  Name: string;
+}
+
+type TableActionsProps = {
+  selectedItems: CronJob[];
+};
+
+function TableActions({ selectedItems }: TableActionsProps) {
+  const environmentId = useEnvironmentId();
+  const deleteCronJobsMutation = useDeleteCronJobsMutation(environmentId);
+  const router = useRouter();
+
+  return (
+    <Authorized authorizations="K8sCronJobsW">
+      <LoadingButton
+        className="btn-wrapper"
+        color="dangerlight"
+        disabled={selectedItems.length === 0}
+        onClick={() => handleRemoveClick(selectedItems)}
+        icon={Trash2}
+        isLoading={deleteCronJobsMutation.isLoading}
+        loadingText="Removing Cron Jobs..."
+        data-cy="k8s-cronJobs-removeCronJobButton"
+      >
+        Remove
+      </LoadingButton>
+
+      <CreateFromManifestButton
+        params={{ tab: 'cronJobs' }}
+        data-cy="k8s-cronJobs-deploy-button"
+      />
+    </Authorized>
+  );
+
+  async function handleRemoveClick(cronJobs: SelectedCronJob[]) {
+    const confirmed = await confirmDelete(
+      <>
+        <p>Are you sure you want to delete the selected Cron Jobs?</p>
+        <ul className="mt-2 max-h-96 list-inside overflow-hidden overflow-y-auto text-sm">
+          {cronJobs.map((s, index) => (
+            <li key={index}>
+              {s.Namespace}/{s.Name}
+            </li>
+          ))}
+        </ul>
+      </>
+    );
+    if (!confirmed) {
+      return null;
+    }
+
+    const payload: Record<string, string[]> = {};
+    cronJobs.forEach((r) => {
+      payload[r.Namespace] = payload[r.Namespace] || [];
+      payload[r.Namespace].push(r.Name);
+    });
+
+    deleteCronJobsMutation.mutate(
+      { environmentId, data: payload },
+      {
+        onSuccess: () => {
+          notifySuccess(
+            'Cron Jobs successfully removed',
+            cronJobs.map((r) => `${r.Namespace}/${r.Name}`).join(', ')
+          );
+          router.stateService.reload();
+        },
+        onError: (error) => {
+          notifyError(
+            'Unable to delete Cron Jobs',
+            error as Error,
+            cronJobs.map((r) => `${r.Namespace}/${r.Name}`).join(', ')
+          );
+        },
+      }
+    );
+
+    return cronJobs;
+  }
+}
diff --git a/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/CronJobsExecutionsInnerDatatable.tsx b/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/CronJobsExecutionsInnerDatatable.tsx
new file mode 100644
index 0000000..ae36bce
--- /dev/null
+++ b/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/CronJobsExecutionsInnerDatatable.tsx
@@ -0,0 +1,25 @@
+import { CalendarCheck2 } from 'lucide-react';
+
+import { BasicTable } from '@@/datatables/BasicTable';
+
+import { columns } from '../JobsDatatable/columns';
+import { Job } from '../JobsDatatable/types';
+
+interface CronJobsExecutionsProps {
+  item: Job[];
+}
+
+export function CronJobsExecutionsInnerDatatable({
+  item,
+}: CronJobsExecutionsProps) {
+  return (
+    <BasicTable
+      dataset={item}
+      columns={columns}
+      getRowId={(row) => row.Id}
+      data-cy="k8s-cronJobs-executions-datatable"
+      title="Executions"
+      titleIcon={CalendarCheck2}
+    />
+  );
+}
diff --git a/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/columns/command.tsx b/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/columns/command.tsx
new file mode 100644
index 0000000..2d1977a
--- /dev/null
+++ b/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/columns/command.tsx
@@ -0,0 +1,7 @@
+import { columnHelper } from './helper';
+
+export const command = columnHelper.accessor((row) => row.Command, {
+  header: 'Command',
+  id: 'command',
+  cell: ({ getValue }) => getValue() ?? '',
+});
diff --git a/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/columns/expand.tsx b/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/columns/expand.tsx
new file mode 100644
index 0000000..1911be6
--- /dev/null
+++ b/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/columns/expand.tsx
@@ -0,0 +1,10 @@
+import { buildExpandColumn } from '@@/datatables/expand-column';
+
+import { CronJob } from '../types';
+
+import { columnHelper } from './helper';
+
+export const expand = columnHelper.display({
+  ...buildExpandColumn<CronJob>(),
+  id: 'expand',
+});
diff --git a/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/columns/helper.ts b/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/columns/helper.ts
new file mode 100644
index 0000000..5d4021a
--- /dev/null
+++ b/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/columns/helper.ts
@@ -0,0 +1,5 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { CronJob } from '../types';
+
+export const columnHelper = createColumnHelper<CronJob>();
diff --git a/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/columns/index.tsx b/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/columns/index.tsx
new file mode 100644
index 0000000..8e5d55f
--- /dev/null
+++ b/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/columns/index.tsx
@@ -0,0 +1,17 @@
+import { expand } from './expand';
+import { name } from './name';
+import { namespace } from './namespace';
+import { schedule } from './schedule';
+import { suspend } from './suspend';
+import { timezone } from './timezone';
+import { command } from './command';
+
+export const columns = [
+  expand,
+  name,
+  namespace,
+  command,
+  schedule,
+  suspend,
+  timezone,
+];
diff --git a/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/columns/name.tsx b/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/columns/name.tsx
new file mode 100644
index 0000000..770e335
--- /dev/null
+++ b/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/columns/name.tsx
@@ -0,0 +1,33 @@
+import { SystemBadge } from '@@/Badge/SystemBadge';
+import { Link } from '@@/Link';
+
+import { columnHelper } from './helper';
+
+export const name = columnHelper.accessor(
+  (row) => {
+    let result = row.Name;
+    if (row.IsSystem) {
+      result += ' system';
+    }
+    return result;
+  },
+  {
+    header: 'Name',
+    id: 'name',
+    cell: ({ row }) => (
+      <div className="flex gap-2">
+        <Link
+          to="kubernetes.moreResources.cronJob"
+          params={{
+            namespace: row.original.Namespace,
+            name: row.original.Name,
+          }}
+          data-cy={`cronjob-name-link-${row.original.Namespace}-${row.original.Name}`}
+        >
+          {row.original.Name}
+        </Link>
+        {row.original.IsSystem && <SystemBadge className="ml-auto" />}
+      </div>
+    ),
+  }
+);
diff --git a/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/columns/namespace.tsx b/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/columns/namespace.tsx
new file mode 100644
index 0000000..26eb33b
--- /dev/null
+++ b/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/columns/namespace.tsx
@@ -0,0 +1,32 @@
+import { Row } from '@tanstack/react-table';
+
+import { filterHOC } from '@@/datatables/Filter';
+import { Link } from '@@/Link';
+
+import { CronJob } from '../types';
+
+import { columnHelper } from './helper';
+
+export const namespace = columnHelper.accessor((row) => row.Namespace, {
+  header: 'Namespace',
+  id: 'namespace',
+  cell: ({ getValue, row }) => (
+    <Link
+      to="kubernetes.resourcePools.resourcePool"
+      params={{
+        id: getValue(),
+      }}
+      title={getValue()}
+      data-cy={`cronJob-namespace-link-${row.original.Name}`}
+    >
+      {getValue()}
+    </Link>
+  ),
+  meta: {
+    filter: filterHOC('Filter by namespace'),
+  },
+  enableColumnFilter: true,
+  filterFn: (row: Row<CronJob>, _columnId: string, filterValue: string[]) =>
+    filterValue.length === 0 ||
+    filterValue.includes(row.original.Namespace ?? ''),
+});
diff --git a/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/columns/schedule.tsx b/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/columns/schedule.tsx
new file mode 100644
index 0000000..f979240
--- /dev/null
+++ b/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/columns/schedule.tsx
@@ -0,0 +1,7 @@
+import { columnHelper } from './helper';
+
+export const schedule = columnHelper.accessor((row) => row.Schedule, {
+  header: 'Schedule',
+  id: 'schedule',
+  cell: ({ getValue }) => getValue() ?? '',
+});
diff --git a/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/columns/suspend.tsx b/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/columns/suspend.tsx
new file mode 100644
index 0000000..8ae455b
--- /dev/null
+++ b/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/columns/suspend.tsx
@@ -0,0 +1,10 @@
+import { columnHelper } from './helper';
+
+export const suspend = columnHelper.accessor((row) => row.Suspend, {
+  header: 'Suspend',
+  id: 'suspend',
+  cell: ({ getValue }) => {
+    const suspended = getValue();
+    return suspended ? 'Yes' : 'No';
+  },
+});
diff --git a/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/columns/timezone.tsx b/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/columns/timezone.tsx
new file mode 100644
index 0000000..3b262b9
--- /dev/null
+++ b/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/columns/timezone.tsx
@@ -0,0 +1,7 @@
+import { columnHelper } from './helper';
+
+export const timezone = columnHelper.accessor((row) => row.Timezone, {
+  header: 'Timezone',
+  id: 'timezone',
+  cell: ({ getValue }) => getValue() ?? '',
+});
diff --git a/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/index.tsx b/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/index.tsx
new file mode 100644
index 0000000..9410750
--- /dev/null
+++ b/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/index.tsx
@@ -0,0 +1 @@
+export { CronJobsDatatable } from './CronJobsDatatable';
diff --git a/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/queries/query-keys.ts b/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/queries/query-keys.ts
new file mode 100644
index 0000000..2695ab1
--- /dev/null
+++ b/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/queries/query-keys.ts
@@ -0,0 +1,6 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+export const queryKeys = {
+  list: (environmentId: EnvironmentId) =>
+    ['environments', environmentId, 'kubernetes', 'cronJobs'] as const,
+};
diff --git a/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/queries/useCronJobs.ts b/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/queries/useCronJobs.ts
new file mode 100644
index 0000000..a71d489
--- /dev/null
+++ b/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/queries/useCronJobs.ts
@@ -0,0 +1,38 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { withError } from '@/react-tools/react-query';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { CronJob } from '../types';
+
+import { queryKeys } from './query-keys';
+
+export function useCronJobs(
+  environmentId: EnvironmentId,
+  options?: { refetchInterval?: number; enabled?: boolean }
+) {
+  return useQuery(
+    queryKeys.list(environmentId),
+    async () => getAllCronJobs(environmentId),
+    {
+      ...withError('Unable to get cron jobs'),
+      refetchInterval() {
+        return options?.refetchInterval ?? false;
+      },
+      enabled: options?.enabled,
+    }
+  );
+}
+
+async function getAllCronJobs(environmentId: EnvironmentId) {
+  try {
+    const { data: cronJobs } = await axios.get<CronJob[]>(
+      `kubernetes/${environmentId}/cron_jobs`
+    );
+
+    return cronJobs;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to get cron jobs');
+  }
+}
diff --git a/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/queries/useDeleteCronJobsMutation.ts b/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/queries/useDeleteCronJobsMutation.ts
new file mode 100644
index 0000000..6e10f92
--- /dev/null
+++ b/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/queries/useDeleteCronJobsMutation.ts
@@ -0,0 +1,34 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { withError, withInvalidate } from '@/react-tools/react-query';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { queryKeys } from './query-keys';
+
+export function useDeleteCronJobsMutation(environmentId: EnvironmentId) {
+  const queryClient = useQueryClient();
+  return useMutation(deleteCronJob, {
+    ...withInvalidate(queryClient, [queryKeys.list(environmentId)]),
+    ...withError('Unable to delete Cron Jobs'),
+  });
+}
+
+type NamespaceCronJobsMap = Record<string, string[]>;
+
+export async function deleteCronJob({
+  environmentId,
+  data,
+}: {
+  environmentId: EnvironmentId;
+  data: NamespaceCronJobsMap;
+}) {
+  try {
+    return await axios.post(
+      `kubernetes/${environmentId}/cron_jobs/delete`,
+      data
+    );
+  } catch (e) {
+    throw parseAxiosError(e, `Unable to delete Cron Jobs`);
+  }
+}
diff --git a/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/types.ts b/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/types.ts
new file mode 100644
index 0000000..72765b6
--- /dev/null
+++ b/app/react/kubernetes/more-resources/JobsView/CronJobsDatatable/types.ts
@@ -0,0 +1,13 @@
+import { Job } from '../JobsDatatable/types';
+
+export type CronJob = {
+  Id: string;
+  Name: string;
+  Namespace: string;
+  Command: string;
+  Schedule: string;
+  Timezone: string;
+  Suspend: boolean;
+  IsSystem?: boolean;
+  Jobs?: Job[];
+};
diff --git a/app/react/kubernetes/more-resources/JobsView/JobsDatatable/JobsDatatable.tsx b/app/react/kubernetes/more-resources/JobsView/JobsDatatable/JobsDatatable.tsx
new file mode 100644
index 0000000..2bd0644
--- /dev/null
+++ b/app/react/kubernetes/more-resources/JobsView/JobsDatatable/JobsDatatable.tsx
@@ -0,0 +1,180 @@
+import { useMemo } from 'react';
+import { Trash2, CalendarCheck2 } from 'lucide-react';
+import { useRouter } from '@uirouter/react';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { Authorized, useAuthorizations } from '@/react/hooks/useUser';
+import { notifyError, notifySuccess } from '@/portainer/services/notifications';
+import { SystemResourceDescription } from '@/react/kubernetes/datatables/SystemResourceDescription';
+import {
+  DefaultDatatableSettings,
+  TableSettings as KubeTableSettings,
+} from '@/react/kubernetes/datatables/DefaultDatatableSettings';
+import { useKubeStore } from '@/react/kubernetes/datatables/default-kube-datatable-store';
+import { CreateFromManifestButton } from '@/react/kubernetes/components/CreateFromManifestButton';
+
+import { confirmDelete } from '@@/modals/confirm';
+import { Datatable, TableSettingsMenu } from '@@/datatables';
+import { LoadingButton } from '@@/buttons';
+import {
+  type FilteredColumnsTableSettings,
+  filteredColumnsSettings,
+} from '@@/datatables/types';
+import { mergeOptions } from '@@/datatables/extend-options/mergeOptions';
+import { withColumnFilters } from '@@/datatables/extend-options/withColumnFilters';
+
+import { useJobs } from './queries/useJobs';
+import { columns } from './columns';
+import { Job } from './types';
+import { useDeleteJobsMutation } from './queries/useDeleteJobsMutation';
+
+const storageKey = 'jobs';
+
+interface TableSettings
+  extends KubeTableSettings, FilteredColumnsTableSettings {}
+
+export function JobsDatatable() {
+  const environmentId = useEnvironmentId();
+  const tableState = useKubeStore<TableSettings>(
+    storageKey,
+    undefined,
+    (set) => ({
+      ...filteredColumnsSettings(set),
+    })
+  );
+
+  const jobsQuery = useJobs(environmentId, {
+    refetchInterval: tableState.autoRefreshRate * 1000,
+  });
+  const jobsRowData = jobsQuery.data;
+
+  const { authorized: canAccessSystemResources } = useAuthorizations(
+    'K8sAccessSystemNamespaces'
+  );
+  const filteredJobs = useMemo(
+    () =>
+      tableState.showSystemResources
+        ? jobsRowData
+        : jobsRowData?.filter(
+            (job) =>
+              // show everything if we can access system resources and the table is set to show them
+              (canAccessSystemResources && tableState.showSystemResources) ||
+              // otherwise, only show non-system resources
+              !job.IsSystem
+          ),
+    [jobsRowData, tableState.showSystemResources, canAccessSystemResources]
+  );
+
+  return (
+    <Datatable
+      dataset={filteredJobs || []}
+      columns={columns}
+      settingsManager={tableState}
+      isLoading={jobsQuery.isLoading}
+      title="Jobs"
+      titleIcon={CalendarCheck2}
+      getRowId={(row) => row.Id}
+      isRowSelectable={(row) => !row.original.IsSystem}
+      renderTableActions={(selectedRows) => (
+        <TableActions selectedItems={selectedRows} />
+      )}
+      renderTableSettings={() => (
+        <TableSettingsMenu>
+          <DefaultDatatableSettings settings={tableState} />
+        </TableSettingsMenu>
+      )}
+      description={
+        <SystemResourceDescription
+          showSystemResources={tableState.showSystemResources}
+        />
+      }
+      data-cy="k8s-jobs-datatable"
+      extendTableOptions={mergeOptions(
+        withColumnFilters(tableState.columnFilters, tableState.setColumnFilters)
+      )}
+    />
+  );
+}
+
+interface SelectedJob {
+  Namespace: string;
+  Name: string;
+}
+
+type TableActionsProps = {
+  selectedItems: Job[];
+};
+
+function TableActions({ selectedItems }: TableActionsProps) {
+  const environmentId = useEnvironmentId();
+  const deleteJobsMutation = useDeleteJobsMutation(environmentId);
+  const router = useRouter();
+
+  return (
+    <Authorized authorizations="K8sCronJobsW">
+      <LoadingButton
+        className="btn-wrapper"
+        color="dangerlight"
+        disabled={selectedItems.length === 0}
+        onClick={() => handleRemoveClick(selectedItems)}
+        icon={Trash2}
+        isLoading={deleteJobsMutation.isLoading}
+        loadingText="Removing jobs..."
+        data-cy="k8s-jobs-removeJobButton"
+      >
+        Remove
+      </LoadingButton>
+
+      <CreateFromManifestButton
+        params={{ tab: 'jobs' }}
+        data-cy="k8s-jobs-deploy-button"
+      />
+    </Authorized>
+  );
+
+  async function handleRemoveClick(jobs: SelectedJob[]) {
+    const confirmed = await confirmDelete(
+      <>
+        <p>Are you sure you want to delete the selected job(s)?</p>
+        <ul className="mt-2 max-h-96 list-inside overflow-hidden overflow-y-auto text-sm">
+          {jobs.map((s, index) => (
+            <li key={index}>
+              {s.Namespace}/{s.Name}
+            </li>
+          ))}
+        </ul>
+      </>
+    );
+    if (!confirmed) {
+      return null;
+    }
+
+    const payload: Record<string, string[]> = {};
+    jobs.forEach((r) => {
+      payload[r.Namespace] = payload[r.Namespace] || [];
+      payload[r.Namespace].push(r.Name);
+    });
+
+    deleteJobsMutation.mutate(
+      { environmentId, data: payload },
+      {
+        onSuccess: () => {
+          notifySuccess(
+            'Jobs successfully removed',
+            jobs.map((r) => `${r.Namespace}/${r.Name}`).join(', ')
+          );
+          router.stateService.reload();
+        },
+        onError: (error) => {
+          notifyError(
+            'Unable to delete jobs',
+            error as Error,
+            jobs.map((r) => `${r.Namespace}/${r.Name}`).join(', ')
+          );
+        },
+      }
+    );
+
+    return jobs;
+  }
+}
diff --git a/app/react/kubernetes/more-resources/JobsView/JobsDatatable/columns/actions.tsx b/app/react/kubernetes/more-resources/JobsView/JobsDatatable/columns/actions.tsx
new file mode 100644
index 0000000..829f88e
--- /dev/null
+++ b/app/react/kubernetes/more-resources/JobsView/JobsDatatable/columns/actions.tsx
@@ -0,0 +1,46 @@
+import { FileText } from 'lucide-react';
+
+import { Link } from '@@/Link';
+import { Icon } from '@@/Icon';
+
+import { columnHelper } from './helper';
+
+export const actions = columnHelper.accessor(() => '', {
+  header: 'Actions',
+  id: 'actions',
+  enableSorting: false,
+  cell: ({ row: { original: job } }) => (
+    <Cell
+      name={job.Name}
+      namespace={job.Namespace}
+      podName={job.PodName}
+      containerName={job.Container?.name}
+    />
+  ),
+});
+
+type CellProps = {
+  name: string;
+  namespace: string;
+  podName: string;
+  containerName?: string;
+};
+
+function Cell({ name, namespace, podName, containerName }: CellProps) {
+  return (
+    <Link
+      className="flex items-center gap-1"
+      to="kubernetes.applications.application.logs"
+      params={{
+        name: podName,
+        namespace,
+        pod: podName,
+        container: containerName,
+      }}
+      data-cy={`job-logs-${namespace}-${name}-${containerName}`}
+    >
+      <Icon icon={FileText} />
+      Logs
+    </Link>
+  );
+}
diff --git a/app/react/kubernetes/more-resources/JobsView/JobsDatatable/columns/command.tsx b/app/react/kubernetes/more-resources/JobsView/JobsDatatable/columns/command.tsx
new file mode 100644
index 0000000..2d1977a
--- /dev/null
+++ b/app/react/kubernetes/more-resources/JobsView/JobsDatatable/columns/command.tsx
@@ -0,0 +1,7 @@
+import { columnHelper } from './helper';
+
+export const command = columnHelper.accessor((row) => row.Command, {
+  header: 'Command',
+  id: 'command',
+  cell: ({ getValue }) => getValue() ?? '',
+});
diff --git a/app/react/kubernetes/more-resources/JobsView/JobsDatatable/columns/duration.tsx b/app/react/kubernetes/more-resources/JobsView/JobsDatatable/columns/duration.tsx
new file mode 100644
index 0000000..b189d5a
--- /dev/null
+++ b/app/react/kubernetes/more-resources/JobsView/JobsDatatable/columns/duration.tsx
@@ -0,0 +1,7 @@
+import { columnHelper } from './helper';
+
+export const duration = columnHelper.accessor((row) => row.Duration, {
+  header: 'Duration',
+  id: 'duration',
+  cell: ({ getValue }) => getValue() ?? '',
+});
diff --git a/app/react/kubernetes/more-resources/JobsView/JobsDatatable/columns/finished.tsx b/app/react/kubernetes/more-resources/JobsView/JobsDatatable/columns/finished.tsx
new file mode 100644
index 0000000..cf8e5b5
--- /dev/null
+++ b/app/react/kubernetes/more-resources/JobsView/JobsDatatable/columns/finished.tsx
@@ -0,0 +1,7 @@
+import { columnHelper } from './helper';
+
+export const finished = columnHelper.accessor((row) => row.FinishTime, {
+  header: 'Finished',
+  id: 'finished',
+  cell: ({ getValue }) => getValue() ?? '',
+});
diff --git a/app/react/kubernetes/more-resources/JobsView/JobsDatatable/columns/helper.ts b/app/react/kubernetes/more-resources/JobsView/JobsDatatable/columns/helper.ts
new file mode 100644
index 0000000..c89105a
--- /dev/null
+++ b/app/react/kubernetes/more-resources/JobsView/JobsDatatable/columns/helper.ts
@@ -0,0 +1,5 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { Job } from '../types';
+
+export const columnHelper = createColumnHelper<Job>();
diff --git a/app/react/kubernetes/more-resources/JobsView/JobsDatatable/columns/index.tsx b/app/react/kubernetes/more-resources/JobsView/JobsDatatable/columns/index.tsx
new file mode 100644
index 0000000..9b0167e
--- /dev/null
+++ b/app/react/kubernetes/more-resources/JobsView/JobsDatatable/columns/index.tsx
@@ -0,0 +1,19 @@
+import { name } from './name';
+import { namespace } from './namespace';
+import { started } from './started';
+import { finished } from './finished';
+import { duration } from './duration';
+import { status } from './status';
+import { actions } from './actions';
+import { command } from './command';
+
+export const columns = [
+  name,
+  namespace,
+  command,
+  status,
+  started,
+  finished,
+  duration,
+  actions,
+];
diff --git a/app/react/kubernetes/more-resources/JobsView/JobsDatatable/columns/name.tsx b/app/react/kubernetes/more-resources/JobsView/JobsDatatable/columns/name.tsx
new file mode 100644
index 0000000..2a9c3f7
--- /dev/null
+++ b/app/react/kubernetes/more-resources/JobsView/JobsDatatable/columns/name.tsx
@@ -0,0 +1,33 @@
+import { SystemBadge } from '@@/Badge/SystemBadge';
+import { Link } from '@@/Link';
+
+import { columnHelper } from './helper';
+
+export const name = columnHelper.accessor(
+  (row) => {
+    let result = row.Name;
+    if (row.IsSystem) {
+      result += ' system';
+    }
+    return result;
+  },
+  {
+    header: 'Name',
+    id: 'name',
+    cell: ({ row }) => (
+      <div className="flex gap-2">
+        <Link
+          to="kubernetes.moreResources.job"
+          params={{
+            namespace: row.original.Namespace,
+            name: row.original.Name,
+          }}
+          data-cy={`job-name-link-${row.original.Namespace}-${row.original.Name}`}
+        >
+          {row.original.Name}
+        </Link>
+        {row.original.IsSystem && <SystemBadge className="ml-auto" />}
+      </div>
+    ),
+  }
+);
diff --git a/app/react/kubernetes/more-resources/JobsView/JobsDatatable/columns/namespace.tsx b/app/react/kubernetes/more-resources/JobsView/JobsDatatable/columns/namespace.tsx
new file mode 100644
index 0000000..2ef3f4f
--- /dev/null
+++ b/app/react/kubernetes/more-resources/JobsView/JobsDatatable/columns/namespace.tsx
@@ -0,0 +1,32 @@
+import { Row } from '@tanstack/react-table';
+
+import { filterHOC } from '@@/datatables/Filter';
+import { Link } from '@@/Link';
+
+import { Job } from '../types';
+
+import { columnHelper } from './helper';
+
+export const namespace = columnHelper.accessor((row) => row.Namespace, {
+  header: 'Namespace',
+  id: 'namespace',
+  cell: ({ getValue, row }) => (
+    <Link
+      to="kubernetes.resourcePools.resourcePool"
+      params={{
+        id: getValue(),
+      }}
+      title={getValue()}
+      data-cy={`cronJob-namespace-link-${row.original.Name}`}
+    >
+      {getValue()}
+    </Link>
+  ),
+  meta: {
+    filter: filterHOC('Filter by namespace'),
+  },
+  enableColumnFilter: true,
+  filterFn: (row: Row<Job>, _columnId: string, filterValue: string[]) =>
+    filterValue.length === 0 ||
+    filterValue.includes(row.original.Namespace ?? ''),
+});
diff --git a/app/react/kubernetes/more-resources/JobsView/JobsDatatable/columns/started.tsx b/app/react/kubernetes/more-resources/JobsView/JobsDatatable/columns/started.tsx
new file mode 100644
index 0000000..8ea383c
--- /dev/null
+++ b/app/react/kubernetes/more-resources/JobsView/JobsDatatable/columns/started.tsx
@@ -0,0 +1,12 @@
+import { formatDate } from '@/portainer/filters/filters';
+
+import { columnHelper } from './helper';
+
+export const started = columnHelper.accessor(
+  (row) => formatDate(row.StartTime),
+  {
+    header: 'Started',
+    id: 'started',
+    cell: ({ getValue }) => getValue() ?? '',
+  }
+);
diff --git a/app/react/kubernetes/more-resources/JobsView/JobsDatatable/columns/status.module.css b/app/react/kubernetes/more-resources/JobsView/JobsDatatable/columns/status.module.css
new file mode 100644
index 0000000..7dcd859
--- /dev/null
+++ b/app/react/kubernetes/more-resources/JobsView/JobsDatatable/columns/status.module.css
@@ -0,0 +1,13 @@
+.status-indicator {
+  padding: 0 !important;
+  margin-right: 1ch;
+  border-radius: 50%;
+  background-color: var(--red-3);
+  height: 10px;
+  width: 10px;
+  display: inline-block;
+}
+
+.status-indicator.ok {
+  background-color: var(--green-3);
+}
diff --git a/app/react/kubernetes/more-resources/JobsView/JobsDatatable/columns/status.tsx b/app/react/kubernetes/more-resources/JobsView/JobsDatatable/columns/status.tsx
new file mode 100644
index 0000000..93ecb66
--- /dev/null
+++ b/app/react/kubernetes/more-resources/JobsView/JobsDatatable/columns/status.tsx
@@ -0,0 +1,48 @@
+import { CellContext } from '@tanstack/react-table';
+import { HelpCircle } from 'lucide-react';
+import clsx from 'clsx';
+
+import { TooltipWithChildren } from '@@/Tip/TooltipWithChildren';
+
+import { Job } from '../types';
+
+import { columnHelper } from './helper';
+import styles from './status.module.css';
+
+export const status = columnHelper.accessor((row) => row.Status, {
+  header: 'Status',
+  id: 'status',
+  cell: Cell,
+});
+
+function Cell({ row: { original: item } }: CellContext<Job, string>) {
+  return (
+    <>
+      <span
+        className={clsx([
+          styles.statusIndicator,
+          {
+            [styles.ok]: item.Status !== 'Failed',
+          },
+        ])}
+      />
+      {item.Status ?? ''}
+      {item.Status === 'Failed' && (
+        <span className="ml-1">
+          <TooltipWithChildren
+            message={
+              <div>
+                <span>{item.FailedReason}</span>
+              </div>
+            }
+            position="bottom"
+          >
+            <span className="vertical-center text-muted inline-flex whitespace-nowrap text-base">
+              <HelpCircle className="lucide" aria-hidden="true" />
+            </span>
+          </TooltipWithChildren>
+        </span>
+      )}
+    </>
+  );
+}
diff --git a/app/react/kubernetes/more-resources/JobsView/JobsDatatable/index.tsx b/app/react/kubernetes/more-resources/JobsView/JobsDatatable/index.tsx
new file mode 100644
index 0000000..fde9e77
--- /dev/null
+++ b/app/react/kubernetes/more-resources/JobsView/JobsDatatable/index.tsx
@@ -0,0 +1 @@
+export { JobsDatatable } from './JobsDatatable';
diff --git a/app/react/kubernetes/more-resources/JobsView/JobsDatatable/queries/query-keys.ts b/app/react/kubernetes/more-resources/JobsView/JobsDatatable/queries/query-keys.ts
new file mode 100644
index 0000000..dd114ce
--- /dev/null
+++ b/app/react/kubernetes/more-resources/JobsView/JobsDatatable/queries/query-keys.ts
@@ -0,0 +1,6 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+export const queryKeys = {
+  list: (environmentId: EnvironmentId) =>
+    ['environments', environmentId, 'kubernetes', 'jobs'] as const,
+};
diff --git a/app/react/kubernetes/more-resources/JobsView/JobsDatatable/queries/useDeleteJobsMutation.ts b/app/react/kubernetes/more-resources/JobsView/JobsDatatable/queries/useDeleteJobsMutation.ts
new file mode 100644
index 0000000..a8df351
--- /dev/null
+++ b/app/react/kubernetes/more-resources/JobsView/JobsDatatable/queries/useDeleteJobsMutation.ts
@@ -0,0 +1,31 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { withError, withInvalidate } from '@/react-tools/react-query';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { queryKeys } from './query-keys';
+
+export function useDeleteJobsMutation(environmentId: EnvironmentId) {
+  const queryClient = useQueryClient();
+  return useMutation(deleteJob, {
+    ...withInvalidate(queryClient, [queryKeys.list(environmentId)]),
+    ...withError('Unable to delete Jobs'),
+  });
+}
+
+type NamespaceJobsMap = Record<string, string[]>;
+
+export async function deleteJob({
+  environmentId,
+  data,
+}: {
+  environmentId: EnvironmentId;
+  data: NamespaceJobsMap;
+}) {
+  try {
+    return await axios.post(`kubernetes/${environmentId}/jobs/delete`, data);
+  } catch (e) {
+    throw parseAxiosError(e, `Unable to delete Jobs`);
+  }
+}
diff --git a/app/react/kubernetes/more-resources/JobsView/JobsDatatable/queries/useJobs.ts b/app/react/kubernetes/more-resources/JobsView/JobsDatatable/queries/useJobs.ts
new file mode 100644
index 0000000..04d6912
--- /dev/null
+++ b/app/react/kubernetes/more-resources/JobsView/JobsDatatable/queries/useJobs.ts
@@ -0,0 +1,38 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { withError } from '@/react-tools/react-query';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { Job } from '../types';
+
+import { queryKeys } from './query-keys';
+
+export function useJobs(
+  environmentId: EnvironmentId,
+  options?: { refetchInterval?: number; enabled?: boolean }
+) {
+  return useQuery(
+    queryKeys.list(environmentId),
+    async () => getAllJobs(environmentId),
+    {
+      ...withError('Unable to get Jobs'),
+      refetchInterval() {
+        return options?.refetchInterval ?? false;
+      },
+      enabled: options?.enabled,
+    }
+  );
+}
+
+async function getAllJobs(environmentId: EnvironmentId) {
+  try {
+    const { data: jobs } = await axios.get<Job[]>(
+      `kubernetes/${environmentId}/jobs`
+    );
+
+    return jobs;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to get Jobs');
+  }
+}
diff --git a/app/react/kubernetes/more-resources/JobsView/JobsDatatable/types.ts b/app/react/kubernetes/more-resources/JobsView/JobsDatatable/types.ts
new file mode 100644
index 0000000..5743fe4
--- /dev/null
+++ b/app/react/kubernetes/more-resources/JobsView/JobsDatatable/types.ts
@@ -0,0 +1,18 @@
+import { Container } from 'kubernetes-types/core/v1';
+
+export type Job = {
+  Id: string;
+  Namespace: string;
+  Name: string;
+  PodName: string;
+  Container?: Container;
+  Command?: string;
+  BackoffLimit?: number;
+  Completions?: number;
+  StartTime?: string;
+  FinishTime?: string;
+  Duration?: number;
+  Status?: string;
+  FailedReason?: string;
+  IsSystem?: boolean;
+};
diff --git a/app/react/kubernetes/more-resources/JobsView/JobsView.tsx b/app/react/kubernetes/more-resources/JobsView/JobsView.tsx
new file mode 100644
index 0000000..b27f6f3
--- /dev/null
+++ b/app/react/kubernetes/more-resources/JobsView/JobsView.tsx
@@ -0,0 +1,47 @@
+import { CalendarCheck2, CalendarSync } from 'lucide-react';
+
+import { useUnauthorizedRedirect } from '@/react/hooks/useUnauthorizedRedirect';
+
+import { PageHeader } from '@@/PageHeader';
+import { WidgetTabs, Tab, useCurrentTabIndex } from '@@/Widget/WidgetTabs';
+
+import { JobsDatatable } from './JobsDatatable/JobsDatatable';
+import { CronJobsDatatable } from './CronJobsDatatable/CronJobsDatatable';
+
+export function JobsView() {
+  useUnauthorizedRedirect(
+    { authorizations: ['K8sJobsR', 'K8sCronJobsR'] },
+    { to: 'kubernetes.dashboard' }
+  );
+
+  const tabs: Tab[] = [
+    {
+      name: 'Cron Jobs',
+      icon: CalendarSync,
+      widget: <CronJobsDatatable />,
+      selectedTabParam: 'cronJobs',
+    },
+    {
+      name: 'Jobs',
+      icon: CalendarCheck2,
+      widget: <JobsDatatable />,
+      selectedTabParam: 'jobs',
+    },
+  ];
+
+  const currentTabIndex = useCurrentTabIndex(tabs);
+
+  return (
+    <>
+      <PageHeader
+        title="Cron Job & Job lists"
+        breadcrumbs="Cron Jobs & Jobs"
+        reload
+      />
+      <>
+        <WidgetTabs tabs={tabs} currentTabIndex={currentTabIndex} />
+        <div className="content">{tabs[currentTabIndex].widget}</div>
+      </>
+    </>
+  );
+}
diff --git a/app/react/kubernetes/more-resources/JobsView/index.ts b/app/react/kubernetes/more-resources/JobsView/index.ts
new file mode 100644
index 0000000..29a6fb6
--- /dev/null
+++ b/app/react/kubernetes/more-resources/JobsView/index.ts
@@ -0,0 +1 @@
+export { JobsView } from './JobsView';
diff --git a/app/react/kubernetes/more-resources/ResourceDetailsYAMLView.test.tsx b/app/react/kubernetes/more-resources/ResourceDetailsYAMLView.test.tsx
new file mode 100644
index 0000000..e261cd4
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ResourceDetailsYAMLView.test.tsx
@@ -0,0 +1,159 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import { HttpResponse } from 'msw';
+import { ReactNode } from 'react';
+
+import { server, http } from '@/setup-tests/server';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+
+import { ResourceDetailsYAMLView } from './ResourceDetailsYAMLView';
+
+vi.mock('@@/PageHeader', () => ({
+  PageHeader: ({ title }: { title: string }) => <h1>{title}</h1>,
+}));
+
+vi.mock('@@/Link', () => ({
+  Link: ({
+    children,
+    ...props
+  }: {
+    children: ReactNode;
+    [key: string]: unknown;
+  }) => <a {...props}>{children}</a>,
+}));
+
+const mockResourceConfig = {
+  title: 'ConfigMap',
+  breadcrumbLabel: 'ConfigMaps',
+  breadcrumbLink: 'portainer.kubernetes.configmaps',
+  resourceType: 'ConfigMap',
+  apiVersion: 'v1',
+  resourcePlural: 'configmaps',
+  namespaced: true,
+  yamlIdentifier: 'configmap-yaml',
+  dataCy: 'k8s-configmap-yaml',
+};
+
+let mockParams: Record<string, unknown> = {
+  name: 'my-cm',
+  namespace: 'default',
+  endpointId: 1,
+  tab: 'yaml',
+};
+
+vi.mock('@uirouter/react', async (importOriginal: () => Promise<object>) => {
+  const actual = await importOriginal();
+  return {
+    ...(actual as object),
+    useCurrentStateAndParams: () => ({
+      state: { data: { resourceConfig: mockResourceConfig } },
+      params: mockParams,
+    }),
+  };
+});
+
+vi.mock('../components/YAMLInspector', () => ({
+  YAMLInspector: ({
+    data,
+    isLoading,
+    isError,
+    'data-cy': dataCy,
+  }: {
+    data: string;
+    isLoading?: boolean;
+    isError?: boolean;
+    'data-cy'?: string;
+  }) => {
+    if (isLoading) {
+      return <div data-cy="yaml-loading">Loading</div>;
+    }
+    if (isError) {
+      return <div>Error loading YAML</div>;
+    }
+    return <pre data-cy={dataCy}>{data}</pre>;
+  },
+}));
+
+vi.mock('@@/CodeEditor', () => ({
+  CodeEditor: ({
+    value,
+    id,
+    'data-cy': dataCy,
+  }: {
+    value?: string;
+    id?: string;
+    'data-cy'?: string;
+  }) => (
+    <div data-cy={dataCy} data-testid={id}>
+      {value}
+    </div>
+  ),
+}));
+
+vi.mock('@/react/hooks/useEnvironmentId', () => ({
+  useEnvironmentId: () => 1,
+}));
+
+function renderView() {
+  const Wrapped = withTestQueryProvider(ResourceDetailsYAMLView);
+  return render(<Wrapped />);
+}
+
+describe('ResourceDetailsYAMLView', () => {
+  beforeEach(() => {
+    server.resetHandlers();
+    mockParams = {
+      name: 'my-cm',
+      namespace: 'default',
+      endpointId: 1,
+      tab: 'yaml',
+    };
+  });
+
+  it('renders title and YAML from the kubernetes API on the YAML tab', async () => {
+    server.use(
+      http.get(
+        '/api/endpoints/1/kubernetes/api/v1/namespaces/default/configmaps/my-cm',
+        () =>
+          new HttpResponse('kind: ConfigMap', {
+            headers: { 'Content-Type': 'application/yaml' },
+          })
+      )
+    );
+
+    renderView();
+
+    expect(
+      screen.getByRole('heading', { name: 'ConfigMap', level: 1 })
+    ).toBeVisible();
+
+    await waitFor(() => {
+      expect(screen.getByText('kind: ConfigMap')).toBeVisible();
+    });
+  });
+
+  it('renders Describe output when the Describe tab is selected', async () => {
+    mockParams = {
+      name: 'my-cm',
+      namespace: 'default',
+      endpointId: 1,
+      tab: 'describe',
+    };
+
+    server.use(
+      http.get('/api/kubernetes/1/describe', ({ request }) => {
+        const url = new URL(request.url);
+        expect(url.searchParams.get('name')).toBe('my-cm');
+        expect(url.searchParams.get('kind')).toBe('ConfigMap');
+        expect(url.searchParams.get('namespace')).toBe('default');
+        return HttpResponse.json({ describe: 'Name: my-cm' });
+      })
+    );
+
+    renderView();
+
+    await waitFor(() => {
+      expect(screen.getByText('Name: my-cm')).toBeVisible();
+    });
+    expect(screen.getByTestId('describe-resource')).toBeVisible();
+  });
+});
diff --git a/app/react/kubernetes/more-resources/ResourceDetailsYAMLView.tsx b/app/react/kubernetes/more-resources/ResourceDetailsYAMLView.tsx
new file mode 100644
index 0000000..6c2657e
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ResourceDetailsYAMLView.tsx
@@ -0,0 +1,213 @@
+import { useMemo } from 'react';
+import { useCurrentStateAndParams } from '@uirouter/react';
+import { Code, FileText } from 'lucide-react';
+
+import { useDescribeResource } from '@/react/kubernetes/helm/HelmApplicationView/ReleaseDetails/ResourcesTable/queries/useDescribeResource';
+
+import { PageHeader } from '@@/PageHeader';
+import { Widget, WidgetBody, WidgetTabs } from '@@/Widget';
+import { Tab, useCurrentTabIndex } from '@@/Widget/WidgetTabs';
+import { Alert } from '@@/Alert';
+import { InlineLoader } from '@@/InlineLoader';
+import { CodeEditor } from '@@/CodeEditor';
+
+import { YAMLInspector } from '../components/YAMLInspector';
+import { useResourceYAML } from '../queries/useResourceYAML';
+
+type ResourceConfig = {
+  title: string;
+  breadcrumbLabel: string;
+  breadcrumbLink: string;
+  breadcrumbTab?: string;
+  resourceType: string;
+  apiVersion: string;
+  resourcePlural: string;
+  namespaced: boolean;
+  yamlIdentifier: string;
+  dataCy: string;
+};
+
+const fallbackTabs: Tab[] = [
+  { name: 'YAML', icon: Code, widget: null, selectedTabParam: 'yaml' },
+  {
+    name: 'Describe',
+    icon: FileText,
+    widget: null,
+    selectedTabParam: 'describe',
+  },
+];
+
+export function ResourceDetailsYAMLView() {
+  const { state, params } = useCurrentStateAndParams();
+  const config = state.data?.resourceConfig as ResourceConfig | undefined;
+
+  const tabs = useMemo(
+    () =>
+      config && params.name
+        ? buildTabs(config, params.name, params.namespace, params.endpointId)
+        : fallbackTabs,
+    [config, params.name, params.namespace, params.endpointId]
+  );
+
+  const currentTabIndex = useCurrentTabIndex(tabs);
+
+  if (!config || !params.name) {
+    return null;
+  }
+
+  return (
+    <>
+      <PageHeader
+        title={config.title}
+        breadcrumbs={[
+          {
+            label: config.breadcrumbLabel,
+            link: config.breadcrumbLink,
+            linkParams: config.breadcrumbTab
+              ? { tab: config.breadcrumbTab }
+              : {},
+          },
+          params.name,
+        ]}
+        reload
+      />
+
+      <>
+        <WidgetTabs tabs={tabs} currentTabIndex={currentTabIndex} />
+        {tabs[currentTabIndex]?.widget}
+      </>
+    </>
+  );
+}
+
+function buildTabs(
+  config: ResourceConfig,
+  name: string,
+  namespace: string | undefined,
+  endpointId: number
+): Tab[] {
+  const resourcePath = buildResourcePath(config, namespace, name);
+
+  return [
+    {
+      name: 'YAML',
+      icon: Code,
+      widget: (
+        <YamlTabContent
+          endpointId={endpointId}
+          resourcePath={resourcePath}
+          config={config}
+        />
+      ),
+      selectedTabParam: 'yaml',
+    },
+    {
+      name: 'Describe',
+      icon: FileText,
+      widget: (
+        <DescribeTabContent
+          name={name}
+          resourceType={config.resourceType}
+          namespace={namespace}
+        />
+      ),
+      selectedTabParam: 'describe',
+    },
+  ];
+}
+
+function YamlTabContent({
+  endpointId,
+  resourcePath,
+  config,
+}: {
+  endpointId: number;
+  resourcePath: string;
+  config: ResourceConfig;
+}) {
+  const { data, isLoading, isError } = useResourceYAML({
+    environmentId: endpointId,
+    resourcePath,
+    enabled: !!resourcePath,
+  });
+
+  return (
+    <div className="row">
+      <div className="col-sm-12">
+        <Widget>
+          <WidgetBody>
+            <YAMLInspector
+              identifier={config.yamlIdentifier}
+              data={data || ''}
+              hideMessage
+              isLoading={isLoading}
+              isError={isError}
+              data-cy={config.dataCy}
+            />
+          </WidgetBody>
+        </Widget>
+      </div>
+    </div>
+  );
+}
+
+function DescribeTabContent({
+  name,
+  resourceType,
+  namespace,
+}: {
+  name: string;
+  resourceType: string;
+  namespace?: string;
+}) {
+  const { data, isLoading, isError } = useDescribeResource(
+    name,
+    resourceType,
+    namespace
+  );
+
+  return (
+    <div className="row">
+      <div className="col-sm-12">
+        <Widget>
+          <WidgetBody>
+            {isLoading && <InlineLoader>Loading...</InlineLoader>}
+            {isError && (
+              <Alert color="error" title="Error">
+                Error loading resource details
+              </Alert>
+            )}
+            {!isLoading && !isError && (
+              <CodeEditor
+                id="describe-resource"
+                data-cy="describe-resource"
+                readonly
+                value={data?.describe}
+                type="yaml"
+              />
+            )}
+          </WidgetBody>
+        </Widget>
+      </div>
+    </div>
+  );
+}
+
+function buildResourcePath(
+  config: ResourceConfig,
+  namespace: string | undefined,
+  name: string
+) {
+  const apiPrefix = config.apiVersion.includes('/')
+    ? `apis/${config.apiVersion}`
+    : `api/${config.apiVersion}`;
+
+  if (config.namespaced) {
+    if (!namespace) {
+      return '';
+    }
+    return `${apiPrefix}/namespaces/${namespace}/${config.resourcePlural}/${name}`;
+  }
+
+  return `${apiPrefix}/${config.resourcePlural}/${name}`;
+}
diff --git a/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/RoleBindingsDatatable.tsx b/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/RoleBindingsDatatable.tsx
new file mode 100644
index 0000000..9b57b02
--- /dev/null
+++ b/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/RoleBindingsDatatable.tsx
@@ -0,0 +1,185 @@
+import { Trash2, Link as LinkIcon } from 'lucide-react';
+import { useRouter } from '@uirouter/react';
+import { Row } from '@tanstack/react-table';
+import clsx from 'clsx';
+import { useMemo } from 'react';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useAuthorizations, Authorized } from '@/react/hooks/useUser';
+import { notifyError, notifySuccess } from '@/portainer/services/notifications';
+import { SystemResourceDescription } from '@/react/kubernetes/datatables/SystemResourceDescription';
+import {
+  DefaultDatatableSettings,
+  TableSettings as KubeTableSettings,
+} from '@/react/kubernetes/datatables/DefaultDatatableSettings';
+import { CreateFromManifestButton } from '@/react/kubernetes/components/CreateFromManifestButton';
+import { useKubeStore } from '@/react/kubernetes/datatables/default-kube-datatable-store';
+
+import { confirmDelete } from '@@/modals/confirm';
+import { Datatable, Table, TableSettingsMenu } from '@@/datatables';
+import { LoadingButton } from '@@/buttons';
+import {
+  type FilteredColumnsTableSettings,
+  filteredColumnsSettings,
+} from '@@/datatables/types';
+
+import { RoleBinding } from './types';
+import { columns } from './columns';
+import { useRoleBindings } from './queries/useRoleBindings';
+import { useDeleteRoleBindingsMutation } from './queries/useDeleteRoleBindingsMutation';
+
+const storageKey = 'roleBindings';
+interface TableSettings
+  extends KubeTableSettings, FilteredColumnsTableSettings {}
+
+export function RoleBindingsDatatable() {
+  const environmentId = useEnvironmentId();
+  const tableState = useKubeStore<TableSettings>(
+    storageKey,
+    undefined,
+    (set) => ({
+      ...filteredColumnsSettings(set),
+    })
+  );
+  const roleBindingsQuery = useRoleBindings(environmentId, {
+    autoRefreshRate: tableState.autoRefreshRate * 1000,
+  });
+  const filteredRoleBindings = useMemo(
+    () =>
+      tableState.showSystemResources
+        ? roleBindingsQuery.data
+        : roleBindingsQuery.data?.filter((rb) => !rb.isSystem),
+    [roleBindingsQuery.data, tableState.showSystemResources]
+  );
+
+  const { authorized: isAuthorisedToAddEdit } = useAuthorizations([
+    'K8sRoleBindingsW',
+  ]);
+
+  return (
+    <Datatable
+      dataset={filteredRoleBindings || []}
+      columns={columns}
+      settingsManager={tableState}
+      isLoading={roleBindingsQuery.isLoading}
+      emptyContentLabel="No role bindings found"
+      title="Role Bindings"
+      titleIcon={LinkIcon}
+      getRowId={(row) => row.uid}
+      isRowSelectable={(row) => !row.original.isSystem}
+      renderTableActions={(selectedRows) => (
+        <TableActions selectedItems={selectedRows} />
+      )}
+      renderTableSettings={() => (
+        <TableSettingsMenu>
+          <DefaultDatatableSettings settings={tableState} />
+        </TableSettingsMenu>
+      )}
+      description={
+        <SystemResourceDescription
+          showSystemResources={tableState.showSystemResources}
+        />
+      }
+      disableSelect={!isAuthorisedToAddEdit}
+      renderRow={renderRow}
+      data-cy="k8s-role-bindings-datatable"
+    />
+  );
+}
+
+// needed to apply custom styling to the row and not globally required in the AC's for this ticket.
+function renderRow(row: Row<RoleBinding>, highlightedItemId?: string) {
+  return (
+    <Table.Row<RoleBinding>
+      cells={row.getVisibleCells()}
+      className={clsx('[&>td]:!py-4 [&>td]:!align-top', {
+        active: highlightedItemId === row.id,
+      })}
+    />
+  );
+}
+
+interface SelectedRole {
+  namespace: string;
+  name: string;
+}
+
+type TableActionsProps = {
+  selectedItems: RoleBinding[];
+};
+
+function TableActions({ selectedItems }: TableActionsProps) {
+  const environmentId = useEnvironmentId();
+  const deleteRoleBindingsMutation =
+    useDeleteRoleBindingsMutation(environmentId);
+  const router = useRouter();
+
+  async function handleRemoveClick(roles: SelectedRole[]) {
+    const confirmed = await confirmDelete(
+      <>
+        <p>Are you sure you want to delete the selected role binding(s)?</p>
+        <ul className="mt-2 max-h-96 list-inside overflow-hidden overflow-y-auto text-sm">
+          {roles.map((r, index) => (
+            <li key={index}>
+              {r.namespace}/{r.name}
+            </li>
+          ))}
+        </ul>
+      </>
+    );
+    if (!confirmed) {
+      return null;
+    }
+
+    const payload: Record<string, string[]> = {};
+    roles.forEach((r) => {
+      payload[r.namespace] = payload[r.namespace] || [];
+      payload[r.namespace].push(r.name);
+    });
+
+    deleteRoleBindingsMutation.mutate(
+      { environmentId, data: payload },
+      {
+        onSuccess: () => {
+          notifySuccess(
+            'Role binding(s) successfully removed',
+            roles.map((r) => `${r.namespace}/${r.name}`).join(', ')
+          );
+          router.stateService.reload();
+        },
+        onError: (error) => {
+          notifyError(
+            'Unable to delete role bindings(s)',
+            error as Error,
+            roles.map((r) => `${r.namespace}/${r.name}`).join(', ')
+          );
+        },
+      }
+    );
+    return roles;
+  }
+
+  return (
+    <Authorized authorizations="K8sRoleBindingsW">
+      <LoadingButton
+        className="btn-wrapper"
+        color="dangerlight"
+        disabled={selectedItems.length === 0}
+        onClick={() => handleRemoveClick(selectedItems)}
+        icon={Trash2}
+        isLoading={deleteRoleBindingsMutation.isLoading}
+        loadingText="Removing role bindings..."
+        data-cy="k8s-role-bindings-remove-button"
+      >
+        Remove
+      </LoadingButton>
+
+      <CreateFromManifestButton
+        params={{
+          tab: 'roleBindings',
+        }}
+        data-cy="k8s-role-bindings-deploy-button"
+      />
+    </Authorized>
+  );
+}
diff --git a/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/columns/created.tsx b/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/columns/created.tsx
new file mode 100644
index 0000000..c9c4562
--- /dev/null
+++ b/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/columns/created.tsx
@@ -0,0 +1,12 @@
+import { formatDate } from '@/portainer/filters/filters';
+
+import { columnHelper } from './helper';
+
+export const created = columnHelper.accessor(
+  (row) => formatDate(row.creationDate),
+  {
+    header: 'Created',
+    id: 'created',
+    cell: ({ getValue }) => getValue(),
+  }
+);
diff --git a/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/columns/helper.ts b/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/columns/helper.ts
new file mode 100644
index 0000000..358f6b2
--- /dev/null
+++ b/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/columns/helper.ts
@@ -0,0 +1,5 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { RoleBinding } from '../types';
+
+export const columnHelper = createColumnHelper<RoleBinding>();
diff --git a/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/columns/index.tsx b/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/columns/index.tsx
new file mode 100644
index 0000000..447f584
--- /dev/null
+++ b/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/columns/index.tsx
@@ -0,0 +1,19 @@
+import { name } from './name';
+import { roleKind } from './roleKind';
+import { roleName } from './roleName';
+import { subjectKind } from './subjectKind';
+import { subjectName } from './subjectName';
+import { subjectNamespace } from './subjectNamespace';
+import { created } from './created';
+import { namespace } from './namespace';
+
+export const columns = [
+  name,
+  namespace,
+  roleKind,
+  roleName,
+  subjectKind,
+  subjectName,
+  subjectNamespace,
+  created,
+];
diff --git a/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/columns/name.tsx b/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/columns/name.tsx
new file mode 100644
index 0000000..de5befc
--- /dev/null
+++ b/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/columns/name.tsx
@@ -0,0 +1,32 @@
+import { SystemBadge } from '@@/Badge/SystemBadge';
+import { Link } from '@@/Link';
+
+import { columnHelper } from './helper';
+
+export const name = columnHelper.accessor(
+  (row) => {
+    if (row.isSystem) {
+      return `${row.name} system`;
+    }
+    return row.name;
+  },
+  {
+    header: 'Name',
+    id: 'name',
+    cell: ({ row }) => (
+      <div className="flex gap-2">
+        <Link
+          to="kubernetes.moreResources.roleBinding"
+          params={{
+            namespace: row.original.namespace,
+            name: row.original.name,
+          }}
+          data-cy={`rolebinding-name-link-${row.original.namespace}-${row.original.name}`}
+        >
+          {row.original.name}
+        </Link>
+        {row.original.isSystem && <SystemBadge className="ml-auto" />}
+      </div>
+    ),
+  }
+);
diff --git a/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/columns/namespace.tsx b/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/columns/namespace.tsx
new file mode 100644
index 0000000..5575c9a
--- /dev/null
+++ b/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/columns/namespace.tsx
@@ -0,0 +1,31 @@
+import { Row } from '@tanstack/react-table';
+
+import { Link } from '@@/Link';
+import { filterHOC } from '@@/datatables/Filter';
+
+import { RoleBinding } from '../types';
+
+import { columnHelper } from './helper';
+
+export const namespace = columnHelper.accessor((row) => row.namespace, {
+  header: 'Namespace',
+  id: 'namespace',
+  cell: ({ getValue }) => (
+    <Link
+      to="kubernetes.resourcePools.resourcePool"
+      params={{
+        id: getValue(),
+      }}
+      data-cy={`role-binding-namespace-link-${getValue()}`}
+    >
+      {getValue()}
+    </Link>
+  ),
+  meta: {
+    filter: filterHOC('Filter by namespace'),
+  },
+  enableColumnFilter: true,
+  filterFn: (row: Row<RoleBinding>, _columnId: string, filterValue: string[]) =>
+    filterValue.length === 0 ||
+    filterValue.includes(row.original.namespace ?? ''),
+});
diff --git a/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/columns/roleKind.tsx b/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/columns/roleKind.tsx
new file mode 100644
index 0000000..5c946f8
--- /dev/null
+++ b/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/columns/roleKind.tsx
@@ -0,0 +1,25 @@
+import { Link } from '@@/Link';
+
+import { columnHelper } from './helper';
+
+export const roleKind = columnHelper.accessor('roleRef.kind', {
+  header: 'Role Kind',
+  id: 'roleKind',
+  cell: ({ row }) => {
+    const to =
+      row.original.roleRef.kind === 'ClusterRole'
+        ? 'kubernetes.moreResources.clusterRoles'
+        : 'kubernetes.moreResources.roles';
+    const tabParam =
+      row.original.roleRef.kind === 'ClusterRole' ? 'clusterRoles' : 'roles';
+    return (
+      <Link
+        to={to}
+        params={{ tab: tabParam }}
+        data-cy={`role-binding-role-kind-link-${row.original.roleRef.kind}`}
+      >
+        {row.original.roleRef.kind}
+      </Link>
+    );
+  },
+});
diff --git a/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/columns/roleName.tsx b/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/columns/roleName.tsx
new file mode 100644
index 0000000..69fb3a6
--- /dev/null
+++ b/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/columns/roleName.tsx
@@ -0,0 +1,6 @@
+import { columnHelper } from './helper';
+
+export const roleName = columnHelper.accessor('roleRef.name', {
+  header: 'Role Name',
+  id: 'roleName',
+});
diff --git a/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/columns/subjectKind.tsx b/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/columns/subjectKind.tsx
new file mode 100644
index 0000000..49c43cb
--- /dev/null
+++ b/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/columns/subjectKind.tsx
@@ -0,0 +1,13 @@
+import { columnHelper } from './helper';
+
+export const subjectKind = columnHelper.accessor(
+  (row) => row.subjects?.map((sub) => sub.kind).join(', '),
+  {
+    header: 'Subject Kind',
+    id: 'subjectKind',
+    cell: ({ row }) =>
+      row.original.subjects?.map((sub, index) => (
+        <div key={index}>{sub.kind}</div>
+      )) || '-',
+  }
+);
diff --git a/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/columns/subjectName.tsx b/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/columns/subjectName.tsx
new file mode 100644
index 0000000..b53a578
--- /dev/null
+++ b/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/columns/subjectName.tsx
@@ -0,0 +1,13 @@
+import { columnHelper } from './helper';
+
+export const subjectName = columnHelper.accessor(
+  (row) => row.subjects?.map((sub) => sub.name).join(', '),
+  {
+    header: 'Subject Name',
+    id: 'subjectName',
+    cell: ({ row }) =>
+      row.original.subjects?.map((sub, index) => (
+        <div key={index}>{sub.name}</div>
+      )) || '-',
+  }
+);
diff --git a/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/columns/subjectNamespace.tsx b/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/columns/subjectNamespace.tsx
new file mode 100644
index 0000000..b08993a
--- /dev/null
+++ b/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/columns/subjectNamespace.tsx
@@ -0,0 +1,45 @@
+import { Link } from '@@/Link';
+import { filterHOC } from '@@/datatables/Filter';
+
+import {
+  filterFn,
+  filterNamespaceOptionsTransformer,
+} from '../../../ClusterRolesView/utils';
+
+import { columnHelper } from './helper';
+
+export const subjectNamespace = columnHelper.accessor(
+  (row) => row.subjects?.flatMap((sub) => sub.namespace || '-') || [],
+  {
+    header: 'Subject Namespace',
+    id: 'subjectNamespace',
+    cell: ({ row }) =>
+      row.original.subjects?.map((sub, index) => (
+        <div key={index}>
+          {sub.namespace ? (
+            <Link
+              to="kubernetes.resourcePools.resourcePool"
+              params={{
+                id: sub.namespace,
+              }}
+              title={sub.namespace}
+              data-cy={`subject-namespace-link-${row.original.name}_${index}`}
+            >
+              {sub.namespace}
+            </Link>
+          ) : (
+            '-'
+          )}
+        </div>
+      )) || '-',
+    enableColumnFilter: true,
+    // use a custom filter, to remove empty namespace values
+    meta: {
+      filter: filterHOC(
+        'Filter by subject namespace',
+        filterNamespaceOptionsTransformer
+      ),
+    },
+    filterFn,
+  }
+);
diff --git a/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/index.tsx b/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/index.tsx
new file mode 100644
index 0000000..9a8a77a
--- /dev/null
+++ b/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/index.tsx
@@ -0,0 +1 @@
+export { RoleBindingsDatatable } from './RoleBindingsDatatable';
diff --git a/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/queries/query-keys.ts b/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/queries/query-keys.ts
new file mode 100644
index 0000000..c87ce5f
--- /dev/null
+++ b/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/queries/query-keys.ts
@@ -0,0 +1,6 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+export const queryKeys = {
+  list: (environmentId: EnvironmentId) =>
+    ['environments', environmentId, 'kubernetes', 'role_bindings'] as const,
+};
diff --git a/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/queries/useDeleteRoleBindingsMutation.ts b/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/queries/useDeleteRoleBindingsMutation.ts
new file mode 100644
index 0000000..777f238
--- /dev/null
+++ b/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/queries/useDeleteRoleBindingsMutation.ts
@@ -0,0 +1,32 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { withError, withInvalidate } from '@/react-tools/react-query';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { queryKeys } from './query-keys';
+
+export function useDeleteRoleBindingsMutation(environmentId: EnvironmentId) {
+  const queryClient = useQueryClient();
+  return useMutation(deleteRoleBindings, {
+    ...withInvalidate(queryClient, [queryKeys.list(environmentId)]),
+    ...withError('Unable to delete role bindings'),
+  });
+}
+
+export async function deleteRoleBindings({
+  environmentId,
+  data,
+}: {
+  environmentId: EnvironmentId;
+  data: Record<string, string[]>;
+}) {
+  try {
+    return await axios.post(
+      `kubernetes/${environmentId}/role_bindings/delete`,
+      data
+    );
+  } catch (e) {
+    throw parseAxiosError(e, `Unable to delete role bindings`);
+  }
+}
diff --git a/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/queries/useRoleBindings.ts b/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/queries/useRoleBindings.ts
new file mode 100644
index 0000000..79d7896
--- /dev/null
+++ b/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/queries/useRoleBindings.ts
@@ -0,0 +1,38 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { withError } from '@/react-tools/react-query';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { RoleBinding } from '../types';
+
+import { queryKeys } from './query-keys';
+
+export function useRoleBindings(
+  environmentId: EnvironmentId,
+  options?: { autoRefreshRate?: number; enabled?: boolean }
+) {
+  return useQuery(
+    queryKeys.list(environmentId),
+    async () => getAllRoleBindings(environmentId),
+    {
+      ...withError('Unable to get role bindings'),
+      refetchInterval() {
+        return options?.autoRefreshRate ?? false;
+      },
+      enabled: options?.enabled,
+    }
+  );
+}
+
+async function getAllRoleBindings(environmentId: EnvironmentId) {
+  try {
+    const { data: roleBinding } = await axios.get<RoleBinding[]>(
+      `kubernetes/${environmentId}/role_bindings`
+    );
+
+    return roleBinding;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to get role bindings');
+  }
+}
diff --git a/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/types.ts b/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/types.ts
new file mode 100644
index 0000000..9c2ebf7
--- /dev/null
+++ b/app/react/kubernetes/more-resources/RolesView/RoleBindingsDatatable/types.ts
@@ -0,0 +1,22 @@
+export type RoleRef = {
+  name: string;
+  kind: string;
+  apiGroup?: string;
+};
+
+export type RoleSubject = {
+  name: string;
+  kind: string;
+  apiGroup?: string;
+  namespace?: string;
+};
+
+export type RoleBinding = {
+  name: string;
+  uid: string;
+  namespace: string;
+  roleRef: RoleRef;
+  subjects: RoleSubject[] | null;
+  creationDate: string;
+  isSystem: boolean;
+};
diff --git a/app/react/kubernetes/more-resources/RolesView/RolesDatatable/RolesDatatable.tsx b/app/react/kubernetes/more-resources/RolesView/RolesDatatable/RolesDatatable.tsx
new file mode 100644
index 0000000..bf5903d
--- /dev/null
+++ b/app/react/kubernetes/more-resources/RolesView/RolesDatatable/RolesDatatable.tsx
@@ -0,0 +1,193 @@
+import { Trash2, UserCheck } from 'lucide-react';
+import { useRouter } from '@uirouter/react';
+import { useMemo } from 'react';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { Authorized } from '@/react/hooks/useUser';
+import { notifyError, notifySuccess } from '@/portainer/services/notifications';
+import { SystemResourceDescription } from '@/react/kubernetes/datatables/SystemResourceDescription';
+import { CreateFromManifestButton } from '@/react/kubernetes/components/CreateFromManifestButton';
+import {
+  DefaultDatatableSettings,
+  TableSettings as KubeTableSettings,
+} from '@/react/kubernetes/datatables/DefaultDatatableSettings';
+import { useKubeStore } from '@/react/kubernetes/datatables/default-kube-datatable-store';
+
+import { confirmDelete } from '@@/modals/confirm';
+import { Datatable, TableSettingsMenu } from '@@/datatables';
+import { LoadingButton } from '@@/buttons';
+import {
+  type FilteredColumnsTableSettings,
+  filteredColumnsSettings,
+} from '@@/datatables/types';
+
+import { useRoleBindings } from '../RoleBindingsDatatable/queries/useRoleBindings';
+import { RoleBinding } from '../RoleBindingsDatatable/types';
+
+import { columns } from './columns';
+import { Role, RoleRowData } from './types';
+import { useRoles } from './queries/useRoles';
+import { useDeleteRolesMutation } from './queries/useDeleteRolesMutation';
+
+const storageKey = 'roles';
+interface TableSettings
+  extends KubeTableSettings, FilteredColumnsTableSettings {}
+
+export function RolesDatatable() {
+  const environmentId = useEnvironmentId();
+  const tableState = useKubeStore<TableSettings>(
+    storageKey,
+    undefined,
+    (set) => ({
+      ...filteredColumnsSettings(set),
+    })
+  );
+  const rolesQuery = useRoles(environmentId, {
+    autoRefreshRate: tableState.autoRefreshRate * 1000,
+  });
+  const roleBindingsQuery = useRoleBindings(environmentId, {
+    autoRefreshRate: tableState.autoRefreshRate * 1000,
+  });
+  const roleRowData = useRoleRowData(rolesQuery.data, roleBindingsQuery.data);
+
+  const filteredRoles = useMemo(
+    () =>
+      tableState.showSystemResources
+        ? roleRowData
+        : roleRowData.filter((role) => !role.isSystem),
+    [roleRowData, tableState.showSystemResources]
+  );
+
+  return (
+    <Datatable
+      dataset={filteredRoles || []}
+      columns={columns}
+      settingsManager={tableState}
+      isLoading={rolesQuery.isLoading || roleBindingsQuery.isLoading}
+      emptyContentLabel="No roles found"
+      title="Roles"
+      titleIcon={UserCheck}
+      getRowId={(row) => row.uid}
+      isRowSelectable={(row) => !row.original.isSystem}
+      renderTableActions={(selectedRows) => (
+        <TableActions selectedItems={selectedRows} />
+      )}
+      renderTableSettings={() => (
+        <TableSettingsMenu>
+          <DefaultDatatableSettings settings={tableState} />
+        </TableSettingsMenu>
+      )}
+      description={
+        <SystemResourceDescription
+          showSystemResources={tableState.showSystemResources}
+        />
+      }
+      data-cy="k8s-roles-datatable"
+    />
+  );
+}
+
+interface SelectedRole {
+  namespace: string;
+  name: string;
+}
+
+type TableActionsProps = {
+  selectedItems: Role[];
+};
+
+function TableActions({ selectedItems }: TableActionsProps) {
+  const environmentId = useEnvironmentId();
+  const deleteRolesMutation = useDeleteRolesMutation(environmentId);
+  const router = useRouter();
+
+  return (
+    <Authorized authorizations="K8sRolesW">
+      <LoadingButton
+        className="btn-wrapper"
+        color="dangerlight"
+        disabled={selectedItems.length === 0}
+        onClick={() => handleRemoveClick(selectedItems)}
+        icon={Trash2}
+        isLoading={deleteRolesMutation.isLoading}
+        loadingText="Removing roles..."
+        data-cy="k8s-roles-removeRoleButton"
+      >
+        Remove
+      </LoadingButton>
+
+      <CreateFromManifestButton
+        params={{ tab: 'roles' }}
+        data-cy="k8s-roles-deploy-button"
+      />
+    </Authorized>
+  );
+
+  async function handleRemoveClick(roles: SelectedRole[]) {
+    const confirmed = await confirmDelete(
+      <>
+        <p>Are you sure you want to delete the selected role(s)?</p>
+        <ul className="mt-2 max-h-96 list-inside overflow-hidden overflow-y-auto text-sm">
+          {roles.map((s, index) => (
+            <li key={index}>
+              {s.namespace}/{s.name}
+            </li>
+          ))}
+        </ul>
+      </>
+    );
+    if (!confirmed) {
+      return null;
+    }
+
+    const payload: Record<string, string[]> = {};
+    roles.forEach((r) => {
+      payload[r.namespace] = payload[r.namespace] || [];
+      payload[r.namespace].push(r.name);
+    });
+
+    deleteRolesMutation.mutate(
+      { environmentId, data: payload },
+      {
+        onSuccess: () => {
+          notifySuccess(
+            'Roles successfully removed',
+            roles.map((r) => `${r.namespace}/${r.name}`).join(', ')
+          );
+          router.stateService.reload();
+        },
+        onError: (error) => {
+          notifyError(
+            'Unable to delete roles',
+            error as Error,
+            roles.map((r) => `${r.namespace}/${r.name}`).join(', ')
+          );
+        },
+      }
+    );
+    return roles;
+  }
+}
+
+// Mark roles that are used by a role binding
+
+// Mark roles that are used by a role binding
+function useRoleRowData(
+  roles?: Role[],
+  roleBindings?: RoleBinding[]
+): RoleRowData[] {
+  const roleRowData = useMemo(
+    () =>
+      roles?.map((role) => {
+        const isUsed = roleBindings?.some(
+          (roleBinding) =>
+            roleBinding.roleRef.name === role.name &&
+            roleBinding.namespace === role.namespace
+        );
+        return { ...role, isUnused: !isUsed };
+      }),
+    [roles, roleBindings]
+  );
+
+  return roleRowData ?? [];
+}
diff --git a/app/react/kubernetes/more-resources/RolesView/RolesDatatable/columns/created.tsx b/app/react/kubernetes/more-resources/RolesView/RolesDatatable/columns/created.tsx
new file mode 100644
index 0000000..c9c4562
--- /dev/null
+++ b/app/react/kubernetes/more-resources/RolesView/RolesDatatable/columns/created.tsx
@@ -0,0 +1,12 @@
+import { formatDate } from '@/portainer/filters/filters';
+
+import { columnHelper } from './helper';
+
+export const created = columnHelper.accessor(
+  (row) => formatDate(row.creationDate),
+  {
+    header: 'Created',
+    id: 'created',
+    cell: ({ getValue }) => getValue(),
+  }
+);
diff --git a/app/react/kubernetes/more-resources/RolesView/RolesDatatable/columns/helper.ts b/app/react/kubernetes/more-resources/RolesView/RolesDatatable/columns/helper.ts
new file mode 100644
index 0000000..acac7cf
--- /dev/null
+++ b/app/react/kubernetes/more-resources/RolesView/RolesDatatable/columns/helper.ts
@@ -0,0 +1,5 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { RoleRowData } from '../types';
+
+export const columnHelper = createColumnHelper<RoleRowData>();
diff --git a/app/react/kubernetes/more-resources/RolesView/RolesDatatable/columns/index.tsx b/app/react/kubernetes/more-resources/RolesView/RolesDatatable/columns/index.tsx
new file mode 100644
index 0000000..4fbbd3d
--- /dev/null
+++ b/app/react/kubernetes/more-resources/RolesView/RolesDatatable/columns/index.tsx
@@ -0,0 +1,5 @@
+import { name } from './name';
+import { created } from './created';
+import { namespace } from './namespace';
+
+export const columns = [name, namespace, created];
diff --git a/app/react/kubernetes/more-resources/RolesView/RolesDatatable/columns/name.tsx b/app/react/kubernetes/more-resources/RolesView/RolesDatatable/columns/name.tsx
new file mode 100644
index 0000000..9591936
--- /dev/null
+++ b/app/react/kubernetes/more-resources/RolesView/RolesDatatable/columns/name.tsx
@@ -0,0 +1,40 @@
+import { SystemBadge } from '@@/Badge/SystemBadge';
+import { UnusedBadge } from '@@/Badge/UnusedBadge';
+import { Link } from '@@/Link';
+
+import { columnHelper } from './helper';
+
+export const name = columnHelper.accessor(
+  (row) => {
+    let result = row.name;
+    if (row.isSystem) {
+      result += ' system';
+    }
+    if (row.isUnused) {
+      result += ' unused';
+    }
+    return result;
+  },
+  {
+    header: 'Name',
+    id: 'name',
+    cell: ({ row }) => (
+      <div className="flex gap-2">
+        <Link
+          to="kubernetes.moreResources.role"
+          params={{
+            namespace: row.original.namespace,
+            name: row.original.name,
+          }}
+          data-cy={`role-name-link-${row.original.namespace}-${row.original.name}`}
+        >
+          {row.original.name}
+        </Link>
+        <div className="ml-auto flex gap-2">
+          {row.original.isSystem && <SystemBadge />}
+          {row.original.isUnused && <UnusedBadge />}
+        </div>
+      </div>
+    ),
+  }
+);
diff --git a/app/react/kubernetes/more-resources/RolesView/RolesDatatable/columns/namespace.tsx b/app/react/kubernetes/more-resources/RolesView/RolesDatatable/columns/namespace.tsx
new file mode 100644
index 0000000..378ef26
--- /dev/null
+++ b/app/react/kubernetes/more-resources/RolesView/RolesDatatable/columns/namespace.tsx
@@ -0,0 +1,32 @@
+import { Row } from '@tanstack/react-table';
+
+import { filterHOC } from '@@/datatables/Filter';
+import { Link } from '@@/Link';
+
+import { RoleRowData } from '../types';
+
+import { columnHelper } from './helper';
+
+export const namespace = columnHelper.accessor((row) => row.namespace, {
+  header: 'Namespace',
+  id: 'namespace',
+  cell: ({ getValue, row }) => (
+    <Link
+      to="kubernetes.resourcePools.resourcePool"
+      params={{
+        id: getValue(),
+      }}
+      title={getValue()}
+      data-cy={`role-namespace-link-${row.original.name}`}
+    >
+      {getValue()}
+    </Link>
+  ),
+  meta: {
+    filter: filterHOC('Filter by namespace'),
+  },
+  enableColumnFilter: true,
+  filterFn: (row: Row<RoleRowData>, _columnId: string, filterValue: string[]) =>
+    filterValue.length === 0 ||
+    filterValue.includes(row.original.namespace ?? ''),
+});
diff --git a/app/react/kubernetes/more-resources/RolesView/RolesDatatable/index.tsx b/app/react/kubernetes/more-resources/RolesView/RolesDatatable/index.tsx
new file mode 100644
index 0000000..89baa6c
--- /dev/null
+++ b/app/react/kubernetes/more-resources/RolesView/RolesDatatable/index.tsx
@@ -0,0 +1 @@
+export { RolesDatatable } from './RolesDatatable';
diff --git a/app/react/kubernetes/more-resources/RolesView/RolesDatatable/queries/query-keys.ts b/app/react/kubernetes/more-resources/RolesView/RolesDatatable/queries/query-keys.ts
new file mode 100644
index 0000000..d48b61c
--- /dev/null
+++ b/app/react/kubernetes/more-resources/RolesView/RolesDatatable/queries/query-keys.ts
@@ -0,0 +1,6 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+export const queryKeys = {
+  list: (environmentId: EnvironmentId) =>
+    ['environments', environmentId, 'kubernetes', 'roles'] as const,
+};
diff --git a/app/react/kubernetes/more-resources/RolesView/RolesDatatable/queries/useDeleteRolesMutation.ts b/app/react/kubernetes/more-resources/RolesView/RolesDatatable/queries/useDeleteRolesMutation.ts
new file mode 100644
index 0000000..8f2cfa7
--- /dev/null
+++ b/app/react/kubernetes/more-resources/RolesView/RolesDatatable/queries/useDeleteRolesMutation.ts
@@ -0,0 +1,29 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { withError, withInvalidate } from '@/react-tools/react-query';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { queryKeys } from './query-keys';
+
+export function useDeleteRolesMutation(environmentId: EnvironmentId) {
+  const queryClient = useQueryClient();
+  return useMutation(deleteRole, {
+    ...withInvalidate(queryClient, [queryKeys.list(environmentId)]),
+    ...withError('Unable to delete roles'),
+  });
+}
+
+export async function deleteRole({
+  environmentId,
+  data,
+}: {
+  environmentId: EnvironmentId;
+  data: Record<string, string[]>;
+}) {
+  try {
+    return await axios.post(`kubernetes/${environmentId}/roles/delete`, data);
+  } catch (e) {
+    throw parseAxiosError(e, `Unable to delete roles`);
+  }
+}
diff --git a/app/react/kubernetes/more-resources/RolesView/RolesDatatable/queries/useRoles.ts b/app/react/kubernetes/more-resources/RolesView/RolesDatatable/queries/useRoles.ts
new file mode 100644
index 0000000..803ee06
--- /dev/null
+++ b/app/react/kubernetes/more-resources/RolesView/RolesDatatable/queries/useRoles.ts
@@ -0,0 +1,41 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { withError } from '@/react-tools/react-query';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { Role } from '../types';
+
+const queryKeys = {
+  list: (environmentId: EnvironmentId) =>
+    ['environments', environmentId, 'kubernetes', 'roles'] as const,
+};
+
+export function useRoles(
+  environmentId: EnvironmentId,
+  options?: { autoRefreshRate?: number; enabled?: boolean }
+) {
+  return useQuery(
+    queryKeys.list(environmentId),
+    async () => getAllRoles(environmentId),
+    {
+      ...withError('Unable to get roles'),
+      refetchInterval() {
+        return options?.autoRefreshRate ?? false;
+      },
+      enabled: options?.enabled,
+    }
+  );
+}
+
+async function getAllRoles(environmentId: EnvironmentId) {
+  try {
+    const { data: roles } = await axios.get<Role[]>(
+      `kubernetes/${environmentId}/roles`
+    );
+
+    return roles;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to get roles');
+  }
+}
diff --git a/app/react/kubernetes/more-resources/RolesView/RolesDatatable/types.ts b/app/react/kubernetes/more-resources/RolesView/RolesDatatable/types.ts
new file mode 100644
index 0000000..05e30ca
--- /dev/null
+++ b/app/react/kubernetes/more-resources/RolesView/RolesDatatable/types.ts
@@ -0,0 +1,17 @@
+export type Rule = {
+  verbs: string[];
+  apiGroups: string[];
+  resources: string[];
+};
+
+export type Role = {
+  name: string;
+  uid: string;
+  namespace: string;
+  creationDate: string;
+  isSystem: boolean;
+};
+
+export type RoleRowData = Role & {
+  isUnused: boolean;
+};
diff --git a/app/react/kubernetes/more-resources/RolesView/RolesView.tsx b/app/react/kubernetes/more-resources/RolesView/RolesView.tsx
new file mode 100644
index 0000000..c4419e9
--- /dev/null
+++ b/app/react/kubernetes/more-resources/RolesView/RolesView.tsx
@@ -0,0 +1,43 @@
+import { UserCheck, Link } from 'lucide-react';
+
+import { useUnauthorizedRedirect } from '@/react/hooks/useUnauthorizedRedirect';
+
+import { PageHeader } from '@@/PageHeader';
+import { WidgetTabs, Tab, useCurrentTabIndex } from '@@/Widget/WidgetTabs';
+
+import { RolesDatatable } from './RolesDatatable';
+import { RoleBindingsDatatable } from './RoleBindingsDatatable';
+
+export function RolesView() {
+  useUnauthorizedRedirect(
+    { authorizations: ['K8sRoleBindingsW', 'K8sRolesW'], adminOnlyCE: true },
+    { to: 'kubernetes.dashboard' }
+  );
+
+  const tabs: Tab[] = [
+    {
+      name: 'Roles',
+      icon: UserCheck,
+      widget: <RolesDatatable />,
+      selectedTabParam: 'roles',
+    },
+    {
+      name: 'Role Bindings',
+      icon: Link,
+      widget: <RoleBindingsDatatable />,
+      selectedTabParam: 'roleBindings',
+    },
+  ];
+
+  const currentTabIndex = useCurrentTabIndex(tabs);
+
+  return (
+    <>
+      <PageHeader title="Role list" breadcrumbs="Roles" reload />
+      <>
+        <WidgetTabs tabs={tabs} currentTabIndex={currentTabIndex} />
+        <div className="content">{tabs[currentTabIndex].widget}</div>
+      </>
+    </>
+  );
+}
diff --git a/app/react/kubernetes/more-resources/RolesView/index.tsx b/app/react/kubernetes/more-resources/RolesView/index.tsx
new file mode 100644
index 0000000..d270a36
--- /dev/null
+++ b/app/react/kubernetes/more-resources/RolesView/index.tsx
@@ -0,0 +1 @@
+export { RolesView } from './RolesView';
diff --git a/app/react/kubernetes/more-resources/ServiceAccountsView/ItemView/ImagePullSecretBadge.tsx b/app/react/kubernetes/more-resources/ServiceAccountsView/ItemView/ImagePullSecretBadge.tsx
new file mode 100644
index 0000000..db5d4eb
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ServiceAccountsView/ItemView/ImagePullSecretBadge.tsx
@@ -0,0 +1,105 @@
+import { Secret } from 'kubernetes-types/core/v1';
+
+import { useCurrentUser } from '@/react/hooks/useUser';
+import { Registry } from '@/react/portainer/registries/types/registry';
+
+import { Badge } from '@@/Badge';
+import { Link } from '@@/Link';
+import { Tooltip } from '@@/Tip/Tooltip';
+import { TooltipWithChildren } from '@@/Tip/TooltipWithChildren';
+
+type Props = {
+  secretName: string;
+  namespace: string;
+  secret: Secret | undefined;
+  registry: Registry | undefined;
+};
+
+export function ImagePullSecretBadge({
+  secretName,
+  namespace,
+  secret,
+  registry,
+}: Props) {
+  const { isPureAdmin } = useCurrentUser();
+  const registryIdStr =
+    secret?.metadata?.annotations?.['portainer.io/registry.id'];
+  const registryId = registryIdStr
+    ? parseInt(registryIdStr, 10) || undefined
+    : undefined;
+
+  const registryTooltip = registry && (
+    <Tooltip
+      position="right"
+      message={
+        <div className="flex flex-col gap-1">
+          <span>
+            <span className="font-medium">Registry: </span>
+            {isPureAdmin ? (
+              <Link
+                to="portainer.registries.registry"
+                params={{ id: registry.Id }}
+                className="!text-inherit underline"
+                data-cy={`registry-link-${registry.Id}`}
+                rel="noopener noreferrer"
+                target="_blank"
+              >
+                {registry.Name}
+              </Link>
+            ) : (
+              registry.Name
+            )}
+          </span>
+          <span>
+            <span className="font-medium">URL: </span>
+            {registry.URL}
+          </span>
+        </div>
+      }
+    />
+  );
+
+  const registryNotFoundMessage =
+    'The registry associated with this secret could not be found. It may have been deleted.';
+  const showRegistryNotFound = !!registryId && !registry;
+
+  const secretLink = (
+    <Link
+      to="kubernetes.secrets.secret"
+      params={{ name: secretName, namespace }}
+      data-cy={`image-pull-secret-link-${secretName}`}
+      className="!text-inherit"
+    >
+      {secretName}
+    </Link>
+  );
+
+  const missingSecretContent = (
+    <>
+      {secretName}
+      <Tooltip message="This secret doesn't exist in the namespace." />
+    </>
+  );
+
+  function renderSecretName() {
+    const content = secret ? secretLink : missingSecretContent;
+    if (showRegistryNotFound) {
+      return (
+        <TooltipWithChildren message={registryNotFoundMessage}>
+          <span>{content}</span>
+        </TooltipWithChildren>
+      );
+    }
+    return content;
+  }
+
+  return (
+    <Badge
+      type={secret ? 'info' : 'warn'}
+      className="inline-flex min-w-max items-center"
+    >
+      {renderSecretName()}
+      {registryTooltip}
+    </Badge>
+  );
+}
diff --git a/app/react/kubernetes/more-resources/ServiceAccountsView/ItemView/ImagePullSecretsEditor.tsx b/app/react/kubernetes/more-resources/ServiceAccountsView/ItemView/ImagePullSecretsEditor.tsx
new file mode 100644
index 0000000..84ddc77
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ServiceAccountsView/ItemView/ImagePullSecretsEditor.tsx
@@ -0,0 +1,72 @@
+import { Button } from '@@/buttons/Button';
+import { LoadingButton } from '@@/buttons/LoadingButton';
+import {
+  DisabledMultiValue,
+  DisabledMultiValueRemove,
+  DisabledOption,
+  preserveProtectedValues,
+} from '@@/form-components/DisabledMultiValue';
+import { MultiSelect } from '@@/form-components/PortainerSelect';
+
+type Props = {
+  selectedNames: string[];
+  secretOptions: DisabledOption<string>[];
+  protectedSecretNames: string[];
+  isSaving: boolean;
+  onChange: (names: string[]) => void;
+  onSave: () => void;
+  onCancel: () => void;
+};
+
+export function ImagePullSecretsEditor({
+  selectedNames,
+  secretOptions,
+  protectedSecretNames,
+  isSaving,
+  onChange,
+  onSave,
+  onCancel,
+}: Props) {
+  return (
+    <div className="flex flex-wrap items-center gap-2">
+      <MultiSelect<string>
+        value={selectedNames}
+        options={secretOptions}
+        onChange={(names) =>
+          // Registry access owns some default service account secrets, so this
+          // editor keeps them selected even if the user clears the field.
+          onChange(preserveProtectedValues(names, protectedSecretNames))
+        }
+        placeholder="Select secrets..."
+        disabled={isSaving}
+        data-cy="k8sSADetail-imagePullSecrets-select"
+        components={{
+          MultiValue: DisabledMultiValue,
+          MultiValueRemove: DisabledMultiValueRemove,
+        }}
+      />
+      <div className="inline-flex gap-2">
+        <LoadingButton
+          size="small"
+          isLoading={isSaving}
+          loadingText="Saving..."
+          onClick={onSave}
+          data-cy="k8sSADetail-imagePullSecrets-save"
+          className="h-[34px]"
+        >
+          Save
+        </LoadingButton>
+        <Button
+          size="small"
+          color="default"
+          disabled={isSaving}
+          onClick={onCancel}
+          data-cy="k8sSADetail-imagePullSecrets-cancel"
+          className="h-[34px]"
+        >
+          Cancel
+        </Button>
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/kubernetes/more-resources/ServiceAccountsView/ItemView/ImagePullSecretsList.tsx b/app/react/kubernetes/more-resources/ServiceAccountsView/ItemView/ImagePullSecretsList.tsx
new file mode 100644
index 0000000..b0b54e8
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ServiceAccountsView/ItemView/ImagePullSecretsList.tsx
@@ -0,0 +1,108 @@
+import { PencilIcon } from 'lucide-react';
+import { Secret } from 'kubernetes-types/core/v1';
+
+import { Registry } from '@/react/portainer/registries/types/registry';
+
+import { Badge } from '@@/Badge';
+import { Button } from '@@/buttons/Button';
+import { TooltipWithChildren } from '@@/Tip/TooltipWithChildren';
+
+import { ImagePullSecretBadge } from './ImagePullSecretBadge';
+
+const MAX_VISIBLE_SECRETS = 5;
+
+type ImagePullSecret = {
+  name: string;
+  secret: Secret | undefined;
+  registry: Registry | undefined;
+};
+
+type Props = {
+  imagePullSecrets: ImagePullSecret[];
+  namespace: string;
+  isDefaultServiceAccount: boolean;
+  canEdit: boolean;
+  isSystem?: boolean;
+  onEdit: () => void;
+};
+
+export function ImagePullSecretsList({
+  imagePullSecrets,
+  namespace,
+  isDefaultServiceAccount,
+  canEdit,
+  isSystem,
+  onEdit,
+}: Props) {
+  const visibleSecrets = imagePullSecrets.slice(0, MAX_VISIBLE_SECRETS);
+  const hiddenSecrets = imagePullSecrets.slice(MAX_VISIBLE_SECRETS);
+
+  return (
+    <div className="flex items-center gap-2">
+      {visibleSecrets.length > 0 ? (
+        <div className="flex h-fit flex-wrap gap-1">
+          {visibleSecrets.map((imagePullSecret) => (
+            <ImagePullSecretBadge
+              key={imagePullSecret.name}
+              secretName={imagePullSecret.name}
+              namespace={namespace}
+              secret={imagePullSecret.secret}
+              registry={imagePullSecret.registry}
+            />
+          ))}
+          {hiddenSecrets.length > 0 && (
+            <TooltipWithChildren
+              message={hiddenSecrets.map((secret) => secret.name).join(', ')}
+            >
+              <span>
+                <Badge type="muted" className="min-w-max cursor-default">
+                  + {hiddenSecrets.length} more
+                </Badge>
+              </span>
+            </TooltipWithChildren>
+          )}
+        </div>
+      ) : (
+        <ImagePullSecretsEmptyState
+          isDefaultServiceAccount={isDefaultServiceAccount}
+        />
+      )}
+      {canEdit && !isSystem && (
+        <Button
+          color="light"
+          size="small"
+          icon={PencilIcon}
+          onClick={onEdit}
+          data-cy="k8sSADetail-imagePullSecrets-edit"
+          className="h-[34px]"
+        >
+          Edit
+        </Button>
+      )}
+    </div>
+  );
+}
+
+function ImagePullSecretsEmptyState({
+  isDefaultServiceAccount,
+}: {
+  isDefaultServiceAccount: boolean;
+}) {
+  return (
+    <span className="text-muted">
+      {isDefaultServiceAccount ? (
+        <>
+          No image pull secrets configured. Pods in this namespace without an
+          explicit service account must specify <code>imagePullSecrets</code>{' '}
+          manually. Add a secret here so they can pull images automatically.
+        </>
+      ) : (
+        <>
+          No image pull secrets configured. Pods using this service account must
+          specify <code>imagePullSecrets</code> manually. Add a secret here so
+          pods using this service account can pull images automatically.
+        </>
+      )}
+    </span>
+  );
+}
diff --git a/app/react/kubernetes/more-resources/ServiceAccountsView/ItemView/ImagePullSecretsRow.test.tsx b/app/react/kubernetes/more-resources/ServiceAccountsView/ItemView/ImagePullSecretsRow.test.tsx
new file mode 100644
index 0000000..14855f7
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ServiceAccountsView/ItemView/ImagePullSecretsRow.test.tsx
@@ -0,0 +1,263 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { HttpResponse, http } from 'msw';
+import { ReactNode } from 'react';
+import { vi } from 'vitest';
+
+import { server } from '@/setup-tests/server';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { useAuthorizations } from '@/react/hooks/useUser';
+
+import { ImagePullSecretsRow } from './ImagePullSecretsRow';
+
+vi.mock('@/react/hooks/useEnvironmentId', () => ({
+  useEnvironmentId: () => 1,
+}));
+
+vi.mock(
+  '@/react/hooks/useUser',
+  async (importOriginal: () => Promise<object>) => ({
+    ...(await importOriginal()),
+    useAuthorizations: vi.fn(),
+    useCurrentUser: () => ({ isPureAdmin: false }),
+  })
+);
+
+vi.mock('@/react/kubernetes/configs/queries/useSecrets', () => ({
+  useSecrets: () => ({
+    data: [
+      { metadata: { name: 'secret-a' } },
+      { metadata: { name: 'secret-b' } },
+    ],
+    isLoading: false,
+  }),
+}));
+
+vi.mock(
+  '@/react/portainer/environments/queries/useEnvironmentRegistries',
+  () => ({
+    useEnvironmentRegistries: () => ({
+      data: {
+        linkedDefaultSecretNames: [],
+        registryBySecretName: {},
+      },
+      isLoading: false,
+    }),
+  })
+);
+
+vi.mock('@@/Link', () => ({
+  Link: ({ children }: { children: ReactNode }) => <>{children}</>,
+}));
+
+vi.mock('@@/Tip/Tooltip', () => ({ Tooltip: () => null }));
+
+vi.mock('@@/Tip/TooltipWithChildren', () => ({
+  TooltipWithChildren: ({ children }: { children: ReactNode }) => (
+    <>{children}</>
+  ),
+}));
+
+vi.mock('@@/form-components/PortainerSelect', () => ({
+  MultiSelect: () => <div data-testid="multi-select" />,
+}));
+
+const ImagePullSecretsRowWithQuery = withTestQueryProvider(ImagePullSecretsRow);
+
+type RowProps = React.ComponentProps<typeof ImagePullSecretsRow>;
+
+function renderRow(props: Partial<RowProps> = {}) {
+  return render(
+    <ImagePullSecretsRowWithQuery
+      namespace="default"
+      name="my-sa"
+      imagePullSecrets={[]}
+      isSystem={false}
+      {...props}
+    />
+  );
+}
+
+describe('ImagePullSecretsRow', () => {
+  beforeEach(() => {
+    vi.mocked(useAuthorizations).mockImplementation(() => ({
+      authorized: false,
+      isLoading: false,
+    }));
+  });
+
+  describe('empty state messages', () => {
+    it('shows a pod-specific message for a non-default service account', () => {
+      renderRow({ name: 'my-sa', imagePullSecrets: [] });
+      expect(
+        screen.getByText(/Pods using this service account must specify/)
+      ).toBeVisible();
+    });
+
+    it('shows a namespace-wide message for the default service account', () => {
+      renderRow({ name: 'default', imagePullSecrets: [] });
+      expect(
+        screen.getByText(
+          /Pods in this namespace without an explicit service account/
+        )
+      ).toBeVisible();
+    });
+  });
+
+  describe('pull secret badges', () => {
+    it('renders current pull secrets as badges', () => {
+      renderRow({
+        imagePullSecrets: [{ name: 'secret-a' }, { name: 'secret-b' }],
+      });
+      expect(screen.getByText('secret-a')).toBeVisible();
+      expect(screen.getByText('secret-b')).toBeVisible();
+    });
+
+    it('shows a warning badge for a pull secret that no longer exists in the namespace', () => {
+      renderRow({ imagePullSecrets: [{ name: 'orphan-secret' }] });
+      expect(screen.getByText('orphan-secret')).toBeVisible();
+    });
+  });
+
+  describe('edit button visibility by role', () => {
+    it('does not show edit button for a user without write permission', () => {
+      vi.mocked(useAuthorizations).mockImplementation(() => ({
+        authorized: false,
+        isLoading: false,
+      }));
+      renderRow();
+      expect(
+        screen.queryByRole('button', { name: /edit/i })
+      ).not.toBeInTheDocument();
+    });
+
+    it('does not show edit button for system service accounts, even for an admin', () => {
+      vi.mocked(useAuthorizations).mockImplementation(() => ({
+        authorized: true,
+        isLoading: false,
+      }));
+      renderRow({ isSystem: true });
+      expect(
+        screen.queryByRole('button', { name: /edit/i })
+      ).not.toBeInTheDocument();
+    });
+
+    it('shows edit button for an authorized user on a non-system SA', () => {
+      vi.mocked(useAuthorizations).mockImplementation((permission) => ({
+        authorized: permission === 'K8sServiceAccountsW',
+        isLoading: false,
+      }));
+      renderRow({ isSystem: false });
+      expect(screen.getByRole('button', { name: /edit/i })).toBeVisible();
+    });
+  });
+
+  describe('edit flow', () => {
+    beforeEach(() => {
+      vi.mocked(useAuthorizations).mockImplementation((permission) => ({
+        authorized: permission === 'K8sServiceAccountsW',
+        isLoading: false,
+      }));
+    });
+
+    it('shows save and cancel buttons after clicking edit', async () => {
+      renderRow({ imagePullSecrets: [{ name: 'secret-a' }] });
+
+      await userEvent.click(screen.getByRole('button', { name: /edit/i }));
+
+      expect(screen.getByRole('button', { name: /save/i })).toBeVisible();
+      expect(screen.getByRole('button', { name: /cancel/i })).toBeVisible();
+    });
+
+    it('returns to view mode when cancel is clicked', async () => {
+      renderRow({ imagePullSecrets: [{ name: 'secret-a' }] });
+
+      await userEvent.click(screen.getByRole('button', { name: /edit/i }));
+      await userEvent.click(screen.getByRole('button', { name: /cancel/i }));
+
+      expect(screen.getByRole('button', { name: /edit/i })).toBeVisible();
+      expect(
+        screen.queryByRole('button', { name: /save/i })
+      ).not.toBeInTheDocument();
+    });
+
+    it('sends a PUT to the correct path and body when save is clicked', async () => {
+      let capturedPath: string | undefined;
+      let capturedBody: unknown;
+
+      server.use(
+        http.put(
+          '/api/kubernetes/:envId/namespaces/:namespace/service_accounts/:name/image_pull_secrets',
+          async ({ request }) => {
+            capturedPath = request.url;
+            capturedBody = await request.json();
+            return new HttpResponse(null, { status: 204 });
+          }
+        )
+      );
+
+      renderRow({
+        namespace: 'production',
+        name: 'app-sa',
+        imagePullSecrets: [{ name: 'secret-a' }, { name: 'secret-b' }],
+      });
+
+      await userEvent.click(screen.getByRole('button', { name: /edit/i }));
+      await userEvent.click(screen.getByRole('button', { name: /save/i }));
+
+      await waitFor(() => {
+        expect(capturedPath).toContain(
+          '/api/kubernetes/1/namespaces/production/service_accounts/app-sa/image_pull_secrets'
+        );
+        expect(capturedBody).toEqual({
+          secretNames: ['secret-a', 'secret-b'],
+        });
+      });
+    });
+
+    it('sends an empty secretNames array when there are no pull secrets', async () => {
+      let capturedBody: unknown;
+
+      server.use(
+        http.put(
+          '/api/kubernetes/:envId/namespaces/:namespace/service_accounts/:name/image_pull_secrets',
+          async ({ request }) => {
+            capturedBody = await request.json();
+            return new HttpResponse(null, { status: 204 });
+          }
+        )
+      );
+
+      renderRow({ namespace: 'default', name: 'my-sa', imagePullSecrets: [] });
+
+      await userEvent.click(screen.getByRole('button', { name: /edit/i }));
+      await userEvent.click(screen.getByRole('button', { name: /save/i }));
+
+      await waitFor(() => {
+        expect(capturedBody).toEqual({ secretNames: [] });
+      });
+    });
+  });
+
+  describe('admin vs standard user role', () => {
+    it('admin with registry access can enter edit mode', async () => {
+      vi.mocked(useAuthorizations).mockImplementation(() => ({
+        authorized: true,
+        isLoading: false,
+      }));
+      renderRow({ isSystem: false });
+      await userEvent.click(screen.getByRole('button', { name: /edit/i }));
+      expect(screen.getByRole('button', { name: /save/i })).toBeVisible();
+    });
+
+    it('standard user with write permission but no registry access can also enter edit mode', async () => {
+      vi.mocked(useAuthorizations).mockImplementation((permission) => ({
+        authorized: permission === 'K8sServiceAccountsW',
+        isLoading: false,
+      }));
+      renderRow({ isSystem: false });
+      await userEvent.click(screen.getByRole('button', { name: /edit/i }));
+      expect(screen.getByRole('button', { name: /save/i })).toBeVisible();
+    });
+  });
+});
diff --git a/app/react/kubernetes/more-resources/ServiceAccountsView/ItemView/ImagePullSecretsRow.tsx b/app/react/kubernetes/more-resources/ServiceAccountsView/ItemView/ImagePullSecretsRow.tsx
new file mode 100644
index 0000000..8799448
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ServiceAccountsView/ItemView/ImagePullSecretsRow.tsx
@@ -0,0 +1,288 @@
+import { useMemo, useState } from 'react';
+import { Secret } from 'kubernetes-types/core/v1';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useAuthorizations } from '@/react/hooks/useUser';
+import { useSecrets } from '@/react/kubernetes/configs/queries/useSecrets';
+import { useEnvironmentRegistries } from '@/react/portainer/environments/queries/useEnvironmentRegistries';
+import { Registry } from '@/react/portainer/registries/types/registry';
+
+import { DetailsRow } from '@@/DetailsTable/DetailsRow';
+import { InlineLoader } from '@@/InlineLoader';
+import { Link } from '@@/Link';
+import { DisabledOption } from '@@/form-components/DisabledMultiValue';
+import { Tooltip } from '@@/Tip/Tooltip';
+
+import { useUpdateServiceAccountImagePullSecretsMutation } from '../queries/useUpdateServiceAccountImagePullSecretsMutation';
+
+import { ImagePullSecretsEditor } from './ImagePullSecretsEditor';
+import { ImagePullSecretsList } from './ImagePullSecretsList';
+
+const registryAccessAdminMessage = (
+  <span>
+    This secret is linked to the default service account from the{' '}
+    <Link to="kubernetes.registries" data-cy="registry-access-link">
+      registry access
+    </Link>{' '}
+    settings to allow pods to pull images automatically in this namespace.
+    Update the settings to remove the link.
+  </span>
+);
+
+const registryAccessUserMessage = (
+  <span>
+    This secret is linked to the default service account from the registry
+    access settings to allow pods to pull images automatically in this
+    namespace. Contact your administrator to update the settings.
+  </span>
+);
+
+type ImagePullSecretName = { name: string };
+
+type Props = {
+  namespace: string;
+  name: string;
+  imagePullSecrets: ImagePullSecretName[];
+  isSystem?: boolean;
+};
+
+export function ImagePullSecretsRow({
+  namespace,
+  name,
+  imagePullSecrets,
+  isSystem,
+}: Props) {
+  const isDefaultServiceAccount = name === 'default';
+  const environmentId = useEnvironmentId();
+  const secretsQuery = useSecrets(environmentId, namespace);
+  const secrets = secretsQuery.data ?? [];
+  const { authorized: canEdit } = useAuthorizations('K8sServiceAccountsW');
+  const { authorized: canUpdateRegistryAccess } = useAuthorizations(
+    'PortainerRegistryUpdateAccess'
+  );
+  const updateMutation =
+    useUpdateServiceAccountImagePullSecretsMutation(environmentId);
+
+  const [isEditing, setIsEditing] = useState(false);
+  const [selectedNames, setSelectedNames] = useState<string[]>([]);
+
+  const {
+    currentNames,
+    protectedSecretNames,
+    secretOptions,
+    registryBySecretName,
+    isRegistryDataLoading,
+  } = useImagePullSecretsState({
+    environmentId,
+    namespace,
+    imagePullSecrets,
+    isDefaultServiceAccount,
+    secrets,
+    canUpdateRegistryAccess,
+  });
+  const pullSecretDetails = linkImagePullSecretsToSecrets(
+    secrets,
+    imagePullSecrets,
+    registryBySecretName
+  );
+  const isLoading = secretsQuery.isLoading || isRegistryDataLoading;
+
+  return (
+    <DetailsRow
+      label={
+        <span className="flex items-center">
+          Image pull secrets
+          <Tooltip
+            message={
+              name === 'default' ? (
+                <>
+                  <code>imagePullSecrets</code> from this &apos;default&apos;
+                  service account apply to all <strong>pods</strong> without an
+                  explicit service account in this namespace.
+                </>
+              ) : (
+                <>
+                  These <code>imagePullSecrets</code> are inherited by pods
+                  using this service account.
+                </>
+              )
+            }
+          />
+        </span>
+      }
+    >
+      {isLoading ? (
+        <InlineLoader size="xs">Loading image pull secrets...</InlineLoader>
+      ) : isEditing ? (
+        <ImagePullSecretsEditor
+          selectedNames={selectedNames}
+          secretOptions={secretOptions}
+          protectedSecretNames={protectedSecretNames}
+          isSaving={updateMutation.isLoading}
+          onChange={setSelectedNames}
+          onSave={handleSave}
+          onCancel={handleCancel}
+        />
+      ) : (
+        <ImagePullSecretsList
+          imagePullSecrets={pullSecretDetails}
+          namespace={namespace}
+          isDefaultServiceAccount={isDefaultServiceAccount}
+          canEdit={canEdit}
+          isSystem={isSystem}
+          onEdit={handleEdit}
+        />
+      )}
+    </DetailsRow>
+  );
+
+  function handleEdit() {
+    setSelectedNames(currentNames);
+    setIsEditing(true);
+  }
+
+  function handleCancel() {
+    setIsEditing(false);
+  }
+
+  function handleSave() {
+    updateMutation.mutate(
+      { environmentId, namespace, name, secretNames: selectedNames },
+      { onSuccess: () => setIsEditing(false) }
+    );
+  }
+}
+
+function linkImagePullSecretsToSecrets(
+  secrets: Secret[],
+  secretNames: { name: string }[],
+  registryBySecretName: Record<string, Registry>
+) {
+  return secretNames.map(({ name }) => {
+    const secret = secrets.find((s) => s.metadata?.name === name);
+    return { name, secret, registry: registryBySecretName[name] };
+  });
+}
+
+type UseImagePullSecretsStateArgs = {
+  environmentId: number;
+  namespace: string;
+  imagePullSecrets: ImagePullSecretName[];
+  isDefaultServiceAccount: boolean;
+  secrets: Secret[];
+  canUpdateRegistryAccess: boolean;
+};
+
+/**
+ * Builds the derived state needed by the list and inline editor.
+ * For the default service account, secrets managed by registry access stay
+ * visible but non-removable here because they are configured elsewhere.
+ */
+function useImagePullSecretsState({
+  environmentId,
+  namespace,
+  imagePullSecrets,
+  isDefaultServiceAccount,
+  secrets,
+  canUpdateRegistryAccess,
+}: UseImagePullSecretsStateArgs) {
+  const registryData = useImagePullSecretRegistryData(environmentId, namespace);
+
+  return useMemo(() => {
+    const currentNames = imagePullSecrets.map(({ name }) => name);
+    const linkedDefaultSecretNamesSet = new Set(
+      isDefaultServiceAccount ? registryData.linkedDefaultSecretNames : []
+    );
+    const protectedSecretNames = currentNames.filter((secretName) =>
+      linkedDefaultSecretNamesSet.has(secretName)
+    );
+    const registryDisabledMessage = canUpdateRegistryAccess
+      ? registryAccessAdminMessage
+      : registryAccessUserMessage;
+    const secretOptions: DisabledOption<string>[] = secrets
+      .map((secret) => secret.metadata?.name ?? '')
+      .filter(Boolean)
+      .map((name) => {
+        const isProtected =
+          isDefaultServiceAccount && linkedDefaultSecretNamesSet.has(name);
+
+        return {
+          value: name,
+          label: name,
+          disabled: isProtected,
+          disabledMessage: isProtected ? registryDisabledMessage : undefined,
+        };
+      });
+
+    return {
+      currentNames,
+      protectedSecretNames,
+      secretOptions,
+      registryBySecretName: registryData.registryBySecretName,
+      isRegistryDataLoading: registryData.isLoading,
+    };
+  }, [
+    canUpdateRegistryAccess,
+    imagePullSecrets,
+    isDefaultServiceAccount,
+    registryData.isLoading,
+    registryData.linkedDefaultSecretNames,
+    registryData.registryBySecretName,
+    secrets,
+  ]);
+}
+
+type ImagePullSecretRegistryState = {
+  linkedDefaultSecretNames: string[];
+  registryBySecretName: Record<string, Registry>;
+};
+
+const emptyRegistryState: ImagePullSecretRegistryState = {
+  linkedDefaultSecretNames: [],
+  registryBySecretName: {},
+};
+
+function useImagePullSecretRegistryData(
+  environmentId: number,
+  namespace: string
+) {
+  const registryStateQuery = useEnvironmentRegistries(environmentId, {
+    select: (registries) =>
+      selectImagePullSecretRegistryState(registries, environmentId, namespace),
+  });
+
+  return {
+    ...emptyRegistryState,
+    ...registryStateQuery.data,
+    isLoading: registryStateQuery.isLoading,
+  };
+}
+
+function selectImagePullSecretRegistryState(
+  registries: Registry[],
+  environmentId: number,
+  namespace: string
+): ImagePullSecretRegistryState {
+  return registries.reduce<ImagePullSecretRegistryState>((state, registry) => {
+    const secretName = getRegistrySecretName(registry.Id);
+    const isLinkedToDefaultSA =
+      registry.RegistryAccesses?.[environmentId]?.Namespaces?.includes(
+        namespace
+      );
+
+    return {
+      linkedDefaultSecretNames: isLinkedToDefaultSA
+        ? [...state.linkedDefaultSecretNames, secretName]
+        : state.linkedDefaultSecretNames,
+      registryBySecretName: {
+        ...state.registryBySecretName,
+        [secretName]: registry,
+      },
+    };
+  }, emptyRegistryState);
+}
+
+function getRegistrySecretName(registryId: Registry['Id']) {
+  // Registry access creates image pull secrets using this generated name.
+  return `registry-${registryId}`;
+}
diff --git a/app/react/kubernetes/more-resources/ServiceAccountsView/ItemView/ServiceAccountDetailsWidget.test.tsx b/app/react/kubernetes/more-resources/ServiceAccountsView/ItemView/ServiceAccountDetailsWidget.test.tsx
new file mode 100644
index 0000000..22a1437
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ServiceAccountsView/ItemView/ServiceAccountDetailsWidget.test.tsx
@@ -0,0 +1,178 @@
+import { render, screen } from '@testing-library/react';
+import { vi } from 'vitest';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { ReactNode } from 'react';
+
+import { useServiceAccount } from '../queries/useServiceAccount';
+
+import { ServiceAccountDetailsWidget } from './ServiceAccountDetailsWidget';
+
+vi.mock('../queries/useServiceAccount', () => ({
+  useServiceAccount: vi.fn(),
+}));
+
+vi.mock('@/react/hooks/useEnvironmentId', () => ({
+  useEnvironmentId: () => 1,
+}));
+
+vi.mock('@/react/hooks/useUser', () => ({
+  useAuthorizations: () => ({ authorized: false }),
+  useCurrentUser: () => ({ isPureAdmin: true }),
+}));
+
+vi.mock('@/react/kubernetes/configs/queries/useSecrets', () => ({
+  useSecrets: vi.fn(() => ({ data: [] })),
+}));
+
+vi.mock(
+  '@/react/portainer/environments/queries/useEnvironmentRegistries',
+  () => ({
+    useEnvironmentRegistries: vi.fn(() => ({
+      data: {
+        linkedDefaultSecretNames: [],
+        registryBySecretName: {},
+      },
+      isLoading: false,
+    })),
+  })
+);
+
+vi.mock('@@/Link', () => ({
+  Link: ({ children }: { children: ReactNode }) => <span>{children}</span>,
+}));
+
+function renderWidget() {
+  const client = new QueryClient();
+  return render(
+    <QueryClientProvider client={client}>
+      <ServiceAccountDetailsWidget namespace="default" name="my-sa" />
+    </QueryClientProvider>
+  );
+}
+
+describe('ServiceAccountDetailsWidget', () => {
+  it('shows service account name and namespace', () => {
+    vi.mocked(useServiceAccount).mockReturnValue({
+      data: {
+        name: 'my-sa',
+        namespace: 'default',
+        isSystem: false,
+        uid: '',
+        creationDate: '',
+      },
+      isLoading: false,
+    } as unknown as ReturnType<typeof useServiceAccount>);
+
+    renderWidget();
+    expect(screen.getByText('my-sa')).toBeInTheDocument();
+    expect(screen.getByText('default')).toBeInTheDocument();
+  });
+
+  it('shows image pull secret badges', () => {
+    vi.mocked(useServiceAccount).mockReturnValue({
+      data: {
+        name: 'my-sa',
+        namespace: 'default',
+        isSystem: false,
+        uid: '',
+        creationDate: '',
+        imagePullSecrets: [{ name: 'registry-creds' }],
+      },
+      isLoading: false,
+    } as unknown as ReturnType<typeof useServiceAccount>);
+
+    renderWidget();
+    expect(screen.getByText('registry-creds')).toBeInTheDocument();
+  });
+
+  it('shows the empty state when there are no image pull secrets', () => {
+    vi.mocked(useServiceAccount).mockReturnValue({
+      data: {
+        name: 'my-sa',
+        namespace: 'default',
+        isSystem: false,
+        uid: '',
+        creationDate: '',
+        imagePullSecrets: [],
+      },
+      isLoading: false,
+    } as unknown as ReturnType<typeof useServiceAccount>);
+
+    renderWidget();
+    expect(
+      screen.getByText(/No image pull secrets configured\./)
+    ).toBeInTheDocument();
+  });
+
+  it('truncates image pull secrets beyond the visible limit and shows overflow badge', () => {
+    const secrets = Array.from({ length: 7 }, (_, i) => ({
+      name: `secret-${i}`,
+    }));
+    vi.mocked(useServiceAccount).mockReturnValue({
+      data: {
+        name: 'my-sa',
+        namespace: 'default',
+        isSystem: false,
+        uid: '',
+        creationDate: '',
+        imagePullSecrets: secrets,
+      },
+      isLoading: false,
+    } as unknown as ReturnType<typeof useServiceAccount>);
+
+    renderWidget();
+    expect(screen.getByText('+ 2 more')).toBeInTheDocument();
+    expect(screen.queryByText('secret-5')).not.toBeInTheDocument();
+  });
+
+  it('shows automount token as Disabled when explicitly false', () => {
+    vi.mocked(useServiceAccount).mockReturnValue({
+      data: {
+        name: 'my-sa',
+        namespace: 'default',
+        isSystem: false,
+        uid: '',
+        creationDate: '',
+        automountServiceAccountToken: false,
+      },
+      isLoading: false,
+    } as unknown as ReturnType<typeof useServiceAccount>);
+
+    renderWidget();
+    expect(screen.getByText('Disabled')).toBeInTheDocument();
+  });
+
+  it('shows automount token as Enabled when not set', () => {
+    vi.mocked(useServiceAccount).mockReturnValue({
+      data: {
+        name: 'my-sa',
+        namespace: 'default',
+        isSystem: false,
+        uid: '',
+        creationDate: '',
+      },
+      isLoading: false,
+    } as unknown as ReturnType<typeof useServiceAccount>);
+
+    renderWidget();
+    expect(screen.getByText('Enabled')).toBeInTheDocument();
+  });
+
+  it('shows SystemBadge for system service accounts', () => {
+    vi.mocked(useServiceAccount).mockReturnValue({
+      data: {
+        name: 'default',
+        namespace: 'kube-system',
+        isSystem: true,
+        uid: '',
+        creationDate: '',
+      },
+      isLoading: false,
+    } as unknown as ReturnType<typeof useServiceAccount>);
+
+    renderWidget();
+    const systemBadges = screen.getAllByRole('status');
+    expect(systemBadges).toHaveLength(2);
+    expect(systemBadges[0]).toHaveTextContent('System');
+  });
+});
diff --git a/app/react/kubernetes/more-resources/ServiceAccountsView/ItemView/ServiceAccountDetailsWidget.tsx b/app/react/kubernetes/more-resources/ServiceAccountsView/ItemView/ServiceAccountDetailsWidget.tsx
new file mode 100644
index 0000000..b2bb098
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ServiceAccountsView/ItemView/ServiceAccountDetailsWidget.tsx
@@ -0,0 +1,77 @@
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+
+import { SystemBadge } from '@@/Badge/SystemBadge';
+import { DetailsRow } from '@@/DetailsTable/DetailsRow';
+import { DetailsTable } from '@@/DetailsTable/DetailsTable';
+import { Link } from '@@/Link';
+import { Tooltip } from '@@/Tip/Tooltip';
+import { Widget, WidgetBody } from '@@/Widget';
+
+import { useServiceAccount } from '../queries/useServiceAccount';
+
+import { ImagePullSecretsRow } from './ImagePullSecretsRow';
+
+type Props = { namespace: string; name: string };
+
+export function ServiceAccountDetailsWidget({ namespace, name }: Props) {
+  const environmentId = useEnvironmentId();
+  const serviceAccountQuery = useServiceAccount(environmentId, namespace, name);
+  const { data: serviceAccount } = serviceAccountQuery;
+  const { isLoading } = serviceAccountQuery;
+
+  return (
+    <div className="row">
+      <div className="col-sm-12">
+        <Widget>
+          <WidgetBody loading={isLoading}>
+            <DetailsTable
+              dataCy="k8sSADetail-table"
+              className="[&_td:first-child]:w-2/5"
+            >
+              <DetailsRow label="Name">
+                {serviceAccount?.name}
+                {serviceAccount?.isSystem && <SystemBadge className="ml-1" />}
+              </DetailsRow>
+              <DetailsRow label="Namespace">
+                <Link
+                  to="kubernetes.resourcePools.resourcePool"
+                  params={{ id: namespace }}
+                  data-cy="namespace-link"
+                >
+                  {namespace}
+                </Link>
+                {serviceAccount?.isSystem && <SystemBadge className="ml-1" />}
+              </DetailsRow>
+              <DetailsRow label="Creation date">
+                {serviceAccount?.creationDate
+                  ? new Date(serviceAccount.creationDate).toLocaleString()
+                  : '-'}
+              </DetailsRow>
+              <DetailsRow
+                label={
+                  <>
+                    Automount token
+                    <Tooltip message="Controls whether pods automatically receive an API token for cluster access. Disabling this reduces attack surface for workloads that don't need Kubernetes API access. Individual pods can still override this setting." />
+                  </>
+                }
+              >
+                <span className="flex items-center">
+                  {serviceAccount?.automountServiceAccountToken === false
+                    ? 'Disabled'
+                    : 'Enabled'}
+                </span>
+              </DetailsRow>
+
+              <ImagePullSecretsRow
+                namespace={namespace}
+                name={name}
+                imagePullSecrets={serviceAccount?.imagePullSecrets ?? []}
+                isSystem={serviceAccount?.isSystem}
+              />
+            </DetailsTable>
+          </WidgetBody>
+        </Widget>
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/kubernetes/more-resources/ServiceAccountsView/ItemView/ServiceAccountView.test.tsx b/app/react/kubernetes/more-resources/ServiceAccountsView/ItemView/ServiceAccountView.test.tsx
new file mode 100644
index 0000000..561cb1a
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ServiceAccountsView/ItemView/ServiceAccountView.test.tsx
@@ -0,0 +1,83 @@
+import { render, screen } from '@testing-library/react';
+import { vi } from 'vitest';
+import { ReactNode } from 'react';
+
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { UserViewModel } from '@/portainer/models/user';
+
+import { ServiceAccountView } from './ServiceAccountView';
+
+let mockParams: {
+  endpointId: number;
+  namespace: string;
+  name: string;
+  tab?: string;
+} = { endpointId: 1, namespace: 'default', name: 'my-sa' };
+
+vi.mock('@@/Link', () => ({
+  Link: ({
+    children,
+    ...props
+  }: {
+    children: ReactNode;
+    [key: string]: unknown;
+  }) => <a {...props}>{children}</a>,
+}));
+
+vi.mock('@uirouter/react', async (importOriginal: () => Promise<object>) => {
+  const actual = await importOriginal();
+  return {
+    ...(actual as object),
+    useCurrentStateAndParams: () => ({ params: mockParams }),
+  };
+});
+
+vi.mock('./ServiceAccountDetailsWidget', () => ({
+  ServiceAccountDetailsWidget: () => (
+    <div data-testid="sa-details">Details Widget</div>
+  ),
+}));
+
+vi.mock('./ServiceAccountYAMLEditor', () => ({
+  ServiceAccountYAMLEditor: () => (
+    <div data-testid="yaml-view">YAML Editor</div>
+  ),
+}));
+
+vi.mock('@/react/hooks/useEnvironmentId', () => ({
+  useEnvironmentId: () => 1,
+}));
+
+function getWrapped() {
+  const user = new UserViewModel({ Username: 'admin' });
+  const routerConfig = [{ name: 'root', url: '/' }];
+  return withTestQueryProvider(
+    withUserProvider(
+      withTestRouter(ServiceAccountView, {
+        route: 'root',
+        stateConfig: routerConfig,
+      }),
+      user
+    )
+  );
+}
+
+describe('ServiceAccountView', () => {
+  beforeEach(() => {
+    mockParams = { endpointId: 1, namespace: 'default', name: 'my-sa' };
+  });
+
+  it('renders with page title', () => {
+    const Wrapped = getWrapped();
+    render(<Wrapped />);
+    expect(screen.getByText('Service account details')).toBeInTheDocument();
+  });
+
+  it('renders service account name in breadcrumb', () => {
+    const Wrapped = getWrapped();
+    render(<Wrapped />);
+    expect(screen.getByText('my-sa')).toBeInTheDocument();
+  });
+});
diff --git a/app/react/kubernetes/more-resources/ServiceAccountsView/ItemView/ServiceAccountView.tsx b/app/react/kubernetes/more-resources/ServiceAccountsView/ItemView/ServiceAccountView.tsx
new file mode 100644
index 0000000..aec0810
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ServiceAccountsView/ItemView/ServiceAccountView.tsx
@@ -0,0 +1,54 @@
+import { useCurrentStateAndParams } from '@uirouter/react';
+import { Code, User } from 'lucide-react';
+
+import { PageHeader } from '@@/PageHeader';
+import { WidgetTabs, useCurrentTabIndex, Tab } from '@@/Widget/WidgetTabs';
+
+import { ServiceAccountDetailsWidget } from './ServiceAccountDetailsWidget';
+import { ServiceAccountYAMLEditor } from './ServiceAccountYAMLEditor';
+
+export function ServiceAccountView() {
+  const {
+    params: { namespace, name },
+  } = useCurrentStateAndParams();
+
+  const tabs: Tab[] = [
+    {
+      name: 'Service account',
+      icon: User,
+      widget: <ServiceAccountDetailsWidget namespace={namespace} name={name} />,
+      selectedTabParam: 'service-account',
+    },
+    {
+      name: 'YAML',
+      icon: Code,
+      widget: <ServiceAccountYAMLEditor />,
+      selectedTabParam: 'YAML',
+    },
+  ];
+
+  const currentTabIndex = useCurrentTabIndex(tabs);
+
+  return (
+    <>
+      <PageHeader
+        title="Service account details"
+        breadcrumbs={[
+          {
+            label: 'Service accounts',
+            link: 'kubernetes.moreResources.serviceAccounts',
+          },
+          {
+            label: namespace,
+            link: 'kubernetes.resourcePools.resourcePool',
+            linkParams: { id: namespace },
+          },
+          name,
+        ]}
+        reload
+      />
+      <WidgetTabs tabs={tabs} currentTabIndex={currentTabIndex} />
+      {tabs[currentTabIndex].widget}
+    </>
+  );
+}
diff --git a/app/react/kubernetes/more-resources/ServiceAccountsView/ItemView/ServiceAccountYAMLEditor.tsx b/app/react/kubernetes/more-resources/ServiceAccountsView/ItemView/ServiceAccountYAMLEditor.tsx
new file mode 100644
index 0000000..ae9ad04
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ServiceAccountsView/ItemView/ServiceAccountYAMLEditor.tsx
@@ -0,0 +1,64 @@
+import { useQuery } from '@tanstack/react-query';
+import { useCurrentStateAndParams } from '@uirouter/react';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import axios from '@/portainer/services/axios/axios';
+import { parseKubernetesAxiosError } from '@/react/kubernetes/axiosError';
+
+import { Widget, WidgetBody } from '@@/Widget';
+
+import { YAMLInspector } from '../../../components/YAMLInspector';
+
+export function ServiceAccountYAMLEditor() {
+  const {
+    params: { namespace, name },
+  } = useCurrentStateAndParams();
+  const environmentId = useEnvironmentId();
+
+  const {
+    data = '',
+    isLoading,
+    isError,
+  } = useQuery(
+    [environmentId, 'kubernetes', 'serviceaccount-yaml', namespace, name],
+    () => getServiceAccountYAML(environmentId, namespace, name),
+    { enabled: !!namespace && !!name }
+  );
+
+  return (
+    <div className="row">
+      <div className="col-sm-12">
+        <Widget>
+          <WidgetBody>
+            <YAMLInspector
+              identifier={`serviceaccount-${namespace}-${name}`}
+              data={data}
+              isLoading={isLoading}
+              isError={isError}
+              data-cy="serviceaccount-yaml"
+            />
+          </WidgetBody>
+        </Widget>
+      </div>
+    </div>
+  );
+}
+
+async function getServiceAccountYAML(
+  environmentId: number,
+  namespace: string,
+  name: string
+) {
+  try {
+    const { data } = await axios.get<string>(
+      `/endpoints/${environmentId}/kubernetes/api/v1/namespaces/${namespace}/serviceaccounts/${name}`,
+      { headers: { Accept: 'application/yaml' } }
+    );
+    return data;
+  } catch (e) {
+    throw parseKubernetesAxiosError(
+      e,
+      'Unable to retrieve service account YAML'
+    );
+  }
+}
diff --git a/app/react/kubernetes/more-resources/ServiceAccountsView/ServiceAccountsDatatable/ServiceAccountsDatatable.tsx b/app/react/kubernetes/more-resources/ServiceAccountsView/ServiceAccountsDatatable/ServiceAccountsDatatable.tsx
new file mode 100644
index 0000000..2b467ba
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ServiceAccountsView/ServiceAccountsDatatable/ServiceAccountsDatatable.tsx
@@ -0,0 +1,150 @@
+import { User } from 'lucide-react';
+import { useRouter } from '@uirouter/react';
+import { useMemo } from 'react';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { Authorized } from '@/react/hooks/useUser';
+import { notifyError, notifySuccess } from '@/portainer/services/notifications';
+import { SystemResourceDescription } from '@/react/kubernetes/datatables/SystemResourceDescription';
+import {
+  DefaultDatatableSettings,
+  TableSettings as KubeTableSettings,
+} from '@/react/kubernetes/datatables/DefaultDatatableSettings';
+import { CreateFromManifestButton } from '@/react/kubernetes/components/CreateFromManifestButton';
+import { useKubeStore } from '@/react/kubernetes/datatables/default-kube-datatable-store';
+
+import { Datatable, TableSettingsMenu } from '@@/datatables';
+import { DeleteButton } from '@@/buttons/DeleteButton';
+import {
+  type FilteredColumnsTableSettings,
+  filteredColumnsSettings,
+} from '@@/datatables/types';
+
+import { ServiceAccount } from '../types';
+
+import { columns } from './columns';
+import { useDeleteServiceAccountsMutation } from './queries/useDeleteServiceAccountsMutation';
+import { useGetAllServiceAccountsQuery } from './queries/useGetAllServiceAccountsQuery';
+
+const storageKey = 'serviceAccounts';
+interface TableSettings
+  extends KubeTableSettings, FilteredColumnsTableSettings {}
+
+export function ServiceAccountsDatatable() {
+  const environmentId = useEnvironmentId();
+  const tableState = useKubeStore<TableSettings>(
+    storageKey,
+    undefined,
+    (set) => ({
+      ...filteredColumnsSettings(set),
+    })
+  );
+  const serviceAccountsQuery = useGetAllServiceAccountsQuery(environmentId, {
+    refetchInterval: tableState.autoRefreshRate * 1000,
+  });
+  const filteredServiceAccounts = useMemo(
+    () =>
+      tableState.showSystemResources
+        ? serviceAccountsQuery.data
+        : serviceAccountsQuery.data?.filter((sa) => !sa.isSystem),
+    [serviceAccountsQuery.data, tableState.showSystemResources]
+  );
+
+  return (
+    <Datatable
+      dataset={filteredServiceAccounts || []}
+      columns={columns}
+      settingsManager={tableState}
+      isLoading={serviceAccountsQuery.isLoading}
+      emptyContentLabel="No service accounts found"
+      title="Service Accounts"
+      titleIcon={User}
+      getRowId={(row) => row.uid}
+      isRowSelectable={(row) => !row.original.isSystem}
+      renderTableActions={(selectedRows) => (
+        <TableActions selectedItems={selectedRows} />
+      )}
+      renderTableSettings={() => (
+        <TableSettingsMenu>
+          <DefaultDatatableSettings settings={tableState} />
+        </TableSettingsMenu>
+      )}
+      description={
+        <SystemResourceDescription
+          showSystemResources={tableState.showSystemResources}
+        />
+      }
+      data-cy="k8s-service-accounts-datatable"
+    />
+  );
+}
+
+interface SelectedServiceAccount {
+  namespace: string;
+  name: string;
+}
+
+type TableActionsProps = {
+  selectedItems: ServiceAccount[];
+};
+
+function TableActions({ selectedItems }: TableActionsProps) {
+  const environmentId = useEnvironmentId();
+  const deleteServiceAccountsMutation =
+    useDeleteServiceAccountsMutation(environmentId);
+  const router = useRouter();
+
+  return (
+    <Authorized authorizations="K8sServiceAccountsW">
+      <DeleteButton
+        disabled={selectedItems.length === 0}
+        onConfirmed={() => handleRemoveClick(selectedItems)}
+        confirmMessage={
+          <>
+            <p>
+              Are you sure you want to delete the selected service account(s)?
+            </p>
+            <ul className="mt-2 max-h-96 list-inside overflow-hidden overflow-y-auto text-sm">
+              {selectedItems.map((s, index) => (
+                <li key={index}>
+                  {s.namespace}/{s.name}
+                </li>
+              ))}
+            </ul>
+          </>
+        }
+        data-cy="k8s-service-accounts-datatable-remove-button"
+      />
+
+      <CreateFromManifestButton data-cy="k8s-service-accounts-datatable-create-button" />
+    </Authorized>
+  );
+
+  async function handleRemoveClick(serviceAccounts: SelectedServiceAccount[]) {
+    const payload: Record<string, string[]> = {};
+    serviceAccounts.forEach((sa) => {
+      payload[sa.namespace] = payload[sa.namespace] || [];
+      payload[sa.namespace].push(sa.name);
+    });
+
+    deleteServiceAccountsMutation.mutate(
+      { environmentId, data: payload },
+      {
+        onSuccess: () => {
+          notifySuccess(
+            'Service account(s) successfully removed',
+            serviceAccounts.map((sa) => `${sa.namespace}/${sa.name}`).join(', ')
+          );
+          router.stateService.reload();
+        },
+        onError: (error) => {
+          notifyError(
+            'Unable to delete service account(s)',
+            error as Error,
+            serviceAccounts.map((sa) => `${sa.namespace}/${sa.name}`).join(', ')
+          );
+        },
+      }
+    );
+  }
+}
diff --git a/app/react/kubernetes/more-resources/ServiceAccountsView/ServiceAccountsDatatable/columns/created.tsx b/app/react/kubernetes/more-resources/ServiceAccountsView/ServiceAccountsDatatable/columns/created.tsx
new file mode 100644
index 0000000..c9c4562
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ServiceAccountsView/ServiceAccountsDatatable/columns/created.tsx
@@ -0,0 +1,12 @@
+import { formatDate } from '@/portainer/filters/filters';
+
+import { columnHelper } from './helper';
+
+export const created = columnHelper.accessor(
+  (row) => formatDate(row.creationDate),
+  {
+    header: 'Created',
+    id: 'created',
+    cell: ({ getValue }) => getValue(),
+  }
+);
diff --git a/app/react/kubernetes/more-resources/ServiceAccountsView/ServiceAccountsDatatable/columns/helper.ts b/app/react/kubernetes/more-resources/ServiceAccountsView/ServiceAccountsDatatable/columns/helper.ts
new file mode 100644
index 0000000..aacd5a0
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ServiceAccountsView/ServiceAccountsDatatable/columns/helper.ts
@@ -0,0 +1,5 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { ServiceAccount } from '../../types';
+
+export const columnHelper = createColumnHelper<ServiceAccount>();
diff --git a/app/react/kubernetes/more-resources/ServiceAccountsView/ServiceAccountsDatatable/columns/index.tsx b/app/react/kubernetes/more-resources/ServiceAccountsView/ServiceAccountsDatatable/columns/index.tsx
new file mode 100644
index 0000000..006a506
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ServiceAccountsView/ServiceAccountsDatatable/columns/index.tsx
@@ -0,0 +1,5 @@
+import { name } from './name';
+import { namespace } from './namespace';
+import { created } from './created';
+
+export const columns = [name, namespace, created];
diff --git a/app/react/kubernetes/more-resources/ServiceAccountsView/ServiceAccountsDatatable/columns/name.tsx b/app/react/kubernetes/more-resources/ServiceAccountsView/ServiceAccountsDatatable/columns/name.tsx
new file mode 100644
index 0000000..0ba5b5e
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ServiceAccountsView/ServiceAccountsDatatable/columns/name.tsx
@@ -0,0 +1,33 @@
+import { SystemBadge } from '@@/Badge/SystemBadge';
+import { Link } from '@@/Link';
+
+import { columnHelper } from './helper';
+
+export const name = columnHelper.accessor(
+  (row) => {
+    let result = row.name;
+    if (row.isSystem) {
+      result += ' system';
+    }
+    return result;
+  },
+  {
+    header: 'Name',
+    id: 'name',
+    cell: ({ row }) => (
+      <div className="flex gap-2">
+        <Link
+          to="kubernetes.moreResources.serviceAccounts.serviceAccount"
+          params={{
+            namespace: row.original.namespace,
+            name: row.original.name,
+          }}
+          data-cy={`sa-name-link-${row.original.name}`}
+        >
+          {row.original.name}
+        </Link>
+        {row.original.isSystem && <SystemBadge className="ml-auto" />}
+      </div>
+    ),
+  }
+);
diff --git a/app/react/kubernetes/more-resources/ServiceAccountsView/ServiceAccountsDatatable/columns/namespace.tsx b/app/react/kubernetes/more-resources/ServiceAccountsView/ServiceAccountsDatatable/columns/namespace.tsx
new file mode 100644
index 0000000..dc4091d
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ServiceAccountsView/ServiceAccountsDatatable/columns/namespace.tsx
@@ -0,0 +1,36 @@
+import { Row } from '@tanstack/react-table';
+
+import { Link } from '@@/Link';
+import { filterHOC } from '@@/datatables/Filter';
+
+import { ServiceAccount } from '../../types';
+
+import { columnHelper } from './helper';
+
+export const namespace = columnHelper.accessor('namespace', {
+  header: 'Namespace',
+  id: 'namespace',
+  cell: ({ row }) => (
+    <Link
+      to="kubernetes.resourcePools.resourcePool"
+      params={{
+        id: row.original.namespace,
+      }}
+      title={row.original.namespace}
+      data-cy={`service-account-namespace-link-${row.original.name}`}
+    >
+      {row.original.namespace}
+    </Link>
+  ),
+  meta: {
+    filter: filterHOC('Filter by namespace'),
+  },
+  enableColumnFilter: true,
+  filterFn: (
+    row: Row<ServiceAccount>,
+    _columnId: string,
+    filterValue: string[]
+  ) =>
+    filterValue.length === 0 ||
+    filterValue.includes(row.original.namespace ?? ''),
+});
diff --git a/app/react/kubernetes/more-resources/ServiceAccountsView/ServiceAccountsDatatable/index.ts b/app/react/kubernetes/more-resources/ServiceAccountsView/ServiceAccountsDatatable/index.ts
new file mode 100644
index 0000000..ce8deb7
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ServiceAccountsView/ServiceAccountsDatatable/index.ts
@@ -0,0 +1 @@
+export { ServiceAccountsDatatable } from './ServiceAccountsDatatable';
diff --git a/app/react/kubernetes/more-resources/ServiceAccountsView/ServiceAccountsDatatable/queries/query-keys.ts b/app/react/kubernetes/more-resources/ServiceAccountsView/ServiceAccountsDatatable/queries/query-keys.ts
new file mode 100644
index 0000000..cdedb0f
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ServiceAccountsView/ServiceAccountsDatatable/queries/query-keys.ts
@@ -0,0 +1,6 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+export const queryKeys = {
+  list: (environmentId: EnvironmentId) =>
+    ['environments', environmentId, 'kubernetes', 'serviceaccounts'] as const,
+};
diff --git a/app/react/kubernetes/more-resources/ServiceAccountsView/ServiceAccountsDatatable/queries/useDeleteServiceAccountsMutation.ts b/app/react/kubernetes/more-resources/ServiceAccountsView/ServiceAccountsDatatable/queries/useDeleteServiceAccountsMutation.ts
new file mode 100644
index 0000000..59dd312
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ServiceAccountsView/ServiceAccountsDatatable/queries/useDeleteServiceAccountsMutation.ts
@@ -0,0 +1,33 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { withError } from '@/react-tools/react-query';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { queryKeys } from './query-keys';
+
+export function useDeleteServiceAccountsMutation(environmentId: EnvironmentId) {
+  const queryClient = useQueryClient();
+  return useMutation(deleteServiceAccounts, {
+    onSuccess: () =>
+      queryClient.invalidateQueries(queryKeys.list(environmentId)),
+    ...withError('Unable to delete service accounts'),
+  });
+}
+
+export async function deleteServiceAccounts({
+  environmentId,
+  data,
+}: {
+  environmentId: EnvironmentId;
+  data: Record<string, string[]>;
+}) {
+  try {
+    return await axios.post(
+      `kubernetes/${environmentId}/service_accounts/delete`,
+      data
+    );
+  } catch (e) {
+    throw parseAxiosError(e, `Unable to delete service accounts`);
+  }
+}
diff --git a/app/react/kubernetes/more-resources/ServiceAccountsView/ServiceAccountsDatatable/queries/useGetAllServiceAccountsQuery.ts b/app/react/kubernetes/more-resources/ServiceAccountsView/ServiceAccountsDatatable/queries/useGetAllServiceAccountsQuery.ts
new file mode 100644
index 0000000..f45984d
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ServiceAccountsView/ServiceAccountsDatatable/queries/useGetAllServiceAccountsQuery.ts
@@ -0,0 +1,38 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { withError } from '@/react-tools/react-query';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { ServiceAccount } from '../../types';
+
+import { queryKeys } from './query-keys';
+
+export function useGetAllServiceAccountsQuery(
+  environmentId: EnvironmentId,
+  options?: {
+    refetchInterval?: number;
+    enabled?: boolean;
+  }
+) {
+  return useQuery(
+    queryKeys.list(environmentId),
+    async () => getAllServiceAccounts(environmentId),
+    {
+      ...withError('Unable to get service accounts'),
+      ...options,
+    }
+  );
+}
+
+async function getAllServiceAccounts(environmentId: EnvironmentId) {
+  try {
+    const { data: services } = await axios.get<ServiceAccount[]>(
+      `kubernetes/${environmentId}/service_accounts`
+    );
+
+    return services;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to get service accounts');
+  }
+}
diff --git a/app/react/kubernetes/more-resources/ServiceAccountsView/ServiceAccountsView.tsx b/app/react/kubernetes/more-resources/ServiceAccountsView/ServiceAccountsView.tsx
new file mode 100644
index 0000000..441d454
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ServiceAccountsView/ServiceAccountsView.tsx
@@ -0,0 +1,22 @@
+import { useUnauthorizedRedirect } from '@/react/hooks/useUnauthorizedRedirect';
+
+import { PageHeader } from '@@/PageHeader';
+
+import { ServiceAccountsDatatable } from './ServiceAccountsDatatable';
+
+export function ServiceAccountsView() {
+  useUnauthorizedRedirect(
+    { authorizations: ['K8sServiceAccountsW'], adminOnlyCE: true },
+    { to: 'kubernetes.dashboard' }
+  );
+  return (
+    <>
+      <PageHeader
+        title="Service Account list"
+        breadcrumbs="Service Accounts"
+        reload
+      />
+      <ServiceAccountsDatatable />
+    </>
+  );
+}
diff --git a/app/react/kubernetes/more-resources/ServiceAccountsView/index.ts b/app/react/kubernetes/more-resources/ServiceAccountsView/index.ts
new file mode 100644
index 0000000..df4c455
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ServiceAccountsView/index.ts
@@ -0,0 +1 @@
+export { ServiceAccountsView } from './ServiceAccountsView';
diff --git a/app/react/kubernetes/more-resources/ServiceAccountsView/queries/query-keys.ts b/app/react/kubernetes/more-resources/ServiceAccountsView/queries/query-keys.ts
new file mode 100644
index 0000000..f953bff
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ServiceAccountsView/queries/query-keys.ts
@@ -0,0 +1,10 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+export const queryKeys = {
+  base: (environmentId: EnvironmentId) =>
+    ['environments', environmentId, 'kubernetes', 'serviceaccounts'] as const,
+  detail: (environmentId: EnvironmentId, namespace: string, name: string) =>
+    [queryKeys.base(environmentId), namespace, name] as const,
+  yaml: (environmentId: EnvironmentId, namespace: string, name: string) =>
+    [queryKeys.base(environmentId), namespace, name, 'yaml'] as const,
+};
diff --git a/app/react/kubernetes/more-resources/ServiceAccountsView/queries/useServiceAccount.test.tsx b/app/react/kubernetes/more-resources/ServiceAccountsView/queries/useServiceAccount.test.tsx
new file mode 100644
index 0000000..a3f2b14
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ServiceAccountsView/queries/useServiceAccount.test.tsx
@@ -0,0 +1,63 @@
+import { waitFor } from '@testing-library/react';
+import { HttpResponse } from 'msw';
+import { renderHook } from '@testing-library/react-hooks';
+
+import { server, http } from '@/setup-tests/server';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { suppressConsoleLogs } from '@/setup-tests/suppress-console';
+
+import { useServiceAccount } from './useServiceAccount';
+
+vi.mock('@/react/hooks/useEnvironmentId', () => ({
+  useEnvironmentId: () => 1,
+}));
+
+function renderQueryHook(namespace: string, name: string) {
+  return renderHook(() => useServiceAccount(1, namespace, name), {
+    wrapper: withTestQueryProvider(({ children }) => <>{children}</>),
+  });
+}
+
+describe('useServiceAccount', () => {
+  it('returns service account data on success', async () => {
+    const mockSA = { name: 'my-sa', namespace: 'default', uid: 'abc-123' };
+    server.use(
+      http.get(
+        '/api/kubernetes/1/namespaces/default/service_accounts/my-sa',
+        () => HttpResponse.json(mockSA)
+      )
+    );
+
+    const { result } = renderQueryHook('default', 'my-sa');
+    await waitFor(() => expect(result.current.isSuccess).toBe(true));
+    expect(result.current.data?.name).toBe('my-sa');
+  });
+
+  it('sets isError on a 500 response', async () => {
+    const restoreConsole = suppressConsoleLogs();
+    server.use(
+      http.get(
+        '/api/kubernetes/1/namespaces/default/service_accounts/bad',
+        () => HttpResponse.json({ message: 'error' }, { status: 500 })
+      )
+    );
+
+    const { result } = renderQueryHook('default', 'bad');
+    await waitFor(() => expect(result.current.isError).toBe(true));
+    restoreConsole();
+  });
+
+  it('does not fetch when name is empty', async () => {
+    const { result } = renderQueryHook('default', '');
+    await waitFor(() => {
+      expect(result.current.data).toBeUndefined();
+    });
+  });
+
+  it('does not fetch when namespace is empty', async () => {
+    const { result } = renderQueryHook('', 'my-sa');
+    await waitFor(() => {
+      expect(result.current.data).toBeUndefined();
+    });
+  });
+});
diff --git a/app/react/kubernetes/more-resources/ServiceAccountsView/queries/useServiceAccount.ts b/app/react/kubernetes/more-resources/ServiceAccountsView/queries/useServiceAccount.ts
new file mode 100644
index 0000000..79e6fee
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ServiceAccountsView/queries/useServiceAccount.ts
@@ -0,0 +1,49 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { withError } from '@/react-tools/react-query';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { queryKeys } from './query-keys';
+
+export type ServiceAccountDetails = {
+  name: string;
+  uid: string;
+  namespace: string;
+  creationDate: string;
+  isSystem: boolean;
+  automountServiceAccountToken?: boolean;
+  imagePullSecrets?: Array<{ name: string }>;
+  labels?: Record<string, string>;
+  annotations?: Record<string, string>;
+};
+
+export function useServiceAccount(
+  environmentId: EnvironmentId,
+  namespace: string,
+  name: string
+) {
+  return useQuery(
+    queryKeys.detail(environmentId, namespace, name),
+    async () => getServiceAccount(environmentId, namespace, name),
+    {
+      enabled: !!environmentId && !!namespace && !!name,
+      ...withError('Unable to get service account'),
+    }
+  );
+}
+
+async function getServiceAccount(
+  environmentId: EnvironmentId,
+  namespace: string,
+  name: string
+) {
+  try {
+    const { data } = await axios.get<ServiceAccountDetails>(
+      `kubernetes/${environmentId}/namespaces/${namespace}/service_accounts/${name}`
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to get service account');
+  }
+}
diff --git a/app/react/kubernetes/more-resources/ServiceAccountsView/queries/useUpdateServiceAccountImagePullSecretsMutation.ts b/app/react/kubernetes/more-resources/ServiceAccountsView/queries/useUpdateServiceAccountImagePullSecretsMutation.ts
new file mode 100644
index 0000000..72c66ca
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ServiceAccountsView/queries/useUpdateServiceAccountImagePullSecretsMutation.ts
@@ -0,0 +1,46 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { withError } from '@/react-tools/react-query';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { queryKeys } from './query-keys';
+
+type Payload = {
+  environmentId: EnvironmentId;
+  namespace: string;
+  name: string;
+  secretNames: string[];
+};
+
+export function useUpdateServiceAccountImagePullSecretsMutation(
+  environmentId: EnvironmentId
+) {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: updateServiceAccountImagePullSecrets,
+    onSuccess: (_data, { namespace, name }) => {
+      queryClient.invalidateQueries(
+        queryKeys.detail(environmentId, namespace, name)
+      );
+      queryClient.invalidateQueries(queryKeys.base(environmentId));
+    },
+    ...withError('Unable to update image pull secrets'),
+  });
+}
+
+async function updateServiceAccountImagePullSecrets({
+  environmentId,
+  namespace,
+  name,
+  secretNames,
+}: Payload) {
+  try {
+    await axios.put(
+      `kubernetes/${environmentId}/namespaces/${namespace}/service_accounts/${name}/image_pull_secrets`,
+      { secretNames }
+    );
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to update image pull secrets');
+  }
+}
diff --git a/app/react/kubernetes/more-resources/ServiceAccountsView/types.ts b/app/react/kubernetes/more-resources/ServiceAccountsView/types.ts
new file mode 100644
index 0000000..251489a
--- /dev/null
+++ b/app/react/kubernetes/more-resources/ServiceAccountsView/types.ts
@@ -0,0 +1,8 @@
+export type ServiceAccount = {
+  name: string;
+  uid: string;
+  namespace: string;
+  creationDate: string;
+  isSystem: boolean;
+  imagePullSecrets?: Array<{ name: string }>;
+};
diff --git a/app/react/kubernetes/namespaces/AccessView/AccessDatatable/AccessDatatable.tsx b/app/react/kubernetes/namespaces/AccessView/AccessDatatable/AccessDatatable.tsx
new file mode 100644
index 0000000..58324ef
--- /dev/null
+++ b/app/react/kubernetes/namespaces/AccessView/AccessDatatable/AccessDatatable.tsx
@@ -0,0 +1,107 @@
+import { UserX } from 'lucide-react';
+import { useMemo } from 'react';
+import { useCurrentStateAndParams, useRouter } from '@uirouter/react';
+
+import { useUsers } from '@/portainer/users/queries';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useTeams } from '@/react/portainer/users/teams/queries';
+import { PortainerNamespaceAccessesConfigMap } from '@/react/kubernetes/configs/constants';
+import { useConfigMap } from '@/react/kubernetes/configs/queries/useConfigMap';
+import { useUpdateK8sConfigMapMutation } from '@/react/kubernetes/configs/queries/useUpdateK8sConfigMapMutation';
+import { notifyError, notifySuccess } from '@/portainer/services/notifications';
+
+import { createPersistedStore } from '@@/datatables/types';
+import { useTableState } from '@@/datatables/useTableState';
+import { Datatable } from '@@/datatables';
+import { DeleteButton } from '@@/buttons/DeleteButton';
+
+import { parseNamespaceAccesses } from '../parseNamespaceAccesses';
+import { NamespaceAccess } from '../types';
+import { createUnauthorizeAccessConfigMapPayload } from '../createAccessConfigMapPayload';
+
+import { entityType } from './columns/type';
+import { name } from './columns/name';
+
+const tableKey = 'kubernetes_resourcepool_access';
+const columns = [name, entityType];
+const store = createPersistedStore(tableKey);
+
+export function AccessDatatable() {
+  const {
+    params: { id: namespaceName },
+  } = useCurrentStateAndParams();
+  const router = useRouter();
+  const environmentId = useEnvironmentId();
+  const tableState = useTableState(store, tableKey);
+  const usersQuery = useUsers(false, environmentId);
+  const teamsQuery = useTeams(false, environmentId);
+  const accessConfigMapQuery = useConfigMap(
+    environmentId,
+    PortainerNamespaceAccessesConfigMap.namespace,
+    PortainerNamespaceAccessesConfigMap.configMapName
+  );
+  const namespaceAccesses = useMemo(
+    () =>
+      parseNamespaceAccesses(
+        accessConfigMapQuery.data ?? null,
+        namespaceName,
+        usersQuery.data ?? [],
+        teamsQuery.data ?? []
+      ),
+    [accessConfigMapQuery.data, usersQuery.data, teamsQuery.data, namespaceName]
+  );
+  const configMap = accessConfigMapQuery.data;
+
+  const updateConfigMapMutation = useUpdateK8sConfigMapMutation(
+    environmentId,
+    PortainerNamespaceAccessesConfigMap.namespace
+  );
+
+  return (
+    <Datatable
+      data-cy="access-datatable"
+      title="Namespace access"
+      titleIcon={UserX}
+      dataset={namespaceAccesses}
+      isLoading={accessConfigMapQuery.isLoading}
+      columns={columns}
+      settingsManager={tableState}
+      // the user id and team id can be the same, so add the type to the id
+      getRowId={(row) => `${row.type}-${row.id}`}
+      renderTableActions={(selectedItems) => (
+        <DeleteButton
+          isLoading={updateConfigMapMutation.isLoading}
+          loadingText="Removing..."
+          confirmMessage="Are you sure you want to unauthorized the selected users or teams?"
+          onConfirmed={() => handleUpdate(selectedItems)}
+          disabled={
+            selectedItems.length === 0 ||
+            usersQuery.isLoading ||
+            teamsQuery.isLoading ||
+            accessConfigMapQuery.isLoading
+          }
+          data-cy="remove-access-button"
+        />
+      )}
+    />
+  );
+
+  async function handleUpdate(selectedItemsToRemove: Array<NamespaceAccess>) {
+    try {
+      const configMapPayload = createUnauthorizeAccessConfigMapPayload(
+        namespaceAccesses,
+        selectedItemsToRemove,
+        namespaceName,
+        configMap
+      );
+      await updateConfigMapMutation.mutateAsync({
+        configMap: configMapPayload,
+        configMapName: PortainerNamespaceAccessesConfigMap.configMapName,
+      });
+      notifySuccess('Success', 'Namespace access updated');
+      router.stateService.reload();
+    } catch (error) {
+      notifyError('Failed to update namespace access', error as Error);
+    }
+  }
+}
diff --git a/app/react/kubernetes/namespaces/AccessView/AccessDatatable/columns/helper.ts b/app/react/kubernetes/namespaces/AccessView/AccessDatatable/columns/helper.ts
new file mode 100644
index 0000000..19d2607
--- /dev/null
+++ b/app/react/kubernetes/namespaces/AccessView/AccessDatatable/columns/helper.ts
@@ -0,0 +1,5 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { NamespaceAccess } from '../../types';
+
+export const helper = createColumnHelper<NamespaceAccess>();
diff --git a/app/react/kubernetes/namespaces/AccessView/AccessDatatable/columns/name.ts b/app/react/kubernetes/namespaces/AccessView/AccessDatatable/columns/name.ts
new file mode 100644
index 0000000..34b6372
--- /dev/null
+++ b/app/react/kubernetes/namespaces/AccessView/AccessDatatable/columns/name.ts
@@ -0,0 +1,5 @@
+import { helper } from './helper';
+
+export const name = helper.accessor('name', {
+  header: 'Name',
+});
diff --git a/app/react/kubernetes/namespaces/AccessView/AccessDatatable/columns/type.ts b/app/react/kubernetes/namespaces/AccessView/AccessDatatable/columns/type.ts
new file mode 100644
index 0000000..317c499
--- /dev/null
+++ b/app/react/kubernetes/namespaces/AccessView/AccessDatatable/columns/type.ts
@@ -0,0 +1,5 @@
+import { helper } from './helper';
+
+export const entityType = helper.accessor('type', {
+  header: 'Type',
+});
diff --git a/app/react/kubernetes/namespaces/AccessView/AccessView.tsx b/app/react/kubernetes/namespaces/AccessView/AccessView.tsx
new file mode 100644
index 0000000..495c99b
--- /dev/null
+++ b/app/react/kubernetes/namespaces/AccessView/AccessView.tsx
@@ -0,0 +1,39 @@
+import { useCurrentStateAndParams } from '@uirouter/react';
+
+import { useUnauthorizedRedirect } from '@/react/hooks/useUnauthorizedRedirect';
+
+import { PageHeader } from '@@/PageHeader';
+
+import { NamespaceDetailsWidget } from './NamespaceDetailsWidget';
+import { AccessDatatable } from './AccessDatatable/AccessDatatable';
+import { CreateAccessWidget } from './CreateAccessWidget/CreateAccessWidget';
+
+export function AccessView() {
+  const {
+    params: { id: namespaceName },
+  } = useCurrentStateAndParams();
+  useUnauthorizedRedirect(
+    { authorizations: ['K8sResourcePoolDetailsW'] },
+    { to: 'kubernetes.resourcePools' }
+  );
+  return (
+    <>
+      <PageHeader
+        title="Namespace access management"
+        breadcrumbs={[
+          { label: 'Namespaces', link: 'kubernetes.resourcePools' },
+          {
+            label: namespaceName,
+            link: 'kubernetes.resourcePools.resourcePool',
+            linkParams: { id: namespaceName },
+          },
+          'Access management',
+        ]}
+        reload
+      />
+      <NamespaceDetailsWidget />
+      <CreateAccessWidget />
+      <AccessDatatable />
+    </>
+  );
+}
diff --git a/app/react/kubernetes/namespaces/AccessView/CreateAccessWidget/CreateAccessInnerForm.tsx b/app/react/kubernetes/namespaces/AccessView/CreateAccessWidget/CreateAccessInnerForm.tsx
new file mode 100644
index 0000000..25bc739
--- /dev/null
+++ b/app/react/kubernetes/namespaces/AccessView/CreateAccessWidget/CreateAccessInnerForm.tsx
@@ -0,0 +1,199 @@
+import { Form, FormikProps } from 'formik';
+import { Plus } from 'lucide-react';
+import { useMemo } from 'react';
+
+import { useEnvironment } from '@/react/portainer/environments/queries';
+import { useGroup } from '@/react/portainer/environments/environment-groups/queries/useGroup';
+import { useUsers } from '@/portainer/users/queries';
+import { useTeams } from '@/react/portainer/users/teams/queries/useTeams';
+import { User } from '@/portainer/users/types';
+import { Environment } from '@/react/portainer/environments/types';
+import { Team } from '@/react/portainer/users/teams/types';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { EnvironmentGroup } from '@/react/portainer/environments/environment-groups/types';
+import { useIsEdgeAdmin } from '@/react/hooks/useUser';
+
+import { LoadingButton } from '@@/buttons';
+import { FormControl } from '@@/form-components/FormControl';
+import { Link } from '@@/Link';
+
+import { NamespaceAccessUsersSelector } from '../NamespaceAccessUsersSelector';
+import { EnvironmentAccess, NamespaceAccess } from '../types';
+
+import { CreateAccessValues } from './types';
+
+export function CreateAccessInnerForm({
+  values,
+  handleSubmit,
+  setFieldValue,
+  isSubmitting,
+  isValid,
+  dirty,
+  namespaceAccessesGranted,
+}: FormikProps<CreateAccessValues> & {
+  namespaceAccessesGranted: NamespaceAccess[];
+}) {
+  const environmentId = useEnvironmentId();
+  const environmentQuery = useEnvironment(environmentId);
+  const groupQuery = useGroup(environmentQuery.data?.GroupId);
+  const usersQuery = useUsers(false, environmentId);
+  const teamsQuery = useTeams();
+  const availableTeamOrUserOptions: EnvironmentAccess[] =
+    useAvailableTeamOrUserOptions(
+      values.selectedUsersAndTeams,
+      namespaceAccessesGranted,
+      environmentQuery.data,
+      groupQuery.data,
+      usersQuery.data,
+      teamsQuery.data
+    );
+  const isAdminQuery = useIsEdgeAdmin();
+  return (
+    <Form className="form-horizontal" onSubmit={handleSubmit} noValidate>
+      <FormControl label="Select user(s) and/or team(s)">
+        {availableTeamOrUserOptions.length > 0 ||
+        values.selectedUsersAndTeams.length > 0 ? (
+          <NamespaceAccessUsersSelector
+            inputId="users-selector"
+            options={availableTeamOrUserOptions}
+            onChange={(opts) => setFieldValue('selectedUsersAndTeams', opts)}
+            value={values.selectedUsersAndTeams}
+            dataCy="namespaceAccess-usersSelector"
+          />
+        ) : (
+          <span className="small text-muted pt-2">
+            No user or team access has been set on the environment.
+            {isAdminQuery.isAdmin && (
+              <>
+                {' '}
+                Head over to the{' '}
+                <Link
+                  to="portainer.endpoints"
+                  data-cy="namespaceAccess-environmentsLink"
+                >
+                  Environments view
+                </Link>{' '}
+                to manage them.
+              </>
+            )}
+          </span>
+        )}
+      </FormControl>
+      <div className="form-group mt-5">
+        <div className="col-sm-12">
+          <LoadingButton
+            disabled={!isValid || !dirty}
+            data-cy="namespaceAccess-createAccessButton"
+            isLoading={isSubmitting}
+            loadingText="Creating access..."
+            icon={Plus}
+            className="!ml-0"
+          >
+            Create access
+          </LoadingButton>
+        </div>
+      </div>
+    </Form>
+  );
+}
+
+/**
+ * Returns the team and user options that can be added to the namespace, excluding the ones that already have access.
+ */
+function useAvailableTeamOrUserOptions(
+  selectedAccesses: EnvironmentAccess[],
+  namespaceAccessesGranted: NamespaceAccess[],
+  environment?: Environment,
+  group?: EnvironmentGroup,
+  users?: User[],
+  teams?: Team[]
+) {
+  return useMemo(() => {
+    // get unique users and teams from environment accesses (the keys are the IDs)
+    const environmentAccessPolicies = environment?.UserAccessPolicies ?? {};
+    const environmentTeamAccessPolicies = environment?.TeamAccessPolicies ?? {};
+    const environmentGroupAccessPolicies = group?.UserAccessPolicies ?? {};
+    const environmentGroupTeamAccessPolicies = group?.TeamAccessPolicies ?? {};
+
+    // get all users that have access to the environment
+    const userAccessPolicies = {
+      ...environmentAccessPolicies,
+      ...environmentGroupAccessPolicies,
+    };
+    const uniqueUserIds = new Set(Object.keys(userAccessPolicies));
+    const userAccessOptions: EnvironmentAccess[] = Array.from(uniqueUserIds)
+      .map((id) => {
+        const userId = parseInt(id, 10);
+        const user = users?.find((u) => u.Id === userId);
+        if (!user) {
+          return null;
+        }
+        // role from the userAccessPolicies is used by default, if not found, role from the environmentTeamAccessPolicies is used
+        const userAccessPolicy =
+          environmentAccessPolicies[userId] ??
+          environmentGroupAccessPolicies[userId];
+        const userAccess: EnvironmentAccess = {
+          id: user?.Id,
+          name: user?.Username,
+          type: 'user',
+          role: {
+            name: 'Standard user',
+            id: userAccessPolicy?.RoleId,
+          },
+        };
+        return userAccess;
+      })
+      .filter((u) => u !== null);
+
+    // get all teams that have access to the environment
+    const teamAccessPolicies = {
+      ...environmentTeamAccessPolicies,
+      ...environmentGroupTeamAccessPolicies,
+    };
+    const uniqueTeamIds = new Set(Object.keys(teamAccessPolicies));
+    const teamAccessOptions: EnvironmentAccess[] = Array.from(uniqueTeamIds)
+      .map((id) => {
+        const teamId = parseInt(id, 10);
+        const team = teams?.find((t) => t.Id === teamId);
+        if (!team) {
+          return null;
+        }
+        const teamAccessPolicy =
+          environmentTeamAccessPolicies[teamId] ??
+          environmentGroupTeamAccessPolicies[teamId];
+        const teamAccess: EnvironmentAccess = {
+          id: team?.Id,
+          name: team?.Name,
+          type: 'team',
+          role: {
+            name: 'Standard user',
+            id: teamAccessPolicy?.RoleId,
+          },
+        };
+        return teamAccess;
+      })
+      .filter((t) => t !== null);
+
+    // filter out users and teams that already have access to the namespace
+    const userAndTeamEnvironmentAccesses = [
+      ...userAccessOptions,
+      ...teamAccessOptions,
+    ];
+    const filteredAccessOptions = userAndTeamEnvironmentAccesses.filter(
+      (t) =>
+        !selectedAccesses.some((e) => e.id === t.id && e.type === t.type) &&
+        !namespaceAccessesGranted.some(
+          (e) => e.id === t.id && e.type === t.type
+        )
+    );
+
+    return filteredAccessOptions;
+  }, [
+    namespaceAccessesGranted,
+    selectedAccesses,
+    environment,
+    group,
+    users,
+    teams,
+  ]);
+}
diff --git a/app/react/kubernetes/namespaces/AccessView/CreateAccessWidget/CreateAccessWidget.tsx b/app/react/kubernetes/namespaces/AccessView/CreateAccessWidget/CreateAccessWidget.tsx
new file mode 100644
index 0000000..032fcb1
--- /dev/null
+++ b/app/react/kubernetes/namespaces/AccessView/CreateAccessWidget/CreateAccessWidget.tsx
@@ -0,0 +1,139 @@
+import { UserPlusIcon } from 'lucide-react';
+import { Formik } from 'formik';
+import { useMemo } from 'react';
+import { useCurrentStateAndParams } from '@uirouter/react';
+
+import { useIsRBACEnabled } from '@/react/kubernetes/cluster/useIsRBACEnabled';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { RBACAlert } from '@/react/kubernetes/cluster/ConfigureView/ConfigureForm/RBACAlert';
+import { useUsers } from '@/portainer/users/queries';
+import { PortainerNamespaceAccessesConfigMap } from '@/react/kubernetes/configs/constants';
+import { useConfigMap } from '@/react/kubernetes/configs/queries/useConfigMap';
+import { useTeams } from '@/react/portainer/users/teams/queries';
+import { useUpdateK8sConfigMapMutation } from '@/react/kubernetes/configs/queries/useUpdateK8sConfigMapMutation';
+import { notifyError, notifySuccess } from '@/portainer/services/notifications';
+import { Configuration } from '@/react/kubernetes/configs/types';
+import { useCurrentUser } from '@/react/hooks/useUser';
+
+import { Widget, WidgetBody, WidgetTitle } from '@@/Widget';
+import { TextTip } from '@@/Tip/TextTip';
+
+import { EnvironmentAccess } from '../types';
+import { createAuthorizeAccessConfigMapPayload } from '../createAccessConfigMapPayload';
+import { parseNamespaceAccesses } from '../parseNamespaceAccesses';
+
+import { CreateAccessValues } from './types';
+import { CreateAccessInnerForm } from './CreateAccessInnerForm';
+import { validationSchema } from './createAccess.validation';
+
+export function CreateAccessWidget() {
+  const {
+    params: { id: namespaceName },
+  } = useCurrentStateAndParams();
+  const { user } = useCurrentUser();
+  const environmentId = useEnvironmentId();
+  const isRBACEnabledQuery = useIsRBACEnabled(environmentId);
+  const initialValues: {
+    selectedUsersAndTeams: EnvironmentAccess[];
+  } = {
+    selectedUsersAndTeams: [],
+  };
+  const usersQuery = useUsers(false, environmentId);
+  const teamsQuery = useTeams(false, environmentId);
+  const accessConfigMapQuery = useConfigMap(
+    environmentId,
+    PortainerNamespaceAccessesConfigMap.namespace,
+    PortainerNamespaceAccessesConfigMap.configMapName
+  );
+  const namespaceAccesses = useMemo(
+    () =>
+      parseNamespaceAccesses(
+        accessConfigMapQuery.data ?? null,
+        namespaceName,
+        usersQuery.data ?? [],
+        teamsQuery.data ?? []
+      ),
+    [accessConfigMapQuery.data, usersQuery.data, teamsQuery.data, namespaceName]
+  );
+  const configMap = accessConfigMapQuery.data;
+
+  const updateConfigMapMutation = useUpdateK8sConfigMapMutation(
+    environmentId,
+    PortainerNamespaceAccessesConfigMap.namespace
+  );
+
+  return (
+    <div className="row">
+      <div className="col-sm-12">
+        <Widget aria-label="Create access">
+          <WidgetTitle icon={UserPlusIcon} title="Create access" />
+          <WidgetBody>
+            {isRBACEnabledQuery.data === false && <RBACAlert />}
+            <TextTip className="mb-2" childrenWrapperClassName="text-warning">
+              Adding user access will require the affected user(s) to logout and
+              login for the changes to be taken into account.
+            </TextTip>
+            {isRBACEnabledQuery.data !== false && (
+              <Formik<CreateAccessValues>
+                initialValues={initialValues}
+                enableReinitialize
+                validationSchema={validationSchema}
+                onSubmit={(values, formikHelpers) =>
+                  onSubmit(values, formikHelpers)
+                }
+                validateOnMount
+              >
+                {(formikProps) => (
+                  <CreateAccessInnerForm
+                    // eslint-disable-next-line react/jsx-props-no-spreading
+                    {...formikProps}
+                    namespaceAccessesGranted={namespaceAccesses}
+                  />
+                )}
+              </Formik>
+            )}
+          </WidgetBody>
+        </Widget>
+      </div>
+    </div>
+  );
+
+  async function onSubmit(
+    values: {
+      selectedUsersAndTeams: EnvironmentAccess[];
+    },
+    { resetForm }: { resetForm: () => void }
+  ) {
+    try {
+      const configMapPayload = createAuthorizeAccessConfigMapPayload(
+        namespaceAccesses,
+        values.selectedUsersAndTeams,
+        namespaceName,
+        configMap ?? newConfigMap(user.Username, user.Id)
+      );
+      await updateConfigMapMutation.mutateAsync({
+        configMap: configMapPayload,
+        configMapName: PortainerNamespaceAccessesConfigMap.configMapName,
+      });
+      notifySuccess('Success', 'Namespace access updated');
+      resetForm();
+    } catch (error) {
+      notifyError('Failed to update namespace access', error as Error);
+    }
+  }
+}
+
+function newConfigMap(userName: string, userId: number) {
+  const configMap: Configuration = {
+    Type: 1,
+    UID: '',
+    Name: PortainerNamespaceAccessesConfigMap.configMapName,
+    Namespace: PortainerNamespaceAccessesConfigMap.namespace,
+    Data: { [PortainerNamespaceAccessesConfigMap.accessKey]: '{}' },
+    ConfigurationOwner: userName,
+    ConfigurationOwnerId: `${userId}`,
+    IsUsed: false,
+    Yaml: '',
+  };
+  return configMap;
+}
diff --git a/app/react/kubernetes/namespaces/AccessView/CreateAccessWidget/createAccess.validation.ts b/app/react/kubernetes/namespaces/AccessView/CreateAccessWidget/createAccess.validation.ts
new file mode 100644
index 0000000..1f634a7
--- /dev/null
+++ b/app/react/kubernetes/namespaces/AccessView/CreateAccessWidget/createAccess.validation.ts
@@ -0,0 +1,19 @@
+import { object, array, string, number, SchemaOf, mixed } from 'yup';
+
+import { CreateAccessValues } from './types';
+
+export function validationSchema(): SchemaOf<CreateAccessValues> {
+  return object().shape({
+    selectedUsersAndTeams: array(
+      object().shape({
+        type: mixed().oneOf(['team', 'user']).required(),
+        name: string().required(),
+        id: number().required(),
+        role: object().shape({
+          id: number().required(),
+          name: string().required(),
+        }),
+      })
+    ).min(1),
+  });
+}
diff --git a/app/react/kubernetes/namespaces/AccessView/CreateAccessWidget/types.ts b/app/react/kubernetes/namespaces/AccessView/CreateAccessWidget/types.ts
new file mode 100644
index 0000000..a5421a1
--- /dev/null
+++ b/app/react/kubernetes/namespaces/AccessView/CreateAccessWidget/types.ts
@@ -0,0 +1,5 @@
+import { EnvironmentAccess } from '../types';
+
+export type CreateAccessValues = {
+  selectedUsersAndTeams: EnvironmentAccess[];
+};
diff --git a/app/react/kubernetes/namespaces/AccessView/NamespaceAccessUsersSelector.tsx b/app/react/kubernetes/namespaces/AccessView/NamespaceAccessUsersSelector.tsx
new file mode 100644
index 0000000..1a48bfb
--- /dev/null
+++ b/app/react/kubernetes/namespaces/AccessView/NamespaceAccessUsersSelector.tsx
@@ -0,0 +1,85 @@
+import { User as UserIcon, Users as TeamIcon } from 'lucide-react';
+import { OptionProps, components, MultiValueGenericProps } from 'react-select';
+
+import { Select } from '@@/form-components/ReactSelect';
+
+import { EnvironmentAccess } from './types';
+
+interface Props {
+  name?: string;
+  value: EnvironmentAccess[];
+  onChange(value: readonly EnvironmentAccess[]): void;
+  options: EnvironmentAccess[];
+  dataCy: string;
+  inputId?: string;
+  placeholder?: string;
+}
+
+export function NamespaceAccessUsersSelector({
+  onChange,
+  options,
+  value,
+  dataCy,
+  inputId,
+  name,
+  placeholder,
+}: Props) {
+  return (
+    <Select
+      isMulti
+      name={name}
+      getOptionLabel={(option) => option.name}
+      getOptionValue={(option) => `${option.id}-${option.type}`}
+      options={options}
+      value={value}
+      closeMenuOnSelect={false}
+      onChange={onChange}
+      data-cy={dataCy}
+      id={dataCy}
+      inputId={inputId}
+      placeholder={placeholder}
+      components={{ MultiValueLabel, Option: OptionComponent }}
+    />
+  );
+}
+
+function isOption(option: unknown): option is EnvironmentAccess {
+  return !!option && typeof option === 'object' && 'type' in option;
+}
+
+function OptionComponent({
+  data,
+  ...props
+}: OptionProps<EnvironmentAccess, true>) {
+  return (
+    // eslint-disable-next-line react/jsx-props-no-spreading
+    <components.Option data={data} {...props}>
+      {isOption(data) && <Label option={data} />}
+    </components.Option>
+  );
+}
+
+function MultiValueLabel({
+  data,
+  ...props
+}: MultiValueGenericProps<EnvironmentAccess, true>) {
+  return (
+    // eslint-disable-next-line react/jsx-props-no-spreading
+    <components.MultiValueLabel data={data} {...props}>
+      {isOption(data) && <Label option={data} />}
+    </components.MultiValueLabel>
+  );
+}
+
+function Label({ option }: { option: EnvironmentAccess }) {
+  const Icon = option.type === 'user' ? UserIcon : TeamIcon;
+
+  return (
+    <div className="flex items-center gap-1">
+      <Icon />
+      <span>{option.name}</span>
+      <span>|</span>
+      <span>{option.role.name}</span>
+    </div>
+  );
+}
diff --git a/app/react/kubernetes/namespaces/AccessView/NamespaceDetailsWidget.tsx b/app/react/kubernetes/namespaces/AccessView/NamespaceDetailsWidget.tsx
new file mode 100644
index 0000000..408b443
--- /dev/null
+++ b/app/react/kubernetes/namespaces/AccessView/NamespaceDetailsWidget.tsx
@@ -0,0 +1,29 @@
+import { Layers } from 'lucide-react';
+import { useCurrentStateAndParams } from '@uirouter/react';
+
+import { WidgetTitle, WidgetBody, Widget } from '@@/Widget';
+
+export function NamespaceDetailsWidget() {
+  const {
+    params: { id: namespaceName },
+  } = useCurrentStateAndParams();
+  return (
+    <div className="row">
+      <div className="col-sm-12">
+        <Widget aria-label="Namespace details">
+          <WidgetTitle icon={Layers} title="Namespace" />
+          <WidgetBody>
+            <table className="table">
+              <tbody>
+                <tr>
+                  <td>Name</td>
+                  <td>{namespaceName}</td>
+                </tr>
+              </tbody>
+            </table>
+          </WidgetBody>
+        </Widget>
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/kubernetes/namespaces/AccessView/createAccessConfigMapPayload.ts b/app/react/kubernetes/namespaces/AccessView/createAccessConfigMapPayload.ts
new file mode 100644
index 0000000..1570ee4
--- /dev/null
+++ b/app/react/kubernetes/namespaces/AccessView/createAccessConfigMapPayload.ts
@@ -0,0 +1,90 @@
+import { ConfigMap } from 'kubernetes-types/core/v1';
+import { concat, without } from 'lodash';
+
+import { PortainerNamespaceAccessesConfigMap } from '@/react/kubernetes/configs/constants';
+import { Configuration } from '@/react/kubernetes/configs/types';
+
+import { NamespaceAccess } from './types';
+
+export function createAuthorizeAccessConfigMapPayload(
+  namespaceAccesses: NamespaceAccess[],
+  selectedItems: NamespaceAccess[],
+  namespaceName: string,
+  configMap?: Configuration
+): ConfigMap {
+  const newRemainingAccesses = concat(namespaceAccesses, ...selectedItems);
+  return createAccessConfigMapPayload(
+    newRemainingAccesses,
+    namespaceName,
+    configMap
+  );
+}
+
+export function createUnauthorizeAccessConfigMapPayload(
+  namespaceAccesses: NamespaceAccess[],
+  selectedItems: NamespaceAccess[],
+  namespaceName: string,
+  configMap?: Configuration
+): ConfigMap {
+  const newRemainingAccesses = without(namespaceAccesses, ...selectedItems);
+  return createAccessConfigMapPayload(
+    newRemainingAccesses,
+    namespaceName,
+    configMap
+  );
+}
+
+function createAccessConfigMapPayload(
+  newRemainingAccesses: NamespaceAccess[],
+  namespaceName: string,
+  configMap?: Configuration
+): ConfigMap {
+  const configMapAccessesValue = JSON.parse(
+    configMap?.Data?.[PortainerNamespaceAccessesConfigMap.accessKey] || '{}'
+  );
+  const newNamespaceAccesses = newRemainingAccesses.reduce(
+    (namespaceAccesses, accessItem) => {
+      if (accessItem.type === 'user') {
+        return {
+          ...namespaceAccesses,
+          UserAccessPolicies: {
+            ...namespaceAccesses.UserAccessPolicies,
+            // hardcode to 0, as they use their environment role
+            [`${accessItem.id}`]: { RoleId: 0 },
+          },
+        };
+      }
+      return {
+        ...namespaceAccesses,
+        TeamAccessPolicies: {
+          ...namespaceAccesses.TeamAccessPolicies,
+          // hardcode to 0, as they use their environment role
+          [`${accessItem.id}`]: { RoleId: 0 },
+        },
+      };
+    },
+    {
+      UserAccessPolicies: {},
+      TeamAccessPolicies: {},
+    }
+  );
+  const newConfigMapAccessesValue = {
+    ...configMapAccessesValue,
+    [namespaceName]: newNamespaceAccesses,
+  };
+  const updatedConfigMap: ConfigMap = {
+    metadata: {
+      name: PortainerNamespaceAccessesConfigMap.configMapName,
+      namespace: PortainerNamespaceAccessesConfigMap.namespace,
+      uid: configMap?.UID,
+    },
+    data: {
+      ...configMap?.Data,
+      [PortainerNamespaceAccessesConfigMap.accessKey]: JSON.stringify(
+        newConfigMapAccessesValue
+      ),
+    },
+  };
+
+  return updatedConfigMap;
+}
diff --git a/app/react/kubernetes/namespaces/AccessView/parseNamespaceAccesses.ts b/app/react/kubernetes/namespaces/AccessView/parseNamespaceAccesses.ts
new file mode 100644
index 0000000..a3e373d
--- /dev/null
+++ b/app/react/kubernetes/namespaces/AccessView/parseNamespaceAccesses.ts
@@ -0,0 +1,41 @@
+import { PortainerNamespaceAccessesConfigMap } from '@/react/kubernetes/configs/constants';
+import { User } from '@/portainer/users/types';
+import { Team } from '@/react/portainer/users/teams/types';
+import { Configuration } from '@/react/kubernetes/configs/types';
+
+import { NamespaceAccess, NamespaceAccessesMap } from './types';
+
+export function parseNamespaceAccesses(
+  data: Configuration | null,
+  namespaceName: string,
+  users: User[],
+  teams: Team[]
+) {
+  if (!data) {
+    return [];
+  }
+  const namespacesAccesses: NamespaceAccessesMap = JSON.parse(
+    data?.Data?.[PortainerNamespaceAccessesConfigMap.accessKey] ?? '{}'
+  );
+  const userAccessesIds = Object.keys(
+    namespacesAccesses[namespaceName]?.UserAccessPolicies ?? {}
+  );
+  const userAccesses: NamespaceAccess[] = users
+    .filter((user) => userAccessesIds.includes(`${user.Id}`))
+    .map((user) => ({
+      id: user.Id,
+      name: user.Username,
+      type: 'user',
+    }));
+  const teamAccessesIds = Object.keys(
+    namespacesAccesses[namespaceName]?.TeamAccessPolicies ?? {}
+  );
+  const teamAccesses: NamespaceAccess[] = teams
+    .filter((team) => teamAccessesIds.includes(`${team.Id}`))
+    .map((team) => ({
+      id: team.Id,
+      name: team.Name,
+      type: 'team',
+    }));
+  return [...userAccesses, ...teamAccesses];
+}
diff --git a/app/react/kubernetes/namespaces/AccessView/types.ts b/app/react/kubernetes/namespaces/AccessView/types.ts
new file mode 100644
index 0000000..18b0816
--- /dev/null
+++ b/app/react/kubernetes/namespaces/AccessView/types.ts
@@ -0,0 +1,23 @@
+import {
+  TeamAccessPolicies,
+  UserAccessPolicies,
+} from '@/react/portainer/environments/types';
+
+export type NamespaceAccess = {
+  id: number;
+  name: string;
+  type: 'user' | 'team';
+};
+
+export type EnvironmentAccess = NamespaceAccess & {
+  role: { name: string; id: number };
+};
+
+export interface NamespaceAccesses {
+  UserAccessPolicies?: UserAccessPolicies;
+  TeamAccessPolicies?: TeamAccessPolicies;
+}
+
+export interface NamespaceAccessesMap {
+  [key: string]: NamespaceAccesses;
+}
diff --git a/app/react/kubernetes/namespaces/CreateView/CreateNamespaceForm.tsx b/app/react/kubernetes/namespaces/CreateView/CreateNamespaceForm.tsx
new file mode 100644
index 0000000..d09f5a7
--- /dev/null
+++ b/app/react/kubernetes/namespaces/CreateView/CreateNamespaceForm.tsx
@@ -0,0 +1,121 @@
+import { Formik } from 'formik';
+import { useRouter } from '@uirouter/react';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { notifySuccess } from '@/portainer/services/notifications';
+import { useCurrentEnvironment } from '@/react/hooks/useCurrentEnvironment';
+import { useEnvironmentRegistries } from '@/react/portainer/environments/queries/useEnvironmentRegistries';
+import { useCurrentUser } from '@/react/hooks/useUser';
+
+import { Widget, WidgetBody } from '@@/Widget';
+
+import { useIngressControllerClassMapQuery } from '../../cluster/ingressClass/useIngressControllerClassMap';
+import { NamespaceInnerForm } from '../components/NamespaceForm/NamespaceInnerForm';
+import { useNamespacesQuery } from '../queries/useNamespacesQuery';
+import { useClusterResourceLimitsQuery } from '../queries/useResourceLimitsQuery';
+import { useCreateNamespaceMutation } from '../queries/useCreateNamespaceMutation';
+import { getNamespaceValidationSchema } from '../components/NamespaceForm/NamespaceForm.validation';
+import { transformFormValuesToNamespacePayload } from '../components/NamespaceForm/utils';
+import {
+  NamespaceFormValues,
+  NamespacePayload,
+  UpdateRegistryPayload,
+} from '../types';
+
+export function CreateNamespaceForm() {
+  const router = useRouter();
+  const environmentId = useEnvironmentId();
+  const { data: environment, ...environmentQuery } = useCurrentEnvironment();
+  const resourceLimitsQuery = useClusterResourceLimitsQuery(environmentId);
+  const { data: registries } = useEnvironmentRegistries(environmentId, {
+    hideDefault: true,
+  });
+  const { user } = useCurrentUser();
+  // for namespace create, show ingress classes that are allowed in the current environment.
+  // the ingressClasses show the none option, so we don't need to add it here.
+  const { data: ingressClasses } = useIngressControllerClassMapQuery({
+    environmentId,
+    allowedOnly: true,
+  });
+
+  const { data: namespaces } = useNamespacesQuery(environmentId);
+  const namespaceNames = Object.keys(namespaces || {});
+
+  const createNamespaceMutation = useCreateNamespaceMutation(environmentId);
+
+  if (resourceLimitsQuery.isLoading || environmentQuery.isLoading) {
+    return null;
+  }
+
+  const memoryLimit = resourceLimitsQuery.data?.Memory ?? 0;
+  const cpuLimit = resourceLimitsQuery.data?.CPU ?? 0;
+  const initialValues: NamespaceFormValues = {
+    name: '',
+    ingressClasses: ingressClasses ?? [],
+    resourceQuota: {
+      enabled: false,
+      memory: '0',
+      cpu: '0',
+    },
+    registries: [],
+  };
+
+  return (
+    <Widget>
+      <WidgetBody>
+        <Formik
+          enableReinitialize
+          initialValues={initialValues}
+          onSubmit={(values) => handleSubmit(values, user.Username)}
+          validateOnMount
+          validationSchema={getNamespaceValidationSchema(
+            memoryLimit,
+            cpuLimit,
+            namespaceNames
+          )}
+        >
+          {NamespaceInnerForm}
+        </Formik>
+      </WidgetBody>
+    </Widget>
+  );
+
+  function handleSubmit(values: NamespaceFormValues, userName: string) {
+    const createNamespacePayload: NamespacePayload =
+      transformFormValuesToNamespacePayload(values, userName);
+    const updateRegistriesPayload: UpdateRegistryPayload[] =
+      values.registries.flatMap((registryFormValues) => {
+        // find the matching registry from the cluster registries
+        const selectedRegistry = registries?.find(
+          (registry) => registryFormValues.Id === registry.Id
+        );
+        if (!selectedRegistry) {
+          return [];
+        }
+        const envNamespacesWithAccess =
+          selectedRegistry.RegistryAccesses?.[`${environmentId}`]?.Namespaces ||
+          [];
+        return {
+          Id: selectedRegistry.Id,
+          Namespaces: [...envNamespacesWithAccess, values.name],
+        };
+      });
+
+    createNamespaceMutation.mutate(
+      {
+        createNamespacePayload,
+        updateRegistriesPayload,
+        namespaceIngressControllerPayload: values.ingressClasses,
+      },
+      {
+        onSuccess: () => {
+          notifySuccess(
+            'Success',
+            `Namespace '${values.name}' created successfully`
+          );
+          router.stateService.go('kubernetes.resourcePools');
+        },
+      }
+    );
+  }
+}
diff --git a/app/react/kubernetes/namespaces/CreateView/CreateNamespaceView.tsx b/app/react/kubernetes/namespaces/CreateView/CreateNamespaceView.tsx
new file mode 100644
index 0000000..0710982
--- /dev/null
+++ b/app/react/kubernetes/namespaces/CreateView/CreateNamespaceView.tsx
@@ -0,0 +1,43 @@
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { isBE } from '@/react/portainer/feature-flags/feature-flags.service';
+import { useUnauthorizedRedirect } from '@/react/hooks/useUnauthorizedRedirect';
+
+import { PageHeader } from '@@/PageHeader';
+
+import { CreateNamespaceForm } from './CreateNamespaceForm';
+
+export function CreateNamespaceView() {
+  const environmentId = useEnvironmentId();
+
+  useUnauthorizedRedirect(
+    {
+      authorizations: 'K8sResourcePoolsW',
+      adminOnlyCE: !isBE,
+    },
+    {
+      to: 'kubernetes.resourcePools',
+      params: {
+        id: environmentId,
+      },
+    }
+  );
+
+  return (
+    <div className="form-horizontal">
+      <PageHeader
+        title="Create a namespace"
+        breadcrumbs={[
+          { label: 'Namespaces', link: 'kubernetes.resourcePools' },
+          'Create a namespace',
+        ]}
+        reload
+      />
+
+      <div className="row">
+        <div className="col-sm-12">
+          <CreateNamespaceForm />
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/kubernetes/namespaces/CreateView/index.tsx b/app/react/kubernetes/namespaces/CreateView/index.tsx
new file mode 100644
index 0000000..b3f5ca6
--- /dev/null
+++ b/app/react/kubernetes/namespaces/CreateView/index.tsx
@@ -0,0 +1 @@
+export { CreateNamespaceView } from './CreateNamespaceView';
diff --git a/app/react/kubernetes/namespaces/CreateView/types.ts b/app/react/kubernetes/namespaces/CreateView/types.ts
new file mode 100644
index 0000000..7b41028
--- /dev/null
+++ b/app/react/kubernetes/namespaces/CreateView/types.ts
@@ -0,0 +1,25 @@
+import { Registry } from '@/react/portainer/registries/types/registry';
+
+import { IngressControllerClassMap } from '../../cluster/ingressClass/types';
+import {
+  ResourceQuotaFormValues,
+  ResourceQuotaPayload,
+} from '../components/NamespaceForm/ResourceQuotaFormSection/types';
+
+export type CreateNamespaceFormValues = {
+  name: string;
+  resourceQuota: ResourceQuotaFormValues;
+  ingressClasses: IngressControllerClassMap[];
+  registries: Registry[];
+};
+
+export type CreateNamespacePayload = {
+  Name: string;
+  Owner: string;
+  ResourceQuota: ResourceQuotaPayload;
+};
+
+export type UpdateRegistryPayload = {
+  Id: number;
+  Namespaces: string[];
+};
diff --git a/app/react/kubernetes/namespaces/ItemView/ConfirmUpdateNamespace.tsx b/app/react/kubernetes/namespaces/ItemView/ConfirmUpdateNamespace.tsx
new file mode 100644
index 0000000..00fa810
--- /dev/null
+++ b/app/react/kubernetes/namespaces/ItemView/ConfirmUpdateNamespace.tsx
@@ -0,0 +1,45 @@
+import { ModalType } from '@@/modals';
+import { confirm } from '@@/modals/confirm';
+import { buildConfirmButton } from '@@/modals/utils';
+
+type Warnings = {
+  quota: boolean;
+  ingress: boolean;
+  registries: boolean;
+};
+
+export function confirmUpdateNamespace(warnings: Warnings) {
+  const message = (
+    <>
+      {warnings.quota && (
+        <p>
+          Reducing the quota assigned to an &quot;in-use&quot; namespace may
+          have unintended consequences, including preventing running
+          applications from functioning correctly and potentially even blocking
+          them from running at all.
+        </p>
+      )}
+      {warnings.ingress && (
+        <p>
+          Deactivating ingresses may cause applications to be unaccessible. All
+          ingress configurations from affected applications will be removed.
+        </p>
+      )}
+      {warnings.registries && (
+        <p>
+          Some registries you removed might be used by one or more applications
+          inside this environment. Removing the registries access could lead to
+          a service interruption for these applications.
+        </p>
+      )}
+      <p>Are you sure you want to continue?</p>
+    </>
+  );
+
+  return confirm({
+    title: 'Are you sure?',
+    modalType: ModalType.Warn,
+    message,
+    confirmButton: buildConfirmButton('Update', 'primary'),
+  });
+}
diff --git a/app/react/kubernetes/namespaces/ItemView/NamespaceAppsDatatable.tsx b/app/react/kubernetes/namespaces/ItemView/NamespaceAppsDatatable.tsx
new file mode 100644
index 0000000..e66e9f8
--- /dev/null
+++ b/app/react/kubernetes/namespaces/ItemView/NamespaceAppsDatatable.tsx
@@ -0,0 +1,58 @@
+import { Code } from 'lucide-react';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+
+import { Datatable, TableSettingsMenu } from '@@/datatables';
+import { TableSettingsMenuAutoRefresh } from '@@/datatables/TableSettingsMenuAutoRefresh';
+import { useTableStateWithStorage } from '@@/datatables/useTableState';
+import {
+  BasicTableSettings,
+  refreshableSettings,
+  RefreshableTableSettings,
+} from '@@/datatables/types';
+
+import { useApplications } from '../../applications/queries/useApplications';
+
+import { useColumns } from './columns';
+
+interface TableSettings extends BasicTableSettings, RefreshableTableSettings {}
+
+export function NamespaceAppsDatatable({ namespace }: { namespace: string }) {
+  const environmentId = useEnvironmentId();
+  const tableState = useTableStateWithStorage<TableSettings>(
+    'kube-namespace-apps',
+    'Name',
+    (set) => ({
+      ...refreshableSettings(set),
+    })
+  );
+
+  const applicationsQuery = useApplications(environmentId, {
+    refetchInterval: tableState.autoRefreshRate * 1000,
+    namespace,
+  });
+  const applications = applicationsQuery.data ?? [];
+
+  const columns = useColumns();
+
+  return (
+    <Datatable
+      dataset={applications}
+      settingsManager={tableState}
+      columns={columns}
+      disableSelect
+      title="Applications running in this namespace"
+      titleIcon={Code}
+      isLoading={applicationsQuery.isLoading}
+      renderTableSettings={() => (
+        <TableSettingsMenu>
+          <TableSettingsMenuAutoRefresh
+            value={tableState.autoRefreshRate}
+            onChange={tableState.setAutoRefreshRate}
+          />
+        </TableSettingsMenu>
+      )}
+      data-cy="namespace-apps-datatable"
+    />
+  );
+}
diff --git a/app/react/kubernetes/namespaces/ItemView/NamespaceView.tsx b/app/react/kubernetes/namespaces/ItemView/NamespaceView.tsx
new file mode 100644
index 0000000..2822394
--- /dev/null
+++ b/app/react/kubernetes/namespaces/ItemView/NamespaceView.tsx
@@ -0,0 +1,86 @@
+import { useCurrentStateAndParams } from '@uirouter/react';
+import { AlertTriangle, Code, Layers, History } from 'lucide-react';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useNamespaceAccessRedirect } from '@/react/kubernetes/namespaces/hooks/useNamespaceAccessRedirect';
+
+import { PageHeader } from '@@/PageHeader';
+import { Tab, useCurrentTabIndex, WidgetTabs } from '@@/Widget/WidgetTabs';
+import { Badge } from '@@/Badge';
+import { Icon } from '@@/Icon';
+
+import { useEventWarningsCount } from '../../queries/useEvents';
+import { NamespaceYAMLEditor } from '../components/NamespaceYamlEditor';
+import { ResourceEventsDatatable } from '../../components/EventsDatatable/ResourceEventsDatatable';
+
+import { UpdateNamespaceForm } from './UpdateNamespaceForm';
+import { NamespaceAppsDatatable } from './NamespaceAppsDatatable';
+
+export function NamespaceView() {
+  const stateAndParams = useCurrentStateAndParams();
+  const {
+    params: { id: namespace },
+  } = stateAndParams;
+  useNamespaceAccessRedirect(namespace, {
+    to: 'kubernetes.resourcePools',
+  });
+
+  const environmentId = useEnvironmentId();
+  const eventWarningCount = useEventWarningsCount(environmentId, { namespace });
+
+  const tabs: Tab[] = [
+    {
+      name: 'Namespace',
+      icon: Layers,
+      widget: <UpdateNamespaceForm />,
+      selectedTabParam: 'namespace',
+    },
+    {
+      name: (
+        <div className="flex items-center gap-x-2">
+          Events
+          {eventWarningCount >= 1 && (
+            <Badge type="warnSecondary">
+              <Icon icon={AlertTriangle} className="!mr-1" />
+              {eventWarningCount}
+            </Badge>
+          )}
+        </div>
+      ),
+      icon: History,
+      widget: (
+        <ResourceEventsDatatable
+          namespace={namespace}
+          storageKey="kubernetes.namespace.events"
+          noWidget={false}
+        />
+      ),
+      selectedTabParam: 'events',
+    },
+    {
+      name: 'YAML',
+      icon: Code,
+      widget: <NamespaceYAMLEditor />,
+      selectedTabParam: 'YAML',
+    },
+  ];
+  const currentTabIndex = useCurrentTabIndex(tabs);
+
+  return (
+    <>
+      <PageHeader
+        title="Namespace details"
+        breadcrumbs={[
+          { label: 'Namespaces', link: 'kubernetes.resourcePools' },
+          namespace,
+        ]}
+        reload
+      />
+      <>
+        <WidgetTabs tabs={tabs} currentTabIndex={currentTabIndex} />
+        {tabs[currentTabIndex].widget}
+        <NamespaceAppsDatatable namespace={namespace} />
+      </>
+    </>
+  );
+}
diff --git a/app/react/kubernetes/namespaces/ItemView/UpdateNamespaceForm.test.tsx b/app/react/kubernetes/namespaces/ItemView/UpdateNamespaceForm.test.tsx
new file mode 100644
index 0000000..65868dd
--- /dev/null
+++ b/app/react/kubernetes/namespaces/ItemView/UpdateNamespaceForm.test.tsx
@@ -0,0 +1,265 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { vi } from 'vitest';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { UserViewModel } from '@/portainer/models/user';
+import { server } from '@/setup-tests/server';
+
+import { UpdateNamespaceForm } from './UpdateNamespaceForm';
+
+const NAMESPACE_NAME = 'test-ns';
+
+vi.mock('@uirouter/react', async (importOriginal: () => Promise<object>) => ({
+  ...(await importOriginal()),
+  useCurrentStateAndParams: vi.fn(() => ({
+    params: { id: NAMESPACE_NAME },
+  })),
+}));
+
+vi.mock('@/react/hooks/useEnvironmentId', () => ({
+  useEnvironmentId: vi.fn(() => 1),
+}));
+
+const mockRegistries = [
+  {
+    Id: 1,
+    Type: 6,
+    Name: 'DockerHub',
+    URL: 'docker.io',
+    BaseURL: '',
+    Authentication: true,
+    Username: 'portainer',
+    Password: '',
+    RegistryAccesses: {
+      '1': {
+        UserAccessPolicies: null,
+        TeamAccessPolicies: null,
+        Namespaces: [NAMESPACE_NAME],
+      },
+    },
+    Gitlab: { ProjectId: 0, InstanceURL: '', ProjectPath: '' },
+    Quay: { OrganisationName: '', UseOrganisation: false },
+    Ecr: { Region: '' },
+    Github: { UseOrganisation: false, OrganisationName: '' },
+  },
+  {
+    Id: 2,
+    Type: 3,
+    Name: 'Private Registry',
+    URL: 'registry.example.com',
+    BaseURL: '',
+    Authentication: false,
+    Username: '',
+    Password: '',
+    RegistryAccesses: {
+      '1': {
+        UserAccessPolicies: null,
+        TeamAccessPolicies: null,
+        Namespaces: [],
+      },
+    },
+    Gitlab: { ProjectId: 0, InstanceURL: '', ProjectPath: '' },
+    Quay: { OrganisationName: '', UseOrganisation: false },
+    Ecr: { Region: '' },
+    Github: { UseOrganisation: false, OrganisationName: '' },
+  },
+];
+
+const mockNamespace = {
+  Id: NAMESPACE_NAME,
+  Name: NAMESPACE_NAME,
+  Status: { phase: 'Active' },
+  Annotations: {},
+  CreationDate: '2024-01-01T00:00:00Z',
+  NamespaceOwner: 'admin',
+  IsSystem: false,
+  IsDefault: false,
+  UnhealthyEventCount: 0,
+  ResourceQuota: {
+    spec: {
+      hard: {
+        'requests.memory': '256Mi',
+        'requests.cpu': '500m',
+      },
+    },
+  },
+};
+
+function buildEndpointResponse(overrides: Record<string, unknown> = {}) {
+  return {
+    Id: 1,
+    Name: 'test-cluster',
+    Type: 5,
+    Kubernetes: {
+      Configuration: {
+        EnableResourceOverCommit: false,
+        StorageClasses: [],
+        UseLoadBalancer: false,
+        IngressAvailabilityPerNamespace: false,
+      },
+    },
+    ...overrides,
+  };
+}
+
+function setupDefaultHandlers(
+  overrides: {
+    endpoint?: Record<string, unknown>;
+    namespace?: Record<string, unknown>;
+    registries?: unknown[];
+    namespaceError?: boolean;
+  } = {}
+) {
+  const handlers = [
+    http.get('/api/endpoints/:id', () =>
+      HttpResponse.json(buildEndpointResponse(overrides.endpoint))
+    ),
+    http.get('/api/kubernetes/:id/max_resource_limits', () =>
+      HttpResponse.json({ Memory: 1024, CPU: 4 })
+    ),
+    http.get('/api/kubernetes/:id/namespaces', () =>
+      // Return other namespaces only (not the current one) so that the
+      // name uniqueness validation doesn't trigger on mount.
+      HttpResponse.json({
+        'other-ns': { ...mockNamespace, Name: 'other-ns', Id: 'other-ns' },
+      })
+    ),
+    http.get('/api/kubernetes/:id/namespaces/:namespace', () => {
+      if (overrides.namespaceError) {
+        return HttpResponse.json({ message: 'server error' }, { status: 500 });
+      }
+      return HttpResponse.json({
+        ...mockNamespace,
+        ...overrides.namespace,
+      });
+    }),
+    http.get('/api/endpoints/:id/registries', () =>
+      HttpResponse.json(overrides.registries ?? mockRegistries)
+    ),
+    http.get('/api/kubernetes/:id/ingresscontrollers', () =>
+      HttpResponse.json([])
+    ),
+    // Mutation handlers
+    http.put('/api/endpoints/:id/registries/:registryId', () =>
+      HttpResponse.json({})
+    ),
+    http.put(
+      '/api/kubernetes/:id/namespaces/:namespace/ingresscontrollers',
+      () => HttpResponse.json([])
+    ),
+  ];
+  server.use(...handlers);
+}
+
+function renderComponent() {
+  const user = new UserViewModel({ Username: 'user', Role: 1 });
+
+  const Wrapped = withTestQueryProvider(
+    withUserProvider(withTestRouter(UpdateNamespaceForm), user)
+  );
+
+  return render(<Wrapped />);
+}
+
+describe('UpdateNamespaceForm', () => {
+  describe('form rendering', () => {
+    it('should load without errors, show read-only name, registries, and disabled button', async () => {
+      setupDefaultHandlers();
+      renderComponent();
+
+      // Wait for the form to load
+      await waitFor(() => {
+        expect(screen.getByText(NAMESPACE_NAME)).toBeVisible();
+      });
+
+      // No validation errors on initial load
+      const errors = screen.queryAllByRole('alert');
+      expect(errors).toHaveLength(0);
+
+      // In edit mode, name is text not an input
+      expect(
+        screen.queryByPlaceholderText('e.g. my-namespace')
+      ).not.toBeInTheDocument();
+
+      // DockerHub should be shown as a selected registry (it has namespace access)
+      expect(screen.getByText('Registries')).toBeVisible();
+      expect(screen.getByText('DockerHub')).toBeVisible();
+
+      // Update button is disabled when form is pristine
+      expect(
+        screen.getByRole('button', { name: /Update namespace/i })
+      ).toBeDisabled();
+    });
+  });
+
+  describe('error states', () => {
+    it('should show error alert when namespace query fails', async () => {
+      setupDefaultHandlers({ namespaceError: true });
+      renderComponent();
+
+      await waitFor(() => {
+        expect(screen.getByText('Error loading namespace')).toBeVisible();
+      });
+    });
+  });
+
+  describe('form submission', { timeout: 10_000 }, () => {
+    it('should submit correct namespace payload on update', async () => {
+      setupDefaultHandlers();
+
+      let namespacePutBody: unknown;
+      server.use(
+        http.put(
+          '/api/kubernetes/:id/namespaces/:namespace',
+          async ({ request }: { request: Request }) => {
+            namespacePutBody = await request.json();
+            return HttpResponse.json({});
+          }
+        )
+      );
+
+      const user = userEvent.setup();
+
+      renderComponent();
+
+      // Wait for form to be fully loaded with registries selector
+      await waitFor(() => {
+        expect(
+          screen.getByRole('button', { name: /Update namespace/i })
+        ).toBeVisible();
+      });
+
+      // Dirty the form by selecting an additional registry via react-select
+      const registryInput = screen.getByRole('combobox');
+      await user.click(registryInput);
+      // Select the second registry that isn't already selected
+      await waitFor(() => {
+        expect(screen.getByText('Private Registry')).toBeVisible();
+      });
+      await user.click(screen.getByText('Private Registry'));
+
+      // Submit
+      const submitButton = screen.getByRole('button', {
+        name: /Update namespace/i,
+      });
+
+      await waitFor(() => {
+        expect(submitButton).not.toBeDisabled();
+      });
+
+      await user.click(submitButton);
+
+      await waitFor(() => {
+        expect(namespacePutBody).toBeDefined();
+        expect(namespacePutBody).toMatchObject({
+          Name: NAMESPACE_NAME,
+          Owner: 'user',
+        });
+      });
+    });
+  });
+});
diff --git a/app/react/kubernetes/namespaces/ItemView/UpdateNamespaceForm.tsx b/app/react/kubernetes/namespaces/ItemView/UpdateNamespaceForm.tsx
new file mode 100644
index 0000000..ac3a89c
--- /dev/null
+++ b/app/react/kubernetes/namespaces/ItemView/UpdateNamespaceForm.tsx
@@ -0,0 +1,197 @@
+import { Formik } from 'formik';
+import { useCurrentStateAndParams, useRouter } from '@uirouter/react';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { notifySuccess } from '@/portainer/services/notifications';
+import { useCurrentEnvironment } from '@/react/hooks/useCurrentEnvironment';
+import { useEnvironmentRegistries } from '@/react/portainer/environments/queries/useEnvironmentRegistries';
+import { useCurrentUser } from '@/react/hooks/useUser';
+
+import { Loading, Widget, WidgetBody } from '@@/Widget';
+import { Alert } from '@@/Alert';
+
+import { NamespaceInnerForm } from '../components/NamespaceForm/NamespaceInnerForm';
+import { useNamespacesQuery } from '../queries/useNamespacesQuery';
+import { useClusterResourceLimitsQuery } from '../queries/useResourceLimitsQuery';
+import { NamespaceFormValues, NamespacePayload } from '../types';
+import { getNamespaceValidationSchema } from '../components/NamespaceForm/NamespaceForm.validation';
+import { transformFormValuesToNamespacePayload } from '../components/NamespaceForm/utils';
+import { useNamespaceQuery } from '../queries/useNamespaceQuery';
+import { useIngressControllerClassMapQuery } from '../../cluster/ingressClass/useIngressControllerClassMap';
+import { useUpdateNamespaceMutation } from '../queries/useUpdateNamespaceMutation';
+
+import { useNamespaceFormValues } from './useNamespaceFormValues';
+import { confirmUpdateNamespace } from './ConfirmUpdateNamespace';
+import { createUpdateRegistriesPayload } from './createUpdateRegistriesPayload';
+import {
+  hasResourceQuotaBeenReduced,
+  hasNamespaceAccessBeenRemoved,
+  hasIngressClassesBeenRemoved,
+} from './updateNamespaceWarnings';
+
+export function UpdateNamespaceForm() {
+  const {
+    params: { id: namespaceName },
+  } = useCurrentStateAndParams();
+  const router = useRouter();
+
+  // for initial values
+  const { user } = useCurrentUser();
+  const environmentId = useEnvironmentId();
+  const environmentQuery = useCurrentEnvironment();
+  const namespacesQuery = useNamespacesQuery(environmentId);
+  const resourceLimitsQuery = useClusterResourceLimitsQuery(environmentId);
+  const namespaceQuery = useNamespaceQuery(environmentId, namespaceName, {
+    params: { withResourceQuota: 'true' },
+  });
+  const registriesQuery = useEnvironmentRegistries(environmentId, {
+    hideDefault: true,
+  });
+  const ingressClassesQuery = useIngressControllerClassMapQuery({
+    environmentId,
+    namespace: namespaceName,
+    allowedOnly: true,
+  });
+  const storageClasses =
+    environmentQuery.data?.Kubernetes.Configuration.StorageClasses;
+  const { data: namespaces } = namespacesQuery;
+  const { data: resourceLimits } = resourceLimitsQuery;
+  const { data: namespace } = namespaceQuery;
+  const { data: registries } = registriesQuery;
+  const { data: ingressClasses } = ingressClassesQuery;
+
+  const updateNamespaceMutation = useUpdateNamespaceMutation(environmentId);
+
+  const namespaceNames = Object.keys(namespaces || {});
+  const memoryLimit = resourceLimits?.Memory ?? 0;
+  const cpuLimit = resourceLimits?.CPU ?? 0;
+  const initialValues = useNamespaceFormValues({
+    namespaceName,
+    environmentId,
+    storageClasses,
+    namespace,
+    registries,
+    ingressClasses,
+  });
+  const isQueryLoading =
+    environmentQuery.isLoading ||
+    resourceLimitsQuery.isLoading ||
+    namespacesQuery.isLoading ||
+    namespaceQuery.isLoading ||
+    registriesQuery.isLoading ||
+    ingressClassesQuery.isLoading;
+
+  const isQueryError =
+    environmentQuery.isError ||
+    resourceLimitsQuery.isError ||
+    namespacesQuery.isError ||
+    namespaceQuery.isError ||
+    registriesQuery.isError ||
+    ingressClassesQuery.isError;
+
+  if (isQueryLoading) {
+    return <Loading />;
+  }
+
+  if (isQueryError) {
+    return (
+      <Alert color="error" title="Error">
+        Error loading namespace
+      </Alert>
+    );
+  }
+
+  if (!initialValues) {
+    return (
+      <Alert color="warn" title="Warning">
+        No data found for namespace
+      </Alert>
+    );
+  }
+
+  return (
+    <div className="row">
+      <div className="col-sm-12">
+        <Widget>
+          <WidgetBody>
+            <Formik
+              initialValues={initialValues}
+              onSubmit={(values) => handleSubmit(values, user.Username)}
+              validateOnMount
+              validationSchema={getNamespaceValidationSchema(
+                memoryLimit,
+                cpuLimit,
+                namespaceNames
+              )}
+            >
+              {(formikProps) => (
+                <NamespaceInnerForm
+                  // eslint-disable-next-line react/jsx-props-no-spreading
+                  {...formikProps}
+                  isEdit
+                  isUpdating={updateNamespaceMutation.isLoading}
+                />
+              )}
+            </Formik>
+          </WidgetBody>
+        </Widget>
+      </div>
+    </div>
+  );
+
+  async function handleSubmit(values: NamespaceFormValues, userName: string) {
+    const createNamespacePayload: NamespacePayload =
+      transformFormValuesToNamespacePayload(values, userName);
+    const updateRegistriesPayload = createUpdateRegistriesPayload({
+      registries,
+      namespaceName,
+      newRegistriesValues: values.registries,
+      initialRegistriesValues: initialValues?.registries || [],
+      environmentId,
+    });
+
+    // give update warnings if needed
+    const isNamespaceAccessRemoved = hasNamespaceAccessBeenRemoved(
+      values.registries,
+      initialValues?.registries || [],
+      environmentId,
+      values.name
+    );
+    const isIngressClassesRemoved = hasIngressClassesBeenRemoved(
+      values.ingressClasses,
+      initialValues?.ingressClasses || []
+    );
+    const warnings = {
+      quota: hasResourceQuotaBeenReduced(
+        values.resourceQuota,
+        initialValues?.resourceQuota
+      ),
+      ingress: isIngressClassesRemoved,
+      registries: isNamespaceAccessRemoved,
+    };
+    if (Object.values(warnings).some(Boolean)) {
+      const confirmed = await confirmUpdateNamespace(warnings);
+      if (!confirmed) {
+        return;
+      }
+    }
+
+    // update the namespace
+    updateNamespaceMutation.mutate(
+      {
+        createNamespacePayload,
+        updateRegistriesPayload,
+        namespaceIngressControllerPayload: values.ingressClasses,
+      },
+      {
+        onSuccess: () => {
+          notifySuccess(
+            'Success',
+            `Namespace '${values.name}' updated successfully`
+          );
+          router.stateService.reload();
+        },
+      }
+    );
+  }
+}
diff --git a/app/react/kubernetes/namespaces/ItemView/columns.tsx b/app/react/kubernetes/namespaces/ItemView/columns.tsx
new file mode 100644
index 0000000..9a6e8a4
--- /dev/null
+++ b/app/react/kubernetes/namespaces/ItemView/columns.tsx
@@ -0,0 +1,85 @@
+import { createColumnHelper } from '@tanstack/react-table';
+import _ from 'lodash';
+import { useMemo } from 'react';
+
+import { usePublicSettings } from '@/react/portainer/settings/queries';
+import { humanize } from '@/portainer/filters/filters';
+
+import { Link } from '@@/Link';
+import { ExternalBadge } from '@@/Badge/ExternalBadge';
+
+import { isExternalApplication } from '../../applications/utils';
+import { cpuHumanValue } from '../../applications/utils/cpuHumanValue';
+import { Application } from '../../applications/ListView/ApplicationsDatatable/types';
+
+const columnHelper = createColumnHelper<Application>();
+
+export function useColumns() {
+  const hideStacksQuery = usePublicSettings<boolean>({
+    select: (settings) =>
+      settings.GlobalDeploymentOptions.hideStacksFunctionality,
+  });
+
+  return useMemo(
+    () =>
+      _.compact([
+        columnHelper.accessor('Name', {
+          header: 'Name',
+          cell: ({ row: { original: item } }) => (
+            <div className="flex-0 flex">
+              <Link
+                to="kubernetes.applications.application"
+                params={{ name: item.Name, namespace: item.ResourcePool }}
+                data-cy={`application-link-${item.Name}`}
+              >
+                {item.Name}
+              </Link>
+              {isExternalApplication({ metadata: item.Metadata }) && (
+                <div className="ml-2">
+                  <ExternalBadge />
+                </div>
+              )}
+            </div>
+          ),
+        }),
+        !hideStacksQuery.data &&
+          columnHelper.accessor('StackName', {
+            header: 'Stack',
+            cell: ({ getValue }) => getValue() || '-',
+          }),
+        columnHelper.accessor('Image', {
+          header: 'Image',
+          cell: ({ getValue }) => (
+            <div className="max-w-md truncate" title={getValue()}>
+              {getValue()}
+            </div>
+          ),
+        }),
+        columnHelper.accessor(
+          (row) =>
+            row.Resource?.CpuRequest
+              ? cpuHumanValue(row.Resource?.CpuRequest)
+              : '-',
+          {
+            header: 'CPU',
+            cell: ({ getValue }) => getValue(),
+          }
+        ),
+        columnHelper.accessor(
+          (row) =>
+            row.Resource?.MemoryRequest ? row.Resource?.MemoryRequest : '-',
+          {
+            header: 'Memory',
+            cell: ({ getValue }) => {
+              const value = getValue();
+              if (value === '-') {
+                return value;
+              }
+              return humanize(value);
+            },
+          }
+        ),
+      ]),
+    [hideStacksQuery.data]
+  );
+}
diff --git a/app/react/kubernetes/namespaces/ItemView/createUpdateRegistriesPayload.test.ts b/app/react/kubernetes/namespaces/ItemView/createUpdateRegistriesPayload.test.ts
new file mode 100644
index 0000000..24b575d
--- /dev/null
+++ b/app/react/kubernetes/namespaces/ItemView/createUpdateRegistriesPayload.test.ts
@@ -0,0 +1,510 @@
+import { createUpdateRegistriesPayload } from './createUpdateRegistriesPayload';
+
+const tests: {
+  testName: string;
+  params: Parameters<typeof createUpdateRegistriesPayload>[0];
+  expected: ReturnType<typeof createUpdateRegistriesPayload>;
+}[] = [
+  {
+    testName: 'Add new registry',
+    params: {
+      registries: [
+        {
+          Id: 1,
+          Type: 6,
+          Name: 'dockerhub',
+          URL: 'docker.io',
+          BaseURL: '',
+          Authentication: true,
+          Username: 'portainer',
+          Gitlab: {
+            ProjectId: 0,
+            InstanceURL: '',
+            ProjectPath: '',
+          },
+          Quay: {
+            OrganisationName: '',
+          },
+          Ecr: {
+            Region: '',
+          },
+          RegistryAccesses: {
+            '7': {
+              UserAccessPolicies: null,
+              TeamAccessPolicies: null,
+              Namespaces: [],
+            },
+          },
+          Github: {
+            UseOrganisation: false,
+            OrganisationName: '',
+          },
+        },
+        {
+          Id: 2,
+          Type: 3,
+          Name: 'portainertest',
+          URL: 'test123.com',
+          BaseURL: '',
+          Authentication: false,
+          Username: '',
+          Gitlab: {
+            ProjectId: 0,
+            InstanceURL: '',
+            ProjectPath: '',
+          },
+          Quay: {
+            OrganisationName: '',
+          },
+          Ecr: {
+            Region: '',
+          },
+          RegistryAccesses: {
+            '7': {
+              UserAccessPolicies: null,
+              TeamAccessPolicies: null,
+              Namespaces: ['newns'],
+            },
+          },
+          Github: {
+            UseOrganisation: false,
+            OrganisationName: '',
+          },
+        },
+      ],
+      namespaceName: 'newns',
+      newRegistriesValues: [
+        {
+          Id: 2,
+          Type: 3,
+          Name: 'portainertest',
+          URL: 'test123.com',
+          BaseURL: '',
+          Authentication: false,
+          Username: '',
+          Gitlab: {
+            ProjectId: 0,
+            InstanceURL: '',
+            ProjectPath: '',
+          },
+          Quay: {
+            OrganisationName: '',
+          },
+          Ecr: {
+            Region: '',
+          },
+          RegistryAccesses: {
+            '7': {
+              UserAccessPolicies: null,
+              TeamAccessPolicies: null,
+              Namespaces: ['newns'],
+            },
+          },
+          Github: {
+            UseOrganisation: false,
+            OrganisationName: '',
+          },
+        },
+        {
+          Id: 1,
+          Type: 6,
+          Name: 'dockerhub',
+          URL: 'docker.io',
+          BaseURL: '',
+          Authentication: true,
+          Username: 'portainer',
+          Gitlab: {
+            ProjectId: 0,
+            InstanceURL: '',
+            ProjectPath: '',
+          },
+          Quay: {
+            OrganisationName: '',
+          },
+          Ecr: {
+            Region: '',
+          },
+          RegistryAccesses: {
+            '7': {
+              UserAccessPolicies: null,
+              TeamAccessPolicies: null,
+              Namespaces: [],
+            },
+          },
+          Github: {
+            UseOrganisation: false,
+            OrganisationName: '',
+          },
+        },
+      ],
+      initialRegistriesValues: [
+        {
+          Id: 2,
+          Type: 3,
+          Name: 'portainertest',
+          URL: 'test123.com',
+          BaseURL: '',
+          Authentication: false,
+          Username: '',
+          Gitlab: {
+            ProjectId: 0,
+            InstanceURL: '',
+            ProjectPath: '',
+          },
+          Quay: {
+            OrganisationName: '',
+          },
+          Ecr: {
+            Region: '',
+          },
+          RegistryAccesses: {
+            '7': {
+              UserAccessPolicies: null,
+              TeamAccessPolicies: null,
+              Namespaces: ['newns'],
+            },
+          },
+          Github: {
+            UseOrganisation: false,
+            OrganisationName: '',
+          },
+        },
+      ],
+      environmentId: 7,
+    },
+    expected: [
+      {
+        Id: 1,
+        Namespaces: ['newns'],
+      },
+    ],
+  },
+  {
+    testName: 'Remove a registry',
+    params: {
+      registries: [
+        {
+          Id: 1,
+          Type: 6,
+          Name: 'dockerhub',
+          URL: 'docker.io',
+          BaseURL: '',
+          Authentication: true,
+          Username: 'portainer',
+          Gitlab: {
+            ProjectId: 0,
+            InstanceURL: '',
+            ProjectPath: '',
+          },
+          Quay: {
+            OrganisationName: '',
+          },
+          Ecr: {
+            Region: '',
+          },
+          RegistryAccesses: {
+            '7': {
+              UserAccessPolicies: null,
+              TeamAccessPolicies: null,
+              Namespaces: ['newns'],
+            },
+          },
+          Github: {
+            UseOrganisation: false,
+            OrganisationName: '',
+          },
+        },
+        {
+          Id: 2,
+          Type: 3,
+          Name: 'portainertest',
+          URL: 'test123.com',
+          BaseURL: '',
+          Authentication: false,
+          Username: '',
+          Gitlab: {
+            ProjectId: 0,
+            InstanceURL: '',
+            ProjectPath: '',
+          },
+          Quay: {
+            OrganisationName: '',
+          },
+          Ecr: {
+            Region: '',
+          },
+          RegistryAccesses: {
+            '7': {
+              UserAccessPolicies: null,
+              TeamAccessPolicies: null,
+              Namespaces: ['newns'],
+            },
+          },
+          Github: {
+            UseOrganisation: false,
+            OrganisationName: '',
+          },
+        },
+      ],
+      namespaceName: 'newns',
+      newRegistriesValues: [
+        {
+          Id: 2,
+          Type: 3,
+          Name: 'portainertest',
+          URL: 'test123.com',
+          BaseURL: '',
+          Authentication: false,
+          Username: '',
+          Gitlab: {
+            ProjectId: 0,
+            InstanceURL: '',
+            ProjectPath: '',
+          },
+          Quay: {
+            OrganisationName: '',
+          },
+          Ecr: {
+            Region: '',
+          },
+          RegistryAccesses: {
+            '7': {
+              UserAccessPolicies: null,
+              TeamAccessPolicies: null,
+              Namespaces: ['newns'],
+            },
+          },
+          Github: {
+            UseOrganisation: false,
+            OrganisationName: '',
+          },
+        },
+      ],
+      initialRegistriesValues: [
+        {
+          Id: 1,
+          Type: 6,
+          Name: 'dockerhub',
+          URL: 'docker.io',
+          BaseURL: '',
+          Authentication: true,
+          Username: 'portainer',
+          Gitlab: {
+            ProjectId: 0,
+            InstanceURL: '',
+            ProjectPath: '',
+          },
+          Quay: {
+            OrganisationName: '',
+          },
+          Ecr: {
+            Region: '',
+          },
+          RegistryAccesses: {
+            '7': {
+              UserAccessPolicies: null,
+              TeamAccessPolicies: null,
+              Namespaces: ['newns'],
+            },
+          },
+          Github: {
+            UseOrganisation: false,
+            OrganisationName: '',
+          },
+        },
+        {
+          Id: 2,
+          Type: 3,
+          Name: 'portainertest',
+          URL: 'test123.com',
+          BaseURL: '',
+          Authentication: false,
+          Username: '',
+          Gitlab: {
+            ProjectId: 0,
+            InstanceURL: '',
+            ProjectPath: '',
+          },
+          Quay: {
+            OrganisationName: '',
+          },
+          Ecr: {
+            Region: '',
+          },
+          RegistryAccesses: {
+            '7': {
+              UserAccessPolicies: null,
+              TeamAccessPolicies: null,
+              Namespaces: ['newns'],
+            },
+          },
+          Github: {
+            UseOrganisation: false,
+            OrganisationName: '',
+          },
+        },
+      ],
+      environmentId: 7,
+    },
+    expected: [
+      {
+        Id: 1,
+        Namespaces: [],
+      },
+    ],
+  },
+  {
+    testName: 'Remove all registries',
+    params: {
+      registries: [
+        {
+          Id: 1,
+          Type: 6,
+          Name: 'dockerhub',
+          URL: 'docker.io',
+          BaseURL: '',
+          Authentication: true,
+          Username: 'portainer',
+          Gitlab: {
+            ProjectId: 0,
+            InstanceURL: '',
+            ProjectPath: '',
+          },
+          Quay: {
+            OrganisationName: '',
+          },
+          Ecr: {
+            Region: '',
+          },
+          RegistryAccesses: {
+            '7': {
+              UserAccessPolicies: null,
+              TeamAccessPolicies: null,
+              Namespaces: ['newns'],
+            },
+          },
+          Github: {
+            UseOrganisation: false,
+            OrganisationName: '',
+          },
+        },
+        {
+          Id: 2,
+          Type: 3,
+          Name: 'portainertest',
+          URL: 'test123.com',
+          BaseURL: '',
+          Authentication: false,
+          Username: '',
+          Gitlab: {
+            ProjectId: 0,
+            InstanceURL: '',
+            ProjectPath: '',
+          },
+          Quay: {
+            OrganisationName: '',
+          },
+          Ecr: {
+            Region: '',
+          },
+          RegistryAccesses: {
+            '7': {
+              UserAccessPolicies: null,
+              TeamAccessPolicies: null,
+              Namespaces: ['newns'],
+            },
+          },
+          Github: {
+            UseOrganisation: false,
+            OrganisationName: '',
+          },
+        },
+      ],
+      namespaceName: 'newns',
+      newRegistriesValues: [],
+      initialRegistriesValues: [
+        {
+          Id: 1,
+          Type: 6,
+          Name: 'dockerhub',
+          URL: 'docker.io',
+          BaseURL: '',
+          Authentication: true,
+          Username: 'portainer',
+          Gitlab: {
+            ProjectId: 0,
+            InstanceURL: '',
+            ProjectPath: '',
+          },
+          Quay: {
+            OrganisationName: '',
+          },
+          Ecr: {
+            Region: '',
+          },
+          RegistryAccesses: {
+            '7': {
+              UserAccessPolicies: null,
+              TeamAccessPolicies: null,
+              Namespaces: ['newns'],
+            },
+          },
+          Github: {
+            UseOrganisation: false,
+            OrganisationName: '',
+          },
+        },
+        {
+          Id: 2,
+          Type: 3,
+          Name: 'portainertest',
+          URL: 'test123.com',
+          BaseURL: '',
+          Authentication: false,
+          Username: '',
+          Gitlab: {
+            ProjectId: 0,
+            InstanceURL: '',
+            ProjectPath: '',
+          },
+          Quay: {
+            OrganisationName: '',
+          },
+          Ecr: {
+            Region: '',
+          },
+          RegistryAccesses: {
+            '7': {
+              UserAccessPolicies: null,
+              TeamAccessPolicies: null,
+              Namespaces: ['newns'],
+            },
+          },
+          Github: {
+            UseOrganisation: false,
+            OrganisationName: '',
+          },
+        },
+      ],
+      environmentId: 7,
+    },
+    expected: [
+      {
+        Id: 1,
+        Namespaces: [],
+      },
+      {
+        Id: 2,
+        Namespaces: [],
+      },
+    ],
+  },
+];
+
+describe('createUpdateRegistriesPayload', () => {
+  tests.forEach(({ testName, params, expected }) => {
+    it(`Should return the correct payload: ${testName}`, () => {
+      expect(createUpdateRegistriesPayload(params)).toEqual(expected);
+    });
+  });
+});
diff --git a/app/react/kubernetes/namespaces/ItemView/createUpdateRegistriesPayload.ts b/app/react/kubernetes/namespaces/ItemView/createUpdateRegistriesPayload.ts
new file mode 100644
index 0000000..243ffbe
--- /dev/null
+++ b/app/react/kubernetes/namespaces/ItemView/createUpdateRegistriesPayload.ts
@@ -0,0 +1,58 @@
+import { difference, uniqBy } from 'lodash';
+
+import { Registry } from '@/react/portainer/registries/types/registry';
+
+import { UpdateRegistryPayload } from '../types';
+
+export function createUpdateRegistriesPayload({
+  registries,
+  namespaceName,
+  newRegistriesValues,
+  initialRegistriesValues,
+  environmentId,
+}: {
+  registries: Registry[] | undefined;
+  namespaceName: string;
+  newRegistriesValues: Registry[];
+  initialRegistriesValues: Registry[];
+  environmentId: number;
+}): UpdateRegistryPayload[] {
+  if (!registries) {
+    return [];
+  }
+
+  // Get all unique registries from both initial and new values
+  const uniqueRegistries = uniqBy(
+    [...initialRegistriesValues, ...newRegistriesValues],
+    'Id'
+  );
+
+  const payload = uniqueRegistries
+    .map((registry) => {
+      const currentNamespaces =
+        registry.RegistryAccesses?.[`${environmentId}`]?.Namespaces || [];
+
+      const existsInNewValues = newRegistriesValues.some(
+        (r) => r.Id === registry.Id
+      );
+
+      // If registry is in new values, add namespace; if not, remove it
+      const updatedNamespaces = existsInNewValues
+        ? [...new Set([...currentNamespaces, namespaceName])]
+        : currentNamespaces.filter((ns) => ns !== namespaceName);
+
+      return {
+        Id: registry.Id,
+        Namespaces: updatedNamespaces,
+        // Track if the namespace list has actually changed (difference returns empty only if arrays have same elements)
+        hasChanged:
+          difference(currentNamespaces, updatedNamespaces).length > 0 ||
+          difference(updatedNamespaces, currentNamespaces).length > 0,
+      };
+    })
+    // Only include registries where the namespace access has changed
+    .filter((item) => item.hasChanged)
+    .map(({ Id, Namespaces }) => ({ Id, Namespaces }));
+
+  return payload;
+}
diff --git a/app/react/kubernetes/namespaces/ItemView/types.ts b/app/react/kubernetes/namespaces/ItemView/types.ts
new file mode 100644
index 0000000..02cd684
--- /dev/null
+++ b/app/react/kubernetes/namespaces/ItemView/types.ts
@@ -0,0 +1,6 @@
+import { KubernetesApplication } from '@/kubernetes/models/application/models';
+
+export interface NamespaceApp extends KubernetesApplication {
+  CPU: number;
+  Memory: number;
+}
diff --git a/app/react/kubernetes/namespaces/ItemView/updateNamespaceWarnings.test.ts b/app/react/kubernetes/namespaces/ItemView/updateNamespaceWarnings.test.ts
new file mode 100644
index 0000000..af3c680
--- /dev/null
+++ b/app/react/kubernetes/namespaces/ItemView/updateNamespaceWarnings.test.ts
@@ -0,0 +1,157 @@
+import { Registry } from '@/react/portainer/registries/types/registry';
+
+import { ResourceQuotaFormValues } from '../components/NamespaceForm/ResourceQuotaFormSection/types';
+import { IngressControllerClassMap } from '../../cluster/ingressClass/types';
+
+import {
+  hasResourceQuotaBeenReduced,
+  hasNamespaceAccessBeenRemoved,
+  hasIngressClassesBeenRemoved,
+} from './updateNamespaceWarnings';
+
+function buildResourceQuota(
+  overrides: Partial<ResourceQuotaFormValues> = {}
+): ResourceQuotaFormValues {
+  return {
+    enabled: true,
+    cpu: '1',
+    memory: '256',
+    ...overrides,
+  };
+}
+
+function buildRegistry(
+  id: number,
+  namespaces: string[] = [],
+  environmentId = 1
+): Registry {
+  return {
+    Id: id,
+    Type: 6,
+    Name: `Registry ${id}`,
+    URL: `registry${id}.example.com`,
+    BaseURL: '',
+    Authentication: false,
+    Username: '',
+    Password: '',
+    RegistryAccesses: {
+      [`${environmentId}`]: {
+        UserAccessPolicies: null,
+        TeamAccessPolicies: null,
+        Namespaces: namespaces,
+      },
+    },
+    Gitlab: { ProjectId: 0, InstanceURL: '', ProjectPath: '' },
+    Quay: { OrganisationName: '', UseOrganisation: false },
+    Ecr: { Region: '' },
+    Github: { UseOrganisation: false, OrganisationName: '' },
+  } as Registry;
+}
+
+function buildIngressClass(
+  name: string,
+  availability: boolean
+): IngressControllerClassMap {
+  return {
+    Name: name,
+    ClassName: name,
+    Type: 'nginx',
+    Availability: availability,
+    New: false,
+    Used: false,
+  };
+}
+
+describe('hasResourceQuotaBeenReduced', () => {
+  it('should return false when values are the same', () => {
+    const quota = buildResourceQuota();
+    expect(hasResourceQuotaBeenReduced(quota, quota)).toBe(false);
+  });
+
+  it('should return true when CPU is decreased', () => {
+    const initial = buildResourceQuota({ cpu: '4' });
+    const updated = buildResourceQuota({ cpu: '2' });
+    expect(hasResourceQuotaBeenReduced(updated, initial)).toBe(true);
+  });
+
+  it('should return true when memory is decreased', () => {
+    const initial = buildResourceQuota({ memory: '512' });
+    const updated = buildResourceQuota({ memory: '256' });
+    expect(hasResourceQuotaBeenReduced(updated, initial)).toBe(true);
+  });
+
+  it('should return false when all values are increased', () => {
+    const initial = buildResourceQuota();
+    const updated = buildResourceQuota({ cpu: '2', memory: '512' });
+    expect(hasResourceQuotaBeenReduced(updated, initial)).toBe(false);
+  });
+
+  it('should treat empty/zero as unlimited (not a reduction)', () => {
+    const initial = buildResourceQuota({ cpu: '' });
+    const updated = buildResourceQuota({ cpu: '' });
+    expect(hasResourceQuotaBeenReduced(updated, initial)).toBe(false);
+  });
+
+  it('should return true when going from unlimited to a set value', () => {
+    const initial = buildResourceQuota({ cpu: '', memory: '' });
+    const updated = buildResourceQuota({ cpu: '2' });
+    expect(hasResourceQuotaBeenReduced(updated, initial)).toBe(true);
+  });
+
+  it('should return false when there is no initial quota', () => {
+    const updated = buildResourceQuota();
+    expect(hasResourceQuotaBeenReduced(updated, undefined)).toBe(false);
+  });
+});
+
+describe('hasNamespaceAccessBeenRemoved', () => {
+  it('should return true when a registry is removed entirely', () => {
+    const initial = [buildRegistry(1, ['default'])];
+    const updated: Registry[] = [];
+    expect(hasNamespaceAccessBeenRemoved(updated, initial, 1, 'default')).toBe(
+      true
+    );
+  });
+
+  it('should return true when namespace is removed from registry accesses', () => {
+    const initial = [buildRegistry(1, ['default'])];
+    const updated = [buildRegistry(1, [])];
+    expect(hasNamespaceAccessBeenRemoved(updated, initial, 1, 'default')).toBe(
+      true
+    );
+  });
+
+  it('should return false when registries and accesses are unchanged', () => {
+    const registries = [buildRegistry(1, ['default'])];
+    expect(
+      hasNamespaceAccessBeenRemoved(registries, registries, 1, 'default')
+    ).toBe(false);
+  });
+
+  it('should return false when namespace was not in old accesses', () => {
+    const initial = [buildRegistry(1, ['other-ns'])];
+    const updated: Registry[] = [];
+    expect(hasNamespaceAccessBeenRemoved(updated, initial, 1, 'default')).toBe(
+      false
+    );
+  });
+});
+
+describe('hasIngressClassesBeenRemoved', () => {
+  it('should return false when availability is unchanged', () => {
+    const classes = [buildIngressClass('nginx', true)];
+    expect(hasIngressClassesBeenRemoved(classes, classes)).toBe(false);
+  });
+
+  it('should return true when availability is changed', () => {
+    const initial = [buildIngressClass('nginx', true)];
+    const updated = [buildIngressClass('nginx', false)];
+    expect(hasIngressClassesBeenRemoved(updated, initial)).toBe(true);
+  });
+
+  it('should return true when class is removed from new list', () => {
+    const initial = [buildIngressClass('nginx', true)];
+    const updated: IngressControllerClassMap[] = [];
+    expect(hasIngressClassesBeenRemoved(updated, initial)).toBe(true);
+  });
+});
diff --git a/app/react/kubernetes/namespaces/ItemView/updateNamespaceWarnings.ts b/app/react/kubernetes/namespaces/ItemView/updateNamespaceWarnings.ts
new file mode 100644
index 0000000..449be69
--- /dev/null
+++ b/app/react/kubernetes/namespaces/ItemView/updateNamespaceWarnings.ts
@@ -0,0 +1,65 @@
+import { Registry } from '@/react/portainer/registries/types/registry';
+
+import { ResourceQuotaFormValues } from '../components/NamespaceForm/ResourceQuotaFormSection/types';
+import { IngressControllerClassMap } from '../../cluster/ingressClass/types';
+
+export function hasResourceQuotaBeenReduced(
+  newResourceQuota: ResourceQuotaFormValues,
+  initialResourceQuota?: ResourceQuotaFormValues
+) {
+  if (!initialResourceQuota) {
+    return false;
+  }
+  // if the new value is an empty string or '0', it's counted as 'unlimited'
+  const unlimitedValue = String(Number.MAX_SAFE_INTEGER);
+  return (
+    (Number(initialResourceQuota.cpu) || unlimitedValue) >
+      (Number(newResourceQuota.cpu) || unlimitedValue) ||
+    (Number(initialResourceQuota.memory) || unlimitedValue) >
+      (Number(newResourceQuota.memory) || unlimitedValue)
+  );
+}
+
+export function hasNamespaceAccessBeenRemoved(
+  newRegistries: Registry[],
+  initialRegistries: Registry[],
+  environmentId: number,
+  namespaceName: string
+) {
+  return initialRegistries.some((oldRegistry) => {
+    // Check if the namespace was in the old registry's accesses
+    const isNamespaceInOldAccesses =
+      oldRegistry.RegistryAccesses?.[`${environmentId}`]?.Namespaces.includes(
+        namespaceName
+      );
+
+    if (!isNamespaceInOldAccesses) {
+      return false;
+    }
+
+    // Find the corresponding new registry
+    const newRegistry = newRegistries.find((r) => r.Id === oldRegistry.Id);
+    if (!newRegistry) {
+      return true;
+    }
+
+    // If the registry no longer exists or the namespace is not in its accesses, access has been removed
+    const isNamespaceInNewAccesses =
+      newRegistry.RegistryAccesses?.[`${environmentId}`]?.Namespaces.includes(
+        namespaceName
+      );
+
+    return !isNamespaceInNewAccesses;
+  });
+}
+
+export function hasIngressClassesBeenRemoved(
+  newIngressClasses: IngressControllerClassMap[],
+  initialIngressClasses: IngressControllerClassMap[]
+) {
+  // go through all old classes and check if their availability has changed
+  return initialIngressClasses.some((oldClass) => {
+    const newClass = newIngressClasses.find((c) => c.Name === oldClass.Name);
+    return newClass?.Availability !== oldClass.Availability;
+  });
+}
diff --git a/app/react/kubernetes/namespaces/ItemView/useNamespaceFormValues.test.ts b/app/react/kubernetes/namespaces/ItemView/useNamespaceFormValues.test.ts
new file mode 100644
index 0000000..4a39cf8
--- /dev/null
+++ b/app/react/kubernetes/namespaces/ItemView/useNamespaceFormValues.test.ts
@@ -0,0 +1,249 @@
+import { computeInitialValues } from './useNamespaceFormValues';
+
+type NamespaceTestData = {
+  testName: string;
+  namespaceData: Parameters<typeof computeInitialValues>[0];
+  expectedFormValues: ReturnType<typeof computeInitialValues>;
+};
+
+// various namespace data from simple to complex
+const tests: NamespaceTestData[] = [
+  {
+    testName:
+      'No resource quotas, registries, storage requests or ingress controllers',
+    namespaceData: {
+      namespaceName: 'test',
+      environmentId: 4,
+      storageClasses: [
+        {
+          Name: 'local-path',
+          AccessModes: ['RWO'],
+          Provisioner: 'rancher.io/local-path',
+          AllowVolumeExpansion: false,
+        },
+      ],
+      namespace: {
+        Id: '6110390e-f7cb-4f23-b219-197e4a1d0291',
+        Name: 'test',
+        Status: {
+          phase: 'Active',
+        },
+        UnhealthyEventCount: 0,
+        Annotations: null,
+        CreationDate: '2024-10-17T17:50:08+13:00',
+        NamespaceOwner: 'admin',
+        IsSystem: false,
+        IsDefault: false,
+      },
+      registries: [
+        {
+          Id: 1,
+          Type: 6,
+          Name: 'dockerhub',
+          URL: 'docker.io',
+          BaseURL: '',
+          Authentication: true,
+          Username: 'aliharriss',
+          Gitlab: {
+            ProjectId: 0,
+            InstanceURL: '',
+            ProjectPath: '',
+          },
+          Ecr: {
+            Region: '',
+          },
+          Quay: {
+            OrganisationName: '',
+          },
+          RegistryAccesses: {
+            '4': {
+              UserAccessPolicies: null,
+              TeamAccessPolicies: null,
+              Namespaces: ['newns'],
+            },
+          },
+          Github: {
+            UseOrganisation: false,
+            OrganisationName: '',
+          },
+        },
+      ],
+      ingressClasses: [
+        {
+          Name: 'none',
+          ClassName: 'none',
+          Type: 'custom',
+          Availability: true,
+          New: false,
+          Used: false,
+        },
+      ],
+    },
+    expectedFormValues: {
+      name: 'test',
+      ingressClasses: [
+        {
+          Name: 'none',
+          ClassName: 'none',
+          Type: 'custom',
+          Availability: true,
+          New: false,
+          Used: false,
+        },
+      ],
+      resourceQuota: {
+        enabled: false,
+        memory: '0',
+        cpu: '0',
+      },
+      registries: [],
+    },
+  },
+  {
+    testName:
+      'With annotations, registry, storage request, resource quota and disabled ingress controller',
+    namespaceData: {
+      namespaceName: 'newns',
+      environmentId: 4,
+      storageClasses: [
+        {
+          Name: 'local-path',
+          AccessModes: ['RWO'],
+          Provisioner: 'rancher.io/local-path',
+          AllowVolumeExpansion: false,
+        },
+      ],
+      namespace: {
+        Id: 'd5c3cb69-bf9b-4625-b754-d7ba6ce2c688',
+        Name: 'newns',
+        Status: {
+          phase: 'Active',
+        },
+        UnhealthyEventCount: 0,
+        Annotations: {
+          asdf: 'asdf',
+        },
+        CreationDate: '2024-10-01T10:20:46+13:00',
+        NamespaceOwner: 'admin',
+        IsSystem: false,
+        IsDefault: false,
+        ResourceQuota: {
+          metadata: {},
+          spec: {
+            hard: {
+              'limits.cpu': '800m',
+              'limits.memory': '768M',
+              'local-path.storageclass.storage.k8s.io/requests.storage': '1G',
+              'requests.cpu': '800m',
+              'requests.memory': '768M',
+              'services.loadbalancers': '1',
+            },
+          },
+        },
+      },
+      registries: [
+        {
+          Id: 1,
+          Type: 6,
+          Name: 'dockerhub',
+          URL: 'docker.io',
+          BaseURL: '',
+          Authentication: true,
+          Username: 'aliharriss',
+          Gitlab: {
+            ProjectId: 0,
+            InstanceURL: '',
+            ProjectPath: '',
+          },
+          Quay: {
+            OrganisationName: '',
+          },
+          Ecr: {
+            Region: '',
+          },
+          RegistryAccesses: {
+            '4': {
+              UserAccessPolicies: null,
+              TeamAccessPolicies: null,
+              Namespaces: ['newns'],
+            },
+          },
+          Github: {
+            UseOrganisation: false,
+            OrganisationName: '',
+          },
+        },
+      ],
+      ingressClasses: [
+        {
+          Name: 'none',
+          ClassName: 'none',
+          Type: 'custom',
+          Availability: true,
+          New: false,
+          Used: false,
+        },
+      ],
+    },
+    expectedFormValues: {
+      name: 'newns',
+      ingressClasses: [
+        {
+          Name: 'none',
+          ClassName: 'none',
+          Type: 'custom',
+          Availability: true,
+          New: false,
+          Used: false,
+        },
+      ],
+      resourceQuota: {
+        enabled: true,
+        memory: '768',
+        cpu: '0.8',
+      },
+      registries: [
+        {
+          Id: 1,
+          Type: 6,
+          Name: 'dockerhub',
+          URL: 'docker.io',
+          BaseURL: '',
+          Authentication: true,
+          Username: 'aliharriss',
+          Gitlab: {
+            ProjectId: 0,
+            InstanceURL: '',
+            ProjectPath: '',
+          },
+          Quay: {
+            OrganisationName: '',
+          },
+          Ecr: {
+            Region: '',
+          },
+          RegistryAccesses: {
+            '4': {
+              UserAccessPolicies: null,
+              TeamAccessPolicies: null,
+              Namespaces: ['newns'],
+            },
+          },
+          Github: {
+            UseOrganisation: false,
+            OrganisationName: '',
+          },
+        },
+      ],
+    },
+  },
+];
+
+describe('useNamespaceFormValues', () => {
+  tests.forEach((test) => {
+    it(`should return the correct form values: ${test.testName}`, () => {
+      const formValues = computeInitialValues(test.namespaceData);
+      expect(formValues).toEqual(test.expectedFormValues);
+    });
+  });
+});
diff --git a/app/react/kubernetes/namespaces/ItemView/useNamespaceFormValues.ts b/app/react/kubernetes/namespaces/ItemView/useNamespaceFormValues.ts
new file mode 100644
index 0000000..a203c18
--- /dev/null
+++ b/app/react/kubernetes/namespaces/ItemView/useNamespaceFormValues.ts
@@ -0,0 +1,78 @@
+import { useMemo } from 'react';
+
+import { StorageClass } from '@/react/portainer/environments/types';
+import { Registry } from '@/react/portainer/registries/types/registry';
+import { parseCPU } from '@/react/kubernetes/utils';
+
+import { NamespaceFormValues, PortainerNamespace } from '../types';
+import { megaBytesValue, convertBase2ToMiB } from '../resourceQuotaUtils';
+import { IngressControllerClassMap } from '../../cluster/ingressClass/types';
+
+interface ComputeInitialValuesParams {
+  namespaceName: string;
+  environmentId: number;
+  storageClasses?: StorageClass[];
+  namespace?: PortainerNamespace;
+  registries?: Registry[];
+  ingressClasses?: IngressControllerClassMap[];
+}
+
+export function computeInitialValues({
+  namespaceName,
+  environmentId,
+  namespace,
+  registries,
+  ingressClasses,
+}: ComputeInitialValuesParams): NamespaceFormValues | null {
+  if (!namespace) {
+    return null;
+  }
+  const memory = namespace.ResourceQuota?.spec?.hard?.['requests.memory'] ?? '';
+  const cpu = namespace.ResourceQuota?.spec?.hard?.['requests.cpu'] ?? '';
+
+  const registriesUsed = registries?.filter((registry) =>
+    registry.RegistryAccesses?.[`${environmentId}`]?.Namespaces.includes(
+      namespaceName
+    )
+  );
+
+  return {
+    name: namespaceName,
+    ingressClasses: ingressClasses ?? [],
+    resourceQuota: {
+      enabled: !!memory || !!cpu,
+      memory: `${megaBytesValue(convertBase2ToMiB(memory))}`,
+      cpu: `${parseCPU(cpu)}`,
+    },
+    registries: registriesUsed ?? [],
+  };
+}
+
+export function useNamespaceFormValues({
+  namespaceName,
+  environmentId,
+  storageClasses,
+  namespace,
+  registries,
+  ingressClasses,
+}: ComputeInitialValuesParams): NamespaceFormValues | null {
+  return useMemo(
+    () =>
+      computeInitialValues({
+        namespaceName,
+        environmentId,
+        storageClasses,
+        namespace,
+        registries,
+        ingressClasses,
+      }),
+    [
+      storageClasses,
+      namespace,
+      registries,
+      namespaceName,
+      ingressClasses,
+      environmentId,
+    ]
+  );
+}
diff --git a/app/react/kubernetes/namespaces/ListView/NamespacesDatatable.tsx b/app/react/kubernetes/namespaces/ListView/NamespacesDatatable.tsx
new file mode 100644
index 0000000..56345b5
--- /dev/null
+++ b/app/react/kubernetes/namespaces/ListView/NamespacesDatatable.tsx
@@ -0,0 +1,193 @@
+import { Layers } from 'lucide-react';
+import { useQueryClient } from '@tanstack/react-query';
+
+import { Authorized, useAuthorizations } from '@/react/hooks/useUser';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { pluralize } from '@/portainer/helpers/strings';
+import { notifyError, notifySuccess } from '@/portainer/services/notifications';
+
+import { DeleteButton } from '@@/buttons/DeleteButton';
+import { refreshableSettings } from '@@/datatables/types';
+import { Datatable, TableSettingsMenu } from '@@/datatables';
+import { useTableStateWithStorage } from '@@/datatables/useTableState';
+import { AddButton } from '@@/buttons';
+
+import { systemResourcesSettings } from '../../datatables/SystemResourcesSettings';
+import { CreateFromManifestButton } from '../../components/CreateFromManifestButton';
+import {
+  DefaultDatatableSettings,
+  TableSettings,
+} from '../../datatables/DefaultDatatableSettings';
+import { SystemResourceDescription } from '../../datatables/SystemResourceDescription';
+import { isDefaultNamespace } from '../isDefaultNamespace';
+import { useNamespacesQuery } from '../queries/useNamespacesQuery';
+import { PortainerNamespace } from '../types';
+import { useDeleteNamespaces } from '../queries/useDeleteNamespaces';
+import { queryKeys } from '../queries/queryKeys';
+
+import { useColumns } from './columns/useColumns';
+
+export function NamespacesDatatable() {
+  const environmentId = useEnvironmentId();
+
+  const tableState = useTableStateWithStorage<TableSettings>(
+    'kube-namespaces',
+    'Name',
+    (set) => ({
+      ...systemResourcesSettings(set),
+      ...refreshableSettings(set),
+    })
+  );
+  const namespacesQuery = useNamespacesQuery(environmentId, {
+    autoRefreshRate: tableState.autoRefreshRate * 1000,
+    withResourceQuota: true,
+    withUnhealthyEvents: true,
+  });
+  const namespaces = Object.values(namespacesQuery.data ?? []);
+
+  const hasWriteAuthQuery = useAuthorizations(
+    'K8sResourcePoolDetailsW',
+    undefined,
+    true
+  );
+  const columns = useColumns();
+
+  const filteredDataset = tableState.showSystemResources
+    ? namespaces
+    : namespaces.filter((namespace) => !namespace.IsSystem);
+
+  return (
+    <Datatable<PortainerNamespace>
+      data-cy="k8sNamespace-namespaceTable"
+      dataset={filteredDataset}
+      columns={columns}
+      settingsManager={tableState}
+      isLoading={namespacesQuery.isLoading}
+      title="Namespaces"
+      titleIcon={Layers}
+      getRowId={(item) => item.Id}
+      disableSelect={!hasWriteAuthQuery.authorized}
+      isRowSelectable={({ original: item }) =>
+        !item.IsSystem && !isDefaultNamespace(item.Name)
+      }
+      renderTableActions={(selectedItems) => (
+        <TableActions
+          selectedItems={selectedItems}
+          namespaces={namespacesQuery.data}
+        />
+      )}
+      renderTableSettings={() => (
+        <TableSettingsMenu>
+          <DefaultDatatableSettings settings={tableState} />
+        </TableSettingsMenu>
+      )}
+      description={
+        <SystemResourceDescription
+          showSystemResources={tableState.showSystemResources}
+        />
+      }
+    />
+  );
+}
+
+function TableActions({
+  selectedItems,
+  namespaces,
+}: {
+  selectedItems: PortainerNamespace[];
+  namespaces?: PortainerNamespace[];
+}) {
+  const queryClient = useQueryClient();
+  const environmentId = useEnvironmentId();
+  const deleteNamespacesMutation = useDeleteNamespaces(environmentId);
+
+  const selectedNamespacePlural = pluralize(selectedItems.length, 'namespace');
+  const includesTerminatingNamespace = selectedItems.some(
+    (ns) => ns.Status.phase === 'Terminating'
+  );
+  const message = includesTerminatingNamespace
+    ? 'At least one namespace is in a terminating state. For terminating state namespaces, you may continue and force removal, but doing so without having properly cleaned up may lead to unstable and unpredictable behavior. Are you sure you wish to proceed?'
+    : `Do you want to remove the selected ${selectedNamespacePlural}? All the resources associated to the selected ${selectedNamespacePlural} will be removed too. Are you sure you wish to proceed?`;
+
+  return (
+    <Authorized authorizations="K8sResourcePoolDetailsW" adminOnlyCE>
+      <DeleteButton
+        onConfirmed={() => onRemoveNamespaces(selectedItems)}
+        disabled={selectedItems.length === 0}
+        data-cy="delete-namespace-button"
+        confirmMessage={message}
+      />
+
+      <AddButton color="secondary" data-cy="add-namespace-form-button">
+        Add with form
+      </AddButton>
+
+      <CreateFromManifestButton data-cy="k8s-namespaces-deploy-button" />
+    </Authorized>
+  );
+
+  function onRemoveNamespaces(selectedNamespaces: Array<PortainerNamespace>) {
+    deleteNamespacesMutation.mutate(
+      {
+        namespaceNames: selectedNamespaces.map((namespace) => namespace.Name),
+      },
+      {
+        onSuccess: (resp) => {
+          // gather errors and deleted namespaces
+          const errors = resp.data?.errors || [];
+          const erroredNamespacePlural = pluralize(errors.length, 'namespace');
+
+          const selectedNamespaceNames = selectedNamespaces.map(
+            (ns) => ns.Name
+          );
+          const deletedNamespaces =
+            resp.data?.deleted || selectedNamespaceNames;
+          const deletedNamespacePlural = pluralize(
+            deletedNamespaces.length,
+            'namespace'
+          );
+
+          // notify user of success and errors
+          if (errors.length > 0) {
+            notifyError(
+              'Error',
+              new Error(
+                `Failed to delete ${erroredNamespacePlural}: ${errors
+                  .map((err) => `${err.namespaceName}: ${err.error}`)
+                  .join(', ')}`
+              )
+            );
+          }
+          if (deletedNamespaces.length > 0) {
+            notifySuccess(
+              'Success',
+              `Successfully deleted ${deletedNamespacePlural}: ${deletedNamespaces.join(
+                ', '
+              )}`
+            );
+          }
+
+          // Plain invalidation / refetching is confusing because namespaces hang in a terminating state
+          // instead, optimistically update the cache manually to hide the deleting (terminating) namespaces
+          const remainingNamespaces = deletedNamespaces.reduce(
+            (acc, ns) => {
+              const index = acc.findIndex((n) => n.Name === ns);
+              if (index !== -1) {
+                acc.splice(index, 1);
+              }
+              return acc;
+            },
+            [...(namespaces ?? [])]
+          );
+          queryClient.setQueryData(
+            queryKeys.list(environmentId, {
+              withResourceQuota: true,
+              withUnhealthyEvents: true,
+            }),
+            () => remainingNamespaces
+          );
+        },
+      }
+    );
+  }
+}
diff --git a/app/react/kubernetes/namespaces/ListView/NamespacesView.tsx b/app/react/kubernetes/namespaces/ListView/NamespacesView.tsx
new file mode 100644
index 0000000..e0409a3
--- /dev/null
+++ b/app/react/kubernetes/namespaces/ListView/NamespacesView.tsx
@@ -0,0 +1,12 @@
+import { PageHeader } from '@@/PageHeader';
+
+import { NamespacesDatatable } from './NamespacesDatatable';
+
+export function NamespacesView() {
+  return (
+    <>
+      <PageHeader title="Namespace list" breadcrumbs="Namespaces" reload />
+      <NamespacesDatatable />
+    </>
+  );
+}
diff --git a/app/react/kubernetes/namespaces/ListView/columns/actions.tsx b/app/react/kubernetes/namespaces/ListView/columns/actions.tsx
new file mode 100644
index 0000000..0f408d4
--- /dev/null
+++ b/app/react/kubernetes/namespaces/ListView/columns/actions.tsx
@@ -0,0 +1,60 @@
+import { CellContext } from '@tanstack/react-table';
+import { Users } from 'lucide-react';
+
+import { useCurrentEnvironment } from '@/react/hooks/useCurrentEnvironment';
+import { Environment } from '@/react/portainer/environments/types';
+
+import { Link } from '@@/Link';
+import { Button } from '@@/buttons';
+
+import { isDefaultNamespace } from '../../isDefaultNamespace';
+import { PortainerNamespace } from '../../types';
+
+import { helper } from './helper';
+
+export const actions = helper.display({
+  header: 'Actions',
+  cell: Cell,
+});
+
+function Cell({
+  row: { original: namespace },
+}: CellContext<PortainerNamespace, unknown>) {
+  const environmentQuery = useCurrentEnvironment();
+
+  if (!environmentQuery.data) {
+    return null;
+  }
+
+  if (!canManageAccess(namespace, environmentQuery.data)) {
+    return '-';
+  }
+
+  return (
+    <Button
+      as={Link}
+      color="link"
+      props={{
+        to: 'kubernetes.resourcePools.resourcePool.access',
+        params: {
+          id: namespace.Name,
+        },
+      }}
+      icon={Users}
+      data-cy={`manage-access-button-${namespace.Name}`}
+    >
+      Manage access
+    </Button>
+  );
+
+  function canManageAccess(
+    { Name, IsSystem }: PortainerNamespace,
+    environment: Environment
+  ) {
+    return (
+      !IsSystem &&
+      (!isDefaultNamespace(Name) ||
+        environment.Kubernetes.Configuration.RestrictDefaultNamespace)
+    );
+  }
+}
diff --git a/app/react/kubernetes/namespaces/ListView/columns/helper.ts b/app/react/kubernetes/namespaces/ListView/columns/helper.ts
new file mode 100644
index 0000000..c914010
--- /dev/null
+++ b/app/react/kubernetes/namespaces/ListView/columns/helper.ts
@@ -0,0 +1,5 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { PortainerNamespace } from '../../types';
+
+export const helper = createColumnHelper<PortainerNamespace>();
diff --git a/app/react/kubernetes/namespaces/ListView/columns/useColumns.tsx b/app/react/kubernetes/namespaces/ListView/columns/useColumns.tsx
new file mode 100644
index 0000000..cbd5c77
--- /dev/null
+++ b/app/react/kubernetes/namespaces/ListView/columns/useColumns.tsx
@@ -0,0 +1,118 @@
+import _ from 'lodash';
+import { useMemo } from 'react';
+import { AlertTriangle } from 'lucide-react';
+
+import { isoDate } from '@/portainer/filters/filters';
+import { useAuthorizations } from '@/react/hooks/useUser';
+import { pluralize } from '@/portainer/helpers/strings';
+
+import { Link } from '@@/Link';
+import { StatusBadge } from '@@/StatusBadge';
+import { Badge } from '@@/Badge';
+import { SystemBadge } from '@@/Badge/SystemBadge';
+import { Icon } from '@@/Icon';
+
+import { helper } from './helper';
+import { actions } from './actions';
+
+export function useColumns() {
+  const hasAuthQuery = useAuthorizations(
+    'K8sResourcePoolsAccessManagementRW',
+    undefined,
+    true
+  );
+  return useMemo(
+    () =>
+      _.compact([
+        helper.accessor('Name', {
+          header: 'Name',
+          id: 'Name',
+          cell: ({ getValue, row: { original: item } }) => {
+            const name = getValue();
+
+            return (
+              <div className="flex gap-2">
+                <Link
+                  to="kubernetes.resourcePools.resourcePool"
+                  params={{
+                    id: name,
+                  }}
+                  data-cy={`namespace-link-${name}`}
+                >
+                  {name}
+                </Link>
+                {item.IsSystem && <SystemBadge className="ml-auto" />}
+              </div>
+            );
+          },
+        }),
+        helper.accessor('Status', {
+          header: 'Status',
+          cell({ getValue, row: { original: item } }) {
+            const status = getValue();
+            return (
+              <div className="flex items-center gap-2">
+                <StatusBadge color={getColor(status.phase)}>
+                  {status.phase}
+                </StatusBadge>
+                {item.UnhealthyEventCount > 0 && (
+                  <span className="inline-flex">
+                    <Badge type="warnSecondary">
+                      <Icon icon={AlertTriangle} className="!mr-1 h-3 w-3" />
+                      <Link
+                        to="kubernetes.resourcePools.resourcePool"
+                        params={{ id: item.Name, tab: 'events' }}
+                        data-cy={`namespace-warning-link-${item.Name}`}
+                        // use the badge text and hover color
+                        className="!text-inherit hover:text-inherit"
+                        title="View events"
+                      >
+                        {item.UnhealthyEventCount}{' '}
+                        {pluralize(item.UnhealthyEventCount, 'warning')}
+                      </Link>
+                    </Badge>
+                  </span>
+                )}
+              </div>
+            );
+
+            function getColor(status?: string) {
+              switch (status?.toLowerCase()) {
+                case 'active':
+                  return 'success';
+                case 'terminating':
+                  return 'danger';
+                default:
+                  return 'info';
+              }
+            }
+          },
+        }),
+        helper.accessor('ResourceQuota', {
+          header: 'Quota',
+          cell({ getValue }) {
+            const quota = getValue();
+
+            if (!quota) {
+              return '-';
+            }
+
+            return <Badge type="warn">Enabled</Badge>;
+          },
+        }),
+        helper.accessor('CreationDate', {
+          header: 'Created',
+          cell({ row: { original: item } }) {
+            return (
+              <>
+                {isoDate(item.CreationDate)}{' '}
+                {item.NamespaceOwner ? ` by ${item.NamespaceOwner}` : ''}
+              </>
+            );
+          },
+        }),
+        hasAuthQuery.authorized && actions,
+      ]),
+    [hasAuthQuery.authorized]
+  );
+}
diff --git a/app/react/kubernetes/namespaces/components/NamespaceForm/LoadBalancerFormSection/LoadBalancerFormSection.tsx b/app/react/kubernetes/namespaces/components/NamespaceForm/LoadBalancerFormSection/LoadBalancerFormSection.tsx
new file mode 100644
index 0000000..bd291d3
--- /dev/null
+++ b/app/react/kubernetes/namespaces/components/NamespaceForm/LoadBalancerFormSection/LoadBalancerFormSection.tsx
@@ -0,0 +1,26 @@
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+
+import { FormSection } from '@@/form-components/FormSection';
+import { SwitchField } from '@@/form-components/SwitchField';
+import { TextTip } from '@@/Tip/TextTip';
+
+export function LoadBalancerFormSection() {
+  return (
+    <FormSection title="Load balancers">
+      <TextTip color="blue">
+        You can set a quota on the number of external load balancers that can be
+        created inside this namespace. Set this quota to 0 to effectively
+        disable the use of load balancers in this namespace.
+      </TextTip>
+      <SwitchField
+        data-cy="k8sNamespaceCreate-loadBalancerQuotaToggle"
+        label="Load balancer quota"
+        labelClass="col-sm-3 col-lg-2"
+        fieldClass="pt-2"
+        checked={false}
+        featureId={FeatureId.K8S_RESOURCE_POOL_LB_QUOTA}
+        onChange={() => {}}
+      />
+    </FormSection>
+  );
+}
diff --git a/app/react/kubernetes/namespaces/components/NamespaceForm/LoadBalancerFormSection/index.ts b/app/react/kubernetes/namespaces/components/NamespaceForm/LoadBalancerFormSection/index.ts
new file mode 100644
index 0000000..2399762
--- /dev/null
+++ b/app/react/kubernetes/namespaces/components/NamespaceForm/LoadBalancerFormSection/index.ts
@@ -0,0 +1 @@
+export { LoadBalancerFormSection } from './LoadBalancerFormSection';
diff --git a/app/react/kubernetes/namespaces/components/NamespaceForm/NamespaceForm.validation.tsx b/app/react/kubernetes/namespaces/components/NamespaceForm/NamespaceForm.validation.tsx
new file mode 100644
index 0000000..9c6f5ac
--- /dev/null
+++ b/app/react/kubernetes/namespaces/components/NamespaceForm/NamespaceForm.validation.tsx
@@ -0,0 +1,28 @@
+import { string, object, array, SchemaOf } from 'yup';
+
+import { NamespaceFormValues } from '../../types';
+
+import { registriesValidationSchema } from './RegistriesFormSection/registriesValidationSchema';
+import { getResourceQuotaValidationSchema } from './ResourceQuotaFormSection/getResourceQuotaValidationSchema';
+
+export function getNamespaceValidationSchema(
+  memoryLimit: number,
+  cpuLimit: number,
+  namespaceNames: string[]
+): SchemaOf<NamespaceFormValues> {
+  return object({
+    name: string()
+      .matches(
+        /^[a-z0-9](?:[-a-z0-9]{0,251}[a-z0-9])?$/,
+        "This field must consist of lower case alphanumeric characters or '-', and contain at most 63 characters, and must start and end with an alphanumeric character."
+      )
+      .max(63, 'Name must be at most 63 characters.')
+      // must not have the same name as an existing namespace
+      .notOneOf(namespaceNames, 'Name must be unique.')
+      .required('Name is required.'),
+    resourceQuota: getResourceQuotaValidationSchema(memoryLimit, cpuLimit),
+    // ingress classes table is constrained already, and doesn't need validation
+    ingressClasses: array(),
+    registries: registriesValidationSchema,
+  });
+}
diff --git a/app/react/kubernetes/namespaces/components/NamespaceForm/NamespaceInnerForm.tsx b/app/react/kubernetes/namespaces/components/NamespaceForm/NamespaceInnerForm.tsx
new file mode 100644
index 0000000..2f7c15a
--- /dev/null
+++ b/app/react/kubernetes/namespaces/components/NamespaceForm/NamespaceInnerForm.tsx
@@ -0,0 +1,167 @@
+import { Field, Form, FormikProps } from 'formik';
+import { MultiValue } from 'react-select';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useCurrentEnvironment } from '@/react/hooks/useCurrentEnvironment';
+import { Registry } from '@/react/portainer/registries/types/registry';
+import { Authorized, useAuthorizations } from '@/react/hooks/useUser';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { FormSection } from '@@/form-components/FormSection';
+import { Input } from '@@/form-components/Input';
+import { FormActions } from '@@/form-components/FormActions';
+import { SystemBadge } from '@@/Badge/SystemBadge';
+
+import { IngressClassDatatable } from '../../../cluster/ingressClass/IngressClassDatatable';
+import { useIngressControllerClassMapQuery } from '../../../cluster/ingressClass/useIngressControllerClassMap';
+import { CreateNamespaceFormValues } from '../../CreateView/types';
+import { AnnotationsBeTeaser } from '../../../annotations/AnnotationsBeTeaser';
+import { isDefaultNamespace } from '../../isDefaultNamespace';
+import { useIsSystemNamespace } from '../../queries/useIsSystemNamespace';
+
+import { NamespaceSummary } from './NamespaceSummary';
+import { StorageQuotaFormSection } from './StorageQuotaFormSection/StorageQuotaFormSection';
+import { RegistriesFormSection } from './RegistriesFormSection';
+import { ResourceQuotaFormValues } from './ResourceQuotaFormSection/types';
+import { ResourceQuotaFormSection } from './ResourceQuotaFormSection';
+import { LoadBalancerFormSection } from './LoadBalancerFormSection';
+import { ToggleSystemNamespaceButton } from './ToggleSystemNamespaceButton';
+
+const namespaceWriteAuth = 'K8sResourcePoolDetailsW';
+
+export function NamespaceInnerForm({
+  errors,
+  isValid,
+  dirty,
+  setFieldValue,
+  values,
+  isUpdating,
+  initialValues,
+  isEdit,
+}: FormikProps<CreateNamespaceFormValues> & {
+  isEdit?: boolean;
+  isUpdating: boolean;
+}) {
+  const { authorized: hasNamespaceWriteAuth } = useAuthorizations(
+    namespaceWriteAuth,
+    undefined,
+    true
+  );
+  const isSystemNamespace = useIsSystemNamespace(values.name, isEdit === true);
+  const isEditingDisabled =
+    !hasNamespaceWriteAuth ||
+    isDefaultNamespace(values.name) ||
+    isSystemNamespace;
+  const environmentId = useEnvironmentId();
+  const environmentQuery = useCurrentEnvironment();
+  const ingressClassesQuery = useIngressControllerClassMapQuery({
+    environmentId,
+    namespace: values.name,
+    allowedOnly: true,
+  });
+
+  if (environmentQuery.isLoading) {
+    return null;
+  }
+
+  const useLoadBalancer =
+    environmentQuery.data?.Kubernetes.Configuration.UseLoadBalancer;
+  const enableResourceOverCommit =
+    environmentQuery.data?.Kubernetes.Configuration.EnableResourceOverCommit;
+  const enableIngressControllersPerNamespace =
+    environmentQuery.data?.Kubernetes.Configuration
+      .IngressAvailabilityPerNamespace;
+  const storageClasses =
+    environmentQuery.data?.Kubernetes.Configuration.StorageClasses ?? [];
+
+  return (
+    <Form className="form-horizontal">
+      <FormControl
+        inputId="namespace"
+        label="Name"
+        required={!isEdit}
+        errors={errors.name}
+      >
+        {isEdit ? (
+          <div className="mt-2 flex gap-2">
+            {values.name}
+            {isSystemNamespace && <SystemBadge />}
+          </div>
+        ) : (
+          <Field
+            as={Input}
+            id="namespace"
+            name="name"
+            disabled={isEdit}
+            placeholder="e.g. my-namespace"
+            data-cy="k8sNamespaceCreate-namespaceNameInput"
+          />
+        )}
+      </FormControl>
+      <AnnotationsBeTeaser />
+      {(values.resourceQuota.enabled || !isEditingDisabled) && (
+        <ResourceQuotaFormSection
+          isEdit={isEdit}
+          enableResourceOverCommit={enableResourceOverCommit}
+          values={values.resourceQuota}
+          onChange={(resourceQuota: ResourceQuotaFormValues) =>
+            setFieldValue('resourceQuota', resourceQuota)
+          }
+          errors={errors.resourceQuota}
+          namespaceName={values.name}
+          isEditingDisabled={isEditingDisabled}
+        />
+      )}
+      {useLoadBalancer && <LoadBalancerFormSection />}
+      {enableIngressControllersPerNamespace && (
+        <Authorized authorizations={[namespaceWriteAuth]}>
+          <FormSection title="Networking">
+            <IngressClassDatatable
+              onChange={(classes) => setFieldValue('ingressClasses', classes)}
+              values={values.ingressClasses}
+              description="Enable the ingress controllers that users can select when publishing applications in this namespace."
+              noIngressControllerLabel="No ingress controllers available in the cluster. Go to the cluster setup view to configure and allow the use of ingress controllers in the cluster."
+              view="namespace"
+              isLoading={ingressClassesQuery.isLoading}
+              initialValues={initialValues.ingressClasses}
+            />
+          </FormSection>
+        </Authorized>
+      )}
+      <RegistriesFormSection
+        values={values.registries}
+        onChange={(registries: MultiValue<Registry>) =>
+          setFieldValue('registries', registries)
+        }
+        errors={errors.registries}
+        isEditingDisabled={isEditingDisabled}
+      />
+      {storageClasses.length > 0 && (
+        <StorageQuotaFormSection storageClasses={storageClasses} />
+      )}
+      <Authorized authorizations={[namespaceWriteAuth]}>
+        <NamespaceSummary
+          initialValues={initialValues}
+          values={values}
+          isValid={isValid}
+        />
+        <FormActions
+          submitLabel={isEdit ? 'Update namespace' : 'Create namespace'}
+          loadingText={isEdit ? 'Updating namespace' : 'Creating namespace'}
+          isLoading={isUpdating}
+          isValid={isValid && dirty}
+          data-cy="k8sNamespaceCreate-submitButton"
+        >
+          {isEdit && (
+            <ToggleSystemNamespaceButton
+              isSystemNamespace={isSystemNamespace}
+              isEdit={isEdit}
+              environmentId={environmentId}
+              namespaceName={values.name}
+            />
+          )}
+        </FormActions>
+      </Authorized>
+    </Form>
+  );
+}
diff --git a/app/react/kubernetes/namespaces/components/NamespaceForm/NamespaceSummary.tsx b/app/react/kubernetes/namespaces/components/NamespaceForm/NamespaceSummary.tsx
new file mode 100644
index 0000000..3c1a36a
--- /dev/null
+++ b/app/react/kubernetes/namespaces/components/NamespaceForm/NamespaceSummary.tsx
@@ -0,0 +1,74 @@
+import { isEqual } from 'lodash';
+
+import { FormSection } from '@@/form-components/FormSection';
+import { TextTip } from '@@/Tip/TextTip';
+
+import { NamespaceFormValues } from '../../types';
+
+interface Props {
+  initialValues: NamespaceFormValues;
+  values: NamespaceFormValues;
+  isValid: boolean;
+}
+
+export function NamespaceSummary({ initialValues, values, isValid }: Props) {
+  // only compare the values from k8s related resources
+  const { registries: newRegistryValues, ...newK8sValues } = values;
+  const { registries: oldRegistryValues, ...oldK8sValues } = initialValues;
+  const hasChanges = !isEqual(newK8sValues, oldK8sValues);
+  if (!hasChanges || !isValid) {
+    return null;
+  }
+
+  const isCreatingNamespace = !oldK8sValues.name && newK8sValues.name;
+
+  const enabledQuotaInitialValues = initialValues.resourceQuota.enabled;
+  const enabledQuotaNewValues = values.resourceQuota.enabled;
+
+  const isCreatingResourceQuota =
+    !enabledQuotaInitialValues && enabledQuotaNewValues;
+  const isUpdatingResourceQuota =
+    enabledQuotaInitialValues && enabledQuotaNewValues;
+  const isDeletingResourceQuota =
+    enabledQuotaInitialValues && !enabledQuotaNewValues;
+
+  return (
+    <FormSection title="Summary" isFoldable defaultFolded={false}>
+      <div className="form-group">
+        <div className="col-sm-12">
+          <TextTip color="blue">
+            Portainer will execute the following Kubernetes actions.
+          </TextTip>
+        </div>
+      </div>
+      <div className="col-sm-12 small text-muted pt-1">
+        <ul>
+          {isCreatingNamespace && (
+            <li>
+              Create a <span className="bold">Namespace</span> named{' '}
+              <code>{values.name}</code>
+            </li>
+          )}
+          {isCreatingResourceQuota && (
+            <li>
+              Create a <span className="bold">ResourceQuota</span> named{' '}
+              <code>portainer-rq-{values.name}</code>
+            </li>
+          )}
+          {isUpdatingResourceQuota && (
+            <li>
+              Update a <span className="bold">ResourceQuota</span> named{' '}
+              <code>portainer-rq-{values.name}</code>
+            </li>
+          )}
+          {isDeletingResourceQuota && (
+            <li>
+              Delete a <span className="bold">ResourceQuota</span> named{' '}
+              <code>portainer-rq-{values.name}</code>
+            </li>
+          )}
+        </ul>
+      </div>
+    </FormSection>
+  );
+}
diff --git a/app/react/kubernetes/namespaces/components/NamespaceForm/RegistriesFormSection/RegistriesFormSection.tsx b/app/react/kubernetes/namespaces/components/NamespaceForm/RegistriesFormSection/RegistriesFormSection.tsx
new file mode 100644
index 0000000..e491fb1
--- /dev/null
+++ b/app/react/kubernetes/namespaces/components/NamespaceForm/RegistriesFormSection/RegistriesFormSection.tsx
@@ -0,0 +1,60 @@
+import { FormikErrors } from 'formik';
+import { MultiValue } from 'react-select';
+
+import { Registry } from '@/react/portainer/registries/types/registry';
+import { useEnvironmentRegistries } from '@/react/portainer/environments/queries/useEnvironmentRegistries';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+
+import { InlineLoader } from '@@/InlineLoader';
+import { FormControl } from '@@/form-components/FormControl';
+import { FormSection } from '@@/form-components/FormSection';
+import { TextTip } from '@@/Tip/TextTip';
+
+import { RegistriesSelector } from './RegistriesSelector';
+
+type Props = {
+  values: MultiValue<Registry>;
+  onChange: (value: MultiValue<Registry>) => void;
+  errors?: string | string[] | FormikErrors<Registry>[];
+  isEditingDisabled: boolean;
+};
+
+export function RegistriesFormSection({
+  values,
+  onChange,
+  errors,
+  isEditingDisabled,
+}: Props) {
+  const environmentId = useEnvironmentId();
+  const registriesQuery = useEnvironmentRegistries(environmentId, {
+    hideDefault: true,
+  });
+  return (
+    <FormSection title="Registries">
+      {!isEditingDisabled && (
+        <TextTip color="blue" className="mb-2">
+          Define which registries can be used by users who have access to this
+          namespace.
+        </TextTip>
+      )}
+      <FormControl
+        inputId="registries"
+        label={isEditingDisabled ? 'Selected registries' : 'Select registries'}
+        errors={errors}
+      >
+        {registriesQuery.isLoading && (
+          <InlineLoader>Loading registries...</InlineLoader>
+        )}
+        {registriesQuery.data && (
+          <RegistriesSelector
+            value={values}
+            onChange={(registries) => onChange(registries)}
+            options={registriesQuery.data}
+            inputId="registries"
+            isEditingDisabled={isEditingDisabled}
+          />
+        )}
+      </FormControl>
+    </FormSection>
+  );
+}
diff --git a/app/react/kubernetes/namespaces/components/NamespaceForm/RegistriesFormSection/RegistriesSelector.tsx b/app/react/kubernetes/namespaces/components/NamespaceForm/RegistriesFormSection/RegistriesSelector.tsx
new file mode 100644
index 0000000..2100da5
--- /dev/null
+++ b/app/react/kubernetes/namespaces/components/NamespaceForm/RegistriesFormSection/RegistriesSelector.tsx
@@ -0,0 +1,75 @@
+import { MultiValue } from 'react-select';
+
+import { Registry } from '@/react/portainer/registries/types/registry';
+import { useCurrentUser } from '@/react/hooks/useUser';
+
+import { Select } from '@@/form-components/ReactSelect';
+import { Link } from '@@/Link';
+
+interface Props {
+  value: MultiValue<Registry>;
+  onChange(value: MultiValue<Registry>): void;
+  options?: Registry[];
+  inputId?: string;
+  isEditingDisabled?: boolean;
+}
+
+export function RegistriesSelector({
+  value,
+  onChange,
+  options = [],
+  inputId,
+  isEditingDisabled,
+}: Props) {
+  const { isPureAdmin } = useCurrentUser();
+
+  if (options.length === 0) {
+    return (
+      <p className="text-muted mb-1 mt-2 text-xs">
+        {isPureAdmin ? (
+          <span>
+            No registries available. Head over to the{' '}
+            <Link
+              to="portainer.registries"
+              target="_blank"
+              data-cy="namespace-permissions-registries-selector"
+            >
+              registry view
+            </Link>{' '}
+            to define a container registry.
+          </span>
+        ) : (
+          <span>
+            No registries available. Contact your administrator to create a
+            container registry.
+          </span>
+        )}
+      </p>
+    );
+  }
+
+  if (isEditingDisabled) {
+    return (
+      <p className="text-muted mb-1 mt-2 text-xs">
+        {value.length === 0 ? 'None' : value.map((v) => v.Name).join(', ')}
+      </p>
+    );
+  }
+
+  return (
+    <Select
+      isMulti
+      getOptionLabel={(option) => option.Name}
+      getOptionValue={(option) => String(option.Id)}
+      options={options}
+      value={value}
+      closeMenuOnSelect={false}
+      onChange={onChange}
+      inputId={inputId}
+      data-cy="namespaceCreate-registrySelect"
+      id="namespaceCreate-registrySelect"
+      placeholder="Select one or more registries"
+      isDisabled={isEditingDisabled}
+    />
+  );
+}
diff --git a/app/react/kubernetes/namespaces/components/NamespaceForm/RegistriesFormSection/index.ts b/app/react/kubernetes/namespaces/components/NamespaceForm/RegistriesFormSection/index.ts
new file mode 100644
index 0000000..04f9343
--- /dev/null
+++ b/app/react/kubernetes/namespaces/components/NamespaceForm/RegistriesFormSection/index.ts
@@ -0,0 +1 @@
+export { RegistriesFormSection } from './RegistriesFormSection';
diff --git a/app/react/kubernetes/namespaces/components/NamespaceForm/RegistriesFormSection/registriesValidationSchema.ts b/app/react/kubernetes/namespaces/components/NamespaceForm/RegistriesFormSection/registriesValidationSchema.ts
new file mode 100644
index 0000000..51f5bb7
--- /dev/null
+++ b/app/react/kubernetes/namespaces/components/NamespaceForm/RegistriesFormSection/registriesValidationSchema.ts
@@ -0,0 +1,11 @@
+import { SchemaOf, array, object, number, string } from 'yup';
+
+import { Registry } from '@/react/portainer/registries/types/registry';
+
+export const registriesValidationSchema: SchemaOf<Registry[]> = array(
+  object({
+    Id: number().required('Registry ID is required.'),
+    Name: string().required('Registry name is required.'),
+  }) as unknown as SchemaOf<Registry>
+  // the only needed value is actually the id. SchemaOf throw a ts error if we don't cast to SchemaOf<Registry>
+);
diff --git a/app/react/kubernetes/namespaces/components/NamespaceForm/ResourceQuotaFormSection/NamespaceResourceReservation.tsx b/app/react/kubernetes/namespaces/components/NamespaceForm/ResourceQuotaFormSection/NamespaceResourceReservation.tsx
new file mode 100644
index 0000000..d4e97f0
--- /dev/null
+++ b/app/react/kubernetes/namespaces/components/NamespaceForm/ResourceQuotaFormSection/NamespaceResourceReservation.tsx
@@ -0,0 +1,45 @@
+import { ResourceReservation } from '@/react/kubernetes/components/ResourceReservation';
+
+import { ResourceQuotaFormValues } from './types';
+import { useNamespaceResourceReservationData } from './useNamespaceResourceReservationData';
+
+interface Props {
+  namespaceName: string;
+  environmentId: number;
+  resourceQuotaValues: ResourceQuotaFormValues;
+}
+
+export function NamespaceResourceReservation({
+  environmentId,
+  namespaceName,
+  resourceQuotaValues,
+}: Props) {
+  const {
+    cpuLimit,
+    memoryLimit,
+    displayResourceUsage,
+    resourceUsage,
+    resourceReservation,
+    isLoading,
+  } = useNamespaceResourceReservationData(
+    environmentId,
+    namespaceName,
+    resourceQuotaValues
+  );
+
+  if (!resourceQuotaValues.enabled) {
+    return null;
+  }
+
+  return (
+    <ResourceReservation
+      displayResourceUsage={displayResourceUsage}
+      resourceReservation={resourceReservation}
+      resourceUsage={resourceUsage}
+      cpuLimit={cpuLimit}
+      memoryLimit={memoryLimit}
+      description="Resource reservation represents the total amount of resource assigned to all the applications deployed inside this namespace."
+      isLoading={isLoading}
+    />
+  );
+}
diff --git a/app/react/kubernetes/namespaces/components/NamespaceForm/ResourceQuotaFormSection/ResourceQuotaFormSection.tsx b/app/react/kubernetes/namespaces/components/NamespaceForm/ResourceQuotaFormSection/ResourceQuotaFormSection.tsx
new file mode 100644
index 0000000..51d445e
--- /dev/null
+++ b/app/react/kubernetes/namespaces/components/NamespaceForm/ResourceQuotaFormSection/ResourceQuotaFormSection.tsx
@@ -0,0 +1,139 @@
+import { FormikErrors } from 'formik';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { FormError } from '@@/form-components/FormError';
+import { FormSection } from '@@/form-components/FormSection';
+import { FormSectionTitle } from '@@/form-components/FormSectionTitle';
+import { Slider } from '@@/form-components/Slider';
+import { SwitchField } from '@@/form-components/SwitchField';
+import { TextTip } from '@@/Tip/TextTip';
+import { SliderWithInput } from '@@/form-components/Slider/SliderWithInput';
+
+import { useClusterResourceLimitsQuery } from '../../../queries/useResourceLimitsQuery';
+
+import { ResourceQuotaFormValues } from './types';
+import { NamespaceResourceReservation } from './NamespaceResourceReservation';
+
+interface Props {
+  values: ResourceQuotaFormValues;
+  onChange: (value: ResourceQuotaFormValues) => void;
+  enableResourceOverCommit?: boolean;
+  errors?: FormikErrors<ResourceQuotaFormValues>;
+  namespaceName?: string;
+  isEdit?: boolean;
+  isEditingDisabled?: boolean;
+}
+
+export function ResourceQuotaFormSection({
+  values,
+  onChange,
+  errors,
+  isEdit,
+  enableResourceOverCommit,
+  namespaceName,
+  isEditingDisabled,
+}: Props) {
+  const environmentId = useEnvironmentId();
+  const resourceLimitsQuery = useClusterResourceLimitsQuery(environmentId);
+  const cpuLimit = resourceLimitsQuery.data?.CPU ?? 0;
+  const memoryLimit = resourceLimitsQuery.data?.Memory ?? 0;
+
+  return (
+    <FormSection title="Resource Quota">
+      {!isEditingDisabled && (
+        <>
+          <TextTip color="blue" className="mb-2">
+            A resource quota sets boundaries on the compute resources a
+            namespace can use. It&apos;s good practice to set a quota for a
+            namespace to manage resources effectively. Alternatively, you can
+            disable assigning a quota for unrestricted access (not recommended).
+          </TextTip>
+
+          <div className="form-group">
+            <div className="col-sm-12">
+              <SwitchField
+                data-cy="k8sNamespaceCreate-resourceAssignmentToggle"
+                disabled={!enableResourceOverCommit}
+                label="Resource assignment"
+                labelClass="col-sm-3 col-lg-2"
+                checked={values.enabled || !enableResourceOverCommit}
+                onChange={(enabled) => onChange({ ...values, enabled })}
+              />
+            </div>
+          </div>
+        </>
+      )}
+
+      {(values.enabled || !enableResourceOverCommit) && !isEditingDisabled && (
+        <div>
+          <FormSectionTitle>Resource Limits</FormSectionTitle>
+          {(!cpuLimit || !memoryLimit) && (
+            <FormError>
+              Not enough resources available in the cluster to apply a resource
+              reservation.
+            </FormError>
+          )}
+
+          <FormControl
+            label="Memory limit (MB)"
+            inputId="memory-limit"
+            className="[&>label]:mt-8"
+            errors={errors?.memory}
+          >
+            {memoryLimit >= 0 && (
+              <SliderWithInput
+                value={Number(values.memory) || 0}
+                onChange={(value) =>
+                  onChange({ ...values, memory: `${value}` })
+                }
+                max={memoryLimit}
+                min={0}
+                step={128}
+                dataCy="k8sNamespaceCreate-memoryLimit"
+                visibleTooltip
+                inputId="memory-limit"
+              />
+            )}
+          </FormControl>
+
+          <FormControl
+            label="CPU limit"
+            inputId="cpu-limit"
+            className="[&>label]:mt-8"
+            errors={errors?.cpu}
+          >
+            {cpuLimit >= 0 && (
+              <Slider
+                min={0}
+                max={cpuLimit / 1000}
+                step={0.1}
+                value={Number(values.cpu) || 0}
+                onChange={(cpu) => {
+                  if (Array.isArray(cpu)) {
+                    return;
+                  }
+                  onChange({ ...values, cpu: cpu.toString() });
+                }}
+                dataCy="k8sNamespaceCreate-cpuLimitSlider"
+                visibleTooltip
+              />
+            )}
+          </FormControl>
+
+          {cpuLimit && memoryLimit && typeof errors === 'string' ? (
+            <FormError>{errors}</FormError>
+          ) : null}
+        </div>
+      )}
+      {namespaceName && isEdit && (
+        <NamespaceResourceReservation
+          namespaceName={namespaceName}
+          environmentId={environmentId}
+          resourceQuotaValues={values}
+        />
+      )}
+    </FormSection>
+  );
+}
diff --git a/app/react/kubernetes/namespaces/components/NamespaceForm/ResourceQuotaFormSection/getResourceQuotaValidationSchema.ts b/app/react/kubernetes/namespaces/components/NamespaceForm/ResourceQuotaFormSection/getResourceQuotaValidationSchema.ts
new file mode 100644
index 0000000..a87cdc5
--- /dev/null
+++ b/app/react/kubernetes/namespaces/components/NamespaceForm/ResourceQuotaFormSection/getResourceQuotaValidationSchema.ts
@@ -0,0 +1,58 @@
+import { boolean, string, object, SchemaOf, TestContext } from 'yup';
+
+import { ResourceQuotaFormValues } from './types';
+
+export function getResourceQuotaValidationSchema(
+  memoryLimit: number,
+  cpuLimit: number
+): SchemaOf<ResourceQuotaFormValues> {
+  return object({
+    enabled: boolean().required('Resource quota enabled status is required.'),
+    memory: string()
+      .test(
+        'non-negative-memory-validation',
+        'Existing namespaces already have memory limits exceeding what is available in the cluster. Before you can set values here, you must reduce amounts in namespaces (and you may have to turn on over-commit temporarily to do so).',
+        () => nonNegativeLimit(memoryLimit)
+      )
+      .test(
+        'memory-validation',
+        `Value must be between 0 and ${memoryLimit}.`,
+        memoryValidation
+      ),
+    cpu: string()
+      .test(
+        'non-negative-memory-validation',
+        'Existing namespaces already have CPU limits exceeding what is available in the cluster. Before you can set values here, you must reduce amounts in namespaces (and you may have to turn on over-commit temporarily to do so).',
+        () => nonNegativeLimit(cpuLimit)
+      )
+      .test('cpu-validation', 'CPU limit value is required.', cpuValidation),
+  }).test(
+    'resource-quota-validation',
+    'At least a single limit must be set.',
+    oneLimitSet
+  );
+
+  function oneLimitSet({
+    enabled,
+    memory,
+    cpu,
+  }: Partial<ResourceQuotaFormValues>) {
+    return !enabled || (Number(memory) || 0) > 0 || (Number(cpu) || 0) > 0;
+  }
+
+  function nonNegativeLimit(limit: number) {
+    return limit >= 0;
+  }
+
+  function memoryValidation(this: TestContext, memoryValue?: string) {
+    const memory = Number(memoryValue) || 0;
+    const { enabled } = this.parent;
+    return !enabled || (memory >= 0 && memory <= memoryLimit);
+  }
+
+  function cpuValidation(this: TestContext, cpuValue?: string) {
+    const cpu = Number(cpuValue) || 0;
+    const { enabled } = this.parent;
+    return !enabled || cpu >= 0;
+  }
+}
diff --git a/app/react/kubernetes/namespaces/components/NamespaceForm/ResourceQuotaFormSection/index.ts b/app/react/kubernetes/namespaces/components/NamespaceForm/ResourceQuotaFormSection/index.ts
new file mode 100644
index 0000000..5a5cc6e
--- /dev/null
+++ b/app/react/kubernetes/namespaces/components/NamespaceForm/ResourceQuotaFormSection/index.ts
@@ -0,0 +1 @@
+export { ResourceQuotaFormSection } from './ResourceQuotaFormSection';
diff --git a/app/react/kubernetes/namespaces/components/NamespaceForm/ResourceQuotaFormSection/types.ts b/app/react/kubernetes/namespaces/components/NamespaceForm/ResourceQuotaFormSection/types.ts
new file mode 100644
index 0000000..4a0fda9
--- /dev/null
+++ b/app/react/kubernetes/namespaces/components/NamespaceForm/ResourceQuotaFormSection/types.ts
@@ -0,0 +1,17 @@
+/**
+ * @property enabled - Whether resource quota is enabled
+ * @property memory - Memory limit in bytes
+ * @property cpu - CPU limit in cores
+ */
+export type ResourceQuotaFormValues = {
+  enabled: boolean;
+  memory?: string;
+  cpu?: string;
+};
+
+export type ResourceQuotaPayload = {
+  enabled: boolean;
+  memory?: string;
+  cpu?: string;
+  loadBalancerLimit?: string;
+};
diff --git a/app/react/kubernetes/namespaces/components/NamespaceForm/ResourceQuotaFormSection/useNamespaceResourceReservationData.ts b/app/react/kubernetes/namespaces/components/NamespaceForm/ResourceQuotaFormSection/useNamespaceResourceReservationData.ts
new file mode 100644
index 0000000..3596bd5
--- /dev/null
+++ b/app/react/kubernetes/namespaces/components/NamespaceForm/ResourceQuotaFormSection/useNamespaceResourceReservationData.ts
@@ -0,0 +1,59 @@
+import { round } from 'lodash';
+
+import { getSafeValue, parseCPU } from '@/react/kubernetes/utils';
+import { PodMetrics } from '@/react/kubernetes/metrics/types';
+import { useNamespaceMetricsQuery } from '@/react/kubernetes/metrics/queries/useNamespaceMetricsQuery';
+import { megaBytesValue } from '@/react/kubernetes/namespaces/resourceQuotaUtils';
+
+import { useResourceQuotaUsed } from './useResourceQuotaUsed';
+import { ResourceQuotaFormValues } from './types';
+
+export function useNamespaceResourceReservationData(
+  environmentId: number,
+  namespaceName: string,
+  resourceQuotaValues: ResourceQuotaFormValues
+) {
+  const { data: quota, isLoading: isQuotaLoading } = useResourceQuotaUsed(
+    environmentId,
+    namespaceName
+  );
+  const { data: metrics, isLoading: isMetricsLoading } =
+    useNamespaceMetricsQuery(environmentId, namespaceName, {
+      select: aggregatePodUsage,
+    });
+
+  return {
+    cpuLimit: Number(resourceQuotaValues.cpu) || 0,
+    memoryLimit: Number(resourceQuotaValues.memory) || 0,
+    displayResourceUsage: !!metrics,
+    resourceReservation: {
+      cpu: getSafeValue(quota?.cpu || 0),
+      memory: getSafeValue(quota?.memory || 0),
+    },
+    resourceUsage: {
+      cpu: getSafeValue(metrics?.cpu || 0),
+      memory: getSafeValue(metrics?.memory || 0),
+    },
+    isLoading: isQuotaLoading || isMetricsLoading,
+  };
+}
+
+/**
+ * Aggregates the resource usage of all the containers in the namespace.
+ * @param podMetricsList - List of pod metrics
+ * @returns Aggregated resource usage. CPU cores are rounded to 3 decimal places. Memory is in MB.
+ */
+function aggregatePodUsage(podMetricsList: PodMetrics) {
+  const containerResourceUsageList = podMetricsList.items?.flatMap((i) =>
+    i.containers.map((c) => c.usage)
+  );
+  const namespaceResourceUsage = containerResourceUsageList?.reduce(
+    (total, usage) => ({
+      cpu: total.cpu + parseCPU(usage.cpu),
+      memory: total.memory + megaBytesValue(usage.memory),
+    }),
+    { cpu: 0, memory: 0 }
+  ) || { cpu: 0, memory: 0 };
+  namespaceResourceUsage.cpu = round(namespaceResourceUsage.cpu, 3);
+  return namespaceResourceUsage;
+}
diff --git a/app/react/kubernetes/namespaces/components/NamespaceForm/ResourceQuotaFormSection/useResourceQuotaUsed.ts b/app/react/kubernetes/namespaces/components/NamespaceForm/ResourceQuotaFormSection/useResourceQuotaUsed.ts
new file mode 100644
index 0000000..1783d8e
--- /dev/null
+++ b/app/react/kubernetes/namespaces/components/NamespaceForm/ResourceQuotaFormSection/useResourceQuotaUsed.ts
@@ -0,0 +1,39 @@
+import { round } from 'lodash';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { parseCPU } from '@/react/kubernetes/utils';
+
+import { useNamespaceQuery } from '../../../queries/useNamespaceQuery';
+import { megaBytesValue } from '../../../resourceQuotaUtils';
+import { PortainerNamespace } from '../../../types';
+
+/**
+ * Returns the resource quota used for a namespace.
+ * @param environmentId - The environment ID.
+ * @param namespaceName - The namespace name.
+ * @param enabled - Whether the resource quota is enabled.
+ * @returns The resource quota used for the namespace. CPU (cores) is rounded to 3 decimal places. Memory is in MB.
+ */
+export function useResourceQuotaUsed(
+  environmentId: EnvironmentId,
+  namespaceName: string,
+  enabled = true
+) {
+  return useNamespaceQuery(environmentId, namespaceName, {
+    select: parseResourceQuotaUsed,
+    enabled,
+    params: { withResourceQuota: 'true' },
+  });
+}
+
+function parseResourceQuotaUsed(namespace: PortainerNamespace) {
+  return {
+    cpu: round(
+      parseCPU(namespace.ResourceQuota?.status?.used?.['requests.cpu'] ?? ''),
+      3
+    ),
+    memory: megaBytesValue(
+      namespace.ResourceQuota?.status?.used?.['requests.memory'] ?? ''
+    ),
+  };
+}
diff --git a/app/react/kubernetes/namespaces/components/NamespaceForm/StorageQuotaFormSection/StorageQuotaFormSection.tsx b/app/react/kubernetes/namespaces/components/NamespaceForm/StorageQuotaFormSection/StorageQuotaFormSection.tsx
new file mode 100644
index 0000000..454f226
--- /dev/null
+++ b/app/react/kubernetes/namespaces/components/NamespaceForm/StorageQuotaFormSection/StorageQuotaFormSection.tsx
@@ -0,0 +1,27 @@
+import { StorageClass } from '@/react/portainer/environments/types';
+
+import { FormSection } from '@@/form-components/FormSection';
+import { TextTip } from '@@/Tip/TextTip';
+
+import { StorageQuotaItem } from './StorageQuotaItem';
+
+interface Props {
+  storageClasses: StorageClass[];
+}
+
+export function StorageQuotaFormSection({ storageClasses }: Props) {
+  return (
+    <FormSection title="Storage">
+      <TextTip color="blue">
+        Quotas can be set on each storage option to prevent users from exceeding
+        a specific threshold when deploying applications. You can set a quota to
+        0 to effectively prevent the usage of a specific storage option inside
+        this namespace.
+      </TextTip>
+
+      {storageClasses.map((storageClass) => (
+        <StorageQuotaItem key={storageClass.Name} storageClass={storageClass} />
+      ))}
+    </FormSection>
+  );
+}
diff --git a/app/react/kubernetes/namespaces/components/NamespaceForm/StorageQuotaFormSection/StorageQuotaItem.tsx b/app/react/kubernetes/namespaces/components/NamespaceForm/StorageQuotaFormSection/StorageQuotaItem.tsx
new file mode 100644
index 0000000..f0ee7ed
--- /dev/null
+++ b/app/react/kubernetes/namespaces/components/NamespaceForm/StorageQuotaFormSection/StorageQuotaItem.tsx
@@ -0,0 +1,43 @@
+import { Database } from 'lucide-react';
+
+import { StorageClass } from '@/react/portainer/environments/types';
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+import { Authorized } from '@/react/hooks/useUser';
+
+import { Icon } from '@@/Icon';
+import { FormSectionTitle } from '@@/form-components/FormSectionTitle';
+import { SwitchField } from '@@/form-components/SwitchField';
+
+type Props = {
+  storageClass: StorageClass;
+};
+
+export function StorageQuotaItem({ storageClass }: Props) {
+  return (
+    <div key={storageClass.Name}>
+      <FormSectionTitle>
+        <div className="vertical-center text-muted inline-flex gap-1 align-top">
+          <Icon icon={Database} className="!mt-0.5 flex-none" />
+          <span>{storageClass.Name}</span>
+        </div>
+      </FormSectionTitle>
+      <hr className="mb-0 mt-2 w-full" />
+      <Authorized authorizations={['K8sResourcePoolDetailsW']}>
+        <div className="form-group mb-4">
+          <div className="col-sm-12">
+            <SwitchField
+              data-cy="k8sNamespaceEdit-storageClassQuota"
+              disabled
+              label="Enable quota"
+              labelClass="col-sm-3 col-lg-2"
+              fieldClass="pt-2"
+              checked={false}
+              onChange={() => {}}
+              featureId={FeatureId.K8S_RESOURCE_POOL_STORAGE_QUOTA}
+            />
+          </div>
+        </div>
+      </Authorized>
+    </div>
+  );
+}
diff --git a/app/react/kubernetes/namespaces/components/NamespaceForm/StorageQuotaFormSection/index.ts b/app/react/kubernetes/namespaces/components/NamespaceForm/StorageQuotaFormSection/index.ts
new file mode 100644
index 0000000..1db1227
--- /dev/null
+++ b/app/react/kubernetes/namespaces/components/NamespaceForm/StorageQuotaFormSection/index.ts
@@ -0,0 +1 @@
+export { StorageQuotaFormSection } from './StorageQuotaFormSection';
diff --git a/app/react/kubernetes/namespaces/components/NamespaceForm/ToggleSystemNamespaceButton.tsx b/app/react/kubernetes/namespaces/components/NamespaceForm/ToggleSystemNamespaceButton.tsx
new file mode 100644
index 0000000..d220444
--- /dev/null
+++ b/app/react/kubernetes/namespaces/components/NamespaceForm/ToggleSystemNamespaceButton.tsx
@@ -0,0 +1,64 @@
+import { notifySuccess } from '@/portainer/services/notifications';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { LoadingButton } from '@@/buttons';
+import { confirmUpdate } from '@@/modals/confirm';
+
+import { useToggleSystemNamespaceMutation } from '../../queries/useToggleSystemNamespace';
+
+export function ToggleSystemNamespaceButton({
+  isSystemNamespace,
+  isEdit,
+  environmentId,
+  namespaceName,
+}: {
+  isSystemNamespace: boolean;
+  isEdit: boolean;
+  environmentId: EnvironmentId;
+  namespaceName: string;
+}) {
+  const toggleSystemNamespaceMutation = useToggleSystemNamespaceMutation(
+    environmentId,
+    namespaceName
+  );
+  if (!isEdit) {
+    return null;
+  }
+
+  return (
+    <LoadingButton
+      onClick={markUnmarkAsSystem}
+      className="!ml-0"
+      data-cy="mark-as-system-button"
+      color="default"
+      type="button"
+      loadingText={
+        isSystemNamespace ? 'Unmarking as system' : 'Marking as system'
+      }
+      isLoading={toggleSystemNamespaceMutation.isLoading}
+    >
+      {isSystemNamespace ? 'Unmark as system' : 'Mark as system'}
+    </LoadingButton>
+  );
+
+  async function markUnmarkAsSystem() {
+    const confirmed = await confirmMarkUnmarkAsSystem(isSystemNamespace);
+    if (confirmed) {
+      toggleSystemNamespaceMutation.mutate(!isSystemNamespace, {
+        onSuccess: () => {
+          notifySuccess('Success', 'Namespace updated');
+        },
+      });
+    }
+  }
+}
+
+async function confirmMarkUnmarkAsSystem(isSystemNamespace: boolean) {
+  const message = isSystemNamespace
+    ? 'Unmarking this namespace as system will allow non administrator users to manage it and the resources in contains depending on the access control settings. Are you sure?'
+    : 'Marking this namespace as a system namespace will prevent non administrator users from managing it and the resources it contains. Are you sure?';
+
+  return new Promise((resolve) => {
+    confirmUpdate(message, resolve);
+  });
+}
diff --git a/app/react/kubernetes/namespaces/components/NamespaceForm/utils.ts b/app/react/kubernetes/namespaces/components/NamespaceForm/utils.ts
new file mode 100644
index 0000000..fe9b906
--- /dev/null
+++ b/app/react/kubernetes/namespaces/components/NamespaceForm/utils.ts
@@ -0,0 +1,18 @@
+import { NamespaceFormValues, NamespacePayload } from '../../types';
+
+export function transformFormValuesToNamespacePayload(
+  createNamespaceFormValues: NamespaceFormValues,
+  owner: string
+): NamespacePayload {
+  const memoryInBytes =
+    Number(createNamespaceFormValues.resourceQuota.memory) * 10 ** 6;
+  return {
+    Name: createNamespaceFormValues.name,
+    Owner: owner,
+    ResourceQuota: {
+      enabled: createNamespaceFormValues.resourceQuota.enabled,
+      cpu: createNamespaceFormValues.resourceQuota.cpu,
+      memory: `${memoryInBytes}`,
+    },
+  };
+}
diff --git a/app/react/kubernetes/namespaces/components/NamespaceYamlEditor.tsx b/app/react/kubernetes/namespaces/components/NamespaceYamlEditor.tsx
new file mode 100644
index 0000000..6442cd5
--- /dev/null
+++ b/app/react/kubernetes/namespaces/components/NamespaceYamlEditor.tsx
@@ -0,0 +1,47 @@
+import { useCurrentStateAndParams } from '@uirouter/react';
+
+import { InlineLoader } from '@@/InlineLoader';
+import { Widget } from '@@/Widget/Widget';
+import { WidgetBody } from '@@/Widget';
+
+import { YAMLInspector } from '../../components/YAMLInspector';
+import { useNamespaceYAML } from '../queries/useNamespaceYAML';
+
+export function NamespaceYAMLEditor() {
+  const {
+    params: { id: namespace, endpointId: environmentId },
+  } = useCurrentStateAndParams();
+  const { data: fullNamespaceYaml, isLoading: isNamespaceYAMLLoading } =
+    useNamespaceYAML(environmentId, namespace);
+
+  if (isNamespaceYAMLLoading) {
+    return (
+      <div className="row">
+        <div className="col-sm-12">
+          <Widget>
+            <WidgetBody>
+              <InlineLoader>Loading namespace YAML...</InlineLoader>
+            </WidgetBody>
+          </Widget>
+        </div>
+      </div>
+    );
+  }
+
+  return (
+    <div className="row">
+      <div className="col-sm-12">
+        <Widget>
+          <WidgetBody>
+            <YAMLInspector
+              identifier="namespace-yaml"
+              data={fullNamespaceYaml || ''}
+              hideMessage
+              data-cy="namespace-yaml"
+            />
+          </WidgetBody>
+        </Widget>
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/kubernetes/namespaces/getSelfSubjectAccessReview.ts b/app/react/kubernetes/namespaces/getSelfSubjectAccessReview.ts
new file mode 100644
index 0000000..6ad1b59
--- /dev/null
+++ b/app/react/kubernetes/namespaces/getSelfSubjectAccessReview.ts
@@ -0,0 +1,53 @@
+import axios from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { parseKubernetesAxiosError } from '../axiosError';
+
+interface SelfSubjectAccessReviewResponse {
+  status: {
+    allowed: boolean;
+  };
+  spec: {
+    resourceAttributes: {
+      namespace: string;
+    };
+  };
+}
+
+/**
+ * getSelfSubjectAccessReview is used to retrieve the self subject access review for a given namespace.
+ * It's great to use this to determine if a user has access to a namespace.
+ * @returns the self subject access review for the given namespace
+ * */
+export async function getSelfSubjectAccessReview(
+  environmentId: EnvironmentId,
+  namespaceName: string,
+  verb = 'list',
+  resource = 'deployments',
+  group = 'apps'
+) {
+  try {
+    const { data: accessReview } =
+      await axios.post<SelfSubjectAccessReviewResponse>(
+        `endpoints/${environmentId}/kubernetes/apis/authorization.k8s.io/v1/selfsubjectaccessreviews`,
+        {
+          spec: {
+            resourceAttributes: {
+              group,
+              resource,
+              verb,
+              namespace: namespaceName,
+            },
+          },
+          apiVersion: 'authorization.k8s.io/v1',
+          kind: 'SelfSubjectAccessReview',
+        }
+      );
+    return accessReview;
+  } catch (e) {
+    throw parseKubernetesAxiosError(
+      e,
+      'Unable to retrieve self subject access review'
+    );
+  }
+}
diff --git a/app/react/kubernetes/namespaces/hooks/useNamespaceAccessRedirect.ts b/app/react/kubernetes/namespaces/hooks/useNamespaceAccessRedirect.ts
new file mode 100644
index 0000000..2701abd
--- /dev/null
+++ b/app/react/kubernetes/namespaces/hooks/useNamespaceAccessRedirect.ts
@@ -0,0 +1,51 @@
+import { useEffect } from 'react';
+import { useCurrentStateAndParams, useRouter } from '@uirouter/react';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+
+import { useNamespacesQuery } from '../queries/useNamespacesQuery';
+
+type RedirectOptions = {
+  to: string;
+  params?: Record<string, unknown>;
+};
+
+/**
+ * Redirects away when the provided namespace is not in the allowed namespaces list for the current environment.
+ */
+export function useNamespaceAccessRedirect(
+  namespace?: string,
+  { to, params } = { to: 'kubernetes.dashboard', params: {} } as RedirectOptions
+) {
+  const router = useRouter();
+  const namespaceInParams = useCurrentStateAndParams().params.namespace;
+  const currentNamespace = namespace || namespaceInParams;
+  const environmentId = useEnvironmentId();
+
+  const namespacesQuery = useNamespacesQuery(environmentId);
+
+  useEffect(() => {
+    if (!currentNamespace) {
+      return;
+    }
+
+    if (namespacesQuery.isLoading || namespacesQuery.isFetching) {
+      return;
+    }
+
+    const namespaces = namespacesQuery.data ?? [];
+    const isAllowed = namespaces.some((ns) => ns.Name === currentNamespace);
+
+    if (!isAllowed) {
+      router.stateService.go(to, params);
+    }
+  }, [
+    currentNamespace,
+    to,
+    params,
+    router.stateService,
+    namespacesQuery.isLoading,
+    namespacesQuery.isFetching,
+    namespacesQuery.data,
+  ]);
+}
diff --git a/app/react/kubernetes/namespaces/isDefaultNamespace.ts b/app/react/kubernetes/namespaces/isDefaultNamespace.ts
new file mode 100644
index 0000000..27b52c5
--- /dev/null
+++ b/app/react/kubernetes/namespaces/isDefaultNamespace.ts
@@ -0,0 +1,5 @@
+export const KUBERNETES_DEFAULT_NAMESPACE = 'default';
+
+export function isDefaultNamespace(namespace: string) {
+  return namespace === KUBERNETES_DEFAULT_NAMESPACE;
+}
diff --git a/app/react/kubernetes/namespaces/queries/queryKeys.ts b/app/react/kubernetes/namespaces/queries/queryKeys.ts
new file mode 100644
index 0000000..6c0a046
--- /dev/null
+++ b/app/react/kubernetes/namespaces/queries/queryKeys.ts
@@ -0,0 +1,35 @@
+import { compact } from 'lodash';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+export const queryKeys = {
+  list: (
+    environmentId: EnvironmentId,
+    options?: { withResourceQuota?: boolean; withUnhealthyEvents?: boolean }
+  ) =>
+    compact([
+      'environments',
+      environmentId,
+      'kubernetes',
+      'namespaces',
+      options?.withResourceQuota,
+      options?.withUnhealthyEvents,
+    ]),
+  namespace: (environmentId: EnvironmentId, namespace: string) =>
+    [
+      'environments',
+      environmentId,
+      'kubernetes',
+      'namespaces',
+      namespace,
+    ] as const,
+  namespaceYAML: (environmentId: EnvironmentId, namespace: string) =>
+    [
+      'environments',
+      environmentId,
+      'kubernetes',
+      'namespaces',
+      namespace,
+      'yaml',
+    ] as const,
+};
diff --git a/app/react/kubernetes/namespaces/queries/useCreateNamespaceMutation.ts b/app/react/kubernetes/namespaces/queries/useCreateNamespaceMutation.ts
new file mode 100644
index 0000000..8823306
--- /dev/null
+++ b/app/react/kubernetes/namespaces/queries/useCreateNamespaceMutation.ts
@@ -0,0 +1,82 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError, withInvalidate } from '@/react-tools/react-query';
+import { updateEnvironmentRegistryAccess } from '@/react/portainer/environments/environment.service/registries';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { IngressControllerClassMap } from '../../cluster/ingressClass/types';
+import { updateIngressControllerClassMap } from '../../cluster/ingressClass/useIngressControllerClassMap';
+import { Namespaces, NamespacePayload, UpdateRegistryPayload } from '../types';
+
+import { queryKeys } from './queryKeys';
+
+export function useCreateNamespaceMutation(environmentId: EnvironmentId) {
+  const queryClient = useQueryClient();
+  return useMutation(
+    async ({
+      createNamespacePayload,
+      updateRegistriesPayload,
+      namespaceIngressControllerPayload,
+    }: {
+      createNamespacePayload: NamespacePayload;
+      updateRegistriesPayload: UpdateRegistryPayload[];
+      namespaceIngressControllerPayload: IngressControllerClassMap[];
+    }) => {
+      // create the namespace first, so that it exists before referencing it in the registry access request
+      await createNamespace(environmentId, createNamespacePayload);
+
+      // collect promises
+      const updateRegistriesPromises = updateRegistriesPayload.map(
+        ({ Id, Namespaces }) =>
+          updateEnvironmentRegistryAccess(environmentId, Id, {
+            Namespaces,
+          })
+      );
+      const updateIngressControllerPromise =
+        namespaceIngressControllerPayload.length > 0
+          ? updateIngressControllerClassMap(
+              environmentId,
+              namespaceIngressControllerPayload,
+              createNamespacePayload.Name
+            )
+          : Promise.resolve();
+
+      // return combined promises
+      return Promise.allSettled([
+        updateIngressControllerPromise,
+        ...updateRegistriesPromises,
+      ]);
+    },
+    {
+      ...withError('Unable to create namespace'),
+      ...withInvalidate(queryClient, [queryKeys.list(environmentId)]),
+    }
+  );
+}
+
+// createNamespace is used to create a namespace using the Portainer backend
+async function createNamespace(
+  environmentId: EnvironmentId,
+  payload: NamespacePayload
+) {
+  try {
+    const { data: ns } = await axios.post<Namespaces>(
+      buildUrl(environmentId),
+      payload
+    );
+    return ns;
+  } catch (e) {
+    throw parseAxiosError(e as Error, 'Unable to create namespace');
+  }
+}
+
+function buildUrl(environmentId: EnvironmentId, namespace?: string) {
+  let url = `kubernetes/${environmentId}/namespaces`;
+
+  if (namespace) {
+    url += `/${namespace}`;
+  }
+
+  return url;
+}
diff --git a/app/react/kubernetes/namespaces/queries/useDeleteNamespaces.ts b/app/react/kubernetes/namespaces/queries/useDeleteNamespaces.ts
new file mode 100644
index 0000000..79b31d2
--- /dev/null
+++ b/app/react/kubernetes/namespaces/queries/useDeleteNamespaces.ts
@@ -0,0 +1,47 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError, withInvalidate } from '@/react-tools/react-query';
+
+import { queryKeys } from './queryKeys';
+
+type DeleteNamespaceError = {
+  namespaceName: string;
+  error: string;
+};
+
+// when successful, the response will contain a list of deleted namespaces and a list of errors
+type DeleteNamespacesResponse = {
+  deleted: string[];
+  errors: DeleteNamespaceError[];
+} | null;
+
+// useDeleteNamespaces is a react query mutation that removes a list of namespaces,
+export function useDeleteNamespaces(environmentId: number) {
+  const queryClient = useQueryClient();
+  return useMutation(
+    ({ namespaceNames }: { namespaceNames: string[] }) =>
+      deleteNamespaces(environmentId, namespaceNames),
+    {
+      ...withInvalidate(queryClient, [queryKeys.list(environmentId)]),
+      ...withError('Unable to delete namespaces'),
+      // onSuccess handled by the caller
+    }
+  );
+}
+
+async function deleteNamespaces(
+  environmentId: number,
+  namespaceNames: string[]
+) {
+  try {
+    return await axios.delete<DeleteNamespacesResponse>(
+      `kubernetes/${environmentId}/namespaces`,
+      {
+        data: namespaceNames,
+      }
+    );
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to delete namespace');
+  }
+}
diff --git a/app/react/kubernetes/namespaces/queries/useIsSystemNamespace.ts b/app/react/kubernetes/namespaces/queries/useIsSystemNamespace.ts
new file mode 100644
index 0000000..2b59ac9
--- /dev/null
+++ b/app/react/kubernetes/namespaces/queries/useIsSystemNamespace.ts
@@ -0,0 +1,24 @@
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+
+import { PortainerNamespace } from '../types';
+
+import { useNamespaceQuery } from './useNamespaceQuery';
+
+export function useIsSystemNamespace(namespace: string, enabled = true) {
+  const envId = useEnvironmentId();
+  const query = useNamespaceQuery(envId, namespace, {
+    select: (namespace) => namespace.IsSystem,
+    enabled,
+  });
+
+  return !!query.data;
+}
+
+export function isSystemNamespace(
+  namespaceName: string,
+  namespaces?: PortainerNamespace[]
+) {
+  return namespaces?.some(
+    (namespace) => namespace.Name === namespaceName && namespace.IsSystem
+  );
+}
diff --git a/app/react/kubernetes/namespaces/queries/useNamespaceQuery.ts b/app/react/kubernetes/namespaces/queries/useNamespaceQuery.ts
new file mode 100644
index 0000000..a70351c
--- /dev/null
+++ b/app/react/kubernetes/namespaces/queries/useNamespaceQuery.ts
@@ -0,0 +1,56 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { notifyError } from '@/portainer/services/notifications';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { PortainerNamespace } from '../types';
+
+import { queryKeys } from './queryKeys';
+
+type QueryParams = 'withResourceQuota';
+
+export function useNamespaceQuery<T = PortainerNamespace>(
+  environmentId: EnvironmentId,
+  namespace: string,
+  {
+    select,
+    enabled,
+    params,
+  }: {
+    select?(namespace: PortainerNamespace): T;
+    params?: Record<QueryParams, string>;
+    enabled?: boolean;
+  } = {}
+) {
+  return useQuery(
+    queryKeys.namespace(environmentId, namespace),
+    () => getNamespace(environmentId, namespace, params),
+    {
+      enabled: !!environmentId && !!namespace && enabled,
+      onError: (err) => {
+        notifyError('Failure', err as Error, 'Unable to get namespace.');
+      },
+      select,
+    }
+  );
+}
+
+// getNamespace is used to retrieve a namespace using the Portainer backend
+export async function getNamespace(
+  environmentId: EnvironmentId,
+  namespace: string,
+  params?: Record<QueryParams, string>
+) {
+  try {
+    const { data: ns } = await axios.get<PortainerNamespace>(
+      `kubernetes/${environmentId}/namespaces/${namespace}`,
+      {
+        params,
+      }
+    );
+    return ns;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to retrieve namespace');
+  }
+}
diff --git a/app/react/kubernetes/namespaces/queries/useNamespaceYAML.ts b/app/react/kubernetes/namespaces/queries/useNamespaceYAML.ts
new file mode 100644
index 0000000..14c0c2b
--- /dev/null
+++ b/app/react/kubernetes/namespaces/queries/useNamespaceYAML.ts
@@ -0,0 +1,71 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { isFulfilled } from '@/portainer/helpers/promise-utils';
+
+import { parseKubernetesAxiosError } from '../../axiosError';
+import { generateResourceQuotaName } from '../resourceQuotaUtils';
+
+import { queryKeys } from './queryKeys';
+
+/**
+ * Gets the YAML for a namespace and its resource quota directly from the K8s proxy API.
+ */
+export function useNamespaceYAML(
+  environmentId: EnvironmentId,
+  namespaceName: string
+) {
+  return useQuery({
+    queryKey: queryKeys.namespaceYAML(environmentId, namespaceName),
+    queryFn: () => composeNamespaceYAML(environmentId, namespaceName),
+  });
+}
+
+async function composeNamespaceYAML(
+  environmentId: EnvironmentId,
+  namespace: string
+) {
+  const settledPromises = await Promise.allSettled([
+    getNamespaceYAML(environmentId, namespace),
+    getResourceQuotaYAML(environmentId, namespace),
+  ]);
+  const resolvedPromises = settledPromises.filter(isFulfilled);
+  return resolvedPromises.map((p) => p.value).join('\n---\n');
+}
+
+async function getNamespaceYAML(
+  environmentId: EnvironmentId,
+  namespace: string
+) {
+  try {
+    const { data: yaml } = await axios.get<string>(
+      `/endpoints/${environmentId}/kubernetes/api/v1/namespaces/${namespace}`,
+      {
+        headers: {
+          Accept: 'application/yaml',
+        },
+      }
+    );
+    return yaml;
+  } catch (error) {
+    throw parseKubernetesAxiosError(error, 'Unable to retrieve namespace YAML');
+  }
+}
+
+async function getResourceQuotaYAML(
+  environmentId: EnvironmentId,
+  namespace: string
+) {
+  const resourceQuotaName = generateResourceQuotaName(namespace);
+  try {
+    const { data: yaml } = await axios.get<string>(
+      `/endpoints/${environmentId}/kubernetes/api/v1/namespaces/${namespace}/resourcequotas/${resourceQuotaName}`,
+      { headers: { Accept: 'application/yaml' } }
+    );
+    return yaml;
+  } catch (e) {
+    // silently ignore if resource quota does not exist
+    return null;
+  }
+}
diff --git a/app/react/kubernetes/namespaces/queries/useNamespacesQuery.ts b/app/react/kubernetes/namespaces/queries/useNamespacesQuery.ts
new file mode 100644
index 0000000..c134a73
--- /dev/null
+++ b/app/react/kubernetes/namespaces/queries/useNamespacesQuery.ts
@@ -0,0 +1,60 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { withError } from '@/react-tools/react-query';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { PortainerNamespace } from '../types';
+
+import { queryKeys } from './queryKeys';
+
+export function useNamespacesQuery<T = PortainerNamespace[]>(
+  environmentId: EnvironmentId,
+  options?: {
+    autoRefreshRate?: number;
+    withResourceQuota?: boolean;
+    withUnhealthyEvents?: boolean;
+    select?: (namespaces: PortainerNamespace[]) => T;
+  }
+) {
+  return useQuery(
+    queryKeys.list(environmentId, {
+      withResourceQuota: !!options?.withResourceQuota,
+      withUnhealthyEvents: !!options?.withUnhealthyEvents,
+    }),
+    async () =>
+      getNamespaces(
+        environmentId,
+        options?.withResourceQuota,
+        options?.withUnhealthyEvents
+      ),
+    {
+      ...withError('Unable to get namespaces.'),
+      refetchInterval() {
+        return options?.autoRefreshRate ?? false;
+      },
+      select: options?.select,
+    }
+  );
+}
+
+// getNamespaces is used to retrieve namespaces using the Portainer backend with caching
+export async function getNamespaces(
+  environmentId: EnvironmentId,
+  withResourceQuota?: boolean,
+  withUnhealthyEvents?: boolean
+) {
+  const params = {
+    withResourceQuota,
+    withUnhealthyEvents,
+  };
+  try {
+    const { data: namespaces } = await axios.get<PortainerNamespace[]>(
+      `kubernetes/${environmentId}/namespaces`,
+      { params }
+    );
+    return namespaces;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to retrieve namespaces');
+  }
+}
diff --git a/app/react/kubernetes/namespaces/queries/useResourceLimitsQuery.ts b/app/react/kubernetes/namespaces/queries/useResourceLimitsQuery.ts
new file mode 100644
index 0000000..0f2ca8b
--- /dev/null
+++ b/app/react/kubernetes/namespaces/queries/useResourceLimitsQuery.ts
@@ -0,0 +1,37 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { notifyError } from '@/portainer/services/notifications';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+type K8sNodeLimits = {
+  CPU: number;
+  Memory: number;
+};
+
+/**
+ * useClusterResourceLimitsQuery is used to retrieve the total resource limits for a cluster, minus the allocated resources taken by existing namespaces
+ * @returns the available resource limits for the cluster
+ * */
+export function useClusterResourceLimitsQuery(environmentId: EnvironmentId) {
+  return useQuery(
+    ['environments', environmentId, 'kubernetes', 'max_resource_limits'],
+    () => getResourceLimits(environmentId),
+    {
+      onError: (err) => {
+        notifyError('Failure', err as Error, 'Unable to get resource limits');
+      },
+    }
+  );
+}
+
+async function getResourceLimits(environmentId: EnvironmentId) {
+  try {
+    const { data: limits } = await axios.get<K8sNodeLimits>(
+      `/kubernetes/${environmentId}/max_resource_limits`
+    );
+    return limits;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to retrieve resource limits');
+  }
+}
diff --git a/app/react/kubernetes/namespaces/queries/useToggleSystemNamespace.ts b/app/react/kubernetes/namespaces/queries/useToggleSystemNamespace.ts
new file mode 100644
index 0000000..cb2ca91
--- /dev/null
+++ b/app/react/kubernetes/namespaces/queries/useToggleSystemNamespace.ts
@@ -0,0 +1,34 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import axios from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { withError, withInvalidate } from '@/react-tools/react-query';
+
+import { queryKeys } from './queryKeys';
+
+export function useToggleSystemNamespaceMutation(
+  environmentId: EnvironmentId,
+  namespaceName: string
+) {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: (isSystem: boolean) =>
+      toggleSystemNamespace(environmentId, namespaceName, isSystem),
+    ...withInvalidate(queryClient, [
+      queryKeys.namespace(environmentId, namespaceName),
+    ]),
+    ...withError('Failed to update namespace'),
+  });
+}
+
+async function toggleSystemNamespace(
+  environmentId: EnvironmentId,
+  namespaceName: string,
+  system: boolean
+) {
+  const response = await axios.put(
+    `/kubernetes/${environmentId}/namespaces/${namespaceName}/system`,
+    { system }
+  );
+  return response.data;
+}
diff --git a/app/react/kubernetes/namespaces/queries/useUpdateNamespaceMutation.ts b/app/react/kubernetes/namespaces/queries/useUpdateNamespaceMutation.ts
new file mode 100644
index 0000000..a8ad025
--- /dev/null
+++ b/app/react/kubernetes/namespaces/queries/useUpdateNamespaceMutation.ts
@@ -0,0 +1,85 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError, withInvalidate } from '@/react-tools/react-query';
+import { updateEnvironmentRegistryAccess } from '@/react/portainer/environments/environment.service/registries';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { notifyError } from '@/portainer/services/notifications';
+import { environmentQueryKeys } from '@/react/portainer/environments/queries/query-keys';
+
+import { IngressControllerClassMap } from '../../cluster/ingressClass/types';
+import { updateIngressControllerClassMap } from '../../cluster/ingressClass/useIngressControllerClassMap';
+import { Namespaces, NamespacePayload, UpdateRegistryPayload } from '../types';
+
+export function useUpdateNamespaceMutation(environmentId: EnvironmentId) {
+  const queryClient = useQueryClient();
+  return useMutation(
+    async ({
+      createNamespacePayload,
+      updateRegistriesPayload,
+      namespaceIngressControllerPayload,
+    }: {
+      createNamespacePayload: NamespacePayload;
+      updateRegistriesPayload: UpdateRegistryPayload[];
+      namespaceIngressControllerPayload: IngressControllerClassMap[];
+    }) => {
+      const { Name: namespaceName } = createNamespacePayload;
+      const updatedNamespace = await updateNamespace(
+        environmentId,
+        namespaceName,
+        createNamespacePayload
+      );
+
+      // collect promises
+      const updateRegistriesPromises = updateRegistriesPayload.map(
+        ({ Id, Namespaces }) =>
+          updateEnvironmentRegistryAccess(environmentId, Id, {
+            Namespaces,
+          })
+      );
+      const updateIngressControllerPromise = updateIngressControllerClassMap(
+        environmentId,
+        namespaceIngressControllerPayload,
+        createNamespacePayload.Name
+      );
+      const results = await Promise.allSettled([
+        updateIngressControllerPromise,
+        ...updateRegistriesPromises,
+      ]);
+      // Check for any failures in the additional updates
+      const failures = results.filter((result) => result.status === 'rejected');
+      failures.forEach((failure) => {
+        const errorMessage =
+          typeof failure.reason?.err?.message === 'string'
+            ? failure.reason?.err?.message
+            : '';
+        notifyError('Unable to update namespace', undefined, errorMessage);
+      });
+      return updatedNamespace;
+    },
+    {
+      ...withError('Unable to update namespace'),
+      //
+      ...withInvalidate(queryClient, [
+        environmentQueryKeys.item(environmentId),
+      ]),
+    }
+  );
+}
+
+// updateNamespace is used to update a namespace using the Portainer backend
+async function updateNamespace(
+  environmentId: EnvironmentId,
+  namespace: string,
+  payload: NamespacePayload
+) {
+  try {
+    const { data: ns } = await axios.put<Namespaces>(
+      `kubernetes/${environmentId}/namespaces/${namespace}`,
+      payload
+    );
+    return ns;
+  } catch (e) {
+    throw parseAxiosError(e as Error, 'Unable to create namespace');
+  }
+}
diff --git a/app/react/kubernetes/namespaces/resourceQuotaUtils.ts b/app/react/kubernetes/namespaces/resourceQuotaUtils.ts
new file mode 100644
index 0000000..eb35f15
--- /dev/null
+++ b/app/react/kubernetes/namespaces/resourceQuotaUtils.ts
@@ -0,0 +1,57 @@
+import { safeFilesizeParser } from '../utils';
+
+export const KubernetesPortainerResourceQuotaPrefix = 'portainer-rq-';
+
+export function generateResourceQuotaName(name: string) {
+  return `${KubernetesPortainerResourceQuotaPrefix}${name}`;
+}
+
+export function terabytesValue(value: string | number) {
+  return gigabytesValue(value) / 1000;
+}
+
+export function gigabytesValue(value: string | number) {
+  return megaBytesValue(value) / 1000;
+}
+
+export function megaBytesValue(value: string | number) {
+  return Math.floor(safeFilesizeParser(value, 10) / 1000 / 1000);
+}
+
+export function bytesValue(mem: string | number) {
+  return safeFilesizeParser(mem, 10) * 1000 * 1000;
+}
+
+/**
+ * Coverts Ki, Gi, Ti, Pi, Ei suffix values to Mi string
+ * Used for kubernetes memory conversions currently
+ */
+export function convertBase2ToMiB(value: string | number) {
+  if (typeof value === 'number') {
+    return value;
+  }
+
+  // Extract the numeric part and suffix
+  const match = value.match(/^(\d+(?:\.\d+)?)([A-Za-z]*)$/);
+  if (!match) {
+    return value;
+  }
+
+  const numericValue = parseFloat(match[1]);
+  const suffix = match[2];
+
+  switch (suffix) {
+    case 'Mi':
+      return `${numericValue}Mi`;
+    case 'Gi':
+      return `${numericValue * 1024}Mi`;
+    case 'Ti':
+      return `${numericValue * 1024 * 1024}Mi`;
+    case 'Pi':
+      return `${numericValue * 1024 * 1024 * 1024}Mi`;
+    case 'Ei':
+      return `${numericValue * 1024 * 1024 * 1024 * 1024}Mi`;
+    default:
+      return value;
+  }
+}
diff --git a/app/react/kubernetes/namespaces/types.ts b/app/react/kubernetes/namespaces/types.ts
new file mode 100644
index 0000000..f3626e6
--- /dev/null
+++ b/app/react/kubernetes/namespaces/types.ts
@@ -0,0 +1,42 @@
+import { NamespaceStatus, ResourceQuota } from 'kubernetes-types/core/v1';
+
+import { Registry } from '@/react/portainer/registries/types/registry';
+
+import { IngressControllerClassMap } from '../cluster/ingressClass/types';
+
+import { ResourceQuotaFormValues } from './components/NamespaceForm/ResourceQuotaFormSection/types';
+
+export interface PortainerNamespace {
+  Id: string;
+  Name: string;
+  Status: NamespaceStatus;
+  UnhealthyEventCount: number;
+  Annotations: Record<string, string> | null;
+  CreationDate: string;
+  NamespaceOwner: string;
+  IsSystem: boolean;
+  IsDefault: boolean;
+  ResourceQuota?: ResourceQuota | null;
+}
+
+// type returned via the internal portainer namespaces api, with simplified fields
+// it is a record currently (legacy reasons), but it should be an array
+export type Namespaces = Record<string, PortainerNamespace>;
+
+export type NamespaceFormValues = {
+  name: string;
+  resourceQuota: ResourceQuotaFormValues;
+  ingressClasses: IngressControllerClassMap[];
+  registries: Registry[];
+};
+
+export type NamespacePayload = {
+  Name: string;
+  Owner: string;
+  ResourceQuota: ResourceQuotaFormValues;
+};
+
+export type UpdateRegistryPayload = {
+  Id: number;
+  Namespaces: string[];
+};
diff --git a/app/react/kubernetes/queries/query-keys.ts b/app/react/kubernetes/queries/query-keys.ts
new file mode 100644
index 0000000..ff225ac
--- /dev/null
+++ b/app/react/kubernetes/queries/query-keys.ts
@@ -0,0 +1,5 @@
+/** Kubernetes environment base query keys */
+export const queryKeys = {
+  base: (environmentId: number) =>
+    ['environments', environmentId, 'kubernetes'] as const,
+};
diff --git a/app/react/kubernetes/queries/types.ts b/app/react/kubernetes/queries/types.ts
new file mode 100644
index 0000000..4c8269c
--- /dev/null
+++ b/app/react/kubernetes/queries/types.ts
@@ -0,0 +1,19 @@
+export type Event = {
+  type: string;
+  name: string;
+  reason: string;
+  message: string;
+  namespace: string;
+  eventTime: Date;
+  kind?: string;
+  count: number;
+  lastTimestamp?: Date;
+  firstTimestamp?: Date;
+  uid: string;
+  involvedObject: {
+    uid: string;
+    kind?: string;
+    name: string;
+    namespace: string;
+  };
+};
diff --git a/app/react/kubernetes/queries/useEvents.ts b/app/react/kubernetes/queries/useEvents.ts
new file mode 100644
index 0000000..bfe5cf5
--- /dev/null
+++ b/app/react/kubernetes/queries/useEvents.ts
@@ -0,0 +1,101 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { Event } from '@/react/kubernetes/queries/types';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+
+import { parseKubernetesAxiosError } from '../axiosError';
+
+import { queryKeys as environmentQueryKeys } from './query-keys';
+
+type RequestOptions = {
+  /** if undefined, events are fetched at the cluster scope */
+  namespace?: string;
+  params?: {
+    resourceId?: string;
+  };
+};
+
+const queryKeys = {
+  base: (environmentId: number, { namespace, params }: RequestOptions) => {
+    if (namespace) {
+      return [
+        ...environmentQueryKeys.base(environmentId),
+        'events',
+        namespace,
+        params,
+      ] as const;
+    }
+    return [
+      ...environmentQueryKeys.base(environmentId),
+      'events',
+      params,
+    ] as const;
+  },
+};
+
+async function getEvents(
+  environmentId: EnvironmentId,
+  options?: RequestOptions
+): Promise<Event[]> {
+  const { namespace, params } = options ?? {};
+  try {
+    const { data } = await axios.get<Event[]>(
+      buildUrl(environmentId, namespace),
+      {
+        params,
+      }
+    );
+    return data;
+  } catch (e) {
+    throw parseKubernetesAxiosError(e, 'Unable to retrieve events');
+  }
+}
+
+type QueryOptions<T> = {
+  queryOptions?: {
+    autoRefreshRate?: number;
+    select?: (data: Event[]) => T;
+    enabled?: boolean;
+  };
+} & RequestOptions;
+
+export function useEvents<T = Event[]>(
+  environmentId: EnvironmentId,
+  options?: QueryOptions<T>
+) {
+  const { queryOptions, params, namespace } = options ?? {};
+  return useQuery(
+    queryKeys.base(environmentId, { params, namespace }),
+    () => getEvents(environmentId, { params, namespace }),
+    {
+      ...withError('Unable to retrieve events'),
+      refetchInterval() {
+        return queryOptions?.autoRefreshRate ?? false;
+      },
+      select: queryOptions?.select,
+    }
+  );
+}
+
+export function useEventWarningsCount(
+  environmentId: EnvironmentId,
+  options?: QueryOptions<number>
+) {
+  const { namespace, params } = options ?? {};
+  const resourceEventsQuery = useEvents<number>(environmentId, {
+    namespace,
+    params,
+    queryOptions: {
+      select: (data) => data.filter((e) => e.type === 'Warning').length,
+    },
+  });
+  return resourceEventsQuery.data || 0;
+}
+
+function buildUrl(environmentId: EnvironmentId, namespace?: string) {
+  return namespace
+    ? `/kubernetes/${environmentId}/namespaces/${namespace}/events`
+    : `/kubernetes/${environmentId}/events`;
+}
diff --git a/app/react/kubernetes/queries/useGetMetricsMutation.ts b/app/react/kubernetes/queries/useGetMetricsMutation.ts
new file mode 100644
index 0000000..3b471d8
--- /dev/null
+++ b/app/react/kubernetes/queries/useGetMetricsMutation.ts
@@ -0,0 +1,8 @@
+import { useMutation } from '@tanstack/react-query';
+
+import { getMetricsForAllNodes } from '../metrics/metrics';
+
+// use this as a mutation because the metrics request should be manually fired when the user clicks to turn the metrics toggle on
+export function useGetMetricsMutation() {
+  return useMutation(getMetricsForAllNodes);
+}
diff --git a/app/react/kubernetes/queries/useKubernetesVersion.ts b/app/react/kubernetes/queries/useKubernetesVersion.ts
new file mode 100644
index 0000000..89daac7
--- /dev/null
+++ b/app/react/kubernetes/queries/useKubernetesVersion.ts
@@ -0,0 +1,42 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { queryKeys } from './query-keys';
+
+export interface KubernetesVersionInfo {
+  major: string;
+  minor: string;
+  gitVersion: string;
+  gitCommit: string;
+  gitTreeState: string;
+  buildDate: string;
+  goVersion: string;
+  compiler: string;
+  platform: string;
+  supportsPodRestart: boolean;
+}
+
+export function useKubernetesVersion(environmentId: EnvironmentId) {
+  return useQuery(
+    [...queryKeys.base(environmentId), 'version'] as const,
+    () => getKubernetesVersion(environmentId),
+    withError('Unable to retrieve Kubernetes cluster version')
+  );
+}
+
+async function getKubernetesVersion(environmentId: EnvironmentId) {
+  try {
+    const { data } = await axios.get<KubernetesVersionInfo>(
+      `/kubernetes/${environmentId}/version`
+    );
+    return data;
+  } catch (error) {
+    throw parseAxiosError(
+      error as Error,
+      'Unable to retrieve Kubernetes cluster version'
+    );
+  }
+}
diff --git a/app/react/kubernetes/queries/useResourceYAML.test.tsx b/app/react/kubernetes/queries/useResourceYAML.test.tsx
new file mode 100644
index 0000000..09716f7
--- /dev/null
+++ b/app/react/kubernetes/queries/useResourceYAML.test.tsx
@@ -0,0 +1,85 @@
+import { waitFor } from '@testing-library/react';
+import { renderHook } from '@testing-library/react-hooks';
+import { describe, it, expect, beforeEach } from 'vitest';
+import { HttpResponse } from 'msw';
+
+import { server, http } from '@/setup-tests/server';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { suppressConsoleLogs } from '@/setup-tests/suppress-console';
+
+import { useResourceYAML } from './useResourceYAML';
+
+const resourcePath = 'api/v1/namespaces/default/configmaps/my-cm';
+
+function renderQueryHook(
+  environmentId: number,
+  resourcePathArg: string,
+  enabled = true
+) {
+  return renderHook(
+    () =>
+      useResourceYAML({
+        environmentId,
+        resourcePath: resourcePathArg,
+        enabled,
+      }),
+    {
+      wrapper: withTestQueryProvider(({ children }) => <>{children}</>),
+    }
+  );
+}
+
+describe('useResourceYAML', () => {
+  beforeEach(() => {
+    server.resetHandlers();
+  });
+
+  it('returns YAML text on success', async () => {
+    const body = 'apiVersion: v1\nkind: ConfigMap';
+    server.use(
+      http.get(
+        `/api/endpoints/1/kubernetes/${resourcePath}`,
+        () =>
+          new HttpResponse(body, {
+            headers: { 'Content-Type': 'application/yaml' },
+          })
+      )
+    );
+
+    const { result } = renderQueryHook(1, resourcePath);
+
+    await waitFor(() => expect(result.current.isSuccess).toBe(true));
+    expect(result.current.data).toBe(body);
+  });
+
+  it('sets isError on failure', async () => {
+    const restoreConsole = suppressConsoleLogs();
+    server.use(
+      http.get(`/api/endpoints/1/kubernetes/${resourcePath}`, () =>
+        HttpResponse.json({ message: 'error' }, { status: 500 })
+      )
+    );
+
+    const { result } = renderQueryHook(1, resourcePath);
+
+    await waitFor(() => expect(result.current.isError).toBe(true));
+    restoreConsole();
+  });
+
+  it('does not fetch when resourcePath is empty', async () => {
+    const { result } = renderQueryHook(1, '');
+
+    await waitFor(() => expect(result.current.fetchStatus).toBe('idle'));
+    expect(result.current.data).toBeUndefined();
+  });
+
+  it('does not fetch when enabled is false', async () => {
+    const { result } = renderQueryHook(1, resourcePath, false);
+
+    await new Promise((resolve) => {
+      setTimeout(resolve, 100);
+    });
+
+    expect(result.current.data).toBeUndefined();
+  });
+});
diff --git a/app/react/kubernetes/queries/useResourceYAML.ts b/app/react/kubernetes/queries/useResourceYAML.ts
new file mode 100644
index 0000000..6b63dfb
--- /dev/null
+++ b/app/react/kubernetes/queries/useResourceYAML.ts
@@ -0,0 +1,50 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { parseKubernetesAxiosError } from '../axiosError';
+
+import { queryKeys as environmentQueryKeys } from './query-keys';
+
+type ResourceYAMLParams = {
+  environmentId: EnvironmentId;
+  resourcePath: string;
+  enabled?: boolean;
+};
+
+export function useResourceYAML({
+  environmentId,
+  resourcePath,
+  enabled = true,
+}: ResourceYAMLParams) {
+  return useQuery({
+    queryKey: [
+      ...environmentQueryKeys.base(environmentId),
+      'resource-yaml',
+      resourcePath,
+    ],
+    queryFn: () => getResourceYAML(environmentId, resourcePath),
+    enabled: enabled && !!resourcePath,
+  });
+}
+
+async function getResourceYAML(
+  environmentId: EnvironmentId,
+  resourcePath: string
+) {
+  try {
+    const { data: yaml } = await axios.get<string>(
+      `/endpoints/${environmentId}/kubernetes/${resourcePath}`,
+      {
+        headers: {
+          Accept: 'application/yaml',
+        },
+      }
+    );
+
+    return yaml;
+  } catch (error) {
+    throw parseKubernetesAxiosError(error, 'Unable to retrieve resource YAML');
+  }
+}
diff --git a/app/react/kubernetes/services/ServicesView/ServicesDatatable/ServicesDatatable.test.tsx b/app/react/kubernetes/services/ServicesView/ServicesDatatable/ServicesDatatable.test.tsx
new file mode 100644
index 0000000..e853982
--- /dev/null
+++ b/app/react/kubernetes/services/ServicesView/ServicesDatatable/ServicesDatatable.test.tsx
@@ -0,0 +1,145 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { HttpResponse } from 'msw';
+
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { createMockUsers } from '@/react-tools/test-mocks';
+import { server, http } from '@/setup-tests/server';
+
+import { ServicesDatatable } from './ServicesDatatable';
+
+vi.mock('@/react/hooks/useEnvironmentId', () => ({
+  useEnvironmentId: () => 1,
+}));
+
+vi.mock('@/portainer/services/notifications', () => ({
+  notifyError: vi.fn(),
+  notifySuccess: vi.fn(),
+}));
+function createMockServices(count: number) {
+  return Array.from({ length: count }, (_, i) => {
+    let namespace = 'default';
+    if (i % 3 === 0) {
+      namespace = 'kube-system';
+    } else if (i % 2 !== 0) {
+      namespace = 'my-namespace';
+    }
+
+    let type = 'ClusterIP';
+    if (i % 4 === 1) {
+      type = 'NodePort';
+    } else if (i % 4 === 2) {
+      type = 'LoadBalancer';
+    } else if (i % 4 === 3) {
+      type = 'ExternalName';
+    }
+
+    return {
+      UID: `service-${i}`,
+      Name: `service-${i}`,
+      Namespace: namespace,
+      Type: type,
+      Ports: [{ Port: 80 + i, TargetPort: 8080 + i, Protocol: 'TCP' }],
+      Selector: { app: `app-${i}` },
+      CreationTimestamp: new Date(Date.now() - i * 1000 * 60).toISOString(),
+      ApplicationOwner: '',
+      Applications: [{ Name: `app-${i}` }],
+    };
+  });
+}
+
+const mockServices = createMockServices(4);
+
+const mockNamespaces = [
+  {
+    Name: 'default',
+    IsSystem: false,
+    Status: 'Active',
+    CreationTimestamp: '2024-01-01T00:00:00Z',
+  },
+  {
+    Name: 'kube-system',
+    IsSystem: true,
+    Status: 'Active',
+    CreationTimestamp: '2024-01-01T00:00:00Z',
+  },
+  {
+    Name: 'my-namespace',
+    IsSystem: false,
+    Status: 'Active',
+    CreationTimestamp: '2024-01-01T00:00:00Z',
+  },
+];
+
+beforeEach(() => {
+  server.use(
+    http.get('/api/kubernetes/1/services', () =>
+      HttpResponse.json(mockServices)
+    ),
+    http.get('/api/kubernetes/1/namespaces', () =>
+      HttpResponse.json(mockNamespaces)
+    )
+  );
+});
+const mockUser = {
+  // Admin user
+  ...createMockUsers(1, 1)[0],
+};
+
+function createTestComponent() {
+  return withTestRouter(
+    withUserProvider(withTestQueryProvider(ServicesDatatable), mockUser),
+    {
+      route: '/kubernetes/services',
+      stateConfig: [
+        {
+          name: 'kubernetes.services',
+          url: '/kubernetes/services',
+          params: { endpointId: '1' },
+        },
+      ],
+    }
+  );
+}
+
+describe('ServicesDatatable', () => {
+  it('renders services data correctly', async () => {
+    const TestComponent = createTestComponent();
+    render(<TestComponent />);
+
+    expect(await screen.findByText('service-1')).toBeInTheDocument();
+    expect(screen.getByText('service-2')).toBeInTheDocument();
+  });
+
+  it('should filter system resources correctly when toggled', async () => {
+    const TestComponent = createTestComponent();
+    render(<TestComponent />);
+
+    const settingsButton = screen.getByRole('button', { name: /settings/i });
+    await userEvent.click(settingsButton);
+
+    await waitFor(() => {
+      expect(screen.queryByText('service-0')).not.toBeInTheDocument();
+    });
+
+    const systemToggle = await screen.findByTestId('show-system-resources');
+    await userEvent.click(systemToggle);
+
+    await waitFor(() => {
+      expect(screen.queryByText('service-0')).toBeInTheDocument();
+    });
+
+    expect(screen.getByText('service-3')).toBeInTheDocument();
+    expect(screen.getByText('service-1')).toBeInTheDocument();
+    expect(screen.getByText('service-2')).toBeInTheDocument();
+  });
+
+  it('should show loading state when data is loading', async () => {
+    const TestComponent = createTestComponent();
+    render(<TestComponent />);
+
+    expect(screen.getByText('Loading...')).toBeInTheDocument();
+  });
+});
diff --git a/app/react/kubernetes/services/ServicesView/ServicesDatatable/ServicesDatatable.tsx b/app/react/kubernetes/services/ServicesView/ServicesDatatable/ServicesDatatable.tsx
new file mode 100644
index 0000000..2658085
--- /dev/null
+++ b/app/react/kubernetes/services/ServicesView/ServicesDatatable/ServicesDatatable.tsx
@@ -0,0 +1,206 @@
+import { useMemo } from 'react';
+import { Shuffle } from 'lucide-react';
+import { useRouter } from '@uirouter/react';
+import clsx from 'clsx';
+import { Row } from '@tanstack/react-table';
+
+import {
+  Namespaces,
+  PortainerNamespace,
+} from '@/react/kubernetes/namespaces/types';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { Authorized, useAuthorizations } from '@/react/hooks/useUser';
+import { notifyError, notifySuccess } from '@/portainer/services/notifications';
+import { pluralize } from '@/portainer/helpers/strings';
+import { DefaultDatatableSettings } from '@/react/kubernetes/datatables/DefaultDatatableSettings';
+import { SystemResourceDescription } from '@/react/kubernetes/datatables/SystemResourceDescription';
+import { useNamespacesQuery } from '@/react/kubernetes/namespaces/queries/useNamespacesQuery';
+import { CreateFromManifestButton } from '@/react/kubernetes/components/CreateFromManifestButton';
+import { createStore } from '@/react/kubernetes/datatables/default-kube-datatable-store';
+
+import { Datatable, Table, TableSettingsMenu } from '@@/datatables';
+import { useTableState } from '@@/datatables/useTableState';
+import { DeleteButton } from '@@/buttons/DeleteButton';
+
+import { useMutationDeleteServices, useClusterServices } from '../../service';
+import { Service } from '../../types';
+
+import { columns } from './columns';
+import { ServiceRowData } from './types';
+
+const storageKey = 'k8sServicesDatatable';
+const settingsStore = createStore(storageKey);
+
+export function ServicesDatatable() {
+  const tableState = useTableState(settingsStore, storageKey);
+  const environmentId = useEnvironmentId();
+  const { data: namespaces, ...namespacesQuery } = useNamespacesQuery(
+    environmentId,
+    {
+      select: (namespacesArray) =>
+        namespacesArray?.reduce<Record<string, PortainerNamespace>>(
+          (acc, namespace) => {
+            acc[namespace.Name] = namespace;
+            return acc;
+          },
+          {}
+        ),
+    }
+  );
+  const { authorized: canWrite } = useAuthorizations(['K8sServiceW']);
+  const { authorized: canAccessSystemResources } = useAuthorizations(
+    'K8sAccessSystemNamespaces'
+  );
+  const { data: services, ...servicesQuery } = useClusterServices(
+    environmentId,
+    {
+      autoRefreshRate: tableState.autoRefreshRate * 1000,
+      withApplications: true,
+      select: (services) =>
+        services?.filter(
+          (service) =>
+            (canAccessSystemResources && tableState.showSystemResources) ||
+            !namespaces?.[service.Namespace]?.IsSystem
+        ),
+    }
+  );
+
+  const servicesWithIsSystem = useServicesRowData(services || [], namespaces);
+
+  return (
+    <Datatable
+      dataset={servicesWithIsSystem || []}
+      columns={columns}
+      settingsManager={tableState}
+      isLoading={
+        servicesQuery.isInitialLoading || namespacesQuery.isInitialLoading
+      }
+      emptyContentLabel="No services found"
+      title="Services"
+      titleIcon={Shuffle}
+      getRowId={(row) => row.UID}
+      isRowSelectable={(row) => !namespaces?.[row.original.Namespace]?.IsSystem}
+      disableSelect={!canWrite}
+      renderTableActions={(selectedRows) => (
+        <TableActions selectedItems={selectedRows} />
+      )}
+      renderTableSettings={() => (
+        <TableSettingsMenu>
+          <DefaultDatatableSettings settings={tableState} />
+        </TableSettingsMenu>
+      )}
+      description={
+        <SystemResourceDescription
+          showSystemResources={
+            tableState.showSystemResources || !canAccessSystemResources
+          }
+        />
+      }
+      renderRow={servicesRenderRow}
+      data-cy="k8s-services-datatable"
+    />
+  );
+}
+
+// useServicesRowData appends the `isSystem` property to the service data
+function useServicesRowData(
+  services: Service[],
+  namespaces?: Namespaces
+): ServiceRowData[] {
+  return useMemo(
+    () =>
+      services.map((service) => ({
+        ...service,
+        IsSystem: namespaces
+          ? namespaces?.[service.Namespace]?.IsSystem
+          : false,
+      })),
+    [services, namespaces]
+  );
+}
+
+// needed to apply custom styling to the row cells and not globally.
+// required in the AC's for this ticket.
+function servicesRenderRow(
+  row: Row<ServiceRowData>,
+  highlightedItemId?: string
+) {
+  return (
+    <Table.Row<ServiceRowData>
+      cells={row.getVisibleCells()}
+      className={clsx('[&>td]:!py-4 [&>td]:!align-top', {
+        active: highlightedItemId === row.id,
+      })}
+    />
+  );
+}
+
+interface SelectedService {
+  Namespace: string;
+  Name: string;
+}
+
+type TableActionsProps = {
+  selectedItems: ServiceRowData[];
+};
+
+function TableActions({ selectedItems }: TableActionsProps) {
+  const environmentId = useEnvironmentId();
+  const deleteServicesMutation = useMutationDeleteServices(environmentId);
+  const router = useRouter();
+
+  return (
+    <Authorized authorizations="K8sServicesW">
+      <DeleteButton
+        disabled={selectedItems.length === 0}
+        onConfirmed={() => handleRemoveClick(selectedItems)}
+        confirmMessage={
+          <>
+            <p>{`Are you sure you want to remove the selected ${pluralize(
+              selectedItems.length,
+              'service'
+            )}?`}</p>
+            <ul className="pl-6">
+              {selectedItems.map((s, index) => (
+                <li key={index}>
+                  {s.Namespace}/{s.Name}
+                </li>
+              ))}
+            </ul>
+          </>
+        }
+        data-cy="k8s-remove-services-button"
+      />
+
+      <CreateFromManifestButton data-cy="k8s-create-service-button" />
+    </Authorized>
+  );
+
+  async function handleRemoveClick(services: SelectedService[]) {
+    const payload: Record<string, string[]> = {};
+    services.forEach((service) => {
+      payload[service.Namespace] = payload[service.Namespace] || [];
+      payload[service.Namespace].push(service.Name);
+    });
+
+    deleteServicesMutation.mutate(
+      { environmentId, data: payload },
+      {
+        onSuccess: () => {
+          notifySuccess(
+            'Services successfully removed',
+            services.map((s) => `${s.Namespace}/${s.Name}`).join(', ')
+          );
+          router.stateService.reload();
+        },
+        onError: (error) => {
+          notifyError(
+            'Unable to delete service(s)',
+            error as Error,
+            services.map((s) => `${s.Namespace}/${s.Name}`).join(', ')
+          );
+        },
+      }
+    );
+  }
+}
diff --git a/app/react/kubernetes/services/ServicesView/ServicesDatatable/columns/ExternalIPLink.tsx b/app/react/kubernetes/services/ServicesView/ServicesDatatable/columns/ExternalIPLink.tsx
new file mode 100644
index 0000000..cf64145
--- /dev/null
+++ b/app/react/kubernetes/services/ServicesView/ServicesDatatable/columns/ExternalIPLink.tsx
@@ -0,0 +1,22 @@
+import { ExternalLink } from 'lucide-react';
+
+import { Icon } from '@@/Icon';
+
+interface Props {
+  to: string;
+  text: string;
+}
+
+export function ExternalIPLink({ to, text }: Props) {
+  return (
+    <a
+      href={to}
+      target="_blank"
+      rel="noreferrer"
+      className="flex items-center gap-1"
+    >
+      <Icon icon={ExternalLink} />
+      <span>{text}</span>
+    </a>
+  );
+}
diff --git a/app/react/kubernetes/services/ServicesView/ServicesDatatable/columns/application.tsx b/app/react/kubernetes/services/ServicesView/ServicesDatatable/columns/application.tsx
new file mode 100644
index 0000000..05b01d9
--- /dev/null
+++ b/app/react/kubernetes/services/ServicesView/ServicesDatatable/columns/application.tsx
@@ -0,0 +1,40 @@
+import { CellContext } from '@tanstack/react-table';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+
+import { Link } from '@@/Link';
+
+import { ServiceRowData } from '../types';
+
+import { columnHelper } from './helper';
+
+export const application = columnHelper.accessor(
+  (row) => (row.Applications ? row.Applications[0].Name : ''),
+  {
+    header: 'Application',
+    id: 'application',
+    cell: Cell,
+  }
+);
+
+function Cell({ row, getValue }: CellContext<ServiceRowData, string>) {
+  const appName = getValue();
+  const environmentId = useEnvironmentId();
+
+  return appName ? (
+    <Link
+      to="kubernetes.applications.application"
+      params={{
+        endpointId: environmentId,
+        namespace: row.original.Namespace,
+        name: appName,
+      }}
+      title={appName}
+      data-cy={`service-application-link-${appName}`}
+    >
+      {appName}
+    </Link>
+  ) : (
+    '-'
+  );
+}
diff --git a/app/react/kubernetes/services/ServicesView/ServicesDatatable/columns/clusterIP.tsx b/app/react/kubernetes/services/ServicesView/ServicesDatatable/columns/clusterIP.tsx
new file mode 100644
index 0000000..452f729
--- /dev/null
+++ b/app/react/kubernetes/services/ServicesView/ServicesDatatable/columns/clusterIP.tsx
@@ -0,0 +1,41 @@
+import { columnHelper } from './helper';
+
+export const clusterIP = columnHelper.accessor(
+  (row) => row.ClusterIPs?.join(','),
+  {
+    header: 'Cluster IP',
+    id: 'clusterIP',
+    cell: ({ row }) => {
+      const clusterIPs = row.original.ClusterIPs;
+
+      if (!clusterIPs?.length) {
+        return '-';
+      }
+      return clusterIPs.map((ip) => <div key={ip}>{ip}</div>);
+    },
+    sortingFn: (rowA, rowB) => {
+      const a = rowA.original.ClusterIPs;
+      const b = rowB.original.ClusterIPs;
+
+      const ipA = a?.[0];
+      const ipB = b?.[0];
+
+      // no ip's at top, followed by 'None', then ordered by ip
+      if (!ipA) return 1;
+      if (!ipB) return -1;
+      if (ipA === ipB) return 0;
+      if (ipA === 'None') return 1;
+      if (ipB === 'None') return -1;
+
+      // natural sort of the ip
+      return ipA.localeCompare(
+        ipB,
+        navigator.languages[0] || navigator.language,
+        {
+          numeric: true,
+          ignorePunctuation: true,
+        }
+      );
+    },
+  }
+);
diff --git a/app/react/kubernetes/services/ServicesView/ServicesDatatable/columns/created.tsx b/app/react/kubernetes/services/ServicesView/ServicesDatatable/columns/created.tsx
new file mode 100644
index 0000000..2e5ba58
--- /dev/null
+++ b/app/react/kubernetes/services/ServicesView/ServicesDatatable/columns/created.tsx
@@ -0,0 +1,23 @@
+import { formatDate } from '@/portainer/filters/filters';
+
+import { columnHelper } from './helper';
+
+export const created = columnHelper.accessor(
+  (row) => {
+    const owner = row.Labels?.['io.portainer.kubernetes.application.owner'];
+    const date = formatDate(row.CreationDate);
+    return owner ? `${date} by ${owner}` : date;
+  },
+  {
+    header: 'Created',
+    id: 'created',
+    cell: ({ row }) => {
+      const date = formatDate(row.original.CreationDate);
+
+      const owner =
+        row.original.Labels?.['io.portainer.kubernetes.application.owner'];
+
+      return owner ? `${date} by ${owner}` : date;
+    },
+  }
+);
diff --git a/app/react/kubernetes/services/ServicesView/ServicesDatatable/columns/externalHost.tsx b/app/react/kubernetes/services/ServicesView/ServicesDatatable/columns/externalHost.tsx
new file mode 100644
index 0000000..7a0e8c3
--- /dev/null
+++ b/app/react/kubernetes/services/ServicesView/ServicesDatatable/columns/externalHost.tsx
@@ -0,0 +1,38 @@
+import { CellContext } from '@tanstack/react-table';
+
+import { ServiceRowData } from '../types';
+
+import { columnHelper } from './helper';
+
+export const externalHost = columnHelper.accessor(
+  (row) => {
+    if (row.Type === 'ExternalName') {
+      return row.ExternalName || '-';
+    }
+
+    return (
+      row.IngressStatus?.map((status) => status.Hostname)
+        .filter(Boolean)
+        .join(' ,') || '-'
+    );
+  },
+  {
+    header: 'External Host',
+    id: 'externalHost',
+    cell: Cell,
+  }
+);
+
+function Cell({ row }: CellContext<ServiceRowData, string>) {
+  if (row.original.Type === 'ExternalName') {
+    return <div>{row.original.ExternalName || '-'}</div>;
+  }
+
+  return (
+    <div>
+      {row.original.IngressStatus?.map((status) => status.Hostname)
+        .filter(Boolean)
+        .join(' ,') || '-'}
+    </div>
+  );
+}
diff --git a/app/react/kubernetes/services/ServicesView/ServicesDatatable/columns/externalIP.tsx b/app/react/kubernetes/services/ServicesView/ServicesDatatable/columns/externalIP.tsx
new file mode 100644
index 0000000..6a9a10b
--- /dev/null
+++ b/app/react/kubernetes/services/ServicesView/ServicesDatatable/columns/externalIP.tsx
@@ -0,0 +1,139 @@
+import { CellContext } from '@tanstack/react-table';
+
+import { ServiceRowData } from '../types';
+
+import { ExternalIPLink } from './ExternalIPLink';
+import { columnHelper } from './helper';
+
+export const externalIP = columnHelper.accessor(
+  (row) => {
+    if (row.Type === 'ExternalName') {
+      return row.ExternalName || '';
+    }
+
+    if (row.ExternalIPs?.length) {
+      return row.ExternalIPs?.join(',') || '';
+    }
+
+    return row.IngressStatus?.map((status) => status.IP).join(',') || '';
+  },
+  {
+    header: 'External IP',
+    id: 'externalIP',
+    cell: Cell,
+    sortingFn: (rowA, rowB) => {
+      const a = rowA.original.IngressStatus;
+      const b = rowB.original.IngressStatus;
+      const aExternal = rowA.original.ExternalIPs;
+      const bExternal = rowB.original.ExternalIPs;
+
+      const ipA = a?.[0].IP || aExternal?.[0] || rowA.original.ExternalName;
+      const ipB = b?.[0].IP || bExternal?.[0] || rowA.original.ExternalName;
+
+      if (!ipA) return 1;
+      if (!ipB) return -1;
+
+      // use a nat sort order for ip addresses
+      return ipA.localeCompare(
+        ipB,
+        navigator.languages[0] || navigator.language,
+        {
+          numeric: true,
+          ignorePunctuation: true,
+        }
+      );
+    },
+  }
+);
+
+function Cell({ row }: CellContext<ServiceRowData, string>) {
+  if (row.original.Type === 'ExternalName') {
+    if (row.original.ExternalName) {
+      const linkTo = `http://${row.original.ExternalName}`;
+      return <ExternalIPLink to={linkTo} text={row.original.ExternalName} />;
+    }
+    return '-';
+  }
+
+  const [scheme, port] = getSchemeAndPort(row.original);
+  if (row.original.ExternalIPs?.length) {
+    return row.original.ExternalIPs?.map((ip, index) => {
+      // some ips come through blank
+      if (ip.length === 0) {
+        return '-';
+      }
+
+      if (scheme) {
+        let linkTo = `${scheme}://${ip}`;
+        if (port !== 80 && port !== 443) {
+          linkTo = `${linkTo}:${port}`;
+        }
+        return (
+          <div key={index}>
+            <ExternalIPLink to={linkTo} text={ip} />
+          </div>
+        );
+      }
+      return <div key={index}>{ip}</div>;
+    });
+  }
+
+  const status = row.original.IngressStatus;
+  if (status) {
+    return status?.map((status, index) => {
+      // some ips come through blank
+      if (status.IP.length === 0) {
+        return '-';
+      }
+
+      if (scheme) {
+        let linkTo = `${scheme}://${status.IP}`;
+        if (port !== 80 && port !== 443) {
+          linkTo = `${linkTo}:${port}`;
+        }
+        return (
+          <div key={index}>
+            <ExternalIPLink to={linkTo} text={status.IP} />
+          </div>
+        );
+      }
+      return <div key={index}>{status.IP}</div>;
+    });
+  }
+
+  return '-';
+}
+
+// calculate the scheme based on the ports of the service
+// favour https over http.
+function getSchemeAndPort(svc: ServiceRowData): [string, number] {
+  let scheme = '';
+  let servicePort = 0;
+
+  svc.Ports?.forEach((port) => {
+    if (port.Protocol === 'TCP') {
+      switch (port.TargetPort) {
+        case '443':
+        case '8443':
+        case 'https':
+          scheme = 'https';
+          servicePort = port.Port;
+          break;
+
+        case '80':
+        case '8080':
+        case 'http':
+          if (scheme !== 'https') {
+            scheme = 'http';
+            servicePort = port.Port;
+          }
+          break;
+
+        default:
+          break;
+      }
+    }
+  });
+
+  return [scheme, servicePort];
+}
diff --git a/app/react/kubernetes/services/ServicesView/ServicesDatatable/columns/helper.ts b/app/react/kubernetes/services/ServicesView/ServicesDatatable/columns/helper.ts
new file mode 100644
index 0000000..b6b4547
--- /dev/null
+++ b/app/react/kubernetes/services/ServicesView/ServicesDatatable/columns/helper.ts
@@ -0,0 +1,5 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { ServiceRowData } from '../types';
+
+export const columnHelper = createColumnHelper<ServiceRowData>();
diff --git a/app/react/kubernetes/services/ServicesView/ServicesDatatable/columns/index.tsx b/app/react/kubernetes/services/ServicesView/ServicesDatatable/columns/index.tsx
new file mode 100644
index 0000000..1cc66e1
--- /dev/null
+++ b/app/react/kubernetes/services/ServicesView/ServicesDatatable/columns/index.tsx
@@ -0,0 +1,23 @@
+import { name } from './name';
+import { type } from './type';
+import { namespace } from './namespace';
+import { ports } from './ports';
+import { clusterIP } from './clusterIP';
+import { externalHost } from './externalHost';
+import { externalIP } from './externalIP';
+import { targetPorts } from './targetPorts';
+import { application } from './application';
+import { created } from './created';
+
+export const columns = [
+  name,
+  application,
+  namespace,
+  type,
+  ports,
+  targetPorts,
+  clusterIP,
+  externalHost,
+  externalIP,
+  created,
+];
diff --git a/app/react/kubernetes/services/ServicesView/ServicesDatatable/columns/name.tsx b/app/react/kubernetes/services/ServicesView/ServicesDatatable/columns/name.tsx
new file mode 100644
index 0000000..92a868b
--- /dev/null
+++ b/app/react/kubernetes/services/ServicesView/ServicesDatatable/columns/name.tsx
@@ -0,0 +1,55 @@
+import { Authorized } from '@/react/hooks/useUser';
+
+import { SystemBadge } from '@@/Badge/SystemBadge';
+import { ExternalBadge } from '@@/Badge/ExternalBadge';
+import { Link } from '@@/Link';
+
+import { columnHelper } from './helper';
+
+export const name = columnHelper.accessor(
+  (row) => {
+    let name = row.Name;
+
+    const isExternal =
+      !row.Labels || !row.Labels['io.portainer.kubernetes.application.owner'];
+
+    if (isExternal && !row.IsSystem) {
+      name = `${name} external`;
+    }
+
+    if (row.IsSystem) {
+      name = `${name} system`;
+    }
+    return name;
+  },
+  {
+    header: 'Name',
+    id: 'name',
+    cell: ({ row }) => {
+      const name = row.original.Name;
+
+      const isExternal =
+        !row.original.Labels ||
+        !row.original.Labels['io.portainer.kubernetes.application.owner'];
+
+      return (
+        <div className="flex gap-2">
+          <Authorized authorizations="K8sServiceW" childrenUnauthorized={name}>
+            <Link
+              to="kubernetes.services.service"
+              params={{ namespace: row.original.Namespace, name }}
+              data-cy={`service-name-link-${row.original.Namespace}-${name}`}
+            >
+              {name}
+            </Link>
+
+            <div className="ml-auto flex gap-2">
+              {row.original.IsSystem && <SystemBadge />}
+              {isExternal && !row.original.IsSystem && <ExternalBadge />}
+            </div>
+          </Authorized>
+        </div>
+      );
+    },
+  }
+);
diff --git a/app/react/kubernetes/services/ServicesView/ServicesDatatable/columns/namespace.tsx b/app/react/kubernetes/services/ServicesView/ServicesDatatable/columns/namespace.tsx
new file mode 100644
index 0000000..050e24b
--- /dev/null
+++ b/app/react/kubernetes/services/ServicesView/ServicesDatatable/columns/namespace.tsx
@@ -0,0 +1,39 @@
+import { Row } from '@tanstack/react-table';
+
+import { filterHOC } from '@/react/components/datatables/Filter';
+
+import { Link } from '@@/Link';
+
+import { ServiceRowData } from '../types';
+
+import { columnHelper } from './helper';
+
+export const namespace = columnHelper.accessor('Namespace', {
+  header: 'Namespace',
+  id: 'namespace',
+  cell: ({ getValue, row }) => {
+    const namespace = getValue();
+
+    return (
+      <Link
+        to="kubernetes.resourcePools.resourcePool"
+        params={{
+          id: namespace,
+        }}
+        title={namespace}
+        data-cy={`service-namespace-link-${row.original.Name}`}
+      >
+        {namespace}
+      </Link>
+    );
+  },
+  meta: {
+    filter: filterHOC('Filter by namespace'),
+  },
+  enableColumnFilter: true,
+  filterFn: (
+    row: Row<ServiceRowData>,
+    columnId: string,
+    filterValue: string[]
+  ) => filterValue.length === 0 || filterValue.includes(row.original.Namespace),
+});
diff --git a/app/react/kubernetes/services/ServicesView/ServicesDatatable/columns/ports.tsx b/app/react/kubernetes/services/ServicesView/ServicesDatatable/columns/ports.tsx
new file mode 100644
index 0000000..e04c5c6
--- /dev/null
+++ b/app/react/kubernetes/services/ServicesView/ServicesDatatable/columns/ports.tsx
@@ -0,0 +1,73 @@
+import { Tooltip } from '@@/Tip/Tooltip';
+
+import { columnHelper } from './helper';
+
+export const ports = columnHelper.accessor(
+  (row) =>
+    row.Ports?.map(
+      (port) =>
+        `${port.Port}${port.NodePort !== 0 ? `:${port.NodePort}` : ''}/${
+          port.Protocol
+        }`
+    ).join(',') || '-',
+  {
+    header: () => (
+      <>
+        Ports
+        <Tooltip message="The format of Ports is port[:nodePort]/protocol. Protocol is either TCP, UDP or SCTP." />
+      </>
+    ),
+    id: 'ports',
+    cell: ({ row }) => {
+      if (!row.original.Ports?.length) {
+        return '-';
+      }
+
+      return (
+        <>
+          {row.original.Ports?.map((port, index) => {
+            if (port.NodePort !== 0) {
+              return (
+                <div key={index}>
+                  {port.Port}:{port.NodePort}/{port.Protocol}
+                </div>
+              );
+            }
+
+            return (
+              <div key={index}>
+                {port.Port}/{port.Protocol}
+              </div>
+            );
+          })}
+        </>
+      );
+    },
+    sortingFn: (rowA, rowB) => {
+      const a = rowA.original.Ports ?? [];
+      const b = rowB.original.Ports ?? [];
+
+      if (!a.length && !b.length) return 0;
+
+      if (!a.length) return 1;
+      if (!b.length) return -1;
+
+      // sort order based on first port
+      const portA = a[0].Port;
+      const portB = b[0].Port;
+
+      if (portA === portB) {
+        // longer list of ports is considered "greater"
+        if (a.length < b.length) return -1;
+        if (a.length > b.length) return 1;
+        return 0;
+      }
+
+      // now do a regular number sort
+      if (portA < portB) return -1;
+      if (portA > portB) return 1;
+
+      return 0;
+    },
+  }
+);
diff --git a/app/react/kubernetes/services/ServicesView/ServicesDatatable/columns/targetPorts.tsx b/app/react/kubernetes/services/ServicesView/ServicesDatatable/columns/targetPorts.tsx
new file mode 100644
index 0000000..a36ff1c
--- /dev/null
+++ b/app/react/kubernetes/services/ServicesView/ServicesDatatable/columns/targetPorts.tsx
@@ -0,0 +1,45 @@
+import { columnHelper } from './helper';
+
+export const targetPorts = columnHelper.accessor(
+  (row) => row.Ports?.map((port) => port.TargetPort).join(','),
+  {
+    header: 'Target Ports',
+    id: 'targetPorts',
+    cell: ({ row }) => {
+      const ports = row.original.Ports?.map((port) => port.TargetPort) ?? [];
+      if (!ports.length) {
+        return '-';
+      }
+
+      return ports.map((port, index) => <div key={index}>{port}</div>);
+    },
+    sortingFn: (rowA, rowB) => {
+      const a = rowA.original.Ports ?? [];
+      const b = rowB.original.Ports ?? [];
+
+      if (!a.length && !b.length) return 0;
+      if (!a.length) return 1;
+      if (!b.length) return -1;
+
+      const portA = a[0].TargetPort;
+      const portB = b[0].TargetPort;
+
+      if (portA === portB) {
+        if (a.length < b.length) return -1;
+        if (a.length > b.length) return 1;
+
+        return 0;
+      }
+
+      // natural sort of the port
+      return portA.localeCompare(
+        portB,
+        navigator.languages[0] || navigator.language,
+        {
+          numeric: true,
+          ignorePunctuation: true,
+        }
+      );
+    },
+  }
+);
diff --git a/app/react/kubernetes/services/ServicesView/ServicesDatatable/columns/type.tsx b/app/react/kubernetes/services/ServicesView/ServicesDatatable/columns/type.tsx
new file mode 100644
index 0000000..2dde205
--- /dev/null
+++ b/app/react/kubernetes/services/ServicesView/ServicesDatatable/columns/type.tsx
@@ -0,0 +1,21 @@
+import { Row } from '@tanstack/react-table';
+
+import { filterHOC } from '@@/datatables/Filter';
+
+import { ServiceRowData } from '../types';
+
+import { columnHelper } from './helper';
+
+export const type = columnHelper.accessor('Type', {
+  header: 'Type',
+  id: 'type',
+  meta: {
+    filter: filterHOC('Filter by type'),
+  },
+  enableColumnFilter: true,
+  filterFn: (
+    row: Row<ServiceRowData>,
+    columnId: string,
+    filterValue: string[]
+  ) => filterValue.length === 0 || filterValue.includes(row.original.Type),
+});
diff --git a/app/react/kubernetes/services/ServicesView/ServicesDatatable/datatable-store.ts b/app/react/kubernetes/services/ServicesView/ServicesDatatable/datatable-store.ts
new file mode 100644
index 0000000..d389ca1
--- /dev/null
+++ b/app/react/kubernetes/services/ServicesView/ServicesDatatable/datatable-store.ts
@@ -0,0 +1,11 @@
+import { TableSettings } from '@/react/kubernetes/datatables/DefaultDatatableSettings';
+import { systemResourcesSettings } from '@/react/kubernetes/datatables/SystemResourcesSettings';
+
+import { refreshableSettings, createPersistedStore } from '@@/datatables/types';
+
+export function createStore(storageKey: string) {
+  return createPersistedStore<TableSettings>(storageKey, 'name', (set) => ({
+    ...refreshableSettings(set),
+    ...systemResourcesSettings(set),
+  }));
+}
diff --git a/app/react/kubernetes/services/ServicesView/ServicesDatatable/index.tsx b/app/react/kubernetes/services/ServicesView/ServicesDatatable/index.tsx
new file mode 100644
index 0000000..2c44e47
--- /dev/null
+++ b/app/react/kubernetes/services/ServicesView/ServicesDatatable/index.tsx
@@ -0,0 +1 @@
+export { ServicesDatatable } from './ServicesDatatable';
diff --git a/app/react/kubernetes/services/ServicesView/ServicesDatatable/types.ts b/app/react/kubernetes/services/ServicesView/ServicesDatatable/types.ts
new file mode 100644
index 0000000..00bc039
--- /dev/null
+++ b/app/react/kubernetes/services/ServicesView/ServicesDatatable/types.ts
@@ -0,0 +1,5 @@
+import { Service } from '../../types';
+
+export type ServiceRowData = Service & {
+  IsSystem: boolean;
+};
diff --git a/app/react/kubernetes/services/ServicesView/ServicesView.tsx b/app/react/kubernetes/services/ServicesView/ServicesView.tsx
new file mode 100644
index 0000000..23165fb
--- /dev/null
+++ b/app/react/kubernetes/services/ServicesView/ServicesView.tsx
@@ -0,0 +1,12 @@
+import { PageHeader } from '@@/PageHeader';
+
+import { ServicesDatatable } from './ServicesDatatable';
+
+export function ServicesView() {
+  return (
+    <>
+      <PageHeader title="Service list" breadcrumbs="Services" reload />
+      <ServicesDatatable />
+    </>
+  );
+}
diff --git a/app/react/kubernetes/services/ServicesView/index.ts b/app/react/kubernetes/services/ServicesView/index.ts
new file mode 100644
index 0000000..567e7e1
--- /dev/null
+++ b/app/react/kubernetes/services/ServicesView/index.ts
@@ -0,0 +1 @@
+export { ServicesView } from './ServicesView';
diff --git a/app/react/kubernetes/services/service.ts b/app/react/kubernetes/services/service.ts
new file mode 100644
index 0000000..a7b6cfb
--- /dev/null
+++ b/app/react/kubernetes/services/service.ts
@@ -0,0 +1,175 @@
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
+import { ServiceList } from 'kubernetes-types/core/v1';
+
+import { withError } from '@/react-tools/react-query';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { Service } from '@/react/kubernetes/services/types';
+
+import { parseKubernetesAxiosError } from '../axiosError';
+
+export const queryKeys = {
+  clusterServices: (environmentId: EnvironmentId) =>
+    ['environments', environmentId, 'kubernetes', 'services'] as const,
+};
+
+/**
+ * Custom hook to fetch cluster services for a specific environment.
+ *
+ * @param environmentId - The ID of the environment.
+ * @param options - Additional options for fetching services.
+ * @param options.autoRefreshRate - The auto refresh rate for refetching services.
+ * @param options.withApplications - Whether to lookup applications for the services.
+ *
+ * @returns The result of the query.
+ */
+export function useClusterServices<T = Service[]>(
+  environmentId: EnvironmentId,
+  options?: {
+    autoRefreshRate?: number;
+    withApplications?: boolean;
+    select?: (services: Service[]) => T;
+  }
+) {
+  return useQuery(
+    queryKeys.clusterServices(environmentId),
+    async () => getClusterServices(environmentId, options?.withApplications),
+    {
+      ...withError('Unable to get services.'),
+      refetchInterval: options?.autoRefreshRate,
+      select: options?.select,
+    }
+  );
+}
+
+// get a list of services, based on an array of service names, for a specific namespace
+export function useServicesQuery<T extends Service | string = Service>(
+  environmentId: EnvironmentId,
+  namespace: string,
+  serviceNames: string[],
+  options?: { yaml?: boolean }
+) {
+  return useQuery(
+    ['environments', environmentId, 'kubernetes', 'services', serviceNames],
+    async () => {
+      // promise.all is best in this case because I want to return an error if even one service request has an error
+      const services = await Promise.all(
+        serviceNames.map((serviceName) =>
+          getService<T>(environmentId, namespace, serviceName, options?.yaml)
+        )
+      );
+      return services;
+    },
+    {
+      ...withError('Unable to retrieve services.'),
+      enabled: !!serviceNames?.length,
+    }
+  );
+}
+
+export function useMutationDeleteServices(environmentId: EnvironmentId) {
+  const queryClient = useQueryClient();
+  return useMutation(deleteServices, {
+    onSuccess: () =>
+      queryClient.invalidateQueries(queryKeys.clusterServices(environmentId)),
+    ...withError('Unable to delete service(s)'),
+  });
+}
+
+// get a list of services for a specific namespace from the Portainer API
+export async function getServices(
+  environmentId: EnvironmentId,
+  namespace: string,
+  withApplications?: boolean
+) {
+  try {
+    const { data: services } = await axios.get<Array<Service>>(
+      `kubernetes/${environmentId}/namespaces/${namespace}/services`,
+      {
+        params: {
+          withApplications,
+        },
+      }
+    );
+    return services;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to retrieve services');
+  }
+}
+
+export async function getClusterServices(
+  environmentId: EnvironmentId,
+  withApplications?: boolean
+) {
+  try {
+    const { data: services } = await axios.get<Array<Service>>(
+      `kubernetes/${environmentId}/services`,
+      {
+        params: {
+          withApplications,
+        },
+      }
+    );
+    return services;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to retrieve services');
+  }
+}
+
+// getNamespaceServices is used to get a list of services for a specific namespace
+// it calls the kubernetes api directly and not the portainer api
+export async function getNamespaceServices(
+  environmentId: EnvironmentId,
+  namespace: string,
+  queryParams?: Record<string, string>
+) {
+  try {
+    const { data: services } = await axios.get<ServiceList>(
+      `/endpoints/${environmentId}/kubernetes/api/v1/namespaces/${namespace}/services`,
+      {
+        params: queryParams,
+      }
+    );
+    return services.items;
+  } catch (e) {
+    throw parseKubernetesAxiosError(e, 'Unable to retrieve services');
+  }
+}
+
+async function getService<T extends Service | string = Service>(
+  environmentId: EnvironmentId,
+  namespace: string,
+  serviceName: string,
+  yaml?: boolean
+) {
+  try {
+    const { data: service } = await axios.get<T>(
+      `/endpoints/${environmentId}/kubernetes/api/v1/namespaces/${namespace}/services/${serviceName}`,
+      {
+        headers: {
+          Accept: yaml ? 'application/yaml' : 'application/json',
+        },
+      }
+    );
+    return service;
+  } catch (e) {
+    throw parseKubernetesAxiosError(e, 'Unable to retrieve service');
+  }
+}
+
+export async function deleteServices({
+  environmentId,
+  data,
+}: {
+  environmentId: EnvironmentId;
+  data: Record<string, string[]>;
+}) {
+  try {
+    return await axios.post(
+      `kubernetes/${environmentId}/services/delete`,
+      data
+    );
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to delete service(s)');
+  }
+}
diff --git a/app/react/kubernetes/services/types.ts b/app/react/kubernetes/services/types.ts
new file mode 100644
index 0000000..805397c
--- /dev/null
+++ b/app/react/kubernetes/services/types.ts
@@ -0,0 +1,42 @@
+type ServicePort = {
+  Name: string;
+  NodePort: number;
+  Port: number;
+  Protocol: string;
+  TargetPort: string;
+};
+
+type IngressStatus = {
+  Hostname: string;
+  IP: string;
+};
+
+type Application = {
+  Uid: string;
+  Name: string;
+  Kind: string;
+};
+
+export type ServiceType =
+  | 'ClusterIP'
+  | 'ExternalName'
+  | 'NodePort'
+  | 'LoadBalancer';
+
+export type Service = {
+  Name: string;
+  UID: string;
+  Type: ServiceType;
+  Namespace: string;
+  Annotations?: Record<string, string>;
+  CreationDate: string;
+  Labels?: Record<string, string>;
+  AllocateLoadBalancerNodePorts?: boolean;
+  Ports?: Array<ServicePort>;
+  Selector?: Record<string, string>;
+  IngressStatus?: Array<IngressStatus>;
+  Applications?: Application[];
+  ClusterIPs?: Array<string>;
+  ExternalName?: string;
+  ExternalIPs?: Array<string>;
+};
diff --git a/app/react/kubernetes/services/useNamespaceServices.ts b/app/react/kubernetes/services/useNamespaceServices.ts
new file mode 100644
index 0000000..8074e22
--- /dev/null
+++ b/app/react/kubernetes/services/useNamespaceServices.ts
@@ -0,0 +1,46 @@
+import { useQuery, UseQueryOptions } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { error as notifyError } from '@/portainer/services/notifications';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { Service } from './types';
+
+export function useNamespaceServices<T = Service[]>(
+  environmentId: EnvironmentId,
+  namespace: string,
+  queryOptions?: UseQueryOptions<Service[], unknown, T>
+) {
+  return useQuery({
+    queryKey: [
+      'environments',
+      environmentId,
+      'kubernetes',
+      'namespaces',
+      namespace,
+      'services',
+    ],
+    queryFn: () => getServices(environmentId, namespace),
+    onError: (err) => {
+      notifyError('Failure', err as Error, 'Unable to get services');
+    },
+    ...queryOptions,
+  });
+}
+
+export async function getServices(
+  environmentId: EnvironmentId,
+  namespace: string
+) {
+  if (!namespace) {
+    return [];
+  }
+  try {
+    const { data: services } = await axios.get<Service[]>(
+      `kubernetes/${environmentId}/namespaces/${namespace}/services`
+    );
+    return services;
+  } catch (e) {
+    throw parseAxiosError(e as Error, 'Unable to retrieve services');
+  }
+}
diff --git a/app/react/kubernetes/summary/KubernetesSummaryView.tsx b/app/react/kubernetes/summary/KubernetesSummaryView.tsx
new file mode 100644
index 0000000..e6a504f
--- /dev/null
+++ b/app/react/kubernetes/summary/KubernetesSummaryView.tsx
@@ -0,0 +1,83 @@
+import { useStore } from 'zustand';
+
+import { TextTip } from '@@/Tip/TextTip';
+import { FormSection } from '@@/form-components/FormSection';
+
+import { summaryStore } from './store';
+
+export type SummaryAction = {
+  action: string;
+  kind: string;
+  name: string;
+  type?: string;
+};
+
+type Props = {
+  actions?: SummaryAction[];
+  cpuLimit?: string | null;
+  memoryLimit?: string | null;
+};
+
+export function KubernetesSummaryView({
+  actions = [],
+  cpuLimit,
+  memoryLimit,
+}: Props) {
+  const { isExpanded, setIsExpanded } = useStore(summaryStore);
+
+  if (actions.length === 0) {
+    return null;
+  }
+
+  return (
+    <FormSection
+      title="Summary"
+      isFoldable
+      defaultFolded={!isExpanded}
+      setIsDefaultFolded={(isFolded) => setIsExpanded(!isFolded)}
+    >
+      <TextTip color="blue">
+        Portainer will execute the following Kubernetes actions.
+      </TextTip>
+      <ul className="small text-muted ml-5 w-full">
+        {actions.map((action, idx) => {
+          if (!action.action || !action.kind || !action.name) {
+            return null;
+          }
+          return (
+            <li key={`${idx}-${action.kind}-${action.name}`}>
+              {`${action.action} ${getArticle(action.action)} `}
+              <span className="bold">{action.kind}</span>
+              {' named '}
+              <code>{action.name}</code>
+              {!!action.type && (
+                <span>
+                  {' of type '}
+                  <code>{action.type}</code>
+                </span>
+              )}
+            </li>
+          );
+        })}
+        {!!memoryLimit && (
+          <li>
+            Set the memory resources limits and requests to{' '}
+            <code>{memoryLimit}M</code>
+          </li>
+        )}
+        {!!cpuLimit && (
+          <li>
+            Set the CPU resources limits and requests to <code>{cpuLimit}</code>
+          </li>
+        )}
+      </ul>
+    </FormSection>
+  );
+}
+
+function getArticle(resourceAction: string): string {
+  if (resourceAction !== 'Create') {
+    return 'the';
+  }
+  return 'a';
+}
diff --git a/app/react/kubernetes/summary/store.ts b/app/react/kubernetes/summary/store.ts
new file mode 100644
index 0000000..a78a9b4
--- /dev/null
+++ b/app/react/kubernetes/summary/store.ts
@@ -0,0 +1,24 @@
+import { createStore } from 'zustand';
+import { persist, subscribeWithSelector } from 'zustand/middleware';
+
+import { keyBuilder } from '@/react/hooks/useLocalStorage';
+
+type State = {
+  isExpanded: boolean;
+  setIsExpanded(expanded: boolean): void;
+};
+
+export const summaryStore = createStore<State>()(
+  subscribeWithSelector(
+    persist(
+      (set) => ({
+        isExpanded: true,
+        setIsExpanded: (expanded: boolean) => set({ isExpanded: expanded }),
+      }),
+      {
+        name: keyBuilder('kubernetes-summary-expanded'),
+        getStorage: () => localStorage,
+      }
+    )
+  )
+);
diff --git a/app/react/kubernetes/summary/types.ts b/app/react/kubernetes/summary/types.ts
new file mode 100644
index 0000000..c8adedc
--- /dev/null
+++ b/app/react/kubernetes/summary/types.ts
@@ -0,0 +1 @@
+export type KubernetesResourceAction = 'Create' | 'Update' | 'Delete';
diff --git a/app/react/kubernetes/utils.test.ts b/app/react/kubernetes/utils.test.ts
new file mode 100644
index 0000000..f2b8382
--- /dev/null
+++ b/app/react/kubernetes/utils.test.ts
@@ -0,0 +1,34 @@
+import { parseCPU } from './utils';
+import { convertBase2ToMiB } from './namespaces/resourceQuotaUtils';
+
+// test parseCPU with '', '2', '100m', '100u'
+describe('parseCPU', () => {
+  it('should return 0 for empty string', () => {
+    expect(parseCPU('')).toBe(0);
+  });
+  it('should return 2 for 2', () => {
+    expect(parseCPU('2')).toBe(2);
+  });
+  it('should return 0.1 for 100m', () => {
+    expect(parseCPU('100m')).toBe(0.1);
+  });
+  it('should return 0.0001 for 100u', () => {
+    expect(parseCPU('100u')).toBe(0.0001);
+  });
+});
+
+// test convertBase2ToMiB
+describe('convertBase2ToMiB', () => {
+  it('should return empty string for empty string', () => {
+    expect(convertBase2ToMiB('')).toBe('');
+  });
+  it('should return 2Mi for 2Mi', () => {
+    expect(convertBase2ToMiB('2Mi')).toBe('2Mi');
+  });
+  it('should return 1024Mi for 1Gi', () => {
+    expect(convertBase2ToMiB('1Gi')).toBe('1024Mi');
+  });
+  it('should return 1024Mi for 1Ti', () => {
+    expect(convertBase2ToMiB('1Ti')).toBe('1048576Mi');
+  });
+});
diff --git a/app/react/kubernetes/utils.ts b/app/react/kubernetes/utils.ts
new file mode 100644
index 0000000..db8d96e
--- /dev/null
+++ b/app/react/kubernetes/utils.ts
@@ -0,0 +1,138 @@
+import { filesize } from 'filesize';
+import { FileSizeOptions } from 'filesize/types/filesize';
+import filesizeParser from 'filesize-parser';
+
+import { Annotation } from './annotations/types';
+
+/**
+ * parseCPU converts a CPU string to a number in cores.
+ * It supports m (milli), u (micro), n (nano), p (pico) suffixes.
+ *
+ * If given an empty string, it returns 0.
+ */
+export function parseCPU(cpu: string) {
+  if (!cpu) {
+    return 0;
+  }
+
+  let res = parseInt(cpu, 10);
+  if (cpu.endsWith('m')) {
+    res /= 1000;
+  } else if (cpu.endsWith('u')) {
+    res /= 1000000;
+  } else if (cpu.endsWith('n')) {
+    res /= 1000000000;
+  } else if (cpu.endsWith('p')) {
+    res /= 1000000000000;
+  }
+  return res;
+}
+
+/**
+ * Converts a byte value to a human-readable string format
+ *
+ * In Kubernetes, resource measurements for memory are typically in binary units (KiB, MiB, GiB).
+ * This function formats raw byte values into human-readable strings using the IEC standard
+ * by default, which is the standard used in Kubernetes resource specifications.
+ *
+ * @param memoryBytes - The memory size in bytes
+ * @param options - Options for formatting (defaults to IEC standard)
+ * @returns Human-readable memory size (e.g., "100 MiB")
+ */
+export function bytesToReadableFormat(
+  memoryBytes: number,
+  options: FileSizeOptions = {
+    output: 'string',
+    // IEC is used by default, because it's the most common standard for memory units in Kubernetes.
+    standard: 'iec',
+  }
+) {
+  return filesize(memoryBytes, options);
+}
+
+/**
+ * Gets a value in mebibytes (MiB) using the filesize library
+ *
+ * This function always returns the memory value converted to MiB,
+ * regardless of the size. It uses the filesize library with specific
+ * configuration to ensure consistent MiB output.
+ *
+ * @param memoryBytes - The memory size in bytes
+ * @returns The memory size in MiB as a number
+ */
+export function getMebibytes(memoryBytes: number): number {
+  const result = filesize(memoryBytes, {
+    standard: 'iec',
+    output: 'array',
+    exponent: 2, // Force MiB as the unit (2^20 bytes)
+    round: 0,
+  });
+
+  // Return just the numerical value (first element of the array)
+  return result[0];
+}
+
+/**
+ * Parses a value using the filesize-parser library and gives the result in bytes.
+ *
+ * This function handles both string and number inputs.
+ * If the base is not provided, the value is a string and it contains 'i' (e.g. "100MiB"), use base 2 (binary/IEC).
+ * Otherwise, it uses the provided base (defaulting to 10).
+ */
+export function safeFilesizeParser(value: string | number, base?: 2 | 10) {
+  if (!value || Number.isNaN(value)) {
+    return 0;
+  }
+
+  // If the value is a string and contains 'i' (e.g. "100MiB"), use base 2 (binary/IEC)
+  const hasBinaryUnit = typeof value === 'string' && value.includes('i');
+  const inferredBase = hasBinaryUnit ? 2 : 10;
+
+  return filesizeParser(value, { base: base ?? inferredBase });
+}
+
+export function prepareAnnotations(annotations?: Annotation[]) {
+  const result = annotations?.reduce(
+    (acc, a) => {
+      acc[a.key] = a.value;
+      return acc;
+    },
+    {} as Record<string, string>
+  );
+  return result;
+}
+
+/**
+ * Returns the safe value of the given number or string.
+ * @param value - The value to get the safe value for.
+ * @returns The safe value of the given number or string.
+ */
+export function getSafeValue(value: number | string) {
+  const valueNumber = Number(value);
+  if (Number.isNaN(valueNumber)) {
+    return 0;
+  }
+  return valueNumber;
+}
+
+/**
+ * Returns the percentage of the value over the total.
+ * @param value - The value to calculate the percentage for.
+ * @param total - The total value to compare the percentage to.
+ * @returns The percentage of the value over the total, with the '- ' string prefixed, for example '- 50%'.
+ */
+export function getPercentageString(value: number, total?: number | string) {
+  const totalNumber = Number(total);
+  if (
+    totalNumber === 0 ||
+    total === undefined ||
+    total === '' ||
+    Number.isNaN(totalNumber)
+  ) {
+    return '';
+  }
+  if (value > totalNumber) {
+    return '- Exceeded';
+  }
+  return `- ${Math.round((value / totalNumber) * 100)}%`;
+}
diff --git a/app/react/kubernetes/volumes/ItemView/.keep b/app/react/kubernetes/volumes/ItemView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/kubernetes/volumes/ItemView/ConfirmRedeployModal.tsx b/app/react/kubernetes/volumes/ItemView/ConfirmRedeployModal.tsx
new file mode 100644
index 0000000..6737061
--- /dev/null
+++ b/app/react/kubernetes/volumes/ItemView/ConfirmRedeployModal.tsx
@@ -0,0 +1,17 @@
+import { confirm } from '@@/modals/confirm';
+import { buildConfirmButton } from '@@/modals/utils';
+
+export function confirmRedeploy() {
+  return confirm({
+    title: '',
+    message: (
+      <>
+        One or multiple applications are currently using this volume.
+        <br /> For the change to be taken into account these applications will
+        need to be redeployed. Do you want us to reschedule it now?
+      </>
+    ),
+    confirmButton: buildConfirmButton('Redeploy the applications'),
+    cancelButtonLabel: "I'll do it later",
+  });
+}
diff --git a/app/react/kubernetes/volumes/ListView/PersistentVolumeClaimsDatatable.test.tsx b/app/react/kubernetes/volumes/ListView/PersistentVolumeClaimsDatatable.test.tsx
new file mode 100644
index 0000000..090c847
--- /dev/null
+++ b/app/react/kubernetes/volumes/ListView/PersistentVolumeClaimsDatatable.test.tsx
@@ -0,0 +1,324 @@
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { vi } from 'vitest';
+import { HttpResponse } from 'msw';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { http, server } from '@/setup-tests/server';
+import { createMockEnvironment } from '@/react-tools/test-mocks';
+import { usePersistentVolumeClaims } from '@/react/kubernetes/volumes/queries/usePersistentVolumeClaims';
+import { useNamespacesQuery } from '@/react/kubernetes/namespaces/queries/useNamespacesQuery';
+import type { PortainerNamespace } from '@/react/kubernetes/namespaces/types';
+
+import { PersistentVolumeClaimsDatatable } from './PersistentVolumeClaimsDatatable';
+import type { PersistentVolumeClaim } from './types';
+
+const mockUseEnvironmentId = vi.fn();
+
+vi.mock('@/react/hooks/useEnvironmentId', () => ({
+  useEnvironmentId: () => mockUseEnvironmentId(),
+}));
+
+vi.mock('@/react/kubernetes/volumes/queries/usePersistentVolumeClaims', () => ({
+  usePersistentVolumeClaims: vi.fn(),
+}));
+
+vi.mock(
+  '@/react/kubernetes/volumes/queries/useDeletePersistentVolumeClaims',
+  () => ({
+    useDeletePersistentVolumeClaims: vi.fn(() => ({
+      mutate: vi.fn(),
+      isLoading: false,
+    })),
+  })
+);
+
+vi.mock('@/react/kubernetes/namespaces/queries/useNamespacesQuery', () => ({
+  useNamespacesQuery: vi.fn(),
+}));
+
+vi.mock('@/react/kubernetes/volumes/ListView/ResizeClaimEditForm', () => ({
+  ResizeClaimEditForm: ({ claim }: { claim: PersistentVolumeClaim }) => (
+    <div data-cy="resize-form">Resize form for {claim.name}</div>
+  ),
+}));
+
+vi.mock('@@/Link', () => ({
+  Link: ({ children }: { children: React.ReactNode }) => (
+    <span data-cy="mock-link">{children}</span>
+  ),
+}));
+
+vi.mock('@/react/kubernetes/components/CreateFromManifestButton', () => ({
+  CreateFromManifestButton: ({ 'data-cy': dataCy }: { 'data-cy'?: string }) => (
+    <button type="button" data-cy={dataCy}>
+      Create from manifest
+    </button>
+  ),
+}));
+
+const mockPVCs: PersistentVolumeClaim[] = [
+  {
+    id: 'pvc-1',
+    name: 'test-pvc-1',
+    namespace: 'default',
+    storage: 10737418240,
+    storageRequest: '10Gi',
+    creationDate: '2024-01-01T00:00:00Z',
+    accessModes: ['ReadWriteOnce'],
+    humanReadableAccessModes: ['ReadWriteOnce'],
+    volumeName: 'pv-1',
+    storageClass: 'standard',
+    allowVolumeExpansion: true,
+    phase: 'Bound',
+  },
+  {
+    id: 'pvc-2',
+    name: 'test-pvc-2',
+    namespace: 'kube-system',
+    storage: 5368709120,
+    storageRequest: '5Gi',
+    creationDate: '2024-01-02T00:00:00Z',
+    accessModes: ['ReadOnlyMany'],
+    humanReadableAccessModes: ['ReadOnlyMany'],
+    volumeName: 'pv-2',
+    storageClass: 'standard',
+    allowVolumeExpansion: false,
+    phase: 'Pending',
+  },
+];
+
+const pvcWithWorkload: PersistentVolumeClaim = {
+  id: 'pvc-3',
+  name: 'used-pvc',
+  namespace: 'default',
+  storage: 1073741824,
+  storageRequest: '1Gi',
+  creationDate: '2024-01-03T00:00:00Z',
+  accessModes: ['ReadWriteOnce'],
+  humanReadableAccessModes: ['ReadWriteOnce'],
+  volumeName: 'pv-3',
+  storageClass: 'standard',
+  allowVolumeExpansion: false,
+  phase: 'Bound',
+  owningApplications: [
+    {
+      Name: 'my-deployment',
+      ResourcePool: 'default',
+      ApplicationType: 'Deployment',
+    },
+  ],
+};
+
+const mockNamespaces = [
+  { Name: 'default', IsSystem: false },
+  { Name: 'kube-system', IsSystem: true },
+] as PortainerNamespace[];
+
+function renderComponent() {
+  server.use(
+    http.get('/api/endpoints/:endpointId', () =>
+      HttpResponse.json(createMockEnvironment())
+    )
+  );
+
+  const Wrapped = withTestQueryProvider(
+    withUserProvider(withTestRouter(PersistentVolumeClaimsDatatable))
+  );
+
+  return render(<Wrapped />);
+}
+
+describe('PersistentVolumeClaimsDatatable', () => {
+  beforeEach(() => {
+    localStorage.clear();
+    mockUseEnvironmentId.mockReturnValue(3);
+    vi.mocked(usePersistentVolumeClaims).mockImplementation(
+      (_envId, options) =>
+        ({
+          data: options?.select ? options.select(mockPVCs) : mockPVCs,
+          isLoading: false,
+        }) as ReturnType<typeof usePersistentVolumeClaims>
+    );
+    vi.mocked(useNamespacesQuery).mockReturnValue({
+      data: [],
+      isLoading: false,
+    } as ReturnType<typeof useNamespacesQuery>);
+  });
+
+  it('renders the datatable with PVC names and title', async () => {
+    renderComponent();
+
+    expect(await screen.findByText('Volume claims')).toBeVisible();
+    expect(await screen.findByText('test-pvc-1')).toBeVisible();
+    expect(screen.getByText('test-pvc-2')).toBeVisible();
+  });
+
+  it('shows an empty table when there are no PVCs', async () => {
+    vi.mocked(usePersistentVolumeClaims).mockImplementation(
+      (_envId, options) =>
+        ({
+          data: options?.select
+            ? options.select([] as PersistentVolumeClaim[])
+            : [],
+          isLoading: false,
+        }) as ReturnType<typeof usePersistentVolumeClaims>
+    );
+
+    renderComponent();
+
+    expect(await screen.findByText('Volume claims')).toBeVisible();
+    expect(screen.queryByText('test-pvc-1')).not.toBeInTheDocument();
+  });
+
+  it('opens the resize modal when edit is clicked for an expandable PVC', async () => {
+    const { container } = renderComponent();
+
+    await screen.findByText('test-pvc-1');
+
+    const editButton = container.querySelector(
+      '[data-cy="kubernetes-pv-resize-edit-test-pvc-1"]'
+    ) as HTMLButtonElement;
+    expect(editButton).not.toBeNull();
+    expect(editButton).not.toBeDisabled();
+
+    await userEvent.click(editButton);
+
+    expect(await screen.findByTestId('resize-form')).toBeVisible();
+    expect(screen.getByText('Resize form for test-pvc-1')).toBeVisible();
+  });
+
+  it('disables the resize button for PVCs where volume expansion is not allowed', async () => {
+    const { container } = renderComponent();
+
+    await screen.findByText('test-pvc-2');
+
+    const editButton = container.querySelector(
+      '[data-cy="kubernetes-pv-resize-edit-test-pvc-2"]'
+    ) as HTMLButtonElement;
+
+    expect(editButton).toBeDisabled();
+  });
+
+  it('does not show the resize modal initially', async () => {
+    renderComponent();
+
+    await screen.findByText('test-pvc-1');
+
+    expect(screen.queryByTestId('resize-form')).not.toBeInTheDocument();
+  });
+
+  describe('Used by column', () => {
+    it('shows the owning application name for PVCs with a workload', async () => {
+      vi.mocked(usePersistentVolumeClaims).mockImplementation(
+        (_envId, options) => {
+          const data = [pvcWithWorkload];
+          return {
+            data: options?.select ? options.select(data) : data,
+            isLoading: false,
+          } as ReturnType<typeof usePersistentVolumeClaims>;
+        }
+      );
+
+      renderComponent();
+
+      expect(await screen.findByText('my-deployment')).toBeVisible();
+    });
+
+    it('shows a dash for PVCs with no owning applications', async () => {
+      vi.mocked(usePersistentVolumeClaims).mockImplementation(
+        (_envId, options) => {
+          const data = [mockPVCs[0]];
+          return {
+            data: options?.select ? options.select(data) : data,
+            isLoading: false,
+          } as ReturnType<typeof usePersistentVolumeClaims>;
+        }
+      );
+
+      renderComponent();
+
+      await screen.findByText('test-pvc-1');
+      expect(screen.getByText('-')).toBeVisible();
+    });
+  });
+
+  describe('row selectability', () => {
+    it('disables the row checkbox for PVCs with owning applications', async () => {
+      vi.mocked(usePersistentVolumeClaims).mockImplementation(
+        (_envId, options) => {
+          const data = [mockPVCs[0], pvcWithWorkload];
+          return {
+            data: options?.select ? options.select(data) : data,
+            isLoading: false,
+          } as ReturnType<typeof usePersistentVolumeClaims>;
+        }
+      );
+
+      const { container } = renderComponent();
+
+      await screen.findByText('used-pvc');
+
+      // skip header checkbox (index 0); row checkboxes follow in render order
+      const rowCheckboxes = Array.from(
+        container.querySelectorAll<HTMLInputElement>('input[type="checkbox"]')
+      ).slice(1);
+
+      const [freeCheckbox, usedCheckbox] = rowCheckboxes;
+      expect(freeCheckbox).not.toBeDisabled();
+      expect(usedCheckbox).toBeDisabled();
+    });
+
+    it('allows selection of a Bound PVC that has no owning applications', async () => {
+      vi.mocked(usePersistentVolumeClaims).mockImplementation(
+        (_envId, options) => {
+          const data = [mockPVCs[0]]; // Bound, no owningApplications
+          return {
+            data: options?.select ? options.select(data) : data,
+            isLoading: false,
+          } as ReturnType<typeof usePersistentVolumeClaims>;
+        }
+      );
+
+      const { container } = renderComponent();
+
+      await screen.findByText('test-pvc-1');
+
+      const rowCheckboxes = Array.from(
+        container.querySelectorAll<HTMLInputElement>('input[type="checkbox"]')
+      ).slice(1);
+
+      expect(rowCheckboxes[0]).not.toBeDisabled();
+    });
+  });
+
+  it('hides system namespace PVCs by default', async () => {
+    vi.mocked(useNamespacesQuery).mockReturnValue({
+      data: mockNamespaces,
+      isLoading: false,
+    } as ReturnType<typeof useNamespacesQuery>);
+
+    renderComponent();
+
+    expect(await screen.findByText('test-pvc-1')).toBeVisible();
+    expect(screen.queryByText('test-pvc-2')).not.toBeInTheDocument();
+  });
+
+  it('shows system namespace PVCs when showSystemResources is enabled', async () => {
+    localStorage.setItem(
+      'portainer.datatable_settings_kube-volumes-pvc',
+      JSON.stringify({ state: { showSystemResources: true }, version: 1 })
+    );
+    vi.mocked(useNamespacesQuery).mockReturnValue({
+      data: mockNamespaces,
+      isLoading: false,
+    } as ReturnType<typeof useNamespacesQuery>);
+
+    renderComponent();
+
+    expect(await screen.findByText('test-pvc-1')).toBeVisible();
+    expect(screen.getByText('test-pvc-2')).toBeVisible();
+  });
+});
diff --git a/app/react/kubernetes/volumes/ListView/PersistentVolumeClaimsDatatable.tsx b/app/react/kubernetes/volumes/ListView/PersistentVolumeClaimsDatatable.tsx
new file mode 100644
index 0000000..8fd473f
--- /dev/null
+++ b/app/react/kubernetes/volumes/ListView/PersistentVolumeClaimsDatatable.tsx
@@ -0,0 +1,118 @@
+import { Database } from 'lucide-react';
+import { useState } from 'react';
+
+import { Authorized, useAuthorizations } from '@/react/hooks/useUser';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { usePersistentVolumeClaims } from '@/react/kubernetes/volumes/queries/usePersistentVolumeClaims';
+import { useDeletePersistentVolumeClaims } from '@/react/kubernetes/volumes/queries/useDeletePersistentVolumeClaims';
+import { ResizeClaimEditForm } from '@/react/kubernetes/volumes/ListView/ResizeClaimEditForm';
+import { isSystemNamespace } from '@/react/kubernetes/namespaces/queries/useIsSystemNamespace';
+import { useNamespacesQuery } from '@/react/kubernetes/namespaces/queries/useNamespacesQuery';
+
+import { refreshableSettings } from '@@/datatables/types';
+import { Datatable, TableSettingsMenu } from '@@/datatables';
+import { useTableStateWithStorage } from '@@/datatables/useTableState';
+import { DeleteButton } from '@@/buttons/DeleteButton';
+import { Modal } from '@@/modals';
+
+import { systemResourcesSettings } from '../../datatables/SystemResourcesSettings';
+import { CreateFromManifestButton } from '../../components/CreateFromManifestButton';
+import {
+  DefaultDatatableSettings,
+  TableSettings,
+} from '../../datatables/DefaultDatatableSettings';
+import { SystemResourceDescription } from '../../datatables/SystemResourceDescription';
+
+import { createPersistentVolumeClaimsColumns } from './persistentVolumeClaimsColumns';
+import { PersistentVolumeClaim } from './types';
+
+export function PersistentVolumeClaimsDatatable() {
+  const [editResizeClaim, setEditResizeClaim] =
+    useState<PersistentVolumeClaim | null>(null);
+  const tableState = useTableStateWithStorage<TableSettings>(
+    'kube-volumes-pvc',
+    'name',
+    (set) => ({
+      ...systemResourcesSettings(set),
+      ...refreshableSettings(set),
+    })
+  );
+
+  const { authorized: hasWriteAuth } = useAuthorizations(
+    'K8sVolumesW',
+    undefined,
+    false
+  );
+
+  const envId = useEnvironmentId();
+  const namespacesQuery = useNamespacesQuery(envId);
+  const namespaces = namespacesQuery.data ?? [];
+  const deleteClaimsMutation = useDeletePersistentVolumeClaims(envId);
+  const claimsQuery = usePersistentVolumeClaims(envId, {
+    refetchInterval: tableState.autoRefreshRate * 1000,
+    select: filterVolumeClaims,
+  });
+  const claims = claimsQuery.data ?? [];
+  const columns = createPersistentVolumeClaimsColumns((claim) =>
+    setEditResizeClaim(claim)
+  );
+
+  return (
+    <>
+      <Datatable<PersistentVolumeClaim>
+        data-cy="k8s-persistentvolumeclaims-datatable"
+        isLoading={claimsQuery.isLoading}
+        dataset={claims}
+        columns={columns}
+        settingsManager={tableState}
+        title="Volume claims"
+        titleIcon={Database}
+        disableSelect={!hasWriteAuth}
+        isRowSelectable={({ original: claim }) =>
+          !claim.owningApplications?.length
+        }
+        renderTableActions={(selectedItems) => (
+          <Authorized authorizations="K8sVolumesW">
+            <DeleteButton
+              confirmMessage="Do you want to remove the selected volume claim(s)?"
+              onConfirmed={() => deleteClaimsMutation.mutate(selectedItems)}
+              disabled={selectedItems.length === 0}
+              isLoading={deleteClaimsMutation.isLoading}
+              data-cy="k8s-persistentvolumeclaims-delete-button"
+            />
+            <CreateFromManifestButton data-cy="k8s-persistentvolumeclaims-deploy-button" />
+          </Authorized>
+        )}
+        renderTableSettings={() => (
+          <TableSettingsMenu>
+            <DefaultDatatableSettings settings={tableState} />
+          </TableSettingsMenu>
+        )}
+        description={
+          <SystemResourceDescription
+            showSystemResources={tableState.showSystemResources}
+          />
+        }
+      />
+
+      {editResizeClaim && (
+        <Modal onDismiss={() => setEditResizeClaim(null)} size="md">
+          <ResizeClaimEditForm
+            claim={editResizeClaim}
+            onDismiss={() => setEditResizeClaim(null)}
+          />
+        </Modal>
+      )}
+    </>
+  );
+
+  function filterVolumeClaims(
+    claims: PersistentVolumeClaim[]
+  ): PersistentVolumeClaim[] {
+    return claims.filter(
+      (claim) =>
+        tableState.showSystemResources ||
+        !isSystemNamespace(claim.namespace, namespaces)
+    );
+  }
+}
diff --git a/app/react/kubernetes/volumes/ListView/PersistentVolumesDatatable.test.tsx b/app/react/kubernetes/volumes/ListView/PersistentVolumesDatatable.test.tsx
new file mode 100644
index 0000000..bba0d83
--- /dev/null
+++ b/app/react/kubernetes/volumes/ListView/PersistentVolumesDatatable.test.tsx
@@ -0,0 +1,156 @@
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { vi } from 'vitest';
+import { HttpResponse } from 'msw';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { http, server } from '@/setup-tests/server';
+import { createMockEnvironment } from '@/react-tools/test-mocks';
+import { usePersistentVolumes } from '@/react/kubernetes/volumes/queries/usePersistentVolumes';
+
+import { PersistentVolumesDatatable } from './PersistentVolumesDatatable';
+import type { PersistentVolume } from './types';
+
+const mockUseEnvironmentId = vi.fn();
+
+vi.mock('@/react/hooks/useEnvironmentId', () => ({
+  useEnvironmentId: () => mockUseEnvironmentId(),
+}));
+
+vi.mock('@/react/kubernetes/volumes/queries/usePersistentVolumes', () => ({
+  usePersistentVolumes: vi.fn(),
+}));
+
+vi.mock(
+  '@/react/kubernetes/volumes/queries/useDeletePersistentVolumes',
+  () => ({
+    useDeletePersistentVolumes: vi.fn(() => ({
+      mutate: vi.fn(),
+      isLoading: false,
+    })),
+  })
+);
+
+vi.mock('@/react/kubernetes/volumes/ListView/ReclaimPolicyEditForm', () => ({
+  ReclaimPolicyEditForm: ({ volume }: { volume: PersistentVolume }) => (
+    <div data-cy="reclaim-policy-form">
+      Reclaim policy form for {volume.name}
+    </div>
+  ),
+}));
+
+vi.mock('@@/Link', () => ({
+  Link: ({ children }: { children: React.ReactNode }) => (
+    <span data-cy="mock-link">{children}</span>
+  ),
+}));
+
+vi.mock('@/react/kubernetes/components/CreateFromManifestButton', () => ({
+  CreateFromManifestButton: ({ 'data-cy': dataCy }: { 'data-cy'?: string }) => (
+    <button type="button" data-cy={dataCy}>
+      Create from manifest
+    </button>
+  ),
+}));
+
+const mockPVs: PersistentVolume[] = [
+  {
+    name: 'test-pv-1',
+    accessModes: ['ReadWriteOnce'],
+    humanReadableAccessModes: ['ReadWriteOnce'],
+    capacity: { storage: '10Gi' },
+    claimRef: null,
+    storageClassName: 'standard',
+    persistentVolumeReclaimPolicy: 'Retain',
+    status: 'Available',
+    creationDate: '2024-01-01T00:00:00Z',
+  },
+  {
+    name: 'test-pv-2',
+    accessModes: ['ReadWriteOnce'],
+    humanReadableAccessModes: ['ReadWriteOnce'],
+    capacity: { storage: '5Gi' },
+    claimRef: {
+      kind: 'PersistentVolumeClaim',
+      namespace: 'default',
+      name: 'my-pvc',
+      uid: 'abc-123',
+      apiVersion: 'v1',
+      resourceVersion: '1000',
+    },
+    storageClassName: 'standard',
+    persistentVolumeReclaimPolicy: 'Delete',
+    status: 'Bound',
+    creationDate: '2024-01-02T00:00:00Z',
+  },
+];
+
+function renderComponent() {
+  server.use(
+    http.get('/api/endpoints/:endpointId', () =>
+      HttpResponse.json(createMockEnvironment())
+    )
+  );
+
+  const Wrapped = withTestQueryProvider(
+    withUserProvider(withTestRouter(PersistentVolumesDatatable))
+  );
+
+  return render(<Wrapped />);
+}
+
+describe('PersistentVolumesDatatable', () => {
+  beforeEach(() => {
+    mockUseEnvironmentId.mockReturnValue(3);
+    vi.mocked(usePersistentVolumes).mockReturnValue({
+      data: mockPVs,
+      isLoading: false,
+    } as ReturnType<typeof usePersistentVolumes>);
+  });
+
+  it('renders the datatable with PV names and title', async () => {
+    renderComponent();
+
+    expect(await screen.findByText('Volumes')).toBeVisible();
+    expect(await screen.findByText('test-pv-1')).toBeVisible();
+    expect(screen.getByText('test-pv-2')).toBeVisible();
+  });
+
+  it('shows an empty table when there are no PVs', async () => {
+    vi.mocked(usePersistentVolumes).mockReturnValue({
+      data: [] as PersistentVolume[],
+      isLoading: false,
+    } as ReturnType<typeof usePersistentVolumes>);
+
+    renderComponent();
+
+    expect(await screen.findByText('Volumes')).toBeVisible();
+    expect(screen.queryByText('test-pv-1')).not.toBeInTheDocument();
+  });
+
+  it('opens the reclaim policy modal when edit is clicked', async () => {
+    const { container } = renderComponent();
+
+    await screen.findByText('test-pv-1');
+
+    const editButton = container.querySelector(
+      '[data-cy="kubernetes-pv-reclaim-edit-test-pv-1"]'
+    ) as HTMLButtonElement;
+    expect(editButton).not.toBeNull();
+
+    await userEvent.click(editButton);
+
+    expect(await screen.findByTestId('reclaim-policy-form')).toBeVisible();
+    expect(screen.getByText('Reclaim policy form for test-pv-1')).toBeVisible();
+  });
+
+  it('does not show the reclaim policy modal initially', async () => {
+    renderComponent();
+
+    await screen.findByText('test-pv-1');
+
+    expect(screen.queryByTestId('reclaim-policy-form')).not.toBeInTheDocument();
+  });
+});
diff --git a/app/react/kubernetes/volumes/ListView/PersistentVolumesDatatable.tsx b/app/react/kubernetes/volumes/ListView/PersistentVolumesDatatable.tsx
new file mode 100644
index 0000000..5cf95c3
--- /dev/null
+++ b/app/react/kubernetes/volumes/ListView/PersistentVolumesDatatable.tsx
@@ -0,0 +1,111 @@
+import { Database } from 'lucide-react';
+import { useState } from 'react';
+
+import { Authorized, useAuthorizations } from '@/react/hooks/useUser';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { usePersistentVolumes } from '@/react/kubernetes/volumes/queries/usePersistentVolumes';
+import { useDeletePersistentVolumes } from '@/react/kubernetes/volumes/queries/useDeletePersistentVolumes';
+import { ReclaimPolicyEditForm } from '@/react/kubernetes/volumes/ListView/ReclaimPolicyEditForm';
+import { CreateFromManifestButton } from '@/react/kubernetes/components/CreateFromManifestButton';
+
+import { refreshableSettings } from '@@/datatables/types';
+import { Datatable, TableSettingsMenu } from '@@/datatables';
+import { useTableStateWithStorage } from '@@/datatables/useTableState';
+import { DeleteButton } from '@@/buttons/DeleteButton';
+import { Modal } from '@@/modals';
+
+import { systemResourcesSettings } from '../../datatables/SystemResourcesSettings';
+import { isPersistentVolumeUsed } from '../utils';
+import {
+  DefaultDatatableSettings,
+  TableSettings,
+} from '../../datatables/DefaultDatatableSettings';
+import { SystemResourceDescription } from '../../datatables/SystemResourceDescription';
+
+import { createPersistentVolumesColumns } from './persistentVolumesColumns';
+import { PersistentVolume } from './types';
+
+export function PersistentVolumesDatatable() {
+  const [editReclaimPolicyVolume, setEditReclaimPolicyVolume] =
+    useState<PersistentVolume | null>(null);
+  const tableState = useTableStateWithStorage<TableSettings>(
+    'kube-volumes-pv',
+    'name',
+    (set) => ({
+      ...systemResourcesSettings(set),
+      ...refreshableSettings(set),
+    })
+  );
+
+  const { authorized: hasWriteAuth } = useAuthorizations(
+    'K8sVolumesW',
+    undefined,
+    false
+  );
+
+  const envId = useEnvironmentId();
+  const deleteVolumesMutation = useDeletePersistentVolumes(envId);
+  const volumesQuery = usePersistentVolumes(envId, {
+    refetchInterval: tableState.autoRefreshRate * 1000,
+  });
+  const volumes = volumesQuery.data ?? [];
+  const columns = createPersistentVolumesColumns((volume) =>
+    setEditReclaimPolicyVolume(volume)
+  );
+
+  return (
+    <>
+      <Datatable<PersistentVolume>
+        data-cy="k8s-persistentvolumes-datatable"
+        isLoading={volumesQuery.isLoading}
+        dataset={volumes}
+        columns={columns}
+        settingsManager={tableState}
+        title="Volumes"
+        titleIcon={Database}
+        getRowId={(row) => `${row.name}`}
+        disableSelect={!hasWriteAuth}
+        isRowSelectable={({ original: volume }) =>
+          !isPersistentVolumeUsed(volume)
+        }
+        renderTableActions={(selectedItems) => (
+          <Authorized authorizations="K8sVolumesW">
+            <DeleteButton
+              confirmMessage="Do you want to remove the selected volume(s)?"
+              onConfirmed={() => deleteVolumesMutation.mutate(selectedItems)}
+              disabled={selectedItems.length === 0}
+              isLoading={deleteVolumesMutation.isLoading}
+              data-cy="k8s-persistentvolumes-delete-button"
+            />
+            <CreateFromManifestButton data-cy="k8s-persistentvolumes-deploy-button" />
+          </Authorized>
+        )}
+        renderTableSettings={() => (
+          <TableSettingsMenu>
+            <DefaultDatatableSettings settings={tableState} />
+          </TableSettingsMenu>
+        )}
+        description={
+          <SystemResourceDescription
+            showSystemResources={tableState.showSystemResources}
+          />
+        }
+      />
+
+      <div>
+        {editReclaimPolicyVolume && (
+          <Modal
+            onDismiss={() => setEditReclaimPolicyVolume(null)}
+            aria-label="kubernetes-reclaim-modal"
+            size="lg"
+          >
+            <ReclaimPolicyEditForm
+              volume={editReclaimPolicyVolume}
+              onDismiss={() => setEditReclaimPolicyVolume(null)}
+            />
+          </Modal>
+        )}
+      </div>
+    </>
+  );
+}
diff --git a/app/react/kubernetes/volumes/ListView/ReclaimPolicyEditForm.test.tsx b/app/react/kubernetes/volumes/ListView/ReclaimPolicyEditForm.test.tsx
new file mode 100644
index 0000000..37ee581
--- /dev/null
+++ b/app/react/kubernetes/volumes/ListView/ReclaimPolicyEditForm.test.tsx
@@ -0,0 +1,149 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { vi } from 'vitest';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+
+vi.mock('@@/modals', () => ({
+  Modal: {
+    Header: ({ title }: { title: string }) => <h2>{title}</h2>,
+    Body: ({ children }: { children: React.ReactNode }) => (
+      <div>{children}</div>
+    ),
+    Footer: ({ children }: { children: React.ReactNode }) => (
+      <div>{children}</div>
+    ),
+  },
+}));
+
+/* eslint-disable import/first */
+import { ReclaimPolicyEditForm } from './ReclaimPolicyEditForm';
+import type { PersistentVolume } from './types';
+/* eslint-enable import/first */
+
+const mockUseEnvironmentId = vi.fn();
+const mockMutateAsync = vi.fn();
+
+vi.mock('@/react/hooks/useEnvironmentId', () => ({
+  useEnvironmentId: () => mockUseEnvironmentId(),
+}));
+
+vi.mock('@/react/kubernetes/volumes/queries/useUpdatePVReclaimPolicy', () => ({
+  useUpdatePVReclaimPolicy: () => ({
+    mutateAsync: mockMutateAsync,
+    isLoading: false,
+  }),
+}));
+
+vi.mock('@/portainer/services/notifications', () => ({
+  notifySuccess: vi.fn(),
+  notifyError: vi.fn(),
+}));
+
+// Mock react-select with a native select for easier testing
+vi.mock('@@/form-components/ReactSelect', () => ({
+  Select: ({
+    value,
+    options,
+    onChange,
+    inputId,
+  }: {
+    value?: { value: string; label: string };
+    options?: { value: string; label: string }[];
+    onChange?: (option: { value: string; label: string } | null) => void;
+    inputId?: string;
+  }) => (
+    <select
+      id={inputId}
+      aria-label="Reclaim Policy"
+      value={value?.value}
+      onChange={(e) => {
+        const selected = options?.find((o) => o.value === e.target.value);
+        if (selected) onChange?.(selected);
+      }}
+    >
+      {options?.map((o) => (
+        <option key={o.value} value={o.value}>
+          {o.label}
+        </option>
+      ))}
+    </select>
+  ),
+}));
+
+const mockVolume: PersistentVolume = {
+  name: 'test-pv',
+  accessModes: ['ReadWriteOnce'],
+  humanReadableAccessModes: ['ReadWriteOnce'],
+  capacity: { storage: '10Gi' },
+  claimRef: null,
+  storageClassName: 'standard',
+  persistentVolumeReclaimPolicy: 'Retain',
+  status: 'Available',
+  creationDate: '2024-01-01T00:00:00Z',
+};
+
+function renderComponent(volume = mockVolume, onDismiss = vi.fn()) {
+  const Wrapped = withTestQueryProvider(ReclaimPolicyEditForm);
+  return render(<Wrapped volume={volume} onDismiss={onDismiss} />);
+}
+
+describe('ReclaimPolicyEditForm', () => {
+  beforeEach(() => {
+    mockUseEnvironmentId.mockReturnValue(3);
+    mockMutateAsync.mockResolvedValue({});
+  });
+
+  it('renders the form with the title and current reclaim policy', async () => {
+    renderComponent();
+
+    expect(
+      await screen.findByText('Edit Persistent Volume Reclaim Policy')
+    ).toBeVisible();
+
+    const select = screen.getByRole('combobox', { name: /reclaim policy/i });
+    expect(select).toHaveValue('Retain');
+  });
+
+  it('shows all available reclaim policy options', async () => {
+    renderComponent();
+
+    await screen.findByText('Edit Persistent Volume Reclaim Policy');
+
+    expect(screen.getByRole('option', { name: 'Retain' })).toBeInTheDocument();
+    expect(screen.getByRole('option', { name: 'Recycle' })).toBeInTheDocument();
+    expect(screen.getByRole('option', { name: 'Delete' })).toBeInTheDocument();
+  });
+
+  it('submits the correct payload when saving the updated policy', async () => {
+    const onDismiss = vi.fn();
+    renderComponent(mockVolume, onDismiss);
+
+    await screen.findByText('Edit Persistent Volume Reclaim Policy');
+
+    const select = screen.getByRole('combobox', { name: /reclaim policy/i });
+    await userEvent.selectOptions(select, 'Delete');
+
+    await userEvent.click(screen.getByRole('button', { name: /save/i }));
+
+    await waitFor(() => {
+      expect(mockMutateAsync).toHaveBeenCalledWith({
+        name: 'test-pv',
+        reclaimPolicy: 'Delete',
+      });
+    });
+  });
+
+  it('calls onDismiss after successful submission', async () => {
+    const onDismiss = vi.fn();
+    renderComponent(mockVolume, onDismiss);
+
+    await screen.findByText('Edit Persistent Volume Reclaim Policy');
+
+    await userEvent.click(screen.getByRole('button', { name: /save/i }));
+
+    await waitFor(() => {
+      expect(onDismiss).toHaveBeenCalled();
+    });
+  });
+});
diff --git a/app/react/kubernetes/volumes/ListView/ReclaimPolicyEditForm.tsx b/app/react/kubernetes/volumes/ListView/ReclaimPolicyEditForm.tsx
new file mode 100644
index 0000000..481a68e
--- /dev/null
+++ b/app/react/kubernetes/volumes/ListView/ReclaimPolicyEditForm.tsx
@@ -0,0 +1,103 @@
+import { Form, Formik } from 'formik';
+import { mixed, object, SchemaOf } from 'yup';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useUpdatePVReclaimPolicy } from '@/react/kubernetes/volumes/queries/useUpdatePVReclaimPolicy';
+
+import { Modal } from '@@/modals';
+import { LoadingButton } from '@@/buttons';
+import { FormControl } from '@@/form-components/FormControl';
+import { Select } from '@@/form-components/ReactSelect';
+
+import { PersistentVolume, ReclaimPolicy } from './types';
+
+interface ReclaimPolicyEditFormValues {
+  reclaimPolicy: ReclaimPolicy;
+}
+
+const RECLAIM_POLICY_OPTIONS: ReclaimPolicy[] = ['Retain', 'Recycle', 'Delete'];
+
+interface Props {
+  volume: PersistentVolume;
+  onDismiss: () => void;
+}
+
+export function ReclaimPolicyEditForm({ volume, onDismiss }: Props) {
+  const envId = useEnvironmentId();
+  const updateMutation = useUpdatePVReclaimPolicy(envId);
+
+  const initialValues: ReclaimPolicyEditFormValues = {
+    reclaimPolicy: volume.persistentVolumeReclaimPolicy,
+  };
+
+  return (
+    <>
+      <Modal.Header title="Edit Persistent Volume Reclaim Policy" />
+
+      <Formik<ReclaimPolicyEditFormValues>
+        initialValues={initialValues}
+        validationSchema={validationSchema()}
+        onSubmit={onSubmit}
+        validateOnChange
+      >
+        {({ errors, handleSubmit, values, setFieldValue, isSubmitting }) => (
+          <>
+            <Modal.Body>
+              <Form className="form-vertical" onSubmit={handleSubmit}>
+                <FormControl
+                  label="Reclaim Policy"
+                  inputId="reclaimPolicy-input"
+                  errors={errors.reclaimPolicy}
+                  size="vertical"
+                >
+                  <Select
+                    inputId="reclaimPolicy-input"
+                    value={{
+                      value: values.reclaimPolicy,
+                      label: values.reclaimPolicy,
+                    }}
+                    onChange={(option) =>
+                      setFieldValue('reclaimPolicy', option?.value)
+                    }
+                    options={RECLAIM_POLICY_OPTIONS.map((o) => ({
+                      value: o,
+                      label: o,
+                    }))}
+                    data-cy="kubernetes-pv-reclaim-policy-select"
+                  />
+                </FormControl>
+              </Form>
+            </Modal.Body>
+
+            <Modal.Footer>
+              <LoadingButton
+                loadingText="Updating..."
+                isLoading={isSubmitting}
+                onClick={() => handleSubmit()}
+                data-cy="kubernetes-pv-reclaim-edit-submit"
+              >
+                Save
+              </LoadingButton>
+            </Modal.Footer>
+          </>
+        )}
+      </Formik>
+    </>
+  );
+
+  async function onSubmit(values: ReclaimPolicyEditFormValues) {
+    await updateMutation.mutateAsync({
+      name: volume.name,
+      reclaimPolicy: values.reclaimPolicy,
+    });
+    onDismiss();
+  }
+}
+
+function validationSchema(): SchemaOf<ReclaimPolicyEditFormValues> {
+  return object().shape({
+    reclaimPolicy: mixed<ReclaimPolicy>()
+      .oneOf(RECLAIM_POLICY_OPTIONS)
+      .required(),
+  });
+}
diff --git a/app/react/kubernetes/volumes/ListView/ResizeClaimEditForm.test.tsx b/app/react/kubernetes/volumes/ListView/ResizeClaimEditForm.test.tsx
new file mode 100644
index 0000000..c968a90
--- /dev/null
+++ b/app/react/kubernetes/volumes/ListView/ResizeClaimEditForm.test.tsx
@@ -0,0 +1,126 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { vi } from 'vitest';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+
+vi.mock('@@/modals', () => ({
+  Modal: {
+    Header: ({ title }: { title: string }) => <h2>{title}</h2>,
+    Body: ({ children }: { children: React.ReactNode }) => (
+      <div>{children}</div>
+    ),
+    Footer: ({ children }: { children: React.ReactNode }) => (
+      <div>{children}</div>
+    ),
+  },
+}));
+
+/* eslint-disable import/first */
+import { ResizeClaimEditForm } from './ResizeClaimEditForm';
+import type { PersistentVolumeClaim } from './types';
+/* eslint-enable import/first */
+
+const mockUseEnvironmentId = vi.fn();
+const mockMutateAsync = vi.fn();
+
+vi.mock('@/react/hooks/useEnvironmentId', () => ({
+  useEnvironmentId: () => mockUseEnvironmentId(),
+}));
+
+vi.mock('@/react/kubernetes/volumes/queries/useResizePVC', () => ({
+  useResizePVC: () => ({
+    mutateAsync: mockMutateAsync,
+    isLoading: false,
+  }),
+}));
+
+vi.mock('@/portainer/services/notifications', () => ({
+  notifySuccess: vi.fn(),
+  notifyError: vi.fn(),
+}));
+
+const mockClaim: PersistentVolumeClaim = {
+  id: 'pvc-1',
+  name: 'my-pvc',
+  namespace: 'default',
+  storage: 10737418240,
+  storageRequest: '10Gi',
+  creationDate: '2024-01-01T00:00:00Z',
+  accessModes: ['ReadWriteOnce'],
+  humanReadableAccessModes: ['ReadWriteOnce'],
+  volumeName: 'pv-1',
+  storageClass: 'standard',
+  allowVolumeExpansion: true,
+  phase: 'Bound',
+};
+
+function renderComponent(claim = mockClaim, onDismiss = vi.fn()) {
+  const Wrapped = withTestQueryProvider(ResizeClaimEditForm);
+  return render(<Wrapped claim={claim} onDismiss={onDismiss} />);
+}
+
+describe('ResizeClaimEditForm', () => {
+  beforeEach(() => {
+    mockUseEnvironmentId.mockReturnValue(3);
+    mockMutateAsync.mockResolvedValue({});
+  });
+
+  it('renders the form with the claim name in the title and pre-filled size', async () => {
+    renderComponent();
+
+    expect(
+      await screen.findByText('Resize Persistent Volume Claim')
+    ).toBeVisible();
+    expect(screen.getByRole('textbox', { name: /new size/i })).toHaveValue(
+      '10Gi'
+    );
+  });
+
+  it('shows a validation error when the size field is cleared', async () => {
+    renderComponent();
+
+    const sizeInput = await screen.findByRole('textbox', {
+      name: /new size/i,
+    });
+
+    await userEvent.clear(sizeInput);
+    await userEvent.click(screen.getByRole('button', { name: /resize/i }));
+
+    expect(await screen.findByText('New size is required')).toBeVisible();
+  });
+
+  it('submits the correct payload when the form is filled and submitted', async () => {
+    const onDismiss = vi.fn();
+    renderComponent(mockClaim, onDismiss);
+
+    const sizeInput = await screen.findByRole('textbox', {
+      name: /new size/i,
+    });
+
+    await userEvent.clear(sizeInput);
+    await userEvent.type(sizeInput, '20Gi');
+    await userEvent.click(screen.getByRole('button', { name: /resize/i }));
+
+    await waitFor(() => {
+      expect(mockMutateAsync).toHaveBeenCalledWith({
+        namespace: 'default',
+        name: 'my-pvc',
+        newSize: '20Gi',
+      });
+    });
+  });
+
+  it('calls onDismiss after successful submission', async () => {
+    const onDismiss = vi.fn();
+    renderComponent(mockClaim, onDismiss);
+
+    await screen.findByRole('textbox', { name: /new size/i });
+
+    await userEvent.click(screen.getByRole('button', { name: /resize/i }));
+
+    await waitFor(() => {
+      expect(onDismiss).toHaveBeenCalled();
+    });
+  });
+});
diff --git a/app/react/kubernetes/volumes/ListView/ResizeClaimEditForm.tsx b/app/react/kubernetes/volumes/ListView/ResizeClaimEditForm.tsx
new file mode 100644
index 0000000..41999ef
--- /dev/null
+++ b/app/react/kubernetes/volumes/ListView/ResizeClaimEditForm.tsx
@@ -0,0 +1,92 @@
+import { Field, Form, Formik } from 'formik';
+import { object, SchemaOf, string } from 'yup';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useResizePVC } from '@/react/kubernetes/volumes/queries/useResizePVC';
+
+import { Modal } from '@@/modals';
+import { LoadingButton } from '@@/buttons';
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+
+import { PersistentVolumeClaim } from './types';
+
+interface ResizeClaimEditFormValues {
+  newSize: string;
+}
+
+interface Props {
+  claim: PersistentVolumeClaim;
+  onDismiss: () => void;
+}
+
+export function ResizeClaimEditForm({ claim, onDismiss }: Props) {
+  const envId = useEnvironmentId();
+  const resizeMutation = useResizePVC(envId);
+
+  const initialValues: ResizeClaimEditFormValues = {
+    newSize: claim.storageRequest ?? '',
+  };
+
+  return (
+    <>
+      <Modal.Header title="Resize Persistent Volume Claim" />
+
+      <Formik<ResizeClaimEditFormValues>
+        initialValues={initialValues}
+        validationSchema={validationSchema()}
+        onSubmit={onSubmit}
+        validateOnChange
+      >
+        {({ errors, handleSubmit, isSubmitting }) => (
+          <>
+            <Modal.Body>
+              <Form className="form-vertical" onSubmit={handleSubmit}>
+                <FormControl
+                  label="New size"
+                  inputId="newSize-input"
+                  errors={errors.newSize}
+                  size="vertical"
+                >
+                  <Field
+                    as={Input}
+                    id="newSize-input"
+                    name="newSize"
+                    placeholder="e.g. 10Gi"
+                    data-cy="kubernetes-pvc-resize-size-input"
+                  />
+                </FormControl>
+              </Form>
+            </Modal.Body>
+
+            <Modal.Footer>
+              <LoadingButton
+                loadingText="Resizing..."
+                isLoading={isSubmitting}
+                onClick={() => handleSubmit()}
+                data-cy="kubernetes-pvc-resize-submit"
+              >
+                Resize
+              </LoadingButton>
+            </Modal.Footer>
+          </>
+        )}
+      </Formik>
+    </>
+  );
+
+  async function onSubmit(values: ResizeClaimEditFormValues) {
+    await resizeMutation.mutateAsync({
+      namespace: claim.namespace,
+      name: claim.name,
+      newSize: values.newSize,
+    });
+    onDismiss();
+  }
+}
+
+function validationSchema(): SchemaOf<ResizeClaimEditFormValues> {
+  return object().shape({
+    newSize: string().required('New size is required'),
+  });
+}
diff --git a/app/react/kubernetes/volumes/ListView/StorageClassesDatatable.test.tsx b/app/react/kubernetes/volumes/ListView/StorageClassesDatatable.test.tsx
new file mode 100644
index 0000000..e0945e9
--- /dev/null
+++ b/app/react/kubernetes/volumes/ListView/StorageClassesDatatable.test.tsx
@@ -0,0 +1,146 @@
+import { render, screen } from '@testing-library/react';
+import { vi } from 'vitest';
+import { HttpResponse } from 'msw';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { http, server } from '@/setup-tests/server';
+import { createMockEnvironment } from '@/react-tools/test-mocks';
+import { useStorageClasses } from '@/react/kubernetes/volumes/queries/useStorageClasses';
+
+import { StorageClassesDatatable } from './StorageClassesDatatable';
+import type { StorageClass } from './types';
+
+const mockUseEnvironmentId = vi.fn();
+
+vi.mock('@/react/hooks/useEnvironmentId', () => ({
+  useEnvironmentId: () => mockUseEnvironmentId(),
+}));
+
+vi.mock('@/react/kubernetes/volumes/queries/useStorageClasses', () => ({
+  useStorageClasses: vi.fn(),
+}));
+
+vi.mock('@/react/kubernetes/volumes/queries/useDeleteStorageClasses', () => ({
+  useDeleteStorageClasses: vi.fn(() => ({
+    mutate: vi.fn(),
+    isLoading: false,
+  })),
+}));
+
+vi.mock('@/react/kubernetes/volumes/queries/useSetDefaultStorageClass', () => ({
+  useSetDefaultStorageClass: vi.fn(() => ({
+    mutate: vi.fn(),
+    isLoading: false,
+  })),
+}));
+
+vi.mock('@@/Link', () => ({
+  Link: ({ children }: { children: React.ReactNode }) => (
+    <span data-cy="mock-link">{children}</span>
+  ),
+}));
+
+vi.mock('@/react/kubernetes/components/CreateFromManifestButton', () => ({
+  CreateFromManifestButton: ({ 'data-cy': dataCy }: { 'data-cy'?: string }) => (
+    <button type="button" data-cy={dataCy}>
+      Create from manifest
+    </button>
+  ),
+}));
+
+const mockStorageClasses: StorageClass[] = [
+  {
+    name: 'standard',
+    provisioner: 'k8s.io/minikube-hostpath',
+    reclaimPolicy: 'Delete',
+    allowVolumeExpansion: true,
+    isDefault: true,
+    creationDate: '2024-01-01T00:00:00Z',
+  },
+  {
+    name: 'fast-ssd',
+    provisioner: 'kubernetes.io/no-provisioner',
+    reclaimPolicy: 'Retain',
+    allowVolumeExpansion: false,
+    isDefault: false,
+    creationDate: '2024-01-02T00:00:00Z',
+  },
+];
+
+function renderComponent() {
+  server.use(
+    http.get('/api/endpoints/:endpointId', () =>
+      HttpResponse.json(createMockEnvironment())
+    )
+  );
+
+  const Wrapped = withTestQueryProvider(
+    withUserProvider(withTestRouter(StorageClassesDatatable))
+  );
+
+  return render(<Wrapped />);
+}
+
+describe('StorageClassesDatatable', () => {
+  beforeEach(() => {
+    mockUseEnvironmentId.mockReturnValue(3);
+    vi.mocked(useStorageClasses).mockReturnValue({
+      data: mockStorageClasses,
+      isLoading: false,
+    } as ReturnType<typeof useStorageClasses>);
+  });
+
+  it('renders the datatable with storage class names and title', async () => {
+    renderComponent();
+
+    expect(await screen.findByText('Storage')).toBeVisible();
+    expect(await screen.findByText('standard')).toBeVisible();
+    expect(screen.getByText('fast-ssd')).toBeVisible();
+  });
+
+  it('shows the Default badge for the default storage class', async () => {
+    renderComponent();
+
+    await screen.findByText('standard');
+
+    expect(screen.getByText('Default')).toBeVisible();
+  });
+
+  it('disables the set-as-default button for an already-default storage class', async () => {
+    const { container } = renderComponent();
+
+    await screen.findByText('standard');
+
+    const setDefaultButton = container.querySelector(
+      '[data-cy="k8s-storage-class-set-default-standard"]'
+    ) as HTMLButtonElement;
+    expect(setDefaultButton).not.toBeNull();
+    expect(setDefaultButton).toBeDisabled();
+  });
+
+  it('enables the set-as-default button for a non-default storage class', async () => {
+    const { container } = renderComponent();
+
+    await screen.findByText('fast-ssd');
+
+    const setDefaultButton = container.querySelector(
+      '[data-cy="k8s-storage-class-set-default-fast-ssd"]'
+    ) as HTMLButtonElement;
+    expect(setDefaultButton).not.toBeNull();
+    expect(setDefaultButton).not.toBeDisabled();
+  });
+
+  it('shows an empty table when there are no storage classes', async () => {
+    vi.mocked(useStorageClasses).mockReturnValue({
+      data: [] as StorageClass[],
+      isLoading: false,
+    } as ReturnType<typeof useStorageClasses>);
+
+    renderComponent();
+
+    expect(await screen.findByText('Storage')).toBeVisible();
+    expect(screen.queryByText('standard')).not.toBeInTheDocument();
+  });
+});
diff --git a/app/react/kubernetes/volumes/ListView/StorageClassesDatatable.tsx b/app/react/kubernetes/volumes/ListView/StorageClassesDatatable.tsx
new file mode 100644
index 0000000..4d23993
--- /dev/null
+++ b/app/react/kubernetes/volumes/ListView/StorageClassesDatatable.tsx
@@ -0,0 +1,88 @@
+import { HardDrive } from 'lucide-react';
+
+import { Authorized, useAuthorizations } from '@/react/hooks/useUser';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useStorageClasses } from '@/react/kubernetes/volumes/queries/useStorageClasses';
+import { useDeleteStorageClasses } from '@/react/kubernetes/volumes/queries/useDeleteStorageClasses';
+import { useSetDefaultStorageClass } from '@/react/kubernetes/volumes/queries/useSetDefaultStorageClass';
+
+import { Datatable, TableSettingsMenu } from '@@/datatables';
+import {
+  BasicTableSettings,
+  RefreshableTableSettings,
+  refreshableSettings,
+} from '@@/datatables/types';
+import { useTableStateWithStorage } from '@@/datatables/useTableState';
+import { TableSettingsMenuAutoRefresh } from '@@/datatables/TableSettingsMenuAutoRefresh';
+import { DeleteButton } from '@@/buttons/DeleteButton';
+
+import { CreateFromManifestButton } from '../../components/CreateFromManifestButton';
+
+import { createStorageClassesColumns } from './storageClassesColumns';
+import { StorageClass } from './types';
+
+interface TableSettings extends BasicTableSettings, RefreshableTableSettings {}
+
+export function StorageClassesDatatable() {
+  const tableState = useTableStateWithStorage<TableSettings>(
+    'kube-volumes-sc',
+    'name',
+    (set) => ({
+      ...refreshableSettings(set),
+    })
+  );
+
+  const { authorized: hasWriteAuth } = useAuthorizations(
+    'K8sVolumesW',
+    undefined,
+    false
+  );
+
+  const envId = useEnvironmentId();
+  const deleteStorageClassesMutation = useDeleteStorageClasses(envId);
+  const setDefaultStorageClassMutation = useSetDefaultStorageClass(envId);
+  const storageClassesQuery = useStorageClasses(envId, {
+    refetchInterval: tableState.autoRefreshRate * 1000,
+  });
+  const storageClasses = storageClassesQuery.data ?? [];
+
+  const columns = createStorageClassesColumns((storageClass: StorageClass) =>
+    setDefaultStorageClassMutation.mutate(storageClass.name)
+  );
+
+  return (
+    <Datatable<StorageClass>
+      data-cy="k8s-storageclasses-datatable"
+      isLoading={storageClassesQuery.isLoading}
+      dataset={storageClasses}
+      columns={columns}
+      settingsManager={tableState}
+      title="Storage"
+      titleIcon={HardDrive}
+      getRowId={(row) => `${row.name}`}
+      disableSelect={!hasWriteAuth}
+      renderTableActions={(selectedItems) => (
+        <Authorized authorizations="K8sVolumesW">
+          <DeleteButton
+            confirmMessage="Do you want to remove the selected storage class(es)?"
+            onConfirmed={() =>
+              deleteStorageClassesMutation.mutate(selectedItems)
+            }
+            disabled={selectedItems.length === 0}
+            isLoading={deleteStorageClassesMutation.isLoading}
+            data-cy="k8s-storageclasses-delete-button"
+          />
+          <CreateFromManifestButton data-cy="k8s-storageclasses-deploy-button" />
+        </Authorized>
+      )}
+      renderTableSettings={() => (
+        <TableSettingsMenu>
+          <TableSettingsMenuAutoRefresh
+            value={tableState.autoRefreshRate}
+            onChange={(value) => tableState.setAutoRefreshRate(value)}
+          />
+        </TableSettingsMenu>
+      )}
+    />
+  );
+}
diff --git a/app/react/kubernetes/volumes/ListView/VolumesView.tsx b/app/react/kubernetes/volumes/ListView/VolumesView.tsx
new file mode 100644
index 0000000..26017d4
--- /dev/null
+++ b/app/react/kubernetes/volumes/ListView/VolumesView.tsx
@@ -0,0 +1,43 @@
+import { Database, HardDrive } from 'lucide-react';
+
+import { PageHeader } from '@@/PageHeader';
+import { WidgetTabs, Tab, useCurrentTabIndex } from '@@/Widget/WidgetTabs';
+
+import { PersistentVolumesDatatable } from './PersistentVolumesDatatable';
+import { StorageClassesDatatable } from './StorageClassesDatatable';
+import { PersistentVolumeClaimsDatatable } from './PersistentVolumeClaimsDatatable';
+
+export function VolumesView() {
+  const tabs: Tab[] = [
+    {
+      name: 'Persistent volume claims',
+      icon: Database,
+      widget: <PersistentVolumeClaimsDatatable />,
+      selectedTabParam: 'volume-claims',
+    },
+    {
+      name: 'Persistent volumes',
+      icon: Database,
+      widget: <PersistentVolumesDatatable />,
+      selectedTabParam: 'volumes',
+    },
+    {
+      name: 'Storage classes',
+      icon: HardDrive,
+      widget: <StorageClassesDatatable />,
+      selectedTabParam: 'storage',
+    },
+  ];
+
+  const currentTabIndex = useCurrentTabIndex(tabs);
+
+  return (
+    <>
+      <PageHeader title="Volume list" breadcrumbs="Volumes" reload />
+      <>
+        <WidgetTabs tabs={tabs} currentTabIndex={currentTabIndex} />
+        <div className="content">{tabs[currentTabIndex].widget}</div>
+      </>
+    </>
+  );
+}
diff --git a/app/react/kubernetes/volumes/ListView/persistentVolumeClaimsColumns.tsx b/app/react/kubernetes/volumes/ListView/persistentVolumeClaimsColumns.tsx
new file mode 100644
index 0000000..abdbbe3
--- /dev/null
+++ b/app/react/kubernetes/volumes/ListView/persistentVolumeClaimsColumns.tsx
@@ -0,0 +1,136 @@
+import { createColumnHelper } from '@tanstack/react-table';
+import { slugify } from 'markdown-to-jsx';
+import { Edit } from 'lucide-react';
+
+import { formatDate } from '@/portainer/filters/filters';
+
+import { StatusBadge, StatusBadgeType } from '@@/StatusBadge';
+import { Link } from '@@/Link';
+import { TooltipWithChildren } from '@@/Tip/TooltipWithChildren';
+import { Button } from '@@/buttons';
+import { Icon } from '@@/Icon';
+
+import { PersistentVolumeClaim, PersistentVolumeClaimPhase } from './types';
+
+const helper = createColumnHelper<PersistentVolumeClaim>();
+
+export function createPersistentVolumeClaimsColumns(
+  onEditResizeClaim: (claim: PersistentVolumeClaim) => void
+) {
+  return [
+    helper.accessor('name', {
+      header: 'Name',
+      cell: ({ row: { original } }) => {
+        return original.namespace && original.name ? (
+          <Link
+            to="kubernetes.volumes.volume"
+            params={{
+              namespace: original.namespace,
+              name: original.name,
+            }}
+            data-cy={`volume-link-${original.name}`}
+          >
+            {original.name}
+          </Link>
+        ) : (
+          <>{original.name}</>
+        );
+      },
+    }),
+    helper.accessor('namespace', {
+      header: 'Namespace',
+    }),
+    helper.accessor('owningApplications', {
+      header: 'Used by',
+      id: 'owningApplications',
+      cell: ({ getValue }) => {
+        const apps = getValue();
+        if (!apps?.length) {
+          return '-';
+        }
+        return (
+          <div className="flex flex-col gap-y-1">
+            {apps.map((app) => (
+              <Link
+                key={app.Uid ?? app.Name}
+                to="kubernetes.applications.application"
+                params={{
+                  name: app.Name,
+                  namespace: app.ResourcePool,
+                  'resource-type': app.ApplicationType,
+                }}
+                data-cy={`pvc-owning-app-${app.Name}`}
+              >
+                {app.Name}
+              </Link>
+            ))}
+          </div>
+        );
+      },
+    }),
+    helper.accessor('phase', {
+      header: 'Status',
+      cell: ({ getValue }) => {
+        const phase = getValue();
+        return <StatusBadge color={phaseColor(phase)}>{phase}</StatusBadge>;
+      },
+    }),
+    helper.accessor('storageRequest', {
+      header: 'Capacity',
+    }),
+    helper.accessor((row) => row.humanReadableAccessModes.join(', '), {
+      header: 'Access modes',
+      id: 'accessModes',
+    }),
+    helper.accessor('storageClass', {
+      header: 'Storage class',
+    }),
+    helper.accessor('volumeName', {
+      header: 'Volume',
+    }),
+    helper.accessor((row) => formatDate(row.creationDate), {
+      header: 'Created',
+      id: 'created',
+    }),
+    helper.display({
+      id: 'actions',
+      header: 'Actions',
+      cell: ({ row: { original } }) => {
+        const isExpandable = original.allowVolumeExpansion;
+        return (
+          <TooltipWithChildren
+            message={
+              isExpandable
+                ? 'Resize volume claim'
+                : 'Storage class does not allow volume expansion'
+            }
+            position="top"
+          >
+            <Button
+              color="light"
+              className="!ml-0"
+              disabled={!isExpandable}
+              data-cy={`kubernetes-pv-resize-edit-${slugify(original.name)}`}
+              onClick={() => onEditResizeClaim(original)}
+            >
+              <Icon icon={Edit} />
+            </Button>
+          </TooltipWithChildren>
+        );
+      },
+    }),
+  ];
+}
+
+function phaseColor(phase: PersistentVolumeClaimPhase): StatusBadgeType {
+  switch (phase) {
+    case 'Bound':
+      return 'successLite';
+    case 'Pending':
+      return 'warningLite';
+    case 'Lost':
+      return 'dangerLite';
+    default:
+      return 'mutedLite';
+  }
+}
diff --git a/app/react/kubernetes/volumes/ListView/persistentVolumesColumns.tsx b/app/react/kubernetes/volumes/ListView/persistentVolumesColumns.tsx
new file mode 100644
index 0000000..26b4327
--- /dev/null
+++ b/app/react/kubernetes/volumes/ListView/persistentVolumesColumns.tsx
@@ -0,0 +1,113 @@
+import { createColumnHelper } from '@tanstack/react-table';
+import { Edit } from 'lucide-react';
+import { slugify } from 'markdown-to-jsx';
+
+import { formatDate } from '@/portainer/filters/filters';
+
+import { StatusBadge, StatusBadgeType } from '@@/StatusBadge';
+import { Link } from '@@/Link';
+import { Button } from '@@/buttons';
+import { TooltipWithChildren } from '@@/Tip/TooltipWithChildren';
+import { Icon } from '@@/Icon';
+
+import { PersistentVolume, PersistentVolumeStatus } from './types';
+
+const helper = createColumnHelper<PersistentVolume>();
+
+export function createPersistentVolumesColumns(
+  onEditReclaimPolicy: (volume: PersistentVolume) => void
+) {
+  return [
+    helper.accessor('name', {
+      header: 'Name',
+      cell: ({ getValue }) => {
+        const name = getValue();
+        return (
+          <Link
+            to="kubernetes.volumes.persistentVolume"
+            params={{ name }}
+            data-cy={`persistent-volume-name-link-${name}`}
+          >
+            {name}
+          </Link>
+        );
+      },
+    }),
+    helper.accessor('status', {
+      header: 'Status',
+      cell: ({ getValue }) => {
+        const status = getValue();
+        return <StatusBadge color={statusColor(status)}>{status}</StatusBadge>;
+      },
+    }),
+    helper.accessor((row) => row.capacity?.storage, {
+      header: 'Capacity',
+      id: 'capacity',
+    }),
+    helper.accessor((row) => row.humanReadableAccessModes.join(', '), {
+      header: 'Access modes',
+      id: 'accessModes',
+    }),
+    helper.accessor('persistentVolumeReclaimPolicy', {
+      header: 'Reclaim policy',
+    }),
+    helper.accessor('storageClassName', {
+      header: 'Storage class',
+    }),
+    helper.accessor('claimRef', {
+      header: 'Claim',
+      id: 'claim',
+      cell: ({ row: { original } }) =>
+        original.claimRef ? (
+          <Link
+            to="kubernetes.volumes.volume"
+            params={{
+              namespace: original.claimRef.namespace,
+              name: original.claimRef.name,
+            }}
+            data-cy={`volume-link-${original.claimRef.name}`}
+          >
+            {original.claimRef.namespace}/{original.claimRef.name}
+          </Link>
+        ) : (
+          ''
+        ),
+    }),
+    helper.accessor((row) => formatDate(row.creationDate), {
+      header: 'Created',
+      id: 'created',
+    }),
+    helper.display({
+      id: 'actions',
+      header: 'Actions',
+      cell: ({ row: { original } }) => {
+        return (
+          <TooltipWithChildren message="Edit reclaim policy" position="top">
+            <Button
+              color="light"
+              className="!ml-0"
+              data-cy={`kubernetes-pv-reclaim-edit-${slugify(original.name)}`}
+              onClick={() => onEditReclaimPolicy(original)}
+            >
+              <Icon icon={Edit} />
+            </Button>
+          </TooltipWithChildren>
+        );
+      },
+    }),
+  ];
+}
+
+function statusColor(status: PersistentVolumeStatus): StatusBadgeType {
+  switch (status) {
+    case 'Bound':
+    case 'Available':
+      return 'successLite';
+    case 'Released':
+      return 'warningLite';
+    case 'Failed':
+      return 'dangerLite';
+    default:
+      return 'mutedLite';
+  }
+}
diff --git a/app/react/kubernetes/volumes/ListView/storageClassesColumns.tsx b/app/react/kubernetes/volumes/ListView/storageClassesColumns.tsx
new file mode 100644
index 0000000..21d6090
--- /dev/null
+++ b/app/react/kubernetes/volumes/ListView/storageClassesColumns.tsx
@@ -0,0 +1,77 @@
+import { createColumnHelper } from '@tanstack/react-table';
+import { Star } from 'lucide-react';
+import { slugify } from 'markdown-to-jsx';
+
+import { formatDate } from '@/portainer/filters/filters';
+
+import { Badge } from '@@/Badge';
+import { Link } from '@@/Link';
+import { Button } from '@@/buttons';
+import { TooltipWithChildren } from '@@/Tip/TooltipWithChildren';
+import { Icon } from '@@/Icon';
+
+import { StorageClass } from './types';
+
+const helper = createColumnHelper<StorageClass>();
+
+export function createStorageClassesColumns(
+  onSetDefault: (storageClass: StorageClass) => void
+) {
+  return [
+    helper.accessor('name', {
+      header: 'Name',
+      cell: ({ row, getValue }) => {
+        const name = getValue();
+        return (
+          <div className="flex items-center gap-2">
+            <Link
+              to="kubernetes.volumes.storageClass"
+              params={{ name }}
+              data-cy={`storage-class-name-link-${name}`}
+            >
+              {name}
+            </Link>
+            {row.original.isDefault && <Badge type="success">Default</Badge>}
+          </div>
+        );
+      },
+    }),
+    helper.accessor('provisioner', {
+      header: 'Provisioner',
+    }),
+    helper.accessor('reclaimPolicy', {
+      header: 'Reclaim policy',
+      cell: ({ getValue }) => getValue() ?? '-',
+    }),
+    helper.accessor('allowVolumeExpansion', {
+      header: 'Volume expansion',
+      cell: ({ getValue }) => (getValue() ? 'Allowed' : 'Disallowed'),
+    }),
+    helper.accessor((row) => formatDate(row.creationDate), {
+      header: 'Created',
+      id: 'created',
+    }),
+    helper.display({
+      id: 'actions',
+      header: 'Actions',
+      cell: ({ row: { original } }) => (
+        <TooltipWithChildren
+          message={
+            original.isDefault ? 'Already the default' : 'Set as default'
+          }
+          position="top"
+        >
+          <Button
+            color="light"
+            className="!ml-0"
+            disabled={original.isDefault}
+            data-cy={`k8s-storage-class-set-default-${slugify(original.name)}`}
+            onClick={() => onSetDefault(original)}
+          >
+            <Icon icon={Star} />
+          </Button>
+        </TooltipWithChildren>
+      ),
+    }),
+  ];
+}
diff --git a/app/react/kubernetes/volumes/ListView/types.ts b/app/react/kubernetes/volumes/ListView/types.ts
new file mode 100644
index 0000000..739ed90
--- /dev/null
+++ b/app/react/kubernetes/volumes/ListView/types.ts
@@ -0,0 +1,95 @@
+import { K8sVolOwningApplication } from '../types';
+
+export interface VolumeViewModel {
+  Applications: K8sVolOwningApplication[];
+  PersistentVolumeClaim: {
+    Name: string;
+    storageClass: {
+      Name: string;
+    };
+    Storage?: string | number;
+    CreationDate?: string;
+    ApplicationOwner?: string;
+    IsExternal?: boolean;
+  };
+  ResourcePool: {
+    Namespace: {
+      Name: string;
+    };
+  };
+}
+
+export type AccessMode =
+  | 'ReadWriteOnce'
+  | 'ReadOnlyMany'
+  | 'ReadWriteMany'
+  | 'ReadWriteOncePod';
+export type ReclaimPolicy = 'Retain' | 'Recycle' | 'Delete';
+export type VolumeMode = 'Filesystem' | 'Block';
+export type PersistentVolumeStatus =
+  | 'Available'
+  | 'Bound'
+  | 'Released'
+  | 'Failed';
+export type PersistentVolumeClaimPhase = 'Bound' | 'Pending' | 'Lost';
+
+export interface ClaimRef {
+  kind: string;
+  namespace: string;
+  name: string;
+  uid: string;
+  apiVersion: string;
+  resourceVersion: string;
+}
+
+export interface PersistentVolume {
+  name: string;
+  labels?: Record<string, string>;
+  annotations?: Record<string, string>;
+  accessModes: string[];
+  humanReadableAccessModes: AccessMode[];
+  capacity: {
+    storage: string;
+  };
+  claimRef: ClaimRef | null;
+  storageClassName: string;
+  persistentVolumeReclaimPolicy: ReclaimPolicy;
+  volumeMode?: VolumeMode;
+  csi?: unknown;
+  status: PersistentVolumeStatus;
+  creationDate: string;
+}
+
+export interface PersistentVolumeClaim {
+  id: string;
+  name: string;
+  namespace: string;
+  storage: number;
+  storageRequest: string;
+  creationDate: string;
+  accessModes: string[];
+  humanReadableAccessModes: AccessMode[];
+  volumeName: string;
+  resourcesRequests?: {
+    storage?: string;
+  };
+  storageClass: string;
+  allowVolumeExpansion: boolean;
+  volumeMode?: VolumeMode;
+  phase: PersistentVolumeClaimPhase;
+  labels?: Record<string, string>;
+  owningApplications?: K8sVolOwningApplication[];
+}
+
+export interface StorageClass {
+  name: string;
+  provisioner: string;
+  reclaimPolicy: ReclaimPolicy | null;
+  allowVolumeExpansion: boolean | null;
+  isDefault: boolean;
+  annotations?: Record<string, string>;
+  labels?: Record<string, string>;
+  creationDate: string;
+  parameters?: Record<string, string>;
+  mountOptions?: string[];
+}
diff --git a/app/react/kubernetes/volumes/queries/query-keys.ts b/app/react/kubernetes/volumes/queries/query-keys.ts
new file mode 100644
index 0000000..a0c1dc4
--- /dev/null
+++ b/app/react/kubernetes/volumes/queries/query-keys.ts
@@ -0,0 +1,22 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+export const queryKeys = {
+  volumes: (environmentId: EnvironmentId) => [
+    'environments',
+    environmentId,
+    'kubernetes',
+    'volumes',
+  ],
+  claims: (environmentId: EnvironmentId) => [
+    'environments',
+    environmentId,
+    'kubernetes',
+    'claims',
+  ],
+  storages: (environmentId: EnvironmentId) => [
+    'environments',
+    environmentId,
+    'kubernetes',
+    'storages',
+  ],
+};
diff --git a/app/react/kubernetes/volumes/queries/useDeletePersistentVolumeClaims.ts b/app/react/kubernetes/volumes/queries/useDeletePersistentVolumeClaims.ts
new file mode 100644
index 0000000..d6f4bd9
--- /dev/null
+++ b/app/react/kubernetes/volumes/queries/useDeletePersistentVolumeClaims.ts
@@ -0,0 +1,33 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+import { notifySuccess } from '@/portainer/services/notifications';
+import { PersistentVolumeClaim } from '@/react/kubernetes/volumes/ListView/types';
+
+import { queryKeys } from './query-keys';
+
+export function useDeletePersistentVolumeClaims(environmentId: EnvironmentId) {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: (claims: PersistentVolumeClaim[]) =>
+      deleteClaims(claims, environmentId),
+    onSuccess: () => {
+      notifySuccess('Success', 'Persistent volume claim successfully removed');
+      queryClient.invalidateQueries(queryKeys.storages(environmentId));
+      return queryClient.invalidateQueries(queryKeys.claims(environmentId));
+    },
+    ...withError('Unable to remove persistent volume claims'),
+  });
+}
+
+function deleteClaims(
+  claims: PersistentVolumeClaim[],
+  environmentId: EnvironmentId
+) {
+  return axios.post(
+    `/kubernetes/${environmentId}/persistent_volume_claims/delete`,
+    claims.map((c) => ({ name: c.name, namespace: c.namespace }))
+  );
+}
diff --git a/app/react/kubernetes/volumes/queries/useDeletePersistentVolumes.ts b/app/react/kubernetes/volumes/queries/useDeletePersistentVolumes.ts
new file mode 100644
index 0000000..dcdc416
--- /dev/null
+++ b/app/react/kubernetes/volumes/queries/useDeletePersistentVolumes.ts
@@ -0,0 +1,33 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+import { notifySuccess } from '@/portainer/services/notifications';
+import { PersistentVolume } from '@/react/kubernetes/volumes/ListView/types';
+
+import { queryKeys } from './query-keys';
+
+export function useDeletePersistentVolumes(environmentId: EnvironmentId) {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: (volumes: PersistentVolume[]) =>
+      deleteVolumes(volumes, environmentId),
+    onSuccess: () => {
+      notifySuccess('Success', 'Persistent volume successfully removed');
+      queryClient.invalidateQueries(queryKeys.storages(environmentId));
+      return queryClient.invalidateQueries(queryKeys.volumes(environmentId));
+    },
+    ...withError('Unable to remove persistent volumes'),
+  });
+}
+
+function deleteVolumes(
+  volumes: PersistentVolume[],
+  environmentId: EnvironmentId
+) {
+  return axios.post(
+    `/kubernetes/${environmentId}/persistent_volumes/delete`,
+    volumes.map((v) => v.name)
+  );
+}
diff --git a/app/react/kubernetes/volumes/queries/useDeleteStorageClasses.ts b/app/react/kubernetes/volumes/queries/useDeleteStorageClasses.ts
new file mode 100644
index 0000000..dbebdd5
--- /dev/null
+++ b/app/react/kubernetes/volumes/queries/useDeleteStorageClasses.ts
@@ -0,0 +1,33 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+import { notifySuccess } from '@/portainer/services/notifications';
+import { StorageClass } from '@/react/kubernetes/volumes/ListView/types';
+
+import { queryKeys } from './query-keys';
+
+export function useDeleteStorageClasses(environmentId: EnvironmentId) {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: (storageClasses: StorageClass[]) =>
+      deleteStorageClasses(storageClasses, environmentId),
+    onSuccess: () => {
+      notifySuccess('Success', 'Storage classes successfully removed');
+      queryClient.invalidateQueries(queryKeys.storages(environmentId));
+      return queryClient.invalidateQueries(queryKeys.volumes(environmentId));
+    },
+    ...withError('Unable to remove storage classes'),
+  });
+}
+
+function deleteStorageClasses(
+  storageClasses: StorageClass[],
+  environmentId: EnvironmentId
+) {
+  return axios.post(
+    `/kubernetes/${environmentId}/storage_classes/delete`,
+    storageClasses.map((s) => s.name)
+  );
+}
diff --git a/app/react/kubernetes/volumes/queries/useDeleteVolumes.ts b/app/react/kubernetes/volumes/queries/useDeleteVolumes.ts
new file mode 100644
index 0000000..8537967
--- /dev/null
+++ b/app/react/kubernetes/volumes/queries/useDeleteVolumes.ts
@@ -0,0 +1,60 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios from '@/portainer/services/axios/axios';
+import { getAllSettledItems } from '@/portainer/helpers/promise-utils';
+import { withError } from '@/react-tools/react-query';
+import { notifyError, notifySuccess } from '@/portainer/services/notifications';
+import { pluralize } from '@/portainer/helpers/strings';
+
+import { parseKubernetesAxiosError } from '../../axiosError';
+import { VolumeViewModel } from '../ListView/types';
+
+import { queryKeys } from './query-keys';
+
+export function useDeleteVolumes(environmentId: EnvironmentId) {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: (volumes: VolumeViewModel[]) =>
+      deleteVolumes(volumes, environmentId),
+    onSuccess: ({ fulfilledItems, rejectedItems }) => {
+      // one error notification per rejected item
+      rejectedItems.forEach(({ item, reason }) => {
+        notifyError(
+          `Failed to remove volume '${item.PersistentVolumeClaim.Name}'`,
+          new Error(reason)
+        );
+      });
+
+      // one success notification for all fulfilled items
+      if (fulfilledItems.length) {
+        notifySuccess(
+          `${pluralize(fulfilledItems.length, 'Volume')} successfully removed`,
+          fulfilledItems
+            .map((item) => item.PersistentVolumeClaim.Name)
+            .join(', ')
+        );
+      }
+      queryClient.invalidateQueries(queryKeys.storages(environmentId));
+      return queryClient.invalidateQueries(queryKeys.volumes(environmentId));
+    },
+    ...withError('Unable to remove volumes'),
+  });
+}
+
+function deleteVolumes(
+  volumes: VolumeViewModel[],
+  environmentId: EnvironmentId
+) {
+  return getAllSettledItems(volumes, deleteVolume);
+
+  async function deleteVolume(volume: VolumeViewModel) {
+    try {
+      await axios.delete(
+        `/endpoints/${environmentId}/kubernetes/api/v1/namespaces/${volume.ResourcePool.Namespace.Name}/persistentvolumeclaims/${volume.PersistentVolumeClaim.Name}`
+      );
+    } catch (error) {
+      throw parseKubernetesAxiosError(error, 'Unable to remove volume');
+    }
+  }
+}
diff --git a/app/react/kubernetes/volumes/queries/useNamespaceVolumes.ts b/app/react/kubernetes/volumes/queries/useNamespaceVolumes.ts
new file mode 100644
index 0000000..179a7a0
--- /dev/null
+++ b/app/react/kubernetes/volumes/queries/useNamespaceVolumes.ts
@@ -0,0 +1,51 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { withError } from '@/react-tools/react-query';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { K8sVolumeInfo } from '../types';
+
+import { queryKeys } from './query-keys';
+import { convertToVolumeViewModels } from './useVolumesQuery';
+
+// useQuery to get a list of all volumes in a cluster
+export function useNamespaceVolumes(
+  environmentId: EnvironmentId,
+  namespace: string,
+  queryOptions?: {
+    refetchInterval?: number;
+    withApplications?: boolean;
+  }
+) {
+  return useQuery(
+    queryKeys.volumes(environmentId),
+    () =>
+      getNamespaceVolumes(environmentId, namespace, {
+        withApplications: queryOptions?.withApplications ?? false,
+      }),
+    {
+      enabled: !!namespace,
+      refetchInterval: queryOptions?.refetchInterval,
+      select: convertToVolumeViewModels,
+      ...withError('Unable to retrieve volumes'),
+    }
+  );
+}
+
+// get all volumes in a cluster
+async function getNamespaceVolumes(
+  environmentId: EnvironmentId,
+  namespace: string,
+  params?: { withApplications: boolean }
+) {
+  try {
+    const { data } = await axios.get<K8sVolumeInfo[]>(
+      `/kubernetes/${environmentId}/namespaces/${namespace}/volumes`,
+      { params }
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to retrieve volumes');
+  }
+}
diff --git a/app/react/kubernetes/volumes/queries/usePersistentVolumeClaims.ts b/app/react/kubernetes/volumes/queries/usePersistentVolumeClaims.ts
new file mode 100644
index 0000000..95fbf25
--- /dev/null
+++ b/app/react/kubernetes/volumes/queries/usePersistentVolumeClaims.ts
@@ -0,0 +1,40 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { queryKeys } from '@/react/kubernetes/volumes/queries/query-keys';
+import { withError } from '@/react-tools/react-query';
+import { PersistentVolumeClaim } from '@/react/kubernetes/volumes/ListView/types';
+import axios from '@/react/portainer/services/axios/axios';
+import { parseKubernetesAxiosError } from '@/react/kubernetes/axiosError';
+
+export function usePersistentVolumeClaims<T = PersistentVolumeClaim>(
+  environmentId: EnvironmentId,
+  queryOptions?: {
+    refetchInterval?: number;
+    select?: (claims: PersistentVolumeClaim[]) => T[];
+  }
+) {
+  return useQuery(
+    queryKeys.claims(environmentId),
+    () => getPersistentVolumeClaims(environmentId),
+    {
+      refetchInterval: queryOptions?.refetchInterval,
+      select: queryOptions?.select,
+      ...withError('Unable to retrieve persistent volume claims'),
+    }
+  );
+}
+
+async function getPersistentVolumeClaims(environmentId: EnvironmentId) {
+  try {
+    const { data } = await axios.get<PersistentVolumeClaim[]>(
+      `/kubernetes/${environmentId}/persistent_volume_claims`
+    );
+    return data;
+  } catch (e) {
+    throw parseKubernetesAxiosError(
+      e,
+      'Unable to retrieve persistent volume claims'
+    );
+  }
+}
diff --git a/app/react/kubernetes/volumes/queries/usePersistentVolumes.ts b/app/react/kubernetes/volumes/queries/usePersistentVolumes.ts
new file mode 100644
index 0000000..960237c
--- /dev/null
+++ b/app/react/kubernetes/volumes/queries/usePersistentVolumes.ts
@@ -0,0 +1,41 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { queryKeys } from '@/react/kubernetes/volumes/queries/query-keys';
+import { withError } from '@/react-tools/react-query';
+import { PersistentVolume } from '@/react/kubernetes/volumes/ListView/types';
+import axios from '@/react/portainer/services/axios/axios';
+import { parseKubernetesAxiosError } from '@/react/kubernetes/axiosError';
+
+export function usePersistentVolumes<T = PersistentVolume>(
+  environmentId: EnvironmentId,
+  queryOptions?: {
+    refetchInterval?: number;
+    select?: (volumes: PersistentVolume[]) => T[];
+  }
+) {
+  return useQuery(
+    queryKeys.volumes(environmentId),
+    () => getPersistentVolumes(environmentId, { withApplications: true }),
+    {
+      refetchInterval: queryOptions?.refetchInterval,
+      select: queryOptions?.select,
+      ...withError('Unable to retrieve persistent volumes'),
+    }
+  );
+}
+
+async function getPersistentVolumes(
+  environmentId: EnvironmentId,
+  params?: { withApplications: boolean }
+) {
+  try {
+    const { data } = await axios.get<PersistentVolume[]>(
+      `/kubernetes/${environmentId}/persistent_volumes`,
+      { params }
+    );
+    return data;
+  } catch (e) {
+    throw parseKubernetesAxiosError(e, 'Unable to retrieve persistent volumes');
+  }
+}
diff --git a/app/react/kubernetes/volumes/queries/useResizePVC.ts b/app/react/kubernetes/volumes/queries/useResizePVC.ts
new file mode 100644
index 0000000..7e30779
--- /dev/null
+++ b/app/react/kubernetes/volumes/queries/useResizePVC.ts
@@ -0,0 +1,34 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { queryKeys } from './query-keys';
+
+interface ResizePVCPayload {
+  namespace: string;
+  name: string;
+  newSize: string;
+}
+
+export function useResizePVC(environmentId: EnvironmentId) {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: (payload: ResizePVCPayload) =>
+      resizePVC(payload, environmentId),
+    onSuccess: () => {
+      notifySuccess('Success', 'Persistent volume claim successfully resized');
+      return queryClient.invalidateQueries(queryKeys.volumes(environmentId));
+    },
+    ...withError('Unable to resize persistent volume claim'),
+  });
+}
+
+function resizePVC(payload: ResizePVCPayload, environmentId: EnvironmentId) {
+  return axios.put(
+    `/kubernetes/${environmentId}/persistent_volume_claims/resize`,
+    payload
+  );
+}
diff --git a/app/react/kubernetes/volumes/queries/useSetDefaultStorageClass.ts b/app/react/kubernetes/volumes/queries/useSetDefaultStorageClass.ts
new file mode 100644
index 0000000..4dff436
--- /dev/null
+++ b/app/react/kubernetes/volumes/queries/useSetDefaultStorageClass.ts
@@ -0,0 +1,36 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+import { notifySuccess } from '@/portainer/services/notifications';
+import { parseKubernetesAxiosError } from '@/react/kubernetes/axiosError';
+
+import { queryKeys } from './query-keys';
+
+export function useSetDefaultStorageClass(environmentId: EnvironmentId) {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: (name: string) => setDefaultStorageClass(name, environmentId),
+    onSuccess: () => {
+      notifySuccess('Success', 'Default storage class successfully updated');
+      return queryClient.invalidateQueries(queryKeys.storages(environmentId));
+    },
+    ...withError('Unable to set default storage class'),
+  });
+}
+
+async function setDefaultStorageClass(
+  name: string,
+  environmentId: EnvironmentId
+) {
+  try {
+    await axios.put(
+      `/kubernetes/${environmentId}/storage_classes/${encodeURIComponent(
+        name
+      )}/default`
+    );
+  } catch (e) {
+    throw parseKubernetesAxiosError(e, 'Unable to set default storage class');
+  }
+}
diff --git a/app/react/kubernetes/volumes/queries/useStorageClasses.ts b/app/react/kubernetes/volumes/queries/useStorageClasses.ts
new file mode 100644
index 0000000..dd7d2b1
--- /dev/null
+++ b/app/react/kubernetes/volumes/queries/useStorageClasses.ts
@@ -0,0 +1,37 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { queryKeys } from '@/react/kubernetes/volumes/queries/query-keys';
+import { withError } from '@/react-tools/react-query';
+import { StorageClass } from '@/react/kubernetes/volumes/ListView/types';
+import axios from '@/react/portainer/services/axios/axios';
+import { parseKubernetesAxiosError } from '@/react/kubernetes/axiosError';
+
+export function useStorageClasses<T = StorageClass>(
+  environmentId: EnvironmentId,
+  queryOptions?: {
+    refetchInterval?: number;
+    select?: (storageClasses: StorageClass[]) => T[];
+  }
+) {
+  return useQuery(
+    queryKeys.storages(environmentId),
+    () => getStorageClasses(environmentId),
+    {
+      refetchInterval: queryOptions?.refetchInterval,
+      select: queryOptions?.select,
+      ...withError('Unable to retrieve storage classes'),
+    }
+  );
+}
+
+async function getStorageClasses(environmentId: EnvironmentId) {
+  try {
+    const { data } = await axios.get<StorageClass[]>(
+      `/kubernetes/${environmentId}/storage_classes`
+    );
+    return data;
+  } catch (e) {
+    throw parseKubernetesAxiosError(e, 'Unable to retrieve storage classes');
+  }
+}
diff --git a/app/react/kubernetes/volumes/queries/useUpdatePVReclaimPolicy.ts b/app/react/kubernetes/volumes/queries/useUpdatePVReclaimPolicy.ts
new file mode 100644
index 0000000..2d3ba7d
--- /dev/null
+++ b/app/react/kubernetes/volumes/queries/useUpdatePVReclaimPolicy.ts
@@ -0,0 +1,38 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import axios from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { ReclaimPolicy } from '../ListView/types';
+
+import { queryKeys } from './query-keys';
+
+interface UpdateReclaimPolicyPayload {
+  name: string;
+  reclaimPolicy: ReclaimPolicy;
+}
+
+export function useUpdatePVReclaimPolicy(environmentId: EnvironmentId) {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: (payload: UpdateReclaimPolicyPayload) =>
+      updateReclaimPolicy(payload, environmentId),
+    onSuccess: () => {
+      notifySuccess('Success', 'Reclaim policy successfully updated');
+      return queryClient.invalidateQueries(queryKeys.volumes(environmentId));
+    },
+    ...withError('Unable to update reclaim policy'),
+  });
+}
+
+function updateReclaimPolicy(
+  payload: UpdateReclaimPolicyPayload,
+  environmentId: EnvironmentId
+) {
+  return axios.put(
+    `/kubernetes/${environmentId}/persistent_volumes/reclaim_policy`,
+    payload
+  );
+}
diff --git a/app/react/kubernetes/volumes/queries/useVolumesQuery.ts b/app/react/kubernetes/volumes/queries/useVolumesQuery.ts
new file mode 100644
index 0000000..dd0b1f4
--- /dev/null
+++ b/app/react/kubernetes/volumes/queries/useVolumesQuery.ts
@@ -0,0 +1,39 @@
+import { humanize } from '@/portainer/filters/filters';
+
+import { K8sVolumeInfo } from '../types';
+import { VolumeViewModel } from '../ListView/types';
+import { appOwnerLabel } from '../../applications/constants';
+
+export function convertToVolumeViewModels(
+  volumes: K8sVolumeInfo[]
+): VolumeViewModel[] {
+  return volumes.map((volume) => {
+    const owningApplications =
+      volume.persistentVolumeClaim.owningApplications ?? [];
+    return {
+      Applications: owningApplications.map((app) => ({
+        Name: app.Name,
+        ResourcePool: app.ResourcePool,
+        Namespace: app.Namespace,
+        Kind: app.Kind,
+      })),
+      PersistentVolumeClaim: {
+        Namespace: volume.persistentVolumeClaim.namespace,
+        Name: volume.persistentVolumeClaim.name,
+        storageClass: {
+          Name: volume.persistentVolumeClaim.storageClass || '',
+        },
+        Storage: humanize(volume.persistentVolumeClaim.storage),
+        CreationDate: volume.persistentVolumeClaim.creationDate,
+        ApplicationOwner:
+          volume.persistentVolumeClaim.owningApplications?.[0]?.Name,
+        IsExternal: !volume.persistentVolumeClaim.labels?.[appOwnerLabel],
+      },
+      ResourcePool: {
+        Namespace: {
+          Name: volume.persistentVolumeClaim.namespace,
+        },
+      },
+    };
+  });
+}
diff --git a/app/react/kubernetes/volumes/types.ts b/app/react/kubernetes/volumes/types.ts
new file mode 100644
index 0000000..984aab6
--- /dev/null
+++ b/app/react/kubernetes/volumes/types.ts
@@ -0,0 +1,60 @@
+import {
+  PersistentVolumeSpec,
+  PersistentVolumeClaimSpec,
+  PersistentVolumeClaimStatus,
+  ObjectReference,
+  CSIPersistentVolumeSource,
+} from 'kubernetes-types/core/v1';
+
+export interface K8sVolumeInfo {
+  persistentVolume: K8sPersistentVolume;
+  persistentVolumeClaim: K8sPersistentVolumeClaim;
+  storageClass: K8sStorageClass;
+}
+
+interface K8sPersistentVolume {
+  name?: string;
+  annotations?: { [key: string]: string };
+  accessModes?: PersistentVolumeSpec['accessModes'];
+  capacity: PersistentVolumeSpec['capacity'];
+  claimRef?: ObjectReference;
+  storageClassName?: string;
+  persistentVolumeReclaimPolicy: PersistentVolumeSpec['persistentVolumeReclaimPolicy'];
+  volumeMode?: PersistentVolumeSpec['volumeMode'];
+  csi?: CSIPersistentVolumeSource;
+}
+
+interface K8sPersistentVolumeClaim {
+  id: string;
+  name: string;
+  namespace: string;
+  storage: number;
+  creationDate: string;
+  accessModes?: PersistentVolumeClaimSpec['accessModes'];
+  volumeName: string;
+  resourcesRequests?: PersistentVolumeClaimSpec['resources'];
+  storageClass?: string;
+  volumeMode?: PersistentVolumeClaimSpec['volumeMode'];
+  owningApplications?: K8sVolOwningApplication[];
+  phase: PersistentVolumeClaimStatus['phase'];
+  labels?: { [key: string]: string };
+}
+
+interface K8sStorageClass {
+  name: string;
+  provisioner: string;
+  reclaimPolicy?: PersistentVolumeSpec['persistentVolumeReclaimPolicy'];
+  allowVolumeExpansion?: boolean;
+}
+
+export interface K8sVolOwningApplication {
+  Uid?: string;
+  Name: string;
+  ResourcePool: string;
+  ApplicationType?: string;
+  Namespace?: string;
+  Kind?: string;
+  Labels?: { [key: string]: string };
+}
+
+export type Volumes = Record<string, K8sVolumeInfo>;
diff --git a/app/react/kubernetes/volumes/utils.ts b/app/react/kubernetes/volumes/utils.ts
new file mode 100644
index 0000000..0502688
--- /dev/null
+++ b/app/react/kubernetes/volumes/utils.ts
@@ -0,0 +1,15 @@
+import uuidv4 from 'uuid/v4';
+
+import { PersistentVolume, VolumeViewModel } from './ListView/types';
+
+export function isVolumeUsed(volume: VolumeViewModel) {
+  return volume.Applications.length !== 0;
+}
+
+export function isPersistentVolumeUsed(volume: PersistentVolume) {
+  return volume.claimRef !== null;
+}
+
+export function generatedApplicationConfigVolumeName(applicationName: string) {
+  return `config-${applicationName}-${uuidv4()}`;
+}
diff --git a/app/react/portainer/HomeView/BackupFailedPanel.test.tsx b/app/react/portainer/HomeView/BackupFailedPanel.test.tsx
new file mode 100644
index 0000000..ce7a2a9
--- /dev/null
+++ b/app/react/portainer/HomeView/BackupFailedPanel.test.tsx
@@ -0,0 +1,50 @@
+import { http, HttpResponse } from 'msw';
+import { render } from '@testing-library/react';
+
+import { server } from '@/setup-tests/server';
+import { isoDate } from '@/portainer/filters/filters';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+
+import { BackupFailedPanel } from './BackupFailedPanel';
+
+test('when backup failed, should show message', async () => {
+  const timestamp = 1500;
+
+  const { findByText } = renderComponent({ failed: true, timestamp });
+
+  await expect(
+    findByText(
+      `The latest automated backup has failed at ${isoDate(
+        timestamp
+      )}. For details please see the log files and have a look at the`,
+      { exact: false }
+    )
+  ).resolves.toBeVisible();
+});
+
+test("when user is using less nodes then allowed he shouldn't see message", async () => {
+  const { findByText } = renderComponent({ failed: false });
+
+  await expect(
+    findByText('The latest automated backup has failed at', { exact: false })
+  ).rejects.toBeTruthy();
+});
+
+function renderComponent({
+  failed,
+  timestamp,
+}: {
+  failed: boolean;
+  timestamp?: number;
+}) {
+  server.use(
+    http.get('/api/backup/s3/status', () =>
+      HttpResponse.json({ Failed: failed, TimestampUTC: timestamp })
+    )
+  );
+
+  const Wrapped = withTestQueryProvider(withTestRouter(BackupFailedPanel));
+
+  return render(<Wrapped />);
+}
diff --git a/app/react/portainer/HomeView/BackupFailedPanel.tsx b/app/react/portainer/HomeView/BackupFailedPanel.tsx
new file mode 100644
index 0000000..51fe0f1
--- /dev/null
+++ b/app/react/portainer/HomeView/BackupFailedPanel.tsx
@@ -0,0 +1,49 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { error as notifyError } from '@/portainer/services/notifications';
+import { getBackupStatus } from '@/portainer/services/api/backup.service';
+import { isoDate } from '@/portainer/filters/filters';
+
+import { InformationPanel } from '@@/InformationPanel';
+import { TextTip } from '@@/Tip/TextTip';
+import { Link } from '@@/Link';
+
+export function BackupFailedPanel() {
+  const { status, isLoading } = useBackupStatus();
+
+  if (isLoading || !status || !status.Failed) {
+    return null;
+  }
+
+  return (
+    <div className="row">
+      <div className="col-sm-12">
+        <InformationPanel title="Information">
+          <TextTip>
+            The latest automated backup has failed at{' '}
+            {isoDate(status.TimestampUTC)}. For details please see the log files
+            and have a look at the{' '}
+            <Link to="portainer.settings" data-cy="backup-failed-settings-link">
+              settings
+            </Link>{' '}
+            to verify the backup configuration.
+          </TextTip>
+        </InformationPanel>
+      </div>
+    </div>
+  );
+}
+
+function useBackupStatus() {
+  const { data, isLoading } = useQuery(
+    ['backup', 'status'],
+    () => getBackupStatus(),
+    {
+      onError(error) {
+        notifyError('Failure', error as Error, 'Failed to get license info');
+      },
+    }
+  );
+
+  return { status: data, isLoading };
+}
diff --git a/app/react/portainer/HomeView/EdgeLoadingSpinner.module.css b/app/react/portainer/HomeView/EdgeLoadingSpinner.module.css
new file mode 100644
index 0000000..d6ec118
--- /dev/null
+++ b/app/react/portainer/HomeView/EdgeLoadingSpinner.module.css
@@ -0,0 +1,9 @@
+.root {
+  width: 100%;
+  height: 100%;
+  text-align: center;
+  display: flex;
+  flex-direction: row;
+  align-items: center;
+  justify-content: center;
+}
diff --git a/app/react/portainer/HomeView/EdgeLoadingSpinner.tsx b/app/react/portainer/HomeView/EdgeLoadingSpinner.tsx
new file mode 100644
index 0000000..b16b5ee
--- /dev/null
+++ b/app/react/portainer/HomeView/EdgeLoadingSpinner.tsx
@@ -0,0 +1,15 @@
+import clsx from 'clsx';
+import { Settings } from 'lucide-react';
+
+import { Icon } from '@@/Icon';
+
+import styles from './EdgeLoadingSpinner.module.css';
+
+export function EdgeLoadingSpinner() {
+  return (
+    <div className={clsx('row', styles.root)}>
+      Connecting to the Edge environment...
+      <Icon icon={Settings} className="!ml-1 animate-spin-slow" />
+    </div>
+  );
+}
diff --git a/app/react/portainer/HomeView/EnvironmentHeader/EnvironmentHeader.test.tsx b/app/react/portainer/HomeView/EnvironmentHeader/EnvironmentHeader.test.tsx
new file mode 100644
index 0000000..87ddc26
--- /dev/null
+++ b/app/react/portainer/HomeView/EnvironmentHeader/EnvironmentHeader.test.tsx
@@ -0,0 +1,125 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { useCurrentStateAndParams, useRouter } from '@uirouter/react';
+
+import { server } from '@/setup-tests/server';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+
+import { EnvironmentHeader } from './EnvironmentHeader';
+
+vi.mock('@uirouter/react', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@uirouter/react')>();
+  return {
+    ...actual,
+    useCurrentStateAndParams: vi.fn(),
+    useRouter: vi.fn(),
+  };
+});
+
+const mockCounts = {
+  total: 10,
+  up: 7,
+  down: 2,
+  unassigned: 1,
+};
+
+const mockGo = vi.fn();
+
+function setupMocks(params: Record<string, unknown> = {}) {
+  vi.mocked(useCurrentStateAndParams).mockReturnValue({
+    state: {} as never,
+    params,
+  });
+  vi.mocked(useRouter).mockReturnValue({
+    stateService: { go: mockGo },
+  } as never);
+}
+
+function renderComponent() {
+  const Wrapped = withTestQueryProvider(EnvironmentHeader);
+  return render(<Wrapped />);
+}
+
+function mockSummaryCounts(counts = mockCounts) {
+  server.use(
+    http.get('/api/endpoints/summary', () => HttpResponse.json(counts))
+  );
+}
+
+describe('EnvironmentHeader', () => {
+  beforeEach(() => {
+    mockGo.mockClear();
+    setupMocks();
+  });
+
+  it('renders all status segments with counts', async () => {
+    mockSummaryCounts();
+    renderComponent();
+
+    await waitFor(() => {
+      expect(
+        screen.getByRole('radio', { name: /filter by up/i })
+      ).toBeVisible();
+    });
+
+    expect(
+      screen.getByRole('radio', { name: /filter by total/i })
+    ).toBeVisible();
+    expect(
+      screen.getByRole('radio', { name: /filter by down/i })
+    ).toBeVisible();
+    expect(
+      screen.getByRole('radio', { name: /filter by unassigned/i })
+    ).toBeVisible();
+  });
+
+  it('navigates with correct params when Down segment is clicked', async () => {
+    const user = userEvent.setup();
+    mockSummaryCounts();
+    renderComponent();
+
+    await waitFor(() => {
+      expect(
+        screen.getByRole('radio', { name: /filter by down/i })
+      ).toBeVisible();
+    });
+
+    await user.click(screen.getByRole('radio', { name: /filter by down/i }));
+    expect(mockGo).toHaveBeenCalledWith(
+      '.',
+      expect.objectContaining({
+        groupBy: 'Health',
+        groupFilter: 'Down',
+        page: 0,
+        search: '',
+      }),
+      { reload: false, location: 'replace' }
+    );
+  });
+
+  it('clears params when Total is clicked while a filter is active', async () => {
+    const user = userEvent.setup();
+    mockSummaryCounts();
+    setupMocks({ groupBy: 'health', groupFilter: 'up' });
+    renderComponent();
+
+    await waitFor(() => {
+      expect(
+        screen.getByRole('radio', { name: /filter by total/i })
+      ).toBeVisible();
+    });
+
+    await user.click(screen.getByRole('radio', { name: /filter by total/i }));
+    expect(mockGo).toHaveBeenCalledWith(
+      '.',
+      expect.objectContaining({
+        groupBy: 'Id',
+        groupFilter: null,
+        page: 0,
+        search: '',
+      }),
+      { reload: false, location: 'replace' }
+    );
+  });
+});
diff --git a/app/react/portainer/HomeView/EnvironmentHeader/EnvironmentHeader.tsx b/app/react/portainer/HomeView/EnvironmentHeader/EnvironmentHeader.tsx
new file mode 100644
index 0000000..978f1ba
--- /dev/null
+++ b/app/react/portainer/HomeView/EnvironmentHeader/EnvironmentHeader.tsx
@@ -0,0 +1,96 @@
+import { useEnvironmentSummaryCounts } from '@/react/portainer/environments/queries/useEnvironmentSummaryCounts';
+import { SortType } from '@/react/portainer/environments/queries/useEnvironmentList';
+
+import {
+  StatusSummaryBar,
+  StatusSegment,
+} from '@@/StatusSummaryBar/StatusSummaryBar';
+
+import { useHomeViewState } from '../useHomeViewState';
+
+type HeaderFilter =
+  | 'all'
+  | 'custom'
+  | 'up'
+  | 'down'
+  | 'outdated'
+  | 'unassigned';
+
+type ActionableFilter = Exclude<HeaderFilter, 'all' | 'custom'>;
+
+const HEADER_FILTER_CONFIG: Record<
+  ActionableFilter,
+  { sortBy: SortType; groupFilter: string }
+> = {
+  up: { sortBy: 'Health', groupFilter: 'Up' },
+  down: { sortBy: 'Health', groupFilter: 'Down' },
+  outdated: { sortBy: 'Health', groupFilter: 'Outdated' },
+  unassigned: { sortBy: 'Group', groupFilter: '1' },
+};
+
+function deriveHeaderFilter(
+  sortKey: string | undefined,
+  sortGroupFilter: string | null
+): HeaderFilter {
+  if (!sortKey) return 'custom';
+  if (!sortGroupFilter) return 'all';
+  const entries = Object.entries(HEADER_FILTER_CONFIG) as [
+    ActionableFilter,
+    { sortBy: string; groupFilter: string },
+  ][];
+  const match = entries.find(
+    ([, c]) => c.sortBy === sortKey && c.groupFilter === sortGroupFilter
+  );
+  return match?.[0] ?? 'custom';
+}
+
+export function EnvironmentHeader() {
+  const countsQuery = useEnvironmentSummaryCounts();
+  const counts = countsQuery.data;
+  const tableState = useHomeViewState();
+  const headerFilter = deriveHeaderFilter(
+    tableState.groupKey,
+    tableState.groupFilter
+  );
+
+  function handleFilterChange(f: string | null) {
+    if (f === null) {
+      tableState.setHeaderFilter('Id' as SortType, null);
+      return;
+    }
+    const config = HEADER_FILTER_CONFIG[f as ActionableFilter];
+    tableState.setHeaderFilter(config.sortBy, config.groupFilter);
+  }
+
+  if (countsQuery.isLoading || !counts || counts.total === 0) {
+    return null;
+  }
+  const segments: StatusSegment[] = [
+    { key: 'up', label: 'Up', count: counts.up, color: 'success' },
+    { key: 'down', label: 'Down', count: counts.down, color: 'error' },
+    {
+      key: 'outdated',
+      label: 'Outdated',
+      count: counts.outdated,
+      color: 'warning',
+    },
+    {
+      key: 'unassigned',
+      label: 'Unassigned',
+      count: counts.unassigned,
+      color: 'gray',
+    },
+  ];
+
+  return (
+    <StatusSummaryBar
+      total={counts.total}
+      segments={segments}
+      value={headerFilter}
+      onChange={handleFilterChange}
+      radioGroupName="environment-status-filter"
+      data-cy="environment-status-bar"
+      ariaLabel="Filter by environment status"
+    />
+  );
+}
diff --git a/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/AgentDetails.tsx b/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/AgentDetails.tsx
new file mode 100644
index 0000000..654618b
--- /dev/null
+++ b/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/AgentDetails.tsx
@@ -0,0 +1,31 @@
+import { AlertTriangle } from 'lucide-react';
+
+import { Environment } from '@/react/portainer/environments/types';
+import { isAgentEnvironment } from '@/react/portainer/environments/utils';
+
+import { Tooltip } from '@@/Tip/Tooltip';
+import { Icon } from '@@/Icon';
+
+export function AgentDetails({ environment }: { environment: Environment }) {
+  if (!isAgentEnvironment(environment.Type)) {
+    return null;
+  }
+
+  const { Version: agentVersion, IsOutdated } = environment.Agent;
+
+  if (!IsOutdated) {
+    return (
+      <span className="small text-muted vertical-center font-medium">
+        {agentVersion}
+      </span>
+    );
+  }
+
+  return (
+    <span className="small text-muted vertical-center flex items-center gap-1 font-medium">
+      <Icon icon={AlertTriangle} className="icon-warning" />
+      <span className="icon-warning">{agentVersion || '< 2.15'}</span>
+      <Tooltip message="A newer agent version is available. Upgrade to access the latest features and bug fixes." />
+    </span>
+  );
+}
diff --git a/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EditButtons.tsx b/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EditButtons.tsx
new file mode 100644
index 0000000..d319a1d
--- /dev/null
+++ b/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EditButtons.tsx
@@ -0,0 +1,117 @@
+import { Edit2, Settings } from 'lucide-react';
+import { ReactNode } from 'react';
+import clsx from 'clsx';
+
+import { useCurrentUser } from '@/react/hooks/useUser';
+import {
+  Environment,
+  PlatformType,
+} from '@/react/portainer/environments/types';
+import {
+  isEdgeAsync as checkEdgeAsync,
+  getPlatformType,
+} from '@/react/portainer/environments/utils';
+
+import { LinkButton } from '@@/LinkButton';
+
+export function EditButtons({ environment }: { environment: Environment }) {
+  const { isPureAdmin } = useCurrentUser();
+
+  const isEdgeAsync = checkEdgeAsync(environment);
+
+  const configRoute = getConfigRoute(environment);
+
+  const buttonsClasses = clsx(
+    '!ml-0 h-full w-full !rounded-none',
+    'hover:bg-gray-3',
+    'th-dark:hover:bg-gray-9',
+    'th-highcontrast:hover:bg-white th-highcontrast:hover:text-black'
+  );
+
+  return (
+    <ButtonsGrid className="ml-3 w-11">
+      <LinkButton
+        disabled={!isPureAdmin}
+        to="portainer.endpoints.endpoint"
+        params={{ id: environment.Id, redirectTo: 'portainer.home' }}
+        color="none"
+        icon={Edit2}
+        size="medium"
+        className={buttonsClasses}
+        title="Edit"
+        data-cy={`edit-environment-link-${environment.Name}`}
+      />
+
+      <LinkButton
+        disabled={!configRoute || isEdgeAsync || !isPureAdmin}
+        to={configRoute}
+        params={{ endpointId: environment.Id }}
+        color="none"
+        icon={Settings}
+        size="medium"
+        className={buttonsClasses}
+        title="Configuration"
+        data-cy={`configure-environment-link-${environment.Name}`}
+      />
+    </ButtonsGrid>
+  );
+}
+
+function getConfigRoute(environment: Environment) {
+  const platform = getPlatformType(environment.Type);
+
+  switch (platform) {
+    case PlatformType.Docker:
+      return getDockerConfigRoute(environment);
+    case PlatformType.Kubernetes:
+      return 'kubernetes.cluster.setup';
+    default:
+      return '';
+  }
+}
+
+function getDockerConfigRoute(environment: Environment) {
+  const snapshot = environment.Snapshots?.[0];
+  if (!snapshot) {
+    return '';
+  }
+
+  return snapshot.Swarm ? 'docker.swarm' : 'docker.host';
+}
+
+function ButtonsGrid({
+  children,
+  className,
+}: {
+  children: ReactNode[];
+  className?: string;
+}) {
+  const elementChildren = children.filter((child) => child);
+  return (
+    <div
+      className={clsx(
+        'grid',
+        // trace borders but make them transparent so
+        // * hovering the env item won't make env box borders clip with the grid borders
+        // * hovering the buttons won't make the button's icon flicker
+        'rounded-r-lg border border-solid',
+        'border-y-transparent border-r-transparent',
+        'border-l-gray-4 th-highcontrast:border-l-white th-dark:border-l-gray-8',
+        'overflow-hidden',
+        className
+      )}
+    >
+      {elementChildren.map((child, index) => (
+        <div
+          key={index}
+          className={clsx({
+            'border-0 border-b border-solid border-b-gray-4 th-highcontrast:border-b-white th-dark:border-b-gray-8':
+              index < elementChildren.length - 1,
+          })}
+        >
+          {child}
+        </div>
+      ))}
+    </div>
+  );
+}
diff --git a/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EngineVersion.tsx b/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EngineVersion.tsx
new file mode 100644
index 0000000..30338d6
--- /dev/null
+++ b/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EngineVersion.tsx
@@ -0,0 +1,67 @@
+import { DockerSnapshot } from '@/react/docker/snapshots/types';
+import {
+  Environment,
+  PlatformType,
+  KubernetesSnapshot,
+  ContainerEngine,
+} from '@/react/portainer/environments/types';
+import { getPlatformType } from '@/react/portainer/environments/utils';
+import { getDockerEnvironmentType } from '@/react/portainer/environments/utils/getDockerEnvironmentType';
+
+export function EngineVersion({ environment }: { environment: Environment }) {
+  const platform = getPlatformType(environment.Type);
+  const isPodman = environment.ContainerEngine === ContainerEngine.Podman;
+
+  switch (platform) {
+    case PlatformType.Docker:
+      return (
+        <DockerEngineVersion
+          snapshot={environment.Snapshots[0]}
+          isPodman={isPodman}
+        />
+      );
+    case PlatformType.Kubernetes:
+      return (
+        <KubernetesEngineVersion
+          snapshot={environment.Kubernetes.Snapshots?.[0]}
+        />
+      );
+    default:
+      return null;
+  }
+}
+
+function DockerEngineVersion({
+  snapshot,
+  isPodman,
+}: {
+  snapshot?: DockerSnapshot;
+  isPodman?: boolean;
+}) {
+  if (!snapshot) {
+    return null;
+  }
+  const type = getDockerEnvironmentType(snapshot.Swarm, isPodman);
+
+  return (
+    <span className="small text-muted vertical-center">
+      {type} {snapshot.DockerVersion}
+    </span>
+  );
+}
+
+function KubernetesEngineVersion({
+  snapshot,
+}: {
+  snapshot?: KubernetesSnapshot;
+}) {
+  if (!snapshot) {
+    return null;
+  }
+
+  return (
+    <span className="small text-muted vertical-center">
+      Kubernetes {snapshot.KubernetesVersion}
+    </span>
+  );
+}
diff --git a/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentBrowseButtons.tsx b/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentBrowseButtons.tsx
new file mode 100644
index 0000000..1c77d4e
--- /dev/null
+++ b/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentBrowseButtons.tsx
@@ -0,0 +1,167 @@
+import { History, Wifi, WifiOff, X } from 'lucide-react';
+import clsx from 'clsx';
+
+import { Environment } from '@/react/portainer/environments/types';
+import {
+  getDashboardRoute,
+  isEdgeAsync as checkEdgeAsync,
+} from '@/react/portainer/environments/utils';
+import { isBE } from '@/react/portainer/feature-flags/feature-flags.service';
+
+import { Icon } from '@@/Icon';
+import { LinkButton } from '@@/LinkButton';
+import { Button } from '@@/buttons';
+
+type BrowseStatus = 'snapshot' | 'connected' | 'disconnected';
+
+export function EnvironmentBrowseButtons({
+  environment,
+  onClickBrowse,
+  onClickDisconnect,
+  isActive,
+}: {
+  environment: Environment;
+  onClickBrowse(): void;
+  onClickDisconnect(): void;
+  isActive: boolean;
+}) {
+  const isEdgeAsync = checkEdgeAsync(environment);
+  const browseStatus = getStatus(isActive, isEdgeAsync);
+
+  const dashboardRoute = getDashboardRoute(environment);
+  return (
+    <div className="flex h-24 w-full flex-col justify-center gap-2 [&>*]:h-1/3">
+      {isBE &&
+        (browseStatus !== 'snapshot' ? (
+          <LinkButton
+            icon={History}
+            disabled={!isEdgeAsync}
+            to="edge.browse.dashboard"
+            params={{
+              environmentId: environment.Id,
+            }}
+            size="medium"
+            color="light"
+            className="!m-0 w-full !py-0"
+            title={
+              !isEdgeAsync
+                ? 'Browse snapshot is only available for async environments'
+                : ''
+            }
+            data-cy={`browse-snapshot-link-${environment.Name}`}
+          >
+            Browse snapshot
+          </LinkButton>
+        ) : (
+          <Button
+            icon={X}
+            data-cy={`close-snapshot-link-${environment.Name}`}
+            onClick={onClickDisconnect}
+            className="!m-0 w-full !py-0 opacity-60"
+            size="medium"
+            color="light"
+          >
+            Close snapshot
+          </Button>
+        ))}
+
+      {browseStatus !== 'connected' ? (
+        <LinkButton
+          title={
+            isEdgeAsync
+              ? 'Live connection is not available for async environments'
+              : ''
+          }
+          icon={Wifi}
+          disabled={isEdgeAsync}
+          to={dashboardRoute.to}
+          params={dashboardRoute.params}
+          size="medium"
+          onClick={onClickBrowse}
+          color="primary"
+          className="!m-0 w-full !py-0"
+          data-cy={`live-connect-link-${environment.Name}`}
+        >
+          Live connect
+        </LinkButton>
+      ) : (
+        <Button
+          data-cy={`disconnect-link-${environment.Name}`}
+          icon={WifiOff}
+          onClick={onClickDisconnect}
+          className="!m-0 w-full !py-0 opacity-60"
+          size="medium"
+          color="primary"
+        >
+          Disconnect
+        </Button>
+      )}
+
+      <BrowseStatusTag status={browseStatus} />
+    </div>
+  );
+}
+
+function getStatus(isActive: boolean, isEdgeAsync: boolean) {
+  if (!isActive) {
+    return 'disconnected';
+  }
+
+  if (isEdgeAsync) {
+    return 'snapshot';
+  }
+
+  return 'connected';
+}
+
+function BrowseStatusTag({ status }: { status: BrowseStatus }) {
+  switch (status) {
+    case 'snapshot':
+      return <Snapshot />;
+    case 'connected':
+      return <Connected />;
+    case 'disconnected':
+      return <Disconnected />;
+    default:
+      return null;
+  }
+}
+
+function Disconnected() {
+  return (
+    <div className="flex items-center justify-center gap-2">
+      <Icon icon={WifiOff} />
+      Disconnected
+    </div>
+  );
+}
+
+function Connected() {
+  return (
+    <div
+      className={clsx(
+        'flex items-center justify-center gap-2 rounded-lg',
+        'text-green-8 th-dark:text-green-4',
+        'bg-green-3 th-dark:bg-green-3/30'
+      )}
+    >
+      <div className="h-2 w-2 rounded-full bg-green-8 th-dark:bg-green-4" />
+      Connected
+    </div>
+  );
+}
+
+function Snapshot() {
+  return (
+    <div
+      className={clsx(
+        'flex items-center justify-center gap-2 rounded-lg',
+        'text-warning-7 th-dark:text-warning-4',
+        'bg-warning-3 th-highcontrast:bg-warning-3/30 th-dark:bg-warning-3/10'
+      )}
+    >
+      <div className="h-2 w-2 rounded-full bg-warning-7" />
+      Browsing Snapshot
+    </div>
+  );
+}
diff --git a/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentCard.stories.tsx b/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentCard.stories.tsx
new file mode 100644
index 0000000..c21c0a2
--- /dev/null
+++ b/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentCard.stories.tsx
@@ -0,0 +1,178 @@
+import { StoryFn } from '@storybook/react-webpack5';
+
+import {
+  Environment,
+  EnvironmentStatus,
+  EnvironmentType,
+  KubernetesSnapshot,
+} from '@/react/portainer/environments/types';
+import { DockerSnapshot } from '@/react/docker/snapshots/types';
+import { createMockEnvironment } from '@/react-tools/test-mocks';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+
+import { EnvironmentCard } from './EnvironmentCard';
+
+const WrappedEnvironmentCard = withUserProvider(EnvironmentCard);
+
+export default {
+  component: WrappedEnvironmentCard,
+  title: 'Components/Home/EnvironmentList/EnvironmentCard',
+};
+
+interface Args {
+  environment: Environment;
+  groupName?: string;
+}
+
+function Template({ environment, groupName }: Args) {
+  return (
+    <WrappedEnvironmentCard
+      environment={environment}
+      groupName={groupName}
+      onClickBrowse={() => {}}
+    />
+  );
+}
+
+// Docker
+export const DockerEnvironment: StoryFn<Args> = Template.bind({});
+DockerEnvironment.args = {
+  environment: mockEnvironment(EnvironmentType.Docker),
+};
+
+export const DockerAgentEnvironment: StoryFn<Args> = Template.bind({});
+DockerAgentEnvironment.args = {
+  environment: mockEnvironment(EnvironmentType.AgentOnDocker),
+};
+
+export const DockerEdgeEnvironment: StoryFn<Args> = Template.bind({});
+DockerEdgeEnvironment.args = {
+  environment: mockEnvironment(EnvironmentType.EdgeAgentOnDocker),
+};
+
+export const DockerEnvironmentDown: StoryFn<Args> = Template.bind({});
+DockerEnvironmentDown.args = {
+  environment: mockEnvironment(EnvironmentType.Docker, EnvironmentStatus.Down),
+};
+
+// Azure
+export const AzureEnvironment: StoryFn<Args> = Template.bind({});
+AzureEnvironment.args = { environment: mockEnvironment(EnvironmentType.Azure) };
+
+// Kubernetes
+export const KubernetesAgentEnvironment: StoryFn<Args> = Template.bind({});
+KubernetesAgentEnvironment.args = {
+  environment: mockEnvironment(EnvironmentType.AgentOnKubernetes),
+};
+
+export const KubernetesEdgeEnvironment: StoryFn<Args> = Template.bind({});
+KubernetesEdgeEnvironment.args = {
+  environment: mockEnvironment(EnvironmentType.EdgeAgentOnKubernetes),
+};
+
+export const KubernetesEnvironmentDown: StoryFn<Args> = Template.bind({});
+KubernetesEnvironmentDown.args = {
+  environment: mockEnvironment(
+    EnvironmentType.KubernetesLocal,
+    EnvironmentStatus.Down
+  ),
+};
+
+// Long name wrapping
+export const LongEnvironmentName: StoryFn<Args> = Template.bind({});
+LongEnvironmentName.args = {
+  environment: mockEnvironment(
+    EnvironmentType.AgentOnKubernetes,
+    EnvironmentStatus.Up,
+    {
+      Name: 'production-eu-west-1-kubernetes-cluster-primary-workload-node-pool',
+    }
+  ),
+  groupName: 'Production Europe',
+};
+
+export const LongEnvironmentNameWithStats: StoryFn<Args> = Template.bind({});
+LongEnvironmentNameWithStats.args = {
+  environment: mockKubernetesEnvironmentWithStats({
+    Name: 'production-eu-west-1-kubernetes-cluster-primary-workload-node-pool',
+  }),
+  groupName: 'Production Europe',
+};
+
+// With group name
+export const WithGroupName: StoryFn<Args> = Template.bind({});
+WithGroupName.args = {
+  environment: mockEnvironment(EnvironmentType.AgentOnKubernetes),
+  groupName: 'Production',
+};
+
+// With stats
+export const DockerWithStats: StoryFn<Args> = Template.bind({});
+DockerWithStats.args = { environment: mockDockerEnvironmentWithStats() };
+
+export const KubernetesWithStats: StoryFn<Args> = Template.bind({});
+KubernetesWithStats.args = {
+  environment: mockKubernetesEnvironmentWithStats(),
+};
+
+function mockEnvironment(
+  type: EnvironmentType,
+  status: EnvironmentStatus = EnvironmentStatus.Up,
+  overrides: Partial<Environment> = {}
+): Environment {
+  const env = createMockEnvironment();
+  env.Type = type;
+  env.Status = status;
+  return { ...env, ...overrides };
+}
+
+function mockDockerEnvironmentWithStats(): Environment {
+  const env = createMockEnvironment();
+  env.Type = EnvironmentType.Docker;
+  env.Status = EnvironmentStatus.Up;
+  env.Snapshots = [mockDockerSnapshot()];
+  return env;
+}
+
+function mockKubernetesEnvironmentWithStats(
+  overrides: Partial<Environment> = {}
+): Environment {
+  const env = createMockEnvironment();
+  env.Type = EnvironmentType.KubernetesLocal;
+  env.Status = EnvironmentStatus.Up;
+  env.Kubernetes.Snapshots = [mockKubernetesSnapshot()];
+  return { ...env, ...overrides };
+}
+
+function mockDockerSnapshot(): DockerSnapshot {
+  return {
+    TotalCPU: 4,
+    TotalMemory: 8 * 1024 * 1024 * 1024,
+    NodeCount: 1,
+    ImageCount: 12,
+    VolumeCount: 3,
+    ContainerCount: 5,
+    RunningContainerCount: 3,
+    StoppedContainerCount: 2,
+    HealthyContainerCount: 2,
+    UnhealthyContainerCount: 1,
+    Time: 1716825600,
+    StackCount: 2,
+    ServiceCount: 0,
+    Swarm: false,
+    DockerVersion: '24.0.7',
+    GpuUseAll: false,
+    GpuUseList: [],
+    IsPodman: false,
+  };
+}
+
+function mockKubernetesSnapshot(): KubernetesSnapshot {
+  return {
+    KubernetesVersion: 'v1.31.0',
+    TotalCPU: 12,
+    TotalMemory: 32 * 1024 * 1024 * 1024,
+    Time: 1716825600,
+    NodeCount: 3,
+  };
+}
diff --git a/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentCard.test.tsx b/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentCard.test.tsx
new file mode 100644
index 0000000..8d4ee94
--- /dev/null
+++ b/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentCard.test.tsx
@@ -0,0 +1,141 @@
+import { http, HttpResponse } from 'msw';
+import { render, screen } from '@testing-library/react';
+
+import { createMockEnvironment } from '@/react-tools/test-mocks';
+import {
+  Environment,
+  EnvironmentStatus,
+  EnvironmentType,
+} from '@/react/portainer/environments/types';
+import { UserViewModel } from '@/portainer/models/user';
+import { server } from '@/setup-tests/server';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+
+import { EnvironmentCard } from './EnvironmentCard';
+
+function renderCard(env: Environment, groupName?: string, isAdmin = false) {
+  const user = new UserViewModel({ Username: 'test', Role: isAdmin ? 1 : 2 });
+
+  server.use(http.get('/api/tags', () => HttpResponse.json([])));
+
+  const Wrapped = withTestQueryProvider(
+    withTestRouter(withUserProvider(EnvironmentCard, user))
+  );
+
+  return render(
+    <Wrapped environment={env} groupName={groupName} onClickBrowse={() => {}} />
+  );
+}
+
+describe('EnvironmentCard', () => {
+  it('renders the environment name', () => {
+    const env = createMockEnvironment({ Name: 'my-env' });
+    renderCard(env);
+    expect(screen.getByText('my-env')).toBeVisible();
+  });
+
+  it('renders the group name when provided', () => {
+    const env = createMockEnvironment();
+    renderCard(env, 'Production');
+    expect(screen.getByText(/Production/)).toBeVisible();
+  });
+
+  it('shows Unassigned when no group name is provided', () => {
+    const env = createMockEnvironment();
+    renderCard(env);
+    expect(screen.getByText(/Unassigned/)).toBeVisible();
+  });
+
+  describe('Live connect / disconnect', () => {
+    it('does not render a Live connect button', () => {
+      const env = createMockEnvironment();
+      renderCard(env);
+      expect(
+        screen.queryByRole('link', { name: /live connect/i })
+      ).not.toBeInTheDocument();
+    });
+
+    it('does not render a Disconnect button', () => {
+      const env = createMockEnvironment();
+      renderCard(env);
+      expect(
+        screen.queryByRole('button', { name: /disconnect/i })
+      ).not.toBeInTheDocument();
+    });
+  });
+
+  describe('Browse snapshot button', () => {
+    it('is hidden when environment is Up', () => {
+      const env = createMockEnvironment({
+        Type: EnvironmentType.EdgeAgentOnDocker,
+        Status: EnvironmentStatus.Up,
+        Edge: {
+          AsyncMode: true,
+          PingInterval: 0,
+          CommandInterval: 0,
+          SnapshotInterval: 0,
+        },
+        Snapshots: [{ Time: Date.now() / 1000 } as never],
+      });
+      renderCard(env);
+      expect(
+        screen.queryByRole('link', { name: /browse snapshot/i })
+      ).not.toBeInTheDocument();
+    });
+
+    it('is hidden when environment is Down but has no snapshot', () => {
+      const env = createMockEnvironment({
+        Type: EnvironmentType.EdgeAgentOnDocker,
+        Status: EnvironmentStatus.Down,
+        Edge: {
+          AsyncMode: true,
+          PingInterval: 0,
+          CommandInterval: 0,
+          SnapshotInterval: 0,
+        },
+        Snapshots: [],
+      });
+      renderCard(env);
+      expect(
+        screen.queryByRole('link', { name: /browse snapshot/i })
+      ).not.toBeInTheDocument();
+    });
+
+    // TODO: enable when BrowseSnapshotButton is uncommented [C9S-46]
+    it.todo('is visible when environment is Down and has a snapshot', () => {
+      const env = createMockEnvironment({
+        Type: EnvironmentType.EdgeAgentOnDocker,
+        Status: EnvironmentStatus.Down,
+        Edge: {
+          AsyncMode: true,
+          PingInterval: 0,
+          CommandInterval: 0,
+          SnapshotInterval: 0,
+        },
+        Snapshots: [{ Time: Date.now() / 1000 } as never],
+      });
+      renderCard(env);
+      expect(
+        screen.getByRole('link', { name: /browse snapshot/i })
+      ).toBeVisible();
+    });
+  });
+
+  describe('edge environment', () => {
+    it('renders EdgeIndicator for edge environments', () => {
+      const env = createMockEnvironment({
+        Type: EnvironmentType.EdgeAgentOnDocker,
+        Edge: {
+          AsyncMode: false,
+          PingInterval: 0,
+          CommandInterval: 0,
+          SnapshotInterval: 0,
+        },
+      });
+      renderCard(env);
+      expect(screen.getByLabelText('edge-status')).toBeVisible();
+    });
+  });
+});
diff --git a/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentCard.tsx b/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentCard.tsx
new file mode 100644
index 0000000..8631371
--- /dev/null
+++ b/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentCard.tsx
@@ -0,0 +1,137 @@
+import { Clock } from 'lucide-react';
+
+import { isoDateFromTimestamp } from '@/portainer/filters/filters';
+import {
+  type Environment,
+  PlatformType,
+} from '@/react/portainer/environments/types';
+import {
+  getDashboardRoute,
+  getPlatformType,
+  isEdgeEnvironment,
+  isSnapshotBrowsingSupported,
+} from '@/react/portainer/environments/utils';
+import { EnvironmentURL } from '@/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentURL';
+import { EnvironmentGroupName } from '@/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentGroupName';
+import { EnvironmentStats } from '@/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentStats';
+import { AgentDetails } from '@/react/portainer/HomeView/EnvironmentList/EnvironmentItem/AgentDetails';
+import { EnvironmentTypeTag } from '@/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentTypeTag';
+
+import { SnapshotBadge } from '@@/SnapshotBadge';
+import { EdgeIndicator } from '@@/EdgeIndicator';
+import { EnvironmentStatusBadge } from '@@/EnvironmentStatusBadge';
+import { Link } from '@@/Link';
+import { BlocklistItem } from '@@/Blocklist/BlocklistItem';
+
+import { EnvironmentIcon } from './EnvironmentIcon';
+import { EngineVersion } from './EngineVersion';
+import { EditButtons } from './EditButtons';
+
+interface Props {
+  environment: Environment;
+  groupName?: string;
+
+  onClickBrowse(): void;
+}
+
+export function EnvironmentCard({
+  environment,
+  groupName,
+  onClickBrowse,
+}: Props) {
+  const isEdge = isEdgeEnvironment(environment.Type);
+
+  const snapshotTime = getSnapshotTime(environment);
+  const dashboardRoute = getDashboardRoute(environment);
+  const hasDashboardRoute = !!dashboardRoute.to;
+  const showSnapshotButton =
+    isSnapshotBrowsingSupported(environment) &&
+    !environment.Heartbeat &&
+    environment.Snapshots.length > 0;
+
+  return (
+    <div className="relative border-0 border-b border-solid border-gray-5 th-highcontrast:border-white th-dark:border-gray-9">
+      <BlocklistItem
+        as={hasDashboardRoute ? Link : 'button'}
+        className="!m-0 flex flex-wrap gap-4 !border-none !pr-14"
+        onClick={hasDashboardRoute ? onClickBrowse : undefined}
+        aria-disabled={!hasDashboardRoute}
+        to={dashboardRoute.to}
+        params={dashboardRoute.params}
+        data-cy={`environment-card-${environment.Name}`}
+      >
+        <div className="flex min-w-0 flex-1 gap-3">
+          <div className="flex items-center justify-center self-center rounded-lg bg-blue-9/10 p-2 pt-2">
+            <EnvironmentIcon
+              type={environment.Type}
+              containerEngine={environment.ContainerEngine}
+            />
+          </div>
+
+          <div className="flex min-w-0 flex-1 grow flex-col gap-1">
+            {/* First row - title */}
+            <div className="flex items-center gap-2">
+              <span className="break-words text-sm font-bold">
+                {environment.Name}
+              </span>
+              <EnvironmentStatusBadge environment={environment} />
+              {showSnapshotButton && <SnapshotBadge />}
+            </div>
+            {/* Middle row - status info */}
+            <div className="flex items-center gap-2">
+              {isEdge ? (
+                <EdgeIndicator environment={environment} showLastCheckInDate />
+              ) : (
+                <>
+                  {snapshotTime && (
+                    <span
+                      className="small text-muted vertical-center gap-1"
+                      title="Last snapshot time"
+                    >
+                      <Clock className="icon icon-sm" aria-hidden="true" />
+                      {snapshotTime} •
+                    </span>
+                  )}
+                </>
+              )}
+              <EngineVersion environment={environment} />
+              <span className="small text-muted vertical-center">•</span>
+              <EnvironmentURL environment={environment} />
+            </div>
+            <div className="flex items-center gap-2">
+              <EnvironmentGroupName groupName={groupName} />
+              <EnvironmentTypeTag environment={environment} />
+              <AgentDetails environment={environment} />
+            </div>
+          </div>
+        </div>
+        <EnvironmentStats environment={environment} />
+      </BlocklistItem>
+      {/*
+      Buttons are extracted out of the main button because it causes errors with react and accessibility issues
+      see https://stackoverflow.com/questions/66409964/warning-validatedomnesting-a-cannot-appear-as-a-descendant-of-a
+      */}
+      <div className="absolute inset-y-0 right-0 flex w-56 justify-end">
+        <EditButtons environment={environment} />
+      </div>
+    </div>
+  );
+}
+
+function getSnapshotTime(environment: Environment) {
+  const platform = getPlatformType(environment.Type);
+
+  switch (platform) {
+    case PlatformType.Docker:
+      return environment.Snapshots.length > 0
+        ? isoDateFromTimestamp(environment.Snapshots[0].Time)
+        : null;
+    case PlatformType.Kubernetes:
+      return environment.Kubernetes.Snapshots &&
+        environment.Kubernetes.Snapshots.length > 0
+        ? isoDateFromTimestamp(environment.Kubernetes.Snapshots[0].Time)
+        : null;
+    default:
+      return null;
+  }
+}
diff --git a/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentGroupName.test.tsx b/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentGroupName.test.tsx
new file mode 100644
index 0000000..5c6526e
--- /dev/null
+++ b/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentGroupName.test.tsx
@@ -0,0 +1,15 @@
+import { render, screen } from '@testing-library/react';
+
+import { EnvironmentGroupName } from './EnvironmentGroupName';
+
+describe('EnvironmentGroupName', () => {
+  it('renders the provided group name', () => {
+    render(<EnvironmentGroupName groupName="Production" />);
+    expect(screen.getByText(/Production/)).toBeVisible();
+  });
+
+  it('renders Unassigned when no group name is provided', () => {
+    render(<EnvironmentGroupName />);
+    expect(screen.getByText(/Unassigned/)).toBeVisible();
+  });
+});
diff --git a/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentGroupName.tsx b/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentGroupName.tsx
new file mode 100644
index 0000000..aecf12c
--- /dev/null
+++ b/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentGroupName.tsx
@@ -0,0 +1,10 @@
+import { LayoutGrid } from 'lucide-react';
+
+export function EnvironmentGroupName({ groupName }: { groupName?: string }) {
+  return (
+    <span className="small text-muted vertical-center">
+      <LayoutGrid aria-hidden="true" className="icon icon-xs" /> Group:{' '}
+      {groupName || 'Unassigned'}
+    </span>
+  );
+}
diff --git a/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentIcon.tsx b/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentIcon.tsx
new file mode 100644
index 0000000..8580baa
--- /dev/null
+++ b/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentIcon.tsx
@@ -0,0 +1,88 @@
+import { getEnvironmentTypeIcon } from '@/react/portainer/environments/utils';
+import dockerEdge from '@/assets/ico/docker-edge-environment.svg';
+import podmanEdge from '@/assets/ico/podman-edge-environment.svg';
+import kube from '@/assets/images/kubernetes_endpoint.png';
+import kubeEdge from '@/assets/ico/kubernetes-edge-environment.svg';
+import {
+  ContainerEngine,
+  EnvironmentType,
+} from '@/react/portainer/environments/types';
+import azure from '@/assets/ico/vendor/azure.svg';
+import docker from '@/assets/ico/vendor/docker.svg';
+import podman from '@/assets/ico/vendor/podman.svg';
+
+import { Icon } from '@@/Icon';
+
+interface Props {
+  type: EnvironmentType;
+  containerEngine?: ContainerEngine;
+}
+
+export function EnvironmentIcon({ type, containerEngine }: Props) {
+  switch (type) {
+    case EnvironmentType.AgentOnDocker:
+    case EnvironmentType.Docker:
+      if (containerEngine === ContainerEngine.Podman) {
+        return (
+          <img
+            src={podman}
+            width="60"
+            alt="podman environment"
+            aria-hidden="true"
+          />
+        );
+      }
+      return (
+        <img
+          src={docker}
+          width="60"
+          alt="docker environment"
+          aria-hidden="true"
+        />
+      );
+    case EnvironmentType.Azure:
+      return (
+        <img
+          src={azure}
+          width="60"
+          alt="azure environment"
+          aria-hidden="true"
+        />
+      );
+    case EnvironmentType.EdgeAgentOnDocker:
+      if (containerEngine === ContainerEngine.Podman) {
+        return (
+          <img
+            src={podmanEdge}
+            alt="podman edge environment"
+            aria-hidden="true"
+          />
+        );
+      }
+      return (
+        <img
+          src={dockerEdge}
+          alt="docker edge environment"
+          aria-hidden="true"
+        />
+      );
+    case EnvironmentType.KubernetesLocal:
+    case EnvironmentType.AgentOnKubernetes:
+      return <img src={kube} alt="kubernetes environment" aria-hidden="true" />;
+    case EnvironmentType.EdgeAgentOnKubernetes:
+      return (
+        <img
+          src={kubeEdge}
+          alt="kubernetes edge environment"
+          aria-hidden="true"
+        />
+      );
+    default:
+      return (
+        <Icon
+          icon={getEnvironmentTypeIcon(type, containerEngine)}
+          className="blue-icon !h-16 !w-16"
+        />
+      );
+  }
+}
diff --git a/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentItem.stories.tsx b/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentItem.stories.tsx
new file mode 100644
index 0000000..2cf37fb
--- /dev/null
+++ b/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentItem.stories.tsx
@@ -0,0 +1,73 @@
+import { StoryFn } from '@storybook/react-webpack5';
+
+import {
+  Environment,
+  EnvironmentStatus,
+  EnvironmentType,
+} from '@/react/portainer/environments/types';
+import { createMockEnvironment } from '@/react-tools/test-mocks';
+
+import { EnvironmentItem } from './EnvironmentItem';
+
+export default {
+  component: EnvironmentItem,
+  title: 'Components/Home/EnvironmentList/EnvironmentItem',
+};
+
+interface Args {
+  environment: Environment;
+}
+
+function Template({ environment }: Args) {
+  return (
+    <EnvironmentItem
+      environment={environment}
+      onClickBrowse={() => {}}
+      onClickDisconnect={() => {}}
+      isActive={false}
+    />
+  );
+}
+
+export const DockerEnvironment: StoryFn<Args> = Template.bind({});
+DockerEnvironment.args = {
+  environment: mockEnvironment(EnvironmentType.Docker),
+};
+
+export const DockerAgentEnvironment: StoryFn<Args> = Template.bind({});
+DockerAgentEnvironment.args = {
+  environment: mockEnvironment(EnvironmentType.AgentOnDocker),
+};
+
+export const DockerEdgeEnvironment: StoryFn<Args> = Template.bind({});
+DockerEdgeEnvironment.args = {
+  environment: mockEnvironment(EnvironmentType.EdgeAgentOnDocker),
+};
+
+export const AzureEnvironment: StoryFn<Args> = Template.bind({});
+AzureEnvironment.args = {
+  environment: mockEnvironment(EnvironmentType.Azure),
+};
+
+export const KubernetesLocalEnvironment: StoryFn<Args> = Template.bind({});
+KubernetesLocalEnvironment.args = {
+  environment: mockEnvironment(EnvironmentType.KubernetesLocal),
+};
+
+export const KubernetesAgentEnvironment: StoryFn<Args> = Template.bind({});
+KubernetesAgentEnvironment.args = {
+  environment: mockEnvironment(EnvironmentType.AgentOnKubernetes),
+};
+
+export const KubernetesEdgeEnvironment: StoryFn<Args> = Template.bind({});
+KubernetesEdgeEnvironment.args = {
+  environment: mockEnvironment(EnvironmentType.EdgeAgentOnKubernetes),
+};
+
+function mockEnvironment(type: EnvironmentType): Environment {
+  const env = createMockEnvironment();
+  env.Type = type;
+  env.Status = EnvironmentStatus.Up;
+
+  return env;
+}
diff --git a/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentItem.test.tsx b/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentItem.test.tsx
new file mode 100644
index 0000000..19f8770
--- /dev/null
+++ b/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentItem.test.tsx
@@ -0,0 +1,61 @@
+import { http, HttpResponse } from 'msw';
+import { render } from '@testing-library/react';
+
+import {
+  EnvironmentGroupId,
+  Environment,
+} from '@/react/portainer/environments/types';
+import { UserViewModel } from '@/portainer/models/user';
+import { Tag } from '@/portainer/tags/types';
+import { createMockEnvironment } from '@/react-tools/test-mocks';
+import { server } from '@/setup-tests/server';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { EnvironmentGroup } from '@/react/portainer/environments/environment-groups/types';
+
+import { EnvironmentItem } from './EnvironmentItem';
+
+test('loads component', async () => {
+  const env = createMockEnvironment();
+  const { getByText } = renderComponent(env);
+
+  expect(getByText(env.Name)).toBeInTheDocument();
+});
+
+test('shows group name', async () => {
+  const groupName = 'group-name';
+  const groupId: EnvironmentGroupId = 14;
+
+  const env = createMockEnvironment();
+  env.GroupId = groupId;
+
+  const { findByText } = renderComponent(env, { Name: groupName });
+
+  await expect(findByText(groupName)).resolves.toBeVisible();
+});
+
+function renderComponent(
+  env: Environment,
+  group: Partial<EnvironmentGroup> = { Name: 'group' },
+  isAdmin = false,
+  tags: Tag[] = []
+) {
+  const user = new UserViewModel({ Username: 'test', Role: isAdmin ? 1 : 2 });
+
+  server.use(http.get('/api/tags', () => HttpResponse.json(tags)));
+
+  const Wrapped = withTestQueryProvider(
+    withTestRouter(withUserProvider(EnvironmentItem, user))
+  );
+
+  return render(
+    <Wrapped
+      isActive={false}
+      onClickBrowse={() => {}}
+      onClickDisconnect={() => {}}
+      environment={env}
+      groupName={group.Name}
+    />
+  );
+}
diff --git a/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentItem.tsx b/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentItem.tsx
new file mode 100644
index 0000000..cde99fa
--- /dev/null
+++ b/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentItem.tsx
@@ -0,0 +1,181 @@
+import _ from 'lodash';
+import { Tag, Activity } from 'lucide-react';
+import clsx from 'clsx';
+
+import { stripProtocol } from '@/react/common/string-utils';
+import { isoDateFromTimestamp } from '@/portainer/filters/filters';
+import {
+  type Environment,
+  PlatformType,
+} from '@/react/portainer/environments/types';
+import {
+  getDashboardRoute,
+  getPlatformType,
+  isEdgeEnvironment,
+} from '@/react/portainer/environments/utils';
+import type { TagId } from '@/portainer/tags/types';
+import { useTags } from '@/portainer/tags/queries';
+
+import { EdgeIndicator } from '@@/EdgeIndicator';
+import { EnvironmentStatusBadge } from '@@/EnvironmentStatusBadge';
+import { Link } from '@@/Link';
+import { BlocklistItem } from '@@/Blocklist/BlocklistItem';
+
+import { EnvironmentIcon } from './EnvironmentIcon';
+import { EnvironmentStats } from './EnvironmentStats';
+import { EngineVersion } from './EngineVersion';
+import { EnvironmentTypeTag } from './EnvironmentTypeTag';
+import { EnvironmentBrowseButtons } from './EnvironmentBrowseButtons';
+import { EditButtons } from './EditButtons';
+import { AgentDetails } from './AgentDetails';
+
+interface Props {
+  environment: Environment;
+  groupName?: string;
+
+  onClickBrowse(): void;
+
+  onClickDisconnect(): void;
+
+  isActive: boolean;
+}
+
+export function EnvironmentItem({
+  environment,
+  onClickBrowse,
+  onClickDisconnect,
+  groupName,
+  isActive,
+}: Props) {
+  const isEdge = isEdgeEnvironment(environment.Type);
+
+  const snapshotTime = getSnapshotTime(environment);
+
+  const tags = useEnvironmentTagNames(environment.TagIds);
+  const dashboardRoute = getDashboardRoute(environment);
+
+  return (
+    <div className="relative">
+      <BlocklistItem
+        as={dashboardRoute.to ? Link : 'button'}
+        className={clsx('!m-0 min-h-[110px] !pr-56', {
+          'cursor-default': !dashboardRoute.to,
+          'no-link': dashboardRoute.to,
+        })}
+        onClick={onClickBrowse}
+        to={dashboardRoute.to}
+        params={dashboardRoute.params}
+      >
+        <div className="ml-2 flex justify-center self-center">
+          <EnvironmentIcon
+            type={environment.Type}
+            containerEngine={environment.ContainerEngine}
+          />
+        </div>
+        <div className="ml-3 mr-auto flex flex-col items-start justify-center gap-3">
+          <div className="flex flex-wrap items-center gap-x-4 gap-y-2">
+            <span className="font-bold">{environment.Name}</span>
+            {isEdge ? (
+              <EdgeIndicator environment={environment} showLastCheckInDate />
+            ) : (
+              <>
+                <EnvironmentStatusBadge environment={environment} />
+                {snapshotTime && (
+                  <span
+                    className="small text-muted vertical-center gap-1"
+                    title="Last snapshot time"
+                  >
+                    <Activity className="icon icon-sm" aria-hidden="true" />
+                    {snapshotTime}
+                  </span>
+                )}
+              </>
+            )}
+            <EngineVersion environment={environment} />
+            {!isEdge && (
+              <span className="text-muted small vertical-center">
+                {stripProtocol(environment.URL)}
+              </span>
+            )}
+          </div>
+          <div className="small text-muted flex flex-wrap items-center gap-x-4 gap-y-2">
+            {groupName && (
+              <span className="font-semibold">
+                <span>Group: </span>
+                <span>{groupName}</span>
+              </span>
+            )}
+            <span className="vertical-center gap-1">
+              <Tag className="icon icon-sm" aria-hidden="true" />
+              {tags}
+            </span>
+            <EnvironmentTypeTag environment={environment} />
+            <AgentDetails environment={environment} />
+          </div>
+          <EnvironmentStats environment={environment} />
+        </div>
+      </BlocklistItem>
+      {/*
+      Buttons are extracted out of the main button because it causes errors with react and accessibility issues
+      see https://stackoverflow.com/questions/66409964/warning-validatedomnesting-a-cannot-appear-as-a-descendant-of-a
+      */}
+      <div className="absolute inset-y-0 right-0 flex w-56 justify-end">
+        <div className="flex flex-1 items-center py-3">
+          <EnvironmentBrowseButtons
+            environment={environment}
+            onClickBrowse={onClickBrowse}
+            onClickDisconnect={onClickDisconnect}
+            isActive={isActive}
+          />
+        </div>
+        <EditButtons environment={environment} />
+      </div>
+    </div>
+  );
+}
+
+function useEnvironmentTagNames(tagIds?: TagId[]) {
+  const tagsQuery = useTags({
+    select: (tags) => {
+      if (!tagIds) {
+        return [];
+      }
+      return _.compact(
+        tagIds
+          .map((id) => tags.find((tag) => tag.ID === id))
+          .map((tag) => tag?.Name)
+      );
+    },
+    enabled: !!tagIds && tagIds.length > 0,
+  });
+
+  const { data: tags, isLoading } = tagsQuery;
+
+  if (tags && tags.length > 0) {
+    return tags.join(', ');
+  }
+
+  if (isLoading) {
+    return 'Loading tags...';
+  }
+
+  return 'No tags';
+}
+
+function getSnapshotTime(environment: Environment) {
+  const platform = getPlatformType(environment.Type);
+
+  switch (platform) {
+    case PlatformType.Docker:
+      return environment.Snapshots.length > 0
+        ? isoDateFromTimestamp(environment.Snapshots[0].Time)
+        : null;
+    case PlatformType.Kubernetes:
+      return environment.Kubernetes.Snapshots &&
+        environment.Kubernetes.Snapshots.length > 0
+        ? isoDateFromTimestamp(environment.Kubernetes.Snapshots[0].Time)
+        : null;
+    default:
+      return null;
+  }
+}
diff --git a/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentStats.tsx b/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentStats.tsx
new file mode 100644
index 0000000..b3ad7f2
--- /dev/null
+++ b/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentStats.tsx
@@ -0,0 +1,39 @@
+import {
+  Environment,
+  PlatformType,
+} from '@/react/portainer/environments/types';
+import { getPlatformType } from '@/react/portainer/environments/utils';
+
+import { EnvironmentStatsDocker } from './EnvironmentStatsDocker';
+import { EnvironmentStatsKubernetes } from './EnvironmentStatsKubernetes';
+
+interface Props {
+  environment: Environment;
+}
+
+export function EnvironmentStats({ environment }: Props) {
+  const platform = getPlatformType(environment.Type);
+
+  const component = getComponent(platform, environment);
+
+  return (
+    <span className="blocklist-item-desc flex flex-wrap items-center gap-x-10 gap-y-2">
+      {component}
+    </span>
+  );
+}
+
+function getComponent(platform: PlatformType, environment: Environment) {
+  switch (platform) {
+    case PlatformType.Kubernetes:
+      return (
+        <EnvironmentStatsKubernetes
+          snapshot={environment.Kubernetes.Snapshots?.[0]}
+        />
+      );
+    case PlatformType.Docker:
+      return <EnvironmentStatsDocker snapshot={environment.Snapshots?.[0]} />;
+    default:
+      return null;
+  }
+}
diff --git a/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentStatsDocker.tsx b/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentStatsDocker.tsx
new file mode 100644
index 0000000..9c6314b
--- /dev/null
+++ b/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentStatsDocker.tsx
@@ -0,0 +1,30 @@
+import { DockerSnapshot } from '@/react/docker/snapshots/types';
+import { humanize } from '@/portainer/filters/filters';
+
+import { ContainerStats, CPUStats, MemoryStats, NodeStats } from '@@/StatsItem';
+
+interface Props {
+  snapshot?: DockerSnapshot;
+}
+
+export function EnvironmentStatsDocker({ snapshot }: Props) {
+  if (!snapshot) {
+    return <>No snapshot available</>;
+  }
+
+  return (
+    <>
+      <ContainerStats
+        total={snapshot.ContainerCount}
+        running={snapshot.RunningContainerCount}
+        stopped={snapshot.StoppedContainerCount}
+      />
+
+      <NodeStats value={snapshot.NodeCount} />
+
+      <CPUStats value={snapshot.TotalCPU} />
+
+      <MemoryStats value={humanize(snapshot.TotalMemory)} />
+    </>
+  );
+}
diff --git a/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentStatsKubernetes.tsx b/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentStatsKubernetes.tsx
new file mode 100644
index 0000000..855c94f
--- /dev/null
+++ b/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentStatsKubernetes.tsx
@@ -0,0 +1,31 @@
+import { KubernetesSnapshot } from '@/react/portainer/environments/types';
+import { humanize } from '@/portainer/filters/filters';
+
+import { CPUStats, GpuStats, MemoryStats, NodeStats } from '@@/StatsItem';
+
+interface Props {
+  snapshot?: KubernetesSnapshot;
+}
+
+export function EnvironmentStatsKubernetes({ snapshot }: Props) {
+  if (!snapshot) {
+    return <>No snapshot available</>;
+  }
+
+  const totalGpuCount = Object.values(snapshot.TotalGPU ?? {}).reduce(
+    (sum, v) => sum + v,
+    0
+  );
+
+  return (
+    <>
+      {totalGpuCount > 0 && <GpuStats value={totalGpuCount} />}
+
+      <NodeStats value={snapshot.NodeCount} />
+
+      <CPUStats value={snapshot.TotalCPU} />
+
+      <MemoryStats value={humanize(snapshot.TotalMemory)} />
+    </>
+  );
+}
diff --git a/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentTypeTag.tsx b/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentTypeTag.tsx
new file mode 100644
index 0000000..79c8ecc
--- /dev/null
+++ b/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentTypeTag.tsx
@@ -0,0 +1,51 @@
+import {
+  Environment,
+  EnvironmentType,
+} from '@/react/portainer/environments/types';
+import {
+  isEdgeEnvironment,
+  isLocalEnvironment,
+  isAgentEnvironment,
+} from '@/react/portainer/environments/utils';
+
+export function EnvironmentTypeTag({
+  environment,
+}: {
+  environment: Environment;
+}) {
+  const typeLabel = getTypeLabel(environment);
+
+  if (!typeLabel) {
+    return null;
+  }
+
+  return (
+    <span className="vertical-center gap-1">
+      <span className="small text-muted vertical-center font-medium">
+        {typeLabel}
+      </span>
+    </span>
+  );
+}
+
+function getTypeLabel(environment: Environment) {
+  if (isEdgeEnvironment(environment.Type)) {
+    return environment.Edge.AsyncMode
+      ? 'Edge Agent Async'
+      : 'Edge Agent Standard';
+  }
+
+  if (isLocalEnvironment(environment)) {
+    return 'Local';
+  }
+
+  if (environment.Type === EnvironmentType.Azure) {
+    return 'ACI';
+  }
+
+  if (isAgentEnvironment(environment.Type)) {
+    return 'Agent';
+  }
+
+  return '';
+}
diff --git a/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentURL.test.tsx b/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentURL.test.tsx
new file mode 100644
index 0000000..45907b6
--- /dev/null
+++ b/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentURL.test.tsx
@@ -0,0 +1,32 @@
+import { render, screen } from '@testing-library/react';
+
+import { createMockEnvironment } from '@/react-tools/test-mocks';
+import { EnvironmentType } from '@/react/portainer/environments/types';
+
+import { EnvironmentURL } from './EnvironmentURL';
+
+describe('EnvironmentURL', () => {
+  it('renders the environment URL for non-edge environments', () => {
+    const env = createMockEnvironment({ URL: 'tcp://192.168.1.100:2376' });
+    render(<EnvironmentURL environment={env} />);
+    expect(screen.getByText('tcp://192.168.1.100:2376')).toBeVisible();
+  });
+
+  it('renders nothing for EdgeAgentOnDocker environments', () => {
+    const env = createMockEnvironment({
+      Type: EnvironmentType.EdgeAgentOnDocker,
+      URL: 'tcp://192.168.1.100:2376',
+    });
+    const { container } = render(<EnvironmentURL environment={env} />);
+    expect(container).toBeEmptyDOMElement();
+  });
+
+  it('renders nothing for EdgeAgentOnKubernetes environments', () => {
+    const env = createMockEnvironment({
+      Type: EnvironmentType.EdgeAgentOnKubernetes,
+      URL: 'tcp://192.168.1.100:2376',
+    });
+    const { container } = render(<EnvironmentURL environment={env} />);
+    expect(container).toBeEmptyDOMElement();
+  });
+});
diff --git a/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentURL.tsx b/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentURL.tsx
new file mode 100644
index 0000000..7be69c1
--- /dev/null
+++ b/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentURL.tsx
@@ -0,0 +1,12 @@
+import type { Environment } from '@/react/portainer/environments/types';
+import { isEdgeEnvironment } from '@/react/portainer/environments/utils';
+
+export function EnvironmentURL({ environment }: { environment: Environment }) {
+  if (isEdgeEnvironment(environment.Type)) {
+    return null;
+  }
+
+  return (
+    <span className="small text-muted vertical-center">{environment.URL}</span>
+  );
+}
diff --git a/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/index.ts b/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/index.ts
new file mode 100644
index 0000000..86e32a5
--- /dev/null
+++ b/app/react/portainer/HomeView/EnvironmentList/EnvironmentItem/index.ts
@@ -0,0 +1 @@
+export { EnvironmentItem } from './EnvironmentItem';
diff --git a/app/react/portainer/HomeView/EnvironmentList/EnvironmentList.module.css b/app/react/portainer/HomeView/EnvironmentList/EnvironmentList.module.css
new file mode 100644
index 0000000..c023629
--- /dev/null
+++ b/app/react/portainer/HomeView/EnvironmentList/EnvironmentList.module.css
@@ -0,0 +1,74 @@
+.actionBar {
+  margin-left: 15px !important;
+  margin-right: 15px !important;
+}
+
+.actionBar .description {
+  margin-bottom: 10px;
+}
+
+.refresh-environments-button {
+  margin-left: 0 !important;
+}
+
+.filter-container {
+  display: flex;
+  justify-content: flex-start;
+  padding: 0px 5px;
+}
+
+.filter-container input[type='text'] {
+  background: none !important;
+  border: 0px !important;
+}
+
+.filter-left {
+  width: 15%;
+}
+
+.filter-right {
+  width: 20%;
+  margin-left: auto;
+}
+
+.filter-button {
+  margin-left: 10px;
+  padding: 10px 0px;
+  width: 5%;
+  display: inline-block;
+}
+
+.clear-button {
+  white-space: nowrap;
+
+  border: 0px;
+
+  background: transparent;
+  margin: 0;
+}
+
+.action-button {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+}
+
+.refresh-button {
+  display: inline-block;
+  width: fit-content;
+}
+
+.kubeconfig-button {
+  display: inline-block;
+  width: fit-content;
+}
+
+.filterSearchbar {
+  display: inline-block;
+  width: 100%;
+}
+
+.filterSearchbar input[type='text'] {
+  background: none !important;
+  border: 0px !important;
+}
diff --git a/app/react/portainer/HomeView/EnvironmentList/EnvironmentList.test.tsx b/app/react/portainer/HomeView/EnvironmentList/EnvironmentList.test.tsx
new file mode 100644
index 0000000..af5141d
--- /dev/null
+++ b/app/react/portainer/HomeView/EnvironmentList/EnvironmentList.test.tsx
@@ -0,0 +1,533 @@
+import { useState, useEffect } from 'react';
+import { http, HttpResponse } from 'msw';
+import type { HttpHandler } from 'msw';
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+
+import {
+  EnvironmentStatus,
+  EnvironmentType,
+  PlatformType,
+  Environment,
+} from '@/react/portainer/environments/types';
+import { UserViewModel } from '@/portainer/models/user';
+import { server } from '@/setup-tests/server';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { createMockEnvironment } from '@/react-tools/test-mocks';
+
+import { EnvironmentList } from './EnvironmentList';
+
+function getArrayParam(params: URLSearchParams, key: string): number[] {
+  return params.get(key)?.split(',').filter(Boolean).map(Number) ?? [];
+}
+
+// vi.hoisted ensures these are initialized before the vi.mock factory runs.
+// The store is reactive: stateService.go updates it and notifies React subscribers.
+const { mockUrlParamsStore, mockStateServiceGo } = vi.hoisted(() => {
+  let snapshot: Record<string, unknown> = {};
+  const listeners = new Set<() => void>();
+
+  function notify() {
+    listeners.forEach((l) => l());
+  }
+
+  return {
+    mockUrlParamsStore: {
+      subscribe: (listener: () => void) => {
+        listeners.add(listener);
+        return () => {
+          listeners.delete(listener);
+        };
+      },
+      getSnapshot: () => snapshot,
+      set: (params: Record<string, unknown>) => {
+        snapshot = { ...params };
+        notify();
+      },
+      reset: () => {
+        snapshot = {};
+        notify();
+      },
+    },
+    mockStateServiceGo: vi.fn(
+      (_route: string, params: Record<string, unknown>) => {
+        snapshot = { ...snapshot, ...params };
+        notify();
+      }
+    ),
+  };
+});
+
+vi.mock('@uirouter/react', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@uirouter/react')>();
+  return {
+    ...actual,
+    useCurrentStateAndParams: () => {
+      const [params, setParams] = useState(() =>
+        mockUrlParamsStore.getSnapshot()
+      );
+      useEffect(
+        () =>
+          mockUrlParamsStore.subscribe(() => {
+            setParams(mockUrlParamsStore.getSnapshot());
+          }),
+        []
+      );
+      return { params, state: {} };
+    },
+    useRouter: vi.fn(() => ({ stateService: { go: mockStateServiceGo } })),
+  };
+});
+
+beforeEach(() => {
+  sessionStorage.clear();
+  localStorage.clear();
+  mockUrlParamsStore.reset();
+  mockStateServiceGo.mockClear();
+});
+
+vi.mock('@reach/menu-button');
+
+test('when no environments for query should show empty list message', async () => {
+  const { findByText } = await renderComponent(false, []);
+
+  await expect(findByText('No environments available.')).resolves.toBeVisible();
+});
+
+test('when user is not admin and no environments at all should show empty list info message', async () => {
+  const { findByText } = await renderComponent(false, []);
+
+  await expect(
+    findByText(
+      'You do not have access to any environment. Please contact your administrator.'
+    )
+  ).resolves.toBeVisible();
+});
+
+test('when user is an admin and no environments at all should show empty list info message', async () => {
+  const { findByText } = await renderComponent(true);
+
+  await expect(
+    findByText(/No environment available for management. Please head over the/)
+  ).resolves.toBeVisible();
+});
+
+test('renders environments returned by the API', async () => {
+  const environments = [
+    createMockEnvironment({ Id: 1, Name: 'prod-cluster', GroupId: 1 }),
+    createMockEnvironment({ Id: 2, Name: 'staging-cluster', GroupId: 1 }),
+  ];
+  const { findByText } = await renderComponent(false, environments);
+
+  await expect(findByText('prod-cluster')).resolves.toBeVisible();
+  await expect(findByText('staging-cluster')).resolves.toBeVisible();
+});
+
+test('sort buttons are rendered for each sort option', async () => {
+  const { findByRole } = await renderComponent(false, []);
+
+  await expect(findByRole('button', { name: /Group/i })).resolves.toBeVisible();
+  await expect(
+    screen.findByRole('button', { name: /Platform/i })
+  ).resolves.toBeVisible();
+  await expect(
+    screen.findByRole('button', { name: /Health/i })
+  ).resolves.toBeVisible();
+});
+
+test('clicking inactive sort button switches active sort', async () => {
+  const user = userEvent.setup();
+  await renderComponent(false, []);
+
+  const platformBtn = await screen.findByRole('button', { name: /Platform/i });
+  await user.click(platformBtn);
+
+  expect(screen.getByRole('menu')).toBeVisible();
+});
+
+test('Platform filter groups Docker, AgentOnDocker, and EdgeAgentOnDocker together', async () => {
+  const user = userEvent.setup();
+  const allEnvironments = [
+    createMockEnvironment({
+      Id: 1,
+      Name: 'docker-direct',
+      Type: EnvironmentType.Docker,
+    }),
+    createMockEnvironment({
+      Id: 2,
+      Name: 'docker-agent',
+      Type: EnvironmentType.AgentOnDocker,
+    }),
+    createMockEnvironment({
+      Id: 3,
+      Name: 'kube-local',
+      Type: EnvironmentType.KubernetesLocal,
+    }),
+  ];
+
+  await renderComponent(false, allEnvironments, [
+    http.get('/api/endpoints/summary', () =>
+      HttpResponse.json({
+        total: 3,
+        up: 3,
+        down: 0,
+        outdated: 0,
+        unassigned: 0,
+        byGroup: [],
+        byPlatformType: { docker: 2, kubernetes: 1, podman: 0, azure: 0 },
+        byHealth: { down: 0, up: 0, outdated: 0, heartbeat: 0 },
+      })
+    ),
+    http.get('/api/endpoints', ({ request }) => {
+      const platformTypes = getArrayParam(
+        new URL(request.url).searchParams,
+        'platformTypes'
+      );
+      const envTypesByPlatform: Partial<Record<PlatformType, number[]>> = {
+        [PlatformType.Docker]: [
+          EnvironmentType.Docker,
+          EnvironmentType.AgentOnDocker,
+          EnvironmentType.EdgeAgentOnDocker,
+        ],
+        [PlatformType.Kubernetes]: [
+          EnvironmentType.KubernetesLocal,
+          EnvironmentType.AgentOnKubernetes,
+          EnvironmentType.EdgeAgentOnKubernetes,
+        ],
+        [PlatformType.Podman]: [
+          EnvironmentType.Docker,
+          EnvironmentType.AgentOnDocker,
+          EnvironmentType.EdgeAgentOnDocker,
+        ],
+        [PlatformType.Azure]: [EnvironmentType.Azure],
+      };
+      const allowedTypes = platformTypes.flatMap(
+        (pt) => envTypesByPlatform[pt as PlatformType] ?? []
+      );
+      const filtered = allowedTypes.length
+        ? allEnvironments.filter((e) => allowedTypes.includes(e.Type))
+        : allEnvironments;
+      return HttpResponse.json(filtered, {
+        headers: {
+          'x-total-available': filtered.length.toString(),
+          'x-total-count': filtered.length.toString(),
+        },
+      });
+    }),
+  ]);
+
+  const platformBtn = await screen.findByRole('button', { name: /Platform/i });
+  await user.click(platformBtn);
+  await user.click(await screen.findByRole('menuitem', { name: /Docker/ }));
+
+  await waitFor(() => {
+    expect(screen.getByText('docker-direct')).toBeVisible();
+    expect(screen.getByText('docker-agent')).toBeVisible();
+    expect(screen.queryByText('kube-local')).not.toBeInTheDocument();
+  });
+});
+
+test('Health filter shows only environments matching the selected status', async () => {
+  const user = userEvent.setup();
+  const allEnvironments = [
+    createMockEnvironment({
+      Id: 1,
+      Name: 'env-up',
+      Status: EnvironmentStatus.Up,
+    }),
+    createMockEnvironment({
+      Id: 2,
+      Name: 'env-down',
+      Status: EnvironmentStatus.Down,
+    }),
+  ];
+
+  await renderComponent(false, allEnvironments, [
+    http.get('/api/endpoints/summary', () =>
+      HttpResponse.json({
+        total: 2,
+        up: 1,
+        down: 1,
+        outdated: 0,
+        unassigned: 0,
+        byGroup: [],
+        byPlatformType: { docker: 0, kubernetes: 0, podman: 0, azure: 0 },
+        byHealth: { down: 1, up: 1, outdated: 0, heartbeat: 0 },
+      })
+    ),
+    http.get('/api/endpoints', ({ request }) => {
+      const statuses = getArrayParam(
+        new URL(request.url).searchParams,
+        'status'
+      );
+      const filtered = statuses.length
+        ? allEnvironments.filter((e) => statuses.includes(e.Status))
+        : allEnvironments;
+      return HttpResponse.json(filtered, {
+        headers: {
+          'x-total-available': filtered.length.toString(),
+          'x-total-count': filtered.length.toString(),
+        },
+      });
+    }),
+  ]);
+
+  const healthBtn = await screen.findByRole('button', { name: /Health/i });
+  await user.click(healthBtn);
+  await user.click(await screen.findByRole('menuitem', { name: /^Up/ }));
+
+  await waitFor(() => {
+    expect(screen.getByText('env-up')).toBeVisible();
+    expect(screen.queryByText('env-down')).not.toBeInTheDocument();
+  });
+});
+
+test('Heartbeat filter shows only edge envs with an active heartbeat', async () => {
+  const user = userEvent.setup();
+  const allEnvironments = [
+    createMockEnvironment({
+      Id: 1,
+      Name: 'edge-heartbeat',
+      Type: EnvironmentType.EdgeAgentOnDocker,
+      Status: EnvironmentStatus.Up,
+      Heartbeat: true,
+    }),
+    createMockEnvironment({
+      Id: 2,
+      Name: 'docker-up',
+      Type: EnvironmentType.Docker,
+      Status: EnvironmentStatus.Up,
+    }),
+  ];
+
+  await renderComponent(false, allEnvironments, [
+    http.get('/api/endpoints/summary', () =>
+      HttpResponse.json({
+        total: 2,
+        up: 2,
+        down: 0,
+        outdated: 0,
+        unassigned: 0,
+        byGroup: [],
+        byPlatformType: { docker: 1, kubernetes: 0, podman: 0, azure: 0 },
+        byHealth: { down: 0, up: 1, outdated: 0, heartbeat: 1 },
+      })
+    ),
+    http.get('/api/endpoints', ({ request }) => {
+      const params = new URL(request.url).searchParams;
+      const types = getArrayParam(params, 'types');
+      const statuses = getArrayParam(params, 'status');
+
+      let filtered = allEnvironments;
+      if (types.length > 0) {
+        filtered = filtered.filter((e) => types.includes(e.Type));
+      }
+      if (statuses.length > 0) {
+        filtered = filtered.filter((e) => statuses.includes(e.Status));
+      }
+
+      return HttpResponse.json(filtered, {
+        headers: {
+          'x-total-available': filtered.length.toString(),
+          'x-total-count': filtered.length.toString(),
+        },
+      });
+    }),
+  ]);
+
+  const healthBtn = await screen.findByRole('button', { name: /Health/i });
+  await user.click(healthBtn);
+  await user.click(await screen.findByRole('menuitem', { name: /Heartbeat/i }));
+
+  await waitFor(() => {
+    expect(screen.getByText('edge-heartbeat')).toBeVisible();
+    expect(screen.queryByText('docker-up')).not.toBeInTheDocument();
+  });
+});
+
+// --- URL parameter tests ---
+
+test('URL param groupBy=health applies Health sort to API request', async () => {
+  let capturedParams: URLSearchParams | null = null;
+
+  mockUrlParamsStore.set({ groupBy: 'health' });
+
+  await renderComponent(
+    false,
+    [],
+    [
+      http.get('/api/endpoints', ({ request }) => {
+        capturedParams = new URL(request.url).searchParams;
+        return HttpResponse.json([], {
+          headers: { 'x-total-available': '0', 'x-total-count': '0' },
+        });
+      }),
+    ]
+  );
+
+  await waitFor(() => {
+    expect(capturedParams?.get('sort')).toBe('Health');
+  });
+});
+
+test('URL param groupBy=health&groupFilter=up activates Up status filter in API request', async () => {
+  let capturedParams: URLSearchParams | null = null;
+
+  mockUrlParamsStore.set({ groupBy: 'health', groupFilter: 'Up' });
+
+  await renderComponent(
+    false,
+    [],
+    [
+      http.get('/api/endpoints', ({ request }) => {
+        capturedParams = new URL(request.url).searchParams;
+        return HttpResponse.json([], {
+          headers: { 'x-total-available': '0', 'x-total-count': '0' },
+        });
+      }),
+    ]
+  );
+
+  await waitFor(() => {
+    // EnvironmentStatus.Up = 1
+    expect(capturedParams?.get('status')).toBe('1');
+  });
+});
+
+test('URL param groupBy=platform&groupFilter=docker activates Docker platform filter in API request', async () => {
+  let capturedParams: URLSearchParams | null = null;
+
+  mockUrlParamsStore.set({ groupBy: 'platformtype', groupFilter: 'Docker' });
+
+  await renderComponent(
+    false,
+    [],
+    [
+      http.get('/api/endpoints', ({ request }) => {
+        capturedParams = new URL(request.url).searchParams;
+        return HttpResponse.json([], {
+          headers: { 'x-total-available': '0', 'x-total-count': '0' },
+        });
+      }),
+    ]
+  );
+
+  await waitFor(() => {
+    // PlatformType.Docker = 0
+    expect(capturedParams?.get('platformTypes')).toBe('0');
+  });
+});
+
+test('URL param groupFilter without groupBy is ignored (default Id sort used)', async () => {
+  let capturedParams: URLSearchParams | null = null;
+
+  // groupFilter present but no groupBy — the component should bail out early
+  mockUrlParamsStore.set({ groupFilter: 'up' });
+
+  await renderComponent(
+    false,
+    [],
+    [
+      http.get('/api/endpoints', ({ request }) => {
+        capturedParams = new URL(request.url).searchParams;
+        return HttpResponse.json([], {
+          headers: { 'x-total-available': '0', 'x-total-count': '0' },
+        });
+      }),
+    ]
+  );
+
+  // status[] should not be sent; sort defaults to Id (the Age sort key)
+  await waitFor(() => {
+    expect(capturedParams).not.toBeNull();
+  });
+  expect(capturedParams!.get('status')).toBeNull();
+  expect(capturedParams!.get('sort')).toBe('Id');
+});
+
+test('selecting a sort/filter updates URL via stateService.go', async () => {
+  const user = userEvent.setup();
+
+  await renderComponent(
+    false,
+    [],
+    [
+      http.get('/api/endpoints/summary', () =>
+        HttpResponse.json({
+          total: 1,
+          up: 1,
+          down: 0,
+          outdated: 0,
+          unassigned: 0,
+          byGroup: [],
+          byPlatformType: { docker: 1, kubernetes: 0, podman: 0, azure: 0 },
+          byHealth: { down: 0, up: 1, outdated: 0, heartbeat: 0 },
+        })
+      ),
+    ]
+  );
+
+  const healthBtn = await screen.findByRole('button', { name: /Health/i });
+  await user.click(healthBtn);
+  await user.click(await screen.findByRole('menuitem', { name: /^Up/ }));
+
+  await waitFor(() => {
+    expect(mockStateServiceGo).toHaveBeenCalledWith(
+      '.',
+      expect.objectContaining({ groupBy: 'Health', groupFilter: 'Up' }),
+      { reload: false, location: 'replace' }
+    );
+  });
+});
+
+/**
+ * Renders the EnvironmentList component with MSW handler overrides.
+ *
+ * @param isAdmin - Whether to render as an admin user (Role 1) or non-admin (Role 2).
+ * @param environments - Environments returned by the default /api/endpoints handler.
+ * @param extraHandlers - Handlers prepended before the default endpoint/summary
+ *   handlers, giving them priority for tests that need custom behaviour.
+ */
+async function renderComponent(
+  isAdmin = false,
+  environments: Environment[] = [],
+  extraHandlers: HttpHandler[] = []
+) {
+  const user = new UserViewModel({ Username: 'test', Role: isAdmin ? 1 : 2 });
+
+  server.use(
+    ...extraHandlers,
+    http.get('/api/endpoints', () =>
+      HttpResponse.json(environments, {
+        headers: {
+          'x-total-available': environments.length.toString(),
+          'x-total-count': environments.length.toString(),
+        },
+      })
+    ),
+    http.get('/api/endpoints/summary', () =>
+      HttpResponse.json({
+        total: environments.length,
+        up: 0,
+        down: 0,
+        outdated: 0,
+        unassigned: 0,
+        byGroup: [],
+        byPlatformType: { docker: 0, kubernetes: 0, podman: 0, azure: 0 },
+        byHealth: { down: 0, up: 0, outdated: 0, heartbeat: 0 },
+      })
+    )
+  );
+
+  const Wrapped = withTestQueryProvider(
+    withUserProvider(withTestRouter(EnvironmentList), user)
+  );
+
+  const queries = render(<Wrapped onClickBrowse={vi.fn()} />);
+
+  await queries.findByText('SORT BY:');
+
+  return queries;
+}
diff --git a/app/react/portainer/HomeView/EnvironmentList/EnvironmentList.tsx b/app/react/portainer/HomeView/EnvironmentList/EnvironmentList.tsx
new file mode 100644
index 0000000..c3a091a
--- /dev/null
+++ b/app/react/portainer/HomeView/EnvironmentList/EnvironmentList.tsx
@@ -0,0 +1,296 @@
+import React, { ReactNode, useMemo } from 'react';
+
+import {
+  Environment,
+  EnvironmentStatus,
+  PlatformType,
+  EnvironmentHealth,
+} from '@/react/portainer/environments/types';
+import {
+  refetchIfAnyOffline,
+  SortType,
+  useEnvironmentList,
+} from '@/react/portainer/environments/queries/useEnvironmentList';
+import { useGroups } from '@/react/portainer/environments/environment-groups/queries';
+import { EnvironmentsQueryParams } from '@/react/portainer/environments/environment.service';
+import { useIsPureAdmin } from '@/react/hooks/useUser';
+import {
+  getPlatformType,
+  isEdgeEnvironment,
+} from '@/react/portainer/environments/utils';
+import { useEnvironmentSummaryCounts } from '@/react/portainer/environments/queries/useEnvironmentSummaryCounts';
+import { useParseSortGroupApiParams } from '@/react/portainer/environments/queries/useParseApiSortParams';
+import { useBaseApiQueryParams } from '@/react/portainer/environments/queries/useBaseApiQueryParams';
+import { useAvailableSortGroups } from '@/react/portainer/environments/queries/useAvailableSortGroups';
+import { getPlatformIconByPlatform } from '@/react/portainer/environments/utils/get-platform-icon';
+import { getHealthIcon } from '@/react/portainer/environments/utils/get-health-icon';
+import { getGroupIcon } from '@/react/portainer/environments/utils/get-group-icon';
+import { UpdateBadge } from '@/react/portainer/HomeView/EnvironmentList/UpdateBadge';
+import { KubeconfigButton } from '@/react/portainer/HomeView/EnvironmentList/KubeconfigButton';
+import { EnvironmentCard } from '@/react/portainer/HomeView/EnvironmentList/EnvironmentItem/EnvironmentCard';
+
+import { DropdownOption } from '@@/DropdownMenu/DropdownMenu';
+import {
+  SortableGroup,
+  SortableList,
+  SortOption,
+} from '@@/SortableList/SortableList';
+
+import { useHomeViewState } from '../useHomeViewState';
+
+import { NoEnvironmentsInfoPanel } from './NoEnvironmentsInfoPanel';
+
+interface Props {
+  onClickBrowse(environment: Environment): void;
+}
+
+const SORT_OPTIONS: SortOption<SortType>[] = [
+  {
+    key: 'Id',
+    label: 'Age',
+    descendingLabel: 'Newest',
+    ascendingLabel: 'Oldest',
+  },
+  { key: 'Group', label: 'Group', grouped: true },
+  { key: 'PlatformType', label: 'Platform', grouped: true },
+  { key: 'Health', label: 'Health', grouped: true },
+];
+
+const platformDetails: Record<
+  string,
+  { type: PlatformType; description: string }
+> = {
+  Docker: {
+    type: PlatformType.Docker,
+    description: 'Docker hosts and Swarm clusters',
+  },
+  Kubernetes: {
+    type: PlatformType.Kubernetes,
+    description: 'Kubernetes clusters and nodes',
+  },
+  Azure: { type: PlatformType.Azure, description: 'Azure Container Instances' },
+  Podman: { type: PlatformType.Podman, description: 'Podman Containers' },
+};
+
+const healthDetails: Record<
+  string,
+  { type: EnvironmentHealth; description: string }
+> = {
+  Up: {
+    type: EnvironmentHealth.Up,
+    description: 'Environments online and up-to-date',
+  },
+  Down: {
+    type: EnvironmentHealth.Down,
+    description: 'Environments currently offline or unreachable',
+  },
+  Outdated: {
+    type: EnvironmentHealth.Outdated,
+    description: 'Environments with agents that can be upgraded',
+  },
+  Heartbeat: {
+    type: EnvironmentHealth.Heartbeat,
+    description: 'Edge environments with active heartbeat',
+  },
+};
+
+const GROUP_FIELD: Partial<Record<SortType, (item: EnvironmentRow) => string>> =
+  {
+    Group: (item) => item.GroupId.toString(),
+    PlatformType: (item) => item.platformName,
+    Health: (item) => item.healthLabel,
+  };
+
+export function EnvironmentList({ onClickBrowse }: Props) {
+  const isPureAdmin = useIsPureAdmin();
+  const summaryQuery = useEnvironmentSummaryCounts();
+
+  const tableState = useHomeViewState();
+
+  const groupsQuery = useGroups();
+
+  const groupDetails = useMemo(
+    () =>
+      Object.fromEntries(
+        (groupsQuery.data ?? []).map((group) => [
+          group.Id.toString(),
+          { name: group.Name, description: group.Description },
+        ])
+      ),
+    [groupsQuery.data]
+  );
+
+  const baseQueryParams: EnvironmentsQueryParams = useBaseApiQueryParams(
+    tableState.search
+  );
+
+  const sortGroupApiParams = useParseSortGroupApiParams(
+    tableState.groupFilter,
+    tableState.groupKey,
+    groupsQuery.data
+  );
+
+  const listQueryParams: EnvironmentsQueryParams = useMemo(
+    () => ({ ...baseQueryParams, ...sortGroupApiParams }),
+    [baseQueryParams, sortGroupApiParams]
+  );
+
+  const availableGroupsBySort = useAvailableSortGroups(summaryQuery.data);
+
+  const sortOrder = tableState.sortBy?.desc ? 'desc' : 'asc';
+
+  const { isLoading, environments, totalCount, updateAvailable } =
+    useEnvironmentList(
+      {
+        page: tableState.page + 1,
+        pageLimit: tableState.pageSize,
+        sort: tableState.groupKey,
+        order: sortOrder,
+        ...listQueryParams,
+      },
+      { refetchInterval: refetchIfAnyOffline }
+    );
+
+  const environmentRows = useMemo<EnvironmentRow[]>(() => {
+    return environments.map((env) => ({
+      ...env,
+      groupName: groupDetails[env.GroupId.toString()]?.name ?? 'Unassigned',
+      platformName:
+        PlatformType[getPlatformType(env.Type, env.ContainerEngine)],
+      healthLabel: getHealthLabel(env, tableState.groupFilter),
+    }));
+  }, [environments, groupDetails, tableState.groupFilter]);
+
+  const environmentGroups = useMemo(
+    () =>
+      buildGroups(
+        environmentRows,
+        tableState.groupKey,
+        availableGroupsBySort,
+        groupDetails
+      ),
+    [environmentRows, tableState.groupKey, availableGroupsBySort, groupDetails]
+  );
+
+  const headerButtons = [
+    updateAvailable && <UpdateBadge key="update-badge" />,
+    <KubeconfigButton
+      key="kube-config-button"
+      environments={environments}
+      envQueryParams={listQueryParams}
+    />,
+  ].filter((btn): btn is React.ReactElement => Boolean(btn));
+
+  return (
+    <div className="flex flex-col gap-2">
+      {summaryQuery.isSuccess && summaryQuery.data.total === 0 && (
+        <NoEnvironmentsInfoPanel isAdmin={isPureAdmin} />
+      )}
+      <SortableList
+        isLoading={isLoading}
+        renderItem={(row: EnvironmentRow) => (
+          <EnvironmentCard
+            environment={row}
+            groupName={row.groupName}
+            onClickBrowse={() => onClickBrowse(row)}
+          />
+        )}
+        tableState={tableState}
+        sortOptions={SORT_OPTIONS}
+        groupOptions={availableGroupsBySort}
+        totalCount={totalCount}
+        groups={environmentGroups}
+        searchPlaceholder="Search environments..."
+        emptyMessage="No environments available."
+        headerButtons={headerButtons}
+        data-cy="home-endpointList"
+        showGroupHeaders
+      />
+    </div>
+  );
+}
+
+type EnvironmentRow = Environment & {
+  groupName: string;
+  platformName: string;
+  healthLabel: string;
+};
+
+function getHealthLabel(
+  env: Environment,
+  sortGroupFilter: string | null
+): string {
+  // When a health filter is applied the server only returns environments
+  // matching that filter, so we trust the filter value as the label.
+  if (sortGroupFilter !== null) {
+    return sortGroupFilter;
+  }
+
+  const status = resolveBaseStatus(env);
+  if (env.Agent.IsOutdated && status !== 'Down') {
+    return 'Outdated';
+  }
+  return status;
+}
+
+function resolveBaseStatus(env: Environment): string {
+  if (isEdgeEnvironment(env.Type)) {
+    return env.Heartbeat ? 'Heartbeat' : 'Down';
+  }
+  switch (env.Status) {
+    case EnvironmentStatus.Up:
+      return 'Up';
+    case EnvironmentStatus.Down:
+    case EnvironmentStatus.Provisioning:
+    case EnvironmentStatus.Error:
+      return 'Down';
+    default:
+      return 'Unknown';
+  }
+}
+
+function buildGroups(
+  items: EnvironmentRow[],
+  sortBy: SortType,
+  groupOptions: Record<string, DropdownOption[]>,
+  groupDetails: Record<string, { name: string; description: string }>
+): SortableGroup<EnvironmentRow>[] {
+  if (!items?.length) return [];
+  const options = groupOptions[sortBy];
+  const getField = GROUP_FIELD[sortBy];
+  if (!options?.length || !getField) {
+    return [{ key: 'all', label: 'All', items }];
+  }
+  const itemsByKey = new Map<string, EnvironmentRow[]>();
+  for (const item of items) {
+    const key = getField(item);
+    const bucket = itemsByKey.get(key);
+    if (bucket) {
+      bucket.push(item);
+    } else {
+      itemsByKey.set(key, [item]);
+    }
+  }
+
+  return options.flatMap(({ key, label: optLabel }) => {
+    const groupItems = itemsByKey.get(key);
+    if (!groupItems?.length) return [];
+
+    const label = optLabel ?? key;
+    let icon: ReactNode;
+    let description: string | undefined;
+
+    if (sortBy === 'PlatformType' && platformDetails[key]) {
+      icon = getPlatformIconByPlatform(platformDetails[key].type, 'md');
+      description = platformDetails[key].description;
+    } else if (sortBy === 'Health' && healthDetails[key]) {
+      icon = getHealthIcon(healthDetails[key].type, 'md');
+      description = healthDetails[key].description;
+    } else if (sortBy === 'Group') {
+      icon = getGroupIcon('md');
+      description = groupDetails[key]?.description;
+    }
+
+    return [{ key, label, icon, description, items: groupItems }];
+  });
+}
diff --git a/app/react/portainer/HomeView/EnvironmentList/HomepageFilter.tsx b/app/react/portainer/HomeView/EnvironmentList/HomepageFilter.tsx
new file mode 100644
index 0000000..05ead7d
--- /dev/null
+++ b/app/react/portainer/HomeView/EnvironmentList/HomepageFilter.tsx
@@ -0,0 +1,69 @@
+import { components, OptionProps } from 'react-select';
+
+import { useLocalStorage } from '@/react/hooks/useLocalStorage';
+
+import {
+  type Option as OptionType,
+  PortainerSelect,
+} from '@@/form-components/PortainerSelect';
+
+interface Props<TValue = number> {
+  filterOptions?: OptionType<TValue>[];
+  onChange: (value: TValue[]) => void;
+  placeHolder: string;
+  value: TValue[];
+}
+
+function Option<TValue = number>(props: OptionProps<OptionType<TValue>, true>) {
+  const { isSelected, label } = props;
+  return (
+    <div>
+      <components.Option
+        // eslint-disable-next-line react/jsx-props-no-spreading
+        {...props}
+      >
+        <div className="flex items-center gap-2">
+          <input
+            type="checkbox"
+            checked={isSelected}
+            onChange={() => null}
+            data-cy={`homepage-filter-option-${label}`}
+          />
+          <label className="whitespace-nowrap">{label}</label>
+        </div>
+      </components.Option>
+    </div>
+  );
+}
+
+export function HomepageFilter<TValue = number>({
+  filterOptions = [],
+  onChange,
+  placeHolder,
+  value,
+}: Props<TValue>) {
+  return (
+    <PortainerSelect<TValue>
+      placeholder={placeHolder}
+      options={filterOptions}
+      value={value}
+      isMulti
+      components={{ Option }}
+      onChange={(option) => onChange([...option])}
+      bindToBody
+      data-cy="homepage-filter"
+    />
+  );
+}
+
+export function useHomePageFilter<T>(
+  key: string,
+  defaultValue: T
+): [T, (value: T) => void] {
+  const filterKey = keyBuilder(key);
+  return useLocalStorage(filterKey, defaultValue, sessionStorage);
+}
+
+function keyBuilder(key: string) {
+  return `datatable_home_filter_type_${key}`;
+}
diff --git a/app/react/portainer/HomeView/EnvironmentList/KubeconfigButton/KubeconfigButton.tsx b/app/react/portainer/HomeView/EnvironmentList/KubeconfigButton/KubeconfigButton.tsx
new file mode 100644
index 0000000..a33dab2
--- /dev/null
+++ b/app/react/portainer/HomeView/EnvironmentList/KubeconfigButton/KubeconfigButton.tsx
@@ -0,0 +1,88 @@
+import { useState } from 'react';
+import { Download } from 'lucide-react';
+
+import { Environment } from '@/react/portainer/environments/types';
+import { isKubernetesEnvironment } from '@/react/portainer/environments/utils';
+import { Query } from '@/react/portainer/environments/queries/useEnvironmentList';
+
+import { Button } from '@@/buttons';
+import { TooltipWithChildren } from '@@/Tip/TooltipWithChildren';
+
+import { KubeconfigPrompt } from './KubeconfigPrompt';
+
+import '@reach/dialog/styles.css';
+
+export interface Props {
+  environments: Environment[];
+  envQueryParams: Query;
+}
+export function KubeconfigButton({ environments, envQueryParams }: Props) {
+  const [isOpen, setIsOpen] = useState(false);
+
+  const kubeEnvs = environments.filter((env) =>
+    isKubernetesEnvironment(env.Type)
+  );
+
+  const isHttp = window.location.protocol === 'http:';
+  const noKubeEnvs = kubeEnvs.length === 0;
+  const isDisabled = noKubeEnvs || isHttp;
+
+  let tooltipMessage = '';
+  if (isHttp) {
+    tooltipMessage =
+      'Kubeconfig download is not available when Portainer is accessed via HTTP. Please use HTTPS';
+  } else if (noKubeEnvs) {
+    tooltipMessage = 'No Kubernetes environments detected';
+  }
+
+  const button = (
+    <Button
+      onClick={handleClick}
+      data-cy="download-kubeconfig-button"
+      size="medium"
+      className="!m-0"
+      icon={Download}
+      disabled={isDisabled}
+      color="light"
+    >
+      Kubeconfig
+    </Button>
+  );
+
+  return (
+    <>
+      {isDisabled ? (
+        <TooltipWithChildren message={tooltipMessage}>
+          <span className="!m-0">{button}</span>
+        </TooltipWithChildren>
+      ) : (
+        button
+      )}
+      {prompt()}
+    </>
+  );
+
+  function handleClick() {
+    if (!environments) {
+      return;
+    }
+
+    setIsOpen(true);
+  }
+
+  function handleClose() {
+    setIsOpen(false);
+  }
+
+  function prompt() {
+    return (
+      isOpen && (
+        <KubeconfigPrompt
+          envQueryParams={envQueryParams}
+          onClose={handleClose}
+          selectedItems={kubeEnvs.map((env) => env.Id)}
+        />
+      )
+    );
+  }
+}
diff --git a/app/react/portainer/HomeView/EnvironmentList/KubeconfigButton/KubeconfigPrompt.module.css b/app/react/portainer/HomeView/EnvironmentList/KubeconfigButton/KubeconfigPrompt.module.css
new file mode 100644
index 0000000..0a51806
--- /dev/null
+++ b/app/react/portainer/HomeView/EnvironmentList/KubeconfigButton/KubeconfigPrompt.module.css
@@ -0,0 +1,16 @@
+.checkbox {
+  padding-left: 0.5rem;
+}
+
+.checkbox-list {
+  max-height: 200px;
+  overflow-y: auto;
+  background-color: var(--white-color);
+  border: 0;
+  border-radius: 4px;
+}
+
+:root[theme='dark'] .checkbox-list,
+:root[theme='highcontrast'] .checkbox-list {
+  background-color: var(--bg-modal-content-color);
+}
diff --git a/app/react/portainer/HomeView/EnvironmentList/KubeconfigButton/KubeconfigPrompt.test.tsx b/app/react/portainer/HomeView/EnvironmentList/KubeconfigButton/KubeconfigPrompt.test.tsx
new file mode 100644
index 0000000..f1c42bd
--- /dev/null
+++ b/app/react/portainer/HomeView/EnvironmentList/KubeconfigButton/KubeconfigPrompt.test.tsx
@@ -0,0 +1,330 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { vi } from 'vitest';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { UserViewModel } from '@/portainer/models/user';
+import {
+  Environment,
+  EnvironmentType,
+} from '@/react/portainer/environments/types';
+import * as notifications from '@/portainer/services/notifications';
+import { usePublicSettings } from '@/react/portainer/settings/queries';
+import { usePaginationLimitState } from '@/react/hooks/usePaginationLimitState';
+import { useListSelection } from '@/react/hooks/useListSelection';
+import { useEnvironmentList } from '@/react/portainer/environments/queries';
+import { downloadKubeconfigFile } from '@/react/portainer/HomeView/EnvironmentList/KubeconfigButton/kubeconfig.service';
+
+import { KubeconfigPrompt, KubeconfigPromptProps } from './KubeconfigPrompt';
+
+vi.mock('@/react/portainer/settings/queries', () => ({
+  usePublicSettings: vi.fn(),
+}));
+
+vi.mock('@/react/portainer/environments/queries/useEnvironmentList', () => ({
+  useEnvironmentList: vi.fn(),
+}));
+
+vi.mock('@/react/hooks/usePaginationLimitState', () => ({
+  usePaginationLimitState: vi.fn(),
+}));
+
+vi.mock('@/react/hooks/useListSelection', () => ({
+  useListSelection: vi.fn(),
+}));
+
+vi.mock(
+  '@/react/portainer/HomeView/EnvironmentList/KubeconfigButton/kubeconfig.service',
+  () => ({
+    downloadKubeconfigFile: vi.fn(),
+  })
+);
+
+vi.mock('@/portainer/services/notifications', () => ({
+  warning: vi.fn(),
+  error: vi.fn(),
+}));
+
+function createMockEnvironment(
+  id: number,
+  name: string,
+  status = 1
+): Environment {
+  return {
+    Id: id,
+    Name: name,
+    Type: EnvironmentType.AgentOnKubernetes,
+    URL: `https://k8s-${name}.example.com`,
+    Status: status,
+    GroupId: 1,
+    PublicURL: '',
+    EdgeID: '',
+    EdgeKey: '',
+    EdgeCheckinInterval: 0,
+    QueryDate: 0,
+    LastCheckInDate: 0,
+    Snapshots: [],
+    Kubernetes: {
+      Snapshots: [],
+      Configuration: {
+        IngressClasses: [],
+      },
+    },
+    Agent: {
+      Version: '2.0.0',
+    },
+    TagIds: [],
+    UserAccessPolicies: {},
+    TeamAccessPolicies: {},
+  } as unknown as Environment;
+}
+
+const defaultProps: KubeconfigPromptProps = {
+  envQueryParams: {},
+  onClose: vi.fn(),
+  selectedItems: [],
+};
+
+describe('KubeconfigPrompt', () => {
+  let mockToggleSelection: ReturnType<typeof vi.fn>;
+  let mockSetPageLimit: ReturnType<typeof vi.fn>;
+
+  beforeEach(() => {
+    mockToggleSelection = vi.fn();
+    mockSetPageLimit = vi.fn();
+
+    vi.mocked(usePublicSettings).mockReturnValue({
+      data: 'The kubeconfig file will expire in 7 days.',
+      isLoading: false,
+      isError: false,
+    } as ReturnType<typeof usePublicSettings>);
+
+    vi.mocked(usePaginationLimitState).mockReturnValue([
+      10,
+      mockSetPageLimit,
+    ] as ReturnType<typeof usePaginationLimitState>);
+
+    vi.mocked(useListSelection).mockReturnValue([
+      [],
+      mockToggleSelection,
+    ] as ReturnType<typeof useListSelection>);
+
+    vi.mocked(useEnvironmentList).mockReturnValue({
+      environments: [
+        createMockEnvironment(1, 'k8s-dev'),
+        createMockEnvironment(2, 'k8s-prod'),
+        createMockEnvironment(3, 'k8s-staging'),
+      ],
+      totalCount: 3,
+      isLoading: false,
+    } as ReturnType<typeof useEnvironmentList>);
+
+    vi.mocked(downloadKubeconfigFile).mockResolvedValue(undefined);
+  });
+
+  afterEach(() => {
+    vi.clearAllMocks();
+  });
+
+  describe('Rendering', () => {
+    it('should render environment list with checkboxes', () => {
+      renderComponent();
+
+      expect(
+        screen.getByTestId('select-environment-checkbox-k8s-dev')
+      ).toBeVisible();
+      expect(
+        screen.getByTestId('select-environment-checkbox-k8s-prod')
+      ).toBeVisible();
+      expect(
+        screen.getByTestId('select-environment-checkbox-k8s-staging')
+      ).toBeVisible();
+    });
+
+    it('should render environment names with URLs', () => {
+      renderComponent();
+
+      expect(
+        screen.getByText('k8s-dev (https://k8s-k8s-dev.example.com)')
+      ).toBeVisible();
+      expect(
+        screen.getByText('k8s-prod (https://k8s-k8s-prod.example.com)')
+      ).toBeVisible();
+    });
+  });
+
+  describe('Selection', () => {
+    it('should initialize with selectedItems from props', () => {
+      renderComponent({ selectedItems: [1, 2] });
+
+      expect(useListSelection).toHaveBeenCalledWith([1, 2]);
+    });
+
+    it('should call toggleSelection when individual checkbox is clicked', async () => {
+      const user = userEvent.setup();
+      renderComponent();
+
+      const checkbox = screen.getByTestId(
+        'select-environment-checkbox-k8s-dev'
+      );
+      await user.click(checkbox);
+
+      expect(mockToggleSelection).toHaveBeenCalledWith(1, true);
+    });
+
+    it('should show select all checkbox unchecked when no items selected', () => {
+      vi.mocked(useListSelection).mockReturnValue([
+        [],
+        mockToggleSelection,
+      ] as ReturnType<typeof useListSelection>);
+
+      renderComponent();
+
+      const selectAllCheckbox = screen.getByTestId('select-all-checkbox');
+      expect(selectAllCheckbox).not.toBeChecked();
+    });
+
+    it('should show select all checkbox checked when all items on page are selected', () => {
+      vi.mocked(useListSelection).mockReturnValue([
+        [1, 2, 3],
+        mockToggleSelection,
+      ] as ReturnType<typeof useListSelection>);
+
+      renderComponent();
+
+      const selectAllCheckbox = screen.getByTestId('select-all-checkbox');
+      expect(selectAllCheckbox).toBeChecked();
+    });
+
+    it('should call toggleSelection for all environments when select all is clicked', async () => {
+      const user = userEvent.setup();
+      vi.mocked(useListSelection).mockReturnValue([
+        [],
+        mockToggleSelection,
+      ] as ReturnType<typeof useListSelection>);
+
+      renderComponent();
+
+      const selectAllCheckbox = screen.getByTestId('select-all-checkbox');
+      await user.click(selectAllCheckbox);
+
+      expect(mockToggleSelection).toHaveBeenCalledTimes(3);
+      expect(mockToggleSelection).toHaveBeenCalledWith(1, true);
+      expect(mockToggleSelection).toHaveBeenCalledWith(2, true);
+      expect(mockToggleSelection).toHaveBeenCalledWith(3, true);
+    });
+
+    it('should deselect all when select all is clicked and all are selected', async () => {
+      const user = userEvent.setup();
+      vi.mocked(useListSelection).mockReturnValue([
+        [1, 2, 3],
+        mockToggleSelection,
+      ] as ReturnType<typeof useListSelection>);
+
+      renderComponent();
+
+      const selectAllCheckbox = screen.getByTestId('select-all-checkbox');
+      await user.click(selectAllCheckbox);
+
+      expect(mockToggleSelection).toHaveBeenCalledTimes(3);
+      expect(mockToggleSelection).toHaveBeenCalledWith(1, false);
+      expect(mockToggleSelection).toHaveBeenCalledWith(2, false);
+      expect(mockToggleSelection).toHaveBeenCalledWith(3, false);
+    });
+  });
+
+  describe('Download Functionality', () => {
+    it('should disable download button when no environments selected', () => {
+      vi.mocked(useListSelection).mockReturnValue([
+        [],
+        mockToggleSelection,
+      ] as ReturnType<typeof useListSelection>);
+
+      renderComponent();
+
+      const downloadButton = screen.getByTestId(
+        'download-kubeconfig-confirmbutton'
+      );
+      expect(downloadButton).toBeDisabled();
+    });
+
+    it('should enable download button when environments are selected', () => {
+      vi.mocked(useListSelection).mockReturnValue([
+        [1, 2],
+        mockToggleSelection,
+      ] as ReturnType<typeof useListSelection>);
+
+      renderComponent();
+
+      const downloadButton = screen.getByTestId(
+        'download-kubeconfig-confirmbutton'
+      );
+      expect(downloadButton).not.toBeDisabled();
+    });
+
+    it('should show error notification when download fails', async () => {
+      const user = userEvent.setup();
+      const error = new Error('Network error');
+      vi.mocked(downloadKubeconfigFile).mockRejectedValue(error);
+      vi.mocked(useListSelection).mockReturnValue([
+        [1],
+        mockToggleSelection,
+      ] as ReturnType<typeof useListSelection>);
+
+      renderComponent();
+
+      const downloadButton = screen.getByTestId(
+        'download-kubeconfig-confirmbutton'
+      );
+      await user.click(downloadButton);
+
+      await waitFor(() => {
+        expect(notifications.error).toHaveBeenCalledWith(
+          'Failed downloading kubeconfig file',
+          error
+        );
+      });
+    });
+
+    it('should not close modal when download fails', async () => {
+      const user = userEvent.setup();
+      const onClose = vi.fn();
+      vi.mocked(downloadKubeconfigFile).mockRejectedValue(
+        new Error('Network error')
+      );
+      vi.mocked(useListSelection).mockReturnValue([
+        [1],
+        mockToggleSelection,
+      ] as ReturnType<typeof useListSelection>);
+
+      renderComponent({ onClose });
+
+      const downloadButton = screen.getByTestId(
+        'download-kubeconfig-confirmbutton'
+      );
+      await user.click(downloadButton);
+
+      await waitFor(() => {
+        expect(notifications.error).toHaveBeenCalled();
+      });
+
+      expect(onClose).not.toHaveBeenCalled();
+    });
+  });
+});
+
+function renderComponent(
+  props: Partial<KubeconfigPromptProps> = {}
+): ReturnType<typeof render> {
+  const user = new UserViewModel({ Username: 'testuser' });
+
+  const Wrapped = withTestQueryProvider(
+    withUserProvider(
+      () => <KubeconfigPrompt {...defaultProps} {...props} />,
+      user
+    )
+  );
+
+  return render(<Wrapped />);
+}
diff --git a/app/react/portainer/HomeView/EnvironmentList/KubeconfigButton/KubeconfigPrompt.tsx b/app/react/portainer/HomeView/EnvironmentList/KubeconfigButton/KubeconfigPrompt.tsx
new file mode 100644
index 0000000..36186cc
--- /dev/null
+++ b/app/react/portainer/HomeView/EnvironmentList/KubeconfigButton/KubeconfigPrompt.tsx
@@ -0,0 +1,178 @@
+import clsx from 'clsx';
+import { useState } from 'react';
+
+import { downloadKubeconfigFile } from '@/react/portainer/HomeView/EnvironmentList/KubeconfigButton/kubeconfig.service';
+import * as notifications from '@/portainer/services/notifications';
+import {
+  Environment,
+  EnvironmentType,
+} from '@/react/portainer/environments/types';
+import { usePaginationLimitState } from '@/react/hooks/usePaginationLimitState';
+import { usePublicSettings } from '@/react/portainer/settings/queries';
+import {
+  Query,
+  useEnvironmentList,
+} from '@/react/portainer/environments/queries/useEnvironmentList';
+import { useListSelection } from '@/react/hooks/useListSelection';
+
+import { Modal } from '@@/modals';
+import { PaginationControls } from '@@/PaginationControls';
+import { Checkbox } from '@@/form-components/Checkbox';
+import { Button } from '@@/buttons';
+
+import styles from './KubeconfigPrompt.module.css';
+
+export interface KubeconfigPromptProps {
+  envQueryParams: Query;
+  onClose: () => void;
+  selectedItems: Array<Environment['Id']>;
+}
+const storageKey = 'home_endpoints';
+
+export function KubeconfigPrompt({
+  envQueryParams,
+  onClose,
+  selectedItems,
+}: KubeconfigPromptProps) {
+  const [page, setPage] = useState(1);
+  const [pageLimit, setPageLimit] = usePaginationLimitState(storageKey);
+
+  const expiryQuery = usePublicSettings({
+    select: (settings) => expiryMessage(settings.KubeconfigExpiry),
+  });
+
+  const [selection, toggleSelection] =
+    useListSelection<Environment['Id']>(selectedItems);
+
+  const { environments, totalCount, isLoading } = useEnvironmentList({
+    ...envQueryParams,
+    page,
+    pageLimit,
+    types: [
+      EnvironmentType.KubernetesLocal,
+      EnvironmentType.AgentOnKubernetes,
+      EnvironmentType.EdgeAgentOnKubernetes,
+    ],
+  });
+  const isAllPageSelected =
+    !isLoading &&
+    environments
+      .filter((env) => env.Status <= 2)
+      .every((env) => selection.includes(env.Id));
+
+  return (
+    <Modal aria-label="Kubeconfig View" onDismiss={onClose} size="xl">
+      <Modal.Header title="Download kubeconfig file" />
+
+      <Modal.Body>
+        <div>
+          <span>
+            Select the kubernetes environments to add to the kubeconfig file.
+            You may select across multiple pages.
+          </span>
+          <span className="space-left">{expiryQuery.data}</span>
+        </div>
+
+        <div className="mt-2 flex h-8 items-center">
+          <Checkbox
+            id="settings-container-truncate-name"
+            data-cy="select-all-checkbox"
+            label="Select all (in this page)"
+            checked={isAllPageSelected}
+            onChange={handleSelectAll}
+          />
+        </div>
+        <div className="datatable">
+          <div className={styles.checkboxList}>
+            {environments
+              .filter((env) => env.Status <= 2)
+              .map((env) => (
+                <div
+                  key={env.Id}
+                  className={clsx(
+                    styles.checkbox,
+                    'flex h-8 items-center pt-1'
+                  )}
+                >
+                  <Checkbox
+                    id={`${env.Id}`}
+                    data-cy={`select-environment-checkbox-${env.Name}`}
+                    label={`${env.Name} (${env.URL})`}
+                    checked={selection.includes(env.Id)}
+                    onChange={() =>
+                      toggleSelection(env.Id, !selection.includes(env.Id))
+                    }
+                  />
+                </div>
+              ))}
+          </div>
+          <div className="flex w-full justify-end pt-3">
+            <PaginationControls
+              showAll={totalCount <= 100}
+              page={page}
+              onPageChange={setPage}
+              pageLimit={pageLimit}
+              onPageLimitChange={setPageLimit}
+              pageCount={Math.ceil(totalCount / pageLimit)}
+            />
+          </div>
+        </div>
+      </Modal.Body>
+
+      <Modal.Footer>
+        <Button
+          onClick={onClose}
+          color="default"
+          data-cy="cancel-kubeconfig-download-button"
+        >
+          Cancel
+        </Button>
+        <Button
+          onClick={handleDownload}
+          disabled={selection.length === 0}
+          data-cy="download-kubeconfig-confirmbutton"
+        >
+          Download File
+        </Button>
+      </Modal.Footer>
+    </Modal>
+  );
+
+  function handleSelectAll() {
+    environments.forEach((env) => toggleSelection(env.Id, !isAllPageSelected));
+  }
+
+  function handleDownload() {
+    confirmKubeconfigSelection();
+  }
+
+  async function confirmKubeconfigSelection() {
+    if (selection.length === 0) {
+      notifications.warning('No environment was selected', '');
+      return;
+    }
+    try {
+      await downloadKubeconfigFile(selection);
+      onClose();
+    } catch (e) {
+      notifications.error('Failed downloading kubeconfig file', e as Error);
+    }
+  }
+}
+
+export function expiryMessage(expiry: string) {
+  const prefix = 'The kubeconfig file will';
+  switch (expiry) {
+    case '24h':
+      return `${prefix} expire in 1 day.`;
+    case '168h':
+      return `${prefix} expire in 7 days.`;
+    case '720h':
+      return `${prefix} expire in 30 days.`;
+    case '8640h':
+      return `${prefix} expire in 1 year.`;
+    case '0':
+    default:
+      return `${prefix} not expire.`;
+  }
+}
diff --git a/app/react/portainer/HomeView/EnvironmentList/KubeconfigButton/index.ts b/app/react/portainer/HomeView/EnvironmentList/KubeconfigButton/index.ts
new file mode 100644
index 0000000..e5e2db4
--- /dev/null
+++ b/app/react/portainer/HomeView/EnvironmentList/KubeconfigButton/index.ts
@@ -0,0 +1 @@
+export { KubeconfigButton } from './KubeconfigButton';
diff --git a/app/react/portainer/HomeView/EnvironmentList/KubeconfigButton/kubeconfig.service.ts b/app/react/portainer/HomeView/EnvironmentList/KubeconfigButton/kubeconfig.service.ts
new file mode 100644
index 0000000..a49ff4e
--- /dev/null
+++ b/app/react/portainer/HomeView/EnvironmentList/KubeconfigButton/kubeconfig.service.ts
@@ -0,0 +1,23 @@
+import { saveAs } from 'file-saver';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+const baseUrl = 'kubernetes';
+
+export async function downloadKubeconfigFile(environmentIds: EnvironmentId[]) {
+  try {
+    const { headers, data } = await axios.get<Blob>(`${baseUrl}/config`, {
+      params: { ids: JSON.stringify(environmentIds) },
+      responseType: 'blob',
+      headers: {
+        Accept: 'text/yaml',
+      },
+    });
+    const contentDispositionHeader = headers['content-disposition'];
+    const filename = contentDispositionHeader.replace('attachment;', '').trim();
+    saveAs(data, filename);
+  } catch (e) {
+    throw parseAxiosError(e as Error, '');
+  }
+}
diff --git a/app/react/portainer/HomeView/EnvironmentList/NoEnvironmentsInfoPanel.tsx b/app/react/portainer/HomeView/EnvironmentList/NoEnvironmentsInfoPanel.tsx
new file mode 100644
index 0000000..f976d70
--- /dev/null
+++ b/app/react/portainer/HomeView/EnvironmentList/NoEnvironmentsInfoPanel.tsx
@@ -0,0 +1,33 @@
+import { InformationPanel } from '@@/InformationPanel';
+import { Link } from '@@/Link';
+import { TextTip } from '@@/Tip/TextTip';
+
+export function NoEnvironmentsInfoPanel({ isAdmin }: { isAdmin: boolean }) {
+  return (
+    <div className="row">
+      <div className="col-sm-12">
+        <InformationPanel title="Information">
+          <TextTip>
+            {isAdmin ? (
+              <span>
+                No environment available for management. Please head over the{' '}
+                <Link
+                  to="portainer.wizard.endpoints"
+                  data-cy="wizard-add-environments-link"
+                >
+                  environment wizard
+                </Link>{' '}
+                to add an environment.
+              </span>
+            ) : (
+              <span>
+                You do not have access to any environment. Please contact your
+                administrator.
+              </span>
+            )}
+          </TextTip>
+        </InformationPanel>
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/portainer/HomeView/EnvironmentList/SortbySelector.module.css b/app/react/portainer/HomeView/EnvironmentList/SortbySelector.module.css
new file mode 100644
index 0000000..c16644d
--- /dev/null
+++ b/app/react/portainer/HomeView/EnvironmentList/SortbySelector.module.css
@@ -0,0 +1,26 @@
+.sort-by-container {
+  display: flex;
+  align-items: center;
+  justify-content: flex-end;
+}
+
+.sort-by-element {
+  display: inline-block;
+}
+
+.sort-button {
+  background-color: var(--bg-sortbutton-color);
+  color: var(--grey-6);
+  border: 1px solid var(--border-sortbutton);
+  display: inline-block;
+  padding: 8px 10px;
+  border-radius: 5px;
+}
+
+:global(:root[theme='dark']) .sort-button {
+  color: var(--white-color);
+}
+
+:global(:root[theme='highcontrast']) .sort-button {
+  color: var(--white-color);
+}
diff --git a/app/react/portainer/HomeView/EnvironmentList/SortbySelector.tsx b/app/react/portainer/HomeView/EnvironmentList/SortbySelector.tsx
new file mode 100644
index 0000000..a764f6d
--- /dev/null
+++ b/app/react/portainer/HomeView/EnvironmentList/SortbySelector.tsx
@@ -0,0 +1,64 @@
+import clsx from 'clsx';
+
+import { PortainerSelect } from '@@/form-components/PortainerSelect';
+import { TableHeaderSortIcons } from '@@/datatables/TableHeaderSortIcons';
+
+import {
+  SortOptions,
+  SortType,
+} from '../../environments/queries/useEnvironmentList';
+
+import styles from './SortbySelector.module.css';
+
+export type ListSortType = Exclude<SortType, 'LastCheckIn' | 'EdgeID'>;
+
+const sortByOptions = SortOptions.filter(
+  (v): v is ListSortType => !['LastCheckIn', 'EdgeID'].includes(v)
+).map((v) => ({
+  value: v,
+  label: v,
+}));
+
+interface Props {
+  onChange: (value: ListSortType) => void;
+  onDescending: () => void;
+  placeHolder: string;
+  sortByDescending: boolean;
+  sortByButton: boolean;
+  value?: ListSortType;
+}
+
+export function SortbySelector({
+  onChange,
+  onDescending,
+  placeHolder,
+  sortByDescending,
+  sortByButton,
+  value,
+}: Props) {
+  const sorted = sortByButton && !!value;
+  return (
+    <div className="flex items-center justify-end gap-1">
+      <PortainerSelect
+        placeholder={placeHolder}
+        options={sortByOptions}
+        onChange={(option: ListSortType) => onChange(option)}
+        isClearable
+        value={value}
+        data-cy="home-view-sortby-selector"
+      />
+
+      <button
+        className={clsx(styles.sortButton, '!m-0 h-[34px]')}
+        type="button"
+        disabled={!sorted}
+        onClick={(e) => {
+          e.preventDefault();
+          onDescending();
+        }}
+      >
+        <TableHeaderSortIcons sorted={sorted} descending={sortByDescending} />
+      </button>
+    </div>
+  );
+}
diff --git a/app/react/portainer/HomeView/EnvironmentList/UpdateBadge.tsx b/app/react/portainer/HomeView/EnvironmentList/UpdateBadge.tsx
new file mode 100644
index 0000000..c2afac6
--- /dev/null
+++ b/app/react/portainer/HomeView/EnvironmentList/UpdateBadge.tsx
@@ -0,0 +1,43 @@
+import _ from 'lodash';
+import clsx from 'clsx';
+
+import { useSupportedAgentVersions } from '@/react/portainer/environments/update-schedules/queries/useSupportedAgentVersions';
+
+import { Link } from '@@/Link';
+
+export function UpdateBadge() {
+  const version = useAgentLatestVersion();
+
+  return (
+    <span
+      className={clsx(
+        'inline-flex h-fit items-center gap-2 rounded-3xl border border-solid border-transparent p-1 font-normal',
+        'bg-blue-3 text-blue-8',
+        'th-dark:bg-blue-8 th-dark:text-white',
+        'th-highcontrast:border-white th-highcontrast:bg-transparent th-highcontrast:text-white'
+      )}
+    >
+      <span className="hidden text-sm 2xl:!inline">
+        Update Available: Edge Agent {version}
+      </span>
+      <Link
+        to="portainer.endpoints.updateSchedules.create"
+        className={clsx(
+          'badge border border-solid border-transparent font-normal',
+          'bg-blue-8 text-blue-3',
+          'th-dark:bg-blue-3 th-dark:text-blue-8 th-dark:hover:bg-blue-5 th-dark:hover:text-blue-8',
+          'th-highcontrast:border-white th-highcontrast:bg-transparent th-highcontrast:text-white th-highcontrast:hover:bg-gray-warm-7 th-highcontrast:hover:text-white'
+        )}
+        data-cy="home-schedule-update-link"
+      >
+        Schedule Update
+      </Link>
+    </span>
+  );
+}
+
+function useAgentLatestVersion() {
+  const supportedAgentVersionsQuery = useSupportedAgentVersions();
+
+  return _.last(supportedAgentVersionsQuery.data) || '';
+}
diff --git a/app/react/portainer/HomeView/EnvironmentList/index.ts b/app/react/portainer/HomeView/EnvironmentList/index.ts
new file mode 100644
index 0000000..7ab62ca
--- /dev/null
+++ b/app/react/portainer/HomeView/EnvironmentList/index.ts
@@ -0,0 +1 @@
+export { EnvironmentList } from './EnvironmentList';
diff --git a/app/react/portainer/HomeView/EnvironmentList/types.ts b/app/react/portainer/HomeView/EnvironmentList/types.ts
new file mode 100644
index 0000000..7030c45
--- /dev/null
+++ b/app/react/portainer/HomeView/EnvironmentList/types.ts
@@ -0,0 +1,11 @@
+export interface Filter<T = number> {
+  value: T;
+  label: string;
+}
+
+export enum ConnectionType {
+  API,
+  Agent,
+  EdgeAgentStandard,
+  EdgeAgentAsync,
+}
diff --git a/app/react/portainer/HomeView/HomeView.tsx b/app/react/portainer/HomeView/HomeView.tsx
new file mode 100644
index 0000000..11b0d14
--- /dev/null
+++ b/app/react/portainer/HomeView/HomeView.tsx
@@ -0,0 +1,92 @@
+import { useStore } from 'zustand';
+import { useCurrentStateAndParams, useRouter } from '@uirouter/react';
+import { useEffect, useState } from 'react';
+
+import { environmentStore } from '@/react/hooks/current-environment-store';
+import { Environment } from '@/react/portainer/environments/types';
+import { isEdgeEnvironment } from '@/react/portainer/environments/utils';
+
+import { confirm } from '@@/modals/confirm';
+import { PageHeader } from '@@/PageHeader';
+import { ModalType } from '@@/modals';
+import { buildConfirmButton } from '@@/modals/utils';
+
+import { EnvironmentList } from './EnvironmentList';
+import { EdgeLoadingSpinner } from './EdgeLoadingSpinner';
+import { MotdPanel } from './MotdPanel';
+import { LicenseNodePanel } from './LicenseNodePanel';
+import { BackupFailedPanel } from './BackupFailedPanel';
+import { EnvironmentHeader } from './EnvironmentHeader/EnvironmentHeader';
+
+export function HomeView() {
+  const { clear: clearStore } = useStore(environmentStore);
+
+  const { params } = useCurrentStateAndParams();
+  const [connectingToEdgeEndpoint, setConnectingToEdgeEndpoint] = useState(
+    !!params.redirect
+  );
+
+  const router = useRouter();
+
+  useEffect(() => {
+    async function redirect() {
+      const options = {
+        title: `Failed connecting to ${params.environmentName}`,
+        message: `There was an issue connecting to edge agent via tunnel. Click 'Retry' below to retry now, or wait 10 seconds to automatically retry.`,
+        confirmButton: buildConfirmButton('Retry', 'primary', 10),
+        modalType: ModalType.Destructive,
+      };
+
+      if (await confirm(options)) {
+        setConnectingToEdgeEndpoint(true);
+        router.stateService.go(params.route, {
+          endpointId: params.environmentId,
+        });
+      } else {
+        clearStore();
+        router.stateService.go(
+          'portainer.home',
+          {},
+          { reload: true, inherit: false }
+        );
+      }
+    }
+
+    if (params.redirect) {
+      redirect();
+    }
+  }, [params, setConnectingToEdgeEndpoint, router, clearStore]);
+
+  return (
+    <div className="flex min-h-screen flex-col">
+      <PageHeader
+        reload
+        title="Home"
+        breadcrumbs={[{ label: 'Environments' }]}
+      />
+
+      {process.env.PORTAINER_EDITION !== 'CE' && <LicenseNodePanel />}
+
+      <MotdPanel />
+
+      {process.env.PORTAINER_EDITION !== 'CE' && <BackupFailedPanel />}
+
+      {connectingToEdgeEndpoint ? (
+        <div className="mb-5 flex flex-1 flex-col items-center justify-center">
+          <EdgeLoadingSpinner />
+        </div>
+      ) : (
+        <div className="mx-5 mb-5 flex flex-col gap-6">
+          <EnvironmentHeader />
+          <EnvironmentList onClickBrowse={handleBrowseClick} />
+        </div>
+      )}
+    </div>
+  );
+
+  function handleBrowseClick(environment: Environment) {
+    if (isEdgeEnvironment(environment.Type)) {
+      setConnectingToEdgeEndpoint(true);
+    }
+  }
+}
diff --git a/app/react/portainer/HomeView/LicenseNodePanel.test.tsx b/app/react/portainer/HomeView/LicenseNodePanel.test.tsx
new file mode 100644
index 0000000..bd862cc
--- /dev/null
+++ b/app/react/portainer/HomeView/LicenseNodePanel.test.tsx
@@ -0,0 +1,53 @@
+import { http, HttpResponse } from 'msw';
+import { render } from '@testing-library/react';
+
+import { server } from '@/setup-tests/server';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+
+import { LicenseType } from '../licenses/types';
+
+import { LicenseNodePanel } from './LicenseNodePanel';
+
+test('when user is using more nodes then allowed he should see message', async () => {
+  const allowed = 2;
+  const used = 5;
+  server.use(
+    http.get('/api/licenses/info', () =>
+      HttpResponse.json({ nodes: allowed, type: LicenseType.Subscription })
+    ),
+    http.get('/api/system/nodes', () => HttpResponse.json({ nodes: used }))
+  );
+
+  const { findByText } = renderComponent();
+
+  await expect(
+    findByText(
+      /The number of nodes for your license has been exceeded. Please contact your administrator./
+    )
+  ).resolves.toBeVisible();
+});
+
+test("when user is using less nodes then allowed he shouldn't see message", async () => {
+  const allowed = 5;
+  const used = 2;
+  server.use(
+    http.get('/api/licenses/info', () =>
+      HttpResponse.json({ nodes: allowed, type: LicenseType.Subscription })
+    ),
+    http.get('/api/system/nodes', () => HttpResponse.json({ nodes: used }))
+  );
+
+  const { findByText } = renderComponent();
+
+  await expect(
+    findByText(
+      /The number of nodes for your license has been exceeded. Please contact your administrator./
+    )
+  ).rejects.toBeTruthy();
+});
+
+function renderComponent() {
+  const Wrapped = withTestQueryProvider(LicenseNodePanel);
+
+  return render(<Wrapped />);
+}
diff --git a/app/react/portainer/HomeView/LicenseNodePanel.tsx b/app/react/portainer/HomeView/LicenseNodePanel.tsx
new file mode 100644
index 0000000..e0f130d
--- /dev/null
+++ b/app/react/portainer/HomeView/LicenseNodePanel.tsx
@@ -0,0 +1,39 @@
+import { TextTip } from '@@/Tip/TextTip';
+import { InformationPanel } from '@@/InformationPanel';
+
+import { useNodesCount } from '../system/useNodesCount';
+import { useLicenseInfo } from '../licenses/use-license.service';
+import { LicenseType } from '../licenses/types';
+
+export function LicenseNodePanel() {
+  const nodesValid = useNodesValid();
+
+  if (nodesValid) {
+    return null;
+  }
+
+  return (
+    <InformationPanel title="License node allowance exceeded">
+      <TextTip>
+        The number of nodes for your license has been exceeded. Please contact
+        your administrator.
+      </TextTip>
+    </InformationPanel>
+  );
+}
+
+function useNodesValid() {
+  const { isLoading: isLoadingNodes, data: nodesCount = 0 } = useNodesCount();
+
+  const { isLoading: isLoadingLicense, info } = useLicenseInfo();
+  if (
+    isLoadingLicense ||
+    isLoadingNodes ||
+    !info ||
+    info.type === LicenseType.Trial
+  ) {
+    return true;
+  }
+
+  return nodesCount <= info.nodes;
+}
diff --git a/app/react/portainer/HomeView/MotdPanel.tsx b/app/react/portainer/HomeView/MotdPanel.tsx
new file mode 100644
index 0000000..f053d26
--- /dev/null
+++ b/app/react/portainer/HomeView/MotdPanel.tsx
@@ -0,0 +1,58 @@
+import { useQuery } from '@tanstack/react-query';
+import _ from 'lodash';
+import sanitize from 'sanitize-html';
+
+import { useUIState } from '@/react/hooks/useUIState';
+
+import { InformationPanel } from '@@/InformationPanel';
+
+import { getMotd } from './home.service';
+
+export function MotdPanel() {
+  const motd = useMotd();
+
+  const uiStateStore = useUIState();
+
+  if (
+    !motd ||
+    motd.Message === '' ||
+    motd.Hash === uiStateStore.dismissedInfoHash
+  ) {
+    return null;
+  }
+
+  return (
+    <div className="mx-5 mb-4">
+      {!!motd.Style && <style>{motd.Style}</style>}
+      <InformationPanel
+        onDismiss={() => onDismiss(motd.Hash)}
+        title={motd.Title}
+        wrapperStyle={camelCaseKeys(motd.ContentLayout)}
+        bodyClassName="motd-body"
+      >
+        <span className="text-muted">
+          {/* eslint-disable-next-line react/no-danger */}
+          <p dangerouslySetInnerHTML={{ __html: sanitize(motd.Message) }} />
+        </span>
+      </InformationPanel>
+    </div>
+  );
+
+  function onDismiss(hash: string) {
+    uiStateStore.dismissMotd(hash);
+  }
+}
+
+function useMotd() {
+  const { data } = useQuery(['motd'], () => getMotd());
+  return data;
+}
+
+function camelCaseKeys(obj: Record<string, string> = {}) {
+  return Object.fromEntries(
+    Object.entries(obj).map(([key, value]) => {
+      const camelCased = _.camelCase(key);
+      return [camelCased, value];
+    })
+  );
+}
diff --git a/app/react/portainer/HomeView/home.service.ts b/app/react/portainer/HomeView/home.service.ts
new file mode 100644
index 0000000..d6f2535
--- /dev/null
+++ b/app/react/portainer/HomeView/home.service.ts
@@ -0,0 +1,15 @@
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { Motd } from './types';
+
+export async function getMotd() {
+  try {
+    const { data } = await axios.get<Motd>('/motd');
+    return data;
+  } catch (err) {
+    throw parseAxiosError(
+      err as Error,
+      'Unable to retrieve information message'
+    );
+  }
+}
diff --git a/app/react/portainer/HomeView/index.ts b/app/react/portainer/HomeView/index.ts
new file mode 100644
index 0000000..ee14985
--- /dev/null
+++ b/app/react/portainer/HomeView/index.ts
@@ -0,0 +1 @@
+export { HomeView } from './HomeView';
diff --git a/app/react/portainer/HomeView/types.ts b/app/react/portainer/HomeView/types.ts
new file mode 100644
index 0000000..b18b969
--- /dev/null
+++ b/app/react/portainer/HomeView/types.ts
@@ -0,0 +1,7 @@
+export interface Motd {
+  Title: string;
+  Message: string;
+  Hash: string;
+  Style?: string;
+  ContentLayout?: Record<string, string>;
+}
diff --git a/app/react/portainer/HomeView/useHomeViewState.ts b/app/react/portainer/HomeView/useHomeViewState.ts
new file mode 100644
index 0000000..c36a992
--- /dev/null
+++ b/app/react/portainer/HomeView/useHomeViewState.ts
@@ -0,0 +1,38 @@
+import {
+  getSortTypeCaseInsensitive,
+  SortType,
+} from '@/react/portainer/environments/queries/useEnvironmentList';
+
+import { useTableStateFromUrl } from '@@/datatables/useTableStateFromUrl';
+
+const STORAGE_KEY = 'home_view_endpoints';
+const DEFAULT_SORT = 'Id';
+
+type Extra = {
+  groupKey: SortType;
+  setHeaderFilter: (sortBy: SortType, filter: string | null) => void;
+};
+
+export function useHomeViewState() {
+  return useTableStateFromUrl<Record<never, never>, Extra>({
+    localStorageKey: STORAGE_KEY,
+    defaultSort: DEFAULT_SORT,
+    defaultGroupBy: DEFAULT_SORT,
+    buildExtra: (urlState, setUrlState) => {
+      return {
+        groupKey: urlState.groupBy
+          ? (getSortTypeCaseInsensitive(urlState.groupBy) ?? DEFAULT_SORT)
+          : DEFAULT_SORT,
+        setHeaderFilter: (sortBy, filter) => {
+          setUrlState({
+            groupBy: sortBy.toString(),
+            groupFilter: filter,
+            order: 'asc',
+            page: 0,
+            search: '',
+          });
+        },
+      };
+    },
+  });
+}
diff --git a/app/react/portainer/access-control/AccessControlForm/AccessControlForm.stories.tsx b/app/react/portainer/access-control/AccessControlForm/AccessControlForm.stories.tsx
new file mode 100644
index 0000000..20bc300
--- /dev/null
+++ b/app/react/portainer/access-control/AccessControlForm/AccessControlForm.stories.tsx
@@ -0,0 +1,50 @@
+import { Meta, StoryFn } from '@storybook/react-webpack5';
+import { useState } from 'react';
+
+import { UserViewModel } from '@/portainer/models/user';
+import { Role, User } from '@/portainer/users/types';
+import { isPureAdmin } from '@/portainer/users/user.helpers';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+
+import { parseAccessControlFormData } from '../utils';
+
+import { AccessControlForm } from './AccessControlForm';
+
+const meta: Meta = {
+  title: 'Components/AccessControlForm',
+  component: AccessControlForm,
+};
+
+export default meta;
+
+interface Args {
+  userRole: Role;
+}
+
+function Template({ userRole }: Args) {
+  const defaults = parseAccessControlFormData(
+    isPureAdmin({ Role: userRole } as User),
+    0
+  );
+
+  const [value, setValue] = useState(defaults);
+
+  const Wrapped = withUserProvider(
+    AccessControlForm,
+    new UserViewModel({ Role: userRole })
+  );
+
+  return (
+    <Wrapped values={value} onChange={setValue} errors={{}} environmentId={1} />
+  );
+}
+
+export const AdminAccessControl: StoryFn<Args> = Template.bind({});
+AdminAccessControl.args = {
+  userRole: Role.Admin,
+};
+
+export const NonAdminAccessControl: StoryFn<Args> = Template.bind({});
+NonAdminAccessControl.args = {
+  userRole: Role.Standard,
+};
diff --git a/app/react/portainer/access-control/AccessControlForm/AccessControlForm.test.tsx b/app/react/portainer/access-control/AccessControlForm/AccessControlForm.test.tsx
new file mode 100644
index 0000000..2503ce9
--- /dev/null
+++ b/app/react/portainer/access-control/AccessControlForm/AccessControlForm.test.tsx
@@ -0,0 +1,344 @@
+import { http, HttpResponse } from 'msw';
+import { render, within } from '@testing-library/react';
+
+import { server } from '@/setup-tests/server';
+import { UserViewModel } from '@/portainer/models/user';
+import { Team, TeamId } from '@/react/portainer/users/teams/types';
+import { createMockTeams } from '@/react-tools/test-mocks';
+import { UserId } from '@/portainer/users/types';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+
+import { ResourceControlOwnership, AccessControlFormData } from '../types';
+import { ResourceControlViewModel } from '../models/ResourceControlViewModel';
+
+import { AccessControlForm } from './AccessControlForm';
+
+test('renders correctly', async () => {
+  const values = buildFormData();
+
+  const { findByText } = await renderComponent(values);
+
+  expect(await findByText('Access control')).toBeVisible();
+});
+
+test.each([
+  [ResourceControlOwnership.ADMINISTRATORS],
+  [ResourceControlOwnership.PRIVATE],
+  [ResourceControlOwnership.RESTRICTED],
+])(
+  `when ownership is %s, ownership selector should be visible`,
+  async (ownership) => {
+    const values = buildFormData(ownership);
+
+    const { findByRole, getByLabelText } = await renderComponent(values);
+    const accessSwitch = getByLabelText(/Enable access control/);
+
+    expect(accessSwitch).toBeEnabled();
+
+    await expect(findByRole('radiogroup')).resolves.toBeVisible();
+  }
+);
+
+test.each([
+  [ResourceControlOwnership.ADMINISTRATORS],
+  [ResourceControlOwnership.PRIVATE],
+  [ResourceControlOwnership.RESTRICTED],
+])(
+  'when isAdmin and ownership is %s, ownership selector should show admin and restricted options',
+  async (ownership) => {
+    const values = buildFormData(ownership);
+
+    const { findByRole } = await renderComponent(values, vi.fn(), {
+      isAdmin: true,
+    });
+
+    const ownershipSelector = await findByRole('radiogroup');
+
+    expect(ownershipSelector).toBeVisible();
+    if (!ownershipSelector) {
+      throw new Error('selector is missing');
+    }
+
+    const selectorQueries = within(ownershipSelector);
+    expect(
+      await selectorQueries.findByLabelText(/Administrator/)
+    ).toBeVisible();
+    expect(await selectorQueries.findByLabelText(/Restricted/)).toBeVisible();
+  }
+);
+
+test.each([
+  [ResourceControlOwnership.ADMINISTRATORS],
+  [ResourceControlOwnership.PRIVATE],
+  [ResourceControlOwnership.RESTRICTED],
+])(
+  `when user is not an admin and %s and no teams, should have only private option`,
+  async (ownership) => {
+    const values = buildFormData(ownership);
+
+    const { findByRole } = await renderComponent(values, vi.fn(), {
+      teams: [],
+      isAdmin: false,
+    });
+
+    const ownershipSelector = await findByRole('radiogroup');
+
+    const selectorQueries = within(ownershipSelector);
+
+    expect(selectorQueries.queryByLabelText(/Private/)).toBeVisible();
+    expect(selectorQueries.queryByLabelText(/Restricted/)).toBeNull();
+  }
+);
+
+test.each([
+  [ResourceControlOwnership.ADMINISTRATORS],
+  [ResourceControlOwnership.PRIVATE],
+  [ResourceControlOwnership.RESTRICTED],
+])(
+  `when user is not an admin and %s and there is 1 team, should have private and restricted options`,
+  async (ownership) => {
+    const values = buildFormData(ownership);
+
+    const { findByRole } = await renderComponent(values, vi.fn(), {
+      teams: createMockTeams(1),
+      isAdmin: false,
+    });
+
+    const ownershipSelector = await findByRole('radiogroup');
+
+    const selectorQueries = within(ownershipSelector);
+
+    expect(await selectorQueries.findByLabelText(/Private/)).toBeVisible();
+    expect(await selectorQueries.findByLabelText(/Restricted/)).toBeVisible();
+  }
+);
+
+test('when ownership is public, ownership selector should be hidden', async () => {
+  const values = buildFormData(ResourceControlOwnership.PUBLIC);
+
+  const { queryByRole } = await renderComponent(values);
+
+  expect(queryByRole('radiogroup')).toBeNull();
+});
+
+test('when hideTitle is true, title should be hidden', async () => {
+  const values = buildFormData();
+
+  const { queryByRole } = await renderComponent(values, vi.fn(), {
+    hideTitle: true,
+  });
+
+  expect(queryByRole('Access control')).toBeNull();
+});
+
+test('when isAdmin and admin ownership is selected, no extra options are visible', async () => {
+  const values = buildFormData(ResourceControlOwnership.ADMINISTRATORS);
+
+  const { findByRole, queryByLabelText } = await renderComponent(
+    values,
+    vi.fn(),
+    {
+      isAdmin: true,
+    }
+  );
+
+  const ownershipSelector = await findByRole('radiogroup');
+
+  expect(ownershipSelector).toBeVisible();
+  if (!ownershipSelector) {
+    throw new Error('selector is missing');
+  }
+
+  const selectorQueries = within(ownershipSelector);
+
+  expect(await selectorQueries.findByLabelText(/Administrator/)).toBeChecked();
+  expect(await selectorQueries.findByLabelText(/Restricted/)).not.toBeChecked();
+
+  expect(queryByLabelText('extra-options')).toBeNull();
+});
+
+test('when isAdmin and restricted ownership is selected, show team and users selectors', async () => {
+  const values = buildFormData(ResourceControlOwnership.RESTRICTED);
+
+  const { findByRole, findByLabelText } = await renderComponent(
+    values,
+    vi.fn(),
+    {
+      isAdmin: true,
+    }
+  );
+
+  const ownershipSelector = await findByRole('radiogroup');
+
+  expect(ownershipSelector).toBeVisible();
+  if (!ownershipSelector) {
+    throw new Error('selector is missing');
+  }
+
+  const selectorQueries = within(ownershipSelector);
+
+  expect(
+    await selectorQueries.findByLabelText(/Administrator/)
+  ).not.toBeChecked();
+
+  expect(await selectorQueries.findByLabelText(/Restricted/)).toBeChecked();
+
+  const extraOptions = await findByLabelText('extra-options');
+  expect(extraOptions).toBeVisible();
+
+  if (!extraOptions) {
+    throw new Error('extra options section is missing');
+  }
+
+  const extraQueries = within(extraOptions);
+  expect(await extraQueries.findByText(/Authorized users/)).toBeVisible();
+  expect(await extraQueries.findByText(/Authorized teams/)).toBeVisible();
+});
+
+test('when user is not an admin, there are more then 1 team and ownership is restricted, team selector should be visible', async () => {
+  const values = buildFormData(ResourceControlOwnership.RESTRICTED);
+
+  const { findByRole, findByLabelText } = await renderComponent(
+    values,
+    vi.fn()
+  );
+
+  const ownershipSelector = await findByRole('radiogroup');
+
+  expect(ownershipSelector).toBeVisible();
+  if (!ownershipSelector) {
+    throw new Error('selector is missing');
+  }
+
+  const selectorQueries = within(ownershipSelector);
+
+  expect(await selectorQueries.findByLabelText(/Private/)).toBeVisible();
+  expect(await selectorQueries.findByLabelText(/Restricted/)).toBeVisible();
+
+  const extraOptions = await findByLabelText('extra-options');
+  expect(extraOptions).toBeVisible();
+
+  if (!extraOptions) {
+    throw new Error('extra options section is missing');
+  }
+
+  const extraQueries = within(extraOptions);
+  expect(extraQueries.queryByLabelText(/Authorized teams/)).toBeVisible();
+});
+
+test('when user is not an admin, there is 1 team and ownership is restricted, team selector not should be visible', async () => {
+  const values = buildFormData(ResourceControlOwnership.RESTRICTED);
+
+  const { findByRole, findByLabelText } = await renderComponent(
+    values,
+    vi.fn(),
+    {
+      teams: createMockTeams(1),
+      isAdmin: false,
+    }
+  );
+
+  const ownershipSelector = await findByRole('radiogroup');
+
+  expect(ownershipSelector).toBeVisible();
+  if (!ownershipSelector) {
+    throw new Error('selector is missing');
+  }
+
+  const selectorQueries = within(ownershipSelector);
+
+  expect(await selectorQueries.findByLabelText(/Private/)).toBeVisible();
+  expect(await selectorQueries.findByLabelText(/Restricted/)).toBeVisible();
+
+  const extraOptions = await findByLabelText('extra-options');
+  expect(extraOptions).toBeVisible();
+
+  if (!extraOptions) {
+    throw new Error('extra options section is missing');
+  }
+
+  const extraQueries = within(extraOptions);
+  expect(extraQueries.queryByText(/Authorized teams/)).toBeNull();
+});
+
+test('when user is not an admin, and ownership is restricted, user selector not should be visible', async () => {
+  const values = buildFormData(ResourceControlOwnership.RESTRICTED);
+
+  const { findByRole, findByLabelText } = await renderComponent(
+    values,
+    vi.fn(),
+    {
+      isAdmin: false,
+    }
+  );
+
+  const ownershipSelector = await findByRole('radiogroup');
+
+  expect(ownershipSelector).toBeVisible();
+  if (!ownershipSelector) {
+    throw new Error('selector is missing');
+  }
+
+  const extraOptions = await findByLabelText('extra-options');
+  expect(extraOptions).toBeVisible();
+
+  if (!extraOptions) {
+    throw new Error('extra options section is missing');
+  }
+  const extraQueries = within(extraOptions);
+
+  expect(extraQueries.queryByText(/Authorized users/)).toBeNull();
+});
+
+interface AdditionalProps {
+  teams?: Team[];
+  users?: UserViewModel[];
+  isAdmin?: boolean;
+  hideTitle?: boolean;
+  resourceControl?: ResourceControlViewModel;
+}
+
+async function renderComponent(
+  values: AccessControlFormData,
+  onChange = vi.fn(),
+  { isAdmin = false, hideTitle = false, teams, users }: AdditionalProps = {}
+) {
+  const user = new UserViewModel({ Username: 'user', Role: isAdmin ? 1 : 2 });
+
+  if (teams) {
+    server.use(http.get('/api/teams', () => HttpResponse.json(teams)));
+  }
+
+  if (users) {
+    server.use(http.get('/api/users', () => HttpResponse.json(users)));
+  }
+
+  const Wrapped = withTestRouter(
+    withTestQueryProvider(withUserProvider(AccessControlForm, user))
+  );
+
+  const renderResult = render(
+    <Wrapped
+      environmentId={1}
+      errors={{}}
+      values={values}
+      onChange={onChange}
+      hideTitle={hideTitle}
+    />
+  );
+
+  await expect(
+    renderResult.findByLabelText(/Enable access control/)
+  ).resolves.toBeVisible();
+  return renderResult;
+}
+
+function buildFormData(
+  ownership = ResourceControlOwnership.PRIVATE,
+  authorizedTeams: TeamId[] = [],
+  authorizedUsers: UserId[] = []
+): AccessControlFormData {
+  return { ownership, authorizedTeams, authorizedUsers };
+}
diff --git a/app/react/portainer/access-control/AccessControlForm/AccessControlForm.tsx b/app/react/portainer/access-control/AccessControlForm/AccessControlForm.tsx
new file mode 100644
index 0000000..21edc8d
--- /dev/null
+++ b/app/react/portainer/access-control/AccessControlForm/AccessControlForm.tsx
@@ -0,0 +1,82 @@
+import { FormikErrors } from 'formik';
+
+import { useIsEdgeAdmin } from '@/react/hooks/useUser';
+
+import { FormSectionTitle } from '@@/form-components/FormSectionTitle';
+import { SwitchField } from '@@/form-components/SwitchField';
+
+import { EditDetails } from '../EditDetails';
+import { ResourceControlOwnership, AccessControlFormData } from '../types';
+import { EnvironmentId } from '../../environments/types';
+
+export interface Props {
+  values: AccessControlFormData;
+  onChange(values: AccessControlFormData): void;
+  hideTitle?: boolean;
+  formNamespace?: string;
+  errors?: FormikErrors<AccessControlFormData>;
+  environmentId: EnvironmentId;
+}
+
+export function AccessControlForm({
+  values,
+  onChange,
+  hideTitle,
+  formNamespace,
+  errors,
+  environmentId,
+}: Props) {
+  const isAdminQuery = useIsEdgeAdmin();
+
+  if (isAdminQuery.isLoading) {
+    return null;
+  }
+
+  const { isAdmin } = isAdminQuery;
+
+  const accessControlEnabled =
+    values.ownership !== ResourceControlOwnership.PUBLIC;
+  return (
+    <>
+      {!hideTitle && <FormSectionTitle>Access control</FormSectionTitle>}
+
+      <div className="form-group">
+        <div className="col-sm-12">
+          <SwitchField
+            data-cy="portainer-accessMgmtToggle"
+            checked={accessControlEnabled}
+            name={withNamespace('accessControlEnabled')}
+            label="Enable access control"
+            labelClass="col-sm-3 col-lg-2"
+            tooltip="When enabled, you can restrict the access and management of this resource."
+            onChange={handleToggleEnable}
+          />
+        </div>
+      </div>
+
+      {accessControlEnabled && (
+        <EditDetails
+          onChange={onChange}
+          values={values}
+          errors={errors}
+          formNamespace={formNamespace}
+          environmentId={environmentId}
+        />
+      )}
+    </>
+  );
+
+  function withNamespace(name: string) {
+    return formNamespace ? `${formNamespace}.${name}` : name;
+  }
+
+  function handleToggleEnable(accessControlEnabled: boolean) {
+    let ownership = ResourceControlOwnership.PUBLIC;
+    if (accessControlEnabled) {
+      ownership = isAdmin
+        ? ResourceControlOwnership.ADMINISTRATORS
+        : ResourceControlOwnership.PRIVATE;
+    }
+    onChange({ ...values, ownership });
+  }
+}
diff --git a/app/react/portainer/access-control/AccessControlForm/AccessControlForm.validation.test.ts b/app/react/portainer/access-control/AccessControlForm/AccessControlForm.validation.test.ts
new file mode 100644
index 0000000..483c2e4
--- /dev/null
+++ b/app/react/portainer/access-control/AccessControlForm/AccessControlForm.validation.test.ts
@@ -0,0 +1,82 @@
+import { ResourceControlOwnership } from '../types';
+
+import { validationSchema } from './AccessControlForm.validation';
+
+test('when ownership not restricted, should be valid', async () => {
+  const schema = validationSchema(true);
+  [
+    ResourceControlOwnership.ADMINISTRATORS,
+    ResourceControlOwnership.PRIVATE,
+    ResourceControlOwnership.PUBLIC,
+  ].forEach(async (ownership) => {
+    const object = { ownership };
+
+    await expect(
+      schema.validate(object, { strict: true })
+    ).resolves.toStrictEqual(object);
+  });
+});
+
+test('when ownership is restricted and no teams or users, should be invalid', async () => {
+  [true, false].forEach(async (isAdmin) => {
+    const schema = validationSchema(isAdmin);
+
+    await expect(
+      schema.validate(
+        {
+          ownership: ResourceControlOwnership.RESTRICTED,
+          authorizedTeams: [],
+          authorizedUsers: [],
+        },
+        { strict: true }
+      )
+    ).rejects.toThrowErrorMatchingSnapshot();
+  });
+});
+
+test('when ownership is restricted, and the user is admin should have either teams or users', async () => {
+  const schema = validationSchema(true);
+  const teams = {
+    ownership: ResourceControlOwnership.RESTRICTED,
+    authorizedTeams: [1],
+    authorizedUsers: [],
+  };
+
+  await expect(schema.validate(teams, { strict: true })).resolves.toStrictEqual(
+    teams
+  );
+
+  const users = {
+    ownership: ResourceControlOwnership.RESTRICTED,
+    authorizedTeams: [],
+    authorizedUsers: [1],
+  };
+
+  await expect(schema.validate(users, { strict: true })).resolves.toStrictEqual(
+    users
+  );
+
+  const both = {
+    ownership: ResourceControlOwnership.RESTRICTED,
+    authorizedTeams: [1],
+    authorizedUsers: [2],
+  };
+
+  await expect(schema.validate(both, { strict: true })).resolves.toStrictEqual(
+    both
+  );
+});
+
+test('when  ownership is restricted, user is not admin with teams, should be valid', async () => {
+  const schema = validationSchema(false);
+
+  const object = {
+    ownership: ResourceControlOwnership.RESTRICTED,
+    authorizedTeams: [1],
+    authorizedUsers: [],
+  };
+
+  await expect(
+    schema.validate(object, { strict: true })
+  ).resolves.toStrictEqual(object);
+});
diff --git a/app/react/portainer/access-control/AccessControlForm/AccessControlForm.validation.ts b/app/react/portainer/access-control/AccessControlForm/AccessControlForm.validation.ts
new file mode 100644
index 0000000..d15cd22
--- /dev/null
+++ b/app/react/portainer/access-control/AccessControlForm/AccessControlForm.validation.ts
@@ -0,0 +1,37 @@
+import { object, mixed, array, number, SchemaOf } from 'yup';
+
+import { AccessControlFormData, ResourceControlOwnership } from '../types';
+
+export function validationSchema(
+  isAdmin: boolean
+): SchemaOf<AccessControlFormData> {
+  return object()
+    .shape({
+      ownership: mixed<ResourceControlOwnership>()
+        .oneOf(Object.values(ResourceControlOwnership))
+        .required(),
+      authorizedUsers: array(number().default(0)),
+      authorizedTeams: array(number().default(0)),
+    })
+    .test(
+      'user-and-team',
+      isAdmin
+        ? 'You must specify at least one team or user.'
+        : 'You must specify at least one team.',
+      ({ ownership, authorizedTeams, authorizedUsers }) => {
+        if (ownership !== ResourceControlOwnership.RESTRICTED) {
+          return true;
+        }
+
+        if (!isAdmin) {
+          return !!authorizedTeams && authorizedTeams.length > 0;
+        }
+
+        return (
+          !!authorizedTeams &&
+          !!authorizedUsers &&
+          (authorizedTeams.length > 0 || authorizedUsers.length > 0)
+        );
+      }
+    );
+}
diff --git a/app/react/portainer/access-control/AccessControlForm/__snapshots__/AccessControlForm.validation.test.ts.snap b/app/react/portainer/access-control/AccessControlForm/__snapshots__/AccessControlForm.validation.test.ts.snap
new file mode 100644
index 0000000..dff9209
--- /dev/null
+++ b/app/react/portainer/access-control/AccessControlForm/__snapshots__/AccessControlForm.validation.test.ts.snap
@@ -0,0 +1,5 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`when ownership is restricted and no teams or users, should be invalid 1`] = `[ValidationError: You must specify at least one team or user.]`;
+
+exports[`when ownership is restricted and no teams or users, should be invalid 2`] = `[ValidationError: You must specify at least one team.]`;
diff --git a/app/react/portainer/access-control/AccessControlForm/index.ts b/app/react/portainer/access-control/AccessControlForm/index.ts
new file mode 100644
index 0000000..e36066e
--- /dev/null
+++ b/app/react/portainer/access-control/AccessControlForm/index.ts
@@ -0,0 +1,2 @@
+export { AccessControlForm } from './AccessControlForm';
+export { validationSchema as accessControlFormValidation } from './AccessControlForm.validation';
diff --git a/app/react/portainer/access-control/AccessControlPanel/AccessControlPaneDetails.test.tsx b/app/react/portainer/access-control/AccessControlPanel/AccessControlPaneDetails.test.tsx
new file mode 100644
index 0000000..254844d
--- /dev/null
+++ b/app/react/portainer/access-control/AccessControlPanel/AccessControlPaneDetails.test.tsx
@@ -0,0 +1,177 @@
+import _ from 'lodash';
+import { http, HttpResponse } from 'msw';
+import { render } from '@testing-library/react';
+
+import { createMockTeams, createMockUsers } from '@/react-tools/test-mocks';
+import { server } from '@/setup-tests/server';
+import { Role } from '@/portainer/users/types';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+
+import {
+  ResourceControlOwnership,
+  ResourceControlType,
+  TeamResourceAccess,
+  UserResourceAccess,
+} from '../types';
+import { ResourceControlViewModel } from '../models/ResourceControlViewModel';
+
+import { AccessControlPanelDetails } from './AccessControlPanelDetails';
+
+test.each([
+  [ResourceControlOwnership.ADMINISTRATORS],
+  [ResourceControlOwnership.PRIVATE],
+  [ResourceControlOwnership.PUBLIC],
+  [ResourceControlOwnership.RESTRICTED],
+])(
+  'when resource control with ownership %s is supplied, show its ownership',
+  async (ownership) => {
+    const resourceControl = buildViewModel(ownership);
+    const { queryByLabelText } = await renderComponent(
+      ResourceControlType.Container,
+      resourceControl
+    );
+
+    expect(queryByLabelText('ownership')).toHaveTextContent(ownership);
+  }
+);
+
+test('when resource control is not supplied, show administrators', async () => {
+  const { queryByLabelText } = await renderComponent(
+    ResourceControlType.Container
+  );
+
+  expect(queryByLabelText('ownership')).toHaveTextContent(
+    ResourceControlOwnership.ADMINISTRATORS
+  );
+});
+
+const inheritanceTests = [
+  {
+    resourceType: ResourceControlType.Container,
+    parentType: ResourceControlType.Service,
+  },
+  {
+    resourceType: ResourceControlType.Volume,
+    parentType: ResourceControlType.Container,
+  },
+  ...[
+    ResourceControlType.Config,
+    ResourceControlType.Container,
+    ResourceControlType.Network,
+    ResourceControlType.Secret,
+    ResourceControlType.Service,
+    ResourceControlType.Volume,
+  ].map((resourceType) => ({
+    resourceType,
+    parentType: ResourceControlType.Stack,
+  })),
+];
+
+for (let i = 0; i < inheritanceTests.length; i += 1) {
+  const { resourceType, parentType } = inheritanceTests[i];
+  test(`when resource is ${ResourceControlType[resourceType]} and resource control is ${ResourceControlType[parentType]}, show message`, async () => {
+    const resourceControl = buildViewModel(
+      ResourceControlOwnership.ADMINISTRATORS,
+      parentType
+    );
+
+    const { queryByLabelText } = await renderComponent(
+      resourceType,
+      resourceControl
+    );
+    const inheritanceMessage = queryByLabelText('inheritance-message');
+    expect(inheritanceMessage).toBeVisible();
+  });
+}
+
+test('when resource is limited to specific users, show number of users', async () => {
+  const users = createMockUsers(10, Role.Standard);
+
+  server.use(http.get('/api/users', () => HttpResponse.json(users)));
+
+  const restrictedToUsers = _.sampleSize(users, 3);
+
+  const resourceControl = buildViewModel(
+    ResourceControlOwnership.RESTRICTED,
+    ResourceControlType.Service,
+    restrictedToUsers.map((user) => ({
+      UserId: user.Id,
+      AccessLevel: 1,
+    }))
+  );
+
+  const { queryByText, findByLabelText } = await renderComponent(
+    undefined,
+    resourceControl
+  );
+
+  expect(queryByText(/Authorized users/)).toBeVisible();
+
+  await expect(findByLabelText('authorized-users')).resolves.toHaveTextContent(
+    `${restrictedToUsers.length} users`
+  );
+});
+
+test('when resource is limited to specific teams, show comma separated list of their names', async () => {
+  const teams = createMockTeams(10);
+
+  server.use(http.get('/api/teams', () => HttpResponse.json(teams)));
+
+  const restrictedToTeams = _.sampleSize(teams, 3);
+
+  const resourceControl = buildViewModel(
+    ResourceControlOwnership.RESTRICTED,
+    ResourceControlType.Config,
+    [],
+    restrictedToTeams.map((team) => ({
+      TeamId: team.Id,
+      AccessLevel: 1,
+    }))
+  );
+
+  const { queryByText, findByLabelText } = await renderComponent(
+    undefined,
+    resourceControl
+  );
+
+  expect(queryByText(/Authorized teams/)).toBeVisible();
+
+  await expect(findByLabelText('authorized-teams')).resolves.toHaveTextContent(
+    restrictedToTeams.map((team) => team.Name).join(', ')
+  );
+});
+
+async function renderComponent(
+  resourceType: ResourceControlType = ResourceControlType.Container,
+  resourceControl?: ResourceControlViewModel
+) {
+  const Wrapped = withTestQueryProvider(
+    withTestRouter(withUserProvider(AccessControlPanelDetails))
+  );
+  const queries = render(
+    <Wrapped resourceControl={resourceControl} resourceType={resourceType} />
+  );
+  await expect(queries.findByText('Ownership')).resolves.toBeVisible();
+
+  return queries;
+}
+
+function buildViewModel(
+  ownership: ResourceControlOwnership,
+  type: ResourceControlType = ResourceControlType.Config,
+  users: UserResourceAccess[] = [],
+  teams: TeamResourceAccess[] = []
+): ResourceControlViewModel {
+  return {
+    Id: 0,
+    Public: false,
+    ResourceId: 0,
+    System: false,
+    TeamAccesses: teams,
+    Ownership: ownership,
+    Type: type,
+    UserAccesses: users,
+  };
+}
diff --git a/app/react/portainer/access-control/AccessControlPanel/AccessControlPanel.tsx b/app/react/portainer/access-control/AccessControlPanel/AccessControlPanel.tsx
new file mode 100644
index 0000000..02d8cfe
--- /dev/null
+++ b/app/react/portainer/access-control/AccessControlPanel/AccessControlPanel.tsx
@@ -0,0 +1,170 @@
+import { useReducer } from 'react';
+import { Edit, Eye } from 'lucide-react';
+
+import { Icon } from '@/react/components/Icon';
+import { TeamMembership, TeamRole } from '@/react/portainer/users/teams/types';
+import {
+  useIsCurrentUserTeamLeader,
+  useUserMembership,
+} from '@/portainer/users/queries';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { useCurrentUser, useIsEdgeAdmin } from '@/react/hooks/useUser';
+
+import { TableContainer, TableTitle } from '@@/datatables';
+import { Button } from '@@/buttons';
+
+import { ResourceControlType, ResourceId } from '../types';
+import { ResourceControlViewModel } from '../models/ResourceControlViewModel';
+
+import { AccessControlPanelDetails } from './AccessControlPanelDetails';
+import { AccessControlPanelForm } from './AccessControlPanelForm';
+
+interface Props {
+  resourceControl?: ResourceControlViewModel;
+  resourceType: ResourceControlType;
+  resourceId: ResourceId;
+  environmentId: EnvironmentId;
+  disableOwnershipChange?: boolean;
+  onUpdateSuccess(): Promise<void>;
+  resourceName?: string;
+}
+
+export function AccessControlPanel({
+  resourceControl,
+  resourceType,
+  disableOwnershipChange,
+  resourceId,
+  environmentId,
+  onUpdateSuccess,
+  resourceName = 'resource',
+}: Props) {
+  const [isEditMode, toggleEditMode] = useReducer((state) => !state, false);
+  const isAdminQuery = useIsEdgeAdmin();
+  const isTeamLeader = useIsCurrentUserTeamLeader();
+
+  const isInherited = checkIfInherited();
+
+  const restrictions = useRestrictions(resourceControl);
+
+  if (isAdminQuery.isLoading || !restrictions) {
+    return null;
+  }
+
+  const { isPartOfRestrictedUsers, isLeaderOfAnyRestrictedTeams } =
+    restrictions;
+
+  const { isAdmin } = isAdminQuery;
+
+  const isEditDisabled =
+    disableOwnershipChange ||
+    isInherited ||
+    (!isAdmin && !isPartOfRestrictedUsers && !isLeaderOfAnyRestrictedTeams);
+
+  return (
+    <TableContainer>
+      <TableTitle label="Access control" icon={Eye} />
+      <AccessControlPanelDetails
+        resourceName={resourceName}
+        resourceType={resourceType}
+        resourceControl={resourceControl}
+        isAuthorisedToFetchUsers={isAdmin || isTeamLeader}
+      />
+
+      {!isEditDisabled && !isEditMode && (
+        <div className="row">
+          <div>
+            <Button
+              color="link"
+              onClick={toggleEditMode}
+              data-cy="change-ownership-button"
+            >
+              <Icon icon={Edit} className="space-right" />
+              Change ownership
+            </Button>
+          </div>
+        </div>
+      )}
+
+      {isEditMode && (
+        <AccessControlPanelForm
+          resourceControl={resourceControl}
+          onCancelClick={() => toggleEditMode()}
+          resourceId={resourceId}
+          resourceType={resourceType}
+          environmentId={environmentId}
+          onUpdateSuccess={handleUpdateSuccess}
+        />
+      )}
+    </TableContainer>
+  );
+
+  async function handleUpdateSuccess() {
+    await onUpdateSuccess();
+    toggleEditMode();
+  }
+
+  function checkIfInherited() {
+    if (!resourceControl) {
+      return false;
+    }
+
+    const inheritedVolume =
+      resourceControl.Type === ResourceControlType.Container &&
+      resourceType === ResourceControlType.Volume;
+    const inheritedContainer =
+      resourceControl.Type === ResourceControlType.Service &&
+      resourceType === ResourceControlType.Container;
+    const inheritedFromStack =
+      resourceControl.Type === ResourceControlType.Stack &&
+      resourceType !== ResourceControlType.Stack;
+
+    return inheritedVolume || inheritedContainer || inheritedFromStack;
+  }
+}
+
+function useRestrictions(resourceControl?: ResourceControlViewModel) {
+  const { user } = useCurrentUser();
+  const isAdminQuery = useIsEdgeAdmin();
+  const memberships = useUserMembership(user.Id);
+
+  if (isAdminQuery.isLoading) {
+    return undefined;
+  }
+
+  const { isAdmin } = isAdminQuery;
+
+  if (!resourceControl || isAdmin) {
+    return {
+      isPartOfRestrictedUsers: false,
+      isLeaderOfAnyRestrictedTeams: false,
+    };
+  }
+
+  if (resourceControl.UserAccesses.some((ua) => ua.UserId === user.Id)) {
+    return {
+      isPartOfRestrictedUsers: true,
+      isLeaderOfAnyRestrictedTeams: false,
+    };
+  }
+
+  const isTeamLeader =
+    memberships.isSuccess &&
+    isLeaderOfAnyRestrictedTeams(memberships.data, resourceControl);
+
+  return {
+    isPartOfRestrictedUsers: false,
+    isLeaderOfAnyRestrictedTeams: isTeamLeader,
+  };
+}
+
+// returns true if user is a team leader and resource is limited to this team
+function isLeaderOfAnyRestrictedTeams(
+  userMemberships: TeamMembership[],
+  resourceControl: ResourceControlViewModel
+) {
+  return userMemberships.some(
+    (membership) =>
+      membership.Role === TeamRole.Leader &&
+      resourceControl.TeamAccesses.some((ta) => ta.TeamId === membership.TeamID)
+  );
+}
diff --git a/app/react/portainer/access-control/AccessControlPanel/AccessControlPanelDetails.tsx b/app/react/portainer/access-control/AccessControlPanel/AccessControlPanelDetails.tsx
new file mode 100644
index 0000000..1259b82
--- /dev/null
+++ b/app/react/portainer/access-control/AccessControlPanel/AccessControlPanelDetails.tsx
@@ -0,0 +1,257 @@
+import clsx from 'clsx';
+import { PropsWithChildren } from 'react';
+import _ from 'lodash';
+import { Info } from 'lucide-react';
+
+import { truncate } from '@/portainer/filters/filters';
+import { UserId } from '@/portainer/users/types';
+import { TeamId } from '@/react/portainer/users/teams/types';
+import { useTeams } from '@/react/portainer/users/teams/queries';
+import { useUsers } from '@/portainer/users/queries';
+import { pluralize } from '@/portainer/helpers/strings';
+import { ownershipIcon } from '@/react/docker/components/datatable/createOwnershipColumn';
+
+import { Link } from '@@/Link';
+import { Tooltip } from '@@/Tip/Tooltip';
+import { Icon } from '@@/Icon';
+
+import {
+  ResourceControlOwnership,
+  ResourceControlType,
+  ResourceId,
+} from '../types';
+import { ResourceControlViewModel } from '../models/ResourceControlViewModel';
+
+interface Props {
+  resourceControl?: ResourceControlViewModel;
+  resourceType?: ResourceControlType;
+  isAuthorisedToFetchUsers?: boolean;
+  resourceName?: string;
+}
+
+export function AccessControlPanelDetails({
+  resourceControl,
+  resourceType,
+  isAuthorisedToFetchUsers = false,
+  resourceName = 'resource',
+}: Props) {
+  const inheritanceMessage = getInheritanceMessage(
+    resourceType,
+    resourceControl
+  );
+
+  const {
+    Ownership: ownership = ResourceControlOwnership.ADMINISTRATORS,
+    UserAccesses: restrictedToUsers = [],
+    TeamAccesses: restrictedToTeams = [],
+  } = resourceControl || {};
+
+  const users = useAuthorizedUsers(
+    restrictedToUsers.map((ra) => ra.UserId),
+    isAuthorisedToFetchUsers
+  );
+  const teams = useAuthorizedTeams(restrictedToTeams.map((ra) => ra.TeamId));
+
+  const teamsLength = teams.data ? teams.data.length : 0;
+  const unauthoisedTeams = restrictedToTeams.length - teamsLength;
+
+  let teamsMessage = teams.data && teams.data.join(', ');
+  if (unauthoisedTeams > 0 && teams.isFetched) {
+    teamsMessage += teamsLength > 0 ? ' and' : '';
+    teamsMessage += ` ${unauthoisedTeams} ${pluralize(
+      unauthoisedTeams,
+      'team'
+    )} you are not part of`;
+  }
+
+  const userMessage = users.data
+    ? users.data.join(', ')
+    : `${restrictedToUsers.length} ${pluralize(
+        restrictedToUsers.length,
+        'user'
+      )}`;
+
+  return (
+    <table className="table">
+      <tbody>
+        <tr data-cy="access-ownership">
+          <td className="w-1/5">Ownership</td>
+          <td>
+            <i
+              className={clsx(ownershipIcon(ownership), 'space-right')}
+              aria-hidden="true"
+              aria-label="ownership-icon"
+            />
+            <span aria-label="ownership">{ownership}</span>
+            <Tooltip message={getOwnershipTooltip(ownership, resourceName)} />
+          </td>
+        </tr>
+        {inheritanceMessage}
+        {restrictedToUsers.length > 0 && (
+          <tr data-cy="access-authorisedUsers">
+            <td>Authorized users</td>
+            <td aria-label="authorized-users">{userMessage}</td>
+          </tr>
+        )}
+        {restrictedToTeams.length > 0 && (
+          <tr data-cy="access-authorisedTeams">
+            <td>Authorized teams</td>
+            <td aria-label="authorized-teams">{teamsMessage}</td>
+          </tr>
+        )}
+      </tbody>
+    </table>
+  );
+}
+
+function getOwnershipTooltip(
+  ownership: ResourceControlOwnership,
+  resourceName: string
+) {
+  switch (ownership) {
+    case ResourceControlOwnership.PRIVATE:
+      return `Management of this ${resourceName} is restricted to a single user.`;
+    case ResourceControlOwnership.RESTRICTED:
+      return `This ${resourceName} can be managed by a restricted set of users and/or teams.`;
+    case ResourceControlOwnership.PUBLIC:
+      return `This ${resourceName} can be managed by any user with access to this environment.`;
+    case ResourceControlOwnership.ADMINISTRATORS:
+    default:
+      return `This ${resourceName} can only be managed by administrators.`;
+  }
+}
+
+function getInheritanceMessage(
+  resourceType: ResourceControlType | undefined,
+  resourceControl?: ResourceControlViewModel
+) {
+  if (!resourceControl || resourceControl.Type === resourceType) {
+    return null;
+  }
+
+  const parentType = resourceControl.Type;
+  const resourceId = resourceControl.ResourceId;
+
+  if (
+    resourceType === ResourceControlType.Container &&
+    parentType === ResourceControlType.Service
+  ) {
+    return (
+      <InheritanceMessage tooltip="Access control applied on a service is also applied on each container of that service.">
+        Access control on this resource is inherited from the following service:
+        <Link
+          to="docker.services.service"
+          params={{ id: resourceId }}
+          data-cy="docker-access-inherited-service"
+          title={String(resourceId)}
+        >
+          {truncate(resourceId)}
+        </Link>
+      </InheritanceMessage>
+    );
+  }
+
+  if (
+    resourceType === ResourceControlType.Volume &&
+    parentType === ResourceControlType.Container
+  ) {
+    return (
+      <InheritanceMessage tooltip="Access control applied on a container created using a template is also applied on each volume associated to the container.">
+        Access control on this resource is inherited from the following
+        container:
+        <Link
+          to="docker.containers.container"
+          params={{ id: resourceId }}
+          data-cy="docker-access-inherited-container"
+          title={String(resourceId)}
+        >
+          {truncate(resourceId)}
+        </Link>
+      </InheritanceMessage>
+    );
+  }
+
+  if (parentType === ResourceControlType.Stack) {
+    return (
+      <InheritanceMessage tooltip="Access control applied on a stack is also applied on each resource in the stack.">
+        <span className="space-right">
+          Access control on this resource is inherited from the following stack:
+        </span>
+        {removeEndpointIdFromStackResourceId(resourceId)}
+      </InheritanceMessage>
+    );
+  }
+
+  return null;
+}
+
+function removeEndpointIdFromStackResourceId(stackName: ResourceId) {
+  if (!stackName || typeof stackName !== 'string') {
+    return stackName;
+  }
+
+  const firstUnderlineIndex = stackName.indexOf('_');
+  if (firstUnderlineIndex < 0) {
+    return stackName;
+  }
+  return stackName.substring(firstUnderlineIndex + 1);
+}
+
+interface InheritanceMessageProps {
+  tooltip: string;
+}
+
+function InheritanceMessage({
+  children,
+  tooltip,
+}: PropsWithChildren<InheritanceMessageProps>) {
+  return (
+    <tr>
+      <td colSpan={2} aria-label="inheritance-message">
+        <div className="inline-flex items-center gap-1">
+          <Icon icon={Info} mode="primary" />
+          {children}
+        </div>
+        <Tooltip message={tooltip} />
+      </td>
+    </tr>
+  );
+}
+
+function useAuthorizedTeams(authorizedTeamIds: TeamId[]) {
+  return useTeams(false, 0, {
+    enabled: authorizedTeamIds.length > 0,
+    select: (teams) => {
+      if (authorizedTeamIds.length === 0) {
+        return [];
+      }
+
+      return _.compact(
+        authorizedTeamIds.map((id) => {
+          const team = teams.find((u) => u.Id === id);
+          return team?.Name;
+        })
+      );
+    },
+  });
+}
+
+function useAuthorizedUsers(authorizedUserIds: UserId[], enabled = true) {
+  return useUsers(
+    false,
+    0,
+    authorizedUserIds.length > 0 && enabled,
+    (users) => {
+      if (authorizedUserIds.length === 0) {
+        return [];
+      }
+
+      return _.compact(
+        authorizedUserIds.map((id) => {
+          const user = users.find((u) => u.Id === id);
+          return user?.Username;
+        })
+      );
+    }
+  );
+}
diff --git a/app/react/portainer/access-control/AccessControlPanel/AccessControlPanelForm.module.css b/app/react/portainer/access-control/AccessControlPanel/AccessControlPanelForm.module.css
new file mode 100644
index 0000000..d722449
--- /dev/null
+++ b/app/react/portainer/access-control/AccessControlPanel/AccessControlPanelForm.module.css
@@ -0,0 +1,3 @@
+.form {
+  padding: 0 20px;
+}
diff --git a/app/react/portainer/access-control/AccessControlPanel/AccessControlPanelForm.tsx b/app/react/portainer/access-control/AccessControlPanel/AccessControlPanelForm.tsx
new file mode 100644
index 0000000..5f3ac56
--- /dev/null
+++ b/app/react/portainer/access-control/AccessControlPanel/AccessControlPanelForm.tsx
@@ -0,0 +1,157 @@
+import { Form, Formik } from 'formik';
+import clsx from 'clsx';
+import { useMutation } from '@tanstack/react-query';
+import { object } from 'yup';
+
+import { useCurrentUser, useIsEdgeAdmin } from '@/react/hooks/useUser';
+import { notifySuccess } from '@/portainer/services/notifications';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { confirm } from '@@/modals/confirm';
+import { Button } from '@@/buttons';
+import { LoadingButton } from '@@/buttons/LoadingButton';
+import { buildConfirmButton } from '@@/modals/utils';
+import { ModalType } from '@@/modals';
+
+import { EditDetails } from '../EditDetails';
+import { parseAccessControlFormData } from '../utils';
+import { validationSchema } from '../AccessControlForm/AccessControlForm.validation';
+import { applyResourceControlChange } from '../access-control.service';
+import {
+  ResourceControlType,
+  ResourceId,
+  AccessControlFormData,
+} from '../types';
+import { ResourceControlViewModel } from '../models/ResourceControlViewModel';
+
+import styles from './AccessControlPanelForm.module.css';
+
+interface Props {
+  resourceType: ResourceControlType;
+  resourceId: ResourceId;
+  resourceControl?: ResourceControlViewModel;
+  environmentId: EnvironmentId;
+  onCancelClick(): void;
+  onUpdateSuccess(): Promise<void>;
+}
+
+export function AccessControlPanelForm({
+  resourceId,
+  resourceType,
+  resourceControl,
+  environmentId,
+  onCancelClick,
+  onUpdateSuccess,
+}: Props) {
+  const { user } = useCurrentUser();
+  const isAdminQuery = useIsEdgeAdmin();
+
+  const updateAccess = useMutation(
+    (variables: AccessControlFormData) =>
+      applyResourceControlChange(
+        resourceType,
+        resourceId,
+        variables,
+        resourceControl
+      ),
+    {
+      meta: {
+        error: { title: 'Failure', message: 'Unable to update access control' },
+      },
+      onSuccess() {
+        return onUpdateSuccess();
+      },
+    }
+  );
+
+  if (isAdminQuery.isLoading) {
+    return null;
+  }
+
+  const { isAdmin } = isAdminQuery;
+
+  const initialValues = {
+    accessControl: parseAccessControlFormData(
+      isAdmin,
+      user.Id,
+      resourceControl
+    ),
+  };
+
+  return (
+    <Formik
+      initialValues={initialValues}
+      onSubmit={handleSubmit}
+      validateOnMount
+      validateOnChange
+      validationSchema={() =>
+        object({ accessControl: validationSchema(isAdmin) })
+      }
+    >
+      {({ setFieldValue, values, isSubmitting, isValid, errors }) => (
+        <Form className={clsx('form-horizontal', styles.form)}>
+          <EditDetails
+            onChange={(accessControl) =>
+              setFieldValue('accessControl', accessControl)
+            }
+            values={values.accessControl}
+            isPublicVisible
+            errors={errors.accessControl}
+            environmentId={environmentId}
+          />
+
+          <div className="form-group">
+            <div className="col-sm-12">
+              <Button
+                size="small"
+                color="default"
+                onClick={onCancelClick}
+                data-cy="cancel-access-control-update-button"
+              >
+                Cancel
+              </Button>
+              <LoadingButton
+                size="small"
+                data-cy="update-access-control-button"
+                color="primary"
+                type="submit"
+                isLoading={isSubmitting}
+                disabled={!isValid}
+                loadingText="Updating Ownership"
+              >
+                Update Ownership
+              </LoadingButton>
+            </div>
+          </div>
+        </Form>
+      )}
+    </Formik>
+  );
+
+  async function handleSubmit({
+    accessControl,
+  }: {
+    accessControl: AccessControlFormData;
+  }) {
+    const confirmed = await confirmAccessControlUpdate();
+    if (!confirmed) {
+      return;
+    }
+
+    updateAccess.mutate(accessControl, {
+      onSuccess() {
+        notifySuccess('Success', 'Access control successfully updated');
+      },
+    });
+  }
+}
+
+function confirmAccessControlUpdate() {
+  return confirm({
+    modalType: ModalType.Warn,
+    title: 'Are you sure?',
+    message:
+      'Changing the ownership of this resource will potentially restrict its management to some users.',
+    confirmButton: buildConfirmButton('Change ownership'),
+  });
+}
diff --git a/app/react/portainer/access-control/AccessControlPanel/index.ts b/app/react/portainer/access-control/AccessControlPanel/index.ts
new file mode 100644
index 0000000..8401b7c
--- /dev/null
+++ b/app/react/portainer/access-control/AccessControlPanel/index.ts
@@ -0,0 +1 @@
+export { AccessControlPanel } from './AccessControlPanel';
diff --git a/app/react/portainer/access-control/AccessManagement/AccessDatatable/AccessDatatable.test.tsx b/app/react/portainer/access-control/AccessManagement/AccessDatatable/AccessDatatable.test.tsx
new file mode 100644
index 0000000..0022246
--- /dev/null
+++ b/app/react/portainer/access-control/AccessManagement/AccessDatatable/AccessDatatable.test.tsx
@@ -0,0 +1,160 @@
+import { render, screen } from '@testing-library/react';
+import { vi } from 'vitest';
+
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+
+import { AccessDatatable } from './AccessDatatable';
+import { Access } from './types';
+
+vi.mock('@/react/portainer/feature-flags/feature-flags.service', () => ({
+  isBE: true,
+}));
+
+function createMockAccess(overrides: Partial<Access> = {}): Access {
+  return {
+    Id: 1,
+    Name: 'Test User',
+    Type: 'user',
+    Role: { Id: 1, Name: 'Admin' },
+    ...overrides,
+  } as Access;
+}
+
+function renderComponent(
+  props: Partial<Parameters<typeof AccessDatatable>[0]> = {}
+) {
+  const defaultProps = {
+    tableKey: 'test-access-table',
+    dataset: [],
+    onRemove: vi.fn(),
+    isUpdatingAccess: false,
+    isLoading: false,
+    onUpdate: vi.fn(),
+  };
+
+  const Wrapped = withTestQueryProvider(withTestRouter(AccessDatatable));
+  return render(<Wrapped {...defaultProps} {...props} />);
+}
+
+describe('AccessDatatable', () => {
+  describe('loading state', () => {
+    it('should show loading state when isLoading is true', () => {
+      renderComponent({
+        isLoading: true,
+        dataset: [],
+      });
+
+      expect(screen.getByLabelText('Access')).toBeVisible();
+      // Datatable shows loading indicator when isLoading is true
+      expect(screen.getByText('Loading...')).toBeVisible();
+    });
+
+    it('should not show loading state when isLoading is false', () => {
+      renderComponent({
+        isLoading: false,
+        dataset: [createMockAccess()],
+      });
+
+      expect(screen.queryByText('Loading...')).not.toBeInTheDocument();
+    });
+  });
+
+  describe('content display', () => {
+    it('should display access data in the table', () => {
+      const mockAccess = createMockAccess({ Name: 'John Doe' });
+      renderComponent({
+        isLoading: false,
+        dataset: [mockAccess],
+      });
+
+      expect(screen.getByText('John Doe')).toBeVisible();
+    });
+
+    it('should display empty state when dataset is empty and not loading', () => {
+      renderComponent({
+        isLoading: false,
+        dataset: [],
+      });
+
+      expect(screen.getByText('No items available.')).toBeVisible();
+    });
+
+    it('should render the datatable title', () => {
+      renderComponent({
+        isLoading: false,
+        dataset: [],
+      });
+
+      expect(screen.getByText('Access')).toBeVisible();
+    });
+  });
+
+  describe('inherited access', () => {
+    it('should show inherited access warning when inheritFrom is true', () => {
+      renderComponent({
+        isLoading: false,
+        dataset: [],
+        inheritFrom: true,
+      });
+
+      // Multiple "Access tagged as" divs are rendered (one for inherited, one for override)
+      const elements = screen.getAllByText(/Access tagged as/);
+      expect(elements.length).toBeGreaterThan(0);
+      expect(elements[0]).toBeVisible();
+    });
+  });
+
+  describe('update functionality', () => {
+    it('should render update button when isUpdateEnabled is true', () => {
+      const mockAccess = createMockAccess();
+      renderComponent({
+        isLoading: false,
+        isUpdateEnabled: true,
+        showRoles: true,
+        dataset: [mockAccess],
+      });
+
+      const updateButton = screen.getByRole('button', { name: /update/i });
+      expect(updateButton).toBeVisible();
+    });
+
+    it('should disable update button when no roles are changed', () => {
+      const mockAccess = createMockAccess();
+      renderComponent({
+        isLoading: false,
+        isUpdateEnabled: true,
+        showRoles: true,
+        dataset: [mockAccess],
+      });
+
+      const updateButton = screen.getByRole('button', { name: /update/i });
+      expect(updateButton).toBeDisabled();
+    });
+
+    it('should show "Updating..." text when isUpdatingAccess is true', () => {
+      const mockAccess = createMockAccess();
+      renderComponent({
+        isLoading: false,
+        isUpdatingAccess: true,
+        isUpdateEnabled: true,
+        showRoles: true,
+        dataset: [mockAccess],
+      });
+
+      expect(screen.getByText('Updating...')).toBeVisible();
+    });
+
+    it('should show warning text when showWarning and isUpdateEnabled are true', () => {
+      const mockAccess = createMockAccess();
+      renderComponent({
+        isLoading: false,
+        isUpdateEnabled: true,
+        showWarning: true,
+        dataset: [mockAccess],
+      });
+
+      expect(screen.getByText(/logout and login/i)).toBeVisible();
+    });
+  });
+});
diff --git a/app/react/portainer/access-control/AccessManagement/AccessDatatable/AccessDatatable.tsx b/app/react/portainer/access-control/AccessManagement/AccessDatatable/AccessDatatable.tsx
new file mode 100644
index 0000000..036bbad
--- /dev/null
+++ b/app/react/portainer/access-control/AccessManagement/AccessDatatable/AccessDatatable.tsx
@@ -0,0 +1,208 @@
+import { Check, UserX } from 'lucide-react';
+import { useMemo, useState } from 'react';
+import _ from 'lodash';
+
+import {
+  TeamAccessViewModel,
+  UserAccessViewModel,
+} from '@/portainer/models/access';
+import { isBE } from '@/react/portainer/feature-flags/feature-flags.service';
+
+import { Datatable } from '@@/datatables';
+import { createPersistedStore } from '@@/datatables/types';
+import { useTableState } from '@@/datatables/useTableState';
+import { withMeta } from '@@/datatables/extend-options/withMeta';
+import { LoadingButton } from '@@/buttons';
+import { TextTip } from '@@/Tip/TextTip';
+import { mergeOptions } from '@@/datatables/extend-options/mergeOptions';
+
+import { useColumns } from './columns/useColumns';
+import { Access } from './types';
+import { RemoveAccessButton } from './RemoveAccessButton';
+
+type Props = {
+  tableKey: string;
+  dataset?: Array<Access>;
+  onRemove(items: Array<Access>): void;
+  onUpdate(
+    users: Array<UserAccessViewModel>,
+    teams: Array<TeamAccessViewModel>
+  ): void;
+  showWarning?: boolean;
+  isUpdateEnabled?: boolean;
+  showRoles?: boolean;
+  inheritFrom?: boolean;
+  isUpdatingAccess: boolean;
+  isLoading: boolean;
+};
+
+export function AccessDatatable({
+  dataset,
+  tableKey,
+  onRemove,
+  onUpdate,
+  showWarning = false,
+  isUpdateEnabled = false,
+  showRoles = false,
+  inheritFrom = false,
+  isUpdatingAccess,
+  isLoading,
+}: Props) {
+  const columns = useColumns({ showRoles, inheritFrom });
+  const [store] = useState(() => createPersistedStore(tableKey));
+  const tableState = useTableState(store, tableKey);
+  const rolesState = useRolesState();
+
+  return (
+    <Datatable
+      data-cy="access-datatable"
+      title="Access"
+      titleIcon={UserX}
+      dataset={dataset || []}
+      isLoading={isLoading}
+      columns={columns}
+      settingsManager={tableState}
+      getRowId={(row) => `${row.Type}-${row.Id}`}
+      extendTableOptions={mergeOptions(
+        withMeta({
+          table: 'access-table',
+          roles: rolesState,
+        })
+      )}
+      isRowSelectable={({ original: item }) => !inheritFrom || !item.Inherited}
+      renderTableActions={(selectedItems) => (
+        <>
+          <RemoveAccessButton items={selectedItems} onClick={onRemove} />
+
+          {isBE && isUpdateEnabled && (
+            <LoadingButton
+              data-cy="update-access-button"
+              icon={Check}
+              disabled={rolesState.count === 0}
+              onClick={handleUpdate}
+              isLoading={isUpdatingAccess}
+              loadingText="Updating..."
+            >
+              Update
+            </LoadingButton>
+          )}
+        </>
+      )}
+      description={
+        <>
+          {inheritFrom && (
+            <div className="small text-muted">
+              <div>
+                Access tagged as <code>inherited</code> are inherited from the
+                group access. They cannot be removed or modified at the
+                environment level but they can be overridden.
+              </div>
+              <div>
+                Access tagged as <code>override</code> are overriding the group
+              </div>
+            </div>
+          )}
+          {isBE && showWarning && isUpdateEnabled && (
+            <TextTip>
+              <div className="text-warning-9 th-highcontrast:text-warning-1 th-dark:text-warning-7">
+                Updating user access will require the affected user(s) to logout
+                and login for the changes to be taken into account.
+              </div>
+            </TextTip>
+          )}
+        </>
+      }
+    />
+  );
+
+  function handleUpdate() {
+    const update = rolesState.getUpdate();
+    const teamsAccess = getAccess(update.teams, 'team');
+    const usersAccess = getAccess(update.users, 'user');
+
+    onUpdate(usersAccess, teamsAccess);
+
+    function getAccess(
+      accesses: Record<number, number | undefined>,
+      type: 'team' | 'user'
+    ) {
+      return _.compact(
+        Object.entries(accesses).map(([strId, role]) => {
+          if (!strId || !role) {
+            return undefined;
+          }
+
+          const id = parseInt(strId, 10);
+          const entity = dataset?.find(
+            (item) => item.Type === type && item.Id === id
+          );
+          if (!entity) {
+            return undefined;
+          }
+
+          return {
+            ...entity,
+            Role: {
+              Id: role,
+              Name: '',
+            },
+          };
+        })
+      );
+    }
+  }
+}
+
+function useRolesState() {
+  const [teamRoles, setTeamRoles] = useState<
+    Record<number, number | undefined>
+  >({});
+  const [userRoles, setUserRoles] = useState<
+    Record<number, number | undefined>
+  >({});
+
+  const count = useMemo(
+    () => Object.keys(teamRoles).length + Object.keys(userRoles).length,
+    [teamRoles, userRoles]
+  );
+
+  return { getRoleValue, setRolesValue, getUpdate, count };
+
+  function getRoleValue(id: number, entity: 'user' | 'team') {
+    if (entity === 'team') {
+      return teamRoles[id];
+    }
+    return userRoles[id];
+  }
+
+  function setRolesValue(
+    id: number,
+    entity: 'user' | 'team',
+    value: number | undefined
+  ) {
+    if (entity === 'team') {
+      setTeamRoles(updater);
+
+      return;
+    }
+
+    setUserRoles(updater);
+
+    function updater(roles: Record<number, number | undefined>) {
+      const newRoles = { ...roles };
+      if (typeof value === 'undefined') {
+        delete newRoles[id];
+      } else {
+        newRoles[id] = value;
+      }
+      return newRoles;
+    }
+  }
+
+  function getUpdate() {
+    return {
+      users: userRoles,
+      teams: teamRoles,
+    };
+  }
+}
diff --git a/app/react/portainer/access-control/AccessManagement/AccessDatatable/RemoveAccessButton.test.tsx b/app/react/portainer/access-control/AccessManagement/AccessDatatable/RemoveAccessButton.test.tsx
new file mode 100644
index 0000000..fde0663
--- /dev/null
+++ b/app/react/portainer/access-control/AccessManagement/AccessDatatable/RemoveAccessButton.test.tsx
@@ -0,0 +1,100 @@
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { vi } from 'vitest';
+
+import { RemoveAccessButton } from './RemoveAccessButton';
+import { Access } from './types';
+
+function createMockAccess(overrides: Partial<Access> = {}): Access {
+  return {
+    Id: 1,
+    Name: 'Test User',
+    Type: 'user',
+    Role: { Id: 1, Name: 'Admin' },
+    ...overrides,
+  } as Access;
+}
+
+describe('RemoveAccessButton', () => {
+  describe('loading state', () => {
+    it('should show loading indicator when isLoading is true', () => {
+      const mockAccess = createMockAccess();
+      render(
+        <RemoveAccessButton onClick={vi.fn()} items={[mockAccess]} isLoading />
+      );
+
+      // DeleteButton shows loading text when isLoading is true
+      expect(screen.getByText('Removing...')).toBeVisible();
+    });
+
+    it('should show "Remove" text when isLoading is false', () => {
+      const mockAccess = createMockAccess();
+      render(
+        <RemoveAccessButton
+          onClick={vi.fn()}
+          items={[mockAccess]}
+          isLoading={false}
+        />
+      );
+
+      expect(screen.getByText('Remove')).toBeVisible();
+      expect(screen.queryByText('Removing...')).not.toBeInTheDocument();
+    });
+
+    it('should show "Remove" text when isLoading is undefined', () => {
+      const mockAccess = createMockAccess();
+      render(<RemoveAccessButton onClick={vi.fn()} items={[mockAccess]} />);
+
+      expect(screen.getByText('Remove')).toBeVisible();
+    });
+  });
+
+  describe('disabled state', () => {
+    it('should be disabled when items array is empty', () => {
+      render(
+        <RemoveAccessButton onClick={vi.fn()} items={[]} isLoading={false} />
+      );
+
+      const button = screen.getByRole('button', { name: /remove/i });
+      expect(button).toBeDisabled();
+    });
+
+    it('should be enabled when items array has elements', () => {
+      const mockAccess = createMockAccess();
+      render(
+        <RemoveAccessButton
+          onClick={vi.fn()}
+          items={[mockAccess]}
+          isLoading={false}
+        />
+      );
+
+      const button = screen.getByRole('button', { name: /remove/i });
+      expect(button).not.toBeDisabled();
+    });
+  });
+
+  describe('click behavior', () => {
+    it('should open confirmation dialog when clicked', async () => {
+      const user = userEvent.setup();
+      const mockOnClick = vi.fn();
+      const mockAccess = createMockAccess();
+
+      render(
+        <RemoveAccessButton
+          onClick={mockOnClick}
+          items={[mockAccess]}
+          isLoading={false}
+        />
+      );
+
+      const button = screen.getByRole('button', { name: /remove/i });
+      await user.click(button);
+
+      // The confirm dialog should appear
+      expect(
+        screen.getByText(/are you sure you want to unauthorized/i)
+      ).toBeVisible();
+    });
+  });
+});
diff --git a/app/react/portainer/access-control/AccessManagement/AccessDatatable/RemoveAccessButton.tsx b/app/react/portainer/access-control/AccessManagement/AccessDatatable/RemoveAccessButton.tsx
new file mode 100644
index 0000000..325b73b
--- /dev/null
+++ b/app/react/portainer/access-control/AccessManagement/AccessDatatable/RemoveAccessButton.tsx
@@ -0,0 +1,23 @@
+import { DeleteButton } from '@@/buttons/DeleteButton';
+
+import { Access } from './types';
+
+export function RemoveAccessButton({
+  onClick,
+  items,
+  isLoading,
+}: {
+  onClick(items: Array<Access>): void;
+  items: Array<Access>;
+  isLoading?: boolean;
+}) {
+  return (
+    <DeleteButton
+      confirmMessage="Are you sure you want to unauthorized the selected users or teams?"
+      onConfirmed={() => onClick(items)}
+      disabled={items.length === 0}
+      data-cy="remove-access-button"
+      isLoading={isLoading}
+    />
+  );
+}
diff --git a/app/react/portainer/access-control/AccessManagement/AccessDatatable/columns/helper.ts b/app/react/portainer/access-control/AccessManagement/AccessDatatable/columns/helper.ts
new file mode 100644
index 0000000..8cd9c72
--- /dev/null
+++ b/app/react/portainer/access-control/AccessManagement/AccessDatatable/columns/helper.ts
@@ -0,0 +1,5 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { Access } from '../types';
+
+export const helper = createColumnHelper<Access>();
diff --git a/app/react/portainer/access-control/AccessManagement/AccessDatatable/columns/inheritedName.tsx b/app/react/portainer/access-control/AccessManagement/AccessDatatable/columns/inheritedName.tsx
new file mode 100644
index 0000000..537531d
--- /dev/null
+++ b/app/react/portainer/access-control/AccessManagement/AccessDatatable/columns/inheritedName.tsx
@@ -0,0 +1,22 @@
+import { helper } from './helper';
+
+export const inheritedName = helper.accessor('Name', {
+  cell({ row: { original: item }, getValue }) {
+    const name = getValue();
+    return (
+      <>
+        {name}
+        {item.Inherited && (
+          <span className="text-muted small">
+            <code className="text-sm">inherited</code>
+          </span>
+        )}
+        {item.Override && (
+          <span className="text-muted small">
+            <code className="text-sm">override</code>
+          </span>
+        )}
+      </>
+    );
+  },
+});
diff --git a/app/react/portainer/access-control/AccessManagement/AccessDatatable/columns/name.ts b/app/react/portainer/access-control/AccessManagement/AccessDatatable/columns/name.ts
new file mode 100644
index 0000000..9054a02
--- /dev/null
+++ b/app/react/portainer/access-control/AccessManagement/AccessDatatable/columns/name.ts
@@ -0,0 +1,3 @@
+import { helper } from './helper';
+
+export const name = helper.accessor('Name', {});
diff --git a/app/react/portainer/access-control/AccessManagement/AccessDatatable/columns/role.tsx b/app/react/portainer/access-control/AccessManagement/AccessDatatable/columns/role.tsx
new file mode 100644
index 0000000..32ecfb3
--- /dev/null
+++ b/app/react/portainer/access-control/AccessManagement/AccessDatatable/columns/role.tsx
@@ -0,0 +1,90 @@
+import { CellContext } from '@tanstack/react-table';
+import { Edit, X } from 'lucide-react';
+
+import { useRbacRoles } from '@/react/portainer/users/RolesView/useRbacRoles';
+
+import { Button } from '@@/buttons';
+import { Select } from '@@/form-components/Input';
+
+import { Access, getTableMeta } from '../types';
+
+import { helper } from './helper';
+
+export const role = helper.accessor('Role.Name', {
+  cell: RoleCell,
+  header: 'Role',
+  meta: {
+    width: 320,
+  },
+});
+
+function RoleCell({
+  row: { original: item, getCanSelect },
+  table,
+  getValue,
+}: CellContext<Access, string>) {
+  const meta = getTableMeta(table.options.meta);
+  const type = item.Type as 'team' | 'user';
+  const updateValue = meta.roles.getRoleValue(item.Id, type);
+  const role = getValue();
+
+  if (!getCanSelect()) {
+    return <>{role}</>;
+  }
+
+  if (typeof updateValue === 'undefined') {
+    return (
+      <>
+        {role}
+        <Button
+          color="none"
+          icon={Edit}
+          onClick={() => meta.roles.setRolesValue(item.Id, type, item.Role.Id)}
+          data-cy="edit-role-button"
+        >
+          Edit
+        </Button>
+      </>
+    );
+  }
+  return (
+    <RollEdit
+      value={updateValue}
+      onChange={(value) => meta.roles.setRolesValue(item.Id, type, value)}
+    />
+  );
+}
+
+function RollEdit({
+  value,
+  onChange,
+}: {
+  value: number;
+  onChange(value?: number): void;
+}) {
+  const rolesQuery = useRbacRoles({
+    select: (roles) => roles.map((r) => ({ label: r.Name, value: r.Id })),
+  });
+
+  if (!rolesQuery.data) {
+    return null;
+  }
+
+  return (
+    <div className="flex max-w-xs items-center gap-3">
+      <Select
+        aria-label="Role"
+        data-cy="role-select"
+        value={value}
+        options={rolesQuery.data}
+        onChange={(e) => onChange(parseInt(e.target.value, 10))}
+      />
+      <Button
+        color="none"
+        icon={X}
+        onClick={() => onChange()}
+        data-cy="cancel-role-button"
+      />
+    </div>
+  );
+}
diff --git a/app/react/portainer/access-control/AccessManagement/AccessDatatable/columns/type.ts b/app/react/portainer/access-control/AccessManagement/AccessDatatable/columns/type.ts
new file mode 100644
index 0000000..f295fd7
--- /dev/null
+++ b/app/react/portainer/access-control/AccessManagement/AccessDatatable/columns/type.ts
@@ -0,0 +1,3 @@
+import { helper } from './helper';
+
+export const type = helper.accessor('Type', {});
diff --git a/app/react/portainer/access-control/AccessManagement/AccessDatatable/columns/useColumns.ts b/app/react/portainer/access-control/AccessManagement/AccessDatatable/columns/useColumns.ts
new file mode 100644
index 0000000..1c74642
--- /dev/null
+++ b/app/react/portainer/access-control/AccessManagement/AccessDatatable/columns/useColumns.ts
@@ -0,0 +1,27 @@
+import _ from 'lodash';
+import { useMemo } from 'react';
+
+import { isBE } from '@/react/portainer/feature-flags/feature-flags.service';
+
+import { inheritedName } from './inheritedName';
+import { name } from './name';
+import { type } from './type';
+import { role } from './role';
+
+export function useColumns({
+  showRoles,
+  inheritFrom,
+}: {
+  showRoles: boolean;
+  inheritFrom: boolean;
+}) {
+  return useMemo(
+    () =>
+      _.compact([
+        inheritFrom ? inheritedName : name,
+        type,
+        isBE && showRoles && role,
+      ]),
+    [inheritFrom, showRoles]
+  );
+}
diff --git a/app/react/portainer/access-control/AccessManagement/AccessDatatable/types.ts b/app/react/portainer/access-control/AccessManagement/AccessDatatable/types.ts
new file mode 100644
index 0000000..d85ebd7
--- /dev/null
+++ b/app/react/portainer/access-control/AccessManagement/AccessDatatable/types.ts
@@ -0,0 +1,34 @@
+import {
+  TeamAccessViewModel,
+  UserAccessViewModel,
+} from '@/portainer/models/access';
+
+export type Access = UserAccessViewModel | TeamAccessViewModel;
+
+export interface TableMeta {
+  table: 'access-table';
+  roles: {
+    getRoleValue(id: number, entity: 'user' | 'team'): number | undefined;
+    setRolesValue(
+      id: number,
+      entity: 'user' | 'team',
+      value: number | undefined
+    ): void;
+  };
+}
+
+function isTableMeta(meta?: unknown): meta is TableMeta {
+  return (
+    !!meta &&
+    typeof meta === 'object' &&
+    'table' in meta &&
+    meta.table === 'access-table'
+  );
+}
+
+export function getTableMeta(meta: unknown) {
+  if (!isTableMeta(meta)) {
+    throw new Error('missing table meta');
+  }
+  return meta;
+}
diff --git a/app/react/portainer/access-control/AccessManagement/PorAccessManagementUsersSelector.test.tsx b/app/react/portainer/access-control/AccessManagement/PorAccessManagementUsersSelector.test.tsx
new file mode 100644
index 0000000..bde6309
--- /dev/null
+++ b/app/react/portainer/access-control/AccessManagement/PorAccessManagementUsersSelector.test.tsx
@@ -0,0 +1,135 @@
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { vi } from 'vitest';
+
+import { PorAccessManagementUsersSelector } from './PorAccessManagementUsersSelector';
+
+type Option = { Type: 'user' | 'team'; Id: number; Name: string };
+
+function createMockOptions(): Option[] {
+  return [
+    { Id: 1, Name: 'User One', Type: 'user' },
+    { Id: 2, Name: 'Team Alpha', Type: 'team' },
+    { Id: 3, Name: 'User Two', Type: 'user' },
+  ];
+}
+
+describe('PorAccessManagementUsersSelector', () => {
+  describe('loading state', () => {
+    it('should show loading indicator when isLoading is true', () => {
+      render(
+        <PorAccessManagementUsersSelector
+          options={[]}
+          value={[]}
+          onChange={vi.fn()}
+          isLoading
+        />
+      );
+
+      // react-select shows a loading indicator when isLoading is true
+      const loadingIndicator = document.querySelector(
+        '.portainer-selector__loading-indicator'
+      );
+      expect(loadingIndicator).toBeInTheDocument();
+    });
+
+    it('should show loading message when menu is opened while loading', async () => {
+      const user = userEvent.setup();
+      render(
+        <PorAccessManagementUsersSelector
+          options={[]}
+          value={[]}
+          onChange={vi.fn()}
+          isLoading
+        />
+      );
+
+      // Click to open the select menu
+      const input = screen.getByRole('combobox');
+      await user.click(input);
+
+      // The loading message should be visible
+      expect(screen.getByText('Loading users and teams...')).toBeVisible();
+    });
+
+    it('should not show loading indicator when isLoading is false', () => {
+      render(
+        <PorAccessManagementUsersSelector
+          options={createMockOptions()}
+          value={[]}
+          onChange={vi.fn()}
+          isLoading={false}
+        />
+      );
+
+      const loadingIndicator = document.querySelector(
+        '.portainer-selector__loading-indicator'
+      );
+      expect(loadingIndicator).not.toBeInTheDocument();
+    });
+  });
+
+  describe('no options state', () => {
+    it('should show default empty text when menu is opened and no options available', async () => {
+      const user = userEvent.setup();
+      render(
+        <PorAccessManagementUsersSelector
+          options={[]}
+          value={[]}
+          onChange={vi.fn()}
+          isLoading={false}
+        />
+      );
+
+      const input = screen.getByRole('combobox');
+      await user.click(input);
+
+      expect(screen.getByText('No users or teams available.')).toBeVisible();
+    });
+  });
+
+  describe('label', () => {
+    it('should display default label when not provided', () => {
+      render(
+        <PorAccessManagementUsersSelector
+          options={[]}
+          value={[]}
+          onChange={vi.fn()}
+        />
+      );
+
+      expect(screen.getByText('Select user(s) and/or team(s)')).toBeVisible();
+    });
+  });
+
+  describe('placeholder', () => {
+    it('should display default placeholder', () => {
+      render(
+        <PorAccessManagementUsersSelector
+          options={createMockOptions()}
+          value={[]}
+          onChange={vi.fn()}
+        />
+      );
+
+      expect(
+        screen.getByText('Select one or more users and/or teams')
+      ).toBeVisible();
+    });
+  });
+
+  describe('input id', () => {
+    it('should have the correct inputId for accessibility', () => {
+      render(
+        <PorAccessManagementUsersSelector
+          options={[]}
+          value={[]}
+          onChange={vi.fn()}
+        />
+      );
+
+      const input = screen.getByRole('combobox');
+      expect(input).toHaveAttribute('id', 'users-selector');
+    });
+  });
+});
diff --git a/app/react/portainer/access-control/AccessManagement/PorAccessManagementUsersSelector.tsx b/app/react/portainer/access-control/AccessManagement/PorAccessManagementUsersSelector.tsx
new file mode 100644
index 0000000..51d11df
--- /dev/null
+++ b/app/react/portainer/access-control/AccessManagement/PorAccessManagementUsersSelector.tsx
@@ -0,0 +1,86 @@
+import { User as UserIcon, Users as TeamIcon } from 'lucide-react';
+import { OptionProps, components, MultiValueGenericProps } from 'react-select';
+
+import { Select } from '@@/form-components/ReactSelect';
+
+type Option = { Type: 'user' | 'team'; Id: number; Name: string };
+
+interface Props {
+  value: Option[];
+  onChange(value: readonly Option[]): void;
+  options: Option[];
+  isLoading?: boolean;
+}
+
+export function PorAccessManagementUsersSelector({
+  options,
+  value,
+  onChange,
+  isLoading,
+}: Props) {
+  return (
+    <div className="form-group">
+      <label
+        className="col-sm-3 col-lg-2 control-label text-left"
+        htmlFor="users-selector"
+      >
+        Select user(s) and/or team(s)
+      </label>
+      <div className="col-sm-9 col-lg-10">
+        <Select
+          isMulti
+          getOptionLabel={(option) => option.Name}
+          getOptionValue={(option) => `${option.Id}-${option.Type}`}
+          options={options}
+          value={value}
+          closeMenuOnSelect={false}
+          onChange={onChange}
+          data-cy="component-selectUser"
+          id="component-selectUser"
+          inputId="users-selector"
+          placeholder="Select one or more users and/or teams"
+          components={{ MultiValueLabel, Option: OptionComponent }}
+          isLoading={isLoading}
+          loadingMessage={() => 'Loading users and teams...'}
+          noOptionsMessage={() => 'No users or teams available.'}
+        />
+      </div>
+    </div>
+  );
+}
+
+function isOption(option: unknown): option is Option {
+  return !!option && typeof option === 'object' && 'Type' in option;
+}
+
+function OptionComponent({ data, ...props }: OptionProps<Option, true>) {
+  return (
+    // eslint-disable-next-line react/jsx-props-no-spreading
+    <components.Option data={data} {...props}>
+      {isOption(data) && <Label option={data} />}
+    </components.Option>
+  );
+}
+
+function MultiValueLabel({
+  data,
+  ...props
+}: MultiValueGenericProps<Option, true>) {
+  return (
+    // eslint-disable-next-line react/jsx-props-no-spreading
+    <components.MultiValueLabel data={data} {...props}>
+      {isOption(data) && <Label option={data} />}
+    </components.MultiValueLabel>
+  );
+}
+
+function Label({ option }: { option: Option }) {
+  const Icon = option.Type === 'user' ? UserIcon : TeamIcon;
+
+  return (
+    <div className="flex items-center gap-1">
+      <Icon />
+      <span>{option.Name}</span>
+    </div>
+  );
+}
diff --git a/app/react/portainer/access-control/EditDetails/AccessTypeSelector.tsx b/app/react/portainer/access-control/EditDetails/AccessTypeSelector.tsx
new file mode 100644
index 0000000..c62579f
--- /dev/null
+++ b/app/react/portainer/access-control/EditDetails/AccessTypeSelector.tsx
@@ -0,0 +1,36 @@
+import { BoxSelector } from '@@/BoxSelector';
+
+import { Team } from '../../users/teams/types';
+import { ResourceControlOwnership } from '../types';
+
+import { useOptions } from './useOptions';
+
+export function AccessTypeSelector({
+  name,
+  isAdmin,
+  isPublicVisible,
+  teams,
+  value,
+  onChange,
+  resourceName = 'resource',
+}: {
+  name: string;
+  isAdmin: boolean;
+  teams: Team[];
+  isPublicVisible: boolean;
+  value: ResourceControlOwnership;
+  onChange(value: ResourceControlOwnership): void;
+  resourceName?: string;
+}) {
+  const options = useOptions(isAdmin, teams, isPublicVisible, resourceName);
+
+  return (
+    <BoxSelector
+      slim
+      radioName={name}
+      value={value}
+      options={options}
+      onChange={onChange}
+    />
+  );
+}
diff --git a/app/react/portainer/access-control/EditDetails/EditDetails.tsx b/app/react/portainer/access-control/EditDetails/EditDetails.tsx
new file mode 100644
index 0000000..deac862
--- /dev/null
+++ b/app/react/portainer/access-control/EditDetails/EditDetails.tsx
@@ -0,0 +1,130 @@
+import { useCallback } from 'react';
+import { FormikErrors } from 'formik';
+
+import { useCurrentUser } from '@/react/hooks/useUser';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { FormError } from '@@/form-components/FormError';
+
+import { ResourceControlOwnership, AccessControlFormData } from '../types';
+
+import { UsersField } from './UsersField';
+import { TeamsField } from './TeamsField';
+import { useLoadState } from './useLoadState';
+import { AccessTypeSelector } from './AccessTypeSelector';
+
+interface Props {
+  values: AccessControlFormData;
+  onChange(values: AccessControlFormData): void;
+  isPublicVisible?: boolean;
+  errors?: FormikErrors<AccessControlFormData>;
+  formNamespace?: string;
+  resourceName?: string;
+  environmentId?: EnvironmentId;
+}
+
+export function EditDetails({
+  values,
+  onChange,
+  isPublicVisible = false,
+  errors,
+  formNamespace,
+  resourceName = 'resource',
+  environmentId,
+}: Props) {
+  const { user, isPureAdmin } = useCurrentUser();
+
+  const { users, teams, isLoading } = useLoadState(environmentId);
+
+  const handleChange = useCallback(
+    (partialValues: Partial<typeof values>) => {
+      onChange({ ...values, ...partialValues });
+    },
+
+    [values, onChange]
+  );
+
+  if (
+    isLoading ||
+    !teams ||
+    (isPureAdmin && !users) ||
+    !values.authorizedUsers
+  ) {
+    return null;
+  }
+
+  return (
+    <>
+      <AccessTypeSelector
+        onChange={handleChangeOwnership}
+        name={withNamespace('ownership')}
+        value={values.ownership}
+        isAdmin={isPureAdmin}
+        isPublicVisible={isPublicVisible}
+        teams={teams}
+        resourceName={resourceName}
+      />
+
+      {values.ownership === ResourceControlOwnership.RESTRICTED && (
+        <div aria-label="extra-options">
+          {isPureAdmin && (
+            <UsersField
+              name={withNamespace('authorizedUsers')}
+              users={users || []}
+              onChange={(authorizedUsers) => handleChange({ authorizedUsers })}
+              value={values.authorizedUsers}
+              errors={errors?.authorizedUsers}
+            />
+          )}
+
+          {(isPureAdmin || teams.length > 1) && (
+            <TeamsField
+              name={withNamespace('authorizedTeams')}
+              teams={teams}
+              overrideTooltip={
+                !isPureAdmin && teams.length > 1
+                  ? 'As you are a member of multiple teams, you can select which teams(s) will be able to manage this resource.'
+                  : undefined
+              }
+              onChange={(authorizedTeams) => handleChange({ authorizedTeams })}
+              value={values.authorizedTeams}
+              errors={errors?.authorizedTeams}
+            />
+          )}
+
+          {typeof errors === 'string' && (
+            <div className="form-group col-md-12">
+              <FormError>{errors}</FormError>
+            </div>
+          )}
+        </div>
+      )}
+    </>
+  );
+
+  function withNamespace(name: string) {
+    return formNamespace ? `${formNamespace}.${name}` : name;
+  }
+
+  function handleChangeOwnership(ownership: ResourceControlOwnership) {
+    let { authorizedTeams, authorizedUsers } = values;
+
+    if (ownership === ResourceControlOwnership.PRIVATE && user) {
+      authorizedUsers = [user.Id];
+      authorizedTeams = [];
+    }
+
+    if (ownership === ResourceControlOwnership.RESTRICTED) {
+      authorizedUsers = [];
+      authorizedTeams = [];
+      // Non admin team leaders/members under only one team can
+      // automatically grant the resource access to all members
+      // under the team
+      if (!isPureAdmin && teams && teams.length === 1) {
+        authorizedTeams = teams.map((team) => team.Id);
+      }
+    }
+
+    handleChange({ ownership, authorizedTeams, authorizedUsers });
+  }
+}
diff --git a/app/react/portainer/access-control/EditDetails/TeamsField.tsx b/app/react/portainer/access-control/EditDetails/TeamsField.tsx
new file mode 100644
index 0000000..b6bfc47
--- /dev/null
+++ b/app/react/portainer/access-control/EditDetails/TeamsField.tsx
@@ -0,0 +1,56 @@
+import { Team } from '@/react/portainer/users/teams/types';
+
+import { TeamsSelector } from '@@/TeamsSelector';
+import { FormControl } from '@@/form-components/FormControl';
+import { Link } from '@@/Link';
+
+interface Props {
+  name: string;
+  teams: Team[];
+  value: number[];
+  overrideTooltip?: string;
+  onChange(value: number[]): void;
+  errors?: string | string[];
+}
+
+export function TeamsField({
+  name,
+  teams,
+  value,
+  overrideTooltip,
+  onChange,
+  errors,
+}: Props) {
+  return (
+    <FormControl
+      label="Authorized teams"
+      tooltip={
+        teams.length > 0
+          ? overrideTooltip ||
+            'You can select which team(s) will be able to manage this resource.'
+          : undefined
+      }
+      inputId="authorized-teams-selector"
+      errors={errors}
+    >
+      {teams.length > 0 ? (
+        <TeamsSelector
+          name={name}
+          teams={teams}
+          onChange={onChange}
+          value={value}
+          inputId="authorized-teams-selector"
+          dataCy="teams-selector"
+        />
+      ) : (
+        <span className="small text-muted">
+          You have not yet created any teams. Head over to the{' '}
+          <Link to="portainer.teams" data-cy="teams-view-link">
+            Teams view
+          </Link>{' '}
+          to manage teams.
+        </span>
+      )}
+    </FormControl>
+  );
+}
diff --git a/app/react/portainer/access-control/EditDetails/UsersField.tsx b/app/react/portainer/access-control/EditDetails/UsersField.tsx
new file mode 100644
index 0000000..b0e9c06
--- /dev/null
+++ b/app/react/portainer/access-control/EditDetails/UsersField.tsx
@@ -0,0 +1,47 @@
+import { User } from '@/portainer/users/types';
+
+import { UsersSelector } from '@@/UsersSelector';
+import { FormControl } from '@@/form-components/FormControl';
+import { Link } from '@@/Link';
+
+interface Props {
+  name: string;
+  users: User[];
+  value: number[];
+  onChange(value: number[]): void;
+  errors?: string | string[];
+}
+
+export function UsersField({ name, users, value, onChange, errors }: Props) {
+  return (
+    <FormControl
+      label="Authorized users"
+      tooltip={
+        users.length > 0
+          ? 'You can select which user(s) will be able to manage this resource.'
+          : undefined
+      }
+      inputId="authorized-users-selector"
+      errors={errors}
+    >
+      {users.length > 0 ? (
+        <UsersSelector
+          name={name}
+          users={users}
+          onChange={onChange}
+          value={value}
+          inputId="authorized-users-selector"
+          dataCy="users-selector"
+        />
+      ) : (
+        <span className="small text-muted">
+          You have not yet created any users. Head over to the{' '}
+          <Link to="portainer.users" data-cy="access-control-users-link">
+            Users view
+          </Link>{' '}
+          to manage users.
+        </span>
+      )}
+    </FormControl>
+  );
+}
diff --git a/app/react/portainer/access-control/EditDetails/index.ts b/app/react/portainer/access-control/EditDetails/index.ts
new file mode 100644
index 0000000..41357e7
--- /dev/null
+++ b/app/react/portainer/access-control/EditDetails/index.ts
@@ -0,0 +1 @@
+export { EditDetails } from './EditDetails';
diff --git a/app/react/portainer/access-control/EditDetails/useLoadState.ts b/app/react/portainer/access-control/EditDetails/useLoadState.ts
new file mode 100644
index 0000000..50b1c92
--- /dev/null
+++ b/app/react/portainer/access-control/EditDetails/useLoadState.ts
@@ -0,0 +1,21 @@
+import { useTeams } from '@/react/portainer/users/teams/queries';
+import { useUsers } from '@/portainer/users/queries';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { useIsEdgeAdmin } from '@/react/hooks/useUser';
+
+export function useLoadState(environmentId?: EnvironmentId) {
+  const isAdminQuery = useIsEdgeAdmin();
+  const teams = useTeams(false, environmentId);
+
+  const users = useUsers(false, environmentId, isAdminQuery.isAdmin);
+
+  return {
+    teams: teams.data,
+    users: users.data,
+    isAdmin: isAdminQuery.isAdmin,
+    isLoading:
+      teams.isInitialLoading ||
+      users.isInitialLoading ||
+      isAdminQuery.isLoading,
+  };
+}
diff --git a/app/react/portainer/access-control/EditDetails/useOptions.tsx b/app/react/portainer/access-control/EditDetails/useOptions.tsx
new file mode 100644
index 0000000..5f5ded7
--- /dev/null
+++ b/app/react/portainer/access-control/EditDetails/useOptions.tsx
@@ -0,0 +1,97 @@
+import _ from 'lodash';
+import { useEffect, useState } from 'react';
+
+import { buildOption } from '@/portainer/components/BoxSelector';
+import { Team } from '@/react/portainer/users/teams/types';
+import { ownershipIcon } from '@/react/docker/components/datatable/createOwnershipColumn';
+
+import { BoxSelectorOption } from '@@/BoxSelector/types';
+import { BadgeIcon } from '@@/BadgeIcon';
+
+import { ResourceControlOwnership } from '../types';
+
+function publicOption(
+  resourceName: string
+): BoxSelectorOption<ResourceControlOwnership> {
+  return {
+    value: ResourceControlOwnership.PUBLIC,
+    label: 'Public',
+    id: 'access_public',
+    description: `I want any user with access to this ${resourceName} to be able to manage this ${resourceName}`,
+    icon: <BadgeIcon icon={ownershipIcon(ResourceControlOwnership.PUBLIC)} />,
+  };
+}
+
+export function useOptions(
+  isAdmin: boolean,
+  teams?: Team[],
+  isPublicVisible = false,
+  resourceName = 'resource'
+) {
+  const [options, setOptions] = useState<
+    Array<BoxSelectorOption<ResourceControlOwnership>>
+  >([]);
+
+  useEffect(() => {
+    const options = isAdmin
+      ? adminOptions(resourceName)
+      : nonAdminOptions(teams, resourceName);
+
+    setOptions(
+      isPublicVisible ? [...options, publicOption(resourceName)] : options
+    );
+  }, [isAdmin, teams, isPublicVisible, resourceName]);
+
+  return options;
+}
+
+function adminOptions(resourceName: string) {
+  return [
+    buildOption(
+      'access_administrators',
+      <BadgeIcon
+        icon={ownershipIcon(ResourceControlOwnership.ADMINISTRATORS)}
+      />,
+      'Administrators',
+      `I want to restrict the management of this ${resourceName} to administrators only`,
+      ResourceControlOwnership.ADMINISTRATORS
+    ),
+    buildOption(
+      'access_restricted',
+      <BadgeIcon icon={ownershipIcon(ResourceControlOwnership.RESTRICTED)} />,
+      'Restricted',
+      `I want to restrict the management of this ${resourceName} to a set of users and/or teams`,
+      ResourceControlOwnership.RESTRICTED
+    ),
+  ];
+}
+function nonAdminOptions(teams?: Team[], resourceName = 'resource') {
+  return _.compact([
+    buildOption(
+      'access_private',
+      <BadgeIcon icon={ownershipIcon(ResourceControlOwnership.PRIVATE)} />,
+      'Private',
+      `I want to restrict this ${resourceName} to be manageable by myself only`,
+      ResourceControlOwnership.PRIVATE
+    ),
+    teams &&
+      teams.length > 0 &&
+      buildOption(
+        'access_restricted',
+        <BadgeIcon icon={ownershipIcon(ResourceControlOwnership.RESTRICTED)} />,
+        'Restricted',
+        teams.length === 1 ? (
+          <>
+            I want any member of my team (<b>{teams[0].Name}</b>) to be able to
+            manage this {resourceName}
+          </>
+        ) : (
+          <>
+            I want to restrict the management of this {resourceName} to one or
+            more of my teams
+          </>
+        ),
+        ResourceControlOwnership.RESTRICTED
+      ),
+  ]);
+}
diff --git a/app/react/portainer/access-control/PorAccessControlForm/TeamsSelector.tsx b/app/react/portainer/access-control/PorAccessControlForm/TeamsSelector.tsx
new file mode 100644
index 0000000..945c582
--- /dev/null
+++ b/app/react/portainer/access-control/PorAccessControlForm/TeamsSelector.tsx
@@ -0,0 +1,34 @@
+import { Team } from '@/react/portainer/users/teams/types';
+
+import { Select } from '@@/form-components/ReactSelect';
+
+interface Props {
+  value: Team[];
+  onChange(value: readonly Team[]): void;
+  options: Team[];
+  inputId?: string;
+}
+
+// to be removed with the angularjs app/portainer/components/accessControlForm
+export function PorAccessControlFormTeamSelector({
+  value,
+  onChange,
+  options,
+  inputId,
+}: Props) {
+  return (
+    <Select
+      isMulti
+      getOptionLabel={(option) => option.Name}
+      getOptionValue={(option) => String(option.Id)}
+      options={options}
+      value={value}
+      closeMenuOnSelect={false}
+      onChange={onChange}
+      data-cy="portainer-selectTeamAccess"
+      id="portainer-selectTeamAccess"
+      inputId={inputId}
+      placeholder="Select one or more teams"
+    />
+  );
+}
diff --git a/app/react/portainer/access-control/PorAccessControlForm/UsersSelector.tsx b/app/react/portainer/access-control/PorAccessControlForm/UsersSelector.tsx
new file mode 100644
index 0000000..31eb80a
--- /dev/null
+++ b/app/react/portainer/access-control/PorAccessControlForm/UsersSelector.tsx
@@ -0,0 +1,34 @@
+import { User } from '@/portainer/users/types';
+
+import { Select } from '@@/form-components/ReactSelect';
+
+interface Props {
+  value: User[];
+  onChange(value: readonly User[]): void;
+  options: User[];
+  inputId?: string;
+}
+
+// to be removed with the angularjs app/portainer/components/accessControlForm
+export function PorAccessControlFormUserSelector({
+  value,
+  onChange,
+  options,
+  inputId,
+}: Props) {
+  return (
+    <Select
+      isMulti
+      getOptionLabel={(option) => option.Username}
+      getOptionValue={(option) => String(option.Id)}
+      options={options}
+      value={value}
+      closeMenuOnSelect={false}
+      onChange={onChange}
+      data-cy="portainer-selectUserAccess"
+      id="portainer-selectUserAccess"
+      inputId={inputId}
+      placeholder="Select one or more users"
+    />
+  );
+}
diff --git a/app/react/portainer/access-control/access-control.service.ts b/app/react/portainer/access-control/access-control.service.ts
new file mode 100644
index 0000000..1c026d5
--- /dev/null
+++ b/app/react/portainer/access-control/access-control.service.ts
@@ -0,0 +1,97 @@
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import {
+  AccessControlFormData,
+  OwnershipParameters,
+  ResourceControlId,
+  ResourceControlType,
+  ResourceId,
+} from './types';
+import { ResourceControlViewModel } from './models/ResourceControlViewModel';
+import { parseOwnershipParameters } from './utils';
+
+/**
+ * Update an existing ResourceControl or create a new one on existing resource without RC
+ * @param resourceType Type of ResourceControl
+ * @param resourceId ID of involved Resource
+ * @param resourceControl Previous ResourceControl (can be undefined)
+ * @param formValues View data generated by AccessControlPanel
+ */
+export function applyResourceControlChange(
+  resourceType: ResourceControlType,
+  resourceId: ResourceId,
+  formValues: AccessControlFormData,
+  resourceControl?: ResourceControlViewModel
+) {
+  const ownershipParameters = parseOwnershipParameters(formValues);
+  if (resourceControl) {
+    return updateResourceControl(resourceControl.Id, ownershipParameters);
+  }
+  return createResourceControl(resourceType, resourceId, ownershipParameters);
+}
+
+/**
+ * Apply a ResourceControl after Resource creation
+ * @param accessControlData ResourceControl to apply
+ * @param resourceControl ResourceControl to update
+ * @param subResourcesIds SubResources managed by the ResourceControl
+ */
+export function applyResourceControl(
+  accessControlData: AccessControlFormData,
+  resourceControlId: ResourceControlId,
+  subResourcesIds: (number | string)[] = []
+) {
+  const ownershipParameters = parseOwnershipParameters(
+    accessControlData,
+    subResourcesIds
+  );
+  return updateResourceControl(resourceControlId, ownershipParameters);
+}
+
+/**
+ * Update a ResourceControl
+ * @param resourceControlId ID of involved resource
+ * @param ownershipParameters
+ */
+async function updateResourceControl(
+  resourceControlId: ResourceControlId,
+  ownershipParameters: OwnershipParameters
+) {
+  try {
+    await axios.put(buildUrl(resourceControlId), ownershipParameters);
+  } catch (error) {
+    throw parseAxiosError(error as Error);
+  }
+}
+
+/**
+ * Create a ResourceControl
+ * @param resourceType Type of ResourceControl
+ * @param resourceId ID of involved resource
+ * @param ownershipParameters Transient type from view data to payload
+ */
+async function createResourceControl(
+  resourceType: ResourceControlType,
+  resourceId: ResourceId,
+  ownershipParameters: OwnershipParameters
+) {
+  try {
+    await axios.post(buildUrl(), {
+      ...ownershipParameters,
+      type: resourceType,
+      resourceId,
+    });
+  } catch (error) {
+    throw parseAxiosError(error as Error);
+  }
+}
+
+function buildUrl(id?: ResourceControlId) {
+  let url = '/resource_controls';
+
+  if (id) {
+    url += `/${id}`;
+  }
+
+  return url;
+}
diff --git a/app/react/portainer/access-control/index.ts b/app/react/portainer/access-control/index.ts
new file mode 100644
index 0000000..e8e8a72
--- /dev/null
+++ b/app/react/portainer/access-control/index.ts
@@ -0,0 +1,2 @@
+export { AccessControlPanel } from './AccessControlPanel';
+export { AccessControlForm } from './AccessControlForm';
diff --git a/app/react/portainer/access-control/models/ResourceControlViewModel.ts b/app/react/portainer/access-control/models/ResourceControlViewModel.ts
new file mode 100644
index 0000000..b0940e3
--- /dev/null
+++ b/app/react/portainer/access-control/models/ResourceControlViewModel.ts
@@ -0,0 +1,60 @@
+import {
+  ResourceControlId,
+  ResourceControlOwnership,
+  ResourceControlResponse,
+  ResourceControlType,
+  ResourceId,
+  TeamResourceAccess,
+  UserResourceAccess,
+} from '../types';
+
+export class ResourceControlViewModel {
+  Id: ResourceControlId;
+
+  Type: ResourceControlType;
+
+  ResourceId: ResourceId;
+
+  UserAccesses: UserResourceAccess[];
+
+  TeamAccesses: TeamResourceAccess[];
+
+  Public: boolean;
+
+  System: boolean;
+
+  Ownership: ResourceControlOwnership;
+
+  constructor(data: ResourceControlResponse) {
+    this.Id = data.Id;
+    this.Type = data.Type;
+    this.ResourceId = data.ResourceId;
+    this.UserAccesses = data.UserAccesses;
+    this.TeamAccesses = data.TeamAccesses;
+    this.Public = data.Public;
+    this.System = data.System;
+    this.Ownership = determineOwnership(data);
+  }
+}
+
+export function determineOwnership(resourceControl: ResourceControlResponse) {
+  if (resourceControl.Public) {
+    return ResourceControlOwnership.PUBLIC;
+  }
+
+  if (
+    resourceControl.UserAccesses.length === 1 &&
+    resourceControl.TeamAccesses.length === 0
+  ) {
+    return ResourceControlOwnership.PRIVATE;
+  }
+
+  if (
+    resourceControl.UserAccesses.length > 1 ||
+    resourceControl.TeamAccesses.length > 0
+  ) {
+    return ResourceControlOwnership.RESTRICTED;
+  }
+
+  return ResourceControlOwnership.ADMINISTRATORS;
+}
diff --git a/app/react/portainer/access-control/types.ts b/app/react/portainer/access-control/types.ts
new file mode 100644
index 0000000..0fd6826
--- /dev/null
+++ b/app/react/portainer/access-control/types.ts
@@ -0,0 +1,76 @@
+import { TeamId } from '@/react/portainer/users/teams/types';
+import { UserId } from '@/portainer/users/types/user-id';
+
+export type ResourceControlId = number;
+
+export type ResourceId = number | string;
+
+export enum ResourceControlOwnership {
+  PUBLIC = 'public',
+  PRIVATE = 'private',
+  RESTRICTED = 'restricted',
+  ADMINISTRATORS = 'administrators',
+}
+
+/**
+ * Transient type from view data to payload
+ */
+export interface OwnershipParameters {
+  administratorsOnly: boolean;
+  public: boolean;
+  users: UserId[];
+  teams: TeamId[];
+  subResourcesIds: ResourceId[];
+}
+
+export enum ResourceControlType {
+  // Container represents a resource control associated to a Docker container
+  Container = 1,
+  // Service represents a resource control associated to a Docker service
+  Service,
+  // Volume represents a resource control associated to a Docker volume
+  Volume,
+  // Network represents a resource control associated to a Docker network
+  Network,
+  // Secret represents a resource control associated to a Docker secret
+  Secret,
+  // Stack represents a resource control associated to a stack composed of Docker services
+  Stack,
+  // Config represents a resource control associated to a Docker config
+  Config,
+  // CustomTemplate represents a resource control associated to a custom template
+  CustomTemplate,
+  // ContainerGroup represents a resource control associated to an Azure container group
+  ContainerGroup,
+}
+
+export enum ResourceAccessLevel {
+  ReadWriteAccessLevel = 1,
+}
+
+export interface UserResourceAccess {
+  UserId: UserId;
+  AccessLevel: ResourceAccessLevel;
+}
+
+export interface TeamResourceAccess {
+  TeamId: TeamId;
+  AccessLevel: ResourceAccessLevel;
+}
+
+export interface ResourceControlResponse {
+  Id: number;
+  Type: ResourceControlType;
+  ResourceId: ResourceId;
+  UserAccesses: UserResourceAccess[];
+  TeamAccesses: TeamResourceAccess[];
+  Public: boolean;
+  AdministratorsOnly: boolean;
+  System: boolean;
+}
+
+export interface AccessControlFormData {
+  ownership: ResourceControlOwnership;
+  authorizedUsers: UserId[];
+  authorizedTeams: TeamId[];
+}
diff --git a/app/react/portainer/access-control/utils.test.ts b/app/react/portainer/access-control/utils.test.ts
new file mode 100644
index 0000000..1194bb8
--- /dev/null
+++ b/app/react/portainer/access-control/utils.test.ts
@@ -0,0 +1,81 @@
+import { ResourceControlViewModel } from './models/ResourceControlViewModel';
+import { ResourceControlOwnership, ResourceControlType } from './types';
+import { parseAccessControlFormData } from './utils';
+
+describe('parseAccessControlFormData', () => {
+  test('when ownership is private and resource is supplied, authorizedUsers should be UserAccess', () => {
+    const resourceControl = buildResourceControl(
+      ResourceControlOwnership.PRIVATE
+    );
+    resourceControl.UserAccesses = [{ UserId: 1, AccessLevel: 1 }];
+
+    const actual = parseAccessControlFormData(false, 1, resourceControl);
+    expect(actual.authorizedUsers).toContain(1);
+    expect(actual.authorizedUsers).toHaveLength(1);
+  });
+
+  test('when not admin and no resource control, ownership should be set to private and authorizedUsers is only currentUserId', () => {
+    const actual = parseAccessControlFormData(false, 1);
+
+    expect(actual.ownership).toBe(ResourceControlOwnership.PRIVATE);
+    expect(actual.authorizedUsers).toContain(1);
+    expect(actual.authorizedUsers).toHaveLength(1);
+  });
+
+  [
+    ResourceControlOwnership.ADMINISTRATORS,
+    ResourceControlOwnership.RESTRICTED,
+    ResourceControlOwnership.PUBLIC,
+    ResourceControlOwnership.PRIVATE,
+  ].forEach((ownership) => {
+    test(`when resource control supplied, if user is not admin, will change ownership to rc ownership (${ownership})`, () => {
+      const resourceControl = buildResourceControl(ownership);
+
+      const actual = parseAccessControlFormData(false, 0, resourceControl);
+      expect(actual.ownership).toBe(resourceControl.Ownership);
+    });
+  });
+
+  [
+    ResourceControlOwnership.ADMINISTRATORS,
+    ResourceControlOwnership.RESTRICTED,
+    ResourceControlOwnership.PUBLIC,
+  ].forEach((ownership) => {
+    test(`when resource control supplied and user is admin, if resource ownership is ${ownership} , will change ownership to rc ownership`, () => {
+      const resourceControl = buildResourceControl(ownership);
+
+      const actual = parseAccessControlFormData(true, 0, resourceControl);
+      expect(actual.ownership).toBe(resourceControl.Ownership);
+    });
+  });
+
+  test('when isAdmin and resource control not supplied, ownership should be set to Administrator', () => {
+    const actual = parseAccessControlFormData(true, 0);
+
+    expect(actual.ownership).toBe(ResourceControlOwnership.ADMINISTRATORS);
+  });
+
+  test('when resource control supplied, if user is admin and resource ownership is private, will change ownership to restricted', () => {
+    const resourceControl = buildResourceControl(
+      ResourceControlOwnership.PRIVATE
+    );
+
+    const actual = parseAccessControlFormData(true, 0, resourceControl);
+    expect(actual.ownership).toBe(ResourceControlOwnership.RESTRICTED);
+  });
+
+  function buildResourceControl(
+    ownership: ResourceControlOwnership
+  ): ResourceControlViewModel {
+    return {
+      UserAccesses: [],
+      TeamAccesses: [],
+      Ownership: ownership,
+      Id: 1,
+      Public: false,
+      ResourceId: 1,
+      System: false,
+      Type: ResourceControlType.Config,
+    };
+  }
+});
diff --git a/app/react/portainer/access-control/utils.ts b/app/react/portainer/access-control/utils.ts
new file mode 100644
index 0000000..b8ad9a8
--- /dev/null
+++ b/app/react/portainer/access-control/utils.ts
@@ -0,0 +1,94 @@
+import { TeamId } from '@/react/portainer/users/teams/types';
+import { UserId } from '@/portainer/users/types';
+
+import {
+  AccessControlFormData,
+  OwnershipParameters,
+  ResourceControlOwnership,
+  ResourceId,
+} from './types';
+import { ResourceControlViewModel } from './models/ResourceControlViewModel';
+
+/**
+ * Transform AccessControlFormData to ResourceControlOwnershipParameters
+ * @param {int} userId ID of user performing the operation
+ * @param {AccessControlFormData} formValues Form data (generated by AccessControlForm)
+ * @param {int[]} subResources Sub Resources restricted by the ResourceControl
+ */
+export function parseOwnershipParameters(
+  formValues: AccessControlFormData,
+  subResourcesIds: ResourceId[] = []
+): OwnershipParameters {
+  const { ownership, authorizedTeams, authorizedUsers } = formValues;
+
+  const adminOnly = ownership === ResourceControlOwnership.ADMINISTRATORS;
+  const publicOnly = ownership === ResourceControlOwnership.PUBLIC;
+
+  let users = authorizedUsers;
+  let teams = authorizedTeams;
+  if (
+    [
+      ResourceControlOwnership.ADMINISTRATORS,
+      ResourceControlOwnership.PUBLIC,
+    ].includes(ownership)
+  ) {
+    users = [];
+    teams = [];
+  }
+
+  return {
+    administratorsOnly: adminOnly,
+    public: publicOnly,
+    users,
+    teams,
+    subResourcesIds,
+  };
+}
+
+export function defaultValues(
+  isAdmin: boolean,
+  currentUserId: UserId
+): AccessControlFormData {
+  if (!isAdmin) {
+    return {
+      ownership: ResourceControlOwnership.PRIVATE,
+      authorizedTeams: [],
+      authorizedUsers: [currentUserId],
+    };
+  }
+
+  return {
+    ownership: ResourceControlOwnership.ADMINISTRATORS,
+    authorizedTeams: [],
+    authorizedUsers: [],
+  };
+}
+
+export function parseAccessControlFormData(
+  isAdmin: boolean,
+  currentUserId: UserId,
+  resourceControl?: ResourceControlViewModel
+): AccessControlFormData {
+  if (!resourceControl) {
+    return defaultValues(isAdmin, currentUserId);
+  }
+
+  let ownership = resourceControl.Ownership;
+  if (isAdmin && ownership === ResourceControlOwnership.PRIVATE) {
+    ownership = ResourceControlOwnership.RESTRICTED;
+  }
+
+  let authorizedTeams: TeamId[] = [];
+  let authorizedUsers: UserId[] = [];
+  if (
+    [
+      ResourceControlOwnership.PRIVATE,
+      ResourceControlOwnership.RESTRICTED,
+    ].includes(ownership)
+  ) {
+    authorizedTeams = resourceControl.TeamAccesses.map((ra) => ra.TeamId);
+    authorizedUsers = resourceControl.UserAccesses.map((ra) => ra.UserId);
+  }
+
+  return { ownership, authorizedUsers, authorizedTeams };
+}
diff --git a/app/react/portainer/account/AccountView/AccessTokensDatatable/AccessTokensDatatable.tsx b/app/react/portainer/account/AccountView/AccessTokensDatatable/AccessTokensDatatable.tsx
new file mode 100644
index 0000000..015d185
--- /dev/null
+++ b/app/react/portainer/account/AccountView/AccessTokensDatatable/AccessTokensDatatable.tsx
@@ -0,0 +1,33 @@
+import { Key } from 'lucide-react';
+
+import { Datatable } from '@@/datatables';
+import { createPersistedStore } from '@@/datatables/types';
+import { useTableState } from '@@/datatables/useTableState';
+
+import { useAccessTokens } from '../../access-tokens/queries/useAccessTokens';
+
+import { columns } from './columns';
+import { TableActions } from './TableActions';
+
+const tableKey = 'access-tokens';
+const store = createPersistedStore(tableKey);
+
+export function AccessTokensDatatable() {
+  const query = useAccessTokens();
+  const tableState = useTableState(store, tableKey);
+
+  return (
+    <Datatable
+      columns={columns}
+      isLoading={query.isLoading}
+      dataset={query.data || []}
+      settingsManager={tableState}
+      title="Access tokens"
+      titleIcon={Key}
+      renderTableActions={(selectedItems) => (
+        <TableActions selectedItems={selectedItems} />
+      )}
+      data-cy="access-tokens-datatable"
+    />
+  );
+}
diff --git a/app/react/portainer/account/AccountView/AccessTokensDatatable/TableActions.tsx b/app/react/portainer/account/AccountView/AccessTokensDatatable/TableActions.tsx
new file mode 100644
index 0000000..ce78f89
--- /dev/null
+++ b/app/react/portainer/account/AccountView/AccessTokensDatatable/TableActions.tsx
@@ -0,0 +1,40 @@
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { DeleteButton } from '@@/buttons/DeleteButton';
+import { AddButton } from '@@/buttons';
+
+import { AccessToken } from '../../access-tokens/types';
+
+import { useDeleteAccessTokensMutation } from './useDeleteAccessTokensMutation';
+
+export function TableActions({
+  selectedItems,
+}: {
+  selectedItems: AccessToken[];
+}) {
+  const deleteMutation = useDeleteAccessTokensMutation();
+
+  return (
+    <>
+      <DeleteButton
+        disabled={selectedItems.length === 0}
+        confirmMessage="Do you want to remove the selected access token(s)? Any script or application using these tokens will no longer be able to invoke the Portainer API."
+        onConfirmed={handleRemove}
+        data-cy="access-tokens-delete-button"
+      />
+
+      <AddButton to=".new-access-token" data-cy="access-tokens-add-button">
+        Add access token
+      </AddButton>
+    </>
+  );
+
+  function handleRemove() {
+    const ids = selectedItems.map((item) => item.id);
+    deleteMutation.mutate(ids, {
+      onSuccess() {
+        notifySuccess('Success', 'Access token(s) removed');
+      },
+    });
+  }
+}
diff --git a/app/react/portainer/account/AccountView/AccessTokensDatatable/columns.ts b/app/react/portainer/account/AccountView/AccessTokensDatatable/columns.ts
new file mode 100644
index 0000000..1ee7a83
--- /dev/null
+++ b/app/react/portainer/account/AccountView/AccessTokensDatatable/columns.ts
@@ -0,0 +1,24 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { isoDateFromTimestamp } from '@/portainer/filters/filters';
+
+import { AccessToken } from '../../access-tokens/types';
+
+const columnHelper = createColumnHelper<AccessToken>();
+
+export const columns = [
+  columnHelper.accessor('description', {
+    header: 'Description',
+  }),
+  columnHelper.accessor('prefix', {
+    header: 'Prefix',
+  }),
+  columnHelper.accessor('dateCreated', {
+    header: 'Created',
+    cell: ({ getValue }) => isoDateFromTimestamp(getValue()),
+  }),
+  columnHelper.accessor('lastUsed', {
+    header: 'Last Used',
+    cell: ({ getValue }) => isoDateFromTimestamp(getValue()),
+  }),
+];
diff --git a/app/react/portainer/account/AccountView/AccessTokensDatatable/index.ts b/app/react/portainer/account/AccountView/AccessTokensDatatable/index.ts
new file mode 100644
index 0000000..f3264f1
--- /dev/null
+++ b/app/react/portainer/account/AccountView/AccessTokensDatatable/index.ts
@@ -0,0 +1 @@
+export { AccessTokensDatatable } from './AccessTokensDatatable';
diff --git a/app/react/portainer/account/AccountView/AccessTokensDatatable/useDeleteAccessTokensMutation.ts b/app/react/portainer/account/AccountView/AccessTokensDatatable/useDeleteAccessTokensMutation.ts
new file mode 100644
index 0000000..0649b08
--- /dev/null
+++ b/app/react/portainer/account/AccountView/AccessTokensDatatable/useDeleteAccessTokensMutation.ts
@@ -0,0 +1,40 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { withError, withInvalidate } from '@/react-tools/react-query';
+import { useCurrentUser } from '@/react/hooks/useUser';
+import { promiseSequence } from '@/portainer/helpers/promise-utils';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { AccessToken } from '../../access-tokens/types';
+import { buildUrl } from '../../access-tokens/queries/build-url';
+import { queryKeys } from '../../access-tokens/queries/query-keys';
+
+export function useDeleteAccessTokensMutation() {
+  const { user } = useCurrentUser();
+
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: (ids: Array<AccessToken['id']>) =>
+      deleteAccessTokens(user.Id, ids),
+    ...withError('Failed to delete access tokens'),
+    ...withInvalidate(queryClient, [queryKeys.base(user.Id)]),
+  });
+}
+
+async function deleteAccessTokens(
+  userId: number,
+  tokenIds: Array<AccessToken['id']>
+) {
+  return promiseSequence(
+    tokenIds.map((tokenId) => () => deleteAccessToken(userId, tokenId))
+  );
+}
+
+async function deleteAccessToken(userId: number, id: AccessToken['id']) {
+  try {
+    await axios.delete(buildUrl(userId, id));
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to delete access token');
+  }
+}
diff --git a/app/react/portainer/account/AccountView/ApplicationSettings/ApplicationSettingsForm.tsx b/app/react/portainer/account/AccountView/ApplicationSettings/ApplicationSettingsForm.tsx
new file mode 100644
index 0000000..0fdc545
--- /dev/null
+++ b/app/react/portainer/account/AccountView/ApplicationSettings/ApplicationSettingsForm.tsx
@@ -0,0 +1,86 @@
+import { Form, Formik } from 'formik';
+
+import { useCurrentUser } from '@/react/hooks/useUser';
+import { notifySuccess } from '@/portainer/services/notifications';
+import { updateAxiosAdapter } from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+
+import { TextTip } from '@@/Tip/TextTip';
+import { LoadingButton } from '@@/buttons';
+import { SwitchField } from '@@/form-components/SwitchField';
+
+import { useUpdateUserMutation } from '../../useUpdateUserMutation';
+
+type FormValues = {
+  useCache: boolean;
+};
+
+export function ApplicationSettingsForm() {
+  const { user } = useCurrentUser();
+  const updateSettingsMutation = useUpdateUserMutation();
+
+  const initialValues = {
+    useCache: user.UseCache,
+  };
+
+  return (
+    <Formik<FormValues>
+      initialValues={initialValues}
+      onSubmit={handleSubmit}
+      validateOnMount
+      enableReinitialize
+    >
+      {({ isValid, dirty, values, setFieldValue }) => (
+        <Form className="form-horizontal">
+          <TextTip color="orange" className="mb-3">
+            Enabling front-end data caching can mean that changes to Kubernetes
+            clusters made by other users or outside of Portainer may take up to
+            five minutes to show in your session. This caching only applies to
+            Kubernetes environments.
+          </TextTip>
+          <SwitchField
+            label="Enable front-end data caching for Kubernetes environments"
+            data-cy="account-applicationSettingsUseCacheSwitch"
+            checked={values.useCache}
+            onChange={(value) => setFieldValue('useCache', value)}
+            labelClass="col-lg-2 col-sm-3" // match the label width of the other fields in the page
+            fieldClass="!mb-4"
+          />
+          <div className="form-group">
+            <div className="col-sm-12">
+              <LoadingButton
+                loadingText="Saving..."
+                isLoading={updateSettingsMutation.isLoading}
+                disabled={!isValid || !dirty}
+                className="!ml-0"
+                data-cy="account-applicationSettingsSaveButton"
+              >
+                Save
+              </LoadingButton>
+            </div>
+          </div>
+        </Form>
+      )}
+    </Formik>
+  );
+
+  function handleSubmit(values: FormValues) {
+    updateSettingsMutation.mutate(
+      {
+        useCache: values.useCache,
+      },
+      {
+        onSuccess() {
+          updateAxiosAdapter(values.useCache);
+          notifySuccess(
+            'Success',
+            'Successfully updated application settings.'
+          );
+          // a full reload is required to update the angular $http cache setting
+          setTimeout(() => window.location.reload(), 2000); // allow 2s to show the success notification
+        },
+        ...withError('Unable to update application settings'),
+      }
+    );
+  }
+}
diff --git a/app/react/portainer/account/AccountView/ApplicationSettings/ApplicationSettingsWidget.tsx b/app/react/portainer/account/AccountView/ApplicationSettings/ApplicationSettingsWidget.tsx
new file mode 100644
index 0000000..31ff5ea
--- /dev/null
+++ b/app/react/portainer/account/AccountView/ApplicationSettings/ApplicationSettingsWidget.tsx
@@ -0,0 +1,20 @@
+import { Settings } from 'lucide-react';
+
+import { Widget, WidgetBody, WidgetTitle } from '@@/Widget';
+
+import { ApplicationSettingsForm } from './ApplicationSettingsForm';
+
+export function ApplicationSettingsWidget() {
+  return (
+    <div className="row">
+      <div className="col-sm-12">
+        <Widget>
+          <WidgetTitle icon={Settings} title="Application settings" />
+          <WidgetBody>
+            <ApplicationSettingsForm />
+          </WidgetBody>
+        </Widget>
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/portainer/account/AccountView/ApplicationSettings/index.ts b/app/react/portainer/account/AccountView/ApplicationSettings/index.ts
new file mode 100644
index 0000000..fd49063
--- /dev/null
+++ b/app/react/portainer/account/AccountView/ApplicationSettings/index.ts
@@ -0,0 +1 @@
+export { ApplicationSettingsWidget } from './ApplicationSettingsWidget';
diff --git a/app/react/portainer/account/AccountView/HelmRepositoryDatatable/HelmRepositoryDatatable.tsx b/app/react/portainer/account/AccountView/HelmRepositoryDatatable/HelmRepositoryDatatable.tsx
new file mode 100644
index 0000000..bad68c2
--- /dev/null
+++ b/app/react/portainer/account/AccountView/HelmRepositoryDatatable/HelmRepositoryDatatable.tsx
@@ -0,0 +1,105 @@
+import { useMemo, useEffect } from 'react';
+
+import { useCurrentUser } from '@/react/hooks/useUser';
+import helm from '@/assets/ico/vendor/helm.svg?c';
+import { isPureAdmin } from '@/portainer/users/user.helpers';
+
+import { Link } from '@@/Link';
+import { Datatable } from '@@/datatables';
+import { createPersistedStore } from '@@/datatables/types';
+import { useTableState } from '@@/datatables/useTableState';
+import { TextTip } from '@@/Tip/TextTip';
+
+import { columns } from './columns';
+import { HelmRepositoryDatatableActions } from './HelmRepositoryDatatableActions';
+import { useHelmRepositories } from './helm-repositories.service';
+import { HelmRepository } from './types';
+
+const storageKey = 'helmRepository';
+
+const settingsStore = createPersistedStore(storageKey);
+
+export function HelmRepositoryDatatable() {
+  const { user } = useCurrentUser();
+  const helmReposQuery = useHelmRepositories(user.Id);
+
+  const isAdminUser = isPureAdmin(user);
+
+  const tableState = useTableState(settingsStore, storageKey);
+
+  const helmRepos = useMemo(() => {
+    const helmRepos = [];
+    if (helmReposQuery.data?.GlobalRepository) {
+      const helmrepository: HelmRepository = {
+        Global: true,
+        URL: helmReposQuery.data.GlobalRepository,
+        Id: 0,
+        UserId: 0,
+      };
+      helmRepos.push(helmrepository);
+    }
+    return [...helmRepos, ...(helmReposQuery.data?.UserRepositories ?? [])];
+  }, [
+    helmReposQuery.data?.GlobalRepository,
+    helmReposQuery.data?.UserRepositories,
+  ]);
+
+  useEffect(() => {
+    // window.location.hash will get everything after the hashbang
+    // the regex will match the the content after each hash
+    const timeout = setTimeout(() => {
+      const regEx = /#!.*#(.*)/;
+      const match = window.location.hash.match(regEx);
+      if (match && match[1]) {
+        document.getElementById(match[1])?.scrollIntoView();
+      }
+    }, 1000);
+    return () => clearTimeout(timeout);
+  }, []);
+
+  return (
+    <Datatable
+      id="helm-repositories"
+      getRowId={(row) => String(row.Id)}
+      dataset={helmRepos}
+      description={<HelmDatatableDescription isAdmin={isAdminUser} />}
+      settingsManager={tableState}
+      columns={columns}
+      title="Helm repositories"
+      titleIcon={helm}
+      titleId="helm-repositories"
+      renderTableActions={(selectedRows) => (
+        <HelmRepositoryDatatableActions selectedItems={selectedRows} />
+      )}
+      isLoading={helmReposQuery.isLoading}
+      isRowSelectable={(row) => !row.original.Global}
+      data-cy="helm-repositories-datatable"
+    />
+  );
+}
+
+function HelmDatatableDescription({ isAdmin }: { isAdmin: boolean }) {
+  return (
+    <TextTip color="blue" className="mb-3">
+      <p>
+        Adding a Helm repository here makes it available only in your Portainer
+        user account. The Helm charts from these repositories (along with the
+        globally set Helm repository) are shown in the &apos;Create from
+        Code&apos; screen.
+      </p>
+      {isAdmin && (
+        <>
+          To manage your helm repositories globally, navigate to{' '}
+          <Link
+            to="portainer.settings"
+            params={{ '#': 'kubernetes-settings' }}
+            data-cy="helm-settings-link"
+          >
+            Settings &gt; General
+          </Link>
+          .
+        </>
+      )}
+    </TextTip>
+  );
+}
diff --git a/app/react/portainer/account/AccountView/HelmRepositoryDatatable/HelmRepositoryDatatableActions.tsx b/app/react/portainer/account/AccountView/HelmRepositoryDatatable/HelmRepositoryDatatableActions.tsx
new file mode 100644
index 0000000..08f8617
--- /dev/null
+++ b/app/react/portainer/account/AccountView/HelmRepositoryDatatable/HelmRepositoryDatatableActions.tsx
@@ -0,0 +1,47 @@
+import { useRouter } from '@uirouter/react';
+
+import { pluralize } from '@/portainer/helpers/strings';
+
+import { AddButton } from '@@/buttons';
+import { DeleteButton } from '@@/buttons/DeleteButton';
+
+import { HelmRepository } from './types';
+import { useDeleteHelmRepositoriesMutation } from './helm-repositories.service';
+
+interface Props {
+  selectedItems: HelmRepository[];
+}
+
+export function HelmRepositoryDatatableActions({ selectedItems }: Props) {
+  const router = useRouter();
+  const deleteHelmRepoMutation = useDeleteHelmRepositoriesMutation();
+
+  return (
+    <>
+      <DeleteButton
+        disabled={selectedItems.length === 0}
+        onConfirmed={() => onDeleteClick(selectedItems)}
+        confirmMessage={`Are you sure you want to remove the selected Helm ${pluralize(
+          selectedItems.length,
+          'repository',
+          'repositories'
+        )}?`}
+        data-cy="helmRepository-deleteButton"
+      />
+      <AddButton
+        to="portainer.account.createHelmRepository"
+        data-cy="helmRepository-addButton"
+      >
+        Add Helm repository
+      </AddButton>
+    </>
+  );
+
+  async function onDeleteClick(selectedItems: HelmRepository[]) {
+    deleteHelmRepoMutation.mutate(selectedItems, {
+      onSuccess: () => {
+        router.stateService.reload();
+      },
+    });
+  }
+}
diff --git a/app/react/portainer/account/AccountView/HelmRepositoryDatatable/columns/helper.ts b/app/react/portainer/account/AccountView/HelmRepositoryDatatable/columns/helper.ts
new file mode 100644
index 0000000..279aba6
--- /dev/null
+++ b/app/react/portainer/account/AccountView/HelmRepositoryDatatable/columns/helper.ts
@@ -0,0 +1,5 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { HelmRepository } from '../types';
+
+export const columnHelper = createColumnHelper<HelmRepository>();
diff --git a/app/react/portainer/account/AccountView/HelmRepositoryDatatable/columns/index.ts b/app/react/portainer/account/AccountView/HelmRepositoryDatatable/columns/index.ts
new file mode 100644
index 0000000..a0a5b7b
--- /dev/null
+++ b/app/react/portainer/account/AccountView/HelmRepositoryDatatable/columns/index.ts
@@ -0,0 +1,3 @@
+import { url } from './url';
+
+export const columns = [url];
diff --git a/app/react/portainer/account/AccountView/HelmRepositoryDatatable/columns/url.tsx b/app/react/portainer/account/AccountView/HelmRepositoryDatatable/columns/url.tsx
new file mode 100644
index 0000000..e61dae3
--- /dev/null
+++ b/app/react/portainer/account/AccountView/HelmRepositoryDatatable/columns/url.tsx
@@ -0,0 +1,17 @@
+import { Badge } from '@@/Badge';
+
+import { columnHelper } from './helper';
+
+export const url = columnHelper.accessor('URL', {
+  id: 'url',
+  cell: ({ row }) => (
+    <div className="flex">
+      {row.original.URL}
+      {row.original.Global && (
+        <Badge type="success" className="ml-2">
+          Globally-set
+        </Badge>
+      )}
+    </div>
+  ),
+});
diff --git a/app/react/portainer/account/AccountView/HelmRepositoryDatatable/helm-repositories.service.ts b/app/react/portainer/account/AccountView/HelmRepositoryDatatable/helm-repositories.service.ts
new file mode 100644
index 0000000..2d7eaef
--- /dev/null
+++ b/app/react/portainer/account/AccountView/HelmRepositoryDatatable/helm-repositories.service.ts
@@ -0,0 +1,117 @@
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { success as notifySuccess } from '@/portainer/services/notifications';
+import { withError } from '@/react-tools/react-query';
+import { pluralize } from '@/portainer/helpers/strings';
+import { queryKeys } from '@/react/kubernetes/helm/helmChartSourceQueries/query-keys';
+import { useCurrentUser } from '@/react/hooks/useUser';
+
+import {
+  CreateHelmRepositoryPayload,
+  HelmRepository,
+  HelmRepositories,
+} from './types';
+
+export async function createHelmRepository(
+  helmRepository: CreateHelmRepositoryPayload
+) {
+  try {
+    const { data } = await axios.post<{ helmRepository: HelmRepository }>(
+      buildUrl(helmRepository.UserId),
+      helmRepository
+    );
+    return data.helmRepository;
+  } catch (e) {
+    throw parseAxiosError(e as Error, 'Unable to create Helm repository');
+  }
+}
+
+export async function getHelmRepositories(userId: number) {
+  try {
+    const { data } = await axios.get<HelmRepositories>(buildUrl(userId));
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e as Error, 'Unable to get Helm repositories');
+  }
+}
+
+export async function deleteHelmRepository(repo: HelmRepository) {
+  try {
+    await axios.delete<HelmRepository[]>(buildUrl(repo.UserId, repo.Id));
+  } catch (e) {
+    throw parseAxiosError(e as Error, 'Unable to delete Helm repository');
+  }
+}
+
+export async function deleteHelmRepositories(repos: HelmRepository[]) {
+  try {
+    await Promise.all(repos.map((repo) => deleteHelmRepository(repo)));
+  } catch (e) {
+    throw parseAxiosError(e as Error, 'Unable to delete Helm repositories');
+  }
+}
+
+export function useDeleteHelmRepositoryMutation() {
+  const queryClient = useQueryClient();
+  const { user } = useCurrentUser();
+
+  return useMutation(deleteHelmRepository, {
+    onSuccess: (_, helmRepository) => {
+      notifySuccess('Helm repository deleted successfully', helmRepository.URL);
+      return queryClient.invalidateQueries(queryKeys.registries(user.Id));
+    },
+    ...withError('Unable to delete Helm repository'),
+  });
+}
+
+export function useDeleteHelmRepositoriesMutation() {
+  const queryClient = useQueryClient();
+  const { user } = useCurrentUser();
+
+  return useMutation(deleteHelmRepositories, {
+    onSuccess: () => {
+      notifySuccess(
+        'Success',
+        `Helm ${pluralize(
+          deleteHelmRepositories.length,
+          'repository',
+          'repositories'
+        )} deleted successfully`
+      );
+      return queryClient.invalidateQueries(queryKeys.registries(user.Id));
+    },
+    ...withError('Unable to delete Helm repositories'),
+  });
+}
+
+export function useHelmRepositories(userId: number) {
+  return useQuery(
+    queryKeys.registries(userId),
+    () => getHelmRepositories(userId),
+    {
+      staleTime: 20,
+      ...withError('Unable to retrieve Helm repositories'),
+    }
+  );
+}
+
+export function useCreateHelmRepositoryMutation() {
+  const queryClient = useQueryClient();
+  const { user } = useCurrentUser();
+
+  return useMutation(createHelmRepository, {
+    onSuccess: (_, payload) => {
+      notifySuccess('Helm repository created successfully', payload.URL);
+      return queryClient.invalidateQueries(queryKeys.registries(user.Id));
+    },
+    ...withError('Unable to create Helm repository'),
+  });
+}
+
+function buildUrl(userId: number, helmRepositoryId?: number) {
+  if (helmRepositoryId) {
+    return `/users/${userId}/helm/repositories/${helmRepositoryId}`;
+  }
+  return `/users/${userId}/helm/repositories`;
+}
diff --git a/app/react/portainer/account/AccountView/HelmRepositoryDatatable/index.ts b/app/react/portainer/account/AccountView/HelmRepositoryDatatable/index.ts
new file mode 100644
index 0000000..64dad6a
--- /dev/null
+++ b/app/react/portainer/account/AccountView/HelmRepositoryDatatable/index.ts
@@ -0,0 +1 @@
+export { HelmRepositoryDatatable } from './HelmRepositoryDatatable';
diff --git a/app/react/portainer/account/AccountView/HelmRepositoryDatatable/types.ts b/app/react/portainer/account/AccountView/HelmRepositoryDatatable/types.ts
new file mode 100644
index 0000000..c883e39
--- /dev/null
+++ b/app/react/portainer/account/AccountView/HelmRepositoryDatatable/types.ts
@@ -0,0 +1,20 @@
+export interface CreateHelmRepositoryPayload {
+  UserId: number;
+  URL: string;
+}
+
+export interface HelmRepositoryFormValues {
+  URL: string;
+}
+
+export interface HelmRepository {
+  Id: number;
+  UserId: number;
+  URL: string;
+  Global: boolean;
+}
+
+export interface HelmRepositories {
+  UserRepositories: HelmRepository[];
+  GlobalRepository: string;
+}
diff --git a/app/react/portainer/account/AccountView/theme-options.tsx b/app/react/portainer/account/AccountView/theme-options.tsx
new file mode 100644
index 0000000..0976084
--- /dev/null
+++ b/app/react/portainer/account/AccountView/theme-options.tsx
@@ -0,0 +1,30 @@
+import { Eye, Moon, Sun, RefreshCw } from 'lucide-react';
+
+import { BadgeIcon } from '@@/BadgeIcon';
+
+export const options = [
+  {
+    id: 'light',
+    icon: <BadgeIcon icon={Sun} />,
+    label: 'Light Theme',
+    value: 'light',
+  },
+  {
+    id: 'dark',
+    icon: <BadgeIcon icon={Moon} />,
+    label: 'Dark Theme',
+    value: 'dark',
+  },
+  {
+    id: 'highcontrast',
+    icon: <BadgeIcon icon={Eye} />,
+    label: 'High Contrast',
+    value: 'highcontrast',
+  },
+  {
+    id: 'auto',
+    icon: <BadgeIcon icon={RefreshCw} />,
+    label: 'System Theme',
+    value: 'auto',
+  },
+] as const;
diff --git a/app/react/portainer/account/CreateAccessTokenView/CreateUserAcccessToken.validation.tsx b/app/react/portainer/account/CreateAccessTokenView/CreateUserAcccessToken.validation.tsx
new file mode 100644
index 0000000..0a38e0a
--- /dev/null
+++ b/app/react/portainer/account/CreateAccessTokenView/CreateUserAcccessToken.validation.tsx
@@ -0,0 +1,23 @@
+import { SchemaOf, object, string } from 'yup';
+
+import { ApiKeyFormValues } from './types';
+
+export function getAPITokenValidationSchema(
+  requirePassword: boolean
+): SchemaOf<ApiKeyFormValues> {
+  if (requirePassword) {
+    return object({
+      password: string().required('Password is required.'),
+      description: string()
+        .max(128, 'Description must be at most 128 characters')
+        .required('Description is required.'),
+    });
+  }
+
+  return object({
+    password: string().optional(),
+    description: string()
+      .max(128, 'Description must be at most 128 characters')
+      .required('Description is required.'),
+  });
+}
diff --git a/app/react/portainer/account/CreateAccessTokenView/CreateUserAccessToken.test.tsx b/app/react/portainer/account/CreateAccessTokenView/CreateUserAccessToken.test.tsx
new file mode 100644
index 0000000..7c6c666
--- /dev/null
+++ b/app/react/portainer/account/CreateAccessTokenView/CreateUserAccessToken.test.tsx
@@ -0,0 +1,46 @@
+import userEvent from '@testing-library/user-event';
+import { render, waitFor } from '@testing-library/react';
+
+import { UserViewModel } from '@/portainer/models/user';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+
+import { CreateUserAccessToken } from './CreateUserAccessToken';
+
+test('the button is disabled when all fields are blank and enabled when all fields are filled', async () => {
+  const { getByRole, getByLabelText } = renderComponent();
+
+  const button = getByRole('button', { name: 'Add access token' });
+  await waitFor(() => {
+    expect(button).toBeDisabled();
+  });
+
+  const descriptionField = getByLabelText(/Description/);
+  const passwordField = getByLabelText(/Current password/);
+
+  await userEvent.type(passwordField, 'password');
+  await userEvent.type(descriptionField, 'description');
+
+  await waitFor(() => {
+    expect(button).toBeEnabled();
+  });
+
+  await userEvent.clear(descriptionField);
+  await waitFor(() => {
+    expect(button).toBeDisabled();
+  });
+});
+
+function renderComponent() {
+  const user = new UserViewModel({
+    Username: 'admin',
+    Id: 1,
+  });
+
+  const Wrapped = withTestQueryProvider(
+    withUserProvider(withTestRouter(CreateUserAccessToken), user)
+  );
+
+  return render(<Wrapped />);
+}
diff --git a/app/react/portainer/account/CreateAccessTokenView/CreateUserAccessToken.tsx b/app/react/portainer/account/CreateAccessTokenView/CreateUserAccessToken.tsx
new file mode 100644
index 0000000..c55e60c
--- /dev/null
+++ b/app/react/portainer/account/CreateAccessTokenView/CreateUserAccessToken.tsx
@@ -0,0 +1,80 @@
+import { Formik } from 'formik';
+import { useState } from 'react';
+
+import { useCurrentUser } from '@/react/hooks/useUser';
+import { AuthenticationMethod } from '@/react/portainer/settings/types';
+
+import { Widget } from '@@/Widget';
+import { PageHeader } from '@@/PageHeader';
+
+import { usePublicSettings } from '../../settings/queries/usePublicSettings';
+
+import { ApiKeyFormValues } from './types';
+import { getAPITokenValidationSchema } from './CreateUserAcccessToken.validation';
+import { useCreateUserAccessTokenMutation } from './useCreateUserAccessTokenMutation';
+import { CreateUserAccessTokenInnerForm } from './CreateUserAccessTokenInnerForm';
+import { DisplayUserAccessToken } from './DisplayUserAccessToken';
+
+const initialValues: ApiKeyFormValues = {
+  password: '',
+  description: '',
+};
+
+export function CreateUserAccessToken() {
+  const mutation = useCreateUserAccessTokenMutation();
+  const { user } = useCurrentUser();
+  const [newAPIToken, setNewAPIToken] = useState('');
+  const settings = usePublicSettings();
+
+  const requirePassword =
+    settings.data?.AuthenticationMethod === AuthenticationMethod.Internal ||
+    user.Id === 1;
+
+  return (
+    <>
+      <PageHeader
+        title="Create access token"
+        breadcrumbs={[
+          { label: 'My account', link: 'portainer.account' },
+          'Add access token',
+        ]}
+        reload
+      />
+
+      <div className="row">
+        <div className="col-sm-12">
+          <Widget>
+            <Widget.Body>
+              {newAPIToken === '' ? (
+                <Formik
+                  initialValues={initialValues}
+                  onSubmit={onSubmit}
+                  validationSchema={getAPITokenValidationSchema(
+                    requirePassword
+                  )}
+                >
+                  <CreateUserAccessTokenInnerForm
+                    showAuthentication={requirePassword}
+                  />
+                </Formik>
+              ) : (
+                <DisplayUserAccessToken apikey={newAPIToken} />
+              )}
+            </Widget.Body>
+          </Widget>
+        </div>
+      </div>
+    </>
+  );
+
+  async function onSubmit(values: ApiKeyFormValues) {
+    mutation.mutate(
+      { values, userid: user.Id },
+      {
+        onSuccess(response) {
+          setNewAPIToken(response);
+        },
+      }
+    );
+  }
+}
diff --git a/app/react/portainer/account/CreateAccessTokenView/CreateUserAccessTokenInnerForm.tsx b/app/react/portainer/account/CreateAccessTokenView/CreateUserAccessTokenInnerForm.tsx
new file mode 100644
index 0000000..186a26e
--- /dev/null
+++ b/app/react/portainer/account/CreateAccessTokenView/CreateUserAccessTokenInnerForm.tsx
@@ -0,0 +1,63 @@
+import { Field, Form, useFormikContext } from 'formik';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+import { LoadingButton } from '@@/buttons';
+
+import { ApiKeyFormValues } from './types';
+
+interface Props {
+  showAuthentication: boolean;
+}
+
+export function CreateUserAccessTokenInnerForm({ showAuthentication }: Props) {
+  const { errors, values, handleSubmit, isValid, dirty } =
+    useFormikContext<ApiKeyFormValues>();
+
+  return (
+    <Form
+      className="form-horizontal"
+      onSubmit={handleSubmit}
+      autoComplete="off"
+    >
+      {showAuthentication && (
+        <FormControl
+          inputId="password"
+          label="Current password"
+          required
+          errors={errors.password}
+        >
+          <Field
+            as={Input}
+            type="password"
+            id="password"
+            name="password"
+            value={values.password}
+            autoComplete="new-password"
+          />
+        </FormControl>
+      )}
+      <FormControl
+        inputId="description"
+        label="Description"
+        required
+        errors={errors.description}
+      >
+        <Field
+          as={Input}
+          id="description"
+          name="description"
+          value={values.description}
+        />
+      </FormControl>
+      <LoadingButton
+        disabled={!isValid || !dirty}
+        data-cy="create-access-token-button"
+        isLoading={false}
+        loadingText="Adding access token..."
+      >
+        Add access token
+      </LoadingButton>
+    </Form>
+  );
+}
diff --git a/app/react/portainer/account/CreateAccessTokenView/DisplayUserAccessToken.tsx b/app/react/portainer/account/CreateAccessTokenView/DisplayUserAccessToken.tsx
new file mode 100644
index 0000000..49a01c8
--- /dev/null
+++ b/app/react/portainer/account/CreateAccessTokenView/DisplayUserAccessToken.tsx
@@ -0,0 +1,38 @@
+import { Button, CopyButton } from '@@/buttons';
+import { FormSectionTitle } from '@@/form-components/FormSectionTitle';
+import { TextTip } from '@@/Tip/TextTip';
+import { Link } from '@@/Link';
+
+export function DisplayUserAccessToken({ apikey }: { apikey: string }) {
+  return (
+    <>
+      <FormSectionTitle>New access token</FormSectionTitle>
+      <TextTip>
+        Please copy the new access token. You won&#39;t be able to view the
+        token again.
+      </TextTip>
+      <div className="pt-5">
+        <div className="inline-flex">
+          <div className="">{apikey}</div>
+          <div>
+            <CopyButton
+              copyText={apikey}
+              color="link"
+              data-cy="create-access-token-copy-button"
+            />
+          </div>
+        </div>
+        <hr />
+      </div>
+      <Button
+        as={Link}
+        props={{
+          to: 'portainer.account',
+        }}
+        data-cy="create-access-token-done-button"
+      >
+        Done
+      </Button>
+    </>
+  );
+}
diff --git a/app/react/portainer/account/CreateAccessTokenView/index.ts b/app/react/portainer/account/CreateAccessTokenView/index.ts
new file mode 100644
index 0000000..66872c3
--- /dev/null
+++ b/app/react/portainer/account/CreateAccessTokenView/index.ts
@@ -0,0 +1 @@
+export { CreateUserAccessToken } from './CreateUserAccessToken';
diff --git a/app/react/portainer/account/CreateAccessTokenView/types.ts b/app/react/portainer/account/CreateAccessTokenView/types.ts
new file mode 100644
index 0000000..fd663a2
--- /dev/null
+++ b/app/react/portainer/account/CreateAccessTokenView/types.ts
@@ -0,0 +1,4 @@
+export interface ApiKeyFormValues {
+  password?: string;
+  description: string;
+}
diff --git a/app/react/portainer/account/CreateAccessTokenView/useCreateUserAccessTokenMutation.ts b/app/react/portainer/account/CreateAccessTokenView/useCreateUserAccessTokenMutation.ts
new file mode 100644
index 0000000..0c9bb4d
--- /dev/null
+++ b/app/react/portainer/account/CreateAccessTokenView/useCreateUserAccessTokenMutation.ts
@@ -0,0 +1,39 @@
+import { useMutation } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { ApiKeyFormValues } from './types';
+
+export interface ApiKeyResponse {
+  rawAPIKey: string;
+}
+
+export function useCreateUserAccessTokenMutation() {
+  return useMutation(createUserAccessToken, {
+    ...withError('Unable to create access token'),
+    onSuccess: () => {
+      notifySuccess('Success', 'Access token successfully created');
+      // TODO: invalidate query when user page migrated to react.
+    },
+  });
+}
+
+async function createUserAccessToken({
+  values,
+  userid,
+}: {
+  values: ApiKeyFormValues;
+  userid: number;
+}) {
+  try {
+    const response = await axios.post<ApiKeyResponse>(
+      `/users/${userid}/tokens`,
+      values
+    );
+    return response.data.rawAPIKey;
+  } catch (e) {
+    throw parseAxiosError(e);
+  }
+}
diff --git a/app/react/portainer/account/access-tokens/queries/build-url.ts b/app/react/portainer/account/access-tokens/queries/build-url.ts
new file mode 100644
index 0000000..861f474
--- /dev/null
+++ b/app/react/portainer/account/access-tokens/queries/build-url.ts
@@ -0,0 +1,8 @@
+import { UserId } from '@/portainer/users/types';
+
+import { AccessToken } from '../types';
+
+export function buildUrl(userId: UserId, id?: AccessToken['id']) {
+  const baseUrl = `/users/${userId}/tokens`;
+  return id ? `${baseUrl}/${id}` : baseUrl;
+}
diff --git a/app/react/portainer/account/access-tokens/queries/query-keys.ts b/app/react/portainer/account/access-tokens/queries/query-keys.ts
new file mode 100644
index 0000000..6ee78c4
--- /dev/null
+++ b/app/react/portainer/account/access-tokens/queries/query-keys.ts
@@ -0,0 +1,6 @@
+import { userQueryKeys } from '@/portainer/users/queries/queryKeys';
+import { UserId } from '@/portainer/users/types';
+
+export const queryKeys = {
+  base: (userId: UserId) => [...userQueryKeys.user(userId), 'tokens'] as const,
+};
diff --git a/app/react/portainer/account/access-tokens/queries/useAccessTokens.ts b/app/react/portainer/account/access-tokens/queries/useAccessTokens.ts
new file mode 100644
index 0000000..4a1b06c
--- /dev/null
+++ b/app/react/portainer/account/access-tokens/queries/useAccessTokens.ts
@@ -0,0 +1,27 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { useCurrentUser } from '@/react/hooks/useUser';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { AccessToken } from '../types';
+
+import { queryKeys } from './query-keys';
+import { buildUrl } from './build-url';
+
+export function useAccessTokens() {
+  const { user } = useCurrentUser();
+
+  return useQuery({
+    queryKey: queryKeys.base(user.Id),
+    queryFn: () => getAccessTokens(user.Id),
+  });
+}
+
+async function getAccessTokens(userId: number) {
+  try {
+    const { data } = await axios.get<Array<AccessToken>>(buildUrl(userId));
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to get access tokens');
+  }
+}
diff --git a/app/react/portainer/account/access-tokens/types.ts b/app/react/portainer/account/access-tokens/types.ts
new file mode 100644
index 0000000..b099c2d
--- /dev/null
+++ b/app/react/portainer/account/access-tokens/types.ts
@@ -0,0 +1,22 @@
+/**
+ * AccessToken represents an API key
+ */
+export interface AccessToken {
+  id: number;
+
+  userId: number;
+
+  description: string;
+
+  /** API key identifier (7 char prefix) */
+  prefix: string;
+
+  /** Unix timestamp (UTC) when the API key was created */
+  dateCreated: number;
+
+  /** Unix timestamp (UTC) when the API key was last used */
+  lastUsed: number;
+
+  /** Digest represents SHA256 hash of the raw API key */
+  digest?: string;
+}
diff --git a/app/react/portainer/account/git-credentials/types.ts b/app/react/portainer/account/git-credentials/types.ts
new file mode 100644
index 0000000..d1f2e0e
--- /dev/null
+++ b/app/react/portainer/account/git-credentials/types.ts
@@ -0,0 +1,4 @@
+export enum AuthTypeOption {
+  Basic = 0,
+  Token = 1,
+}
diff --git a/app/react/portainer/account/helm-repositories/CreateHelmRepositoryView/CreateHelmRepositoriesView.tsx b/app/react/portainer/account/helm-repositories/CreateHelmRepositoryView/CreateHelmRepositoriesView.tsx
new file mode 100644
index 0000000..a5351ba
--- /dev/null
+++ b/app/react/portainer/account/helm-repositories/CreateHelmRepositoryView/CreateHelmRepositoriesView.tsx
@@ -0,0 +1,29 @@
+import { PageHeader } from '@@/PageHeader';
+import { Widget, WidgetBody } from '@@/Widget';
+
+import { CreateHelmRepositoryForm } from './CreateHelmRespositoriesForm';
+
+export function CreateHelmRepositoriesView() {
+  return (
+    <>
+      <PageHeader
+        title="Create Helm repository"
+        breadcrumbs={[
+          { label: 'My account', link: 'portainer.account' },
+          { label: 'Create Helm repository' },
+        ]}
+        reload
+      />
+
+      <div className="row">
+        <div className="col-sm-12">
+          <Widget>
+            <WidgetBody>
+              <CreateHelmRepositoryForm />
+            </WidgetBody>
+          </Widget>
+        </div>
+      </div>
+    </>
+  );
+}
diff --git a/app/react/portainer/account/helm-repositories/CreateHelmRepositoryView/CreateHelmRespositoriesForm.tsx b/app/react/portainer/account/helm-repositories/CreateHelmRepositoryView/CreateHelmRespositoriesForm.tsx
new file mode 100644
index 0000000..4354dbd
--- /dev/null
+++ b/app/react/portainer/account/helm-repositories/CreateHelmRepositoryView/CreateHelmRespositoriesForm.tsx
@@ -0,0 +1,47 @@
+import { useRouter } from '@uirouter/react';
+
+import { useCurrentUser } from '@/react/hooks/useUser';
+
+import {
+  CreateHelmRepositoryPayload,
+  HelmRepositoryFormValues,
+} from '../../AccountView/HelmRepositoryDatatable/types';
+import {
+  useHelmRepositories,
+  useCreateHelmRepositoryMutation,
+} from '../../AccountView/HelmRepositoryDatatable/helm-repositories.service';
+import { HelmRepositoryForm } from '../components/HelmRepositoryForm';
+
+export function CreateHelmRepositoryForm() {
+  const router = useRouter();
+  const currentUser = useCurrentUser();
+
+  const createHelmRepositoryMutation = useCreateHelmRepositoryMutation();
+  const helmReposQuery = useHelmRepositories(currentUser.user.Id);
+
+  const allRepositories =
+    helmReposQuery.data?.UserRepositories.map((x) => x.URL) || [];
+  if (helmReposQuery.data?.GlobalRepository) {
+    allRepositories.push(helmReposQuery.data?.GlobalRepository);
+  }
+
+  return (
+    <HelmRepositoryForm
+      isLoading={createHelmRepositoryMutation.isLoading}
+      onSubmit={onSubmit}
+      URLs={allRepositories}
+    />
+  );
+
+  function onSubmit(values: HelmRepositoryFormValues) {
+    const payload: CreateHelmRepositoryPayload = {
+      ...values,
+      UserId: currentUser.user.Id,
+    };
+    createHelmRepositoryMutation.mutate(payload, {
+      onSuccess: () => {
+        router.stateService.go('portainer.account');
+      },
+    });
+  }
+}
diff --git a/app/react/portainer/account/helm-repositories/CreateHelmRepositoryView/index.ts b/app/react/portainer/account/helm-repositories/CreateHelmRepositoryView/index.ts
new file mode 100644
index 0000000..fcfce00
--- /dev/null
+++ b/app/react/portainer/account/helm-repositories/CreateHelmRepositoryView/index.ts
@@ -0,0 +1 @@
+export { CreateHelmRepositoriesView } from './CreateHelmRepositoriesView';
diff --git a/app/react/portainer/account/helm-repositories/components/CreateHelmRepositoryForm.validation.ts b/app/react/portainer/account/helm-repositories/components/CreateHelmRepositoryForm.validation.ts
new file mode 100644
index 0000000..9b51b08
--- /dev/null
+++ b/app/react/portainer/account/helm-repositories/components/CreateHelmRepositoryForm.validation.ts
@@ -0,0 +1,19 @@
+import { object, string } from 'yup';
+
+import { isValidUrl } from '@@/form-components/validate-url';
+
+export function noDuplicateURLsSchema(urls: string[]) {
+  return string()
+    .required('URL is required')
+    .test('not existing name', 'URL is already added', (newName) =>
+      urls.every((name) => name !== newName)
+    );
+}
+
+export function validationSchema(urls: string[]) {
+  return object().shape({
+    URL: noDuplicateURLsSchema(urls)
+      .test('valid-url', 'Invalid URL', (value) => !value || isValidUrl(value))
+      .required('URL is required'),
+  });
+}
diff --git a/app/react/portainer/account/helm-repositories/components/HelmRepositoryForm.tsx b/app/react/portainer/account/helm-repositories/components/HelmRepositoryForm.tsx
new file mode 100644
index 0000000..203c4e6
--- /dev/null
+++ b/app/react/portainer/account/helm-repositories/components/HelmRepositoryForm.tsx
@@ -0,0 +1,81 @@
+import { Field, Form, Formik } from 'formik';
+import { useRouter } from '@uirouter/react';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+import { LoadingButton } from '@@/buttons/LoadingButton';
+import { Button } from '@@/buttons';
+
+import { HelmRepositoryFormValues } from '../../AccountView/HelmRepositoryDatatable/types';
+
+import { validationSchema } from './CreateHelmRepositoryForm.validation';
+
+type Props = {
+  isEditing?: boolean;
+  isLoading: boolean;
+  onSubmit: (formValues: HelmRepositoryFormValues) => void;
+  URLs: string[];
+};
+
+const defaultInitialValues: HelmRepositoryFormValues = {
+  URL: '',
+};
+
+export function HelmRepositoryForm({
+  isEditing = false,
+  isLoading,
+  onSubmit,
+  URLs,
+}: Props) {
+  const router = useRouter();
+
+  return (
+    <Formik<HelmRepositoryFormValues>
+      initialValues={defaultInitialValues}
+      enableReinitialize
+      validationSchema={() => validationSchema(URLs)}
+      onSubmit={(values) => onSubmit(values)}
+      validateOnMount
+    >
+      {({ values, errors, handleSubmit, isValid, dirty }) => (
+        <Form className="form-horizontal" onSubmit={handleSubmit} noValidate>
+          <FormControl
+            inputId="url-field"
+            label="URL"
+            errors={errors.URL}
+            required
+          >
+            <Field
+              as={Input}
+              name="URL"
+              value={values.URL}
+              autoComplete="off"
+              id="url-field"
+            />
+          </FormControl>
+          <div className="form-group">
+            <div className="col-sm-12 mt-3">
+              <LoadingButton
+                disabled={!isValid || !dirty}
+                data-cy="helm-repository-save-button"
+                isLoading={isLoading}
+                loadingText="Saving Helm repository..."
+              >
+                {isEditing ? 'Update Helm repository' : 'Save Helm repository'}
+              </LoadingButton>
+              {isEditing && (
+                <Button
+                  color="default"
+                  data-cy="helm-repository-cancel-button"
+                  onClick={() => router.stateService.go('portainer.account')}
+                >
+                  Cancel
+                </Button>
+              )}
+            </div>
+          </div>
+        </Form>
+      )}
+    </Formik>
+  );
+}
diff --git a/app/react/portainer/account/useUpdateUserMutation.tsx b/app/react/portainer/account/useUpdateUserMutation.tsx
new file mode 100644
index 0000000..0643f39
--- /dev/null
+++ b/app/react/portainer/account/useUpdateUserMutation.tsx
@@ -0,0 +1,41 @@
+import { useMutation } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { ThemeColor } from '@/portainer/users/types';
+import {
+  mutationOptions,
+  withInvalidate,
+  queryClient,
+} from '@/react-tools/react-query';
+import { userQueryKeys } from '@/portainer/users/queries/queryKeys';
+import { useCurrentUser } from '@/react/hooks/useUser';
+
+export type UserUpdatePayload = {
+  username?: string;
+  password?: string;
+  newPassword?: string;
+  useCache?: boolean;
+  theme?: { color: ThemeColor };
+  role?: number;
+};
+
+export function useUpdateUserMutation() {
+  const {
+    user: { Id: userId },
+  } = useCurrentUser();
+
+  return useMutation(
+    (payload: UserUpdatePayload) => updateUser(payload, userId),
+    mutationOptions(withInvalidate(queryClient, [userQueryKeys.base()]))
+    // error notification should be handled by the caller
+  );
+}
+
+async function updateUser(payload: UserUpdatePayload, userId: number) {
+  try {
+    const { data } = await axios.put(`/users/${userId}`, payload);
+    return data;
+  } catch (error) {
+    throw parseAxiosError(error);
+  }
+}
diff --git a/app/react/portainer/common/PortainerTunnelAddrField.tsx b/app/react/portainer/common/PortainerTunnelAddrField.tsx
new file mode 100644
index 0000000..4f03f0a
--- /dev/null
+++ b/app/react/portainer/common/PortainerTunnelAddrField.tsx
@@ -0,0 +1,65 @@
+import { Field, useField } from 'formik';
+import { string } from 'yup';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+
+interface Props {
+  fieldName: string;
+  readonly?: boolean;
+  required?: boolean;
+}
+
+export function PortainerTunnelAddrField({
+  fieldName,
+  readonly,
+  required,
+}: Props) {
+  const [, metaProps] = useField(fieldName);
+  const id = `${fieldName}-input`;
+
+  return (
+    <FormControl
+      label="Portainer tunnel server address"
+      tooltip="Address of this Portainer instance that will be used by Edge agents to establish a reverse tunnel."
+      required
+      errors={metaProps.error}
+      inputId={id}
+    >
+      <Field
+        id={id}
+        name={fieldName}
+        as={Input}
+        placeholder="portainer.mydomain.tld"
+        required={required}
+        readOnly={readonly}
+      />
+    </FormControl>
+  );
+}
+
+export function validation() {
+  return string()
+    .required('Tunnel server address is required')
+    .test(
+      'valid tunnel server URL',
+      'The tunnel server address must be a valid address (localhost cannot be used)',
+      (value) => {
+        if (!value) {
+          return false;
+        }
+
+        return !value.startsWith('localhost');
+      }
+    );
+}
+
+/**
+ * Returns an address that can be used as a default value for the Portainer tunnel server address
+ * based on the current window location.
+ * Used for Edge Compute.
+ *
+ */
+export function buildDefaultValue() {
+  return `${window.location.hostname}:8000`;
+}
diff --git a/app/react/portainer/common/PortainerUrlField.tsx b/app/react/portainer/common/PortainerUrlField.tsx
new file mode 100644
index 0000000..e85b968
--- /dev/null
+++ b/app/react/portainer/common/PortainerUrlField.tsx
@@ -0,0 +1,67 @@
+import { Field, useField } from 'formik';
+import { string } from 'yup';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+import { isValidUrl } from '@@/form-components/validate-url';
+
+interface Props {
+  fieldName: string;
+  readonly?: boolean;
+  required?: boolean;
+  tooltip?: string;
+}
+
+export function PortainerUrlField({
+  fieldName,
+  readonly,
+  required,
+  tooltip = 'URL of the Portainer instance that the agent will use to initiate the communications.',
+}: Props) {
+  const [, metaProps] = useField(fieldName);
+  const id = `${fieldName}-input`;
+
+  return (
+    <FormControl
+      label="Portainer API server URL"
+      tooltip={tooltip}
+      required
+      errors={metaProps.error}
+      inputId={id}
+    >
+      <Field
+        id={id}
+        name={fieldName}
+        as={Input}
+        placeholder="https://portainer.mydomain.tld"
+        required={required}
+        data-cy="endpointCreate-portainerServerUrlInput"
+        readOnly={readonly}
+      />
+    </FormControl>
+  );
+}
+
+export function validation() {
+  return string()
+    .required('API server URL is required')
+    .test(
+      'valid API server URL',
+      'The API server URL must be a valid URL (localhost cannot be used)',
+      (value) =>
+        isValidUrl(
+          value,
+          (url) => !!url.hostname && url.hostname !== 'localhost'
+        )
+    );
+}
+
+/**
+ * Returns a URL that can be used as a default value for the Portainer server API URL
+ * based on the current window location.
+ * Used for Edge Compute.
+ *
+ */
+export function buildDefaultValue() {
+  return `${window.location.protocol}//${window.location.host}`;
+}
diff --git a/app/react/portainer/custom-templates/.keep b/app/react/portainer/custom-templates/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/portainer/custom-templates/CreateView/.keep b/app/react/portainer/custom-templates/CreateView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/portainer/custom-templates/ItemView/.keep b/app/react/portainer/custom-templates/ItemView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/portainer/custom-templates/ListView/.keep b/app/react/portainer/custom-templates/ListView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/portainer/custom-templates/components/CommonFields.tsx b/app/react/portainer/custom-templates/components/CommonFields.tsx
new file mode 100644
index 0000000..4b44589
--- /dev/null
+++ b/app/react/portainer/custom-templates/components/CommonFields.tsx
@@ -0,0 +1,123 @@
+import { SchemaOf, object, string } from 'yup';
+import { FormikErrors } from 'formik';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+
+import { CustomTemplate } from '../../templates/custom-templates/types';
+
+export interface Values {
+  Title: string;
+  Description: string;
+  Note: string;
+  Logo: string;
+}
+
+export function CommonFields({
+  values,
+  onChange,
+  errors,
+}: {
+  values: Values;
+  onChange: (values: Values) => void;
+  errors?: FormikErrors<Values>;
+}) {
+  return (
+    <>
+      <FormControl
+        label="Title"
+        required
+        inputId="template-title"
+        errors={errors?.Title}
+      >
+        <Input
+          name="title"
+          data-cy="custom-templates-title-input"
+          placeholder="e.g. mytemplate"
+          id="template-title"
+          required
+          value={values.Title}
+          onChange={(e) => {
+            handleChange({ Title: e.target.value });
+          }}
+        />
+      </FormControl>
+
+      <FormControl
+        label="Description"
+        required
+        inputId="template-description"
+        errors={errors?.Description}
+      >
+        <Input
+          name="description"
+          data-cy="custom-templates-description-input"
+          id="template-description"
+          required
+          value={values.Description}
+          onChange={(e) => {
+            handleChange({ Description: e.target.value });
+          }}
+        />
+      </FormControl>
+
+      <FormControl label="Note" inputId="template-note" errors={errors?.Note}>
+        <Input
+          name="note"
+          data-cy="custom-templates-note-input"
+          id="template-note"
+          value={values.Note}
+          onChange={(e) => {
+            handleChange({ Note: e.target.value });
+          }}
+        />
+      </FormControl>
+
+      <FormControl label="Logo" inputId="template-logo" errors={errors?.Logo}>
+        <Input
+          name="logo"
+          data-cy="custom-templates-logo-input"
+          id="template-logo"
+          value={values.Logo}
+          onChange={(e) => {
+            handleChange({ Logo: e.target.value });
+          }}
+        />
+      </FormControl>
+    </>
+  );
+
+  function handleChange(change: Partial<Values>) {
+    onChange({ ...values, ...change });
+  }
+}
+
+export function validation({
+  currentTemplateId,
+  templates = [],
+}: {
+  currentTemplateId?: CustomTemplate['Id'];
+  templates?: Array<CustomTemplate>;
+} = {}): SchemaOf<Values> {
+  return object({
+    Title: string()
+      .required('Title is required.')
+      .test(
+        'is-unique',
+        'Title must be unique',
+        (value) =>
+          !value ||
+          !templates.some(
+            (template) =>
+              template.Title === value && template.Id !== currentTemplateId
+          )
+      )
+      .max(
+        200,
+        'Custom template title must be less than or equal to 200 characters'
+      ),
+    Description: string().required('Description is required.'),
+    Note: string().default(''),
+    Logo: string().default(''),
+  });
+}
diff --git a/app/react/portainer/custom-templates/components/CustomTemplatesVariablesDefinitionField/CustomTemplatesVariablesDefinitionField.stories.tsx b/app/react/portainer/custom-templates/components/CustomTemplatesVariablesDefinitionField/CustomTemplatesVariablesDefinitionField.stories.tsx
new file mode 100644
index 0000000..e066287
--- /dev/null
+++ b/app/react/portainer/custom-templates/components/CustomTemplatesVariablesDefinitionField/CustomTemplatesVariablesDefinitionField.stories.tsx
@@ -0,0 +1,36 @@
+import { Meta } from '@storybook/react-webpack5';
+import { useState } from 'react';
+
+import {
+  CustomTemplatesVariablesDefinitionField,
+  VariableDefinition,
+} from './CustomTemplatesVariablesDefinitionField';
+
+export default {
+  title: 'Components/Custom Templates/Variables Definition Field',
+  component: CustomTemplatesVariablesDefinitionField,
+  args: {},
+} as Meta<typeof CustomTemplatesVariablesDefinitionField>;
+
+function Template() {
+  const [value, setValue] = useState<VariableDefinition[]>([
+    { label: '', name: '', defaultValue: '', description: '' },
+  ]);
+
+  return (
+    <CustomTemplatesVariablesDefinitionField
+      value={value}
+      onChange={setValue}
+      errors={[
+        {
+          name: 'required',
+          defaultValue: 'non empty',
+          description: '',
+          label: 'invalid',
+        },
+      ]}
+    />
+  );
+}
+
+export const Story = Template.bind({});
diff --git a/app/react/portainer/custom-templates/components/CustomTemplatesVariablesDefinitionField/CustomTemplatesVariablesDefinitionField.tsx b/app/react/portainer/custom-templates/components/CustomTemplatesVariablesDefinitionField/CustomTemplatesVariablesDefinitionField.tsx
new file mode 100644
index 0000000..3eded90
--- /dev/null
+++ b/app/react/portainer/custom-templates/components/CustomTemplatesVariablesDefinitionField/CustomTemplatesVariablesDefinitionField.tsx
@@ -0,0 +1,135 @@
+import { SchemaOf, array, object, string } from 'yup';
+
+import { FormError } from '@@/form-components/FormError';
+import { Input } from '@@/form-components/Input';
+import { InputList } from '@@/form-components/InputList';
+import { ArrayError, ItemProps } from '@@/form-components/InputList/InputList';
+
+export interface VariableDefinition {
+  name: string;
+  label: string;
+  defaultValue: string;
+  description: string;
+}
+
+export type Values = VariableDefinition[];
+
+interface Props {
+  value: Values;
+  onChange: (value: Values) => void;
+  errors?: ArrayError<Values>;
+  isVariablesNamesFromParent?: boolean;
+}
+
+export function CustomTemplatesVariablesDefinitionField({
+  onChange,
+  value,
+  errors,
+  isVariablesNamesFromParent,
+}: Props) {
+  return (
+    <InputList
+      label="Variables definition"
+      onChange={onChange}
+      value={value}
+      renderItem={(item, onChange, index, error) => (
+        <Item
+          item={item}
+          onChange={onChange}
+          error={error}
+          index={index}
+          isNameReadonly={isVariablesNamesFromParent}
+        />
+      )}
+      itemBuilder={() => ({
+        label: '',
+        name: '',
+        defaultValue: '',
+        description: '',
+      })}
+      errors={errors}
+      textTip="List should map the mustache variables in the template file, if default value is empty, the variable will be required."
+      isAddButtonHidden={isVariablesNamesFromParent}
+      data-cy="custom-templates-variables-field"
+    />
+  );
+}
+
+interface DefinitionItemProps extends ItemProps<VariableDefinition> {
+  isNameReadonly?: boolean;
+}
+
+function Item({
+  item,
+  onChange,
+  error,
+  isNameReadonly,
+  index,
+}: DefinitionItemProps) {
+  const errorObj = typeof error === 'object' ? error : {};
+
+  return (
+    <div className="flex gap-2">
+      <div>
+        <Input
+          value={item.name}
+          name="name"
+          onChange={handleChange}
+          placeholder="Name (e.g var_name)"
+          readOnly={isNameReadonly}
+          data-cy={`custom-templates-item-name-field_${index}`}
+        />
+        {errorObj?.name && <FormError>{errorObj.name}</FormError>}
+      </div>
+      <div>
+        <Input
+          value={item.label}
+          onChange={handleChange}
+          placeholder="Label"
+          name="label"
+          data-cy={`custom-templates-item-label-field_${index}`}
+        />
+        {errorObj?.label && <FormError>{errorObj.label}</FormError>}
+      </div>
+      <div>
+        <Input
+          name="description"
+          value={item.description}
+          onChange={handleChange}
+          placeholder="Description"
+          data-cy={`custom-templates-item-description-field_${index}`}
+        />
+        {errorObj?.description && <FormError>{errorObj.description}</FormError>}
+      </div>
+      <div>
+        <Input
+          value={item.defaultValue}
+          onChange={handleChange}
+          placeholder="Default Value"
+          name="defaultValue"
+          data-cy={`custom-templates-item-default-value-field_${index}`}
+        />
+        {errorObj?.defaultValue && (
+          <FormError>{errorObj.defaultValue}</FormError>
+        )}
+      </div>
+    </div>
+  );
+
+  function handleChange(e: React.ChangeEvent<HTMLInputElement>) {
+    onChange({ ...item, [e.target.name]: e.target.value });
+  }
+}
+
+function itemValidation(): SchemaOf<VariableDefinition> {
+  return object().shape({
+    name: string().required('Name is required'),
+    label: string().required('Label is required'),
+    defaultValue: string().default(''),
+    description: string().default(''),
+  });
+}
+
+export function validation(): SchemaOf<Values> {
+  return array().of(itemValidation());
+}
diff --git a/app/react/portainer/custom-templates/components/CustomTemplatesVariablesDefinitionField/index.ts b/app/react/portainer/custom-templates/components/CustomTemplatesVariablesDefinitionField/index.ts
new file mode 100644
index 0000000..c05c96a
--- /dev/null
+++ b/app/react/portainer/custom-templates/components/CustomTemplatesVariablesDefinitionField/index.ts
@@ -0,0 +1,8 @@
+export {
+  CustomTemplatesVariablesDefinitionField,
+  validation as variablesValidation,
+} from './CustomTemplatesVariablesDefinitionField';
+export type {
+  VariableDefinition,
+  Values as DefinitionFieldValues,
+} from './CustomTemplatesVariablesDefinitionField';
diff --git a/app/react/portainer/custom-templates/components/CustomTemplatesVariablesField/CustomTemplatesVariablesField.stories.tsx b/app/react/portainer/custom-templates/components/CustomTemplatesVariablesField/CustomTemplatesVariablesField.stories.tsx
new file mode 100644
index 0000000..6df28b3
--- /dev/null
+++ b/app/react/portainer/custom-templates/components/CustomTemplatesVariablesField/CustomTemplatesVariablesField.stories.tsx
@@ -0,0 +1,50 @@
+import { useState } from 'react';
+
+import { VariableDefinition } from '../CustomTemplatesVariablesDefinitionField/CustomTemplatesVariablesDefinitionField';
+
+import {
+  CustomTemplatesVariablesField,
+  Values,
+} from './CustomTemplatesVariablesField';
+
+export default {
+  title: 'Components/Custom Templates/Variables Field',
+  component: CustomTemplatesVariablesField,
+};
+
+const definitions: VariableDefinition[] = [
+  {
+    label: 'Image Name',
+    name: 'image_name',
+    defaultValue: 'nginx',
+    description: '',
+  },
+  {
+    label: 'Required field',
+    name: 'required_field',
+    defaultValue: '',
+    description: '',
+  },
+  {
+    label: 'Required field with tooltip',
+    name: 'required_field',
+    defaultValue: '',
+    description: 'tooltip',
+  },
+];
+
+function Template() {
+  const [value, setValue] = useState<Values>(
+    definitions.map((def) => ({ key: def.name, value: def.defaultValue || '' }))
+  );
+
+  return (
+    <CustomTemplatesVariablesField
+      value={value}
+      onChange={setValue}
+      definitions={definitions}
+    />
+  );
+}
+
+export const Story = Template.bind({});
diff --git a/app/react/portainer/custom-templates/components/CustomTemplatesVariablesField/CustomTemplatesVariablesField.test.tsx b/app/react/portainer/custom-templates/components/CustomTemplatesVariablesField/CustomTemplatesVariablesField.test.tsx
new file mode 100644
index 0000000..1d83440
--- /dev/null
+++ b/app/react/portainer/custom-templates/components/CustomTemplatesVariablesField/CustomTemplatesVariablesField.test.tsx
@@ -0,0 +1,97 @@
+import { vi } from 'vitest';
+import userEvent from '@testing-library/user-event';
+import { render, screen } from '@testing-library/react';
+
+import {
+  CustomTemplatesVariablesField,
+  Values,
+} from './CustomTemplatesVariablesField';
+
+test('renders CustomTemplatesVariablesField component', () => {
+  const onChange = vi.fn();
+  const definitions = [
+    {
+      name: 'Variable1',
+      label: 'Variable 1',
+      description: 'Description 1',
+      defaultValue: 'Default 1',
+    },
+    {
+      name: 'Variable2',
+      label: 'Variable 2',
+      description: 'Description 2',
+      defaultValue: 'Default 2',
+    },
+  ];
+  const value: Values = [
+    { key: 'Variable1', value: 'Value 1' },
+    { key: 'Variable2', value: 'Value 2' },
+  ];
+
+  render(
+    <CustomTemplatesVariablesField
+      onChange={onChange}
+      definitions={definitions}
+      value={value}
+    />
+  );
+
+  const variableFieldItems = screen.getAllByLabelText(/Variable \d/);
+  expect(variableFieldItems).toHaveLength(2);
+});
+
+test('calls onChange when variable value is changed', async () => {
+  const user = userEvent.setup();
+  const onChange = vi.fn();
+  const definitions = [
+    {
+      name: 'Variable1',
+      label: 'Variable 1',
+      description: 'Description 1',
+      defaultValue: 'Default 1',
+    },
+  ];
+  const value: Values = [{ key: 'Variable1', value: 'Value 1' }];
+
+  render(
+    <CustomTemplatesVariablesField
+      onChange={onChange}
+      definitions={definitions}
+      value={value}
+    />
+  );
+
+  const inputElement = screen.getByLabelText('Variable 1');
+
+  await user.clear(inputElement);
+  expect(onChange).toHaveBeenCalledWith([{ key: 'Variable1', value: '' }]);
+
+  await user.type(inputElement, 'New Value');
+  expect(onChange).toHaveBeenCalled();
+});
+
+test('renders error message when errors prop is provided', () => {
+  const onChange = vi.fn();
+  const definitions = [
+    {
+      name: 'Variable1',
+      label: 'Variable 1',
+      description: 'Description 1',
+      defaultValue: 'Default 1',
+    },
+  ];
+  const value: Values = [{ key: 'Variable1', value: 'Value 1' }];
+  const errors = [{ value: 'Error message' }];
+
+  render(
+    <CustomTemplatesVariablesField
+      onChange={onChange}
+      definitions={definitions}
+      value={value}
+      errors={errors}
+    />
+  );
+
+  const errorElement = screen.getByText('Error message');
+  expect(errorElement).toBeInTheDocument();
+});
diff --git a/app/react/portainer/custom-templates/components/CustomTemplatesVariablesField/CustomTemplatesVariablesField.tsx b/app/react/portainer/custom-templates/components/CustomTemplatesVariablesField/CustomTemplatesVariablesField.tsx
new file mode 100644
index 0000000..d5b408c
--- /dev/null
+++ b/app/react/portainer/custom-templates/components/CustomTemplatesVariablesField/CustomTemplatesVariablesField.tsx
@@ -0,0 +1,62 @@
+import { FormSection } from '@@/form-components/FormSection/FormSection';
+import { ArrayError } from '@@/form-components/InputList/InputList';
+import { FormError } from '@@/form-components/FormError';
+
+import { VariableDefinition } from '../CustomTemplatesVariablesDefinitionField/CustomTemplatesVariablesDefinitionField';
+
+import { VariableFieldItem } from './VariableFieldItem';
+
+export type Values = Array<{ key: string; value?: string }>;
+
+interface Props {
+  errors?: ArrayError<Values>;
+  value: Values;
+  definitions: VariableDefinition[] | undefined;
+  onChange: (value: Values) => void;
+}
+
+export function CustomTemplatesVariablesField({
+  errors,
+  value,
+  definitions,
+  onChange,
+}: Props) {
+  if (!definitions || !definitions.length) {
+    return null;
+  }
+
+  return (
+    <FormSection title="Template Variables">
+      {definitions.map((definition, index) => (
+        <VariableFieldItem
+          key={definition.name}
+          definition={definition}
+          error={getError(errors, index)}
+          value={value.find((v) => v.key === definition.name)?.value}
+          onChange={(fieldValue) => {
+            onChange(
+              value.map((v) =>
+                v.key === definition.name ? { ...v, value: fieldValue } : v
+              )
+            );
+          }}
+        />
+      ))}
+
+      {typeof errors === 'string' && <FormError>{errors}</FormError>}
+    </FormSection>
+  );
+}
+
+function getError(errors: ArrayError<Values> | undefined, index: number) {
+  if (!errors || typeof errors !== 'object') {
+    return undefined;
+  }
+
+  const error = errors[index];
+  if (!error) {
+    return undefined;
+  }
+
+  return typeof error === 'object' ? error.value : error;
+}
diff --git a/app/react/portainer/custom-templates/components/CustomTemplatesVariablesField/VariableFieldItem.test.tsx b/app/react/portainer/custom-templates/components/CustomTemplatesVariablesField/VariableFieldItem.test.tsx
new file mode 100644
index 0000000..34e6e35
--- /dev/null
+++ b/app/react/portainer/custom-templates/components/CustomTemplatesVariablesField/VariableFieldItem.test.tsx
@@ -0,0 +1,52 @@
+import { vi } from 'vitest';
+import userEvent from '@testing-library/user-event';
+import { render, screen } from '@testing-library/react';
+
+import { VariableFieldItem } from './VariableFieldItem';
+
+test('renders VariableFieldItem component', () => {
+  const definition = {
+    name: 'variableName',
+    label: 'Variable Label',
+    description: 'Variable Description',
+    defaultValue: 'Default Value',
+  };
+
+  render(<VariableFieldItem definition={definition} onChange={vi.fn()} />);
+
+  const labelElement = screen.getByText('Variable Label');
+  expect(labelElement).toBeInTheDocument();
+
+  const inputElement = screen.getByPlaceholderText(
+    'Enter value or leave blank to use default of Default Value'
+  );
+  expect(inputElement).toBeInTheDocument();
+});
+
+test('calls onChange when input value changes', async () => {
+  const user = userEvent.setup();
+  const onChange = vi.fn();
+
+  const definition = {
+    name: 'variableName',
+    label: 'Variable Label',
+    description: 'Variable Description',
+    defaultValue: 'Default Value',
+  };
+
+  render(
+    <VariableFieldItem
+      definition={definition}
+      onChange={onChange}
+      value="value"
+    />
+  );
+
+  const inputElement = screen.getByLabelText(definition.label);
+
+  await user.clear(inputElement);
+  expect(onChange).toHaveBeenCalledWith('');
+
+  await user.type(inputElement, 'New Value');
+  expect(onChange).toHaveBeenCalled();
+});
diff --git a/app/react/portainer/custom-templates/components/CustomTemplatesVariablesField/VariableFieldItem.tsx b/app/react/portainer/custom-templates/components/CustomTemplatesVariablesField/VariableFieldItem.tsx
new file mode 100644
index 0000000..1f50d41
--- /dev/null
+++ b/app/react/portainer/custom-templates/components/CustomTemplatesVariablesField/VariableFieldItem.tsx
@@ -0,0 +1,39 @@
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+
+import { VariableDefinition } from '../CustomTemplatesVariablesDefinitionField/CustomTemplatesVariablesDefinitionField';
+
+export function VariableFieldItem({
+  definition,
+  error,
+  onChange,
+  value,
+}: {
+  definition: VariableDefinition;
+  error?: string;
+  onChange: (value: string) => void;
+  value?: string;
+}) {
+  const inputId = `${definition.name}-input`;
+
+  return (
+    <FormControl
+      required={!definition.defaultValue}
+      label={definition.label}
+      key={definition.name}
+      inputId={inputId}
+      tooltip={definition.description}
+      size="small"
+      errors={error}
+    >
+      <Input
+        name={`variables.${definition.name}`}
+        data-cy={`custom-template-variables-${definition.name}`}
+        id={inputId}
+        value={value}
+        onChange={(e) => onChange(e.target.value)}
+        placeholder={`Enter value or leave blank to use default of ${definition.defaultValue}`}
+      />
+    </FormControl>
+  );
+}
diff --git a/app/react/portainer/custom-templates/components/CustomTemplatesVariablesField/getDefaultValues.ts b/app/react/portainer/custom-templates/components/CustomTemplatesVariablesField/getDefaultValues.ts
new file mode 100644
index 0000000..ea54717
--- /dev/null
+++ b/app/react/portainer/custom-templates/components/CustomTemplatesVariablesField/getDefaultValues.ts
@@ -0,0 +1,12 @@
+import { VariableDefinition } from '../CustomTemplatesVariablesDefinitionField';
+
+import { Values } from './CustomTemplatesVariablesField';
+
+export function getDefaultValues(
+  definitions: VariableDefinition[] | undefined = []
+): Values {
+  return definitions.map((v) => ({
+    key: v.name,
+    value: v.defaultValue,
+  }));
+}
diff --git a/app/react/portainer/custom-templates/components/CustomTemplatesVariablesField/index.ts b/app/react/portainer/custom-templates/components/CustomTemplatesVariablesField/index.ts
new file mode 100644
index 0000000..9824f37
--- /dev/null
+++ b/app/react/portainer/custom-templates/components/CustomTemplatesVariablesField/index.ts
@@ -0,0 +1,8 @@
+export {
+  CustomTemplatesVariablesField,
+  type Values as VariablesFieldValue,
+} from './CustomTemplatesVariablesField';
+
+export { validation as variablesFieldValidation } from './validation';
+
+export { getDefaultValues as getVariablesFieldDefaultValues } from './getDefaultValues';
diff --git a/app/react/portainer/custom-templates/components/CustomTemplatesVariablesField/validation.tsx b/app/react/portainer/custom-templates/components/CustomTemplatesVariablesField/validation.tsx
new file mode 100644
index 0000000..be4668d
--- /dev/null
+++ b/app/react/portainer/custom-templates/components/CustomTemplatesVariablesField/validation.tsx
@@ -0,0 +1,23 @@
+import { array, object, string } from 'yup';
+
+import { VariableDefinition } from '../CustomTemplatesVariablesDefinitionField/CustomTemplatesVariablesDefinitionField';
+
+export function validation(definitions: VariableDefinition[]) {
+  return array(
+    object({
+      key: string().default(''),
+      value: string().default(''),
+    }).test('required-if-no-default-value', 'This field is required', (obj) => {
+      const definition = definitions.find((d) => d.name === obj.key);
+      if (!definition) {
+        return true;
+      }
+
+      if (!definition.defaultValue && !obj.value) {
+        return false;
+      }
+
+      return true;
+    })
+  );
+}
diff --git a/app/react/portainer/custom-templates/components/PlatformSelector.tsx b/app/react/portainer/custom-templates/components/PlatformSelector.tsx
new file mode 100644
index 0000000..df50b96
--- /dev/null
+++ b/app/react/portainer/custom-templates/components/PlatformSelector.tsx
@@ -0,0 +1,31 @@
+import { FormControl } from '@@/form-components/FormControl';
+import { Select } from '@@/form-components/Input';
+
+import { Platform } from '../../templates/types';
+
+const platformOptions = [
+  { label: 'Linux', value: Platform.LINUX },
+  { label: 'Windows', value: Platform.WINDOWS },
+];
+
+export function PlatformField({
+  onChange,
+  value,
+}: {
+  onChange: (platform: Platform) => void;
+  value: Platform;
+}) {
+  return (
+    <FormControl label="Platform" required inputId="template-platform">
+      <Select
+        name="platform"
+        data-cy="custom-tempalte-platform-select"
+        id="template-platform"
+        required
+        options={platformOptions}
+        value={value}
+        onChange={(e) => onChange(parseInt(e.target.value, 10))}
+      />
+    </FormControl>
+  );
+}
diff --git a/app/react/portainer/custom-templates/components/TemplateTypeSelector.tsx b/app/react/portainer/custom-templates/components/TemplateTypeSelector.tsx
new file mode 100644
index 0000000..7016eec
--- /dev/null
+++ b/app/react/portainer/custom-templates/components/TemplateTypeSelector.tsx
@@ -0,0 +1,31 @@
+import { StackType } from '@/react/common/stacks/types';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { Select } from '@@/form-components/Input';
+
+const typeOptions = [
+  { label: 'Swarm', value: StackType.DockerSwarm },
+  { label: 'Standalone / Podman', value: StackType.DockerCompose },
+];
+
+export function TemplateTypeSelector({
+  onChange,
+  value,
+}: {
+  onChange: (type: StackType) => void;
+  value: StackType;
+}) {
+  return (
+    <FormControl label="Type" required inputId="template-type">
+      <Select
+        name="type"
+        data-cy="custom-template-template-type"
+        id="template-type"
+        required
+        options={typeOptions}
+        value={value}
+        onChange={(e) => onChange(parseInt(e.target.value, 10))}
+      />
+    </FormControl>
+  );
+}
diff --git a/app/react/portainer/custom-templates/components/utils.ts b/app/react/portainer/custom-templates/components/utils.ts
new file mode 100644
index 0000000..df08adc
--- /dev/null
+++ b/app/react/portainer/custom-templates/components/utils.ts
@@ -0,0 +1,89 @@
+import _ from 'lodash';
+import Mustache from 'mustache';
+
+import { isBE } from '../../feature-flags/feature-flags.service';
+
+import { VariableDefinition } from './CustomTemplatesVariablesDefinitionField/CustomTemplatesVariablesDefinitionField';
+import { VariablesFieldValue } from './CustomTemplatesVariablesField';
+
+export const isTemplateVariablesEnabled = isBE;
+
+export function getTemplateVariables(templateStr: string) {
+  const [template, error] = validateAndParse(templateStr);
+
+  if (!template) {
+    return [null, error] as const;
+  }
+
+  return [
+    template
+      .filter(([type, value]) => type === 'name' && value)
+      .map(([, value]) => ({
+        name: value,
+        label: '',
+        defaultValue: '',
+        description: '',
+      })),
+    null,
+  ] as const;
+}
+type TemplateSpans = ReturnType<typeof Mustache.parse>;
+function validateAndParse(
+  templateStr: string
+): readonly [TemplateSpans, null] | readonly [null, string] {
+  if (!templateStr) {
+    return [[] as TemplateSpans, null] as const;
+  }
+
+  try {
+    return [Mustache.parse(templateStr), null] as const;
+  } catch (e) {
+    if (!(e instanceof Error)) {
+      return [null, 'Parse error'] as const;
+    }
+
+    return [null, e.message] as const;
+  }
+}
+
+export function intersectVariables(
+  oldVariables: VariableDefinition[] = [],
+  newVariables: VariableDefinition[] = []
+) {
+  const oldVariablesWithLabel = oldVariables.filter((v) => !!v.label);
+
+  return _.uniqBy(
+    [
+      ...oldVariablesWithLabel,
+      ...newVariables.filter(
+        (v) => !oldVariablesWithLabel.find(({ name }) => name === v.name)
+      ),
+    ],
+    'name'
+  );
+}
+
+export function renderTemplate(
+  template: string,
+  variables: VariablesFieldValue,
+  definitions: VariableDefinition[]
+) {
+  const state = Object.fromEntries(
+    _.compact(
+      variables.map(({ key, value }) => {
+        if (value) {
+          return [key, value];
+        }
+
+        const definition = definitions.find((def) => def.name === key);
+        if (!definition) {
+          return null;
+        }
+
+        return [key, definition.defaultValue || `{{ ${definition.name} }}`];
+      })
+    )
+  );
+
+  return Mustache.render(template, state, undefined, { escape: (t) => t });
+}
diff --git a/app/react/portainer/environments/EdgeAutoCreateScriptView/AutomaticEdgeEnvCreation/AutomaticEdgeEnvCreation.tsx b/app/react/portainer/environments/EdgeAutoCreateScriptView/AutomaticEdgeEnvCreation/AutomaticEdgeEnvCreation.tsx
new file mode 100644
index 0000000..119b898
--- /dev/null
+++ b/app/react/portainer/environments/EdgeAutoCreateScriptView/AutomaticEdgeEnvCreation/AutomaticEdgeEnvCreation.tsx
@@ -0,0 +1,220 @@
+import { useMutation } from '@tanstack/react-query';
+import { useEffect, useState } from 'react';
+import { Laptop, Network } from 'lucide-react';
+
+import { generateKey } from '@/react/portainer/environments/environment.service/edge';
+import { EdgeScriptForm } from '@/react/edge/components/EdgeScriptForm';
+import { commandsTabs } from '@/react/edge/components/EdgeScriptForm/scripts';
+import { useSettings } from '@/react/portainer/settings/queries';
+import EdgeAgentStandardIcon from '@/react/edge/components/edge-agent-standard.svg?c';
+import EdgeAgentAsyncIcon from '@/react/edge/components/edge-agent-async.svg?c';
+import { ConnectivityTestModal } from '@/react/edge/components/ConnectivityTestModal/ConnectivityTestModal';
+
+import { Widget, WidgetBody, WidgetTitle } from '@@/Widget';
+import { TextTip } from '@@/Tip/TextTip';
+import { BoxSelector } from '@@/BoxSelector';
+import { FormSection } from '@@/form-components/FormSection';
+import { CopyButton } from '@@/buttons';
+import { Button } from '@@/buttons';
+import { Link } from '@@/Link';
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+
+const commands = {
+  linux: [
+    commandsTabs.k8sLinux,
+    commandsTabs.swarmLinux,
+    commandsTabs.standaloneLinux,
+    commandsTabs.podmanLinux,
+  ],
+  win: [commandsTabs.swarmWindows, commandsTabs.standaloneWindow],
+};
+
+const asyncModeOptions = [
+  {
+    icon: EdgeAgentStandardIcon,
+    id: 'standard',
+    label: 'Edge Agent Standard',
+    value: false,
+    iconType: 'badge',
+  },
+  {
+    icon: EdgeAgentAsyncIcon,
+    id: 'async',
+    label: 'Edge Agent Async',
+    value: true,
+    iconType: 'badge',
+  },
+] as const;
+
+export function AutomaticEdgeEnvCreation() {
+  const edgeKeyMutation = useGenerateKeyMutation();
+  const { mutate: generateKey, reset: resetKey } = edgeKeyMutation;
+  const settingsQuery = useSettings();
+  const [asyncMode, setAsyncMode] = useState(false);
+
+  const url = settingsQuery.data?.EdgePortainerUrl;
+
+  const settings = settingsQuery.data;
+  const edgeKey = edgeKeyMutation.data;
+  const edgeComputeConfigurationOK = validateConfiguration();
+
+  useEffect(() => {
+    if (edgeComputeConfigurationOK) {
+      generateKey();
+    } else {
+      resetKey();
+    }
+  }, [generateKey, edgeComputeConfigurationOK, resetKey]);
+
+  if (!settingsQuery.data) {
+    return null;
+  }
+
+  return (
+    <Widget>
+      <WidgetTitle icon={Laptop} title="Automatic Edge Environment Creation" />
+      <WidgetBody className="form-horizontal">
+        {!edgeComputeConfigurationOK ? (
+          <TextTip color="orange">
+            In order to use this feature, please turn on Edge Compute features{' '}
+            <Link
+              to="portainer.settings.edgeCompute"
+              data-cy="edge-disabled-portainer-edge-settings-link"
+            >
+              here
+            </Link>{' '}
+            and have Portainer API server URL and tunnel server address properly
+            configured.
+          </TextTip>
+        ) : (
+          <>
+            <BoxSelector
+              slim
+              radioName="async-mode-selector"
+              value={asyncMode}
+              onChange={handleChangeAsyncMode}
+              options={asyncModeOptions}
+            />
+
+            <EdgeKeyInfo
+              asyncMode={asyncMode}
+              edgeKey={edgeKey}
+              isLoading={edgeKeyMutation.isLoading}
+              url={url}
+              tunnelUrl={settings?.Edge.TunnelServerAddress}
+            />
+          </>
+        )}
+      </WidgetBody>
+    </Widget>
+  );
+
+  function handleChangeAsyncMode(asyncMode: boolean) {
+    setAsyncMode(asyncMode);
+  }
+
+  function validateConfiguration() {
+    return !!(
+      settings &&
+      settings.EnableEdgeComputeFeatures &&
+      settings.EdgePortainerUrl &&
+      settings.Edge.TunnelServerAddress
+    );
+  }
+}
+
+// using mutation because we want this action to run only when required
+function useGenerateKeyMutation() {
+  return useMutation(generateKey);
+}
+
+function EdgeKeyInfo({
+  isLoading,
+  edgeKey,
+  url,
+  tunnelUrl,
+  asyncMode,
+}: {
+  isLoading: boolean;
+  edgeKey?: string;
+  url?: string;
+  tunnelUrl?: string;
+  asyncMode: boolean;
+}) {
+  const [isConnectivityModalOpen, setIsConnectivityModalOpen] = useState(false);
+
+  if (isLoading || !edgeKey) {
+    return <div>Generating key for {url} ... </div>;
+  }
+
+  return (
+    <>
+      <hr />
+
+      <FormSection title="Edge key">
+        <div className="break-words">
+          <code>{edgeKey}</code>
+        </div>
+
+        <CopyButton
+          copyText={edgeKey}
+          data-cy="edge-auto-create-copy-token-button"
+        >
+          Copy token
+        </CopyButton>
+      </FormSection>
+
+      <hr />
+
+      <EdgeScriptForm
+        edgeInfo={{ key: edgeKey }}
+        commands={commands}
+        asyncMode={asyncMode}
+        showMetaFields
+      >
+        <TextTip color="blue">
+          Portainer Server URL{' '}
+          {!asyncMode ? 'and tunnel server address are' : 'is'} set{' '}
+          <Link
+            to="portainer.settings.edgeCompute"
+            data-cy="server-url-portainer-edge-settings-link"
+          >
+            here
+          </Link>
+        </TextTip>
+        <FormControl label="Portainer API server URL">
+          <Input value={url} readOnly data-cy="edge-auto-create-url-input" />
+        </FormControl>
+
+        {!asyncMode && (
+          <FormControl label="Portainer tunnel server address">
+            <Input
+              value={tunnelUrl}
+              readOnly
+              data-cy="edge-auto-create-tunnel-address-input"
+            />
+          </FormControl>
+        )}
+
+        <Button
+          color="default"
+          className="!ml-0 mb-8"
+          icon={Network}
+          onClick={() => setIsConnectivityModalOpen(true)}
+          data-cy="edge-auto-create-test-connectivity-button"
+        >
+          Test connectivity
+        </Button>
+      </EdgeScriptForm>
+
+      {isConnectivityModalOpen && url && (
+        <ConnectivityTestModal
+          portainerUrl={url}
+          tunnelServerAddr={!asyncMode ? tunnelUrl : undefined}
+          onDismiss={() => setIsConnectivityModalOpen(false)}
+        />
+      )}
+    </>
+  );
+}
diff --git a/app/react/portainer/environments/EdgeAutoCreateScriptView/AutomaticEdgeEnvCreation/index.ts b/app/react/portainer/environments/EdgeAutoCreateScriptView/AutomaticEdgeEnvCreation/index.ts
new file mode 100644
index 0000000..1a10043
--- /dev/null
+++ b/app/react/portainer/environments/EdgeAutoCreateScriptView/AutomaticEdgeEnvCreation/index.ts
@@ -0,0 +1 @@
+export { AutomaticEdgeEnvCreation } from './AutomaticEdgeEnvCreation';
diff --git a/app/react/portainer/environments/EdgeAutoCreateScriptView/EdgeAutoCreateScriptView.tsx b/app/react/portainer/environments/EdgeAutoCreateScriptView/EdgeAutoCreateScriptView.tsx
new file mode 100644
index 0000000..87cd7c6
--- /dev/null
+++ b/app/react/portainer/environments/EdgeAutoCreateScriptView/EdgeAutoCreateScriptView.tsx
@@ -0,0 +1,28 @@
+import { withLimitToBE } from '@/react/hooks/useLimitToBE';
+
+import { PageHeader } from '@@/PageHeader';
+
+import { AutomaticEdgeEnvCreation } from './AutomaticEdgeEnvCreation';
+
+export const EdgeAutoCreateScriptViewWrapper = withLimitToBE(
+  EdgeAutoCreateScriptView
+);
+
+function EdgeAutoCreateScriptView() {
+  return (
+    <>
+      <PageHeader
+        title="Automatic Edge Environment Creation"
+        breadcrumbs={[
+          { label: 'Environments', link: 'portainer.endpoints' },
+          'Automatic Edge Environment Creation',
+        ]}
+        reload
+      />
+
+      <div className="mx-3">
+        <AutomaticEdgeEnvCreation />
+      </div>
+    </>
+  );
+}
diff --git a/app/react/portainer/environments/EdgeAutoCreateScriptView/index.ts b/app/react/portainer/environments/EdgeAutoCreateScriptView/index.ts
new file mode 100644
index 0000000..609cb24
--- /dev/null
+++ b/app/react/portainer/environments/EdgeAutoCreateScriptView/index.ts
@@ -0,0 +1 @@
+export { EdgeAutoCreateScriptViewWrapper as EdgeAutoCreateScriptView } from './EdgeAutoCreateScriptView';
diff --git a/app/react/portainer/environments/ItemView/AzureEnvironmentForm/AzureEndpointConfigSection/AzureEndpointConfigSection.test.tsx b/app/react/portainer/environments/ItemView/AzureEnvironmentForm/AzureEndpointConfigSection/AzureEndpointConfigSection.test.tsx
new file mode 100644
index 0000000..309a519
--- /dev/null
+++ b/app/react/portainer/environments/ItemView/AzureEnvironmentForm/AzureEndpointConfigSection/AzureEndpointConfigSection.test.tsx
@@ -0,0 +1,74 @@
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { describe, it, expect, vi } from 'vitest';
+
+import { AzureEndpointConfigSection } from './AzureEndpointConfigSection';
+
+describe('AzureEndpointConfigSection', () => {
+  it('should render with initial values', () => {
+    const values = {
+      applicationId: 'app-id-123',
+      tenantId: 'tenant-id-456',
+      authenticationKey: 'auth-key-789',
+    };
+    const setValues = vi.fn();
+
+    render(
+      <AzureEndpointConfigSection values={values} setValues={setValues} />
+    );
+
+    expect(screen.getByLabelText('Application ID')).toHaveValue('app-id-123');
+    expect(screen.getByLabelText('Tenant ID')).toHaveValue('tenant-id-456');
+    expect(screen.getByLabelText('Authentication key')).toHaveValue(
+      'auth-key-789'
+    );
+    expect(screen.getByText('Azure configuration')).toBeVisible();
+  });
+
+  it('should call setValues when input values change', async () => {
+    const values = {
+      applicationId: '',
+      tenantId: '',
+      authenticationKey: '',
+    };
+    const setValues = vi.fn();
+
+    render(
+      <AzureEndpointConfigSection values={values} setValues={setValues} />
+    );
+
+    const user = userEvent.setup();
+
+    // Type in Application ID (userEvent.type triggers onChange for each character)
+    const appIdInput = screen.getByLabelText('Application ID');
+    await user.clear(appIdInput);
+    await user.type(appIdInput, 'a');
+    expect(setValues).toHaveBeenLastCalledWith({
+      applicationId: 'a',
+      tenantId: '',
+      authenticationKey: '',
+    });
+
+    // Reset mock and test Tenant ID
+    setValues.mockClear();
+    const tenantIdInput = screen.getByLabelText('Tenant ID');
+    await user.clear(tenantIdInput);
+    await user.type(tenantIdInput, 't');
+    expect(setValues).toHaveBeenLastCalledWith({
+      applicationId: '',
+      tenantId: 't',
+      authenticationKey: '',
+    });
+
+    // Reset mock and test Authentication key
+    setValues.mockClear();
+    const authKeyInput = screen.getByLabelText('Authentication key');
+    await user.clear(authKeyInput);
+    await user.type(authKeyInput, 'k');
+    expect(setValues).toHaveBeenLastCalledWith({
+      applicationId: '',
+      tenantId: '',
+      authenticationKey: 'k',
+    });
+  });
+});
diff --git a/app/react/portainer/environments/ItemView/AzureEnvironmentForm/AzureEndpointConfigSection/AzureEndpointConfigSection.tsx b/app/react/portainer/environments/ItemView/AzureEnvironmentForm/AzureEndpointConfigSection/AzureEndpointConfigSection.tsx
new file mode 100644
index 0000000..36fb905
--- /dev/null
+++ b/app/react/portainer/environments/ItemView/AzureEnvironmentForm/AzureEndpointConfigSection/AzureEndpointConfigSection.tsx
@@ -0,0 +1,73 @@
+import { FormControl } from '@@/form-components/FormControl';
+import { FormSection } from '@@/form-components/FormSection';
+import { Input } from '@@/form-components/Input';
+
+interface Values {
+  applicationId: string;
+  tenantId: string;
+  authenticationKey: string;
+}
+
+interface Props {
+  values: Values;
+  setValues: (values: Values) => void;
+}
+
+export function AzureEndpointConfigSection({ values, setValues }: Props) {
+  return (
+    <FormSection title="Azure configuration">
+      <FormControl
+        label="Application ID"
+        inputId="azure-application-id"
+        size="small"
+      >
+        <Input
+          id="azure-application-id"
+          value={values.applicationId}
+          onChange={(e) =>
+            setValues({
+              ...values,
+              applicationId: e.target.value,
+            })
+          }
+          placeholder="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+          data-cy="azure-credential-appid-input"
+        />
+      </FormControl>
+
+      <FormControl label="Tenant ID" inputId="azure-tenant-id" size="small">
+        <Input
+          id="azure-tenant-id"
+          value={values.tenantId}
+          onChange={(e) =>
+            setValues({
+              ...values,
+              tenantId: e.target.value,
+            })
+          }
+          placeholder="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+          data-cy="azure-credential-tenantid-input"
+        />
+      </FormControl>
+
+      <FormControl
+        label="Authentication key"
+        inputId="azure-authentication-key"
+        size="small"
+      >
+        <Input
+          id="azure-authentication-key"
+          value={values.authenticationKey}
+          onChange={(e) =>
+            setValues({
+              ...values,
+              authenticationKey: e.target.value,
+            })
+          }
+          placeholder="cOrXoK/1D35w8YQ8nH1/8ZGwzz45JIYD5jxHKXEQknk="
+          data-cy="azure-credential-authkey-input"
+        />
+      </FormControl>
+    </FormSection>
+  );
+}
diff --git a/app/react/portainer/environments/ItemView/AzureEnvironmentForm/AzureEnvironmentForm.test.tsx b/app/react/portainer/environments/ItemView/AzureEnvironmentForm/AzureEnvironmentForm.test.tsx
new file mode 100644
index 0000000..08ec3c5
--- /dev/null
+++ b/app/react/portainer/environments/ItemView/AzureEnvironmentForm/AzureEnvironmentForm.test.tsx
@@ -0,0 +1,122 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse, DefaultBodyType } from 'msw';
+
+import { server } from '@/setup-tests/server';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import {
+  createMockUsers,
+  createMockEnvironment,
+  createMockEnvironmentGroup,
+} from '@/react-tools/test-mocks';
+import { withCurrentUser } from '@/react-tools/withCurrentUser';
+
+import { AzureEnvironmentForm } from './AzureEnvironmentForm';
+
+test('renders form with initial values', async () => {
+  renderComponent({
+    environment: createMockEnvironment({
+      Name: 'azure-env',
+      URL: 'https://azure.example.com',
+      AzureCredentials: {
+        ApplicationID: 'app-123',
+        TenantID: 'tenant-456',
+        AuthenticationKey: 'key-789',
+      },
+    }),
+  });
+
+  expect(await screen.findByRole('textbox', { name: /Name/i })).toHaveValue(
+    'azure-env'
+  );
+  expect(screen.getByLabelText(/Environment URL/i)).toHaveValue(
+    'https://azure.example.com'
+  );
+  expect(screen.getByLabelText(/Application ID/i)).toHaveValue('app-123');
+  expect(screen.getByLabelText(/Tenant ID/i)).toHaveValue('tenant-456');
+  expect(
+    screen.getByRole('button', { name: /Update environment/i })
+  ).toBeVisible();
+});
+
+test('submits form with updated values', async () => {
+  const user = userEvent.setup();
+  let requestBody: DefaultBodyType;
+
+  server.use(
+    http.put('/api/endpoints/:id', async ({ request }) => {
+      requestBody = await request.json();
+      return HttpResponse.json(createMockEnvironment());
+    })
+  );
+
+  const onSuccess = vi.fn();
+  renderComponent({
+    environment: createMockEnvironment({
+      Name: 'azure-env',
+      URL: 'https://azure.example.com',
+      AzureCredentials: {
+        ApplicationID: 'app-123',
+        TenantID: 'tenant-456',
+        AuthenticationKey: 'key-789',
+      },
+    }),
+    onSuccess,
+  });
+
+  const nameInput = await screen.findByRole('textbox', { name: /Name/i });
+  await user.clear(nameInput);
+  await user.type(nameInput, 'updated-azure-env');
+
+  const submitButton = screen.getByRole('button', {
+    name: /Update environment/i,
+  });
+
+  await waitFor(() => {
+    expect(submitButton).toBeEnabled();
+  });
+
+  await user.click(submitButton);
+
+  await waitFor(() => {
+    expect(onSuccess).toHaveBeenCalled();
+
+    expect(requestBody).toMatchObject({
+      Name: 'updated-azure-env',
+      GroupID: 1,
+      TagIDs: [],
+      AzureApplicationID: 'app-123',
+      AzureTenantID: 'tenant-456',
+    });
+  });
+});
+
+function renderComponent({
+  environment = createMockEnvironment(),
+  onSuccess = vi.fn(),
+}: {
+  environment?: ReturnType<typeof createMockEnvironment>;
+  onSuccess?: () => void;
+} = {}) {
+  const users = createMockUsers(1, [1]);
+
+  server.use(
+    http.get('/api/users/:id', () => HttpResponse.json(users[0])),
+    http.get('/api/endpoints', () =>
+      HttpResponse.json({ value: [], totalCount: 0 })
+    ),
+    http.get('/api/endpoint_groups', () =>
+      HttpResponse.json([
+        createMockEnvironmentGroup({ Id: 1, Name: 'Default' }),
+      ])
+    ),
+    http.get('/api/tags', () => HttpResponse.json([]))
+  );
+
+  const Wrapped = withCurrentUser(
+    withTestQueryProvider(withTestRouter(AzureEnvironmentForm))
+  );
+
+  return render(<Wrapped environment={environment} onSuccess={onSuccess} />);
+}
diff --git a/app/react/portainer/environments/ItemView/AzureEnvironmentForm/AzureEnvironmentForm.tsx b/app/react/portainer/environments/ItemView/AzureEnvironmentForm/AzureEnvironmentForm.tsx
new file mode 100644
index 0000000..1e555b1
--- /dev/null
+++ b/app/react/portainer/environments/ItemView/AzureEnvironmentForm/AzureEnvironmentForm.tsx
@@ -0,0 +1,103 @@
+import { Form, Formik } from 'formik';
+
+import { Environment } from '@/react/portainer/environments/types';
+import { useUpdateEnvironmentMutation } from '@/react/portainer/environments/queries/useUpdateEnvironmentMutation';
+import { NameField } from '@/react/portainer/environments/common/NameField/NameField';
+
+import { FormSection } from '@@/form-components/FormSection';
+import { Widget } from '@@/Widget/Widget';
+import { WidgetBody } from '@@/Widget';
+
+import { EnvironmentFormActions } from '../EnvironmentFormActions/EnvironmentFormActions';
+import { EnvironmentUrlField } from '../../common/EnvironmentUrlField/EnvironmentUrlField';
+import { MetadataFieldset } from '../../common/MetadataFieldset';
+
+import { AzureEndpointConfigSection } from './AzureEndpointConfigSection/AzureEndpointConfigSection';
+import { AzureEnvironmentFormValues } from './types';
+import { useAzureValidation } from './validation';
+
+interface Props {
+  environment: Environment;
+  onSuccess: () => void;
+}
+
+export function AzureEnvironmentForm({ environment, onSuccess }: Props) {
+  const mutation = useUpdateEnvironmentMutation();
+  const validation = useAzureValidation({
+    environmentId: environment.Id,
+  });
+
+  const initialValues: AzureEnvironmentFormValues = {
+    name: environment.Name,
+    environmentUrl: environment.URL,
+    azure: {
+      applicationId: environment.AzureCredentials?.ApplicationID || '',
+      tenantId: environment.AzureCredentials?.TenantID || '',
+      authenticationKey: environment.AzureCredentials?.AuthenticationKey || '',
+    },
+    meta: {
+      groupId: environment.GroupId,
+      tagIds: environment.TagIds || [],
+    },
+  };
+
+  return (
+    <Widget>
+      <WidgetBody>
+        <Formik
+          initialValues={initialValues}
+          onSubmit={handleSubmit}
+          validationSchema={validation}
+          validateOnMount
+          enableReinitialize
+        >
+          {({ values, setFieldValue, isValid, dirty, isSubmitting }) => (
+            <Form className="form-horizontal">
+              <FormSection title="Configuration">
+                <NameField />
+
+                <EnvironmentUrlField disabled optional />
+              </FormSection>
+
+              <AzureEndpointConfigSection
+                values={values.azure}
+                setValues={(azure: typeof values.azure) =>
+                  setFieldValue('azure', azure)
+                }
+              />
+
+              <MetadataFieldset />
+
+              <EnvironmentFormActions
+                isLoading={isSubmitting}
+                isValid={isValid}
+                isDirty={dirty}
+              />
+            </Form>
+          )}
+        </Formik>
+      </WidgetBody>
+    </Widget>
+  );
+
+  function handleSubmit(values: AzureEnvironmentFormValues) {
+    mutation.mutate(
+      {
+        id: environment.Id,
+        payload: {
+          Name: values.name,
+          GroupID: values.meta.groupId,
+          TagIDs: values.meta.tagIds,
+          AzureApplicationID: values.azure.applicationId || undefined,
+          AzureTenantID: values.azure.tenantId || undefined,
+          AzureAuthenticationKey: values.azure.authenticationKey || undefined,
+        },
+      },
+      {
+        onSuccess: () => {
+          onSuccess();
+        },
+      }
+    );
+  }
+}
diff --git a/app/react/portainer/environments/ItemView/AzureEnvironmentForm/types.ts b/app/react/portainer/environments/ItemView/AzureEnvironmentForm/types.ts
new file mode 100644
index 0000000..15915c0
--- /dev/null
+++ b/app/react/portainer/environments/ItemView/AzureEnvironmentForm/types.ts
@@ -0,0 +1,12 @@
+import { EnvironmentMetadata } from '@/react/portainer/environments/environment.service/create';
+
+export interface AzureEnvironmentFormValues {
+  name: string;
+  environmentUrl: string;
+  azure: {
+    applicationId: string;
+    tenantId: string;
+    authenticationKey: string;
+  };
+  meta: EnvironmentMetadata;
+}
diff --git a/app/react/portainer/environments/ItemView/AzureEnvironmentForm/validation.ts b/app/react/portainer/environments/ItemView/AzureEnvironmentForm/validation.ts
new file mode 100644
index 0000000..e29f6bd
--- /dev/null
+++ b/app/react/portainer/environments/ItemView/AzureEnvironmentForm/validation.ts
@@ -0,0 +1,25 @@
+import { object, SchemaOf, string } from 'yup';
+
+import { useNameValidation } from '@/react/portainer/environments/common/NameField/NameField';
+
+import { EnvironmentId } from '../../types';
+import { metadataValidation } from '../../common/MetadataFieldset/validation';
+
+import { AzureEnvironmentFormValues } from './types';
+
+export function useAzureValidation({
+  environmentId,
+}: {
+  environmentId: EnvironmentId;
+}): SchemaOf<AzureEnvironmentFormValues> {
+  return object({
+    name: useNameValidation(environmentId),
+    environmentUrl: string().default(''),
+    azure: object({
+      applicationId: string().default(''),
+      tenantId: string().default(''),
+      authenticationKey: string().default(''),
+    }).required(),
+    meta: metadataValidation(),
+  });
+}
diff --git a/app/react/portainer/environments/ItemView/ConfirmDisassociateModel.tsx b/app/react/portainer/environments/ItemView/ConfirmDisassociateModel.tsx
new file mode 100644
index 0000000..b0d7b4a
--- /dev/null
+++ b/app/react/portainer/environments/ItemView/ConfirmDisassociateModel.tsx
@@ -0,0 +1,29 @@
+import { confirm } from '@@/modals/confirm';
+import { ModalType } from '@@/modals';
+import { buildConfirmButton } from '@@/modals/utils';
+
+export function confirmDisassociate() {
+  const message = (
+    <>
+      <p>
+        Disassociating this Edge environment will mark it as non associated and
+        will clear the registered Edge ID.
+      </p>
+      <p>
+        Any agent started with the Edge key associated to this environment will
+        be able to re-associate with this environment.
+      </p>
+      <p>
+        You can re-use the Edge ID and Edge key that you used to deploy the
+        existing Edge agent to associate a new Edge device to this environment.
+      </p>
+    </>
+  );
+
+  return confirm({
+    title: 'About disassociating',
+    modalType: ModalType.Warn,
+    message,
+    confirmButton: buildConfirmButton('Disassociate'),
+  });
+}
diff --git a/app/react/portainer/environments/ItemView/EdgeAgentDeploymentWidget/EdgeAgentDeploymentWidget.test.tsx b/app/react/portainer/environments/ItemView/EdgeAgentDeploymentWidget/EdgeAgentDeploymentWidget.test.tsx
new file mode 100644
index 0000000..3308cc9
--- /dev/null
+++ b/app/react/portainer/environments/ItemView/EdgeAgentDeploymentWidget/EdgeAgentDeploymentWidget.test.tsx
@@ -0,0 +1,219 @@
+import { render, screen } from '@testing-library/react';
+import { vi } from 'vitest';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+
+import { EdgeAgentDeploymentWidget } from './EdgeAgentDeploymentWidget';
+
+vi.mock('@/react/edge/components/EdgeScriptForm', () => ({
+  EdgeScriptForm: ({
+    edgeInfo,
+    commands,
+    asyncMode,
+  }: {
+    edgeInfo: { key: string; id?: string };
+    commands: { linux: Array<unknown>; win: Array<unknown> };
+    asyncMode?: boolean;
+  }) => (
+    <div data-cy="edge-script-form">
+      <div data-cy="edge-info-key">{edgeInfo.key}</div>
+      <div data-cy="edge-info-id">{edgeInfo.id || 'undefined'}</div>
+      <div data-cy="async-mode">{String(asyncMode)}</div>
+      <div data-cy="commands-type">{JSON.stringify(commands)}</div>
+    </div>
+  ),
+}));
+
+vi.mock('@/react/portainer/environments/ItemView/EdgeKeyDisplay', () => ({
+  EdgeKeyDisplay: ({ edgeKey }: { edgeKey: string }) => (
+    <div data-cy="edge-key-display">{edgeKey}</div>
+  ),
+}));
+
+describe('EdgeAgentDeploymentWidget', () => {
+  it('should render widget with deployment sections', () => {
+    renderComponent({ edgeKey: 'test-edge-key-123' });
+
+    // Check for key UI elements that must be present
+    expect(screen.getByText('Deploy an agent')).toBeVisible();
+    expect(screen.getByText('Edge agent deployment script')).toBeVisible();
+    expect(screen.getByTestId('edge-script-form')).toBeVisible();
+    expect(screen.getByTestId('edge-key-display')).toBeVisible();
+  });
+
+  it('should render EdgeScriptForm with correct edgeInfo', () => {
+    renderComponent({
+      edgeKey: 'test-edge-key-123',
+      edgeId: 'edge-id-456',
+    });
+
+    expect(screen.getByTestId('edge-script-form')).toBeInTheDocument();
+    expect(screen.getByTestId('edge-info-key')).toHaveTextContent(
+      'test-edge-key-123'
+    );
+    expect(screen.getByTestId('edge-info-id')).toHaveTextContent('edge-id-456');
+  });
+
+  it('should render EdgeScriptForm with undefined edgeId when not provided', () => {
+    renderComponent({
+      edgeKey: 'test-edge-key-123',
+    });
+
+    expect(screen.getByTestId('edge-info-id')).toHaveTextContent('undefined');
+  });
+
+  it('should pass asyncMode prop to EdgeScriptForm', () => {
+    renderComponent({
+      edgeKey: 'test-edge-key-123',
+      asyncMode: true,
+    });
+
+    expect(screen.getByTestId('async-mode')).toHaveTextContent('true');
+  });
+
+  it('should pass asyncMode as undefined when not provided', () => {
+    renderComponent({
+      edgeKey: 'test-edge-key-123',
+    });
+
+    expect(screen.getByTestId('async-mode')).toHaveTextContent('undefined');
+  });
+
+  it('should construct commands with linux and windows platforms', () => {
+    renderComponent({
+      edgeKey: 'test-edge-key-123',
+    });
+
+    const commandsText = screen.getByTestId('commands-type').textContent;
+    const commands = JSON.parse(commandsText || '{}');
+
+    expect(commands).toHaveProperty('linux');
+    expect(commands).toHaveProperty('win');
+    expect(Array.isArray(commands.linux)).toBe(true);
+    expect(Array.isArray(commands.win)).toBe(true);
+  });
+
+  it('should include correct linux commands', () => {
+    renderComponent({
+      edgeKey: 'test-edge-key-123',
+    });
+
+    const commandsText = screen.getByTestId('commands-type').textContent;
+    const commands = JSON.parse(commandsText || '{}');
+
+    // Should have 4 linux commands: k8s, swarm, standalone, podman
+    expect(commands.linux.length).toBe(4);
+    const platforms = commands.linux.map((cmd: { id: string }) => cmd.id);
+    expect(platforms).toContain('k8s');
+    expect(platforms).toContain('swarm');
+    expect(platforms).toContain('standalone');
+    expect(platforms).toContain('podman');
+  });
+
+  it('should include correct windows commands', () => {
+    renderComponent({
+      edgeKey: 'test-edge-key-123',
+    });
+
+    const commandsText = screen.getByTestId('commands-type').textContent;
+    const commands = JSON.parse(commandsText || '{}');
+
+    // Should have 2 windows commands: swarm, standalone
+    expect(commands.win.length).toBe(2);
+    const platforms = commands.win.map((cmd: { id: string }) => cmd.id);
+    expect(platforms).toContain('swarm');
+    expect(platforms).toContain('standalone');
+  });
+
+  it('should render EdgeKeyDisplay with correct edgeKey', () => {
+    renderComponent({
+      edgeKey: 'test-edge-key-123',
+    });
+
+    const keyDisplay = screen.getByTestId('edge-key-display');
+    expect(keyDisplay).toBeInTheDocument();
+    expect(keyDisplay).toHaveTextContent('test-edge-key-123');
+  });
+
+  it('should render Widget structure', () => {
+    const { container } = renderComponent({
+      edgeKey: 'test-edge-key-123',
+    });
+
+    // Widget should have the widget structure
+    const widget = container.querySelector('[class*="widget"]');
+    expect(widget).toBeInTheDocument();
+  });
+
+  describe('Edge key decoding and display', () => {
+    it('should decode and display valid edge key details', () => {
+      const validKey = btoa('https://portainer.io|tunnel.example.com:8000');
+      renderComponent({ edgeKey: validKey });
+
+      expect(screen.getByText(/https:\/\/portainer\.io/)).toBeVisible();
+      expect(
+        screen.getByText(/tcp:\/\/tunnel\.example\.com:8000/)
+      ).toBeVisible();
+    });
+
+    it('should handle invalid base64 gracefully', () => {
+      renderComponent({ edgeKey: 'invalid-base64!!!' });
+
+      // Should not crash and should render the widget
+      expect(screen.getByText('Deploy an agent')).toBeVisible();
+      expect(screen.getByText('Edge agent deployment script')).toBeVisible();
+    });
+
+    it('should handle empty edge key', () => {
+      renderComponent({ edgeKey: '' });
+
+      expect(screen.getByText('Deploy an agent')).toBeVisible();
+      expect(screen.getByText('Edge agent deployment script')).toBeVisible();
+    });
+
+    it('should handle edge key with missing pipe delimiter', () => {
+      const keyWithoutPipe = btoa('https://portainer.io');
+      renderComponent({ edgeKey: keyWithoutPipe });
+
+      // Should decode but show empty tunnel address
+      expect(screen.getByText(/https:\/\/portainer\.io/)).toBeVisible();
+    });
+
+    it('should handle edge key with only pipe delimiter', () => {
+      const keyWithOnlyPipe = btoa('|');
+      renderComponent({ edgeKey: keyWithOnlyPipe });
+
+      // Should not crash
+      expect(screen.getByText('Deploy an agent')).toBeVisible();
+    });
+
+    it('should handle edge key with multiple pipe delimiters', () => {
+      const keyWithMultiplePipes = btoa(
+        'https://portainer.io|tunnel.example.com:8000|extra'
+      );
+      renderComponent({ edgeKey: keyWithMultiplePipes });
+
+      // Should use first two parts only
+      expect(screen.getByText(/https:\/\/portainer\.io/)).toBeVisible();
+      expect(
+        screen.getByText(/tcp:\/\/tunnel\.example\.com:8000/)
+      ).toBeVisible();
+    });
+  });
+});
+
+interface RenderOptions {
+  edgeKey: string;
+  edgeId?: string;
+  asyncMode?: boolean;
+}
+
+function renderComponent({ edgeKey, edgeId, asyncMode }: RenderOptions) {
+  const Wrapper = withTestQueryProvider(
+    withUserProvider(EdgeAgentDeploymentWidget)
+  );
+  return render(
+    <Wrapper edgeKey={edgeKey} edgeId={edgeId} asyncMode={asyncMode} />
+  );
+}
diff --git a/app/react/portainer/environments/ItemView/EdgeAgentDeploymentWidget/EdgeAgentDeploymentWidget.tsx b/app/react/portainer/environments/ItemView/EdgeAgentDeploymentWidget/EdgeAgentDeploymentWidget.tsx
new file mode 100644
index 0000000..3e3e63c
--- /dev/null
+++ b/app/react/portainer/environments/ItemView/EdgeAgentDeploymentWidget/EdgeAgentDeploymentWidget.tsx
@@ -0,0 +1,81 @@
+import { compact } from 'lodash';
+
+import { EdgeScriptForm } from '@/react/edge/components/EdgeScriptForm';
+import { commandsTabs } from '@/react/edge/components/EdgeScriptForm/scripts';
+import { EdgeKeyDisplay } from '@/react/portainer/environments/ItemView/EdgeKeyDisplay';
+
+import { FormSection } from '@@/form-components/FormSection';
+import { Widget, WidgetBody } from '@@/Widget';
+import { TextTip } from '@@/Tip/TextTip';
+
+interface Props {
+  edgeKey: string;
+  edgeId?: string;
+  asyncMode?: boolean;
+}
+
+interface EdgeKeyDetails {
+  instanceURL: string;
+  tunnelServerAddr: string;
+}
+
+export function EdgeAgentDeploymentWidget({
+  edgeKey,
+  edgeId,
+  asyncMode,
+}: Props) {
+  const edgeScriptCommands = {
+    linux: compact([
+      commandsTabs.k8sLinux,
+      commandsTabs.swarmLinux,
+      commandsTabs.standaloneLinux,
+      commandsTabs.podmanLinux,
+    ]),
+    win: [commandsTabs.swarmWindows, commandsTabs.standaloneWindow],
+  };
+
+  const edgeKeyDetails = decodeEdgeKey(edgeKey);
+
+  return (
+    <Widget>
+      <WidgetBody>
+        <FormSection title="Deploy an agent">
+          <TextTip color="blue">
+            Refer to the platform related command below to deploy the Edge agent
+            in your remote cluster. <br />
+            The agent will communicate with Portainer via{' '}
+            <u>{edgeKeyDetails.instanceURL}</u> and{' '}
+            <u>tcp://{edgeKeyDetails.tunnelServerAddr}</u>
+          </TextTip>
+        </FormSection>
+
+        <FormSection title="Edge agent deployment script">
+          <EdgeScriptForm
+            edgeInfo={{ key: edgeKey, id: edgeId }}
+            commands={edgeScriptCommands}
+            asyncMode={asyncMode}
+          />
+        </FormSection>
+
+        <EdgeKeyDisplay edgeKey={edgeKey} />
+      </WidgetBody>
+    </Widget>
+  );
+}
+
+function decodeEdgeKey(key: string): EdgeKeyDetails {
+  if (!key) {
+    return { instanceURL: '', tunnelServerAddr: '' };
+  }
+
+  try {
+    const decodedKey = atob(key).split('|');
+    return {
+      instanceURL: decodedKey[0] || '',
+      tunnelServerAddr: decodedKey[1] || '',
+    };
+  } catch {
+    // Invalid base64, return empty strings
+    return { instanceURL: '', tunnelServerAddr: '' };
+  }
+}
diff --git a/app/react/portainer/environments/ItemView/EdgeEnvironmentForm/EdgeEnvironmentForm.test.tsx b/app/react/portainer/environments/ItemView/EdgeEnvironmentForm/EdgeEnvironmentForm.test.tsx
new file mode 100644
index 0000000..1b75fa2
--- /dev/null
+++ b/app/react/portainer/environments/ItemView/EdgeEnvironmentForm/EdgeEnvironmentForm.test.tsx
@@ -0,0 +1,326 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { HttpResponse } from 'msw';
+import { describe, expect, it, vi } from 'vitest';
+
+import { server, http } from '@/setup-tests/server';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import {
+  createMockEnvironment,
+  createMockEnvironmentGroup,
+} from '@/react-tools/test-mocks';
+import { EnvironmentType } from '@/react/portainer/environments/types';
+
+import { EdgeEnvironmentForm } from './EdgeEnvironmentForm';
+
+// Factory function to create a fresh wrapped component for each test
+function createWrappedForm() {
+  return withTestRouter(
+    withUserProvider(withTestQueryProvider(EdgeEnvironmentForm)),
+    {
+      route: '/endpoints/1',
+      stateConfig: [
+        {
+          name: 'portainer.endpoints.endpoint',
+          url: '/endpoints/:id',
+        },
+      ],
+    }
+  );
+}
+
+// Default mock handlers
+function setupDefaultMocks() {
+  server.use(
+    // Settings endpoint
+    http.get('/api/settings', () =>
+      HttpResponse.json({
+        Edge: {
+          PingInterval: 60,
+          SnapshotInterval: 300,
+          CommandInterval: 60,
+        },
+        EdgeAgentCheckinInterval: 5,
+      })
+    ),
+    // Groups endpoint
+    http.get('/api/endpoint_groups', () =>
+      HttpResponse.json([
+        createMockEnvironmentGroup({ Id: 1, Name: 'Default' }),
+        createMockEnvironmentGroup({ Id: 2, Name: 'Production' }),
+      ])
+    ),
+    // Tags endpoint
+    http.get('/api/tags', () =>
+      HttpResponse.json([
+        { ID: 1, Name: 'tag1' },
+        { ID: 2, Name: 'tag2' },
+      ])
+    ),
+    // Name uniqueness check
+    http.get('/api/endpoints', () =>
+      HttpResponse.json({ value: [], totalCount: 0 })
+    ),
+    // Update endpoint
+    http.put('/api/endpoints/:id', () => HttpResponse.json({})),
+    // User endpoint for MetadataFieldset
+    http.get('/api/users/me', () =>
+      HttpResponse.json({
+        Id: 1,
+        Username: 'admin',
+        Role: 1,
+      })
+    )
+  );
+}
+
+describe('EdgeEnvironmentForm', () => {
+  beforeEach(() => {
+    setupDefaultMocks();
+  });
+
+  describe('sync mode', () => {
+    it('should render poll frequency field for sync mode environment', async () => {
+      const environment = createMockEnvironment({
+        Id: 1,
+        Name: 'Test Edge Environment',
+        Type: EnvironmentType.EdgeAgentOnDocker,
+        EdgeID: 'edge-123',
+        Edge: {
+          AsyncMode: false,
+          PingInterval: 0,
+          SnapshotInterval: 0,
+          CommandInterval: 0,
+        },
+      });
+
+      const onSuccess = vi.fn();
+      const WrappedForm = createWrappedForm();
+
+      render(<WrappedForm environment={environment} onSuccess={onSuccess} />);
+
+      await waitFor(() => {
+        expect(screen.getByText('Poll frequency')).toBeVisible();
+      });
+
+      // Async mode fields should not be present
+      expect(screen.queryByText('Ping interval')).not.toBeInTheDocument();
+      expect(screen.queryByText('Snapshot interval')).not.toBeInTheDocument();
+      expect(screen.queryByText('Command interval')).not.toBeInTheDocument();
+    });
+
+    it('should render poll frequency field with the environment initial value', async () => {
+      const environment = createMockEnvironment({
+        Id: 1,
+        Name: 'Test Edge Environment',
+        Type: EnvironmentType.EdgeAgentOnDocker,
+        EdgeID: 'edge-123',
+        EdgeCheckinInterval: 10,
+        Edge: {
+          AsyncMode: false,
+          PingInterval: 0,
+          SnapshotInterval: 0,
+          CommandInterval: 0,
+        },
+      });
+
+      const onSuccess = vi.fn();
+      const WrappedForm = createWrappedForm();
+
+      render(<WrappedForm environment={environment} onSuccess={onSuccess} />);
+
+      await waitFor(() => {
+        expect(
+          screen.getByRole('combobox', { name: /poll frequency/i })
+        ).toHaveValue('10');
+      });
+    });
+  });
+
+  describe('async mode', () => {
+    it('should render async interval fields for async mode environment', async () => {
+      const environment = createMockEnvironment({
+        Id: 1,
+        Name: 'Test Edge Async Environment',
+        Type: EnvironmentType.EdgeAgentOnDocker,
+        EdgeID: 'edge-123',
+        Edge: {
+          AsyncMode: true,
+          PingInterval: 60,
+          SnapshotInterval: 300,
+          CommandInterval: 60,
+        },
+      });
+
+      const onSuccess = vi.fn();
+      const WrappedForm = createWrappedForm();
+
+      render(<WrappedForm environment={environment} onSuccess={onSuccess} />);
+
+      await waitFor(() => {
+        expect(screen.getByText('Ping interval')).toBeVisible();
+      });
+
+      expect(screen.getByText('Snapshot interval')).toBeVisible();
+      expect(screen.getByText('Command interval')).toBeVisible();
+
+      // Sync mode field should not be present
+      expect(screen.queryByText('Poll frequency')).not.toBeInTheDocument();
+    });
+  });
+
+  describe('form fields', () => {
+    it('should render name field with initial value', async () => {
+      const environment = createMockEnvironment({
+        Id: 1,
+        Name: 'My Edge Env',
+        Type: EnvironmentType.EdgeAgentOnDocker,
+        EdgeID: 'edge-123',
+        Edge: {
+          AsyncMode: false,
+          PingInterval: 0,
+          SnapshotInterval: 0,
+          CommandInterval: 0,
+        },
+      });
+
+      const WrappedForm = createWrappedForm();
+
+      render(<WrappedForm environment={environment} onSuccess={vi.fn()} />);
+
+      await waitFor(() => {
+        const nameInput = screen.getByTestId('environmentCreate-nameInput');
+        expect(nameInput).toHaveValue('My Edge Env');
+      });
+    });
+
+    it('should render public URL field with initial value', async () => {
+      const environment = createMockEnvironment({
+        Id: 1,
+        Name: 'Test Edge',
+        Type: EnvironmentType.EdgeAgentOnDocker,
+        EdgeID: 'edge-123',
+        PublicURL: 'https://edge.example.com',
+        Edge: {
+          AsyncMode: false,
+          PingInterval: 0,
+          SnapshotInterval: 0,
+          CommandInterval: 0,
+        },
+      });
+
+      const WrappedForm = createWrappedForm();
+
+      render(<WrappedForm environment={environment} onSuccess={vi.fn()} />);
+
+      await waitFor(() => {
+        const publicUrlInput = screen.getByTestId('public-url-input');
+        expect(publicUrlInput).toHaveValue('https://edge.example.com');
+      });
+    });
+
+    it('should render metadata section with group selector', async () => {
+      const environment = createMockEnvironment({
+        Id: 1,
+        Name: 'Test Edge',
+        Type: EnvironmentType.EdgeAgentOnDocker,
+        EdgeID: 'edge-123',
+        GroupId: 1,
+        Edge: {
+          AsyncMode: false,
+          PingInterval: 0,
+          SnapshotInterval: 0,
+          CommandInterval: 0,
+        },
+      });
+
+      const WrappedForm = createWrappedForm();
+
+      render(<WrappedForm environment={environment} onSuccess={vi.fn()} />);
+
+      await waitFor(() => {
+        expect(screen.getByText('Metadata')).toBeVisible();
+      });
+
+      expect(screen.getByTestId('environment-group-select')).toBeVisible();
+    });
+  });
+
+  describe('form submission', () => {
+    it('should enable submit button when form is dirty and valid', async () => {
+      const environment = createMockEnvironment({
+        Id: 5,
+        Name: 'Original Name',
+        Type: EnvironmentType.EdgeAgentOnDocker,
+        EdgeID: 'edge-123',
+        PublicURL: 'https://original.example.com',
+        GroupId: 1,
+        TagIds: [1],
+        EdgeCheckinInterval: 5,
+        Edge: {
+          AsyncMode: false,
+          PingInterval: 0,
+          SnapshotInterval: 0,
+          CommandInterval: 0,
+        },
+        Gpus: [],
+      });
+
+      const WrappedForm = createWrappedForm();
+
+      render(<WrappedForm environment={environment} onSuccess={vi.fn()} />);
+
+      // Wait for form to load
+      await waitFor(() => {
+        expect(screen.getByTestId('environmentCreate-nameInput')).toBeVisible();
+      });
+
+      // Button should be disabled initially (form is pristine)
+      const submitButton = screen.getByRole('button', {
+        name: /update environment/i,
+      });
+      expect(submitButton).toBeDisabled();
+
+      // Change the name to make the form dirty
+      const nameInput = screen.getByTestId('environmentCreate-nameInput');
+      await userEvent.type(nameInput, ' v2');
+
+      // Button should be enabled after changes
+      await waitFor(() => {
+        expect(submitButton).not.toBeDisabled();
+      });
+    });
+  });
+
+  describe('form actions', () => {
+    it('should disable submit button when form is pristine', async () => {
+      const environment = createMockEnvironment({
+        Id: 1,
+        Name: 'Test Edge',
+        Type: EnvironmentType.EdgeAgentOnDocker,
+        EdgeID: 'edge-123',
+        Edge: {
+          AsyncMode: false,
+          PingInterval: 0,
+          SnapshotInterval: 0,
+          CommandInterval: 0,
+        },
+      });
+
+      const WrappedForm = createWrappedForm();
+
+      render(<WrappedForm environment={environment} onSuccess={vi.fn()} />);
+
+      await waitFor(() => {
+        expect(screen.getByText('Configuration')).toBeVisible();
+      });
+
+      const submitButton = screen.getByRole('button', {
+        name: /update environment/i,
+      });
+      expect(submitButton).toBeDisabled();
+    });
+  });
+});
diff --git a/app/react/portainer/environments/ItemView/EdgeEnvironmentForm/EdgeEnvironmentForm.tsx b/app/react/portainer/environments/ItemView/EdgeEnvironmentForm/EdgeEnvironmentForm.tsx
new file mode 100644
index 0000000..c4a31ef
--- /dev/null
+++ b/app/react/portainer/environments/ItemView/EdgeEnvironmentForm/EdgeEnvironmentForm.tsx
@@ -0,0 +1,119 @@
+import { Form, Formik, useFormikContext } from 'formik';
+import _ from 'lodash';
+
+import { NameField } from '@/react/portainer/environments/common/NameField/NameField';
+import { PublicUrlField } from '@/react/portainer/environments/common/PublicUrlField/PublicUrlField';
+import { EdgeIntervalsFieldset } from '@/react/portainer/environments/common/EdgeIntervalsFieldset/EdgeIntervalsFieldset';
+import { useUpdateEnvironmentMutation } from '@/react/portainer/environments/queries/useUpdateEnvironmentMutation';
+import { Environment } from '@/react/portainer/environments/types';
+
+import { Widget } from '@@/Widget';
+import { TextTip } from '@@/Tip/TextTip';
+import { confirmDestructive } from '@@/modals/confirm';
+import { buildConfirmButton } from '@@/modals/utils';
+import { FormSection } from '@@/form-components/FormSection';
+
+import { MetadataFieldset } from '../../common/MetadataFieldset';
+import { EnvironmentFormActions } from '../EnvironmentFormActions/EnvironmentFormActions';
+
+import { EdgeEnvironmentFormValues } from './types';
+import { buildInitialValues, buildUpdatePayload } from './helpers';
+import { useEdgeValidation } from './validation';
+
+interface Props {
+  environment: Environment;
+  onSuccess: () => void;
+}
+
+export function EdgeEnvironmentForm({ environment, onSuccess }: Props) {
+  const initialValues = buildInitialValues(environment);
+  const validationSchema = useEdgeValidation(environment.Id);
+  const updateMutation = useUpdateEnvironmentMutation();
+
+  async function handleSubmit(values: EdgeEnvironmentFormValues) {
+    if (_.difference(environment.TagIds, values.meta.tagIds || []).length > 0) {
+      const confirmed = await confirmDestructive({
+        title: 'Confirm action',
+        message:
+          'Removing tags from this environment will remove the corresponding edge stacks when dynamic grouping is being used',
+        confirmButton: buildConfirmButton(),
+      });
+
+      if (!confirmed) {
+        return;
+      }
+    }
+
+    const payload = buildUpdatePayload(values, environment);
+    updateMutation.mutate({ id: environment.Id, payload }, { onSuccess });
+  }
+
+  return (
+    <Widget>
+      <Widget.Body>
+        <Formik
+          initialValues={initialValues}
+          validationSchema={validationSchema}
+          onSubmit={handleSubmit}
+          validateOnMount
+          enableReinitialize
+        >
+          <EdgeEnvironmentFormContent
+            environment={environment}
+            isSubmitting={updateMutation.isLoading}
+          />
+        </Formik>
+      </Widget.Body>
+    </Widget>
+  );
+}
+
+interface FormContentProps {
+  environment: Environment;
+  isSubmitting: boolean;
+}
+
+function EdgeEnvironmentFormContent({
+  environment,
+  isSubmitting,
+}: FormContentProps) {
+  const { isValid, dirty, values, setValues } =
+    useFormikContext<EdgeEnvironmentFormValues>();
+
+  const asyncMode = environment.Edge?.AsyncMode || false;
+
+  return (
+    <Form className="form-horizontal">
+      <FormSection title="Configuration">
+        <NameField />
+        <PublicUrlField />
+        <TextTip color="blue">
+          Use https connection on Edge agent to use private registries with
+          credentials.
+        </TextTip>
+      </FormSection>
+
+      <EdgeIntervalsFieldset
+        value={values.edge}
+        onChange={(intervalValues) => {
+          setValues((values) => ({
+            ...values,
+            edge: {
+              ...values.edge,
+              ...intervalValues,
+            },
+          }));
+        }}
+        asyncMode={asyncMode}
+      />
+
+      <MetadataFieldset />
+
+      <EnvironmentFormActions
+        isLoading={isSubmitting}
+        isValid={isValid}
+        isDirty={dirty}
+      />
+    </Form>
+  );
+}
diff --git a/app/react/portainer/environments/ItemView/EdgeEnvironmentForm/helpers.ts b/app/react/portainer/environments/ItemView/EdgeEnvironmentForm/helpers.ts
new file mode 100644
index 0000000..be7b397
--- /dev/null
+++ b/app/react/portainer/environments/ItemView/EdgeEnvironmentForm/helpers.ts
@@ -0,0 +1,53 @@
+import { Environment } from '@/react/portainer/environments/types';
+
+import { EdgeEnvironmentFormValues } from './types';
+
+/**
+ * Build initial form values from an environment object
+ */
+export function buildInitialValues(
+  environment: Environment
+): EdgeEnvironmentFormValues {
+  return {
+    name: environment.Name,
+    publicUrl: environment.PublicURL || '',
+
+    edge: {
+      checkinInterval: environment.EdgeCheckinInterval,
+      pingInterval: environment.Edge.PingInterval,
+      snapshotInterval: environment.Edge.SnapshotInterval,
+      commandInterval: environment.Edge.CommandInterval,
+    },
+
+    meta: {
+      groupId: environment.GroupId,
+      tagIds: environment.TagIds || [],
+    },
+  };
+}
+
+/**
+ * Build the API payload from form values
+ * @param values - Form values
+ * @param environment - Original environment (for read-only fields like AsyncMode)
+ */
+export function buildUpdatePayload(
+  values: EdgeEnvironmentFormValues,
+  environment: Environment
+) {
+  return {
+    Name: values.name,
+    PublicURL: values.publicUrl,
+    GroupID: values.meta.groupId,
+    TagIds: values.meta.tagIds,
+
+    EdgeCheckinInterval: values.edge.checkinInterval,
+    Edge: {
+      // AsyncMode is read-only, pass through from original environment
+      AsyncMode: environment.Edge?.AsyncMode ?? false,
+      PingInterval: values.edge.pingInterval,
+      SnapshotInterval: values.edge.snapshotInterval,
+      CommandInterval: values.edge.commandInterval,
+    },
+  };
+}
diff --git a/app/react/portainer/environments/ItemView/EdgeEnvironmentForm/types.ts b/app/react/portainer/environments/ItemView/EdgeEnvironmentForm/types.ts
new file mode 100644
index 0000000..f1bd52f
--- /dev/null
+++ b/app/react/portainer/environments/ItemView/EdgeEnvironmentForm/types.ts
@@ -0,0 +1,16 @@
+import { EdgeIntervalsValues } from '../../common/EdgeIntervalsFieldset/types';
+import { EnvironmentMetadata } from '../../environment.service/create';
+
+export interface EdgeEnvironmentFormValues {
+  /** Environment name */
+  name: string;
+
+  /** Public URL for the environment */
+  publicUrl: string;
+
+  /** Edge check-in interval settings */
+  edge: EdgeIntervalsValues;
+
+  /** Metadata (required by MetadataFieldset) */
+  meta: EnvironmentMetadata;
+}
diff --git a/app/react/portainer/environments/ItemView/EdgeEnvironmentForm/validation.ts b/app/react/portainer/environments/ItemView/EdgeEnvironmentForm/validation.ts
new file mode 100644
index 0000000..8773c9e
--- /dev/null
+++ b/app/react/portainer/environments/ItemView/EdgeEnvironmentForm/validation.ts
@@ -0,0 +1,23 @@
+import { object, string, SchemaOf } from 'yup';
+
+import { useNameValidation } from '../../common/NameField/NameField';
+import { edgeIntervalsValidation } from '../../common/EdgeIntervalsFieldset/validation';
+import { EnvironmentId } from '../../types';
+import { metadataValidation } from '../../common/MetadataFieldset/validation';
+
+import { EdgeEnvironmentFormValues } from './types';
+
+/**
+ * Create validation schema for Edge environment form.
+ * Accepts the original environment name to allow keeping the same name.
+ */
+export function useEdgeValidation(
+  envId: EnvironmentId
+): SchemaOf<EdgeEnvironmentFormValues> {
+  return object({
+    name: useNameValidation(envId),
+    publicUrl: string().default(''),
+    edge: edgeIntervalsValidation(),
+    meta: metadataValidation(),
+  });
+}
diff --git a/app/react/portainer/environments/ItemView/EdgeInformationPanel/EdgeInformationPanel.test.tsx b/app/react/portainer/environments/ItemView/EdgeInformationPanel/EdgeInformationPanel.test.tsx
new file mode 100644
index 0000000..8b10d5e
--- /dev/null
+++ b/app/react/portainer/environments/ItemView/EdgeInformationPanel/EdgeInformationPanel.test.tsx
@@ -0,0 +1,191 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { ComponentProps } from 'react';
+
+import { server } from '@/setup-tests/server';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { notifySuccess } from '@/portainer/services/notifications';
+import { confirmDisassociate } from '@/react/portainer/environments/ItemView/ConfirmDisassociateModel';
+
+import { EdgeInformationPanel } from './EdgeInformationPanel';
+
+vi.mock('../ConfirmDisassociateModel');
+vi.mock('@/portainer/services/notifications');
+
+describe('EdgeInformationPanel', () => {
+  beforeEach(() => {
+    vi.mocked(confirmDisassociate).mockResolvedValue(true);
+  });
+
+  it('should render edge information correctly', () => {
+    const { getByText } = renderComponent();
+
+    expect(
+      getByText(/This Edge environment is associated to an Edge environment/)
+    ).toBeVisible();
+    expect(
+      getByText(
+        'aHR0cDovL3Rlc3Qtc2VydmVyOjg5OTl8dGVzdC10dW5uZWw6ODAwMHx0ZXN0a2V5fDE'
+      )
+    ).toBeVisible();
+    expect(getByText('http://test-server:8999')).toBeVisible();
+    expect(getByText('test-tunnel:8000')).toBeVisible();
+    expect(getByText('test-edge-id-456')).toBeVisible();
+    expect(getByText('Disassociate')).toBeVisible();
+  });
+
+  it('should render empty addresses when edge key is invalid base64', () => {
+    const { getByText, queryByText } = renderComponent({
+      edgeKey: '!!!not-valid-base64!!!',
+    });
+
+    expect(getByText('!!!not-valid-base64!!!')).toBeVisible();
+    expect(queryByText('http://test-server:8999')).not.toBeInTheDocument();
+    expect(queryByText('test-tunnel:8000')).not.toBeInTheDocument();
+  });
+
+  it('should render empty tunnel address when edge key has no pipe separator', () => {
+    // valid base64 of a string with no | character
+    const { getByText, queryByText } = renderComponent({
+      edgeKey: btoa('http://test-server:8999'),
+    });
+
+    expect(getByText('http://test-server:8999')).toBeVisible();
+    expect(queryByText('test-tunnel:8000')).not.toBeInTheDocument();
+  });
+
+  it('should show confirmation modal on disassociate button click', async () => {
+    server.use(
+      http.delete('/api/endpoints/:id/association', () => HttpResponse.json({}))
+    );
+
+    const { getByRole } = renderComponent();
+
+    const user = userEvent.setup();
+    const disassociateButton = getByRole('button', { name: /Disassociate/i });
+
+    await user.click(disassociateButton);
+
+    expect(vi.mocked(confirmDisassociate)).toHaveBeenCalled();
+  });
+
+  it('should call mutation on confirm', async () => {
+    let mutationCalled = false;
+
+    server.use(
+      http.delete('/api/endpoints/:id/association', () => {
+        mutationCalled = true;
+        return HttpResponse.json({});
+      })
+    );
+
+    const { getByRole } = renderComponent();
+
+    const user = userEvent.setup();
+    const disassociateButton = getByRole('button', { name: /Disassociate/i });
+
+    await user.click(disassociateButton);
+
+    await waitFor(() => {
+      expect(mutationCalled).toBe(true);
+    });
+  });
+
+  it('should show loading state during mutation', async () => {
+    server.use(
+      http.delete('/api/endpoints/:id/association', async () => {
+        await new Promise((resolve) => {
+          setTimeout(resolve, 100);
+        });
+        return HttpResponse.json({});
+      })
+    );
+
+    const { getByRole } = renderComponent();
+
+    const user = userEvent.setup();
+    const disassociateButton = getByRole('button', { name: /Disassociate/i });
+
+    await user.click(disassociateButton);
+
+    // Check for loading text immediately after click
+    await waitFor(() => {
+      expect(screen.getByText('Disassociating...')).toBeVisible();
+    });
+  });
+
+  it('should not call mutation if user cancels confirmation', async () => {
+    vi.mocked(confirmDisassociate).mockResolvedValueOnce(false);
+
+    let mutationCalled = false;
+
+    server.use(
+      http.delete('/api/endpoints/:id/association', () => {
+        mutationCalled = true;
+        return HttpResponse.json({});
+      })
+    );
+
+    const { getByRole } = renderComponent();
+
+    const user = userEvent.setup();
+    const disassociateButton = getByRole('button', { name: /Disassociate/i });
+
+    await user.click(disassociateButton);
+
+    // Wait a bit to ensure mutation is not called
+    await new Promise((resolve) => {
+      setTimeout(resolve, 100);
+    });
+
+    expect(mutationCalled).toBe(false);
+  });
+
+  it('should show notification and call onSuccess callback on successful disassociation', async () => {
+    const onSuccessMock = vi.fn();
+
+    server.use(
+      http.delete('/api/endpoints/:id/association', () => HttpResponse.json({}))
+    );
+
+    const { getByRole } = renderComponent({ onSuccess: onSuccessMock });
+
+    const user = userEvent.setup();
+    const disassociateButton = getByRole('button', { name: /Disassociate/i });
+
+    await user.click(disassociateButton);
+
+    await waitFor(() => {
+      expect(notifySuccess).toHaveBeenCalledWith(
+        'Environment disassociated',
+        'Environment successfully disassociated'
+      );
+      expect(onSuccessMock).toHaveBeenCalled();
+    });
+  });
+});
+
+// base64.RawStdEncoding of 'http://test-server:8999|test-tunnel:8000|testkey|1' (no padding, as produced by Go)
+const TEST_EDGE_KEY =
+  'aHR0cDovL3Rlc3Qtc2VydmVyOjg5OTl8dGVzdC10dW5uZWw6ODAwMHx0ZXN0a2V5fDE';
+
+function renderComponent({
+  environmentId = 1,
+  edgeKey = TEST_EDGE_KEY,
+  edgeId = 'test-edge-id-456',
+  platformName = 'Docker',
+  onSuccess = vi.fn(),
+}: Partial<ComponentProps<typeof EdgeInformationPanel>> = {}) {
+  const Wrapped = withTestQueryProvider(() => (
+    <EdgeInformationPanel
+      environmentId={environmentId}
+      edgeKey={edgeKey}
+      edgeId={edgeId}
+      platformName={platformName}
+      onSuccess={onSuccess}
+    />
+  ));
+
+  return render(<Wrapped />);
+}
diff --git a/app/react/portainer/environments/ItemView/EdgeInformationPanel/EdgeInformationPanel.tsx b/app/react/portainer/environments/ItemView/EdgeInformationPanel/EdgeInformationPanel.tsx
new file mode 100644
index 0000000..5af2cac
--- /dev/null
+++ b/app/react/portainer/environments/ItemView/EdgeInformationPanel/EdgeInformationPanel.tsx
@@ -0,0 +1,87 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { InformationPanel } from '@@/InformationPanel';
+import { LoadingButton } from '@@/buttons';
+import { TextTip } from '@@/Tip/TextTip';
+
+import { confirmDisassociate } from '../ConfirmDisassociateModel';
+
+import { useDisassociateEnvironment } from './useDisassociateEnvironment';
+
+interface EdgeInformationPanelProps {
+  environmentId: EnvironmentId;
+  edgeKey: string;
+  edgeId: string;
+  platformName: string;
+  onSuccess?: () => void;
+}
+
+export function EdgeInformationPanel({
+  environmentId,
+  edgeKey,
+  edgeId,
+  platformName,
+  onSuccess,
+}: EdgeInformationPanelProps) {
+  const disassociateMutation = useDisassociateEnvironment(environmentId);
+
+  let edgeServerAddress = '';
+  let edgeTunnelAddress = '';
+  try {
+    const decoded = atob(edgeKey + '='.repeat((4 - (edgeKey.length % 4)) % 4));
+    [edgeServerAddress = '', edgeTunnelAddress = ''] = decoded.split('|');
+  } catch {
+    // malformed edge key — leave addresses empty
+  }
+
+  async function handleDisassociate() {
+    const confirmed = await confirmDisassociate();
+    if (confirmed) {
+      disassociateMutation.mutate(undefined, {
+        onSuccess() {
+          notifySuccess(
+            'Environment disassociated',
+            'Environment successfully disassociated'
+          );
+          onSuccess?.();
+        },
+      });
+    }
+  }
+
+  return (
+    <InformationPanel title="Edge information">
+      <div className="text-muted small flex flex-col gap-2">
+        <TextTip>
+          This Edge environment is associated to an Edge environment (
+          {platformName}).
+        </TextTip>
+        <p>
+          Edge key: <code>{edgeKey}</code>
+        </p>
+        <p>
+          Portainer API server: <code>{edgeServerAddress}</code>
+        </p>
+        <p>
+          Portainer tunnel address: <code>{edgeTunnelAddress}</code>
+        </p>
+        <p>
+          Edge identifier: <code>{edgeId}</code>
+        </p>
+        <p>
+          <LoadingButton
+            size="small"
+            color="primary"
+            isLoading={disassociateMutation.isLoading}
+            loadingText="Disassociating..."
+            onClick={handleDisassociate}
+            data-cy="disassociate-environment-button"
+          >
+            Disassociate
+          </LoadingButton>
+        </p>
+      </div>
+    </InformationPanel>
+  );
+}
diff --git a/app/react/portainer/environments/ItemView/EdgeInformationPanel/useDisassociateEnvironment.ts b/app/react/portainer/environments/ItemView/EdgeInformationPanel/useDisassociateEnvironment.ts
new file mode 100644
index 0000000..fa770ed
--- /dev/null
+++ b/app/react/portainer/environments/ItemView/EdgeInformationPanel/useDisassociateEnvironment.ts
@@ -0,0 +1,17 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { withError, withInvalidate } from '@/react-tools/react-query';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { disassociateEndpoint } from '@/react/portainer/environments/environment.service';
+
+import { environmentQueryKeys } from '../../queries/query-keys';
+
+export function useDisassociateEnvironment(environmentId: EnvironmentId) {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: () => disassociateEndpoint(environmentId),
+    ...withError('Failed to disassociate environment'),
+    ...withInvalidate(queryClient, [environmentQueryKeys.item(environmentId)]),
+  });
+}
diff --git a/app/react/portainer/environments/ItemView/EdgeKeyDisplay.tsx b/app/react/portainer/environments/ItemView/EdgeKeyDisplay.tsx
new file mode 100644
index 0000000..7f2acad
--- /dev/null
+++ b/app/react/portainer/environments/ItemView/EdgeKeyDisplay.tsx
@@ -0,0 +1,30 @@
+import { CopyButton } from '@@/buttons';
+import { FormSection } from '@@/form-components/FormSection';
+import { TextTip } from '@@/Tip/TextTip';
+import { Code } from '@@/Code';
+
+export function EdgeKeyDisplay({ edgeKey }: { edgeKey: string }) {
+  return (
+    <FormSection title="Join token">
+      <TextTip color="blue">
+        For those pre-staging the edge agent, use the following join token to
+        associate the Edge agent with this environment.
+      </TextTip>
+
+      <p className="small text-muted mt-2">
+        You can read more about pre-staging in the user-guide available{' '}
+        <a href="https://downloads.portainer.io/edge_agent_guide.pdf">here.</a>
+      </p>
+
+      <Code>{edgeKey}</Code>
+
+      <CopyButton
+        copyText={edgeKey}
+        className="mt-2"
+        data-cy="copy-edge-key-button"
+      >
+        Copy token
+      </CopyButton>
+    </FormSection>
+  );
+}
diff --git a/app/react/portainer/environments/ItemView/EnvironmentDetailsForm.test.tsx b/app/react/portainer/environments/ItemView/EnvironmentDetailsForm.test.tsx
new file mode 100644
index 0000000..c0d1067
--- /dev/null
+++ b/app/react/portainer/environments/ItemView/EnvironmentDetailsForm.test.tsx
@@ -0,0 +1,256 @@
+import { render, screen, waitFor } from '@testing-library/react';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import {
+  Environment,
+  EnvironmentType,
+} from '@/react/portainer/environments/types';
+import { createMockEnvironment } from '@/react-tools/test-mocks';
+
+import { EnvironmentDetailsForm } from './EnvironmentDetailsForm';
+
+// Mock child form components
+vi.mock('./AzureEnvironmentForm/AzureEnvironmentForm', () => ({
+  AzureEnvironmentForm: ({
+    environment,
+    onSuccess,
+  }: {
+    environment: Environment;
+    onSuccess: () => void;
+  }) => (
+    <div data-cy="azure-environment-form">
+      AzureEnvironmentForm: {environment.Name}
+      <button type="button" onClick={onSuccess}>
+        Submit Azure
+      </button>
+    </div>
+  ),
+}));
+
+vi.mock('./EdgeEnvironmentForm/EdgeEnvironmentForm', () => ({
+  EdgeEnvironmentForm: ({
+    environment,
+    onSuccess,
+  }: {
+    environment: Environment;
+    onSuccess: () => void;
+  }) => (
+    <div data-cy="edge-environment-form">
+      EdgeEnvironmentForm: {environment.Name}
+      <button type="button" onClick={onSuccess}>
+        Submit Edge
+      </button>
+    </div>
+  ),
+}));
+
+vi.mock('./GeneralEnvironmentForm/GeneralEnvironmentForm', () => ({
+  GeneralEnvironmentForm: ({
+    environment,
+    onSuccess,
+  }: {
+    environment: Environment;
+    onSuccess: () => void;
+  }) => (
+    <div data-cy="general-environment-form">
+      GeneralEnvironmentForm: {environment.Name}
+      <button type="button" onClick={onSuccess}>
+        Submit General
+      </button>
+    </div>
+  ),
+}));
+
+// Mock notification service
+const mockNotifySuccess = vi.fn();
+vi.mock('@/portainer/services/notifications', () => ({
+  notifySuccess: (title: string, message: string) =>
+    mockNotifySuccess(title, message),
+}));
+
+// Mock router
+const mockRouterGo = vi.fn();
+const mockRouterState = {
+  stateService: {
+    go: mockRouterGo,
+  },
+};
+const mockStateParams = {
+  params: {},
+};
+
+vi.mock('@uirouter/react', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@uirouter/react')>();
+  return {
+    ...actual,
+    useRouter: () => mockRouterState,
+    useCurrentStateAndParams: () => mockStateParams,
+  };
+});
+
+describe('EnvironmentDetailsForm', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('should render AzureEnvironmentForm for Azure environment', async () => {
+    const environment = createMockEnvironment({
+      Type: EnvironmentType.Azure,
+      Name: 'Azure Test',
+    });
+
+    renderComponent({ environment });
+
+    await waitFor(() => {
+      const azureForm = screen.getByTestId('azure-environment-form');
+      expect(azureForm).toBeVisible();
+      expect(azureForm).toHaveTextContent('Azure Test');
+    });
+
+    // Should not render other forms
+    expect(
+      screen.queryByTestId('edge-environment-form')
+    ).not.toBeInTheDocument();
+    expect(
+      screen.queryByTestId('general-environment-form')
+    ).not.toBeInTheDocument();
+  });
+
+  it('should render EdgeEnvironmentForm for EdgeAgentOnDocker environment', async () => {
+    const environment = createMockEnvironment({
+      Type: EnvironmentType.EdgeAgentOnDocker,
+      Name: 'Edge Docker Test',
+    });
+
+    renderComponent({ environment });
+
+    await waitFor(() => {
+      const edgeForm = screen.getByTestId('edge-environment-form');
+      expect(edgeForm).toBeVisible();
+      expect(edgeForm).toHaveTextContent('Edge Docker Test');
+    });
+
+    // Should not render other forms
+    expect(
+      screen.queryByTestId('azure-environment-form')
+    ).not.toBeInTheDocument();
+    expect(
+      screen.queryByTestId('general-environment-form')
+    ).not.toBeInTheDocument();
+  });
+
+  it('should render EdgeEnvironmentForm for EdgeAgentOnKubernetes environment', async () => {
+    const environment = createMockEnvironment({
+      Type: EnvironmentType.EdgeAgentOnKubernetes,
+      Name: 'Edge K8s Test',
+    });
+
+    renderComponent({ environment });
+
+    await waitFor(() => {
+      const edgeForm = screen.getByTestId('edge-environment-form');
+      expect(edgeForm).toBeVisible();
+      expect(edgeForm).toHaveTextContent('Edge K8s Test');
+    });
+  });
+
+  it('should render GeneralEnvironmentForm for Docker environment', async () => {
+    const environment = createMockEnvironment({
+      Type: EnvironmentType.Docker,
+      Name: 'Docker Test',
+    });
+
+    renderComponent({ environment });
+
+    await waitFor(() => {
+      const generalForm = screen.getByTestId('general-environment-form');
+      expect(generalForm).toBeVisible();
+      expect(generalForm).toHaveTextContent('Docker Test');
+    });
+
+    // Should not render other forms
+    expect(
+      screen.queryByTestId('azure-environment-form')
+    ).not.toBeInTheDocument();
+    expect(
+      screen.queryByTestId('edge-environment-form')
+    ).not.toBeInTheDocument();
+  });
+
+  it('should render GeneralEnvironmentForm for Kubernetes environment', async () => {
+    const environment = createMockEnvironment({
+      Type: EnvironmentType.KubernetesLocal,
+      Name: 'K8s Test',
+    });
+
+    renderComponent({ environment });
+
+    await waitFor(() => {
+      const generalForm = screen.getByTestId('general-environment-form');
+      expect(generalForm).toBeVisible();
+      expect(generalForm).toHaveTextContent('K8s Test');
+    });
+  });
+
+  it('should show success notification and navigate on form success', async () => {
+    const environment = createMockEnvironment({
+      Type: EnvironmentType.Docker,
+      Name: 'Test Environment',
+    });
+
+    renderComponent({ environment });
+
+    const submitButton = await screen.findByRole('button', {
+      name: 'Submit General',
+    });
+    submitButton.click();
+
+    await waitFor(() => {
+      expect(mockNotifySuccess).toHaveBeenCalledWith(
+        'Environment updated',
+        'Test Environment'
+      );
+      expect(mockRouterGo).toHaveBeenCalledWith(
+        'portainer.endpoints',
+        {},
+        { reload: true }
+      );
+    });
+  });
+
+  it('should navigate to redirectTo param when provided on success', async () => {
+    const environment = createMockEnvironment({
+      Type: EnvironmentType.Docker,
+      Name: 'Test Environment',
+    });
+
+    // Update the mock to return redirectTo param
+    mockStateParams.params = { redirectTo: 'docker.dashboard' };
+
+    renderComponent({ environment });
+
+    const submitButton = await screen.findByRole('button', {
+      name: 'Submit General',
+    });
+    submitButton.click();
+
+    await waitFor(() => {
+      expect(mockNotifySuccess).toHaveBeenCalled();
+      expect(mockRouterGo).toHaveBeenCalledWith(
+        'docker.dashboard',
+        {},
+        { reload: true }
+      );
+    });
+
+    // Reset for next test
+    mockStateParams.params = {};
+  });
+});
+
+function renderComponent({ environment }: { environment: Environment }) {
+  const Wrapped = withTestQueryProvider(withTestRouter(EnvironmentDetailsForm));
+
+  return render(<Wrapped environment={environment} />);
+}
diff --git a/app/react/portainer/environments/ItemView/EnvironmentDetailsForm.tsx b/app/react/portainer/environments/ItemView/EnvironmentDetailsForm.tsx
new file mode 100644
index 0000000..29badba
--- /dev/null
+++ b/app/react/portainer/environments/ItemView/EnvironmentDetailsForm.tsx
@@ -0,0 +1,57 @@
+import { useCurrentStateAndParams, useRouter } from '@uirouter/react';
+
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { Environment } from '../types';
+import { isAzureEnvironment, isEdgeEnvironment } from '../utils';
+
+import { AzureEnvironmentForm } from './AzureEnvironmentForm/AzureEnvironmentForm';
+import { EdgeEnvironmentForm } from './EdgeEnvironmentForm/EdgeEnvironmentForm';
+import { GeneralEnvironmentForm } from './GeneralEnvironmentForm/GeneralEnvironmentForm';
+
+export function EnvironmentDetailsForm({
+  environment,
+}: {
+  environment: Environment;
+}) {
+  const router = useRouter();
+  const {
+    params: { redirectTo = '' },
+  } = useCurrentStateAndParams();
+  const isAzure = isAzureEnvironment(environment.Type);
+  const isEdge = isEdgeEnvironment(environment.Type);
+
+  if (isAzure) {
+    return (
+      <AzureEnvironmentForm
+        environment={environment}
+        onSuccess={handleSuccess}
+      />
+    );
+  }
+
+  if (isEdge) {
+    return (
+      <EdgeEnvironmentForm
+        environment={environment}
+        onSuccess={handleSuccess}
+      />
+    );
+  }
+
+  return (
+    <GeneralEnvironmentForm
+      environment={environment}
+      onSuccess={handleSuccess}
+    />
+  );
+
+  function handleSuccess() {
+    notifySuccess('Environment updated', environment.Name);
+    router.stateService.go(
+      redirectTo || 'portainer.endpoints',
+      {},
+      { reload: true }
+    );
+  }
+}
diff --git a/app/react/portainer/environments/ItemView/EnvironmentFormActions/EnvironmentFormActions.test.tsx b/app/react/portainer/environments/ItemView/EnvironmentFormActions/EnvironmentFormActions.test.tsx
new file mode 100644
index 0000000..702f9c7
--- /dev/null
+++ b/app/react/portainer/environments/ItemView/EnvironmentFormActions/EnvironmentFormActions.test.tsx
@@ -0,0 +1,66 @@
+import { render, screen } from '@testing-library/react';
+import { describe, expect, it } from 'vitest';
+
+import { withTestRouter } from '@/react/test-utils/withRouter';
+
+import { EnvironmentFormActions } from './EnvironmentFormActions';
+
+describe('EnvironmentFormActions', () => {
+  it('should render update and cancel buttons', async () => {
+    renderComponent({ isLoading: false });
+
+    expect(
+      await screen.findByRole('button', { name: 'Update environment' })
+    ).toBeVisible();
+    expect(screen.getByText('Cancel')).toBeVisible();
+  });
+
+  it('should disable update button when form is not dirty', () => {
+    renderComponent({ isDirty: false });
+
+    const updateButton = screen.getByRole('button', {
+      name: 'Update environment',
+    });
+    expect(updateButton).toBeDisabled();
+  });
+
+  it('should disable update button when form is invalid', () => {
+    renderComponent({ isValid: false, isDirty: true });
+
+    const updateButton = screen.getByRole('button', {
+      name: 'Update environment',
+    });
+    expect(updateButton).toBeDisabled();
+  });
+
+  it('should enable update button when form is valid and dirty', () => {
+    renderComponent({ isValid: true, isDirty: true });
+
+    const updateButton = screen.getByRole('button', {
+      name: 'Update environment',
+    });
+    expect(updateButton).toBeEnabled();
+  });
+
+  it('should disable submit button when loading', () => {
+    renderComponent({ isLoading: true });
+
+    const updateButton = screen.getByText('Updating environment...');
+
+    expect(updateButton).toBeDisabled();
+  });
+});
+
+function renderComponent(
+  props?: Partial<React.ComponentProps<typeof EnvironmentFormActions>>
+) {
+  const defaultProps: React.ComponentProps<typeof EnvironmentFormActions> = {
+    isLoading: false,
+    isValid: true,
+    isDirty: false,
+  };
+
+  const Wrapper = withTestRouter(EnvironmentFormActions);
+
+  return render(<Wrapper {...defaultProps} {...props} />);
+}
diff --git a/app/react/portainer/environments/ItemView/EnvironmentFormActions/EnvironmentFormActions.tsx b/app/react/portainer/environments/ItemView/EnvironmentFormActions/EnvironmentFormActions.tsx
new file mode 100644
index 0000000..9518af1
--- /dev/null
+++ b/app/react/portainer/environments/ItemView/EnvironmentFormActions/EnvironmentFormActions.tsx
@@ -0,0 +1,42 @@
+import { Save } from 'lucide-react';
+
+import { LoadingButton } from '@@/buttons/LoadingButton';
+import { Button } from '@@/buttons';
+import { Link } from '@@/Link';
+
+interface Props {
+  isLoading: boolean;
+  isValid: boolean;
+  isDirty: boolean;
+}
+
+export function EnvironmentFormActions({ isLoading, isValid, isDirty }: Props) {
+  return (
+    <div className="form-group">
+      <div className="col-sm-12">
+        <LoadingButton
+          className="wizard-connect-button !ml-0"
+          loadingText="Updating environment..."
+          isLoading={isLoading}
+          disabled={!isDirty || !isValid}
+          icon={Save}
+          data-cy="environment-update-button"
+        >
+          Update environment
+        </LoadingButton>
+
+        <Button
+          type="button"
+          color="default"
+          as={Link}
+          props={{ to: 'portainer.endpoints' }}
+          disabled={isLoading}
+          data-cy="environment-cancel-button"
+          className="!ml-2"
+        >
+          Cancel
+        </Button>
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/portainer/environments/ItemView/GeneralEnvironmentForm/GeneralEnvironmentForm.test.tsx b/app/react/portainer/environments/ItemView/GeneralEnvironmentForm/GeneralEnvironmentForm.test.tsx
new file mode 100644
index 0000000..e1f2882
--- /dev/null
+++ b/app/react/portainer/environments/ItemView/GeneralEnvironmentForm/GeneralEnvironmentForm.test.tsx
@@ -0,0 +1,428 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { DefaultBodyType, http, HttpResponse } from 'msw';
+import { describe, it, expect, vi, test } from 'vitest';
+
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { server } from '@/setup-tests/server';
+import {
+  Environment,
+  EnvironmentType,
+  EnvironmentStatus,
+} from '@/react/portainer/environments/types';
+import {
+  createMockEnvironment,
+  createMockUser,
+} from '@/react-tools/test-mocks';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+
+import { GeneralEnvironmentForm } from './GeneralEnvironmentForm';
+
+describe('GeneralEnvironmentForm', () => {
+  it('should render all fields for Docker environment', async () => {
+    const dockerEnv = createMockEnvironment({
+      Type: EnvironmentType.Docker,
+      URL: 'unix:///var/run/docker.sock',
+    });
+    renderComponent(dockerEnv);
+
+    await waitFor(() => {
+      expect(screen.getByRole('textbox', { name: /Name/ })).toBeVisible();
+    });
+
+    expect(screen.getByLabelText('Environment URL')).toBeVisible();
+    expect(screen.getByLabelText('Public IP')).toBeVisible();
+    expect(screen.queryByText(/TLS/i)).not.toBeInTheDocument();
+  });
+
+  it('should render TLS section for Docker API environment', async () => {
+    const dockerApiEnv = createMockEnvironment({
+      Type: EnvironmentType.Docker,
+      URL: 'tcp://10.0.0.1:2375',
+    });
+    renderComponent(dockerApiEnv);
+
+    await waitFor(() => {
+      expect(screen.getByRole('textbox', { name: /Name/ })).toBeVisible();
+    });
+
+    expect(screen.getByLabelText('Environment URL')).toBeVisible();
+    expect(screen.getByLabelText('Public IP')).toBeVisible();
+    expect(screen.getByText(/TLS/i)).toBeVisible();
+  });
+
+  it('should not show TLS section for Kubernetes environment', async () => {
+    const k8sEnv = createMockEnvironment({
+      Type: EnvironmentType.AgentOnKubernetes,
+    });
+    renderComponent(k8sEnv);
+    await waitFor(() => {
+      expect(screen.getByRole('textbox', { name: /Name/ })).toBeVisible();
+    });
+
+    expect(screen.queryByText(/TLS/i)).not.toBeInTheDocument();
+  });
+
+  it('should not show URL fields when environment has error', async () => {
+    const errorEnv = createMockEnvironment({
+      Status: EnvironmentStatus.Error,
+    });
+    renderComponent(errorEnv);
+
+    await waitFor(() => {
+      expect(screen.getByRole('textbox', { name: /Name/ })).toBeVisible();
+    });
+
+    expect(screen.queryByLabelText('Environment URL')).not.toBeInTheDocument();
+    expect(screen.queryByLabelText('Public IP')).not.toBeInTheDocument();
+  });
+
+  it('should validate required fields', async () => {
+    const env = createMockEnvironment();
+    renderComponent(env);
+    const nameInput = screen.getByRole('textbox', { name: /Name/ });
+    await waitFor(() => {
+      expect(nameInput).toBeVisible();
+    });
+
+    await userEvent.clear(nameInput);
+    await userEvent.tab();
+
+    await waitFor(() => {
+      expect(screen.getByText(/Name is required/i)).toBeVisible();
+    });
+  });
+
+  it('should strip protocol from URL on load', async () => {
+    const env = createMockEnvironment({ URL: 'tcp://10.0.0.1:2375' });
+    renderComponent(env);
+
+    await waitFor(() => {
+      const urlInput = screen.getByLabelText('Environment URL');
+      expect(urlInput).toHaveValue('10.0.0.1:2375');
+    });
+  });
+
+  it('should handle submission', async () => {
+    let requestPayload: DefaultBodyType;
+
+    server.use(
+      http.put('/api/endpoints/:id', async ({ request }) => {
+        await new Promise((resolve) => {
+          setTimeout(resolve, 100);
+        });
+        requestPayload = await request.json();
+        return HttpResponse.json(createMockEnvironment());
+      })
+    );
+
+    const env = createMockEnvironment({ Id: 1, Name: 'test-env' });
+    const onSuccess = vi.fn();
+    renderComponent(env, { onSuccess });
+
+    const nameInput = screen.getByRole('textbox', { name: /Name/ });
+
+    await waitFor(() => {
+      expect(nameInput).toBeVisible();
+    });
+
+    // Fill form fields
+    await userEvent.clear(nameInput);
+    await userEvent.type(nameInput, 'my-environment');
+
+    expect(nameInput).toHaveValue('my-environment');
+
+    const urlInput = screen.getByLabelText('Environment URL');
+    await userEvent.clear(urlInput);
+    await userEvent.type(urlInput, '10.0.0.1:2375');
+
+    const publicUrlInput = screen.getByLabelText('Public IP');
+    await userEvent.type(publicUrlInput, '1.2.3.4');
+
+    // Wait for debounce to complete (NameField uses useDebounce)
+    await new Promise((resolve) => {
+      setTimeout(resolve, 500);
+    });
+
+    const submitButton = screen.getByRole('button', {
+      name: /update environment/i,
+    });
+
+    // Wait for Formik to process all changes and enable submit button
+    await waitFor(() => {
+      expect(submitButton).toBeEnabled();
+    });
+
+    await userEvent.click(submitButton);
+    expect(await screen.findByText(/updating environment/i)).toBeVisible();
+
+    // Verify payload
+    await waitFor(() => {
+      expect(requestPayload).toMatchObject({
+        Name: 'my-environment',
+        URL: 'tcp://10.0.0.1:2375',
+        PublicURL: '1.2.3.4',
+      });
+    });
+
+    expect(onSuccess).toHaveBeenCalled();
+  });
+
+  it('should render cancel button', async () => {
+    const env = createMockEnvironment();
+    renderComponent(env);
+
+    await waitFor(() => {
+      expect(screen.getByRole('textbox', { name: /Name/ })).toBeVisible();
+    });
+
+    expect(screen.getByText('Cancel')).toBeVisible();
+  });
+
+  it('should disable submit button when form is invalid', async () => {
+    const env = createMockEnvironment();
+    renderComponent(env);
+
+    await waitFor(() => {
+      expect(screen.getByRole('textbox', { name: /Name/ })).toBeVisible();
+    });
+
+    // Clear required field to make form invalid
+    const nameInput = screen.getByRole('textbox', { name: /Name/ });
+    await userEvent.clear(nameInput);
+
+    await waitFor(() => {
+      const submitButton = screen.getByRole('button', {
+        name: /update environment/i,
+      });
+      expect(submitButton).toBeDisabled();
+
+      expect(screen.getAllByRole('alert').length).toBeGreaterThan(0);
+    });
+  });
+
+  describe('URL handling', () => {
+    test.each([
+      {
+        description: 'unix:// socket URL',
+        inputUrl: 'unix:///var/run/docker.sock',
+        expectedDisplay: 'unix:///var/run/docker.sock',
+        environmentType: EnvironmentType.Docker,
+      },
+      {
+        description: 'tcp:// Docker URL',
+        inputUrl: 'tcp://10.0.0.1:2375',
+        expectedDisplay: '10.0.0.1:2375',
+        environmentType: EnvironmentType.Docker,
+      },
+      {
+        description: 'https:// URL',
+        inputUrl: 'https://docker.example.com:2376',
+        expectedDisplay: 'docker.example.com:2376',
+        environmentType: EnvironmentType.Docker,
+      },
+      {
+        description: 'http:// URL',
+        inputUrl: 'http://docker.example.com:2375',
+        expectedDisplay: 'docker.example.com:2375',
+        environmentType: EnvironmentType.Docker,
+      },
+      {
+        description: 'URL without protocol',
+        inputUrl: '192.168.1.100:2375',
+        expectedDisplay: '192.168.1.100:2375',
+        environmentType: EnvironmentType.Docker,
+      },
+      {
+        description: 'Kubernetes local URL',
+        inputUrl: 'https://k8s.example.com:6443',
+        expectedDisplay: 'k8s.example.com:6443',
+        environmentType: EnvironmentType.KubernetesLocal,
+      },
+    ])(
+      'should handle $description correctly on load',
+      async ({ inputUrl, expectedDisplay, environmentType }) => {
+        const env = createMockEnvironment({
+          URL: inputUrl,
+          Type: environmentType,
+        });
+        renderComponent(env);
+
+        await waitFor(() => {
+          const urlInput = screen.getByLabelText('Environment URL');
+          expect(urlInput).toHaveValue(expectedDisplay);
+        });
+      }
+    );
+  });
+
+  describe('TLS visibility', () => {
+    test.each([
+      {
+        description: 'Docker tcp:// API',
+        url: 'tcp://10.0.0.1:2375',
+        environmentType: EnvironmentType.Docker,
+        shouldShowTLS: true,
+      },
+      {
+        description: 'Docker tcp:// API with TLS port',
+        url: 'tcp://docker.example.com:2376',
+        environmentType: EnvironmentType.Docker,
+        shouldShowTLS: true,
+      },
+      {
+        description: 'Docker unix:// socket',
+        url: 'unix:///var/run/docker.sock',
+        environmentType: EnvironmentType.Docker,
+        shouldShowTLS: false,
+      },
+      {
+        description: 'Agent on Docker',
+        url: 'tcp://agent:9001',
+        environmentType: EnvironmentType.AgentOnDocker,
+        shouldShowTLS: false,
+      },
+      {
+        description: 'Agent on Kubernetes',
+        url: 'agent-k8s:9001',
+        environmentType: EnvironmentType.AgentOnKubernetes,
+        shouldShowTLS: false,
+      },
+      {
+        description: 'Kubernetes Local',
+        url: 'https://k8s.local:6443',
+        environmentType: EnvironmentType.KubernetesLocal,
+        shouldShowTLS: false,
+      },
+      {
+        description: 'Edge Agent on Docker',
+        url: 'edge-agent:8000',
+        environmentType: EnvironmentType.EdgeAgentOnDocker,
+        shouldShowTLS: false,
+      },
+    ])(
+      'should $description - TLS visible: $shouldShowTLS',
+      async ({ url, environmentType, shouldShowTLS }) => {
+        const env = createMockEnvironment({
+          Type: environmentType,
+          URL: url,
+        });
+        renderComponent(env);
+
+        await waitFor(() => {
+          expect(screen.getByRole('textbox', { name: /Name/ })).toBeVisible();
+        });
+
+        if (shouldShowTLS) {
+          expect(screen.getByText(/TLS/i)).toBeVisible();
+        } else {
+          expect(screen.queryByText(/TLS/i)).not.toBeInTheDocument();
+        }
+      }
+    );
+  });
+
+  describe('Form submission', () => {
+    test.each([
+      {
+        description: 'Docker tcp:// URL',
+        environmentType: EnvironmentType.Docker,
+        inputUrl: '10.0.0.1:2375',
+        expectedPayloadUrl: 'tcp://10.0.0.1:2375',
+      },
+      {
+        description: 'Docker plain URL becomes tcp://',
+        environmentType: EnvironmentType.Docker,
+        inputUrl: 'docker.example.com:2376',
+        expectedPayloadUrl: 'tcp://docker.example.com:2376',
+      },
+      {
+        description: 'Kubernetes Local adds https://',
+        environmentType: EnvironmentType.KubernetesLocal,
+        inputUrl: 'k8s.local:6443',
+        expectedPayloadUrl: 'https://k8s.local:6443',
+      },
+    ])(
+      'should submit $description correctly',
+      async ({ environmentType, inputUrl, expectedPayloadUrl }) => {
+        let requestPayload: DefaultBodyType;
+
+        server.use(
+          http.put('/api/endpoints/:id', async ({ request }) => {
+            await new Promise((resolve) => {
+              setTimeout(resolve, 100);
+            });
+            requestPayload = await request.json();
+            return HttpResponse.json(createMockEnvironment());
+          })
+        );
+
+        const env = createMockEnvironment({
+          Id: 1,
+          Name: 'test-env',
+          Type: environmentType,
+        });
+        const onSuccess = vi.fn();
+        renderComponent(env, { onSuccess });
+
+        const nameInput = screen.getByRole('textbox', { name: /Name/ });
+
+        await waitFor(() => {
+          expect(nameInput).toBeVisible();
+        });
+
+        // Fill form fields
+        await userEvent.clear(nameInput);
+        await userEvent.type(nameInput, 'my-environment');
+
+        const urlInput = screen.getByLabelText('Environment URL');
+        await userEvent.clear(urlInput);
+        await userEvent.type(urlInput, inputUrl);
+
+        // Wait for debounce to complete (NameField uses useDebounce)
+        await new Promise((resolve) => {
+          setTimeout(resolve, 500);
+        });
+
+        const submitButton = screen.getByRole('button', {
+          name: /update environment/i,
+        });
+
+        // Wait for Formik to process all changes and enable submit button
+        await waitFor(() => {
+          expect(submitButton).toBeEnabled();
+        });
+
+        await userEvent.click(submitButton);
+        expect(await screen.findByText(/updating environment/i)).toBeVisible();
+
+        // Verify payload
+        await waitFor(() => {
+          expect(requestPayload).toMatchObject({
+            Name: 'my-environment',
+            URL: expectedPayloadUrl,
+          });
+        });
+
+        expect(onSuccess).toHaveBeenCalled();
+      }
+    );
+  });
+});
+
+function renderComponent(
+  environment: Environment,
+  { onSuccess = vi.fn() } = {}
+) {
+  const Wrapped = withUserProvider(
+    withTestRouter(withTestQueryProvider(GeneralEnvironmentForm)),
+    createMockUser({
+      Id: 1,
+      Username: 'admin',
+      Role: 1,
+    })
+  );
+
+  return render(<Wrapped environment={environment} onSuccess={onSuccess} />);
+}
diff --git a/app/react/portainer/environments/ItemView/GeneralEnvironmentForm/GeneralEnvironmentForm.tsx b/app/react/portainer/environments/ItemView/GeneralEnvironmentForm/GeneralEnvironmentForm.tsx
new file mode 100644
index 0000000..4727a7b
--- /dev/null
+++ b/app/react/portainer/environments/ItemView/GeneralEnvironmentForm/GeneralEnvironmentForm.tsx
@@ -0,0 +1,104 @@
+import { Formik, Form, FormikErrors } from 'formik';
+
+import { useUpdateEnvironmentMutation } from '@/react/portainer/environments/queries/useUpdateEnvironmentMutation';
+import { NameField } from '@/react/portainer/environments/common/NameField/NameField';
+import { EnvironmentUrlField } from '@/react/portainer/environments/common/EnvironmentUrlField/EnvironmentUrlField';
+import { PublicUrlField } from '@/react/portainer/environments/common/PublicUrlField/PublicUrlField';
+import { TLSFieldset } from '@/react/components/TLSFieldset';
+import { MetadataFieldset } from '@/react/portainer/environments/common/MetadataFieldset';
+import {
+  isAgentEnvironment,
+  isLocalDockerEnvironment,
+} from '@/react/portainer/environments/utils';
+import {
+  Environment,
+  EnvironmentStatus,
+} from '@/react/portainer/environments/types';
+
+import { FormSection } from '@@/form-components/FormSection';
+import { Widget } from '@@/Widget/Widget';
+import { WidgetBody } from '@@/Widget';
+import { TLSConfig } from '@@/TLSFieldset/types';
+
+import { EnvironmentFormActions } from '../EnvironmentFormActions/EnvironmentFormActions';
+
+import { useGeneralValidation } from './validation';
+import { buildInitialValues, buildUpdatePayload } from './helpers';
+
+interface Props {
+  environment: Environment;
+  onSuccess: () => void;
+}
+
+export function GeneralEnvironmentForm({ environment, onSuccess }: Props) {
+  const updateMutation = useUpdateEnvironmentMutation();
+
+  const isAgent = isAgentEnvironment(environment.Type);
+  const isLocalDocker = isLocalDockerEnvironment(environment.URL);
+  const hasError = environment.Status === EnvironmentStatus.Error;
+  const validationSchema = useGeneralValidation({
+    status: environment.Status,
+    environmentId: environment.Id,
+  });
+
+  return (
+    <Widget>
+      <WidgetBody>
+        <Formik
+          initialValues={buildInitialValues(environment)}
+          validationSchema={validationSchema}
+          onSubmit={(values) => {
+            const payload = buildUpdatePayload({
+              values,
+              environmentType: environment.Type,
+            });
+            updateMutation.mutate(
+              { id: environment.Id, payload },
+              { onSuccess }
+            );
+          }}
+          validateOnMount
+        >
+          {({ values, setFieldValue, errors, isValid, dirty }) => (
+            <Form className="form-horizontal">
+              <FormSection title="Configuration">
+                <NameField />
+
+                {!hasError && (
+                  <>
+                    <EnvironmentUrlField
+                      isAgent={isAgent}
+                      disabled={isLocalDocker}
+                    />
+                    <PublicUrlField />
+                  </>
+                )}
+
+                {!hasError && values.tls && (
+                  <TLSFieldset
+                    values={values.tls}
+                    onChange={(partialValues) => {
+                      setFieldValue('tls', {
+                        ...values.tls,
+                        ...partialValues,
+                      });
+                    }}
+                    errors={errors.tls as FormikErrors<TLSConfig> | undefined}
+                  />
+                )}
+              </FormSection>
+
+              <MetadataFieldset />
+
+              <EnvironmentFormActions
+                isLoading={updateMutation.isLoading}
+                isValid={isValid}
+                isDirty={dirty}
+              />
+            </Form>
+          )}
+        </Formik>
+      </WidgetBody>
+    </Widget>
+  );
+}
diff --git a/app/react/portainer/environments/ItemView/GeneralEnvironmentForm/helpers.test.ts b/app/react/portainer/environments/ItemView/GeneralEnvironmentForm/helpers.test.ts
new file mode 100644
index 0000000..9bedaef
--- /dev/null
+++ b/app/react/portainer/environments/ItemView/GeneralEnvironmentForm/helpers.test.ts
@@ -0,0 +1,216 @@
+import { describe, test, expect } from 'vitest';
+
+import { EnvironmentType } from '@/react/portainer/environments/types';
+import { createMockEnvironment } from '@/react-tools/test-mocks';
+
+import { formatURL, buildInitialValues, buildUpdatePayload } from './helpers';
+
+describe('formatURL', () => {
+  test.each([
+    {
+      description: 'Docker environment with plain URL',
+      url: '10.0.0.1:2375',
+      environmentType: EnvironmentType.Docker,
+      expected: 'tcp://10.0.0.1:2375',
+    },
+    {
+      description: 'Docker environment with tcp:// protocol',
+      url: 'tcp://10.0.0.1:2375',
+      environmentType: EnvironmentType.Docker,
+      expected: 'tcp://10.0.0.1:2375',
+    },
+    {
+      description: 'Docker environment with https:// protocol',
+      url: 'https://docker.example.com:2376',
+      environmentType: EnvironmentType.Docker,
+      expected: 'tcp://docker.example.com:2376',
+    },
+    {
+      description: 'Docker environment with http:// protocol',
+      url: 'http://docker.example.com:2375',
+      environmentType: EnvironmentType.Docker,
+      expected: 'tcp://docker.example.com:2375',
+    },
+    {
+      description: 'Docker environment with unix:// socket',
+      url: 'unix:///var/run/docker.sock',
+      environmentType: EnvironmentType.Docker,
+      expected: 'unix:///var/run/docker.sock',
+    },
+    {
+      description: 'Agent on Docker',
+      url: 'agent-host:9001',
+      environmentType: EnvironmentType.AgentOnDocker,
+      expected: 'tcp://agent-host:9001',
+    },
+    {
+      description: 'Kubernetes Local with https://',
+      url: 'https://k8s.example.com:6443',
+      environmentType: EnvironmentType.KubernetesLocal,
+      expected: 'https://k8s.example.com:6443',
+    },
+    {
+      description: 'Kubernetes Local without protocol',
+      url: 'k8s.example.com:6443',
+      environmentType: EnvironmentType.KubernetesLocal,
+      expected: 'https://k8s.example.com:6443',
+    },
+    {
+      description: 'Agent on Kubernetes no protocol added',
+      url: 'k8s-agent:9001',
+      environmentType: EnvironmentType.AgentOnKubernetes,
+      expected: 'k8s-agent:9001',
+    },
+    {
+      description: 'Edge Agent on Docker',
+      url: 'edge-agent:8000',
+      environmentType: EnvironmentType.EdgeAgentOnDocker,
+      expected: 'tcp://edge-agent:8000',
+    },
+    {
+      description: 'Edge Agent on Kubernetes',
+      url: 'edge-k8s:9001',
+      environmentType: EnvironmentType.EdgeAgentOnKubernetes,
+      expected: 'tcp://edge-k8s:9001',
+    },
+    {
+      description: 'Empty URL',
+      url: '',
+      environmentType: EnvironmentType.Docker,
+      expected: '',
+    },
+  ])('$description', ({ url, environmentType, expected }) => {
+    const result = formatURL({ url, environmentType });
+    expect(result).toBe(expected);
+  });
+});
+
+describe('buildInitialValues', () => {
+  test.each([
+    {
+      description: 'Docker with tcp:// URL',
+      environment: {
+        URL: 'tcp://10.0.0.1:2375',
+        Type: EnvironmentType.Docker,
+        TLSConfig: {
+          TLS: true,
+          TLSSkipVerify: false,
+          TLSCACert: '',
+          TLSCert: '',
+          TLSKey: '',
+        },
+      },
+      expectedUrl: '10.0.0.1:2375',
+      expectedTls: {
+        tls: true,
+        skipVerify: false,
+        caCertFile: undefined,
+        certFile: undefined,
+        keyFile: undefined,
+      },
+    },
+    {
+      description: 'Docker with unix:// socket',
+      environment: {
+        URL: 'unix:///var/run/docker.sock',
+        Type: EnvironmentType.Docker,
+      },
+      expectedUrl: 'unix:///var/run/docker.sock',
+      expectedTls: undefined,
+    },
+    {
+      description: 'Kubernetes without TLS config',
+      environment: {
+        URL: 'https://k8s.example.com:6443',
+        Type: EnvironmentType.AgentOnKubernetes,
+      },
+      expectedUrl: 'k8s.example.com:6443',
+      expectedTls: undefined,
+    },
+    {
+      description: 'Agent on Docker without TLS',
+      environment: {
+        URL: 'tcp://agent:9001',
+        Type: EnvironmentType.AgentOnDocker,
+      },
+      expectedUrl: 'agent:9001',
+      expectedTls: undefined,
+    },
+  ])('$description', ({ environment, expectedUrl, expectedTls }) => {
+    const mockEnv = createMockEnvironment(environment);
+    const result = buildInitialValues(mockEnv);
+
+    expect(result.environmentUrl).toBe(expectedUrl);
+    expect(result.tls).toEqual(expectedTls);
+  });
+});
+
+describe('buildUpdatePayload', () => {
+  test.each([
+    {
+      description: 'Docker environment with plain URL',
+      values: {
+        name: 'my-docker',
+        environmentUrl: '10.0.0.1:2375',
+        publicUrl: '1.2.3.4',
+        meta: { groupId: 1, tagIds: [1, 2] },
+        tls: {
+          tls: true,
+          skipVerify: false,
+          caCertFile: undefined,
+          certFile: undefined,
+          keyFile: undefined,
+        },
+      },
+      environmentType: EnvironmentType.Docker,
+      expectedUrl: 'tcp://10.0.0.1:2375',
+    },
+    {
+      description: 'Kubernetes Local environment',
+      values: {
+        name: 'my-k8s',
+        environmentUrl: 'k8s.local:6443',
+        publicUrl: '',
+        meta: { groupId: 1, tagIds: [] },
+        tls: undefined,
+      },
+      environmentType: EnvironmentType.KubernetesLocal,
+      expectedUrl: 'https://k8s.local:6443',
+    },
+    {
+      description: 'Agent on Kubernetes',
+      values: {
+        name: 'k8s-agent',
+        environmentUrl: 'agent:9001',
+        publicUrl: '',
+        meta: { groupId: 2, tagIds: [] },
+        tls: undefined,
+      },
+      environmentType: EnvironmentType.AgentOnKubernetes,
+      expectedUrl: 'agent:9001',
+    },
+    {
+      description: 'Local Docker (should return the same URL)',
+      values: {
+        name: 'local-docker',
+        environmentUrl: 'unix:///var/run/docker.sock',
+        publicUrl: '',
+        meta: { groupId: 1, tagIds: [] },
+        tls: undefined,
+      },
+      environmentType: EnvironmentType.Docker,
+      expectedUrl: 'unix:///var/run/docker.sock',
+    },
+  ])('$description', ({ values, environmentType, expectedUrl }) => {
+    const payload = buildUpdatePayload({
+      values,
+      environmentType,
+    });
+
+    expect(payload.URL).toBe(expectedUrl);
+    expect(payload.Name).toBe(values.name);
+    expect(payload.PublicURL).toBe(values.publicUrl);
+    expect(payload.GroupID).toBe(values.meta.groupId);
+    expect(payload.TagIDs).toEqual(values.meta.tagIds);
+  });
+});
diff --git a/app/react/portainer/environments/ItemView/GeneralEnvironmentForm/helpers.ts b/app/react/portainer/environments/ItemView/GeneralEnvironmentForm/helpers.ts
new file mode 100644
index 0000000..569e433
--- /dev/null
+++ b/app/react/portainer/environments/ItemView/GeneralEnvironmentForm/helpers.ts
@@ -0,0 +1,90 @@
+import {
+  Environment,
+  EnvironmentType,
+} from '@/react/portainer/environments/types';
+import { UpdateEnvironmentPayload } from '@/react/portainer/environments/queries/useUpdateEnvironmentMutation';
+import { stripProtocol } from '@/react/common/string-utils';
+
+import { isDockerAPIEnvironment, isLocalDockerEnvironment } from '../../utils';
+
+import { GeneralEnvironmentFormValues } from './types';
+
+export function buildInitialValues(
+  environment: Environment
+): GeneralEnvironmentFormValues {
+  const isDockerAPI = isDockerAPIEnvironment(environment);
+  const isLocalDocker = isLocalDockerEnvironment(environment.URL);
+  return {
+    name: environment.Name,
+    environmentUrl: isLocalDocker
+      ? environment.URL
+      : stripProtocol(environment.URL),
+    publicUrl: environment.PublicURL || '',
+
+    meta: {
+      groupId: environment.GroupId,
+      tagIds: environment.TagIds || [],
+    },
+
+    tls: isDockerAPI
+      ? {
+          tls: environment.TLSConfig?.TLS || false,
+          skipVerify: environment.TLSConfig?.TLSSkipVerify || false,
+          caCertFile: undefined,
+          certFile: undefined,
+          keyFile: undefined,
+        }
+      : undefined,
+  };
+}
+
+export function buildUpdatePayload({
+  environmentType,
+  values,
+}: {
+  values: GeneralEnvironmentFormValues;
+  environmentType: EnvironmentType;
+}): Partial<UpdateEnvironmentPayload> {
+  return {
+    Name: values.name,
+    PublicURL: values.publicUrl,
+    GroupID: values.meta.groupId,
+    TagIDs: values.meta.tagIds,
+
+    URL: formatURL({
+      url: values.environmentUrl,
+      environmentType,
+    }),
+
+    TLS: values.tls?.tls,
+    TLSSkipVerify: values.tls?.skipVerify,
+    TLSSkipClientVerify: values.tls?.skipVerify,
+    TLSCACert: values.tls?.caCertFile,
+    TLSCert: values.tls?.certFile,
+    TLSKey: values.tls?.keyFile,
+  };
+}
+
+export function formatURL({
+  environmentType,
+  url,
+}: {
+  url: string;
+  environmentType: EnvironmentType;
+}) {
+  if (!url || isLocalDockerEnvironment(url)) {
+    return url;
+  }
+
+  const stripped = stripProtocol(url);
+
+  if (environmentType === EnvironmentType.KubernetesLocal) {
+    return `https://${stripped}`;
+  }
+
+  if (environmentType === EnvironmentType.AgentOnKubernetes) {
+    return stripped;
+  }
+
+  return `tcp://${stripped}`;
+}
diff --git a/app/react/portainer/environments/ItemView/GeneralEnvironmentForm/types.ts b/app/react/portainer/environments/ItemView/GeneralEnvironmentForm/types.ts
new file mode 100644
index 0000000..d8af0e6
--- /dev/null
+++ b/app/react/portainer/environments/ItemView/GeneralEnvironmentForm/types.ts
@@ -0,0 +1,12 @@
+import { TLSConfig } from '@/react/components/TLSFieldset/types';
+import { EnvironmentMetadata } from '@/react/portainer/environments/environment.service/create';
+
+export interface GeneralEnvironmentFormValues {
+  name: string;
+  environmentUrl: string;
+  publicUrl: string;
+
+  tls?: TLSConfig;
+
+  meta: EnvironmentMetadata;
+}
diff --git a/app/react/portainer/environments/ItemView/GeneralEnvironmentForm/validation.ts b/app/react/portainer/environments/ItemView/GeneralEnvironmentForm/validation.ts
new file mode 100644
index 0000000..5cc83e3
--- /dev/null
+++ b/app/react/portainer/environments/ItemView/GeneralEnvironmentForm/validation.ts
@@ -0,0 +1,33 @@
+import { object, string, SchemaOf } from 'yup';
+
+import { tlsConfigValidation } from '@/react/components/TLSFieldset/TLSFieldset';
+import {
+  EnvironmentId,
+  EnvironmentStatus,
+} from '@/react/portainer/environments/types';
+
+import { useNameValidation } from '../../common/NameField/NameField';
+import { metadataValidation } from '../../common/MetadataFieldset/validation';
+
+import { GeneralEnvironmentFormValues } from './types';
+
+export function useGeneralValidation({
+  status,
+  environmentId,
+}: {
+  status: EnvironmentStatus;
+  environmentId: EnvironmentId;
+}): SchemaOf<GeneralEnvironmentFormValues> {
+  const nameValidation = useNameValidation(environmentId);
+
+  return object({
+    name: nameValidation,
+    environmentUrl:
+      status !== EnvironmentStatus.Error
+        ? string().required('Environment address is required')
+        : string().default(''),
+    publicUrl: string().default(''),
+    tls: tlsConfigValidation({ optionalCert: true }).optional(),
+    meta: metadataValidation(),
+  });
+}
diff --git a/app/react/portainer/environments/ItemView/ItemView.test.tsx b/app/react/portainer/environments/ItemView/ItemView.test.tsx
new file mode 100644
index 0000000..4601923
--- /dev/null
+++ b/app/react/portainer/environments/ItemView/ItemView.test.tsx
@@ -0,0 +1,207 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import { http, HttpResponse } from 'msw';
+
+import { server } from '@/setup-tests/server';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import {
+  Environment,
+  EnvironmentType,
+  EnvironmentStatus,
+} from '@/react/portainer/environments/types';
+import { createMockEnvironment } from '@/react-tools/test-mocks';
+
+import { ItemView } from './ItemView';
+
+// Mock child components
+vi.mock('./EdgeInformationPanel/EdgeInformationPanel', () => ({
+  EdgeInformationPanel: ({
+    environmentId,
+    edgeKey,
+    edgeId,
+    platformName,
+  }: {
+    environmentId: number;
+    edgeKey: string;
+    edgeId: string;
+    platformName: string;
+  }) => (
+    <div data-cy="edge-info-panel">
+      EdgeInformationPanel: {environmentId}, {edgeKey}, {edgeId}, {platformName}
+    </div>
+  ),
+}));
+
+vi.mock('./EdgeAgentDeploymentWidget/EdgeAgentDeploymentWidget', () => ({
+  EdgeAgentDeploymentWidget: ({
+    edgeKey,
+    edgeId,
+    asyncMode,
+  }: {
+    edgeKey: string;
+    edgeId?: string;
+    asyncMode?: boolean;
+  }) => (
+    <div data-cy="edge-agent-deployment">
+      EdgeAgentDeploymentWidget: {edgeKey}, {edgeId}, {asyncMode?.toString()}
+    </div>
+  ),
+}));
+
+vi.mock('./KubeConfigInfo/KubeConfigInfo', () => ({
+  KubeConfigInfo: ({
+    environmentId,
+    environmentType,
+    edgeId,
+    status,
+  }: {
+    environmentId: number;
+    environmentType: EnvironmentType;
+    edgeId?: string;
+    status: EnvironmentStatus;
+  }) => (
+    <div data-cy="kube-config-info">
+      KubeConfigInfo: {environmentId}, {environmentType}, {edgeId}, {status}
+    </div>
+  ),
+}));
+
+vi.mock('./EnvironmentDetailsForm', () => ({
+  EnvironmentDetailsForm: ({ environment }: { environment: Environment }) => (
+    <div data-cy="environment-details-form">
+      EnvironmentDetailsForm: {environment.Name}
+    </div>
+  ),
+}));
+
+// Mock useIdParam hook
+vi.mock('@/react/hooks/useIdParam', () => ({
+  useIdParam: () => 1,
+}));
+
+describe('ItemView', () => {
+  it('should render page header with environment name and breadcrumbs', async () => {
+    const { getByRole } = renderComponent();
+
+    await waitFor(() => {
+      expect(
+        getByRole('heading', { name: 'Environment details' })
+      ).toBeVisible();
+    });
+
+    // Check breadcrumbs are present
+    expect(screen.getByText('Test Environment')).toBeVisible();
+  });
+
+  it('should render EdgeInformationPanel for edge environment with EdgeID', async () => {
+    const environment = createMockEnvironment({
+      Type: EnvironmentType.EdgeAgentOnDocker,
+      EdgeID: 'edge-123',
+      EdgeKey: 'edge-key-123',
+    });
+
+    renderComponentWithEnvironment(environment);
+
+    await waitFor(() => {
+      const edgeInfoPanel = screen.getByTestId('edge-info-panel');
+      expect(edgeInfoPanel).toBeVisible();
+      expect(edgeInfoPanel).toHaveTextContent('edge-key-123');
+      expect(edgeInfoPanel).toHaveTextContent('edge-123');
+    });
+  });
+
+  it('should render EdgeAgentDeploymentWidget for edge environment without EdgeID', async () => {
+    const environment = createMockEnvironment({
+      Type: EnvironmentType.EdgeAgentOnDocker,
+      EdgeID: undefined,
+      EdgeKey: 'edge-key-456',
+      Edge: {
+        AsyncMode: true,
+        PingInterval: 30,
+        SnapshotInterval: 60,
+        CommandInterval: 10,
+      },
+    });
+
+    renderComponentWithEnvironment(environment);
+
+    await waitFor(() => {
+      const deploymentWidget = screen.getByTestId('edge-agent-deployment');
+      expect(deploymentWidget).toBeVisible();
+      expect(deploymentWidget).toHaveTextContent('edge-key-456');
+      expect(deploymentWidget).toHaveTextContent('true'); // AsyncMode
+    });
+  });
+
+  it('should not render edge components for non-edge environment', async () => {
+    const environment = createMockEnvironment({
+      Type: EnvironmentType.Docker,
+    });
+
+    renderComponentWithEnvironment(environment);
+
+    await waitFor(() => {
+      expect(screen.getByTestId('kube-config-info')).toBeVisible();
+    });
+
+    expect(screen.queryByTestId('edge-info-panel')).not.toBeInTheDocument();
+    expect(
+      screen.queryByTestId('edge-agent-deployment')
+    ).not.toBeInTheDocument();
+  });
+
+  it('should render KubeConfigInfo component', async () => {
+    const environment = createMockEnvironment({
+      Type: EnvironmentType.KubernetesLocal,
+      Status: EnvironmentStatus.Up,
+    });
+
+    renderComponentWithEnvironment(environment);
+
+    await waitFor(() => {
+      const kubeConfigInfo = screen.getByTestId('kube-config-info');
+      expect(kubeConfigInfo).toBeVisible();
+      expect(kubeConfigInfo).toHaveTextContent('5'); // EnvironmentType.KubernetesLocal value
+      expect(kubeConfigInfo).toHaveTextContent('1'); // Status: Up
+    });
+  });
+
+  it('should render EnvironmentDetailsForm component', async () => {
+    const { getByTestId } = renderComponent();
+
+    await waitFor(() => {
+      const detailsForm = getByTestId('environment-details-form');
+      expect(detailsForm).toBeVisible();
+      expect(detailsForm).toHaveTextContent('Test Environment');
+    });
+  });
+});
+
+function renderComponent() {
+  const mockEnvironment = createMockEnvironment({
+    Id: 1,
+    Name: 'Test Environment',
+    Type: EnvironmentType.Docker,
+    Status: EnvironmentStatus.Up,
+  });
+  return renderComponentWithEnvironment(mockEnvironment);
+}
+
+function renderComponentWithEnvironment(environment: Environment) {
+  server.use(
+    http.get('/api/endpoints/:id', ({ params }) => {
+      const { id } = params;
+      return HttpResponse.json({
+        ...environment,
+        Id: Number(id),
+      });
+    })
+  );
+
+  const Wrapped = withTestQueryProvider(
+    withUserProvider(withTestRouter(ItemView))
+  );
+
+  return render(<Wrapped />);
+}
diff --git a/app/react/portainer/environments/ItemView/ItemView.tsx b/app/react/portainer/environments/ItemView/ItemView.tsx
new file mode 100644
index 0000000..798e5e7
--- /dev/null
+++ b/app/react/portainer/environments/ItemView/ItemView.tsx
@@ -0,0 +1,65 @@
+import { useIdParam } from '@/react/hooks/useIdParam';
+
+import { PageHeader } from '@@/PageHeader';
+
+import { useEnvironment } from '../queries';
+import { getPlatformTypeName, isEdgeEnvironment } from '../utils';
+
+import { EdgeInformationPanel } from './EdgeInformationPanel/EdgeInformationPanel';
+import { EdgeAgentDeploymentWidget } from './EdgeAgentDeploymentWidget/EdgeAgentDeploymentWidget';
+import { KubeConfigInfo } from './KubeConfigInfo/KubeConfigInfo';
+import { EnvironmentDetailsForm } from './EnvironmentDetailsForm';
+
+export function ItemView() {
+  const id = useIdParam();
+  const environmentQuery = useEnvironment(id);
+
+  if (!environmentQuery.data) {
+    return null;
+  }
+
+  const environment = environmentQuery.data;
+
+  const isEdge = isEdgeEnvironment(environment.Type);
+  const platformName = getPlatformTypeName(environment.Type);
+
+  return (
+    <>
+      <PageHeader
+        title="Environment details"
+        breadcrumbs={[
+          { label: 'Environments', link: 'portainer.endpoints' },
+          environment.Name,
+        ]}
+        reload
+      />
+
+      <div className="mx-4 space-y-4 [&>*]:block">
+        {isEdge &&
+          (environment.EdgeID ? (
+            <EdgeInformationPanel
+              environmentId={id}
+              edgeKey={environment.EdgeKey}
+              edgeId={environment.EdgeID}
+              platformName={platformName}
+            />
+          ) : (
+            <EdgeAgentDeploymentWidget
+              edgeKey={environment.EdgeKey}
+              edgeId={environment.EdgeID}
+              asyncMode={environment.Edge?.AsyncMode}
+            />
+          ))}
+
+        <KubeConfigInfo
+          environmentId={id}
+          environmentType={environment.Type}
+          edgeId={environment.EdgeID}
+          status={environment.Status}
+        />
+
+        <EnvironmentDetailsForm environment={environment} />
+      </div>
+    </>
+  );
+}
diff --git a/app/react/portainer/environments/ItemView/KubeConfigInfo/KubeConfigInfo.test.tsx b/app/react/portainer/environments/ItemView/KubeConfigInfo/KubeConfigInfo.test.tsx
new file mode 100644
index 0000000..35dfd96
--- /dev/null
+++ b/app/react/portainer/environments/ItemView/KubeConfigInfo/KubeConfigInfo.test.tsx
@@ -0,0 +1,132 @@
+import { render, screen } from '@testing-library/react';
+
+import {
+  EnvironmentType,
+  EnvironmentStatus,
+} from '@/react/portainer/environments/types';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+
+import { KubeConfigInfo } from './KubeConfigInfo';
+
+function renderPanel(
+  environmentType: EnvironmentType,
+  status: EnvironmentStatus = EnvironmentStatus.Up,
+  edgeId?: string
+) {
+  const Wrapped = withTestRouter(KubeConfigInfo);
+  return render(
+    <Wrapped
+      environmentId={1}
+      environmentType={environmentType}
+      status={status}
+      edgeId={edgeId}
+    />
+  );
+}
+
+describe('KubeConfigInfo', () => {
+  describe('Visibility', () => {
+    it('should display for KubernetesLocal environment', () => {
+      renderPanel(EnvironmentType.KubernetesLocal);
+
+      expect(
+        screen.getByText('Kubernetes features configuration')
+      ).toBeVisible();
+      expect(screen.getByText('Kubernetes configuration')).toBeVisible();
+    });
+
+    it('should display for AgentOnKubernetes environment', () => {
+      renderPanel(EnvironmentType.AgentOnKubernetes);
+
+      expect(
+        screen.getByText('Kubernetes features configuration')
+      ).toBeVisible();
+    });
+
+    it('should display for EdgeAgentOnKubernetes with EdgeID', () => {
+      renderPanel(
+        EnvironmentType.EdgeAgentOnKubernetes,
+        EnvironmentStatus.Up,
+        'edge-123'
+      );
+
+      expect(
+        screen.getByText('Kubernetes features configuration')
+      ).toBeVisible();
+    });
+
+    it('should not display for EdgeAgentOnKubernetes without EdgeID', () => {
+      renderPanel(EnvironmentType.EdgeAgentOnKubernetes);
+
+      expect(
+        screen.queryByText('Kubernetes features configuration')
+      ).not.toBeInTheDocument();
+    });
+
+    it('should not display when status is Down', () => {
+      renderPanel(EnvironmentType.KubernetesLocal, EnvironmentStatus.Down);
+
+      expect(
+        screen.queryByText('Kubernetes features configuration')
+      ).not.toBeInTheDocument();
+    });
+
+    it('should not display for Docker environment', () => {
+      renderPanel(EnvironmentType.Docker);
+
+      expect(
+        screen.queryByText('Kubernetes features configuration')
+      ).not.toBeInTheDocument();
+    });
+
+    it('should not display for Azure environment', () => {
+      renderPanel(EnvironmentType.Azure);
+
+      expect(
+        screen.queryByText('Kubernetes features configuration')
+      ).not.toBeInTheDocument();
+    });
+  });
+
+  describe('Content', () => {
+    it('should display wrench icon', () => {
+      const { container } = renderPanel(EnvironmentType.KubernetesLocal);
+
+      const icon = container.querySelector('svg');
+      expect(icon).toBeInTheDocument();
+    });
+
+    it('should display correct title', () => {
+      renderPanel(EnvironmentType.KubernetesLocal);
+
+      expect(
+        screen.getByText('Kubernetes features configuration')
+      ).toBeVisible();
+    });
+
+    it('should display correct message text', () => {
+      renderPanel(EnvironmentType.KubernetesLocal);
+
+      expect(
+        screen.getByText(/You should configure the features available/i)
+      ).toBeVisible();
+    });
+
+    it('should display link with correct text', () => {
+      renderPanel(EnvironmentType.KubernetesLocal);
+
+      const link = screen.getByTestId('kubernetes-config-link');
+      expect(link).toBeVisible();
+      expect(link).toHaveTextContent('Kubernetes configuration');
+    });
+
+    it('should have link element', () => {
+      renderPanel(EnvironmentType.KubernetesLocal);
+
+      const link = screen.getByTestId('kubernetes-config-link');
+
+      // Link component renders an anchor tag
+      expect(link.tagName).toBe('A');
+    });
+  });
+});
diff --git a/app/react/portainer/environments/ItemView/KubeConfigInfo/KubeConfigInfo.tsx b/app/react/portainer/environments/ItemView/KubeConfigInfo/KubeConfigInfo.tsx
new file mode 100644
index 0000000..f728e69
--- /dev/null
+++ b/app/react/portainer/environments/ItemView/KubeConfigInfo/KubeConfigInfo.tsx
@@ -0,0 +1,61 @@
+import { Wrench } from 'lucide-react';
+
+import {
+  EnvironmentId,
+  EnvironmentType,
+  EnvironmentStatus,
+} from '@/react/portainer/environments/types';
+import {
+  isKubernetesEnvironment,
+  isEdgeEnvironment,
+} from '@/react/portainer/environments/utils';
+import { InformationPanel } from '@/react/components/InformationPanel';
+import { Link } from '@/react/components/Link';
+import { Icon } from '@/react/components/Icon';
+
+interface Props {
+  environmentId?: EnvironmentId;
+  environmentType?: EnvironmentType;
+  edgeId?: string;
+  status: EnvironmentStatus;
+}
+
+export function KubeConfigInfo({
+  environmentId,
+  environmentType,
+  edgeId,
+  status,
+}: Props) {
+  if (!environmentType) {
+    return null;
+  }
+
+  const isVisible =
+    isKubernetesEnvironment(environmentType) &&
+    (!isEdgeEnvironment(environmentType) || !!edgeId) &&
+    status !== EnvironmentStatus.Down;
+
+  if (!isVisible) {
+    return null;
+  }
+
+  return (
+    <InformationPanel title="Kubernetes features configuration">
+      <span className="small text-muted vertical-center">
+        <Icon icon={Wrench} mode="primary" />
+        <div>
+          You should configure the features available in this Kubernetes
+          environment in the{' '}
+          <Link
+            to="kubernetes.cluster.setup"
+            params={{ endpointId: environmentId }}
+            data-cy="kubernetes-config-link"
+          >
+            Kubernetes configuration
+          </Link>{' '}
+          view.
+        </div>
+      </span>
+    </InformationPanel>
+  );
+}
diff --git a/app/react/portainer/environments/ItemView/tls-options.tsx b/app/react/portainer/environments/ItemView/tls-options.tsx
new file mode 100644
index 0000000..5b6ea16
--- /dev/null
+++ b/app/react/portainer/environments/ItemView/tls-options.tsx
@@ -0,0 +1,38 @@
+import { Shield } from 'lucide-react';
+
+import { BoxSelectorOption } from '@@/BoxSelector';
+
+export const tlsOptions: ReadonlyArray<BoxSelectorOption<string>> = [
+  {
+    id: 'tls_client_ca',
+    value: 'tls_client_ca',
+    icon: Shield,
+    iconType: 'badge',
+    label: 'TLS with server and client verification',
+    description: 'Use client certificates and server verification',
+  },
+  {
+    id: 'tls_client_noca',
+    value: 'tls_client_noca',
+    icon: Shield,
+    iconType: 'badge',
+    label: 'TLS with client verification only',
+    description: 'Use client certificates without server verification',
+  },
+  {
+    id: 'tls_ca',
+    value: 'tls_ca',
+    icon: Shield,
+    iconType: 'badge',
+    label: 'TLS with server verification only',
+    description: 'Only verify the server certificate',
+  },
+  {
+    id: 'tls_only',
+    value: 'tls_only',
+    icon: Shield,
+    iconType: 'badge',
+    label: 'TLS only',
+    description: 'No server/client verification',
+  },
+] as const;
diff --git a/app/react/portainer/environments/ListView/EnvironmentsDatatable.tsx b/app/react/portainer/environments/ListView/EnvironmentsDatatable.tsx
new file mode 100644
index 0000000..ea459b2
--- /dev/null
+++ b/app/react/portainer/environments/ListView/EnvironmentsDatatable.tsx
@@ -0,0 +1,107 @@
+import { HardDrive, Trash2 } from 'lucide-react';
+import { useState } from 'react';
+
+import { useEnvironmentList } from '@/react/portainer/environments/queries';
+import { useGroups } from '@/react/portainer/environments/environment-groups/queries';
+
+import { Datatable } from '@@/datatables';
+import { createPersistedStore } from '@@/datatables/types';
+import { AddButton, Button } from '@@/buttons';
+import { useTableState } from '@@/datatables/useTableState';
+
+import { isBE } from '../../feature-flags/feature-flags.service';
+import { isSortType } from '../queries/useEnvironmentList';
+import { EnvironmentStatus } from '../types';
+
+import { columns } from './columns';
+import { EnvironmentListItem } from './types';
+
+const tableKey = 'environments';
+const settingsStore = createPersistedStore(tableKey, 'Name');
+
+export function EnvironmentsDatatable({
+  onRemove,
+}: {
+  onRemove: (environments: Array<EnvironmentListItem>) => void;
+}) {
+  const tableState = useTableState(settingsStore, tableKey);
+
+  const [page, setPage] = useState(0);
+
+  const groupsQuery = useGroups();
+  const { environments, isLoading, totalCount } = useEnvironmentList(
+    {
+      search: tableState.search,
+      excludeSnapshots: true,
+      page: page + 1,
+      pageLimit: tableState.pageSize,
+      sort: isSortType(tableState.sortBy?.id)
+        ? tableState.sortBy?.id
+        : undefined,
+      order: tableState.sortBy?.desc ? 'desc' : 'asc',
+    },
+    { enabled: groupsQuery.isSuccess, refetchInterval: 30 * 1000 }
+  );
+
+  const environmentsWithGroups = environments.map<EnvironmentListItem>(
+    (env) => {
+      const groupId = env.GroupId;
+      const group = groupsQuery.data?.find((g) => g.Id === groupId);
+      return {
+        ...env,
+        GroupName: group?.Name,
+      };
+    }
+  );
+
+  return (
+    <Datatable
+      title="Environments"
+      titleIcon={HardDrive}
+      dataset={environmentsWithGroups}
+      columns={columns}
+      settingsManager={tableState}
+      isServerSidePagination
+      page={page}
+      onPageChange={setPage}
+      totalCount={totalCount}
+      isLoading={isLoading}
+      isRowSelectable={(row) =>
+        row.original.Status !== EnvironmentStatus.Provisioning
+      }
+      renderTableActions={(selectedRows) => (
+        <div className="flex items-center gap-2">
+          <Button
+            color="dangerlight"
+            disabled={selectedRows.length === 0}
+            onClick={() => onRemove(selectedRows)}
+            icon={Trash2}
+            className="!m-0"
+            data-cy="remove-environments-button"
+          >
+            Remove
+          </Button>
+
+          {isBE && (
+            <AddButton
+              color="secondary"
+              data-cy="environments-auto-onboarding-button"
+              to="portainer.endpoints.edgeAutoCreateScript"
+            >
+              Auto onboarding
+            </AddButton>
+          )}
+
+          <AddButton
+            to="portainer.wizard.endpoints"
+            params={{ referrer: 'environments' }}
+            data-cy="environments-add-environments-button"
+          >
+            Add environment
+          </AddButton>
+        </div>
+      )}
+      data-cy="environments-datatable"
+    />
+  );
+}
diff --git a/app/react/portainer/environments/ListView/ListView.tsx b/app/react/portainer/environments/ListView/ListView.tsx
new file mode 100644
index 0000000..633ff15
--- /dev/null
+++ b/app/react/portainer/environments/ListView/ListView.tsx
@@ -0,0 +1,61 @@
+import { useStore } from 'zustand';
+
+import { notifySuccess } from '@/portainer/services/notifications';
+import { environmentStore } from '@/react/hooks/current-environment-store';
+
+import { PageHeader } from '@@/PageHeader';
+import { confirmDelete } from '@@/modals/confirm';
+
+import { Environment } from '../types';
+
+import { EnvironmentsDatatable } from './EnvironmentsDatatable';
+import { useDeleteEnvironmentsMutation } from './useDeleteEnvironmentsMutation';
+
+export function ListView() {
+  const constCurrentEnvironmentStore = useStore(environmentStore);
+  const deletionMutation = useDeleteEnvironmentsMutation();
+
+  return (
+    <>
+      <PageHeader
+        title="Environments"
+        breadcrumbs="Environment management"
+        reload
+      />
+
+      <EnvironmentsDatatable onRemove={handleRemove} />
+    </>
+  );
+
+  async function handleRemove(environmentsToDelete: Array<Environment>) {
+    const confirmed = await confirmDelete(
+      'This action will remove all configurations associated to your environment(s). Continue?'
+    );
+
+    if (!confirmed) {
+      return;
+    }
+
+    const id = constCurrentEnvironmentStore.environmentId;
+    // If the current endpoint was deleted, then clean endpoint store
+    if (environmentsToDelete.some((e) => e.Id === id)) {
+      constCurrentEnvironmentStore.clear();
+    }
+
+    deletionMutation.mutate(
+      environmentsToDelete.map((e) => ({
+        id: e.Id,
+        deleteCluster: false,
+        name: e.Name,
+      })),
+      {
+        onSuccess() {
+          notifySuccess(
+            'Environments successfully removed',
+            environmentsToDelete.map((e) => e.Name).join(', ')
+          );
+        },
+      }
+    );
+  }
+}
diff --git a/app/react/portainer/environments/ListView/columns/actions.tsx b/app/react/portainer/environments/ListView/columns/actions.tsx
new file mode 100644
index 0000000..9e40f62
--- /dev/null
+++ b/app/react/portainer/environments/ListView/columns/actions.tsx
@@ -0,0 +1,42 @@
+import { CellContext } from '@tanstack/react-table';
+import { Users } from 'lucide-react';
+
+import { EnvironmentStatus } from '@/react/portainer/environments/types';
+
+import { Button } from '@@/buttons';
+import { Link } from '@@/Link';
+
+import { EnvironmentListItem } from '../types';
+
+import { columnHelper } from './helper';
+
+export const actions = columnHelper.display({
+  header: 'Actions',
+  cell: Cell,
+});
+
+function Cell({
+  row: { original: environment },
+}: CellContext<EnvironmentListItem, unknown>) {
+  if (
+    environment.Status === EnvironmentStatus.Provisioning ||
+    environment.Status === EnvironmentStatus.Error
+  ) {
+    return <>-</>;
+  }
+
+  return (
+    <Button
+      as={Link}
+      props={{
+        to: 'portainer.endpoints.endpoint.access',
+        params: { id: environment.Id },
+      }}
+      color="link"
+      icon={Users}
+      data-cy={`environment-manage-access-button-${environment.Name}`}
+    >
+      Manage access
+    </Button>
+  );
+}
diff --git a/app/react/portainer/environments/ListView/columns/helper.ts b/app/react/portainer/environments/ListView/columns/helper.ts
new file mode 100644
index 0000000..3d35eef
--- /dev/null
+++ b/app/react/portainer/environments/ListView/columns/helper.ts
@@ -0,0 +1,5 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { EnvironmentListItem } from '../types';
+
+export const columnHelper = createColumnHelper<EnvironmentListItem>();
diff --git a/app/react/portainer/environments/ListView/columns/index.ts b/app/react/portainer/environments/ListView/columns/index.ts
new file mode 100644
index 0000000..7a68d22
--- /dev/null
+++ b/app/react/portainer/environments/ListView/columns/index.ts
@@ -0,0 +1,15 @@
+import { actions } from './actions';
+import { columnHelper } from './helper';
+import { name } from './name';
+import { type } from './type';
+import { url } from './url';
+
+export const columns = [
+  name,
+  type,
+  url,
+  columnHelper.accessor('GroupName', {
+    header: 'Group Name',
+  }),
+  actions,
+];
diff --git a/app/react/portainer/environments/ListView/columns/name.tsx b/app/react/portainer/environments/ListView/columns/name.tsx
new file mode 100644
index 0000000..dd2dce8
--- /dev/null
+++ b/app/react/portainer/environments/ListView/columns/name.tsx
@@ -0,0 +1,25 @@
+import { EnvironmentStatus } from '@/react/portainer/environments/types';
+
+import { Link } from '@@/Link';
+
+import { columnHelper } from './helper';
+
+export const name = columnHelper.accessor('Name', {
+  header: 'Name',
+  cell: ({ getValue, row: { original: environment } }) => {
+    const name = getValue();
+    if (environment.Status === EnvironmentStatus.Provisioning) {
+      return name;
+    }
+
+    return (
+      <Link
+        to="portainer.endpoints.endpoint"
+        params={{ id: environment.Id }}
+        data-cy={`environment-link-${environment.Id}`}
+      >
+        {name}
+      </Link>
+    );
+  },
+});
diff --git a/app/react/portainer/environments/ListView/columns/type.tsx b/app/react/portainer/environments/ListView/columns/type.tsx
new file mode 100644
index 0000000..58d9843
--- /dev/null
+++ b/app/react/portainer/environments/ListView/columns/type.tsx
@@ -0,0 +1,41 @@
+import { CellContext } from '@tanstack/react-table';
+
+import {
+  getEnvironmentTypeIcon,
+  getPlatformTypeName,
+} from '@/react/portainer/environments/utils';
+
+import { Icon } from '@@/Icon';
+
+import { EnvironmentListItem } from '../types';
+import { EnvironmentType, ContainerEngine } from '../../types';
+
+import { columnHelper } from './helper';
+
+type TypeCellContext = {
+  type: EnvironmentType;
+  containerEngine?: ContainerEngine;
+};
+
+export const type = columnHelper.accessor(
+  (rowItem): TypeCellContext => ({
+    type: rowItem.Type,
+    containerEngine: rowItem.ContainerEngine,
+  }),
+  {
+    header: 'Type',
+    cell: Cell,
+    id: 'Type',
+  }
+);
+
+function Cell({ getValue }: CellContext<EnvironmentListItem, TypeCellContext>) {
+  const { type, containerEngine } = getValue();
+
+  return (
+    <span className="flex items-center gap-1">
+      <Icon icon={getEnvironmentTypeIcon(type, containerEngine)} />
+      {getPlatformTypeName(type, containerEngine)}
+    </span>
+  );
+}
diff --git a/app/react/portainer/environments/ListView/columns/url.tsx b/app/react/portainer/environments/ListView/columns/url.tsx
new file mode 100644
index 0000000..57105a3
--- /dev/null
+++ b/app/react/portainer/environments/ListView/columns/url.tsx
@@ -0,0 +1,111 @@
+import { CellContext } from '@tanstack/react-table';
+import { AlertCircle, HelpCircle, Loader2 } from 'lucide-react';
+
+import {
+  EnvironmentStatus,
+  EnvironmentStatusMessage,
+  EnvironmentType,
+} from '@/react/portainer/environments/types';
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { TooltipWithChildren } from '@@/Tip/TooltipWithChildren';
+import { Button } from '@@/buttons';
+import { Icon } from '@@/Icon';
+import { Tooltip } from '@@/Tip/Tooltip';
+
+import { EnvironmentListItem } from '../types';
+import { useUpdateEnvironmentMutation } from '../../queries/useUpdateEnvironmentMutation';
+
+import { columnHelper } from './helper';
+
+export const url = columnHelper.accessor('URL', {
+  header: 'URL',
+  cell: Cell,
+});
+
+function Cell({
+  row: { original: environment },
+}: CellContext<EnvironmentListItem, string>) {
+  const mutation = useUpdateEnvironmentMutation();
+
+  if (
+    environment.Type !== EnvironmentType.EdgeAgentOnDocker &&
+    environment.Status !== EnvironmentStatus.Provisioning
+  ) {
+    return (
+      <>
+        {environment.URL}
+        {environment.StatusMessage?.summary &&
+          environment.StatusMessage?.detail && (
+            <div className="ml-2 inline-block">
+              <span className="text-danger vertical-center inline-flex">
+                <AlertCircle className="lucide" aria-hidden="true" />
+                <span>{environment.StatusMessage.summary}</span>
+              </span>
+              <TooltipWithChildren
+                message={
+                  <div>
+                    {environment.StatusMessage.detail}
+                    {environment.URL && (
+                      <div className="mt-2 text-right">
+                        <Button
+                          color="link"
+                          data-cy={`dismiss-error-${environment.Id}`}
+                          className="small !ml-0 p-0"
+                          onClick={handleDismissButton}
+                        >
+                          <span className="text-muted-light">
+                            Dismiss error (still visible in logs)
+                          </span>
+                        </Button>
+                      </div>
+                    )}
+                  </div>
+                }
+                position="bottom"
+              >
+                <span className="vertical-center inline-flex text-base">
+                  <HelpCircle className="lucide ml-1" aria-hidden="true" />
+                </span>
+              </TooltipWithChildren>
+            </div>
+          )}
+      </>
+    );
+  }
+
+  if (environment.Type === EnvironmentType.EdgeAgentOnDocker) {
+    return <>-</>;
+  }
+
+  if (environment.Status === EnvironmentStatus.Provisioning) {
+    return (
+      <div className="inline-flex items-center text-base">
+        <Icon icon={Loader2} className="!mr-1 animate-spin-slow" />
+        {environment.StatusMessage?.summary}
+        {environment.StatusMessage?.detail && (
+          <Tooltip message={environment.StatusMessage?.detail} />
+        )}
+      </div>
+    );
+  }
+
+  return <>-</>;
+
+  function handleDismissButton() {
+    mutation.mutate(
+      {
+        id: environment.Id,
+        payload: {
+          IsSetStatusMessage: true,
+          StatusMessage: {} as EnvironmentStatusMessage,
+        },
+      },
+      {
+        onSuccess: () => {
+          notifySuccess('Success', 'Error dismissed successfully');
+        },
+      }
+    );
+  }
+}
diff --git a/app/react/portainer/environments/ListView/index.ts b/app/react/portainer/environments/ListView/index.ts
new file mode 100644
index 0000000..dd06dfd
--- /dev/null
+++ b/app/react/portainer/environments/ListView/index.ts
@@ -0,0 +1 @@
+export { ListView } from './ListView';
diff --git a/app/react/portainer/environments/ListView/types.ts b/app/react/portainer/environments/ListView/types.ts
new file mode 100644
index 0000000..e0d7dfa
--- /dev/null
+++ b/app/react/portainer/environments/ListView/types.ts
@@ -0,0 +1,5 @@
+import { Environment } from '@/react/portainer/environments/types';
+
+export type EnvironmentListItem = {
+  GroupName?: string;
+} & Environment;
diff --git a/app/react/portainer/environments/ListView/useDeleteEnvironmentsMutation.ts b/app/react/portainer/environments/ListView/useDeleteEnvironmentsMutation.ts
new file mode 100644
index 0000000..1ce491d
--- /dev/null
+++ b/app/react/portainer/environments/ListView/useDeleteEnvironmentsMutation.ts
@@ -0,0 +1,68 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+import { notifyError, notifySuccess } from '@/portainer/services/notifications';
+import { pluralize } from '@/portainer/helpers/strings';
+
+import { buildUrl } from '../environment.service/utils';
+import { EnvironmentId } from '../types';
+
+export function useDeleteEnvironmentsMutation() {
+  const queryClient = useQueryClient();
+  return useMutation(
+    async (
+      environments: {
+        id: EnvironmentId;
+        name: string;
+        deleteCluster?: boolean;
+      }[]
+    ) => {
+      const resp = await deleteEnvironments(environments);
+
+      if (resp === null) {
+        return { deleted: environments, errors: [] };
+      }
+
+      return {
+        deleted: environments.filter((e) =>
+          (resp.deleted || []).includes(e.id)
+        ),
+        errors: environments.filter((e) => (resp.errors || []).includes(e.id)),
+      };
+    },
+    {
+      ...withError('Unable to delete environment(s)'),
+      onSuccess: ({ deleted, errors }) => {
+        queryClient.invalidateQueries(['environments']);
+        // show an error message for each env that failed to delete
+        errors.forEach((e) => {
+          notifyError(`Failed to remove environment ${e.name}`, undefined);
+        });
+        // show one summary message for all successful deletes
+        if (deleted.length) {
+          notifySuccess(
+            `${pluralize(deleted.length, 'Environment')} successfully removed`,
+            deleted.map((d) => d.name).join(', ')
+          );
+        }
+      },
+    }
+  );
+}
+
+async function deleteEnvironments(
+  environments: { id: EnvironmentId; deleteCluster?: boolean }[]
+) {
+  try {
+    const { data } = await axios.post<{
+      deleted: EnvironmentId[];
+      errors: EnvironmentId[];
+    } | null>(buildUrl(undefined, 'delete'), {
+      endpoints: environments,
+    });
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e as Error, 'Unable to delete environment');
+  }
+}
diff --git a/app/react/portainer/environments/TagsView/TagsDatatable.tsx b/app/react/portainer/environments/TagsView/TagsDatatable.tsx
new file mode 100644
index 0000000..95f631a
--- /dev/null
+++ b/app/react/portainer/environments/TagsView/TagsDatatable.tsx
@@ -0,0 +1,51 @@
+import { TagIcon } from 'lucide-react';
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { Tag } from '@/portainer/tags/types';
+
+import { Datatable } from '@@/datatables';
+import { createPersistedStore } from '@@/datatables/types';
+import { useTableState } from '@@/datatables/useTableState';
+import { DeleteButton } from '@@/buttons/DeleteButton';
+
+const columnHelper = createColumnHelper<Tag>();
+
+const columns = [
+  columnHelper.accessor('Name', {
+    header: 'Name',
+  }),
+];
+
+const tableKey = 'tags-table';
+
+const store = createPersistedStore(tableKey);
+
+export function TagsDatatable({
+  dataset,
+  onRemove,
+}: {
+  dataset: Array<Tag> | undefined;
+  onRemove: (selectedItems: Array<Tag>) => void;
+}) {
+  const tableState = useTableState(store, tableKey);
+
+  return (
+    <Datatable
+      title="Tags"
+      titleIcon={TagIcon}
+      dataset={dataset || []}
+      columns={columns}
+      isLoading={!dataset}
+      settingsManager={tableState}
+      renderTableActions={(selectedItems) => (
+        <DeleteButton
+          disabled={selectedItems.length === 0}
+          confirmMessage="Are you sure you want to remove the selected tag(s)?"
+          onConfirmed={() => onRemove(selectedItems)}
+          data-cy="remove-tag-button"
+        />
+      )}
+      data-cy="tags-datatable"
+    />
+  );
+}
diff --git a/app/react/portainer/environments/common/EdgeIntervalsFieldset/EdgeIntervalsFieldset.test.tsx b/app/react/portainer/environments/common/EdgeIntervalsFieldset/EdgeIntervalsFieldset.test.tsx
new file mode 100644
index 0000000..ba36b27
--- /dev/null
+++ b/app/react/portainer/environments/common/EdgeIntervalsFieldset/EdgeIntervalsFieldset.test.tsx
@@ -0,0 +1,238 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { HttpResponse } from 'msw';
+import { ComponentProps } from 'react';
+
+import { server, http } from '@/setup-tests/server';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+
+import { EdgeIntervalsFieldset } from './EdgeIntervalsFieldset';
+import { getDefaultEdgeIntervalsValues } from './types';
+
+describe('EdgeIntervalsFieldset', () => {
+  beforeEach(() => {
+    // Mock settings endpoint for useIntervalOptions hook
+    server.use(
+      http.get('/api/settings', () =>
+        HttpResponse.json({
+          Edge: {
+            PingInterval: 60,
+            SnapshotInterval: 300,
+            CommandInterval: 60,
+          },
+          EdgeAgentCheckinInterval: 5,
+        })
+      )
+    );
+  });
+
+  describe('sync mode', () => {
+    it('should render poll frequency field in sync mode', async () => {
+      renderComponent({ asyncMode: false });
+
+      await waitFor(() => {
+        expect(screen.getByText('Poll frequency')).toBeVisible();
+      });
+
+      expect(
+        screen.getByRole('combobox', { name: /poll frequency/i })
+      ).toBeVisible();
+    });
+
+    it('should call onChange with updated checkinInterval when changed', async () => {
+      const onChange = vi.fn();
+      const initialValue = getDefaultEdgeIntervalsValues();
+
+      renderComponent({
+        asyncMode: false,
+        value: initialValue,
+        onChange,
+      });
+
+      await waitFor(() => {
+        expect(
+          screen.getByRole('combobox', { name: /poll frequency/i })
+        ).toBeVisible();
+      });
+
+      const select = screen.getByRole('combobox', { name: /poll frequency/i });
+      await userEvent.selectOptions(select, '5');
+
+      expect(onChange).toHaveBeenCalledWith({
+        ...initialValue,
+        checkinInterval: 5,
+      });
+    });
+
+    it('should not render async interval fields in sync mode', async () => {
+      renderComponent({ asyncMode: false });
+
+      await waitFor(() => {
+        expect(screen.getByText('Poll frequency')).toBeVisible();
+      });
+
+      expect(screen.queryByText('Ping interval')).not.toBeInTheDocument();
+      expect(screen.queryByText('Snapshot interval')).not.toBeInTheDocument();
+      expect(screen.queryByText('Command interval')).not.toBeInTheDocument();
+    });
+  });
+
+  describe('async mode', () => {
+    it('should render async interval fields in async mode', async () => {
+      renderComponent({ asyncMode: true });
+
+      await waitFor(() => {
+        expect(screen.getByText('Ping interval')).toBeVisible();
+      });
+
+      expect(screen.getByText('Snapshot interval')).toBeVisible();
+      expect(screen.getByText('Command interval')).toBeVisible();
+    });
+
+    it('should call onChange with updated pingInterval when changed', async () => {
+      const onChange = vi.fn();
+      const initialValue = getDefaultEdgeIntervalsValues();
+
+      renderComponent({
+        asyncMode: true,
+        value: initialValue,
+        onChange,
+      });
+
+      await waitFor(() => {
+        expect(screen.getByText('Ping interval')).toBeVisible();
+      });
+
+      const select = screen.getByRole('combobox', { name: /ping interval/i });
+      await userEvent.selectOptions(select, '60');
+
+      expect(onChange).toHaveBeenCalledWith({
+        ...initialValue,
+        pingInterval: 60,
+      });
+    });
+
+    it('should call onChange with updated snapshotInterval when changed', async () => {
+      const onChange = vi.fn();
+      const initialValue = getDefaultEdgeIntervalsValues();
+
+      renderComponent({
+        asyncMode: true,
+        value: initialValue,
+        onChange,
+      });
+
+      await waitFor(() => {
+        expect(screen.getByText('Snapshot interval')).toBeVisible();
+      });
+
+      const select = screen.getByRole('combobox', {
+        name: /snapshot interval/i,
+      });
+      await userEvent.selectOptions(select, '3600');
+
+      expect(onChange).toHaveBeenCalledWith({
+        ...initialValue,
+        snapshotInterval: 3600,
+      });
+    });
+
+    it('should call onChange with updated commandInterval when changed', async () => {
+      const onChange = vi.fn();
+      const initialValue = getDefaultEdgeIntervalsValues();
+
+      renderComponent({
+        asyncMode: true,
+        value: initialValue,
+        onChange,
+      });
+
+      await waitFor(() => {
+        expect(screen.getByText('Command interval')).toBeVisible();
+      });
+
+      const select = screen.getByRole('combobox', {
+        name: /command interval/i,
+      });
+      await userEvent.selectOptions(select, '3600');
+
+      expect(onChange).toHaveBeenCalledWith({
+        ...initialValue,
+        commandInterval: 3600,
+      });
+    });
+
+    it('should not render poll frequency field in async mode', async () => {
+      renderComponent({ asyncMode: true });
+
+      await waitFor(() => {
+        expect(screen.getByText('Ping interval')).toBeVisible();
+      });
+
+      expect(screen.queryByText('Poll frequency')).not.toBeInTheDocument();
+    });
+  });
+
+  describe('readonly mode', () => {
+    it('should disable fields when readonly is true in sync mode', async () => {
+      renderComponent({ asyncMode: false, readonly: true });
+
+      await waitFor(() => {
+        expect(
+          screen.getByRole('combobox', { name: /poll frequency/i })
+        ).toBeDisabled();
+      });
+    });
+
+    it('should disable fields when readonly is true in async mode', async () => {
+      renderComponent({ asyncMode: true, readonly: true });
+
+      await waitFor(() => {
+        expect(
+          screen.getByRole('combobox', { name: /ping interval/i })
+        ).toBeDisabled();
+      });
+
+      expect(
+        screen.getByRole('combobox', { name: /snapshot interval/i })
+      ).toBeDisabled();
+      expect(
+        screen.getByRole('combobox', { name: /command interval/i })
+      ).toBeDisabled();
+    });
+  });
+
+  describe('custom title', () => {
+    it('should render with custom title', async () => {
+      renderComponent({ asyncMode: false, title: 'Custom Title' });
+
+      await waitFor(() => {
+        expect(screen.getByText('Custom Title')).toBeVisible();
+      });
+    });
+
+    it('should render with default title when not specified', async () => {
+      renderComponent({ asyncMode: false });
+
+      await waitFor(() => {
+        expect(screen.getByText('Check-in Intervals')).toBeVisible();
+      });
+    });
+  });
+});
+
+function renderComponent(
+  props: Partial<ComponentProps<typeof EdgeIntervalsFieldset>> = {}
+) {
+  const defaultProps: ComponentProps<typeof EdgeIntervalsFieldset> = {
+    value: getDefaultEdgeIntervalsValues(),
+    onChange: vi.fn(),
+    asyncMode: false,
+    ...props,
+  };
+
+  const Wrapped = withTestQueryProvider(EdgeIntervalsFieldset);
+
+  return render(<Wrapped {...defaultProps} />);
+}
diff --git a/app/react/portainer/environments/common/EdgeIntervalsFieldset/EdgeIntervalsFieldset.tsx b/app/react/portainer/environments/common/EdgeIntervalsFieldset/EdgeIntervalsFieldset.tsx
new file mode 100644
index 0000000..dbee53e
--- /dev/null
+++ b/app/react/portainer/environments/common/EdgeIntervalsFieldset/EdgeIntervalsFieldset.tsx
@@ -0,0 +1,60 @@
+import { EdgeCheckinIntervalField } from '@/react/edge/components/EdgeCheckInIntervalField';
+import { EdgeAsyncIntervalsForm } from '@/react/edge/components/EdgeAsyncIntervalsForm';
+
+import { FormSection } from '@@/form-components/FormSection';
+
+import {
+  EdgeIntervalsValues,
+  toAsyncIntervalsValues,
+  fromAsyncIntervalsValues,
+} from './types';
+
+interface Props {
+  /** Current interval values */
+  value: EdgeIntervalsValues;
+  /** Callback when intervals change */
+  onChange: (value: EdgeIntervalsValues) => void;
+  /** Whether the agent is in async mode (determines which interval fields to show) */
+  asyncMode: boolean;
+  /** Whether fields should be read-only */
+  readonly?: boolean;
+  /** Optional custom section title */
+  title?: string;
+}
+
+/**
+ * EdgeIntervalsFieldset displays the appropriate check-in interval fields
+ * based on whether the Edge agent is in sync or async mode.
+ *
+ * - Sync mode: Shows a single poll frequency selector (EdgeCheckinIntervalField)
+ * - Async mode: Shows ping, snapshot, and command interval selectors (EdgeAsyncIntervalsForm)
+ */
+export function EdgeIntervalsFieldset({
+  value,
+  onChange,
+  asyncMode,
+  readonly = false,
+  title = 'Check-in Intervals',
+}: Props) {
+  return (
+    <FormSection title={title}>
+      {asyncMode ? (
+        <EdgeAsyncIntervalsForm
+          values={toAsyncIntervalsValues(value)}
+          readonly={readonly}
+          onChange={(asyncValues) => {
+            onChange(fromAsyncIntervalsValues(value, asyncValues));
+          }}
+        />
+      ) : (
+        <EdgeCheckinIntervalField
+          value={value.checkinInterval}
+          readonly={readonly}
+          onChange={(checkinInterval) =>
+            onChange({ ...value, checkinInterval })
+          }
+        />
+      )}
+    </FormSection>
+  );
+}
diff --git a/app/react/portainer/environments/common/EdgeIntervalsFieldset/types.ts b/app/react/portainer/environments/common/EdgeIntervalsFieldset/types.ts
new file mode 100644
index 0000000..ae54c09
--- /dev/null
+++ b/app/react/portainer/environments/common/EdgeIntervalsFieldset/types.ts
@@ -0,0 +1,59 @@
+import {
+  EdgeAsyncIntervalsValues,
+  EDGE_ASYNC_INTERVAL_USE_DEFAULT,
+} from '@/react/edge/components/EdgeAsyncIntervalsForm';
+
+/**
+ * Internal form values for edge check-in intervals.
+ * Uses lowerCamelCase for consistency with Formik/frontend conventions.
+ */
+export interface EdgeIntervalsValues {
+  /** Sync mode check-in interval (maps to EdgeCheckinInterval in API) */
+  checkinInterval: number;
+  /** Async mode ping interval */
+  pingInterval: number;
+  /** Async mode snapshot interval */
+  snapshotInterval: number;
+  /** Async mode command interval */
+  commandInterval: number;
+}
+
+/**
+ * Default values for edge intervals form
+ */
+export function getDefaultEdgeIntervalsValues(): EdgeIntervalsValues {
+  return {
+    checkinInterval: 0, // Use default
+    pingInterval: EDGE_ASYNC_INTERVAL_USE_DEFAULT,
+    snapshotInterval: EDGE_ASYNC_INTERVAL_USE_DEFAULT,
+    commandInterval: EDGE_ASYNC_INTERVAL_USE_DEFAULT,
+  };
+}
+
+/**
+ * Convert EdgeIntervalsValues to EdgeAsyncIntervalsValues (PascalCase for existing component)
+ */
+export function toAsyncIntervalsValues(
+  values: EdgeIntervalsValues
+): EdgeAsyncIntervalsValues {
+  return {
+    PingInterval: values.pingInterval,
+    SnapshotInterval: values.snapshotInterval,
+    CommandInterval: values.commandInterval,
+  };
+}
+
+/**
+ * Convert EdgeAsyncIntervalsValues (PascalCase) back to EdgeIntervalsValues
+ */
+export function fromAsyncIntervalsValues(
+  values: EdgeIntervalsValues,
+  asyncValues: EdgeAsyncIntervalsValues
+): EdgeIntervalsValues {
+  return {
+    ...values,
+    pingInterval: asyncValues.PingInterval,
+    snapshotInterval: asyncValues.SnapshotInterval,
+    commandInterval: asyncValues.CommandInterval,
+  };
+}
diff --git a/app/react/portainer/environments/common/EdgeIntervalsFieldset/validation.ts b/app/react/portainer/environments/common/EdgeIntervalsFieldset/validation.ts
new file mode 100644
index 0000000..51647cc
--- /dev/null
+++ b/app/react/portainer/environments/common/EdgeIntervalsFieldset/validation.ts
@@ -0,0 +1,45 @@
+import { number, object, SchemaOf } from 'yup';
+
+import {
+  options as asyncOptions,
+  edgeAsyncIntervalsValidation,
+} from '@/react/edge/components/EdgeAsyncIntervalsForm';
+import { checkinIntervalOptions } from '@/react/edge/components/EdgeCheckInIntervalField';
+
+import {
+  EdgeIntervalsValues,
+  toAsyncIntervalsValues,
+  fromAsyncIntervalsValues,
+} from './types';
+
+const checkinIntervalValues = checkinIntervalOptions.map(
+  (option) => option.value
+);
+const asyncIntervalValues = asyncOptions.map((option) => option.value);
+
+/**
+ * Validation schema for edge intervals.
+ * Validates both sync and async mode intervals.
+ */
+export function edgeIntervalsValidation(): SchemaOf<EdgeIntervalsValues> {
+  return object({
+    checkinInterval: number()
+      .required('Check-in interval is required')
+      .oneOf(checkinIntervalValues, 'Invalid check-in interval'),
+    pingInterval: number()
+      .required('Ping interval is required')
+      .oneOf(asyncIntervalValues, 'Invalid ping interval'),
+    snapshotInterval: number()
+      .required('Snapshot interval is required')
+      .oneOf(asyncIntervalValues, 'Invalid snapshot interval'),
+    commandInterval: number()
+      .required('Command interval is required')
+      .oneOf(asyncIntervalValues, 'Invalid command interval'),
+  });
+}
+
+// Re-export conversion helpers for use with validation
+export { toAsyncIntervalsValues, fromAsyncIntervalsValues };
+
+// Re-export async intervals validation for wizard form compatibility
+export { edgeAsyncIntervalsValidation };
diff --git a/app/react/portainer/environments/common/EnvironmentUrlField/EnvironmentUrlField.tsx b/app/react/portainer/environments/common/EnvironmentUrlField/EnvironmentUrlField.tsx
new file mode 100644
index 0000000..fad051f
--- /dev/null
+++ b/app/react/portainer/environments/common/EnvironmentUrlField/EnvironmentUrlField.tsx
@@ -0,0 +1,41 @@
+import { Field, useField } from 'formik';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+
+export function EnvironmentUrlField({
+  placeholderPort = '9001',
+  isAgent,
+  disabled,
+  optional,
+}: {
+  placeholderPort?: string;
+  isAgent?: boolean;
+  disabled?: boolean;
+  optional?: boolean;
+}) {
+  const [, meta] = useField('environmentUrl');
+
+  return (
+    <FormControl
+      label={isAgent ? 'Environment address' : 'Environment URL'}
+      errors={meta.error}
+      required={optional}
+      inputId="environment-url-field"
+      tooltip={
+        isAgent
+          ? 'The address for the Portainer agent in the format <HOST>:<PORT> or <IP>:<PORT>'
+          : 'URL or IP address of a Docker host. The Docker API must be exposed over a TCP port. Please refer to the Docker documentation to configure it.'
+      }
+    >
+      <Field
+        id="environment-url-field"
+        name="environmentUrl"
+        as={Input}
+        placeholder={`e.g. 10.0.0.10:${placeholderPort} or tasks.portainer_agent:${placeholderPort}`}
+        data-cy="endpointCreate-endpointUrlAgentInput"
+        disabled={disabled}
+      />
+    </FormControl>
+  );
+}
diff --git a/app/react/portainer/environments/common/MetadataFieldset/GroupsField.tsx b/app/react/portainer/environments/common/MetadataFieldset/GroupsField.tsx
new file mode 100644
index 0000000..ac455fb
--- /dev/null
+++ b/app/react/portainer/environments/common/MetadataFieldset/GroupsField.tsx
@@ -0,0 +1,37 @@
+import { useField } from 'formik';
+
+import { useGroups } from '@/react/portainer/environments/environment-groups/queries';
+import { EnvironmentGroupId } from '@/react/portainer/environments/types';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { Select } from '@@/form-components/Input';
+
+export function GroupField({ name = 'meta.groupId' }: { name?: string }) {
+  const [fieldProps, metaProps, helpers] = useField<EnvironmentGroupId>(name);
+
+  const groupsQuery = useGroups();
+  if (!groupsQuery.data) {
+    return null;
+  }
+
+  const options = groupsQuery.data.map((group) => ({
+    value: group.Id,
+    label: group.Name,
+  }));
+
+  return (
+    <FormControl label="Group" errors={metaProps.error}>
+      <Select
+        name={name}
+        data-cy="environment-group-select"
+        options={options}
+        value={fieldProps.value}
+        onChange={(e) => handleChange(e.target.value)}
+      />
+    </FormControl>
+  );
+
+  function handleChange(value: string) {
+    helpers.setValue(value ? parseInt(value, 10) : 1);
+  }
+}
diff --git a/app/react/portainer/environments/common/MetadataFieldset/MetadataFieldset.tsx b/app/react/portainer/environments/common/MetadataFieldset/MetadataFieldset.tsx
new file mode 100644
index 0000000..63dd293
--- /dev/null
+++ b/app/react/portainer/environments/common/MetadataFieldset/MetadataFieldset.tsx
@@ -0,0 +1,29 @@
+import { useField } from 'formik';
+import { PropsWithChildren } from 'react';
+
+import { useCurrentUser } from '@/react/hooks/useUser';
+
+import { TagSelector } from '@@/TagSelector';
+import { FormSection } from '@@/form-components/FormSection';
+
+import { GroupField } from './GroupsField';
+
+export function MetadataFieldset({ children }: PropsWithChildren<unknown>) {
+  const [tagProps, , tagHelpers] = useField('meta.tagIds');
+
+  const { isPureAdmin } = useCurrentUser();
+
+  return (
+    <FormSection title="Metadata">
+      {children}
+
+      <GroupField />
+
+      <TagSelector
+        value={tagProps.value}
+        allowCreate={isPureAdmin}
+        onChange={(value) => tagHelpers.setValue(value)}
+      />
+    </FormSection>
+  );
+}
diff --git a/app/react/portainer/environments/common/MetadataFieldset/index.ts b/app/react/portainer/environments/common/MetadataFieldset/index.ts
new file mode 100644
index 0000000..8093037
--- /dev/null
+++ b/app/react/portainer/environments/common/MetadataFieldset/index.ts
@@ -0,0 +1 @@
+export { MetadataFieldset } from './MetadataFieldset';
diff --git a/app/react/portainer/environments/common/MetadataFieldset/validation.ts b/app/react/portainer/environments/common/MetadataFieldset/validation.ts
new file mode 100644
index 0000000..f119c13
--- /dev/null
+++ b/app/react/portainer/environments/common/MetadataFieldset/validation.ts
@@ -0,0 +1,10 @@
+import { object, number, array, SchemaOf } from 'yup';
+
+import { EnvironmentMetadata } from '@/react/portainer/environments/environment.service/create';
+
+export function metadataValidation(): SchemaOf<EnvironmentMetadata> {
+  return object({
+    groupId: number(),
+    tagIds: array().of(number()).default([]),
+  });
+}
diff --git a/app/react/portainer/environments/common/NameField/NameField.tsx b/app/react/portainer/environments/common/NameField/NameField.tsx
new file mode 100644
index 0000000..68f76f0
--- /dev/null
+++ b/app/react/portainer/environments/common/NameField/NameField.tsx
@@ -0,0 +1,77 @@
+import { useField } from 'formik';
+import { string } from 'yup';
+
+import { getEnvironments } from '@/react/portainer/environments/environment.service';
+import { useDebounce } from '@/react/hooks/useDebounce';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+import { useCachedValidation } from '@@/form-components/useCachedTest';
+
+interface Props {
+  readonly?: boolean;
+  tooltip?: string;
+  placeholder?: string;
+}
+
+export function NameField({
+  readonly,
+  tooltip,
+  placeholder = 'e.g. docker-prod01 / kubernetes-cluster01',
+}: Props) {
+  const [{ value }, meta, { setValue }] = useField('name');
+
+  const id = 'name-input';
+
+  const [debouncedValue, setDebouncedValue] = useDebounce(value, setValue);
+
+  return (
+    <FormControl
+      label="Name"
+      required
+      errors={meta.error}
+      inputId={id}
+      tooltip={tooltip}
+    >
+      <Input
+        id={id}
+        data-cy="environmentCreate-nameInput"
+        name="name"
+        onChange={(e) => setDebouncedValue(e.target.value)}
+        value={debouncedValue}
+        placeholder={placeholder}
+        readOnly={readonly}
+      />
+    </FormControl>
+  );
+}
+
+export async function isNameUnique(name = '', envId?: number) {
+  if (!name) {
+    return true;
+  }
+
+  try {
+    const result = await getEnvironments({
+      limit: 1,
+      query: { name, excludeSnapshots: true },
+    });
+    return (
+      result.totalCount === 0 ||
+      result.value.every((e) => e.Name !== name || e.Id === envId)
+    );
+  } catch (e) {
+    // if backend fails to respond, assume name is unique, name validation happens also in the backend
+    return true;
+  }
+}
+
+export function useNameValidation(envId?: number) {
+  const uniquenessTest = useCachedValidation((name: string | undefined) =>
+    isNameUnique(name || '', envId)
+  );
+
+  return string()
+    .required('Name is required')
+    .test('unique-name', 'Name should be unique', uniquenessTest);
+}
diff --git a/app/react/portainer/environments/common/PublicUrlField/PublicUrlField.test.tsx b/app/react/portainer/environments/common/PublicUrlField/PublicUrlField.test.tsx
new file mode 100644
index 0000000..05725e6
--- /dev/null
+++ b/app/react/portainer/environments/common/PublicUrlField/PublicUrlField.test.tsx
@@ -0,0 +1,67 @@
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { Form, Formik } from 'formik';
+import { describe, expect, it } from 'vitest';
+
+import { PublicUrlField } from './PublicUrlField';
+
+describe('PublicUrlField', () => {
+  it('should render the public URL field', () => {
+    renderComponent();
+
+    const input = screen.getByLabelText('Public IP');
+    expect(input).toBeVisible();
+  });
+
+  it('should display placeholder text', () => {
+    renderComponent();
+
+    const input = screen.getByPlaceholderText(
+      'e.g. 10.0.0.10 or mydocker.mydomain.com'
+    );
+    expect(input).toBeVisible();
+  });
+
+  it('should update value on user input', async () => {
+    const { publicUrl } = renderComponent();
+
+    const input = screen.getByLabelText('Public IP');
+    await userEvent.clear(input);
+    await userEvent.type(input, '10.0.0.10');
+
+    expect(publicUrl()).toBe('10.0.0.10');
+  });
+
+  it('should display error message when field has error', () => {
+    renderComponent({ initialErrors: { publicUrl: 'Invalid URL' } });
+
+    expect(screen.getByText('Invalid URL')).toBeVisible();
+  });
+});
+
+function renderComponent(options?: { initialErrors?: { publicUrl?: string } }) {
+  const initialValues = { publicUrl: '' };
+  let formValues = initialValues;
+
+  const result = render(
+    <Formik
+      initialValues={initialValues}
+      initialErrors={options?.initialErrors}
+      onSubmit={() => {}}
+    >
+      {({ values }) => {
+        formValues = values;
+        return (
+          <Form>
+            <PublicUrlField />
+          </Form>
+        );
+      }}
+    </Formik>
+  );
+
+  return {
+    ...result,
+    publicUrl: () => formValues.publicUrl,
+  };
+}
diff --git a/app/react/portainer/environments/common/PublicUrlField/PublicUrlField.tsx b/app/react/portainer/environments/common/PublicUrlField/PublicUrlField.tsx
new file mode 100644
index 0000000..203de5f
--- /dev/null
+++ b/app/react/portainer/environments/common/PublicUrlField/PublicUrlField.tsx
@@ -0,0 +1,25 @@
+import { Field, useField } from 'formik';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+
+export function PublicUrlField() {
+  const [, meta] = useField('publicUrl');
+
+  return (
+    <FormControl
+      label="Public IP"
+      inputId="public-url-field"
+      errors={meta.error}
+      tooltip="URL or IP address where exposed containers will be reachable. This field is optional and will default to the environment URL."
+    >
+      <Field
+        id="public-url-field"
+        name="publicUrl"
+        as={Input}
+        placeholder="e.g. 10.0.0.10 or mydocker.mydomain.com"
+        data-cy="public-url-input"
+      />
+    </FormControl>
+  );
+}
diff --git a/app/react/portainer/environments/common/TimeWindowPicker/TimePickerInput.tsx b/app/react/portainer/environments/common/TimeWindowPicker/TimePickerInput.tsx
new file mode 100644
index 0000000..44d8a8e
--- /dev/null
+++ b/app/react/portainer/environments/common/TimeWindowPicker/TimePickerInput.tsx
@@ -0,0 +1,116 @@
+import { ChevronUp, ChevronDown } from 'lucide-react';
+import moment from 'moment';
+
+import { Button } from '@@/buttons';
+import { Input } from '@@/form-components/Input';
+
+import { utcToTimeZone } from './utils';
+
+const valueFormat = 'HH:mm';
+const displayFormat = 'hh:mm';
+const minuteIncrement = 5;
+
+type Props = {
+  utcTime: string;
+  onChange: (time: string) => void;
+  timeZone?: string;
+};
+
+export function TimePickerInput({
+  utcTime,
+  onChange,
+  timeZone = 'UTC',
+}: Props) {
+  const localTime12h = utcToTimeZone(utcTime, timeZone, displayFormat);
+  const localTime24h = utcToTimeZone(utcTime, timeZone, valueFormat);
+  const [hours, minutes] = localTime12h.split(':');
+
+  return (
+    <div className="flex items-center">
+      <div className="flex flex-col">
+        <Button
+          color="link"
+          data-cy="env-time-picker-hours-up-button"
+          size="medium"
+          className="!ml-0 w-full"
+          icon={ChevronUp}
+          onClick={() => {
+            const newTime = moment(localTime24h, valueFormat)
+              .add(1, 'hours')
+              .format(valueFormat);
+            onChange(newTime);
+          }}
+        />
+        <Input
+          type="text"
+          data-cy="time-picker-hours-input"
+          value={hours}
+          className="w-12 !cursor-default text-center"
+          disabled
+        />
+        <Button
+          color="link"
+          data-cy="env-time-picker-hours-down-button"
+          size="medium"
+          className="!ml-0 w-full"
+          icon={ChevronDown}
+          onClick={() => {
+            const newTime = moment(localTime24h, valueFormat)
+              .subtract(1, 'hours')
+              .format(valueFormat);
+            onChange(newTime);
+          }}
+        />
+      </div>
+      :
+      <div className="flex flex-col">
+        <Button
+          color="link"
+          data-cy="env-time-picker-minutes-up-button"
+          size="medium"
+          className="!ml-0 w-full"
+          icon={ChevronUp}
+          onClick={() => {
+            const newTime = moment(localTime24h, valueFormat)
+              .add(minuteIncrement, 'minutes')
+              .format(valueFormat);
+            onChange(newTime);
+          }}
+        />
+        <Input
+          type="text"
+          data-cy="time-picker-minutes-input"
+          value={minutes}
+          className="w-12 !cursor-default text-center"
+          disabled
+        />
+        <Button
+          color="link"
+          data-cy="env-time-picker-minutes-down-button"
+          size="medium"
+          className="!ml-0 w-full"
+          icon={ChevronDown}
+          onClick={() => {
+            const newTime = moment(localTime24h, valueFormat)
+              .subtract(minuteIncrement, 'minutes')
+              .format(valueFormat);
+            onChange(newTime);
+          }}
+        />
+      </div>
+      <Button
+        color="default"
+        data-cy="env-time-picker-ampm-button"
+        className="h-[34px]"
+        onClick={() => {
+          const newTime = moment(localTime24h, valueFormat)
+            .add(12, 'hours')
+            .format(valueFormat);
+          onChange(newTime);
+        }}
+      >
+        {moment(localTime24h, valueFormat).format('A')}
+      </Button>
+    </div>
+  );
+}
diff --git a/app/react/portainer/environments/common/TimeWindowPicker/TimeWindowPicker.tsx b/app/react/portainer/environments/common/TimeWindowPicker/TimeWindowPicker.tsx
new file mode 100644
index 0000000..5e3b1aa
--- /dev/null
+++ b/app/react/portainer/environments/common/TimeWindowPicker/TimeWindowPicker.tsx
@@ -0,0 +1,100 @@
+import moment from 'moment';
+import { FormikErrors } from 'formik';
+
+import { Button } from '@@/buttons';
+import { Alert } from '@@/Alert';
+
+import { EndpointChangeWindow } from '../../types';
+
+import { TimeWindowPickerInputGroup } from './TimeWindowPickerInputGroup';
+import { formatUTCTime, utcToTimeZone } from './utils';
+
+type Props = {
+  /**
+   * The current start and end time values. in 'HH:mm' format (e.g. '00:00') and in UTC timezone.
+   */
+  values: EndpointChangeWindow;
+  errors?: FormikErrors<EndpointChangeWindow>;
+  initialValues: EndpointChangeWindow;
+  onChangeTimeZone: (timeZone: string) => void;
+  onChangeChangeWindow: (changeWindow: EndpointChangeWindow) => void;
+  isEditMode: boolean;
+  setIsEditMode: (isEditMode: boolean) => void;
+  timeZone?: string;
+  initialTimeZone?: string;
+};
+
+const summaryTimeFormat = 'h:mmA';
+
+export function TimeWindowPicker({
+  values,
+  errors,
+  initialValues,
+  onChangeTimeZone,
+  onChangeChangeWindow,
+  isEditMode,
+  setIsEditMode,
+  timeZone = moment.tz.guess(),
+  initialTimeZone,
+}: Props) {
+  return (
+    <div className="mb-4 flex flex-col gap-y-2">
+      {isEditMode && (
+        <TimeWindowPickerInputGroup
+          values={values}
+          onChangeTimeZone={onChangeTimeZone}
+          onChangeChangeWindow={onChangeChangeWindow}
+          timeZone={timeZone}
+          errors={errors}
+        />
+      )}
+      <Alert color="info" className="[&>div]:!text-xs">
+        <span>
+          GitOps updates to stacks or applications outside{' '}
+          <span className="font-bold">{`${formatUTCTime(
+            values.StartTime,
+            summaryTimeFormat
+          )} - ${formatUTCTime(
+            values.EndTime,
+            summaryTimeFormat
+          )} UTC (${utcToTimeZone(
+            values.StartTime,
+            timeZone,
+            summaryTimeFormat
+          )} - ${utcToTimeZone(values.EndTime, timeZone, summaryTimeFormat)} ${
+            moment().isDST() ? ' DST' : ''
+          } ${timeZone})`}</span>{' '}
+          will not occur.
+        </span>
+      </Alert>
+      {values.Enabled && (
+        <div className="flex w-full">
+          {!isEditMode && (
+            <Button
+              color="default"
+              data-cy="edit-change-window-button"
+              className="!ml-0"
+              onClick={() => setIsEditMode(true)}
+            >
+              Edit Change Window
+            </Button>
+          )}
+          {isEditMode && (
+            <Button
+              color="default"
+              data-cy="cancel-change-window-button"
+              className="!ml-0"
+              onClick={() => {
+                setIsEditMode(false);
+                onChangeChangeWindow(initialValues);
+                onChangeTimeZone(initialTimeZone || moment.tz.guess());
+              }}
+            >
+              Cancel
+            </Button>
+          )}
+        </div>
+      )}
+    </div>
+  );
+}
diff --git a/app/react/portainer/environments/common/TimeWindowPicker/TimeWindowPickerInputGroup.tsx b/app/react/portainer/environments/common/TimeWindowPicker/TimeWindowPickerInputGroup.tsx
new file mode 100644
index 0000000..291ea40
--- /dev/null
+++ b/app/react/portainer/environments/common/TimeWindowPicker/TimeWindowPickerInputGroup.tsx
@@ -0,0 +1,132 @@
+import moment from 'moment';
+import { useMemo } from 'react';
+import { FormikErrors } from 'formik';
+
+import { Select } from '@@/form-components/ReactSelect';
+import { Option } from '@@/form-components/PortainerSelect';
+import { FormError } from '@@/form-components/FormError';
+
+import { EndpointChangeWindow } from '../../types';
+
+import { timeZoneToUtc, utcToTimeZone } from './utils';
+import { TimePickerInput } from './TimePickerInput';
+
+type Props = {
+  /**
+   * The current start and end time values. in 'HH:mm' format (e.g. '00:00') and in UTC timezone.
+   */
+  values: EndpointChangeWindow;
+  errors?: FormikErrors<EndpointChangeWindow>;
+  onChangeTimeZone: (timeZone: string) => void;
+  onChangeChangeWindow: (changeWindow: EndpointChangeWindow) => void;
+  timeZone?: string;
+};
+
+export function TimeWindowPickerInputGroup({
+  values,
+  errors,
+  onChangeTimeZone,
+  onChangeChangeWindow,
+  timeZone = moment.tz.guess(),
+}: Props) {
+  // all unique timezones for all countries as options
+  const timeZoneOptions = useMemo(() => {
+    const countries = moment.tz.countries();
+    const zones = countries.flatMap((country) =>
+      moment.tz.zonesForCountry(country)
+    );
+    return [...new Set(zones)]
+      .sort()
+      .concat('UTC')
+      .map((zone) => ({
+        label: zone,
+        value: zone,
+      }));
+  }, []);
+
+  // set the initial timezone to the user's timezone if it is not set
+  if (!timeZone) {
+    const newTimeZone = moment.tz.guess();
+    onChangeChangeWindow({
+      ...values,
+      StartTime: timeZoneToUtc(values.StartTime, newTimeZone),
+      EndTime: timeZoneToUtc(values.EndTime, newTimeZone),
+    });
+    onChangeTimeZone(newTimeZone);
+  }
+
+  // find the option index for react-select to scroll to the current option
+  const timeZoneOptionIndex = useMemo(
+    () => timeZoneOptions.findIndex((option) => option.value === timeZone),
+    [timeZone, timeZoneOptions]
+  );
+
+  return (
+    <div className="flex-col">
+      <div className="flex flex-wrap items-center gap-x-5">
+        <div className="inline-flex flex-wrap items-center gap-x-5">
+          <TimePickerInput
+            utcTime={values.StartTime}
+            timeZone={timeZone}
+            onChange={(time) =>
+              onChangeChangeWindow({
+                ...values,
+                StartTime: timeZoneToUtc(time, timeZone),
+              })
+            }
+          />
+          to
+          <TimePickerInput
+            utcTime={values.EndTime}
+            timeZone={timeZone}
+            onChange={(time) =>
+              onChangeChangeWindow({
+                ...values,
+                EndTime: timeZoneToUtc(time, timeZone),
+              })
+            }
+          />
+        </div>
+        <Select<Option<string>>
+          options={timeZoneOptions}
+          value={timeZoneOptions[timeZoneOptionIndex]}
+          className="min-w-fit max-w-xs flex-1 basis-[fit-content]"
+          onChange={(newTimeZone) => {
+            if (!newTimeZone) return;
+            // update the utc time so that the local time displayed remains the same
+            const updatedStartTime = onTimezoneChangeUpdateUTCTime(
+              values.StartTime,
+              timeZone,
+              newTimeZone.value
+            );
+            const updatedEndTime = onTimezoneChangeUpdateUTCTime(
+              values.EndTime,
+              timeZone,
+              newTimeZone.value
+            );
+            onChangeChangeWindow({
+              ...values,
+              StartTime: updatedStartTime,
+              EndTime: updatedEndTime,
+            });
+            onChangeTimeZone(newTimeZone.value);
+          }}
+          data-cy="time-window-picker-timezone-select"
+          id="time-window-picker-timezone-select"
+        />
+      </div>
+      {errors?.StartTime && <FormError>{errors.StartTime}</FormError>}
+      {errors?.EndTime && <FormError>{errors.EndTime}</FormError>}
+    </div>
+  );
+}
+
+function onTimezoneChangeUpdateUTCTime(
+  utcTime: string,
+  oldTimeZone: string,
+  newTimeZone: string
+) {
+  const localTime = utcToTimeZone(utcTime, oldTimeZone);
+  const newUtcTime = timeZoneToUtc(localTime, newTimeZone);
+  return newUtcTime;
+}
diff --git a/app/react/portainer/environments/common/TimeWindowPicker/index.ts b/app/react/portainer/environments/common/TimeWindowPicker/index.ts
new file mode 100644
index 0000000..c61d736
--- /dev/null
+++ b/app/react/portainer/environments/common/TimeWindowPicker/index.ts
@@ -0,0 +1 @@
+export { TimeWindowPicker } from './TimeWindowPicker';
diff --git a/app/react/portainer/environments/common/TimeWindowPicker/utils.ts b/app/react/portainer/environments/common/TimeWindowPicker/utils.ts
new file mode 100644
index 0000000..4560b74
--- /dev/null
+++ b/app/react/portainer/environments/common/TimeWindowPicker/utils.ts
@@ -0,0 +1,36 @@
+import moment from 'moment';
+
+/**
+ * Converts a UTC time to the same format in the given timezone.
+ * @param utcTime The UTC time to convert in 'HH:mm' format.
+ * @param timeZone The timezone to convert the UTC time to.
+ * @param format The format to convert the time to.
+ * @returns The converted time in the same format as the input.
+ */
+export function utcToTimeZone(
+  utcTime: string,
+  timeZone: string,
+  format = 'HH:mm'
+) {
+  return moment.utc(utcTime, 'HH:mm').tz(timeZone).format(format);
+}
+
+/**
+ * Converts a time in the given timezone to the same format in UTC.
+ * @param time The time to convert in 'HH:mm' format.
+ * @param timeZone The timezone to convert the time to UTC.
+ * @returns The converted time in the same format as the input.
+ */
+export function timeZoneToUtc(time: string, timeZone: string) {
+  return moment.tz(time, 'HH:mm', timeZone).utc().format('HH:mm');
+}
+
+/**
+ * Formats a UTC time string to the specified format.
+ * @param utcTime - The UTC time string to format in 'HH:mm' format.
+ * @param format - The format to use. Defaults to 'HH:mm'.
+ * @returns The formatted time string.
+ */
+export function formatUTCTime(utcTime: string, format = 'HH:mm') {
+  return moment.utc(utcTime, 'HH:mm').format(format);
+}
diff --git a/app/react/portainer/environments/environment-groups/AccessView/.keep b/app/react/portainer/environments/environment-groups/AccessView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/portainer/environments/environment-groups/CreateView/CreateGroupView.test.tsx b/app/react/portainer/environments/environment-groups/CreateView/CreateGroupView.test.tsx
new file mode 100644
index 0000000..4c5760b
--- /dev/null
+++ b/app/react/portainer/environments/environment-groups/CreateView/CreateGroupView.test.tsx
@@ -0,0 +1,387 @@
+import { render, screen, waitFor, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { vi } from 'vitest';
+import { http, HttpResponse, DefaultBodyType } from 'msw';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { server } from '@/setup-tests/server';
+import { createMockEnvironment } from '@/react-tools/test-mocks';
+
+import { CreateGroupView } from './CreateGroupView';
+
+vi.mock('@/react/hooks/useCanExit', () => ({
+  useCanExit: vi.fn(),
+}));
+
+vi.mock('@/portainer/services/notifications', () => ({
+  notifyError: vi.fn(),
+  notifySuccess: vi.fn(),
+}));
+
+function renderCreateGroupView({
+  onMutationError,
+  availableEnvironments = [] as ReturnType<typeof createMockEnvironment>[],
+}: {
+  onMutationError?(): void;
+  availableEnvironments?: ReturnType<typeof createMockEnvironment>[];
+} = {}) {
+  // Set up default mocks
+  server.use(
+    http.get('/api/tags', () =>
+      HttpResponse.json([
+        { ID: 1, Name: 'production' },
+        { ID: 2, Name: 'staging' },
+      ])
+    ),
+    http.get('/api/endpoints', ({ request }) => {
+      const url = new URL(request.url);
+      const groupIds = [
+        ...url.searchParams.getAll('groupIds'),
+        ...url.searchParams.getAll('groupIds[]'),
+      ];
+      if (groupIds.includes('1') && availableEnvironments.length > 0) {
+        return HttpResponse.json(availableEnvironments, {
+          headers: {
+            'x-total-count': String(availableEnvironments.length),
+            'x-total-available': String(availableEnvironments.length),
+          },
+        });
+      }
+      return HttpResponse.json([], {
+        headers: { 'x-total-count': '0', 'x-total-available': '0' },
+      });
+    })
+  );
+
+  const Wrapped = withTestQueryProvider(
+    withTestRouter(withUserProvider(CreateGroupView)),
+    { onMutationError }
+  );
+
+  return render(<Wrapped />);
+}
+
+describe('CreateGroupView', () => {
+  describe('Page rendering', () => {
+    it('should render the page header with correct title', async () => {
+      renderCreateGroupView();
+
+      // Use heading role to get the h1 title specifically (not the breadcrumb)
+      expect(
+        await screen.findByRole('heading', { name: /Create group/i })
+      ).toBeVisible();
+    });
+
+    it('should render breadcrumbs with link to Groups', async () => {
+      renderCreateGroupView();
+
+      // Use the data-cy attribute to find the breadcrumb link
+      expect(await screen.findByTestId('breadcrumb-Groups')).toBeVisible();
+    });
+
+    it('should render the form', async () => {
+      renderCreateGroupView();
+
+      expect(await screen.findByLabelText(/Name/i)).toBeVisible();
+      expect(screen.getByLabelText(/Description/i)).toBeVisible();
+    });
+
+    it('should render the Create button', async () => {
+      renderCreateGroupView();
+
+      expect(
+        await screen.findByRole('button', { name: /Create/i })
+      ).toBeVisible();
+    });
+  });
+
+  describe('Form submission and payload validation', () => {
+    it('should submit the correct API payload with all fields', async () => {
+      let requestBody: DefaultBodyType;
+
+      server.use(
+        http.post('/api/endpoint_groups', async ({ request }) => {
+          requestBody = await request.json();
+          return HttpResponse.json({
+            Id: 1,
+            Name: 'test-group',
+            Description: 'Test description',
+            TagIds: [],
+            Policies: [],
+          });
+        })
+      );
+
+      const user = userEvent.setup();
+      renderCreateGroupView();
+
+      // Fill in the name
+      const nameInput = await screen.findByLabelText(/Name/i);
+      await user.type(nameInput, 'test-group');
+
+      // Fill in the description
+      const descriptionInput = screen.getByLabelText(/Description/i);
+      await user.type(descriptionInput, 'Test description');
+
+      // Submit the form
+      const submitButton = screen.getByRole('button', { name: /Create/i });
+      await waitFor(() => {
+        expect(submitButton).toBeEnabled();
+      });
+
+      await user.click(submitButton);
+
+      // Verify the request body matches expected API payload
+      await waitFor(() => {
+        expect(requestBody).toEqual({
+          Name: 'test-group',
+          Description: 'Test description',
+          TagIDs: [],
+          AssociatedEndpoints: [],
+        });
+      });
+    });
+
+    it('should submit the correct API payload with minimal fields (name only)', async () => {
+      let requestBody: DefaultBodyType;
+
+      server.use(
+        http.post('/api/endpoint_groups', async ({ request }) => {
+          requestBody = await request.json();
+          return HttpResponse.json({
+            Id: 1,
+            Name: 'minimal-group',
+            Description: '',
+            TagIds: [],
+            Policies: [],
+          });
+        })
+      );
+
+      const user = userEvent.setup();
+      renderCreateGroupView();
+
+      // Fill in only the name (required)
+      const nameInput = await screen.findByLabelText(/Name/i);
+      await user.type(nameInput, 'minimal-group');
+
+      // Submit the form
+      const submitButton = screen.getByRole('button', { name: /Create/i });
+      await waitFor(() => {
+        expect(submitButton).toBeEnabled();
+      });
+
+      await user.click(submitButton);
+
+      // Verify the request body
+      await waitFor(() => {
+        expect(requestBody).toEqual({
+          Name: 'minimal-group',
+          Description: '',
+          TagIDs: [],
+          AssociatedEndpoints: [],
+        });
+      });
+    });
+
+    it('should show Creating... loading state during submission', async () => {
+      server.use(
+        http.post('/api/endpoint_groups', async () => {
+          // Delay response to test loading state
+          await new Promise((resolve) => {
+            setTimeout(resolve, 100);
+          });
+          return HttpResponse.json({
+            Id: 1,
+            Name: 'test-group',
+            Description: '',
+            TagIds: [],
+            Policies: [],
+          });
+        })
+      );
+
+      const user = userEvent.setup();
+      renderCreateGroupView();
+
+      const nameInput = await screen.findByLabelText(/Name/i);
+      await user.type(nameInput, 'test-group');
+
+      const submitButton = screen.getByRole('button', { name: /Create/i });
+      await waitFor(() => {
+        expect(submitButton).toBeEnabled();
+      });
+
+      await user.click(submitButton);
+
+      // Should show loading state
+      expect(
+        await screen.findByRole('button', { name: /Creating.../i })
+      ).toBeVisible();
+    });
+  });
+
+  describe('Error handling', () => {
+    it('should handle API error gracefully', async () => {
+      const consoleErrorSpy = vi
+        .spyOn(console, 'error')
+        .mockImplementation(() => {});
+
+      const mutationError = vi.fn();
+      const errorMessage = 'Failed to create group';
+
+      server.use(
+        http.post('/api/endpoint_groups', () =>
+          HttpResponse.json({ message: errorMessage }, { status: 500 })
+        )
+      );
+
+      const user = userEvent.setup();
+      renderCreateGroupView({ onMutationError: mutationError });
+
+      const nameInput = await screen.findByLabelText(/Name/i);
+      await user.type(nameInput, 'test-group');
+
+      const submitButton = screen.getByRole('button', { name: /Create/i });
+      await waitFor(() => {
+        expect(submitButton).toBeEnabled();
+      });
+
+      await user.click(submitButton);
+
+      await waitFor(() => {
+        expect(mutationError).toHaveBeenCalled();
+      });
+
+      consoleErrorSpy.mockRestore();
+    });
+  });
+
+  describe('Validation', () => {
+    it('should show validation error for empty name', async () => {
+      renderCreateGroupView();
+
+      await waitFor(() => {
+        expect(screen.getAllByText(/Name is required/i)[0]).toBeVisible();
+      });
+    });
+
+    it('should disable submit button when name is empty', async () => {
+      renderCreateGroupView();
+
+      const submitButton = await screen.findByRole('button', {
+        name: /Create/i,
+      });
+
+      expect(submitButton).toBeDisabled();
+    });
+  });
+
+  describe('Environment selection via drawer', () => {
+    it('should include environments selected in the drawer in the POST payload', async () => {
+      let requestBody: DefaultBodyType;
+      const env = createMockEnvironment({ Id: 42, Name: 'my-test-env' });
+
+      server.use(
+        http.post('/api/endpoint_groups', async ({ request }) => {
+          requestBody = await request.json();
+          return HttpResponse.json({
+            Id: 1,
+            Name: 'test-group',
+            TagIds: [],
+            Policies: [],
+          });
+        })
+      );
+
+      const user = userEvent.setup();
+      renderCreateGroupView({ availableEnvironments: [env] });
+
+      const nameInput = await screen.findByLabelText(/Name/i);
+      await user.type(nameInput, 'test-group');
+
+      // Open the add environments drawer
+      const addBtn = await screen.findByTestId('add-environments-button');
+      await user.click(addBtn);
+
+      // Wait for the environment to appear in the drawer, then select via checkbox
+      await screen.findByText('my-test-env');
+      const drawerTable = screen.getByTestId('add-environments-drawer-table');
+      const drawerCheckboxes = within(drawerTable).getAllByRole('checkbox');
+      await user.click(drawerCheckboxes[1]); // [0] = select-all header, [1] = first row
+
+      // Confirm the selection
+      const confirmBtn = screen.getByTestId('add-environments-confirm-button');
+      await waitFor(() => expect(confirmBtn).toBeEnabled());
+      await user.click(confirmBtn);
+
+      // Submit the form
+      const submitBtn = screen.getByRole('button', { name: /Create/i });
+      await waitFor(() => expect(submitBtn).toBeEnabled());
+      await user.click(submitBtn);
+
+      await waitFor(() => {
+        expect(requestBody).toMatchObject({
+          Name: 'test-group',
+          AssociatedEndpoints: [42],
+        });
+      });
+    });
+
+    it('should allow removing a selected environment before submitting', async () => {
+      let requestBody: DefaultBodyType;
+      const env = createMockEnvironment({ Id: 42, Name: 'removable-env' });
+
+      server.use(
+        http.post('/api/endpoint_groups', async ({ request }) => {
+          requestBody = await request.json();
+          return HttpResponse.json({
+            Id: 1,
+            Name: 'test-group',
+            TagIds: [],
+            Policies: [],
+          });
+        })
+      );
+
+      const user = userEvent.setup();
+      renderCreateGroupView({ availableEnvironments: [env] });
+
+      const nameInput = await screen.findByLabelText(/Name/i);
+      await user.type(nameInput, 'test-group');
+
+      // Add the environment via drawer
+      const addBtn = await screen.findByTestId('add-environments-button');
+      await user.click(addBtn);
+      await screen.findByText('removable-env');
+      const drawerTable = screen.getByTestId('add-environments-drawer-table');
+      const drawerCheckboxes = within(drawerTable).getAllByRole('checkbox');
+      await user.click(drawerCheckboxes[1]);
+      const confirmBtn = screen.getByTestId('add-environments-confirm-button');
+      await waitFor(() => expect(confirmBtn).toBeEnabled());
+      await user.click(confirmBtn);
+
+      // Environment now appears in the associated list — select its row checkbox and remove it
+      await screen.findByText('removable-env');
+      const assocCheckboxes = screen.getAllByRole('checkbox');
+      await user.click(assocCheckboxes[assocCheckboxes.length - 1]);
+      const removeBtn = await screen.findByTestId('remove-environments-button');
+      await waitFor(() => expect(removeBtn).toBeEnabled());
+      await user.click(removeBtn);
+
+      // Submit — payload should have no environments
+      const submitBtn = screen.getByRole('button', { name: /Create/i });
+      await waitFor(() => expect(submitBtn).toBeEnabled());
+      await user.click(submitBtn);
+
+      await waitFor(() => {
+        expect(requestBody).toMatchObject({
+          Name: 'test-group',
+          AssociatedEndpoints: [],
+        });
+      });
+    });
+  });
+});
diff --git a/app/react/portainer/environments/environment-groups/CreateView/CreateGroupView.tsx b/app/react/portainer/environments/environment-groups/CreateView/CreateGroupView.tsx
new file mode 100644
index 0000000..1a833b7
--- /dev/null
+++ b/app/react/portainer/environments/environment-groups/CreateView/CreateGroupView.tsx
@@ -0,0 +1,68 @@
+import { useRouter } from '@uirouter/react';
+import { FormikHelpers } from 'formik';
+
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { Widget } from '@@/Widget';
+import { PageHeader } from '@@/PageHeader';
+
+import { useCreateGroupMutation } from '../queries/useCreateGroupMutation';
+import { GroupForm, GroupFormValues } from '../components/GroupForm';
+
+export function CreateGroupView() {
+  const router = useRouter();
+  const createMutation = useCreateGroupMutation();
+
+  const initialValues: GroupFormValues = {
+    name: '',
+    description: '',
+    tagIds: [],
+    associatedEnvironments: [],
+  };
+
+  return (
+    <>
+      <PageHeader
+        title="Create group"
+        breadcrumbs={[
+          { label: 'Groups', link: 'portainer.groups' },
+          { label: 'Create group' },
+        ]}
+      />
+
+      <div className="mx-4 pb-20">
+        <Widget>
+          <Widget.Body>
+            <GroupForm
+              initialValues={initialValues}
+              onSubmit={handleSubmit}
+              submitLabel="Create"
+              submitLoadingLabel="Creating..."
+            />
+          </Widget.Body>
+        </Widget>
+      </div>
+    </>
+  );
+
+  async function handleSubmit(
+    values: GroupFormValues,
+    { resetForm }: FormikHelpers<GroupFormValues>
+  ) {
+    await createMutation.mutateAsync(
+      {
+        name: values.name,
+        description: values.description,
+        tagIds: values.tagIds,
+        associatedEnvironments: values.associatedEnvironments,
+      },
+      {
+        onSuccess: () => {
+          resetForm();
+          notifySuccess('Success', 'Group successfully created');
+          router.stateService.go('portainer.groups');
+        },
+      }
+    );
+  }
+}
diff --git a/app/react/portainer/environments/environment-groups/ItemView/EditGroupView.test.tsx b/app/react/portainer/environments/environment-groups/ItemView/EditGroupView.test.tsx
new file mode 100644
index 0000000..e9a9d4e
--- /dev/null
+++ b/app/react/portainer/environments/environment-groups/ItemView/EditGroupView.test.tsx
@@ -0,0 +1,583 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { vi } from 'vitest';
+import { http, HttpResponse, DefaultBodyType } from 'msw';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { server } from '@/setup-tests/server';
+import { suppressConsoleLogs } from '@/setup-tests/suppress-console';
+import {
+  Environment,
+  EnvironmentType,
+  EnvironmentStatus,
+} from '@/react/portainer/environments/types';
+import {
+  createMockEnvironment,
+  createMockEnvironmentGroup,
+} from '@/react-tools/test-mocks';
+
+import { EnvironmentGroup } from '../types';
+
+import { EditGroupView } from './EditGroupView';
+
+vi.mock('@/react/hooks/useCanExit', () => ({
+  useCanExit: vi.fn(),
+}));
+
+vi.mock('@/react/hooks/useIdParam', () => ({
+  useIdParam: () => 2, // Default to group ID 2 for most tests
+}));
+
+vi.mock('@/portainer/services/notifications', () => ({
+  notifyError: vi.fn(),
+  notifySuccess: vi.fn(),
+}));
+
+vi.mock('@@/Link', () => ({
+  Link: ({
+    children,
+    className,
+    ...props
+  }: {
+    children: React.ReactNode;
+    className?: string;
+  }) => (
+    <a className={className} {...props}>
+      {children}
+    </a>
+  ),
+}));
+
+vi.mock('@@/modals/confirm', () => {
+  const confirmFn = vi.fn(async () => true);
+  return {
+    confirm: confirmFn,
+  };
+});
+
+const mockGroup = createMockEnvironmentGroup({
+  Id: 2,
+  Name: 'Test Group',
+  Description: 'Test description',
+  TagIds: [1],
+});
+
+const mockEnvironment = createMockEnvironment({
+  Id: 1,
+  Name: 'Test Environment',
+  Type: EnvironmentType.Docker,
+  Status: EnvironmentStatus.Up,
+  GroupId: 2,
+  TagIds: [],
+});
+
+function buildMockEnvironment(
+  id: number,
+  name: string,
+  groupId: number = 1
+): Partial<Environment> {
+  return createMockEnvironment({
+    Id: id,
+    Name: name,
+    Type: EnvironmentType.Docker,
+    Status: EnvironmentStatus.Up,
+    GroupId: groupId,
+    TagIds: [],
+  });
+}
+
+function renderEditGroupView({
+  onMutationError,
+  groupData = mockGroup,
+  associatedEnvironments = [mockEnvironment],
+}: {
+  onMutationError?(): void;
+  groupData?: EnvironmentGroup | null;
+  associatedEnvironments?: Array<Partial<Environment>>;
+} = {}) {
+  // Set up default mocks
+  server.use(
+    http.get('/api/tags', () =>
+      HttpResponse.json([
+        { ID: 1, Name: 'production' },
+        { ID: 2, Name: 'staging' },
+      ])
+    ),
+    http.get<object, never, EnvironmentGroup | { message: string }>(
+      '/api/endpoint_groups/2',
+      () => {
+        if (groupData === null) {
+          return HttpResponse.json(
+            { message: 'Group not found' },
+            { status: 404 }
+          );
+        }
+        return HttpResponse.json(groupData);
+      }
+    ),
+    // Mock for environments query (associated environments)
+    http.get('/api/endpoints', ({ request }) => {
+      const url = new URL(request.url);
+      // Get all groupIds values (handles both groupIds=2 and groupIds[]=2 formats)
+      const groupIdsParam = url.searchParams.getAll('groupIds');
+      const groupIds =
+        groupIdsParam.length > 0
+          ? groupIdsParam
+          : url.searchParams.getAll('groupIds[]');
+      const endpointIdsParam = url.searchParams.getAll('endpointIds');
+      const endpointIds =
+        endpointIdsParam.length > 0
+          ? endpointIdsParam
+          : url.searchParams.getAll('endpointIds[]');
+
+      // Helper to create response with required headers
+      function createResponse(envs: Array<Partial<Environment>>) {
+        return HttpResponse.json(envs, {
+          headers: {
+            'x-total-count': String(envs.length),
+            'x-total-available': String(envs.length),
+          },
+        });
+      }
+
+      // If querying by endpointIds (AssociatedEnvironmentsSelector initial query)
+      if (endpointIds.length > 0) {
+        const ids = endpointIds.map(Number);
+        const envs = associatedEnvironments.filter((e) =>
+          ids.includes(e.Id as number)
+        );
+        return createResponse(envs);
+      }
+
+      // If querying for group's associated environments
+      if (groupIds.includes('2')) {
+        return createResponse(associatedEnvironments);
+      }
+      // For available environments (unassigned group = 1)
+      if (groupIds.includes('1')) {
+        return createResponse([
+          buildMockEnvironment(10, 'Available Env 1'),
+          buildMockEnvironment(11, 'Available Env 2'),
+        ]);
+      }
+      return createResponse([]);
+    })
+  );
+
+  const Wrapped = withTestQueryProvider(
+    withTestRouter(withUserProvider(EditGroupView)),
+    { onMutationError }
+  );
+
+  return render(<Wrapped />);
+}
+
+describe('EditGroupView', () => {
+  describe('Page rendering', () => {
+    it('should render the page header with correct title', async () => {
+      renderEditGroupView();
+
+      // The component should render without errors and breadcrumbs should be visible
+      expect(await screen.findByText('Groups')).toBeVisible();
+    });
+
+    it('should render breadcrumbs with link to Groups', async () => {
+      renderEditGroupView();
+
+      expect(await screen.findByText('Groups')).toBeVisible();
+    });
+
+    it('should load and display group data', async () => {
+      renderEditGroupView();
+
+      // Wait for the form to load and populate with group data
+      const nameInput = await screen.findByLabelText(/Name/i);
+      await waitFor(() => {
+        expect(nameInput).toHaveValue('Test Group');
+      });
+
+      // Verify the group data is loaded
+      expect(nameInput).toHaveValue('Test Group');
+    });
+
+    it('should render the Update button', async () => {
+      renderEditGroupView();
+
+      expect(
+        await screen.findByRole('button', { name: /Update/i })
+      ).toBeVisible();
+    });
+  });
+
+  describe('Loading state', () => {
+    it('should not show form while fetching group data', async () => {
+      server.use(
+        http.get('/api/endpoint_groups/2', async () => {
+          // Delay response to test loading state
+          await new Promise((resolve) => {
+            setTimeout(resolve, 100);
+          });
+          return HttpResponse.json(mockGroup);
+        })
+      );
+
+      renderEditGroupView();
+
+      // Form should not be visible initially while loading
+      expect(screen.queryByLabelText(/Name/i)).not.toBeInTheDocument();
+
+      // After loading completes, form should appear
+      await waitFor(() => {
+        expect(screen.getByLabelText(/Name/i)).toBeVisible();
+      });
+    });
+
+    it('should populate form with fetched group data', async () => {
+      renderEditGroupView();
+
+      // Wait for data to load and populate the form
+      const nameInput = await screen.findByLabelText(/Name/i);
+      await waitFor(() => {
+        expect(nameInput).toHaveValue('Test Group');
+      });
+
+      const descriptionInput = screen.getByLabelText(/Description/i);
+      expect(descriptionInput).toHaveValue('Test description');
+    });
+
+    it('should show Environments tab for non-unassigned groups', async () => {
+      renderEditGroupView();
+
+      // Wait for form to load
+      await screen.findByLabelText(/Name/i);
+
+      // The Environments tab should be visible — target by data-cy so we
+      // don't collide with the "Environments" stat block label in the header.
+      const environmentsTab = screen.getByTestId('tab-0');
+      expect(environmentsTab).toBeVisible();
+      expect(environmentsTab).toHaveTextContent(/Environments/i);
+    });
+  });
+
+  describe('Error state', () => {
+    // Suppress console logs for error state tests
+    const restoreConsole = suppressConsoleLogs();
+    afterAll(restoreConsole);
+
+    it('should show error Alert when group fetch fails', async () => {
+      renderEditGroupView({ groupData: null });
+
+      // Should show the error message
+      expect(
+        await screen.findByText(/Failed to load group details/i)
+      ).toBeVisible();
+    });
+
+    it('should NOT show the form when group fetch fails', async () => {
+      renderEditGroupView({ groupData: null });
+
+      // Wait for the error message to appear
+      await screen.findByText(/Failed to load group details/i);
+
+      // Form fields should not be visible
+      expect(screen.queryByLabelText(/Name/i)).not.toBeInTheDocument();
+      expect(
+        screen.queryByRole('button', { name: /Update/i })
+      ).not.toBeInTheDocument();
+    });
+  });
+
+  describe('Form submission and payload validation', () => {
+    it('should submit the correct API payload when updating', async () => {
+      let requestBody: DefaultBodyType;
+      let requestUrl: string;
+
+      server.use(
+        http.put('/api/endpoint_groups/:id', async ({ request, params }) => {
+          requestBody = await request.json();
+          requestUrl = `/api/endpoint_groups/${params.id}`;
+          return HttpResponse.json({
+            ...mockGroup,
+            Name: 'Updated Group',
+          });
+        })
+      );
+
+      const user = userEvent.setup();
+      renderEditGroupView();
+
+      // Wait for form to populate
+      const nameInput = await screen.findByLabelText(/Name/i);
+      await waitFor(() => {
+        expect(nameInput).toHaveValue('Test Group');
+      });
+
+      // Clear and update the name
+      await user.clear(nameInput);
+      await user.type(nameInput, 'Updated Group');
+
+      // Submit the form
+      const submitButton = screen.getByRole('button', { name: /Update/i });
+      await waitFor(() => {
+        expect(submitButton).toBeEnabled();
+      });
+
+      await user.click(submitButton);
+
+      // Verify the request URL and body.
+      await waitFor(() => {
+        expect(requestUrl).toBe('/api/endpoint_groups/2');
+        expect(requestBody).toMatchObject({
+          Name: 'Updated Group',
+          Description: 'Test description',
+          TagIDs: [1],
+        });
+      });
+    });
+
+    it('should submit updated description correctly', async () => {
+      let requestBody: DefaultBodyType;
+
+      server.use(
+        http.put('/api/endpoint_groups/:id', async ({ request }) => {
+          requestBody = await request.json();
+          return HttpResponse.json({
+            ...mockGroup,
+            Description: 'New description',
+          });
+        })
+      );
+
+      const user = userEvent.setup();
+      renderEditGroupView();
+
+      // Wait for form to populate
+      const descriptionInput = await screen.findByLabelText(/Description/i);
+      await waitFor(() => {
+        expect(descriptionInput).toHaveValue('Test description');
+      });
+
+      // Clear and update the description
+      await user.clear(descriptionInput);
+      await user.type(descriptionInput, 'New description');
+
+      // Submit the form
+      const submitButton = screen.getByRole('button', { name: /Update/i });
+      await waitFor(() => {
+        expect(submitButton).toBeEnabled();
+      });
+
+      await user.click(submitButton);
+
+      // Verify the request body includes new description
+      await waitFor(() => {
+        expect(requestBody).toMatchObject({
+          Description: 'New description',
+        });
+      });
+    });
+
+    it('should show Updating... loading state during submission', async () => {
+      server.use(
+        http.put('/api/endpoint_groups/:id', async () => {
+          // Delay response to test loading state
+          await new Promise((resolve) => {
+            setTimeout(resolve, 100);
+          });
+          return HttpResponse.json(mockGroup);
+        })
+      );
+
+      const user = userEvent.setup();
+      renderEditGroupView();
+
+      // Wait for form to populate
+      const nameInput = await screen.findByLabelText(/Name/i);
+      await waitFor(() => {
+        expect(nameInput).toHaveValue('Test Group');
+      });
+
+      // Make a change to enable the submit button
+      await user.clear(nameInput);
+      await user.type(nameInput, 'Changed Name');
+
+      const submitButton = screen.getByRole('button', { name: /Update/i });
+      await waitFor(() => {
+        expect(submitButton).toBeEnabled();
+      });
+
+      await user.click(submitButton);
+
+      // Should show loading state
+      expect(
+        await screen.findByRole('button', { name: /Updating.../i })
+      ).toBeVisible();
+    });
+  });
+
+  describe('Error handling on update', () => {
+    it('should handle API error gracefully on update', async () => {
+      const restoreConsole = suppressConsoleLogs();
+
+      const mutationError = vi.fn();
+      const errorMessage = 'Failed to update group';
+
+      server.use(
+        http.put('/api/endpoint_groups/:id', () =>
+          HttpResponse.json({ message: errorMessage }, { status: 500 })
+        )
+      );
+
+      const user = userEvent.setup();
+      renderEditGroupView({ onMutationError: mutationError });
+
+      // Wait for form to populate
+      const nameInput = await screen.findByLabelText(/Name/i);
+      await waitFor(() => {
+        expect(nameInput).toHaveValue('Test Group');
+      });
+
+      // Make a change
+      await user.clear(nameInput);
+      await user.type(nameInput, 'Changed Name');
+
+      const submitButton = screen.getByRole('button', { name: /Update/i });
+      await waitFor(() => {
+        expect(submitButton).toBeEnabled();
+      });
+
+      await user.click(submitButton);
+
+      await waitFor(() => {
+        expect(mutationError).toHaveBeenCalled();
+      });
+
+      restoreConsole();
+    });
+  });
+
+  describe('Update payload', () => {
+    it('should include AssociatedEndpoints in update payload', async () => {
+      let requestBody: DefaultBodyType;
+
+      server.use(
+        http.put('/api/endpoint_groups/:id', async ({ request }) => {
+          requestBody = await request.json();
+          return HttpResponse.json(mockGroup);
+        })
+      );
+
+      const user = userEvent.setup();
+      renderEditGroupView();
+
+      // Wait for form to populate
+      const nameInput = await screen.findByLabelText(/Name/i);
+      await waitFor(() => {
+        expect(nameInput).toHaveValue('Test Group');
+      });
+
+      // Make a small change to enable submit
+      await user.type(nameInput, ' edited');
+
+      const submitButton = screen.getByRole('button', { name: /Update/i });
+      await waitFor(() => {
+        expect(submitButton).toBeEnabled();
+      });
+
+      await user.click(submitButton);
+
+      // Verify AssociatedEndpoints is present in the payload
+      await waitFor(() => {
+        expect(requestBody).toHaveProperty('AssociatedEndpoints');
+      });
+    });
+  });
+
+  describe('API request - size parameter', () => {
+    it('should request the group with size=true so TypeInfo is populated', async () => {
+      let capturedUrl: string | undefined;
+
+      server.use(
+        http.get('/api/endpoint_groups/2', ({ request }) => {
+          capturedUrl = request.url;
+          return HttpResponse.json(mockGroup);
+        }),
+        http.get('/api/tags', () => HttpResponse.json([])),
+        http.get('/api/endpoints', () =>
+          HttpResponse.json([], {
+            headers: {
+              'x-total-count': '0',
+              'x-total-available': '0',
+            },
+          })
+        )
+      );
+
+      const Wrapped = withTestQueryProvider(
+        withTestRouter(withUserProvider(EditGroupView))
+      );
+      render(<Wrapped />);
+
+      await screen.findByLabelText(/Name/i);
+
+      // size=true is required for TypeInfo (Docker/Kubernetes/Podman counts) to be
+      // included in the response. Without it, EnvironmentTypeBreakdown in GroupHeader
+      // shows nothing.
+      expect(new URL(capturedUrl!).searchParams.get('size')).toBe('true');
+    });
+
+    it('should show per-platform breakdown in GroupHeader when TypeInfo is returned', async () => {
+      const groupWithTypeInfo = createMockEnvironmentGroup({
+        Id: 2,
+        Name: 'Test Group',
+        Description: 'Test description',
+        TagIds: [1],
+        Total: 3,
+        TypeInfo: { Docker: 2, Kubernetes: 1, Podman: 0, Mixed: true },
+      });
+
+      renderEditGroupView({ groupData: groupWithTypeInfo });
+
+      expect(await screen.findByText('Docker')).toBeVisible();
+      expect(screen.getByText('Kubernetes')).toBeVisible();
+    });
+  });
+
+  describe('Delete flow', () => {
+    it('should render the delete button', async () => {
+      renderEditGroupView();
+
+      // Wait for form to load
+      await screen.findByLabelText(/Name/i);
+
+      // Delete button should be visible
+      expect(screen.getByRole('button', { name: /Delete/i })).toBeVisible();
+    });
+
+    it('should hide the delete button when group data is missing', async () => {
+      renderEditGroupView({ groupData: null });
+
+      // Wait for the header error state to appear
+      await screen.findByText(/Failed to load group details/i);
+
+      // Delete lives inside GroupHeader's action bar, which is suppressed
+      // when the group hasn't loaded — there's nothing to act on.
+      expect(
+        screen.queryByRole('button', { name: /Delete/i })
+      ).not.toBeInTheDocument();
+    });
+
+    it('should have correct data-cy attribute', async () => {
+      renderEditGroupView();
+
+      // Wait for form to load
+      await screen.findByLabelText(/Name/i);
+
+      // The Delete button now lives inside GroupHeader's action bar
+      const deleteButton = screen.getByRole('button', { name: /Delete/i });
+      expect(deleteButton).toHaveAttribute('data-cy', 'group-header-delete');
+    });
+  });
+});
diff --git a/app/react/portainer/environments/environment-groups/ItemView/EditGroupView.tsx b/app/react/portainer/environments/environment-groups/ItemView/EditGroupView.tsx
new file mode 100644
index 0000000..f7903b9
--- /dev/null
+++ b/app/react/portainer/environments/environment-groups/ItemView/EditGroupView.tsx
@@ -0,0 +1,91 @@
+import { useMemo, useState } from 'react';
+import { Box } from 'lucide-react';
+import { useRouter } from '@uirouter/react';
+
+import { notifySuccess } from '@/portainer/services/notifications';
+import { useIdParam } from '@/react/hooks/useIdParam';
+
+import { PageHeader } from '@@/PageHeader';
+import { Tab, WidgetTabs, useCurrentTabIndex } from '@@/Widget/WidgetTabs';
+import { confirm } from '@@/modals/confirm';
+import { ModalType } from '@@/modals/Modal';
+import { buildConfirmButton } from '@@/modals/utils';
+
+import { useGroup } from '../queries/useGroup';
+import { useDeleteEnvironmentGroupMutation } from '../queries/useDeleteEnvironmentGroupMutation';
+
+import { EnvironmentsTab } from './tabs/EnvironmentsTab';
+import { GroupHeader } from './GroupHeader';
+
+export function EditGroupView() {
+  const router = useRouter();
+  const groupId = useIdParam();
+  const deleteMutation = useDeleteEnvironmentGroupMutation();
+  const [addEnvsDrawerOpen, setAddEnvsDrawerOpen] = useState(false);
+  const groupQuery = useGroup(
+    deleteMutation.isLoading || deleteMutation.isSuccess ? undefined : groupId,
+    { size: true }
+  );
+  const group = groupQuery.data;
+  const groupName = group?.Name ?? 'Environment group';
+
+  async function handleDeleteGroup() {
+    const confirmed = await confirm({
+      title: 'Delete Environment Group',
+      modalType: ModalType.Destructive,
+      message: `Are you sure you want to delete the environment group "${groupName}"? This action cannot be undone.`,
+      confirmButton: buildConfirmButton('Delete', 'danger'),
+    });
+
+    if (confirmed) {
+      deleteMutation.mutate(groupId, {
+        onSuccess() {
+          notifySuccess('Success', 'Environment group deleted');
+          router.stateService.go('portainer.groups');
+        },
+      });
+    }
+  }
+
+  const tabs: Array<Tab> = useMemo(
+    () => [
+      {
+        name: 'Environments',
+        icon: Box,
+        widget: (
+          <EnvironmentsTab
+            externalDrawerOpen={addEnvsDrawerOpen}
+            onExternalDrawerClose={() => setAddEnvsDrawerOpen(false)}
+          />
+        ),
+        selectedTabParam: 'environments',
+      },
+    ],
+    [addEnvsDrawerOpen]
+  );
+
+  const currentTabIndex = useCurrentTabIndex(tabs);
+
+  return (
+    <>
+      <PageHeader
+        breadcrumbs={[{ label: 'Groups', link: 'portainer.groups' }, groupName]}
+      />
+      <div className="mx-4 space-y-4">
+        <GroupHeader
+          group={group}
+          isLoading={groupQuery.isLoading}
+          onRefresh={() => groupQuery.refetch()}
+          onAddEnvironments={() => setAddEnvsDrawerOpen(true)}
+          onDelete={handleDeleteGroup}
+        />
+        <WidgetTabs
+          tabs={tabs}
+          currentTabIndex={currentTabIndex}
+          useContainer={false}
+        />
+      </div>
+      {tabs[currentTabIndex].widget}
+    </>
+  );
+}
diff --git a/app/react/portainer/environments/environment-groups/ItemView/GroupHeader.tsx b/app/react/portainer/environments/environment-groups/ItemView/GroupHeader.tsx
new file mode 100644
index 0000000..d68c8e3
--- /dev/null
+++ b/app/react/portainer/environments/environment-groups/ItemView/GroupHeader.tsx
@@ -0,0 +1,87 @@
+import { LayoutGrid, Plus, RefreshCw, Trash2 } from 'lucide-react';
+
+import { ResourceDetailHeader } from '@@/ResourceDetailHeader/ResourceDetailHeader';
+import { ResourceStatBlock } from '@@/ResourceDetailHeader/ResourceStatBlock';
+import { ActionBarShell } from '@@/ResourceDetailHeader/ActionBarShell';
+import { ActionBarButton } from '@@/ResourceDetailHeader/ActionBarButton';
+import { HeaderStats } from '@@/ResourceDetailHeader/HeaderStats';
+
+import { EnvironmentGroup } from '../types';
+import { PlatformBadge } from '../components/PlatformBadge';
+import { EnvironmentTypeBreakdown } from '../components/EnvironmentTypeBreakdown';
+
+interface Props {
+  group?: EnvironmentGroup;
+  isLoading?: boolean;
+  onRefresh?: () => void;
+  onAddEnvironments?: () => void;
+  onDelete?: () => void;
+}
+
+export function GroupHeader({
+  group,
+  isLoading,
+  onRefresh,
+  onAddEnvironments,
+  onDelete,
+}: Props) {
+  const actionBar = group ? (
+    <ActionBarShell>
+      <div className="flex items-center gap-3">
+        <ActionBarButton
+          icon={RefreshCw}
+          onClick={() => onRefresh?.()}
+          data-cy="group-header-refresh"
+        >
+          Refresh
+        </ActionBarButton>
+        <ActionBarButton
+          icon={Plus}
+          onClick={() => onAddEnvironments?.()}
+          data-cy="group-header-add-environments"
+        >
+          Add environments
+        </ActionBarButton>
+      </div>
+      <div className="flex items-center gap-1">
+        <ActionBarButton
+          icon={Trash2}
+          onClick={() => onDelete?.()}
+          data-cy="group-header-delete"
+          color="dangerlight"
+        >
+          Delete
+        </ActionBarButton>
+      </div>
+    </ActionBarShell>
+  ) : undefined;
+
+  return (
+    <ResourceDetailHeader
+      isLoading={isLoading}
+      errorMessage={
+        !isLoading && !group ? 'Failed to load group details' : undefined
+      }
+      icon={
+        <LayoutGrid className="!text-group-accent-8 th-dark:!text-group-accent-2" />
+      }
+      subtitleLabel="Environment Group"
+      title={group?.Name || ''}
+      badge={group && <PlatformBadge group={group} />}
+      description={group?.Description}
+      rightInfo={
+        group && (
+          <HeaderStats>
+            <ResourceStatBlock>
+              <ResourceStatBlock.Label>Environments</ResourceStatBlock.Label>
+              <ResourceStatBlock.Value>
+                <EnvironmentTypeBreakdown group={group} />
+              </ResourceStatBlock.Value>
+            </ResourceStatBlock>
+          </HeaderStats>
+        )
+      }
+      actionBar={actionBar}
+    />
+  );
+}
diff --git a/app/react/portainer/environments/environment-groups/ItemView/tabs/EnvironmentsTab.tsx b/app/react/portainer/environments/environment-groups/ItemView/tabs/EnvironmentsTab.tsx
new file mode 100644
index 0000000..8048496
--- /dev/null
+++ b/app/react/portainer/environments/environment-groups/ItemView/tabs/EnvironmentsTab.tsx
@@ -0,0 +1,96 @@
+import { FormikHelpers } from 'formik';
+import { useMemo } from 'react';
+
+import { useIdParam } from '@/react/hooks/useIdParam';
+import { useEnvironmentList } from '@/react/portainer/environments/queries';
+
+import { Widget } from '@@/Widget';
+
+import { useGroup } from '../../queries/useGroup';
+import { useUpdateGroupMutation } from '../../queries/useUpdateGroupMutation';
+import { GroupForm, GroupFormValues } from '../../components/GroupForm';
+import { AssociatedEnvironmentsSelector } from '../../components/AssociatedEnvironmentsSelector/AssociatedEnvironmentsSelector';
+import { isUngoverned } from '../../utils/getPlatformLabel';
+
+interface Props {
+  externalDrawerOpen?: boolean;
+  onExternalDrawerClose?: () => void;
+}
+
+export function EnvironmentsTab({
+  externalDrawerOpen,
+  onExternalDrawerClose,
+}: Props) {
+  const groupId = useIdParam();
+  const groupQuery = useGroup(groupId);
+  const environmentsQuery = useEnvironmentList({
+    groupIds: [groupId],
+    pageLimit: 0,
+  });
+  const updateMutation = useUpdateGroupMutation();
+
+  const currentGroupIsUngoverned = groupQuery.data
+    ? isUngoverned(groupQuery.data)
+    : false;
+
+  const initialValues: GroupFormValues = useMemo(
+    () => ({
+      name: groupQuery.data?.Name ?? '',
+      description: groupQuery.data?.Description ?? '',
+      tagIds: groupQuery.data?.TagIds ?? [],
+    }),
+    [groupQuery.data]
+  );
+
+  return (
+    <>
+      <div className="m-4">
+        <Widget>
+          <Widget.Body loading={groupQuery.isLoading}>
+            {groupQuery.data && (
+              <GroupForm
+                initialValues={initialValues}
+                onSubmit={handleSubmit}
+                submitLabel="Update"
+                submitLoadingLabel="Updating..."
+                groupId={groupId}
+              />
+            )}
+          </Widget.Body>
+        </Widget>
+      </div>
+
+      <div className="pb-20">
+        <AssociatedEnvironmentsSelector
+          groupId={groupId}
+          readOnly={currentGroupIsUngoverned}
+          externalDrawerOpen={externalDrawerOpen}
+          onExternalDrawerClose={onExternalDrawerClose}
+        />
+      </div>
+    </>
+  );
+
+  async function handleSubmit(
+    values: GroupFormValues,
+    { resetForm }: FormikHelpers<GroupFormValues>
+  ) {
+    const associatedEnvironments = (environmentsQuery.environments ?? []).map(
+      (e) => e.Id
+    );
+    await updateMutation.mutateAsync(
+      {
+        id: groupId,
+        name: values.name,
+        description: values.description,
+        tagIds: values.tagIds,
+        associatedEnvironments,
+      },
+      {
+        onSuccess() {
+          resetForm();
+        },
+      }
+    );
+  }
+}
diff --git a/app/react/portainer/environments/environment-groups/ListView/EnvironmentGroupsTable/EnvironmentGroupRow.tsx b/app/react/portainer/environments/environment-groups/ListView/EnvironmentGroupsTable/EnvironmentGroupRow.tsx
new file mode 100644
index 0000000..e1dcc30
--- /dev/null
+++ b/app/react/portainer/environments/environment-groups/ListView/EnvironmentGroupsTable/EnvironmentGroupRow.tsx
@@ -0,0 +1,136 @@
+import { LayoutGrid, Columns3Cog, Users } from 'lucide-react';
+import clsx from 'clsx';
+import { useRouter } from '@uirouter/react';
+
+import { Tag } from '@/portainer/tags/types';
+
+import { Link } from '@@/Link';
+import { Badge } from '@@/Badge';
+import { Button } from '@@/buttons';
+
+import { EnvironmentGroup } from '../../types';
+import { EnvironmentTypeBreakdown } from '../../components/EnvironmentTypeBreakdown';
+import { PlatformBadge } from '../../components/PlatformBadge';
+import { isUngoverned } from '../../utils/getPlatformLabel';
+
+interface Props {
+  group: EnvironmentGroup;
+  tags?: Tag[];
+}
+
+export function EnvironmentGroupRow({ group, tags }: Props) {
+  const router = useRouter();
+  const ungoverned = isUngoverned(group);
+
+  function handleRowClick() {
+    if (!ungoverned) {
+      router.stateService.go('portainer.groups.group', { id: group.Id });
+    }
+  }
+
+  function handleKeyDown(e: React.KeyboardEvent) {
+    if (!ungoverned && (e.key === 'Enter' || e.key === ' ')) {
+      e.preventDefault();
+      handleRowClick();
+    }
+  }
+
+  return (
+    <div
+      className={clsx(
+        'group flex items-center gap-5 border-0 border-t border-solid border-gray-4 px-5 py-4 transition-colors',
+        ungoverned
+          ? 'cursor-default bg-gray-2 th-highcontrast:bg-gray-10 th-dark:bg-gray-10'
+          : 'cursor-pointer hover:bg-gray-2 th-dark:hover:bg-gray-9',
+        'th-dark:border-gray-8'
+      )}
+      data-cy={`environment-group-row-${group.Name}`}
+      onClick={ungoverned ? undefined : handleRowClick}
+      onKeyDown={ungoverned ? undefined : handleKeyDown}
+      role={ungoverned ? undefined : 'button'}
+      tabIndex={ungoverned ? undefined : 0}
+    >
+      {/* Icon */}
+      <div
+        className={clsx(
+          'flex h-12 w-12 shrink-0 items-center justify-center rounded-xl text-2xl',
+          ungoverned
+            ? 'bg-warning-7 th-dark:bg-warning-10'
+            : 'bg-blue-3 th-dark:bg-blue-9'
+        )}
+      >
+        {ungoverned ? (
+          <Columns3Cog
+            className={clsx(
+              'h-6 w-6',
+              '!text-warning-4 th-dark:text-warning-3'
+            )}
+          />
+        ) : (
+          <LayoutGrid
+            className={clsx('h-6 w-6', 'text-blue-9 th-dark:text-blue-3')}
+          />
+        )}
+      </div>
+
+      {/* Content */}
+      <div className="min-w-0 flex-1">
+        {/* Name + Tag badges */}
+        <div className="flex items-center gap-3">
+          <span
+            className={clsx(
+              'text-sm font-bold',
+              ungoverned
+                ? 'text-warning-7 th-dark:text-warning-3'
+                : 'text-gray-8 th-highcontrast:text-white th-dark:text-gray-2'
+            )}
+            data-cy={`environment-group-name-${group.Name}`}
+          >
+            {group.Name}
+          </span>
+          {!ungoverned && <PlatformBadge group={group} />}
+          {!ungoverned &&
+            group.TagIds?.map((tagId) => {
+              const tag = tags?.find((t) => t.ID === tagId);
+              return (
+                <Badge key={tagId} type="info" className="text-xs">
+                  {tag?.Name ?? `Tag ${tagId}`}
+                </Badge>
+              );
+            })}
+        </div>
+
+        {/* Meta info */}
+        <div
+          className={clsx(
+            'mt-1 flex items-center gap-4 text-xs',
+            ungoverned
+              ? 'text-warning-7 th-dark:text-warning-4'
+              : 'text-gray-7 th-highcontrast:text-white group-hover:th-highcontrast:text-gray-11 th-dark:text-gray-5'
+          )}
+        >
+          <EnvironmentTypeBreakdown group={group} />
+        </div>
+      </div>
+
+      {/* Action buttons */}
+      {!ungoverned && (
+        <div className="flex items-center gap-1">
+          <Button
+            as={Link}
+            props={{
+              to: 'portainer.groups.group',
+              params: { id: group.Id, tab: 'access' },
+            }}
+            color="link"
+            icon={Users}
+            onClick={(e: React.MouseEvent) => e.stopPropagation()}
+            data-cy={`manage-access-button_${group.Name}`}
+          >
+            Manage access
+          </Button>
+        </div>
+      )}
+    </div>
+  );
+}
diff --git a/app/react/portainer/environments/environment-groups/ListView/EnvironmentGroupsTable/EnvironmentGroupsTable.test.tsx b/app/react/portainer/environments/environment-groups/ListView/EnvironmentGroupsTable/EnvironmentGroupsTable.test.tsx
new file mode 100644
index 0000000..4a76139
--- /dev/null
+++ b/app/react/portainer/environments/environment-groups/ListView/EnvironmentGroupsTable/EnvironmentGroupsTable.test.tsx
@@ -0,0 +1,677 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { vi } from 'vitest';
+import { PropsWithChildren } from 'react';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { server } from '@/setup-tests/server';
+
+import { EnvironmentGroup } from '../../types';
+
+import { EnvironmentGroupsTable } from './EnvironmentGroupsTable';
+
+vi.mock('@@/Link', () => ({
+  Link: ({
+    children,
+    ...props
+  }: PropsWithChildren<{ to: string; params?: Record<string, unknown> }>) => (
+    <span role="button" tabIndex={0} {...props}>
+      {children}
+    </span>
+  ),
+}));
+
+function buildGroup(
+  overrides: Partial<EnvironmentGroup> & { Id: number; Name: string }
+): EnvironmentGroup {
+  return {
+    Description: '',
+    TagIds: [],
+    ...overrides,
+  };
+}
+
+const mockGroups: Array<EnvironmentGroup> = [
+  buildGroup({
+    Id: 2,
+    Name: 'Production Kubernetes',
+    Description: 'Production k8s cluster',
+    TagIds: [1, 2],
+  }),
+  buildGroup({
+    Id: 3,
+    Name: 'Development Kubernetes',
+    TagIds: [1],
+  }),
+  buildGroup({
+    Id: 4,
+    Name: 'Docker Hosts',
+    TagIds: [3],
+  }),
+  buildGroup({
+    Id: 5,
+    Name: 'Staging Mixed',
+    TagIds: [2],
+  }),
+  buildGroup({
+    Id: 6,
+    Name: 'Edge Fleet',
+  }),
+];
+
+function searchInput() {
+  return screen.getByTestId('environment-groups-list-header-search');
+}
+function sortByName() {
+  return screen.getByTestId(
+    'environment-groups-list-header-sort-sort-by-name-button'
+  );
+}
+function nextPageBtn() {
+  return screen.getByTitle('Next page');
+}
+function prevPageBtn() {
+  return screen.getByTitle('Previous page');
+}
+
+async function waitForLoaded() {
+  await waitFor(() => {
+    const rows = screen.queryAllByTestId(/^environment-group-row-/);
+    const empty = screen.queryByText(
+      /No environment groups found|No groups match/
+    );
+    if (rows.length === 0 && !empty) throw new Error('Still loading');
+  });
+}
+
+function renderTable() {
+  server.use(
+    http.get('/api/endpoint_groups', () => HttpResponse.json(mockGroups)),
+    http.get('/api/tags', () =>
+      HttpResponse.json([
+        { ID: 1, Name: 'production' },
+        { ID: 2, Name: 'staging' },
+        { ID: 3, Name: 'docker' },
+      ])
+    )
+  );
+
+  const Wrapped = withTestQueryProvider(
+    withTestRouter(withUserProvider(EnvironmentGroupsTable))
+  );
+
+  return render(<Wrapped />);
+}
+
+function renderEmptyTable() {
+  server.use(http.get('/api/endpoint_groups', () => HttpResponse.json([])));
+
+  const Wrapped = withTestQueryProvider(
+    withTestRouter(withUserProvider(EnvironmentGroupsTable))
+  );
+
+  return render(<Wrapped />);
+}
+
+beforeEach(() => {
+  localStorage.clear();
+  sessionStorage.clear();
+});
+
+describe('EnvironmentGroupsTable', () => {
+  describe('Rendering', () => {
+    it('should show loading state initially', () => {
+      server.use(
+        http.get('/api/endpoint_groups', async () => {
+          await new Promise((resolve) => {
+            setTimeout(resolve, 5000);
+          });
+          return HttpResponse.json(mockGroups);
+        })
+      );
+
+      const Wrapped = withTestQueryProvider(
+        withTestRouter(withUserProvider(EnvironmentGroupsTable))
+      );
+      render(<Wrapped />);
+
+      // Header renders immediately; group rows are not yet visible
+      expect(
+        screen.getByTestId(
+          'environment-groups-list-header-sort-sort-by-name-button'
+        )
+      ).toBeVisible();
+      expect(
+        screen.queryByTestId(/^environment-group-row-/)
+      ).not.toBeInTheDocument();
+    });
+
+    it('should render all groups after loading', async () => {
+      renderTable();
+
+      await waitForLoaded();
+
+      mockGroups.forEach((group) => {
+        expect(
+          screen.getByTestId(`environment-group-row-${group.Name}`)
+        ).toBeVisible();
+      });
+    });
+
+    it('should show empty state when no groups exist', async () => {
+      renderEmptyTable();
+
+      expect(
+        await screen.findByText('No environment groups found')
+      ).toBeVisible();
+    });
+  });
+
+  describe('Filtering', () => {
+    it('should filter groups by name', async () => {
+      const user = userEvent.setup();
+      renderTable();
+
+      await waitForLoaded();
+
+      await user.type(searchInput(), 'Production');
+
+      // SearchBar debounces input; wait for the filter to apply
+      await waitFor(() => {
+        expect(
+          screen.queryByTestId('environment-group-row-Docker Hosts')
+        ).not.toBeInTheDocument();
+      });
+      expect(
+        screen.getByTestId('environment-group-row-Production Kubernetes')
+      ).toBeVisible();
+    });
+
+    it('should filter case-insensitively', async () => {
+      const user = userEvent.setup();
+      renderTable();
+
+      await waitForLoaded();
+
+      await user.type(searchInput(), 'docker');
+
+      // SearchBar debounces input; wait for the filter to apply
+      await waitFor(() => {
+        expect(
+          screen.getByTestId('environment-group-row-Docker Hosts')
+        ).toBeVisible();
+      });
+    });
+
+    it('should show no results message when filter matches nothing', async () => {
+      const user = userEvent.setup();
+      renderTable();
+
+      await waitForLoaded();
+
+      await user.type(searchInput(), 'nonexistent');
+
+      // SearchBar debounces input; wait for the empty state to render
+      await waitFor(() => {
+        expect(screen.getByText('No groups match your search')).toBeVisible();
+      });
+    });
+  });
+
+  describe('Sorting', () => {
+    it('should sort by name ascending by default', async () => {
+      renderTable();
+
+      await waitForLoaded();
+
+      const rows = screen.getAllByTestId(/^environment-group-row-/);
+      expect(rows[0]).toHaveAttribute(
+        'data-cy',
+        'environment-group-row-Development Kubernetes'
+      );
+      expect(rows[1]).toHaveAttribute(
+        'data-cy',
+        'environment-group-row-Docker Hosts'
+      );
+    });
+
+    it('should toggle sort direction when clicking the active sort', async () => {
+      const user = userEvent.setup();
+      renderTable();
+
+      await waitForLoaded();
+
+      // Click name again to reverse
+      await user.click(sortByName());
+
+      const rows = screen.getAllByTestId(/^environment-group-row-/);
+      expect(rows[0]).toHaveAttribute(
+        'data-cy',
+        'environment-group-row-Staging Mixed'
+      );
+    });
+  });
+
+  describe('Pagination', () => {
+    it('should show pagination info when items exist', async () => {
+      renderTable();
+
+      await waitForLoaded();
+
+      // SortableListPagerInfo always shows when totalCount > 0
+      expect(screen.getByRole('combobox')).toBeVisible();
+    });
+
+    it('should show pagination when items exceed page size', async () => {
+      const manyGroups = Array.from({ length: 15 }, (_, i) =>
+        buildGroup({
+          Id: i + 1,
+          Name: `Group ${String(i + 1).padStart(2, '0')}`,
+        })
+      );
+
+      server.use(
+        http.get('/api/endpoint_groups', () => HttpResponse.json(manyGroups))
+      );
+
+      const Wrapped = withTestQueryProvider(
+        withTestRouter(withUserProvider(EnvironmentGroupsTable))
+      );
+      render(<Wrapped />);
+
+      await waitForLoaded();
+
+      expect(nextPageBtn()).toBeVisible();
+      // Should show 10 items on first page
+      const rows = screen.getAllByTestId(/^environment-group-row-/);
+      expect(rows).toHaveLength(10);
+    });
+
+    it('should navigate to next page', async () => {
+      const user = userEvent.setup();
+
+      const manyGroups = Array.from({ length: 15 }, (_, i) =>
+        buildGroup({
+          Id: i + 1,
+          Name: `Group ${String(i + 1).padStart(2, '0')}`,
+        })
+      );
+
+      server.use(
+        http.get('/api/endpoint_groups', () => HttpResponse.json(manyGroups))
+      );
+
+      const Wrapped = withTestQueryProvider(
+        withTestRouter(withUserProvider(EnvironmentGroupsTable))
+      );
+      render(<Wrapped />);
+
+      await waitForLoaded();
+
+      await user.click(nextPageBtn());
+
+      const rows = screen.getAllByTestId(/^environment-group-row-/);
+      expect(rows).toHaveLength(5);
+    });
+
+    it('should reset to page 1 when filtering', async () => {
+      const user = userEvent.setup();
+
+      const manyGroups = Array.from({ length: 15 }, (_, i) =>
+        buildGroup({
+          Id: i + 1,
+          Name: `Group ${String(i + 1).padStart(2, '0')}`,
+        })
+      );
+
+      server.use(
+        http.get('/api/endpoint_groups', () => HttpResponse.json(manyGroups))
+      );
+
+      const Wrapped = withTestQueryProvider(
+        withTestRouter(withUserProvider(EnvironmentGroupsTable))
+      );
+      render(<Wrapped />);
+
+      await waitForLoaded();
+
+      // Go to page 2
+      await user.click(nextPageBtn());
+      expect(screen.getAllByTestId(/^environment-group-row-/)).toHaveLength(5);
+
+      // Type a filter - safePage clamps to page 1
+      await user.type(searchInput(), 'Group 0');
+
+      // Should show filtered results from page 1
+      await waitFor(() => {
+        const rows = screen.getAllByTestId(/^environment-group-row-/);
+        expect(rows.length).toBeGreaterThan(0);
+        expect(rows.length).toBeLessThanOrEqual(10);
+      });
+    });
+
+    it('should reset to page 1 when changing sort', async () => {
+      const user = userEvent.setup();
+
+      const manyGroups = Array.from({ length: 15 }, (_, i) =>
+        buildGroup({
+          Id: i + 1,
+          Name: `Group ${String(i + 1).padStart(2, '0')}`,
+        })
+      );
+
+      server.use(
+        http.get('/api/endpoint_groups', () => HttpResponse.json(manyGroups))
+      );
+
+      const Wrapped = withTestQueryProvider(
+        withTestRouter(withUserProvider(EnvironmentGroupsTable))
+      );
+      render(<Wrapped />);
+
+      await waitForLoaded();
+
+      // Go to page 2
+      await user.click(nextPageBtn());
+
+      // Toggle Name sort direction
+      await user.click(sortByName());
+
+      expect(screen.getAllByTestId(/^environment-group-row-/)).toHaveLength(10);
+    });
+  });
+
+  describe('Sort header', () => {
+    it('should render the name sort button', async () => {
+      renderTable();
+
+      await waitForLoaded();
+
+      expect(sortByName()).toBeVisible();
+    });
+
+    it('should render the filter input', async () => {
+      renderTable();
+
+      await waitForLoaded();
+
+      expect(searchInput()).toBeVisible();
+      expect(searchInput()).toHaveAttribute('placeholder', 'Filter groups...');
+    });
+
+    it('should render the add group button in the page header (not in the table)', async () => {
+      // The Add Group button lives in ListView's PageHeader, not in EnvironmentGroupsTable.
+      // This test confirms it is absent from the table component itself.
+      renderTable();
+
+      await waitForLoaded();
+
+      expect(
+        screen.queryByTestId('add-environment-group-button')
+      ).not.toBeInTheDocument();
+    });
+  });
+
+  describe('Pagination - Advanced', () => {
+    it('should navigate to previous page', async () => {
+      const user = userEvent.setup();
+
+      const manyGroups = Array.from({ length: 15 }, (_, i) =>
+        buildGroup({
+          Id: i + 1,
+          Name: `Group ${String(i + 1).padStart(2, '0')}`,
+        })
+      );
+
+      server.use(
+        http.get('/api/endpoint_groups', () => HttpResponse.json(manyGroups))
+      );
+
+      const Wrapped = withTestQueryProvider(
+        withTestRouter(withUserProvider(EnvironmentGroupsTable))
+      );
+      render(<Wrapped />);
+
+      await waitForLoaded();
+
+      // Go to page 2
+      await user.click(nextPageBtn());
+      expect(screen.getAllByTestId(/^environment-group-row-/)).toHaveLength(5);
+
+      // Go back to page 1
+      await user.click(prevPageBtn());
+      expect(screen.getAllByTestId(/^environment-group-row-/)).toHaveLength(10);
+    });
+
+    it('should disable next button on last page', async () => {
+      const user = userEvent.setup();
+
+      const manyGroups = Array.from({ length: 15 }, (_, i) =>
+        buildGroup({
+          Id: i + 1,
+          Name: `Group ${String(i + 1).padStart(2, '0')}`,
+        })
+      );
+
+      server.use(
+        http.get('/api/endpoint_groups', () => HttpResponse.json(manyGroups))
+      );
+
+      const Wrapped = withTestQueryProvider(
+        withTestRouter(withUserProvider(EnvironmentGroupsTable))
+      );
+      render(<Wrapped />);
+
+      await waitForLoaded();
+
+      const next = nextPageBtn();
+      expect(next).not.toBeDisabled();
+
+      // Navigate to the last page (page 2 of 2 with 15 items at 10/page)
+      await user.click(next);
+
+      expect(next).toBeDisabled();
+    });
+
+    it('should change items per page', async () => {
+      const user = userEvent.setup();
+
+      const manyGroups = Array.from({ length: 25 }, (_, i) =>
+        buildGroup({
+          Id: i + 1,
+          Name: `Group ${String(i + 1).padStart(2, '0')}`,
+        })
+      );
+
+      server.use(
+        http.get('/api/endpoint_groups', () => HttpResponse.json(manyGroups))
+      );
+
+      const Wrapped = withTestQueryProvider(
+        withTestRouter(withUserProvider(EnvironmentGroupsTable))
+      );
+      render(<Wrapped />);
+
+      await waitForLoaded();
+
+      // Initial page should have 10 items
+      expect(screen.getAllByTestId(/^environment-group-row-/)).toHaveLength(10);
+
+      // Change to 25 items per page
+      const select = screen.getByRole('combobox');
+      await user.selectOptions(select, '25');
+
+      // Should now show 25 items
+      expect(screen.getAllByTestId(/^environment-group-row-/)).toHaveLength(25);
+    });
+
+    it('should navigate to specific page number', async () => {
+      const user = userEvent.setup();
+
+      const manyGroups = Array.from({ length: 30 }, (_, i) =>
+        buildGroup({
+          Id: i + 1,
+          Name: `Group ${String(i + 1).padStart(2, '0')}`,
+        })
+      );
+
+      server.use(
+        http.get('/api/endpoint_groups', () => HttpResponse.json(manyGroups))
+      );
+
+      const Wrapped = withTestQueryProvider(
+        withTestRouter(withUserProvider(EnvironmentGroupsTable))
+      );
+      render(<Wrapped />);
+
+      await waitForLoaded();
+
+      // Click page 3
+      await user.click(screen.getByRole('button', { name: '3' }));
+
+      // Should show items from page 3
+      const rows = screen.getAllByTestId(/^environment-group-row-/);
+      expect(rows).toHaveLength(10);
+    });
+
+    it('should reset to page 1 after filtering results', async () => {
+      const user = userEvent.setup();
+
+      const manyGroups = Array.from({ length: 25 }, (_, i) =>
+        buildGroup({
+          Id: i + 1,
+          Name: i % 2 === 0 ? `ProductionGroup ${i}` : `Group ${i}`,
+        })
+      );
+
+      server.use(
+        http.get('/api/endpoint_groups', () => HttpResponse.json(manyGroups))
+      );
+
+      const Wrapped = withTestQueryProvider(
+        withTestRouter(withUserProvider(EnvironmentGroupsTable))
+      );
+      render(<Wrapped />);
+
+      await waitForLoaded();
+
+      // Go to page 2
+      await user.click(nextPageBtn());
+
+      // Filter - safePage clamps back to page 1
+      await user.type(searchInput(), 'Production');
+
+      // Should show filtered results from page 1
+      await waitFor(() => {
+        const rows = screen.getAllByTestId(/^environment-group-row-/);
+        expect(rows.length).toBeGreaterThan(0);
+      });
+    });
+  });
+
+  describe('Group Row Features', () => {
+    it('should display ungoverned group', async () => {
+      server.use(
+        http.get('/api/endpoint_groups', () =>
+          HttpResponse.json([
+            buildGroup({
+              Id: 1,
+              Name: 'Unassigned',
+            }),
+          ])
+        )
+      );
+
+      const Wrapped = withTestQueryProvider(
+        withTestRouter(withUserProvider(EnvironmentGroupsTable))
+      );
+      render(<Wrapped />);
+
+      await waitForLoaded();
+
+      expect(
+        screen.getByTestId('environment-group-row-Unassigned')
+      ).toBeInTheDocument();
+    });
+  });
+
+  describe('Combinations - Sorting + Pagination + Filtering', () => {
+    it('should maintain sort order after pagination', async () => {
+      const user = userEvent.setup();
+
+      const manyGroups = Array.from({ length: 25 }, (_, i) =>
+        buildGroup({
+          Id: i + 1,
+          Name: `Group ${String(i + 1).padStart(2, '0')}`,
+        })
+      );
+
+      server.use(
+        http.get('/api/endpoint_groups', () => HttpResponse.json(manyGroups))
+      );
+
+      const Wrapped = withTestQueryProvider(
+        withTestRouter(withUserProvider(EnvironmentGroupsTable))
+      );
+      render(<Wrapped />);
+
+      await waitForLoaded();
+
+      const firstPageOrder = screen
+        .getAllByTestId(/^environment-group-row-/)[0]
+        .getAttribute('data-cy');
+
+      // Go to next page
+      await user.click(nextPageBtn());
+
+      // Go back to first page
+      await user.click(prevPageBtn());
+
+      // Order should be the same
+      const returnedFirstRow = screen
+        .getAllByTestId(/^environment-group-row-/)[0]
+        .getAttribute('data-cy');
+      expect(firstPageOrder).toBe(returnedFirstRow);
+    });
+
+    it('should apply filter and paginate together', async () => {
+      const user = userEvent.setup();
+
+      const manyGroups = Array.from({ length: 20 }, (_, i) =>
+        buildGroup({
+          Id: i + 1,
+          Name: i % 2 === 0 ? `ProdGroup ${i}` : `DevGroup ${i}`,
+        })
+      );
+
+      server.use(
+        http.get('/api/endpoint_groups', () => HttpResponse.json(manyGroups))
+      );
+
+      const Wrapped = withTestQueryProvider(
+        withTestRouter(withUserProvider(EnvironmentGroupsTable))
+      );
+      render(<Wrapped />);
+
+      await waitForLoaded();
+
+      // Filter by "Prod"
+      await user.type(searchInput(), 'Prod');
+
+      // SearchBar debounces input; wait for filtered rows to settle
+      await waitFor(() => {
+        const rows = screen.getAllByTestId(/^environment-group-row-/);
+        expect(rows.length).toBeGreaterThan(0);
+        rows.forEach((row) => {
+          expect(row).toHaveAttribute(
+            'data-cy',
+            expect.stringContaining('ProdGroup')
+          );
+        });
+      });
+    });
+  });
+});
diff --git a/app/react/portainer/environments/environment-groups/ListView/EnvironmentGroupsTable/EnvironmentGroupsTable.tsx b/app/react/portainer/environments/environment-groups/ListView/EnvironmentGroupsTable/EnvironmentGroupsTable.tsx
new file mode 100644
index 0000000..07f10de
--- /dev/null
+++ b/app/react/portainer/environments/environment-groups/ListView/EnvironmentGroupsTable/EnvironmentGroupsTable.tsx
@@ -0,0 +1,93 @@
+import { useMemo } from 'react';
+
+import { useTags } from '@/portainer/tags/queries';
+
+import {
+  SortableGroup,
+  SortableList,
+  SortOption,
+} from '@@/SortableList/SortableList';
+import { useSortableListState } from '@@/SortableList/sortable-list.store';
+
+import { useGroups } from '../../queries/useGroups';
+import { EnvironmentGroup } from '../../types';
+import { isUngoverned } from '../../utils/getPlatformLabel';
+
+import { EnvironmentGroupRow } from './EnvironmentGroupRow';
+
+const SORT_OPTIONS: SortOption[] = [{ key: 'Name', label: 'Name' }];
+
+export function EnvironmentGroupsTable() {
+  const groupsQuery = useGroups();
+  const tagsQuery = useTags();
+  const tableState = useSortableListState('environment_groups', 'Name');
+
+  const sorted = useMemo(() => {
+    const data = groupsQuery.data ?? [];
+    const governed = data.filter((g) => !isUngoverned(g));
+    const ungoverned = data.filter((g) => isUngoverned(g));
+    const sortedGoverned = [...governed].sort((a, b) => {
+      const cmp = a.Name.localeCompare(b.Name);
+      return tableState.sortBy?.desc ? -cmp : cmp;
+    });
+    return [...sortedGoverned, ...ungoverned];
+  }, [groupsQuery.data, tableState.sortBy?.desc]);
+
+  const filtered = useMemo(() => {
+    const term = tableState.search.toLowerCase();
+    if (!term) return sorted;
+    return sorted.filter(
+      (g) =>
+        g.Name.toLowerCase().includes(term) ||
+        g.Description?.toLowerCase().includes(term)
+    );
+  }, [sorted, tableState.search]);
+
+  const pageItems = useMemo(() => {
+    const totalPages = Math.max(
+      1,
+      Math.ceil(filtered.length / tableState.pageSize)
+    );
+    const safePage = Math.min(tableState.page, totalPages - 1);
+    const start = safePage * tableState.pageSize;
+    return filtered.slice(start, start + tableState.pageSize);
+  }, [filtered, tableState.page, tableState.pageSize]);
+
+  const groups = useMemo(() => buildGroups(pageItems), [pageItems]);
+
+  return (
+    <SortableList
+      tableState={tableState}
+      sortOptions={SORT_OPTIONS}
+      groups={groups}
+      totalCount={filtered.length}
+      renderItem={(group) => (
+        <EnvironmentGroupRow group={group} tags={tagsQuery.data} />
+      )}
+      getItemKey={(group) => group.Id}
+      isLoading={groupsQuery.isLoading}
+      searchPlaceholder="Filter groups..."
+      emptyMessage={
+        tableState.search
+          ? 'No groups match your search'
+          : 'No environment groups found'
+      }
+      data-cy="environment-groups-list"
+    />
+  );
+}
+
+function buildGroups(
+  items: EnvironmentGroup[]
+): SortableGroup<EnvironmentGroup>[] {
+  const governed = items.filter((g) => !isUngoverned(g));
+  const ungoverned = items.filter((g) => isUngoverned(g));
+  const result: SortableGroup<EnvironmentGroup>[] = [];
+  if (governed.length) {
+    result.push({ key: 'governed', label: 'Groups', items: governed });
+  }
+  if (ungoverned.length) {
+    result.push({ key: 'ungoverned', label: 'Ungoverned', items: ungoverned });
+  }
+  return result;
+}
diff --git a/app/react/portainer/environments/environment-groups/ListView/ListView.stories.tsx b/app/react/portainer/environments/environment-groups/ListView/ListView.stories.tsx
new file mode 100644
index 0000000..2a9fd08
--- /dev/null
+++ b/app/react/portainer/environments/environment-groups/ListView/ListView.stories.tsx
@@ -0,0 +1,199 @@
+import { Meta, StoryObj } from '@storybook/react-webpack5';
+import { ReactStateDeclaration } from '@uirouter/react';
+import { http, HttpResponse } from 'msw';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+
+import { EnvironmentGroup } from '../types';
+
+import { EnvironmentGroupsTable } from './EnvironmentGroupsTable/EnvironmentGroupsTable';
+
+function buildGroup(
+  overrides: Partial<EnvironmentGroup> & { Id: number; Name: string }
+): EnvironmentGroup {
+  return {
+    Description: '',
+    TagIds: [],
+    ...overrides,
+  };
+}
+
+const sampleGroups: Array<EnvironmentGroup> = [
+  buildGroup({
+    Id: 2,
+    Name: 'Production - AWS',
+    Description: 'Production workloads on AWS EKS',
+    Total: 12,
+    TypeInfo: { Docker: 0, Kubernetes: 12, Podman: 0, Mixed: false },
+  }),
+  buildGroup({
+    Id: 3,
+    Name: 'Staging - Azure',
+    Description: 'Pre-production staging on Azure AKS',
+    Total: 5,
+    TypeInfo: { Docker: 0, Kubernetes: 5, Podman: 0, Mixed: false },
+  }),
+  buildGroup({
+    Id: 4,
+    Name: 'CI/CD Runners',
+    Description: 'Containerised build and test agents',
+    Total: 8,
+    TypeInfo: { Docker: 8, Kubernetes: 0, Podman: 0, Mixed: false },
+  }),
+  buildGroup({
+    Id: 5,
+    Name: 'Dev Workstations',
+    Description: 'Developer local Docker environments',
+    Total: 6,
+    TypeInfo: { Docker: 6, Kubernetes: 0, Podman: 0, Mixed: false },
+  }),
+  buildGroup({
+    Id: 6,
+    Name: 'Edge Devices',
+    Description: 'Edge computing nodes across regional sites',
+    Total: 14,
+    TypeInfo: { Docker: 0, Kubernetes: 0, Podman: 14, Mixed: false },
+  }),
+  buildGroup({
+    Id: 7,
+    Name: 'IoT Gateway Fleet',
+    Description: 'Podman-based IoT gateway nodes',
+    Total: 9,
+    TypeInfo: { Docker: 0, Kubernetes: 0, Podman: 9, Mixed: false },
+  }),
+  buildGroup({
+    Id: 8,
+    Name: 'Platform Services',
+    Description: 'Mixed workloads — Kubernetes, Docker, and Podman',
+    Total: 11,
+    TypeInfo: { Docker: 4, Kubernetes: 5, Podman: 2, Mixed: true },
+  }),
+  buildGroup({
+    Id: 1,
+    Name: 'Unassigned',
+    Description: '',
+    Total: 3,
+    TypeInfo: { Docker: 1, Kubernetes: 1, Podman: 1, Mixed: true },
+  }),
+];
+
+const stateConfig: Array<ReactStateDeclaration> = [
+  { name: 'portainer.groups', component: () => null },
+  { name: 'portainer.groups.group', component: () => null },
+  { name: 'portainer.groups.new', component: () => null },
+];
+
+const WrappedPage = withTestQueryProvider(
+  withTestRouter(withUserProvider(EnvironmentGroupsTable), {
+    route: 'portainer.groups',
+    stateConfig,
+  })
+);
+
+const meta: Meta<typeof WrappedPage> = {
+  component: WrappedPage,
+  title: 'Pages/Environment Groups',
+  parameters: {
+    layout: 'fullscreen',
+  },
+  decorators: [
+    (Story) => (
+      <div className="p-4">
+        <Story />
+      </div>
+    ),
+  ],
+};
+
+export default meta;
+type Story = StoryObj<typeof WrappedPage>;
+
+export const Default: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        http.get('/api/endpoint_groups', () => HttpResponse.json(sampleGroups)),
+      ],
+    },
+  },
+};
+
+export const Empty: Story = {
+  parameters: {
+    msw: {
+      handlers: [http.get('/api/endpoint_groups', () => HttpResponse.json([]))],
+    },
+  },
+};
+
+export const ManyGroups: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        http.get('/api/endpoint_groups', () => {
+          const platforms: Array<Pick<EnvironmentGroup, 'TypeInfo' | 'Total'>> =
+            [
+              {
+                TypeInfo: { Docker: 8, Kubernetes: 0, Podman: 0, Mixed: false },
+                Total: 8,
+              },
+              {
+                TypeInfo: { Docker: 0, Kubernetes: 6, Podman: 0, Mixed: false },
+                Total: 6,
+              },
+              {
+                TypeInfo: { Docker: 3, Kubernetes: 4, Podman: 1, Mixed: true },
+                Total: 8,
+              },
+              {
+                TypeInfo: { Docker: 12, Kubernetes: 0, Podman: 2, Mixed: true },
+                Total: 14,
+              },
+              {
+                TypeInfo: { Docker: 0, Kubernetes: 0, Podman: 5, Mixed: false },
+                Total: 5,
+              },
+            ];
+          const names = [
+            'Production',
+            'Staging',
+            'Development',
+            'Testing',
+            'Lab',
+            'Edge',
+            'Data',
+            'Monitoring',
+            'Security',
+            'Infra',
+          ];
+          const regions = ['AWS', 'Azure', 'GCP', 'On-Premise', 'Hybrid'];
+
+          const groups = Array.from({ length: 30 }, (_, i) => {
+            const p = platforms[i % platforms.length];
+            return buildGroup({
+              Id: i + 2,
+              Name: `${names[i % names.length]} - ${
+                regions[i % regions.length]
+              }`,
+              Description: `Auto-generated group ${i + 1}`,
+              Total: p.Total,
+              TypeInfo: p.TypeInfo,
+            });
+          });
+
+          return HttpResponse.json([
+            ...groups,
+            buildGroup({
+              Id: 1,
+              Name: 'Unassigned',
+              Total: 3,
+              TypeInfo: { Docker: 2, Kubernetes: 1, Podman: 0, Mixed: true },
+            }),
+          ]);
+        }),
+      ],
+    },
+  },
+};
diff --git a/app/react/portainer/environments/environment-groups/ListView/ListView.tsx b/app/react/portainer/environments/environment-groups/ListView/ListView.tsx
new file mode 100644
index 0000000..fb57209
--- /dev/null
+++ b/app/react/portainer/environments/environment-groups/ListView/ListView.tsx
@@ -0,0 +1,24 @@
+import { PageHeader } from '@@/PageHeader';
+import { AddButton } from '@@/buttons';
+
+import { EnvironmentGroupsTable } from './EnvironmentGroupsTable/EnvironmentGroupsTable';
+
+export function ListView() {
+  return (
+    <>
+      <PageHeader
+        title="Environment Groups"
+        breadcrumbs="Environment group management"
+        reload
+      >
+        <AddButton to=".new" data-cy="add-environment-group-button">
+          Add group
+        </AddButton>
+      </PageHeader>
+
+      <div className="mx-5 mb-5">
+        <EnvironmentGroupsTable />
+      </div>
+    </>
+  );
+}
diff --git a/app/react/portainer/environments/environment-groups/ListView/index.ts b/app/react/portainer/environments/environment-groups/ListView/index.ts
new file mode 100644
index 0000000..dd06dfd
--- /dev/null
+++ b/app/react/portainer/environments/environment-groups/ListView/index.ts
@@ -0,0 +1 @@
+export { ListView } from './ListView';
diff --git a/app/react/portainer/environments/environment-groups/components/AssociatedEnvironmentsSelector/AddEnvironmentsDrawer.tsx b/app/react/portainer/environments/environment-groups/components/AssociatedEnvironmentsSelector/AddEnvironmentsDrawer.tsx
new file mode 100644
index 0000000..cdb31b1
--- /dev/null
+++ b/app/react/portainer/environments/environment-groups/components/AssociatedEnvironmentsSelector/AddEnvironmentsDrawer.tsx
@@ -0,0 +1,181 @@
+import clsx from 'clsx';
+import { useState } from 'react';
+import { createColumnHelper } from '@tanstack/react-table';
+import { truncate } from 'lodash';
+
+import { useEnvironmentList } from '@/react/portainer/environments/queries';
+import { isSortType } from '@/react/portainer/environments/queries/useEnvironmentList';
+import {
+  EnvironmentId,
+  EnvironmentGroupId,
+} from '@/react/portainer/environments/types';
+
+import { Datatable } from '@@/datatables';
+import { useTableStateWithoutStorage } from '@@/datatables/useTableState';
+import { withControlledSelected } from '@@/datatables/extend-options/withControlledSelected';
+import { TableRow } from '@@/datatables/TableRow';
+import { Sheet, SheetContent, SheetClose, SheetHeader } from '@@/Sheet';
+import { Button, LoadingButton } from '@@/buttons';
+
+import { EnvironmentTableData } from './types';
+
+const columnHelper = createColumnHelper<EnvironmentTableData>();
+
+const columns = [
+  columnHelper.accessor('Name', {
+    header: 'Name',
+    id: 'Name',
+    cell: ({ getValue }) => (
+      <span title={getValue()}>{truncate(getValue(), { length: 64 })}</span>
+    ),
+  }),
+];
+
+interface Props {
+  open: boolean;
+  onClose(): void;
+  /** IDs already in the group — excluded from the available list. Use for create-form contexts where no group ID exists yet. */
+  excludeIds?: EnvironmentId[];
+  /** Endpoint group IDs whose members are excluded from the available list. Prefer this over excludeIds when a group ID is available, to avoid sending thousands of individual IDs in the URL. */
+  excludeGroupIds?: EnvironmentGroupId[];
+  /** Called with the full env objects so callers can display names or extract IDs.
+   *  Returns true if the add was committed, false if the user cancelled. */
+  onAdd:
+    | ((envs: EnvironmentTableData[]) => Promise<boolean>)
+    | ((envs: EnvironmentTableData[]) => void);
+  /** Loading state from the parent — disables buttons and shows spinner */
+  isLoading?: boolean;
+}
+
+export function AddEnvironmentsDrawer({
+  open,
+  onClose,
+  excludeIds,
+  excludeGroupIds,
+  onAdd,
+  isLoading,
+}: Props) {
+  const tableState = useTableStateWithoutStorage('Name');
+  const [selectedIds, setSelectedIds] = useState<string[]>([]);
+  const [selectedEnvs, setSelectedEnvs] = useState<EnvironmentTableData[]>([]);
+  const [page, setPage] = useState(0);
+
+  const {
+    environments,
+    totalCount,
+    isLoading: isEnvsLoading,
+  } = useEnvironmentList({
+    pageLimit: tableState.pageSize,
+    page: page + 1,
+    search: tableState.search,
+    sort: isSortType(tableState.sortBy?.id) ? tableState.sortBy.id : 'Name',
+    order: tableState.sortBy?.desc ? 'desc' : 'asc',
+    groupIds: [1],
+    excludeIds,
+    excludeGroupIds,
+  });
+
+  function handleSelectionChange(ids: string[]) {
+    setSelectedIds(ids);
+    const currentDataMap = new Map(
+      (environments ?? []).map((env) => [String(env.Id), env])
+    );
+    setSelectedEnvs((prev) => {
+      const prevMap = new Map(prev.map((e) => [String(e.Id), e]));
+      // Keep already-tracked envs that remain selected
+      const kept = prev.filter((e) => ids.includes(String(e.Id)));
+      // Add newly selected envs from the current page
+      const added = ids
+        .filter((id) => !prevMap.has(id) && currentDataMap.has(id))
+        .map((id) => currentDataMap.get(id)!);
+      return [...kept, ...added];
+    });
+  }
+
+  async function handleAdd() {
+    const committed = await onAdd(selectedEnvs);
+    // Close only if the add was committed or there was no confirmation needed
+    if (committed || committed === undefined) {
+      resetSelection();
+      onClose();
+    }
+  }
+
+  function resetSelection() {
+    setSelectedIds([]);
+    setSelectedEnvs([]);
+  }
+
+  return (
+    <Sheet
+      open={open}
+      onOpenChange={(isOpen) => {
+        if (!isOpen) {
+          resetSelection();
+          onClose();
+        }
+      }}
+    >
+      <SheetContent className="flex flex-col !p-0">
+        <div className="flex-1 overflow-auto p-4">
+          <SheetHeader title="Add environments" />
+          <Datatable<EnvironmentTableData>
+            title="Available environments"
+            columns={columns}
+            dataset={environments ?? []}
+            settingsManager={tableState}
+            isLoading={isEnvsLoading}
+            isServerSidePagination
+            page={page}
+            onPageChange={setPage}
+            totalCount={totalCount}
+            getRowId={(row) => String(row.Id)}
+            renderRow={(row) => (
+              <TableRow<EnvironmentTableData>
+                cells={row.getVisibleCells()}
+                onClick={() => row.toggleSelected()}
+                className={clsx({ active: row.getIsSelected() })}
+                aria-selected={row.getIsSelected()}
+              />
+            )}
+            extendTableOptions={withControlledSelected(
+              handleSelectionChange,
+              selectedIds
+            )}
+            data-cy="add-environments-drawer-table"
+          />
+        </div>
+        {/* Don't use StickyFooter here. StickyFooter has classes for the menu to the left that we don't want here */}
+        <div
+          className={clsx(
+            'sticky bottom-0 left-0 right-0 z-50 h-16 w-full justify-end gap-4',
+            'flex items-center px-6',
+            'border-t border-[var(--border-widget-color)] bg-[var(--bg-widget-color)]',
+            'shadow-[0_-2px_5px_rgba(0,0,0,0.1)]'
+          )}
+        >
+          <SheetClose asChild>
+            <Button
+              color="default"
+              disabled={isLoading}
+              data-cy="add-environments-cancel-button"
+              size="medium"
+            >
+              Cancel
+            </Button>
+          </SheetClose>
+          <LoadingButton
+            onClick={handleAdd}
+            disabled={selectedIds.length === 0 || isLoading}
+            isLoading={!!isLoading}
+            loadingText="Adding..."
+            data-cy="add-environments-confirm-button"
+            size="medium"
+          >
+            Confirm
+          </LoadingButton>
+        </div>
+      </SheetContent>
+    </Sheet>
+  );
+}
diff --git a/app/react/portainer/environments/environment-groups/components/AssociatedEnvironmentsSelector/AssociatedEnvironmentsSelector.test.tsx b/app/react/portainer/environments/environment-groups/components/AssociatedEnvironmentsSelector/AssociatedEnvironmentsSelector.test.tsx
new file mode 100644
index 0000000..0310abe
--- /dev/null
+++ b/app/react/portainer/environments/environment-groups/components/AssociatedEnvironmentsSelector/AssociatedEnvironmentsSelector.test.tsx
@@ -0,0 +1,214 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { vi } from 'vitest';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { server } from '@/setup-tests/server';
+import { createMockEnvironment } from '@/react-tools/test-mocks';
+import {
+  Environment,
+  EnvironmentId,
+} from '@/react/portainer/environments/types';
+
+import { EnvironmentGroup } from '../../types';
+
+import { AssociatedEnvironmentsSelector } from './AssociatedEnvironmentsSelector';
+
+vi.mock('@@/modals/confirm', () => ({
+  openConfirm: vi.fn().mockResolvedValue(true),
+  confirmDelete: vi.fn().mockResolvedValue(true),
+}));
+
+const mockGroup: EnvironmentGroup = {
+  Id: 2,
+  Name: 'Test Group',
+  Description: '',
+  TagIds: [],
+};
+
+function createEnv(id: EnvironmentId, name: string): Partial<Environment> {
+  return createMockEnvironment({ Id: id, Name: name });
+}
+
+function setupMockServer({
+  associatedEnvs = [] as Array<Partial<Environment>>,
+  availableEnvs = [] as Array<Partial<Environment>>,
+  onPut = undefined as ((body: unknown) => void) | undefined,
+} = {}) {
+  server.use(
+    http.get('/api/endpoint_groups/2', () => HttpResponse.json(mockGroup)),
+    http.get('/api/endpoints', ({ request }) => {
+      const url = new URL(request.url);
+      const groupIds = [
+        ...url.searchParams.getAll('groupIds'),
+        ...url.searchParams.getAll('groupIds[]'),
+      ];
+
+      function makeResponse(envs: Array<Partial<Environment>>) {
+        return HttpResponse.json(envs, {
+          headers: {
+            'x-total-count': String(envs.length),
+            'x-total-available': String(envs.length),
+          },
+        });
+      }
+
+      if (groupIds.includes('2')) return makeResponse(associatedEnvs);
+      if (groupIds.includes('1')) return makeResponse(availableEnvs);
+      return makeResponse([]);
+    }),
+    http.put('/api/endpoint_groups/2', async ({ request }) => {
+      const body = await request.json();
+      onPut?.(body);
+      return HttpResponse.json(mockGroup);
+    })
+  );
+}
+
+function renderComponent(groupId = 2) {
+  const Wrapped = withTestQueryProvider(() => (
+    <AssociatedEnvironmentsSelector groupId={groupId} readOnly={false} />
+  ));
+
+  return render(<Wrapped />);
+}
+
+describe('AssociatedEnvironmentsSelector', () => {
+  describe('Rendering', () => {
+    it('renders the associated environments table', async () => {
+      setupMockServer();
+      renderComponent();
+
+      expect(
+        await screen.findByRole('heading', { name: 'Associated environments' })
+      ).toBeVisible();
+    });
+
+    it('renders an Add button', async () => {
+      setupMockServer();
+      renderComponent();
+
+      expect(
+        await screen.findByTestId('add-environments-button')
+      ).toBeInTheDocument();
+    });
+
+    it('renders a Remove button that is initially disabled', async () => {
+      setupMockServer({ associatedEnvs: [createEnv(10, 'my-env')] });
+      renderComponent();
+
+      await screen.findByText('my-env');
+
+      const removeBtn = screen.getByTestId('remove-environments-button');
+      expect(removeBtn).toBeDisabled();
+    });
+
+    it('displays environments returned by the API', async () => {
+      setupMockServer({ associatedEnvs: [createEnv(10, 'env-alpha')] });
+      renderComponent();
+
+      expect(await screen.findByText('env-alpha')).toBeInTheDocument();
+    });
+  });
+
+  describe('Removing environments', () => {
+    it('enables Remove button when a row is selected', async () => {
+      const user = userEvent.setup();
+      setupMockServer({ associatedEnvs: [createEnv(10, 'env-to-remove')] });
+      renderComponent();
+
+      await screen.findByText('env-to-remove');
+
+      // First checkbox is the select-all header, second is the first row
+      const checkboxes = screen.getAllByRole('checkbox');
+      await user.click(checkboxes[1]);
+
+      await waitFor(() => {
+        expect(screen.getByTestId('remove-environments-button')).toBeEnabled();
+      });
+    });
+
+    it('calls PUT with filtered environment IDs after confirming remove', async () => {
+      const user = userEvent.setup();
+      let requestBody: unknown;
+
+      setupMockServer({
+        associatedEnvs: [createEnv(10, 'env-a'), createEnv(11, 'env-b')],
+        onPut: (body) => {
+          requestBody = body;
+        },
+      });
+      renderComponent();
+
+      await screen.findByText('env-a');
+
+      // Select first row checkbox
+      const checkboxes = screen.getAllByRole('checkbox');
+      await user.click(checkboxes[1]);
+
+      const removeBtn = await screen.findByTestId('remove-environments-button');
+      await waitFor(() => expect(removeBtn).toBeEnabled());
+      await user.click(removeBtn);
+
+      await waitFor(() => {
+        expect(requestBody).toMatchObject({
+          AssociatedEndpoints: [11],
+        });
+      });
+    });
+  });
+
+  describe('Adding environments (drawer)', () => {
+    it('opens the drawer when Add button is clicked', async () => {
+      const user = userEvent.setup();
+      setupMockServer({ availableEnvs: [createEnv(20, 'available-env')] });
+      renderComponent();
+
+      const addBtn = await screen.findByTestId('add-environments-button');
+      await user.click(addBtn);
+
+      expect(await screen.findByText('Add environments')).toBeVisible();
+    });
+
+    it('calls PUT with merged IDs when environments are added from drawer', async () => {
+      const user = userEvent.setup();
+      let requestBody: unknown;
+
+      setupMockServer({
+        associatedEnvs: [createEnv(10, 'existing-env')],
+        availableEnvs: [createEnv(20, 'new-env')],
+        onPut: (body) => {
+          requestBody = body;
+        },
+      });
+      renderComponent();
+
+      // Open drawer
+      const addBtn = await screen.findByTestId('add-environments-button');
+      await user.click(addBtn);
+
+      // Wait for drawer to open and available env to appear
+      await screen.findByText('Add environments');
+      await screen.findByText('new-env');
+
+      // Select the available env — find the drawer's checkboxes
+      // The drawer table has its own checkboxes after the main table ones
+      const allCheckboxes = screen.getAllByRole('checkbox');
+      // Last checkbox belongs to the drawer table row
+      await user.click(allCheckboxes[allCheckboxes.length - 1]);
+
+      // Click the Add button in the drawer footer
+      const confirmAddBtn = screen.getByTestId(
+        'add-environments-confirm-button'
+      );
+      await user.click(confirmAddBtn);
+
+      await waitFor(() => {
+        expect(requestBody).toMatchObject({
+          AssociatedEndpoints: expect.arrayContaining([10, 20]),
+        });
+      });
+    });
+  });
+});
diff --git a/app/react/portainer/environments/environment-groups/components/AssociatedEnvironmentsSelector/AssociatedEnvironmentsSelector.tsx b/app/react/portainer/environments/environment-groups/components/AssociatedEnvironmentsSelector/AssociatedEnvironmentsSelector.tsx
new file mode 100644
index 0000000..c2a0982
--- /dev/null
+++ b/app/react/portainer/environments/environment-groups/components/AssociatedEnvironmentsSelector/AssociatedEnvironmentsSelector.tsx
@@ -0,0 +1,108 @@
+import { useState } from 'react';
+
+import { useEnvironmentList } from '@/react/portainer/environments/queries';
+import { EnvironmentGroupId } from '@/react/portainer/environments/types';
+
+import { openConfirm } from '@@/modals/confirm';
+import { buildConfirmButton } from '@@/modals/utils';
+
+import { useGroup } from '../../queries/useGroup';
+import { useUpdateGroupMutation } from '../../queries/useUpdateGroupMutation';
+
+import { EnvironmentTableData } from './types';
+import { AssociatedEnvironmentsTable } from './AssociatedEnvironmentsTable';
+import { AddEnvironmentsDrawer } from './AddEnvironmentsDrawer';
+
+interface Props {
+  groupId: EnvironmentGroupId;
+  /* For unassigned group, don't show the add/remove buttons and hide the checkbox */
+  readOnly: boolean;
+  externalDrawerOpen?: boolean;
+  onExternalDrawerClose?: () => void;
+}
+
+export function AssociatedEnvironmentsSelector({
+  groupId,
+  readOnly,
+  externalDrawerOpen,
+  onExternalDrawerClose,
+}: Props) {
+  const [drawerOpen, setDrawerOpen] = useState(false);
+
+  const isDrawerOpen = drawerOpen || (externalDrawerOpen ?? false);
+
+  function closeDrawer() {
+    setDrawerOpen(false);
+    onExternalDrawerClose?.();
+  }
+
+  const groupQuery = useGroup(groupId);
+  const environmentsQuery = useEnvironmentList({
+    groupIds: [groupId],
+    pageLimit: 0,
+  });
+  const updateMutation = useUpdateGroupMutation();
+
+  const currentEnvironments = environmentsQuery.environments ?? [];
+  const currentIds = currentEnvironments.map((e) => e.Id);
+
+  return (
+    <>
+      <AssociatedEnvironmentsTable
+        title="Associated environments"
+        environments={currentEnvironments}
+        isLoading={environmentsQuery.isLoading}
+        onRemove={handleRemove}
+        onOpenAddDrawer={() => setDrawerOpen(true)}
+        isRemoving={updateMutation.isLoading}
+        data-cy="group-associatedEndpoints"
+        readOnly={readOnly}
+      />
+
+      <AddEnvironmentsDrawer
+        open={isDrawerOpen}
+        onClose={closeDrawer}
+        excludeGroupIds={[groupId]}
+        onAdd={handleAdd}
+        isLoading={updateMutation.isLoading}
+      />
+    </>
+  );
+
+  function handleRemove(selected: EnvironmentTableData[]) {
+    const selectedIds = new Set(selected.map((e) => e.Id));
+    const remainingIds = currentIds.filter((id) => !selectedIds.has(id));
+
+    updateMutation.mutate({
+      id: groupId,
+      name: groupQuery.data?.Name ?? '',
+      description: groupQuery.data?.Description,
+      tagIds: groupQuery.data?.TagIds,
+      associatedEnvironments: remainingIds,
+    });
+  }
+
+  async function handleAdd(newEnvs: EnvironmentTableData[]): Promise<boolean> {
+    const confirmed = await openConfirm({
+      title: 'Are you sure?',
+      message: `Are you sure you want to add the selected environment(s) to this group?`,
+      confirmButton: buildConfirmButton('Add'),
+    });
+
+    if (!confirmed) return false;
+
+    const mergedIds = [
+      ...new Set([...currentIds, ...newEnvs.map((e) => e.Id)]),
+    ];
+
+    updateMutation.mutate({
+      id: groupId,
+      name: groupQuery.data?.Name ?? '',
+      description: groupQuery.data?.Description,
+      tagIds: groupQuery.data?.TagIds,
+      associatedEnvironments: mergedIds,
+    });
+
+    return true;
+  }
+}
diff --git a/app/react/portainer/environments/environment-groups/components/AssociatedEnvironmentsSelector/AssociatedEnvironmentsTable.tsx b/app/react/portainer/environments/environment-groups/components/AssociatedEnvironmentsSelector/AssociatedEnvironmentsTable.tsx
new file mode 100644
index 0000000..241b7ba
--- /dev/null
+++ b/app/react/portainer/environments/environment-groups/components/AssociatedEnvironmentsSelector/AssociatedEnvironmentsTable.tsx
@@ -0,0 +1,122 @@
+import { createColumnHelper } from '@tanstack/react-table';
+import { truncate } from 'lodash';
+import { useMemo, useState } from 'react';
+import { Plus } from 'lucide-react';
+import clsx from 'clsx';
+
+import { AutomationTestingProps } from '@/types';
+
+import { useTableStateWithoutStorage } from '@@/datatables/useTableState';
+import { Datatable } from '@@/datatables';
+import { withControlledSelected } from '@@/datatables/extend-options/withControlledSelected';
+import { TableRow } from '@@/datatables/TableRow';
+import { DeleteButton } from '@@/buttons/DeleteButton';
+import { Button } from '@@/buttons';
+
+import { EnvironmentTableData } from './types';
+
+const columnHelper = createColumnHelper<EnvironmentTableData>();
+
+interface Props extends AutomationTestingProps {
+  title: string;
+  environments: Array<EnvironmentTableData>;
+  onRemove(selected: EnvironmentTableData[]): void;
+  onOpenAddDrawer(): void;
+  isRemoving?: boolean;
+  isLoading?: boolean;
+  /** When false, Remove fires immediately without a confirmation dialog (e.g. create mode) */
+  confirmRemove?: boolean;
+  /** When true, don't show the add/remove buttons and hide the checkbox */
+  readOnly?: boolean;
+  /** Use when the datatable isn't a standalone widget, like in a form */
+  noWidget?: boolean;
+}
+
+export function AssociatedEnvironmentsTable({
+  title,
+  environments,
+  onRemove,
+  onOpenAddDrawer,
+  isRemoving,
+  isLoading,
+  confirmRemove = true,
+  readOnly = false,
+  'data-cy': dataCy,
+  noWidget,
+}: Props) {
+  const tableState = useTableStateWithoutStorage('Name');
+  const [selectedIds, setSelectedIds] = useState<string[]>([]);
+  const columns = useMemo(() => buildColumns(), []);
+
+  return (
+    <Datatable<EnvironmentTableData>
+      noWidget={noWidget}
+      disableSelect={readOnly}
+      isLoading={isLoading}
+      title={title}
+      columns={columns}
+      settingsManager={tableState}
+      dataset={environments}
+      getRowId={(row) => String(row.Id)}
+      renderRow={(row) => (
+        <TableRow<EnvironmentTableData>
+          cells={row.getVisibleCells()}
+          onClick={() => row.toggleSelected()}
+          className={clsx({ active: row.getIsSelected() })}
+          aria-selected={row.getIsSelected()}
+        />
+      )}
+      extendTableOptions={withControlledSelected(setSelectedIds, selectedIds)}
+      renderTableActions={(selectedItems) =>
+        readOnly ? null : (
+          <>
+            {confirmRemove ? (
+              <DeleteButton
+                disabled={selectedItems.length === 0}
+                isLoading={isRemoving}
+                confirmMessage="Are you sure you want to remove the selected environment(s) from this group?"
+                onConfirmed={() => handleRemove(selectedItems)}
+                data-cy="remove-environments-button"
+                type="button"
+              />
+            ) : (
+              <DeleteButton
+                disabled={selectedItems.length === 0}
+                onClick={() => {
+                  handleRemove(selectedItems);
+                }}
+                data-cy="remove-environments-button"
+                type="button"
+              />
+            )}
+            <Button
+              icon={Plus}
+              onClick={onOpenAddDrawer}
+              data-cy="add-environments-button"
+            >
+              Add
+            </Button>
+          </>
+        )
+      }
+      data-cy={dataCy || 'environment-table'}
+    />
+  );
+
+  function handleRemove(selectedItems: EnvironmentTableData[]) {
+    onRemove(selectedItems);
+    setSelectedIds([]);
+  }
+}
+
+function buildColumns() {
+  return [
+    columnHelper.accessor('Name', {
+      header: 'Name',
+      id: 'Name',
+      cell: ({ getValue }) => (
+        <span title={getValue()}>{truncate(getValue(), { length: 64 })}</span>
+      ),
+    }),
+  ];
+}
diff --git a/app/react/portainer/environments/environment-groups/components/AssociatedEnvironmentsSelector/FormModeEnvironmentsSelector.tsx b/app/react/portainer/environments/environment-groups/components/AssociatedEnvironmentsSelector/FormModeEnvironmentsSelector.tsx
new file mode 100644
index 0000000..c422d72
--- /dev/null
+++ b/app/react/portainer/environments/environment-groups/components/AssociatedEnvironmentsSelector/FormModeEnvironmentsSelector.tsx
@@ -0,0 +1,68 @@
+import { useState } from 'react';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { FormSection } from '@@/form-components/FormSection';
+import { Widget, WidgetBody } from '@@/Widget';
+
+import { EnvironmentTableData } from './types';
+import { AssociatedEnvironmentsTable } from './AssociatedEnvironmentsTable';
+import { AddEnvironmentsDrawer } from './AddEnvironmentsDrawer';
+
+interface Props {
+  selectedIds: EnvironmentId[];
+  onChange(ids: EnvironmentId[]): void;
+}
+
+/**
+ * Similar to AssociatedEnvironmentsSelector, but instead of making API calls and getting the environment list from the server, it holds the the selected environments and ids in local state.
+ *
+ * This is because on create, there is no group to add / remove environments from yet.
+ */
+export function FormModeEnvironmentsSelector({ selectedIds, onChange }: Props) {
+  const [drawerOpen, setDrawerOpen] = useState(false);
+  const [selectedEnvironments, setSelectedEnvironments] = useState<
+    EnvironmentTableData[]
+  >([]);
+
+  return (
+    <FormSection title="Associate environments">
+      <p className="small text-muted">
+        Associate environments to this group by clicking the add button below.
+      </p>
+      <Widget>
+        <WidgetBody className="no-padding">
+          <AssociatedEnvironmentsTable
+            noWidget
+            title="Associated environments"
+            environments={selectedEnvironments}
+            onRemove={handleRemove}
+            onOpenAddDrawer={() => setDrawerOpen(true)}
+            confirmRemove={false}
+            data-cy="group-associatedEndpoints"
+          />
+        </WidgetBody>
+      </Widget>
+
+      <AddEnvironmentsDrawer
+        open={drawerOpen}
+        onClose={() => setDrawerOpen(false)}
+        excludeIds={selectedIds}
+        onAdd={handleAdd}
+      />
+    </FormSection>
+  );
+
+  async function handleRemove(toRemove: EnvironmentTableData[]) {
+    const removeIds = new Set(toRemove.map((env) => env.Id));
+    setSelectedEnvironments((prev) => prev.filter((e) => !removeIds.has(e.Id)));
+    onChange(selectedIds.filter((id) => !removeIds.has(id)));
+  }
+
+  function handleAdd(newEnvs: EnvironmentTableData[]) {
+    const existingIds = new Set(selectedIds);
+    const toAdd = newEnvs.filter((e) => !existingIds.has(e.Id));
+    setSelectedEnvironments((prev) => [...prev, ...toAdd]);
+    onChange([...selectedIds, ...toAdd.map((e) => e.Id)]);
+  }
+}
diff --git a/app/react/portainer/environments/environment-groups/components/AssociatedEnvironmentsSelector/types.ts b/app/react/portainer/environments/environment-groups/components/AssociatedEnvironmentsSelector/types.ts
new file mode 100644
index 0000000..453fb97
--- /dev/null
+++ b/app/react/portainer/environments/environment-groups/components/AssociatedEnvironmentsSelector/types.ts
@@ -0,0 +1,3 @@
+import { Environment } from '@/react/portainer/environments/types';
+
+export type EnvironmentTableData = Pick<Environment, 'Name' | 'Id'>;
diff --git a/app/react/portainer/environments/environment-groups/components/EnvironmentTypeBreakdown.test.tsx b/app/react/portainer/environments/environment-groups/components/EnvironmentTypeBreakdown.test.tsx
new file mode 100644
index 0000000..4e72221
--- /dev/null
+++ b/app/react/portainer/environments/environment-groups/components/EnvironmentTypeBreakdown.test.tsx
@@ -0,0 +1,109 @@
+import { render, screen } from '@testing-library/react';
+
+import { EnvironmentGroup } from '../types';
+
+import { EnvironmentTypeBreakdown } from './EnvironmentTypeBreakdown';
+
+function buildGroup(
+  overrides: Partial<EnvironmentGroup> = {}
+): EnvironmentGroup {
+  return {
+    Id: 2,
+    Name: 'test-group',
+    Description: '',
+    TagIds: [],
+    ...overrides,
+  };
+}
+
+describe('EnvironmentTypeBreakdown', () => {
+  it('renders nothing when Total is 0', () => {
+    const { container } = render(
+      <EnvironmentTypeBreakdown group={buildGroup({ Total: 0 })} />
+    );
+    expect(container).toBeEmptyDOMElement();
+  });
+
+  it('renders nothing when Total is undefined', () => {
+    const { container } = render(
+      <EnvironmentTypeBreakdown group={buildGroup()} />
+    );
+    expect(container).toBeEmptyDOMElement();
+  });
+
+  it('renders singular environment count when TypeInfo is absent', () => {
+    render(<EnvironmentTypeBreakdown group={buildGroup({ Total: 1 })} />);
+    expect(screen.getByText('1 Environment')).toBeInTheDocument();
+  });
+
+  it('renders plural environment count when TypeInfo is absent', () => {
+    render(<EnvironmentTypeBreakdown group={buildGroup({ Total: 5 })} />);
+    expect(screen.getByText('5 Environments')).toBeInTheDocument();
+  });
+
+  it('applies data-cy attribute using group name', () => {
+    render(<EnvironmentTypeBreakdown group={buildGroup({ Total: 3 })} />);
+    expect(
+      screen.getByTestId('environment-group-size_test-group')
+    ).toBeInTheDocument();
+  });
+
+  it('renders Kubernetes logo and count', () => {
+    render(
+      <EnvironmentTypeBreakdown
+        group={buildGroup({
+          Total: 2,
+          TypeInfo: { Kubernetes: 2, Docker: 0, Podman: 0, Mixed: false },
+        })}
+      />
+    );
+    expect(screen.getByAltText('Kubernetes')).toBeInTheDocument();
+    expect(screen.getByText('2')).toBeInTheDocument();
+    expect(screen.queryByAltText('Docker')).not.toBeInTheDocument();
+    expect(screen.queryByAltText('Podman')).not.toBeInTheDocument();
+  });
+
+  it('renders Docker logo and count', () => {
+    render(
+      <EnvironmentTypeBreakdown
+        group={buildGroup({
+          Total: 3,
+          TypeInfo: { Kubernetes: 0, Docker: 3, Podman: 0, Mixed: false },
+        })}
+      />
+    );
+    expect(screen.getByAltText('Docker')).toBeInTheDocument();
+    expect(screen.getByText('3')).toBeInTheDocument();
+    expect(screen.queryByAltText('Kubernetes')).not.toBeInTheDocument();
+    expect(screen.queryByAltText('Podman')).not.toBeInTheDocument();
+  });
+
+  it('renders Podman logo and count', () => {
+    render(
+      <EnvironmentTypeBreakdown
+        group={buildGroup({
+          Total: 1,
+          TypeInfo: { Kubernetes: 0, Docker: 0, Podman: 1, Mixed: true },
+        })}
+      />
+    );
+    expect(screen.getByAltText('Podman')).toBeInTheDocument();
+    expect(screen.getByText('1')).toBeInTheDocument();
+    expect(screen.queryByAltText('Kubernetes')).not.toBeInTheDocument();
+    expect(screen.queryByAltText('Docker')).not.toBeInTheDocument();
+  });
+
+  it('renders all three logos when all platform types are present', () => {
+    render(
+      <EnvironmentTypeBreakdown
+        group={buildGroup({
+          Total: 6,
+          TypeInfo: { Kubernetes: 2, Docker: 3, Podman: 1, Mixed: true },
+        })}
+      />
+    );
+    expect(screen.getByAltText('Kubernetes')).toBeInTheDocument();
+    expect(screen.getByAltText('Docker')).toBeInTheDocument();
+    expect(screen.getByAltText('Podman')).toBeInTheDocument();
+  });
+});
diff --git a/app/react/portainer/environments/environment-groups/components/EnvironmentTypeBreakdown.tsx b/app/react/portainer/environments/environment-groups/components/EnvironmentTypeBreakdown.tsx
new file mode 100644
index 0000000..4081832
--- /dev/null
+++ b/app/react/portainer/environments/environment-groups/components/EnvironmentTypeBreakdown.tsx
@@ -0,0 +1,61 @@
+import clsx from 'clsx';
+
+import KubernetesLogo from '@/assets/ico/vendor/kubernetes.svg';
+import DockerLogo from '@/assets/ico/vendor/docker.svg';
+import PodmanLogo from '@/assets/ico/vendor/podman.svg';
+
+import { EnvironmentGroup } from '../types';
+
+interface Props {
+  group: EnvironmentGroup;
+  className?: string;
+}
+
+export function EnvironmentTypeBreakdown({ group, className }: Props) {
+  if (!group.Total || group.Total === 0) {
+    return null;
+  }
+
+  if (!group.TypeInfo) {
+    return (
+      <span
+        className={className}
+        data-cy={`environment-group-size_${group.Name}`}
+      >
+        {group.Total} {group.Total === 1 ? 'Environment' : 'Environments'}
+      </span>
+    );
+  }
+
+  return (
+    <div
+      className={clsx('flex items-center gap-3', className)}
+      data-cy={`environment-group-size_${group.Name}`}
+    >
+      {group.TypeInfo.Kubernetes > 0 && (
+        <div className="flex items-center gap-1">
+          <img src={KubernetesLogo} alt="Kubernetes" className="h-4 w-4" />
+          <span>
+            <b>{group.TypeInfo.Kubernetes}</b> Kubernetes
+          </span>
+        </div>
+      )}
+      {group.TypeInfo.Docker > 0 && (
+        <div className="flex items-center gap-1">
+          <img src={DockerLogo} alt="Docker" className="h-4 w-4" />
+          <span>
+            <b>{group.TypeInfo.Docker}</b> Docker
+          </span>
+        </div>
+      )}
+      {group.TypeInfo.Podman > 0 && (
+        <div className="flex items-center gap-1">
+          <img src={PodmanLogo} alt="Podman" className="h-4 w-4" />
+          <span>
+            <b>{group.TypeInfo.Podman}</b> Podman
+          </span>
+        </div>
+      )}
+    </div>
+  );
+}
diff --git a/app/react/portainer/environments/environment-groups/components/GroupForm.test.tsx b/app/react/portainer/environments/environment-groups/components/GroupForm.test.tsx
new file mode 100644
index 0000000..9bb7999
--- /dev/null
+++ b/app/react/portainer/environments/environment-groups/components/GroupForm.test.tsx
@@ -0,0 +1,317 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { vi } from 'vitest';
+import { http, HttpResponse } from 'msw';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { server } from '@/setup-tests/server';
+
+import { GroupForm, GroupFormValues } from './GroupForm';
+
+vi.mock('@/react/hooks/useCanExit', () => ({
+  useCanExit: vi.fn(),
+}));
+
+function renderGroupForm({
+  initialValues = {
+    name: '',
+    description: '',
+    tagIds: [],
+  },
+  onSubmit = vi.fn(),
+  submitLabel = 'Create',
+  submitLoadingLabel = 'Creating...',
+  groupId,
+}: {
+  initialValues?: GroupFormValues;
+  onSubmit?: (values: GroupFormValues) => Promise<void>;
+  submitLabel?: string;
+  submitLoadingLabel?: string;
+  groupId?: number;
+} = {}) {
+  // Mock tag endpoints
+  server.use(
+    http.get('/api/tags', () =>
+      HttpResponse.json([
+        { ID: 1, Name: 'production' },
+        { ID: 2, Name: 'staging' },
+      ])
+    ),
+    // Mock environments list for AssociatedEnvironmentsSelector and InlineAvailableEnvironmentsTable
+    http.get('/api/endpoints', () =>
+      HttpResponse.json([], {
+        headers: {
+          'x-total-count': '0',
+          'x-total-available': '0',
+        },
+      })
+    ),
+    // Mock group endpoint for AssociatedEnvironmentsSelector (edit mode)
+    http.get('/api/endpoint_groups/:id', ({ params }) =>
+      HttpResponse.json({
+        Id: Number(params.id),
+        Name: 'Test Group',
+        Description: '',
+        TagIds: [],
+        Policies: [],
+      })
+    )
+  );
+
+  const Wrapped = withTestQueryProvider(
+    withTestRouter(
+      withUserProvider(() => (
+        <GroupForm
+          initialValues={initialValues}
+          onSubmit={onSubmit}
+          submitLabel={submitLabel}
+          submitLoadingLabel={submitLoadingLabel}
+          groupId={groupId}
+        />
+      ))
+    )
+  );
+
+  return {
+    ...render(<Wrapped />),
+    onSubmit,
+  };
+}
+
+describe('GroupForm', () => {
+  describe('Form rendering', () => {
+    it('should render name and description fields', async () => {
+      renderGroupForm();
+
+      expect(await screen.findByLabelText(/Name/i)).toBeVisible();
+      expect(screen.getByLabelText(/Description/i)).toBeVisible();
+    });
+
+    it('should render the submit button with correct label', async () => {
+      renderGroupForm({ submitLabel: 'Create' });
+
+      expect(
+        await screen.findByRole('button', { name: /Create/i })
+      ).toBeVisible();
+    });
+
+    it('should not show Associated environments section when groupId is provided (edit mode)', async () => {
+      renderGroupForm({ groupId: 2 });
+
+      await screen.findByLabelText(/Name/i);
+
+      // In edit mode, environments are managed by AssociatedEnvironmentsSelector component (rendered separately in EditGroupView)
+      expect(
+        screen.queryByRole('heading', { name: /Associated environments/i })
+      ).not.toBeInTheDocument();
+      expect(
+        screen.queryByTestId('add-environments-button')
+      ).not.toBeInTheDocument();
+    });
+
+    it('should not show environment section when groupId is 1 (unassigned group)', async () => {
+      renderGroupForm({ groupId: 1 });
+
+      await screen.findByLabelText(/Name/i);
+
+      // In edit mode, environments are managed by AssociatedEnvironmentsSelector component (rendered separately)
+      expect(
+        screen.queryByRole('heading', { name: /Associated environments/i })
+      ).not.toBeInTheDocument();
+      expect(
+        screen.queryByTestId('add-environments-button')
+      ).not.toBeInTheDocument();
+    });
+
+    it('should show associated environments table with Add button in create mode (no groupId)', async () => {
+      renderGroupForm();
+
+      await screen.findByLabelText(/Name/i);
+
+      // FormModeEnvironmentsSelector renders AssociatedEnvironmentsTable with an Add button
+      expect(
+        await screen.findByTestId('add-environments-button')
+      ).toBeInTheDocument();
+    });
+  });
+
+  describe('Form validation', () => {
+    it('should show validation error when name is empty', async () => {
+      renderGroupForm();
+
+      // The form validates on mount
+      await waitFor(() => {
+        expect(
+          screen.getByRole('alert', { name: /Name is required/i })
+        ).toBeVisible();
+      });
+    });
+
+    it('should disable submit button when form is invalid', async () => {
+      renderGroupForm();
+
+      const submitButton = await screen.findByRole('button', {
+        name: /Create/i,
+      });
+
+      expect(submitButton).toBeDisabled();
+    });
+
+    it('should disable submit button when form is not dirty', async () => {
+      renderGroupForm({
+        initialValues: {
+          name: 'existing-group',
+          description: '',
+          tagIds: [],
+        },
+      });
+
+      const submitButton = await screen.findByRole('button', {
+        name: /Create/i,
+      });
+
+      expect(submitButton).toBeDisabled();
+    });
+
+    it('should enable submit button when form is valid and dirty', async () => {
+      const user = userEvent.setup();
+      renderGroupForm();
+
+      const nameInput = await screen.findByLabelText(/Name/i);
+      await user.type(nameInput, 'my-new-group');
+
+      const submitButton = screen.getByRole('button', { name: /Create/i });
+
+      await waitFor(() => {
+        expect(submitButton).toBeEnabled();
+      });
+    });
+
+    it('should clear validation error when name is provided', async () => {
+      const user = userEvent.setup();
+      renderGroupForm();
+
+      // Wait for initial validation error
+      await waitFor(() => {
+        expect(
+          screen.getByRole('alert', { name: /Name is required/i })
+        ).toBeVisible();
+      });
+
+      // Use data-cy attribute to find the specific name input
+      const nameInput = screen.getByTestId('group-name-input');
+      await user.type(nameInput, 'my-group');
+
+      await waitFor(() => {
+        expect(
+          screen.queryByRole('alert', { name: /Name is required/i })
+        ).not.toBeInTheDocument();
+      });
+    });
+  });
+
+  describe('Form submission', () => {
+    it('should call onSubmit with form values when submitted', async () => {
+      const user = userEvent.setup();
+      const onSubmit = vi.fn().mockResolvedValue(undefined);
+      renderGroupForm({ onSubmit });
+
+      const nameInput = await screen.findByLabelText(/Name/i);
+      await user.type(nameInput, 'test-group');
+
+      const descriptionInput = screen.getByLabelText(/Description/i);
+      await user.type(descriptionInput, 'Test description');
+
+      const submitButton = screen.getByRole('button', { name: /Create/i });
+      await waitFor(() => {
+        expect(submitButton).toBeEnabled();
+      });
+
+      await user.click(submitButton);
+
+      await waitFor(() => {
+        expect(onSubmit).toHaveBeenCalledWith(
+          expect.objectContaining({
+            name: 'test-group',
+            description: 'Test description',
+            tagIds: [],
+          }),
+          expect.anything()
+        );
+      });
+    });
+
+    it('should show loading state during submission', async () => {
+      const user = userEvent.setup();
+      let resolveSubmit: () => void;
+      const onSubmit = vi.fn().mockImplementation(
+        () =>
+          new Promise<void>((resolve) => {
+            resolveSubmit = resolve;
+          })
+      );
+
+      renderGroupForm({
+        onSubmit,
+        submitLabel: 'Create',
+        submitLoadingLabel: 'Creating...',
+      });
+
+      const nameInput = await screen.findByLabelText(/Name/i);
+      await user.type(nameInput, 'test-group');
+
+      const submitButton = screen.getByRole('button', { name: /Create/i });
+      await waitFor(() => {
+        expect(submitButton).toBeEnabled();
+      });
+
+      await user.click(submitButton);
+
+      await waitFor(() => {
+        expect(
+          screen.getByRole('button', { name: /Creating.../i })
+        ).toBeVisible();
+      });
+
+      resolveSubmit!();
+    });
+  });
+
+  describe('Form field placeholders', () => {
+    it('should show correct placeholder for name field', async () => {
+      renderGroupForm();
+
+      const nameInput = await screen.findByPlaceholderText(/e\.g\. my-group/i);
+      expect(nameInput).toBeVisible();
+    });
+
+    it('should show correct placeholder for description field', async () => {
+      renderGroupForm();
+
+      const descriptionInput = await screen.findByPlaceholderText(
+        /e\.g\. production environments/i
+      );
+      expect(descriptionInput).toBeVisible();
+    });
+  });
+
+  describe('Initial values', () => {
+    it('should populate form with initial values', async () => {
+      renderGroupForm({
+        initialValues: {
+          name: 'pre-filled-name',
+          description: 'pre-filled-description',
+          tagIds: [],
+        },
+      });
+
+      const nameInput = await screen.findByLabelText(/Name/i);
+      expect(nameInput).toHaveValue('pre-filled-name');
+
+      const descriptionInput = screen.getByLabelText(/Description/i);
+      expect(descriptionInput).toHaveValue('pre-filled-description');
+    });
+  });
+});
diff --git a/app/react/portainer/environments/environment-groups/components/GroupForm.tsx b/app/react/portainer/environments/environment-groups/components/GroupForm.tsx
new file mode 100644
index 0000000..1935af1
--- /dev/null
+++ b/app/react/portainer/environments/environment-groups/components/GroupForm.tsx
@@ -0,0 +1,162 @@
+import {
+  Form,
+  Formik,
+  FormikHelpers,
+  FormikProps,
+  useFormikContext,
+} from 'formik';
+import { object, string, array, number } from 'yup';
+import { useRef } from 'react';
+
+import { TagId } from '@/portainer/tags/types';
+import {
+  EnvironmentId,
+  EnvironmentGroupId,
+} from '@/react/portainer/environments/types';
+import { useIsPureAdmin } from '@/react/hooks/useUser';
+import { useCanExit } from '@/react/hooks/useCanExit';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+import { TagSelector } from '@@/TagSelector';
+import { confirmGenericDiscard } from '@@/modals/confirm';
+import { LoadingButton } from '@@/buttons';
+import { StickyFooter } from '@@/StickyFooter/StickyFooter';
+
+import { FormModeEnvironmentsSelector } from './AssociatedEnvironmentsSelector/FormModeEnvironmentsSelector';
+
+export interface GroupFormValues {
+  name: string;
+  description: string;
+  tagIds: Array<TagId>;
+  /** Used in create mode only — undefined in edit mode */
+  associatedEnvironments?: Array<EnvironmentId>;
+}
+
+interface Props {
+  initialValues: GroupFormValues;
+  /** Should return a Promise that resolves when navigation happens (to keep isSubmitting true) */
+  onSubmit: (
+    values: GroupFormValues,
+    helpers: FormikHelpers<GroupFormValues>
+  ) => Promise<void>;
+  submitLabel: string;
+  submitLoadingLabel: string;
+  /** Group ID - if provided, shows environment selector (not for unassigned group) */
+  groupId?: EnvironmentGroupId;
+}
+
+const validationSchema = object({
+  name: string().required('Name is required'),
+  description: string(),
+  tagIds: array(number()),
+});
+
+export function GroupForm({
+  initialValues,
+  onSubmit,
+  submitLabel,
+  submitLoadingLabel,
+  groupId,
+}: Props) {
+  const formikRef = useRef<FormikProps<GroupFormValues>>(null);
+  useCanExit(() => !formikRef.current?.dirty || confirmGenericDiscard());
+
+  return (
+    <Formik
+      innerRef={formikRef}
+      initialValues={initialValues}
+      onSubmit={onSubmit}
+      validationSchema={validationSchema}
+      validateOnMount
+      enableReinitialize
+    >
+      <InnerForm
+        submitLabel={submitLabel}
+        submitLoadingLabel={submitLoadingLabel}
+        groupId={groupId}
+      />
+    </Formik>
+  );
+}
+
+interface InnerFormProps {
+  submitLabel: string;
+  submitLoadingLabel: string;
+  groupId?: EnvironmentGroupId;
+}
+
+function InnerForm({
+  submitLabel,
+  submitLoadingLabel,
+  groupId,
+}: InnerFormProps) {
+  const isPureAdmin = useIsPureAdmin();
+  const {
+    values,
+    errors,
+    handleChange,
+    setFieldValue,
+    isValid,
+    dirty,
+    isSubmitting,
+  } = useFormikContext<GroupFormValues>();
+  const isCreateMode = !groupId;
+
+  return (
+    <Form className="form-horizontal">
+      <FormControl
+        label="Name"
+        required
+        errors={errors.name}
+        inputId="group-name"
+      >
+        <Input
+          id="group-name"
+          name="name"
+          value={values.name}
+          onChange={handleChange}
+          placeholder="e.g. my-group"
+          data-cy="group-name-input"
+        />
+      </FormControl>
+
+      <FormControl label="Description" inputId="group-description">
+        <Input
+          id="group-description"
+          name="description"
+          value={values.description}
+          onChange={handleChange}
+          placeholder="e.g. production environments..."
+          data-cy="group-description-input"
+        />
+      </FormControl>
+
+      <TagSelector
+        value={values.tagIds}
+        onChange={(tagIds) => setFieldValue('tagIds', tagIds)}
+        allowCreate={isPureAdmin}
+      />
+
+      {isCreateMode && (
+        // Same UI as edit mode, but updates form values instead of the API
+        <FormModeEnvironmentsSelector
+          selectedIds={values.associatedEnvironments ?? []}
+          onChange={(ids) => setFieldValue('associatedEnvironments', ids)}
+        />
+      )}
+
+      <StickyFooter className="justify-end gap-4">
+        <LoadingButton
+          size="medium"
+          loadingText={submitLoadingLabel}
+          isLoading={isSubmitting}
+          disabled={!isValid || isSubmitting || !dirty}
+          data-cy="group-submit-button"
+        >
+          {submitLabel}
+        </LoadingButton>
+      </StickyFooter>
+    </Form>
+  );
+}
diff --git a/app/react/portainer/environments/environment-groups/components/PlatformBadge.tsx b/app/react/portainer/environments/environment-groups/components/PlatformBadge.tsx
new file mode 100644
index 0000000..6e25027
--- /dev/null
+++ b/app/react/portainer/environments/environment-groups/components/PlatformBadge.tsx
@@ -0,0 +1,29 @@
+import { EnvironmentGroup } from '../types';
+import { getPlatformLabel } from '../utils/getPlatformLabel';
+
+const colorByLabel: Record<string, string> = {
+  Docker: 'bg-green-2 th-dark:bg-green-9',
+  Kubernetes: 'bg-blue-2 th-dark:bg-blue-9',
+  Podman: 'bg-orange-2 th-dark:bg-orange-9',
+  Mixed: 'bg-purple-2 th-dark:bg-purple-9',
+  Empty: 'bg-gray-2 th-dark:bg-gray-8',
+};
+
+interface Props {
+  group: EnvironmentGroup;
+}
+
+export function PlatformBadge({ group }: Props) {
+  const platformLabel = getPlatformLabel(group);
+  const colorClass =
+    colorByLabel[platformLabel] ?? 'bg-gray-2 th-dark:bg-gray-8';
+
+  return (
+    <span
+      className={`flex w-fit items-center rounded-xl ${colorClass} px-2 py-px text-xs font-bold text-gray-9 th-highcontrast:bg-gray-8 th-highcontrast:text-white th-dark:text-gray-3`}
+      data-cy={`environment-group-platform_${group.Name}`}
+    >
+      {platformLabel}
+    </span>
+  );
+}
diff --git a/app/react/portainer/environments/environment-groups/environment-groups.service.ts b/app/react/portainer/environments/environment-groups/environment-groups.service.ts
new file mode 100644
index 0000000..cc58229
--- /dev/null
+++ b/app/react/portainer/environments/environment-groups/environment-groups.service.ts
@@ -0,0 +1,24 @@
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { EnvironmentGroupId } from '../types';
+
+import { buildUrl } from './queries/build-url';
+import { EnvironmentGroup } from './types';
+
+export async function getGroup(id: EnvironmentGroupId) {
+  try {
+    const { data: group } = await axios.get<EnvironmentGroup>(buildUrl(id));
+    return group;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to retrieve group');
+  }
+}
+
+export async function getGroups() {
+  try {
+    const { data: groups } = await axios.get<EnvironmentGroup[]>(buildUrl());
+    return groups;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to retrieve groups');
+  }
+}
diff --git a/app/react/portainer/environments/environment-groups/queries.ts b/app/react/portainer/environments/environment-groups/queries.ts
new file mode 100644
index 0000000..d49814e
--- /dev/null
+++ b/app/react/portainer/environments/environment-groups/queries.ts
@@ -0,0 +1 @@
+export { useGroups } from './queries/useGroups';
diff --git a/app/react/portainer/environments/environment-groups/queries/build-url.ts b/app/react/portainer/environments/environment-groups/queries/build-url.ts
new file mode 100644
index 0000000..1ef08e5
--- /dev/null
+++ b/app/react/portainer/environments/environment-groups/queries/build-url.ts
@@ -0,0 +1,15 @@
+import { EnvironmentGroupId } from '../../types';
+
+export function buildUrl(id?: EnvironmentGroupId, action?: string) {
+  let url = '/endpoint_groups';
+
+  if (id) {
+    url += `/${id}`;
+  }
+
+  if (action) {
+    url += `/${action}`;
+  }
+
+  return url;
+}
diff --git a/app/react/portainer/environments/environment-groups/queries/query-keys.ts b/app/react/portainer/environments/environment-groups/queries/query-keys.ts
new file mode 100644
index 0000000..bcea887
--- /dev/null
+++ b/app/react/portainer/environments/environment-groups/queries/query-keys.ts
@@ -0,0 +1,8 @@
+import { EnvironmentGroupId } from '../../types';
+
+export const queryKeys = {
+  base: () => ['environment-groups'] as const,
+  list: (size = false) => [...queryKeys.base(), { size }] as const,
+  group: (id?: EnvironmentGroupId, size = false) =>
+    [...queryKeys.base(), id, { size }] as const,
+};
diff --git a/app/react/portainer/environments/environment-groups/queries/useCreateGroupMutation.ts b/app/react/portainer/environments/environment-groups/queries/useCreateGroupMutation.ts
new file mode 100644
index 0000000..85270b3
--- /dev/null
+++ b/app/react/portainer/environments/environment-groups/queries/useCreateGroupMutation.ts
@@ -0,0 +1,53 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { TagId } from '@/portainer/tags/types';
+import {
+  mutationOptions,
+  withError,
+  withInvalidate,
+} from '@/react-tools/react-query';
+
+import { EnvironmentId } from '../../types';
+import { EnvironmentGroup } from '../types';
+
+import { buildUrl } from './build-url';
+import { queryKeys } from './query-keys';
+
+interface CreateGroupPayload {
+  name: string;
+  description?: string;
+  associatedEnvironments?: EnvironmentId[];
+  tagIds?: TagId[];
+}
+
+export async function createGroup({
+  name,
+  description,
+  associatedEnvironments,
+  tagIds,
+}: CreateGroupPayload) {
+  try {
+    const { data: group } = await axios.post<EnvironmentGroup>(buildUrl(), {
+      Name: name,
+      Description: description,
+      AssociatedEndpoints: associatedEnvironments,
+      TagIDs: tagIds,
+    });
+    return group;
+  } catch (e) {
+    throw parseAxiosError(e as Error, 'Failed to create group');
+  }
+}
+
+export function useCreateGroupMutation() {
+  const queryClient = useQueryClient();
+
+  return useMutation(
+    createGroup,
+    mutationOptions(
+      withError('Failed to create group'),
+      withInvalidate(queryClient, [queryKeys.base(), queryKeys.list(true)])
+    )
+  );
+}
diff --git a/app/react/portainer/environments/environment-groups/queries/useDeleteEnvironmentGroupMutation.ts b/app/react/portainer/environments/environment-groups/queries/useDeleteEnvironmentGroupMutation.ts
new file mode 100644
index 0000000..d2166d7
--- /dev/null
+++ b/app/react/portainer/environments/environment-groups/queries/useDeleteEnvironmentGroupMutation.ts
@@ -0,0 +1,23 @@
+import { useMutation } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+
+import { EnvironmentGroupId } from '../../types';
+
+import { buildUrl } from './build-url';
+
+export function useDeleteEnvironmentGroupMutation() {
+  return useMutation({
+    mutationFn: (id: EnvironmentGroupId) => deleteEnvironmentGroup(id),
+    ...withError('Failed to delete environment group'),
+  });
+}
+
+async function deleteEnvironmentGroup(id: EnvironmentGroupId) {
+  try {
+    await axios.delete(buildUrl(id));
+  } catch (e) {
+    throw parseAxiosError(e as Error, 'Unable to delete environment group');
+  }
+}
diff --git a/app/react/portainer/environments/environment-groups/queries/useGroup.ts b/app/react/portainer/environments/environment-groups/queries/useGroup.ts
new file mode 100644
index 0000000..e382be0
--- /dev/null
+++ b/app/react/portainer/environments/environment-groups/queries/useGroup.ts
@@ -0,0 +1,43 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { getEndpointGroupsById } from '@api/sdk.gen';
+import { PortainerEndpointGroup } from '@api/types.gen';
+
+import { withError } from '@/react-tools/react-query';
+
+import { queryKeys } from './query-keys';
+
+/** Get the environment group by id. **Only portainer administrators can access this endpoint.** */
+export function useGroup<T = PortainerEndpointGroup>(
+  groupId?: PortainerEndpointGroup['Id'],
+  {
+    select,
+    enabled = true,
+    size = false,
+  }: {
+    select?: (group: PortainerEndpointGroup | null) => T;
+    enabled?: boolean;
+    size?: boolean;
+  } = {}
+) {
+  return useQuery(
+    queryKeys.group(groupId, size),
+    async () => {
+      if (groupId === undefined) {
+        return null;
+      }
+      const { data } = await getEndpointGroupsById({
+        path: { id: groupId },
+        query: { size },
+      });
+
+      return data;
+    },
+    {
+      staleTime: 50,
+      select,
+      enabled: enabled && groupId !== undefined,
+      ...withError('Failed loading group'),
+    }
+  );
+}
diff --git a/app/react/portainer/environments/environment-groups/queries/useGroups.ts b/app/react/portainer/environments/environment-groups/queries/useGroups.ts
new file mode 100644
index 0000000..aa0fc79
--- /dev/null
+++ b/app/react/portainer/environments/environment-groups/queries/useGroups.ts
@@ -0,0 +1,30 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { endpointGroupList } from '@api/sdk.gen';
+
+import { EnvironmentGroup } from '../types';
+
+import { queryKeys } from './query-keys';
+
+/** Get all environment groups. **Only portainer administrators can access this endpoint.** */
+export function useGroups<T = EnvironmentGroup[]>({
+  select,
+  enabled = true,
+  size = false,
+}: {
+  select?: (group: EnvironmentGroup[]) => T;
+  enabled?: boolean;
+  size?: boolean;
+} = {}) {
+  return useQuery(
+    queryKeys.list(size),
+    async () => {
+      const { data } = await endpointGroupList({ query: { size } });
+      return data;
+    },
+    {
+      select,
+      enabled,
+    }
+  );
+}
diff --git a/app/react/portainer/environments/environment-groups/queries/useUpdateGroupMutation.ts b/app/react/portainer/environments/environment-groups/queries/useUpdateGroupMutation.ts
new file mode 100644
index 0000000..4072f4e
--- /dev/null
+++ b/app/react/portainer/environments/environment-groups/queries/useUpdateGroupMutation.ts
@@ -0,0 +1,56 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { TagId } from '@/portainer/tags/types';
+import { withError } from '@/react-tools/react-query';
+import { environmentQueryKeys } from '@/react/portainer/environments/queries/query-keys';
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { EnvironmentGroupId, EnvironmentId } from '../../types';
+import { EnvironmentGroup } from '../types';
+
+import { buildUrl } from './build-url';
+import { queryKeys } from './query-keys';
+
+interface UpdateGroupPayload {
+  id: EnvironmentGroupId;
+  name: string;
+  description?: string;
+  tagIds?: Array<TagId>;
+  associatedEnvironments?: Array<EnvironmentId>;
+}
+
+export async function updateGroup({
+  id,
+  name,
+  description,
+  tagIds,
+  associatedEnvironments,
+}: UpdateGroupPayload) {
+  try {
+    const { data: group } = await axios.put<EnvironmentGroup>(buildUrl(id), {
+      Name: name,
+      Description: description,
+      TagIDs: tagIds,
+      AssociatedEndpoints: associatedEnvironments,
+    });
+    return group;
+  } catch (e) {
+    throw parseAxiosError(e as Error, 'Failed to update group');
+  }
+}
+
+export function useUpdateGroupMutation() {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: updateGroup,
+    onSuccess: () => {
+      queryClient.invalidateQueries(queryKeys.base());
+      queryClient.invalidateQueries(queryKeys.list(true));
+      queryClient.invalidateQueries(environmentQueryKeys.base());
+      notifySuccess('Success', 'Group successfully updated');
+    },
+    ...withError('Failed to update group'),
+  });
+}
diff --git a/app/react/portainer/environments/environment-groups/types.ts b/app/react/portainer/environments/environment-groups/types.ts
new file mode 100644
index 0000000..7a1c01b
--- /dev/null
+++ b/app/react/portainer/environments/environment-groups/types.ts
@@ -0,0 +1,3 @@
+import { EndpointgroupsEndpointGroupResponse } from '@api/types.gen';
+
+export type EnvironmentGroup = EndpointgroupsEndpointGroupResponse;
diff --git a/app/react/portainer/environments/environment-groups/utils/getPlatformLabel.ts b/app/react/portainer/environments/environment-groups/utils/getPlatformLabel.ts
new file mode 100644
index 0000000..7c9e13d
--- /dev/null
+++ b/app/react/portainer/environments/environment-groups/utils/getPlatformLabel.ts
@@ -0,0 +1,25 @@
+import { EnvironmentGroup } from '../types';
+
+export function getPlatformLabel(group: EnvironmentGroup): string {
+  if (!group.Total || group.Total === 0) {
+    return 'Empty';
+  }
+
+  const typeInfo = group.TypeInfo;
+  if (!typeInfo) {
+    return 'Mixed';
+  }
+
+  if (!typeInfo.Mixed) {
+    if (typeInfo.Docker > 0) return 'Docker';
+    if (typeInfo.Kubernetes > 0) return 'Kubernetes';
+    if (typeInfo.Podman > 0) return 'Podman';
+    return 'Empty';
+  }
+
+  return 'Mixed';
+}
+
+export function isUngoverned(group: EnvironmentGroup): boolean {
+  return group.Id === 1;
+}
diff --git a/app/react/portainer/environments/environment.service/create.ts b/app/react/portainer/environments/environment.service/create.ts
new file mode 100644
index 0000000..3f589f5
--- /dev/null
+++ b/app/react/portainer/environments/environment.service/create.ts
@@ -0,0 +1,265 @@
+import { endpointCreate } from '@api/sdk.gen';
+import { EndpointCreateData } from '@api/types.gen';
+
+import { arrayToJson } from '@/portainer/helpers/json';
+import { parseAxiosError } from '@/portainer/services/axios/axios';
+import {
+  type EnvironmentGroupId,
+  ContainerEngine,
+  EnvironmentCreationTypes,
+} from '@/react/portainer/environments/types';
+import { type TagId } from '@/portainer/tags/types';
+import { EdgeAsyncIntervalsValues } from '@/react/edge/components/EdgeAsyncIntervalsForm';
+
+import { toEnvironment } from './utils';
+
+export interface EnvironmentMetadata {
+  groupId?: EnvironmentGroupId;
+  tagIds?: TagId[];
+}
+
+interface CreateLocalDockerEnvironment {
+  name: string;
+  socketPath?: string;
+  publicUrl?: string;
+  meta?: EnvironmentMetadata;
+  containerEngine?: ContainerEngine;
+}
+
+export async function createLocalDockerEnvironment({
+  name,
+  socketPath = '',
+  publicUrl = '',
+  meta = { tagIds: [] },
+  containerEngine,
+}: CreateLocalDockerEnvironment) {
+  const url = prefixPath(socketPath);
+
+  return createEnvironment(
+    name,
+    EnvironmentCreationTypes.LocalDockerEnvironment,
+    {
+      url,
+      publicUrl,
+      meta,
+      containerEngine,
+    }
+  );
+
+  function prefixPath(path: string) {
+    if (path === '') {
+      return path;
+    }
+
+    // Windows named pipe
+    if (path.startsWith('//./pipe/')) {
+      return `npipe://${path}`;
+    }
+
+    return `unix://${path}`;
+  }
+}
+
+interface CreateLocalKubernetesEnvironment {
+  name: string;
+  meta?: EnvironmentMetadata;
+}
+
+export async function createLocalKubernetesEnvironment({
+  name,
+  meta = { tagIds: [] },
+}: CreateLocalKubernetesEnvironment) {
+  return createEnvironment(
+    name,
+    EnvironmentCreationTypes.LocalKubernetesEnvironment,
+    { meta, tls: { skipClientVerify: true, skipVerify: true } }
+  );
+}
+
+interface AzureSettings {
+  applicationId: string;
+  tenantId: string;
+  authenticationKey: string;
+}
+
+interface CreateAzureEnvironment {
+  name: string;
+  azure: AzureSettings;
+  meta?: EnvironmentMetadata;
+}
+
+export async function createAzureEnvironment({
+  name,
+  azure,
+  meta = { tagIds: [] },
+}: CreateAzureEnvironment) {
+  return createEnvironment(name, EnvironmentCreationTypes.AzureEnvironment, {
+    meta,
+    azure,
+  });
+}
+
+interface TLSSettings {
+  skipVerify?: boolean;
+  skipClientVerify?: boolean;
+  caCertFile?: File;
+  certFile?: File;
+  keyFile?: File;
+}
+
+interface EdgeSettings extends EdgeAsyncIntervalsValues {
+  asyncMode: boolean;
+}
+
+export interface EnvironmentOptions {
+  url?: string;
+  publicUrl?: string;
+  meta?: EnvironmentMetadata;
+  azure?: AzureSettings;
+  tls?: TLSSettings;
+  pollFrequency?: number;
+  edge?: EdgeSettings;
+  tunnelServerAddr?: string;
+  containerEngine?: ContainerEngine;
+}
+
+interface CreateRemoteEnvironment {
+  name: string;
+  creationType: Exclude<
+    EnvironmentCreationTypes,
+    EnvironmentCreationTypes.EdgeAgentEnvironment
+  >;
+  url: string;
+  options?: Omit<EnvironmentOptions, 'url'>;
+  containerEngine?: ContainerEngine;
+}
+
+export async function createRemoteEnvironment({
+  creationType,
+  name,
+  url,
+  options = {},
+}: CreateRemoteEnvironment) {
+  return createEnvironment(name, creationType, {
+    ...options,
+    url: `tcp://${url}`,
+  });
+}
+
+export interface CreateAgentEnvironmentValues {
+  name: string;
+  environmentUrl: string;
+  meta: EnvironmentMetadata;
+  containerEngine?: ContainerEngine;
+}
+
+export function createAgentEnvironment({
+  name,
+  environmentUrl,
+  containerEngine = ContainerEngine.Docker,
+  meta = { tagIds: [] },
+}: CreateAgentEnvironmentValues) {
+  return createRemoteEnvironment({
+    name,
+    url: environmentUrl,
+    creationType: EnvironmentCreationTypes.AgentEnvironment,
+    options: {
+      meta,
+      tls: {
+        skipVerify: true,
+        skipClientVerify: true,
+      },
+      containerEngine,
+    },
+  });
+}
+
+interface CreateEdgeAgentEnvironment {
+  name: string;
+  portainerUrl: string;
+  tunnelServerAddr?: string;
+  meta?: EnvironmentMetadata;
+  pollFrequency: number;
+  edge: EdgeSettings;
+  containerEngine: ContainerEngine;
+}
+
+export function createEdgeAgentEnvironment({
+  name,
+  portainerUrl,
+  meta = { tagIds: [] },
+  pollFrequency,
+  edge,
+  containerEngine,
+}: CreateEdgeAgentEnvironment) {
+  return createEnvironment(
+    name,
+    EnvironmentCreationTypes.EdgeAgentEnvironment,
+    {
+      url: portainerUrl,
+      pollFrequency,
+      edge,
+      meta,
+      containerEngine,
+    }
+  );
+}
+
+async function createEnvironment(
+  name: string,
+  creationType: EnvironmentCreationTypes,
+  options?: EnvironmentOptions
+) {
+  if (creationType === EnvironmentCreationTypes.KubeConfigEnvironment) {
+    throw new Error('Kube config creation is not supported on CE');
+  }
+
+  let payload: EndpointCreateData['body'] = {
+    Name: name,
+    EndpointCreationType: creationType,
+  };
+
+  if (options) {
+    const { tls, azure, meta, containerEngine } = options;
+    const { groupId, tagIds = [] } = meta || {};
+
+    payload = {
+      ...payload,
+      URL: options.url,
+      PublicURL: options.publicUrl,
+      GroupID: groupId,
+      TagIds: arrayToJson(tagIds),
+      EdgeCheckinInterval: options.pollFrequency,
+      ContainerEngine: containerEngine,
+    };
+
+    if (tls) {
+      payload = {
+        ...payload,
+        TLS: true,
+        TLSSkipVerify: tls.skipVerify,
+        TLSSkipClientVerify: tls.skipClientVerify,
+        TLSCACertFile: tls.caCertFile,
+        TLSCertFile: tls.certFile,
+        TLSKeyFile: tls.keyFile,
+      };
+    }
+
+    if (azure) {
+      payload = {
+        ...payload,
+        AzureApplicationID: azure.applicationId,
+        AzureTenantID: azure.tenantId,
+        AzureAuthenticationKey: azure.authenticationKey,
+      };
+    }
+  }
+
+  try {
+    const { data } = await endpointCreate({ body: payload });
+
+    return toEnvironment(data);
+  } catch (e) {
+    throw parseAxiosError(e as Error);
+  }
+}
diff --git a/app/react/portainer/environments/environment.service/edge.ts b/app/react/portainer/environments/environment.service/edge.ts
new file mode 100644
index 0000000..461443a
--- /dev/null
+++ b/app/react/portainer/environments/environment.service/edge.ts
@@ -0,0 +1,16 @@
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+interface GenerateUrlResponse {
+  edgeKey: string;
+}
+
+export async function generateKey() {
+  try {
+    const { data } = await axios.post<GenerateUrlResponse>(
+      `/endpoints/edge/generate-key`
+    );
+    return data.edgeKey;
+  } catch (err) {
+    throw parseAxiosError(err as Error, 'Unable to generate key');
+  }
+}
diff --git a/app/react/portainer/environments/environment.service/index.ts b/app/react/portainer/environments/environment.service/index.ts
new file mode 100644
index 0000000..b353d4a
--- /dev/null
+++ b/app/react/portainer/environments/environment.service/index.ts
@@ -0,0 +1,289 @@
+import { endpointList } from '@api/sdk.gen';
+import { PortainerEndpoint } from '@api/types.gen';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import {
+  Environment,
+  EnvironmentId,
+  EnvironmentType,
+  EnvironmentSecuritySettings,
+  EnvironmentStatus,
+  EnvironmentGroupId,
+  PlatformType,
+  EdgeGroupId,
+} from '@/react/portainer/environments/types';
+import { type TagId } from '@/portainer/tags/types';
+import { UserId } from '@/portainer/users/types';
+import { TeamId } from '@/react/portainer/users/teams/types';
+import {
+  EdgeStack,
+  StatusType as EdgeStackStatusType,
+} from '@/react/edge/edge-stacks/types';
+
+import { getPublicSettings } from '../../settings/settings.service';
+import { SortType } from '../queries/useEnvironmentList';
+
+import { buildUrl, toEnvironment } from './utils';
+
+export type EdgeStackEnvironmentsQueryParams =
+  | {
+      edgeStackId?: EdgeStack['Id'];
+    }
+  | {
+      edgeStackId: EdgeStack['Id'];
+      edgeStackStatus?: EdgeStackStatusType;
+    };
+
+export interface BaseEnvironmentsQueryParams {
+  search?: string;
+  types?: EnvironmentType[] | readonly EnvironmentType[];
+  tagIds?: TagId[];
+  endpointIds?: EnvironmentId[];
+  excludeIds?: EnvironmentId[];
+  excludeGroupIds?: EnvironmentGroupId[];
+  tagsPartialMatch?: boolean;
+  groupIds?: EnvironmentGroupId[];
+  status?: EnvironmentStatus[];
+  edgeAsync?: boolean;
+  edgeDeviceUntrusted?: boolean;
+  excludeSnapshots?: boolean;
+  name?: string;
+  /** Filter environments by partial name match (case-insensitive, searches name only) */
+  nameFilter?: string;
+  agentVersions?: string[];
+  updateInformation?: boolean;
+  edgeCheckInPassedSeconds?: number;
+  platformTypes?: PlatformType[];
+  edgeGroupIds?: EdgeGroupId[];
+  excludeEdgeGroupIds?: EdgeGroupId[];
+  outdated?: boolean;
+}
+
+export type EnvironmentsQueryParams = BaseEnvironmentsQueryParams &
+  EdgeStackEnvironmentsQueryParams;
+
+export interface GetEnvironmentsOptions {
+  start?: number;
+  limit?: number;
+  sort?: {
+    by?: SortType;
+    order?: 'asc' | 'desc';
+  };
+  query?: EnvironmentsQueryParams;
+}
+
+export async function getEnvironments(
+  {
+    start,
+    limit,
+    sort = { by: undefined, order: 'asc' },
+    query = {},
+  }: GetEnvironmentsOptions = { query: {} }
+) {
+  if (
+    (query.tagIds && query.tagIds.length === 0) ||
+    (query.endpointIds && query.endpointIds.length === 0)
+  ) {
+    return {
+      totalCount: 0,
+      value: <Environment[]>[],
+      totalAvailable: 0,
+      updateAvailable: false,
+    };
+  }
+
+  const response = await endpointList({
+    query: {
+      start,
+      limit,
+      sort: sort.by,
+      order: sort.order,
+      ...query,
+      types: query.types ? [...query.types] : undefined,
+    },
+  });
+
+  const totalCount = (response.headers['x-total-count'] || '0') as string;
+  const totalAvailable = (response.headers['x-total-available'] ||
+    '0') as string;
+  const updateAvailable = response.headers['x-update-available'] === 'true';
+
+  return {
+    totalCount: parseInt(totalCount, 10),
+    value: (response.data ?? []).map(toEnvironment),
+    totalAvailable: parseInt(totalAvailable, 10),
+    updateAvailable,
+  };
+}
+
+export interface GroupCount {
+  groupName: string;
+  groupID: number;
+  count: number;
+}
+
+export interface PlatformCounts {
+  docker: number;
+  kubernetes: number;
+  podman: number;
+  azure: number;
+}
+
+export interface HealthCounts {
+  down: number;
+  up: number;
+  heartbeat: number;
+  outdated: number;
+}
+
+export interface EnvironmentSummaryCounts {
+  total: number;
+  up: number;
+  down: number;
+  outdated: number;
+  unassigned: number;
+  byGroup: GroupCount[];
+  byPlatformType: PlatformCounts;
+  byHealth: HealthCounts;
+}
+
+export async function getEnvironmentSummaryCounts() {
+  try {
+    const { data } = await axios.get<EnvironmentSummaryCounts>(
+      buildUrl(undefined, 'summary')
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e as Error);
+  }
+}
+
+export async function getAgentVersions() {
+  try {
+    const response = await axios.get<string[]>(
+      buildUrl(undefined, 'agent_versions')
+    );
+    return response.data;
+  } catch (e) {
+    throw parseAxiosError(e as Error);
+  }
+}
+
+export async function getEndpoint(id: EnvironmentId, excludeSnapshot = true) {
+  try {
+    const { data: endpoint } = await axios.get<PortainerEndpoint>(
+      buildUrl(id),
+      {
+        params: { excludeSnapshot },
+      }
+    );
+    return toEnvironment(endpoint);
+  } catch (e) {
+    throw parseAxiosError(e as Error);
+  }
+}
+
+export async function snapshotEndpoints() {
+  try {
+    await axios.post<void>(buildUrl(undefined, 'snapshot'));
+  } catch (e) {
+    throw parseAxiosError(e as Error);
+  }
+}
+
+export async function getDeploymentOptions(environmentId: EnvironmentId) {
+  const publicSettings = await getPublicSettings();
+  const endpoint = await getEndpoint(environmentId);
+
+  if (
+    publicSettings.GlobalDeploymentOptions.perEnvOverride &&
+    endpoint.DeploymentOptions?.overrideGlobalOptions
+  ) {
+    return endpoint.DeploymentOptions;
+  }
+
+  return publicSettings.GlobalDeploymentOptions;
+}
+
+export async function snapshotEndpoint(id: EnvironmentId) {
+  try {
+    await axios.post<void>(buildUrl(id, 'snapshot'));
+  } catch (e) {
+    throw parseAxiosError(e as Error);
+  }
+}
+
+export async function endpointsByGroup(
+  groupId: EnvironmentGroupId,
+  start: number,
+  limit: number,
+  query: Omit<EnvironmentsQueryParams, 'groupIds'>
+) {
+  return getEnvironments({
+    start,
+    limit,
+    query: { groupIds: [groupId], ...query },
+  });
+}
+
+export async function disassociateEndpoint(id: EnvironmentId) {
+  try {
+    await axios.delete(buildUrl(id, 'association'));
+  } catch (e) {
+    throw parseAxiosError(e as Error);
+  }
+}
+
+export async function deleteEndpoint(id: EnvironmentId) {
+  try {
+    await axios.delete(buildUrl(id));
+  } catch (e) {
+    throw parseAxiosError(e as Error);
+  }
+}
+
+export async function updatePoolAccess(
+  id: EnvironmentId,
+  resourcePool: string,
+  usersToAdd: UserId[],
+  teamsToAdd: TeamId[],
+  usersToRemove: UserId[],
+  teamsToRemove: TeamId[]
+) {
+  try {
+    await axios.put<void>(`${buildUrl(id, 'pools')}/${resourcePool}/access`, {
+      usersToAdd,
+      teamsToAdd,
+      usersToRemove,
+      teamsToRemove,
+    });
+  } catch (e) {
+    throw parseAxiosError(e as Error);
+  }
+}
+
+export async function forceUpdateService(
+  id: EnvironmentId,
+  serviceID: string,
+  pullImage: boolean
+) {
+  try {
+    await axios.put(buildUrl(id, 'forceupdateservice'), {
+      serviceID,
+      pullImage,
+    });
+  } catch (e) {
+    throw parseAxiosError(e as Error);
+  }
+}
+
+export async function updateSettings(
+  id: EnvironmentId,
+  settings: EnvironmentSecuritySettings
+) {
+  try {
+    await axios.put(buildUrl(id, 'settings'), settings);
+  } catch (e) {
+    throw parseAxiosError(e as Error);
+  }
+}
diff --git a/app/react/portainer/environments/environment.service/registries.ts b/app/react/portainer/environments/environment.service/registries.ts
new file mode 100644
index 0000000..9e96680
--- /dev/null
+++ b/app/react/portainer/environments/environment.service/registries.ts
@@ -0,0 +1,75 @@
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { TeamId } from '@/react/portainer/users/teams/types';
+import { UserId } from '@/portainer/users/types';
+import {
+  RegistryId,
+  Registry,
+} from '@/react/portainer/registries/types/registry';
+
+import { EnvironmentId } from '../types';
+
+import { buildUrl } from './utils';
+
+export type RoleId = number;
+interface AccessPolicy {
+  RoleId: RoleId;
+}
+
+type UserAccessPolicies = Record<UserId, AccessPolicy>; // map[UserID]AccessPolicy
+type TeamAccessPolicies = Record<TeamId, AccessPolicy>;
+
+interface RegistryAccess {
+  UserAccessPolicies: UserAccessPolicies;
+  TeamAccessPolicies: TeamAccessPolicies;
+  Namespaces: string[];
+}
+
+export async function updateEnvironmentRegistryAccess(
+  environmentId: EnvironmentId,
+  registryId: RegistryId,
+  access: Partial<RegistryAccess>
+) {
+  try {
+    await axios.put<void>(buildRegistryUrl(environmentId, registryId), access);
+  } catch (e) {
+    throw parseAxiosError(e);
+  }
+}
+
+export async function getEnvironmentRegistries(
+  id: EnvironmentId,
+  namespace: string
+) {
+  try {
+    const { data } = await axios.get<Registry[]>(buildRegistryUrl(id), {
+      params: { namespace },
+    });
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e);
+  }
+}
+
+export async function getEnvironmentRegistry(
+  endpointId: EnvironmentId,
+  registryId: RegistryId
+) {
+  try {
+    const { data } = await axios.get<Registry>(
+      buildRegistryUrl(endpointId, registryId)
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e);
+  }
+}
+
+function buildRegistryUrl(id: EnvironmentId, registryId?: RegistryId) {
+  let url = `${buildUrl(id)}/registries`;
+
+  if (registryId) {
+    url += `/${registryId}`;
+  }
+
+  return url;
+}
diff --git a/app/react/portainer/environments/environment.service/utils.ts b/app/react/portainer/environments/environment.service/utils.ts
new file mode 100644
index 0000000..9409b5a
--- /dev/null
+++ b/app/react/portainer/environments/environment.service/utils.ts
@@ -0,0 +1,115 @@
+import {
+  PortainerEndpoint,
+  PortainerDockerSnapshot,
+  PortainerKubernetesData,
+  PortainerEnvironmentEdgeSettings,
+  PortainerKubernetesStorageClassConfig,
+} from '@api/types.gen';
+
+import { DockerSnapshot } from '@/react/docker/snapshots/types';
+
+import {
+  ContainerEngine,
+  Environment,
+  EnvironmentEdge,
+  EnvironmentId,
+  EnvironmentStatus,
+  EnvironmentType,
+  KubernetesSettings,
+  StorageClass,
+} from '../types';
+
+export function buildUrl(id?: EnvironmentId, action?: string) {
+  let baseUrl = 'endpoints';
+  if (id) {
+    baseUrl += `/${id}`;
+  }
+
+  if (action) {
+    baseUrl += `/${action}`;
+  }
+
+  return baseUrl;
+}
+
+export function toEnvironment(endpoint: PortainerEndpoint): Environment {
+  return {
+    ...endpoint,
+    Type: endpoint.Type ? endpoint.Type : EnvironmentType.Docker,
+    Status: endpoint.Status ?? EnvironmentStatus.Down,
+    ContainerEngine: toContainerEngine(endpoint.ContainerEngine),
+    TagIds: endpoint.TagIds ?? [],
+    Gpus: endpoint.Gpus ?? [],
+    EnableGPUManagement: endpoint.EnableGPUManagement ?? false,
+    Snapshots: endpoint.Snapshots?.map(toDockerSnapshot) || [],
+    Agent: {
+      Version: endpoint.Agent?.Version || '',
+      // EE only
+      IsOutdated: false,
+    },
+    Edge: toEdge(endpoint.Edge),
+    Kubernetes: toKubernetesSettings(endpoint.Kubernetes),
+
+    // EE only
+    ChangeWindow: { Enabled: false, EndTime: '', StartTime: '' },
+    DeploymentOptions: {
+      hideAddWithForm: false,
+      hideFileUpload: false,
+      hideWebEditor: false,
+      overrideGlobalOptions: false,
+    },
+    EnableImageNotification: false,
+  };
+}
+
+function toKubernetesSettings(
+  data: PortainerKubernetesData
+): KubernetesSettings {
+  return {
+    ...data,
+    Configuration: {
+      ...data.Configuration,
+      StorageClasses:
+        data.Configuration?.StorageClasses?.map(toStorageClass) ?? [],
+      IngressClasses: data.Configuration?.IngressClasses ?? [],
+    },
+  };
+
+  function toStorageClass(
+    original: PortainerKubernetesStorageClassConfig
+  ): StorageClass {
+    return {
+      ...original,
+      AccessModes: original.AccessModes ?? [],
+    };
+  }
+}
+
+function toContainerEngine(engine: string): ContainerEngine {
+  switch (engine) {
+    case ContainerEngine.Docker:
+      return ContainerEngine.Docker;
+    case ContainerEngine.Podman:
+      return ContainerEngine.Podman;
+    case '':
+      return ContainerEngine.Kubernetes;
+    default:
+      return ContainerEngine.Docker;
+  }
+}
+
+function toDockerSnapshot(snapshot: PortainerDockerSnapshot): DockerSnapshot {
+  return {
+    ...snapshot,
+    GpuUseList: snapshot.GpuUseList ?? [],
+  };
+}
+
+function toEdge(edge?: PortainerEnvironmentEdgeSettings): EnvironmentEdge {
+  return {
+    AsyncMode: edge?.AsyncMode ?? false,
+    PingInterval: edge?.PingInterval ?? 0,
+    SnapshotInterval: edge?.SnapshotInterval ?? 0,
+    CommandInterval: edge?.CommandInterval ?? 0,
+  };
+}
diff --git a/app/react/portainer/environments/queries/index.ts b/app/react/portainer/environments/queries/index.ts
new file mode 100644
index 0000000..992a956
--- /dev/null
+++ b/app/react/portainer/environments/queries/index.ts
@@ -0,0 +1,2 @@
+export { useEnvironment } from './useEnvironment';
+export { useEnvironmentList } from './useEnvironmentList';
diff --git a/app/react/portainer/environments/queries/query-keys.ts b/app/react/portainer/environments/queries/query-keys.ts
new file mode 100644
index 0000000..5cb21a3
--- /dev/null
+++ b/app/react/portainer/environments/queries/query-keys.ts
@@ -0,0 +1,13 @@
+import { EnvironmentId } from '../types';
+
+export const environmentQueryKeys = {
+  base: () => ['environments'] as const,
+  item: (id: EnvironmentId) => [...environmentQueryKeys.base(), id] as const,
+  registries: (environmentId: EnvironmentId, namespace?: string) =>
+    [
+      ...environmentQueryKeys.base(),
+      environmentId,
+      'registries',
+      namespace,
+    ] as const,
+};
diff --git a/app/react/portainer/environments/queries/useAgentDetails.ts b/app/react/portainer/environments/queries/useAgentDetails.ts
new file mode 100644
index 0000000..78a51cf
--- /dev/null
+++ b/app/react/portainer/environments/queries/useAgentDetails.ts
@@ -0,0 +1,19 @@
+import { useSettings } from '@/react/portainer/settings/queries';
+import { useSystemStatus } from '@/react/portainer/system/useSystemStatus';
+
+export function useAgentDetails() {
+  const settingsQuery = useSettings();
+
+  const versionQuery = useSystemStatus({ select: (status) => status.Version });
+
+  if (!versionQuery.isSuccess || !settingsQuery.isSuccess) {
+    return null;
+  }
+
+  const agentVersion = versionQuery.data;
+
+  return {
+    agentVersion,
+    agentSecret: settingsQuery.data.AgentSecret,
+  };
+}
diff --git a/app/react/portainer/environments/queries/useAgentVersionsList.ts b/app/react/portainer/environments/queries/useAgentVersionsList.ts
new file mode 100644
index 0000000..c86d85a
--- /dev/null
+++ b/app/react/portainer/environments/queries/useAgentVersionsList.ts
@@ -0,0 +1,11 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { getAgentVersions } from '../environment.service';
+
+import { environmentQueryKeys } from './query-keys';
+
+export function useAgentVersionsList() {
+  return useQuery([...environmentQueryKeys.base(), 'agentVersions'], () =>
+    getAgentVersions()
+  );
+}
diff --git a/app/react/portainer/environments/queries/useAvailableSortGroups.tsx b/app/react/portainer/environments/queries/useAvailableSortGroups.tsx
new file mode 100644
index 0000000..bfe027e
--- /dev/null
+++ b/app/react/portainer/environments/queries/useAvailableSortGroups.tsx
@@ -0,0 +1,83 @@
+import { useMemo } from 'react';
+
+import {
+  EnvironmentSummaryCounts,
+  GroupCount,
+  HealthCounts,
+  PlatformCounts,
+} from '@/react/portainer/environments/environment.service';
+import { getPlatformIconByPlatform } from '@/react/portainer/environments/utils/get-platform-icon';
+import { getGroupIcon } from '@/react/portainer/environments/utils/get-group-icon';
+import { getHealthIcon } from '@/react/portainer/environments/utils/get-health-icon';
+import {
+  EnvironmentHealth,
+  PlatformType,
+} from '@/react/portainer/environments/types';
+
+import { DropdownOption } from '@@/DropdownMenu/DropdownMenu';
+
+export function useAvailableSortGroups(
+  summaryQueryData: EnvironmentSummaryCounts | undefined
+) {
+  return useMemo<Record<string, DropdownOption[]>>(
+    () => ({
+      Group: summaryQueryData
+        ? buildGroupEntries(summaryQueryData.byGroup ?? [])
+        : [],
+      PlatformType: summaryQueryData
+        ? buildPlatformEntries(summaryQueryData.byPlatformType ?? [])
+        : [],
+      Health: summaryQueryData
+        ? buildHealthEntries(summaryQueryData.byHealth ?? [])
+        : [],
+    }),
+    [summaryQueryData]
+  );
+}
+
+function buildGroupEntries(byGroup: GroupCount[]): DropdownOption[] {
+  return byGroup.map(({ groupName, groupID, count }) => ({
+    key: groupID.toString(),
+    label: groupName,
+    count,
+    icon: getGroupIcon('sm'),
+  }));
+}
+
+function buildPlatformEntries(
+  byPlatformType: PlatformCounts
+): DropdownOption[] {
+  const categories: Array<{
+    key: keyof PlatformCounts;
+    platformType: PlatformType;
+  }> = [
+    { key: 'docker', platformType: PlatformType.Docker },
+    { key: 'kubernetes', platformType: PlatformType.Kubernetes },
+    { key: 'podman', platformType: PlatformType.Podman },
+    { key: 'azure', platformType: PlatformType.Azure },
+  ];
+  return categories
+    .map(({ key, platformType }) => ({
+      key: PlatformType[platformType],
+      count: byPlatformType[key] ?? 0,
+      icon: getPlatformIconByPlatform(platformType, 'sm'),
+    }))
+    .filter(({ count }) => count > 0);
+}
+
+function buildHealthEntries(byHealth: HealthCounts): DropdownOption[] {
+  const categories: Array<{ key: keyof HealthCounts; healthStatus: number }> = [
+    { key: 'down', healthStatus: EnvironmentHealth.Down },
+    { key: 'outdated', healthStatus: EnvironmentHealth.Outdated },
+    { key: 'up', healthStatus: EnvironmentHealth.Up },
+    { key: 'heartbeat', healthStatus: EnvironmentHealth.Heartbeat },
+  ];
+
+  return categories
+    .map(({ key, healthStatus }) => ({
+      key: EnvironmentHealth[healthStatus],
+      count: byHealth[key] ?? 0,
+      icon: getHealthIcon(healthStatus, 'sm'),
+    }))
+    .filter(({ count }) => count > 0);
+}
diff --git a/app/react/portainer/environments/queries/useBaseApiQueryParams.ts b/app/react/portainer/environments/queries/useBaseApiQueryParams.ts
new file mode 100644
index 0000000..e9b548d
--- /dev/null
+++ b/app/react/portainer/environments/queries/useBaseApiQueryParams.ts
@@ -0,0 +1,15 @@
+import { useMemo } from 'react';
+
+import { isBE } from '@/react/portainer/feature-flags/feature-flags.service';
+
+export function useBaseApiQueryParams(searchTerm: string) {
+  return useMemo(
+    () => ({
+      provisioned: true,
+      updateInformation: isBE,
+      k8sEnvAdmin: true,
+      search: searchTerm || undefined,
+    }),
+    [searchTerm]
+  );
+}
diff --git a/app/react/portainer/environments/queries/useCreateEnvironmentMutation.ts b/app/react/portainer/environments/queries/useCreateEnvironmentMutation.ts
new file mode 100644
index 0000000..53b251a
--- /dev/null
+++ b/app/react/portainer/environments/queries/useCreateEnvironmentMutation.ts
@@ -0,0 +1,65 @@
+import {
+  useQueryClient,
+  useMutation,
+  MutationFunction,
+} from '@tanstack/react-query';
+
+import {
+  createRemoteEnvironment,
+  createLocalDockerEnvironment,
+  createAzureEnvironment,
+  createAgentEnvironment,
+  createEdgeAgentEnvironment,
+  createLocalKubernetesEnvironment,
+} from '../environment.service/create';
+
+export function useCreateAzureEnvironmentMutation() {
+  return useGenericCreationMutation(createAzureEnvironment);
+}
+
+export function useCreateLocalDockerEnvironmentMutation() {
+  return useGenericCreationMutation(createLocalDockerEnvironment);
+}
+
+export function useCreateLocalKubernetesEnvironmentMutation() {
+  return useGenericCreationMutation(createLocalKubernetesEnvironment);
+}
+
+export function useCreateRemoteEnvironmentMutation(
+  creationType: Parameters<typeof createRemoteEnvironment>[0]['creationType']
+) {
+  return useGenericCreationMutation(
+    (
+      params: Omit<
+        Parameters<typeof createRemoteEnvironment>[0],
+        'creationType'
+      >
+    ) => createRemoteEnvironment({ creationType, ...params })
+  );
+}
+
+export function useCreateAgentEnvironmentMutation() {
+  return useGenericCreationMutation(createAgentEnvironment);
+}
+
+export function useCreateEdgeAgentEnvironmentMutation() {
+  return useGenericCreationMutation(createEdgeAgentEnvironment);
+}
+
+function useGenericCreationMutation<TData = unknown, TVariables = void>(
+  mutation: MutationFunction<TData, TVariables>
+) {
+  const queryClient = useQueryClient();
+
+  return useMutation(mutation, {
+    onSuccess() {
+      return queryClient.invalidateQueries(['environments']);
+    },
+    meta: {
+      error: {
+        title: 'Failure',
+        message: 'Unable to create environment',
+      },
+    },
+  });
+}
diff --git a/app/react/portainer/environments/queries/useDeleteEnvironmentsMutation.ts b/app/react/portainer/environments/queries/useDeleteEnvironmentsMutation.ts
new file mode 100644
index 0000000..57519d0
--- /dev/null
+++ b/app/react/portainer/environments/queries/useDeleteEnvironmentsMutation.ts
@@ -0,0 +1,24 @@
+import { useQueryClient, useMutation } from '@tanstack/react-query';
+
+import { promiseSequence } from '@/portainer/helpers/promise-utils';
+import {
+  mutationOptions,
+  withError,
+  withInvalidate,
+} from '@/react-tools/react-query';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { deleteEndpoint } from '../environment.service';
+
+export function useDeleteEnvironmentsMutation() {
+  const queryClient = useQueryClient();
+
+  return useMutation(
+    (ids: Array<EnvironmentId>) =>
+      promiseSequence(ids.map((id) => () => deleteEndpoint(id))),
+    mutationOptions(
+      withError('Failed to remove environments'),
+      withInvalidate(queryClient, [['environments']])
+    )
+  );
+}
diff --git a/app/react/portainer/environments/queries/useEnvironment.ts b/app/react/portainer/environments/queries/useEnvironment.ts
new file mode 100644
index 0000000..8ad47b7
--- /dev/null
+++ b/app/react/portainer/environments/queries/useEnvironment.ts
@@ -0,0 +1,42 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { withError } from '@/react-tools/react-query';
+
+import { getDeploymentOptions, getEndpoint } from '../environment.service';
+import { Environment, EnvironmentId } from '../types';
+
+import { environmentQueryKeys } from './query-keys';
+
+export function useEnvironment<T = Environment>(
+  environmentId?: EnvironmentId,
+  select?: (environment: Environment) => T,
+  options?: {
+    autoRefreshRate?: number;
+    excludeSnapshot?: boolean;
+  }
+) {
+  return useQuery(
+    environmentQueryKeys.item(environmentId!),
+    () => getEndpoint(environmentId!, options?.excludeSnapshot ?? undefined),
+    {
+      select,
+      ...withError('Failed loading environment'),
+      staleTime: 50,
+      enabled: !!environmentId,
+      refetchInterval() {
+        return options?.autoRefreshRate ?? false;
+      },
+    }
+  );
+}
+
+export function useEnvironmentDeploymentOptions(id: EnvironmentId | undefined) {
+  return useQuery(
+    [...environmentQueryKeys.item(id!), 'deploymentOptions'],
+    () => getDeploymentOptions(id!),
+    {
+      enabled: !!id,
+      ...withError('Failed loading deployment options'),
+    }
+  );
+}
diff --git a/app/react/portainer/environments/queries/useEnvironmentList.ts b/app/react/portainer/environments/queries/useEnvironmentList.ts
new file mode 100644
index 0000000..8638520
--- /dev/null
+++ b/app/react/portainer/environments/queries/useEnvironmentList.ts
@@ -0,0 +1,140 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { withError } from '@/react-tools/react-query';
+import {
+  PlatformType,
+  EnvironmentStatus,
+} from '@/react/portainer/environments/types';
+
+import {
+  EnvironmentsQueryParams,
+  getEnvironments,
+} from '../environment.service';
+
+import { environmentQueryKeys } from './query-keys';
+
+export const ENVIRONMENTS_POLLING_INTERVAL = 30000; // in ms
+
+export const SortOptions = [
+  'Name',
+  'Group',
+  'Status',
+  'PlatformType',
+  'LastCheckIn',
+  'EdgeID',
+  'Health',
+  'Id',
+] as const;
+export type SortType = (typeof SortOptions)[number];
+export function isSortType(value?: string): value is SortType {
+  return SortOptions.includes(value as SortType);
+}
+
+export function getSortType(value?: string): SortType | undefined {
+  return isSortType(value) ? value : undefined;
+}
+
+export function getSortTypeCaseInsensitive(
+  value?: string
+): SortType | undefined {
+  if (!value) return undefined;
+  return SortOptions.find((opt) => opt.toLowerCase() === value.toLowerCase());
+}
+
+export type Query = EnvironmentsQueryParams & {
+  page?: number;
+  /** Use 0 to fetch all environments without pagination (backend supports limit=0). */
+  pageLimit?: number;
+  sort?: SortType;
+  order?: 'asc' | 'desc';
+};
+
+type GetEndpointsResponse = Awaited<ReturnType<typeof getEnvironments>>;
+
+export function refetchIfAnyOffline(data?: GetEndpointsResponse) {
+  if (!data) {
+    return false;
+  }
+
+  const hasOfflineEnvironment = data.value.some(
+    (env) => env.Status === EnvironmentStatus.Down
+  );
+
+  if (!hasOfflineEnvironment) {
+    return false;
+  }
+
+  return ENVIRONMENTS_POLLING_INTERVAL;
+}
+
+export function useEnvironmentList(
+  { page = 1, pageLimit = 100, sort, order, ...query }: Query = {},
+  {
+    enabled,
+    refetchInterval,
+    staleTime,
+  }: {
+    refetchInterval?:
+      | number
+      | false
+      | ((data?: GetEndpointsResponse) => false | number);
+    staleTime?: number;
+    enabled?: boolean;
+  } = {}
+) {
+  const { isLoading, data } = useQuery(
+    [
+      ...environmentQueryKeys.base(),
+      { page, pageLimit, sort, order, ...query },
+    ],
+    async () => {
+      const start = pageLimit === 0 ? 0 : (page - 1) * pageLimit + 1;
+
+      return getEnvironments({
+        start,
+        limit: pageLimit,
+        sort: { by: sort, order },
+        query,
+      });
+    },
+    {
+      staleTime,
+      keepPreviousData: true,
+      refetchInterval,
+      enabled,
+      ...withError('Failure retrieving environments'),
+    }
+  );
+
+  if (data?.value && query && query.platformTypes) {
+    const platforms = Array.from(query.platformTypes);
+
+    if (
+      platforms.includes(PlatformType.Podman) !==
+      platforms.includes(PlatformType.Docker)
+    ) {
+      const isPodmanSelected = platforms.includes(PlatformType.Podman);
+      const containerEngineToExclude = isPodmanSelected ? 'docker' : 'podman';
+
+      const filteredList = data?.value.filter(
+        (env) => env.ContainerEngine !== containerEngineToExclude
+      );
+
+      return {
+        isLoading,
+        environments: filteredList,
+        totalCount: data ? data.totalCount : 0,
+        totalAvailable: data ? data.totalAvailable : 0,
+        updateAvailable: data ? data.updateAvailable : false,
+      };
+    }
+  }
+
+  return {
+    isLoading,
+    environments: data ? data.value : [],
+    totalCount: data ? data.totalCount : 0,
+    totalAvailable: data ? data.totalAvailable : 0,
+    updateAvailable: data ? data.updateAvailable : false,
+  };
+}
diff --git a/app/react/portainer/environments/queries/useEnvironmentRegistries.ts b/app/react/portainer/environments/queries/useEnvironmentRegistries.ts
new file mode 100644
index 0000000..917f8bb
--- /dev/null
+++ b/app/react/portainer/environments/queries/useEnvironmentRegistries.ts
@@ -0,0 +1,44 @@
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { buildUrl } from '../environment.service/utils';
+import { EnvironmentId } from '../types';
+import { Registry } from '../../registries/types/registry';
+import {
+  GenericRegistriesQueryOptions,
+  useGenericRegistriesQuery,
+} from '../../registries/queries/useRegistries';
+
+import { environmentQueryKeys } from './query-keys';
+
+export function useEnvironmentRegistries<T = Array<Registry>>(
+  environmentId: EnvironmentId,
+  queryOptions: GenericRegistriesQueryOptions<T> = {}
+) {
+  const { namespace } = queryOptions;
+  return useGenericRegistriesQuery(
+    environmentQueryKeys.registries(environmentId, namespace),
+    () => getEnvironmentRegistries(environmentId, { namespace }),
+    queryOptions
+  );
+}
+
+type Params = {
+  namespace?: string;
+};
+
+async function getEnvironmentRegistries(
+  environmentId: EnvironmentId,
+  params: Params
+) {
+  try {
+    const { data } = await axios.get<Array<Registry>>(
+      buildUrl(environmentId, 'registries'),
+      {
+        params,
+      }
+    );
+    return data;
+  } catch (err) {
+    throw parseAxiosError(err as Error, 'Unable to retrieve registries');
+  }
+}
diff --git a/app/react/portainer/environments/queries/useEnvironmentSummaryCounts.ts b/app/react/portainer/environments/queries/useEnvironmentSummaryCounts.ts
new file mode 100644
index 0000000..ffd4786
--- /dev/null
+++ b/app/react/portainer/environments/queries/useEnvironmentSummaryCounts.ts
@@ -0,0 +1,24 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { withError } from '@/react-tools/react-query';
+
+import {
+  getEnvironmentSummaryCounts,
+  EnvironmentSummaryCounts,
+} from '../environment.service';
+
+import { ENVIRONMENTS_POLLING_INTERVAL } from './useEnvironmentList';
+import { environmentQueryKeys } from './query-keys';
+
+export type { EnvironmentSummaryCounts };
+
+export function useEnvironmentSummaryCounts() {
+  return useQuery(
+    [...environmentQueryKeys.base(), 'summaryCounts'],
+    () => getEnvironmentSummaryCounts(),
+    {
+      refetchInterval: ENVIRONMENTS_POLLING_INTERVAL,
+      ...withError('Unable to retrieve environment summary counts'),
+    }
+  );
+}
diff --git a/app/react/portainer/environments/queries/useIsPodman.ts b/app/react/portainer/environments/queries/useIsPodman.ts
new file mode 100644
index 0000000..12f2720
--- /dev/null
+++ b/app/react/portainer/environments/queries/useIsPodman.ts
@@ -0,0 +1,15 @@
+import { ContainerEngine, EnvironmentId } from '../types';
+
+import { useEnvironment } from './useEnvironment';
+
+/**
+ * useIsPodman returns true if the current environment is using podman as container engine.
+ * @returns isPodman boolean, can also be undefined if the environment hasn't loaded yet.
+ */
+export function useIsPodman(envId: EnvironmentId) {
+  const { data: isPodman } = useEnvironment(
+    envId,
+    (env) => env.ContainerEngine === ContainerEngine.Podman
+  );
+  return isPodman;
+}
diff --git a/app/react/portainer/environments/queries/useParseApiSortParams.test.ts b/app/react/portainer/environments/queries/useParseApiSortParams.test.ts
new file mode 100644
index 0000000..93fe9f1
--- /dev/null
+++ b/app/react/portainer/environments/queries/useParseApiSortParams.test.ts
@@ -0,0 +1,118 @@
+import { renderHook } from '@testing-library/react-hooks';
+import { describe, expect, it } from 'vitest';
+
+import {
+  EnvironmentStatus,
+  EnvironmentType,
+  PlatformType,
+} from '@/react/portainer/environments/types';
+import { EnvironmentGroup } from '@/react/portainer/environments/environment-groups/types';
+import { createMockEnvironmentGroup } from '@/react-tools/test-mocks';
+
+import { useParseSortGroupApiParams } from './useParseApiSortParams';
+
+const groups: EnvironmentGroup[] = [
+  createMockEnvironmentGroup({ Id: 1, Name: 'Unassigned' }),
+  createMockEnvironmentGroup({ Id: 2, Name: 'Production' }),
+];
+
+describe('useParseSortGroupApiParams', () => {
+  it('returns empty params when no filter is selected', () => {
+    const { result } = renderHook(() =>
+      useParseSortGroupApiParams(null, 'Health', groups)
+    );
+    expect(result.current).toEqual({});
+  });
+
+  describe('Health sort', () => {
+    it('maps Up to status=[Up]', () => {
+      const { result } = renderHook(() =>
+        useParseSortGroupApiParams('Up', 'Health', groups)
+      );
+      expect(result.current).toEqual({ status: [EnvironmentStatus.Up] });
+    });
+
+    it('maps Down to status=[Down]', () => {
+      const { result } = renderHook(() =>
+        useParseSortGroupApiParams('Down', 'Health', groups)
+      );
+      expect(result.current).toEqual({ status: [EnvironmentStatus.Down] });
+    });
+
+    it('maps Outdated to outdated=true (no status)', () => {
+      const { result } = renderHook(() =>
+        useParseSortGroupApiParams('Outdated', 'Health', groups)
+      );
+      expect(result.current).toEqual({ outdated: true });
+    });
+
+    it('maps Heartbeat to edge types + status=[Up] so backend returns only edge envs with a valid heartbeat', () => {
+      const { result } = renderHook(() =>
+        useParseSortGroupApiParams('Heartbeat', 'Health', groups)
+      );
+      expect(result.current).toEqual({
+        types: [
+          EnvironmentType.EdgeAgentOnDocker,
+          EnvironmentType.EdgeAgentOnKubernetes,
+        ],
+        status: [EnvironmentStatus.Up],
+      });
+    });
+
+    it('returns a fresh types array (not the shared EdgeTypes tuple) for each call', () => {
+      const { result: first } = renderHook(() =>
+        useParseSortGroupApiParams('Heartbeat', 'Health', groups)
+      );
+      const { result: second } = renderHook(() =>
+        useParseSortGroupApiParams('Heartbeat', 'Health', groups)
+      );
+      expect(first.current.types).not.toBe(second.current.types);
+      expect(first.current.types).toEqual(second.current.types);
+    });
+  });
+
+  describe('Group sort', () => {
+    it('maps Unassigned to groupIds=[1]', () => {
+      const { result } = renderHook(() =>
+        useParseSortGroupApiParams('1', 'Group', groups)
+      );
+      expect(result.current).toEqual({ groupIds: [1] });
+    });
+
+    it('maps a named group to that group id', () => {
+      const { result } = renderHook(() =>
+        useParseSortGroupApiParams('2', 'Group', groups)
+      );
+      expect(result.current).toEqual({ groupIds: [2] });
+    });
+
+    it('returns empty params when the group id cannot be resolved', () => {
+      const { result } = renderHook(() =>
+        useParseSortGroupApiParams('99', 'Group', groups)
+      );
+      expect(result.current).toEqual({});
+    });
+  });
+
+  describe('Platform sort', () => {
+    it('maps Docker to platformTypes=[Docker] and clears types', () => {
+      const { result } = renderHook(() =>
+        useParseSortGroupApiParams('Docker', 'PlatformType', groups)
+      );
+      expect(result.current).toEqual({
+        types: [],
+        platformTypes: [PlatformType.Docker],
+      });
+    });
+
+    it('returns empty platformTypes for unknown platforms', () => {
+      const { result } = renderHook(() =>
+        useParseSortGroupApiParams('Unknown', 'PlatformType', groups)
+      );
+      expect(result.current).toEqual({
+        types: [],
+        platformTypes: [],
+      });
+    });
+  });
+});
diff --git a/app/react/portainer/environments/queries/useParseApiSortParams.ts b/app/react/portainer/environments/queries/useParseApiSortParams.ts
new file mode 100644
index 0000000..e5742e9
--- /dev/null
+++ b/app/react/portainer/environments/queries/useParseApiSortParams.ts
@@ -0,0 +1,60 @@
+import { useMemo } from 'react';
+
+import { EnvironmentGroup } from '@/react/portainer/environments/environment-groups/types';
+import { EnvironmentsQueryParams } from '@/react/portainer/environments/environment.service';
+import {
+  EdgeTypes,
+  EnvironmentStatus,
+  PlatformType,
+} from '@/react/portainer/environments/types';
+
+export function useParseSortGroupApiParams(
+  sortGroupFilter: string | null,
+  sortKey: string,
+  groupQueryData: EnvironmentGroup[] | undefined
+) {
+  return useMemo<Partial<EnvironmentsQueryParams>>(() => {
+    if (!sortGroupFilter) return {};
+    switch (sortKey) {
+      case 'Group': {
+        const group = groupQueryData
+          ? groupQueryData.find((g) => g.Id.toString() === sortGroupFilter)
+          : undefined;
+        return group ? { groupIds: [group.Id] } : {};
+      }
+      case 'PlatformType': {
+        const typesByPlatform: Record<string, PlatformType> = {
+          Docker: PlatformType.Docker,
+          Podman: PlatformType.Podman,
+          Kubernetes: PlatformType.Kubernetes,
+          Azure: PlatformType.Azure,
+        };
+        const platformType = typesByPlatform[sortGroupFilter];
+        return {
+          types: [],
+          platformTypes: platformType !== undefined ? [platformType] : [],
+        };
+      }
+      case 'Health': {
+        if (sortGroupFilter === 'Outdated') {
+          return { outdated: true };
+        }
+        if (sortGroupFilter === 'Heartbeat') {
+          // Edge envs with an active heartbeat: backend derives Up/Down from
+          // check-in timing, so filter to edge types with derived status=Up.
+          return {
+            types: [...EdgeTypes],
+            status: [EnvironmentStatus.Up],
+          };
+        }
+        const statusByLabel: Record<string, EnvironmentStatus[]> = {
+          Up: [EnvironmentStatus.Up],
+          Down: [EnvironmentStatus.Down],
+        };
+        return { status: statusByLabel[sortGroupFilter] ?? [] };
+      }
+      default:
+        return {};
+    }
+  }, [sortGroupFilter, sortKey, groupQueryData]);
+}
diff --git a/app/react/portainer/environments/queries/useUpdateEnvironmentMutation.ts b/app/react/portainer/environments/queries/useUpdateEnvironmentMutation.ts
new file mode 100644
index 0000000..d6a3610
--- /dev/null
+++ b/app/react/portainer/environments/queries/useUpdateEnvironmentMutation.ts
@@ -0,0 +1,90 @@
+import { useQueryClient, useMutation } from '@tanstack/react-query';
+
+import {
+  EndpointsEndpointUpdatePayload,
+  PortainerEndpoint,
+} from '@api/types.gen';
+
+import { withError, withInvalidate } from '@/react-tools/react-query';
+import {
+  EnvironmentId,
+  EnvironmentStatusMessage,
+  KubernetesSettings,
+} from '@/react/portainer/environments/types';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { buildUrl, toEnvironment } from '../environment.service/utils';
+
+import { environmentQueryKeys } from './query-keys';
+
+export function useUpdateEnvironmentMutation() {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: updateEnvironment,
+    ...withInvalidate(queryClient, [environmentQueryKeys.base()]),
+    ...withError('Unable to update environment'),
+  });
+}
+
+export type UpdateEnvironmentPayload = Omit<
+  EndpointsEndpointUpdatePayload,
+  'Kubernetes'
+> & {
+  Kubernetes?: KubernetesSettings;
+  TLSCACert: File | undefined;
+  TLSCert: File | undefined;
+  TLSKey: File | undefined;
+  IsSetStatusMessage?: boolean;
+  StatusMessage?: EnvironmentStatusMessage;
+};
+
+export async function updateEnvironment({
+  id,
+  payload,
+}: {
+  id: EnvironmentId;
+  payload: Partial<UpdateEnvironmentPayload>;
+}) {
+  try {
+    await uploadTLSFilesForEndpoint(
+      id,
+      payload.TLSCACert,
+      payload.TLSCert,
+      payload.TLSKey
+    );
+
+    const { data } = await axios.put<PortainerEndpoint>(buildUrl(id), payload);
+
+    return toEnvironment(data);
+  } catch (e) {
+    throw parseAxiosError(e as Error, 'Unable to update environment');
+  }
+}
+
+async function uploadTLSFilesForEndpoint(
+  id: EnvironmentId,
+  tlscaCert?: File,
+  tlsCert?: File,
+  tlsKey?: File
+) {
+  await Promise.all([
+    uploadCert('ca', tlscaCert),
+    uploadCert('cert', tlsCert),
+    uploadCert('key', tlsKey),
+  ]);
+
+  function uploadCert(type: 'ca' | 'cert' | 'key', cert?: File) {
+    if (!cert) {
+      return null;
+    }
+    const formData = new FormData();
+    formData.append('file', cert);
+    try {
+      return axios.post<void>(`upload/tls/${type}`, formData, {
+        params: { folder: id },
+      });
+    } catch (e) {
+      throw parseAxiosError(e as Error);
+    }
+  }
+}
diff --git a/app/react/portainer/environments/queries/useUpdateEnvironmentsRelationsMutation.ts b/app/react/portainer/environments/queries/useUpdateEnvironmentsRelationsMutation.ts
new file mode 100644
index 0000000..cf70e30
--- /dev/null
+++ b/app/react/portainer/environments/queries/useUpdateEnvironmentsRelationsMutation.ts
@@ -0,0 +1,51 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import {
+  mutationOptions,
+  withError,
+  withInvalidate,
+} from '@/react-tools/react-query';
+import { EdgeGroup } from '@/react/edge/edge-groups/types';
+import { TagId } from '@/portainer/tags/types';
+import { queryKeys as edgeGroupQueryKeys } from '@/react/edge/edge-groups/queries/query-keys';
+import { queryKeys as groupQueryKeys } from '@/react/portainer/environments/environment-groups/queries/query-keys';
+import { tagKeys } from '@/portainer/tags/queries';
+
+import { EnvironmentId, EnvironmentGroupId } from '../types';
+import { buildUrl } from '../environment.service/utils';
+
+import { environmentQueryKeys } from './query-keys';
+
+export function useUpdateEnvironmentsRelationsMutation() {
+  const queryClient = useQueryClient();
+
+  return useMutation(
+    updateEnvironmentRelations,
+    mutationOptions(
+      withInvalidate(queryClient, [
+        environmentQueryKeys.base(),
+        edgeGroupQueryKeys.base(),
+        groupQueryKeys.base(),
+        tagKeys.all,
+      ]),
+      withError('Unable to update environment relations')
+    )
+  );
+}
+
+export interface EnvironmentRelationsPayload {
+  edgeGroups: Array<EdgeGroup['Id']>;
+  group: EnvironmentGroupId;
+  tags: Array<TagId>;
+}
+
+export async function updateEnvironmentRelations(
+  relations: Record<EnvironmentId, EnvironmentRelationsPayload>
+) {
+  try {
+    await axios.put(buildUrl(undefined, 'relations'), { relations });
+  } catch (e) {
+    throw parseAxiosError(e as Error, 'Unable to update environment relations');
+  }
+}
diff --git a/app/react/portainer/environments/types.ts b/app/react/portainer/environments/types.ts
new file mode 100644
index 0000000..195db28
--- /dev/null
+++ b/app/react/portainer/environments/types.ts
@@ -0,0 +1,185 @@
+import {
+  PortainerEndpoint,
+  PortainerEndpointSecuritySettings,
+} from '@api/types.gen';
+
+import { TagId } from '@/portainer/tags/types';
+import { DockerSnapshot } from '@/react/docker/snapshots/types';
+
+export type EnvironmentGroupId = number;
+
+export type EdgeGroupId = number;
+
+type RoleId = number;
+interface AccessPolicy {
+  RoleId: RoleId;
+}
+
+export type UserAccessPolicies = Record<number, AccessPolicy>; // map[UserID]AccessPolicy
+export type TeamAccessPolicies = Record<number, AccessPolicy>;
+
+export type EnvironmentId = number;
+
+/**
+ * matches portainer.EndpointType in app/portainer.go
+ */
+export enum EnvironmentType {
+  // Docker represents an environment(endpoint) connected to a Docker environment(endpoint)
+  Docker = 1,
+  // AgentOnDocker represents an environment(endpoint) connected to a Portainer agent deployed on a Docker environment(endpoint)
+  AgentOnDocker,
+  // Azure represents an environment(endpoint) connected to an Azure environment(endpoint)
+  Azure,
+  // EdgeAgentOnDocker represents an environment(endpoint) connected to an Edge agent deployed on a Docker environment(endpoint)
+  EdgeAgentOnDocker,
+  // KubernetesLocal represents an environment(endpoint) connected to a local Kubernetes environment(endpoint)
+  KubernetesLocal,
+  // AgentOnKubernetes represents an environment(endpoint) connected to a Portainer agent deployed on a Kubernetes environment(endpoint)
+  AgentOnKubernetes,
+  // EdgeAgentOnKubernetes represents an environment(endpoint) connected to an Edge agent deployed on a Kubernetes environment(endpoint)
+  EdgeAgentOnKubernetes,
+}
+
+export const EdgeTypes = [
+  EnvironmentType.EdgeAgentOnDocker,
+  EnvironmentType.EdgeAgentOnKubernetes,
+] as const;
+
+export enum EnvironmentStatus {
+  Up = 1,
+  Down,
+  Provisioning,
+  Error,
+}
+
+export interface KubernetesSnapshot {
+  KubernetesVersion: string;
+  TotalCPU: number;
+  TotalMemory: number;
+  Time: number;
+  NodeCount: number;
+  GPUNodeCount?: number;
+  TotalGPU?: Record<string, number>;
+}
+
+export type IngressClass = {
+  Name: string;
+  Type: string;
+  Blocked?: boolean;
+  BlockedNamespaces?: string[];
+};
+
+export interface StorageClass {
+  Name: string;
+  AccessModes: string[];
+  AllowVolumeExpansion: boolean;
+  Provisioner: string;
+}
+
+export interface KubernetesConfiguration {
+  UseLoadBalancer?: boolean;
+  StorageClasses?: StorageClass[];
+  UseServerMetrics?: boolean;
+  EnableResourceOverCommit?: boolean;
+  ResourceOverCommitPercentage?: number;
+  RestrictDefaultNamespace?: boolean;
+  RestrictSecrets?: boolean;
+  RestrictStandardUserIngressW?: boolean;
+  IngressClasses: IngressClass[];
+  IngressAvailabilityPerNamespace: boolean;
+  AllowNoneIngressClass: boolean;
+}
+
+export interface KubernetesSettings {
+  Snapshots?: KubernetesSnapshot[];
+  Configuration: KubernetesConfiguration;
+  Flags: {
+    IsServerMetricsDetected: boolean;
+    IsServerIngressClassDetected: boolean;
+    IsServerStorageDetected: boolean;
+  };
+}
+
+export type EnvironmentEdge = {
+  AsyncMode: boolean;
+  PingInterval: number;
+  SnapshotInterval: number;
+  CommandInterval: number;
+};
+
+export type EnvironmentSecuritySettings = PortainerEndpointSecuritySettings;
+
+export type DeploymentOptions = {
+  overrideGlobalOptions: boolean;
+  hideAddWithForm: boolean;
+  hideWebEditor: boolean;
+  hideFileUpload: boolean;
+};
+
+/**
+ *  EndpointChangeWindow determine when GitOps stack/app updates may occur
+ */
+export interface EndpointChangeWindow {
+  Enabled: boolean;
+  StartTime: string;
+  EndTime: string;
+}
+export interface EnvironmentStatusMessage {
+  summary: string;
+  detail: string;
+}
+
+type EnvironmentBase = Omit<PortainerEndpoint, 'Status'>;
+
+export interface Environment extends EnvironmentBase {
+  Status: EnvironmentStatus;
+  Type: EnvironmentType;
+  ContainerEngine: ContainerEngine;
+
+  TagIds: TagId[];
+  Snapshots: DockerSnapshot[];
+  Agent: { Version: string; IsOutdated?: boolean };
+  Edge: EnvironmentEdge;
+  EnableGPUManagement: boolean;
+  Kubernetes: KubernetesSettings;
+
+  // Fields not in CE PortainerEndpoint (EE-only in server)
+  LocalTimeZone?: string;
+  EnableImageNotification: boolean;
+  ChangeWindow: EndpointChangeWindow;
+  DeploymentOptions: DeploymentOptions | null;
+  StatusMessage?: EnvironmentStatusMessage;
+}
+
+/**
+ * TS reference of endpoint_create.go#EndpointCreationType iota
+ */
+export enum EnvironmentCreationTypes {
+  LocalDockerEnvironment = 1,
+  AgentEnvironment,
+  AzureEnvironment,
+  EdgeAgentEnvironment,
+  LocalKubernetesEnvironment,
+  KubeConfigEnvironment,
+}
+
+export enum ContainerEngine {
+  Docker = 'docker',
+  Podman = 'podman',
+  // an empty container engine means that the endpoint is a Kubernetes endpoint
+  Kubernetes = '',
+}
+
+export enum PlatformType {
+  Docker,
+  Kubernetes,
+  Azure,
+  Podman,
+}
+
+export enum EnvironmentHealth {
+  Down,
+  Outdated,
+  Up,
+  Heartbeat,
+}
diff --git a/app/react/portainer/environments/update-schedules/CreateView/CreateView.tsx b/app/react/portainer/environments/update-schedules/CreateView/CreateView.tsx
new file mode 100644
index 0000000..2408a14
--- /dev/null
+++ b/app/react/portainer/environments/update-schedules/CreateView/CreateView.tsx
@@ -0,0 +1,137 @@
+import { useMemo } from 'react';
+import { Settings } from 'lucide-react';
+import { Formik, Form as FormikForm } from 'formik';
+import { useRouter } from '@uirouter/react';
+
+import { notifySuccess } from '@/portainer/services/notifications';
+import { withLimitToBE } from '@/react/hooks/useLimitToBE';
+import { useEdgeGroups } from '@/react/edge/edge-groups/queries/useEdgeGroups';
+
+import { PageHeader } from '@@/PageHeader';
+import { Widget } from '@@/Widget';
+import { LoadingButton } from '@@/buttons';
+import { TextTip } from '@@/Tip/TextTip';
+import { Link } from '@@/Link';
+
+import { ScheduleType } from '../types';
+import { useCreateMutation } from '../queries/create';
+import { FormValues } from '../common/types';
+import { validation } from '../common/validation';
+import { ScheduleTypeSelector } from '../common/ScheduleTypeSelector';
+import { useList } from '../queries/list';
+import { NameField } from '../common/NameField';
+import { EdgeGroupsField } from '../common/EdgeGroupsField';
+import { BetaAlert } from '../common/BetaAlert';
+import { defaultValue } from '../common/ScheduledTimeField';
+
+export default withLimitToBE(CreateView);
+
+function CreateView() {
+  const initialValues = useMemo<FormValues>(
+    () => ({
+      name: '',
+      groupIds: [],
+      type: ScheduleType.Update,
+      version: '',
+      scheduledTime: defaultValue(),
+    }),
+    []
+  );
+  const edgeGroupsQuery = useEdgeGroups();
+  const schedulesQuery = useList();
+
+  const createMutation = useCreateMutation();
+  const router = useRouter();
+
+  if (!schedulesQuery.data) {
+    return null;
+  }
+
+  const schedules = schedulesQuery.data;
+
+  return (
+    <>
+      <PageHeader
+        title="Update & Rollback"
+        breadcrumbs="Edge agent update and rollback"
+        reload
+      />
+
+      <BetaAlert
+        className="mb-2 ml-[15px]"
+        message="Beta feature - currently limited to standalone Linux edge devices."
+      />
+
+      <div className="row">
+        <div className="col-sm-12">
+          <Widget>
+            <Widget.Title title="Update & Rollback Scheduler" icon={Settings} />
+            <Widget.Body>
+              <TextTip color="blue" className="mb-2">
+                Devices need to be allocated to an Edge group, visit the{' '}
+                <Link
+                  to="edge.groups"
+                  data-cy="update-schedules-create-edge-groups-link"
+                >
+                  Edge Groups
+                </Link>{' '}
+                page to assign environments and create groups.
+                <br />
+                You can upgrade from any agent version to 2.17 or later only.
+                You can not upgrade to an agent version prior to 2.17 . The
+                ability to rollback to originating version is for 2.15.0+ only.
+              </TextTip>
+
+              <Formik
+                initialValues={initialValues}
+                onSubmit={handleSubmit}
+                validateOnMount
+                validationSchema={() =>
+                  validation(schedules, edgeGroupsQuery.data)
+                }
+              >
+                {({ isValid, setFieldValue, values, handleBlur, errors }) => (
+                  <FormikForm className="form-horizontal">
+                    <NameField />
+                    <EdgeGroupsField
+                      onChange={(value) => setFieldValue('groupIds', value)}
+                      value={values.groupIds}
+                      onBlur={handleBlur}
+                      error={errors.groupIds}
+                    />
+
+                    <div className="mt-2">
+                      <ScheduleTypeSelector />
+                    </div>
+
+                    <div className="form-group">
+                      <div className="col-sm-12">
+                        <LoadingButton
+                          disabled={!isValid}
+                          data-cy="update-schedules-create-submit-button"
+                          isLoading={createMutation.isLoading}
+                          loadingText="Creating..."
+                        >
+                          Create Schedule
+                        </LoadingButton>
+                      </div>
+                    </div>
+                  </FormikForm>
+                )}
+              </Formik>
+            </Widget.Body>
+          </Widget>
+        </div>
+      </div>
+    </>
+  );
+
+  function handleSubmit(values: FormValues) {
+    createMutation.mutate(values, {
+      onSuccess() {
+        notifySuccess('Success', 'Created schedule successfully');
+        router.stateService.go('^');
+      },
+    });
+  }
+}
diff --git a/app/react/portainer/environments/update-schedules/CreateView/index.ts b/app/react/portainer/environments/update-schedules/CreateView/index.ts
new file mode 100644
index 0000000..e1f585e
--- /dev/null
+++ b/app/react/portainer/environments/update-schedules/CreateView/index.ts
@@ -0,0 +1 @@
+export { default as CreateView } from './CreateView';
diff --git a/app/react/portainer/environments/update-schedules/ItemView/ItemView.tsx b/app/react/portainer/environments/update-schedules/ItemView/ItemView.tsx
new file mode 100644
index 0000000..90c83f6
--- /dev/null
+++ b/app/react/portainer/environments/update-schedules/ItemView/ItemView.tsx
@@ -0,0 +1,199 @@
+import { Settings } from 'lucide-react';
+import { Formik, Form as FormikForm } from 'formik';
+import { useCurrentStateAndParams, useRouter } from '@uirouter/react';
+import { object, SchemaOf } from 'yup';
+
+import { notifySuccess } from '@/portainer/services/notifications';
+import { withLimitToBE } from '@/react/hooks/useLimitToBE';
+import { useEdgeGroups } from '@/react/edge/edge-groups/queries/useEdgeGroups';
+import { EdgeGroup } from '@/react/edge/edge-groups/types';
+
+import { PageHeader } from '@@/PageHeader';
+import { Widget } from '@@/Widget';
+import { LoadingButton } from '@@/buttons';
+import { TextTip } from '@@/Tip/TextTip';
+import { InformationPanel } from '@@/InformationPanel';
+import { Link } from '@@/Link';
+
+import { useItem } from '../queries/useItem';
+import { validation } from '../common/validation';
+import { useUpdateMutation } from '../queries/useUpdateMutation';
+import { useList } from '../queries/list';
+import { NameField, nameValidation } from '../common/NameField';
+import { EdgeGroupsField } from '../common/EdgeGroupsField';
+import { EdgeUpdateSchedule } from '../types';
+import { FormValues } from '../common/types';
+import { ScheduleTypeSelector } from '../common/ScheduleTypeSelector';
+import { BetaAlert } from '../common/BetaAlert';
+
+export default withLimitToBE(ItemView);
+
+function ItemView() {
+  const {
+    params: { id: idParam },
+  } = useCurrentStateAndParams();
+
+  const id = parseInt(idParam, 10);
+  const edgeGroupsQuery = useEdgeGroups();
+
+  if (!idParam || Number.isNaN(id)) {
+    throw new Error('id is a required path param');
+  }
+
+  const updateMutation = useUpdateMutation();
+  const router = useRouter();
+  const itemQuery = useItem(id);
+  const schedulesQuery = useList();
+
+  if (!itemQuery.data || !schedulesQuery.data) {
+    return null;
+  }
+
+  const item = itemQuery.data;
+  const isScheduleActive = item.isActive;
+
+  const schedules = schedulesQuery.data;
+
+  const initialValuesActive: Partial<FormValues> = {
+    name: item.name,
+  };
+
+  const initialValues: FormValues = {
+    name: item.name,
+    groupIds: item.edgeGroupIds,
+    type: item.type,
+    version: item.version,
+    scheduledTime: item.scheduledTime,
+  };
+
+  const environmentsCount = Object.keys(
+    item.environmentsPreviousVersions
+  ).length;
+
+  return (
+    <>
+      <PageHeader
+        title="Update & Rollback"
+        breadcrumbs={[
+          { label: 'Edge agent update and rollback', link: '^' },
+          item.name,
+        ]}
+        reload
+      />
+
+      <BetaAlert
+        className="mb-2 ml-[15px]"
+        message="Beta feature - currently limited to standalone Linux edge devices."
+      />
+
+      <div className="row">
+        <div className="col-sm-12">
+          <Widget>
+            <Widget.Title title="Update & Rollback Scheduler" icon={Settings} />
+            <Widget.Body>
+              <TextTip color="blue" className="mb-2">
+                Devices need to be allocated to an Edge group, visit the{' '}
+                <Link
+                  to="edge.groups"
+                  data-cy="update-schedules-edge-groups-link"
+                >
+                  Edge Groups
+                </Link>{' '}
+                page to assign environments and create groups.
+                <br />
+                You can upgrade from any agent version to 2.17 or later only.
+                You can not upgrade to an agent version prior to 2.17 . The
+                ability to rollback to originating version is for 2.15.0+ only.
+              </TextTip>
+
+              <Formik
+                initialValues={
+                  !isScheduleActive ? initialValues : initialValuesActive
+                }
+                onSubmit={(values) => {
+                  updateMutation.mutate(
+                    { id, values },
+                    {
+                      onSuccess() {
+                        notifySuccess(
+                          'Success',
+                          'Updated schedule successfully'
+                        );
+                        router.stateService.go('^');
+                      },
+                    }
+                  );
+                }}
+                validateOnMount
+                validationSchema={() =>
+                  updateValidation(
+                    item.id,
+                    schedules,
+                    edgeGroupsQuery.data,
+                    isScheduleActive
+                  )
+                }
+              >
+                {({ isValid, setFieldValue, values, handleBlur, errors }) => (
+                  <FormikForm className="form-horizontal">
+                    <NameField />
+
+                    <EdgeGroupsField
+                      disabled={isScheduleActive}
+                      onChange={(value) => setFieldValue('groupIds', value)}
+                      value={
+                        isScheduleActive
+                          ? item.edgeGroupIds
+                          : values.groupIds || []
+                      }
+                      onBlur={handleBlur}
+                      error={errors.groupIds}
+                    />
+
+                    <div className="mt-2">
+                      {isScheduleActive ? (
+                        <InformationPanel>
+                          <TextTip color="blue">
+                            {environmentsCount} environment(s) will be updated
+                            to version {item.version} on {item.scheduledTime}{' '}
+                            (local time)
+                          </TextTip>
+                        </InformationPanel>
+                      ) : (
+                        <ScheduleTypeSelector />
+                      )}
+                    </div>
+
+                    <div className="form-group">
+                      <div className="col-sm-12">
+                        <LoadingButton
+                          disabled={!isValid}
+                          data-cy="update-schedule-button"
+                          isLoading={updateMutation.isLoading}
+                          loadingText="Updating..."
+                        >
+                          Update Schedule
+                        </LoadingButton>
+                      </div>
+                    </div>
+                  </FormikForm>
+                )}
+              </Formik>
+            </Widget.Body>
+          </Widget>
+        </div>
+      </div>
+    </>
+  );
+}
+
+function updateValidation(
+  itemId: EdgeUpdateSchedule['id'],
+  schedules: EdgeUpdateSchedule[],
+  edgeGroups: Array<EdgeGroup> | undefined,
+  isScheduleActive: boolean
+): SchemaOf<{ name: string } | FormValues> {
+  return !isScheduleActive
+    ? validation(schedules, edgeGroups, itemId)
+    : object({ name: nameValidation(schedules, itemId) });
+}
diff --git a/app/react/portainer/environments/update-schedules/ItemView/index.ts b/app/react/portainer/environments/update-schedules/ItemView/index.ts
new file mode 100644
index 0000000..9c264d4
--- /dev/null
+++ b/app/react/portainer/environments/update-schedules/ItemView/index.ts
@@ -0,0 +1 @@
+export { default as ItemView } from './ItemView';
diff --git a/app/react/portainer/environments/update-schedules/ListView/ListView.tsx b/app/react/portainer/environments/update-schedules/ListView/ListView.tsx
new file mode 100644
index 0000000..36a79cb
--- /dev/null
+++ b/app/react/portainer/environments/update-schedules/ListView/ListView.tsx
@@ -0,0 +1,111 @@
+import { Clock } from 'lucide-react';
+import { useMemo } from 'react';
+import _ from 'lodash';
+
+import { notifySuccess } from '@/portainer/services/notifications';
+import { withLimitToBE } from '@/react/hooks/useLimitToBE';
+import { useEdgeGroups } from '@/react/edge/edge-groups/queries/useEdgeGroups';
+
+import { Datatable } from '@@/datatables';
+import { PageHeader } from '@@/PageHeader';
+import { AddButton } from '@@/buttons';
+import { useTableState } from '@@/datatables/useTableState';
+import { DeleteButton } from '@@/buttons/DeleteButton';
+
+import { useList } from '../queries/list';
+import { EdgeUpdateSchedule, StatusType } from '../types';
+import { useRemoveMutation } from '../queries/useRemoveMutation';
+import { BetaAlert } from '../common/BetaAlert';
+
+import { columns } from './columns';
+import { createStore } from './datatable-store';
+import { DecoratedItem } from './types';
+
+const storageKey = 'update-schedules-list';
+const settingsStore = createStore(storageKey);
+
+export default withLimitToBE(ListView);
+
+export function ListView() {
+  const tableState = useTableState(settingsStore, storageKey);
+
+  const listQuery = useList(true);
+  const groupsQuery = useEdgeGroups({
+    select: (groups) => Object.fromEntries(groups.map((g) => [g.Id, g.Name])),
+  });
+
+  const items: Array<DecoratedItem> = useMemo(() => {
+    if (!listQuery.data || !groupsQuery.data) {
+      return [];
+    }
+
+    return listQuery.data.map((item) => ({
+      ...item,
+      edgeGroupNames: _.compact(
+        item.edgeGroupIds.map((id) => groupsQuery.data[id])
+      ),
+    }));
+  }, [listQuery.data, groupsQuery.data]);
+
+  if (!listQuery.data || !groupsQuery.data) {
+    return null;
+  }
+
+  return (
+    <>
+      <PageHeader
+        title="Update & Rollback"
+        breadcrumbs="Update and rollback"
+        reload
+      />
+
+      <BetaAlert
+        className="mb-2 ml-[15px]"
+        message="Beta feature - currently limited to standalone Linux edge devices."
+      />
+
+      <Datatable
+        dataset={items}
+        columns={columns}
+        settingsManager={tableState}
+        title="Update & rollback"
+        titleIcon={Clock}
+        isLoading={listQuery.isLoading}
+        renderTableActions={(selectedRows) => (
+          <TableActions selectedRows={selectedRows} />
+        )}
+        isRowSelectable={(row) => row.original.status === StatusType.Pending}
+        data-cy="environment-update-schedules-datatable"
+      />
+    </>
+  );
+}
+
+function TableActions({
+  selectedRows,
+}: {
+  selectedRows: EdgeUpdateSchedule[];
+}) {
+  const removeMutation = useRemoveMutation();
+  return (
+    <>
+      <DeleteButton
+        onConfirmed={() => handleRemove()}
+        disabled={selectedRows.length === 0}
+        data-cy="remove-update-schedules-button"
+        confirmMessage="Are you sure you want to remove these schedules?"
+      />
+      <AddButton to=".create" data-cy="add-update-schedules-button">
+        Add update & rollback schedule
+      </AddButton>
+    </>
+  );
+
+  async function handleRemove() {
+    removeMutation.mutate(selectedRows, {
+      onSuccess: () => {
+        notifySuccess('Success', 'Schedules successfully removed');
+      },
+    });
+  }
+}
diff --git a/app/react/portainer/environments/update-schedules/ListView/columns/created.tsx b/app/react/portainer/environments/update-schedules/ListView/columns/created.tsx
new file mode 100644
index 0000000..cf102e0
--- /dev/null
+++ b/app/react/portainer/environments/update-schedules/ListView/columns/created.tsx
@@ -0,0 +1,12 @@
+import { isoDateFromTimestamp } from '@/portainer/filters/filters';
+
+import { columnHelper } from './helper';
+
+export const created = columnHelper.accessor('created', {
+  id: 'created',
+  header: 'Created',
+  cell: ({ getValue }) => {
+    const value = getValue();
+    return isoDateFromTimestamp(value);
+  },
+});
diff --git a/app/react/portainer/environments/update-schedules/ListView/columns/groups.tsx b/app/react/portainer/environments/update-schedules/ListView/columns/groups.tsx
new file mode 100644
index 0000000..5dd57c0
--- /dev/null
+++ b/app/react/portainer/environments/update-schedules/ListView/columns/groups.tsx
@@ -0,0 +1,18 @@
+import { CellContext } from '@tanstack/react-table';
+
+import { DecoratedItem } from '../types';
+
+import { columnHelper } from './helper';
+
+export const groups = columnHelper.accessor('edgeGroupNames', {
+  header: 'Edge Groups',
+  cell: GroupsCell,
+});
+
+export function GroupsCell({
+  getValue,
+}: CellContext<DecoratedItem, Array<string>>) {
+  const groups = getValue();
+
+  return groups.join(', ');
+}
diff --git a/app/react/portainer/environments/update-schedules/ListView/columns/helper.ts b/app/react/portainer/environments/update-schedules/ListView/columns/helper.ts
new file mode 100644
index 0000000..dc18be1
--- /dev/null
+++ b/app/react/portainer/environments/update-schedules/ListView/columns/helper.ts
@@ -0,0 +1,5 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { DecoratedItem } from '../types';
+
+export const columnHelper = createColumnHelper<DecoratedItem>();
diff --git a/app/react/portainer/environments/update-schedules/ListView/columns/index.ts b/app/react/portainer/environments/update-schedules/ListView/columns/index.ts
new file mode 100644
index 0000000..763cd9a
--- /dev/null
+++ b/app/react/portainer/environments/update-schedules/ListView/columns/index.ts
@@ -0,0 +1,18 @@
+import { buildNameColumn } from '@@/datatables/buildNameColumn';
+
+import { DecoratedItem } from '../types';
+
+import { created } from './created';
+import { groups } from './groups';
+import { scheduleStatus } from './schedule-status';
+import { scheduledTime } from './scheduled-time';
+import { scheduleType } from './type';
+
+export const columns = [
+  buildNameColumn<DecoratedItem>('name', '.item', 'update-schedules-name'),
+  scheduledTime,
+  groups,
+  scheduleType,
+  scheduleStatus,
+  created,
+];
diff --git a/app/react/portainer/environments/update-schedules/ListView/columns/schedule-status.tsx b/app/react/portainer/environments/update-schedules/ListView/columns/schedule-status.tsx
new file mode 100644
index 0000000..0415b88
--- /dev/null
+++ b/app/react/portainer/environments/update-schedules/ListView/columns/schedule-status.tsx
@@ -0,0 +1,27 @@
+import { CellContext } from '@tanstack/react-table';
+
+import { StatusType } from '../../types';
+import { DecoratedItem } from '../types';
+
+import { columnHelper } from './helper';
+
+export const scheduleStatus = columnHelper.accessor('status', {
+  header: 'Status',
+  cell: StatusCell,
+});
+
+function StatusCell({
+  getValue,
+  row: {
+    original: { statusMessage },
+  },
+}: CellContext<DecoratedItem, DecoratedItem['status']>) {
+  const status = getValue();
+
+  switch (status) {
+    case StatusType.Failed:
+      return statusMessage;
+    default:
+      return StatusType[status];
+  }
+}
diff --git a/app/react/portainer/environments/update-schedules/ListView/columns/scheduled-time.tsx b/app/react/portainer/environments/update-schedules/ListView/columns/scheduled-time.tsx
new file mode 100644
index 0000000..061ac84
--- /dev/null
+++ b/app/react/portainer/environments/update-schedules/ListView/columns/scheduled-time.tsx
@@ -0,0 +1,12 @@
+import { formatDate } from '@/portainer/filters/filters';
+
+import { FORMAT } from '@@/DateTimeField';
+
+import { columnHelper } from './helper';
+
+export const scheduledTime = columnHelper.accessor('scheduledTime', {
+  header: 'Scheduled Time & Date',
+  // make sure the value has the right format
+  cell: ({ getValue }) => formatDate(getValue(), FORMAT, FORMAT),
+  id: 'time',
+});
diff --git a/app/react/portainer/environments/update-schedules/ListView/columns/type.tsx b/app/react/portainer/environments/update-schedules/ListView/columns/type.tsx
new file mode 100644
index 0000000..d230d1b
--- /dev/null
+++ b/app/react/portainer/environments/update-schedules/ListView/columns/type.tsx
@@ -0,0 +1,12 @@
+import { ScheduleType } from '../../types';
+
+import { columnHelper } from './helper';
+
+export const scheduleType = columnHelper.accessor('type', {
+  header: 'Type',
+  cell: ({ getValue }) => {
+    const value = getValue();
+
+    return ScheduleType[value];
+  },
+});
diff --git a/app/react/portainer/environments/update-schedules/ListView/datatable-store.ts b/app/react/portainer/environments/update-schedules/ListView/datatable-store.ts
new file mode 100644
index 0000000..047a092
--- /dev/null
+++ b/app/react/portainer/environments/update-schedules/ListView/datatable-store.ts
@@ -0,0 +1,26 @@
+import {
+  refreshableSettings,
+  hiddenColumnsSettings,
+  RefreshableTableSettings,
+  SettableColumnsTableSettings,
+  createPersistedStore,
+  BasicTableSettings,
+} from '@/react/components/datatables/types';
+
+interface TableSettings
+  extends
+    BasicTableSettings,
+    SettableColumnsTableSettings,
+    RefreshableTableSettings {}
+
+export function createStore(storageKey: string) {
+  return createPersistedStore<TableSettings>(
+    storageKey,
+    'time',
+
+    (set) => ({
+      ...hiddenColumnsSettings(set),
+      ...refreshableSettings(set),
+    })
+  );
+}
diff --git a/app/react/portainer/environments/update-schedules/ListView/index.ts b/app/react/portainer/environments/update-schedules/ListView/index.ts
new file mode 100644
index 0000000..717a65b
--- /dev/null
+++ b/app/react/portainer/environments/update-schedules/ListView/index.ts
@@ -0,0 +1 @@
+export { default as ListView } from './ListView';
diff --git a/app/react/portainer/environments/update-schedules/ListView/types.ts b/app/react/portainer/environments/update-schedules/ListView/types.ts
new file mode 100644
index 0000000..be71dbf
--- /dev/null
+++ b/app/react/portainer/environments/update-schedules/ListView/types.ts
@@ -0,0 +1,5 @@
+import { EdgeUpdateListItemResponse } from '../queries/list';
+
+export type DecoratedItem = EdgeUpdateListItemResponse & {
+  edgeGroupNames: string[];
+};
diff --git a/app/react/portainer/environments/update-schedules/common/ActiveSchedulesNotice.tsx b/app/react/portainer/environments/update-schedules/common/ActiveSchedulesNotice.tsx
new file mode 100644
index 0000000..c01cc69
--- /dev/null
+++ b/app/react/portainer/environments/update-schedules/common/ActiveSchedulesNotice.tsx
@@ -0,0 +1,109 @@
+import _ from 'lodash';
+import { Clock } from 'lucide-react';
+
+import { Environment } from '@/react/portainer/environments/types';
+import { useEdgeGroups } from '@/react/edge/edge-groups/queries/useEdgeGroups';
+import { EdgeGroup } from '@/react/edge/edge-groups/types';
+
+import { ActiveSchedule } from '../queries/useActiveSchedules';
+import { ScheduleType } from '../types';
+
+export function ActiveSchedulesNotice({
+  selectedEdgeGroupIds,
+  activeSchedules,
+  environments,
+}: {
+  selectedEdgeGroupIds: EdgeGroup['Id'][];
+  activeSchedules: ActiveSchedule[];
+  environments: Environment[];
+}) {
+  const groupsQuery = useEdgeGroups();
+
+  if (!groupsQuery.data) {
+    return null;
+  }
+
+  // environmentId -> {currentVersion, targetVersion}
+  const environmentScheduleGroup = Object.fromEntries(
+    activeSchedules.map((schedule) => [
+      schedule.environmentId,
+      {
+        currentVersion:
+          environments.find((env) => env.Id === schedule.environmentId)?.Agent
+            .Version || '',
+        targetVersion: schedule.targetVersion,
+        type: schedule.type,
+      },
+    ])
+  );
+
+  const edgeGroups = groupsQuery.data
+    .filter((edgeGroup) => selectedEdgeGroupIds.includes(edgeGroup.Id))
+    .map((edgeGroup) => ({
+      edgeGroupId: edgeGroup.Id,
+      edgeGroupName: edgeGroup.Name,
+      schedules: Object.values(
+        _.groupBy(
+          _.compact(
+            edgeGroup.Endpoints.map((eId) => environmentScheduleGroup[eId])
+          ),
+          (schedule) =>
+            `${schedule.currentVersion}_${schedule.targetVersion}_${schedule.type}`
+        )
+      ).map((schedules) => ({
+        currentVersion: schedules[0].currentVersion,
+        targetVersion: schedules[0].targetVersion,
+        scheduleCount: schedules.length,
+        type: schedules[0].type,
+      })),
+    }))
+    .filter((group) => group.schedules.length > 0);
+
+  if (edgeGroups.length === 0) {
+    return null;
+  }
+
+  return (
+    <div className="form-group">
+      <div className="col-sm-12 space-y-1">
+        {edgeGroups.map(({ edgeGroupId, edgeGroupName, schedules }) =>
+          schedules.map(
+            ({ currentVersion, scheduleCount, targetVersion, type }) => (
+              <ActiveSchedulesNoticeItem
+                currentVersion={currentVersion || 'unknown version'}
+                key={`${edgeGroupId}-${currentVersion}-${targetVersion}`}
+                name={edgeGroupName}
+                scheduleCount={scheduleCount}
+                version={targetVersion}
+                scheduleType={type}
+              />
+            )
+          )
+        )}
+      </div>
+    </div>
+  );
+}
+
+function ActiveSchedulesNoticeItem({
+  name,
+  scheduleCount,
+  version,
+  currentVersion,
+  scheduleType,
+}: {
+  name: string;
+  scheduleCount: number;
+  version: string;
+  currentVersion: string;
+  scheduleType: ScheduleType;
+}) {
+  return (
+    <div className="flex items-center gap-1 text-sm">
+      <Clock className="lucide" />
+      {scheduleCount} edge devices in {name} are scheduled for{' '}
+      {scheduleType === ScheduleType.Rollback ? 'rollback' : 'update'} from{' '}
+      {currentVersion} to {version}
+    </div>
+  );
+}
diff --git a/app/react/portainer/environments/update-schedules/common/BetaAlert.tsx b/app/react/portainer/environments/update-schedules/common/BetaAlert.tsx
new file mode 100644
index 0000000..3e41a02
--- /dev/null
+++ b/app/react/portainer/environments/update-schedules/common/BetaAlert.tsx
@@ -0,0 +1,26 @@
+import { ReactNode } from 'react';
+
+import betaIcon from '@/assets/ico/beta.svg?c';
+
+import { TextTip } from '@@/Tip/TextTip';
+
+interface Props {
+  message: ReactNode;
+  className?: string;
+  isHtml?: boolean;
+}
+
+export function BetaAlert({ message, className, isHtml }: Props) {
+  return (
+    <TextTip icon={betaIcon} className={className}>
+      <div className="text-warning">
+        {isHtml && typeof message === 'string' ? (
+          // eslint-disable-next-line react/no-danger
+          <span dangerouslySetInnerHTML={{ __html: message }} />
+        ) : (
+          message
+        )}
+      </div>
+    </TextTip>
+  );
+}
diff --git a/app/react/portainer/environments/update-schedules/common/EdgeGroupsField.tsx b/app/react/portainer/environments/update-schedules/common/EdgeGroupsField.tsx
new file mode 100644
index 0000000..9052a73
--- /dev/null
+++ b/app/react/portainer/environments/update-schedules/common/EdgeGroupsField.tsx
@@ -0,0 +1,65 @@
+import { FormikErrors, FormikHandlers } from 'formik';
+
+import { useEdgeGroups } from '@/react/edge/edge-groups/queries/useEdgeGroups';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { Select } from '@@/form-components/ReactSelect';
+import { TextTip } from '@@/Tip/TextTip';
+
+import { FormValues } from './types';
+
+interface Props {
+  disabled?: boolean;
+  onBlur: FormikHandlers['handleBlur'];
+  value: FormValues['groupIds'];
+  error?: FormikErrors<FormValues>['groupIds'];
+  onChange(value: FormValues['groupIds']): void;
+}
+
+export function EdgeGroupsField({
+  disabled,
+  onBlur,
+  value,
+  error,
+  onChange,
+}: Props) {
+  const groupsQuery = useEdgeGroups();
+
+  const selectedGroups = groupsQuery.data?.filter((group) =>
+    value.includes(group.Id)
+  );
+
+  return (
+    <div>
+      <FormControl
+        label="Groups"
+        required
+        inputId="groups-select"
+        errors={error}
+        tooltip="Updates are done based on groups, allowing you to choose multiple devices at the same time and the ability to roll out progressively across all environments by scheduling them for different days."
+      >
+        <Select
+          name="groupIds"
+          onBlur={onBlur}
+          value={selectedGroups}
+          inputId="groups-select"
+          placeholder="Select one or multiple group(s)"
+          onChange={(selectedGroups) =>
+            onChange(selectedGroups.map((g) => g.Id))
+          }
+          isMulti
+          options={groupsQuery.data || []}
+          getOptionLabel={(group) => group.Name}
+          getOptionValue={(group) => group.Id.toString()}
+          closeMenuOnSelect={false}
+          isDisabled={disabled}
+          data-cy="update-schedules-edge-groups-select"
+          id="update-schedules-edge-groups-select"
+        />
+      </FormControl>
+      <TextTip color="blue">
+        Select groups of Edge environments to update
+      </TextTip>
+    </div>
+  );
+}
diff --git a/app/react/portainer/environments/update-schedules/common/NameField.tsx b/app/react/portainer/environments/update-schedules/common/NameField.tsx
new file mode 100644
index 0000000..5c15a16
--- /dev/null
+++ b/app/react/portainer/environments/update-schedules/common/NameField.tsx
@@ -0,0 +1,36 @@
+import { Field, useField } from 'formik';
+import { string } from 'yup';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+
+import { EdgeUpdateSchedule } from '../types';
+
+import { FormValues } from './types';
+
+export function NameField() {
+  const [{ name }, { error }] = useField<FormValues['name']>('name');
+
+  return (
+    <FormControl
+      label="Name"
+      required
+      inputId="name-input"
+      errors={error}
+      tooltip="A descriptive name helps identify the update or roll back schedule when you have more than one"
+    >
+      <Field as={Input} name={name} id="name-input" />
+    </FormControl>
+  );
+}
+
+export function nameValidation(
+  schedules: EdgeUpdateSchedule[],
+  currentId?: EdgeUpdateSchedule['id']
+) {
+  return string()
+    .required('This field is required')
+    .test('unique', 'Name must be unique', (value) =>
+      schedules.every((s) => s.id === currentId || s.name !== value)
+    );
+}
diff --git a/app/react/portainer/environments/update-schedules/common/RollbackOptions.tsx b/app/react/portainer/environments/update-schedules/common/RollbackOptions.tsx
new file mode 100644
index 0000000..be35415
--- /dev/null
+++ b/app/react/portainer/environments/update-schedules/common/RollbackOptions.tsx
@@ -0,0 +1,106 @@
+import { useFormikContext } from 'formik';
+import _ from 'lodash';
+import { useMemo, useEffect } from 'react';
+
+import { useEdgeGroups } from '@/react/edge/edge-groups/queries/useEdgeGroups';
+
+import { TextTip } from '@@/Tip/TextTip';
+
+import { usePreviousVersions } from '../queries/usePreviousVersions';
+
+import { FormValues } from './types';
+
+export function RollbackOptions() {
+  const { isLoading, count, version, versionError } = useSelectVersionOnMount();
+
+  const groupNames = useGroupNames();
+
+  if (versionError) {
+    return <TextTip>{versionError}</TextTip>;
+  }
+
+  if (!count) {
+    return (
+      <TextTip>
+        There are no rollback options available for your selected groups(s)
+      </TextTip>
+    );
+  }
+
+  if (isLoading || !groupNames) {
+    return null;
+  }
+
+  return (
+    <div className="form-group">
+      <div className="col-sm-12">
+        {count} edge device(s) from {groupNames} will rollback to version{' '}
+        {version}
+      </div>
+    </div>
+  );
+}
+
+function useSelectVersionOnMount() {
+  const {
+    values: { groupIds, version },
+    setFieldValue,
+    setFieldError,
+    errors: { version: versionError },
+  } = useFormikContext<FormValues>();
+
+  const previousVersionsQuery = usePreviousVersions(groupIds ?? []);
+
+  const previousVersions = useMemo(
+    () =>
+      previousVersionsQuery.data
+        ? _.uniq(Object.values(previousVersionsQuery.data))
+        : [],
+    [previousVersionsQuery.data]
+  );
+
+  const previousVersionCount = useMemo(
+    () => Object.keys(previousVersions).length,
+    [previousVersions]
+  );
+
+  useEffect(() => {
+    switch (previousVersions.length) {
+      case 0:
+        setFieldValue('version', '');
+        setFieldError('version', 'No rollback options available');
+        break;
+      case 1:
+        setFieldValue('version', previousVersions[0]);
+        break;
+      default:
+        setFieldError(
+          'version',
+          'Rollback is not available for these edge group as there are multiple version types to rollback to'
+        );
+    }
+  }, [previousVersions, setFieldError, setFieldValue]);
+
+  return {
+    isLoading: previousVersionsQuery.isLoading,
+    versionError,
+    version,
+    count: previousVersionCount,
+  };
+}
+
+function useGroupNames() {
+  const {
+    values: { groupIds },
+  } = useFormikContext<FormValues>();
+
+  const groupsQuery = useEdgeGroups({
+    select: (groups) => Object.fromEntries(groups.map((g) => [g.Id, g.Name])),
+  });
+
+  if (!groupsQuery.data) {
+    return null;
+  }
+
+  return groupIds.map((id) => groupsQuery.data[id]).join(', ');
+}
diff --git a/app/react/portainer/environments/update-schedules/common/RollbackScheduleDetailsFieldset.tsx b/app/react/portainer/environments/update-schedules/common/RollbackScheduleDetailsFieldset.tsx
new file mode 100644
index 0000000..069de8a
--- /dev/null
+++ b/app/react/portainer/environments/update-schedules/common/RollbackScheduleDetailsFieldset.tsx
@@ -0,0 +1,19 @@
+import { RollbackOptions } from './RollbackOptions';
+import { ScheduledTimeField } from './ScheduledTimeField';
+
+interface Props {
+  hasTimeZone: boolean;
+  hasGroupSelected: boolean;
+}
+
+export function RollbackScheduleDetailsFieldset({
+  hasTimeZone,
+  hasGroupSelected,
+}: Props) {
+  return (
+    <div className="mt-3">
+      <RollbackOptions />
+      {hasTimeZone && hasGroupSelected && <ScheduledTimeField />}
+    </div>
+  );
+}
diff --git a/app/react/portainer/environments/update-schedules/common/ScheduleTypeSelector.tsx b/app/react/portainer/environments/update-schedules/common/ScheduleTypeSelector.tsx
new file mode 100644
index 0000000..8d088f7
--- /dev/null
+++ b/app/react/portainer/environments/update-schedules/common/ScheduleTypeSelector.tsx
@@ -0,0 +1,82 @@
+import { useFormikContext } from 'formik';
+import { number } from 'yup';
+import { useEffect } from 'react';
+
+import { NavTabs } from '@@/NavTabs';
+import { NavContainer } from '@@/NavTabs/NavContainer';
+
+import { ScheduleType } from '../types';
+
+import { useEnvironments } from './useEnvironments';
+import { defaultValue } from './ScheduledTimeField';
+import { FormValues } from './types';
+import { UpdateScheduleDetailsFieldset } from './UpdateScheduleDetailsFieldset';
+import { RollbackScheduleDetailsFieldset } from './RollbackScheduleDetailsFieldset';
+
+export function ScheduleTypeSelector() {
+  const { values, setFieldValue } = useFormikContext<FormValues>();
+
+  const environments = useEnvironments(values.groupIds);
+
+  // old version is version that doesn't support scheduling of updates
+  const hasNoTimeZone = environments.some((env) => !env.LocalTimeZone);
+  const hasTimeZone = environments.some((env) => env.LocalTimeZone);
+  const hasGroupSelected = values.groupIds.length > 0;
+
+  useEffect(() => {
+    if (!hasTimeZone || !hasGroupSelected) {
+      setFieldValue('scheduledTime', '');
+    } else if (!values.scheduledTime) {
+      setFieldValue('scheduledTime', defaultValue());
+    }
+  }, [setFieldValue, hasTimeZone, values.scheduledTime, hasGroupSelected]);
+
+  return (
+    <div className="form-group">
+      <div className="col-sm-12">
+        <NavContainer>
+          <NavTabs
+            options={[
+              {
+                id: ScheduleType.Update,
+                label: 'Update',
+                children: (
+                  <UpdateScheduleDetailsFieldset
+                    environments={environments}
+                    hasTimeZone={hasTimeZone}
+                    hasNoTimeZone={hasNoTimeZone}
+                    hasGroupSelected={hasGroupSelected}
+                    version={values.version}
+                  />
+                ),
+              },
+              {
+                id: ScheduleType.Rollback,
+                label: 'Rollback',
+                children: (
+                  <RollbackScheduleDetailsFieldset
+                    hasTimeZone={hasTimeZone}
+                    hasGroupSelected={hasGroupSelected}
+                  />
+                ),
+              },
+            ]}
+            selectedId={values.type}
+            onSelect={handleChangeType}
+          />
+        </NavContainer>
+      </div>
+    </div>
+  );
+
+  function handleChangeType(scheduleType: ScheduleType) {
+    setFieldValue('type', scheduleType);
+    setFieldValue('version', '');
+  }
+}
+
+export function typeValidation() {
+  return number()
+    .oneOf([ScheduleType.Rollback, ScheduleType.Update])
+    .default(ScheduleType.Update);
+}
diff --git a/app/react/portainer/environments/update-schedules/common/ScheduledTimeField.tsx b/app/react/portainer/environments/update-schedules/common/ScheduledTimeField.tsx
new file mode 100644
index 0000000..828442c
--- /dev/null
+++ b/app/react/portainer/environments/update-schedules/common/ScheduledTimeField.tsx
@@ -0,0 +1,77 @@
+import { useField } from 'formik';
+import { useMemo } from 'react';
+import { string } from 'yup';
+
+import {
+  isoDate,
+  parseIsoDate,
+  TIME_FORMAT,
+} from '@/portainer/filters/filters';
+
+import { DateTimeField, FORMAT } from '@@/DateTimeField';
+import { TextTip } from '@@/Tip/TextTip';
+
+import { FormValues } from './types';
+
+interface Props {
+  disabled?: boolean;
+}
+
+export function ScheduledTimeField({ disabled }: Props) {
+  const [{ name, value }, { error }, { setValue }] =
+    useField<FormValues['scheduledTime']>('scheduledTime');
+  const dateValue = useMemo(() => parseIsoDate(value, FORMAT), [value]);
+
+  if (!value) {
+    return null;
+  }
+
+  return (
+    <>
+      <DateTimeField
+        label="Schedule date & time"
+        minDate={new Date(Date.now() - 24 * 60 * 60 * 1000)}
+        onChange={(date) => {
+          const dateToSave = date || new Date(Date.now() + 24 * 60 * 60 * 1000);
+          setValue(isoDate(dateToSave.valueOf(), FORMAT));
+        }}
+        error={error}
+        disabled={disabled}
+        name={name}
+        value={dateValue}
+        data-cy="update-schedules-time-input"
+      />
+      {!disabled && value && (
+        <TextTip color="blue">
+          If time zone is not set on edge agent then UTC+0 will be used.
+        </TextTip>
+      )}
+    </>
+  );
+}
+
+export function timeValidation() {
+  return string()
+    .required('Scheduled time is required')
+    .test(
+      'validFormat',
+      `Scheduled time must be in the format ${TIME_FORMAT}`,
+      (value) => isValidDate(parseIsoDate(value))
+    )
+    .test(
+      'validDate',
+      `Scheduled time must be bigger then ${
+        (isoDate(Date.now() - 24 * 60 * 60 * 1000), FORMAT)
+      }`,
+      (value) =>
+        parseIsoDate(value).valueOf() > Date.now() - 24 * 60 * 60 * 1000
+    );
+}
+
+export function defaultValue() {
+  return isoDate(Date.now(), FORMAT);
+}
+
+function isValidDate(date: Date) {
+  return date instanceof Date && !Number.isNaN(date.valueOf());
+}
diff --git a/app/react/portainer/environments/update-schedules/common/UpdateScheduleDetailsFieldset.tsx b/app/react/portainer/environments/update-schedules/common/UpdateScheduleDetailsFieldset.tsx
new file mode 100644
index 0000000..c7af441
--- /dev/null
+++ b/app/react/portainer/environments/update-schedules/common/UpdateScheduleDetailsFieldset.tsx
@@ -0,0 +1,56 @@
+import _ from 'lodash';
+
+import { Environment } from '@/react/portainer/environments/types';
+import { semverCompare } from '@/react/common/semver-utils';
+
+import { TextTip } from '@@/Tip/TextTip';
+
+import { VersionSelect } from './VersionSelect';
+import { ScheduledTimeField } from './ScheduledTimeField';
+
+interface Props {
+  environments: Environment[];
+  hasTimeZone: boolean;
+  hasNoTimeZone: boolean;
+  hasGroupSelected: boolean;
+  version: string;
+}
+
+export function UpdateScheduleDetailsFieldset({
+  environments,
+  hasTimeZone,
+  hasNoTimeZone,
+  hasGroupSelected,
+  version,
+}: Props) {
+  const minVersion = _.first(
+    _.compact<string>(environments.map((env) => env.Agent.Version)).sort(
+      (a, b) => semverCompare(a, b)
+    )
+  );
+
+  return (
+    <>
+      {environments.length > 0 ? (
+        !!version && (
+          <TextTip color="blue">
+            {environments.length} environment(s) will be updated to {version}
+          </TextTip>
+        )
+      ) : (
+        <TextTip color="orange">
+          No environments options for the selected edge groups
+        </TextTip>
+      )}
+      <VersionSelect minVersion={minVersion} />
+
+      {hasTimeZone && hasGroupSelected && <ScheduledTimeField />}
+      {hasNoTimeZone && (
+        <TextTip>
+          These edge groups have older versions of the edge agent that do not
+          support scheduling, these will happen immediately
+        </TextTip>
+      )}
+    </>
+  );
+}
diff --git a/app/react/portainer/environments/update-schedules/common/VersionSelect.tsx b/app/react/portainer/environments/update-schedules/common/VersionSelect.tsx
new file mode 100644
index 0000000..fa71342
--- /dev/null
+++ b/app/react/portainer/environments/update-schedules/common/VersionSelect.tsx
@@ -0,0 +1,63 @@
+import { Field, useField } from 'formik';
+import _ from 'lodash';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { Select } from '@@/form-components/Input';
+import { TextTip } from '@@/Tip/TextTip';
+
+import { useSupportedAgentVersions } from '../queries/useSupportedAgentVersions';
+
+import { FormValues } from './types';
+
+/**
+ * in-case agents don't have any version field, it means they are version less then 2.15.x or that they still not associated.
+ */
+const DEFAULT_MIN_VERSION = '2.14.10';
+
+export function VersionSelect({
+  minVersion = DEFAULT_MIN_VERSION,
+}: {
+  minVersion?: string;
+}) {
+  const [{ value: version }, { error }, { setValue }] =
+    useField<FormValues['version']>('version');
+  const supportedAgentVersionsQuery = useSupportedAgentVersions(minVersion, {
+    onSuccess(versions) {
+      if (versions.includes(version)) {
+        return;
+      }
+
+      setValue(_.last(versions) || '');
+    },
+  });
+
+  if (!supportedAgentVersionsQuery.data) {
+    return null;
+  }
+
+  if (!supportedAgentVersionsQuery.data.length) {
+    return (
+      <FormControl label="Version">
+        <TextTip>No supported versions available</TextTip>
+      </FormControl>
+    );
+  }
+
+  const supportedVersions = supportedAgentVersionsQuery.data.map((version) => ({
+    label: version,
+    value: version,
+  }));
+
+  return (
+    <FormControl label="Version" errors={error} inputId="version-input">
+      <Field
+        id="version-input"
+        name="version"
+        as={Select}
+        className="form-control"
+        placeholder="Version"
+        options={supportedVersions}
+      />
+    </FormControl>
+  );
+}
diff --git a/app/react/portainer/environments/update-schedules/common/types.ts b/app/react/portainer/environments/update-schedules/common/types.ts
new file mode 100644
index 0000000..057c95a
--- /dev/null
+++ b/app/react/portainer/environments/update-schedules/common/types.ts
@@ -0,0 +1,11 @@
+import { EdgeGroup } from '@/react/edge/edge-groups/types';
+
+import { ScheduleType } from '../types';
+
+export interface FormValues {
+  name: string;
+  groupIds: EdgeGroup['Id'][];
+  type: ScheduleType;
+  version: string;
+  scheduledTime: string;
+}
diff --git a/app/react/portainer/environments/update-schedules/common/useEnvironments.ts b/app/react/portainer/environments/update-schedules/common/useEnvironments.ts
new file mode 100644
index 0000000..7843cf2
--- /dev/null
+++ b/app/react/portainer/environments/update-schedules/common/useEnvironments.ts
@@ -0,0 +1,13 @@
+import { useEnvironmentList } from '@/react/portainer/environments/queries/useEnvironmentList';
+import { EdgeGroupId, EdgeTypes } from '@/react/portainer/environments/types';
+
+export function useEnvironments(edgeGroupIds: Array<EdgeGroupId>) {
+  const environmentsQuery = useEnvironmentList(
+    { edgeGroupIds, types: EdgeTypes, pageLimit: 0, excludeSnapshots: true },
+    {
+      enabled: edgeGroupIds.length > 0,
+    }
+  );
+
+  return environmentsQuery.environments;
+}
diff --git a/app/react/portainer/environments/update-schedules/common/utils.ts b/app/react/portainer/environments/update-schedules/common/utils.ts
new file mode 100644
index 0000000..0e02742
--- /dev/null
+++ b/app/react/portainer/environments/update-schedules/common/utils.ts
@@ -0,0 +1,23 @@
+import { semverCompare } from '@/react/common/semver-utils';
+
+export function compareVersion(
+  currentVersion: string,
+  version = '',
+  bigger = false
+) {
+  if (!currentVersion) {
+    return true;
+  }
+
+  // if supplied version is not a string, e.g develop
+  if (!version.includes('.')) {
+    return true;
+  }
+
+  if (bigger) {
+    return semverCompare(currentVersion, version) > 0;
+  }
+
+  // env version is less than the supplied
+  return semverCompare(currentVersion, version) < 0;
+}
diff --git a/app/react/portainer/environments/update-schedules/common/validation.ts b/app/react/portainer/environments/update-schedules/common/validation.ts
new file mode 100644
index 0000000..67e0b99
--- /dev/null
+++ b/app/react/portainer/environments/update-schedules/common/validation.ts
@@ -0,0 +1,62 @@
+import { array, object, SchemaOf, string, number } from 'yup';
+
+import { parseIsoDate } from '@/portainer/filters/filters';
+import { EdgeGroup } from '@/react/edge/edge-groups/types';
+
+import { EdgeUpdateSchedule, ScheduleType } from '../types';
+
+import { nameValidation } from './NameField';
+import { typeValidation } from './ScheduleTypeSelector';
+import { FormValues } from './types';
+
+export function validation(
+  schedules: EdgeUpdateSchedule[],
+  edgeGroups: Array<EdgeGroup> | undefined,
+  currentId?: EdgeUpdateSchedule['id']
+): SchemaOf<FormValues> {
+  return object({
+    groupIds: array()
+      .of(number().default(0))
+      .min(1, 'At least one group is required')
+      .test(
+        'At least one group must have endpoints',
+        (groupIds) =>
+          !!(
+            groupIds &&
+            edgeGroups &&
+            groupIds?.flatMap(
+              (id) => edgeGroups?.find((group) => group.Id === id)?.Endpoints
+            ).length > 0
+          )
+      ),
+    name: nameValidation(schedules, currentId),
+    type: typeValidation(),
+    scheduledTime: string()
+      .default('')
+      .test('valid', (value) => !value || parseIsoDate(value) !== null),
+    version: string()
+      .default('')
+      .when('type', {
+        is: ScheduleType.Update,
+        // update type
+        then: (schema) => schema.required('Version is required'),
+        // rollback
+        otherwise: (schema) => schema.required('No rollback options available'),
+      }),
+    registryId: number().default(0),
+    agentImage: string()
+      .default('')
+      .when('registryId', {
+        is: 0,
+        then: (schema) => schema.optional(),
+        otherwise: (schema) => schema.required('Agent image is required'),
+      }),
+    updaterImage: string()
+      .default('')
+      .when('registryId', {
+        is: 0,
+        then: (schema) => schema.optional(),
+        otherwise: (schema) => schema.required('Updater image is required'),
+      }),
+  });
+}
diff --git a/app/react/portainer/environments/update-schedules/index.ts b/app/react/portainer/environments/update-schedules/index.ts
new file mode 100644
index 0000000..05a5646
--- /dev/null
+++ b/app/react/portainer/environments/update-schedules/index.ts
@@ -0,0 +1,3 @@
+export { ListView } from './ListView';
+export { CreateView } from './CreateView';
+export { ItemView } from './ItemView';
diff --git a/app/react/portainer/environments/update-schedules/queries/create.ts b/app/react/portainer/environments/update-schedules/queries/create.ts
new file mode 100644
index 0000000..6ef3cb8
--- /dev/null
+++ b/app/react/portainer/environments/update-schedules/queries/create.ts
@@ -0,0 +1,31 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError, withInvalidate } from '@/react-tools/react-query';
+
+import { EdgeUpdateSchedule } from '../types';
+import { FormValues } from '../common/types';
+
+import { queryKeys } from './query-keys';
+import { buildUrl } from './urls';
+
+async function create(schedule: FormValues) {
+  try {
+    const { data } = await axios.post<EdgeUpdateSchedule>(buildUrl(), schedule);
+
+    return data;
+  } catch (err) {
+    throw parseAxiosError(
+      err as Error,
+      'Failed to create edge update schedule'
+    );
+  }
+}
+
+export function useCreateMutation() {
+  const queryClient = useQueryClient();
+  return useMutation(create, {
+    ...withInvalidate(queryClient, [queryKeys.base()]),
+    ...withError(),
+  });
+}
diff --git a/app/react/portainer/environments/update-schedules/queries/list.ts b/app/react/portainer/environments/update-schedules/queries/list.ts
new file mode 100644
index 0000000..dae8486
--- /dev/null
+++ b/app/react/portainer/environments/update-schedules/queries/list.ts
@@ -0,0 +1,33 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { EdgeUpdateResponse, StatusType } from '../types';
+
+import { queryKeys } from './query-keys';
+import { buildUrl } from './urls';
+
+export type EdgeUpdateListItemResponse = EdgeUpdateResponse & {
+  status: StatusType;
+  statusMessage: string;
+};
+
+async function getList(includeEdgeStacks?: boolean) {
+  try {
+    const { data } = await axios.get<EdgeUpdateListItemResponse[]>(buildUrl(), {
+      params: { includeEdgeStacks },
+    });
+    return data;
+  } catch (err) {
+    throw parseAxiosError(
+      err as Error,
+      'Failed to get list of edge update schedules'
+    );
+  }
+}
+
+export function useList(includeEdgeStacks?: boolean) {
+  return useQuery(queryKeys.list(includeEdgeStacks), () =>
+    getList(includeEdgeStacks)
+  );
+}
diff --git a/app/react/portainer/environments/update-schedules/queries/query-keys.ts b/app/react/portainer/environments/update-schedules/queries/query-keys.ts
new file mode 100644
index 0000000..f6e5153
--- /dev/null
+++ b/app/react/portainer/environments/update-schedules/queries/query-keys.ts
@@ -0,0 +1,19 @@
+import {
+  EdgeGroupId,
+  EnvironmentId,
+} from '@/react/portainer/environments/types';
+
+import { EdgeUpdateSchedule } from '../types';
+
+export const queryKeys = {
+  base: () => ['edge', 'update_schedules'] as const,
+  list: (includeEdgeStacks?: boolean) =>
+    [...queryKeys.base(), { includeEdgeStacks }] as const,
+  item: (id: EdgeUpdateSchedule['id']) => [...queryKeys.base(), id] as const,
+  activeSchedules: (environmentIds: EnvironmentId[]) =>
+    [...queryKeys.base(), 'active', { environmentIds }] as const,
+  supportedAgentVersions: () =>
+    [...queryKeys.base(), 'agent_versions'] as const,
+  previousVersions: (edgeGroupIds?: EdgeGroupId[]) =>
+    [...queryKeys.base(), 'previous_versions', { edgeGroupIds }] as const,
+};
diff --git a/app/react/portainer/environments/update-schedules/queries/urls.ts b/app/react/portainer/environments/update-schedules/queries/urls.ts
new file mode 100644
index 0000000..b2af6f4
--- /dev/null
+++ b/app/react/portainer/environments/update-schedules/queries/urls.ts
@@ -0,0 +1,17 @@
+import { EdgeUpdateSchedule } from '../types';
+
+export const BASE_URL = '/edge_update_schedules';
+
+export function buildUrl(id?: EdgeUpdateSchedule['id'], action?: string) {
+  let url = BASE_URL;
+
+  if (id) {
+    url += `/${id}`;
+  }
+
+  if (action) {
+    url += `/${action}`;
+  }
+
+  return url;
+}
diff --git a/app/react/portainer/environments/update-schedules/queries/useActiveSchedules.ts b/app/react/portainer/environments/update-schedules/queries/useActiveSchedules.ts
new file mode 100644
index 0000000..c05e1d9
--- /dev/null
+++ b/app/react/portainer/environments/update-schedules/queries/useActiveSchedules.ts
@@ -0,0 +1,41 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { EdgeUpdateSchedule, ScheduleType, StatusType } from '../types';
+
+import { queryKeys } from './query-keys';
+import { buildUrl } from './urls';
+
+export interface ActiveSchedule {
+  environmentId: EnvironmentId;
+  scheduleId: EdgeUpdateSchedule['id'];
+  targetVersion: string;
+  status: StatusType;
+  error: string;
+  type: ScheduleType;
+}
+
+async function getActiveSchedules(environmentIds: EnvironmentId[]) {
+  try {
+    const { data } = await axios.post<ActiveSchedule[]>(
+      buildUrl(undefined, 'active'),
+      { environmentIds }
+    );
+    return data;
+  } catch (err) {
+    throw parseAxiosError(
+      err as Error,
+      'Failed to get list of edge update schedules'
+    );
+  }
+}
+
+export function useActiveSchedules(environmentIds: EnvironmentId[]) {
+  return useQuery(
+    queryKeys.activeSchedules(environmentIds),
+    () => getActiveSchedules(environmentIds),
+    { enabled: environmentIds.length > 0 }
+  );
+}
diff --git a/app/react/portainer/environments/update-schedules/queries/useItem.ts b/app/react/portainer/environments/update-schedules/queries/useItem.ts
new file mode 100644
index 0000000..8e3afbb
--- /dev/null
+++ b/app/react/portainer/environments/update-schedules/queries/useItem.ts
@@ -0,0 +1,30 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { EdgeUpdateResponse, EdgeUpdateSchedule } from '../types';
+
+import { queryKeys } from './query-keys';
+import { buildUrl } from './urls';
+
+export function useItem(id: EdgeUpdateSchedule['id']) {
+  return useQuery(queryKeys.item(id), () => getItem(id));
+}
+
+type EdgeUpdateItemResponse = EdgeUpdateResponse & {
+  isActive: boolean;
+};
+
+async function getItem(id: EdgeUpdateSchedule['id']) {
+  try {
+    const { data } = await axios.get<EdgeUpdateItemResponse>(buildUrl(id), {
+      params: { includeEdgeStack: true },
+    });
+    return data;
+  } catch (err) {
+    throw parseAxiosError(
+      err as Error,
+      'Failed to get list of edge update schedules'
+    );
+  }
+}
diff --git a/app/react/portainer/environments/update-schedules/queries/usePreviousVersions.ts b/app/react/portainer/environments/update-schedules/queries/usePreviousVersions.ts
new file mode 100644
index 0000000..32d0fbc
--- /dev/null
+++ b/app/react/portainer/environments/update-schedules/queries/usePreviousVersions.ts
@@ -0,0 +1,47 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import {
+  EdgeGroupId,
+  EnvironmentId,
+} from '@/react/portainer/environments/types';
+
+import { queryKeys } from './query-keys';
+import { buildUrl } from './urls';
+
+interface Options<T> {
+  select?: (data: Record<EnvironmentId, string>) => T;
+  onSuccess?(data: T): void;
+  enabled?: boolean;
+}
+
+export function usePreviousVersions<T = Record<EdgeGroupId, string>>(
+  edgeGroupIds: EdgeGroupId[],
+  { select, enabled }: Options<T> = {}
+) {
+  return useQuery(
+    queryKeys.previousVersions(edgeGroupIds),
+    () => getPreviousVersions(edgeGroupIds),
+    {
+      select,
+      enabled: enabled && edgeGroupIds.length > 0,
+    }
+  );
+}
+
+async function getPreviousVersions(edgeGroupIds: EdgeGroupId[]) {
+  try {
+    const { data } = await axios.get<Record<EdgeGroupId, string>>(
+      buildUrl(undefined, 'previous_versions'),
+      {
+        params: { edgeGroupIds },
+      }
+    );
+    return data;
+  } catch (err) {
+    throw parseAxiosError(
+      err as Error,
+      'Failed to get list of edge update schedules'
+    );
+  }
+}
diff --git a/app/react/portainer/environments/update-schedules/queries/useRemoveMutation.ts b/app/react/portainer/environments/update-schedules/queries/useRemoveMutation.ts
new file mode 100644
index 0000000..0405cc8
--- /dev/null
+++ b/app/react/portainer/environments/update-schedules/queries/useRemoveMutation.ts
@@ -0,0 +1,42 @@
+import { useQueryClient, useMutation } from '@tanstack/react-query';
+
+import { promiseSequence } from '@/portainer/helpers/promise-utils';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import {
+  mutationOptions,
+  withError,
+  withInvalidate,
+} from '@/react-tools/react-query';
+
+import { EdgeUpdateSchedule } from '../types';
+
+import { buildUrl } from './urls';
+import { queryKeys } from './query-keys';
+
+export function useRemoveMutation() {
+  const queryClient = useQueryClient();
+
+  return useMutation(
+    (schedules: EdgeUpdateSchedule[]) =>
+      promiseSequence(
+        schedules.map((schedule) => () => deleteUpdateSchedule(schedule.id))
+      ),
+
+    mutationOptions(
+      withInvalidate(queryClient, [queryKeys.base()]),
+      withError()
+    )
+  );
+}
+
+async function deleteUpdateSchedule(id: EdgeUpdateSchedule['id']) {
+  try {
+    const { data } = await axios.delete<EdgeUpdateSchedule[]>(buildUrl(id));
+    return data;
+  } catch (err) {
+    throw parseAxiosError(
+      err as Error,
+      'Failed to delete edge update schedule'
+    );
+  }
+}
diff --git a/app/react/portainer/environments/update-schedules/queries/useSupportedAgentVersions.ts b/app/react/portainer/environments/update-schedules/queries/useSupportedAgentVersions.ts
new file mode 100644
index 0000000..7b250b0
--- /dev/null
+++ b/app/react/portainer/environments/update-schedules/queries/useSupportedAgentVersions.ts
@@ -0,0 +1,45 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+import { semverCompare } from '@/react/common/semver-utils';
+
+import { queryKeys } from './query-keys';
+import { buildUrl } from './urls';
+
+export function useSupportedAgentVersions(
+  minVersion?: string,
+  { onSuccess }: { onSuccess?(data: string[]): void } = {}
+) {
+  return useQuery(
+    [...queryKeys.supportedAgentVersions(), { minVersion }],
+    getSupportedAgentVersions,
+    {
+      select(versions) {
+        if (!minVersion) {
+          return versions;
+        }
+
+        return versions.filter(
+          (version) => semverCompare(version, minVersion) > 0
+        );
+      },
+      onSuccess,
+      ...withError('failed fetching available agent versions'),
+    }
+  );
+}
+
+async function getSupportedAgentVersions() {
+  try {
+    const { data } = await axios.get<string[]>(
+      buildUrl(undefined, 'agent_versions')
+    );
+    return data;
+  } catch (err) {
+    throw parseAxiosError(
+      err as Error,
+      'Failed to get list of edge update schedules'
+    );
+  }
+}
diff --git a/app/react/portainer/environments/update-schedules/queries/useUpdateMutation.ts b/app/react/portainer/environments/update-schedules/queries/useUpdateMutation.ts
new file mode 100644
index 0000000..6d68c88
--- /dev/null
+++ b/app/react/portainer/environments/update-schedules/queries/useUpdateMutation.ts
@@ -0,0 +1,36 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError, withInvalidate } from '@/react-tools/react-query';
+
+import { EdgeUpdateSchedule } from '../types';
+import { FormValues } from '../common/types';
+
+import { queryKeys } from './query-keys';
+import { buildUrl } from './urls';
+
+interface Update {
+  id: EdgeUpdateSchedule['id'];
+  values: Partial<FormValues>;
+}
+
+async function update({ id, values }: Update) {
+  try {
+    const { data } = await axios.put<EdgeUpdateSchedule>(buildUrl(id), values);
+
+    return data;
+  } catch (err) {
+    throw parseAxiosError(
+      err as Error,
+      'Failed to update edge update schedule'
+    );
+  }
+}
+
+export function useUpdateMutation() {
+  const queryClient = useQueryClient();
+  return useMutation(update, {
+    ...withInvalidate(queryClient, [queryKeys.base()]),
+    ...withError(),
+  });
+}
diff --git a/app/react/portainer/environments/update-schedules/types.ts b/app/react/portainer/environments/update-schedules/types.ts
new file mode 100644
index 0000000..fb8566b
--- /dev/null
+++ b/app/react/portainer/environments/update-schedules/types.ts
@@ -0,0 +1,33 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { UserId } from '@/portainer/users/types';
+import { EdgeGroup } from '@/react/edge/edge-groups/types';
+
+export enum ScheduleType {
+  Update = 1,
+  Rollback,
+}
+
+export enum StatusType {
+  Pending,
+  Failed,
+  Success,
+  Sent,
+}
+
+export type EdgeUpdateSchedule = {
+  id: number;
+  name: string;
+
+  type: ScheduleType;
+
+  created: number;
+  createdBy: UserId;
+  version: string;
+  environmentsPreviousVersions: Record<EnvironmentId, string>;
+};
+
+export type EdgeUpdateResponse = EdgeUpdateSchedule & {
+  // from edge stack:
+  edgeGroupIds: EdgeGroup['Id'][];
+  scheduledTime: string;
+};
diff --git a/app/react/portainer/environments/utils/azure.png b/app/react/portainer/environments/utils/azure.png
new file mode 100644
index 0000000..37eecaa
Binary files /dev/null and b/app/react/portainer/environments/utils/azure.png differ
diff --git a/app/react/portainer/environments/utils/azure.svg b/app/react/portainer/environments/utils/azure.svg
new file mode 100644
index 0000000..dcd43db
--- /dev/null
+++ b/app/react/portainer/environments/utils/azure.svg
@@ -0,0 +1,23 @@
+<svg width="105" height="95" viewBox="0 0 105 95" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M40.0412 11.1924H62.0164L39.2057 80.2579C38.9712 80.9682 38.5252 81.5844 37.9284 82.0209C37.3338 82.4574 36.6177 82.6928 35.8848 82.6928H18.7841C18.2293 82.6928 17.6807 82.558 17.1865 82.2991C16.6923 82.0402 16.2652 81.6636 15.9406 81.2036C15.6161 80.7435 15.4046 80.2086 15.3229 79.6481C15.2413 79.0875 15.2894 78.514 15.4674 77.9749L36.7224 13.6295C36.9569 12.9191 37.4029 12.3029 37.9996 11.8664C38.5943 11.4299 39.3104 11.1946 40.0433 11.1946L40.0412 11.1924Z" fill="url(#paint0_linear_142_1882)"/>
+<path d="M71.9753 57.5178H37.129C36.8044 57.5178 36.4883 57.6163 36.2203 57.8024C35.9522 57.9886 35.7449 58.2539 35.6277 58.5598C35.5083 58.8679 35.4832 59.206 35.5544 59.527C35.6256 59.85 35.791 60.1432 36.0276 60.3678L58.4195 81.7236C59.0707 82.3462 59.9292 82.6907 60.8212 82.6907H80.5518L71.9753 57.5135V57.5178Z" fill="#0078D4"/>
+<path d="M40.0424 11.1925C39.3012 11.1903 38.5788 11.43 37.9799 11.875C37.3811 12.3222 36.9372 12.9512 36.7152 13.6744L15.4959 77.9193C15.3053 78.4585 15.2467 79.0383 15.3221 79.6053C15.3974 80.1744 15.6068 80.7158 15.9293 81.1843C16.2538 81.6529 16.6831 82.0359 17.1814 82.2991C17.6798 82.5623 18.2326 82.6992 18.7937 82.6971H36.3362C36.9895 82.5773 37.6009 82.2841 38.1056 81.8434C38.6123 81.4047 38.9934 80.8356 39.2132 80.1958L43.4449 67.4543L58.5607 81.8605C59.193 82.3954 59.9887 82.6928 60.8116 82.6992H80.4689L71.8463 57.5221L46.7135 57.5285L62.0972 11.1925H40.0424Z" fill="url(#paint1_linear_142_1882)"/>
+<path d="M68.1089 13.6252C67.8743 12.917 67.4283 12.3008 66.8337 11.8643C66.239 11.4278 65.525 11.1924 64.7942 11.1924H40.3043C41.0371 11.1924 41.749 11.4278 42.3437 11.8643C42.9384 12.3008 43.3844 12.917 43.6189 13.6252L64.8738 77.977C65.0518 78.5141 65.102 79.0875 65.0183 79.6502C64.9366 80.2108 64.7251 80.7457 64.4006 81.2057C64.076 81.6658 63.651 82.0423 63.1547 82.3012C62.6606 82.5601 62.1141 82.6949 61.5571 82.6949H86.0471C86.602 82.6949 87.1506 82.5601 87.6447 82.3012C88.1389 82.0423 88.566 81.6658 88.8885 81.2057C89.213 80.7457 89.4245 80.2108 89.5062 79.6502C89.5878 79.0896 89.5397 78.5162 89.3617 77.977L68.1089 13.6252Z" fill="url(#paint2_linear_142_1882)"/>
+<defs>
+<linearGradient id="paint0_linear_142_1882" x1="48.0523" y1="16.4923" x2="24.3284" y2="85.0728" gradientUnits="userSpaceOnUse">
+<stop stop-color="#114A8B"/>
+<stop offset="1" stop-color="#0669BC"/>
+</linearGradient>
+<linearGradient id="paint1_linear_142_1882" x1="55.179" y1="48.5976" x2="49.8774" y2="50.3511" gradientUnits="userSpaceOnUse">
+<stop stop-opacity="0.3"/>
+<stop offset="0.07" stop-opacity="0.2"/>
+<stop offset="0.32" stop-opacity="0.1"/>
+<stop offset="0.62" stop-opacity="0.05"/>
+<stop offset="1" stop-opacity="0"/>
+</linearGradient>
+<linearGradient id="paint2_linear_142_1882" x1="52.4404" y1="14.419" x2="78.4565" y2="82.2478" gradientUnits="userSpaceOnUse">
+<stop stop-color="#3CCBF4"/>
+<stop offset="1" stop-color="#2892DF"/>
+</linearGradient>
+</defs>
+</svg>
diff --git a/app/react/portainer/environments/utils/docker.png b/app/react/portainer/environments/utils/docker.png
new file mode 100644
index 0000000..aca3e26
Binary files /dev/null and b/app/react/portainer/environments/utils/docker.png differ
diff --git a/app/react/portainer/environments/utils/docker.svg b/app/react/portainer/environments/utils/docker.svg
new file mode 100644
index 0000000..0e1efde
--- /dev/null
+++ b/app/react/portainer/environments/utils/docker.svg
@@ -0,0 +1,12 @@
+<svg width="105" height="95" viewBox="0 0 105 95" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M102.014 39.3373C101.744 39.1083 99.3192 37.2276 94.1117 37.2276C92.7654 37.2276 91.3729 37.3645 90.0266 37.5956C89.0382 30.5754 83.3366 27.1798 83.1126 26.998L81.7201 26.1721L80.8219 27.5029C79.6996 29.2917 78.8473 31.3115 78.3532 33.3762C77.4109 37.3688 77.993 41.1303 79.9697 44.3419C77.5889 45.7177 73.7278 46.0386 72.9196 46.0857H9.16103C7.50059 46.0857 6.15213 47.4615 6.15213 49.1604C6.0621 54.8497 7.00434 60.539 8.9349 65.9073C11.1356 71.7806 14.4125 76.1391 18.6337 78.8008C23.3931 81.7835 31.1614 83.4802 39.9159 83.4802C43.867 83.4802 47.8182 83.1122 51.7254 82.3783C57.159 81.3684 62.3664 79.4427 67.1719 76.644C71.123 74.3033 74.6701 71.3228 77.679 67.8351C82.7524 62.0089 85.7613 55.4937 87.962 49.7124H88.8603C94.3839 49.7124 97.7948 47.4636 99.6814 45.5379C100.938 44.344 101.882 42.8762 102.554 41.2244L102.958 40.0305L102.016 39.3415L102.014 39.3373Z" fill="#0091E2"/>
+<path d="M15.0862 44.2006H23.6166C24.0207 44.2006 24.3809 43.8797 24.3809 43.4197V35.6207C24.3809 35.2077 24.0668 34.8419 23.6166 34.8419H15.0862C14.682 34.8419 14.3219 35.1628 14.3219 35.6207V43.4197C14.3659 43.8776 14.682 44.2006 15.0862 44.2006Z" fill="#0091E2"/>
+<path d="M26.851 44.2006H35.3814C35.7856 44.2006 36.1436 43.8797 36.1436 43.4197V35.6207C36.1436 35.2077 35.8295 34.8419 35.3814 34.8419H26.851C26.4469 34.8419 26.0867 35.1628 26.0867 35.6207V43.4197C26.1307 43.8776 26.4469 44.2006 26.851 44.2006Z" fill="#0091E2"/>
+<path d="M38.842 44.2006H47.3724C47.7765 44.2006 48.1367 43.8797 48.1367 43.4197V35.6207C48.1367 35.2077 47.8226 34.8419 47.3724 34.8419H38.842C38.4378 34.8419 38.0777 35.1628 38.0777 35.6207V43.4197C38.0777 43.8776 38.3918 44.2006 38.842 44.2006Z" fill="#0091E2"/>
+<path d="M50.6474 44.2006H59.1778C59.582 44.2006 59.9421 43.8797 59.9421 43.4197V35.6207C59.9421 35.2077 59.628 34.8419 59.1778 34.8419H50.6474C50.2433 34.8419 49.8831 35.1628 49.8831 35.6207V43.4197C49.8831 43.8776 50.2433 44.2006 50.6474 44.2006Z" fill="#0091E2"/>
+<path d="M26.851 33.0509H35.3814C35.7856 33.0509 36.1436 32.6829 36.1436 32.27V24.471C36.1436 24.058 35.8295 23.69 35.3814 23.69H26.851C26.4469 23.69 26.0867 24.0109 26.0867 24.471V32.27C26.1307 32.6829 26.4469 33.0509 26.851 33.0509Z" fill="#0091E2"/>
+<path d="M38.842 33.0509H47.3724C47.7765 33.0509 48.1367 32.6829 48.1367 32.27V24.471C48.1367 24.058 47.8226 23.69 47.3724 23.69H38.842C38.4378 23.69 38.0777 24.0109 38.0777 24.471V32.27C38.0777 32.6829 38.3918 33.0509 38.842 33.0509Z" fill="#0091E2"/>
+<path d="M50.6474 33.0509H59.1778C59.582 33.0509 59.9421 32.6829 59.9421 32.27V24.471C59.9421 24.058 59.582 23.69 59.1778 23.69H50.6474C50.2433 23.69 49.8831 24.0109 49.8831 24.471V32.27C49.8831 32.6829 50.2433 33.0509 50.6474 33.0509Z" fill="#0091E2"/>
+<path d="M50.6474 21.8563H59.1778C59.582 21.8563 59.9421 21.5354 59.9421 21.0754V13.2764C59.9421 12.8634 59.582 12.4954 59.1778 12.4954H50.6474C50.2433 12.4954 49.8831 12.8164 49.8831 13.2764V21.0754C49.8831 21.4883 50.2433 21.8563 50.6474 21.8563Z" fill="#0091E2"/>
+<path d="M62.5514 44.2006H71.0819C71.486 44.2006 71.8461 43.8797 71.8461 43.4197V35.6207C71.8461 35.2077 71.532 34.8419 71.0819 34.8419H62.5514C62.1473 34.8419 61.7871 35.1628 61.7871 35.6207V43.4197C61.8311 43.8776 62.1473 44.2006 62.5514 44.2006Z" fill="#0091E2"/>
+</svg>
diff --git a/app/react/portainer/environments/utils/get-group-icon.tsx b/app/react/portainer/environments/utils/get-group-icon.tsx
new file mode 100644
index 0000000..27e58e6
--- /dev/null
+++ b/app/react/portainer/environments/utils/get-group-icon.tsx
@@ -0,0 +1,14 @@
+import { Layers } from 'lucide-react';
+import type { ReactElement } from 'react';
+
+import {
+  IconSize,
+  IconSizeClass,
+} from '@/react/portainer/environments/utils/index';
+
+import { Icon } from '@@/Icon';
+
+export function getGroupIcon(size: IconSize): ReactElement {
+  const sizeClass = IconSizeClass[size];
+  return <Icon className={sizeClass} icon={Layers} />;
+}
diff --git a/app/react/portainer/environments/utils/get-health-icon.tsx b/app/react/portainer/environments/utils/get-health-icon.tsx
new file mode 100644
index 0000000..b3f49f0
--- /dev/null
+++ b/app/react/portainer/environments/utils/get-health-icon.tsx
@@ -0,0 +1,35 @@
+import { type ReactElement } from 'react';
+
+import { EnvironmentHealth } from '@/react/portainer/environments/types';
+import { IconSize } from '@/react/portainer/environments/utils/index';
+
+export const IconSizeClass: Record<IconSize, string> = {
+  sm: 'h-3.5 w-3.5',
+  md: 'h-4 w-4',
+};
+
+export function getHealthIcon(
+  healthStatus: EnvironmentHealth,
+  size: IconSize
+): ReactElement {
+  const dotClass = `block rounded-full ${IconSizeClass[size]}`;
+  const icons: Record<EnvironmentHealth, ReactElement> = {
+    [EnvironmentHealth.Up]: (
+      <span aria-hidden="true" className={`${dotClass} bg-success-7`} />
+    ),
+    [EnvironmentHealth.Down]: (
+      <span aria-hidden="true" className={`${dotClass} bg-error-7`} />
+    ),
+    [EnvironmentHealth.Outdated]: (
+      <span aria-hidden="true" className={`${dotClass} bg-warning-7`} />
+    ),
+    [EnvironmentHealth.Heartbeat]: (
+      <span
+        aria-hidden="true"
+        className={`${dotClass} animate-pulse bg-success-7`}
+      />
+    ),
+  };
+
+  return icons[healthStatus];
+}
diff --git a/app/react/portainer/environments/utils/get-platform-icon.tsx b/app/react/portainer/environments/utils/get-platform-icon.tsx
new file mode 100644
index 0000000..7e6a76d
--- /dev/null
+++ b/app/react/portainer/environments/utils/get-platform-icon.tsx
@@ -0,0 +1,49 @@
+import {
+  getPlatformType,
+  IconSize,
+  IconSizeClass,
+} from '@/react/portainer/environments/utils';
+import {
+  ContainerEngine,
+  EnvironmentType,
+  PlatformType,
+} from '@/react/portainer/environments/types';
+import Podman from '@/assets/ico/vendor/podman.svg?c';
+
+import Docker from './docker.svg?c';
+import Azure from './azure.svg?c';
+import Kubernetes from './kubernetes.svg?c';
+
+const icons: {
+  [key in PlatformType]: SvgrComponent;
+} = {
+  [PlatformType.Docker]: Docker,
+  [PlatformType.Podman]: Podman,
+  [PlatformType.Kubernetes]: Kubernetes,
+  [PlatformType.Azure]: Azure,
+};
+
+export function getPlatformIconByEnvironment(
+  type: EnvironmentType,
+  containerEngine?: ContainerEngine
+) {
+  const platform = getPlatformType(type, containerEngine);
+
+  return icons[platform];
+}
+
+export function getPlatformIconByPlatform(
+  platform: PlatformType,
+  size?: IconSize
+) {
+  const platformName = PlatformType[platform];
+  const BaseIcon = icons[platform];
+
+  return (
+    <BaseIcon
+      className={size !== undefined ? IconSizeClass[size] : undefined}
+      role="img"
+      aria-label={platformName}
+    />
+  );
+}
diff --git a/app/react/portainer/environments/utils/getDockerEnvironmentType.ts b/app/react/portainer/environments/utils/getDockerEnvironmentType.ts
new file mode 100644
index 0000000..7f1e829
--- /dev/null
+++ b/app/react/portainer/environments/utils/getDockerEnvironmentType.ts
@@ -0,0 +1,6 @@
+export function getDockerEnvironmentType(isSwarm: boolean, isPodman?: boolean) {
+  if (isPodman) {
+    return 'Podman';
+  }
+  return isSwarm ? 'Swarm' : 'Standalone';
+}
diff --git a/app/react/portainer/environments/utils/index.ts b/app/react/portainer/environments/utils/index.ts
new file mode 100644
index 0000000..bc5ef7e
--- /dev/null
+++ b/app/react/portainer/environments/utils/index.ts
@@ -0,0 +1,172 @@
+import { Cloud } from 'lucide-react';
+
+import Kube from '@/assets/ico/kube.svg?c';
+import PodmanIcon from '@/assets/ico/vendor/podman-icon.svg?c';
+import DockerIcon from '@/assets/ico/vendor/docker-icon.svg?c';
+import MicrosoftIcon from '@/assets/ico/vendor/microsoft-icon.svg?c';
+
+import {
+  Environment,
+  EnvironmentType,
+  ContainerEngine,
+  PlatformType,
+} from '../types';
+
+export function getPlatformType(
+  envType: EnvironmentType,
+  containerEngine?: ContainerEngine
+) {
+  switch (envType) {
+    case EnvironmentType.KubernetesLocal:
+    case EnvironmentType.AgentOnKubernetes:
+    case EnvironmentType.EdgeAgentOnKubernetes:
+      return PlatformType.Kubernetes;
+    case EnvironmentType.Docker:
+    case EnvironmentType.AgentOnDocker:
+    case EnvironmentType.EdgeAgentOnDocker:
+      if (containerEngine === ContainerEngine.Podman) {
+        return PlatformType.Podman;
+      }
+      return PlatformType.Docker;
+    case EnvironmentType.Azure:
+      return PlatformType.Azure;
+    default:
+      throw new Error(`Environment type ${envType} is not supported`);
+  }
+}
+
+export function isDockerEnvironment(envType: EnvironmentType) {
+  return getPlatformType(envType) === PlatformType.Docker;
+}
+
+export function isKubernetesEnvironment(envType: EnvironmentType) {
+  return getPlatformType(envType) === PlatformType.Kubernetes;
+}
+
+export function getPlatformTypeName(
+  envType: EnvironmentType,
+  containerEngine?: ContainerEngine
+): string {
+  return PlatformType[getPlatformType(envType, containerEngine)];
+}
+
+export function isSnapshotBrowsingSupported(environment: Environment) {
+  return isDockerEnvironment(environment.Type) && isEdgeAsync(environment);
+}
+
+export function isAgentEnvironment(envType: EnvironmentType) {
+  return (
+    isEdgeEnvironment(envType) ||
+    [EnvironmentType.AgentOnDocker, EnvironmentType.AgentOnKubernetes].includes(
+      envType
+    )
+  );
+}
+
+export function isEdgeEnvironment(envType: EnvironmentType) {
+  return [
+    EnvironmentType.EdgeAgentOnDocker,
+    EnvironmentType.EdgeAgentOnKubernetes,
+  ].includes(envType);
+}
+
+export function isEdgeAsync(env?: Environment | null) {
+  return !!env && env.Edge.AsyncMode;
+}
+
+export function isUnassociatedEdgeEnvironment(env: Environment) {
+  return isEdgeEnvironment(env.Type) && !env.EdgeID;
+}
+
+export function isLocalEnvironment(environment: Environment) {
+  return (
+    isLocalDockerEnvironment(environment.URL) ||
+    environment.Type === EnvironmentType.KubernetesLocal
+  );
+}
+
+export function isLocalDockerEnvironment(environmentUrl: string) {
+  return (
+    environmentUrl.startsWith('unix://') ||
+    environmentUrl.startsWith('npipe://')
+  );
+}
+
+export function isDockerAPIEnvironment(environment: Environment) {
+  return (
+    environment.URL.startsWith('tcp://') &&
+    environment.Type === EnvironmentType.Docker
+  );
+}
+
+export function isAzureEnvironment(envType: EnvironmentType) {
+  return envType === EnvironmentType.Azure;
+}
+
+export function getDashboardRoute(environment: Environment) {
+  if (isEdgeEnvironment(environment.Type)) {
+    if (!environment.EdgeID) {
+      return {
+        to: 'portainer.endpoints.endpoint',
+        params: { id: environment.Id },
+      };
+    }
+
+    if (isEdgeAsync(environment)) {
+      return {
+        to: 'edge.browse.dashboard',
+        params: { environmentId: environment.Id },
+      };
+    }
+  }
+
+  const params = { endpointId: environment.Id };
+  const to = getPlatformRoute();
+
+  return { to, params };
+
+  function getPlatformRoute() {
+    const platform = getPlatformType(environment.Type);
+    switch (platform) {
+      case PlatformType.Azure:
+        return 'azure.dashboard';
+      case PlatformType.Docker:
+        return 'docker.dashboard';
+      case PlatformType.Kubernetes:
+        return 'kubernetes.dashboard';
+      default:
+        throw new Error(`Unsupported platform ${platform}`);
+    }
+  }
+}
+
+export function getEnvironmentTypeIcon(
+  type: EnvironmentType,
+  containerEngine?: ContainerEngine
+) {
+  switch (type) {
+    case EnvironmentType.Azure:
+      return MicrosoftIcon;
+    case EnvironmentType.EdgeAgentOnDocker:
+      return Cloud;
+    case EnvironmentType.AgentOnKubernetes:
+    case EnvironmentType.EdgeAgentOnKubernetes:
+    case EnvironmentType.KubernetesLocal:
+      return Kube;
+    case EnvironmentType.AgentOnDocker:
+    case EnvironmentType.Docker:
+      if (containerEngine === ContainerEngine.Podman) {
+        return PodmanIcon;
+      }
+      return DockerIcon;
+    default:
+      throw new Error(`type ${type}-${EnvironmentType[type]} is not supported`);
+  }
+}
+
+export type IconSize = 'sm' | 'md';
+
+export const IconSizeClass: Record<IconSize, string> = {
+  sm: 'h-3.5 w-3.5',
+  md: 'h-4 w-4',
+};
diff --git a/app/react/portainer/environments/utils/kubernetes.png b/app/react/portainer/environments/utils/kubernetes.png
new file mode 100644
index 0000000..25c14f5
Binary files /dev/null and b/app/react/portainer/environments/utils/kubernetes.png differ
diff --git a/app/react/portainer/environments/utils/kubernetes.svg b/app/react/portainer/environments/utils/kubernetes.svg
new file mode 100644
index 0000000..26218a4
--- /dev/null
+++ b/app/react/portainer/environments/utils/kubernetes.svg
@@ -0,0 +1,12 @@
+<svg width="105" height="95" viewBox="0 0 105 95" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M52.9583 88.2672C47.7146 88.2672 42.473 88.2233 37.2336 88.287C34.8511 88.3133 33.0128 87.4681 31.5177 85.5934C24.8882 77.2756 18.2193 68.993 11.5525 60.7038C10.2148 59.042 9.69024 57.2726 10.1995 55.0949C12.6476 44.6236 15.0061 34.1282 17.4018 23.6393C17.8805 21.5385 19.0958 20.0962 21.063 19.1632C30.7527 14.5576 40.4205 9.91685 50.0818 5.25636C52.1037 4.27947 54.0294 4.33875 56.0359 5.30246C65.6382 9.93222 75.247 14.5532 84.8799 19.1237C86.9171 20.0918 88.1564 21.5714 88.6504 23.7403C91.0395 34.2313 93.4155 44.7246 95.8483 55.2025C96.3139 57.2133 95.892 58.9102 94.6351 60.4711C87.9007 68.87 81.1618 77.2668 74.4492 85.6856C73 87.5054 71.177 88.3001 68.8841 88.2804C63.5792 88.2409 58.2698 88.2694 52.9649 88.2694L52.9561 88.265L52.9583 88.2672ZM51.6097 21.2509C51.7037 23.9554 51.3758 24.3703 48.8927 24.8577C44.4861 25.7248 40.5058 27.5359 37.2795 30.7036C36.062 31.9022 35.0369 31.6475 33.9527 30.8748C33.1177 30.2821 32.4445 29.4611 31.6904 28.752C31.1746 28.2691 30.6915 27.7137 30.1013 27.3427C29.2357 26.8048 28.3286 26.8817 27.6947 27.7532C27.1199 28.5369 27.2641 29.3843 27.9133 30.056C28.357 30.5126 28.9232 30.8529 29.4609 31.2085C30.2653 31.7463 31.1287 32.2029 31.9024 32.7847C33.4762 33.9679 33.6205 34.7714 32.6871 36.4617C30.5341 40.3561 29.5702 44.5292 29.7254 48.9834C29.8106 51.4113 29.1002 52.1796 26.663 52.4562C25.5701 52.5814 24.4707 52.6472 23.3865 52.8316C22.1625 53.038 21.2925 53.7185 21.557 55.0883C21.8105 56.4077 22.8816 56.6096 23.9789 56.3418C25.1636 56.0455 26.2958 55.5493 27.4652 55.1893C29.8587 54.4561 30.6674 54.8425 31.6707 57.1321C33.4281 61.156 36.1057 64.4159 39.6795 66.9448C41.214 68.0337 41.4632 68.9666 40.5735 70.6767C40.1582 71.4758 39.6183 72.2178 39.144 72.9905C38.8402 73.4866 38.5254 73.9784 38.2588 74.4943C37.7254 75.5216 37.9527 76.4217 38.9036 77.032C39.9615 77.7103 40.873 77.1834 41.3451 76.2592C41.9834 74.9992 42.3528 73.6052 42.8643 72.2815C43.6839 70.1543 44.5364 69.7284 46.6413 70.3189C50.9124 71.5087 55.1879 71.5241 59.4633 70.3387C61.5464 69.7613 62.3158 70.1082 63.1398 72.1651C63.6207 73.3637 63.9202 74.6391 64.4579 75.8136C64.9387 76.8783 65.7475 77.741 67.0546 77.0473C68.2677 76.4041 68.3136 75.3153 67.6885 74.2133C67.083 73.1442 66.3442 72.1475 65.7366 71.0785C64.5475 68.9754 64.718 68.2576 66.6349 66.8504C70.2218 64.2227 72.8754 60.864 74.5738 56.7413C75.3585 54.8337 76.106 54.4539 78.1214 55.051C79.3563 55.4176 80.5432 55.9598 81.787 56.2738C82.9017 56.5548 84.0493 56.5152 84.4799 55.1191C84.8296 53.9841 84.0646 53.0511 82.528 52.7965C81.3192 52.5945 80.0798 52.566 78.8667 52.3794C76.9323 52.0787 76.2241 51.2269 76.305 49.3083C76.4995 44.7224 75.5246 40.4197 73.2689 36.42C72.4055 34.8899 72.5432 33.9767 73.9596 32.8637C74.7727 32.2271 75.6973 31.7463 76.5585 31.1778C77.094 30.8221 77.6667 30.4863 78.1082 30.0297C78.7618 29.3623 78.8973 28.5303 78.329 27.7268C77.7454 26.9036 76.8755 26.829 76.0754 27.2263C75.4612 27.5315 74.9607 28.0891 74.4426 28.572C73.7344 29.235 73.1027 29.9857 72.3639 30.6092C70.8951 31.8495 70.0055 31.8232 68.6087 30.5828C65.1879 27.5381 61.2207 25.6326 56.731 24.8094C54.9277 24.4779 54.3791 23.8874 54.4534 22.0258C54.5037 20.7328 54.7376 19.4508 54.8534 18.1622C54.9933 16.6562 54.1496 15.4335 53.0108 15.4379C51.872 15.4423 51.0326 16.6606 51.1834 18.171C51.2884 19.2005 51.4632 20.2235 51.6119 21.2509H51.6031H51.6097Z" fill="#326CE4"/>
+<path d="M51.6085 21.2509C51.4642 20.2236 51.285 19.2028 51.1801 18.171C51.0292 16.6607 51.8686 15.4423 53.0074 15.4379C54.1462 15.4335 54.9899 16.6563 54.85 18.1622C54.7298 19.4552 54.4959 20.7351 54.45 22.0259C54.3801 23.8874 54.9243 24.4779 56.7276 24.8094C61.2173 25.6326 65.1845 27.5337 68.6053 30.5829C69.9999 31.8232 70.8895 31.8518 72.3605 30.6092C73.0993 29.9858 73.7332 29.235 74.4392 28.5721C74.9551 28.0891 75.4578 27.5293 76.072 27.2264C76.8721 26.829 77.7442 26.9015 78.3256 27.7269C78.8939 28.5304 78.7562 29.358 78.1048 30.0297C77.6611 30.4863 77.0906 30.8178 76.5551 31.1778C75.6961 31.7508 74.7671 32.2315 73.9562 32.8638C72.5376 33.9767 72.4021 34.89 73.2655 36.42C75.519 40.4198 76.4961 44.7224 76.3016 49.3083C76.2207 51.2247 76.9311 52.0765 78.8633 52.3794C80.0764 52.566 81.3114 52.5946 82.5246 52.7965C84.0634 53.0534 84.8284 53.9842 84.4765 55.1191C84.0459 56.5175 82.8983 56.5548 81.7836 56.2738C80.5398 55.9621 79.3508 55.4198 78.118 55.0511C76.1048 54.4539 75.3595 54.8315 74.5704 56.7414C72.872 60.864 70.2185 64.2228 66.6315 66.8505C64.7146 68.2554 64.5397 68.9733 65.7332 71.0785C66.3386 72.1476 67.0731 73.1442 67.6851 74.2133C68.3102 75.3175 68.2643 76.402 67.0512 77.0474C65.7463 77.7411 64.9375 76.8761 64.4545 75.8136C63.9211 74.6436 63.6195 73.3615 63.1364 72.1651C62.308 70.1082 61.543 69.7614 59.4599 70.3387C55.1845 71.5263 50.909 71.5088 46.6379 70.3189C44.5286 69.7328 43.6762 70.1587 42.8609 72.2815C42.3516 73.6096 41.9778 75.0014 41.3417 76.2593C40.8762 77.1835 39.9581 77.7103 38.9002 77.032C37.9515 76.4239 37.7264 75.5217 38.2554 74.4943C38.5242 73.9784 38.8346 73.4867 39.1406 72.9906C39.6149 72.2178 40.1505 71.4802 40.5701 70.6768C41.4598 68.9667 41.2106 68.0315 39.6761 66.9449C36.1045 64.4159 33.4225 61.156 31.6673 57.1321C30.6641 54.8403 29.8553 54.4583 27.4618 55.1894C26.2924 55.5494 25.1602 56.0433 23.9755 56.3419C22.8804 56.6141 21.8115 56.4121 21.5536 55.0884C21.2891 53.7185 22.1591 53.0424 23.3831 52.8317C24.4629 52.6473 25.5668 52.5814 26.6597 52.4563C29.1012 52.1841 29.8072 51.4135 29.722 48.9834C29.5668 44.5293 30.5307 40.3583 32.6837 36.4618C33.6171 34.7714 33.4728 33.968 31.899 32.7847C31.1253 32.203 30.2619 31.7464 29.4575 31.2085C28.922 30.8529 28.3537 30.5148 27.9099 30.056C27.2608 29.3843 27.1165 28.5369 27.6914 27.7532C28.3296 26.8839 29.2345 26.8049 30.0979 27.3427C30.6881 27.7137 31.1712 28.2647 31.687 28.7521C32.4411 29.4633 33.1165 30.2822 33.9493 30.8749C35.0335 31.6476 36.0564 31.9022 37.2761 30.7036C40.498 27.5337 44.4784 25.7226 48.8893 24.8577C51.3724 24.3704 51.6981 23.9555 51.6063 21.2509H51.615H51.6085ZM50.5899 31.8408H50.6948C50.6948 31.3249 50.6686 30.8024 50.7036 30.2865C50.7495 29.5753 50.485 29.4084 49.7943 29.5446C46.4281 30.2031 43.4314 31.6103 40.7975 33.8231C40.0718 34.4312 40.2139 34.7758 40.9177 35.2566C42.9964 36.6857 45.0248 38.185 47.1013 39.6119C48.9789 40.9005 50.1331 40.3298 50.2795 38.0577C50.4107 35.9898 50.4893 33.9131 50.5899 31.8408ZM34.4455 47.4489C34.428 49.0493 35.1231 49.6442 36.533 49.2359C38.6947 48.608 40.8696 48.0131 43.0182 47.3458C44.9855 46.7333 45.2871 45.5105 43.7877 44.0902C41.9603 42.3582 40.0106 40.7535 38.1985 38.9995C37.2346 38.0665 36.8849 38.5319 36.4412 39.4319C35.1625 42.0267 34.557 44.7795 34.4433 47.4445L34.4455 47.4489ZM52.9527 66.4641C54.6424 66.5102 56.2839 66.2095 57.9167 65.8011C58.5812 65.6343 59.0096 65.5289 58.5309 64.6925C57.1517 62.28 55.8927 59.7972 54.4697 57.4131C53.6741 56.0784 52.3363 56.0938 51.5516 57.4329C50.144 59.8301 48.8631 62.2953 47.5057 64.7211C47.1516 65.3533 47.2959 65.5838 47.9953 65.7594C49.6281 66.1699 51.2631 66.4926 52.9549 66.4619V66.4663L52.9527 66.4641ZM71.589 47.506C71.4381 44.9025 70.8808 42.1979 69.637 39.6558C69.1321 38.6263 68.5638 38.275 67.5889 39.1904C65.8447 40.8259 64.0173 42.3757 62.2752 44.0156C60.7124 45.4864 61.0402 46.7135 63.1386 47.348C65.296 48.0043 67.4687 48.608 69.6327 49.2337C71.6196 49.8066 71.6261 49.8044 71.5868 47.5038L71.589 47.506ZM62.0741 52.7878C59.2763 52.9129 58.9309 53.4397 59.8774 55.7777C60.7779 57.9993 61.731 60.1989 62.6009 62.4314C62.896 63.1888 63.1364 63.5598 63.9408 62.9539C66.6884 60.8772 68.7955 58.3022 70.1201 55.1081C70.284 54.713 70.5835 54.1839 69.8359 54.0544C67.1671 53.5978 64.4873 53.1807 62.0719 52.7856L62.0741 52.7878ZM55.3418 31.6103H55.4074C55.5167 33.7375 55.6172 35.8647 55.7375 37.9962C55.8686 40.2903 57.0052 40.8961 58.8632 39.6207C60.8807 38.2355 62.8107 36.7208 64.8676 35.4015C65.9671 34.6946 65.7222 34.3016 64.8982 33.6299C62.3998 31.5993 59.6085 30.269 56.45 29.617C55.3375 29.3865 55.2325 29.7663 55.3309 30.6444C55.3659 30.9649 55.3353 31.2876 55.3353 31.6125H55.344L55.3418 31.6103ZM46.7494 54.3354C46.4456 53.6768 46.4849 52.8097 45.3461 52.8514C42.4827 52.9568 39.6914 53.5802 36.8696 53.971C35.875 54.1071 35.6717 54.5374 36.0608 55.4001C37.4248 58.4098 39.4182 60.9036 42.0652 62.8793C42.745 63.3864 43.0991 63.3952 43.4248 62.4819C44.0106 60.8421 44.7494 59.2571 45.4139 57.6458C45.8576 56.5724 46.2838 55.4923 46.7472 54.3398V54.3354H46.7494ZM53.1123 45.37C51.1298 45.3656 49.9604 46.1537 49.9145 47.528C49.8598 49.1788 51.4642 51.0338 52.9812 51.0645C54.4238 51.0952 56.0741 49.3478 56.0828 47.7782C56.0916 46.3184 54.9287 45.37 53.1101 45.3657L53.1145 45.37H53.1123Z" fill="#FDFDFE"/>
+<path d="M50.5936 31.8408C50.4931 33.9131 50.4144 35.9854 50.2833 38.0577C50.1346 40.3342 48.9783 40.9027 47.1051 39.6119C45.0264 38.1828 43.0001 36.6813 40.9214 35.2566C40.2176 34.7736 40.0777 34.4334 40.8012 33.8231C43.4351 31.6103 46.4319 30.2053 49.798 29.5446C50.4931 29.4085 50.7532 29.5797 50.7073 30.2866C50.6723 30.8025 50.6986 31.3249 50.6986 31.843H50.5936V31.8386V31.8408Z" fill="#326CE4"/>
+<path d="M34.4479 47.4491C34.5638 44.784 35.1671 42.0312 36.4458 39.4364C36.8895 38.5342 37.2392 38.0666 38.2032 39.0039C40.0108 40.7558 41.9649 42.3561 43.7923 44.0947C45.2917 45.5194 44.9901 46.74 43.0229 47.3503C40.8742 48.0176 38.7015 48.6103 36.5376 49.2404C35.1299 49.6487 34.4348 49.0538 34.4501 47.4534L34.4479 47.4491Z" fill="#326CE4"/>
+<path d="M52.9596 66.4597C51.2699 66.4904 49.6328 66.1633 48 65.7528C47.3005 65.5772 47.1606 65.3467 47.5103 64.7145C48.8677 62.2909 50.1486 59.8191 51.5563 57.4263C52.341 56.0872 53.6787 56.0718 54.4743 57.4065C55.8973 59.7906 57.1607 62.2734 58.5356 64.6859C59.0143 65.5201 58.5815 65.6255 57.9213 65.7945C56.2886 66.205 54.6492 66.5058 52.9574 66.4575L52.9596 66.4597Z" fill="#326CE4"/>
+<path d="M71.5882 47.5038C71.6276 49.8022 71.6188 49.811 69.6341 49.2337C67.4701 48.6058 65.2974 47.9999 63.1401 47.348C61.0417 46.7113 60.716 45.4908 62.2767 44.0156C64.0187 42.3757 65.8439 40.8259 67.5904 39.1904C68.5652 38.2772 69.1335 38.6241 69.6385 39.6558C70.8822 42.1957 71.4374 44.9025 71.5904 47.506L71.5882 47.5038Z" fill="#326CE4"/>
+<path d="M62.0786 52.7834C64.4917 53.1741 67.1693 53.5956 69.8425 54.0522C70.5857 54.1774 70.2885 54.7086 70.1267 55.106C68.7977 58.3022 66.695 60.8794 63.9474 62.9517C63.1431 63.5598 62.9026 63.1866 62.6075 62.4293C61.7376 60.1967 60.7846 57.9949 59.884 55.7755C58.9354 53.4376 59.2851 52.9107 62.0808 52.7856L62.0786 52.7834Z" fill="#326CE4"/>
+<path d="M55.3482 31.6059C55.3482 31.281 55.3788 30.9583 55.3439 30.6378C55.2477 29.7597 55.3526 29.3843 56.463 29.6104C59.6237 30.2624 62.4128 31.5927 64.9112 33.6233C65.7352 34.295 65.9844 34.6858 64.8806 35.3948C62.8237 36.7186 60.8936 38.2289 58.8761 39.6141C57.0182 40.8895 55.8794 40.2858 55.7504 37.9896C55.6302 35.8624 55.5297 33.7308 55.4204 31.6037H55.3461L55.3482 31.6059Z" fill="#326CE4"/>
+<path d="M46.7487 54.3288C46.2853 55.4813 45.8591 56.5613 45.4154 57.6348C44.7509 59.2461 44.0165 60.8311 43.4263 62.4709C43.1006 63.3842 42.7465 63.3798 42.0667 62.8683C39.4197 60.8926 37.4306 58.3988 36.0623 55.3891C35.6688 54.5264 35.8721 54.0961 36.871 53.96C39.6929 53.5736 42.482 52.9458 45.3476 52.8404C46.4864 52.7965 46.4471 53.668 46.7509 54.3244V54.3288H46.7487Z" fill="#326CE4"/>
+<path d="M53.1149 45.3635C54.9291 45.3679 56.0964 46.3119 56.0876 47.7761C56.0767 49.3457 54.4286 51.0931 52.986 51.0624C51.4712 51.0273 49.8646 49.1767 49.9193 47.5258C49.9652 46.1516 51.1368 45.3591 53.1171 45.3679L53.1127 45.3635H53.1149Z" fill="#326CE4"/>
+</svg>
diff --git a/app/react/portainer/environments/wizard/EnvironmentTypeSelectView/EnvironmentSelector.tsx b/app/react/portainer/environments/wizard/EnvironmentTypeSelectView/EnvironmentSelector.tsx
new file mode 100644
index 0000000..c5f4529
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentTypeSelectView/EnvironmentSelector.tsx
@@ -0,0 +1,28 @@
+import { BoxSelector } from '@@/BoxSelector';
+
+import { EnvironmentOption, EnvironmentOptionValue } from './environment-types';
+
+interface Props {
+  value: EnvironmentOptionValue[];
+  onChange(value: EnvironmentOptionValue[]): void;
+  options: EnvironmentOption[];
+  hiddenSpacingCount?: number;
+}
+
+export function EnvironmentSelector({
+  value,
+  onChange,
+  options,
+  hiddenSpacingCount,
+}: Props) {
+  return (
+    <BoxSelector
+      options={options}
+      isMulti
+      value={value}
+      onChange={onChange}
+      radioName="type-selector"
+      hiddenSpacingCount={hiddenSpacingCount}
+    />
+  );
+}
diff --git a/app/react/portainer/environments/wizard/EnvironmentTypeSelectView/EnvironmentTypeSelectView.tsx b/app/react/portainer/environments/wizard/EnvironmentTypeSelectView/EnvironmentTypeSelectView.tsx
new file mode 100644
index 0000000..c776912
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentTypeSelectView/EnvironmentTypeSelectView.tsx
@@ -0,0 +1,84 @@
+import { useState } from 'react';
+import { useRouter } from '@uirouter/react';
+import { Wand2 } from 'lucide-react';
+
+import { Button } from '@@/buttons';
+import { PageHeader } from '@@/PageHeader';
+import { Widget, WidgetBody, WidgetTitle } from '@@/Widget';
+import { FormSection } from '@@/form-components/FormSection';
+
+import { EnvironmentSelector } from './EnvironmentSelector';
+import {
+  EnvironmentOptionValue,
+  existingEnvironmentTypes,
+  newEnvironmentTypes,
+} from './environment-types';
+
+export function EnvironmentTypeSelectView() {
+  const [types, setTypes] = useState<EnvironmentOptionValue[]>([]);
+  const router = useRouter();
+
+  return (
+    <>
+      <PageHeader
+        title="Quick Setup"
+        breadcrumbs={[{ label: 'Environment Wizard' }]}
+        reload
+      />
+
+      <div className="row">
+        <div className="col-sm-12">
+          <Widget>
+            <WidgetTitle icon={Wand2} title="Environment Wizard" />
+            <WidgetBody>
+              <div className="form-horizontal">
+                <FormSection title="Select your environment(s)">
+                  <p className="text-muted small">
+                    You can onboard different types of environments, select all
+                    that apply.
+                  </p>
+                  <p className="control-label !mb-2">
+                    Connect to existing environments
+                  </p>
+                  <EnvironmentSelector
+                    value={types}
+                    onChange={setTypes}
+                    options={existingEnvironmentTypes}
+                  />
+                  <p className="control-label !mb-2">Set up new environments</p>
+                  <EnvironmentSelector
+                    value={types}
+                    onChange={setTypes}
+                    options={newEnvironmentTypes}
+                    hiddenSpacingCount={
+                      existingEnvironmentTypes.length -
+                      newEnvironmentTypes.length
+                    }
+                  />
+                </FormSection>
+              </div>
+              <Button
+                disabled={types.length === 0}
+                data-cy="start-wizard-button"
+                onClick={() => startWizard()}
+                className="!ml-0"
+              >
+                Start Wizard
+              </Button>
+            </WidgetBody>
+          </Widget>
+        </div>
+      </div>
+    </>
+  );
+
+  function startWizard() {
+    if (types.length === 0) {
+      return;
+    }
+
+    router.stateService.go('portainer.wizard.endpoints.create', {
+      envType: types,
+    });
+  }
+}
diff --git a/app/react/portainer/environments/wizard/EnvironmentTypeSelectView/environment-types.ts b/app/react/portainer/environments/wizard/EnvironmentTypeSelectView/environment-types.ts
new file mode 100644
index 0000000..99eac54
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentTypeSelectView/environment-types.ts
@@ -0,0 +1,104 @@
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+import Docker from '@/assets/ico/vendor/docker.svg?c';
+import Podman from '@/assets/ico/vendor/podman.svg?c';
+import Kubernetes from '@/assets/ico/vendor/kubernetes.svg?c';
+import Kubesolo from '@/assets/ico/vendor/kubesolo.svg?c';
+import Azure from '@/assets/ico/vendor/azure.svg?c';
+import InstallK8s from '@/assets/ico/vendor/install-kubernetes.svg?c';
+
+import { BoxSelectorOption } from '@@/BoxSelector';
+
+export type EnvironmentOptionValue =
+  | 'dockerStandalone'
+  | 'dockerSwarm'
+  | 'podman'
+  | 'kubernetes'
+  | 'aci'
+  | 'kubesolo'
+  | 'k8sInstall';
+
+export interface EnvironmentOption extends BoxSelectorOption<EnvironmentOptionValue> {
+  id: EnvironmentOptionValue;
+  value: EnvironmentOptionValue;
+}
+export const existingEnvironmentTypes: EnvironmentOption[] = [
+  {
+    id: 'dockerStandalone',
+    value: 'dockerStandalone',
+    label: 'Docker Standalone',
+    icon: Docker,
+    iconType: 'logo',
+    description: 'Connect to Docker Standalone via URL/IP, API or Socket',
+  },
+  {
+    id: 'dockerSwarm',
+    value: 'dockerSwarm',
+    label: 'Docker Swarm',
+    icon: Docker,
+    iconType: 'logo',
+    description: 'Connect to Docker Swarm via URL/IP, API or Socket',
+  },
+  {
+    id: 'podman',
+    value: 'podman',
+    label: 'Podman',
+    icon: Podman,
+    iconType: 'logo',
+    description: 'Connect to Podman via URL/IP or Socket',
+  },
+  {
+    id: 'kubernetes',
+    value: 'kubernetes',
+    label: 'Kubernetes',
+    icon: Kubernetes,
+    iconType: 'logo',
+    description: 'Connect to a Kubernetes environment via URL/IP',
+  },
+  {
+    id: 'aci',
+    value: 'aci',
+    label: 'ACI',
+    description: 'Connect to ACI environment via API',
+    iconType: 'logo',
+    icon: Azure,
+  },
+];
+
+export const newEnvironmentTypes: EnvironmentOption[] = [
+  {
+    id: 'kubesolo',
+    value: 'kubesolo',
+    label: 'KubeSolo (Edge)',
+    description:
+      'Deploy a single-node Kubernetes edge environment with KubeSolo',
+    icon: Kubesolo,
+    iconType: 'logo',
+    feature: FeatureId.KUBESOLO,
+    disabledWhenLimited: true,
+  },
+  {
+    id: 'k8sInstall',
+    value: 'k8sInstall',
+    label: 'Create Kubernetes cluster',
+    description: 'Create a Kubernetes cluster on existing infrastructure',
+    icon: InstallK8s,
+    iconType: 'logo',
+    feature: FeatureId.K8SINSTALL,
+    disabledWhenLimited: true,
+  },
+];
+
+export const environmentTypes: EnvironmentOption[] = [
+  ...existingEnvironmentTypes,
+  ...newEnvironmentTypes,
+];
+
+export const formTitles: Record<EnvironmentOptionValue, string> = {
+  dockerStandalone: 'Connect to your Docker Standalone environment',
+  dockerSwarm: 'Connect to your Docker Swarm environment',
+  podman: 'Connect to your Podman environment',
+  kubernetes: 'Connect to your Kubernetes environment',
+  aci: 'Connect to your ACI environment',
+  kubesolo: 'Deploy a KubeSolo edge environment',
+  k8sInstall: 'Create a Kubernetes cluster',
+};
diff --git a/app/react/portainer/environments/wizard/EnvironmentTypeSelectView/index.ts b/app/react/portainer/environments/wizard/EnvironmentTypeSelectView/index.ts
new file mode 100644
index 0000000..5db681c
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentTypeSelectView/index.ts
@@ -0,0 +1 @@
+export { EnvironmentTypeSelectView } from './EnvironmentTypeSelectView';
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/EnvironmentsCreationView.module.css b/app/react/portainer/environments/wizard/EnvironmentsCreationView/EnvironmentsCreationView.module.css
new file mode 100644
index 0000000..5ae1223
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/EnvironmentsCreationView.module.css
@@ -0,0 +1,16 @@
+.wizard-step-action {
+  padding-top: 40px;
+  padding-bottom: 40px;
+  text-align: right;
+  border-top: 1px solid #777;
+}
+
+.wizard-wrapper {
+  display: grid;
+  grid-template-columns: 2fr minmax(300px, 1fr);
+  grid-template-areas:
+    'main sidebar'
+    'footer sidebar';
+  gap: 10px;
+  margin: 0 15px;
+}
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/EnvironmentsCreationView.tsx b/app/react/portainer/environments/wizard/EnvironmentsCreationView/EnvironmentsCreationView.tsx
new file mode 100644
index 0000000..6fbc775
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/EnvironmentsCreationView.tsx
@@ -0,0 +1,229 @@
+import { useCurrentStateAndParams, useRouter } from '@uirouter/react';
+import { useState, useMemo } from 'react';
+import _ from 'lodash';
+import { Wand2 } from 'lucide-react';
+
+import { notifyError } from '@/portainer/services/notifications';
+import {
+  Environment,
+  EnvironmentId,
+} from '@/react/portainer/environments/types';
+
+import { Stepper } from '@@/Stepper/Stepper';
+import { Widget, WidgetBody, WidgetTitle } from '@@/Widget';
+import { PageHeader } from '@@/PageHeader';
+import { Button } from '@@/buttons';
+import { FormSection } from '@@/form-components/FormSection';
+import { StickyFooter } from '@@/StickyFooter/StickyFooter';
+
+import {
+  EnvironmentOptionValue,
+  environmentTypes,
+  formTitles,
+} from '../EnvironmentTypeSelectView/environment-types';
+
+import { WizardDocker } from './WizardDocker';
+import { WizardAzure } from './WizardAzure';
+import { WizardKubernetes } from './WizardKubernetes';
+import { AnalyticsState, AnalyticsStateKey } from './types';
+import styles from './EnvironmentsCreationView.module.css';
+import { WizardEndpointsList } from './WizardEndpointsList';
+import { WizardPodman } from './WizardPodman';
+
+export function EnvironmentCreationView() {
+  const {
+    params: { localEndpointId: localEndpointIdParam, referrer, step: urlStep },
+  } = useCurrentStateAndParams();
+
+  const [environmentIds, setEnvironmentIds] = useState<EnvironmentId[]>(() => {
+    const localEndpointId = parseInt(localEndpointIdParam, 10);
+
+    if (!localEndpointId || Number.isNaN(localEndpointId)) {
+      return [];
+    }
+
+    return [localEndpointId];
+  });
+
+  const envTypes = useParamEnvironmentTypes();
+  const router = useRouter();
+
+  const steps = useMemo(
+    () =>
+      _.compact(
+        envTypes.map((id) => environmentTypes.find((eType) => eType.id === id))
+      ).map((step) => ({ ...step, enabled: true })),
+    [envTypes]
+  );
+
+  const { setAnalytics } = useAnalyticsState();
+
+  const currentStepIndex = useMemo(() => {
+    if (!urlStep) return 0;
+    const idx = steps.findIndex((s) => s.id === urlStep);
+    return idx >= 0 ? idx : 0;
+  }, [urlStep, steps]);
+
+  const currentStep = steps[currentStepIndex];
+  const isFirstStep = currentStepIndex === 0;
+  const isLastStep = currentStepIndex === steps.length - 1;
+  const Component = getComponent(currentStep.id);
+
+  const isDockerStandalone = currentStep.id === 'dockerStandalone';
+
+  return (
+    <div className="pb-20">
+      <PageHeader
+        title="Quick Setup"
+        breadcrumbs={[{ label: 'Environment Wizard' }]}
+        reload
+      />
+
+      <div className="row">
+        <div className="col-sm-12">
+          <Stepper
+            steps={steps}
+            currentStepIndex={currentStepIndex}
+            onStepClick={onStepClick}
+          />
+        </div>
+      </div>
+      <div className={styles.wizardWrapper}>
+        <Widget>
+          <WidgetTitle icon={Wand2} title="Environment Wizard" />
+          <WidgetBody>
+            <FormSection title={formTitles[currentStep.id]}>
+              <Component
+                onCreate={handleCreateEnvironment}
+                isDockerStandalone={isDockerStandalone}
+              />
+            </FormSection>
+          </WidgetBody>
+        </Widget>
+        <div>
+          <WizardEndpointsList environmentIds={environmentIds} />
+        </div>
+      </div>
+
+      <StickyFooter className="justify-end gap-4">
+        <Button
+          color="default"
+          onClick={onPreviousClick}
+          disabled={isFirstStep}
+          data-cy="environment-wizard-back-button"
+          size="medium"
+        >
+          Back
+        </Button>
+        <Button
+          color="primary"
+          onClick={onNextClick}
+          data-cy="environment-wizard-continue-button"
+          size="medium"
+        >
+          {isLastStep ? 'Close' : 'Continue'}
+        </Button>
+      </StickyFooter>
+    </div>
+  );
+
+  function navigateToStep(index: number, replace = false) {
+    router.stateService.go(
+      '.',
+      { step: steps[index]?.id ?? null },
+      { location: replace ? 'replace' : true }
+    );
+  }
+
+  function onNextClick() {
+    if (isLastStep) {
+      handleFinish();
+      return;
+    }
+    navigateToStep(currentStepIndex + 1);
+  }
+
+  function onPreviousClick() {
+    navigateToStep(currentStepIndex - 1, true);
+  }
+
+  function onStepClick(index: number) {
+    navigateToStep(index, index < currentStepIndex);
+  }
+
+  function handleCreateEnvironment(
+    environment: Environment,
+    analytics: AnalyticsStateKey
+  ) {
+    setEnvironmentIds((prev) => [...prev, environment.Id]);
+    setAnalytics(analytics);
+  }
+
+  function handleFinish() {
+    if (referrer === 'environments') {
+      router.stateService.go('portainer.endpoints');
+      return;
+    }
+    router.stateService.go('portainer.home');
+  }
+}
+
+function useParamEnvironmentTypes(): EnvironmentOptionValue[] {
+  const {
+    params: { envType },
+  } = useCurrentStateAndParams();
+  const router = useRouter();
+
+  if (!envType) {
+    notifyError('No environment type provided');
+    router.stateService.go('portainer.wizard.endpoints');
+    return [];
+  }
+
+  return Array.isArray(envType) ? envType : [envType];
+}
+
+function getComponent(id: EnvironmentOptionValue) {
+  switch (id) {
+    case 'dockerStandalone':
+    case 'dockerSwarm':
+      return WizardDocker;
+    case 'podman':
+      return WizardPodman;
+    case 'aci':
+      return WizardAzure;
+    case 'kubernetes':
+      return WizardKubernetes;
+    default:
+      throw new Error(`Unknown environment type ${id}`);
+  }
+}
+
+function useAnalyticsState() {
+  const [analytics, setAnalyticsState] = useState<AnalyticsState>({
+    dockerAgent: 0,
+    dockerApi: 0,
+    dockerEdgeAgentAsync: 0,
+    dockerEdgeAgentStandard: 0,
+    podmanAgent: 0,
+    podmanEdgeAgentAsync: 0,
+    podmanEdgeAgentStandard: 0,
+    podmanLocalEnvironment: 0,
+    kubernetesAgent: 0,
+    kubernetesEdgeAgentAsync: 0,
+    kubernetesEdgeAgentStandard: 0,
+    kubesoloEdgeAgentStandard: 0,
+    kubesoloEdgeAgentAsync: 0,
+    aciApi: 0,
+    localEndpoint: 0,
+  });
+
+  return { analytics, setAnalytics };
+
+  function setAnalytics(key: AnalyticsStateKey) {
+    setAnalyticsState((prevState) => ({
+      ...prevState,
+      [key]: prevState[key] + 1,
+    }));
+  }
+}
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardAzure/WizardAzure.tsx b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardAzure/WizardAzure.tsx
new file mode 100644
index 0000000..7e3bb5b
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardAzure/WizardAzure.tsx
@@ -0,0 +1,185 @@
+import { Field, Form, Formik } from 'formik';
+import { useReducer, useState } from 'react';
+import { object, SchemaOf, string } from 'yup';
+import { Network, Plug2 } from 'lucide-react';
+
+import { useCreateAzureEnvironmentMutation } from '@/react/portainer/environments/queries/useCreateEnvironmentMutation';
+import { notifySuccess } from '@/portainer/services/notifications';
+import { Environment } from '@/react/portainer/environments/types';
+import { EnvironmentMetadata } from '@/react/portainer/environments/environment.service/create';
+import {
+  NameField,
+  useNameValidation,
+} from '@/react/portainer/environments/common/NameField/NameField';
+import { metadataValidation } from '@/react/portainer/environments/common/MetadataFieldset/validation';
+
+import { LoadingButton } from '@@/buttons/LoadingButton';
+import { Input } from '@@/form-components/Input';
+import { FormControl } from '@@/form-components/FormControl';
+import { BoxSelector, BoxSelectorOption } from '@@/BoxSelector';
+import { BadgeIcon } from '@@/BadgeIcon';
+
+import { AnalyticsStateKey } from '../types';
+import { MoreSettingsSection } from '../shared/MoreSettingsSection';
+
+interface FormValues {
+  name: string;
+  applicationId: string;
+  tenantId: string;
+  authenticationKey: string;
+  meta: EnvironmentMetadata;
+}
+
+const initialValues: FormValues = {
+  name: '',
+  applicationId: '',
+  tenantId: '',
+  authenticationKey: '',
+  meta: {
+    groupId: 1,
+    tagIds: [],
+  },
+};
+
+const options: Array<BoxSelectorOption<'api'>> = [
+  {
+    description: '',
+    icon: <BadgeIcon icon={Network} size="3xl" />,
+    id: 'api',
+    label: 'API',
+    value: 'api',
+  },
+];
+
+interface Props {
+  onCreate(environment: Environment, analytics: AnalyticsStateKey): void;
+}
+
+export function WizardAzure({ onCreate }: Props) {
+  const [formKey, clearForm] = useReducer((state) => state + 1, 0);
+
+  const [creationType, setCreationType] = useState(options[0].id);
+  const mutation = useCreateAzureEnvironmentMutation();
+  const validation = useValidation();
+
+  return (
+    <div className="form-horizontal">
+      <BoxSelector
+        options={options}
+        radioName="creation-type"
+        onChange={(value) => setCreationType(value)}
+        value={creationType}
+      />
+
+      <Formik<FormValues>
+        initialValues={initialValues}
+        onSubmit={handleSubmit}
+        key={formKey}
+        validateOnMount
+        validationSchema={validation}
+      >
+        {({ errors, dirty, isValid }) => (
+          <Form>
+            <NameField />
+
+            <FormControl
+              label="Application ID"
+              errors={errors.applicationId}
+              inputId="applicationId-input"
+              required
+            >
+              <Field
+                name="applicationId"
+                id="applicationId-input"
+                as={Input}
+                placeholder="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+              />
+            </FormControl>
+
+            <FormControl
+              label="Tenant ID"
+              errors={errors.tenantId}
+              inputId="tenantId-input"
+              required
+            >
+              <Field
+                name="tenantId"
+                id="tenantId-input"
+                as={Input}
+                placeholder="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+              />
+            </FormControl>
+
+            <FormControl
+              label="Authentication Key"
+              errors={errors.authenticationKey}
+              inputId="authenticationKey-input"
+              required
+            >
+              <Field
+                name="authenticationKey"
+                id="authenticationKey-input"
+                as={Input}
+                placeholder="cOrXoK/1D35w8YQ8nH1/8ZGwzz45JIYD5jxHKXEQknk="
+              />
+            </FormControl>
+
+            <MoreSettingsSection />
+
+            <div className="row">
+              <div className="col-sm-12">
+                <LoadingButton
+                  className="vertical-center"
+                  data-cy="create-azure-environment-button"
+                  loadingText="Connecting environment..."
+                  isLoading={mutation.isLoading}
+                  disabled={!dirty || !isValid}
+                  icon={Plug2}
+                >
+                  Connect
+                </LoadingButton>
+              </div>
+            </div>
+          </Form>
+        )}
+      </Formik>
+    </div>
+  );
+
+  function handleSubmit({
+    applicationId,
+    authenticationKey,
+    meta,
+    name,
+    tenantId,
+  }: typeof initialValues) {
+    mutation.mutate(
+      {
+        name,
+        azure: {
+          applicationId,
+          authenticationKey,
+          tenantId,
+        },
+        meta,
+      },
+      {
+        onSuccess(environment) {
+          notifySuccess('Environment created', environment.Name);
+          clearForm();
+          onCreate(environment, 'aciApi');
+        },
+      }
+    );
+  }
+}
+
+function useValidation(): SchemaOf<FormValues> {
+  return object({
+    name: useNameValidation(),
+    applicationId: string().required('Application ID is required'),
+    tenantId: string().required('Tenant ID is required'),
+    authenticationKey: string().required('Authentication Key is required'),
+    meta: metadataValidation(),
+  });
+}
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardAzure/index.ts b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardAzure/index.ts
new file mode 100644
index 0000000..93784b2
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardAzure/index.ts
@@ -0,0 +1 @@
+export { WizardAzure } from './WizardAzure';
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/APITab/APIForm.tsx b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/APITab/APIForm.tsx
new file mode 100644
index 0000000..34511c3
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/APITab/APIForm.tsx
@@ -0,0 +1,148 @@
+import { Field, Form, Formik } from 'formik';
+import { useReducer } from 'react';
+import { Plug2 } from 'lucide-react';
+
+import { useCreateRemoteEnvironmentMutation } from '@/react/portainer/environments/queries/useCreateEnvironmentMutation';
+import { notifySuccess } from '@/portainer/services/notifications';
+import {
+  Environment,
+  EnvironmentCreationTypes,
+} from '@/react/portainer/environments/types';
+import { TLSFieldset } from '@/react/components/TLSFieldset/TLSFieldset';
+import { NameField } from '@/react/portainer/environments/common/NameField/NameField';
+
+import { LoadingButton } from '@@/buttons/LoadingButton';
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+
+import { MoreSettingsSection } from '../../shared/MoreSettingsSection';
+
+import { useValidation } from './APIForm.validation';
+import { FormValues } from './types';
+
+interface Props {
+  onCreate(environment: Environment): void;
+}
+
+export function APIForm({ onCreate }: Props) {
+  const [formKey, clearForm] = useReducer((state) => state + 1, 0);
+  const initialValues: FormValues = {
+    url: '',
+    name: '',
+    tlsConfig: {
+      tls: false,
+      skipVerify: false,
+    },
+    meta: {
+      groupId: 1,
+      tagIds: [],
+    },
+  };
+
+  const mutation = useCreateRemoteEnvironmentMutation(
+    EnvironmentCreationTypes.LocalDockerEnvironment
+  );
+
+  const validation = useValidation();
+
+  return (
+    <Formik
+      initialValues={initialValues}
+      onSubmit={handleSubmit}
+      validationSchema={validation}
+      validateOnMount
+      key={formKey}
+    >
+      {({ values, errors, setFieldValue, isValid, dirty }) => (
+        <Form>
+          <NameField />
+
+          <FormControl
+            inputId="url-field"
+            label="Docker API URL"
+            required
+            tooltip="URL or IP address of a Docker host. The Docker API must be exposed over a TCP port. Please refer to the Docker documentation to configure it."
+          >
+            <Field
+              as={Input}
+              id="url-field"
+              name="url"
+              placeholder="e.g. 10.0.0.10:2375 or mydocker.mydomain.com:2375"
+            />
+          </FormControl>
+
+          <TLSFieldset
+            values={values.tlsConfig}
+            onChange={(value) =>
+              Object.entries(value).forEach(([key, value]) =>
+                setFieldValue(`tlsConfig.${key}`, value)
+              )
+            }
+            errors={errors.tlsConfig}
+          />
+
+          <MoreSettingsSection />
+
+          <div className="form-group">
+            <div className="col-sm-12">
+              <LoadingButton
+                className="wizard-connect-button vertical-center"
+                data-cy="docker-aconnect-button"
+                loadingText="Connecting environment..."
+                isLoading={mutation.isLoading}
+                disabled={!dirty || !isValid}
+                icon={Plug2}
+              >
+                Connect
+              </LoadingButton>
+            </div>
+          </div>
+        </Form>
+      )}
+    </Formik>
+  );
+
+  function handleSubmit(values: FormValues) {
+    const tls = getTlsValues();
+
+    mutation.mutate(
+      {
+        name: values.name,
+        url: values.url,
+        options: {
+          tls,
+          meta: values.meta,
+        },
+      },
+      {
+        onSuccess(environment) {
+          notifySuccess('Environment created', environment.Name);
+          clearForm();
+          onCreate(environment);
+        },
+      }
+    );
+    function getTlsValues() {
+      if (!values.tlsConfig.tls) {
+        return undefined;
+      }
+
+      return {
+        skipVerify: values.tlsConfig.skipVerify,
+        ...getCertFiles(),
+      };
+
+      function getCertFiles() {
+        if (values.tlsConfig.skipVerify) {
+          return {};
+        }
+
+        return {
+          caCertFile: values.tlsConfig.caCertFile,
+          certFile: values.tlsConfig.certFile,
+          keyFile: values.tlsConfig.keyFile,
+        };
+      }
+    }
+  }
+}
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/APITab/APIForm.validation.tsx b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/APITab/APIForm.validation.tsx
new file mode 100644
index 0000000..9c05b9d
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/APITab/APIForm.validation.tsx
@@ -0,0 +1,16 @@
+import { object, SchemaOf, string } from 'yup';
+
+import { tlsConfigValidation } from '@/react/components/TLSFieldset/TLSFieldset';
+import { useNameValidation } from '@/react/portainer/environments/common/NameField/NameField';
+import { metadataValidation } from '@/react/portainer/environments/common/MetadataFieldset/validation';
+
+import { FormValues } from './types';
+
+export function useValidation(): SchemaOf<FormValues> {
+  return object({
+    name: useNameValidation(),
+    url: string().required('This field is required.'),
+    tlsConfig: tlsConfigValidation(),
+    meta: metadataValidation(),
+  });
+}
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/APITab/APITab.tsx b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/APITab/APITab.tsx
new file mode 100644
index 0000000..3b39cd4
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/APITab/APITab.tsx
@@ -0,0 +1,15 @@
+import { Environment } from '@/react/portainer/environments/types';
+
+import { APIForm } from './APIForm';
+
+interface Props {
+  onCreate(environment: Environment): void;
+}
+
+export function APITab({ onCreate }: Props) {
+  return (
+    <div className="mt-5">
+      <APIForm onCreate={onCreate} />
+    </div>
+  );
+}
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/APITab/DeploymentScripts.test.tsx b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/APITab/DeploymentScripts.test.tsx
new file mode 100644
index 0000000..3c13375
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/APITab/DeploymentScripts.test.tsx
@@ -0,0 +1,24 @@
+import userEvent from '@testing-library/user-event';
+import { render, screen } from '@testing-library/react';
+
+import { DeploymentScripts } from './DeploymentScripts';
+
+describe('DeploymentScripts', () => {
+  it('uses the same OS labels as the Docker agent tab and switches socket examples', async () => {
+    const user = userEvent.setup();
+    render(<DeploymentScripts />);
+
+    expect(
+      screen.getByRole('button', { name: 'Linux & Windows WSL' })
+    ).toBeVisible();
+    expect(screen.getByRole('button', { name: 'Windows WCS' })).toBeVisible();
+
+    expect(screen.getByText(/var\/run\/docker\.sock/)).toBeVisible();
+
+    await user.click(screen.getByRole('button', { name: 'Windows WCS' }));
+
+    expect(
+      screen.getByText('-v \\.\\pipe\\docker_engine:\\.\\pipe\\docker_engine')
+    ).toBeVisible();
+  });
+});
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/APITab/DeploymentScripts.tsx b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/APITab/DeploymentScripts.tsx
new file mode 100644
index 0000000..7925f3b
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/APITab/DeploymentScripts.tsx
@@ -0,0 +1,62 @@
+import { useState } from 'react';
+
+import { CopyButton } from '@@/buttons/CopyButton';
+import { Code } from '@@/Code';
+import { NavTabs } from '@@/NavTabs';
+import { NavContainer } from '@@/NavTabs/NavContainer';
+import { TextTip } from '@@/Tip/TextTip';
+
+const deployments = [
+  {
+    id: 'linux',
+    label: 'Linux & Windows WSL',
+    command: `-v "/var/run/docker.sock:/var/run/docker.sock"`,
+  },
+  {
+    id: 'win',
+    label: 'Windows WCS',
+    command: '-v \\.\\pipe\\docker_engine:\\.\\pipe\\docker_engine',
+  },
+];
+
+export function DeploymentScripts() {
+  const [deployType, setDeployType] = useState(deployments[0].id);
+
+  const options = deployments.map((c) => ({
+    id: c.id,
+    label: c.label,
+    children: <DeployCode code={c.command} />,
+  }));
+
+  return (
+    <NavContainer>
+      <NavTabs
+        options={options}
+        onSelect={(id: string) => setDeployType(id)}
+        selectedId={deployType}
+      />
+    </NavContainer>
+  );
+}
+
+interface DeployCodeProps {
+  code: string;
+}
+
+function DeployCode({ code }: DeployCodeProps) {
+  return (
+    <>
+      <TextTip color="blue" className="mb-1">
+        When using the socket, ensure that you have started the Portainer
+        container with the following Docker flag:
+      </TextTip>
+
+      <Code>{code}</Code>
+      <div className="mt-2">
+        <CopyButton copyText={code} data-cy="copy-deployment-command">
+          Copy command
+        </CopyButton>
+      </div>
+    </>
+  );
+}
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/APITab/index.ts b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/APITab/index.ts
new file mode 100644
index 0000000..7e5ae32
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/APITab/index.ts
@@ -0,0 +1 @@
+export { APITab } from './APITab';
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/APITab/types.ts b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/APITab/types.ts
new file mode 100644
index 0000000..a0c5b45
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/APITab/types.ts
@@ -0,0 +1,9 @@
+import { TLSConfig } from '@/react/components/TLSFieldset/types';
+import { EnvironmentMetadata } from '@/react/portainer/environments/environment.service/create';
+
+export interface FormValues {
+  name: string;
+  url: string;
+  tlsConfig: TLSConfig;
+  meta: EnvironmentMetadata;
+}
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/AgentTab/AgentTab.tsx b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/AgentTab/AgentTab.tsx
new file mode 100644
index 0000000..6cfe40f
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/AgentTab/AgentTab.tsx
@@ -0,0 +1,28 @@
+import {
+  ContainerEngine,
+  Environment,
+} from '@/react/portainer/environments/types';
+
+import { AgentForm } from '../../shared/AgentForm/AgentForm';
+
+import { DeploymentScripts } from './DeploymentScripts';
+
+interface Props {
+  onCreate(environment: Environment): void;
+  isDockerStandalone?: boolean;
+}
+
+export function AgentTab({ onCreate, isDockerStandalone }: Props) {
+  return (
+    <>
+      <DeploymentScripts isDockerStandalone={isDockerStandalone} />
+
+      <div className="mt-5">
+        <AgentForm
+          onCreate={onCreate}
+          containerEngine={ContainerEngine.Docker}
+        />
+      </div>
+    </>
+  );
+}
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/AgentTab/DeploymentScripts.tsx b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/AgentTab/DeploymentScripts.tsx
new file mode 100644
index 0000000..9f6bd85
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/AgentTab/DeploymentScripts.tsx
@@ -0,0 +1,163 @@
+import { useState } from 'react';
+
+import { useAgentDetails } from '@/react/portainer/environments/queries/useAgentDetails';
+
+import { CopyButton } from '@@/buttons/CopyButton';
+import { Code } from '@@/Code';
+import { NavTabs } from '@@/NavTabs';
+import { NavContainer } from '@@/NavTabs/NavContainer';
+
+const deploymentsStandalone = [
+  {
+    id: 'linux',
+    label: 'Linux & Windows WSL',
+    command: linuxStandaloneCommand,
+  },
+  {
+    id: 'win',
+    label: 'Windows WCS',
+    command: winStandaloneCommand,
+  },
+];
+
+const deploymentsSwarm = [
+  {
+    id: 'linux',
+    label: 'Linux & Windows WSL',
+    command: linuxSwarmCommand,
+  },
+  {
+    id: 'win',
+    label: 'Windows WCS',
+    command: winSwarmCommand,
+  },
+];
+
+interface Props {
+  isDockerStandalone?: boolean;
+}
+
+export function DeploymentScripts({ isDockerStandalone }: Props) {
+  const deployments = isDockerStandalone
+    ? deploymentsStandalone
+    : deploymentsSwarm;
+  const [deployType, setDeployType] = useState(deployments[0].id);
+
+  const agentDetailsQuery = useAgentDetails();
+
+  if (!agentDetailsQuery) {
+    return null;
+  }
+
+  const { agentVersion, agentSecret } = agentDetailsQuery;
+
+  const options = deployments.map((c) => {
+    const code = c.command(agentVersion, agentSecret);
+
+    return {
+      id: c.id,
+      label: c.label,
+      children: <DeployCode code={code} />,
+    };
+  });
+
+  return (
+    <NavContainer>
+      <NavTabs
+        options={options}
+        onSelect={(id: string) => setDeployType(id)}
+        selectedId={deployType}
+      />
+    </NavContainer>
+  );
+}
+
+interface DeployCodeProps {
+  code: string;
+}
+
+function DeployCode({ code }: DeployCodeProps) {
+  return (
+    <>
+      <div className="code-script">
+        <Code>{code}</Code>
+      </div>
+      <div className="mt-2">
+        <CopyButton copyText={code} data-cy="copy-deployment-script">
+          Copy command
+        </CopyButton>
+      </div>
+    </>
+  );
+}
+
+function linuxStandaloneCommand(agentVersion: string, agentSecret: string) {
+  const secret =
+    agentSecret === '' ? '' : `\\\n  -e AGENT_SECRET=${agentSecret} `;
+
+  return `docker run -d \\
+  -p 9001:9001 ${secret}\\
+  --name portainer_agent \\
+  --restart=always \\
+  -v /var/run/docker.sock:/var/run/docker.sock \\
+  -v /var/lib/docker/volumes:/var/lib/docker/volumes \\
+  -v /:/host \\
+  portainer/agent:${agentVersion}
+`;
+}
+
+function linuxSwarmCommand(agentVersion: string, agentSecret: string) {
+  const secret =
+    agentSecret === '' ? '' : `\\\n  -e AGENT_SECRET=${agentSecret} `;
+
+  return `docker network create \\
+--driver overlay \\
+  portainer_agent_network
+
+docker service create \\
+  --name portainer_agent \\
+  --network portainer_agent_network \\
+  -p 9001:9001/tcp ${secret}\\
+  --mode global \\
+  --constraint 'node.platform.os == linux' \\
+  --mount type=bind,src=//var/run/docker.sock,dst=/var/run/docker.sock \\
+  --mount type=bind,src=//var/lib/docker/volumes,dst=/var/lib/docker/volumes \\
+  --mount type=bind,src=//,dst=/host \\
+  portainer/agent:${agentVersion}
+`;
+}
+
+function winStandaloneCommand(agentVersion: string, agentSecret: string) {
+  const secret =
+    agentSecret === '' ? '' : `\`\n  -e AGENT_SECRET=${agentSecret} `;
+
+  return `docker run -d \`
+  -p 9001:9001 ${secret}\`
+  --name portainer_agent \`
+  --restart=always \`
+  -v C:\\:C:\\host \`
+  -v C:\\ProgramData\\docker\\volumes:C:\\ProgramData\\docker\\volumes \`
+  -v \\\\.\\pipe\\docker_engine:\\\\.\\pipe\\docker_engine \`
+  portainer/agent:${agentVersion}
+`;
+}
+
+function winSwarmCommand(agentVersion: string, agentSecret: string) {
+  const secret =
+    agentSecret === '' ? '' : `\`\n  -e AGENT_SECRET=${agentSecret} `;
+
+  return `docker network create \`
+--driver overlay \`
+  portainer_agent_network
+
+docker service create \`
+  --name portainer_agent \`
+  --network portainer_agent_network \`
+  -p 9001:9001/tcp ${secret}\`
+  --mode global \`
+  --constraint 'node.platform.os == windows' \`
+  --mount type=npipe,src=\\\\.\\pipe\\docker_engine,dst=\\\\.\\pipe\\docker_engine \`
+  --mount type=bind,src=C:\\ProgramData\\docker\\volumes,dst=C:\\ProgramData\\docker\\volumes \`
+  portainer/agent:${agentVersion}
+`;
+}
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/AgentTab/index.ts b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/AgentTab/index.ts
new file mode 100644
index 0000000..fb72ea6
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/AgentTab/index.ts
@@ -0,0 +1 @@
+export { AgentTab } from './AgentTab';
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/SocketTab/SocketForm.tsx b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/SocketTab/SocketForm.tsx
new file mode 100644
index 0000000..a21bcca
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/SocketTab/SocketForm.tsx
@@ -0,0 +1,125 @@
+import { Field, Form, Formik, useFormikContext } from 'formik';
+import { useReducer } from 'react';
+import { Plug2 } from 'lucide-react';
+
+import { useCreateLocalDockerEnvironmentMutation } from '@/react/portainer/environments/queries/useCreateEnvironmentMutation';
+import { notifySuccess } from '@/portainer/services/notifications';
+import {
+  ContainerEngine,
+  Environment,
+} from '@/react/portainer/environments/types';
+import { NameField } from '@/react/portainer/environments/common/NameField/NameField';
+
+import { LoadingButton } from '@@/buttons/LoadingButton';
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+import { SwitchField } from '@@/form-components/SwitchField';
+
+import { MoreSettingsSection } from '../../shared/MoreSettingsSection';
+
+import { useValidation } from './SocketForm.validation';
+import { FormValues } from './types';
+
+interface Props {
+  onCreate(environment: Environment): void;
+  containerEngine: ContainerEngine;
+}
+
+export function SocketForm({ onCreate, containerEngine }: Props) {
+  const [formKey, clearForm] = useReducer((state) => state + 1, 0);
+  const initialValues: FormValues = {
+    name: '',
+    socketPath: '',
+    overridePath: false,
+    meta: { groupId: 1, tagIds: [] },
+  };
+
+  const mutation = useCreateLocalDockerEnvironmentMutation();
+  const validation = useValidation();
+
+  return (
+    <Formik
+      initialValues={initialValues}
+      onSubmit={handleSubmit}
+      validationSchema={validation}
+      validateOnMount
+      key={formKey}
+    >
+      {({ isValid, dirty }) => (
+        <Form>
+          <NameField />
+
+          <OverrideSocketFieldset />
+
+          <MoreSettingsSection />
+
+          <div className="form-group">
+            <div className="col-sm-12">
+              <LoadingButton
+                className="wizard-connect-button vertical-center"
+                data-cy="docker-socket-connect-button"
+                loadingText="Connecting environment..."
+                isLoading={mutation.isLoading}
+                disabled={!dirty || !isValid}
+                icon={Plug2}
+              >
+                Connect
+              </LoadingButton>
+            </div>
+          </div>
+        </Form>
+      )}
+    </Formik>
+  );
+
+  function handleSubmit(values: FormValues) {
+    mutation.mutate(
+      {
+        name: values.name,
+        socketPath: values.overridePath ? values.socketPath : '',
+        meta: values.meta,
+        containerEngine,
+      },
+      {
+        onSuccess(environment) {
+          notifySuccess('Environment created', environment.Name);
+          clearForm();
+          onCreate(environment);
+        },
+      }
+    );
+  }
+}
+
+function OverrideSocketFieldset() {
+  const { values, setFieldValue, errors } = useFormikContext<FormValues>();
+
+  return (
+    <>
+      <div className="form-group">
+        <div className="col-sm-12">
+          <SwitchField
+            checked={values.overridePath}
+            data-cy="create-docker-env-socket-override-switch"
+            onChange={(checked) => setFieldValue('overridePath', checked)}
+            label="Override default socket path"
+            labelClass="col-sm-3 col-lg-2"
+          />
+        </div>
+      </div>
+      {values.overridePath && (
+        <FormControl
+          label="Socket Path"
+          tooltip="Path to the Docker socket. Remember to bind-mount the socket, see the important notice above for more information."
+          errors={errors.socketPath}
+        >
+          <Field
+            name="socketPath"
+            as={Input}
+            placeholder="e.g. /var/run/docker.sock (on Linux) or //./pipe/docker_engine (on Windows)"
+          />
+        </FormControl>
+      )}
+    </>
+  );
+}
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/SocketTab/SocketForm.validation.tsx b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/SocketTab/SocketForm.validation.tsx
new file mode 100644
index 0000000..841fbe2
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/SocketTab/SocketForm.validation.tsx
@@ -0,0 +1,23 @@
+import { boolean, object, SchemaOf, string } from 'yup';
+
+import { useNameValidation } from '@/react/portainer/environments/common/NameField/NameField';
+import { metadataValidation } from '@/react/portainer/environments/common/MetadataFieldset/validation';
+
+import { FormValues } from './types';
+
+export function useValidation(): SchemaOf<FormValues> {
+  return object({
+    name: useNameValidation(),
+    meta: metadataValidation(),
+    overridePath: boolean().default(false),
+    socketPath: string()
+      .default('')
+      .when('overridePath', (overridePath, schema) =>
+        overridePath
+          ? schema.required(
+              'Socket Path is required when override path is enabled'
+            )
+          : schema
+      ),
+  });
+}
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/SocketTab/SocketTab.tsx b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/SocketTab/SocketTab.tsx
new file mode 100644
index 0000000..32b0bda
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/SocketTab/SocketTab.tsx
@@ -0,0 +1,27 @@
+import {
+  ContainerEngine,
+  Environment,
+} from '@/react/portainer/environments/types';
+
+import { DeploymentScripts } from '../APITab/DeploymentScripts';
+
+import { SocketForm } from './SocketForm';
+
+interface Props {
+  onCreate(environment: Environment): void;
+}
+
+export function SocketTab({ onCreate }: Props) {
+  return (
+    <>
+      <DeploymentScripts />
+
+      <div className="mt-5">
+        <SocketForm
+          onCreate={onCreate}
+          containerEngine={ContainerEngine.Docker}
+        />
+      </div>
+    </>
+  );
+}
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/SocketTab/index.ts b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/SocketTab/index.ts
new file mode 100644
index 0000000..96425ea
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/SocketTab/index.ts
@@ -0,0 +1 @@
+export { SocketTab } from './SocketTab';
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/SocketTab/types.ts b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/SocketTab/types.ts
new file mode 100644
index 0000000..9bc7fda
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/SocketTab/types.ts
@@ -0,0 +1,8 @@
+import { EnvironmentMetadata } from '@/react/portainer/environments/environment.service/create';
+
+export interface FormValues {
+  name: string;
+  socketPath: string;
+  overridePath: boolean;
+  meta: EnvironmentMetadata;
+}
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/WizardDocker.tsx b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/WizardDocker.tsx
new file mode 100644
index 0000000..d984729
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/WizardDocker.tsx
@@ -0,0 +1,220 @@
+import { useState } from 'react';
+import { Zap, Network, Plug2 } from 'lucide-react';
+import _ from 'lodash';
+
+import {
+  ContainerEngine,
+  Environment,
+} from '@/react/portainer/environments/types';
+import { commandsTabs } from '@/react/edge/components/EdgeScriptForm/scripts';
+import { isBE } from '@/react/portainer/feature-flags/feature-flags.service';
+import EdgeAgentStandardIcon from '@/react/edge/components/edge-agent-standard.svg?c';
+import EdgeAgentAsyncIcon from '@/react/edge/components/edge-agent-async.svg?c';
+
+import { BoxSelector, type BoxSelectorOption } from '@@/BoxSelector';
+import { BadgeIcon } from '@@/BadgeIcon';
+import { Alert } from '@@/Alert';
+import { FormSection } from '@@/form-components/FormSection';
+import { Badge } from '@@/Badge';
+import { ExternalLink } from '@@/ExternalLink';
+import { useDocsUrl } from '@@/PageHeader/ContextHelp';
+
+import { AnalyticsStateKey } from '../types';
+import { EdgeAgentTab } from '../shared/EdgeAgentTab';
+
+import { AgentTab } from './AgentTab';
+import { APITab } from './APITab';
+import { SocketTab } from './SocketTab';
+
+interface Props {
+  onCreate(environment: Environment, analytics: AnalyticsStateKey): void;
+  isDockerStandalone?: boolean;
+}
+
+type CreationType =
+  | 'agent'
+  | 'api'
+  | 'socket'
+  | 'edgeAgentStandard'
+  | 'edgeAgentAsync';
+
+const primaryOptions: BoxSelectorOption<CreationType>[] = _.compact([
+  {
+    id: 'edgeAgentStandard',
+    icon: <BadgeIcon icon={EdgeAgentStandardIcon} size="3xl" />,
+    label: 'Edge Agent Standard',
+    description: (
+      <>
+        <span>
+          <Badge type="infoSecondary">Recommended</Badge>{' '}
+          <Badge type="infoSecondary">Supports Policies</Badge>
+        </span>
+        <span className="mt-1 block">
+          The remote environment will initiate connections to the Portainer
+          server, with the ability to open a secure on-demand tunnel for
+          real-time interaction. The Portainer server must be accessible from
+          the Edge Agent environment.
+        </span>
+      </>
+    ),
+    value: 'edgeAgentStandard',
+  },
+  isBE && {
+    id: 'edgeAgentAsync',
+    icon: <BadgeIcon icon={EdgeAgentAsyncIcon} size="3xl" />,
+    label: 'Edge Agent Async',
+    description:
+      'The remote environment will initiate connections to the Portainer server, without the ability to open a real-time tunnel. The Portainer server must be accessible from the Edge Agent environment.',
+    value: 'edgeAgentAsync' as CreationType,
+  },
+]);
+
+const legacyOptions: BoxSelectorOption<CreationType>[] = [
+  {
+    id: 'agent',
+    icon: <BadgeIcon icon={Zap} size="3xl" />,
+    label: 'Agent',
+    description:
+      'The Portainer Server will initiate connections to the remote environment. The agent on the remote environment must be accessible from the Portainer server environment.',
+    value: 'agent',
+  },
+  {
+    id: 'api',
+    icon: <BadgeIcon icon={Network} size="3xl" />,
+    label: 'API',
+    description: 'Connect to the environment directly via the Docker API.',
+    value: 'api',
+  },
+  {
+    id: 'socket',
+    icon: <BadgeIcon icon={Plug2} size="3xl" />,
+    label: 'Socket',
+    description: 'Connect to the environment directly via the Docker socket.',
+    value: 'socket',
+  },
+];
+
+const containerEngine = ContainerEngine.Docker;
+
+export function WizardDocker({ onCreate, isDockerStandalone }: Props) {
+  const edgeAgentDocsUrl = useDocsUrl(
+    '/faqs/getting-started/why-do-we-recommend-using-the-edge-agent-instead-of-the-traditional-agent'
+  );
+  const [creationType, setCreationType] = useState<CreationType>(
+    primaryOptions[0].value
+  );
+
+  const tab = getTab(creationType);
+
+  return (
+    <div className="form-horizontal">
+      {!isDockerStandalone && (
+        <Alert color="warn" className="col-sm-12 mb-2">
+          <div>
+            Only do this <b>once</b> for your environment, regardless of how
+            many nodes are in the cluster. You do <b>not</b> need to add each
+            node as an individual environment in Portainer. Adding just one node
+            (we recommend the manager node) will allow Portainer to manage the
+            entire cluster.
+          </div>
+        </Alert>
+      )}
+      <BoxSelector
+        onChange={(v) => setCreationType(v)}
+        options={primaryOptions}
+        value={creationType}
+        radioName="creation-type"
+        className="!-mb-2"
+      />
+
+      <FormSection
+        key="legacy-options"
+        title="More options"
+        titleSize="sm"
+        isFoldable
+        defaultFolded={false}
+        className="mb-8"
+      >
+        <p className="text-muted mb-2 text-xs">
+          These are legacy options that don&apos;t support edge features or
+          policy management. For most use cases,{' '}
+          <ExternalLink
+            to={edgeAgentDocsUrl}
+            data-cy="wizard-edge-agent-docs-link"
+          >
+            the Edge Agent is recommended
+          </ExternalLink>
+        </p>
+        <BoxSelector
+          onChange={(v) => setCreationType(v)}
+          options={legacyOptions}
+          value={creationType}
+          radioName="creation-type"
+        />
+      </FormSection>
+
+      {tab}
+    </div>
+  );
+
+  function getTab(creationType: CreationType) {
+    switch (creationType) {
+      case 'agent':
+        return (
+          <AgentTab
+            onCreate={(environment) => onCreate(environment, 'dockerAgent')}
+            isDockerStandalone={isDockerStandalone}
+          />
+        );
+      case 'api':
+        return (
+          <APITab
+            onCreate={(environment) => onCreate(environment, 'dockerApi')}
+          />
+        );
+      case 'socket':
+        return (
+          <SocketTab
+            onCreate={(environment) => onCreate(environment, 'localEndpoint')}
+          />
+        );
+      case 'edgeAgentStandard':
+        return (
+          <EdgeAgentTab
+            onCreate={(environment) =>
+              onCreate(environment, 'dockerEdgeAgentStandard')
+            }
+            commands={{
+              linux: isDockerStandalone
+                ? [commandsTabs.standaloneLinux]
+                : [commandsTabs.swarmLinux],
+              win: isDockerStandalone
+                ? [commandsTabs.standaloneWindow]
+                : [commandsTabs.swarmWindows],
+            }}
+            containerEngine={containerEngine}
+          />
+        );
+      case 'edgeAgentAsync':
+        return (
+          <EdgeAgentTab
+            asyncMode
+            onCreate={(environment) =>
+              onCreate(environment, 'dockerEdgeAgentAsync')
+            }
+            commands={{
+              linux: isDockerStandalone
+                ? [commandsTabs.standaloneLinux]
+                : [commandsTabs.swarmLinux],
+              win: isDockerStandalone
+                ? [commandsTabs.standaloneWindow]
+                : [commandsTabs.swarmWindows],
+            }}
+            containerEngine={containerEngine}
+          />
+        );
+      default:
+        return null;
+    }
+  }
+}
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/index.ts b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/index.ts
new file mode 100644
index 0000000..562baea
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardDocker/index.ts
@@ -0,0 +1 @@
+export { WizardDocker } from './WizardDocker';
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardEndpointsList/WizardEndpointsList.module.css b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardEndpointsList/WizardEndpointsList.module.css
new file mode 100644
index 0000000..c0d4b42
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardEndpointsList/WizardEndpointsList.module.css
@@ -0,0 +1,46 @@
+.wizard-list-wrapper {
+  display: grid;
+  grid-template-columns: 50px 1fr 70px;
+  grid-template-areas:
+    'image title title'
+    'image subtitle edgeStatus'
+    'image type type';
+  border: 1px solid rgb(221, 221, 221);
+  border-radius: 5px;
+  margin-bottom: 10px;
+  margin-top: 3px;
+  padding: 10px;
+  box-shadow: 0 3px 10px -2px rgb(161 170 166 / 20%);
+}
+
+.wizard-list-edge-status {
+  grid-area: edgeStatus;
+  display: flex;
+  justify-content: flex-end;
+  align-items: center;
+}
+
+.wizard-list-image {
+  grid-area: image;
+}
+
+.wizard-list-title {
+  grid-column: title;
+  padding: 0px 5px;
+  font-weight: bold;
+  font-size: 14px;
+}
+
+.wizard-list-subtitle {
+  grid-column: subtitle;
+  padding: 0px 5px;
+  font-size: 10px;
+  color: rgb(129, 129, 129);
+}
+
+.wizard-list-type {
+  grid-column: type;
+  padding: 0px 5px;
+  font-size: 10px;
+  color: rgb(129, 129, 129);
+}
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardEndpointsList/WizardEndpointsList.tsx b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardEndpointsList/WizardEndpointsList.tsx
new file mode 100644
index 0000000..9301e1a
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardEndpointsList/WizardEndpointsList.tsx
@@ -0,0 +1,84 @@
+import { Plug2 } from 'lucide-react';
+import clsx from 'clsx';
+
+import { stripProtocol } from '@/react/common/string-utils';
+import { endpointTypeName } from '@/portainer/filters/filters';
+import {
+  getEnvironmentTypeIcon,
+  isEdgeEnvironment,
+  isUnassociatedEdgeEnvironment,
+} from '@/react/portainer/environments/utils';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import {
+  ENVIRONMENTS_POLLING_INTERVAL,
+  useEnvironmentList,
+} from '@/react/portainer/environments/queries/useEnvironmentList';
+
+import { EdgeIndicator } from '@@/EdgeIndicator';
+import { Widget, WidgetBody, WidgetTitle } from '@@/Widget';
+import { Icon } from '@@/Icon';
+
+import styles from './WizardEndpointsList.module.css';
+
+interface Props {
+  environmentIds: EnvironmentId[];
+}
+
+export function WizardEndpointsList({ environmentIds }: Props) {
+  const { environments } = useEnvironmentList(
+    { endpointIds: environmentIds },
+    {
+      refetchInterval: (environments) => {
+        if (!environments) {
+          return false;
+        }
+
+        if (!environments.value.some(isUnassociatedEdgeEnvironment)) {
+          return false;
+        }
+
+        return ENVIRONMENTS_POLLING_INTERVAL;
+      },
+
+      enabled: environmentIds.length > 0,
+    }
+  );
+
+  return (
+    <Widget>
+      <WidgetTitle icon={Plug2} title="New Environments" />
+      <WidgetBody>
+        {environments.map((environment) => (
+          <div className={styles.wizardListWrapper} key={environment.Id}>
+            <div
+              className={clsx(
+                styles.wizardListImage,
+                'text-5xl text-blue-8 th-highcontrast:text-white th-dark:text-blue-7'
+              )}
+            >
+              <Icon
+                icon={getEnvironmentTypeIcon(
+                  environment.Type,
+                  environment.ContainerEngine
+                )}
+                className="mr-1"
+              />
+            </div>
+            <div className={styles.wizardListTitle}>{environment.Name}</div>
+            <div className={styles.wizardListSubtitle}>
+              URL: {stripProtocol(environment.URL)}
+            </div>
+            <div className={styles.wizardListType}>
+              Type: {endpointTypeName(environment.Type)}
+            </div>
+            {isEdgeEnvironment(environment.Type) && (
+              <div className={styles.wizardListEdgeStatus}>
+                <EdgeIndicator environment={environment} />
+              </div>
+            )}
+          </div>
+        ))}
+      </WidgetBody>
+    </Widget>
+  );
+}
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardEndpointsList/index.ts b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardEndpointsList/index.ts
new file mode 100644
index 0000000..ab5267a
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardEndpointsList/index.ts
@@ -0,0 +1 @@
+export { WizardEndpointsList } from './WizardEndpointsList';
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardKubernetes/AgentPanel.tsx b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardKubernetes/AgentPanel.tsx
new file mode 100644
index 0000000..e80f515
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardKubernetes/AgentPanel.tsx
@@ -0,0 +1,29 @@
+import { useState } from 'react';
+
+import { Environment } from '@/react/portainer/environments/types';
+
+import { AgentForm } from '../shared/AgentForm';
+
+import { deployments, DeploymentScripts } from './DeploymentScripts';
+
+interface Props {
+  onCreate(environment: Environment): void;
+}
+
+export function AgentPanel({ onCreate }: Props) {
+  const [deployType, setDeployType] = useState(deployments[0].id);
+  const defaultPort = deployType === 'k8sNodePort' ? '30778' : '9001';
+  return (
+    <>
+      <DeploymentScripts
+        deployType={deployType}
+        setDeployType={setDeployType}
+      />
+
+      <div className="mt-5">
+        {' '}
+        <AgentForm onCreate={onCreate} envDefaultPort={defaultPort} />
+      </div>
+    </>
+  );
+}
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardKubernetes/DeploymentScripts.tsx b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardKubernetes/DeploymentScripts.tsx
new file mode 100644
index 0000000..870a2a6
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardKubernetes/DeploymentScripts.tsx
@@ -0,0 +1,122 @@
+import { Info } from 'lucide-react';
+
+import { getAgentShortVersion } from '@/portainer/views/endpoints/helpers';
+import { useAgentDetails } from '@/react/portainer/environments/queries/useAgentDetails';
+
+import { CopyButton } from '@@/buttons/CopyButton';
+import { Code } from '@@/Code';
+import { FormSectionTitle } from '@@/form-components/FormSectionTitle';
+import { NavTabs } from '@@/NavTabs';
+import { Icon } from '@@/Icon';
+import { NavContainer } from '@@/NavTabs/NavContainer';
+
+export const deployments = [
+  {
+    id: 'k8sLoadBalancer',
+    label: 'Kubernetes via load balancer',
+    command: kubeLoadBalancerCommand,
+    showAgentSecretMessage: true,
+  },
+  {
+    id: 'k8sNodePort',
+    label: 'Kubernetes via node port',
+    command: kubeNodePortCommand,
+    showAgentSecretMessage: true,
+  },
+];
+
+export function DeploymentScripts({
+  deployType,
+  setDeployType,
+}: {
+  deployType: string;
+  setDeployType: (id: string) => void;
+}) {
+  const agentDetailsQuery = useAgentDetails();
+
+  if (!agentDetailsQuery) {
+    return null;
+  }
+
+  const { agentVersion, agentSecret } = agentDetailsQuery;
+
+  const options = deployments.map((c) => {
+    const code = c.command(agentVersion);
+
+    return {
+      id: c.id,
+      label: c.label,
+      children: (
+        <DeployCode
+          agentSecret={agentSecret}
+          showAgentSecretMessage={c.showAgentSecretMessage}
+          code={code}
+        />
+      ),
+    };
+  });
+
+  return (
+    <>
+      <FormSectionTitle>Information</FormSectionTitle>
+
+      <div className="form-group">
+        <span className="col-sm-12 text-muted small">
+          Ensure that you have deployed the Portainer agent in your cluster
+          first. Refer to the platform related command below to deploy it.
+        </span>
+      </div>
+
+      <NavContainer>
+        <NavTabs
+          options={options}
+          onSelect={(id: string) => setDeployType(id)}
+          selectedId={deployType}
+        />
+      </NavContainer>
+    </>
+  );
+}
+
+function kubeNodePortCommand(agentVersion: string) {
+  const agentShortVersion = getAgentShortVersion(agentVersion);
+
+  return `kubectl apply -f https://downloads.portainer.io/ce${agentShortVersion}/portainer-agent-k8s-nodeport.yaml`;
+}
+
+function kubeLoadBalancerCommand(agentVersion: string) {
+  const agentShortVersion = getAgentShortVersion(agentVersion);
+
+  return `kubectl apply -f https://downloads.portainer.io/ce${agentShortVersion}/portainer-agent-k8s-lb.yaml`;
+}
+
+interface LoadBalancerProps {
+  agentSecret?: string;
+  showAgentSecretMessage?: boolean;
+  code: string;
+}
+
+function DeployCode({
+  agentSecret,
+  showAgentSecretMessage,
+  code,
+}: LoadBalancerProps) {
+  return (
+    <>
+      {showAgentSecretMessage && agentSecret && (
+        <p className="text-muted small my-6">
+          <Icon icon={Info} mode="primary" className="mr-1" />
+          Note that the environment variable AGENT_SECRET will need to be set to
+          <code>{agentSecret}</code>. Please update the manifest that will be
+          downloaded from the following script.
+        </p>
+      )}
+      <Code>{code}</Code>
+      <div className="mt-2">
+        <CopyButton copyText={code} data-cy="copy-deploy-agent-command-button">
+          Copy command
+        </CopyButton>
+      </div>
+    </>
+  );
+}
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardKubernetes/KubeConfigTeaserForm.tsx b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardKubernetes/KubeConfigTeaserForm.tsx
new file mode 100644
index 0000000..ff40ec0
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardKubernetes/KubeConfigTeaserForm.tsx
@@ -0,0 +1,104 @@
+import { Field, Form, Formik } from 'formik';
+import { Plug2 } from 'lucide-react';
+
+import { LoadingButton } from '@@/buttons/LoadingButton';
+import { FormControl } from '@@/form-components/FormControl';
+import { FormSectionTitle } from '@@/form-components/FormSectionTitle';
+import { Input } from '@@/form-components/Input';
+import { Button } from '@@/buttons';
+import { TextTip } from '@@/Tip/TextTip';
+import { useDocsUrl } from '@@/PageHeader/ContextHelp';
+
+const initialValues = {
+  kubeConfig: '',
+  name: '',
+  meta: {
+    groupId: 1,
+    tagIds: [],
+  },
+};
+
+export function KubeConfigTeaserForm() {
+  const kubeConfigImportDocUrl = useDocsUrl(
+    '/admin/environments/add/kubernetes/import'
+  );
+
+  return (
+    <Formik initialValues={initialValues} onSubmit={() => {}} validateOnMount>
+      {() => (
+        <Form>
+          <FormSectionTitle>Environment details</FormSectionTitle>
+          <div className="form-group">
+            <div className="col-sm-12">
+              <TextTip color="blue">
+                <span className="text-muted">
+                  <a
+                    href={kubeConfigImportDocUrl}
+                    target="_blank"
+                    rel="noreferrer"
+                  >
+                    Import the kubeconfig file
+                  </a>{' '}
+                  of an existing Kubernetes cluster located on-premise or on a
+                  cloud platform. This will create a corresponding environment
+                  in Portainer and install the agent on the cluster. Please
+                  ensure:
+                </span>
+              </TextTip>
+            </div>
+            <div className="col-sm-12 text-muted text-xs">
+              <ul className="p-2 pl-4">
+                <li>You have a load balancer enabled in your cluster</li>
+                <li>You specify current-context in your kubeconfig</li>
+                <li>
+                  The kubeconfig is self-contained - including any required
+                  credentials.
+                </li>
+              </ul>
+              <p>
+                Note: Officially supported cloud providers are Civo, Akamai
+                Connected Cloud, DigitalOcean and Microsoft Azure (others are
+                not guaranteed to work at present)
+              </p>
+            </div>
+          </div>
+
+          <FormControl label="Name" required>
+            <Field
+              name="name"
+              as={Input}
+              data-cy="endpointCreate-nameInput"
+              placeholder="e.g. docker-prod01 / kubernetes-cluster01"
+              readOnly
+            />
+          </FormControl>
+
+          <FormControl
+            label="Kubeconfig file"
+            required
+            inputId="kubeconfig_file"
+          >
+            <Button disabled data-cy="kubeconfig-file-upload">
+              Select a file
+            </Button>
+          </FormControl>
+
+          <div className="form-group">
+            <div className="col-sm-12">
+              <LoadingButton
+                className="wizard-connect-button !ml-0"
+                data-cy="kubeconfig-connect-environment-button"
+                loadingText="Connecting environment..."
+                isLoading={false}
+                disabled
+                icon={Plug2}
+              >
+                Connect
+              </LoadingButton>
+            </div>
+          </div>
+        </Form>
+      )}
+    </Formik>
+  );
+}
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardKubernetes/WizardKubernetes.test.tsx b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardKubernetes/WizardKubernetes.test.tsx
new file mode 100644
index 0000000..485606a
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardKubernetes/WizardKubernetes.test.tsx
@@ -0,0 +1,96 @@
+import { HttpResponse } from 'msw';
+import { render, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { server, http } from '@/setup-tests/server';
+import { createMockEnvironment } from '@/react-tools/test-mocks';
+
+import { WizardKubernetes } from './WizardKubernetes';
+
+function renderComponent() {
+  // minimal settings so EdgeAgentForm can render
+  server.use(
+    http.get('/api/settings', () =>
+      HttpResponse.json({
+        AgentSecret: 'secret',
+        EdgePortainerUrl: 'https://example.com',
+        Edge: {
+          PingInterval: 60,
+          SnapshotInterval: 60,
+          CommandInterval: 60,
+          AsyncMode: false,
+          TunnelServerAddress: 'portainer.test:8000',
+        },
+      })
+    ),
+    http.get('/api/custom_templates', () => HttpResponse.json([])),
+    http.get('/api/system/status', () =>
+      HttpResponse.json({ Version: '2.19.0', Edition: 'CE', InstanceID: '1' })
+    ),
+    http.get('/api/endpoints', () =>
+      HttpResponse.json([], {
+        headers: {
+          'x-total-available': '0',
+          'x-total-count': '0',
+        },
+      })
+    )
+  );
+
+  const Wrapped = withTestQueryProvider(
+    withTestRouter(() => <WizardKubernetes onCreate={() => {}} />)
+  );
+  return render(<Wrapped />);
+}
+
+describe('WizardKubernetes', () => {
+  test('renders Edge Agent Standard form when selected', async () => {
+    const { getByText, queryByTestId, findByTestId } = renderComponent();
+
+    // select Edge Agent Standard
+    await userEvent.click(getByText('Edge Agent Standard'));
+
+    // verify submit button is visible (smallest sanity check for setup)
+    await expect(
+      findByTestId('edge-agent-form-submit-button')
+    ).resolves.toBeVisible();
+    expect(
+      queryByTestId('endpointCreate-portainerServerUrlInput')
+    ).toBeInTheDocument();
+  });
+
+  test('submits ContainerEngine as empty string for Kubernetes', async () => {
+    let observedEntries: Array<[string, string]> = [];
+
+    server.use(
+      http.post('/api/endpoints', async ({ request }) => {
+        const form = await request.formData();
+        observedEntries = Array.from(form.entries()).map(([key, value]) => [
+          key,
+          typeof value === 'string' ? value : 'binary',
+        ]);
+        return HttpResponse.json(createMockEnvironment());
+      })
+    );
+
+    const { getByText, getByTestId, findByTestId } = renderComponent();
+
+    await userEvent.click(getByText('Edge Agent Standard'));
+
+    await userEvent.type(getByTestId('environmentCreate-nameInput'), 'k8s-env');
+
+    const submitBtn = await findByTestId('edge-agent-form-submit-button');
+    await waitFor(() => expect(submitBtn).not.toBeDisabled());
+    await userEvent.click(submitBtn);
+
+    // assert POST happened and ContainerEngine key exists with empty string
+    await waitFor(() => {
+      expect(observedEntries.length).toBeGreaterThan(0);
+      expect(
+        observedEntries.some(([k, v]) => k === 'ContainerEngine' && v === '')
+      ).toBe(true);
+    });
+  });
+});
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardKubernetes/WizardKubernetes.tsx b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardKubernetes/WizardKubernetes.tsx
new file mode 100644
index 0000000..c11fd36
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardKubernetes/WizardKubernetes.tsx
@@ -0,0 +1,184 @@
+import { useState } from 'react';
+import { Zap, UploadCloud } from 'lucide-react';
+import _ from 'lodash';
+
+import {
+  ContainerEngine,
+  Environment,
+} from '@/react/portainer/environments/types';
+import { commandsTabs } from '@/react/edge/components/EdgeScriptForm/scripts';
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+import { isBE } from '@/react/portainer/feature-flags/feature-flags.service';
+import EdgeAgentStandardIcon from '@/react/edge/components/edge-agent-standard.svg?c';
+import EdgeAgentAsyncIcon from '@/react/edge/components/edge-agent-async.svg?c';
+
+import { BoxSelectorOption } from '@@/BoxSelector/types';
+import { BoxSelector } from '@@/BoxSelector';
+import { BEOverlay } from '@@/BEFeatureIndicator/BEOverlay';
+import { FormSection } from '@@/form-components/FormSection';
+import { Badge } from '@@/Badge';
+import { ExternalLink } from '@@/ExternalLink';
+import { useDocsUrl } from '@@/PageHeader/ContextHelp';
+
+import { AnalyticsStateKey } from '../types';
+import { EdgeAgentTab } from '../shared/EdgeAgentTab';
+
+import { AgentPanel } from './AgentPanel';
+import { KubeConfigTeaserForm } from './KubeConfigTeaserForm';
+
+interface Props {
+  onCreate(environment: Environment, analytics: AnalyticsStateKey): void;
+}
+
+type CreationType =
+  | 'edgeAgentStandard'
+  | 'edgeAgentAsync'
+  | 'agent'
+  | 'kubeconfig';
+
+const primaryOptions: BoxSelectorOption<CreationType>[] = _.compact([
+  {
+    id: 'edgeAgentStandard',
+    icon: EdgeAgentStandardIcon,
+    iconType: 'badge',
+    label: 'Edge Agent Standard',
+    description: (
+      <>
+        <span>
+          <Badge type="infoSecondary">Recommended</Badge>{' '}
+          <Badge type="infoSecondary">Supports Policies</Badge>
+        </span>
+        <span className="mt-1 block">
+          The remote environment will initiate connections to the Portainer
+          server, with the ability to open a secure on-demand tunnel for
+          real-time interaction. The Portainer server must be accessible from
+          the Edge Agent environment.
+        </span>
+      </>
+    ),
+    value: 'edgeAgentStandard',
+  },
+  isBE && {
+    id: 'edgeAgentAsync',
+    icon: EdgeAgentAsyncIcon,
+    iconType: 'badge',
+    label: 'Edge Agent Async',
+    description:
+      'The remote environment will initiate connections to the Portainer server, without the ability to open a real-time tunnel. The Portainer server must be accessible from the Edge Agent environment.',
+    value: 'edgeAgentAsync',
+  },
+]);
+
+const legacyOptions: BoxSelectorOption<CreationType>[] = [
+  {
+    id: 'agent_endpoint',
+    icon: Zap,
+    iconType: 'badge',
+    label: 'Agent',
+    value: 'agent',
+    description:
+      'The Portainer Server will initiate connections to the remote environment. The agent on the remote environment must be accessible from the Portainer server environment.',
+  },
+  {
+    id: 'kubeconfig_endpoint',
+    icon: UploadCloud,
+    iconType: 'badge',
+    label: 'Import',
+    value: 'kubeconfig',
+    description: 'Import an existing Kubernetes config.',
+    feature: FeatureId.K8S_CREATE_FROM_KUBECONFIG,
+  },
+];
+
+export function WizardKubernetes({ onCreate }: Props) {
+  const edgeAgentDocsUrl = useDocsUrl(
+    '/faqs/getting-started/why-do-we-recommend-using-the-edge-agent-instead-of-the-traditional-agent'
+  );
+  const [creationType, setCreationType] = useState<CreationType>(
+    primaryOptions[0].value
+  );
+
+  const tab = getTab(creationType);
+
+  return (
+    <div className="form-horizontal">
+      <BoxSelector
+        onChange={(v) => setCreationType(v)}
+        options={primaryOptions}
+        value={creationType}
+        radioName="creation-type"
+        className="!-mb-2"
+      />
+
+      <FormSection
+        key="legacy-options"
+        title="More options"
+        titleSize="sm"
+        isFoldable
+        defaultFolded={false}
+        className="mb-8"
+      >
+        <p className="text-muted mb-2 text-xs">
+          These are legacy options that don&apos;t support edge features or
+          policy management. For most use cases,{' '}
+          <ExternalLink
+            to={edgeAgentDocsUrl}
+            data-cy="wizard-edge-agent-docs-link"
+          >
+            the Edge Agent is recommended
+          </ExternalLink>
+        </p>
+        <BoxSelector
+          onChange={(v) => setCreationType(v)}
+          options={legacyOptions}
+          value={creationType}
+          radioName="creation-type"
+        />
+      </FormSection>
+
+      {tab}
+    </div>
+  );
+
+  function getTab(type: CreationType) {
+    switch (type) {
+      case 'agent':
+        return (
+          <AgentPanel
+            onCreate={(environment) => onCreate(environment, 'kubernetesAgent')}
+          />
+        );
+      case 'edgeAgentStandard':
+        return (
+          <EdgeAgentTab
+            onCreate={(environment) =>
+              onCreate(environment, 'kubernetesEdgeAgentStandard')
+            }
+            commands={[{ ...commandsTabs.k8sLinux, label: 'Linux' }]}
+            containerEngine={ContainerEngine.Kubernetes}
+          />
+        );
+      case 'edgeAgentAsync':
+        return (
+          <EdgeAgentTab
+            asyncMode
+            onCreate={(environment) =>
+              onCreate(environment, 'kubernetesEdgeAgentAsync')
+            }
+            commands={[{ ...commandsTabs.k8sLinux, label: 'Linux' }]}
+            containerEngine={ContainerEngine.Kubernetes}
+          />
+        );
+      case 'kubeconfig':
+        return (
+          <div className="mb-3">
+            <BEOverlay featureId={FeatureId.K8S_CREATE_FROM_KUBECONFIG}>
+              <KubeConfigTeaserForm />
+            </BEOverlay>
+          </div>
+        );
+      default:
+        throw new Error('Creation type not supported');
+    }
+  }
+}
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardKubernetes/index.ts b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardKubernetes/index.ts
new file mode 100644
index 0000000..8c074cb
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardKubernetes/index.ts
@@ -0,0 +1 @@
+export { WizardKubernetes } from './WizardKubernetes';
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardPodman/AgentTab/AgentTab.tsx b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardPodman/AgentTab/AgentTab.tsx
new file mode 100644
index 0000000..6ccbfd1
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardPodman/AgentTab/AgentTab.tsx
@@ -0,0 +1,27 @@
+import {
+  ContainerEngine,
+  Environment,
+} from '@/react/portainer/environments/types';
+
+import { AgentForm } from '../../shared/AgentForm/AgentForm';
+
+import { DeploymentScripts } from './DeploymentScripts';
+
+interface Props {
+  onCreate(environment: Environment): void;
+}
+
+export function AgentTab({ onCreate }: Props) {
+  return (
+    <>
+      <DeploymentScripts />
+
+      <div className="mt-5">
+        <AgentForm
+          onCreate={onCreate}
+          containerEngine={ContainerEngine.Podman}
+        />
+      </div>
+    </>
+  );
+}
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardPodman/AgentTab/DeploymentScripts.tsx b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardPodman/AgentTab/DeploymentScripts.tsx
new file mode 100644
index 0000000..9c68686
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardPodman/AgentTab/DeploymentScripts.tsx
@@ -0,0 +1,87 @@
+import { useState } from 'react';
+
+import { useAgentDetails } from '@/react/portainer/environments/queries/useAgentDetails';
+
+import { CopyButton } from '@@/buttons/CopyButton';
+import { Code } from '@@/Code';
+import { NavTabs } from '@@/NavTabs';
+import { NavContainer } from '@@/NavTabs/NavContainer';
+
+const deploymentPodman = [
+  {
+    id: 'all',
+    label: 'Linux (CentOS)',
+    command: linuxPodmanCommandRootful,
+  },
+];
+
+export function DeploymentScripts() {
+  const deployments = deploymentPodman;
+  const [deployType, setDeployType] = useState(deployments[0].id);
+
+  const agentDetailsQuery = useAgentDetails();
+
+  if (!agentDetailsQuery) {
+    return null;
+  }
+
+  const { agentVersion, agentSecret } = agentDetailsQuery;
+
+  const options = deployments.map((c) => {
+    const code = c.command(agentVersion, agentSecret);
+
+    return {
+      id: c.id,
+      label: c.label,
+      children: <DeployCode code={code} />,
+    };
+  });
+
+  return (
+    <NavContainer>
+      <NavTabs
+        options={options}
+        onSelect={(id: string) => setDeployType(id)}
+        selectedId={deployType}
+      />
+    </NavContainer>
+  );
+}
+
+interface DeployCodeProps {
+  code: string;
+}
+
+function DeployCode({ code }: DeployCodeProps) {
+  return (
+    <>
+      <div className="code-script">
+        <Code>{code}</Code>
+      </div>
+      <div className="mt-2">
+        <CopyButton copyText={code} data-cy="copy-deployment-script">
+          Copy command
+        </CopyButton>
+      </div>
+    </>
+  );
+}
+
+function linuxPodmanCommandRootful(agentVersion: string, agentSecret: string) {
+  const secret =
+    agentSecret === '' ? '' : `\\\n  -e AGENT_SECRET=${agentSecret} `;
+
+  return `sudo systemctl enable --now podman.socket\n
+sudo podman volume create portainer\n
+sudo podman run -d \\
+-p 9001:9001 ${secret}\\
+-e PODMAN=1 \\
+--name portainer_agent \\
+--restart=always \\
+--privileged \\
+-v /run/podman/podman.sock:/var/run/docker.sock \\
+-v /var/lib/containers/storage/volumes:/var/lib/docker/volumes \\
+-v /:/host \\
+portainer/agent:${agentVersion}
+`;
+}
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardPodman/AgentTab/index.ts b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardPodman/AgentTab/index.ts
new file mode 100644
index 0000000..fb72ea6
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardPodman/AgentTab/index.ts
@@ -0,0 +1 @@
+export { AgentTab } from './AgentTab';
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardPodman/SocketTab/DeploymentScripts.tsx b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardPodman/SocketTab/DeploymentScripts.tsx
new file mode 100644
index 0000000..14b47a5
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardPodman/SocketTab/DeploymentScripts.tsx
@@ -0,0 +1,68 @@
+import { useState } from 'react';
+
+import { CopyButton } from '@@/buttons/CopyButton';
+import { Code } from '@@/Code';
+import { NavTabs } from '@@/NavTabs';
+import { NavContainer } from '@@/NavTabs/NavContainer';
+import { TextTip } from '@@/Tip/TextTip';
+
+const deployments = [
+  {
+    id: 'linux',
+    label: 'Linux (CentOS)',
+    command: `sudo systemctl enable --now podman.socket`,
+  },
+];
+
+export function DeploymentScripts() {
+  const [deployType, setDeployType] = useState(deployments[0].id);
+
+  const options = deployments.map((c) => ({
+    id: c.id,
+    label: c.label,
+    children: <DeployCode code={c.command} />,
+  }));
+
+  return (
+    <NavContainer>
+      <NavTabs
+        options={options}
+        onSelect={(id: string) => setDeployType(id)}
+        selectedId={deployType}
+      />
+    </NavContainer>
+  );
+}
+
+interface DeployCodeProps {
+  code: string;
+}
+
+function DeployCode({ code }: DeployCodeProps) {
+  const bindMountCode = `-v "/run/podman/podman.sock:/var/run/docker.sock"`;
+  return (
+    <>
+      <TextTip color="blue" className="mb-1">
+        When using the socket, ensure that you have started the Portainer
+        container with the following Podman flag:
+      </TextTip>
+      <Code>{bindMountCode}</Code>
+      <div className="mb-4 mt-2">
+        <CopyButton copyText={bindMountCode} data-cy="copy-deployment-command">
+          Copy command
+        </CopyButton>
+      </div>
+
+      <TextTip color="blue" className="mb-1">
+        To use the socket, ensure that you have started the Podman rootful
+        socket:
+      </TextTip>
+      <Code>{code}</Code>
+      <div className="mt-2">
+        <CopyButton copyText={code} data-cy="copy-deployment-command">
+          Copy command
+        </CopyButton>
+      </div>
+    </>
+  );
+}
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardPodman/SocketTab/SocketForm.tsx b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardPodman/SocketTab/SocketForm.tsx
new file mode 100644
index 0000000..a1d0036
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardPodman/SocketTab/SocketForm.tsx
@@ -0,0 +1,125 @@
+import { Field, Form, Formik, useFormikContext } from 'formik';
+import { useReducer } from 'react';
+import { Plug2 } from 'lucide-react';
+
+import { notifySuccess } from '@/portainer/services/notifications';
+import { useCreateLocalDockerEnvironmentMutation } from '@/react/portainer/environments/queries/useCreateEnvironmentMutation';
+import {
+  ContainerEngine,
+  Environment,
+} from '@/react/portainer/environments/types';
+import { NameField } from '@/react/portainer/environments/common/NameField/NameField';
+
+import { LoadingButton } from '@@/buttons/LoadingButton';
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+import { SwitchField } from '@@/form-components/SwitchField';
+
+import { MoreSettingsSection } from '../../shared/MoreSettingsSection';
+
+import { useValidation } from './SocketForm.validation';
+import { FormValues } from './types';
+
+interface Props {
+  onCreate(environment: Environment): void;
+  containerEngine: ContainerEngine;
+}
+
+export function SocketForm({ onCreate, containerEngine }: Props) {
+  const [formKey, clearForm] = useReducer((state) => state + 1, 0);
+  const initialValues: FormValues = {
+    name: '',
+    socketPath: '',
+    overridePath: false,
+    meta: { groupId: 1, tagIds: [] },
+  };
+
+  const mutation = useCreateLocalDockerEnvironmentMutation();
+  const validation = useValidation();
+
+  return (
+    <Formik
+      initialValues={initialValues}
+      onSubmit={handleSubmit}
+      validationSchema={validation}
+      validateOnMount
+      key={formKey}
+    >
+      {({ isValid, dirty }) => (
+        <Form>
+          <NameField />
+
+          <OverrideSocketFieldset />
+
+          <MoreSettingsSection />
+
+          <div className="form-group">
+            <div className="col-sm-12">
+              <LoadingButton
+                className="wizard-connect-button vertical-center"
+                data-cy="docker-socket-connect-button"
+                loadingText="Connecting environment..."
+                isLoading={mutation.isLoading}
+                disabled={!dirty || !isValid}
+                icon={Plug2}
+              >
+                Connect
+              </LoadingButton>
+            </div>
+          </div>
+        </Form>
+      )}
+    </Formik>
+  );
+
+  function handleSubmit(values: FormValues) {
+    mutation.mutate(
+      {
+        name: values.name,
+        socketPath: values.overridePath ? values.socketPath : '',
+        meta: values.meta,
+        containerEngine,
+      },
+      {
+        onSuccess(environment) {
+          notifySuccess('Environment created', environment.Name);
+          clearForm();
+          onCreate(environment);
+        },
+      }
+    );
+  }
+}
+
+function OverrideSocketFieldset() {
+  const { values, setFieldValue, errors } = useFormikContext<FormValues>();
+
+  return (
+    <>
+      <div className="form-group">
+        <div className="col-sm-12">
+          <SwitchField
+            checked={values.overridePath}
+            data-cy="create-docker-env-socket-override-switch"
+            onChange={(checked) => setFieldValue('overridePath', checked)}
+            label="Override default socket path"
+            labelClass="col-sm-3 col-lg-2"
+          />
+        </div>
+      </div>
+      {values.overridePath && (
+        <FormControl
+          label="Socket Path"
+          tooltip="Path to the Podman socket. Remember to bind-mount the socket, see the important notice above for more information."
+          errors={errors.socketPath}
+        >
+          <Field
+            name="socketPath"
+            as={Input}
+            placeholder="e.g. /run/podman/podman.sock (on Linux)"
+          />
+        </FormControl>
+      )}
+    </>
+  );
+}
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardPodman/SocketTab/SocketForm.validation.tsx b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardPodman/SocketTab/SocketForm.validation.tsx
new file mode 100644
index 0000000..841fbe2
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardPodman/SocketTab/SocketForm.validation.tsx
@@ -0,0 +1,23 @@
+import { boolean, object, SchemaOf, string } from 'yup';
+
+import { useNameValidation } from '@/react/portainer/environments/common/NameField/NameField';
+import { metadataValidation } from '@/react/portainer/environments/common/MetadataFieldset/validation';
+
+import { FormValues } from './types';
+
+export function useValidation(): SchemaOf<FormValues> {
+  return object({
+    name: useNameValidation(),
+    meta: metadataValidation(),
+    overridePath: boolean().default(false),
+    socketPath: string()
+      .default('')
+      .when('overridePath', (overridePath, schema) =>
+        overridePath
+          ? schema.required(
+              'Socket Path is required when override path is enabled'
+            )
+          : schema
+      ),
+  });
+}
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardPodman/SocketTab/SocketTab.tsx b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardPodman/SocketTab/SocketTab.tsx
new file mode 100644
index 0000000..fb6ef3d
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardPodman/SocketTab/SocketTab.tsx
@@ -0,0 +1,33 @@
+import {
+  ContainerEngine,
+  Environment,
+} from '@/react/portainer/environments/types';
+
+import { TextTip } from '@@/Tip/TextTip';
+
+import { DeploymentScripts } from './DeploymentScripts';
+import { SocketForm } from './SocketForm';
+
+interface Props {
+  onCreate(environment: Environment): void;
+}
+
+export function SocketTab({ onCreate }: Props) {
+  return (
+    <>
+      <TextTip color="orange" className="mb-2" inline={false}>
+        To connect via socket, Portainer server must be running in a Podman
+        container.
+      </TextTip>
+
+      <DeploymentScripts />
+
+      <div className="mt-5">
+        <SocketForm
+          onCreate={onCreate}
+          containerEngine={ContainerEngine.Podman}
+        />
+      </div>
+    </>
+  );
+}
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardPodman/SocketTab/index.ts b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardPodman/SocketTab/index.ts
new file mode 100644
index 0000000..96425ea
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardPodman/SocketTab/index.ts
@@ -0,0 +1 @@
+export { SocketTab } from './SocketTab';
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardPodman/SocketTab/types.ts b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardPodman/SocketTab/types.ts
new file mode 100644
index 0000000..9bc7fda
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardPodman/SocketTab/types.ts
@@ -0,0 +1,8 @@
+import { EnvironmentMetadata } from '@/react/portainer/environments/environment.service/create';
+
+export interface FormValues {
+  name: string;
+  socketPath: string;
+  overridePath: boolean;
+  meta: EnvironmentMetadata;
+}
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardPodman/WizardPodman.tsx b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardPodman/WizardPodman.tsx
new file mode 100644
index 0000000..d92dd89
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardPodman/WizardPodman.tsx
@@ -0,0 +1,181 @@
+import { useState } from 'react';
+import { Zap, Plug2 } from 'lucide-react';
+import _ from 'lodash';
+
+import {
+  ContainerEngine,
+  Environment,
+} from '@/react/portainer/environments/types';
+import { commandsTabs } from '@/react/edge/components/EdgeScriptForm/scripts';
+import { isBE } from '@/react/portainer/feature-flags/feature-flags.service';
+import EdgeAgentStandardIcon from '@/react/edge/components/edge-agent-standard.svg?c';
+import EdgeAgentAsyncIcon from '@/react/edge/components/edge-agent-async.svg?c';
+
+import { BoxSelector, type BoxSelectorOption } from '@@/BoxSelector';
+import { BadgeIcon } from '@@/BadgeIcon';
+import { TextTip } from '@@/Tip/TextTip';
+import { FormSection } from '@@/form-components/FormSection';
+import { Badge } from '@@/Badge';
+import { ExternalLink } from '@@/ExternalLink';
+import { useDocsUrl } from '@@/PageHeader/ContextHelp';
+
+import { AnalyticsStateKey } from '../types';
+import { EdgeAgentTab } from '../shared/EdgeAgentTab';
+
+import { AgentTab } from './AgentTab';
+import { SocketTab } from './SocketTab';
+
+interface Props {
+  onCreate(environment: Environment, analytics: AnalyticsStateKey): void;
+}
+
+type CreationType = 'agent' | 'socket' | 'edgeAgentStandard' | 'edgeAgentAsync';
+
+const primaryOptions: BoxSelectorOption<CreationType>[] = _.compact([
+  {
+    id: 'edgeAgentStandard',
+    icon: <BadgeIcon icon={EdgeAgentStandardIcon} size="3xl" />,
+    label: 'Edge Agent Standard',
+    description: (
+      <>
+        <span>
+          <Badge type="infoSecondary">Recommended</Badge>{' '}
+          <Badge type="infoSecondary">Supports Policies</Badge>
+        </span>
+        <span className="mt-1 block">
+          The remote environment will initiate connections to the Portainer
+          server, with the ability to open a secure on-demand tunnel for
+          real-time interaction. The Portainer server must be accessible from
+          the Edge Agent environment.
+        </span>
+      </>
+    ),
+    value: 'edgeAgentStandard',
+  },
+  isBE && {
+    id: 'edgeAgentAsync',
+    icon: <BadgeIcon icon={EdgeAgentAsyncIcon} size="3xl" />,
+    label: 'Edge Agent Async',
+    description:
+      'The remote environment will initiate connections to the Portainer server, without the ability to open a real-time tunnel. The Portainer server must be accessible from the Edge Agent environment.',
+    value: 'edgeAgentAsync',
+  },
+]);
+
+const legacyOptions: BoxSelectorOption<CreationType>[] = [
+  {
+    id: 'agent',
+    icon: <BadgeIcon icon={Zap} size="3xl" />,
+    label: 'Agent',
+    description:
+      'The Portainer Server will initiate connections to the remote environment. The agent on the remote environment must be accessible from the Portainer server environment.',
+    value: 'agent',
+  },
+  {
+    id: 'socket',
+    icon: <BadgeIcon icon={Plug2} size="3xl" />,
+    label: 'Socket',
+    description: 'Connect to the environment directly via the Docker socket.',
+    value: 'socket',
+  },
+];
+
+const containerEngine = ContainerEngine.Podman;
+
+export function WizardPodman({ onCreate }: Props) {
+  const edgeAgentDocsUrl = useDocsUrl(
+    '/faqs/getting-started/why-do-we-recommend-using-the-edge-agent-instead-of-the-traditional-agent'
+  );
+  const [creationType, setCreationType] = useState<CreationType>(
+    primaryOptions[0].value
+  );
+
+  const tab = getTab(creationType);
+
+  return (
+    <div className="form-horizontal">
+      <BoxSelector
+        onChange={(v) => setCreationType(v)}
+        options={primaryOptions}
+        value={creationType}
+        radioName="creation-type"
+        className="!-mb-2"
+      />
+
+      <FormSection
+        key="legacy-options"
+        title="More options"
+        titleSize="sm"
+        isFoldable
+        defaultFolded={false}
+        className="mb-8"
+      >
+        <p className="text-muted mb-2 text-xs">
+          These are legacy options that don&apos;t support edge features or
+          policy management. For most use cases,{' '}
+          <ExternalLink
+            to={edgeAgentDocsUrl}
+            data-cy="wizard-edge-agent-docs-link"
+          >
+            the Edge Agent is recommended
+          </ExternalLink>
+        </p>
+        <BoxSelector
+          onChange={(v) => setCreationType(v)}
+          options={legacyOptions}
+          value={creationType}
+          radioName="creation-type"
+        />
+      </FormSection>
+
+      <TextTip color="orange" className="mb-2" inline={false}>
+        Currently, Portainer only supports <b>Podman 5</b> running in rootful
+        (privileged) mode on <b>CentOS 9</b> Linux environments. Rootless mode
+        and other Linux distros may work, but aren&apos;t officially supported.
+      </TextTip>
+      {tab}
+    </div>
+  );
+
+  function getTab(creationType: CreationType) {
+    switch (creationType) {
+      case 'agent':
+        return (
+          <AgentTab
+            onCreate={(environment) => onCreate(environment, 'podmanAgent')}
+          />
+        );
+      case 'socket':
+        return (
+          <SocketTab
+            onCreate={(environment) =>
+              onCreate(environment, 'podmanLocalEnvironment')
+            }
+          />
+        );
+      case 'edgeAgentStandard':
+        return (
+          <EdgeAgentTab
+            onCreate={(environment) =>
+              onCreate(environment, 'podmanEdgeAgentStandard')
+            }
+            commands={[commandsTabs.podmanLinux]}
+            containerEngine={containerEngine}
+          />
+        );
+      case 'edgeAgentAsync':
+        return (
+          <EdgeAgentTab
+            asyncMode
+            onCreate={(environment) =>
+              onCreate(environment, 'podmanEdgeAgentAsync')
+            }
+            commands={[commandsTabs.podmanLinux]}
+            containerEngine={containerEngine}
+          />
+        );
+      default:
+        return null;
+    }
+  }
+}
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardPodman/index.ts b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardPodman/index.ts
new file mode 100644
index 0000000..5042118
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/WizardPodman/index.ts
@@ -0,0 +1 @@
+export { WizardPodman } from './WizardPodman';
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/index.ts b/app/react/portainer/environments/wizard/EnvironmentsCreationView/index.ts
new file mode 100644
index 0000000..ffd6f4d
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/index.ts
@@ -0,0 +1 @@
+export { EnvironmentCreationView } from './EnvironmentsCreationView';
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/shared/AgentForm/AgentForm.tsx b/app/react/portainer/environments/wizard/EnvironmentsCreationView/shared/AgentForm/AgentForm.tsx
new file mode 100644
index 0000000..bc11a1e
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/shared/AgentForm/AgentForm.tsx
@@ -0,0 +1,92 @@
+import { Form, Formik } from 'formik';
+import { useReducer } from 'react';
+import { Plug2 } from 'lucide-react';
+
+import { useCreateAgentEnvironmentMutation } from '@/react/portainer/environments/queries/useCreateEnvironmentMutation';
+import { notifySuccess } from '@/portainer/services/notifications';
+import {
+  ContainerEngine,
+  Environment,
+} from '@/react/portainer/environments/types';
+import { CreateAgentEnvironmentValues } from '@/react/portainer/environments/environment.service/create';
+import { NameField } from '@/react/portainer/environments/common/NameField/NameField';
+import { EnvironmentUrlField } from '@/react/portainer/environments/common/EnvironmentUrlField/EnvironmentUrlField';
+
+import { LoadingButton } from '@@/buttons/LoadingButton';
+
+import { MoreSettingsSection } from '../MoreSettingsSection';
+
+import { useValidation } from './AgentForm.validation';
+
+interface Props {
+  onCreate(environment: Environment): void;
+  envDefaultPort?: string;
+  containerEngine?: ContainerEngine;
+}
+
+const initialValues: CreateAgentEnvironmentValues = {
+  environmentUrl: '',
+  name: '',
+  meta: {
+    groupId: 1,
+    tagIds: [],
+  },
+};
+
+export function AgentForm({
+  onCreate,
+  envDefaultPort,
+  containerEngine = ContainerEngine.Docker,
+}: Props) {
+  const [formKey, clearForm] = useReducer((state) => state + 1, 0);
+
+  const mutation = useCreateAgentEnvironmentMutation();
+  const validation = useValidation();
+
+  return (
+    <Formik
+      initialValues={initialValues}
+      onSubmit={handleSubmit}
+      validationSchema={validation}
+      validateOnMount
+      key={formKey}
+    >
+      {({ isValid, dirty }) => (
+        <Form>
+          <NameField />
+          <EnvironmentUrlField placeholderPort={envDefaultPort} />
+
+          <MoreSettingsSection />
+
+          <div className="form-group">
+            <div className="col-sm-12">
+              <LoadingButton
+                className="wizard-connect-button vertical-center"
+                data-cy="agent-connect-environment-button"
+                loadingText="Connecting environment..."
+                isLoading={mutation.isLoading}
+                disabled={!dirty || !isValid}
+                icon={Plug2}
+              >
+                Connect
+              </LoadingButton>
+            </div>
+          </div>
+        </Form>
+      )}
+    </Formik>
+  );
+
+  function handleSubmit(values: CreateAgentEnvironmentValues) {
+    mutation.mutate(
+      { ...values, containerEngine },
+      {
+        onSuccess(environment) {
+          notifySuccess('Environment created', environment.Name);
+          clearForm();
+          onCreate(environment);
+        },
+      }
+    );
+  }
+}
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/shared/AgentForm/AgentForm.validation.tsx b/app/react/portainer/environments/wizard/EnvironmentsCreationView/shared/AgentForm/AgentForm.validation.tsx
new file mode 100644
index 0000000..d39d9cc
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/shared/AgentForm/AgentForm.validation.tsx
@@ -0,0 +1,48 @@
+import { mixed, object, SchemaOf, string } from 'yup';
+
+import { CreateAgentEnvironmentValues } from '@/react/portainer/environments/environment.service/create';
+import { useNameValidation } from '@/react/portainer/environments/common/NameField/NameField';
+import { metadataValidation } from '@/react/portainer/environments/common/MetadataFieldset/validation';
+
+export function useValidation(): SchemaOf<CreateAgentEnvironmentValues> {
+  return object({
+    name: useNameValidation(),
+    environmentUrl: environmentValidation(),
+    meta: metadataValidation(),
+    containerEngine: mixed().oneOf(['docker', 'podman']),
+  });
+}
+
+function environmentValidation() {
+  return string()
+    .required('This field is required')
+    .test(
+      'address',
+      'Environment address must be of the form <IP>:<PORT> or <HOST>:<PORT>.',
+      (environmentUrl) => validateAddress(environmentUrl)
+    );
+}
+
+export function validateAddress(address: string | undefined) {
+  if (typeof address === 'undefined') {
+    return false;
+  }
+
+  if (address.indexOf('://') > -1) {
+    return false;
+  }
+
+  const [host, port] = address.split(':');
+
+  if (
+    host.length === 0 ||
+    Number.isNaN(parseInt(port, 10)) ||
+    port.match(/^[0-9]+$/) == null ||
+    parseInt(port, 10) < 1 ||
+    parseInt(port, 10) > 65535
+  ) {
+    return false;
+  }
+
+  return true;
+}
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/shared/AgentForm/index.tsx b/app/react/portainer/environments/wizard/EnvironmentsCreationView/shared/AgentForm/index.tsx
new file mode 100644
index 0000000..f8e987b
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/shared/AgentForm/index.tsx
@@ -0,0 +1 @@
+export { AgentForm } from './AgentForm';
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/shared/EdgeAgentTab/EdgeAgentForm/EdgeAgentFieldset.tsx b/app/react/portainer/environments/wizard/EnvironmentsCreationView/shared/EdgeAgentTab/EdgeAgentForm/EdgeAgentFieldset.tsx
new file mode 100644
index 0000000..371f094
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/shared/EdgeAgentTab/EdgeAgentForm/EdgeAgentFieldset.tsx
@@ -0,0 +1,92 @@
+import { useState } from 'react';
+import { useFormikContext } from 'formik';
+import { Network } from 'lucide-react';
+
+import { isBE } from '@/react/portainer/feature-flags/feature-flags.service';
+import { PortainerTunnelAddrField } from '@/react/portainer/common/PortainerTunnelAddrField';
+import { PortainerUrlField } from '@/react/portainer/common/PortainerUrlField';
+import { NameField } from '@/react/portainer/environments/common/NameField/NameField';
+import { ContainerEngine } from '@/react/portainer/environments/types';
+import {
+  ConnectivityEnvironment,
+  ConnectivityTestModal,
+} from '@/react/edge/components/ConnectivityTestModal/ConnectivityTestModal';
+
+import { Button } from '@@/buttons';
+
+import { FormValues } from './types';
+
+interface EdgeAgentFormProps {
+  readonly?: boolean;
+  asyncMode?: boolean;
+  containerEngine?: ContainerEngine;
+}
+
+export function EdgeAgentFieldset({
+  readonly,
+  asyncMode,
+  containerEngine = ContainerEngine.Docker,
+}: EdgeAgentFormProps) {
+  const [isModalOpen, setIsModalOpen] = useState(false);
+  const { values } = useFormikContext<FormValues>();
+
+  const showTunnelField = isBE && !asyncMode;
+  const environment = toConnectivityEnvironment(containerEngine);
+
+  return (
+    <>
+      <NameField readonly={readonly} />
+      <PortainerUrlField
+        fieldName="portainerUrl"
+        readonly={readonly}
+        required
+      />
+      {showTunnelField && (
+        <PortainerTunnelAddrField
+          fieldName="tunnelServerAddr"
+          readonly={readonly}
+          required
+        />
+      )}
+
+      <div className="form-group">
+        <div className="col-sm-12">
+          <Button
+            color="default"
+            className="!ml-0"
+            icon={Network}
+            onClick={() => setIsModalOpen(true)}
+            data-cy="edge-agent-test-connectivity-button"
+          >
+            Test connectivity
+          </Button>
+        </div>
+      </div>
+
+      {isModalOpen && (
+        <ConnectivityTestModal
+          portainerUrl={values.portainerUrl}
+          tunnelServerAddr={
+            showTunnelField ? values.tunnelServerAddr : undefined
+          }
+          environment={environment}
+          onDismiss={() => setIsModalOpen(false)}
+        />
+      )}
+    </>
+  );
+}
+
+function toConnectivityEnvironment(
+  containerEngine: ContainerEngine
+): ConnectivityEnvironment {
+  switch (containerEngine) {
+    case ContainerEngine.Kubernetes:
+      return 'kubernetes';
+    case ContainerEngine.Podman:
+      return 'podman';
+    case ContainerEngine.Docker:
+    default:
+      return 'docker';
+  }
+}
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/shared/EdgeAgentTab/EdgeAgentForm/EdgeAgentForm.tsx b/app/react/portainer/environments/wizard/EnvironmentsCreationView/shared/EdgeAgentTab/EdgeAgentForm/EdgeAgentForm.tsx
new file mode 100644
index 0000000..b5fb95b
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/shared/EdgeAgentTab/EdgeAgentForm/EdgeAgentForm.tsx
@@ -0,0 +1,144 @@
+import { Formik, Form } from 'formik';
+import { Plug2 } from 'lucide-react';
+
+import {
+  ContainerEngine,
+  Environment,
+} from '@/react/portainer/environments/types';
+import { useCreateEdgeAgentEnvironmentMutation } from '@/react/portainer/environments/queries/useCreateEnvironmentMutation';
+import { Settings } from '@/react/portainer/settings/types';
+import { EdgeCheckinIntervalField } from '@/react/edge/components/EdgeCheckInIntervalField';
+import {
+  EdgeAsyncIntervalsForm,
+  EDGE_ASYNC_INTERVAL_USE_DEFAULT,
+} from '@/react/edge/components/EdgeAsyncIntervalsForm';
+import { useSettings } from '@/react/portainer/settings/queries';
+import { buildDefaultValue as buildTunnelDefaultValue } from '@/react/portainer/common/PortainerTunnelAddrField';
+import { buildDefaultValue as buildApiUrlDefaultValue } from '@/react/portainer/common/PortainerUrlField';
+
+import { FormSection } from '@@/form-components/FormSection';
+import { LoadingButton } from '@@/buttons/LoadingButton';
+
+import { MoreSettingsSection } from '../../MoreSettingsSection';
+
+import { EdgeAgentFieldset } from './EdgeAgentFieldset';
+import { useValidationSchema } from './EdgeAgentForm.validation';
+import { FormValues } from './types';
+
+interface Props {
+  onCreate(environment: Environment): void;
+  readonly: boolean;
+  asyncMode: boolean;
+  containerEngine: ContainerEngine;
+}
+
+export function EdgeAgentForm({
+  onCreate,
+  readonly,
+  asyncMode,
+  containerEngine,
+}: Props) {
+  const settingsQuery = useSettings();
+
+  const createMutation = useCreateEdgeAgentEnvironmentMutation();
+  const validation = useValidationSchema();
+
+  if (!settingsQuery.data) {
+    return null;
+  }
+
+  const settings = settingsQuery.data;
+
+  const initialValues = buildInitialValues(settings);
+
+  return (
+    <Formik<FormValues>
+      initialValues={initialValues}
+      onSubmit={handleSubmit}
+      validateOnMount
+      validationSchema={validation}
+    >
+      {({ isValid, setFieldValue, values }) => (
+        <Form>
+          <EdgeAgentFieldset
+            readonly={readonly}
+            asyncMode={asyncMode}
+            containerEngine={containerEngine}
+          />
+
+          <MoreSettingsSection>
+            <FormSection title="Check-in Intervals">
+              {asyncMode ? (
+                <EdgeAsyncIntervalsForm
+                  values={values.edge}
+                  readonly={readonly}
+                  onChange={(values) => setFieldValue('edge', values)}
+                />
+              ) : (
+                <EdgeCheckinIntervalField
+                  readonly={readonly}
+                  onChange={(value) => setFieldValue('pollFrequency', value)}
+                  value={values.pollFrequency}
+                />
+              )}
+            </FormSection>
+          </MoreSettingsSection>
+
+          {!readonly && (
+            <div className="row">
+              <div className="col-sm-12">
+                <LoadingButton
+                  className="vertical-center"
+                  data-cy="edge-agent-form-submit-button"
+                  isLoading={createMutation.isLoading}
+                  loadingText="Creating environment..."
+                  disabled={!isValid}
+                  icon={Plug2}
+                >
+                  Create
+                </LoadingButton>
+              </div>
+            </div>
+          )}
+        </Form>
+      )}
+    </Formik>
+  );
+
+  function handleSubmit(values: typeof initialValues) {
+    createMutation.mutate(
+      {
+        ...values,
+        edge: {
+          ...values.edge,
+          asyncMode,
+        },
+        containerEngine,
+      },
+      {
+        onSuccess(environment) {
+          onCreate(environment);
+        },
+      }
+    );
+  }
+}
+
+export function buildInitialValues(settings: Settings): FormValues {
+  return {
+    name: '',
+    portainerUrl: settings.EdgePortainerUrl || buildApiUrlDefaultValue(),
+    tunnelServerAddr:
+      settings.Edge.TunnelServerAddress || buildTunnelDefaultValue(),
+    pollFrequency: 0,
+    meta: {
+      groupId: 1,
+      tagIds: [],
+    },
+    edge: {
+      CommandInterval: EDGE_ASYNC_INTERVAL_USE_DEFAULT,
+      PingInterval: EDGE_ASYNC_INTERVAL_USE_DEFAULT,
+      SnapshotInterval: EDGE_ASYNC_INTERVAL_USE_DEFAULT,
+    },
+  };
+}
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/shared/EdgeAgentTab/EdgeAgentForm/EdgeAgentForm.validation.ts b/app/react/portainer/environments/wizard/EnvironmentsCreationView/shared/EdgeAgentTab/EdgeAgentForm/EdgeAgentForm.validation.ts
new file mode 100644
index 0000000..a67b103
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/shared/EdgeAgentTab/EdgeAgentForm/EdgeAgentForm.validation.ts
@@ -0,0 +1,27 @@
+import { number, object, SchemaOf, string } from 'yup';
+
+import {
+  edgeAsyncIntervalsValidation,
+  EdgeAsyncIntervalsValues,
+} from '@/react/edge/components/EdgeAsyncIntervalsForm';
+import { validation as urlValidation } from '@/react/portainer/common/PortainerTunnelAddrField';
+import { isBE } from '@/react/portainer/feature-flags/feature-flags.service';
+import { useNameValidation } from '@/react/portainer/environments/common/NameField/NameField';
+import { metadataValidation } from '@/react/portainer/environments/common/MetadataFieldset/validation';
+
+import { FormValues } from './types';
+
+export function useValidationSchema(): SchemaOf<FormValues> {
+  const nameValidation = useNameValidation();
+
+  return object().shape({
+    name: nameValidation,
+    portainerUrl: urlValidation(),
+    tunnelServerAddr: string(),
+    pollFrequency: number().required(),
+    meta: metadataValidation(),
+    edge: isBE
+      ? edgeAsyncIntervalsValidation()
+      : (null as unknown as SchemaOf<EdgeAsyncIntervalsValues>),
+  });
+}
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/shared/EdgeAgentTab/EdgeAgentForm/index.tsx b/app/react/portainer/environments/wizard/EnvironmentsCreationView/shared/EdgeAgentTab/EdgeAgentForm/index.tsx
new file mode 100644
index 0000000..7e8af34
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/shared/EdgeAgentTab/EdgeAgentForm/index.tsx
@@ -0,0 +1 @@
+export { EdgeAgentForm } from './EdgeAgentForm';
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/shared/EdgeAgentTab/EdgeAgentForm/types.ts b/app/react/portainer/environments/wizard/EnvironmentsCreationView/shared/EdgeAgentTab/EdgeAgentForm/types.ts
new file mode 100644
index 0000000..ddbdbb7
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/shared/EdgeAgentTab/EdgeAgentForm/types.ts
@@ -0,0 +1,13 @@
+import { EdgeAsyncIntervalsValues } from '@/react/edge/components/EdgeAsyncIntervalsForm';
+import { EnvironmentMetadata } from '@/react/portainer/environments/environment.service/create';
+
+export interface FormValues {
+  name: string;
+
+  portainerUrl: string;
+  tunnelServerAddr?: string;
+  pollFrequency: number;
+  meta: EnvironmentMetadata;
+
+  edge: EdgeAsyncIntervalsValues;
+}
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/shared/EdgeAgentTab/EdgeAgentTab.tsx b/app/react/portainer/environments/wizard/EnvironmentsCreationView/shared/EdgeAgentTab/EdgeAgentTab.tsx
new file mode 100644
index 0000000..c1cbbfa
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/shared/EdgeAgentTab/EdgeAgentTab.tsx
@@ -0,0 +1,87 @@
+import { v4 as uuid } from 'uuid';
+import { useReducer, useState } from 'react';
+
+import {
+  ContainerEngine,
+  Environment,
+} from '@/react/portainer/environments/types';
+import { EdgeScriptForm } from '@/react/edge/components/EdgeScriptForm';
+import { CommandTab } from '@/react/edge/components/EdgeScriptForm/scripts';
+import { OS, EdgeInfo } from '@/react/edge/components/EdgeScriptForm/types';
+import { EdgeKeyDisplay } from '@/react/portainer/environments/ItemView/EdgeKeyDisplay';
+
+import { Button } from '@@/buttons';
+
+import { EdgeAgentForm } from './EdgeAgentForm';
+
+interface Props {
+  onCreate: (environment: Environment) => void;
+  commands: CommandTab[] | Partial<Record<OS, CommandTab[]>>;
+  asyncMode?: boolean;
+  containerEngine?: ContainerEngine;
+}
+
+export function EdgeAgentTab({
+  onCreate,
+  commands,
+  asyncMode = false,
+  containerEngine = ContainerEngine.Docker,
+}: Props) {
+  const [edgeInfo, setEdgeInfo] = useState<EdgeInfo>();
+  const [formKey, clearForm] = useReducer((state) => state + 1, 0);
+
+  return (
+    <>
+      <EdgeAgentForm
+        onCreate={handleCreate}
+        readonly={!!edgeInfo}
+        key={formKey}
+        asyncMode={asyncMode}
+        containerEngine={containerEngine}
+      />
+
+      {edgeInfo && (
+        <>
+          <div className="clear-both" />
+
+          <hr />
+
+          <EdgeKeyDisplay edgeKey={edgeInfo.key} />
+
+          <hr />
+
+          <EdgeScriptForm
+            edgeInfo={edgeInfo}
+            commands={commands}
+            asyncMode={asyncMode}
+          />
+
+          <hr />
+
+          <div className="row">
+            <div className="flex justify-end">
+              <Button
+                color="primary"
+                type="reset"
+                onClick={handleReset}
+                data-cy="edge-agent-tab-add-environment-button"
+              >
+                Add another environment
+              </Button>
+            </div>
+          </div>
+        </>
+      )}
+    </>
+  );
+
+  function handleCreate(environment: Environment) {
+    setEdgeInfo({ key: environment.EdgeKey, id: environment.EdgeID || uuid() });
+    onCreate(environment);
+  }
+
+  function handleReset() {
+    setEdgeInfo(undefined);
+    clearForm();
+  }
+}
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/shared/EdgeAgentTab/index.ts b/app/react/portainer/environments/wizard/EnvironmentsCreationView/shared/EdgeAgentTab/index.ts
new file mode 100644
index 0000000..38f4550
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/shared/EdgeAgentTab/index.ts
@@ -0,0 +1 @@
+export { EdgeAgentTab } from './EdgeAgentTab';
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/shared/MoreSettingsSection.tsx b/app/react/portainer/environments/wizard/EnvironmentsCreationView/shared/MoreSettingsSection.tsx
new file mode 100644
index 0000000..b1fac05
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/shared/MoreSettingsSection.tsx
@@ -0,0 +1,17 @@
+import { PropsWithChildren } from 'react';
+
+import { MetadataFieldset } from '@/react/portainer/environments/common/MetadataFieldset/MetadataFieldset';
+
+import { FormSection } from '@@/form-components/FormSection';
+
+export function MoreSettingsSection({ children }: PropsWithChildren<unknown>) {
+  return (
+    <FormSection title="More settings" className="ml-0" isFoldable>
+      <div className="ml-8">
+        {children}
+
+        <MetadataFieldset />
+      </div>
+    </FormSection>
+  );
+}
diff --git a/app/react/portainer/environments/wizard/EnvironmentsCreationView/types.ts b/app/react/portainer/environments/wizard/EnvironmentsCreationView/types.ts
new file mode 100644
index 0000000..9b40bc2
--- /dev/null
+++ b/app/react/portainer/environments/wizard/EnvironmentsCreationView/types.ts
@@ -0,0 +1,19 @@
+export interface AnalyticsState {
+  dockerAgent: number;
+  dockerApi: number;
+  dockerEdgeAgentStandard: number;
+  dockerEdgeAgentAsync: number;
+  podmanAgent: number;
+  podmanEdgeAgentStandard: number;
+  podmanEdgeAgentAsync: number;
+  podmanLocalEnvironment: number; // podman socket
+  kubernetesAgent: number;
+  kubernetesEdgeAgentStandard: number;
+  kubernetesEdgeAgentAsync: number;
+  kubesoloEdgeAgentStandard: number;
+  kubesoloEdgeAgentAsync: number;
+  aciApi: number;
+  localEndpoint: number; // docker socket
+}
+
+export type AnalyticsStateKey = keyof AnalyticsState;
diff --git a/app/react/portainer/environments/wizard/HomeView/HomeView.module.css b/app/react/portainer/environments/wizard/HomeView/HomeView.module.css
new file mode 100644
index 0000000..2656b3a
--- /dev/null
+++ b/app/react/portainer/environments/wizard/HomeView/HomeView.module.css
@@ -0,0 +1,23 @@
+.wizard-button {
+  display: block;
+  border: 1px solid rgb(163, 163, 163);
+  border-radius: 5px;
+  width: 200px;
+  height: 300px;
+  float: left;
+  margin-right: 30px;
+  cursor: pointer;
+  padding: 25px 20px;
+  box-shadow: 0 3px 10px -2px rgb(161 170 166 / 60%);
+}
+
+.wizard-button:hover {
+  box-shadow: 0 3px 10px -2px rgb(161 170 166 / 80%);
+  border: 1px solid #3ca4ff;
+  color: #337ab7;
+}
+
+a.link {
+  color: var(--text-body-color);
+  text-decoration: none;
+}
diff --git a/app/react/portainer/environments/wizard/HomeView/HomeView.tsx b/app/react/portainer/environments/wizard/HomeView/HomeView.tsx
new file mode 100644
index 0000000..a0ba5a9
--- /dev/null
+++ b/app/react/portainer/environments/wizard/HomeView/HomeView.tsx
@@ -0,0 +1,115 @@
+import { Wand2, Plug2 } from 'lucide-react';
+
+import { EnvironmentType } from '@/react/portainer/environments/types';
+import DockerIcon from '@/assets/ico/vendor/docker-icon.svg?c';
+import Kube from '@/assets/ico/kube.svg?c';
+
+import { PageHeader } from '@@/PageHeader';
+import { Widget, WidgetBody, WidgetTitle } from '@@/Widget';
+import { Link } from '@@/Link';
+
+import { Option } from '../components/Option';
+
+import { useConnectLocalEnvironment } from './useFetchOrCreateLocalEnvironment';
+import styles from './HomeView.module.css';
+
+export function HomeView() {
+  const localEnvironmentAdded = useConnectLocalEnvironment();
+  return (
+    <>
+      <PageHeader
+        title="Quick Setup"
+        breadcrumbs={[{ label: 'Environment Wizard' }]}
+        reload
+      />
+
+      <div className="row">
+        <div className="col-sm-12">
+          <Widget>
+            <WidgetTitle title="Environment Wizard" icon={Wand2} />
+            <WidgetBody>
+              <div className="row">
+                <div className="col-sm-12 form-section-title">
+                  Welcome to Portainer
+                </div>
+                <div className="text-muted small">
+                  {localEnvironmentAdded.status === 'success' && (
+                    <p>
+                      We have connected your local environment of{' '}
+                      {getTypeLabel(localEnvironmentAdded.type)} to Portainer.
+                    </p>
+                  )}
+
+                  {localEnvironmentAdded.status === 'error' && (
+                    <p>
+                      We could not connect your local environment to Portainer.
+                      <br />
+                      Please ensure your environment is correctly exposed. For
+                      help with installation visit{' '}
+                      <a
+                        href="https://documentation.portainer.io/quickstart/"
+                        target="_blank"
+                        rel="noopener noreferrer"
+                      >
+                        https://documentation.portainer.io/quickstart
+                      </a>
+                    </p>
+                  )}
+
+                  <p>
+                    Get started below with your local portainer or connect more
+                    container environments.
+                  </p>
+                </div>
+
+                <div className="flex flex-wrap gap-4">
+                  {localEnvironmentAdded.status === 'success' && (
+                    <Link
+                      to="portainer.home"
+                      className={styles.link}
+                      data-cy="wizard-get-started-link"
+                    >
+                      <Option
+                        icon={
+                          localEnvironmentAdded.type === EnvironmentType.Docker
+                            ? DockerIcon
+                            : Kube
+                        }
+                        title="Get Started"
+                        description="Proceed using the local environment which Portainer is running in"
+                      />
+                    </Link>
+                  )}
+                  <Link
+                    to="portainer.wizard.endpoints"
+                    className={styles.link}
+                    data-cy="wizard-add-environments-link"
+                  >
+                    <Option
+                      title="Add Environments"
+                      icon={Plug2}
+                      description="Connect to other environments"
+                    />
+                  </Link>
+                </div>
+              </div>
+            </WidgetBody>
+          </Widget>
+        </div>
+      </div>
+    </>
+  );
+}
+
+function getTypeLabel(type?: EnvironmentType) {
+  switch (type) {
+    case EnvironmentType.Docker:
+      return 'Docker';
+    case EnvironmentType.AgentOnDocker:
+      return 'Docker Agent';
+    case EnvironmentType.KubernetesLocal:
+      return 'Kubernetes';
+    default:
+      return '';
+  }
+}
diff --git a/app/react/portainer/environments/wizard/HomeView/index.ts b/app/react/portainer/environments/wizard/HomeView/index.ts
new file mode 100644
index 0000000..ee14985
--- /dev/null
+++ b/app/react/portainer/environments/wizard/HomeView/index.ts
@@ -0,0 +1 @@
+export { HomeView } from './HomeView';
diff --git a/app/react/portainer/environments/wizard/HomeView/useFetchOrCreateLocalEnvironment.ts b/app/react/portainer/environments/wizard/HomeView/useFetchOrCreateLocalEnvironment.ts
new file mode 100644
index 0000000..48e8e8d
--- /dev/null
+++ b/app/react/portainer/environments/wizard/HomeView/useFetchOrCreateLocalEnvironment.ts
@@ -0,0 +1,126 @@
+import { useEffect, useState } from 'react';
+import { useMutation } from '@tanstack/react-query';
+
+import { useEnvironmentList } from '@/react/portainer/environments/queries/useEnvironmentList';
+import {
+  ContainerEngine,
+  Environment,
+  EnvironmentType,
+} from '@/react/portainer/environments/types';
+import {
+  createLocalDockerEnvironment,
+  createLocalKubernetesEnvironment,
+} from '@/react/portainer/environments/environment.service/create';
+
+export function useConnectLocalEnvironment(): {
+  status: 'error' | 'loading' | 'success';
+  type?: EnvironmentType;
+} {
+  const [localEnvironment, setLocalEnvironment] = useState<Environment>();
+
+  const { isLoading, environment } = useFetchLocalEnvironment();
+
+  const createLocalEnvironmentMutation = useMutation(createLocalEnvironment);
+
+  const { mutate } = createLocalEnvironmentMutation;
+
+  useEffect(() => {
+    if (isLoading || localEnvironment) {
+      return;
+    }
+
+    if (environment) {
+      setLocalEnvironment(environment);
+      return;
+    }
+
+    mutate(undefined, {
+      onSuccess(environment) {
+        setLocalEnvironment(environment);
+      },
+    });
+  }, [environment, isLoading, localEnvironment, mutate]);
+
+  return {
+    status: getStatus(isLoading, createLocalEnvironmentMutation.status),
+    type: localEnvironment?.Type,
+  };
+}
+
+function getStatus(
+  isLoading: boolean,
+  mutationStatus: 'loading' | 'error' | 'success' | 'idle'
+): 'loading' | 'error' | 'success' {
+  if (isLoading || mutationStatus === 'loading') {
+    return 'loading';
+  }
+
+  if (mutationStatus === 'error') {
+    return 'error';
+  }
+
+  return 'success';
+}
+
+async function createLocalEnvironment() {
+  const name = 'local';
+  const attempts = [
+    () => createLocalKubernetesEnvironment({ name }),
+    () =>
+      createLocalDockerEnvironment({
+        name,
+        containerEngine: ContainerEngine.Podman,
+      }),
+    () =>
+      createLocalDockerEnvironment({
+        name,
+        containerEngine: ContainerEngine.Docker,
+      }),
+  ];
+
+  for (let i = 0; i < attempts.length; i++) {
+    try {
+      return await attempts[i]();
+    } catch (err) {
+      // Continue to next attempt
+    }
+  }
+
+  throw new Error('Failed to create local environment with any method');
+}
+
+function useFetchLocalEnvironment() {
+  const { environments, isLoading } = useEnvironmentList(
+    {
+      page: 0,
+      pageLimit: 1,
+      types: [
+        EnvironmentType.Docker,
+        EnvironmentType.AgentOnDocker,
+        EnvironmentType.KubernetesLocal,
+      ],
+    },
+    {
+      refetchInterval: false,
+      staleTime: Infinity,
+    }
+  );
+
+  let environment: Environment | undefined;
+  environments.forEach((value) => {
+    if (!environment) {
+      if (value.Type === EnvironmentType.AgentOnDocker) {
+        if (value.Name === 'primary' && value.Id === 1) {
+          environment = value;
+        }
+      } else {
+        environment = value;
+      }
+    }
+  });
+
+  return {
+    isLoading,
+    environment,
+  };
+}
diff --git a/app/react/portainer/environments/wizard/components/Option/Option.module.css b/app/react/portainer/environments/wizard/components/Option/Option.module.css
new file mode 100644
index 0000000..37183c2
--- /dev/null
+++ b/app/react/portainer/environments/wizard/components/Option/Option.module.css
@@ -0,0 +1,49 @@
+.root {
+  --selected-item-color: var(--blue-2);
+  @apply border border-solid;
+  @apply border-gray-5 bg-gray-2 text-black;
+  @apply th-dark:border-gray-neutral-8 th-dark:bg-gray-iron-10 th-dark:text-white;
+  @apply th-highcontrast:border-gray-neutral-8 th-highcontrast:bg-gray-iron-10 th-highcontrast:text-white;
+
+  display: block;
+  width: 200px;
+
+  min-height: 300px;
+
+  border-radius: 5px;
+  padding: 25px 20px;
+  cursor: pointer;
+  box-shadow: var(--shadow-boxselector-color);
+
+  margin: 0;
+  display: block;
+}
+
+.feature:hover {
+  border-color: var(--blue-2);
+  color: #337ab7;
+  box-shadow: 0 3px 10px -2px rgb(161 170 166 / 80%);
+}
+
+.teaser {
+  @apply border-2;
+  border-color: var(--BE-only);
+  color: var(--text-muted-color);
+}
+
+.teaser:hover {
+  box-shadow: 0 3px 10px -2px rgb(161 170 166 / 80%);
+}
+
+.active {
+  @apply border-blue-6 bg-blue-3;
+  @apply th-dark:border-blue-7 th-dark:bg-blue-10;
+
+  box-shadow: 0 3px 10px -2px rgb(161 170 166 / 80%);
+}
+
+.icon-component {
+  font-size: 80px;
+  height: 80px;
+  width: auto;
+}
diff --git a/app/react/portainer/environments/wizard/components/Option/Option.tsx b/app/react/portainer/environments/wizard/components/Option/Option.tsx
new file mode 100644
index 0000000..9626953
--- /dev/null
+++ b/app/react/portainer/environments/wizard/components/Option/Option.tsx
@@ -0,0 +1,64 @@
+import clsx from 'clsx';
+import { ComponentType } from 'react';
+
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+import { isLimitedToBE } from '@/react/portainer/feature-flags/feature-flags.service';
+
+import { BEFeatureIndicator } from '@@/BEFeatureIndicator';
+
+import styles from './Option.module.css';
+
+export interface SelectorItemType {
+  icon: string | ComponentType<{ selected?: boolean; className?: string }>;
+  title: string;
+  description: string;
+}
+
+interface Props extends SelectorItemType {
+  active?: boolean;
+  onClick?(): void;
+  featureId?: FeatureId;
+}
+
+export function Option({
+  icon,
+  active,
+  description,
+  title,
+  onClick = () => {},
+  featureId,
+}: Props) {
+  const IconComponent = icon;
+  const isLimited = isLimitedToBE(featureId);
+  return (
+    <button
+      className={clsx(
+        styles.root,
+        isLimited ? styles.teaser : styles.feature,
+        'border-0',
+        {
+          [styles.active]: active,
+        }
+      )}
+      type="button"
+      disabled={isLimited}
+      onClick={onClick}
+    >
+      <div className="mt-2 flex items-end justify-center text-center">
+        <IconComponent selected={active} className={styles.iconComponent} />
+      </div>
+
+      <div className="mt-3 flex flex-col text-center">
+        <h3>{title}</h3>
+        <h5>{description}</h5>
+        {featureId && isLimited && (
+          <BEFeatureIndicator
+            showIcon={false}
+            featureId={featureId}
+            className="!whitespace-normal"
+          />
+        )}
+      </div>
+    </button>
+  );
+}
diff --git a/app/react/portainer/environments/wizard/components/Option/index.ts b/app/react/portainer/environments/wizard/components/Option/index.ts
new file mode 100644
index 0000000..f7ecd68
--- /dev/null
+++ b/app/react/portainer/environments/wizard/components/Option/index.ts
@@ -0,0 +1 @@
+export { Option } from './Option';
diff --git a/app/react/portainer/environments/wizard/index.ts b/app/react/portainer/environments/wizard/index.ts
new file mode 100644
index 0000000..b848586
--- /dev/null
+++ b/app/react/portainer/environments/wizard/index.ts
@@ -0,0 +1,3 @@
+export { HomeView } from './HomeView';
+export { EnvironmentTypeSelectView } from './EnvironmentTypeSelectView';
+export { EnvironmentCreationView } from './EnvironmentsCreationView';
diff --git a/app/react/portainer/feature-flags/enums.ts b/app/react/portainer/feature-flags/enums.ts
new file mode 100644
index 0000000..ea3c2b0
--- /dev/null
+++ b/app/react/portainer/feature-flags/enums.ts
@@ -0,0 +1,46 @@
+export enum Edition {
+  CE,
+  BE,
+}
+
+export enum FeatureState {
+  HIDDEN,
+  VISIBLE,
+  LIMITED_BE,
+}
+
+export enum FeatureId {
+  K8S_RESOURCE_POOL_LB_QUOTA = 'k8s-resourcepool-Ibquota',
+  K8S_RESOURCE_POOL_STORAGE_QUOTA = 'k8s-resourcepool-storagequota',
+  K8S_CREATE_FROM_KUBECONFIG = 'k8s-create-from-kubeconfig',
+  K8S_EDIT_YAML = 'k8s-edit-yaml',
+  KAAS_PROVISIONING = 'kaas-provisioning',
+  RBAC_ROLES = 'rbac-roles',
+  REGISTRY_MANAGEMENT = 'registry-management',
+  K8S_SETUP_DEFAULT = 'k8s-setup-default',
+  S3_BACKUP_SETTING = 's3-backup-setting',
+  S3_RESTORE = 'restore-s3-form',
+  HIDE_INTERNAL_AUTHENTICATION_PROMPT = 'hide-internal-authentication-prompt',
+  TEAM_MEMBERSHIP = 'team-membership',
+  HIDE_INTERNAL_AUTH = 'hide-internal-auth',
+  EXTERNAL_AUTH_LDAP = 'external-auth-ldap',
+  ACTIVITY_AUDIT = 'activity-audit',
+  FORCE_REDEPLOYMENT = 'force-redeployment',
+  HIDE_AUTO_UPDATE_WINDOW = 'hide-auto-update-window',
+  IMAGE_UP_TO_DATE_INDICATOR = 'image-up-to-date-indicator',
+  STACK_PULL_IMAGE = 'stack-pull-image',
+  STACK_WEBHOOK = 'stack-webhook',
+  CONTAINER_WEBHOOK = 'container-webhook',
+  POD_SECURITY_POLICY_CONSTRAINT = 'pod-security-policy-constraint',
+  HIDE_DOCKER_HUB_ANONYMOUS = 'hide-docker-hub-anonymous',
+  CUSTOM_LOGIN_BANNER = 'custom-login-banner',
+  ENFORCE_DEPLOYMENT_OPTIONS = 'k8s-enforce-deployment-options',
+  K8S_ADM_ONLY_USR_INGRESS_DEPLY = 'k8s-admin-only-ingress-deploy',
+  K8S_ADM_ONLY_SECRETS = 'k8s-admin-only-secrets',
+  K8S_ROLLING_RESTART = 'k8s-rolling-restart',
+  K8SINSTALL = 'k8s-install',
+  KUBESOLO = 'kubesolo',
+  K8S_ANNOTATIONS = 'k8s-annotations',
+  CA_FILE = 'ca-file',
+  K8S_REQUIRE_NOTE_ON_APPLICATIONS = 'k8s-note-on-applications',
+}
diff --git a/app/react/portainer/feature-flags/feature-flags.css b/app/react/portainer/feature-flags/feature-flags.css
new file mode 100644
index 0000000..fc65269
--- /dev/null
+++ b/app/react/portainer/feature-flags/feature-flags.css
@@ -0,0 +1,62 @@
+.form-control.limited-be {
+  border-color: var(--BE-only);
+}
+
+.form-control.limited-be.no-border {
+  border-color: var(--border-form-control-color);
+}
+
+button.limited-be,
+button[disabled].limited-be.oauth-save-settings-button {
+  background-color: var(--BE-only);
+  border-color: var(--BE-only);
+  margin-left: 0px;
+}
+
+button.limited-be.oauth-save-settings-button {
+  background-color: var(--blue-2);
+  border-color: transparent;
+  margin-left: 0px;
+}
+
+ng-form.limited-be,
+form.limited-be,
+div.limited-be {
+  border: solid 1px var(--BE-only);
+  border-radius: 8px;
+  pointer-events: none;
+  touch-action: none;
+  display: block;
+}
+
+.limited-be-content {
+  @apply border-gray-6 p-2.5 opacity-50;
+}
+
+.limited-be-link {
+  padding: 10px;
+  width: inherit;
+  z-index: 5;
+  position: absolute;
+  top: 0px;
+  right: 0px;
+  float: right;
+  border-top-right-radius: 8px;
+  border-bottom-left-radius: 8px;
+  touch-action: auto;
+  cursor: hand;
+  pointer-events: auto;
+}
+
+.limited-be-link a {
+  @apply text-gray-6;
+}
+
+.limited-be-link a:hover {
+  @apply underline;
+  @apply border-blue-9 text-blue-9;
+}
+
+.form-control.limited-be[disabled] {
+  background-color: transparent !important;
+}
diff --git a/app/react/portainer/feature-flags/feature-flags.service.ts b/app/react/portainer/feature-flags/feature-flags.service.ts
new file mode 100644
index 0000000..4224461
--- /dev/null
+++ b/app/react/portainer/feature-flags/feature-flags.service.ts
@@ -0,0 +1,79 @@
+import { Edition, FeatureId, FeatureState } from './enums';
+
+export const isBE = process.env.PORTAINER_EDITION === 'BE';
+interface ServiceState {
+  currentEdition: Edition;
+  features: Record<FeatureId, Edition>;
+}
+
+const state: ServiceState = {
+  currentEdition: Edition.CE,
+  features: <Record<FeatureId, Edition>>{},
+};
+
+export async function init(edition: Edition) {
+  // will be loaded on runtime
+  const currentEdition = edition;
+  const features = {
+    [FeatureId.K8S_RESOURCE_POOL_LB_QUOTA]: Edition.BE,
+    [FeatureId.K8S_RESOURCE_POOL_STORAGE_QUOTA]: Edition.BE,
+    [FeatureId.K8S_CREATE_FROM_KUBECONFIG]: Edition.BE,
+    [FeatureId.KAAS_PROVISIONING]: Edition.BE,
+    [FeatureId.K8SINSTALL]: Edition.BE,
+    [FeatureId.KUBESOLO]: Edition.BE,
+    [FeatureId.ACTIVITY_AUDIT]: Edition.BE,
+    [FeatureId.EXTERNAL_AUTH_LDAP]: Edition.BE,
+    [FeatureId.HIDE_INTERNAL_AUTH]: Edition.BE,
+    [FeatureId.HIDE_INTERNAL_AUTHENTICATION_PROMPT]: Edition.BE,
+    [FeatureId.K8S_SETUP_DEFAULT]: Edition.BE,
+    [FeatureId.RBAC_ROLES]: Edition.BE,
+    [FeatureId.REGISTRY_MANAGEMENT]: Edition.BE,
+    [FeatureId.S3_BACKUP_SETTING]: Edition.BE,
+    [FeatureId.S3_RESTORE]: Edition.BE,
+    [FeatureId.TEAM_MEMBERSHIP]: Edition.BE,
+    [FeatureId.FORCE_REDEPLOYMENT]: Edition.BE,
+    [FeatureId.HIDE_AUTO_UPDATE_WINDOW]: Edition.BE,
+    [FeatureId.IMAGE_UP_TO_DATE_INDICATOR]: Edition.BE,
+    [FeatureId.STACK_PULL_IMAGE]: Edition.BE,
+    [FeatureId.STACK_WEBHOOK]: Edition.BE,
+    [FeatureId.CONTAINER_WEBHOOK]: Edition.BE,
+    [FeatureId.POD_SECURITY_POLICY_CONSTRAINT]: Edition.BE,
+    [FeatureId.HIDE_DOCKER_HUB_ANONYMOUS]: Edition.BE,
+    [FeatureId.CUSTOM_LOGIN_BANNER]: Edition.BE,
+    [FeatureId.K8S_EDIT_YAML]: Edition.BE,
+    [FeatureId.ENFORCE_DEPLOYMENT_OPTIONS]: Edition.BE,
+    [FeatureId.K8S_ADM_ONLY_USR_INGRESS_DEPLY]: Edition.BE,
+    [FeatureId.K8S_ADM_ONLY_SECRETS]: Edition.BE,
+    [FeatureId.K8S_ROLLING_RESTART]: Edition.BE,
+    [FeatureId.K8S_ANNOTATIONS]: Edition.BE,
+    [FeatureId.CA_FILE]: Edition.BE,
+    [FeatureId.K8S_REQUIRE_NOTE_ON_APPLICATIONS]: Edition.BE,
+  };
+
+  state.currentEdition = currentEdition;
+  state.features = features;
+}
+
+export function selectShow(featureId?: FeatureId) {
+  if (!featureId) {
+    return FeatureState.VISIBLE;
+  }
+
+  if (!state.features[featureId]) {
+    return FeatureState.HIDDEN;
+  }
+
+  if (state.features[featureId] <= state.currentEdition) {
+    return FeatureState.VISIBLE;
+  }
+
+  if (state.features[featureId] === Edition.BE) {
+    return FeatureState.LIMITED_BE;
+  }
+
+  return FeatureState.HIDDEN;
+}
+
+export function isLimitedToBE(featureId?: FeatureId) {
+  return selectShow(featureId) === FeatureState.LIMITED_BE;
+}
diff --git a/app/react/portainer/feature-flags/index.ts b/app/react/portainer/feature-flags/index.ts
new file mode 100644
index 0000000..68d713d
--- /dev/null
+++ b/app/react/portainer/feature-flags/index.ts
@@ -0,0 +1,8 @@
+import angular from 'angular';
+
+import { limitedFeatureDirective } from './limited-feature.directive';
+import './feature-flags.css';
+
+export default angular
+  .module('portainer.feature-flags', [])
+  .directive('limitedFeatureDir', limitedFeatureDirective).name;
diff --git a/app/react/portainer/feature-flags/limited-feature.directive.ts b/app/react/portainer/feature-flags/limited-feature.directive.ts
new file mode 100644
index 0000000..bed534a
--- /dev/null
+++ b/app/react/portainer/feature-flags/limited-feature.directive.ts
@@ -0,0 +1,44 @@
+import _ from 'lodash';
+import { IAttributes, IDirective, IScope } from 'angular';
+
+import { FeatureState } from '@/react/portainer/feature-flags/enums';
+
+import { selectShow } from './feature-flags.service';
+
+const BASENAME = 'limitedFeature';
+
+/* @ngInject */
+export function limitedFeatureDirective(): IDirective {
+  return {
+    restrict: 'A',
+    link,
+  };
+
+  function link(scope: IScope, elem: JQLite, attrs: IAttributes) {
+    const { limitedFeatureDir: featureId } = attrs;
+
+    if (!featureId) {
+      return;
+    }
+
+    const limitedFeatureAttrs = Object.keys(attrs)
+      .filter((attr) => attr.startsWith(BASENAME) && attr !== `${BASENAME}Dir`)
+      .map((attr) => [_.kebabCase(attr.replace(BASENAME, '')), attrs[attr]]);
+
+    const state = selectShow(featureId);
+
+    if (state === FeatureState.HIDDEN) {
+      elem.hide();
+      return;
+    }
+
+    if (state === FeatureState.VISIBLE) {
+      return;
+    }
+
+    limitedFeatureAttrs.forEach(([attr, value = attr]) => {
+      const currentValue = elem.attr(attr) || '';
+      elem.attr(attr, `${currentValue} ${value}`.trim());
+    });
+  }
+}
diff --git a/app/react/portainer/feature-flags/useFeatureFlag.ts b/app/react/portainer/feature-flags/useFeatureFlag.ts
new file mode 100644
index 0000000..e2e24c1
--- /dev/null
+++ b/app/react/portainer/feature-flags/useFeatureFlag.ts
@@ -0,0 +1,17 @@
+import { usePublicSettings } from '../settings/queries';
+
+export enum FeatureFlag {}
+
+export function useFeatureFlag(
+  flag: FeatureFlag,
+  {
+    onSuccess,
+    enabled = true,
+  }: { onSuccess?: (isEnabled: boolean) => void; enabled?: boolean } = {}
+) {
+  return usePublicSettings<boolean>({
+    select: (settings) => settings.Features[flag],
+    onSuccess,
+    enabled,
+  });
+}
diff --git a/app/react/portainer/feature-flags/useRedirectFeatureFlag.ts b/app/react/portainer/feature-flags/useRedirectFeatureFlag.ts
new file mode 100644
index 0000000..a5c6cd5
--- /dev/null
+++ b/app/react/portainer/feature-flags/useRedirectFeatureFlag.ts
@@ -0,0 +1,18 @@
+import { useRouter } from '@uirouter/react';
+
+import { FeatureFlag, useFeatureFlag } from './useFeatureFlag';
+
+export function useRedirectFeatureFlag(
+  flag: FeatureFlag,
+  to = 'portainer.home'
+) {
+  const router = useRouter();
+
+  useFeatureFlag(flag, {
+    onSuccess(isEnabled) {
+      if (!isEnabled) {
+        router.stateService.go(to);
+      }
+    },
+  });
+}
diff --git a/app/react/portainer/feature-flags/withEdition.tsx b/app/react/portainer/feature-flags/withEdition.tsx
new file mode 100644
index 0000000..3572ca3
--- /dev/null
+++ b/app/react/portainer/feature-flags/withEdition.tsx
@@ -0,0 +1,22 @@
+import { ComponentType } from 'react';
+
+export function withEdition<T>(
+  WrappedComponent: ComponentType<T>,
+  edition: 'BE' | 'CE'
+): ComponentType<T> {
+  // Try to create a nice displayName for React Dev Tools.
+  const displayName =
+    WrappedComponent.displayName || WrappedComponent.name || 'Component';
+
+  function WrapperComponent(props: T & JSX.IntrinsicAttributes) {
+    if (process.env.PORTAINER_EDITION !== edition) {
+      return null;
+    }
+
+    return <WrappedComponent {...props} />;
+  }
+
+  WrapperComponent.displayName = `with${edition}Edition(${displayName})`;
+
+  return WrapperComponent;
+}
diff --git a/app/react/portainer/feature-flags/withFeatureFlag.tsx b/app/react/portainer/feature-flags/withFeatureFlag.tsx
new file mode 100644
index 0000000..a41b21b
--- /dev/null
+++ b/app/react/portainer/feature-flags/withFeatureFlag.tsx
@@ -0,0 +1,26 @@
+import { ComponentType } from 'react';
+
+import { FeatureFlag, useFeatureFlag } from './useFeatureFlag';
+
+export function withFeatureFlag<T>(
+  WrappedComponent: ComponentType<T>,
+  flag: FeatureFlag
+): ComponentType<T> {
+  // Try to create a nice displayName for React Dev Tools.
+  const displayName =
+    WrappedComponent.displayName || WrappedComponent.name || 'Component';
+
+  function WrapperComponent(props: T & JSX.IntrinsicAttributes) {
+    const featureFlagQuery = useFeatureFlag(flag);
+
+    if (!featureFlagQuery.data) {
+      return null;
+    }
+
+    return <WrappedComponent {...props} />;
+  }
+
+  WrapperComponent.displayName = `with${flag}FeatureFlag(${displayName})`;
+
+  return WrapperComponent;
+}
diff --git a/app/react/portainer/generated-api/portainer/client.gen.ts b/app/react/portainer/generated-api/portainer/client.gen.ts
new file mode 100644
index 0000000..b21ebd7
--- /dev/null
+++ b/app/react/portainer/generated-api/portainer/client.gen.ts
@@ -0,0 +1,30 @@
+// This file is auto-generated by @hey-api/openapi-ts
+
+import { createClientConfig } from '@/react/portainer/services/axios/configure-hey-api';
+
+import {
+  type Client,
+  type ClientOptions,
+  type Config,
+  createClient,
+  createConfig,
+} from './client';
+import type { ClientOptions as ClientOptions2 } from './types.gen';
+
+/**
+ * The `createClientConfig()` function will be called on client initialization
+ * and the returned object will become the client's initial configuration.
+ *
+ * You may want to initialize your client this way instead of calling
+ * `setConfig()`. This is useful for example if you're using Next.js
+ * to ensure your client always has the correct values.
+ */
+export type CreateClientConfig<T extends ClientOptions = ClientOptions2> = (
+  override?: Config<ClientOptions & T>
+) => Config<Required<ClientOptions> & T>;
+
+export const client: Client = createClient(
+  createClientConfig(
+    createConfig<ClientOptions2>({ baseURL: 'api', throwOnError: true })
+  )
+);
diff --git a/app/react/portainer/generated-api/portainer/client/client.gen.ts b/app/react/portainer/generated-api/portainer/client/client.gen.ts
new file mode 100644
index 0000000..adce8b9
--- /dev/null
+++ b/app/react/portainer/generated-api/portainer/client/client.gen.ts
@@ -0,0 +1,172 @@
+// This file is auto-generated by @hey-api/openapi-ts
+
+import type { AxiosError, AxiosInstance, RawAxiosRequestHeaders } from 'axios';
+import axios from 'axios';
+
+import { createSseClient } from '../core/serverSentEvents.gen';
+import type { HttpMethod } from '../core/types.gen';
+import { getValidRequestBody } from '../core/utils.gen';
+import type { Client, Config, RequestOptions } from './types.gen';
+import {
+  buildUrl,
+  createConfig,
+  mergeConfigs,
+  mergeHeaders,
+  setAuthParams,
+} from './utils.gen';
+
+export const createClient = (config: Config = {}): Client => {
+  let _config = mergeConfigs(createConfig(), config);
+
+  let instance: AxiosInstance;
+
+  if (_config.axios && !('Axios' in _config.axios)) {
+    instance = _config.axios;
+  } else {
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    const { auth, ...configWithoutAuth } = _config;
+    instance = axios.create(configWithoutAuth);
+  }
+
+  const getConfig = (): Config => ({ ..._config });
+
+  const setConfig = (config: Config): Config => {
+    _config = mergeConfigs(_config, config);
+    instance.defaults = {
+      ...instance.defaults,
+      ..._config,
+      // @ts-expect-error
+      headers: mergeHeaders(instance.defaults.headers, _config.headers),
+    };
+    return getConfig();
+  };
+
+  const beforeRequest = async <
+    TData = unknown,
+    ThrowOnError extends boolean = boolean,
+    Url extends string = string,
+  >(
+    options: RequestOptions<TData, ThrowOnError, Url>
+  ) => {
+    const opts = {
+      ..._config,
+      ...options,
+      axios: options.axios ?? _config.axios ?? instance,
+      headers: mergeHeaders(_config.headers, options.headers),
+    };
+
+    if (opts.security) {
+      await setAuthParams(opts);
+    }
+
+    if (opts.requestValidator) {
+      await opts.requestValidator(opts);
+    }
+
+    if (opts.body !== undefined && opts.bodySerializer) {
+      opts.body = opts.bodySerializer(opts.body);
+    }
+
+    const url = buildUrl(opts);
+
+    return { opts, url };
+  };
+
+  // @ts-expect-error
+  const request: Client['request'] = async (options) => {
+    const { opts, url } = await beforeRequest(options);
+    try {
+      // assign Axios here for consistency with fetch
+      const _axios = opts.axios!;
+      // eslint-disable-next-line @typescript-eslint/no-unused-vars
+      const { auth, ...optsWithoutAuth } = opts;
+      const response = await _axios({
+        ...optsWithoutAuth,
+        baseURL: '', // the baseURL is already included in `url`
+        data: getValidRequestBody(opts),
+        headers: opts.headers as RawAxiosRequestHeaders,
+        // let `paramsSerializer()` handle query params if it exists
+        params: opts.paramsSerializer ? opts.query : undefined,
+        url,
+      });
+
+      let { data } = response;
+
+      if (opts.responseType === 'json') {
+        if (opts.responseValidator) {
+          await opts.responseValidator(data);
+        }
+
+        if (opts.responseTransformer) {
+          data = await opts.responseTransformer(data);
+        }
+      }
+
+      return {
+        ...response,
+        data: data ?? {},
+      };
+    } catch (error) {
+      const e = error as AxiosError;
+      if (opts.throwOnError) {
+        throw e;
+      }
+      // @ts-expect-error
+      e.error = e.response?.data ?? {};
+      return e;
+    }
+  };
+
+  const makeMethodFn =
+    (method: Uppercase<HttpMethod>) => (options: RequestOptions) =>
+      request({ ...options, method });
+
+  const makeSseFn =
+    (method: Uppercase<HttpMethod>) => async (options: RequestOptions) => {
+      const { opts, url } = await beforeRequest(options);
+      return createSseClient({
+        ...opts,
+        body: opts.body as BodyInit | null | undefined,
+        headers: opts.headers as Record<string, string>,
+        method,
+        serializedBody: getValidRequestBody(opts) as
+          | BodyInit
+          | null
+          | undefined,
+        // @ts-expect-error
+        signal: opts.signal,
+        url,
+      });
+    };
+
+  const _buildUrl: Client['buildUrl'] = (options) =>
+    buildUrl({ axios: instance, ..._config, ...options });
+
+  return {
+    buildUrl: _buildUrl,
+    connect: makeMethodFn('CONNECT'),
+    delete: makeMethodFn('DELETE'),
+    get: makeMethodFn('GET'),
+    getConfig,
+    head: makeMethodFn('HEAD'),
+    instance,
+    options: makeMethodFn('OPTIONS'),
+    patch: makeMethodFn('PATCH'),
+    post: makeMethodFn('POST'),
+    put: makeMethodFn('PUT'),
+    request,
+    setConfig,
+    sse: {
+      connect: makeSseFn('CONNECT'),
+      delete: makeSseFn('DELETE'),
+      get: makeSseFn('GET'),
+      head: makeSseFn('HEAD'),
+      options: makeSseFn('OPTIONS'),
+      patch: makeSseFn('PATCH'),
+      post: makeSseFn('POST'),
+      put: makeSseFn('PUT'),
+      trace: makeSseFn('TRACE'),
+    },
+    trace: makeMethodFn('TRACE'),
+  } as Client;
+};
diff --git a/app/react/portainer/generated-api/portainer/client/index.ts b/app/react/portainer/generated-api/portainer/client/index.ts
new file mode 100644
index 0000000..3e877a5
--- /dev/null
+++ b/app/react/portainer/generated-api/portainer/client/index.ts
@@ -0,0 +1,25 @@
+// This file is auto-generated by @hey-api/openapi-ts
+
+export type { Auth } from '../core/auth.gen';
+export type { QuerySerializerOptions } from '../core/bodySerializer.gen';
+export {
+  formDataBodySerializer,
+  jsonBodySerializer,
+  urlSearchParamsBodySerializer,
+} from '../core/bodySerializer.gen';
+export { buildClientParams } from '../core/params.gen';
+export { serializeQueryKeyValue } from '../core/queryKeySerializer.gen';
+export type { ServerSentEventsResult } from '../core/serverSentEvents.gen';
+export type { ClientMeta } from '../core/types.gen';
+export { createClient } from './client.gen';
+export type {
+  Client,
+  ClientOptions,
+  Config,
+  CreateClientConfig,
+  Options,
+  RequestOptions,
+  RequestResult,
+  TDataShape,
+} from './types.gen';
+export { createConfig } from './utils.gen';
diff --git a/app/react/portainer/generated-api/portainer/client/types.gen.ts b/app/react/portainer/generated-api/portainer/client/types.gen.ts
new file mode 100644
index 0000000..8147ac3
--- /dev/null
+++ b/app/react/portainer/generated-api/portainer/client/types.gen.ts
@@ -0,0 +1,207 @@
+// This file is auto-generated by @hey-api/openapi-ts
+
+import type {
+  AxiosError,
+  AxiosInstance,
+  AxiosRequestHeaders,
+  AxiosResponse,
+  AxiosStatic,
+  CreateAxiosDefaults,
+} from 'axios';
+
+import type { Auth } from '../core/auth.gen';
+import type {
+  ServerSentEventsOptions,
+  ServerSentEventsResult,
+} from '../core/serverSentEvents.gen';
+import type {
+  Client as CoreClient,
+  Config as CoreConfig,
+} from '../core/types.gen';
+
+export interface Config<T extends ClientOptions = ClientOptions>
+  extends
+    Omit<CreateAxiosDefaults, 'auth' | 'baseURL' | 'headers' | 'method'>,
+    CoreConfig {
+  /**
+   * Axios implementation. You can use this option to provide either an
+   * `AxiosStatic` or an `AxiosInstance`.
+   *
+   * @default axios
+   */
+  axios?: AxiosStatic | AxiosInstance;
+  /**
+   * Base URL for all requests made by this client.
+   */
+  baseURL?: T['baseURL'];
+  /**
+   * An object containing any HTTP headers that you want to pre-populate your
+   * `Headers` object with.
+   *
+   * {@link https://developer.mozilla.org/docs/Web/API/Headers/Headers#init See more}
+   */
+  headers?:
+    | AxiosRequestHeaders
+    | Record<
+        string,
+        | string
+        | number
+        | boolean
+        | (string | number | boolean)[]
+        | null
+        | undefined
+        | unknown
+      >;
+  /**
+   * Throw an error instead of returning it in the response?
+   *
+   * @default false
+   */
+  throwOnError?: T['throwOnError'];
+}
+
+export interface RequestOptions<
+  TData = unknown,
+  ThrowOnError extends boolean = boolean,
+  Url extends string = string,
+>
+  extends
+    Config<{
+      throwOnError: ThrowOnError;
+    }>,
+    Pick<
+      ServerSentEventsOptions<TData>,
+      | 'onRequest'
+      | 'onSseError'
+      | 'onSseEvent'
+      | 'sseDefaultRetryDelay'
+      | 'sseMaxRetryAttempts'
+      | 'sseMaxRetryDelay'
+    > {
+  /**
+   * Any body that you want to add to your request.
+   *
+   * {@link https://developer.mozilla.org/docs/Web/API/fetch#body}
+   */
+  body?: unknown;
+  path?: Record<string, unknown>;
+  query?: Record<string, unknown>;
+  /**
+   * Security mechanism(s) to use for the request.
+   */
+  security?: ReadonlyArray<Auth>;
+  url: Url;
+}
+
+export interface ClientOptions {
+  baseURL?: string;
+  throwOnError?: boolean;
+}
+
+export type RequestResult<
+  TData = unknown,
+  TError = unknown,
+  ThrowOnError extends boolean = boolean,
+> = ThrowOnError extends true
+  ? Promise<
+      AxiosResponse<
+        TData extends Record<string, unknown> ? TData[keyof TData] : TData
+      >
+    >
+  : Promise<
+      | (AxiosResponse<
+          TData extends Record<string, unknown> ? TData[keyof TData] : TData
+        > & {
+          error: undefined;
+        })
+      | (AxiosError<
+          TError extends Record<string, unknown> ? TError[keyof TError] : TError
+        > & {
+          data: undefined;
+          error: TError extends Record<string, unknown>
+            ? TError[keyof TError]
+            : TError;
+        })
+    >;
+
+type MethodFn = <
+  TData = unknown,
+  TError = unknown,
+  ThrowOnError extends boolean = false,
+>(
+  options: Omit<RequestOptions<TData, ThrowOnError>, 'method'>
+) => RequestResult<TData, TError, ThrowOnError>;
+
+type SseFn = <
+  TData = unknown,
+  // eslint-disable-next-line @typescript-eslint/no-unused-vars
+  _TError = unknown,
+  ThrowOnError extends boolean = false,
+>(
+  options: Omit<RequestOptions<never, ThrowOnError>, 'method'>
+) => Promise<ServerSentEventsResult<TData>>;
+
+type RequestFn = <
+  TData = unknown,
+  TError = unknown,
+  ThrowOnError extends boolean = false,
+>(
+  options: Omit<RequestOptions<TData, ThrowOnError>, 'method'> &
+    Pick<Required<RequestOptions<TData, ThrowOnError>>, 'method'>
+) => RequestResult<TData, TError, ThrowOnError>;
+
+type BuildUrlFn = <
+  TData extends {
+    path?: Record<string, unknown>;
+    query?: Record<string, unknown>;
+    url: string;
+  },
+>(
+  options: TData &
+    Pick<
+      RequestOptions<unknown, boolean>,
+      'axios' | 'baseURL' | 'paramsSerializer' | 'querySerializer'
+    >
+) => string;
+
+export type Client = CoreClient<
+  RequestFn,
+  Config,
+  MethodFn,
+  BuildUrlFn,
+  SseFn
+> & {
+  instance: AxiosInstance;
+};
+
+/**
+ * The `createClientConfig()` function will be called on client initialization
+ * and the returned object will become the client's initial configuration.
+ *
+ * You may want to initialize your client this way instead of calling
+ * `setConfig()`. This is useful for example if you're using Next.js
+ * to ensure your client always has the correct values.
+ */
+export type CreateClientConfig<T extends ClientOptions = ClientOptions> = (
+  override?: Config<ClientOptions & T>
+) => Config<Required<ClientOptions> & T>;
+
+export interface TDataShape {
+  body?: unknown;
+  headers?: unknown;
+  path?: unknown;
+  query?: unknown;
+  url: string;
+}
+
+type OmitKeys<T, K> = Pick<T, Exclude<keyof T, K>>;
+
+export type Options<
+  TData extends TDataShape = TDataShape,
+  ThrowOnError extends boolean = boolean,
+  TResponse = unknown,
+> = OmitKeys<
+  RequestOptions<TResponse, ThrowOnError>,
+  'body' | 'path' | 'query' | 'url'
+> &
+  ([TData] extends [never] ? unknown : Omit<TData, 'url'>);
diff --git a/app/react/portainer/generated-api/portainer/client/utils.gen.ts b/app/react/portainer/generated-api/portainer/client/utils.gen.ts
new file mode 100644
index 0000000..3c5d9ca
--- /dev/null
+++ b/app/react/portainer/generated-api/portainer/client/utils.gen.ts
@@ -0,0 +1,216 @@
+// This file is auto-generated by @hey-api/openapi-ts
+
+import { getAuthToken } from '../core/auth.gen';
+import type { QuerySerializerOptions } from '../core/bodySerializer.gen';
+import {
+  serializeArrayParam,
+  serializeObjectParam,
+  serializePrimitiveParam,
+} from '../core/pathSerializer.gen';
+import { getUrl } from '../core/utils.gen';
+import type {
+  Client,
+  ClientOptions,
+  Config,
+  RequestOptions,
+} from './types.gen';
+
+export const createQuerySerializer = <T = unknown>({
+  parameters = {},
+  ...args
+}: QuerySerializerOptions = {}): ((queryParams: T) => string) => {
+  const querySerializer = (queryParams: T): string => {
+    const search: string[] = [];
+    if (queryParams && typeof queryParams === 'object') {
+      for (const name in queryParams) {
+        const value = queryParams[name];
+
+        if (value === undefined || value === null) {
+          continue;
+        }
+
+        const options = parameters[name] || args;
+
+        if (Array.isArray(value)) {
+          const serializedArray = serializeArrayParam({
+            allowReserved: options.allowReserved,
+            explode: true,
+            name,
+            style: 'form',
+            value,
+            ...options.array,
+          });
+          if (serializedArray) search.push(serializedArray);
+        } else if (typeof value === 'object') {
+          const serializedObject = serializeObjectParam({
+            allowReserved: options.allowReserved,
+            explode: true,
+            name,
+            style: 'deepObject',
+            value: value as Record<string, unknown>,
+            ...options.object,
+          });
+          if (serializedObject) search.push(serializedObject);
+        } else {
+          const serializedPrimitive = serializePrimitiveParam({
+            allowReserved: options.allowReserved,
+            name,
+            value: value as string,
+          });
+          if (serializedPrimitive) search.push(serializedPrimitive);
+        }
+      }
+    }
+    return search.join('&');
+  };
+  return querySerializer;
+};
+
+const checkForExistence = (
+  options: Pick<RequestOptions, 'auth' | 'query'> & {
+    headers: Record<any, unknown>;
+  },
+  name?: string
+): boolean => {
+  if (!name) {
+    return false;
+  }
+  if (name in options.headers || options.query?.[name]) {
+    return true;
+  }
+  if (
+    'Cookie' in options.headers &&
+    options.headers['Cookie'] &&
+    typeof options.headers['Cookie'] === 'string'
+  ) {
+    return options.headers['Cookie'].includes(`${name}=`);
+  }
+  return false;
+};
+
+export async function setAuthParams(
+  options: Pick<RequestOptions, 'auth' | 'query' | 'security'> & {
+    headers: Record<any, unknown>;
+  }
+): Promise<void> {
+  for (const auth of options.security ?? []) {
+    if (checkForExistence(options, auth.name)) {
+      continue;
+    }
+    const token = await getAuthToken(auth, options.auth);
+
+    if (!token) {
+      continue;
+    }
+
+    const name = auth.name ?? 'Authorization';
+
+    switch (auth.in) {
+      case 'query':
+        if (!options.query) {
+          options.query = {};
+        }
+        options.query[name] = token;
+        break;
+      case 'cookie': {
+        const value = `${name}=${token}`;
+        if ('Cookie' in options.headers && options.headers['Cookie']) {
+          options.headers['Cookie'] = `${options.headers['Cookie']}; ${value}`;
+        } else {
+          options.headers['Cookie'] = value;
+        }
+        break;
+      }
+      case 'header':
+      default:
+        options.headers[name] = token;
+        break;
+    }
+  }
+}
+
+export const buildUrl: Client['buildUrl'] = (options) => {
+  const instanceBaseUrl = options.axios?.defaults?.baseURL;
+
+  const baseUrl =
+    options.baseURL && typeof options.baseURL === 'string'
+      ? options.baseURL
+      : instanceBaseUrl;
+
+  return getUrl({
+    baseUrl: baseUrl as string,
+    path: options.path,
+    // let `paramsSerializer()` handle query params if it exists
+    query: !options.paramsSerializer ? options.query : undefined,
+    querySerializer:
+      typeof options.querySerializer === 'function'
+        ? options.querySerializer
+        : createQuerySerializer(options.querySerializer),
+    url: options.url,
+  });
+};
+
+export const mergeConfigs = (a: Config, b: Config): Config => {
+  const config = { ...a, ...b };
+  config.headers = mergeHeaders(a.headers, b.headers);
+  return config;
+};
+
+/**
+ * Special Axios headers keywords allowing to set headers by request method.
+ */
+export const axiosHeadersKeywords = [
+  'common',
+  'delete',
+  'get',
+  'head',
+  'patch',
+  'post',
+  'put',
+] as const;
+
+export const mergeHeaders = (
+  ...headers: Array<Required<Config>['headers'] | undefined>
+): Record<any, unknown> => {
+  const mergedHeaders: Record<any, unknown> = {};
+  for (const header of headers) {
+    if (!header || typeof header !== 'object') {
+      continue;
+    }
+
+    const iterator = Object.entries(header);
+
+    for (const [key, value] of iterator) {
+      if (
+        axiosHeadersKeywords.includes(
+          key as (typeof axiosHeadersKeywords)[number]
+        ) &&
+        typeof value === 'object'
+      ) {
+        mergedHeaders[key] = {
+          ...(mergedHeaders[key] as Record<any, unknown>),
+          ...value,
+        };
+      } else if (value === null) {
+        delete mergedHeaders[key];
+      } else if (Array.isArray(value)) {
+        for (const v of value) {
+          // @ts-expect-error
+          mergedHeaders[key] = [...(mergedHeaders[key] ?? []), v as string];
+        }
+      } else if (value !== undefined) {
+        // assume object headers are meant to be JSON stringified, i.e., their
+        // content value in OpenAPI specification is 'application/json'
+        mergedHeaders[key] =
+          typeof value === 'object' ? JSON.stringify(value) : (value as string);
+      }
+    }
+  }
+  return mergedHeaders;
+};
+
+export const createConfig = <T extends ClientOptions = ClientOptions>(
+  override: Config<Omit<ClientOptions, keyof T> & T> = {}
+): Config<Omit<ClientOptions, keyof T> & T> => ({
+  ...override,
+});
diff --git a/app/react/portainer/generated-api/portainer/core/auth.gen.ts b/app/react/portainer/generated-api/portainer/core/auth.gen.ts
new file mode 100644
index 0000000..9735896
--- /dev/null
+++ b/app/react/portainer/generated-api/portainer/core/auth.gen.ts
@@ -0,0 +1,49 @@
+// This file is auto-generated by @hey-api/openapi-ts
+
+export type AuthToken = string | undefined;
+
+export interface Auth {
+  /**
+   * Which part of the request do we use to send the auth?
+   *
+   * @default 'header'
+   */
+  in?: 'header' | 'query' | 'cookie';
+  /**
+   * A unique identifier for the security scheme.
+   *
+   * Defined only when there are multiple security schemes whose `Auth`
+   * shape would otherwise be identical.
+   */
+  key?: string;
+  /**
+   * Header or query parameter name.
+   *
+   * @default 'Authorization'
+   */
+  name?: string;
+  scheme?: 'basic' | 'bearer';
+  type: 'apiKey' | 'http';
+}
+
+export const getAuthToken = async (
+  auth: Auth,
+  callback: ((auth: Auth) => Promise<AuthToken> | AuthToken) | AuthToken
+): Promise<string | undefined> => {
+  const token =
+    typeof callback === 'function' ? await callback(auth) : callback;
+
+  if (!token) {
+    return;
+  }
+
+  if (auth.scheme === 'bearer') {
+    return `Bearer ${token}`;
+  }
+
+  if (auth.scheme === 'basic') {
+    return `Basic ${btoa(token)}`;
+  }
+
+  return token;
+};
diff --git a/app/react/portainer/generated-api/portainer/core/bodySerializer.gen.ts b/app/react/portainer/generated-api/portainer/core/bodySerializer.gen.ts
new file mode 100644
index 0000000..e363841
--- /dev/null
+++ b/app/react/portainer/generated-api/portainer/core/bodySerializer.gen.ts
@@ -0,0 +1,96 @@
+// This file is auto-generated by @hey-api/openapi-ts
+
+import type {
+  ArrayStyle,
+  ObjectStyle,
+  SerializerOptions,
+} from './pathSerializer.gen';
+
+export type QuerySerializer = (query: Record<string, unknown>) => string;
+
+export type BodySerializer = (body: unknown) => unknown;
+
+type QuerySerializerOptionsObject = {
+  allowReserved?: boolean;
+  array?: Partial<SerializerOptions<ArrayStyle>>;
+  object?: Partial<SerializerOptions<ObjectStyle>>;
+};
+
+export type QuerySerializerOptions = QuerySerializerOptionsObject & {
+  /**
+   * Per-parameter serialization overrides. When provided, these settings
+   * override the global array/object settings for specific parameter names.
+   */
+  parameters?: Record<string, QuerySerializerOptionsObject>;
+};
+
+const serializeFormDataPair = (
+  data: FormData,
+  key: string,
+  value: unknown
+): void => {
+  if (typeof value === 'string' || value instanceof Blob) {
+    data.append(key, value);
+  } else if (value instanceof Date) {
+    data.append(key, value.toISOString());
+  } else {
+    data.append(key, JSON.stringify(value));
+  }
+};
+
+const serializeUrlSearchParamsPair = (
+  data: URLSearchParams,
+  key: string,
+  value: unknown
+): void => {
+  if (typeof value === 'string') {
+    data.append(key, value);
+  } else {
+    data.append(key, JSON.stringify(value));
+  }
+};
+
+export const formDataBodySerializer = {
+  bodySerializer: (body: unknown): FormData => {
+    const data = new FormData();
+
+    Object.entries(body as Record<string, unknown>).forEach(([key, value]) => {
+      if (value === undefined || value === null) {
+        return;
+      }
+      if (Array.isArray(value)) {
+        value.forEach((v) => serializeFormDataPair(data, key, v));
+      } else {
+        serializeFormDataPair(data, key, value);
+      }
+    });
+
+    return data;
+  },
+};
+
+export const jsonBodySerializer = {
+  bodySerializer: (body: unknown): string =>
+    JSON.stringify(body, (_key, value) =>
+      typeof value === 'bigint' ? value.toString() : value
+    ),
+};
+
+export const urlSearchParamsBodySerializer = {
+  bodySerializer: (body: unknown): string => {
+    const data = new URLSearchParams();
+
+    Object.entries(body as Record<string, unknown>).forEach(([key, value]) => {
+      if (value === undefined || value === null) {
+        return;
+      }
+      if (Array.isArray(value)) {
+        value.forEach((v) => serializeUrlSearchParamsPair(data, key, v));
+      } else {
+        serializeUrlSearchParamsPair(data, key, value);
+      }
+    });
+
+    return data.toString();
+  },
+};
diff --git a/app/react/portainer/generated-api/portainer/core/params.gen.ts b/app/react/portainer/generated-api/portainer/core/params.gen.ts
new file mode 100644
index 0000000..3945f83
--- /dev/null
+++ b/app/react/portainer/generated-api/portainer/core/params.gen.ts
@@ -0,0 +1,188 @@
+// This file is auto-generated by @hey-api/openapi-ts
+
+type Slot = 'body' | 'headers' | 'path' | 'query';
+
+export type Field =
+  | {
+      in: Exclude<Slot, 'body'>;
+      /**
+       * Field name. This is the name we want the user to see and use.
+       */
+      key: string;
+      /**
+       * Field mapped name. This is the name we want to use in the request.
+       * If omitted, we use the same value as `key`.
+       */
+      map?: string;
+    }
+  | {
+      in: Extract<Slot, 'body'>;
+      /**
+       * Key isn't required for bodies.
+       */
+      key?: string;
+      map?: string;
+    }
+  | {
+      /**
+       * Field name. This is the name we want the user to see and use.
+       */
+      key: string;
+      /**
+       * Field mapped name. This is the name we want to use in the request.
+       * If `in` is omitted, `map` aliases `key` to the transport layer.
+       */
+      map: Slot;
+    };
+
+export interface Fields {
+  allowExtra?: Partial<Record<Slot, boolean>>;
+  args?: ReadonlyArray<Field>;
+}
+
+export type FieldsConfig = ReadonlyArray<Field | Fields>;
+
+const extraPrefixesMap: Record<string, Slot> = {
+  $body_: 'body',
+  $headers_: 'headers',
+  $path_: 'path',
+  $query_: 'query',
+};
+const extraPrefixes = Object.entries(extraPrefixesMap);
+
+type KeyMap = Map<
+  string,
+  | {
+      in: Slot;
+      map?: string;
+    }
+  | {
+      in?: never;
+      map: Slot;
+    }
+>;
+
+function buildKeyMap(fields: FieldsConfig, map?: KeyMap): KeyMap {
+  if (!map) {
+    map = new Map();
+  }
+
+  for (const config of fields) {
+    if ('in' in config) {
+      if (config.key) {
+        map.set(config.key, {
+          in: config.in,
+          map: config.map,
+        });
+      }
+    } else if ('key' in config) {
+      map.set(config.key, {
+        map: config.map,
+      });
+    } else if (config.args) {
+      buildKeyMap(config.args, map);
+    }
+  }
+
+  return map;
+}
+
+interface Params {
+  body?: unknown;
+  headers: Record<string, unknown>;
+  path: Record<string, unknown>;
+  query: Record<string, unknown>;
+}
+
+function stripEmptySlots(params: Params): void {
+  for (const [slot, value] of Object.entries(params)) {
+    if (slot === 'body') continue;
+    if (
+      value &&
+      typeof value === 'object' &&
+      !Array.isArray(value) &&
+      !Object.keys(value).length
+    ) {
+      delete params[slot as Slot];
+    }
+  }
+}
+
+export function buildClientParams(
+  args: ReadonlyArray<unknown>,
+  fields: FieldsConfig
+): Params {
+  const params: Params = {
+    headers: Object.create(null),
+    path: Object.create(null),
+    query: Object.create(null),
+  };
+
+  const map = buildKeyMap(fields);
+
+  function writeSlot(slot: Slot, key: string, value: unknown): void {
+    let record = params[slot] as Record<string, unknown> | undefined;
+    if (record === undefined) {
+      record = Object.create(null) as Record<string, unknown>;
+      params[slot] = record;
+    }
+    record[key] = value;
+  }
+
+  let config: FieldsConfig[number] | undefined;
+
+  for (const [index, arg] of args.entries()) {
+    if (fields[index]) {
+      config = fields[index];
+    }
+
+    if (!config) {
+      continue;
+    }
+
+    if ('in' in config) {
+      if (config.key) {
+        const field = map.get(config.key)!;
+        const name = field.map || config.key;
+        if (field.in) {
+          writeSlot(field.in, name, arg);
+        }
+      } else {
+        params.body = arg;
+      }
+    } else {
+      for (const [key, value] of Object.entries(arg ?? {})) {
+        const field = map.get(key);
+
+        if (field) {
+          if (field.in) {
+            const name = field.map || key;
+            writeSlot(field.in, name, value);
+          } else {
+            params[field.map] = value;
+          }
+        } else {
+          const extra = extraPrefixes.find(([prefix]) =>
+            key.startsWith(prefix)
+          );
+
+          if (extra) {
+            const [prefix, slot] = extra;
+            writeSlot(slot, key.slice(prefix.length), value);
+          } else if ('allowExtra' in config && config.allowExtra) {
+            for (const [slot, allowed] of Object.entries(config.allowExtra)) {
+              if (allowed) {
+                writeSlot(slot as Slot, key, value);
+                break;
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+
+  stripEmptySlots(params);
+
+  return params;
+}
diff --git a/app/react/portainer/generated-api/portainer/core/pathSerializer.gen.ts b/app/react/portainer/generated-api/portainer/core/pathSerializer.gen.ts
new file mode 100644
index 0000000..331b6f9
--- /dev/null
+++ b/app/react/portainer/generated-api/portainer/core/pathSerializer.gen.ts
@@ -0,0 +1,186 @@
+// This file is auto-generated by @hey-api/openapi-ts
+
+interface SerializeOptions<T>
+  extends SerializePrimitiveOptions, SerializerOptions<T> {}
+
+interface SerializePrimitiveOptions {
+  allowReserved?: boolean;
+  name: string;
+}
+
+export interface SerializerOptions<T> {
+  /**
+   * @default true
+   */
+  explode: boolean;
+  style: T;
+}
+
+export type ArrayStyle = 'form' | 'spaceDelimited' | 'pipeDelimited';
+export type ArraySeparatorStyle = ArrayStyle | MatrixStyle;
+type MatrixStyle = 'label' | 'matrix' | 'simple';
+export type ObjectStyle = 'form' | 'deepObject';
+type ObjectSeparatorStyle = ObjectStyle | MatrixStyle;
+
+interface SerializePrimitiveParam extends SerializePrimitiveOptions {
+  value: string;
+}
+
+export const separatorArrayExplode = (
+  style: ArraySeparatorStyle
+): '.' | ';' | ',' | '&' => {
+  switch (style) {
+    case 'label':
+      return '.';
+    case 'matrix':
+      return ';';
+    case 'simple':
+      return ',';
+    default:
+      return '&';
+  }
+};
+
+export const separatorArrayNoExplode = (
+  style: ArraySeparatorStyle
+): ',' | '|' | '%20' => {
+  switch (style) {
+    case 'form':
+      return ',';
+    case 'pipeDelimited':
+      return '|';
+    case 'spaceDelimited':
+      return '%20';
+    default:
+      return ',';
+  }
+};
+
+export const separatorObjectExplode = (
+  style: ObjectSeparatorStyle
+): '.' | ';' | ',' | '&' => {
+  switch (style) {
+    case 'label':
+      return '.';
+    case 'matrix':
+      return ';';
+    case 'simple':
+      return ',';
+    default:
+      return '&';
+  }
+};
+
+export const serializeArrayParam = ({
+  allowReserved,
+  explode,
+  name,
+  style,
+  value,
+}: SerializeOptions<ArraySeparatorStyle> & {
+  value: unknown[];
+}): string => {
+  if (!explode) {
+    const joinedValues = (
+      allowReserved ? value : value.map((v) => encodeURIComponent(v as string))
+    ).join(separatorArrayNoExplode(style));
+    switch (style) {
+      case 'label':
+        return `.${joinedValues}`;
+      case 'matrix':
+        return `;${name}=${joinedValues}`;
+      case 'simple':
+        return joinedValues;
+      default:
+        return `${name}=${joinedValues}`;
+    }
+  }
+
+  const separator = separatorArrayExplode(style);
+  const joinedValues = value
+    .map((v) => {
+      if (style === 'label' || style === 'simple') {
+        return allowReserved ? v : encodeURIComponent(v as string);
+      }
+
+      return serializePrimitiveParam({
+        allowReserved,
+        name,
+        value: v as string,
+      });
+    })
+    .join(separator);
+  return style === 'label' || style === 'matrix'
+    ? separator + joinedValues
+    : joinedValues;
+};
+
+export const serializePrimitiveParam = ({
+  allowReserved,
+  name,
+  value,
+}: SerializePrimitiveParam): string => {
+  if (value === undefined || value === null) {
+    return '';
+  }
+
+  if (typeof value === 'object') {
+    throw new Error(
+      'Deeply-nested arrays/objects aren’t supported. Provide your own `querySerializer()` to handle these.'
+    );
+  }
+
+  return `${name}=${allowReserved ? value : encodeURIComponent(value)}`;
+};
+
+export const serializeObjectParam = ({
+  allowReserved,
+  explode,
+  name,
+  style,
+  value,
+  valueOnly,
+}: SerializeOptions<ObjectSeparatorStyle> & {
+  value: Record<string, unknown> | Date;
+  valueOnly?: boolean;
+}): string => {
+  if (value instanceof Date) {
+    return valueOnly ? value.toISOString() : `${name}=${value.toISOString()}`;
+  }
+
+  if (style !== 'deepObject' && !explode) {
+    let values: string[] = [];
+    Object.entries(value).forEach(([key, v]) => {
+      values = [
+        ...values,
+        key,
+        allowReserved ? (v as string) : encodeURIComponent(v as string),
+      ];
+    });
+    const joinedValues = values.join(',');
+    switch (style) {
+      case 'form':
+        return `${name}=${joinedValues}`;
+      case 'label':
+        return `.${joinedValues}`;
+      case 'matrix':
+        return `;${name}=${joinedValues}`;
+      default:
+        return joinedValues;
+    }
+  }
+
+  const separator = separatorObjectExplode(style);
+  const joinedValues = Object.entries(value)
+    .map(([key, v]) =>
+      serializePrimitiveParam({
+        allowReserved,
+        name: style === 'deepObject' ? `${name}[${key}]` : key,
+        value: v as string,
+      })
+    )
+    .join(separator);
+  return style === 'label' || style === 'matrix'
+    ? separator + joinedValues
+    : joinedValues;
+};
diff --git a/app/react/portainer/generated-api/portainer/core/queryKeySerializer.gen.ts b/app/react/portainer/generated-api/portainer/core/queryKeySerializer.gen.ts
new file mode 100644
index 0000000..05b0b4e
--- /dev/null
+++ b/app/react/portainer/generated-api/portainer/core/queryKeySerializer.gen.ts
@@ -0,0 +1,139 @@
+// This file is auto-generated by @hey-api/openapi-ts
+
+/**
+ * JSON-friendly union that mirrors what Pinia Colada can hash.
+ */
+export type JsonValue =
+  | null
+  | string
+  | number
+  | boolean
+  | JsonValue[]
+  | { [key: string]: JsonValue };
+
+/**
+ * Replacer that converts non-JSON values (bigint, Date, etc.) to safe substitutes.
+ */
+export const queryKeyJsonReplacer = (
+  _key: string,
+  value: unknown
+): unknown | undefined => {
+  if (
+    value === undefined ||
+    typeof value === 'function' ||
+    typeof value === 'symbol'
+  ) {
+    return undefined;
+  }
+  if (typeof value === 'bigint') {
+    return value.toString();
+  }
+  if (value instanceof Date) {
+    return value.toISOString();
+  }
+  return value;
+};
+
+/**
+ * Safely stringifies a value and parses it back into a JsonValue.
+ */
+export const stringifyToJsonValue = (input: unknown): JsonValue | undefined => {
+  try {
+    const json = JSON.stringify(input, queryKeyJsonReplacer);
+    if (json === undefined) {
+      return undefined;
+    }
+    return JSON.parse(json) as JsonValue;
+  } catch {
+    return undefined;
+  }
+};
+
+/**
+ * Detects plain objects (including objects with a null prototype).
+ */
+const isPlainObject = (value: unknown): value is Record<string, unknown> => {
+  if (value === null || typeof value !== 'object') {
+    return false;
+  }
+  const prototype = Object.getPrototypeOf(value as object);
+  return prototype === Object.prototype || prototype === null;
+};
+
+/**
+ * Turns URLSearchParams into a sorted JSON object for deterministic keys.
+ */
+const serializeSearchParams = (params: URLSearchParams): JsonValue => {
+  const entries = Array.from(params.entries()).sort(([a], [b]) =>
+    a.localeCompare(b)
+  );
+  const result: Record<string, JsonValue> = {};
+
+  for (const [key, value] of entries) {
+    const existing = result[key];
+    if (existing === undefined) {
+      result[key] = value;
+      continue;
+    }
+
+    if (Array.isArray(existing)) {
+      (existing as string[]).push(value);
+    } else {
+      result[key] = [existing, value];
+    }
+  }
+
+  return result;
+};
+
+/**
+ * Normalizes any accepted value into a JSON-friendly shape for query keys.
+ */
+export const serializeQueryKeyValue = (
+  value: unknown
+): JsonValue | undefined => {
+  if (value === null) {
+    return null;
+  }
+
+  if (
+    typeof value === 'string' ||
+    typeof value === 'number' ||
+    typeof value === 'boolean'
+  ) {
+    return value;
+  }
+
+  if (
+    value === undefined ||
+    typeof value === 'function' ||
+    typeof value === 'symbol'
+  ) {
+    return undefined;
+  }
+
+  if (typeof value === 'bigint') {
+    return value.toString();
+  }
+
+  if (value instanceof Date) {
+    return value.toISOString();
+  }
+
+  if (Array.isArray(value)) {
+    return stringifyToJsonValue(value);
+  }
+
+  if (
+    typeof URLSearchParams !== 'undefined' &&
+    value instanceof URLSearchParams
+  ) {
+    return serializeSearchParams(value);
+  }
+
+  if (isPlainObject(value)) {
+    return stringifyToJsonValue(value);
+  }
+
+  return undefined;
+};
diff --git a/app/react/portainer/generated-api/portainer/core/serverSentEvents.gen.ts b/app/react/portainer/generated-api/portainer/core/serverSentEvents.gen.ts
new file mode 100644
index 0000000..536db4e
--- /dev/null
+++ b/app/react/portainer/generated-api/portainer/core/serverSentEvents.gen.ts
@@ -0,0 +1,265 @@
+// This file is auto-generated by @hey-api/openapi-ts
+
+import type { Config } from './types.gen';
+
+export type ServerSentEventsOptions<TData = unknown> = Omit<
+  RequestInit,
+  'method'
+> &
+  Pick<Config, 'method' | 'responseTransformer' | 'responseValidator'> & {
+    /**
+     * Fetch API implementation. You can use this option to provide a custom
+     * fetch instance.
+     *
+     * @default globalThis.fetch
+     */
+    fetch?: typeof fetch;
+    /**
+     * Implementing clients can call request interceptors inside this hook.
+     */
+    onRequest?: (url: string, init: RequestInit) => Promise<Request>;
+    /**
+     * Callback invoked when a network or parsing error occurs during streaming.
+     *
+     * This option applies only if the endpoint returns a stream of events.
+     *
+     * @param error The error that occurred.
+     */
+    onSseError?: (error: unknown) => void;
+    /**
+     * Callback invoked when an event is streamed from the server.
+     *
+     * This option applies only if the endpoint returns a stream of events.
+     *
+     * @param event Event streamed from the server.
+     * @returns Nothing (void).
+     */
+    onSseEvent?: (event: StreamEvent<TData>) => void;
+    serializedBody?: RequestInit['body'];
+    /**
+     * Default retry delay in milliseconds.
+     *
+     * This option applies only if the endpoint returns a stream of events.
+     *
+     * @default 3000
+     */
+    sseDefaultRetryDelay?: number;
+    /**
+     * Maximum number of retry attempts before giving up.
+     */
+    sseMaxRetryAttempts?: number;
+    /**
+     * Maximum retry delay in milliseconds.
+     *
+     * Applies only when exponential backoff is used.
+     *
+     * This option applies only if the endpoint returns a stream of events.
+     *
+     * @default 30000
+     */
+    sseMaxRetryDelay?: number;
+    /**
+     * Optional sleep function for retry backoff.
+     *
+     * Defaults to using `setTimeout`.
+     */
+    sseSleepFn?: (ms: number) => Promise<void>;
+    url: string;
+  };
+
+export interface StreamEvent<TData = unknown> {
+  data: TData;
+  event?: string;
+  id?: string;
+  retry?: number;
+}
+
+export type ServerSentEventsResult<
+  TData = unknown,
+  TReturn = void,
+  TNext = unknown,
+> = {
+  stream: AsyncGenerator<
+    TData extends Record<string, unknown> ? TData[keyof TData] : TData,
+    TReturn,
+    TNext
+  >;
+};
+
+export function createSseClient<TData = unknown>({
+  onRequest,
+  onSseError,
+  onSseEvent,
+  responseTransformer,
+  responseValidator,
+  sseDefaultRetryDelay,
+  sseMaxRetryAttempts,
+  sseMaxRetryDelay,
+  sseSleepFn,
+  url,
+  ...options
+}: ServerSentEventsOptions): ServerSentEventsResult<TData> {
+  let lastEventId: string | undefined;
+
+  const sleep =
+    sseSleepFn ??
+    ((ms: number) => new Promise((resolve) => setTimeout(resolve, ms)));
+
+  const createStream = async function* () {
+    let retryDelay: number = sseDefaultRetryDelay ?? 3000;
+    let attempt = 0;
+    const signal = options.signal ?? new AbortController().signal;
+
+    while (true) {
+      if (signal.aborted) break;
+
+      attempt++;
+
+      const headers =
+        options.headers instanceof Headers
+          ? options.headers
+          : new Headers(options.headers as Record<string, string> | undefined);
+
+      if (lastEventId !== undefined) {
+        headers.set('Last-Event-ID', lastEventId);
+      }
+
+      try {
+        const requestInit: RequestInit = {
+          redirect: 'follow',
+          ...options,
+          body: options.serializedBody,
+          headers,
+          signal,
+        };
+        let request = new Request(url, requestInit);
+        if (onRequest) {
+          request = await onRequest(url, requestInit);
+        }
+        // fetch must be assigned here, otherwise it would throw the error:
+        // TypeError: Failed to execute 'fetch' on 'Window': Illegal invocation
+        const _fetch = options.fetch ?? globalThis.fetch;
+        const response = await _fetch(request);
+
+        if (!response.ok)
+          throw new Error(
+            `SSE failed: ${response.status} ${response.statusText}`
+          );
+
+        if (!response.body) throw new Error('No body in SSE response');
+
+        const reader = response.body
+          .pipeThrough(new TextDecoderStream())
+          .getReader();
+
+        let buffer = '';
+
+        const abortHandler = () => {
+          try {
+            reader.cancel();
+          } catch {
+            // noop
+          }
+        };
+
+        signal.addEventListener('abort', abortHandler);
+
+        try {
+          while (true) {
+            const { done, value } = await reader.read();
+            if (done) break;
+            buffer += value;
+            buffer = buffer.replace(/\r\n?/g, '\n'); // normalize line endings
+
+            const chunks = buffer.split('\n\n');
+            buffer = chunks.pop() ?? '';
+
+            for (const chunk of chunks) {
+              const lines = chunk.split('\n');
+              const dataLines: Array<string> = [];
+              let eventName: string | undefined;
+
+              for (const line of lines) {
+                if (line.startsWith('data:')) {
+                  dataLines.push(line.replace(/^data:\s*/, ''));
+                } else if (line.startsWith('event:')) {
+                  eventName = line.replace(/^event:\s*/, '');
+                } else if (line.startsWith('id:')) {
+                  lastEventId = line.replace(/^id:\s*/, '');
+                } else if (line.startsWith('retry:')) {
+                  const parsed = Number.parseInt(
+                    line.replace(/^retry:\s*/, ''),
+                    10
+                  );
+                  if (!Number.isNaN(parsed)) {
+                    retryDelay = parsed;
+                  }
+                }
+              }
+
+              let data: unknown;
+              let parsedJson = false;
+
+              if (dataLines.length) {
+                const rawData = dataLines.join('\n');
+                try {
+                  data = JSON.parse(rawData);
+                  parsedJson = true;
+                } catch {
+                  data = rawData;
+                }
+              }
+
+              if (parsedJson) {
+                if (responseValidator) {
+                  await responseValidator(data);
+                }
+
+                if (responseTransformer) {
+                  data = await responseTransformer(data);
+                }
+              }
+
+              onSseEvent?.({
+                data,
+                event: eventName,
+                id: lastEventId,
+                retry: retryDelay,
+              });
+
+              if (dataLines.length) {
+                yield data as any;
+              }
+            }
+          }
+        } finally {
+          signal.removeEventListener('abort', abortHandler);
+          reader.releaseLock();
+        }
+
+        break; // exit loop on normal completion
+      } catch (error) {
+        // connection failed or aborted; retry after delay
+        onSseError?.(error);
+
+        if (
+          sseMaxRetryAttempts !== undefined &&
+          attempt >= sseMaxRetryAttempts
+        ) {
+          break; // stop after firing error
+        }
+
+        // exponential backoff: double retry each attempt, cap at 30s
+        const backoff = Math.min(
+          retryDelay * 2 ** (attempt - 1),
+          sseMaxRetryDelay ?? 30000
+        );
+        await sleep(backoff);
+      }
+    }
+  };
+
+  const stream = createStream();
+
+  return { stream };
+}
diff --git a/app/react/portainer/generated-api/portainer/core/types.gen.ts b/app/react/portainer/generated-api/portainer/core/types.gen.ts
new file mode 100644
index 0000000..82d2cd7
--- /dev/null
+++ b/app/react/portainer/generated-api/portainer/core/types.gen.ts
@@ -0,0 +1,124 @@
+// This file is auto-generated by @hey-api/openapi-ts
+
+import type { Auth, AuthToken } from './auth.gen';
+import type {
+  BodySerializer,
+  QuerySerializer,
+  QuerySerializerOptions,
+} from './bodySerializer.gen';
+
+export type HttpMethod =
+  | 'connect'
+  | 'delete'
+  | 'get'
+  | 'head'
+  | 'options'
+  | 'patch'
+  | 'post'
+  | 'put'
+  | 'trace';
+
+export type Client<
+  RequestFn = never,
+  Config = unknown,
+  MethodFn = never,
+  BuildUrlFn = never,
+  SseFn = never,
+> = {
+  /**
+   * Returns the final request URL.
+   */
+  buildUrl: BuildUrlFn;
+  getConfig: () => Config;
+  request: RequestFn;
+  setConfig: (config: Config) => Config;
+} & {
+  [K in HttpMethod]: MethodFn;
+} & ([SseFn] extends [never]
+    ? { sse?: never }
+    : { sse: { [K in HttpMethod]: SseFn } });
+
+export interface Config {
+  /**
+   * Auth token or a function returning auth token. The resolved value will be
+   * added to the request payload as defined by its `security` array.
+   */
+  auth?: ((auth: Auth) => Promise<AuthToken> | AuthToken) | AuthToken;
+  /**
+   * A function for serializing request body parameter. By default,
+   * {@link JSON.stringify()} will be used.
+   */
+  bodySerializer?: BodySerializer | null;
+  /**
+   * An object containing any HTTP headers that you want to pre-populate your
+   * `Headers` object with.
+   *
+   * {@link https://developer.mozilla.org/docs/Web/API/Headers/Headers#init See more}
+   */
+  headers?:
+    | RequestInit['headers']
+    | Record<
+        string,
+        | string
+        | number
+        | boolean
+        | (string | number | boolean)[]
+        | null
+        | undefined
+        | unknown
+      >;
+  /**
+   * The request method.
+   *
+   * {@link https://developer.mozilla.org/docs/Web/API/fetch#method See more}
+   */
+  method?: Uppercase<HttpMethod>;
+  /**
+   * A function for serializing request query parameters. By default, arrays
+   * will be exploded in form style, objects will be exploded in deepObject
+   * style, and reserved characters are percent-encoded.
+   *
+   * This method will have no effect if the native `paramsSerializer()` Axios
+   * API function is used.
+   *
+   * {@link https://swagger.io/docs/specification/serialization/#query View examples}
+   */
+  querySerializer?: QuerySerializer | QuerySerializerOptions;
+  /**
+   * A function validating request data. This is useful if you want to ensure
+   * the request conforms to the desired shape, so it can be safely sent to
+   * the server.
+   */
+  requestValidator?: (data: unknown) => Promise<unknown>;
+  /**
+   * A function transforming response data before it's returned. This is useful
+   * for post-processing data, e.g., converting ISO strings into Date objects.
+   */
+  responseTransformer?: (data: unknown) => Promise<unknown>;
+  /**
+   * A function validating response data. This is useful if you want to ensure
+   * the response conforms to the desired shape, so it can be safely passed to
+   * the transformers and returned to the user.
+   */
+  responseValidator?: (data: unknown) => Promise<unknown>;
+}
+
+/**
+ * Arbitrary metadata passed through the `meta` request option.
+ */
+// eslint-disable-next-line @typescript-eslint/no-empty-object-type
+export interface ClientMeta {}
+
+type IsExactlyNeverOrNeverUndefined<T> = [T] extends [never]
+  ? true
+  : [T] extends [never | undefined]
+    ? [undefined] extends [T]
+      ? false
+      : true
+    : false;
+
+export type OmitNever<T extends Record<string, unknown>> = {
+  [K in keyof T as IsExactlyNeverOrNeverUndefined<T[K]> extends true
+    ? never
+    : K]: T[K];
+};
diff --git a/app/react/portainer/generated-api/portainer/core/utils.gen.ts b/app/react/portainer/generated-api/portainer/core/utils.gen.ts
new file mode 100644
index 0000000..8e1607c
--- /dev/null
+++ b/app/react/portainer/generated-api/portainer/core/utils.gen.ts
@@ -0,0 +1,146 @@
+// This file is auto-generated by @hey-api/openapi-ts
+
+import type { BodySerializer, QuerySerializer } from './bodySerializer.gen';
+import {
+  type ArraySeparatorStyle,
+  serializeArrayParam,
+  serializeObjectParam,
+  serializePrimitiveParam,
+} from './pathSerializer.gen';
+
+export interface PathSerializer {
+  path: Record<string, unknown>;
+  url: string;
+}
+
+export const PATH_PARAM_RE: RegExp = /\{[^{}]+\}/g;
+
+export const defaultPathSerializer = ({
+  path,
+  url: _url,
+}: PathSerializer): string => {
+  let url = _url;
+  const matches = _url.match(PATH_PARAM_RE);
+  if (matches) {
+    for (const match of matches) {
+      let explode = false;
+      let name = match.substring(1, match.length - 1);
+      let style: ArraySeparatorStyle = 'simple';
+
+      if (name.endsWith('*')) {
+        explode = true;
+        name = name.substring(0, name.length - 1);
+      }
+
+      if (name.startsWith('.')) {
+        name = name.substring(1);
+        style = 'label';
+      } else if (name.startsWith(';')) {
+        name = name.substring(1);
+        style = 'matrix';
+      }
+
+      const value = path[name];
+
+      if (value === undefined || value === null) {
+        continue;
+      }
+
+      if (Array.isArray(value)) {
+        url = url.replace(
+          match,
+          serializeArrayParam({ explode, name, style, value })
+        );
+        continue;
+      }
+
+      if (typeof value === 'object') {
+        url = url.replace(
+          match,
+          serializeObjectParam({
+            explode,
+            name,
+            style,
+            value: value as Record<string, unknown>,
+            valueOnly: true,
+          })
+        );
+        continue;
+      }
+
+      if (style === 'matrix') {
+        url = url.replace(
+          match,
+          `;${serializePrimitiveParam({
+            name,
+            value: value as string,
+          })}`
+        );
+        continue;
+      }
+
+      const replaceValue = encodeURIComponent(
+        style === 'label' ? `.${value as string}` : (value as string)
+      );
+      url = url.replace(match, replaceValue);
+    }
+  }
+  return url;
+};
+
+export const getUrl = ({
+  baseUrl,
+  path,
+  query,
+  querySerializer,
+  url: _url,
+}: {
+  baseUrl?: string;
+  path?: Record<string, unknown>;
+  query?: Record<string, unknown>;
+  querySerializer: QuerySerializer;
+  url: string;
+}): string => {
+  const pathUrl = _url.startsWith('/') ? _url : `/${_url}`;
+  let url = (baseUrl ?? '') + pathUrl;
+  if (path) {
+    url = defaultPathSerializer({ path, url });
+  }
+  let search = query ? querySerializer(query) : '';
+  if (search.startsWith('?')) {
+    search = search.substring(1);
+  }
+  if (search) {
+    url += `?${search}`;
+  }
+  return url;
+};
+
+export function getValidRequestBody(options: {
+  body?: unknown;
+  bodySerializer?: BodySerializer | null;
+  serializedBody?: unknown;
+}): unknown {
+  const hasBody = options.body !== undefined;
+  const isSerializedBody = hasBody && options.bodySerializer;
+
+  if (isSerializedBody) {
+    if ('serializedBody' in options) {
+      const hasSerializedBody =
+        options.serializedBody !== undefined && options.serializedBody !== '';
+
+      return hasSerializedBody ? options.serializedBody : null;
+    }
+
+    // not all clients implement a serializedBody property (i.e., client-axios)
+    return options.body !== '' ? options.body : null;
+  }
+
+  // plain/text body
+  if (hasBody) {
+    return options.body;
+  }
+
+  // no body was provided
+  return undefined;
+}
diff --git a/app/react/portainer/generated-api/portainer/sdk.gen.ts b/app/react/portainer/generated-api/portainer/sdk.gen.ts
new file mode 100644
index 0000000..a9f20ca
--- /dev/null
+++ b/app/react/portainer/generated-api/portainer/sdk.gen.ts
@@ -0,0 +1,11026 @@
+// This file is auto-generated by @hey-api/openapi-ts
+
+import * as z from 'zod';
+
+import {
+  type Client,
+  type ClientMeta,
+  formDataBodySerializer,
+  type Options as Options2,
+  type RequestResult,
+  type TDataShape,
+} from './client';
+import { client } from './client.gen';
+import type {
+  AuthenticateUserData,
+  AuthenticateUserErrors,
+  AuthenticateUserResponses,
+  BackupData,
+  BackupErrors,
+  BackupResponses,
+  CreateKubernetesIngressData,
+  CreateKubernetesIngressErrors,
+  CreateKubernetesIngressResponses,
+  CreateKubernetesNamespaceData,
+  CreateKubernetesNamespaceErrors,
+  CreateKubernetesNamespaceResponses,
+  CreateKubernetesServiceData,
+  CreateKubernetesServiceErrors,
+  CreateKubernetesServiceResponses,
+  CurrentUserInspectData,
+  CurrentUserInspectErrors,
+  CurrentUserInspectResponses,
+  CustomTemplateCreateFileData,
+  CustomTemplateCreateFileErrors,
+  CustomTemplateCreateFileResponses,
+  CustomTemplateCreateRepositoryData,
+  CustomTemplateCreateRepositoryErrors,
+  CustomTemplateCreateRepositoryResponses,
+  CustomTemplateCreateStringData,
+  CustomTemplateCreateStringErrors,
+  CustomTemplateCreateStringResponses,
+  CustomTemplateDeleteData,
+  CustomTemplateDeleteErrors,
+  CustomTemplateDeleteResponses,
+  CustomTemplateFileData,
+  CustomTemplateFileErrors,
+  CustomTemplateFileResponses,
+  CustomTemplateGitFetchData,
+  CustomTemplateGitFetchErrors,
+  CustomTemplateGitFetchResponses,
+  CustomTemplateInspectData,
+  CustomTemplateInspectErrors,
+  CustomTemplateInspectResponses,
+  CustomTemplateListData,
+  CustomTemplateListErrors,
+  CustomTemplateListResponses,
+  CustomTemplateUpdateData,
+  CustomTemplateUpdateErrors,
+  CustomTemplateUpdateResponses,
+  DeleteClusterRoleBindingsData,
+  DeleteClusterRoleBindingsErrors,
+  DeleteClusterRoleBindingsResponses,
+  DeleteClusterRolesData,
+  DeleteClusterRolesErrors,
+  DeleteClusterRolesResponses,
+  DeleteCronJobsData,
+  DeleteCronJobsErrors,
+  DeleteCronJobsResponses,
+  DeleteJobsData,
+  DeleteJobsErrors,
+  DeleteJobsResponses,
+  DeleteKubernetesIngressesData,
+  DeleteKubernetesIngressesErrors,
+  DeleteKubernetesIngressesResponses,
+  DeleteKubernetesNamespaceData,
+  DeleteKubernetesNamespaceErrors,
+  DeleteKubernetesNamespaceResponses,
+  DeleteKubernetesPersistentVolumeClaimsData,
+  DeleteKubernetesPersistentVolumeClaimsErrors,
+  DeleteKubernetesPersistentVolumeClaimsResponses,
+  DeleteKubernetesPersistentVolumesData,
+  DeleteKubernetesPersistentVolumesErrors,
+  DeleteKubernetesPersistentVolumesResponses,
+  DeleteKubernetesPodData,
+  DeleteKubernetesPodErrors,
+  DeleteKubernetesPodResponses,
+  DeleteKubernetesServicesData,
+  DeleteKubernetesServicesErrors,
+  DeleteKubernetesServicesResponses,
+  DeleteKubernetesStorageClassesData,
+  DeleteKubernetesStorageClassesErrors,
+  DeleteKubernetesStorageClassesResponses,
+  DeleteRoleBindingsData,
+  DeleteRoleBindingsErrors,
+  DeleteRoleBindingsResponses,
+  DeleteRolesData,
+  DeleteRolesErrors,
+  DeleteRolesResponses,
+  DeleteServiceAccountsData,
+  DeleteServiceAccountsErrors,
+  DeleteServiceAccountsResponses,
+  DeleteWebhooksByIdData,
+  DeleteWebhooksByIdErrors,
+  DeleteWebhooksByIdResponses,
+  DescribeResourceData,
+  DescribeResourceErrors,
+  DescribeResourceResponses,
+  DockerContainerGpusInspectData,
+  DockerContainerGpusInspectErrors,
+  DockerContainerGpusInspectResponses,
+  DockerDashboardData,
+  DockerDashboardErrors,
+  DockerDashboardResponses,
+  DockerImagesListData,
+  DockerImagesListErrors,
+  DockerImagesListResponses,
+  DrainNodeData,
+  DrainNodeErrors,
+  DrainNodeResponses,
+  EdgeGroupCreateData,
+  EdgeGroupCreateErrors,
+  EdgeGroupCreateResponses,
+  EdgeGroupDeleteData,
+  EdgeGroupDeleteErrors,
+  EdgeGroupDeleteResponses,
+  EdgeGroupInspectData,
+  EdgeGroupInspectErrors,
+  EdgeGroupInspectResponses,
+  EdgeGroupListData,
+  EdgeGroupListErrors,
+  EdgeGroupListResponses,
+  EdgeGroupUpdateData,
+  EdgeGroupUpdateErrors,
+  EdgeGroupUpdateResponses,
+  EdgeJobCreateFileData,
+  EdgeJobCreateFileErrors,
+  EdgeJobCreateFileResponses,
+  EdgeJobCreateStringData,
+  EdgeJobCreateStringErrors,
+  EdgeJobCreateStringResponses,
+  EdgeJobDeleteData,
+  EdgeJobDeleteErrors,
+  EdgeJobDeleteResponses,
+  EdgeJobFileData,
+  EdgeJobFileErrors,
+  EdgeJobFileResponses,
+  EdgeJobInspectData,
+  EdgeJobInspectErrors,
+  EdgeJobInspectResponses,
+  EdgeJobListData,
+  EdgeJobListErrors,
+  EdgeJobListResponses,
+  EdgeJobTaskLogsInspectData,
+  EdgeJobTaskLogsInspectErrors,
+  EdgeJobTaskLogsInspectResponses,
+  EdgeJobTasksClearData,
+  EdgeJobTasksClearErrors,
+  EdgeJobTasksClearResponses,
+  EdgeJobTasksCollectData,
+  EdgeJobTasksCollectErrors,
+  EdgeJobTasksCollectResponses,
+  EdgeJobTasksListData,
+  EdgeJobTasksListErrors,
+  EdgeJobTasksListResponses,
+  EdgeJobUpdateData,
+  EdgeJobUpdateErrors,
+  EdgeJobUpdateResponses,
+  EdgeStackCreateFileData,
+  EdgeStackCreateFileErrors,
+  EdgeStackCreateFileResponses,
+  EdgeStackCreateRepositoryData,
+  EdgeStackCreateRepositoryErrors,
+  EdgeStackCreateRepositoryResponses,
+  EdgeStackCreateStringData,
+  EdgeStackCreateStringErrors,
+  EdgeStackCreateStringResponses,
+  EdgeStackDeleteData,
+  EdgeStackDeleteErrors,
+  EdgeStackDeleteResponses,
+  EdgeStackFileData,
+  EdgeStackFileErrors,
+  EdgeStackFileResponses,
+  EdgeStackInspectData,
+  EdgeStackInspectErrors,
+  EdgeStackInspectResponses,
+  EdgeStackListData,
+  EdgeStackListErrors,
+  EdgeStackListResponses,
+  EdgeStackStatusUpdateData,
+  EdgeStackStatusUpdateErrors,
+  EdgeStackStatusUpdateResponses,
+  EdgeStackUpdateData,
+  EdgeStackUpdateErrors,
+  EdgeStackUpdateResponses,
+  EndpointAssociationDeleteData,
+  EndpointAssociationDeleteErrors,
+  EndpointAssociationDeleteResponses,
+  EndpointCreateData,
+  EndpointCreateErrors,
+  EndpointCreateGlobalKeyData,
+  EndpointCreateGlobalKeyErrors,
+  EndpointCreateGlobalKeyResponses,
+  EndpointCreateResponses,
+  EndpointDeleteBatchData,
+  EndpointDeleteBatchErrors,
+  EndpointDeleteBatchResponses,
+  EndpointDeleteData,
+  EndpointDeleteErrors,
+  EndpointDeleteResponses,
+  EndpointDockerhubStatusData,
+  EndpointDockerhubStatusErrors,
+  EndpointDockerhubStatusResponses,
+  EndpointForceUpdateServiceData,
+  EndpointForceUpdateServiceErrors,
+  EndpointForceUpdateServiceResponses,
+  EndpointGroupAddEndpointData,
+  EndpointGroupAddEndpointErrors,
+  EndpointGroupAddEndpointResponses,
+  EndpointGroupDeleteData,
+  EndpointGroupDeleteEndpointData,
+  EndpointGroupDeleteEndpointErrors,
+  EndpointGroupDeleteEndpointResponses,
+  EndpointGroupDeleteErrors,
+  EndpointGroupDeleteResponses,
+  EndpointGroupListData,
+  EndpointGroupListErrors,
+  EndpointGroupListResponses,
+  EndpointGroupUpdateData,
+  EndpointGroupUpdateErrors,
+  EndpointGroupUpdateResponses,
+  EndpointInspectData,
+  EndpointInspectErrors,
+  EndpointInspectResponses,
+  EndpointListData,
+  EndpointListErrors,
+  EndpointListResponses,
+  EndpointRegistriesListData,
+  EndpointRegistriesListErrors,
+  EndpointRegistriesListResponses,
+  EndpointRegistryAccessData,
+  EndpointRegistryAccessErrors,
+  EndpointRegistryAccessResponses,
+  EndpointSettingsUpdateData,
+  EndpointSettingsUpdateErrors,
+  EndpointSettingsUpdateResponses,
+  EndpointSnapshotData,
+  EndpointSnapshotErrors,
+  EndpointSnapshotResponses,
+  EndpointSnapshotsData,
+  EndpointSnapshotsErrors,
+  EndpointSnapshotsResponses,
+  EndpointSummaryCountsData,
+  EndpointSummaryCountsErrors,
+  EndpointSummaryCountsResponses,
+  EndpointUpdateData,
+  EndpointUpdateErrors,
+  EndpointUpdateRelationsData,
+  EndpointUpdateRelationsErrors,
+  EndpointUpdateRelationsResponses,
+  EndpointUpdateResponses,
+  GetAllKubernetesApplicationsCountData,
+  GetAllKubernetesApplicationsCountErrors,
+  GetAllKubernetesApplicationsCountResponses,
+  GetAllKubernetesApplicationsData,
+  GetAllKubernetesApplicationsErrors,
+  GetAllKubernetesApplicationsResponses,
+  GetAllKubernetesClusterIngressesCountData,
+  GetAllKubernetesClusterIngressesCountErrors,
+  GetAllKubernetesClusterIngressesCountResponses,
+  GetAllKubernetesClusterIngressesData,
+  GetAllKubernetesClusterIngressesErrors,
+  GetAllKubernetesClusterIngressesResponses,
+  GetAllKubernetesClusterRoleBindingsData,
+  GetAllKubernetesClusterRoleBindingsErrors,
+  GetAllKubernetesClusterRoleBindingsResponses,
+  GetAllKubernetesClusterRolesData,
+  GetAllKubernetesClusterRolesErrors,
+  GetAllKubernetesClusterRolesResponses,
+  GetAllKubernetesConfigMapsCountData,
+  GetAllKubernetesConfigMapsCountErrors,
+  GetAllKubernetesConfigMapsCountResponses,
+  GetAllKubernetesConfigMapsData,
+  GetAllKubernetesConfigMapsErrors,
+  GetAllKubernetesConfigMapsResponses,
+  GetAllKubernetesEventsData,
+  GetAllKubernetesEventsErrors,
+  GetAllKubernetesEventsResponses,
+  GetAllKubernetesIngressControllersData,
+  GetAllKubernetesIngressControllersErrors,
+  GetAllKubernetesIngressControllersResponses,
+  GetAllKubernetesIngressesData,
+  GetAllKubernetesIngressesErrors,
+  GetAllKubernetesIngressesResponses,
+  GetAllKubernetesPersistentVolumeClaimsData,
+  GetAllKubernetesPersistentVolumeClaimsErrors,
+  GetAllKubernetesPersistentVolumeClaimsResponses,
+  GetAllKubernetesPersistentVolumesData,
+  GetAllKubernetesPersistentVolumesErrors,
+  GetAllKubernetesPersistentVolumesResponses,
+  GetAllKubernetesServicesCountData,
+  GetAllKubernetesServicesCountErrors,
+  GetAllKubernetesServicesCountResponses,
+  GetAllKubernetesStorageClassesData,
+  GetAllKubernetesStorageClassesErrors,
+  GetAllKubernetesStorageClassesResponses,
+  GetAllKubernetesVolumesCountData,
+  GetAllKubernetesVolumesCountErrors,
+  GetAllKubernetesVolumesCountResponses,
+  GetAllKubernetesVolumesData,
+  GetAllKubernetesVolumesErrors,
+  GetAllKubernetesVolumesResponses,
+  GetApplicationsResourcesData,
+  GetApplicationsResourcesErrors,
+  GetApplicationsResourcesResponses,
+  GetEndpointGroupsByIdData,
+  GetEndpointGroupsByIdErrors,
+  GetEndpointGroupsByIdResponses,
+  GetKubernetesConfigData,
+  GetKubernetesConfigErrors,
+  GetKubernetesConfigMapData,
+  GetKubernetesConfigMapErrors,
+  GetKubernetesConfigMapResponses,
+  GetKubernetesConfigResponses,
+  GetKubernetesCronJobsData,
+  GetKubernetesCronJobsErrors,
+  GetKubernetesCronJobsResponses,
+  GetKubernetesDashboardData,
+  GetKubernetesDashboardErrors,
+  GetKubernetesDashboardResponses,
+  GetKubernetesEventsForNamespaceData,
+  GetKubernetesEventsForNamespaceErrors,
+  GetKubernetesEventsForNamespaceResponses,
+  GetKubernetesIngressControllersByNamespaceData,
+  GetKubernetesIngressControllersByNamespaceErrors,
+  GetKubernetesIngressControllersByNamespaceResponses,
+  GetKubernetesIngressData,
+  GetKubernetesIngressErrors,
+  GetKubernetesIngressResponses,
+  GetKubernetesJobsData,
+  GetKubernetesJobsErrors,
+  GetKubernetesJobsResponses,
+  GetKubernetesMaxResourceLimitsData,
+  GetKubernetesMaxResourceLimitsErrors,
+  GetKubernetesMaxResourceLimitsResponses,
+  GetKubernetesMetricsForAllNodesData,
+  GetKubernetesMetricsForAllNodesErrors,
+  GetKubernetesMetricsForAllNodesResponses,
+  GetKubernetesMetricsForAllPodsData,
+  GetKubernetesMetricsForAllPodsErrors,
+  GetKubernetesMetricsForAllPodsResponses,
+  GetKubernetesMetricsForNodeData,
+  GetKubernetesMetricsForNodeErrors,
+  GetKubernetesMetricsForNodeResponses,
+  GetKubernetesMetricsForPodData,
+  GetKubernetesMetricsForPodErrors,
+  GetKubernetesMetricsForPodResponses,
+  GetKubernetesNamespaceData,
+  GetKubernetesNamespaceErrors,
+  GetKubernetesNamespaceResponses,
+  GetKubernetesNamespacesCountData,
+  GetKubernetesNamespacesCountErrors,
+  GetKubernetesNamespacesCountResponses,
+  GetKubernetesNamespacesData,
+  GetKubernetesNamespacesErrors,
+  GetKubernetesNamespacesResponses,
+  GetKubernetesNodesData,
+  GetKubernetesNodesErrors,
+  GetKubernetesNodesLimitsData,
+  GetKubernetesNodesLimitsErrors,
+  GetKubernetesNodesLimitsResponses,
+  GetKubernetesNodesResponses,
+  GetKubernetesPersistentVolumeClaimData,
+  GetKubernetesPersistentVolumeClaimErrors,
+  GetKubernetesPersistentVolumeClaimResponses,
+  GetKubernetesPersistentVolumeClaimsInNamespaceData,
+  GetKubernetesPersistentVolumeClaimsInNamespaceErrors,
+  GetKubernetesPersistentVolumeClaimsInNamespaceResponses,
+  GetKubernetesPersistentVolumeData,
+  GetKubernetesPersistentVolumeErrors,
+  GetKubernetesPersistentVolumeResponses,
+  GetKubernetesRbacStatusData,
+  GetKubernetesRbacStatusErrors,
+  GetKubernetesRbacStatusResponses,
+  GetKubernetesRoleBindingsData,
+  GetKubernetesRoleBindingsErrors,
+  GetKubernetesRoleBindingsResponses,
+  GetKubernetesRolesData,
+  GetKubernetesRolesErrors,
+  GetKubernetesRolesResponses,
+  GetKubernetesSecretData,
+  GetKubernetesSecretErrors,
+  GetKubernetesSecretResponses,
+  GetKubernetesSecretsCountData,
+  GetKubernetesSecretsCountErrors,
+  GetKubernetesSecretsCountResponses,
+  GetKubernetesSecretsData,
+  GetKubernetesSecretsErrors,
+  GetKubernetesSecretsResponses,
+  GetKubernetesServiceAccountData,
+  GetKubernetesServiceAccountErrors,
+  GetKubernetesServiceAccountResponses,
+  GetKubernetesServiceAccountsData,
+  GetKubernetesServiceAccountsErrors,
+  GetKubernetesServiceAccountsResponses,
+  GetKubernetesServicesByNamespaceData,
+  GetKubernetesServicesByNamespaceErrors,
+  GetKubernetesServicesByNamespaceResponses,
+  GetKubernetesServicesData,
+  GetKubernetesServicesErrors,
+  GetKubernetesServicesResponses,
+  GetKubernetesStorageClassData,
+  GetKubernetesStorageClassErrors,
+  GetKubernetesStorageClassResponses,
+  GetKubernetesVersionData,
+  GetKubernetesVersionErrors,
+  GetKubernetesVersionResponses,
+  GetKubernetesVolumeData,
+  GetKubernetesVolumeErrors,
+  GetKubernetesVolumeResponses,
+  GetKubernetesVolumesInNamespaceData,
+  GetKubernetesVolumesInNamespaceErrors,
+  GetKubernetesVolumesInNamespaceResponses,
+  GetWebhooksData,
+  GetWebhooksErrors,
+  GetWebhooksResponses,
+  GetWebsocketAttachData,
+  GetWebsocketAttachErrors,
+  GetWebsocketAttachResponses,
+  GetWebsocketExecData,
+  GetWebsocketExecErrors,
+  GetWebsocketExecResponses,
+  GetWebsocketKubernetesShellData,
+  GetWebsocketKubernetesShellErrors,
+  GetWebsocketKubernetesShellResponses,
+  GetWebsocketPodData,
+  GetWebsocketPodErrors,
+  GetWebsocketPodResponses,
+  GitOperationRepoFilePreviewData,
+  GitOperationRepoFilePreviewErrors,
+  GitOperationRepoFilePreviewResponses,
+  GitOpsSourceGetData,
+  GitOpsSourceGetErrors,
+  GitOpsSourceGetResponses,
+  GitOpsSourcesCreateGitData,
+  GitOpsSourcesCreateGitErrors,
+  GitOpsSourcesCreateGitResponses,
+  GitOpsSourcesDeleteData,
+  GitOpsSourcesDeleteErrors,
+  GitOpsSourcesDeleteResponses,
+  GitOpsSourcesListData,
+  GitOpsSourcesListErrors,
+  GitOpsSourcesListResponses,
+  GitOpsSourcesSummaryData,
+  GitOpsSourcesSummaryErrors,
+  GitOpsSourcesSummaryResponses,
+  GitOpsSourcesTestByIdData,
+  GitOpsSourcesTestByIdErrors,
+  GitOpsSourcesTestByIdResponses,
+  GitOpsSourcesTestData,
+  GitOpsSourcesTestErrors,
+  GitOpsSourcesTestResponses,
+  GitOpsSourcesUpdateAccessData,
+  GitOpsSourcesUpdateAccessErrors,
+  GitOpsSourcesUpdateAccessResponses,
+  GitOpsSourcesUpdateGitData,
+  GitOpsSourcesUpdateGitErrors,
+  GitOpsSourcesUpdateGitResponses,
+  GitOpsWorkflowGetData,
+  GitOpsWorkflowGetErrors,
+  GitOpsWorkflowGetResponses,
+  GitOpsWorkflowsListData,
+  GitOpsWorkflowsListErrors,
+  GitOpsWorkflowsListResponses,
+  GitOpsWorkflowsSummaryData,
+  GitOpsWorkflowsSummaryErrors,
+  GitOpsWorkflowsSummaryResponses,
+  HelmDeleteData,
+  HelmDeleteErrors,
+  HelmDeleteResponses,
+  HelmGetData,
+  HelmGetErrors,
+  HelmGetHistoryData,
+  HelmGetHistoryErrors,
+  HelmGetHistoryResponses,
+  HelmGetResponses,
+  HelmInstallData,
+  HelmInstallErrors,
+  HelmInstallResponses,
+  HelmListData,
+  HelmListErrors,
+  HelmListResponses,
+  HelmRepoSearchData,
+  HelmRepoSearchErrors,
+  HelmRepoSearchResponses,
+  HelmRollbackData,
+  HelmRollbackErrors,
+  HelmRollbackResponses,
+  HelmShowData,
+  HelmShowErrors,
+  HelmShowResponses,
+  HelmUserRepositoriesListData,
+  HelmUserRepositoriesListErrors,
+  HelmUserRepositoriesListResponses,
+  HelmUserRepositoryCreateData,
+  HelmUserRepositoryCreateErrors,
+  HelmUserRepositoryCreateResponses,
+  HelmUserRepositoryDeleteData,
+  HelmUserRepositoryDeleteErrors,
+  HelmUserRepositoryDeleteResponses,
+  KubernetesNamespacesToggleSystemData,
+  KubernetesNamespacesToggleSystemErrors,
+  KubernetesNamespacesToggleSystemResponses,
+  LdapCheckData,
+  LdapCheckErrors,
+  LdapCheckResponses,
+  LogoutData,
+  LogoutErrors,
+  LogoutResponses,
+  MotdData,
+  MotdResponses,
+  PostEndpointGroupsData,
+  PostEndpointGroupsErrors,
+  PostEndpointGroupsResponses,
+  PostEndpointsByIdDockerV2BrowsePutData,
+  PostEndpointsByIdDockerV2BrowsePutErrors,
+  PostEndpointsByIdDockerV2BrowsePutResponses,
+  PostWebhooksByIdData,
+  PostWebhooksByIdErrors,
+  PostWebhooksByIdResponses,
+  PostWebhooksData,
+  PostWebhooksErrors,
+  PostWebhooksResponses,
+  PutWebhooksByIdData,
+  PutWebhooksByIdErrors,
+  PutWebhooksByIdResponses,
+  RegistryConfigureData,
+  RegistryConfigureErrors,
+  RegistryConfigureResponses,
+  RegistryCreateData,
+  RegistryCreateErrors,
+  RegistryCreateResponses,
+  RegistryDeleteData,
+  RegistryDeleteErrors,
+  RegistryDeleteResponses,
+  RegistryInspectData,
+  RegistryInspectErrors,
+  RegistryInspectResponses,
+  RegistryListData,
+  RegistryListErrors,
+  RegistryListResponses,
+  RegistryPingData,
+  RegistryPingErrors,
+  RegistryPingResponses,
+  RegistryUpdateData,
+  RegistryUpdateErrors,
+  RegistryUpdateResponses,
+  ResizeKubernetesPersistentVolumeClaimData,
+  ResizeKubernetesPersistentVolumeClaimErrors,
+  ResizeKubernetesPersistentVolumeClaimResponses,
+  ResourceControlCreateData,
+  ResourceControlCreateErrors,
+  ResourceControlCreateResponses,
+  ResourceControlDeleteData,
+  ResourceControlDeleteErrors,
+  ResourceControlDeleteResponses,
+  ResourceControlUpdateData,
+  ResourceControlUpdateErrors,
+  ResourceControlUpdateResponses,
+  RestartKubernetesPodData,
+  RestartKubernetesPodErrors,
+  RestartKubernetesPodResponses,
+  RestoreData,
+  RestoreErrors,
+  RestoreResponses,
+  RoleListData,
+  RoleListErrors,
+  RoleListResponses,
+  SetDefaultKubernetesStorageClassData,
+  SetDefaultKubernetesStorageClassErrors,
+  SetDefaultKubernetesStorageClassResponses,
+  SettingsInspectData,
+  SettingsInspectErrors,
+  SettingsInspectResponses,
+  SettingsPublicData,
+  SettingsPublicErrors,
+  SettingsPublicResponses,
+  SettingsUpdateData,
+  SettingsUpdateErrors,
+  SettingsUpdateResponses,
+  SslInspectData,
+  SslInspectErrors,
+  SslInspectResponses,
+  SslUpdateData,
+  SslUpdateErrors,
+  SslUpdateResponses,
+  StackAssociateData,
+  StackAssociateErrors,
+  StackAssociateResponses,
+  StackCreateDockerStandaloneFileData,
+  StackCreateDockerStandaloneFileErrors,
+  StackCreateDockerStandaloneFileResponses,
+  StackCreateDockerStandaloneRepositoryData,
+  StackCreateDockerStandaloneRepositoryErrors,
+  StackCreateDockerStandaloneRepositoryResponses,
+  StackCreateDockerStandaloneStringData,
+  StackCreateDockerStandaloneStringErrors,
+  StackCreateDockerStandaloneStringResponses,
+  StackCreateDockerSwarmFileData,
+  StackCreateDockerSwarmFileErrors,
+  StackCreateDockerSwarmFileResponses,
+  StackCreateDockerSwarmRepositoryData,
+  StackCreateDockerSwarmRepositoryErrors,
+  StackCreateDockerSwarmRepositoryResponses,
+  StackCreateDockerSwarmStringData,
+  StackCreateDockerSwarmStringErrors,
+  StackCreateDockerSwarmStringResponses,
+  StackCreateKubernetesFileData,
+  StackCreateKubernetesFileErrors,
+  StackCreateKubernetesFileResponses,
+  StackCreateKubernetesGitData,
+  StackCreateKubernetesGitErrors,
+  StackCreateKubernetesGitResponses,
+  StackCreateKubernetesUrlData,
+  StackCreateKubernetesUrlErrors,
+  StackCreateKubernetesUrlResponses,
+  StackDeleteData,
+  StackDeleteErrors,
+  StackDeleteKubernetesByNameData,
+  StackDeleteKubernetesByNameErrors,
+  StackDeleteKubernetesByNameResponses,
+  StackDeleteResponses,
+  StackFileInspectData,
+  StackFileInspectErrors,
+  StackFileInspectResponses,
+  StackGitRedeployData,
+  StackGitRedeployErrors,
+  StackGitRedeployResponses,
+  StackInspectData,
+  StackInspectErrors,
+  StackInspectResponses,
+  StackListData,
+  StackListErrors,
+  StackListResponses,
+  StackMigrateData,
+  StackMigrateErrors,
+  StackMigrateResponses,
+  StackStartData,
+  StackStartErrors,
+  StackStartResponses,
+  StackStopData,
+  StackStopErrors,
+  StackStopResponses,
+  StackUpdateData,
+  StackUpdateErrors,
+  StackUpdateGitData,
+  StackUpdateGitErrors,
+  StackUpdateGitResponses,
+  StackUpdateResponses,
+  SystemInfoData,
+  SystemInfoErrors,
+  SystemInfoResponses,
+  SystemNodesCountData,
+  SystemNodesCountErrors,
+  SystemNodesCountResponses,
+  SystemStatusData,
+  SystemStatusResponses,
+  SystemUpgradeData,
+  SystemUpgradeResponses,
+  SystemVersionData,
+  SystemVersionResponses,
+  TagCreateData,
+  TagCreateErrors,
+  TagCreateResponses,
+  TagDeleteData,
+  TagDeleteErrors,
+  TagDeleteResponses,
+  TagListData,
+  TagListErrors,
+  TagListResponses,
+  TeamCreateData,
+  TeamCreateErrors,
+  TeamCreateResponses,
+  TeamDeleteData,
+  TeamDeleteErrors,
+  TeamDeleteResponses,
+  TeamInspectData,
+  TeamInspectErrors,
+  TeamInspectResponses,
+  TeamListData,
+  TeamListErrors,
+  TeamListResponses,
+  TeamMembershipCreateData,
+  TeamMembershipCreateErrors,
+  TeamMembershipCreateResponses,
+  TeamMembershipDeleteData,
+  TeamMembershipDeleteErrors,
+  TeamMembershipDeleteResponses,
+  TeamMembershipListData,
+  TeamMembershipListErrors,
+  TeamMembershipListResponses,
+  TeamMembershipsData,
+  TeamMembershipsErrors,
+  TeamMembershipsResponses,
+  TeamMembershipUpdateData,
+  TeamMembershipUpdateErrors,
+  TeamMembershipUpdateResponses,
+  TeamUpdateData,
+  TeamUpdateErrors,
+  TeamUpdateResponses,
+  TemplateFileData,
+  TemplateFileErrors,
+  TemplateFileResponses,
+  TemplateListData,
+  TemplateListErrors,
+  TemplateListResponses,
+  UpdateKubernetesIngressControllersByNamespaceData,
+  UpdateKubernetesIngressControllersByNamespaceErrors,
+  UpdateKubernetesIngressControllersByNamespaceResponses,
+  UpdateKubernetesIngressControllersData,
+  UpdateKubernetesIngressControllersErrors,
+  UpdateKubernetesIngressControllersResponses,
+  UpdateKubernetesIngressData,
+  UpdateKubernetesIngressErrors,
+  UpdateKubernetesIngressResponses,
+  UpdateKubernetesNamespaceData,
+  UpdateKubernetesNamespaceDeprecatedData,
+  UpdateKubernetesNamespaceDeprecatedErrors,
+  UpdateKubernetesNamespaceDeprecatedResponses,
+  UpdateKubernetesNamespaceErrors,
+  UpdateKubernetesNamespaceResponses,
+  UpdateKubernetesPersistentVolumeReclaimPolicyData,
+  UpdateKubernetesPersistentVolumeReclaimPolicyErrors,
+  UpdateKubernetesPersistentVolumeReclaimPolicyResponses,
+  UpdateKubernetesServiceAccountImagePullSecretsData,
+  UpdateKubernetesServiceAccountImagePullSecretsErrors,
+  UpdateKubernetesServiceAccountImagePullSecretsResponses,
+  UpdateKubernetesServiceData,
+  UpdateKubernetesServiceErrors,
+  UpdateKubernetesServiceResponses,
+  UploadTlsData,
+  UploadTlsErrors,
+  UploadTlsResponses,
+  UserAdminCheckData,
+  UserAdminCheckErrors,
+  UserAdminCheckResponses,
+  UserAdminInitData,
+  UserAdminInitErrors,
+  UserAdminInitResponses,
+  UserCreateData,
+  UserCreateErrors,
+  UserCreateResponses,
+  UserDeleteData,
+  UserDeleteErrors,
+  UserDeleteResponses,
+  UserEffectiveAccessInspectData,
+  UserEffectiveAccessInspectErrors,
+  UserEffectiveAccessInspectResponses,
+  UserGenerateApiKeyData,
+  UserGenerateApiKeyErrors,
+  UserGenerateApiKeyResponses,
+  UserGetApiKeysData,
+  UserGetApiKeysErrors,
+  UserGetApiKeysResponses,
+  UserInspectData,
+  UserInspectErrors,
+  UserInspectResponses,
+  UserListData,
+  UserListErrors,
+  UserListResponses,
+  UserMembershipsInspectData,
+  UserMembershipsInspectErrors,
+  UserMembershipsInspectResponses,
+  UserRemoveApiKeyData,
+  UserRemoveApiKeyErrors,
+  UserRemoveApiKeyResponses,
+  UserUpdateData,
+  UserUpdateErrors,
+  UserUpdatePasswordData,
+  UserUpdatePasswordErrors,
+  UserUpdatePasswordResponses,
+  UserUpdateResponses,
+  ValidateOAuthData,
+  ValidateOAuthErrors,
+  ValidateOAuthResponses,
+  WebhookInvokeData,
+  WebhookInvokeErrors,
+  WebhookInvokeResponses,
+} from './types.gen';
+import {
+  zAuthenticateUserBody,
+  zAuthenticateUserResponse,
+  zBackupBody,
+  zCreateKubernetesIngressBody,
+  zCreateKubernetesIngressPath,
+  zCreateKubernetesIngressResponse,
+  zCreateKubernetesNamespaceBody,
+  zCreateKubernetesNamespacePath,
+  zCreateKubernetesNamespaceResponse,
+  zCreateKubernetesServiceBody,
+  zCreateKubernetesServicePath,
+  zCreateKubernetesServiceResponse,
+  zCurrentUserInspectResponse,
+  zCustomTemplateCreateFileBody,
+  zCustomTemplateCreateFileResponse,
+  zCustomTemplateCreateRepositoryBody,
+  zCustomTemplateCreateRepositoryResponse,
+  zCustomTemplateCreateStringBody,
+  zCustomTemplateCreateStringResponse,
+  zCustomTemplateDeletePath,
+  zCustomTemplateDeleteResponse,
+  zCustomTemplateFilePath,
+  zCustomTemplateFileResponse,
+  zCustomTemplateGitFetchPath,
+  zCustomTemplateGitFetchResponse,
+  zCustomTemplateInspectPath,
+  zCustomTemplateInspectResponse,
+  zCustomTemplateListQuery,
+  zCustomTemplateListResponse,
+  zCustomTemplateUpdateBody,
+  zCustomTemplateUpdatePath,
+  zCustomTemplateUpdateResponse,
+  zDeleteClusterRoleBindingsBody,
+  zDeleteClusterRoleBindingsPath,
+  zDeleteClusterRoleBindingsResponse,
+  zDeleteClusterRolesBody,
+  zDeleteClusterRolesPath,
+  zDeleteClusterRolesResponse,
+  zDeleteCronJobsBody,
+  zDeleteCronJobsPath,
+  zDeleteCronJobsResponse,
+  zDeleteJobsBody,
+  zDeleteJobsPath,
+  zDeleteJobsResponse,
+  zDeleteKubernetesIngressesBody,
+  zDeleteKubernetesIngressesPath,
+  zDeleteKubernetesIngressesResponse,
+  zDeleteKubernetesNamespacePath,
+  zDeleteKubernetesNamespaceResponse,
+  zDeleteKubernetesPersistentVolumeClaimsBody,
+  zDeleteKubernetesPersistentVolumeClaimsPath,
+  zDeleteKubernetesPersistentVolumeClaimsResponse,
+  zDeleteKubernetesPersistentVolumesBody,
+  zDeleteKubernetesPersistentVolumesPath,
+  zDeleteKubernetesPersistentVolumesResponse,
+  zDeleteKubernetesPodPath,
+  zDeleteKubernetesPodResponse,
+  zDeleteKubernetesServicesBody,
+  zDeleteKubernetesServicesPath,
+  zDeleteKubernetesServicesResponse,
+  zDeleteKubernetesStorageClassesBody,
+  zDeleteKubernetesStorageClassesPath,
+  zDeleteKubernetesStorageClassesResponse,
+  zDeleteRoleBindingsBody,
+  zDeleteRoleBindingsPath,
+  zDeleteRoleBindingsResponse,
+  zDeleteRolesBody,
+  zDeleteRolesPath,
+  zDeleteRolesResponse,
+  zDeleteServiceAccountsBody,
+  zDeleteServiceAccountsPath,
+  zDeleteServiceAccountsResponse,
+  zDeleteWebhooksByIdPath,
+  zDescribeResourcePath,
+  zDescribeResourceQuery,
+  zDescribeResourceResponse,
+  zDockerContainerGpusInspectPath,
+  zDockerContainerGpusInspectResponse,
+  zDockerDashboardPath,
+  zDockerDashboardResponse2,
+  zDockerImagesListPath,
+  zDockerImagesListQuery,
+  zDockerImagesListResponse,
+  zDrainNodePath,
+  zDrainNodeResponse,
+  zEdgeGroupCreateBody,
+  zEdgeGroupCreateResponse,
+  zEdgeGroupDeletePath,
+  zEdgeGroupDeleteResponse,
+  zEdgeGroupInspectPath,
+  zEdgeGroupInspectResponse,
+  zEdgeGroupListResponse,
+  zEdgeGroupUpdateBody,
+  zEdgeGroupUpdatePath,
+  zEdgeGroupUpdateResponse,
+  zEdgeJobCreateFileBody,
+  zEdgeJobCreateFileResponse,
+  zEdgeJobCreateStringBody,
+  zEdgeJobCreateStringResponse,
+  zEdgeJobDeletePath,
+  zEdgeJobDeleteResponse,
+  zEdgeJobFilePath,
+  zEdgeJobFileResponse,
+  zEdgeJobInspectPath,
+  zEdgeJobInspectResponse,
+  zEdgeJobListResponse,
+  zEdgeJobTaskLogsInspectPath,
+  zEdgeJobTaskLogsInspectResponse,
+  zEdgeJobTasksClearPath,
+  zEdgeJobTasksClearResponse,
+  zEdgeJobTasksCollectPath,
+  zEdgeJobTasksCollectResponse,
+  zEdgeJobTasksListPath,
+  zEdgeJobTasksListResponse,
+  zEdgeJobUpdateBody,
+  zEdgeJobUpdatePath,
+  zEdgeJobUpdateResponse,
+  zEdgeStackCreateFileBody,
+  zEdgeStackCreateFileQuery,
+  zEdgeStackCreateFileResponse,
+  zEdgeStackCreateRepositoryBody,
+  zEdgeStackCreateRepositoryQuery,
+  zEdgeStackCreateRepositoryResponse,
+  zEdgeStackCreateStringBody,
+  zEdgeStackCreateStringQuery,
+  zEdgeStackCreateStringResponse,
+  zEdgeStackDeletePath,
+  zEdgeStackDeleteResponse,
+  zEdgeStackFilePath,
+  zEdgeStackFileResponse,
+  zEdgeStackInspectPath,
+  zEdgeStackInspectResponse,
+  zEdgeStackListQuery,
+  zEdgeStackListResponse,
+  zEdgeStackStatusUpdateBody,
+  zEdgeStackStatusUpdatePath,
+  zEdgeStackStatusUpdateResponse,
+  zEdgeStackUpdateBody,
+  zEdgeStackUpdatePath,
+  zEdgeStackUpdateResponse,
+  zEndpointAssociationDeletePath,
+  zEndpointAssociationDeleteResponse,
+  zEndpointCreateBody,
+  zEndpointCreateGlobalKeyResponse,
+  zEndpointCreateResponse,
+  zEndpointDeleteBatchBody,
+  zEndpointDeleteBatchResponse,
+  zEndpointDeletePath,
+  zEndpointDeleteResponse,
+  zEndpointDockerhubStatusPath,
+  zEndpointDockerhubStatusResponse,
+  zEndpointForceUpdateServiceBody,
+  zEndpointForceUpdateServicePath,
+  zEndpointForceUpdateServiceResponse,
+  zEndpointGroupAddEndpointPath,
+  zEndpointGroupAddEndpointResponse,
+  zEndpointGroupDeleteEndpointPath,
+  zEndpointGroupDeleteEndpointResponse,
+  zEndpointGroupDeletePath,
+  zEndpointGroupDeleteResponse,
+  zEndpointGroupListQuery,
+  zEndpointGroupListResponse,
+  zEndpointGroupUpdateBody,
+  zEndpointGroupUpdatePath,
+  zEndpointGroupUpdateResponse,
+  zEndpointInspectPath,
+  zEndpointInspectQuery,
+  zEndpointInspectResponse,
+  zEndpointListQuery,
+  zEndpointListResponse,
+  zEndpointRegistriesListPath,
+  zEndpointRegistriesListQuery,
+  zEndpointRegistriesListResponse,
+  zEndpointRegistryAccessBody,
+  zEndpointRegistryAccessPath,
+  zEndpointRegistryAccessResponse,
+  zEndpointSettingsUpdateBody,
+  zEndpointSettingsUpdatePath,
+  zEndpointSettingsUpdateResponse,
+  zEndpointSnapshotPath,
+  zEndpointSnapshotResponse,
+  zEndpointSnapshotsResponse,
+  zEndpointSummaryCountsResponse,
+  zEndpointUpdateBody,
+  zEndpointUpdatePath,
+  zEndpointUpdateRelationsBody,
+  zEndpointUpdateRelationsResponse,
+  zEndpointUpdateResponse,
+  zGetAllKubernetesApplicationsCountPath,
+  zGetAllKubernetesApplicationsCountResponse,
+  zGetAllKubernetesApplicationsPath,
+  zGetAllKubernetesApplicationsQuery,
+  zGetAllKubernetesApplicationsResponse,
+  zGetAllKubernetesClusterIngressesCountPath,
+  zGetAllKubernetesClusterIngressesCountResponse,
+  zGetAllKubernetesClusterIngressesPath,
+  zGetAllKubernetesClusterIngressesQuery,
+  zGetAllKubernetesClusterIngressesResponse,
+  zGetAllKubernetesClusterRoleBindingsPath,
+  zGetAllKubernetesClusterRoleBindingsResponse,
+  zGetAllKubernetesClusterRolesPath,
+  zGetAllKubernetesClusterRolesResponse,
+  zGetAllKubernetesConfigMapsCountPath,
+  zGetAllKubernetesConfigMapsCountResponse,
+  zGetAllKubernetesConfigMapsPath,
+  zGetAllKubernetesConfigMapsQuery,
+  zGetAllKubernetesConfigMapsResponse,
+  zGetAllKubernetesEventsPath,
+  zGetAllKubernetesEventsQuery,
+  zGetAllKubernetesEventsResponse,
+  zGetAllKubernetesIngressControllersPath,
+  zGetAllKubernetesIngressControllersQuery,
+  zGetAllKubernetesIngressControllersResponse,
+  zGetAllKubernetesIngressesPath,
+  zGetAllKubernetesIngressesResponse,
+  zGetAllKubernetesPersistentVolumeClaimsPath,
+  zGetAllKubernetesPersistentVolumeClaimsResponse,
+  zGetAllKubernetesPersistentVolumesPath,
+  zGetAllKubernetesPersistentVolumesResponse,
+  zGetAllKubernetesServicesCountPath,
+  zGetAllKubernetesServicesCountResponse,
+  zGetAllKubernetesStorageClassesPath,
+  zGetAllKubernetesStorageClassesResponse,
+  zGetAllKubernetesVolumesCountPath,
+  zGetAllKubernetesVolumesCountResponse,
+  zGetAllKubernetesVolumesPath,
+  zGetAllKubernetesVolumesQuery,
+  zGetAllKubernetesVolumesResponse,
+  zGetApplicationsResourcesPath,
+  zGetApplicationsResourcesQuery,
+  zGetApplicationsResourcesResponse,
+  zGetEndpointGroupsByIdPath,
+  zGetEndpointGroupsByIdQuery,
+  zGetEndpointGroupsByIdResponse,
+  zGetKubernetesConfigMapPath,
+  zGetKubernetesConfigMapResponse,
+  zGetKubernetesConfigQuery,
+  zGetKubernetesCronJobsPath,
+  zGetKubernetesCronJobsResponse,
+  zGetKubernetesDashboardPath,
+  zGetKubernetesDashboardResponse,
+  zGetKubernetesEventsForNamespacePath,
+  zGetKubernetesEventsForNamespaceQuery,
+  zGetKubernetesEventsForNamespaceResponse,
+  zGetKubernetesIngressControllersByNamespacePath,
+  zGetKubernetesIngressControllersByNamespaceResponse,
+  zGetKubernetesIngressPath,
+  zGetKubernetesIngressResponse,
+  zGetKubernetesJobsPath,
+  zGetKubernetesJobsQuery,
+  zGetKubernetesJobsResponse,
+  zGetKubernetesMaxResourceLimitsPath,
+  zGetKubernetesMaxResourceLimitsResponse,
+  zGetKubernetesMetricsForAllNodesPath,
+  zGetKubernetesMetricsForAllNodesResponse,
+  zGetKubernetesMetricsForAllPodsPath,
+  zGetKubernetesMetricsForAllPodsResponse,
+  zGetKubernetesMetricsForNodePath,
+  zGetKubernetesMetricsForNodeResponse,
+  zGetKubernetesMetricsForPodPath,
+  zGetKubernetesMetricsForPodResponse,
+  zGetKubernetesNamespacePath,
+  zGetKubernetesNamespaceQuery,
+  zGetKubernetesNamespaceResponse,
+  zGetKubernetesNamespacesCountPath,
+  zGetKubernetesNamespacesCountResponse,
+  zGetKubernetesNamespacesPath,
+  zGetKubernetesNamespacesQuery,
+  zGetKubernetesNamespacesResponse,
+  zGetKubernetesNodesLimitsPath,
+  zGetKubernetesNodesLimitsResponse,
+  zGetKubernetesNodesPath,
+  zGetKubernetesNodesResponse,
+  zGetKubernetesPersistentVolumeClaimPath,
+  zGetKubernetesPersistentVolumeClaimResponse,
+  zGetKubernetesPersistentVolumeClaimsInNamespacePath,
+  zGetKubernetesPersistentVolumeClaimsInNamespaceResponse,
+  zGetKubernetesPersistentVolumePath,
+  zGetKubernetesPersistentVolumeResponse,
+  zGetKubernetesRbacStatusPath,
+  zGetKubernetesRbacStatusResponse,
+  zGetKubernetesRoleBindingsPath,
+  zGetKubernetesRoleBindingsResponse,
+  zGetKubernetesRolesPath,
+  zGetKubernetesRolesResponse,
+  zGetKubernetesSecretPath,
+  zGetKubernetesSecretResponse,
+  zGetKubernetesSecretsCountPath,
+  zGetKubernetesSecretsCountResponse,
+  zGetKubernetesSecretsPath,
+  zGetKubernetesSecretsQuery,
+  zGetKubernetesSecretsResponse,
+  zGetKubernetesServiceAccountPath,
+  zGetKubernetesServiceAccountResponse,
+  zGetKubernetesServiceAccountsPath,
+  zGetKubernetesServiceAccountsResponse,
+  zGetKubernetesServicesByNamespacePath,
+  zGetKubernetesServicesByNamespaceResponse,
+  zGetKubernetesServicesPath,
+  zGetKubernetesServicesQuery,
+  zGetKubernetesServicesResponse,
+  zGetKubernetesStorageClassPath,
+  zGetKubernetesStorageClassResponse,
+  zGetKubernetesVersionPath,
+  zGetKubernetesVersionResponse,
+  zGetKubernetesVolumePath,
+  zGetKubernetesVolumeResponse,
+  zGetKubernetesVolumesInNamespacePath,
+  zGetKubernetesVolumesInNamespaceQuery,
+  zGetKubernetesVolumesInNamespaceResponse,
+  zGetWebhooksQuery,
+  zGetWebhooksResponse,
+  zGetWebsocketAttachQuery,
+  zGetWebsocketExecQuery,
+  zGetWebsocketKubernetesShellQuery,
+  zGetWebsocketPodQuery,
+  zGitOperationRepoFilePreviewBody,
+  zGitOperationRepoFilePreviewResponse,
+  zGitOpsSourceGetPath,
+  zGitOpsSourceGetResponse,
+  zGitOpsSourcesCreateGitBody,
+  zGitOpsSourcesCreateGitResponse,
+  zGitOpsSourcesDeletePath,
+  zGitOpsSourcesDeleteResponse,
+  zGitOpsSourcesListQuery,
+  zGitOpsSourcesListResponse,
+  zGitOpsSourcesSummaryResponse,
+  zGitOpsSourcesTestBody,
+  zGitOpsSourcesTestByIdBody,
+  zGitOpsSourcesTestByIdPath,
+  zGitOpsSourcesTestByIdResponse,
+  zGitOpsSourcesTestResponse,
+  zGitOpsSourcesUpdateAccessBody,
+  zGitOpsSourcesUpdateAccessPath,
+  zGitOpsSourcesUpdateAccessResponse,
+  zGitOpsSourcesUpdateGitBody,
+  zGitOpsSourcesUpdateGitPath,
+  zGitOpsSourcesUpdateGitResponse,
+  zGitOpsWorkflowGetPath,
+  zGitOpsWorkflowGetResponse,
+  zGitOpsWorkflowsListQuery,
+  zGitOpsWorkflowsListResponse,
+  zGitOpsWorkflowsSummaryResponse,
+  zHelmDeletePath,
+  zHelmDeleteQuery,
+  zHelmDeleteResponse,
+  zHelmGetHistoryPath,
+  zHelmGetHistoryQuery,
+  zHelmGetHistoryResponse,
+  zHelmGetPath,
+  zHelmGetQuery,
+  zHelmGetResponse,
+  zHelmInstallBody,
+  zHelmInstallPath,
+  zHelmInstallQuery,
+  zHelmInstallResponse,
+  zHelmListPath,
+  zHelmListQuery,
+  zHelmListResponse,
+  zHelmRepoSearchQuery,
+  zHelmRepoSearchResponse,
+  zHelmRollbackPath,
+  zHelmRollbackQuery,
+  zHelmRollbackResponse,
+  zHelmShowPath,
+  zHelmShowQuery,
+  zHelmShowResponse,
+  zHelmUserRepositoriesListPath,
+  zHelmUserRepositoriesListResponse,
+  zHelmUserRepositoryCreateBody,
+  zHelmUserRepositoryCreatePath,
+  zHelmUserRepositoryCreateResponse,
+  zHelmUserRepositoryDeletePath,
+  zHelmUserRepositoryDeleteResponse,
+  zKubernetesNamespacesToggleSystemBody,
+  zKubernetesNamespacesToggleSystemPath,
+  zKubernetesNamespacesToggleSystemResponse,
+  zLdapCheckBody,
+  zLdapCheckResponse,
+  zLogoutResponse,
+  zMotdResponse,
+  zPostEndpointGroupsBody,
+  zPostEndpointGroupsResponse,
+  zPostEndpointsByIdDockerV2BrowsePutBody,
+  zPostEndpointsByIdDockerV2BrowsePutPath,
+  zPostEndpointsByIdDockerV2BrowsePutQuery,
+  zPostEndpointsByIdDockerV2BrowsePutResponse,
+  zPostWebhooksBody,
+  zPostWebhooksByIdPath,
+  zPostWebhooksResponse,
+  zPutWebhooksByIdBody,
+  zPutWebhooksByIdPath,
+  zPutWebhooksByIdResponse,
+  zRegistryConfigureBody,
+  zRegistryConfigurePath,
+  zRegistryConfigureResponse,
+  zRegistryCreateBody,
+  zRegistryCreateResponse,
+  zRegistryDeletePath,
+  zRegistryDeleteResponse,
+  zRegistryInspectPath,
+  zRegistryInspectResponse,
+  zRegistryListResponse,
+  zRegistryPingBody,
+  zRegistryPingResponse,
+  zRegistryUpdateBody,
+  zRegistryUpdatePath,
+  zRegistryUpdateResponse,
+  zResizeKubernetesPersistentVolumeClaimBody,
+  zResizeKubernetesPersistentVolumeClaimPath,
+  zResizeKubernetesPersistentVolumeClaimResponse,
+  zResourceControlCreateBody,
+  zResourceControlCreateResponse,
+  zResourceControlDeletePath,
+  zResourceControlDeleteResponse,
+  zResourceControlUpdateBody,
+  zResourceControlUpdatePath,
+  zResourceControlUpdateResponse,
+  zRestartKubernetesPodPath,
+  zRestartKubernetesPodResponse,
+  zRestoreBody,
+  zRestoreHeaders,
+  zRoleListResponse,
+  zSetDefaultKubernetesStorageClassPath,
+  zSetDefaultKubernetesStorageClassResponse,
+  zSettingsInspectResponse,
+  zSettingsPublicResponse,
+  zSettingsUpdateBody,
+  zSettingsUpdateResponse,
+  zSslInspectResponse,
+  zSslUpdateBody,
+  zSslUpdateResponse,
+  zStackAssociatePath,
+  zStackAssociateQuery,
+  zStackAssociateResponse,
+  zStackCreateDockerStandaloneFileBody,
+  zStackCreateDockerStandaloneFileQuery,
+  zStackCreateDockerStandaloneFileResponse,
+  zStackCreateDockerStandaloneRepositoryBody,
+  zStackCreateDockerStandaloneRepositoryQuery,
+  zStackCreateDockerStandaloneRepositoryResponse,
+  zStackCreateDockerStandaloneStringBody,
+  zStackCreateDockerStandaloneStringQuery,
+  zStackCreateDockerStandaloneStringResponse,
+  zStackCreateDockerSwarmFileBody,
+  zStackCreateDockerSwarmFileQuery,
+  zStackCreateDockerSwarmFileResponse,
+  zStackCreateDockerSwarmRepositoryBody,
+  zStackCreateDockerSwarmRepositoryQuery,
+  zStackCreateDockerSwarmRepositoryResponse,
+  zStackCreateDockerSwarmStringBody,
+  zStackCreateDockerSwarmStringQuery,
+  zStackCreateDockerSwarmStringResponse,
+  zStackCreateKubernetesFileBody,
+  zStackCreateKubernetesFileQuery,
+  zStackCreateKubernetesFileResponse,
+  zStackCreateKubernetesGitBody,
+  zStackCreateKubernetesGitQuery,
+  zStackCreateKubernetesGitResponse,
+  zStackCreateKubernetesUrlBody,
+  zStackCreateKubernetesUrlQuery,
+  zStackCreateKubernetesUrlResponse,
+  zStackDeleteKubernetesByNamePath,
+  zStackDeleteKubernetesByNameQuery,
+  zStackDeleteKubernetesByNameResponse,
+  zStackDeletePath,
+  zStackDeleteQuery,
+  zStackDeleteResponse,
+  zStackFileInspectPath,
+  zStackFileInspectResponse,
+  zStackGitRedeployBody,
+  zStackGitRedeployPath,
+  zStackGitRedeployQuery,
+  zStackGitRedeployResponse,
+  zStackInspectPath,
+  zStackInspectResponse,
+  zStackListQuery,
+  zStackListResponse,
+  zStackMigrateBody,
+  zStackMigratePath,
+  zStackMigrateQuery,
+  zStackMigrateResponse,
+  zStackStartPath,
+  zStackStartQuery,
+  zStackStartResponse,
+  zStackStopPath,
+  zStackStopQuery,
+  zStackStopResponse,
+  zStackUpdateBody,
+  zStackUpdateGitBody,
+  zStackUpdateGitPath,
+  zStackUpdateGitQuery,
+  zStackUpdateGitResponse,
+  zStackUpdatePath,
+  zStackUpdateQuery,
+  zStackUpdateResponse,
+  zSystemInfoResponse,
+  zSystemNodesCountResponse2,
+  zSystemStatusResponse,
+  zSystemUpgradeResponse,
+  zSystemVersionResponse2,
+  zTagCreateBody,
+  zTagCreateResponse,
+  zTagDeletePath,
+  zTagDeleteResponse,
+  zTagListResponse,
+  zTeamCreateBody,
+  zTeamCreateResponse,
+  zTeamDeletePath,
+  zTeamDeleteResponse,
+  zTeamInspectPath,
+  zTeamInspectResponse,
+  zTeamListQuery,
+  zTeamListResponse,
+  zTeamMembershipCreateBody,
+  zTeamMembershipCreateResponse,
+  zTeamMembershipDeletePath,
+  zTeamMembershipDeleteResponse,
+  zTeamMembershipListResponse,
+  zTeamMembershipsPath,
+  zTeamMembershipsResponse,
+  zTeamMembershipUpdateBody,
+  zTeamMembershipUpdatePath,
+  zTeamMembershipUpdateResponse,
+  zTeamUpdateBody,
+  zTeamUpdatePath,
+  zTeamUpdateResponse,
+  zTemplateFilePath,
+  zTemplateFileResponse,
+  zTemplateListResponse,
+  zUpdateKubernetesIngressBody,
+  zUpdateKubernetesIngressControllersBody,
+  zUpdateKubernetesIngressControllersByNamespaceBody,
+  zUpdateKubernetesIngressControllersByNamespacePath,
+  zUpdateKubernetesIngressControllersByNamespaceResponse,
+  zUpdateKubernetesIngressControllersPath,
+  zUpdateKubernetesIngressControllersResponse,
+  zUpdateKubernetesIngressPath,
+  zUpdateKubernetesIngressResponse,
+  zUpdateKubernetesNamespaceBody,
+  zUpdateKubernetesNamespaceDeprecatedBody,
+  zUpdateKubernetesNamespaceDeprecatedPath,
+  zUpdateKubernetesNamespaceDeprecatedResponse,
+  zUpdateKubernetesNamespacePath,
+  zUpdateKubernetesNamespaceResponse,
+  zUpdateKubernetesPersistentVolumeReclaimPolicyBody,
+  zUpdateKubernetesPersistentVolumeReclaimPolicyPath,
+  zUpdateKubernetesPersistentVolumeReclaimPolicyResponse,
+  zUpdateKubernetesServiceAccountImagePullSecretsBody,
+  zUpdateKubernetesServiceAccountImagePullSecretsPath,
+  zUpdateKubernetesServiceAccountImagePullSecretsResponse,
+  zUpdateKubernetesServiceBody,
+  zUpdateKubernetesServicePath,
+  zUpdateKubernetesServiceResponse,
+  zUploadTlsBody,
+  zUploadTlsPath,
+  zUploadTlsResponse,
+  zUserAdminCheckResponse,
+  zUserAdminInitBody,
+  zUserAdminInitHeaders,
+  zUserAdminInitResponse,
+  zUserCreateBody,
+  zUserCreateResponse,
+  zUserDeletePath,
+  zUserDeleteResponse,
+  zUserEffectiveAccessInspectPath,
+  zUserEffectiveAccessInspectResponse,
+  zUserGenerateApiKeyBody,
+  zUserGenerateApiKeyPath,
+  zUserGenerateApiKeyResponse,
+  zUserGetApiKeysPath,
+  zUserGetApiKeysResponse,
+  zUserInspectPath,
+  zUserInspectResponse,
+  zUserListQuery,
+  zUserListResponse,
+  zUserMembershipsInspectPath,
+  zUserMembershipsInspectResponse,
+  zUserRemoveApiKeyPath,
+  zUserRemoveApiKeyResponse,
+  zUserUpdateBody,
+  zUserUpdatePasswordBody,
+  zUserUpdatePasswordPath,
+  zUserUpdatePasswordResponse,
+  zUserUpdatePath,
+  zUserUpdateResponse,
+  zValidateOAuthBody,
+  zValidateOAuthResponse,
+  zWebhookInvokePath,
+} from './zod.gen';
+
+export type Options<
+  TData extends TDataShape = TDataShape,
+  ThrowOnError extends boolean = boolean,
+  TResponse = unknown,
+> = Options2<TData, ThrowOnError, TResponse> & {
+  /**
+   * You can provide a client instance returned by `createClient()` instead of
+   * individual options. This might be also useful if you want to implement a
+   * custom client.
+   */
+  client?: Client;
+  /**
+   * You can pass arbitrary values through the `meta` object. This can be
+   * used to access values that aren't defined as part of the SDK function.
+   */
+  meta?: keyof ClientMeta extends never ? Record<string, unknown> : ClientMeta;
+};
+
+/**
+ * Authenticate
+ *
+ * **Access policy**: public
+ * Use this environment(endpoint) to authenticate against Portainer using a username and password.
+ */
+export const authenticateUser = <ThrowOnError extends boolean = true>(
+  options: Options<AuthenticateUserData, ThrowOnError>
+): RequestResult<
+  AuthenticateUserResponses,
+  AuthenticateUserErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    AuthenticateUserResponses,
+    AuthenticateUserErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zAuthenticateUserBody,
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zAuthenticateUserResponse.parseAsync(data),
+    url: '/auth',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Logout
+ *
+ * **Access policy**: public
+ */
+export const logout = <ThrowOnError extends boolean = true>(
+  options?: Options<LogoutData, ThrowOnError>
+): RequestResult<LogoutResponses, LogoutErrors, ThrowOnError> =>
+  (options?.client ?? client).post<LogoutResponses, LogoutErrors, ThrowOnError>(
+    {
+      requestValidator: async (data) =>
+        await z
+          .object({
+            body: z.never().optional(),
+            path: z.never().optional(),
+            query: z.never().optional(),
+          })
+          .parseAsync(data),
+      responseValidator: async (data) => await zLogoutResponse.parseAsync(data),
+      security: [
+        { name: 'X-API-KEY', type: 'apiKey' },
+        { name: 'Authorization', type: 'apiKey' },
+      ],
+      url: '/auth/logout',
+      ...options,
+    }
+  );
+
+/**
+ * Authenticate with OAuth
+ *
+ * **Access policy**: public
+ */
+export const validateOAuth = <ThrowOnError extends boolean = true>(
+  options: Options<ValidateOAuthData, ThrowOnError>
+): RequestResult<ValidateOAuthResponses, ValidateOAuthErrors, ThrowOnError> =>
+  (options.client ?? client).post<
+    ValidateOAuthResponses,
+    ValidateOAuthErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zValidateOAuthBody,
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zValidateOAuthResponse.parseAsync(data),
+    url: '/auth/oauth/validate',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Creates an archive with a system data snapshot that could be used to restore the system.
+ *
+ * Creates an archive with a system data snapshot that could be used to restore the system.
+ * **Access policy**: admin
+ */
+export const backup = <ThrowOnError extends boolean = true>(
+  options?: Options<BackupData, ThrowOnError>
+): RequestResult<BackupResponses, BackupErrors, ThrowOnError> =>
+  (options?.client ?? client).post<BackupResponses, BackupErrors, ThrowOnError>(
+    {
+      requestValidator: async (data) =>
+        await z
+          .object({
+            body: zBackupBody.optional(),
+            path: z.never().optional(),
+            query: z.never().optional(),
+          })
+          .parseAsync(data),
+      security: [
+        { name: 'X-API-KEY', type: 'apiKey' },
+        { name: 'Authorization', type: 'apiKey' },
+      ],
+      url: '/backup',
+      ...options,
+      headers: {
+        'Content-Type': 'application/json',
+        ...options?.headers,
+      },
+    }
+  );
+
+/**
+ * List available custom templates
+ *
+ * List available custom templates.
+ * **Access policy**: authenticated
+ */
+export const customTemplateList = <ThrowOnError extends boolean = true>(
+  options: Options<CustomTemplateListData, ThrowOnError>
+): RequestResult<
+  CustomTemplateListResponses,
+  CustomTemplateListErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    CustomTemplateListResponses,
+    CustomTemplateListErrors,
+    ThrowOnError
+  >({
+    querySerializer: { parameters: { type: { array: { explode: false } } } },
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: z.never().optional(),
+          query: zCustomTemplateListQuery,
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zCustomTemplateListResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/custom_templates',
+    ...options,
+  });
+
+/**
+ * Remove a template
+ *
+ * Remove a template.
+ * **Access policy**: authenticated
+ */
+export const customTemplateDelete = <ThrowOnError extends boolean = true>(
+  options: Options<CustomTemplateDeleteData, ThrowOnError>
+): RequestResult<
+  CustomTemplateDeleteResponses,
+  CustomTemplateDeleteErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).delete<
+    CustomTemplateDeleteResponses,
+    CustomTemplateDeleteErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zCustomTemplateDeletePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zCustomTemplateDeleteResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/custom_templates/{id}',
+    ...options,
+  });
+
+/**
+ * Inspect a custom template
+ *
+ * Retrieve details about a template.
+ * **Access policy**: authenticated
+ */
+export const customTemplateInspect = <ThrowOnError extends boolean = true>(
+  options: Options<CustomTemplateInspectData, ThrowOnError>
+): RequestResult<
+  CustomTemplateInspectResponses,
+  CustomTemplateInspectErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    CustomTemplateInspectResponses,
+    CustomTemplateInspectErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zCustomTemplateInspectPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zCustomTemplateInspectResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/custom_templates/{id}',
+    ...options,
+  });
+
+/**
+ * Update a template
+ *
+ * Update a template.
+ * **Access policy**: authenticated
+ */
+export const customTemplateUpdate = <ThrowOnError extends boolean = true>(
+  options: Options<CustomTemplateUpdateData, ThrowOnError>
+): RequestResult<
+  CustomTemplateUpdateResponses,
+  CustomTemplateUpdateErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).put<
+    CustomTemplateUpdateResponses,
+    CustomTemplateUpdateErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zCustomTemplateUpdateBody,
+          path: zCustomTemplateUpdatePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zCustomTemplateUpdateResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/custom_templates/{id}',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Get Template stack file content.
+ *
+ * Retrieve the content of the Stack file for the specified custom template
+ * **Access policy**: authenticated
+ */
+export const customTemplateFile = <ThrowOnError extends boolean = true>(
+  options: Options<CustomTemplateFileData, ThrowOnError>
+): RequestResult<
+  CustomTemplateFileResponses,
+  CustomTemplateFileErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    CustomTemplateFileResponses,
+    CustomTemplateFileErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zCustomTemplateFilePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zCustomTemplateFileResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/custom_templates/{id}/file',
+    ...options,
+  });
+
+/**
+ * Fetch the latest config file content based on custom template's git repository configuration
+ *
+ * Retrieve details about a template created from git repository method.
+ * **Access policy**: authenticated
+ */
+export const customTemplateGitFetch = <ThrowOnError extends boolean = true>(
+  options: Options<CustomTemplateGitFetchData, ThrowOnError>
+): RequestResult<
+  CustomTemplateGitFetchResponses,
+  CustomTemplateGitFetchErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).put<
+    CustomTemplateGitFetchResponses,
+    CustomTemplateGitFetchErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zCustomTemplateGitFetchPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zCustomTemplateGitFetchResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/custom_templates/{id}/git_fetch',
+    ...options,
+  });
+
+/**
+ * Create a custom template
+ *
+ * Create a custom template.
+ * **Access policy**: authenticated
+ */
+export const customTemplateCreateFile = <ThrowOnError extends boolean = true>(
+  options: Options<CustomTemplateCreateFileData, ThrowOnError>
+): RequestResult<
+  CustomTemplateCreateFileResponses,
+  CustomTemplateCreateFileErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    CustomTemplateCreateFileResponses,
+    CustomTemplateCreateFileErrors,
+    ThrowOnError
+  >({
+    ...formDataBodySerializer,
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zCustomTemplateCreateFileBody,
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zCustomTemplateCreateFileResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/custom_templates/create/file',
+    ...options,
+    headers: {
+      'Content-Type': null,
+      ...options.headers,
+    },
+  });
+
+/**
+ * Create a custom template
+ *
+ * Create a custom template.
+ * **Access policy**: authenticated
+ */
+export const customTemplateCreateRepository = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<CustomTemplateCreateRepositoryData, ThrowOnError>
+): RequestResult<
+  CustomTemplateCreateRepositoryResponses,
+  CustomTemplateCreateRepositoryErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    CustomTemplateCreateRepositoryResponses,
+    CustomTemplateCreateRepositoryErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zCustomTemplateCreateRepositoryBody,
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zCustomTemplateCreateRepositoryResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/custom_templates/create/repository',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Create a custom template
+ *
+ * Create a custom template.
+ * **Access policy**: authenticated
+ */
+export const customTemplateCreateString = <ThrowOnError extends boolean = true>(
+  options: Options<CustomTemplateCreateStringData, ThrowOnError>
+): RequestResult<
+  CustomTemplateCreateStringResponses,
+  CustomTemplateCreateStringErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    CustomTemplateCreateStringResponses,
+    CustomTemplateCreateStringErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zCustomTemplateCreateStringBody,
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zCustomTemplateCreateStringResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/custom_templates/create/string',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Fetch container gpus data
+ *
+ * **Access policy**:
+ */
+export const dockerContainerGpusInspect = <ThrowOnError extends boolean = true>(
+  options: Options<DockerContainerGpusInspectData, ThrowOnError>
+): RequestResult<
+  DockerContainerGpusInspectResponses,
+  DockerContainerGpusInspectErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    DockerContainerGpusInspectResponses,
+    DockerContainerGpusInspectErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zDockerContainerGpusInspectPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zDockerContainerGpusInspectResponse.parseAsync(data),
+    security: [{ name: 'Authorization', type: 'apiKey' }],
+    url: '/docker/{environmentId}/containers/{containerId}/gpus',
+    ...options,
+  });
+
+/**
+ * Get counters for the dashboard
+ *
+ * **Access policy**: restricted
+ */
+export const dockerDashboard = <ThrowOnError extends boolean = true>(
+  options: Options<DockerDashboardData, ThrowOnError>
+): RequestResult<
+  DockerDashboardResponses,
+  DockerDashboardErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    DockerDashboardResponses,
+    DockerDashboardErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zDockerDashboardPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zDockerDashboardResponse2.parseAsync(data),
+    security: [{ name: 'Authorization', type: 'apiKey' }],
+    url: '/docker/{environmentId}/dashboard',
+    ...options,
+  });
+
+/**
+ * Fetch images
+ *
+ * **Access policy**:
+ */
+export const dockerImagesList = <ThrowOnError extends boolean = true>(
+  options: Options<DockerImagesListData, ThrowOnError>
+): RequestResult<
+  DockerImagesListResponses,
+  DockerImagesListErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    DockerImagesListResponses,
+    DockerImagesListErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zDockerImagesListPath,
+          query: zDockerImagesListQuery.optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zDockerImagesListResponse.parseAsync(data),
+    security: [{ name: 'Authorization', type: 'apiKey' }],
+    url: '/docker/{environmentId}/images',
+    ...options,
+  });
+
+/**
+ * list EdgeGroups
+ *
+ * **Access policy**: administrator
+ */
+export const edgeGroupList = <ThrowOnError extends boolean = true>(
+  options?: Options<EdgeGroupListData, ThrowOnError>
+): RequestResult<EdgeGroupListResponses, EdgeGroupListErrors, ThrowOnError> =>
+  (options?.client ?? client).get<
+    EdgeGroupListResponses,
+    EdgeGroupListErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zEdgeGroupListResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/edge_groups',
+    ...options,
+  });
+
+/**
+ * Create an EdgeGroup
+ *
+ * **Access policy**: administrator
+ */
+export const edgeGroupCreate = <ThrowOnError extends boolean = true>(
+  options: Options<EdgeGroupCreateData, ThrowOnError>
+): RequestResult<
+  EdgeGroupCreateResponses,
+  EdgeGroupCreateErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    EdgeGroupCreateResponses,
+    EdgeGroupCreateErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zEdgeGroupCreateBody,
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zEdgeGroupCreateResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/edge_groups',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Deletes an EdgeGroup
+ *
+ * **Access policy**: administrator
+ */
+export const edgeGroupDelete = <ThrowOnError extends boolean = true>(
+  options: Options<EdgeGroupDeleteData, ThrowOnError>
+): RequestResult<
+  EdgeGroupDeleteResponses,
+  EdgeGroupDeleteErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).delete<
+    EdgeGroupDeleteResponses,
+    EdgeGroupDeleteErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zEdgeGroupDeletePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zEdgeGroupDeleteResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/edge_groups/{id}',
+    ...options,
+  });
+
+/**
+ * Inspects an EdgeGroup
+ *
+ * **Access policy**: administrator
+ */
+export const edgeGroupInspect = <ThrowOnError extends boolean = true>(
+  options: Options<EdgeGroupInspectData, ThrowOnError>
+): RequestResult<
+  EdgeGroupInspectResponses,
+  EdgeGroupInspectErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    EdgeGroupInspectResponses,
+    EdgeGroupInspectErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zEdgeGroupInspectPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zEdgeGroupInspectResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/edge_groups/{id}',
+    ...options,
+  });
+
+/**
+ * Updates an EdgeGroup
+ *
+ * **Access policy**: administrator
+ */
+export const edgeGroupUpdate = <ThrowOnError extends boolean = true>(
+  options: Options<EdgeGroupUpdateData, ThrowOnError>
+): RequestResult<
+  EdgeGroupUpdateResponses,
+  EdgeGroupUpdateErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).put<
+    EdgeGroupUpdateResponses,
+    EdgeGroupUpdateErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zEdgeGroupUpdateBody,
+          path: zEdgeGroupUpdatePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zEdgeGroupUpdateResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/edge_groups/{id}',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Fetch EdgeJobs list
+ *
+ * **Access policy**: administrator
+ */
+export const edgeJobList = <ThrowOnError extends boolean = true>(
+  options?: Options<EdgeJobListData, ThrowOnError>
+): RequestResult<EdgeJobListResponses, EdgeJobListErrors, ThrowOnError> =>
+  (options?.client ?? client).get<
+    EdgeJobListResponses,
+    EdgeJobListErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zEdgeJobListResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/edge_jobs',
+    ...options,
+  });
+
+/**
+ * Delete an EdgeJob
+ *
+ * **Access policy**: administrator
+ */
+export const edgeJobDelete = <ThrowOnError extends boolean = true>(
+  options: Options<EdgeJobDeleteData, ThrowOnError>
+): RequestResult<EdgeJobDeleteResponses, EdgeJobDeleteErrors, ThrowOnError> =>
+  (options.client ?? client).delete<
+    EdgeJobDeleteResponses,
+    EdgeJobDeleteErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zEdgeJobDeletePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zEdgeJobDeleteResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/edge_jobs/{id}',
+    ...options,
+  });
+
+/**
+ * Inspect an EdgeJob
+ *
+ * **Access policy**: administrator
+ */
+export const edgeJobInspect = <ThrowOnError extends boolean = true>(
+  options: Options<EdgeJobInspectData, ThrowOnError>
+): RequestResult<EdgeJobInspectResponses, EdgeJobInspectErrors, ThrowOnError> =>
+  (options.client ?? client).get<
+    EdgeJobInspectResponses,
+    EdgeJobInspectErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zEdgeJobInspectPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zEdgeJobInspectResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/edge_jobs/{id}',
+    ...options,
+  });
+
+/**
+ * Update an EdgeJob
+ *
+ * **Access policy**: administrator
+ */
+export const edgeJobUpdate = <ThrowOnError extends boolean = true>(
+  options: Options<EdgeJobUpdateData, ThrowOnError>
+): RequestResult<EdgeJobUpdateResponses, EdgeJobUpdateErrors, ThrowOnError> =>
+  (options.client ?? client).put<
+    EdgeJobUpdateResponses,
+    EdgeJobUpdateErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zEdgeJobUpdateBody,
+          path: zEdgeJobUpdatePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zEdgeJobUpdateResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/edge_jobs/{id}',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Fetch a file of an EdgeJob
+ *
+ * **Access policy**: administrator
+ */
+export const edgeJobFile = <ThrowOnError extends boolean = true>(
+  options: Options<EdgeJobFileData, ThrowOnError>
+): RequestResult<EdgeJobFileResponses, EdgeJobFileErrors, ThrowOnError> =>
+  (options.client ?? client).get<
+    EdgeJobFileResponses,
+    EdgeJobFileErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zEdgeJobFilePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zEdgeJobFileResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/edge_jobs/{id}/file',
+    ...options,
+  });
+
+/**
+ * Fetch the list of tasks on an EdgeJob
+ *
+ * **Access policy**: administrator
+ */
+export const edgeJobTasksList = <ThrowOnError extends boolean = true>(
+  options: Options<EdgeJobTasksListData, ThrowOnError>
+): RequestResult<
+  EdgeJobTasksListResponses,
+  EdgeJobTasksListErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    EdgeJobTasksListResponses,
+    EdgeJobTasksListErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zEdgeJobTasksListPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zEdgeJobTasksListResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/edge_jobs/{id}/tasks',
+    ...options,
+  });
+
+/**
+ * Clear the log for a specifc task on an EdgeJob
+ *
+ * **Access policy**: administrator
+ */
+export const edgeJobTasksClear = <ThrowOnError extends boolean = true>(
+  options: Options<EdgeJobTasksClearData, ThrowOnError>
+): RequestResult<
+  EdgeJobTasksClearResponses,
+  EdgeJobTasksClearErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).delete<
+    EdgeJobTasksClearResponses,
+    EdgeJobTasksClearErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zEdgeJobTasksClearPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zEdgeJobTasksClearResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/edge_jobs/{id}/tasks/{taskID}/logs',
+    ...options,
+  });
+
+/**
+ * Fetch the log for a specifc task on an EdgeJob
+ *
+ * **Access policy**: administrator
+ */
+export const edgeJobTaskLogsInspect = <ThrowOnError extends boolean = true>(
+  options: Options<EdgeJobTaskLogsInspectData, ThrowOnError>
+): RequestResult<
+  EdgeJobTaskLogsInspectResponses,
+  EdgeJobTaskLogsInspectErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    EdgeJobTaskLogsInspectResponses,
+    EdgeJobTaskLogsInspectErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zEdgeJobTaskLogsInspectPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zEdgeJobTaskLogsInspectResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/edge_jobs/{id}/tasks/{taskID}/logs',
+    ...options,
+  });
+
+/**
+ * Collect the log for a specifc task on an EdgeJob
+ *
+ * **Access policy**: administrator
+ */
+export const edgeJobTasksCollect = <ThrowOnError extends boolean = true>(
+  options: Options<EdgeJobTasksCollectData, ThrowOnError>
+): RequestResult<
+  EdgeJobTasksCollectResponses,
+  EdgeJobTasksCollectErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    EdgeJobTasksCollectResponses,
+    EdgeJobTasksCollectErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zEdgeJobTasksCollectPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zEdgeJobTasksCollectResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/edge_jobs/{id}/tasks/{taskID}/logs',
+    ...options,
+  });
+
+/**
+ * Create an EdgeJob from a file
+ *
+ * **Access policy**: administrator
+ */
+export const edgeJobCreateFile = <ThrowOnError extends boolean = true>(
+  options: Options<EdgeJobCreateFileData, ThrowOnError>
+): RequestResult<
+  EdgeJobCreateFileResponses,
+  EdgeJobCreateFileErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    EdgeJobCreateFileResponses,
+    EdgeJobCreateFileErrors,
+    ThrowOnError
+  >({
+    ...formDataBodySerializer,
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zEdgeJobCreateFileBody,
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zEdgeJobCreateFileResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/edge_jobs/create/file',
+    ...options,
+    headers: {
+      'Content-Type': null,
+      ...options.headers,
+    },
+  });
+
+/**
+ * Create an EdgeJob from a text
+ *
+ * **Access policy**: administrator
+ */
+export const edgeJobCreateString = <ThrowOnError extends boolean = true>(
+  options: Options<EdgeJobCreateStringData, ThrowOnError>
+): RequestResult<
+  EdgeJobCreateStringResponses,
+  EdgeJobCreateStringErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    EdgeJobCreateStringResponses,
+    EdgeJobCreateStringErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zEdgeJobCreateStringBody,
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zEdgeJobCreateStringResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/edge_jobs/create/string',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Fetches the list of EdgeStacks
+ *
+ * **Access policy**: administrator
+ */
+export const edgeStackList = <ThrowOnError extends boolean = true>(
+  options?: Options<EdgeStackListData, ThrowOnError>
+): RequestResult<EdgeStackListResponses, EdgeStackListErrors, ThrowOnError> =>
+  (options?.client ?? client).get<
+    EdgeStackListResponses,
+    EdgeStackListErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: z.never().optional(),
+          query: zEdgeStackListQuery.optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zEdgeStackListResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/edge_stacks',
+    ...options,
+  });
+
+/**
+ * Delete an EdgeStack
+ *
+ * **Access policy**: administrator
+ */
+export const edgeStackDelete = <ThrowOnError extends boolean = true>(
+  options: Options<EdgeStackDeleteData, ThrowOnError>
+): RequestResult<
+  EdgeStackDeleteResponses,
+  EdgeStackDeleteErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).delete<
+    EdgeStackDeleteResponses,
+    EdgeStackDeleteErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zEdgeStackDeletePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zEdgeStackDeleteResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/edge_stacks/{id}',
+    ...options,
+  });
+
+/**
+ * Inspect an EdgeStack
+ *
+ * **Access policy**: administrator
+ */
+export const edgeStackInspect = <ThrowOnError extends boolean = true>(
+  options: Options<EdgeStackInspectData, ThrowOnError>
+): RequestResult<
+  EdgeStackInspectResponses,
+  EdgeStackInspectErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    EdgeStackInspectResponses,
+    EdgeStackInspectErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zEdgeStackInspectPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zEdgeStackInspectResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/edge_stacks/{id}',
+    ...options,
+  });
+
+/**
+ * Update an EdgeStack
+ *
+ * **Access policy**: administrator
+ */
+export const edgeStackUpdate = <ThrowOnError extends boolean = true>(
+  options: Options<EdgeStackUpdateData, ThrowOnError>
+): RequestResult<
+  EdgeStackUpdateResponses,
+  EdgeStackUpdateErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).put<
+    EdgeStackUpdateResponses,
+    EdgeStackUpdateErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zEdgeStackUpdateBody,
+          path: zEdgeStackUpdatePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zEdgeStackUpdateResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/edge_stacks/{id}',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Fetches the stack file for an EdgeStack
+ *
+ * **Access policy**: administrator
+ */
+export const edgeStackFile = <ThrowOnError extends boolean = true>(
+  options: Options<EdgeStackFileData, ThrowOnError>
+): RequestResult<EdgeStackFileResponses, EdgeStackFileErrors, ThrowOnError> =>
+  (options.client ?? client).get<
+    EdgeStackFileResponses,
+    EdgeStackFileErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zEdgeStackFilePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zEdgeStackFileResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/edge_stacks/{id}/file',
+    ...options,
+  });
+
+/**
+ * Update an EdgeStack status
+ *
+ * Authorized only if the request is done by an Edge Environment(Endpoint)
+ */
+export const edgeStackStatusUpdate = <ThrowOnError extends boolean = true>(
+  options: Options<EdgeStackStatusUpdateData, ThrowOnError>
+): RequestResult<
+  EdgeStackStatusUpdateResponses,
+  EdgeStackStatusUpdateErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).put<
+    EdgeStackStatusUpdateResponses,
+    EdgeStackStatusUpdateErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zEdgeStackStatusUpdateBody,
+          path: zEdgeStackStatusUpdatePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zEdgeStackStatusUpdateResponse.parseAsync(data),
+    url: '/edge_stacks/{id}/status',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Create an EdgeStack from file
+ *
+ * **Access policy**: administrator
+ */
+export const edgeStackCreateFile = <ThrowOnError extends boolean = true>(
+  options: Options<EdgeStackCreateFileData, ThrowOnError>
+): RequestResult<
+  EdgeStackCreateFileResponses,
+  EdgeStackCreateFileErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    EdgeStackCreateFileResponses,
+    EdgeStackCreateFileErrors,
+    ThrowOnError
+  >({
+    ...formDataBodySerializer,
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zEdgeStackCreateFileBody,
+          path: z.never().optional(),
+          query: zEdgeStackCreateFileQuery.optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zEdgeStackCreateFileResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/edge_stacks/create/file',
+    ...options,
+    headers: {
+      'Content-Type': null,
+      ...options.headers,
+    },
+  });
+
+/**
+ * Create an EdgeStack from a git repository
+ *
+ * **Access policy**: administrator
+ */
+export const edgeStackCreateRepository = <ThrowOnError extends boolean = true>(
+  options: Options<EdgeStackCreateRepositoryData, ThrowOnError>
+): RequestResult<
+  EdgeStackCreateRepositoryResponses,
+  EdgeStackCreateRepositoryErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    EdgeStackCreateRepositoryResponses,
+    EdgeStackCreateRepositoryErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zEdgeStackCreateRepositoryBody,
+          path: z.never().optional(),
+          query: zEdgeStackCreateRepositoryQuery.optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zEdgeStackCreateRepositoryResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/edge_stacks/create/repository',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Create an EdgeStack from a text
+ *
+ * **Access policy**: administrator
+ */
+export const edgeStackCreateString = <ThrowOnError extends boolean = true>(
+  options: Options<EdgeStackCreateStringData, ThrowOnError>
+): RequestResult<
+  EdgeStackCreateStringResponses,
+  EdgeStackCreateStringErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    EdgeStackCreateStringResponses,
+    EdgeStackCreateStringErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zEdgeStackCreateStringBody,
+          path: z.never().optional(),
+          query: zEdgeStackCreateStringQuery.optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zEdgeStackCreateStringResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/edge_stacks/create/string',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * List Environment(Endpoint) groups
+ *
+ * List all environment(endpoint) groups based on the current user authorizations. Will
+ * return all environment(endpoint) groups if using an administrator account otherwise it will
+ * only return authorized environment(endpoint) groups.
+ * **Access policy**: restricted
+ */
+export const endpointGroupList = <ThrowOnError extends boolean = true>(
+  options?: Options<EndpointGroupListData, ThrowOnError>
+): RequestResult<
+  EndpointGroupListResponses,
+  EndpointGroupListErrors,
+  ThrowOnError
+> =>
+  (options?.client ?? client).get<
+    EndpointGroupListResponses,
+    EndpointGroupListErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: z.never().optional(),
+          query: zEndpointGroupListQuery.optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zEndpointGroupListResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/endpoint_groups',
+    ...options,
+  });
+
+/**
+ * Create an Environment(Endpoint) Group
+ *
+ * Create a new environment(endpoint) group.
+ * **Access policy**: administrator
+ */
+export const postEndpointGroups = <ThrowOnError extends boolean = true>(
+  options: Options<PostEndpointGroupsData, ThrowOnError>
+): RequestResult<
+  PostEndpointGroupsResponses,
+  PostEndpointGroupsErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    PostEndpointGroupsResponses,
+    PostEndpointGroupsErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zPostEndpointGroupsBody,
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zPostEndpointGroupsResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/endpoint_groups',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Remove an environment(endpoint) group
+ *
+ * Remove an environment(endpoint) group.
+ * **Access policy**: administrator
+ */
+export const endpointGroupDelete = <ThrowOnError extends boolean = true>(
+  options: Options<EndpointGroupDeleteData, ThrowOnError>
+): RequestResult<
+  EndpointGroupDeleteResponses,
+  EndpointGroupDeleteErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).delete<
+    EndpointGroupDeleteResponses,
+    EndpointGroupDeleteErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zEndpointGroupDeletePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zEndpointGroupDeleteResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/endpoint_groups/{id}',
+    ...options,
+  });
+
+/**
+ * Inspect an Environment(Endpoint) group
+ *
+ * Retrieve details abont an environment(endpoint) group.
+ * **Access policy**: administrator
+ */
+export const getEndpointGroupsById = <ThrowOnError extends boolean = true>(
+  options: Options<GetEndpointGroupsByIdData, ThrowOnError>
+): RequestResult<
+  GetEndpointGroupsByIdResponses,
+  GetEndpointGroupsByIdErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetEndpointGroupsByIdResponses,
+    GetEndpointGroupsByIdErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetEndpointGroupsByIdPath,
+          query: zGetEndpointGroupsByIdQuery.optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetEndpointGroupsByIdResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/endpoint_groups/{id}',
+    ...options,
+  });
+
+/**
+ * Update an environment(endpoint) group
+ *
+ * Update an environment(endpoint) group.
+ * **Access policy**: administrator
+ */
+export const endpointGroupUpdate = <ThrowOnError extends boolean = true>(
+  options: Options<EndpointGroupUpdateData, ThrowOnError>
+): RequestResult<
+  EndpointGroupUpdateResponses,
+  EndpointGroupUpdateErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).put<
+    EndpointGroupUpdateResponses,
+    EndpointGroupUpdateErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zEndpointGroupUpdateBody,
+          path: zEndpointGroupUpdatePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zEndpointGroupUpdateResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/endpoint_groups/{id}',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Removes environment(endpoint) from an environment(endpoint) group
+ *
+ * **Access policy**: administrator
+ */
+export const endpointGroupDeleteEndpoint = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<EndpointGroupDeleteEndpointData, ThrowOnError>
+): RequestResult<
+  EndpointGroupDeleteEndpointResponses,
+  EndpointGroupDeleteEndpointErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).delete<
+    EndpointGroupDeleteEndpointResponses,
+    EndpointGroupDeleteEndpointErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zEndpointGroupDeleteEndpointPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zEndpointGroupDeleteEndpointResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/endpoint_groups/{id}/endpoints/{endpointId}',
+    ...options,
+  });
+
+/**
+ * Add an environment(endpoint) to an environment(endpoint) group
+ *
+ * Add an environment(endpoint) to an environment(endpoint) group
+ * **Access policy**: administrator
+ */
+export const endpointGroupAddEndpoint = <ThrowOnError extends boolean = true>(
+  options: Options<EndpointGroupAddEndpointData, ThrowOnError>
+): RequestResult<
+  EndpointGroupAddEndpointResponses,
+  EndpointGroupAddEndpointErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).put<
+    EndpointGroupAddEndpointResponses,
+    EndpointGroupAddEndpointErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zEndpointGroupAddEndpointPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zEndpointGroupAddEndpointResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/endpoint_groups/{id}/endpoints/{endpointId}',
+    ...options,
+  });
+
+/**
+ * List environments(endpoints)
+ *
+ * List all environments(endpoints) based on the current user authorizations. Will
+ * return all environments(endpoints) if using an administrator or team leader account otherwise it will
+ * only return authorized environments(endpoints).
+ * **Access policy**: restricted
+ */
+export const endpointList = <ThrowOnError extends boolean = true>(
+  options?: Options<EndpointListData, ThrowOnError>
+): RequestResult<EndpointListResponses, EndpointListErrors, ThrowOnError> =>
+  (options?.client ?? client).get<
+    EndpointListResponses,
+    EndpointListErrors,
+    ThrowOnError
+  >({
+    querySerializer: {
+      parameters: {
+        groupIds: { array: { explode: false } },
+        status: { array: { explode: false } },
+        types: { array: { explode: false } },
+        platformTypes: { array: { explode: false } },
+        excludeGroupIds: { array: { explode: false } },
+        tagIds: { array: { explode: false } },
+        endpointIds: { array: { explode: false } },
+        excludeIds: { array: { explode: false } },
+        agentVersions: { array: { explode: false } },
+        edgeGroupIds: { array: { explode: false } },
+        excludeEdgeGroupIds: { array: { explode: false } },
+      },
+    },
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: z.never().optional(),
+          query: zEndpointListQuery.optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zEndpointListResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/endpoints',
+    ...options,
+  });
+
+/**
+ * Create a new environment(endpoint)
+ *
+ * Create a new environment(endpoint) that will be used to manage an environment(endpoint).
+ * **Access policy**: administrator
+ */
+export const endpointCreate = <ThrowOnError extends boolean = true>(
+  options: Options<EndpointCreateData, ThrowOnError>
+): RequestResult<EndpointCreateResponses, EndpointCreateErrors, ThrowOnError> =>
+  (options.client ?? client).post<
+    EndpointCreateResponses,
+    EndpointCreateErrors,
+    ThrowOnError
+  >({
+    ...formDataBodySerializer,
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zEndpointCreateBody,
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zEndpointCreateResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/endpoints',
+    ...options,
+    headers: {
+      'Content-Type': null,
+      ...options.headers,
+    },
+  });
+
+/**
+ * Remove an environment
+ *
+ * Remove the environment associated to the specified identifier and optionally clean-up associated resources.
+ * **Access policy**: Administrator only.
+ */
+export const endpointDelete = <ThrowOnError extends boolean = true>(
+  options: Options<EndpointDeleteData, ThrowOnError>
+): RequestResult<EndpointDeleteResponses, EndpointDeleteErrors, ThrowOnError> =>
+  (options.client ?? client).delete<
+    EndpointDeleteResponses,
+    EndpointDeleteErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zEndpointDeletePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zEndpointDeleteResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/endpoints/{id}',
+    ...options,
+  });
+
+/**
+ * Inspect an environment(endpoint)
+ *
+ * Retrieve details about an environment(endpoint).
+ * **Access policy**: restricted
+ */
+export const endpointInspect = <ThrowOnError extends boolean = true>(
+  options: Options<EndpointInspectData, ThrowOnError>
+): RequestResult<
+  EndpointInspectResponses,
+  EndpointInspectErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    EndpointInspectResponses,
+    EndpointInspectErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zEndpointInspectPath,
+          query: zEndpointInspectQuery.optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zEndpointInspectResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/endpoints/{id}',
+    ...options,
+  });
+
+/**
+ * Update an environment(endpoint)
+ *
+ * Update an environment(endpoint).
+ * **Access policy**: authenticated
+ */
+export const endpointUpdate = <ThrowOnError extends boolean = true>(
+  options: Options<EndpointUpdateData, ThrowOnError>
+): RequestResult<EndpointUpdateResponses, EndpointUpdateErrors, ThrowOnError> =>
+  (options.client ?? client).put<
+    EndpointUpdateResponses,
+    EndpointUpdateErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zEndpointUpdateBody,
+          path: zEndpointUpdatePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zEndpointUpdateResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/endpoints/{id}',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * De-association an edge environment(endpoint)
+ *
+ * De-association an edge environment(endpoint).
+ * **Access policy**: administrator
+ */
+export const endpointAssociationDelete = <ThrowOnError extends boolean = true>(
+  options: Options<EndpointAssociationDeleteData, ThrowOnError>
+): RequestResult<
+  EndpointAssociationDeleteResponses,
+  EndpointAssociationDeleteErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).put<
+    EndpointAssociationDeleteResponses,
+    EndpointAssociationDeleteErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zEndpointAssociationDeletePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zEndpointAssociationDeleteResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/endpoints/{id}/association',
+    ...options,
+  });
+
+/**
+ * Upload a file under a specific path on the file system of an environment (endpoint)
+ *
+ * Use this environment(endpoint) to upload TLS files.
+ * **Access policy**: administrator
+ */
+export const postEndpointsByIdDockerV2BrowsePut = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<PostEndpointsByIdDockerV2BrowsePutData, ThrowOnError>
+): RequestResult<
+  PostEndpointsByIdDockerV2BrowsePutResponses,
+  PostEndpointsByIdDockerV2BrowsePutErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    PostEndpointsByIdDockerV2BrowsePutResponses,
+    PostEndpointsByIdDockerV2BrowsePutErrors,
+    ThrowOnError
+  >({
+    ...formDataBodySerializer,
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zPostEndpointsByIdDockerV2BrowsePutBody,
+          path: zPostEndpointsByIdDockerV2BrowsePutPath,
+          query: zPostEndpointsByIdDockerV2BrowsePutQuery.optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zPostEndpointsByIdDockerV2BrowsePutResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/endpoints/{id}/docker/v2/browse/put',
+    ...options,
+    headers: {
+      'Content-Type': null,
+      ...options.headers,
+    },
+  });
+
+/**
+ * fetch docker pull limits
+ *
+ * get docker pull limits for a docker hub registry in the environment
+ * **Access policy**:
+ */
+export const endpointDockerhubStatus = <ThrowOnError extends boolean = true>(
+  options: Options<EndpointDockerhubStatusData, ThrowOnError>
+): RequestResult<
+  EndpointDockerhubStatusResponses,
+  EndpointDockerhubStatusErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    EndpointDockerhubStatusResponses,
+    EndpointDockerhubStatusErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zEndpointDockerhubStatusPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zEndpointDockerhubStatusResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/endpoints/{id}/dockerhub/{registryId}',
+    ...options,
+  });
+
+/**
+ * force update a docker service
+ *
+ * force update a docker service
+ * **Access policy**: authenticated
+ */
+export const endpointForceUpdateService = <ThrowOnError extends boolean = true>(
+  options: Options<EndpointForceUpdateServiceData, ThrowOnError>
+): RequestResult<
+  EndpointForceUpdateServiceResponses,
+  EndpointForceUpdateServiceErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).put<
+    EndpointForceUpdateServiceResponses,
+    EndpointForceUpdateServiceErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zEndpointForceUpdateServiceBody,
+          path: zEndpointForceUpdateServicePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zEndpointForceUpdateServiceResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/endpoints/{id}/forceupdateservice',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * List Helm Releases
+ *
+ * **Access policy**: authenticated
+ */
+export const helmList = <ThrowOnError extends boolean = true>(
+  options: Options<HelmListData, ThrowOnError>
+): RequestResult<HelmListResponses, HelmListErrors, ThrowOnError> =>
+  (options.client ?? client).get<
+    HelmListResponses,
+    HelmListErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zHelmListPath,
+          query: zHelmListQuery.optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) => await zHelmListResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/endpoints/{id}/kubernetes/helm',
+    ...options,
+  });
+
+/**
+ * Install Helm Chart
+ *
+ * **Access policy**: authenticated
+ */
+export const helmInstall = <ThrowOnError extends boolean = true>(
+  options: Options<HelmInstallData, ThrowOnError>
+): RequestResult<HelmInstallResponses, HelmInstallErrors, ThrowOnError> =>
+  (options.client ?? client).post<
+    HelmInstallResponses,
+    HelmInstallErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zHelmInstallBody,
+          path: zHelmInstallPath,
+          query: zHelmInstallQuery.optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zHelmInstallResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/endpoints/{id}/kubernetes/helm',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Delete Helm Release
+ *
+ * **Access policy**: authenticated
+ */
+export const helmDelete = <ThrowOnError extends boolean = true>(
+  options: Options<HelmDeleteData, ThrowOnError>
+): RequestResult<HelmDeleteResponses, HelmDeleteErrors, ThrowOnError> =>
+  (options.client ?? client).delete<
+    HelmDeleteResponses,
+    HelmDeleteErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zHelmDeletePath,
+          query: zHelmDeleteQuery.optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zHelmDeleteResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/endpoints/{id}/kubernetes/helm/{release}',
+    ...options,
+  });
+
+/**
+ * Get a helm release
+ *
+ * Get details of a helm release by release name
+ * **Access policy**: authenticated
+ */
+export const helmGet = <ThrowOnError extends boolean = true>(
+  options: Options<HelmGetData, ThrowOnError>
+): RequestResult<HelmGetResponses, HelmGetErrors, ThrowOnError> =>
+  (options.client ?? client).get<HelmGetResponses, HelmGetErrors, ThrowOnError>(
+    {
+      requestValidator: async (data) =>
+        await z
+          .object({
+            body: z.never().optional(),
+            path: zHelmGetPath,
+            query: zHelmGetQuery.optional(),
+          })
+          .parseAsync(data),
+      responseType: 'json',
+      responseValidator: async (data) =>
+        await zHelmGetResponse.parseAsync(data),
+      security: [
+        { name: 'X-API-KEY', type: 'apiKey' },
+        { name: 'Authorization', type: 'apiKey' },
+      ],
+      url: '/endpoints/{id}/kubernetes/helm/{release}',
+      ...options,
+    }
+  );
+
+/**
+ * Get a historical list of releases
+ *
+ * Get a historical list of releases by release name
+ * **Access policy**: authenticated
+ */
+export const helmGetHistory = <ThrowOnError extends boolean = true>(
+  options: Options<HelmGetHistoryData, ThrowOnError>
+): RequestResult<HelmGetHistoryResponses, HelmGetHistoryErrors, ThrowOnError> =>
+  (options.client ?? client).get<
+    HelmGetHistoryResponses,
+    HelmGetHistoryErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zHelmGetHistoryPath,
+          query: zHelmGetHistoryQuery.optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zHelmGetHistoryResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/endpoints/{id}/kubernetes/helm/{release}/history',
+    ...options,
+  });
+
+/**
+ * Rollback a helm release
+ *
+ * Rollback a helm release to a previous revision
+ * **Access policy**: authenticated
+ */
+export const helmRollback = <ThrowOnError extends boolean = true>(
+  options: Options<HelmRollbackData, ThrowOnError>
+): RequestResult<HelmRollbackResponses, HelmRollbackErrors, ThrowOnError> =>
+  (options.client ?? client).post<
+    HelmRollbackResponses,
+    HelmRollbackErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zHelmRollbackPath,
+          query: zHelmRollbackQuery.optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zHelmRollbackResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/endpoints/{id}/kubernetes/helm/{release}/rollback',
+    ...options,
+  });
+
+/**
+ * List Registries on environment
+ *
+ * List all registries based on the current user authorizations in current environment.
+ * **Access policy**: authenticated
+ */
+export const endpointRegistriesList = <ThrowOnError extends boolean = true>(
+  options: Options<EndpointRegistriesListData, ThrowOnError>
+): RequestResult<
+  EndpointRegistriesListResponses,
+  EndpointRegistriesListErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    EndpointRegistriesListResponses,
+    EndpointRegistriesListErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zEndpointRegistriesListPath,
+          query: zEndpointRegistriesListQuery.optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zEndpointRegistriesListResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/endpoints/{id}/registries',
+    ...options,
+  });
+
+/**
+ * update registry access for environment
+ *
+ * **Access policy**: authenticated
+ */
+export const endpointRegistryAccess = <ThrowOnError extends boolean = true>(
+  options: Options<EndpointRegistryAccessData, ThrowOnError>
+): RequestResult<
+  EndpointRegistryAccessResponses,
+  EndpointRegistryAccessErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).put<
+    EndpointRegistryAccessResponses,
+    EndpointRegistryAccessErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zEndpointRegistryAccessBody,
+          path: zEndpointRegistryAccessPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zEndpointRegistryAccessResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/endpoints/{id}/registries/{registryId}',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Update settings for an environment(endpoint)
+ *
+ * Update settings for an environment(endpoint).
+ * **Access policy**: authenticated
+ */
+export const endpointSettingsUpdate = <ThrowOnError extends boolean = true>(
+  options: Options<EndpointSettingsUpdateData, ThrowOnError>
+): RequestResult<
+  EndpointSettingsUpdateResponses,
+  EndpointSettingsUpdateErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).put<
+    EndpointSettingsUpdateResponses,
+    EndpointSettingsUpdateErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zEndpointSettingsUpdateBody,
+          path: zEndpointSettingsUpdatePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zEndpointSettingsUpdateResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/endpoints/{id}/settings',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Snapshots an environment(endpoint)
+ *
+ * Snapshots an environment(endpoint)
+ * **Access policy**: administrator
+ */
+export const endpointSnapshot = <ThrowOnError extends boolean = true>(
+  options: Options<EndpointSnapshotData, ThrowOnError>
+): RequestResult<
+  EndpointSnapshotResponses,
+  EndpointSnapshotErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    EndpointSnapshotResponses,
+    EndpointSnapshotErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zEndpointSnapshotPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zEndpointSnapshotResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/endpoints/{id}/snapshot',
+    ...options,
+  });
+
+/**
+ * Remove multiple environments
+ *
+ * Remove multiple environments and optionally clean-up associated resources.
+ * **Access policy**: Administrator only.
+ */
+export const endpointDeleteBatch = <ThrowOnError extends boolean = true>(
+  options: Options<EndpointDeleteBatchData, ThrowOnError>
+): RequestResult<
+  EndpointDeleteBatchResponses,
+  EndpointDeleteBatchErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    EndpointDeleteBatchResponses,
+    EndpointDeleteBatchErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zEndpointDeleteBatchBody,
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zEndpointDeleteBatchResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/endpoints/delete',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Create or retrieve the endpoint for an EdgeID
+ */
+export const endpointCreateGlobalKey = <ThrowOnError extends boolean = true>(
+  options?: Options<EndpointCreateGlobalKeyData, ThrowOnError>
+): RequestResult<
+  EndpointCreateGlobalKeyResponses,
+  EndpointCreateGlobalKeyErrors,
+  ThrowOnError
+> =>
+  (options?.client ?? client).post<
+    EndpointCreateGlobalKeyResponses,
+    EndpointCreateGlobalKeyErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zEndpointCreateGlobalKeyResponse.parseAsync(data),
+    url: '/endpoints/global-key',
+    ...options,
+  });
+
+/**
+ * Update relations for a list of environments
+ *
+ * Update relations for a list of environments
+ * Edge groups, tags and environment group can be updated.
+ *
+ * **Access policy**: administrator
+ */
+export const endpointUpdateRelations = <ThrowOnError extends boolean = true>(
+  options: Options<EndpointUpdateRelationsData, ThrowOnError>
+): RequestResult<
+  EndpointUpdateRelationsResponses,
+  EndpointUpdateRelationsErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).put<
+    EndpointUpdateRelationsResponses,
+    EndpointUpdateRelationsErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zEndpointUpdateRelationsBody,
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zEndpointUpdateRelationsResponse.parseAsync(data),
+    security: [{ name: 'Authorization', type: 'apiKey' }],
+    url: '/endpoints/relations',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Snapshot all environments(endpoints)
+ *
+ * Snapshot all environments(endpoints)
+ * **Access policy**: administrator
+ */
+export const endpointSnapshots = <ThrowOnError extends boolean = true>(
+  options?: Options<EndpointSnapshotsData, ThrowOnError>
+): RequestResult<
+  EndpointSnapshotsResponses,
+  EndpointSnapshotsErrors,
+  ThrowOnError
+> =>
+  (options?.client ?? client).post<
+    EndpointSnapshotsResponses,
+    EndpointSnapshotsErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zEndpointSnapshotsResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/endpoints/snapshot',
+    ...options,
+  });
+
+/**
+ * Get environment summary counts
+ *
+ * Returns counts of environments by status (up, down) and ungrouped environments (unassigned), plus breakdowns by group, type, and health.
+ * **Access policy**: restricted
+ */
+export const endpointSummaryCounts = <ThrowOnError extends boolean = true>(
+  options?: Options<EndpointSummaryCountsData, ThrowOnError>
+): RequestResult<
+  EndpointSummaryCountsResponses,
+  EndpointSummaryCountsErrors,
+  ThrowOnError
+> =>
+  (options?.client ?? client).get<
+    EndpointSummaryCountsResponses,
+    EndpointSummaryCountsErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zEndpointSummaryCountsResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/endpoints/summary',
+    ...options,
+  });
+
+/**
+ * preview the content of target file in the git repository
+ *
+ * Retrieve the compose file content based on git repository configuration
+ * **Access policy**: authenticated
+ */
+export const gitOperationRepoFilePreview = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<GitOperationRepoFilePreviewData, ThrowOnError>
+): RequestResult<
+  GitOperationRepoFilePreviewResponses,
+  GitOperationRepoFilePreviewErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    GitOperationRepoFilePreviewResponses,
+    GitOperationRepoFilePreviewErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zGitOperationRepoFilePreviewBody,
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGitOperationRepoFilePreviewResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/gitops/repo/file/preview',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * List all GitOps sources
+ *
+ * Returns a deduplicated list of git repositories used across all GitOps workflows.
+ * **Access policy**: authenticated
+ */
+export const gitOpsSourcesList = <ThrowOnError extends boolean = true>(
+  options?: Options<GitOpsSourcesListData, ThrowOnError>
+): RequestResult<
+  GitOpsSourcesListResponses,
+  GitOpsSourcesListErrors,
+  ThrowOnError
+> =>
+  (options?.client ?? client).get<
+    GitOpsSourcesListResponses,
+    GitOpsSourcesListErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: z.never().optional(),
+          query: zGitOpsSourcesListQuery.optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGitOpsSourcesListResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/gitops/sources',
+    ...options,
+  });
+
+/**
+ * Delete a source
+ *
+ * Deletes an existing GitOps source. Returns 409 if the source is referenced by any workflow or custom template.
+ * **Access policy**: authenticated
+ */
+export const gitOpsSourcesDelete = <ThrowOnError extends boolean = true>(
+  options: Options<GitOpsSourcesDeleteData, ThrowOnError>
+): RequestResult<
+  GitOpsSourcesDeleteResponses,
+  GitOpsSourcesDeleteErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).delete<
+    GitOpsSourcesDeleteResponses,
+    GitOpsSourcesDeleteErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGitOpsSourcesDeletePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zGitOpsSourcesDeleteResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/gitops/sources/{id}',
+    ...options,
+  });
+
+/**
+ * Get a GitOps source by ID
+ *
+ * Returns a single GitOps source with its connection settings and linked workflows.
+ * **Access policy**: authenticated
+ */
+export const gitOpsSourceGet = <ThrowOnError extends boolean = true>(
+  options: Options<GitOpsSourceGetData, ThrowOnError>
+): RequestResult<
+  GitOpsSourceGetResponses,
+  GitOpsSourceGetErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GitOpsSourceGetResponses,
+    GitOpsSourceGetErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGitOpsSourceGetPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGitOpsSourceGetResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/gitops/sources/{id}',
+    ...options,
+  });
+
+/**
+ * Update a Git source
+ *
+ * Updates an existing GitOps source backed by a Git repository.
+ * **Access policy**: authenticated
+ */
+export const gitOpsSourcesUpdateGit = <ThrowOnError extends boolean = true>(
+  options: Options<GitOpsSourcesUpdateGitData, ThrowOnError>
+): RequestResult<
+  GitOpsSourcesUpdateGitResponses,
+  GitOpsSourcesUpdateGitErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).put<
+    GitOpsSourcesUpdateGitResponses,
+    GitOpsSourcesUpdateGitErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zGitOpsSourcesUpdateGitBody,
+          path: zGitOpsSourcesUpdateGitPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGitOpsSourcesUpdateGitResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/gitops/sources/{id}',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Update a GitOps source's access control
+ *
+ * Updates the access control settings for an existing GitOps source.
+ * **Access policy**: administrator
+ */
+export const gitOpsSourcesUpdateAccess = <ThrowOnError extends boolean = true>(
+  options: Options<GitOpsSourcesUpdateAccessData, ThrowOnError>
+): RequestResult<
+  GitOpsSourcesUpdateAccessResponses,
+  GitOpsSourcesUpdateAccessErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).put<
+    GitOpsSourcesUpdateAccessResponses,
+    GitOpsSourcesUpdateAccessErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zGitOpsSourcesUpdateAccessBody,
+          path: zGitOpsSourcesUpdateAccessPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGitOpsSourcesUpdateAccessResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/gitops/sources/{id}/access',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Test the connection of a stored source
+ *
+ * Tests connectivity for a GitOps source, applying optional overrides to the stored configuration.
+ * **Access policy**: authenticated
+ */
+export const gitOpsSourcesTestById = <ThrowOnError extends boolean = true>(
+  options: Options<GitOpsSourcesTestByIdData, ThrowOnError>
+): RequestResult<
+  GitOpsSourcesTestByIdResponses,
+  GitOpsSourcesTestByIdErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    GitOpsSourcesTestByIdResponses,
+    GitOpsSourcesTestByIdErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zGitOpsSourcesTestByIdBody.optional(),
+          path: zGitOpsSourcesTestByIdPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGitOpsSourcesTestByIdResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/gitops/sources/{id}/test',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Create a Git source
+ *
+ * Creates a new GitOps source backed by a Git repository.
+ * **Access policy**: authenticated
+ */
+export const gitOpsSourcesCreateGit = <ThrowOnError extends boolean = true>(
+  options: Options<GitOpsSourcesCreateGitData, ThrowOnError>
+): RequestResult<
+  GitOpsSourcesCreateGitResponses,
+  GitOpsSourcesCreateGitErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    GitOpsSourcesCreateGitResponses,
+    GitOpsSourcesCreateGitErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zGitOpsSourcesCreateGitBody,
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGitOpsSourcesCreateGitResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/gitops/sources/git',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Summarize GitOps source status counts
+ *
+ * Returns a count of sources per status.
+ * **Access policy**: authenticated
+ */
+export const gitOpsSourcesSummary = <ThrowOnError extends boolean = true>(
+  options?: Options<GitOpsSourcesSummaryData, ThrowOnError>
+): RequestResult<
+  GitOpsSourcesSummaryResponses,
+  GitOpsSourcesSummaryErrors,
+  ThrowOnError
+> =>
+  (options?.client ?? client).get<
+    GitOpsSourcesSummaryResponses,
+    GitOpsSourcesSummaryErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGitOpsSourcesSummaryResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/gitops/sources/summary',
+    ...options,
+  });
+
+/**
+ * Test a Git source connection
+ *
+ * Tests connectivity for Git connection details that have not been persisted yet.
+ * **Access policy**: authenticated
+ */
+export const gitOpsSourcesTest = <ThrowOnError extends boolean = true>(
+  options: Options<GitOpsSourcesTestData, ThrowOnError>
+): RequestResult<
+  GitOpsSourcesTestResponses,
+  GitOpsSourcesTestErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    GitOpsSourcesTestResponses,
+    GitOpsSourcesTestErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zGitOpsSourcesTestBody,
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGitOpsSourcesTestResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/gitops/sources/test',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * List all GitOps workflows
+ *
+ * Returns a unified list of all stacks that have GitOps (GitConfig) configured.
+ * **Access policy**: authenticated
+ */
+export const gitOpsWorkflowsList = <ThrowOnError extends boolean = true>(
+  options?: Options<GitOpsWorkflowsListData, ThrowOnError>
+): RequestResult<
+  GitOpsWorkflowsListResponses,
+  GitOpsWorkflowsListErrors,
+  ThrowOnError
+> =>
+  (options?.client ?? client).get<
+    GitOpsWorkflowsListResponses,
+    GitOpsWorkflowsListErrors,
+    ThrowOnError
+  >({
+    querySerializer: {
+      parameters: { endpointIds: { array: { explode: false } } },
+    },
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: z.never().optional(),
+          query: zGitOpsWorkflowsListQuery.optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGitOpsWorkflowsListResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/gitops/workflows',
+    ...options,
+  });
+
+/**
+ * Get a GitOps workflow by ID
+ *
+ * Returns the detail view of a single GitOps workflow, with one entry per backing
+ * stack or edge stack artifact.
+ * **Access policy**: authenticated
+ */
+export const gitOpsWorkflowGet = <ThrowOnError extends boolean = true>(
+  options: Options<GitOpsWorkflowGetData, ThrowOnError>
+): RequestResult<
+  GitOpsWorkflowGetResponses,
+  GitOpsWorkflowGetErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GitOpsWorkflowGetResponses,
+    GitOpsWorkflowGetErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGitOpsWorkflowGetPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGitOpsWorkflowGetResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/gitops/workflows/{id}',
+    ...options,
+  });
+
+/**
+ * Summarize GitOps workflow status counts
+ *
+ * Returns a count of workflows per status across all environments.
+ * **Access policy**: authenticated
+ */
+export const gitOpsWorkflowsSummary = <ThrowOnError extends boolean = true>(
+  options?: Options<GitOpsWorkflowsSummaryData, ThrowOnError>
+): RequestResult<
+  GitOpsWorkflowsSummaryResponses,
+  GitOpsWorkflowsSummaryErrors,
+  ThrowOnError
+> =>
+  (options?.client ?? client).get<
+    GitOpsWorkflowsSummaryResponses,
+    GitOpsWorkflowsSummaryErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGitOpsWorkflowsSummaryResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/gitops/workflows/summary',
+    ...options,
+  });
+
+/**
+ * Get a list of applications across all namespaces in the cluster. If the nodeName is provided, it will return the applications running on that node.
+ *
+ * Get a list of applications across all namespaces in the cluster. If the nodeName is provided, it will return the applications running on that node.
+ * **Access policy**: authenticated
+ */
+export const getAllKubernetesApplications = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<GetAllKubernetesApplicationsData, ThrowOnError>
+): RequestResult<
+  GetAllKubernetesApplicationsResponses,
+  GetAllKubernetesApplicationsErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetAllKubernetesApplicationsResponses,
+    GetAllKubernetesApplicationsErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetAllKubernetesApplicationsPath,
+          query: zGetAllKubernetesApplicationsQuery,
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetAllKubernetesApplicationsResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/applications',
+    ...options,
+  });
+
+/**
+ * Get Applications count
+ *
+ * Get the count of Applications across all namespaces in the cluster. If the nodeName is provided, it will return the count of applications running on that node.
+ * **Access policy**: Authenticated user.
+ */
+export const getAllKubernetesApplicationsCount = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<GetAllKubernetesApplicationsCountData, ThrowOnError>
+): RequestResult<
+  GetAllKubernetesApplicationsCountResponses,
+  GetAllKubernetesApplicationsCountErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetAllKubernetesApplicationsCountResponses,
+    GetAllKubernetesApplicationsCountErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetAllKubernetesApplicationsCountPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetAllKubernetesApplicationsCountResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/applications/count',
+    ...options,
+  });
+
+/**
+ * Delete cluster role bindings
+ *
+ * Delete the provided list of cluster role bindings.
+ * **Access policy**: Authenticated user.
+ */
+export const deleteClusterRoleBindings = <ThrowOnError extends boolean = true>(
+  options: Options<DeleteClusterRoleBindingsData, ThrowOnError>
+): RequestResult<
+  DeleteClusterRoleBindingsResponses,
+  DeleteClusterRoleBindingsErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    DeleteClusterRoleBindingsResponses,
+    DeleteClusterRoleBindingsErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zDeleteClusterRoleBindingsBody,
+          path: zDeleteClusterRoleBindingsPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zDeleteClusterRoleBindingsResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/cluster_role_bindings/delete',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Delete cluster roles
+ *
+ * Delete the provided list of cluster roles.
+ * **Access policy**: Authenticated user.
+ */
+export const deleteClusterRoles = <ThrowOnError extends boolean = true>(
+  options: Options<DeleteClusterRolesData, ThrowOnError>
+): RequestResult<
+  DeleteClusterRolesResponses,
+  DeleteClusterRolesErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    DeleteClusterRolesResponses,
+    DeleteClusterRolesErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zDeleteClusterRolesBody,
+          path: zDeleteClusterRolesPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zDeleteClusterRolesResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/cluster_roles/delete',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Get a list of kubernetes cluster role bindings
+ *
+ * Get a list of kubernetes cluster role bindings within the given environment at the cluster level.
+ * **Access policy**: Authenticated user.
+ */
+export const getAllKubernetesClusterRoleBindings = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<GetAllKubernetesClusterRoleBindingsData, ThrowOnError>
+): RequestResult<
+  GetAllKubernetesClusterRoleBindingsResponses,
+  GetAllKubernetesClusterRoleBindingsErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetAllKubernetesClusterRoleBindingsResponses,
+    GetAllKubernetesClusterRoleBindingsErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetAllKubernetesClusterRoleBindingsPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetAllKubernetesClusterRoleBindingsResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/clusterrolebindings',
+    ...options,
+  });
+
+/**
+ * Get a list of kubernetes cluster roles
+ *
+ * Get a list of kubernetes cluster roles within the given environment at the cluster level.
+ * **Access policy**: Authenticated user.
+ */
+export const getAllKubernetesClusterRoles = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<GetAllKubernetesClusterRolesData, ThrowOnError>
+): RequestResult<
+  GetAllKubernetesClusterRolesResponses,
+  GetAllKubernetesClusterRolesErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetAllKubernetesClusterRolesResponses,
+    GetAllKubernetesClusterRolesErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetAllKubernetesClusterRolesPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetAllKubernetesClusterRolesResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/clusterroles',
+    ...options,
+  });
+
+/**
+ * Get a list of ConfigMaps
+ *
+ * Get a list of ConfigMaps across all namespaces in the cluster. For non-admin users, it will only return ConfigMaps based on the namespaces that they have access to.
+ * **Access policy**: Authenticated user.
+ */
+export const getAllKubernetesConfigMaps = <ThrowOnError extends boolean = true>(
+  options: Options<GetAllKubernetesConfigMapsData, ThrowOnError>
+): RequestResult<
+  GetAllKubernetesConfigMapsResponses,
+  GetAllKubernetesConfigMapsErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetAllKubernetesConfigMapsResponses,
+    GetAllKubernetesConfigMapsErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetAllKubernetesConfigMapsPath,
+          query: zGetAllKubernetesConfigMapsQuery,
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetAllKubernetesConfigMapsResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/configmaps',
+    ...options,
+  });
+
+/**
+ * Get ConfigMaps count
+ *
+ * Get the count of ConfigMaps across all namespaces in the cluster. For non-admin users, it will only return the count of ConfigMaps based on the namespaces that they have access to.
+ * **Access policy**: Authenticated user.
+ */
+export const getAllKubernetesConfigMapsCount = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<GetAllKubernetesConfigMapsCountData, ThrowOnError>
+): RequestResult<
+  GetAllKubernetesConfigMapsCountResponses,
+  GetAllKubernetesConfigMapsCountErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetAllKubernetesConfigMapsCountResponses,
+    GetAllKubernetesConfigMapsCountErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetAllKubernetesConfigMapsCountPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetAllKubernetesConfigMapsCountResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/configmaps/count',
+    ...options,
+  });
+
+/**
+ * Get a list of kubernetes Cron Jobs
+ *
+ * Get a list of kubernetes Cron Jobs that the user has access to.
+ * **Access policy**: Authenticated user.
+ */
+export const getKubernetesCronJobs = <ThrowOnError extends boolean = true>(
+  options: Options<GetKubernetesCronJobsData, ThrowOnError>
+): RequestResult<
+  GetKubernetesCronJobsResponses,
+  GetKubernetesCronJobsErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetKubernetesCronJobsResponses,
+    GetKubernetesCronJobsErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetKubernetesCronJobsPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetKubernetesCronJobsResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/cron_jobs',
+    ...options,
+  });
+
+/**
+ * Delete Cron Jobs
+ *
+ * Delete the provided list of Cron Jobs.
+ * **Access policy**: Authenticated user.
+ */
+export const deleteCronJobs = <ThrowOnError extends boolean = true>(
+  options: Options<DeleteCronJobsData, ThrowOnError>
+): RequestResult<DeleteCronJobsResponses, DeleteCronJobsErrors, ThrowOnError> =>
+  (options.client ?? client).post<
+    DeleteCronJobsResponses,
+    DeleteCronJobsErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zDeleteCronJobsBody,
+          path: zDeleteCronJobsPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zDeleteCronJobsResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/cron_jobs/delete',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Get the dashboard summary data
+ *
+ * Get the dashboard summary data which is simply a count of a range of different commonly used kubernetes resources.
+ * **Access policy**: Authenticated user.
+ */
+export const getKubernetesDashboard = <ThrowOnError extends boolean = true>(
+  options: Options<GetKubernetesDashboardData, ThrowOnError>
+): RequestResult<
+  GetKubernetesDashboardResponses,
+  GetKubernetesDashboardErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetKubernetesDashboardResponses,
+    GetKubernetesDashboardErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetKubernetesDashboardPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetKubernetesDashboardResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/dashboard',
+    ...options,
+  });
+
+/**
+ * Get a description of a kubernetes resource
+ *
+ * Get a description of a kubernetes resource.
+ * **Access policy**: Authenticated user.
+ */
+export const describeResource = <ThrowOnError extends boolean = true>(
+  options: Options<DescribeResourceData, ThrowOnError>
+): RequestResult<
+  DescribeResourceResponses,
+  DescribeResourceErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    DescribeResourceResponses,
+    DescribeResourceErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zDescribeResourcePath,
+          query: zDescribeResourceQuery,
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zDescribeResourceResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/describe',
+    ...options,
+  });
+
+/**
+ * Gets kubernetes events
+ *
+ * Get events by query param resourceId
+ * **Access policy**: Authenticated user.
+ */
+export const getAllKubernetesEvents = <ThrowOnError extends boolean = true>(
+  options: Options<GetAllKubernetesEventsData, ThrowOnError>
+): RequestResult<
+  GetAllKubernetesEventsResponses,
+  GetAllKubernetesEventsErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetAllKubernetesEventsResponses,
+    GetAllKubernetesEventsErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetAllKubernetesEventsPath,
+          query: zGetAllKubernetesEventsQuery.optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetAllKubernetesEventsResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/events',
+    ...options,
+  });
+
+/**
+ * Get a list of ingress controllers
+ *
+ * Get a list of ingress controllers for the given environment. If the allowedOnly query parameter is set, only ingress controllers that are allowed by the environment's ingress configuration will be returned.
+ * **Access policy**: Authenticated user.
+ */
+export const getAllKubernetesIngressControllers = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<GetAllKubernetesIngressControllersData, ThrowOnError>
+): RequestResult<
+  GetAllKubernetesIngressControllersResponses,
+  GetAllKubernetesIngressControllersErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetAllKubernetesIngressControllersResponses,
+    GetAllKubernetesIngressControllersErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetAllKubernetesIngressControllersPath,
+          query: zGetAllKubernetesIngressControllersQuery.optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetAllKubernetesIngressControllersResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/ingresscontrollers',
+    ...options,
+  });
+
+/**
+ * Update (block/unblock) ingress controllers
+ *
+ * Update (block/unblock) ingress controllers for the provided environment.
+ * **Access policy**: Authenticated user.
+ */
+export const updateKubernetesIngressControllers = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<UpdateKubernetesIngressControllersData, ThrowOnError>
+): RequestResult<
+  UpdateKubernetesIngressControllersResponses,
+  UpdateKubernetesIngressControllersErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).put<
+    UpdateKubernetesIngressControllersResponses,
+    UpdateKubernetesIngressControllersErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zUpdateKubernetesIngressControllersBody,
+          path: zUpdateKubernetesIngressControllersPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zUpdateKubernetesIngressControllersResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/ingresscontrollers',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Get kubernetes ingresses at the cluster level
+ *
+ * Get kubernetes ingresses at the cluster level for the provided environment.
+ * **Access policy**: Authenticated user.
+ */
+export const getAllKubernetesClusterIngresses = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<GetAllKubernetesClusterIngressesData, ThrowOnError>
+): RequestResult<
+  GetAllKubernetesClusterIngressesResponses,
+  GetAllKubernetesClusterIngressesErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetAllKubernetesClusterIngressesResponses,
+    GetAllKubernetesClusterIngressesErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetAllKubernetesClusterIngressesPath,
+          query: zGetAllKubernetesClusterIngressesQuery.optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetAllKubernetesClusterIngressesResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/ingresses',
+    ...options,
+  });
+
+/**
+ * Get Ingresses count
+ *
+ * Get the number of kubernetes ingresses within the given environment.
+ * **Access policy**: Authenticated user.
+ */
+export const getAllKubernetesClusterIngressesCount = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<GetAllKubernetesClusterIngressesCountData, ThrowOnError>
+): RequestResult<
+  GetAllKubernetesClusterIngressesCountResponses,
+  GetAllKubernetesClusterIngressesCountErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetAllKubernetesClusterIngressesCountResponses,
+    GetAllKubernetesClusterIngressesCountErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetAllKubernetesClusterIngressesCountPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetAllKubernetesClusterIngressesCountResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/ingresses/count',
+    ...options,
+  });
+
+/**
+ * Delete one or more Ingresses
+ *
+ * Delete one or more Ingresses in the provided environment.
+ * **Access policy**: Authenticated user.
+ */
+export const deleteKubernetesIngresses = <ThrowOnError extends boolean = true>(
+  options: Options<DeleteKubernetesIngressesData, ThrowOnError>
+): RequestResult<
+  DeleteKubernetesIngressesResponses,
+  DeleteKubernetesIngressesErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    DeleteKubernetesIngressesResponses,
+    DeleteKubernetesIngressesErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zDeleteKubernetesIngressesBody,
+          path: zDeleteKubernetesIngressesPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zDeleteKubernetesIngressesResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/ingresses/delete',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Get a list of kubernetes Jobs
+ *
+ * Get a list of kubernetes Jobs that the user has access to.
+ * **Access policy**: Authenticated user.
+ */
+export const getKubernetesJobs = <ThrowOnError extends boolean = true>(
+  options: Options<GetKubernetesJobsData, ThrowOnError>
+): RequestResult<
+  GetKubernetesJobsResponses,
+  GetKubernetesJobsErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetKubernetesJobsResponses,
+    GetKubernetesJobsErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetKubernetesJobsPath,
+          query: zGetKubernetesJobsQuery.optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetKubernetesJobsResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/jobs',
+    ...options,
+  });
+
+/**
+ * Delete Jobs
+ *
+ * Delete the provided list of Jobs.
+ * **Access policy**: Authenticated user.
+ */
+export const deleteJobs = <ThrowOnError extends boolean = true>(
+  options: Options<DeleteJobsData, ThrowOnError>
+): RequestResult<DeleteJobsResponses, DeleteJobsErrors, ThrowOnError> =>
+  (options.client ?? client).post<
+    DeleteJobsResponses,
+    DeleteJobsErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zDeleteJobsBody,
+          path: zDeleteJobsPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zDeleteJobsResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/jobs/delete',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Get max CPU and memory limits of all nodes within k8s cluster
+ *
+ * Get max CPU and memory limits (unused resources) of all nodes within k8s cluster.
+ * **Access policy**: Authenticated user.
+ */
+export const getKubernetesMaxResourceLimits = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<GetKubernetesMaxResourceLimitsData, ThrowOnError>
+): RequestResult<
+  GetKubernetesMaxResourceLimitsResponses,
+  GetKubernetesMaxResourceLimitsErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetKubernetesMaxResourceLimitsResponses,
+    GetKubernetesMaxResourceLimitsErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetKubernetesMaxResourceLimitsPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetKubernetesMaxResourceLimitsResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/max_resource_limits',
+    ...options,
+  });
+
+/**
+ * Get the total resource requests and limits of all applications
+ *
+ * Get the total CPU (cores) and memory (bytes) requests and limits of all applications across all namespaces.
+ * **Access policy**: Authenticated user.
+ */
+export const getApplicationsResources = <ThrowOnError extends boolean = true>(
+  options: Options<GetApplicationsResourcesData, ThrowOnError>
+): RequestResult<
+  GetApplicationsResourcesResponses,
+  GetApplicationsResourcesErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetApplicationsResourcesResponses,
+    GetApplicationsResourcesErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetApplicationsResourcesPath,
+          query: zGetApplicationsResourcesQuery,
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetApplicationsResourcesResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/metrics/applications_resources',
+    ...options,
+  });
+
+/**
+ * Get a list of nodes with their live metrics
+ *
+ * Get a list of metrics associated with all nodes of a cluster.
+ * **Access policy**: Authenticated user.
+ */
+export const getKubernetesMetricsForAllNodes = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<GetKubernetesMetricsForAllNodesData, ThrowOnError>
+): RequestResult<
+  GetKubernetesMetricsForAllNodesResponses,
+  GetKubernetesMetricsForAllNodesErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetKubernetesMetricsForAllNodesResponses,
+    GetKubernetesMetricsForAllNodesErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetKubernetesMetricsForAllNodesPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetKubernetesMetricsForAllNodesResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/metrics/nodes',
+    ...options,
+  });
+
+/**
+ * Get live metrics for a node
+ *
+ * Get live metrics for the specified node.
+ * **Access policy**: Authenticated user.
+ */
+export const getKubernetesMetricsForNode = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<GetKubernetesMetricsForNodeData, ThrowOnError>
+): RequestResult<
+  GetKubernetesMetricsForNodeResponses,
+  GetKubernetesMetricsForNodeErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetKubernetesMetricsForNodeResponses,
+    GetKubernetesMetricsForNodeErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetKubernetesMetricsForNodePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetKubernetesMetricsForNodeResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/metrics/nodes/{name}',
+    ...options,
+  });
+
+/**
+ * Get a list of pods with their live metrics
+ *
+ * Get a list of pods with their live metrics for the specified namespace.
+ * **Access policy**: Authenticated user.
+ */
+export const getKubernetesMetricsForAllPods = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<GetKubernetesMetricsForAllPodsData, ThrowOnError>
+): RequestResult<
+  GetKubernetesMetricsForAllPodsResponses,
+  GetKubernetesMetricsForAllPodsErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetKubernetesMetricsForAllPodsResponses,
+    GetKubernetesMetricsForAllPodsErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetKubernetesMetricsForAllPodsPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetKubernetesMetricsForAllPodsResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/metrics/pods/{namespace}',
+    ...options,
+  });
+
+/**
+ * Get live metrics for a pod
+ *
+ * Get live metrics for the specified pod.
+ * **Access policy**: Authenticated user.
+ */
+export const getKubernetesMetricsForPod = <ThrowOnError extends boolean = true>(
+  options: Options<GetKubernetesMetricsForPodData, ThrowOnError>
+): RequestResult<
+  GetKubernetesMetricsForPodResponses,
+  GetKubernetesMetricsForPodErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetKubernetesMetricsForPodResponses,
+    GetKubernetesMetricsForPodErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetKubernetesMetricsForPodPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetKubernetesMetricsForPodResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/metrics/pods/{namespace}/{name}',
+    ...options,
+  });
+
+/**
+ * Delete a kubernetes namespace
+ *
+ * Delete a kubernetes namespace within the given environment.
+ * **Access policy**: Authenticated user.
+ */
+export const deleteKubernetesNamespace = <ThrowOnError extends boolean = true>(
+  options: Options<DeleteKubernetesNamespaceData, ThrowOnError>
+): RequestResult<
+  DeleteKubernetesNamespaceResponses,
+  DeleteKubernetesNamespaceErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).delete<
+    DeleteKubernetesNamespaceResponses,
+    DeleteKubernetesNamespaceErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zDeleteKubernetesNamespacePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zDeleteKubernetesNamespaceResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/namespaces',
+    ...options,
+  });
+
+/**
+ * Get a list of namespaces
+ *
+ * Get a list of all namespaces within the given environment based on the user role and permissions. If the user is an admin, they can access all namespaces. If the user is not an admin, they can only access namespaces that they have access to.
+ * **Access policy**: Authenticated user.
+ */
+export const getKubernetesNamespaces = <ThrowOnError extends boolean = true>(
+  options: Options<GetKubernetesNamespacesData, ThrowOnError>
+): RequestResult<
+  GetKubernetesNamespacesResponses,
+  GetKubernetesNamespacesErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetKubernetesNamespacesResponses,
+    GetKubernetesNamespacesErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetKubernetesNamespacesPath,
+          query: zGetKubernetesNamespacesQuery,
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetKubernetesNamespacesResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/namespaces',
+    ...options,
+  });
+
+/**
+ * Create a namespace
+ *
+ * Create a namespace within the given environment.
+ * **Access policy**: Authenticated user.
+ */
+export const createKubernetesNamespace = <ThrowOnError extends boolean = true>(
+  options: Options<CreateKubernetesNamespaceData, ThrowOnError>
+): RequestResult<
+  CreateKubernetesNamespaceResponses,
+  CreateKubernetesNamespaceErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    CreateKubernetesNamespaceResponses,
+    CreateKubernetesNamespaceErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zCreateKubernetesNamespaceBody,
+          path: zCreateKubernetesNamespacePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zCreateKubernetesNamespaceResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/namespaces',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Update a namespace
+ *
+ * Update a namespace within the given environment.
+ * **Access policy**: Authenticated user.
+ */
+export const updateKubernetesNamespaceDeprecated = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<UpdateKubernetesNamespaceDeprecatedData, ThrowOnError>
+): RequestResult<
+  UpdateKubernetesNamespaceDeprecatedResponses,
+  UpdateKubernetesNamespaceDeprecatedErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).put<
+    UpdateKubernetesNamespaceDeprecatedResponses,
+    UpdateKubernetesNamespaceDeprecatedErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zUpdateKubernetesNamespaceDeprecatedBody,
+          path: zUpdateKubernetesNamespaceDeprecatedPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zUpdateKubernetesNamespaceDeprecatedResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/namespaces',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Get namespace details
+ *
+ * Get namespace details for the provided namespace within the given environment.
+ * **Access policy**: Authenticated user.
+ */
+export const getKubernetesNamespace = <ThrowOnError extends boolean = true>(
+  options: Options<GetKubernetesNamespaceData, ThrowOnError>
+): RequestResult<
+  GetKubernetesNamespaceResponses,
+  GetKubernetesNamespaceErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetKubernetesNamespaceResponses,
+    GetKubernetesNamespaceErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetKubernetesNamespacePath,
+          query: zGetKubernetesNamespaceQuery,
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetKubernetesNamespaceResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/namespaces/{namespace}',
+    ...options,
+  });
+
+/**
+ * Update a namespace
+ *
+ * Update a namespace within the given environment.
+ * **Access policy**: Authenticated user.
+ */
+export const updateKubernetesNamespace = <ThrowOnError extends boolean = true>(
+  options: Options<UpdateKubernetesNamespaceData, ThrowOnError>
+): RequestResult<
+  UpdateKubernetesNamespaceResponses,
+  UpdateKubernetesNamespaceErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).put<
+    UpdateKubernetesNamespaceResponses,
+    UpdateKubernetesNamespaceErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zUpdateKubernetesNamespaceBody,
+          path: zUpdateKubernetesNamespacePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zUpdateKubernetesNamespaceResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/namespaces/{namespace}',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Get a ConfigMap
+ *
+ * Get a ConfigMap by name for a given namespace.
+ * **Access policy**: Authenticated user.
+ */
+export const getKubernetesConfigMap = <ThrowOnError extends boolean = true>(
+  options: Options<GetKubernetesConfigMapData, ThrowOnError>
+): RequestResult<
+  GetKubernetesConfigMapResponses,
+  GetKubernetesConfigMapErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetKubernetesConfigMapResponses,
+    GetKubernetesConfigMapErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetKubernetesConfigMapPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetKubernetesConfigMapResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/namespaces/{namespace}/configmaps/{configmap}',
+    ...options,
+  });
+
+/**
+ * Gets kubernetes events for namespace
+ *
+ * Get events by optional query param resourceId for a given namespace.
+ * **Access policy**: Authenticated user.
+ */
+export const getKubernetesEventsForNamespace = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<GetKubernetesEventsForNamespaceData, ThrowOnError>
+): RequestResult<
+  GetKubernetesEventsForNamespaceResponses,
+  GetKubernetesEventsForNamespaceErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetKubernetesEventsForNamespaceResponses,
+    GetKubernetesEventsForNamespaceErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetKubernetesEventsForNamespacePath,
+          query: zGetKubernetesEventsForNamespaceQuery.optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetKubernetesEventsForNamespaceResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/namespaces/{namespace}/events',
+    ...options,
+  });
+
+/**
+ * Get a list ingress controllers by namespace
+ *
+ * Get a list of ingress controllers for the given environment in the provided namespace.
+ * **Access policy**: Authenticated user.
+ */
+export const getKubernetesIngressControllersByNamespace = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<GetKubernetesIngressControllersByNamespaceData, ThrowOnError>
+): RequestResult<
+  GetKubernetesIngressControllersByNamespaceResponses,
+  GetKubernetesIngressControllersByNamespaceErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetKubernetesIngressControllersByNamespaceResponses,
+    GetKubernetesIngressControllersByNamespaceErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetKubernetesIngressControllersByNamespacePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetKubernetesIngressControllersByNamespaceResponse.parseAsync(
+        data
+      ),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/namespaces/{namespace}/ingresscontrollers',
+    ...options,
+  });
+
+/**
+ * Update (block/unblock) ingress controllers by namespace
+ *
+ * Update (block/unblock) ingress controllers by namespace for the provided environment.
+ * **Access policy**: Authenticated user.
+ */
+export const updateKubernetesIngressControllersByNamespace = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<
+    UpdateKubernetesIngressControllersByNamespaceData,
+    ThrowOnError
+  >
+): RequestResult<
+  UpdateKubernetesIngressControllersByNamespaceResponses,
+  UpdateKubernetesIngressControllersByNamespaceErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).put<
+    UpdateKubernetesIngressControllersByNamespaceResponses,
+    UpdateKubernetesIngressControllersByNamespaceErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zUpdateKubernetesIngressControllersByNamespaceBody,
+          path: zUpdateKubernetesIngressControllersByNamespacePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zUpdateKubernetesIngressControllersByNamespaceResponse.parseAsync(
+        data
+      ),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/namespaces/{namespace}/ingresscontrollers',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Get a list of Ingresses
+ *
+ * Get a list of Ingresses. If namespace is provided, it will return the list of Ingresses in that namespace.
+ * **Access policy**: Authenticated user.
+ */
+export const getAllKubernetesIngresses = <ThrowOnError extends boolean = true>(
+  options: Options<GetAllKubernetesIngressesData, ThrowOnError>
+): RequestResult<
+  GetAllKubernetesIngressesResponses,
+  GetAllKubernetesIngressesErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetAllKubernetesIngressesResponses,
+    GetAllKubernetesIngressesErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetAllKubernetesIngressesPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetAllKubernetesIngressesResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/namespaces/{namespace}/ingresses',
+    ...options,
+  });
+
+/**
+ * Create an Ingress
+ *
+ * Create an Ingress for the provided environment.
+ * **Access policy**: Authenticated user.
+ */
+export const createKubernetesIngress = <ThrowOnError extends boolean = true>(
+  options: Options<CreateKubernetesIngressData, ThrowOnError>
+): RequestResult<
+  CreateKubernetesIngressResponses,
+  CreateKubernetesIngressErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    CreateKubernetesIngressResponses,
+    CreateKubernetesIngressErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zCreateKubernetesIngressBody,
+          path: zCreateKubernetesIngressPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zCreateKubernetesIngressResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/namespaces/{namespace}/ingresses',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Update an Ingress
+ *
+ * Update an Ingress for the provided environment.
+ * **Access policy**: Authenticated user.
+ */
+export const updateKubernetesIngress = <ThrowOnError extends boolean = true>(
+  options: Options<UpdateKubernetesIngressData, ThrowOnError>
+): RequestResult<
+  UpdateKubernetesIngressResponses,
+  UpdateKubernetesIngressErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).put<
+    UpdateKubernetesIngressResponses,
+    UpdateKubernetesIngressErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zUpdateKubernetesIngressBody,
+          path: zUpdateKubernetesIngressPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zUpdateKubernetesIngressResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/namespaces/{namespace}/ingresses',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Get an Ingress by name
+ *
+ * Get an Ingress by name for the provided environment.
+ * **Access policy**: Authenticated user.
+ */
+export const getKubernetesIngress = <ThrowOnError extends boolean = true>(
+  options: Options<GetKubernetesIngressData, ThrowOnError>
+): RequestResult<
+  GetKubernetesIngressResponses,
+  GetKubernetesIngressErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetKubernetesIngressResponses,
+    GetKubernetesIngressErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetKubernetesIngressPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetKubernetesIngressResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/namespaces/{namespace}/ingresses/{ingress}',
+    ...options,
+  });
+
+/**
+ * Get PersistentVolumeClaims in a namespace
+ *
+ * Get a list of PersistentVolumeClaims in the specified namespace.
+ * **Access policy**: Authenticated user.
+ */
+export const getKubernetesPersistentVolumeClaimsInNamespace = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<
+    GetKubernetesPersistentVolumeClaimsInNamespaceData,
+    ThrowOnError
+  >
+): RequestResult<
+  GetKubernetesPersistentVolumeClaimsInNamespaceResponses,
+  GetKubernetesPersistentVolumeClaimsInNamespaceErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetKubernetesPersistentVolumeClaimsInNamespaceResponses,
+    GetKubernetesPersistentVolumeClaimsInNamespaceErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetKubernetesPersistentVolumeClaimsInNamespacePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetKubernetesPersistentVolumeClaimsInNamespaceResponse.parseAsync(
+        data
+      ),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/namespaces/{namespace}/persistent_volume_claims',
+    ...options,
+  });
+
+/**
+ * Get a specific PersistentVolumeClaim
+ *
+ * Get a PersistentVolumeClaim by name within a namespace.
+ * **Access policy**: Authenticated user.
+ */
+export const getKubernetesPersistentVolumeClaim = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<GetKubernetesPersistentVolumeClaimData, ThrowOnError>
+): RequestResult<
+  GetKubernetesPersistentVolumeClaimResponses,
+  GetKubernetesPersistentVolumeClaimErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetKubernetesPersistentVolumeClaimResponses,
+    GetKubernetesPersistentVolumeClaimErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetKubernetesPersistentVolumeClaimPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetKubernetesPersistentVolumeClaimResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/namespaces/{namespace}/persistent_volume_claims/{name}',
+    ...options,
+  });
+
+/**
+ * Delete a kubernetes pod
+ *
+ * Delete a single Kubernetes pod in the given namespace. The owning
+ * controller (Deployment, StatefulSet, DaemonSet, ...) is responsible
+ * for recreating the pod. For naked pods the pod is removed permanently.
+ * **Access policy**: Authenticated user.
+ */
+export const deleteKubernetesPod = <ThrowOnError extends boolean = true>(
+  options: Options<DeleteKubernetesPodData, ThrowOnError>
+): RequestResult<
+  DeleteKubernetesPodResponses,
+  DeleteKubernetesPodErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).delete<
+    DeleteKubernetesPodResponses,
+    DeleteKubernetesPodErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zDeleteKubernetesPodPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zDeleteKubernetesPodResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/namespaces/{namespace}/pods/{name}',
+    ...options,
+  });
+
+/**
+ * Restart all containers in a Kubernetes pod
+ *
+ * Restart all containers in a single Kubernetes pod in place using
+ * the Kubernetes 1.35 alpha pod-restart subresource. The pod itself
+ * is preserved. Requires the cluster to expose the corresponding
+ * subresource (and the matching feature gate to be enabled).
+ * **Access policy**: Authenticated user.
+ */
+export const restartKubernetesPod = <ThrowOnError extends boolean = true>(
+  options: Options<RestartKubernetesPodData, ThrowOnError>
+): RequestResult<
+  RestartKubernetesPodResponses,
+  RestartKubernetesPodErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    RestartKubernetesPodResponses,
+    RestartKubernetesPodErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zRestartKubernetesPodPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zRestartKubernetesPodResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/namespaces/{namespace}/pods/{name}/restart',
+    ...options,
+  });
+
+/**
+ * Get a Secret
+ *
+ * Get a Secret by name for a given namespace.
+ * **Access policy**: Authenticated user.
+ */
+export const getKubernetesSecret = <ThrowOnError extends boolean = true>(
+  options: Options<GetKubernetesSecretData, ThrowOnError>
+): RequestResult<
+  GetKubernetesSecretResponses,
+  GetKubernetesSecretErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetKubernetesSecretResponses,
+    GetKubernetesSecretErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetKubernetesSecretPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetKubernetesSecretResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/namespaces/{namespace}/secrets/{secret}',
+    ...options,
+  });
+
+/**
+ * Get a kubernetes service account
+ *
+ * Get a kubernetes service account in the given namespace.
+ * **Access policy**: Authenticated user.
+ */
+export const getKubernetesServiceAccount = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<GetKubernetesServiceAccountData, ThrowOnError>
+): RequestResult<
+  GetKubernetesServiceAccountResponses,
+  GetKubernetesServiceAccountErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetKubernetesServiceAccountResponses,
+    GetKubernetesServiceAccountErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetKubernetesServiceAccountPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetKubernetesServiceAccountResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/namespaces/{namespace}/service_accounts/{name}',
+    ...options,
+  });
+
+/**
+ * Update image pull secrets for a service account
+ *
+ * Replace the imagePullSecrets list on a service account with the provided list.
+ * **Access policy**: Authenticated user.
+ */
+export const updateKubernetesServiceAccountImagePullSecrets = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<
+    UpdateKubernetesServiceAccountImagePullSecretsData,
+    ThrowOnError
+  >
+): RequestResult<
+  UpdateKubernetesServiceAccountImagePullSecretsResponses,
+  UpdateKubernetesServiceAccountImagePullSecretsErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).put<
+    UpdateKubernetesServiceAccountImagePullSecretsResponses,
+    UpdateKubernetesServiceAccountImagePullSecretsErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zUpdateKubernetesServiceAccountImagePullSecretsBody,
+          path: zUpdateKubernetesServiceAccountImagePullSecretsPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zUpdateKubernetesServiceAccountImagePullSecretsResponse.parseAsync(
+        data
+      ),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/namespaces/{namespace}/service_accounts/{name}/image_pull_secrets',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Get a list of services for a given namespace
+ *
+ * Get a list of services for a given namespace.
+ * **Access policy**: Authenticated user.
+ */
+export const getKubernetesServicesByNamespace = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<GetKubernetesServicesByNamespaceData, ThrowOnError>
+): RequestResult<
+  GetKubernetesServicesByNamespaceResponses,
+  GetKubernetesServicesByNamespaceErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetKubernetesServicesByNamespaceResponses,
+    GetKubernetesServicesByNamespaceErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetKubernetesServicesByNamespacePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetKubernetesServicesByNamespaceResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/namespaces/{namespace}/services',
+    ...options,
+  });
+
+/**
+ * Create a service
+ *
+ * Create a service within a given namespace
+ * **Access policy**: Authenticated user.
+ */
+export const createKubernetesService = <ThrowOnError extends boolean = true>(
+  options: Options<CreateKubernetesServiceData, ThrowOnError>
+): RequestResult<
+  CreateKubernetesServiceResponses,
+  CreateKubernetesServiceErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    CreateKubernetesServiceResponses,
+    CreateKubernetesServiceErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zCreateKubernetesServiceBody,
+          path: zCreateKubernetesServicePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zCreateKubernetesServiceResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/namespaces/{namespace}/services',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Update a service
+ *
+ * Update a service within a given namespace.
+ * **Access policy**: Authenticated user.
+ */
+export const updateKubernetesService = <ThrowOnError extends boolean = true>(
+  options: Options<UpdateKubernetesServiceData, ThrowOnError>
+): RequestResult<
+  UpdateKubernetesServiceResponses,
+  UpdateKubernetesServiceErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).put<
+    UpdateKubernetesServiceResponses,
+    UpdateKubernetesServiceErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zUpdateKubernetesServiceBody,
+          path: zUpdateKubernetesServicePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zUpdateKubernetesServiceResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/namespaces/{namespace}/services',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Toggle the system state for a namespace
+ *
+ * Toggle the system state for a namespace
+ * **Access policy**: Administrator or environment administrator.
+ */
+export const kubernetesNamespacesToggleSystem = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<KubernetesNamespacesToggleSystemData, ThrowOnError>
+): RequestResult<
+  KubernetesNamespacesToggleSystemResponses,
+  KubernetesNamespacesToggleSystemErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).put<
+    KubernetesNamespacesToggleSystemResponses,
+    KubernetesNamespacesToggleSystemErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zKubernetesNamespacesToggleSystemBody,
+          path: zKubernetesNamespacesToggleSystemPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zKubernetesNamespacesToggleSystemResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/namespaces/{namespace}/system',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Get Kubernetes volumes within a namespace in the given Portainer environment
+ *
+ * Get a list of kubernetes volumes within the specified namespace in the given environment (Endpoint). The Endpoint ID must be a valid Portainer environment identifier.
+ * **Access policy**: Authenticated user.
+ */
+export const getKubernetesVolumesInNamespace = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<GetKubernetesVolumesInNamespaceData, ThrowOnError>
+): RequestResult<
+  GetKubernetesVolumesInNamespaceResponses,
+  GetKubernetesVolumesInNamespaceErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetKubernetesVolumesInNamespaceResponses,
+    GetKubernetesVolumesInNamespaceErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetKubernetesVolumesInNamespacePath,
+          query: zGetKubernetesVolumesInNamespaceQuery.optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetKubernetesVolumesInNamespaceResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/namespaces/{namespace}/volumes',
+    ...options,
+  });
+
+/**
+ * Get the total number of kubernetes namespaces within the given Portainer environment.
+ *
+ * Get the total number of kubernetes namespaces within the given environment, including the system namespaces. The total count depends on the user's role and permissions.
+ * **Access policy**: Authenticated user.
+ */
+export const getKubernetesNamespacesCount = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<GetKubernetesNamespacesCountData, ThrowOnError>
+): RequestResult<
+  GetKubernetesNamespacesCountResponses,
+  GetKubernetesNamespacesCountErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetKubernetesNamespacesCountResponses,
+    GetKubernetesNamespacesCountErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetKubernetesNamespacesCountPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetKubernetesNamespacesCountResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/namespaces/count',
+    ...options,
+  });
+
+/**
+ * Get Kubernetes cluster nodes
+ *
+ * Returns the list of Kubernetes nodes for the selected environment.
+ * **Access policy**: Authenticated user.
+ */
+export const getKubernetesNodes = <ThrowOnError extends boolean = true>(
+  options: Options<GetKubernetesNodesData, ThrowOnError>
+): RequestResult<
+  GetKubernetesNodesResponses,
+  GetKubernetesNodesErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetKubernetesNodesResponses,
+    GetKubernetesNodesErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetKubernetesNodesPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetKubernetesNodesResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/nodes',
+    ...options,
+  });
+
+/**
+ * Drain a Kubernetes node
+ *
+ * Drain a Kubernetes node by safely evicting all pods from the node, preparing it for maintenance or removal
+ * **Access policy**: authenticated
+ */
+export const drainNode = <ThrowOnError extends boolean = true>(
+  options: Options<DrainNodeData, ThrowOnError>
+): RequestResult<DrainNodeResponses, DrainNodeErrors, ThrowOnError> =>
+  (options.client ?? client).post<
+    DrainNodeResponses,
+    DrainNodeErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zDrainNodePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zDrainNodeResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/nodes/{name}/drain',
+    ...options,
+  });
+
+/**
+ * Get CPU and memory limits of all nodes within k8s cluster
+ *
+ * Get CPU and memory limits of all nodes within k8s cluster.
+ * **Access policy**: Authenticated user.
+ */
+export const getKubernetesNodesLimits = <ThrowOnError extends boolean = true>(
+  options: Options<GetKubernetesNodesLimitsData, ThrowOnError>
+): RequestResult<
+  GetKubernetesNodesLimitsResponses,
+  GetKubernetesNodesLimitsErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetKubernetesNodesLimitsResponses,
+    GetKubernetesNodesLimitsErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetKubernetesNodesLimitsPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetKubernetesNodesLimitsResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/nodes_limits',
+    ...options,
+  });
+
+/**
+ * Get all PersistentVolumeClaims
+ *
+ * Get a list of all PersistentVolumeClaims within the given environment. Scoped by namespace for non-admin users.
+ * **Access policy**: Authenticated user.
+ */
+export const getAllKubernetesPersistentVolumeClaims = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<GetAllKubernetesPersistentVolumeClaimsData, ThrowOnError>
+): RequestResult<
+  GetAllKubernetesPersistentVolumeClaimsResponses,
+  GetAllKubernetesPersistentVolumeClaimsErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetAllKubernetesPersistentVolumeClaimsResponses,
+    GetAllKubernetesPersistentVolumeClaimsErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetAllKubernetesPersistentVolumeClaimsPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetAllKubernetesPersistentVolumeClaimsResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/persistent_volume_claims',
+    ...options,
+  });
+
+/**
+ * Delete PersistentVolumeClaims
+ *
+ * Delete the provided list of PersistentVolumeClaims.
+ * **Access policy**: Authenticated user.
+ */
+export const deleteKubernetesPersistentVolumeClaims = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<DeleteKubernetesPersistentVolumeClaimsData, ThrowOnError>
+): RequestResult<
+  DeleteKubernetesPersistentVolumeClaimsResponses,
+  DeleteKubernetesPersistentVolumeClaimsErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    DeleteKubernetesPersistentVolumeClaimsResponses,
+    DeleteKubernetesPersistentVolumeClaimsErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zDeleteKubernetesPersistentVolumeClaimsBody,
+          path: zDeleteKubernetesPersistentVolumeClaimsPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zDeleteKubernetesPersistentVolumeClaimsResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/persistent_volume_claims/delete',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Resize a PersistentVolumeClaim
+ *
+ * Resize a PVC to a new size. The StorageClass must support volume expansion.
+ * **Access policy**: Authenticated user.
+ */
+export const resizeKubernetesPersistentVolumeClaim = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<ResizeKubernetesPersistentVolumeClaimData, ThrowOnError>
+): RequestResult<
+  ResizeKubernetesPersistentVolumeClaimResponses,
+  ResizeKubernetesPersistentVolumeClaimErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).put<
+    ResizeKubernetesPersistentVolumeClaimResponses,
+    ResizeKubernetesPersistentVolumeClaimErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zResizeKubernetesPersistentVolumeClaimBody,
+          path: zResizeKubernetesPersistentVolumeClaimPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zResizeKubernetesPersistentVolumeClaimResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/persistent_volume_claims/resize',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Get all PersistentVolumes in the cluster
+ *
+ * Get a list of all PersistentVolumes in the given environment.
+ * **Access policy**: Authenticated user.
+ */
+export const getAllKubernetesPersistentVolumes = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<GetAllKubernetesPersistentVolumesData, ThrowOnError>
+): RequestResult<
+  GetAllKubernetesPersistentVolumesResponses,
+  GetAllKubernetesPersistentVolumesErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetAllKubernetesPersistentVolumesResponses,
+    GetAllKubernetesPersistentVolumesErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetAllKubernetesPersistentVolumesPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetAllKubernetesPersistentVolumesResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/persistent_volumes',
+    ...options,
+  });
+
+/**
+ * Get a specific PersistentVolume
+ *
+ * Get a PersistentVolume by name in the given environment.
+ * **Access policy**: Authenticated user.
+ */
+export const getKubernetesPersistentVolume = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<GetKubernetesPersistentVolumeData, ThrowOnError>
+): RequestResult<
+  GetKubernetesPersistentVolumeResponses,
+  GetKubernetesPersistentVolumeErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetKubernetesPersistentVolumeResponses,
+    GetKubernetesPersistentVolumeErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetKubernetesPersistentVolumePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetKubernetesPersistentVolumeResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/persistent_volumes/{name}',
+    ...options,
+  });
+
+/**
+ * Delete PersistentVolumes
+ *
+ * Delete the provided list of PersistentVolumes.
+ * **Access policy**: Authenticated user.
+ */
+export const deleteKubernetesPersistentVolumes = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<DeleteKubernetesPersistentVolumesData, ThrowOnError>
+): RequestResult<
+  DeleteKubernetesPersistentVolumesResponses,
+  DeleteKubernetesPersistentVolumesErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    DeleteKubernetesPersistentVolumesResponses,
+    DeleteKubernetesPersistentVolumesErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zDeleteKubernetesPersistentVolumesBody,
+          path: zDeleteKubernetesPersistentVolumesPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zDeleteKubernetesPersistentVolumesResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/persistent_volumes/delete',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Update reclaim policy of a PersistentVolume
+ *
+ * Update the reclaim policy of a PersistentVolume.
+ * **Access policy**: Authenticated user.
+ */
+export const updateKubernetesPersistentVolumeReclaimPolicy = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<
+    UpdateKubernetesPersistentVolumeReclaimPolicyData,
+    ThrowOnError
+  >
+): RequestResult<
+  UpdateKubernetesPersistentVolumeReclaimPolicyResponses,
+  UpdateKubernetesPersistentVolumeReclaimPolicyErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).put<
+    UpdateKubernetesPersistentVolumeReclaimPolicyResponses,
+    UpdateKubernetesPersistentVolumeReclaimPolicyErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zUpdateKubernetesPersistentVolumeReclaimPolicyBody,
+          path: zUpdateKubernetesPersistentVolumeReclaimPolicyPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zUpdateKubernetesPersistentVolumeReclaimPolicyResponse.parseAsync(
+        data
+      ),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/persistent_volumes/reclaim_policy',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Check if RBAC is enabled
+ *
+ * Check if RBAC is enabled in the specified Kubernetes cluster.
+ * **Access policy**: Authenticated user.
+ */
+export const getKubernetesRbacStatus = <ThrowOnError extends boolean = true>(
+  options: Options<GetKubernetesRbacStatusData, ThrowOnError>
+): RequestResult<
+  GetKubernetesRbacStatusResponses,
+  GetKubernetesRbacStatusErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetKubernetesRbacStatusResponses,
+    GetKubernetesRbacStatusErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetKubernetesRbacStatusPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetKubernetesRbacStatusResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/rbac_enabled',
+    ...options,
+  });
+
+/**
+ * Delete role bindings
+ *
+ * Delete the provided list of role bindings.
+ * **Access policy**: Authenticated user.
+ */
+export const deleteRoleBindings = <ThrowOnError extends boolean = true>(
+  options: Options<DeleteRoleBindingsData, ThrowOnError>
+): RequestResult<
+  DeleteRoleBindingsResponses,
+  DeleteRoleBindingsErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    DeleteRoleBindingsResponses,
+    DeleteRoleBindingsErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zDeleteRoleBindingsBody,
+          path: zDeleteRoleBindingsPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zDeleteRoleBindingsResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/role_bindings/delete',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Get a list of kubernetes role bindings
+ *
+ * Get a list of kubernetes role bindings that the user has access to.
+ * **Access policy**: Authenticated user.
+ */
+export const getKubernetesRoleBindings = <ThrowOnError extends boolean = true>(
+  options: Options<GetKubernetesRoleBindingsData, ThrowOnError>
+): RequestResult<
+  GetKubernetesRoleBindingsResponses,
+  GetKubernetesRoleBindingsErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetKubernetesRoleBindingsResponses,
+    GetKubernetesRoleBindingsErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetKubernetesRoleBindingsPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetKubernetesRoleBindingsResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/rolebindings',
+    ...options,
+  });
+
+/**
+ * Get a list of kubernetes roles
+ *
+ * Get a list of kubernetes roles that the user has access to.
+ * **Access policy**: Authenticated user.
+ */
+export const getKubernetesRoles = <ThrowOnError extends boolean = true>(
+  options: Options<GetKubernetesRolesData, ThrowOnError>
+): RequestResult<
+  GetKubernetesRolesResponses,
+  GetKubernetesRolesErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetKubernetesRolesResponses,
+    GetKubernetesRolesErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetKubernetesRolesPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetKubernetesRolesResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/roles',
+    ...options,
+  });
+
+/**
+ * Delete roles
+ *
+ * Delete the provided list of roles.
+ * **Access policy**: Authenticated user.
+ */
+export const deleteRoles = <ThrowOnError extends boolean = true>(
+  options: Options<DeleteRolesData, ThrowOnError>
+): RequestResult<DeleteRolesResponses, DeleteRolesErrors, ThrowOnError> =>
+  (options.client ?? client).post<
+    DeleteRolesResponses,
+    DeleteRolesErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zDeleteRolesBody,
+          path: zDeleteRolesPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zDeleteRolesResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/roles/delete',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Get a list of Secrets
+ *
+ * Get a list of Secrets for a given namespace. If isUsed is set to true, information about the applications that use the secrets is also returned.
+ * **Access policy**: Authenticated user.
+ */
+export const getKubernetesSecrets = <ThrowOnError extends boolean = true>(
+  options: Options<GetKubernetesSecretsData, ThrowOnError>
+): RequestResult<
+  GetKubernetesSecretsResponses,
+  GetKubernetesSecretsErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetKubernetesSecretsResponses,
+    GetKubernetesSecretsErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetKubernetesSecretsPath,
+          query: zGetKubernetesSecretsQuery,
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetKubernetesSecretsResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/secrets',
+    ...options,
+  });
+
+/**
+ * Get Secrets count
+ *
+ * Get the count of Secrets across all namespaces that the user has access to.
+ * **Access policy**: Authenticated user.
+ */
+export const getKubernetesSecretsCount = <ThrowOnError extends boolean = true>(
+  options: Options<GetKubernetesSecretsCountData, ThrowOnError>
+): RequestResult<
+  GetKubernetesSecretsCountResponses,
+  GetKubernetesSecretsCountErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetKubernetesSecretsCountResponses,
+    GetKubernetesSecretsCountErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetKubernetesSecretsCountPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetKubernetesSecretsCountResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/secrets/count',
+    ...options,
+  });
+
+/**
+ * Delete service accounts
+ *
+ * Delete the provided list of service accounts.
+ * **Access policy**: Authenticated user.
+ */
+export const deleteServiceAccounts = <ThrowOnError extends boolean = true>(
+  options: Options<DeleteServiceAccountsData, ThrowOnError>
+): RequestResult<
+  DeleteServiceAccountsResponses,
+  DeleteServiceAccountsErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    DeleteServiceAccountsResponses,
+    DeleteServiceAccountsErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zDeleteServiceAccountsBody,
+          path: zDeleteServiceAccountsPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zDeleteServiceAccountsResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/service_accounts/delete',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Get a list of kubernetes service accounts
+ *
+ * Get a list of kubernetes service accounts that the user has access to.
+ * **Access policy**: Authenticated user.
+ */
+export const getKubernetesServiceAccounts = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<GetKubernetesServiceAccountsData, ThrowOnError>
+): RequestResult<
+  GetKubernetesServiceAccountsResponses,
+  GetKubernetesServiceAccountsErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetKubernetesServiceAccountsResponses,
+    GetKubernetesServiceAccountsErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetKubernetesServiceAccountsPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetKubernetesServiceAccountsResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/serviceaccounts',
+    ...options,
+  });
+
+/**
+ * Get a list of services
+ *
+ * Get a list of services that the user has access to.
+ * **Access policy**: Authenticated user.
+ */
+export const getKubernetesServices = <ThrowOnError extends boolean = true>(
+  options: Options<GetKubernetesServicesData, ThrowOnError>
+): RequestResult<
+  GetKubernetesServicesResponses,
+  GetKubernetesServicesErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetKubernetesServicesResponses,
+    GetKubernetesServicesErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetKubernetesServicesPath,
+          query: zGetKubernetesServicesQuery.optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetKubernetesServicesResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/services',
+    ...options,
+  });
+
+/**
+ * Get services count
+ *
+ * Get the count of services that the user has access to.
+ * **Access policy**: Authenticated user.
+ */
+export const getAllKubernetesServicesCount = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<GetAllKubernetesServicesCountData, ThrowOnError>
+): RequestResult<
+  GetAllKubernetesServicesCountResponses,
+  GetAllKubernetesServicesCountErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetAllKubernetesServicesCountResponses,
+    GetAllKubernetesServicesCountErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetAllKubernetesServicesCountPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetAllKubernetesServicesCountResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/services/count',
+    ...options,
+  });
+
+/**
+ * Delete services
+ *
+ * Delete the provided list of services.
+ * **Access policy**: Authenticated user.
+ */
+export const deleteKubernetesServices = <ThrowOnError extends boolean = true>(
+  options: Options<DeleteKubernetesServicesData, ThrowOnError>
+): RequestResult<
+  DeleteKubernetesServicesResponses,
+  DeleteKubernetesServicesErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    DeleteKubernetesServicesResponses,
+    DeleteKubernetesServicesErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zDeleteKubernetesServicesBody,
+          path: zDeleteKubernetesServicesPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zDeleteKubernetesServicesResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/services/delete',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Get all StorageClasses
+ *
+ * Get a list of all StorageClasses in the given environment.
+ * **Access policy**: Authenticated user.
+ */
+export const getAllKubernetesStorageClasses = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<GetAllKubernetesStorageClassesData, ThrowOnError>
+): RequestResult<
+  GetAllKubernetesStorageClassesResponses,
+  GetAllKubernetesStorageClassesErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetAllKubernetesStorageClassesResponses,
+    GetAllKubernetesStorageClassesErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetAllKubernetesStorageClassesPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetAllKubernetesStorageClassesResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/storage_classes',
+    ...options,
+  });
+
+/**
+ * Get a specific StorageClass
+ *
+ * Get a StorageClass by name in the given environment.
+ * **Access policy**: Authenticated user.
+ */
+export const getKubernetesStorageClass = <ThrowOnError extends boolean = true>(
+  options: Options<GetKubernetesStorageClassData, ThrowOnError>
+): RequestResult<
+  GetKubernetesStorageClassResponses,
+  GetKubernetesStorageClassErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetKubernetesStorageClassResponses,
+    GetKubernetesStorageClassErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetKubernetesStorageClassPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetKubernetesStorageClassResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/storage_classes/{name}',
+    ...options,
+  });
+
+/**
+ * Set a StorageClass as default
+ *
+ * Set the specified StorageClass as the cluster default, removing default from any other.
+ * **Access policy**: Authenticated user.
+ */
+export const setDefaultKubernetesStorageClass = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<SetDefaultKubernetesStorageClassData, ThrowOnError>
+): RequestResult<
+  SetDefaultKubernetesStorageClassResponses,
+  SetDefaultKubernetesStorageClassErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).put<
+    SetDefaultKubernetesStorageClassResponses,
+    SetDefaultKubernetesStorageClassErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zSetDefaultKubernetesStorageClassPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zSetDefaultKubernetesStorageClassResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/storage_classes/{name}/default',
+    ...options,
+  });
+
+/**
+ * Delete StorageClasses
+ *
+ * Delete the provided list of StorageClasses.
+ * **Access policy**: Authenticated user.
+ */
+export const deleteKubernetesStorageClasses = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<DeleteKubernetesStorageClassesData, ThrowOnError>
+): RequestResult<
+  DeleteKubernetesStorageClassesResponses,
+  DeleteKubernetesStorageClassesErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    DeleteKubernetesStorageClassesResponses,
+    DeleteKubernetesStorageClassesErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zDeleteKubernetesStorageClassesBody,
+          path: zDeleteKubernetesStorageClassesPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zDeleteKubernetesStorageClassesResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/storage_classes/delete',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Get the Kubernetes cluster version and Portainer-relevant capabilities
+ *
+ * Get the Kubernetes cluster version (major, minor, gitVersion, ...)
+ * as reported by the cluster's discovery API, augmented with capability
+ * flags Portainer uses to gate UI features (e.g. supportsPodRestart).
+ * **Access policy**: Authenticated user.
+ */
+export const getKubernetesVersion = <ThrowOnError extends boolean = true>(
+  options: Options<GetKubernetesVersionData, ThrowOnError>
+): RequestResult<
+  GetKubernetesVersionResponses,
+  GetKubernetesVersionErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetKubernetesVersionResponses,
+    GetKubernetesVersionErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetKubernetesVersionPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetKubernetesVersionResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/version',
+    ...options,
+  });
+
+/**
+ * Get Kubernetes volumes within the given Portainer environment
+ *
+ * Get a list of all kubernetes volumes within the given environment (Endpoint). The Endpoint ID must be a valid Portainer environment identifier.
+ * **Access policy**: Authenticated user.
+ */
+export const getAllKubernetesVolumes = <ThrowOnError extends boolean = true>(
+  options: Options<GetAllKubernetesVolumesData, ThrowOnError>
+): RequestResult<
+  GetAllKubernetesVolumesResponses,
+  GetAllKubernetesVolumesErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetAllKubernetesVolumesResponses,
+    GetAllKubernetesVolumesErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetAllKubernetesVolumesPath,
+          query: zGetAllKubernetesVolumesQuery.optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetAllKubernetesVolumesResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/volumes',
+    ...options,
+  });
+
+/**
+ * Get a Kubernetes volume within the given Portainer environment
+ *
+ * Get a Kubernetes volume within the given environment (Endpoint). The Endpoint ID must be a valid Portainer environment identifier.
+ * **Access policy**: Authenticated user.
+ */
+export const getKubernetesVolume = <ThrowOnError extends boolean = true>(
+  options: Options<GetKubernetesVolumeData, ThrowOnError>
+): RequestResult<
+  GetKubernetesVolumeResponses,
+  GetKubernetesVolumeErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetKubernetesVolumeResponses,
+    GetKubernetesVolumeErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetKubernetesVolumePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetKubernetesVolumeResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/volumes/{namespace}/{volume}',
+    ...options,
+  });
+
+/**
+ * Get the total number of kubernetes volumes within the given Portainer environment.
+ *
+ * Get the total number of kubernetes volumes within the given environment (Endpoint). The total count depends on the user's role and permissions. The Endpoint ID must be a valid Portainer environment identifier.
+ * **Access policy**: Authenticated user.
+ */
+export const getAllKubernetesVolumesCount = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<GetAllKubernetesVolumesCountData, ThrowOnError>
+): RequestResult<
+  GetAllKubernetesVolumesCountResponses,
+  GetAllKubernetesVolumesCountErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetAllKubernetesVolumesCountResponses,
+    GetAllKubernetesVolumesCountErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zGetAllKubernetesVolumesCountPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetAllKubernetesVolumesCountResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/{id}/volumes/count',
+    ...options,
+  });
+
+/**
+ * Generate a kubeconfig file
+ *
+ * Generate a kubeconfig file that allows a client to communicate with the Kubernetes API server
+ * **Access policy**: Authenticated user.
+ */
+export const getKubernetesConfig = <ThrowOnError extends boolean = true>(
+  options?: Options<GetKubernetesConfigData, ThrowOnError>
+): RequestResult<
+  GetKubernetesConfigResponses,
+  GetKubernetesConfigErrors,
+  ThrowOnError
+> =>
+  (options?.client ?? client).get<
+    GetKubernetesConfigResponses,
+    GetKubernetesConfigErrors,
+    ThrowOnError
+  >({
+    querySerializer: {
+      parameters: {
+        ids: { array: { explode: false } },
+        excludeIds: { array: { explode: false } },
+      },
+    },
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: z.never().optional(),
+          query: zGetKubernetesConfigQuery.optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/kubernetes/config',
+    ...options,
+  });
+
+/**
+ * Test LDAP connectivity
+ *
+ * Test LDAP connectivity using LDAP details
+ * **Access policy**: administrator
+ */
+export const ldapCheck = <ThrowOnError extends boolean = true>(
+  options: Options<LdapCheckData, ThrowOnError>
+): RequestResult<LdapCheckResponses, LdapCheckErrors, ThrowOnError> =>
+  (options.client ?? client).post<
+    LdapCheckResponses,
+    LdapCheckErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zLdapCheckBody,
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zLdapCheckResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/ldap/check',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * fetches the message of the day
+ *
+ * **Access policy**: restricted
+ */
+export const motd = <ThrowOnError extends boolean = true>(
+  options?: Options<MotdData, ThrowOnError>
+): RequestResult<MotdResponses, unknown, ThrowOnError> =>
+  (options?.client ?? client).get<MotdResponses, unknown, ThrowOnError>({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) => await zMotdResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/motd',
+    ...options,
+  });
+
+/**
+ * List Registries
+ *
+ * List all registries based on the current user authorizations.
+ * Will return all registries if using an administrator account otherwise it
+ * will only return authorized registries.
+ * **Access policy**: restricted
+ */
+export const registryList = <ThrowOnError extends boolean = true>(
+  options?: Options<RegistryListData, ThrowOnError>
+): RequestResult<RegistryListResponses, RegistryListErrors, ThrowOnError> =>
+  (options?.client ?? client).get<
+    RegistryListResponses,
+    RegistryListErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zRegistryListResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/registries',
+    ...options,
+  });
+
+/**
+ * Create a new registry
+ *
+ * Create a new registry.
+ * **Access policy**: restricted
+ */
+export const registryCreate = <ThrowOnError extends boolean = true>(
+  options: Options<RegistryCreateData, ThrowOnError>
+): RequestResult<RegistryCreateResponses, RegistryCreateErrors, ThrowOnError> =>
+  (options.client ?? client).post<
+    RegistryCreateResponses,
+    RegistryCreateErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zRegistryCreateBody,
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zRegistryCreateResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/registries',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Remove a registry
+ *
+ * Remove a registry
+ * **Access policy**: restricted
+ */
+export const registryDelete = <ThrowOnError extends boolean = true>(
+  options: Options<RegistryDeleteData, ThrowOnError>
+): RequestResult<RegistryDeleteResponses, RegistryDeleteErrors, ThrowOnError> =>
+  (options.client ?? client).delete<
+    RegistryDeleteResponses,
+    RegistryDeleteErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zRegistryDeletePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zRegistryDeleteResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/registries/{id}',
+    ...options,
+  });
+
+/**
+ * Inspect a registry
+ *
+ * Retrieve details about a registry.
+ * **Access policy**: restricted
+ */
+export const registryInspect = <ThrowOnError extends boolean = true>(
+  options: Options<RegistryInspectData, ThrowOnError>
+): RequestResult<
+  RegistryInspectResponses,
+  RegistryInspectErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    RegistryInspectResponses,
+    RegistryInspectErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zRegistryInspectPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zRegistryInspectResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/registries/{id}',
+    ...options,
+  });
+
+/**
+ * Update a registry
+ *
+ * Update a registry
+ * **Access policy**: restricted
+ */
+export const registryUpdate = <ThrowOnError extends boolean = true>(
+  options: Options<RegistryUpdateData, ThrowOnError>
+): RequestResult<RegistryUpdateResponses, RegistryUpdateErrors, ThrowOnError> =>
+  (options.client ?? client).put<
+    RegistryUpdateResponses,
+    RegistryUpdateErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zRegistryUpdateBody,
+          path: zRegistryUpdatePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zRegistryUpdateResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/registries/{id}',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Configures a registry
+ *
+ * Configures a registry.
+ * **Access policy**: restricted
+ */
+export const registryConfigure = <ThrowOnError extends boolean = true>(
+  options: Options<RegistryConfigureData, ThrowOnError>
+): RequestResult<
+  RegistryConfigureResponses,
+  RegistryConfigureErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    RegistryConfigureResponses,
+    RegistryConfigureErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zRegistryConfigureBody,
+          path: zRegistryConfigurePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zRegistryConfigureResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/registries/{id}/configure',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Test registry connection
+ *
+ * Test connection to a registry with provided credentials
+ * **Access policy**: authenticated
+ */
+export const registryPing = <ThrowOnError extends boolean = true>(
+  options: Options<RegistryPingData, ThrowOnError>
+): RequestResult<RegistryPingResponses, RegistryPingErrors, ThrowOnError> =>
+  (options.client ?? client).post<
+    RegistryPingResponses,
+    RegistryPingErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zRegistryPingBody,
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zRegistryPingResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/registries/ping',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Create a new resource control
+ *
+ * Create a new resource control to restrict access to a Docker resource.
+ * **Access policy**: administrator
+ */
+export const resourceControlCreate = <ThrowOnError extends boolean = true>(
+  options: Options<ResourceControlCreateData, ThrowOnError>
+): RequestResult<
+  ResourceControlCreateResponses,
+  ResourceControlCreateErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    ResourceControlCreateResponses,
+    ResourceControlCreateErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zResourceControlCreateBody,
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zResourceControlCreateResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/resource_controls',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Remove a resource control
+ *
+ * Remove a resource control.
+ * **Access policy**: administrator
+ */
+export const resourceControlDelete = <ThrowOnError extends boolean = true>(
+  options: Options<ResourceControlDeleteData, ThrowOnError>
+): RequestResult<
+  ResourceControlDeleteResponses,
+  ResourceControlDeleteErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).delete<
+    ResourceControlDeleteResponses,
+    ResourceControlDeleteErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zResourceControlDeletePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zResourceControlDeleteResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/resource_controls/{id}',
+    ...options,
+  });
+
+/**
+ * Update a resource control
+ *
+ * Update a resource control
+ * **Access policy**: authenticated
+ */
+export const resourceControlUpdate = <ThrowOnError extends boolean = true>(
+  options: Options<ResourceControlUpdateData, ThrowOnError>
+): RequestResult<
+  ResourceControlUpdateResponses,
+  ResourceControlUpdateErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).put<
+    ResourceControlUpdateResponses,
+    ResourceControlUpdateErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zResourceControlUpdateBody,
+          path: zResourceControlUpdatePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zResourceControlUpdateResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/resource_controls/{id}',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Triggers a system restore using provided backup file
+ *
+ * Triggers a system restore using provided backup file
+ * **Access policy**: public (requires the X-Setup-Token header on an uninitialized instance unless --no-setup-token is set)
+ */
+export const restore = <ThrowOnError extends boolean = true>(
+  options: Options<RestoreData, ThrowOnError>
+): RequestResult<RestoreResponses, RestoreErrors, ThrowOnError> =>
+  (options.client ?? client).post<
+    RestoreResponses,
+    RestoreErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zRestoreBody,
+          headers: zRestoreHeaders.optional(),
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    url: '/restore',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * List roles
+ *
+ * List all roles available for use
+ * **Access policy**: administrator
+ */
+export const roleList = <ThrowOnError extends boolean = true>(
+  options?: Options<RoleListData, ThrowOnError>
+): RequestResult<RoleListResponses, RoleListErrors, ThrowOnError> =>
+  (options?.client ?? client).get<
+    RoleListResponses,
+    RoleListErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) => await zRoleListResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/roles',
+    ...options,
+  });
+
+/**
+ * Retrieve Portainer settings
+ *
+ * Retrieve Portainer settings.
+ * **Access policy**: administrator
+ */
+export const settingsInspect = <ThrowOnError extends boolean = true>(
+  options?: Options<SettingsInspectData, ThrowOnError>
+): RequestResult<
+  SettingsInspectResponses,
+  SettingsInspectErrors,
+  ThrowOnError
+> =>
+  (options?.client ?? client).get<
+    SettingsInspectResponses,
+    SettingsInspectErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zSettingsInspectResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/settings',
+    ...options,
+  });
+
+/**
+ * Update Portainer settings
+ *
+ * Update Portainer settings.
+ * **Access policy**: administrator
+ */
+export const settingsUpdate = <ThrowOnError extends boolean = true>(
+  options: Options<SettingsUpdateData, ThrowOnError>
+): RequestResult<SettingsUpdateResponses, SettingsUpdateErrors, ThrowOnError> =>
+  (options.client ?? client).put<
+    SettingsUpdateResponses,
+    SettingsUpdateErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zSettingsUpdateBody,
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zSettingsUpdateResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/settings',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Retrieve Portainer public settings
+ *
+ * Retrieve public settings. Returns a small set of settings that are not reserved to administrators only.
+ * **Access policy**: public
+ */
+export const settingsPublic = <ThrowOnError extends boolean = true>(
+  options?: Options<SettingsPublicData, ThrowOnError>
+): RequestResult<SettingsPublicResponses, SettingsPublicErrors, ThrowOnError> =>
+  (options?.client ?? client).get<
+    SettingsPublicResponses,
+    SettingsPublicErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zSettingsPublicResponse.parseAsync(data),
+    url: '/settings/public',
+    ...options,
+  });
+
+/**
+ * Inspect the ssl settings
+ *
+ * Retrieve the ssl settings.
+ * **Access policy**: administrator
+ */
+export const sslInspect = <ThrowOnError extends boolean = true>(
+  options?: Options<SslInspectData, ThrowOnError>
+): RequestResult<SslInspectResponses, SslInspectErrors, ThrowOnError> =>
+  (options?.client ?? client).get<
+    SslInspectResponses,
+    SslInspectErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zSslInspectResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/ssl',
+    ...options,
+  });
+
+/**
+ * Update the ssl settings
+ *
+ * Update the ssl settings.
+ * **Access policy**: administrator
+ */
+export const sslUpdate = <ThrowOnError extends boolean = true>(
+  options: Options<SslUpdateData, ThrowOnError>
+): RequestResult<SslUpdateResponses, SslUpdateErrors, ThrowOnError> =>
+  (options.client ?? client).put<
+    SslUpdateResponses,
+    SslUpdateErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zSslUpdateBody,
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zSslUpdateResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/ssl',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * List stacks
+ *
+ * List all stacks based on the current user authorizations.
+ * Will return all stacks if using an administrator account otherwise it
+ * will only return the list of stacks the user have access to.
+ * Limited stacks will not be returned by this endpoint.
+ * **Access policy**: authenticated
+ */
+export const stackList = <ThrowOnError extends boolean = true>(
+  options?: Options<StackListData, ThrowOnError>
+): RequestResult<StackListResponses, StackListErrors, ThrowOnError> =>
+  (options?.client ?? client).get<
+    StackListResponses,
+    StackListErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: z.never().optional(),
+          query: zStackListQuery.optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zStackListResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/stacks',
+    ...options,
+  });
+
+/**
+ * Remove a stack
+ *
+ * Remove a stack.
+ * **Access policy**: restricted
+ */
+export const stackDelete = <ThrowOnError extends boolean = true>(
+  options: Options<StackDeleteData, ThrowOnError>
+): RequestResult<StackDeleteResponses, StackDeleteErrors, ThrowOnError> =>
+  (options.client ?? client).delete<
+    StackDeleteResponses,
+    StackDeleteErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zStackDeletePath,
+          query: zStackDeleteQuery,
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zStackDeleteResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/stacks/{id}',
+    ...options,
+  });
+
+/**
+ * Inspect a stack
+ *
+ * Retrieve details about a stack.
+ * **Access policy**: restricted
+ */
+export const stackInspect = <ThrowOnError extends boolean = true>(
+  options: Options<StackInspectData, ThrowOnError>
+): RequestResult<StackInspectResponses, StackInspectErrors, ThrowOnError> =>
+  (options.client ?? client).get<
+    StackInspectResponses,
+    StackInspectErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zStackInspectPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zStackInspectResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/stacks/{id}',
+    ...options,
+  });
+
+/**
+ * Update a stack
+ *
+ * Update a stack, only for file based stacks.
+ * **Access policy**: authenticated
+ */
+export const stackUpdate = <ThrowOnError extends boolean = true>(
+  options: Options<StackUpdateData, ThrowOnError>
+): RequestResult<StackUpdateResponses, StackUpdateErrors, ThrowOnError> =>
+  (options.client ?? client).put<
+    StackUpdateResponses,
+    StackUpdateErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zStackUpdateBody,
+          path: zStackUpdatePath,
+          query: zStackUpdateQuery,
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zStackUpdateResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/stacks/{id}',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Associate an orphaned stack to a new environment(endpoint)
+ *
+ * **Access policy**: administrator
+ */
+export const stackAssociate = <ThrowOnError extends boolean = true>(
+  options: Options<StackAssociateData, ThrowOnError>
+): RequestResult<StackAssociateResponses, StackAssociateErrors, ThrowOnError> =>
+  (options.client ?? client).put<
+    StackAssociateResponses,
+    StackAssociateErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zStackAssociatePath,
+          query: zStackAssociateQuery,
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zStackAssociateResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/stacks/{id}/associate',
+    ...options,
+  });
+
+/**
+ * Retrieve the content of the Stack file for the specified stack
+ *
+ * Get Stack file content.
+ * **Access policy**: restricted
+ */
+export const stackFileInspect = <ThrowOnError extends boolean = true>(
+  options: Options<StackFileInspectData, ThrowOnError>
+): RequestResult<
+  StackFileInspectResponses,
+  StackFileInspectErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    StackFileInspectResponses,
+    StackFileInspectErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zStackFileInspectPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zStackFileInspectResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/stacks/{id}/file',
+    ...options,
+  });
+
+/**
+ * Update a stack's Git configs
+ *
+ * Update the Git settings in a stack, e.g., RepositoryReferenceName and AutoUpdate. When SourceID is set, URL/auth/TLS are taken from the referenced Source.
+ * **Access policy**: authenticated
+ */
+export const stackUpdateGit = <ThrowOnError extends boolean = true>(
+  options: Options<StackUpdateGitData, ThrowOnError>
+): RequestResult<StackUpdateGitResponses, StackUpdateGitErrors, ThrowOnError> =>
+  (options.client ?? client).post<
+    StackUpdateGitResponses,
+    StackUpdateGitErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zStackUpdateGitBody,
+          path: zStackUpdateGitPath,
+          query: zStackUpdateGitQuery.optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zStackUpdateGitResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/stacks/{id}/git',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Redeploy a stack
+ *
+ * Pull and redeploy a stack via Git
+ * **Access policy**: authenticated
+ */
+export const stackGitRedeploy = <ThrowOnError extends boolean = true>(
+  options: Options<StackGitRedeployData, ThrowOnError>
+): RequestResult<
+  StackGitRedeployResponses,
+  StackGitRedeployErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).put<
+    StackGitRedeployResponses,
+    StackGitRedeployErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zStackGitRedeployBody,
+          path: zStackGitRedeployPath,
+          query: zStackGitRedeployQuery.optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zStackGitRedeployResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/stacks/{id}/git/redeploy',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Migrate a stack to another environment(endpoint)
+ *
+ * Migrate a stack from an environment(endpoint) to another environment(endpoint). It will re-create the stack inside the target environment(endpoint) before removing the original stack.
+ * **Access policy**: authenticated
+ */
+export const stackMigrate = <ThrowOnError extends boolean = true>(
+  options: Options<StackMigrateData, ThrowOnError>
+): RequestResult<StackMigrateResponses, StackMigrateErrors, ThrowOnError> =>
+  (options.client ?? client).post<
+    StackMigrateResponses,
+    StackMigrateErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zStackMigrateBody,
+          path: zStackMigratePath,
+          query: zStackMigrateQuery.optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zStackMigrateResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/stacks/{id}/migrate',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Starts a stopped Stack
+ *
+ * Starts a stopped Stack.
+ * **Access policy**: authenticated
+ */
+export const stackStart = <ThrowOnError extends boolean = true>(
+  options: Options<StackStartData, ThrowOnError>
+): RequestResult<StackStartResponses, StackStartErrors, ThrowOnError> =>
+  (options.client ?? client).post<
+    StackStartResponses,
+    StackStartErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zStackStartPath,
+          query: zStackStartQuery,
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zStackStartResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/stacks/{id}/start',
+    ...options,
+  });
+
+/**
+ * Stop a running Stack
+ *
+ * Stop a running Stack.
+ * **Access policy**: authenticated
+ */
+export const stackStop = <ThrowOnError extends boolean = true>(
+  options: Options<StackStopData, ThrowOnError>
+): RequestResult<StackStopResponses, StackStopErrors, ThrowOnError> =>
+  (options.client ?? client).post<
+    StackStopResponses,
+    StackStopErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zStackStopPath,
+          query: zStackStopQuery,
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zStackStopResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/stacks/{id}/stop',
+    ...options,
+  });
+
+/**
+ * Deploy a new kubernetes stack from a git repository
+ *
+ * Deploy a new stack into a Docker environment specified via the environment identifier.
+ * **Access policy**: authenticated
+ */
+export const stackCreateKubernetesGit = <ThrowOnError extends boolean = true>(
+  options: Options<StackCreateKubernetesGitData, ThrowOnError>
+): RequestResult<
+  StackCreateKubernetesGitResponses,
+  StackCreateKubernetesGitErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    StackCreateKubernetesGitResponses,
+    StackCreateKubernetesGitErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zStackCreateKubernetesGitBody,
+          path: z.never().optional(),
+          query: zStackCreateKubernetesGitQuery,
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zStackCreateKubernetesGitResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/stacks/create/kubernetes/repository',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Deploy a new kubernetes stack from a file
+ *
+ * Deploy a new stack into a Docker environment specified via the environment identifier.
+ * **Access policy**: authenticated
+ */
+export const stackCreateKubernetesFile = <ThrowOnError extends boolean = true>(
+  options: Options<StackCreateKubernetesFileData, ThrowOnError>
+): RequestResult<
+  StackCreateKubernetesFileResponses,
+  StackCreateKubernetesFileErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    StackCreateKubernetesFileResponses,
+    StackCreateKubernetesFileErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zStackCreateKubernetesFileBody,
+          path: z.never().optional(),
+          query: zStackCreateKubernetesFileQuery,
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zStackCreateKubernetesFileResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/stacks/create/kubernetes/string',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Deploy a new kubernetes stack from a url
+ *
+ * Deploy a new stack into a Docker environment specified via the environment identifier.
+ * **Access policy**: authenticated
+ */
+export const stackCreateKubernetesUrl = <ThrowOnError extends boolean = true>(
+  options: Options<StackCreateKubernetesUrlData, ThrowOnError>
+): RequestResult<
+  StackCreateKubernetesUrlResponses,
+  StackCreateKubernetesUrlErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    StackCreateKubernetesUrlResponses,
+    StackCreateKubernetesUrlErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zStackCreateKubernetesUrlBody,
+          path: z.never().optional(),
+          query: zStackCreateKubernetesUrlQuery,
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zStackCreateKubernetesUrlResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/stacks/create/kubernetes/url',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Deploy a new compose stack from a file
+ *
+ * Deploy a new stack into a Docker environment specified via the environment identifier.
+ * **Access policy**: authenticated
+ */
+export const stackCreateDockerStandaloneFile = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<StackCreateDockerStandaloneFileData, ThrowOnError>
+): RequestResult<
+  StackCreateDockerStandaloneFileResponses,
+  StackCreateDockerStandaloneFileErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    StackCreateDockerStandaloneFileResponses,
+    StackCreateDockerStandaloneFileErrors,
+    ThrowOnError
+  >({
+    ...formDataBodySerializer,
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zStackCreateDockerStandaloneFileBody,
+          path: z.never().optional(),
+          query: zStackCreateDockerStandaloneFileQuery,
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zStackCreateDockerStandaloneFileResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/stacks/create/standalone/file',
+    ...options,
+    headers: {
+      'Content-Type': null,
+      ...options.headers,
+    },
+  });
+
+/**
+ * Deploy a new compose stack from repository
+ *
+ * Deploy a new stack into a Docker environment specified via the environment identifier.
+ * **Access policy**: authenticated
+ */
+export const stackCreateDockerStandaloneRepository = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<StackCreateDockerStandaloneRepositoryData, ThrowOnError>
+): RequestResult<
+  StackCreateDockerStandaloneRepositoryResponses,
+  StackCreateDockerStandaloneRepositoryErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    StackCreateDockerStandaloneRepositoryResponses,
+    StackCreateDockerStandaloneRepositoryErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zStackCreateDockerStandaloneRepositoryBody,
+          path: z.never().optional(),
+          query: zStackCreateDockerStandaloneRepositoryQuery,
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zStackCreateDockerStandaloneRepositoryResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/stacks/create/standalone/repository',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Deploy a new compose stack from a text
+ *
+ * Deploy a new stack into a Docker environment specified via the environment identifier.
+ * **Access policy**: authenticated
+ */
+export const stackCreateDockerStandaloneString = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<StackCreateDockerStandaloneStringData, ThrowOnError>
+): RequestResult<
+  StackCreateDockerStandaloneStringResponses,
+  StackCreateDockerStandaloneStringErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    StackCreateDockerStandaloneStringResponses,
+    StackCreateDockerStandaloneStringErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zStackCreateDockerStandaloneStringBody,
+          path: z.never().optional(),
+          query: zStackCreateDockerStandaloneStringQuery,
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zStackCreateDockerStandaloneStringResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/stacks/create/standalone/string',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Deploy a new swarm stack from a file
+ *
+ * Deploy a new stack into a Docker environment specified via the environment identifier.
+ * **Access policy**: authenticated
+ */
+export const stackCreateDockerSwarmFile = <ThrowOnError extends boolean = true>(
+  options: Options<StackCreateDockerSwarmFileData, ThrowOnError>
+): RequestResult<
+  StackCreateDockerSwarmFileResponses,
+  StackCreateDockerSwarmFileErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    StackCreateDockerSwarmFileResponses,
+    StackCreateDockerSwarmFileErrors,
+    ThrowOnError
+  >({
+    ...formDataBodySerializer,
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zStackCreateDockerSwarmFileBody.optional(),
+          path: z.never().optional(),
+          query: zStackCreateDockerSwarmFileQuery,
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zStackCreateDockerSwarmFileResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/stacks/create/swarm/file',
+    ...options,
+    headers: {
+      'Content-Type': null,
+      ...options.headers,
+    },
+  });
+
+/**
+ * Deploy a new swarm stack from a git repository
+ *
+ * Deploy a new stack into a Docker environment specified via the environment identifier.
+ * **Access policy**: authenticated
+ */
+export const stackCreateDockerSwarmRepository = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<StackCreateDockerSwarmRepositoryData, ThrowOnError>
+): RequestResult<
+  StackCreateDockerSwarmRepositoryResponses,
+  StackCreateDockerSwarmRepositoryErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    StackCreateDockerSwarmRepositoryResponses,
+    StackCreateDockerSwarmRepositoryErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zStackCreateDockerSwarmRepositoryBody,
+          path: z.never().optional(),
+          query: zStackCreateDockerSwarmRepositoryQuery,
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zStackCreateDockerSwarmRepositoryResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/stacks/create/swarm/repository',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Deploy a new swarm stack from a text
+ *
+ * Deploy a new stack into a Docker environment specified via the environment identifier.
+ * **Access policy**: authenticated
+ */
+export const stackCreateDockerSwarmString = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<StackCreateDockerSwarmStringData, ThrowOnError>
+): RequestResult<
+  StackCreateDockerSwarmStringResponses,
+  StackCreateDockerSwarmStringErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    StackCreateDockerSwarmStringResponses,
+    StackCreateDockerSwarmStringErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zStackCreateDockerSwarmStringBody,
+          path: z.never().optional(),
+          query: zStackCreateDockerSwarmStringQuery,
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zStackCreateDockerSwarmStringResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/stacks/create/swarm/string',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Remove Kubernetes stacks by name
+ *
+ * Remove a stack.
+ * **Access policy**: restricted
+ */
+export const stackDeleteKubernetesByName = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<StackDeleteKubernetesByNameData, ThrowOnError>
+): RequestResult<
+  StackDeleteKubernetesByNameResponses,
+  StackDeleteKubernetesByNameErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).delete<
+    StackDeleteKubernetesByNameResponses,
+    StackDeleteKubernetesByNameErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zStackDeleteKubernetesByNamePath,
+          query: zStackDeleteKubernetesByNameQuery,
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zStackDeleteKubernetesByNameResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/stacks/name/{name}',
+    ...options,
+  });
+
+/**
+ * Webhook for triggering stack updates from git
+ *
+ * **Access policy**: public
+ */
+export const webhookInvoke = <ThrowOnError extends boolean = true>(
+  options: Options<WebhookInvokeData, ThrowOnError>
+): RequestResult<WebhookInvokeResponses, WebhookInvokeErrors, ThrowOnError> =>
+  (options.client ?? client).post<
+    WebhookInvokeResponses,
+    WebhookInvokeErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zWebhookInvokePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    url: '/stacks/webhooks/{webhookID}',
+    ...options,
+  });
+
+/**
+ * Retrieve system info
+ *
+ * **Access policy**: authenticated
+ */
+export const systemInfo = <ThrowOnError extends boolean = true>(
+  options?: Options<SystemInfoData, ThrowOnError>
+): RequestResult<SystemInfoResponses, SystemInfoErrors, ThrowOnError> =>
+  (options?.client ?? client).get<
+    SystemInfoResponses,
+    SystemInfoErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zSystemInfoResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/system/info',
+    ...options,
+  });
+
+/**
+ * Retrieve the count of nodes
+ *
+ * **Access policy**: authenticated
+ */
+export const systemNodesCount = <ThrowOnError extends boolean = true>(
+  options?: Options<SystemNodesCountData, ThrowOnError>
+): RequestResult<
+  SystemNodesCountResponses,
+  SystemNodesCountErrors,
+  ThrowOnError
+> =>
+  (options?.client ?? client).get<
+    SystemNodesCountResponses,
+    SystemNodesCountErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zSystemNodesCountResponse2.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/system/nodes',
+    ...options,
+  });
+
+/**
+ * Check Portainer status
+ *
+ * Retrieve Portainer status
+ * **Access policy**: public
+ */
+export const systemStatus = <ThrowOnError extends boolean = true>(
+  options?: Options<SystemStatusData, ThrowOnError>
+): RequestResult<SystemStatusResponses, unknown, ThrowOnError> =>
+  (options?.client ?? client).get<SystemStatusResponses, unknown, ThrowOnError>(
+    {
+      requestValidator: async (data) =>
+        await z
+          .object({
+            body: z.never().optional(),
+            path: z.never().optional(),
+            query: z.never().optional(),
+          })
+          .parseAsync(data),
+      responseType: 'json',
+      responseValidator: async (data) =>
+        await zSystemStatusResponse.parseAsync(data),
+      url: '/system/status',
+      ...options,
+    }
+  );
+
+/**
+ * Upgrade Portainer to BE
+ *
+ * Upgrade Portainer to BE
+ * **Access policy**: administrator
+ */
+export const systemUpgrade = <ThrowOnError extends boolean = true>(
+  options?: Options<SystemUpgradeData, ThrowOnError>
+): RequestResult<SystemUpgradeResponses, unknown, ThrowOnError> =>
+  (options?.client ?? client).post<
+    SystemUpgradeResponses,
+    unknown,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zSystemUpgradeResponse.parseAsync(data),
+    url: '/system/upgrade',
+    ...options,
+  });
+
+/**
+ * Check for portainer updates
+ *
+ * Check if portainer has an update available
+ * **Access policy**: authenticated
+ */
+export const systemVersion = <ThrowOnError extends boolean = true>(
+  options?: Options<SystemVersionData, ThrowOnError>
+): RequestResult<SystemVersionResponses, unknown, ThrowOnError> =>
+  (options?.client ?? client).get<
+    SystemVersionResponses,
+    unknown,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zSystemVersionResponse2.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/system/version',
+    ...options,
+  });
+
+/**
+ * List tags
+ *
+ * List tags.
+ * **Access policy**: authenticated
+ */
+export const tagList = <ThrowOnError extends boolean = true>(
+  options?: Options<TagListData, ThrowOnError>
+): RequestResult<TagListResponses, TagListErrors, ThrowOnError> =>
+  (options?.client ?? client).get<
+    TagListResponses,
+    TagListErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) => await zTagListResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/tags',
+    ...options,
+  });
+
+/**
+ * Create a new tag
+ *
+ * Create a new tag.
+ * **Access policy**: administrator
+ */
+export const tagCreate = <ThrowOnError extends boolean = true>(
+  options: Options<TagCreateData, ThrowOnError>
+): RequestResult<TagCreateResponses, TagCreateErrors, ThrowOnError> =>
+  (options.client ?? client).post<
+    TagCreateResponses,
+    TagCreateErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zTagCreateBody,
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zTagCreateResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/tags',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Remove a tag
+ *
+ * Remove a tag.
+ * **Access policy**: administrator
+ */
+export const tagDelete = <ThrowOnError extends boolean = true>(
+  options: Options<TagDeleteData, ThrowOnError>
+): RequestResult<TagDeleteResponses, TagDeleteErrors, ThrowOnError> =>
+  (options.client ?? client).delete<
+    TagDeleteResponses,
+    TagDeleteErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zTagDeletePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zTagDeleteResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/tags/{id}',
+    ...options,
+  });
+
+/**
+ * List team memberships
+ *
+ * List team memberships. Access is only available to administrators and team leaders.
+ * **Access policy**: administrator
+ */
+export const teamMembershipList = <ThrowOnError extends boolean = true>(
+  options?: Options<TeamMembershipListData, ThrowOnError>
+): RequestResult<
+  TeamMembershipListResponses,
+  TeamMembershipListErrors,
+  ThrowOnError
+> =>
+  (options?.client ?? client).get<
+    TeamMembershipListResponses,
+    TeamMembershipListErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zTeamMembershipListResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/team_memberships',
+    ...options,
+  });
+
+/**
+ * Create a new team membership
+ *
+ * Create a new team memberships. Access is only available to administrators leaders of the associated team.
+ * **Access policy**: administrator
+ */
+export const teamMembershipCreate = <ThrowOnError extends boolean = true>(
+  options: Options<TeamMembershipCreateData, ThrowOnError>
+): RequestResult<
+  TeamMembershipCreateResponses,
+  TeamMembershipCreateErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    TeamMembershipCreateResponses,
+    TeamMembershipCreateErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zTeamMembershipCreateBody,
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zTeamMembershipCreateResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/team_memberships',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Remove a team membership
+ *
+ * Remove a team membership. Access is only available to administrators leaders of the associated team.
+ * **Access policy**: administrator
+ */
+export const teamMembershipDelete = <ThrowOnError extends boolean = true>(
+  options: Options<TeamMembershipDeleteData, ThrowOnError>
+): RequestResult<
+  TeamMembershipDeleteResponses,
+  TeamMembershipDeleteErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).delete<
+    TeamMembershipDeleteResponses,
+    TeamMembershipDeleteErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zTeamMembershipDeletePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zTeamMembershipDeleteResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/team_memberships/{id}',
+    ...options,
+  });
+
+/**
+ * Update a team membership
+ *
+ * Update a team membership. Access is only available to administrators or leaders of the associated team.
+ * **Access policy**: administrator or leaders of the associated team
+ */
+export const teamMembershipUpdate = <ThrowOnError extends boolean = true>(
+  options: Options<TeamMembershipUpdateData, ThrowOnError>
+): RequestResult<
+  TeamMembershipUpdateResponses,
+  TeamMembershipUpdateErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).put<
+    TeamMembershipUpdateResponses,
+    TeamMembershipUpdateErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zTeamMembershipUpdateBody,
+          path: zTeamMembershipUpdatePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zTeamMembershipUpdateResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/team_memberships/{id}',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * List teams
+ *
+ * List teams. For non-administrator users, will only list the teams they are member of.
+ * **Access policy**: restricted
+ */
+export const teamList = <ThrowOnError extends boolean = true>(
+  options?: Options<TeamListData, ThrowOnError>
+): RequestResult<TeamListResponses, TeamListErrors, ThrowOnError> =>
+  (options?.client ?? client).get<
+    TeamListResponses,
+    TeamListErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: z.never().optional(),
+          query: zTeamListQuery.optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) => await zTeamListResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/teams',
+    ...options,
+  });
+
+/**
+ * Create a new team
+ *
+ * Create a new team.
+ * **Access policy**: administrator
+ */
+export const teamCreate = <ThrowOnError extends boolean = true>(
+  options: Options<TeamCreateData, ThrowOnError>
+): RequestResult<TeamCreateResponses, TeamCreateErrors, ThrowOnError> =>
+  (options.client ?? client).post<
+    TeamCreateResponses,
+    TeamCreateErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zTeamCreateBody,
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zTeamCreateResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/teams',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Remove a team
+ *
+ * Remove a team.
+ * **Access policy**: administrator
+ */
+export const teamDelete = <ThrowOnError extends boolean = true>(
+  options: Options<TeamDeleteData, ThrowOnError>
+): RequestResult<TeamDeleteResponses, TeamDeleteErrors, ThrowOnError> =>
+  (options.client ?? client).delete<
+    TeamDeleteResponses,
+    TeamDeleteErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zTeamDeletePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zTeamDeleteResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/teams/{id}',
+    ...options,
+  });
+
+/**
+ * Inspect a team
+ *
+ * Retrieve details about a team. Access is only available for administrator and leaders of that team.
+ * **Access policy**: administrator
+ */
+export const teamInspect = <ThrowOnError extends boolean = true>(
+  options: Options<TeamInspectData, ThrowOnError>
+): RequestResult<TeamInspectResponses, TeamInspectErrors, ThrowOnError> =>
+  (options.client ?? client).get<
+    TeamInspectResponses,
+    TeamInspectErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zTeamInspectPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zTeamInspectResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/teams/{id}',
+    ...options,
+  });
+
+/**
+ * Update a team
+ *
+ * Update a team.
+ * **Access policy**: administrator
+ */
+export const teamUpdate = <ThrowOnError extends boolean = true>(
+  options: Options<TeamUpdateData, ThrowOnError>
+): RequestResult<TeamUpdateResponses, TeamUpdateErrors, ThrowOnError> =>
+  (options.client ?? client).put<
+    TeamUpdateResponses,
+    TeamUpdateErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zTeamUpdateBody,
+          path: zTeamUpdatePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zTeamUpdateResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/teams/{id}',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * List team memberships
+ *
+ * List team memberships. Access is only available to administrators and team leaders.
+ * **Access policy**: restricted
+ */
+export const teamMemberships = <ThrowOnError extends boolean = true>(
+  options: Options<TeamMembershipsData, ThrowOnError>
+): RequestResult<
+  TeamMembershipsResponses,
+  TeamMembershipsErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    TeamMembershipsResponses,
+    TeamMembershipsErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zTeamMembershipsPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zTeamMembershipsResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/teams/{id}/memberships',
+    ...options,
+  });
+
+/**
+ * List available templates
+ *
+ * List available templates.
+ * **Access policy**: authenticated
+ */
+export const templateList = <ThrowOnError extends boolean = true>(
+  options?: Options<TemplateListData, ThrowOnError>
+): RequestResult<TemplateListResponses, TemplateListErrors, ThrowOnError> =>
+  (options?.client ?? client).get<
+    TemplateListResponses,
+    TemplateListErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zTemplateListResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/templates',
+    ...options,
+  });
+
+/**
+ * Get a template's file
+ *
+ * Get a template's file
+ * **Access policy**: authenticated
+ */
+export const templateFile = <ThrowOnError extends boolean = true>(
+  options: Options<TemplateFileData, ThrowOnError>
+): RequestResult<TemplateFileResponses, TemplateFileErrors, ThrowOnError> =>
+  (options.client ?? client).post<
+    TemplateFileResponses,
+    TemplateFileErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zTemplateFilePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zTemplateFileResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/templates/{id}/file',
+    ...options,
+  });
+
+/**
+ * Search Helm Charts
+ *
+ * **Access policy**: authenticated
+ */
+export const helmRepoSearch = <ThrowOnError extends boolean = true>(
+  options: Options<HelmRepoSearchData, ThrowOnError>
+): RequestResult<HelmRepoSearchResponses, HelmRepoSearchErrors, ThrowOnError> =>
+  (options.client ?? client).get<
+    HelmRepoSearchResponses,
+    HelmRepoSearchErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: z.never().optional(),
+          query: zHelmRepoSearchQuery,
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zHelmRepoSearchResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/templates/helm',
+    ...options,
+  });
+
+/**
+ * Show Helm Chart Information
+ *
+ * **Access policy**: authenticated
+ */
+export const helmShow = <ThrowOnError extends boolean = true>(
+  options: Options<HelmShowData, ThrowOnError>
+): RequestResult<HelmShowResponses, HelmShowErrors, ThrowOnError> =>
+  (options.client ?? client).get<
+    HelmShowResponses,
+    HelmShowErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zHelmShowPath,
+          query: zHelmShowQuery,
+        })
+        .parseAsync(data),
+    responseType: 'text',
+    responseValidator: async (data) => await zHelmShowResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/templates/helm/{command}',
+    ...options,
+  });
+
+/**
+ * Upload TLS files
+ *
+ * Use this environment(endpoint) to upload TLS files.
+ * **Access policy**: administrator
+ */
+export const uploadTls = <ThrowOnError extends boolean = true>(
+  options: Options<UploadTlsData, ThrowOnError>
+): RequestResult<UploadTlsResponses, UploadTlsErrors, ThrowOnError> =>
+  (options.client ?? client).post<
+    UploadTlsResponses,
+    UploadTlsErrors,
+    ThrowOnError
+  >({
+    ...formDataBodySerializer,
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zUploadTlsBody,
+          path: zUploadTlsPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zUploadTlsResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/upload/tls/{certificate}',
+    ...options,
+    headers: {
+      'Content-Type': null,
+      ...options.headers,
+    },
+  });
+
+/**
+ * List users
+ *
+ * List Portainer users.
+ * Non-administrator users will only be able to list other non-administrator user accounts.
+ * User passwords are filtered out, and should never be accessible.
+ * **Access policy**: restricted
+ */
+export const userList = <ThrowOnError extends boolean = true>(
+  options?: Options<UserListData, ThrowOnError>
+): RequestResult<UserListResponses, UserListErrors, ThrowOnError> =>
+  (options?.client ?? client).get<
+    UserListResponses,
+    UserListErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: z.never().optional(),
+          query: zUserListQuery.optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) => await zUserListResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/users',
+    ...options,
+  });
+
+/**
+ * Create a new user
+ *
+ * Create a new Portainer user.
+ * Only administrators can create users.
+ * **Access policy**: restricted
+ */
+export const userCreate = <ThrowOnError extends boolean = true>(
+  options: Options<UserCreateData, ThrowOnError>
+): RequestResult<UserCreateResponses, UserCreateErrors, ThrowOnError> =>
+  (options.client ?? client).post<
+    UserCreateResponses,
+    UserCreateErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zUserCreateBody,
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zUserCreateResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/users',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Remove a user
+ *
+ * Remove a user.
+ * **Access policy**: administrator
+ */
+export const userDelete = <ThrowOnError extends boolean = true>(
+  options: Options<UserDeleteData, ThrowOnError>
+): RequestResult<UserDeleteResponses, UserDeleteErrors, ThrowOnError> =>
+  (options.client ?? client).delete<
+    UserDeleteResponses,
+    UserDeleteErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zUserDeletePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zUserDeleteResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/users/{id}',
+    ...options,
+  });
+
+/**
+ * Inspect a user
+ *
+ * Retrieve details about a user.
+ * User passwords are filtered out, and should never be accessible.
+ * **Access policy**: authenticated
+ */
+export const userInspect = <ThrowOnError extends boolean = true>(
+  options: Options<UserInspectData, ThrowOnError>
+): RequestResult<UserInspectResponses, UserInspectErrors, ThrowOnError> =>
+  (options.client ?? client).get<
+    UserInspectResponses,
+    UserInspectErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zUserInspectPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zUserInspectResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/users/{id}',
+    ...options,
+  });
+
+/**
+ * Update a user
+ *
+ * Update user details. A regular user account can only update his details.
+ * A regular user account cannot change their username or role.
+ * **Access policy**: authenticated
+ */
+export const userUpdate = <ThrowOnError extends boolean = true>(
+  options: Options<UserUpdateData, ThrowOnError>
+): RequestResult<UserUpdateResponses, UserUpdateErrors, ThrowOnError> =>
+  (options.client ?? client).put<
+    UserUpdateResponses,
+    UserUpdateErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zUserUpdateBody,
+          path: zUserUpdatePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zUserUpdateResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/users/{id}',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Inspect a user's effective access on every environment
+ *
+ * Returns the resolved role for each environment the user can access,
+ * following the policy precedence used by the access viewer
+ * (user-endpoint, user-group, team-endpoint, team-group).
+ * Environments where the user has no role are omitted.
+ * **Access policy**: restricted
+ */
+export const userEffectiveAccessInspect = <ThrowOnError extends boolean = true>(
+  options: Options<UserEffectiveAccessInspectData, ThrowOnError>
+): RequestResult<
+  UserEffectiveAccessInspectResponses,
+  UserEffectiveAccessInspectErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    UserEffectiveAccessInspectResponses,
+    UserEffectiveAccessInspectErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zUserEffectiveAccessInspectPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zUserEffectiveAccessInspectResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/users/{id}/effective-access',
+    ...options,
+  });
+
+/**
+ * List a users helm repositories
+ *
+ * Inspect a user helm repositories.
+ * **Access policy**: authenticated
+ */
+export const helmUserRepositoriesList = <ThrowOnError extends boolean = true>(
+  options: Options<HelmUserRepositoriesListData, ThrowOnError>
+): RequestResult<
+  HelmUserRepositoriesListResponses,
+  HelmUserRepositoriesListErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    HelmUserRepositoriesListResponses,
+    HelmUserRepositoriesListErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zHelmUserRepositoriesListPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zHelmUserRepositoriesListResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/users/{id}/helm/repositories',
+    ...options,
+  });
+
+/**
+ * Create a user helm repository
+ *
+ * Create a user helm repository.
+ * **Access policy**: authenticated
+ */
+export const helmUserRepositoryCreate = <ThrowOnError extends boolean = true>(
+  options: Options<HelmUserRepositoryCreateData, ThrowOnError>
+): RequestResult<
+  HelmUserRepositoryCreateResponses,
+  HelmUserRepositoryCreateErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    HelmUserRepositoryCreateResponses,
+    HelmUserRepositoryCreateErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zHelmUserRepositoryCreateBody,
+          path: zHelmUserRepositoryCreatePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zHelmUserRepositoryCreateResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/users/{id}/helm/repositories',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Delete a users helm repositoryies
+ *
+ * **Access policy**: authenticated
+ */
+export const helmUserRepositoryDelete = <ThrowOnError extends boolean = true>(
+  options: Options<HelmUserRepositoryDeleteData, ThrowOnError>
+): RequestResult<
+  HelmUserRepositoryDeleteResponses,
+  HelmUserRepositoryDeleteErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).delete<
+    HelmUserRepositoryDeleteResponses,
+    HelmUserRepositoryDeleteErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zHelmUserRepositoryDeletePath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zHelmUserRepositoryDeleteResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/users/{id}/helm/repositories/{repositoryID}',
+    ...options,
+  });
+
+/**
+ * Inspect a user memberships
+ *
+ * Inspect a user memberships.
+ * **Access policy**: restricted
+ */
+export const userMembershipsInspect = <ThrowOnError extends boolean = true>(
+  options: Options<UserMembershipsInspectData, ThrowOnError>
+): RequestResult<
+  UserMembershipsInspectResponses,
+  UserMembershipsInspectErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    UserMembershipsInspectResponses,
+    UserMembershipsInspectErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zUserMembershipsInspectPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zUserMembershipsInspectResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/users/{id}/memberships',
+    ...options,
+  });
+
+/**
+ * Update password for a user
+ *
+ * Update password for the specified user.
+ * **Access policy**: authenticated
+ */
+export const userUpdatePassword = <ThrowOnError extends boolean = true>(
+  options: Options<UserUpdatePasswordData, ThrowOnError>
+): RequestResult<
+  UserUpdatePasswordResponses,
+  UserUpdatePasswordErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).put<
+    UserUpdatePasswordResponses,
+    UserUpdatePasswordErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zUserUpdatePasswordBody,
+          path: zUserUpdatePasswordPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zUserUpdatePasswordResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/users/{id}/passwd',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Get all API keys for a user
+ *
+ * Gets all API keys for a user.
+ * Only the calling user or admin can retrieve api-keys.
+ * **Access policy**: authenticated
+ */
+export const userGetApiKeys = <ThrowOnError extends boolean = true>(
+  options: Options<UserGetApiKeysData, ThrowOnError>
+): RequestResult<UserGetApiKeysResponses, UserGetApiKeysErrors, ThrowOnError> =>
+  (options.client ?? client).get<
+    UserGetApiKeysResponses,
+    UserGetApiKeysErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zUserGetApiKeysPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zUserGetApiKeysResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/users/{id}/tokens',
+    ...options,
+  });
+
+/**
+ * Generate an API key for a user
+ *
+ * Generates an API key for a user.
+ * Only the calling user can generate a token for themselves.
+ * Password is required only for internal authentication.
+ * **Access policy**: restricted
+ */
+export const userGenerateApiKey = <ThrowOnError extends boolean = true>(
+  options: Options<UserGenerateApiKeyData, ThrowOnError>
+): RequestResult<
+  UserGenerateApiKeyResponses,
+  UserGenerateApiKeyErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    UserGenerateApiKeyResponses,
+    UserGenerateApiKeyErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zUserGenerateApiKeyBody,
+          path: zUserGenerateApiKeyPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zUserGenerateApiKeyResponse.parseAsync(data),
+    security: [{ name: 'Authorization', type: 'apiKey' }],
+    url: '/users/{id}/tokens',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Remove an api-key associated to a user
+ *
+ * Remove an api-key associated to a user..
+ * Only the calling user or admin can remove api-key.
+ * **Access policy**: authenticated
+ */
+export const userRemoveApiKey = <ThrowOnError extends boolean = true>(
+  options: Options<UserRemoveApiKeyData, ThrowOnError>
+): RequestResult<
+  UserRemoveApiKeyResponses,
+  UserRemoveApiKeyErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).delete<
+    UserRemoveApiKeyResponses,
+    UserRemoveApiKeyErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zUserRemoveApiKeyPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zUserRemoveApiKeyResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/users/{id}/tokens/{keyID}',
+    ...options,
+  });
+
+/**
+ * Check administrator account existence
+ *
+ * Check if an administrator account exists in the database.
+ * **Access policy**: public
+ */
+export const userAdminCheck = <ThrowOnError extends boolean = true>(
+  options?: Options<UserAdminCheckData, ThrowOnError>
+): RequestResult<UserAdminCheckResponses, UserAdminCheckErrors, ThrowOnError> =>
+  (options?.client ?? client).get<
+    UserAdminCheckResponses,
+    UserAdminCheckErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseValidator: async (data) =>
+      await zUserAdminCheckResponse.parseAsync(data),
+    url: '/users/admin/check',
+    ...options,
+  });
+
+/**
+ * Initialize administrator account
+ *
+ * Initialize the 'admin' user account.
+ * **Access policy**: public (requires the X-Setup-Token header on an uninitialized instance unless --no-setup-token is set)
+ */
+export const userAdminInit = <ThrowOnError extends boolean = true>(
+  options: Options<UserAdminInitData, ThrowOnError>
+): RequestResult<UserAdminInitResponses, UserAdminInitErrors, ThrowOnError> =>
+  (options.client ?? client).post<
+    UserAdminInitResponses,
+    UserAdminInitErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zUserAdminInitBody,
+          headers: zUserAdminInitHeaders.optional(),
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zUserAdminInitResponse.parseAsync(data),
+    url: '/users/admin/init',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Inspect the current user user
+ *
+ * Retrieve details about the current  user.
+ * User passwords are filtered out, and should never be accessible.
+ * **Access policy**: authenticated
+ */
+export const currentUserInspect = <ThrowOnError extends boolean = true>(
+  options?: Options<CurrentUserInspectData, ThrowOnError>
+): RequestResult<
+  CurrentUserInspectResponses,
+  CurrentUserInspectErrors,
+  ThrowOnError
+> =>
+  (options?.client ?? client).get<
+    CurrentUserInspectResponses,
+    CurrentUserInspectErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zCurrentUserInspectResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/users/me',
+    ...options,
+  });
+
+/**
+ * List webhooks
+ *
+ * **Access policy**: authenticated
+ */
+export const getWebhooks = <ThrowOnError extends boolean = true>(
+  options?: Options<GetWebhooksData, ThrowOnError>
+): RequestResult<GetWebhooksResponses, GetWebhooksErrors, ThrowOnError> =>
+  (options?.client ?? client).get<
+    GetWebhooksResponses,
+    GetWebhooksErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: z.never().optional(),
+          query: zGetWebhooksQuery.optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zGetWebhooksResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/webhooks',
+    ...options,
+  });
+
+/**
+ * Create a webhook
+ *
+ * **Access policy**: authenticated
+ */
+export const postWebhooks = <ThrowOnError extends boolean = true>(
+  options: Options<PostWebhooksData, ThrowOnError>
+): RequestResult<PostWebhooksResponses, PostWebhooksErrors, ThrowOnError> =>
+  (options.client ?? client).post<
+    PostWebhooksResponses,
+    PostWebhooksErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zPostWebhooksBody,
+          path: z.never().optional(),
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zPostWebhooksResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/webhooks',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Delete a webhook
+ *
+ * **Access policy**: authenticated
+ */
+export const deleteWebhooksById = <ThrowOnError extends boolean = true>(
+  options: Options<DeleteWebhooksByIdData, ThrowOnError>
+): RequestResult<
+  DeleteWebhooksByIdResponses,
+  DeleteWebhooksByIdErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).delete<
+    DeleteWebhooksByIdResponses,
+    DeleteWebhooksByIdErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zDeleteWebhooksByIdPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/webhooks/{id}',
+    ...options,
+  });
+
+/**
+ * Execute a webhook
+ *
+ * Acts on a passed in token UUID to restart the docker service
+ * **Access policy**: public
+ */
+export const postWebhooksById = <ThrowOnError extends boolean = true>(
+  options: Options<PostWebhooksByIdData, ThrowOnError>
+): RequestResult<
+  PostWebhooksByIdResponses,
+  PostWebhooksByIdErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).post<
+    PostWebhooksByIdResponses,
+    PostWebhooksByIdErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: zPostWebhooksByIdPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    url: '/webhooks/{id}',
+    ...options,
+  });
+
+/**
+ * Update a webhook
+ *
+ * **Access policy**: authenticated
+ */
+export const putWebhooksById = <ThrowOnError extends boolean = true>(
+  options: Options<PutWebhooksByIdData, ThrowOnError>
+): RequestResult<
+  PutWebhooksByIdResponses,
+  PutWebhooksByIdErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).put<
+    PutWebhooksByIdResponses,
+    PutWebhooksByIdErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: zPutWebhooksByIdBody,
+          path: zPutWebhooksByIdPath,
+          query: z.never().optional(),
+        })
+        .parseAsync(data),
+    responseType: 'json',
+    responseValidator: async (data) =>
+      await zPutWebhooksByIdResponse.parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/webhooks/{id}',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * Attach a websocket
+ *
+ * If the nodeName query parameter is present, the request will be proxied to the underlying agent environment(endpoint).
+ * If the nodeName query parameter is not specified, the request will be upgraded to the websocket protocol and
+ * an AttachStart operation HTTP request will be created and hijacked.
+ * **Access policy**: authenticated
+ */
+export const getWebsocketAttach = <ThrowOnError extends boolean = true>(
+  options: Options<GetWebsocketAttachData, ThrowOnError>
+): RequestResult<
+  GetWebsocketAttachResponses,
+  GetWebsocketAttachErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetWebsocketAttachResponses,
+    GetWebsocketAttachErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: z.never().optional(),
+          query: zGetWebsocketAttachQuery,
+        })
+        .parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/websocket/attach',
+    ...options,
+  });
+
+/**
+ * Execute a websocket
+ *
+ * If the nodeName query parameter is present, the request will be proxied to the underlying agent environment(endpoint).
+ * If the nodeName query parameter is not specified, the request will be upgraded to the websocket protocol and
+ * an ExecStart operation HTTP request will be created and hijacked.
+ */
+export const getWebsocketExec = <ThrowOnError extends boolean = true>(
+  options: Options<GetWebsocketExecData, ThrowOnError>
+): RequestResult<
+  GetWebsocketExecResponses,
+  GetWebsocketExecErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetWebsocketExecResponses,
+    GetWebsocketExecErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: z.never().optional(),
+          query: zGetWebsocketExecQuery,
+        })
+        .parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/websocket/exec',
+    ...options,
+  });
+
+/**
+ * Execute a websocket on kubectl shell pod
+ *
+ * The request will be upgraded to the websocket protocol. The request will proxy input from the client to the pod via long-lived websocket connection.
+ * **Access policy**: authenticated
+ */
+export const getWebsocketKubernetesShell = <
+  ThrowOnError extends boolean = true,
+>(
+  options: Options<GetWebsocketKubernetesShellData, ThrowOnError>
+): RequestResult<
+  GetWebsocketKubernetesShellResponses,
+  GetWebsocketKubernetesShellErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetWebsocketKubernetesShellResponses,
+    GetWebsocketKubernetesShellErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: z.never().optional(),
+          query: zGetWebsocketKubernetesShellQuery,
+        })
+        .parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/websocket/kubernetes-shell',
+    ...options,
+  });
+
+/**
+ * Execute a websocket on pod
+ *
+ * The request will be upgraded to the websocket protocol.
+ * **Access policy**: authenticated
+ */
+export const getWebsocketPod = <ThrowOnError extends boolean = true>(
+  options: Options<GetWebsocketPodData, ThrowOnError>
+): RequestResult<
+  GetWebsocketPodResponses,
+  GetWebsocketPodErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetWebsocketPodResponses,
+    GetWebsocketPodErrors,
+    ThrowOnError
+  >({
+    requestValidator: async (data) =>
+      await z
+        .object({
+          body: z.never().optional(),
+          path: z.never().optional(),
+          query: zGetWebsocketPodQuery,
+        })
+        .parseAsync(data),
+    security: [
+      { name: 'X-API-KEY', type: 'apiKey' },
+      { name: 'Authorization', type: 'apiKey' },
+    ],
+    url: '/websocket/pod',
+    ...options,
+  });
diff --git a/app/react/portainer/generated-api/portainer/types.gen.ts b/app/react/portainer/generated-api/portainer/types.gen.ts
new file mode 100644
index 0000000..ce03614
--- /dev/null
+++ b/app/react/portainer/generated-api/portainer/types.gen.ts
@@ -0,0 +1,19205 @@
+// This file is auto-generated by @hey-api/openapi-ts
+
+export type ClientOptions = {
+  baseURL: `${string}://${string}/api` | (string & {});
+};
+
+export type AuthAuthenticatePayload = {
+  /**
+   * Password
+   */
+  Password: string;
+  /**
+   * Username
+   */
+  Username: string;
+};
+
+export type AuthAuthenticateResponse = {
+  /**
+   * JWT token used to authenticate against the API
+   */
+  jwt?: string;
+};
+
+export type AuthOauthPayload = {
+  /**
+   * OAuth code returned from OAuth Provided
+   */
+  Code?: string;
+};
+
+export type BackupBackupPayload = {
+  Password?: string;
+};
+
+export type BackupRestorePayload = {
+  FileContent?: Array<number>;
+  FileName?: string;
+  Password?: string;
+};
+
+export type BuildBuildInfo = {
+  BuildNumber?: string;
+  GitCommit?: string;
+  GoVersion?: string;
+  ImageTag?: string;
+  NodejsVersion?: string;
+  PnpmVersion?: string;
+  WebpackVersion?: string;
+};
+
+export type BuildDependenciesInfo = {
+  ComposeVersion?: string;
+  DockerVersion?: string;
+  HelmVersion?: string;
+  KubectlVersion?: string;
+};
+
+export type BuildRuntimeInfo = {
+  Env?: Array<string>;
+};
+
+export type ContainersContainerGpusResponse = {
+  gpus?: string;
+};
+
+export type CustomtemplatesCustomTemplateFromFileContentPayload = {
+  /**
+   * Description of the template
+   */
+  Description: string;
+  /**
+   * EdgeTemplate indicates if this template purpose for Edge Stack
+   */
+  EdgeTemplate?: boolean;
+  /**
+   * Content of stack file
+   */
+  FileContent: string;
+  /**
+   * URL of the template's logo
+   */
+  Logo?: string;
+  /**
+   * A note that will be displayed in the UI. Supports HTML content
+   */
+  Note?: string;
+  /**
+   * Platform associated to the template.
+   * Valid values are: 1 - 'linux', 2 - 'windows'
+   * Required for Docker stacks
+   */
+  Platform?: 1 | 2;
+  /**
+   * Title of the template
+   */
+  Title: string;
+  /**
+   * Type of created stack:
+   * * 1 - swarm
+   * * 2 - compose
+   * * 3 - kubernetes
+   */
+  Type: 1 | 2 | 3;
+  /**
+   * Definitions of variables in the stack file
+   */
+  Variables?: Array<PortainerCustomTemplateVariableDefinition>;
+};
+
+export type CustomtemplatesCustomTemplateFromGitRepositoryPayload = {
+  /**
+   * Path to the Stack file inside the Git repository
+   */
+  ComposeFilePathInRepository?: string;
+  /**
+   * Description of the template
+   */
+  Description: string;
+  /**
+   * EdgeTemplate indicates if this template purpose for Edge Stack
+   */
+  EdgeTemplate?: boolean;
+  /**
+   * IsComposeFormat indicates if the Kubernetes template is created from a Docker Compose file
+   */
+  IsComposeFormat?: boolean;
+  /**
+   * URL of the template's logo
+   */
+  Logo?: string;
+  /**
+   * A note that will be displayed in the UI. Supports HTML content
+   */
+  Note?: string;
+  /**
+   * Platform associated to the template.
+   * Valid values are: 1 - 'linux', 2 - 'windows'
+   * Required for Docker stacks
+   */
+  Platform?: 1 | 2;
+  /**
+   * Deprecated: use SourceID instead. Use basic authentication to clone the Git repository.
+   */
+  RepositoryAuthentication?: boolean;
+  /**
+   * Deprecated: use SourceID instead. Password used in basic authentication. Required when RepositoryAuthentication is true.
+   */
+  RepositoryPassword?: string;
+  /**
+   * Reference name of a Git repository hosting the Stack file
+   */
+  RepositoryReferenceName?: string;
+  /**
+   * Deprecated: use SourceID instead. URL of a Git repository hosting the Stack file.
+   */
+  RepositoryURL?: string;
+  /**
+   * Deprecated: use SourceID instead. Username used in basic authentication. Required when RepositoryAuthentication is true.
+   */
+  RepositoryUsername?: string;
+  /**
+   * SourceID references an existing Source for git credentials/URL.
+   * When set, the inline URL and authentication fields are ignored.
+   */
+  SourceID: number;
+  /**
+   * Deprecated: use SourceID instead. TLSSkipVerify skips SSL verification when cloning the Git repository.
+   */
+  TLSSkipVerify?: boolean;
+  /**
+   * Title of the template
+   */
+  Title: string;
+  /**
+   * Type of created stack:
+   * * 1 - swarm
+   * * 2 - compose
+   * * 3 - kubernetes
+   */
+  Type: 1 | 2;
+  /**
+   * Definitions of variables in the stack file
+   */
+  Variables?: Array<PortainerCustomTemplateVariableDefinition>;
+};
+
+export type CustomtemplatesCustomTemplateUpdatePayload = {
+  /**
+   * Path to the Stack file inside the Git repository
+   */
+  ComposeFilePathInRepository?: string;
+  /**
+   * Description of the template
+   */
+  Description: string;
+  /**
+   * EdgeTemplate indicates if this template purpose for Edge Stack
+   */
+  EdgeTemplate?: boolean;
+  /**
+   * Content of stack file
+   */
+  FileContent: string;
+  /**
+   * IsComposeFormat indicates if the Kubernetes template is created from a Docker Compose file
+   */
+  IsComposeFormat?: boolean;
+  /**
+   * URL of the template's logo
+   */
+  Logo?: string;
+  /**
+   * A note that will be displayed in the UI. Supports HTML content
+   */
+  Note?: string;
+  /**
+   * Platform associated to the template.
+   * Valid values are: 1 - 'linux', 2 - 'windows'
+   * Required for Docker stacks
+   */
+  Platform?: 1 | 2;
+  /**
+   * Deprecated: use SourceID instead. Use authentication to clone the Git repository.
+   */
+  RepositoryAuthentication?: boolean;
+  /**
+   * Deprecated: use SourceID instead. Password used in basic authentication or token used in token authentication. Required when RepositoryAuthentication is true.
+   */
+  RepositoryPassword?: string;
+  /**
+   * Reference name of a Git repository hosting the Stack file
+   */
+  RepositoryReferenceName?: string;
+  /**
+   * Deprecated: use SourceID instead. URL of a Git repository hosting the Stack file.
+   */
+  RepositoryURL?: string;
+  /**
+   * Deprecated: use SourceID instead. Username used in basic authentication. Required when RepositoryAuthentication is true.
+   */
+  RepositoryUsername?: string;
+  /**
+   * SourceID references an existing Source for git credentials/URL.
+   * When set, the inline URL and authentication fields are ignored.
+   */
+  SourceID?: number;
+  /**
+   * Deprecated: use SourceID instead. TLSSkipVerify skips SSL verification when cloning the Git repository.
+   */
+  TLSSkipVerify?: boolean;
+  /**
+   * Title of the template
+   */
+  Title: string;
+  /**
+   * Type of created stack (1 - swarm, 2 - compose, 3 - kubernetes)
+   */
+  Type: 1 | 2 | 3;
+  /**
+   * Definitions of variables in the stack file
+   */
+  Variables?: Array<PortainerCustomTemplateVariableDefinition>;
+};
+
+export type CustomtemplatesFileResponse = {
+  FileContent?: string;
+};
+
+export type DockerDashboardResponse = {
+  containers?: StatsContainerStats;
+  images?: DockerImagesCounters;
+  networks?: number;
+  services?: number;
+  stacks?: number;
+  volumes?: number;
+};
+
+export type DockerImagesCounters = {
+  size?: number;
+  total?: number;
+};
+
+export type EdgegroupsDecoratedEdgeGroup = {
+  Dynamic?: boolean;
+  /**
+   * Shadow to avoid exposing in the API
+   */
+  EndpointIds?: number;
+  EndpointTypes?: Array<PortainerEndpointType>;
+  /**
+   * Deprecated: only used for API responses
+   */
+  Endpoints?: Array<number>;
+  HasEdgeJob?: boolean;
+  HasEdgeStack?: boolean;
+  /**
+   * EdgeGroup Identifier
+   */
+  Id?: number;
+  Name?: string;
+  PartialMatch?: boolean;
+  TagIds?: Array<number>;
+  TrustedEndpoints?: Array<number>;
+};
+
+export type EdgegroupsEdgeGroupCreatePayload = {
+  Dynamic?: boolean;
+  Endpoints?: Array<number>;
+  Name?: string;
+  PartialMatch?: boolean;
+  TagIDs?: Array<number>;
+};
+
+export type EdgegroupsEdgeGroupUpdatePayload = {
+  Dynamic?: boolean;
+  Endpoints?: Array<number>;
+  Name?: string;
+  PartialMatch?: boolean;
+  TagIDs?: Array<number>;
+};
+
+export type EdgejobsEdgeJobCreateFromFileContentPayload = {
+  CronExpression?: string;
+  EdgeGroups?: Array<number>;
+  Endpoints?: Array<number>;
+  FileContent?: string;
+  Name?: string;
+  Recurring?: boolean;
+};
+
+export type EdgejobsEdgeJobFileResponse = {
+  FileContent?: string;
+};
+
+export type EdgejobsEdgeJobUpdatePayload = {
+  CronExpression?: string;
+  EdgeGroups?: Array<number>;
+  Endpoints?: Array<number>;
+  FileContent?: string;
+  Name?: string;
+  Recurring?: boolean;
+};
+
+export type EdgejobsFileResponse = {
+  FileContent?: string;
+};
+
+export type EdgejobsTaskContainer = {
+  EndpointId?: number;
+  EndpointName?: string;
+  Id?: string;
+  LogsStatus?: PortainerEdgeJobLogsStatus;
+};
+
+export type EdgestacksEdgeStackFromGitRepositoryPayload = {
+  /**
+   * Deployment type to deploy this stack
+   * Valid values are: 0 - 'compose', 1 - 'kubernetes'
+   * compose is enabled only for docker environments
+   * kubernetes is enabled only for kubernetes environments
+   */
+  DeploymentType?: 0 | 1 | 2;
+  /**
+   * List of identifiers of EdgeGroups
+   */
+  EdgeGroups: Array<number>;
+  /**
+   * Path to the Stack file inside the Git repository
+   */
+  FilePathInRepository?: string;
+  /**
+   * Name of the stack
+   * Max length: 255
+   * Name must only contains lowercase characters, numbers, hyphens, or underscores
+   * Name must start with a lowercase character or number
+   * Example: stack-name or stack_123 or stackName
+   */
+  Name: string;
+  /**
+   * List of Registries to use for this stack
+   */
+  Registries?: Array<number>;
+  /**
+   * Deprecated: Use SourceID instead. Use basic authentication to clone the Git repository.
+   */
+  RepositoryAuthentication?: boolean;
+  /**
+   * Deprecated: Use SourceID instead. Password used in basic authentication.
+   */
+  RepositoryPassword?: string;
+  /**
+   * Reference name of a Git repository hosting the Stack file
+   */
+  RepositoryReferenceName?: string;
+  /**
+   * Deprecated: Use SourceID instead. URL of a Git repository hosting the Stack file.
+   */
+  RepositoryURL?: string;
+  /**
+   * Deprecated: Use SourceID instead. Username used in basic authentication.
+   */
+  RepositoryUsername?: string;
+  /**
+   * SourceID references an existing Source for git credentials/URL.
+   * When set, the inline URL and authentication fields are ignored.
+   */
+  SourceID?: number;
+  /**
+   * Deprecated: Use SourceID instead. TLSSkipVerify skips SSL verification when cloning the Git repository.
+   */
+  TLSSkipVerify?: boolean;
+  /**
+   * Uses the manifest's namespaces instead of the default one
+   */
+  UseManifestNamespaces?: boolean;
+};
+
+export type EdgestacksEdgeStackFromStringPayload = {
+  /**
+   * Deployment type to deploy this stack
+   * Valid values are: 0 - 'compose', 1 - 'kubernetes'
+   * compose is enabled only for docker environments
+   * kubernetes is enabled only for kubernetes environments
+   */
+  DeploymentType?: 0 | 1 | 2;
+  /**
+   * List of identifiers of EdgeGroups
+   */
+  EdgeGroups?: Array<number>;
+  /**
+   * Name of the stack
+   * Max length: 255
+   * Name must only contains lowercase characters, numbers, hyphens, or underscores
+   * Name must start with a lowercase character or number
+   * Example: stack-name or stack_123 or stackName
+   */
+  Name: string;
+  /**
+   * List of Registries to use for this stack
+   */
+  Registries?: Array<number>;
+  /**
+   * Content of the Stack file
+   */
+  StackFileContent: string;
+  /**
+   * Uses the manifest's namespaces instead of the default one
+   */
+  UseManifestNamespaces?: boolean;
+};
+
+export type EdgestacksStackFileResponse = {
+  StackFileContent?: string;
+};
+
+export type EdgestacksUpdateEdgeStackPayload = {
+  DeploymentType?: PortainerEdgeStackDeploymentType;
+  EdgeGroups?: Array<number>;
+  StackFileContent?: string;
+  UpdateVersion?: boolean;
+  /**
+   * Uses the manifest's namespaces instead of the default one
+   */
+  UseManifestNamespaces?: boolean;
+};
+
+export type EdgestacksUpdateStatusPayload = {
+  EndpointID?: number;
+  Error?: string;
+  Status?: PortainerEdgeStackStatusType;
+  Time?: number;
+  Version?: number;
+};
+
+export type EndpointgroupsEndpointGroupResponse = {
+  /**
+   * Description associated to the environment(endpoint) group
+   */
+  Description: string;
+  /**
+   * Environment(Endpoint) group Identifier
+   */
+  Id: number;
+  /**
+   * Environment(Endpoint) group name
+   */
+  Name: string;
+  /**
+   * List of tags associated to this environment(endpoint) group
+   */
+  TagIds?: Array<number>;
+  TeamAccessPolicies?: PortainerTeamAccessPolicies;
+  Total?: number;
+  TypeInfo?: EndpointgroupsEndpointGroupTypeInfo;
+  UserAccessPolicies?: PortainerUserAccessPolicies;
+};
+
+export type EndpointgroupsEndpointGroupTypeInfo = {
+  Docker: number;
+  Kubernetes: number;
+  Mixed: boolean;
+  Podman: number;
+};
+
+export type EndpointgroupsEndpointGroupCreatePayload = {
+  /**
+   * List of environment(endpoint) identifiers that will be part of this group
+   */
+  AssociatedEndpoints?: Array<number>;
+  /**
+   * Environment(Endpoint) group description
+   */
+  Description?: string;
+  /**
+   * Environment(Endpoint) group name
+   */
+  Name: string;
+  /**
+   * List of tag identifiers to which this environment(endpoint) group is associated
+   */
+  TagIDs?: Array<number>;
+};
+
+export type EndpointgroupsEndpointGroupUpdatePayload = {
+  /**
+   * List of environment(endpoint) identifiers that will be part of this group
+   */
+  AssociatedEndpoints?: Array<number>;
+  /**
+   * Environment(Endpoint) group description
+   */
+  Description?: string;
+  /**
+   * Environment(Endpoint) group name
+   */
+  Name?: string;
+  /**
+   * List of tag identifiers associated to the environment(endpoint) group
+   */
+  TagIDs?: Array<number>;
+  TeamAccessPolicies?: PortainerTeamAccessPolicies;
+  UserAccessPolicies?: PortainerUserAccessPolicies;
+};
+
+export type EndpointsEnvironmentSummaryCountsResponse = {
+  byGroup?: Array<EndpointsGroupCount>;
+  byHealth?: EndpointsHealthCounts;
+  byPlatformType?: EndpointsPlatformCounts;
+  down?: number;
+  outdated?: number;
+  total?: number;
+  unassigned?: number;
+  up?: number;
+};
+
+export type EndpointsDockerhubStatusResponse = {
+  /**
+   * Daily limit
+   */
+  limit?: number;
+  /**
+   * Remaiming images to pull
+   */
+  remaining?: number;
+};
+
+export type EndpointsEndpointCreateGlobalKeyResponse = {
+  endpointID?: number;
+};
+
+export type EndpointsEndpointDeleteBatchPartialResponse = {
+  deleted?: Array<number>;
+  errors?: Array<number>;
+};
+
+export type EndpointsEndpointDeleteBatchPayload = {
+  endpoints?: Array<EndpointsEndpointDeleteRequest>;
+};
+
+export type EndpointsEndpointDeleteRequest = {
+  deleteCluster?: boolean;
+  id?: number;
+};
+
+export type EndpointsEndpointSettingsUpdatePayload = {
+  /**
+   * Whether non-administrator should be able to use bind mounts when creating containers
+   */
+  allowBindMountsForRegularUsers?: boolean;
+  /**
+   * Whether non-administrator should be able to use container capabilities
+   */
+  allowContainerCapabilitiesForRegularUsers?: boolean;
+  /**
+   * Whether non-administrator should be able to use device mapping
+   */
+  allowDeviceMappingForRegularUsers?: boolean;
+  /**
+   * Whether non-administrator should be able to use the host pid
+   */
+  allowHostNamespaceForRegularUsers?: boolean;
+  /**
+   * Whether non-administrator should be able to use privileged mode when creating containers
+   */
+  allowPrivilegedModeForRegularUsers?: boolean;
+  /**
+   * Whether non-administrator should be able to use security-opt settings
+   */
+  allowSecurityOptForRegularUsers?: boolean;
+  /**
+   * Whether non-administrator should be able to manage stacks
+   */
+  allowStackManagementForRegularUsers?: boolean;
+  /**
+   * Whether non-administrator should be able to use sysctl settings
+   */
+  allowSysctlSettingForRegularUsers?: boolean;
+  /**
+   * Whether non-administrator should be able to browse volumes
+   */
+  allowVolumeBrowserForRegularUsers?: boolean;
+  enableGPUManagement?: boolean;
+  /**
+   * Whether host management features are enabled
+   */
+  enableHostManagementFeatures?: boolean;
+  gpus?: Array<PortainerPair>;
+};
+
+export type EndpointsEndpointUpdatePayload = {
+  /**
+   * Azure application ID
+   */
+  AzureApplicationID?: string;
+  /**
+   * Azure authentication key
+   */
+  AzureAuthenticationKey?: string;
+  /**
+   * Azure tenant ID
+   */
+  AzureTenantID?: string;
+  /**
+   * The check in interval for edge agent (in seconds)
+   */
+  EdgeCheckinInterval?: number;
+  /**
+   * GPUs information
+   */
+  Gpus?: Array<PortainerPair>;
+  /**
+   * Group identifier
+   */
+  GroupID?: number;
+  /**
+   * Associated Kubernetes data
+   */
+  Kubernetes?: PortainerKubernetesData;
+  /**
+   * Name that will be used to identify this environment(endpoint)
+   */
+  Name?: string;
+  /**
+   * URL or IP address where exposed containers will be reachable.\
+   * Defaults to URL if not specified
+   */
+  PublicURL?: string;
+  /**
+   * The status of the environment(endpoint) (1 - up, 2 - down)
+   */
+  Status?: number;
+  /**
+   * Require TLS to connect against this environment(endpoint)
+   */
+  TLS?: boolean;
+  /**
+   * Skip client verification when using TLS
+   */
+  TLSSkipClientVerify?: boolean;
+  /**
+   * Skip server verification when using TLS
+   */
+  TLSSkipVerify?: boolean;
+  /**
+   * List of tag identifiers to which this environment(endpoint) is associated
+   */
+  TagIDs?: Array<number>;
+  TeamAccessPolicies?: PortainerTeamAccessPolicies;
+  /**
+   * URL or IP address of a Docker host
+   */
+  URL?: string;
+  UserAccessPolicies?: PortainerUserAccessPolicies;
+};
+
+export type EndpointsEndpointUpdateRelationsPayload = {
+  Relations?: {
+    [key: string]: {
+      EdgeGroups?: Array<number>;
+      Group?: number;
+      Tags?: Array<number>;
+    };
+  };
+};
+
+export type EndpointsForceUpdateServicePayload = {
+  /**
+   * PullImage if true will pull the image
+   */
+  PullImage?: boolean;
+  /**
+   * ServiceId to update
+   */
+  ServiceID?: string;
+};
+
+export type EndpointsGroupCount = {
+  count?: number;
+  groupID?: number;
+  groupName?: string;
+};
+
+export type EndpointsHealthCounts = {
+  down?: number;
+  heartbeat?: number;
+  outdated?: number;
+  up?: number;
+};
+
+export type EndpointsPlatformCounts = {
+  azure?: number;
+  docker?: number;
+  kubernetes?: number;
+  podman?: number;
+};
+
+export type EndpointsRegistryAccessPayload = {
+  Namespaces?: Array<string>;
+  TeamAccessPolicies?: PortainerTeamAccessPolicies;
+  UserAccessPolicies?: PortainerUserAccessPolicies;
+};
+
+export type GithubComPortainerPortainerPkgLibhelmReleaseHook = {
+  /**
+   * DeletePolicies are the policies that indicate when to delete the hook
+   */
+  delete_policies?: Array<string>;
+  /**
+   * Events are the events that this hook fires on.
+   */
+  events?: Array<string>;
+  /**
+   * Kind is the Kubernetes kind.
+   */
+  kind?: string;
+  /**
+   * LastRun indicates the date/time this was last run.
+   */
+  last_run?: ReleaseHookExecution;
+  /**
+   * Manifest is the manifest contents.
+   */
+  manifest?: string;
+  name?: string;
+  /**
+   * Path is the chart-relative path to the template.
+   */
+  path?: string;
+  /**
+   * Weight indicates the sort order for execution among similar Hook type
+   */
+  weight?: number;
+};
+
+export type GitopsFileResponse = {
+  FileContent?: string;
+};
+
+export type GitopsRepositoryFilePreviewPayload = {
+  /**
+   * Password for git authentication.
+   * Deprecated: use SourceID instead
+   */
+  password?: string;
+  reference?: string;
+  /**
+   * URL of a Git repository to preview.
+   * Deprecated: use SourceID instead
+   */
+  repository?: string;
+  /**
+   * SourceID resolves URL and auth from the stored Source record.
+   * When set, the inline Repository/Username/Password/TLSSkipVerify fields are ignored.
+   */
+  sourceID?: number;
+  /**
+   * Path to file whose content will be read
+   */
+  targetFile?: string;
+  /**
+   * TLSSkipVerify skips SSL verification when cloning the Git repository.
+   * Deprecated: use SourceID instead
+   */
+  tlsSkipVerify?: boolean;
+  /**
+   * Username for git authentication.
+   * Deprecated: use SourceID instead
+   */
+  username?: string;
+};
+
+export type GittypesGitAuthentication = {
+  AuthorizationType?: number;
+  Password?: string;
+  Provider?: number;
+  Username?: string;
+};
+
+export type GittypesGitSource = {
+  Authentication?: GittypesGitAuthentication;
+  TLSSkipVerify?: boolean;
+  URL?: string;
+};
+
+export type GittypesRepoConfig = {
+  /**
+   * Git credentials
+   */
+  Authentication?: GittypesGitAuthentication;
+  /**
+   * ConfigFilePath is the path to the config file within the repository.
+   * NOTE: For stacks, this mirrors Stack.EntryPoint and the two are kept in sync by stackUpdateGit.
+   */
+  ConfigFilePath?: string;
+  /**
+   * Repository hash
+   */
+  ConfigHash?: string;
+  /**
+   * The reference name
+   */
+  ReferenceName?: string;
+  /**
+   * TLSSkipVerify skips SSL verification when cloning the Git repository
+   */
+  TLSSkipVerify?: boolean;
+  /**
+   * The repo url
+   */
+  URL?: string;
+};
+
+export type HelmInstallChartPayload = {
+  atomic?: boolean;
+  chart?: string;
+  name?: string;
+  namespace?: string;
+  repo?: string;
+  values?: string;
+  version?: string;
+};
+
+export type ImagesImageResponse = {
+  created?: number;
+  id?: string;
+  nodeName?: string;
+  size?: number;
+  tags?: Array<string>;
+  /**
+   * Used is true if the image is used by at least one container
+   * supplied only when withUsage is true
+   */
+  used?: boolean;
+};
+
+export type IntstrIntOrString = {
+  IntVal?: number;
+  StrVal?: string;
+  Type?: IntstrType;
+};
+
+export const IntstrType = {
+  /**
+   * Int
+   *
+   * The IntOrString holds an int.
+   */
+  INT: 0 /**
+   * String
+   *
+   * The IntOrString holds a string.
+   */,
+  STRING: 1,
+} as const;
+
+export type IntstrType = (typeof IntstrType)[keyof typeof IntstrType];
+
+export const K8sIoApiCoreV1ConditionStatus = {
+  /**
+   * ConditionTrue
+   */
+  CONDITION_TRUE: 'True',
+  /**
+   * ConditionFalse
+   */
+  CONDITION_FALSE: 'False',
+  /**
+   * ConditionUnknown
+   */
+  CONDITION_UNKNOWN: 'Unknown',
+} as const;
+
+export type K8sIoApiCoreV1ConditionStatus =
+  (typeof K8sIoApiCoreV1ConditionStatus)[keyof typeof K8sIoApiCoreV1ConditionStatus];
+
+export type K8sIoApiCoreV1HttpHeader = {
+  /**
+   * The header field name.
+   * This will be canonicalized upon output, so case-variant names will be understood as the same header.
+   */
+  name?: string;
+  /**
+   * The header field value
+   */
+  value?: string;
+};
+
+export type K8sIoApiCoreV1LocalObjectReference = {
+  /**
+   * Name of the referent.
+   * This field is effectively required, but due to backwards compatibility is
+   * allowed to be empty. Instances of this type with an empty value here are
+   * almost certainly wrong.
+   * More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+   * +optional
+   * +default=""
+   * +kubebuilder:default=""
+   * TODO: Drop `kubebuilder:default` when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.
+   */
+  name?: string;
+};
+
+export type K8sIoApiCoreV1ObjectReference = {
+  /**
+   * API version of the referent.
+   * +optional
+   */
+  apiVersion?: string;
+  /**
+   * If referring to a piece of an object instead of an entire object, this string
+   * should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2].
+   * For example, if the object reference is to a container within a pod, this would take on a value like:
+   * "spec.containers{name}" (where "name" refers to the name of the container that triggered
+   * the event) or if no container name is specified "spec.containers[2]" (container with
+   * index 2 in this pod). This syntax is chosen only to have some well-defined way of
+   * referencing a part of an object.
+   * TODO: this design is not final and this field is subject to change in the future.
+   * +optional
+   */
+  fieldPath?: string;
+  /**
+   * Kind of the referent.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+   * +optional
+   */
+  kind?: string;
+  /**
+   * Name of the referent.
+   * More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+   * +optional
+   */
+  name?: string;
+  /**
+   * Namespace of the referent.
+   * More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
+   * +optional
+   */
+  namespace?: string;
+  /**
+   * Specific resourceVersion to which this reference is made, if any.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
+   * +optional
+   */
+  resourceVersion?: string;
+  /**
+   * UID of the referent.
+   * More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids
+   * +optional
+   */
+  uid?: string;
+};
+
+export type K8sIoApiCoreV1ResourceClaim = {
+  /**
+   * Name must match the name of one entry in pod.spec.resourceClaims of
+   * the Pod where this field is used. It makes that resource available
+   * inside a container.
+   */
+  name?: string;
+  /**
+   * Request is the name chosen for a request in the referenced claim.
+   * If empty, everything from the claim is made available, otherwise
+   * only the result of this request.
+   *
+   * +optional
+   */
+  request?: string;
+};
+
+export type K8sIoApiRbacV1Subject = {
+  /**
+   * APIGroup holds the API group of the referenced subject.
+   * Defaults to "" for ServiceAccount subjects.
+   * Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
+   * +optional
+   */
+  apiGroup?: string;
+  /**
+   * Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
+   * If the Authorizer does not recognized the kind value, the Authorizer should report an error.
+   */
+  kind?: string;
+  /**
+   * Name of the object being referenced.
+   * +required
+   * +k8s:required
+   */
+  name?: string;
+  /**
+   * Namespace of the referenced object.  If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
+   * the Authorizer should report an error.
+   * +optional
+   */
+  namespace?: string;
+};
+
+export type KubernetesConfiguration = {
+  ConfigurationOwner?: string;
+  Data?: {
+    [key: string]: unknown;
+  };
+  Kind?: string;
+};
+
+export type KubernetesCustomResourceMetadata = {
+  apiVersion?: string;
+  kind?: string;
+  name?: string;
+  plural?: string;
+  scope?: string;
+};
+
+export type KubernetesIngressRule = {
+  Host?: string;
+  IP?: string;
+  Path?: string;
+  TLS?: Array<KubernetesTlsInfo>;
+};
+
+export type KubernetesK8sApplication = {
+  Annotations?: {
+    [key: string]: string;
+  };
+  ApplicationOwner?: string;
+  ApplicationType?: string;
+  Configurations?: Array<KubernetesConfiguration>;
+  Containers?: Array<unknown>;
+  CreationDate?: string;
+  CustomResourceMetadata?: KubernetesCustomResourceMetadata;
+  DeploymentType?: string;
+  Id?: string;
+  Image?: string;
+  Kind?: string;
+  Labels?: {
+    [key: string]: string;
+  };
+  LoadBalancerIPAddress?: string;
+  MatchLabels?: {
+    [key: string]: string;
+  };
+  Metadata?: KubernetesMetadata;
+  Name?: string;
+  Namespace?: string;
+  Pods?: Array<KubernetesPod>;
+  PublishedPorts?: Array<KubernetesPublishedPort>;
+  Resource?: KubernetesK8sApplicationResource;
+  ResourcePool?: string;
+  RunningPodsCount?: number;
+  ServiceId?: string;
+  ServiceName?: string;
+  ServiceType?: string;
+  StackId?: string;
+  StackKind?: string;
+  StackName?: string;
+  Status?: string;
+  TotalPodsCount?: number;
+  Uid?: string;
+};
+
+export type KubernetesK8sApplicationResource = {
+  CpuLimit?: number;
+  CpuRequest?: number;
+  MemoryLimit?: number;
+  MemoryRequest?: number;
+};
+
+export type KubernetesK8sClusterRole = {
+  creationDate?: string;
+  isSystem?: boolean;
+  name?: string;
+  uid?: string;
+};
+
+export type KubernetesK8sClusterRoleBinding = {
+  creationDate?: string;
+  isSystem?: boolean;
+  name?: string;
+  namespace?: string;
+  roleRef?: V1RoleRef;
+  subjects?: Array<K8sIoApiRbacV1Subject>;
+  uid?: string;
+};
+
+export type KubernetesK8sConfigMap = {
+  Annotations?: {
+    [key: string]: string;
+  };
+  ConfigurationOwner?: string;
+  ConfigurationOwnerId?: string;
+  ConfigurationOwners?: Array<KubernetesK8sConfigurationOwnerResource>;
+  CreationDate?: string;
+  Data?: {
+    [key: string]: string;
+  };
+  IsUsed?: boolean;
+  Labels?: {
+    [key: string]: string;
+  };
+  Name?: string;
+  Namespace?: string;
+  UID?: string;
+};
+
+export type KubernetesK8sConfigurationOwnerResource = {
+  Id?: string;
+  Name?: string;
+  ResourceKind?: string;
+};
+
+export type KubernetesK8sCronJob = {
+  Command?: string;
+  Id?: string;
+  IsSystem?: boolean;
+  Jobs?: Array<KubernetesK8sJob>;
+  Name?: string;
+  Namespace?: string;
+  Schedule?: string;
+  Suspend?: boolean;
+  Timezone?: string;
+};
+
+export type KubernetesK8sCronJobDeleteRequests = {
+  [key: string]: Array<string>;
+};
+
+export type KubernetesK8sDashboard = {
+  applicationsCount?: number;
+  configMapsCount?: number;
+  ingressesCount?: number;
+  namespacesCount?: number;
+  secretsCount?: number;
+  servicesCount?: number;
+  volumesCount?: number;
+};
+
+export type KubernetesK8sEvent = {
+  count?: number;
+  eventTime?: string;
+  firstTimestamp?: string;
+  involvedObject?: KubernetesK8sEventInvolvedObject;
+  kind?: string;
+  lastTimestamp?: string;
+  message?: string;
+  name?: string;
+  namespace?: string;
+  reason?: string;
+  type?: string;
+  uid?: string;
+};
+
+export type KubernetesK8sEventInvolvedObject = {
+  kind?: string;
+  name?: string;
+  namespace?: string;
+  uid?: string;
+};
+
+export type KubernetesK8sIngressController = {
+  Availability?: boolean;
+  ClassName?: string;
+  Name?: string;
+  New?: boolean;
+  Type?: string;
+  Used?: boolean;
+};
+
+export type KubernetesK8sIngressDeleteRequests = {
+  [key: string]: Array<string>;
+};
+
+export type KubernetesK8sIngressInfo = {
+  Annotations?: {
+    [key: string]: string;
+  };
+  ClassName?: string;
+  CreationDate?: string;
+  Hosts?: Array<string>;
+  Labels?: {
+    [key: string]: string;
+  };
+  Name?: string;
+  Namespace?: string;
+  Paths?: Array<KubernetesK8sIngressPath>;
+  TLS?: Array<KubernetesK8sIngressTls>;
+  Type?: string;
+  UID?: string;
+};
+
+export type KubernetesK8sIngressPath = {
+  HasService?: boolean;
+  Host?: string;
+  IngressName?: string;
+  Path?: string;
+  PathType?: string;
+  Port?: number;
+  ServiceName?: string;
+};
+
+export type KubernetesK8sIngressTls = {
+  Hosts?: Array<string>;
+  SecretName?: string;
+};
+
+export type KubernetesK8sJob = {
+  BackoffLimit?: number;
+  Command?: string;
+  Completions?: number;
+  Container?: V1Container;
+  Duration?: string;
+  FailedReason?: string;
+  FinishTime?: string;
+  Id?: string;
+  IsSystem?: boolean;
+  Name?: string;
+  Namespace?: string;
+  PodName?: string;
+  StartTime?: string;
+  Status?: string;
+};
+
+export type KubernetesK8sJobDeleteRequests = {
+  [key: string]: Array<string>;
+};
+
+export type KubernetesK8sNamespaceDetails = {
+  Annotations?: {
+    [key: string]: string;
+  };
+  Name?: string;
+  Owner?: string;
+  ResourceQuota?: KubernetesK8sResourceQuota;
+};
+
+export type KubernetesK8sPvcResizeRequest = {
+  name?: string;
+  namespace?: string;
+  newSize?: string;
+};
+
+export type KubernetesK8sPvReclaimPolicyRequest = {
+  name?: string;
+  reclaimPolicy?: V1PersistentVolumeReclaimPolicy;
+};
+
+export type KubernetesK8sPersistentVolume = {
+  accessModes?: Array<string>;
+  annotations?: {
+    [key: string]: string;
+  };
+  capacity?: V1ResourceList;
+  claimRef?: K8sIoApiCoreV1ObjectReference;
+  creationDate?: string;
+  csi?: V1CsiPersistentVolumeSource;
+  humanReadableAccessModes?: Array<V1PersistentVolumeAccessMode>;
+  labels?: {
+    [key: string]: string;
+  };
+  name?: string;
+  persistentVolumeReclaimPolicy?: V1PersistentVolumeReclaimPolicy;
+  status?: V1PersistentVolumePhase;
+  storageClassName?: string;
+  volumeMode?: V1PersistentVolumeMode;
+};
+
+export type KubernetesK8sPersistentVolumeClaim = {
+  accessModes?: Array<string>;
+  allowVolumeExpansion?: boolean;
+  creationDate?: string;
+  humanReadableAccessModes?: Array<V1PersistentVolumeAccessMode>;
+  id?: string;
+  labels?: {
+    [key: string]: string;
+  };
+  name?: string;
+  namespace?: string;
+  owningApplications?: Array<KubernetesK8sApplication>;
+  phase?: V1PersistentVolumeClaimPhase;
+  resourcesRequests?: V1ResourceList;
+  storage?: number;
+  storageClass?: string;
+  storageRequest?: string;
+  volumeMode?: V1PersistentVolumeMode;
+  volumeName?: string;
+};
+
+export type KubernetesK8sResourceQuota = {
+  cpu?: string;
+  enabled?: boolean;
+  memory?: string;
+};
+
+export type KubernetesK8sRole = {
+  creationDate?: string;
+  /**
+   * isSystem is true if prefixed with "system:" or exists in the kube-system namespace
+   * or is one of the portainer roles
+   */
+  isSystem?: boolean;
+  name?: string;
+  namespace?: string;
+  uid?: string;
+};
+
+export type KubernetesK8sRoleBinding = {
+  creationDate?: string;
+  isSystem?: boolean;
+  name?: string;
+  namespace?: string;
+  roleRef?: V1RoleRef;
+  subjects?: Array<K8sIoApiRbacV1Subject>;
+  uid?: string;
+};
+
+export type KubernetesK8sRoleBindingDeleteRequests = {
+  [key: string]: Array<string>;
+};
+
+export type KubernetesK8sRoleDeleteRequests = {
+  [key: string]: Array<string>;
+};
+
+export type KubernetesK8sSecret = {
+  Annotations?: {
+    [key: string]: string;
+  };
+  ConfigurationOwner?: string;
+  ConfigurationOwnerId?: string;
+  ConfigurationOwners?: Array<KubernetesK8sConfigurationOwnerResource>;
+  CreationDate?: string;
+  Data?: {
+    [key: string]: string;
+  };
+  IsUsed?: boolean;
+  Labels?: {
+    [key: string]: string;
+  };
+  Name?: string;
+  Namespace?: string;
+  SecretType?: string;
+  UID?: string;
+};
+
+export type KubernetesK8sServiceAccount = {
+  annotations?: {
+    [key: string]: string;
+  };
+  automountServiceAccountToken?: boolean;
+  creationDate?: string;
+  imagePullSecrets?: Array<K8sIoApiCoreV1LocalObjectReference>;
+  isSystem?: boolean;
+  labels?: {
+    [key: string]: string;
+  };
+  name?: string;
+  namespace?: string;
+  uid?: string;
+};
+
+export type KubernetesK8sServiceAccountDeleteRequests = {
+  [key: string]: Array<string>;
+};
+
+export type KubernetesK8sServiceAccountImagePullSecretsUpdatePayload = {
+  secretNames?: Array<string>;
+};
+
+export type KubernetesK8sServiceDeleteRequests = {
+  [key: string]: Array<string>;
+};
+
+export type KubernetesK8sServiceInfo = {
+  AllocateLoadBalancerNodePorts?: boolean;
+  Annotations?: {
+    [key: string]: string;
+  };
+  /**
+   * serviceList screen
+   */
+  Applications?: Array<KubernetesK8sApplication>;
+  ClusterIPs?: Array<string>;
+  CreationDate?: string;
+  ExternalIPs?: Array<string>;
+  ExternalName?: string;
+  IngressStatus?: Array<KubernetesK8sServiceIngress>;
+  Labels?: {
+    [key: string]: string;
+  };
+  Name?: string;
+  Namespace?: string;
+  Ports?: Array<KubernetesK8sServicePort>;
+  Selector?: {
+    [key: string]: string;
+  };
+  Type?: string;
+  UID?: string;
+};
+
+export type KubernetesK8sServiceIngress = {
+  Hostname?: string;
+  IP?: string;
+};
+
+export type KubernetesK8sServicePort = {
+  Name?: string;
+  NodePort?: number;
+  Port?: number;
+  Protocol?: string;
+  TargetPort?: string;
+};
+
+export type KubernetesK8sStorageClass = {
+  allowVolumeExpansion?: boolean;
+  annotations?: {
+    [key: string]: string;
+  };
+  creationDate?: string;
+  isDefault?: boolean;
+  labels?: {
+    [key: string]: string;
+  };
+  mountOptions?: Array<string>;
+  name?: string;
+  parameters?: {
+    [key: string]: string;
+  };
+  provisioner?: string;
+  reclaimPolicy?: V1PersistentVolumeReclaimPolicy;
+};
+
+export type KubernetesK8sVolumeDeleteRequest = {
+  name?: string;
+  namespace?: string;
+};
+
+export type KubernetesK8sVolumeInfo = {
+  persistentVolume?: KubernetesK8sPersistentVolume;
+  persistentVolumeClaim?: KubernetesK8sPersistentVolumeClaim;
+  storageClass?: KubernetesK8sStorageClass;
+};
+
+export type KubernetesKubernetesNodeResponse = {
+  /**
+   * APIVersion defines the versioned schema of this representation of an object.
+   * Servers should convert recognized schemas to the latest internal value, and
+   * may reject unrecognized values.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+   * +optional
+   */
+  apiVersion?: string;
+  /**
+   * Kind is a string value representing the REST resource this object represents.
+   * Servers may infer this from the endpoint the client submits requests to.
+   * Cannot be updated.
+   * In CamelCase.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+   * +optional
+   */
+  kind?: string;
+  /**
+   * Standard object's metadata.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+   * +optional
+   */
+  metadata?: V1ObjectMeta;
+  /**
+   * Spec defines the behavior of a node.
+   * https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+   * +optional
+   */
+  spec?: V1NodeSpec;
+  /**
+   * Most recently observed status of the node.
+   * Populated by the system.
+   * Read-only.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+   * +optional
+   */
+  status?: V1NodeStatus;
+};
+
+export type KubernetesMetadata = {
+  annotations?: {
+    [key: string]: string;
+  };
+  labels?: {
+    [key: string]: string;
+  };
+};
+
+export type KubernetesPod = {
+  ContainerName?: string;
+  CreationDate?: string;
+  Image?: string;
+  ImagePullPolicy?: string;
+  Name?: string;
+  NodeName?: string;
+  PodIP?: string;
+  Resource?: KubernetesK8sApplicationResource;
+  Status?: string;
+  Uid?: string;
+};
+
+export type KubernetesPublishedPort = {
+  IngressRules?: Array<KubernetesIngressRule>;
+  Port?: number;
+};
+
+export type KubernetesTlsInfo = {
+  hosts?: Array<string>;
+};
+
+export type KubernetesDescribeResourceResponse = {
+  describe?: string;
+};
+
+export type KubernetesKubernetesVersionResponse = {
+  buildDate?: string;
+  compiler?: string;
+  /**
+   * EmulationMajor is the major version of the emulation version
+   */
+  emulationMajor?: string;
+  /**
+   * EmulationMinor is the minor version of the emulation version
+   */
+  emulationMinor?: string;
+  gitCommit?: string;
+  gitTreeState?: string;
+  gitVersion?: string;
+  goVersion?: string;
+  /**
+   * Major is the major version of the binary version
+   */
+  major?: string;
+  /**
+   * MinCompatibilityMajor is the major version of the minimum compatibility version
+   */
+  minCompatibilityMajor?: string;
+  /**
+   * MinCompatibilityMinor is the minor version of the minimum compatibility version
+   */
+  minCompatibilityMinor?: string;
+  /**
+   * Minor is the minor version of the binary version
+   */
+  minor?: string;
+  platform?: string;
+  /**
+   * SupportsPodRestart is true when the cluster exposes the `pods/restart`
+   * subresource via API discovery — i.e. the feature gate is enabled and
+   * the cluster version is recent enough. This is the authoritative
+   * signal for whether Portainer can call the pod-restart endpoint, and
+   * is preferred over a raw Kubernetes-version comparison.
+   */
+  supportsPodRestart?: boolean;
+};
+
+export type KubernetesNamespacesToggleSystemPayload = {
+  /**
+   * Toggle the system state of this namespace to true or false
+   */
+  System?: boolean;
+};
+
+export type LdapCheckPayload = {
+  LDAPSettings?: PortainerLdapSettings;
+};
+
+export type MotdMotd = {
+  ContentLayout?: {
+    [key: string]: string;
+  };
+  Hash?: Array<number>;
+  Message?: string;
+  Style?: string;
+  Title?: string;
+};
+
+export const Oauth2AuthStyle = {
+  /**
+   * AuthStyleAutoDetect
+   */
+  AUTH_STYLE_AUTO_DETECT: 0,
+  /**
+   * AuthStyleInParams
+   */
+  AUTH_STYLE_IN_PARAMS: 1,
+  /**
+   * AuthStyleInHeader
+   */
+  AUTH_STYLE_IN_HEADER: 2,
+} as const;
+
+export type Oauth2AuthStyle =
+  (typeof Oauth2AuthStyle)[keyof typeof Oauth2AuthStyle];
+
+export const PlatformContainerPlatform = {
+  /**
+   * PlatformDocker
+   */
+  PLATFORM_DOCKER: 'Docker',
+  /**
+   * PlatformDockerStandalone
+   */
+  PLATFORM_DOCKER_STANDALONE: 'Docker Standalone',
+  /**
+   * PlatformDockerSwarm
+   */
+  PLATFORM_DOCKER_SWARM: 'Docker Swarm',
+  /**
+   * PlatformKubernetes
+   */
+  PLATFORM_KUBERNETES: 'Kubernetes',
+  /**
+   * PlatformPodman
+   */
+  PLATFORM_PODMAN: 'Podman',
+} as const;
+
+export type PlatformContainerPlatform =
+  (typeof PlatformContainerPlatform)[keyof typeof PlatformContainerPlatform];
+
+export type PortainerApiKey = {
+  /**
+   * Unix timestamp (UTC) when the API key was created
+   */
+  dateCreated?: number;
+  description?: string;
+  /**
+   * Digest represents SHA256 hash of the raw API key
+   */
+  digest?: string;
+  id?: number;
+  /**
+   * Unix timestamp (UTC) when the API key was last used
+   */
+  lastUsed?: number;
+  /**
+   * API key identifier (7 char prefix)
+   */
+  prefix?: string;
+  userId?: number;
+};
+
+export type PortainerAccessPolicy = {
+  /**
+   * Namespaces is a list of namespaces that this access policy applies to. Only used for namespaced level roles
+   */
+  Namespaces?: Array<string>;
+  /**
+   * Role identifier. Reference the role that will be associated to this access policy
+   */
+  RoleId: number;
+};
+
+export type PortainerArtifact = {
+  edgeGroups?: Array<number>;
+  edgeStackId?: number;
+  envGroups?: Array<number>;
+  envIds?: Array<number>;
+  files?: Array<PortainerArtifactFile>;
+  stackId?: number;
+};
+
+export type PortainerArtifactFile = {
+  hash?: string;
+  path?: string;
+  pathError?: string;
+  pathStatus?: PortainerSourceStatus;
+  ref?: string;
+  refError?: string;
+  refStatus?: PortainerSourceStatus;
+  sourceId?: number;
+};
+
+export const PortainerAuthenticationMethod = {
+  /**
+   * _
+   */
+  '': 0,
+  /**
+   * AuthenticationInternal
+   */
+  AUTHENTICATION_INTERNAL: 1,
+  /**
+   * AuthenticationLDAP
+   */
+  AUTHENTICATION_LDAP: 2,
+  /**
+   * AuthenticationOAuth
+   */
+  AUTHENTICATION_O_AUTH: 3,
+} as const;
+
+export type PortainerAuthenticationMethod =
+  (typeof PortainerAuthenticationMethod)[keyof typeof PortainerAuthenticationMethod];
+
+export type PortainerAuthorizations = {
+  [key: string]: boolean;
+};
+
+export type PortainerAutoUpdateSettings = {
+  /**
+   * Pull latest image
+   */
+  ForcePullImage?: boolean;
+  /**
+   * Force update ignores repo changes
+   */
+  ForceUpdate?: boolean;
+  /**
+   * Auto update interval
+   */
+  Interval?: string;
+  /**
+   * Autoupdate job id
+   */
+  JobID?: string;
+  /**
+   * A UUID generated from client
+   */
+  Webhook?: string;
+};
+
+export type PortainerAzureCredentials = {
+  /**
+   * Azure application ID
+   */
+  ApplicationID: string;
+  /**
+   * Azure authentication key
+   */
+  AuthenticationKey: string;
+  /**
+   * Azure tenant ID
+   */
+  TenantID: string;
+};
+
+export type PortainerCustomTemplate = {
+  /**
+   * User identifier who created this template
+   */
+  CreatedByUserId?: number;
+  /**
+   * Description of the template
+   */
+  Description?: string;
+  /**
+   * EdgeTemplate indicates if this template purpose for Edge Stack
+   */
+  EdgeTemplate?: boolean;
+  /**
+   * Path to the Stack file
+   */
+  EntryPoint?: string;
+  GitConfig?: GittypesRepoConfig;
+  /**
+   * CustomTemplate Identifier
+   */
+  Id?: number;
+  /**
+   * IsComposeFormat indicates if the Kubernetes template is created from a Docker Compose file
+   */
+  IsComposeFormat?: boolean;
+  /**
+   * URL of the template's logo
+   */
+  Logo?: string;
+  /**
+   * A note that will be displayed in the UI. Supports HTML content
+   */
+  Note?: string;
+  /**
+   * Platform associated to the template.
+   * Valid values are: 1 - 'linux', 2 - 'windows'
+   */
+  Platform?: 1 | 2;
+  /**
+   * Path on disk to the repository hosting the Stack file
+   */
+  ProjectPath?: string;
+  ResourceControl?: PortainerResourceControl;
+  /**
+   * Title of the template
+   */
+  Title?: string;
+  /**
+   * Type of created stack:
+   * * 1 - swarm
+   * * 2 - compose
+   * * 3 - kubernetes
+   */
+  Type?: 1 | 2 | 3;
+  Variables?: Array<PortainerCustomTemplateVariableDefinition>;
+  artifact?: PortainerArtifact;
+};
+
+export const PortainerCustomTemplatePlatform = {
+  /**
+   * _
+   */
+  '': 0,
+  /**
+   * CustomTemplatePlatformLinux
+   */
+  CUSTOM_TEMPLATE_PLATFORM_LINUX: 1,
+  /**
+   * CustomTemplatePlatformWindows
+   */
+  CUSTOM_TEMPLATE_PLATFORM_WINDOWS: 2,
+} as const;
+
+export type PortainerCustomTemplatePlatform =
+  (typeof PortainerCustomTemplatePlatform)[keyof typeof PortainerCustomTemplatePlatform];
+
+export type PortainerCustomTemplateVariableDefinition = {
+  defaultValue?: string;
+  description?: string;
+  label?: string;
+  name?: string;
+};
+
+export type PortainerDiagnosticsData = {
+  DNS?: {
+    [key: string]: string;
+  };
+  Log?: string;
+  Proxy?: {
+    [key: string]: string;
+  };
+  Telnet?: {
+    [key: string]: string;
+  };
+};
+
+export type PortainerDockerSnapshot = {
+  ContainerCount: number;
+  DiagnosticsData?: PortainerDiagnosticsData;
+  DockerSnapshotRaw?: PortainerDockerSnapshotRaw;
+  DockerVersion: string;
+  GpuUseAll: boolean;
+  GpuUseList?: Array<string>;
+  HealthyContainerCount: number;
+  ImageCount: number;
+  IsPodman: boolean;
+  NodeCount: number;
+  PerformanceMetrics?: PortainerPerformanceMetrics;
+  RunningContainerCount: number;
+  ServiceCount: number;
+  StackCount: number;
+  StoppedContainerCount: number;
+  Swarm: boolean;
+  Time: number;
+  TotalCPU: number;
+  TotalMemory: number;
+  UnhealthyContainerCount: number;
+  VolumeCount: number;
+};
+
+export type PortainerDockerSnapshotRaw = {
+  [key: string]: unknown;
+};
+
+export type PortainerEcrData = {
+  Region?: string;
+};
+
+export type PortainerEdge = {
+  /**
+   * Deprecated 2.18
+   */
+  AsyncMode?: boolean;
+  /**
+   * The command list interval for edge agent - used in edge async mode (in seconds)
+   */
+  CommandInterval?: number;
+  /**
+   * The ping interval for edge agent - used in edge async mode (in seconds)
+   */
+  PingInterval?: number;
+  /**
+   * The snapshot interval for edge agent - used in edge async mode (in seconds)
+   */
+  SnapshotInterval?: number;
+};
+
+export type PortainerEdgeGroup = {
+  Dynamic?: boolean;
+  EndpointIds?: RoarRoarPortainerEndpointId;
+  /**
+   * Deprecated: only used for API responses
+   */
+  Endpoints?: Array<number>;
+  /**
+   * EdgeGroup Identifier
+   */
+  Id?: number;
+  Name?: string;
+  PartialMatch?: boolean;
+  TagIds?: Array<number>;
+};
+
+export type PortainerEdgeJob = {
+  Created?: number;
+  CronExpression?: string;
+  EdgeGroups?: Array<number>;
+  Endpoints?: {
+    [key: string]: PortainerEdgeJobEndpointMeta;
+  };
+  /**
+   * Field used for log collection of Endpoints belonging to EdgeGroups
+   */
+  GroupLogsCollection?: {
+    [key: string]: PortainerEdgeJobEndpointMeta;
+  };
+  /**
+   * EdgeJob Identifier
+   */
+  Id?: number;
+  Name?: string;
+  Recurring?: boolean;
+  ScriptPath?: string;
+  Version?: number;
+};
+
+export type PortainerEdgeJobEndpointMeta = {
+  CollectLogs?: boolean;
+  LogsStatus?: PortainerEdgeJobLogsStatus;
+};
+
+export const PortainerEdgeJobLogsStatus = {
+  /**
+   * _
+   */
+  '': 0,
+  /**
+   * EdgeJobLogsStatusIdle
+   */
+  EDGE_JOB_LOGS_STATUS_IDLE: 1,
+  /**
+   * EdgeJobLogsStatusPending
+   */
+  EDGE_JOB_LOGS_STATUS_PENDING: 2,
+  /**
+   * EdgeJobLogsStatusCollected
+   */
+  EDGE_JOB_LOGS_STATUS_COLLECTED: 3,
+} as const;
+
+export type PortainerEdgeJobLogsStatus =
+  (typeof PortainerEdgeJobLogsStatus)[keyof typeof PortainerEdgeJobLogsStatus];
+
+export type PortainerEdgeStack = {
+  /**
+   * The username which created this stack
+   */
+  CreatedBy?: string;
+  /**
+   * The username id which created this stack
+   */
+  CreatedByUserId?: string;
+  /**
+   * StatusArray    map[EndpointID][]EdgeStackStatus `json:"StatusArray"`
+   */
+  CreationDate?: number;
+  DeploymentType?: PortainerEdgeStackDeploymentType;
+  EdgeGroups?: Array<number>;
+  EntryPoint?: string;
+  /**
+   * EdgeStack Identifier
+   */
+  Id?: number;
+  ManifestPath?: string;
+  Name?: string;
+  NumDeployments?: number;
+  ProjectPath?: string;
+  Status?: {
+    [key: string]: PortainerEdgeStackStatus;
+  };
+  /**
+   * Uses the manifest's namespaces instead of the default one
+   */
+  UseManifestNamespaces?: boolean;
+  Version?: number;
+};
+
+export type PortainerEdgeStackDeploymentStatus = {
+  Error?: string;
+  /**
+   * EE only feature
+   */
+  RollbackTo?: number;
+  Time?: number;
+  Type?: PortainerEdgeStackStatusType;
+  Version?: number;
+};
+
+export const PortainerEdgeStackDeploymentType = {
+  /**
+   * EdgeStackDeploymentCompose
+   */
+  EDGE_STACK_DEPLOYMENT_COMPOSE: 0 /**
+   * EdgeStackDeploymentKubernetes
+   */,
+  EDGE_STACK_DEPLOYMENT_KUBERNETES: 1,
+} as const;
+
+export type PortainerEdgeStackDeploymentType =
+  (typeof PortainerEdgeStackDeploymentType)[keyof typeof PortainerEdgeStackDeploymentType];
+
+export type PortainerEdgeStackStatus = {
+  /**
+   * EE only feature
+   */
+  DeploymentInfo?: PortainerStackDeploymentInfo;
+  /**
+   * Deprecated
+   */
+  Details?: PortainerEdgeStackStatusDetails;
+  EndpointID?: number;
+  /**
+   * Deprecated
+   */
+  Error?: string;
+  /**
+   * ReadyRePullImage is a flag to indicate whether the auto update is trigger to re-pull image
+   */
+  ReadyRePullImage?: boolean;
+  Status?: Array<PortainerEdgeStackDeploymentStatus>;
+  /**
+   * Deprecated
+   */
+  Type?: PortainerEdgeStackStatusType;
+};
+
+export type PortainerEdgeStackStatusDetails = {
+  Acknowledged?: boolean;
+  Error?: boolean;
+  ImagesPulled?: boolean;
+  Ok?: boolean;
+  Pending?: boolean;
+  RemoteUpdateSuccess?: boolean;
+  Remove?: boolean;
+};
+
+export const PortainerEdgeStackStatusType = {
+  /**
+   * EdgeStackStatusPending
+   */
+  EDGE_STACK_STATUS_PENDING: 0,
+  /**
+   * EdgeStackStatusDeploymentReceived
+   */
+  EDGE_STACK_STATUS_DEPLOYMENT_RECEIVED: 1,
+  /**
+   * EdgeStackStatusError
+   */
+  EDGE_STACK_STATUS_ERROR: 2,
+  /**
+   * EdgeStackStatusAcknowledged
+   */
+  EDGE_STACK_STATUS_ACKNOWLEDGED: 3,
+  /**
+   * EdgeStackStatusRemoved
+   */
+  EDGE_STACK_STATUS_REMOVED: 4,
+  /**
+   * EdgeStackStatusRemoteUpdateSuccess
+   */
+  EDGE_STACK_STATUS_REMOTE_UPDATE_SUCCESS: 5,
+  /**
+   * EdgeStackStatusImagesPulled
+   */
+  EDGE_STACK_STATUS_IMAGES_PULLED: 6,
+  /**
+   * EdgeStackStatusRunning
+   */
+  EDGE_STACK_STATUS_RUNNING: 7,
+  /**
+   * EdgeStackStatusDeploying
+   */
+  EDGE_STACK_STATUS_DEPLOYING: 8,
+  /**
+   * EdgeStackStatusRemoving
+   */
+  EDGE_STACK_STATUS_REMOVING: 9,
+  /**
+   * EdgeStackStatusPausedDeploying
+   */
+  EDGE_STACK_STATUS_PAUSED_DEPLOYING: 10,
+  /**
+   * EdgeStackStatusRollingBack
+   */
+  EDGE_STACK_STATUS_ROLLING_BACK: 11,
+  /**
+   * EdgeStackStatusRolledBack
+   */
+  EDGE_STACK_STATUS_ROLLED_BACK: 12,
+  /**
+   * EdgeStackStatusCompleted
+   */
+  EDGE_STACK_STATUS_COMPLETED: 13,
+} as const;
+
+export type PortainerEdgeStackStatusType =
+  (typeof PortainerEdgeStackStatusType)[keyof typeof PortainerEdgeStackStatusType];
+
+export type PortainerEndpoint = {
+  Agent: PortainerEnvironmentAgentData;
+  AzureCredentials?: PortainerAzureCredentials;
+  /**
+   * Maximum version of docker-compose
+   */
+  ComposeSyntaxMaxVersion: string;
+  /**
+   * ContainerEngine represents the container engine type. This can be 'docker' or 'podman' when interacting directly with these environments, otherwise '' for kubernetes environments.
+   */
+  ContainerEngine: string;
+  Edge: PortainerEnvironmentEdgeSettings;
+  /**
+   * The check in interval for edge agent (in seconds)
+   */
+  EdgeCheckinInterval: number;
+  /**
+   * The identifier of the edge agent associated with this environment(endpoint)
+   */
+  EdgeID?: string;
+  /**
+   * The key which is used to map the agent to Portainer
+   */
+  EdgeKey: string;
+  EnableGPUManagement?: boolean;
+  Gpus?: Array<PortainerPair>;
+  /**
+   * Environment(Endpoint) group identifier
+   */
+  GroupId: number;
+  /**
+   * Heartbeat indicates the heartbeat status of an edge environment
+   */
+  Heartbeat?: boolean;
+  /**
+   * Environment(Endpoint) Identifier
+   */
+  Id: number;
+  /**
+   * Associated Kubernetes data
+   */
+  Kubernetes: PortainerKubernetesData;
+  /**
+   * LastCheckInDate mark last check-in date on checkin
+   */
+  LastCheckInDate: number;
+  /**
+   * Environment(Endpoint) name
+   */
+  Name: string;
+  /**
+   * URL or IP address where exposed containers will be reachable
+   */
+  PublicURL: string;
+  /**
+   * Environment(Endpoint) specific security settings
+   */
+  SecuritySettings: PortainerEndpointSecuritySettings;
+  /**
+   * List of snapshots
+   */
+  Snapshots?: Array<PortainerDockerSnapshot>;
+  /**
+   * The status of the environment(endpoint) (1 - up, 2 - down, 3 - provisioning, 4 - error)
+   */
+  Status?: 1 | 2 | 3 | 4;
+  TLSConfig: PortainerTlsConfiguration;
+  /**
+   * List of tag identifiers to which this environment(endpoint) is associated
+   */
+  TagIds?: Array<number>;
+  /**
+   * List of team identifiers authorized to connect to this environment(endpoint)
+   */
+  TeamAccessPolicies?: PortainerTeamAccessPolicies;
+  /**
+   * Environment(Endpoint) environment(endpoint) type. 1 for a Docker environment(endpoint), 2 for an agent on Docker environment(endpoint) or 3 for an Azure environment(endpoint).
+   */
+  Type: PortainerEndpointType;
+  /**
+   * URL or IP address of the Docker host associated to this environment(endpoint)
+   */
+  URL: string;
+  /**
+   * List of user identifiers authorized to connect to this environment(endpoint)
+   */
+  UserAccessPolicies?: PortainerUserAccessPolicies;
+  /**
+   * Whether the device has been trusted or not by the user
+   */
+  UserTrusted?: boolean;
+};
+
+export type PortainerEndpointGroup = {
+  /**
+   * Description associated to the environment(endpoint) group
+   */
+  Description: string;
+  /**
+   * Environment(Endpoint) group Identifier
+   */
+  Id: number;
+  /**
+   * Environment(Endpoint) group name
+   */
+  Name: string;
+  /**
+   * List of tags associated to this environment(endpoint) group
+   */
+  TagIds?: Array<number>;
+  TeamAccessPolicies?: PortainerTeamAccessPolicies;
+  UserAccessPolicies?: PortainerUserAccessPolicies;
+};
+
+export type PortainerEndpointSecuritySettings = {
+  /**
+   * Whether non-administrator should be able to use bind mounts when creating containers
+   */
+  allowBindMountsForRegularUsers: boolean;
+  /**
+   * Whether non-administrator should be able to use container capabilities
+   */
+  allowContainerCapabilitiesForRegularUsers: boolean;
+  /**
+   * Whether non-administrator should be able to use device mapping
+   */
+  allowDeviceMappingForRegularUsers: boolean;
+  /**
+   * Whether non-administrator should be able to use the host pid
+   */
+  allowHostNamespaceForRegularUsers: boolean;
+  /**
+   * Whether non-administrator should be able to use privileged mode when creating containers
+   */
+  allowPrivilegedModeForRegularUsers: boolean;
+  /**
+   * Whether non-administrator should be able to use security-opt settings
+   */
+  allowSecurityOptForRegularUsers: boolean;
+  /**
+   * Whether non-administrator should be able to manage stacks
+   */
+  allowStackManagementForRegularUsers: boolean;
+  /**
+   * Whether non-administrator should be able to use sysctl settings
+   */
+  allowSysctlSettingForRegularUsers: boolean;
+  /**
+   * Whether non-administrator should be able to browse volumes
+   */
+  allowVolumeBrowserForRegularUsers: boolean;
+  /**
+   * Whether host management features are enabled
+   */
+  enableHostManagementFeatures: boolean;
+};
+
+export const PortainerEndpointStatus = {
+  /**
+   * _
+   */
+  '': 0,
+  /**
+   * EndpointStatusUp
+   */
+  ENDPOINT_STATUS_UP: 1,
+  /**
+   * EndpointStatusDown
+   */
+  ENDPOINT_STATUS_DOWN: 2,
+} as const;
+
+export type PortainerEndpointStatus =
+  (typeof PortainerEndpointStatus)[keyof typeof PortainerEndpointStatus];
+
+export const PortainerEndpointType = {
+  /**
+   * _
+   */
+  '': 0,
+  /**
+   * DockerEnvironment
+   */
+  DOCKER_ENVIRONMENT: 1,
+  /**
+   * AgentOnDockerEnvironment
+   */
+  AGENT_ON_DOCKER_ENVIRONMENT: 2,
+  /**
+   * AzureEnvironment
+   */
+  AZURE_ENVIRONMENT: 3,
+  /**
+   * EdgeAgentOnDockerEnvironment
+   */
+  EDGE_AGENT_ON_DOCKER_ENVIRONMENT: 4,
+  /**
+   * KubernetesLocalEnvironment
+   */
+  KUBERNETES_LOCAL_ENVIRONMENT: 5,
+  /**
+   * AgentOnKubernetesEnvironment
+   */
+  AGENT_ON_KUBERNETES_ENVIRONMENT: 6,
+  /**
+   * EdgeAgentOnKubernetesEnvironment
+   */
+  EDGE_AGENT_ON_KUBERNETES_ENVIRONMENT: 7,
+} as const;
+
+export type PortainerEndpointType =
+  (typeof PortainerEndpointType)[keyof typeof PortainerEndpointType];
+
+export type PortainerEnvironmentAgentData = {
+  Version?: string;
+};
+
+export type PortainerEnvironmentEdgeSettings = {
+  /**
+   * Whether the device has been started in edge async mode
+   */
+  AsyncMode: boolean;
+  /**
+   * The command list interval for edge agent - used in edge async mode [seconds]
+   */
+  CommandInterval: number;
+  /**
+   * The ping interval for edge agent - used in edge async mode [seconds]
+   */
+  PingInterval: number;
+  /**
+   * The snapshot interval for edge agent - used in edge async mode [seconds]
+   */
+  SnapshotInterval: number;
+};
+
+export type PortainerGithubRegistryData = {
+  OrganisationName?: string;
+  UseOrganisation?: boolean;
+};
+
+export type PortainerGitlabRegistryData = {
+  InstanceURL?: string;
+  ProjectId?: number;
+  ProjectPath?: string;
+};
+
+export type PortainerGlobalDeploymentOptions = {
+  hideStacksFunctionality?: boolean;
+};
+
+export type PortainerHelmConfig = {
+  /**
+   * Atomic enables automatic rollback on deployment failure (equivalent to helm --atomic).
+   * Used by both git repo and Helm repository deployments.
+   */
+  Atomic?: boolean;
+  /**
+   * ChartName is the name of the Helm chart within the repository.
+   * Required for Helm repository deployments.
+   */
+  ChartName?: string;
+  /**
+   * ChartPath is the path to a Helm chart folder within the cloned git repository.
+   * Used exclusively for git repo helm deployments. Mutually exclusive with ChartURL.
+   */
+  ChartPath?: string;
+  /**
+   * ChartURL is the URL of a Helm chart repository.
+   * Used exclusively for Helm repository deployments. Mutually exclusive with ChartPath.
+   */
+  ChartURL?: string;
+  /**
+   * ChartVersion is the version of the Helm chart to deploy. Empty means latest.
+   * Used exclusively for Helm repository deployments.
+   */
+  ChartVersion?: string;
+  /**
+   * Namespace is the Kubernetes namespace to deploy the Helm chart into.
+   * Used by both git repo and Helm repository deployments.
+   */
+  Namespace?: string;
+  /**
+   * Timeout sets the deadline for Helm operations (equivalent to helm --timeout, e.g. "5m0s").
+   * Used by both git repo and Helm repository deployments.
+   */
+  Timeout?: string;
+  /**
+   * ValuesFiles is a list of relative paths to Helm values YAML files within the cloned git repository.
+   * Used exclusively for git repo helm deployments.
+   */
+  ValuesFiles?: Array<string>;
+  /**
+   * ValuesInline is the inline YAML string of Helm values.
+   * Used exclusively for Helm repository deployments.
+   */
+  ValuesInline?: string;
+};
+
+export type PortainerHelmUserRepository = {
+  /**
+   * Membership Identifier
+   */
+  Id?: number;
+  /**
+   * Helm repository URL
+   */
+  URL?: string;
+  /**
+   * User identifier
+   */
+  UserId?: number;
+};
+
+export type PortainerInternalAuthSettings = {
+  RequiredPasswordLength?: number;
+};
+
+export type PortainerK8sNamespaceInfo = {
+  Annotations?: {
+    [key: string]: string;
+  };
+  CreationDate?: string;
+  Id?: string;
+  IsDefault?: boolean;
+  IsSystem?: boolean;
+  Name?: string;
+  NamespaceOwner?: string;
+  ResourceQuota?: V1ResourceQuota;
+  Status?: V1NamespaceStatus;
+  UnhealthyEventCount?: number;
+};
+
+export type PortainerK8sNodeLimits = {
+  CPU?: number;
+  Memory?: number;
+};
+
+export type PortainerK8sNodesLimits = {
+  [key: string]: PortainerK8sNodeLimits;
+};
+
+export type PortainerKubernetesConfiguration = {
+  AllowNoneIngressClass: boolean;
+  EnableResourceOverCommit?: boolean;
+  IngressAvailabilityPerNamespace: boolean;
+  IngressClasses?: Array<PortainerKubernetesIngressClassConfig>;
+  ResourceOverCommitPercentage?: number;
+  RestrictDefaultNamespace?: boolean;
+  StorageClasses?: Array<PortainerKubernetesStorageClassConfig>;
+  UseLoadBalancer?: boolean;
+  UseServerMetrics?: boolean;
+};
+
+export type PortainerKubernetesData = {
+  Configuration: PortainerKubernetesConfiguration;
+  Flags: PortainerKubernetesFlags;
+  Snapshots?: Array<PortainerKubernetesSnapshot>;
+};
+
+export type PortainerKubernetesFlags = {
+  GPUOperator?: boolean;
+  IsServerIngressClassDetected: boolean;
+  IsServerMetricsDetected: boolean;
+  IsServerStorageDetected: boolean;
+};
+
+export type PortainerKubernetesIngressClassConfig = {
+  Blocked?: boolean;
+  BlockedNamespaces?: Array<string>;
+  Name: string;
+  Type: string;
+};
+
+export type PortainerKubernetesSnapshot = {
+  ClusterType?: string;
+  DiagnosticsData?: PortainerDiagnosticsData;
+  GPUNodeCount?: number;
+  KubernetesVersion: string;
+  NodeCount: number;
+  PerformanceMetrics?: PortainerPerformanceMetrics;
+  Time: number;
+  TotalCPU: number;
+  TotalGPU?: {
+    [key: string]: number;
+  };
+  TotalMemory: number;
+};
+
+export type PortainerKubernetesStorageClassConfig = {
+  AccessModes?: Array<string>;
+  AllowVolumeExpansion: boolean;
+  Name: string;
+  Provisioner: string;
+};
+
+export type PortainerLdapGroupSearchSettings = {
+  /**
+   * LDAP attribute which denotes the group membership
+   */
+  GroupAttribute?: string;
+  /**
+   * The distinguished name of the element from which the LDAP server will search for groups
+   */
+  GroupBaseDN?: string;
+  /**
+   * The LDAP search filter used to select group elements, optional
+   */
+  GroupFilter?: string;
+};
+
+export type PortainerLdapSearchSettings = {
+  /**
+   * The distinguished name of the element from which the LDAP server will search for users
+   */
+  BaseDN?: string;
+  /**
+   * Optional LDAP search filter used to select user elements
+   */
+  Filter?: string;
+  /**
+   * LDAP attribute which denotes the username
+   */
+  UserNameAttribute?: string;
+};
+
+export type PortainerLdapSettings = {
+  /**
+   * Enable this option if the server is configured for Anonymous access. When enabled, ReaderDN and Password will not be used
+   */
+  AnonymousMode?: boolean;
+  /**
+   * Automatically provision users and assign them to matching LDAP group names
+   */
+  AutoCreateUsers?: boolean;
+  GroupSearchSettings?: Array<PortainerLdapGroupSearchSettings>;
+  /**
+   * Password of the account that will be used to search users
+   */
+  Password?: string;
+  /**
+   * Account that will be used to search for users
+   */
+  ReaderDN?: string;
+  SearchSettings?: Array<PortainerLdapSearchSettings>;
+  /**
+   * Whether LDAP connection should use StartTLS
+   */
+  StartTLS?: boolean;
+  TLSConfig?: PortainerTlsConfiguration;
+  /**
+   * URL or IP address of the LDAP server
+   */
+  URL?: string;
+};
+
+export const PortainerMembershipRole = {
+  /**
+   * _
+   */
+  '': 0,
+  /**
+   * TeamLeader
+   */
+  TEAM_LEADER: 1,
+  /**
+   * TeamMember
+   */
+  TEAM_MEMBER: 2,
+} as const;
+
+export type PortainerMembershipRole =
+  (typeof PortainerMembershipRole)[keyof typeof PortainerMembershipRole];
+
+export type PortainerOAuthSettings = {
+  AccessTokenURI?: string;
+  AuthStyle?: Oauth2AuthStyle;
+  AuthorizationURI?: string;
+  ClientID?: string;
+  ClientSecret?: string;
+  DefaultTeamID?: number;
+  KubeSecretKey?: Array<number>;
+  LogoutURI?: string;
+  OAuthAutoCreateUsers?: boolean;
+  RedirectURI?: string;
+  ResourceURI?: string;
+  SSO?: boolean;
+  Scopes?: string;
+  UserIdentifier?: string;
+};
+
+export type PortainerPair = {
+  name: string;
+  value: string;
+};
+
+export type PortainerPerformanceMetrics = {
+  CPUUsage?: number;
+  DiskUsage?: number;
+  MemoryUsage?: number;
+  NetworkUsage?: number;
+};
+
+export type PortainerQuayRegistryData = {
+  OrganisationName?: string;
+  UseOrganisation?: boolean;
+};
+
+export type PortainerRegistry = {
+  /**
+   * Stores temporary access token
+   */
+  AccessToken?: string;
+  AccessTokenExpiry?: number;
+  /**
+   * Is authentication against this registry enabled
+   */
+  Authentication?: boolean;
+  /**
+   * Deprecated in DBVersion == 18
+   */
+  AuthorizedTeams?: Array<number>;
+  /**
+   * Deprecated in DBVersion == 18
+   */
+  AuthorizedUsers?: Array<number>;
+  /**
+   * Base URL, introduced for ProGet registry
+   */
+  BaseURL?: string;
+  Ecr?: PortainerEcrData;
+  Github?: PortainerGithubRegistryData;
+  Gitlab?: PortainerGitlabRegistryData;
+  /**
+   * Registry Identifier
+   */
+  Id?: number;
+  ManagementConfiguration?: PortainerRegistryManagementConfiguration;
+  /**
+   * Registry Name
+   */
+  Name?: string;
+  /**
+   * Password or SecretAccessKey used to authenticate against this registry
+   */
+  Password?: string;
+  Quay?: PortainerQuayRegistryData;
+  RegistryAccesses?: PortainerRegistryAccesses;
+  /**
+   * Deprecated in DBVersion == 31
+   */
+  TeamAccessPolicies?: PortainerTeamAccessPolicies;
+  /**
+   * Registry Type (1 - Quay, 2 - Azure, 3 - Custom, 4 - Gitlab, 5 - ProGet, 6 - DockerHub, 7 - ECR)
+   */
+  Type?: 1 | 2 | 3 | 4 | 5 | 6 | 7;
+  /**
+   * URL or IP address of the Docker registry
+   */
+  URL?: string;
+  /**
+   * Deprecated fields
+   * Deprecated in DBVersion == 31
+   */
+  UserAccessPolicies?: PortainerUserAccessPolicies;
+  /**
+   * Username or AccessKeyID used to authenticate against this registry
+   */
+  Username?: string;
+};
+
+export type PortainerRegistryAccessPolicies = {
+  /**
+   * Kubernetes specific fields (with kubernetes, namespaces have access to a registry, if users/teams have access to the same namespace, they have access to the registry)
+   */
+  Namespaces?: Array<string>;
+  TeamAccessPolicies?: PortainerTeamAccessPolicies;
+  /**
+   * Docker specific fields (with docker, users/teams have access to a registry)
+   */
+  UserAccessPolicies?: PortainerUserAccessPolicies;
+};
+
+export type PortainerRegistryAccesses = {
+  [key: string]: PortainerRegistryAccessPolicies;
+};
+
+export type PortainerRegistryManagementConfiguration = {
+  AccessToken?: string;
+  AccessTokenExpiry?: number;
+  Authentication?: boolean;
+  Ecr?: PortainerEcrData;
+  Password?: string;
+  TLSConfig?: PortainerTlsConfiguration;
+  Type?: PortainerRegistryType;
+  Username?: string;
+};
+
+export const PortainerRegistryType = {
+  /**
+   * _
+   */
+  '': 0,
+  /**
+   * QuayRegistry
+   */
+  QUAY_REGISTRY: 1,
+  /**
+   * AzureRegistry
+   */
+  AZURE_REGISTRY: 2,
+  /**
+   * CustomRegistry
+   */
+  CUSTOM_REGISTRY: 3,
+  /**
+   * GitlabRegistry
+   */
+  GITLAB_REGISTRY: 4,
+  /**
+   * ProGetRegistry
+   */
+  PRO_GET_REGISTRY: 5,
+  /**
+   * DockerHubRegistry
+   */
+  DOCKER_HUB_REGISTRY: 6,
+  /**
+   * EcrRegistry
+   */
+  ECR_REGISTRY: 7,
+  /**
+   * GithubRegistry
+   */
+  GITHUB_REGISTRY: 8,
+} as const;
+
+export type PortainerRegistryType =
+  (typeof PortainerRegistryType)[keyof typeof PortainerRegistryType];
+
+export const PortainerResourceAccessLevel = {
+  /**
+   * _
+   */
+  '': 0 /**
+   * ReadWriteAccessLevel
+   */,
+  READ_WRITE_ACCESS_LEVEL: 1,
+} as const;
+
+export type PortainerResourceAccessLevel =
+  (typeof PortainerResourceAccessLevel)[keyof typeof PortainerResourceAccessLevel];
+
+export type PortainerResourceControl = {
+  AccessLevel?: PortainerResourceAccessLevel;
+  /**
+   * Permit access to resource only to admins
+   */
+  AdministratorsOnly?: boolean;
+  /**
+   * ResourceControl Identifier
+   */
+  Id?: number;
+  /**
+   * Deprecated fields
+   * Deprecated in DBVersion == 2
+   */
+  OwnerId?: number;
+  /**
+   * Permit access to the associated resource to any user
+   */
+  Public?: boolean;
+  /**
+   * Docker resource identifier on which access control will be applied.\
+   * In the case of a resource control applied to a stack, use the stack name as identifier
+   */
+  ResourceId?: string;
+  /**
+   * List of Docker resources that will inherit this access control
+   */
+  SubResourceIds?: Array<string>;
+  System?: boolean;
+  TeamAccesses?: Array<PortainerTeamResourceAccess>;
+  /**
+   * Type of Docker resource. Valid values are: 1- container, 2 -service
+   * 3 - volume, 4 - secret, 5 - stack, 6 - config or 7 - custom template
+   */
+  Type?: PortainerResourceControlType;
+  UserAccesses?: Array<PortainerUserResourceAccess>;
+};
+
+export const PortainerResourceControlType = {
+  /**
+   * _
+   */
+  '': 0,
+  /**
+   * ContainerResourceControl
+   */
+  CONTAINER_RESOURCE_CONTROL: 1,
+  /**
+   * ServiceResourceControl
+   */
+  SERVICE_RESOURCE_CONTROL: 2,
+  /**
+   * VolumeResourceControl
+   */
+  VOLUME_RESOURCE_CONTROL: 3,
+  /**
+   * NetworkResourceControl
+   */
+  NETWORK_RESOURCE_CONTROL: 4,
+  /**
+   * SecretResourceControl
+   */
+  SECRET_RESOURCE_CONTROL: 5,
+  /**
+   * StackResourceControl
+   */
+  STACK_RESOURCE_CONTROL: 6,
+  /**
+   * ConfigResourceControl
+   */
+  CONFIG_RESOURCE_CONTROL: 7,
+  /**
+   * CustomTemplateResourceControl
+   */
+  CUSTOM_TEMPLATE_RESOURCE_CONTROL: 8,
+  /**
+   * ContainerGroupResourceControl
+   */
+  CONTAINER_GROUP_RESOURCE_CONTROL: 9,
+} as const;
+
+export type PortainerResourceControlType =
+  (typeof PortainerResourceControlType)[keyof typeof PortainerResourceControlType];
+
+export type PortainerRole = {
+  /**
+   * Authorizations associated to a role
+   */
+  Authorizations?: PortainerAuthorizations;
+  /**
+   * Role description
+   */
+  Description?: string;
+  /**
+   * Role Identifier
+   */
+  Id?: number;
+  /**
+   * Role name
+   */
+  Name?: string;
+  Priority?: number;
+};
+
+export type PortainerSslSettings = {
+  certPath?: string;
+  httpEnabled?: boolean;
+  keyPath?: string;
+  selfSigned?: boolean;
+};
+
+export type PortainerSettings = {
+  /**
+   * Container environment parameter AGENT_SECRET
+   */
+  AgentSecret?: string;
+  AllowBindMountsForRegularUsers?: boolean;
+  AllowContainerCapabilitiesForRegularUsers?: boolean;
+  AllowDeviceMappingForRegularUsers?: boolean;
+  AllowHostNamespaceForRegularUsers?: boolean;
+  AllowPrivilegedModeForRegularUsers?: boolean;
+  AllowStackManagementForRegularUsers?: boolean;
+  AllowVolumeBrowserForRegularUsers?: boolean;
+  /**
+   * Active authentication method for the Portainer instance. Valid values are: 1 for internal, 2 for LDAP, or 3 for oauth
+   */
+  AuthenticationMethod?: PortainerAuthenticationMethod;
+  /**
+   * A list of label name & value that will be used to hide containers when querying containers
+   */
+  BlackListedLabels?: Array<PortainerPair>;
+  /**
+   * Deprecated fields
+   */
+  DisplayDonationHeader?: boolean;
+  DisplayExternalContributors?: boolean;
+  Edge?: PortainerEdge;
+  /**
+   * The default check in interval for edge agent (in seconds)
+   */
+  EdgeAgentCheckinInterval?: number;
+  /**
+   * EdgePortainerURL is the URL that is exposed to edge agents
+   */
+  EdgePortainerUrl?: string;
+  /**
+   * Whether edge compute features are enabled
+   */
+  EnableEdgeComputeFeatures?: boolean;
+  /**
+   * Deprecated fields v26
+   */
+  EnableHostManagementFeatures?: boolean;
+  /**
+   * EnforceEdgeID makes Portainer store the Edge ID instead of accepting anyone
+   */
+  EnforceEdgeID?: boolean;
+  FeatureFlagSettings?: {
+    [key: string]: boolean;
+  };
+  /**
+   * ForceSecureCookies forces the Secure attribute on auth cookies regardless of detected scheme.
+   * Enable when Portainer runs behind a TLS-terminating proxy.
+   */
+  ForceSecureCookies?: boolean;
+  /**
+   * Deployment options for encouraging git ops workflows
+   */
+  GlobalDeploymentOptions?: PortainerGlobalDeploymentOptions;
+  /**
+   * Helm repository URL, defaults to "https://charts.bitnami.com/bitnami"
+   */
+  HelmRepositoryURL?: string;
+  InternalAuthSettings?: PortainerInternalAuthSettings;
+  IsDockerDesktopExtension?: boolean;
+  /**
+   * The expiry of a Kubeconfig
+   */
+  KubeconfigExpiry?: string;
+  /**
+   * KubectlImage, defaults to portainer/kubectl-shell
+   */
+  KubectlShellImage?: string;
+  LDAPSettings?: PortainerLdapSettings;
+  /**
+   * URL to a logo that will be displayed on the login page as well as on top of the sidebar. Will use default Portainer logo when value is empty string
+   */
+  LogoURL?: string;
+  OAuthSettings?: PortainerOAuthSettings;
+  /**
+   * The interval in which environment(endpoint) snapshots are created
+   */
+  SnapshotInterval?: string;
+  /**
+   * URL to the templates that will be displayed in the UI when navigating to App Templates
+   */
+  TemplatesURL?: string;
+  /**
+   * TrustOnFirstConnect makes Portainer accepting edge agent connection by default
+   */
+  TrustOnFirstConnect?: boolean;
+  /**
+   * The duration of a user session
+   */
+  UserSessionTimeout?: string;
+};
+
+export type PortainerSource = {
+  administratorsOnly?: boolean;
+  git?: GittypesGitSource;
+  helm?: PortainerHelmConfig;
+  id?: number;
+  lastSync?: number;
+  name?: string;
+  ownerID?: number;
+  public?: boolean;
+  registry?: PortainerRegistry;
+  status?: PortainerSourceStatus;
+  statusError?: string;
+  teamAccesses?: Array<number>;
+  type?: PortainerSourceType;
+  userAccesses?: Array<number>;
+};
+
+export const PortainerSourceStatus = {
+  /**
+   * SourceStatusUnknown
+   */
+  SOURCE_STATUS_UNKNOWN: 0,
+  /**
+   * SourceStatusHealthy
+   */
+  SOURCE_STATUS_HEALTHY: 1,
+  /**
+   * SourceStatusError
+   */
+  SOURCE_STATUS_ERROR: 2,
+} as const;
+
+export type PortainerSourceStatus =
+  (typeof PortainerSourceStatus)[keyof typeof PortainerSourceStatus];
+
+export const PortainerSourceType = {
+  /**
+   * _
+   */
+  '': 0,
+  /**
+   * SourceTypeGit
+   */
+  SOURCE_TYPE_GIT: 1,
+  /**
+   * SourceTypeRegistry
+   */
+  SOURCE_TYPE_REGISTRY: 2,
+  /**
+   * SourceTypeHelm
+   */
+  SOURCE_TYPE_HELM: 3,
+} as const;
+
+export type PortainerSourceType =
+  (typeof PortainerSourceType)[keyof typeof PortainerSourceType];
+
+export type PortainerStack = {
+  /**
+   * Only applies when deploying stack with multiple files
+   */
+  AdditionalFiles?: Array<string>;
+  /**
+   * The GitOps update settings of a git stack
+   */
+  AutoUpdate?: PortainerAutoUpdateSettings;
+  /**
+   * The username which created this stack
+   */
+  CreatedBy?: string;
+  /**
+   * The date in unix time when stack was created
+   */
+  CreationDate?: number;
+  /**
+   * CurrentDeploymentInfo records the git repository state at the time of the last actual deployment.
+   */
+  CurrentDeploymentInfo?: PortainerStackDeploymentInfo;
+  /**
+   * DeploymentStartStatus is the stack status captured when the current
+   * deployment starts. It is used by deployment logic during the current
+   * deployment attempt and is cleared/replaced when a new deployment begins.
+   */
+  DeploymentStartStatus?: PortainerStackStatus;
+  /**
+   * DeploymentStatus records the status progression of the current deployment.
+   * Cleared when a new deployment starts.
+   */
+  DeploymentStatus?: Array<PortainerStackDeploymentStatus>;
+  /**
+   * Environment(Endpoint) identifier. Reference the environment(endpoint) that will be used for deployment
+   */
+  EndpointId?: number;
+  /**
+   * EntryPoint is the path to the config file relative to the project root.
+   * NOTE: For git stacks this mirrors GitConfig.ConfigFilePath and the two are kept in sync
+   * by stackUpdateGit. The deploy command builder (compose_unpacker_cmd_builder) uses this
+   * field directly; Kubernetes deploy and git clone operations use GitConfig.ConfigFilePath.
+   */
+  EntryPoint?: string;
+  /**
+   * A list of environment(endpoint) variables used during stack deployment
+   */
+  Env?: Array<PortainerPair>;
+  /**
+   * Whether the stack is from a app template
+   */
+  FromAppTemplate?: boolean;
+  /**
+   * GitConfig is the git repository configuration for git-backed stacks.
+   * Deprecated: loaded from Source via WorkflowID; kept for DB backwards-compatibility only.
+   * Non-migration code must not read or write this field; use Source records instead.
+   */
+  GitConfig?: GittypesRepoConfig;
+  /**
+   * Stack Identifier
+   */
+  Id?: number;
+  /**
+   * Stack name
+   */
+  Name?: string;
+  /**
+   * Kubernetes namespace if stack is a kube application
+   */
+  Namespace?: string;
+  /**
+   * The stack deployment option
+   */
+  Option?: PortainerStackOption;
+  /**
+   * Path on disk to the repository hosting the Stack file
+   */
+  ProjectPath?: string;
+  ResourceControl?: PortainerResourceControl;
+  /**
+   * Stack status (1 - active, 2 - inactive, 3 - deploying, 4 - error)
+   */
+  Status?: PortainerStackStatus;
+  /**
+   * Cluster identifier of the Swarm cluster where the stack is deployed
+   */
+  SwarmId?: string;
+  /**
+   * Stack type. 1 for a Swarm stack, 2 for a Compose stack
+   */
+  Type?: PortainerStackType;
+  /**
+   * The date in unix time when stack was last updated
+   */
+  UpdateDate?: number;
+  /**
+   * The username which last updated this stack
+   */
+  UpdatedBy?: string;
+  /**
+   * WorkflowID is the ID of the Workflow that owns the Source for this stack.
+   */
+  WorkflowID?: number;
+};
+
+export type PortainerStackDeploymentInfo = {
+  /**
+   * AdditionalFiles are the additional files used for deploying the stack
+   */
+  AdditionalFiles?: Array<string>;
+  /**
+   * ConfigFilePath is the path to the config file in the git repository used for deploying the stack
+   */
+  ConfigFilePath?: string;
+  /**
+   * ConfigHash is the commit hash of the git repository used for deploying the stack
+   */
+  ConfigHash?: string;
+  /**
+   * FileVersion is the version of the stack file, used to detect changes
+   */
+  FileVersion?: number;
+  /**
+   * ReferenceName is the git reference (branch/tag) used for deploying the stack
+   */
+  ReferenceName?: string;
+  /**
+   * RepositoryURL is the git repository URL used for deploying the stack
+   */
+  RepositoryURL?: string;
+  /**
+   * SourceID is the Source used for deploying the stack
+   */
+  SourceID?: number;
+  /**
+   * Version is the version of the stack and also is the deployed version in edge agent
+   */
+  Version?: number;
+};
+
+export type PortainerStackDeploymentStatus = {
+  /**
+   * populated on Error entries
+   */
+  Message?: string;
+  Status?: PortainerStackStatus;
+  Time?: number;
+};
+
+export type PortainerStackOption = {
+  /**
+   * Enable atomic rollback on failure (Helm --atomic flag for Kubernetes Helm stacks)
+   */
+  HelmAtomic?: boolean;
+  /**
+   * Prune services that are no longer referenced
+   */
+  Prune?: boolean;
+};
+
+export const PortainerStackStatus = {
+  /**
+   * _
+   */
+  '': 0,
+  /**
+   * StackStatusActive
+   *
+   * 1 - deployed and running
+   */
+  STACK_STATUS_ACTIVE: 1,
+  /**
+   * StackStatusInactive
+   *
+   * 2 - intentionally stopped
+   */
+  STACK_STATUS_INACTIVE: 2,
+  /**
+   * StackStatusDeploying
+   *
+   * 3 - deployment in progress
+   */
+  STACK_STATUS_DEPLOYING: 3,
+  /**
+   * StackStatusError
+   *
+   * 4 - deployment failed
+   */
+  STACK_STATUS_ERROR: 4,
+} as const;
+
+export type PortainerStackStatus =
+  (typeof PortainerStackStatus)[keyof typeof PortainerStackStatus];
+
+export const PortainerStackType = {
+  /**
+   * _
+   */
+  '': 0,
+  /**
+   * DockerSwarmStack
+   */
+  DOCKER_SWARM_STACK: 1,
+  /**
+   * DockerComposeStack
+   */
+  DOCKER_COMPOSE_STACK: 2,
+  /**
+   * KubernetesStack
+   */
+  KUBERNETES_STACK: 3,
+} as const;
+
+export type PortainerStackType =
+  (typeof PortainerStackType)[keyof typeof PortainerStackType];
+
+export type PortainerTlsConfiguration = {
+  /**
+   * Use TLS
+   */
+  TLS: boolean;
+  /**
+   * Path to the TLS CA certificate file
+   */
+  TLSCACert?: string;
+  /**
+   * Path to the TLS client certificate file
+   */
+  TLSCert?: string;
+  /**
+   * Path to the TLS client key file
+   */
+  TLSKey?: string;
+  /**
+   * Skip the verification of the server TLS certificate
+   */
+  TLSSkipVerify: boolean;
+};
+
+export type PortainerTag = {
+  /**
+   * A set of environment(endpoint) group ids that have this tag
+   */
+  EndpointGroups?: {
+    [key: string]: boolean;
+  };
+  /**
+   * A set of environment(endpoint) ids that have this tag
+   */
+  Endpoints?: {
+    [key: string]: boolean;
+  };
+  /**
+   * Tag identifier
+   */
+  ID?: number;
+  /**
+   * Tag name
+   */
+  Name?: string;
+};
+
+export type PortainerTeam = {
+  /**
+   * Team Identifier
+   */
+  Id?: number;
+  /**
+   * Team name
+   */
+  Name?: string;
+};
+
+export type PortainerTeamAccessPolicies = {
+  [key: string]: PortainerAccessPolicy;
+};
+
+export type PortainerTeamMembership = {
+  /**
+   * Membership Identifier
+   */
+  Id?: number;
+  /**
+   * Team role (1 for team leader and 2 for team member)
+   */
+  Role?: PortainerMembershipRole;
+  /**
+   * Team identifier
+   */
+  TeamID?: number;
+  /**
+   * User identifier
+   */
+  UserID?: number;
+};
+
+export type PortainerTeamResourceAccess = {
+  AccessLevel?: PortainerResourceAccessLevel;
+  TeamId?: number;
+};
+
+export type PortainerTemplate = {
+  /**
+   * Whether the template should be available to administrators only
+   */
+  administrator_only?: boolean;
+  /**
+   * A list of categories associated to the template
+   */
+  categories?: Array<string>;
+  /**
+   * The command that will be executed in a container template
+   */
+  command?: string;
+  /**
+   * Description of the template
+   */
+  description?: string;
+  /**
+   * A list of environment(endpoint) variables used during the template deployment
+   */
+  env?: Array<PortainerTemplateEnv>;
+  /**
+   * Container hostname
+   */
+  hostname?: string;
+  /**
+   * Mandatory container/stack fields
+   * Template Identifier
+   */
+  id?: number;
+  /**
+   * Mandatory container fields
+   * Image associated to a container template. Mandatory for a container template
+   */
+  image?: string;
+  /**
+   * Whether the container should be started in
+   * interactive mode (-i -t equivalent on the CLI)
+   */
+  interactive?: boolean;
+  /**
+   * Container labels
+   */
+  labels?: Array<PortainerPair>;
+  /**
+   * URL of the template's logo
+   */
+  logo?: string;
+  /**
+   * Optional stack/container fields
+   * Default name for the stack/container to be used on deployment
+   */
+  name?: string;
+  /**
+   * Name of a network that will be used on container deployment if it exists inside the environment(endpoint)
+   */
+  network?: string;
+  /**
+   * A note that will be displayed in the UI. Supports HTML content
+   */
+  note?: string;
+  /**
+   * Platform associated to the template.
+   * Valid values are: 'linux', 'windows' or leave empty for multi-platform
+   */
+  platform?: string;
+  /**
+   * A list of ports exposed by the container
+   */
+  ports?: Array<string>;
+  /**
+   * Whether the container should be started in privileged mode
+   */
+  privileged?: boolean;
+  /**
+   * Optional container fields
+   * The URL of a registry associated to the image for a container template
+   */
+  registry?: string;
+  /**
+   * Mandatory stack fields
+   */
+  repository?: PortainerTemplateRepository;
+  /**
+   * Container restart policy
+   */
+  restart_policy?: string;
+  /**
+   * Mandatory Edge stack fields
+   * Stack file used for this template
+   */
+  stackFile?: string;
+  /**
+   * Title of the template
+   */
+  title?: string;
+  /**
+   * Template type. Valid values are: 1 (container), 2 (Swarm stack), 3 (Compose stack), 4 (Compose edge stack)
+   */
+  type?: PortainerTemplateType;
+  /**
+   * A list of volumes used during the container template deployment
+   */
+  volumes?: Array<PortainerTemplateVolume>;
+};
+
+export type PortainerTemplateEnv = {
+  /**
+   * Default value that will be set for the variable
+   */
+  default?: string;
+  /**
+   * Content of the tooltip that will be generated in the UI
+   */
+  description?: string;
+  /**
+   * Text for the label that will be generated in the UI
+   */
+  label?: string;
+  /**
+   * name of the environment(endpoint) variable
+   */
+  name?: string;
+  /**
+   * If set to true, will not generate any input for this variable in the UI
+   */
+  preset?: boolean;
+  /**
+   * A list of name/value that will be used to generate a dropdown in the UI
+   */
+  select?: Array<PortainerTemplateEnvSelect>;
+};
+
+export type PortainerTemplateEnvSelect = {
+  /**
+   * Will set this choice as the default choice
+   */
+  default?: boolean;
+  /**
+   * Some text that will displayed as a choice
+   */
+  text?: string;
+  /**
+   * A value that will be associated to the choice
+   */
+  value?: string;
+};
+
+export type PortainerTemplateRepository = {
+  /**
+   * Path to the stack file inside the git repository
+   */
+  stackfile?: string;
+  /**
+   * URL of a git repository used to deploy a stack template. Mandatory for a Swarm/Compose stack template
+   */
+  url?: string;
+};
+
+export const PortainerTemplateType = {
+  /**
+   * _
+   */
+  '': 0,
+  /**
+   * ContainerTemplate
+   */
+  CONTAINER_TEMPLATE: 1,
+  /**
+   * SwarmStackTemplate
+   */
+  SWARM_STACK_TEMPLATE: 2,
+  /**
+   * ComposeStackTemplate
+   */
+  COMPOSE_STACK_TEMPLATE: 3,
+} as const;
+
+export type PortainerTemplateType =
+  (typeof PortainerTemplateType)[keyof typeof PortainerTemplateType];
+
+export type PortainerTemplateVolume = {
+  /**
+   * Path on the host
+   */
+  bind?: string;
+  /**
+   * Path inside the container
+   */
+  container?: string;
+  /**
+   * Whether the volume used should be readonly
+   */
+  readonly?: boolean;
+};
+
+export type PortainerUser = {
+  /**
+   * User Identifier
+   */
+  Id: number;
+  /**
+   * User role (1 for administrator account and 2 for regular account)
+   */
+  Role: PortainerUserRole;
+  ThemeSettings?: PortainerUserThemeSettings;
+  TokenIssueAt?: number;
+  UseCache?: boolean;
+  Username: string;
+};
+
+export type PortainerUserAccessPolicies = {
+  [key: string]: PortainerAccessPolicy;
+};
+
+export type PortainerUserResourceAccess = {
+  AccessLevel?: PortainerResourceAccessLevel;
+  UserId?: number;
+};
+
+export const PortainerUserRole = {
+  /**
+   * _
+   */
+  '': 0,
+  /**
+   * AdministratorRole
+   */
+  ADMINISTRATOR_ROLE: 1,
+  /**
+   * StandardUserRole
+   */
+  STANDARD_USER_ROLE: 2,
+} as const;
+
+export type PortainerUserRole =
+  (typeof PortainerUserRole)[keyof typeof PortainerUserRole];
+
+export type PortainerUserThemeSettings = {
+  /**
+   * Color represents the color theme of the UI
+   */
+  color?: 'dark' | 'light' | 'highcontrast' | 'auto' | '';
+};
+
+export type PortainerWebhook = {
+  EndpointId?: number;
+  /**
+   * Webhook Identifier
+   */
+  Id?: number;
+  RegistryId?: number;
+  ResourceId?: string;
+  Token?: string;
+  /**
+   * Type of webhook (1 - service)
+   */
+  Type?: PortainerWebhookType;
+};
+
+export const PortainerWebhookType = {
+  /**
+   * _
+   */
+  '': 0 /**
+   * ServiceWebhook
+   */,
+  SERVICE_WEBHOOK: 1,
+} as const;
+
+export type PortainerWebhookType =
+  (typeof PortainerWebhookType)[keyof typeof PortainerWebhookType];
+
+export type RegistriesRegistryConfigurePayload = {
+  /**
+   * Is authentication against this registry enabled
+   */
+  Authentication: boolean;
+  /**
+   * Password used to authenticate against this registry. required when Authentication is true
+   */
+  Password?: string;
+  /**
+   * ECR region
+   */
+  Region?: string;
+  /**
+   * Use TLS
+   */
+  TLS?: boolean;
+  /**
+   * The TLS CA certificate file
+   */
+  TLSCACertFile?: Array<number>;
+  /**
+   * The TLS client certificate file
+   */
+  TLSCertFile?: Array<number>;
+  /**
+   * The TLS client key file
+   */
+  TLSKeyFile?: Array<number>;
+  /**
+   * Skip the verification of the server TLS certificate
+   */
+  TLSSkipVerify?: boolean;
+  /**
+   * Username used to authenticate against this registry. Required when Authentication is true
+   */
+  Username?: string;
+};
+
+export type RegistriesRegistryCreatePayload = {
+  /**
+   * Is authentication against this registry enabled
+   */
+  Authentication: boolean;
+  /**
+   * BaseURL required for ProGet registry
+   */
+  BaseURL?: string;
+  /**
+   * ECR specific details, required when type = 7
+   */
+  Ecr?: PortainerEcrData;
+  /**
+   * Gitlab specific details, required when type = 4
+   */
+  Gitlab?: PortainerGitlabRegistryData;
+  /**
+   * Name that will be used to identify this registry
+   */
+  Name: string;
+  /**
+   * Password used to authenticate against this registry. required when Authentication is true
+   */
+  Password?: string;
+  /**
+   * Quay specific details, required when type = 1
+   */
+  Quay?: PortainerQuayRegistryData;
+  /**
+   * Use TLS
+   */
+  TLS?: boolean;
+  /**
+   * Registry Type. Valid values are:
+   * 1 (Quay.io),
+   * 2 (Azure container registry),
+   * 3 (custom registry),
+   * 4 (Gitlab registry),
+   * 5 (ProGet registry),
+   * 6 (DockerHub)
+   * 7 (ECR)
+   */
+  Type: 1 | 2 | 3 | 4 | 5 | 6 | 7;
+  /**
+   * URL or IP address of the Docker registry
+   */
+  URL: string;
+  /**
+   * Username used to authenticate against this registry. Required when Authentication is true
+   */
+  Username?: string;
+};
+
+export type RegistriesRegistryPingPayload = {
+  /**
+   * Password used to authenticate against this registry
+   */
+  Password?: string;
+  /**
+   * Use TLS
+   */
+  TLS?: boolean;
+  /**
+   * Registry Type. Valid values are:
+   * 1 (Quay.io),
+   * 2 (Azure container registry),
+   * 3 (custom registry),
+   * 4 (Gitlab registry),
+   * 5 (ProGet registry),
+   * 6 (DockerHub)
+   * 7 (ECR)
+   * 8 (Github registry)
+   */
+  Type: 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8;
+  /**
+   * URL or IP address of the Docker registry
+   */
+  URL: string;
+  /**
+   * Username used to authenticate against this registry
+   */
+  Username?: string;
+};
+
+export type RegistriesRegistryPingResponse = {
+  /**
+   * Message provides details about the connection test result
+   */
+  message?: string;
+  /**
+   * Success indicates if the registry connection was successful
+   */
+  success?: boolean;
+};
+
+export type RegistriesRegistryUpdatePayload = {
+  /**
+   * Is authentication against this registry enabled
+   */
+  Authentication: boolean;
+  /**
+   * BaseURL is used for quay registry
+   */
+  BaseURL?: string;
+  /**
+   * ECR data
+   */
+  Ecr?: PortainerEcrData;
+  /**
+   * Name that will be used to identify this registry
+   */
+  Name: string;
+  /**
+   * Password used to authenticate against this registry. required when Authentication is true
+   */
+  Password?: string;
+  /**
+   * Quay data
+   */
+  Quay?: PortainerQuayRegistryData;
+  /**
+   * Registry access control
+   */
+  RegistryAccesses?: PortainerRegistryAccesses;
+  /**
+   * URL or IP address of the Docker registry
+   */
+  URL: string;
+  /**
+   * Username used to authenticate against this registry. Required when Authentication is true
+   */
+  Username?: string;
+};
+
+export type ReleaseChart = {
+  /**
+   * Files are miscellaneous files in a chart archive,
+   * e.g. README, LICENSE, etc.
+   */
+  files?: Array<ReleaseFile>;
+  /**
+   * Lock is the contents of Chart.lock.
+   */
+  lock?: ReleaseLock;
+  /**
+   * Metadata is the contents of the Chartfile.
+   */
+  metadata?: ReleaseMetadata;
+  /**
+   * Schema is an optional JSON schema for imposing structure on Values
+   */
+  schema?: Array<number>;
+  /**
+   * Templates for this chart.
+   */
+  templates?: Array<ReleaseFile>;
+  /**
+   * Values are default config for this chart.
+   */
+  values?: {
+    [key: string]: unknown;
+  };
+};
+
+export type ReleaseChartReference = {
+  chartPath?: string;
+  registryID?: number;
+  repoURL?: string;
+};
+
+export type ReleaseDependency = {
+  /**
+   * Alias usable alias to be used for the chart
+   */
+  alias?: string;
+  /**
+   * A yaml path that resolves to a boolean, used for enabling/disabling charts (e.g. subchart1.enabled )
+   */
+  condition?: string;
+  /**
+   * Enabled bool determines if chart should be loaded
+   */
+  enabled?: boolean;
+  /**
+   * ImportValues holds the mapping of source values to parent key to be imported. Each item can be a
+   * string or pair of child/parent sublist items.
+   */
+  'import-values'?: Array<unknown>;
+  /**
+   * Name is the name of the dependency.
+   *
+   * This must mach the name in the dependency's Chart.yaml.
+   */
+  name?: string;
+  /**
+   * The URL to the repository.
+   *
+   * Appending `index.yaml` to this string should result in a URL that can be
+   * used to fetch the repository index.
+   */
+  repository?: string;
+  /**
+   * Tags can be used to group charts for enabling/disabling together
+   */
+  tags?: Array<string>;
+  /**
+   * Version is the version (range) of this chart.
+   *
+   * A lock file will always produce a single version, while a dependency
+   * may contain a semantic version range.
+   */
+  version?: string;
+};
+
+export type ReleaseFile = {
+  /**
+   * Data is the template as byte data.
+   */
+  data?: Array<number>;
+  /**
+   * Name is the path-like name of the template.
+   */
+  name?: string;
+};
+
+export type ReleaseHookExecution = {
+  /**
+   * CompletedAt indicates the date/time this hook was completed.
+   */
+  completed_at?: string;
+  /**
+   * Phase indicates whether the hook completed successfully
+   */
+  phase?: string;
+  /**
+   * StartedAt indicates the date/time this hook was started
+   */
+  started_at?: string;
+};
+
+export type ReleaseInfo = {
+  /**
+   * Deleted tracks when this object was deleted.
+   */
+  deleted?: string;
+  /**
+   * Description is human-friendly "log entry" about this release.
+   */
+  description?: string;
+  /**
+   * FirstDeployed is when the release was first deployed.
+   */
+  first_deployed?: string;
+  /**
+   * LastDeployed is when the release was last deployed.
+   */
+  last_deployed?: string;
+  /**
+   * Contains the rendered templates/NOTES.txt if available
+   */
+  notes?: string;
+  /**
+   * Resources is the list of resources that are part of the release
+   */
+  resources?: Array<UnstructuredUnstructured>;
+  /**
+   * Status is the current state of the release
+   */
+  status?: string;
+};
+
+export type ReleaseLock = {
+  /**
+   * Dependencies is the list of dependencies that this lock file has locked.
+   */
+  dependencies?: Array<ReleaseDependency>;
+  /**
+   * Digest is a hash of the dependencies in Chart.yaml.
+   */
+  digest?: string;
+  /**
+   * Generated is the date the lock file was last generated.
+   */
+  generated?: string;
+};
+
+export type ReleaseMaintainer = {
+  /**
+   * Email is an optional email address to contact the named maintainer
+   */
+  email?: string;
+  /**
+   * Name is a user name or organization name
+   */
+  name?: string;
+  /**
+   * URL is an optional URL to an address for the named maintainer
+   */
+  url?: string;
+};
+
+export type ReleaseMetadata = {
+  /**
+   * Annotations are additional mappings uninterpreted by Helm,
+   * made available for inspection by other applications.
+   */
+  annotations?: {
+    [key: string]: string;
+  };
+  /**
+   * The API Version of this chart. Required.
+   */
+  apiVersion?: string;
+  /**
+   * The version of the application enclosed inside of this chart.
+   */
+  appVersion?: string;
+  /**
+   * The condition to check to enable chart
+   */
+  condition?: string;
+  /**
+   * Dependencies are a list of dependencies for a chart.
+   */
+  dependencies?: Array<ReleaseDependency>;
+  /**
+   * Whether or not this chart is deprecated
+   */
+  deprecated?: boolean;
+  /**
+   * A one-sentence description of the chart
+   */
+  description?: string;
+  /**
+   * The URL to a relevant project page, git repo, or contact person
+   */
+  home?: string;
+  /**
+   * The URL to an icon file.
+   */
+  icon?: string;
+  /**
+   * A list of string keywords
+   */
+  keywords?: Array<string>;
+  /**
+   * KubeVersion is a SemVer constraint specifying the version of Kubernetes required.
+   */
+  kubeVersion?: string;
+  /**
+   * A list of name and URL/email address combinations for the maintainer(s)
+   */
+  maintainers?: Array<ReleaseMaintainer>;
+  /**
+   * The name of the chart. Required.
+   */
+  name?: string;
+  /**
+   * Source is the URL to the source code of this chart
+   */
+  sources?: Array<string>;
+  /**
+   * The tags to check to enable chart
+   */
+  tags?: string;
+  /**
+   * Specifies the chart type: application or library
+   */
+  type?: string;
+  /**
+   * A SemVer 2 conformant version string of the chart. Required.
+   */
+  version?: string;
+};
+
+export type ReleaseRelease = {
+  /**
+   * AppVersion is the app version of the release.
+   */
+  appVersion?: string;
+  /**
+   * Chart is the chart that was released.
+   */
+  chart?: ReleaseChart;
+  /**
+   * ChartReference are the labels that are used to identify the chart source.
+   */
+  chartReference?: ReleaseChartReference;
+  /**
+   * Config is the set of extra Values added to the chart.
+   * These values override the default values inside of the chart.
+   */
+  config?: {
+    [key: string]: unknown;
+  };
+  /**
+   * Hooks are all of the hooks declared for this release.
+   */
+  hooks?: Array<GithubComPortainerPortainerPkgLibhelmReleaseHook>;
+  /**
+   * Info provides information about a release
+   */
+  info?: ReleaseInfo;
+  /**
+   * Manifest is the string representation of the rendered template.
+   */
+  manifest?: string;
+  /**
+   * Name is the name of the release
+   */
+  name?: string;
+  /**
+   * Namespace is the kubernetes namespace of the release.
+   */
+  namespace?: string;
+  /**
+   * StackID is the ID of the Portainer stack associated with this release (if using GitOps)
+   */
+  stackID?: number;
+  /**
+   * Values are the values used to deploy the chart.
+   */
+  values?: ReleaseValues;
+  /**
+   * Version is an int which represents the revision of the release.
+   */
+  version?: number;
+};
+
+export type ReleaseReleaseElement = {
+  appVersion?: string;
+  chart?: string;
+  name?: string;
+  namespace?: string;
+  revision?: string;
+  status?: string;
+  updated?: string;
+};
+
+export type ReleaseValues = {
+  computedValues?: string;
+  userSuppliedValues?: string;
+};
+
+export type ResourceQuantity = {
+  Format?: 'DecimalExponent' | 'BinarySI' | 'DecimalSI';
+};
+
+export type ResourcecontrolsResourceControlCreatePayload = {
+  /**
+   * Permit access to resource only to admins
+   */
+  AdministratorsOnly?: boolean;
+  /**
+   * Permit access to the associated resource to any user
+   */
+  Public?: boolean;
+  ResourceID: string;
+  /**
+   * List of Docker resources that will inherit this access control
+   */
+  SubResourceIDs?: Array<string>;
+  /**
+   * List of team identifiers with access to the associated resource
+   */
+  Teams?: Array<number>;
+  /**
+   * Type of Resource. Valid values are: 1 - container, 2 - service
+   * 3 - volume, 4 - network, 5 - secret, 6 - stack, 7 - config, 8 - custom template, 9 - azure-container-group
+   */
+  Type: 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9;
+  /**
+   * List of user identifiers with access to the associated resource
+   */
+  Users?: Array<number>;
+};
+
+export type ResourcecontrolsResourceControlUpdatePayload = {
+  /**
+   * Permit access to resource only to admins
+   */
+  AdministratorsOnly?: boolean;
+  /**
+   * Permit access to the associated resource to any user
+   */
+  Public?: boolean;
+  /**
+   * List of team identifiers with access to the associated resource
+   */
+  Teams?: Array<number>;
+  /**
+   * List of user identifiers with access to the associated resource
+   */
+  Users?: Array<number>;
+};
+
+export type RoarRoarPortainerEndpointId = {
+  [key: string]: unknown;
+};
+
+export type SettingsPublicSettingsResponse = {
+  /**
+   * Active authentication method for the Portainer instance. Valid values are: 1 for internal, 2 for LDAP, or 3 for oauth
+   */
+  AuthenticationMethod?: PortainerAuthenticationMethod;
+  Edge?: {
+    /**
+     * The check in interval for edge agent (in seconds) - used in non async mode [seconds]
+     */
+    CheckinInterval?: number;
+    /**
+     * The command list interval for edge agent - used in edge async mode [seconds]
+     */
+    CommandInterval?: number;
+    /**
+     * The ping interval for edge agent - used in edge async mode [seconds]
+     */
+    PingInterval?: number;
+    /**
+     * The snapshot interval for edge agent - used in edge async mode [seconds]
+     */
+    SnapshotInterval?: number;
+  };
+  /**
+   * Whether edge compute features are enabled
+   */
+  EnableEdgeComputeFeatures?: boolean;
+  /**
+   * Supported feature flags
+   */
+  Features?: {
+    [key: string]: boolean;
+  };
+  /**
+   * Deployment options for encouraging deployment as code
+   */
+  GlobalDeploymentOptions?: PortainerGlobalDeploymentOptions;
+  IsDockerDesktopExtension?: boolean;
+  /**
+   * The expiry of a Kubeconfig
+   */
+  KubeconfigExpiry?: string;
+  /**
+   * URL to a logo that will be displayed on the login page as well as on top of the sidebar. Will use default Portainer logo when value is empty string
+   */
+  LogoURL?: string;
+  /**
+   * The URL used for oauth login
+   */
+  OAuthLoginURI?: string;
+  /**
+   * The URL used for oauth logout
+   */
+  OAuthLogoutURI?: string;
+  /**
+   * The minimum required length for a password of any user when using internal auth mode
+   */
+  RequiredPasswordLength?: number;
+  /**
+   * Whether the setup wizard must send the X-Setup-Token header for admin init / restore
+   */
+  RequiresSetupToken?: boolean;
+  /**
+   * Whether team sync is enabled
+   */
+  TeamSync?: boolean;
+};
+
+export type SettingsSettingsUpdatePayload = {
+  /**
+   * Active authentication method for the Portainer instance. Valid values are: 1 for internal, 2 for LDAP, or 3 for oauth
+   */
+  AuthenticationMethod?: number;
+  /**
+   * A list of label name & value that will be used to hide containers when querying containers
+   */
+  BlackListedLabels?: Array<PortainerPair>;
+  EdgeAgentCheckinInterval?: number;
+  /**
+   * EdgePortainerURL is the URL that is exposed to edge agents
+   */
+  EdgePortainerURL?: string;
+  /**
+   * Whether edge compute features are enabled
+   */
+  EnableEdgeComputeFeatures?: boolean;
+  /**
+   * EnforceEdgeID makes Portainer store the Edge ID instead of accepting anyone
+   */
+  EnforceEdgeID?: boolean;
+  /**
+   * ForceSecureCookies forces the Secure attribute on auth cookies regardless of the detected scheme
+   */
+  ForceSecureCookies?: boolean;
+  /**
+   * Deployment options for encouraging deployment as code
+   */
+  GlobalDeploymentOptions?: PortainerGlobalDeploymentOptions;
+  /**
+   * Helm repository URL
+   */
+  HelmRepositoryURL?: string;
+  InternalAuthSettings?: PortainerInternalAuthSettings;
+  /**
+   * The expiry of a Kubeconfig
+   */
+  KubeconfigExpiry?: string;
+  /**
+   * Kubectl Shell Image
+   */
+  KubectlShellImage?: string;
+  LDAPSettings?: PortainerLdapSettings;
+  /**
+   * URL to a logo that will be displayed on the login page as well as on top of the sidebar. Will use default Portainer logo when value is empty string
+   */
+  LogoURL?: string;
+  OAuthSettings?: PortainerOAuthSettings;
+  /**
+   * The interval in which environment(endpoint) snapshots are created
+   */
+  SnapshotInterval?: string;
+  /**
+   * URL to the templates that will be displayed in the UI when navigating to App Templates
+   */
+  TemplatesURL?: string;
+  /**
+   * TrustOnFirstConnect makes Portainer accepting edge agent connection by default
+   */
+  TrustOnFirstConnect?: boolean;
+  /**
+   * The duration of a user session
+   */
+  UserSessionTimeout?: string;
+};
+
+export type SourcesAutoUpdateInfo = {
+  fetchInterval?: string;
+  mechanism?: string;
+};
+
+export type SourcesConnectionTestResult = {
+  error?: string;
+  success?: boolean;
+};
+
+export type SourcesGitAuthenticationPayload = {
+  password?: string;
+  username?: string;
+};
+
+export type SourcesGitAuthenticationUpdatePayload = {
+  password?: string;
+  username?: string;
+};
+
+export type SourcesGitSourceCreatePayload = {
+  administratorsOnly?: boolean;
+  authentication?: SourcesGitAuthenticationPayload;
+  name?: string;
+  public?: boolean;
+  teamAccesses?: Array<number>;
+  tlsSkipVerify?: boolean;
+  url: string;
+  userAccesses?: Array<number>;
+};
+
+export type SourcesGitSourceUpdatePayload = {
+  authentication?: SourcesGitAuthenticationUpdatePayload;
+  name?: string;
+  tlsSkipVerify?: boolean;
+  url?: string;
+};
+
+export type SourcesSource = {
+  environments?: number;
+  error?: string;
+  id: number;
+  lastSync?: number;
+  name: string;
+  status: WorkflowsStatus;
+  type: SourcesSourceType;
+  url: string;
+  usedBy?: number;
+};
+
+export type SourcesSourceAccess = {
+  public?: boolean;
+  teams?: Array<number>;
+  users?: Array<number>;
+};
+
+export type SourcesSourceAccessUpdatePayload = {
+  public?: boolean;
+  teams?: Array<number>;
+  users?: Array<number>;
+};
+
+export type SourcesSourceDetail = {
+  access?: SourcesSourceAccess;
+  autoUpdate?: SourcesAutoUpdateInfo;
+  connection: SourcesConnectionInfo;
+  environments?: number;
+  error?: string;
+  id: number;
+  lastSync?: number;
+  name: string;
+  status: WorkflowsStatus;
+  type: SourcesSourceType;
+  url: string;
+  usedBy?: number;
+  workflows?: Array<WorkflowsWorkflow>;
+};
+
+export const SourcesSourceType = {
+  /**
+   * SourceTypeGit
+   */
+  SOURCE_TYPE_GIT: 'git',
+  /**
+   * SourceTypeHelm
+   */
+  SOURCE_TYPE_HELM: 'helm',
+  /**
+   * SourceTypeOCI
+   */
+  SOURCE_TYPE_OCI: 'oci',
+} as const;
+
+export type SourcesSourceType =
+  (typeof SourcesSourceType)[keyof typeof SourcesSourceType];
+
+export const SourcesStatus = {
+  /**
+   * SourceStatusUnknown
+   */
+  SOURCE_STATUS_UNKNOWN: 'unknown',
+  /**
+   * SourceStatusHealthy
+   */
+  SOURCE_STATUS_HEALTHY: 'healthy',
+  /**
+   * SourceStatusError
+   */
+  SOURCE_STATUS_ERROR: 'error',
+} as const;
+
+export type SourcesStatus = (typeof SourcesStatus)[keyof typeof SourcesStatus];
+
+export type SourcesConnectionInfo = {
+  authentication?: SourcesGitAuthInfo;
+  tlsSkipVerify?: boolean;
+};
+
+export type SourcesGitAuthInfo = {
+  username?: string;
+};
+
+export type SslSslUpdatePayload = {
+  /**
+   * SSL Certificates
+   */
+  Cert?: string;
+  HTTPEnabled?: boolean;
+  Key?: string;
+};
+
+export type StacksComposeStackFromFileContentPayload = {
+  /**
+   * A list of environment variables used during stack deployment
+   */
+  Env?: Array<PortainerPair>;
+  /**
+   * Whether the stack is from a app template
+   */
+  FromAppTemplate?: boolean;
+  /**
+   * Name of the stack
+   */
+  Name: string;
+  /**
+   * Content of the Stack file
+   */
+  StackFileContent: string;
+};
+
+export type StacksComposeStackFromGitRepositoryPayload = {
+  /**
+   * Applicable when deploying with multiple stack files
+   */
+  AdditionalFiles?: Array<string>;
+  /**
+   * Optional GitOps update configuration
+   */
+  AutoUpdate?: PortainerAutoUpdateSettings;
+  /**
+   * Path to the Stack file inside the Git repository
+   */
+  ComposeFile?: string;
+  /**
+   * A list of environment variables used during stack deployment
+   */
+  Env?: Array<PortainerPair>;
+  /**
+   * Whether the stack is from a app template
+   */
+  FromAppTemplate?: boolean;
+  /**
+   * Name of the stack
+   */
+  Name: string;
+  /**
+   * Deprecated: use SourceID instead. Use basic authentication to clone the Git repository.
+   */
+  RepositoryAuthentication?: boolean;
+  /**
+   * Deprecated: use SourceID instead. Password used in basic authentication.
+   */
+  RepositoryPassword?: string;
+  /**
+   * Reference name of a Git repository hosting the Stack file
+   */
+  RepositoryReferenceName?: string;
+  /**
+   * Deprecated: use SourceID instead. URL of a Git repository hosting the Stack file.
+   */
+  RepositoryURL?: string;
+  /**
+   * Deprecated: use SourceID instead. Username used in basic authentication.
+   */
+  RepositoryUsername?: string;
+  /**
+   * SourceID references an existing Source for git credentials/URL.
+   * When set, the inline URL and authentication fields are ignored.
+   */
+  SourceID?: number;
+  /**
+   * Deprecated: use SourceID instead. TLSSkipVerify skips SSL verification when cloning the Git repository.
+   */
+  TLSSkipVerify?: boolean;
+};
+
+export type StacksKubernetesGitDeploymentPayload = {
+  AdditionalFiles?: Array<string>;
+  AutoUpdate?: PortainerAutoUpdateSettings;
+  ComposeFormat?: boolean;
+  ManifestFile?: string;
+  Namespace?: string;
+  /**
+   * Deprecated: use SourceID instead. Use basic authentication to clone the Git repository.
+   */
+  RepositoryAuthentication?: boolean;
+  /**
+   * Deprecated: use SourceID instead. Password used in basic authentication.
+   */
+  RepositoryPassword?: string;
+  /**
+   * Deprecated: use SourceID instead. Reference name of a Git repository hosting the Stack file.
+   */
+  RepositoryReferenceName?: string;
+  /**
+   * Deprecated: use SourceID instead. URL of a Git repository hosting the Stack file.
+   */
+  RepositoryURL?: string;
+  /**
+   * Deprecated: use SourceID instead. Username used in basic authentication.
+   */
+  RepositoryUsername?: string;
+  /**
+   * SourceID references an existing Source for git credentials/URL.
+   * When set, the inline URL and authentication fields are ignored.
+   */
+  SourceID?: number;
+  StackName?: string;
+  /**
+   * Deprecated: use SourceID instead. TLSSkipVerify skips SSL verification when cloning the Git repository.
+   */
+  TLSSkipVerify?: boolean;
+};
+
+export type StacksKubernetesManifestUrlDeploymentPayload = {
+  ComposeFormat?: boolean;
+  ManifestURL?: string;
+  Namespace?: string;
+  StackName?: string;
+};
+
+export type StacksKubernetesStringDeploymentPayload = {
+  ComposeFormat?: boolean;
+  /**
+   * Whether the stack is from a app template
+   */
+  FromAppTemplate?: boolean;
+  Namespace?: string;
+  StackFileContent?: string;
+  StackName?: string;
+};
+
+export type StacksStackFileResponse = {
+  /**
+   * Content of the Stack file
+   */
+  StackFileContent?: string;
+};
+
+export type StacksStackGitRedeployPayload = {
+  Env?: Array<PortainerPair>;
+  Prune?: boolean;
+  /**
+   * Deprecated(2.36): use RepullImageAndRedeploy instead for cleaner responsibility
+   * Force a pulling to current image with the original tag though the image is already the latest
+   */
+  PullImage?: boolean;
+  /**
+   * When true and RepositoryPassword is non-empty, stored credentials are replaced.
+   */
+  RepositoryAuthentication?: boolean;
+  /**
+   * Non-empty value (with RepositoryAuthentication=true) replaces stored credentials; leave blank to keep them.
+   */
+  RepositoryPassword?: string;
+  RepositoryReferenceName?: string;
+  RepositoryUsername?: string;
+  /**
+   * RepullImageAndRedeploy indicates whether to force repulling images and redeploying the stack
+   */
+  RepullImageAndRedeploy?: boolean;
+  StackName?: string;
+};
+
+export type StacksStackGitUpdatePayload = {
+  AdditionalFiles?: Array<string>;
+  AutoUpdate?: PortainerAutoUpdateSettings;
+  ConfigFilePath?: string;
+  Env?: Array<PortainerPair>;
+  Prune?: boolean;
+  /**
+   * Deprecated: use SourceID instead. Use basic authentication to clone the Git repository.
+   */
+  RepositoryAuthentication?: boolean;
+  /**
+   * Deprecated: use SourceID instead. Password used in basic authentication.
+   */
+  RepositoryPassword?: string;
+  RepositoryReferenceName?: string;
+  /**
+   * Deprecated: use SourceID instead. URL of a Git repository hosting the Stack file.
+   */
+  RepositoryURL?: string;
+  /**
+   * Deprecated: use SourceID instead. Username used in basic authentication.
+   */
+  RepositoryUsername?: string;
+  /**
+   * SourceID references an existing Source for git credentials/URL.
+   * When set, the inline URL and authentication fields are ignored.
+   */
+  SourceID?: number;
+  /**
+   * Deprecated: use SourceID instead. Skip TLS verification when cloning the Git repository.
+   */
+  TLSSkipVerify?: boolean;
+};
+
+export type StacksStackMigratePayload = {
+  /**
+   * Environment(Endpoint) identifier of the target environment(endpoint) where the stack will be relocated
+   */
+  EndpointID: number;
+  /**
+   * If provided will rename the migrated stack
+   */
+  Name?: string;
+  /**
+   * Swarm cluster identifier, must match the identifier of the cluster where the stack will be relocated
+   */
+  SwarmID?: string;
+};
+
+export type StacksStackResponse = {
+  /**
+   * Only applies when deploying stack with multiple files
+   */
+  AdditionalFiles?: Array<string>;
+  /**
+   * The GitOps update settings of a git stack
+   */
+  AutoUpdate?: PortainerAutoUpdateSettings;
+  /**
+   * The username which created this stack
+   */
+  CreatedBy?: string;
+  /**
+   * The date in unix time when stack was created
+   */
+  CreationDate?: number;
+  /**
+   * CurrentDeploymentInfo records the git repository state at the time of the last actual deployment.
+   */
+  CurrentDeploymentInfo?: PortainerStackDeploymentInfo;
+  /**
+   * DeploymentStartStatus is the stack status captured when the current
+   * deployment starts. It is used by deployment logic during the current
+   * deployment attempt and is cleared/replaced when a new deployment begins.
+   */
+  DeploymentStartStatus?: PortainerStackStatus;
+  /**
+   * DeploymentStatus records the status progression of the current deployment.
+   * Cleared when a new deployment starts.
+   */
+  DeploymentStatus?: Array<PortainerStackDeploymentStatus>;
+  /**
+   * Environment(Endpoint) identifier. Reference the environment(endpoint) that will be used for deployment
+   */
+  EndpointId?: number;
+  /**
+   * EntryPoint is the path to the config file relative to the project root.
+   * NOTE: For git stacks this mirrors GitConfig.ConfigFilePath and the two are kept in sync
+   * by stackUpdateGit. The deploy command builder (compose_unpacker_cmd_builder) uses this
+   * field directly; Kubernetes deploy and git clone operations use GitConfig.ConfigFilePath.
+   */
+  EntryPoint?: string;
+  /**
+   * A list of environment(endpoint) variables used during stack deployment
+   */
+  Env?: Array<PortainerPair>;
+  /**
+   * Whether the stack is from a app template
+   */
+  FromAppTemplate?: boolean;
+  /**
+   * GitConfig is the git repository configuration for git-backed stacks.
+   * Deprecated: loaded from Source via WorkflowID; kept for DB backwards-compatibility only.
+   * Non-migration code must not read or write this field; use Source records instead.
+   */
+  GitConfig?: GittypesRepoConfig;
+  GitSourceId?: number;
+  /**
+   * Stack Identifier
+   */
+  Id?: number;
+  /**
+   * Stack name
+   */
+  Name?: string;
+  /**
+   * Kubernetes namespace if stack is a kube application
+   */
+  Namespace?: string;
+  /**
+   * The stack deployment option
+   */
+  Option?: PortainerStackOption;
+  /**
+   * Path on disk to the repository hosting the Stack file
+   */
+  ProjectPath?: string;
+  ResourceControl?: PortainerResourceControl;
+  /**
+   * Stack status (1 - active, 2 - inactive, 3 - deploying, 4 - error)
+   */
+  Status?: PortainerStackStatus;
+  /**
+   * Cluster identifier of the Swarm cluster where the stack is deployed
+   */
+  SwarmId?: string;
+  /**
+   * Stack type. 1 for a Swarm stack, 2 for a Compose stack
+   */
+  Type?: PortainerStackType;
+  /**
+   * The date in unix time when stack was last updated
+   */
+  UpdateDate?: number;
+  /**
+   * The username which last updated this stack
+   */
+  UpdatedBy?: string;
+  /**
+   * WorkflowID is the ID of the Workflow that owns the Source for this stack.
+   */
+  WorkflowID?: number;
+};
+
+export type StacksSwarmStackFromFileContentPayload = {
+  /**
+   * A list of environment variables used during stack deployment
+   */
+  Env?: Array<PortainerPair>;
+  /**
+   * Whether the stack is from a app template
+   */
+  FromAppTemplate?: boolean;
+  /**
+   * Name of the stack
+   */
+  Name: string;
+  /**
+   * Content of the Stack file
+   */
+  StackFileContent: string;
+  /**
+   * Swarm cluster identifier
+   */
+  SwarmID: string;
+};
+
+export type StacksSwarmStackFromGitRepositoryPayload = {
+  /**
+   * Applicable when deploying with multiple stack files
+   */
+  AdditionalFiles?: Array<string>;
+  /**
+   * Optional GitOps update configuration
+   */
+  AutoUpdate?: PortainerAutoUpdateSettings;
+  /**
+   * Path to the Stack file inside the Git repository
+   */
+  ComposeFile?: string;
+  /**
+   * A list of environment variables used during stack deployment
+   */
+  Env?: Array<PortainerPair>;
+  /**
+   * Whether the stack is from a app template
+   */
+  FromAppTemplate?: boolean;
+  /**
+   * Name of the stack
+   */
+  Name: string;
+  /**
+   * Deprecated: use SourceID instead. Use basic authentication to clone the Git repository.
+   */
+  RepositoryAuthentication?: boolean;
+  /**
+   * Deprecated: use SourceID instead. Password used in basic authentication.
+   */
+  RepositoryPassword?: string;
+  /**
+   * Reference name of a Git repository hosting the Stack file
+   */
+  RepositoryReferenceName?: string;
+  /**
+   * Deprecated: use SourceID instead. URL of a Git repository hosting the Stack file.
+   */
+  RepositoryURL?: string;
+  /**
+   * Deprecated: use SourceID instead. Username used in basic authentication.
+   */
+  RepositoryUsername?: string;
+  /**
+   * SourceID references an existing Source for git credentials/URL.
+   * When set, the inline URL and authentication fields are ignored.
+   */
+  SourceID?: number;
+  /**
+   * Swarm cluster identifier
+   */
+  SwarmID: string;
+  /**
+   * Deprecated: use SourceID instead. TLSSkipVerify skips SSL verification when cloning the Git repository.
+   */
+  TLSSkipVerify?: boolean;
+};
+
+export type StacksUpdateSwarmStackPayload = {
+  /**
+   * A list of environment(endpoint) variables used during stack deployment
+   */
+  Env?: Array<PortainerPair>;
+  /**
+   * Prune services that are no longer referenced
+   */
+  Prune?: boolean;
+  /**
+   * Deprecated(2.36): use RepullImageAndRedeploy instead for cleaner responsibility
+   * Force a pulling to current image with the original tag though the image is already the latest
+   */
+  PullImage?: boolean;
+  /**
+   * RepullImageAndRedeploy indicates whether to force repulling images and redeploying the stack
+   */
+  RepullImageAndRedeploy?: boolean;
+  /**
+   * New content of the Stack file
+   */
+  StackFileContent?: string;
+};
+
+export type StatsContainerStats = {
+  healthy?: number;
+  running?: number;
+  stopped?: number;
+  total?: number;
+  unhealthy?: number;
+};
+
+export type SwarmServiceUpdateResponse = {
+  /**
+   * Optional warning messages
+   */
+  Warnings?: Array<string>;
+};
+
+export type SystemNodesCountResponse = {
+  nodes?: number;
+};
+
+export type SystemStatus = {
+  /**
+   * Server Instance ID
+   */
+  InstanceID?: string;
+  /**
+   * Portainer API version
+   */
+  Version?: string;
+};
+
+export type SystemSystemInfoResponse = {
+  agents?: number;
+  edgeAgents?: number;
+  platform?: PlatformContainerPlatform;
+};
+
+export type SystemVersionResponse = {
+  Build?: BuildBuildInfo;
+  DatabaseVersion?: string;
+  Dependencies?: BuildDependenciesInfo;
+  /**
+   * The latest version available
+   */
+  LatestVersion?: string;
+  Runtime?: BuildRuntimeInfo;
+  ServerEdition?: string;
+  ServerVersion?: string;
+  /**
+   * Whether portainer has an update available
+   */
+  UpdateAvailable?: boolean;
+  VersionSupport?: string;
+};
+
+export type TagsTagCreatePayload = {
+  Name: string;
+};
+
+export type TeammembershipsTeamMembershipCreatePayload = {
+  /**
+   * Role for the user inside the team (1 for leader and 2 for regular member)
+   */
+  Role: 1 | 2;
+  /**
+   * Team identifier
+   */
+  TeamID: number;
+  /**
+   * User identifier
+   */
+  UserID: number;
+};
+
+export type TeammembershipsTeamMembershipUpdatePayload = {
+  /**
+   * Role for the user inside the team (1 for leader and 2 for regular member)
+   */
+  Role: 1 | 2;
+  /**
+   * Team identifier
+   */
+  TeamID: number;
+  /**
+   * User identifier
+   */
+  UserID: number;
+};
+
+export type TeamsTeamCreatePayload = {
+  /**
+   * Name
+   */
+  Name: string;
+  /**
+   * TeamLeaders
+   */
+  TeamLeaders?: Array<number>;
+};
+
+export type TeamsTeamUpdatePayload = {
+  /**
+   * Name
+   */
+  Name?: string;
+};
+
+export type TemplatesFileResponse = {
+  /**
+   * The requested file content
+   */
+  FileContent?: string;
+};
+
+export type TemplatesListResponse = {
+  templates?: Array<PortainerTemplate>;
+  version?: string;
+};
+
+export type UnstructuredUnstructured = {
+  /**
+   * Object is a JSON compatible map with string, float, int, bool, []interface{}, or
+   * map[string]interface{}
+   * children.
+   */
+  Object?: {
+    [key: string]: unknown;
+  };
+};
+
+export const UsersAccessLocation = {
+  /**
+   * AccessLocationEnvironment
+   */
+  ACCESS_LOCATION_ENVIRONMENT: 'environment' /**
+   * AccessLocationEnvironmentGroup
+   */,
+  ACCESS_LOCATION_ENVIRONMENT_GROUP: 'environmentGroup',
+} as const;
+
+export type UsersAccessLocation =
+  (typeof UsersAccessLocation)[keyof typeof UsersAccessLocation];
+
+export type UsersEffectiveAccessEntry = {
+  accessLocation?: UsersAccessLocation;
+  endpointId?: number;
+  endpointName?: string;
+  groupId?: number;
+  groupName?: string;
+  roleId?: number;
+  roleName?: string;
+  rolePriority?: number;
+  teamId?: number;
+  teamName?: string;
+};
+
+export type UsersAccessTokenResponse = {
+  apiKey?: PortainerApiKey;
+  rawAPIKey?: string;
+};
+
+export type UsersAddHelmRepoUrlPayload = {
+  url?: string;
+};
+
+export type UsersAdminInitPayload = {
+  /**
+   * Password for the admin user
+   */
+  Password: string;
+  /**
+   * Username for the admin user
+   */
+  Username: string;
+};
+
+export type UsersHelmUserRepositoryResponse = {
+  GlobalRepository?: string;
+  UserRepositories?: Array<PortainerHelmUserRepository>;
+};
+
+export type UsersThemePayload = {
+  /**
+   * Color represents the color theme of the UI
+   */
+  color?: 'dark' | 'light' | 'highcontrast' | 'auto';
+};
+
+export type UsersUserAccessTokenCreatePayload = {
+  description: string;
+  password: string;
+};
+
+export type UsersUserCreatePayload = {
+  Password: string;
+  /**
+   * User role (1 for administrator account and 2 for regular account)
+   */
+  Role: 1 | 2;
+  Username: string;
+};
+
+export type UsersUserUpdatePasswordPayload = {
+  /**
+   * New Password
+   */
+  NewPassword: string;
+  /**
+   * Current Password
+   */
+  Password: string;
+};
+
+export type UsersUserUpdatePayload = {
+  NewPassword: string;
+  Password: string;
+  /**
+   * User role (1 for administrator account and 2 for regular account)
+   */
+  Role: 1 | 2;
+  Theme?: UsersThemePayload;
+  UseCache: boolean;
+  Username: string;
+};
+
+export type V1AppArmorProfile = {
+  /**
+   * localhostProfile indicates a profile loaded on the node that should be used.
+   * The profile must be preconfigured on the node to work.
+   * Must match the loaded name of the profile.
+   * Must be set if and only if type is "Localhost".
+   * +optional
+   */
+  localhostProfile?: string;
+  /**
+   * type indicates which kind of AppArmor profile will be applied.
+   * Valid options are:
+   * Localhost - a profile pre-loaded on the node.
+   * RuntimeDefault - the container runtime's default profile.
+   * Unconfined - no AppArmor enforcement.
+   * +unionDiscriminator
+   */
+  type?: V1AppArmorProfileType;
+};
+
+export const V1AppArmorProfileType = {
+  /**
+   * AppArmorProfileTypeUnconfined
+   */
+  APP_ARMOR_PROFILE_TYPE_UNCONFINED: 'Unconfined',
+  /**
+   * AppArmorProfileTypeRuntimeDefault
+   */
+  APP_ARMOR_PROFILE_TYPE_RUNTIME_DEFAULT: 'RuntimeDefault',
+  /**
+   * AppArmorProfileTypeLocalhost
+   */
+  APP_ARMOR_PROFILE_TYPE_LOCALHOST: 'Localhost',
+} as const;
+
+export type V1AppArmorProfileType =
+  (typeof V1AppArmorProfileType)[keyof typeof V1AppArmorProfileType];
+
+export type V1AttachedVolume = {
+  /**
+   * DevicePath represents the device path where the volume should be available
+   */
+  devicePath?: string;
+  /**
+   * Name of the attached volume
+   */
+  name?: string;
+};
+
+export type V1CsiPersistentVolumeSource = {
+  /**
+   * controllerExpandSecretRef is a reference to the secret object containing
+   * sensitive information to pass to the CSI driver to complete the CSI
+   * ControllerExpandVolume call.
+   * This field is optional, and may be empty if no secret is required. If the
+   * secret object contains more than one secret, all secrets are passed.
+   * +optional
+   */
+  controllerExpandSecretRef?: V1SecretReference;
+  /**
+   * controllerPublishSecretRef is a reference to the secret object containing
+   * sensitive information to pass to the CSI driver to complete the CSI
+   * ControllerPublishVolume and ControllerUnpublishVolume calls.
+   * This field is optional, and may be empty if no secret is required. If the
+   * secret object contains more than one secret, all secrets are passed.
+   * +optional
+   */
+  controllerPublishSecretRef?: V1SecretReference;
+  /**
+   * driver is the name of the driver to use for this volume.
+   * Required.
+   */
+  driver?: string;
+  /**
+   * fsType to mount. Must be a filesystem type supported by the host operating system.
+   * Ex. "ext4", "xfs", "ntfs".
+   * +optional
+   */
+  fsType?: string;
+  /**
+   * nodeExpandSecretRef is a reference to the secret object containing
+   * sensitive information to pass to the CSI driver to complete the CSI
+   * NodeExpandVolume call.
+   * This field is optional, may be omitted if no secret is required. If the
+   * secret object contains more than one secret, all secrets are passed.
+   * +optional
+   */
+  nodeExpandSecretRef?: V1SecretReference;
+  /**
+   * nodePublishSecretRef is a reference to the secret object containing
+   * sensitive information to pass to the CSI driver to complete the CSI
+   * NodePublishVolume and NodeUnpublishVolume calls.
+   * This field is optional, and may be empty if no secret is required. If the
+   * secret object contains more than one secret, all secrets are passed.
+   * +optional
+   */
+  nodePublishSecretRef?: V1SecretReference;
+  /**
+   * nodeStageSecretRef is a reference to the secret object containing sensitive
+   * information to pass to the CSI driver to complete the CSI NodeStageVolume
+   * and NodeStageVolume and NodeUnstageVolume calls.
+   * This field is optional, and may be empty if no secret is required. If the
+   * secret object contains more than one secret, all secrets are passed.
+   * +optional
+   */
+  nodeStageSecretRef?: V1SecretReference;
+  /**
+   * readOnly value to pass to ControllerPublishVolumeRequest.
+   * Defaults to false (read/write).
+   * +optional
+   */
+  readOnly?: boolean;
+  /**
+   * volumeAttributes of the volume to publish.
+   * +optional
+   */
+  volumeAttributes?: {
+    [key: string]: string;
+  };
+  /**
+   * volumeHandle is the unique volume name returned by the CSI volume
+   * plugin’s CreateVolume to refer to the volume on all subsequent calls.
+   * Required.
+   */
+  volumeHandle?: string;
+};
+
+export type V1Capabilities = {
+  /**
+   * Added capabilities
+   * +optional
+   * +listType=atomic
+   */
+  add?: Array<string>;
+  /**
+   * Removed capabilities
+   * +optional
+   * +listType=atomic
+   */
+  drop?: Array<string>;
+};
+
+export type V1ConfigMapEnvSource = {
+  /**
+   * Name of the referent.
+   * This field is effectively required, but due to backwards compatibility is
+   * allowed to be empty. Instances of this type with an empty value here are
+   * almost certainly wrong.
+   * More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+   * +optional
+   * +default=""
+   * +kubebuilder:default=""
+   * TODO: Drop `kubebuilder:default` when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.
+   */
+  name?: string;
+  /**
+   * Specify whether the ConfigMap must be defined
+   * +optional
+   */
+  optional?: boolean;
+};
+
+export type V1ConfigMapKeySelector = {
+  /**
+   * The key to select.
+   */
+  key?: string;
+  /**
+   * Name of the referent.
+   * This field is effectively required, but due to backwards compatibility is
+   * allowed to be empty. Instances of this type with an empty value here are
+   * almost certainly wrong.
+   * More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+   * +optional
+   * +default=""
+   * +kubebuilder:default=""
+   * TODO: Drop `kubebuilder:default` when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.
+   */
+  name?: string;
+  /**
+   * Specify whether the ConfigMap or its key must be defined
+   * +optional
+   */
+  optional?: boolean;
+};
+
+export type V1ConfigMapNodeConfigSource = {
+  /**
+   * KubeletConfigKey declares which key of the referenced ConfigMap corresponds to the KubeletConfiguration structure
+   * This field is required in all cases.
+   */
+  kubeletConfigKey?: string;
+  /**
+   * Name is the metadata.name of the referenced ConfigMap.
+   * This field is required in all cases.
+   */
+  name?: string;
+  /**
+   * Namespace is the metadata.namespace of the referenced ConfigMap.
+   * This field is required in all cases.
+   */
+  namespace?: string;
+  /**
+   * ResourceVersion is the metadata.ResourceVersion of the referenced ConfigMap.
+   * This field is forbidden in Node.Spec, and required in Node.Status.
+   * +optional
+   */
+  resourceVersion?: string;
+  /**
+   * UID is the metadata.UID of the referenced ConfigMap.
+   * This field is forbidden in Node.Spec, and required in Node.Status.
+   * +optional
+   */
+  uid?: string;
+};
+
+export type V1Container = {
+  /**
+   * Arguments to the entrypoint.
+   * The container image's CMD is used if this is not provided.
+   * Variable references $(VAR_NAME) are expanded using the container's environment. If a variable
+   * cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced
+   * to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will
+   * produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless
+   * of whether the variable exists or not. Cannot be updated.
+   * More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell
+   * +optional
+   * +listType=atomic
+   */
+  args?: Array<string>;
+  /**
+   * Entrypoint array. Not executed within a shell.
+   * The container image's ENTRYPOINT is used if this is not provided.
+   * Variable references $(VAR_NAME) are expanded using the container's environment. If a variable
+   * cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced
+   * to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will
+   * produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless
+   * of whether the variable exists or not. Cannot be updated.
+   * More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell
+   * +optional
+   * +listType=atomic
+   */
+  command?: Array<string>;
+  /**
+   * List of environment variables to set in the container.
+   * Cannot be updated.
+   * +optional
+   * +patchMergeKey=name
+   * +patchStrategy=merge
+   * +listType=map
+   * +listMapKey=name
+   */
+  env?: Array<V1EnvVar>;
+  /**
+   * List of sources to populate environment variables in the container.
+   * The keys defined within a source may consist of any printable ASCII characters except '='.
+   * When a key exists in multiple
+   * sources, the value associated with the last source will take precedence.
+   * Values defined by an Env with a duplicate key will take precedence.
+   * Cannot be updated.
+   * +optional
+   * +listType=atomic
+   */
+  envFrom?: Array<V1EnvFromSource>;
+  /**
+   * Container image name.
+   * More info: https://kubernetes.io/docs/concepts/containers/images
+   * This field is optional to allow higher level config management to default or override
+   * container images in workload controllers like Deployments and StatefulSets.
+   * +optional
+   */
+  image?: string;
+  /**
+   * Image pull policy.
+   * One of Always, Never, IfNotPresent.
+   * Defaults to Always if :latest tag is specified, or IfNotPresent otherwise.
+   * Cannot be updated.
+   * More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
+   * +optional
+   */
+  imagePullPolicy?: V1PullPolicy;
+  /**
+   * Actions that the management system should take in response to container lifecycle events.
+   * Cannot be updated.
+   * +optional
+   */
+  lifecycle?: V1Lifecycle;
+  /**
+   * Periodic probe of container liveness.
+   * Container will be restarted if the probe fails.
+   * Cannot be updated.
+   * More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+   * +optional
+   */
+  livenessProbe?: V1Probe;
+  /**
+   * Name of the container specified as a DNS_LABEL.
+   * Each container in a pod must have a unique name (DNS_LABEL).
+   * Cannot be updated.
+   */
+  name?: string;
+  /**
+   * List of ports to expose from the container. Not specifying a port here
+   * DOES NOT prevent that port from being exposed. Any port which is
+   * listening on the default "0.0.0.0" address inside a container will be
+   * accessible from the network.
+   * Modifying this array with strategic merge patch may corrupt the data.
+   * For more information See https://github.com/kubernetes/kubernetes/issues/108255.
+   * Cannot be updated.
+   * +optional
+   * +patchMergeKey=containerPort
+   * +patchStrategy=merge
+   * +listType=map
+   * +listMapKey=containerPort
+   * +listMapKey=protocol
+   */
+  ports?: Array<V1ContainerPort>;
+  /**
+   * Periodic probe of container service readiness.
+   * Container will be removed from service endpoints if the probe fails.
+   * Cannot be updated.
+   * More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+   * +optional
+   */
+  readinessProbe?: V1Probe;
+  /**
+   * Resources resize policy for the container.
+   * This field cannot be set on ephemeral containers.
+   * +featureGate=InPlacePodVerticalScaling
+   * +optional
+   * +listType=atomic
+   */
+  resizePolicy?: Array<V1ContainerResizePolicy>;
+  /**
+   * Compute Resources required by this container.
+   * Cannot be updated.
+   * More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+   * +optional
+   */
+  resources?: V1ResourceRequirements;
+  /**
+   * RestartPolicy defines the restart behavior of individual containers in a pod.
+   * This overrides the pod-level restart policy. When this field is not specified,
+   * the restart behavior is defined by the Pod's restart policy and the container type.
+   * Additionally, setting the RestartPolicy as "Always" for the init container will
+   * have the following effect:
+   * this init container will be continually restarted on
+   * exit until all regular containers have terminated. Once all regular
+   * containers have completed, all init containers with restartPolicy "Always"
+   * will be shut down. This lifecycle differs from normal init containers and
+   * is often referred to as a "sidecar" container. Although this init
+   * container still starts in the init container sequence, it does not wait
+   * for the container to complete before proceeding to the next init
+   * container. Instead, the next init container starts immediately after this
+   * init container is started, or after any startupProbe has successfully
+   * completed.
+   * +optional
+   */
+  restartPolicy?: V1ContainerRestartPolicy;
+  /**
+   * Represents a list of rules to be checked to determine if the
+   * container should be restarted on exit. The rules are evaluated in
+   * order. Once a rule matches a container exit condition, the remaining
+   * rules are ignored. If no rule matches the container exit condition,
+   * the Container-level restart policy determines the whether the container
+   * is restarted or not. Constraints on the rules:
+   * - At most 20 rules are allowed.
+   * - Rules can have the same action.
+   * - Identical rules are not forbidden in validations.
+   * When rules are specified, container MUST set RestartPolicy explicitly
+   * even it if matches the Pod's RestartPolicy.
+   * +featureGate=ContainerRestartRules
+   * +optional
+   * +listType=atomic
+   */
+  restartPolicyRules?: Array<V1ContainerRestartRule>;
+  /**
+   * SecurityContext defines the security options the container should be run with.
+   * If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.
+   * More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+   * +optional
+   */
+  securityContext?: V1SecurityContext;
+  /**
+   * StartupProbe indicates that the Pod has successfully initialized.
+   * If specified, no other probes are executed until this completes successfully.
+   * If this probe fails, the Pod will be restarted, just as if the livenessProbe failed.
+   * This can be used to provide different probe parameters at the beginning of a Pod's lifecycle,
+   * when it might take a long time to load data or warm a cache, than during steady-state operation.
+   * This cannot be updated.
+   * More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+   * +optional
+   */
+  startupProbe?: V1Probe;
+  /**
+   * Whether this container should allocate a buffer for stdin in the container runtime. If this
+   * is not set, reads from stdin in the container will always result in EOF.
+   * Default is false.
+   * +optional
+   */
+  stdin?: boolean;
+  /**
+   * Whether the container runtime should close the stdin channel after it has been opened by
+   * a single attach. When stdin is true the stdin stream will remain open across multiple attach
+   * sessions. If stdinOnce is set to true, stdin is opened on container start, is empty until the
+   * first client attaches to stdin, and then remains open and accepts data until the client disconnects,
+   * at which time stdin is closed and remains closed until the container is restarted. If this
+   * flag is false, a container processes that reads from stdin will never receive an EOF.
+   * Default is false
+   * +optional
+   */
+  stdinOnce?: boolean;
+  /**
+   * Optional: Path at which the file to which the container's termination message
+   * will be written is mounted into the container's filesystem.
+   * Message written is intended to be brief final status, such as an assertion failure message.
+   * Will be truncated by the node if greater than 4096 bytes. The total message length across
+   * all containers will be limited to 12kb.
+   * Defaults to /dev/termination-log.
+   * Cannot be updated.
+   * +optional
+   */
+  terminationMessagePath?: string;
+  /**
+   * Indicate how the termination message should be populated. File will use the contents of
+   * terminationMessagePath to populate the container status message on both success and failure.
+   * FallbackToLogsOnError will use the last chunk of container log output if the termination
+   * message file is empty and the container exited with an error.
+   * The log output is limited to 2048 bytes or 80 lines, whichever is smaller.
+   * Defaults to File.
+   * Cannot be updated.
+   * +optional
+   */
+  terminationMessagePolicy?: V1TerminationMessagePolicy;
+  /**
+   * Whether this container should allocate a TTY for itself, also requires 'stdin' to be true.
+   * Default is false.
+   * +optional
+   */
+  tty?: boolean;
+  /**
+   * volumeDevices is the list of block devices to be used by the container.
+   * +patchMergeKey=devicePath
+   * +patchStrategy=merge
+   * +listType=map
+   * +listMapKey=devicePath
+   * +optional
+   */
+  volumeDevices?: Array<V1VolumeDevice>;
+  /**
+   * Pod volumes to mount into the container's filesystem.
+   * Cannot be updated.
+   * +optional
+   * +patchMergeKey=mountPath
+   * +patchStrategy=merge
+   * +listType=map
+   * +listMapKey=mountPath
+   */
+  volumeMounts?: Array<V1VolumeMount>;
+  /**
+   * Container's working directory.
+   * If not specified, the container runtime's default will be used, which
+   * might be configured in the container image.
+   * Cannot be updated.
+   * +optional
+   */
+  workingDir?: string;
+};
+
+export type V1ContainerImage = {
+  /**
+   * Names by which this image is known.
+   * e.g. ["kubernetes.example/hyperkube:v1.0.7", "cloud-vendor.registry.example/cloud-vendor/hyperkube:v1.0.7"]
+   * +optional
+   * +listType=atomic
+   */
+  names?: Array<string>;
+  /**
+   * The size of the image in bytes.
+   * +optional
+   */
+  sizeBytes?: number;
+};
+
+export type V1ContainerPort = {
+  /**
+   * Number of port to expose on the pod's IP address.
+   * This must be a valid port number, 0 < x < 65536.
+   */
+  containerPort?: number;
+  /**
+   * What host IP to bind the external port to.
+   * +optional
+   */
+  hostIP?: string;
+  /**
+   * Number of port to expose on the host.
+   * If specified, this must be a valid port number, 0 < x < 65536.
+   * If HostNetwork is specified, this must match ContainerPort.
+   * Most containers do not need this.
+   * +optional
+   */
+  hostPort?: number;
+  /**
+   * If specified, this must be an IANA_SVC_NAME and unique within the pod. Each
+   * named port in a pod must have a unique name. Name for the port that can be
+   * referred to by services.
+   * +optional
+   */
+  name?: string;
+  /**
+   * Protocol for port. Must be UDP, TCP, or SCTP.
+   * Defaults to "TCP".
+   * +optional
+   * +default="TCP"
+   */
+  protocol?: V1Protocol;
+};
+
+export type V1ContainerResizePolicy = {
+  /**
+   * Name of the resource to which this resource resize policy applies.
+   * Supported values: cpu, memory.
+   */
+  resourceName?: V1ResourceName;
+  /**
+   * Restart policy to apply when specified resource is resized.
+   * If not specified, it defaults to NotRequired.
+   */
+  restartPolicy?: V1ResourceResizeRestartPolicy;
+};
+
+export const V1ContainerRestartPolicy = {
+  /**
+   * ContainerRestartPolicyAlways
+   */
+  CONTAINER_RESTART_POLICY_ALWAYS: 'Always',
+  /**
+   * ContainerRestartPolicyNever
+   */
+  CONTAINER_RESTART_POLICY_NEVER: 'Never',
+  /**
+   * ContainerRestartPolicyOnFailure
+   */
+  CONTAINER_RESTART_POLICY_ON_FAILURE: 'OnFailure',
+} as const;
+
+export type V1ContainerRestartPolicy =
+  (typeof V1ContainerRestartPolicy)[keyof typeof V1ContainerRestartPolicy];
+
+export type V1ContainerRestartRule = {
+  /**
+   * Specifies the action taken on a container exit if the requirements
+   * are satisfied. The only possible value is "Restart" to restart the
+   * container.
+   * +required
+   */
+  action?: V1ContainerRestartRuleAction;
+  /**
+   * Represents the exit codes to check on container exits.
+   * +optional
+   * +oneOf=when
+   */
+  exitCodes?: V1ContainerRestartRuleOnExitCodes;
+};
+
+export const V1ContainerRestartRuleAction = {
+  /**
+   * ContainerRestartRuleActionRestart
+   */
+  CONTAINER_RESTART_RULE_ACTION_RESTART: 'Restart' /**
+   * ContainerRestartRuleActionRestartAllContainers
+   */,
+  CONTAINER_RESTART_RULE_ACTION_RESTART_ALL_CONTAINERS: 'RestartAllContainers',
+} as const;
+
+export type V1ContainerRestartRuleAction =
+  (typeof V1ContainerRestartRuleAction)[keyof typeof V1ContainerRestartRuleAction];
+
+export type V1ContainerRestartRuleOnExitCodes = {
+  /**
+   * Represents the relationship between the container exit code(s) and the
+   * specified values. Possible values are:
+   * - In: the requirement is satisfied if the container exit code is in the
+   * set of specified values.
+   * - NotIn: the requirement is satisfied if the container exit code is
+   * not in the set of specified values.
+   * +required
+   */
+  operator?: V1ContainerRestartRuleOnExitCodesOperator;
+  /**
+   * Specifies the set of values to check for container exit codes.
+   * At most 255 elements are allowed.
+   * +optional
+   * +listType=set
+   */
+  values?: Array<number>;
+};
+
+export const V1ContainerRestartRuleOnExitCodesOperator = {
+  /**
+   * ContainerRestartRuleOnExitCodesOpIn
+   */
+  CONTAINER_RESTART_RULE_ON_EXIT_CODES_OP_IN: 'In' /**
+   * ContainerRestartRuleOnExitCodesOpNotIn
+   */,
+  CONTAINER_RESTART_RULE_ON_EXIT_CODES_OP_NOT_IN: 'NotIn',
+} as const;
+
+export type V1ContainerRestartRuleOnExitCodesOperator =
+  (typeof V1ContainerRestartRuleOnExitCodesOperator)[keyof typeof V1ContainerRestartRuleOnExitCodesOperator];
+
+export type V1DaemonEndpoint = {
+  /**
+   * Port number of the given endpoint.
+   */
+  Port?: number;
+};
+
+export type V1EnvFromSource = {
+  /**
+   * The ConfigMap to select from
+   * +optional
+   */
+  configMapRef?: V1ConfigMapEnvSource;
+  /**
+   * Optional text to prepend to the name of each environment variable.
+   * May consist of any printable ASCII characters except '='.
+   * +optional
+   */
+  prefix?: string;
+  /**
+   * The Secret to select from
+   * +optional
+   */
+  secretRef?: V1SecretEnvSource;
+};
+
+export type V1EnvVar = {
+  /**
+   * Name of the environment variable.
+   * May consist of any printable ASCII characters except '='.
+   */
+  name?: string;
+  /**
+   * Variable references $(VAR_NAME) are expanded
+   * using the previously defined environment variables in the container and
+   * any service environment variables. If a variable cannot be resolved,
+   * the reference in the input string will be unchanged. Double $$ are reduced
+   * to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
+   * "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
+   * Escaped references will never be expanded, regardless of whether the variable
+   * exists or not.
+   * Defaults to "".
+   * +optional
+   */
+  value?: string;
+  /**
+   * Source for the environment variable's value. Cannot be used if value is not empty.
+   * +optional
+   */
+  valueFrom?: V1EnvVarSource;
+};
+
+export type V1EnvVarSource = {
+  /**
+   * Selects a key of a ConfigMap.
+   * +optional
+   */
+  configMapKeyRef?: V1ConfigMapKeySelector;
+  /**
+   * Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['<KEY>']`, `metadata.annotations['<KEY>']`,
+   * spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.
+   * +optional
+   */
+  fieldRef?: V1ObjectFieldSelector;
+  /**
+   * FileKeyRef selects a key of the env file.
+   * Requires the EnvFiles feature gate to be enabled.
+   *
+   * +featureGate=EnvFiles
+   * +optional
+   */
+  fileKeyRef?: V1FileKeySelector;
+  /**
+   * Selects a resource of the container: only resources limits and requests
+   * (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.
+   * +optional
+   */
+  resourceFieldRef?: V1ResourceFieldSelector;
+  /**
+   * Selects a key of a secret in the pod's namespace
+   * +optional
+   */
+  secretKeyRef?: V1SecretKeySelector;
+};
+
+export type V1ExecAction = {
+  /**
+   * Command is the command line to execute inside the container, the working directory for the
+   * command  is root ('/') in the container's filesystem. The command is simply exec'd, it is
+   * not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+   * a shell, you need to explicitly call out to that shell.
+   * Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
+   * +optional
+   * +listType=atomic
+   */
+  command?: Array<string>;
+};
+
+export type V1FieldsV1 = {
+  [key: string]: unknown;
+};
+
+export type V1FileKeySelector = {
+  /**
+   * The key within the env file. An invalid key will prevent the pod from starting.
+   * The keys defined within a source may consist of any printable ASCII characters except '='.
+   * During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+   * +required
+   */
+  key?: string;
+  /**
+   * Specify whether the file or its key must be defined. If the file or key
+   * does not exist, then the env var is not published.
+   * If optional is set to true and the specified key does not exist,
+   * the environment variable will not be set in the Pod's containers.
+   *
+   * If optional is set to false and the specified key does not exist,
+   * an error will be returned during Pod creation.
+   * +optional
+   * +default=false
+   */
+  optional?: boolean;
+  /**
+   * The path within the volume from which to select the file.
+   * Must be relative and may not contain the '..' path or start with '..'.
+   * +required
+   */
+  path?: string;
+  /**
+   * The name of the volume mount containing the env file.
+   * +required
+   */
+  volumeName?: string;
+};
+
+export type V1GrpcAction = {
+  /**
+   * Port number of the gRPC service. Number must be in the range 1 to 65535.
+   */
+  port?: number;
+  /**
+   * Service is the name of the service to place in the gRPC HealthCheckRequest
+   * (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+   *
+   * If this is not specified, the default behavior is defined by gRPC.
+   * +optional
+   * +default=""
+   */
+  service?: string;
+};
+
+export type V1HttpGetAction = {
+  /**
+   * Host name to connect to, defaults to the pod IP. You probably want to set
+   * "Host" in httpHeaders instead.
+   * +optional
+   */
+  host?: string;
+  /**
+   * Custom headers to set in the request. HTTP allows repeated headers.
+   * +optional
+   * +listType=atomic
+   */
+  httpHeaders?: Array<K8sIoApiCoreV1HttpHeader>;
+  /**
+   * Path to access on the HTTP server.
+   * +optional
+   */
+  path?: string;
+  /**
+   * Name or number of the port to access on the container.
+   * Number must be in the range 1 to 65535.
+   * Name must be an IANA_SVC_NAME.
+   */
+  port?: IntstrIntOrString;
+  /**
+   * Scheme to use for connecting to the host.
+   * Defaults to HTTP.
+   * +optional
+   */
+  scheme?: V1UriScheme;
+};
+
+export type V1Lifecycle = {
+  /**
+   * PostStart is called immediately after a container is created. If the handler fails,
+   * the container is terminated and restarted according to its restart policy.
+   * Other management of the container blocks until the hook completes.
+   * More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks
+   * +optional
+   */
+  postStart?: V1LifecycleHandler;
+  /**
+   * PreStop is called immediately before a container is terminated due to an
+   * API request or management event such as liveness/startup probe failure,
+   * preemption, resource contention, etc. The handler is not called if the
+   * container crashes or exits. The Pod's termination grace period countdown begins before the
+   * PreStop hook is executed. Regardless of the outcome of the handler, the
+   * container will eventually terminate within the Pod's termination grace
+   * period (unless delayed by finalizers). Other management of the container blocks until the hook completes
+   * or until the termination grace period is reached.
+   * More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks
+   * +optional
+   */
+  preStop?: V1LifecycleHandler;
+  /**
+   * StopSignal defines which signal will be sent to a container when it is being stopped.
+   * If not specified, the default is defined by the container runtime in use.
+   * StopSignal can only be set for Pods with a non-empty .spec.os.name
+   * +optional
+   */
+  stopSignal?: V1Signal;
+};
+
+export type V1LifecycleHandler = {
+  /**
+   * Exec specifies a command to execute in the container.
+   * +optional
+   */
+  exec?: V1ExecAction;
+  /**
+   * HTTPGet specifies an HTTP GET request to perform.
+   * +optional
+   */
+  httpGet?: V1HttpGetAction;
+  /**
+   * Sleep represents a duration that the container should sleep.
+   * +optional
+   */
+  sleep?: V1SleepAction;
+  /**
+   * Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept
+   * for backward compatibility. There is no validation of this field and
+   * lifecycle hooks will fail at runtime when it is specified.
+   * +optional
+   */
+  tcpSocket?: V1TcpSocketAction;
+};
+
+export type V1ListMeta = {
+  /**
+   * continue may be set if the user set a limit on the number of items returned, and indicates that
+   * the server has more data available. The value is opaque and may be used to issue another request
+   * to the endpoint that served this list to retrieve the next set of available objects. Continuing a
+   * consistent list may not be possible if the server configuration has changed or more than a few
+   * minutes have passed. The resourceVersion field returned when using this continue value will be
+   * identical to the value in the first response, unless you have received this token from an error
+   * message.
+   */
+  continue?: string;
+  /**
+   * remainingItemCount is the number of subsequent items in the list which are not included in this
+   * list response. If the list request contained label or field selectors, then the number of
+   * remaining items is unknown and the field will be left unset and omitted during serialization.
+   * If the list is complete (either because it is not chunking or because this is the last chunk),
+   * then there are no more remaining items and this field will be left unset and omitted during
+   * serialization.
+   * Servers older than v1.15 do not set this field.
+   * The intended use of the remainingItemCount is *estimating* the size of a collection. Clients
+   * should not rely on the remainingItemCount to be set or to be exact.
+   * +optional
+   */
+  remainingItemCount?: number;
+  /**
+   * String that identifies the server's internal version of this object that
+   * can be used by clients to determine when objects have changed.
+   * Value must be treated as opaque by clients and passed unmodified back to the server.
+   * Populated by the system.
+   * Read-only.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
+   * +optional
+   */
+  resourceVersion?: string;
+  /**
+   * Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.
+   * +optional
+   */
+  selfLink?: string;
+};
+
+export type V1ManagedFieldsEntry = {
+  /**
+   * APIVersion defines the version of this resource that this field set
+   * applies to. The format is "group/version" just like the top-level
+   * APIVersion field. It is necessary to track the version of a field
+   * set because it cannot be automatically converted.
+   */
+  apiVersion?: string;
+  /**
+   * FieldsType is the discriminator for the different fields format and version.
+   * There is currently only one possible value: "FieldsV1"
+   */
+  fieldsType?: string;
+  /**
+   * FieldsV1 holds the first JSON version format as described in the "FieldsV1" type.
+   * +optional
+   */
+  fieldsV1?: V1FieldsV1;
+  /**
+   * Manager is an identifier of the workflow managing these fields.
+   */
+  manager?: string;
+  /**
+   * Operation is the type of operation which lead to this ManagedFieldsEntry being created.
+   * The only valid values for this field are 'Apply' and 'Update'.
+   */
+  operation?: V1ManagedFieldsOperationType;
+  /**
+   * Subresource is the name of the subresource used to update that object, or
+   * empty string if the object was updated through the main resource. The
+   * value of this field is used to distinguish between managers, even if they
+   * share the same name. For example, a status update will be distinct from a
+   * regular update using the same manager name.
+   * Note that the APIVersion field is not related to the Subresource field and
+   * it always corresponds to the version of the main resource.
+   */
+  subresource?: string;
+  /**
+   * Time is the timestamp of when the ManagedFields entry was added. The
+   * timestamp will also be updated if a field is added, the manager
+   * changes any of the owned fields value or removes a field. The
+   * timestamp does not update when a field is removed from the entry
+   * because another manager took it over.
+   * +optional
+   */
+  time?: string;
+};
+
+export const V1ManagedFieldsOperationType = {
+  /**
+   * ManagedFieldsOperationApply
+   */
+  MANAGED_FIELDS_OPERATION_APPLY: 'Apply' /**
+   * ManagedFieldsOperationUpdate
+   */,
+  MANAGED_FIELDS_OPERATION_UPDATE: 'Update',
+} as const;
+
+export type V1ManagedFieldsOperationType =
+  (typeof V1ManagedFieldsOperationType)[keyof typeof V1ManagedFieldsOperationType];
+
+export const V1MountPropagationMode = {
+  /**
+   * MountPropagationNone
+   */
+  MOUNT_PROPAGATION_NONE: 'None',
+  /**
+   * MountPropagationHostToContainer
+   */
+  MOUNT_PROPAGATION_HOST_TO_CONTAINER: 'HostToContainer',
+  /**
+   * MountPropagationBidirectional
+   */
+  MOUNT_PROPAGATION_BIDIRECTIONAL: 'Bidirectional',
+} as const;
+
+export type V1MountPropagationMode =
+  (typeof V1MountPropagationMode)[keyof typeof V1MountPropagationMode];
+
+export type V1NamespaceCondition = {
+  /**
+   * Last time the condition transitioned from one status to another.
+   * +optional
+   */
+  lastTransitionTime?: string;
+  /**
+   * Human-readable message indicating details about last transition.
+   * +optional
+   */
+  message?: string;
+  /**
+   * Unique, one-word, CamelCase reason for the condition's last transition.
+   * +optional
+   */
+  reason?: string;
+  /**
+   * Status of the condition, one of True, False, Unknown.
+   */
+  status?: K8sIoApiCoreV1ConditionStatus;
+  /**
+   * Type of namespace controller condition.
+   */
+  type?: V1NamespaceConditionType;
+};
+
+export const V1NamespaceConditionType = {
+  /**
+   * NamespaceDeletionDiscoveryFailure
+   */
+  NAMESPACE_DELETION_DISCOVERY_FAILURE: 'NamespaceDeletionDiscoveryFailure',
+  /**
+   * NamespaceDeletionContentFailure
+   */
+  NAMESPACE_DELETION_CONTENT_FAILURE: 'NamespaceDeletionContentFailure',
+  /**
+   * NamespaceDeletionGVParsingFailure
+   */
+  NAMESPACE_DELETION_GV_PARSING_FAILURE:
+    'NamespaceDeletionGroupVersionParsingFailure',
+  /**
+   * NamespaceContentRemaining
+   */
+  NAMESPACE_CONTENT_REMAINING: 'NamespaceContentRemaining',
+  /**
+   * NamespaceFinalizersRemaining
+   */
+  NAMESPACE_FINALIZERS_REMAINING: 'NamespaceFinalizersRemaining',
+} as const;
+
+export type V1NamespaceConditionType =
+  (typeof V1NamespaceConditionType)[keyof typeof V1NamespaceConditionType];
+
+export const V1NamespacePhase = {
+  /**
+   * NamespaceActive
+   */
+  NAMESPACE_ACTIVE: 'Active' /**
+   * NamespaceTerminating
+   */,
+  NAMESPACE_TERMINATING: 'Terminating',
+} as const;
+
+export type V1NamespacePhase =
+  (typeof V1NamespacePhase)[keyof typeof V1NamespacePhase];
+
+export type V1NamespaceStatus = {
+  /**
+   * Represents the latest available observations of a namespace's current state.
+   * +optional
+   * +patchMergeKey=type
+   * +patchStrategy=merge
+   * +listType=map
+   * +listMapKey=type
+   */
+  conditions?: Array<V1NamespaceCondition>;
+  /**
+   * Phase is the current lifecycle phase of the namespace.
+   * More info: https://kubernetes.io/docs/tasks/administer-cluster/namespaces/
+   * +optional
+   */
+  phase?: V1NamespacePhase;
+};
+
+export type V1NodeAddress = {
+  /**
+   * The node address.
+   */
+  address?: string;
+  /**
+   * Node address type, one of Hostname, ExternalIP or InternalIP.
+   */
+  type?: V1NodeAddressType;
+};
+
+export const V1NodeAddressType = {
+  /**
+   * NodeHostName
+   */
+  NODE_HOST_NAME: 'Hostname',
+  /**
+   * NodeInternalIP
+   */
+  NODE_INTERNAL_IP: 'InternalIP',
+  /**
+   * NodeExternalIP
+   */
+  NODE_EXTERNAL_IP: 'ExternalIP',
+  /**
+   * NodeInternalDNS
+   */
+  NODE_INTERNAL_DNS: 'InternalDNS',
+  /**
+   * NodeExternalDNS
+   */
+  NODE_EXTERNAL_DNS: 'ExternalDNS',
+} as const;
+
+export type V1NodeAddressType =
+  (typeof V1NodeAddressType)[keyof typeof V1NodeAddressType];
+
+export type V1NodeCondition = {
+  /**
+   * Last time we got an update on a given condition.
+   * +optional
+   */
+  lastHeartbeatTime?: string;
+  /**
+   * Last time the condition transit from one status to another.
+   * +optional
+   */
+  lastTransitionTime?: string;
+  /**
+   * Human readable message indicating details about last transition.
+   * +optional
+   */
+  message?: string;
+  /**
+   * (brief) reason for the condition's last transition.
+   * +optional
+   */
+  reason?: string;
+  /**
+   * Status of the condition, one of True, False, Unknown.
+   */
+  status?: K8sIoApiCoreV1ConditionStatus;
+  /**
+   * Type of node condition.
+   */
+  type?: V1NodeConditionType;
+};
+
+export const V1NodeConditionType = {
+  /**
+   * NodeReady
+   */
+  NODE_READY: 'Ready',
+  /**
+   * NodeMemoryPressure
+   */
+  NODE_MEMORY_PRESSURE: 'MemoryPressure',
+  /**
+   * NodeDiskPressure
+   */
+  NODE_DISK_PRESSURE: 'DiskPressure',
+  /**
+   * NodePIDPressure
+   */
+  NODE_PID_PRESSURE: 'PIDPressure',
+  /**
+   * NodeNetworkUnavailable
+   */
+  NODE_NETWORK_UNAVAILABLE: 'NetworkUnavailable',
+} as const;
+
+export type V1NodeConditionType =
+  (typeof V1NodeConditionType)[keyof typeof V1NodeConditionType];
+
+export type V1NodeConfigSource = {
+  /**
+   * ConfigMap is a reference to a Node's ConfigMap
+   */
+  configMap?: V1ConfigMapNodeConfigSource;
+};
+
+export type V1NodeConfigStatus = {
+  /**
+   * Active reports the checkpointed config the node is actively using.
+   * Active will represent either the current version of the Assigned config,
+   * or the current LastKnownGood config, depending on whether attempting to use the
+   * Assigned config results in an error.
+   * +optional
+   */
+  active?: V1NodeConfigSource;
+  /**
+   * Assigned reports the checkpointed config the node will try to use.
+   * When Node.Spec.ConfigSource is updated, the node checkpoints the associated
+   * config payload to local disk, along with a record indicating intended
+   * config. The node refers to this record to choose its config checkpoint, and
+   * reports this record in Assigned. Assigned only updates in the status after
+   * the record has been checkpointed to disk. When the Kubelet is restarted,
+   * it tries to make the Assigned config the Active config by loading and
+   * validating the checkpointed payload identified by Assigned.
+   * +optional
+   */
+  assigned?: V1NodeConfigSource;
+  /**
+   * Error describes any problems reconciling the Spec.ConfigSource to the Active config.
+   * Errors may occur, for example, attempting to checkpoint Spec.ConfigSource to the local Assigned
+   * record, attempting to checkpoint the payload associated with Spec.ConfigSource, attempting
+   * to load or validate the Assigned config, etc.
+   * Errors may occur at different points while syncing config. Earlier errors (e.g. download or
+   * checkpointing errors) will not result in a rollback to LastKnownGood, and may resolve across
+   * Kubelet retries. Later errors (e.g. loading or validating a checkpointed config) will result in
+   * a rollback to LastKnownGood. In the latter case, it is usually possible to resolve the error
+   * by fixing the config assigned in Spec.ConfigSource.
+   * You can find additional information for debugging by searching the error message in the Kubelet log.
+   * Error is a human-readable description of the error state; machines can check whether or not Error
+   * is empty, but should not rely on the stability of the Error text across Kubelet versions.
+   * +optional
+   */
+  error?: string;
+  /**
+   * LastKnownGood reports the checkpointed config the node will fall back to
+   * when it encounters an error attempting to use the Assigned config.
+   * The Assigned config becomes the LastKnownGood config when the node determines
+   * that the Assigned config is stable and correct.
+   * This is currently implemented as a 10-minute soak period starting when the local
+   * record of Assigned config is updated. If the Assigned config is Active at the end
+   * of this period, it becomes the LastKnownGood. Note that if Spec.ConfigSource is
+   * reset to nil (use local defaults), the LastKnownGood is also immediately reset to nil,
+   * because the local default config is always assumed good.
+   * You should not make assumptions about the node's method of determining config stability
+   * and correctness, as this may change or become configurable in the future.
+   * +optional
+   */
+  lastKnownGood?: V1NodeConfigSource;
+};
+
+export type V1NodeDaemonEndpoints = {
+  /**
+   * Endpoint on which Kubelet is listening.
+   * +optional
+   */
+  kubeletEndpoint?: V1DaemonEndpoint;
+};
+
+export type V1NodeFeatures = {
+  /**
+   * SupplementalGroupsPolicy is set to true if the runtime supports SupplementalGroupsPolicy and ContainerUser.
+   * +optional
+   */
+  supplementalGroupsPolicy?: boolean;
+};
+
+export const V1NodePhase = {
+  /**
+   * NodePending
+   */
+  NODE_PENDING: 'Pending',
+  /**
+   * NodeRunning
+   */
+  NODE_RUNNING: 'Running',
+  /**
+   * NodeTerminated
+   */
+  NODE_TERMINATED: 'Terminated',
+} as const;
+
+export type V1NodePhase = (typeof V1NodePhase)[keyof typeof V1NodePhase];
+
+export type V1NodeRuntimeHandler = {
+  /**
+   * Supported features.
+   * +optional
+   */
+  features?: V1NodeRuntimeHandlerFeatures;
+  /**
+   * Runtime handler name.
+   * Empty for the default runtime handler.
+   * +optional
+   */
+  name?: string;
+};
+
+export type V1NodeRuntimeHandlerFeatures = {
+  /**
+   * RecursiveReadOnlyMounts is set to true if the runtime handler supports RecursiveReadOnlyMounts.
+   * +optional
+   */
+  recursiveReadOnlyMounts?: boolean;
+  /**
+   * UserNamespaces is set to true if the runtime handler supports UserNamespaces, including for volumes.
+   * +featureGate=UserNamespacesSupport
+   * +optional
+   */
+  userNamespaces?: boolean;
+};
+
+export type V1NodeSpec = {
+  /**
+   * Deprecated: Previously used to specify the source of the node's configuration for the DynamicKubeletConfig feature. This feature is removed.
+   * +optional
+   */
+  configSource?: V1NodeConfigSource;
+  /**
+   * Deprecated. Not all kubelets will set this field. Remove field after 1.13.
+   * see: https://issues.k8s.io/61966
+   * +optional
+   */
+  externalID?: string;
+  /**
+   * PodCIDR represents the pod IP range assigned to the node.
+   * +optional
+   */
+  podCIDR?: string;
+  /**
+   * podCIDRs represents the IP ranges assigned to the node for usage by Pods on that node. If this
+   * field is specified, the 0th entry must match the podCIDR field. It may contain at most 1 value for
+   * each of IPv4 and IPv6.
+   * +optional
+   * +patchStrategy=merge
+   * +listType=set
+   */
+  podCIDRs?: Array<string>;
+  /**
+   * ID of the node assigned by the cloud provider in the format: <ProviderName>://<ProviderSpecificNodeID>
+   * +optional
+   */
+  providerID?: string;
+  /**
+   * If specified, the node's taints.
+   * +optional
+   * +listType=atomic
+   */
+  taints?: Array<V1Taint>;
+  /**
+   * Unschedulable controls node schedulability of new pods. By default, node is schedulable.
+   * More info: https://kubernetes.io/docs/concepts/nodes/node/#manual-node-administration
+   * +optional
+   */
+  unschedulable?: boolean;
+};
+
+export type V1NodeStatus = {
+  /**
+   * List of addresses reachable to the node.
+   * Queried from cloud provider, if available.
+   * More info: https://kubernetes.io/docs/reference/node/node-status/#addresses
+   * Note: This field is declared as mergeable, but the merge key is not sufficiently
+   * unique, which can cause data corruption when it is merged. Callers should instead
+   * use a full-replacement patch. See https://pr.k8s.io/79391 for an example.
+   * Consumers should assume that addresses can change during the
+   * lifetime of a Node. However, there are some exceptions where this may not
+   * be possible, such as Pods that inherit a Node's address in its own status or
+   * consumers of the downward API (status.hostIP).
+   * +optional
+   * +patchMergeKey=type
+   * +patchStrategy=merge
+   * +listType=map
+   * +listMapKey=type
+   */
+  addresses?: Array<V1NodeAddress>;
+  /**
+   * Allocatable represents the resources of a node that are available for scheduling.
+   * Defaults to Capacity.
+   * +optional
+   */
+  allocatable?: V1ResourceList;
+  /**
+   * Capacity represents the total resources of a node.
+   * More info: https://kubernetes.io/docs/reference/node/node-status/#capacity
+   * +optional
+   */
+  capacity?: V1ResourceList;
+  /**
+   * Conditions is an array of current observed node conditions.
+   * More info: https://kubernetes.io/docs/reference/node/node-status/#condition
+   * +optional
+   * +patchMergeKey=type
+   * +patchStrategy=merge
+   * +listType=map
+   * +listMapKey=type
+   */
+  conditions?: Array<V1NodeCondition>;
+  /**
+   * Status of the config assigned to the node via the dynamic Kubelet config feature.
+   * +optional
+   */
+  config?: V1NodeConfigStatus;
+  /**
+   * Endpoints of daemons running on the Node.
+   * +optional
+   */
+  daemonEndpoints?: V1NodeDaemonEndpoints;
+  /**
+   * DeclaredFeatures represents the features related to feature gates that are declared by the node.
+   * +featureGate=NodeDeclaredFeatures
+   * +optional
+   * +listType=atomic
+   */
+  declaredFeatures?: Array<string>;
+  /**
+   * Features describes the set of features implemented by the CRI implementation.
+   * +featureGate=SupplementalGroupsPolicy
+   * +optional
+   */
+  features?: V1NodeFeatures;
+  /**
+   * List of container images on this node
+   * +optional
+   * +listType=atomic
+   */
+  images?: Array<V1ContainerImage>;
+  /**
+   * Set of ids/uuids to uniquely identify the node.
+   * More info: https://kubernetes.io/docs/reference/node/node-status/#info
+   * +optional
+   */
+  nodeInfo?: V1NodeSystemInfo;
+  /**
+   * NodePhase is the recently observed lifecycle phase of the node.
+   * More info: https://kubernetes.io/docs/concepts/nodes/node/#phase
+   * The field is never populated, and now is deprecated.
+   * +optional
+   */
+  phase?: V1NodePhase;
+  /**
+   * The available runtime handlers.
+   * +featureGate=UserNamespacesSupport
+   * +optional
+   * +listType=atomic
+   */
+  runtimeHandlers?: Array<V1NodeRuntimeHandler>;
+  /**
+   * List of volumes that are attached to the node.
+   * +optional
+   * +listType=atomic
+   */
+  volumesAttached?: Array<V1AttachedVolume>;
+  /**
+   * List of attachable volumes in use (mounted) by the node.
+   * +optional
+   * +listType=atomic
+   */
+  volumesInUse?: Array<string>;
+};
+
+export type V1NodeSwapStatus = {
+  /**
+   * Total amount of swap memory in bytes.
+   * +optional
+   */
+  capacity?: number;
+};
+
+export type V1NodeSystemInfo = {
+  /**
+   * The Architecture reported by the node
+   */
+  architecture?: string;
+  /**
+   * Boot ID reported by the node.
+   */
+  bootID?: string;
+  /**
+   * ContainerRuntime Version reported by the node through runtime remote API (e.g. containerd://1.4.2).
+   */
+  containerRuntimeVersion?: string;
+  /**
+   * Kernel Version reported by the node from 'uname -r' (e.g. 3.16.0-0.bpo.4-amd64).
+   */
+  kernelVersion?: string;
+  /**
+   * Deprecated: KubeProxy Version reported by the node.
+   */
+  kubeProxyVersion?: string;
+  /**
+   * Kubelet Version reported by the node.
+   */
+  kubeletVersion?: string;
+  /**
+   * MachineID reported by the node. For unique machine identification
+   * in the cluster this field is preferred. Learn more from man(5)
+   * machine-id: http://man7.org/linux/man-pages/man5/machine-id.5.html
+   */
+  machineID?: string;
+  /**
+   * The Operating System reported by the node
+   */
+  operatingSystem?: string;
+  /**
+   * OS Image reported by the node from /etc/os-release (e.g. Debian GNU/Linux 7 (wheezy)).
+   */
+  osImage?: string;
+  /**
+   * Swap Info reported by the node.
+   */
+  swap?: V1NodeSwapStatus;
+  /**
+   * SystemUUID reported by the node. For unique machine identification
+   * MachineID is preferred. This field is specific to Red Hat hosts
+   * https://access.redhat.com/documentation/en-us/red_hat_subscription_management/1/html/rhsm/uuid
+   */
+  systemUUID?: string;
+};
+
+export type V1ObjectFieldSelector = {
+  /**
+   * Version of the schema the FieldPath is written in terms of, defaults to "v1".
+   * +optional
+   */
+  apiVersion?: string;
+  /**
+   * Path of the field to select in the specified API version.
+   */
+  fieldPath?: string;
+};
+
+export type V1ObjectMeta = {
+  /**
+   * Annotations is an unstructured key value map stored with a resource that may be
+   * set by external tools to store and retrieve arbitrary metadata. They are not
+   * queryable and should be preserved when modifying objects.
+   * More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
+   * +optional
+   */
+  annotations?: {
+    [key: string]: string;
+  };
+  /**
+   * CreationTimestamp is a timestamp representing the server time when this object was
+   * created. It is not guaranteed to be set in happens-before order across separate operations.
+   * Clients may not set this value. It is represented in RFC3339 form and is in UTC.
+   *
+   * Populated by the system.
+   * Read-only.
+   * Null for lists.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+   * +optional
+   */
+  creationTimestamp?: string;
+  /**
+   * Number of seconds allowed for this object to gracefully terminate before
+   * it will be removed from the system. Only set when deletionTimestamp is also set.
+   * May only be shortened.
+   * Read-only.
+   * +optional
+   */
+  deletionGracePeriodSeconds?: number;
+  /**
+   * DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This
+   * field is set by the server when a graceful deletion is requested by the user, and is not
+   * directly settable by a client. The resource is expected to be deleted (no longer visible
+   * from resource lists, and not reachable by name) after the time in this field, once the
+   * finalizers list is empty. As long as the finalizers list contains items, deletion is blocked.
+   * Once the deletionTimestamp is set, this value may not be unset or be set further into the
+   * future, although it may be shortened or the resource may be deleted prior to this time.
+   * For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react
+   * by sending a graceful termination signal to the containers in the pod. After that 30 seconds,
+   * the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup,
+   * remove the pod from the API. In the presence of network partitions, this object may still
+   * exist after this timestamp, until an administrator or automated process can determine the
+   * resource is fully terminated.
+   * If not set, graceful deletion of the object has not been requested.
+   *
+   * Populated by the system when a graceful deletion is requested.
+   * Read-only.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+   * +optional
+   */
+  deletionTimestamp?: string;
+  /**
+   * Must be empty before the object is deleted from the registry. Each entry
+   * is an identifier for the responsible component that will remove the entry
+   * from the list. If the deletionTimestamp of the object is non-nil, entries
+   * in this list can only be removed.
+   * Finalizers may be processed and removed in any order.  Order is NOT enforced
+   * because it introduces significant risk of stuck finalizers.
+   * finalizers is a shared field, any actor with permission can reorder it.
+   * If the finalizer list is processed in order, then this can lead to a situation
+   * in which the component responsible for the first finalizer in the list is
+   * waiting for a signal (field value, external system, or other) produced by a
+   * component responsible for a finalizer later in the list, resulting in a deadlock.
+   * Without enforced ordering finalizers are free to order amongst themselves and
+   * are not vulnerable to ordering changes in the list.
+   * +optional
+   * +patchStrategy=merge
+   * +listType=set
+   */
+  finalizers?: Array<string>;
+  /**
+   * GenerateName is an optional prefix, used by the server, to generate a unique
+   * name ONLY IF the Name field has not been provided.
+   * If this field is used, the name returned to the client will be different
+   * than the name passed. This value will also be combined with a unique suffix.
+   * The provided value has the same validation rules as the Name field,
+   * and may be truncated by the length of the suffix required to make the value
+   * unique on the server.
+   *
+   * If this field is specified and the generated name exists, the server will return a 409.
+   *
+   * Applied only if Name is not specified.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency
+   * +optional
+   */
+  generateName?: string;
+  /**
+   * A sequence number representing a specific generation of the desired state.
+   * Populated by the system. Read-only.
+   * +optional
+   */
+  generation?: number;
+  /**
+   * Map of string keys and values that can be used to organize and categorize
+   * (scope and select) objects. May match selectors of replication controllers
+   * and services.
+   * More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
+   * +optional
+   */
+  labels?: {
+    [key: string]: string;
+  };
+  /**
+   * ManagedFields maps workflow-id and version to the set of fields
+   * that are managed by that workflow. This is mostly for internal
+   * housekeeping, and users typically shouldn't need to set or
+   * understand this field. A workflow can be the user's name, a
+   * controller's name, or the name of a specific apply path like
+   * "ci-cd". The set of fields is always in the version that the
+   * workflow used when modifying the object.
+   *
+   * +optional
+   * +listType=atomic
+   */
+  managedFields?: Array<V1ManagedFieldsEntry>;
+  /**
+   * Name must be unique within a namespace. Is required when creating resources, although
+   * some resources may allow a client to request the generation of an appropriate name
+   * automatically. Name is primarily intended for creation idempotence and configuration
+   * definition.
+   * Cannot be updated.
+   * More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
+   * +optional
+   */
+  name?: string;
+  /**
+   * Namespace defines the space within which each name must be unique. An empty namespace is
+   * equivalent to the "default" namespace, but "default" is the canonical representation.
+   * Not all objects are required to be scoped to a namespace - the value of this field for
+   * those objects will be empty.
+   *
+   * Must be a DNS_LABEL.
+   * Cannot be updated.
+   * More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces
+   * +optional
+   */
+  namespace?: string;
+  /**
+   * List of objects depended by this object. If ALL objects in the list have
+   * been deleted, this object will be garbage collected. If this object is managed by a controller,
+   * then an entry in this list will point to this controller, with the controller field set to true.
+   * There cannot be more than one managing controller.
+   * +optional
+   * +patchMergeKey=uid
+   * +patchStrategy=merge
+   * +listType=map
+   * +listMapKey=uid
+   */
+  ownerReferences?: Array<V1OwnerReference>;
+  /**
+   * An opaque value that represents the internal version of this object that can
+   * be used by clients to determine when objects have changed. May be used for optimistic
+   * concurrency, change detection, and the watch operation on a resource or set of resources.
+   * Clients must treat these values as opaque and passed unmodified back to the server.
+   * They may only be valid for a particular resource or set of resources.
+   *
+   * Populated by the system.
+   * Read-only.
+   * Value must be treated as opaque by clients and .
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
+   * +optional
+   */
+  resourceVersion?: string;
+  /**
+   * Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.
+   * +optional
+   */
+  selfLink?: string;
+  /**
+   * UID is the unique in time and space value for this object. It is typically generated by
+   * the server on successful creation of a resource and is not allowed to change on PUT
+   * operations.
+   *
+   * Populated by the system.
+   * Read-only.
+   * More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids
+   * +optional
+   */
+  uid?: string;
+};
+
+export type V1OwnerReference = {
+  /**
+   * API version of the referent.
+   */
+  apiVersion?: string;
+  /**
+   * If true, AND if the owner has the "foregroundDeletion" finalizer, then
+   * the owner cannot be deleted from the key-value store until this
+   * reference is removed.
+   * See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion
+   * for how the garbage collector interacts with this field and enforces the foreground deletion.
+   * Defaults to false.
+   * To set this field, a user needs "delete" permission of the owner,
+   * otherwise 422 (Unprocessable Entity) will be returned.
+   * +optional
+   */
+  blockOwnerDeletion?: boolean;
+  /**
+   * If true, this reference points to the managing controller.
+   * +optional
+   */
+  controller?: boolean;
+  /**
+   * Kind of the referent.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+   */
+  kind?: string;
+  /**
+   * Name of the referent.
+   * More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
+   */
+  name?: string;
+  /**
+   * UID of the referent.
+   * More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids
+   */
+  uid?: string;
+};
+
+export const V1PersistentVolumeAccessMode = {
+  /**
+   * ReadWriteOnce
+   */
+  READ_WRITE_ONCE: 'ReadWriteOnce',
+  /**
+   * ReadOnlyMany
+   */
+  READ_ONLY_MANY: 'ReadOnlyMany',
+  /**
+   * ReadWriteMany
+   */
+  READ_WRITE_MANY: 'ReadWriteMany',
+  /**
+   * ReadWriteOncePod
+   */
+  READ_WRITE_ONCE_POD: 'ReadWriteOncePod',
+} as const;
+
+export type V1PersistentVolumeAccessMode =
+  (typeof V1PersistentVolumeAccessMode)[keyof typeof V1PersistentVolumeAccessMode];
+
+export const V1PersistentVolumeClaimPhase = {
+  /**
+   * ClaimPending
+   */
+  CLAIM_PENDING: 'Pending',
+  /**
+   * ClaimBound
+   */
+  CLAIM_BOUND: 'Bound',
+  /**
+   * ClaimLost
+   */
+  CLAIM_LOST: 'Lost',
+} as const;
+
+export type V1PersistentVolumeClaimPhase =
+  (typeof V1PersistentVolumeClaimPhase)[keyof typeof V1PersistentVolumeClaimPhase];
+
+export const V1PersistentVolumeMode = {
+  /**
+   * PersistentVolumeBlock
+   */
+  PERSISTENT_VOLUME_BLOCK: 'Block' /**
+   * PersistentVolumeFilesystem
+   */,
+  PERSISTENT_VOLUME_FILESYSTEM: 'Filesystem',
+} as const;
+
+export type V1PersistentVolumeMode =
+  (typeof V1PersistentVolumeMode)[keyof typeof V1PersistentVolumeMode];
+
+export const V1PersistentVolumePhase = {
+  /**
+   * VolumePending
+   */
+  VOLUME_PENDING: 'Pending',
+  /**
+   * VolumeAvailable
+   */
+  VOLUME_AVAILABLE: 'Available',
+  /**
+   * VolumeBound
+   */
+  VOLUME_BOUND: 'Bound',
+  /**
+   * VolumeReleased
+   */
+  VOLUME_RELEASED: 'Released',
+  /**
+   * VolumeFailed
+   */
+  VOLUME_FAILED: 'Failed',
+} as const;
+
+export type V1PersistentVolumePhase =
+  (typeof V1PersistentVolumePhase)[keyof typeof V1PersistentVolumePhase];
+
+export const V1PersistentVolumeReclaimPolicy = {
+  /**
+   * PersistentVolumeReclaimRecycle
+   */
+  PERSISTENT_VOLUME_RECLAIM_RECYCLE: 'Recycle',
+  /**
+   * PersistentVolumeReclaimDelete
+   */
+  PERSISTENT_VOLUME_RECLAIM_DELETE: 'Delete',
+  /**
+   * PersistentVolumeReclaimRetain
+   */
+  PERSISTENT_VOLUME_RECLAIM_RETAIN: 'Retain',
+} as const;
+
+export type V1PersistentVolumeReclaimPolicy =
+  (typeof V1PersistentVolumeReclaimPolicy)[keyof typeof V1PersistentVolumeReclaimPolicy];
+
+export type V1Probe = {
+  /**
+   * Exec specifies a command to execute in the container.
+   * +optional
+   */
+  exec?: V1ExecAction;
+  /**
+   * Minimum consecutive failures for the probe to be considered failed after having succeeded.
+   * Defaults to 3. Minimum value is 1.
+   * +optional
+   */
+  failureThreshold?: number;
+  /**
+   * GRPC specifies a GRPC HealthCheckRequest.
+   * +optional
+   */
+  grpc?: V1GrpcAction;
+  /**
+   * HTTPGet specifies an HTTP GET request to perform.
+   * +optional
+   */
+  httpGet?: V1HttpGetAction;
+  /**
+   * Number of seconds after the container has started before liveness probes are initiated.
+   * More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+   * +optional
+   */
+  initialDelaySeconds?: number;
+  /**
+   * How often (in seconds) to perform the probe.
+   * Default to 10 seconds. Minimum value is 1.
+   * +optional
+   */
+  periodSeconds?: number;
+  /**
+   * Minimum consecutive successes for the probe to be considered successful after having failed.
+   * Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
+   * +optional
+   */
+  successThreshold?: number;
+  /**
+   * TCPSocket specifies a connection to a TCP port.
+   * +optional
+   */
+  tcpSocket?: V1TcpSocketAction;
+  /**
+   * Optional duration in seconds the pod needs to terminate gracefully upon probe failure.
+   * The grace period is the duration in seconds after the processes running in the pod are sent
+   * a termination signal and the time when the processes are forcibly halted with a kill signal.
+   * Set this value longer than the expected cleanup time for your process.
+   * If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this
+   * value overrides the value provided by the pod spec.
+   * Value must be non-negative integer. The value zero indicates stop immediately via
+   * the kill signal (no opportunity to shut down).
+   * This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.
+   * Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset.
+   * +optional
+   */
+  terminationGracePeriodSeconds?: number;
+  /**
+   * Number of seconds after which the probe times out.
+   * Defaults to 1 second. Minimum value is 1.
+   * More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+   * +optional
+   */
+  timeoutSeconds?: number;
+};
+
+export const V1ProcMountType = {
+  /**
+   * DefaultProcMount
+   */
+  DEFAULT_PROC_MOUNT: 'Default' /**
+   * UnmaskedProcMount
+   */,
+  UNMASKED_PROC_MOUNT: 'Unmasked',
+} as const;
+
+export type V1ProcMountType =
+  (typeof V1ProcMountType)[keyof typeof V1ProcMountType];
+
+export const V1Protocol = {
+  /**
+   * ProtocolTCP
+   */
+  PROTOCOL_TCP: 'TCP',
+  /**
+   * ProtocolUDP
+   */
+  PROTOCOL_UDP: 'UDP',
+  /**
+   * ProtocolSCTP
+   */
+  PROTOCOL_SCTP: 'SCTP',
+} as const;
+
+export type V1Protocol = (typeof V1Protocol)[keyof typeof V1Protocol];
+
+export const V1PullPolicy = {
+  /**
+   * PullAlways
+   */
+  PULL_ALWAYS: 'Always',
+  /**
+   * PullNever
+   */
+  PULL_NEVER: 'Never',
+  /**
+   * PullIfNotPresent
+   */
+  PULL_IF_NOT_PRESENT: 'IfNotPresent',
+} as const;
+
+export type V1PullPolicy = (typeof V1PullPolicy)[keyof typeof V1PullPolicy];
+
+export const V1RecursiveReadOnlyMode = {
+  /**
+   * RecursiveReadOnlyDisabled
+   */
+  RECURSIVE_READ_ONLY_DISABLED: 'Disabled',
+  /**
+   * RecursiveReadOnlyIfPossible
+   */
+  RECURSIVE_READ_ONLY_IF_POSSIBLE: 'IfPossible',
+  /**
+   * RecursiveReadOnlyEnabled
+   */
+  RECURSIVE_READ_ONLY_ENABLED: 'Enabled',
+} as const;
+
+export type V1RecursiveReadOnlyMode =
+  (typeof V1RecursiveReadOnlyMode)[keyof typeof V1RecursiveReadOnlyMode];
+
+export type V1ResourceFieldSelector = {
+  /**
+   * Container name: required for volumes, optional for env vars
+   * +optional
+   */
+  containerName?: string;
+  /**
+   * Specifies the output format of the exposed resources, defaults to "1"
+   * +optional
+   */
+  divisor?: ResourceQuantity;
+  /**
+   * Required: resource to select
+   */
+  resource?: string;
+};
+
+export type V1ResourceList = {
+  [key: string]: ResourceQuantity;
+};
+
+export const V1ResourceName = {
+  /**
+   * ResourceCPU
+   */
+  RESOURCE_CPU: 'cpu',
+  /**
+   * ResourceMemory
+   */
+  RESOURCE_MEMORY: 'memory',
+  /**
+   * ResourceStorage
+   */
+  RESOURCE_STORAGE: 'storage',
+  /**
+   * ResourceEphemeralStorage
+   */
+  RESOURCE_EPHEMERAL_STORAGE: 'ephemeral-storage',
+  /**
+   * ResourcePods
+   */
+  RESOURCE_PODS: 'pods',
+  /**
+   * ResourceServices
+   */
+  RESOURCE_SERVICES: 'services',
+  /**
+   * ResourceReplicationControllers
+   */
+  RESOURCE_REPLICATION_CONTROLLERS: 'replicationcontrollers',
+  /**
+   * ResourceQuotas
+   */
+  RESOURCE_QUOTAS: 'resourcequotas',
+  /**
+   * ResourceSecrets
+   */
+  RESOURCE_SECRETS: 'secrets',
+  /**
+   * ResourceConfigMaps
+   */
+  RESOURCE_CONFIG_MAPS: 'configmaps',
+  /**
+   * ResourcePersistentVolumeClaims
+   */
+  RESOURCE_PERSISTENT_VOLUME_CLAIMS: 'persistentvolumeclaims',
+  /**
+   * ResourceServicesNodePorts
+   */
+  RESOURCE_SERVICES_NODE_PORTS: 'services.nodeports',
+  /**
+   * ResourceServicesLoadBalancers
+   */
+  RESOURCE_SERVICES_LOAD_BALANCERS: 'services.loadbalancers',
+  /**
+   * ResourceRequestsCPU
+   */
+  RESOURCE_REQUESTS_CPU: 'requests.cpu',
+  /**
+   * ResourceRequestsMemory
+   */
+  RESOURCE_REQUESTS_MEMORY: 'requests.memory',
+  /**
+   * ResourceRequestsStorage
+   */
+  RESOURCE_REQUESTS_STORAGE: 'requests.storage',
+  /**
+   * ResourceRequestsEphemeralStorage
+   */
+  RESOURCE_REQUESTS_EPHEMERAL_STORAGE: 'requests.ephemeral-storage',
+  /**
+   * ResourceLimitsCPU
+   */
+  RESOURCE_LIMITS_CPU: 'limits.cpu',
+  /**
+   * ResourceLimitsMemory
+   */
+  RESOURCE_LIMITS_MEMORY: 'limits.memory',
+  /**
+   * ResourceLimitsEphemeralStorage
+   */
+  RESOURCE_LIMITS_EPHEMERAL_STORAGE: 'limits.ephemeral-storage',
+} as const;
+
+export type V1ResourceName =
+  (typeof V1ResourceName)[keyof typeof V1ResourceName];
+
+export type V1ResourceQuota = {
+  /**
+   * APIVersion defines the versioned schema of this representation of an object.
+   * Servers should convert recognized schemas to the latest internal value, and
+   * may reject unrecognized values.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+   * +optional
+   */
+  apiVersion?: string;
+  /**
+   * Kind is a string value representing the REST resource this object represents.
+   * Servers may infer this from the endpoint the client submits requests to.
+   * Cannot be updated.
+   * In CamelCase.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+   * +optional
+   */
+  kind?: string;
+  /**
+   * Standard object's metadata.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+   * +optional
+   */
+  metadata?: V1ObjectMeta;
+  /**
+   * Spec defines the desired quota.
+   * https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+   * +optional
+   */
+  spec?: V1ResourceQuotaSpec;
+  /**
+   * Status defines the actual enforced quota and its current usage.
+   * https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+   * +optional
+   */
+  status?: V1ResourceQuotaStatus;
+};
+
+export const V1ResourceQuotaScope = {
+  /**
+   * ResourceQuotaScopeTerminating
+   */
+  RESOURCE_QUOTA_SCOPE_TERMINATING: 'Terminating',
+  /**
+   * ResourceQuotaScopeNotTerminating
+   */
+  RESOURCE_QUOTA_SCOPE_NOT_TERMINATING: 'NotTerminating',
+  /**
+   * ResourceQuotaScopeBestEffort
+   */
+  RESOURCE_QUOTA_SCOPE_BEST_EFFORT: 'BestEffort',
+  /**
+   * ResourceQuotaScopeNotBestEffort
+   */
+  RESOURCE_QUOTA_SCOPE_NOT_BEST_EFFORT: 'NotBestEffort',
+  /**
+   * ResourceQuotaScopePriorityClass
+   */
+  RESOURCE_QUOTA_SCOPE_PRIORITY_CLASS: 'PriorityClass',
+  /**
+   * ResourceQuotaScopeCrossNamespacePodAffinity
+   */
+  RESOURCE_QUOTA_SCOPE_CROSS_NAMESPACE_POD_AFFINITY:
+    'CrossNamespacePodAffinity',
+  /**
+   * ResourceQuotaScopeVolumeAttributesClass
+   */
+  RESOURCE_QUOTA_SCOPE_VOLUME_ATTRIBUTES_CLASS: 'VolumeAttributesClass',
+} as const;
+
+export type V1ResourceQuotaScope =
+  (typeof V1ResourceQuotaScope)[keyof typeof V1ResourceQuotaScope];
+
+export type V1ResourceQuotaSpec = {
+  /**
+   * hard is the set of desired hard limits for each named resource.
+   * More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/
+   * +optional
+   */
+  hard?: V1ResourceList;
+  /**
+   * scopeSelector is also a collection of filters like scopes that must match each object tracked by a quota
+   * but expressed using ScopeSelectorOperator in combination with possible values.
+   * For a resource to match, both scopes AND scopeSelector (if specified in spec), must be matched.
+   * +optional
+   */
+  scopeSelector?: V1ScopeSelector;
+  /**
+   * A collection of filters that must match each object tracked by a quota.
+   * If not specified, the quota matches all objects.
+   * +optional
+   * +listType=atomic
+   */
+  scopes?: Array<V1ResourceQuotaScope>;
+};
+
+export type V1ResourceQuotaStatus = {
+  /**
+   * Hard is the set of enforced hard limits for each named resource.
+   * More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/
+   * +optional
+   */
+  hard?: V1ResourceList;
+  /**
+   * Used is the current observed total usage of the resource in the namespace.
+   * +optional
+   */
+  used?: V1ResourceList;
+};
+
+export type V1ResourceRequirements = {
+  /**
+   * Claims lists the names of resources, defined in spec.resourceClaims,
+   * that are used by this container.
+   *
+   * This field depends on the
+   * DynamicResourceAllocation feature gate.
+   *
+   * This field is immutable. It can only be set for containers.
+   *
+   * +listType=map
+   * +listMapKey=name
+   * +featureGate=DynamicResourceAllocation
+   * +optional
+   */
+  claims?: Array<K8sIoApiCoreV1ResourceClaim>;
+  /**
+   * Limits describes the maximum amount of compute resources allowed.
+   * More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+   * +optional
+   */
+  limits?: V1ResourceList;
+  /**
+   * Requests describes the minimum amount of compute resources required.
+   * If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+   * otherwise to an implementation-defined value. Requests cannot exceed Limits.
+   * More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+   * +optional
+   */
+  requests?: V1ResourceList;
+};
+
+export const V1ResourceResizeRestartPolicy = {
+  /**
+   * NotRequired
+   */
+  NOT_REQUIRED: 'NotRequired' /**
+   * RestartContainer
+   */,
+  RESTART_CONTAINER: 'RestartContainer',
+} as const;
+
+export type V1ResourceResizeRestartPolicy =
+  (typeof V1ResourceResizeRestartPolicy)[keyof typeof V1ResourceResizeRestartPolicy];
+
+export type V1RoleRef = {
+  /**
+   * APIGroup is the group for the resource being referenced
+   */
+  apiGroup?: string;
+  /**
+   * Kind is the type of resource being referenced
+   */
+  kind?: string;
+  /**
+   * Name is the name of resource being referenced
+   * +required
+   * +k8s:required
+   */
+  name?: string;
+};
+
+export type V1SeLinuxOptions = {
+  /**
+   * Level is SELinux level label that applies to the container.
+   * +optional
+   */
+  level?: string;
+  /**
+   * Role is a SELinux role label that applies to the container.
+   * +optional
+   */
+  role?: string;
+  /**
+   * Type is a SELinux type label that applies to the container.
+   * +optional
+   */
+  type?: string;
+  /**
+   * User is a SELinux user label that applies to the container.
+   * +optional
+   */
+  user?: string;
+};
+
+export type V1ScopeSelector = {
+  /**
+   * A list of scope selector requirements by scope of the resources.
+   * +optional
+   * +listType=atomic
+   */
+  matchExpressions?: Array<V1ScopedResourceSelectorRequirement>;
+};
+
+export const V1ScopeSelectorOperator = {
+  /**
+   * ScopeSelectorOpIn
+   */
+  SCOPE_SELECTOR_OP_IN: 'In',
+  /**
+   * ScopeSelectorOpNotIn
+   */
+  SCOPE_SELECTOR_OP_NOT_IN: 'NotIn',
+  /**
+   * ScopeSelectorOpExists
+   */
+  SCOPE_SELECTOR_OP_EXISTS: 'Exists',
+  /**
+   * ScopeSelectorOpDoesNotExist
+   */
+  SCOPE_SELECTOR_OP_DOES_NOT_EXIST: 'DoesNotExist',
+} as const;
+
+export type V1ScopeSelectorOperator =
+  (typeof V1ScopeSelectorOperator)[keyof typeof V1ScopeSelectorOperator];
+
+export type V1ScopedResourceSelectorRequirement = {
+  /**
+   * Represents a scope's relationship to a set of values.
+   * Valid operators are In, NotIn, Exists, DoesNotExist.
+   */
+  operator?: V1ScopeSelectorOperator;
+  /**
+   * The name of the scope that the selector applies to.
+   */
+  scopeName?: V1ResourceQuotaScope;
+  /**
+   * An array of string values. If the operator is In or NotIn,
+   * the values array must be non-empty. If the operator is Exists or DoesNotExist,
+   * the values array must be empty.
+   * This array is replaced during a strategic merge patch.
+   * +optional
+   * +listType=atomic
+   */
+  values?: Array<string>;
+};
+
+export type V1SeccompProfile = {
+  /**
+   * localhostProfile indicates a profile defined in a file on the node should be used.
+   * The profile must be preconfigured on the node to work.
+   * Must be a descending path, relative to the kubelet's configured seccomp profile location.
+   * Must be set if type is "Localhost". Must NOT be set for any other type.
+   * +optional
+   */
+  localhostProfile?: string;
+  /**
+   * type indicates which kind of seccomp profile will be applied.
+   * Valid options are:
+   *
+   * Localhost - a profile defined in a file on the node should be used.
+   * RuntimeDefault - the container runtime default profile should be used.
+   * Unconfined - no profile should be applied.
+   * +unionDiscriminator
+   */
+  type?: V1SeccompProfileType;
+};
+
+export const V1SeccompProfileType = {
+  /**
+   * SeccompProfileTypeUnconfined
+   */
+  SECCOMP_PROFILE_TYPE_UNCONFINED: 'Unconfined',
+  /**
+   * SeccompProfileTypeRuntimeDefault
+   */
+  SECCOMP_PROFILE_TYPE_RUNTIME_DEFAULT: 'RuntimeDefault',
+  /**
+   * SeccompProfileTypeLocalhost
+   */
+  SECCOMP_PROFILE_TYPE_LOCALHOST: 'Localhost',
+} as const;
+
+export type V1SeccompProfileType =
+  (typeof V1SeccompProfileType)[keyof typeof V1SeccompProfileType];
+
+export type V1SecretEnvSource = {
+  /**
+   * Name of the referent.
+   * This field is effectively required, but due to backwards compatibility is
+   * allowed to be empty. Instances of this type with an empty value here are
+   * almost certainly wrong.
+   * More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+   * +optional
+   * +default=""
+   * +kubebuilder:default=""
+   * TODO: Drop `kubebuilder:default` when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.
+   */
+  name?: string;
+  /**
+   * Specify whether the Secret must be defined
+   * +optional
+   */
+  optional?: boolean;
+};
+
+export type V1SecretKeySelector = {
+  /**
+   * The key of the secret to select from.  Must be a valid secret key.
+   */
+  key?: string;
+  /**
+   * Name of the referent.
+   * This field is effectively required, but due to backwards compatibility is
+   * allowed to be empty. Instances of this type with an empty value here are
+   * almost certainly wrong.
+   * More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+   * +optional
+   * +default=""
+   * +kubebuilder:default=""
+   * TODO: Drop `kubebuilder:default` when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.
+   */
+  name?: string;
+  /**
+   * Specify whether the Secret or its key must be defined
+   * +optional
+   */
+  optional?: boolean;
+};
+
+export type V1SecretReference = {
+  /**
+   * name is unique within a namespace to reference a secret resource.
+   * +optional
+   */
+  name?: string;
+  /**
+   * namespace defines the space within which the secret name must be unique.
+   * +optional
+   */
+  namespace?: string;
+};
+
+export type V1SecurityContext = {
+  /**
+   * AllowPrivilegeEscalation controls whether a process can gain more
+   * privileges than its parent process. This bool directly controls if
+   * the no_new_privs flag will be set on the container process.
+   * AllowPrivilegeEscalation is true always when the container is:
+   * 1) run as Privileged
+   * 2) has CAP_SYS_ADMIN
+   * Note that this field cannot be set when spec.os.name is windows.
+   * +optional
+   */
+  allowPrivilegeEscalation?: boolean;
+  /**
+   * appArmorProfile is the AppArmor options to use by this container. If set, this profile
+   * overrides the pod's appArmorProfile.
+   * Note that this field cannot be set when spec.os.name is windows.
+   * +optional
+   */
+  appArmorProfile?: V1AppArmorProfile;
+  /**
+   * The capabilities to add/drop when running containers.
+   * Defaults to the default set of capabilities granted by the container runtime.
+   * Note that this field cannot be set when spec.os.name is windows.
+   * +optional
+   */
+  capabilities?: V1Capabilities;
+  /**
+   * Run container in privileged mode.
+   * Processes in privileged containers are essentially equivalent to root on the host.
+   * Defaults to false.
+   * Note that this field cannot be set when spec.os.name is windows.
+   * +optional
+   */
+  privileged?: boolean;
+  /**
+   * procMount denotes the type of proc mount to use for the containers.
+   * The default value is Default which uses the container runtime defaults for
+   * readonly paths and masked paths.
+   * This requires the ProcMountType feature flag to be enabled.
+   * Note that this field cannot be set when spec.os.name is windows.
+   * +optional
+   */
+  procMount?: V1ProcMountType;
+  /**
+   * Whether this container has a read-only root filesystem.
+   * Default is false.
+   * Note that this field cannot be set when spec.os.name is windows.
+   * +optional
+   */
+  readOnlyRootFilesystem?: boolean;
+  /**
+   * The GID to run the entrypoint of the container process.
+   * Uses runtime default if unset.
+   * May also be set in PodSecurityContext.  If set in both SecurityContext and
+   * PodSecurityContext, the value specified in SecurityContext takes precedence.
+   * Note that this field cannot be set when spec.os.name is windows.
+   * +optional
+   */
+  runAsGroup?: number;
+  /**
+   * Indicates that the container must run as a non-root user.
+   * If true, the Kubelet will validate the image at runtime to ensure that it
+   * does not run as UID 0 (root) and fail to start the container if it does.
+   * If unset or false, no such validation will be performed.
+   * May also be set in PodSecurityContext.  If set in both SecurityContext and
+   * PodSecurityContext, the value specified in SecurityContext takes precedence.
+   * +optional
+   */
+  runAsNonRoot?: boolean;
+  /**
+   * The UID to run the entrypoint of the container process.
+   * Defaults to user specified in image metadata if unspecified.
+   * May also be set in PodSecurityContext.  If set in both SecurityContext and
+   * PodSecurityContext, the value specified in SecurityContext takes precedence.
+   * Note that this field cannot be set when spec.os.name is windows.
+   * +optional
+   */
+  runAsUser?: number;
+  /**
+   * The SELinux context to be applied to the container.
+   * If unspecified, the container runtime will allocate a random SELinux context for each
+   * container.  May also be set in PodSecurityContext.  If set in both SecurityContext and
+   * PodSecurityContext, the value specified in SecurityContext takes precedence.
+   * Note that this field cannot be set when spec.os.name is windows.
+   * +optional
+   */
+  seLinuxOptions?: V1SeLinuxOptions;
+  /**
+   * The seccomp options to use by this container. If seccomp options are
+   * provided at both the pod & container level, the container options
+   * override the pod options.
+   * Note that this field cannot be set when spec.os.name is windows.
+   * +optional
+   */
+  seccompProfile?: V1SeccompProfile;
+  /**
+   * The Windows specific settings applied to all containers.
+   * If unspecified, the options from the PodSecurityContext will be used.
+   * If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
+   * Note that this field cannot be set when spec.os.name is linux.
+   * +optional
+   */
+  windowsOptions?: V1WindowsSecurityContextOptions;
+};
+
+export const V1Signal = {
+  /**
+   * SIGABRT
+   */
+  SIGABRT: 'SIGABRT',
+  /**
+   * SIGALRM
+   */
+  SIGALRM: 'SIGALRM',
+  /**
+   * SIGBUS
+   */
+  SIGBUS: 'SIGBUS',
+  /**
+   * SIGCHLD
+   */
+  SIGCHLD: 'SIGCHLD',
+  /**
+   * SIGCLD
+   */
+  SIGCLD: 'SIGCLD',
+  /**
+   * SIGCONT
+   */
+  SIGCONT: 'SIGCONT',
+  /**
+   * SIGFPE
+   */
+  SIGFPE: 'SIGFPE',
+  /**
+   * SIGHUP
+   */
+  SIGHUP: 'SIGHUP',
+  /**
+   * SIGILL
+   */
+  SIGILL: 'SIGILL',
+  /**
+   * SIGINT
+   */
+  SIGINT: 'SIGINT',
+  /**
+   * SIGIO
+   */
+  SIGIO: 'SIGIO',
+  /**
+   * SIGIOT
+   */
+  SIGIOT: 'SIGIOT',
+  /**
+   * SIGKILL
+   */
+  SIGKILL: 'SIGKILL',
+  /**
+   * SIGPIPE
+   */
+  SIGPIPE: 'SIGPIPE',
+  /**
+   * SIGPOLL
+   */
+  SIGPOLL: 'SIGPOLL',
+  /**
+   * SIGPROF
+   */
+  SIGPROF: 'SIGPROF',
+  /**
+   * SIGPWR
+   */
+  SIGPWR: 'SIGPWR',
+  /**
+   * SIGQUIT
+   */
+  SIGQUIT: 'SIGQUIT',
+  /**
+   * SIGSEGV
+   */
+  SIGSEGV: 'SIGSEGV',
+  /**
+   * SIGSTKFLT
+   */
+  SIGSTKFLT: 'SIGSTKFLT',
+  /**
+   * SIGSTOP
+   */
+  SIGSTOP: 'SIGSTOP',
+  /**
+   * SIGSYS
+   */
+  SIGSYS: 'SIGSYS',
+  /**
+   * SIGTERM
+   */
+  SIGTERM: 'SIGTERM',
+  /**
+   * SIGTRAP
+   */
+  SIGTRAP: 'SIGTRAP',
+  /**
+   * SIGTSTP
+   */
+  SIGTSTP: 'SIGTSTP',
+  /**
+   * SIGTTIN
+   */
+  SIGTTIN: 'SIGTTIN',
+  /**
+   * SIGTTOU
+   */
+  SIGTTOU: 'SIGTTOU',
+  /**
+   * SIGURG
+   */
+  SIGURG: 'SIGURG',
+  /**
+   * SIGUSR1
+   */
+  SIGUSR1: 'SIGUSR1',
+  /**
+   * SIGUSR2
+   */
+  SIGUSR2: 'SIGUSR2',
+  /**
+   * SIGVTALRM
+   */
+  SIGVTALRM: 'SIGVTALRM',
+  /**
+   * SIGWINCH
+   */
+  SIGWINCH: 'SIGWINCH',
+  /**
+   * SIGXCPU
+   */
+  SIGXCPU: 'SIGXCPU',
+  /**
+   * SIGXFSZ
+   */
+  SIGXFSZ: 'SIGXFSZ',
+  /**
+   * SIGRTMIN
+   */
+  SIGRTMIN: 'SIGRTMIN',
+  /**
+   * SIGRTMINPLUS1
+   */
+  SIGRTMINPLUS1: 'SIGRTMIN+1',
+  /**
+   * SIGRTMINPLUS2
+   */
+  SIGRTMINPLUS2: 'SIGRTMIN+2',
+  /**
+   * SIGRTMINPLUS3
+   */
+  SIGRTMINPLUS3: 'SIGRTMIN+3',
+  /**
+   * SIGRTMINPLUS4
+   */
+  SIGRTMINPLUS4: 'SIGRTMIN+4',
+  /**
+   * SIGRTMINPLUS5
+   */
+  SIGRTMINPLUS5: 'SIGRTMIN+5',
+  /**
+   * SIGRTMINPLUS6
+   */
+  SIGRTMINPLUS6: 'SIGRTMIN+6',
+  /**
+   * SIGRTMINPLUS7
+   */
+  SIGRTMINPLUS7: 'SIGRTMIN+7',
+  /**
+   * SIGRTMINPLUS8
+   */
+  SIGRTMINPLUS8: 'SIGRTMIN+8',
+  /**
+   * SIGRTMINPLUS9
+   */
+  SIGRTMINPLUS9: 'SIGRTMIN+9',
+  /**
+   * SIGRTMINPLUS10
+   */
+  SIGRTMINPLUS10: 'SIGRTMIN+10',
+  /**
+   * SIGRTMINPLUS11
+   */
+  SIGRTMINPLUS11: 'SIGRTMIN+11',
+  /**
+   * SIGRTMINPLUS12
+   */
+  SIGRTMINPLUS12: 'SIGRTMIN+12',
+  /**
+   * SIGRTMINPLUS13
+   */
+  SIGRTMINPLUS13: 'SIGRTMIN+13',
+  /**
+   * SIGRTMINPLUS14
+   */
+  SIGRTMINPLUS14: 'SIGRTMIN+14',
+  /**
+   * SIGRTMINPLUS15
+   */
+  SIGRTMINPLUS15: 'SIGRTMIN+15',
+  /**
+   * SIGRTMAXMINUS14
+   */
+  SIGRTMAXMINUS14: 'SIGRTMAX-14',
+  /**
+   * SIGRTMAXMINUS13
+   */
+  SIGRTMAXMINUS13: 'SIGRTMAX-13',
+  /**
+   * SIGRTMAXMINUS12
+   */
+  SIGRTMAXMINUS12: 'SIGRTMAX-12',
+  /**
+   * SIGRTMAXMINUS11
+   */
+  SIGRTMAXMINUS11: 'SIGRTMAX-11',
+  /**
+   * SIGRTMAXMINUS10
+   */
+  SIGRTMAXMINUS10: 'SIGRTMAX-10',
+  /**
+   * SIGRTMAXMINUS9
+   */
+  SIGRTMAXMINUS9: 'SIGRTMAX-9',
+  /**
+   * SIGRTMAXMINUS8
+   */
+  SIGRTMAXMINUS8: 'SIGRTMAX-8',
+  /**
+   * SIGRTMAXMINUS7
+   */
+  SIGRTMAXMINUS7: 'SIGRTMAX-7',
+  /**
+   * SIGRTMAXMINUS6
+   */
+  SIGRTMAXMINUS6: 'SIGRTMAX-6',
+  /**
+   * SIGRTMAXMINUS5
+   */
+  SIGRTMAXMINUS5: 'SIGRTMAX-5',
+  /**
+   * SIGRTMAXMINUS4
+   */
+  SIGRTMAXMINUS4: 'SIGRTMAX-4',
+  /**
+   * SIGRTMAXMINUS3
+   */
+  SIGRTMAXMINUS3: 'SIGRTMAX-3',
+  /**
+   * SIGRTMAXMINUS2
+   */
+  SIGRTMAXMINUS2: 'SIGRTMAX-2',
+  /**
+   * SIGRTMAXMINUS1
+   */
+  SIGRTMAXMINUS1: 'SIGRTMAX-1',
+  /**
+   * SIGRTMAX
+   */
+  SIGRTMAX: 'SIGRTMAX',
+} as const;
+
+export type V1Signal = (typeof V1Signal)[keyof typeof V1Signal];
+
+export type V1SleepAction = {
+  /**
+   * Seconds is the number of seconds to sleep.
+   */
+  seconds?: number;
+};
+
+export type V1TcpSocketAction = {
+  /**
+   * Optional: Host name to connect to, defaults to the pod IP.
+   * +optional
+   */
+  host?: string;
+  /**
+   * Number or name of the port to access on the container.
+   * Number must be in the range 1 to 65535.
+   * Name must be an IANA_SVC_NAME.
+   */
+  port?: IntstrIntOrString;
+};
+
+export type V1Taint = {
+  /**
+   * Required. The effect of the taint on pods
+   * that do not tolerate the taint.
+   * Valid effects are NoSchedule, PreferNoSchedule and NoExecute.
+   */
+  effect?: V1TaintEffect;
+  /**
+   * Required. The taint key to be applied to a node.
+   */
+  key?: string;
+  /**
+   * TimeAdded represents the time at which the taint was added.
+   * +optional
+   */
+  timeAdded?: string;
+  /**
+   * The taint value corresponding to the taint key.
+   * +optional
+   */
+  value?: string;
+};
+
+export const V1TaintEffect = {
+  /**
+   * TaintEffectNoSchedule
+   */
+  TAINT_EFFECT_NO_SCHEDULE: 'NoSchedule',
+  /**
+   * TaintEffectPreferNoSchedule
+   */
+  TAINT_EFFECT_PREFER_NO_SCHEDULE: 'PreferNoSchedule',
+  /**
+   * TaintEffectNoExecute
+   */
+  TAINT_EFFECT_NO_EXECUTE: 'NoExecute',
+} as const;
+
+export type V1TaintEffect = (typeof V1TaintEffect)[keyof typeof V1TaintEffect];
+
+export const V1TerminationMessagePolicy = {
+  /**
+   * TerminationMessageReadFile
+   */
+  TERMINATION_MESSAGE_READ_FILE: 'File' /**
+   * TerminationMessageFallbackToLogsOnError
+   */,
+  TERMINATION_MESSAGE_FALLBACK_TO_LOGS_ON_ERROR: 'FallbackToLogsOnError',
+} as const;
+
+export type V1TerminationMessagePolicy =
+  (typeof V1TerminationMessagePolicy)[keyof typeof V1TerminationMessagePolicy];
+
+export const V1UriScheme = {
+  /**
+   * URISchemeHTTP
+   */
+  URI_SCHEME_HTTP: 'HTTP' /**
+   * URISchemeHTTPS
+   */,
+  URI_SCHEME_HTTPS: 'HTTPS',
+} as const;
+
+export type V1UriScheme = (typeof V1UriScheme)[keyof typeof V1UriScheme];
+
+export type V1VolumeDevice = {
+  /**
+   * devicePath is the path inside of the container that the device will be mapped to.
+   */
+  devicePath?: string;
+  /**
+   * name must match the name of a persistentVolumeClaim in the pod
+   */
+  name?: string;
+};
+
+export type V1VolumeMount = {
+  /**
+   * Path within the container at which the volume should be mounted.  Must
+   * not contain ':'.
+   */
+  mountPath?: string;
+  /**
+   * mountPropagation determines how mounts are propagated from the host
+   * to container and the other way around.
+   * When not set, MountPropagationNone is used.
+   * This field is beta in 1.10.
+   * When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified
+   * (which defaults to None).
+   * +optional
+   */
+  mountPropagation?: V1MountPropagationMode;
+  /**
+   * This must match the Name of a Volume.
+   */
+  name?: string;
+  /**
+   * Mounted read-only if true, read-write otherwise (false or unspecified).
+   * Defaults to false.
+   * +optional
+   */
+  readOnly?: boolean;
+  /**
+   * RecursiveReadOnly specifies whether read-only mounts should be handled
+   * recursively.
+   *
+   * If ReadOnly is false, this field has no meaning and must be unspecified.
+   *
+   * If ReadOnly is true, and this field is set to Disabled, the mount is not made
+   * recursively read-only.  If this field is set to IfPossible, the mount is made
+   * recursively read-only, if it is supported by the container runtime.  If this
+   * field is set to Enabled, the mount is made recursively read-only if it is
+   * supported by the container runtime, otherwise the pod will not be started and
+   * an error will be generated to indicate the reason.
+   *
+   * If this field is set to IfPossible or Enabled, MountPropagation must be set to
+   * None (or be unspecified, which defaults to None).
+   *
+   * If this field is not specified, it is treated as an equivalent of Disabled.
+   * +optional
+   */
+  recursiveReadOnly?: V1RecursiveReadOnlyMode;
+  /**
+   * Path within the volume from which the container's volume should be mounted.
+   * Defaults to "" (volume's root).
+   * +optional
+   */
+  subPath?: string;
+  /**
+   * Expanded path within the volume from which the container's volume should be mounted.
+   * Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.
+   * Defaults to "" (volume's root).
+   * SubPathExpr and SubPath are mutually exclusive.
+   * +optional
+   */
+  subPathExpr?: string;
+};
+
+export type V1WindowsSecurityContextOptions = {
+  /**
+   * GMSACredentialSpec is where the GMSA admission webhook
+   * (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the
+   * GMSA credential spec named by the GMSACredentialSpecName field.
+   * +optional
+   */
+  gmsaCredentialSpec?: string;
+  /**
+   * GMSACredentialSpecName is the name of the GMSA credential spec to use.
+   * +optional
+   */
+  gmsaCredentialSpecName?: string;
+  /**
+   * HostProcess determines if a container should be run as a 'Host Process' container.
+   * All of a Pod's containers must have the same effective HostProcess value
+   * (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).
+   * In addition, if HostProcess is true then HostNetwork must also be set to true.
+   * +optional
+   */
+  hostProcess?: boolean;
+  /**
+   * The UserName in Windows to run the entrypoint of the container process.
+   * Defaults to the user specified in image metadata if unspecified.
+   * May also be set in PodSecurityContext. If set in both SecurityContext and
+   * PodSecurityContext, the value specified in SecurityContext takes precedence.
+   * +optional
+   */
+  runAsUserName?: string;
+};
+
+export type V1Beta1ContainerMetrics = {
+  /**
+   * Container name corresponding to the one from pod.spec.containers.
+   */
+  name?: string;
+  /**
+   * The memory usage is the memory working set.
+   */
+  usage?: V1ResourceList;
+};
+
+export type V1Beta1NodeMetrics = {
+  /**
+   * APIVersion defines the versioned schema of this representation of an object.
+   * Servers should convert recognized schemas to the latest internal value, and
+   * may reject unrecognized values.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+   * +optional
+   */
+  apiVersion?: string;
+  /**
+   * Kind is a string value representing the REST resource this object represents.
+   * Servers may infer this from the endpoint the client submits requests to.
+   * Cannot be updated.
+   * In CamelCase.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+   * +optional
+   */
+  kind?: string;
+  /**
+   * Standard object's metadata.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+   * +optional
+   */
+  metadata?: V1ObjectMeta;
+  /**
+   * The following fields define time interval from which metrics were
+   * collected from the interval [Timestamp-Window, Timestamp].
+   */
+  timestamp?: string;
+  /**
+   * The memory usage is the memory working set.
+   */
+  usage?: V1ResourceList;
+  window?: string;
+};
+
+export type V1Beta1NodeMetricsList = {
+  /**
+   * APIVersion defines the versioned schema of this representation of an object.
+   * Servers should convert recognized schemas to the latest internal value, and
+   * may reject unrecognized values.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+   * +optional
+   */
+  apiVersion?: string;
+  /**
+   * List of node metrics.
+   */
+  items?: Array<V1Beta1NodeMetrics>;
+  /**
+   * Kind is a string value representing the REST resource this object represents.
+   * Servers may infer this from the endpoint the client submits requests to.
+   * Cannot be updated.
+   * In CamelCase.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+   * +optional
+   */
+  kind?: string;
+  /**
+   * Standard list metadata.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+   */
+  metadata?: V1ListMeta;
+};
+
+export type V1Beta1PodMetrics = {
+  /**
+   * APIVersion defines the versioned schema of this representation of an object.
+   * Servers should convert recognized schemas to the latest internal value, and
+   * may reject unrecognized values.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+   * +optional
+   */
+  apiVersion?: string;
+  /**
+   * Metrics for all containers are collected within the same time window.
+   * +listType=atomic
+   */
+  containers?: Array<V1Beta1ContainerMetrics>;
+  /**
+   * Kind is a string value representing the REST resource this object represents.
+   * Servers may infer this from the endpoint the client submits requests to.
+   * Cannot be updated.
+   * In CamelCase.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+   * +optional
+   */
+  kind?: string;
+  /**
+   * Standard object's metadata.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+   * +optional
+   */
+  metadata?: V1ObjectMeta;
+  /**
+   * The following fields define time interval from which metrics were
+   * collected from the interval [Timestamp-Window, Timestamp].
+   */
+  timestamp?: string;
+  window?: string;
+};
+
+export type V1Beta1PodMetricsList = {
+  /**
+   * APIVersion defines the versioned schema of this representation of an object.
+   * Servers should convert recognized schemas to the latest internal value, and
+   * may reject unrecognized values.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+   * +optional
+   */
+  apiVersion?: string;
+  /**
+   * List of pod metrics.
+   */
+  items?: Array<V1Beta1PodMetrics>;
+  /**
+   * Kind is a string value representing the REST resource this object represents.
+   * Servers may infer this from the endpoint the client submits requests to.
+   * Cannot be updated.
+   * In CamelCase.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+   * +optional
+   */
+  kind?: string;
+  /**
+   * Standard list metadata.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+   */
+  metadata?: V1ListMeta;
+};
+
+export type WebhooksWebhookCreatePayload = {
+  EndpointID?: number;
+  RegistryID?: number;
+  ResourceID?: string;
+  /**
+   * Type of webhook (1 - service)
+   */
+  WebhookType?: PortainerWebhookType;
+};
+
+export type WebhooksWebhookUpdatePayload = {
+  RegistryID?: number;
+};
+
+export type WorkflowsArtifactDetail = {
+  autoUpdate?: PortainerAutoUpdateSettings;
+  creationDate?: number;
+  files?: Array<WorkflowsArtifactFileDetail>;
+  id: number;
+  lastSyncDate?: number;
+  name: string;
+  platform?: WorkflowsDeploymentPlatform;
+  status?: WorkflowsWorkflowStatusObject;
+  target?: WorkflowsTarget;
+  type: WorkflowsType;
+};
+
+export type WorkflowsArtifactFileDetail = {
+  hash?: string;
+  path?: string;
+  pathError?: string;
+  pathStatus?: SourcesStatus;
+  ref?: string;
+  refError?: string;
+  refStatus?: SourcesStatus;
+  sourceId?: number;
+};
+
+export const WorkflowsDeploymentPlatform = {
+  /**
+   * DeploymentPlatformDockerStandalone
+   */
+  DEPLOYMENT_PLATFORM_DOCKER_STANDALONE: 'dockerStandalone',
+  /**
+   * DeploymentPlatformDockerSwarm
+   */
+  DEPLOYMENT_PLATFORM_DOCKER_SWARM: 'dockerSwarm',
+  /**
+   * DeploymentPlatformKubernetes
+   */
+  DEPLOYMENT_PLATFORM_KUBERNETES: 'kubernetes',
+} as const;
+
+export type WorkflowsDeploymentPlatform =
+  (typeof WorkflowsDeploymentPlatform)[keyof typeof WorkflowsDeploymentPlatform];
+
+export const WorkflowsStatus = {
+  /**
+   * StatusHealthy
+   */
+  STATUS_HEALTHY: 'healthy',
+  /**
+   * StatusSyncing
+   */
+  STATUS_SYNCING: 'syncing',
+  /**
+   * StatusError
+   */
+  STATUS_ERROR: 'error',
+  /**
+   * StatusPaused
+   */
+  STATUS_PAUSED: 'paused',
+  /**
+   * StatusUnknown
+   */
+  STATUS_UNKNOWN: 'unknown',
+} as const;
+
+export type WorkflowsStatus =
+  (typeof WorkflowsStatus)[keyof typeof WorkflowsStatus];
+
+export type WorkflowsStatusSummary = {
+  error?: number;
+  healthy?: number;
+  paused?: number;
+  syncing?: number;
+  unknown?: number;
+};
+
+export type WorkflowsTarget = {
+  edgeGroupIds?: Array<number>;
+  endpointId?: number;
+  groupStatus?: {
+    [key: string]: WorkflowsStatus;
+  };
+  namespace?: string;
+  resolvedEndpointIds?: Array<number>;
+};
+
+export const WorkflowsType = {
+  /**
+   * TypeStack
+   */
+  TYPE_STACK: 'stack' /**
+   * TypeEdgeStack
+   */,
+  TYPE_EDGE_STACK: 'edgeStack',
+} as const;
+
+export type WorkflowsType = (typeof WorkflowsType)[keyof typeof WorkflowsType];
+
+export type WorkflowsWorkflow = {
+  autoUpdate?: PortainerAutoUpdateSettings;
+  creationDate?: number;
+  gitConfig?: GittypesRepoConfig;
+  id: number;
+  lastSyncDate?: number;
+  name: string;
+  platform: WorkflowsDeploymentPlatform;
+  sourceId?: number;
+  status: WorkflowsWorkflowStatusObject;
+  target: WorkflowsTarget;
+  type: WorkflowsType;
+};
+
+export type WorkflowsWorkflowDetail = {
+  artifacts?: Array<WorkflowsArtifactDetail>;
+  id: number;
+  name: string;
+};
+
+export type WorkflowsWorkflowPhaseStatus = {
+  error?: string;
+  status?: WorkflowsStatus;
+};
+
+export type WorkflowsWorkflowStatusObject = {
+  artifact?: WorkflowsWorkflowPhaseStatus;
+  source?: WorkflowsWorkflowPhaseStatus;
+  target?: WorkflowsWorkflowPhaseStatus;
+};
+
+/**
+ * Ingress controllers
+ */
+export type KubernetesK8sIngressControllerArray =
+  Array<KubernetesK8sIngressController>;
+
+export type EndpointsEndpointDeleteBatchPayload2 =
+  EndpointsEndpointDeleteBatchPayload;
+
+export type KubernetesK8sNamespaceDetails2 = KubernetesK8sNamespaceDetails;
+
+export type KubernetesK8sIngressInfo2 = KubernetesK8sIngressInfo;
+
+export type KubernetesK8sServiceInfo2 = KubernetesK8sServiceInfo;
+
+export type AuthenticateUserData = {
+  /**
+   * Credentials used for authentication
+   */
+  body: AuthAuthenticatePayload;
+  path?: never;
+  query?: never;
+  url: '/auth';
+};
+
+export type AuthenticateUserErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Invalid Credentials
+   */
+  422: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type AuthenticateUserResponses = {
+  /**
+   * Success
+   */
+  200: AuthAuthenticateResponse;
+};
+
+export type AuthenticateUserResponse =
+  AuthenticateUserResponses[keyof AuthenticateUserResponses];
+
+export type LogoutData = {
+  body?: never;
+  path?: never;
+  query?: never;
+  url: '/auth/logout';
+};
+
+export type LogoutErrors = {
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type LogoutResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type LogoutResponse = LogoutResponses[keyof LogoutResponses];
+
+export type ValidateOAuthData = {
+  /**
+   * OAuth Credentials used for authentication
+   */
+  body: AuthOauthPayload;
+  path?: never;
+  query?: never;
+  url: '/auth/oauth/validate';
+};
+
+export type ValidateOAuthErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Invalid Credentials
+   */
+  422: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type ValidateOAuthResponses = {
+  /**
+   * Success
+   */
+  200: AuthAuthenticateResponse;
+};
+
+export type ValidateOAuthResponse =
+  ValidateOAuthResponses[keyof ValidateOAuthResponses];
+
+export type BackupData = {
+  /**
+   * An object contains the password to encrypt the backup with
+   */
+  body?: BackupBackupPayload;
+  path?: never;
+  query?: never;
+  url: '/backup';
+};
+
+export type BackupErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type BackupResponses = {
+  /**
+   * Success
+   */
+  200: unknown;
+};
+
+export type CustomTemplateListData = {
+  body?: never;
+  path?: never;
+  query: {
+    /**
+     * Template types
+     */
+    type: Array<1 | 2 | 3>;
+    /**
+     * Filter by edge templates
+     */
+    edge?: boolean;
+  };
+  url: '/custom_templates';
+};
+
+export type CustomTemplateListErrors = {
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type CustomTemplateListResponses = {
+  /**
+   * Success
+   */
+  200: Array<PortainerCustomTemplate>;
+};
+
+export type CustomTemplateListResponse =
+  CustomTemplateListResponses[keyof CustomTemplateListResponses];
+
+export type CustomTemplateDeleteData = {
+  body?: never;
+  path: {
+    /**
+     * Template identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/custom_templates/{id}';
+};
+
+export type CustomTemplateDeleteErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Access denied to resource
+   */
+  403: unknown;
+  /**
+   * Template not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type CustomTemplateDeleteResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type CustomTemplateDeleteResponse =
+  CustomTemplateDeleteResponses[keyof CustomTemplateDeleteResponses];
+
+export type CustomTemplateInspectData = {
+  body?: never;
+  path: {
+    /**
+     * Template identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/custom_templates/{id}';
+};
+
+export type CustomTemplateInspectErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Template not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type CustomTemplateInspectResponses = {
+  /**
+   * Success
+   */
+  200: PortainerCustomTemplate;
+};
+
+export type CustomTemplateInspectResponse =
+  CustomTemplateInspectResponses[keyof CustomTemplateInspectResponses];
+
+export type CustomTemplateUpdateData = {
+  /**
+   * Template details
+   */
+  body: CustomtemplatesCustomTemplateUpdatePayload;
+  path: {
+    /**
+     * Template identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/custom_templates/{id}';
+};
+
+export type CustomTemplateUpdateErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Permission denied to access template
+   */
+  403: unknown;
+  /**
+   * Template not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type CustomTemplateUpdateResponses = {
+  /**
+   * Success
+   */
+  200: PortainerCustomTemplate;
+};
+
+export type CustomTemplateUpdateResponse =
+  CustomTemplateUpdateResponses[keyof CustomTemplateUpdateResponses];
+
+export type CustomTemplateFileData = {
+  body?: never;
+  path: {
+    /**
+     * Template identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/custom_templates/{id}/file';
+};
+
+export type CustomTemplateFileErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Custom template not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type CustomTemplateFileResponses = {
+  /**
+   * Success
+   */
+  200: CustomtemplatesFileResponse;
+};
+
+export type CustomTemplateFileResponse =
+  CustomTemplateFileResponses[keyof CustomTemplateFileResponses];
+
+export type CustomTemplateGitFetchData = {
+  body?: never;
+  path: {
+    /**
+     * Template identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/custom_templates/{id}/git_fetch';
+};
+
+export type CustomTemplateGitFetchErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Custom template not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type CustomTemplateGitFetchResponses = {
+  /**
+   * Success
+   */
+  200: CustomtemplatesFileResponse;
+};
+
+export type CustomTemplateGitFetchResponse =
+  CustomTemplateGitFetchResponses[keyof CustomTemplateGitFetchResponses];
+
+export type CustomTemplateCreateFileData = {
+  body: {
+    /**
+     * Title of the template
+     */
+    Title: string;
+    /**
+     * Description of the template
+     */
+    Description: string;
+    /**
+     * A note that will be displayed in the UI. Supports HTML content
+     */
+    Note: string;
+    /**
+     * Platform associated to the template (1 - 'linux', 2 - 'windows')
+     */
+    Platform: 1 | 2;
+    /**
+     * Type of created stack (1 - swarm, 2 - compose, 3 - kubernetes)
+     */
+    Type: 1 | 2 | 3;
+    /**
+     * File
+     */
+    File: Blob | File;
+    /**
+     * URL of the template's logo
+     */
+    Logo?: string;
+    /**
+     * A json array of variables definitions
+     */
+    Variables?: string;
+  };
+  path?: never;
+  query?: never;
+  url: '/custom_templates/create/file';
+};
+
+export type CustomTemplateCreateFileErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type CustomTemplateCreateFileResponses = {
+  /**
+   * OK
+   */
+  200: PortainerCustomTemplate;
+};
+
+export type CustomTemplateCreateFileResponse =
+  CustomTemplateCreateFileResponses[keyof CustomTemplateCreateFileResponses];
+
+export type CustomTemplateCreateRepositoryData = {
+  /**
+   * Required when using method=repository
+   */
+  body: CustomtemplatesCustomTemplateFromGitRepositoryPayload;
+  path?: never;
+  query?: never;
+  url: '/custom_templates/create/repository';
+};
+
+export type CustomTemplateCreateRepositoryErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type CustomTemplateCreateRepositoryResponses = {
+  /**
+   * OK
+   */
+  200: PortainerCustomTemplate;
+};
+
+export type CustomTemplateCreateRepositoryResponse =
+  CustomTemplateCreateRepositoryResponses[keyof CustomTemplateCreateRepositoryResponses];
+
+export type CustomTemplateCreateStringData = {
+  /**
+   * body
+   */
+  body: CustomtemplatesCustomTemplateFromFileContentPayload;
+  path?: never;
+  query?: never;
+  url: '/custom_templates/create/string';
+};
+
+export type CustomTemplateCreateStringErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type CustomTemplateCreateStringResponses = {
+  /**
+   * OK
+   */
+  200: PortainerCustomTemplate;
+};
+
+export type CustomTemplateCreateStringResponse =
+  CustomTemplateCreateStringResponses[keyof CustomTemplateCreateStringResponses];
+
+export type DockerContainerGpusInspectData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    environmentId: number;
+    /**
+     * Container identifier
+     */
+    containerId: number;
+  };
+  query?: never;
+  url: '/docker/{environmentId}/containers/{containerId}/gpus';
+};
+
+export type DockerContainerGpusInspectErrors = {
+  /**
+   * Bad request
+   */
+  400: unknown;
+  /**
+   * Environment or container not found
+   */
+  404: unknown;
+  /**
+   * Internal server error
+   */
+  500: unknown;
+};
+
+export type DockerContainerGpusInspectResponses = {
+  /**
+   * Success
+   */
+  200: ContainersContainerGpusResponse;
+};
+
+export type DockerContainerGpusInspectResponse =
+  DockerContainerGpusInspectResponses[keyof DockerContainerGpusInspectResponses];
+
+export type DockerDashboardData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    environmentId: number;
+  };
+  query?: never;
+  url: '/docker/{environmentId}/dashboard';
+};
+
+export type DockerDashboardErrors = {
+  /**
+   * Bad request
+   */
+  400: unknown;
+  /**
+   * Internal server error
+   */
+  500: unknown;
+};
+
+export type DockerDashboardResponses = {
+  /**
+   * Success
+   */
+  200: DockerDashboardResponse;
+};
+
+export type DockerDashboardResponse2 =
+  DockerDashboardResponses[keyof DockerDashboardResponses];
+
+export type DockerImagesListData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    environmentId: number;
+  };
+  query?: {
+    /**
+     * Include image usage information
+     */
+    withUsage?: boolean;
+  };
+  url: '/docker/{environmentId}/images';
+};
+
+export type DockerImagesListErrors = {
+  /**
+   * Bad request
+   */
+  400: unknown;
+  /**
+   * Internal server error
+   */
+  500: unknown;
+};
+
+export type DockerImagesListResponses = {
+  /**
+   * Success
+   */
+  200: Array<ImagesImageResponse>;
+};
+
+export type DockerImagesListResponse =
+  DockerImagesListResponses[keyof DockerImagesListResponses];
+
+export type EdgeGroupListData = {
+  body?: never;
+  path?: never;
+  query?: never;
+  url: '/edge_groups';
+};
+
+export type EdgeGroupListErrors = {
+  /**
+   * Internal Server Error
+   */
+  500: unknown;
+  /**
+   * Edge compute features are disabled
+   */
+  503: unknown;
+};
+
+export type EdgeGroupListResponses = {
+  /**
+   * EdgeGroups
+   */
+  200: Array<EdgegroupsDecoratedEdgeGroup>;
+};
+
+export type EdgeGroupListResponse =
+  EdgeGroupListResponses[keyof EdgeGroupListResponses];
+
+export type EdgeGroupCreateData = {
+  /**
+   * EdgeGroup data
+   */
+  body: EdgegroupsEdgeGroupCreatePayload;
+  path?: never;
+  query?: never;
+  url: '/edge_groups';
+};
+
+export type EdgeGroupCreateErrors = {
+  /**
+   * Internal Server Error
+   */
+  500: unknown;
+  /**
+   * Edge compute features are disabled
+   */
+  503: unknown;
+};
+
+export type EdgeGroupCreateResponses = {
+  /**
+   * OK
+   */
+  200: PortainerEdgeGroup;
+};
+
+export type EdgeGroupCreateResponse =
+  EdgeGroupCreateResponses[keyof EdgeGroupCreateResponses];
+
+export type EdgeGroupDeleteData = {
+  body?: never;
+  path: {
+    /**
+     * EdgeGroup Id
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/edge_groups/{id}';
+};
+
+export type EdgeGroupDeleteErrors = {
+  /**
+   * Edge group is in use by an Edge stack or Edge job
+   */
+  409: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+  /**
+   * Edge compute features are disabled
+   */
+  503: unknown;
+};
+
+export type EdgeGroupDeleteResponses = {
+  /**
+   * No Content
+   */
+  204: void;
+};
+
+export type EdgeGroupDeleteResponse =
+  EdgeGroupDeleteResponses[keyof EdgeGroupDeleteResponses];
+
+export type EdgeGroupInspectData = {
+  body?: never;
+  path: {
+    /**
+     * EdgeGroup Id
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/edge_groups/{id}';
+};
+
+export type EdgeGroupInspectErrors = {
+  /**
+   * Internal Server Error
+   */
+  500: unknown;
+  /**
+   * Edge compute features are disabled
+   */
+  503: unknown;
+};
+
+export type EdgeGroupInspectResponses = {
+  /**
+   * OK
+   */
+  200: PortainerEdgeGroup;
+};
+
+export type EdgeGroupInspectResponse =
+  EdgeGroupInspectResponses[keyof EdgeGroupInspectResponses];
+
+export type EdgeGroupUpdateData = {
+  /**
+   * EdgeGroup data
+   */
+  body: EdgegroupsEdgeGroupUpdatePayload;
+  path: {
+    /**
+     * EdgeGroup Id
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/edge_groups/{id}';
+};
+
+export type EdgeGroupUpdateErrors = {
+  /**
+   * Internal Server Error
+   */
+  500: unknown;
+  /**
+   * Edge compute features are disabled
+   */
+  503: unknown;
+};
+
+export type EdgeGroupUpdateResponses = {
+  /**
+   * OK
+   */
+  200: PortainerEdgeGroup;
+};
+
+export type EdgeGroupUpdateResponse =
+  EdgeGroupUpdateResponses[keyof EdgeGroupUpdateResponses];
+
+export type EdgeJobListData = {
+  body?: never;
+  path?: never;
+  query?: never;
+  url: '/edge_jobs';
+};
+
+export type EdgeJobListErrors = {
+  /**
+   * Bad Request
+   */
+  400: unknown;
+  /**
+   * Internal Server Error
+   */
+  500: unknown;
+  /**
+   * Edge compute features are disabled
+   */
+  503: unknown;
+};
+
+export type EdgeJobListResponses = {
+  /**
+   * OK
+   */
+  200: Array<PortainerEdgeJob>;
+};
+
+export type EdgeJobListResponse =
+  EdgeJobListResponses[keyof EdgeJobListResponses];
+
+export type EdgeJobDeleteData = {
+  body?: never;
+  path: {
+    /**
+     * EdgeJob Id
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/edge_jobs/{id}';
+};
+
+export type EdgeJobDeleteErrors = {
+  /**
+   * Bad Request
+   */
+  400: unknown;
+  /**
+   * Internal Server Error
+   */
+  500: unknown;
+  /**
+   * Edge compute features are disabled
+   */
+  503: unknown;
+};
+
+export type EdgeJobDeleteResponses = {
+  /**
+   * No Content
+   */
+  204: void;
+};
+
+export type EdgeJobDeleteResponse =
+  EdgeJobDeleteResponses[keyof EdgeJobDeleteResponses];
+
+export type EdgeJobInspectData = {
+  body?: never;
+  path: {
+    /**
+     * EdgeJob Id
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/edge_jobs/{id}';
+};
+
+export type EdgeJobInspectErrors = {
+  /**
+   * Bad Request
+   */
+  400: unknown;
+  /**
+   * Internal Server Error
+   */
+  500: unknown;
+  /**
+   * Edge compute features are disabled
+   */
+  503: unknown;
+};
+
+export type EdgeJobInspectResponses = {
+  /**
+   * OK
+   */
+  200: PortainerEdgeJob;
+};
+
+export type EdgeJobInspectResponse =
+  EdgeJobInspectResponses[keyof EdgeJobInspectResponses];
+
+export type EdgeJobUpdateData = {
+  /**
+   * EdgeGroup data
+   */
+  body: EdgejobsEdgeJobUpdatePayload;
+  path: {
+    /**
+     * EdgeJob Id
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/edge_jobs/{id}';
+};
+
+export type EdgeJobUpdateErrors = {
+  /**
+   * Bad Request
+   */
+  400: unknown;
+  /**
+   * Internal Server Error
+   */
+  500: unknown;
+  /**
+   * Edge compute features are disabled
+   */
+  503: unknown;
+};
+
+export type EdgeJobUpdateResponses = {
+  /**
+   * OK
+   */
+  200: PortainerEdgeJob;
+};
+
+export type EdgeJobUpdateResponse =
+  EdgeJobUpdateResponses[keyof EdgeJobUpdateResponses];
+
+export type EdgeJobFileData = {
+  body?: never;
+  path: {
+    /**
+     * EdgeJob Id
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/edge_jobs/{id}/file';
+};
+
+export type EdgeJobFileErrors = {
+  /**
+   * Bad Request
+   */
+  400: unknown;
+  /**
+   * Internal Server Error
+   */
+  500: unknown;
+  /**
+   * Edge compute features are disabled
+   */
+  503: unknown;
+};
+
+export type EdgeJobFileResponses = {
+  /**
+   * OK
+   */
+  200: EdgejobsEdgeJobFileResponse;
+};
+
+export type EdgeJobFileResponse =
+  EdgeJobFileResponses[keyof EdgeJobFileResponses];
+
+export type EdgeJobTasksListData = {
+  body?: never;
+  path: {
+    /**
+     * EdgeJob Id
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/edge_jobs/{id}/tasks';
+};
+
+export type EdgeJobTasksListErrors = {
+  /**
+   * Bad Request
+   */
+  400: unknown;
+  /**
+   * Internal Server Error
+   */
+  500: unknown;
+  /**
+   * Edge compute features are disabled
+   */
+  503: unknown;
+};
+
+export type EdgeJobTasksListResponses = {
+  /**
+   * OK
+   */
+  200: Array<EdgejobsTaskContainer>;
+};
+
+export type EdgeJobTasksListResponse =
+  EdgeJobTasksListResponses[keyof EdgeJobTasksListResponses];
+
+export type EdgeJobTasksClearData = {
+  body?: never;
+  path: {
+    /**
+     * EdgeJob Id
+     */
+    id: number;
+    /**
+     * Task Id
+     */
+    taskID: number;
+  };
+  query?: never;
+  url: '/edge_jobs/{id}/tasks/{taskID}/logs';
+};
+
+export type EdgeJobTasksClearErrors = {
+  /**
+   * Bad Request
+   */
+  400: unknown;
+  /**
+   * Internal Server Error
+   */
+  500: unknown;
+  /**
+   * Edge compute features are disabled
+   */
+  503: unknown;
+};
+
+export type EdgeJobTasksClearResponses = {
+  /**
+   * No Content
+   */
+  204: void;
+};
+
+export type EdgeJobTasksClearResponse =
+  EdgeJobTasksClearResponses[keyof EdgeJobTasksClearResponses];
+
+export type EdgeJobTaskLogsInspectData = {
+  body?: never;
+  path: {
+    /**
+     * EdgeJob Id
+     */
+    id: number;
+    /**
+     * Task Id
+     */
+    taskID: number;
+  };
+  query?: never;
+  url: '/edge_jobs/{id}/tasks/{taskID}/logs';
+};
+
+export type EdgeJobTaskLogsInspectErrors = {
+  /**
+   * Bad Request
+   */
+  400: unknown;
+  /**
+   * Internal Server Error
+   */
+  500: unknown;
+  /**
+   * Edge compute features are disabled
+   */
+  503: unknown;
+};
+
+export type EdgeJobTaskLogsInspectResponses = {
+  /**
+   * OK
+   */
+  200: EdgejobsFileResponse;
+};
+
+export type EdgeJobTaskLogsInspectResponse =
+  EdgeJobTaskLogsInspectResponses[keyof EdgeJobTaskLogsInspectResponses];
+
+export type EdgeJobTasksCollectData = {
+  body?: never;
+  path: {
+    /**
+     * EdgeJob Id
+     */
+    id: number;
+    /**
+     * Task Id
+     */
+    taskID: number;
+  };
+  query?: never;
+  url: '/edge_jobs/{id}/tasks/{taskID}/logs';
+};
+
+export type EdgeJobTasksCollectErrors = {
+  /**
+   * Bad Request
+   */
+  400: unknown;
+  /**
+   * Internal Server Error
+   */
+  500: unknown;
+  /**
+   * Edge compute features are disabled
+   */
+  503: unknown;
+};
+
+export type EdgeJobTasksCollectResponses = {
+  /**
+   * No Content
+   */
+  204: void;
+};
+
+export type EdgeJobTasksCollectResponse =
+  EdgeJobTasksCollectResponses[keyof EdgeJobTasksCollectResponses];
+
+export type EdgeJobCreateFileData = {
+  body: {
+    /**
+     * Content of the Stack file
+     */
+    file: Blob | File;
+    /**
+     * Name of the stack
+     */
+    Name: string;
+    /**
+     * A cron expression to schedule this job
+     */
+    CronExpression: string;
+    /**
+     * JSON stringified array of Edge Groups ids
+     */
+    EdgeGroups: string;
+    /**
+     * JSON stringified array of Environment ids
+     */
+    Endpoints: string;
+    /**
+     * If recurring
+     */
+    Recurring?: boolean;
+  };
+  path?: never;
+  query?: never;
+  url: '/edge_jobs/create/file';
+};
+
+export type EdgeJobCreateFileErrors = {
+  /**
+   * Internal Server Error
+   */
+  500: unknown;
+  /**
+   * Edge compute features are disabled
+   */
+  503: unknown;
+};
+
+export type EdgeJobCreateFileResponses = {
+  /**
+   * OK
+   */
+  200: PortainerEdgeGroup;
+};
+
+export type EdgeJobCreateFileResponse =
+  EdgeJobCreateFileResponses[keyof EdgeJobCreateFileResponses];
+
+export type EdgeJobCreateStringData = {
+  /**
+   * EdgeGroup data when method is string
+   */
+  body: EdgejobsEdgeJobCreateFromFileContentPayload;
+  path?: never;
+  query?: never;
+  url: '/edge_jobs/create/string';
+};
+
+export type EdgeJobCreateStringErrors = {
+  /**
+   * Internal Server Error
+   */
+  500: unknown;
+  /**
+   * Edge compute features are disabled
+   */
+  503: unknown;
+};
+
+export type EdgeJobCreateStringResponses = {
+  /**
+   * OK
+   */
+  200: PortainerEdgeGroup;
+};
+
+export type EdgeJobCreateStringResponse =
+  EdgeJobCreateStringResponses[keyof EdgeJobCreateStringResponses];
+
+export type EdgeStackListData = {
+  body?: never;
+  path?: never;
+  query?: {
+    /**
+     * will summarize the statuses
+     */
+    summarizeStatuses?: boolean;
+  };
+  url: '/edge_stacks';
+};
+
+export type EdgeStackListErrors = {
+  /**
+   * Bad Request
+   */
+  400: unknown;
+  /**
+   * Internal Server Error
+   */
+  500: unknown;
+  /**
+   * Edge compute features are disabled
+   */
+  503: unknown;
+};
+
+export type EdgeStackListResponses = {
+  /**
+   * OK
+   */
+  200: Array<PortainerEdgeStack>;
+};
+
+export type EdgeStackListResponse =
+  EdgeStackListResponses[keyof EdgeStackListResponses];
+
+export type EdgeStackDeleteData = {
+  body?: never;
+  path: {
+    /**
+     * EdgeStack Id
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/edge_stacks/{id}';
+};
+
+export type EdgeStackDeleteErrors = {
+  /**
+   * Bad Request
+   */
+  400: unknown;
+  /**
+   * Internal Server Error
+   */
+  500: unknown;
+  /**
+   * Edge compute features are disabled
+   */
+  503: unknown;
+};
+
+export type EdgeStackDeleteResponses = {
+  /**
+   * No Content
+   */
+  204: void;
+};
+
+export type EdgeStackDeleteResponse =
+  EdgeStackDeleteResponses[keyof EdgeStackDeleteResponses];
+
+export type EdgeStackInspectData = {
+  body?: never;
+  path: {
+    /**
+     * EdgeStack Id
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/edge_stacks/{id}';
+};
+
+export type EdgeStackInspectErrors = {
+  /**
+   * Bad Request
+   */
+  400: unknown;
+  /**
+   * Internal Server Error
+   */
+  500: unknown;
+  /**
+   * Edge compute features are disabled
+   */
+  503: unknown;
+};
+
+export type EdgeStackInspectResponses = {
+  /**
+   * OK
+   */
+  200: PortainerEdgeStack;
+};
+
+export type EdgeStackInspectResponse =
+  EdgeStackInspectResponses[keyof EdgeStackInspectResponses];
+
+export type EdgeStackUpdateData = {
+  /**
+   * EdgeStack data
+   */
+  body: EdgestacksUpdateEdgeStackPayload;
+  path: {
+    /**
+     * EdgeStack Id
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/edge_stacks/{id}';
+};
+
+export type EdgeStackUpdateErrors = {
+  /**
+   * Bad Request
+   */
+  400: unknown;
+  /**
+   * Internal Server Error
+   */
+  500: unknown;
+  /**
+   * Edge compute features are disabled
+   */
+  503: unknown;
+};
+
+export type EdgeStackUpdateResponses = {
+  /**
+   * OK
+   */
+  200: PortainerEdgeStack;
+};
+
+export type EdgeStackUpdateResponse =
+  EdgeStackUpdateResponses[keyof EdgeStackUpdateResponses];
+
+export type EdgeStackFileData = {
+  body?: never;
+  path: {
+    /**
+     * EdgeStack Id
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/edge_stacks/{id}/file';
+};
+
+export type EdgeStackFileErrors = {
+  /**
+   * Bad Request
+   */
+  400: unknown;
+  /**
+   * Internal Server Error
+   */
+  500: unknown;
+  /**
+   * Edge compute features are disabled
+   */
+  503: unknown;
+};
+
+export type EdgeStackFileResponses = {
+  /**
+   * OK
+   */
+  200: EdgestacksStackFileResponse;
+};
+
+export type EdgeStackFileResponse =
+  EdgeStackFileResponses[keyof EdgeStackFileResponses];
+
+export type EdgeStackStatusUpdateData = {
+  /**
+   * EdgeStack status payload
+   */
+  body: EdgestacksUpdateStatusPayload;
+  path: {
+    /**
+     * EdgeStack Id
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/edge_stacks/{id}/status';
+};
+
+export type EdgeStackStatusUpdateErrors = {
+  /**
+   * Bad Request
+   */
+  400: unknown;
+  /**
+   * Forbidden
+   */
+  403: unknown;
+  /**
+   * Not Found
+   */
+  404: unknown;
+  /**
+   * Internal Server Error
+   */
+  500: unknown;
+};
+
+export type EdgeStackStatusUpdateResponses = {
+  /**
+   * OK
+   */
+  200: PortainerEdgeStack;
+};
+
+export type EdgeStackStatusUpdateResponse =
+  EdgeStackStatusUpdateResponses[keyof EdgeStackStatusUpdateResponses];
+
+export type EdgeStackCreateFileData = {
+  body: {
+    /**
+     * Name of the stack. it must only consist of lowercase alphanumeric characters, hyphens, or underscores as well as start with a letter or number
+     */
+    Name: string;
+    /**
+     * Content of the Stack file
+     */
+    file: Blob | File;
+    /**
+     * JSON stringified array of Edge Groups ids
+     */
+    EdgeGroups: string;
+    /**
+     * deploy type 0 - 'compose', 1 - 'kubernetes'
+     */
+    DeploymentType: number;
+    /**
+     * JSON stringified array of Registry ids to use for this stack
+     */
+    Registries?: string;
+    /**
+     * Uses the manifest's namespaces instead of the default one, relevant only for kube environments
+     */
+    UseManifestNamespaces?: boolean;
+    /**
+     * Pre Pull image
+     */
+    PrePullImage?: boolean;
+    /**
+     * Retry deploy
+     */
+    RetryDeploy?: boolean;
+  };
+  path?: never;
+  query?: {
+    /**
+     * if true, will not create an edge stack, but just will check the settings and return a non-persisted edge stack object
+     */
+    dryrun?: string;
+  };
+  url: '/edge_stacks/create/file';
+};
+
+export type EdgeStackCreateFileErrors = {
+  /**
+   * Bad request
+   */
+  400: unknown;
+  /**
+   * Internal server error
+   */
+  500: unknown;
+  /**
+   * Edge compute features are disabled
+   */
+  503: unknown;
+};
+
+export type EdgeStackCreateFileResponses = {
+  /**
+   * OK
+   */
+  200: PortainerEdgeStack;
+};
+
+export type EdgeStackCreateFileResponse =
+  EdgeStackCreateFileResponses[keyof EdgeStackCreateFileResponses];
+
+export type EdgeStackCreateRepositoryData = {
+  /**
+   * stack config
+   */
+  body: EdgestacksEdgeStackFromGitRepositoryPayload;
+  path?: never;
+  query?: {
+    /**
+     * if true, will not create an edge stack, but just will check the settings and return a non-persisted edge stack object
+     */
+    dryrun?: string;
+  };
+  url: '/edge_stacks/create/repository';
+};
+
+export type EdgeStackCreateRepositoryErrors = {
+  /**
+   * Bad request
+   */
+  400: unknown;
+  /**
+   * Internal server error
+   */
+  500: unknown;
+  /**
+   * Edge compute features are disabled
+   */
+  503: unknown;
+};
+
+export type EdgeStackCreateRepositoryResponses = {
+  /**
+   * OK
+   */
+  200: PortainerEdgeStack;
+};
+
+export type EdgeStackCreateRepositoryResponse =
+  EdgeStackCreateRepositoryResponses[keyof EdgeStackCreateRepositoryResponses];
+
+export type EdgeStackCreateStringData = {
+  /**
+   * stack config
+   */
+  body: EdgestacksEdgeStackFromStringPayload;
+  path?: never;
+  query?: {
+    /**
+     * if true, will not create an edge stack, but just will check the settings and return a non-persisted edge stack object
+     */
+    dryrun?: string;
+  };
+  url: '/edge_stacks/create/string';
+};
+
+export type EdgeStackCreateStringErrors = {
+  /**
+   * Bad request
+   */
+  400: unknown;
+  /**
+   * Internal server error
+   */
+  500: unknown;
+  /**
+   * Edge compute features are disabled
+   */
+  503: unknown;
+};
+
+export type EdgeStackCreateStringResponses = {
+  /**
+   * OK
+   */
+  200: PortainerEdgeStack;
+};
+
+export type EdgeStackCreateStringResponse =
+  EdgeStackCreateStringResponses[keyof EdgeStackCreateStringResponses];
+
+export type EndpointGroupListData = {
+  body?: never;
+  path?: never;
+  query?: {
+    /**
+     * If true, each environment(endpoint) group will include the number of environments(endpoints) associated to it and breakdown by type
+     */
+    size?: boolean;
+  };
+  url: '/endpoint_groups';
+};
+
+export type EndpointGroupListErrors = {
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type EndpointGroupListResponses = {
+  /**
+   * Environment(Endpoint) group
+   */
+  200: Array<EndpointgroupsEndpointGroupResponse>;
+};
+
+export type EndpointGroupListResponse =
+  EndpointGroupListResponses[keyof EndpointGroupListResponses];
+
+export type PostEndpointGroupsData = {
+  /**
+   * Environment(Endpoint) Group details
+   */
+  body: EndpointgroupsEndpointGroupCreatePayload;
+  path?: never;
+  query?: never;
+  url: '/endpoint_groups';
+};
+
+export type PostEndpointGroupsErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type PostEndpointGroupsResponses = {
+  /**
+   * Success
+   */
+  200: PortainerEndpointGroup;
+};
+
+export type PostEndpointGroupsResponse =
+  PostEndpointGroupsResponses[keyof PostEndpointGroupsResponses];
+
+export type EndpointGroupDeleteData = {
+  body?: never;
+  path: {
+    /**
+     * EndpointGroup identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/endpoint_groups/{id}';
+};
+
+export type EndpointGroupDeleteErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * EndpointGroup not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type EndpointGroupDeleteResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type EndpointGroupDeleteResponse =
+  EndpointGroupDeleteResponses[keyof EndpointGroupDeleteResponses];
+
+export type GetEndpointGroupsByIdData = {
+  body?: never;
+  path: {
+    /**
+     * Environment(Endpoint) group identifier
+     */
+    id: number;
+  };
+  query?: {
+    /**
+     * If true, include the number of environments and breakdown by type
+     */
+    size?: boolean;
+  };
+  url: '/endpoint_groups/{id}';
+};
+
+export type GetEndpointGroupsByIdErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * EndpointGroup not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type GetEndpointGroupsByIdResponses = {
+  /**
+   * Success
+   */
+  200: EndpointgroupsEndpointGroupResponse;
+};
+
+export type GetEndpointGroupsByIdResponse =
+  GetEndpointGroupsByIdResponses[keyof GetEndpointGroupsByIdResponses];
+
+export type EndpointGroupUpdateData = {
+  /**
+   * EndpointGroup details
+   */
+  body: EndpointgroupsEndpointGroupUpdatePayload;
+  path: {
+    /**
+     * EndpointGroup identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/endpoint_groups/{id}';
+};
+
+export type EndpointGroupUpdateErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * EndpointGroup not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type EndpointGroupUpdateResponses = {
+  /**
+   * Success
+   */
+  200: PortainerEndpointGroup;
+};
+
+export type EndpointGroupUpdateResponse =
+  EndpointGroupUpdateResponses[keyof EndpointGroupUpdateResponses];
+
+export type EndpointGroupDeleteEndpointData = {
+  body?: never;
+  path: {
+    /**
+     * EndpointGroup identifier
+     */
+    id: number;
+    /**
+     * Environment(Endpoint) identifier
+     */
+    endpointId: number;
+  };
+  query?: never;
+  url: '/endpoint_groups/{id}/endpoints/{endpointId}';
+};
+
+export type EndpointGroupDeleteEndpointErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * EndpointGroup not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type EndpointGroupDeleteEndpointResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type EndpointGroupDeleteEndpointResponse =
+  EndpointGroupDeleteEndpointResponses[keyof EndpointGroupDeleteEndpointResponses];
+
+export type EndpointGroupAddEndpointData = {
+  body?: never;
+  path: {
+    /**
+     * EndpointGroup identifier
+     */
+    id: number;
+    /**
+     * Environment(Endpoint) identifier
+     */
+    endpointId: number;
+  };
+  query?: never;
+  url: '/endpoint_groups/{id}/endpoints/{endpointId}';
+};
+
+export type EndpointGroupAddEndpointErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * EndpointGroup not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type EndpointGroupAddEndpointResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type EndpointGroupAddEndpointResponse =
+  EndpointGroupAddEndpointResponses[keyof EndpointGroupAddEndpointResponses];
+
+export type EndpointListData = {
+  body?: never;
+  path?: never;
+  query?: {
+    /**
+     * Start searching from
+     */
+    start?: number;
+    /**
+     * Limit results to this value
+     */
+    limit?: number;
+    /**
+     * Sort results by this value
+     */
+    sort?:
+      | 'Name'
+      | 'Group'
+      | 'Status'
+      | 'LastCheckIn'
+      | 'EdgeID'
+      | 'PlatformType'
+      | 'Health'
+      | 'Id';
+    /**
+     * Order sorted results by desc/asc
+     */
+    order?: string;
+    /**
+     * Search query
+     */
+    search?: string;
+    /**
+     * List environments(endpoints) of these groups
+     */
+    groupIds?: Array<number>;
+    /**
+     * List environments(endpoints) by this status
+     */
+    status?: Array<number>;
+    /**
+     * List environments(endpoints) of this type
+     */
+    types?: Array<0 | 1 | 2 | 3 | 4 | 5 | 6 | 7>;
+    /**
+     * Filter environments by platform type
+     */
+    platformTypes?: Array<0 | 1 | 2 | 3 | 4>;
+    /**
+     * If true, return only environments with an outdated agent
+     */
+    outdated?: boolean;
+    /**
+     * Exclude environments of these groups
+     */
+    excludeGroupIds?: Array<number>;
+    /**
+     * search environments(endpoints) with these tags (depends on tagsPartialMatch)
+     */
+    tagIds?: Array<number>;
+    /**
+     * If true, will return environment(endpoint) which has one of tagIds, if false (or missing) will return only environments(endpoints) that has all the tags
+     */
+    tagsPartialMatch?: boolean;
+    /**
+     * will return only these environments(endpoints)
+     */
+    endpointIds?: Array<number>;
+    /**
+     * will exclude these environments(endpoints)
+     */
+    excludeIds?: Array<number>;
+    /**
+     * will return only environments with on of these agent versions
+     */
+    agentVersions?: Array<string>;
+    /**
+     * if exists true show only edge async agents, false show only standard edge agents. if missing, will show both types (relevant only for edge agents)
+     */
+    edgeAsync?: boolean;
+    /**
+     * if true, show only untrusted edge agents, if false show only trusted edge agents (relevant only for edge agents)
+     */
+    edgeDeviceUntrusted?: boolean;
+    /**
+     * if bigger then zero, show only edge agents that checked-in in the last provided seconds (relevant only for edge agents)
+     */
+    edgeCheckInPassedSeconds?: number;
+    /**
+     * if true, the snapshot data won't be retrieved
+     */
+    excludeSnapshots?: boolean;
+    /**
+     * will return only environments(endpoints) with this name
+     */
+    name?: string;
+    /**
+     * will return the environments of the specified edge stack
+     */
+    edgeStackId?: number;
+    /**
+     * only applied when edgeStackId exists. Filter the returned environments based on their deployment status in the stack (not the environment status!)
+     */
+    edgeStackStatus?: 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13;
+    /**
+     * List environments(endpoints) of these edge groups
+     */
+    edgeGroupIds?: Array<number>;
+    /**
+     * Exclude environments(endpoints) of these edge groups
+     */
+    excludeEdgeGroupIds?: Array<number>;
+  };
+  url: '/endpoints';
+};
+
+export type EndpointListErrors = {
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type EndpointListResponses = {
+  /**
+   * Endpoints
+   */
+  200: Array<PortainerEndpoint>;
+};
+
+export type EndpointListResponse =
+  EndpointListResponses[keyof EndpointListResponses];
+
+export type EndpointCreateData = {
+  body: {
+    /**
+     * Name that will be used to identify this environment(endpoint) (example: my-environment)
+     */
+    Name: string;
+    /**
+     * Environment(Endpoint) type. Value must be one of: 1 (Local Docker environment), 2 (Agent environment), 3 (Azure environment), 4 (Edge agent environment) or 5 (Local Kubernetes Environment)
+     */
+    EndpointCreationType: 0 | 1 | 2 | 3 | 4 | 5;
+    /**
+     * Container engine used by the environment(endpoint). Value must be one of: 'docker' or 'podman'
+     */
+    ContainerEngine?: string;
+    /**
+     * URL or IP address of a Docker host (example: docker.mydomain.tld:2375). Defaults to local if not specified (Linux: /var/run/docker.sock, Windows: //./pipe/docker_engine). Cannot be empty if EndpointCreationType is set to 4 (Edge agent environment)
+     */
+    URL?: string;
+    /**
+     * URL or IP address where exposed containers will be reachable. Defaults to URL if not specified (example: docker.mydomain.tld:2375)
+     */
+    PublicURL?: string;
+    /**
+     * Environment(Endpoint) group identifier. If not specified will default to 1 (unassigned).
+     */
+    GroupID?: number;
+    /**
+     * Require TLS to connect against this environment(endpoint). Must be true if EndpointCreationType is set to 2 (Agent environment)
+     */
+    TLS?: boolean;
+    /**
+     * Skip server verification when using TLS. Must be true if EndpointCreationType is set to 2 (Agent environment)
+     */
+    TLSSkipVerify?: boolean;
+    /**
+     * Skip client verification when using TLS. Must be true if EndpointCreationType is set to 2 (Agent environment)
+     */
+    TLSSkipClientVerify?: boolean;
+    /**
+     * TLS CA certificate file
+     */
+    TLSCACertFile?: Blob | File;
+    /**
+     * TLS client certificate file
+     */
+    TLSCertFile?: Blob | File;
+    /**
+     * TLS client key file
+     */
+    TLSKeyFile?: Blob | File;
+    /**
+     * Azure application ID. Required if environment(endpoint) type is set to 3
+     */
+    AzureApplicationID?: string;
+    /**
+     * Azure tenant ID. Required if environment(endpoint) type is set to 3
+     */
+    AzureTenantID?: string;
+    /**
+     * Azure authentication key. Required if environment(endpoint) type is set to 3
+     */
+    AzureAuthenticationKey?: string;
+    /**
+     * JSON-parsable array of tag identifiers to which this environment(endpoint) is associated
+     */
+    TagIds?: string;
+    /**
+     * The check in interval for edge agent (in seconds)
+     */
+    EdgeCheckinInterval?: number;
+    /**
+     * URL or IP address that will be used to establish a reverse tunnel
+     */
+    EdgeTunnelServerAddress?: string;
+    /**
+     * List of GPUs - json stringified array of {name, value} structs
+     */
+    Gpus?: string;
+  };
+  path?: never;
+  query?: never;
+  url: '/endpoints';
+};
+
+export type EndpointCreateErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Name is not unique
+   */
+  409: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type EndpointCreateResponses = {
+  /**
+   * Success
+   */
+  200: PortainerEndpoint;
+};
+
+export type EndpointCreateResponse =
+  EndpointCreateResponses[keyof EndpointCreateResponses];
+
+export type EndpointDeleteData = {
+  body?: never;
+  path: {
+    /**
+     * Environment(Endpoint) identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/endpoints/{id}';
+};
+
+export type EndpointDeleteErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access or operation not allowed.
+   */
+  403: unknown;
+  /**
+   * Unable to find the environment with the specified identifier inside the database.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to delete the environment.
+   */
+  500: unknown;
+};
+
+export type EndpointDeleteResponses = {
+  /**
+   * Environment successfully deleted.
+   */
+  204: void;
+};
+
+export type EndpointDeleteResponse =
+  EndpointDeleteResponses[keyof EndpointDeleteResponses];
+
+export type EndpointInspectData = {
+  body?: never;
+  path: {
+    /**
+     * Environment(Endpoint) identifier
+     */
+    id: number;
+  };
+  query?: {
+    /**
+     * if true, the snapshot data won't be retrieved
+     */
+    excludeSnapshot?: boolean;
+  };
+  url: '/endpoints/{id}';
+};
+
+export type EndpointInspectErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Environment(Endpoint) not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type EndpointInspectResponses = {
+  /**
+   * Success
+   */
+  200: PortainerEndpoint;
+};
+
+export type EndpointInspectResponse =
+  EndpointInspectResponses[keyof EndpointInspectResponses];
+
+export type EndpointUpdateData = {
+  /**
+   * Environment(Endpoint) details
+   */
+  body: EndpointsEndpointUpdatePayload;
+  path: {
+    /**
+     * Environment(Endpoint) identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/endpoints/{id}';
+};
+
+export type EndpointUpdateErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Environment(Endpoint) not found
+   */
+  404: unknown;
+  /**
+   * Name is not unique
+   */
+  409: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type EndpointUpdateResponses = {
+  /**
+   * Success
+   */
+  200: PortainerEndpoint;
+};
+
+export type EndpointUpdateResponse =
+  EndpointUpdateResponses[keyof EndpointUpdateResponses];
+
+export type EndpointAssociationDeleteData = {
+  body?: never;
+  path: {
+    /**
+     * Environment(Endpoint) identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/endpoints/{id}/association';
+};
+
+export type EndpointAssociationDeleteErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Environment(Endpoint) not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type EndpointAssociationDeleteResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type EndpointAssociationDeleteResponse =
+  EndpointAssociationDeleteResponses[keyof EndpointAssociationDeleteResponses];
+
+export type PostEndpointsByIdDockerV2BrowsePutData = {
+  body: {
+    /**
+     * The destination path to upload the file to
+     */
+    Path: string;
+    /**
+     * The file to upload
+     */
+    file: Blob | File;
+  };
+  path: {
+    /**
+     * Environment(Endpoint) identifier
+     */
+    id: number;
+  };
+  query?: {
+    /**
+     * Optional volume identifier to upload the file
+     */
+    volumeID?: string;
+  };
+  url: '/endpoints/{id}/docker/v2/browse/put';
+};
+
+export type PostEndpointsByIdDockerV2BrowsePutErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type PostEndpointsByIdDockerV2BrowsePutResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type PostEndpointsByIdDockerV2BrowsePutResponse =
+  PostEndpointsByIdDockerV2BrowsePutResponses[keyof PostEndpointsByIdDockerV2BrowsePutResponses];
+
+export type EndpointDockerhubStatusData = {
+  body?: never;
+  path: {
+    /**
+     * endpoint ID
+     */
+    id: number;
+    /**
+     * registry ID
+     */
+    registryId: number;
+  };
+  query?: never;
+  url: '/endpoints/{id}/dockerhub/{registryId}';
+};
+
+export type EndpointDockerhubStatusErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Permission denied
+   */
+  403: unknown;
+  /**
+   * registry or endpoint not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type EndpointDockerhubStatusResponses = {
+  /**
+   * Success
+   */
+  200: EndpointsDockerhubStatusResponse;
+};
+
+export type EndpointDockerhubStatusResponse =
+  EndpointDockerhubStatusResponses[keyof EndpointDockerhubStatusResponses];
+
+export type EndpointForceUpdateServiceData = {
+  /**
+   * details
+   */
+  body: EndpointsForceUpdateServicePayload;
+  path: {
+    /**
+     * endpoint identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/endpoints/{id}/forceupdateservice';
+};
+
+export type EndpointForceUpdateServiceErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Permission denied
+   */
+  403: unknown;
+  /**
+   * endpoint not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type EndpointForceUpdateServiceResponses = {
+  /**
+   * Success
+   */
+  200: SwarmServiceUpdateResponse;
+};
+
+export type EndpointForceUpdateServiceResponse =
+  EndpointForceUpdateServiceResponses[keyof EndpointForceUpdateServiceResponses];
+
+export type HelmListData = {
+  body?: never;
+  path: {
+    /**
+     * Environment(Endpoint) identifier
+     */
+    id: number;
+  };
+  query?: {
+    /**
+     * specify an optional namespace
+     */
+    namespace?: string;
+    /**
+     * specify an optional filter
+     */
+    filter?: string;
+    /**
+     * specify an optional selector
+     */
+    selector?: string;
+  };
+  url: '/endpoints/{id}/kubernetes/helm';
+};
+
+export type HelmListErrors = {
+  /**
+   * Invalid environment(endpoint) identifier
+   */
+  400: unknown;
+  /**
+   * Unauthorized
+   */
+  401: unknown;
+  /**
+   * Environment(Endpoint) or ServiceAccount not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type HelmListResponses = {
+  /**
+   * Success
+   */
+  200: Array<ReleaseReleaseElement>;
+};
+
+export type HelmListResponse = HelmListResponses[keyof HelmListResponses];
+
+export type HelmInstallData = {
+  /**
+   * Chart details
+   */
+  body: HelmInstallChartPayload;
+  path: {
+    /**
+     * Environment(Endpoint) identifier
+     */
+    id: number;
+  };
+  query?: {
+    /**
+     * Dry run
+     */
+    dryRun?: boolean;
+  };
+  url: '/endpoints/{id}/kubernetes/helm';
+};
+
+export type HelmInstallErrors = {
+  /**
+   * Invalid request payload
+   */
+  400: unknown;
+  /**
+   * Unauthorized
+   */
+  401: unknown;
+  /**
+   * Environment(Endpoint) or ServiceAccount not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type HelmInstallResponses = {
+  /**
+   * Created
+   */
+  201: ReleaseRelease;
+};
+
+export type HelmInstallResponse =
+  HelmInstallResponses[keyof HelmInstallResponses];
+
+export type HelmDeleteData = {
+  body?: never;
+  path: {
+    /**
+     * Environment(Endpoint) identifier
+     */
+    id: number;
+    /**
+     * The name of the release/application to uninstall
+     */
+    release: string;
+  };
+  query?: {
+    /**
+     * An optional namespace
+     */
+    namespace?: string;
+  };
+  url: '/endpoints/{id}/kubernetes/helm/{release}';
+};
+
+export type HelmDeleteErrors = {
+  /**
+   * Invalid environment(endpoint) id or bad request
+   */
+  400: unknown;
+  /**
+   * Unauthorized
+   */
+  401: unknown;
+  /**
+   * Environment(Endpoint) or ServiceAccount not found
+   */
+  404: unknown;
+  /**
+   * Server error or helm error
+   */
+  500: unknown;
+};
+
+export type HelmDeleteResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type HelmDeleteResponse = HelmDeleteResponses[keyof HelmDeleteResponses];
+
+export type HelmGetData = {
+  body?: never;
+  path: {
+    /**
+     * Environment(Endpoint) identifier
+     */
+    id: number;
+    /**
+     * Helm release name
+     */
+    release: string;
+  };
+  query?: {
+    /**
+     * specify an optional namespace
+     */
+    namespace?: string;
+    /**
+     * show resources of the release
+     */
+    showResources?: boolean;
+    /**
+     * specify an optional revision
+     */
+    revision?: number;
+  };
+  url: '/endpoints/{id}/kubernetes/helm/{release}';
+};
+
+export type HelmGetErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to retrieve the release.
+   */
+  500: unknown;
+};
+
+export type HelmGetResponses = {
+  /**
+   * Success
+   */
+  200: ReleaseRelease;
+};
+
+export type HelmGetResponse = HelmGetResponses[keyof HelmGetResponses];
+
+export type HelmGetHistoryData = {
+  body?: never;
+  path: {
+    /**
+     * Environment(Endpoint) identifier
+     */
+    id: number;
+    /**
+     * Helm release name
+     */
+    release: string;
+  };
+  query?: {
+    /**
+     * specify an optional namespace
+     */
+    namespace?: string;
+  };
+  url: '/endpoints/{id}/kubernetes/helm/{release}/history';
+};
+
+export type HelmGetHistoryErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to retrieve the historical list of releases.
+   */
+  500: unknown;
+};
+
+export type HelmGetHistoryResponses = {
+  /**
+   * Success
+   */
+  200: Array<ReleaseRelease>;
+};
+
+export type HelmGetHistoryResponse =
+  HelmGetHistoryResponses[keyof HelmGetHistoryResponses];
+
+export type HelmRollbackData = {
+  body?: never;
+  path: {
+    /**
+     * Environment(Endpoint) identifier
+     */
+    id: number;
+    /**
+     * Helm release name
+     */
+    release: string;
+  };
+  query?: {
+    /**
+     * specify an optional namespace
+     */
+    namespace?: string;
+    /**
+     * specify the revision to rollback to (defaults to previous revision if not specified)
+     */
+    revision?: number;
+    /**
+     * wait for resources to be ready (default: false)
+     */
+    wait?: boolean;
+    /**
+     * wait for jobs to complete before marking the release as successful (default: false)
+     */
+    waitForJobs?: boolean;
+    /**
+     * performs pods restart for the resource if applicable (default: true)
+     */
+    recreate?: boolean;
+    /**
+     * force resource update through delete/recreate if needed (default: false)
+     */
+    force?: boolean;
+    /**
+     * time to wait for any individual Kubernetes operation in seconds (default: 300)
+     */
+    timeout?: number;
+  };
+  url: '/endpoints/{id}/kubernetes/helm/{release}/rollback';
+};
+
+export type HelmRollbackErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier or release name.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to rollback the release.
+   */
+  500: unknown;
+};
+
+export type HelmRollbackResponses = {
+  /**
+   * Success
+   */
+  200: ReleaseRelease;
+};
+
+export type HelmRollbackResponse =
+  HelmRollbackResponses[keyof HelmRollbackResponses];
+
+export type EndpointRegistriesListData = {
+  body?: never;
+  path: {
+    /**
+     * Environment(Endpoint) identifier
+     */
+    id: number;
+  };
+  query?: {
+    /**
+     * required if kubernetes environment, will show registries by namespace
+     */
+    namespace?: string;
+  };
+  url: '/endpoints/{id}/registries';
+};
+
+export type EndpointRegistriesListErrors = {
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type EndpointRegistriesListResponses = {
+  /**
+   * Success
+   */
+  200: Array<PortainerRegistry>;
+};
+
+export type EndpointRegistriesListResponse =
+  EndpointRegistriesListResponses[keyof EndpointRegistriesListResponses];
+
+export type EndpointRegistryAccessData = {
+  /**
+   * details
+   */
+  body: EndpointsRegistryAccessPayload;
+  path: {
+    /**
+     * Environment(Endpoint) identifier
+     */
+    id: number;
+    /**
+     * Registry identifier
+     */
+    registryId: number;
+  };
+  query?: never;
+  url: '/endpoints/{id}/registries/{registryId}';
+};
+
+export type EndpointRegistryAccessErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Permission denied
+   */
+  403: unknown;
+  /**
+   * Endpoint not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type EndpointRegistryAccessResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type EndpointRegistryAccessResponse =
+  EndpointRegistryAccessResponses[keyof EndpointRegistryAccessResponses];
+
+export type EndpointSettingsUpdateData = {
+  /**
+   * Environment(Endpoint) details
+   */
+  body: EndpointsEndpointSettingsUpdatePayload;
+  path: {
+    /**
+     * Environment(Endpoint) identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/endpoints/{id}/settings';
+};
+
+export type EndpointSettingsUpdateErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Environment(Endpoint) not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type EndpointSettingsUpdateResponses = {
+  /**
+   * Success
+   */
+  200: PortainerEndpoint;
+};
+
+export type EndpointSettingsUpdateResponse =
+  EndpointSettingsUpdateResponses[keyof EndpointSettingsUpdateResponses];
+
+export type EndpointSnapshotData = {
+  body?: never;
+  path: {
+    /**
+     * Environment(Endpoint) identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/endpoints/{id}/snapshot';
+};
+
+export type EndpointSnapshotErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Environment(Endpoint) not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type EndpointSnapshotResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type EndpointSnapshotResponse =
+  EndpointSnapshotResponses[keyof EndpointSnapshotResponses];
+
+export type EndpointDeleteBatchData = {
+  /**
+   * List of environments to delete, with optional deleteCluster flag to clean-up associated resources (cloud environments only)
+   */
+  body: EndpointsEndpointDeleteBatchPayload2;
+  path?: never;
+  query?: never;
+  url: '/endpoints/delete';
+};
+
+export type EndpointDeleteBatchErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access or operation not allowed.
+   */
+  403: unknown;
+  /**
+   * Server error occurred while attempting to delete the specified environments.
+   */
+  500: unknown;
+};
+
+export type EndpointDeleteBatchResponses = {
+  /**
+   * Environment(s) successfully deleted.
+   */
+  204: void;
+  /**
+   * Partial success. Some environments were deleted successfully, while others failed.
+   */
+  207: EndpointsEndpointDeleteBatchPartialResponse;
+};
+
+export type EndpointDeleteBatchResponse =
+  EndpointDeleteBatchResponses[keyof EndpointDeleteBatchResponses];
+
+export type EndpointCreateGlobalKeyData = {
+  body?: never;
+  path?: never;
+  query?: never;
+  url: '/endpoints/global-key';
+};
+
+export type EndpointCreateGlobalKeyErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type EndpointCreateGlobalKeyResponses = {
+  /**
+   * Success
+   */
+  200: EndpointsEndpointCreateGlobalKeyResponse;
+};
+
+export type EndpointCreateGlobalKeyResponse =
+  EndpointCreateGlobalKeyResponses[keyof EndpointCreateGlobalKeyResponses];
+
+export type EndpointUpdateRelationsData = {
+  /**
+   * Environment relations data
+   */
+  body: EndpointsEndpointUpdateRelationsPayload;
+  path?: never;
+  query?: never;
+  url: '/endpoints/relations';
+};
+
+export type EndpointUpdateRelationsErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Unauthorized
+   */
+  401: unknown;
+  /**
+   * Not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type EndpointUpdateRelationsResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type EndpointUpdateRelationsResponse =
+  EndpointUpdateRelationsResponses[keyof EndpointUpdateRelationsResponses];
+
+export type EndpointSnapshotsData = {
+  body?: never;
+  path?: never;
+  query?: never;
+  url: '/endpoints/snapshot';
+};
+
+export type EndpointSnapshotsErrors = {
+  /**
+   * Server Error
+   */
+  500: unknown;
+};
+
+export type EndpointSnapshotsResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type EndpointSnapshotsResponse =
+  EndpointSnapshotsResponses[keyof EndpointSnapshotsResponses];
+
+export type EndpointSummaryCountsData = {
+  body?: never;
+  path?: never;
+  query?: never;
+  url: '/endpoints/summary';
+};
+
+export type EndpointSummaryCountsErrors = {
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type EndpointSummaryCountsResponses = {
+  /**
+   * Environment summary counts
+   */
+  200: EndpointsEnvironmentSummaryCountsResponse;
+};
+
+export type EndpointSummaryCountsResponse =
+  EndpointSummaryCountsResponses[keyof EndpointSummaryCountsResponses];
+
+export type GitOperationRepoFilePreviewData = {
+  /**
+   * Template details
+   */
+  body: GitopsRepositoryFilePreviewPayload;
+  path?: never;
+  query?: never;
+  url: '/gitops/repo/file/preview';
+};
+
+export type GitOperationRepoFilePreviewErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Source not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type GitOperationRepoFilePreviewResponses = {
+  /**
+   * Success
+   */
+  200: GitopsFileResponse;
+};
+
+export type GitOperationRepoFilePreviewResponse =
+  GitOperationRepoFilePreviewResponses[keyof GitOperationRepoFilePreviewResponses];
+
+export type GitOpsSourcesListData = {
+  body?: never;
+  path?: never;
+  query?: {
+    /**
+     * Search term (matches URL)
+     */
+    search?: string;
+    /**
+     * Sort field: name | status | type
+     */
+    sort?: string;
+    /**
+     * Sort order: asc or desc
+     */
+    order?: string;
+    /**
+     * Pagination start index
+     */
+    start?: number;
+    /**
+     * Pagination limit (0 = unlimited)
+     */
+    limit?: number;
+    /**
+     * Filter by status: healthy | syncing | error | paused | unknown
+     */
+    status?: string;
+    /**
+     * Filter by source type: git | oci | helm
+     */
+    type?: 'git' | 'helm' | 'oci';
+  };
+  url: '/gitops/sources';
+};
+
+export type GitOpsSourcesListErrors = {
+  /**
+   * Invalid status parameter
+   */
+  400: unknown;
+  /**
+   * Access denied
+   */
+  403: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type GitOpsSourcesListResponses = {
+  /**
+   * OK
+   */
+  200: Array<SourcesSource>;
+};
+
+export type GitOpsSourcesListResponse =
+  GitOpsSourcesListResponses[keyof GitOpsSourcesListResponses];
+
+export type GitOpsSourcesDeleteData = {
+  body?: never;
+  path: {
+    /**
+     * Source identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/gitops/sources/{id}';
+};
+
+export type GitOpsSourcesDeleteErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Access denied
+   */
+  403: unknown;
+  /**
+   * Source not found
+   */
+  404: unknown;
+  /**
+   * Source is in use by one or more workflows or custom templates
+   */
+  409: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type GitOpsSourcesDeleteResponses = {
+  /**
+   * Source deleted
+   */
+  204: void;
+};
+
+export type GitOpsSourcesDeleteResponse =
+  GitOpsSourcesDeleteResponses[keyof GitOpsSourcesDeleteResponses];
+
+export type GitOpsSourceGetData = {
+  body?: never;
+  path: {
+    /**
+     * Source identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/gitops/sources/{id}';
+};
+
+export type GitOpsSourceGetErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Access denied
+   */
+  403: unknown;
+  /**
+   * Source not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type GitOpsSourceGetResponses = {
+  /**
+   * OK
+   */
+  200: SourcesSourceDetail;
+};
+
+export type GitOpsSourceGetResponse =
+  GitOpsSourceGetResponses[keyof GitOpsSourceGetResponses];
+
+export type GitOpsSourcesUpdateGitData = {
+  /**
+   * Git source details
+   */
+  body: SourcesGitSourceUpdatePayload;
+  path: {
+    /**
+     * Source identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/gitops/sources/{id}';
+};
+
+export type GitOpsSourcesUpdateGitErrors = {
+  /**
+   * Invalid request payload
+   */
+  400: unknown;
+  /**
+   * Access denied
+   */
+  403: unknown;
+  /**
+   * Source not found
+   */
+  404: unknown;
+  /**
+   * A source with this URL and credentials already exists
+   */
+  409: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type GitOpsSourcesUpdateGitResponses = {
+  /**
+   * OK
+   */
+  200: PortainerSource;
+};
+
+export type GitOpsSourcesUpdateGitResponse =
+  GitOpsSourcesUpdateGitResponses[keyof GitOpsSourcesUpdateGitResponses];
+
+export type GitOpsSourcesUpdateAccessData = {
+  /**
+   * Source access control
+   */
+  body: SourcesSourceAccessUpdatePayload;
+  path: {
+    /**
+     * Source identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/gitops/sources/{id}/access';
+};
+
+export type GitOpsSourcesUpdateAccessErrors = {
+  /**
+   * Invalid request payload
+   */
+  400: unknown;
+  /**
+   * Access denied
+   */
+  403: unknown;
+  /**
+   * Source not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type GitOpsSourcesUpdateAccessResponses = {
+  /**
+   * OK
+   */
+  200: PortainerSource;
+};
+
+export type GitOpsSourcesUpdateAccessResponse =
+  GitOpsSourcesUpdateAccessResponses[keyof GitOpsSourcesUpdateAccessResponses];
+
+export type GitOpsSourcesTestByIdData = {
+  /**
+   * Optional connection overrides; omitted fields fall back to stored values
+   */
+  body?: SourcesGitSourceUpdatePayload;
+  path: {
+    /**
+     * Source identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/gitops/sources/{id}/test';
+};
+
+export type GitOpsSourcesTestByIdErrors = {
+  /**
+   * Invalid request payload
+   */
+  400: unknown;
+  /**
+   * Access denied
+   */
+  403: unknown;
+  /**
+   * Source not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type GitOpsSourcesTestByIdResponses = {
+  /**
+   * Connection test result
+   */
+  200: SourcesConnectionTestResult;
+};
+
+export type GitOpsSourcesTestByIdResponse =
+  GitOpsSourcesTestByIdResponses[keyof GitOpsSourcesTestByIdResponses];
+
+export type GitOpsSourcesCreateGitData = {
+  /**
+   * Git source details
+   */
+  body: SourcesGitSourceCreatePayload;
+  path?: never;
+  query?: never;
+  url: '/gitops/sources/git';
+};
+
+export type GitOpsSourcesCreateGitErrors = {
+  /**
+   * Invalid request payload
+   */
+  400: unknown;
+  /**
+   * Access denied
+   */
+  403: unknown;
+  /**
+   * A source with this URL and credentials already exists
+   */
+  409: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type GitOpsSourcesCreateGitResponses = {
+  /**
+   * Created
+   */
+  201: PortainerSource;
+};
+
+export type GitOpsSourcesCreateGitResponse =
+  GitOpsSourcesCreateGitResponses[keyof GitOpsSourcesCreateGitResponses];
+
+export type GitOpsSourcesSummaryData = {
+  body?: never;
+  path?: never;
+  query?: never;
+  url: '/gitops/sources/summary';
+};
+
+export type GitOpsSourcesSummaryErrors = {
+  /**
+   * Access denied
+   */
+  403: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type GitOpsSourcesSummaryResponses = {
+  /**
+   * OK
+   */
+  200: WorkflowsStatusSummary;
+};
+
+export type GitOpsSourcesSummaryResponse =
+  GitOpsSourcesSummaryResponses[keyof GitOpsSourcesSummaryResponses];
+
+export type GitOpsSourcesTestData = {
+  /**
+   * Git connection details
+   */
+  body: SourcesGitSourceCreatePayload;
+  path?: never;
+  query?: never;
+  url: '/gitops/sources/test';
+};
+
+export type GitOpsSourcesTestErrors = {
+  /**
+   * Invalid request payload
+   */
+  400: unknown;
+  /**
+   * Access denied
+   */
+  403: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type GitOpsSourcesTestResponses = {
+  /**
+   * Connection test result
+   */
+  200: SourcesConnectionTestResult;
+};
+
+export type GitOpsSourcesTestResponse =
+  GitOpsSourcesTestResponses[keyof GitOpsSourcesTestResponses];
+
+export type GitOpsWorkflowsListData = {
+  body?: never;
+  path?: never;
+  query?: {
+    /**
+     * Search term (matches name or repository URL)
+     */
+    search?: string;
+    /**
+     * Sort field: name | type | status | creationDate | lastSyncDate
+     */
+    sort?: string;
+    /**
+     * Sort order: asc or desc
+     */
+    order?: string;
+    /**
+     * Pagination start index
+     */
+    start?: number;
+    /**
+     * Pagination limit (0 = unlimited)
+     */
+    limit?: number;
+    /**
+     * Filter by environment IDs (e.g. endpointIds[]=1&endpointIds[]=2)
+     */
+    endpointIds?: Array<number>;
+    /**
+     * Filter by status: healthy | syncing | error | paused | unknown
+     */
+    status?: string;
+    /**
+     * Filter by type: stack
+     */
+    type?: string;
+    /**
+     * Filter by platform: dockerStandalone | dockerSwarm | kubernetes
+     */
+    platform?: string;
+  };
+  url: '/gitops/workflows';
+};
+
+export type GitOpsWorkflowsListErrors = {
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type GitOpsWorkflowsListResponses = {
+  /**
+   * OK
+   */
+  200: Array<WorkflowsWorkflow>;
+};
+
+export type GitOpsWorkflowsListResponse =
+  GitOpsWorkflowsListResponses[keyof GitOpsWorkflowsListResponses];
+
+export type GitOpsWorkflowGetData = {
+  body?: never;
+  path: {
+    /**
+     * Workflow identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/gitops/workflows/{id}';
+};
+
+export type GitOpsWorkflowGetErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Workflow not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type GitOpsWorkflowGetResponses = {
+  /**
+   * OK
+   */
+  200: WorkflowsWorkflowDetail;
+};
+
+export type GitOpsWorkflowGetResponse =
+  GitOpsWorkflowGetResponses[keyof GitOpsWorkflowGetResponses];
+
+export type GitOpsWorkflowsSummaryData = {
+  body?: never;
+  path?: never;
+  query?: never;
+  url: '/gitops/workflows/summary';
+};
+
+export type GitOpsWorkflowsSummaryErrors = {
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type GitOpsWorkflowsSummaryResponses = {
+  /**
+   * OK
+   */
+  200: WorkflowsStatusSummary;
+};
+
+export type GitOpsWorkflowsSummaryResponse =
+  GitOpsWorkflowsSummaryResponses[keyof GitOpsWorkflowsSummaryResponses];
+
+export type GetAllKubernetesApplicationsData = {
+  body?: never;
+  path: {
+    /**
+     * Environment(Endpoint) identifier
+     */
+    id: number;
+  };
+  query: {
+    /**
+     * Namespace name
+     */
+    namespace: string;
+    /**
+     * Node name
+     */
+    nodeName: string;
+  };
+  url: '/kubernetes/{id}/applications';
+};
+
+export type GetAllKubernetesApplicationsErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to retrieve the list of applications from the cluster.
+   */
+  500: unknown;
+};
+
+export type GetAllKubernetesApplicationsResponses = {
+  /**
+   * Success
+   */
+  200: Array<KubernetesK8sApplication>;
+};
+
+export type GetAllKubernetesApplicationsResponse =
+  GetAllKubernetesApplicationsResponses[keyof GetAllKubernetesApplicationsResponses];
+
+export type GetAllKubernetesApplicationsCountData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/applications/count';
+};
+
+export type GetAllKubernetesApplicationsCountErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to retrieve the count of all applications from the cluster.
+   */
+  500: unknown;
+};
+
+export type GetAllKubernetesApplicationsCountResponses = {
+  /**
+   * Success
+   */
+  200: number;
+};
+
+export type GetAllKubernetesApplicationsCountResponse =
+  GetAllKubernetesApplicationsCountResponses[keyof GetAllKubernetesApplicationsCountResponses];
+
+export type DeleteClusterRoleBindingsData = {
+  /**
+   * A list of cluster role bindings to delete
+   */
+  body: Array<string>;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/cluster_role_bindings/delete';
+};
+
+export type DeleteClusterRoleBindingsErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier or unable to find a specific cluster role binding.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to delete cluster role bindings.
+   */
+  500: unknown;
+};
+
+export type DeleteClusterRoleBindingsResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type DeleteClusterRoleBindingsResponse =
+  DeleteClusterRoleBindingsResponses[keyof DeleteClusterRoleBindingsResponses];
+
+export type DeleteClusterRolesData = {
+  /**
+   * A list of cluster roles to delete
+   */
+  body: Array<string>;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/cluster_roles/delete';
+};
+
+export type DeleteClusterRolesErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier or unable to find a specific cluster role.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to delete cluster roles.
+   */
+  500: unknown;
+};
+
+export type DeleteClusterRolesResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type DeleteClusterRolesResponse =
+  DeleteClusterRolesResponses[keyof DeleteClusterRolesResponses];
+
+export type GetAllKubernetesClusterRoleBindingsData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/clusterrolebindings';
+};
+
+export type GetAllKubernetesClusterRoleBindingsErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to retrieve the list of cluster role bindings.
+   */
+  500: unknown;
+};
+
+export type GetAllKubernetesClusterRoleBindingsResponses = {
+  /**
+   * Success
+   */
+  200: Array<KubernetesK8sClusterRoleBinding>;
+};
+
+export type GetAllKubernetesClusterRoleBindingsResponse =
+  GetAllKubernetesClusterRoleBindingsResponses[keyof GetAllKubernetesClusterRoleBindingsResponses];
+
+export type GetAllKubernetesClusterRolesData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/clusterroles';
+};
+
+export type GetAllKubernetesClusterRolesErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to retrieve the list of cluster roles.
+   */
+  500: unknown;
+};
+
+export type GetAllKubernetesClusterRolesResponses = {
+  /**
+   * Success
+   */
+  200: Array<KubernetesK8sClusterRole>;
+};
+
+export type GetAllKubernetesClusterRolesResponse =
+  GetAllKubernetesClusterRolesResponses[keyof GetAllKubernetesClusterRolesResponses];
+
+export type GetAllKubernetesConfigMapsData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+  };
+  query: {
+    /**
+     * Set to true to include information about applications that use the ConfigMaps in the response
+     */
+    isUsed: boolean;
+  };
+  url: '/kubernetes/{id}/configmaps';
+};
+
+export type GetAllKubernetesConfigMapsErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to retrieve all configmaps from the cluster.
+   */
+  500: unknown;
+};
+
+export type GetAllKubernetesConfigMapsResponses = {
+  /**
+   * Success
+   */
+  200: Array<KubernetesK8sConfigMap>;
+};
+
+export type GetAllKubernetesConfigMapsResponse =
+  GetAllKubernetesConfigMapsResponses[keyof GetAllKubernetesConfigMapsResponses];
+
+export type GetAllKubernetesConfigMapsCountData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/configmaps/count';
+};
+
+export type GetAllKubernetesConfigMapsCountErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to retrieve the count of all configmaps from the cluster.
+   */
+  500: unknown;
+};
+
+export type GetAllKubernetesConfigMapsCountResponses = {
+  /**
+   * Success
+   */
+  200: number;
+};
+
+export type GetAllKubernetesConfigMapsCountResponse =
+  GetAllKubernetesConfigMapsCountResponses[keyof GetAllKubernetesConfigMapsCountResponses];
+
+export type GetKubernetesCronJobsData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/cron_jobs';
+};
+
+export type GetKubernetesCronJobsErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to retrieve the list of Cron Jobs.
+   */
+  500: unknown;
+};
+
+export type GetKubernetesCronJobsResponses = {
+  /**
+   * Success
+   */
+  200: Array<KubernetesK8sCronJob>;
+};
+
+export type GetKubernetesCronJobsResponse =
+  GetKubernetesCronJobsResponses[keyof GetKubernetesCronJobsResponses];
+
+export type DeleteCronJobsData = {
+  /**
+   * A map where the key is the namespace and the value is an array of Cron Jobs to delete
+   */
+  body: KubernetesK8sCronJobDeleteRequests;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/cron_jobs/delete';
+};
+
+export type DeleteCronJobsErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier or unable to find a specific service account.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to delete Cron Jobs.
+   */
+  500: unknown;
+};
+
+export type DeleteCronJobsResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type DeleteCronJobsResponse =
+  DeleteCronJobsResponses[keyof DeleteCronJobsResponses];
+
+export type GetKubernetesDashboardData = {
+  body?: never;
+  path: {
+    /**
+     * Environment (Endpoint) identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/dashboard';
+};
+
+export type GetKubernetesDashboardErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type GetKubernetesDashboardResponses = {
+  /**
+   * Success
+   */
+  200: Array<KubernetesK8sDashboard>;
+};
+
+export type GetKubernetesDashboardResponse =
+  GetKubernetesDashboardResponses[keyof GetKubernetesDashboardResponses];
+
+export type DescribeResourceData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+  };
+  query: {
+    /**
+     * Resource name
+     */
+    name: string;
+    /**
+     * Resource kind
+     */
+    kind: string;
+    /**
+     * Namespace
+     */
+    namespace?: string;
+  };
+  url: '/kubernetes/{id}/describe';
+};
+
+export type DescribeResourceErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to retrieve resource description
+   */
+  500: unknown;
+};
+
+export type DescribeResourceResponses = {
+  /**
+   * Success
+   */
+  200: KubernetesDescribeResourceResponse;
+};
+
+export type DescribeResourceResponse =
+  DescribeResourceResponses[keyof DescribeResourceResponses];
+
+export type GetAllKubernetesEventsData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+  };
+  query?: {
+    /**
+     * The resource id of the involved kubernetes object
+     */
+    resourceId?: string;
+  };
+  url: '/kubernetes/{id}/events';
+};
+
+export type GetAllKubernetesEventsErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Server error occurred while attempting to retrieve the events.
+   */
+  500: unknown;
+};
+
+export type GetAllKubernetesEventsResponses = {
+  /**
+   * Success
+   */
+  200: Array<KubernetesK8sEvent>;
+};
+
+export type GetAllKubernetesEventsResponse =
+  GetAllKubernetesEventsResponses[keyof GetAllKubernetesEventsResponses];
+
+export type GetAllKubernetesIngressControllersData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+  };
+  query?: {
+    /**
+     * Only return allowed ingress controllers
+     */
+    allowedOnly?: boolean;
+  };
+  url: '/kubernetes/{id}/ingresscontrollers';
+};
+
+export type GetAllKubernetesIngressControllersErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to retrieve ingress controllers
+   */
+  500: unknown;
+};
+
+export type GetAllKubernetesIngressControllersResponses = {
+  /**
+   * Success
+   */
+  200: Array<KubernetesK8sIngressController>;
+};
+
+export type GetAllKubernetesIngressControllersResponse =
+  GetAllKubernetesIngressControllersResponses[keyof GetAllKubernetesIngressControllersResponses];
+
+export type UpdateKubernetesIngressControllersData = {
+  /**
+   * Ingress controllers
+   */
+  body: KubernetesK8sIngressControllerArray;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/ingresscontrollers';
+};
+
+export type UpdateKubernetesIngressControllersErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier or unable to find the ingress controllers to update.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to update ingress controllers.
+   */
+  500: unknown;
+};
+
+export type UpdateKubernetesIngressControllersResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type UpdateKubernetesIngressControllersResponse =
+  UpdateKubernetesIngressControllersResponses[keyof UpdateKubernetesIngressControllersResponses];
+
+export type GetAllKubernetesClusterIngressesData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+  };
+  query?: {
+    /**
+     * Lookup services associated with each ingress
+     */
+    withServices?: boolean;
+  };
+  url: '/kubernetes/{id}/ingresses';
+};
+
+export type GetAllKubernetesClusterIngressesErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to retrieve ingresses.
+   */
+  500: unknown;
+};
+
+export type GetAllKubernetesClusterIngressesResponses = {
+  /**
+   * Success
+   */
+  200: Array<KubernetesK8sIngressInfo>;
+};
+
+export type GetAllKubernetesClusterIngressesResponse =
+  GetAllKubernetesClusterIngressesResponses[keyof GetAllKubernetesClusterIngressesResponses];
+
+export type GetAllKubernetesClusterIngressesCountData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/ingresses/count';
+};
+
+export type GetAllKubernetesClusterIngressesCountErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to retrieve ingresses count.
+   */
+  500: unknown;
+};
+
+export type GetAllKubernetesClusterIngressesCountResponses = {
+  /**
+   * Success
+   */
+  200: number;
+};
+
+export type GetAllKubernetesClusterIngressesCountResponse =
+  GetAllKubernetesClusterIngressesCountResponses[keyof GetAllKubernetesClusterIngressesCountResponses];
+
+export type DeleteKubernetesIngressesData = {
+  /**
+   * Ingress details
+   */
+  body: KubernetesK8sIngressDeleteRequests;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/ingresses/delete';
+};
+
+export type DeleteKubernetesIngressesErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier or unable to find a specific ingress.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to delete specified ingresses.
+   */
+  500: unknown;
+};
+
+export type DeleteKubernetesIngressesResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type DeleteKubernetesIngressesResponse =
+  DeleteKubernetesIngressesResponses[keyof DeleteKubernetesIngressesResponses];
+
+export type GetKubernetesJobsData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+  };
+  query?: {
+    /**
+     * Whether to include Jobs that have a cronjob owner
+     */
+    includeCronJobChildren?: boolean;
+  };
+  url: '/kubernetes/{id}/jobs';
+};
+
+export type GetKubernetesJobsErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to retrieve the list of Jobs.
+   */
+  500: unknown;
+};
+
+export type GetKubernetesJobsResponses = {
+  /**
+   * Success
+   */
+  200: Array<KubernetesK8sJob>;
+};
+
+export type GetKubernetesJobsResponse =
+  GetKubernetesJobsResponses[keyof GetKubernetesJobsResponses];
+
+export type DeleteJobsData = {
+  /**
+   * A map where the key is the namespace and the value is an array of Jobs to delete
+   */
+  body: KubernetesK8sJobDeleteRequests;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/jobs/delete';
+};
+
+export type DeleteJobsErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier or unable to find a specific service account.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to delete Jobs.
+   */
+  500: unknown;
+};
+
+export type DeleteJobsResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type DeleteJobsResponse = DeleteJobsResponses[keyof DeleteJobsResponses];
+
+export type GetKubernetesMaxResourceLimitsData = {
+  body?: never;
+  path: {
+    /**
+     * Environment(Endpoint) identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/max_resource_limits';
+};
+
+export type GetKubernetesMaxResourceLimitsErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to retrieve nodes limits.
+   */
+  500: unknown;
+};
+
+export type GetKubernetesMaxResourceLimitsResponses = {
+  /**
+   * Success
+   */
+  200: PortainerK8sNodesLimits;
+};
+
+export type GetKubernetesMaxResourceLimitsResponse =
+  GetKubernetesMaxResourceLimitsResponses[keyof GetKubernetesMaxResourceLimitsResponses];
+
+export type GetApplicationsResourcesData = {
+  body?: never;
+  path: {
+    /**
+     * Environment(Endpoint) identifier
+     */
+    id: number;
+  };
+  query: {
+    /**
+     * Node name
+     */
+    node: string;
+  };
+  url: '/kubernetes/{id}/metrics/applications_resources';
+};
+
+export type GetApplicationsResourcesErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to retrieve the total resource requests and limits for all applications from the cluster.
+   */
+  500: unknown;
+};
+
+export type GetApplicationsResourcesResponses = {
+  /**
+   * Success
+   */
+  200: KubernetesK8sApplicationResource;
+};
+
+export type GetApplicationsResourcesResponse =
+  GetApplicationsResourcesResponses[keyof GetApplicationsResourcesResponses];
+
+export type GetKubernetesMetricsForAllNodesData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/metrics/nodes';
+};
+
+export type GetKubernetesMetricsForAllNodesErrors = {
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Server error occurred while attempting to retrieve the list of nodes with their live metrics.
+   */
+  500: unknown;
+};
+
+export type GetKubernetesMetricsForAllNodesResponses = {
+  /**
+   * Success
+   */
+  200: V1Beta1NodeMetricsList;
+};
+
+export type GetKubernetesMetricsForAllNodesResponse =
+  GetKubernetesMetricsForAllNodesResponses[keyof GetKubernetesMetricsForAllNodesResponses];
+
+export type GetKubernetesMetricsForNodeData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+    /**
+     * Node identifier
+     */
+    name: string;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/metrics/nodes/{name}';
+};
+
+export type GetKubernetesMetricsForNodeErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Server error occurred while attempting to retrieve the live metrics for the specified node.
+   */
+  500: unknown;
+};
+
+export type GetKubernetesMetricsForNodeResponses = {
+  /**
+   * Success
+   */
+  200: V1Beta1NodeMetrics;
+};
+
+export type GetKubernetesMetricsForNodeResponse =
+  GetKubernetesMetricsForNodeResponses[keyof GetKubernetesMetricsForNodeResponses];
+
+export type GetKubernetesMetricsForAllPodsData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+    /**
+     * Namespace
+     */
+    namespace: string;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/metrics/pods/{namespace}';
+};
+
+export type GetKubernetesMetricsForAllPodsErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Server error occurred while attempting to retrieve the list of pods with their live metrics.
+   */
+  500: unknown;
+};
+
+export type GetKubernetesMetricsForAllPodsResponses = {
+  /**
+   * Success
+   */
+  200: V1Beta1PodMetricsList;
+};
+
+export type GetKubernetesMetricsForAllPodsResponse =
+  GetKubernetesMetricsForAllPodsResponses[keyof GetKubernetesMetricsForAllPodsResponses];
+
+export type GetKubernetesMetricsForPodData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+    /**
+     * Namespace
+     */
+    namespace: string;
+    /**
+     * Pod identifier
+     */
+    name: string;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/metrics/pods/{namespace}/{name}';
+};
+
+export type GetKubernetesMetricsForPodErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Server error occurred while attempting to retrieve the live metrics for the specified pod.
+   */
+  500: unknown;
+};
+
+export type GetKubernetesMetricsForPodResponses = {
+  /**
+   * Success
+   */
+  200: V1Beta1PodMetrics;
+};
+
+export type GetKubernetesMetricsForPodResponse =
+  GetKubernetesMetricsForPodResponses[keyof GetKubernetesMetricsForPodResponses];
+
+export type DeleteKubernetesNamespaceData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/namespaces';
+};
+
+export type DeleteKubernetesNamespaceErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access or operation not allowed.
+   */
+  403: unknown;
+  /**
+   * Server error occurred while attempting to delete the namespace.
+   */
+  500: unknown;
+};
+
+export type DeleteKubernetesNamespaceResponses = {
+  /**
+   * Success
+   */
+  200: string;
+};
+
+export type DeleteKubernetesNamespaceResponse =
+  DeleteKubernetesNamespaceResponses[keyof DeleteKubernetesNamespaceResponses];
+
+export type GetKubernetesNamespacesData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+  };
+  query: {
+    /**
+     * When set to true, include the resource quota information as part of the Namespace information. Default is false
+     */
+    withResourceQuota: boolean;
+    /**
+     * When set to true, include the unhealthy events information as part of the Namespace information. Default is false
+     */
+    withUnhealthyEvents: boolean;
+  };
+  url: '/kubernetes/{id}/namespaces';
+};
+
+export type GetKubernetesNamespacesErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to retrieve the list of namespaces.
+   */
+  500: unknown;
+};
+
+export type GetKubernetesNamespacesResponses = {
+  /**
+   * Success
+   */
+  200: Array<PortainerK8sNamespaceInfo>;
+};
+
+export type GetKubernetesNamespacesResponse =
+  GetKubernetesNamespacesResponses[keyof GetKubernetesNamespacesResponses];
+
+export type CreateKubernetesNamespaceData = {
+  /**
+   * Namespace configuration details
+   */
+  body: KubernetesK8sNamespaceDetails;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/namespaces';
+};
+
+export type CreateKubernetesNamespaceErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Conflict - the namespace already exists.
+   */
+  409: unknown;
+  /**
+   * Server error occurred while attempting to create the namespace.
+   */
+  500: unknown;
+};
+
+export type CreateKubernetesNamespaceResponses = {
+  /**
+   * Success
+   */
+  200: PortainerK8sNamespaceInfo;
+};
+
+export type CreateKubernetesNamespaceResponse =
+  CreateKubernetesNamespaceResponses[keyof CreateKubernetesNamespaceResponses];
+
+export type UpdateKubernetesNamespaceDeprecatedData = {
+  /**
+   * Namespace details
+   */
+  body: KubernetesK8sNamespaceDetails2;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+    /**
+     * Namespace
+     */
+    namespace: string;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/namespaces';
+};
+
+export type UpdateKubernetesNamespaceDeprecatedErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier or unable to find a specific namespace.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to update the namespace.
+   */
+  500: unknown;
+};
+
+export type UpdateKubernetesNamespaceDeprecatedResponses = {
+  /**
+   * Success
+   */
+  200: PortainerK8sNamespaceInfo;
+};
+
+export type UpdateKubernetesNamespaceDeprecatedResponse =
+  UpdateKubernetesNamespaceDeprecatedResponses[keyof UpdateKubernetesNamespaceDeprecatedResponses];
+
+export type GetKubernetesNamespaceData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+    /**
+     * The namespace name to get details for
+     */
+    namespace: string;
+  };
+  query: {
+    /**
+     * When set to true, include the resource quota information as part of the Namespace information. Default is false
+     */
+    withResourceQuota: boolean;
+  };
+  url: '/kubernetes/{id}/namespaces/{namespace}';
+};
+
+export type GetKubernetesNamespaceErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier or unable to find a specific namespace.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to retrieve specified namespace information.
+   */
+  500: unknown;
+};
+
+export type GetKubernetesNamespaceResponses = {
+  /**
+   * Success
+   */
+  200: PortainerK8sNamespaceInfo;
+};
+
+export type GetKubernetesNamespaceResponse =
+  GetKubernetesNamespaceResponses[keyof GetKubernetesNamespaceResponses];
+
+export type UpdateKubernetesNamespaceData = {
+  /**
+   * Namespace details
+   */
+  body: KubernetesK8sNamespaceDetails2;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+    /**
+     * Namespace
+     */
+    namespace: string;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/namespaces/{namespace}';
+};
+
+export type UpdateKubernetesNamespaceErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier or unable to find a specific namespace.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to update the namespace.
+   */
+  500: unknown;
+};
+
+export type UpdateKubernetesNamespaceResponses = {
+  /**
+   * Success
+   */
+  200: PortainerK8sNamespaceInfo;
+};
+
+export type UpdateKubernetesNamespaceResponse =
+  UpdateKubernetesNamespaceResponses[keyof UpdateKubernetesNamespaceResponses];
+
+export type GetKubernetesConfigMapData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+    /**
+     * The namespace name where the configmap is located
+     */
+    namespace: string;
+    /**
+     * The configmap name to get details for
+     */
+    configmap: string;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/namespaces/{namespace}/configmaps/{configmap}';
+};
+
+export type GetKubernetesConfigMapErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier or a configmap with the specified name in the given namespace.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to retrieve a configmap by name within the specified namespace.
+   */
+  500: unknown;
+};
+
+export type GetKubernetesConfigMapResponses = {
+  /**
+   * Success
+   */
+  200: KubernetesK8sConfigMap;
+};
+
+export type GetKubernetesConfigMapResponse =
+  GetKubernetesConfigMapResponses[keyof GetKubernetesConfigMapResponses];
+
+export type GetKubernetesEventsForNamespaceData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+    /**
+     * The namespace name the events are associated to
+     */
+    namespace: string;
+  };
+  query?: {
+    /**
+     * The resource id of the involved kubernetes object
+     */
+    resourceId?: string;
+  };
+  url: '/kubernetes/{id}/namespaces/{namespace}/events';
+};
+
+export type GetKubernetesEventsForNamespaceErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Server error occurred while attempting to retrieve the events within the specified namespace.
+   */
+  500: unknown;
+};
+
+export type GetKubernetesEventsForNamespaceResponses = {
+  /**
+   * Success
+   */
+  200: Array<KubernetesK8sEvent>;
+};
+
+export type GetKubernetesEventsForNamespaceResponse =
+  GetKubernetesEventsForNamespaceResponses[keyof GetKubernetesEventsForNamespaceResponses];
+
+export type GetKubernetesIngressControllersByNamespaceData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+    /**
+     * Namespace
+     */
+    namespace: string;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/namespaces/{namespace}/ingresscontrollers';
+};
+
+export type GetKubernetesIngressControllersByNamespaceErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier or a namespace with the specified name.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to retrieve ingress controllers by a namespace
+   */
+  500: unknown;
+};
+
+export type GetKubernetesIngressControllersByNamespaceResponses = {
+  /**
+   * Success
+   */
+  200: Array<KubernetesK8sIngressController>;
+};
+
+export type GetKubernetesIngressControllersByNamespaceResponse =
+  GetKubernetesIngressControllersByNamespaceResponses[keyof GetKubernetesIngressControllersByNamespaceResponses];
+
+export type UpdateKubernetesIngressControllersByNamespaceData = {
+  /**
+   * Ingress controllers
+   */
+  body: KubernetesK8sIngressControllerArray;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+    /**
+     * Namespace name
+     */
+    namespace: string;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/namespaces/{namespace}/ingresscontrollers';
+};
+
+export type UpdateKubernetesIngressControllersByNamespaceErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to update ingress controllers by namespace.
+   */
+  500: unknown;
+};
+
+export type UpdateKubernetesIngressControllersByNamespaceResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type UpdateKubernetesIngressControllersByNamespaceResponse =
+  UpdateKubernetesIngressControllersByNamespaceResponses[keyof UpdateKubernetesIngressControllersByNamespaceResponses];
+
+export type GetAllKubernetesIngressesData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+    /**
+     * Namespace name
+     */
+    namespace: string;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/namespaces/{namespace}/ingresses';
+};
+
+export type GetAllKubernetesIngressesErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to retrieve ingresses
+   */
+  500: unknown;
+};
+
+export type GetAllKubernetesIngressesResponses = {
+  /**
+   * Success
+   */
+  200: Array<KubernetesK8sIngressInfo>;
+};
+
+export type GetAllKubernetesIngressesResponse =
+  GetAllKubernetesIngressesResponses[keyof GetAllKubernetesIngressesResponses];
+
+export type CreateKubernetesIngressData = {
+  /**
+   * Ingress details
+   */
+  body: KubernetesK8sIngressInfo2;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+    /**
+     * Namespace name
+     */
+    namespace: string;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/namespaces/{namespace}/ingresses';
+};
+
+export type CreateKubernetesIngressErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier.
+   */
+  404: unknown;
+  /**
+   * Conflict - an ingress with the same name already exists in the specified namespace.
+   */
+  409: unknown;
+  /**
+   * Server error occurred while attempting to create an ingress.
+   */
+  500: unknown;
+};
+
+export type CreateKubernetesIngressResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type CreateKubernetesIngressResponse =
+  CreateKubernetesIngressResponses[keyof CreateKubernetesIngressResponses];
+
+export type UpdateKubernetesIngressData = {
+  /**
+   * Ingress details
+   */
+  body: KubernetesK8sIngressInfo2;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+    /**
+     * Namespace name
+     */
+    namespace: string;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/namespaces/{namespace}/ingresses';
+};
+
+export type UpdateKubernetesIngressErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier or unable to find the specified ingress.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to update the specified ingress.
+   */
+  500: unknown;
+};
+
+export type UpdateKubernetesIngressResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type UpdateKubernetesIngressResponse =
+  UpdateKubernetesIngressResponses[keyof UpdateKubernetesIngressResponses];
+
+export type GetKubernetesIngressData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+    /**
+     * Namespace name
+     */
+    namespace: string;
+    /**
+     * Ingress name
+     */
+    ingress: string;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/namespaces/{namespace}/ingresses/{ingress}';
+};
+
+export type GetKubernetesIngressErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier or unable to find an ingress with the specified name.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to retrieve an ingress.
+   */
+  500: unknown;
+};
+
+export type GetKubernetesIngressResponses = {
+  /**
+   * Success
+   */
+  200: KubernetesK8sIngressInfo;
+};
+
+export type GetKubernetesIngressResponse =
+  GetKubernetesIngressResponses[keyof GetKubernetesIngressResponses];
+
+export type GetKubernetesPersistentVolumeClaimsInNamespaceData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+    /**
+     * Namespace name
+     */
+    namespace: string;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/namespaces/{namespace}/persistent_volume_claims';
+};
+
+export type GetKubernetesPersistentVolumeClaimsInNamespaceErrors = {
+  /**
+   * Invalid request payload.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access or operation not allowed.
+   */
+  403: unknown;
+  /**
+   * Server error occurred while attempting to retrieve persistent volume claims.
+   */
+  500: unknown;
+};
+
+export type GetKubernetesPersistentVolumeClaimsInNamespaceResponses = {
+  /**
+   * Success
+   */
+  200: Array<KubernetesK8sPersistentVolumeClaim>;
+};
+
+export type GetKubernetesPersistentVolumeClaimsInNamespaceResponse =
+  GetKubernetesPersistentVolumeClaimsInNamespaceResponses[keyof GetKubernetesPersistentVolumeClaimsInNamespaceResponses];
+
+export type GetKubernetesPersistentVolumeClaimData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+    /**
+     * Namespace name
+     */
+    namespace: string;
+    /**
+     * PVC name
+     */
+    name: string;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/namespaces/{namespace}/persistent_volume_claims/{name}';
+};
+
+export type GetKubernetesPersistentVolumeClaimErrors = {
+  /**
+   * Invalid request payload.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access or operation not allowed.
+   */
+  403: unknown;
+  /**
+   * PVC not found.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to retrieve the persistent volume claim.
+   */
+  500: unknown;
+};
+
+export type GetKubernetesPersistentVolumeClaimResponses = {
+  /**
+   * Success
+   */
+  200: KubernetesK8sPersistentVolumeClaim;
+};
+
+export type GetKubernetesPersistentVolumeClaimResponse =
+  GetKubernetesPersistentVolumeClaimResponses[keyof GetKubernetesPersistentVolumeClaimResponses];
+
+export type DeleteKubernetesPodData = {
+  body?: never;
+  path: {
+    /**
+     * Environment(Endpoint) identifier
+     */
+    id: number;
+    /**
+     * Namespace
+     */
+    namespace: string;
+    /**
+     * Pod name
+     */
+    name: string;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/namespaces/{namespace}/pods/{name}';
+};
+
+export type DeleteKubernetesPodErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier or unable to find the specified pod.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to delete the pod.
+   */
+  500: unknown;
+};
+
+export type DeleteKubernetesPodResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type DeleteKubernetesPodResponse =
+  DeleteKubernetesPodResponses[keyof DeleteKubernetesPodResponses];
+
+export type RestartKubernetesPodData = {
+  body?: never;
+  path: {
+    /**
+     * Environment(Endpoint) identifier
+     */
+    id: number;
+    /**
+     * Namespace
+     */
+    namespace: string;
+    /**
+     * Pod name
+     */
+    name: string;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/namespaces/{namespace}/pods/{name}/restart';
+};
+
+export type RestartKubernetesPodErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment, the specified pod, or the cluster does not expose the pod-restart subresource (Kubernetes <1.35 or feature gate disabled).
+   */
+  404: unknown;
+  /**
+   * The cluster does not support the pod-restart subresource (Kubernetes <1.35 or feature gate disabled).
+   */
+  405: unknown;
+  /**
+   * Server error occurred while attempting to restart the pod.
+   */
+  500: unknown;
+};
+
+export type RestartKubernetesPodResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type RestartKubernetesPodResponse =
+  RestartKubernetesPodResponses[keyof RestartKubernetesPodResponses];
+
+export type GetKubernetesSecretData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+    /**
+     * The namespace name where the secret is located
+     */
+    namespace: string;
+    /**
+     * The secret name to get details for
+     */
+    secret: string;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/namespaces/{namespace}/secrets/{secret}';
+};
+
+export type GetKubernetesSecretErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to retrieve a secret by name belong in a namespace.
+   */
+  500: unknown;
+};
+
+export type GetKubernetesSecretResponses = {
+  /**
+   * Success
+   */
+  200: KubernetesK8sSecret;
+};
+
+export type GetKubernetesSecretResponse =
+  GetKubernetesSecretResponses[keyof GetKubernetesSecretResponses];
+
+export type GetKubernetesServiceAccountData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+    /**
+     * Namespace
+     */
+    namespace: string;
+    /**
+     * Service account name
+     */
+    name: string;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/namespaces/{namespace}/service_accounts/{name}';
+};
+
+export type GetKubernetesServiceAccountErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Unauthorized
+   */
+  401: unknown;
+  /**
+   * Permission denied
+   */
+  403: unknown;
+  /**
+   * Service account not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type GetKubernetesServiceAccountResponses = {
+  /**
+   * Success
+   */
+  200: KubernetesK8sServiceAccount;
+};
+
+export type GetKubernetesServiceAccountResponse =
+  GetKubernetesServiceAccountResponses[keyof GetKubernetesServiceAccountResponses];
+
+export type UpdateKubernetesServiceAccountImagePullSecretsData = {
+  /**
+   * New imagePullSecrets list
+   */
+  body: KubernetesK8sServiceAccountImagePullSecretsUpdatePayload;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+    /**
+     * Namespace
+     */
+    namespace: string;
+    /**
+     * Service account name
+     */
+    name: string;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/namespaces/{namespace}/service_accounts/{name}/image_pull_secrets';
+};
+
+export type UpdateKubernetesServiceAccountImagePullSecretsErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier, namespace, or service account.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to update image pull secrets for the service account.
+   */
+  500: unknown;
+};
+
+export type UpdateKubernetesServiceAccountImagePullSecretsResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type UpdateKubernetesServiceAccountImagePullSecretsResponse =
+  UpdateKubernetesServiceAccountImagePullSecretsResponses[keyof UpdateKubernetesServiceAccountImagePullSecretsResponses];
+
+export type GetKubernetesServicesByNamespaceData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+    /**
+     * Namespace name
+     */
+    namespace: string;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/namespaces/{namespace}/services';
+};
+
+export type GetKubernetesServicesByNamespaceErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to retrieve all services for a namespace.
+   */
+  500: unknown;
+};
+
+export type GetKubernetesServicesByNamespaceResponses = {
+  /**
+   * Success
+   */
+  200: Array<KubernetesK8sServiceInfo>;
+};
+
+export type GetKubernetesServicesByNamespaceResponse =
+  GetKubernetesServicesByNamespaceResponses[keyof GetKubernetesServicesByNamespaceResponses];
+
+export type CreateKubernetesServiceData = {
+  /**
+   * Service definition
+   */
+  body: KubernetesK8sServiceInfo2;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+    /**
+     * Namespace name
+     */
+    namespace: string;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/namespaces/{namespace}/services';
+};
+
+export type CreateKubernetesServiceErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to create a service.
+   */
+  500: unknown;
+};
+
+export type CreateKubernetesServiceResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type CreateKubernetesServiceResponse =
+  CreateKubernetesServiceResponses[keyof CreateKubernetesServiceResponses];
+
+export type UpdateKubernetesServiceData = {
+  /**
+   * Service definition
+   */
+  body: KubernetesK8sServiceInfo2;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+    /**
+     * Namespace name
+     */
+    namespace: string;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/namespaces/{namespace}/services';
+};
+
+export type UpdateKubernetesServiceErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier or unable to find the service to update.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to update a service.
+   */
+  500: unknown;
+};
+
+export type UpdateKubernetesServiceResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type UpdateKubernetesServiceResponse =
+  UpdateKubernetesServiceResponses[keyof UpdateKubernetesServiceResponses];
+
+export type KubernetesNamespacesToggleSystemData = {
+  /**
+   * Update details
+   */
+  body: KubernetesNamespacesToggleSystemPayload;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+    /**
+     * Namespace name
+     */
+    namespace: string;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/namespaces/{namespace}/system';
+};
+
+export type KubernetesNamespacesToggleSystemErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier or unable to find the namespace to update.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to update the system state of the namespace.
+   */
+  500: unknown;
+};
+
+export type KubernetesNamespacesToggleSystemResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type KubernetesNamespacesToggleSystemResponse =
+  KubernetesNamespacesToggleSystemResponses[keyof KubernetesNamespacesToggleSystemResponses];
+
+export type GetKubernetesVolumesInNamespaceData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+    /**
+     * Namespace identifier
+     */
+    namespace: string;
+  };
+  query?: {
+    /**
+     * When set to True, include the applications that are using the volumes. It is set to false by default
+     */
+    withApplications?: boolean;
+  };
+  url: '/kubernetes/{id}/namespaces/{namespace}/volumes';
+};
+
+export type GetKubernetesVolumesInNamespaceErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access or operation not allowed.
+   */
+  403: unknown;
+  /**
+   * Server error occurred while attempting to retrieve kubernetes volumes in the namespace.
+   */
+  500: unknown;
+};
+
+export type GetKubernetesVolumesInNamespaceResponses = {
+  /**
+   * Success
+   */
+  200: {
+    [key: string]: KubernetesK8sVolumeInfo;
+  };
+};
+
+export type GetKubernetesVolumesInNamespaceResponse =
+  GetKubernetesVolumesInNamespaceResponses[keyof GetKubernetesVolumesInNamespaceResponses];
+
+export type GetKubernetesNamespacesCountData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/namespaces/count';
+};
+
+export type GetKubernetesNamespacesCountErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to compute the namespace count.
+   */
+  500: unknown;
+};
+
+export type GetKubernetesNamespacesCountResponses = {
+  /**
+   * Success
+   */
+  200: number;
+};
+
+export type GetKubernetesNamespacesCountResponse =
+  GetKubernetesNamespacesCountResponses[keyof GetKubernetesNamespacesCountResponses];
+
+export type GetKubernetesNodesData = {
+  body?: never;
+  path: {
+    /**
+     * Environment(Endpoint) identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/nodes';
+};
+
+export type GetKubernetesNodesErrors = {
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource.
+   */
+  403: unknown;
+  /**
+   * Server error occurred while attempting to retrieve the list of nodes.
+   */
+  500: unknown;
+};
+
+export type GetKubernetesNodesResponses = {
+  /**
+   * Success
+   */
+  200: Array<KubernetesKubernetesNodeResponse>;
+};
+
+export type GetKubernetesNodesResponse =
+  GetKubernetesNodesResponses[keyof GetKubernetesNodesResponses];
+
+export type DrainNodeData = {
+  body?: never;
+  path: {
+    /**
+     * Environment(Endpoint) identifier
+     */
+    id: number;
+    /**
+     * Name of the node to drain
+     */
+    name: string;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/nodes/{name}/drain';
+};
+
+export type DrainNodeErrors = {
+  /**
+   * Invalid request, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier or unable to find the specified node.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to drain node.
+   */
+  500: unknown;
+};
+
+export type DrainNodeResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type DrainNodeResponse = DrainNodeResponses[keyof DrainNodeResponses];
+
+export type GetKubernetesNodesLimitsData = {
+  body?: never;
+  path: {
+    /**
+     * Environment(Endpoint) identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/nodes_limits';
+};
+
+export type GetKubernetesNodesLimitsErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to retrieve nodes limits.
+   */
+  500: unknown;
+};
+
+export type GetKubernetesNodesLimitsResponses = {
+  /**
+   * Success
+   */
+  200: PortainerK8sNodesLimits;
+};
+
+export type GetKubernetesNodesLimitsResponse =
+  GetKubernetesNodesLimitsResponses[keyof GetKubernetesNodesLimitsResponses];
+
+export type GetAllKubernetesPersistentVolumeClaimsData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/persistent_volume_claims';
+};
+
+export type GetAllKubernetesPersistentVolumeClaimsErrors = {
+  /**
+   * Invalid request payload.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access or operation not allowed.
+   */
+  403: unknown;
+  /**
+   * Server error occurred while attempting to retrieve persistent volume claims.
+   */
+  500: unknown;
+};
+
+export type GetAllKubernetesPersistentVolumeClaimsResponses = {
+  /**
+   * Success
+   */
+  200: Array<KubernetesK8sPersistentVolumeClaim>;
+};
+
+export type GetAllKubernetesPersistentVolumeClaimsResponse =
+  GetAllKubernetesPersistentVolumeClaimsResponses[keyof GetAllKubernetesPersistentVolumeClaimsResponses];
+
+export type DeleteKubernetesPersistentVolumeClaimsData = {
+  /**
+   * List of PVCs to delete (namespace + name)
+   */
+  body: Array<KubernetesK8sVolumeDeleteRequest>;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/persistent_volume_claims/delete';
+};
+
+export type DeleteKubernetesPersistentVolumeClaimsErrors = {
+  /**
+   * Invalid request payload.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access or operation not allowed.
+   */
+  403: unknown;
+  /**
+   * Server error occurred while attempting to delete persistent volume claims.
+   */
+  500: unknown;
+};
+
+export type DeleteKubernetesPersistentVolumeClaimsResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type DeleteKubernetesPersistentVolumeClaimsResponse =
+  DeleteKubernetesPersistentVolumeClaimsResponses[keyof DeleteKubernetesPersistentVolumeClaimsResponses];
+
+export type ResizeKubernetesPersistentVolumeClaimData = {
+  /**
+   * PVC resize request
+   */
+  body: KubernetesK8sPvcResizeRequest;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/persistent_volume_claims/resize';
+};
+
+export type ResizeKubernetesPersistentVolumeClaimErrors = {
+  /**
+   * Invalid request payload.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access or operation not allowed.
+   */
+  403: unknown;
+  /**
+   * Server error occurred while attempting to resize the persistent volume claim.
+   */
+  500: unknown;
+};
+
+export type ResizeKubernetesPersistentVolumeClaimResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type ResizeKubernetesPersistentVolumeClaimResponse =
+  ResizeKubernetesPersistentVolumeClaimResponses[keyof ResizeKubernetesPersistentVolumeClaimResponses];
+
+export type GetAllKubernetesPersistentVolumesData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/persistent_volumes';
+};
+
+export type GetAllKubernetesPersistentVolumesErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access or operation not allowed.
+   */
+  403: unknown;
+  /**
+   * Server error occurred while attempting to retrieve persistent volumes.
+   */
+  500: unknown;
+};
+
+export type GetAllKubernetesPersistentVolumesResponses = {
+  /**
+   * Success
+   */
+  200: Array<KubernetesK8sPersistentVolume>;
+};
+
+export type GetAllKubernetesPersistentVolumesResponse =
+  GetAllKubernetesPersistentVolumesResponses[keyof GetAllKubernetesPersistentVolumesResponses];
+
+export type GetKubernetesPersistentVolumeData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+    /**
+     * PersistentVolume name
+     */
+    name: string;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/persistent_volumes/{name}';
+};
+
+export type GetKubernetesPersistentVolumeErrors = {
+  /**
+   * Invalid request payload.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access or operation not allowed.
+   */
+  403: unknown;
+  /**
+   * PersistentVolume not found.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to retrieve the persistent volume.
+   */
+  500: unknown;
+};
+
+export type GetKubernetesPersistentVolumeResponses = {
+  /**
+   * Success
+   */
+  200: KubernetesK8sPersistentVolume;
+};
+
+export type GetKubernetesPersistentVolumeResponse =
+  GetKubernetesPersistentVolumeResponses[keyof GetKubernetesPersistentVolumeResponses];
+
+export type DeleteKubernetesPersistentVolumesData = {
+  /**
+   * List of PV names to delete
+   */
+  body: Array<string>;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/persistent_volumes/delete';
+};
+
+export type DeleteKubernetesPersistentVolumesErrors = {
+  /**
+   * Invalid request payload.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access or operation not allowed.
+   */
+  403: unknown;
+  /**
+   * Server error occurred while attempting to delete persistent volumes.
+   */
+  500: unknown;
+};
+
+export type DeleteKubernetesPersistentVolumesResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type DeleteKubernetesPersistentVolumesResponse =
+  DeleteKubernetesPersistentVolumesResponses[keyof DeleteKubernetesPersistentVolumesResponses];
+
+export type UpdateKubernetesPersistentVolumeReclaimPolicyData = {
+  /**
+   * Reclaim policy update request
+   */
+  body: KubernetesK8sPvReclaimPolicyRequest;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/persistent_volumes/reclaim_policy';
+};
+
+export type UpdateKubernetesPersistentVolumeReclaimPolicyErrors = {
+  /**
+   * Invalid request payload.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access or operation not allowed.
+   */
+  403: unknown;
+  /**
+   * Server error occurred while attempting to update reclaim policy.
+   */
+  500: unknown;
+};
+
+export type UpdateKubernetesPersistentVolumeReclaimPolicyResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type UpdateKubernetesPersistentVolumeReclaimPolicyResponse =
+  UpdateKubernetesPersistentVolumeReclaimPolicyResponses[keyof UpdateKubernetesPersistentVolumeReclaimPolicyResponses];
+
+export type GetKubernetesRbacStatusData = {
+  body?: never;
+  path: {
+    /**
+     * Environment(Endpoint) identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/rbac_enabled';
+};
+
+export type GetKubernetesRbacStatusErrors = {
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to retrieve the RBAC status.
+   */
+  500: unknown;
+};
+
+export type GetKubernetesRbacStatusResponses = {
+  /**
+   * RBAC status
+   */
+  200: boolean;
+};
+
+export type GetKubernetesRbacStatusResponse =
+  GetKubernetesRbacStatusResponses[keyof GetKubernetesRbacStatusResponses];
+
+export type DeleteRoleBindingsData = {
+  /**
+   * A map where the key is the namespace and the value is an array of role bindings to delete
+   */
+  body: KubernetesK8sRoleBindingDeleteRequests;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/role_bindings/delete';
+};
+
+export type DeleteRoleBindingsErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier or unable to find a specific role binding.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to delete role bindings.
+   */
+  500: unknown;
+};
+
+export type DeleteRoleBindingsResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type DeleteRoleBindingsResponse =
+  DeleteRoleBindingsResponses[keyof DeleteRoleBindingsResponses];
+
+export type GetKubernetesRoleBindingsData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/rolebindings';
+};
+
+export type GetKubernetesRoleBindingsErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to retrieve the list of role bindings.
+   */
+  500: unknown;
+};
+
+export type GetKubernetesRoleBindingsResponses = {
+  /**
+   * Success
+   */
+  200: Array<KubernetesK8sRoleBinding>;
+};
+
+export type GetKubernetesRoleBindingsResponse =
+  GetKubernetesRoleBindingsResponses[keyof GetKubernetesRoleBindingsResponses];
+
+export type GetKubernetesRolesData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/roles';
+};
+
+export type GetKubernetesRolesErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to retrieve the list of roles.
+   */
+  500: unknown;
+};
+
+export type GetKubernetesRolesResponses = {
+  /**
+   * Success
+   */
+  200: Array<KubernetesK8sRole>;
+};
+
+export type GetKubernetesRolesResponse =
+  GetKubernetesRolesResponses[keyof GetKubernetesRolesResponses];
+
+export type DeleteRolesData = {
+  /**
+   * A map where the key is the namespace and the value is an array of roles to delete
+   */
+  body: KubernetesK8sRoleDeleteRequests;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/roles/delete';
+};
+
+export type DeleteRolesErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier or unable to find a specific role.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to delete roles.
+   */
+  500: unknown;
+};
+
+export type DeleteRolesResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type DeleteRolesResponse =
+  DeleteRolesResponses[keyof DeleteRolesResponses];
+
+export type GetKubernetesSecretsData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+  };
+  query: {
+    /**
+     * When set to true, associate the Secrets with the applications that use them
+     */
+    isUsed: boolean;
+  };
+  url: '/kubernetes/{id}/secrets';
+};
+
+export type GetKubernetesSecretsErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to retrieve all secrets from the cluster.
+   */
+  500: unknown;
+};
+
+export type GetKubernetesSecretsResponses = {
+  /**
+   * Success
+   */
+  200: Array<KubernetesK8sSecret>;
+};
+
+export type GetKubernetesSecretsResponse =
+  GetKubernetesSecretsResponses[keyof GetKubernetesSecretsResponses];
+
+export type GetKubernetesSecretsCountData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/secrets/count';
+};
+
+export type GetKubernetesSecretsCountErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to retrieve the count of all secrets from the cluster.
+   */
+  500: unknown;
+};
+
+export type GetKubernetesSecretsCountResponses = {
+  /**
+   * Success
+   */
+  200: number;
+};
+
+export type GetKubernetesSecretsCountResponse =
+  GetKubernetesSecretsCountResponses[keyof GetKubernetesSecretsCountResponses];
+
+export type DeleteServiceAccountsData = {
+  /**
+   * A map where the key is the namespace and the value is an array of service accounts to delete
+   */
+  body: KubernetesK8sServiceAccountDeleteRequests;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/service_accounts/delete';
+};
+
+export type DeleteServiceAccountsErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier or unable to find a specific service account.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to delete service accounts.
+   */
+  500: unknown;
+};
+
+export type DeleteServiceAccountsResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type DeleteServiceAccountsResponse =
+  DeleteServiceAccountsResponses[keyof DeleteServiceAccountsResponses];
+
+export type GetKubernetesServiceAccountsData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/serviceaccounts';
+};
+
+export type GetKubernetesServiceAccountsErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to retrieve the list of service accounts.
+   */
+  500: unknown;
+};
+
+export type GetKubernetesServiceAccountsResponses = {
+  /**
+   * Success
+   */
+  200: Array<KubernetesK8sServiceAccount>;
+};
+
+export type GetKubernetesServiceAccountsResponse =
+  GetKubernetesServiceAccountsResponses[keyof GetKubernetesServiceAccountsResponses];
+
+export type GetKubernetesServicesData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+  };
+  query?: {
+    /**
+     * Lookup applications associated with each service
+     */
+    withApplications?: boolean;
+  };
+  url: '/kubernetes/{id}/services';
+};
+
+export type GetKubernetesServicesErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to retrieve all services.
+   */
+  500: unknown;
+};
+
+export type GetKubernetesServicesResponses = {
+  /**
+   * Success
+   */
+  200: Array<KubernetesK8sServiceInfo>;
+};
+
+export type GetKubernetesServicesResponse =
+  GetKubernetesServicesResponses[keyof GetKubernetesServicesResponses];
+
+export type GetAllKubernetesServicesCountData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/services/count';
+};
+
+export type GetAllKubernetesServicesCountErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to retrieve the total count of all services.
+   */
+  500: unknown;
+};
+
+export type GetAllKubernetesServicesCountResponses = {
+  /**
+   * Success
+   */
+  200: number;
+};
+
+export type GetAllKubernetesServicesCountResponse =
+  GetAllKubernetesServicesCountResponses[keyof GetAllKubernetesServicesCountResponses];
+
+export type DeleteKubernetesServicesData = {
+  /**
+   * A map where the key is the namespace and the value is an array of services to delete
+   */
+  body: KubernetesK8sServiceDeleteRequests;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/services/delete';
+};
+
+export type DeleteKubernetesServicesErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier or unable to find a specific service.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to delete services.
+   */
+  500: unknown;
+};
+
+export type DeleteKubernetesServicesResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type DeleteKubernetesServicesResponse =
+  DeleteKubernetesServicesResponses[keyof DeleteKubernetesServicesResponses];
+
+export type GetAllKubernetesStorageClassesData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/storage_classes';
+};
+
+export type GetAllKubernetesStorageClassesErrors = {
+  /**
+   * Invalid request payload.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access or operation not allowed.
+   */
+  403: unknown;
+  /**
+   * Server error occurred while attempting to retrieve storage classes.
+   */
+  500: unknown;
+};
+
+export type GetAllKubernetesStorageClassesResponses = {
+  /**
+   * Success
+   */
+  200: Array<KubernetesK8sStorageClass>;
+};
+
+export type GetAllKubernetesStorageClassesResponse =
+  GetAllKubernetesStorageClassesResponses[keyof GetAllKubernetesStorageClassesResponses];
+
+export type GetKubernetesStorageClassData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+    /**
+     * StorageClass name
+     */
+    name: string;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/storage_classes/{name}';
+};
+
+export type GetKubernetesStorageClassErrors = {
+  /**
+   * Invalid request payload.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access or operation not allowed.
+   */
+  403: unknown;
+  /**
+   * StorageClass not found.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to retrieve the storage class.
+   */
+  500: unknown;
+};
+
+export type GetKubernetesStorageClassResponses = {
+  /**
+   * Success
+   */
+  200: KubernetesK8sStorageClass;
+};
+
+export type GetKubernetesStorageClassResponse =
+  GetKubernetesStorageClassResponses[keyof GetKubernetesStorageClassResponses];
+
+export type SetDefaultKubernetesStorageClassData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+    /**
+     * StorageClass name
+     */
+    name: string;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/storage_classes/{name}/default';
+};
+
+export type SetDefaultKubernetesStorageClassErrors = {
+  /**
+   * Invalid request payload.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access or operation not allowed.
+   */
+  403: unknown;
+  /**
+   * Server error occurred while attempting to set default storage class.
+   */
+  500: unknown;
+};
+
+export type SetDefaultKubernetesStorageClassResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type SetDefaultKubernetesStorageClassResponse =
+  SetDefaultKubernetesStorageClassResponses[keyof SetDefaultKubernetesStorageClassResponses];
+
+export type DeleteKubernetesStorageClassesData = {
+  /**
+   * List of StorageClass names to delete
+   */
+  body: Array<string>;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/storage_classes/delete';
+};
+
+export type DeleteKubernetesStorageClassesErrors = {
+  /**
+   * Invalid request payload.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access or operation not allowed.
+   */
+  403: unknown;
+  /**
+   * Server error occurred while attempting to delete storage classes.
+   */
+  500: unknown;
+};
+
+export type DeleteKubernetesStorageClassesResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type DeleteKubernetesStorageClassesResponse =
+  DeleteKubernetesStorageClassesResponses[keyof DeleteKubernetesStorageClassesResponses];
+
+export type GetKubernetesVersionData = {
+  body?: never;
+  path: {
+    /**
+     * Environment(Endpoint) identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/version';
+};
+
+export type GetKubernetesVersionErrors = {
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to retrieve the cluster version.
+   */
+  500: unknown;
+};
+
+export type GetKubernetesVersionResponses = {
+  /**
+   * Success
+   */
+  200: KubernetesKubernetesVersionResponse;
+};
+
+export type GetKubernetesVersionResponse =
+  GetKubernetesVersionResponses[keyof GetKubernetesVersionResponses];
+
+export type GetAllKubernetesVolumesData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+  };
+  query?: {
+    /**
+     * When set to True, include the applications that are using the volumes. It is set to false by default
+     */
+    withApplications?: boolean;
+  };
+  url: '/kubernetes/{id}/volumes';
+};
+
+export type GetAllKubernetesVolumesErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access or operation not allowed.
+   */
+  403: unknown;
+  /**
+   * Server error occurred while attempting to retrieve kubernetes volumes.
+   */
+  500: unknown;
+};
+
+export type GetAllKubernetesVolumesResponses = {
+  /**
+   * Success
+   */
+  200: {
+    [key: string]: KubernetesK8sVolumeInfo;
+  };
+};
+
+export type GetAllKubernetesVolumesResponse =
+  GetAllKubernetesVolumesResponses[keyof GetAllKubernetesVolumesResponses];
+
+export type GetKubernetesVolumeData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+    /**
+     * Namespace identifier
+     */
+    namespace: string;
+    /**
+     * Volume name
+     */
+    volume: string;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/volumes/{namespace}/{volume}';
+};
+
+export type GetKubernetesVolumeErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type GetKubernetesVolumeResponses = {
+  /**
+   * Success
+   */
+  200: KubernetesK8sVolumeInfo;
+};
+
+export type GetKubernetesVolumeResponse =
+  GetKubernetesVolumeResponses[keyof GetKubernetesVolumeResponses];
+
+export type GetAllKubernetesVolumesCountData = {
+  body?: never;
+  path: {
+    /**
+     * Environment identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/kubernetes/{id}/volumes/count';
+};
+
+export type GetAllKubernetesVolumesCountErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access or operation not allowed.
+   */
+  403: unknown;
+  /**
+   * Server error occurred while attempting to retrieve kubernetes volumes count.
+   */
+  500: unknown;
+};
+
+export type GetAllKubernetesVolumesCountResponses = {
+  /**
+   * Success
+   */
+  200: number;
+};
+
+export type GetAllKubernetesVolumesCountResponse =
+  GetAllKubernetesVolumesCountResponses[keyof GetAllKubernetesVolumesCountResponses];
+
+export type GetKubernetesConfigData = {
+  body?: never;
+  path?: never;
+  query?: {
+    /**
+     * will include only these environments(endpoints)
+     */
+    ids?: Array<number>;
+    /**
+     * will exclude these environments(endpoints)
+     */
+    excludeIds?: Array<number>;
+  };
+  url: '/kubernetes/config';
+};
+
+export type GetKubernetesConfigErrors = {
+  /**
+   * Invalid request payload, such as missing required fields or fields not meeting validation criteria.
+   */
+  400: unknown;
+  /**
+   * Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions.
+   */
+  401: unknown;
+  /**
+   * Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions.
+   */
+  403: unknown;
+  /**
+   * Unable to find an environment with the specified identifier.
+   */
+  404: unknown;
+  /**
+   * Server error occurred while attempting to generate the kubeconfig file.
+   */
+  500: unknown;
+};
+
+export type GetKubernetesConfigResponses = {
+  /**
+   * Success
+   */
+  200: unknown;
+};
+
+export type LdapCheckData = {
+  /**
+   * details
+   */
+  body: LdapCheckPayload;
+  path?: never;
+  query?: never;
+  url: '/ldap/check';
+};
+
+export type LdapCheckErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type LdapCheckResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type LdapCheckResponse = LdapCheckResponses[keyof LdapCheckResponses];
+
+export type MotdData = {
+  body?: never;
+  path?: never;
+  query?: never;
+  url: '/motd';
+};
+
+export type MotdResponses = {
+  /**
+   * OK
+   */
+  200: MotdMotd;
+};
+
+export type MotdResponse = MotdResponses[keyof MotdResponses];
+
+export type RegistryListData = {
+  body?: never;
+  path?: never;
+  query?: never;
+  url: '/registries';
+};
+
+export type RegistryListErrors = {
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type RegistryListResponses = {
+  /**
+   * Success
+   */
+  200: Array<PortainerRegistry>;
+};
+
+export type RegistryListResponse =
+  RegistryListResponses[keyof RegistryListResponses];
+
+export type RegistryCreateData = {
+  /**
+   * Registry details
+   */
+  body: RegistriesRegistryCreatePayload;
+  path?: never;
+  query?: never;
+  url: '/registries';
+};
+
+export type RegistryCreateErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Another registry with the same name or same URL & credentials already exists
+   */
+  409: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type RegistryCreateResponses = {
+  /**
+   * Success
+   */
+  200: PortainerRegistry;
+};
+
+export type RegistryCreateResponse =
+  RegistryCreateResponses[keyof RegistryCreateResponses];
+
+export type RegistryDeleteData = {
+  body?: never;
+  path: {
+    /**
+     * Registry identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/registries/{id}';
+};
+
+export type RegistryDeleteErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Registry not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type RegistryDeleteResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type RegistryDeleteResponse =
+  RegistryDeleteResponses[keyof RegistryDeleteResponses];
+
+export type RegistryInspectData = {
+  body?: never;
+  path: {
+    /**
+     * Registry identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/registries/{id}';
+};
+
+export type RegistryInspectErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Permission denied to access registry
+   */
+  403: unknown;
+  /**
+   * Registry not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type RegistryInspectResponses = {
+  /**
+   * Success
+   */
+  200: PortainerRegistry;
+};
+
+export type RegistryInspectResponse =
+  RegistryInspectResponses[keyof RegistryInspectResponses];
+
+export type RegistryUpdateData = {
+  /**
+   * Registry details
+   */
+  body: RegistriesRegistryUpdatePayload;
+  path: {
+    /**
+     * Registry identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/registries/{id}';
+};
+
+export type RegistryUpdateErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Registry not found
+   */
+  404: unknown;
+  /**
+   * Another registry with the same name or same URL & credentials already exists
+   */
+  409: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type RegistryUpdateResponses = {
+  /**
+   * Success
+   */
+  200: PortainerRegistry;
+};
+
+export type RegistryUpdateResponse =
+  RegistryUpdateResponses[keyof RegistryUpdateResponses];
+
+export type RegistryConfigureData = {
+  /**
+   * Registry configuration
+   */
+  body: RegistriesRegistryConfigurePayload;
+  path: {
+    /**
+     * Registry identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/registries/{id}/configure';
+};
+
+export type RegistryConfigureErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Permission denied
+   */
+  403: unknown;
+  /**
+   * Registry not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type RegistryConfigureResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type RegistryConfigureResponse =
+  RegistryConfigureResponses[keyof RegistryConfigureResponses];
+
+export type RegistryPingData = {
+  /**
+   * Registry credentials to test
+   */
+  body: RegistriesRegistryPingPayload;
+  path?: never;
+  query?: never;
+  url: '/registries/ping';
+};
+
+export type RegistryPingErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type RegistryPingResponses = {
+  /**
+   * Success
+   */
+  200: RegistriesRegistryPingResponse;
+};
+
+export type RegistryPingResponse =
+  RegistryPingResponses[keyof RegistryPingResponses];
+
+export type ResourceControlCreateData = {
+  /**
+   * Resource control details
+   */
+  body: ResourcecontrolsResourceControlCreatePayload;
+  path?: never;
+  query?: never;
+  url: '/resource_controls';
+};
+
+export type ResourceControlCreateErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * A resource control is already associated to this resource
+   */
+  409: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type ResourceControlCreateResponses = {
+  /**
+   * Success
+   */
+  200: PortainerResourceControl;
+};
+
+export type ResourceControlCreateResponse =
+  ResourceControlCreateResponses[keyof ResourceControlCreateResponses];
+
+export type ResourceControlDeleteData = {
+  body?: never;
+  path: {
+    /**
+     * Resource control identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/resource_controls/{id}';
+};
+
+export type ResourceControlDeleteErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Resource control not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type ResourceControlDeleteResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type ResourceControlDeleteResponse =
+  ResourceControlDeleteResponses[keyof ResourceControlDeleteResponses];
+
+export type ResourceControlUpdateData = {
+  /**
+   * Resource control details
+   */
+  body: ResourcecontrolsResourceControlUpdatePayload;
+  path: {
+    /**
+     * Resource control identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/resource_controls/{id}';
+};
+
+export type ResourceControlUpdateErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Unauthorized
+   */
+  403: unknown;
+  /**
+   * Resource control not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type ResourceControlUpdateResponses = {
+  /**
+   * Success
+   */
+  200: PortainerResourceControl;
+};
+
+export type ResourceControlUpdateResponse =
+  ResourceControlUpdateResponses[keyof ResourceControlUpdateResponses];
+
+export type RestoreData = {
+  /**
+   * Restore request payload
+   */
+  body: BackupRestorePayload;
+  headers?: {
+    /**
+     * Setup token (required when instance is uninitialized and --no-setup-token is not set)
+     */
+    'X-Setup-Token'?: string;
+  };
+  path?: never;
+  query?: never;
+  url: '/restore';
+};
+
+export type RestoreErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Access denied - invalid or missing setup token
+   */
+  403: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type RestoreResponses = {
+  /**
+   * Success
+   */
+  200: unknown;
+};
+
+export type RoleListData = {
+  body?: never;
+  path?: never;
+  query?: never;
+  url: '/roles';
+};
+
+export type RoleListErrors = {
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type RoleListResponses = {
+  /**
+   * Success
+   */
+  200: Array<PortainerRole>;
+};
+
+export type RoleListResponse = RoleListResponses[keyof RoleListResponses];
+
+export type SettingsInspectData = {
+  body?: never;
+  path?: never;
+  query?: never;
+  url: '/settings';
+};
+
+export type SettingsInspectErrors = {
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type SettingsInspectResponses = {
+  /**
+   * Success
+   */
+  200: PortainerSettings;
+};
+
+export type SettingsInspectResponse =
+  SettingsInspectResponses[keyof SettingsInspectResponses];
+
+export type SettingsUpdateData = {
+  /**
+   * New settings
+   */
+  body: SettingsSettingsUpdatePayload;
+  path?: never;
+  query?: never;
+  url: '/settings';
+};
+
+export type SettingsUpdateErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type SettingsUpdateResponses = {
+  /**
+   * Success
+   */
+  200: PortainerSettings;
+};
+
+export type SettingsUpdateResponse =
+  SettingsUpdateResponses[keyof SettingsUpdateResponses];
+
+export type SettingsPublicData = {
+  body?: never;
+  path?: never;
+  query?: never;
+  url: '/settings/public';
+};
+
+export type SettingsPublicErrors = {
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type SettingsPublicResponses = {
+  /**
+   * Success
+   */
+  200: SettingsPublicSettingsResponse;
+};
+
+export type SettingsPublicResponse =
+  SettingsPublicResponses[keyof SettingsPublicResponses];
+
+export type SslInspectData = {
+  body?: never;
+  path?: never;
+  query?: never;
+  url: '/ssl';
+};
+
+export type SslInspectErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Permission denied to access settings
+   */
+  403: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type SslInspectResponses = {
+  /**
+   * Success
+   */
+  200: PortainerSslSettings;
+};
+
+export type SslInspectResponse = SslInspectResponses[keyof SslInspectResponses];
+
+export type SslUpdateData = {
+  /**
+   * SSL Settings
+   */
+  body: SslSslUpdatePayload;
+  path?: never;
+  query?: never;
+  url: '/ssl';
+};
+
+export type SslUpdateErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Permission denied to access settings
+   */
+  403: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type SslUpdateResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type SslUpdateResponse = SslUpdateResponses[keyof SslUpdateResponses];
+
+export type StackListData = {
+  body?: never;
+  path?: never;
+  query?: {
+    /**
+     * Filters to process on the stack list. Encoded as JSON (a map[string]string). For example, {'SwarmID': 'jpofkc0i9uo9wtx1zesuk649w'} will only return stacks that are part of the specified Swarm cluster. Available filters: EndpointID, SwarmID.
+     */
+    filters?: string;
+  };
+  url: '/stacks';
+};
+
+export type StackListErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type StackListResponses = {
+  /**
+   * Success
+   */
+  200: Array<PortainerStack>;
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type StackListResponse = StackListResponses[keyof StackListResponses];
+
+export type StackDeleteData = {
+  body?: never;
+  path: {
+    /**
+     * Stack identifier
+     */
+    id: number;
+  };
+  query: {
+    /**
+     * Set to true to delete an external stack. Only external Swarm stacks are supported
+     */
+    external?: boolean;
+    /**
+     * Environment identifier
+     */
+    endpointId: number;
+  };
+  url: '/stacks/{id}';
+};
+
+export type StackDeleteErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Permission denied
+   */
+  403: unknown;
+  /**
+   * Not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type StackDeleteResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type StackDeleteResponse =
+  StackDeleteResponses[keyof StackDeleteResponses];
+
+export type StackInspectData = {
+  body?: never;
+  path: {
+    /**
+     * Stack identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/stacks/{id}';
+};
+
+export type StackInspectErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Permission denied
+   */
+  403: unknown;
+  /**
+   * Stack not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type StackInspectResponses = {
+  /**
+   * Success
+   */
+  200: StacksStackResponse;
+};
+
+export type StackInspectResponse =
+  StackInspectResponses[keyof StackInspectResponses];
+
+export type StackUpdateData = {
+  /**
+   * Stack details
+   */
+  body: StacksUpdateSwarmStackPayload;
+  path: {
+    /**
+     * Stack identifier
+     */
+    id: number;
+  };
+  query: {
+    /**
+     * Environment identifier
+     */
+    endpointId: number;
+  };
+  url: '/stacks/{id}';
+};
+
+export type StackUpdateErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Permission denied
+   */
+  403: unknown;
+  /**
+   * Not found
+   */
+  404: unknown;
+  /**
+   * Conflict
+   */
+  409: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type StackUpdateResponses = {
+  /**
+   * Success
+   */
+  200: PortainerStack;
+};
+
+export type StackUpdateResponse =
+  StackUpdateResponses[keyof StackUpdateResponses];
+
+export type StackAssociateData = {
+  body?: never;
+  path: {
+    /**
+     * Stack identifier
+     */
+    id: number;
+  };
+  query: {
+    /**
+     * Environment identifier
+     */
+    endpointId: number;
+    /**
+     * Swarm identifier
+     */
+    swarmId: number;
+    /**
+     * Indicates whether the stack is orphaned
+     */
+    orphanedRunning: boolean;
+  };
+  url: '/stacks/{id}/associate';
+};
+
+export type StackAssociateErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Permission denied
+   */
+  403: unknown;
+  /**
+   * Stack not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type StackAssociateResponses = {
+  /**
+   * Success
+   */
+  200: PortainerStack;
+};
+
+export type StackAssociateResponse =
+  StackAssociateResponses[keyof StackAssociateResponses];
+
+export type StackFileInspectData = {
+  body?: never;
+  path: {
+    /**
+     * Stack identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/stacks/{id}/file';
+};
+
+export type StackFileInspectErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Permission denied
+   */
+  403: unknown;
+  /**
+   * Stack not found
+   */
+  404: unknown;
+  /**
+   * Git settings changed, redeploy required
+   */
+  409: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type StackFileInspectResponses = {
+  /**
+   * Success
+   */
+  200: StacksStackFileResponse;
+};
+
+export type StackFileInspectResponse =
+  StackFileInspectResponses[keyof StackFileInspectResponses];
+
+export type StackUpdateGitData = {
+  /**
+   * Git configs for pull and redeploy a stack
+   */
+  body: StacksStackGitUpdatePayload;
+  path: {
+    /**
+     * Stack identifier
+     */
+    id: number;
+  };
+  query?: {
+    /**
+     * Stacks created before version 1.18.0 might not have an associated environment(endpoint) identifier. Use this optional parameter to set the environment(endpoint) identifier used by the stack.
+     */
+    endpointId?: number;
+  };
+  url: '/stacks/{id}/git';
+};
+
+export type StackUpdateGitErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Permission denied
+   */
+  403: unknown;
+  /**
+   * Not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type StackUpdateGitResponses = {
+  /**
+   * Success
+   */
+  200: StacksStackResponse;
+};
+
+export type StackUpdateGitResponse =
+  StackUpdateGitResponses[keyof StackUpdateGitResponses];
+
+export type StackGitRedeployData = {
+  /**
+   * Git configs for pull and redeploy of a stack. **StackName** may only be populated for Kuberenetes stacks, and if specified with a blank string, it will be set to blank
+   */
+  body: StacksStackGitRedeployPayload;
+  path: {
+    /**
+     * Stack identifier
+     */
+    id: number;
+  };
+  query?: {
+    /**
+     * Stacks created before version 1.18.0 might not have an associated environment(endpoint) identifier. Use this optional parameter to set the environment(endpoint) identifier used by the stack.
+     */
+    endpointId?: number;
+  };
+  url: '/stacks/{id}/git/redeploy';
+};
+
+export type StackGitRedeployErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Permission denied
+   */
+  403: unknown;
+  /**
+   * Not found
+   */
+  404: unknown;
+  /**
+   * Conflict
+   */
+  409: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type StackGitRedeployResponses = {
+  /**
+   * Success
+   */
+  200: PortainerStack;
+};
+
+export type StackGitRedeployResponse =
+  StackGitRedeployResponses[keyof StackGitRedeployResponses];
+
+export type StackMigrateData = {
+  /**
+   * Stack migration details
+   */
+  body: StacksStackMigratePayload;
+  path: {
+    /**
+     * Stack identifier
+     */
+    id: number;
+  };
+  query?: {
+    /**
+     * Stacks created before version 1.18.0 might not have an associated environment(endpoint) identifier. Use this optional parameter to set the environment(endpoint) identifier used by the stack.
+     */
+    endpointId?: number;
+  };
+  url: '/stacks/{id}/migrate';
+};
+
+export type StackMigrateErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Permission denied
+   */
+  403: unknown;
+  /**
+   * Stack not found
+   */
+  404: unknown;
+  /**
+   * A stack with the same name is already running on the target environment(endpoint)
+   */
+  409: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type StackMigrateResponses = {
+  /**
+   * Success
+   */
+  200: PortainerStack;
+};
+
+export type StackMigrateResponse =
+  StackMigrateResponses[keyof StackMigrateResponses];
+
+export type StackStartData = {
+  body?: never;
+  path: {
+    /**
+     * Stack identifier
+     */
+    id: number;
+  };
+  query: {
+    /**
+     * Environment identifier
+     */
+    endpointId: number;
+  };
+  url: '/stacks/{id}/start';
+};
+
+export type StackStartErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Permission denied
+   */
+  403: unknown;
+  /**
+   * Not found
+   */
+  404: unknown;
+  /**
+   * Stack is already active, deploying, or in error state
+   */
+  409: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type StackStartResponses = {
+  /**
+   * Success
+   */
+  200: PortainerStack;
+};
+
+export type StackStartResponse = StackStartResponses[keyof StackStartResponses];
+
+export type StackStopData = {
+  body?: never;
+  path: {
+    /**
+     * Stack identifier
+     */
+    id: number;
+  };
+  query: {
+    /**
+     * Environment identifier
+     */
+    endpointId: number;
+  };
+  url: '/stacks/{id}/stop';
+};
+
+export type StackStopErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Permission denied
+   */
+  403: unknown;
+  /**
+   * Not found
+   */
+  404: unknown;
+  /**
+   * Conflict
+   */
+  409: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type StackStopResponses = {
+  /**
+   * Success
+   */
+  200: PortainerStack;
+};
+
+export type StackStopResponse = StackStopResponses[keyof StackStopResponses];
+
+export type StackCreateKubernetesGitData = {
+  /**
+   * stack config
+   */
+  body: StacksKubernetesGitDeploymentPayload;
+  path?: never;
+  query: {
+    /**
+     * Identifier of the environment that will be used to deploy the stack
+     */
+    endpointId: number;
+  };
+  url: '/stacks/create/kubernetes/repository';
+};
+
+export type StackCreateKubernetesGitErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Stack name or webhook ID already exists
+   */
+  409: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type StackCreateKubernetesGitResponses = {
+  /**
+   * OK
+   */
+  200: PortainerStack;
+};
+
+export type StackCreateKubernetesGitResponse =
+  StackCreateKubernetesGitResponses[keyof StackCreateKubernetesGitResponses];
+
+export type StackCreateKubernetesFileData = {
+  /**
+   * stack config
+   */
+  body: StacksKubernetesStringDeploymentPayload;
+  path?: never;
+  query: {
+    /**
+     * Identifier of the environment that will be used to deploy the stack
+     */
+    endpointId: number;
+  };
+  url: '/stacks/create/kubernetes/string';
+};
+
+export type StackCreateKubernetesFileErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type StackCreateKubernetesFileResponses = {
+  /**
+   * OK
+   */
+  200: PortainerStack;
+};
+
+export type StackCreateKubernetesFileResponse =
+  StackCreateKubernetesFileResponses[keyof StackCreateKubernetesFileResponses];
+
+export type StackCreateKubernetesUrlData = {
+  /**
+   * stack config
+   */
+  body: StacksKubernetesManifestUrlDeploymentPayload;
+  path?: never;
+  query: {
+    /**
+     * Identifier of the environment that will be used to deploy the stack
+     */
+    endpointId: number;
+  };
+  url: '/stacks/create/kubernetes/url';
+};
+
+export type StackCreateKubernetesUrlErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type StackCreateKubernetesUrlResponses = {
+  /**
+   * OK
+   */
+  200: PortainerStack;
+};
+
+export type StackCreateKubernetesUrlResponse =
+  StackCreateKubernetesUrlResponses[keyof StackCreateKubernetesUrlResponses];
+
+export type StackCreateDockerStandaloneFileData = {
+  body: {
+    /**
+     * Name of the stack
+     */
+    Name: string;
+    /**
+     * Environment variables passed during deployment, represented as a JSON array [{'name': 'name', 'value': 'value'}].
+     */
+    Env?: string;
+    /**
+     * Stack file
+     */
+    file?: Blob | File;
+  };
+  path?: never;
+  query: {
+    /**
+     * Identifier of the environment that will be used to deploy the stack
+     */
+    endpointId: number;
+  };
+  url: '/stacks/create/standalone/file';
+};
+
+export type StackCreateDockerStandaloneFileErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type StackCreateDockerStandaloneFileResponses = {
+  /**
+   * OK
+   */
+  200: PortainerStack;
+};
+
+export type StackCreateDockerStandaloneFileResponse =
+  StackCreateDockerStandaloneFileResponses[keyof StackCreateDockerStandaloneFileResponses];
+
+export type StackCreateDockerStandaloneRepositoryData = {
+  /**
+   * stack config
+   */
+  body: StacksComposeStackFromGitRepositoryPayload;
+  path?: never;
+  query: {
+    /**
+     * Identifier of the environment that will be used to deploy the stack
+     */
+    endpointId: number;
+  };
+  url: '/stacks/create/standalone/repository';
+};
+
+export type StackCreateDockerStandaloneRepositoryErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Stack name or webhook ID already exists
+   */
+  409: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type StackCreateDockerStandaloneRepositoryResponses = {
+  /**
+   * OK
+   */
+  200: PortainerStack;
+};
+
+export type StackCreateDockerStandaloneRepositoryResponse =
+  StackCreateDockerStandaloneRepositoryResponses[keyof StackCreateDockerStandaloneRepositoryResponses];
+
+export type StackCreateDockerStandaloneStringData = {
+  /**
+   * stack config
+   */
+  body: StacksComposeStackFromFileContentPayload;
+  path?: never;
+  query: {
+    /**
+     * Identifier of the environment that will be used to deploy the stack
+     */
+    endpointId: number;
+  };
+  url: '/stacks/create/standalone/string';
+};
+
+export type StackCreateDockerStandaloneStringErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type StackCreateDockerStandaloneStringResponses = {
+  /**
+   * OK
+   */
+  200: PortainerStack;
+};
+
+export type StackCreateDockerStandaloneStringResponse =
+  StackCreateDockerStandaloneStringResponses[keyof StackCreateDockerStandaloneStringResponses];
+
+export type StackCreateDockerSwarmFileData = {
+  body?: {
+    /**
+     * Name of the stack
+     */
+    Name?: string;
+    /**
+     * Swarm cluster identifier.
+     */
+    SwarmID?: string;
+    /**
+     * Environment variables passed during deployment, represented as a JSON array [{'name': 'name', 'value': 'value'}]. Optional
+     */
+    Env?: string;
+    /**
+     * Stack file
+     */
+    file?: Blob | File;
+  };
+  path?: never;
+  query: {
+    /**
+     * Identifier of the environment that will be used to deploy the stack
+     */
+    endpointId: number;
+  };
+  url: '/stacks/create/swarm/file';
+};
+
+export type StackCreateDockerSwarmFileErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type StackCreateDockerSwarmFileResponses = {
+  /**
+   * OK
+   */
+  200: PortainerStack;
+};
+
+export type StackCreateDockerSwarmFileResponse =
+  StackCreateDockerSwarmFileResponses[keyof StackCreateDockerSwarmFileResponses];
+
+export type StackCreateDockerSwarmRepositoryData = {
+  /**
+   * stack config
+   */
+  body: StacksSwarmStackFromGitRepositoryPayload;
+  path?: never;
+  query: {
+    /**
+     * Identifier of the environment that will be used to deploy the stack
+     */
+    endpointId: number;
+  };
+  url: '/stacks/create/swarm/repository';
+};
+
+export type StackCreateDockerSwarmRepositoryErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Stack name or webhook ID already exists
+   */
+  409: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type StackCreateDockerSwarmRepositoryResponses = {
+  /**
+   * OK
+   */
+  200: PortainerStack;
+};
+
+export type StackCreateDockerSwarmRepositoryResponse =
+  StackCreateDockerSwarmRepositoryResponses[keyof StackCreateDockerSwarmRepositoryResponses];
+
+export type StackCreateDockerSwarmStringData = {
+  /**
+   * stack config
+   */
+  body: StacksSwarmStackFromFileContentPayload;
+  path?: never;
+  query: {
+    /**
+     * Identifier of the environment that will be used to deploy the stack
+     */
+    endpointId: number;
+  };
+  url: '/stacks/create/swarm/string';
+};
+
+export type StackCreateDockerSwarmStringErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type StackCreateDockerSwarmStringResponses = {
+  /**
+   * OK
+   */
+  200: PortainerStack;
+};
+
+export type StackCreateDockerSwarmStringResponse =
+  StackCreateDockerSwarmStringResponses[keyof StackCreateDockerSwarmStringResponses];
+
+export type StackDeleteKubernetesByNameData = {
+  body?: never;
+  path: {
+    /**
+     * Stack name
+     */
+    name: string;
+  };
+  query: {
+    /**
+     * Set to true to delete an external stack. Only external Swarm stacks are supported
+     */
+    external?: boolean;
+    /**
+     * Environment identifier
+     */
+    endpointId: number;
+  };
+  url: '/stacks/name/{name}';
+};
+
+export type StackDeleteKubernetesByNameErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Permission denied
+   */
+  403: unknown;
+  /**
+   * Not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type StackDeleteKubernetesByNameResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type StackDeleteKubernetesByNameResponse =
+  StackDeleteKubernetesByNameResponses[keyof StackDeleteKubernetesByNameResponses];
+
+export type WebhookInvokeData = {
+  body?: never;
+  path: {
+    /**
+     * Stack identifier
+     */
+    webhookID: string;
+  };
+  query?: never;
+  url: '/stacks/webhooks/{webhookID}';
+};
+
+export type WebhookInvokeErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Autoupdate for the stack isn't available" or "Stack deployment is already in progress
+   */
+  409: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type WebhookInvokeResponses = {
+  /**
+   * Success
+   */
+  200: unknown;
+};
+
+export type SystemInfoData = {
+  body?: never;
+  path?: never;
+  query?: never;
+  url: '/system/info';
+};
+
+export type SystemInfoErrors = {
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type SystemInfoResponses = {
+  /**
+   * Success
+   */
+  200: SystemSystemInfoResponse;
+};
+
+export type SystemInfoResponse = SystemInfoResponses[keyof SystemInfoResponses];
+
+export type SystemNodesCountData = {
+  body?: never;
+  path?: never;
+  query?: never;
+  url: '/system/nodes';
+};
+
+export type SystemNodesCountErrors = {
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type SystemNodesCountResponses = {
+  /**
+   * Success
+   */
+  200: SystemNodesCountResponse;
+};
+
+export type SystemNodesCountResponse2 =
+  SystemNodesCountResponses[keyof SystemNodesCountResponses];
+
+export type SystemStatusData = {
+  body?: never;
+  path?: never;
+  query?: never;
+  url: '/system/status';
+};
+
+export type SystemStatusResponses = {
+  /**
+   * Success
+   */
+  200: SystemStatus;
+};
+
+export type SystemStatusResponse =
+  SystemStatusResponses[keyof SystemStatusResponses];
+
+export type SystemUpgradeData = {
+  body?: never;
+  path?: never;
+  query?: never;
+  url: '/system/upgrade';
+};
+
+export type SystemUpgradeResponses = {
+  /**
+   * Success
+   */
+  204: SystemStatus;
+};
+
+export type SystemUpgradeResponse =
+  SystemUpgradeResponses[keyof SystemUpgradeResponses];
+
+export type SystemVersionData = {
+  body?: never;
+  path?: never;
+  query?: never;
+  url: '/system/version';
+};
+
+export type SystemVersionResponses = {
+  /**
+   * Success
+   */
+  200: SystemVersionResponse;
+};
+
+export type SystemVersionResponse2 =
+  SystemVersionResponses[keyof SystemVersionResponses];
+
+export type TagListData = {
+  body?: never;
+  path?: never;
+  query?: never;
+  url: '/tags';
+};
+
+export type TagListErrors = {
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type TagListResponses = {
+  /**
+   * Success
+   */
+  200: Array<PortainerTag>;
+};
+
+export type TagListResponse = TagListResponses[keyof TagListResponses];
+
+export type TagCreateData = {
+  /**
+   * Tag details
+   */
+  body: TagsTagCreatePayload;
+  path?: never;
+  query?: never;
+  url: '/tags';
+};
+
+export type TagCreateErrors = {
+  /**
+   * This name is already associated to a tag
+   */
+  409: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type TagCreateResponses = {
+  /**
+   * Success
+   */
+  200: PortainerTag;
+};
+
+export type TagCreateResponse = TagCreateResponses[keyof TagCreateResponses];
+
+export type TagDeleteData = {
+  body?: never;
+  path: {
+    /**
+     * Tag identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/tags/{id}';
+};
+
+export type TagDeleteErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Permission denied
+   */
+  403: unknown;
+  /**
+   * Tag not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type TagDeleteResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type TagDeleteResponse = TagDeleteResponses[keyof TagDeleteResponses];
+
+export type TeamMembershipListData = {
+  body?: never;
+  path?: never;
+  query?: never;
+  url: '/team_memberships';
+};
+
+export type TeamMembershipListErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Permission denied
+   */
+  403: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type TeamMembershipListResponses = {
+  /**
+   * Success
+   */
+  200: Array<PortainerTeamMembership>;
+};
+
+export type TeamMembershipListResponse =
+  TeamMembershipListResponses[keyof TeamMembershipListResponses];
+
+export type TeamMembershipCreateData = {
+  /**
+   * Team membership details
+   */
+  body: TeammembershipsTeamMembershipCreatePayload;
+  path?: never;
+  query?: never;
+  url: '/team_memberships';
+};
+
+export type TeamMembershipCreateErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Permission denied to manage memberships
+   */
+  403: unknown;
+  /**
+   * Team membership already registered
+   */
+  409: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type TeamMembershipCreateResponses = {
+  /**
+   * Success
+   */
+  200: PortainerTeamMembership;
+};
+
+export type TeamMembershipCreateResponse =
+  TeamMembershipCreateResponses[keyof TeamMembershipCreateResponses];
+
+export type TeamMembershipDeleteData = {
+  body?: never;
+  path: {
+    /**
+     * TeamMembership identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/team_memberships/{id}';
+};
+
+export type TeamMembershipDeleteErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Permission denied
+   */
+  403: unknown;
+  /**
+   * TeamMembership not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type TeamMembershipDeleteResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type TeamMembershipDeleteResponse =
+  TeamMembershipDeleteResponses[keyof TeamMembershipDeleteResponses];
+
+export type TeamMembershipUpdateData = {
+  /**
+   * Team membership details
+   */
+  body: TeammembershipsTeamMembershipUpdatePayload;
+  path: {
+    /**
+     * Team membership identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/team_memberships/{id}';
+};
+
+export type TeamMembershipUpdateErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Permission denied
+   */
+  403: unknown;
+  /**
+   * TeamMembership not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type TeamMembershipUpdateResponses = {
+  /**
+   * Success
+   */
+  200: PortainerTeamMembership;
+};
+
+export type TeamMembershipUpdateResponse =
+  TeamMembershipUpdateResponses[keyof TeamMembershipUpdateResponses];
+
+export type TeamListData = {
+  body?: never;
+  path?: never;
+  query?: {
+    /**
+     * Only list teams that the user is leader of
+     */
+    onlyLedTeams?: boolean;
+    /**
+     * Identifier of the environment(endpoint) that will be used to filter the authorized teams
+     */
+    environmentId?: number;
+  };
+  url: '/teams';
+};
+
+export type TeamListErrors = {
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type TeamListResponses = {
+  /**
+   * Success
+   */
+  200: Array<PortainerTeam>;
+};
+
+export type TeamListResponse = TeamListResponses[keyof TeamListResponses];
+
+export type TeamCreateData = {
+  /**
+   * details
+   */
+  body: TeamsTeamCreatePayload;
+  path?: never;
+  query?: never;
+  url: '/teams';
+};
+
+export type TeamCreateErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * A team with the same name already exists
+   */
+  409: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type TeamCreateResponses = {
+  /**
+   * Success
+   */
+  200: PortainerTeam;
+};
+
+export type TeamCreateResponse = TeamCreateResponses[keyof TeamCreateResponses];
+
+export type TeamDeleteData = {
+  body?: never;
+  path: {
+    /**
+     * Team Id
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/teams/{id}';
+};
+
+export type TeamDeleteErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Permission denied
+   */
+  403: unknown;
+  /**
+   * Team not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type TeamDeleteResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type TeamDeleteResponse = TeamDeleteResponses[keyof TeamDeleteResponses];
+
+export type TeamInspectData = {
+  body?: never;
+  path: {
+    /**
+     * Team identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/teams/{id}';
+};
+
+export type TeamInspectErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Permission denied
+   */
+  403: unknown;
+  /**
+   * Team not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type TeamInspectResponses = {
+  /**
+   * Success
+   */
+  200: PortainerTeam;
+};
+
+export type TeamInspectResponse =
+  TeamInspectResponses[keyof TeamInspectResponses];
+
+export type TeamUpdateData = {
+  /**
+   * Team details
+   */
+  body: TeamsTeamUpdatePayload;
+  path: {
+    /**
+     * Team identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/teams/{id}';
+};
+
+export type TeamUpdateErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Permission denied
+   */
+  403: unknown;
+  /**
+   * Team not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type TeamUpdateResponses = {
+  /**
+   * Success
+   */
+  200: PortainerTeam;
+};
+
+export type TeamUpdateResponse = TeamUpdateResponses[keyof TeamUpdateResponses];
+
+export type TeamMembershipsData = {
+  body?: never;
+  path: {
+    /**
+     * Team Id
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/teams/{id}/memberships';
+};
+
+export type TeamMembershipsErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Permission denied
+   */
+  403: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type TeamMembershipsResponses = {
+  /**
+   * Success
+   */
+  200: Array<PortainerTeamMembership>;
+};
+
+export type TeamMembershipsResponse =
+  TeamMembershipsResponses[keyof TeamMembershipsResponses];
+
+export type TemplateListData = {
+  body?: never;
+  path?: never;
+  query?: never;
+  url: '/templates';
+};
+
+export type TemplateListErrors = {
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type TemplateListResponses = {
+  /**
+   * Success
+   */
+  200: TemplatesListResponse;
+};
+
+export type TemplateListResponse =
+  TemplateListResponses[keyof TemplateListResponses];
+
+export type TemplateFileData = {
+  body?: never;
+  path: {
+    /**
+     * Template identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/templates/{id}/file';
+};
+
+export type TemplateFileErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type TemplateFileResponses = {
+  /**
+   * Success
+   */
+  200: TemplatesFileResponse;
+};
+
+export type TemplateFileResponse =
+  TemplateFileResponses[keyof TemplateFileResponses];
+
+export type HelmRepoSearchData = {
+  body?: never;
+  path?: never;
+  query: {
+    /**
+     * Helm repository URL
+     */
+    repo: string;
+    /**
+     * Helm chart name
+     */
+    chart?: string;
+    /**
+     * If true will use cache to search
+     */
+    useCache?: string;
+  };
+  url: '/templates/helm';
+};
+
+export type HelmRepoSearchErrors = {
+  /**
+   * Bad request
+   */
+  400: unknown;
+  /**
+   * Unauthorized
+   */
+  401: unknown;
+  /**
+   * Not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type HelmRepoSearchResponses = {
+  /**
+   * Success
+   */
+  200: string;
+};
+
+export type HelmRepoSearchResponse =
+  HelmRepoSearchResponses[keyof HelmRepoSearchResponses];
+
+export type HelmShowData = {
+  body?: never;
+  path: {
+    /**
+     * chart/values/readme
+     */
+    command: string;
+  };
+  query: {
+    /**
+     * Helm repository URL
+     */
+    repo: string;
+    /**
+     * Chart name
+     */
+    chart: string;
+    /**
+     * Chart version
+     */
+    version?: string;
+  };
+  url: '/templates/helm/{command}';
+};
+
+export type HelmShowErrors = {
+  /**
+   * Unauthorized
+   */
+  401: unknown;
+  /**
+   * Environment(Endpoint) or ServiceAccount not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type HelmShowResponses = {
+  /**
+   * Success
+   */
+  200: string;
+};
+
+export type HelmShowResponse = HelmShowResponses[keyof HelmShowResponses];
+
+export type UploadTlsData = {
+  body: {
+    /**
+     * Folder where the TLS file will be stored. Will be created if not existing
+     */
+    folder: string;
+    /**
+     * The file to upload
+     */
+    file: Blob | File;
+  };
+  path: {
+    /**
+     * TLS file type. Valid values are 'ca', 'cert' or 'key'.
+     */
+    certificate: 'ca' | 'cert' | 'key';
+  };
+  query?: never;
+  url: '/upload/tls/{certificate}';
+};
+
+export type UploadTlsErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type UploadTlsResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type UploadTlsResponse = UploadTlsResponses[keyof UploadTlsResponses];
+
+export type UserListData = {
+  body?: never;
+  path?: never;
+  query?: {
+    /**
+     * Identifier of the environment(endpoint) that will be used to filter the authorized users
+     */
+    environmentId?: number;
+  };
+  url: '/users';
+};
+
+export type UserListErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type UserListResponses = {
+  /**
+   * Success
+   */
+  200: Array<PortainerUser>;
+};
+
+export type UserListResponse = UserListResponses[keyof UserListResponses];
+
+export type UserCreateData = {
+  /**
+   * User details
+   */
+  body: UsersUserCreatePayload;
+  path?: never;
+  query?: never;
+  url: '/users';
+};
+
+export type UserCreateErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Permission denied
+   */
+  403: unknown;
+  /**
+   * User already exists
+   */
+  409: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type UserCreateResponses = {
+  /**
+   * Success
+   */
+  200: PortainerUser;
+};
+
+export type UserCreateResponse = UserCreateResponses[keyof UserCreateResponses];
+
+export type UserDeleteData = {
+  body?: never;
+  path: {
+    /**
+     * User identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/users/{id}';
+};
+
+export type UserDeleteErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Permission denied
+   */
+  403: unknown;
+  /**
+   * User not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type UserDeleteResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type UserDeleteResponse = UserDeleteResponses[keyof UserDeleteResponses];
+
+export type UserInspectData = {
+  body?: never;
+  path: {
+    /**
+     * User identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/users/{id}';
+};
+
+export type UserInspectErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Permission denied
+   */
+  403: unknown;
+  /**
+   * User not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type UserInspectResponses = {
+  /**
+   * Success
+   */
+  200: PortainerUser;
+};
+
+export type UserInspectResponse =
+  UserInspectResponses[keyof UserInspectResponses];
+
+export type UserUpdateData = {
+  /**
+   * User details
+   */
+  body: UsersUserUpdatePayload;
+  path: {
+    /**
+     * User identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/users/{id}';
+};
+
+export type UserUpdateErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Permission denied
+   */
+  403: unknown;
+  /**
+   * User not found
+   */
+  404: unknown;
+  /**
+   * Username already exist
+   */
+  409: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type UserUpdateResponses = {
+  /**
+   * Success
+   */
+  200: PortainerUser;
+};
+
+export type UserUpdateResponse = UserUpdateResponses[keyof UserUpdateResponses];
+
+export type UserEffectiveAccessInspectData = {
+  body?: never;
+  path: {
+    /**
+     * User identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/users/{id}/effective-access';
+};
+
+export type UserEffectiveAccessInspectErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Permission denied
+   */
+  403: unknown;
+  /**
+   * User not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type UserEffectiveAccessInspectResponses = {
+  /**
+   * Success
+   */
+  200: Array<UsersEffectiveAccessEntry>;
+};
+
+export type UserEffectiveAccessInspectResponse =
+  UserEffectiveAccessInspectResponses[keyof UserEffectiveAccessInspectResponses];
+
+export type HelmUserRepositoriesListData = {
+  body?: never;
+  path: {
+    /**
+     * User identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/users/{id}/helm/repositories';
+};
+
+export type HelmUserRepositoriesListErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Permission denied
+   */
+  403: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type HelmUserRepositoriesListResponses = {
+  /**
+   * Success
+   */
+  200: UsersHelmUserRepositoryResponse;
+};
+
+export type HelmUserRepositoriesListResponse =
+  HelmUserRepositoriesListResponses[keyof HelmUserRepositoriesListResponses];
+
+export type HelmUserRepositoryCreateData = {
+  /**
+   * Helm Repository
+   */
+  body: UsersAddHelmRepoUrlPayload;
+  path: {
+    /**
+     * User identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/users/{id}/helm/repositories';
+};
+
+export type HelmUserRepositoryCreateErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Permission denied
+   */
+  403: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type HelmUserRepositoryCreateResponses = {
+  /**
+   * Success
+   */
+  200: PortainerHelmUserRepository;
+};
+
+export type HelmUserRepositoryCreateResponse =
+  HelmUserRepositoryCreateResponses[keyof HelmUserRepositoryCreateResponses];
+
+export type HelmUserRepositoryDeleteData = {
+  body?: never;
+  path: {
+    /**
+     * User identifier
+     */
+    id: number;
+    /**
+     * Repository identifier
+     */
+    repositoryID: number;
+  };
+  query?: never;
+  url: '/users/{id}/helm/repositories/{repositoryID}';
+};
+
+export type HelmUserRepositoryDeleteErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Permission denied
+   */
+  403: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type HelmUserRepositoryDeleteResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type HelmUserRepositoryDeleteResponse =
+  HelmUserRepositoryDeleteResponses[keyof HelmUserRepositoryDeleteResponses];
+
+export type UserMembershipsInspectData = {
+  body?: never;
+  path: {
+    /**
+     * User identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/users/{id}/memberships';
+};
+
+export type UserMembershipsInspectErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Permission denied
+   */
+  403: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type UserMembershipsInspectResponses = {
+  /**
+   * Success
+   */
+  200: PortainerTeamMembership;
+};
+
+export type UserMembershipsInspectResponse =
+  UserMembershipsInspectResponses[keyof UserMembershipsInspectResponses];
+
+export type UserUpdatePasswordData = {
+  /**
+   * details
+   */
+  body: UsersUserUpdatePasswordPayload;
+  path: {
+    /**
+     * identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/users/{id}/passwd';
+};
+
+export type UserUpdatePasswordErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Permission denied
+   */
+  403: unknown;
+  /**
+   * User not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type UserUpdatePasswordResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type UserUpdatePasswordResponse =
+  UserUpdatePasswordResponses[keyof UserUpdatePasswordResponses];
+
+export type UserGetApiKeysData = {
+  body?: never;
+  path: {
+    /**
+     * User identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/users/{id}/tokens';
+};
+
+export type UserGetApiKeysErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Permission denied
+   */
+  403: unknown;
+  /**
+   * User not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type UserGetApiKeysResponses = {
+  /**
+   * Success
+   */
+  200: Array<PortainerApiKey>;
+};
+
+export type UserGetApiKeysResponse =
+  UserGetApiKeysResponses[keyof UserGetApiKeysResponses];
+
+export type UserGenerateApiKeyData = {
+  /**
+   * details
+   */
+  body: UsersUserAccessTokenCreatePayload;
+  path: {
+    /**
+     * User identifier
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/users/{id}/tokens';
+};
+
+export type UserGenerateApiKeyErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Unauthorized
+   */
+  401: unknown;
+  /**
+   * Permission denied
+   */
+  403: unknown;
+  /**
+   * User not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type UserGenerateApiKeyResponses = {
+  /**
+   * Success
+   */
+  200: UsersAccessTokenResponse;
+};
+
+export type UserGenerateApiKeyResponse =
+  UserGenerateApiKeyResponses[keyof UserGenerateApiKeyResponses];
+
+export type UserRemoveApiKeyData = {
+  body?: never;
+  path: {
+    /**
+     * User identifier
+     */
+    id: number;
+    /**
+     * Api Key identifier
+     */
+    keyID: number;
+  };
+  query?: never;
+  url: '/users/{id}/tokens/{keyID}';
+};
+
+export type UserRemoveApiKeyErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Permission denied
+   */
+  403: unknown;
+  /**
+   * Not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type UserRemoveApiKeyResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type UserRemoveApiKeyResponse =
+  UserRemoveApiKeyResponses[keyof UserRemoveApiKeyResponses];
+
+export type UserAdminCheckData = {
+  body?: never;
+  path?: never;
+  query?: never;
+  url: '/users/admin/check';
+};
+
+export type UserAdminCheckErrors = {
+  /**
+   * User not found
+   */
+  404: unknown;
+};
+
+export type UserAdminCheckResponses = {
+  /**
+   * Success
+   */
+  204: void;
+};
+
+export type UserAdminCheckResponse =
+  UserAdminCheckResponses[keyof UserAdminCheckResponses];
+
+export type UserAdminInitData = {
+  /**
+   * User details
+   */
+  body: UsersAdminInitPayload;
+  headers?: {
+    /**
+     * Setup token (required when instance is uninitialized and --no-setup-token is not set)
+     */
+    'X-Setup-Token'?: string;
+  };
+  path?: never;
+  query?: never;
+  url: '/users/admin/init';
+};
+
+export type UserAdminInitErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Access denied - invalid or missing setup token
+   */
+  403: unknown;
+  /**
+   * Admin user already initialized
+   */
+  409: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type UserAdminInitResponses = {
+  /**
+   * Success
+   */
+  200: PortainerUser;
+};
+
+export type UserAdminInitResponse =
+  UserAdminInitResponses[keyof UserAdminInitResponses];
+
+export type CurrentUserInspectData = {
+  body?: never;
+  path?: never;
+  query?: never;
+  url: '/users/me';
+};
+
+export type CurrentUserInspectErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Permission denied
+   */
+  403: unknown;
+  /**
+   * User not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type CurrentUserInspectResponses = {
+  /**
+   * Success
+   */
+  200: PortainerUser;
+};
+
+export type CurrentUserInspectResponse =
+  CurrentUserInspectResponses[keyof CurrentUserInspectResponses];
+
+export type GetWebhooksData = {
+  body?: never;
+  path?: never;
+  query?: {
+    /**
+     * Filters (json-string)
+     */
+    filters?: string;
+  };
+  url: '/webhooks';
+};
+
+export type GetWebhooksErrors = {
+  /**
+   * Bad Request
+   */
+  400: unknown;
+  /**
+   * Internal Server Error
+   */
+  500: unknown;
+};
+
+export type GetWebhooksResponses = {
+  /**
+   * OK
+   */
+  200: Array<PortainerWebhook>;
+};
+
+export type GetWebhooksResponse =
+  GetWebhooksResponses[keyof GetWebhooksResponses];
+
+export type PostWebhooksData = {
+  /**
+   * Webhook data
+   */
+  body: WebhooksWebhookCreatePayload;
+  path?: never;
+  query?: never;
+  url: '/webhooks';
+};
+
+export type PostWebhooksErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * A webhook for this resource already exists
+   */
+  409: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type PostWebhooksResponses = {
+  /**
+   * OK
+   */
+  200: PortainerWebhook;
+};
+
+export type PostWebhooksResponse =
+  PostWebhooksResponses[keyof PostWebhooksResponses];
+
+export type DeleteWebhooksByIdData = {
+  body?: never;
+  path: {
+    /**
+     * Webhook id
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/webhooks/{id}';
+};
+
+export type DeleteWebhooksByIdErrors = {
+  /**
+   * Bad Request
+   */
+  400: unknown;
+  /**
+   * Internal Server Error
+   */
+  500: unknown;
+};
+
+export type DeleteWebhooksByIdResponses = {
+  /**
+   * Webhook deleted
+   */
+  202: unknown;
+};
+
+export type PostWebhooksByIdData = {
+  body?: never;
+  path: {
+    /**
+     * Webhook token
+     */
+    id: string;
+  };
+  query?: never;
+  url: '/webhooks/{id}';
+};
+
+export type PostWebhooksByIdErrors = {
+  /**
+   * Bad Request
+   */
+  400: unknown;
+  /**
+   * Internal Server Error
+   */
+  500: unknown;
+};
+
+export type PostWebhooksByIdResponses = {
+  /**
+   * Webhook executed
+   */
+  202: unknown;
+};
+
+export type PutWebhooksByIdData = {
+  /**
+   * Webhook data
+   */
+  body: WebhooksWebhookUpdatePayload;
+  path: {
+    /**
+     * Webhook id
+     */
+    id: number;
+  };
+  query?: never;
+  url: '/webhooks/{id}';
+};
+
+export type PutWebhooksByIdErrors = {
+  /**
+   * Bad Request
+   */
+  400: unknown;
+  /**
+   * Conflict
+   */
+  409: unknown;
+  /**
+   * Internal Server Error
+   */
+  500: unknown;
+};
+
+export type PutWebhooksByIdResponses = {
+  /**
+   * OK
+   */
+  200: PortainerWebhook;
+};
+
+export type PutWebhooksByIdResponse =
+  PutWebhooksByIdResponses[keyof PutWebhooksByIdResponses];
+
+export type GetWebsocketAttachData = {
+  body?: never;
+  path?: never;
+  query: {
+    /**
+     * environment(endpoint) ID of the environment(endpoint) where the resource is located
+     */
+    endpointId: number;
+    /**
+     * node name
+     */
+    nodeName?: string;
+  };
+  url: '/websocket/attach';
+};
+
+export type GetWebsocketAttachErrors = {
+  /**
+   * Bad Request
+   */
+  400: unknown;
+  /**
+   * Forbidden
+   */
+  403: unknown;
+  /**
+   * Not Found
+   */
+  404: unknown;
+  /**
+   * Internal Server Error
+   */
+  500: unknown;
+};
+
+export type GetWebsocketAttachResponses = {
+  /**
+   * OK
+   */
+  200: unknown;
+};
+
+export type GetWebsocketExecData = {
+  body?: never;
+  path?: never;
+  query: {
+    /**
+     * environment(endpoint) ID of the environment(endpoint) where the resource is located
+     */
+    endpointId: number;
+    /**
+     * node name
+     */
+    nodeName?: string;
+  };
+  url: '/websocket/exec';
+};
+
+export type GetWebsocketExecErrors = {
+  /**
+   * Bad Request
+   */
+  400: unknown;
+  /**
+   * Conflict
+   */
+  409: unknown;
+  /**
+   * Internal Server Error
+   */
+  500: unknown;
+};
+
+export type GetWebsocketExecResponses = {
+  /**
+   * OK
+   */
+  200: unknown;
+};
+
+export type GetWebsocketKubernetesShellData = {
+  body?: never;
+  path?: never;
+  query: {
+    /**
+     * environment(endpoint) ID of the environment(endpoint) where the resource is located
+     */
+    endpointId: number;
+  };
+  url: '/websocket/kubernetes-shell';
+};
+
+export type GetWebsocketKubernetesShellErrors = {
+  /**
+   * Invalid request
+   */
+  400: unknown;
+  /**
+   * Permission denied
+   */
+  403: unknown;
+  /**
+   * Environment not found
+   */
+  404: unknown;
+  /**
+   * Server error
+   */
+  500: unknown;
+};
+
+export type GetWebsocketKubernetesShellResponses = {
+  /**
+   * Success
+   */
+  200: unknown;
+};
+
+export type GetWebsocketPodData = {
+  body?: never;
+  path?: never;
+  query: {
+    /**
+     * environment(endpoint) ID of the environment(endpoint) where the resource is located
+     */
+    endpointId: number;
+    /**
+     * namespace where the container is located
+     */
+    namespace: string;
+    /**
+     * name of the pod containing the container
+     */
+    podName: string;
+    /**
+     * name of the container
+     */
+    containerName: string;
+    /**
+     * command to execute in the container
+     */
+    command: string;
+  };
+  url: '/websocket/pod';
+};
+
+export type GetWebsocketPodErrors = {
+  /**
+   * Bad Request
+   */
+  400: unknown;
+  /**
+   * Forbidden
+   */
+  403: unknown;
+  /**
+   * Not Found
+   */
+  404: unknown;
+  /**
+   * Internal Server Error
+   */
+  500: unknown;
+};
+
+export type GetWebsocketPodResponses = {
+  /**
+   * OK
+   */
+  200: unknown;
+};
diff --git a/app/react/portainer/generated-api/portainer/zod.gen.ts b/app/react/portainer/generated-api/portainer/zod.gen.ts
new file mode 100644
index 0000000..304324b
--- /dev/null
+++ b/app/react/portainer/generated-api/portainer/zod.gen.ts
@@ -0,0 +1,6428 @@
+// This file is auto-generated by @hey-api/openapi-ts
+
+import * as z from 'zod';
+
+export const zAuthAuthenticatePayload = z.object({
+  Password: z.string(),
+  Username: z.string(),
+});
+
+export const zAuthAuthenticateResponse = z.object({
+  jwt: z.string().optional(),
+});
+
+export const zAuthOauthPayload = z.object({
+  Code: z.string().optional(),
+});
+
+export const zBackupBackupPayload = z.object({
+  Password: z.string().optional(),
+});
+
+export const zBackupRestorePayload = z.object({
+  FileContent: z
+    .array(
+      z
+        .int()
+        .min(-2147483648, {
+          error: 'Invalid value: Expected int32 to be >= -2147483648',
+        })
+        .max(2147483647, {
+          error: 'Invalid value: Expected int32 to be <= 2147483647',
+        })
+    )
+    .optional(),
+  FileName: z.string().optional(),
+  Password: z.string().optional(),
+});
+
+export const zBuildBuildInfo = z.object({
+  BuildNumber: z.string().optional(),
+  GitCommit: z.string().optional(),
+  GoVersion: z.string().optional(),
+  ImageTag: z.string().optional(),
+  NodejsVersion: z.string().optional(),
+  PnpmVersion: z.string().optional(),
+  WebpackVersion: z.string().optional(),
+});
+
+export const zBuildDependenciesInfo = z.object({
+  ComposeVersion: z.string().optional(),
+  DockerVersion: z.string().optional(),
+  HelmVersion: z.string().optional(),
+  KubectlVersion: z.string().optional(),
+});
+
+export const zBuildRuntimeInfo = z.object({
+  Env: z.array(z.string()).optional(),
+});
+
+export const zContainersContainerGpusResponse = z.object({
+  gpus: z.string().optional(),
+});
+
+export const zCustomtemplatesFileResponse = z.object({
+  FileContent: z.string().optional(),
+});
+
+export const zDockerImagesCounters = z.object({
+  size: z.int().optional(),
+  total: z.int().optional(),
+});
+
+export const zEdgegroupsEdgeGroupCreatePayload = z.object({
+  Dynamic: z.boolean().optional(),
+  Endpoints: z.array(z.int()).optional(),
+  Name: z.string().optional(),
+  PartialMatch: z.boolean().optional(),
+  TagIDs: z.array(z.int()).optional(),
+});
+
+export const zEdgegroupsEdgeGroupUpdatePayload = z.object({
+  Dynamic: z.boolean().optional(),
+  Endpoints: z.array(z.int()).optional(),
+  Name: z.string().optional(),
+  PartialMatch: z.boolean().optional(),
+  TagIDs: z.array(z.int()).optional(),
+});
+
+export const zEdgejobsEdgeJobCreateFromFileContentPayload = z.object({
+  CronExpression: z.string().optional(),
+  EdgeGroups: z.array(z.int()).optional(),
+  Endpoints: z.array(z.int()).optional(),
+  FileContent: z.string().optional(),
+  Name: z.string().optional(),
+  Recurring: z.boolean().optional(),
+});
+
+export const zEdgejobsEdgeJobFileResponse = z.object({
+  FileContent: z.string().optional(),
+});
+
+export const zEdgejobsEdgeJobUpdatePayload = z.object({
+  CronExpression: z.string().optional(),
+  EdgeGroups: z.array(z.int()).optional(),
+  Endpoints: z.array(z.int()).optional(),
+  FileContent: z.string().optional(),
+  Name: z.string().optional(),
+  Recurring: z.boolean().optional(),
+});
+
+export const zEdgejobsFileResponse = z.object({
+  FileContent: z.string().optional(),
+});
+
+export const zEdgestacksEdgeStackFromGitRepositoryPayload = z.object({
+  DeploymentType: z
+    .union([z.literal(0), z.literal(1), z.literal(2)])
+    .optional(),
+  EdgeGroups: z.array(z.int()),
+  FilePathInRepository: z.string().optional().default('docker-compose.yml'),
+  Name: z.string(),
+  Registries: z.array(z.int()).optional(),
+  RepositoryAuthentication: z.boolean().optional(),
+  RepositoryPassword: z.string().optional(),
+  RepositoryReferenceName: z.string().optional(),
+  RepositoryURL: z.string().optional(),
+  RepositoryUsername: z.string().optional(),
+  SourceID: z.int().optional(),
+  TLSSkipVerify: z.boolean().optional(),
+  UseManifestNamespaces: z.boolean().optional(),
+});
+
+export const zEdgestacksEdgeStackFromStringPayload = z.object({
+  DeploymentType: z
+    .union([z.literal(0), z.literal(1), z.literal(2)])
+    .optional(),
+  EdgeGroups: z.array(z.int()).optional(),
+  Name: z.string(),
+  Registries: z.array(z.int()).optional(),
+  StackFileContent: z.string(),
+  UseManifestNamespaces: z.boolean().optional(),
+});
+
+export const zEdgestacksStackFileResponse = z.object({
+  StackFileContent: z.string().optional(),
+});
+
+export const zEndpointgroupsEndpointGroupTypeInfo = z.object({
+  Docker: z.int(),
+  Kubernetes: z.int(),
+  Mixed: z.boolean(),
+  Podman: z.int(),
+});
+
+export const zEndpointgroupsEndpointGroupCreatePayload = z.object({
+  AssociatedEndpoints: z.array(z.int()).optional(),
+  Description: z.string().optional(),
+  Name: z.string(),
+  TagIDs: z.array(z.int()).optional(),
+});
+
+export const zEndpointsDockerhubStatusResponse = z.object({
+  limit: z.int().optional(),
+  remaining: z.int().optional(),
+});
+
+export const zEndpointsEndpointCreateGlobalKeyResponse = z.object({
+  endpointID: z.int().optional(),
+});
+
+export const zEndpointsEndpointDeleteBatchPartialResponse = z.object({
+  deleted: z.array(z.int()).optional(),
+  errors: z.array(z.int()).optional(),
+});
+
+export const zEndpointsEndpointDeleteRequest = z.object({
+  deleteCluster: z.boolean().optional(),
+  id: z.int().optional(),
+});
+
+export const zEndpointsEndpointDeleteBatchPayload = z.object({
+  endpoints: z.array(zEndpointsEndpointDeleteRequest).optional(),
+});
+
+export const zEndpointsEndpointUpdateRelationsPayload = z.object({
+  Relations: z
+    .record(
+      z.string(),
+      z.object({
+        EdgeGroups: z.array(z.int()).optional(),
+        Group: z.int().optional(),
+        Tags: z.array(z.int()).optional(),
+      })
+    )
+    .optional(),
+});
+
+export const zEndpointsForceUpdateServicePayload = z.object({
+  PullImage: z.boolean().optional(),
+  ServiceID: z.string().optional(),
+});
+
+export const zEndpointsGroupCount = z.object({
+  count: z.int().optional(),
+  groupID: z.int().optional(),
+  groupName: z.string().optional(),
+});
+
+export const zEndpointsHealthCounts = z.object({
+  down: z.int().optional(),
+  heartbeat: z.int().optional(),
+  outdated: z.int().optional(),
+  up: z.int().optional(),
+});
+
+export const zEndpointsPlatformCounts = z.object({
+  azure: z.int().optional(),
+  docker: z.int().optional(),
+  kubernetes: z.int().optional(),
+  podman: z.int().optional(),
+});
+
+export const zEndpointsEnvironmentSummaryCountsResponse = z.object({
+  byGroup: z.array(zEndpointsGroupCount).optional(),
+  byHealth: zEndpointsHealthCounts.optional(),
+  byPlatformType: zEndpointsPlatformCounts.optional(),
+  down: z.int().optional(),
+  outdated: z.int().optional(),
+  total: z.int().optional(),
+  unassigned: z.int().optional(),
+  up: z.int().optional(),
+});
+
+export const zGitopsFileResponse = z.object({
+  FileContent: z.string().optional(),
+});
+
+export const zGitopsRepositoryFilePreviewPayload = z.object({
+  password: z.string().optional(),
+  reference: z.string().optional(),
+  repository: z.string().optional(),
+  sourceID: z.int().optional(),
+  targetFile: z.string().optional(),
+  tlsSkipVerify: z.boolean().optional(),
+  username: z.string().optional(),
+});
+
+export const zGittypesGitAuthentication = z.object({
+  AuthorizationType: z.int().optional(),
+  Password: z.string().optional(),
+  Provider: z.int().optional(),
+  Username: z.string().optional(),
+});
+
+export const zGittypesGitSource = z.object({
+  Authentication: zGittypesGitAuthentication.optional(),
+  TLSSkipVerify: z.boolean().optional(),
+  URL: z.string().optional(),
+});
+
+export const zGittypesRepoConfig = z.object({
+  Authentication: zGittypesGitAuthentication.optional(),
+  ConfigFilePath: z.string().optional(),
+  ConfigHash: z.string().optional(),
+  ReferenceName: z.string().optional(),
+  TLSSkipVerify: z.boolean().optional(),
+  URL: z.string().optional(),
+});
+
+export const zHelmInstallChartPayload = z.object({
+  atomic: z.boolean().optional(),
+  chart: z.string().optional(),
+  name: z.string().optional(),
+  namespace: z.string().optional(),
+  repo: z.string().optional(),
+  values: z.string().optional(),
+  version: z.string().optional(),
+});
+
+export const zImagesImageResponse = z.object({
+  created: z.int().optional(),
+  id: z.string().optional(),
+  nodeName: z.string().optional(),
+  size: z.int().optional(),
+  tags: z.array(z.string()).optional(),
+  used: z.boolean().optional(),
+});
+
+export const zIntstrType = z.union([z.literal(0), z.literal(1)]);
+
+export const zIntstrIntOrString = z.object({
+  IntVal: z.int().optional(),
+  StrVal: z.string().optional(),
+  Type: zIntstrType.optional(),
+});
+
+export const zK8sIoApiCoreV1ConditionStatus = z.enum([
+  'True',
+  'False',
+  'Unknown',
+]);
+
+export const zK8sIoApiCoreV1HttpHeader = z.object({
+  name: z.string().optional(),
+  value: z.string().optional(),
+});
+
+export const zK8sIoApiCoreV1LocalObjectReference = z.object({
+  name: z.string().optional(),
+});
+
+export const zK8sIoApiCoreV1ObjectReference = z.object({
+  apiVersion: z.string().optional(),
+  fieldPath: z.string().optional(),
+  kind: z.string().optional(),
+  name: z.string().optional(),
+  namespace: z.string().optional(),
+  resourceVersion: z.string().optional(),
+  uid: z.string().optional(),
+});
+
+export const zK8sIoApiCoreV1ResourceClaim = z.object({
+  name: z.string().optional(),
+  request: z.string().optional(),
+});
+
+export const zK8sIoApiRbacV1Subject = z.object({
+  apiGroup: z.string().optional(),
+  kind: z.string().optional(),
+  name: z.string().optional(),
+  namespace: z.string().optional(),
+});
+
+export const zKubernetesConfiguration = z.object({
+  ConfigurationOwner: z.string().optional(),
+  Data: z.record(z.string(), z.unknown()).optional(),
+  Kind: z.string().optional(),
+});
+
+export const zKubernetesCustomResourceMetadata = z.object({
+  apiVersion: z.string().optional(),
+  kind: z.string().optional(),
+  name: z.string().optional(),
+  plural: z.string().optional(),
+  scope: z.string().optional(),
+});
+
+export const zKubernetesK8sApplicationResource = z.object({
+  CpuLimit: z.number().optional(),
+  CpuRequest: z.number().optional(),
+  MemoryLimit: z.int().optional(),
+  MemoryRequest: z.int().optional(),
+});
+
+export const zKubernetesK8sClusterRole = z.object({
+  creationDate: z.string().optional(),
+  isSystem: z.boolean().optional(),
+  name: z.string().optional(),
+  uid: z.string().optional(),
+});
+
+export const zKubernetesK8sConfigurationOwnerResource = z.object({
+  Id: z.string().optional(),
+  Name: z.string().optional(),
+  ResourceKind: z.string().optional(),
+});
+
+export const zKubernetesK8sConfigMap = z.object({
+  Annotations: z.record(z.string(), z.string()).optional(),
+  ConfigurationOwner: z.string().optional(),
+  ConfigurationOwnerId: z.string().optional(),
+  ConfigurationOwners: z
+    .array(zKubernetesK8sConfigurationOwnerResource)
+    .optional(),
+  CreationDate: z.string().optional(),
+  Data: z.record(z.string(), z.string()).optional(),
+  IsUsed: z.boolean().optional(),
+  Labels: z.record(z.string(), z.string()).optional(),
+  Name: z.string().optional(),
+  Namespace: z.string().optional(),
+  UID: z.string().optional(),
+});
+
+export const zKubernetesK8sCronJobDeleteRequests = z.record(
+  z.string(),
+  z.array(z.string())
+);
+
+export const zKubernetesK8sDashboard = z.object({
+  applicationsCount: z.int().optional(),
+  configMapsCount: z.int().optional(),
+  ingressesCount: z.int().optional(),
+  namespacesCount: z.int().optional(),
+  secretsCount: z.int().optional(),
+  servicesCount: z.int().optional(),
+  volumesCount: z.int().optional(),
+});
+
+export const zKubernetesK8sEventInvolvedObject = z.object({
+  kind: z.string().optional(),
+  name: z.string().optional(),
+  namespace: z.string().optional(),
+  uid: z.string().optional(),
+});
+
+export const zKubernetesK8sEvent = z.object({
+  count: z.int().optional(),
+  eventTime: z.string().optional(),
+  firstTimestamp: z.string().optional(),
+  involvedObject: zKubernetesK8sEventInvolvedObject.optional(),
+  kind: z.string().optional(),
+  lastTimestamp: z.string().optional(),
+  message: z.string().optional(),
+  name: z.string().optional(),
+  namespace: z.string().optional(),
+  reason: z.string().optional(),
+  type: z.string().optional(),
+  uid: z.string().optional(),
+});
+
+export const zKubernetesK8sIngressController = z.object({
+  Availability: z.boolean().optional(),
+  ClassName: z.string().optional(),
+  Name: z.string().optional(),
+  New: z.boolean().optional(),
+  Type: z.string().optional(),
+  Used: z.boolean().optional(),
+});
+
+export const zKubernetesK8sIngressDeleteRequests = z.record(
+  z.string(),
+  z.array(z.string())
+);
+
+export const zKubernetesK8sIngressPath = z.object({
+  HasService: z.boolean().optional(),
+  Host: z.string().optional(),
+  IngressName: z.string().optional(),
+  Path: z.string().optional(),
+  PathType: z.string().optional(),
+  Port: z.int().optional(),
+  ServiceName: z.string().optional(),
+});
+
+export const zKubernetesK8sIngressTls = z.object({
+  Hosts: z.array(z.string()).optional(),
+  SecretName: z.string().optional(),
+});
+
+export const zKubernetesK8sIngressInfo = z.object({
+  Annotations: z.record(z.string(), z.string()).optional(),
+  ClassName: z.string().optional(),
+  CreationDate: z.string().optional(),
+  Hosts: z.array(z.string()).optional(),
+  Labels: z.record(z.string(), z.string()).optional(),
+  Name: z.string().optional(),
+  Namespace: z.string().optional(),
+  Paths: z.array(zKubernetesK8sIngressPath).optional(),
+  TLS: z.array(zKubernetesK8sIngressTls).optional(),
+  Type: z.string().optional(),
+  UID: z.string().optional(),
+});
+
+export const zKubernetesK8sJobDeleteRequests = z.record(
+  z.string(),
+  z.array(z.string())
+);
+
+export const zKubernetesK8sPvcResizeRequest = z.object({
+  name: z.string().optional(),
+  namespace: z.string().optional(),
+  newSize: z.string().optional(),
+});
+
+export const zKubernetesK8sResourceQuota = z.object({
+  cpu: z.string().optional(),
+  enabled: z.boolean().optional(),
+  memory: z.string().optional(),
+});
+
+export const zKubernetesK8sNamespaceDetails = z.object({
+  Annotations: z.record(z.string(), z.string()).optional(),
+  Name: z.string().optional(),
+  Owner: z.string().optional(),
+  ResourceQuota: zKubernetesK8sResourceQuota.optional(),
+});
+
+export const zKubernetesK8sRole = z.object({
+  creationDate: z.string().optional(),
+  isSystem: z.boolean().optional(),
+  name: z.string().optional(),
+  namespace: z.string().optional(),
+  uid: z.string().optional(),
+});
+
+export const zKubernetesK8sRoleBindingDeleteRequests = z.record(
+  z.string(),
+  z.array(z.string())
+);
+
+export const zKubernetesK8sRoleDeleteRequests = z.record(
+  z.string(),
+  z.array(z.string())
+);
+
+export const zKubernetesK8sSecret = z.object({
+  Annotations: z.record(z.string(), z.string()).optional(),
+  ConfigurationOwner: z.string().optional(),
+  ConfigurationOwnerId: z.string().optional(),
+  ConfigurationOwners: z
+    .array(zKubernetesK8sConfigurationOwnerResource)
+    .optional(),
+  CreationDate: z.string().optional(),
+  Data: z.record(z.string(), z.string()).optional(),
+  IsUsed: z.boolean().optional(),
+  Labels: z.record(z.string(), z.string()).optional(),
+  Name: z.string().optional(),
+  Namespace: z.string().optional(),
+  SecretType: z.string().optional(),
+  UID: z.string().optional(),
+});
+
+export const zKubernetesK8sServiceAccount = z.object({
+  annotations: z.record(z.string(), z.string()).optional(),
+  automountServiceAccountToken: z.boolean().optional(),
+  creationDate: z.string().optional(),
+  imagePullSecrets: z.array(zK8sIoApiCoreV1LocalObjectReference).optional(),
+  isSystem: z.boolean().optional(),
+  labels: z.record(z.string(), z.string()).optional(),
+  name: z.string().optional(),
+  namespace: z.string().optional(),
+  uid: z.string().optional(),
+});
+
+export const zKubernetesK8sServiceAccountDeleteRequests = z.record(
+  z.string(),
+  z.array(z.string())
+);
+
+export const zKubernetesK8sServiceAccountImagePullSecretsUpdatePayload =
+  z.object({
+    secretNames: z.array(z.string()).optional(),
+  });
+
+export const zKubernetesK8sServiceDeleteRequests = z.record(
+  z.string(),
+  z.array(z.string())
+);
+
+export const zKubernetesK8sServiceIngress = z.object({
+  Hostname: z.string().optional(),
+  IP: z.string().optional(),
+});
+
+export const zKubernetesK8sServicePort = z.object({
+  Name: z.string().optional(),
+  NodePort: z.int().optional(),
+  Port: z.int().optional(),
+  Protocol: z.string().optional(),
+  TargetPort: z.string().optional(),
+});
+
+export const zKubernetesK8sVolumeDeleteRequest = z.object({
+  name: z.string().optional(),
+  namespace: z.string().optional(),
+});
+
+export const zKubernetesMetadata = z.object({
+  annotations: z.record(z.string(), z.string()).optional(),
+  labels: z.record(z.string(), z.string()).optional(),
+});
+
+export const zKubernetesPod = z.object({
+  ContainerName: z.string().optional(),
+  CreationDate: z.string().optional(),
+  Image: z.string().optional(),
+  ImagePullPolicy: z.string().optional(),
+  Name: z.string().optional(),
+  NodeName: z.string().optional(),
+  PodIP: z.string().optional(),
+  Resource: zKubernetesK8sApplicationResource.optional(),
+  Status: z.string().optional(),
+  Uid: z.string().optional(),
+});
+
+export const zKubernetesTlsInfo = z.object({
+  hosts: z.array(z.string()).optional(),
+});
+
+export const zKubernetesIngressRule = z.object({
+  Host: z.string().optional(),
+  IP: z.string().optional(),
+  Path: z.string().optional(),
+  TLS: z.array(zKubernetesTlsInfo).optional(),
+});
+
+export const zKubernetesPublishedPort = z.object({
+  IngressRules: z.array(zKubernetesIngressRule).optional(),
+  Port: z.int().optional(),
+});
+
+export const zKubernetesK8sApplication = z.object({
+  Annotations: z.record(z.string(), z.string()).optional(),
+  ApplicationOwner: z.string().optional(),
+  ApplicationType: z.string().optional(),
+  Configurations: z.array(zKubernetesConfiguration).optional(),
+  Containers: z.array(z.unknown()).optional(),
+  CreationDate: z.string().optional(),
+  CustomResourceMetadata: zKubernetesCustomResourceMetadata.optional(),
+  DeploymentType: z.string().optional(),
+  Id: z.string().optional(),
+  Image: z.string().optional(),
+  Kind: z.string().optional(),
+  Labels: z.record(z.string(), z.string()).optional(),
+  LoadBalancerIPAddress: z.string().optional(),
+  MatchLabels: z.record(z.string(), z.string()).optional(),
+  Metadata: zKubernetesMetadata.optional(),
+  Name: z.string().optional(),
+  Namespace: z.string().optional(),
+  Pods: z.array(zKubernetesPod).optional(),
+  PublishedPorts: z.array(zKubernetesPublishedPort).optional(),
+  Resource: zKubernetesK8sApplicationResource.optional(),
+  ResourcePool: z.string().optional(),
+  RunningPodsCount: z.int().optional(),
+  ServiceId: z.string().optional(),
+  ServiceName: z.string().optional(),
+  ServiceType: z.string().optional(),
+  StackId: z.string().optional(),
+  StackKind: z.string().optional(),
+  StackName: z.string().optional(),
+  Status: z.string().optional(),
+  TotalPodsCount: z.int().optional(),
+  Uid: z.string().optional(),
+});
+
+export const zKubernetesK8sServiceInfo = z.object({
+  AllocateLoadBalancerNodePorts: z.boolean().optional(),
+  Annotations: z.record(z.string(), z.string()).optional(),
+  Applications: z.array(zKubernetesK8sApplication).optional(),
+  ClusterIPs: z.array(z.string()).optional(),
+  CreationDate: z.string().optional(),
+  ExternalIPs: z.array(z.string()).optional(),
+  ExternalName: z.string().optional(),
+  IngressStatus: z.array(zKubernetesK8sServiceIngress).optional(),
+  Labels: z.record(z.string(), z.string()).optional(),
+  Name: z.string().optional(),
+  Namespace: z.string().optional(),
+  Ports: z.array(zKubernetesK8sServicePort).optional(),
+  Selector: z.record(z.string(), z.string()).optional(),
+  Type: z.string().optional(),
+  UID: z.string().optional(),
+});
+
+export const zKubernetesDescribeResourceResponse = z.object({
+  describe: z.string().optional(),
+});
+
+export const zKubernetesKubernetesVersionResponse = z.object({
+  buildDate: z.string().optional(),
+  compiler: z.string().optional(),
+  emulationMajor: z.string().optional(),
+  emulationMinor: z.string().optional(),
+  gitCommit: z.string().optional(),
+  gitTreeState: z.string().optional(),
+  gitVersion: z.string().optional(),
+  goVersion: z.string().optional(),
+  major: z.string().optional(),
+  minCompatibilityMajor: z.string().optional(),
+  minCompatibilityMinor: z.string().optional(),
+  minor: z.string().optional(),
+  platform: z.string().optional(),
+  supportsPodRestart: z.boolean().optional(),
+});
+
+export const zKubernetesNamespacesToggleSystemPayload = z.object({
+  System: z.boolean().optional(),
+});
+
+export const zMotdMotd = z.object({
+  ContentLayout: z.record(z.string(), z.string()).optional(),
+  Hash: z.array(z.int()).optional(),
+  Message: z.string().optional(),
+  Style: z.string().optional(),
+  Title: z.string().optional(),
+});
+
+export const zOauth2AuthStyle = z.union([
+  z.literal(0),
+  z.literal(1),
+  z.literal(2),
+]);
+
+export const zPlatformContainerPlatform = z.enum([
+  'Docker',
+  'Docker Standalone',
+  'Docker Swarm',
+  'Kubernetes',
+  'Podman',
+]);
+
+export const zPortainerApiKey = z.object({
+  dateCreated: z.int().optional(),
+  description: z.string().optional(),
+  digest: z.string().optional(),
+  id: z.int().optional(),
+  lastUsed: z.int().optional(),
+  prefix: z.string().optional(),
+  userId: z.int().optional(),
+});
+
+export const zPortainerAccessPolicy = z.object({
+  Namespaces: z.array(z.string()).optional(),
+  RoleId: z.int(),
+});
+
+export const zPortainerAuthenticationMethod = z.union([
+  z.literal(0),
+  z.literal(1),
+  z.literal(2),
+  z.literal(3),
+]);
+
+export const zPortainerAuthorizations = z.record(z.string(), z.boolean());
+
+export const zPortainerAutoUpdateSettings = z.object({
+  ForcePullImage: z.boolean().optional(),
+  ForceUpdate: z.boolean().optional(),
+  Interval: z.string().optional(),
+  JobID: z.string().optional(),
+  Webhook: z.string().optional(),
+});
+
+export const zPortainerAzureCredentials = z.object({
+  ApplicationID: z.string(),
+  AuthenticationKey: z.string(),
+  TenantID: z.string(),
+});
+
+export const zPortainerCustomTemplatePlatform = z.union([
+  z.literal(0),
+  z.literal(1),
+  z.literal(2),
+]);
+
+export const zPortainerCustomTemplateVariableDefinition = z.object({
+  defaultValue: z.string().optional(),
+  description: z.string().optional(),
+  label: z.string().optional(),
+  name: z.string().optional(),
+});
+
+export const zCustomtemplatesCustomTemplateFromFileContentPayload = z.object({
+  Description: z.string(),
+  EdgeTemplate: z.boolean().optional(),
+  FileContent: z.string(),
+  Logo: z.string().optional(),
+  Note: z.string().optional(),
+  Platform: z.union([z.literal(1), z.literal(2)]).optional(),
+  Title: z.string(),
+  Type: z.union([z.literal(1), z.literal(2), z.literal(3)]),
+  Variables: z.array(zPortainerCustomTemplateVariableDefinition).optional(),
+});
+
+export const zCustomtemplatesCustomTemplateFromGitRepositoryPayload = z.object({
+  ComposeFilePathInRepository: z
+    .string()
+    .optional()
+    .default('docker-compose.yml'),
+  Description: z.string(),
+  EdgeTemplate: z.boolean().optional(),
+  IsComposeFormat: z.boolean().optional(),
+  Logo: z.string().optional(),
+  Note: z.string().optional(),
+  Platform: z.union([z.literal(1), z.literal(2)]).optional(),
+  RepositoryAuthentication: z.boolean().optional(),
+  RepositoryPassword: z.string().optional(),
+  RepositoryReferenceName: z.string().optional(),
+  RepositoryURL: z.string().optional(),
+  RepositoryUsername: z.string().optional(),
+  SourceID: z.int(),
+  TLSSkipVerify: z.boolean().optional(),
+  Title: z.string(),
+  Type: z.union([z.literal(1), z.literal(2)]),
+  Variables: z.array(zPortainerCustomTemplateVariableDefinition).optional(),
+});
+
+export const zCustomtemplatesCustomTemplateUpdatePayload = z.object({
+  ComposeFilePathInRepository: z
+    .string()
+    .optional()
+    .default('docker-compose.yml'),
+  Description: z.string(),
+  EdgeTemplate: z.boolean().optional(),
+  FileContent: z.string(),
+  IsComposeFormat: z.boolean().optional(),
+  Logo: z.string().optional(),
+  Note: z.string().optional(),
+  Platform: z.union([z.literal(1), z.literal(2)]).optional(),
+  RepositoryAuthentication: z.boolean().optional(),
+  RepositoryPassword: z.string().optional(),
+  RepositoryReferenceName: z.string().optional(),
+  RepositoryURL: z.string().optional(),
+  RepositoryUsername: z.string().optional(),
+  SourceID: z.int().optional(),
+  TLSSkipVerify: z.boolean().optional(),
+  Title: z.string(),
+  Type: z.union([z.literal(1), z.literal(2), z.literal(3)]),
+  Variables: z.array(zPortainerCustomTemplateVariableDefinition).optional(),
+});
+
+export const zPortainerDiagnosticsData = z.object({
+  DNS: z.record(z.string(), z.string()).optional(),
+  Log: z.string().optional(),
+  Proxy: z.record(z.string(), z.string()).optional(),
+  Telnet: z.record(z.string(), z.string()).optional(),
+});
+
+export const zPortainerDockerSnapshotRaw = z.record(z.string(), z.unknown());
+
+export const zPortainerEcrData = z.object({
+  Region: z.string().optional(),
+});
+
+export const zPortainerEdge = z.object({
+  AsyncMode: z.boolean().optional(),
+  CommandInterval: z.int().optional(),
+  PingInterval: z.int().optional(),
+  SnapshotInterval: z.int().optional(),
+});
+
+export const zPortainerEdgeJobLogsStatus = z.union([
+  z.literal(0),
+  z.literal(1),
+  z.literal(2),
+  z.literal(3),
+]);
+
+export const zEdgejobsTaskContainer = z.object({
+  EndpointId: z.int().optional(),
+  EndpointName: z.string().optional(),
+  Id: z.string().optional(),
+  LogsStatus: zPortainerEdgeJobLogsStatus.optional(),
+});
+
+export const zPortainerEdgeJobEndpointMeta = z.object({
+  CollectLogs: z.boolean().optional(),
+  LogsStatus: zPortainerEdgeJobLogsStatus.optional(),
+});
+
+export const zPortainerEdgeJob = z.object({
+  Created: z.int().optional(),
+  CronExpression: z.string().optional(),
+  EdgeGroups: z.array(z.int()).optional(),
+  Endpoints: z.record(z.string(), zPortainerEdgeJobEndpointMeta).optional(),
+  GroupLogsCollection: z
+    .record(z.string(), zPortainerEdgeJobEndpointMeta)
+    .optional(),
+  Id: z.int().optional(),
+  Name: z.string().optional(),
+  Recurring: z.boolean().optional(),
+  ScriptPath: z.string().optional(),
+  Version: z.int().optional(),
+});
+
+export const zPortainerEdgeStackDeploymentType = z.union([
+  z.literal(0),
+  z.literal(1),
+]);
+
+export const zEdgestacksUpdateEdgeStackPayload = z.object({
+  DeploymentType: zPortainerEdgeStackDeploymentType.optional(),
+  EdgeGroups: z.array(z.int()).optional(),
+  StackFileContent: z.string().optional(),
+  UpdateVersion: z.boolean().optional(),
+  UseManifestNamespaces: z.boolean().optional(),
+});
+
+export const zPortainerEdgeStackStatusDetails = z.object({
+  Acknowledged: z.boolean().optional(),
+  Error: z.boolean().optional(),
+  ImagesPulled: z.boolean().optional(),
+  Ok: z.boolean().optional(),
+  Pending: z.boolean().optional(),
+  RemoteUpdateSuccess: z.boolean().optional(),
+  Remove: z.boolean().optional(),
+});
+
+export const zPortainerEdgeStackStatusType = z.union([
+  z.literal(0),
+  z.literal(1),
+  z.literal(2),
+  z.literal(3),
+  z.literal(4),
+  z.literal(5),
+  z.literal(6),
+  z.literal(7),
+  z.literal(8),
+  z.literal(9),
+  z.literal(10),
+  z.literal(11),
+  z.literal(12),
+  z.literal(13),
+]);
+
+export const zEdgestacksUpdateStatusPayload = z.object({
+  EndpointID: z.int().optional(),
+  Error: z.string().optional(),
+  Status: zPortainerEdgeStackStatusType.optional(),
+  Time: z.coerce
+    .bigint()
+    .min(BigInt('-9223372036854775808'), {
+      error: 'Invalid value: Expected int64 to be >= -9223372036854775808',
+    })
+    .max(BigInt('9223372036854775807'), {
+      error: 'Invalid value: Expected int64 to be <= 9223372036854775807',
+    })
+    .optional(),
+  Version: z.int().optional(),
+});
+
+export const zPortainerEdgeStackDeploymentStatus = z.object({
+  Error: z.string().optional(),
+  RollbackTo: z.int().optional(),
+  Time: z.coerce
+    .bigint()
+    .min(BigInt('-9223372036854775808'), {
+      error: 'Invalid value: Expected int64 to be >= -9223372036854775808',
+    })
+    .max(BigInt('9223372036854775807'), {
+      error: 'Invalid value: Expected int64 to be <= 9223372036854775807',
+    })
+    .optional(),
+  Type: zPortainerEdgeStackStatusType.optional(),
+  Version: z.int().optional(),
+});
+
+export const zPortainerEndpointSecuritySettings = z.object({
+  allowBindMountsForRegularUsers: z.boolean(),
+  allowContainerCapabilitiesForRegularUsers: z.boolean(),
+  allowDeviceMappingForRegularUsers: z.boolean(),
+  allowHostNamespaceForRegularUsers: z.boolean(),
+  allowPrivilegedModeForRegularUsers: z.boolean(),
+  allowSecurityOptForRegularUsers: z.boolean(),
+  allowStackManagementForRegularUsers: z.boolean(),
+  allowSysctlSettingForRegularUsers: z.boolean(),
+  allowVolumeBrowserForRegularUsers: z.boolean(),
+  enableHostManagementFeatures: z.boolean(),
+});
+
+export const zPortainerEndpointStatus = z.union([
+  z.literal(0),
+  z.literal(1),
+  z.literal(2),
+]);
+
+export const zPortainerEndpointType = z.union([
+  z.literal(0),
+  z.literal(1),
+  z.literal(2),
+  z.literal(3),
+  z.literal(4),
+  z.literal(5),
+  z.literal(6),
+  z.literal(7),
+]);
+
+export const zEdgegroupsDecoratedEdgeGroup = z.object({
+  Dynamic: z.boolean().optional(),
+  EndpointIds: z.int().optional(),
+  EndpointTypes: z.array(zPortainerEndpointType).optional(),
+  Endpoints: z.array(z.int()).optional(),
+  HasEdgeJob: z.boolean().optional(),
+  HasEdgeStack: z.boolean().optional(),
+  Id: z.int().optional(),
+  Name: z.string().optional(),
+  PartialMatch: z.boolean().optional(),
+  TagIds: z.array(z.int()).optional(),
+  TrustedEndpoints: z.array(z.int()).optional(),
+});
+
+export const zPortainerEnvironmentAgentData = z.object({
+  Version: z.string().optional(),
+});
+
+export const zPortainerEnvironmentEdgeSettings = z.object({
+  AsyncMode: z.boolean(),
+  CommandInterval: z.int(),
+  PingInterval: z.int(),
+  SnapshotInterval: z.int(),
+});
+
+export const zPortainerGithubRegistryData = z.object({
+  OrganisationName: z.string().optional(),
+  UseOrganisation: z.boolean().optional(),
+});
+
+export const zPortainerGitlabRegistryData = z.object({
+  InstanceURL: z.string().optional(),
+  ProjectId: z.int().optional(),
+  ProjectPath: z.string().optional(),
+});
+
+export const zPortainerGlobalDeploymentOptions = z.object({
+  hideStacksFunctionality: z.boolean().optional(),
+});
+
+export const zPortainerHelmConfig = z.object({
+  Atomic: z.boolean().optional(),
+  ChartName: z.string().optional(),
+  ChartPath: z.string().optional(),
+  ChartURL: z.string().optional(),
+  ChartVersion: z.string().optional(),
+  Namespace: z.string().optional(),
+  Timeout: z.string().optional(),
+  ValuesFiles: z.array(z.string()).optional(),
+  ValuesInline: z.string().optional(),
+});
+
+export const zPortainerHelmUserRepository = z.object({
+  Id: z.int().optional(),
+  URL: z.string().optional(),
+  UserId: z.int().optional(),
+});
+
+export const zPortainerInternalAuthSettings = z.object({
+  RequiredPasswordLength: z.int().optional(),
+});
+
+export const zPortainerK8sNodeLimits = z.object({
+  CPU: z.int().optional(),
+  Memory: z.int().optional(),
+});
+
+export const zPortainerK8sNodesLimits = z.record(
+  z.string(),
+  zPortainerK8sNodeLimits
+);
+
+export const zPortainerKubernetesFlags = z.object({
+  GPUOperator: z.boolean().optional(),
+  IsServerIngressClassDetected: z.boolean(),
+  IsServerMetricsDetected: z.boolean(),
+  IsServerStorageDetected: z.boolean(),
+});
+
+export const zPortainerKubernetesIngressClassConfig = z.object({
+  Blocked: z.boolean().optional(),
+  BlockedNamespaces: z.array(z.string()).optional(),
+  Name: z.string(),
+  Type: z.string(),
+});
+
+export const zPortainerKubernetesStorageClassConfig = z.object({
+  AccessModes: z.array(z.string()).optional(),
+  AllowVolumeExpansion: z.boolean(),
+  Name: z.string(),
+  Provisioner: z.string(),
+});
+
+export const zPortainerKubernetesConfiguration = z.object({
+  AllowNoneIngressClass: z.boolean(),
+  EnableResourceOverCommit: z.boolean().optional(),
+  IngressAvailabilityPerNamespace: z.boolean(),
+  IngressClasses: z.array(zPortainerKubernetesIngressClassConfig).optional(),
+  ResourceOverCommitPercentage: z.int().optional(),
+  RestrictDefaultNamespace: z.boolean().optional(),
+  StorageClasses: z.array(zPortainerKubernetesStorageClassConfig).optional(),
+  UseLoadBalancer: z.boolean().optional(),
+  UseServerMetrics: z.boolean().optional(),
+});
+
+export const zPortainerLdapGroupSearchSettings = z.object({
+  GroupAttribute: z.string().optional(),
+  GroupBaseDN: z.string().optional(),
+  GroupFilter: z.string().optional(),
+});
+
+export const zPortainerLdapSearchSettings = z.object({
+  BaseDN: z.string().optional(),
+  Filter: z.string().optional(),
+  UserNameAttribute: z.string().optional(),
+});
+
+export const zPortainerMembershipRole = z.union([
+  z.literal(0),
+  z.literal(1),
+  z.literal(2),
+]);
+
+export const zPortainerOAuthSettings = z.object({
+  AccessTokenURI: z.string().optional(),
+  AuthStyle: zOauth2AuthStyle.optional(),
+  AuthorizationURI: z.string().optional(),
+  ClientID: z.string().optional(),
+  ClientSecret: z.string().optional(),
+  DefaultTeamID: z.int().optional(),
+  KubeSecretKey: z.array(z.int()).optional(),
+  LogoutURI: z.string().optional(),
+  OAuthAutoCreateUsers: z.boolean().optional(),
+  RedirectURI: z.string().optional(),
+  ResourceURI: z.string().optional(),
+  SSO: z.boolean().optional(),
+  Scopes: z.string().optional(),
+  UserIdentifier: z.string().optional(),
+});
+
+export const zPortainerPair = z.object({
+  name: z.string(),
+  value: z.string(),
+});
+
+export const zEndpointsEndpointSettingsUpdatePayload = z.object({
+  allowBindMountsForRegularUsers: z.boolean().optional(),
+  allowContainerCapabilitiesForRegularUsers: z.boolean().optional(),
+  allowDeviceMappingForRegularUsers: z.boolean().optional(),
+  allowHostNamespaceForRegularUsers: z.boolean().optional(),
+  allowPrivilegedModeForRegularUsers: z.boolean().optional(),
+  allowSecurityOptForRegularUsers: z.boolean().optional(),
+  allowStackManagementForRegularUsers: z.boolean().optional(),
+  allowSysctlSettingForRegularUsers: z.boolean().optional(),
+  allowVolumeBrowserForRegularUsers: z.boolean().optional(),
+  enableGPUManagement: z.boolean().optional(),
+  enableHostManagementFeatures: z.boolean().optional(),
+  gpus: z.array(zPortainerPair).optional(),
+});
+
+export const zPortainerPerformanceMetrics = z.object({
+  CPUUsage: z.number().optional(),
+  DiskUsage: z.number().optional(),
+  MemoryUsage: z.number().optional(),
+  NetworkUsage: z.number().optional(),
+});
+
+export const zPortainerDockerSnapshot = z.object({
+  ContainerCount: z.int(),
+  DiagnosticsData: zPortainerDiagnosticsData.optional(),
+  DockerSnapshotRaw: zPortainerDockerSnapshotRaw.optional(),
+  DockerVersion: z.string(),
+  GpuUseAll: z.boolean(),
+  GpuUseList: z.array(z.string()).optional(),
+  HealthyContainerCount: z.int(),
+  ImageCount: z.int(),
+  IsPodman: z.boolean(),
+  NodeCount: z.int(),
+  PerformanceMetrics: zPortainerPerformanceMetrics.optional(),
+  RunningContainerCount: z.int(),
+  ServiceCount: z.int(),
+  StackCount: z.int(),
+  StoppedContainerCount: z.int(),
+  Swarm: z.boolean(),
+  Time: z.int(),
+  TotalCPU: z.int(),
+  TotalMemory: z.int(),
+  UnhealthyContainerCount: z.int(),
+  VolumeCount: z.int(),
+});
+
+export const zPortainerKubernetesSnapshot = z.object({
+  ClusterType: z.string().optional(),
+  DiagnosticsData: zPortainerDiagnosticsData.optional(),
+  GPUNodeCount: z.int().optional(),
+  KubernetesVersion: z.string(),
+  NodeCount: z.int(),
+  PerformanceMetrics: zPortainerPerformanceMetrics.optional(),
+  Time: z.int(),
+  TotalCPU: z.int(),
+  TotalGPU: z
+    .record(
+      z.string(),
+      z.coerce
+        .bigint()
+        .min(BigInt('-9223372036854775808'), {
+          error: 'Invalid value: Expected int64 to be >= -9223372036854775808',
+        })
+        .max(BigInt('9223372036854775807'), {
+          error: 'Invalid value: Expected int64 to be <= 9223372036854775807',
+        })
+    )
+    .optional(),
+  TotalMemory: z.int(),
+});
+
+export const zPortainerKubernetesData = z.object({
+  Configuration: zPortainerKubernetesConfiguration,
+  Flags: zPortainerKubernetesFlags,
+  Snapshots: z.array(zPortainerKubernetesSnapshot).optional(),
+});
+
+export const zPortainerQuayRegistryData = z.object({
+  OrganisationName: z.string().optional(),
+  UseOrganisation: z.boolean().optional(),
+});
+
+export const zPortainerRegistryType = z.union([
+  z.literal(0),
+  z.literal(1),
+  z.literal(2),
+  z.literal(3),
+  z.literal(4),
+  z.literal(5),
+  z.literal(6),
+  z.literal(7),
+  z.literal(8),
+]);
+
+export const zPortainerResourceAccessLevel = z.union([
+  z.literal(0),
+  z.literal(1),
+]);
+
+export const zPortainerResourceControlType = z.union([
+  z.literal(0),
+  z.literal(1),
+  z.literal(2),
+  z.literal(3),
+  z.literal(4),
+  z.literal(5),
+  z.literal(6),
+  z.literal(7),
+  z.literal(8),
+  z.literal(9),
+]);
+
+export const zPortainerRole = z.object({
+  Authorizations: zPortainerAuthorizations.optional(),
+  Description: z.string().optional(),
+  Id: z.int().optional(),
+  Name: z.string().optional(),
+  Priority: z.int().optional(),
+});
+
+export const zPortainerSslSettings = z.object({
+  certPath: z.string().optional(),
+  httpEnabled: z.boolean().optional(),
+  keyPath: z.string().optional(),
+  selfSigned: z.boolean().optional(),
+});
+
+export const zPortainerSourceStatus = z.union([
+  z.literal(0),
+  z.literal(1),
+  z.literal(2),
+]);
+
+export const zPortainerArtifactFile = z.object({
+  hash: z.string().optional(),
+  path: z.string().optional(),
+  pathError: z.string().optional(),
+  pathStatus: zPortainerSourceStatus.optional(),
+  ref: z.string().optional(),
+  refError: z.string().optional(),
+  refStatus: zPortainerSourceStatus.optional(),
+  sourceId: z.int().optional(),
+});
+
+export const zPortainerArtifact = z.object({
+  edgeGroups: z.array(z.int()).optional(),
+  edgeStackId: z.int().optional(),
+  envGroups: z.array(z.int()).optional(),
+  envIds: z.array(z.int()).optional(),
+  files: z.array(zPortainerArtifactFile).optional(),
+  stackId: z.int().optional(),
+});
+
+export const zPortainerSourceType = z.union([
+  z.literal(0),
+  z.literal(1),
+  z.literal(2),
+  z.literal(3),
+]);
+
+export const zPortainerStackDeploymentInfo = z.object({
+  AdditionalFiles: z.array(z.string()).optional(),
+  ConfigFilePath: z.string().optional(),
+  ConfigHash: z.string().optional(),
+  FileVersion: z.int().optional(),
+  ReferenceName: z.string().optional(),
+  RepositoryURL: z.string().optional(),
+  SourceID: z.int().optional(),
+  Version: z.int().optional(),
+});
+
+export const zPortainerEdgeStackStatus = z.object({
+  DeploymentInfo: zPortainerStackDeploymentInfo.optional(),
+  Details: zPortainerEdgeStackStatusDetails.optional(),
+  EndpointID: z.int().optional(),
+  Error: z.string().optional(),
+  ReadyRePullImage: z.boolean().optional(),
+  Status: z.array(zPortainerEdgeStackDeploymentStatus).optional(),
+  Type: zPortainerEdgeStackStatusType.optional(),
+});
+
+export const zPortainerEdgeStack = z.object({
+  CreatedBy: z.string().optional(),
+  CreatedByUserId: z.string().optional(),
+  CreationDate: z.int().optional(),
+  DeploymentType: zPortainerEdgeStackDeploymentType.optional(),
+  EdgeGroups: z.array(z.int()).optional(),
+  EntryPoint: z.string().optional(),
+  Id: z.int().optional(),
+  ManifestPath: z.string().optional(),
+  Name: z.string().optional(),
+  NumDeployments: z.int().optional(),
+  ProjectPath: z.string().optional(),
+  Status: z.record(z.string(), zPortainerEdgeStackStatus).optional(),
+  UseManifestNamespaces: z.boolean().optional(),
+  Version: z.int().optional(),
+});
+
+export const zPortainerStackOption = z.object({
+  HelmAtomic: z.boolean().optional(),
+  Prune: z.boolean().optional(),
+});
+
+export const zPortainerStackStatus = z.union([
+  z.literal(0),
+  z.literal(1),
+  z.literal(2),
+  z.literal(3),
+  z.literal(4),
+]);
+
+export const zPortainerStackDeploymentStatus = z.object({
+  Message: z.string().optional(),
+  Status: zPortainerStackStatus.optional(),
+  Time: z.int().optional(),
+});
+
+export const zPortainerStackType = z.union([
+  z.literal(0),
+  z.literal(1),
+  z.literal(2),
+  z.literal(3),
+]);
+
+export const zPortainerTlsConfiguration = z.object({
+  TLS: z.boolean(),
+  TLSCACert: z.string().optional(),
+  TLSCert: z.string().optional(),
+  TLSKey: z.string().optional(),
+  TLSSkipVerify: z.boolean(),
+});
+
+export const zPortainerLdapSettings = z.object({
+  AnonymousMode: z.boolean().optional(),
+  AutoCreateUsers: z.boolean().optional(),
+  GroupSearchSettings: z.array(zPortainerLdapGroupSearchSettings).optional(),
+  Password: z.string().optional(),
+  ReaderDN: z.string().optional(),
+  SearchSettings: z.array(zPortainerLdapSearchSettings).optional(),
+  StartTLS: z.boolean().optional(),
+  TLSConfig: zPortainerTlsConfiguration.optional(),
+  URL: z.string().optional(),
+});
+
+export const zLdapCheckPayload = z.object({
+  LDAPSettings: zPortainerLdapSettings.optional(),
+});
+
+export const zPortainerRegistryManagementConfiguration = z.object({
+  AccessToken: z.string().optional(),
+  AccessTokenExpiry: z.int().optional(),
+  Authentication: z.boolean().optional(),
+  Ecr: zPortainerEcrData.optional(),
+  Password: z.string().optional(),
+  TLSConfig: zPortainerTlsConfiguration.optional(),
+  Type: zPortainerRegistryType.optional(),
+  Username: z.string().optional(),
+});
+
+export const zPortainerSettings = z.object({
+  AgentSecret: z.string().optional(),
+  AllowBindMountsForRegularUsers: z.boolean().optional(),
+  AllowContainerCapabilitiesForRegularUsers: z.boolean().optional(),
+  AllowDeviceMappingForRegularUsers: z.boolean().optional(),
+  AllowHostNamespaceForRegularUsers: z.boolean().optional(),
+  AllowPrivilegedModeForRegularUsers: z.boolean().optional(),
+  AllowStackManagementForRegularUsers: z.boolean().optional(),
+  AllowVolumeBrowserForRegularUsers: z.boolean().optional(),
+  AuthenticationMethod: zPortainerAuthenticationMethod.optional(),
+  BlackListedLabels: z.array(zPortainerPair).optional(),
+  DisplayDonationHeader: z.boolean().optional(),
+  DisplayExternalContributors: z.boolean().optional(),
+  Edge: zPortainerEdge.optional(),
+  EdgeAgentCheckinInterval: z.int().optional(),
+  EdgePortainerUrl: z.string().optional(),
+  EnableEdgeComputeFeatures: z.boolean().optional(),
+  EnableHostManagementFeatures: z.boolean().optional(),
+  EnforceEdgeID: z.boolean().optional(),
+  FeatureFlagSettings: z.record(z.string(), z.boolean()).optional(),
+  ForceSecureCookies: z.boolean().optional(),
+  GlobalDeploymentOptions: zPortainerGlobalDeploymentOptions.optional(),
+  HelmRepositoryURL: z.string().optional(),
+  InternalAuthSettings: zPortainerInternalAuthSettings.optional(),
+  IsDockerDesktopExtension: z.boolean().optional(),
+  KubeconfigExpiry: z.string().optional(),
+  KubectlShellImage: z.string().optional(),
+  LDAPSettings: zPortainerLdapSettings.optional(),
+  LogoURL: z.string().optional(),
+  OAuthSettings: zPortainerOAuthSettings.optional(),
+  SnapshotInterval: z.string().optional(),
+  TemplatesURL: z.string().optional(),
+  TrustOnFirstConnect: z.boolean().optional(),
+  UserSessionTimeout: z.string().optional(),
+});
+
+export const zPortainerTag = z.object({
+  EndpointGroups: z.record(z.string(), z.boolean()).optional(),
+  Endpoints: z.record(z.string(), z.boolean()).optional(),
+  ID: z.int().optional(),
+  Name: z.string().optional(),
+});
+
+export const zPortainerTeam = z.object({
+  Id: z.int().optional(),
+  Name: z.string().optional(),
+});
+
+export const zPortainerTeamAccessPolicies = z.record(
+  z.string(),
+  zPortainerAccessPolicy
+);
+
+export const zPortainerTeamMembership = z.object({
+  Id: z.int().optional(),
+  Role: zPortainerMembershipRole.optional(),
+  TeamID: z.int().optional(),
+  UserID: z.int().optional(),
+});
+
+export const zPortainerTeamResourceAccess = z.object({
+  AccessLevel: zPortainerResourceAccessLevel.optional(),
+  TeamId: z.int().optional(),
+});
+
+export const zPortainerTemplateEnvSelect = z.object({
+  default: z.boolean().optional(),
+  text: z.string().optional(),
+  value: z.string().optional(),
+});
+
+export const zPortainerTemplateEnv = z.object({
+  default: z.string().optional(),
+  description: z.string().optional(),
+  label: z.string().optional(),
+  name: z.string().optional(),
+  preset: z.boolean().optional(),
+  select: z.array(zPortainerTemplateEnvSelect).optional(),
+});
+
+export const zPortainerTemplateRepository = z.object({
+  stackfile: z.string().optional(),
+  url: z.string().optional(),
+});
+
+export const zPortainerTemplateType = z.union([
+  z.literal(0),
+  z.literal(1),
+  z.literal(2),
+  z.literal(3),
+]);
+
+export const zPortainerTemplateVolume = z.object({
+  bind: z.string().optional(),
+  container: z.string().optional(),
+  readonly: z.boolean().optional(),
+});
+
+export const zPortainerTemplate = z.object({
+  administrator_only: z.boolean().optional(),
+  categories: z.array(z.string()).optional(),
+  command: z.string().optional(),
+  description: z.string().optional(),
+  env: z.array(zPortainerTemplateEnv).optional(),
+  hostname: z.string().optional(),
+  id: z.int().optional(),
+  image: z.string().optional(),
+  interactive: z.boolean().optional(),
+  labels: z.array(zPortainerPair).optional(),
+  logo: z.string().optional(),
+  name: z.string().optional(),
+  network: z.string().optional(),
+  note: z.string().optional(),
+  platform: z.string().optional(),
+  ports: z.array(z.string()).optional(),
+  privileged: z.boolean().optional(),
+  registry: z.string().optional(),
+  repository: zPortainerTemplateRepository.optional(),
+  restart_policy: z.string().optional(),
+  stackFile: z.string().optional(),
+  title: z.string().optional(),
+  type: zPortainerTemplateType.optional(),
+  volumes: z.array(zPortainerTemplateVolume).optional(),
+});
+
+export const zPortainerUserAccessPolicies = z.record(
+  z.string(),
+  zPortainerAccessPolicy
+);
+
+export const zEndpointgroupsEndpointGroupResponse = z.object({
+  Description: z.string(),
+  Id: z.int(),
+  Name: z.string(),
+  TagIds: z.array(z.int()).optional(),
+  TeamAccessPolicies: zPortainerTeamAccessPolicies.optional(),
+  Total: z.int().optional(),
+  TypeInfo: zEndpointgroupsEndpointGroupTypeInfo.optional(),
+  UserAccessPolicies: zPortainerUserAccessPolicies.optional(),
+});
+
+export const zEndpointgroupsEndpointGroupUpdatePayload = z.object({
+  AssociatedEndpoints: z.array(z.int()).optional(),
+  Description: z.string().optional(),
+  Name: z.string().optional(),
+  TagIDs: z.array(z.int()).optional(),
+  TeamAccessPolicies: zPortainerTeamAccessPolicies.optional(),
+  UserAccessPolicies: zPortainerUserAccessPolicies.optional(),
+});
+
+export const zEndpointsEndpointUpdatePayload = z.object({
+  AzureApplicationID: z.string().optional(),
+  AzureAuthenticationKey: z.string().optional(),
+  AzureTenantID: z.string().optional(),
+  EdgeCheckinInterval: z.int().optional(),
+  Gpus: z.array(zPortainerPair).optional(),
+  GroupID: z.int().optional(),
+  Kubernetes: zPortainerKubernetesData.optional(),
+  Name: z.string().optional(),
+  PublicURL: z.string().optional(),
+  Status: z.int().optional(),
+  TLS: z.boolean().optional(),
+  TLSSkipClientVerify: z.boolean().optional(),
+  TLSSkipVerify: z.boolean().optional(),
+  TagIDs: z.array(z.int()).optional(),
+  TeamAccessPolicies: zPortainerTeamAccessPolicies.optional(),
+  URL: z.string().optional(),
+  UserAccessPolicies: zPortainerUserAccessPolicies.optional(),
+});
+
+export const zEndpointsRegistryAccessPayload = z.object({
+  Namespaces: z.array(z.string()).optional(),
+  TeamAccessPolicies: zPortainerTeamAccessPolicies.optional(),
+  UserAccessPolicies: zPortainerUserAccessPolicies.optional(),
+});
+
+export const zPortainerEndpoint = z.object({
+  Agent: zPortainerEnvironmentAgentData,
+  AzureCredentials: zPortainerAzureCredentials.optional(),
+  ComposeSyntaxMaxVersion: z.string(),
+  ContainerEngine: z.string(),
+  Edge: zPortainerEnvironmentEdgeSettings,
+  EdgeCheckinInterval: z.int(),
+  EdgeID: z.string().optional(),
+  EdgeKey: z.string(),
+  EnableGPUManagement: z.boolean().optional(),
+  Gpus: z.array(zPortainerPair).optional(),
+  GroupId: z.int(),
+  Heartbeat: z.boolean().optional(),
+  Id: z.int(),
+  Kubernetes: zPortainerKubernetesData,
+  LastCheckInDate: z.int(),
+  Name: z.string(),
+  PublicURL: z.string(),
+  SecuritySettings: zPortainerEndpointSecuritySettings,
+  Snapshots: z.array(zPortainerDockerSnapshot).optional(),
+  Status: z
+    .union([z.literal(1), z.literal(2), z.literal(3), z.literal(4)])
+    .optional(),
+  TLSConfig: zPortainerTlsConfiguration,
+  TagIds: z.array(z.int()).optional(),
+  TeamAccessPolicies: zPortainerTeamAccessPolicies.optional(),
+  Type: zPortainerEndpointType,
+  URL: z.string(),
+  UserAccessPolicies: zPortainerUserAccessPolicies.optional(),
+  UserTrusted: z.boolean().optional(),
+});
+
+export const zPortainerEndpointGroup = z.object({
+  Description: z.string(),
+  Id: z.int(),
+  Name: z.string(),
+  TagIds: z.array(z.int()).optional(),
+  TeamAccessPolicies: zPortainerTeamAccessPolicies.optional(),
+  UserAccessPolicies: zPortainerUserAccessPolicies.optional(),
+});
+
+export const zPortainerRegistryAccessPolicies = z.object({
+  Namespaces: z.array(z.string()).optional(),
+  TeamAccessPolicies: zPortainerTeamAccessPolicies.optional(),
+  UserAccessPolicies: zPortainerUserAccessPolicies.optional(),
+});
+
+export const zPortainerRegistryAccesses = z.record(
+  z.string(),
+  zPortainerRegistryAccessPolicies
+);
+
+export const zPortainerRegistry = z.object({
+  AccessToken: z.string().optional(),
+  AccessTokenExpiry: z.int().optional(),
+  Authentication: z.boolean().optional(),
+  AuthorizedTeams: z.array(z.int()).optional(),
+  AuthorizedUsers: z.array(z.int()).optional(),
+  BaseURL: z.string().optional(),
+  Ecr: zPortainerEcrData.optional(),
+  Github: zPortainerGithubRegistryData.optional(),
+  Gitlab: zPortainerGitlabRegistryData.optional(),
+  Id: z.int().optional(),
+  ManagementConfiguration: zPortainerRegistryManagementConfiguration.optional(),
+  Name: z.string().optional(),
+  Password: z.string().optional(),
+  Quay: zPortainerQuayRegistryData.optional(),
+  RegistryAccesses: zPortainerRegistryAccesses.optional(),
+  TeamAccessPolicies: zPortainerTeamAccessPolicies.optional(),
+  Type: z
+    .union([
+      z.literal(1),
+      z.literal(2),
+      z.literal(3),
+      z.literal(4),
+      z.literal(5),
+      z.literal(6),
+      z.literal(7),
+    ])
+    .optional(),
+  URL: z.string().optional(),
+  UserAccessPolicies: zPortainerUserAccessPolicies.optional(),
+  Username: z.string().optional(),
+});
+
+export const zPortainerSource = z.object({
+  administratorsOnly: z.boolean().optional(),
+  git: zGittypesGitSource.optional(),
+  helm: zPortainerHelmConfig.optional(),
+  id: z.int().optional(),
+  lastSync: z.int().optional(),
+  name: z.string().optional(),
+  ownerID: z.int().optional(),
+  public: z.boolean().optional(),
+  registry: zPortainerRegistry.optional(),
+  status: zPortainerSourceStatus.optional(),
+  statusError: z.string().optional(),
+  teamAccesses: z.array(z.int()).optional(),
+  type: zPortainerSourceType.optional(),
+  userAccesses: z.array(z.int()).optional(),
+});
+
+export const zPortainerUserResourceAccess = z.object({
+  AccessLevel: zPortainerResourceAccessLevel.optional(),
+  UserId: z.int().optional(),
+});
+
+export const zPortainerResourceControl = z.object({
+  AccessLevel: zPortainerResourceAccessLevel.optional(),
+  AdministratorsOnly: z.boolean().optional(),
+  Id: z.int().optional(),
+  OwnerId: z.int().optional(),
+  Public: z.boolean().optional(),
+  ResourceId: z.string().optional(),
+  SubResourceIds: z.array(z.string()).optional(),
+  System: z.boolean().optional(),
+  TeamAccesses: z.array(zPortainerTeamResourceAccess).optional(),
+  Type: zPortainerResourceControlType.optional(),
+  UserAccesses: z.array(zPortainerUserResourceAccess).optional(),
+});
+
+export const zPortainerCustomTemplate = z.object({
+  CreatedByUserId: z.int().optional(),
+  Description: z.string().optional(),
+  EdgeTemplate: z.boolean().optional(),
+  EntryPoint: z.string().optional(),
+  GitConfig: zGittypesRepoConfig.optional(),
+  Id: z.int().optional(),
+  IsComposeFormat: z.boolean().optional(),
+  Logo: z.string().optional(),
+  Note: z.string().optional(),
+  Platform: z.union([z.literal(1), z.literal(2)]).optional(),
+  ProjectPath: z.string().optional(),
+  ResourceControl: zPortainerResourceControl.optional(),
+  Title: z.string().optional(),
+  Type: z.union([z.literal(1), z.literal(2), z.literal(3)]).optional(),
+  Variables: z.array(zPortainerCustomTemplateVariableDefinition).optional(),
+  artifact: zPortainerArtifact.optional(),
+});
+
+export const zPortainerStack = z.object({
+  AdditionalFiles: z.array(z.string()).optional(),
+  AutoUpdate: zPortainerAutoUpdateSettings.optional(),
+  CreatedBy: z.string().optional(),
+  CreationDate: z.int().optional(),
+  CurrentDeploymentInfo: zPortainerStackDeploymentInfo.optional(),
+  DeploymentStartStatus: zPortainerStackStatus.optional(),
+  DeploymentStatus: z.array(zPortainerStackDeploymentStatus).optional(),
+  EndpointId: z.int().optional(),
+  EntryPoint: z.string().optional(),
+  Env: z.array(zPortainerPair).optional(),
+  FromAppTemplate: z.boolean().optional(),
+  GitConfig: zGittypesRepoConfig.optional(),
+  Id: z.int().optional(),
+  Name: z.string().optional(),
+  Namespace: z.string().optional(),
+  Option: zPortainerStackOption.optional(),
+  ProjectPath: z.string().optional(),
+  ResourceControl: zPortainerResourceControl.optional(),
+  Status: zPortainerStackStatus.optional(),
+  SwarmId: z.string().optional(),
+  Type: zPortainerStackType.optional(),
+  UpdateDate: z.int().optional(),
+  UpdatedBy: z.string().optional(),
+  WorkflowID: z.int().optional(),
+});
+
+export const zPortainerUserRole = z.union([
+  z.literal(0),
+  z.literal(1),
+  z.literal(2),
+]);
+
+export const zPortainerUserThemeSettings = z.object({
+  color: z.enum(['dark', 'light', 'highcontrast', 'auto', '']).optional(),
+});
+
+export const zPortainerUser = z.object({
+  Id: z.int(),
+  Role: zPortainerUserRole,
+  ThemeSettings: zPortainerUserThemeSettings.optional(),
+  TokenIssueAt: z.int().optional(),
+  UseCache: z.boolean().optional(),
+  Username: z.string(),
+});
+
+export const zPortainerWebhookType = z.union([z.literal(0), z.literal(1)]);
+
+export const zPortainerWebhook = z.object({
+  EndpointId: z.int().optional(),
+  Id: z.int().optional(),
+  RegistryId: z.int().optional(),
+  ResourceId: z.string().optional(),
+  Token: z.string().optional(),
+  Type: zPortainerWebhookType.optional(),
+});
+
+export const zRegistriesRegistryConfigurePayload = z.object({
+  Authentication: z.boolean(),
+  Password: z.string().optional(),
+  Region: z.string().optional(),
+  TLS: z.boolean().optional(),
+  TLSCACertFile: z
+    .array(
+      z
+        .int()
+        .min(-2147483648, {
+          error: 'Invalid value: Expected int32 to be >= -2147483648',
+        })
+        .max(2147483647, {
+          error: 'Invalid value: Expected int32 to be <= 2147483647',
+        })
+    )
+    .optional(),
+  TLSCertFile: z
+    .array(
+      z
+        .int()
+        .min(-2147483648, {
+          error: 'Invalid value: Expected int32 to be >= -2147483648',
+        })
+        .max(2147483647, {
+          error: 'Invalid value: Expected int32 to be <= 2147483647',
+        })
+    )
+    .optional(),
+  TLSKeyFile: z
+    .array(
+      z
+        .int()
+        .min(-2147483648, {
+          error: 'Invalid value: Expected int32 to be >= -2147483648',
+        })
+        .max(2147483647, {
+          error: 'Invalid value: Expected int32 to be <= 2147483647',
+        })
+    )
+    .optional(),
+  TLSSkipVerify: z.boolean().optional(),
+  Username: z.string().optional(),
+});
+
+export const zRegistriesRegistryCreatePayload = z.object({
+  Authentication: z.boolean(),
+  BaseURL: z.string().optional(),
+  Ecr: zPortainerEcrData.optional(),
+  Gitlab: zPortainerGitlabRegistryData.optional(),
+  Name: z.string(),
+  Password: z.string().optional(),
+  Quay: zPortainerQuayRegistryData.optional(),
+  TLS: z.boolean().optional(),
+  Type: z.union([
+    z.literal(1),
+    z.literal(2),
+    z.literal(3),
+    z.literal(4),
+    z.literal(5),
+    z.literal(6),
+    z.literal(7),
+  ]),
+  URL: z.string(),
+  Username: z.string().optional(),
+});
+
+export const zRegistriesRegistryPingPayload = z.object({
+  Password: z.string().optional(),
+  TLS: z.boolean().optional(),
+  Type: z.union([
+    z.literal(1),
+    z.literal(2),
+    z.literal(3),
+    z.literal(4),
+    z.literal(5),
+    z.literal(6),
+    z.literal(7),
+    z.literal(8),
+  ]),
+  URL: z.string(),
+  Username: z.string().optional(),
+});
+
+export const zRegistriesRegistryPingResponse = z.object({
+  message: z.string().optional(),
+  success: z.boolean().optional(),
+});
+
+export const zRegistriesRegistryUpdatePayload = z.object({
+  Authentication: z.boolean(),
+  BaseURL: z.string().optional(),
+  Ecr: zPortainerEcrData.optional(),
+  Name: z.string(),
+  Password: z.string().optional(),
+  Quay: zPortainerQuayRegistryData.optional(),
+  RegistryAccesses: zPortainerRegistryAccesses.optional(),
+  URL: z.string(),
+  Username: z.string().optional(),
+});
+
+export const zReleaseChartReference = z.object({
+  chartPath: z.string().optional(),
+  registryID: z.int().optional(),
+  repoURL: z.string().optional(),
+});
+
+export const zReleaseDependency = z.object({
+  alias: z.string().optional(),
+  condition: z.string().optional(),
+  enabled: z.boolean().optional(),
+  'import-values': z.array(z.unknown()).optional(),
+  name: z.string().optional(),
+  repository: z.string().optional(),
+  tags: z.array(z.string()).optional(),
+  version: z.string().optional(),
+});
+
+export const zReleaseFile = z.object({
+  data: z.array(z.int()).optional(),
+  name: z.string().optional(),
+});
+
+export const zReleaseHookExecution = z.object({
+  completed_at: z.string().optional(),
+  phase: z.string().optional(),
+  started_at: z.string().optional(),
+});
+
+export const zGithubComPortainerPortainerPkgLibhelmReleaseHook = z.object({
+  delete_policies: z.array(z.string()).optional(),
+  events: z.array(z.string()).optional(),
+  kind: z.string().optional(),
+  last_run: zReleaseHookExecution.optional(),
+  manifest: z.string().optional(),
+  name: z.string().optional(),
+  path: z.string().optional(),
+  weight: z.int().optional(),
+});
+
+export const zReleaseLock = z.object({
+  dependencies: z.array(zReleaseDependency).optional(),
+  digest: z.string().optional(),
+  generated: z.string().optional(),
+});
+
+export const zReleaseMaintainer = z.object({
+  email: z.string().optional(),
+  name: z.string().optional(),
+  url: z.string().optional(),
+});
+
+export const zReleaseMetadata = z.object({
+  annotations: z.record(z.string(), z.string()).optional(),
+  apiVersion: z.string().optional(),
+  appVersion: z.string().optional(),
+  condition: z.string().optional(),
+  dependencies: z.array(zReleaseDependency).optional(),
+  deprecated: z.boolean().optional(),
+  description: z.string().optional(),
+  home: z.string().optional(),
+  icon: z.string().optional(),
+  keywords: z.array(z.string()).optional(),
+  kubeVersion: z.string().optional(),
+  maintainers: z.array(zReleaseMaintainer).optional(),
+  name: z.string().optional(),
+  sources: z.array(z.string()).optional(),
+  tags: z.string().optional(),
+  type: z.string().optional(),
+  version: z.string().optional(),
+});
+
+export const zReleaseChart = z.object({
+  files: z.array(zReleaseFile).optional(),
+  lock: zReleaseLock.optional(),
+  metadata: zReleaseMetadata.optional(),
+  schema: z.array(z.int()).optional(),
+  templates: z.array(zReleaseFile).optional(),
+  values: z.record(z.string(), z.unknown()).optional(),
+});
+
+export const zReleaseReleaseElement = z.object({
+  appVersion: z.string().optional(),
+  chart: z.string().optional(),
+  name: z.string().optional(),
+  namespace: z.string().optional(),
+  revision: z.string().optional(),
+  status: z.string().optional(),
+  updated: z.string().optional(),
+});
+
+export const zReleaseValues = z.object({
+  computedValues: z.string().optional(),
+  userSuppliedValues: z.string().optional(),
+});
+
+export const zResourceQuantity = z.object({
+  Format: z.enum(['DecimalExponent', 'BinarySI', 'DecimalSI']).optional(),
+});
+
+export const zResourcecontrolsResourceControlCreatePayload = z.object({
+  AdministratorsOnly: z.boolean().optional(),
+  Public: z.boolean().optional(),
+  ResourceID: z.string(),
+  SubResourceIDs: z.array(z.string()).optional(),
+  Teams: z.array(z.int()).optional(),
+  Type: z.union([
+    z.literal(1),
+    z.literal(2),
+    z.literal(3),
+    z.literal(4),
+    z.literal(5),
+    z.literal(6),
+    z.literal(7),
+    z.literal(8),
+    z.literal(9),
+  ]),
+  Users: z.array(z.int()).optional(),
+});
+
+export const zResourcecontrolsResourceControlUpdatePayload = z.object({
+  AdministratorsOnly: z.boolean().optional(),
+  Public: z.boolean().optional(),
+  Teams: z.array(z.int()).optional(),
+  Users: z.array(z.int()).optional(),
+});
+
+export const zRoarRoarPortainerEndpointId = z.record(z.string(), z.unknown());
+
+export const zPortainerEdgeGroup = z.object({
+  Dynamic: z.boolean().optional(),
+  EndpointIds: zRoarRoarPortainerEndpointId.optional(),
+  Endpoints: z.array(z.int()).optional(),
+  Id: z.int().optional(),
+  Name: z.string().optional(),
+  PartialMatch: z.boolean().optional(),
+  TagIds: z.array(z.int()).optional(),
+});
+
+export const zSettingsPublicSettingsResponse = z.object({
+  AuthenticationMethod: zPortainerAuthenticationMethod.optional(),
+  Edge: z
+    .object({
+      CheckinInterval: z.int().optional(),
+      CommandInterval: z.int().optional(),
+      PingInterval: z.int().optional(),
+      SnapshotInterval: z.int().optional(),
+    })
+    .optional(),
+  EnableEdgeComputeFeatures: z.boolean().optional(),
+  Features: z.record(z.string(), z.boolean()).optional(),
+  GlobalDeploymentOptions: zPortainerGlobalDeploymentOptions.optional(),
+  IsDockerDesktopExtension: z.boolean().optional(),
+  KubeconfigExpiry: z.string().optional().default('0'),
+  LogoURL: z.string().optional(),
+  OAuthLoginURI: z.string().optional(),
+  OAuthLogoutURI: z.string().optional(),
+  RequiredPasswordLength: z.int().optional(),
+  RequiresSetupToken: z.boolean().optional(),
+  TeamSync: z.boolean().optional(),
+});
+
+export const zSettingsSettingsUpdatePayload = z.object({
+  AuthenticationMethod: z.int().optional(),
+  BlackListedLabels: z.array(zPortainerPair).optional(),
+  EdgeAgentCheckinInterval: z.int().optional(),
+  EdgePortainerURL: z.string().optional(),
+  EnableEdgeComputeFeatures: z.boolean().optional(),
+  EnforceEdgeID: z.boolean().optional(),
+  ForceSecureCookies: z.boolean().optional(),
+  GlobalDeploymentOptions: zPortainerGlobalDeploymentOptions.optional(),
+  HelmRepositoryURL: z.string().optional(),
+  InternalAuthSettings: zPortainerInternalAuthSettings.optional(),
+  KubeconfigExpiry: z.string().optional().default('0'),
+  KubectlShellImage: z.string().optional(),
+  LDAPSettings: zPortainerLdapSettings.optional(),
+  LogoURL: z.string().optional(),
+  OAuthSettings: zPortainerOAuthSettings.optional(),
+  SnapshotInterval: z.string().optional(),
+  TemplatesURL: z.string().optional(),
+  TrustOnFirstConnect: z.boolean().optional(),
+  UserSessionTimeout: z.string().optional(),
+});
+
+export const zSourcesAutoUpdateInfo = z.object({
+  fetchInterval: z.string().optional(),
+  mechanism: z.string().optional(),
+});
+
+export const zSourcesConnectionTestResult = z.object({
+  error: z.string().optional(),
+  success: z.boolean().optional(),
+});
+
+export const zSourcesGitAuthenticationPayload = z.object({
+  password: z.string().optional(),
+  username: z.string().optional(),
+});
+
+export const zSourcesGitAuthenticationUpdatePayload = z.object({
+  password: z.string().optional(),
+  username: z.string().optional(),
+});
+
+export const zSourcesGitSourceCreatePayload = z.object({
+  administratorsOnly: z.boolean().optional(),
+  authentication: zSourcesGitAuthenticationPayload.optional(),
+  name: z.string().optional(),
+  public: z.boolean().optional(),
+  teamAccesses: z.array(z.int()).optional(),
+  tlsSkipVerify: z.boolean().optional(),
+  url: z.string(),
+  userAccesses: z.array(z.int()).optional(),
+});
+
+export const zSourcesGitSourceUpdatePayload = z.object({
+  authentication: zSourcesGitAuthenticationUpdatePayload.optional(),
+  name: z.string().optional(),
+  tlsSkipVerify: z.boolean().optional(),
+  url: z.string().optional(),
+});
+
+export const zSourcesSourceAccess = z.object({
+  public: z.boolean().optional(),
+  teams: z.array(z.int()).optional(),
+  users: z.array(z.int()).optional(),
+});
+
+export const zSourcesSourceAccessUpdatePayload = z.object({
+  public: z.boolean().optional(),
+  teams: z.array(z.int()).optional(),
+  users: z.array(z.int()).optional(),
+});
+
+export const zSourcesSourceType = z.enum(['git', 'helm', 'oci']);
+
+export const zSourcesStatus = z.enum(['unknown', 'healthy', 'error']);
+
+export const zSourcesGitAuthInfo = z.object({
+  username: z.string().optional(),
+});
+
+export const zSourcesConnectionInfo = z.object({
+  authentication: zSourcesGitAuthInfo.optional(),
+  tlsSkipVerify: z.boolean().optional(),
+});
+
+export const zSslSslUpdatePayload = z.object({
+  Cert: z.string().optional(),
+  HTTPEnabled: z.boolean().optional(),
+  Key: z.string().optional(),
+});
+
+export const zStacksComposeStackFromFileContentPayload = z.object({
+  Env: z.array(zPortainerPair).optional(),
+  FromAppTemplate: z.boolean().optional(),
+  Name: z.string(),
+  StackFileContent: z.string(),
+});
+
+export const zStacksComposeStackFromGitRepositoryPayload = z.object({
+  AdditionalFiles: z.array(z.string()).optional(),
+  AutoUpdate: zPortainerAutoUpdateSettings.optional(),
+  ComposeFile: z.string().optional().default('docker-compose.yml'),
+  Env: z.array(zPortainerPair).optional(),
+  FromAppTemplate: z.boolean().optional(),
+  Name: z.string(),
+  RepositoryAuthentication: z.boolean().optional(),
+  RepositoryPassword: z.string().optional(),
+  RepositoryReferenceName: z.string().optional(),
+  RepositoryURL: z.string().optional(),
+  RepositoryUsername: z.string().optional(),
+  SourceID: z.int().optional(),
+  TLSSkipVerify: z.boolean().optional(),
+});
+
+export const zStacksKubernetesGitDeploymentPayload = z.object({
+  AdditionalFiles: z.array(z.string()).optional(),
+  AutoUpdate: zPortainerAutoUpdateSettings.optional(),
+  ComposeFormat: z.boolean().optional(),
+  ManifestFile: z.string().optional(),
+  Namespace: z.string().optional(),
+  RepositoryAuthentication: z.boolean().optional(),
+  RepositoryPassword: z.string().optional(),
+  RepositoryReferenceName: z.string().optional(),
+  RepositoryURL: z.string().optional(),
+  RepositoryUsername: z.string().optional(),
+  SourceID: z.int().optional(),
+  StackName: z.string().optional(),
+  TLSSkipVerify: z.boolean().optional(),
+});
+
+export const zStacksKubernetesManifestUrlDeploymentPayload = z.object({
+  ComposeFormat: z.boolean().optional(),
+  ManifestURL: z.string().optional(),
+  Namespace: z.string().optional(),
+  StackName: z.string().optional(),
+});
+
+export const zStacksKubernetesStringDeploymentPayload = z.object({
+  ComposeFormat: z.boolean().optional(),
+  FromAppTemplate: z.boolean().optional(),
+  Namespace: z.string().optional(),
+  StackFileContent: z.string().optional(),
+  StackName: z.string().optional(),
+});
+
+export const zStacksStackFileResponse = z.object({
+  StackFileContent: z.string().optional(),
+});
+
+export const zStacksStackGitRedeployPayload = z.object({
+  Env: z.array(zPortainerPair).optional(),
+  Prune: z.boolean().optional(),
+  PullImage: z.boolean().optional(),
+  RepositoryAuthentication: z.boolean().optional(),
+  RepositoryPassword: z.string().optional(),
+  RepositoryReferenceName: z.string().optional(),
+  RepositoryUsername: z.string().optional(),
+  RepullImageAndRedeploy: z.boolean().optional(),
+  StackName: z.string().optional(),
+});
+
+export const zStacksStackGitUpdatePayload = z.object({
+  AdditionalFiles: z.array(z.string()).optional(),
+  AutoUpdate: zPortainerAutoUpdateSettings.optional(),
+  ConfigFilePath: z.string().optional(),
+  Env: z.array(zPortainerPair).optional(),
+  Prune: z.boolean().optional(),
+  RepositoryAuthentication: z.boolean().optional(),
+  RepositoryPassword: z.string().optional(),
+  RepositoryReferenceName: z.string().optional(),
+  RepositoryURL: z.string().optional(),
+  RepositoryUsername: z.string().optional(),
+  SourceID: z.int().optional(),
+  TLSSkipVerify: z.boolean().optional(),
+});
+
+export const zStacksStackMigratePayload = z.object({
+  EndpointID: z.int(),
+  Name: z.string().optional(),
+  SwarmID: z.string().optional(),
+});
+
+export const zStacksStackResponse = z.object({
+  AdditionalFiles: z.array(z.string()).optional(),
+  AutoUpdate: zPortainerAutoUpdateSettings.optional(),
+  CreatedBy: z.string().optional(),
+  CreationDate: z.int().optional(),
+  CurrentDeploymentInfo: zPortainerStackDeploymentInfo.optional(),
+  DeploymentStartStatus: zPortainerStackStatus.optional(),
+  DeploymentStatus: z.array(zPortainerStackDeploymentStatus).optional(),
+  EndpointId: z.int().optional(),
+  EntryPoint: z.string().optional(),
+  Env: z.array(zPortainerPair).optional(),
+  FromAppTemplate: z.boolean().optional(),
+  GitConfig: zGittypesRepoConfig.optional(),
+  GitSourceId: z.int().optional(),
+  Id: z.int().optional(),
+  Name: z.string().optional(),
+  Namespace: z.string().optional(),
+  Option: zPortainerStackOption.optional(),
+  ProjectPath: z.string().optional(),
+  ResourceControl: zPortainerResourceControl.optional(),
+  Status: zPortainerStackStatus.optional(),
+  SwarmId: z.string().optional(),
+  Type: zPortainerStackType.optional(),
+  UpdateDate: z.int().optional(),
+  UpdatedBy: z.string().optional(),
+  WorkflowID: z.int().optional(),
+});
+
+export const zStacksSwarmStackFromFileContentPayload = z.object({
+  Env: z.array(zPortainerPair).optional(),
+  FromAppTemplate: z.boolean().optional(),
+  Name: z.string(),
+  StackFileContent: z.string(),
+  SwarmID: z.string(),
+});
+
+export const zStacksSwarmStackFromGitRepositoryPayload = z.object({
+  AdditionalFiles: z.array(z.string()).optional(),
+  AutoUpdate: zPortainerAutoUpdateSettings.optional(),
+  ComposeFile: z.string().optional().default('docker-compose.yml'),
+  Env: z.array(zPortainerPair).optional(),
+  FromAppTemplate: z.boolean().optional(),
+  Name: z.string(),
+  RepositoryAuthentication: z.boolean().optional(),
+  RepositoryPassword: z.string().optional(),
+  RepositoryReferenceName: z.string().optional(),
+  RepositoryURL: z.string().optional(),
+  RepositoryUsername: z.string().optional(),
+  SourceID: z.int().optional(),
+  SwarmID: z.string(),
+  TLSSkipVerify: z.boolean().optional(),
+});
+
+export const zStacksUpdateSwarmStackPayload = z.object({
+  Env: z.array(zPortainerPair).optional(),
+  Prune: z.boolean().optional(),
+  PullImage: z.boolean().optional(),
+  RepullImageAndRedeploy: z.boolean().optional(),
+  StackFileContent: z.string().optional(),
+});
+
+export const zStatsContainerStats = z.object({
+  healthy: z.int().optional(),
+  running: z.int().optional(),
+  stopped: z.int().optional(),
+  total: z.int().optional(),
+  unhealthy: z.int().optional(),
+});
+
+export const zDockerDashboardResponse = z.object({
+  containers: zStatsContainerStats.optional(),
+  images: zDockerImagesCounters.optional(),
+  networks: z.int().optional(),
+  services: z.int().optional(),
+  stacks: z.int().optional(),
+  volumes: z.int().optional(),
+});
+
+export const zSwarmServiceUpdateResponse = z.object({
+  Warnings: z.array(z.string()).optional(),
+});
+
+export const zSystemNodesCountResponse = z.object({
+  nodes: z.int().optional(),
+});
+
+export const zSystemStatus = z.object({
+  InstanceID: z.string().optional(),
+  Version: z.string().optional(),
+});
+
+export const zSystemSystemInfoResponse = z.object({
+  agents: z.int().optional(),
+  edgeAgents: z.int().optional(),
+  platform: zPlatformContainerPlatform.optional(),
+});
+
+export const zSystemVersionResponse = z.object({
+  Build: zBuildBuildInfo.optional(),
+  DatabaseVersion: z.string().optional(),
+  Dependencies: zBuildDependenciesInfo.optional(),
+  LatestVersion: z.string().optional(),
+  Runtime: zBuildRuntimeInfo.optional(),
+  ServerEdition: z.string().optional(),
+  ServerVersion: z.string().optional(),
+  UpdateAvailable: z.boolean().optional(),
+  VersionSupport: z.string().optional(),
+});
+
+export const zTagsTagCreatePayload = z.object({
+  Name: z.string(),
+});
+
+export const zTeammembershipsTeamMembershipCreatePayload = z.object({
+  Role: z.union([z.literal(1), z.literal(2)]),
+  TeamID: z.int(),
+  UserID: z.int(),
+});
+
+export const zTeammembershipsTeamMembershipUpdatePayload = z.object({
+  Role: z.union([z.literal(1), z.literal(2)]),
+  TeamID: z.int(),
+  UserID: z.int(),
+});
+
+export const zTeamsTeamCreatePayload = z.object({
+  Name: z.string(),
+  TeamLeaders: z.array(z.int()).optional(),
+});
+
+export const zTeamsTeamUpdatePayload = z.object({
+  Name: z.string().optional(),
+});
+
+export const zTemplatesFileResponse = z.object({
+  FileContent: z.string().optional(),
+});
+
+export const zTemplatesListResponse = z.object({
+  templates: z.array(zPortainerTemplate).optional(),
+  version: z.string().optional(),
+});
+
+export const zUnstructuredUnstructured = z.object({
+  Object: z.record(z.string(), z.unknown()).optional(),
+});
+
+export const zReleaseInfo = z.object({
+  deleted: z.string().optional(),
+  description: z.string().optional(),
+  first_deployed: z.string().optional(),
+  last_deployed: z.string().optional(),
+  notes: z.string().optional(),
+  resources: z.array(zUnstructuredUnstructured).optional(),
+  status: z.string().optional(),
+});
+
+export const zReleaseRelease = z.object({
+  appVersion: z.string().optional(),
+  chart: zReleaseChart.optional(),
+  chartReference: zReleaseChartReference.optional(),
+  config: z.record(z.string(), z.unknown()).optional(),
+  hooks: z.array(zGithubComPortainerPortainerPkgLibhelmReleaseHook).optional(),
+  info: zReleaseInfo.optional(),
+  manifest: z.string().optional(),
+  name: z.string().optional(),
+  namespace: z.string().optional(),
+  stackID: z.int().optional(),
+  values: zReleaseValues.optional(),
+  version: z.int().optional(),
+});
+
+export const zUsersAccessLocation = z.enum(['environment', 'environmentGroup']);
+
+export const zUsersEffectiveAccessEntry = z.object({
+  accessLocation: zUsersAccessLocation.optional(),
+  endpointId: z.int().optional(),
+  endpointName: z.string().optional(),
+  groupId: z.int().optional(),
+  groupName: z.string().optional(),
+  roleId: z.int().optional(),
+  roleName: z.string().optional(),
+  rolePriority: z.int().optional(),
+  teamId: z.int().optional(),
+  teamName: z.string().optional(),
+});
+
+export const zUsersAccessTokenResponse = z.object({
+  apiKey: zPortainerApiKey.optional(),
+  rawAPIKey: z.string().optional(),
+});
+
+export const zUsersAddHelmRepoUrlPayload = z.object({
+  url: z.string().optional(),
+});
+
+export const zUsersAdminInitPayload = z.object({
+  Password: z.string(),
+  Username: z.string(),
+});
+
+export const zUsersHelmUserRepositoryResponse = z.object({
+  GlobalRepository: z.string().optional(),
+  UserRepositories: z.array(zPortainerHelmUserRepository).optional(),
+});
+
+export const zUsersThemePayload = z.object({
+  color: z.enum(['dark', 'light', 'highcontrast', 'auto']).optional(),
+});
+
+export const zUsersUserAccessTokenCreatePayload = z.object({
+  description: z.string(),
+  password: z.string(),
+});
+
+export const zUsersUserCreatePayload = z.object({
+  Password: z.string(),
+  Role: z.union([z.literal(1), z.literal(2)]),
+  Username: z.string(),
+});
+
+export const zUsersUserUpdatePasswordPayload = z.object({
+  NewPassword: z.string(),
+  Password: z.string(),
+});
+
+export const zUsersUserUpdatePayload = z.object({
+  NewPassword: z.string(),
+  Password: z.string(),
+  Role: z.union([z.literal(1), z.literal(2)]),
+  Theme: zUsersThemePayload.optional(),
+  UseCache: z.boolean(),
+  Username: z.string(),
+});
+
+export const zV1AppArmorProfileType = z.enum([
+  'Unconfined',
+  'RuntimeDefault',
+  'Localhost',
+]);
+
+export const zV1AppArmorProfile = z.object({
+  localhostProfile: z.string().optional(),
+  type: zV1AppArmorProfileType.optional(),
+});
+
+export const zV1AttachedVolume = z.object({
+  devicePath: z.string().optional(),
+  name: z.string().optional(),
+});
+
+export const zV1Capabilities = z.object({
+  add: z.array(z.string()).optional(),
+  drop: z.array(z.string()).optional(),
+});
+
+export const zV1ConfigMapEnvSource = z.object({
+  name: z.string().optional(),
+  optional: z.boolean().optional(),
+});
+
+export const zV1ConfigMapKeySelector = z.object({
+  key: z.string().optional(),
+  name: z.string().optional(),
+  optional: z.boolean().optional(),
+});
+
+export const zV1ConfigMapNodeConfigSource = z.object({
+  kubeletConfigKey: z.string().optional(),
+  name: z.string().optional(),
+  namespace: z.string().optional(),
+  resourceVersion: z.string().optional(),
+  uid: z.string().optional(),
+});
+
+export const zV1ContainerImage = z.object({
+  names: z.array(z.string()).optional(),
+  sizeBytes: z.int().optional(),
+});
+
+export const zV1ContainerRestartPolicy = z.enum([
+  'Always',
+  'Never',
+  'OnFailure',
+]);
+
+export const zV1ContainerRestartRuleAction = z.enum([
+  'Restart',
+  'RestartAllContainers',
+]);
+
+export const zV1ContainerRestartRuleOnExitCodesOperator = z.enum([
+  'In',
+  'NotIn',
+]);
+
+export const zV1ContainerRestartRuleOnExitCodes = z.object({
+  operator: zV1ContainerRestartRuleOnExitCodesOperator.optional(),
+  values: z.array(z.int()).optional(),
+});
+
+export const zV1ContainerRestartRule = z.object({
+  action: zV1ContainerRestartRuleAction.optional(),
+  exitCodes: zV1ContainerRestartRuleOnExitCodes.optional(),
+});
+
+export const zV1DaemonEndpoint = z.object({
+  Port: z.int().optional(),
+});
+
+export const zV1ExecAction = z.object({
+  command: z.array(z.string()).optional(),
+});
+
+export const zV1FieldsV1 = z.record(z.string(), z.unknown());
+
+export const zV1FileKeySelector = z.object({
+  key: z.string().optional(),
+  optional: z.boolean().optional(),
+  path: z.string().optional(),
+  volumeName: z.string().optional(),
+});
+
+export const zV1GrpcAction = z.object({
+  port: z.int().optional(),
+  service: z.string().optional(),
+});
+
+export const zV1ListMeta = z.object({
+  continue: z.string().optional(),
+  remainingItemCount: z.int().optional(),
+  resourceVersion: z.string().optional(),
+  selfLink: z.string().optional(),
+});
+
+export const zV1ManagedFieldsOperationType = z.enum(['Apply', 'Update']);
+
+export const zV1ManagedFieldsEntry = z.object({
+  apiVersion: z.string().optional(),
+  fieldsType: z.string().optional(),
+  fieldsV1: zV1FieldsV1.optional(),
+  manager: z.string().optional(),
+  operation: zV1ManagedFieldsOperationType.optional(),
+  subresource: z.string().optional(),
+  time: z.string().optional(),
+});
+
+export const zV1MountPropagationMode = z.enum([
+  'None',
+  'HostToContainer',
+  'Bidirectional',
+]);
+
+export const zV1NamespaceConditionType = z.enum([
+  'NamespaceDeletionDiscoveryFailure',
+  'NamespaceDeletionContentFailure',
+  'NamespaceDeletionGroupVersionParsingFailure',
+  'NamespaceContentRemaining',
+  'NamespaceFinalizersRemaining',
+]);
+
+export const zV1NamespaceCondition = z.object({
+  lastTransitionTime: z.string().optional(),
+  message: z.string().optional(),
+  reason: z.string().optional(),
+  status: zK8sIoApiCoreV1ConditionStatus.optional(),
+  type: zV1NamespaceConditionType.optional(),
+});
+
+export const zV1NamespacePhase = z.enum(['Active', 'Terminating']);
+
+export const zV1NamespaceStatus = z.object({
+  conditions: z.array(zV1NamespaceCondition).optional(),
+  phase: zV1NamespacePhase.optional(),
+});
+
+export const zV1NodeAddressType = z.enum([
+  'Hostname',
+  'InternalIP',
+  'ExternalIP',
+  'InternalDNS',
+  'ExternalDNS',
+]);
+
+export const zV1NodeAddress = z.object({
+  address: z.string().optional(),
+  type: zV1NodeAddressType.optional(),
+});
+
+export const zV1NodeConditionType = z.enum([
+  'Ready',
+  'MemoryPressure',
+  'DiskPressure',
+  'PIDPressure',
+  'NetworkUnavailable',
+]);
+
+export const zV1NodeCondition = z.object({
+  lastHeartbeatTime: z.string().optional(),
+  lastTransitionTime: z.string().optional(),
+  message: z.string().optional(),
+  reason: z.string().optional(),
+  status: zK8sIoApiCoreV1ConditionStatus.optional(),
+  type: zV1NodeConditionType.optional(),
+});
+
+export const zV1NodeConfigSource = z.object({
+  configMap: zV1ConfigMapNodeConfigSource.optional(),
+});
+
+export const zV1NodeConfigStatus = z.object({
+  active: zV1NodeConfigSource.optional(),
+  assigned: zV1NodeConfigSource.optional(),
+  error: z.string().optional(),
+  lastKnownGood: zV1NodeConfigSource.optional(),
+});
+
+export const zV1NodeDaemonEndpoints = z.object({
+  kubeletEndpoint: zV1DaemonEndpoint.optional(),
+});
+
+export const zV1NodeFeatures = z.object({
+  supplementalGroupsPolicy: z.boolean().optional(),
+});
+
+export const zV1NodePhase = z.enum(['Pending', 'Running', 'Terminated']);
+
+export const zV1NodeRuntimeHandlerFeatures = z.object({
+  recursiveReadOnlyMounts: z.boolean().optional(),
+  userNamespaces: z.boolean().optional(),
+});
+
+export const zV1NodeRuntimeHandler = z.object({
+  features: zV1NodeRuntimeHandlerFeatures.optional(),
+  name: z.string().optional(),
+});
+
+export const zV1NodeSwapStatus = z.object({
+  capacity: z.int().optional(),
+});
+
+export const zV1NodeSystemInfo = z.object({
+  architecture: z.string().optional(),
+  bootID: z.string().optional(),
+  containerRuntimeVersion: z.string().optional(),
+  kernelVersion: z.string().optional(),
+  kubeProxyVersion: z.string().optional(),
+  kubeletVersion: z.string().optional(),
+  machineID: z.string().optional(),
+  operatingSystem: z.string().optional(),
+  osImage: z.string().optional(),
+  swap: zV1NodeSwapStatus.optional(),
+  systemUUID: z.string().optional(),
+});
+
+export const zV1ObjectFieldSelector = z.object({
+  apiVersion: z.string().optional(),
+  fieldPath: z.string().optional(),
+});
+
+export const zV1OwnerReference = z.object({
+  apiVersion: z.string().optional(),
+  blockOwnerDeletion: z.boolean().optional(),
+  controller: z.boolean().optional(),
+  kind: z.string().optional(),
+  name: z.string().optional(),
+  uid: z.string().optional(),
+});
+
+export const zV1ObjectMeta = z.object({
+  annotations: z.record(z.string(), z.string()).optional(),
+  creationTimestamp: z.string().optional(),
+  deletionGracePeriodSeconds: z.int().optional(),
+  deletionTimestamp: z.string().optional(),
+  finalizers: z.array(z.string()).optional(),
+  generateName: z.string().optional(),
+  generation: z.int().optional(),
+  labels: z.record(z.string(), z.string()).optional(),
+  managedFields: z.array(zV1ManagedFieldsEntry).optional(),
+  name: z.string().optional(),
+  namespace: z.string().optional(),
+  ownerReferences: z.array(zV1OwnerReference).optional(),
+  resourceVersion: z.string().optional(),
+  selfLink: z.string().optional(),
+  uid: z.string().optional(),
+});
+
+export const zV1PersistentVolumeAccessMode = z.enum([
+  'ReadWriteOnce',
+  'ReadOnlyMany',
+  'ReadWriteMany',
+  'ReadWriteOncePod',
+]);
+
+export const zV1PersistentVolumeClaimPhase = z.enum([
+  'Pending',
+  'Bound',
+  'Lost',
+]);
+
+export const zV1PersistentVolumeMode = z.enum(['Block', 'Filesystem']);
+
+export const zV1PersistentVolumePhase = z.enum([
+  'Pending',
+  'Available',
+  'Bound',
+  'Released',
+  'Failed',
+]);
+
+export const zV1PersistentVolumeReclaimPolicy = z.enum([
+  'Recycle',
+  'Delete',
+  'Retain',
+]);
+
+export const zKubernetesK8sPvReclaimPolicyRequest = z.object({
+  name: z.string().optional(),
+  reclaimPolicy: zV1PersistentVolumeReclaimPolicy.optional(),
+});
+
+export const zKubernetesK8sStorageClass = z.object({
+  allowVolumeExpansion: z.boolean().optional(),
+  annotations: z.record(z.string(), z.string()).optional(),
+  creationDate: z.string().optional(),
+  isDefault: z.boolean().optional(),
+  labels: z.record(z.string(), z.string()).optional(),
+  mountOptions: z.array(z.string()).optional(),
+  name: z.string().optional(),
+  parameters: z.record(z.string(), z.string()).optional(),
+  provisioner: z.string().optional(),
+  reclaimPolicy: zV1PersistentVolumeReclaimPolicy.optional(),
+});
+
+export const zV1ProcMountType = z.enum(['Default', 'Unmasked']);
+
+export const zV1Protocol = z.enum(['TCP', 'UDP', 'SCTP']);
+
+export const zV1ContainerPort = z.object({
+  containerPort: z.int().optional(),
+  hostIP: z.string().optional(),
+  hostPort: z.int().optional(),
+  name: z.string().optional(),
+  protocol: zV1Protocol.optional(),
+});
+
+export const zV1PullPolicy = z.enum(['Always', 'Never', 'IfNotPresent']);
+
+export const zV1RecursiveReadOnlyMode = z.enum([
+  'Disabled',
+  'IfPossible',
+  'Enabled',
+]);
+
+export const zV1ResourceFieldSelector = z.object({
+  containerName: z.string().optional(),
+  divisor: zResourceQuantity.optional(),
+  resource: z.string().optional(),
+});
+
+export const zV1ResourceList = z.record(z.string(), zResourceQuantity);
+
+export const zKubernetesK8sPersistentVolumeClaim = z.object({
+  accessModes: z.array(z.string()).optional(),
+  allowVolumeExpansion: z.boolean().optional(),
+  creationDate: z.string().optional(),
+  humanReadableAccessModes: z.array(zV1PersistentVolumeAccessMode).optional(),
+  id: z.string().optional(),
+  labels: z.record(z.string(), z.string()).optional(),
+  name: z.string().optional(),
+  namespace: z.string().optional(),
+  owningApplications: z.array(zKubernetesK8sApplication).optional(),
+  phase: zV1PersistentVolumeClaimPhase.optional(),
+  resourcesRequests: zV1ResourceList.optional(),
+  storage: z.int().optional(),
+  storageClass: z.string().optional(),
+  storageRequest: z.string().optional(),
+  volumeMode: zV1PersistentVolumeMode.optional(),
+  volumeName: z.string().optional(),
+});
+
+export const zV1NodeStatus = z.object({
+  addresses: z.array(zV1NodeAddress).optional(),
+  allocatable: zV1ResourceList.optional(),
+  capacity: zV1ResourceList.optional(),
+  conditions: z.array(zV1NodeCondition).optional(),
+  config: zV1NodeConfigStatus.optional(),
+  daemonEndpoints: zV1NodeDaemonEndpoints.optional(),
+  declaredFeatures: z.array(z.string()).optional(),
+  features: zV1NodeFeatures.optional(),
+  images: z.array(zV1ContainerImage).optional(),
+  nodeInfo: zV1NodeSystemInfo.optional(),
+  phase: zV1NodePhase.optional(),
+  runtimeHandlers: z.array(zV1NodeRuntimeHandler).optional(),
+  volumesAttached: z.array(zV1AttachedVolume).optional(),
+  volumesInUse: z.array(z.string()).optional(),
+});
+
+export const zV1ResourceName = z.enum([
+  'cpu',
+  'memory',
+  'storage',
+  'ephemeral-storage',
+  'pods',
+  'services',
+  'replicationcontrollers',
+  'resourcequotas',
+  'secrets',
+  'configmaps',
+  'persistentvolumeclaims',
+  'services.nodeports',
+  'services.loadbalancers',
+  'requests.cpu',
+  'requests.memory',
+  'requests.storage',
+  'requests.ephemeral-storage',
+  'limits.cpu',
+  'limits.memory',
+  'limits.ephemeral-storage',
+]);
+
+export const zV1ResourceQuotaScope = z.enum([
+  'Terminating',
+  'NotTerminating',
+  'BestEffort',
+  'NotBestEffort',
+  'PriorityClass',
+  'CrossNamespacePodAffinity',
+  'VolumeAttributesClass',
+]);
+
+export const zV1ResourceQuotaStatus = z.object({
+  hard: zV1ResourceList.optional(),
+  used: zV1ResourceList.optional(),
+});
+
+export const zV1ResourceRequirements = z.object({
+  claims: z.array(zK8sIoApiCoreV1ResourceClaim).optional(),
+  limits: zV1ResourceList.optional(),
+  requests: zV1ResourceList.optional(),
+});
+
+export const zV1ResourceResizeRestartPolicy = z.enum([
+  'NotRequired',
+  'RestartContainer',
+]);
+
+export const zV1ContainerResizePolicy = z.object({
+  resourceName: zV1ResourceName.optional(),
+  restartPolicy: zV1ResourceResizeRestartPolicy.optional(),
+});
+
+export const zV1RoleRef = z.object({
+  apiGroup: z.string().optional(),
+  kind: z.string().optional(),
+  name: z.string().optional(),
+});
+
+export const zKubernetesK8sClusterRoleBinding = z.object({
+  creationDate: z.string().optional(),
+  isSystem: z.boolean().optional(),
+  name: z.string().optional(),
+  namespace: z.string().optional(),
+  roleRef: zV1RoleRef.optional(),
+  subjects: z.array(zK8sIoApiRbacV1Subject).optional(),
+  uid: z.string().optional(),
+});
+
+export const zKubernetesK8sRoleBinding = z.object({
+  creationDate: z.string().optional(),
+  isSystem: z.boolean().optional(),
+  name: z.string().optional(),
+  namespace: z.string().optional(),
+  roleRef: zV1RoleRef.optional(),
+  subjects: z.array(zK8sIoApiRbacV1Subject).optional(),
+  uid: z.string().optional(),
+});
+
+export const zV1SeLinuxOptions = z.object({
+  level: z.string().optional(),
+  role: z.string().optional(),
+  type: z.string().optional(),
+  user: z.string().optional(),
+});
+
+export const zV1ScopeSelectorOperator = z.enum([
+  'In',
+  'NotIn',
+  'Exists',
+  'DoesNotExist',
+]);
+
+export const zV1ScopedResourceSelectorRequirement = z.object({
+  operator: zV1ScopeSelectorOperator.optional(),
+  scopeName: zV1ResourceQuotaScope.optional(),
+  values: z.array(z.string()).optional(),
+});
+
+export const zV1ScopeSelector = z.object({
+  matchExpressions: z.array(zV1ScopedResourceSelectorRequirement).optional(),
+});
+
+export const zV1ResourceQuotaSpec = z.object({
+  hard: zV1ResourceList.optional(),
+  scopeSelector: zV1ScopeSelector.optional(),
+  scopes: z.array(zV1ResourceQuotaScope).optional(),
+});
+
+export const zV1ResourceQuota = z.object({
+  apiVersion: z.string().optional(),
+  kind: z.string().optional(),
+  metadata: zV1ObjectMeta.optional(),
+  spec: zV1ResourceQuotaSpec.optional(),
+  status: zV1ResourceQuotaStatus.optional(),
+});
+
+export const zPortainerK8sNamespaceInfo = z.object({
+  Annotations: z.record(z.string(), z.string()).optional(),
+  CreationDate: z.string().optional(),
+  Id: z.string().optional(),
+  IsDefault: z.boolean().optional(),
+  IsSystem: z.boolean().optional(),
+  Name: z.string().optional(),
+  NamespaceOwner: z.string().optional(),
+  ResourceQuota: zV1ResourceQuota.optional(),
+  Status: zV1NamespaceStatus.optional(),
+  UnhealthyEventCount: z.int().optional(),
+});
+
+export const zV1SeccompProfileType = z.enum([
+  'Unconfined',
+  'RuntimeDefault',
+  'Localhost',
+]);
+
+export const zV1SeccompProfile = z.object({
+  localhostProfile: z.string().optional(),
+  type: zV1SeccompProfileType.optional(),
+});
+
+export const zV1SecretEnvSource = z.object({
+  name: z.string().optional(),
+  optional: z.boolean().optional(),
+});
+
+export const zV1EnvFromSource = z.object({
+  configMapRef: zV1ConfigMapEnvSource.optional(),
+  prefix: z.string().optional(),
+  secretRef: zV1SecretEnvSource.optional(),
+});
+
+export const zV1SecretKeySelector = z.object({
+  key: z.string().optional(),
+  name: z.string().optional(),
+  optional: z.boolean().optional(),
+});
+
+export const zV1EnvVarSource = z.object({
+  configMapKeyRef: zV1ConfigMapKeySelector.optional(),
+  fieldRef: zV1ObjectFieldSelector.optional(),
+  fileKeyRef: zV1FileKeySelector.optional(),
+  resourceFieldRef: zV1ResourceFieldSelector.optional(),
+  secretKeyRef: zV1SecretKeySelector.optional(),
+});
+
+export const zV1EnvVar = z.object({
+  name: z.string().optional(),
+  value: z.string().optional(),
+  valueFrom: zV1EnvVarSource.optional(),
+});
+
+export const zV1SecretReference = z.object({
+  name: z.string().optional(),
+  namespace: z.string().optional(),
+});
+
+export const zV1CsiPersistentVolumeSource = z.object({
+  controllerExpandSecretRef: zV1SecretReference.optional(),
+  controllerPublishSecretRef: zV1SecretReference.optional(),
+  driver: z.string().optional(),
+  fsType: z.string().optional(),
+  nodeExpandSecretRef: zV1SecretReference.optional(),
+  nodePublishSecretRef: zV1SecretReference.optional(),
+  nodeStageSecretRef: zV1SecretReference.optional(),
+  readOnly: z.boolean().optional(),
+  volumeAttributes: z.record(z.string(), z.string()).optional(),
+  volumeHandle: z.string().optional(),
+});
+
+export const zKubernetesK8sPersistentVolume = z.object({
+  accessModes: z.array(z.string()).optional(),
+  annotations: z.record(z.string(), z.string()).optional(),
+  capacity: zV1ResourceList.optional(),
+  claimRef: zK8sIoApiCoreV1ObjectReference.optional(),
+  creationDate: z.string().optional(),
+  csi: zV1CsiPersistentVolumeSource.optional(),
+  humanReadableAccessModes: z.array(zV1PersistentVolumeAccessMode).optional(),
+  labels: z.record(z.string(), z.string()).optional(),
+  name: z.string().optional(),
+  persistentVolumeReclaimPolicy: zV1PersistentVolumeReclaimPolicy.optional(),
+  status: zV1PersistentVolumePhase.optional(),
+  storageClassName: z.string().optional(),
+  volumeMode: zV1PersistentVolumeMode.optional(),
+});
+
+export const zKubernetesK8sVolumeInfo = z.object({
+  persistentVolume: zKubernetesK8sPersistentVolume.optional(),
+  persistentVolumeClaim: zKubernetesK8sPersistentVolumeClaim.optional(),
+  storageClass: zKubernetesK8sStorageClass.optional(),
+});
+
+export const zV1Signal = z.enum([
+  'SIGABRT',
+  'SIGALRM',
+  'SIGBUS',
+  'SIGCHLD',
+  'SIGCLD',
+  'SIGCONT',
+  'SIGFPE',
+  'SIGHUP',
+  'SIGILL',
+  'SIGINT',
+  'SIGIO',
+  'SIGIOT',
+  'SIGKILL',
+  'SIGPIPE',
+  'SIGPOLL',
+  'SIGPROF',
+  'SIGPWR',
+  'SIGQUIT',
+  'SIGSEGV',
+  'SIGSTKFLT',
+  'SIGSTOP',
+  'SIGSYS',
+  'SIGTERM',
+  'SIGTRAP',
+  'SIGTSTP',
+  'SIGTTIN',
+  'SIGTTOU',
+  'SIGURG',
+  'SIGUSR1',
+  'SIGUSR2',
+  'SIGVTALRM',
+  'SIGWINCH',
+  'SIGXCPU',
+  'SIGXFSZ',
+  'SIGRTMIN',
+  'SIGRTMIN+1',
+  'SIGRTMIN+2',
+  'SIGRTMIN+3',
+  'SIGRTMIN+4',
+  'SIGRTMIN+5',
+  'SIGRTMIN+6',
+  'SIGRTMIN+7',
+  'SIGRTMIN+8',
+  'SIGRTMIN+9',
+  'SIGRTMIN+10',
+  'SIGRTMIN+11',
+  'SIGRTMIN+12',
+  'SIGRTMIN+13',
+  'SIGRTMIN+14',
+  'SIGRTMIN+15',
+  'SIGRTMAX-14',
+  'SIGRTMAX-13',
+  'SIGRTMAX-12',
+  'SIGRTMAX-11',
+  'SIGRTMAX-10',
+  'SIGRTMAX-9',
+  'SIGRTMAX-8',
+  'SIGRTMAX-7',
+  'SIGRTMAX-6',
+  'SIGRTMAX-5',
+  'SIGRTMAX-4',
+  'SIGRTMAX-3',
+  'SIGRTMAX-2',
+  'SIGRTMAX-1',
+  'SIGRTMAX',
+]);
+
+export const zV1SleepAction = z.object({
+  seconds: z.int().optional(),
+});
+
+export const zV1TcpSocketAction = z.object({
+  host: z.string().optional(),
+  port: zIntstrIntOrString.optional(),
+});
+
+export const zV1TaintEffect = z.enum([
+  'NoSchedule',
+  'PreferNoSchedule',
+  'NoExecute',
+]);
+
+export const zV1Taint = z.object({
+  effect: zV1TaintEffect.optional(),
+  key: z.string().optional(),
+  timeAdded: z.string().optional(),
+  value: z.string().optional(),
+});
+
+export const zV1NodeSpec = z.object({
+  configSource: zV1NodeConfigSource.optional(),
+  externalID: z.string().optional(),
+  podCIDR: z.string().optional(),
+  podCIDRs: z.array(z.string()).optional(),
+  providerID: z.string().optional(),
+  taints: z.array(zV1Taint).optional(),
+  unschedulable: z.boolean().optional(),
+});
+
+export const zKubernetesKubernetesNodeResponse = z.object({
+  apiVersion: z.string().optional(),
+  kind: z.string().optional(),
+  metadata: zV1ObjectMeta.optional(),
+  spec: zV1NodeSpec.optional(),
+  status: zV1NodeStatus.optional(),
+});
+
+export const zV1TerminationMessagePolicy = z.enum([
+  'File',
+  'FallbackToLogsOnError',
+]);
+
+export const zV1UriScheme = z.enum(['HTTP', 'HTTPS']);
+
+export const zV1HttpGetAction = z.object({
+  host: z.string().optional(),
+  httpHeaders: z.array(zK8sIoApiCoreV1HttpHeader).optional(),
+  path: z.string().optional(),
+  port: zIntstrIntOrString.optional(),
+  scheme: zV1UriScheme.optional(),
+});
+
+export const zV1LifecycleHandler = z.object({
+  exec: zV1ExecAction.optional(),
+  httpGet: zV1HttpGetAction.optional(),
+  sleep: zV1SleepAction.optional(),
+  tcpSocket: zV1TcpSocketAction.optional(),
+});
+
+export const zV1Lifecycle = z.object({
+  postStart: zV1LifecycleHandler.optional(),
+  preStop: zV1LifecycleHandler.optional(),
+  stopSignal: zV1Signal.optional(),
+});
+
+export const zV1Probe = z.object({
+  exec: zV1ExecAction.optional(),
+  failureThreshold: z.int().optional(),
+  grpc: zV1GrpcAction.optional(),
+  httpGet: zV1HttpGetAction.optional(),
+  initialDelaySeconds: z.int().optional(),
+  periodSeconds: z.int().optional(),
+  successThreshold: z.int().optional(),
+  tcpSocket: zV1TcpSocketAction.optional(),
+  terminationGracePeriodSeconds: z.int().optional(),
+  timeoutSeconds: z.int().optional(),
+});
+
+export const zV1VolumeDevice = z.object({
+  devicePath: z.string().optional(),
+  name: z.string().optional(),
+});
+
+export const zV1VolumeMount = z.object({
+  mountPath: z.string().optional(),
+  mountPropagation: zV1MountPropagationMode.optional(),
+  name: z.string().optional(),
+  readOnly: z.boolean().optional(),
+  recursiveReadOnly: zV1RecursiveReadOnlyMode.optional(),
+  subPath: z.string().optional(),
+  subPathExpr: z.string().optional(),
+});
+
+export const zV1WindowsSecurityContextOptions = z.object({
+  gmsaCredentialSpec: z.string().optional(),
+  gmsaCredentialSpecName: z.string().optional(),
+  hostProcess: z.boolean().optional(),
+  runAsUserName: z.string().optional(),
+});
+
+export const zV1SecurityContext = z.object({
+  allowPrivilegeEscalation: z.boolean().optional(),
+  appArmorProfile: zV1AppArmorProfile.optional(),
+  capabilities: zV1Capabilities.optional(),
+  privileged: z.boolean().optional(),
+  procMount: zV1ProcMountType.optional(),
+  readOnlyRootFilesystem: z.boolean().optional(),
+  runAsGroup: z.int().optional(),
+  runAsNonRoot: z.boolean().optional(),
+  runAsUser: z.int().optional(),
+  seLinuxOptions: zV1SeLinuxOptions.optional(),
+  seccompProfile: zV1SeccompProfile.optional(),
+  windowsOptions: zV1WindowsSecurityContextOptions.optional(),
+});
+
+export const zV1Container = z.object({
+  args: z.array(z.string()).optional(),
+  command: z.array(z.string()).optional(),
+  env: z.array(zV1EnvVar).optional(),
+  envFrom: z.array(zV1EnvFromSource).optional(),
+  image: z.string().optional(),
+  imagePullPolicy: zV1PullPolicy.optional(),
+  lifecycle: zV1Lifecycle.optional(),
+  livenessProbe: zV1Probe.optional(),
+  name: z.string().optional(),
+  ports: z.array(zV1ContainerPort).optional(),
+  readinessProbe: zV1Probe.optional(),
+  resizePolicy: z.array(zV1ContainerResizePolicy).optional(),
+  resources: zV1ResourceRequirements.optional(),
+  restartPolicy: zV1ContainerRestartPolicy.optional(),
+  restartPolicyRules: z.array(zV1ContainerRestartRule).optional(),
+  securityContext: zV1SecurityContext.optional(),
+  startupProbe: zV1Probe.optional(),
+  stdin: z.boolean().optional(),
+  stdinOnce: z.boolean().optional(),
+  terminationMessagePath: z.string().optional(),
+  terminationMessagePolicy: zV1TerminationMessagePolicy.optional(),
+  tty: z.boolean().optional(),
+  volumeDevices: z.array(zV1VolumeDevice).optional(),
+  volumeMounts: z.array(zV1VolumeMount).optional(),
+  workingDir: z.string().optional(),
+});
+
+export const zKubernetesK8sJob = z.object({
+  BackoffLimit: z.int().optional(),
+  Command: z.string().optional(),
+  Completions: z.int().optional(),
+  Container: zV1Container.optional(),
+  Duration: z.string().optional(),
+  FailedReason: z.string().optional(),
+  FinishTime: z.string().optional(),
+  Id: z.string().optional(),
+  IsSystem: z.boolean().optional(),
+  Name: z.string().optional(),
+  Namespace: z.string().optional(),
+  PodName: z.string().optional(),
+  StartTime: z.string().optional(),
+  Status: z.string().optional(),
+});
+
+export const zKubernetesK8sCronJob = z.object({
+  Command: z.string().optional(),
+  Id: z.string().optional(),
+  IsSystem: z.boolean().optional(),
+  Jobs: z.array(zKubernetesK8sJob).optional(),
+  Name: z.string().optional(),
+  Namespace: z.string().optional(),
+  Schedule: z.string().optional(),
+  Suspend: z.boolean().optional(),
+  Timezone: z.string().optional(),
+});
+
+export const zV1Beta1ContainerMetrics = z.object({
+  name: z.string().optional(),
+  usage: zV1ResourceList.optional(),
+});
+
+export const zV1Beta1NodeMetrics = z.object({
+  apiVersion: z.string().optional(),
+  kind: z.string().optional(),
+  metadata: zV1ObjectMeta.optional(),
+  timestamp: z.string().optional(),
+  usage: zV1ResourceList.optional(),
+  window: z.string().optional(),
+});
+
+export const zV1Beta1NodeMetricsList = z.object({
+  apiVersion: z.string().optional(),
+  items: z.array(zV1Beta1NodeMetrics).optional(),
+  kind: z.string().optional(),
+  metadata: zV1ListMeta.optional(),
+});
+
+export const zV1Beta1PodMetrics = z.object({
+  apiVersion: z.string().optional(),
+  containers: z.array(zV1Beta1ContainerMetrics).optional(),
+  kind: z.string().optional(),
+  metadata: zV1ObjectMeta.optional(),
+  timestamp: z.string().optional(),
+  window: z.string().optional(),
+});
+
+export const zV1Beta1PodMetricsList = z.object({
+  apiVersion: z.string().optional(),
+  items: z.array(zV1Beta1PodMetrics).optional(),
+  kind: z.string().optional(),
+  metadata: zV1ListMeta.optional(),
+});
+
+export const zWebhooksWebhookCreatePayload = z.object({
+  EndpointID: z.int().optional(),
+  RegistryID: z.int().optional(),
+  ResourceID: z.string().optional(),
+  WebhookType: zPortainerWebhookType.optional(),
+});
+
+export const zWebhooksWebhookUpdatePayload = z.object({
+  RegistryID: z.int().optional(),
+});
+
+export const zWorkflowsArtifactFileDetail = z.object({
+  hash: z.string().optional(),
+  path: z.string().optional(),
+  pathError: z.string().optional(),
+  pathStatus: zSourcesStatus.optional(),
+  ref: z.string().optional(),
+  refError: z.string().optional(),
+  refStatus: zSourcesStatus.optional(),
+  sourceId: z.int().optional(),
+});
+
+export const zWorkflowsDeploymentPlatform = z.enum([
+  'dockerStandalone',
+  'dockerSwarm',
+  'kubernetes',
+]);
+
+export const zWorkflowsStatus = z.enum([
+  'healthy',
+  'syncing',
+  'error',
+  'paused',
+  'unknown',
+]);
+
+export const zSourcesSource = z.object({
+  environments: z.int().optional(),
+  error: z.string().optional(),
+  id: z.int(),
+  lastSync: z.int().optional(),
+  name: z.string(),
+  status: zWorkflowsStatus,
+  type: zSourcesSourceType,
+  url: z.string(),
+  usedBy: z.int().optional(),
+});
+
+export const zWorkflowsStatusSummary = z.object({
+  error: z.int().optional(),
+  healthy: z.int().optional(),
+  paused: z.int().optional(),
+  syncing: z.int().optional(),
+  unknown: z.int().optional(),
+});
+
+export const zWorkflowsTarget = z.object({
+  edgeGroupIds: z.array(z.int()).optional(),
+  endpointId: z.int().optional(),
+  groupStatus: z.record(z.string(), zWorkflowsStatus).optional(),
+  namespace: z.string().optional(),
+  resolvedEndpointIds: z.array(z.int()).optional(),
+});
+
+export const zWorkflowsType = z.enum(['stack', 'edgeStack']);
+
+export const zWorkflowsWorkflowPhaseStatus = z.object({
+  error: z.string().optional(),
+  status: zWorkflowsStatus.optional(),
+});
+
+export const zWorkflowsWorkflowStatusObject = z.object({
+  artifact: zWorkflowsWorkflowPhaseStatus.optional(),
+  source: zWorkflowsWorkflowPhaseStatus.optional(),
+  target: zWorkflowsWorkflowPhaseStatus.optional(),
+});
+
+export const zWorkflowsArtifactDetail = z.object({
+  autoUpdate: zPortainerAutoUpdateSettings.optional(),
+  creationDate: z.int().optional(),
+  files: z.array(zWorkflowsArtifactFileDetail).optional(),
+  id: z.int(),
+  lastSyncDate: z.int().optional(),
+  name: z.string(),
+  platform: zWorkflowsDeploymentPlatform.optional(),
+  status: zWorkflowsWorkflowStatusObject.optional(),
+  target: zWorkflowsTarget.optional(),
+  type: zWorkflowsType,
+});
+
+export const zWorkflowsWorkflow = z.object({
+  autoUpdate: zPortainerAutoUpdateSettings.optional(),
+  creationDate: z.int().optional(),
+  gitConfig: zGittypesRepoConfig.optional(),
+  id: z.int(),
+  lastSyncDate: z.int().optional(),
+  name: z.string(),
+  platform: zWorkflowsDeploymentPlatform,
+  sourceId: z.int().optional(),
+  status: zWorkflowsWorkflowStatusObject,
+  target: zWorkflowsTarget,
+  type: zWorkflowsType,
+});
+
+export const zSourcesSourceDetail = z.object({
+  access: zSourcesSourceAccess.optional(),
+  autoUpdate: zSourcesAutoUpdateInfo.optional(),
+  connection: zSourcesConnectionInfo,
+  environments: z.int().optional(),
+  error: z.string().optional(),
+  id: z.int(),
+  lastSync: z.int().optional(),
+  name: z.string(),
+  status: zWorkflowsStatus,
+  type: zSourcesSourceType,
+  url: z.string(),
+  usedBy: z.int().optional(),
+  workflows: z.array(zWorkflowsWorkflow).optional(),
+});
+
+export const zWorkflowsWorkflowDetail = z.object({
+  artifacts: z.array(zWorkflowsArtifactDetail).optional(),
+  id: z.int(),
+  name: z.string(),
+});
+
+/**
+ * Ingress controllers
+ */
+export const zKubernetesK8sIngressControllerArray = z.array(
+  zKubernetesK8sIngressController
+);
+
+export const zEndpointsEndpointDeleteBatchPayload2 =
+  zEndpointsEndpointDeleteBatchPayload;
+
+export const zKubernetesK8sNamespaceDetails2 = zKubernetesK8sNamespaceDetails;
+
+export const zKubernetesK8sIngressInfo2 = zKubernetesK8sIngressInfo;
+
+export const zKubernetesK8sServiceInfo2 = zKubernetesK8sServiceInfo;
+
+/**
+ * Credentials used for authentication
+ */
+export const zAuthenticateUserBody = zAuthAuthenticatePayload;
+
+/**
+ * Success
+ */
+export const zAuthenticateUserResponse = zAuthAuthenticateResponse;
+
+/**
+ * Success
+ */
+export const zLogoutResponse = z.void();
+
+/**
+ * OAuth Credentials used for authentication
+ */
+export const zValidateOAuthBody = zAuthOauthPayload;
+
+/**
+ * Success
+ */
+export const zValidateOAuthResponse = zAuthAuthenticateResponse;
+
+/**
+ * An object contains the password to encrypt the backup with
+ */
+export const zBackupBody = zBackupBackupPayload;
+
+export const zCustomTemplateListQuery = z.object({
+  type: z.array(z.union([z.literal(1), z.literal(2), z.literal(3)])),
+  edge: z.boolean().optional(),
+});
+
+/**
+ * Success
+ */
+export const zCustomTemplateListResponse = z.array(zPortainerCustomTemplate);
+
+export const zCustomTemplateDeletePath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zCustomTemplateDeleteResponse = z.void();
+
+export const zCustomTemplateInspectPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zCustomTemplateInspectResponse = zPortainerCustomTemplate;
+
+/**
+ * Template details
+ */
+export const zCustomTemplateUpdateBody =
+  zCustomtemplatesCustomTemplateUpdatePayload;
+
+export const zCustomTemplateUpdatePath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zCustomTemplateUpdateResponse = zPortainerCustomTemplate;
+
+export const zCustomTemplateFilePath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zCustomTemplateFileResponse = zCustomtemplatesFileResponse;
+
+export const zCustomTemplateGitFetchPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zCustomTemplateGitFetchResponse = zCustomtemplatesFileResponse;
+
+export const zCustomTemplateCreateFileBody = z.object({
+  Title: z.string(),
+  Description: z.string(),
+  Note: z.string(),
+  Platform: z.union([z.literal(1), z.literal(2)]),
+  Type: z.union([z.literal(1), z.literal(2), z.literal(3)]),
+  File: z.union([z.instanceof(Blob), z.instanceof(File)]),
+  Logo: z.string().optional(),
+  Variables: z.string().optional(),
+});
+
+/**
+ * OK
+ */
+export const zCustomTemplateCreateFileResponse = zPortainerCustomTemplate;
+
+/**
+ * Required when using method=repository
+ */
+export const zCustomTemplateCreateRepositoryBody =
+  zCustomtemplatesCustomTemplateFromGitRepositoryPayload;
+
+/**
+ * OK
+ */
+export const zCustomTemplateCreateRepositoryResponse = zPortainerCustomTemplate;
+
+/**
+ * body
+ */
+export const zCustomTemplateCreateStringBody =
+  zCustomtemplatesCustomTemplateFromFileContentPayload;
+
+/**
+ * OK
+ */
+export const zCustomTemplateCreateStringResponse = zPortainerCustomTemplate;
+
+export const zDockerContainerGpusInspectPath = z.object({
+  environmentId: z.int(),
+  containerId: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zDockerContainerGpusInspectResponse =
+  zContainersContainerGpusResponse;
+
+export const zDockerDashboardPath = z.object({
+  environmentId: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zDockerDashboardResponse2 = zDockerDashboardResponse;
+
+export const zDockerImagesListPath = z.object({
+  environmentId: z.int(),
+});
+
+export const zDockerImagesListQuery = z.object({
+  withUsage: z.boolean().optional(),
+});
+
+/**
+ * Success
+ */
+export const zDockerImagesListResponse = z.array(zImagesImageResponse);
+
+/**
+ * EdgeGroups
+ */
+export const zEdgeGroupListResponse = z.array(zEdgegroupsDecoratedEdgeGroup);
+
+/**
+ * EdgeGroup data
+ */
+export const zEdgeGroupCreateBody = zEdgegroupsEdgeGroupCreatePayload;
+
+/**
+ * OK
+ */
+export const zEdgeGroupCreateResponse = zPortainerEdgeGroup;
+
+export const zEdgeGroupDeletePath = z.object({
+  id: z.int(),
+});
+
+/**
+ * No Content
+ */
+export const zEdgeGroupDeleteResponse = z.void();
+
+export const zEdgeGroupInspectPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * OK
+ */
+export const zEdgeGroupInspectResponse = zPortainerEdgeGroup;
+
+/**
+ * EdgeGroup data
+ */
+export const zEdgeGroupUpdateBody = zEdgegroupsEdgeGroupUpdatePayload;
+
+export const zEdgeGroupUpdatePath = z.object({
+  id: z.int(),
+});
+
+/**
+ * OK
+ */
+export const zEdgeGroupUpdateResponse = zPortainerEdgeGroup;
+
+/**
+ * OK
+ */
+export const zEdgeJobListResponse = z.array(zPortainerEdgeJob);
+
+export const zEdgeJobDeletePath = z.object({
+  id: z.int(),
+});
+
+/**
+ * No Content
+ */
+export const zEdgeJobDeleteResponse = z.void();
+
+export const zEdgeJobInspectPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * OK
+ */
+export const zEdgeJobInspectResponse = zPortainerEdgeJob;
+
+/**
+ * EdgeGroup data
+ */
+export const zEdgeJobUpdateBody = zEdgejobsEdgeJobUpdatePayload;
+
+export const zEdgeJobUpdatePath = z.object({
+  id: z.int(),
+});
+
+/**
+ * OK
+ */
+export const zEdgeJobUpdateResponse = zPortainerEdgeJob;
+
+export const zEdgeJobFilePath = z.object({
+  id: z.int(),
+});
+
+/**
+ * OK
+ */
+export const zEdgeJobFileResponse = zEdgejobsEdgeJobFileResponse;
+
+export const zEdgeJobTasksListPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * OK
+ */
+export const zEdgeJobTasksListResponse = z.array(zEdgejobsTaskContainer);
+
+export const zEdgeJobTasksClearPath = z.object({
+  id: z.int(),
+  taskID: z.int(),
+});
+
+/**
+ * No Content
+ */
+export const zEdgeJobTasksClearResponse = z.void();
+
+export const zEdgeJobTaskLogsInspectPath = z.object({
+  id: z.int(),
+  taskID: z.int(),
+});
+
+/**
+ * OK
+ */
+export const zEdgeJobTaskLogsInspectResponse = zEdgejobsFileResponse;
+
+export const zEdgeJobTasksCollectPath = z.object({
+  id: z.int(),
+  taskID: z.int(),
+});
+
+/**
+ * No Content
+ */
+export const zEdgeJobTasksCollectResponse = z.void();
+
+export const zEdgeJobCreateFileBody = z.object({
+  file: z.union([z.instanceof(Blob), z.instanceof(File)]),
+  Name: z.string(),
+  CronExpression: z.string(),
+  EdgeGroups: z.string(),
+  Endpoints: z.string(),
+  Recurring: z.boolean().optional(),
+});
+
+/**
+ * OK
+ */
+export const zEdgeJobCreateFileResponse = zPortainerEdgeGroup;
+
+/**
+ * EdgeGroup data when method is string
+ */
+export const zEdgeJobCreateStringBody =
+  zEdgejobsEdgeJobCreateFromFileContentPayload;
+
+/**
+ * OK
+ */
+export const zEdgeJobCreateStringResponse = zPortainerEdgeGroup;
+
+export const zEdgeStackListQuery = z.object({
+  summarizeStatuses: z.boolean().optional(),
+});
+
+/**
+ * OK
+ */
+export const zEdgeStackListResponse = z.array(zPortainerEdgeStack);
+
+export const zEdgeStackDeletePath = z.object({
+  id: z.int(),
+});
+
+/**
+ * No Content
+ */
+export const zEdgeStackDeleteResponse = z.void();
+
+export const zEdgeStackInspectPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * OK
+ */
+export const zEdgeStackInspectResponse = zPortainerEdgeStack;
+
+/**
+ * EdgeStack data
+ */
+export const zEdgeStackUpdateBody = zEdgestacksUpdateEdgeStackPayload;
+
+export const zEdgeStackUpdatePath = z.object({
+  id: z.int(),
+});
+
+/**
+ * OK
+ */
+export const zEdgeStackUpdateResponse = zPortainerEdgeStack;
+
+export const zEdgeStackFilePath = z.object({
+  id: z.int(),
+});
+
+/**
+ * OK
+ */
+export const zEdgeStackFileResponse = zEdgestacksStackFileResponse;
+
+/**
+ * EdgeStack status payload
+ */
+export const zEdgeStackStatusUpdateBody = zEdgestacksUpdateStatusPayload;
+
+export const zEdgeStackStatusUpdatePath = z.object({
+  id: z.int(),
+});
+
+/**
+ * OK
+ */
+export const zEdgeStackStatusUpdateResponse = zPortainerEdgeStack;
+
+export const zEdgeStackCreateFileBody = z.object({
+  Name: z.string(),
+  file: z.union([z.instanceof(Blob), z.instanceof(File)]),
+  EdgeGroups: z.string(),
+  DeploymentType: z.int(),
+  Registries: z.string().optional(),
+  UseManifestNamespaces: z.boolean().optional(),
+  PrePullImage: z.boolean().optional(),
+  RetryDeploy: z.boolean().optional(),
+});
+
+export const zEdgeStackCreateFileQuery = z.object({
+  dryrun: z.string().optional(),
+});
+
+/**
+ * OK
+ */
+export const zEdgeStackCreateFileResponse = zPortainerEdgeStack;
+
+/**
+ * stack config
+ */
+export const zEdgeStackCreateRepositoryBody =
+  zEdgestacksEdgeStackFromGitRepositoryPayload;
+
+export const zEdgeStackCreateRepositoryQuery = z.object({
+  dryrun: z.string().optional(),
+});
+
+/**
+ * OK
+ */
+export const zEdgeStackCreateRepositoryResponse = zPortainerEdgeStack;
+
+/**
+ * stack config
+ */
+export const zEdgeStackCreateStringBody = zEdgestacksEdgeStackFromStringPayload;
+
+export const zEdgeStackCreateStringQuery = z.object({
+  dryrun: z.string().optional(),
+});
+
+/**
+ * OK
+ */
+export const zEdgeStackCreateStringResponse = zPortainerEdgeStack;
+
+export const zEndpointGroupListQuery = z.object({
+  size: z.boolean().optional(),
+});
+
+/**
+ * Environment(Endpoint) group
+ */
+export const zEndpointGroupListResponse = z.array(
+  zEndpointgroupsEndpointGroupResponse
+);
+
+/**
+ * Environment(Endpoint) Group details
+ */
+export const zPostEndpointGroupsBody =
+  zEndpointgroupsEndpointGroupCreatePayload;
+
+/**
+ * Success
+ */
+export const zPostEndpointGroupsResponse = zPortainerEndpointGroup;
+
+export const zEndpointGroupDeletePath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zEndpointGroupDeleteResponse = z.void();
+
+export const zGetEndpointGroupsByIdPath = z.object({
+  id: z.int(),
+});
+
+export const zGetEndpointGroupsByIdQuery = z.object({
+  size: z.boolean().optional(),
+});
+
+/**
+ * Success
+ */
+export const zGetEndpointGroupsByIdResponse =
+  zEndpointgroupsEndpointGroupResponse;
+
+/**
+ * EndpointGroup details
+ */
+export const zEndpointGroupUpdateBody =
+  zEndpointgroupsEndpointGroupUpdatePayload;
+
+export const zEndpointGroupUpdatePath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zEndpointGroupUpdateResponse = zPortainerEndpointGroup;
+
+export const zEndpointGroupDeleteEndpointPath = z.object({
+  id: z.int(),
+  endpointId: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zEndpointGroupDeleteEndpointResponse = z.void();
+
+export const zEndpointGroupAddEndpointPath = z.object({
+  id: z.int(),
+  endpointId: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zEndpointGroupAddEndpointResponse = z.void();
+
+export const zEndpointListQuery = z.object({
+  start: z.int().optional(),
+  limit: z.int().optional(),
+  sort: z
+    .enum([
+      'Name',
+      'Group',
+      'Status',
+      'LastCheckIn',
+      'EdgeID',
+      'PlatformType',
+      'Health',
+      'Id',
+    ])
+    .optional(),
+  order: z.string().optional(),
+  search: z.string().optional(),
+  groupIds: z.array(z.int()).optional(),
+  status: z.array(z.int()).optional(),
+  types: z
+    .array(
+      z.union([
+        z.literal(0),
+        z.literal(1),
+        z.literal(2),
+        z.literal(3),
+        z.literal(4),
+        z.literal(5),
+        z.literal(6),
+        z.literal(7),
+      ])
+    )
+    .optional(),
+  platformTypes: z
+    .array(
+      z.union([
+        z.literal(0),
+        z.literal(1),
+        z.literal(2),
+        z.literal(3),
+        z.literal(4),
+      ])
+    )
+    .optional(),
+  outdated: z.boolean().optional(),
+  excludeGroupIds: z.array(z.int()).optional(),
+  tagIds: z.array(z.int()).optional(),
+  tagsPartialMatch: z.boolean().optional(),
+  endpointIds: z.array(z.int()).optional(),
+  excludeIds: z.array(z.int()).optional(),
+  agentVersions: z.array(z.string()).optional(),
+  edgeAsync: z.boolean().optional(),
+  edgeDeviceUntrusted: z.boolean().optional(),
+  edgeCheckInPassedSeconds: z.number().optional(),
+  excludeSnapshots: z.boolean().optional(),
+  name: z.string().optional(),
+  edgeStackId: z.int().optional(),
+  edgeStackStatus: z
+    .union([
+      z.literal(0),
+      z.literal(1),
+      z.literal(2),
+      z.literal(3),
+      z.literal(4),
+      z.literal(5),
+      z.literal(6),
+      z.literal(7),
+      z.literal(8),
+      z.literal(9),
+      z.literal(10),
+      z.literal(11),
+      z.literal(12),
+      z.literal(13),
+    ])
+    .optional(),
+  edgeGroupIds: z.array(z.int()).optional(),
+  excludeEdgeGroupIds: z.array(z.int()).optional(),
+});
+
+/**
+ * Endpoints
+ */
+export const zEndpointListResponse = z.array(zPortainerEndpoint);
+
+export const zEndpointCreateBody = z.object({
+  Name: z.string(),
+  EndpointCreationType: z.union([
+    z.literal(0),
+    z.literal(1),
+    z.literal(2),
+    z.literal(3),
+    z.literal(4),
+    z.literal(5),
+  ]),
+  ContainerEngine: z.string().optional(),
+  URL: z.string().optional(),
+  PublicURL: z.string().optional(),
+  GroupID: z.int().optional(),
+  TLS: z.boolean().optional(),
+  TLSSkipVerify: z.boolean().optional(),
+  TLSSkipClientVerify: z.boolean().optional(),
+  TLSCACertFile: z.union([z.instanceof(Blob), z.instanceof(File)]).optional(),
+  TLSCertFile: z.union([z.instanceof(Blob), z.instanceof(File)]).optional(),
+  TLSKeyFile: z.union([z.instanceof(Blob), z.instanceof(File)]).optional(),
+  AzureApplicationID: z.string().optional(),
+  AzureTenantID: z.string().optional(),
+  AzureAuthenticationKey: z.string().optional(),
+  TagIds: z.string().optional(),
+  EdgeCheckinInterval: z.int().optional(),
+  EdgeTunnelServerAddress: z.string().optional(),
+  Gpus: z.string().optional(),
+});
+
+/**
+ * Success
+ */
+export const zEndpointCreateResponse = zPortainerEndpoint;
+
+export const zEndpointDeletePath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Environment successfully deleted.
+ */
+export const zEndpointDeleteResponse = z.void();
+
+export const zEndpointInspectPath = z.object({
+  id: z.int(),
+});
+
+export const zEndpointInspectQuery = z.object({
+  excludeSnapshot: z.boolean().optional(),
+});
+
+/**
+ * Success
+ */
+export const zEndpointInspectResponse = zPortainerEndpoint;
+
+/**
+ * Environment(Endpoint) details
+ */
+export const zEndpointUpdateBody = zEndpointsEndpointUpdatePayload;
+
+export const zEndpointUpdatePath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zEndpointUpdateResponse = zPortainerEndpoint;
+
+export const zEndpointAssociationDeletePath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zEndpointAssociationDeleteResponse = z.void();
+
+export const zPostEndpointsByIdDockerV2BrowsePutBody = z.object({
+  Path: z.string(),
+  file: z.union([z.instanceof(Blob), z.instanceof(File)]),
+});
+
+export const zPostEndpointsByIdDockerV2BrowsePutPath = z.object({
+  id: z.int(),
+});
+
+export const zPostEndpointsByIdDockerV2BrowsePutQuery = z.object({
+  volumeID: z.string().optional(),
+});
+
+/**
+ * Success
+ */
+export const zPostEndpointsByIdDockerV2BrowsePutResponse = z.void();
+
+export const zEndpointDockerhubStatusPath = z.object({
+  id: z.int(),
+  registryId: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zEndpointDockerhubStatusResponse =
+  zEndpointsDockerhubStatusResponse;
+
+/**
+ * details
+ */
+export const zEndpointForceUpdateServiceBody =
+  zEndpointsForceUpdateServicePayload;
+
+export const zEndpointForceUpdateServicePath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zEndpointForceUpdateServiceResponse = zSwarmServiceUpdateResponse;
+
+export const zHelmListPath = z.object({
+  id: z.int(),
+});
+
+export const zHelmListQuery = z.object({
+  namespace: z.string().optional(),
+  filter: z.string().optional(),
+  selector: z.string().optional(),
+});
+
+/**
+ * Success
+ */
+export const zHelmListResponse = z.array(zReleaseReleaseElement);
+
+/**
+ * Chart details
+ */
+export const zHelmInstallBody = zHelmInstallChartPayload;
+
+export const zHelmInstallPath = z.object({
+  id: z.int(),
+});
+
+export const zHelmInstallQuery = z.object({
+  dryRun: z.boolean().optional(),
+});
+
+/**
+ * Created
+ */
+export const zHelmInstallResponse = zReleaseRelease;
+
+export const zHelmDeletePath = z.object({
+  id: z.int(),
+  release: z.string(),
+});
+
+export const zHelmDeleteQuery = z.object({
+  namespace: z.string().optional(),
+});
+
+/**
+ * Success
+ */
+export const zHelmDeleteResponse = z.void();
+
+export const zHelmGetPath = z.object({
+  id: z.int(),
+  release: z.string(),
+});
+
+export const zHelmGetQuery = z.object({
+  namespace: z.string().optional(),
+  showResources: z.boolean().optional(),
+  revision: z.int().optional(),
+});
+
+/**
+ * Success
+ */
+export const zHelmGetResponse = zReleaseRelease;
+
+export const zHelmGetHistoryPath = z.object({
+  id: z.int(),
+  release: z.string(),
+});
+
+export const zHelmGetHistoryQuery = z.object({
+  namespace: z.string().optional(),
+});
+
+/**
+ * Success
+ */
+export const zHelmGetHistoryResponse = z.array(zReleaseRelease);
+
+export const zHelmRollbackPath = z.object({
+  id: z.int(),
+  release: z.string(),
+});
+
+export const zHelmRollbackQuery = z.object({
+  namespace: z.string().optional(),
+  revision: z.int().optional(),
+  wait: z.boolean().optional(),
+  waitForJobs: z.boolean().optional(),
+  recreate: z.boolean().optional(),
+  force: z.boolean().optional(),
+  timeout: z.int().optional(),
+});
+
+/**
+ * Success
+ */
+export const zHelmRollbackResponse = zReleaseRelease;
+
+export const zEndpointRegistriesListPath = z.object({
+  id: z.int(),
+});
+
+export const zEndpointRegistriesListQuery = z.object({
+  namespace: z.string().optional(),
+});
+
+/**
+ * Success
+ */
+export const zEndpointRegistriesListResponse = z.array(zPortainerRegistry);
+
+/**
+ * details
+ */
+export const zEndpointRegistryAccessBody = zEndpointsRegistryAccessPayload;
+
+export const zEndpointRegistryAccessPath = z.object({
+  id: z.int(),
+  registryId: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zEndpointRegistryAccessResponse = z.void();
+
+/**
+ * Environment(Endpoint) details
+ */
+export const zEndpointSettingsUpdateBody =
+  zEndpointsEndpointSettingsUpdatePayload;
+
+export const zEndpointSettingsUpdatePath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zEndpointSettingsUpdateResponse = zPortainerEndpoint;
+
+export const zEndpointSnapshotPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zEndpointSnapshotResponse = z.void();
+
+/**
+ * List of environments to delete, with optional deleteCluster flag to clean-up associated resources (cloud environments only)
+ */
+export const zEndpointDeleteBatchBody = zEndpointsEndpointDeleteBatchPayload2;
+
+export const zEndpointDeleteBatchResponse = z.union([
+  z.void(),
+  zEndpointsEndpointDeleteBatchPartialResponse,
+]);
+
+/**
+ * Success
+ */
+export const zEndpointCreateGlobalKeyResponse =
+  zEndpointsEndpointCreateGlobalKeyResponse;
+
+/**
+ * Environment relations data
+ */
+export const zEndpointUpdateRelationsBody =
+  zEndpointsEndpointUpdateRelationsPayload;
+
+/**
+ * Success
+ */
+export const zEndpointUpdateRelationsResponse = z.void();
+
+/**
+ * Success
+ */
+export const zEndpointSnapshotsResponse = z.void();
+
+/**
+ * Environment summary counts
+ */
+export const zEndpointSummaryCountsResponse =
+  zEndpointsEnvironmentSummaryCountsResponse;
+
+/**
+ * Template details
+ */
+export const zGitOperationRepoFilePreviewBody =
+  zGitopsRepositoryFilePreviewPayload;
+
+/**
+ * Success
+ */
+export const zGitOperationRepoFilePreviewResponse = zGitopsFileResponse;
+
+export const zGitOpsSourcesListQuery = z.object({
+  search: z.string().optional(),
+  sort: z.string().optional(),
+  order: z.string().optional(),
+  start: z.int().optional(),
+  limit: z.int().optional(),
+  status: z.string().optional(),
+  type: z.enum(['git', 'helm', 'oci']).optional(),
+});
+
+/**
+ * OK
+ */
+export const zGitOpsSourcesListResponse = z.array(zSourcesSource);
+
+export const zGitOpsSourcesDeletePath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Source deleted
+ */
+export const zGitOpsSourcesDeleteResponse = z.void();
+
+export const zGitOpsSourceGetPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * OK
+ */
+export const zGitOpsSourceGetResponse = zSourcesSourceDetail;
+
+/**
+ * Git source details
+ */
+export const zGitOpsSourcesUpdateGitBody = zSourcesGitSourceUpdatePayload;
+
+export const zGitOpsSourcesUpdateGitPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * OK
+ */
+export const zGitOpsSourcesUpdateGitResponse = zPortainerSource;
+
+/**
+ * Source access control
+ */
+export const zGitOpsSourcesUpdateAccessBody = zSourcesSourceAccessUpdatePayload;
+
+export const zGitOpsSourcesUpdateAccessPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * OK
+ */
+export const zGitOpsSourcesUpdateAccessResponse = zPortainerSource;
+
+/**
+ * Optional connection overrides; omitted fields fall back to stored values
+ */
+export const zGitOpsSourcesTestByIdBody = zSourcesGitSourceUpdatePayload;
+
+export const zGitOpsSourcesTestByIdPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Connection test result
+ */
+export const zGitOpsSourcesTestByIdResponse = zSourcesConnectionTestResult;
+
+/**
+ * Git source details
+ */
+export const zGitOpsSourcesCreateGitBody = zSourcesGitSourceCreatePayload;
+
+/**
+ * Created
+ */
+export const zGitOpsSourcesCreateGitResponse = zPortainerSource;
+
+/**
+ * OK
+ */
+export const zGitOpsSourcesSummaryResponse = zWorkflowsStatusSummary;
+
+/**
+ * Git connection details
+ */
+export const zGitOpsSourcesTestBody = zSourcesGitSourceCreatePayload;
+
+/**
+ * Connection test result
+ */
+export const zGitOpsSourcesTestResponse = zSourcesConnectionTestResult;
+
+export const zGitOpsWorkflowsListQuery = z.object({
+  search: z.string().optional(),
+  sort: z.string().optional(),
+  order: z.string().optional(),
+  start: z.int().optional(),
+  limit: z.int().optional(),
+  endpointIds: z.array(z.int()).optional(),
+  status: z.string().optional(),
+  type: z.string().optional(),
+  platform: z.string().optional(),
+});
+
+/**
+ * OK
+ */
+export const zGitOpsWorkflowsListResponse = z.array(zWorkflowsWorkflow);
+
+export const zGitOpsWorkflowGetPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * OK
+ */
+export const zGitOpsWorkflowGetResponse = zWorkflowsWorkflowDetail;
+
+/**
+ * OK
+ */
+export const zGitOpsWorkflowsSummaryResponse = zWorkflowsStatusSummary;
+
+export const zGetAllKubernetesApplicationsPath = z.object({
+  id: z.int(),
+});
+
+export const zGetAllKubernetesApplicationsQuery = z.object({
+  namespace: z.string(),
+  nodeName: z.string(),
+});
+
+/**
+ * Success
+ */
+export const zGetAllKubernetesApplicationsResponse = z.array(
+  zKubernetesK8sApplication
+);
+
+export const zGetAllKubernetesApplicationsCountPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zGetAllKubernetesApplicationsCountResponse = z.int();
+
+/**
+ * A list of cluster role bindings to delete
+ */
+export const zDeleteClusterRoleBindingsBody = z.array(z.string());
+
+export const zDeleteClusterRoleBindingsPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zDeleteClusterRoleBindingsResponse = z.void();
+
+/**
+ * A list of cluster roles to delete
+ */
+export const zDeleteClusterRolesBody = z.array(z.string());
+
+export const zDeleteClusterRolesPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zDeleteClusterRolesResponse = z.void();
+
+export const zGetAllKubernetesClusterRoleBindingsPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zGetAllKubernetesClusterRoleBindingsResponse = z.array(
+  zKubernetesK8sClusterRoleBinding
+);
+
+export const zGetAllKubernetesClusterRolesPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zGetAllKubernetesClusterRolesResponse = z.array(
+  zKubernetesK8sClusterRole
+);
+
+export const zGetAllKubernetesConfigMapsPath = z.object({
+  id: z.int(),
+});
+
+export const zGetAllKubernetesConfigMapsQuery = z.object({
+  isUsed: z.boolean(),
+});
+
+/**
+ * Success
+ */
+export const zGetAllKubernetesConfigMapsResponse = z.array(
+  zKubernetesK8sConfigMap
+);
+
+export const zGetAllKubernetesConfigMapsCountPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zGetAllKubernetesConfigMapsCountResponse = z.int();
+
+export const zGetKubernetesCronJobsPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zGetKubernetesCronJobsResponse = z.array(zKubernetesK8sCronJob);
+
+/**
+ * A map where the key is the namespace and the value is an array of Cron Jobs to delete
+ */
+export const zDeleteCronJobsBody = zKubernetesK8sCronJobDeleteRequests;
+
+export const zDeleteCronJobsPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zDeleteCronJobsResponse = z.void();
+
+export const zGetKubernetesDashboardPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zGetKubernetesDashboardResponse = z.array(zKubernetesK8sDashboard);
+
+export const zDescribeResourcePath = z.object({
+  id: z.int(),
+});
+
+export const zDescribeResourceQuery = z.object({
+  name: z.string(),
+  kind: z.string(),
+  namespace: z.string().optional(),
+});
+
+/**
+ * Success
+ */
+export const zDescribeResourceResponse = zKubernetesDescribeResourceResponse;
+
+export const zGetAllKubernetesEventsPath = z.object({
+  id: z.int(),
+});
+
+export const zGetAllKubernetesEventsQuery = z.object({
+  resourceId: z.string().optional(),
+});
+
+/**
+ * Success
+ */
+export const zGetAllKubernetesEventsResponse = z.array(zKubernetesK8sEvent);
+
+export const zGetAllKubernetesIngressControllersPath = z.object({
+  id: z.int(),
+});
+
+export const zGetAllKubernetesIngressControllersQuery = z.object({
+  allowedOnly: z.boolean().optional(),
+});
+
+/**
+ * Success
+ */
+export const zGetAllKubernetesIngressControllersResponse = z.array(
+  zKubernetesK8sIngressController
+);
+
+/**
+ * Ingress controllers
+ */
+export const zUpdateKubernetesIngressControllersBody =
+  zKubernetesK8sIngressControllerArray;
+
+export const zUpdateKubernetesIngressControllersPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zUpdateKubernetesIngressControllersResponse = z.void();
+
+export const zGetAllKubernetesClusterIngressesPath = z.object({
+  id: z.int(),
+});
+
+export const zGetAllKubernetesClusterIngressesQuery = z.object({
+  withServices: z.boolean().optional(),
+});
+
+/**
+ * Success
+ */
+export const zGetAllKubernetesClusterIngressesResponse = z.array(
+  zKubernetesK8sIngressInfo
+);
+
+export const zGetAllKubernetesClusterIngressesCountPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zGetAllKubernetesClusterIngressesCountResponse = z.int();
+
+/**
+ * Ingress details
+ */
+export const zDeleteKubernetesIngressesBody =
+  zKubernetesK8sIngressDeleteRequests;
+
+export const zDeleteKubernetesIngressesPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zDeleteKubernetesIngressesResponse = z.void();
+
+export const zGetKubernetesJobsPath = z.object({
+  id: z.int(),
+});
+
+export const zGetKubernetesJobsQuery = z.object({
+  includeCronJobChildren: z.boolean().optional(),
+});
+
+/**
+ * Success
+ */
+export const zGetKubernetesJobsResponse = z.array(zKubernetesK8sJob);
+
+/**
+ * A map where the key is the namespace and the value is an array of Jobs to delete
+ */
+export const zDeleteJobsBody = zKubernetesK8sJobDeleteRequests;
+
+export const zDeleteJobsPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zDeleteJobsResponse = z.void();
+
+export const zGetKubernetesMaxResourceLimitsPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zGetKubernetesMaxResourceLimitsResponse = zPortainerK8sNodesLimits;
+
+export const zGetApplicationsResourcesPath = z.object({
+  id: z.int(),
+});
+
+export const zGetApplicationsResourcesQuery = z.object({
+  node: z.string(),
+});
+
+/**
+ * Success
+ */
+export const zGetApplicationsResourcesResponse =
+  zKubernetesK8sApplicationResource;
+
+export const zGetKubernetesMetricsForAllNodesPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zGetKubernetesMetricsForAllNodesResponse = zV1Beta1NodeMetricsList;
+
+export const zGetKubernetesMetricsForNodePath = z.object({
+  id: z.int(),
+  name: z.string(),
+});
+
+/**
+ * Success
+ */
+export const zGetKubernetesMetricsForNodeResponse = zV1Beta1NodeMetrics;
+
+export const zGetKubernetesMetricsForAllPodsPath = z.object({
+  id: z.int(),
+  namespace: z.string(),
+});
+
+/**
+ * Success
+ */
+export const zGetKubernetesMetricsForAllPodsResponse = zV1Beta1PodMetricsList;
+
+export const zGetKubernetesMetricsForPodPath = z.object({
+  id: z.int(),
+  namespace: z.string(),
+  name: z.string(),
+});
+
+/**
+ * Success
+ */
+export const zGetKubernetesMetricsForPodResponse = zV1Beta1PodMetrics;
+
+export const zDeleteKubernetesNamespacePath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zDeleteKubernetesNamespaceResponse = z.string();
+
+export const zGetKubernetesNamespacesPath = z.object({
+  id: z.int(),
+});
+
+export const zGetKubernetesNamespacesQuery = z.object({
+  withResourceQuota: z.boolean(),
+  withUnhealthyEvents: z.boolean(),
+});
+
+/**
+ * Success
+ */
+export const zGetKubernetesNamespacesResponse = z.array(
+  zPortainerK8sNamespaceInfo
+);
+
+/**
+ * Namespace configuration details
+ */
+export const zCreateKubernetesNamespaceBody = zKubernetesK8sNamespaceDetails;
+
+export const zCreateKubernetesNamespacePath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zCreateKubernetesNamespaceResponse = zPortainerK8sNamespaceInfo;
+
+/**
+ * Namespace details
+ */
+export const zUpdateKubernetesNamespaceDeprecatedBody =
+  zKubernetesK8sNamespaceDetails2;
+
+export const zUpdateKubernetesNamespaceDeprecatedPath = z.object({
+  id: z.int(),
+  namespace: z.string(),
+});
+
+/**
+ * Success
+ */
+export const zUpdateKubernetesNamespaceDeprecatedResponse =
+  zPortainerK8sNamespaceInfo;
+
+export const zGetKubernetesNamespacePath = z.object({
+  id: z.int(),
+  namespace: z.string(),
+});
+
+export const zGetKubernetesNamespaceQuery = z.object({
+  withResourceQuota: z.boolean(),
+});
+
+/**
+ * Success
+ */
+export const zGetKubernetesNamespaceResponse = zPortainerK8sNamespaceInfo;
+
+/**
+ * Namespace details
+ */
+export const zUpdateKubernetesNamespaceBody = zKubernetesK8sNamespaceDetails2;
+
+export const zUpdateKubernetesNamespacePath = z.object({
+  id: z.int(),
+  namespace: z.string(),
+});
+
+/**
+ * Success
+ */
+export const zUpdateKubernetesNamespaceResponse = zPortainerK8sNamespaceInfo;
+
+export const zGetKubernetesConfigMapPath = z.object({
+  id: z.int(),
+  namespace: z.string(),
+  configmap: z.string(),
+});
+
+/**
+ * Success
+ */
+export const zGetKubernetesConfigMapResponse = zKubernetesK8sConfigMap;
+
+export const zGetKubernetesEventsForNamespacePath = z.object({
+  id: z.int(),
+  namespace: z.string(),
+});
+
+export const zGetKubernetesEventsForNamespaceQuery = z.object({
+  resourceId: z.string().optional(),
+});
+
+/**
+ * Success
+ */
+export const zGetKubernetesEventsForNamespaceResponse =
+  z.array(zKubernetesK8sEvent);
+
+export const zGetKubernetesIngressControllersByNamespacePath = z.object({
+  id: z.int(),
+  namespace: z.string(),
+});
+
+/**
+ * Success
+ */
+export const zGetKubernetesIngressControllersByNamespaceResponse = z.array(
+  zKubernetesK8sIngressController
+);
+
+/**
+ * Ingress controllers
+ */
+export const zUpdateKubernetesIngressControllersByNamespaceBody =
+  zKubernetesK8sIngressControllerArray;
+
+export const zUpdateKubernetesIngressControllersByNamespacePath = z.object({
+  id: z.int(),
+  namespace: z.string(),
+});
+
+/**
+ * Success
+ */
+export const zUpdateKubernetesIngressControllersByNamespaceResponse = z.void();
+
+export const zGetAllKubernetesIngressesPath = z.object({
+  id: z.int(),
+  namespace: z.string(),
+});
+
+/**
+ * Success
+ */
+export const zGetAllKubernetesIngressesResponse = z.array(
+  zKubernetesK8sIngressInfo
+);
+
+/**
+ * Ingress details
+ */
+export const zCreateKubernetesIngressBody = zKubernetesK8sIngressInfo2;
+
+export const zCreateKubernetesIngressPath = z.object({
+  id: z.int(),
+  namespace: z.string(),
+});
+
+/**
+ * Success
+ */
+export const zCreateKubernetesIngressResponse = z.void();
+
+/**
+ * Ingress details
+ */
+export const zUpdateKubernetesIngressBody = zKubernetesK8sIngressInfo2;
+
+export const zUpdateKubernetesIngressPath = z.object({
+  id: z.int(),
+  namespace: z.string(),
+});
+
+/**
+ * Success
+ */
+export const zUpdateKubernetesIngressResponse = z.void();
+
+export const zGetKubernetesIngressPath = z.object({
+  id: z.int(),
+  namespace: z.string(),
+  ingress: z.string(),
+});
+
+/**
+ * Success
+ */
+export const zGetKubernetesIngressResponse = zKubernetesK8sIngressInfo;
+
+export const zGetKubernetesPersistentVolumeClaimsInNamespacePath = z.object({
+  id: z.int(),
+  namespace: z.string(),
+});
+
+/**
+ * Success
+ */
+export const zGetKubernetesPersistentVolumeClaimsInNamespaceResponse = z.array(
+  zKubernetesK8sPersistentVolumeClaim
+);
+
+export const zGetKubernetesPersistentVolumeClaimPath = z.object({
+  id: z.int(),
+  namespace: z.string(),
+  name: z.string(),
+});
+
+/**
+ * Success
+ */
+export const zGetKubernetesPersistentVolumeClaimResponse =
+  zKubernetesK8sPersistentVolumeClaim;
+
+export const zDeleteKubernetesPodPath = z.object({
+  id: z.int(),
+  namespace: z.string(),
+  name: z.string(),
+});
+
+/**
+ * Success
+ */
+export const zDeleteKubernetesPodResponse = z.void();
+
+export const zRestartKubernetesPodPath = z.object({
+  id: z.int(),
+  namespace: z.string(),
+  name: z.string(),
+});
+
+/**
+ * Success
+ */
+export const zRestartKubernetesPodResponse = z.void();
+
+export const zGetKubernetesSecretPath = z.object({
+  id: z.int(),
+  namespace: z.string(),
+  secret: z.string(),
+});
+
+/**
+ * Success
+ */
+export const zGetKubernetesSecretResponse = zKubernetesK8sSecret;
+
+export const zGetKubernetesServiceAccountPath = z.object({
+  id: z.int(),
+  namespace: z.string(),
+  name: z.string(),
+});
+
+/**
+ * Success
+ */
+export const zGetKubernetesServiceAccountResponse =
+  zKubernetesK8sServiceAccount;
+
+/**
+ * New imagePullSecrets list
+ */
+export const zUpdateKubernetesServiceAccountImagePullSecretsBody =
+  zKubernetesK8sServiceAccountImagePullSecretsUpdatePayload;
+
+export const zUpdateKubernetesServiceAccountImagePullSecretsPath = z.object({
+  id: z.int(),
+  namespace: z.string(),
+  name: z.string(),
+});
+
+/**
+ * Success
+ */
+export const zUpdateKubernetesServiceAccountImagePullSecretsResponse = z.void();
+
+export const zGetKubernetesServicesByNamespacePath = z.object({
+  id: z.int(),
+  namespace: z.string(),
+});
+
+/**
+ * Success
+ */
+export const zGetKubernetesServicesByNamespaceResponse = z.array(
+  zKubernetesK8sServiceInfo
+);
+
+/**
+ * Service definition
+ */
+export const zCreateKubernetesServiceBody = zKubernetesK8sServiceInfo2;
+
+export const zCreateKubernetesServicePath = z.object({
+  id: z.int(),
+  namespace: z.string(),
+});
+
+/**
+ * Success
+ */
+export const zCreateKubernetesServiceResponse = z.void();
+
+/**
+ * Service definition
+ */
+export const zUpdateKubernetesServiceBody = zKubernetesK8sServiceInfo2;
+
+export const zUpdateKubernetesServicePath = z.object({
+  id: z.int(),
+  namespace: z.string(),
+});
+
+/**
+ * Success
+ */
+export const zUpdateKubernetesServiceResponse = z.void();
+
+/**
+ * Update details
+ */
+export const zKubernetesNamespacesToggleSystemBody =
+  zKubernetesNamespacesToggleSystemPayload;
+
+export const zKubernetesNamespacesToggleSystemPath = z.object({
+  id: z.int(),
+  namespace: z.string(),
+});
+
+/**
+ * Success
+ */
+export const zKubernetesNamespacesToggleSystemResponse = z.void();
+
+export const zGetKubernetesVolumesInNamespacePath = z.object({
+  id: z.int(),
+  namespace: z.string(),
+});
+
+export const zGetKubernetesVolumesInNamespaceQuery = z.object({
+  withApplications: z.boolean().optional(),
+});
+
+/**
+ * Success
+ */
+export const zGetKubernetesVolumesInNamespaceResponse = z.record(
+  z.string(),
+  zKubernetesK8sVolumeInfo
+);
+
+export const zGetKubernetesNamespacesCountPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zGetKubernetesNamespacesCountResponse = z.int();
+
+export const zGetKubernetesNodesPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zGetKubernetesNodesResponse = z.array(
+  zKubernetesKubernetesNodeResponse
+);
+
+export const zDrainNodePath = z.object({
+  id: z.int(),
+  name: z.string(),
+});
+
+/**
+ * Success
+ */
+export const zDrainNodeResponse = z.void();
+
+export const zGetKubernetesNodesLimitsPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zGetKubernetesNodesLimitsResponse = zPortainerK8sNodesLimits;
+
+export const zGetAllKubernetesPersistentVolumeClaimsPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zGetAllKubernetesPersistentVolumeClaimsResponse = z.array(
+  zKubernetesK8sPersistentVolumeClaim
+);
+
+/**
+ * List of PVCs to delete (namespace + name)
+ */
+export const zDeleteKubernetesPersistentVolumeClaimsBody = z.array(
+  zKubernetesK8sVolumeDeleteRequest
+);
+
+export const zDeleteKubernetesPersistentVolumeClaimsPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zDeleteKubernetesPersistentVolumeClaimsResponse = z.void();
+
+/**
+ * PVC resize request
+ */
+export const zResizeKubernetesPersistentVolumeClaimBody =
+  zKubernetesK8sPvcResizeRequest;
+
+export const zResizeKubernetesPersistentVolumeClaimPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zResizeKubernetesPersistentVolumeClaimResponse = z.void();
+
+export const zGetAllKubernetesPersistentVolumesPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zGetAllKubernetesPersistentVolumesResponse = z.array(
+  zKubernetesK8sPersistentVolume
+);
+
+export const zGetKubernetesPersistentVolumePath = z.object({
+  id: z.int(),
+  name: z.string(),
+});
+
+/**
+ * Success
+ */
+export const zGetKubernetesPersistentVolumeResponse =
+  zKubernetesK8sPersistentVolume;
+
+/**
+ * List of PV names to delete
+ */
+export const zDeleteKubernetesPersistentVolumesBody = z.array(z.string());
+
+export const zDeleteKubernetesPersistentVolumesPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zDeleteKubernetesPersistentVolumesResponse = z.void();
+
+/**
+ * Reclaim policy update request
+ */
+export const zUpdateKubernetesPersistentVolumeReclaimPolicyBody =
+  zKubernetesK8sPvReclaimPolicyRequest;
+
+export const zUpdateKubernetesPersistentVolumeReclaimPolicyPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zUpdateKubernetesPersistentVolumeReclaimPolicyResponse = z.void();
+
+export const zGetKubernetesRbacStatusPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * RBAC status
+ */
+export const zGetKubernetesRbacStatusResponse = z.boolean();
+
+/**
+ * A map where the key is the namespace and the value is an array of role bindings to delete
+ */
+export const zDeleteRoleBindingsBody = zKubernetesK8sRoleBindingDeleteRequests;
+
+export const zDeleteRoleBindingsPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zDeleteRoleBindingsResponse = z.void();
+
+export const zGetKubernetesRoleBindingsPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zGetKubernetesRoleBindingsResponse = z.array(
+  zKubernetesK8sRoleBinding
+);
+
+export const zGetKubernetesRolesPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zGetKubernetesRolesResponse = z.array(zKubernetesK8sRole);
+
+/**
+ * A map where the key is the namespace and the value is an array of roles to delete
+ */
+export const zDeleteRolesBody = zKubernetesK8sRoleDeleteRequests;
+
+export const zDeleteRolesPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zDeleteRolesResponse = z.void();
+
+export const zGetKubernetesSecretsPath = z.object({
+  id: z.int(),
+});
+
+export const zGetKubernetesSecretsQuery = z.object({
+  isUsed: z.boolean(),
+});
+
+/**
+ * Success
+ */
+export const zGetKubernetesSecretsResponse = z.array(zKubernetesK8sSecret);
+
+export const zGetKubernetesSecretsCountPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zGetKubernetesSecretsCountResponse = z.int();
+
+/**
+ * A map where the key is the namespace and the value is an array of service accounts to delete
+ */
+export const zDeleteServiceAccountsBody =
+  zKubernetesK8sServiceAccountDeleteRequests;
+
+export const zDeleteServiceAccountsPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zDeleteServiceAccountsResponse = z.void();
+
+export const zGetKubernetesServiceAccountsPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zGetKubernetesServiceAccountsResponse = z.array(
+  zKubernetesK8sServiceAccount
+);
+
+export const zGetKubernetesServicesPath = z.object({
+  id: z.int(),
+});
+
+export const zGetKubernetesServicesQuery = z.object({
+  withApplications: z.boolean().optional(),
+});
+
+/**
+ * Success
+ */
+export const zGetKubernetesServicesResponse = z.array(
+  zKubernetesK8sServiceInfo
+);
+
+export const zGetAllKubernetesServicesCountPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zGetAllKubernetesServicesCountResponse = z.int();
+
+/**
+ * A map where the key is the namespace and the value is an array of services to delete
+ */
+export const zDeleteKubernetesServicesBody =
+  zKubernetesK8sServiceDeleteRequests;
+
+export const zDeleteKubernetesServicesPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zDeleteKubernetesServicesResponse = z.void();
+
+export const zGetAllKubernetesStorageClassesPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zGetAllKubernetesStorageClassesResponse = z.array(
+  zKubernetesK8sStorageClass
+);
+
+export const zGetKubernetesStorageClassPath = z.object({
+  id: z.int(),
+  name: z.string(),
+});
+
+/**
+ * Success
+ */
+export const zGetKubernetesStorageClassResponse = zKubernetesK8sStorageClass;
+
+export const zSetDefaultKubernetesStorageClassPath = z.object({
+  id: z.int(),
+  name: z.string(),
+});
+
+/**
+ * Success
+ */
+export const zSetDefaultKubernetesStorageClassResponse = z.void();
+
+/**
+ * List of StorageClass names to delete
+ */
+export const zDeleteKubernetesStorageClassesBody = z.array(z.string());
+
+export const zDeleteKubernetesStorageClassesPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zDeleteKubernetesStorageClassesResponse = z.void();
+
+export const zGetKubernetesVersionPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zGetKubernetesVersionResponse =
+  zKubernetesKubernetesVersionResponse;
+
+export const zGetAllKubernetesVolumesPath = z.object({
+  id: z.int(),
+});
+
+export const zGetAllKubernetesVolumesQuery = z.object({
+  withApplications: z.boolean().optional(),
+});
+
+/**
+ * Success
+ */
+export const zGetAllKubernetesVolumesResponse = z.record(
+  z.string(),
+  zKubernetesK8sVolumeInfo
+);
+
+export const zGetKubernetesVolumePath = z.object({
+  id: z.int(),
+  namespace: z.string(),
+  volume: z.string(),
+});
+
+/**
+ * Success
+ */
+export const zGetKubernetesVolumeResponse = zKubernetesK8sVolumeInfo;
+
+export const zGetAllKubernetesVolumesCountPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zGetAllKubernetesVolumesCountResponse = z.int();
+
+export const zGetKubernetesConfigQuery = z.object({
+  ids: z.array(z.int()).optional(),
+  excludeIds: z.array(z.int()).optional(),
+});
+
+/**
+ * details
+ */
+export const zLdapCheckBody = zLdapCheckPayload;
+
+/**
+ * Success
+ */
+export const zLdapCheckResponse = z.void();
+
+/**
+ * OK
+ */
+export const zMotdResponse = zMotdMotd;
+
+/**
+ * Success
+ */
+export const zRegistryListResponse = z.array(zPortainerRegistry);
+
+/**
+ * Registry details
+ */
+export const zRegistryCreateBody = zRegistriesRegistryCreatePayload;
+
+/**
+ * Success
+ */
+export const zRegistryCreateResponse = zPortainerRegistry;
+
+export const zRegistryDeletePath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zRegistryDeleteResponse = z.void();
+
+export const zRegistryInspectPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zRegistryInspectResponse = zPortainerRegistry;
+
+/**
+ * Registry details
+ */
+export const zRegistryUpdateBody = zRegistriesRegistryUpdatePayload;
+
+export const zRegistryUpdatePath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zRegistryUpdateResponse = zPortainerRegistry;
+
+/**
+ * Registry configuration
+ */
+export const zRegistryConfigureBody = zRegistriesRegistryConfigurePayload;
+
+export const zRegistryConfigurePath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zRegistryConfigureResponse = z.void();
+
+/**
+ * Registry credentials to test
+ */
+export const zRegistryPingBody = zRegistriesRegistryPingPayload;
+
+/**
+ * Success
+ */
+export const zRegistryPingResponse = zRegistriesRegistryPingResponse;
+
+/**
+ * Resource control details
+ */
+export const zResourceControlCreateBody =
+  zResourcecontrolsResourceControlCreatePayload;
+
+/**
+ * Success
+ */
+export const zResourceControlCreateResponse = zPortainerResourceControl;
+
+export const zResourceControlDeletePath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zResourceControlDeleteResponse = z.void();
+
+/**
+ * Resource control details
+ */
+export const zResourceControlUpdateBody =
+  zResourcecontrolsResourceControlUpdatePayload;
+
+export const zResourceControlUpdatePath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zResourceControlUpdateResponse = zPortainerResourceControl;
+
+/**
+ * Restore request payload
+ */
+export const zRestoreBody = zBackupRestorePayload;
+
+export const zRestoreHeaders = z.object({
+  'X-Setup-Token': z.string().optional(),
+});
+
+/**
+ * Success
+ */
+export const zRoleListResponse = z.array(zPortainerRole);
+
+/**
+ * Success
+ */
+export const zSettingsInspectResponse = zPortainerSettings;
+
+/**
+ * New settings
+ */
+export const zSettingsUpdateBody = zSettingsSettingsUpdatePayload;
+
+/**
+ * Success
+ */
+export const zSettingsUpdateResponse = zPortainerSettings;
+
+/**
+ * Success
+ */
+export const zSettingsPublicResponse = zSettingsPublicSettingsResponse;
+
+/**
+ * Success
+ */
+export const zSslInspectResponse = zPortainerSslSettings;
+
+/**
+ * SSL Settings
+ */
+export const zSslUpdateBody = zSslSslUpdatePayload;
+
+/**
+ * Success
+ */
+export const zSslUpdateResponse = z.void();
+
+export const zStackListQuery = z.object({
+  filters: z.string().optional(),
+});
+
+export const zStackListResponse = z.union([z.array(zPortainerStack), z.void()]);
+
+export const zStackDeletePath = z.object({
+  id: z.int(),
+});
+
+export const zStackDeleteQuery = z.object({
+  external: z.boolean().optional(),
+  endpointId: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zStackDeleteResponse = z.void();
+
+export const zStackInspectPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zStackInspectResponse = zStacksStackResponse;
+
+/**
+ * Stack details
+ */
+export const zStackUpdateBody = zStacksUpdateSwarmStackPayload;
+
+export const zStackUpdatePath = z.object({
+  id: z.int(),
+});
+
+export const zStackUpdateQuery = z.object({
+  endpointId: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zStackUpdateResponse = zPortainerStack;
+
+export const zStackAssociatePath = z.object({
+  id: z.int(),
+});
+
+export const zStackAssociateQuery = z.object({
+  endpointId: z.int(),
+  swarmId: z.int(),
+  orphanedRunning: z.boolean(),
+});
+
+/**
+ * Success
+ */
+export const zStackAssociateResponse = zPortainerStack;
+
+export const zStackFileInspectPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zStackFileInspectResponse = zStacksStackFileResponse;
+
+/**
+ * Git configs for pull and redeploy a stack
+ */
+export const zStackUpdateGitBody = zStacksStackGitUpdatePayload;
+
+export const zStackUpdateGitPath = z.object({
+  id: z.int(),
+});
+
+export const zStackUpdateGitQuery = z.object({
+  endpointId: z.int().optional(),
+});
+
+/**
+ * Success
+ */
+export const zStackUpdateGitResponse = zStacksStackResponse;
+
+/**
+ * Git configs for pull and redeploy of a stack. **StackName** may only be populated for Kuberenetes stacks, and if specified with a blank string, it will be set to blank
+ */
+export const zStackGitRedeployBody = zStacksStackGitRedeployPayload;
+
+export const zStackGitRedeployPath = z.object({
+  id: z.int(),
+});
+
+export const zStackGitRedeployQuery = z.object({
+  endpointId: z.int().optional(),
+});
+
+/**
+ * Success
+ */
+export const zStackGitRedeployResponse = zPortainerStack;
+
+/**
+ * Stack migration details
+ */
+export const zStackMigrateBody = zStacksStackMigratePayload;
+
+export const zStackMigratePath = z.object({
+  id: z.int(),
+});
+
+export const zStackMigrateQuery = z.object({
+  endpointId: z.int().optional(),
+});
+
+/**
+ * Success
+ */
+export const zStackMigrateResponse = zPortainerStack;
+
+export const zStackStartPath = z.object({
+  id: z.int(),
+});
+
+export const zStackStartQuery = z.object({
+  endpointId: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zStackStartResponse = zPortainerStack;
+
+export const zStackStopPath = z.object({
+  id: z.int(),
+});
+
+export const zStackStopQuery = z.object({
+  endpointId: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zStackStopResponse = zPortainerStack;
+
+/**
+ * stack config
+ */
+export const zStackCreateKubernetesGitBody =
+  zStacksKubernetesGitDeploymentPayload;
+
+export const zStackCreateKubernetesGitQuery = z.object({
+  endpointId: z.int(),
+});
+
+/**
+ * OK
+ */
+export const zStackCreateKubernetesGitResponse = zPortainerStack;
+
+/**
+ * stack config
+ */
+export const zStackCreateKubernetesFileBody =
+  zStacksKubernetesStringDeploymentPayload;
+
+export const zStackCreateKubernetesFileQuery = z.object({
+  endpointId: z.int(),
+});
+
+/**
+ * OK
+ */
+export const zStackCreateKubernetesFileResponse = zPortainerStack;
+
+/**
+ * stack config
+ */
+export const zStackCreateKubernetesUrlBody =
+  zStacksKubernetesManifestUrlDeploymentPayload;
+
+export const zStackCreateKubernetesUrlQuery = z.object({
+  endpointId: z.int(),
+});
+
+/**
+ * OK
+ */
+export const zStackCreateKubernetesUrlResponse = zPortainerStack;
+
+export const zStackCreateDockerStandaloneFileBody = z.object({
+  Name: z.string(),
+  Env: z.string().optional(),
+  file: z.union([z.instanceof(Blob), z.instanceof(File)]).optional(),
+});
+
+export const zStackCreateDockerStandaloneFileQuery = z.object({
+  endpointId: z.int(),
+});
+
+/**
+ * OK
+ */
+export const zStackCreateDockerStandaloneFileResponse = zPortainerStack;
+
+/**
+ * stack config
+ */
+export const zStackCreateDockerStandaloneRepositoryBody =
+  zStacksComposeStackFromGitRepositoryPayload;
+
+export const zStackCreateDockerStandaloneRepositoryQuery = z.object({
+  endpointId: z.int(),
+});
+
+/**
+ * OK
+ */
+export const zStackCreateDockerStandaloneRepositoryResponse = zPortainerStack;
+
+/**
+ * stack config
+ */
+export const zStackCreateDockerStandaloneStringBody =
+  zStacksComposeStackFromFileContentPayload;
+
+export const zStackCreateDockerStandaloneStringQuery = z.object({
+  endpointId: z.int(),
+});
+
+/**
+ * OK
+ */
+export const zStackCreateDockerStandaloneStringResponse = zPortainerStack;
+
+export const zStackCreateDockerSwarmFileBody = z.object({
+  Name: z.string().optional(),
+  SwarmID: z.string().optional(),
+  Env: z.string().optional(),
+  file: z.union([z.instanceof(Blob), z.instanceof(File)]).optional(),
+});
+
+export const zStackCreateDockerSwarmFileQuery = z.object({
+  endpointId: z.int(),
+});
+
+/**
+ * OK
+ */
+export const zStackCreateDockerSwarmFileResponse = zPortainerStack;
+
+/**
+ * stack config
+ */
+export const zStackCreateDockerSwarmRepositoryBody =
+  zStacksSwarmStackFromGitRepositoryPayload;
+
+export const zStackCreateDockerSwarmRepositoryQuery = z.object({
+  endpointId: z.int(),
+});
+
+/**
+ * OK
+ */
+export const zStackCreateDockerSwarmRepositoryResponse = zPortainerStack;
+
+/**
+ * stack config
+ */
+export const zStackCreateDockerSwarmStringBody =
+  zStacksSwarmStackFromFileContentPayload;
+
+export const zStackCreateDockerSwarmStringQuery = z.object({
+  endpointId: z.int(),
+});
+
+/**
+ * OK
+ */
+export const zStackCreateDockerSwarmStringResponse = zPortainerStack;
+
+export const zStackDeleteKubernetesByNamePath = z.object({
+  name: z.string(),
+});
+
+export const zStackDeleteKubernetesByNameQuery = z.object({
+  external: z.boolean().optional(),
+  endpointId: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zStackDeleteKubernetesByNameResponse = z.void();
+
+export const zWebhookInvokePath = z.object({
+  webhookID: z.string(),
+});
+
+/**
+ * Success
+ */
+export const zSystemInfoResponse = zSystemSystemInfoResponse;
+
+/**
+ * Success
+ */
+export const zSystemNodesCountResponse2 = zSystemNodesCountResponse;
+
+/**
+ * Success
+ */
+export const zSystemStatusResponse = zSystemStatus;
+
+/**
+ * Success
+ */
+export const zSystemUpgradeResponse = zSystemStatus;
+
+/**
+ * Success
+ */
+export const zSystemVersionResponse2 = zSystemVersionResponse;
+
+/**
+ * Success
+ */
+export const zTagListResponse = z.array(zPortainerTag);
+
+/**
+ * Tag details
+ */
+export const zTagCreateBody = zTagsTagCreatePayload;
+
+/**
+ * Success
+ */
+export const zTagCreateResponse = zPortainerTag;
+
+export const zTagDeletePath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zTagDeleteResponse = z.void();
+
+/**
+ * Success
+ */
+export const zTeamMembershipListResponse = z.array(zPortainerTeamMembership);
+
+/**
+ * Team membership details
+ */
+export const zTeamMembershipCreateBody =
+  zTeammembershipsTeamMembershipCreatePayload;
+
+/**
+ * Success
+ */
+export const zTeamMembershipCreateResponse = zPortainerTeamMembership;
+
+export const zTeamMembershipDeletePath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zTeamMembershipDeleteResponse = z.void();
+
+/**
+ * Team membership details
+ */
+export const zTeamMembershipUpdateBody =
+  zTeammembershipsTeamMembershipUpdatePayload;
+
+export const zTeamMembershipUpdatePath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zTeamMembershipUpdateResponse = zPortainerTeamMembership;
+
+export const zTeamListQuery = z.object({
+  onlyLedTeams: z.boolean().optional(),
+  environmentId: z.int().optional(),
+});
+
+/**
+ * Success
+ */
+export const zTeamListResponse = z.array(zPortainerTeam);
+
+/**
+ * details
+ */
+export const zTeamCreateBody = zTeamsTeamCreatePayload;
+
+/**
+ * Success
+ */
+export const zTeamCreateResponse = zPortainerTeam;
+
+export const zTeamDeletePath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zTeamDeleteResponse = z.void();
+
+export const zTeamInspectPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zTeamInspectResponse = zPortainerTeam;
+
+/**
+ * Team details
+ */
+export const zTeamUpdateBody = zTeamsTeamUpdatePayload;
+
+export const zTeamUpdatePath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zTeamUpdateResponse = zPortainerTeam;
+
+export const zTeamMembershipsPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zTeamMembershipsResponse = z.array(zPortainerTeamMembership);
+
+/**
+ * Success
+ */
+export const zTemplateListResponse = zTemplatesListResponse;
+
+export const zTemplateFilePath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zTemplateFileResponse = zTemplatesFileResponse;
+
+export const zHelmRepoSearchQuery = z.object({
+  repo: z.string(),
+  chart: z.string().optional(),
+  useCache: z.string().optional(),
+});
+
+/**
+ * Success
+ */
+export const zHelmRepoSearchResponse = z.string();
+
+export const zHelmShowPath = z.object({
+  command: z.string(),
+});
+
+export const zHelmShowQuery = z.object({
+  repo: z.string(),
+  chart: z.string(),
+  version: z.string().optional(),
+});
+
+/**
+ * Success
+ */
+export const zHelmShowResponse = z.string();
+
+export const zUploadTlsBody = z.object({
+  folder: z.string(),
+  file: z.union([z.instanceof(Blob), z.instanceof(File)]),
+});
+
+export const zUploadTlsPath = z.object({
+  certificate: z.enum(['ca', 'cert', 'key']),
+});
+
+/**
+ * Success
+ */
+export const zUploadTlsResponse = z.void();
+
+export const zUserListQuery = z.object({
+  environmentId: z.int().optional(),
+});
+
+/**
+ * Success
+ */
+export const zUserListResponse = z.array(zPortainerUser);
+
+/**
+ * User details
+ */
+export const zUserCreateBody = zUsersUserCreatePayload;
+
+/**
+ * Success
+ */
+export const zUserCreateResponse = zPortainerUser;
+
+export const zUserDeletePath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zUserDeleteResponse = z.void();
+
+export const zUserInspectPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zUserInspectResponse = zPortainerUser;
+
+/**
+ * User details
+ */
+export const zUserUpdateBody = zUsersUserUpdatePayload;
+
+export const zUserUpdatePath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zUserUpdateResponse = zPortainerUser;
+
+export const zUserEffectiveAccessInspectPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zUserEffectiveAccessInspectResponse = z.array(
+  zUsersEffectiveAccessEntry
+);
+
+export const zHelmUserRepositoriesListPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zHelmUserRepositoriesListResponse =
+  zUsersHelmUserRepositoryResponse;
+
+/**
+ * Helm Repository
+ */
+export const zHelmUserRepositoryCreateBody = zUsersAddHelmRepoUrlPayload;
+
+export const zHelmUserRepositoryCreatePath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zHelmUserRepositoryCreateResponse = zPortainerHelmUserRepository;
+
+export const zHelmUserRepositoryDeletePath = z.object({
+  id: z.int(),
+  repositoryID: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zHelmUserRepositoryDeleteResponse = z.void();
+
+export const zUserMembershipsInspectPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zUserMembershipsInspectResponse = zPortainerTeamMembership;
+
+/**
+ * details
+ */
+export const zUserUpdatePasswordBody = zUsersUserUpdatePasswordPayload;
+
+export const zUserUpdatePasswordPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zUserUpdatePasswordResponse = z.void();
+
+export const zUserGetApiKeysPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zUserGetApiKeysResponse = z.array(zPortainerApiKey);
+
+/**
+ * details
+ */
+export const zUserGenerateApiKeyBody = zUsersUserAccessTokenCreatePayload;
+
+export const zUserGenerateApiKeyPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zUserGenerateApiKeyResponse = zUsersAccessTokenResponse;
+
+export const zUserRemoveApiKeyPath = z.object({
+  id: z.int(),
+  keyID: z.int(),
+});
+
+/**
+ * Success
+ */
+export const zUserRemoveApiKeyResponse = z.void();
+
+/**
+ * Success
+ */
+export const zUserAdminCheckResponse = z.void();
+
+/**
+ * User details
+ */
+export const zUserAdminInitBody = zUsersAdminInitPayload;
+
+export const zUserAdminInitHeaders = z.object({
+  'X-Setup-Token': z.string().optional(),
+});
+
+/**
+ * Success
+ */
+export const zUserAdminInitResponse = zPortainerUser;
+
+/**
+ * Success
+ */
+export const zCurrentUserInspectResponse = zPortainerUser;
+
+export const zGetWebhooksQuery = z.object({
+  filters: z.string().optional(),
+});
+
+/**
+ * OK
+ */
+export const zGetWebhooksResponse = z.array(zPortainerWebhook);
+
+/**
+ * Webhook data
+ */
+export const zPostWebhooksBody = zWebhooksWebhookCreatePayload;
+
+/**
+ * OK
+ */
+export const zPostWebhooksResponse = zPortainerWebhook;
+
+export const zDeleteWebhooksByIdPath = z.object({
+  id: z.int(),
+});
+
+export const zPostWebhooksByIdPath = z.object({
+  id: z.string(),
+});
+
+/**
+ * Webhook data
+ */
+export const zPutWebhooksByIdBody = zWebhooksWebhookUpdatePayload;
+
+export const zPutWebhooksByIdPath = z.object({
+  id: z.int(),
+});
+
+/**
+ * OK
+ */
+export const zPutWebhooksByIdResponse = zPortainerWebhook;
+
+export const zGetWebsocketAttachQuery = z.object({
+  endpointId: z.int(),
+  nodeName: z.string().optional(),
+});
+
+export const zGetWebsocketExecQuery = z.object({
+  endpointId: z.int(),
+  nodeName: z.string().optional(),
+});
+
+export const zGetWebsocketKubernetesShellQuery = z.object({
+  endpointId: z.int(),
+});
+
+export const zGetWebsocketPodQuery = z.object({
+  endpointId: z.int(),
+  namespace: z.string(),
+  podName: z.string(),
+  containerName: z.string(),
+  command: z.string(),
+});
diff --git a/app/react/portainer/gitops/AdditionalFilesField.tsx b/app/react/portainer/gitops/AdditionalFilesField.tsx
new file mode 100644
index 0000000..51a9f95
--- /dev/null
+++ b/app/react/portainer/gitops/AdditionalFilesField.tsx
@@ -0,0 +1,62 @@
+import { FormikErrors } from 'formik';
+
+import { useStateWrapper } from '@/react/hooks/useStateWrapper';
+
+import { FormError } from '@@/form-components/FormError';
+import { InputGroup } from '@@/form-components/InputGroup';
+import { InputList, ItemProps } from '@@/form-components/InputList';
+
+interface Props {
+  value: Array<string>;
+  onChange: (value: Array<string>) => void;
+  errors?: FormikErrors<string>[] | string | string[];
+}
+
+export function AdditionalFileField({ onChange, value, errors }: Props) {
+  return (
+    <InputList
+      errors={errors}
+      label="Additional paths"
+      onChange={onChange}
+      value={value}
+      addLabel="Add file"
+      item={Item}
+      itemBuilder={() => ''}
+      data-cy="gitops-additional-files"
+    />
+  );
+}
+
+function Item({
+  item,
+  onChange,
+  disabled,
+  error,
+  readOnly,
+  index,
+}: ItemProps<string>) {
+  const [inputValue, updateInputValue] = useStateWrapper(item, onChange);
+
+  return (
+    <div className="relative flex flex-col">
+      <InputGroup size="small">
+        <InputGroup.Addon>path</InputGroup.Addon>
+        <InputGroup.Input
+          required
+          disabled={disabled}
+          readOnly={readOnly}
+          value={inputValue}
+          onChange={(e) => {
+            updateInputValue(e.target.value);
+          }}
+          data-cy={`gitops-additional-files_${index}`}
+        />
+      </InputGroup>
+      {error && (
+        <div className="absolute -bottom-7">
+          <FormError>{error}</FormError>
+        </div>
+      )}
+    </div>
+  );
+}
diff --git a/app/react/portainer/gitops/AutoUpdateFieldset/AutoUpdateFieldset.tsx b/app/react/portainer/gitops/AutoUpdateFieldset/AutoUpdateFieldset.tsx
new file mode 100644
index 0000000..37d3944
--- /dev/null
+++ b/app/react/portainer/gitops/AutoUpdateFieldset/AutoUpdateFieldset.tsx
@@ -0,0 +1,84 @@
+import { FormikErrors } from 'formik';
+
+import { AutoUpdateModel } from '@/react/portainer/gitops/types';
+
+import { SwitchField } from '@@/form-components/SwitchField';
+import { InsightsBox } from '@@/InsightsBox';
+
+import { AutoUpdateSettings } from './AutoUpdateSettings';
+
+export function AutoUpdateFieldset({
+  value,
+  onChange,
+  environmentType,
+  isForcePullVisible = true,
+  errors,
+  baseWebhookUrl,
+  webhookId,
+  webhooksDocs,
+}: {
+  value: AutoUpdateModel;
+  onChange: (value: AutoUpdateModel) => void;
+  environmentType?: 'DOCKER' | 'KUBERNETES';
+  isForcePullVisible?: boolean;
+  errors?: FormikErrors<AutoUpdateModel>;
+  baseWebhookUrl: string;
+  webhookId: string;
+  webhooksDocs?: string;
+}) {
+  return (
+    <>
+      <div className="form-group">
+        <div className="col-sm-12">
+          <SwitchField
+            name="autoUpdate"
+            data-cy="gitops-auto-update-switch"
+            checked={value.RepositoryAutomaticUpdates}
+            label="GitOps updates"
+            tooltip="When enabled, at each polling interval or webhook invocation, if the
+              git repo differs from what was stored locally on the last git pull,
+              the changes are deployed."
+            labelClass="col-sm-3 col-lg-2"
+            onChange={(value) =>
+              handleChange({ RepositoryAutomaticUpdates: value })
+            }
+          />
+        </div>
+      </div>
+
+      <InsightsBox
+        content={
+          <p>
+            We&#39;ve renamed &quot;Automatic updates&quot; to better align with
+            industry terminology and clarify its purpose for all users.
+            Originally chosen during the early emergence of GitOps, the name has
+            changed, but the functionality remains unchanged. GitOps has rapidly
+            emerged as a revolutionary approach to managing infrastructure and
+            application changes, and we want to ensure our platform reflects the
+            latest advancements in the industry.
+          </p>
+        }
+        header="Meet ‘GitOps updates’ : Formerly known as Automatic updates"
+        insightCloseId="rename-gitops-updates"
+        className="mb-3"
+      />
+
+      {value.RepositoryAutomaticUpdates && (
+        <AutoUpdateSettings
+          webhookId={webhookId}
+          baseWebhookUrl={baseWebhookUrl}
+          value={value}
+          onChange={handleChange}
+          environmentType={environmentType}
+          showForcePullImage={isForcePullVisible}
+          errors={errors}
+          webhookDocs={webhooksDocs}
+        />
+      )}
+    </>
+  );
+
+  function handleChange(newValues: Partial<AutoUpdateModel>) {
+    onChange({ ...value, ...newValues });
+  }
+}
diff --git a/app/react/portainer/gitops/AutoUpdateFieldset/AutoUpdateSettings.tsx b/app/react/portainer/gitops/AutoUpdateFieldset/AutoUpdateSettings.tsx
new file mode 100644
index 0000000..dae4ed5
--- /dev/null
+++ b/app/react/portainer/gitops/AutoUpdateFieldset/AutoUpdateSettings.tsx
@@ -0,0 +1,122 @@
+import { FormikErrors } from 'formik';
+
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+import { type AutoUpdateModel } from '@/react/portainer/gitops/types';
+
+import { ButtonSelector } from '@@/form-components/ButtonSelector/ButtonSelector';
+import { FormControl } from '@@/form-components/FormControl';
+import { SwitchField } from '@@/form-components/SwitchField';
+import { TextTip } from '@@/Tip/TextTip';
+
+import { ForceDeploymentSwitch } from './ForceDeploymentSwitch';
+import { IntervalField } from './IntervalField';
+import { WebhookSettings } from './WebhookSettings';
+
+export function AutoUpdateSettings({
+  value,
+  onChange,
+  environmentType,
+  showForcePullImage,
+  errors,
+  baseWebhookUrl,
+  webhookId,
+  webhookDocs,
+}: {
+  value: AutoUpdateModel;
+  onChange: (value: Partial<AutoUpdateModel>) => void;
+  environmentType?: 'DOCKER' | 'KUBERNETES';
+  showForcePullImage: boolean;
+  errors?: FormikErrors<AutoUpdateModel>;
+  baseWebhookUrl: string;
+  webhookId: string;
+  webhookDocs?: string;
+}) {
+  return (
+    <>
+      <TextTip color="orange" className="mb-2">
+        Any changes to this stack or application that have been made locally via
+        Portainer or directly in the cluster will be overwritten by the git
+        repository content, which may cause service interruption.
+      </TextTip>
+
+      <FormControl label="Mechanism">
+        <ButtonSelector
+          size="small"
+          options={[
+            { value: 'Interval', label: 'Polling' },
+            { value: 'Webhook', label: 'Webhook' },
+          ]}
+          value={value.RepositoryMechanism || 'Interval'}
+          onChange={(value) => onChange({ RepositoryMechanism: value })}
+        />
+      </FormControl>
+
+      {value.RepositoryMechanism === 'Webhook' && (
+        <WebhookSettings
+          baseUrl={baseWebhookUrl}
+          value={webhookId}
+          docsLink={webhookDocs}
+        />
+      )}
+
+      {value.RepositoryMechanism === 'Interval' && (
+        <IntervalField
+          value={value.RepositoryFetchInterval || ''}
+          onChange={(value) => onChange({ RepositoryFetchInterval: value })}
+          errors={errors?.RepositoryFetchInterval}
+        />
+      )}
+
+      {showForcePullImage && (
+        <div className="form-group">
+          <div className="col-sm-12">
+            <SwitchField
+              name="forcePullImage"
+              data-cy="gitops-force-pull-image-switch"
+              featureId={FeatureId.STACK_PULL_IMAGE}
+              checked={value.ForcePullImage || false}
+              label="Re-pull image"
+              labelClass="col-sm-3 col-lg-2"
+              tooltip="If enabled, then when redeploy is triggered via the webhook or polling, if there's a newer image with the tag that you've specified (e.g. changeable development builds), it's pulled and redeployed. If you haven't specified a tag, or have specified 'latest' as the tag, then the image with the tag 'latest' is pulled and redeployed."
+              onChange={(value) => onChange({ ForcePullImage: value })}
+            />
+          </div>
+        </div>
+      )}
+
+      <ForceDeploymentSwitch
+        checked={value.RepositoryAutomaticUpdatesForce || false}
+        onChange={(value) =>
+          onChange({ RepositoryAutomaticUpdatesForce: value })
+        }
+        label={
+          environmentType === 'KUBERNETES' ? 'Always apply manifest' : undefined
+        }
+        tooltip={
+          environmentType === 'KUBERNETES' ? (
+            <>
+              <p>
+                If enabled, then when redeploy is triggered via the webhook or
+                polling, kubectl apply is always performed, even if Portainer
+                detects no difference between the git repo and what was stored
+                locally on last git pull.
+              </p>
+              <p>
+                This is useful if you want your git repo to be the source of
+                truth and are fine with changes made directly to resources in
+                the cluster being overwritten.
+              </p>
+            </>
+          ) : (
+            <p>
+              If enabled, then when redeploy is triggered via the webhook or
+              polling, the stack will be always redeployed, even if Portainer
+              detects no difference between the git repo and what was stored
+              locally on last git pull.
+            </p>
+          )
+        }
+      />
+    </>
+  );
+}
diff --git a/app/react/portainer/gitops/AutoUpdateFieldset/ForceDeploymentSwitch.tsx b/app/react/portainer/gitops/AutoUpdateFieldset/ForceDeploymentSwitch.tsx
new file mode 100644
index 0000000..449fa85
--- /dev/null
+++ b/app/react/portainer/gitops/AutoUpdateFieldset/ForceDeploymentSwitch.tsx
@@ -0,0 +1,34 @@
+import { ReactNode } from 'react';
+
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+
+import { SwitchField } from '@@/form-components/SwitchField';
+
+export function ForceDeploymentSwitch({
+  checked,
+  onChange,
+  tooltip = '',
+  label = 'Force redeployment',
+}: {
+  checked: boolean;
+  onChange: (value: boolean) => void;
+  tooltip?: ReactNode;
+  label?: string;
+}) {
+  return (
+    <div className="form-group">
+      <div className="col-sm-12">
+        <SwitchField
+          name="forceUpdate"
+          data-cy="gitops-force-redeployment-switch"
+          featureId={FeatureId.FORCE_REDEPLOYMENT}
+          checked={checked}
+          label={label}
+          tooltip={tooltip}
+          labelClass="col-sm-3 col-lg-2"
+          onChange={onChange}
+        />
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/portainer/gitops/AutoUpdateFieldset/IntervalField.test.ts b/app/react/portainer/gitops/AutoUpdateFieldset/IntervalField.test.ts
new file mode 100644
index 0000000..ab9267b
--- /dev/null
+++ b/app/react/portainer/gitops/AutoUpdateFieldset/IntervalField.test.ts
@@ -0,0 +1,38 @@
+import { describe, it, expect } from 'vitest';
+
+import { intervalValidation } from './IntervalField';
+
+describe('intervalValidation', () => {
+  it('rejects empty value with invalid duration format message', async () => {
+    const schema = intervalValidation();
+    await expect(schema.validate('')).rejects.toThrow(
+      'Invalid duration format. Use formats like 5m, 1h30m, 7d, or 300s'
+    );
+  });
+
+  it('accepts simple minute values', async () => {
+    const schema = intervalValidation();
+    await expect(schema.validate('1m')).resolves.toBe('1m');
+    await expect(schema.validate('5m')).resolves.toBe('5m');
+  });
+
+  it('accepts complex duration values', async () => {
+    const schema = intervalValidation();
+    await expect(schema.validate('6h40m')).resolves.toBe('6h40m');
+  });
+
+  it('accepts seconds >= 60s (treated as >= 1 minute)', async () => {
+    const schema = intervalValidation();
+    await expect(schema.validate('90s')).resolves.toBe('90s');
+  });
+
+  it('rejects sub-minute durations and invalid formats', async () => {
+    const schema = intervalValidation();
+    await expect(schema.validate('30s')).rejects.toThrow(
+      'Minimum interval is 1m'
+    );
+    await expect(schema.validate('abc')).rejects.toThrow(
+      'Invalid duration format. Use formats like 5m, 1h30m, 7d, or 300s'
+    );
+  });
+});
diff --git a/app/react/portainer/gitops/AutoUpdateFieldset/IntervalField.tsx b/app/react/portainer/gitops/AutoUpdateFieldset/IntervalField.tsx
new file mode 100644
index 0000000..87bdd19
--- /dev/null
+++ b/app/react/portainer/gitops/AutoUpdateFieldset/IntervalField.tsx
@@ -0,0 +1,55 @@
+import parse from 'parse-duration';
+
+import { durationValidation } from '@/react/utils/validation';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+import { useCaretPosition } from '@@/form-components/useCaretPosition';
+
+export function IntervalField({
+  onChange,
+  value,
+  errors,
+}: {
+  value: string;
+  onChange: (value: string) => void;
+  errors?: string;
+}) {
+  const { ref, updateCaret } = useCaretPosition();
+
+  return (
+    <FormControl
+      label="Fetch interval"
+      inputId="repository_fetch_interval"
+      tooltip="Specify how frequently polling occurs using syntax such as, 5m = 5 minutes, 24h = 24 hours, 6h40m = 6 hours and 40 minutes."
+      required
+      errors={errors}
+    >
+      <Input
+        mRef={ref}
+        data-cy="repository-fetch-interval-input"
+        id="repository_fetch_interval"
+        name="repository_fetch_interval"
+        placeholder="5m"
+        required
+        value={value}
+        onChange={(e) => {
+          onChange(e.target.value);
+          updateCaret();
+        }}
+      />
+    </FormControl>
+  );
+}
+
+export function intervalValidation() {
+  return durationValidation(false) // Don't allow empty - field is required
+    .required('This field is required.')
+    .test('minimumInterval', 'Minimum interval is 1m', (value) => {
+      if (!value) {
+        return false;
+      }
+      const minutes = parse(value, 'minute');
+      return minutes !== null && minutes >= 1;
+    });
+}
diff --git a/app/react/portainer/gitops/AutoUpdateFieldset/WebhookSettings.tsx b/app/react/portainer/gitops/AutoUpdateFieldset/WebhookSettings.tsx
new file mode 100644
index 0000000..3ad706a
--- /dev/null
+++ b/app/react/portainer/gitops/AutoUpdateFieldset/WebhookSettings.tsx
@@ -0,0 +1,52 @@
+import { truncateLeftRight } from '@/portainer/filters/filters';
+
+import { HelpLink } from '@@/HelpLink';
+import { CopyButton } from '@@/buttons';
+import { FormControl } from '@@/form-components/FormControl';
+
+export function WebhookSettings({
+  value,
+  baseUrl,
+  docsLink,
+}: {
+  docsLink?: string;
+  value: string;
+  baseUrl: string;
+}) {
+  const url = `${baseUrl}/${value}`;
+
+  return (
+    <FormControl
+      label="Webhook"
+      tooltip={
+        !!docsLink && (
+          <>
+            See{' '}
+            <HelpLink docLink={docsLink}>
+              Portainer documentation on webhook usage
+            </HelpLink>
+            .
+          </>
+        )
+      }
+    >
+      <div className="flex items-center gap-2">
+        <span
+          className="text-muted"
+          aria-label="webhook url"
+          role="textbox"
+          aria-readonly
+        >
+          {truncateLeftRight(url)}
+        </span>
+        <CopyButton
+          copyText={url}
+          color="light"
+          data-cy="copy-webhook-link-button"
+        >
+          Copy link
+        </CopyButton>
+      </div>
+    </FormControl>
+  );
+}
diff --git a/app/react/portainer/gitops/AutoUpdateFieldset/index.ts b/app/react/portainer/gitops/AutoUpdateFieldset/index.ts
new file mode 100644
index 0000000..dd26b4c
--- /dev/null
+++ b/app/react/portainer/gitops/AutoUpdateFieldset/index.ts
@@ -0,0 +1 @@
+export { AutoUpdateFieldset } from './AutoUpdateFieldset';
diff --git a/app/react/portainer/gitops/AutoUpdateFieldset/utils.ts b/app/react/portainer/gitops/AutoUpdateFieldset/utils.ts
new file mode 100644
index 0000000..e87af9b
--- /dev/null
+++ b/app/react/portainer/gitops/AutoUpdateFieldset/utils.ts
@@ -0,0 +1,72 @@
+export type AutoUpdateMechanism = 'Webhook' | 'Interval';
+export interface AutoUpdateResponse {
+  /* Auto update interval */
+  Interval: string;
+
+  /* A UUID generated from client */
+  Webhook: string;
+
+  /* Force update ignores repo changes */
+  ForceUpdate: boolean;
+
+  /* Pull latest image */
+  ForcePullImage: boolean;
+}
+
+export type AutoUpdateModel = {
+  RepositoryAutomaticUpdates: boolean;
+  RepositoryMechanism: AutoUpdateMechanism;
+  RepositoryFetchInterval: string;
+  ForcePullImage: boolean;
+  RepositoryAutomaticUpdatesForce: boolean;
+};
+
+export function getDefaultAutoUpdateValues(): AutoUpdateModel {
+  return {
+    RepositoryAutomaticUpdates: false,
+    RepositoryAutomaticUpdatesForce: false,
+    RepositoryMechanism: 'Interval',
+    RepositoryFetchInterval: '5m',
+    ForcePullImage: false,
+  };
+}
+
+export function parseAutoUpdateResponse(
+  response?: AutoUpdateResponse | null
+): AutoUpdateModel {
+  if (!response || (!response?.Interval && !response?.Webhook)) {
+    return getDefaultAutoUpdateValues();
+  }
+
+  return {
+    RepositoryAutomaticUpdates: true,
+    RepositoryMechanism: response.Interval ? 'Interval' : 'Webhook',
+    RepositoryFetchInterval: response.Interval || '',
+    RepositoryAutomaticUpdatesForce: response.ForceUpdate,
+    ForcePullImage: response.ForcePullImage,
+  };
+}
+
+export function transformAutoUpdateViewModel(
+  viewModel: AutoUpdateModel | undefined,
+  webhookId: string | undefined
+): AutoUpdateResponse | null {
+  if (!viewModel || !viewModel.RepositoryAutomaticUpdates) {
+    return null;
+  }
+
+  if (viewModel.RepositoryMechanism === 'Webhook' && !webhookId) {
+    throw new Error('Webhook ID is required');
+  }
+
+  return {
+    Interval:
+      viewModel.RepositoryMechanism === 'Interval'
+        ? viewModel.RepositoryFetchInterval
+        : '',
+    Webhook:
+      viewModel.RepositoryMechanism === 'Webhook' && webhookId ? webhookId : '',
+    ForceUpdate: viewModel.RepositoryAutomaticUpdatesForce,
+    ForcePullImage: viewModel.ForcePullImage,
+  };
+}
diff --git a/app/react/portainer/gitops/AutoUpdateFieldset/validation.ts b/app/react/portainer/gitops/AutoUpdateFieldset/validation.ts
new file mode 100644
index 0000000..45577ba
--- /dev/null
+++ b/app/react/portainer/gitops/AutoUpdateFieldset/validation.ts
@@ -0,0 +1,28 @@
+import { string, boolean, object, SchemaOf, mixed } from 'yup';
+
+import { AutoUpdateMechanism, AutoUpdateModel } from '../types';
+
+import { intervalValidation } from './IntervalField';
+
+export function autoUpdateValidation(): SchemaOf<AutoUpdateModel> {
+  return object({
+    RepositoryAutomaticUpdates: boolean().default(false),
+    RepositoryAutomaticUpdatesForce: boolean().default(false),
+    RepositoryMechanism: mixed<AutoUpdateMechanism>()
+      .oneOf(['Interval', 'Webhook'])
+      .when('RepositoryAutomaticUpdates', {
+        is: true,
+        then: string().required(),
+      })
+      .default('Interval'),
+    RepositoryFetchInterval: string()
+      .default('')
+      .when(['RepositoryAutomaticUpdates', 'RepositoryMechanism'], {
+        is: (autoUpdates: boolean, mechanism: AutoUpdateMechanism) =>
+          autoUpdates && mechanism === 'Interval',
+        then: intervalValidation(),
+      }),
+    RepositoryWebhookId: string().default(''),
+    ForcePullImage: boolean().default(false),
+  });
+}
diff --git a/app/react/portainer/gitops/ComposePathField/ComposePathField.test.tsx b/app/react/portainer/gitops/ComposePathField/ComposePathField.test.tsx
new file mode 100644
index 0000000..4e58398
--- /dev/null
+++ b/app/react/portainer/gitops/ComposePathField/ComposePathField.test.tsx
@@ -0,0 +1,166 @@
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { vi } from 'vitest';
+
+import { GitFormModel } from '../types';
+
+import { ComposePathField } from './ComposePathField';
+
+// Mock the feature flags
+vi.mock('../../feature-flags/feature-flags.service', () => ({
+  isBE: false,
+}));
+
+// Mock the PathSelector component
+vi.mock('./PathSelector', () => ({
+  PathSelector: vi.fn(({ value, onChange, placeholder, inputId }) => (
+    <input
+      value={value}
+      onChange={(e) => onChange(e.target.value)}
+      placeholder={placeholder}
+      id={inputId}
+      data-testid="path-selector"
+    />
+  )),
+}));
+
+const defaultProps = {
+  value: '',
+  onChange: vi.fn(),
+  isCompose: true,
+  model: {
+    SourceId: 1,
+    ComposeFilePathInRepository: 'docker-compose.yml',
+  } as GitFormModel,
+  isDockerStandalone: false,
+};
+
+describe('ComposePathField', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('should render with default props', () => {
+    render(<ComposePathField {...defaultProps} />);
+
+    expect(screen.getByText('Compose path')).toBeInTheDocument();
+    expect(screen.getByRole('textbox')).toBeInTheDocument();
+    expect(
+      screen.getByPlaceholderText('docker-compose.yml')
+    ).toBeInTheDocument();
+  });
+
+  it('should show manifest path label when isCompose is false', () => {
+    render(<ComposePathField {...defaultProps} isCompose={false} />);
+
+    expect(screen.getByText('Manifest path')).toBeInTheDocument();
+    expect(screen.getByPlaceholderText('manifest.yml')).toBeInTheDocument();
+  });
+
+  it('should display compose file tip text', () => {
+    render(<ComposePathField {...defaultProps} />);
+
+    expect(
+      screen.getByText(/Indicate the path to the Compose/)
+    ).toBeInTheDocument();
+    expect(
+      screen.getByText(/requires a yaml, yml, json, or hcl file extension/)
+    ).toBeInTheDocument();
+  });
+
+  it('should display kubernetes manifest file tip text when not compose', () => {
+    render(<ComposePathField {...defaultProps} isCompose={false} />);
+
+    expect(screen.getByText(/Indicate the path to the/)).toBeInTheDocument();
+    expect(
+      screen.getByRole('link', { name: 'Kubernetes manifest file' })
+    ).toHaveAttribute(
+      'href',
+      'https://kubernetes.io/docs/concepts/overview/working-with-objects/'
+    );
+  });
+
+  it('should show Docker standalone tip when isDockerStandalone is true', () => {
+    render(<ComposePathField {...defaultProps} isDockerStandalone />);
+
+    expect(
+      screen.getByText(/To enable rebuilding of an image/)
+    ).toBeInTheDocument();
+    expect(screen.getByText('pull_policy: build')).toBeInTheDocument();
+    expect(
+      screen.getByRole('link', { name: 'Docker documentation' })
+    ).toHaveAttribute(
+      'href',
+      'https://docs.docker.com/compose/compose-file/#pull_policy'
+    );
+  });
+
+  it('should not show Docker standalone tip when isDockerStandalone is false', () => {
+    render(<ComposePathField {...defaultProps} isDockerStandalone={false} />);
+
+    expect(
+      screen.queryByText(/To enable rebuilding of an image/)
+    ).not.toBeInTheDocument();
+  });
+
+  it('should call onChange when input value changes', async () => {
+    const user = userEvent.setup();
+    const onChange = vi.fn();
+
+    render(<ComposePathField {...defaultProps} onChange={onChange} />);
+
+    const input = screen.getByRole('textbox');
+    await user.type(input, 'new-compose.yml');
+
+    expect(onChange).toHaveBeenCalled();
+  });
+
+  it('should display error message when provided', () => {
+    const errorMessage = 'Path is required';
+    render(<ComposePathField {...defaultProps} errors={errorMessage} />);
+
+    expect(screen.getByText(errorMessage)).toBeInTheDocument();
+  });
+
+  it('should show correct input id and data-cy attributes', () => {
+    render(<ComposePathField {...defaultProps} />);
+
+    const input = screen.getByRole('textbox');
+    expect(input).toHaveAttribute('id', 'stack_repository_path');
+    expect(input).toHaveAttribute('data-cy', 'stack-repository-path-input');
+  });
+
+  it('should display the current value in the input', () => {
+    const testValue = 'custom-compose.yml';
+    render(<ComposePathField {...defaultProps} value={testValue} />);
+
+    const input = screen.getByRole('textbox');
+    expect(input).toHaveValue(testValue);
+  });
+});
+
+describe('ComposePathField with Business Edition features', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('should render PathSelector when isBE is true', () => {
+    // Mock isBE to return true for this test
+    vi.doMock('../../feature-flags/feature-flags.service', () => ({
+      isBE: true,
+    }));
+
+    // Since we can't use dynamic imports in this test environment,
+    // we'll test the BE functionality by mocking the feature flag
+    // and verifying the PathSelector is called with correct props
+    const mockPathSelector = vi.fn(() => <div data-testid="path-selector" />);
+    vi.doMock('./PathSelector', () => ({
+      PathSelector: mockPathSelector,
+    }));
+
+    // Note: In a real scenario with BE features enabled,
+    // the PathSelector component would be rendered instead of the Input
+    // This test verifies the conditional rendering logic works correctly
+    expect(mockPathSelector).toBeDefined();
+  });
+});
diff --git a/app/react/portainer/gitops/ComposePathField/ComposePathField.tsx b/app/react/portainer/gitops/ComposePathField/ComposePathField.tsx
new file mode 100644
index 0000000..e1f2c75
--- /dev/null
+++ b/app/react/portainer/gitops/ComposePathField/ComposePathField.tsx
@@ -0,0 +1,94 @@
+import { useStateWrapper } from '@/react/hooks/useStateWrapper';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { TextTip } from '@@/Tip/TextTip';
+import { Input } from '@@/form-components/Input';
+
+import { GitFormModel } from '../types';
+import { isBE } from '../../feature-flags/feature-flags.service';
+
+import { PathSelector } from './PathSelector';
+
+interface Props {
+  errors?: string;
+  value: string;
+  onChange(value: string): void;
+  isCompose: boolean;
+  model: GitFormModel;
+  isDockerStandalone: boolean;
+}
+
+export function ComposePathField({
+  value,
+  onChange,
+  isCompose,
+  model,
+  isDockerStandalone,
+  errors,
+}: Props) {
+  const [inputValue, updateInputValue] = useStateWrapper(value, onChange);
+
+  return (
+    <div className="form-group">
+      <span className="col-sm-12">
+        <TextTip color="blue" className="mb-2">
+          <span>
+            Indicate the path to the{' '}
+            {isCompose ? (
+              'Compose'
+            ) : (
+              <a
+                href="https://kubernetes.io/docs/concepts/overview/working-with-objects/"
+                target="_blank"
+                rel="noopener noreferrer"
+              >
+                Kubernetes manifest file
+              </a>
+            )}{' '}
+            from the root of your repository (requires a yaml, yml, json, or hcl
+            file extension).
+          </span>
+          {isDockerStandalone && (
+            <span className="ml-2">
+              To enable rebuilding of an image if already present on Docker
+              standalone environments, include
+              <code>pull_policy: build</code> in your compose file as per{' '}
+              <a href="https://docs.docker.com/compose/compose-file/#pull_policy">
+                Docker documentation
+              </a>
+              .
+            </span>
+          )}
+        </TextTip>
+      </span>
+      <div className="col-sm-12">
+        <FormControl
+          label={isCompose ? 'Compose path' : 'Manifest path'}
+          inputId="stack_repository_path"
+          required
+          errors={errors}
+        >
+          {isBE ? (
+            <PathSelector
+              value={value}
+              onChange={onChange}
+              placeholder={isCompose ? 'docker-compose.yml' : 'manifest.yml'}
+              model={model}
+              inputId="stack_repository_path"
+            />
+          ) : (
+            <Input
+              value={inputValue}
+              data-cy="stack-repository-path-input"
+              onChange={(e) => {
+                updateInputValue(e.target.value);
+              }}
+              placeholder={isCompose ? 'docker-compose.yml' : 'manifest.yml'}
+              id="stack_repository_path"
+            />
+          )}
+        </FormControl>
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/portainer/gitops/ComposePathField/PathSelector.tsx b/app/react/portainer/gitops/ComposePathField/PathSelector.tsx
new file mode 100644
index 0000000..bf7bf4a
--- /dev/null
+++ b/app/react/portainer/gitops/ComposePathField/PathSelector.tsx
@@ -0,0 +1,53 @@
+import { useSearch } from '@/react/portainer/gitops/queries/useSearch';
+
+import { AutocompleteSelect } from '@@/form-components/AutocompleteSelect';
+
+import { GitFormModel } from '../types';
+
+export type PathSelectorGitModel = Pick<
+  GitFormModel,
+  'RepositoryReferenceName' | 'SourceId'
+>;
+
+export function PathSelector({
+  value,
+  onChange,
+  placeholder,
+  model,
+  dirOnly,
+  readOnly,
+  inputId,
+}: {
+  value: string;
+  onChange(value: string): void;
+  placeholder: string;
+  model: PathSelectorGitModel;
+  dirOnly?: boolean;
+  readOnly?: boolean;
+  inputId: string;
+}) {
+  const payload = {
+    keyword: value,
+    reference: model.RepositoryReferenceName,
+    dirOnly,
+    sourceId: model.SourceId,
+  };
+
+  const enabled = !!(model.SourceId && value);
+  const { data: searchResults } = useSearch(payload, enabled);
+
+  return (
+    <AutocompleteSelect
+      searchResults={searchResults?.map((result) => ({
+        value: result,
+        label: result,
+      }))}
+      value={value}
+      onChange={onChange}
+      placeholder={placeholder}
+      readOnly={readOnly}
+      inputId={inputId}
+      data-cy="git-ops-path-selector"
+    />
+  );
+}
diff --git a/app/react/portainer/gitops/ComposePathField/index.ts b/app/react/portainer/gitops/ComposePathField/index.ts
new file mode 100644
index 0000000..7e185ea
--- /dev/null
+++ b/app/react/portainer/gitops/ComposePathField/index.ts
@@ -0,0 +1 @@
+export { ComposePathField } from './ComposePathField';
diff --git a/app/react/portainer/gitops/GitCommitLink.tsx b/app/react/portainer/gitops/GitCommitLink.tsx
new file mode 100644
index 0000000..a1dfc72
--- /dev/null
+++ b/app/react/portainer/gitops/GitCommitLink.tsx
@@ -0,0 +1,35 @@
+function cleanGitRepoUrl(url: string) {
+  return url
+    .trim() // remove leading and trailing whitespace
+    .replace(/\/$/, '') // if there's a trailing slash, remove it
+    .replace(/\.git$/, ''); // if there's a trailing .git extension, remove it
+}
+
+function getGitRepoCommitUrl(url: string, hash: string) {
+  const cleanedUrl = cleanGitRepoUrl(url);
+
+  if (cleanedUrl.startsWith('https://bitbucket.org')) {
+    return `${cleanedUrl}/commits/${hash}`;
+  }
+
+  // this is a fallback for any other git repo
+  // the tested repo includes gitlab, github, and azure devops
+  return `${cleanedUrl}/commit/${hash}`;
+}
+
+interface Props {
+  baseURL: string;
+  commitHash: string;
+}
+
+export function GitCommitLink({ baseURL, commitHash }: Props) {
+  return (
+    <a
+      href={getGitRepoCommitUrl(baseURL, commitHash)}
+      target="_blank"
+      rel="noopener noreferrer"
+    >
+      {commitHash.slice(0, 7)}
+    </a>
+  );
+}
diff --git a/app/react/portainer/gitops/GitForm.stories.tsx b/app/react/portainer/gitops/GitForm.stories.tsx
new file mode 100644
index 0000000..e3d8254
--- /dev/null
+++ b/app/react/portainer/gitops/GitForm.stories.tsx
@@ -0,0 +1,67 @@
+import { Meta } from '@storybook/react-webpack5';
+import { Form, Formik } from 'formik';
+
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+
+import { GitForm, buildGitValidationSchema } from './GitForm';
+import { DeployMethod, GitFormModel } from './types';
+
+export default {
+  component: GitForm,
+  title: 'Components/Forms/GitForm',
+} as Meta;
+
+const WrappedComponent = withUserProvider(GitForm);
+
+interface Args {
+  isAdditionalFilesFieldVisible: boolean;
+  isDockerStandalone: boolean;
+  deployMethod: DeployMethod;
+  isForcePullVisible: boolean;
+}
+
+export function Primary({
+  deployMethod,
+  isAdditionalFilesFieldVisible,
+  isDockerStandalone,
+  isForcePullVisible,
+}: Args) {
+  const initialValues: GitFormModel = {
+    SourceId: 0,
+    AdditionalFiles: [],
+    RepositoryReferenceName: '',
+    ComposeFilePathInRepository: '',
+  };
+
+  return (
+    <Formik
+      initialValues={initialValues}
+      validationSchema={() => buildGitValidationSchema(deployMethod)}
+      onSubmit={() => {}}
+    >
+      {({ values, errors, setValues }) => (
+        <Form className="form-horizontal">
+          <WrappedComponent
+            value={values}
+            errors={errors}
+            onChange={(value) => setValues({ ...values, ...value })}
+            isAdditionalFilesFieldVisible={isAdditionalFilesFieldVisible}
+            isDockerStandalone={isDockerStandalone}
+            isForcePullVisible={isForcePullVisible}
+            deployMethod={deployMethod}
+            baseWebhookUrl="ws://localhost:9000"
+            webhookId="1234"
+          />
+        </Form>
+      )}
+    </Formik>
+  );
+}
+
+Primary.args = {
+  isAdditionalFilesFieldVisible: true,
+  isAutoUpdateVisible: true,
+  isDockerStandalone: true,
+  isForcePullVisible: true,
+  deployMethod: 'compose',
+};
diff --git a/app/react/portainer/gitops/GitForm.tsx b/app/react/portainer/gitops/GitForm.tsx
new file mode 100644
index 0000000..283d94b
--- /dev/null
+++ b/app/react/portainer/gitops/GitForm.tsx
@@ -0,0 +1,141 @@
+import { useState } from 'react';
+import { array, number, object, SchemaOf, string } from 'yup';
+import { FormikErrors } from 'formik';
+
+import { ComposePathField } from '@/react/portainer/gitops/ComposePathField';
+import { RefField } from '@/react/portainer/gitops/RefField';
+import { DeployMethod, GitFormModel } from '@/react/portainer/gitops/types';
+import { TimeWindowDisplay } from '@/react/portainer/gitops/TimeWindowDisplay';
+import { GitSourceSelector } from '@/react/portainer/gitops/sources/GitSourceSelector';
+
+import { FormSection } from '@@/form-components/FormSection';
+import { validateForm } from '@@/form-components/validate-form';
+
+import { AdditionalFileField } from './AdditionalFilesField';
+import { AutoUpdateFieldset } from './AutoUpdateFieldset';
+import { autoUpdateValidation } from './AutoUpdateFieldset/validation';
+import { refFieldValidation } from './RefField/RefField';
+
+interface Props {
+  value: GitFormModel;
+  onChange: (value: Partial<GitFormModel>) => void;
+  environmentType?: 'DOCKER' | 'KUBERNETES' | undefined;
+  deployMethod?: DeployMethod;
+  isDockerStandalone?: boolean;
+  isAdditionalFilesFieldVisible?: boolean;
+  isForcePullVisible?: boolean;
+  errors?: FormikErrors<GitFormModel>;
+  baseWebhookUrl?: string;
+  webhookId?: string;
+  webhooksDocs?: string;
+  isAutoUpdateVisible?: boolean;
+}
+
+export function GitForm({
+  value: initialValue,
+  onChange,
+  environmentType = 'DOCKER',
+  deployMethod = 'compose',
+  isDockerStandalone = false,
+  isAdditionalFilesFieldVisible,
+  isForcePullVisible,
+  errors = {},
+  baseWebhookUrl,
+  webhookId,
+  webhooksDocs,
+  isAutoUpdateVisible = true,
+}: Props) {
+  const [value, setValue] = useState(initialValue); // TODO: remove this state when form is not inside angularjs
+
+  return (
+    <FormSection title="Git repository">
+      <GitSourceSelector
+        value={value.SourceId}
+        onChange={(source) =>
+          handleChange({
+            SourceId: source?.id,
+            RepositoryReferenceName: initialValue.RepositoryReferenceName,
+            ComposeFilePathInRepository:
+              initialValue.ComposeFilePathInRepository,
+          })
+        }
+        error={errors.SourceId}
+      />
+
+      <RefField
+        value={value.RepositoryReferenceName || ''}
+        onChange={(value) => handleChange({ RepositoryReferenceName: value })}
+        sourceId={value.SourceId}
+        error={errors.RepositoryReferenceName}
+      />
+
+      <ComposePathField
+        value={value.ComposeFilePathInRepository || ''}
+        onChange={(value) =>
+          handleChange({ ComposeFilePathInRepository: value || undefined })
+        }
+        isCompose={deployMethod === 'compose'}
+        model={value}
+        isDockerStandalone={isDockerStandalone}
+        errors={errors.ComposeFilePathInRepository}
+      />
+
+      {isAdditionalFilesFieldVisible && (
+        <AdditionalFileField
+          value={value.AdditionalFiles || []}
+          onChange={(value) => handleChange({ AdditionalFiles: value })}
+          errors={errors.AdditionalFiles}
+        />
+      )}
+
+      {isAutoUpdateVisible && value.AutoUpdate && (
+        <AutoUpdateFieldset
+          environmentType={environmentType}
+          webhookId={webhookId || ''}
+          baseWebhookUrl={baseWebhookUrl || ''}
+          value={value.AutoUpdate}
+          onChange={(value) => handleChange({ AutoUpdate: value })}
+          isForcePullVisible={isForcePullVisible}
+          errors={errors.AutoUpdate as FormikErrors<GitFormModel['AutoUpdate']>}
+          webhooksDocs={webhooksDocs}
+        />
+      )}
+
+      <TimeWindowDisplay />
+    </FormSection>
+  );
+
+  function handleChange(partialValue: Partial<GitFormModel>) {
+    onChange(partialValue);
+    setValue((value) => ({ ...value, ...partialValue }));
+  }
+}
+
+export async function validateGitForm(
+  formValues: GitFormModel,
+  deployMethod: DeployMethod = 'compose'
+) {
+  return validateForm<GitFormModel>(
+    () => buildGitValidationSchema(deployMethod),
+    formValues
+  );
+}
+
+export function buildGitValidationSchema(
+  deployMethod: DeployMethod
+): SchemaOf<GitFormModel> {
+  return object({
+    RepositoryURL: string().optional(),
+    RepositoryReferenceName: refFieldValidation(),
+    ComposeFilePathInRepository: string().required(
+      deployMethod === 'compose'
+        ? 'Compose file path is required'
+        : 'Manifest file path is required'
+    ),
+    AdditionalFiles: array(string().required('Path is required')).default([]),
+    AutoUpdate: autoUpdateValidation().nullable(),
+    SourceId: number()
+      .min(1, 'Source is required')
+      .required('Source is required'),
+  }) as SchemaOf<GitFormModel>;
+}
diff --git a/app/react/portainer/gitops/GitReferenceCard.test.tsx b/app/react/portainer/gitops/GitReferenceCard.test.tsx
new file mode 100644
index 0000000..2f8007e
--- /dev/null
+++ b/app/react/portainer/gitops/GitReferenceCard.test.tsx
@@ -0,0 +1,211 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import { HttpResponse } from 'msw';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { server, http } from '@/setup-tests/server';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+
+import { RepoConfigResponse } from './types';
+import { GitReferenceCard } from './GitReferenceCard';
+
+vi.mock('@/portainer/helpers/webhookHelper', () => ({
+  baseStackWebhookUrl: () => 'https://portainer.example/api/stacks/webhooks',
+}));
+
+const defaultGitConfig: RepoConfigResponse = {
+  URL: 'https://github.com/portainer/portainer-compose',
+  ReferenceName: 'refs/heads/main',
+  ConfigFilePath: 'docker-compose.yml',
+  ConfigHash: 'abc123def456',
+  TLSSkipVerify: false,
+};
+
+function renderCard(
+  overrides: Partial<Parameters<typeof GitReferenceCard>[0]> = {}
+) {
+  const Component = withTestQueryProvider(
+    withTestRouter(() => (
+      <GitReferenceCard
+        gitConfig={defaultGitConfig}
+        stackType="docker"
+        sourceId={1}
+        {...overrides}
+      />
+    ))
+  );
+  return render(<Component />);
+}
+
+describe('GitReferenceCard', () => {
+  beforeEach(() => {
+    server.use(
+      http.post('/api/gitops/repo/refs', () =>
+        HttpResponse.json(['refs/heads/main', 'refs/heads/develop'])
+      ),
+      http.post('/api/gitops/repo/files/search', () =>
+        HttpResponse.json(['docker-compose.yml'])
+      )
+    );
+  });
+
+  describe('Normal state (no divergence)', () => {
+    it('renders repo, ref, and file info from gitConfig', async () => {
+      renderCard();
+
+      await waitFor(() =>
+        expect(screen.getByRole('group', { name: 'Repo' })).toHaveTextContent(
+          defaultGitConfig.URL
+        )
+      );
+      expect(screen.getByRole('group', { name: 'Ref' })).toHaveTextContent(
+        defaultGitConfig.ReferenceName
+      );
+      expect(screen.getByRole('group', { name: 'File' })).toHaveTextContent(
+        defaultGitConfig.ConfigFilePath
+      );
+    });
+
+    it('does not show divergence alert when currentDeploymentInfo matches gitConfig', async () => {
+      renderCard({
+        currentDeploymentInfo: {
+          Version: 1,
+          FileVersion: 1,
+          RepositoryURL: defaultGitConfig.URL,
+          ReferenceName: defaultGitConfig.ReferenceName,
+          ConfigFilePath: defaultGitConfig.ConfigFilePath,
+        },
+      });
+
+      await waitFor(() =>
+        expect(screen.getByRole('group', { name: 'Repo' })).toHaveTextContent(
+          defaultGitConfig.URL
+        )
+      );
+      expect(
+        screen.queryByText('Settings changed since last deploy')
+      ).not.toBeInTheDocument();
+    });
+
+    it('shows auto-update as Off when not set', () => {
+      renderCard();
+      expect(
+        screen.getByRole('group', { name: 'Auto-update' })
+      ).toHaveTextContent('Off');
+    });
+
+    it('shows auto-update as On when autoUpdate is provided', async () => {
+      renderCard({
+        autoUpdate: {
+          Interval: '5m',
+          Webhook: '',
+          ForcePullImage: false,
+          ForceUpdate: false,
+        },
+      });
+
+      expect(
+        screen.getByRole('group', { name: 'Auto-update' })
+      ).toHaveTextContent('On');
+      expect(screen.getByRole('group', { name: 'Interval' })).toHaveTextContent(
+        '5m'
+      );
+    });
+  });
+
+  describe('Diverged state', () => {
+    it('shows divergence alert with next URL when URL changed', async () => {
+      renderCard({
+        currentDeploymentInfo: {
+          Version: 1,
+          FileVersion: 1,
+          RepositoryURL: 'https://github.com/portainer/old-repo',
+          ReferenceName: defaultGitConfig.ReferenceName,
+          ConfigFilePath: defaultGitConfig.ConfigFilePath,
+        },
+      });
+
+      await waitFor(() =>
+        expect(screen.getByRole('status')).toHaveTextContent(
+          'Settings changed since last deploy'
+        )
+      );
+      expect(screen.getByRole('status')).toHaveTextContent(
+        defaultGitConfig.URL
+      );
+    });
+
+    it('shows divergence alert when ReferenceName changed', async () => {
+      renderCard({
+        currentDeploymentInfo: {
+          Version: 1,
+          FileVersion: 1,
+          RepositoryURL: defaultGitConfig.URL,
+          ReferenceName: 'refs/heads/old-branch',
+          ConfigFilePath: defaultGitConfig.ConfigFilePath,
+        },
+      });
+
+      await waitFor(() =>
+        expect(screen.getByRole('status')).toHaveTextContent(
+          'Settings changed since last deploy'
+        )
+      );
+      expect(screen.getByRole('status')).toHaveTextContent(
+        defaultGitConfig.ReferenceName
+      );
+    });
+
+    it('shows deployed values in line items when diverged', async () => {
+      const deployedUrl = 'https://github.com/portainer/old-repo';
+      renderCard({
+        currentDeploymentInfo: {
+          Version: 1,
+          FileVersion: 1,
+          RepositoryURL: deployedUrl,
+          ReferenceName: defaultGitConfig.ReferenceName,
+          ConfigFilePath: defaultGitConfig.ConfigFilePath,
+        },
+      });
+
+      await waitFor(() =>
+        expect(screen.getByRole('group', { name: 'Repo' })).toHaveTextContent(
+          deployedUrl
+        )
+      );
+    });
+
+    it('always shows the next config file path in the divergence alert', async () => {
+      renderCard({
+        currentDeploymentInfo: {
+          Version: 1,
+          FileVersion: 1,
+          RepositoryURL: 'https://github.com/portainer/old-repo',
+          ReferenceName: defaultGitConfig.ReferenceName,
+          ConfigFilePath: defaultGitConfig.ConfigFilePath,
+        },
+      });
+
+      await waitFor(() =>
+        expect(screen.getByRole('status')).toHaveTextContent(
+          'Settings changed since last deploy'
+        )
+      );
+      expect(screen.getByRole('status')).toHaveTextContent(
+        defaultGitConfig.ConfigFilePath
+      );
+    });
+
+    it('does not show divergence alert when currentDeploymentInfo is null', async () => {
+      renderCard({ currentDeploymentInfo: null });
+
+      await waitFor(() =>
+        expect(screen.getByRole('group', { name: 'Repo' })).toHaveTextContent(
+          defaultGitConfig.URL
+        )
+      );
+      expect(
+        screen.queryByText('Settings changed since last deploy')
+      ).not.toBeInTheDocument();
+    });
+  });
+});
diff --git a/app/react/portainer/gitops/GitReferenceCard.tsx b/app/react/portainer/gitops/GitReferenceCard.tsx
new file mode 100644
index 0000000..2abb83f
--- /dev/null
+++ b/app/react/portainer/gitops/GitReferenceCard.tsx
@@ -0,0 +1,363 @@
+import { ReactNode } from 'react';
+import { CheckCircle, GitMerge, Loader2, XCircle } from 'lucide-react';
+
+import { truncateLeftRight } from '@/portainer/filters/filters';
+import { baseStackWebhookUrl } from '@/portainer/helpers/webhookHelper';
+import { GitCommitLink } from '@/react/portainer/gitops/GitCommitLink';
+import { useGitRefs } from '@/react/portainer/gitops/queries/useGitRefs';
+import { useSearch } from '@/react/portainer/gitops/queries/useSearch';
+import { isGitConfigDiverged } from '@/react/portainer/gitops/utils';
+import { AutomationTestingProps } from '@/types';
+import {
+  AutoUpdateResponse,
+  RepoConfigResponse,
+} from '@/react/portainer/gitops/types';
+import { StackDeploymentInfo } from '@/react/common/stacks/types';
+import { useSource } from '@/react/portainer/gitops/sources/queries/useSource';
+
+import { CopyButton } from '@@/buttons';
+import { Card } from '@@/primitives/Card';
+import { Icon } from '@@/Icon';
+import { Alert } from '@@/Alert';
+import { Link } from '@@/Link';
+
+import { getGitValidityError } from './hooks/useGitRepoValidity';
+
+export function GitReferenceCard({
+  stackType,
+  gitConfig,
+  autoUpdate,
+  currentDeploymentInfo,
+  sourceId,
+}: {
+  stackType: 'docker' | 'helm' | 'edge' | 'edge-helm' | 'kubernetes';
+  gitConfig: RepoConfigResponse;
+  autoUpdate?: AutoUpdateResponse | null;
+  currentDeploymentInfo?: StackDeploymentInfo | null;
+  sourceId: number;
+}) {
+  const hasDivergence = isGitConfigDiverged(gitConfig, currentDeploymentInfo);
+
+  const deployed = hasDivergence ? currentDeploymentInfo : undefined;
+  const url = deployed?.RepositoryURL ?? gitConfig.URL;
+  const configFilePath = deployed?.ConfigFilePath ?? gitConfig.ConfigFilePath;
+  const reference = deployed?.ReferenceName ?? gitConfig.ReferenceName;
+  const commitId = deployed?.ConfigHash ?? gitConfig.ConfigHash;
+  const sourceIdToShow = deployed?.SourceID ?? sourceId;
+
+  const refCheckQuery = useGitRefs(
+    {
+      sourceId: sourceIdToShow,
+    },
+    { enabled: !!sourceIdToShow, suppressError: true }
+  );
+
+  const repoError = getGitValidityError(
+    refCheckQuery.error,
+    !!gitConfig.Authentication
+  );
+  const hasRepoError = refCheckQuery.isError;
+
+  const foundRef =
+    !!reference &&
+    !!refCheckQuery.data &&
+    refCheckQuery.data.includes(reference);
+
+  const hasRefError = !reference || (refCheckQuery.isSuccess && !foundRef);
+
+  // check file
+  const enableFileCheck = stackType !== 'helm' && stackType !== 'edge-helm';
+  const fileCheckQuery = useSearch(
+    {
+      keyword: configFilePath || '',
+      reference,
+      sourceId: sourceIdToShow,
+    },
+    enableFileCheck &&
+      !!sourceIdToShow &&
+      !!reference &&
+      !!configFilePath &&
+      !hasRepoError &&
+      !hasRefError
+  );
+
+  const foundFile =
+    !!configFilePath &&
+    !!fileCheckQuery.data &&
+    fileCheckQuery.data.includes(configFilePath);
+
+  const hasFileError =
+    enableFileCheck &&
+    (!configFilePath ||
+      fileCheckQuery.isError ||
+      (fileCheckQuery.isFetched && !foundFile));
+
+  const { Interval: autoUpdateInterval, Webhook: webhook } = autoUpdate || {};
+  const webhookUrl = webhook ? `${baseStackWebhookUrl()}/${webhook}` : '';
+
+  const isRefLoading = refCheckQuery.isFetching;
+  const isFileLoading = enableFileCheck && fileCheckQuery.isFetching;
+
+  const hasError = hasRepoError || hasRefError || hasFileError;
+  const explainedError = getExplainedError(
+    refCheckQuery.error,
+    fileCheckQuery.error
+  );
+  const infoMessage = explainedError || repoError;
+
+  return (
+    <Card.Container variant="filled">
+      <Card.Body>
+        <div className="form-section-title !mt-0 flex items-center gap-2">
+          <Icon icon={GitMerge} /> Managed by Git
+        </div>
+        {hasError && (
+          <>
+            <Alert color="error" className="mb-5">
+              <div className="flex flex-col">
+                {hasRepoError && (
+                  <div>
+                    The git repository <span>{url || ''}</span> could not be
+                    reached.
+                  </div>
+                )}
+                {hasRefError && (
+                  <div>
+                    The git reference <span>{reference || ''}</span> could not
+                    be found on the remote repository.
+                  </div>
+                )}
+                {hasFileError && (
+                  <div>
+                    The referenced file{' '}
+                    <span className="muted">{configFilePath || ''}</span> could
+                    not be found on the remote repository.
+                  </div>
+                )}
+              </div>
+            </Alert>
+            {!!infoMessage && (
+              <Alert color="info" className="mb-5">
+                {infoMessage}
+              </Alert>
+            )}
+          </>
+        )}
+
+        <div
+          className="grid grid-cols-1 gap-x-6 gap-y-1 text-sm lg:grid-cols-2 xl:grid-cols-3"
+          data-cy="git-reference-card-info"
+        >
+          <LineItem
+            label="Repo"
+            value={url || 'missing'}
+            title={url || 'missing'}
+            isLoading={isRefLoading}
+            isValid={!!url && !hasRepoError}
+            isError={!url || hasRepoError}
+            data-cy="git-url"
+          />
+          <LineItem
+            label="Ref"
+            value={reference || 'missing'}
+            title={reference || 'missing'}
+            isLoading={isRefLoading}
+            isValid={foundRef}
+            isError={!reference || hasRefError}
+            data-cy="git-ref"
+          />
+          {enableFileCheck && (
+            <LineItem
+              label="File"
+              value={configFilePath || 'missing'}
+              title={configFilePath || 'missing'}
+              isLoading={isFileLoading}
+              isValid={foundFile}
+              isError={!configFilePath || hasFileError}
+              data-cy="git-file-path"
+            />
+          )}
+
+          {!!sourceIdToShow && <SourceLineItem sourceId={sourceIdToShow} />}
+          {!!commitId && (
+            <LineItem
+              label="Commit"
+              value={
+                <GitCommitLink baseURL={url || ''} commitHash={commitId} />
+              }
+              title={commitId}
+              data-cy="git-commit"
+            />
+          )}
+          <LineItem
+            label="Auto-update"
+            value={autoUpdate ? 'On' : 'Off'}
+            title="auto-update"
+            data-cy="git-auto-update"
+          />
+          {!!autoUpdateInterval && (
+            <LineItem
+              label="Interval"
+              value={autoUpdateInterval}
+              title="auto-update-interval"
+              data-cy="git-interval"
+            />
+          )}
+          {!!webhook && (
+            <LineItem
+              label="Webhook"
+              value={
+                <>
+                  <span data-cy="git-webhook-url">
+                    {truncateLeftRight(webhookUrl, 0, 10, 25)}
+                  </span>
+                  <CopyButton
+                    copyText={webhookUrl}
+                    color="light"
+                    data-cy="git-webhook-copy-button"
+                  >
+                    Copy link
+                  </CopyButton>
+                </>
+              }
+              title="webhook"
+              data-cy="git-webhook"
+            />
+          )}
+        </div>
+        {currentDeploymentInfo && hasDivergence && (
+          <DivergenceAlert
+            gitConfig={gitConfig}
+            currentDeploymentInfo={currentDeploymentInfo}
+          />
+        )}
+      </Card.Body>
+    </Card.Container>
+  );
+}
+
+function SourceLineItem({ sourceId }: { sourceId: number }) {
+  const sourceQuery = useSource(sourceId);
+  const sourceName = sourceQuery.data?.name;
+
+  return (
+    <LineItem
+      label="Source"
+      value={
+        sourceName ? (
+          <Link
+            to="portainer.gitops.sources.item"
+            params={{ sourceId }}
+            data-cy="git-source-link"
+          >
+            {sourceName}
+          </Link>
+        ) : sourceQuery.isLoading ? (
+          ''
+        ) : (
+          'not found'
+        )
+      }
+      title={sourceName ?? ''}
+      isLoading={sourceQuery.isLoading}
+      isError={sourceQuery.isError || (!sourceQuery.isLoading && !sourceName)}
+      isValid={!!sourceName}
+      data-cy="git-source"
+    />
+  );
+}
+
+function DivergenceAlert({
+  gitConfig,
+  currentDeploymentInfo,
+}: {
+  gitConfig: RepoConfigResponse;
+  currentDeploymentInfo: StackDeploymentInfo;
+}) {
+  const urlChanged =
+    typeof currentDeploymentInfo.RepositoryURL !== 'undefined' &&
+    currentDeploymentInfo.RepositoryURL !== gitConfig.URL;
+
+  const refChanged =
+    typeof currentDeploymentInfo.ReferenceName !== 'undefined' &&
+    currentDeploymentInfo.ReferenceName !== gitConfig.ReferenceName;
+
+  return (
+    <Alert color="info" className="mt-4">
+      <div className="flex flex-col gap-1 text-sm">
+        <strong>Settings changed since last deploy</strong>
+        <div>
+          Next: {urlChanged && <code>{gitConfig.URL ?? ''}</code>}{' '}
+          {refChanged && <code>{gitConfig.ReferenceName ?? ''}</code>} Config:{' '}
+          <code>{gitConfig.ConfigFilePath ?? ''}</code>
+        </div>
+      </div>
+    </Alert>
+  );
+}
+
+function getExplainedError(...errors: Array<unknown | null>) {
+  if (
+    errors.some(
+      (e) =>
+        e instanceof Error &&
+        e?.message.startsWith(
+          'Authentication required: Invalid username or token'
+        )
+    )
+  ) {
+    return 'The configured Git Credentials are invalid or expired. Update the credentials to restore access.';
+  }
+  return '';
+}
+
+function LineItem({
+  label,
+  isLoading,
+  isValid,
+  isError,
+  value,
+  title,
+  'data-cy': dataCy,
+}: {
+  label: string;
+  value: ReactNode;
+  title: string;
+  isLoading?: boolean;
+  isValid?: boolean;
+  isError?: boolean;
+} & AutomationTestingProps) {
+  return (
+    <div
+      role="group"
+      aria-label={label}
+      className="flex min-w-0 items-center gap-1"
+    >
+      <StateIcon isLoading={isLoading} isValid={isValid} isError={isError} />
+      <span className="text-muted">{label}:</span>
+      <span
+        className="inline-flex max-w-[40rem] flex-wrap items-center gap-1 truncate align-middle"
+        title={title}
+        data-cy={dataCy}
+      >
+        {value}
+      </span>
+    </div>
+  );
+}
+
+function StateIcon({
+  isLoading,
+  isValid,
+  isError,
+}: {
+  isLoading?: boolean;
+  isValid?: boolean;
+  isError?: boolean;
+}) {
+  if (isLoading)
+    return <Icon icon={Loader2} className="animate-spin" size="md" />;
+  if (isError) return <Icon icon={XCircle} mode="danger" size="md" />;
+  if (isValid) return <Icon icon={CheckCircle} mode="success" size="md" />;
+  return null;
+}
diff --git a/app/react/portainer/gitops/RefField/RefField.tsx b/app/react/portainer/gitops/RefField/RefField.tsx
new file mode 100644
index 0000000..b3d7788
--- /dev/null
+++ b/app/react/portainer/gitops/RefField/RefField.tsx
@@ -0,0 +1,100 @@
+import { PropsWithChildren, ReactNode } from 'react';
+import { SchemaOf, string } from 'yup';
+
+import { useStateWrapper } from '@/react/hooks/useStateWrapper';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+import { TextTip } from '@@/Tip/TextTip';
+
+import { isBE } from '../../feature-flags/feature-flags.service';
+
+import { RefSelector } from './RefSelector';
+
+interface Props {
+  value: string;
+  onChange(value: string): void;
+  sourceId?: number;
+  error?: string;
+}
+
+export function RefField({ value, onChange, sourceId, error }: Props) {
+  const [inputValue, updateInputValue] = useStateWrapper(value, onChange);
+  const inputId = 'repository-reference-field';
+  return isBE ? (
+    <Wrapper
+      inputId={inputId}
+      errors={error}
+      tip={
+        <>
+          Specify a reference of the repository using the following syntax:
+          branches with <code>refs/heads/branch_name</code> or tags with{' '}
+          <code>refs/tags/tag_name</code>.
+        </>
+      }
+    >
+      <RefSelector
+        inputId={inputId}
+        value={value}
+        onChange={onChange}
+        sourceId={sourceId}
+      />
+    </Wrapper>
+  ) : (
+    <Wrapper
+      inputId={inputId}
+      errors={error}
+      tip={
+        <>
+          Specify a reference of the repository using the following syntax:
+          branches with <code>refs/heads/branch_name</code> or tags with{' '}
+          <code>refs/tags/tag_name</code>. If not specified, will use the
+          default <code>HEAD</code> reference normally the <code>main</code>{' '}
+          branch.
+        </>
+      }
+    >
+      <Input
+        id={inputId}
+        data-cy="repository-reference-input"
+        value={inputValue}
+        onChange={(e) => updateInputValue(e.target.value)}
+        placeholder="refs/heads/main"
+      />
+    </Wrapper>
+  );
+}
+
+function Wrapper({
+  tip,
+  children,
+  errors,
+  inputId,
+}: PropsWithChildren<{ tip: ReactNode; errors?: string; inputId: string }>) {
+  return (
+    <div className="form-group">
+      <span className="col-sm-12 mb-2">
+        <TextTip color="blue">{tip}</TextTip>
+      </span>
+      <div className="col-sm-12">
+        <FormControl
+          label="Repository reference"
+          inputId={inputId}
+          required
+          errors={errors}
+        >
+          {children}
+        </FormControl>
+      </div>
+    </div>
+  );
+}
+
+export function refFieldValidation(): SchemaOf<string> {
+  return string()
+    .when({
+      is: isBE,
+      then: string().required('Repository reference name is required'),
+    })
+    .default('');
+}
diff --git a/app/react/portainer/gitops/RefField/RefSelector.tsx b/app/react/portainer/gitops/RefField/RefSelector.tsx
new file mode 100644
index 0000000..c0486aa
--- /dev/null
+++ b/app/react/portainer/gitops/RefField/RefSelector.tsx
@@ -0,0 +1,61 @@
+import { useGitRefs } from '@/react/portainer/gitops/queries/useGitRefs';
+
+import { PortainerSelect } from '@@/form-components/PortainerSelect';
+
+export function RefSelector({
+  sourceId,
+  value,
+  onChange,
+  inputId,
+}: {
+  sourceId?: number;
+  value: string;
+  onChange: (value: string) => void;
+  inputId: string;
+}) {
+  const { data: refs } = useGitRefs<Array<{ label: string; value: string }>>(
+    {
+      sourceId: sourceId!,
+    },
+    {
+      enabled: !!sourceId,
+      select: (refs) => {
+        if (refs.length === 0) {
+          return [{ value: 'refs/heads/main', label: 'refs/heads/main' }];
+        }
+
+        // put refs/heads/main first if it is present in repository
+        if (refs.includes('refs/heads/main')) {
+          refs.splice(refs.indexOf('refs/heads/main'), 1);
+          refs.unshift('refs/heads/main');
+        }
+
+        if (refs.includes('refs/heads/master')) {
+          refs.splice(refs.indexOf('refs/heads/master'), 1);
+          refs.unshift('refs/heads/master');
+        }
+
+        return refs.map((t: string) => ({
+          value: t,
+          label: t,
+        }));
+      },
+
+      onSuccess(refs) {
+        if (refs && !refs.some((ref) => ref.value === value)) {
+          onChange(refs[0].value);
+        }
+      },
+    }
+  );
+
+  return (
+    <PortainerSelect
+      inputId={inputId}
+      value={value}
+      options={refs || [{ value: 'refs/heads/main', label: 'refs/heads/main' }]}
+      onChange={(e) => e && onChange(e)}
+      data-cy="component-gitRefInput"
+    />
+  );
+}
diff --git a/app/react/portainer/gitops/RefField/index.ts b/app/react/portainer/gitops/RefField/index.ts
new file mode 100644
index 0000000..a42f39e
--- /dev/null
+++ b/app/react/portainer/gitops/RefField/index.ts
@@ -0,0 +1 @@
+export { RefField } from './RefField';
diff --git a/app/react/portainer/gitops/RelativePathFieldset/RelativePathFieldset.tsx b/app/react/portainer/gitops/RelativePathFieldset/RelativePathFieldset.tsx
new file mode 100644
index 0000000..b8b719f
--- /dev/null
+++ b/app/react/portainer/gitops/RelativePathFieldset/RelativePathFieldset.tsx
@@ -0,0 +1,324 @@
+import { useState } from 'react';
+import { FormikErrors } from 'formik';
+
+import {
+  PathSelector,
+  PathSelectorGitModel,
+} from '@/react/portainer/gitops/ComposePathField/PathSelector';
+import { dummyGitForm } from '@/react/portainer/gitops/RelativePathFieldset/utils';
+
+import { SwitchField } from '@@/form-components/SwitchField';
+import { TextTip } from '@@/Tip/TextTip';
+import { FormControl } from '@@/form-components/FormControl';
+import { Input, Select } from '@@/form-components/Input';
+import { useDocsUrl } from '@@/PageHeader/ContextHelp';
+import { InsightsBox } from '@@/InsightsBox';
+
+import { RelativePathModel, getPerDevConfigsFilterType } from './types';
+
+interface Props {
+  values: RelativePathModel;
+  gitModel?: PathSelectorGitModel;
+  onChange: (value: RelativePathModel) => void;
+  isEditing?: boolean;
+  hideEdgeConfigs?: boolean;
+  errors?: FormikErrors<RelativePathModel>;
+}
+
+export function RelativePathFieldset({
+  values: value,
+  gitModel,
+  onChange = () => {},
+  isEditing,
+  hideEdgeConfigs,
+  errors,
+}: Props) {
+  const [relativePathManuallyEnabled, setRelativePathManuallyEnabled] =
+    useState(value.SupportRelativePath);
+
+  const [relativePathForcedEnabled, setRelativePathForcedEnabled] = useState(
+    value.SupportPerDeviceConfigs
+  );
+
+  const gitoptsEdgeConfigDocUrl = useDocsUrl(
+    '/user/edge/stacks/add#gitops-edge-configurations'
+  );
+
+  const pathTipSwarm =
+    'For relative path volumes use with Docker Swarm, you must have a network filesystem which all of your nodes can access.';
+  const pathTipGitopsActive =
+    'GitOps Edge configurations is active. When you set the ‘local filesystem path’, it will also be utilized for relative paths.';
+
+  return (
+    <>
+      <div className="form-group">
+        <div className="col-sm-12">
+          <SwitchField
+            name="EnableRelativePaths"
+            data-cy="gitops-enable-relative-paths-switch"
+            label="Enable relative path volumes"
+            labelClass="col-sm-3 col-lg-2"
+            tooltip="Enabling this means you can specify relative path volumes in your Compose files, with Portainer pulling the content from your git repository to the environment the stack is deployed to."
+            disabled={isEditing || relativePathForcedEnabled}
+            checked={value.SupportRelativePath}
+            onChange={(value) => {
+              setRelativePathManuallyEnabled(value);
+              handleChange({ SupportRelativePath: value });
+            }}
+          />
+        </div>
+      </div>
+
+      {value.SupportRelativePath && (
+        <>
+          <div className="form-group">
+            <div className="col-sm-12">
+              <TextTip color="blue">
+                {relativePathForcedEnabled ? pathTipGitopsActive : pathTipSwarm}
+              </TextTip>
+            </div>
+          </div>
+
+          {(!relativePathForcedEnabled || hideEdgeConfigs) && (
+            <div className="form-group">
+              <div className="col-sm-12">
+                <FormControl
+                  label="Local filesystem path"
+                  errors={errors?.FilesystemPath}
+                  required
+                >
+                  <Input
+                    name="FilesystemPath"
+                    data-cy="relative-path-filesystem-path-input"
+                    placeholder="/mnt"
+                    disabled={isEditing}
+                    value={value.FilesystemPath}
+                    onChange={(e) =>
+                      handleChange({ FilesystemPath: e.target.value })
+                    }
+                  />
+                </FormControl>
+              </div>
+            </div>
+          )}
+        </>
+      )}
+
+      {!hideEdgeConfigs && (
+        <>
+          <div className="form-group">
+            <div className="col-sm-12">
+              <TextTip color="blue">
+                When enabled, corresponding Edge ID will be passed through as an
+                environment variable: PORTAINER_EDGE_ID.
+              </TextTip>
+            </div>
+          </div>
+
+          <div className="form-group">
+            <div className="col-sm-12">
+              <SwitchField
+                name="EnablePerDeviceConfigs"
+                data-cy="gitops-enable-per-device-configs-switch"
+                label="GitOps Edge configurations"
+                labelClass="col-sm-3 col-lg-2"
+                tooltip="By enabling the GitOps Edge Configurations feature, you gain the ability to define relative path volumes in your configuration files. Portainer will then automatically fetch the content from your git repository by matching the folder name or file name with the Portainer Edge ID, and apply it to the environment where the stack is deployed"
+                disabled={isEditing}
+                checked={!!value.SupportPerDeviceConfigs}
+                onChange={(v) => {
+                  setRelativePathForcedEnabled(v);
+                  handleChange({
+                    SupportPerDeviceConfigs: v,
+                    SupportRelativePath: v ? true : relativePathManuallyEnabled,
+                  });
+                }}
+              />
+            </div>
+          </div>
+
+          {value.SupportPerDeviceConfigs && (
+            <>
+              <InsightsBox
+                content={
+                  <p>
+                    Files named <code>$&#123;PORTAINER_EDGE_ID&#125;.env</code>{' '}
+                    and/or <code>$&#123;PORTAINER_EDGE_GROUP&#125;.env</code>{' '}
+                    contained by the config folder will be loaded for compose
+                    file interpolation.
+                  </p>
+                }
+                header="GitOps Edge Configurations"
+                insightCloseId="edge-config-interpolation-info"
+                className="mb-3"
+              />
+
+              <div className="form-group">
+                <div className="col-sm-12">
+                  <TextTip color="blue">{pathTipSwarm}</TextTip>
+                </div>
+              </div>
+
+              <div className="form-group">
+                <div className="col-sm-12">
+                  <FormControl
+                    label="Local filesystem path"
+                    errors={errors?.FilesystemPath}
+                    required
+                  >
+                    <Input
+                      name="FilesystemPath"
+                      data-cy="per-device-configs-filesystem-path-input"
+                      placeholder="/mnt"
+                      disabled={isEditing}
+                      value={value.FilesystemPath}
+                      onChange={(e) =>
+                        handleChange({ FilesystemPath: e.target.value })
+                      }
+                    />
+                  </FormControl>
+                </div>
+              </div>
+
+              <div className="form-group">
+                <div className="col-sm-12">
+                  <TextTip color="blue">
+                    Specify the directory name where your configuration will be
+                    located. This will allow you to manage device configuration
+                    settings with a Git repo as your template.
+                  </TextTip>
+                </div>
+              </div>
+
+              <div className="form-group">
+                <div className="col-sm-12">
+                  <FormControl
+                    label="Directory"
+                    errors={errors?.PerDeviceConfigsPath}
+                    inputId="per_device_configs_path_input"
+                    required
+                  >
+                    <PathSelector
+                      value={value.PerDeviceConfigsPath || ''}
+                      onChange={(value) =>
+                        handleChange({ PerDeviceConfigsPath: value })
+                      }
+                      placeholder="config"
+                      model={gitModel || dummyGitForm}
+                      readOnly={isEditing}
+                      dirOnly
+                      inputId="per_device_configs_path_input"
+                    />
+                  </FormControl>
+                </div>
+              </div>
+
+              <div className="form-group">
+                <div className="col-sm-12">
+                  <TextTip color="blue">
+                    Select which rule to use when matching configuration with
+                    Portainer Edge ID either on a per-device basis or group-wide
+                    with an Edge Group. Only configurations that match the
+                    selected rule will be accessible through their corresponding
+                    paths. Deployments that rely on accessing the configuration
+                    may experience errors.
+                  </TextTip>
+                </div>
+              </div>
+
+              <div className="form-group">
+                <div className="col-sm-12">
+                  <FormControl label="Device matching rule">
+                    <Select
+                      value={value.PerDeviceConfigsMatchType}
+                      data-cy="per-device-configs-match-type-select"
+                      onChange={(e) =>
+                        handleChange({
+                          PerDeviceConfigsMatchType: getPerDevConfigsFilterType(
+                            e.target.value
+                          ),
+                        })
+                      }
+                      options={[
+                        {
+                          label: '',
+                          value: '',
+                        },
+                        {
+                          label: 'Match file name with Portainer Edge ID',
+                          value: 'file',
+                        },
+                        {
+                          label: 'Match folder name with Portainer Edge ID',
+                          value: 'dir',
+                        },
+                      ]}
+                      disabled={isEditing}
+                    />
+                  </FormControl>
+                </div>
+              </div>
+
+              <div className="form-group">
+                <div className="col-sm-12">
+                  <FormControl label="Group matching rule">
+                    <Select
+                      value={value.PerDeviceConfigsGroupMatchType}
+                      data-cy="per-device-configs-group-match-type-select"
+                      onChange={(e) =>
+                        handleChange({
+                          PerDeviceConfigsGroupMatchType:
+                            getPerDevConfigsFilterType(e.target.value),
+                        })
+                      }
+                      options={[
+                        {
+                          label: '',
+                          value: '',
+                        },
+                        {
+                          label: 'Match file name with Edge Group',
+                          value: 'file',
+                        },
+                        {
+                          label: 'Match folder name with Edge Group',
+                          value: 'dir',
+                        },
+                      ]}
+                      disabled={isEditing}
+                    />
+                  </FormControl>
+                </div>
+              </div>
+
+              <div className="form-group">
+                <div className="col-sm-12">
+                  <TextTip color="blue">
+                    <div>
+                      You can use it as an environment variable with an image:{' '}
+                      <code>myapp:$&#123;PORTAINER_EDGE_ID&#125;</code> or{' '}
+                      <code>myapp:$&#123;PORTAINER_EDGE_GROUP&#125;</code>. You
+                      can also use it with the relative path for volumes:{' '}
+                      <code>
+                        ./config/$&#123;PORTAINER_EDGE_ID&#125;:/myapp/config
+                      </code>{' '}
+                      or{' '}
+                      <code>
+                        ./config/$&#123;PORTAINER_EDGE_GROUP&#125;:/myapp/groupconfig
+                      </code>
+                      . More documentation can be found{' '}
+                      <a href={gitoptsEdgeConfigDocUrl}>here</a>.
+                    </div>
+                  </TextTip>
+                </div>
+              </div>
+            </>
+          )}
+        </>
+      )}
+    </>
+  );
+
+  function handleChange(newValue: Partial<RelativePathModel>) {
+    onChange({ ...value, ...newValue });
+  }
+}
diff --git a/app/react/portainer/gitops/RelativePathFieldset/types.ts b/app/react/portainer/gitops/RelativePathFieldset/types.ts
new file mode 100644
index 0000000..be1a08d
--- /dev/null
+++ b/app/react/portainer/gitops/RelativePathFieldset/types.ts
@@ -0,0 +1,37 @@
+export function getDefaultRelativePathModel(): RelativePathModel {
+  return {
+    SupportRelativePath: false,
+    FilesystemPath: '',
+    PerDeviceConfigsGroupMatchType: '',
+    PerDeviceConfigsMatchType: '',
+    PerDeviceConfigsPath: '',
+    SupportPerDeviceConfigs: false,
+  };
+}
+
+export interface RelativePathModel {
+  SupportRelativePath: boolean;
+  FilesystemPath: string;
+  SupportPerDeviceConfigs: boolean;
+  PerDeviceConfigsPath: string;
+  PerDeviceConfigsMatchType: PerDevConfigsFilterType;
+  PerDeviceConfigsGroupMatchType: PerDevConfigsFilterType;
+}
+
+export type PerDevConfigsFilterType = 'file' | 'dir' | '';
+
+function isPerDevConfigsFilterType(
+  type: string
+): type is PerDevConfigsFilterType {
+  return ['file', 'dir'].includes(type);
+}
+
+export function getPerDevConfigsFilterType(
+  type: string
+): PerDevConfigsFilterType {
+  if (isPerDevConfigsFilterType(type)) {
+    return type;
+  }
+
+  return '';
+}
diff --git a/app/react/portainer/gitops/RelativePathFieldset/utils.ts b/app/react/portainer/gitops/RelativePathFieldset/utils.ts
new file mode 100644
index 0000000..c3e8924
--- /dev/null
+++ b/app/react/portainer/gitops/RelativePathFieldset/utils.ts
@@ -0,0 +1,21 @@
+import { EdgeStack } from '@/react/edge/edge-stacks/types';
+
+import { GitFormModel, RelativePathModel } from '../types';
+
+export function parseRelativePathResponse(stack: EdgeStack): RelativePathModel {
+  return {
+    SupportRelativePath: stack.SupportRelativePath ?? false,
+    FilesystemPath: stack.FilesystemPath ?? '',
+    SupportPerDeviceConfigs: stack.SupportPerDeviceConfigs ?? false,
+    PerDeviceConfigsMatchType: stack.PerDeviceConfigsMatchType ?? '',
+    PerDeviceConfigsGroupMatchType: stack.PerDeviceConfigsGroupMatchType ?? '',
+    PerDeviceConfigsPath: stack.PerDeviceConfigsPath ?? '',
+  };
+}
+
+export const dummyGitForm: GitFormModel = {
+  SourceId: 0,
+  AdditionalFiles: [],
+  RepositoryReferenceName: '',
+  ComposeFilePathInRepository: '',
+};
diff --git a/app/react/portainer/gitops/RelativePathFieldset/validation.ts b/app/react/portainer/gitops/RelativePathFieldset/validation.ts
new file mode 100644
index 0000000..f5a36ea
--- /dev/null
+++ b/app/react/portainer/gitops/RelativePathFieldset/validation.ts
@@ -0,0 +1,28 @@
+import { boolean, mixed, object, SchemaOf, string } from 'yup';
+
+import { PerDevConfigsFilterType, RelativePathModel } from './types';
+
+export function relativePathValidation(): SchemaOf<RelativePathModel> {
+  return object({
+    SupportRelativePath: boolean().default(false),
+    FilesystemPath: string()
+      .when(['SupportRelativePath'], {
+        is: true,
+        then: string().required('Local filesystem path is required'),
+      })
+      .default(''),
+    SupportPerDeviceConfigs: boolean().default(false),
+    PerDeviceConfigsPath: string()
+      .when('SupportPerDeviceConfigs', {
+        is: true,
+        then: string().required('Directory is required'),
+      })
+      .default(''),
+    PerDeviceConfigsMatchType: mixed<PerDevConfigsFilterType>()
+      .oneOf(['', 'file', 'dir'])
+      .default(''),
+    PerDeviceConfigsGroupMatchType: mixed<PerDevConfigsFilterType>()
+      .oneOf(['', 'file', 'dir'])
+      .default(''),
+  });
+}
diff --git a/app/react/portainer/gitops/TimeWindowDisplay.tsx b/app/react/portainer/gitops/TimeWindowDisplay.tsx
new file mode 100644
index 0000000..d6a85db
--- /dev/null
+++ b/app/react/portainer/gitops/TimeWindowDisplay.tsx
@@ -0,0 +1,87 @@
+import moment from 'moment';
+import 'moment-timezone';
+
+import { useCurrentEnvironment } from '@/react/hooks/useCurrentEnvironment';
+
+import { TextTip } from '@@/Tip/TextTip';
+
+import { withEdition } from '../feature-flags/withEdition';
+
+const TimeWindowDisplayWrapper = withEdition(TimeWindowDisplay, 'BE');
+
+export { TimeWindowDisplayWrapper as TimeWindowDisplay };
+
+function TimeWindowDisplay() {
+  const currentEnvQuery = useCurrentEnvironment(false);
+
+  if (!currentEnvQuery.data) {
+    return null;
+  }
+
+  const { ChangeWindow } = currentEnvQuery.data;
+
+  if (!ChangeWindow.Enabled) {
+    return null;
+  }
+  const timezone = moment.tz.guess();
+  const isDST = moment().isDST();
+  const { startTime: startTimeLocal, endTime: endTimeLocal } = utcToTime(
+    { startTime: ChangeWindow.StartTime, endTime: ChangeWindow.EndTime },
+    timezone
+  );
+
+  const { startTime: startTimeUtc, endTime: endTimeUtc } = parseInterval(
+    ChangeWindow.StartTime,
+    ChangeWindow.EndTime
+  );
+
+  return (
+    <TextTip color="orange" className="mb-2">
+      A change window is enabled, GitOps updates will not occur outside of{' '}
+      <span className="font-bold">
+        {shortTime(startTimeUtc)} - {shortTime(endTimeUtc)} UTC (
+        {shortTime(startTimeLocal)} -{shortTime(endTimeLocal)}{' '}
+        {isDST ? 'DST' : ''} {timezone})
+      </span>
+      .
+    </TextTip>
+  );
+}
+
+function utcToTime(
+  utcTime: { startTime: string; endTime: string },
+  timezone: string
+) {
+  const startTime = moment
+    .tz(utcTime.startTime, 'HH:mm', 'GMT')
+    .tz(timezone)
+    .format('HH:mm');
+  const endTime = moment
+    .tz(utcTime.endTime, 'HH:mm', 'GMT')
+    .tz(timezone)
+    .format('HH:mm');
+
+  return parseInterval(startTime, endTime);
+}
+
+function parseTime(originalTime: string) {
+  const [startHour, startMin] = originalTime.split(':');
+
+  const time = new Date();
+
+  time.setHours(parseInt(startHour, 10));
+  time.setMinutes(parseInt(startMin, 10));
+
+  return time;
+}
+
+function parseInterval(startTime: string, endTime: string) {
+  return {
+    startTime: parseTime(startTime),
+    endTime: parseTime(endTime),
+  };
+}
+
+function shortTime(time: Date) {
+  return moment(time).format('h:mm a');
+}
diff --git a/app/react/portainer/gitops/components/StatusBadge.tsx b/app/react/portainer/gitops/components/StatusBadge.tsx
new file mode 100644
index 0000000..7999d38
--- /dev/null
+++ b/app/react/portainer/gitops/components/StatusBadge.tsx
@@ -0,0 +1,57 @@
+import { Badge } from '@@/Badge';
+import { StatusDot } from '@@/primitives/StatusDot';
+
+import {
+  WorkflowStatus,
+  WorkflowType,
+  DeploymentPlatform,
+} from '../workflows/types';
+
+const BADGE_TYPE = {
+  healthy: 'success',
+  error: 'danger',
+  syncing: 'warn',
+  paused: 'muted',
+  unknown: 'muted',
+} as const;
+
+const STATUS_LABELS: Record<WorkflowStatus, string> = {
+  healthy: 'Healthy',
+  error: 'Error',
+  syncing: 'Syncing',
+  paused: 'Paused',
+  unknown: 'Unknown',
+};
+
+export function StatusBadge({ status }: { status: WorkflowStatus }) {
+  return (
+    <Badge type={BADGE_TYPE[status]} shape="pill" size="md">
+      <StatusDot color={BADGE_TYPE[status]} size="xs" /> {STATUS_LABELS[status]}
+    </Badge>
+  );
+}
+
+const TYPE_LABELS: Record<WorkflowType, string> = {
+  stack: 'Stack',
+  edgeStack: 'Edge Stack',
+};
+export function TypeBadge({ type }: { type: WorkflowType }) {
+  return <Badge type="muted">{TYPE_LABELS[type]}</Badge>;
+}
+
+const PLATFORM_LABELS: Record<DeploymentPlatform, string> = {
+  dockerStandalone: 'Docker Standalone',
+  dockerSwarm: 'Docker Swarm',
+  kubernetes: 'Kubernetes',
+};
+export function PlatformBadge({
+  platform,
+}: {
+  platform: DeploymentPlatform | undefined;
+}) {
+  return (
+    <Badge type="muted">
+      {platform ? PLATFORM_LABELS[platform] : 'Unknown'}
+    </Badge>
+  );
+}
diff --git a/app/react/portainer/gitops/hooks/useGitRepoValidity.ts b/app/react/portainer/gitops/hooks/useGitRepoValidity.ts
new file mode 100644
index 0000000..dffd74f
--- /dev/null
+++ b/app/react/portainer/gitops/hooks/useGitRepoValidity.ts
@@ -0,0 +1,67 @@
+import { isAxiosError } from '@/portainer/services/axios/utils/isAxiosError';
+
+import { isDefaultResponse } from '../../services/axios/utils/parseAxiosError';
+import { useGitRefs } from '../queries/useGitRefs';
+
+interface Params {
+  force?: boolean;
+  sourceId?: number;
+  enabled?: boolean;
+  onSettled?(isValid?: boolean): void;
+  onAfterSettle?(): void;
+}
+
+export function useGitRepoValidity({
+  sourceId,
+  force,
+  enabled,
+  onSettled,
+  onAfterSettle,
+}: Params) {
+  const query = useGitRefs(
+    {
+      sourceId: sourceId!,
+      force,
+    },
+    {
+      enabled: !!sourceId && enabled,
+      select: () => true,
+      suppressError: true,
+      onSettled(isValid) {
+        if (onSettled) {
+          onSettled(isValid);
+        }
+        if (onAfterSettle) {
+          onAfterSettle();
+        }
+      },
+    }
+  );
+
+  const errorMessage = getGitValidityError(query.error, !!sourceId);
+
+  const isChecking = query.isInitialLoading || query.isFetching;
+
+  return {
+    isValid: !!query.data && !query.isError,
+    isChecking,
+    hasError: query.isError,
+    errorMessage,
+    query,
+  } as const;
+}
+
+export function getGitValidityError(error: unknown, hasCreds: boolean) {
+  if (!isAxiosError(error)) return undefined;
+  const responseData = error.response?.data;
+  const details = isDefaultResponse(responseData)
+    ? (responseData.details ?? '')
+    : '';
+  if (
+    !hasCreds &&
+    details === 'Authentication required: Repository not found.'
+  ) {
+    return 'Git repository could not be found or is private, please ensure that the URL is correct or credentials are provided.';
+  }
+  return details || undefined;
+}
diff --git a/app/react/portainer/gitops/index.ts b/app/react/portainer/gitops/index.ts
new file mode 100644
index 0000000..8bf4b92
--- /dev/null
+++ b/app/react/portainer/gitops/index.ts
@@ -0,0 +1,20 @@
+import angular from 'angular';
+
+import { withUIRouter } from '@/react-tools/withUIRouter';
+import { withReactQuery } from '@/react-tools/withReactQuery';
+import { RelativePathFieldset } from '@/react/portainer/gitops/RelativePathFieldset/RelativePathFieldset';
+import { withFormValidation } from '@/react-tools/withFormValidation';
+
+import { relativePathValidation } from './RelativePathFieldset/validation';
+
+export const ngModule = angular.module('portainer.app.react.gitops', []);
+
+withFormValidation(
+  ngModule,
+  withUIRouter(withReactQuery(RelativePathFieldset)),
+  'relativePathFieldset',
+  ['gitModel', 'hideEdgeConfigs', 'isEditing', 'onChange'],
+  relativePathValidation
+);
+
+export const gitopsModule = ngModule.name;
diff --git a/app/react/portainer/gitops/queries/query-keys.ts b/app/react/portainer/gitops/queries/query-keys.ts
new file mode 100644
index 0000000..7beccc1
--- /dev/null
+++ b/app/react/portainer/gitops/queries/query-keys.ts
@@ -0,0 +1,6 @@
+export const workflowQueryKeys = {
+  all: ['gitops', 'workflows'] as const,
+  list: (params: object) => [...workflowQueryKeys.all, 'list', params] as const,
+  summary: () => [...workflowQueryKeys.all, 'summary'] as const,
+  detail: (id: number) => [...workflowQueryKeys.all, 'detail', id] as const,
+};
diff --git a/app/react/portainer/gitops/queries/useGitFilePreview.ts b/app/react/portainer/gitops/queries/useGitFilePreview.ts
new file mode 100644
index 0000000..0f8ed65
--- /dev/null
+++ b/app/react/portainer/gitops/queries/useGitFilePreview.ts
@@ -0,0 +1,36 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+export interface GitFilePreviewParams {
+  targetFile: string;
+  reference?: string;
+  /** When set, resolves URL and auth from the stored Source record */
+  sourceId?: number;
+}
+
+async function getFilePreview(params: GitFilePreviewParams): Promise<string> {
+  try {
+    const { data } = await axios.post<{ FileContent: string }>(
+      '/gitops/repo/file/preview',
+      params
+    );
+    return data.FileContent;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to fetch file from git');
+  }
+}
+
+export function useGitFilePreview<TData = string>(
+  params: GitFilePreviewParams,
+  options: { enabled?: boolean; select?: (data: string) => TData } = {}
+) {
+  const { enabled = true, select } = options;
+  return useQuery({
+    queryKey: ['gitops', 'file-preview', params],
+    queryFn: () => getFilePreview(params),
+    enabled: enabled && !!params.sourceId && !!params.targetFile,
+    select,
+    retry: false,
+  });
+}
diff --git a/app/react/portainer/gitops/queries/useGitRefs.ts b/app/react/portainer/gitops/queries/useGitRefs.ts
new file mode 100644
index 0000000..75d6081
--- /dev/null
+++ b/app/react/portainer/gitops/queries/useGitRefs.ts
@@ -0,0 +1,48 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios from '@/portainer/services/axios/axios';
+import { isBE } from '@/react/portainer/feature-flags/feature-flags.service';
+import { withError } from '@/react-tools/react-query';
+
+interface RefsPayload {
+  force?: boolean;
+  sourceId: number;
+}
+
+export function useGitRefs<T = string[]>(
+  payload: RefsPayload,
+  {
+    enabled,
+    select,
+    onSuccess,
+    onSettled,
+    suppressError,
+    cacheTime = 0,
+  }: {
+    enabled?: boolean;
+    select?: (data: string[]) => T;
+    onSuccess?(data: T): void;
+    onSettled?(data: T | undefined, error: unknown): void;
+    suppressError?: boolean;
+    cacheTime?: number;
+  } = {}
+) {
+  return useQuery({
+    queryKey: ['gitops', 'refs', payload],
+    queryFn: () => listRefs(payload),
+    enabled: isBE && enabled,
+    retry: false,
+    cacheTime,
+    select,
+    onSuccess,
+    onSettled,
+    ...(suppressError ? {} : withError('Failed loading refs')),
+  });
+}
+
+export async function listRefs({ force, ...body }: RefsPayload) {
+  const { data } = await axios.post<string[]>('/gitops/repo/refs', body, {
+    params: { force },
+  });
+  return data;
+}
diff --git a/app/react/portainer/gitops/queries/useSearch.ts b/app/react/portainer/gitops/queries/useSearch.ts
new file mode 100644
index 0000000..5a3e0f0
--- /dev/null
+++ b/app/react/portainer/gitops/queries/useSearch.ts
@@ -0,0 +1,30 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios from '@/portainer/services/axios/axios';
+
+import { isBE } from '../../feature-flags/feature-flags.service';
+
+interface SearchPayload {
+  keyword: string;
+  reference?: string;
+  dirOnly?: boolean;
+  sourceId?: number;
+}
+
+export function useSearch(payload: SearchPayload, enabled: boolean) {
+  return useQuery({
+    queryKey: ['gitops', 'search', payload],
+    queryFn: () => searchRepo(payload),
+    enabled: isBE && enabled,
+    retry: false,
+    cacheTime: 0,
+  });
+}
+
+export async function searchRepo(payload: SearchPayload) {
+  const { data } = await axios.post<string[] | null>(
+    '/gitops/repo/files/search',
+    payload
+  );
+  return data;
+}
diff --git a/app/react/portainer/gitops/queries/useUpdateGitStack.ts b/app/react/portainer/gitops/queries/useUpdateGitStack.ts
new file mode 100644
index 0000000..3898f62
--- /dev/null
+++ b/app/react/portainer/gitops/queries/useUpdateGitStack.ts
@@ -0,0 +1,50 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { buildStackUrl } from '@/react/common/stacks/queries/buildUrl';
+import { queryKeys } from '@/react/common/stacks/queries/query-keys';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { EnvVarValues } from '@@/form-components/EnvironmentVariablesFieldset';
+
+interface DeployGitPayload {
+  RepositoryReferenceName?: string;
+  Env?: EnvVarValues;
+  Prune?: boolean;
+  // RepullImageAndRedeploy indicates whether to force repulling images and redeploying the stack
+  RepullImageAndRedeploy?: boolean;
+
+  StackName?: string;
+}
+
+export async function updateGitStack(
+  stackId: number,
+  endpointId: number,
+  payload: DeployGitPayload
+) {
+  try {
+    const { data } = await axios.put(
+      buildStackUrl(stackId, 'git/redeploy'),
+      payload,
+      { params: { endpointId } }
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e as Error);
+  }
+}
+
+export function useUpdateGitStack(stackId: number, endpointId: number) {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationKey: ['git-stack', 'redeploy', endpointId, stackId],
+    mutationFn: (payload: DeployGitPayload) =>
+      updateGitStack(stackId, endpointId, payload),
+    onSuccess: () => {
+      queryClient.invalidateQueries({
+        queryKey: queryKeys.stack(stackId),
+        exact: true,
+      });
+    },
+  });
+}
diff --git a/app/react/portainer/gitops/queries/useUpdateGitStackSettings.ts b/app/react/portainer/gitops/queries/useUpdateGitStackSettings.ts
new file mode 100644
index 0000000..b9b0e4e
--- /dev/null
+++ b/app/react/portainer/gitops/queries/useUpdateGitStackSettings.ts
@@ -0,0 +1,64 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/react/portainer/services/axios/axios';
+import { buildStackUrl } from '@/react/common/stacks/queries/buildUrl';
+import { queryKeys } from '@/react/common/stacks/queries/query-keys';
+import { withError } from '@/react-tools/react-query';
+
+import { EnvVar } from '@@/form-components/EnvironmentVariablesFieldset/types';
+
+import { AutoUpdateResponse } from '../types';
+
+export interface GitStackPayload {
+  env: Array<EnvVar>;
+  prune?: boolean;
+  RepositoryURL?: string;
+  ConfigFilePath?: string;
+  RepositoryReferenceName?: string;
+  AutoUpdate?: AutoUpdateResponse | null;
+  TLSSkipVerify?: boolean;
+  Registries?: number[];
+  AdditionalFiles?: string[];
+  HelmChartPath?: string;
+  HelmValuesFiles?: string[];
+  Atomic?: boolean;
+  SourceID?: number;
+}
+
+export async function updateGitStackSettings(
+  stackId: number,
+  endpointId: number,
+  payload: GitStackPayload
+) {
+  try {
+    const { data } = await axios.post(buildStackUrl(stackId, 'git'), payload, {
+      params: { endpointId },
+    });
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e as Error);
+  }
+}
+
+export function useUpdateGitStackSettings() {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: ({
+      stackId,
+      endpointId,
+      payload,
+    }: {
+      stackId: number;
+      endpointId: number;
+      payload: GitStackPayload;
+    }) => updateGitStackSettings(stackId, endpointId, payload),
+    onSuccess: (_, { stackId }) => {
+      queryClient.invalidateQueries({
+        queryKey: queryKeys.stack(stackId),
+        exact: true,
+      });
+    },
+    ...withError('Unable to save stack settings'),
+  });
+}
diff --git a/app/react/portainer/gitops/queries/useWorkflows.ts b/app/react/portainer/gitops/queries/useWorkflows.ts
new file mode 100644
index 0000000..3495bf5
--- /dev/null
+++ b/app/react/portainer/gitops/queries/useWorkflows.ts
@@ -0,0 +1,40 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+import { withPaginationHeaders } from '@/react/common/api/pagination.types';
+
+import {
+  DeploymentPlatform,
+  Workflow,
+  WorkflowStatus,
+  WorkflowType,
+} from '../workflows/types';
+
+import { workflowQueryKeys } from './query-keys';
+
+export interface WorkflowsParams {
+  search?: string;
+  sort?: string;
+  order?: 'asc' | 'desc';
+  start?: number;
+  limit?: number;
+  status?: WorkflowStatus | null;
+  type?: WorkflowType | null;
+  platform?: DeploymentPlatform | null;
+}
+
+async function getWorkflows(params: WorkflowsParams) {
+  const response = await axios.get<Workflow[]>('/gitops/workflows', {
+    params,
+  });
+  return withPaginationHeaders(response);
+}
+
+export function useWorkflows(params: WorkflowsParams) {
+  return useQuery({
+    queryKey: workflowQueryKeys.list(params),
+    queryFn: () => getWorkflows(params),
+    ...withError('Failed loading workflows'),
+  });
+}
diff --git a/app/react/portainer/gitops/queries/useWorkflowsSummary.ts b/app/react/portainer/gitops/queries/useWorkflowsSummary.ts
new file mode 100644
index 0000000..395e483
--- /dev/null
+++ b/app/react/portainer/gitops/queries/useWorkflowsSummary.ts
@@ -0,0 +1,29 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+
+import { workflowQueryKeys } from './query-keys';
+
+export interface WorkflowSummary {
+  healthy: number;
+  error: number;
+  syncing: number;
+  paused: number;
+  unknown: number;
+}
+
+async function getWorkflowsSummary(): Promise<WorkflowSummary> {
+  const { data } = await axios.get<WorkflowSummary>(
+    '/gitops/workflows/summary'
+  );
+  return data;
+}
+
+export function useWorkflowsSummary() {
+  return useQuery({
+    queryKey: workflowQueryKeys.summary(),
+    queryFn: getWorkflowsSummary,
+    ...withError('Failed loading workflow summary'),
+  });
+}
diff --git a/app/react/portainer/gitops/sources/CreateView/CreateForm.tsx b/app/react/portainer/gitops/sources/CreateView/CreateForm.tsx
new file mode 100644
index 0000000..940e998
--- /dev/null
+++ b/app/react/portainer/gitops/sources/CreateView/CreateForm.tsx
@@ -0,0 +1,78 @@
+import { Form, Formik, FormikHelpers } from 'formik';
+import { useRouter } from '@uirouter/react';
+
+import { notifySuccess } from '@/portainer/services/notifications';
+import { ResourceControlOwnership } from '@/react/portainer/access-control/types';
+import { useIsPureAdmin } from '@/react/hooks/useUser';
+
+import { Widget } from '@@/Widget';
+
+import { FormValues, formValuesToCreatePayload } from './type';
+import { useCreateSourceMutation } from './useSourceCreateMutation';
+import { WizardStep, useWizardContext } from './WizardContext';
+import { WizardHeader } from './WizardHeader';
+import { WizardFooter } from './WizardFooter';
+
+type Props = {
+  steps: WizardStep[];
+};
+
+export function CreateForm({ steps }: Props) {
+  const isAdmin = useIsPureAdmin();
+  const mutation = useCreateSourceMutation();
+  const router = useRouter();
+  const { currentStep, isLastStep, goToNextStep } = useWizardContext();
+
+  const initialFormValues: FormValues = {
+    name: '',
+    type: 'git',
+    git: {
+      url: '',
+      authentication: {
+        authEnabled: true,
+      },
+      connectionOk: false,
+    },
+    authorizedTeams: [],
+    authorizedUsers: [],
+    ownership: isAdmin
+      ? ResourceControlOwnership.ADMINISTRATORS
+      : ResourceControlOwnership.PRIVATE,
+  };
+
+  return (
+    <Formik
+      initialValues={initialFormValues}
+      onSubmit={handleSubmit}
+      validationSchema={currentStep.validateStep}
+    >
+      <Form noValidate>
+        <WizardHeader steps={steps} />
+        <Widget>
+          <currentStep.component />
+        </Widget>
+        <WizardFooter />
+      </Form>
+    </Formik>
+  );
+
+  function handleSubmit(
+    formValues: FormValues,
+    { setTouched, setSubmitting }: FormikHelpers<FormValues>
+  ) {
+    if (!isLastStep) {
+      goToNextStep();
+      setTouched({});
+      setSubmitting(false);
+      return;
+    }
+
+    mutation.mutate(formValuesToCreatePayload(formValues), {
+      onSuccess: () => {
+        notifySuccess('Success', 'Source successfully created');
+        router.stateService.go('.^');
+      },
+      onSettled: () => setSubmitting(false),
+    });
+  }
+}
diff --git a/app/react/portainer/gitops/sources/CreateView/CreateView.tsx b/app/react/portainer/gitops/sources/CreateView/CreateView.tsx
new file mode 100644
index 0000000..0fb93e6
--- /dev/null
+++ b/app/react/portainer/gitops/sources/CreateView/CreateView.tsx
@@ -0,0 +1,57 @@
+import { useWizardSteps } from '@@/Stepper/useWizardSteps';
+import { PageHeader } from '@@/PageHeader';
+
+import { TypeSelectStep, validateTypeSelectStep } from './steps/TypeSelectStep';
+import { ConfigureStep, validateConfigureStep } from './steps/ConfigureStep';
+import { WizardStep, WizardProvider } from './WizardContext';
+import { CreateForm } from './CreateForm';
+import {
+  AccessControlStep,
+  validateAccessControlStep,
+} from './steps/AccessControlStep';
+
+const steps: WizardStep[] = [
+  {
+    id: 'type',
+    label: 'Select source type',
+    component: TypeSelectStep,
+    validateStep: validateTypeSelectStep,
+  },
+  {
+    id: 'configure',
+    label: 'Configure connection',
+    component: ConfigureStep,
+    validateStep: validateConfigureStep,
+  },
+  {
+    id: 'access',
+    label: 'Access control',
+    component: AccessControlStep,
+    validateStep: validateAccessControlStep,
+  },
+];
+
+export function CreateView() {
+  const context = useWizardSteps<WizardStep>({ steps });
+
+  return (
+    <div className="form-horizontal pb-20">
+      <PageHeader
+        title="Create Source"
+        breadcrumbs={[
+          { link: '.^', label: 'GitOps Sources' },
+          { label: 'Create Source' },
+        ]}
+        reload
+      />
+
+      <div className="row">
+        <div className="col-sm-12">
+          <WizardProvider context={context}>
+            <CreateForm steps={steps} />
+          </WizardProvider>
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/portainer/gitops/sources/CreateView/WizardContext.tsx b/app/react/portainer/gitops/sources/CreateView/WizardContext.tsx
new file mode 100644
index 0000000..5e00cd8
--- /dev/null
+++ b/app/react/portainer/gitops/sources/CreateView/WizardContext.tsx
@@ -0,0 +1,16 @@
+import { ComponentProps, ComponentType } from 'react';
+import { Formik } from 'formik';
+
+import { createContext } from '@/react/utils/context';
+
+import { StepConfig, WizardStepState } from '@@/Stepper/useWizardSteps';
+
+export type WizardStep = StepConfig & {
+  component: ComponentType;
+  validateStep: () => ComponentProps<typeof Formik>['validationSchema'];
+};
+
+const { Provider: WizardProvider, useContext: useWizardContext } =
+  createContext<WizardStepState<WizardStep>>('WizardContext');
+
+export { WizardProvider, useWizardContext };
diff --git a/app/react/portainer/gitops/sources/CreateView/WizardFooter.test.tsx b/app/react/portainer/gitops/sources/CreateView/WizardFooter.test.tsx
new file mode 100644
index 0000000..31b6510
--- /dev/null
+++ b/app/react/portainer/gitops/sources/CreateView/WizardFooter.test.tsx
@@ -0,0 +1,182 @@
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { Formik } from 'formik';
+import * as yup from 'yup';
+
+import { ResourceControlOwnership } from '@/react/portainer/access-control/types';
+
+import { WizardStepState } from '@@/Stepper/useWizardSteps';
+
+import { WizardStep, WizardProvider } from './WizardContext';
+import { WizardFooter } from './WizardFooter';
+import { FormValues } from './type';
+
+function noop() {}
+
+const firstStep: WizardStep = {
+  id: 'step-1',
+  label: 'First',
+  component: () => null,
+  validateStep: () => yup.object(),
+};
+
+const lastStep: WizardStep = {
+  id: 'step-2',
+  label: 'Last',
+  component: () => null,
+  validateStep: () => yup.object(),
+};
+
+function buildWizardContext(
+  overrides: Partial<WizardStepState<WizardStep>> = {}
+): WizardStepState<WizardStep> {
+  return {
+    currentStep: firstStep,
+    currentStepIndex: 0,
+    isFirstStep: true,
+    isLastStep: false,
+    canGoBack: false,
+    canGoForward: true,
+    goToNextStep: noop,
+    goToPreviousStep: noop,
+    goToStep: noop,
+    goToStepByIndex: noop,
+    ...overrides,
+  };
+}
+
+const initialFormValues: FormValues = {
+  name: '',
+  type: 'git',
+  git: {
+    url: '',
+    connectionOk: false,
+    authentication: { authEnabled: false },
+  },
+  authorizedTeams: [],
+  authorizedUsers: [],
+  ownership: ResourceControlOwnership.ADMINISTRATORS,
+};
+
+const validFormValues: FormValues = {
+  name: 'my-source',
+  type: 'git',
+  git: {
+    url: 'https://github.com/org/repo.git',
+    connectionOk: true,
+    authentication: { authEnabled: false },
+  },
+  authorizedTeams: [],
+  authorizedUsers: [],
+  ownership: ResourceControlOwnership.ADMINISTRATORS,
+};
+
+function renderFooter({
+  wizardContext = buildWizardContext(),
+  formValues = initialFormValues,
+  validationSchema,
+  validateOnMount,
+}: {
+  wizardContext?: WizardStepState<WizardStep>;
+  formValues?: FormValues;
+  validationSchema?: Parameters<typeof Formik>[0]['validationSchema'];
+  validateOnMount?: boolean;
+} = {}) {
+  return render(
+    <Formik
+      initialValues={formValues}
+      onSubmit={noop}
+      validationSchema={validationSchema}
+      validateOnMount={validateOnMount}
+    >
+      <WizardProvider context={wizardContext}>
+        <WizardFooter />
+      </WizardProvider>
+    </Formik>
+  );
+}
+
+describe('WizardFooter', () => {
+  it('disables Back on first step', () => {
+    renderFooter({ wizardContext: buildWizardContext({ isFirstStep: true }) });
+
+    expect(screen.getByRole('button', { name: /back/i })).toBeDisabled();
+  });
+
+  it('enables Back when not on first step', () => {
+    renderFooter({
+      wizardContext: buildWizardContext({
+        isFirstStep: false,
+        canGoBack: true,
+        currentStepIndex: 1,
+      }),
+    });
+
+    expect(screen.getByRole('button', { name: /back/i })).not.toBeDisabled();
+  });
+
+  it('shows Continue on non-last step', () => {
+    renderFooter({ wizardContext: buildWizardContext({ isLastStep: false }) });
+
+    expect(screen.getByRole('button', { name: /continue/i })).toBeVisible();
+  });
+
+  it('shows Create on last step', () => {
+    renderFooter({
+      wizardContext: buildWizardContext({
+        isFirstStep: false,
+        isLastStep: true,
+        currentStep: lastStep,
+        currentStepIndex: 1,
+        canGoBack: true,
+        canGoForward: false,
+      }),
+      formValues: validFormValues,
+    });
+
+    expect(screen.getByRole('button', { name: /create/i })).toBeVisible();
+  });
+
+  it('disables Continue when form is invalid', async () => {
+    renderFooter({
+      wizardContext: buildWizardContext({ isLastStep: false }),
+      formValues: initialFormValues,
+      validationSchema: yup.object({ name: yup.string().required() }),
+      validateOnMount: true,
+    });
+
+    expect(
+      await screen.findByRole('button', { name: /continue/i })
+    ).toBeDisabled();
+  });
+
+  it('enables Continue when form is valid', async () => {
+    renderFooter({
+      wizardContext: buildWizardContext({ isLastStep: false }),
+      formValues: validFormValues,
+      validationSchema: yup.object({ name: yup.string().required() }),
+      validateOnMount: true,
+    });
+
+    expect(
+      await screen.findByRole('button', { name: /continue/i })
+    ).not.toBeDisabled();
+  });
+
+  it('calls goToPreviousStep when Back is clicked', async () => {
+    const goToPreviousStep = vi.fn();
+    const user = userEvent.setup();
+
+    renderFooter({
+      wizardContext: buildWizardContext({
+        isFirstStep: false,
+        canGoBack: true,
+        goToPreviousStep,
+      }),
+    });
+
+    await user.click(screen.getByRole('button', { name: /back/i }));
+
+    expect(goToPreviousStep).toHaveBeenCalledOnce();
+  });
+});
diff --git a/app/react/portainer/gitops/sources/CreateView/WizardFooter.tsx b/app/react/portainer/gitops/sources/CreateView/WizardFooter.tsx
new file mode 100644
index 0000000..cf1329b
--- /dev/null
+++ b/app/react/portainer/gitops/sources/CreateView/WizardFooter.tsx
@@ -0,0 +1,38 @@
+import { useFormikContext } from 'formik';
+
+import { StickyFooter } from '@@/StickyFooter/StickyFooter';
+import { Button, LoadingButton } from '@@/buttons';
+
+import { FormValues } from './type';
+import { useWizardContext } from './WizardContext';
+
+export function WizardFooter() {
+  const { isFirstStep, isLastStep, goToPreviousStep } = useWizardContext();
+  const { isSubmitting, isValid } = useFormikContext<FormValues>();
+
+  return (
+    <StickyFooter className="justify-end gap-4">
+      <Button
+        color="default"
+        type="button"
+        onClick={goToPreviousStep}
+        disabled={isFirstStep}
+        data-cy="gitops-source-wizard-back-button"
+        size="medium"
+      >
+        Back
+      </Button>
+      <LoadingButton
+        color="primary"
+        type="submit"
+        disabled={!isValid}
+        data-cy="gitops-source-wizard-continue-button"
+        size="medium"
+        isLoading={isSubmitting}
+        loadingText={isLastStep ? 'Creating...' : ''}
+      >
+        {isLastStep ? 'Create' : 'Continue'}
+      </LoadingButton>
+    </StickyFooter>
+  );
+}
diff --git a/app/react/portainer/gitops/sources/CreateView/WizardHeader.tsx b/app/react/portainer/gitops/sources/CreateView/WizardHeader.tsx
new file mode 100644
index 0000000..9847708
--- /dev/null
+++ b/app/react/portainer/gitops/sources/CreateView/WizardHeader.tsx
@@ -0,0 +1,23 @@
+import { Stepper } from '@@/Stepper/Stepper';
+
+import { WizardStep, useWizardContext } from './WizardContext';
+
+type Props = {
+  steps: WizardStep[];
+};
+
+export function WizardHeader({ steps }: Props) {
+  const { currentStepIndex, goToStepByIndex } = useWizardContext();
+
+  return (
+    <div className="row">
+      <div className="col-sm-12 px-0">
+        <Stepper
+          steps={steps}
+          currentStepIndex={currentStepIndex}
+          onStepClick={goToStepByIndex}
+        />
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/portainer/gitops/sources/CreateView/steps/AccessControlStep.tsx b/app/react/portainer/gitops/sources/CreateView/steps/AccessControlStep.tsx
new file mode 100644
index 0000000..59c87d6
--- /dev/null
+++ b/app/react/portainer/gitops/sources/CreateView/steps/AccessControlStep.tsx
@@ -0,0 +1,45 @@
+import { useFormikContext } from 'formik';
+
+import { EditDetails } from '@/react/portainer/access-control/EditDetails';
+
+import { Widget } from '@@/Widget';
+
+import { validationSchema } from '../validation';
+import { FormValues } from '../type';
+
+export function AccessControlStep() {
+  const { values, errors, setValues } = useFormikContext<FormValues>();
+
+  return (
+    <>
+      <Widget.Title
+        title="Access control"
+        subtitle="Configure who can use this source to create workflows and deployments."
+      />
+      <Widget.Body>
+        <EditDetails
+          resourceName="source"
+          values={values}
+          onChange={({ ownership, authorizedTeams, authorizedUsers }) => {
+            setValues((values) => ({
+              ...values,
+              ownership,
+              authorizedTeams,
+              authorizedUsers,
+            }));
+          }}
+          errors={errors}
+          isPublicVisible
+        />
+      </Widget.Body>
+    </>
+  );
+}
+
+export function validateAccessControlStep() {
+  return validationSchema().pick([
+    'ownership',
+    'authorizedUsers',
+    'authorizedTeams',
+  ]);
+}
diff --git a/app/react/portainer/gitops/sources/CreateView/steps/Authentication.tsx b/app/react/portainer/gitops/sources/CreateView/steps/Authentication.tsx
new file mode 100644
index 0000000..7880657
--- /dev/null
+++ b/app/react/portainer/gitops/sources/CreateView/steps/Authentication.tsx
@@ -0,0 +1,35 @@
+import { useFormikContext } from 'formik';
+
+import { FormSection } from '@@/form-components/FormSection';
+
+import { GitAuthentication } from '../../components/GitAuthentication';
+import { FormValues } from '../type';
+
+export function Authentication() {
+  const { values, setValues, errors } = useFormikContext<FormValues>();
+
+  if (values.type !== 'git') {
+    return null;
+  }
+
+  const { authentication } = values.git;
+
+  return (
+    <FormSection title="Authentication">
+      <GitAuthentication
+        values={authentication}
+        errors={errors.git?.authentication}
+        onChange={(changed) =>
+          setValues((old) => ({
+            ...old,
+            git: {
+              ...old.git,
+              authentication: { ...old.git.authentication, ...changed },
+            },
+          }))
+        }
+        toggleDataCy="git-auth-toggle"
+      />
+    </FormSection>
+  );
+}
diff --git a/app/react/portainer/gitops/sources/CreateView/steps/ConfigureGit.tsx b/app/react/portainer/gitops/sources/CreateView/steps/ConfigureGit.tsx
new file mode 100644
index 0000000..4f5b255
--- /dev/null
+++ b/app/react/portainer/gitops/sources/CreateView/steps/ConfigureGit.tsx
@@ -0,0 +1,53 @@
+import { useFormikContext } from 'formik';
+
+import { Input } from '@@/form-components/Input';
+import { FormControl } from '@@/form-components/FormControl';
+import { SwitchField } from '@@/form-components/SwitchField';
+
+import { FormValues } from '../type';
+
+import { Authentication } from './Authentication';
+import { ConnectionTest } from './ConnectionTest';
+
+export function ConfigureGit() {
+  const { values, setFieldValue, errors } = useFormikContext<FormValues>();
+
+  if (values.type !== 'git') {
+    return null;
+  }
+
+  return (
+    <div className="grid">
+      <FormControl
+        inputId="repository-url-input"
+        label="Repository URL"
+        required
+        errors={errors.git?.url}
+        tooltip="Enter the full URL of your git repository"
+      >
+        <Input
+          id="repository-url-input"
+          value={values.git.url}
+          data-cy="repository-url-input"
+          placeholder="https://github.com/org/repo"
+          required
+          onChange={({ target: { value } }) => setFieldValue('git.url', value)}
+        />
+      </FormControl>
+
+      <SwitchField
+        label="Skip TLS Verification"
+        labelClass="col-sm-3 col-lg-2"
+        name="TLSSkipVerify"
+        checked={values.git.tlsSkipVerify || false}
+        onChange={(value) => setFieldValue('git.tlsSkipVerify', value)}
+        tooltip="Enabling this will allow skipping TLS validation for any self-signed certificate."
+        data-cy="tls-skip-verify"
+      />
+
+      <Authentication />
+
+      <ConnectionTest />
+    </div>
+  );
+}
diff --git a/app/react/portainer/gitops/sources/CreateView/steps/ConfigureHelm.tsx b/app/react/portainer/gitops/sources/CreateView/steps/ConfigureHelm.tsx
new file mode 100644
index 0000000..0aff44c
--- /dev/null
+++ b/app/react/portainer/gitops/sources/CreateView/steps/ConfigureHelm.tsx
@@ -0,0 +1,3 @@
+export function ConfigureHelm() {
+  return <>Helm Panel</>;
+}
diff --git a/app/react/portainer/gitops/sources/CreateView/steps/ConfigureRegistry.tsx b/app/react/portainer/gitops/sources/CreateView/steps/ConfigureRegistry.tsx
new file mode 100644
index 0000000..177b9c4
--- /dev/null
+++ b/app/react/portainer/gitops/sources/CreateView/steps/ConfigureRegistry.tsx
@@ -0,0 +1,3 @@
+export function ConfigureRegistry() {
+  return <>Registry panel</>;
+}
diff --git a/app/react/portainer/gitops/sources/CreateView/steps/ConfigureStep.tsx b/app/react/portainer/gitops/sources/CreateView/steps/ConfigureStep.tsx
new file mode 100644
index 0000000..f8418b1
--- /dev/null
+++ b/app/react/portainer/gitops/sources/CreateView/steps/ConfigureStep.tsx
@@ -0,0 +1,70 @@
+import { useFormikContext } from 'formik';
+import { ComponentType } from 'react';
+
+import { Widget } from '@@/Widget';
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+
+import { FormValues } from '../type';
+import { validationSchema } from '../validation';
+
+import { ConfigureGit } from './ConfigureGit';
+import { ConfigureHelm } from './ConfigureHelm';
+import { ConfigureRegistry } from './ConfigureRegistry';
+
+const panels: Record<
+  FormValues['type'],
+  { title: string; component: ComponentType }
+> = {
+  git: { title: 'Git Repository', component: ConfigureGit },
+  helm: { title: 'Helm Repository', component: ConfigureHelm },
+  registry: { title: 'OCI Registry', component: ConfigureRegistry },
+};
+
+export function ConfigureStep() {
+  const { values } = useFormikContext<FormValues>();
+
+  const { title, component: ConfigurePanel } = panels[values.type];
+
+  return (
+    <>
+      <Widget.Title
+        title={`Configure ${title}`}
+        subtitle="Enter the connection details and test the connection before proceeding"
+      />
+      <Widget.Body>
+        <SharedFields />
+        <ConfigurePanel />
+      </Widget.Body>
+    </>
+  );
+}
+
+export function validateConfigureStep() {
+  return validationSchema().pick(['name', 'git']);
+}
+
+function SharedFields() {
+  const { values, errors, setFieldValue } = useFormikContext<FormValues>();
+
+  return (
+    <div className="grid">
+      <FormControl
+        inputId="source-name-input"
+        label="Source Name"
+        required
+        errors={errors.name}
+        tooltip="A unique name to identify this source in Portainer"
+      >
+        <Input
+          id="source-name-input"
+          value={values.name}
+          data-cy="source-name-input"
+          placeholder="my-source"
+          required
+          onChange={({ target: { value } }) => setFieldValue('name', value)}
+        />
+      </FormControl>
+    </div>
+  );
+}
diff --git a/app/react/portainer/gitops/sources/CreateView/steps/ConnectionTest.test.tsx b/app/react/portainer/gitops/sources/CreateView/steps/ConnectionTest.test.tsx
new file mode 100644
index 0000000..6ae5d9b
--- /dev/null
+++ b/app/react/portainer/gitops/sources/CreateView/steps/ConnectionTest.test.tsx
@@ -0,0 +1,139 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import { Formik } from 'formik';
+import { http, HttpResponse } from 'msw';
+
+import { server } from '@/setup-tests/server';
+import { suppressConsoleLogs } from '@/setup-tests/suppress-console';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { ResourceControlOwnership } from '@/react/portainer/access-control/types';
+
+import { FormValues } from '../type';
+
+import { ConnectionTest } from './ConnectionTest';
+
+const baseGitValues: FormValues['git'] = {
+  url: 'https://github.com/org/repo.git',
+  tlsSkipVerify: false,
+  connectionOk: false,
+  authentication: {
+    authEnabled: false,
+  },
+};
+
+const invalidGitValues: FormValues['git'] = {
+  url: '',
+  tlsSkipVerify: false,
+  connectionOk: false,
+  authentication: {
+    authEnabled: false,
+  },
+};
+
+function renderConnectionTest(gitValues: FormValues['git']) {
+  const initialValues: FormValues = {
+    name: 'test-source',
+    type: 'git',
+    git: gitValues,
+    authorizedTeams: [],
+    authorizedUsers: [],
+    ownership: ResourceControlOwnership.ADMINISTRATORS,
+  };
+
+  const Wrapped = withTestQueryProvider(ConnectionTest);
+
+  return render(
+    <Formik initialValues={initialValues} onSubmit={() => {}}>
+      <Wrapped />
+    </Formik>
+  );
+}
+
+describe('ConnectionTest', () => {
+  beforeEach(() => {
+    vi.useFakeTimers();
+  });
+
+  afterEach(() => {
+    vi.useRealTimers();
+  });
+
+  it('renders nothing when git URL is empty', () => {
+    renderConnectionTest(invalidGitValues);
+
+    expect(screen.queryByRole('alert')).not.toBeInTheDocument();
+    expect(screen.queryByRole('status')).not.toBeInTheDocument();
+  });
+
+  it('shows "Testing connection…" while debounce is pending, then success', async () => {
+    server.use(
+      http.post('/api/gitops/sources/test', () =>
+        HttpResponse.json({ success: true })
+      )
+    );
+
+    renderConnectionTest(baseGitValues);
+
+    expect(screen.getByText('Testing connection...')).toBeInTheDocument();
+    expect(screen.queryByText('Connection successful')).not.toBeInTheDocument();
+
+    // Advance past the debounce
+    await vi.advanceTimersByTimeAsync(600);
+
+    await waitFor(() => {
+      expect(screen.getByText('Connection successful')).toBeVisible();
+    });
+    expect(screen.queryByText('Testing connection...')).not.toBeInTheDocument();
+  });
+
+  it('shows success alert when gitOpsSourcesTest returns success:true', async () => {
+    server.use(
+      http.post('/api/gitops/sources/test', () =>
+        HttpResponse.json({ success: true })
+      )
+    );
+
+    renderConnectionTest(baseGitValues);
+
+    await vi.advanceTimersByTimeAsync(600);
+
+    await waitFor(() => {
+      expect(screen.getByText('Connection successful')).toBeVisible();
+    });
+  });
+
+  it('shows failure alert when gitOpsSourcesTest returns success:false', async () => {
+    server.use(
+      http.post('/api/gitops/sources/test', () =>
+        HttpResponse.json({ success: false, error: 'Repository not found' })
+      )
+    );
+
+    renderConnectionTest(baseGitValues);
+
+    await vi.advanceTimersByTimeAsync(600);
+
+    await waitFor(() => {
+      expect(screen.getByText('Repository not found')).toBeVisible();
+    });
+  });
+
+  it('shows failure alert when the API returns an error', async () => {
+    const restoreConsole = suppressConsoleLogs();
+
+    server.use(
+      http.post('/api/gitops/sources/test', () =>
+        HttpResponse.json({ message: 'Internal Server Error' }, { status: 500 })
+      )
+    );
+
+    renderConnectionTest(baseGitValues);
+
+    await vi.advanceTimersByTimeAsync(600);
+
+    await waitFor(() => {
+      expect(screen.getByText('Connection failed')).toBeVisible();
+    });
+
+    restoreConsole();
+  });
+});
diff --git a/app/react/portainer/gitops/sources/CreateView/steps/ConnectionTest.tsx b/app/react/portainer/gitops/sources/CreateView/steps/ConnectionTest.tsx
new file mode 100644
index 0000000..61d52a3
--- /dev/null
+++ b/app/react/portainer/gitops/sources/CreateView/steps/ConnectionTest.tsx
@@ -0,0 +1,64 @@
+import { useEffect } from 'react';
+import { useFormikContext } from 'formik';
+import { isEqual } from 'lodash';
+
+import { useDebouncedValue } from '@/react/hooks/useDebouncedValue';
+
+import { Alert } from '@@/Alert';
+
+import { FormValues, gitFormValuesToTestPayload } from '../type';
+import { useTestSourceConnection } from '../useTestSourceConnection';
+import { validateGitConnection } from '../validation';
+
+export function ConnectionTest() {
+  const { values, setFieldValue } = useFormikContext<FormValues>();
+  const { git } = values;
+
+  const livePayload = validateGitConnection().isValidSync(git)
+    ? gitFormValuesToTestPayload(git)
+    : undefined;
+
+  const debouncedPayload = useDebouncedValue(livePayload);
+  const query = useTestSourceConnection(debouncedPayload);
+
+  const settled = isEqual(debouncedPayload, livePayload) && !query.isFetching;
+  const connectionOk = settled && query.data?.success === true;
+
+  useEffect(() => {
+    setFieldValue('git.connectionOk', connectionOk);
+  }, [connectionOk, setFieldValue]);
+
+  if (!livePayload) {
+    return null;
+  }
+
+  if (!settled) {
+    return (
+      <Alert color="info" title="Testing connection...">
+        Checking that Portainer can reach the repository.
+      </Alert>
+    );
+  }
+
+  if (query.isError) {
+    return (
+      <Alert color="error" title="Connection failed">
+        Unable to test the connection. Please try again.
+      </Alert>
+    );
+  }
+
+  if (query.data?.success) {
+    return (
+      <Alert color="success" title="Connection successful">
+        Portainer reached the repository with these details.
+      </Alert>
+    );
+  }
+
+  return (
+    <Alert color="error" title="Connection failed">
+      {query.data?.error || 'Unable to reach the repository.'}
+    </Alert>
+  );
+}
diff --git a/app/react/portainer/gitops/sources/CreateView/steps/TypeSelectStep.tsx b/app/react/portainer/gitops/sources/CreateView/steps/TypeSelectStep.tsx
new file mode 100644
index 0000000..462223b
--- /dev/null
+++ b/app/react/portainer/gitops/sources/CreateView/steps/TypeSelectStep.tsx
@@ -0,0 +1,34 @@
+import { useFormikContext } from 'formik';
+
+import { Widget } from '@@/Widget';
+import { BoxSelector } from '@@/BoxSelector';
+
+import { FormValues } from '../type';
+import { validationSchema } from '../validation';
+
+import { sourceTypeOptions } from './typeSelectOptions';
+
+export function TypeSelectStep() {
+  const { values, setFieldValue } = useFormikContext<FormValues>();
+
+  return (
+    <>
+      <Widget.Title
+        title="Select Source type"
+        subtitle="Choose the type of external source you want to connect to Portainer. Currently only Git repositories can be connected. Support for Helm repositories, OCI registries, and S3 buckets is coming in a future release."
+      />
+      <Widget.Body>
+        <BoxSelector
+          value={values.type}
+          onChange={(type) => setFieldValue('type', type)}
+          radioName="source-type-selector"
+          options={sourceTypeOptions}
+        />
+      </Widget.Body>
+    </>
+  );
+}
+
+export function validateTypeSelectStep() {
+  return validationSchema().pick(['type']);
+}
diff --git a/app/react/portainer/gitops/sources/CreateView/steps/typeSelectOptions.tsx b/app/react/portainer/gitops/sources/CreateView/steps/typeSelectOptions.tsx
new file mode 100644
index 0000000..8587a03
--- /dev/null
+++ b/app/react/portainer/gitops/sources/CreateView/steps/typeSelectOptions.tsx
@@ -0,0 +1,80 @@
+import { Cylinder, Radio } from 'lucide-react';
+
+import GitIcon from '@/assets/ico/git.svg?c';
+import HelmIcon from '@/assets/ico/helm.svg?c';
+
+import { BoxSelectorOption } from '@@/BoxSelector';
+
+const git: BoxSelectorOption<'git'> = {
+  id: 'git',
+  label: 'Git Repository',
+  value: 'git',
+  icon: GitIcon,
+  iconType: 'logo',
+  description: Description({
+    txt: 'Connect to a Git repository (GitHub, Gitlab, Bitbucket, etc) to pull configurations files, manifests, and other deployment assets.',
+    items: ['Branch & tag selection', 'SSH or HTTPS auth', 'Webhook support'],
+  }),
+};
+
+const helm: BoxSelectorOption<'helm'> = {
+  id: 'helm',
+  value: 'helm',
+  label: 'Helm Repository',
+  icon: HelmIcon,
+  iconType: 'logo',
+  description: Description({
+    txt: 'Connect to a Helm chart repository to deploy and manage Helm charts across your environments.',
+    items: [
+      'Chart versioning',
+      'Values customization',
+      'Dependency management',
+    ],
+  }),
+  disabled: true,
+};
+
+const registry: BoxSelectorOption<'registry'> = {
+  id: 'registry',
+  value: 'registry',
+  label: 'OCI Registry',
+  icon: Radio,
+  description: Description({
+    txt: 'Connect to an OCI-compliant container registry to pull artifacts and container images.',
+    items: [
+      'Image tags & digests',
+      'Private registry auth',
+      'Artifact support',
+    ],
+  }),
+  disabled: true,
+};
+
+const s3: BoxSelectorOption<'s3'> = {
+  id: 's3',
+  value: 's3',
+  label: 'S3 Bucket',
+  icon: Cylinder,
+  description: Description({
+    txt: 'Connect to an S3-compatible bucket (AWS, S3, MinIO, etc) to fetch configuration files and assets.',
+    items: ['Prefix filtering', 'IAM or key auth', 'Version support'],
+  }),
+  disabled: true,
+};
+
+export const sourceTypeOptions = [git, helm, registry, s3];
+
+function Description({ txt, items }: { txt: string; items: string[] }) {
+  return (
+    <div>
+      {txt}
+      <div className="pl-4 pt-2">
+        <ul>
+          {items.map((v, k) => (
+            <li key={k}>{v}</li>
+          ))}
+        </ul>
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/portainer/gitops/sources/CreateView/type.test.ts b/app/react/portainer/gitops/sources/CreateView/type.test.ts
new file mode 100644
index 0000000..f7fb39e
--- /dev/null
+++ b/app/react/portainer/gitops/sources/CreateView/type.test.ts
@@ -0,0 +1,131 @@
+import {
+  AccessControlFormData,
+  ResourceControlOwnership,
+} from '@/react/portainer/access-control/types';
+
+import { formValuesToCreatePayload, gitFormValuesToTestPayload } from './type';
+
+const baseGit = {
+  url: 'https://github.com/org/repo.git',
+  tlsSkipVerify: false,
+  connectionOk: false,
+};
+
+const baseUAC: AccessControlFormData = {
+  authorizedTeams: [],
+  authorizedUsers: [],
+  ownership: ResourceControlOwnership.ADMINISTRATORS,
+};
+
+describe('formValuesToCreatePayload', () => {
+  it('populates authentication when authEnabled with username and password', () => {
+    const payload = formValuesToCreatePayload({
+      ...baseUAC,
+      name: 'my-source',
+      type: 'git',
+      git: {
+        ...baseGit,
+        authentication: {
+          authEnabled: true,
+          username: 'alice',
+          password: 'secret',
+        },
+      },
+    });
+
+    expect(payload.git.authentication).toEqual({
+      username: 'alice',
+      password: 'secret',
+    });
+  });
+
+  it('omits authentication when authEnabled is false', () => {
+    const payload = formValuesToCreatePayload({
+      ...baseUAC,
+      name: 'my-source',
+      type: 'git',
+      git: {
+        ...baseGit,
+        authentication: { authEnabled: false },
+      },
+    });
+
+    expect(payload.git.authentication).toBeUndefined();
+  });
+
+  it('omits authentication when authEnabled but username is missing', () => {
+    const payload = formValuesToCreatePayload({
+      ...baseUAC,
+      name: 'my-source',
+      type: 'git',
+      git: {
+        ...baseGit,
+        authentication: {
+          authEnabled: true,
+          password: 'secret',
+        },
+      },
+    });
+
+    expect(payload.git.authentication).toBeUndefined();
+  });
+
+  it('omits authentication when authEnabled but password is missing', () => {
+    const payload = formValuesToCreatePayload({
+      ...baseUAC,
+      name: 'my-source',
+      type: 'git',
+      git: {
+        ...baseGit,
+        authentication: {
+          authEnabled: true,
+          username: 'alice',
+        },
+      },
+    });
+
+    expect(payload.git.authentication).toBeUndefined();
+  });
+
+  it('does not include connectionOk in the create payload', () => {
+    const payload = formValuesToCreatePayload({
+      ...baseUAC,
+      name: 'my-source',
+      type: 'git',
+      git: {
+        ...baseGit,
+        connectionOk: true,
+        authentication: { authEnabled: false },
+      },
+    });
+
+    expect(payload.git).not.toHaveProperty('connectionOk');
+  });
+});
+
+describe('gitFormValuesToTestPayload', () => {
+  it('populates authentication when authEnabled with username and password', () => {
+    const payload = gitFormValuesToTestPayload({
+      ...baseGit,
+      authentication: {
+        authEnabled: true,
+        username: 'alice',
+        password: 'secret',
+      },
+    });
+
+    expect(payload.authentication).toEqual({
+      username: 'alice',
+      password: 'secret',
+    });
+  });
+
+  it('omits authentication when authEnabled is false', () => {
+    const payload = gitFormValuesToTestPayload({
+      ...baseGit,
+      authentication: { authEnabled: false },
+    });
+
+    expect(payload.authentication).toBeUndefined();
+  });
+});
diff --git a/app/react/portainer/gitops/sources/CreateView/type.ts b/app/react/portainer/gitops/sources/CreateView/type.ts
new file mode 100644
index 0000000..dc12cb6
--- /dev/null
+++ b/app/react/portainer/gitops/sources/CreateView/type.ts
@@ -0,0 +1,76 @@
+import {
+  type SourcesGitAuthenticationPayload,
+  type SourcesGitSourceCreatePayload,
+} from '@api/types.gen';
+
+import {
+  AccessControlFormData,
+  ResourceControlOwnership,
+} from '@/react/portainer/access-control/types';
+
+import { CreateSourcePayload } from './useSourceCreateMutation';
+
+type GitFormValues = {
+  url: string;
+  authentication: {
+    authEnabled: boolean;
+    username?: string;
+    password?: string;
+  };
+  tlsSkipVerify?: boolean;
+  /** Mirrors the connection-test result; not sent in the create payload. */
+  connectionOk: boolean;
+};
+
+export const FormValueTypes = ['git', 'registry', 'helm'] as const;
+
+export type FormValues = AccessControlFormData & {
+  name: string;
+  type: (typeof FormValueTypes)[number];
+  git: GitFormValues;
+};
+
+export function formValuesToCreatePayload({
+  name,
+  type,
+  git: { authentication, tlsSkipVerify, url },
+  authorizedTeams,
+  authorizedUsers,
+  ownership,
+}: FormValues): CreateSourcePayload {
+  return {
+    type,
+    git: {
+      name,
+      tlsSkipVerify,
+      url,
+      authentication: buildAuthPayload(authentication),
+      administratorsOnly: ownership === ResourceControlOwnership.ADMINISTRATORS,
+      public: ownership === ResourceControlOwnership.PUBLIC,
+      teamAccesses: authorizedTeams,
+      userAccesses: authorizedUsers,
+    },
+  };
+}
+
+export function gitFormValuesToTestPayload({
+  authentication,
+  url,
+  tlsSkipVerify,
+}: GitFormValues): SourcesGitSourceCreatePayload {
+  return {
+    url,
+    tlsSkipVerify,
+    authentication: buildAuthPayload(authentication),
+  };
+}
+
+function buildAuthPayload(
+  auth: GitFormValues['authentication']
+): SourcesGitAuthenticationPayload | undefined {
+  const { authEnabled, username, password } = auth;
+  if (!authEnabled || !username || !password) {
+    return undefined;
+  }
+  return { username, password };
+}
diff --git a/app/react/portainer/gitops/sources/CreateView/useSourceCreateMutation.ts b/app/react/portainer/gitops/sources/CreateView/useSourceCreateMutation.ts
new file mode 100644
index 0000000..d47a7fc
--- /dev/null
+++ b/app/react/portainer/gitops/sources/CreateView/useSourceCreateMutation.ts
@@ -0,0 +1,28 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { gitOpsSourcesCreateGit } from '@api/sdk.gen';
+import { type SourcesGitSourceCreatePayload } from '@api/types.gen';
+
+import { withError, withInvalidate } from '@/react-tools/react-query';
+
+import { sourceQueryKeys } from '../queries/query-keys';
+
+export type CreateSourcePayload = {
+  type: 'git' | 'registry' | 'helm';
+  git: SourcesGitSourceCreatePayload;
+};
+
+export function useCreateSourceMutation() {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: createSource,
+    ...withError('Unable to create source'),
+    ...withInvalidate(queryClient, [sourceQueryKeys.all]),
+  });
+}
+
+async function createSource(payload: CreateSourcePayload) {
+  const { data } = await gitOpsSourcesCreateGit({ body: payload.git });
+  return data;
+}
diff --git a/app/react/portainer/gitops/sources/CreateView/useTestSourceConnection.ts b/app/react/portainer/gitops/sources/CreateView/useTestSourceConnection.ts
new file mode 100644
index 0000000..a275827
--- /dev/null
+++ b/app/react/portainer/gitops/sources/CreateView/useTestSourceConnection.ts
@@ -0,0 +1,43 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { gitOpsSourcesTest } from '@api/sdk.gen';
+import { type SourcesGitSourceCreatePayload } from '@api/types.gen';
+
+import { strToHash } from '@/react/utils/hash';
+
+import { sourceQueryKeys } from '../queries/query-keys';
+
+export function useTestSourceConnection(
+  payload: SourcesGitSourceCreatePayload | undefined
+) {
+  const payloadHashedPassword = {
+    ...payload,
+
+    authentication: {
+      ...payload?.authentication,
+      password: null,
+      passwordHash: payload?.authentication?.password
+        ? strToHash(payload.authentication.password)
+        : undefined,
+    },
+  };
+
+  return useQuery({
+    queryKey: [
+      ...sourceQueryKeys.all,
+      'connection-test',
+      payloadHashedPassword,
+    ],
+    queryFn: async () => {
+      if (!payload) {
+        throw new Error('Connection details are required');
+      }
+      const { data } = await gitOpsSourcesTest({ body: payload });
+      return data;
+    },
+    enabled: !!payload,
+    retry: false,
+    refetchOnWindowFocus: false,
+    staleTime: 5000,
+  });
+}
diff --git a/app/react/portainer/gitops/sources/CreateView/validation.test.ts b/app/react/portainer/gitops/sources/CreateView/validation.test.ts
new file mode 100644
index 0000000..eb86b7b
--- /dev/null
+++ b/app/react/portainer/gitops/sources/CreateView/validation.test.ts
@@ -0,0 +1,164 @@
+import { ResourceControlOwnership } from '@/react/portainer/access-control/types';
+
+import { FormValues } from './type';
+import { validateGitConnection, validationSchema } from './validation';
+
+const baseAuth = {
+  authEnabled: false,
+};
+
+const validGitValues = {
+  url: 'https://github.com/org/repo.git',
+  tlsSkipVerify: false,
+  connectionOk: true,
+  authentication: baseAuth,
+};
+
+describe('validateGitConnection (pick schema — no connectionOk)', () => {
+  it('passes when url is valid and auth disabled', async () => {
+    const schema = validateGitConnection();
+    await expect(
+      schema.isValid({
+        url: 'https://github.com/org/repo.git',
+        tlsSkipVerify: false,
+        authentication: baseAuth,
+      })
+    ).resolves.toBe(true);
+  });
+
+  it('does not require connectionOk', async () => {
+    const schema = validateGitConnection();
+    await expect(
+      schema.isValid({
+        url: 'https://github.com/org/repo.git',
+        authentication: baseAuth,
+      })
+    ).resolves.toBe(true);
+  });
+
+  it('rejects empty URL', async () => {
+    const schema = validateGitConnection();
+    await expect(
+      schema.isValid({
+        url: '',
+        authentication: baseAuth,
+      })
+    ).resolves.toBe(false);
+  });
+
+  it('rejects localhost URL', async () => {
+    const schema = validateGitConnection();
+    await expect(
+      schema.isValid({
+        url: 'http://localhost/repo.git',
+        authentication: baseAuth,
+      })
+    ).resolves.toBe(false);
+  });
+
+  it('accepts a normal https URL', async () => {
+    const schema = validateGitConnection();
+    await expect(
+      schema.isValid({
+        url: 'https://gitlab.example.com/org/repo.git',
+        authentication: baseAuth,
+      })
+    ).resolves.toBe(true);
+  });
+});
+
+describe('validationSchema git.authentication', () => {
+  it('requires username and password when authEnabled is true', async () => {
+    const schema = validationSchema();
+    const result = await schema.isValid({
+      name: 'src',
+      type: 'git',
+      git: {
+        ...validGitValues,
+        authentication: { ...baseAuth, authEnabled: true },
+      },
+      authorizedTeams: [],
+      authorizedUsers: [],
+      ownership: ResourceControlOwnership.ADMINISTRATORS,
+    } satisfies FormValues);
+    expect(result).toBe(false);
+  });
+
+  it('passes when authEnabled is false and no credentials provided', async () => {
+    const schema = validationSchema();
+    const result = await schema.isValid({
+      name: 'src',
+      type: 'git',
+      git: validGitValues,
+      authorizedTeams: [],
+      authorizedUsers: [],
+      ownership: ResourceControlOwnership.ADMINISTRATORS,
+    } satisfies FormValues);
+    expect(result).toBe(true);
+  });
+
+  it('passes when authEnabled is true and credentials are provided', async () => {
+    const schema = validationSchema();
+    const result = await schema.isValid({
+      name: 'src',
+      type: 'git',
+      git: {
+        ...validGitValues,
+        authentication: {
+          ...baseAuth,
+          authEnabled: true,
+          username: 'alice',
+          password: 'secret',
+        },
+      },
+      authorizedTeams: [],
+      authorizedUsers: [],
+      ownership: ResourceControlOwnership.ADMINISTRATORS,
+    } satisfies FormValues);
+    expect(result).toBe(true);
+  });
+});
+
+describe('validationSchema full git (requires connectionOk)', () => {
+  it('fails when connectionOk is false', async () => {
+    const schema = validationSchema();
+    const result = await schema.isValid({
+      name: 'src',
+      type: 'git',
+      git: {
+        ...validGitValues,
+        connectionOk: false,
+      },
+      authorizedTeams: [],
+      authorizedUsers: [],
+      ownership: ResourceControlOwnership.ADMINISTRATORS,
+    } satisfies FormValues);
+    expect(result).toBe(false);
+  });
+
+  it('passes when connectionOk is true', async () => {
+    const schema = validationSchema();
+    const result = await schema.isValid({
+      name: 'src',
+      type: 'git',
+      git: validGitValues,
+      authorizedTeams: [],
+      authorizedUsers: [],
+      ownership: ResourceControlOwnership.ADMINISTRATORS,
+    } satisfies FormValues);
+    expect(result).toBe(true);
+  });
+
+  it('requires name', async () => {
+    const schema = validationSchema();
+    const result = await schema.isValid({
+      name: '',
+      type: 'git',
+      git: validGitValues,
+      authorizedTeams: [],
+      authorizedUsers: [],
+      ownership: ResourceControlOwnership.ADMINISTRATORS,
+    } satisfies FormValues);
+    expect(result).toBe(false);
+  });
+});
diff --git a/app/react/portainer/gitops/sources/CreateView/validation.tsx b/app/react/portainer/gitops/sources/CreateView/validation.tsx
new file mode 100644
index 0000000..9c300d1
--- /dev/null
+++ b/app/react/portainer/gitops/sources/CreateView/validation.tsx
@@ -0,0 +1,59 @@
+import { array, bool, mixed, number, object, SchemaOf, string } from 'yup';
+
+import { ResourceControlOwnership } from '@/react/portainer/access-control/types';
+import { stringEnumValues } from '@/types';
+
+import { isValidUrl } from '@@/form-components/validate-url';
+
+import { FormValues, FormValueTypes } from './type';
+
+export function validationSchema(): SchemaOf<FormValues> {
+  return object({
+    name: string().required('Name is required.'),
+    type: mixed<FormValues['type']>()
+      .oneOf([...FormValueTypes])
+      .required()
+      .default('git'),
+    git: validateGit(),
+    ownership: mixed<ResourceControlOwnership>()
+      .oneOf(stringEnumValues(ResourceControlOwnership))
+      .required(),
+    authorizedTeams: array().of(number().required()),
+    authorizedUsers: array().of(number().required()),
+  });
+}
+
+export function validateGitConnection() {
+  return validateGit().pick(['url', 'authentication', 'tlsSkipVerify']);
+}
+
+function validateGit(): SchemaOf<FormValues['git']> {
+  return object({
+    authentication: object({
+      authEnabled: bool().required().default(false),
+      username: string().when('authEnabled', {
+        is: true,
+        then: string().required('Username is required'),
+      }),
+      password: string().when('authEnabled', {
+        is: true,
+        then: string().required('Password is required'),
+      }),
+    }),
+    url: string()
+      .required('Repository URL is required.')
+      .test(
+        'valid repository URL',
+        'The repository URL must be a valid URL (localhost cannot be used)',
+        (value) =>
+          isValidUrl(
+            value,
+            (url) => !!url.hostname && url.hostname !== 'localhost'
+          )
+      ),
+    tlsSkipVerify: bool(),
+    connectionOk: bool()
+      .oneOf([true], 'The connection test must succeed before continuing.')
+      .required(),
+  });
+}
diff --git a/app/react/portainer/gitops/sources/GitSourceSelector.test.tsx b/app/react/portainer/gitops/sources/GitSourceSelector.test.tsx
new file mode 100644
index 0000000..268d8c9
--- /dev/null
+++ b/app/react/portainer/gitops/sources/GitSourceSelector.test.tsx
@@ -0,0 +1,50 @@
+import { render, screen } from '@testing-library/react';
+import { http, HttpResponse } from 'msw';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { server } from '@/setup-tests/server';
+
+import { Source } from './types';
+import { GitSourceSelector } from './GitSourceSelector';
+
+function renderComponent({
+  value,
+  sources = [],
+}: {
+  value?: Source['id'];
+  sources?: Array<Pick<Source, 'id' | 'name'>>;
+} = {}) {
+  server.use(
+    http.get('/api/gitops/sources', () =>
+      HttpResponse.json(sources, {
+        headers: {
+          'x-total-count': String(sources.length),
+          'x-total-available': String(sources.length),
+        },
+      })
+    )
+  );
+
+  const Wrapped = withTestQueryProvider(
+    withTestRouter(() => <GitSourceSelector value={value} onChange={vi.fn()} />)
+  );
+
+  return render(<Wrapped />);
+}
+
+describe('GitSourceSelector', () => {
+  it('renders the source selector', async () => {
+    renderComponent();
+
+    expect(await screen.findByLabelText('Source')).toBeInTheDocument();
+  });
+
+  it('shows the create new source button', async () => {
+    renderComponent();
+
+    expect(
+      await screen.findByTestId('create-source-button')
+    ).toBeInTheDocument();
+  });
+});
diff --git a/app/react/portainer/gitops/sources/GitSourceSelector.tsx b/app/react/portainer/gitops/sources/GitSourceSelector.tsx
new file mode 100644
index 0000000..efdbccb
--- /dev/null
+++ b/app/react/portainer/gitops/sources/GitSourceSelector.tsx
@@ -0,0 +1,55 @@
+import { AddButton } from '@@/buttons';
+import { FormControl } from '@@/form-components/FormControl';
+import { Select } from '@@/form-components/ReactSelect';
+
+import { useSources } from './queries/useSources';
+import { Source } from './types';
+
+export function GitSourceSelector({
+  value,
+  onChange,
+  error,
+  readOnly = false,
+}: {
+  value?: Source['id'];
+  onChange?(source?: Source | null): void;
+  error?: string;
+  readOnly?: boolean;
+}) {
+  const sourcesQuery = useSources({ type: 'git' });
+  const sources = sourcesQuery.data?.data ?? [];
+  const selectedSource = sources.find((s) => s.id === value);
+
+  return (
+    <div className="form-group">
+      <div className="col-sm-12">
+        <FormControl label="Source" inputId="source-selector" errors={error}>
+          <div className="flex items-center gap-2">
+            <div className="flex-1">
+              <Select
+                placeholder="Select a source"
+                value={selectedSource ?? null}
+                options={sources}
+                getOptionLabel={(s) => s.name}
+                getOptionValue={(s) => String(s.id)}
+                onChange={onChange}
+                isClearable
+                isLoading={sourcesQuery.isLoading}
+                noOptionsMessage={() => 'No git sources available'}
+                inputId="source-selector"
+                data-cy="source-selector"
+                isDisabled={readOnly}
+              />
+            </div>
+            <AddButton
+              to="portainer.gitops.sources.new"
+              data-cy="create-source-button"
+            >
+              Create new source
+            </AddButton>
+          </div>
+        </FormControl>
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/portainer/gitops/sources/ItemView/AccessTab.tsx b/app/react/portainer/gitops/sources/ItemView/AccessTab.tsx
new file mode 100644
index 0000000..6b9d698
--- /dev/null
+++ b/app/react/portainer/gitops/sources/ItemView/AccessTab.tsx
@@ -0,0 +1,189 @@
+import { useRef } from 'react';
+import { Form, Formik, FormikProps } from 'formik';
+import { Eye } from 'lucide-react';
+
+import { notifySuccess } from '@/portainer/services/notifications';
+import { useCurrentUser } from '@/react/hooks/useUser';
+import {
+  AccessControlFormData,
+  ResourceAccessLevel,
+  ResourceControlOwnership,
+  ResourceControlType,
+} from '@/react/portainer/access-control/types';
+import { parseAccessControlFormData } from '@/react/portainer/access-control/utils';
+import { validationSchema } from '@/react/portainer/access-control/AccessControlForm/AccessControlForm.validation';
+import { EditDetails } from '@/react/portainer/access-control/EditDetails';
+import { AccessControlPanelDetails } from '@/react/portainer/access-control/AccessControlPanel/AccessControlPanelDetails';
+import { ResourceControlViewModel } from '@/react/portainer/access-control/models/ResourceControlViewModel';
+
+import { Widget } from '@@/Widget';
+import { Button } from '@@/buttons';
+import { LoadingButton } from '@@/buttons/LoadingButton';
+import { StickyFooter } from '@@/StickyFooter/StickyFooter';
+import { usePreventFormExit } from '@@/form-components/usePreventFormExit';
+
+import { SourceDetail } from '../queries/useSource';
+import {
+  UpdateSourceAccessPayload,
+  useUpdateSourceAccessMutation,
+} from '../queries/useUpdateSourceAccessMutation';
+
+interface Props {
+  source: SourceDetail;
+  isEditing: boolean;
+  onEditingChange: (isEditing: boolean) => void;
+}
+
+export function AccessTab({ source, isEditing, onEditingChange }: Props) {
+  const { isPureAdmin } = useCurrentUser();
+
+  if (isEditing && isPureAdmin) {
+    return (
+      <AccessForm source={source} onClose={() => onEditingChange(false)} />
+    );
+  }
+
+  return (
+    <Widget>
+      <Widget.Title title="Access control" icon={Eye} />
+      <Widget.Body>
+        <AccessControlPanelDetails
+          resourceName="source"
+          resourceControl={toResourceControl(source)}
+          isAuthorisedToFetchUsers
+        />
+      </Widget.Body>
+    </Widget>
+  );
+}
+
+function AccessForm({
+  source,
+  onClose,
+}: {
+  source: SourceDetail;
+  onClose: () => void;
+}) {
+  const { user, isPureAdmin } = useCurrentUser();
+  const updateAccess = useUpdateSourceAccessMutation(source.id);
+  const formikRef = useRef<FormikProps<AccessControlFormData>>(null);
+
+  usePreventFormExit(() => !!formikRef.current?.dirty);
+
+  const initialValues = parseAccessControlFormData(
+    isPureAdmin,
+    user.Id,
+    toResourceControl(source)
+  );
+
+  return (
+    <Formik
+      innerRef={formikRef}
+      initialValues={initialValues}
+      validateOnMount
+      validationSchema={() => validationSchema(isPureAdmin)}
+      onSubmit={(values, { setSubmitting }) =>
+        updateAccess.mutate(toAccessPayload(values), {
+          onSuccess: () => {
+            notifySuccess('Source access updated', '');
+            onClose();
+          },
+          onSettled: () => setSubmitting(false),
+        })
+      }
+    >
+      {({
+        handleSubmit,
+        values,
+        errors,
+        isValid,
+        dirty,
+        isSubmitting,
+        setValues,
+      }) => (
+        <StickyFooter.Container>
+          <Form
+            className="form-horizontal space-y-4"
+            onSubmit={handleSubmit}
+            noValidate
+          >
+            <Widget>
+              <Widget.Title title="Access control" icon={Eye} />
+              <Widget.Body>
+                <EditDetails
+                  resourceName="source"
+                  values={values}
+                  errors={errors}
+                  onChange={setValues}
+                  isPublicVisible
+                />
+              </Widget.Body>
+            </Widget>
+
+            <StickyFooter className="gap-4">
+              <Button
+                type="button"
+                color="default"
+                onClick={onClose}
+                data-cy="cancel-source-access-button"
+              >
+                Cancel
+              </Button>
+              <LoadingButton
+                isLoading={isSubmitting}
+                loadingText="Saving..."
+                disabled={!isValid || !dirty}
+                data-cy="save-source-access-button"
+              >
+                Save Changes
+              </LoadingButton>
+            </StickyFooter>
+          </Form>
+        </StickyFooter.Container>
+      )}
+    </Formik>
+  );
+}
+
+function toResourceControl(source: SourceDetail): ResourceControlViewModel {
+  const {
+    public: isPublic = false,
+    users = [],
+    teams = [],
+  } = source.access ?? {};
+
+  return new ResourceControlViewModel({
+    Id: 0,
+    // Sources aren't an inheritable resource, so Type is irrelevant here; it's
+    // only required by the model and never read for sources.
+    Type: ResourceControlType.CustomTemplate,
+    ResourceId: source.id,
+    Public: isPublic,
+    AdministratorsOnly: !isPublic && users.length === 0 && teams.length === 0,
+    System: false,
+    UserAccesses: users.map((UserId) => ({
+      UserId,
+      AccessLevel: ResourceAccessLevel.ReadWriteAccessLevel,
+    })),
+    TeamAccesses: teams.map((TeamId) => ({
+      TeamId,
+      AccessLevel: ResourceAccessLevel.ReadWriteAccessLevel,
+    })),
+  });
+}
+
+function toAccessPayload({
+  ownership,
+  authorizedUsers,
+  authorizedTeams,
+}: AccessControlFormData): UpdateSourceAccessPayload {
+  const isRestricted =
+    ownership === ResourceControlOwnership.RESTRICTED ||
+    ownership === ResourceControlOwnership.PRIVATE;
+
+  return {
+    public: ownership === ResourceControlOwnership.PUBLIC,
+    users: isRestricted ? authorizedUsers : [],
+    teams: isRestricted ? authorizedTeams : [],
+  };
+}
diff --git a/app/react/portainer/gitops/sources/ItemView/CountDot.tsx b/app/react/portainer/gitops/sources/ItemView/CountDot.tsx
new file mode 100644
index 0000000..ab64d9b
--- /dev/null
+++ b/app/react/portainer/gitops/sources/ItemView/CountDot.tsx
@@ -0,0 +1,28 @@
+import clsx from 'clsx';
+
+import { addPlural } from '@/react/common/string-utils';
+
+export function CountDot({
+  value = 0,
+  type,
+}: {
+  value: number | undefined;
+  type: string;
+}) {
+  return (
+    <span
+      className={clsx([
+        'inline-block shrink-0 rounded-full',
+        'shadow-[0_0_8px_var(--tw-shadow-color)]',
+        'flex h-5 w-5 items-center justify-center text-xs font-bold',
+        'bg-blue-2 text-blue-6',
+        'th-dark:bg-gray-7 th-dark:text-white',
+        'th-highcontrast:bg-gray-7 th-highcontrast:text-white',
+      ])}
+      role="status"
+      aria-label={addPlural(value, type)}
+    >
+      {value}
+    </span>
+  );
+}
diff --git a/app/react/portainer/gitops/sources/ItemView/ItemView.tsx b/app/react/portainer/gitops/sources/ItemView/ItemView.tsx
new file mode 100644
index 0000000..03eaf06
--- /dev/null
+++ b/app/react/portainer/gitops/sources/ItemView/ItemView.tsx
@@ -0,0 +1,150 @@
+import { useMemo, useState } from 'react';
+import { GitCommit, PenBoxIcon, Settings, UsersIcon } from 'lucide-react';
+
+import { useIdParam } from '@/react/hooks/useIdParam';
+import { useCurrentUser } from '@/react/hooks/useUser';
+
+import { PageHeader } from '@@/PageHeader';
+import { Tab, WidgetTabs, useCurrentTabIndex } from '@@/Widget/WidgetTabs';
+import { ResourceDetailHeaderSkeleton } from '@@/ResourceDetailHeader/ResourceDetailHeaderSkeleton';
+import { Alert } from '@@/Alert';
+import { Badge } from '@@/Badge';
+import { Button } from '@@/buttons';
+
+import { SourceDetail, useSource } from '../queries/useSource';
+
+import { SettingsTab } from './SettingsTab/SettingsTab';
+import { WorkflowsTab } from './WorkflowsTab';
+import { SourceResourceHeader } from './SourceResourceHeader';
+import { CountDot } from './CountDot';
+import { AccessTab } from './AccessTab';
+
+const breadcrumbs = [
+  { label: 'GitOps Sources', link: 'portainer.gitops.sources' },
+  'Source',
+];
+
+export function ItemView() {
+  const sourceId = useIdParam('sourceId');
+
+  const sourceQuery = useSource(sourceId);
+  const source = sourceQuery.data;
+
+  if (sourceQuery.isLoading) {
+    return (
+      <>
+        <PageHeader breadcrumbs={breadcrumbs} />
+        <div className="mx-4 mb-4 space-y-4">
+          <ResourceDetailHeaderSkeleton statBlockCount={2} />
+        </div>
+      </>
+    );
+  }
+
+  if (!source || sourceQuery.isError) {
+    const error = sourceQuery.error;
+
+    return (
+      <>
+        <PageHeader breadcrumbs={breadcrumbs} />
+        <div className="mx-4 mb-4 space-y-4">
+          <Alert color="error">
+            Failed loading source:{' '}
+            {error instanceof Error ? error.message : 'Unknown error'}
+          </Alert>
+        </div>
+      </>
+    );
+  }
+
+  return <PageContent source={source} />;
+}
+
+function PageContent({ source }: { source: SourceDetail }) {
+  const [isEditing, setIsEditing] = useState(false);
+  const { isPureAdmin } = useCurrentUser();
+
+  const tabs: Array<Tab & { isEditable?: boolean }> = useMemo(
+    () => [
+      {
+        name: 'Settings',
+        icon: Settings,
+        widget: (
+          <SettingsTab
+            source={source}
+            isEditing={isEditing}
+            onEditingChange={setIsEditing}
+          />
+        ),
+        selectedTabParam: 'settings',
+        isEditable: true,
+      },
+      {
+        name: (
+          <>
+            Workflows{' '}
+            <CountDot value={source.workflows?.length ?? 0} type="workflow" />
+          </>
+        ),
+        icon: GitCommit,
+        widget: <WorkflowsTab workflows={source.workflows ?? []} />,
+        selectedTabParam: 'workflows',
+      },
+      {
+        name: 'Access',
+        icon: UsersIcon,
+        widget: (
+          <AccessTab
+            source={source}
+            isEditing={isEditing}
+            onEditingChange={setIsEditing}
+          />
+        ),
+        selectedTabParam: 'accessTab',
+        isEditable: isPureAdmin,
+      },
+    ],
+    [isEditing, isPureAdmin, source]
+  );
+
+  const currentTabIndex = useCurrentTabIndex(tabs);
+  const isTabEditable = tabs[currentTabIndex]?.isEditable;
+
+  return (
+    <>
+      <PageHeader
+        breadcrumbs={[
+          { label: 'GitOps Sources', link: 'portainer.gitops.sources' },
+          source.name,
+        ]}
+        reload
+      />
+      <div className="mx-4 space-y-4 pb-4">
+        <SourceResourceHeader source={source} />
+        <div className="flex items-center gap-2">
+          <WidgetTabs
+            tabs={tabs}
+            currentTabIndex={currentTabIndex}
+            useContainer={false}
+          />
+          <div className="ml-auto">
+            {isTabEditable &&
+              (isEditing ? (
+                <Badge type="info">Editing</Badge>
+              ) : (
+                <Button
+                  icon={PenBoxIcon}
+                  color="light"
+                  data-cy="edit-settings-button"
+                  onClick={() => setIsEditing(true)}
+                >
+                  Edit
+                </Button>
+              ))}
+          </div>
+        </div>
+        {tabs[currentTabIndex].widget}
+      </div>
+    </>
+  );
+}
diff --git a/app/react/portainer/gitops/sources/ItemView/SettingsTab/AuthWidget.tsx b/app/react/portainer/gitops/sources/ItemView/SettingsTab/AuthWidget.tsx
new file mode 100644
index 0000000..6a41e53
--- /dev/null
+++ b/app/react/portainer/gitops/sources/ItemView/SettingsTab/AuthWidget.tsx
@@ -0,0 +1,51 @@
+import { LockIcon } from 'lucide-react';
+
+import { Card } from '@@/primitives/Card';
+import { Badge } from '@@/Badge';
+
+import { SourceDetail } from '../../queries/useSource';
+
+import { DetailField } from './DetailField';
+
+interface Props {
+  auth?: SourceDetail['connection']['authentication'];
+}
+
+export function AuthWidget({ auth }: Props) {
+  return (
+    <Card.Container>
+      <Card.Header
+        icon={LockIcon}
+        title="Authentication"
+        subtitle="Credentials used to connect to this source"
+      />
+      <Card.Body>
+        <div className="grid grid-cols-2 gap-4">
+          {auth ? (
+            <>
+              <DetailField label="Authentication Method">
+                <Badge type="info" data-cy="source-auth-method">
+                  Basic
+                </Badge>
+              </DetailField>
+              <DetailField label="Username">
+                <span
+                  className="font-mono text-sm"
+                  data-cy="source-auth-credentials"
+                >
+                  {auth.username}
+                </span>
+              </DetailField>
+            </>
+          ) : (
+            <DetailField label="Authentication Method">
+              <Badge type={'muted'} data-cy="source-auth-method">
+                None
+              </Badge>
+            </DetailField>
+          )}
+        </div>
+      </Card.Body>
+    </Card.Container>
+  );
+}
diff --git a/app/react/portainer/gitops/sources/ItemView/SettingsTab/AutoUpdateWidget.tsx b/app/react/portainer/gitops/sources/ItemView/SettingsTab/AutoUpdateWidget.tsx
new file mode 100644
index 0000000..ff67eec
--- /dev/null
+++ b/app/react/portainer/gitops/sources/ItemView/SettingsTab/AutoUpdateWidget.tsx
@@ -0,0 +1,38 @@
+import { RefreshCwIcon } from 'lucide-react';
+
+import { Card } from '@@/primitives/Card';
+
+import { AutoUpdateInfo } from '../../queries/useSource';
+
+import { DetailField } from './DetailField';
+
+interface Props {
+  autoUpdate?: AutoUpdateInfo;
+}
+
+export function AutoUpdateWidget({ autoUpdate }: Props) {
+  const mechanism = autoUpdate?.mechanism ?? '-';
+  const fetchInterval = autoUpdate?.fetchInterval ?? '-';
+
+  return (
+    <Card.Container>
+      <Card.Header
+        icon={RefreshCwIcon}
+        title="Change Detection"
+        subtitle="How Portainer detects new commits"
+      />
+      <Card.Body>
+        <div className="grid grid-cols-2 gap-4">
+          <DetailField label="Mechanism">
+            <span className="text-gray-6 th-dark:text-gray-5">{mechanism}</span>
+          </DetailField>
+          <DetailField label="Fetch Interval">
+            <span className="text-gray-6 th-dark:text-gray-5">
+              {fetchInterval}
+            </span>
+          </DetailField>
+        </div>
+      </Card.Body>
+    </Card.Container>
+  );
+}
diff --git a/app/react/portainer/gitops/sources/ItemView/SettingsTab/ConnectionDetailsWidget.tsx b/app/react/portainer/gitops/sources/ItemView/SettingsTab/ConnectionDetailsWidget.tsx
new file mode 100644
index 0000000..97da3dc
--- /dev/null
+++ b/app/react/portainer/gitops/sources/ItemView/SettingsTab/ConnectionDetailsWidget.tsx
@@ -0,0 +1,50 @@
+import { LinkIcon } from 'lucide-react';
+
+import { Icon } from '@@/Icon';
+import { Card } from '@@/primitives/Card';
+
+import { SOURCE_TYPES } from '../../types';
+import { SourceDetail } from '../../queries/useSource';
+
+import { DetailField } from './DetailField';
+
+interface Props {
+  source: SourceDetail;
+}
+
+export function ConnectionDetailsWidget({ source }: Props) {
+  const typeConfig = source.type ? SOURCE_TYPES[source.type] : undefined;
+
+  return (
+    <Card.Container>
+      <Card.Header
+        icon={LinkIcon}
+        title="Connection Details"
+        subtitle="Source name, URL, and connection settings"
+      />
+      <Card.Body className="grid grid-cols-1 gap-4">
+        <div className="grid grid-cols-2 gap-4">
+          <DetailField label="Name">{source.name ?? '-'}</DetailField>
+          <DetailField label="Type">
+            {typeConfig ? (
+              <span className="flex items-center gap-1.5">
+                <Icon icon={typeConfig.icon} size="sm" />
+                {typeConfig.label}
+              </span>
+            ) : (
+              '-'
+            )}
+          </DetailField>
+        </div>
+        <DetailField label="Repository URL">
+          <code
+            className="bg-transparent p-0 font-mono text-sm"
+            data-cy="source-url"
+          >
+            {source.url ?? '-'}
+          </code>
+        </DetailField>
+      </Card.Body>
+    </Card.Container>
+  );
+}
diff --git a/app/react/portainer/gitops/sources/ItemView/SettingsTab/DetailField.tsx b/app/react/portainer/gitops/sources/ItemView/SettingsTab/DetailField.tsx
new file mode 100644
index 0000000..64d750f
--- /dev/null
+++ b/app/react/portainer/gitops/sources/ItemView/SettingsTab/DetailField.tsx
@@ -0,0 +1,18 @@
+export function DetailField({
+  label,
+  children,
+}: {
+  label: string;
+  children: React.ReactNode;
+}) {
+  return (
+    <div className="flex flex-col gap-1">
+      <span className="text-xs uppercase tracking-wider text-gray-6 th-highcontrast:text-gray-3 th-dark:text-gray-5">
+        {label}
+      </span>
+      <span className="font-semibold text-gray-9 th-highcontrast:text-white th-dark:text-white">
+        {children}
+      </span>
+    </div>
+  );
+}
diff --git a/app/react/portainer/gitops/sources/ItemView/SettingsTab/EditForm/EditAuthWidget.tsx b/app/react/portainer/gitops/sources/ItemView/SettingsTab/EditForm/EditAuthWidget.tsx
new file mode 100644
index 0000000..2ab8a56
--- /dev/null
+++ b/app/react/portainer/gitops/sources/ItemView/SettingsTab/EditForm/EditAuthWidget.tsx
@@ -0,0 +1,37 @@
+import { LockIcon } from 'lucide-react';
+import { useFormikContext } from 'formik';
+
+import { Card } from '@@/primitives/Card';
+
+import { GitAuthentication } from '../../../components/GitAuthentication';
+
+import { SettingsFormValues } from './types';
+
+export function EditAuthWidget() {
+  const { values, errors, setValues } = useFormikContext<SettingsFormValues>();
+
+  return (
+    <Card.Container>
+      <Card.Header
+        icon={LockIcon}
+        title="Authentication"
+        subtitle="Choose how Portainer authenticates to this source"
+      />
+      <Card.Body>
+        <GitAuthentication
+          values={{
+            authEnabled: values.authEnabled,
+            username: values.username,
+            password: values.password,
+          }}
+          isEditing
+          errors={{ username: errors.username, password: errors.password }}
+          onChange={(changed) =>
+            setValues((oldValues) => ({ ...oldValues, ...changed }))
+          }
+          toggleDataCy="source-auth-enabled"
+        />
+      </Card.Body>
+    </Card.Container>
+  );
+}
diff --git a/app/react/portainer/gitops/sources/ItemView/SettingsTab/EditForm/EditConnectionDetailsWidget.tsx b/app/react/portainer/gitops/sources/ItemView/SettingsTab/EditForm/EditConnectionDetailsWidget.tsx
new file mode 100644
index 0000000..d7d6dbc
--- /dev/null
+++ b/app/react/portainer/gitops/sources/ItemView/SettingsTab/EditForm/EditConnectionDetailsWidget.tsx
@@ -0,0 +1,56 @@
+import { LinkIcon } from 'lucide-react';
+import { useFormikContext } from 'formik';
+
+import { Card } from '@@/primitives/Card';
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+import { SwitchField } from '@@/form-components/SwitchField';
+
+import { SettingsFormValues } from './types';
+
+export function EditConnectionDetailsWidget() {
+  const { values, errors, setFieldValue } =
+    useFormikContext<SettingsFormValues>();
+
+  return (
+    <Card.Container>
+      <Card.Header
+        icon={LinkIcon}
+        title="Connection Details"
+        subtitle="Source name, URL, and connection settings"
+      />
+      <Card.Body>
+        <FormControl inputId="name" label="Name" errors={errors.name} required>
+          <Input
+            id="name"
+            name="name"
+            value={values.name}
+            onChange={(e) => setFieldValue('name', e.target.value)}
+            data-cy="source-name-input"
+          />
+        </FormControl>
+        <FormControl
+          inputId="url"
+          label="Repository URL"
+          errors={errors.url}
+          required
+        >
+          <Input
+            id="url"
+            name="url"
+            value={values.url}
+            onChange={(e) => setFieldValue('url', e.target.value)}
+            data-cy="source-url-input"
+          />
+        </FormControl>
+        <SwitchField
+          label="Skip TLS verification"
+          name="tlsSkipVerify"
+          checked={values.tlsSkipVerify}
+          onChange={(checked) => setFieldValue('tlsSkipVerify', checked)}
+          data-cy="source-tls-skip-verify"
+        />
+      </Card.Body>
+    </Card.Container>
+  );
+}
diff --git a/app/react/portainer/gitops/sources/ItemView/SettingsTab/EditForm/SettingsForm.tsx b/app/react/portainer/gitops/sources/ItemView/SettingsTab/EditForm/SettingsForm.tsx
new file mode 100644
index 0000000..117dcef
--- /dev/null
+++ b/app/react/portainer/gitops/sources/ItemView/SettingsTab/EditForm/SettingsForm.tsx
@@ -0,0 +1,93 @@
+import { useRef } from 'react';
+import { Form, Formik, FormikProps } from 'formik';
+
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { Button } from '@@/buttons';
+import { LoadingButton } from '@@/buttons/LoadingButton';
+import { StickyFooter } from '@@/StickyFooter/StickyFooter';
+import { usePreventFormExit } from '@@/form-components/usePreventFormExit';
+
+import { SourceDetail } from '../../../queries/useSource';
+import { useUpdateSourceMutation } from '../../../queries/useUpdateSourceMutation';
+
+import { EditConnectionDetailsWidget } from './EditConnectionDetailsWidget';
+import { EditAuthWidget } from './EditAuthWidget';
+import { TestConnectionWidget } from './TestConnectionWidget';
+import { SettingsFormValues, validationSchema } from './types';
+import { buildUpdatePayload } from './payload';
+
+interface Props {
+  source: SourceDetail;
+  onCancel: () => void;
+}
+
+export function SettingsForm({ source, onCancel }: Props) {
+  const updateSource = useUpdateSourceMutation(source.id);
+  const formikRef = useRef<FormikProps<SettingsFormValues>>(null);
+
+  usePreventFormExit(() => !!formikRef.current?.dirty);
+
+  const initialValues: SettingsFormValues = {
+    name: source.name ?? '',
+    url: source.url ?? '',
+    tlsSkipVerify: source.connection.tlsSkipVerify ?? false,
+    authEnabled: !!source.connection.authentication,
+    username: source.connection.authentication?.username ?? '',
+    password: '',
+  };
+
+  return (
+    <Formik
+      innerRef={formikRef}
+      initialValues={initialValues}
+      validationSchema={validationSchema}
+      onSubmit={(values, { setSubmitting }) => {
+        const payload = buildUpdatePayload(values, initialValues);
+
+        updateSource.mutate(payload, {
+          onSuccess: () => {
+            notifySuccess('Source updated', '');
+            onCancel();
+          },
+          onSettled: () => setSubmitting(false),
+        });
+      }}
+    >
+      {({ handleSubmit, isValid, dirty, isSubmitting, resetForm }) => (
+        <StickyFooter.Container>
+          <Form
+            className="form-horizontal space-y-4"
+            onSubmit={handleSubmit}
+            noValidate
+          >
+            <EditConnectionDetailsWidget />
+            <EditAuthWidget />
+            <TestConnectionWidget sourceId={source.id} />
+            <StickyFooter className="gap-4">
+              <Button
+                type="button"
+                color="default"
+                onClick={() => {
+                  resetForm();
+                  onCancel();
+                }}
+                data-cy="cancel-settings-button"
+              >
+                Cancel
+              </Button>
+              <LoadingButton
+                isLoading={isSubmitting}
+                loadingText="Saving..."
+                disabled={!isValid || !dirty}
+                data-cy="save-settings-button"
+              >
+                Save Changes
+              </LoadingButton>
+            </StickyFooter>
+          </Form>
+        </StickyFooter.Container>
+      )}
+    </Formik>
+  );
+}
diff --git a/app/react/portainer/gitops/sources/ItemView/SettingsTab/EditForm/TestConnectionWidget.tsx b/app/react/portainer/gitops/sources/ItemView/SettingsTab/EditForm/TestConnectionWidget.tsx
new file mode 100644
index 0000000..8a5a3a7
--- /dev/null
+++ b/app/react/portainer/gitops/sources/ItemView/SettingsTab/EditForm/TestConnectionWidget.tsx
@@ -0,0 +1,41 @@
+import { ArrowLeftRight } from 'lucide-react';
+import { useFormikContext } from 'formik';
+
+import { Card } from '@@/primitives/Card';
+
+import { Source } from '../../../types';
+import { TestConnectionButton } from '../../TestConnectionButton';
+
+import { SettingsFormValues } from './types';
+import { buildUpdatePayload } from './payload';
+
+interface Props {
+  sourceId: Source['id'];
+}
+
+export function TestConnectionWidget({ sourceId }: Props) {
+  const { values, initialValues } = useFormikContext<SettingsFormValues>();
+
+  const payload = buildUpdatePayload(values, initialValues);
+
+  return (
+    <Card.Container>
+      <Card.Header
+        icon={ArrowLeftRight}
+        title="Test Connection"
+        subtitle="Verify settings before saving"
+      />
+      <Card.Body>
+        <p className="mb-4 text-sm text-gray-7 th-highcontrast:text-white th-dark:text-gray-6">
+          Test the connection to verify your settings are correct before saving.
+        </p>
+        <TestConnectionButton
+          sourceId={sourceId}
+          payload={payload}
+          data-cy="source-test-connection-settings-btn"
+          showError
+        />
+      </Card.Body>
+    </Card.Container>
+  );
+}
diff --git a/app/react/portainer/gitops/sources/ItemView/SettingsTab/EditForm/payload.ts b/app/react/portainer/gitops/sources/ItemView/SettingsTab/EditForm/payload.ts
new file mode 100644
index 0000000..007e0ec
--- /dev/null
+++ b/app/react/portainer/gitops/sources/ItemView/SettingsTab/EditForm/payload.ts
@@ -0,0 +1,41 @@
+import { UpdateSourcePayload } from '../../../queries/useUpdateSourceMutation';
+
+import { SettingsFormValues } from './types';
+
+export function buildUpdatePayload(
+  values: SettingsFormValues,
+  initialValues: SettingsFormValues
+): UpdateSourcePayload {
+  return {
+    name: changed(values.name, initialValues.name),
+    url: changed(values.url, initialValues.url),
+    tlsSkipVerify: changed(values.tlsSkipVerify, initialValues.tlsSkipVerify),
+    authentication: buildAuthenticationPayload(values, initialValues),
+  };
+}
+
+function buildAuthenticationPayload(
+  values: SettingsFormValues,
+  initialValues: SettingsFormValues
+) {
+  if (!values.authEnabled && initialValues.authEnabled) {
+    return {};
+  }
+
+  if (!values.authEnabled) {
+    return undefined;
+  }
+
+  const payload = {
+    username: changed(values.username, initialValues.username),
+    password: changed(values.password, initialValues.password),
+  };
+
+  return Object.values(payload).some((v) => v !== undefined)
+    ? payload
+    : undefined;
+}
+
+function changed<T>(value: T, initialValue: T) {
+  return value === initialValue ? undefined : value;
+}
diff --git a/app/react/portainer/gitops/sources/ItemView/SettingsTab/EditForm/types.ts b/app/react/portainer/gitops/sources/ItemView/SettingsTab/EditForm/types.ts
new file mode 100644
index 0000000..c2c890b
--- /dev/null
+++ b/app/react/portainer/gitops/sources/ItemView/SettingsTab/EditForm/types.ts
@@ -0,0 +1,23 @@
+import { boolean as yupBoolean, object, string } from 'yup';
+
+export interface SettingsFormValues {
+  name: string;
+  url: string;
+  tlsSkipVerify: boolean;
+  authEnabled: boolean;
+  username: string;
+  password: string;
+}
+
+export const validationSchema = object({
+  name: string().required('Name is required'),
+  url: string().required('Repository URL is required'),
+  tlsSkipVerify: yupBoolean().defined(),
+  authEnabled: yupBoolean().defined(),
+  username: string().when('authEnabled', {
+    is: true,
+    then: (schema) => schema.required('Username is required'),
+    otherwise: (schema) => schema.optional(),
+  }),
+  password: string().optional(),
+});
diff --git a/app/react/portainer/gitops/sources/ItemView/SettingsTab/SettingsTab.tsx b/app/react/portainer/gitops/sources/ItemView/SettingsTab/SettingsTab.tsx
new file mode 100644
index 0000000..4994bef
--- /dev/null
+++ b/app/react/portainer/gitops/sources/ItemView/SettingsTab/SettingsTab.tsx
@@ -0,0 +1,30 @@
+import { SourceDetail } from '../../queries/useSource';
+
+import { ConnectionDetailsWidget } from './ConnectionDetailsWidget';
+import { AuthWidget } from './AuthWidget';
+import { AutoUpdateWidget } from './AutoUpdateWidget';
+import { SyncStatusWidget } from './SyncStatusWidget';
+import { SettingsForm } from './EditForm/SettingsForm';
+
+interface Props {
+  source: SourceDetail;
+  isEditing: boolean;
+  onEditingChange: (isEditing: boolean) => void;
+}
+
+export function SettingsTab({ source, isEditing, onEditingChange }: Props) {
+  if (isEditing) {
+    return (
+      <SettingsForm source={source} onCancel={() => onEditingChange(false)} />
+    );
+  }
+
+  return (
+    <>
+      <ConnectionDetailsWidget source={source} />
+      <AuthWidget auth={source?.connection.authentication} />
+      <AutoUpdateWidget autoUpdate={source.autoUpdate} />
+      <SyncStatusWidget source={source} />
+    </>
+  );
+}
diff --git a/app/react/portainer/gitops/sources/ItemView/SettingsTab/SyncStatusWidget.tsx b/app/react/portainer/gitops/sources/ItemView/SettingsTab/SyncStatusWidget.tsx
new file mode 100644
index 0000000..4261f28
--- /dev/null
+++ b/app/react/portainer/gitops/sources/ItemView/SettingsTab/SyncStatusWidget.tsx
@@ -0,0 +1,72 @@
+import { ShieldAlertIcon } from 'lucide-react';
+import { capitalize } from 'lodash';
+import moment from 'moment';
+
+import { Card } from '@@/primitives/Card';
+import { StatusDot } from '@@/primitives/StatusDot';
+import { Badge } from '@@/Badge';
+import { Alert } from '@@/Alert';
+
+import { SourceDetail } from '../../queries/useSource';
+
+import { DetailField } from './DetailField';
+
+interface Props {
+  source: SourceDetail;
+}
+
+export function SyncStatusWidget({ source }: Props) {
+  const lastSyncLabel = source.lastSync
+    ? moment.unix(source.lastSync).fromNow()
+    : '-';
+
+  const dotColor = getStatusColor(source.status);
+
+  const statusLabel = source.status ? capitalize(source.status) : '-';
+
+  return (
+    <Card.Container>
+      <Card.Header
+        icon={ShieldAlertIcon}
+        title="Sync Status"
+        subtitle="Health and timing of the last sync"
+      />
+      <Card.Body className="flex flex-col gap-4">
+        <div className="grid grid-cols-2 gap-4">
+          <DetailField label="Status">
+            {source.status ? (
+              <Badge type={dotColor} shape="pill" data-cy="source-status">
+                <StatusDot color={dotColor} size="xs" /> {statusLabel}
+              </Badge>
+            ) : (
+              '-'
+            )}
+          </DetailField>
+          <DetailField label="Last Sync">
+            <span data-cy="source-last-sync">{lastSyncLabel}</span>
+          </DetailField>
+        </div>
+        {source.error && <Alert color="error">{source.error}</Alert>}
+      </Card.Body>
+    </Card.Container>
+  );
+}
+
+function getStatusColor(
+  status?: SourceDetail['status']
+): 'success' | 'warn' | 'danger' | 'info' | 'muted' {
+  switch (status) {
+    case 'healthy':
+      return 'success';
+    case 'error':
+      return 'danger';
+    case 'syncing':
+      return 'warn';
+    case 'paused':
+      return 'muted';
+    case 'unknown':
+    case undefined:
+    default:
+      return 'muted';
+  }
+}
diff --git a/app/react/portainer/gitops/sources/ItemView/SourceResourceHeader.tsx b/app/react/portainer/gitops/sources/ItemView/SourceResourceHeader.tsx
new file mode 100644
index 0000000..e40002e
--- /dev/null
+++ b/app/react/portainer/gitops/sources/ItemView/SourceResourceHeader.tsx
@@ -0,0 +1,110 @@
+import { GitBranch, GitCommitIcon, ClockIcon } from 'lucide-react';
+import moment from 'moment';
+import { useRouter } from '@uirouter/react';
+
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { Icon } from '@@/Icon';
+import { ResourceDetailHeader } from '@@/ResourceDetailHeader/ResourceDetailHeader';
+import { HeaderStats } from '@@/ResourceDetailHeader/HeaderStats';
+import { ResourceStatBlock } from '@@/ResourceDetailHeader/ResourceStatBlock';
+import { DeleteButton } from '@@/buttons/DeleteButton';
+import { ActionBarShell } from '@@/ResourceDetailHeader/ActionBarShell';
+
+import { StatusBadge } from '../../components/StatusBadge';
+import { SOURCE_TYPES } from '../types';
+import { SourceDetail } from '../queries/useSource';
+import { useDeleteSourceMutation } from '../queries/useDeleteSourceMutation';
+
+import { TestConnectionButton } from './TestConnectionButton';
+
+interface Props {
+  source: SourceDetail;
+}
+
+export function SourceResourceHeader({ source }: Props) {
+  const typeConfig = source.type ? SOURCE_TYPES[source.type] : undefined;
+  const typeIcon = typeConfig?.icon;
+  const lastSyncLabel = source.lastSync
+    ? moment.unix(source.lastSync).fromNow()
+    : '-';
+
+  return (
+    <ResourceDetailHeader
+      icon={<Icon icon={typeIcon ?? GitBranch} size="xl" />}
+      subtitleLabel={typeConfig?.label ?? 'Git'}
+      title={source.name}
+      badge={<StatusBadge status={source.status} />}
+      description={
+        !!source.url && (
+          <code className="bg-transparent p-0 tracking-widest th-dark:text-gray-6">
+            {source.url}
+          </code>
+        )
+      }
+      rightInfo={
+        <HeaderStats>
+          <ResourceStatBlock>
+            <ResourceStatBlock.Label icon={<Icon icon={GitCommitIcon} />}>
+              Workflows
+            </ResourceStatBlock.Label>
+            <ResourceStatBlock.Value align="center" size="base">
+              {source.usedBy ?? '-'}
+            </ResourceStatBlock.Value>
+          </ResourceStatBlock>
+          <ResourceStatBlock>
+            <ResourceStatBlock.Label icon={<Icon icon={ClockIcon} />}>
+              Last sync
+            </ResourceStatBlock.Label>
+            <ResourceStatBlock.Value align="center" size="base">
+              {lastSyncLabel}
+            </ResourceStatBlock.Value>
+          </ResourceStatBlock>
+        </HeaderStats>
+      }
+      actionBar={
+        <ActionBarShell>
+          <TestConnectionButton
+            sourceId={source.id}
+            data-cy="source-test-connection-btn"
+          />
+
+          <div className="ml-auto">
+            <SourceDeleteButton
+              sourceId={source.id}
+              hasWorkflows={source.usedBy > 0}
+            />
+          </div>
+        </ActionBarShell>
+      }
+    />
+  );
+}
+
+function SourceDeleteButton({
+  sourceId,
+  hasWorkflows,
+}: {
+  sourceId: SourceDetail['id'];
+  hasWorkflows: boolean;
+}) {
+  const mutation = useDeleteSourceMutation();
+  const router = useRouter();
+
+  return (
+    <DeleteButton
+      confirmMessage="Are you sure you want to delete this Source?"
+      data-cy="delete-btn"
+      disabled={hasWorkflows}
+      onConfirmed={() =>
+        mutation.mutate(sourceId, {
+          onSuccess() {
+            notifySuccess('Success', 'Source deleted');
+            router.stateService.go('^');
+          },
+        })
+      }
+      isLoading={mutation.isLoading}
+    />
+  );
+}
diff --git a/app/react/portainer/gitops/sources/ItemView/TestConnectionButton.tsx b/app/react/portainer/gitops/sources/ItemView/TestConnectionButton.tsx
new file mode 100644
index 0000000..6fc4043
--- /dev/null
+++ b/app/react/portainer/gitops/sources/ItemView/TestConnectionButton.tsx
@@ -0,0 +1,92 @@
+import { ArrowLeftRight, CheckCircle, XCircle } from 'lucide-react';
+
+import { LoadingButton } from '@@/buttons';
+import { Icon } from '@@/Icon';
+import { TooltipWithChildren } from '@@/Tip/TooltipWithChildren';
+
+import { Source } from '../types';
+import {
+  ConnectionTestResult,
+  useTestSourceConnectionMutation,
+} from '../queries/useTestSourceConnectionMutation';
+import { UpdateSourcePayload } from '../queries/useUpdateSourceMutation';
+
+interface Props {
+  sourceId: Source['id'];
+  payload?: UpdateSourcePayload;
+  'data-cy': string;
+  showError?: boolean;
+}
+
+export function TestConnectionButton({
+  sourceId,
+  payload,
+  'data-cy': dataCy,
+  showError,
+}: Props) {
+  const mutation = useTestSourceConnectionMutation();
+
+  return (
+    <div className="flex items-center gap-2">
+      <LoadingButton
+        size="small"
+        color="default"
+        className="!ml-0"
+        isLoading={mutation.isLoading}
+        icon={ArrowLeftRight}
+        loadingText="Testing connection..."
+        onClick={() => mutation.mutate({ id: sourceId, payload })}
+        type="button"
+        data-cy={dataCy}
+      >
+        Test connection
+      </LoadingButton>
+      {mutation.isSuccess && (
+        <ConnectionTestStatusIcon
+          result={mutation.data}
+          showError={showError}
+        />
+      )}
+    </div>
+  );
+}
+
+function ConnectionTestStatusIcon({
+  result,
+  showError,
+}: {
+  result: ConnectionTestResult;
+  showError?: boolean;
+}) {
+  if (result.success) {
+    return (
+      <>
+        <Icon icon={CheckCircle} mode="success" />
+        <span className="sr-only">Connection successful</span>
+      </>
+    );
+  }
+
+  const errorMessage = result.error ?? 'Connection failed';
+
+  if (showError) {
+    return (
+      <span
+        className="flex items-center gap-1 text-sm text-error-9 th-highcontrast:text-error-4 th-dark:text-error-4"
+        role="alert"
+      >
+        <Icon icon={XCircle} mode="danger" />
+        {errorMessage}
+      </span>
+    );
+  }
+
+  return (
+    <TooltipWithChildren message={errorMessage}>
+      <span role="alert">
+        <Icon icon={XCircle} mode="danger" />
+        <span className="sr-only">{errorMessage}</span>
+      </span>
+    </TooltipWithChildren>
+  );
+}
diff --git a/app/react/portainer/gitops/sources/ItemView/WorkflowsTab.tsx b/app/react/portainer/gitops/sources/ItemView/WorkflowsTab.tsx
new file mode 100644
index 0000000..f067e43
--- /dev/null
+++ b/app/react/portainer/gitops/sources/ItemView/WorkflowsTab.tsx
@@ -0,0 +1,117 @@
+import { ChevronRight, GitCommitIcon, LayoutGridIcon } from 'lucide-react';
+import moment from 'moment';
+
+import { addPlural } from '@/react/common/string-utils';
+
+import { Card } from '@@/primitives/Card';
+import { Icon } from '@@/Icon';
+import { Link } from '@@/Link';
+
+import { Workflow, WorkflowTarget, WorkflowType } from '../../workflows/types';
+import { StatusBadge } from '../../components/StatusBadge';
+import { getWorkflowLink } from '../../workflows/utils';
+import { effectiveWorkflowStatus } from '../../workflows/status';
+
+interface Props {
+  workflows: Workflow[];
+}
+
+export function WorkflowsTab({ workflows }: Props) {
+  return (
+    <Card.Container>
+      <Card.Header
+        icon={GitCommitIcon}
+        title="Workflows"
+        subtitle={`${addPlural(
+          workflows.length,
+          'workflow'
+        )} using this source`}
+      />
+
+      {workflows.length === 0 ? (
+        <Card.Body>
+          <p className="text-muted text-sm">
+            No workflows are using this source.
+          </p>
+        </Card.Body>
+      ) : (
+        <WorkflowsList workflows={workflows} />
+      )}
+    </Card.Container>
+  );
+}
+
+function WorkflowsList({ workflows }: { workflows: Array<Workflow> }) {
+  return (
+    <div className="space-y-2">
+      {workflows.map((wf) => (
+        <WorkflowCard key={wf.id} item={wf} />
+      ))}
+    </div>
+  );
+}
+
+function WorkflowCard({ item }: { item: Workflow }) {
+  const { to, params } = getWorkflowLink(item);
+
+  return (
+    <Link
+      className="group flex items-center gap-3 p-4 text-inherit hover:bg-cyan-4/10 hover:text-current hover:!no-underline"
+      to={to}
+      params={params}
+      data-cy="workflow-item"
+    >
+      <div className="me-3 flex h-10 w-10 items-center justify-center rounded-lg bg-blue-4 text-blue-7">
+        <Icon icon={GitCommitIcon} size="lg" />
+      </div>
+      <div className="flex flex-1 flex-col">
+        <div className="flex items-center gap-3">
+          <h6 className="m-0 text-sm font-medium tracking-wider">
+            {item.name}
+          </h6>
+          <StatusBadge status={effectiveWorkflowStatus(item).status} />
+        </div>
+        <div className="flex items-center gap-3">
+          <code className="bg-transparent p-0">
+            {item.gitConfig?.ConfigFilePath}
+          </code>
+          <span>
+            Last sync:{' '}
+            {item.lastSyncDate
+              ? moment.unix(item.lastSyncDate).fromNow()
+              : 'Never'}
+          </span>
+        </div>
+      </div>
+
+      <TargetBlock target={item.target} type={item.type} />
+      <span className="text-gray-4 group-hover:text-gray-6">
+        <Icon icon={ChevronRight} size="lg" />
+      </span>
+    </Link>
+  );
+}
+
+function TargetBlock({
+  target,
+  type,
+}: {
+  target: WorkflowTarget;
+  type: WorkflowType;
+}) {
+  return type === 'edgeStack' ? <EdgeStackTargetBlock target={target} /> : null;
+}
+
+function EdgeStackTargetBlock({ target }: { target: WorkflowTarget }) {
+  return (
+    <div className="flex items-center gap-2 rounded-md border border-solid border-gray-4 bg-gray-2 px-3 py-2 th-highcontrast:border-gray-11 th-highcontrast:bg-transparent th-dark:border-gray-8 th-dark:bg-gray-iron-10">
+      <Icon icon={LayoutGridIcon} />
+      <span className="font-bold text-graphite-700 th-highcontrast:text-white th-dark:text-white">
+        {target.edgeGroupIds?.length ?? 0}
+      </span>
+      <span className="th-dark:text-gray text-xs text-gray-6 th-highcontrast:text-white th-dark:text-gray-6">
+        Groups
+      </span>
+    </div>
+  );
+}
diff --git a/app/react/portainer/gitops/sources/ListView/ListView.tsx b/app/react/portainer/gitops/sources/ListView/ListView.tsx
new file mode 100644
index 0000000..7132143
--- /dev/null
+++ b/app/react/portainer/gitops/sources/ListView/ListView.tsx
@@ -0,0 +1,134 @@
+import { PageHeader } from '@@/PageHeader';
+import {
+  SortableGroup,
+  SortableList,
+  SortOption,
+} from '@@/SortableList/SortableList';
+import { StatusSummaryBar } from '@@/StatusSummaryBar/StatusSummaryBar';
+import { AddButton } from '@@/buttons';
+
+import { useSources } from '../queries/useSources';
+import { useSourcesSummary } from '../queries/useSourcesSummary';
+import { Source, SourceStatus, SOURCE_TYPES } from '../types';
+
+import { SourceCard } from './SourceCard';
+import { useListState } from './useListState';
+
+const STATUS_CONFIG: Array<{
+  key: SourceStatus;
+  label: string;
+  color: 'error' | 'gray' | 'warning' | 'success';
+}> = [
+  { key: 'error', label: 'Error', color: 'error' },
+  { key: 'paused', label: 'Paused', color: 'gray' },
+  { key: 'syncing', label: 'Syncing', color: 'warning' },
+  { key: 'healthy', label: 'Healthy', color: 'success' },
+  { key: 'unknown', label: 'Unknown', color: 'gray' },
+];
+
+const TYPE_CONFIG = Object.entries(SOURCE_TYPES).map(([key, { label }]) => ({
+  key,
+  label,
+}));
+
+const SORT_OPTIONS: SortOption[] = [
+  { key: 'name', label: 'Name' },
+  { key: 'status', label: 'Status', grouped: true },
+  { key: 'type', label: 'Type', grouped: true },
+];
+
+const GROUP_OPTIONS = {
+  status: STATUS_CONFIG,
+  type: TYPE_CONFIG,
+};
+
+export function ListView() {
+  const tableState = useListState();
+  const sortBy = tableState.sortBy?.id ?? 'name';
+
+  const sourcesQuery = useSources({
+    search: tableState.search || undefined,
+    sort: sortBy,
+    order: tableState.sortBy?.desc ? 'desc' : 'asc',
+    start: tableState.page * tableState.pageSize,
+    limit: tableState.pageSize,
+    status: tableState.status ?? undefined,
+    type: tableState.type ?? undefined,
+  });
+
+  const summaryQuery = useSourcesSummary();
+
+  const page = sourcesQuery.data?.data;
+  const totalCount = sourcesQuery.data?.totalCount ?? 0;
+  const groups = buildGroups(page, sortBy);
+
+  const statusSegments = STATUS_CONFIG.map((s) => ({
+    ...s,
+    count: summaryQuery.data?.[s.key] ?? 0,
+  }));
+
+  const summaryTotal = summaryQuery.data
+    ? Object.values(summaryQuery.data).reduce((a, b) => a + b, 0)
+    : 0;
+
+  return (
+    <>
+      <PageHeader title="GitOps Sources" breadcrumbs="GitOps Sources" reload>
+        <div className="ml-auto">
+          <AddButton data-cy="add-source-button">Add new</AddButton>
+        </div>
+      </PageHeader>
+      <div className="mx-4 mb-4 space-y-4">
+        <StatusSummaryBar
+          total={summaryTotal}
+          segments={statusSegments}
+          value={tableState.status}
+          onChange={tableState.setStatus}
+          radioGroupName="sources-status"
+          isLoading={summaryQuery.isLoading}
+        />
+        <SortableList
+          tableState={tableState}
+          sortOptions={SORT_OPTIONS}
+          groupOptions={{ ...GROUP_OPTIONS, status: statusSegments }}
+          groups={groups}
+          totalCount={totalCount}
+          isLoading={sourcesQuery.isLoading}
+          getItemKey={(item) => item.id}
+          showGroupHeaders
+          emptyMessage="No sources found"
+          searchPlaceholder="Search"
+          renderItem={(item) => <SourceCard item={item} />}
+          data-cy="sources-list"
+        />
+      </div>
+    </>
+  );
+}
+
+function buildGroups(
+  items: Source[] | null | undefined,
+  sortBy: string
+): SortableGroup<Source>[] {
+  if (!items?.length) {
+    return [];
+  }
+
+  if (sortBy === 'status') {
+    return STATUS_CONFIG.map(({ key, label }) => ({
+      key,
+      label,
+      items: items.filter((item) => item.status === key),
+    })).filter((g) => g.items.length > 0);
+  }
+
+  if (sortBy === 'type') {
+    return TYPE_CONFIG.map(({ key, label }) => ({
+      key,
+      label,
+      items: items.filter((item) => item.type === key),
+    })).filter((g) => g.items.length > 0);
+  }
+
+  return [{ key: 'all', label: 'All', items }];
+}
diff --git a/app/react/portainer/gitops/sources/ListView/SourceCard.tsx b/app/react/portainer/gitops/sources/ListView/SourceCard.tsx
new file mode 100644
index 0000000..343ce20
--- /dev/null
+++ b/app/react/portainer/gitops/sources/ListView/SourceCard.tsx
@@ -0,0 +1,65 @@
+import { AlertTriangle, GitCommit, Server, WatchIcon } from 'lucide-react';
+import moment from 'moment';
+
+import { Icon } from '@@/Icon';
+import { Link } from '@@/Link';
+import { SortableListItem } from '@@/SortableList/SortableListItem';
+
+import { StatusBadge } from '../../components/StatusBadge';
+import { Source, SOURCE_TYPES } from '../types';
+
+import { StatBlock } from './StatBlock';
+
+export function SourceCard({ item }: { item: Source }) {
+  const { icon: TypeIcon } = SOURCE_TYPES[item.type];
+  const lastSyncLabel = item.lastSync
+    ? moment.unix(item.lastSync).fromNow()
+    : '-';
+
+  return (
+    <SortableListItem>
+      <div className="flex items-center gap-4">
+        <div className="flex h-10 w-10 shrink-0 items-center justify-center rounded bg-gray-2 th-highcontrast:bg-gray-8 th-dark:bg-gray-8">
+          <Icon icon={TypeIcon} size="md" className="text-gray-6" />
+        </div>
+        <div className="flex min-w-0 flex-1 items-center justify-between gap-4">
+          <div className="flex min-w-0 flex-col gap-1">
+            <div className="flex items-center gap-2">
+              <Link
+                to="portainer.gitops.sources.item"
+                params={{ sourceId: item.id }}
+                className="truncate font-semibold tracking-wide text-gray-9 th-highcontrast:text-white th-dark:text-white"
+                data-cy={`source-link-${item.id}`}
+              >
+                {item.name}
+              </Link>
+              <StatusBadge status={item.status} />
+            </div>
+            <span className="truncate text-sm text-gray-7 th-highcontrast:text-gray-3 th-dark:text-gray-3">
+              {item.url}
+            </span>
+            {item.error && (
+              <div className="flex items-center gap-1.5 text-xs text-error-8">
+                <Icon icon={AlertTriangle} size="sm" className="shrink-0" />
+                {item.error}
+              </div>
+            )}
+          </div>
+          <div className="flex shrink-0 gap-2">
+            <StatBlock icon={GitCommit} label="Workflows" value={item.usedBy} />
+            <StatBlock
+              icon={Server}
+              label="Environments"
+              value={item.environments}
+            />
+            <StatBlock
+              icon={WatchIcon}
+              label="Last sync"
+              value={lastSyncLabel}
+            />
+          </div>
+        </div>
+      </div>
+    </SortableListItem>
+  );
+}
diff --git a/app/react/portainer/gitops/sources/ListView/StatBlock.tsx b/app/react/portainer/gitops/sources/ListView/StatBlock.tsx
new file mode 100644
index 0000000..46c3a64
--- /dev/null
+++ b/app/react/portainer/gitops/sources/ListView/StatBlock.tsx
@@ -0,0 +1,23 @@
+import { type LucideIcon } from 'lucide-react';
+
+import { Icon } from '@@/Icon';
+
+interface Props {
+  icon: LucideIcon;
+  label: string;
+  value: string | number;
+}
+
+export function StatBlock({ icon, label, value }: Props) {
+  return (
+    <div className="flex min-w-[100px] flex-col gap-1 rounded-lg border border-solid border-gray-5 bg-gray-2 px-4 py-3 th-highcontrast:border-white th-highcontrast:bg-gray-10 th-dark:border-gray-8 th-dark:bg-gray-iron-10">
+      <div className="flex items-center gap-1.5 text-xs uppercase tracking-wider text-gray-7 th-highcontrast:text-gray-3 th-dark:text-gray-3">
+        <Icon icon={icon} size="sm" />
+        <span>{label}</span>
+      </div>
+      <span className="text-base font-semibold text-gray-9 th-highcontrast:text-white th-dark:text-white">
+        {value}
+      </span>
+    </div>
+  );
+}
diff --git a/app/react/portainer/gitops/sources/ListView/useListState.ts b/app/react/portainer/gitops/sources/ListView/useListState.ts
new file mode 100644
index 0000000..70c0151
--- /dev/null
+++ b/app/react/portainer/gitops/sources/ListView/useListState.ts
@@ -0,0 +1,48 @@
+import { buildGroupSortExtras } from '@@/datatables/groupSortState';
+import {
+  asEnum,
+  useTableStateFromUrl,
+} from '@@/datatables/useTableStateFromUrl';
+
+import { SourceStatus, SourceType } from '../types';
+
+const DEFAULT_SORT = 'name' as const;
+
+const SOURCE_STATUSES = new Set<SourceStatus>([
+  'healthy',
+  'error',
+  'syncing',
+  'paused',
+  'unknown',
+]);
+
+const SOURCE_TYPES = new Set<SourceType>(['git', 'helm', 'oci']);
+
+const SORT_KEYS = ['name', 'status', 'type'] as const;
+
+const DIMENSIONS = [{ key: 'status' }, { key: 'type' }];
+
+export function useListState() {
+  return useTableStateFromUrl({
+    localStorageKey: 'sources',
+    defaultSort: DEFAULT_SORT,
+    parseExtra: (params) => ({
+      status: asEnum(params.status, SOURCE_STATUSES),
+      type: asEnum(params.type, SOURCE_TYPES),
+    }),
+    buildExtra: (urlState, setUrlState) => ({
+      status: urlState.status,
+      type: urlState.type,
+      setStatus: (v: SourceStatus | null) =>
+        setUrlState({ status: v, page: 0 }),
+      setType: (v: SourceType | null) => setUrlState({ type: v, page: 0 }),
+      ...buildGroupSortExtras({
+        urlState,
+        setUrlState,
+        defaultSort: DEFAULT_SORT,
+        sortKeys: SORT_KEYS,
+        dimensions: DIMENSIONS,
+      }),
+    }),
+  });
+}
diff --git a/app/react/portainer/gitops/sources/components/GitAuthentication.tsx b/app/react/portainer/gitops/sources/components/GitAuthentication.tsx
new file mode 100644
index 0000000..ff7b106
--- /dev/null
+++ b/app/react/portainer/gitops/sources/components/GitAuthentication.tsx
@@ -0,0 +1,46 @@
+import { SwitchField } from '@@/form-components/SwitchField';
+
+import {
+  ProviderCredentialFields,
+  CredentialValues,
+} from './ProviderCredentialFields';
+
+type AuthenticationValues = CredentialValues & { authEnabled: boolean };
+
+type Props = {
+  values: AuthenticationValues;
+  errors?: { username?: string; password?: string };
+  isEditing?: boolean;
+  onChange: (changed: Partial<AuthenticationValues>) => void;
+  toggleDataCy: string;
+};
+
+export function GitAuthentication({
+  values,
+  errors,
+  isEditing,
+  onChange,
+  toggleDataCy,
+}: Props) {
+  return (
+    <>
+      <div className="mb-4">
+        <SwitchField
+          label="Authentication"
+          name="authentication"
+          checked={values.authEnabled}
+          onChange={(value) => onChange({ authEnabled: value })}
+          data-cy={toggleDataCy}
+        />
+      </div>
+      {values.authEnabled && (
+        <ProviderCredentialFields
+          values={values}
+          errors={errors}
+          isEditing={isEditing}
+          onChange={onChange}
+        />
+      )}
+    </>
+  );
+}
diff --git a/app/react/portainer/gitops/sources/components/PasswordField.tsx b/app/react/portainer/gitops/sources/components/PasswordField.tsx
new file mode 100644
index 0000000..6907032
--- /dev/null
+++ b/app/react/portainer/gitops/sources/components/PasswordField.tsx
@@ -0,0 +1,41 @@
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+
+type Props = {
+  value: string;
+  onChange: (value: string) => void;
+  label: string;
+  tooltip?: string;
+  error?: string;
+  required?: boolean;
+};
+
+export function PasswordField({
+  value,
+  onChange,
+  label,
+  tooltip,
+  error,
+  required,
+}: Props) {
+  return (
+    <FormControl
+      inputId="Password"
+      label={label}
+      errors={error}
+      required={required}
+      tooltip={tooltip}
+    >
+      <Input
+        id="Password"
+        name="password"
+        type="password"
+        value={value}
+        autoComplete="off"
+        placeholder="*******"
+        onChange={(e) => onChange(e.target.value)}
+        data-cy="component-gitPasswordInput"
+      />
+    </FormControl>
+  );
+}
diff --git a/app/react/portainer/gitops/sources/components/ProviderCredentialFields.tsx b/app/react/portainer/gitops/sources/components/ProviderCredentialFields.tsx
new file mode 100644
index 0000000..0534097
--- /dev/null
+++ b/app/react/portainer/gitops/sources/components/ProviderCredentialFields.tsx
@@ -0,0 +1,40 @@
+import { PasswordField } from './PasswordField';
+import { UsernameField } from './UsernameField';
+
+export type CredentialValues = {
+  username?: string;
+  password?: string;
+};
+
+type Props = {
+  values: CredentialValues;
+  isEditing?: boolean;
+  errors?: { username?: string; password?: string };
+  onChange: (values: Partial<CredentialValues>) => void;
+};
+
+export function ProviderCredentialFields({
+  values: { username, password },
+  isEditing = false,
+  errors,
+  onChange,
+}: Props) {
+  return (
+    <div className="flex flex-col gap-y-4">
+      <UsernameField
+        value={username || ''}
+        onChange={(value) => onChange({ username: value })}
+        error={errors?.username}
+      />
+
+      <PasswordField
+        value={password || ''}
+        onChange={(value) => onChange({ password: value })}
+        label="Personal Access Token"
+        tooltip="Provide a personal access token or password"
+        error={errors?.password}
+        required={!isEditing}
+      />
+    </div>
+  );
+}
diff --git a/app/react/portainer/gitops/sources/components/UsernameField.tsx b/app/react/portainer/gitops/sources/components/UsernameField.tsx
new file mode 100644
index 0000000..c007ed0
--- /dev/null
+++ b/app/react/portainer/gitops/sources/components/UsernameField.tsx
@@ -0,0 +1,30 @@
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+
+type Props = {
+  value: string;
+  onChange: (value: string) => void;
+  tooltip?: string;
+  error?: string;
+};
+
+export function UsernameField({ value, onChange, tooltip, error }: Props) {
+  return (
+    <FormControl
+      inputId="Username"
+      label="Username"
+      errors={error}
+      tooltip={tooltip}
+    >
+      <Input
+        id="Username"
+        name="username"
+        value={value}
+        autoComplete="off"
+        onChange={(e) => onChange(e.target.value)}
+        data-cy="component-gitUsernameInput"
+        placeholder="git username"
+      />
+    </FormControl>
+  );
+}
diff --git a/app/react/portainer/gitops/sources/queries/query-keys.ts b/app/react/portainer/gitops/sources/queries/query-keys.ts
new file mode 100644
index 0000000..6a4374d
--- /dev/null
+++ b/app/react/portainer/gitops/sources/queries/query-keys.ts
@@ -0,0 +1,6 @@
+export const sourceQueryKeys = {
+  all: ['gitops', 'sources'] as const,
+  list: (params: object) => [...sourceQueryKeys.all, 'list', params] as const,
+  summary: () => [...sourceQueryKeys.all, 'summary'] as const,
+  detail: (id: number) => [...sourceQueryKeys.all, 'detail', id] as const,
+};
diff --git a/app/react/portainer/gitops/sources/queries/useDeleteSourceMutation.ts b/app/react/portainer/gitops/sources/queries/useDeleteSourceMutation.ts
new file mode 100644
index 0000000..6c5dff5
--- /dev/null
+++ b/app/react/portainer/gitops/sources/queries/useDeleteSourceMutation.ts
@@ -0,0 +1,26 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { gitOpsSourcesDelete } from '@api/sdk.gen';
+
+import { withError } from '@/react-tools/react-query';
+
+import { Source } from '../types';
+
+import { sourceQueryKeys } from './query-keys';
+
+async function deleteSource(id: Source['id']): Promise<void> {
+  await gitOpsSourcesDelete({ path: { id } });
+}
+
+export function useDeleteSourceMutation() {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: deleteSource,
+    onSuccess: (_, id) => {
+      queryClient.removeQueries({ queryKey: sourceQueryKeys.detail(id) });
+      queryClient.invalidateQueries({ queryKey: sourceQueryKeys.all });
+    },
+    ...withError('Unable to delete source'),
+  });
+}
diff --git a/app/react/portainer/gitops/sources/queries/useSource.ts b/app/react/portainer/gitops/sources/queries/useSource.ts
new file mode 100644
index 0000000..b1b3d45
--- /dev/null
+++ b/app/react/portainer/gitops/sources/queries/useSource.ts
@@ -0,0 +1,141 @@
+import { useQuery } from '@tanstack/react-query';
+
+import {
+  type SourcesGitAuthInfo,
+  type SourcesConnectionInfo,
+  type SourcesAutoUpdateInfo,
+  type SourcesSourceDetail,
+  WorkflowsWorkflow,
+  WorkflowsWorkflowStatusObject,
+  WorkflowsStatus,
+  WorkflowsWorkflowPhaseStatus,
+  GittypesRepoConfig,
+  GittypesGitAuthentication,
+} from '@api/types.gen';
+import { gitOpsSourceGet } from '@api/sdk.gen';
+
+import { withError } from '@/react-tools/react-query';
+import {
+  type RepoConfigResponse,
+  type GitAuthenticationResponse,
+} from '@/react/portainer/gitops/types';
+import { AuthTypeOption } from '@/react/portainer/account/git-credentials/types';
+
+import { Source } from '../types';
+import {
+  Workflow,
+  WorkflowPhaseStatus,
+  WorkflowStatus,
+  WorkflowStatusObject,
+} from '../../workflows/types';
+
+import { sourceQueryKeys } from './query-keys';
+
+export type GitAuthInfo = SourcesGitAuthInfo;
+export type ConnectionInfo = SourcesConnectionInfo;
+export type AutoUpdateInfo = SourcesAutoUpdateInfo;
+
+export type SourceDetail = Omit<SourcesSourceDetail, 'workflows' | 'usedBy'> & {
+  workflows: Array<Workflow>;
+  usedBy: number;
+};
+
+export function sourceOptions(id: Source['id']) {
+  return {
+    queryKey: sourceQueryKeys.detail(id!),
+    queryFn: () => getSource(id!),
+    ...withError('Failed loading source'),
+  };
+}
+
+export function useSource(id: Source['id'] | undefined) {
+  return useQuery({
+    ...sourceOptions(id!),
+    enabled: !!id,
+  });
+}
+
+export async function getSource(id: Source['id']): Promise<SourceDetail> {
+  const { data } = await gitOpsSourceGet({ path: { id } });
+
+  return toSourceDetails(data);
+
+  function toSourceDetails(source: SourcesSourceDetail): SourceDetail {
+    return {
+      ...source,
+      workflows: source.workflows?.map(toWorkflow) ?? [],
+      usedBy: source.usedBy ?? 0,
+    };
+
+    function toWorkflow(workflow: WorkflowsWorkflow): Workflow {
+      return {
+        ...workflow,
+        creationDate: workflow.creationDate ?? 0,
+        lastSyncDate: workflow.lastSyncDate ?? 0,
+        status: toWorkflowStatusObject(workflow.status),
+        gitConfig: toWorkflowGitConfig(workflow.gitConfig),
+      };
+    }
+
+    function toWorkflowStatusObject(
+      statusObj: WorkflowsWorkflowStatusObject
+    ): WorkflowStatusObject {
+      return {
+        ...statusObj,
+        source: toPhaseStatus(statusObj.source),
+        artifact: toPhaseStatus(statusObj.artifact),
+        target: toPhaseStatus(statusObj.target),
+      };
+    }
+  }
+
+  function toPhaseStatus(
+    phaseStatus: WorkflowsWorkflowPhaseStatus | undefined
+  ): WorkflowPhaseStatus {
+    return {
+      ...phaseStatus,
+      status: toWorkflowStatus(phaseStatus?.status),
+    };
+  }
+
+  function toWorkflowStatus(
+    status: WorkflowsStatus | undefined
+  ): WorkflowStatus {
+    if (!status) {
+      return 'unknown';
+    }
+
+    return status;
+  }
+
+  function toWorkflowGitConfig(
+    gitConfig: GittypesRepoConfig | undefined
+  ): RepoConfigResponse | undefined {
+    if (!gitConfig) {
+      return undefined;
+    }
+
+    return {
+      URL: gitConfig.URL ?? '',
+      ReferenceName: gitConfig.ReferenceName ?? '',
+      ConfigFilePath: gitConfig.ConfigFilePath ?? '',
+      ConfigHash: gitConfig.ConfigHash ?? '',
+      TLSSkipVerify: gitConfig.TLSSkipVerify ?? false,
+      Authentication: toGitAuthentication(gitConfig.Authentication),
+    };
+  }
+
+  function toGitAuthentication(
+    auth: GittypesGitAuthentication | undefined
+  ): GitAuthenticationResponse | undefined {
+    if (!auth) {
+      return undefined;
+    }
+
+    return {
+      Username: auth.Username,
+      Password: auth.Password,
+      AuthorizationType: auth.AuthorizationType as AuthTypeOption | undefined,
+    };
+  }
+}
diff --git a/app/react/portainer/gitops/sources/queries/useSources.ts b/app/react/portainer/gitops/sources/queries/useSources.ts
new file mode 100644
index 0000000..5d2537a
--- /dev/null
+++ b/app/react/portainer/gitops/sources/queries/useSources.ts
@@ -0,0 +1,36 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+import { withPaginationHeaders } from '@/react/common/api/pagination.types';
+
+import { Source, SourceStatus, SourceType } from '../types';
+
+import { sourceQueryKeys } from './query-keys';
+
+export interface SourcesParams {
+  search?: string;
+  sort?: string;
+  order?: 'asc' | 'desc';
+  start?: number;
+  limit?: number;
+  status?: SourceStatus | null;
+  type?: SourceType | null;
+}
+
+async function getSources(params: SourcesParams) {
+  const response = await axios.get<Source[]>('/gitops/sources', { params });
+  return withPaginationHeaders(response);
+}
+
+export function useSources(
+  params: SourcesParams,
+  { enabled = true }: { enabled?: boolean } = {}
+) {
+  return useQuery({
+    queryKey: sourceQueryKeys.list(params),
+    queryFn: () => getSources(params),
+    enabled,
+    ...withError('Failed loading sources'),
+  });
+}
diff --git a/app/react/portainer/gitops/sources/queries/useSourcesSummary.ts b/app/react/portainer/gitops/sources/queries/useSourcesSummary.ts
new file mode 100644
index 0000000..fae664c
--- /dev/null
+++ b/app/react/portainer/gitops/sources/queries/useSourcesSummary.ts
@@ -0,0 +1,23 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+
+import { SourceStatus } from '../types';
+
+import { sourceQueryKeys } from './query-keys';
+
+export type SourcesSummary = Record<SourceStatus, number>;
+
+async function getSourcesSummary(): Promise<SourcesSummary> {
+  const { data } = await axios.get<SourcesSummary>('/gitops/sources/summary');
+  return data;
+}
+
+export function useSourcesSummary() {
+  return useQuery({
+    queryKey: sourceQueryKeys.summary(),
+    queryFn: getSourcesSummary,
+    ...withError('Failed loading sources summary'),
+  });
+}
diff --git a/app/react/portainer/gitops/sources/queries/useTestSourceConnectionMutation.ts b/app/react/portainer/gitops/sources/queries/useTestSourceConnectionMutation.ts
new file mode 100644
index 0000000..c7c51c8
--- /dev/null
+++ b/app/react/portainer/gitops/sources/queries/useTestSourceConnectionMutation.ts
@@ -0,0 +1,33 @@
+import { useMutation } from '@tanstack/react-query';
+
+import { type SourcesConnectionTestResult } from '@api/types.gen';
+import { gitOpsSourcesTestById } from '@api/sdk.gen';
+
+import { withError } from '@/react-tools/react-query';
+
+import { Source } from '../types';
+
+import { UpdateSourcePayload } from './useUpdateSourceMutation';
+
+export type ConnectionTestResult = SourcesConnectionTestResult;
+
+async function testSourceConnection(
+  id: Source['id'],
+  payload: UpdateSourcePayload
+): Promise<ConnectionTestResult> {
+  const { data } = await gitOpsSourcesTestById({ path: { id }, body: payload });
+  return data;
+}
+
+export function useTestSourceConnectionMutation() {
+  return useMutation({
+    mutationFn: ({
+      id,
+      payload = {},
+    }: {
+      id: Source['id'];
+      payload?: UpdateSourcePayload;
+    }) => testSourceConnection(id, payload),
+    ...withError('Connection test failed'),
+  });
+}
diff --git a/app/react/portainer/gitops/sources/queries/useUpdateSourceAccessMutation.ts b/app/react/portainer/gitops/sources/queries/useUpdateSourceAccessMutation.ts
new file mode 100644
index 0000000..2a27ccc
--- /dev/null
+++ b/app/react/portainer/gitops/sources/queries/useUpdateSourceAccessMutation.ts
@@ -0,0 +1,36 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { type SourcesSourceAccess } from '@api/types.gen';
+import { gitOpsSourcesUpdateAccess } from '@api/sdk.gen';
+
+import { withError } from '@/react-tools/react-query';
+
+import { Source } from '../types';
+
+import { sourceQueryKeys } from './query-keys';
+
+export type UpdateSourceAccessPayload = SourcesSourceAccess;
+
+async function updateSourceAccess(
+  id: Source['id'],
+  payload: UpdateSourceAccessPayload
+): Promise<void> {
+  await gitOpsSourcesUpdateAccess({
+    path: { id },
+    body: payload,
+  });
+}
+
+export function useUpdateSourceAccessMutation(id: Source['id']) {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: (payload: UpdateSourceAccessPayload) =>
+      updateSourceAccess(id, payload),
+    onSuccess: () =>
+      queryClient.invalidateQueries({
+        queryKey: sourceQueryKeys.detail(id),
+      }),
+    ...withError('Unable to update source access'),
+  });
+}
diff --git a/app/react/portainer/gitops/sources/queries/useUpdateSourceMutation.ts b/app/react/portainer/gitops/sources/queries/useUpdateSourceMutation.ts
new file mode 100644
index 0000000..8855cd5
--- /dev/null
+++ b/app/react/portainer/gitops/sources/queries/useUpdateSourceMutation.ts
@@ -0,0 +1,33 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { gitOpsSourcesUpdateGit } from '@api/sdk.gen';
+
+import { withError } from '@/react-tools/react-query';
+import { SourcesGitSourceUpdatePayload } from '@/react/portainer/generated-api/portainer/types.gen';
+
+import { Source } from '../types';
+
+import { sourceQueryKeys } from './query-keys';
+
+export type UpdateSourcePayload = SourcesGitSourceUpdatePayload;
+
+async function updateSource(
+  id: Source['id'],
+  payload: UpdateSourcePayload
+): Promise<void> {
+  await gitOpsSourcesUpdateGit({ path: { id }, body: payload });
+}
+
+export function useUpdateSourceMutation(id: Source['id']) {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: (payload: UpdateSourcePayload) => updateSource(id, payload),
+    onSuccess: () => {
+      return queryClient.invalidateQueries({
+        queryKey: sourceQueryKeys.detail(id),
+      });
+    },
+    ...withError('Unable to update source'),
+  });
+}
diff --git a/app/react/portainer/gitops/sources/types.ts b/app/react/portainer/gitops/sources/types.ts
new file mode 100644
index 0000000..0b0b8a3
--- /dev/null
+++ b/app/react/portainer/gitops/sources/types.ts
@@ -0,0 +1,27 @@
+import { type LucideIcon, Box, GitBranch, Package } from 'lucide-react';
+
+import { WorkflowsStatus, SourcesSourceType } from '@api/types.gen';
+
+export type SourceStatus = WorkflowsStatus;
+export type SourceType = SourcesSourceType;
+
+export interface Source {
+  id: number;
+  name: string;
+  type: SourceType;
+  url: string;
+  status: SourceStatus;
+  error?: string;
+  usedBy: number;
+  environments: number;
+  lastSync: number;
+}
+
+export const SOURCE_TYPES: Record<
+  SourceType,
+  { label: string; icon: LucideIcon }
+> = {
+  git: { label: 'Git', icon: GitBranch },
+  helm: { label: 'Helm', icon: Package },
+  oci: { label: 'OCI', icon: Box },
+};
diff --git a/app/react/portainer/gitops/types.ts b/app/react/portainer/gitops/types.ts
new file mode 100644
index 0000000..f96eb4b
--- /dev/null
+++ b/app/react/portainer/gitops/types.ts
@@ -0,0 +1,80 @@
+import { AuthTypeOption } from '@/react/portainer/account/git-credentials/types';
+
+import {
+  AutoUpdateModel,
+  getDefaultAutoUpdateValues,
+} from './AutoUpdateFieldset/utils';
+
+export type {
+  AutoUpdateMechanism,
+  AutoUpdateModel,
+  AutoUpdateResponse,
+} from './AutoUpdateFieldset/utils';
+
+export { type RelativePathModel } from './RelativePathFieldset/types';
+
+export interface GitAuthenticationResponse {
+  Username?: string;
+  Password?: string;
+  AuthorizationType?: AuthTypeOption;
+}
+
+export interface RepoConfigResponse {
+  URL: string;
+  ReferenceName: string;
+  ConfigFilePath: string;
+  Authentication?: GitAuthenticationResponse;
+  ConfigHash: string;
+  TLSSkipVerify: boolean;
+}
+
+export type DeployMethod = 'compose' | 'manifest' | 'helm';
+
+export interface GitFormModel {
+  SourceId?: number;
+  ComposeFilePathInRepository?: string;
+  RepositoryReferenceName?: string;
+  AdditionalFiles?: string[];
+  /**
+   * Auto update
+   *
+   * if undefined, GitForm won't show the AutoUpdate fieldset
+   */
+  AutoUpdate?: AutoUpdateModel;
+
+  /** Used to create stacks from app templates */
+  RepositoryURL?: string;
+}
+
+export function getDefaultModel(
+  autoUpdate: AutoUpdateModel = getDefaultAutoUpdateValues()
+): GitFormModel {
+  return {
+    ComposeFilePathInRepository: 'docker-compose.yml',
+    RepositoryReferenceName: 'refs/heads/main',
+    AutoUpdate: autoUpdate,
+    SourceId: 0,
+  };
+}
+
+export function toGitFormModel(
+  sourceId?: number,
+  response?: Omit<
+    RepoConfigResponse,
+    'URL' | 'TLSSkipVerify' | 'ConfigHash' | 'Authentication'
+  >,
+  autoUpdate?: AutoUpdateModel
+): GitFormModel {
+  if (!response) {
+    return getDefaultModel(autoUpdate);
+  }
+
+  const { ReferenceName, ConfigFilePath } = response;
+
+  return {
+    ComposeFilePathInRepository: ConfigFilePath,
+    RepositoryReferenceName: ReferenceName,
+    AutoUpdate: autoUpdate,
+    SourceId: sourceId,
+  };
+}
diff --git a/app/react/portainer/gitops/utils.ts b/app/react/portainer/gitops/utils.ts
new file mode 100644
index 0000000..7c5f69d
--- /dev/null
+++ b/app/react/portainer/gitops/utils.ts
@@ -0,0 +1,35 @@
+import { StackDeploymentInfo } from '@/react/common/stacks/types';
+
+import { confirm } from '@@/modals/confirm';
+
+import { RepoConfigResponse } from './types';
+
+export function confirmEnableTLSVerify() {
+  return confirm({
+    title: 'Enable TLS Verification?',
+    message:
+      'Enabling the verification of TLS certificates without ensuring the correct configuration of your Certificate Authority (CA) for self-signed certificates can result in deployment failures.',
+  });
+}
+export function isGitConfigDiverged(
+  gitConfig: RepoConfigResponse,
+  currentDeploymentInfo: StackDeploymentInfo | null | undefined
+) {
+  if (!currentDeploymentInfo) return false;
+
+  // treat missing field as unchanged
+
+  const urlChanged =
+    typeof currentDeploymentInfo.RepositoryURL !== 'undefined' &&
+    currentDeploymentInfo.RepositoryURL !== gitConfig.URL;
+
+  const refChanged =
+    typeof currentDeploymentInfo.ReferenceName !== 'undefined' &&
+    currentDeploymentInfo.ReferenceName !== gitConfig.ReferenceName;
+
+  const fileChanged =
+    typeof currentDeploymentInfo.ConfigFilePath !== 'undefined' &&
+    currentDeploymentInfo.ConfigFilePath !== gitConfig.ConfigFilePath;
+
+  return urlChanged || refChanged || fileChanged;
+}
diff --git a/app/react/portainer/gitops/workflows/ItemView/FilesSection.tsx b/app/react/portainer/gitops/workflows/ItemView/FilesSection.tsx
new file mode 100644
index 0000000..1a8ab55
--- /dev/null
+++ b/app/react/portainer/gitops/workflows/ItemView/FilesSection.tsx
@@ -0,0 +1,89 @@
+import { FileTextIcon } from 'lucide-react';
+
+import { WorkflowsArtifactFileDetail } from '@api/types.gen';
+
+import { Card } from '@@/primitives/Card';
+import { Badge } from '@@/Badge';
+
+import { WorkflowSourcesResult } from '../queries/useWorkflowSources';
+import { WorkflowArtifact } from '../types';
+
+interface Props {
+  artifacts: WorkflowArtifact[];
+  sources: WorkflowSourcesResult;
+}
+
+interface FileGroup {
+  sourceId: number;
+  files: WorkflowsArtifactFileDetail[];
+}
+
+function groupFilesBySource(artifacts: WorkflowArtifact[]): FileGroup[] {
+  const groups = new Map<number, WorkflowsArtifactFileDetail[]>();
+
+  artifacts
+    .flatMap((artifact) => artifact.files)
+    .forEach((file) => {
+      const files = groups.get(file.sourceId) ?? [];
+      files.push(file);
+      groups.set(file.sourceId, files);
+    });
+
+  return [...groups.entries()].map(([sourceId, files]) => ({
+    sourceId,
+    files,
+  }));
+}
+
+export function FilesSection({ artifacts, sources }: Props) {
+  const groups = groupFilesBySource(artifacts);
+  const sourceNames = new Map(
+    sources.map(({ sourceId, query }) => [sourceId, query.data?.name])
+  );
+
+  return (
+    <Card.Container aria-label="Files">
+      <Card.Header
+        icon={FileTextIcon}
+        title="Files"
+        actions={<Badge type="muted">{groups.length}</Badge>}
+      />
+      <ul className="m-0 list-none divide-y divide-solid divide-gray-3 p-0 th-dark:divide-gray-9">
+        {groups.map((group) => (
+          <FileGroupRow
+            key={group.sourceId}
+            group={group}
+            sourceName={sourceNames.get(group.sourceId)}
+          />
+        ))}
+      </ul>
+    </Card.Container>
+  );
+}
+
+function FileGroupRow({
+  group,
+  sourceName,
+}: {
+  group: FileGroup;
+  sourceName: string | undefined;
+}) {
+  return (
+    <li className="px-4 py-3">
+      <p className="m-0 font-semibold text-gray-9 th-highcontrast:text-white th-dark:text-white">
+        {sourceName ?? 'Unknown source'}
+      </p>
+      <ul className="m-0 mt-1 list-none space-y-1 p-0">
+        {group.files.map((file) => (
+          <li
+            key={`${file.path}-${file.ref}`}
+            className="flex items-center gap-2 font-mono text-xs text-gray-7 th-highcontrast:text-gray-3 th-dark:text-gray-4"
+          >
+            <span>{file.path}</span>
+            <span className="text-gray-5">@ {file.ref}</span>
+          </li>
+        ))}
+      </ul>
+    </li>
+  );
+}
diff --git a/app/react/portainer/gitops/workflows/ItemView/ItemView.test.tsx b/app/react/portainer/gitops/workflows/ItemView/ItemView.test.tsx
new file mode 100644
index 0000000..c17dbf5
--- /dev/null
+++ b/app/react/portainer/gitops/workflows/ItemView/ItemView.test.tsx
@@ -0,0 +1,99 @@
+import { render, screen } from '@testing-library/react';
+import { vi } from 'vitest';
+import { ReactNode } from 'react';
+import { HttpResponse } from 'msw';
+
+import { http, server } from '@/setup-tests/server';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { UserViewModel } from '@/portainer/models/user';
+
+import { WorkflowDetail } from '../types';
+import {
+  mockWorkflowHealthy,
+  mockWorkflowEmpty,
+} from '../test-utils/workflow.mock';
+
+import { ItemView } from './ItemView';
+
+const useCurrentStateAndParams = vi.fn(() => ({
+  params: { workflowId: 1 },
+}));
+
+vi.mock('@uirouter/react', async (importOriginal: () => Promise<object>) => ({
+  ...(await importOriginal()),
+  useCurrentStateAndParams: () => useCurrentStateAndParams(),
+}));
+
+// Avoid ui-router relative/unregistered state resolution in tests, same as WidgetTabs.test.tsx
+vi.mock('@@/Link', () => ({
+  Link: ({
+    children,
+    'data-cy': dataCy,
+    className,
+  }: {
+    children: ReactNode;
+    'data-cy'?: string;
+    className?: string;
+  }) => (
+    <a data-cy={dataCy} className={className} href="/">
+      {children}
+    </a>
+  ),
+}));
+
+describe('ItemView', () => {
+  it('renders the workflow name and status badge once loaded', async () => {
+    renderComponent();
+
+    expect(
+      await screen.findByRole('heading', { name: mockWorkflowHealthy.name })
+    ).toBeInTheDocument();
+    expect(screen.getByText('Healthy')).toBeInTheDocument();
+  });
+
+  it('renders the Overview tab sections with the fixture artifact', async () => {
+    renderComponent();
+
+    await screen.findByRole('heading', { name: mockWorkflowHealthy.name });
+
+    expect(screen.getByText('Stacks')).toBeInTheDocument();
+    expect(screen.getAllByText('Targets').length).toBeGreaterThan(0);
+    expect(screen.getByText('Files')).toBeInTheDocument();
+    expect(screen.getByText('Sources')).toBeInTheDocument();
+    expect(
+      (await screen.findAllByText('docker-compose.yml')).length
+    ).toBeGreaterThan(0);
+  });
+
+  it('renders the empty state for a zero-artifact workflow', async () => {
+    renderComponent(mockWorkflowEmpty);
+
+    expect(
+      await screen.findByRole('heading', { name: mockWorkflowEmpty.name })
+    ).toBeInTheDocument();
+    expect(screen.getAllByText('No artifacts').length).toBeGreaterThan(0);
+    expect(screen.queryByText('Stacks')).not.toBeInTheDocument();
+  });
+});
+
+function renderComponent(workflow: WorkflowDetail = mockWorkflowHealthy) {
+  useCurrentStateAndParams.mockReturnValue({
+    params: { workflowId: workflow.id },
+  });
+
+  server.use(
+    http.get(`/api/gitops/workflows/${workflow.id}`, () =>
+      HttpResponse.json(workflow)
+    )
+  );
+
+  const user = new UserViewModel({ Username: 'user', Role: 1 });
+
+  const Wrapped = withTestQueryProvider(
+    withUserProvider(withTestRouter(ItemView), user)
+  );
+
+  return render(<Wrapped />);
+}
diff --git a/app/react/portainer/gitops/workflows/ItemView/ItemView.tsx b/app/react/portainer/gitops/workflows/ItemView/ItemView.tsx
new file mode 100644
index 0000000..d7bd882
--- /dev/null
+++ b/app/react/portainer/gitops/workflows/ItemView/ItemView.tsx
@@ -0,0 +1,81 @@
+import { useIdParam } from '@/react/hooks/useIdParam';
+
+import { PageHeader } from '@@/PageHeader';
+import { ResourceDetailHeaderSkeleton } from '@@/ResourceDetailHeader/ResourceDetailHeaderSkeleton';
+import { Alert } from '@@/Alert';
+import { Tab, WidgetTabs, useCurrentTabIndex } from '@@/Widget/WidgetTabs';
+
+import { useWorkflow } from '../queries/useWorkflow';
+import { WorkflowDetail } from '../types';
+
+import { WorkflowResourceHeader } from './WorkflowResourceHeader';
+import { OverviewTab } from './OverviewTab';
+
+const breadcrumbs = [
+  { label: 'GitOps Workflows', link: 'portainer.gitops.workflows' },
+  'Workflow',
+];
+
+export function ItemView() {
+  const workflowId = useIdParam('workflowId');
+
+  const workflowQuery = useWorkflow(workflowId);
+  const workflow = workflowQuery.data;
+
+  if (workflowQuery.isLoading) {
+    return (
+      <>
+        <PageHeader breadcrumbs={breadcrumbs} />
+        <div className="mx-4 mb-4 space-y-4">
+          <ResourceDetailHeaderSkeleton statBlockCount={1} />
+        </div>
+      </>
+    );
+  }
+
+  if (!workflow || workflowQuery.isError) {
+    const error = workflowQuery.error;
+
+    return (
+      <>
+        <PageHeader breadcrumbs={breadcrumbs} />
+        <div className="mx-4 mb-4 space-y-4">
+          <Alert color="error">
+            Failed loading workflow:{' '}
+            {error instanceof Error ? error.message : 'Unknown error'}
+          </Alert>
+        </div>
+      </>
+    );
+  }
+
+  return <PageContent workflow={workflow} />;
+}
+
+function PageContent({ workflow }: { workflow: WorkflowDetail }) {
+  const workflowTabs: Tab[] = [
+    {
+      name: 'Overview',
+      selectedTabParam: 'overview',
+      widget: <OverviewTab workflow={workflow} />,
+    },
+  ];
+  const currentTabIndex = useCurrentTabIndex(workflowTabs);
+
+  return (
+    <>
+      <PageHeader
+        breadcrumbs={[
+          { label: 'GitOps Workflows', link: 'portainer.gitops.workflows' },
+          workflow.name,
+        ]}
+        reload
+      />
+      <div className="mx-4 space-y-4 pb-4">
+        <WorkflowResourceHeader workflow={workflow} />
+        <WidgetTabs tabs={workflowTabs} currentTabIndex={currentTabIndex} />
+        {workflowTabs[currentTabIndex].widget}
+      </div>
+    </>
+  );
+}
diff --git a/app/react/portainer/gitops/workflows/ItemView/OverviewTab.tsx b/app/react/portainer/gitops/workflows/ItemView/OverviewTab.tsx
new file mode 100644
index 0000000..ceb580e
--- /dev/null
+++ b/app/react/portainer/gitops/workflows/ItemView/OverviewTab.tsx
@@ -0,0 +1,49 @@
+import { PackageOpenIcon } from 'lucide-react';
+
+import { Card } from '@@/primitives/Card';
+import { Icon } from '@@/Icon';
+
+import { useWorkflowSources } from '../queries/useWorkflowSources';
+import { WorkflowDetail } from '../types';
+
+import { StacksSection } from './StacksSection';
+import { TargetsSection } from './TargetsSection';
+import { FilesSection } from './FilesSection';
+import { SourcesSection } from './SourcesSection';
+
+interface Props {
+  workflow: WorkflowDetail;
+}
+
+export function OverviewTab({ workflow }: Props) {
+  const sources = useWorkflowSources(workflow.artifacts);
+
+  if (workflow.artifacts.length === 0) {
+    return <EmptyOverview />;
+  }
+
+  return (
+    <div className="space-y-4">
+      <SourcesSection sources={sources} />
+      <FilesSection artifacts={workflow.artifacts} sources={sources} />
+      <TargetsSection artifacts={workflow.artifacts} />
+      <StacksSection artifacts={workflow.artifacts} />
+    </div>
+  );
+}
+
+function EmptyOverview() {
+  return (
+    <Card.Container>
+      <div className="flex flex-col items-center gap-2 py-12 text-center">
+        <Icon icon={PackageOpenIcon} size="xl" className="text-gray-5" />
+        <p className="m-0 font-semibold text-gray-9 th-highcontrast:text-white th-dark:text-white">
+          No artifacts
+        </p>
+        <p className="m-0 text-sm text-gray-6">
+          This workflow has no stacks or edge stacks associated with it yet.
+        </p>
+      </div>
+    </Card.Container>
+  );
+}
diff --git a/app/react/portainer/gitops/workflows/ItemView/SourcesSection.tsx b/app/react/portainer/gitops/workflows/ItemView/SourcesSection.tsx
new file mode 100644
index 0000000..1a69b82
--- /dev/null
+++ b/app/react/portainer/gitops/workflows/ItemView/SourcesSection.tsx
@@ -0,0 +1,74 @@
+import { GitBranchIcon } from 'lucide-react';
+
+import { Card } from '@@/primitives/Card';
+import { Badge } from '@@/Badge';
+import { Link } from '@@/Link';
+
+import { StatusBadge } from '../../components/StatusBadge';
+import {
+  WorkflowSourcesResult,
+  WorkflowSourceQuery,
+} from '../queries/useWorkflowSources';
+import { Dot } from '../ListView/WorkflowSubRow/Block';
+
+interface Props {
+  sources: WorkflowSourcesResult;
+}
+
+export function SourcesSection({ sources }: Props) {
+  return (
+    <Card.Container aria-label="Sources">
+      <Card.Header
+        icon={GitBranchIcon}
+        title="Sources"
+        actions={<Badge type="muted">{sources.length}</Badge>}
+      />
+      <ul className="m-0 list-none divide-y divide-solid divide-gray-3 p-0 th-dark:divide-gray-9">
+        {sources.map(({ sourceId, query }) => (
+          <SourceRow key={sourceId} query={query} />
+        ))}
+      </ul>
+    </Card.Container>
+  );
+}
+
+function SourceRow({ query }: { query: WorkflowSourceQuery['query'] }) {
+  if (query.isLoading) {
+    return (
+      <li className="animate-pulse px-4 py-3">
+        <div className="h-4 w-48 rounded bg-gray-3 th-dark:bg-gray-8" />
+      </li>
+    );
+  }
+
+  const source = query.data;
+  if (!source || query.isError) {
+    return (
+      <li className="flex items-center gap-2 px-4 py-3 text-gray-6">
+        <Dot status="unknown" />
+        Unknown source
+      </li>
+    );
+  }
+
+  return (
+    <li>
+      <Link
+        to="portainer.gitops.sources.item"
+        params={{ sourceId: source.id }}
+        data-cy={`workflow-source-link-${source.id}`}
+        className="flex items-center gap-4 px-4 py-3 no-underline hover:bg-gray-1 hover:no-underline th-dark:hover:bg-gray-10"
+      >
+        <StatusBadge status={source.status} />
+        <div className="min-w-0 flex-1">
+          <p className="m-0 truncate font-semibold text-gray-9 th-highcontrast:text-white th-dark:text-white">
+            {source.name}
+          </p>
+          <p className="m-0 mt-0.5 truncate text-xs text-gray-7 th-highcontrast:text-gray-3 th-dark:text-gray-4">
+            {source.url}
+          </p>
+        </div>
+      </Link>
+    </li>
+  );
+}
diff --git a/app/react/portainer/gitops/workflows/ItemView/StacksSection.tsx b/app/react/portainer/gitops/workflows/ItemView/StacksSection.tsx
new file mode 100644
index 0000000..4e592c4
--- /dev/null
+++ b/app/react/portainer/gitops/workflows/ItemView/StacksSection.tsx
@@ -0,0 +1,74 @@
+import { LayersIcon, ArrowRightIcon } from 'lucide-react';
+
+import { Card } from '@@/primitives/Card';
+import { Icon } from '@@/Icon';
+import { Badge } from '@@/Badge';
+import { Link } from '@@/Link';
+
+import { PlatformBadge } from '../../components/StatusBadge';
+import { TargetCell } from '../ListView/WorkflowSubRow/TargetCell';
+import { WorkflowArtifact } from '../types';
+import { Dot } from '../ListView/WorkflowSubRow/Block';
+import { getDeployedStackLink } from '../utils';
+
+interface Props {
+  artifacts: WorkflowArtifact[];
+}
+
+export function StacksSection({ artifacts }: Props) {
+  return (
+    <Card.Container aria-label="Stacks">
+      <Card.Header
+        icon={LayersIcon}
+        title="Stacks"
+        actions={<Badge type="muted">{artifacts.length}</Badge>}
+      />
+      <ul className="m-0 list-none divide-y divide-solid divide-gray-3 p-0 th-dark:divide-gray-9">
+        {artifacts.map((artifact) => (
+          <StackRow key={artifact.id} artifact={artifact} />
+        ))}
+      </ul>
+    </Card.Container>
+  );
+}
+
+function StackRow({ artifact }: { artifact: WorkflowArtifact }) {
+  const status = artifact.status.artifact.status;
+  const stackLink = getDeployedStackLink(artifact);
+
+  return (
+    <li className="flex items-center gap-4 px-4 py-3">
+      <Dot status={status} />
+      <div className="min-w-0 flex-1">
+        <p className="m-0 truncate font-semibold">
+          {stackLink ? (
+            <Link
+              to={stackLink.to}
+              params={stackLink.params}
+              data-cy={`workflow-stack-link-${artifact.id}`}
+              className="text-gray-9 th-highcontrast:text-white th-dark:text-white"
+            >
+              {artifact.name}
+            </Link>
+          ) : (
+            <span className="text-gray-9 th-highcontrast:text-white th-dark:text-white">
+              {artifact.name}
+            </span>
+          )}
+        </p>
+        <p className="m-0 mt-0.5 flex items-center gap-1 truncate font-mono text-xs text-gray-7 th-highcontrast:text-gray-3 th-dark:text-gray-4">
+          {artifact.files.map((file) => file.path).join(', ') || 'No files'}
+        </p>
+      </div>
+      <PlatformBadge platform={artifact.platform} />
+      <Icon icon={ArrowRightIcon} size="sm" className="shrink-0 text-gray-5" />
+      <div className="w-56 shrink-0">
+        <TargetCell
+          target={artifact.target}
+          type={artifact.type}
+          status={artifact.status.target.status}
+        />
+      </div>
+    </li>
+  );
+}
diff --git a/app/react/portainer/gitops/workflows/ItemView/TargetsSection.tsx b/app/react/portainer/gitops/workflows/ItemView/TargetsSection.tsx
new file mode 100644
index 0000000..2f45298
--- /dev/null
+++ b/app/react/portainer/gitops/workflows/ItemView/TargetsSection.tsx
@@ -0,0 +1,56 @@
+import { CrosshairIcon } from 'lucide-react';
+
+import { Card } from '@@/primitives/Card';
+import { Badge } from '@@/Badge';
+import { Alert } from '@@/Alert';
+
+import { TargetCell } from '../ListView/WorkflowSubRow/TargetCell';
+import { computeArtifactTargetCount } from '../status';
+import { WorkflowArtifact } from '../types';
+
+interface Props {
+  artifacts: WorkflowArtifact[];
+}
+
+export function TargetsSection({ artifacts }: Props) {
+  const targetCount = artifacts.reduce(
+    (sum, artifact) => sum + computeArtifactTargetCount(artifact),
+    0
+  );
+
+  return (
+    <Card.Container aria-label="Targets">
+      <Card.Header
+        icon={CrosshairIcon}
+        title="Targets"
+        actions={<Badge type="muted">{targetCount}</Badge>}
+      />
+      <div className="divide-y divide-solid divide-gray-3 th-dark:divide-gray-9">
+        {artifacts.map((artifact) => (
+          <TargetRow key={artifact.id} artifact={artifact} />
+        ))}
+      </div>
+    </Card.Container>
+  );
+}
+
+function TargetRow({ artifact }: { artifact: WorkflowArtifact }) {
+  return (
+    <div
+      className="flex flex-col gap-2 px-4 py-3"
+      data-cy={`workflow-target-row-${artifact.id}`}
+    >
+      <p className="m-0 text-xs font-semibold uppercase tracking-wide text-gray-6 th-dark:text-gray-6">
+        {artifact.name}
+      </p>
+      <TargetCell
+        target={artifact.target}
+        type={artifact.type}
+        status={artifact.status.target.status}
+      />
+      {artifact.status.target.error && (
+        <Alert color="error">{artifact.status.target.error}</Alert>
+      )}
+    </div>
+  );
+}
diff --git a/app/react/portainer/gitops/workflows/ItemView/WorkflowResourceHeader.tsx b/app/react/portainer/gitops/workflows/ItemView/WorkflowResourceHeader.tsx
new file mode 100644
index 0000000..f676201
--- /dev/null
+++ b/app/react/portainer/gitops/workflows/ItemView/WorkflowResourceHeader.tsx
@@ -0,0 +1,103 @@
+import { GitCommit, PenBoxIcon, PauseIcon, RefreshCwIcon } from 'lucide-react';
+import _ from 'lodash';
+
+import { Icon } from '@@/Icon';
+import { ResourceDetailHeader } from '@@/ResourceDetailHeader/ResourceDetailHeader';
+import { HeaderStats } from '@@/ResourceDetailHeader/HeaderStats';
+import { ResourceStatBlock } from '@@/ResourceDetailHeader/ResourceStatBlock';
+import { ActionBarShell } from '@@/ResourceDetailHeader/ActionBarShell';
+import { Button } from '@@/buttons';
+import { DeleteButton } from '@@/buttons/DeleteButton';
+import { TooltipWithChildren } from '@@/Tip/TooltipWithChildren';
+
+import { WorkflowDetail } from '../types';
+import { StatusBadge } from '../../components/StatusBadge';
+import { computeTargetRollup, effectiveWorkflowDetailStatus } from '../status';
+
+const COMING_SOON_MESSAGE = 'Coming soon';
+
+interface Props {
+  workflow: WorkflowDetail;
+}
+
+export function WorkflowResourceHeader({ workflow }: Props) {
+  const status = effectiveWorkflowDetailStatus(workflow);
+  const rollup = computeTargetRollup(workflow);
+
+  return (
+    <ResourceDetailHeader
+      icon={<Icon icon={GitCommit} size="xl" />}
+      title={workflow.name}
+      badge={<StatusBadge status={status.status} />}
+      rightInfo={
+        <HeaderStats>
+          <ResourceStatBlock
+            status={rollup.tone}
+            data-cy="workflow-targets-stat"
+          >
+            <ResourceStatBlock.Label>Targets</ResourceStatBlock.Label>
+            <ResourceStatBlock.Value align="center" size="base" dot>
+              {rollup.total > 0
+                ? `${rollup.synced}/${rollup.total} synced`
+                : 'No artifacts'}
+            </ResourceStatBlock.Value>
+          </ResourceStatBlock>
+        </HeaderStats>
+      }
+      actionBar={
+        <ActionBarShell>
+          <div className="flex items-center gap-2">
+            <TooltipWithChildren message={COMING_SOON_MESSAGE}>
+              <span>
+                <Button
+                  icon={PenBoxIcon}
+                  color="light"
+                  disabled
+                  data-cy="workflow-edit-button"
+                >
+                  Edit
+                </Button>
+              </span>
+            </TooltipWithChildren>
+            <TooltipWithChildren message={COMING_SOON_MESSAGE}>
+              <span>
+                <Button
+                  icon={RefreshCwIcon}
+                  color="light"
+                  disabled
+                  data-cy="workflow-sync-button"
+                >
+                  Force sync
+                </Button>
+              </span>
+            </TooltipWithChildren>
+            <TooltipWithChildren message={COMING_SOON_MESSAGE}>
+              <span>
+                <Button
+                  icon={PauseIcon}
+                  color="light"
+                  disabled
+                  data-cy="workflow-pause-button"
+                >
+                  Pause
+                </Button>
+              </span>
+            </TooltipWithChildren>
+          </div>
+          <div className="ml-auto">
+            <TooltipWithChildren message={COMING_SOON_MESSAGE}>
+              <span>
+                <DeleteButton
+                  confirmMessage="Are you sure you want to delete this workflow?"
+                  onConfirmed={_.noop}
+                  data-cy="workflow-delete-button"
+                  disabled
+                />
+              </span>
+            </TooltipWithChildren>
+          </div>
+        </ActionBarShell>
+      }
+    />
+  );
+}
diff --git a/app/react/portainer/gitops/workflows/ListView/ListView.tsx b/app/react/portainer/gitops/workflows/ListView/ListView.tsx
new file mode 100644
index 0000000..5436c7d
--- /dev/null
+++ b/app/react/portainer/gitops/workflows/ListView/ListView.tsx
@@ -0,0 +1,155 @@
+import { useMemo } from 'react';
+
+import { PageHeader } from '@@/PageHeader';
+import { StatusSummaryBar } from '@@/StatusSummaryBar/StatusSummaryBar';
+import {
+  SortableList,
+  SortableGroup,
+  SortOption,
+} from '@@/SortableList/SortableList';
+
+import { useWorkflows } from '../../queries/useWorkflows';
+import { useWorkflowsSummary } from '../../queries/useWorkflowsSummary';
+import { Workflow, WorkflowStatus } from '../types';
+import { effectiveWorkflowStatus } from '../status';
+
+import { WorkflowCard } from './WorkflowCard';
+import { useListState } from './useListState';
+
+const STATUS_CONFIG: Array<{
+  key: WorkflowStatus;
+  label: string;
+  color: 'error' | 'gray' | 'warning' | 'success';
+}> = [
+  { key: 'error', label: 'Error', color: 'error' },
+  { key: 'paused', label: 'Paused', color: 'gray' },
+  { key: 'syncing', label: 'Syncing', color: 'warning' },
+  { key: 'healthy', label: 'Healthy', color: 'success' },
+  { key: 'unknown', label: 'Unknown', color: 'gray' },
+];
+
+const SORT_OPTIONS: SortOption[] = [
+  { key: 'name', label: 'Name' },
+  { key: 'status', label: 'Status', grouped: true },
+  { key: 'type', label: 'Type', grouped: true },
+  { key: 'platform', label: 'Platform', grouped: true },
+  { key: 'lastSyncDate', label: 'Last sync' },
+];
+
+const GROUP_OPTIONS: Record<string, Array<{ key: string; label: string }>> = {
+  status: STATUS_CONFIG,
+  type: [
+    { key: 'stack', label: 'Stack' },
+    { key: 'edgeStack', label: 'Edge Stack' },
+  ],
+  platform: [
+    { key: 'dockerStandalone', label: 'Docker Standalone' },
+    { key: 'dockerSwarm', label: 'Docker Swarm' },
+    { key: 'kubernetes', label: 'Kubernetes' },
+  ],
+};
+
+const GROUP_FIELD: Record<string, (item: Workflow) => string> = {
+  status: (item: Workflow) => effectiveWorkflowStatus(item).status,
+  type: (item) => item.type,
+  platform: (item) => item.platform,
+};
+
+export function ListView() {
+  const tableState = useListState();
+
+  const sortBy = tableState.sortBy?.id ?? 'name';
+
+  const workflowsQuery = useWorkflows({
+    search: tableState.search || undefined,
+    sort: sortBy,
+    order: tableState.sortBy?.desc ? 'desc' : 'asc',
+    start: tableState.page * tableState.pageSize,
+    limit: tableState.pageSize,
+    status: tableState.status ?? undefined,
+    type: tableState.type ?? undefined,
+    platform: tableState.platform ?? undefined,
+  });
+
+  const summaryQuery = useWorkflowsSummary();
+
+  const page = workflowsQuery.data?.data;
+  const totalCount = workflowsQuery.data?.totalCount ?? 0;
+
+  const groups = useMemo(() => buildGroups(page, sortBy), [page, sortBy]);
+
+  const statusSegments = STATUS_CONFIG.map((s) => ({
+    ...s,
+    count: summaryQuery.data?.[s.key] ?? 0,
+  }));
+
+  const groupOptions = useMemo(
+    () => ({
+      ...GROUP_OPTIONS,
+      status: statusSegments,
+    }),
+    [statusSegments]
+  );
+
+  const summaryTotal = summaryQuery.data
+    ? Object.values(summaryQuery.data).reduce((a, b) => a + b, 0)
+    : 0;
+
+  return (
+    <>
+      <PageHeader
+        title="GitOps Workflows"
+        breadcrumbs="GitOps Workflows"
+        reload
+      />
+      <div className="mx-4 mb-4 space-y-4">
+        <StatusSummaryBar
+          total={summaryTotal}
+          segments={statusSegments}
+          value={tableState.status}
+          onChange={tableState.setStatus}
+          radioGroupName="workflows-status"
+          isLoading={summaryQuery.isLoading}
+        />
+        <SortableList
+          tableState={tableState}
+          sortOptions={SORT_OPTIONS}
+          groupOptions={groupOptions}
+          groups={groups}
+          totalCount={totalCount}
+          isLoading={workflowsQuery.isLoading}
+          getItemKey={(item) => `${item.type}-${item.id}`}
+          showGroupHeaders
+          emptyMessage="No workflows found"
+          searchPlaceholder="Search"
+          renderItem={(item) => <WorkflowCard item={item} />}
+          data-cy="workflows-list"
+        />
+      </div>
+    </>
+  );
+}
+
+function buildGroups(
+  items: Workflow[] | null = [],
+  sortBy: string
+): SortableGroup<Workflow>[] {
+  if (!items) {
+    return [];
+  }
+
+  const options = GROUP_OPTIONS[sortBy];
+
+  if (!options) {
+    return items.length > 0 ? [{ key: 'all', label: 'All', items }] : [];
+  }
+
+  const getField = GROUP_FIELD[sortBy];
+  return options
+    .map(({ key, label }) => ({
+      key,
+      label,
+      items: items.filter((item) => getField(item) === key),
+    }))
+    .filter((g) => g.items.length > 0);
+}
diff --git a/app/react/portainer/gitops/workflows/ListView/WorkflowCard.tsx b/app/react/portainer/gitops/workflows/ListView/WorkflowCard.tsx
new file mode 100644
index 0000000..d3e65a7
--- /dev/null
+++ b/app/react/portainer/gitops/workflows/ListView/WorkflowCard.tsx
@@ -0,0 +1,101 @@
+import { AlertTriangle, GitCommit, WatchIcon } from 'lucide-react';
+import moment from 'moment';
+
+import { StackType } from '@/react/common/stacks/types';
+
+import { Icon } from '@@/Icon';
+import { Link } from '@@/Link';
+import { SortableListItem } from '@@/SortableList/SortableListItem';
+
+import { Workflow, WorkflowType } from '../types';
+import { StatusBadge, TypeBadge } from '../../components/StatusBadge';
+import { effectiveWorkflowStatus } from '../status';
+
+import { WorkflowSubRow } from './WorkflowSubRow/WorkflowSubRow';
+
+export function WorkflowCard({ item }: { item: Workflow }) {
+  const { to, params } = getWorkflowLink(item);
+
+  const { status: effectiveStatus, error: errorMessage } =
+    effectiveWorkflowStatus(item);
+
+  return (
+    <SortableListItem>
+      <div className="flex gap-4">
+        <div className="mt-0.5 flex h-10 w-10 shrink-0 items-center justify-center rounded bg-gray-2 th-dark:bg-gray-8">
+          <Icon icon={GitCommit} size="md" className="text-gray-6" />
+        </div>
+        <div className="min-w-0 flex-1">
+          <div className="mb-3 flex items-center justify-between">
+            <div className="flex items-center gap-2">
+              <Link
+                to={to}
+                params={params}
+                data-cy={`workflow-link-${item.id}`}
+                className="font-semibold tracking-wide text-gray-9 th-highcontrast:text-white th-dark:text-white"
+              >
+                {item.name}
+              </Link>
+              <StatusBadge status={effectiveStatus} />
+              <TypeBadge type={item.type} />
+            </div>
+            <SyncLabel type={item.type} date={item.lastSyncDate} />
+          </div>
+          <WorkflowSubRow item={item} />
+          {errorMessage && (
+            <div className="mt-2.5 flex items-center gap-1.5 text-xs text-error-8">
+              <Icon icon={AlertTriangle} size="sm" className="shrink-0" />
+              {errorMessage}
+            </div>
+          )}
+        </div>
+      </div>
+    </SortableListItem>
+  );
+}
+
+function SyncLabel({ type, date }: { type: WorkflowType; date: number }) {
+  const syncLabel = date ? moment.unix(date).fromNow() : '-';
+  const syncTitle = type === 'edgeStack' ? 'Oldest sync' : 'Last sync';
+
+  return (
+    <div className="flex items-center gap-1.5 text-xs text-gray-7 th-highcontrast:text-gray-3 th-dark:text-gray-3">
+      <Icon icon={WatchIcon} size="xs" />
+      <span>
+        {syncTitle}: {syncLabel}
+      </span>
+    </div>
+  );
+}
+
+function getWorkflowLink(item: Workflow): { to: string; params: object } {
+  if (item.type === 'edgeStack') {
+    return { to: 'edge.stacks.edit', params: { stackId: item.id } };
+  }
+  if (item.platform === 'kubernetes') {
+    return {
+      to: 'kubernetes.applications.application',
+      params: {
+        endpointId: item.target.endpointId,
+        namespace: item.target.namespace,
+        name: item.name,
+      },
+    };
+  }
+
+  const type =
+    item.platform === 'dockerSwarm'
+      ? StackType.DockerSwarm
+      : StackType.DockerCompose;
+
+  return {
+    to: 'docker.stacks.stack',
+    params: {
+      endpointId: item.target.endpointId,
+      name: item.name,
+      id: item.id,
+      type,
+      regular: true,
+    },
+  };
+}
diff --git a/app/react/portainer/gitops/workflows/ListView/WorkflowSubRow/Block.tsx b/app/react/portainer/gitops/workflows/ListView/WorkflowSubRow/Block.tsx
new file mode 100644
index 0000000..2988098
--- /dev/null
+++ b/app/react/portainer/gitops/workflows/ListView/WorkflowSubRow/Block.tsx
@@ -0,0 +1,60 @@
+import clsx from 'clsx';
+import { ReactNode } from 'react';
+
+import { WorkflowStatus } from '../../types';
+
+const STATUS_DOT_CLASSES: Record<WorkflowStatus, string> = {
+  healthy: 'bg-success-7 th-highcontrast:bg-success-3',
+  error: 'bg-error-7 th-highcontrast:bg-error-3',
+  syncing: 'bg-warning-7 th-highcontrast:bg-warning-3',
+  paused: 'bg-warning-5 th-highcontrast:bg-yellow-3',
+  unknown: 'bg-gray-4 th-highcontrast:bg-gray-3',
+};
+
+const STATUS_BLOCK_CLASSES: Record<WorkflowStatus, string> = {
+  healthy: 'bg-success-1 th-dark:bg-success-11 th-highcontrast:bg-success-11',
+  error: 'bg-error-1 th-dark:bg-error-11 th-highcontrast:bg-error-11',
+  syncing: 'bg-warning-1 th-dark:bg-warning-11 th-highcontrast:bg-warning-11',
+  paused: 'bg-gray-2 th-dark:bg-gray-iron-11 th-highcontrast:bg-gray-iron-11',
+  unknown: 'bg-gray-2 th-dark:bg-gray-iron-11 th-highcontrast:bg-gray-iron-11',
+};
+
+export function Block({
+  status,
+  className,
+  children,
+}: {
+  status: WorkflowStatus;
+  className?: string;
+  children: ReactNode;
+}) {
+  return (
+    <div
+      className={clsx(
+        'rounded px-3 py-2',
+        STATUS_BLOCK_CLASSES[status],
+        className
+      )}
+    >
+      {children}
+    </div>
+  );
+}
+
+export function Dot({
+  status,
+  className,
+}: {
+  status: WorkflowStatus;
+  className?: string;
+}) {
+  return (
+    <span
+      className={clsx(
+        'h-2 w-2 shrink-0 rounded-full',
+        STATUS_DOT_CLASSES[status],
+        className
+      )}
+    />
+  );
+}
diff --git a/app/react/portainer/gitops/workflows/ListView/WorkflowSubRow/TargetCell.tsx b/app/react/portainer/gitops/workflows/ListView/WorkflowSubRow/TargetCell.tsx
new file mode 100644
index 0000000..4755a7b
--- /dev/null
+++ b/app/react/portainer/gitops/workflows/ListView/WorkflowSubRow/TargetCell.tsx
@@ -0,0 +1,135 @@
+import { ReactNode } from 'react';
+import { LayoutGridIcon } from 'lucide-react';
+
+import { useEnvironment } from '@/react/portainer/environments/queries';
+import {
+  getDashboardRoute,
+  getEnvironmentTypeIcon,
+} from '@/react/portainer/environments/utils';
+import { useEdgeGroup } from '@/react/edge/edge-groups/queries/useEdgeGroup';
+
+import { Icon } from '@@/Icon';
+import { Link } from '@@/Link';
+
+import { WorkflowStatus, WorkflowTarget, WorkflowType } from '../../types';
+
+import { Block, Dot } from './Block';
+
+export function TargetCell({
+  target,
+  type,
+  status,
+}: {
+  target: WorkflowTarget | undefined;
+  type: WorkflowType;
+  status: WorkflowStatus;
+}) {
+  if (!target) {
+    return null;
+  }
+
+  if (type === 'edgeStack') {
+    return (
+      <div className="flex flex-col gap-1.5">
+        {target.edgeGroupIds?.map((id) => (
+          <EdgeGroupTarget
+            key={id}
+            id={id}
+            status={target.groupStatus?.[id] ?? status}
+          />
+        ))}
+      </div>
+    );
+  }
+
+  return <StackTarget target={target} status={status} />;
+}
+
+function EdgeGroupTarget({
+  id,
+  status,
+}: {
+  id: number;
+  status: WorkflowStatus;
+}) {
+  const { data } = useEdgeGroup(id);
+  const name = data?.Name ?? `Edge Group ${id}`;
+  return (
+    <TargetRow
+      icon={
+        <Icon
+          icon={LayoutGridIcon}
+          size="xs"
+          className="shrink-0 text-gray-6"
+        />
+      }
+      status={status}
+    >
+      <Link
+        to="edge.groups.edit"
+        params={{ groupId: id }}
+        data-cy={`workflow-edge-group-link-${id}`}
+        className="tracking-wider text-gray-9 th-highcontrast:text-white th-dark:text-white"
+      >
+        {name}
+      </Link>
+    </TargetRow>
+  );
+}
+
+function StackTarget({
+  target,
+  status,
+}: {
+  target: WorkflowTarget;
+  status: WorkflowStatus;
+}) {
+  const { data: environment } = useEnvironment(target.endpointId);
+
+  if (!target.endpointId) {
+    return <span className="text-gray-5">No target</span>;
+  }
+
+  const envName = environment?.Name ?? `Environment ${target.endpointId}`;
+  const icon = environment
+    ? getEnvironmentTypeIcon(environment.Type)
+    : 'circle';
+  const label = target.namespace ? `${envName} / ${target.namespace}` : envName;
+  const dashboardRoute = environment
+    ? getDashboardRoute(environment)
+    : { to: '', params: {} };
+
+  return (
+    <TargetRow
+      icon={<Icon icon={icon} size="xs" className="shrink-0 text-gray-6" />}
+      status={status}
+    >
+      <Link
+        to={dashboardRoute.to}
+        params={dashboardRoute.params}
+        data-cy={`workflow-environment-link-${target.endpointId}`}
+        className="tracking-wider text-gray-9 th-highcontrast:text-white th-dark:text-white"
+      >
+        {label}
+      </Link>
+    </TargetRow>
+  );
+}
+
+function TargetRow({
+  icon,
+  status,
+  children,
+}: {
+  icon: ReactNode;
+  status: WorkflowStatus;
+  children: ReactNode;
+}) {
+  return (
+    <Block status={status} className="flex items-center gap-2">
+      <Dot status={status} />
+      {icon}
+      {children}
+    </Block>
+  );
+}
diff --git a/app/react/portainer/gitops/workflows/ListView/WorkflowSubRow/WorkflowSubRow.tsx b/app/react/portainer/gitops/workflows/ListView/WorkflowSubRow/WorkflowSubRow.tsx
new file mode 100644
index 0000000..b559c01
--- /dev/null
+++ b/app/react/portainer/gitops/workflows/ListView/WorkflowSubRow/WorkflowSubRow.tsx
@@ -0,0 +1,170 @@
+import clsx from 'clsx';
+import { ReactNode } from 'react';
+
+import { Link } from '@@/Link';
+
+import { Workflow, WorkflowStatus } from '../../types';
+import { getDeployedStackLink, getSourceLink } from '../../utils';
+
+import { Block, Dot } from './Block';
+import { TargetCell } from './TargetCell';
+
+export function WorkflowSubRow({ item }: { item: Workflow }) {
+  return (
+    <div className="overflow-hidden rounded border border-solid border-gray-3 text-xs th-dark:border-gray-9">
+      <table className="w-full table-fixed border-collapse">
+        <thead className="border-0 border-b border-solid border-gray-3 bg-gray-2 th-dark:border-gray-9 th-dark:bg-gray-iron-11">
+          <tr>
+            <Th>Source</Th>
+            <Th divider>Artifacts</Th>
+            <Th divider>Targets</Th>
+          </tr>
+        </thead>
+        <tbody>
+          <tr>
+            <Td>
+              {item.gitConfig && (
+                <SourceCell
+                  sourceId={item.sourceId}
+                  name={item.name}
+                  url={item.gitConfig.URL}
+                  status={item.status.source.status}
+                />
+              )}
+            </Td>
+            <Td divider>
+              {item.gitConfig && (
+                <ArtifactCell
+                  item={item}
+                  path={item.gitConfig.ConfigFilePath}
+                  status={item.status.artifact.status}
+                />
+              )}
+            </Td>
+            <Td divider rowSpan={9999}>
+              <TargetCell
+                target={item.target}
+                type={item.type}
+                status={item.status.target.status}
+              />
+            </Td>
+          </tr>
+        </tbody>
+      </table>
+    </div>
+  );
+}
+
+function SourceCell({
+  sourceId,
+  name,
+  url,
+  status,
+}: {
+  sourceId: number | undefined;
+  name: string;
+  url: string;
+  status: WorkflowStatus;
+}) {
+  const content = (
+    <Block status={status} className="flex items-start gap-2">
+      <Dot status={status} className="mt-1.5" />
+      <div className="min-w-0">
+        <p className="m-0 font-semibold text-gray-9 th-highcontrast:text-white th-dark:text-white">
+          {name}
+        </p>
+        <p className="m-0 mt-0.5 break-all text-gray-7 th-highcontrast:text-gray-3 th-dark:text-gray-3">
+          {url}
+        </p>
+      </div>
+    </Block>
+  );
+
+  if (sourceId === undefined) {
+    return content;
+  }
+
+  const sourceLink = getSourceLink(sourceId);
+  return (
+    <Link
+      to={sourceLink.to}
+      params={sourceLink.params}
+      data-cy={`workflow-source-link-${sourceId}`}
+      className="block no-underline hover:no-underline"
+    >
+      {content}
+    </Link>
+  );
+}
+
+function ArtifactCell({
+  item,
+  path,
+  status,
+}: {
+  item: Workflow;
+  path: string;
+  status: WorkflowStatus;
+}) {
+  const content = (
+    <Block status={status} className="flex items-center gap-2">
+      <Dot status={status} />
+      <span className="font-mono text-gray-7 th-highcontrast:text-gray-3 th-dark:text-gray-4">
+        {path}
+      </span>
+    </Block>
+  );
+
+  const stackLink = getDeployedStackLink(item);
+  if (!stackLink) {
+    return content;
+  }
+
+  return (
+    <Link
+      to={stackLink.to}
+      params={stackLink.params}
+      data-cy={`workflow-artifact-link-${item.id}`}
+      className="block no-underline hover:no-underline"
+    >
+      {content}
+    </Link>
+  );
+}
+
+function Th({ children, divider }: { children: ReactNode; divider?: boolean }) {
+  return (
+    <th
+      className={clsx(
+        'w-1/3 px-4 py-2 text-left text-sm font-semibold uppercase tracking-wider text-gray-7 th-highcontrast:text-white th-dark:text-white',
+        divider &&
+          'border-0 border-l border-solid border-gray-3 th-dark:border-gray-9'
+      )}
+    >
+      {children}
+    </th>
+  );
+}
+
+function Td({
+  children,
+  divider,
+  rowSpan,
+}: {
+  children?: ReactNode;
+  divider?: boolean;
+  rowSpan?: number;
+}) {
+  return (
+    <td
+      className={clsx(
+        'px-4 py-3 align-top',
+        divider &&
+          'border-0 border-l border-solid border-gray-3 th-dark:border-gray-8'
+      )}
+      rowSpan={rowSpan}
+    >
+      {children}
+    </td>
+  );
+}
diff --git a/app/react/portainer/gitops/workflows/ListView/useListState.ts b/app/react/portainer/gitops/workflows/ListView/useListState.ts
new file mode 100644
index 0000000..0b698c2
--- /dev/null
+++ b/app/react/portainer/gitops/workflows/ListView/useListState.ts
@@ -0,0 +1,60 @@
+import { buildGroupSortExtras } from '@@/datatables/groupSortState';
+import {
+  asEnum,
+  useTableStateFromUrl,
+} from '@@/datatables/useTableStateFromUrl';
+
+import { WorkflowStatus, WorkflowType, DeploymentPlatform } from '../types';
+
+const DEFAULT_SORT = 'name' as const;
+
+const WORKFLOW_STATUSES = new Set<WorkflowStatus>([
+  'healthy',
+  'error',
+  'syncing',
+  'paused',
+  'unknown',
+]);
+const WORKFLOW_TYPES = new Set<WorkflowType>(['stack', 'edgeStack']);
+const DEPLOYMENT_PLATFORMS = new Set<DeploymentPlatform>([
+  'dockerStandalone',
+  'dockerSwarm',
+  'kubernetes',
+]);
+
+const SORT_KEYS = [
+  'name',
+  'status',
+  'type',
+  'platform',
+  'lastSyncDate',
+] as const;
+
+const DIMENSIONS = [{ key: 'status' }, { key: 'type' }, { key: 'platform' }];
+
+export function useListState() {
+  return useTableStateFromUrl({
+    localStorageKey: 'workflows',
+    defaultSort: DEFAULT_SORT,
+    persistedExtraKeys: ['status', 'type', 'platform'],
+    parseExtra: (params) => ({
+      status: asEnum(params.status, WORKFLOW_STATUSES),
+      type: asEnum(params.type, WORKFLOW_TYPES),
+      platform: asEnum(params.platform, DEPLOYMENT_PLATFORMS),
+    }),
+    buildExtra: (urlState, setUrlState) => ({
+      status: urlState.status,
+      type: urlState.type,
+      platform: urlState.platform,
+      setStatus: (v: WorkflowStatus | null) =>
+        setUrlState({ status: v, page: 0 }),
+      ...buildGroupSortExtras({
+        urlState,
+        setUrlState,
+        defaultSort: DEFAULT_SORT,
+        sortKeys: SORT_KEYS,
+        dimensions: DIMENSIONS,
+      }),
+    }),
+  });
+}
diff --git a/app/react/portainer/gitops/workflows/queries/useWorkflow.ts b/app/react/portainer/gitops/workflows/queries/useWorkflow.ts
new file mode 100644
index 0000000..6b1b871
--- /dev/null
+++ b/app/react/portainer/gitops/workflows/queries/useWorkflow.ts
@@ -0,0 +1,85 @@
+import { useQuery } from '@tanstack/react-query';
+
+import {
+  WorkflowsArtifactDetail,
+  WorkflowsArtifactFileDetail,
+  WorkflowsWorkflowDetail,
+  WorkflowsWorkflowPhaseStatus,
+  WorkflowsWorkflowStatusObject,
+} from '@api/types.gen';
+import { gitOpsWorkflowGet } from '@api/sdk.gen';
+
+import { withError } from '@/react-tools/react-query';
+
+import {
+  WorkflowArtifact,
+  WorkflowArtifactFile,
+  WorkflowDetail,
+  WorkflowPhaseStatus,
+  WorkflowStatusObject,
+} from '../types';
+import { workflowQueryKeys } from '../../queries/query-keys';
+
+async function getWorkflow(id: number): Promise<WorkflowDetail> {
+  const response = await gitOpsWorkflowGet({ path: { id } });
+
+  return toWorkflowDetail(response.data);
+
+  function toWorkflowDetail(wf: WorkflowsWorkflowDetail): WorkflowDetail {
+    return {
+      ...wf,
+      artifacts: wf.artifacts?.map(toArtifact) || [],
+    };
+  }
+
+  function toArtifact(artifact: WorkflowsArtifactDetail): WorkflowArtifact {
+    return {
+      ...artifact,
+      status: toArtifactStatusObj(artifact.status),
+      files: (artifact.files ?? []).filter(hasSourceId).map(toArtifactFile),
+    };
+  }
+
+  function hasSourceId(
+    file: WorkflowsArtifactFileDetail
+  ): file is WorkflowsArtifactFileDetail & { sourceId: number } {
+    return !!file.sourceId;
+  }
+
+  function toArtifactFile(
+    file: WorkflowsArtifactFileDetail & { sourceId: number }
+  ): WorkflowArtifactFile {
+    return {
+      ...file,
+      sourceId: file.sourceId,
+    };
+  }
+
+  function toArtifactStatusObj(
+    statusObj: WorkflowsWorkflowStatusObject | undefined
+  ): WorkflowStatusObject {
+    return {
+      artifact: toStatus(statusObj?.artifact),
+      source: toStatus(statusObj?.source),
+      target: toStatus(statusObj?.target),
+    };
+  }
+
+  function toStatus(
+    status: WorkflowsWorkflowPhaseStatus | undefined
+  ): WorkflowPhaseStatus {
+    return {
+      status: status?.status || 'unknown',
+      error: status?.error,
+    };
+  }
+}
+
+export function useWorkflow(id: number | undefined) {
+  return useQuery({
+    queryKey: workflowQueryKeys.detail(id!),
+    queryFn: () => getWorkflow(id!),
+    enabled: !!id,
+    ...withError('Failed loading workflow'),
+  });
+}
diff --git a/app/react/portainer/gitops/workflows/queries/useWorkflowSources.ts b/app/react/portainer/gitops/workflows/queries/useWorkflowSources.ts
new file mode 100644
index 0000000..e11f20f
--- /dev/null
+++ b/app/react/portainer/gitops/workflows/queries/useWorkflowSources.ts
@@ -0,0 +1,37 @@
+import { useQueries, UseQueryResult } from '@tanstack/react-query';
+
+import { SourceDetail, sourceOptions } from '../../sources/queries/useSource';
+import { WorkflowArtifact } from '../types';
+
+export type SourceQueryResult = UseQueryResult<SourceDetail>;
+
+export interface WorkflowSourceQuery {
+  sourceId: number;
+  query: SourceQueryResult;
+}
+
+export type WorkflowSourcesResult = WorkflowSourceQuery[];
+
+/**
+ * Resolves every sourceId referenced across an artifact list's files[], deduped.
+ */
+export function useWorkflowSources(
+  artifacts: WorkflowArtifact[]
+): WorkflowSourcesResult {
+  const sourceIds = [
+    ...new Set(
+      artifacts
+        .flatMap((artifact) => artifact.files)
+        .map((file) => file.sourceId)
+    ),
+  ];
+
+  const queries = useQueries({
+    queries: sourceIds.map((id) => sourceOptions(id)),
+  });
+
+  return sourceIds.map((sourceId, index) => ({
+    sourceId,
+    query: queries[index],
+  }));
+}
diff --git a/app/react/portainer/gitops/workflows/status.test.ts b/app/react/portainer/gitops/workflows/status.test.ts
new file mode 100644
index 0000000..4113666
--- /dev/null
+++ b/app/react/portainer/gitops/workflows/status.test.ts
@@ -0,0 +1,182 @@
+import { describe, it, expect } from 'vitest';
+
+import {
+  mockWorkflowHealthy,
+  mockWorkflowTargetError,
+  mockWorkflowEdgeMixed,
+  mockWorkflowMultiArtifact,
+  mockWorkflowEmpty,
+} from './test-utils/workflow.mock';
+import { Workflow, WorkflowPhaseStatus, WorkflowStatus } from './types';
+import {
+  effectiveWorkflowStatus,
+  worstPhaseStatus,
+  computeTargetRollup,
+} from './status';
+
+describe('effectiveWorkflowStatus', () => {
+  describe('uniform phases', () => {
+    it.each<WorkflowStatus>([
+      'error',
+      'syncing',
+      'paused',
+      'healthy',
+      'unknown',
+    ])('all phases %s → %s', (status) => {
+      const item = makeWorkflow(
+        makePhase(status),
+        makePhase(status),
+        makePhase(status)
+      );
+      expect(effectiveWorkflowStatus(item).status).toBe(status);
+    });
+  });
+
+  describe('priority order', () => {
+    it('error beats syncing and healthy', () => {
+      const item = makeWorkflow(
+        makePhase('error'),
+        makePhase('syncing'),
+        makePhase('healthy')
+      );
+      expect(effectiveWorkflowStatus(item).status).toBe('error');
+    });
+
+    it('syncing beats paused and healthy', () => {
+      const item = makeWorkflow(
+        makePhase('paused'),
+        makePhase('syncing'),
+        makePhase('healthy')
+      );
+      expect(effectiveWorkflowStatus(item).status).toBe('syncing');
+    });
+
+    it('paused beats healthy and unknown', () => {
+      const item = makeWorkflow(
+        makePhase('healthy'),
+        makePhase('unknown'),
+        makePhase('paused')
+      );
+      expect(effectiveWorkflowStatus(item).status).toBe('paused');
+    });
+  });
+
+  describe('error message', () => {
+    it('includes error from the winning phase', () => {
+      const item = makeWorkflow(
+        makePhase('error', 'git clone failed'),
+        makePhase('healthy'),
+        makePhase('healthy')
+      );
+      expect(effectiveWorkflowStatus(item)).toEqual({
+        status: 'error',
+        error: 'git clone failed',
+      });
+    });
+
+    it('no error when winning phase has no error', () => {
+      const item = makeWorkflow(
+        makePhase('syncing'),
+        makePhase('healthy'),
+        makePhase('healthy')
+      );
+      expect(effectiveWorkflowStatus(item).error).toBeUndefined();
+    });
+  });
+});
+
+describe('worstPhaseStatus', () => {
+  it('returns the sole phase for a single-element list', () => {
+    expect(worstPhaseStatus([makePhase('syncing')]).status).toBe('syncing');
+  });
+
+  it('picks the highest-priority phase among many', () => {
+    const phases = [
+      makePhase('unknown'),
+      makePhase('healthy'),
+      makePhase('paused'),
+      makePhase('syncing'),
+      makePhase('error'),
+    ];
+    expect(worstPhaseStatus(phases).status).toBe('error');
+  });
+
+  it('carries the error message of the winning phase', () => {
+    const phases = [makePhase('healthy'), makePhase('error', 'deploy failed')];
+    expect(worstPhaseStatus(phases)).toEqual({
+      status: 'error',
+      error: 'deploy failed',
+    });
+  });
+
+  it('is stable when all phases tie on priority', () => {
+    const phases = [makePhase('healthy'), makePhase('healthy')];
+    expect(worstPhaseStatus(phases).status).toBe('healthy');
+  });
+});
+
+describe('computeTargetRollup', () => {
+  it('reports success and full sync for an all-healthy stack workflow', () => {
+    expect(computeTargetRollup(mockWorkflowHealthy)).toEqual({
+      synced: 1,
+      total: 1,
+      tone: 'success',
+    });
+  });
+
+  it('reports danger when the single stack target errored', () => {
+    expect(computeTargetRollup(mockWorkflowTargetError)).toEqual({
+      synced: 0,
+      total: 1,
+      tone: 'danger',
+    });
+  });
+
+  it('counts one target per edge group and reports danger if any group errored', () => {
+    expect(computeTargetRollup(mockWorkflowEdgeMixed)).toEqual({
+      synced: 1,
+      total: 2,
+      tone: 'danger',
+    });
+  });
+
+  it('reports warning (not danger) when a target is syncing rather than errored', () => {
+    expect(computeTargetRollup(mockWorkflowMultiArtifact)).toEqual({
+      synced: 1,
+      total: 2,
+      tone: 'warning',
+    });
+  });
+
+  it('reports muted with zero counts for a zero-artifact workflow', () => {
+    expect(computeTargetRollup(mockWorkflowEmpty)).toEqual({
+      synced: 0,
+      total: 0,
+      tone: 'muted',
+    });
+  });
+});
+
+function makeWorkflow(
+  source: WorkflowPhaseStatus,
+  artifact: WorkflowPhaseStatus,
+  target: WorkflowPhaseStatus
+): Workflow {
+  return {
+    id: 1,
+    name: 'test',
+    type: 'stack',
+    platform: 'dockerStandalone',
+    status: { source, artifact, target },
+    target: { endpointId: 1 },
+    creationDate: 0,
+    lastSyncDate: 0,
+  };
+}
+
+function makePhase(
+  status: WorkflowStatus,
+  error?: string
+): WorkflowPhaseStatus {
+  return { status, error };
+}
diff --git a/app/react/portainer/gitops/workflows/status.ts b/app/react/portainer/gitops/workflows/status.ts
new file mode 100644
index 0000000..c02585d
--- /dev/null
+++ b/app/react/portainer/gitops/workflows/status.ts
@@ -0,0 +1,98 @@
+import {
+  WorkflowStatus,
+  WorkflowPhaseStatus,
+  Workflow,
+  WorkflowArtifact,
+  WorkflowDetail,
+} from './types';
+
+const STATUS_PRIORITY: Record<WorkflowStatus, number> = {
+  error: 4,
+  syncing: 3,
+  paused: 2,
+  healthy: 1,
+  unknown: 0,
+};
+
+export function worstPhaseStatus(
+  phases: WorkflowPhaseStatus[]
+): WorkflowPhaseStatus {
+  return phases.reduce((worst, phase) =>
+    STATUS_PRIORITY[phase.status || 'unknown'] >
+    STATUS_PRIORITY[worst.status || 'unknown']
+      ? phase
+      : worst
+  );
+}
+
+export function effectiveWorkflowStatus(item: Workflow): WorkflowPhaseStatus {
+  return worstPhaseStatus([
+    item.status.source,
+    item.status.artifact,
+    item.status.target,
+  ]);
+}
+
+function effectiveArtifactStatus(
+  artifact: WorkflowArtifact
+): WorkflowPhaseStatus {
+  return worstPhaseStatus([
+    artifact.status.source,
+    artifact.status.artifact,
+    artifact.status.target,
+  ]);
+}
+
+export function effectiveWorkflowDetailStatus(
+  workflow: WorkflowDetail
+): WorkflowPhaseStatus {
+  if (workflow.artifacts.length === 0) {
+    return { status: 'unknown' };
+  }
+
+  return worstPhaseStatus(workflow.artifacts.map(effectiveArtifactStatus));
+}
+
+export type TargetRollupTone = 'success' | 'danger' | 'warning' | 'muted';
+
+export interface TargetRollup {
+  synced: number;
+  total: number;
+  tone: TargetRollupTone;
+}
+
+/** One entry per target counted for an artifact: one edge group, or one stack endpoint. */
+function artifactTargetStatuses(artifact: WorkflowArtifact): WorkflowStatus[] {
+  if (artifact.type === 'edgeStack') {
+    return (
+      artifact.target?.edgeGroupIds?.map(
+        (groupId) => artifact.target?.groupStatus?.[groupId] ?? 'unknown'
+      ) ?? []
+    );
+  }
+
+  return artifact.status?.target?.status ? [artifact.status.target.status] : [];
+}
+
+export function computeArtifactTargetCount(artifact: WorkflowArtifact): number {
+  return artifactTargetStatuses(artifact).length;
+}
+
+export function computeTargetRollup(workflow: WorkflowDetail): TargetRollup {
+  if (workflow.artifacts.length === 0) {
+    return { synced: 0, total: 0, tone: 'muted' };
+  }
+
+  const statuses = workflow.artifacts.flatMap(artifactTargetStatuses);
+  const synced = statuses.filter((status) => status === 'healthy').length;
+  const hasError = statuses.some((status) => status === 'error');
+  const hasNonHealthy = statuses.some((status) => status !== 'healthy');
+
+  const tone: TargetRollupTone = hasError
+    ? 'danger'
+    : hasNonHealthy
+      ? 'warning'
+      : 'success';
+
+  return { synced, total: statuses.length, tone };
+}
diff --git a/app/react/portainer/gitops/workflows/test-utils/workflow.mock.ts b/app/react/portainer/gitops/workflows/test-utils/workflow.mock.ts
new file mode 100644
index 0000000..8c7e3f6
--- /dev/null
+++ b/app/react/portainer/gitops/workflows/test-utils/workflow.mock.ts
@@ -0,0 +1,205 @@
+import { WorkflowDetail } from '../types';
+
+export const mockWorkflowHealthy: WorkflowDetail = {
+  id: 1,
+  name: 'healthy-workflow',
+  artifacts: [
+    {
+      id: 101,
+      type: 'stack',
+      name: 'nginx-stack',
+      platform: 'dockerStandalone',
+      target: { endpointId: 5 },
+      status: {
+        source: { status: 'healthy' },
+        artifact: { status: 'healthy' },
+        target: { status: 'healthy' },
+      },
+      files: [
+        { sourceId: 25, path: 'docker-compose.yml', ref: 'refs/heads/main' },
+      ],
+      creationDate: 1750000000,
+      lastSyncDate: 1751000000,
+    },
+  ],
+};
+
+export const mockWorkflowSourceError: WorkflowDetail = {
+  id: 2,
+  name: 'broken-source-stack',
+  artifacts: [
+    {
+      id: 102,
+      type: 'stack',
+      name: 'broken-source-stack',
+      platform: 'dockerSwarm',
+      target: { endpointId: 5 },
+      status: {
+        source: {
+          status: 'error',
+          error: 'authentication failed: git clone error',
+        },
+        artifact: { status: 'unknown' },
+        target: { status: 'unknown' },
+      },
+      files: [
+        { sourceId: 22, path: 'docker-compose.yml', ref: 'refs/heads/main' },
+      ],
+      creationDate: 1750000000,
+      lastSyncDate: 1751000000,
+    },
+  ],
+};
+
+export const mockWorkflowArtifactError: WorkflowDetail = {
+  id: 3,
+  name: 'invalid-compose-stack',
+  artifacts: [
+    {
+      id: 103,
+      type: 'stack',
+      name: 'invalid-compose-stack',
+      platform: 'kubernetes',
+      target: { endpointId: 5, namespace: 'default' },
+      status: {
+        source: { status: 'healthy' },
+        artifact: {
+          status: 'error',
+          error:
+            'invalid compose file: yaml: line 4: did not find expected key',
+        },
+        target: { status: 'unknown' },
+      },
+      files: [{ sourceId: 25, path: 'manifest.yaml', ref: 'refs/heads/main' }],
+      creationDate: 1750000000,
+      lastSyncDate: 1751000000,
+    },
+  ],
+};
+
+export const mockWorkflowTargetError: WorkflowDetail = {
+  id: 4,
+  name: 'unreachable-endpoint-stack',
+  artifacts: [
+    {
+      id: 104,
+      type: 'stack',
+      name: 'unreachable-endpoint-stack',
+      platform: 'dockerStandalone',
+      target: { endpointId: 6 },
+      status: {
+        source: { status: 'healthy' },
+        artifact: { status: 'healthy' },
+        target: {
+          status: 'error',
+          error: 'failed to deploy stack to endpoint: connection refused',
+        },
+      },
+      files: [
+        { sourceId: 22, path: 'docker-compose.yml', ref: 'refs/heads/main' },
+      ],
+      creationDate: 1750000000,
+      lastSyncDate: 1751000000,
+    },
+  ],
+};
+
+export const mockWorkflowEdgeMixed: WorkflowDetail = {
+  id: 5,
+  name: 'edge-stack',
+  artifacts: [
+    {
+      id: 105,
+      type: 'edgeStack',
+      name: 'edge-fleet-stack',
+      platform: 'dockerStandalone',
+      target: {
+        edgeGroupIds: [10, 11],
+        groupStatus: { 10: 'healthy', 11: 'error' },
+        resolvedEndpointIds: [20, 21, 22],
+      },
+      status: {
+        source: { status: 'healthy' },
+        artifact: { status: 'healthy' },
+        target: {
+          status: 'error',
+          error: 'one or more edge groups failed to sync',
+        },
+      },
+      files: [
+        { sourceId: 22, path: 'docker-compose.yml', ref: 'refs/heads/main' },
+      ],
+      creationDate: 1750000000,
+      lastSyncDate: 1751000000,
+    },
+  ],
+};
+
+export const mockWorkflowMultiArtifact: WorkflowDetail = {
+  id: 6,
+  name: 'multi-artifact-workflow',
+  artifacts: [
+    {
+      id: 106,
+      type: 'stack',
+      name: 'multi-artifact-web',
+      platform: 'dockerStandalone',
+      target: { endpointId: 5 },
+      status: {
+        source: { status: 'healthy' },
+        artifact: { status: 'healthy' },
+        target: { status: 'healthy' },
+      },
+      files: [
+        {
+          sourceId: 12,
+          path: 'web/docker-compose.yml',
+          ref: 'refs/heads/main',
+        },
+      ],
+      creationDate: 1750000000,
+      lastSyncDate: 1751000000,
+    },
+    {
+      id: 107,
+      type: 'stack',
+      name: 'multi-artifact-worker',
+      platform: 'dockerStandalone',
+      target: { endpointId: 7 },
+      status: {
+        source: { status: 'healthy' },
+        artifact: { status: 'syncing' },
+        target: { status: 'syncing' },
+      },
+      files: [
+        {
+          sourceId: 12,
+          path: 'worker/docker-compose.yml',
+          ref: 'refs/heads/main',
+        },
+      ],
+      creationDate: 1750000000,
+      lastSyncDate: 1751000000,
+    },
+  ],
+};
+
+export const mockWorkflowEmpty: WorkflowDetail = {
+  id: 7,
+  name: 'empty-workflow',
+  artifacts: [],
+};
+
+const mockWorkflows: Record<number, WorkflowDetail> = {
+  1: mockWorkflowHealthy,
+  2: mockWorkflowSourceError,
+  3: mockWorkflowArtifactError,
+  4: mockWorkflowTargetError,
+  5: mockWorkflowEdgeMixed,
+  6: mockWorkflowMultiArtifact,
+  7: mockWorkflowEmpty,
+};
+
+export function getWorkflowMock(id: number): WorkflowDetail | undefined {
+  return mockWorkflows[id];
+}
diff --git a/app/react/portainer/gitops/workflows/types.ts b/app/react/portainer/gitops/workflows/types.ts
new file mode 100644
index 0000000..b30a0a7
--- /dev/null
+++ b/app/react/portainer/gitops/workflows/types.ts
@@ -0,0 +1,70 @@
+import {
+  WorkflowsArtifactDetail,
+  WorkflowsArtifactFileDetail,
+  WorkflowsWorkflowDetail,
+} from '@api/types.gen';
+
+import { RepoConfigResponse } from '@/react/portainer/gitops/types';
+
+export type WorkflowStatus =
+  | 'healthy'
+  | 'error'
+  | 'syncing'
+  | 'paused'
+  | 'unknown';
+export type WorkflowType = 'stack' | 'edgeStack';
+export type DeploymentPlatform =
+  | 'dockerStandalone'
+  | 'dockerSwarm'
+  | 'kubernetes';
+
+export interface WorkflowPhaseStatus {
+  status: WorkflowStatus;
+  error?: string;
+}
+
+export interface WorkflowStatusObject {
+  source: WorkflowPhaseStatus;
+  artifact: WorkflowPhaseStatus;
+  target: WorkflowPhaseStatus;
+}
+
+export interface WorkflowTarget {
+  endpointId?: number;
+  namespace?: string;
+  edgeGroupIds?: number[];
+  groupStatus?: Record<number, WorkflowStatus>;
+  resolvedEndpointIds?: number[];
+}
+
+export interface Workflow {
+  id: number;
+  name: string;
+  type: WorkflowType;
+  platform: DeploymentPlatform;
+  status: WorkflowStatusObject;
+  sourceId?: number;
+  gitConfig?: RepoConfigResponse;
+  target: WorkflowTarget;
+  creationDate: number;
+  lastSyncDate: number;
+}
+
+export interface WorkflowFileRef {
+  sourceId: number;
+  path: string;
+  ref: string;
+}
+
+export type WorkflowArtifact = Omit<WorkflowsArtifactDetail, 'status'> & {
+  status: WorkflowStatusObject;
+  files: Array<WorkflowArtifactFile>;
+};
+
+export type WorkflowArtifactFile = WorkflowsArtifactFileDetail & {
+  sourceId: number;
+};
+
+export type WorkflowDetail = Omit<WorkflowsWorkflowDetail, 'artifacts'> & {
+  artifacts: WorkflowArtifact[];
+};
diff --git a/app/react/portainer/gitops/workflows/utils.ts b/app/react/portainer/gitops/workflows/utils.ts
new file mode 100644
index 0000000..03413a2
--- /dev/null
+++ b/app/react/portainer/gitops/workflows/utils.ts
@@ -0,0 +1,60 @@
+import { StackType } from '@/react/common/stacks/types';
+
+import { DeploymentPlatform, Workflow, WorkflowType } from './types';
+
+export function getWorkflowLink(item: Workflow): {
+  to: string;
+  params: object;
+} {
+  return {
+    to: 'portainer.gitops.workflows.item',
+    params: { workflowId: item.id },
+  };
+}
+
+export function getSourceLink(sourceId: number): {
+  to: string;
+  params: object;
+} {
+  return {
+    to: 'portainer.gitops.sources.item',
+    params: { sourceId },
+  };
+}
+
+interface DeployedStack {
+  id: number;
+  name: string;
+  type: WorkflowType;
+  platform?: DeploymentPlatform;
+  target?: { endpointId?: number };
+}
+
+/** Links to the actual deployed Stack/EdgeStack a Workflow or WorkflowArtifact represents. */
+export function getDeployedStackLink(
+  item: DeployedStack
+): { to: string; params: object } | null {
+  if (item.type === 'edgeStack') {
+    return { to: 'edge.stacks.edit', params: { stackId: item.id } };
+  }
+
+  if (item.platform === 'kubernetes') {
+    return null;
+  }
+
+  const type =
+    item.platform === 'dockerSwarm'
+      ? StackType.DockerSwarm
+      : StackType.DockerCompose;
+
+  return {
+    to: 'docker.stacks.stack',
+    params: {
+      endpointId: item.target?.endpointId,
+      name: item.name,
+      id: item.id,
+      type,
+      regular: true,
+    },
+  };
+}
diff --git a/app/react/portainer/helpers/returnUrl.ts b/app/react/portainer/helpers/returnUrl.ts
new file mode 100644
index 0000000..002af83
--- /dev/null
+++ b/app/react/portainer/helpers/returnUrl.ts
@@ -0,0 +1,15 @@
+import { get, set, keyBuilder } from '@/react/hooks/useLocalStorage';
+
+const KEY = 'RETURN_URL';
+
+export function storeReturnUrl(url: string): void {
+  set(KEY, url);
+}
+
+export function getReturnUrl(): string | null {
+  return get<string | null>(KEY, null);
+}
+
+export function cleanReturnUrl(): void {
+  localStorage.removeItem(keyBuilder(KEY));
+}
diff --git a/app/react/portainer/init/.keep b/app/react/portainer/init/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/portainer/init/InitAdminView/.keep b/app/react/portainer/init/InitAdminView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/portainer/init/InitAdminView/SetupTokenTextTip.tsx b/app/react/portainer/init/InitAdminView/SetupTokenTextTip.tsx
new file mode 100644
index 0000000..cfd6b0e
--- /dev/null
+++ b/app/react/portainer/init/InitAdminView/SetupTokenTextTip.tsx
@@ -0,0 +1,17 @@
+import { TextTip } from '@@/Tip/TextTip';
+
+export function SetupTokenTextTip() {
+  return (
+    <TextTip color="blue">
+      Find this token in the Portainer server logs. See the{' '}
+      <a
+        href="https://docs.portainer.io/faqs/installing/setup-token"
+        target="_blank"
+        rel="noreferrer"
+      >
+        setup token FAQ
+      </a>{' '}
+      for more information.
+    </TextTip>
+  );
+}
diff --git a/app/react/portainer/init/InitAdminView/restore-options.tsx b/app/react/portainer/init/InitAdminView/restore-options.tsx
new file mode 100644
index 0000000..3b0e873
--- /dev/null
+++ b/app/react/portainer/init/InitAdminView/restore-options.tsx
@@ -0,0 +1,23 @@
+import { Download, Upload } from 'lucide-react';
+
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+
+import { BoxSelectorOption } from '@@/BoxSelector';
+
+export const restoreOptions: ReadonlyArray<BoxSelectorOption<string>> = [
+  {
+    id: 'restore_file',
+    value: 'file',
+    icon: Upload,
+    iconType: 'badge',
+    label: 'Upload backup file',
+  },
+  {
+    id: 'restore_s3',
+    value: 's3',
+    icon: Download,
+    iconType: 'badge',
+    label: 'Retrieve from S3',
+    feature: FeatureId.S3_RESTORE,
+  },
+] as const;
diff --git a/app/react/portainer/init/InitLicenseView/.keep b/app/react/portainer/init/InitLicenseView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/portainer/licenses/.keep b/app/react/portainer/licenses/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/portainer/licenses/CreateView/.keep b/app/react/portainer/licenses/CreateView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/portainer/licenses/ListView/.keep b/app/react/portainer/licenses/ListView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/portainer/licenses/license.service.test.ts b/app/react/portainer/licenses/license.service.test.ts
new file mode 100644
index 0000000..f87e815
--- /dev/null
+++ b/app/react/portainer/licenses/license.service.test.ts
@@ -0,0 +1,46 @@
+import { http, HttpResponse } from 'msw';
+
+import { server } from '@/setup-tests/server';
+import PortainerError from '@/portainer/error';
+
+import { getLicenses } from './license.service';
+import type { License } from './types';
+
+describe('getLicenses', () => {
+  it('on success should return the server body', async () => {
+    const catchFn = vi.fn();
+    const thenFn = vi.fn();
+
+    const data: License[] = [];
+    server.use(http.get('/api/licenses', () => HttpResponse.json(data)));
+
+    const promise = getLicenses();
+
+    await promise.then(thenFn).catch(catchFn);
+
+    expect(catchFn).not.toHaveBeenCalled();
+    expect(thenFn).toHaveBeenCalledWith(data);
+  });
+
+  it('on failure should return the server message', async () => {
+    const catchFn = vi.fn();
+    const thenFn = vi.fn();
+
+    const message = 'message';
+    const details = 'details';
+
+    server.use(
+      http.get('/api/licenses', () =>
+        HttpResponse.json({ message, details }, { status: 400 })
+      )
+    );
+
+    const promise = getLicenses();
+    await promise.then(thenFn, catchFn);
+
+    expect(catchFn).toHaveBeenCalledWith(
+      new PortainerError(details, new Error(message))
+    );
+    expect(thenFn).not.toHaveBeenCalled();
+  });
+});
diff --git a/app/react/portainer/licenses/license.service.ts b/app/react/portainer/licenses/license.service.ts
new file mode 100644
index 0000000..c74e253
--- /dev/null
+++ b/app/react/portainer/licenses/license.service.ts
@@ -0,0 +1,126 @@
+import _ from 'lodash';
+import { AxiosError } from 'axios';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { License, LicenseInfo } from './types';
+
+type Listener = (info: LicenseInfo) => void;
+
+interface Store {
+  data?: LicenseInfo;
+  lastLoaded?: number;
+  invalidated: boolean;
+  listeners: Listener[];
+}
+
+const store: Store = {
+  listeners: [],
+  invalidated: true,
+};
+
+export async function getLicenses() {
+  try {
+    const { data } = await axios.get<License[]>(buildUrl());
+
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e);
+  }
+}
+
+interface AttachResponse {
+  licenses: License[];
+  failedKeys: Record<string, string>;
+}
+
+export async function attachLicense(licenseKeys: string[]) {
+  try {
+    const { data } = await axios.post<AttachResponse>(buildUrl(), {
+      licenseKeys,
+    });
+
+    if (Object.keys(data.failedKeys).length === licenseKeys.length) {
+      return data;
+    }
+
+    store.invalidated = true;
+    getLicenseInfo();
+    return data;
+  } catch (e) {
+    const axiosError = e as AxiosError;
+    if (axiosError.response?.status === 401) {
+      throw new Error(
+        'Your session has expired, please refresh the browser and log in again.',
+        { cause: e }
+      );
+    }
+    throw parseAxiosError(e);
+  }
+}
+
+interface RemoveResponse {
+  failedKeys: Record<string, string>;
+}
+
+export async function removeLicense(licenseKeys: string[]) {
+  try {
+    const { data } = await axios.post<RemoveResponse>(buildUrl('remove'), {
+      licenseKeys,
+    });
+    if (Object.keys(data.failedKeys).length === licenseKeys.length) {
+      return data;
+    }
+
+    store.invalidated = true;
+    getLicenseInfo();
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e);
+  }
+}
+
+export function resetState() {
+  store.invalidated = true;
+  store.data = undefined;
+}
+
+export async function getLicenseInfo() {
+  try {
+    if (
+      store.data &&
+      !store.invalidated &&
+      store.lastLoaded &&
+      Math.abs(store.lastLoaded - Date.now()) < 1000 * 30
+    ) {
+      return store.data;
+    }
+
+    const { data: info } = await axios.get<LicenseInfo>(buildUrl('info'));
+    store.data = info;
+    store.lastLoaded = Date.now();
+    store.invalidated = false;
+    store.listeners.forEach((listener) => listener(info));
+
+    return info;
+  } catch (e) {
+    throw parseAxiosError(e);
+  }
+}
+
+export function subscribe(listener: Listener) {
+  store.listeners.push(listener);
+}
+
+export function unsubscribe(listener: Listener) {
+  _.remove(store.listeners, listener);
+}
+
+function buildUrl(action = '') {
+  let url = 'licenses';
+
+  if (action) {
+    url += `/${action}`;
+  }
+  return url;
+}
diff --git a/app/react/portainer/licenses/types.ts b/app/react/portainer/licenses/types.ts
new file mode 100644
index 0000000..f1b35a8
--- /dev/null
+++ b/app/react/portainer/licenses/types.ts
@@ -0,0 +1,49 @@
+// matches https://github.com/portainer/liblicense/blob/develop/liblicense.go#L66-L74
+export enum Edition {
+  CE = 1,
+  BE,
+  EE,
+}
+
+// matches https://github.com/portainer/liblicense/blob/develop/liblicense.go#L64-L69
+
+export enum LicenseType {
+  Trial = 1,
+  Subscription,
+  /**
+   * Essentials is the free 5-node license type
+   */
+  Essentials,
+}
+
+// matches https://github.com/portainer/liblicense/blob/develop/liblicense.go#L35-L50
+export interface License {
+  id: string;
+  company: string;
+  created: number;
+  email: string;
+  expiresAfter: number;
+  licenseKey: string;
+  nodes: number;
+  productEdition: Edition;
+  revoked: boolean;
+  revokedAt: number;
+  type: LicenseType;
+  version: number;
+  reference: string;
+  expiresAt: number;
+}
+
+// matches https://github.com/portainer/portainer-ee/blob/c4575bf528583fe1682267db4ee40a11a905f611/api/portainer.go#L588-L597
+export interface LicenseInfo {
+  productEdition: Edition;
+  company: string;
+  email: string;
+  createdAt: number;
+  expiresAt: number;
+  nodes: number;
+  type: LicenseType;
+  valid: boolean;
+  enforcedAt: number;
+  enforced: boolean;
+}
diff --git a/app/react/portainer/licenses/use-license.service.ts b/app/react/portainer/licenses/use-license.service.ts
new file mode 100644
index 0000000..0cc8177
--- /dev/null
+++ b/app/react/portainer/licenses/use-license.service.ts
@@ -0,0 +1,37 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { error as notifyError } from '@/portainer/services/notifications';
+import { useNodesCount } from '@/react/portainer/system/useNodesCount';
+
+import { getLicenseInfo } from './license.service';
+import { LicenseInfo, LicenseType } from './types';
+
+export function useLicenseInfo() {
+  const { isLoading, data: info } = useQuery<LicenseInfo, Error>(
+    ['licenseInfo'],
+    () => getLicenseInfo(),
+    {
+      onError(error) {
+        notifyError('Failure', error as Error, 'Failed to get license info');
+      },
+    }
+  );
+
+  return { isLoading, info };
+}
+
+export function useIntegratedLicenseInfo() {
+  const { isLoading: isLoadingNodes, data: nodesCount = 0 } = useNodesCount();
+
+  const { isLoading: isLoadingLicense, info } = useLicenseInfo();
+  if (
+    isLoadingLicense ||
+    isLoadingNodes ||
+    !info ||
+    info.type === LicenseType.Trial
+  ) {
+    return null;
+  }
+
+  return { licenseInfo: info as LicenseInfo, usedNodes: nodesCount };
+}
diff --git a/app/react/portainer/logs/ActivityLogsView/ActivityLogsTable.tsx b/app/react/portainer/logs/ActivityLogsView/ActivityLogsTable.tsx
new file mode 100644
index 0000000..8d6aac1
--- /dev/null
+++ b/app/react/portainer/logs/ActivityLogsView/ActivityLogsTable.tsx
@@ -0,0 +1,116 @@
+import { createColumnHelper } from '@tanstack/react-table';
+import { History, Search } from 'lucide-react';
+
+import { isoDateFromTimestamp } from '@/portainer/filters/filters';
+
+import { ExpandableDatatable } from '@@/datatables/ExpandableDatatable';
+import { Button } from '@@/buttons';
+import { JsonTree } from '@@/JsonTree';
+
+import { ActivityLog } from './types';
+import { getSortType } from './useActivityLogs';
+
+const columnHelper = createColumnHelper<ActivityLog>();
+
+const columns = [
+  columnHelper.accessor('timestamp', {
+    id: 'Timestamp',
+    header: 'Time',
+    cell: ({ getValue }) => {
+      const value = getValue();
+      return value ? isoDateFromTimestamp(value) : '';
+    },
+  }),
+  columnHelper.accessor('username', {
+    id: 'Username',
+    header: 'User',
+  }),
+  columnHelper.accessor('context', {
+    id: 'Context',
+    header: 'Environment',
+  }),
+  columnHelper.accessor('action', {
+    id: 'Action',
+    header: 'Action',
+  }),
+  columnHelper.accessor('payload', {
+    header: 'Payload',
+    enableSorting: false,
+    cell: ({ row, getValue }) =>
+      getValue() ? (
+        <Button
+          color="link"
+          onClick={() => row.toggleExpanded()}
+          icon={Search}
+          data-cy={`activity-logs-inspect_${row.index}`}
+        >
+          inspect
+        </Button>
+      ) : null,
+  }),
+];
+
+export function ActivityLogsTable({
+  dataset,
+  currentPage,
+  keyword,
+  limit,
+  onChangeKeyword,
+  onChangeLimit,
+  onChangePage,
+  onChangeSort,
+  sort,
+  totalItems,
+}: {
+  keyword: string;
+  onChangeKeyword(keyword: string): void;
+  sort: { id: string; desc: boolean } | undefined;
+  onChangeSort(sort: { id: string; desc: boolean } | undefined): void;
+  limit: number;
+  onChangeLimit(limit: number): void;
+  currentPage: number;
+  onChangePage(page: number): void;
+  totalItems: number;
+  dataset?: Array<ActivityLog>;
+}) {
+  return (
+    <ExpandableDatatable<ActivityLog>
+      title="Activity logs"
+      titleIcon={History}
+      columns={columns}
+      dataset={dataset || []}
+      isLoading={!dataset}
+      settingsManager={{
+        pageSize: limit,
+        search: keyword,
+        setPageSize: onChangeLimit,
+        setSearch: onChangeKeyword,
+        setSortBy: (id, desc) =>
+          onChangeSort({ id: getSortType(id) || 'Timestamp', desc }),
+        sortBy: sort
+          ? {
+              id: sort.id,
+              desc: sort.desc,
+            }
+          : undefined,
+      }}
+      page={currentPage}
+      onPageChange={onChangePage}
+      isServerSidePagination
+      totalCount={totalItems}
+      disableSelect
+      renderSubRow={(row) => <SubRow item={row.original} />}
+      data-cy="activity-logs-datatable"
+    />
+  );
+}
+
+function SubRow({ item }: { item: ActivityLog }) {
+  return (
+    <tr>
+      <td colSpan={Number.MAX_SAFE_INTEGER}>
+        <JsonTree data={item.payload} />
+      </td>
+    </tr>
+  );
+}
diff --git a/app/react/portainer/logs/ActivityLogsView/ActivityLogsView.tsx b/app/react/portainer/logs/ActivityLogsView/ActivityLogsView.tsx
new file mode 100644
index 0000000..c651cf9
--- /dev/null
+++ b/app/react/portainer/logs/ActivityLogsView/ActivityLogsView.tsx
@@ -0,0 +1,88 @@
+import { useState } from 'react';
+
+import { PageHeader } from '@@/PageHeader';
+import { useTableStateWithoutStorage } from '@@/datatables/useTableState';
+import { BEOverlay } from '@@/BEFeatureIndicator/BEOverlay';
+
+import { FeatureId } from '../../feature-flags/enums';
+
+import { ActivityLogsTable } from './ActivityLogsTable';
+import { useActivityLogs, getSortType } from './useActivityLogs';
+import { useExportMutation } from './useExportMutation';
+import { FilterBar } from './FilterBar';
+
+export function ActivityLogsView() {
+  const exportMutation = useExportMutation();
+  const [range, setRange] = useState<
+    { start: Date; end: Date | null } | undefined
+  >(undefined);
+  const [page, setPage] = useState(0);
+  const tableState = useTableStateWithoutStorage('Timestamp', true);
+  const offset = page * tableState.pageSize;
+
+  const query = {
+    offset,
+    limit: tableState.pageSize,
+    sortBy: getSortType(tableState.sortBy?.id),
+    sortDesc: tableState.sortBy?.desc,
+    keyword: tableState.search,
+    ...(range
+      ? {
+          after: seconds(range?.start?.valueOf()),
+          before: seconds(range?.end?.valueOf()),
+        }
+      : undefined),
+  };
+
+  const logsQuery = useActivityLogs(query);
+
+  return (
+    <>
+      <PageHeader
+        title="User activity logs"
+        breadcrumbs="User activity logs"
+        reload
+      />
+
+      <div className="mx-4">
+        <BEOverlay variant="multi-widget" featureId={FeatureId.ACTIVITY_AUDIT}>
+          <div className="row">
+            <div className="col-sm-12">
+              <FilterBar
+                value={range}
+                onChange={setRange}
+                onExport={handleExport}
+              />
+            </div>
+          </div>
+          <ActivityLogsTable
+            sort={tableState.sortBy}
+            onChangeSort={(value) =>
+              tableState.setSortBy(value?.id, value?.desc || false)
+            }
+            limit={tableState.pageSize}
+            onChangeLimit={tableState.setPageSize}
+            keyword={tableState.search}
+            onChangeKeyword={tableState.setSearch}
+            currentPage={page}
+            onChangePage={setPage}
+            totalItems={logsQuery.data?.totalCount || 0}
+            dataset={logsQuery.data?.logs}
+          />
+        </BEOverlay>
+      </div>
+    </>
+  );
+
+  function handleExport() {
+    exportMutation.mutate(query);
+  }
+}
+
+function seconds(ms?: number) {
+  if (!ms) {
+    return undefined;
+  }
+
+  return Math.floor(ms / 1000);
+}
diff --git a/app/react/portainer/logs/ActivityLogsView/FilterBar.tsx b/app/react/portainer/logs/ActivityLogsView/FilterBar.tsx
new file mode 100644
index 0000000..007db6c
--- /dev/null
+++ b/app/react/portainer/logs/ActivityLogsView/FilterBar.tsx
@@ -0,0 +1,43 @@
+import { DownloadIcon } from 'lucide-react';
+
+import { Widget } from '@@/Widget';
+import { TextTip } from '@@/Tip/TextTip';
+import { Button } from '@@/buttons';
+
+import { DateRangePicker } from '../components/DateRangePicker';
+
+export function FilterBar({
+  value,
+  onChange,
+  onExport,
+}: {
+  value: { start: Date; end: Date | null } | undefined;
+  onChange: (value?: { start: Date; end: Date | null }) => void;
+  onExport: () => void;
+}) {
+  return (
+    <Widget>
+      <Widget.Body>
+        <form className="form-horizontal">
+          <DateRangePicker value={value} onChange={onChange} />
+
+          <TextTip color="blue">
+            Portainer user activity logs have a maximum retention of 7 days.
+          </TextTip>
+
+          <div className="mt-4">
+            <Button
+              color="primary"
+              icon={DownloadIcon}
+              onClick={onExport}
+              className="!ml-0"
+              data-cy="activity-logs-export-csv-button"
+            >
+              Export as CSV
+            </Button>
+          </div>
+        </form>
+      </Widget.Body>
+    </Widget>
+  );
+}
diff --git a/app/react/portainer/logs/ActivityLogsView/types.ts b/app/react/portainer/logs/ActivityLogsView/types.ts
new file mode 100644
index 0000000..76176e7
--- /dev/null
+++ b/app/react/portainer/logs/ActivityLogsView/types.ts
@@ -0,0 +1,19 @@
+interface BaseActivityLog {
+  timestamp: number;
+  action: string;
+  context: string;
+  id: number;
+  username: string;
+}
+export interface ActivityLogResponse extends BaseActivityLog {
+  payload: string;
+}
+
+export interface ActivityLog extends BaseActivityLog {
+  payload: string | object;
+}
+
+export interface ActivityLogsResponse {
+  logs: Array<ActivityLogResponse>;
+  totalCount: number;
+}
diff --git a/app/react/portainer/logs/ActivityLogsView/useActivityLogs.ts b/app/react/portainer/logs/ActivityLogsView/useActivityLogs.ts
new file mode 100644
index 0000000..850dbc8
--- /dev/null
+++ b/app/react/portainer/logs/ActivityLogsView/useActivityLogs.ts
@@ -0,0 +1,94 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { isBE } from '../../feature-flags/feature-flags.service';
+
+import { ActivityLogResponse, ActivityLogsResponse } from './types';
+
+export const sortKeys = ['Context', 'Action', 'Timestamp', 'Username'] as const;
+export type SortKey = (typeof sortKeys)[number];
+export function isSortKey(value?: string): value is SortKey {
+  return !!value && sortKeys.includes(value as SortKey);
+}
+export function getSortType(value?: string): SortKey | undefined {
+  return isSortKey(value) ? value : undefined;
+}
+
+export interface Query {
+  offset: number;
+  limit: number;
+  sortBy?: SortKey;
+  sortDesc?: boolean;
+  keyword: string;
+  after?: number;
+  before?: number;
+}
+
+export function useActivityLogs(query: Query) {
+  return useQuery({
+    queryKey: ['activityLogs', query] as const,
+    queryFn: () => fetchActivityLogs(query),
+    keepPreviousData: true,
+    select: (data) => ({
+      ...data,
+      logs: decorateLogs(data.logs),
+    }),
+  });
+}
+
+async function fetchActivityLogs(query: Query): Promise<ActivityLogsResponse> {
+  try {
+    if (!isBE) {
+      return {
+        logs: [{}, {}, {}, {}, {}] as Array<ActivityLogResponse>,
+        totalCount: 5,
+      };
+    }
+
+    const { data } = await axios.get<ActivityLogsResponse>(
+      '/useractivity/logs',
+      { params: query }
+    );
+    return data;
+  } catch (err) {
+    throw parseAxiosError(err, 'Failed loading user activity logs csv');
+  }
+}
+
+/**
+ * Decorates logs with the payload parsed from base64
+ */
+function decorateLogs(logs?: ActivityLogResponse[]) {
+  if (!logs || logs.length === 0) {
+    return [];
+  }
+
+  return logs.map((log) => ({
+    ...log,
+    payload: parseBase64AsObject(log.payload),
+  }));
+}
+
+function parseBase64AsObject(value: string): string | object {
+  if (!value) {
+    return value;
+  }
+  try {
+    return JSON.parse(safeAtob(value));
+  } catch (err) {
+    return safeAtob(value);
+  }
+}
+
+function safeAtob(value: string) {
+  if (!value) {
+    return value;
+  }
+  try {
+    return window.atob(value);
+  } catch (err) {
+    // If the payload is not base64 encoded, return the original value
+    return value;
+  }
+}
diff --git a/app/react/portainer/logs/ActivityLogsView/useExportMutation.ts b/app/react/portainer/logs/ActivityLogsView/useExportMutation.ts
new file mode 100644
index 0000000..1940a21
--- /dev/null
+++ b/app/react/portainer/logs/ActivityLogsView/useExportMutation.ts
@@ -0,0 +1,32 @@
+import { useMutation } from '@tanstack/react-query';
+import { saveAs } from 'file-saver';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { Query } from './useActivityLogs';
+
+export function useExportMutation() {
+  return useMutation({
+    mutationFn: exportActivityLogs,
+  });
+}
+
+async function exportActivityLogs(query: Omit<Query, 'limit'>) {
+  try {
+    const { data, headers } = await axios.get<Blob>('/useractivity/logs.csv', {
+      params: { ...query, limit: 0 },
+      responseType: 'blob',
+      headers: {
+        'Content-type': 'text/csv',
+      },
+    });
+
+    const contentDispositionHeader = headers['content-disposition'] || '';
+    const filename =
+      contentDispositionHeader.replace('attachment; filename=', '').trim() ||
+      'logs.csv';
+    saveAs(data, filename);
+  } catch (err) {
+    throw parseAxiosError(err, 'Failed loading user activity logs csv');
+  }
+}
diff --git a/app/react/portainer/logs/AuthenticationLogsView/AuthenticationLogsTable.tsx b/app/react/portainer/logs/AuthenticationLogsView/AuthenticationLogsTable.tsx
new file mode 100644
index 0000000..0eb8871
--- /dev/null
+++ b/app/react/portainer/logs/AuthenticationLogsView/AuthenticationLogsTable.tsx
@@ -0,0 +1,58 @@
+import { History } from 'lucide-react';
+
+import { Datatable } from '@@/datatables';
+
+import { AuthLog } from './types';
+import { columns } from './columns';
+
+export function AuthenticationLogsTable({
+  dataset,
+  currentPage,
+  keyword,
+  limit,
+  onChangeKeyword,
+  onChangeLimit,
+  onChangePage,
+  onChangeSort,
+  sort,
+  totalItems,
+}: {
+  keyword: string;
+  onChangeKeyword(keyword: string): void;
+  sort: { key: string; desc: boolean };
+  onChangeSort(sort: { key: string; desc: boolean }): void;
+  limit: number;
+  onChangeLimit(limit: number): void;
+  currentPage: number;
+  onChangePage(page: number): void;
+  totalItems: number;
+  dataset?: Array<AuthLog>;
+}) {
+  return (
+    <Datatable<AuthLog>
+      title="Authentication events"
+      titleIcon={History}
+      columns={columns}
+      dataset={dataset || []}
+      isLoading={!dataset}
+      settingsManager={{
+        pageSize: limit,
+        search: keyword,
+        setPageSize: onChangeLimit,
+        setSearch: onChangeKeyword,
+        setSortBy: (key, desc) =>
+          onChangeSort({ key: key || 'timestamp', desc }),
+        sortBy: {
+          id: sort.key,
+          desc: sort.desc,
+        },
+      }}
+      page={currentPage}
+      onPageChange={onChangePage}
+      isServerSidePagination
+      totalCount={totalItems}
+      disableSelect
+      data-cy="authentication-logs-datatable"
+    />
+  );
+}
diff --git a/app/react/portainer/logs/AuthenticationLogsView/columns.tsx b/app/react/portainer/logs/AuthenticationLogsView/columns.tsx
new file mode 100644
index 0000000..2f452b9
--- /dev/null
+++ b/app/react/portainer/logs/AuthenticationLogsView/columns.tsx
@@ -0,0 +1,74 @@
+import { createColumnHelper } from '@tanstack/react-table';
+import { Check, X } from 'lucide-react';
+
+import { isoDateFromTimestamp } from '@/portainer/filters/filters';
+
+import { multiple } from '@@/datatables/filter-types';
+import { filterHOC } from '@@/datatables/Filter';
+import { Icon } from '@@/Icon';
+
+import { ActivityType, AuthLog, AuthMethodType } from './types';
+
+const activityTypesProps = {
+  [ActivityType.AuthSuccess]: {
+    label: 'Authentication success',
+    icon: Check,
+    mode: 'success',
+  },
+  [ActivityType.AuthFailure]: {
+    label: 'Authentication failure',
+    icon: X,
+    mode: 'danger',
+  },
+  [ActivityType.Logout]: { label: 'Logout', icon: undefined, mode: undefined },
+} as const;
+
+const columnHelper = createColumnHelper<AuthLog>();
+
+export const columns = [
+  columnHelper.accessor('timestamp', {
+    header: 'Time',
+    cell: ({ getValue }) => {
+      const value = getValue();
+      return value ? isoDateFromTimestamp(value) : '';
+    },
+  }),
+  columnHelper.accessor('origin', {
+    header: 'Origin',
+  }),
+  columnHelper.accessor(({ context }) => AuthMethodType[context] || '', {
+    header: 'Context',
+    enableColumnFilter: true,
+    filterFn: multiple,
+    meta: {
+      filter: filterHOC('Filter'),
+    },
+  }),
+  columnHelper.accessor('username', {
+    header: 'User',
+  }),
+
+  columnHelper.accessor((item) => activityTypesProps[item.type].label, {
+    header: 'Result',
+    enableColumnFilter: true,
+    filterFn: multiple,
+    meta: {
+      filter: filterHOC('Filter'),
+    },
+    cell({ row: { original: item } }) {
+      const props = activityTypesProps[item.type];
+      if (!props) {
+        return null;
+      }
+
+      const { label, icon, mode } = props;
+
+      return (
+        <span className="flex items-center gap-1">
+          {label}
+          {icon && mode && <Icon icon={icon} mode={mode} />}
+        </span>
+      );
+    },
+  }),
+];
diff --git a/app/react/portainer/logs/AuthenticationLogsView/types.ts b/app/react/portainer/logs/AuthenticationLogsView/types.ts
new file mode 100644
index 0000000..65686fc
--- /dev/null
+++ b/app/react/portainer/logs/AuthenticationLogsView/types.ts
@@ -0,0 +1,20 @@
+export enum AuthMethodType {
+  Internal = 1,
+  LDAP,
+  OAuth,
+}
+
+export enum ActivityType {
+  AuthSuccess = 1,
+  AuthFailure,
+  Logout,
+}
+
+export interface AuthLog {
+  timestamp: number;
+  context: AuthMethodType;
+  id: number;
+  username: string;
+  type: ActivityType;
+  origin: string;
+}
diff --git a/app/react/portainer/logs/components/DateRangePicker.tsx b/app/react/portainer/logs/components/DateRangePicker.tsx
new file mode 100644
index 0000000..1bb50c1
--- /dev/null
+++ b/app/react/portainer/logs/components/DateRangePicker.tsx
@@ -0,0 +1,65 @@
+import WojtekmajRangePicker from '@wojtekmaj/react-daterange-picker';
+import { Calendar, X } from 'lucide-react';
+import { date, object, SchemaOf } from 'yup';
+import { FormikErrors } from 'formik';
+
+import '@wojtekmaj/react-daterange-picker/dist/DateRangePicker.css';
+import 'react-calendar/dist/Calendar.css';
+
+import { FormControl } from '@@/form-components/FormControl';
+
+import 'react-datetime-picker/dist/DateTimePicker.css';
+
+type Value = { start: Date; end: Date | null };
+
+export function DateRangePicker({
+  value,
+  onChange,
+  name,
+  error,
+}: {
+  value: Value | undefined;
+  onChange: (value?: Value) => void;
+  name?: string;
+  error?: FormikErrors<Value>;
+}) {
+  return (
+    <FormControl label="Date range" errors={error}>
+      <div className="w-1/2">
+        <WojtekmajRangePicker
+          format="y-MM-dd"
+          className="form-control [&>div]:border-0"
+          value={value ? [value.start, value.end] : null}
+          onChange={(date) => {
+            if (!date) {
+              onChange(undefined);
+              return;
+            }
+            if (Array.isArray(date)) {
+              if (date.length === 2 && date[0] && date[1]) {
+                onChange({
+                  start: date[0],
+                  end: date[1],
+                });
+                return;
+              }
+              onChange(undefined);
+              return;
+            }
+            onChange({ start: date, end: null });
+          }}
+          name={name}
+          calendarIcon={<Calendar />}
+          clearIcon={<X />}
+        />
+      </div>
+    </FormControl>
+  );
+}
+
+export function dateRangePickerValidation(): SchemaOf<Value> {
+  return object({
+    start: date().required(),
+    end: date().nullable().default(null).required(),
+  });
+}
diff --git a/app/react/portainer/notifications/NotificationsView.tsx b/app/react/portainer/notifications/NotificationsView.tsx
new file mode 100644
index 0000000..8148964
--- /dev/null
+++ b/app/react/portainer/notifications/NotificationsView.tsx
@@ -0,0 +1,83 @@
+import { Bell } from 'lucide-react';
+import { useStore } from 'zustand';
+import { useCurrentStateAndParams } from '@uirouter/react';
+
+import { withCurrentUser } from '@/react-tools/withCurrentUser';
+import { react2angular } from '@/react-tools/react2angular';
+import { useUser } from '@/react/hooks/useUser';
+import { withUIRouter } from '@/react-tools/withUIRouter';
+import { withReactQuery } from '@/react-tools/withReactQuery';
+
+import { PageHeader } from '@@/PageHeader';
+import { Datatable } from '@@/datatables';
+import { createPersistedStore } from '@@/datatables/types';
+import { useTableState } from '@@/datatables/useTableState';
+import { DeleteButton } from '@@/buttons/DeleteButton';
+
+import { notificationsStore } from './notifications-store';
+import { ToastNotification } from './types';
+import { columns } from './columns';
+
+const storageKey = 'notifications-list';
+const settingsStore = createPersistedStore(storageKey, {
+  id: 'time',
+  desc: true,
+});
+
+export function NotificationsView() {
+  const { user } = useUser();
+
+  const userNotifications: ToastNotification[] =
+    useStore(notificationsStore, (state) => state.userNotifications[user.Id]) ||
+    [];
+
+  const breadcrumbs = 'Notifications';
+  const tableState = useTableState(settingsStore, storageKey);
+
+  const {
+    params: { id: activeItemId },
+  } = useCurrentStateAndParams();
+
+  return (
+    <>
+      <PageHeader title="Notifications" breadcrumbs={breadcrumbs} reload />
+      <Datatable
+        columns={columns}
+        title="Notifications"
+        titleIcon={Bell}
+        dataset={userNotifications}
+        settingsManager={tableState}
+        renderTableActions={(selectedRows) => (
+          <TableActions selectedRows={selectedRows} />
+        )}
+        getRowId={(row) => row.id}
+        highlightedItemId={activeItemId}
+        data-cy="notifications-datatable"
+      />
+    </>
+  );
+}
+
+function TableActions({ selectedRows }: { selectedRows: ToastNotification[] }) {
+  const { user } = useUser();
+  const notificationsStoreState = useStore(notificationsStore);
+  return (
+    <DeleteButton
+      onConfirmed={() => handleRemove()}
+      disabled={selectedRows.length === 0}
+      data-cy="remove-notifications-button"
+      confirmMessage="Are you sure you want to remove the selected notifications?"
+    />
+  );
+
+  function handleRemove() {
+    const { removeNotifications } = notificationsStoreState;
+    const ids = selectedRows.map((row) => row.id);
+    removeNotifications(user.Id, ids);
+  }
+}
+
+export const NotificationsViewAngular = react2angular(
+  withUIRouter(withReactQuery(withCurrentUser(NotificationsView))),
+  []
+);
diff --git a/app/react/portainer/notifications/columns/details.tsx b/app/react/portainer/notifications/columns/details.tsx
new file mode 100644
index 0000000..740931c
--- /dev/null
+++ b/app/react/portainer/notifications/columns/details.tsx
@@ -0,0 +1,11 @@
+import { columnHelper } from './helper';
+
+export const details = columnHelper.accessor('details', {
+  header: 'Details',
+  id: 'details',
+  cell: ({ getValue }) => {
+    const value = getValue();
+
+    return <div className="whitespace-normal">{value}</div>;
+  },
+});
diff --git a/app/react/portainer/notifications/columns/helper.ts b/app/react/portainer/notifications/columns/helper.ts
new file mode 100644
index 0000000..0f1c62d
--- /dev/null
+++ b/app/react/portainer/notifications/columns/helper.ts
@@ -0,0 +1,5 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { ToastNotification } from '../types';
+
+export const columnHelper = createColumnHelper<ToastNotification>();
diff --git a/app/react/portainer/notifications/columns/index.tsx b/app/react/portainer/notifications/columns/index.tsx
new file mode 100644
index 0000000..fa60a8c
--- /dev/null
+++ b/app/react/portainer/notifications/columns/index.tsx
@@ -0,0 +1,6 @@
+import { type } from './type';
+import { title } from './title';
+import { details } from './details';
+import { time } from './time';
+
+export const columns = [type, title, details, time];
diff --git a/app/react/portainer/notifications/columns/time.tsx b/app/react/portainer/notifications/columns/time.tsx
new file mode 100644
index 0000000..4eecc5f
--- /dev/null
+++ b/app/react/portainer/notifications/columns/time.tsx
@@ -0,0 +1,13 @@
+import { isoDate } from '@/portainer/filters/filters';
+
+import { columnHelper } from './helper';
+
+export const time = columnHelper.accessor('timeStamp', {
+  header: 'Time',
+  id: 'time',
+  cell: ({ getValue }) => {
+    const value = getValue();
+
+    return value ? isoDate(value) : '-';
+  },
+});
diff --git a/app/react/portainer/notifications/columns/title.tsx b/app/react/portainer/notifications/columns/title.tsx
new file mode 100644
index 0000000..6e2fe01
--- /dev/null
+++ b/app/react/portainer/notifications/columns/title.tsx
@@ -0,0 +1,6 @@
+import { columnHelper } from './helper';
+
+export const title = columnHelper.accessor('title', {
+  header: 'Title',
+  id: 'title',
+});
diff --git a/app/react/portainer/notifications/columns/type.tsx b/app/react/portainer/notifications/columns/type.tsx
new file mode 100644
index 0000000..08cb7ef
--- /dev/null
+++ b/app/react/portainer/notifications/columns/type.tsx
@@ -0,0 +1,13 @@
+import _ from 'lodash';
+
+import { columnHelper } from './helper';
+
+export const type = columnHelper.accessor('type', {
+  header: 'Type',
+  id: 'type',
+  cell: ({ getValue }) => {
+    const value = getValue();
+
+    return _.capitalize(value);
+  },
+});
diff --git a/app/react/portainer/notifications/notifications-store.ts b/app/react/portainer/notifications/notifications-store.ts
new file mode 100644
index 0000000..e888873
--- /dev/null
+++ b/app/react/portainer/notifications/notifications-store.ts
@@ -0,0 +1,69 @@
+import create from 'zustand/vanilla';
+import { persist } from 'zustand/middleware';
+
+import { keyBuilder } from '@/react/hooks/useLocalStorage';
+import { UserId } from '@/portainer/users/types';
+
+import { ToastNotification } from './types';
+
+interface NotificationsState {
+  userNotifications: Record<UserId, ToastNotification[]>;
+  addNotification: (userId: number, notification: ToastNotification) => void;
+  removeNotification: (userId: number, notificationId: string) => void;
+  removeNotifications: (userId: number, notifications: string[]) => void;
+  clearUserNotifications: (userId: number) => void;
+}
+
+export const notificationsStore = create<NotificationsState>()(
+  persist(
+    (set) => ({
+      userNotifications: {},
+      addNotification: (userId: number, notification: ToastNotification) => {
+        set((state) => {
+          // keep the new notification at the start of the list, so sorting by newest time isn't required
+          const newUserNotifications = [
+            notification,
+            ...(state.userNotifications[userId] || []),
+          ];
+          return {
+            userNotifications: {
+              ...state.userNotifications,
+              [userId]: newUserNotifications,
+            },
+          };
+        });
+      },
+      removeNotification: (userId: number, notificationId: string) => {
+        set((state) => ({
+          userNotifications: {
+            ...state.userNotifications,
+            [userId]: state.userNotifications[userId].filter(
+              (notif) => notif.id !== notificationId
+            ),
+          },
+        }));
+      },
+      removeNotifications: (userId: number, notificationIds: string[]) => {
+        set((state) => ({
+          userNotifications: {
+            ...state.userNotifications,
+            [userId]: state.userNotifications[userId].filter(
+              (notification) => !notificationIds.includes(notification.id)
+            ),
+          },
+        }));
+      },
+      clearUserNotifications: (userId: number) => {
+        set((state) => ({
+          userNotifications: {
+            ...state.userNotifications,
+            [userId]: [],
+          },
+        }));
+      },
+    }),
+    {
+      name: keyBuilder('notifications'),
+    }
+  )
+);
diff --git a/app/react/portainer/notifications/types.ts b/app/react/portainer/notifications/types.ts
new file mode 100644
index 0000000..4285449
--- /dev/null
+++ b/app/react/portainer/notifications/types.ts
@@ -0,0 +1,7 @@
+export type ToastNotification = {
+  id: string;
+  title: string;
+  details: string;
+  type: string;
+  timeStamp: Date;
+};
diff --git a/app/react/portainer/registries/.keep b/app/react/portainer/registries/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/portainer/registries/ConfigureView/.keep b/app/react/portainer/registries/ConfigureView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/portainer/registries/CreateView/.keep b/app/react/portainer/registries/CreateView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/portainer/registries/CreateView/GitlabProjectsTable/GitlabProjectsTable.tsx b/app/react/portainer/registries/CreateView/GitlabProjectsTable/GitlabProjectsTable.tsx
new file mode 100644
index 0000000..f149497
--- /dev/null
+++ b/app/react/portainer/registries/CreateView/GitlabProjectsTable/GitlabProjectsTable.tsx
@@ -0,0 +1,54 @@
+import { createColumnHelper } from '@tanstack/react-table';
+import { ListIcon } from 'lucide-react';
+
+import { createPersistedStore } from '@@/datatables/types';
+import { useTableState } from '@@/datatables/useTableState';
+import { Datatable } from '@@/datatables';
+import { withControlledSelected } from '@@/datatables/extend-options/withControlledSelected';
+import { mergeOptions } from '@@/datatables/extend-options/mergeOptions';
+
+import { RegistryGitlabProject } from '../../types/gitlabProject';
+
+const helper = createColumnHelper<RegistryGitlabProject>();
+
+const columns = [
+  helper.accessor('Namespace', {}),
+  helper.accessor('Name', {}),
+  helper.accessor('PathWithNamespace', {
+    header: 'Path with namespace',
+  }),
+  helper.accessor('Description', {}),
+];
+
+const tableKey = 'gitlab-projects';
+const store = createPersistedStore(tableKey, 'Name');
+
+export function GitlabProjectTable({
+  dataset,
+  value,
+  onChange,
+}: {
+  dataset: RegistryGitlabProject[];
+  value: RegistryGitlabProject[];
+  onChange: (value: RegistryGitlabProject[]) => void;
+}) {
+  const tableState = useTableState(store, tableKey);
+
+  return (
+    <Datatable
+      columns={columns}
+      dataset={dataset}
+      settingsManager={tableState}
+      title="Gitlab projects"
+      titleIcon={ListIcon}
+      extendTableOptions={mergeOptions(
+        withControlledSelected(
+          (ids) => onChange(dataset.filter(({ Id }) => ids.includes(`${Id}`))),
+          value.map(({ Id }) => `${Id}`)
+        )
+      )}
+      isRowSelectable={({ original: item }) => item.RegistryEnabled}
+      data-cy="gitlab-projects-datatable"
+    />
+  );
+}
diff --git a/app/react/portainer/registries/CreateView/RegistryFormDockerhub/RegistryFormDockerhub.stories.tsx b/app/react/portainer/registries/CreateView/RegistryFormDockerhub/RegistryFormDockerhub.stories.tsx
new file mode 100644
index 0000000..d5eb8b3
--- /dev/null
+++ b/app/react/portainer/registries/CreateView/RegistryFormDockerhub/RegistryFormDockerhub.stories.tsx
@@ -0,0 +1,86 @@
+import { Meta, StoryObj } from '@storybook/react-webpack5';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+
+import {
+  RegistryFormDockerhub,
+  RegistryFormDockerhubValues,
+} from './RegistryFormDockerhub';
+
+const meta: Meta<typeof RegistryFormDockerhub> = {
+  component: withTestQueryProvider(RegistryFormDockerhub),
+  title: 'Components/Forms/RegistryFormDockerhub',
+  argTypes: {
+    isLoading: { control: 'boolean' },
+    submitLabel: { control: 'text' },
+  },
+};
+
+export default meta;
+type Story = StoryObj<typeof RegistryFormDockerhub>;
+
+const defaultInitialValues: RegistryFormDockerhubValues = {
+  Name: '',
+  Username: '',
+  Password: '',
+};
+
+export const CreateForm: Story = {
+  args: {
+    initialValues: defaultInitialValues,
+    onSubmit: (values) => {
+      // eslint-disable-next-line no-console
+      console.log('Form submitted:', values);
+      return Promise.resolve();
+    },
+    submitLabel: 'Add registry',
+    isLoading: false,
+    nameIsUsed: () => Promise.resolve(false),
+  },
+};
+
+export const EditForm: Story = {
+  args: {
+    initialValues: {
+      Name: 'dockerhub-prod',
+      Username: 'myusername',
+      Password: '••••••••••••',
+    },
+    onSubmit: (values) => {
+      // eslint-disable-next-line no-console
+      console.log('Form updated:', values);
+      return Promise.resolve();
+    },
+    submitLabel: 'Update registry',
+    isLoading: false,
+    nameIsUsed: () => Promise.resolve(false),
+  },
+};
+
+export const LoadingState: Story = {
+  args: {
+    initialValues: defaultInitialValues,
+    onSubmit: () => new Promise(() => {}), // Never resolves to keep loading
+    submitLabel: 'Add registry',
+    isLoading: true,
+    nameIsUsed: () => Promise.resolve(false),
+  },
+};
+
+export const WithNameConflict: Story = {
+  args: {
+    initialValues: {
+      Name: 'existing-registry',
+      Username: '',
+      Password: '',
+    },
+    onSubmit: (values) => {
+      // eslint-disable-next-line no-console
+      console.log('Form submitted:', values);
+      return Promise.resolve();
+    },
+    submitLabel: 'Add registry',
+    isLoading: false,
+    nameIsUsed: (name) => Promise.resolve(name === 'existing-registry'),
+  },
+};
diff --git a/app/react/portainer/registries/CreateView/RegistryFormDockerhub/RegistryFormDockerhub.test.tsx b/app/react/portainer/registries/CreateView/RegistryFormDockerhub/RegistryFormDockerhub.test.tsx
new file mode 100644
index 0000000..1148881
--- /dev/null
+++ b/app/react/portainer/registries/CreateView/RegistryFormDockerhub/RegistryFormDockerhub.test.tsx
@@ -0,0 +1,171 @@
+import React from 'react';
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { vi } from 'vitest';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+
+import {
+  RegistryFormDockerhub,
+  RegistryFormDockerhubValues,
+} from './RegistryFormDockerhub';
+
+// Mock RegistryTestConnection component to auto-trigger success
+vi.mock('../TestConnection/RegistryTestConnection', () => ({
+  RegistryTestConnection: ({
+    onTestSuccess,
+    disabled,
+  }: {
+    onTestSuccess: () => void;
+    disabled?: boolean;
+  }) => {
+    // Auto-trigger success for tests, but only when the form is valid (not disabled)
+    React.useEffect(() => {
+      if (!disabled) {
+        onTestSuccess();
+      }
+    }, [onTestSuccess, disabled]);
+
+    return <div data-testid="registry-test-connection">Test Connection</div>;
+  },
+}));
+
+test('should render form with all required fields', () => {
+  renderComponent();
+
+  expect(screen.getByText('Important notice')).toBeVisible();
+  expect(screen.getByText('DockerHub account details')).toBeVisible();
+  expect(screen.getByText('Actions')).toBeVisible();
+
+  expect(screen.getByLabelText(/Name/)).toBeVisible();
+  expect(screen.getByLabelText(/DockerHub username/)).toBeVisible();
+  expect(screen.getByLabelText(/DockerHub access token/)).toBeVisible();
+
+  expect(screen.getByRole('button', { name: 'Add registry' })).toBeVisible();
+});
+
+test('should show validation errors for empty required fields', async () => {
+  renderComponent();
+
+  const submitButton = screen.getByRole('button', { name: 'Add registry' });
+
+  await userEvent.click(submitButton);
+
+  expect(submitButton).toBeDisabled();
+
+  await waitFor(() => {
+    const errorMessages = screen.getAllByText('This field is required.');
+    expect(errorMessages.length).toBe(3);
+    expect(errorMessages[0]).toBeVisible();
+  });
+});
+
+test('should show error when name is already used', async () => {
+  const nameIsUsed = vi.fn((name: string) =>
+    Promise.resolve(name === 'existing-name')
+  );
+
+  renderComponent({ nameIsUsed });
+
+  const user = userEvent.setup();
+
+  const nameInput = screen.getByLabelText(/Name/);
+  await user.type(nameInput, 'existing-name');
+  await user.tab(); // Trigger validation
+
+  await waitFor(() => {
+    expect(
+      screen.getByText('A registry with the same name already exists.')
+    ).toBeVisible();
+  });
+});
+
+test('should submit form with valid data', async () => {
+  const user = userEvent.setup();
+  const onSubmit = vi.fn();
+
+  renderComponent({ onSubmit });
+
+  await user.type(screen.getByLabelText(/Name/), 'test-registry');
+  await user.type(screen.getByLabelText(/DockerHub username/), 'testuser');
+  await user.type(
+    screen.getByLabelText(/DockerHub access token/),
+    'secret-token'
+  );
+
+  const submitButton = screen.getByRole('button', { name: 'Add registry' });
+
+  await waitFor(() => {
+    expect(submitButton).toBeEnabled();
+  });
+
+  await user.click(submitButton);
+
+  await waitFor(() => {
+    expect(onSubmit).toHaveBeenCalledWith({
+      Name: 'test-registry',
+      Username: 'testuser',
+      Password: 'secret-token',
+    });
+  });
+});
+
+test('should show loading state when isLoading is true', () => {
+  renderComponent({ isLoading: true });
+
+  const submitButton = screen.getByRole('button', { name: 'In progress...' });
+
+  expect(submitButton).toBeDisabled();
+});
+
+test('should populate form with initial values', () => {
+  const initialValues = {
+    Name: 'my-registry',
+    Username: 'myuser',
+    Password: 'mypassword',
+  };
+
+  renderComponent({ initialValues });
+
+  expect(screen.getByDisplayValue('my-registry')).toBeVisible();
+  expect(screen.getByDisplayValue('myuser')).toBeVisible();
+  expect(screen.getByDisplayValue('mypassword')).toBeVisible();
+});
+
+test('should display dockerhub guide link', () => {
+  renderComponent();
+
+  const link = screen.getByRole('link', { name: /dockerhub guide/ });
+  expect(link).toHaveAttribute(
+    'href',
+    'https://docs.docker.com/docker-hub/access-tokens/'
+  );
+  expect(link).toHaveAttribute('target', '_blank');
+});
+
+function renderComponent(
+  props: Partial<React.ComponentProps<typeof RegistryFormDockerhub>> = {}
+) {
+  const defaultInitialValues: RegistryFormDockerhubValues = {
+    Name: '',
+    Username: '',
+    Password: '',
+  };
+
+  const defaultProps = {
+    initialValues: defaultInitialValues,
+    onSubmit: vi.fn(),
+    submitLabel: 'Add registry',
+    isLoading: false,
+    nameIsUsed: vi.fn(() => Promise.resolve(false)),
+  };
+
+  const actualProps = {
+    ...defaultProps,
+    ...props,
+  };
+
+  const Wrapped = withTestQueryProvider(RegistryFormDockerhub);
+
+  return render(<Wrapped {...actualProps} />);
+}
diff --git a/app/react/portainer/registries/CreateView/RegistryFormDockerhub/RegistryFormDockerhub.tsx b/app/react/portainer/registries/CreateView/RegistryFormDockerhub/RegistryFormDockerhub.tsx
new file mode 100644
index 0000000..7861d59
--- /dev/null
+++ b/app/react/portainer/registries/CreateView/RegistryFormDockerhub/RegistryFormDockerhub.tsx
@@ -0,0 +1,160 @@
+import { Formik, Form } from 'formik';
+import { SchemaOf, object, string } from 'yup';
+import { useState } from 'react';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+import { FormSection } from '@@/form-components/FormSection';
+import { TextTip } from '@@/Tip/TextTip';
+import { FormActions } from '@@/form-components/FormActions';
+
+import { RegistryTestConnection } from '../TestConnection/RegistryTestConnection';
+
+export interface RegistryFormDockerhubValues {
+  Name: string;
+  Username: string;
+  Password: string;
+}
+
+interface Props {
+  initialValues: RegistryFormDockerhubValues;
+  onSubmit: (values: RegistryFormDockerhubValues) => void | Promise<void>;
+  submitLabel: string;
+  isLoading: boolean;
+  nameIsUsed: (name: string) => Promise<boolean>;
+}
+
+export function RegistryFormDockerhub({
+  initialValues,
+  onSubmit,
+  submitLabel,
+  isLoading,
+  nameIsUsed,
+}: Props) {
+  const [isConnectionTested, setIsConnectionTested] = useState(false);
+
+  return (
+    <Formik
+      initialValues={initialValues}
+      validationSchema={() => validationSchema(nameIsUsed)}
+      onSubmit={handleSubmit}
+      enableReinitialize
+      validateOnMount
+    >
+      {({ errors, isValid, values, setFieldValue }) => (
+        <Form className="form-horizontal">
+          <FormSection title="Important notice">
+            <TextTip color="blue">
+              <p>
+                For information on how to generate a DockerHub Access Token,
+                follow the{' '}
+                <a
+                  href="https://docs.docker.com/docker-hub/access-tokens/"
+                  target="_blank"
+                  rel="noopener noreferrer"
+                >
+                  dockerhub guide
+                </a>
+                .
+              </p>
+            </TextTip>
+          </FormSection>
+
+          <FormSection title="DockerHub account details">
+            <FormControl
+              label="Name"
+              inputId="registry_name"
+              errors={errors.Name}
+              required
+            >
+              <Input
+                id="registry_name"
+                name="Name"
+                placeholder="dockerhub-prod-us"
+                data-cy="component-registryName"
+                value={values.Name}
+                onChange={(event) => {
+                  setIsConnectionTested(false);
+                  setFieldValue('Name', event.target.value);
+                }}
+              />
+            </FormControl>
+
+            <FormControl
+              label="DockerHub username"
+              inputId="registry_username"
+              errors={errors.Username}
+              required
+            >
+              <Input
+                id="registry_username"
+                name="Username"
+                data-cy="component-registryUsername"
+                value={values.Username}
+                onChange={(event) => {
+                  setIsConnectionTested(false);
+                  setFieldValue('Username', event.target.value);
+                }}
+              />
+            </FormControl>
+
+            <FormControl
+              label="DockerHub access token"
+              inputId="registry_password"
+              errors={errors.Password}
+              required
+            >
+              <Input
+                id="registry_password"
+                name="Password"
+                type="password"
+                data-cy="component-registryPassword"
+                value={values.Password}
+                onChange={(event) => {
+                  setIsConnectionTested(false);
+                  setFieldValue('Password', event.target.value);
+                }}
+              />
+            </FormControl>
+          </FormSection>
+
+          <RegistryTestConnection
+            values={values}
+            onTestSuccess={() => setIsConnectionTested(true)}
+            disabled={!isValid}
+            isConnectionTested={isConnectionTested}
+          />
+
+          <FormActions
+            isLoading={isLoading}
+            isValid={isValid && isConnectionTested}
+            submitLabel={submitLabel}
+            errors={errors}
+            loadingText="In progress..."
+            data-cy="registry-form-submit"
+          />
+        </Form>
+      )}
+    </Formik>
+  );
+
+  function handleSubmit(values: RegistryFormDockerhubValues) {
+    return onSubmit(values);
+  }
+}
+
+function validationSchema(
+  nameIsUsed: (name: string) => Promise<boolean>
+): SchemaOf<RegistryFormDockerhubValues> {
+  return object({
+    Name: string()
+      .required('This field is required.')
+      .test(
+        'name-not-used',
+        'A registry with the same name already exists.',
+        async (name) => !(await nameIsUsed(name || ''))
+      ),
+    Username: string().required('This field is required.'),
+    Password: string().required('This field is required.'),
+  });
+}
diff --git a/app/react/portainer/registries/CreateView/TestConnection/RegistryTestConnection.test.tsx b/app/react/portainer/registries/CreateView/TestConnection/RegistryTestConnection.test.tsx
new file mode 100644
index 0000000..572cad2
--- /dev/null
+++ b/app/react/portainer/registries/CreateView/TestConnection/RegistryTestConnection.test.tsx
@@ -0,0 +1,156 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { vi } from 'vitest';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { server } from '@/setup-tests/server';
+import { suppressConsoleLogs } from '@/setup-tests/suppress-console';
+
+import { RegistryTestConnection } from './RegistryTestConnection';
+
+const defaultValues = {
+  Username: 'testuser',
+  Password: 'testpass',
+};
+
+const defaultProps = {
+  values: defaultValues,
+  onTestSuccess: vi.fn(),
+  onTestReset: vi.fn(),
+  disabled: false,
+};
+
+function renderComponent(props = {}) {
+  const Wrapped = withTestQueryProvider(RegistryTestConnection);
+  return render(<Wrapped {...defaultProps} {...props} />);
+}
+
+test('should render test connection button', () => {
+  renderComponent();
+
+  expect(screen.getByRole('button', { name: 'Test connection' })).toBeVisible();
+});
+
+test('should be disabled when disabled prop is true', () => {
+  renderComponent({ disabled: true });
+
+  expect(
+    screen.getByRole('button', { name: 'Test connection' })
+  ).toBeDisabled();
+});
+
+test('should be disabled when required fields are empty', () => {
+  renderComponent({
+    values: { Username: '', Password: '' },
+  });
+
+  expect(
+    screen.getByRole('button', { name: 'Test connection' })
+  ).toBeDisabled();
+});
+
+test('should show success message on successful test', async () => {
+  const user = userEvent.setup();
+  const onTestSuccess = vi.fn();
+
+  // Mock successful response from the API
+  server.use(
+    http.post('/api/registries/ping', () =>
+      HttpResponse.json({
+        success: true,
+        message: 'Registry connection successful',
+      })
+    )
+  );
+
+  renderComponent({ onTestSuccess });
+
+  const button = screen.getByRole('button', { name: 'Test connection' });
+  await user.click(button);
+
+  await waitFor(() => {
+    expect(screen.getByText(/Registry connection successful/)).toBeVisible();
+  });
+
+  expect(onTestSuccess).toHaveBeenCalled();
+});
+
+test('should show error message on failed test', async () => {
+  const user = userEvent.setup();
+
+  // Mock failed response from the API
+  server.use(
+    http.post('/api/registries/ping', () =>
+      HttpResponse.json(
+        {
+          success: false,
+          message: 'Connection failed',
+        },
+        { status: 200 }
+      )
+    )
+  );
+
+  renderComponent();
+
+  const button = screen.getByRole('button', { name: 'Test connection' });
+  await user.click(button);
+
+  await waitFor(() => {
+    expect(screen.getByText(/Connection failed/)).toBeVisible();
+  });
+});
+
+test('should show error message on network error', async () => {
+  const restoreConsole = suppressConsoleLogs();
+
+  const user = userEvent.setup();
+
+  // Mock network error
+  server.use(http.post('/api/registries/ping', () => HttpResponse.error()));
+
+  renderComponent();
+
+  const button = screen.getByRole('button', { name: 'Test connection' });
+  await user.click(button);
+
+  await waitFor(() => {
+    expect(
+      screen.getByText(/Failed to test registry connection/)
+    ).toBeVisible();
+  });
+
+  restoreConsole();
+});
+
+test('should send correct payload to API', async () => {
+  const user = userEvent.setup();
+  let receivedPayload: unknown;
+
+  // Mock API to capture the payload
+  server.use(
+    http.post('/api/registries/ping', async ({ request }) => {
+      receivedPayload = await request.json();
+      return HttpResponse.json({
+        success: true,
+        message: 'Registry connection successful',
+      });
+    })
+  );
+
+  renderComponent();
+
+  const button = screen.getByRole('button', { name: 'Test connection' });
+  await user.click(button);
+
+  await waitFor(() => {
+    expect(screen.getByText(/Registry connection successful/)).toBeVisible();
+  });
+
+  expect(receivedPayload).toEqual({
+    Username: 'testuser',
+    Password: 'testpass',
+    Type: 6,
+  });
+});
diff --git a/app/react/portainer/registries/CreateView/TestConnection/RegistryTestConnection.tsx b/app/react/portainer/registries/CreateView/TestConnection/RegistryTestConnection.tsx
new file mode 100644
index 0000000..f8f911e
--- /dev/null
+++ b/app/react/portainer/registries/CreateView/TestConnection/RegistryTestConnection.tsx
@@ -0,0 +1,118 @@
+import { useEffect, useState } from 'react';
+import { AlertCircle, ArrowLeftRight, CheckCircle } from 'lucide-react';
+
+import { LoadingButton } from '@@/buttons';
+import { TextTip } from '@@/Tip/TextTip';
+
+import { RegistryTypes } from '../../types/registry';
+
+import { useCheckRegistryConnectionMutation } from './useCheckRegistryConnectionMutation';
+
+interface Props {
+  values: {
+    Username: string;
+    Password: string;
+  };
+  onTestSuccess: () => void;
+  disabled?: boolean;
+  isConnectionTested?: boolean;
+}
+
+export function RegistryTestConnection({
+  values,
+  onTestSuccess,
+  isConnectionTested,
+  disabled,
+}: Props) {
+  const [testResult, setTestResult] = useState<{
+    success: boolean;
+    message: string;
+  } | null>(null);
+
+  useEffect(() => {
+    if (!isConnectionTested) {
+      setTestResult({
+        success: false,
+        message: 'Connection not tested yet.',
+      });
+    }
+  }, [isConnectionTested]);
+
+  const pingMutation = useCheckRegistryConnectionMutation();
+
+  return (
+    <div className="flex flex-row items-center gap-3">
+      <LoadingButton
+        size="small"
+        color="default"
+        className="!ml-0 w-min"
+        isLoading={pingMutation.isLoading}
+        icon={ArrowLeftRight}
+        loadingText="Testing connection..."
+        onClick={handleTestConnection}
+        disabled={disabled || !values.Username || !values.Password}
+        type="button"
+        data-cy="registry-test-connection-button"
+      >
+        Test connection
+      </LoadingButton>
+
+      {testResult && (
+        <TextTip
+          className="!items-start [&>svg]:mt-0.5"
+          icon={testResult.success ? CheckCircle : AlertCircle}
+          color={testResult.success ? 'green' : 'red'}
+        >
+          {testResult.message}
+        </TextTip>
+      )}
+    </div>
+  );
+
+  async function handleTestConnection() {
+    if (!values.Username || !values.Password) {
+      setTestResult({
+        success: false,
+        message:
+          'Please fill in all required fields before testing the connection.',
+      });
+      return;
+    }
+
+    setTestResult(null);
+
+    const testPayload = {
+      Username: values.Username,
+      Password: values.Password,
+      Type: RegistryTypes.DOCKERHUB, // DockerHub registry type
+    };
+
+    pingMutation.mutate(testPayload, {
+      onSuccess(response) {
+        if (response.success) {
+          setTestResult({
+            success: true,
+            message:
+              response.message ||
+              'Registry connection successful! You can now save the registry.',
+          });
+          onTestSuccess();
+        } else {
+          setTestResult({
+            success: false,
+            message:
+              response.message ||
+              'Failed to connect to the registry. Please check your credentials.',
+          });
+        }
+      },
+      onError() {
+        setTestResult({
+          success: false,
+          message:
+            'Failed to test registry connection. Please try again later.',
+        });
+      },
+    });
+  }
+}
diff --git a/app/react/portainer/registries/CreateView/TestConnection/useCheckRegistryConnectionMutation.ts b/app/react/portainer/registries/CreateView/TestConnection/useCheckRegistryConnectionMutation.ts
new file mode 100644
index 0000000..9c7111b
--- /dev/null
+++ b/app/react/portainer/registries/CreateView/TestConnection/useCheckRegistryConnectionMutation.ts
@@ -0,0 +1,36 @@
+import { useMutation } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+interface RegistryPingPayload {
+  Username: string;
+  Password: string;
+  Type: number;
+  URL?: string;
+  TLS?: boolean;
+}
+
+interface RegistryPingResponse {
+  success: boolean;
+  message: string;
+}
+
+async function pingRegistry(
+  payload: RegistryPingPayload
+): Promise<RegistryPingResponse> {
+  try {
+    const { data } = await axios.post<RegistryPingResponse>(
+      '/registries/ping',
+      payload
+    );
+    return data;
+  } catch (error) {
+    throw parseAxiosError(error as Error);
+  }
+}
+
+export function useCheckRegistryConnectionMutation() {
+  return useMutation({
+    mutationFn: pingRegistry,
+  });
+}
diff --git a/app/react/portainer/registries/CreateView/options.tsx b/app/react/portainer/registries/CreateView/options.tsx
new file mode 100644
index 0000000..984eaa8
--- /dev/null
+++ b/app/react/portainer/registries/CreateView/options.tsx
@@ -0,0 +1,56 @@
+import { BadgeIcon } from '@@/BadgeIcon';
+
+import { RegistryTypes } from '../types/registry';
+import { registryIconMap, registryLabelMap } from '../utils/constants';
+
+export const options = [
+  {
+    id: 'registry_dockerhub',
+    icon: registryIconMap[RegistryTypes.DOCKERHUB],
+    label: registryLabelMap[RegistryTypes.DOCKERHUB],
+    description: 'DockerHub authenticated account',
+    value: String(RegistryTypes.DOCKERHUB),
+  },
+  {
+    id: 'registry_aws_ecr',
+    icon: registryIconMap[RegistryTypes.ECR],
+    label: registryLabelMap[RegistryTypes.ECR],
+    description: 'Amazon elastic container registry',
+    value: String(RegistryTypes.ECR),
+  },
+  {
+    id: 'registry_quay',
+    icon: registryIconMap[RegistryTypes.QUAY],
+    label: registryLabelMap[RegistryTypes.QUAY],
+    description: 'Quay container registry',
+    value: String(RegistryTypes.QUAY),
+  },
+  {
+    id: 'registry_proget',
+    icon: registryIconMap[RegistryTypes.PROGET],
+    label: registryLabelMap[RegistryTypes.PROGET],
+    description: 'ProGet container registry',
+    value: String(RegistryTypes.PROGET),
+  },
+  {
+    id: 'registry_azure',
+    icon: registryIconMap[RegistryTypes.AZURE],
+    label: registryLabelMap[RegistryTypes.AZURE],
+    description: 'Azure container registry',
+    value: String(RegistryTypes.AZURE),
+  },
+  {
+    id: 'registry_gitlab',
+    icon: registryIconMap[RegistryTypes.GITLAB],
+    label: registryLabelMap[RegistryTypes.GITLAB],
+    description: 'GitLab container registry',
+    value: String(RegistryTypes.GITLAB),
+  },
+  {
+    id: 'registry_custom',
+    icon: <BadgeIcon icon={registryIconMap[RegistryTypes.CUSTOM]} />,
+    label: registryLabelMap[RegistryTypes.CUSTOM],
+    description: 'Define your own registry',
+    value: String(RegistryTypes.CUSTOM),
+  },
+];
diff --git a/app/react/portainer/registries/ItemView/.keep b/app/react/portainer/registries/ItemView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/portainer/registries/ListView/ListView.tsx b/app/react/portainer/registries/ListView/ListView.tsx
new file mode 100644
index 0000000..ec846a5
--- /dev/null
+++ b/app/react/portainer/registries/ListView/ListView.tsx
@@ -0,0 +1,25 @@
+import { PageHeader } from '@@/PageHeader';
+import { InformationPanel } from '@@/InformationPanel';
+
+import { RegistriesDatatable } from './RegistriesDatatable';
+
+export function ListView() {
+  return (
+    <>
+      <PageHeader title="Registries" breadcrumbs="Registry management" reload />
+
+      <div className="row">
+        <div className="col-sm-12">
+          <InformationPanel title="Information">
+            <span className="small text-muted">
+              View registries via an environment to manage access for user(s)
+              and/or team(s)
+            </span>
+          </InformationPanel>
+        </div>
+      </div>
+
+      <RegistriesDatatable />
+    </>
+  );
+}
diff --git a/app/react/portainer/registries/ListView/RegistriesDatatable/AddButton.tsx b/app/react/portainer/registries/ListView/RegistriesDatatable/AddButton.tsx
new file mode 100644
index 0000000..c561be2
--- /dev/null
+++ b/app/react/portainer/registries/ListView/RegistriesDatatable/AddButton.tsx
@@ -0,0 +1,16 @@
+import { Authorized } from '@/react/hooks/useUser';
+
+import { AddButton as BaseAddButton } from '@@/buttons';
+
+export function AddButton() {
+  return (
+    <Authorized authorizations="OperationPortainerRegistryCreate" adminOnlyCE>
+      <BaseAddButton
+        data-cy="registry-addRegistryButton"
+        to="portainer.registries.new"
+      >
+        Add registry
+      </BaseAddButton>
+    </Authorized>
+  );
+}
diff --git a/app/react/portainer/registries/ListView/RegistriesDatatable/DeleteButton.tsx b/app/react/portainer/registries/ListView/RegistriesDatatable/DeleteButton.tsx
new file mode 100644
index 0000000..8913813
--- /dev/null
+++ b/app/react/portainer/registries/ListView/RegistriesDatatable/DeleteButton.tsx
@@ -0,0 +1,40 @@
+import { pluralize } from '@/portainer/helpers/strings';
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { DeleteButton as BaseDeleteButton } from '@@/buttons/DeleteButton';
+
+import { Registry } from '../../types/registry';
+
+import { useDeleteRegistriesMutation } from './useDeleteRegistriesMutation';
+
+export function DeleteButton({ selectedItems }: { selectedItems: Registry[] }) {
+  const mutation = useDeleteRegistriesMutation();
+
+  const confirmMessage = getMessage(selectedItems.length);
+
+  return (
+    <BaseDeleteButton
+      data-cy="registry-removeRegistryButton"
+      disabled={selectedItems.length === 0}
+      confirmMessage={confirmMessage}
+      onConfirmed={handleDelete}
+    />
+  );
+
+  function handleDelete() {
+    mutation.mutate(
+      selectedItems.map((item) => item.Id),
+      {
+        onSuccess() {
+          notifySuccess('Success', 'Registries removed');
+        },
+      }
+    );
+  }
+}
+
+function getMessage(selectedCount: number) {
+  const regAttrMsg = selectedCount > 1 ? 'hese' : 'his';
+  const registriesMsg = pluralize(selectedCount, 'registry', 'registries');
+  return `T${regAttrMsg} ${registriesMsg} might be used by applications inside one or more environments. Removing the ${registriesMsg} could lead to a service interruption for the applications using t${regAttrMsg} ${registriesMsg}. Do you want to remove the selected ${registriesMsg}?`;
+}
diff --git a/app/react/portainer/registries/ListView/RegistriesDatatable/RegistriesDatatable.tsx b/app/react/portainer/registries/ListView/RegistriesDatatable/RegistriesDatatable.tsx
new file mode 100644
index 0000000..46616b7
--- /dev/null
+++ b/app/react/portainer/registries/ListView/RegistriesDatatable/RegistriesDatatable.tsx
@@ -0,0 +1,41 @@
+import { Radio } from 'lucide-react';
+
+import { Datatable } from '@@/datatables';
+import { createPersistedStore } from '@@/datatables/types';
+import { useTableState } from '@@/datatables/useTableState';
+
+import { useRegistries } from '../../queries/useRegistries';
+
+import { columns } from './columns';
+import { DeleteButton } from './DeleteButton';
+import { AddButton } from './AddButton';
+
+const tableKey = 'registries';
+
+const store = createPersistedStore(tableKey);
+
+export function RegistriesDatatable() {
+  const query = useRegistries();
+
+  const tableState = useTableState(store, tableKey);
+
+  return (
+    <Datatable
+      columns={columns}
+      dataset={query.data || []}
+      isLoading={query.isLoading}
+      settingsManager={tableState}
+      title="Registries"
+      titleIcon={Radio}
+      renderTableActions={(selectedItems) => (
+        <>
+          <DeleteButton selectedItems={selectedItems} />
+
+          <AddButton />
+        </>
+      )}
+      isRowSelectable={(row) => !!row.original.Id}
+      data-cy="registries-datatable"
+    />
+  );
+}
diff --git a/app/react/portainer/registries/ListView/RegistriesDatatable/columns/DefaultRegistryAction.tsx b/app/react/portainer/registries/ListView/RegistriesDatatable/columns/DefaultRegistryAction.tsx
new file mode 100644
index 0000000..1a75e9f
--- /dev/null
+++ b/app/react/portainer/registries/ListView/RegistriesDatatable/columns/DefaultRegistryAction.tsx
@@ -0,0 +1,82 @@
+import { Eye, EyeOff } from 'lucide-react';
+
+import { notifySuccess } from '@/portainer/services/notifications';
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+import { isLimitedToBE } from '@/react/portainer/feature-flags/feature-flags.service';
+import {
+  usePublicSettings,
+  useUpdateDefaultRegistrySettingsMutation,
+} from '@/react/portainer/settings/queries';
+
+import { Tooltip } from '@@/Tip/Tooltip';
+import { Button } from '@@/buttons';
+import { BEFeatureIndicator } from '@@/BEFeatureIndicator';
+
+export function DefaultRegistryAction() {
+  const settingsQuery = usePublicSettings({
+    select: (settings) => settings.DefaultRegistry?.Hide,
+  });
+  const defaultRegistryMutation = useUpdateDefaultRegistrySettingsMutation();
+
+  if (!settingsQuery.isSuccess) {
+    return null;
+  }
+  const hideDefaultRegistry = settingsQuery.data;
+
+  const isLimited = isLimitedToBE(FeatureId.HIDE_DOCKER_HUB_ANONYMOUS);
+
+  return (
+    <>
+      {!hideDefaultRegistry ? (
+        <div className="vertical-center">
+          <Button
+            color="danger"
+            data-cy="hide-default-registry-button"
+            icon={EyeOff}
+            onClick={() => handleShowOrHide(true)}
+            disabled={isLimited}
+          >
+            Hide for all users
+          </Button>
+          <BEFeatureIndicator featureId={FeatureId.HIDE_DOCKER_HUB_ANONYMOUS} />
+          {isLimited && (
+            <Tooltip
+              message="This hides the option in any registry dropdown prompts but does not prevent a user from deploying anonymously from Docker Hub directly via YAML.
+            Note: Docker Hub (anonymous) will continue to show as the ONLY option if there are NO other registries available to the user."
+            />
+          )}
+        </div>
+      ) : (
+        <div className="vertical-center">
+          <Button
+            data-cy="show-default-registry-button"
+            icon={Eye}
+            onClick={() => handleShowOrHide(false)}
+          >
+            Show for all users
+          </Button>
+          <Tooltip
+            message="This reveals the option in any registry dropdown prompts.
+                    (but note that the Docker Hub (anonymous) option only shows if there is no credentialled Docker Hub option available to the user)."
+          />
+        </div>
+      )}
+    </>
+  );
+
+  function handleShowOrHide(hideDefaultRegistry: boolean) {
+    defaultRegistryMutation.mutate(
+      {
+        Hide: hideDefaultRegistry,
+      },
+      {
+        onSuccess() {
+          notifySuccess(
+            'Success',
+            'Default registry Settings updated successfully'
+          );
+        },
+      }
+    );
+  }
+}
diff --git a/app/react/portainer/registries/ListView/RegistriesDatatable/columns/DefaultRegistryDomain.tsx b/app/react/portainer/registries/ListView/RegistriesDatatable/columns/DefaultRegistryDomain.tsx
new file mode 100644
index 0000000..55510ee
--- /dev/null
+++ b/app/react/portainer/registries/ListView/RegistriesDatatable/columns/DefaultRegistryDomain.tsx
@@ -0,0 +1,19 @@
+import clsx from 'clsx';
+
+import { usePublicSettings } from '@/react/portainer/settings/queries';
+
+export function DefaultRegistryDomain() {
+  const settingsQuery = usePublicSettings({
+    select: (settings) => settings.DefaultRegistry?.Hide,
+  });
+
+  return (
+    <span
+      className={clsx({
+        'cm-strikethrough': settingsQuery.isSuccess && settingsQuery.data,
+      })}
+    >
+      docker.io
+    </span>
+  );
+}
diff --git a/app/react/portainer/registries/ListView/RegistriesDatatable/columns/DefaultRegistryName.tsx b/app/react/portainer/registries/ListView/RegistriesDatatable/columns/DefaultRegistryName.tsx
new file mode 100644
index 0000000..8e75122
--- /dev/null
+++ b/app/react/portainer/registries/ListView/RegistriesDatatable/columns/DefaultRegistryName.tsx
@@ -0,0 +1,19 @@
+import clsx from 'clsx';
+
+import { usePublicSettings } from '@/react/portainer/settings/queries';
+
+export function DefaultRegistryName() {
+  const settingsQuery = usePublicSettings({
+    select: (settings) => settings.DefaultRegistry?.Hide,
+  });
+
+  return (
+    <span
+      className={clsx({
+        'cm-strikethrough': settingsQuery.isSuccess && settingsQuery.data,
+      })}
+    >
+      Docker Hub (anonymous)
+    </span>
+  );
+}
diff --git a/app/react/portainer/registries/ListView/RegistriesDatatable/columns/actions.tsx b/app/react/portainer/registries/ListView/RegistriesDatatable/columns/actions.tsx
new file mode 100644
index 0000000..da26992
--- /dev/null
+++ b/app/react/portainer/registries/ListView/RegistriesDatatable/columns/actions.tsx
@@ -0,0 +1,70 @@
+import { CellContext } from '@tanstack/react-table';
+import { Search } from 'lucide-react';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+
+import { Link } from '@@/Link';
+import { Button } from '@@/buttons';
+import { BEFeatureIndicator } from '@@/BEFeatureIndicator';
+
+import { DecoratedRegistry } from '../types';
+import { RegistryTypes } from '../../../types/registry';
+
+import { columnHelper } from './helper';
+import { DefaultRegistryAction } from './DefaultRegistryAction';
+
+export const actions = columnHelper.display({
+  header: 'Actions',
+  cell: Cell,
+});
+
+const nonBrowsableTypes = [
+  RegistryTypes.ANONYMOUS,
+  RegistryTypes.DOCKERHUB,
+  RegistryTypes.QUAY,
+];
+
+function Cell({
+  row: { original: item },
+}: CellContext<DecoratedRegistry, unknown>) {
+  if (!item.Id) {
+    return <DefaultRegistryAction />;
+  }
+
+  return <BrowseButton registry={item} />;
+}
+
+export function BrowseButton({
+  registry,
+  environmentId,
+}: {
+  registry: DecoratedRegistry;
+  environmentId?: EnvironmentId;
+}) {
+  const canBrowse = !nonBrowsableTypes.includes(registry.Type);
+
+  if (!canBrowse) {
+    return null;
+  }
+
+  return (
+    <BEFeatureIndicator featureId={FeatureId.REGISTRY_MANAGEMENT}>
+      {(isLimited) => (
+        <Button
+          color="link"
+          as={Link}
+          props={{
+            to: 'portainer.registries.registry.repositories',
+            params: { id: registry.Id, endpointId: environmentId },
+          }}
+          disabled={isLimited}
+          icon={Search}
+          data-cy={`browse-registry-button-${registry.Name}`}
+        >
+          Browse
+        </Button>
+      )}
+    </BEFeatureIndicator>
+  );
+}
diff --git a/app/react/portainer/registries/ListView/RegistriesDatatable/columns/helper.ts b/app/react/portainer/registries/ListView/RegistriesDatatable/columns/helper.ts
new file mode 100644
index 0000000..705dd56
--- /dev/null
+++ b/app/react/portainer/registries/ListView/RegistriesDatatable/columns/helper.ts
@@ -0,0 +1,5 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { DecoratedRegistry } from '../types';
+
+export const columnHelper = createColumnHelper<DecoratedRegistry>();
diff --git a/app/react/portainer/registries/ListView/RegistriesDatatable/columns/index.ts b/app/react/portainer/registries/ListView/RegistriesDatatable/columns/index.ts
new file mode 100644
index 0000000..e910638
--- /dev/null
+++ b/app/react/portainer/registries/ListView/RegistriesDatatable/columns/index.ts
@@ -0,0 +1,5 @@
+import { actions } from './actions';
+import { name } from './name';
+import { url } from './url';
+
+export const columns = [name, url, actions];
diff --git a/app/react/portainer/registries/ListView/RegistriesDatatable/columns/name.tsx b/app/react/portainer/registries/ListView/RegistriesDatatable/columns/name.tsx
new file mode 100644
index 0000000..4db6bbd
--- /dev/null
+++ b/app/react/portainer/registries/ListView/RegistriesDatatable/columns/name.tsx
@@ -0,0 +1,56 @@
+import { CellContext } from '@tanstack/react-table';
+
+import { useIsEdgeAdmin } from '@/react/hooks/useUser';
+
+import { Link } from '@@/Link';
+
+import { DecoratedRegistry } from '../types';
+
+import { columnHelper } from './helper';
+import { DefaultRegistryName } from './DefaultRegistryName';
+
+export const name = columnHelper.accessor('Name', {
+  header: 'Name',
+  cell: Cell,
+});
+
+function Cell({
+  row: { original: item },
+}: CellContext<DecoratedRegistry, string>) {
+  return <NameCell item={item} hasLink />;
+}
+
+export function NameCell({
+  item,
+  hasLink,
+}: {
+  item: DecoratedRegistry;
+  hasLink?: boolean;
+}) {
+  const isEdgeAdminQuery = useIsEdgeAdmin();
+
+  if (!item.Id) {
+    return <DefaultRegistryName />;
+  }
+
+  return (
+    <>
+      {isEdgeAdminQuery.isAdmin && hasLink ? (
+        <Link
+          to="portainer.registries.registry"
+          params={{ id: item.Id }}
+          data-cy={`registry-link-${item.Name}`}
+        >
+          {item.Name}
+        </Link>
+      ) : (
+        item.Name
+      )}
+      {item.Authentication && (
+        <span className="label label-info image-tag ml-2">
+          authentication-enabled
+        </span>
+      )}
+    </>
+  );
+}
diff --git a/app/react/portainer/registries/ListView/RegistriesDatatable/columns/url.tsx b/app/react/portainer/registries/ListView/RegistriesDatatable/columns/url.tsx
new file mode 100644
index 0000000..e09731d
--- /dev/null
+++ b/app/react/portainer/registries/ListView/RegistriesDatatable/columns/url.tsx
@@ -0,0 +1,8 @@
+import { DefaultRegistryDomain } from './DefaultRegistryDomain';
+import { columnHelper } from './helper';
+
+export const url = columnHelper.accessor('URL', {
+  header: 'URL',
+  cell: ({ getValue, row: { original: item } }) =>
+    item.Id ? getValue() : <DefaultRegistryDomain />,
+});
diff --git a/app/react/portainer/registries/ListView/RegistriesDatatable/index.ts b/app/react/portainer/registries/ListView/RegistriesDatatable/index.ts
new file mode 100644
index 0000000..a811803
--- /dev/null
+++ b/app/react/portainer/registries/ListView/RegistriesDatatable/index.ts
@@ -0,0 +1 @@
+export { RegistriesDatatable } from './RegistriesDatatable';
diff --git a/app/react/portainer/registries/ListView/RegistriesDatatable/types.ts b/app/react/portainer/registries/ListView/RegistriesDatatable/types.ts
new file mode 100644
index 0000000..d90a2c3
--- /dev/null
+++ b/app/react/portainer/registries/ListView/RegistriesDatatable/types.ts
@@ -0,0 +1,4 @@
+import { Registry } from '../../types/registry';
+
+// eslint-disable-next-line @typescript-eslint/no-empty-object-type
+export interface DecoratedRegistry extends Registry {}
diff --git a/app/react/portainer/registries/ListView/RegistriesDatatable/useDeleteRegistriesMutation.ts b/app/react/portainer/registries/ListView/RegistriesDatatable/useDeleteRegistriesMutation.ts
new file mode 100644
index 0000000..2bef446
--- /dev/null
+++ b/app/react/portainer/registries/ListView/RegistriesDatatable/useDeleteRegistriesMutation.ts
@@ -0,0 +1,35 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { promiseSequence } from '@/portainer/helpers/promise-utils';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import {
+  mutationOptions,
+  withError,
+  withInvalidate,
+} from '@/react-tools/react-query';
+
+import { buildUrl } from '../../queries/build-url';
+import { queryKeys } from '../../queries/query-keys';
+import { Registry } from '../../types/registry';
+
+export function useDeleteRegistriesMutation() {
+  const queryClient = useQueryClient();
+  return useMutation(
+    (RegistryIds: Array<Registry['Id']>) =>
+      promiseSequence(
+        RegistryIds.map((RegistryId) => () => deleteRegistry(RegistryId))
+      ),
+    mutationOptions(
+      withError('Unable to delete registries'),
+      withInvalidate(queryClient, [queryKeys.base()])
+    )
+  );
+}
+
+async function deleteRegistry(id: Registry['Id']) {
+  try {
+    await axios.delete(buildUrl(id));
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to delete registries');
+  }
+}
diff --git a/app/react/portainer/registries/ListView/index.ts b/app/react/portainer/registries/ListView/index.ts
new file mode 100644
index 0000000..dd06dfd
--- /dev/null
+++ b/app/react/portainer/registries/ListView/index.ts
@@ -0,0 +1 @@
+export { ListView } from './ListView';
diff --git a/app/react/portainer/registries/environments/ListView/EnvironmentRegistriesDatatable/EnvironmentRegistriesDatatable.tsx b/app/react/portainer/registries/environments/ListView/EnvironmentRegistriesDatatable/EnvironmentRegistriesDatatable.tsx
new file mode 100644
index 0000000..b01451d
--- /dev/null
+++ b/app/react/portainer/registries/environments/ListView/EnvironmentRegistriesDatatable/EnvironmentRegistriesDatatable.tsx
@@ -0,0 +1,40 @@
+import { Radio } from 'lucide-react';
+
+import { useEnvironmentRegistries } from '@/react/portainer/environments/queries/useEnvironmentRegistries';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { url } from '@/react/portainer/registries/ListView/RegistriesDatatable/columns/url';
+import { AddButton } from '@/react/portainer/registries/ListView/RegistriesDatatable/AddButton';
+
+import { Datatable } from '@@/datatables';
+import { createPersistedStore } from '@@/datatables/types';
+import { useTableState } from '@@/datatables/useTableState';
+
+import { name } from './columns/name';
+import { actions } from './columns/actions';
+
+const columns = [name, url, actions];
+
+const tableKey = 'registries';
+
+const store = createPersistedStore(tableKey);
+
+export function EnvironmentRegistriesDatatable() {
+  const environmentId = useEnvironmentId();
+  const query = useEnvironmentRegistries(environmentId);
+
+  const tableState = useTableState(store, tableKey);
+
+  return (
+    <Datatable
+      columns={columns}
+      dataset={query.data || []}
+      isLoading={query.isLoading}
+      settingsManager={tableState}
+      title="Registries"
+      titleIcon={Radio}
+      renderTableActions={() => <AddButton />}
+      disableSelect
+      data-cy="environment-registries-datatable"
+    />
+  );
+}
diff --git a/app/react/portainer/registries/environments/ListView/EnvironmentRegistriesDatatable/columns/actions.tsx b/app/react/portainer/registries/environments/ListView/EnvironmentRegistriesDatatable/columns/actions.tsx
new file mode 100644
index 0000000..b4562d5
--- /dev/null
+++ b/app/react/portainer/registries/environments/ListView/EnvironmentRegistriesDatatable/columns/actions.tsx
@@ -0,0 +1,56 @@
+import { CellContext } from '@tanstack/react-table';
+import { Users } from 'lucide-react';
+
+import { Authorized, useAuthorizations } from '@/react/hooks/useUser';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { DecoratedRegistry } from '@/react/portainer/registries/ListView/RegistriesDatatable/types';
+import { RegistryTypes } from '@/react/portainer/registries/types/registry';
+import { columnHelper } from '@/react/portainer/registries/ListView/RegistriesDatatable/columns/helper';
+import { BrowseButton } from '@/react/portainer/registries/ListView/RegistriesDatatable/columns/actions';
+
+import { Button } from '@@/buttons';
+import { Link } from '@@/Link';
+
+export const actions = columnHelper.display({
+  header: 'Actions',
+  cell: Cell,
+});
+
+function Cell({
+  row: { original: item },
+}: CellContext<DecoratedRegistry, unknown>) {
+  const environmentId = useEnvironmentId();
+  const hasUpdateAccessAuthorizations = useAuthorizations(
+    ['PortainerRegistryUpdateAccess'],
+    environmentId,
+    true
+  );
+  const canManageAccess =
+    item.Type !== RegistryTypes.ANONYMOUS && hasUpdateAccessAuthorizations;
+
+  if (!item.Id) {
+    return null;
+  }
+
+  return (
+    <>
+      {canManageAccess && (
+        <Authorized authorizations="PortainerRegistryUpdateAccess">
+          <Button
+            color="link"
+            icon={Users}
+            as={Link}
+            props={{
+              to: '.access',
+              params: { id: item.Id },
+            }}
+            data-cy={`registry-manage-access-button-${item.Name}`}
+          >
+            Manage access
+          </Button>
+        </Authorized>
+      )}
+      <BrowseButton registry={item} environmentId={environmentId} />
+    </>
+  );
+}
diff --git a/app/react/portainer/registries/environments/ListView/EnvironmentRegistriesDatatable/columns/name.tsx b/app/react/portainer/registries/environments/ListView/EnvironmentRegistriesDatatable/columns/name.tsx
new file mode 100644
index 0000000..74c0a98
--- /dev/null
+++ b/app/react/portainer/registries/environments/ListView/EnvironmentRegistriesDatatable/columns/name.tsx
@@ -0,0 +1,16 @@
+import { CellContext } from '@tanstack/react-table';
+
+import { DecoratedRegistry } from '@/react/portainer/registries/ListView/RegistriesDatatable/types';
+import { columnHelper } from '@/react/portainer/registries/ListView/RegistriesDatatable/columns/helper';
+import { NameCell } from '@/react/portainer/registries/ListView/RegistriesDatatable/columns/name';
+
+export const name = columnHelper.accessor('Name', {
+  header: 'Name',
+  cell: Cell,
+});
+
+function Cell({
+  row: { original: item },
+}: CellContext<DecoratedRegistry, string>) {
+  return <NameCell item={item} />;
+}
diff --git a/app/react/portainer/registries/environments/ListView/EnvironmentRegistriesDatatable/index.ts b/app/react/portainer/registries/environments/ListView/EnvironmentRegistriesDatatable/index.ts
new file mode 100644
index 0000000..1fdecc6
--- /dev/null
+++ b/app/react/portainer/registries/environments/ListView/EnvironmentRegistriesDatatable/index.ts
@@ -0,0 +1 @@
+export { EnvironmentRegistriesDatatable } from './EnvironmentRegistriesDatatable';
diff --git a/app/react/portainer/registries/environments/ListView/ListView.tsx b/app/react/portainer/registries/environments/ListView/ListView.tsx
new file mode 100644
index 0000000..1847fb1
--- /dev/null
+++ b/app/react/portainer/registries/environments/ListView/ListView.tsx
@@ -0,0 +1,17 @@
+import { PageHeader } from '@@/PageHeader';
+
+import { EnvironmentRegistriesDatatable } from './EnvironmentRegistriesDatatable';
+
+export function ListView() {
+  return (
+    <>
+      <PageHeader
+        title="Environment registries"
+        breadcrumbs="Registry management"
+        reload
+      />
+
+      <EnvironmentRegistriesDatatable />
+    </>
+  );
+}
diff --git a/app/react/portainer/registries/environments/ListView/index.ts b/app/react/portainer/registries/environments/ListView/index.ts
new file mode 100644
index 0000000..dd06dfd
--- /dev/null
+++ b/app/react/portainer/registries/environments/ListView/index.ts
@@ -0,0 +1 @@
+export { ListView } from './ListView';
diff --git a/app/react/portainer/registries/queries/build-url.ts b/app/react/portainer/registries/queries/build-url.ts
new file mode 100644
index 0000000..f490ec4
--- /dev/null
+++ b/app/react/portainer/registries/queries/build-url.ts
@@ -0,0 +1,19 @@
+import { RegistryId } from '../types/registry';
+
+export function buildUrl(registryId: RegistryId, resource?: 'repositories') {
+  let url = '/registries';
+
+  if (registryId) {
+    url += `/${registryId}`;
+  }
+
+  if (resource) {
+    url += `/${resource}`;
+  }
+
+  return url;
+}
+
+export function buildProxyUrl(registryId: RegistryId) {
+  return `${buildUrl(registryId)}/v2`;
+}
diff --git a/app/react/portainer/registries/queries/query-keys.ts b/app/react/portainer/registries/queries/query-keys.ts
new file mode 100644
index 0000000..625ca05
--- /dev/null
+++ b/app/react/portainer/registries/queries/query-keys.ts
@@ -0,0 +1,9 @@
+import { EnvironmentId } from '../../environments/types';
+import { RegistryId } from '../types/registry';
+
+export const queryKeys = {
+  base: () => ['registries'] as const,
+  list: (environmentId?: EnvironmentId) =>
+    [...queryKeys.base(), { environmentId }] as const,
+  item: (registryId: RegistryId) => [...queryKeys.base(), registryId] as const,
+};
diff --git a/app/react/portainer/registries/queries/useRegistries.ts b/app/react/portainer/registries/queries/useRegistries.ts
new file mode 100644
index 0000000..01fb6fb
--- /dev/null
+++ b/app/react/portainer/registries/queries/useRegistries.ts
@@ -0,0 +1,91 @@
+import { QueryKey, useQuery } from '@tanstack/react-query';
+
+import { withError } from '@/react-tools/react-query';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { Registry, RegistryTypes } from '../types/registry';
+import { usePublicSettings } from '../../settings/queries';
+
+import { queryKeys } from './query-keys';
+
+/** ADMIN-ONLY QUERY. Will get an access denied error for non-admin users. */
+export function useRegistries<T = Registry[]>(
+  queryOptions: GenericRegistriesQueryOptions<T> = {}
+) {
+  return useGenericRegistriesQuery(
+    queryKeys.base(),
+    getRegistries,
+    queryOptions
+  );
+}
+
+export type GenericRegistriesQueryOptions<T> = {
+  enabled?: boolean;
+  select?: (registries: Registry[]) => T;
+  onSuccess?: (data: T) => void;
+  /** is used to hide the default registry from the list of registries, regardless of the user's settings. Kubernetes views use this. */
+  hideDefault?: boolean;
+  /** is used to filter the registries by namespace. Kubernetes views use this. */
+  namespace?: string;
+  /** showError */
+  showError?: boolean;
+};
+
+export function useGenericRegistriesQuery<T = Registry[]>(
+  queryKey: QueryKey,
+  fetcher: () => Promise<Array<Registry>>,
+  {
+    enabled,
+    select,
+    onSuccess,
+    hideDefault: hideDefaultOverride,
+    showError = true,
+  }: GenericRegistriesQueryOptions<T> = {}
+) {
+  const hideDefaultRegistryQuery = usePublicSettings({
+    select: (settings) => settings.DefaultRegistry?.Hide,
+    // We don't need the hideDefaultRegistry info if we're overriding it to true
+    enabled: enabled && !hideDefaultOverride,
+  });
+
+  const hideDefault = hideDefaultOverride || !!hideDefaultRegistryQuery.data;
+
+  return useQuery(
+    queryKey,
+    async () => {
+      const registries = await fetcher();
+
+      if (
+        hideDefault ||
+        registries.some((r) => r.Type === RegistryTypes.DOCKERHUB)
+      ) {
+        return registries;
+      }
+
+      return [
+        {
+          Name: 'Docker Hub (anonymous)',
+          Id: 0,
+          Type: RegistryTypes.DOCKERHUB,
+        } as Registry,
+        ...registries,
+      ];
+    },
+    {
+      select,
+      ...(showError && withError('Unable to retrieve registries')),
+      enabled:
+        (hideDefaultOverride || hideDefaultRegistryQuery.isSuccess) && enabled,
+      onSuccess,
+    }
+  );
+}
+
+export async function getRegistries() {
+  try {
+    const { data } = await axios.get<Registry[]>('/registries');
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e as Error, 'Unable to retrieve registries');
+  }
+}
diff --git a/app/react/portainer/registries/queries/useRegistry.ts b/app/react/portainer/registries/queries/useRegistry.ts
new file mode 100644
index 0000000..96e9f0b
--- /dev/null
+++ b/app/react/portainer/registries/queries/useRegistry.ts
@@ -0,0 +1,40 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { withError } from '@/react-tools/react-query';
+
+import { Registry } from '../types/registry';
+
+import { buildUrl } from './build-url';
+import { queryKeys } from './query-keys';
+
+export function useRegistry(
+  registryId?: Registry['Id'],
+  shouldShowError: boolean = true
+) {
+  const environmentId = useEnvironmentId();
+
+  return useQuery(
+    registryId ? queryKeys.item(registryId) : [],
+    () => (registryId ? getRegistry(registryId, environmentId) : undefined),
+    {
+      enabled: !!registryId,
+      retry: 1,
+      ...(shouldShowError ? withError('Unable to load registry details') : {}),
+    }
+  );
+}
+
+async function getRegistry(registryId: Registry['Id'], environmentId: number) {
+  try {
+    const { data } = await axios.get<Registry>(buildUrl(registryId), {
+      params: {
+        endpointId: environmentId,
+      },
+    });
+    return data;
+  } catch (err) {
+    throw parseAxiosError(err as Error, 'Unable to retrieve registry');
+  }
+}
diff --git a/app/react/portainer/registries/registry.service.ts b/app/react/portainer/registries/registry.service.ts
new file mode 100644
index 0000000..5043b24
--- /dev/null
+++ b/app/react/portainer/registries/registry.service.ts
@@ -0,0 +1,14 @@
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { Catalog } from './types/registry';
+
+export async function listRegistryCatalogs(registryId: number) {
+  try {
+    const { data } = await axios.get<Catalog>(
+      `/registries/${registryId}/v2/_catalog`
+    );
+    return data;
+  } catch (err) {
+    throw parseAxiosError(err as Error, 'Failed to get catalog of registry');
+  }
+}
diff --git a/app/react/portainer/registries/repositories/.keep b/app/react/portainer/registries/repositories/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/portainer/registries/repositories/ItemView/.keep b/app/react/portainer/registries/repositories/ItemView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/portainer/registries/repositories/ItemView/TagsDatatable/TagsDatatable.test.tsx b/app/react/portainer/registries/repositories/ItemView/TagsDatatable/TagsDatatable.test.tsx
new file mode 100644
index 0000000..6ec8599
--- /dev/null
+++ b/app/react/portainer/registries/repositories/ItemView/TagsDatatable/TagsDatatable.test.tsx
@@ -0,0 +1,169 @@
+import { render, screen } from '@testing-library/react';
+import { vi } from 'vitest';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+
+import { TagsDatatable } from './TagsDatatable';
+import { Tag } from './types';
+import { RepositoryTagViewModel } from './view-model';
+
+// Mock the necessary hooks
+const mockUseCurrentStateAndParams = vi.fn();
+
+vi.mock('@uirouter/react', async (importOriginal: () => Promise<object>) => ({
+  ...(await importOriginal()),
+  useCurrentStateAndParams: () => mockUseCurrentStateAndParams(),
+}));
+
+// Mock the Link component to capture route parameters and generate proper hrefs
+vi.mock('@@/Link', () => ({
+  Link: ({
+    children,
+    params,
+    'data-cy': dataCy,
+    title,
+  }: {
+    children: React.ReactNode;
+    params?: Record<string, string>;
+    'data-cy'?: string;
+    title?: string;
+  }) => {
+    // Simulate href generation based on route and params
+    // For 'portainer.registries.registry.repository.tag' route
+    const baseParams = {
+      endpointId: '1',
+      id: '1',
+      repository: 'test-repo',
+      ...params,
+    };
+
+    const tag = (baseParams as Record<string, string>).tag || '';
+    const href = `/endpoints/${baseParams.endpointId}/registries/${baseParams.id}/repositories/${baseParams.repository}/tags/${tag}`;
+
+    return (
+      <a href={href} data-cy={dataCy} title={title}>
+        {children}
+      </a>
+    );
+  },
+}));
+
+vi.mock('../../queries/useTagDetails', () => ({
+  useTagDetails: vi.fn(
+    (
+      params,
+      { select }: { select?: (data: RepositoryTagViewModel) => string } = {}
+    ) => {
+      const data: RepositoryTagViewModel = {
+        Name: params.tag,
+        Os: 'linux',
+        Architecture: 'amd64',
+        ImageId: `sha256:${params.tag}123`,
+        Size: 1024,
+        ImageDigest: '',
+        ManifestV2: {
+          digest: `sha256:${params.tag}123`,
+          schemaVersion: 2,
+          mediaType: 'application/vnd.docker.distribution.manifest.v2+json',
+          config: {
+            digest: `sha256:${params.tag}123`,
+            mediaType: 'application/vnd.docker.container.image.v1+json',
+            size: 1024,
+          },
+          layers: [],
+        },
+        History: [],
+      };
+
+      return {
+        data: select?.(data) || data,
+        isLoading: false,
+        error: null,
+      };
+    }
+  ),
+}));
+
+// Create mock data
+const mockTags: Tag[] = [
+  { Name: 'latest' },
+  { Name: 'v1.0.0' },
+  { Name: 'dev-branch' },
+  { Name: 'feature/new-ui' },
+];
+
+const defaultProps = {
+  dataset: mockTags,
+  advancedFeaturesAvailable: true,
+  onRemove: vi.fn(),
+  onRetag: vi.fn().mockResolvedValue(undefined),
+};
+
+function renderComponent() {
+  const Wrapped = withTestQueryProvider(
+    withTestRouter(() => <TagsDatatable {...defaultProps} />)
+  );
+  return render(<Wrapped />);
+}
+
+describe('TagsDatatable', () => {
+  beforeEach(() => {
+    // Set up default mock values
+    mockUseCurrentStateAndParams.mockReturnValue({
+      params: {
+        endpointId: '1',
+        id: '1',
+        repository: 'test-repo',
+      },
+    });
+  });
+
+  it('renders basic table structure', () => {
+    renderComponent();
+    expect(screen.getByText('Tags')).toBeInTheDocument();
+    expect(screen.getByPlaceholderText('Search...')).toBeInTheDocument();
+  });
+
+  it('renders tag data in table', () => {
+    renderComponent();
+
+    // Check that our mock tags are rendered somewhere in the table
+    expect(screen.getByText('latest')).toBeInTheDocument();
+    expect(screen.getByText('v1.0.0')).toBeInTheDocument();
+    expect(screen.getByText('dev-branch')).toBeInTheDocument();
+    expect(screen.getByText('feature/new-ui')).toBeInTheDocument();
+  });
+
+  it('creates correct hrefs for tag name links', () => {
+    renderComponent();
+
+    // Get the links by their data-cy attributes
+    const latestLink = screen.getByTestId(
+      'registry-tag-name_latest'
+    ) as HTMLAnchorElement;
+    const v100Link = screen.getByTestId(
+      'registry-tag-name_v1.0.0'
+    ) as HTMLAnchorElement;
+    const devBranchLink = screen.getByTestId(
+      'registry-tag-name_dev-branch'
+    ) as HTMLAnchorElement;
+    const featureLink = screen.getByTestId(
+      'registry-tag-name_feature/new-ui'
+    ) as HTMLAnchorElement;
+
+    // Verify the exact path portion of the href
+    expect(new URL(latestLink.href).pathname).toBe(
+      '/endpoints/1/registries/1/repositories/test-repo/tags/latest'
+    );
+    expect(new URL(v100Link.href).pathname).toBe(
+      '/endpoints/1/registries/1/repositories/test-repo/tags/v1.0.0'
+    );
+    expect(new URL(devBranchLink.href).pathname).toBe(
+      '/endpoints/1/registries/1/repositories/test-repo/tags/dev-branch'
+    );
+    expect(new URL(featureLink.href).pathname).toBe(
+      '/endpoints/1/registries/1/repositories/test-repo/tags/feature/new-ui'
+    );
+  });
+});
diff --git a/app/react/portainer/registries/repositories/ItemView/TagsDatatable/TagsDatatable.tsx b/app/react/portainer/registries/repositories/ItemView/TagsDatatable/TagsDatatable.tsx
new file mode 100644
index 0000000..907890a
--- /dev/null
+++ b/app/react/portainer/registries/repositories/ItemView/TagsDatatable/TagsDatatable.tsx
@@ -0,0 +1,61 @@
+import { TagIcon } from 'lucide-react';
+import { useStore } from 'zustand';
+
+import { Datatable } from '@@/datatables';
+import { useTableStateWithStorage } from '@@/datatables/useTableState';
+import { DeleteButton } from '@@/buttons/DeleteButton';
+import { withMeta } from '@@/datatables/extend-options/withMeta';
+import { mergeOptions } from '@@/datatables/extend-options/mergeOptions';
+
+import { Tag } from './types';
+import { useColumns } from './columns/useColumns';
+import { newNamesStore } from './useRetagState';
+import { RepositoryTagViewModel } from './view-model';
+
+export function TagsDatatable({
+  dataset,
+  advancedFeaturesAvailable,
+  onRemove,
+  onRetag,
+}: {
+  dataset?: Tag[];
+  advancedFeaturesAvailable: boolean;
+  onRemove: (tags: Tag[]) => void;
+  onRetag: (tags: Record<string, RepositoryTagViewModel>) => Promise<void>;
+}) {
+  const updatesState = useStore(newNamesStore);
+
+  const tableState = useTableStateWithStorage('registryRepositoryTags', 'name');
+  const columns = useColumns(advancedFeaturesAvailable);
+
+  return (
+    <Datatable
+      title="Tags"
+      titleIcon={TagIcon}
+      columns={columns}
+      dataset={dataset || []}
+      isLoading={!dataset}
+      settingsManager={tableState}
+      renderTableActions={(selectedItems) =>
+        advancedFeaturesAvailable && (
+          <DeleteButton
+            confirmMessage="Are you sure you want to remove the selected tags?"
+            onConfirmed={() => onRemove(selectedItems)}
+            data-cy="remove-registry-tags-button"
+          />
+        )
+      }
+      getRowId={(tag) => tag.Name}
+      extendTableOptions={mergeOptions(
+        withMeta({
+          onUpdate: async () => {
+            await onRetag(updatesState.updates);
+            updatesState.clear();
+          },
+          table: 'registry-repository-tags',
+        })
+      )}
+      data-cy="registry-tags-datatable"
+    />
+  );
+}
diff --git a/app/react/portainer/registries/repositories/ItemView/TagsDatatable/columns/actions.tsx b/app/react/portainer/registries/repositories/ItemView/TagsDatatable/columns/actions.tsx
new file mode 100644
index 0000000..e8e10f6
--- /dev/null
+++ b/app/react/portainer/registries/repositories/ItemView/TagsDatatable/columns/actions.tsx
@@ -0,0 +1,126 @@
+import { CellContext } from '@tanstack/react-table';
+import { X, Check, TagIcon } from 'lucide-react';
+import { Form, Formik } from 'formik';
+import { useStore } from 'zustand';
+import { object, string } from 'yup';
+
+import { Button } from '@@/buttons';
+import { Tooltip } from '@@/Tip/Tooltip';
+import { Input } from '@@/form-components/Input';
+import { FormError } from '@@/form-components/FormError';
+
+import { Tag } from '../types';
+import { newNamesStore } from '../useRetagState';
+import { getTableMeta } from '../meta';
+
+import { helper } from './helper';
+import { useDetails } from './buildCell';
+
+export const actions = helper.display({
+  header: 'Actions',
+  cell: ActionsCell,
+});
+
+function ActionsCell({
+  table,
+  row: { original: item },
+}: CellContext<Tag, unknown>) {
+  const meta = getTableMeta(table.options.meta);
+  const detailsQuery = useDetails(item.Name);
+  const state = useStore(newNamesStore);
+
+  const isEdit = state.updates[item.Name] !== undefined;
+
+  if (!detailsQuery.data) {
+    return null;
+  }
+
+  const tagDetails = detailsQuery.data;
+
+  if (!isEdit) {
+    return (
+      <Button
+        color="link"
+        icon={TagIcon}
+        onClick={() => state.setName(item.Name, tagDetails)}
+        data-cy={`retag-${item.Name}`}
+      >
+        Retag
+      </Button>
+    );
+  }
+
+  return (
+    <EditTag
+      initialName={item.Name}
+      onCancel={() => state.setName(item.Name)}
+      onChange={(name) =>
+        state.setName(item.Name, {
+          ...tagDetails,
+          Name: name,
+        })
+      }
+      onSubmit={() => meta.onUpdate()}
+    />
+  );
+}
+
+const schema = object().shape({
+  name: string()
+    .required()
+    .matches(/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/),
+});
+
+function EditTag({
+  initialName,
+  onCancel,
+  onChange,
+  onSubmit,
+}: {
+  initialName: string;
+  onChange: (name: string) => void;
+  onCancel(): void;
+  onSubmit(): void;
+}) {
+  return (
+    <Formik
+      initialValues={{ name: initialName }}
+      onSubmit={onSubmit}
+      validationSchema={schema}
+    >
+      {({ values, errors, setFieldValue }) => (
+        <Form className="vertical-center">
+          <Tooltip message="'Tag can only contain alphanumeric (a-zA-Z0-9) and special _ . - characters. Tag must not start with . - characters.'" />
+
+          <Input
+            className="input-sm"
+            type="text"
+            value={values.name}
+            onChange={(e) => {
+              setFieldValue('name', e.target.value);
+              onChange(e.target.value);
+            }}
+            autoFocus
+            onClick={(e) => e.stopPropagation()}
+            data-cy={`retag-input-${initialName}`}
+          />
+
+          {errors.name && <FormError>{errors.name}</FormError>}
+
+          <Button
+            color="none"
+            icon={X}
+            onClick={onCancel}
+            data-cy={`retag-cancel-${initialName}`}
+          />
+          <Button
+            type="submit"
+            color="none"
+            icon={Check}
+            data-cy={`retag-submit-${initialName}`}
+          />
+        </Form>
+      )}
+    </Formik>
+  );
+}
diff --git a/app/react/portainer/registries/repositories/ItemView/TagsDatatable/columns/buildCell.tsx b/app/react/portainer/registries/repositories/ItemView/TagsDatatable/columns/buildCell.tsx
new file mode 100644
index 0000000..3f95164
--- /dev/null
+++ b/app/react/portainer/registries/repositories/ItemView/TagsDatatable/columns/buildCell.tsx
@@ -0,0 +1,57 @@
+import { CellContext } from '@tanstack/react-table';
+import { useCurrentStateAndParams } from '@uirouter/react';
+
+import { useTagDetails } from '../../../queries/useTagDetails';
+import { Tag } from '../types';
+import { RepositoryTagViewModel } from '../view-model';
+
+function useParams() {
+  const {
+    params: { endpointId, id, repository },
+  } = useCurrentStateAndParams();
+
+  const registryId = number(id);
+
+  if (!registryId) {
+    throw new Error('Missing registry id');
+  }
+
+  if (!repository || typeof repository !== 'string') {
+    throw new Error('Missing repository name');
+  }
+
+  return {
+    environmentId: number(endpointId),
+    registryId,
+    repository,
+  };
+}
+
+export function useDetails<T = RepositoryTagViewModel>(
+  tag: string,
+  select?: (data: RepositoryTagViewModel) => T
+) {
+  const params = useParams();
+  return useTagDetails(
+    {
+      tag,
+      ...params,
+    },
+    { staleTime: 60 * 1000, select }
+  );
+}
+
+export function buildCell<T = RepositoryTagViewModel>(
+  select: (data: RepositoryTagViewModel) => T
+) {
+  return function Cell({ row }: CellContext<Tag, unknown>) {
+    const detailsQuery = useDetails(row.original.Name, select);
+
+    return detailsQuery.data || '';
+  };
+}
+
+function number(value: string | undefined) {
+  const num = parseInt(value || '', 10);
+  return Number.isNaN(num) ? undefined : num;
+}
diff --git a/app/react/portainer/registries/repositories/ItemView/TagsDatatable/columns/helper.ts b/app/react/portainer/registries/repositories/ItemView/TagsDatatable/columns/helper.ts
new file mode 100644
index 0000000..b15e822
--- /dev/null
+++ b/app/react/portainer/registries/repositories/ItemView/TagsDatatable/columns/helper.ts
@@ -0,0 +1,5 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { Tag } from '../types';
+
+export const helper = createColumnHelper<Tag>();
diff --git a/app/react/portainer/registries/repositories/ItemView/TagsDatatable/columns/useColumns.ts b/app/react/portainer/registries/repositories/ItemView/TagsDatatable/columns/useColumns.ts
new file mode 100644
index 0000000..bcedccb
--- /dev/null
+++ b/app/react/portainer/registries/repositories/ItemView/TagsDatatable/columns/useColumns.ts
@@ -0,0 +1,42 @@
+import { useMemo } from 'react';
+import _ from 'lodash';
+
+import { humanize } from '@/portainer/filters/filters';
+import { trimSHA } from '@/docker/filters/utils';
+
+import { buildNameColumnFromObject } from '@@/datatables/buildNameColumn';
+
+import { Tag } from '../types';
+
+import { helper } from './helper';
+import { buildCell } from './buildCell';
+import { actions } from './actions';
+
+const columns = [
+  buildNameColumnFromObject<Tag>({
+    nameKey: 'Name',
+    path: 'portainer.registries.registry.repository.tag',
+    dataCy: 'registry-tag-name',
+    idParam: 'tag',
+    idGetter: (item) => item.Name,
+  }),
+  helper.display({
+    header: 'OS/Architecture',
+    cell: buildCell((model) => `${model.Os}/${model.Architecture}`),
+  }),
+  helper.display({
+    header: 'Image ID',
+    cell: buildCell((model) => trimSHA(model.ImageId)),
+  }),
+  helper.display({
+    header: 'Compressed Size',
+    cell: buildCell((model) => humanize(model.Size)),
+  }),
+];
+
+export function useColumns(advancedFeaturesAvailable: boolean) {
+  return useMemo(
+    () => _.compact([...columns, advancedFeaturesAvailable && actions]),
+    [advancedFeaturesAvailable]
+  );
+}
diff --git a/app/react/portainer/registries/repositories/ItemView/TagsDatatable/manifestsToTag.ts b/app/react/portainer/registries/repositories/ItemView/TagsDatatable/manifestsToTag.ts
new file mode 100644
index 0000000..786e99d
--- /dev/null
+++ b/app/react/portainer/registries/repositories/ItemView/TagsDatatable/manifestsToTag.ts
@@ -0,0 +1,74 @@
+import _ from 'lodash';
+
+import { ManifestV1, ManifestV2 } from '../../queries/manifest.service';
+import { ImageConfigs } from '../../queries/getRegistryBlobs';
+
+import { RepositoryTagViewModel } from './view-model';
+
+function parseV1History(history: { v1Compatibility: string }[]) {
+  return _.map(history, (item) => JSON.parse(item.v1Compatibility));
+}
+
+// convert image configs blob history to manifest v1 history
+function parseImageConfigsHistory(imageConfigs: ImageConfigs, v2: ManifestV2) {
+  return _.map(imageConfigs.history.reverse(), (item) => ({
+    ...item,
+    CreatedBy: item.created_by,
+    // below fields exist in manifest v1 history but not image configs blob
+    id: v2.config.digest,
+    created: imageConfigs.created,
+    docker_version: imageConfigs.docker_version,
+    os: imageConfigs.os,
+    architecture: imageConfigs.architecture,
+    config: imageConfigs.config,
+    container_config: imageConfigs.container_config,
+  }));
+}
+
+export function manifestsToTag({
+  v1,
+  v2,
+  imageConfigs,
+}: {
+  v1?: ManifestV1;
+  v2: ManifestV2 & { digest: string };
+  imageConfigs?: ImageConfigs;
+}) {
+  let history = [];
+  let name = '';
+  let os = '';
+  let arch = '';
+
+  if (imageConfigs) {
+    // use info from image configs blob when manifest v1 is not provided by registry
+    os = imageConfigs.os || '';
+    arch = imageConfigs.architecture || '';
+    history = parseImageConfigsHistory(imageConfigs, v2);
+  } else if (v1) {
+    // use info from manifest v1
+    history = parseV1History(v1.history);
+    name = v1.tag;
+    os = _.get(history, '[0].os', '');
+    arch = v1.architecture;
+  }
+
+  const size = v2.layers.reduce((size, b) => size + b.size, 0);
+
+  const imageId = v2.config.digest;
+
+  // v2.digest comes from
+  //  1. Docker-Content-Digest header from the v2 response, or
+  //  2. Calculated locally by sha256(v2-response-body)
+  const imageDigest = v2.digest;
+
+  return new RepositoryTagViewModel(
+    name,
+    os,
+    arch,
+    size,
+    imageDigest,
+    imageId,
+    v2,
+    history
+  );
+}
diff --git a/app/react/portainer/registries/repositories/ItemView/TagsDatatable/meta.ts b/app/react/portainer/registries/repositories/ItemView/TagsDatatable/meta.ts
new file mode 100644
index 0000000..674de45
--- /dev/null
+++ b/app/react/portainer/registries/repositories/ItemView/TagsDatatable/meta.ts
@@ -0,0 +1,21 @@
+interface TableMeta {
+  table: 'registry-repository-tags';
+  onUpdate(): void;
+}
+
+function isTableMeta(meta: unknown): meta is TableMeta {
+  return (
+    !!meta &&
+    typeof meta === 'object' &&
+    'table' in meta &&
+    meta.table === 'registry-repository-tags'
+  );
+}
+
+export function getTableMeta(meta: unknown): TableMeta {
+  if (!isTableMeta(meta)) {
+    throw new Error('Invalid table meta');
+  }
+
+  return meta;
+}
diff --git a/app/react/portainer/registries/repositories/ItemView/TagsDatatable/types.ts b/app/react/portainer/registries/repositories/ItemView/TagsDatatable/types.ts
new file mode 100644
index 0000000..310840d
--- /dev/null
+++ b/app/react/portainer/registries/repositories/ItemView/TagsDatatable/types.ts
@@ -0,0 +1,3 @@
+export interface Tag {
+  Name: string;
+}
diff --git a/app/react/portainer/registries/repositories/ItemView/TagsDatatable/useRetagState.ts b/app/react/portainer/registries/repositories/ItemView/TagsDatatable/useRetagState.ts
new file mode 100644
index 0000000..405478c
--- /dev/null
+++ b/app/react/portainer/registries/repositories/ItemView/TagsDatatable/useRetagState.ts
@@ -0,0 +1,33 @@
+import { createStore } from 'zustand';
+
+import { RepositoryTagViewModel } from './view-model';
+
+interface Store {
+  updates: Record<string, RepositoryTagViewModel>;
+  setName(originalName: string, value?: RepositoryTagViewModel): void;
+  count: number;
+  getUpdate(originalName: string): RepositoryTagViewModel | undefined;
+  clear(): void;
+}
+
+export const newNamesStore = createStore<Store>()((set, get) => ({
+  updates: {},
+  count: 0,
+  setName(originalName: string, value?: RepositoryTagViewModel) {
+    const { updates } = get();
+    if (typeof value === 'undefined') {
+      delete updates[originalName];
+    } else {
+      updates[originalName] = value;
+    }
+
+    set({ updates, count: Object.keys(updates).length });
+  },
+  getUpdate(originalName: string) {
+    const { updates } = get();
+    return updates[originalName];
+  },
+  clear() {
+    set({ updates: {}, count: 0 });
+  },
+}));
diff --git a/app/react/portainer/registries/repositories/ItemView/TagsDatatable/view-model.ts b/app/react/portainer/registries/repositories/ItemView/TagsDatatable/view-model.ts
new file mode 100644
index 0000000..943ed04
--- /dev/null
+++ b/app/react/portainer/registries/repositories/ItemView/TagsDatatable/view-model.ts
@@ -0,0 +1,41 @@
+import { ManifestV2 } from '../../queries/manifest.service';
+
+export class RepositoryTagViewModel {
+  Name: string;
+
+  Os: string;
+
+  Architecture: string;
+
+  Size: number;
+
+  ImageDigest: string;
+
+  ImageId: string;
+
+  ManifestV2: ManifestV2 & { digest: string };
+
+  History: unknown[];
+
+  constructor(
+    name: string,
+    os: string,
+    arch: string,
+    size: number,
+    imageDigest: string,
+    imageId: string,
+    v2: ManifestV2 & {
+      digest: string;
+    },
+    history: unknown[]
+  ) {
+    this.Name = name;
+    this.Os = os || '';
+    this.Architecture = arch || '';
+    this.Size = size || 0;
+    this.ImageDigest = imageDigest || '';
+    this.ImageId = imageId || '';
+    this.ManifestV2 = v2 || {};
+    this.History = history || [];
+  }
+}
diff --git a/app/react/portainer/registries/repositories/ListView/RepositoriesDatatable.tsx b/app/react/portainer/registries/repositories/ListView/RepositoriesDatatable.tsx
new file mode 100644
index 0000000..8357caa
--- /dev/null
+++ b/app/react/portainer/registries/repositories/ListView/RepositoriesDatatable.tsx
@@ -0,0 +1,23 @@
+import { Book } from 'lucide-react';
+
+import { Datatable } from '@@/datatables';
+import { useTableStateWithStorage } from '@@/datatables/useTableState';
+
+import { Repository } from './types';
+import { columns } from './columns';
+
+export function RepositoriesDatatable({ dataset }: { dataset?: Repository[] }) {
+  const tableState = useTableStateWithStorage('registryRepositories');
+  return (
+    <Datatable
+      title="Repositories"
+      titleIcon={Book}
+      columns={columns}
+      dataset={dataset || []}
+      isLoading={!dataset}
+      settingsManager={tableState}
+      disableSelect
+      data-cy="registry-repositories-datatable"
+    />
+  );
+}
diff --git a/app/react/portainer/registries/repositories/ListView/columns.tsx b/app/react/portainer/registries/repositories/ListView/columns.tsx
new file mode 100644
index 0000000..2e80b9b
--- /dev/null
+++ b/app/react/portainer/registries/repositories/ListView/columns.tsx
@@ -0,0 +1,69 @@
+import { createColumnHelper, CellContext } from '@tanstack/react-table';
+import { useCurrentStateAndParams } from '@uirouter/react';
+
+import { Link } from '@@/Link';
+
+import { useRepositoryTags } from './useRepositoryTags';
+import { Repository } from './types';
+
+const helper = createColumnHelper<Repository>();
+
+export const columns = [
+  helper.accessor('Name', {
+    header: 'Repository',
+    cell: NameCell,
+  }),
+  helper.display({
+    header: 'Tags count',
+    cell: TagsCell,
+  }),
+];
+
+function useParams() {
+  const {
+    params: { endpointId, id },
+  } = useCurrentStateAndParams();
+
+  const registryId = number(id);
+
+  if (!registryId) {
+    throw new Error('Missing registry id');
+  }
+
+  return {
+    environmentId: number(endpointId),
+    registryId,
+  };
+}
+
+function number(value: string | undefined) {
+  const num = parseInt(value || '', 10);
+  return Number.isNaN(num) ? undefined : num;
+}
+
+function NameCell({ getValue }: CellContext<Repository, string>) {
+  const { environmentId } = useParams();
+  const name = getValue();
+  return (
+    <Link
+      to="portainer.registries.registry.repository"
+      params={{ repository: name, endpointId: environmentId }}
+      title={name}
+      data-cy={`repository-name-link-${name}`}
+    >
+      {name}
+    </Link>
+  );
+}
+
+function TagsCell({ row }: CellContext<Repository, unknown>) {
+  const { environmentId, registryId } = useParams();
+
+  const tagsQuery = useRepositoryTags({
+    environmentId,
+    registryId,
+    repository: row.original.Name,
+  });
+
+  return tagsQuery.data?.tags.length || 0;
+}
diff --git a/app/react/portainer/registries/repositories/ListView/types.ts b/app/react/portainer/registries/repositories/ListView/types.ts
new file mode 100644
index 0000000..ac602a0
--- /dev/null
+++ b/app/react/portainer/registries/repositories/ListView/types.ts
@@ -0,0 +1,3 @@
+export interface Repository {
+  Name: string;
+}
diff --git a/app/react/portainer/registries/repositories/ListView/useRepositoryTags.ts b/app/react/portainer/registries/repositories/ListView/useRepositoryTags.ts
new file mode 100644
index 0000000..e1da995
--- /dev/null
+++ b/app/react/portainer/registries/repositories/ListView/useRepositoryTags.ts
@@ -0,0 +1,72 @@
+import { useQuery } from '@tanstack/react-query';
+import _ from 'lodash';
+
+import { Environment } from '@/react/portainer/environments/types';
+import axios from '@/portainer/services/axios/axios';
+
+import { Registry } from '../../types/registry';
+import { buildUrl } from '../../queries/build-url';
+import { queryKeys } from '../../queries/query-keys';
+
+export function useRepositoryTags({
+  registryId,
+  ...params
+}: {
+  registryId: Registry['Id'];
+  repository: string;
+  environmentId?: Environment['Id'];
+}) {
+  return useQuery({
+    queryKey: [...queryKeys.item(registryId), params] as const,
+    queryFn: () =>
+      getRepositoryTags({
+        ...params,
+        registryId,
+        n: 100,
+        last: '',
+      }),
+    staleTime: 1 * 60 * 1000, // 1 minute
+  });
+}
+
+export async function getRepositoryTags(
+  {
+    environmentId,
+    registryId,
+    repository,
+    n,
+    last,
+  }: {
+    registryId: Registry['Id'];
+    repository: string;
+    environmentId?: Environment['Id'];
+    n?: number;
+    last?: string;
+  },
+  acc: { name: string; tags: string[] } = { name: '', tags: [] }
+): Promise<{ name: string; tags: string[] }> {
+  const { data, headers } = await axios.get<{ name: string; tags: string[] }>(
+    `${buildUrl(registryId)}/v2/${repository}/tags/list`,
+    {
+      params: {
+        id: registryId,
+        endpointId: environmentId,
+        repository,
+        n,
+        last,
+      },
+    }
+  );
+  acc.name = data.name;
+  acc.tags = _.concat(acc.tags, data.tags);
+
+  if (headers.link) {
+    const last = data.tags[data.tags.length - 1];
+    return getRepositoryTags(
+      { registryId, repository, n, last, environmentId },
+      acc
+    );
+  }
+
+  return acc;
+}
diff --git a/app/react/portainer/registries/repositories/TagView/.keep b/app/react/portainer/registries/repositories/TagView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/portainer/registries/repositories/queries/getRegistryBlobs.ts b/app/react/portainer/registries/repositories/queries/getRegistryBlobs.ts
new file mode 100644
index 0000000..fa3acd6
--- /dev/null
+++ b/app/react/portainer/registries/repositories/queries/getRegistryBlobs.ts
@@ -0,0 +1,59 @@
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { EnvironmentId } from '../../../environments/types';
+import { RegistryId } from '../../types/registry';
+import { buildProxyUrl } from '../../queries/build-url';
+
+/**
+ * TODO: This file is copy of an old angular service, need to migrate it to use axios
+ */
+
+interface Params {
+  id: RegistryId;
+  repository: string;
+  digest: string;
+  endpointId?: EnvironmentId;
+}
+
+function buildUrl(params: Params) {
+  return `${buildProxyUrl(params.id)}/${params.repository}/blobs/${
+    params.digest
+  }`;
+}
+
+export interface ImageConfigs {
+  architecture: string;
+  config: {
+    Env: string[];
+    Entrypoint: string[];
+    WorkingDir: string;
+    Labels: Record<string, string>;
+    ArgsEscaped: boolean;
+  };
+  created: string;
+  history: Array<{
+    created: string;
+    created_by: string;
+    empty_layer?: boolean;
+    comment?: string;
+  }>;
+  os: string;
+  rootfs: {
+    type: string;
+    diff_ids: string[];
+  };
+  docker_version?: string;
+  container_config?: unknown;
+}
+
+export async function getRegistryBlob(params: Params) {
+  try {
+    const { data } = await axios.get<ImageConfigs | string>(buildUrl(params), {
+      params: { endpointId: params.endpointId },
+    });
+
+    return typeof data === 'string' ? JSON.parse(data) : data;
+  } catch (err) {
+    throw parseAxiosError(err);
+  }
+}
diff --git a/app/react/portainer/registries/repositories/queries/manifest.service.ts b/app/react/portainer/registries/repositories/queries/manifest.service.ts
new file mode 100644
index 0000000..c5ed267
--- /dev/null
+++ b/app/react/portainer/registries/repositories/queries/manifest.service.ts
@@ -0,0 +1,146 @@
+import { Sha256 } from '@aws-crypto/sha256-js';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { RegistryId } from '../../types/registry';
+import { buildProxyUrl } from '../../queries/build-url';
+
+/**
+ * TODO: This file is copy of an old angular service, need to migrate it to use axios
+ */
+
+interface Params {
+  id: RegistryId;
+  repository: string;
+  tag: string;
+  endpointId?: EnvironmentId;
+}
+
+function buildUrl({ id, repository, tag }: Params) {
+  return `${buildProxyUrl(id)}/${repository}/manifests/${tag}`;
+}
+
+export interface ManifestV1 {
+  schemaVersion: number;
+  name: string;
+  tag: string;
+  architecture: string;
+  fsLayers: {
+    blobSum: string;
+  }[];
+  history: {
+    v1Compatibility: string;
+  }[];
+  signatures: {
+    header: {
+      jwk: {
+        crv: string;
+        kid: string;
+        kty: string;
+        x: string;
+        y: string;
+      };
+      alg: string;
+    };
+    signature: string;
+    protected: string;
+  }[];
+}
+
+export async function getTagManifestV1(params: Params) {
+  try {
+    const { data } = await axios.get<ManifestV1>(buildUrl(params), {
+      params: { endpointId: params.endpointId },
+      headers: {
+        Accept: 'application/vnd.docker.distribution.manifest.v1+json',
+        'Cache-Control': 'no-cache',
+        'If-Modified-Since': 'Mon, 26 Jul 1997 05:00:00 GMT',
+      },
+    });
+
+    return data;
+  } catch (err) {
+    throw parseAxiosError(err);
+  }
+}
+
+export interface ManifestV2 {
+  schemaVersion: number;
+  mediaType: string;
+  config: {
+    mediaType: string;
+    size: number;
+    digest: string;
+  };
+  layers: {
+    mediaType: string;
+    size: number;
+    digest: string;
+  }[];
+}
+
+export async function getTagManifestV2(
+  params: Params
+): Promise<ManifestV2 & { digest: string }> {
+  try {
+    const { data: resultText, headers } = await axios.get<string>(
+      buildUrl(params),
+      {
+        params: { endpointId: params.endpointId },
+        headers: {
+          Accept: 'application/vnd.docker.distribution.manifest.v2+json',
+          'Cache-Control': 'no-cache',
+          'If-Modified-Since': 'Mon, 26 Jul 1997 05:00:00 GMT',
+        },
+        // To support ECR we need text response
+        responseType: 'text',
+        // see https://github.com/axios/axios/issues/907#issuecomment-506924322 for text response
+        transformResponse: [(data) => data],
+      }
+    );
+
+    const result = JSON.parse(resultText);
+    // ECR does not return the digest header
+    result.digest =
+      headers['docker-content-digest'] || (await sha256(resultText));
+
+    return result;
+  } catch (err) {
+    throw parseAxiosError(err);
+  }
+}
+
+export async function updateManifest(params: Params, data: unknown) {
+  try {
+    await axios.put(buildUrl(params), data, {
+      headers: {
+        'Content-Type': 'application/vnd.docker.distribution.manifest.v2+json',
+      },
+      params: { endpointId: params.endpointId },
+    });
+  } catch (err) {
+    throw parseAxiosError(err);
+  }
+}
+
+export async function deleteManifest(params: {
+  id: RegistryId;
+  repository: string;
+  tag: string;
+  endpointId?: EnvironmentId;
+}) {
+  try {
+    await axios.delete(buildUrl(params), {
+      params: { endpointId: params.endpointId },
+    });
+  } catch (err) {
+    throw parseAxiosError(err);
+  }
+}
+
+function sha256(string: string) {
+  const hash = new Sha256();
+  hash.update(string);
+  return hash.digest();
+}
diff --git a/app/react/portainer/registries/repositories/queries/queryKeys.ts b/app/react/portainer/registries/repositories/queries/queryKeys.ts
new file mode 100644
index 0000000..2c7215e
--- /dev/null
+++ b/app/react/portainer/registries/repositories/queries/queryKeys.ts
@@ -0,0 +1,31 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { queryKeys as registriesQueryKeys } from '../../queries/query-keys';
+import { RegistryId } from '../../types/registry';
+
+export const queryKeys = {
+  base: (registryId: RegistryId) =>
+    [...registriesQueryKeys.item(registryId), 'repositories'] as const,
+  repository: (registryId: RegistryId, repository: string) =>
+    [...queryKeys.base(registryId), repository] as const,
+  repositoryTags: (registryId: RegistryId, repository: string) =>
+    [...queryKeys.repository(registryId, repository), 'tags'] as const,
+  repositoryTag: (registryId: RegistryId, repository: string, tag: string) =>
+    [...queryKeys.repository(registryId, repository), 'tags', tag] as const,
+  tagDetails: ({
+    registryId,
+    repository,
+    tag,
+    ...params
+  }: {
+    repository: string;
+    environmentId?: EnvironmentId;
+    registryId: RegistryId;
+    tag: string;
+  }) =>
+    [
+      ...queryKeys.repositoryTag(registryId, repository, tag),
+      'details',
+      params,
+    ] as const,
+};
diff --git a/app/react/portainer/registries/repositories/queries/useTagDetails.ts b/app/react/portainer/registries/repositories/queries/useTagDetails.ts
new file mode 100644
index 0000000..89da912
--- /dev/null
+++ b/app/react/portainer/registries/repositories/queries/useTagDetails.ts
@@ -0,0 +1,82 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { Environment } from '@/react/portainer/environments/types';
+import { Registry } from '@/react/portainer/registries/types/registry';
+
+import { manifestsToTag } from '../ItemView/TagsDatatable/manifestsToTag';
+import { RepositoryTagViewModel } from '../ItemView/TagsDatatable/view-model';
+
+import { getTagManifestV1, getTagManifestV2 } from './manifest.service';
+import { ImageConfigs, getRegistryBlob } from './getRegistryBlobs';
+import { queryKeys } from './queryKeys';
+
+interface Params {
+  registryId: Registry['Id'];
+  repository: string;
+  environmentId?: Environment['Id'];
+  tag: string;
+}
+
+export function useTagDetails<T = RepositoryTagViewModel>(
+  params: Params,
+  {
+    staleTime = 0,
+    select,
+  }: { select?: (model: RepositoryTagViewModel) => T; staleTime?: number } = {}
+) {
+  return useQuery({
+    queryKey: queryKeys.tagDetails(params),
+    queryFn: () => getTagDetails(params),
+    staleTime,
+    select,
+  });
+}
+
+export async function getTagDetails({
+  registryId,
+  environmentId,
+  repository,
+  tag,
+}: Params) {
+  const params = {
+    id: registryId,
+    endpointId: environmentId,
+    repository,
+    tag,
+  };
+  const [v1, v2] = await Promise.all([
+    getTagManifestV1(params),
+    getTagManifestV2(params),
+  ]);
+
+  let useV1 = true;
+  let imageConfigs: ImageConfigs | undefined;
+  try {
+    imageConfigs = await getRegistryBlob({
+      digest: v2.config.digest,
+      ...params,
+    });
+
+    // prefer image configs than manifest v1
+    useV1 = false;
+  } catch (e) {
+    // empty
+  }
+
+  if (v1 && v1.schemaVersion === 2) {
+    // Registry returns manifest v2 while we request manifest v1
+    useV1 = false;
+  }
+
+  const data: { v2: typeof v2; v1?: typeof v1; imageConfigs?: ImageConfigs } = {
+    v2,
+    imageConfigs,
+  };
+  if (useV1) {
+    data.v1 = v1;
+  }
+
+  const tagDetails = manifestsToTag(data);
+  tagDetails.Name = tagDetails.Name || tag;
+  return tagDetails;
+}
diff --git a/app/react/portainer/registries/types/gitlabProject.ts b/app/react/portainer/registries/types/gitlabProject.ts
new file mode 100644
index 0000000..31eb406
--- /dev/null
+++ b/app/react/portainer/registries/types/gitlabProject.ts
@@ -0,0 +1,33 @@
+interface GitlabProjectResponse {
+  id: number;
+  name: string;
+  description: string;
+  namespace?: {
+    name: string;
+  };
+  path_with_namespace: string;
+  container_registry_enabled: boolean;
+}
+
+export class RegistryGitlabProject {
+  Id: number;
+
+  Description: string;
+
+  Name: string;
+
+  Namespace: string;
+
+  PathWithNamespace: string;
+
+  RegistryEnabled: boolean;
+
+  constructor(project: GitlabProjectResponse) {
+    this.Id = project.id;
+    this.Description = project.description;
+    this.Name = project.name;
+    this.Namespace = project.namespace ? project.namespace.name : '';
+    this.PathWithNamespace = project.path_with_namespace;
+    this.RegistryEnabled = project.container_registry_enabled;
+  }
+}
diff --git a/app/react/portainer/registries/types/registry.ts b/app/react/portainer/registries/types/registry.ts
new file mode 100644
index 0000000..9b84ed5
--- /dev/null
+++ b/app/react/portainer/registries/types/registry.ts
@@ -0,0 +1,79 @@
+import { TLSConfiguration } from '../../settings/types';
+import {
+  TeamAccessPolicies,
+  UserAccessPolicies,
+} from '../../environments/types';
+
+export type Catalog = {
+  repositories: string[];
+};
+
+export enum RegistryTypes {
+  ANONYMOUS,
+  QUAY,
+  AZURE,
+  CUSTOM,
+  GITLAB,
+  PROGET,
+  DOCKERHUB,
+  ECR,
+  GITHUB,
+}
+
+export interface RegistryAccess {
+  UserAccessPolicies: UserAccessPolicies | null;
+  TeamAccessPolicies: TeamAccessPolicies | null;
+  Namespaces: string[];
+}
+
+export interface RegistryAccesses {
+  [key: string]: RegistryAccess;
+}
+
+export interface Gitlab {
+  ProjectId: number;
+  InstanceURL: string;
+  ProjectPath: string;
+}
+
+export interface Quay {
+  UseOrganisation?: boolean;
+  OrganisationName: string;
+}
+
+export interface Github {
+  UseOrganisation: boolean;
+  OrganisationName: string;
+}
+
+export interface Ecr {
+  Region: string;
+}
+
+interface RegistryManagementConfiguration {
+  Type: RegistryTypes;
+  Authentication: boolean;
+  Username: string;
+  Password: string;
+  TLSConfig: TLSConfiguration;
+  Ecr: Ecr;
+  AccessToken?: string;
+  AccessTokenExpiry?: number;
+}
+
+export type RegistryId = number;
+export interface Registry {
+  Id: RegistryId;
+  Type: RegistryTypes;
+  Name: string;
+  URL: string;
+  BaseURL: string;
+  Authentication: boolean;
+  Username: string;
+  RegistryAccesses: RegistryAccesses | null;
+  Gitlab: Gitlab;
+  Quay: Quay;
+  Github: Github;
+  Ecr: Ecr;
+  ManagementConfiguration?: RegistryManagementConfiguration;
+}
diff --git a/app/react/portainer/registries/utils/constants.tsx b/app/react/portainer/registries/utils/constants.tsx
new file mode 100644
index 0000000..e20ee28
--- /dev/null
+++ b/app/react/portainer/registries/utils/constants.tsx
@@ -0,0 +1,35 @@
+import { Edit } from 'lucide-react';
+
+import Docker from '@/assets/ico/vendor/docker.svg?c';
+import Ecr from '@/assets/ico/vendor/ecr.svg?c';
+import Quay from '@/assets/ico/vendor/quay.svg?c';
+import Proget from '@/assets/ico/vendor/proget.svg?c';
+import Azure from '@/assets/ico/vendor/azure.svg?c';
+import Gitlab from '@/assets/ico/vendor/gitlab.svg?c';
+
+import { RegistryTypes } from '../types/registry';
+
+export const registryLabelMap: Record<RegistryTypes, string> = {
+  [RegistryTypes.ANONYMOUS]: 'Anonymous',
+  [RegistryTypes.DOCKERHUB]: 'DockerHub',
+  [RegistryTypes.ECR]: 'AWS ECR',
+  [RegistryTypes.QUAY]: 'Quay.io',
+  [RegistryTypes.PROGET]: 'ProGet',
+  [RegistryTypes.AZURE]: 'Azure',
+  [RegistryTypes.GITLAB]: 'GitLab',
+  [RegistryTypes.CUSTOM]: 'Custom registry',
+  [RegistryTypes.GITHUB]: 'GitHub',
+};
+
+export const registryIconMap = {
+  [RegistryTypes.DOCKERHUB]: Docker,
+  [RegistryTypes.ECR]: Ecr,
+  [RegistryTypes.QUAY]: Quay,
+  [RegistryTypes.PROGET]: Proget,
+  [RegistryTypes.AZURE]: Azure,
+  [RegistryTypes.GITLAB]: Gitlab,
+  [RegistryTypes.CUSTOM]: Edit,
+  // github and anonymous don't have an icon
+  [RegistryTypes.GITHUB]: null,
+  [RegistryTypes.ANONYMOUS]: null,
+};
diff --git a/app/react/portainer/registries/utils/getUrl.ts b/app/react/portainer/registries/utils/getUrl.ts
new file mode 100644
index 0000000..8841f05
--- /dev/null
+++ b/app/react/portainer/registries/utils/getUrl.ts
@@ -0,0 +1,31 @@
+import { Registry, RegistryTypes } from '../types/registry';
+
+export function getURL(registry: Registry) {
+  switch (registry.Type) {
+    case RegistryTypes.GITLAB:
+      return `${registry.URL}/${registry.Gitlab.ProjectPath}`;
+
+    case RegistryTypes.QUAY:
+      return getQuayUrl(registry);
+
+    case RegistryTypes.GITHUB:
+      return getGithubUrl(registry);
+
+    default:
+      return registry.URL;
+  }
+
+  function getGithubUrl(registry: Registry) {
+    const name = registry.Github.UseOrganisation
+      ? registry.Github.OrganisationName
+      : registry.Username;
+    return `${registry.URL}/${name}`;
+  }
+
+  function getQuayUrl(registry: Registry) {
+    const name = registry.Quay.UseOrganisation
+      ? registry.Quay.OrganisationName
+      : registry.Username;
+    return `${registry.URL}/${name}`;
+  }
+}
diff --git a/app/react/portainer/services/applyTheme.ts b/app/react/portainer/services/applyTheme.ts
new file mode 100644
index 0000000..9a3ab6e
--- /dev/null
+++ b/app/react/portainer/services/applyTheme.ts
@@ -0,0 +1,14 @@
+import { ThemeColor } from '@/portainer/users/types';
+
+export function applyTheme(color: ThemeColor) {
+  if (color === 'auto' || !color) {
+    const isDark = window.matchMedia('(prefers-color-scheme: dark)').matches;
+    if (isDark) {
+      document.documentElement.setAttribute('theme', 'dark');
+    } else {
+      document.documentElement.removeAttribute('theme');
+    }
+  } else {
+    document.documentElement.setAttribute('theme', color);
+  }
+}
diff --git a/app/react/portainer/services/axios/axios.ts b/app/react/portainer/services/axios/axios.ts
new file mode 100644
index 0000000..cc724b1
--- /dev/null
+++ b/app/react/portainer/services/axios/axios.ts
@@ -0,0 +1,154 @@
+import Axios, { AxiosInstance, InternalAxiosRequestConfig } from 'axios';
+import {
+  AxiosCacheInstance,
+  buildMemoryStorage,
+  CacheAxiosResponse,
+  InterpreterResult,
+  setupCache,
+  StorageValue,
+} from 'axios-cache-interceptor';
+import { loadProgressBar } from 'axios-progress-bar';
+import 'axios-progress-bar/dist/nprogress.css';
+import qs from 'qs';
+
+import {
+  CACHE_DURATION,
+  dispatchCacheRefreshEventIfNeeded,
+  portainerAgentManagerOperation,
+  portainerAgentTargetHeader,
+} from '@/portainer/services/http-request.helper';
+import { dockerMaxAPIVersionInterceptor } from '@/portainer/services/dockerMaxApiVersionInterceptor';
+
+export { parseAxiosError } from './utils/parseAxiosError';
+
+const portainerCacheHeader = 'X-Portainer-Cache';
+
+const storage = buildMemoryStorage();
+// mock the cache adapter
+export const cache = {
+  store: {
+    clear: () => {
+      storage.data = new Map<string, StorageValue>();
+    },
+  },
+};
+
+function headerInterpreter(
+  headers?: CacheAxiosResponse['headers']
+): InterpreterResult {
+  if (!headers) {
+    return 'not enough headers';
+  }
+
+  if (headers[portainerCacheHeader]) {
+    return CACHE_DURATION;
+  }
+
+  return 'not enough headers';
+}
+
+const axios = Axios.create({
+  baseURL: 'api',
+  paramsSerializer: {
+    serialize: (params) => qs.stringify(params, { arrayFormat: 'brackets' }),
+  },
+});
+axios.interceptors.request.use((req) => {
+  dispatchCacheRefreshEventIfNeeded(req);
+  return req;
+});
+
+// type guard the axios instance
+function isAxiosCacheInstance(
+  a: AxiosInstance | AxiosCacheInstance
+): a is AxiosCacheInstance {
+  return (a as AxiosCacheInstance).defaults.cache !== undefined;
+}
+
+// when entering a kubernetes environment, or updating user settings, update the cache adapter
+export function updateAxiosAdapter(useCache: boolean) {
+  if (useCache) {
+    if (isAxiosCacheInstance(axios)) {
+      return;
+    }
+
+    setupCache(axios, {
+      storage,
+      ttl: CACHE_DURATION,
+      methods: ['get', 'head', 'options', 'post'],
+      // cachePredicate determines if the response should be cached based on response
+      cachePredicate: {
+        containsHeaders: {
+          [portainerCacheHeader]: () => true,
+        },
+        ignoreUrls: [/^(?!.*\bkubernetes\b).*$/gm],
+        responseMatch: (res) => {
+          if (res.config.method === 'post') {
+            if (res.config.url?.includes('selfsubjectaccessreviews')) {
+              return true;
+            }
+            return false;
+          }
+          return true;
+        },
+      },
+      // headerInterpreter interprets the response headers to determine if the response should be cached
+      headerInterpreter,
+    });
+  }
+}
+
+export default axios;
+
+loadProgressBar(undefined, axios);
+
+export const agentTargetHeader = 'X-PortainerAgent-Target';
+
+export function agentInterceptor(config: InternalAxiosRequestConfig) {
+  if (!config.url || !config.url.includes('/docker/')) {
+    return config;
+  }
+
+  const newConfig = { ...config };
+  const target = portainerAgentTargetHeader();
+  if (target) {
+    newConfig.headers[agentTargetHeader] = target;
+  }
+
+  if (portainerAgentManagerOperation()) {
+    newConfig.headers['X-PortainerAgent-ManagerOperation'] = '1';
+  }
+
+  return newConfig;
+}
+
+axios.interceptors.request.use(dockerMaxAPIVersionInterceptor);
+axios.interceptors.request.use(agentInterceptor);
+
+axios.interceptors.response.use(undefined, (error) => {
+  if (
+    error.response?.status === 401 &&
+    !error.config.url.includes('/v2/') && // docker proxy through agent
+    !error.config.url.includes('/api/v4/') && // gitlab proxy
+    isTransitionRequiresAuthentication()
+  ) {
+    // eslint-disable-next-line no-console
+    console.error('Unauthorized request, logging out');
+    window.location.hash = '/logout';
+    window.location.reload();
+  }
+
+  return Promise.reject(error);
+});
+
+const UNAUTHENTICATED_ROUTES = [
+  '/logout',
+  '/internal-auth',
+  '/auth',
+  '/init/admin',
+];
+function isTransitionRequiresAuthentication() {
+  return !UNAUTHENTICATED_ROUTES.some((route) =>
+    window.location.hash.includes(route)
+  );
+}
diff --git a/app/react/portainer/services/axios/configure-hey-api.ts b/app/react/portainer/services/axios/configure-hey-api.ts
new file mode 100644
index 0000000..693cf09
--- /dev/null
+++ b/app/react/portainer/services/axios/configure-hey-api.ts
@@ -0,0 +1,10 @@
+import { CreateClientConfig } from '@api/client.gen';
+
+import axios from './axios';
+
+export function createClientConfig(config: Parameters<CreateClientConfig>[0]) {
+  return {
+    ...config,
+    axios,
+  };
+}
diff --git a/app/react/portainer/services/axios/utils/defaultAxiosParser.test.ts b/app/react/portainer/services/axios/utils/defaultAxiosParser.test.ts
new file mode 100644
index 0000000..c266796
--- /dev/null
+++ b/app/react/portainer/services/axios/utils/defaultAxiosParser.test.ts
@@ -0,0 +1,338 @@
+import { AxiosError } from 'axios';
+
+import { defaultErrorParser } from './parseAxiosError';
+import { createMockAxiosError } from './test-utils';
+
+describe('defaultErrorParser', () => {
+  describe('structured error responses', () => {
+    it('should extract from errors array format', () => {
+      const axiosError = createMockAxiosError({
+        errors: [
+          { message: 'Validation failed', details: 'Email is required' },
+        ],
+      });
+
+      const result = defaultErrorParser(axiosError);
+
+      expect(result.error.message).toBe('Validation failed');
+      expect(result.details).toBe('Email is required');
+    });
+
+    it('should use message as details fallback in errors array format', () => {
+      const axiosError = createMockAxiosError({
+        errors: [{ message: 'Validation failed' }],
+      });
+
+      const result = defaultErrorParser(axiosError);
+
+      expect(result.error.message).toBe('Validation failed');
+      expect(result.details).toBe('Validation failed');
+    });
+
+    it('should extract from array format', () => {
+      const axiosError = createMockAxiosError([
+        { message: 'Not found', details: 'Resource does not exist' },
+      ]);
+
+      const result = defaultErrorParser(axiosError);
+
+      expect(result.error.message).toBe('Not found');
+      expect(result.details).toBe('Resource does not exist');
+    });
+
+    it('should extract from standard object format', () => {
+      const axiosError = createMockAxiosError({
+        message: 'Unauthorized',
+        details: 'Invalid credentials',
+      });
+
+      const result = defaultErrorParser(axiosError);
+
+      expect(result.error.message).toBe('Unauthorized');
+      expect(result.details).toBe('Invalid credentials');
+    });
+
+    it('should use message as details fallback in standard format', () => {
+      const axiosError = createMockAxiosError({
+        message: 'Unauthorized',
+      });
+
+      const result = defaultErrorParser(axiosError);
+
+      expect(result.error.message).toBe('Unauthorized');
+      expect(result.details).toBe('Unauthorized');
+    });
+  });
+
+  describe('common error property names', () => {
+    it('should extract from "error" property', () => {
+      const axiosError = createMockAxiosError({
+        error: 'Something went wrong',
+      });
+
+      const result = defaultErrorParser(axiosError);
+
+      expect(result.error.message).toBe('Something went wrong');
+      expect(result.details).toBe('Something went wrong');
+    });
+
+    it('should extract from "err" property', () => {
+      const axiosError = createMockAxiosError({
+        err: 'Connection timeout',
+      });
+
+      const result = defaultErrorParser(axiosError);
+
+      expect(result.error.message).toBe('Connection timeout');
+      expect(result.details).toBe('Connection timeout');
+    });
+
+    it('should extract from "msg" property', () => {
+      const axiosError = createMockAxiosError({
+        msg: 'Bad request',
+      });
+
+      const result = defaultErrorParser(axiosError);
+
+      expect(result.error.message).toBe('Bad request');
+      expect(result.details).toBe('Bad request');
+    });
+
+    it('should extract from "detail" property (singular)', () => {
+      const axiosError = createMockAxiosError({
+        detail: 'Not allowed',
+      });
+
+      const result = defaultErrorParser(axiosError);
+
+      expect(result.error.message).toBe('Not allowed');
+      expect(result.details).toBe('Not allowed');
+    });
+  });
+
+  describe('unknown object structure', () => {
+    it('should extract first meaningful string value from object', () => {
+      const axiosError = createMockAxiosError({
+        code: 404,
+        reason: 'Resource not found',
+        timestamp: 1234567890,
+      });
+
+      const result = defaultErrorParser(axiosError);
+
+      expect(result.error.message).toBe('Resource not found');
+      expect(result.details).toBe('Resource not found');
+    });
+
+    it('should skip empty strings when extracting from object', () => {
+      const axiosError = createMockAxiosError({
+        empty: '',
+        code: 500,
+        reason: 'Server error',
+      });
+
+      const result = defaultErrorParser(axiosError);
+
+      expect(result.error.message).toBe('Server error');
+      expect(result.details).toBe('Server error');
+    });
+
+    it('should fall back to status code message when no strings found', () => {
+      const axiosError = createMockAxiosError(
+        {
+          code: 404,
+          timestamp: 1234567890,
+        },
+        404
+      );
+
+      const result = defaultErrorParser(axiosError);
+
+      expect(result.error.message).toBe('Server returned error: 404');
+      expect(result.details).toBe('Server returned error: 404');
+    });
+
+    it('should handle nested objects without stringifying', () => {
+      const axiosError = createMockAxiosError(
+        {
+          nested: { deep: { value: 'should not stringify this' } },
+          count: 42,
+        },
+        500
+      );
+
+      const result = defaultErrorParser(axiosError);
+
+      // Should fall back to status message instead of stringifying
+      expect(result.error.message).toBe('Server returned error: 500');
+      expect(result.details).toBe('Server returned error: 500');
+    });
+  });
+
+  describe('string responses', () => {
+    it('should handle plain string error', () => {
+      const axiosError = createMockAxiosError('Plain error message');
+
+      const result = defaultErrorParser(axiosError);
+
+      expect(result.error.message).toBe('Plain error message');
+      expect(result.details).toBe('Plain error message');
+    });
+
+    it('should handle HTML error response', () => {
+      const axiosError = createMockAxiosError('<html>Error page</html>');
+
+      const result = defaultErrorParser(axiosError);
+
+      expect(result.error.message).toBe('<html>Error page</html>');
+      expect(result.details).toBe('<html>Error page</html>');
+    });
+  });
+
+  describe('primitive types', () => {
+    it('should handle number response', () => {
+      const axiosError = createMockAxiosError(404);
+
+      const result = defaultErrorParser(axiosError);
+
+      expect(result.error.message).toBe('404');
+      expect(result.details).toBe('404');
+    });
+  });
+
+  describe('no response data', () => {
+    it('should use HTTP status text when available', () => {
+      const axiosError = createMockAxiosError(undefined, 403, 'Forbidden');
+
+      const result = defaultErrorParser(axiosError);
+
+      expect(result.error.message).toBe('Forbidden');
+      expect(result.details).toBe('Forbidden');
+    });
+
+    it('should use axios error message when no response', () => {
+      const axiosError = createMockAxiosError(
+        undefined,
+        undefined,
+        undefined,
+        'Network timeout'
+      );
+
+      const result = defaultErrorParser(axiosError);
+
+      expect(result.error.message).toBe('Network timeout');
+      expect(result.details).toBe('Network timeout');
+    });
+
+    it('should use fallback message when nothing available', () => {
+      const axiosError = {
+        name: 'AxiosError',
+        message: '',
+        config: {} as never,
+        isAxiosError: true,
+        toJSON: () => ({}),
+      } as AxiosError;
+
+      const result = defaultErrorParser(axiosError);
+
+      expect(result.error.message).toBe('An unknown error occurred');
+      expect(result.details).toBe('An unknown error occurred');
+    });
+  });
+
+  describe('edge cases', () => {
+    it('should handle null response data', () => {
+      const axiosError = createMockAxiosError(null, 500);
+
+      const result = defaultErrorParser(axiosError);
+
+      // Should fall back to HTTP status code instead of generic message
+      expect(result.error.message).toBe('Server returned error: 500');
+      expect(result.details).toBe('Server returned error: 500');
+    });
+
+    it('should handle empty object', () => {
+      const axiosError = createMockAxiosError({}, 500);
+      const result = defaultErrorParser(axiosError);
+
+      expect(result.error.message).toBe('Server returned error: 500');
+      expect(result.details).toBe('Server returned error: 500');
+    });
+
+    it('should handle empty array', () => {
+      const axiosError = createMockAxiosError([], 500);
+      const result = defaultErrorParser(axiosError);
+
+      expect(result.error.message).toBe('Server returned error: 500');
+      expect(result.details).toBe('Server returned error: 500');
+    });
+
+    it('should handle empty string in response data', () => {
+      const axiosError = createMockAxiosError('', 404);
+
+      const result = defaultErrorParser(axiosError);
+
+      // Empty string is treated as no usable data, so we fall back to HTTP status code
+      expect(result.error.message).toBe('Server returned error: 404');
+      expect(result.details).toBe('Server returned error: 404');
+    });
+  });
+
+  describe('real-world scenarios', () => {
+    it('should handle Docker API error format', () => {
+      const axiosError = createMockAxiosError({
+        message: 'container not found',
+      });
+
+      const result = defaultErrorParser(axiosError);
+
+      expect(result.error.message).toBe('container not found');
+      expect(result.details).toBe('container not found');
+    });
+
+    it('should handle Kubernetes API error format', () => {
+      const axiosError = createMockAxiosError({
+        kind: 'Status',
+        status: 'Failure',
+        message: 'pods "nginx" not found',
+        reason: 'NotFound',
+        code: 404,
+      });
+
+      const result = defaultErrorParser(axiosError);
+
+      // Should extract the "message" property through common error property check
+      expect(result.error.message).toBe('pods "nginx" not found');
+      expect(result.details).toBe('pods "nginx" not found');
+    });
+
+    it('should handle REST API validation error', () => {
+      const axiosError = createMockAxiosError({
+        errors: [
+          {
+            message: 'Invalid input',
+            details: 'Field "name" is required',
+          },
+        ],
+      });
+
+      const result = defaultErrorParser(axiosError);
+
+      expect(result.error.message).toBe('Invalid input');
+      expect(result.details).toBe('Field "name" is required');
+    });
+
+    it('should handle generic HTTP error with only status', () => {
+      const axiosError = createMockAxiosError(
+        undefined,
+        503,
+        'Service Unavailable'
+      );
+
+      const result = defaultErrorParser(axiosError);
+
+      expect(result.error.message).toBe('Service Unavailable');
+      expect(result.details).toBe('Service Unavailable');
+    });
+  });
+});
diff --git a/app/react/portainer/services/axios/utils/isAxiosError.ts b/app/react/portainer/services/axios/utils/isAxiosError.ts
new file mode 100644
index 0000000..78d3d8e
--- /dev/null
+++ b/app/react/portainer/services/axios/utils/isAxiosError.ts
@@ -0,0 +1,7 @@
+import Axios, { AxiosError } from 'axios';
+
+export function isAxiosError<ResponseType>(
+  error: unknown
+): error is AxiosError<ResponseType> {
+  return Axios.isAxiosError(error);
+}
diff --git a/app/react/portainer/services/axios/utils/parseAxiosError.ts b/app/react/portainer/services/axios/utils/parseAxiosError.ts
new file mode 100644
index 0000000..4894921
--- /dev/null
+++ b/app/react/portainer/services/axios/utils/parseAxiosError.ts
@@ -0,0 +1,176 @@
+import { AxiosError } from 'axios';
+
+import PortainerError from '@/portainer/error';
+
+import { isAxiosError } from './isAxiosError';
+
+/**
+ * Parses an Axios error and returns a PortainerError.
+ * @param err The original error.
+ * @param msg An optional error message to prepend.
+ * @param parseError A function to parse AxiosErrors. Defaults to defaultErrorParser.
+ * @returns A PortainerError with the parsed error message and details.
+ */
+export function parseAxiosError(
+  err: unknown,
+  msg = '',
+  parseError = defaultErrorParser
+) {
+  if (err instanceof PortainerError) {
+    return err;
+  }
+
+  let resultErr = err;
+  let resultMsg = msg;
+
+  if (isAxiosError(err)) {
+    const { error, details } = parseError(err);
+    resultErr = error;
+    if (msg && details) {
+      resultMsg = `${msg}: ${details}`;
+    } else {
+      resultMsg = msg || details;
+    }
+  }
+
+  return new PortainerError(resultMsg, resultErr);
+}
+
+type DefaultAxiosErrorType = {
+  message: string;
+  details?: string;
+};
+
+export function defaultErrorParser(axiosError: AxiosError<unknown>) {
+  const { message, details } = extractErrorDetails(axiosError);
+  const error = new Error(message);
+  return { error, details };
+}
+
+/**
+ * Simplify the error handling strategy
+ * Uses multiple fallbacks to give the user a helpful error response
+ */
+function extractErrorDetails(axiosError: AxiosError): {
+  message: string;
+  details: string;
+} {
+  const { data } = axiosError.response || {};
+  if (data && typeof data === 'object') {
+    const errorObj = data as Record<string, unknown>;
+
+    if (isMultipleErrorsResponse(data)) {
+      const firstError = data.errors[0];
+      return {
+        message: firstError.message || '',
+        details: firstError.details || firstError.message || '',
+      };
+    }
+
+    if (Array.isArray(data) && data.length > 0 && isDefaultResponse(data[0])) {
+      return {
+        message: data[0].message || '',
+        details: data[0].details || data[0].message || '',
+      };
+    }
+
+    if (isDefaultResponse(data)) {
+      return {
+        message: data.message || '',
+        details: data.details || data.message || '',
+      };
+    }
+
+    const commonErrorProps = [
+      errorObj.error,
+      errorObj.err,
+      errorObj.msg,
+      errorObj.message,
+      errorObj.detail,
+      errorObj.details,
+    ];
+
+    const errorValue = commonErrorProps.find(
+      (value): value is string => typeof value === 'string' && value.length > 0
+    );
+
+    if (errorValue) {
+      return { message: errorValue, details: errorValue };
+    }
+
+    const stringValues = Object.values(errorObj).filter(
+      (value): value is string => typeof value === 'string' && value.length > 0
+    );
+
+    if (stringValues.length > 0) {
+      return { message: stringValues[0], details: stringValues[0] };
+    }
+
+    const status = axiosError.response?.status;
+    const fallback = status
+      ? `Server returned error: ${status}`
+      : 'Server returned an error response';
+    return { message: fallback, details: fallback };
+  }
+
+  if (data && typeof data === 'string') {
+    return { message: data, details: data };
+  }
+
+  if (data) {
+    const stringValue = String(data);
+    return { message: stringValue, details: stringValue };
+  }
+
+  // Fallback: Use response status or statusText when available
+  if (axiosError.response) {
+    const { status, statusText } = axiosError.response;
+
+    if (statusText) {
+      return {
+        message: statusText,
+        details: statusText,
+      };
+    }
+
+    if (status) {
+      const message = `Server returned error: ${status}`;
+      return { message, details: message };
+    }
+
+    return {
+      message: 'Server returned an error response',
+      details: 'Server returned an error response',
+    };
+  }
+
+  // Final fallback: Use axios error message if available
+  if (axiosError.message) {
+    return { message: axiosError.message, details: axiosError.message };
+  }
+
+  const fallback = 'An unknown error occurred';
+  return { message: fallback, details: fallback };
+}
+
+function isMultipleErrorsResponse(data: unknown): data is {
+  errors: DefaultAxiosErrorType[];
+} {
+  return (
+    !!data &&
+    typeof data === 'object' &&
+    'errors' in data &&
+    Array.isArray(data.errors) &&
+    data.errors.length > 0
+  );
+}
+export function isDefaultResponse(
+  data: unknown
+): data is DefaultAxiosErrorType {
+  return (
+    !!data &&
+    typeof data === 'object' &&
+    'message' in data &&
+    typeof data.message === 'string'
+  );
+}
diff --git a/app/react/portainer/services/axios/utils/test-utils.ts b/app/react/portainer/services/axios/utils/test-utils.ts
new file mode 100644
index 0000000..7f3ea31
--- /dev/null
+++ b/app/react/portainer/services/axios/utils/test-utils.ts
@@ -0,0 +1,39 @@
+import { AxiosError, AxiosResponse, InternalAxiosRequestConfig } from 'axios';
+
+/**
+ * Minimal stub for InternalAxiosRequestConfig used in test mocks
+ */
+function createMockConfig(): InternalAxiosRequestConfig {
+  return {
+    url: '',
+    method: 'get',
+    headers: {},
+  } as InternalAxiosRequestConfig;
+}
+
+/**
+ * Helper function to create mock AxiosError objects for testing
+ */
+export function createMockAxiosError(
+  responseData?: unknown,
+  status?: number,
+  statusText?: string,
+  message?: string
+): AxiosError {
+  const config = createMockConfig();
+
+  const response: AxiosResponse | undefined =
+    responseData !== undefined ||
+    status !== undefined ||
+    statusText !== undefined
+      ? {
+          data: responseData,
+          status: status ?? 500,
+          statusText: statusText ?? '',
+          headers: {},
+          config,
+        }
+      : undefined;
+
+  return new AxiosError(message, undefined, config, undefined, response);
+}
diff --git a/app/react/portainer/settings/.keep b/app/react/portainer/settings/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/portainer/settings/AuthenticationView/AuthenticationMethodSelector.test.tsx b/app/react/portainer/settings/AuthenticationView/AuthenticationMethodSelector.test.tsx
new file mode 100644
index 0000000..fcd2b74
--- /dev/null
+++ b/app/react/portainer/settings/AuthenticationView/AuthenticationMethodSelector.test.tsx
@@ -0,0 +1,76 @@
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+
+import { AuthenticationMethodSelector } from './AuthenticationMethodSelector';
+
+// Helper render function with default props
+function renderComponent(props: {
+  value: number;
+  onChange?: (value: number) => void;
+  radioName?: string;
+}) {
+  const defaultProps = {
+    onChange: vi.fn(),
+    ...props,
+  };
+
+  return render(<AuthenticationMethodSelector {...defaultProps} />);
+}
+
+describe('AuthenticationMethodSelector', () => {
+  it('should render all authentication method options', () => {
+    renderComponent({ value: 1 });
+
+    // Verify all authentication methods are rendered
+    expect(screen.getByLabelText('Internal', { exact: false })).toBeVisible();
+    expect(screen.getByLabelText('LDAP', { exact: false })).toBeVisible();
+    expect(
+      screen.getByLabelText('Microsoft Active Directory', { exact: false })
+    ).toBeVisible();
+    expect(screen.getByLabelText('OAuth', { exact: false })).toBeVisible();
+  });
+
+  it('should select the Internal authentication method by default', () => {
+    renderComponent({ value: 1 });
+
+    const internalRadio = screen.getByLabelText('Internal', {
+      exact: false,
+    }) as HTMLInputElement;
+    expect(internalRadio.checked).toBe(true);
+  });
+
+  it('should select the LDAP authentication method when value is 2', () => {
+    renderComponent({ value: 2 });
+
+    const ldapRadio = screen.getByLabelText('LDAP', {
+      exact: false,
+    }) as HTMLInputElement;
+    expect(ldapRadio.checked).toBe(true);
+  });
+
+  it('should call onChange when selecting a different authentication method', async () => {
+    const user = userEvent.setup();
+    const onChange = vi.fn();
+    renderComponent({ value: 1, onChange });
+
+    // Click on LDAP option
+    const ldapRadio = screen.getByLabelText('LDAP', { exact: false });
+    await user.click(ldapRadio);
+
+    // Verify onChange was called with LDAP value (2)
+    expect(onChange).toHaveBeenCalledWith(2, false);
+  });
+
+  it('should not call onChange when clicking the already selected option', async () => {
+    const user = userEvent.setup();
+    const onChange = vi.fn();
+    renderComponent({ value: 1, onChange });
+
+    // Click on already selected Internal option
+    const internalRadio = screen.getByLabelText('Internal', { exact: false });
+    await user.click(internalRadio);
+
+    // onChange should not be called for already selected option
+    expect(onChange).not.toHaveBeenCalled();
+  });
+});
diff --git a/app/react/portainer/settings/AuthenticationView/AuthenticationMethodSelector.tsx b/app/react/portainer/settings/AuthenticationView/AuthenticationMethodSelector.tsx
new file mode 100644
index 0000000..ae22325
--- /dev/null
+++ b/app/react/portainer/settings/AuthenticationView/AuthenticationMethodSelector.tsx
@@ -0,0 +1,64 @@
+import { ArrowDownCircle } from 'lucide-react';
+
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+import Microsoft from '@/assets/ico/vendor/microsoft.svg?c';
+import Ldap from '@/assets/ico/ldap.svg?c';
+import OAuth from '@/assets/ico/oauth.svg?c';
+
+import { BoxSelector } from '@@/BoxSelector';
+
+import { AuthenticationMethod } from '../types';
+
+const options = [
+  {
+    id: 'auth_internal',
+    icon: ArrowDownCircle,
+    iconType: 'badge',
+    label: 'Internal',
+    description: 'Internal authentication mechanism',
+    value: AuthenticationMethod.Internal,
+  },
+  {
+    id: 'auth_ldap',
+    icon: Ldap,
+    label: 'LDAP',
+    description: 'LDAP authentication',
+    iconType: 'logo',
+    value: AuthenticationMethod.LDAP,
+  },
+  {
+    id: 'auth_ad',
+    icon: Microsoft,
+    label: 'Microsoft Active Directory',
+    description: 'AD authentication',
+    iconType: 'logo',
+    value: AuthenticationMethod.AD,
+    feature: FeatureId.HIDE_INTERNAL_AUTH,
+  },
+  {
+    id: 'auth_oauth',
+    icon: OAuth,
+    label: 'OAuth',
+    description: 'OAuth authentication',
+    iconType: 'logo',
+    value: AuthenticationMethod.OAuth,
+  },
+] as const;
+
+export function AuthenticationMethodSelector({
+  value,
+  onChange,
+}: {
+  value: number;
+  onChange: (value: number) => void;
+}) {
+  return (
+    <BoxSelector
+      radioName="authOptions"
+      options={options}
+      value={value}
+      onChange={onChange}
+      label="Authentication method"
+    />
+  );
+}
diff --git a/app/react/portainer/settings/AuthenticationView/AutoUserProvisionToggle/AutoUserProvisionToggle.test.tsx b/app/react/portainer/settings/AuthenticationView/AutoUserProvisionToggle/AutoUserProvisionToggle.test.tsx
new file mode 100644
index 0000000..2c06f7f
--- /dev/null
+++ b/app/react/portainer/settings/AuthenticationView/AutoUserProvisionToggle/AutoUserProvisionToggle.test.tsx
@@ -0,0 +1,45 @@
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { describe, expect, test, vi } from 'vitest';
+
+import { AutoUserProvisionToggle } from './AutoUserProvisionToggle';
+
+describe('AutoUserProvisionToggle', () => {
+  test('renders with description', () => {
+    render(
+      <AutoUserProvisionToggle
+        value={false}
+        onChange={() => {}}
+        description="Test description for automatic user provisioning"
+      />
+    );
+
+    expect(
+      screen.getByText(/test description for automatic user provisioning/i)
+    ).toBeVisible();
+    expect(
+      screen.getByRole('checkbox', { name: /automatic user provisioning/i })
+    ).toBeVisible();
+  });
+
+  test('calls onChange when toggled', async () => {
+    const user = userEvent.setup();
+    const onChange = vi.fn();
+
+    render(
+      <AutoUserProvisionToggle
+        value={false}
+        onChange={onChange}
+        description="Enable automatic user provisioning"
+      />
+    );
+
+    const toggle = screen.getByRole('checkbox', {
+      name: /automatic user provisioning/i,
+    });
+    await user.click(toggle);
+
+    expect(onChange).toHaveBeenCalled();
+    expect(onChange.mock.calls[0][0]).toBe(true);
+  });
+});
diff --git a/app/react/portainer/settings/AuthenticationView/AutoUserProvisionToggle/AutoUserProvisionToggle.tsx b/app/react/portainer/settings/AuthenticationView/AutoUserProvisionToggle/AutoUserProvisionToggle.tsx
new file mode 100644
index 0000000..f317f9b
--- /dev/null
+++ b/app/react/portainer/settings/AuthenticationView/AutoUserProvisionToggle/AutoUserProvisionToggle.tsx
@@ -0,0 +1,35 @@
+import { AutomationTestingProps } from '@/types';
+
+import { FormSection } from '@@/form-components/FormSection';
+import { SwitchField } from '@@/form-components/SwitchField';
+
+interface AutoUserProvisionToggleProps extends Partial<AutomationTestingProps> {
+  value: boolean;
+  onChange: (value: boolean) => void;
+  description: string;
+}
+
+export function AutoUserProvisionToggle({
+  value,
+  onChange,
+  description,
+  'data-cy': dataCy = 'auto-user-provision-toggle',
+}: AutoUserProvisionToggleProps) {
+  return (
+    <FormSection title="Automatic user provisioning">
+      <div className="form-group">
+        <span className="col-sm-12 text-muted small">{description}</span>
+      </div>
+      <div className="form-group">
+        <div className="col-sm-12">
+          <SwitchField
+            label="Automatic user provisioning"
+            checked={value}
+            onChange={onChange}
+            data-cy={dataCy}
+          />
+        </div>
+      </div>
+    </FormSection>
+  );
+}
diff --git a/app/react/portainer/settings/AuthenticationView/InternalAuth/Badge.tsx b/app/react/portainer/settings/AuthenticationView/InternalAuth/Badge.tsx
new file mode 100644
index 0000000..9d63b67
--- /dev/null
+++ b/app/react/portainer/settings/AuthenticationView/InternalAuth/Badge.tsx
@@ -0,0 +1,30 @@
+import { ReactNode } from 'react';
+
+export interface Props {
+  value: string;
+  icon?: ReactNode;
+  color: string;
+}
+
+// Helper function used as workaround to add opacity to the background color
+function setOpacity(hex: string, alpha: number) {
+  return `${hex}${Math.floor(alpha * 255)
+    .toString(16)
+    .padStart(2, '0')}`;
+}
+
+export function Badge({ icon, value, color }: Props) {
+  return (
+    <span
+      className="badge inline-flex items-center"
+      style={{
+        backgroundColor: setOpacity(color, 0.1),
+        color,
+        padding: '5px 10px',
+      }}
+    >
+      {icon}
+      {value}
+    </span>
+  );
+}
diff --git a/app/react/portainer/settings/AuthenticationView/InternalAuth/InternalAuth.tsx b/app/react/portainer/settings/AuthenticationView/InternalAuth/InternalAuth.tsx
new file mode 100644
index 0000000..8d0500e
--- /dev/null
+++ b/app/react/portainer/settings/AuthenticationView/InternalAuth/InternalAuth.tsx
@@ -0,0 +1,66 @@
+import { Settings } from '@/react/portainer/settings/types';
+
+import { confirmDestructive } from '@@/modals/confirm';
+import { FormSectionTitle } from '@@/form-components/FormSectionTitle';
+import { buildConfirmButton } from '@@/modals/utils';
+
+import { PasswordLengthSlider } from './PasswordLengthSlider/PasswordLengthSlider';
+import { SaveAuthSettingsButton } from './SaveAuthSettingsButton';
+
+export interface Props {
+  onSaveSettings(): void;
+  isLoading: boolean;
+  value: Settings['InternalAuthSettings'];
+  onChange(value: number): void;
+}
+
+export function InternalAuth({
+  onSaveSettings,
+  isLoading,
+  value,
+  onChange,
+}: Props) {
+  async function onSubmit() {
+    if (value.RequiredPasswordLength < 10) {
+      const confirmed = await confirmDestructive({
+        title: 'Allow weak passwords?',
+        message:
+          'You have set an insecure minimum password length. This could leave your system vulnerable to attack, are you sure?',
+        confirmButton: buildConfirmButton('Yes', 'danger'),
+      });
+
+      if (confirmed) {
+        onSaveSettings();
+      }
+    } else {
+      onSaveSettings();
+    }
+  }
+
+  return (
+    <>
+      <FormSectionTitle>Information</FormSectionTitle>
+      <div className="form-group col-sm-12 text-muted small">
+        When using internal authentication, Portainer will encrypt user
+        passwords and store credentials locally.
+      </div>
+
+      <FormSectionTitle>Password rules</FormSectionTitle>
+      <div className="form-group col-sm-12 text-muted small">
+        Define minimum length for user-generated passwords.
+      </div>
+
+      <div className="form-group">
+        <PasswordLengthSlider
+          min={1}
+          max={18}
+          step={1}
+          value={value.RequiredPasswordLength}
+          onChange={onChange}
+        />
+      </div>
+
+      <SaveAuthSettingsButton onSubmit={onSubmit} isLoading={isLoading} />
+    </>
+  );
+}
diff --git a/app/react/portainer/settings/AuthenticationView/InternalAuth/PasswordLengthSlider/PasswordLengthSlider.module.css b/app/react/portainer/settings/AuthenticationView/InternalAuth/PasswordLengthSlider/PasswordLengthSlider.module.css
new file mode 100644
index 0000000..76ae889
--- /dev/null
+++ b/app/react/portainer/settings/AuthenticationView/InternalAuth/PasswordLengthSlider/PasswordLengthSlider.module.css
@@ -0,0 +1,21 @@
+.slider-badge {
+  top: -2px;
+}
+
+.root {
+  margin-left: 15px;
+  margin-top: 200px;
+}
+
+.root :global(.rc-slider-tooltip-inner) {
+  height: auto;
+  padding: 10px;
+  background-color: var(--bg-tooltip-color);
+  min-width: max-content;
+  color: var(--text-tooltip-color);
+  box-shadow: var(--shadow-box-color);
+}
+
+.root :global(.rc-slider-tooltip-arrow) {
+  border-top-color: var(--bg-tooltip-color);
+}
diff --git a/app/react/portainer/settings/AuthenticationView/InternalAuth/PasswordLengthSlider/PasswordLengthSlider.tsx b/app/react/portainer/settings/AuthenticationView/InternalAuth/PasswordLengthSlider/PasswordLengthSlider.tsx
new file mode 100644
index 0000000..13d8818
--- /dev/null
+++ b/app/react/portainer/settings/AuthenticationView/InternalAuth/PasswordLengthSlider/PasswordLengthSlider.tsx
@@ -0,0 +1,127 @@
+import { useCallback } from 'react';
+import RcSlider from 'rc-slider';
+import clsx from 'clsx';
+import { Lock, XCircle, CheckCircle } from 'lucide-react';
+
+import { SliderTooltip } from '@@/Tip/SliderTooltip';
+
+import 'rc-slider/assets/index.css';
+
+import { Badge } from '../Badge';
+
+import styles from './PasswordLengthSlider.module.css';
+
+export interface Props {
+  min: number;
+  max: number;
+  step: number;
+  value: number;
+  onChange(value: number | number[]): void;
+}
+
+type Strength = 'weak' | 'good' | 'strong' | 'veryStrong';
+
+const sliderProperties: Record<
+  Strength,
+  { strength: string; color: string; text: string }
+> = {
+  weak: {
+    strength: 'weak',
+    color: '#F04438',
+    text: 'Weak password',
+  },
+  good: {
+    strength: 'good',
+    color: '#F79009',
+    text: 'Good password',
+  },
+  strong: {
+    strength: 'strong',
+    color: '#12B76A',
+    text: 'Strong password',
+  },
+  veryStrong: {
+    strength: 'veryStrong',
+    color: '#0BA5EC',
+    text: 'Very strong password',
+  },
+};
+
+export function PasswordLengthSlider({
+  min,
+  max,
+  step,
+  value,
+  onChange,
+}: Props) {
+  const sliderProps = getSliderProps(value);
+
+  function getSliderProps(value: number) {
+    if (value < 10) {
+      return sliderProperties.weak;
+    }
+
+    if (value < 12) {
+      return sliderProperties.good;
+    }
+
+    if (value < 14) {
+      return sliderProperties.strong;
+    }
+
+    return sliderProperties.veryStrong;
+  }
+
+  function getBadgeIcon(strength: string) {
+    switch (strength) {
+      case 'weak':
+        return <XCircle size="13" className="space-right" strokeWidth="3px" />;
+      case 'good':
+      case 'strong':
+        return (
+          <CheckCircle size="13" className="space-right" strokeWidth="3px" />
+        );
+      default:
+        return <Lock size="13" className="space-right" strokeWidth="3px" />;
+    }
+  }
+
+  function handleChange(sliderValue: number | number[]) {
+    onChange(sliderValue);
+  }
+
+  const sliderTooltip = useCallback(
+    (node, handleProps) => (
+      <SliderTooltip
+        value={`${handleProps.value} characters`}
+        child={node}
+        delay={800}
+      />
+    ),
+    []
+  );
+
+  return (
+    <div className={clsx(styles.root, styles[sliderProps.strength])}>
+      <div className="col-sm-4">
+        <RcSlider
+          handleRender={sliderTooltip}
+          min={min}
+          max={max}
+          step={step}
+          defaultValue={12}
+          value={value}
+          onChange={handleChange}
+        />
+      </div>
+
+      <div className={clsx('col-sm-2', styles.sliderBadge)}>
+        <Badge
+          icon={getBadgeIcon(sliderProps.strength)}
+          value={sliderProps.text}
+          color={sliderProps.color}
+        />
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/portainer/settings/AuthenticationView/InternalAuth/SaveAuthSettingsButton.tsx b/app/react/portainer/settings/AuthenticationView/InternalAuth/SaveAuthSettingsButton.tsx
new file mode 100644
index 0000000..c32bc7c
--- /dev/null
+++ b/app/react/portainer/settings/AuthenticationView/InternalAuth/SaveAuthSettingsButton.tsx
@@ -0,0 +1,27 @@
+import { LoadingButton } from '@@/buttons/LoadingButton';
+import { FormSectionTitle } from '@@/form-components/FormSectionTitle';
+
+export interface Props {
+  onSubmit(): void;
+  isLoading: boolean;
+}
+
+export function SaveAuthSettingsButton({ onSubmit, isLoading }: Props) {
+  return (
+    <>
+      <FormSectionTitle>Actions</FormSectionTitle>
+      <div className="form-group">
+        <div className="col-sm-12">
+          <LoadingButton
+            loadingText="Saving..."
+            data-cy="save-auth-settings-button"
+            isLoading={isLoading}
+            onClick={() => onSubmit()}
+          >
+            Save settings
+          </LoadingButton>
+        </div>
+      </div>
+    </>
+  );
+}
diff --git a/app/react/portainer/settings/AuthenticationView/InternalAuth/index.ts b/app/react/portainer/settings/AuthenticationView/InternalAuth/index.ts
new file mode 100644
index 0000000..1dcfda3
--- /dev/null
+++ b/app/react/portainer/settings/AuthenticationView/InternalAuth/index.ts
@@ -0,0 +1 @@
+export { InternalAuth } from './InternalAuth';
diff --git a/app/react/portainer/settings/AuthenticationView/LDAPAuth/AdminGroupSearchConfigItem.tsx b/app/react/portainer/settings/AuthenticationView/LDAPAuth/AdminGroupSearchConfigItem.tsx
new file mode 100644
index 0000000..1e0065b
--- /dev/null
+++ b/app/react/portainer/settings/AuthenticationView/LDAPAuth/AdminGroupSearchConfigItem.tsx
@@ -0,0 +1,101 @@
+import { Input } from '@@/form-components/Input';
+import { InputListActionButtons } from '@@/form-components/InputList/ActionButtons';
+import { FormControl } from '@@/form-components/FormControl';
+
+import { LDAPGroupSearchSettings } from '../../types';
+
+interface AdminGroupSearchConfigItemProps {
+  value: LDAPGroupSearchSettings;
+  index: number;
+  count: number;
+  isLimited: boolean;
+  onChange: (value: LDAPGroupSearchSettings) => void;
+  onRemove: () => void;
+}
+
+export function AdminGroupSearchConfigItem({
+  value,
+  index,
+  count,
+  isLimited,
+  onChange,
+  onRemove,
+}: AdminGroupSearchConfigItemProps) {
+  return (
+    <>
+      <div className="flex gap-5">
+        <FormControl
+          size="large"
+          className="w-1/2 flex-1"
+          label="Group Base DN"
+          tooltip="The distinguished name of the element from which the LDAP server will search for groups."
+          inputId={`ldap_admin_group_basedn_${index}`}
+        >
+          <Input
+            id={`ldap_admin_group_basedn_${index}`}
+            data-cy="ldap-admin-group-basedn"
+            value={value.GroupBaseDN}
+            onChange={(e) =>
+              onChange({ ...value, GroupBaseDN: e.target.value })
+            }
+            placeholder="dc=ldap,dc=domain,dc=tld"
+            disabled={isLimited}
+            className={isLimited ? 'limited-be border-0' : undefined}
+          />
+        </FormControl>
+
+        <FormControl
+          size="large"
+          className="w-1/2 flex-1"
+          label="Group Membership Attribute"
+          tooltip="LDAP attribute which denotes the group membership."
+          inputId={`ldap_admin_group_att_${index}`}
+        >
+          <Input
+            id={`ldap_admin_group_att_${index}`}
+            data-cy="ldap-admin-group-att"
+            value={value.GroupAttribute}
+            onChange={(e) =>
+              onChange({ ...value, GroupAttribute: e.target.value })
+            }
+            placeholder="member"
+            disabled={isLimited}
+            className={isLimited ? 'limited-be border-0' : undefined}
+          />
+        </FormControl>
+      </div>
+
+      <div className="flex">
+        <FormControl
+          size="small"
+          className="w-full flex-1"
+          label="Group Filter"
+          tooltip="The LDAP search filter used to select group elements, optional."
+          inputId={`ldap_admin_group_filter_${index}`}
+        >
+          <div className="vertical-center">
+            <Input
+              id={`ldap_admin_group_filter_${index}`}
+              data-cy="ldap-admin-group-filter"
+              value={value.GroupFilter}
+              onChange={(e) =>
+                onChange({ ...value, GroupFilter: e.target.value })
+              }
+              placeholder="(objectClass=groupOfNames)"
+              className={isLimited ? 'limited-be border-0' : undefined}
+              disabled={isLimited}
+            />
+            <InputListActionButtons
+              index={index}
+              count={count}
+              showDelete={index > 0}
+              onDelete={onRemove}
+              disabled={isLimited}
+              data-cy="admin-group-search"
+            />
+          </div>
+        </FormControl>
+      </div>
+    </>
+  );
+}
diff --git a/app/react/portainer/settings/AuthenticationView/LDAPAuth/AdminGroupsSection.test.tsx b/app/react/portainer/settings/AuthenticationView/LDAPAuth/AdminGroupsSection.test.tsx
new file mode 100644
index 0000000..e0f15e3
--- /dev/null
+++ b/app/react/portainer/settings/AuthenticationView/LDAPAuth/AdminGroupsSection.test.tsx
@@ -0,0 +1,167 @@
+import { render, screen, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { describe, expect, test, vi } from 'vitest';
+import { ComponentProps } from 'react';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+
+import { AdminGroupsSection } from './AdminGroupsSection';
+
+const Wrapped = withTestQueryProvider(AdminGroupsSection);
+
+const defaultSearchSettings = [
+  { GroupBaseDN: '', GroupAttribute: '', GroupFilter: '' },
+];
+
+describe('AdminGroupsSection', () => {
+  test('renders section title and fetch button', () => {
+    renderComponent();
+
+    expect(screen.getByText(/auto-populate team admins/i)).toBeVisible();
+    expect(
+      screen.getByRole('button', { name: /fetch admin group\(s\)/i })
+    ).toBeVisible();
+  });
+
+  test('renders one config item with toggle disabled and no group selector', () => {
+    renderComponent();
+
+    expect(
+      screen.getAllByRole('textbox', { name: /group base dn/i })
+    ).toHaveLength(1);
+    expect(
+      screen.getByRole('checkbox', { name: /assign admin rights/i })
+    ).toBeDisabled();
+    expect(
+      screen.queryByLabelText(/select group\(s\)/i)
+    ).not.toBeInTheDocument();
+  });
+
+  test('add button calls onSearchSettingsChange with a new empty item', async () => {
+    const user = userEvent.setup();
+    const onSearchSettingsChange = vi.fn();
+    renderComponent({ onSearchSettingsChange });
+
+    await user.click(
+      screen.getByRole('button', { name: /add group search configuration/i })
+    );
+
+    expect(onSearchSettingsChange).toHaveBeenCalledWith(
+      [
+        ...defaultSearchSettings,
+        { GroupBaseDN: '', GroupAttribute: '', GroupFilter: '' },
+      ],
+      expect.anything()
+    );
+  });
+
+  test('first config item has no delete button, second does', () => {
+    renderComponent({
+      searchSettings: [
+        { GroupBaseDN: '', GroupAttribute: '', GroupFilter: '' },
+        { GroupBaseDN: '', GroupAttribute: '', GroupFilter: '' },
+      ],
+    });
+
+    const firstWidget = screen.getByRole('region', {
+      name: 'Admin group search configuration 1',
+    });
+    const secondWidget = screen.getByRole('region', {
+      name: 'Admin group search configuration 2',
+    });
+
+    expect(
+      within(firstWidget).queryByRole('button', { name: 'Remove item' })
+    ).not.toBeInTheDocument();
+    expect(
+      within(firstWidget).queryByText('Extra search configuration')
+    ).not.toBeInTheDocument();
+    expect(
+      within(secondWidget).getByText('Extra search configuration')
+    ).toBeVisible();
+    expect(
+      within(secondWidget).getByRole('button', { name: 'Remove item' })
+    ).toBeVisible();
+  });
+
+  test('calls onSearchSettingsChange without deleted item when delete is clicked', async () => {
+    const user = userEvent.setup();
+    const onSearchSettingsChange = vi.fn();
+    const firstItem = {
+      GroupBaseDN: 'dc=example,dc=com',
+      GroupAttribute: 'member',
+      GroupFilter: '',
+    };
+
+    renderComponent({
+      onSearchSettingsChange,
+      searchSettings: [
+        firstItem,
+        { GroupBaseDN: '', GroupAttribute: '', GroupFilter: '' },
+      ],
+    });
+
+    const secondWidget = screen.getByRole('region', {
+      name: 'Admin group search configuration 2',
+    });
+    await user.click(
+      within(secondWidget).getByRole('button', { name: 'Remove item' })
+    );
+
+    expect(onSearchSettingsChange).toHaveBeenCalledWith(
+      [firstItem],
+      expect.anything()
+    );
+  });
+
+  test('calls onSearchSettingsChange when config fields are updated', async () => {
+    const user = userEvent.setup();
+    const onSearchSettingsChange = vi.fn();
+    renderComponent({ onSearchSettingsChange });
+
+    await user.type(
+      screen.getByRole('textbox', { name: /group base dn/i }),
+      'd'
+    );
+    expect(onSearchSettingsChange).toHaveBeenCalledWith(
+      [expect.objectContaining({ GroupBaseDN: 'd' })],
+      expect.anything()
+    );
+
+    await user.type(
+      screen.getByRole('textbox', { name: /group membership attribute/i }),
+      'm'
+    );
+    expect(onSearchSettingsChange).toHaveBeenCalledWith(
+      [expect.objectContaining({ GroupAttribute: 'm' })],
+      expect.anything()
+    );
+
+    await user.type(
+      screen.getByRole('textbox', { name: /group filter/i }),
+      '('
+    );
+    expect(onSearchSettingsChange).toHaveBeenCalledWith(
+      [expect.objectContaining({ GroupFilter: '(' })],
+      expect.anything()
+    );
+  });
+});
+
+function renderComponent(
+  overrides: Partial<ComponentProps<typeof AdminGroupsSection>> = {}
+) {
+  const props: ComponentProps<typeof AdminGroupsSection> = {
+    searchSettings: defaultSearchSettings,
+    onSearchSettingsChange: vi.fn(),
+    autoPopulate: false,
+    onAutoPopulateChange: vi.fn(),
+    selectedAdminGroups: [],
+    onSelectedAdminGroupsChange: vi.fn(),
+    groups: null,
+    isFetching: false,
+    onFetch: vi.fn(),
+    ...overrides,
+  };
+  return render(<Wrapped {...props} />);
+}
diff --git a/app/react/portainer/settings/AuthenticationView/LDAPAuth/AdminGroupsSection.tsx b/app/react/portainer/settings/AuthenticationView/LDAPAuth/AdminGroupsSection.tsx
new file mode 100644
index 0000000..5f4737b
--- /dev/null
+++ b/app/react/portainer/settings/AuthenticationView/LDAPAuth/AdminGroupsSection.tsx
@@ -0,0 +1,206 @@
+import { PlusIcon } from 'lucide-react';
+
+import { isLimitedToBE } from '@/react/portainer/feature-flags/feature-flags.service';
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+
+import { MultiSelect } from '@@/form-components/PortainerSelect';
+import { SwitchField } from '@@/form-components/SwitchField';
+import { Button } from '@@/buttons';
+import { LoadingButton } from '@@/buttons/LoadingButton';
+import { useInputList } from '@@/form-components/InputList/useInputList';
+import { Widget, WidgetBody } from '@@/Widget';
+import { FormSection } from '@@/form-components/FormSection';
+import { FormError } from '@@/form-components/FormError';
+import { BEFeatureIndicator } from '@@/BEFeatureIndicator';
+
+import { LDAPGroupSearchSettings } from '../../types';
+
+import { AdminGroupSearchConfigItem } from './AdminGroupSearchConfigItem';
+
+type CEProps = Omit<
+  AdminGroupsSectionProps,
+  'groups' | 'isFetching' | 'onFetch'
+>;
+
+export function AdminGroupsSectionCE({
+  searchSettings,
+  onSearchSettingsChange,
+  autoPopulate,
+  onAutoPopulateChange,
+  selectedAdminGroups,
+  onSelectedAdminGroupsChange,
+  limitedFeatureId,
+  isLimitedFeatureSelfContained,
+}: CEProps) {
+  return (
+    <AdminGroupsSection
+      searchSettings={searchSettings}
+      onSearchSettingsChange={onSearchSettingsChange}
+      autoPopulate={autoPopulate}
+      onAutoPopulateChange={onAutoPopulateChange}
+      selectedAdminGroups={selectedAdminGroups}
+      onSelectedAdminGroupsChange={onSelectedAdminGroupsChange}
+      limitedFeatureId={limitedFeatureId}
+      isLimitedFeatureSelfContained={isLimitedFeatureSelfContained}
+      groups={null}
+      isFetching={false}
+      onFetch={noop}
+    />
+  );
+}
+
+interface AdminGroupsSectionProps {
+  searchSettings: LDAPGroupSearchSettings[];
+  onSearchSettingsChange: (settings: LDAPGroupSearchSettings[]) => void;
+  autoPopulate: boolean;
+  onAutoPopulateChange: (value: boolean) => void;
+  selectedAdminGroups: string[];
+  onSelectedAdminGroupsChange: (groups: string[]) => void;
+  groups: string[] | null;
+  isFetching: boolean;
+  onFetch: () => void;
+  limitedFeatureId?: FeatureId;
+  isLimitedFeatureSelfContained?: boolean;
+}
+
+export function AdminGroupsSection({
+  searchSettings,
+  onSearchSettingsChange,
+  autoPopulate,
+  onAutoPopulateChange,
+  selectedAdminGroups,
+  onSelectedAdminGroupsChange,
+  groups,
+  isFetching,
+  onFetch,
+  limitedFeatureId,
+  isLimitedFeatureSelfContained,
+}: AdminGroupsSectionProps) {
+  const isLimited =
+    (isLimitedFeatureSelfContained ?? false) || isLimitedToBE(limitedFeatureId);
+
+  const { handleAdd, handleRemoveItem, handleChangeItem } = useInputList({
+    value: searchSettings,
+    onChange: onSearchSettingsChange,
+    itemBuilder: () => ({
+      GroupBaseDN: '',
+      GroupAttribute: '',
+      GroupFilter: '',
+    }),
+  });
+
+  const enableAssignAdminGroup = groups !== null && groups.length > 0;
+  const groupOptions = (groups ?? []).map((g) => ({ label: g, value: g }));
+
+  return (
+    <FormSection
+      title={
+        <>
+          Auto-populate team admins
+          {isLimitedFeatureSelfContained && limitedFeatureId && (
+            <BEFeatureIndicator featureId={limitedFeatureId} className="ml-2" />
+          )}
+        </>
+      }
+    >
+      <div className="space-y-3">
+        {searchSettings.map((config, index) => (
+          <Widget
+            key={index}
+            aria-label={`Admin group search configuration ${index + 1}`}
+          >
+            <WidgetBody>
+              {index > 0 && (
+                <div className="form-group mt-2">
+                  <span className="col-sm-12 text-muted small">
+                    Extra search configuration
+                  </span>
+                </div>
+              )}
+
+              <AdminGroupSearchConfigItem
+                value={config}
+                index={index}
+                count={searchSettings.length}
+                isLimited={isLimited}
+                onChange={(value) => handleChangeItem(index, value)}
+                onRemove={() => handleRemoveItem(index, config)}
+              />
+            </WidgetBody>
+          </Widget>
+        ))}
+      </div>
+
+      <div className="form-group mt-2">
+        <div className="col-sm-12">
+          <Button
+            color="light"
+            size="small"
+            disabled={isLimited}
+            onClick={handleAdd}
+            data-cy="add-group-btn"
+            icon={PlusIcon}
+          >
+            Add group search configuration
+          </Button>
+        </div>
+
+        <div className="col-sm-12 vertical-center mt-2">
+          <LoadingButton
+            color="primary"
+            size="medium"
+            type="button"
+            disabled={isLimited}
+            isLoading={isFetching}
+            loadingText="Fetching..."
+            onClick={onFetch}
+            className={isLimited ? 'limited-be' : undefined}
+            data-cy="ldap-fetch-admin-groups"
+          >
+            Fetch Admin Group(s)
+          </LoadingButton>
+          {!!groups && groups.length === 0 && (
+            <FormError>No groups found</FormError>
+          )}
+        </div>
+      </div>
+
+      <div className="form-group">
+        <div className="col-sm-12">
+          <SwitchField
+            label="Assign admin rights to group(s)"
+            checked={autoPopulate}
+            onChange={onAutoPopulateChange}
+            disabled={!enableAssignAdminGroup}
+            data-cy="admin-auto-populate"
+          />
+        </div>
+      </div>
+
+      {autoPopulate && enableAssignAdminGroup && (
+        <div className="form-group">
+          <label
+            htmlFor="group-access"
+            className="control-label col-sm-2 text-left"
+          >
+            Select Group(s)
+          </label>
+          <div className="col-sm-8">
+            <MultiSelect
+              inputId="group-access"
+              value={selectedAdminGroups}
+              onChange={onSelectedAdminGroupsChange}
+              options={groupOptions}
+              placeholder="Select one or more groups"
+              data-cy="group-access-selector"
+            />
+          </div>
+        </div>
+      )}
+    </FormSection>
+  );
+}
+
+function noop() {
+  // CE stub – admin group fetch is a BE-only feature
+}
diff --git a/app/react/portainer/settings/AuthenticationView/LDAPAuth/DnEntriesField/DnBuilder.test.tsx b/app/react/portainer/settings/AuthenticationView/LDAPAuth/DnEntriesField/DnBuilder.test.tsx
new file mode 100644
index 0000000..0699918
--- /dev/null
+++ b/app/react/portainer/settings/AuthenticationView/LDAPAuth/DnEntriesField/DnBuilder.test.tsx
@@ -0,0 +1,60 @@
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { describe, it, expect, vi } from 'vitest';
+
+import { DnBuilder } from './DnBuilder';
+
+describe('DnBuilder', () => {
+  it('does not call onChange on initial render when value already matches suffix', () => {
+    const onChange = vi.fn();
+    const suffix = 'dc=example,dc=com';
+
+    render(<DnBuilder value={suffix} suffix={suffix} onChange={onChange} />);
+
+    expect(onChange).not.toHaveBeenCalled();
+  });
+
+  it('calls onChange with the correct DN when an entry changes', async () => {
+    const user = userEvent.setup();
+    const onChange = vi.fn();
+
+    render(
+      <DnBuilder
+        value="ou=Users,dc=example,dc=com"
+        suffix="dc=example,dc=com"
+        onChange={onChange}
+      />
+    );
+
+    const input = screen.getByRole('textbox');
+    await user.type(input, 'X');
+
+    expect(onChange).toHaveBeenLastCalledWith('ou=UsersX,dc=example,dc=com');
+  });
+
+  it('re-parses entries when value prop changes without calling onChange', () => {
+    const onChange = vi.fn();
+    const suffix = 'dc=example,dc=com';
+
+    const { rerender } = render(
+      <DnBuilder
+        value="ou=users,dc=example,dc=com"
+        suffix={suffix}
+        onChange={onChange}
+      />
+    );
+
+    onChange.mockClear();
+
+    rerender(
+      <DnBuilder
+        value="ou=admins,dc=example,dc=com"
+        suffix={suffix}
+        onChange={onChange}
+      />
+    );
+
+    expect(onChange).not.toHaveBeenCalled();
+    expect(screen.getByRole('textbox')).toHaveValue('admins');
+  });
+});
diff --git a/app/react/portainer/settings/AuthenticationView/LDAPAuth/DnEntriesField/DnBuilder.tsx b/app/react/portainer/settings/AuthenticationView/LDAPAuth/DnEntriesField/DnBuilder.tsx
new file mode 100644
index 0000000..fbac790
--- /dev/null
+++ b/app/react/portainer/settings/AuthenticationView/LDAPAuth/DnEntriesField/DnBuilder.tsx
@@ -0,0 +1,48 @@
+import { useCallback, useEffect, useState } from 'react';
+
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+
+import { DnEntriesField } from './DnEntriesField';
+import { parseDN, buildDN, DnEntry } from './ldap-dn-utils';
+
+interface Props {
+  value: string | undefined;
+  suffix: string;
+  onChange: (dn: string) => void;
+  label?: string;
+  limitedFeatureId?: FeatureId;
+}
+
+export function DnBuilder({
+  value,
+  suffix,
+  onChange,
+  label,
+  limitedFeatureId,
+}: Props) {
+  const [entries, setEntries] = useState<DnEntry[]>([]);
+
+  const handleEntriesChange = useCallback(
+    (newEntries: DnEntry[]) => {
+      setEntries(newEntries);
+      const dn = buildDN(newEntries, suffix);
+      if (dn !== value) {
+        onChange(dn);
+      }
+    },
+    [suffix, value, onChange]
+  );
+
+  useEffect(() => {
+    handleEntriesChange(parseDN(value, suffix));
+  }, [value, suffix, handleEntriesChange]);
+
+  return (
+    <DnEntriesField
+      value={entries}
+      onChange={handleEntriesChange}
+      label={label}
+      limitedFeatureId={limitedFeatureId}
+    />
+  );
+}
diff --git a/app/react/portainer/settings/AuthenticationView/LDAPAuth/DnEntriesField/DnEntriesField.test.tsx b/app/react/portainer/settings/AuthenticationView/LDAPAuth/DnEntriesField/DnEntriesField.test.tsx
new file mode 100644
index 0000000..3b42ad1
--- /dev/null
+++ b/app/react/portainer/settings/AuthenticationView/LDAPAuth/DnEntriesField/DnEntriesField.test.tsx
@@ -0,0 +1,78 @@
+import { useState } from 'react';
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { describe, it, expect, vi } from 'vitest';
+
+import { DnEntriesField } from './DnEntriesField';
+import { DnEntry } from './ldap-dn-utils';
+
+function StatefulDnEntriesField({
+  initialEntries,
+  onChange,
+  label,
+}: {
+  initialEntries: DnEntry[];
+  onChange: (entries: DnEntry[]) => void;
+  label?: string;
+}) {
+  const [entries, setEntries] = useState(initialEntries);
+  return (
+    <DnEntriesField
+      value={entries}
+      onChange={(newEntries) => {
+        setEntries(newEntries);
+        onChange(newEntries);
+      }}
+      label={label}
+    />
+  );
+}
+
+describe('DnEntriesField', () => {
+  it('should display DN entries', () => {
+    const onChange = vi.fn();
+    const entries: DnEntry[] = [
+      { type: 'ou', value: 'Users' },
+      { type: 'ou', value: 'Department' },
+    ];
+
+    render(
+      <StatefulDnEntriesField
+        initialEntries={entries}
+        onChange={onChange}
+        label="Test DN Builder"
+      />
+    );
+
+    expect(screen.getByText('Test DN Builder')).toBeInTheDocument();
+
+    const selects = screen.getAllByRole('combobox');
+    expect(selects).toHaveLength(2);
+    expect(selects[0]).toHaveValue('ou');
+    expect(selects[1]).toHaveValue('ou');
+
+    const inputs = screen.getAllByRole('textbox');
+    expect(inputs[0]).toHaveValue('Users');
+    expect(inputs[1]).toHaveValue('Department');
+  });
+
+  it('should call onChange with updated entries when an entry is modified', async () => {
+    const user = userEvent.setup();
+    const onChange = vi.fn();
+
+    render(
+      <StatefulDnEntriesField
+        initialEntries={[{ type: 'ou', value: 'Users' }]}
+        onChange={onChange}
+      />
+    );
+
+    const inputs = screen.getAllByRole('textbox');
+    await user.clear(inputs[0]);
+    await user.type(inputs[0], 'TestUsers');
+
+    expect(onChange).toHaveBeenLastCalledWith([
+      { type: 'ou', value: 'TestUsers' },
+    ]);
+  });
+});
diff --git a/app/react/portainer/settings/AuthenticationView/LDAPAuth/DnEntriesField/DnEntriesField.tsx b/app/react/portainer/settings/AuthenticationView/LDAPAuth/DnEntriesField/DnEntriesField.tsx
new file mode 100644
index 0000000..5a98752
--- /dev/null
+++ b/app/react/portainer/settings/AuthenticationView/LDAPAuth/DnEntriesField/DnEntriesField.tsx
@@ -0,0 +1,125 @@
+import { Plus } from 'lucide-react';
+
+import { isLimitedToBE } from '@/react/portainer/feature-flags/feature-flags.service';
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+
+import { Select, Input } from '@@/form-components/Input';
+import { Widget, WidgetBody } from '@@/Widget';
+import { Button } from '@@/buttons';
+import { useInputList } from '@@/form-components/InputList/useInputList';
+import { InputListActionButtons } from '@@/form-components/InputList/ActionButtons';
+
+import { DnEntry } from './ldap-dn-utils';
+
+const typeOptions = [
+  { label: 'OU Name', value: 'ou' },
+  { label: 'Folder Name', value: 'cn' },
+] as const;
+
+export function DnEntriesField({
+  value,
+  onChange,
+  label = 'DN entries',
+  limitedFeatureId,
+}: {
+  value: DnEntry[];
+  onChange: (entries: DnEntry[]) => void;
+  label?: string;
+  limitedFeatureId?: FeatureId;
+}) {
+  const isLimited = isLimitedToBE(limitedFeatureId);
+
+  const {
+    handleMoveUp,
+    handleMoveDown,
+    handleRemoveItem,
+    handleAdd,
+    handleChangeItem,
+  } = useInputList({
+    value,
+    onChange,
+    itemBuilder: () => ({ type: 'ou' as const, value: '' }),
+    movable: true,
+  });
+
+  return (
+    <>
+      <div>
+        <label className="control-label text-left">{label}</label>
+        <Button
+          onClick={handleAdd}
+          size="xsmall"
+          color="light"
+          icon={Plus}
+          className="ml-2 !border-0"
+          data-cy="ldap-dn-builder-add-button"
+          disabled={isLimited}
+        >
+          add another entry
+        </Button>
+      </div>
+      {value.length > 0 && (
+        <Widget className="mt-1">
+          <WidgetBody>
+            <div className="flex flex-col gap-y-5">
+              {value.map((entry, index) => (
+                <div key={index} className="flex">
+                  <DnEntryItem
+                    item={entry}
+                    onChange={(newEntry) => handleChangeItem(index, newEntry)}
+                    disabled={isLimited}
+                    readOnly={isLimited}
+                  />
+                  <InputListActionButtons
+                    index={index}
+                    count={value.length}
+                    movable
+                    onMoveUp={() => handleMoveUp(index)}
+                    onMoveDown={() => handleMoveDown(index)}
+                    onDelete={() => handleRemoveItem(index, entry)}
+                    data-cy="ldap-dn-builder"
+                    disabled={isLimited}
+                  />
+                </div>
+              ))}
+            </div>
+          </WidgetBody>
+        </Widget>
+      )}
+    </>
+  );
+}
+
+interface DnEntryItemProps {
+  item: DnEntry;
+  onChange: (value: DnEntry) => void;
+  disabled?: boolean;
+  readOnly?: boolean;
+}
+
+function DnEntryItem({ item, onChange, disabled, readOnly }: DnEntryItemProps) {
+  return (
+    <div className="flex w-full gap-2">
+      <div className="w-1/3">
+        <Select
+          options={typeOptions}
+          value={item.type}
+          onChange={(e) =>
+            onChange({ ...item, type: e.target.value as 'ou' | 'cn' })
+          }
+          disabled={disabled}
+          data-cy="ldap-dn-builder-select"
+        />
+      </div>
+      <div className="w-5/12">
+        <Input
+          value={item.value}
+          onChange={(e) => onChange({ ...item, value: e.target.value })}
+          disabled={disabled}
+          readOnly={readOnly}
+          data-cy="ldap-dn-builder-input"
+        />
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/portainer/settings/AuthenticationView/LDAPAuth/DnEntriesField/GroupDnBuilder.test.tsx b/app/react/portainer/settings/AuthenticationView/LDAPAuth/DnEntriesField/GroupDnBuilder.test.tsx
new file mode 100644
index 0000000..5cc8c32
--- /dev/null
+++ b/app/react/portainer/settings/AuthenticationView/LDAPAuth/DnEntriesField/GroupDnBuilder.test.tsx
@@ -0,0 +1,100 @@
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { describe, it, expect, vi } from 'vitest';
+
+import { GroupDnBuilder, parseGroupName, buildGroupDN } from './GroupDnBuilder';
+import { DnEntry } from './ldap-dn-utils';
+
+describe('GroupDnBuilder', () => {
+  it('should parse and display group name from value', () => {
+    render(
+      <GroupDnBuilder
+        value="cn=Admins,ou=Groups,dc=example,dc=com"
+        suffix="dc=example,dc=com"
+        onChange={vi.fn()}
+        index={0}
+      />
+    );
+
+    expect(screen.getByRole('textbox', { name: /group name/i })).toHaveValue(
+      'Admins'
+    );
+  });
+
+  it('should call onChange with index and updated DN when group name changes', async () => {
+    const user = userEvent.setup();
+    const onChange = vi.fn();
+
+    render(
+      <GroupDnBuilder
+        value=""
+        suffix="dc=example,dc=com"
+        onChange={onChange}
+        index={0}
+      />
+    );
+
+    await user.type(
+      screen.getByRole('textbox', { name: /group name/i }),
+      'Admins'
+    );
+
+    expect(onChange).toHaveBeenLastCalledWith(0, 'cn=Admins,dc=example,dc=com');
+  });
+
+  it('should render remove button when onRemoveClick is provided', () => {
+    render(
+      <GroupDnBuilder
+        value="cn=Admins,dc=example,dc=com"
+        suffix="dc=example,dc=com"
+        onChange={vi.fn()}
+        onRemoveClick={vi.fn()}
+        index={0}
+      />
+    );
+
+    expect(screen.getByTestId('group-dn-remove-button')).toBeInTheDocument();
+  });
+});
+
+describe('parseGroupName', () => {
+  it('should extract group name from a full DN', () => {
+    expect(
+      parseGroupName(
+        'cn=Admins,ou=Groups,dc=example,dc=com',
+        'dc=example,dc=com'
+      )
+    ).toBe('Admins');
+  });
+
+  it('should return empty string when value equals suffix', () => {
+    expect(parseGroupName('dc=example,dc=com', 'dc=example,dc=com')).toBe('');
+  });
+
+  it('should return empty string for empty value', () => {
+    expect(parseGroupName('', 'dc=example,dc=com')).toBe('');
+  });
+});
+
+describe('buildGroupDN', () => {
+  it('should build a full group DN with path entries', () => {
+    const entries: DnEntry[] = [{ type: 'ou', value: 'Groups' }];
+    expect(buildGroupDN('Admins', entries, 'dc=example,dc=com')).toBe(
+      'cn=Admins,ou=Groups,dc=example,dc=com'
+    );
+  });
+
+  it('should fall back to suffix when entries are empty', () => {
+    expect(buildGroupDN('Admins', [], 'dc=example,dc=com')).toBe(
+      'cn=Admins,dc=example,dc=com'
+    );
+  });
+
+  it('should build DN without suffix when entries and suffix are empty', () => {
+    expect(buildGroupDN('Admins', [], '')).toBe('cn=Admins');
+  });
+
+  it('should return suffix when group name is empty', () => {
+    expect(buildGroupDN('', [], 'dc=example,dc=com')).toBe('dc=example,dc=com');
+  });
+});
diff --git a/app/react/portainer/settings/AuthenticationView/LDAPAuth/DnEntriesField/GroupDnBuilder.tsx b/app/react/portainer/settings/AuthenticationView/LDAPAuth/DnEntriesField/GroupDnBuilder.tsx
new file mode 100644
index 0000000..1b90a27
--- /dev/null
+++ b/app/react/portainer/settings/AuthenticationView/LDAPAuth/DnEntriesField/GroupDnBuilder.tsx
@@ -0,0 +1,98 @@
+import { useEffect, useState } from 'react';
+
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+import { isLimitedToBE } from '@/react/portainer/feature-flags/feature-flags.service';
+
+import { DnEntriesField } from './DnEntriesField';
+import { GroupNameField } from './GroupNameField';
+import { DnEntry, parseDN, buildDN } from './ldap-dn-utils';
+
+interface Props {
+  value: string;
+  onChange: (index: number, dn: string) => void;
+  suffix: string;
+  index: number;
+  onRemoveClick?: (index: number) => void;
+  limitedFeatureId?: FeatureId;
+}
+
+export function GroupDnBuilder({
+  value,
+  onChange,
+  suffix,
+  index,
+  onRemoveClick,
+  limitedFeatureId,
+}: Props) {
+  const isLimited = isLimitedToBE(limitedFeatureId);
+  const [groupName, setGroupName] = useState(() =>
+    parseGroupName(value, suffix)
+  );
+  const [entries, setEntries] = useState<DnEntry[]>(() =>
+    parseDN(parsePath(value, suffix), suffix)
+  );
+
+  useEffect(() => {
+    const groupName = parseGroupName(value, suffix);
+    const entries = parseDN(parsePath(value, suffix), suffix);
+    setGroupName(groupName);
+    setEntries(entries);
+    const dn = buildGroupDN(groupName, entries, suffix);
+    if (dn !== value) {
+      onChange(index, dn);
+    }
+  }, [index, onChange, suffix, value]);
+
+  return (
+    <>
+      <GroupNameField
+        id={`group-name-input-${index}`}
+        value={groupName}
+        onChange={(newGroupName) => {
+          setGroupName(newGroupName);
+          onChange(index, buildGroupDN(newGroupName, entries, suffix));
+        }}
+        disabled={isLimited}
+        onRemoveClick={onRemoveClick ? () => onRemoveClick(index) : undefined}
+      />
+      <DnEntriesField
+        value={entries}
+        onChange={(entries: DnEntry[]) => {
+          setEntries(entries);
+          if (groupName) {
+            onChange(index, buildGroupDN(groupName, entries, suffix));
+          }
+        }}
+        label="Path to group"
+        limitedFeatureId={limitedFeatureId}
+      />
+    </>
+  );
+}
+
+export function parseGroupName(value: string, suffix: string): string {
+  if (!value || value === suffix) return '';
+  const [groupNamePart] = value.split(/,(.+)/);
+  return groupNamePart.replace(/^cn=/i, '');
+}
+
+function parsePath(value: string, suffix: string): string {
+  if (!value || value === suffix) return suffix;
+  const [, rest] = value.split(/,(.+)/);
+  return rest || suffix;
+}
+
+export function buildGroupDN(
+  groupName: string,
+  entries: DnEntry[],
+  suffix: string
+): string {
+  if (!groupName) {
+    return suffix;
+  }
+
+  const groupNameEntry = `cn=${groupName}`;
+  const path = buildDN(entries, suffix);
+  const pathPart = path && path !== suffix ? path : suffix;
+  return pathPart ? `${groupNameEntry},${pathPart}` : groupNameEntry;
+}
diff --git a/app/react/portainer/settings/AuthenticationView/LDAPAuth/DnEntriesField/GroupNameField.tsx b/app/react/portainer/settings/AuthenticationView/LDAPAuth/DnEntriesField/GroupNameField.tsx
new file mode 100644
index 0000000..e03f360
--- /dev/null
+++ b/app/react/portainer/settings/AuthenticationView/LDAPAuth/DnEntriesField/GroupNameField.tsx
@@ -0,0 +1,54 @@
+import { Trash2 } from 'lucide-react';
+
+import { Input } from '@@/form-components/Input';
+import { Button } from '@@/buttons';
+
+interface Props {
+  id: string;
+  value: string;
+  onChange: (value: string) => void;
+  disabled: boolean;
+  onRemoveClick?: () => void;
+}
+
+export function GroupNameField({
+  id,
+  value,
+  onChange,
+  disabled,
+  onRemoveClick,
+}: Props) {
+  return (
+    <div className="form-group">
+      <label htmlFor={id} className="col-sm-4 control-label text-left">
+        Group Name
+      </label>
+      <div className="col-sm-7 pl-0">
+        <Input
+          id={id}
+          data-cy="group-name-input"
+          value={value}
+          onChange={(e) => onChange(e.target.value)}
+          disabled={disabled}
+          readOnly={disabled}
+        />
+      </div>
+      {onRemoveClick && (
+        <div className="col-sm-1">
+          <Button
+            type="button"
+            color="danger"
+            size="medium"
+            className="vertical-center"
+            onClick={onRemoveClick}
+            disabled={disabled}
+            icon={Trash2}
+            data-cy="group-dn-remove-button"
+            title="Remove Group"
+            aria-label="Remove Group"
+          />
+        </div>
+      )}
+    </div>
+  );
+}
diff --git a/app/react/portainer/settings/AuthenticationView/LDAPAuth/DnEntriesField/ldap-dn-utils.test.ts b/app/react/portainer/settings/AuthenticationView/LDAPAuth/DnEntriesField/ldap-dn-utils.test.ts
new file mode 100644
index 0000000..4d4c3c1
--- /dev/null
+++ b/app/react/portainer/settings/AuthenticationView/LDAPAuth/DnEntriesField/ldap-dn-utils.test.ts
@@ -0,0 +1,154 @@
+import { describe, it, expect } from 'vitest';
+
+import { parseDN, buildDN, DnEntry } from './ldap-dn-utils';
+
+describe('parseDN', () => {
+  it('should parse DN with OU entries', () => {
+    const dn = 'ou=Users,ou=Department,dc=example,dc=com';
+    const suffix = 'dc=example,dc=com';
+
+    const result = parseDN(dn, suffix);
+
+    expect(result).toEqual([
+      { type: 'ou', value: 'Users' },
+      { type: 'ou', value: 'Department' },
+    ]);
+  });
+
+  it('should parse DN with mixed OU and CN entries', () => {
+    const dn = 'cn=Admins,ou=Groups,dc=example,dc=com';
+    const suffix = 'dc=example,dc=com';
+
+    const result = parseDN(dn, suffix);
+
+    expect(result).toEqual([
+      { type: 'cn', value: 'Admins' },
+      { type: 'ou', value: 'Groups' },
+    ]);
+  });
+
+  it('should filter out non-OU/CN entries', () => {
+    const dn = 'uid=john,ou=Users,dc=example,dc=com';
+    const suffix = 'dc=example,dc=com';
+
+    const result = parseDN(dn, suffix);
+
+    expect(result).toEqual([{ type: 'ou', value: 'Users' }]);
+  });
+
+  it('should return empty array when DN equals the suffix', () => {
+    const suffix = 'dc=example,dc=com';
+
+    const result = parseDN(suffix, suffix);
+
+    expect(result).toEqual([]);
+  });
+
+  it('should return empty array for empty DN', () => {
+    const result = parseDN('', '');
+
+    expect(result).toEqual([]);
+  });
+
+  it('should return empty array for undefined DN', () => {
+    const result = parseDN(undefined, 'dc=example,dc=com');
+
+    expect(result).toEqual([]);
+  });
+
+  it('should handle values with spaces', () => {
+    const result = parseDN(
+      'ou=Sales Team,ou=Department,dc=example,dc=com',
+      'dc=example,dc=com'
+    );
+
+    expect(result).toEqual([
+      { type: 'ou', value: 'Sales Team' },
+      { type: 'ou', value: 'Department' },
+    ]);
+  });
+
+  it('should handle values with underscores and numbers', () => {
+    const result = parseDN(
+      'ou=group_01,ou=dept_2,dc=example,dc=com',
+      'dc=example,dc=com'
+    );
+
+    expect(result).toEqual([
+      { type: 'ou', value: 'group_01' },
+      { type: 'ou', value: 'dept_2' },
+    ]);
+  });
+});
+
+describe('buildDN', () => {
+  it('should build DN from entries with suffix', () => {
+    const entries: DnEntry[] = [
+      { type: 'ou', value: 'Users' },
+      { type: 'ou', value: 'Department' },
+    ];
+    const suffix = 'dc=example,dc=com';
+
+    const result = buildDN(entries, suffix);
+
+    expect(result).toBe('ou=Users,ou=Department,dc=example,dc=com');
+  });
+
+  it('should build DN from mixed CN and OU entries with suffix', () => {
+    const entries: DnEntry[] = [
+      { type: 'cn', value: 'Admins' },
+      { type: 'ou', value: 'Groups' },
+    ];
+
+    const result = buildDN(entries, 'dc=example,dc=com');
+
+    expect(result).toBe('cn=Admins,ou=Groups,dc=example,dc=com');
+  });
+
+  it('should build DN without suffix', () => {
+    const entries: DnEntry[] = [
+      { type: 'ou', value: 'Users' },
+      { type: 'cn', value: 'Admins' },
+    ];
+
+    const result = buildDN(entries, '');
+
+    expect(result).toBe('ou=Users,cn=Admins');
+  });
+
+  it('should filter out entries with empty values', () => {
+    const entries: DnEntry[] = [
+      { type: 'ou', value: 'Users' },
+      { type: 'ou', value: '' },
+      { type: 'cn', value: 'Admins' },
+    ];
+    const suffix = 'dc=example,dc=com';
+
+    const result = buildDN(entries, suffix);
+
+    expect(result).toBe('ou=Users,cn=Admins,dc=example,dc=com');
+  });
+
+  it('should return only suffix when all entries have empty values', () => {
+    const entries: DnEntry[] = [
+      { type: 'ou', value: '' },
+      { type: 'cn', value: '' },
+    ];
+
+    const result = buildDN(entries, 'dc=example,dc=com');
+
+    expect(result).toBe('dc=example,dc=com');
+  });
+
+  it('should return only suffix for empty entries array', () => {
+    const result = buildDN([], 'dc=example,dc=com');
+
+    expect(result).toBe('dc=example,dc=com');
+  });
+
+  it('should return empty string when entries are empty and no suffix', () => {
+    const result = buildDN([], '');
+
+    expect(result).toBe('');
+  });
+});
diff --git a/app/react/portainer/settings/AuthenticationView/LDAPAuth/DnEntriesField/ldap-dn-utils.ts b/app/react/portainer/settings/AuthenticationView/LDAPAuth/DnEntriesField/ldap-dn-utils.ts
new file mode 100644
index 0000000..e95969f
--- /dev/null
+++ b/app/react/portainer/settings/AuthenticationView/LDAPAuth/DnEntriesField/ldap-dn-utils.ts
@@ -0,0 +1,37 @@
+export interface DnEntry {
+  type: 'ou' | 'cn';
+  value: string;
+}
+
+export function parseDN(
+  dn: string | undefined,
+  domainSuffix: string
+): DnEntry[] {
+  const regex = /(\w+)=([a-zA-Z0-9_ -]*),?/;
+  const ouValues: DnEntry[] = [];
+  let left = dn || '';
+  let match = left.match(regex);
+
+  while (match && left !== domainSuffix) {
+    const [, type, value] = match;
+    if (type === 'ou' || type === 'cn') {
+      ouValues.push({ type: type as 'ou' | 'cn', value });
+    }
+    left = left.replace(regex, '');
+    match = left.match(regex);
+  }
+
+  return ouValues;
+}
+
+export function buildDN(entries: DnEntry[], suffix: string): string {
+  const dnParts = entries
+    .filter(({ value }) => value)
+    .map(({ type, value }) => `${type}=${value}`);
+
+  if (suffix) {
+    dnParts.push(suffix);
+  }
+
+  return dnParts.join(',');
+}
diff --git a/app/react/portainer/settings/AuthenticationView/LDAPAuth/LDAPGroupsTable.tsx b/app/react/portainer/settings/AuthenticationView/LDAPAuth/LDAPGroupsTable.tsx
new file mode 100644
index 0000000..a70d6c7
--- /dev/null
+++ b/app/react/portainer/settings/AuthenticationView/LDAPAuth/LDAPGroupsTable.tsx
@@ -0,0 +1,49 @@
+import { Users } from 'lucide-react';
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { Datatable } from '@@/datatables';
+import { useTableStateWithoutStorage } from '@@/datatables/useTableState';
+
+const columns = getColumns();
+
+interface Value {
+  Name: string;
+  Groups: string[];
+}
+
+export function LDAPGroupsTable({ dataset }: { dataset?: Value[] }) {
+  const tableState = useTableStateWithoutStorage();
+
+  return (
+    <Datatable
+      columns={columns}
+      dataset={dataset || []}
+      isLoading={!dataset}
+      title="Groups"
+      titleIcon={Users}
+      settingsManager={tableState}
+      disableSelect
+      data-cy="ldap-groups-datatable"
+    />
+  );
+}
+
+function getColumns() {
+  const helper = createColumnHelper<Value>();
+
+  return [
+    helper.accessor('Name', {}),
+    helper.accessor((item) => item.Groups.join(','), {
+      header: 'Groups',
+      cell: ({ row: { original: item } }) => (
+        <>
+          {item.Groups.map((g) => (
+            <p className="m-0" key={g}>
+              {g}
+            </p>
+          ))}
+        </>
+      ),
+    }),
+  ];
+}
diff --git a/app/react/portainer/settings/AuthenticationView/LDAPAuth/LDAPUsersTable.tsx b/app/react/portainer/settings/AuthenticationView/LDAPAuth/LDAPUsersTable.tsx
new file mode 100644
index 0000000..6c88886
--- /dev/null
+++ b/app/react/portainer/settings/AuthenticationView/LDAPAuth/LDAPUsersTable.tsx
@@ -0,0 +1,37 @@
+import { Users } from 'lucide-react';
+
+import { Datatable } from '@@/datatables';
+import { useTableStateWithoutStorage } from '@@/datatables/useTableState';
+
+const columns = getColumns();
+
+interface Value {
+  value: string;
+}
+
+export function LDAPUsersTable({ dataset }: { dataset?: string[] }) {
+  const tableState = useTableStateWithoutStorage();
+  const items = dataset?.map((value) => ({ value }));
+
+  return (
+    <Datatable
+      columns={columns}
+      dataset={items || []}
+      isLoading={!items}
+      title="Users"
+      titleIcon={Users}
+      settingsManager={tableState}
+      disableSelect
+      data-cy="ldap-users-datatable"
+    />
+  );
+}
+
+function getColumns() {
+  return [
+    {
+      header: 'Name',
+      accessorFn: ({ value }: Value) => value,
+    },
+  ];
+}
diff --git a/app/react/portainer/settings/AuthenticationView/LDAPAuth/LdapSecurityFieldset/LdapSecurityFieldset.test.tsx b/app/react/portainer/settings/AuthenticationView/LDAPAuth/LdapSecurityFieldset/LdapSecurityFieldset.test.tsx
new file mode 100644
index 0000000..ec1b0a5
--- /dev/null
+++ b/app/react/portainer/settings/AuthenticationView/LDAPAuth/LdapSecurityFieldset/LdapSecurityFieldset.test.tsx
@@ -0,0 +1,103 @@
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { describe, expect, test, vi } from 'vitest';
+
+import { LdapSecurityFieldset } from './LdapSecurityFieldset';
+
+describe('LdapSecurityFieldset', () => {
+  test('shows StartTLS toggle when TLS is disabled, hides it when TLS is enabled', () => {
+    const { rerender } = render(
+      <LdapSecurityFieldset
+        values={{ startTLS: false, tls: false, tlsSkipVerify: false }}
+        onChange={() => {}}
+      />
+    );
+
+    expect(
+      screen.getByRole('checkbox', { name: /use starttls/i })
+    ).toBeVisible();
+
+    rerender(
+      <LdapSecurityFieldset
+        values={{ startTLS: false, tls: true, tlsSkipVerify: false }}
+        onChange={() => {}}
+      />
+    );
+
+    expect(
+      screen.queryByRole('checkbox', { name: /use starttls/i })
+    ).toBeNull();
+  });
+
+  test('shows TLS toggle when StartTLS is disabled, calls onChange with tls: true on click', async () => {
+    const user = userEvent.setup();
+    const onChange = vi.fn();
+
+    render(
+      <LdapSecurityFieldset
+        values={{ startTLS: false, tls: false, tlsSkipVerify: false }}
+        onChange={onChange}
+      />
+    );
+
+    const tlsToggle = screen.getByRole('checkbox', { name: /use tls/i });
+    expect(tlsToggle).toBeVisible();
+
+    await user.click(tlsToggle);
+
+    expect(onChange).toHaveBeenCalled();
+    expect(onChange.mock.calls[0][0]).toEqual({ tls: true });
+  });
+
+  describe('CA certificate visibility', () => {
+    test('shows CA cert upload when TLS is enabled', () => {
+      render(
+        <LdapSecurityFieldset
+          values={{ startTLS: false, tls: true, tlsSkipVerify: false }}
+          onChange={() => {}}
+        />
+      );
+      expect(screen.getByText('TLS CA certificate')).toBeVisible();
+    });
+
+    test('shows CA cert upload when TLS is enabled regardless of tlsSkipVerify', () => {
+      render(
+        <LdapSecurityFieldset
+          values={{ startTLS: false, tls: true, tlsSkipVerify: true }}
+          onChange={() => {}}
+        />
+      );
+      expect(screen.getByText('TLS CA certificate')).toBeVisible();
+    });
+
+    test('shows CA cert upload when StartTLS is enabled and tlsSkipVerify is false', () => {
+      render(
+        <LdapSecurityFieldset
+          values={{ startTLS: true, tls: false, tlsSkipVerify: false }}
+          onChange={() => {}}
+        />
+      );
+      expect(screen.getByText('TLS CA certificate')).toBeVisible();
+    });
+
+    test('hides CA cert upload when StartTLS is enabled but tlsSkipVerify is true', () => {
+      render(
+        <LdapSecurityFieldset
+          values={{ startTLS: true, tls: false, tlsSkipVerify: true }}
+          onChange={() => {}}
+        />
+      );
+      expect(screen.queryByText('TLS CA certificate')).toBeNull();
+    });
+
+    test('hides CA cert upload when neither TLS nor StartTLS is enabled', () => {
+      render(
+        <LdapSecurityFieldset
+          values={{ startTLS: false, tls: false, tlsSkipVerify: false }}
+          onChange={() => {}}
+        />
+      );
+      expect(screen.queryByText('TLS CA certificate')).toBeNull();
+    });
+  });
+});
diff --git a/app/react/portainer/settings/AuthenticationView/LDAPAuth/LdapSecurityFieldset/LdapSecurityFieldset.tsx b/app/react/portainer/settings/AuthenticationView/LDAPAuth/LdapSecurityFieldset/LdapSecurityFieldset.tsx
new file mode 100644
index 0000000..acc64a8
--- /dev/null
+++ b/app/react/portainer/settings/AuthenticationView/LDAPAuth/LdapSecurityFieldset/LdapSecurityFieldset.tsx
@@ -0,0 +1,110 @@
+import { FormikErrors } from 'formik';
+
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+import { isLimitedToBE } from '@/react/portainer/feature-flags/feature-flags.service';
+
+import { FileUploadField } from '@@/form-components/FileUpload';
+import { FormControl } from '@@/form-components/FormControl';
+import { FormSection } from '@@/form-components/FormSection';
+import { SwitchField } from '@@/form-components/SwitchField';
+import { BEFeatureIndicator } from '@@/BEFeatureIndicator';
+
+export interface LdapSecurityConfig {
+  startTLS: boolean;
+  tls: boolean;
+  tlsSkipVerify: boolean;
+  caCertFile?: File | null;
+}
+
+interface Props {
+  values: LdapSecurityConfig;
+  onChange: (value: Partial<LdapSecurityConfig>) => void;
+  errors?: FormikErrors<LdapSecurityConfig>;
+  title?: string;
+  uploadState?: 'uploading' | 'success';
+  limitedFeatureId?: FeatureId;
+}
+
+export function LdapSecurityFieldset({
+  values,
+  onChange,
+  errors,
+  title = 'LDAP security',
+  uploadState,
+  limitedFeatureId,
+}: Props) {
+  const showCaCert = values.tls || (values.startTLS && !values.tlsSkipVerify);
+  const isCaCertLimited = isLimitedToBE(limitedFeatureId);
+
+  return (
+    <FormSection title={title}>
+      {!values.tls && (
+        <div className="form-group">
+          <div className="col-sm-12">
+            <SwitchField
+              label="Use StartTLS"
+              checked={values.startTLS}
+              onChange={(checked) => onChange({ startTLS: checked })}
+              tooltip="Enable this option if you want to use StartTLS to secure the connection to the server. Ignored if Use TLS is selected."
+              labelClass="col-sm-3 col-lg-2"
+              featureId={limitedFeatureId}
+              data-cy="starttls-toggle"
+            />
+          </div>
+        </div>
+      )}
+
+      {!values.startTLS && (
+        <div className="form-group">
+          <div className="col-sm-12">
+            <SwitchField
+              label="Use TLS"
+              checked={values.tls}
+              onChange={(checked) => onChange({ tls: checked })}
+              tooltip="Enable this option if you need to specify TLS certificates to connect to the LDAP server."
+              labelClass="col-sm-3 col-lg-2"
+              featureId={limitedFeatureId}
+              data-cy="tls-toggle"
+            />
+          </div>
+        </div>
+      )}
+
+      <div className="form-group">
+        <div className="col-sm-12">
+          <SwitchField
+            label="Skip verification of server certificate"
+            checked={values.tlsSkipVerify}
+            onChange={(checked) => onChange({ tlsSkipVerify: checked })}
+            tooltip="Skip the verification of the server TLS certificate. Not recommended on unsecured networks."
+            labelClass="col-sm-3 col-lg-2"
+            featureId={limitedFeatureId}
+            data-cy="tls-skip-verify-toggle"
+          />
+        </div>
+      </div>
+
+      {showCaCert && (
+        <FormControl
+          label="TLS CA certificate"
+          errors={errors?.caCertFile}
+          inputId="tls-ca-cert"
+        >
+          <FileUploadField
+            inputId="tls-ca-cert"
+            onChange={(file) => onChange({ caCertFile: file })}
+            value={values.caCertFile}
+            title="Select file"
+            required
+            data-cy="tls-ca-cert-upload"
+            state={uploadState}
+            disabled={isCaCertLimited}
+          />
+          {limitedFeatureId && (
+            <BEFeatureIndicator featureId={limitedFeatureId} />
+          )}
+        </FormControl>
+      )}
+    </FormSection>
+  );
+}
diff --git a/app/react/portainer/settings/AuthenticationView/LDAPAuth/LdapSettingsTestLogin/LdapSettingsTestLogin.test.tsx b/app/react/portainer/settings/AuthenticationView/LDAPAuth/LdapSettingsTestLogin/LdapSettingsTestLogin.test.tsx
new file mode 100644
index 0000000..6f48a2f
--- /dev/null
+++ b/app/react/portainer/settings/AuthenticationView/LDAPAuth/LdapSettingsTestLogin/LdapSettingsTestLogin.test.tsx
@@ -0,0 +1,80 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { HttpResponse } from 'msw';
+import { describe, expect, test } from 'vitest';
+
+import { server, http } from '@/setup-tests/server';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+
+import { LDAPSettings } from '../../../types';
+
+import { LdapSettingsTestLogin } from './LdapSettingsTestLogin';
+
+const mockSettings = {
+  AnonymousMode: false,
+  ReaderDN: '',
+  URL: 'ldap://localhost',
+  TLSConfig: {
+    TLS: false,
+    TLSSkipVerify: false,
+  },
+  StartTLS: false,
+  SearchSettings: [],
+  GroupSearchSettings: [],
+  AutoCreateUsers: false,
+} satisfies LDAPSettings;
+
+function renderComponent() {
+  const Wrapped = withTestQueryProvider(LdapSettingsTestLogin);
+  return render(<Wrapped settings={mockSettings} />);
+}
+
+describe('LdapSettingsTestLogin', () => {
+  test('renders username and password inputs and test button', () => {
+    renderComponent();
+
+    expect(screen.getByLabelText(/username/i)).toBeVisible();
+    expect(screen.getByLabelText(/password/i)).toBeVisible();
+    expect(screen.getByRole('button', { name: /^test$/i })).toBeVisible();
+  });
+
+  test('button is disabled when inputs are empty, enabled after filling both fields', async () => {
+    const user = userEvent.setup();
+    renderComponent();
+
+    const button = screen.getByRole('button', { name: /^test$/i });
+    expect(button).toBeDisabled();
+
+    await user.type(screen.getByLabelText(/username/i), 'testuser');
+    expect(button).toBeDisabled();
+
+    await user.type(screen.getByLabelText(/password/i), 'testpass');
+    expect(button).toBeEnabled();
+  });
+
+  test('sends correct payload to API when test button is clicked', async () => {
+    const user = userEvent.setup();
+    let receivedPayload: unknown;
+
+    server.use(
+      http.post('/api/ldap/test', async ({ request }) => {
+        receivedPayload = await request.json();
+        return HttpResponse.json({ valid: true });
+      })
+    );
+
+    renderComponent();
+
+    await user.type(screen.getByLabelText(/username/i), 'testuser');
+    await user.type(screen.getByLabelText(/password/i), 'testpass');
+    await user.click(screen.getByRole('button', { name: /^test$/i }));
+
+    await waitFor(() => {
+      expect(receivedPayload).toMatchObject({
+        LDAPSettings: mockSettings,
+        Username: 'testuser',
+        Password: 'testpass',
+      });
+    });
+  });
+});
diff --git a/app/react/portainer/settings/AuthenticationView/LDAPAuth/LdapSettingsTestLogin/LdapSettingsTestLogin.tsx b/app/react/portainer/settings/AuthenticationView/LDAPAuth/LdapSettingsTestLogin/LdapSettingsTestLogin.tsx
new file mode 100644
index 0000000..eb4d9ce
--- /dev/null
+++ b/app/react/portainer/settings/AuthenticationView/LDAPAuth/LdapSettingsTestLogin/LdapSettingsTestLogin.tsx
@@ -0,0 +1,114 @@
+import { Field, Form, Formik } from 'formik';
+import { Check, X } from 'lucide-react';
+
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+import { isLimitedToBE } from '@/react/portainer/feature-flags/feature-flags.service';
+import { LDAPSettings } from '@/react/portainer/settings/types';
+
+import { BEFeatureIndicator } from '@@/BEFeatureIndicator';
+import { FormSection } from '@@/form-components/FormSection';
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+import { LoadingButton } from '@@/buttons';
+
+import { useTestLdapMutation } from '../../../queries/auth/useTestLdap';
+
+interface Props {
+  settings: LDAPSettings;
+  limitedFeatureId?: FeatureId;
+  showBeIndicatorIfNeeded?: boolean;
+  isLimitedFeatureSelfContained?: boolean;
+}
+
+const initialValues = { username: '', password: '' };
+
+export function LdapSettingsTestLogin({
+  settings,
+  limitedFeatureId,
+  showBeIndicatorIfNeeded = false,
+  isLimitedFeatureSelfContained = false,
+}: Props) {
+  const isDisabled =
+    isLimitedFeatureSelfContained || isLimitedToBE(limitedFeatureId);
+  const mutation = useTestLdapMutation();
+
+  return (
+    <FormSection title="Test login">
+      <Formik
+        initialValues={initialValues}
+        onSubmit={({ username, password }) =>
+          mutation.mutate({ username, password, settings })
+        }
+      >
+        {({ values }) => (
+          <Form noValidate>
+            <div className="form-inline mb-4 flex gap-3">
+              <FormControl
+                label="Username"
+                inputId="ldap_test_username"
+                size="medium"
+              >
+                <Field
+                  as={Input}
+                  id="ldap_test_username"
+                  name="username"
+                  disabled={isDisabled}
+                  className={
+                    isLimitedFeatureSelfContained ? 'limited-be' : undefined
+                  }
+                  data-cy="ldap-test-username"
+                />
+              </FormControl>
+
+              <FormControl
+                label="Password"
+                inputId="ldap_test_password"
+                size="medium"
+              >
+                <Field
+                  as={Input}
+                  id="ldap_test_password"
+                  name="password"
+                  type="password"
+                  autoComplete="new-password"
+                  disabled={isDisabled}
+                  className={
+                    isLimitedFeatureSelfContained ? 'limited-be' : undefined
+                  }
+                  data-cy="ldap-test-password"
+                />
+              </FormControl>
+
+              <div className="vertical-center">
+                <LoadingButton
+                  isLoading={mutation.isLoading}
+                  disabled={isDisabled || !values.username || !values.password}
+                  loadingText="Testing"
+                  data-cy="ldap-test-button"
+                  className={
+                    isLimitedFeatureSelfContained ? 'limited-be' : undefined
+                  }
+                >
+                  Test
+                </LoadingButton>
+
+                {mutation.isSuccess && mutation.data?.valid && (
+                  <Check className="icon-success" aria-hidden="true" />
+                )}
+
+                {(mutation.isError ||
+                  (mutation.isSuccess && !mutation.data?.valid)) && (
+                  <X className="icon-danger" aria-hidden="true" />
+                )}
+
+                {showBeIndicatorIfNeeded && limitedFeatureId && (
+                  <BEFeatureIndicator featureId={limitedFeatureId} />
+                )}
+              </div>
+            </div>
+          </Form>
+        )}
+      </Formik>
+    </FormSection>
+  );
+}
diff --git a/app/react/portainer/settings/AuthenticationView/OAuth/AuthStyleField.tsx b/app/react/portainer/settings/AuthenticationView/OAuth/AuthStyleField.tsx
new file mode 100644
index 0000000..9453e41
--- /dev/null
+++ b/app/react/portainer/settings/AuthenticationView/OAuth/AuthStyleField.tsx
@@ -0,0 +1,50 @@
+import { Options } from '@/react/edge/components/useIntervalOptions';
+import { OAuthStyle } from '@/react/portainer/settings/types';
+
+import { FormControl, Size } from '@@/form-components/FormControl';
+import { Select } from '@@/form-components/Input';
+
+interface Props {
+  value: OAuthStyle;
+  onChange(value: OAuthStyle): void;
+  label?: string;
+  tooltip?: string;
+  readonly?: boolean;
+  size?: Size;
+}
+
+// The options are based on oauth2 lib definition @https://pkg.go.dev/golang.org/x/oauth2#AuthStyle
+export const authStyleOptions: Options = [
+  { label: 'Auto Detect', value: OAuthStyle.AutoDetect, isDefault: true },
+  { label: 'In Params', value: OAuthStyle.InParams },
+  { label: 'In Header', value: OAuthStyle.InHeader },
+];
+
+export function AuthStyleField({
+  value,
+  readonly = false,
+  onChange,
+  label = 'Auth Style',
+  tooltip = 'Auth Style specifies how the endpoint wants the client ID & client secret sent.',
+  size = 'small',
+}: Props) {
+  return (
+    <FormControl
+      inputId="oauth_authstyle"
+      label={label}
+      tooltip={tooltip}
+      size={size}
+    >
+      <Select
+        value={value}
+        onChange={(e) => {
+          onChange(parseInt(e.currentTarget.value, 10));
+        }}
+        options={authStyleOptions}
+        disabled={readonly}
+        id="oauth_authstyle"
+        data-cy="setting-oauth-authstyle-select"
+      />
+    </FormControl>
+  );
+}
diff --git a/app/react/portainer/settings/AuthenticationView/OAuth/index.ts b/app/react/portainer/settings/AuthenticationView/OAuth/index.ts
new file mode 100644
index 0000000..e6afc7c
--- /dev/null
+++ b/app/react/portainer/settings/AuthenticationView/OAuth/index.ts
@@ -0,0 +1 @@
+export { AuthStyleField } from './AuthStyleField';
diff --git a/app/react/portainer/settings/AuthenticationView/SessionLifetimeSelect.test.tsx b/app/react/portainer/settings/AuthenticationView/SessionLifetimeSelect.test.tsx
new file mode 100644
index 0000000..e464af0
--- /dev/null
+++ b/app/react/portainer/settings/AuthenticationView/SessionLifetimeSelect.test.tsx
@@ -0,0 +1,24 @@
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+
+import { SessionLifetimeSelect } from './SessionLifetimeSelect';
+
+describe('SessionLifetimeSelect', () => {
+  test('should render with the correct label and tooltip', () => {
+    const onChange = vi.fn();
+    render(<SessionLifetimeSelect value="1h" onChange={onChange} />);
+
+    expect(screen.getByLabelText('Session lifetime')).toBeInTheDocument();
+  });
+
+  test('should call onChange when selecting a new value', async () => {
+    const user = userEvent.setup();
+    const onChange = vi.fn();
+    render(<SessionLifetimeSelect value="1h" onChange={onChange} />);
+
+    const select = screen.getByRole('combobox');
+    await user.selectOptions(select, '8h');
+
+    expect(onChange).toHaveBeenCalledWith('8h');
+  });
+});
diff --git a/app/react/portainer/settings/AuthenticationView/SessionLifetimeSelect.tsx b/app/react/portainer/settings/AuthenticationView/SessionLifetimeSelect.tsx
new file mode 100644
index 0000000..550e33e
--- /dev/null
+++ b/app/react/portainer/settings/AuthenticationView/SessionLifetimeSelect.tsx
@@ -0,0 +1,60 @@
+import { FormControl } from '@@/form-components/FormControl';
+import { Select } from '@@/form-components/Input';
+
+const sessionLifetimeOptions = [
+  {
+    key: '30 minutes',
+    value: '30m',
+  },
+  {
+    key: '1 hour',
+    value: '1h',
+  },
+  {
+    key: '4 hours',
+    value: '4h',
+  },
+  {
+    key: '8 hours',
+    value: '8h',
+  },
+  {
+    key: '24 hours',
+    value: '24h',
+  },
+  { key: '1 week', value: `${24 * 7}h` },
+  { key: '1 month', value: `${24 * 30}h` },
+  { key: '6 months', value: `${24 * 30 * 6}h` },
+  { key: '1 year', value: `${24 * 30 * 12}h` },
+] as const;
+
+export function getDefaultValue() {
+  return sessionLifetimeOptions[0];
+}
+
+interface Props {
+  value: string;
+  onChange(value: string): void;
+}
+
+export function SessionLifetimeSelect({ value, onChange }: Props) {
+  return (
+    <FormControl
+      inputId="user_timeout"
+      label="Session lifetime"
+      tooltip="Time before users are forced to relogin."
+    >
+      <Select
+        id="user_timeout"
+        data-cy="user-timeout-select"
+        name="user_timeout"
+        value={value}
+        onChange={(e) => onChange(e.target.value)}
+        options={sessionLifetimeOptions.map((opt) => ({
+          label: opt.key,
+          value: opt.value,
+        }))}
+      />
+    </FormControl>
+  );
+}
diff --git a/app/react/portainer/settings/AuthenticationView/ldap-options.tsx b/app/react/portainer/settings/AuthenticationView/ldap-options.tsx
new file mode 100644
index 0000000..a3b068c
--- /dev/null
+++ b/app/react/portainer/settings/AuthenticationView/ldap-options.tsx
@@ -0,0 +1,28 @@
+import { Edit } from 'lucide-react';
+
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+import Openldap from '@/assets/ico/vendor/openldap.svg?c';
+
+export const SERVER_TYPES = {
+  CUSTOM: 0,
+  OPEN_LDAP: 1,
+  AD: 2,
+};
+
+export const options = [
+  {
+    id: 'ldap_custom',
+    icon: Edit,
+    iconType: 'badge',
+    label: 'Custom',
+    value: SERVER_TYPES.CUSTOM,
+  },
+  {
+    id: 'ldap_openldap',
+    icon: Openldap,
+    label: 'OpenLDAP',
+    value: SERVER_TYPES.OPEN_LDAP,
+    feature: FeatureId.EXTERNAL_AUTH_LDAP,
+    iconType: 'logo',
+  },
+];
diff --git a/app/react/portainer/settings/AuthenticationView/oauth-options.tsx b/app/react/portainer/settings/AuthenticationView/oauth-options.tsx
new file mode 100644
index 0000000..f9d3c4c
--- /dev/null
+++ b/app/react/portainer/settings/AuthenticationView/oauth-options.tsx
@@ -0,0 +1,44 @@
+import { Edit } from 'lucide-react';
+
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+import Microsoft from '@/assets/ico/vendor/microsoft.svg?c';
+import Google from '@/assets/ico/vendor/google.svg?c';
+import Github from '@/assets/ico/vendor/github.svg?c';
+
+export const options = [
+  {
+    id: 'microsoft',
+    icon: Microsoft,
+    label: 'Microsoft',
+    description: 'Microsoft OAuth provider',
+    value: 'microsoft',
+    iconType: 'logo',
+    feature: FeatureId.HIDE_INTERNAL_AUTH,
+  },
+  {
+    id: 'google',
+    icon: Google,
+    label: 'Google',
+    description: 'Google OAuth provider',
+    value: 'google',
+    iconType: 'logo',
+    feature: FeatureId.HIDE_INTERNAL_AUTH,
+  },
+  {
+    id: 'github',
+    icon: Github,
+    label: 'Github',
+    description: 'Github OAuth provider',
+    value: 'github',
+    iconType: 'logo',
+    feature: FeatureId.HIDE_INTERNAL_AUTH,
+  },
+  {
+    id: 'custom',
+    icon: Edit,
+    iconType: 'badge',
+    label: 'Custom',
+    description: 'Custom OAuth provider',
+    value: 'custom',
+  },
+];
diff --git a/app/react/portainer/settings/CloudView/.keep b/app/react/portainer/settings/CloudView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/portainer/settings/EdgeComputeView/.keep b/app/react/portainer/settings/EdgeComputeView/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/react/portainer/settings/EdgeComputeView/AutomaticEdgeEnvCreation/AutoEnvCreationSettingsForm.tsx b/app/react/portainer/settings/EdgeComputeView/AutomaticEdgeEnvCreation/AutoEnvCreationSettingsForm.tsx
new file mode 100644
index 0000000..b75c5ea
--- /dev/null
+++ b/app/react/portainer/settings/EdgeComputeView/AutomaticEdgeEnvCreation/AutoEnvCreationSettingsForm.tsx
@@ -0,0 +1,79 @@
+import { Form, Formik } from 'formik';
+import * as yup from 'yup';
+import { useCallback } from 'react';
+
+import { notifySuccess } from '@/portainer/services/notifications';
+import { useUpdateSettingsMutation } from '@/react/portainer/settings/queries';
+import { Settings } from '@/react/portainer/settings/types';
+
+import { LoadingButton } from '@@/buttons/LoadingButton';
+
+import { EnabledWaitingRoomSwitch } from './EnableWaitingRoomSwitch';
+
+interface FormValues {
+  EnableWaitingRoom: boolean;
+}
+const validation = yup.object({
+  EnableWaitingRoom: yup.boolean(),
+});
+
+interface Props {
+  settings: Settings;
+}
+
+export function AutoEnvCreationSettingsForm({ settings }: Props) {
+  const initialValues: FormValues = {
+    EnableWaitingRoom: !settings.TrustOnFirstConnect,
+  };
+
+  const mutation = useUpdateSettingsMutation();
+
+  const { mutate: updateSettings } = mutation;
+
+  const handleSubmit = useCallback(
+    (variables: Partial<FormValues>) => {
+      updateSettings(
+        { TrustOnFirstConnect: !variables.EnableWaitingRoom },
+        {
+          onSuccess() {
+            notifySuccess(
+              'Success',
+              'Successfully updated Automatic Environment Creation settings'
+            );
+          },
+        }
+      );
+    },
+    [updateSettings]
+  );
+
+  return (
+    <Formik<FormValues>
+      initialValues={initialValues}
+      onSubmit={handleSubmit}
+      validationSchema={validation}
+      validateOnMount
+      enableReinitialize
+    >
+      {({ isValid, dirty }) => (
+        <Form className="form-horizontal">
+          <EnabledWaitingRoomSwitch />
+
+          <div className="form-group">
+            <div className="col-sm-12">
+              <LoadingButton
+                loadingText="generating..."
+                data-cy="save-auto-env-settings-button"
+                isLoading={mutation.isLoading}
+                disabled={!isValid || !dirty}
+                className="!ml-0"
+              >
+                Save settings
+              </LoadingButton>
+            </div>
+          </div>
+        </Form>
+      )}
+    </Formik>
+  );
+}
diff --git a/app/react/portainer/settings/EdgeComputeView/AutomaticEdgeEnvCreation/AutomaticEdgeEnvCreation.tsx b/app/react/portainer/settings/EdgeComputeView/AutomaticEdgeEnvCreation/AutomaticEdgeEnvCreation.tsx
new file mode 100644
index 0000000..813ac5f
--- /dev/null
+++ b/app/react/portainer/settings/EdgeComputeView/AutomaticEdgeEnvCreation/AutomaticEdgeEnvCreation.tsx
@@ -0,0 +1,26 @@
+import { Laptop } from 'lucide-react';
+
+import { Widget, WidgetBody, WidgetTitle } from '@@/Widget';
+
+import { useSettings } from '../../queries';
+
+import { AutoEnvCreationSettingsForm } from './AutoEnvCreationSettingsForm';
+
+export function AutomaticEdgeEnvCreation() {
+  const settingsQuery = useSettings();
+
+  if (!settingsQuery.data) {
+    return null;
+  }
+
+  const settings = settingsQuery.data;
+
+  return (
+    <Widget>
+      <WidgetTitle icon={Laptop} title="Automatic Edge Environment Creation" />
+      <WidgetBody>
+        <AutoEnvCreationSettingsForm settings={settings} />
+      </WidgetBody>
+    </Widget>
+  );
+}
diff --git a/app/react/portainer/settings/EdgeComputeView/AutomaticEdgeEnvCreation/EnableWaitingRoomSwitch.tsx b/app/react/portainer/settings/EdgeComputeView/AutomaticEdgeEnvCreation/EnableWaitingRoomSwitch.tsx
new file mode 100644
index 0000000..45b5579
--- /dev/null
+++ b/app/react/portainer/settings/EdgeComputeView/AutomaticEdgeEnvCreation/EnableWaitingRoomSwitch.tsx
@@ -0,0 +1,50 @@
+import { useField } from 'formik';
+
+import { confirm } from '@@/modals/confirm';
+import { FormControl } from '@@/form-components/FormControl';
+import { Switch } from '@@/form-components/SwitchField/Switch';
+import { buildConfirmButton } from '@@/modals/utils';
+import { ModalType } from '@@/modals';
+
+export function EnabledWaitingRoomSwitch() {
+  const [inputProps, meta, helpers] = useField<boolean>('EnableWaitingRoom');
+
+  return (
+    <FormControl
+      inputId="edge_waiting_room"
+      label="Enable Edge Environment Waiting Room"
+      size="medium"
+      errors={meta.error}
+    >
+      <Switch
+        id="edge_waiting_room"
+        data-cy="edge-waiting-room-switch"
+        name="EnableWaitingRoom"
+        className="space-right"
+        checked={inputProps.value}
+        onChange={handleChange}
+      />
+    </FormControl>
+  );
+
+  async function handleChange(enable: boolean) {
+    if (enable) {
+      helpers.setValue(true);
+      return;
+    }
+
+    const confirmed = await confirm({
+      modalType: ModalType.Warn,
+      title: 'Disable Edge Environment Waiting Room',
+      message:
+        'By disabling the waiting room feature, all devices requesting association will be automatically associated and could pose a security risk. Are you sure?',
+      confirmButton: buildConfirmButton('Confirm', 'danger'),
+    });
+
+    if (!confirmed) {
+      return;
+    }
+
+    helpers.setValue(false);
+  }
+}
diff --git a/app/react/portainer/settings/EdgeComputeView/AutomaticEdgeEnvCreation/index.ts b/app/react/portainer/settings/EdgeComputeView/AutomaticEdgeEnvCreation/index.ts
new file mode 100644
index 0000000..1a10043
--- /dev/null
+++ b/app/react/portainer/settings/EdgeComputeView/AutomaticEdgeEnvCreation/index.ts
@@ -0,0 +1 @@
+export { AutomaticEdgeEnvCreation } from './AutomaticEdgeEnvCreation';
diff --git a/app/react/portainer/settings/EdgeComputeView/DeploymentSyncOptions/DeploymentSyncOptions.tsx b/app/react/portainer/settings/EdgeComputeView/DeploymentSyncOptions/DeploymentSyncOptions.tsx
new file mode 100644
index 0000000..2951d43
--- /dev/null
+++ b/app/react/portainer/settings/EdgeComputeView/DeploymentSyncOptions/DeploymentSyncOptions.tsx
@@ -0,0 +1,129 @@
+import { Form, Formik } from 'formik';
+import { useReducer } from 'react';
+import { Laptop } from 'lucide-react';
+
+import { EdgeCheckinIntervalField } from '@/react/edge/components/EdgeCheckInIntervalField';
+import { EdgeAsyncIntervalsForm } from '@/react/edge/components/EdgeAsyncIntervalsForm';
+import { notifySuccess } from '@/portainer/services/notifications';
+import { isBE } from '@/react/portainer/feature-flags/feature-flags.service';
+
+import { Widget, WidgetBody, WidgetTitle } from '@@/Widget';
+import { FormSection } from '@@/form-components/FormSection';
+import { LoadingButton } from '@@/buttons/LoadingButton';
+import { TextTip } from '@@/Tip/TextTip';
+
+import { useSettings, useUpdateSettingsMutation } from '../../queries';
+
+import { FormValues } from './types';
+
+const asyncIntervalFieldSettings = {
+  ping: {
+    label: 'Edge agent default ping frequency',
+    tooltip:
+      'Interval used by default by each Edge agent to ping the Portainer instance. Affects Edge environment management and Edge compute features.',
+  },
+  snapshot: {
+    label: 'Edge agent default snapshot frequency',
+    tooltip:
+      'Interval used by default by each Edge agent to snapshot the agent state.',
+  },
+  command: {
+    label: 'Edge agent default command frequency',
+    tooltip: 'Interval used by default by each Edge agent to execute commands.',
+  },
+};
+
+export function DeploymentSyncOptions() {
+  const settingsQuery = useSettings();
+  const settingsMutation = useUpdateSettingsMutation();
+  const [formKey, resetForm] = useReducer((state) => state + 1, 0);
+
+  if (!settingsQuery.data) {
+    return null;
+  }
+
+  const initialValues: FormValues = {
+    Edge: {
+      CommandInterval: settingsQuery.data.Edge.CommandInterval,
+      PingInterval: settingsQuery.data.Edge.PingInterval,
+      SnapshotInterval: settingsQuery.data.Edge.SnapshotInterval,
+    },
+    EdgeAgentCheckinInterval: settingsQuery.data.EdgeAgentCheckinInterval,
+  };
+
+  return (
+    <div className="row">
+      <Widget>
+        <WidgetTitle icon={Laptop} title="Deployment sync options" />
+        <WidgetBody>
+          <Formik<FormValues>
+            initialValues={initialValues}
+            onSubmit={handleSubmit}
+            key={formKey}
+          >
+            {({ setFieldValue, values, isValid, dirty }) => (
+              <Form className="form-horizontal">
+                <TextTip color="blue">
+                  Default values set here will be available to choose as an
+                  option for edge environment creation
+                </TextTip>
+
+                <FormSection title="Check-in Intervals">
+                  <EdgeCheckinIntervalField
+                    value={values.EdgeAgentCheckinInterval}
+                    onChange={(value) =>
+                      setFieldValue('EdgeAgentCheckinInterval', value)
+                    }
+                    isDefaultHidden
+                    label="Edge agent default poll frequency"
+                    tooltip="Interval used by default by each Edge agent to check in with the Portainer instance. Affects Edge environment management and Edge compute features."
+                  />
+                </FormSection>
+
+                {isBE && (
+                  <FormSection title="Async Check-in Intervals">
+                    <EdgeAsyncIntervalsForm
+                      values={values.Edge}
+                      onChange={(value) => setFieldValue('Edge', value)}
+                      isDefaultHidden
+                      fieldSettings={asyncIntervalFieldSettings}
+                    />
+                  </FormSection>
+                )}
+
+                <div className="form-group mt-5">
+                  <div className="col-sm-12">
+                    <LoadingButton
+                      disabled={!isValid || !dirty}
+                      className="!ml-0"
+                      data-cy="settings-deploySyncOptionsButton"
+                      isLoading={settingsMutation.isLoading}
+                      loadingText="Saving settings..."
+                    >
+                      Save settings
+                    </LoadingButton>
+                  </div>
+                </div>
+              </Form>
+            )}
+          </Formik>
+        </WidgetBody>
+      </Widget>
+    </div>
+  );
+
+  function handleSubmit(values: FormValues) {
+    settingsMutation.mutate(
+      {
+        Edge: values.Edge,
+        EdgeAgentCheckinInterval: values.EdgeAgentCheckinInterval,
+      },
+      {
+        onSuccess() {
+          notifySuccess('Success', 'Settings updated successfully');
+          resetForm();
+        },
+      }
+    );
+  }
+}
diff --git a/app/react/portainer/settings/EdgeComputeView/DeploymentSyncOptions/types.ts b/app/react/portainer/settings/EdgeComputeView/DeploymentSyncOptions/types.ts
new file mode 100644
index 0000000..ce0b852
--- /dev/null
+++ b/app/react/portainer/settings/EdgeComputeView/DeploymentSyncOptions/types.ts
@@ -0,0 +1,8 @@
+export interface FormValues {
+  Edge: {
+    PingInterval: number;
+    SnapshotInterval: number;
+    CommandInterval: number;
+  };
+  EdgeAgentCheckinInterval: number;
+}
diff --git a/app/react/portainer/settings/EdgeComputeView/DeploymentSyncOptions/validation.ts b/app/react/portainer/settings/EdgeComputeView/DeploymentSyncOptions/validation.ts
new file mode 100644
index 0000000..d5d8636
--- /dev/null
+++ b/app/react/portainer/settings/EdgeComputeView/DeploymentSyncOptions/validation.ts
@@ -0,0 +1,25 @@
+import { boolean, number, object, SchemaOf } from 'yup';
+
+import { options as asyncIntervalOptions } from '@/react/edge/components/EdgeAsyncIntervalsForm';
+
+import { FormValues } from './types';
+
+const intervals = asyncIntervalOptions.map((option) => option.value);
+
+export function validationSchema(): SchemaOf<FormValues> {
+  return object({
+    EdgeAgentCheckinInterval: number().required('This field is required.'),
+    Edge: object({
+      PingInterval: number()
+        .required('This field is required.')
+        .oneOf(intervals),
+      SnapshotInterval: number()
+        .required('This field is required.')
+        .oneOf(intervals),
+      CommandInterval: number()
+        .required('This field is required.')
+        .oneOf(intervals),
+      AsyncMode: boolean().default(false),
+    }),
+  });
+}
diff --git a/app/react/portainer/settings/EdgeComputeView/EdgeComputeSettings/EdgeComputeSettings.tsx b/app/react/portainer/settings/EdgeComputeView/EdgeComputeSettings/EdgeComputeSettings.tsx
new file mode 100644
index 0000000..e4ee715
--- /dev/null
+++ b/app/react/portainer/settings/EdgeComputeView/EdgeComputeSettings/EdgeComputeSettings.tsx
@@ -0,0 +1,163 @@
+import { Formik, Form } from 'formik';
+import { Laptop, Network } from 'lucide-react';
+import { useState } from 'react';
+
+import { Settings } from '@/react/portainer/settings/types';
+import { PortainerUrlField } from '@/react/portainer/common/PortainerUrlField';
+import { PortainerTunnelAddrField } from '@/react/portainer/common/PortainerTunnelAddrField';
+import { isBE } from '@/react/portainer/feature-flags/feature-flags.service';
+import { ConnectivityTestModal } from '@/react/edge/components/ConnectivityTestModal/ConnectivityTestModal';
+
+import { Switch } from '@@/form-components/SwitchField/Switch';
+import { FormControl } from '@@/form-components/FormControl';
+import { Widget, WidgetBody, WidgetTitle } from '@@/Widget';
+import { LoadingButton } from '@@/buttons/LoadingButton';
+import { TextTip } from '@@/Tip/TextTip';
+import { Button } from '@@/buttons';
+
+import { validationSchema } from './EdgeComputeSettings.validation';
+import { FormValues } from './types';
+
+interface Props {
+  settings?: Settings;
+  onSubmit(values: FormValues): void;
+}
+
+export function EdgeComputeSettings({ settings, onSubmit }: Props) {
+  const [isConnectivityModalOpen, setIsConnectivityModalOpen] = useState(false);
+
+  if (!settings) {
+    return null;
+  }
+
+  const initialValues: FormValues = {
+    EnableEdgeComputeFeatures: settings.EnableEdgeComputeFeatures,
+    EdgePortainerUrl: settings.EdgePortainerUrl,
+    Edge: {
+      TunnelServerAddress: settings.Edge?.TunnelServerAddress,
+    },
+    EnforceEdgeID: settings.EnforceEdgeID,
+  };
+
+  return (
+    <div className="row">
+      <Widget>
+        <WidgetTitle icon={Laptop} title="Edge Compute settings" />
+
+        <WidgetBody>
+          <Formik
+            initialValues={initialValues}
+            enableReinitialize
+            validationSchema={() => validationSchema()}
+            onSubmit={onSubmit}
+            validateOnMount
+          >
+            {({
+              values,
+              errors,
+              handleSubmit,
+              setFieldValue,
+              isSubmitting,
+              isValid,
+              dirty,
+            }) => (
+              <Form
+                className="form-horizontal"
+                onSubmit={handleSubmit}
+                noValidate
+              >
+                <FormControl
+                  inputId="edge_enable"
+                  label="Enable Edge Compute features"
+                  size="small"
+                  errors={errors.EnableEdgeComputeFeatures}
+                >
+                  <Switch
+                    id="edge_enable"
+                    data-cy="edge-enable-switch"
+                    name="edge_enable"
+                    className="space-right"
+                    checked={values.EnableEdgeComputeFeatures}
+                    onChange={(e) =>
+                      setFieldValue('EnableEdgeComputeFeatures', e)
+                    }
+                  />
+                </FormControl>
+
+                <TextTip color="blue" className="mb-2">
+                  Enable this setting to use Portainer Edge Compute
+                  capabilities.
+                </TextTip>
+
+                {isBE && values.EnableEdgeComputeFeatures && (
+                  <>
+                    <PortainerUrlField
+                      fieldName="EdgePortainerUrl"
+                      tooltip="URL of this Portainer instance that will be used by Edge agents to initiate the communications."
+                    />
+
+                    <PortainerTunnelAddrField fieldName="Edge.TunnelServerAddress" />
+
+                    <div className="form-group">
+                      <div className="col-sm-12">
+                        <Button
+                          color="default"
+                          icon={Network}
+                          onClick={() => setIsConnectivityModalOpen(true)}
+                          data-cy="edge-compute-test-connectivity-button"
+                          className="!ml-0"
+                        >
+                          Test connectivity
+                        </Button>
+                      </div>
+                    </div>
+
+                    {isConnectivityModalOpen && (
+                      <ConnectivityTestModal
+                        portainerUrl={values.EdgePortainerUrl}
+                        tunnelServerAddr={values.Edge.TunnelServerAddress}
+                        onDismiss={() => setIsConnectivityModalOpen(false)}
+                      />
+                    )}
+                  </>
+                )}
+
+                <FormControl
+                  inputId="edge_enforce_id"
+                  label="Enforce use of Portainer generated Edge ID"
+                  size="small"
+                  tooltip="This setting only applies to manually created environments."
+                  errors={errors.EnforceEdgeID}
+                >
+                  <Switch
+                    id="edge_enforce_id"
+                    data-cy="edge-enforce-id-switch"
+                    name="edge_enforce_id"
+                    className="space-right"
+                    checked={values.EnforceEdgeID}
+                    onChange={(e) =>
+                      setFieldValue('EnforceEdgeID', e.valueOf())
+                    }
+                  />
+                </FormControl>
+
+                <div className="form-group mt-5">
+                  <div className="col-sm-12">
+                    <LoadingButton
+                      disabled={!isValid || !dirty}
+                      data-cy="settings-edgeComputeButton"
+                      isLoading={isSubmitting}
+                      loadingText="Saving settings..."
+                    >
+                      Save settings
+                    </LoadingButton>
+                  </div>
+                </div>
+              </Form>
+            )}
+          </Formik>
+        </WidgetBody>
+      </Widget>
+    </div>
+  );
+}
diff --git a/app/react/portainer/settings/EdgeComputeView/EdgeComputeSettings/EdgeComputeSettings.validation.ts b/app/react/portainer/settings/EdgeComputeView/EdgeComputeSettings/EdgeComputeSettings.validation.ts
new file mode 100644
index 0000000..b1eee13
--- /dev/null
+++ b/app/react/portainer/settings/EdgeComputeView/EdgeComputeSettings/EdgeComputeSettings.validation.ts
@@ -0,0 +1,30 @@
+import { boolean, object, SchemaOf, string } from 'yup';
+
+import { validation as tunnelValidation } from '@/react/portainer/common/PortainerTunnelAddrField';
+import { validation as urlValidation } from '@/react/portainer/common/PortainerUrlField';
+import { isBE } from '@/react/portainer/feature-flags/feature-flags.service';
+
+import { FormValues } from './types';
+
+export function validationSchema(): SchemaOf<FormValues> {
+  return object()
+    .shape({
+      EnableEdgeComputeFeatures: boolean().required('This field is required.'),
+      EnforceEdgeID: boolean().required('This field is required.'),
+    })
+    .concat(
+      isBE
+        ? object({
+            EdgePortainerUrl: urlValidation(),
+            Edge: object({
+              TunnelServerAddress: tunnelValidation(),
+            }),
+          })
+        : object({
+            EdgePortainerUrl: string().default(''),
+            Edge: object({
+              TunnelServerAddress: string().default(''),
+            }),
+          })
+    );
+}
diff --git a/app/react/portainer/settings/EdgeComputeView/EdgeComputeSettings/index.ts b/app/react/portainer/settings/EdgeComputeView/EdgeComputeSettings/index.ts
new file mode 100644
index 0000000..7e4534b
--- /dev/null
+++ b/app/react/portainer/settings/EdgeComputeView/EdgeComputeSettings/index.ts
@@ -0,0 +1 @@
+export { EdgeComputeSettings } from './EdgeComputeSettings';
diff --git a/app/react/portainer/settings/EdgeComputeView/EdgeComputeSettings/types.ts b/app/react/portainer/settings/EdgeComputeView/EdgeComputeSettings/types.ts
new file mode 100644
index 0000000..6bdf97d
--- /dev/null
+++ b/app/react/portainer/settings/EdgeComputeView/EdgeComputeSettings/types.ts
@@ -0,0 +1,8 @@
+export interface FormValues {
+  EnableEdgeComputeFeatures: boolean;
+  EdgePortainerUrl: string;
+  EnforceEdgeID: boolean;
+  Edge: {
+    TunnelServerAddress: string;
+  };
+}
diff --git a/app/react/portainer/settings/EdgeComputeView/EdgeComputeSettingsView.tsx b/app/react/portainer/settings/EdgeComputeView/EdgeComputeSettingsView.tsx
new file mode 100644
index 0000000..ba10c9c
--- /dev/null
+++ b/app/react/portainer/settings/EdgeComputeView/EdgeComputeSettingsView.tsx
@@ -0,0 +1,24 @@
+import { Settings } from '@/react/portainer/settings/types';
+
+import { isBE } from '../../feature-flags/feature-flags.service';
+
+import { EdgeComputeSettings } from './EdgeComputeSettings';
+import { DeploymentSyncOptions } from './DeploymentSyncOptions/DeploymentSyncOptions';
+import { AutomaticEdgeEnvCreation } from './AutomaticEdgeEnvCreation';
+
+interface Props {
+  settings: Settings;
+  onSubmit(values: Settings): void;
+}
+
+export function EdgeComputeSettingsView({ settings, onSubmit }: Props) {
+  return (
+    <div className="row">
+      <EdgeComputeSettings settings={settings} onSubmit={onSubmit} />
+
+      <DeploymentSyncOptions />
+
+      {isBE && <AutomaticEdgeEnvCreation />}
+    </div>
+  );
+}
diff --git a/app/react/portainer/settings/SettingsView/ApplicationSettingsPanel/ApplicationSettingsPanel.tsx b/app/react/portainer/settings/SettingsView/ApplicationSettingsPanel/ApplicationSettingsPanel.tsx
new file mode 100644
index 0000000..da8af4a
--- /dev/null
+++ b/app/react/portainer/settings/SettingsView/ApplicationSettingsPanel/ApplicationSettingsPanel.tsx
@@ -0,0 +1,121 @@
+import { Settings as SettingsIcon } from 'lucide-react';
+import { Field, Form, Formik, useFormikContext } from 'formik';
+
+import { EdgeCheckinIntervalField } from '@/react/edge/components/EdgeCheckInIntervalField';
+import { useUpdateSettingsMutation } from '@/react/portainer/settings/queries';
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { Widget } from '@@/Widget';
+import { LoadingButton } from '@@/buttons';
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+
+import { type Settings } from '../../types';
+
+import { validation } from './validation';
+import { Values } from './types';
+import { LogoFieldset } from './LogoFieldset';
+import { ScreenBannerFieldset } from './ScreenBannerFieldset';
+import { TemplatesUrlSection } from './TemplatesUrlSection';
+
+export function ApplicationSettingsPanel({
+  onSuccess,
+  settings,
+}: {
+  onSuccess(settings: Settings): void;
+  settings: Settings;
+}) {
+  const mutation = useUpdateSettingsMutation();
+
+  const initialValues: Values = {
+    edgeAgentCheckinInterval: settings.EdgeAgentCheckinInterval,
+    loginBannerEnabled: !!settings.CustomLoginBanner,
+    loginBanner: settings.CustomLoginBanner,
+    logoEnabled: !!settings.LogoURL,
+    logo: settings.LogoURL,
+    snapshotInterval: settings.SnapshotInterval,
+    templatesUrl: settings.TemplatesURL,
+  };
+
+  return (
+    <Widget>
+      <Widget.Title icon={SettingsIcon} title="Application settings" />
+      <Widget.Body>
+        <Formik
+          initialValues={initialValues}
+          onSubmit={handleSubmit}
+          validationSchema={validation}
+          validateOnMount
+        >
+          <InnerForm isLoading={mutation.isLoading} />
+        </Formik>
+      </Widget.Body>
+    </Widget>
+  );
+
+  function handleSubmit(values: Values) {
+    mutation.mutate(
+      {
+        SnapshotInterval: values.snapshotInterval,
+        LogoURL: values.logo,
+        CustomLoginBanner: values.loginBanner,
+        TemplatesURL: values.templatesUrl,
+        EdgeAgentCheckinInterval: values.edgeAgentCheckinInterval,
+      },
+      {
+        onSuccess(settings) {
+          notifySuccess('Success', 'Application settings updated');
+          onSuccess(settings);
+        },
+      }
+    );
+  }
+}
+
+function InnerForm({ isLoading }: { isLoading: boolean }) {
+  const { values, setFieldValue, isValid, errors } = useFormikContext<Values>();
+
+  return (
+    <Form className="form-horizontal">
+      <FormControl
+        label="Snapshot interval"
+        inputId="snapshot_interval"
+        errors={errors.snapshotInterval}
+        required
+      >
+        <Field
+          as={Input}
+          id="snapshot_interval"
+          placeholder="e.g. 15m"
+          name="snapshotInterval"
+        />
+      </FormControl>
+
+      <EdgeCheckinIntervalField
+        value={values.edgeAgentCheckinInterval}
+        label="Edge agent default poll frequency"
+        isDefaultHidden
+        onChange={(value) => setFieldValue('edgeAgentCheckinInterval', value)}
+      />
+
+      <LogoFieldset />
+
+      <ScreenBannerFieldset />
+
+      <TemplatesUrlSection />
+
+      <div className="form-group">
+        <div className="col-sm-12">
+          <LoadingButton
+            isLoading={isLoading}
+            disabled={!isValid}
+            data-cy="settings-saveSettingsButton"
+            loadingText="Saving..."
+          >
+            Save application settings
+          </LoadingButton>
+        </div>
+      </div>
+    </Form>
+  );
+}
diff --git a/app/react/portainer/settings/SettingsView/ApplicationSettingsPanel/LogoFieldset.tsx b/app/react/portainer/settings/SettingsView/ApplicationSettingsPanel/LogoFieldset.tsx
new file mode 100644
index 0000000..ade9ca4
--- /dev/null
+++ b/app/react/portainer/settings/SettingsView/ApplicationSettingsPanel/LogoFieldset.tsx
@@ -0,0 +1,49 @@
+import { useField, Field } from 'formik';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+import { SwitchField } from '@@/form-components/SwitchField';
+
+import { useToggledValue } from '../useToggledValue';
+
+export function LogoFieldset() {
+  const [{ name }, { error }] = useField<string>('logo');
+
+  const [isEnabled, setIsEnabled] = useToggledValue('logo');
+
+  return (
+    <>
+      <div className="form-group">
+        <div className="col-sm-12">
+          <SwitchField
+            label="Use custom logo"
+            data-cy="custom-logo-switch"
+            checked={isEnabled}
+            name="toggle_logo"
+            labelClass="col-sm-3 col-lg-2"
+            onChange={(checked) => setIsEnabled(checked)}
+          />
+        </div>
+      </div>
+
+      {isEnabled && (
+        <div>
+          <div className="form-group">
+            <span className="col-sm-12 text-muted small">
+              You can specify the URL to your logo here. For an optimal display,
+              logo dimensions should be 155px by 55px.
+            </span>
+          </div>
+          <FormControl label="URL" inputId="logo_url" errors={error} required>
+            <Field
+              as={Input}
+              name={name}
+              id="logo_url"
+              placeholder="https://mycompany.com/logo.png"
+            />
+          </FormControl>
+        </div>
+      )}
+    </>
+  );
+}
diff --git a/app/react/portainer/settings/SettingsView/ApplicationSettingsPanel/ScreenBannerFieldset.tsx b/app/react/portainer/settings/SettingsView/ApplicationSettingsPanel/ScreenBannerFieldset.tsx
new file mode 100644
index 0000000..c6459af
--- /dev/null
+++ b/app/react/portainer/settings/SettingsView/ApplicationSettingsPanel/ScreenBannerFieldset.tsx
@@ -0,0 +1,54 @@
+import { useField, Field } from 'formik';
+
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { TextArea } from '@@/form-components/Input/Textarea';
+import { SwitchField } from '@@/form-components/SwitchField';
+
+import { useToggledValue } from '../useToggledValue';
+
+export function ScreenBannerFieldset() {
+  const [{ name }, { error }] = useField<string>('loginBanner');
+  const [isEnabled, setIsEnabled] = useToggledValue('loginBanner');
+
+  return (
+    <>
+      <div className="form-group">
+        <div className="col-sm-12">
+          <SwitchField
+            labelClass="col-sm-3 col-lg-2"
+            data-cy="logo-banner-switch"
+            label="Login screen banner"
+            checked={isEnabled}
+            name="toggle_login_banner"
+            onChange={(checked) => setIsEnabled(checked)}
+            featureId={FeatureId.CUSTOM_LOGIN_BANNER}
+          />
+        </div>
+
+        <div className="col-sm-12 text-muted small mt-2">
+          You can set a custom banner that will be shown to all users during
+          login.
+        </div>
+      </div>
+
+      {isEnabled && (
+        <FormControl
+          label="Details"
+          inputId="custom_login_banner"
+          errors={error}
+          required
+        >
+          <Field
+            as={TextArea}
+            name={name}
+            rows="5"
+            id="custom_login_banner"
+            placeholder="Banner details"
+          />
+        </FormControl>
+      )}
+    </>
+  );
+}
diff --git a/app/react/portainer/settings/SettingsView/ApplicationSettingsPanel/TemplatesUrlSection.tsx b/app/react/portainer/settings/SettingsView/ApplicationSettingsPanel/TemplatesUrlSection.tsx
new file mode 100644
index 0000000..1eb7a12
--- /dev/null
+++ b/app/react/portainer/settings/SettingsView/ApplicationSettingsPanel/TemplatesUrlSection.tsx
@@ -0,0 +1,46 @@
+import { useField, Field } from 'formik';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { FormSection } from '@@/form-components/FormSection';
+import { Input } from '@@/form-components/Input';
+import { useDocsUrl } from '@@/PageHeader/ContextHelp';
+
+// this value is taken from https://github.com/portainer/portainer/blob/develop/api/portainer.go#L1628
+const DEFAULT_URL =
+  'https://raw.githubusercontent.com/portainer/templates/v3/templates.json';
+
+export function TemplatesUrlSection() {
+  const [{ name }, { error }] = useField<string>('templatesUrl');
+
+  const buildTemplateDocUrl = useDocsUrl('/advanced/app-templates/build');
+
+  return (
+    <FormSection title="App Templates">
+      <div className="form-group">
+        <div className="col-sm-12 text-muted small">
+          <p>
+            You can specify the URL to your own template definitions file here.
+            See{' '}
+            <a href={buildTemplateDocUrl} target="_blank" rel="noreferrer">
+              Portainer documentation
+            </a>{' '}
+            for more details.
+          </p>
+          <p>
+            The default value is <a href={DEFAULT_URL}>{DEFAULT_URL}</a>
+          </p>
+        </div>
+      </div>
+
+      <FormControl label="URL" inputId="templates_url" errors={error}>
+        <Field
+          as={Input}
+          id="templates_url"
+          placeholder={DEFAULT_URL}
+          data-cy="settings-templateUrl"
+          name={name}
+        />
+      </FormControl>
+    </FormSection>
+  );
+}
diff --git a/app/react/portainer/settings/SettingsView/ApplicationSettingsPanel/index.ts b/app/react/portainer/settings/SettingsView/ApplicationSettingsPanel/index.ts
new file mode 100644
index 0000000..c7bd41c
--- /dev/null
+++ b/app/react/portainer/settings/SettingsView/ApplicationSettingsPanel/index.ts
@@ -0,0 +1 @@
+export { ApplicationSettingsPanel } from './ApplicationSettingsPanel';
diff --git a/app/react/portainer/settings/SettingsView/ApplicationSettingsPanel/types.ts b/app/react/portainer/settings/SettingsView/ApplicationSettingsPanel/types.ts
new file mode 100644
index 0000000..afa760e
--- /dev/null
+++ b/app/react/portainer/settings/SettingsView/ApplicationSettingsPanel/types.ts
@@ -0,0 +1,9 @@
+export interface Values {
+  snapshotInterval: string;
+  edgeAgentCheckinInterval: number;
+  loginBanner: string;
+  loginBannerEnabled: boolean;
+  logo: string;
+  logoEnabled: boolean;
+  templatesUrl: string;
+}
diff --git a/app/react/portainer/settings/SettingsView/ApplicationSettingsPanel/validation.ts b/app/react/portainer/settings/SettingsView/ApplicationSettingsPanel/validation.ts
new file mode 100644
index 0000000..53d341c
--- /dev/null
+++ b/app/react/portainer/settings/SettingsView/ApplicationSettingsPanel/validation.ts
@@ -0,0 +1,39 @@
+import { SchemaOf, boolean, number, object, string } from 'yup';
+
+import { isValidUrl } from '@@/form-components/validate-url';
+
+import { Values } from './types';
+
+export function validation(): SchemaOf<Values> {
+  return object({
+    edgeAgentCheckinInterval: number().required(),
+    loginBannerEnabled: boolean().default(false),
+    loginBanner: string()
+      .default('')
+      .when('loginBannerEnabled', {
+        is: true,
+        then: (schema) =>
+          schema.required('Login banner is required when enabled'),
+      }),
+    logoEnabled: boolean().default(false),
+    logo: string()
+      .default('')
+      .when('logoEnabled', {
+        is: true,
+        then: (schema) =>
+          schema
+            .required('Logo url is required when enabled')
+            .test('valid-url', 'Must be a valid URL', (value) =>
+              isValidUrl(value)
+            ),
+      }),
+    snapshotInterval: string().required('Snapshot interval is required'),
+    templatesUrl: string()
+      .default('')
+      .test(
+        'valid-url',
+        'Must be a valid URL',
+        (value) => !value || isValidUrl(value)
+      ),
+  });
+}
diff --git a/app/react/portainer/settings/SettingsView/BackupSettingsView/BackupFileForm.tsx b/app/react/portainer/settings/SettingsView/BackupSettingsView/BackupFileForm.tsx
new file mode 100644
index 0000000..c426353
--- /dev/null
+++ b/app/react/portainer/settings/SettingsView/BackupSettingsView/BackupFileForm.tsx
@@ -0,0 +1,69 @@
+import { Download } from 'lucide-react';
+import { Formik, Form } from 'formik';
+
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { LoadingButton } from '@@/buttons/LoadingButton';
+
+import { DownloadBackupPayload } from './queries/useDownloadBackupMutation';
+import { useDownloadBackupMutation } from './queries';
+import { validationSchema } from './BackupFileForm.validation';
+import { SecurityFieldset } from './SecurityFieldset';
+import { BackupFileSettings } from './types';
+
+export function BackupFileForm() {
+  const downloadMutate = useDownloadBackupMutation();
+
+  const settings: BackupFileSettings = {
+    password: '',
+    passwordProtect: false,
+  };
+
+  return (
+    <Formik<BackupFileSettings>
+      initialValues={settings}
+      validationSchema={validationSchema}
+      onSubmit={onSubmit}
+      validateOnMount
+    >
+      {({ isSubmitting, isValid }) => (
+        <Form className="form-horizontal">
+          <SecurityFieldset
+            switchDataCy="settings-passwordProtectLocal"
+            inputDataCy="settings-backupLocalPassword"
+          />
+
+          <div className="form-group">
+            <div className="col-sm-12">
+              <LoadingButton
+                loadingText="Downloading settings..."
+                data-cy="settings-downloadBackupLocalButton"
+                isLoading={isSubmitting}
+                disabled={!isValid}
+                className="!ml-0"
+                icon={Download}
+              >
+                Download backup
+              </LoadingButton>
+            </div>
+          </div>
+        </Form>
+      )}
+    </Formik>
+  );
+
+  async function onSubmit(values: BackupFileSettings) {
+    const payload: DownloadBackupPayload = {
+      password: '',
+    };
+    if (values.passwordProtect) {
+      payload.password = values.password;
+    }
+
+    downloadMutate.mutate(payload, {
+      onSuccess() {
+        notifySuccess('Success', 'Downloaded backup successfully');
+      },
+    });
+  }
+}
diff --git a/app/react/portainer/settings/SettingsView/BackupSettingsView/BackupFileForm.validation.ts b/app/react/portainer/settings/SettingsView/BackupSettingsView/BackupFileForm.validation.ts
new file mode 100644
index 0000000..5aaa52a
--- /dev/null
+++ b/app/react/portainer/settings/SettingsView/BackupSettingsView/BackupFileForm.validation.ts
@@ -0,0 +1,15 @@
+import { SchemaOf, object, string, boolean } from 'yup';
+
+import { BackupFileSettings } from './types';
+
+export function validationSchema(): SchemaOf<BackupFileSettings> {
+  return object({
+    passwordProtect: boolean().default(false),
+    password: string()
+      .default('')
+      .when('passwordProtect', {
+        is: true,
+        then: (schema) => schema.required('This field is required.'),
+      }),
+  });
+}
diff --git a/app/react/portainer/settings/SettingsView/BackupSettingsView/BackupS3Form.tsx b/app/react/portainer/settings/SettingsView/BackupSettingsView/BackupS3Form.tsx
new file mode 100644
index 0000000..f3b33c8
--- /dev/null
+++ b/app/react/portainer/settings/SettingsView/BackupSettingsView/BackupS3Form.tsx
@@ -0,0 +1,256 @@
+import { Formik, Form, Field } from 'formik';
+import { Upload } from 'lucide-react';
+import clsx from 'clsx';
+
+import {
+  isLimitedToBE,
+  isBE,
+} from '@/react/portainer/feature-flags/feature-flags.service';
+import { success as notifySuccess } from '@/portainer/services/notifications';
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { LoadingButton } from '@@/buttons/LoadingButton';
+import { Input } from '@@/form-components/Input';
+import { SwitchField } from '@@/form-components/SwitchField';
+import { BEOverlay } from '@@/BEFeatureIndicator/BEOverlay';
+
+import {
+  useBackupS3Settings,
+  useExportS3BackupMutation,
+  useUpdateBackupS3SettingsMutation,
+} from './queries';
+import { BackupS3Model, BackupS3Settings } from './types';
+import { validationSchema } from './BackupS3Form.validation';
+import { SecurityFieldset } from './SecurityFieldset';
+
+export function BackupS3Form() {
+  const limitedToBE = isLimitedToBE(FeatureId.S3_BACKUP_SETTING);
+
+  const exportS3Mutate = useExportS3BackupMutation();
+
+  const updateS3Mutate = useUpdateBackupS3SettingsMutation();
+
+  const settingsQuery = useBackupS3Settings({ enabled: isBE });
+  if (settingsQuery.isInitialLoading) {
+    return null;
+  }
+
+  const settings = settingsQuery.data;
+
+  const backupS3Settings = {
+    password: settings?.password || '',
+    cronRule: settings?.cronRule || '',
+    accessKeyID: settings?.accessKeyID || '',
+    secretAccessKey: settings?.secretAccessKey || '',
+    region: settings?.region || '',
+    bucketName: settings?.bucketName || '',
+    s3CompatibleHost: settings?.s3CompatibleHost || '',
+    scheduleAutomaticBackup: !!settings?.cronRule,
+    passwordProtect: !!settings?.password,
+  };
+
+  return (
+    <Formik<BackupS3Settings>
+      initialValues={backupS3Settings}
+      validationSchema={validationSchema}
+      onSubmit={onSubmit}
+      validateOnMount
+    >
+      {({ values, errors, isSubmitting, setFieldValue, isValid }) => (
+        <BEOverlay
+          featureId={FeatureId.S3_BACKUP_SETTING}
+          variant="form-section"
+        >
+          <Form className="form-horizontal">
+            <div className="form-group">
+              <div className="col-sm-12">
+                <SwitchField
+                  name="schedule-automatic-backup"
+                  data-cy="settings-scheduleAutomaticBackupSwitch"
+                  labelClass="col-sm-3 col-lg-2"
+                  label="Schedule automatic backups"
+                  checked={values.scheduleAutomaticBackup}
+                  onChange={(e) => setFieldValue('scheduleAutomaticBackup', e)}
+                />
+              </div>
+            </div>
+
+            {values.scheduleAutomaticBackup && (
+              <FormControl
+                inputId="cron_rule"
+                label="Cron rule"
+                size="small"
+                errors={errors.cronRule}
+                required
+              >
+                <Field
+                  id="cron_rule"
+                  name="cronRule"
+                  type="text"
+                  as={Input}
+                  placeholder="0 2 * * *"
+                  data-cy="settings-backupCronRuleInput"
+                  className={clsx({ 'limited-be': limitedToBE })}
+                  disabled={limitedToBE}
+                />
+              </FormControl>
+            )}
+
+            <FormControl
+              label="Access key ID"
+              inputId="access_key_id"
+              errors={errors.accessKeyID}
+            >
+              <Field
+                id="access_key_id"
+                name="accessKeyID"
+                type="text"
+                as={Input}
+                data-cy="settings-accessKeyIdInput"
+                className={clsx({ 'limited-be': limitedToBE })}
+                disabled={limitedToBE}
+              />
+            </FormControl>
+
+            <FormControl
+              label="Secret access key"
+              inputId="secret_access_key"
+              errors={errors.secretAccessKey}
+            >
+              <Field
+                id="secret_access_key"
+                name="secretAccessKey"
+                type="password"
+                as={Input}
+                data-cy="settings-secretAccessKeyInput"
+                className={clsx({ 'limited-be': limitedToBE })}
+                disabled={limitedToBE}
+              />
+            </FormControl>
+
+            <FormControl label="Region" inputId="region" errors={errors.region}>
+              <Field
+                id="region"
+                name="region"
+                type="text"
+                as={Input}
+                placeholder="default region is us-east-1 if left empty"
+                data-cy="settings-backupRegionInput"
+                className={clsx({ 'limited-be': limitedToBE })}
+                disabled={limitedToBE}
+              />
+            </FormControl>
+
+            <FormControl
+              label="Bucket name"
+              inputId="bucket_name"
+              errors={errors.bucketName}
+            >
+              <Field
+                id="bucket_name"
+                name="bucketName"
+                type="text"
+                as={Input}
+                data-cy="settings-backupBucketNameInput"
+                className={clsx({ 'limited-be': limitedToBE })}
+                disabled={limitedToBE}
+              />
+            </FormControl>
+
+            <FormControl
+              label="S3 compatible host"
+              inputId="s3_compatible_host"
+              tooltip="Hostname of a S3 service"
+              errors={errors.s3CompatibleHost}
+            >
+              <Field
+                id="s3_compatible_host"
+                name="s3CompatibleHost"
+                type="text"
+                as={Input}
+                placeholder="leave empty for AWS S3"
+                data-cy="settings-backupS3CompatibleHostInput"
+                className={clsx({ 'limited-be': limitedToBE })}
+                disabled={limitedToBE}
+              />
+            </FormControl>
+
+            <SecurityFieldset
+              switchDataCy="settings-passwordProtectToggleS3"
+              inputDataCy="settings-backups3pw"
+              disabled={limitedToBE}
+            />
+
+            <div className="form-group">
+              <div className="col-sm-12">
+                <LoadingButton
+                  type="button"
+                  loadingText="Exporting..."
+                  isLoading={isSubmitting}
+                  className={clsx('!ml-0', { 'limited-be': limitedToBE })}
+                  disabled={!isValid || limitedToBE}
+                  data-cy="settings-exportBackupS3Button"
+                  icon={Upload}
+                  onClick={() => {
+                    handleExport(values);
+                  }}
+                >
+                  Export backup
+                </LoadingButton>
+              </div>
+            </div>
+            <div className="form-group">
+              <div className="col-sm-12">
+                <LoadingButton
+                  loadingText="Saving settings..."
+                  isLoading={isSubmitting}
+                  className={clsx('!ml-0', { 'limited-be': limitedToBE })}
+                  disabled={!isValid || limitedToBE}
+                  data-cy="settings-saveBackupSettingsButton"
+                >
+                  Save backup settings
+                </LoadingButton>
+              </div>
+            </div>
+          </Form>
+        </BEOverlay>
+      )}
+    </Formik>
+  );
+
+  function handleExport(values: BackupS3Settings) {
+    const payload: BackupS3Model = {
+      password: values.passwordProtect ? values.password : '',
+      cronRule: values.scheduleAutomaticBackup ? values.cronRule : '',
+      accessKeyID: values.accessKeyID,
+      secretAccessKey: values.secretAccessKey,
+      region: values.region,
+      bucketName: values.bucketName,
+      s3CompatibleHost: values.s3CompatibleHost,
+    };
+    exportS3Mutate.mutate(payload, {
+      onSuccess() {
+        notifySuccess('Success', 'Exported backup to S3 successfully');
+      },
+    });
+  }
+
+  async function onSubmit(values: BackupS3Settings) {
+    const payload: BackupS3Model = {
+      password: values.passwordProtect ? values.password : '',
+      cronRule: values.scheduleAutomaticBackup ? values.cronRule : '',
+      accessKeyID: values.accessKeyID,
+      secretAccessKey: values.secretAccessKey,
+      region: values.region,
+      bucketName: values.bucketName,
+      s3CompatibleHost: values.s3CompatibleHost,
+    };
+
+    updateS3Mutate.mutate(payload, {
+      onSuccess() {
+        notifySuccess('Success', 'S3 backup settings saved successfully');
+      },
+    });
+  }
+}
diff --git a/app/react/portainer/settings/SettingsView/BackupSettingsView/BackupS3Form.validation.ts b/app/react/portainer/settings/SettingsView/BackupSettingsView/BackupS3Form.validation.ts
new file mode 100644
index 0000000..aaed56d
--- /dev/null
+++ b/app/react/portainer/settings/SettingsView/BackupSettingsView/BackupS3Form.validation.ts
@@ -0,0 +1,59 @@
+import { SchemaOf, object, string, boolean } from 'yup';
+
+import { BackupS3Settings } from './types';
+
+export function validationSchema(): SchemaOf<BackupS3Settings> {
+  return object({
+    passwordProtect: boolean().default(false),
+    password: string()
+      .default('')
+      .when('passwordProtect', {
+        is: true,
+        then: (schema) => schema.required('This field is required.'),
+      }),
+    scheduleAutomaticBackup: boolean().default(false),
+    cronRule: string()
+      .default('')
+      .when('scheduleAutomaticBackup', {
+        is: true,
+        then: (schema) =>
+          schema.required('This field is required.').when('cronRule', {
+            is: (val: string) => val !== '',
+            then: (schema) =>
+              schema.matches(
+                /^(\*(\/[1-9][0-9]*)?|([0-5]?[0-9]|6[0-9]|7[0-9])(-[0-5]?[0-9])?)(\s+(\*(\/[1-9][0-9]*)?|([0-5]?[0-9]|6[0-9]|7[0-9])(-[0-5]?[0-9])?)){4}$/,
+                'Please enter a valid cron rule.'
+              ),
+          }),
+      }),
+    accessKeyID: string()
+      .default('')
+      .when('scheduleAutomaticBackup', {
+        is: true,
+        then: (schema) => schema.required('This field is required.'),
+      }),
+    secretAccessKey: string()
+      .default('')
+      .when('scheduleAutomaticBackup', {
+        is: true,
+        then: (schema) => schema.required('This field is required.'),
+      }),
+    region: string().default('').optional(),
+    bucketName: string()
+      .default('')
+      .when('scheduleAutomaticBackup', {
+        is: true,
+        then: (schema) => schema.required('This field is required.'),
+      }),
+    s3CompatibleHost: string()
+      .default('')
+      .when({
+        is: (val: string) => val !== '',
+        then: (schema) =>
+          schema.matches(
+            /^https?:\/\//,
+            'S3 host must begin with http:// or https://.'
+          ),
+      }),
+  });
+}
diff --git a/app/react/portainer/settings/SettingsView/BackupSettingsView/BackupSettingsPanel.tsx b/app/react/portainer/settings/SettingsView/BackupSettingsView/BackupSettingsPanel.tsx
new file mode 100644
index 0000000..107e6b6
--- /dev/null
+++ b/app/react/portainer/settings/SettingsView/BackupSettingsView/BackupSettingsPanel.tsx
@@ -0,0 +1,43 @@
+import { Download } from 'lucide-react';
+import { useState } from 'react';
+
+import { Widget, WidgetBody, WidgetTitle } from '@@/Widget';
+import { FormSection } from '@@/form-components/FormSection';
+import { BoxSelector } from '@@/BoxSelector';
+
+import { BackupFormType, options } from './backup-options';
+import { BackupFileForm } from './BackupFileForm';
+import { BackupS3Form } from './BackupS3Form';
+
+export function BackupSettingsPanel() {
+  const [backupType, setBackupType] = useState(options[0].value);
+
+  return (
+    <Widget>
+      <WidgetTitle icon={Download} title="Back up Portainer" />
+      <WidgetBody>
+        <div className="form-horizontal">
+          <FormSection title="Backup configuration">
+            <div className="form-group col-sm-12 text-muted small">
+              This will back up your Portainer server configuration and does not
+              include containers.
+            </div>
+            <BoxSelector
+              slim
+              options={options}
+              value={backupType}
+              onChange={(v) => setBackupType(v)}
+              radioName="backup-type"
+            />
+
+            {backupType === BackupFormType.S3 ? (
+              <BackupS3Form />
+            ) : (
+              <BackupFileForm />
+            )}
+          </FormSection>
+        </div>
+      </WidgetBody>
+    </Widget>
+  );
+}
diff --git a/app/react/portainer/settings/SettingsView/BackupSettingsView/SecurityFieldset.tsx b/app/react/portainer/settings/SettingsView/BackupSettingsView/SecurityFieldset.tsx
new file mode 100644
index 0000000..46529fc
--- /dev/null
+++ b/app/react/portainer/settings/SettingsView/BackupSettingsView/SecurityFieldset.tsx
@@ -0,0 +1,60 @@
+import { useField, Field } from 'formik';
+
+import { FormSection } from '@@/form-components/FormSection';
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+import { SwitchField } from '@@/form-components/SwitchField';
+
+interface Props {
+  switchDataCy: string;
+  inputDataCy: string;
+  disabled?: boolean;
+}
+
+export function SecurityFieldset({
+  switchDataCy,
+  inputDataCy,
+  disabled,
+}: Props) {
+  const [{ value: passwordProtect }, , { setValue: setPasswordProtect }] =
+    useField<boolean>('passwordProtect');
+
+  const [{ name }, { error }] = useField<string>('password');
+
+  return (
+    <FormSection title="Security settings">
+      <div className="form-group">
+        <div className="col-sm-12">
+          <SwitchField
+            name="password-switch"
+            labelClass="col-sm-3 col-lg-2"
+            label="Password Protect"
+            checked={passwordProtect}
+            data-cy={switchDataCy}
+            onChange={(checked) => setPasswordProtect(checked)}
+            disabled={disabled}
+          />
+        </div>
+      </div>
+
+      {passwordProtect && (
+        <FormControl
+          inputId="password"
+          label="Password"
+          size="small"
+          errors={error}
+          required
+        >
+          <Field
+            id="password"
+            name={name}
+            type="password"
+            as={Input}
+            data-cy={inputDataCy}
+            required
+          />
+        </FormControl>
+      )}
+    </FormSection>
+  );
+}
diff --git a/app/react/portainer/settings/SettingsView/BackupSettingsView/backup-options.tsx b/app/react/portainer/settings/SettingsView/BackupSettingsView/backup-options.tsx
new file mode 100644
index 0000000..c91e54e
--- /dev/null
+++ b/app/react/portainer/settings/SettingsView/BackupSettingsView/backup-options.tsx
@@ -0,0 +1,27 @@
+import { DownloadCloud, UploadCloud } from 'lucide-react';
+
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+
+import { BadgeIcon } from '@@/BadgeIcon';
+
+export enum BackupFormType {
+  S3 = 's3',
+  File = 'file',
+}
+
+export const options = [
+  {
+    id: 'backup_file',
+    icon: <BadgeIcon icon={DownloadCloud} />,
+    label: 'Download backup file',
+    value: BackupFormType.File,
+  },
+  {
+    id: 'backup_s3',
+    icon: <BadgeIcon icon={UploadCloud} />,
+    label: 'Store in S3',
+    description: 'Define a cron schedule',
+    value: BackupFormType.S3,
+    feature: FeatureId.S3_BACKUP_SETTING,
+  },
+];
diff --git a/app/react/portainer/settings/SettingsView/BackupSettingsView/index.ts b/app/react/portainer/settings/SettingsView/BackupSettingsView/index.ts
new file mode 100644
index 0000000..ca1db9d
--- /dev/null
+++ b/app/react/portainer/settings/SettingsView/BackupSettingsView/index.ts
@@ -0,0 +1 @@
+export { BackupSettingsPanel } from './BackupSettingsPanel';
diff --git a/app/react/portainer/settings/SettingsView/BackupSettingsView/queries/backupSettings.service.ts b/app/react/portainer/settings/SettingsView/BackupSettingsView/queries/backupSettings.service.ts
new file mode 100644
index 0000000..a1645a7
--- /dev/null
+++ b/app/react/portainer/settings/SettingsView/BackupSettingsView/queries/backupSettings.service.ts
@@ -0,0 +1,12 @@
+export function buildUrl(subResource?: string, action?: string) {
+  let url = 'backup';
+  if (subResource) {
+    url += `/${subResource}`;
+  }
+
+  if (action) {
+    url += `/${action}`;
+  }
+
+  return url;
+}
diff --git a/app/react/portainer/settings/SettingsView/BackupSettingsView/queries/index.ts b/app/react/portainer/settings/SettingsView/BackupSettingsView/queries/index.ts
new file mode 100644
index 0000000..f7ef215
--- /dev/null
+++ b/app/react/portainer/settings/SettingsView/BackupSettingsView/queries/index.ts
@@ -0,0 +1,4 @@
+export { useBackupS3Settings } from './useBackupS3Settings';
+export { useUpdateBackupS3SettingsMutation } from './useUpdateBackupS3SettingsMutation';
+export { useDownloadBackupMutation } from './useDownloadBackupMutation';
+export { useExportS3BackupMutation } from './useExportS3BackupMutation';
diff --git a/app/react/portainer/settings/SettingsView/BackupSettingsView/queries/queryKeys.ts b/app/react/portainer/settings/SettingsView/BackupSettingsView/queries/queryKeys.ts
new file mode 100644
index 0000000..1256196
--- /dev/null
+++ b/app/react/portainer/settings/SettingsView/BackupSettingsView/queries/queryKeys.ts
@@ -0,0 +1,4 @@
+export const queryKeys = {
+  base: () => ['settings'] as const,
+  backupS3Settings: () => [...queryKeys.base(), 'backupS3Settings'] as const,
+};
diff --git a/app/react/portainer/settings/SettingsView/BackupSettingsView/queries/useBackupS3Settings.ts b/app/react/portainer/settings/SettingsView/BackupSettingsView/queries/useBackupS3Settings.ts
new file mode 100644
index 0000000..108868a
--- /dev/null
+++ b/app/react/portainer/settings/SettingsView/BackupSettingsView/queries/useBackupS3Settings.ts
@@ -0,0 +1,36 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+
+import { BackupS3Model } from '../types';
+
+import { buildUrl } from './backupSettings.service';
+import { queryKeys } from './queryKeys';
+
+export function useBackupS3Settings<T = BackupS3Model>({
+  select,
+  enabled,
+  onSuccess,
+}: {
+  select?: (settings: BackupS3Model) => T;
+  enabled?: boolean;
+  onSuccess?: (data: T) => void;
+} = {}) {
+  return useQuery(queryKeys.backupS3Settings(), getBackupS3Settings, {
+    select,
+    enabled,
+    ...withError('Unable to retrieve s3 backup settings'),
+    onSuccess,
+  });
+}
+
+async function getBackupS3Settings() {
+  try {
+    const { data } = await axios.get<BackupS3Model>(buildUrl('s3', 'settings'));
+
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e as Error, 'Unable to retrieve s3 backup settings');
+  }
+}
diff --git a/app/react/portainer/settings/SettingsView/BackupSettingsView/queries/useDownloadBackupMutation.ts b/app/react/portainer/settings/SettingsView/BackupSettingsView/queries/useDownloadBackupMutation.ts
new file mode 100644
index 0000000..05db6fc
--- /dev/null
+++ b/app/react/portainer/settings/SettingsView/BackupSettingsView/queries/useDownloadBackupMutation.ts
@@ -0,0 +1,35 @@
+import { useMutation } from '@tanstack/react-query';
+import { saveAs } from 'file-saver';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+
+import { buildUrl } from './backupSettings.service';
+
+export interface DownloadBackupPayload {
+  password: string;
+}
+
+export function useDownloadBackupMutation() {
+  return useMutation(downloadBackup, {
+    ...withError('Unable to download backup'),
+  });
+}
+
+async function downloadBackup(payload: DownloadBackupPayload) {
+  try {
+    const response = await axios.post(buildUrl(), payload, {
+      responseType: 'arraybuffer',
+    });
+
+    const file = response.data;
+    const filename = response.headers['content-disposition'].replace(
+      'attachment; filename=',
+      ''
+    );
+    const blob = new Blob([file], { type: 'application/zip' });
+    return saveAs(blob, filename);
+  } catch (e) {
+    throw parseAxiosError(e as Error, 'Unable to download backup');
+  }
+}
diff --git a/app/react/portainer/settings/SettingsView/BackupSettingsView/queries/useExportS3BackupMutation.ts b/app/react/portainer/settings/SettingsView/BackupSettingsView/queries/useExportS3BackupMutation.ts
new file mode 100644
index 0000000..c7507ea
--- /dev/null
+++ b/app/react/portainer/settings/SettingsView/BackupSettingsView/queries/useExportS3BackupMutation.ts
@@ -0,0 +1,24 @@
+import { useMutation } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+
+import { BackupS3Model } from '../types';
+
+import { buildUrl } from './backupSettings.service';
+
+export function useExportS3BackupMutation() {
+  return useMutation(exportS3Backup, {
+    ...withError('Unable to export backup to S3'),
+  });
+}
+
+async function exportS3Backup(payload: BackupS3Model) {
+  try {
+    const response = await axios.post(buildUrl('s3', 'execute'), payload, {});
+
+    return response.data;
+  } catch (e) {
+    throw parseAxiosError(e as Error, 'Unable to export s3 backup');
+  }
+}
diff --git a/app/react/portainer/settings/SettingsView/BackupSettingsView/queries/useUpdateBackupS3SettingsMutation.ts b/app/react/portainer/settings/SettingsView/BackupSettingsView/queries/useUpdateBackupS3SettingsMutation.ts
new file mode 100644
index 0000000..5c12337
--- /dev/null
+++ b/app/react/portainer/settings/SettingsView/BackupSettingsView/queries/useUpdateBackupS3SettingsMutation.ts
@@ -0,0 +1,29 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+
+import { BackupS3Model } from '../types';
+
+import { buildUrl } from './backupSettings.service';
+import { queryKeys } from './queryKeys';
+
+export function useUpdateBackupS3SettingsMutation() {
+  const queryClient = useQueryClient();
+
+  return useMutation(updateBackupS3Settings, {
+    onSuccess: () =>
+      queryClient.invalidateQueries(queryKeys.backupS3Settings()),
+    ...withError('Unable to save s3 backup settings'),
+  });
+}
+
+async function updateBackupS3Settings(payload: BackupS3Model) {
+  try {
+    const response = await axios.post(buildUrl('s3', 'settings'), payload);
+
+    return response.data;
+  } catch (e) {
+    throw parseAxiosError(e as Error, 'Unable to save s3 backup settings');
+  }
+}
diff --git a/app/react/portainer/settings/SettingsView/BackupSettingsView/types.ts b/app/react/portainer/settings/SettingsView/BackupSettingsView/types.ts
new file mode 100644
index 0000000..f739435
--- /dev/null
+++ b/app/react/portainer/settings/SettingsView/BackupSettingsView/types.ts
@@ -0,0 +1,26 @@
+export interface BackupS3Model {
+  cronRule: string;
+  accessKeyID: string;
+  secretAccessKey: string;
+  region: string;
+  bucketName: string;
+  password: string;
+  s3CompatibleHost: string;
+}
+
+export interface BackupS3Settings {
+  passwordProtect: boolean;
+  password: string;
+  scheduleAutomaticBackup: boolean;
+  cronRule: string;
+  accessKeyID: string;
+  secretAccessKey: string;
+  region: string;
+  bucketName: string;
+  s3CompatibleHost: string;
+}
+
+export interface BackupFileSettings {
+  passwordProtect: boolean;
+  password: string;
+}
diff --git a/app/react/portainer/settings/SettingsView/ExperimentalFeatures/ExperimentalFeatures.tsx b/app/react/portainer/settings/SettingsView/ExperimentalFeatures/ExperimentalFeatures.tsx
new file mode 100644
index 0000000..519b558
--- /dev/null
+++ b/app/react/portainer/settings/SettingsView/ExperimentalFeatures/ExperimentalFeatures.tsx
@@ -0,0 +1,28 @@
+import { FlaskConical } from 'lucide-react';
+
+import { useExperimentalSettings } from '@/react/portainer/settings/queries';
+
+import { Widget, WidgetBody, WidgetTitle } from '@@/Widget';
+
+import { ExperimentalFeaturesSettingsForm } from './ExperimentalFeaturesForm';
+
+export function ExperimentalFeatures() {
+  const settingsQuery = useExperimentalSettings();
+
+  if (!settingsQuery.data) {
+    return null;
+  }
+
+  const settings = settingsQuery.data;
+
+  return (
+    <Widget>
+      <WidgetTitle icon={FlaskConical} title="Experimental features" />
+      <WidgetBody>
+        <ExperimentalFeaturesSettingsForm
+          settings={settings.experimentalFeatures}
+        />
+      </WidgetBody>
+    </Widget>
+  );
+}
diff --git a/app/react/portainer/settings/SettingsView/ExperimentalFeatures/ExperimentalFeaturesForm.tsx b/app/react/portainer/settings/SettingsView/ExperimentalFeatures/ExperimentalFeaturesForm.tsx
new file mode 100644
index 0000000..8d24df9
--- /dev/null
+++ b/app/react/portainer/settings/SettingsView/ExperimentalFeatures/ExperimentalFeaturesForm.tsx
@@ -0,0 +1,87 @@
+import { Form, Formik } from 'formik';
+import * as yup from 'yup';
+import { useCallback } from 'react';
+import { FlaskConical } from 'lucide-react';
+
+import { notifySuccess } from '@/portainer/services/notifications';
+import { ExperimentalFeatures } from '@/react/portainer/settings/types';
+import { useUpdateExperimentalSettingsMutation } from '@/react/portainer/settings/queries';
+
+import { LoadingButton } from '@@/buttons/LoadingButton';
+import { TextTip } from '@@/Tip/TextTip';
+
+// eslint-disable-next-line @typescript-eslint/no-empty-object-type
+interface FormValues {}
+
+const validation = yup.object({});
+
+interface Props {
+  settings: ExperimentalFeatures;
+}
+
+export function ExperimentalFeaturesSettingsForm({ settings }: Props) {
+  const initialValues: FormValues = settings;
+
+  const mutation = useUpdateExperimentalSettingsMutation();
+
+  const { mutate: updateSettings } = mutation;
+
+  const handleSubmit = useCallback(() => {
+    updateSettings(
+      {},
+      {
+        onSuccess() {
+          notifySuccess(
+            'Success',
+            'Successfully updated experimental features settings'
+          );
+        },
+      }
+    );
+  }, [updateSettings]);
+
+  return (
+    <Formik<FormValues>
+      initialValues={initialValues}
+      onSubmit={handleSubmit}
+      validationSchema={validation}
+      validateOnMount
+      enableReinitialize
+    >
+      {({ isValid, dirty }) => (
+        <Form className="form-horizontal">
+          <TextTip color="blue" icon={FlaskConical}>
+            Experimental features may be discontinued without notice.
+          </TextTip>
+
+          <br />
+          <br />
+
+          <div className="form-group col-sm-12 text-muted small">
+            In Portainer releases, we may introduce features that we&apos;re
+            experimenting with. These will be items in the early phases of
+            development with limited testing.
+            <br />
+            Our goal is to gain early user feedback, so we can refine, enhance
+            and ultimately make our features the best they can be. Disabling an
+            experimental feature will prevent access to it.
+          </div>
+
+          <div className="form-group">
+            <div className="col-sm-12">
+              <LoadingButton
+                loadingText="Saving settings..."
+                isLoading={mutation.isLoading}
+                disabled={!isValid || !dirty}
+                className="!ml-0"
+                data-cy="settings-experimentalButton"
+              >
+                Save experimental settings
+              </LoadingButton>
+            </div>
+          </div>
+        </Form>
+      )}
+    </Formik>
+  );
+}
diff --git a/app/react/portainer/settings/SettingsView/ExperimentalFeatures/index.ts b/app/react/portainer/settings/SettingsView/ExperimentalFeatures/index.ts
new file mode 100644
index 0000000..a846020
--- /dev/null
+++ b/app/react/portainer/settings/SettingsView/ExperimentalFeatures/index.ts
@@ -0,0 +1 @@
+export { ExperimentalFeatures } from './ExperimentalFeatures';
diff --git a/app/react/portainer/settings/SettingsView/HelmCertPanel.tsx b/app/react/portainer/settings/SettingsView/HelmCertPanel.tsx
new file mode 100644
index 0000000..855a6f5
--- /dev/null
+++ b/app/react/portainer/settings/SettingsView/HelmCertPanel.tsx
@@ -0,0 +1,120 @@
+import { Form, Formik, useFormikContext } from 'formik';
+import { Key } from 'lucide-react';
+import { SchemaOf, object } from 'yup';
+
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { Widget } from '@@/Widget';
+import { TextTip } from '@@/Tip/TextTip';
+import { FileUploadField } from '@@/form-components/FileUpload';
+import { FormControl } from '@@/form-components/FormControl';
+import {
+  file,
+  withFileExtension,
+} from '@@/form-components/yup-file-validation';
+import { FormActions } from '@@/form-components/FormActions';
+import { BEOverlay } from '@@/BEFeatureIndicator/BEOverlay';
+
+import { FeatureId } from '../../feature-flags/enums';
+
+import { useUpdateSSLConfigMutation } from './useUpdateSSLConfigMutation';
+
+interface FormValues {
+  clientCertFile: File | null;
+}
+
+export function HelmCertPanel() {
+  const mutation = useUpdateSSLConfigMutation();
+  const initialValues = {
+    clientCertFile: null,
+  };
+
+  return (
+    <BEOverlay featureId={FeatureId.CA_FILE} variant="widget">
+      <Widget>
+        <Widget.Title
+          icon={Key}
+          title="Certificate Authority file for Kubernetes Helm repositories"
+        />
+        <Widget.Body>
+          <Formik
+            initialValues={initialValues}
+            validationSchema={validation}
+            onSubmit={handleSubmit}
+            validateOnMount
+          >
+            <InnerForm isLoading={mutation.isLoading} />
+          </Formik>
+        </Widget.Body>
+      </Widget>
+    </BEOverlay>
+  );
+
+  function handleSubmit({ clientCertFile }: FormValues) {
+    if (!clientCertFile) {
+      return;
+    }
+
+    mutation.mutate(
+      { clientCertFile },
+      {
+        onSuccess() {
+          notifySuccess('Success', 'Helm certificate updated');
+        },
+      }
+    );
+  }
+}
+
+function InnerForm({ isLoading }: { isLoading: boolean }) {
+  const { values, setFieldValue, errors, isValid } =
+    useFormikContext<FormValues>();
+
+  return (
+    <Form className="form-horizontal">
+      <div className="form-group">
+        <div className="col-sm-12">
+          <TextTip color="blue">
+            Provide an additional CA file containing certificate(s) for HTTPS
+            connections to Helm repositories.
+          </TextTip>
+        </div>
+      </div>
+
+      <FormControl
+        label="CA file"
+        tooltip="Select a CA file containing your X.509 certificate(s), commonly a crt, cer or pem file."
+        inputId="ca-cert-field"
+        errors={errors?.clientCertFile}
+      >
+        <FileUploadField
+          required
+          data-cy="helm-cert-panel-file-upload-field"
+          inputId="ca-cert-field"
+          name="clientCertFile"
+          onChange={(file) => setFieldValue('clientCertFile', file)}
+          value={values.clientCertFile}
+        />
+      </FormControl>
+
+      <FormActions
+        isValid={isValid}
+        isLoading={isLoading}
+        submitLabel="Apply changes"
+        loadingText="Saving in progress..."
+        data-cy="helm-cert-panel-submit-button"
+      />
+    </Form>
+  );
+}
+
+function validation(): SchemaOf<FormValues> {
+  return object({
+    clientCertFile: withFileExtension(file(), [
+      'pem',
+      'crt',
+      'cer',
+      'cert',
+    ]).required(''),
+  });
+}
diff --git a/app/react/portainer/settings/SettingsView/HiddenContainersPanel/AddLabelForm.tsx b/app/react/portainer/settings/SettingsView/HiddenContainersPanel/AddLabelForm.tsx
new file mode 100644
index 0000000..de739ee
--- /dev/null
+++ b/app/react/portainer/settings/SettingsView/HiddenContainersPanel/AddLabelForm.tsx
@@ -0,0 +1,71 @@
+import { Formik, Form, Field } from 'formik';
+import { Plus } from 'lucide-react';
+import { SchemaOf, object, string } from 'yup';
+import { useReducer } from 'react';
+
+import { Button } from '@@/buttons';
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+
+export function AddLabelForm({
+  onSubmit,
+  isLoading,
+}: {
+  onSubmit: (name: string, value: string) => void;
+  isLoading: boolean;
+}) {
+  const [formKey, clearForm] = useReducer((state) => state + 1, 0);
+
+  const initialValues = {
+    name: '',
+    value: '',
+  };
+
+  return (
+    <Formik
+      initialValues={initialValues}
+      onSubmit={handleSubmit}
+      validationSchema={validation}
+      key={formKey}
+    >
+      {({ errors, isValid, dirty }) => (
+        <Form className="form-horizontal">
+          <div className="flex w-full items-start gap-4">
+            <FormControl label="Name" errors={errors.name} className="flex-1">
+              <Field
+                as={Input}
+                name="name"
+                placeholder="e.g. com.example.foo"
+              />
+            </FormControl>
+
+            <FormControl label="Value" errors={errors.value} className="flex-1">
+              <Field as={Input} name="value" placeholder="e.g. bar" />
+            </FormControl>
+
+            <Button
+              type="submit"
+              data-cy="hidden-containersadd-label-button"
+              icon={Plus}
+              disabled={!dirty || !isValid || isLoading}
+            >
+              Add filter
+            </Button>
+          </div>
+        </Form>
+      )}
+    </Formik>
+  );
+
+  function handleSubmit(values: typeof initialValues) {
+    clearForm();
+    onSubmit(values.name, values.value);
+  }
+}
+
+function validation(): SchemaOf<{ name: string; value: string }> {
+  return object({
+    name: string().required('Name is required'),
+    value: string().default(''),
+  });
+}
diff --git a/app/react/portainer/settings/SettingsView/HiddenContainersPanel/HiddenContainersPanel.tsx b/app/react/portainer/settings/SettingsView/HiddenContainersPanel/HiddenContainersPanel.tsx
new file mode 100644
index 0000000..a911149
--- /dev/null
+++ b/app/react/portainer/settings/SettingsView/HiddenContainersPanel/HiddenContainersPanel.tsx
@@ -0,0 +1,62 @@
+import { Box } from 'lucide-react';
+
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { TextTip } from '@@/Tip/TextTip';
+import { Widget } from '@@/Widget';
+
+import { useSettings, useUpdateSettingsMutation } from '../../queries';
+import { Pair } from '../../types';
+
+import { AddLabelForm } from './AddLabelForm';
+import { HiddenContainersTable } from './HiddenContainersTable';
+
+export function HiddenContainersPanel() {
+  const settingsQuery = useSettings((settings) => settings.BlackListedLabels);
+  const mutation = useUpdateSettingsMutation();
+
+  if (!settingsQuery.data) {
+    return null;
+  }
+
+  const labels = settingsQuery.data;
+  return (
+    <Widget>
+      <Widget.Title icon={Box} title="Hidden containers" />
+      <Widget.Body>
+        <div className="mb-3">
+          <TextTip color="blue">
+            You can hide containers with specific labels from Portainer UI. You
+            need to specify the label name and value.
+          </TextTip>
+        </div>
+
+        <AddLabelForm
+          isLoading={mutation.isLoading}
+          onSubmit={(name, value) => handleSubmit([...labels, { name, value }])}
+        />
+
+        <HiddenContainersTable
+          labels={labels}
+          isLoading={mutation.isLoading}
+          onDelete={(name) =>
+            handleSubmit(labels.filter((label) => label.name !== name))
+          }
+        />
+      </Widget.Body>
+    </Widget>
+  );
+
+  function handleSubmit(labels: Pair[]) {
+    mutation.mutate(
+      {
+        BlackListedLabels: labels,
+      },
+      {
+        onSuccess: () => {
+          notifySuccess('Success', 'Hidden container settings updated');
+        },
+      }
+    );
+  }
+}
diff --git a/app/react/portainer/settings/SettingsView/HiddenContainersPanel/HiddenContainersTable.tsx b/app/react/portainer/settings/SettingsView/HiddenContainersPanel/HiddenContainersTable.tsx
new file mode 100644
index 0000000..3f4fd36
--- /dev/null
+++ b/app/react/portainer/settings/SettingsView/HiddenContainersPanel/HiddenContainersTable.tsx
@@ -0,0 +1,47 @@
+import { Trash2 } from 'lucide-react';
+
+import { DetailsTable } from '@@/DetailsTable';
+import { Button } from '@@/buttons';
+
+import { Pair } from '../../types';
+
+export function HiddenContainersTable({
+  labels,
+  isLoading,
+  onDelete,
+}: {
+  labels: Pair[];
+  isLoading: boolean;
+  onDelete: (name: string) => void;
+}) {
+  return (
+    <DetailsTable
+      headers={['Name', 'Value', '']}
+      className="table-hover"
+      emptyMessage="No filter available."
+      dataCy="hidden-containers-table"
+    >
+      {labels.map((label, index) => (
+        <DetailsTable.Row
+          key={index}
+          label={label.name}
+          columns={[
+            <Button
+              color="danger"
+              key={`remove-${index}`}
+              data-cy="hidden-containers-remove-filter-button"
+              size="xsmall"
+              icon={Trash2}
+              onClick={() => onDelete(label.name)}
+              disabled={isLoading}
+            >
+              Remove
+            </Button>,
+          ]}
+        >
+          {label.value}
+        </DetailsTable.Row>
+      ))}
+    </DetailsTable>
+  );
+}
diff --git a/app/react/portainer/settings/SettingsView/KubeSettingsPanel/DeploymentOptionsSection.tsx b/app/react/portainer/settings/SettingsView/KubeSettingsPanel/DeploymentOptionsSection.tsx
new file mode 100644
index 0000000..24fe599
--- /dev/null
+++ b/app/react/portainer/settings/SettingsView/KubeSettingsPanel/DeploymentOptionsSection.tsx
@@ -0,0 +1,109 @@
+import { useFormikContext } from 'formik';
+
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+import { isLimitedToBE } from '@/react/portainer/feature-flags/feature-flags.service';
+
+import { FormSection } from '@@/form-components/FormSection';
+import { SwitchField } from '@@/form-components/SwitchField';
+
+import { KubeNoteMinimumCharacters } from './KubeNoteMinimumCharacters';
+import { FormValues } from './types';
+
+export function DeploymentOptionsSection() {
+  const {
+    values: { globalDeploymentOptions: values },
+    setFieldValue,
+  } = useFormikContext<FormValues>();
+
+  const limitedFeature = isLimitedToBE(FeatureId.ENFORCE_DEPLOYMENT_OPTIONS);
+  return (
+    <FormSection title="Deployment options">
+      <div className="form-group">
+        <div className="col-sm-12">
+          <SwitchField
+            label="Enforce code-based deployment"
+            data-cy="kube-settings-enforce-code-based-deployment"
+            checked={values.hideAddWithForm}
+            name="toggle_hideAddWithForm"
+            featureId={FeatureId.ENFORCE_DEPLOYMENT_OPTIONS}
+            onChange={(value) => handleToggleAddWithForm(value)}
+            labelClass="col-sm-3 col-lg-2"
+            tooltip="Hides the 'Add with form' buttons and prevents adding/editing of resources via forms"
+          />
+        </div>
+      </div>
+      {values.hideAddWithForm && (
+        <div className="form-group flex flex-col gap-y-1">
+          <div className="col-sm-12">
+            <SwitchField
+              label="Allow web editor and custom template use"
+              data-cy="kube-settings-allow-web-editor-and-custom-template-use"
+              checked={!values.hideWebEditor}
+              name="toggle_hideWebEditor"
+              onChange={(value) =>
+                setFieldValue('globalDeploymentOptions.hideWebEditor', !value)
+              }
+              labelClass="col-sm-2 !pl-4"
+            />
+          </div>
+          <div className="col-sm-12">
+            <SwitchField
+              label="Allow specifying of a manifest via a URL"
+              data-cy="kube-settings-allow-specifying-of-a-manifest-via-a-url"
+              checked={!values.hideFileUpload}
+              name="toggle_hideFileUpload"
+              onChange={(value) =>
+                setFieldValue('globalDeploymentOptions.hideFileUpload', !value)
+              }
+              labelClass="col-sm-2 !pl-4"
+            />
+          </div>
+        </div>
+      )}
+      {!limitedFeature && (
+        <div className="form-group">
+          <div className="col-sm-12">
+            <SwitchField
+              label="Allow per environment override"
+              data-cy="kube-settings-allow-per-environment-override"
+              checked={values.perEnvOverride}
+              onChange={(value) =>
+                setFieldValue('globalDeploymentOptions.perEnvOverride', value)
+              }
+              name="toggle_perEnvOverride"
+              labelClass="col-sm-3 col-lg-2"
+              tooltip="Allows overriding of deployment options in the Cluster setup screen of each environment"
+            />
+          </div>
+        </div>
+      )}
+
+      <KubeNoteMinimumCharacters />
+
+      <div className="form-group">
+        <div className="col-sm-12">
+          <SwitchField
+            label="Allow stacks functionality with Kubernetes environments"
+            data-cy="kube-settings-allow-stacks-functionality"
+            checked={!values.hideStacksFunctionality}
+            onChange={(value) =>
+              setFieldValue(
+                'globalDeploymentOptions.hideStacksFunctionality',
+                !value
+              )
+            }
+            name="toggle_stacksFunctionality"
+            labelClass="col-sm-3 col-lg-2"
+            tooltip="This allows you to group your applications/workloads into a single ‘stack’, and then view or delete an entire stack. If disabled, stacks functionality will not show in the UI."
+          />
+        </div>
+      </div>
+    </FormSection>
+  );
+
+  async function handleToggleAddWithForm(checked: boolean) {
+    await setFieldValue('globalDeploymentOptions.hideWebEditor', checked);
+    await setFieldValue('globalDeploymentOptions.hideFileUpload', checked);
+    await setFieldValue('globalDeploymentOptions.hideAddWithForm', checked);
+  }
+}
diff --git a/app/react/portainer/settings/SettingsView/KubeSettingsPanel/HelmSection.tsx b/app/react/portainer/settings/SettingsView/KubeSettingsPanel/HelmSection.tsx
new file mode 100644
index 0000000..0c21140
--- /dev/null
+++ b/app/react/portainer/settings/SettingsView/KubeSettingsPanel/HelmSection.tsx
@@ -0,0 +1,38 @@
+import { Field, useField } from 'formik';
+
+import { TextTip } from '@@/Tip/TextTip';
+import { FormControl } from '@@/form-components/FormControl';
+import { FormSection } from '@@/form-components/FormSection';
+import { Input } from '@@/form-components/Input';
+import { ExternalLink } from '@@/ExternalLink';
+
+export function HelmSection() {
+  const [{ name }, { error }] = useField<string>('helmRepositoryUrl');
+
+  return (
+    <FormSection title="Helm repository">
+      <div className="mb-2">
+        <TextTip color="blue">
+          You can specify the URL to your own{' '}
+          <ExternalLink
+            to="https://helm.sh/docs/topics/chart_repository/"
+            data-cy="helm-repository-link"
+          >
+            Helm repository
+          </ExternalLink>{' '}
+          here.
+        </TextTip>
+      </div>
+
+      <FormControl label="URL" errors={error} inputId="helm-repo-url">
+        <Field
+          as={Input}
+          id="helm-repo-url"
+          data-cy="helm-repo-url-input"
+          name={name}
+          placeholder="https://kubernetes.github.io/ingress-nginx"
+        />
+      </FormControl>
+    </FormSection>
+  );
+}
diff --git a/app/react/portainer/settings/SettingsView/KubeSettingsPanel/KubeConfigSection.tsx b/app/react/portainer/settings/SettingsView/KubeSettingsPanel/KubeConfigSection.tsx
new file mode 100644
index 0000000..b14deb9
--- /dev/null
+++ b/app/react/portainer/settings/SettingsView/KubeSettingsPanel/KubeConfigSection.tsx
@@ -0,0 +1,46 @@
+import { useField } from 'formik';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { FormSection } from '@@/form-components/FormSection';
+import { PortainerSelect } from '@@/form-components/PortainerSelect';
+
+const options = [
+  {
+    label: '1 day',
+    value: '24h',
+  },
+  {
+    label: '7 days',
+    value: `${24 * 7}h`,
+  },
+  {
+    label: '30 days',
+    value: `${24 * 30}h`,
+  },
+  {
+    label: '1 year',
+    value: `${24 * 30 * 12}h`,
+  },
+  {
+    label: 'No expiry',
+    value: '0',
+  },
+] as const;
+
+export function KubeConfigSection() {
+  const [{ value }, { error }, { setValue }] =
+    useField<string>('kubeconfigExpiry');
+
+  return (
+    <FormSection title="Kubeconfig">
+      <FormControl label="Kubeconfig expiry" errors={error}>
+        <PortainerSelect
+          value={value}
+          options={options}
+          onChange={(value) => value && setValue(value)}
+          data-cy="kubeconfig-expiry-selector"
+        />
+      </FormControl>
+    </FormSection>
+  );
+}
diff --git a/app/react/portainer/settings/SettingsView/KubeSettingsPanel/KubeNoteMinimumCharacters.tsx b/app/react/portainer/settings/SettingsView/KubeSettingsPanel/KubeNoteMinimumCharacters.tsx
new file mode 100644
index 0000000..a0be048
--- /dev/null
+++ b/app/react/portainer/settings/SettingsView/KubeSettingsPanel/KubeNoteMinimumCharacters.tsx
@@ -0,0 +1,63 @@
+import { useField } from 'formik';
+
+import { FeatureId } from '@/react/portainer/feature-flags/enums';
+import { isBE } from '@/react/portainer/feature-flags/feature-flags.service';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { SwitchField } from '@@/form-components/SwitchField';
+import { Input } from '@@/form-components/Input';
+
+import { useToggledValue } from '../useToggledValue';
+
+export function KubeNoteMinimumCharacters() {
+  const [{ value }, { error }, { setValue }] = useField<number>(
+    'globalDeploymentOptions.minApplicationNoteLength'
+  );
+  const [isEnabled, setIsEnabled] = useToggledValue(
+    'globalDeploymentOptions.minApplicationNoteLength',
+    'globalDeploymentOptions.requireNoteOnApplications'
+  );
+
+  return (
+    <>
+      <div className="form-group">
+        <div className="col-sm-12">
+          <SwitchField
+            label="Require a note on applications"
+            data-cy="kube-settings-require-note-on-applications-switch"
+            checked={isEnabled}
+            name="toggle_requireNoteOnApplications"
+            onChange={(value) => setIsEnabled(value)}
+            featureId={FeatureId.K8S_REQUIRE_NOTE_ON_APPLICATIONS}
+            labelClass="col-sm-3 col-lg-2"
+            tooltip={`${
+              isBE ? '' : 'BE allows entry of notes in Add/Edit application. '
+            }Using this will enforce entry of a note in Add/Edit application (and prevent complete clearing of it in Application details).`}
+          />
+        </div>
+      </div>
+      {isEnabled && (
+        <FormControl
+          label={
+            <span className="pl-4">
+              Minimum number of characters note must have
+            </span>
+          }
+          errors={error}
+        >
+          <Input
+            name="minNoteLength"
+            data-cy="min-note-length-input"
+            type="number"
+            placeholder="50"
+            min="1"
+            max="9999"
+            value={value}
+            onChange={(e) => setValue(e.target.valueAsNumber)}
+            className="w-1/4"
+          />
+        </FormControl>
+      )}
+    </>
+  );
+}
diff --git a/app/react/portainer/settings/SettingsView/KubeSettingsPanel/KubeSettingsPanel.tsx b/app/react/portainer/settings/SettingsView/KubeSettingsPanel/KubeSettingsPanel.tsx
new file mode 100644
index 0000000..302ae75
--- /dev/null
+++ b/app/react/portainer/settings/SettingsView/KubeSettingsPanel/KubeSettingsPanel.tsx
@@ -0,0 +1,106 @@
+import { Form, Formik } from 'formik';
+import { useQueryClient } from '@tanstack/react-query';
+
+import kubeIcon from '@/assets/ico/kube.svg?c';
+import { notifySuccess } from '@/portainer/services/notifications';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+
+import { LoadingButton } from '@@/buttons';
+import { Widget } from '@@/Widget';
+
+import { useUpdateSettingsMutation } from '../../queries';
+import { Settings } from '../../types';
+
+import { HelmSection } from './HelmSection';
+import { KubeConfigSection } from './KubeConfigSection';
+import { FormValues } from './types';
+import { DeploymentOptionsSection } from './DeploymentOptionsSection';
+import { validation } from './validation';
+
+export function KubeSettingsPanel({ settings }: { settings: Settings }) {
+  const queryClient = useQueryClient();
+  const environmentId = useEnvironmentId(false);
+  const mutation = useUpdateSettingsMutation();
+
+  const initialValues: FormValues = {
+    helmRepositoryUrl: settings.HelmRepositoryURL || '',
+    kubeconfigExpiry: settings.KubeconfigExpiry || '0',
+    globalDeploymentOptions: {
+      ...{
+        requireNoteOnApplications: false,
+        minApplicationNoteLength: 0,
+        hideAddWithForm: false,
+        hideFileUpload: false,
+        hideWebEditor: false,
+        perEnvOverride: false,
+        hideStacksFunctionality: false,
+      },
+      ...settings.GlobalDeploymentOptions,
+    },
+  };
+
+  return (
+    <Widget id="kubernetes-settings">
+      <Widget.Title icon={kubeIcon} title="Kubernetes settings" />
+      <Widget.Body>
+        <Formik
+          initialValues={initialValues}
+          onSubmit={handleSubmit}
+          validationSchema={validation}
+          validateOnMount
+        >
+          {() => (
+            <Form className="form-horizontal">
+              <HelmSection />
+              <KubeConfigSection />
+              <DeploymentOptionsSection />
+
+              <div className="form-group">
+                <div className="col-sm-12">
+                  <LoadingButton
+                    isLoading={mutation.isLoading}
+                    data-cy="save-kubernetes-settings-button"
+                    loadingText="Saving"
+                    className="!ml-0"
+                  >
+                    Save Kubernetes settings
+                  </LoadingButton>
+                </div>
+              </div>
+            </Form>
+          )}
+        </Formik>
+      </Widget.Body>
+    </Widget>
+  );
+
+  function handleSubmit(values: FormValues) {
+    mutation.mutate(
+      {
+        HelmRepositoryURL: values.helmRepositoryUrl,
+        KubeconfigExpiry: values.kubeconfigExpiry,
+        GlobalDeploymentOptions: {
+          ...values.globalDeploymentOptions,
+          requireNoteOnApplications:
+            values.globalDeploymentOptions.requireNoteOnApplications,
+          minApplicationNoteLength: values.globalDeploymentOptions
+            .requireNoteOnApplications
+            ? values.globalDeploymentOptions.minApplicationNoteLength
+            : 0,
+        },
+      },
+      {
+        async onSuccess() {
+          if (environmentId) {
+            await queryClient.invalidateQueries([
+              'environments',
+              environmentId,
+              'deploymentOptions',
+            ]);
+          }
+          notifySuccess('Success', 'Kubernetes settings updated');
+        },
+      }
+    );
+  }
+}
diff --git a/app/react/portainer/settings/SettingsView/KubeSettingsPanel/index.ts b/app/react/portainer/settings/SettingsView/KubeSettingsPanel/index.ts
new file mode 100644
index 0000000..2bfb042
--- /dev/null
+++ b/app/react/portainer/settings/SettingsView/KubeSettingsPanel/index.ts
@@ -0,0 +1 @@
+export { KubeSettingsPanel } from './KubeSettingsPanel';
diff --git a/app/react/portainer/settings/SettingsView/KubeSettingsPanel/types.ts b/app/react/portainer/settings/SettingsView/KubeSettingsPanel/types.ts
new file mode 100644
index 0000000..77fa97e
--- /dev/null
+++ b/app/react/portainer/settings/SettingsView/KubeSettingsPanel/types.ts
@@ -0,0 +1,13 @@
+export interface FormValues {
+  helmRepositoryUrl: string;
+  kubeconfigExpiry: string;
+  globalDeploymentOptions: {
+    hideAddWithForm: boolean;
+    perEnvOverride: boolean;
+    hideWebEditor: boolean;
+    hideFileUpload: boolean;
+    requireNoteOnApplications: boolean;
+    minApplicationNoteLength: number;
+    hideStacksFunctionality: boolean;
+  };
+}
diff --git a/app/react/portainer/settings/SettingsView/KubeSettingsPanel/validation.ts b/app/react/portainer/settings/SettingsView/KubeSettingsPanel/validation.ts
new file mode 100644
index 0000000..a036e4f
--- /dev/null
+++ b/app/react/portainer/settings/SettingsView/KubeSettingsPanel/validation.ts
@@ -0,0 +1,34 @@
+import { SchemaOf, object, string, boolean } from 'yup';
+
+import { nanNumberSchema } from '@/react-tools/yup-schemas';
+
+import { isValidUrl } from '@@/form-components/validate-url';
+
+import { FormValues } from './types';
+
+export function validation(): SchemaOf<FormValues> {
+  return object().shape({
+    helmRepositoryUrl: string()
+      .default('')
+      .test('valid-url', 'Invalid URL', (value) => !value || isValidUrl(value)),
+    kubeconfigExpiry: string().required(),
+    globalDeploymentOptions: object().shape({
+      hideAddWithForm: boolean().required(),
+      perEnvOverride: boolean().required(),
+      hideWebEditor: boolean().required(),
+      hideFileUpload: boolean().required(),
+      requireNoteOnApplications: boolean().required(),
+      hideStacksFunctionality: boolean().required(),
+      minApplicationNoteLength: nanNumberSchema('Must be a number')
+        .default(0)
+        .when('requireNoteOnApplications', {
+          is: true,
+          then: (schema) =>
+            schema
+              .required()
+              .min(1, 'Value should be between 1 to 9999')
+              .max(9999, 'Value should be between 1 to 9999'),
+        }),
+    }),
+  });
+}
diff --git a/app/react/portainer/settings/SettingsView/SSLSettingsPanel/SSLSettingsPanel.tsx b/app/react/portainer/settings/SettingsView/SSLSettingsPanel/SSLSettingsPanel.tsx
new file mode 100644
index 0000000..6e37673
--- /dev/null
+++ b/app/react/portainer/settings/SettingsView/SSLSettingsPanel/SSLSettingsPanel.tsx
@@ -0,0 +1,225 @@
+import { Form, Formik } from 'formik';
+import { Key } from 'lucide-react';
+import { useState } from 'react';
+import { SchemaOf, bool, object } from 'yup';
+
+import { withHideOnExtension } from '@/react/hooks/withHideOnExtension';
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { Widget } from '@@/Widget';
+import { LoadingButton } from '@@/buttons';
+import {
+  file,
+  withFileExtension,
+} from '@@/form-components/yup-file-validation';
+import { TextTip } from '@@/Tip/TextTip';
+import { FormControl } from '@@/form-components/FormControl';
+import { FileUploadField } from '@@/form-components/FileUpload';
+import { SwitchField } from '@@/form-components/SwitchField';
+
+import { useUpdateSSLConfigMutation } from '../useUpdateSSLConfigMutation';
+import { useSSLSettings } from '../../queries/useSSLSettings';
+import { useSettings, useUpdateSettingsMutation } from '../../queries';
+
+interface FormValues {
+  certFile?: File;
+  keyFile?: File;
+  forceHTTPS: boolean;
+  forceSecureCookies: boolean;
+}
+
+export const SSLSettingsPanelWrapper = withHideOnExtension(SSLSettingsPanel);
+
+function SSLSettingsPanel() {
+  const settingsQuery = useSSLSettings();
+  const secureSettingsQuery = useSettings((s) => s.ForceSecureCookies);
+  const [reloadingPage, setReloadingPage] = useState(false);
+  const sslMutation = useUpdateSSLConfigMutation();
+  const settingsMutation = useUpdateSettingsMutation();
+
+  if (!settingsQuery.data || !secureSettingsQuery.isSuccess) {
+    return null;
+  }
+
+  const initialValues: FormValues = {
+    certFile: undefined,
+    keyFile: undefined,
+    forceHTTPS: !settingsQuery.data.httpEnabled,
+    forceSecureCookies: secureSettingsQuery.data,
+  };
+
+  const isLoading =
+    sslMutation.isLoading || settingsMutation.isLoading || reloadingPage;
+
+  return (
+    <Widget>
+      <Widget.Title icon={Key} title="SSL certificate" />
+      <Widget.Body>
+        <Formik
+          initialValues={initialValues}
+          onSubmit={handleSubmit}
+          validationSchema={validation}
+          validateOnMount
+          enableReinitialize
+        >
+          {({ values, setFieldValue, isValid, errors, dirty }) => (
+            <Form className="form-horizontal">
+              <div className="form-group">
+                <div className="col-sm-12">
+                  <TextTip color="orange">
+                    Forcing HTTPs only will cause Portainer to stop listening on
+                    the HTTP port. Any edge agent environment that is using HTTP
+                    will no longer be available.
+                  </TextTip>
+                </div>
+              </div>
+
+              <div className="form-group">
+                <div className="col-sm-12">
+                  <SwitchField
+                    checked={values.forceHTTPS}
+                    data-cy="settings-ssl-force-https-switch"
+                    label="Force HTTPS only"
+                    labelClass="col-sm-3 col-lg-2"
+                    name="forceHTTPS"
+                    onChange={(value) => setFieldValue('forceHTTPS', value)}
+                  />
+                </div>
+              </div>
+
+              <div className="form-group">
+                <div className="col-sm-12">
+                  <TextTip color="blue">
+                    Forcing secure cookies is intended for when users are
+                    accessing Portainer via a TLS-terminating reverse proxy or
+                    Kubernetes ingress. Forcing secure cookies when accessing
+                    Portainer over plain HTTP will break Portainer login
+                    entirely.
+                  </TextTip>
+                </div>
+              </div>
+
+              <div className="form-group">
+                <div className="col-sm-12">
+                  <SwitchField
+                    checked={values.forceSecureCookies}
+                    data-cy="settings-force-secure-cookies-switch"
+                    label="Force Secure cookies"
+                    labelClass="col-sm-3 col-lg-2"
+                    name="forceSecureCookies"
+                    onChange={(value) =>
+                      setFieldValue('forceSecureCookies', value)
+                    }
+                  />
+                </div>
+              </div>
+
+              <div className="form-group">
+                <div className="col-sm-12">
+                  <TextTip color="blue">
+                    Provide a new SSL Certificate to replace the existing one
+                    that is used for HTTPS connections.
+                  </TextTip>
+                </div>
+              </div>
+
+              <FormControl
+                label="SSL/TLS certificate"
+                tooltip="Select an X.509 certificate file, commonly a crt, cer or pem file."
+                inputId="ca-cert-field"
+                errors={errors.certFile}
+              >
+                <FileUploadField
+                  inputId="ca-cert-field"
+                  data-cy="ssl-cert-file-upload"
+                  name="certFile"
+                  onChange={(file) => setFieldValue('certFile', file)}
+                  value={values.certFile}
+                />
+              </FormControl>
+
+              <FormControl
+                label="SSL/TLS private key"
+                tooltip="Select a private key file, commonly a key, or pem file."
+                inputId="ca-cert-field"
+                errors={errors.keyFile}
+              >
+                <FileUploadField
+                  inputId="ca-cert-field"
+                  data-cy="ssl-key-file-upload"
+                  name="keyFile"
+                  onChange={(file) => setFieldValue('keyFile', file)}
+                  value={values.keyFile}
+                />
+              </FormControl>
+
+              <div className="form-group">
+                <div className="col-sm-12">
+                  <LoadingButton
+                    isLoading={isLoading}
+                    data-cy="save-ssl-settings-button"
+                    disabled={!dirty || !isValid}
+                    loadingText={reloadingPage ? 'Reloading' : 'Saving'}
+                    className="!ml-0"
+                  >
+                    Save SSL settings
+                  </LoadingButton>
+                </div>
+              </div>
+            </Form>
+          )}
+        </Formik>
+      </Widget.Body>
+    </Widget>
+  );
+
+  function handleSubmit({
+    certFile,
+    forceHTTPS,
+    keyFile,
+    forceSecureCookies,
+  }: FormValues) {
+    settingsMutation.mutate(
+      { ForceSecureCookies: forceSecureCookies },
+      {
+        onSuccess: () => {
+          notifySuccess('Success', 'Security settings updated');
+        },
+      }
+    );
+
+    const sslChanged =
+      certFile !== undefined ||
+      keyFile !== undefined ||
+      forceHTTPS !== !settingsQuery.data?.httpEnabled;
+
+    if (sslChanged) {
+      sslMutation.mutate(
+        { certFile, httpEnabled: !forceHTTPS, keyFile },
+        {
+          async onSuccess() {
+            await new Promise((resolve) => {
+              setTimeout(resolve, 10000);
+            });
+            window.location.reload();
+            setReloadingPage(true);
+          },
+        }
+      );
+    }
+  }
+}
+
+function validation(): SchemaOf<FormValues> {
+  return object({
+    certFile: withFileExtension(file(), [
+      'pem',
+      'crt',
+      'cer',
+      'cert',
+    ]).optional(),
+    keyFile: withFileExtension(file(), ['pem', 'key']).optional(),
+    forceHTTPS: bool().required(),
+    forceSecureCookies: bool().required(),
+  });
+}
diff --git a/app/react/portainer/settings/SettingsView/SettingsView.test.tsx b/app/react/portainer/settings/SettingsView/SettingsView.test.tsx
new file mode 100644
index 0000000..4e600ba
--- /dev/null
+++ b/app/react/portainer/settings/SettingsView/SettingsView.test.tsx
@@ -0,0 +1,93 @@
+import { render } from '@testing-library/react';
+import { HttpResponse, http } from 'msw';
+
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { server } from '@/setup-tests/server';
+
+import { SettingsView } from './SettingsView';
+
+describe('SettingsView', () => {
+  function setupMocks() {
+    // Mock the settings API endpoints
+    server.use(
+      http.get('/api/settings', () =>
+        HttpResponse.json({
+          LogoURL: '',
+          SnapshotInterval: '5m',
+        })
+      )
+    );
+
+    server.use(
+      http.get('/api/settings/experimental', () =>
+        HttpResponse.json({
+          experimentalFeatures: {},
+        })
+      )
+    );
+
+    // Mock public settings for feature flags
+    server.use(
+      http.get('/api/settings/public', () =>
+        HttpResponse.json({
+          Features: {
+            'disable-roles-sync': false,
+          },
+        })
+      )
+    );
+
+    // Mock SSL settings
+    server.use(
+      http.get('/api/ssl', () =>
+        HttpResponse.json({
+          HTTPSOnly: false,
+          SelfSigned: false,
+        })
+      )
+    );
+
+    // Mock debug settings
+    server.use(
+      http.get('/api/support/debug_log', () =>
+        HttpResponse.json({
+          LogLevel: 'INFO',
+          EnableProfiling: false,
+        })
+      )
+    );
+
+    // Mock backup S3 settings
+    server.use(
+      http.get('/api/backup/s3/settings', () =>
+        HttpResponse.json({
+          Enabled: false,
+          AccessKey: '',
+          SecretKey: '',
+          Region: '',
+          Bucket: '',
+        })
+      )
+    );
+  }
+
+  function renderComponent() {
+    const Wrapped = withTestQueryProvider(
+      withUserProvider(withTestRouter(SettingsView))
+    );
+    return render(<Wrapped />);
+  }
+
+  describe('Experimental Features', () => {
+    test('should NOT render ExperimentalFeatures component in CE edition', async () => {
+      setupMocks();
+      const { queryByText } = renderComponent();
+
+      // Check that the ExperimentalFeatures component is NOT rendered
+      const experimentalFeaturesTitle = queryByText('Experimental features');
+      expect(experimentalFeaturesTitle).not.toBeInTheDocument();
+    });
+  });
+});
diff --git a/app/react/portainer/settings/SettingsView/SettingsView.tsx b/app/react/portainer/settings/SettingsView/SettingsView.tsx
new file mode 100644
index 0000000..1f79d8f
--- /dev/null
+++ b/app/react/portainer/settings/SettingsView/SettingsView.tsx
@@ -0,0 +1,74 @@
+import { useEffect } from 'react';
+import angular from 'angular';
+
+import { StateManager } from '@/portainer/services/types';
+
+import { PageHeader } from '@@/PageHeader';
+
+import { useSettings } from '../queries';
+import { Settings } from '../types';
+import { isBE } from '../../feature-flags/feature-flags.service';
+
+import { ApplicationSettingsPanel } from './ApplicationSettingsPanel';
+import { BackupSettingsPanel } from './BackupSettingsView';
+import { HelmCertPanel } from './HelmCertPanel';
+import { HiddenContainersPanel } from './HiddenContainersPanel/HiddenContainersPanel';
+import { KubeSettingsPanel } from './KubeSettingsPanel';
+import { SSLSettingsPanelWrapper } from './SSLSettingsPanel/SSLSettingsPanel';
+import { ExperimentalFeatures } from './ExperimentalFeatures';
+
+export function SettingsView() {
+  const settingsQuery = useSettings();
+
+  useEffect(() => {
+    if (settingsQuery.data) {
+      const regEx = /#!.*#(.*)/;
+      const match = window.location.hash.match(regEx);
+      if (match && match[1]) {
+        document.getElementById(match[1])?.scrollIntoView();
+      }
+    }
+  }, [settingsQuery.data]);
+
+  return (
+    <>
+      <PageHeader title="Settings" breadcrumbs="Settings" reload />
+
+      <div className="mx-4 space-y-4">
+        {settingsQuery.data && (
+          <>
+            <ApplicationSettingsPanel
+              onSuccess={handleSuccess}
+              settings={settingsQuery.data}
+            />
+
+            <KubeSettingsPanel settings={settingsQuery.data} />
+          </>
+        )}
+
+        <HelmCertPanel />
+
+        <SSLSettingsPanelWrapper />
+
+        {isBE && <ExperimentalFeatures />}
+
+        <HiddenContainersPanel />
+
+        <BackupSettingsPanel />
+      </div>
+    </>
+  );
+}
+
+function handleSuccess(settings: Settings) {
+  // to sync "outside state" - for angularjs
+  // this is a hack, but it works
+  // state manager should be replaced with a non angular solution, maybe using zustand
+  const $injector = angular.element(document).injector();
+  $injector.invoke(
+    /* @ngInject */ (StateManager: StateManager) => {
+      StateManager?.updateLogo(settings.LogoURL);
+      StateManager?.updateSnapshotInterval(settings.SnapshotInterval);
+    }
+  );
+}
diff --git a/app/react/portainer/settings/SettingsView/useToggledValue.tsx b/app/react/portainer/settings/SettingsView/useToggledValue.tsx
new file mode 100644
index 0000000..8d1312e
--- /dev/null
+++ b/app/react/portainer/settings/SettingsView/useToggledValue.tsx
@@ -0,0 +1,21 @@
+import { useField } from 'formik';
+import { useState } from 'react';
+
+export function useToggledValue(
+  fieldName: string,
+  toggleFieldName = `${fieldName}Enabled`
+) {
+  const [, { value }, { setValue }] = useField<string>(fieldName);
+  const [, { value: isEnabled }, { setValue: setIsEnabled }] =
+    useField<boolean>(toggleFieldName);
+  const [oldValue, setOldValue] = useState(value);
+
+  async function handleIsEnabledChange(enabled: boolean) {
+    setOldValue(enabled ? '' : value);
+    // `setValue` is async, formik types are wrong for this version
+    await setIsEnabled(enabled);
+    await setValue(enabled ? oldValue : '', true);
+  }
+
+  return [isEnabled, handleIsEnabledChange] as const;
+}
diff --git a/app/react/portainer/settings/SettingsView/useUpdateSSLConfigMutation.tsx b/app/react/portainer/settings/SettingsView/useUpdateSSLConfigMutation.tsx
new file mode 100644
index 0000000..da8554f
--- /dev/null
+++ b/app/react/portainer/settings/SettingsView/useUpdateSSLConfigMutation.tsx
@@ -0,0 +1,43 @@
+import { useMutation } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { mutationOptions, withError } from '@/react-tools/react-query';
+
+export function useUpdateSSLConfigMutation() {
+  return useMutation(
+    updateSSLConfig,
+    mutationOptions(withError('Unable to update SSL configuration'))
+  );
+}
+
+interface SSLConfig {
+  // SSL Certificates
+  certFile?: File;
+  keyFile?: File;
+  httpEnabled?: boolean;
+
+  // SSL Client Certificates
+  clientCertFile?: File;
+}
+
+async function updateSSLConfig({
+  certFile,
+  keyFile,
+  clientCertFile,
+  ...payload
+}: SSLConfig) {
+  try {
+    const cert = certFile ? await certFile.text() : undefined;
+    const key = keyFile ? await keyFile.text() : undefined;
+    const clientCert = clientCertFile ? await clientCertFile.text() : undefined;
+
+    await axios.put('/ssl', {
+      ...payload,
+      cert,
+      key,
+      clientCert,
+    });
+  } catch (error) {
+    throw parseAxiosError(error, 'Unable to update SSL configuration');
+  }
+}
diff --git a/app/react/portainer/settings/queries/auth/useTestLdap.ts b/app/react/portainer/settings/queries/auth/useTestLdap.ts
new file mode 100644
index 0000000..4bcf5eb
--- /dev/null
+++ b/app/react/portainer/settings/queries/auth/useTestLdap.ts
@@ -0,0 +1,33 @@
+import { useMutation } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/react/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+import { LDAPSettings } from '@/react/portainer/settings/types';
+
+export function useTestLdapMutation() {
+  return useMutation({
+    mutationFn: testLdapLogin,
+    ...withError('Unable to test login'),
+  });
+}
+
+export async function testLdapLogin({
+  password,
+  settings,
+  username,
+}: {
+  settings: LDAPSettings;
+  username: string;
+  password: string;
+}): Promise<{ valid: boolean }> {
+  try {
+    const { data } = await axios.post<{ valid: boolean }>('/ldap/test', {
+      LDAPSettings: settings,
+      Username: username,
+      Password: password,
+    });
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to test login');
+  }
+}
diff --git a/app/react/portainer/settings/queries/index.ts b/app/react/portainer/settings/queries/index.ts
new file mode 100644
index 0000000..6f76643
--- /dev/null
+++ b/app/react/portainer/settings/queries/index.ts
@@ -0,0 +1,9 @@
+export { queryKeys } from './queryKeys';
+export {
+  useSettings,
+  useUpdateDefaultRegistrySettingsMutation,
+  useUpdateSettingsMutation,
+} from './useSettings';
+export { usePublicSettings } from './usePublicSettings';
+export { useExperimentalSettings } from './useExperimentalSettings';
+export { useUpdateExperimentalSettingsMutation } from './useExperimentalSettingsMutation';
diff --git a/app/react/portainer/settings/queries/queryKeys.ts b/app/react/portainer/settings/queries/queryKeys.ts
new file mode 100644
index 0000000..bd9330b
--- /dev/null
+++ b/app/react/portainer/settings/queries/queryKeys.ts
@@ -0,0 +1,5 @@
+export const queryKeys = {
+  base: () => ['settings'] as const,
+  public: () => [...queryKeys.base(), 'public'] as const,
+  experimental: () => [...queryKeys.base(), 'experimental'] as const,
+};
diff --git a/app/react/portainer/settings/queries/useAdminGroups.ts b/app/react/portainer/settings/queries/useAdminGroups.ts
new file mode 100644
index 0000000..9c2bfe3
--- /dev/null
+++ b/app/react/portainer/settings/queries/useAdminGroups.ts
@@ -0,0 +1,36 @@
+import { useMutation } from '@tanstack/react-query';
+
+import axios from '@/react/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+
+import { LDAPGroupSearchSettings } from '../types';
+
+const DEFAULT_GROUP_FILTER = '(objectClass=groupOfNames)';
+
+interface AdminGroupsPayload {
+  AdminGroupSearchSettings: LDAPGroupSearchSettings[];
+  AdminGroups?: string[];
+}
+
+async function fetchAdminGroups(
+  settings: AdminGroupsPayload
+): Promise<string[]> {
+  const payload: AdminGroupsPayload = {
+    ...settings,
+    AdminGroupSearchSettings: settings.AdminGroupSearchSettings.map((s) => ({
+      ...s,
+      GroupFilter: s.GroupFilter || DEFAULT_GROUP_FILTER,
+    })),
+  };
+  const { data } = await axios.post<string[]>('/ldap/admin-groups', {
+    LDAPSettings: payload,
+  });
+  return data;
+}
+
+export function useAdminGroupsMutation() {
+  return useMutation({
+    mutationFn: fetchAdminGroups,
+    ...withError('Failed to search admin groups'),
+  });
+}
diff --git a/app/react/portainer/settings/queries/useExperimentalSettings.ts b/app/react/portainer/settings/queries/useExperimentalSettings.ts
new file mode 100644
index 0000000..ba6058d
--- /dev/null
+++ b/app/react/portainer/settings/queries/useExperimentalSettings.ts
@@ -0,0 +1,39 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+
+import { ExperimentalFeatures } from '../types';
+import { buildUrl } from '../settings.service';
+
+import { queryKeys } from './queryKeys';
+
+type ExperimentalFeaturesSettings = {
+  experimentalFeatures: ExperimentalFeatures;
+};
+
+export function useExperimentalSettings<T = ExperimentalFeaturesSettings>(
+  select?: (settings: ExperimentalFeaturesSettings) => T,
+  enabled = true
+) {
+  return useQuery(queryKeys.experimental(), getExperimentalSettings, {
+    select,
+    enabled,
+    staleTime: 50,
+    ...withError('Unable to retrieve experimental settings'),
+  });
+}
+
+async function getExperimentalSettings() {
+  try {
+    const { data } = await axios.get<ExperimentalFeaturesSettings>(
+      buildUrl('experimental')
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(
+      e as Error,
+      'Unable to retrieve experimental settings'
+    );
+  }
+}
diff --git a/app/react/portainer/settings/queries/useExperimentalSettingsMutation.ts b/app/react/portainer/settings/queries/useExperimentalSettingsMutation.ts
new file mode 100644
index 0000000..b433072
--- /dev/null
+++ b/app/react/portainer/settings/queries/useExperimentalSettingsMutation.ts
@@ -0,0 +1,35 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import {
+  mutationOptions,
+  withError,
+  withInvalidate,
+} from '@/react-tools/react-query';
+
+import { ExperimentalFeatures } from '../types';
+import { buildUrl } from '../settings.service';
+
+import { queryKeys } from './queryKeys';
+
+export function useUpdateExperimentalSettingsMutation() {
+  const queryClient = useQueryClient();
+
+  return useMutation(
+    updateExperimentalSettings,
+    mutationOptions(
+      withInvalidate(queryClient, [queryKeys.base()]),
+      withError('Unable to update experimental settings')
+    )
+  );
+}
+
+async function updateExperimentalSettings(
+  settings: Partial<ExperimentalFeatures>
+) {
+  try {
+    await axios.put(buildUrl('experimental'), settings);
+  } catch (e) {
+    throw parseAxiosError(e as Error, 'Unable to update experimental settings');
+  }
+}
diff --git a/app/react/portainer/settings/queries/usePublicSettings.ts b/app/react/portainer/settings/queries/usePublicSettings.ts
new file mode 100644
index 0000000..871b499
--- /dev/null
+++ b/app/react/portainer/settings/queries/usePublicSettings.ts
@@ -0,0 +1,25 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { withError } from '@/react-tools/react-query';
+
+import { getPublicSettings } from '../settings.service';
+import { PublicSettingsResponse } from '../types';
+
+import { queryKeys } from './queryKeys';
+
+export function usePublicSettings<T = PublicSettingsResponse>({
+  enabled,
+  select,
+  onSuccess,
+}: {
+  select?: (settings: PublicSettingsResponse) => T;
+  enabled?: boolean;
+  onSuccess?: (data: T) => void;
+} = {}) {
+  return useQuery(queryKeys.public(), getPublicSettings, {
+    select,
+    ...withError('Unable to retrieve public settings'),
+    enabled,
+    onSuccess,
+  });
+}
diff --git a/app/react/portainer/settings/queries/useSSLSettings.ts b/app/react/portainer/settings/queries/useSSLSettings.ts
new file mode 100644
index 0000000..0226109
--- /dev/null
+++ b/app/react/portainer/settings/queries/useSSLSettings.ts
@@ -0,0 +1,24 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+interface SSLSettings {
+  certPath: string;
+  keyPath: string;
+  caCertPath: string;
+  selfSigned: boolean;
+  httpEnabled: boolean;
+}
+
+export function useSSLSettings() {
+  return useQuery<SSLSettings>(['sslSettings'], async () => getSSLSettings());
+}
+
+async function getSSLSettings() {
+  try {
+    const response = await axios.get<SSLSettings>('/ssl');
+    return response.data;
+  } catch (error) {
+    throw parseAxiosError(error, 'Unable to retrieve SSL settings');
+  }
+}
diff --git a/app/react/portainer/settings/queries/useSettings.ts b/app/react/portainer/settings/queries/useSettings.ts
new file mode 100644
index 0000000..04d7094
--- /dev/null
+++ b/app/react/portainer/settings/queries/useSettings.ts
@@ -0,0 +1,52 @@
+import { useQuery, useMutation, useQueryClient } from '@tanstack/react-query';
+
+import {
+  mutationOptions,
+  withError,
+  withInvalidate,
+} from '@/react-tools/react-query';
+
+import {
+  updateSettings,
+  getSettings,
+  updateDefaultRegistry,
+} from '../settings.service';
+import { DefaultRegistry, Settings } from '../types';
+
+import { queryKeys } from './queryKeys';
+
+export function useSettings<T = Settings>(
+  select?: (settings: Settings) => T,
+  enabled = true
+) {
+  return useQuery(queryKeys.base(), getSettings, {
+    select,
+    enabled,
+    staleTime: 50,
+    ...withError('Unable to retrieve settings'),
+  });
+}
+
+export function useUpdateSettingsMutation() {
+  const queryClient = useQueryClient();
+
+  return useMutation(
+    updateSettings,
+    mutationOptions(
+      withInvalidate(queryClient, [queryKeys.base(), ['cloud']]),
+      withError('Unable to update settings')
+    )
+  );
+}
+
+export function useUpdateDefaultRegistrySettingsMutation() {
+  const queryClient = useQueryClient();
+
+  return useMutation(
+    (payload: Partial<DefaultRegistry>) => updateDefaultRegistry(payload),
+    mutationOptions(
+      withInvalidate(queryClient, [queryKeys.base()]),
+      withError('Unable to update default registry settings')
+    )
+  );
+}
diff --git a/app/react/portainer/settings/settings.service.ts b/app/react/portainer/settings/settings.service.ts
new file mode 100644
index 0000000..68f74a7
--- /dev/null
+++ b/app/react/portainer/settings/settings.service.ts
@@ -0,0 +1,73 @@
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { PublicSettingsResponse, DefaultRegistry, Settings } from './types';
+
+export async function getPublicSettings() {
+  try {
+    const { data } = await axios.get<PublicSettingsResponse>(
+      buildUrl('public')
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(
+      e as Error,
+      'Unable to retrieve application settings'
+    );
+  }
+}
+
+export async function getGlobalDeploymentOptions() {
+  const publicSettings = await getPublicSettings();
+  return publicSettings.GlobalDeploymentOptions;
+}
+
+export async function getSettings() {
+  try {
+    const { data } = await axios.get<Settings>(buildUrl());
+    return data;
+  } catch (e) {
+    throw parseAxiosError(
+      e as Error,
+      'Unable to retrieve application settings'
+    );
+  }
+}
+
+type OptionalSettings = Omit<Partial<Settings>, 'Edge'> & {
+  Edge?: Partial<Settings['Edge']>;
+};
+
+export async function updateSettings(settings: OptionalSettings) {
+  try {
+    const { data } = await axios.put<Settings>(buildUrl(), settings);
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e as Error, 'Unable to update application settings');
+  }
+}
+
+export async function updateDefaultRegistry(
+  defaultRegistry: Partial<DefaultRegistry>
+) {
+  try {
+    await axios.put(buildUrl('default_registry'), defaultRegistry);
+  } catch (e) {
+    throw parseAxiosError(
+      e as Error,
+      'Unable to update default registry settings'
+    );
+  }
+}
+
+export function buildUrl(subResource?: string, action?: string) {
+  let url = 'settings';
+  if (subResource) {
+    url += `/${subResource}`;
+  }
+
+  if (action) {
+    url += `/${action}`;
+  }
+
+  return url;
+}
diff --git a/app/react/portainer/settings/types.ts b/app/react/portainer/settings/types.ts
new file mode 100644
index 0000000..dd88291
--- /dev/null
+++ b/app/react/portainer/settings/types.ts
@@ -0,0 +1,196 @@
+import { TeamId } from '@/react/portainer/users/teams/types';
+
+export interface TLSConfiguration {
+  TLS: boolean;
+  TLSSkipVerify: boolean;
+  TLSCACert?: string;
+  TLSCert?: string;
+  TLSKey?: string;
+}
+
+export interface LDAPGroupSearchSettings {
+  GroupBaseDN: string;
+  GroupFilter: string;
+  GroupAttribute: string;
+}
+
+export interface LDAPSearchSettings {
+  BaseDN: string;
+  Filter: string;
+  UserNameAttribute: string;
+}
+
+export interface LDAPSettings {
+  AnonymousMode: boolean;
+  ReaderDN: string;
+  Password?: string;
+  URL: string;
+  TLSConfig: TLSConfiguration;
+  StartTLS: boolean;
+  SearchSettings: LDAPSearchSettings[];
+  GroupSearchSettings: LDAPGroupSearchSettings[];
+  AutoCreateUsers: boolean;
+}
+
+export interface Pair {
+  name: string;
+  value?: string;
+}
+
+export interface OAuthSettings {
+  ClientID: string;
+  ClientSecret?: string;
+  AccessTokenURI: string;
+  AuthorizationURI: string;
+  ResourceURI: string;
+  RedirectURI: string;
+  UserIdentifier: string;
+  Scopes: string;
+  OAuthAutoCreateUsers: boolean;
+  DefaultTeamID: TeamId;
+  SSO: boolean;
+  LogoutURI: string;
+  KubeSecretKey: string;
+}
+
+export enum AuthenticationMethod {
+  /**
+   * Internal represents the internal authentication method (authentication against Portainer API)
+   */
+  Internal = 1,
+  /**
+   * LDAP represents the LDAP authentication method (authentication against a LDAP server)
+   */
+  LDAP,
+  /**
+   * OAuth represents the OAuth authentication method (authentication against a authorization server)
+   */
+  OAuth,
+  /**
+   * AD represents the Active Directory authentication method (authentication against a Microsoft Active Directory server)
+   */
+  AD,
+}
+
+/**
+ * The definition are based on oauth2 lib definition @https://pkg.go.dev/golang.org/x/oauth2#AuthStyle
+ */
+export enum OAuthStyle {
+  AutoDetect = 0,
+  InParams,
+  InHeader,
+}
+
+type Feature = string;
+
+export interface DefaultRegistry {
+  Hide: boolean;
+}
+
+// eslint-disable-next-line @typescript-eslint/no-empty-object-type
+export interface ExperimentalFeatures {}
+
+export interface Settings {
+  LogoURL: string;
+  CustomLoginBanner: string;
+  BlackListedLabels: Pair[];
+  AuthenticationMethod: AuthenticationMethod;
+  InternalAuthSettings: { RequiredPasswordLength: number };
+  LDAPSettings: LDAPSettings;
+  OAuthSettings: OAuthSettings;
+  FeatureFlagSettings: { [key: Feature]: boolean };
+  SnapshotInterval: string;
+  TemplatesURL: string;
+  EnableEdgeComputeFeatures: boolean;
+  UserSessionTimeout: string;
+  KubeconfigExpiry: string;
+  HelmRepositoryURL: string;
+  KubectlShellImage: string;
+  TrustOnFirstConnect: boolean;
+  EnforceEdgeID: boolean;
+  AgentSecret: string;
+  EdgePortainerUrl: string;
+  EdgeAgentCheckinInterval: number;
+  EdgeCommandInterval: number;
+  EdgePingInterval: number;
+  EdgeSnapshotInterval: number;
+  DisplayDonationHeader: boolean;
+  DisplayExternalContributors: boolean;
+  EnableHostManagementFeatures: boolean;
+  ExperimentalFeatures?: ExperimentalFeatures;
+  AllowVolumeBrowserForRegularUsers: boolean;
+  AllowBindMountsForRegularUsers: boolean;
+  AllowPrivilegedModeForRegularUsers: boolean;
+  AllowHostNamespaceForRegularUsers: boolean;
+  AllowStackManagementForRegularUsers: boolean;
+  AllowDeviceMappingForRegularUsers: boolean;
+  AllowContainerCapabilitiesForRegularUsers: boolean;
+  ForceSecureCookies: boolean;
+  GlobalDeploymentOptions?: GlobalDeploymentOptions;
+  Edge: {
+    PingInterval: number;
+    SnapshotInterval: number;
+    CommandInterval: number;
+    AsyncMode: boolean;
+    TunnelServerAddress: string;
+  };
+}
+
+export interface GlobalDeploymentOptions {
+  /** Hide manual deploy forms in portainer */
+  hideAddWithForm: boolean;
+  /** Configure this per environment or globally */
+  perEnvOverride: boolean;
+  /** Hide the web editor in the remaining visible forms */
+  hideWebEditor: boolean;
+  /** Hide the file upload option in the remaining visible forms */
+  hideFileUpload: boolean;
+  /** Make note on application add/edit screen required */
+  requireNoteOnApplications: boolean;
+  minApplicationNoteLength: number;
+
+  hideStacksFunctionality: boolean;
+}
+
+export interface PublicSettingsResponse {
+  /** URL to a logo that will be displayed on the login page as well as on top of the sidebar. Will use default Portainer logo when value is empty string  */
+  LogoURL: string;
+  /** The content in plaintext used to display in the login page. Will hide when value is empty string (only on BE) */
+  CustomLoginBanner: string;
+  /** Active authentication method for the Portainer instance. Valid values are: 1 for internal, 2 for LDAP, or 3 for oauth */
+  AuthenticationMethod: AuthenticationMethod;
+  /** The minimum required length for a password of any user when using internal auth mode */
+  RequiredPasswordLength: number;
+  /** Deployment options for encouraging deployment as code (only on BE) */
+  GlobalDeploymentOptions: GlobalDeploymentOptions;
+  /** Whether edge compute features are enabled */
+  EnableEdgeComputeFeatures: boolean;
+  /** Supported feature flags */
+  Features: { [key: Feature]: boolean };
+  /** The URL used for oauth login */
+  OAuthLoginURI: string;
+  /** The URL used for oauth logout */
+  OAuthLogoutURI: string;
+  /** Whether portainer internal auth view will be hidden (only on BE) */
+  OAuthHideInternalAuth: boolean;
+  /** The expiry of a Kubeconfig */
+  KubeconfigExpiry: string;
+  /** Whether team sync is enabled */
+  TeamSync: boolean;
+  /** Whether to hide default registry (only on BE) */
+  DefaultRegistry?: {
+    Hide: boolean;
+  };
+  Edge: {
+    /** Whether the device has been started in edge async mode */
+    AsyncMode: boolean;
+    /** The ping interval for edge agent - used in edge async mode [seconds] */
+    PingInterval: number;
+    /** The snapshot interval for edge agent - used in edge async mode [seconds] */
+    SnapshotInterval: number;
+    /** The command list interval for edge agent - used in edge async mode [seconds] */
+    CommandInterval: number;
+    /** The check in interval for edge agent (in seconds) - used in non async mode [seconds] */
+    CheckinInterval: number;
+  };
+}
diff --git a/app/react/portainer/system/build-url.ts b/app/react/portainer/system/build-url.ts
new file mode 100644
index 0000000..2d18285
--- /dev/null
+++ b/app/react/portainer/system/build-url.ts
@@ -0,0 +1,9 @@
+export function buildUrl(action?: string) {
+  let url = '/system';
+
+  if (action) {
+    url += `/${action}`;
+  }
+
+  return url;
+}
diff --git a/app/react/portainer/system/query-keys.ts b/app/react/portainer/system/query-keys.ts
new file mode 100644
index 0000000..4f2707a
--- /dev/null
+++ b/app/react/portainer/system/query-keys.ts
@@ -0,0 +1,3 @@
+export const queryKeys = {
+  base: () => ['system'] as const,
+};
diff --git a/app/react/portainer/system/useNodesCount.ts b/app/react/portainer/system/useNodesCount.ts
new file mode 100644
index 0000000..8993008
--- /dev/null
+++ b/app/react/portainer/system/useNodesCount.ts
@@ -0,0 +1,28 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+
+import { buildUrl } from './build-url';
+import { queryKeys } from './query-keys';
+
+export const queryKey = [...queryKeys.base(), 'nodes'] as const;
+
+export interface NodesCountResponse {
+  nodes: number;
+}
+
+async function getNodesCount() {
+  try {
+    const { data } = await axios.get<NodesCountResponse>(buildUrl('nodes'));
+    return data.nodes;
+  } catch (error) {
+    throw parseAxiosError(error as Error);
+  }
+}
+
+export function useNodesCount() {
+  return useQuery(queryKey, getNodesCount, {
+    ...withError('Unable to retrieve nodes count'),
+  });
+}
diff --git a/app/react/portainer/system/useSystemInfo.ts b/app/react/portainer/system/useSystemInfo.ts
new file mode 100644
index 0000000..5f2d482
--- /dev/null
+++ b/app/react/portainer/system/useSystemInfo.ts
@@ -0,0 +1,36 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+
+import { buildUrl } from './build-url';
+import { queryKeys } from './query-keys';
+
+export const queryKey = [...queryKeys.base(), 'info'] as const;
+
+export type ContainerPlatform =
+  | 'Docker Standalone'
+  | 'Docker Swarm'
+  | 'Kubernetes'
+  | 'Podman';
+
+export interface SystemInfoResponse {
+  platform: ContainerPlatform;
+  agents: number;
+  edgeAgents: number;
+}
+
+async function getSystemInfo() {
+  try {
+    const { data } = await axios.get<SystemInfoResponse>(buildUrl('info'));
+    return data;
+  } catch (error) {
+    throw parseAxiosError(error as Error);
+  }
+}
+
+export function useSystemInfo() {
+  return useQuery(queryKey, getSystemInfo, {
+    ...withError('Unable to retrieve system info'),
+  });
+}
diff --git a/app/react/portainer/system/useSystemStatus.ts b/app/react/portainer/system/useSystemStatus.ts
new file mode 100644
index 0000000..a71e48d
--- /dev/null
+++ b/app/react/portainer/system/useSystemStatus.ts
@@ -0,0 +1,48 @@
+import { UseQueryOptions, useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { isBE } from '../feature-flags/feature-flags.service';
+
+import { buildUrl } from './build-url';
+import { queryKeys } from './query-keys';
+
+export const queryKey = [...queryKeys.base(), 'status'] as const;
+
+export interface StatusResponse {
+  Edition: string;
+  Version: string;
+  InstanceID: string;
+}
+
+export async function getSystemStatus() {
+  try {
+    const { data } = await axios.get<StatusResponse>(buildUrl('status'));
+
+    data.Edition = isBE ? 'Business Edition' : 'Community Edition';
+
+    return data;
+  } catch (error) {
+    throw parseAxiosError(error as Error);
+  }
+}
+
+export function useSystemStatus<T = StatusResponse>({
+  select,
+  enabled,
+  retry,
+  onSuccess,
+}: {
+  select?: (status: StatusResponse) => T;
+  enabled?: boolean;
+  retry?: UseQueryOptions['retry'];
+  onSuccess?: (data: T) => void;
+} = {}) {
+  return useQuery(queryKey, () => getSystemStatus(), {
+    select,
+    enabled,
+    retry,
+    retryDelay: 1000,
+    onSuccess,
+  });
+}
diff --git a/app/react/portainer/system/useSystemVersion.ts b/app/react/portainer/system/useSystemVersion.ts
new file mode 100644
index 0000000..609130b
--- /dev/null
+++ b/app/react/portainer/system/useSystemVersion.ts
@@ -0,0 +1,53 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { buildUrl } from './build-url';
+import { queryKeys } from './query-keys';
+
+export const queryKey = [...queryKeys.base(), 'version'] as const;
+
+export interface VersionResponse {
+  // Whether portainer has an update available
+  UpdateAvailable: boolean;
+  // The latest version available
+  LatestVersion: string;
+  ServerVersion: string;
+  VersionSupport: 'STS' | 'LTS';
+  DatabaseVersion: string;
+  Build: {
+    BuildNumber: string;
+    ImageTag: string;
+    NodejsVersion: string;
+    PnpmVersion: string;
+    WebpackVersion: string;
+    GoVersion: string;
+    GitCommit: string;
+  };
+  Dependencies: {
+    DockerVersion: string;
+    HelmVersion: string;
+    KubectlVersion: string;
+    ComposeVersion: string;
+  };
+  Runtime: {
+    Env?: string[];
+  };
+}
+
+export async function getSystemVersion() {
+  try {
+    const { data } = await axios.get<VersionResponse>(buildUrl('version'));
+    return data;
+  } catch (error) {
+    throw parseAxiosError(error as Error);
+  }
+}
+
+export function useSystemVersion() {
+  return useQuery(queryKey, () => getSystemVersion(), {
+    // 24 hour stale time to reduce the number of requests to avoid github api rate limits
+    // a hard refresh of the browser will still trigger a new request
+    staleTime: 24 * 60 * 60 * 1000,
+  });
+}
diff --git a/app/react/portainer/system/useUpgradeEditionMutation.ts b/app/react/portainer/system/useUpgradeEditionMutation.ts
new file mode 100644
index 0000000..33ce665
--- /dev/null
+++ b/app/react/portainer/system/useUpgradeEditionMutation.ts
@@ -0,0 +1,30 @@
+import { useMutation } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+import { isAxiosError } from '@/portainer/services/axios/utils/isAxiosError';
+
+import { buildUrl } from './build-url';
+
+export function useUpgradeEditionMutation() {
+  return useMutation(upgradeEdition, {
+    ...withError('Unable to upgrade edition'),
+  });
+}
+
+async function upgradeEdition({ license }: { license: string }) {
+  try {
+    await axios.post(buildUrl('upgrade'), { license });
+  } catch (error) {
+    if (!isAxiosError(error)) {
+      throw error;
+    }
+
+    // if error is because the server disconnected, then everything went well
+    if (!error.response || !error.response.status) {
+      return;
+    }
+
+    throw parseAxiosError(error);
+  }
+}
diff --git a/app/react/portainer/templates/app-templates/AppTemplatesList.tsx b/app/react/portainer/templates/app-templates/AppTemplatesList.tsx
new file mode 100644
index 0000000..35e446e
--- /dev/null
+++ b/app/react/portainer/templates/app-templates/AppTemplatesList.tsx
@@ -0,0 +1,122 @@
+import { Edit } from 'lucide-react';
+import _ from 'lodash';
+import { useMemo, useState } from 'react';
+
+import { DatatableHeader } from '@@/datatables/DatatableHeader';
+import { Table } from '@@/datatables';
+import { useTableState } from '@@/datatables/useTableState';
+import { createPersistedStore } from '@@/datatables/types';
+import { DatatableFooter } from '@@/datatables/DatatableFooter';
+
+import { AppTemplatesListItem } from './AppTemplatesListItem';
+import { TemplateViewModel } from './view-model';
+import { ListState, TemplateType } from './types';
+import { useSortAndFilterTemplates } from './useSortAndFilter';
+import { Filters } from './Filters';
+
+export function AppTemplatesList({
+  templates: initialTemplates,
+  onSelect,
+  selectedId,
+  disabledTypes,
+  fixedCategories,
+  storageKey,
+  templateLinkParams,
+}: {
+  storageKey: string;
+  templates?: TemplateViewModel[];
+  onSelect?: (template: TemplateViewModel) => void;
+  selectedId?: TemplateViewModel['Id'];
+  disabledTypes?: Array<TemplateType>;
+  fixedCategories?: Array<string>;
+  templateLinkParams?: (template: TemplateViewModel) => {
+    to: string;
+    params: object;
+  };
+}) {
+  const [page, setPage] = useState(0);
+  const [store] = useState(() =>
+    createPersistedStore<ListState>(storageKey, undefined, (set) => ({
+      category: null,
+      setCategory: (category: ListState['category']) => set({ category }),
+      types: [],
+      setTypes: (types: ListState['types']) => set({ types }),
+    }))
+  );
+  const listState = useTableState(store, storageKey);
+
+  const templates = useMemo(() => {
+    if (!initialTemplates) {
+      return [];
+    }
+
+    if (!fixedCategories?.length) {
+      return initialTemplates;
+    }
+
+    return initialTemplates.filter((template) =>
+      fixedCategories.some((category) => template.Categories.includes(category))
+    );
+  }, [fixedCategories, initialTemplates]);
+
+  const filteredTemplates = useSortAndFilterTemplates(
+    templates || [],
+    listState,
+    disabledTypes
+  );
+
+  const pagedTemplates =
+    _.chunk(filteredTemplates, listState.pageSize)[page] || [];
+
+  return (
+    <Table.Container>
+      <DatatableHeader
+        onSearchChange={handleSearchChange}
+        searchValue={listState.search}
+        title="Templates"
+        titleIcon={Edit}
+        description={
+          <Filters
+            listState={listState}
+            templates={templates || []}
+            onChange={() => setPage(0)}
+            disabledTypes={disabledTypes}
+            fixedCategories={fixedCategories}
+          />
+        }
+        data-cy="app-templates-list-header"
+      />
+
+      <div className="blocklist gap-y-2 !px-[20px] !pb-[20px]" role="list">
+        {pagedTemplates.map((template) => (
+          <AppTemplatesListItem
+            key={template.Id}
+            template={template}
+            onSelect={onSelect}
+            isSelected={selectedId === template.Id}
+            linkParams={templateLinkParams?.(template)}
+          />
+        ))}
+        {!templates && <div className="text-muted text-center">Loading...</div>}
+        {filteredTemplates.length === 0 && (
+          <div className="text-muted text-center">No templates available.</div>
+        )}
+      </div>
+
+      <DatatableFooter
+        onPageChange={setPage}
+        page={page}
+        onPageSizeChange={listState.setPageSize}
+        pageSize={listState.pageSize}
+        pageCount={Math.ceil(filteredTemplates.length / listState.pageSize)}
+        totalSelected={0}
+        totalHiddenSelected={0}
+      />
+    </Table.Container>
+  );
+
+  function handleSearchChange(search: string) {
+    listState.setSearch(search);
+    setPage(0);
+  }
+}
diff --git a/app/react/portainer/templates/app-templates/AppTemplatesListItem.test.tsx b/app/react/portainer/templates/app-templates/AppTemplatesListItem.test.tsx
new file mode 100644
index 0000000..0857d3e
--- /dev/null
+++ b/app/react/portainer/templates/app-templates/AppTemplatesListItem.test.tsx
@@ -0,0 +1,112 @@
+import userEvent from '@testing-library/user-event';
+import { PropsWithChildren } from 'react';
+import { render } from '@testing-library/react';
+
+import { withTestRouter } from '@/react/test-utils/withRouter';
+
+import { AppTemplatesListItem as BaseComponent } from './AppTemplatesListItem';
+import { TemplateViewModel } from './view-model';
+import { TemplateType } from './types';
+
+test('should render AppTemplatesListItem component', () => {
+  const template: TemplateViewModel = {
+    Title: 'Test Template',
+    // provide necessary properties for the template object
+  } as TemplateViewModel;
+
+  const onSelect = vi.fn();
+  const isSelected = false;
+
+  const { getByText } = renderComponent({ isSelected, template, onSelect });
+
+  expect(getByText(template.Title, { exact: false })).toBeInTheDocument();
+});
+
+const copyAsCustomTestCases = [
+  {
+    type: TemplateType.Container,
+    expected: false,
+  },
+  {
+    type: TemplateType.ComposeStack,
+    expected: true,
+  },
+  {
+    type: TemplateType.SwarmStack,
+    expected: true,
+  },
+];
+
+// TODO - remove after fixing workaround for UISref
+vi.mock('@uirouter/react', async (importOriginal: () => Promise<object>) => ({
+  ...(await importOriginal()),
+  UISref: ({ children }: PropsWithChildren<unknown>) => children, // Mocking UISref to render its children directly
+  useSref: () => ({ href: '' }), // Mocking useSref to return an empty string
+}));
+
+copyAsCustomTestCases.forEach(({ type, expected }) => {
+  test(`copy as custom button should ${
+    expected ? '' : 'not '
+  }be rendered for type ${TemplateType[type]}`, () => {
+    const onSelect = vi.fn();
+    const isSelected = false;
+
+    const { queryByText, unmount } = renderComponent({
+      isSelected,
+      template: {
+        Type: type,
+      } as TemplateViewModel,
+      onSelect,
+    });
+
+    if (expected) {
+      expect(queryByText('Copy as Custom')).toBeVisible();
+    } else {
+      expect(queryByText('Copy as Custom')).toBeNull();
+    }
+
+    unmount();
+  });
+});
+
+test('should call onSelect when clicked', async () => {
+  const user = userEvent.setup();
+  const template: TemplateViewModel = {
+    Title: 'Test Template',
+    // provide necessary properties for the template object
+  } as TemplateViewModel;
+
+  const onSelect = vi.fn();
+  const isSelected = false;
+
+  const { getByLabelText } = renderComponent({
+    isSelected,
+    template,
+    onSelect,
+  });
+
+  const button = getByLabelText(template.Title);
+  await user.click(button);
+
+  expect(onSelect).toHaveBeenCalledWith(template);
+});
+
+function renderComponent({
+  isSelected = false,
+  onSelect,
+  template,
+}: {
+  template: TemplateViewModel;
+  onSelect?: () => void;
+  isSelected?: boolean;
+}) {
+  const AppTemplatesListItem = withTestRouter(BaseComponent);
+
+  return render(
+    <AppTemplatesListItem
+      template={template}
+      onSelect={onSelect}
+      isSelected={isSelected}
+    />
+  );
+}
diff --git a/app/react/portainer/templates/app-templates/AppTemplatesListItem.tsx b/app/react/portainer/templates/app-templates/AppTemplatesListItem.tsx
new file mode 100644
index 0000000..b39c500
--- /dev/null
+++ b/app/react/portainer/templates/app-templates/AppTemplatesListItem.tsx
@@ -0,0 +1,69 @@
+import { StackType } from '@/react/common/stacks/types';
+
+import { Button } from '@@/buttons';
+import { Link } from '@@/Link';
+
+import { TemplateItem } from '../components/TemplateItem';
+
+import { TemplateViewModel } from './view-model';
+import { TemplateType } from './types';
+
+export function AppTemplatesListItem({
+  template,
+  onSelect,
+  isSelected,
+  linkParams,
+}: {
+  template: TemplateViewModel;
+  onSelect?: (template: TemplateViewModel) => void;
+  isSelected: boolean;
+  linkParams?: { to: string; params: object };
+}) {
+  const duplicateCustomTemplateType = getCustomTemplateType(template.Type);
+
+  return (
+    <TemplateItem
+      template={template}
+      typeLabel={
+        template.Type === TemplateType.Container ? 'container' : 'stack'
+      }
+      linkParams={linkParams}
+      onSelect={() => onSelect?.(template)}
+      isSelected={isSelected}
+      renderActions={
+        duplicateCustomTemplateType && (
+          <div className="mr-5 mt-3">
+            <Button
+              as={Link}
+              data-cy="app-templates-duplicate-button"
+              size="xsmall"
+              onClick={(e) => {
+                e.stopPropagation();
+              }}
+              props={{
+                to: '.custom.new',
+                params: {
+                  appTemplateId: template.Id,
+                  type: duplicateCustomTemplateType,
+                },
+              }}
+            >
+              Copy as Custom
+            </Button>
+          </div>
+        )
+      }
+    />
+  );
+}
+
+function getCustomTemplateType(type: TemplateType): StackType | null {
+  switch (type) {
+    case TemplateType.SwarmStack:
+      return StackType.DockerSwarm;
+    case TemplateType.ComposeStack:
+      return StackType.DockerCompose;
+    default:
+      return null;
+  }
+}
diff --git a/app/react/portainer/templates/app-templates/AppTemplatesView.tsx b/app/react/portainer/templates/app-templates/AppTemplatesView.tsx
new file mode 100644
index 0000000..18aee72
--- /dev/null
+++ b/app/react/portainer/templates/app-templates/AppTemplatesView.tsx
@@ -0,0 +1,92 @@
+import { useParamState } from '@/react/hooks/useParamState';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useInfo } from '@/react/docker/proxy/queries/useInfo';
+import { useApiVersion } from '@/react/docker/proxy/queries/useVersion';
+import { useAuthorizations } from '@/react/hooks/useUser';
+
+import { PageHeader } from '@@/PageHeader';
+
+import { TemplateType } from './types';
+import { useAppTemplates } from './queries/useAppTemplates';
+import { AppTemplatesList } from './AppTemplatesList';
+import { DeployForm } from './DeployFormWidget/DeployFormWidget';
+
+export function AppTemplatesView() {
+  const envId = useEnvironmentId(false);
+
+  const hasCreateAuthQuery = useAuthorizations([
+    'DockerContainerCreate',
+    'PortainerStackCreate',
+  ]);
+  const [selectedTemplateId, setSelectedTemplateId] = useParamState<number>(
+    'template',
+    (param) => (param ? parseInt(param, 10) : 0)
+  );
+  const templatesQuery = useAppTemplates({ environmentId: envId });
+  const selectedTemplate = selectedTemplateId
+    ? templatesQuery.data?.find(
+        (template) => template.Id === selectedTemplateId
+      )
+    : undefined;
+
+  const { disabledTypes, fixedCategories, tableKey } = useViewFilter(envId);
+
+  return (
+    <>
+      <PageHeader title="Application templates list" breadcrumbs="Templates" />
+      {selectedTemplate && (
+        <DeployForm
+          template={selectedTemplate}
+          unselect={() => setSelectedTemplateId()}
+        />
+      )}
+
+      <AppTemplatesList
+        templates={templatesQuery.data}
+        selectedId={selectedTemplateId}
+        onSelect={
+          envId && hasCreateAuthQuery.authorized
+            ? (template) => setSelectedTemplateId(template.Id)
+            : undefined
+        }
+        disabledTypes={disabledTypes}
+        fixedCategories={fixedCategories}
+        storageKey={tableKey}
+        templateLinkParams={
+          !envId
+            ? (template) => ({
+                to: 'edge.stacks.new',
+                params: { templateId: template.Id, templateType: 'app' },
+              })
+            : undefined
+        }
+      />
+    </>
+  );
+}
+
+function useViewFilter(envId: number | undefined) {
+  const envInfoQuery = useInfo(envId);
+  const apiVersion = useApiVersion(envId);
+
+  if (!envId) {
+    // edge
+    return {
+      disabledTypes: [TemplateType.Container],
+      fixedCategories: ['edge'],
+      tableKey: 'edge-app-templates',
+    };
+  }
+
+  const showSwarmStacks =
+    apiVersion >= 1.25 &&
+    envInfoQuery.data &&
+    envInfoQuery.data.Swarm &&
+    envInfoQuery.data.Swarm.NodeID &&
+    envInfoQuery.data.Swarm.ControlAvailable;
+
+  return {
+    disabledTypes: !showSwarmStacks ? [TemplateType.SwarmStack] : [],
+    tableKey: 'docker-app-templates',
+  };
+}
diff --git a/app/react/portainer/templates/app-templates/DeployFormWidget/AdvancedSettings.tsx b/app/react/portainer/templates/app-templates/DeployFormWidget/AdvancedSettings.tsx
new file mode 100644
index 0000000..ac90931
--- /dev/null
+++ b/app/react/portainer/templates/app-templates/DeployFormWidget/AdvancedSettings.tsx
@@ -0,0 +1,52 @@
+import { Minus, Plus } from 'lucide-react';
+import { PropsWithChildren, ReactNode, useState } from 'react';
+
+import { Icon } from '@@/Icon';
+import { Button } from '@@/buttons';
+
+export function AdvancedSettings({
+  children,
+  label,
+}: PropsWithChildren<{
+  label: (isOpen: boolean) => ReactNode;
+}>) {
+  const [isOpen, setIsOpen] = useState(false);
+  return (
+    <>
+      <AdvancedSettingsToggle
+        isOpen={isOpen}
+        onClick={() => setIsOpen((value) => !value)}
+        label={label(isOpen)}
+      />
+
+      {isOpen ? children : null}
+    </>
+  );
+}
+
+function AdvancedSettingsToggle({
+  label,
+  onClick,
+  isOpen,
+}: {
+  isOpen: boolean;
+  onClick: () => void;
+  label: ReactNode;
+}) {
+  const icon = isOpen ? Minus : Plus;
+
+  return (
+    <div className="form-group">
+      <div className="col-sm-12">
+        <Button
+          color="none"
+          onClick={() => onClick()}
+          data-cy="advanced-settings-toggle-button"
+        >
+          <Icon icon={icon} />
+          {label}
+        </Button>
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/portainer/templates/app-templates/DeployFormWidget/ContainerDeployForm/ContainerDeployForm.tsx b/app/react/portainer/templates/app-templates/DeployFormWidget/ContainerDeployForm/ContainerDeployForm.tsx
new file mode 100644
index 0000000..97794e5
--- /dev/null
+++ b/app/react/portainer/templates/app-templates/DeployFormWidget/ContainerDeployForm/ContainerDeployForm.tsx
@@ -0,0 +1,168 @@
+import { Formik, Form } from 'formik';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useCurrentUser, useIsEdgeAdmin } from '@/react/hooks/useUser';
+import { AccessControlForm } from '@/react/portainer/access-control';
+import { parseAccessControlFormData } from '@/react/portainer/access-control/utils';
+import { NameField } from '@/react/docker/containers/CreateView/BaseForm/NameField';
+import { NetworkSelector } from '@/react/docker/containers/components/NetworkSelector';
+import { PortsMappingField } from '@/react/docker/containers/CreateView/BaseForm/PortsMappingField';
+import { VolumesTab } from '@/react/docker/containers/CreateView/VolumesTab';
+import { HostsFileEntries } from '@/react/docker/containers/CreateView/NetworkTab/HostsFileEntries';
+import { LabelsTab } from '@/react/docker/containers/CreateView/LabelsTab';
+import { HostnameField } from '@/react/docker/containers/CreateView/NetworkTab/HostnameField';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { FormSection } from '@@/form-components/FormSection';
+import { FormActions } from '@@/form-components/FormActions';
+import { Button } from '@@/buttons';
+
+import { TemplateViewModel } from '../../view-model';
+import { AdvancedSettings } from '../AdvancedSettings';
+import { EnvVarsFieldset } from '../EnvVarsFieldset';
+
+import { useValidation } from './useValidation';
+import { FormValues } from './types';
+import { useCreate } from './useCreate';
+
+export function ContainerDeployForm({
+  template,
+  unselect,
+}: {
+  template: TemplateViewModel;
+  unselect: () => void;
+}) {
+  const { user } = useCurrentUser();
+  const isEdgeAdminQuery = useIsEdgeAdmin();
+  const environmentId = useEnvironmentId();
+
+  const validation = useValidation({
+    isAdmin: isEdgeAdminQuery.isAdmin,
+    envVarDefinitions: template.Env,
+  });
+
+  const createMutation = useCreate(template);
+
+  if (!createMutation || isEdgeAdminQuery.isLoading) {
+    return null;
+  }
+
+  const initialValues: FormValues = {
+    name: template.Name || '',
+    envVars:
+      Object.fromEntries(template.Env?.map((env) => [env.name, env.value])) ||
+      {},
+    accessControl: parseAccessControlFormData(
+      isEdgeAdminQuery.isAdmin,
+      user.Id
+    ),
+    hostname: '',
+    hosts: [],
+    labels: [],
+    network: '',
+    ports: template.Ports.map((p) => ({ ...p, hostPort: p.hostPort || '' })),
+    volumes: template.Volumes.map((v) => ({
+      containerPath: v.container,
+      type: v.type === 'bind' ? 'bind' : 'volume',
+      readOnly: v.readonly,
+      name: v.type === 'bind' ? v.bind || '' : 'auto',
+    })),
+  };
+
+  return (
+    <Formik
+      initialValues={initialValues}
+      onSubmit={createMutation.onSubmit}
+      validationSchema={validation}
+      validateOnMount
+    >
+      {({ values, errors, setFieldValue, isValid }) => (
+        <Form className="form-horizontal">
+          <FormSection title="Configuration">
+            <NameField
+              value={values.name}
+              onChange={(v) => setFieldValue('name', v)}
+              error={errors.name}
+            />
+
+            <FormControl label="Network" errors={errors?.network}>
+              <NetworkSelector
+                value={values.network}
+                onChange={(v) => setFieldValue('network', v)}
+              />
+            </FormControl>
+
+            <EnvVarsFieldset
+              values={values.envVars}
+              onChange={(values) => setFieldValue('envVars', values)}
+              errors={errors.envVars}
+              options={template.Env || []}
+            />
+          </FormSection>
+
+          <AccessControlForm
+            formNamespace="accessControl"
+            onChange={(values) => setFieldValue('accessControl', values)}
+            values={values.accessControl}
+            errors={errors.accessControl}
+            environmentId={environmentId}
+          />
+
+          <AdvancedSettings
+            label={(isOpen) =>
+              isOpen ? 'Hide advanced options' : 'Show advanced options'
+            }
+          >
+            <PortsMappingField
+              value={values.ports}
+              onChange={(v) => setFieldValue('ports', v)}
+              errors={errors.ports}
+            />
+
+            <VolumesTab
+              onChange={(v) => setFieldValue('volumes', v)}
+              values={values.volumes}
+              errors={errors.volumes}
+              allowAuto
+            />
+
+            <HostsFileEntries
+              values={values.hosts}
+              onChange={(v) => setFieldValue('hosts', v)}
+              errors={errors?.hosts}
+            />
+
+            <LabelsTab
+              values={values.labels}
+              onChange={(v) => setFieldValue('labels', v)}
+              errors={errors?.labels}
+            />
+
+            <HostnameField
+              value={values.hostname}
+              onChange={(v) => setFieldValue('hostname', v)}
+              error={errors.hostname}
+            />
+          </AdvancedSettings>
+
+          <FormActions
+            isLoading={createMutation.isLoading}
+            isValid={isValid}
+            loadingText="Deployment in progress..."
+            submitLabel="Deploy the container"
+            data-cy="deploy-container-button"
+          >
+            <Button
+              type="reset"
+              onClick={() => unselect()}
+              color="default"
+              data-cy="cancel-deploy-container-button"
+            >
+              Hide
+            </Button>
+          </FormActions>
+        </Form>
+      )}
+    </Formik>
+  );
+}
diff --git a/app/react/portainer/templates/app-templates/DeployFormWidget/ContainerDeployForm/createContainerConfig.ts b/app/react/portainer/templates/app-templates/DeployFormWidget/ContainerDeployForm/createContainerConfig.ts
new file mode 100644
index 0000000..d0e3832
--- /dev/null
+++ b/app/react/portainer/templates/app-templates/DeployFormWidget/ContainerDeployForm/createContainerConfig.ts
@@ -0,0 +1,64 @@
+import { commandStringToArray } from '@/docker/helpers/containers';
+import { parsePortBindingRequest } from '@/react/docker/containers/CreateView/BaseForm/PortsMappingField.requestModel';
+import { volumesTabUtils } from '@/react/docker/containers/CreateView/VolumesTab';
+import { CreateContainerRequest } from '@/react/docker/containers/CreateView/types';
+
+import { TemplateViewModel } from '../../view-model';
+
+import { FormValues } from './types';
+
+export function createContainerConfiguration(
+  template: TemplateViewModel,
+  values: FormValues
+): CreateContainerRequest {
+  let configuration: CreateContainerRequest = {
+    Env: [],
+    OpenStdin: false,
+    Tty: false,
+    ExposedPorts: {},
+    HostConfig: {
+      RestartPolicy: {
+        Name: 'no',
+      },
+      PortBindings: {},
+      Binds: [],
+      Privileged: false,
+      ExtraHosts: [],
+    },
+    Volumes: {},
+    Labels: {},
+    NetworkingConfig: {},
+  };
+
+  configuration = volumesTabUtils.toRequest(configuration, values.volumes);
+
+  configuration.HostConfig.NetworkMode = values.network;
+  configuration.HostConfig.Privileged = template.Privileged;
+  configuration.HostConfig.RestartPolicy = { Name: template.RestartPolicy };
+  configuration.HostConfig.ExtraHosts = values.hosts ? values.hosts : [];
+  configuration.Hostname = values.hostname;
+  configuration.Env = Object.entries(values.envVars).map(
+    ([name, value]) => `${name}=${value}`
+  );
+  configuration.Cmd = commandStringToArray(template.Command);
+  const portBindings = parsePortBindingRequest(values.ports);
+  configuration.HostConfig.PortBindings = portBindings;
+  configuration.ExposedPorts = Object.fromEntries(
+    Object.keys(portBindings).map((key) => [key, {}])
+  );
+  const consoleConfiguration = getConsoleConfiguration(template.Interactive);
+  configuration.OpenStdin = consoleConfiguration.openStdin;
+  configuration.Tty = consoleConfiguration.tty;
+  configuration.Labels = Object.fromEntries(
+    values.labels.filter((l) => !!l.name).map((l) => [l.name, l.value])
+  );
+  configuration.Image = template.RegistryModel.Image;
+  return configuration;
+}
+
+function getConsoleConfiguration(interactiveFlag: boolean) {
+  return {
+    openStdin: interactiveFlag,
+    tty: interactiveFlag,
+  };
+}
diff --git a/app/react/portainer/templates/app-templates/DeployFormWidget/ContainerDeployForm/types.ts b/app/react/portainer/templates/app-templates/DeployFormWidget/ContainerDeployForm/types.ts
new file mode 100644
index 0000000..245d88b
--- /dev/null
+++ b/app/react/portainer/templates/app-templates/DeployFormWidget/ContainerDeployForm/types.ts
@@ -0,0 +1,18 @@
+import { AccessControlFormData } from '@/react/portainer/access-control/types';
+import { PortMapping } from '@/react/docker/containers/CreateView/BaseForm/PortsMappingField';
+import { VolumesTabValues } from '@/react/docker/containers/CreateView/VolumesTab';
+import { LabelsTabValues } from '@/react/docker/containers/CreateView/LabelsTab';
+
+import { EnvVarsValue } from '../EnvVarsFieldset';
+
+export interface FormValues {
+  name: string;
+  network: string;
+  accessControl: AccessControlFormData;
+  ports: Array<PortMapping>;
+  volumes: VolumesTabValues;
+  hosts: Array<string>;
+  labels: LabelsTabValues;
+  hostname: string;
+  envVars: EnvVarsValue;
+}
diff --git a/app/react/portainer/templates/app-templates/DeployFormWidget/ContainerDeployForm/useCreate.ts b/app/react/portainer/templates/app-templates/DeployFormWidget/ContainerDeployForm/useCreate.ts
new file mode 100644
index 0000000..13d519d
--- /dev/null
+++ b/app/react/portainer/templates/app-templates/DeployFormWidget/ContainerDeployForm/useCreate.ts
@@ -0,0 +1,68 @@
+import { useRouter } from '@uirouter/react';
+
+import { notifySuccess } from '@/portainer/services/notifications';
+import { useCurrentEnvironment } from '@/react/hooks/useCurrentEnvironment';
+import { useCreateOrReplaceMutation } from '@/react/docker/containers/CreateView/useCreateMutation';
+
+import { TemplateViewModel } from '../../view-model';
+
+import { FormValues } from './types';
+import { createContainerConfiguration } from './createContainerConfig';
+import { useCreateLocalVolumes } from './useCreateLocalVolumes';
+
+export function useCreate(template: TemplateViewModel) {
+  const router = useRouter();
+  const createVolumesMutation = useCreateLocalVolumes();
+  const createContainerMutation = useCreateOrReplaceMutation();
+  const environmentQuery = useCurrentEnvironment();
+
+  if (!environmentQuery.data) {
+    return null;
+  }
+
+  const environment = environmentQuery.data;
+
+  return {
+    onSubmit,
+    isLoading:
+      createVolumesMutation.isLoading || createContainerMutation.isLoading,
+  };
+
+  function onSubmit(values: FormValues) {
+    const autoVolumesCount = values.volumes.filter(
+      (v) => v.type === 'volume' && v.name === 'auto'
+    ).length;
+    createVolumesMutation.mutate(autoVolumesCount, {
+      onSuccess(autoVolumes) {
+        let index = 0;
+        const volumes = values.volumes.map((v) =>
+          v.type === 'volume' && v.name === 'auto'
+            ? { ...v, name: autoVolumes[index++].Name }
+            : v
+        );
+
+        createContainerMutation.mutate(
+          {
+            config: createContainerConfiguration(template, {
+              ...values,
+              volumes,
+            }),
+            values: {
+              name: values.name,
+              accessControl: values.accessControl,
+              imageName: template.RegistryModel.Image,
+              alwaysPull: true,
+            },
+            environment,
+          },
+          {
+            onSuccess() {
+              notifySuccess('Success', 'Container successfully created');
+              router.stateService.go('docker.containers');
+            },
+          }
+        );
+      },
+    });
+  }
+}
diff --git a/app/react/portainer/templates/app-templates/DeployFormWidget/ContainerDeployForm/useCreateLocalVolumes.ts b/app/react/portainer/templates/app-templates/DeployFormWidget/ContainerDeployForm/useCreateLocalVolumes.ts
new file mode 100644
index 0000000..cf4f098
--- /dev/null
+++ b/app/react/portainer/templates/app-templates/DeployFormWidget/ContainerDeployForm/useCreateLocalVolumes.ts
@@ -0,0 +1,16 @@
+import { useMutation } from '@tanstack/react-query';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { createVolume } from '@/react/docker/volumes/queries/useCreateVolume';
+
+export function useCreateLocalVolumes() {
+  const environmentId = useEnvironmentId();
+
+  return useMutation(async (count: number) =>
+    Promise.all(
+      Array.from({ length: count }).map(() =>
+        createVolume(environmentId, { Driver: 'local' })
+      )
+    )
+  );
+}
diff --git a/app/react/portainer/templates/app-templates/DeployFormWidget/ContainerDeployForm/useValidation.ts b/app/react/portainer/templates/app-templates/DeployFormWidget/ContainerDeployForm/useValidation.ts
new file mode 100644
index 0000000..ce5552a
--- /dev/null
+++ b/app/react/portainer/templates/app-templates/DeployFormWidget/ContainerDeployForm/useValidation.ts
@@ -0,0 +1,37 @@
+import { object, string } from 'yup';
+import { useMemo } from 'react';
+
+import { accessControlFormValidation } from '@/react/portainer/access-control/AccessControlForm';
+import { hostnameSchema } from '@/react/docker/containers/CreateView/NetworkTab/HostnameField';
+import { hostFileSchema } from '@/react/docker/containers/CreateView/NetworkTab/HostsFileEntries';
+import { labelsTabUtils } from '@/react/docker/containers/CreateView/LabelsTab';
+import { nameValidation } from '@/react/docker/containers/CreateView/BaseForm/NameField';
+import { validationSchema as portSchema } from '@/react/docker/containers/CreateView/BaseForm/PortsMappingField.validation';
+import { volumesTabUtils } from '@/react/docker/containers/CreateView/VolumesTab';
+
+import { envVarsFieldsetValidation } from '../EnvVarsFieldset';
+import { TemplateEnv } from '../../types';
+
+export function useValidation({
+  isAdmin,
+  envVarDefinitions,
+}: {
+  isAdmin: boolean;
+  envVarDefinitions: Array<TemplateEnv>;
+}) {
+  return useMemo(
+    () =>
+      object({
+        accessControl: accessControlFormValidation(isAdmin),
+        envVars: envVarsFieldsetValidation(envVarDefinitions),
+        hostname: hostnameSchema,
+        hosts: hostFileSchema,
+        labels: labelsTabUtils.validation(),
+        name: nameValidation(),
+        network: string().default(''),
+        ports: portSchema(),
+        volumes: volumesTabUtils.validation(),
+      }),
+    [envVarDefinitions, isAdmin]
+  );
+}
diff --git a/app/react/portainer/templates/app-templates/DeployFormWidget/DeployFormWidget.tsx b/app/react/portainer/templates/app-templates/DeployFormWidget/DeployFormWidget.tsx
new file mode 100644
index 0000000..f47f764
--- /dev/null
+++ b/app/react/portainer/templates/app-templates/DeployFormWidget/DeployFormWidget.tsx
@@ -0,0 +1,42 @@
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { TemplateType } from '@/react/portainer/templates/app-templates/types';
+import { TemplateViewModel } from '@/react/portainer/templates/app-templates/view-model';
+import { DeployWidget } from '@/react/portainer/templates/components/DeployWidget';
+
+import { ContainerDeployForm } from './ContainerDeployForm/ContainerDeployForm';
+import { StackDeployForm } from './StackDeployForm/StackDeployForm';
+
+export function DeployForm({
+  template,
+  unselect,
+}: {
+  template: TemplateViewModel;
+  unselect: () => void;
+}) {
+  const Form = useForm(template);
+
+  return (
+    <DeployWidget
+      logo={template.Logo}
+      note={template.Note}
+      title={template.Title}
+    >
+      <Form template={template} unselect={unselect} />
+    </DeployWidget>
+  );
+}
+
+function useForm(template: TemplateViewModel) {
+  const envId = useEnvironmentId(false);
+
+  if (!envId) {
+    // for edge templates, return empty form
+    return () => null;
+  }
+
+  if (template.Type === TemplateType.Container) {
+    return ContainerDeployForm;
+  }
+
+  return StackDeployForm;
+}
diff --git a/app/react/portainer/templates/app-templates/DeployFormWidget/EnvVarsFieldset.test.tsx b/app/react/portainer/templates/app-templates/DeployFormWidget/EnvVarsFieldset.test.tsx
new file mode 100644
index 0000000..4f097ef
--- /dev/null
+++ b/app/react/portainer/templates/app-templates/DeployFormWidget/EnvVarsFieldset.test.tsx
@@ -0,0 +1,173 @@
+import { ReactNode } from 'react';
+import { vi } from 'vitest';
+import userEvent from '@testing-library/user-event';
+import { render, screen } from '@testing-library/react';
+
+import {
+  EnvVarsFieldset,
+  getDefaultValues,
+  envVarsFieldsetValidation,
+} from './EnvVarsFieldset';
+
+// Tippy renders tooltip content in a portal which is not accessible without
+// user interaction in jsdom. Mock Tooltip to render its message inline so
+// tests can assert on the message text.
+vi.mock('@@/Tip/Tooltip/Tooltip', () => ({
+  Tooltip: ({ message }: { message: ReactNode }) => (
+    <span data-cy="tooltip">{message}</span>
+  ),
+}));
+
+test('renders EnvVarsFieldset component', () => {
+  const onChange = vi.fn();
+  const options = [
+    { name: 'VAR1', label: 'Variable 1', preset: false },
+    { name: 'VAR2', label: 'Variable 2', preset: false },
+  ] as const;
+  const value = { VAR1: 'Value 1', VAR2: 'Value 2' };
+
+  render(
+    <EnvVarsFieldset
+      onChange={onChange}
+      options={[...options]}
+      values={value}
+      errors={{}}
+    />
+  );
+
+  options.forEach((option) => {
+    const labelElement = screen.getByLabelText(option.label, { exact: false });
+    expect(labelElement).toBeInTheDocument();
+
+    const inputElement = screen.getByDisplayValue(value[option.name]);
+    expect(inputElement).toBeInTheDocument();
+  });
+});
+
+test('renders the env var description as a tooltip', () => {
+  const onChange = vi.fn();
+  const options = [
+    {
+      name: 'VAR1',
+      label: 'Variable 1',
+      description: 'Helpful description for variable 1',
+      preset: false,
+    },
+  ];
+  const value = { VAR1: 'Value 1' };
+
+  render(
+    <EnvVarsFieldset
+      onChange={onChange}
+      options={options}
+      values={value}
+      errors={{}}
+    />
+  );
+
+  expect(
+    screen.getByText('Helpful description for variable 1')
+  ).toBeInTheDocument();
+});
+
+test('does not render a tooltip when the env var has no description', () => {
+  const onChange = vi.fn();
+  const options = [{ name: 'VAR1', label: 'Variable 1', preset: false }];
+  const value = { VAR1: 'Value 1' };
+
+  render(
+    <EnvVarsFieldset
+      onChange={onChange}
+      options={options}
+      values={value}
+      errors={{}}
+    />
+  );
+
+  expect(screen.queryByTestId('tooltip')).not.toBeInTheDocument();
+});
+
+test('calls onChange when input value changes', async () => {
+  const user = userEvent.setup();
+  const onChange = vi.fn();
+  const options = [{ name: 'VAR1', label: 'Variable 1', preset: false }];
+  const value = { VAR1: 'Value 1' };
+
+  render(
+    <EnvVarsFieldset
+      onChange={onChange}
+      options={options}
+      values={value}
+      errors={{}}
+    />
+  );
+
+  const inputElement = screen.getByDisplayValue(value.VAR1);
+  await user.clear(inputElement);
+  expect(onChange).toHaveBeenCalledWith({ VAR1: undefined });
+
+  const newValue = 'New Value';
+  await user.type(inputElement, newValue);
+  expect(onChange).toHaveBeenCalled();
+});
+
+test('renders error message when there are errors', () => {
+  const onChange = vi.fn();
+  const options = [{ name: 'VAR1', label: 'Variable 1', preset: false }];
+  const value = { VAR1: '' };
+
+  render(
+    <EnvVarsFieldset
+      onChange={onChange}
+      options={options}
+      values={value}
+      errors={{ VAR1: 'Required' }}
+    />
+  );
+
+  const errorElement = screen.getByText('Required');
+  expect(errorElement).toBeInTheDocument();
+});
+
+test('returns default values', () => {
+  const definitions = [
+    {
+      name: 'VAR1',
+      label: 'Variable 1',
+      preset: false,
+      default: 'Default Value 1',
+    },
+    {
+      name: 'VAR2',
+      label: 'Variable 2',
+      preset: false,
+      default: 'Default Value 2',
+    },
+  ];
+
+  const defaultValues = getDefaultValues(definitions);
+
+  expect(defaultValues).toEqual({
+    VAR1: 'Default Value 1',
+    VAR2: 'Default Value 2',
+  });
+});
+
+test('validates env vars fieldset', () => {
+  const schema = envVarsFieldsetValidation([
+    { name: 'VAR1' },
+    { name: 'VAR2' },
+  ]);
+
+  const validData = { VAR1: 'Value 1', VAR2: 'Value 2' };
+  const emptyData = { VAR1: '', VAR2: 'Value 2' };
+  const undefinedData = { VAR1: undefined, VAR2: 'Value 2' };
+
+  const validResult = schema.isValidSync(validData);
+  const emptyResult = schema.isValidSync(emptyData);
+  const undefinedResult = schema.isValidSync(undefinedData);
+
+  expect(validResult).toBe(true);
+  expect(emptyResult).toBe(true);
+  expect(undefinedResult).toBe(true);
+});
diff --git a/app/react/portainer/templates/app-templates/DeployFormWidget/EnvVarsFieldset.tsx b/app/react/portainer/templates/app-templates/DeployFormWidget/EnvVarsFieldset.tsx
new file mode 100644
index 0000000..2d803e8
--- /dev/null
+++ b/app/react/portainer/templates/app-templates/DeployFormWidget/EnvVarsFieldset.tsx
@@ -0,0 +1,110 @@
+import { FormikErrors } from 'formik';
+import { SchemaOf, object, string } from 'yup';
+
+import { TemplateEnv } from '@/react/portainer/templates/app-templates/types';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { Input, Select } from '@@/form-components/Input';
+
+type Value = Record<string, string | undefined>;
+
+export { type Value as EnvVarsValue };
+
+export function EnvVarsFieldset({
+  onChange,
+  options,
+  values,
+  errors,
+}: {
+  options: Array<TemplateEnv>;
+  onChange: (value: Value) => void;
+  values: Value;
+  errors?: FormikErrors<Value>;
+}) {
+  return (
+    <>
+      {options.map((env) => (
+        <Item
+          key={env.name}
+          option={env}
+          value={values[env.name] || ''}
+          onChange={(value) => handleChange(env.name, value)}
+          errors={errors?.[env.name]}
+        />
+      ))}
+    </>
+  );
+
+  function handleChange(name: string, envValue: string) {
+    onChange({ ...values, [name]: envValue || undefined });
+  }
+}
+
+function Item({
+  onChange,
+  option,
+  value,
+  errors,
+}: {
+  option: TemplateEnv;
+  value: string;
+  onChange: (value: string) => void;
+  errors?: FormikErrors<string>;
+}) {
+  const inputId = `env_var_${option.name}`;
+  return (
+    <FormControl
+      label={option.label || option.name}
+      tooltip={option.description}
+      required={false}
+      errors={errors}
+      inputId={inputId}
+    >
+      {option.select ? (
+        <Select
+          value={value}
+          data-cy={`env-var-select-${option.name}`}
+          onChange={(e) => onChange(e.target.value)}
+          options={option.select.map((o) => ({
+            label: o.text,
+            value: o.value,
+          }))}
+          disabled={option.preset}
+          id={inputId}
+        />
+      ) : (
+        <Input
+          value={value}
+          onChange={(e) => onChange(e.target.value)}
+          disabled={option.preset}
+          id={inputId}
+          data-cy="env-var-input"
+        />
+      )}
+    </FormControl>
+  );
+}
+
+export function getDefaultValues(definitions: Array<TemplateEnv>): Value {
+  return Object.fromEntries(
+    definitions.map((v) => {
+      if (v.select) {
+        return [v.name, v.select.find((v) => v.default)?.value || ''];
+      }
+
+      return [v.name, v.default || ''];
+    })
+  );
+}
+
+export function envVarsFieldsetValidation(
+  definitions: Array<TemplateEnv>
+): SchemaOf<Value> {
+  return object(
+    Object.fromEntries(
+      definitions
+        .filter((v) => !v.preset)
+        .map((v) => [v.name, string().optional()])
+    )
+  );
+}
diff --git a/app/react/portainer/templates/app-templates/DeployFormWidget/StackDeployForm/StackDeployForm.tsx b/app/react/portainer/templates/app-templates/DeployFormWidget/StackDeployForm/StackDeployForm.tsx
new file mode 100644
index 0000000..73e5873
--- /dev/null
+++ b/app/react/portainer/templates/app-templates/DeployFormWidget/StackDeployForm/StackDeployForm.tsx
@@ -0,0 +1,163 @@
+import { useRouter } from '@uirouter/react';
+import { Formik, Form } from 'formik';
+
+import { notifySuccess } from '@/portainer/services/notifications';
+import {
+  SwarmCreatePayload,
+  useCreateStack,
+} from '@/react/common/stacks/queries/useCreateStack/useCreateStack';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useCurrentUser, useIsEdgeAdmin } from '@/react/hooks/useUser';
+import { AccessControlForm } from '@/react/portainer/access-control';
+import { parseAccessControlFormData } from '@/react/portainer/access-control/utils';
+import { TemplateType } from '@/react/portainer/templates/app-templates/types';
+import { TemplateViewModel } from '@/react/portainer/templates/app-templates/view-model';
+import { NameField } from '@/react/docker/stacks/common/NameField';
+import { useSwarmId } from '@/react/docker/proxy/queries/useSwarm';
+
+import { Button } from '@@/buttons';
+import { FormActions } from '@@/form-components/FormActions';
+import { FormSection } from '@@/form-components/FormSection';
+import { TextTip } from '@@/Tip/TextTip';
+
+import { EnvVarsFieldset } from '../EnvVarsFieldset';
+
+import { FormValues } from './types';
+import { useValidation } from './useValidation';
+import { useIsDeployable } from './useIsDeployable';
+
+export function StackDeployForm({
+  template,
+  unselect,
+}: {
+  template: TemplateViewModel;
+  unselect: () => void;
+}) {
+  const isDeployable = useIsDeployable(template.Type);
+
+  const router = useRouter();
+  const isEdgeAdminQuery = useIsEdgeAdmin();
+
+  const { user } = useCurrentUser();
+  const environmentId = useEnvironmentId();
+  const swarmIdQuery = useSwarmId(environmentId);
+  const mutation = useCreateStack();
+  const validation = useValidation({
+    isAdmin: isEdgeAdminQuery.isAdmin,
+    environmentId,
+    envVarDefinitions: template.Env,
+  });
+
+  if (isEdgeAdminQuery.isLoading) {
+    return null;
+  }
+
+  const initialValues: FormValues = {
+    name: template.Name || '',
+    envVars:
+      Object.fromEntries(template.Env?.map((env) => [env.name, env.value])) ||
+      {},
+    accessControl: parseAccessControlFormData(
+      isEdgeAdminQuery.isAdmin,
+      user.Id
+    ),
+  };
+
+  if (!isDeployable) {
+    return (
+      <div className="form-group">
+        <TextTip>
+          This template type cannot be deployed on this environment.
+        </TextTip>
+      </div>
+    );
+  }
+
+  return (
+    <Formik
+      initialValues={initialValues}
+      onSubmit={handleSubmit}
+      validationSchema={validation}
+      validateOnMount
+    >
+      {({ values, errors, setFieldValue, isValid }) => (
+        <Form className="form-horizontal">
+          <FormSection title="Configuration">
+            <NameField
+              value={values.name}
+              onChange={(v) => setFieldValue('name', v)}
+              errors={errors.name}
+            />
+
+            <EnvVarsFieldset
+              values={values.envVars}
+              onChange={(values) => setFieldValue('envVars', values)}
+              errors={errors.envVars}
+              options={template.Env || []}
+            />
+          </FormSection>
+
+          <AccessControlForm
+            formNamespace="accessControl"
+            onChange={(values) => setFieldValue('accessControl', values)}
+            values={values.accessControl}
+            errors={errors.accessControl}
+            environmentId={environmentId}
+          />
+
+          <FormActions
+            isLoading={mutation.isLoading}
+            isValid={isValid}
+            loadingText="Deployment in progress..."
+            submitLabel="Deploy the stack"
+            data-cy="deploy-stack-button"
+          >
+            <Button
+              type="reset"
+              onClick={() => unselect()}
+              color="default"
+              data-cy="cancel-deploy-stack-button"
+            >
+              Hide
+            </Button>
+          </FormActions>
+        </Form>
+      )}
+    </Formik>
+  );
+
+  function handleSubmit(values: FormValues) {
+    const type =
+      template.Type === TemplateType.ComposeStack ? 'standalone' : 'swarm';
+    const payload: SwarmCreatePayload['payload'] = {
+      name: values.name,
+      environmentId,
+
+      env: Object.entries(values.envVars).map(([name, value]) => ({
+        name,
+        value,
+      })),
+      swarmId: swarmIdQuery.data || '',
+      git: {
+        RepositoryURL: template.Repository.url,
+        ComposeFilePathInRepository: template.Repository.stackfile,
+      },
+      fromAppTemplate: true,
+      accessControl: values.accessControl,
+    };
+
+    return mutation.mutate(
+      {
+        type,
+        method: 'git',
+        payload,
+      },
+      {
+        onSuccess() {
+          notifySuccess('Success', 'Stack created');
+          router.stateService.go('docker.stacks');
+        },
+      }
+    );
+  }
+}
diff --git a/app/react/portainer/templates/app-templates/DeployFormWidget/StackDeployForm/types.ts b/app/react/portainer/templates/app-templates/DeployFormWidget/StackDeployForm/types.ts
new file mode 100644
index 0000000..f40d79c
--- /dev/null
+++ b/app/react/portainer/templates/app-templates/DeployFormWidget/StackDeployForm/types.ts
@@ -0,0 +1,7 @@
+import { AccessControlFormData } from '@/react/portainer/access-control/types';
+
+export interface FormValues {
+  name: string;
+  envVars: Record<string, string | undefined>;
+  accessControl: AccessControlFormData;
+}
diff --git a/app/react/portainer/templates/app-templates/DeployFormWidget/StackDeployForm/useIsDeployable.ts b/app/react/portainer/templates/app-templates/DeployFormWidget/StackDeployForm/useIsDeployable.ts
new file mode 100644
index 0000000..8e0ea97
--- /dev/null
+++ b/app/react/portainer/templates/app-templates/DeployFormWidget/StackDeployForm/useIsDeployable.ts
@@ -0,0 +1,19 @@
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { TemplateType } from '@/react/portainer/templates/app-templates/types';
+import { useIsSwarm } from '@/react/docker/proxy/queries/useInfo';
+
+export function useIsDeployable(type: TemplateType) {
+  const environmentId = useEnvironmentId();
+
+  const isSwarm = useIsSwarm(environmentId);
+
+  switch (type) {
+    case TemplateType.ComposeStack:
+    case TemplateType.Container:
+      return true;
+    case TemplateType.SwarmStack:
+      return isSwarm;
+    default:
+      return false;
+  }
+}
diff --git a/app/react/portainer/templates/app-templates/DeployFormWidget/StackDeployForm/useValidation.ts b/app/react/portainer/templates/app-templates/DeployFormWidget/StackDeployForm/useValidation.ts
new file mode 100644
index 0000000..4df4062
--- /dev/null
+++ b/app/react/portainer/templates/app-templates/DeployFormWidget/StackDeployForm/useValidation.ts
@@ -0,0 +1,33 @@
+import { useMemo } from 'react';
+import { SchemaOf, object } from 'yup';
+
+import { accessControlFormValidation } from '@/react/portainer/access-control/AccessControlForm';
+import { useNameValidation } from '@/react/docker/stacks/common/NameField';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { envVarsFieldsetValidation } from '../EnvVarsFieldset';
+import { TemplateEnv } from '../../types';
+
+import { FormValues } from './types';
+
+export function useValidation({
+  environmentId,
+  isAdmin,
+  envVarDefinitions,
+}: {
+  isAdmin: boolean;
+  environmentId: EnvironmentId;
+  envVarDefinitions: Array<TemplateEnv>;
+}): SchemaOf<FormValues> {
+  const name = useNameValidation(environmentId);
+
+  return useMemo(
+    () =>
+      object({
+        name,
+        accessControl: accessControlFormValidation(isAdmin),
+        envVars: envVarsFieldsetValidation(envVarDefinitions),
+      }),
+    [envVarDefinitions, isAdmin, name]
+  );
+}
diff --git a/app/react/portainer/templates/app-templates/Filters.tsx b/app/react/portainer/templates/app-templates/Filters.tsx
new file mode 100644
index 0000000..07febd3
--- /dev/null
+++ b/app/react/portainer/templates/app-templates/Filters.tsx
@@ -0,0 +1,95 @@
+import _ from 'lodash';
+
+import { Option, PortainerSelect } from '@@/form-components/PortainerSelect';
+
+import { ListState, TemplateType } from './types';
+import { TemplateViewModel } from './view-model';
+import { TemplateListSort } from './TemplateListSort';
+
+const orderByFields = ['Title', 'Categories', 'Description'] as const;
+const typeFilters: ReadonlyArray<Option<TemplateType>> = [
+  { label: 'Container', value: TemplateType.Container },
+  { label: 'Swarm Stack', value: TemplateType.SwarmStack },
+  { label: 'Compose Stack', value: TemplateType.ComposeStack },
+] as const;
+
+export function Filters({
+  templates,
+  listState,
+  onChange,
+  disabledTypes = [],
+  fixedCategories = [],
+}: {
+  templates: TemplateViewModel[];
+  listState: ListState & { search: string };
+  onChange(): void;
+  disabledTypes?: Array<TemplateType>;
+  fixedCategories?: Array<string>;
+}) {
+  const categories = _.sortBy(
+    _.uniq(templates?.flatMap((template) => template.Categories))
+  )
+    .filter((category) => !fixedCategories.includes(category))
+    .map((category) => ({ label: category, value: category }));
+
+  const templatesTypes = _.uniq(
+    templates?.flatMap((template) => template.Type)
+  );
+
+  const typeFiltersEnabled = typeFilters.filter(
+    (type) =>
+      !disabledTypes.includes(type.value) && templatesTypes.includes(type.value)
+  );
+
+  return (
+    <div className="flex w-full gap-4">
+      {categories.length > 0 && (
+        <div className="w-1/4">
+          <PortainerSelect
+            options={categories}
+            onChange={(category) => {
+              listState.setCategory(category);
+              onChange();
+            }}
+            placeholder="Category"
+            value={listState.category}
+            bindToBody
+            isClearable
+            aria-label="Category filter"
+            data-cy="app-templates-category-filter"
+          />
+        </div>
+      )}
+      {typeFiltersEnabled.length > 1 && (
+        <div className="w-1/4">
+          <PortainerSelect<TemplateType>
+            isMulti
+            options={typeFiltersEnabled}
+            onChange={(types) => {
+              listState.setTypes(types);
+              onChange();
+            }}
+            placeholder="Type"
+            value={listState.types}
+            bindToBody
+            isClearable
+            aria-label="Type filter"
+            data-cy="app-templates-type-filter"
+          />
+        </div>
+      )}
+      <div className="ml-auto w-1/4">
+        <TemplateListSort
+          onChange={(value) => {
+            listState.setSortBy(value?.id, value?.desc ?? false);
+            onChange();
+          }}
+          options={orderByFields}
+          placeholder="Sort By"
+          value={listState.sortBy}
+          aria-label="Sort"
+        />
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/portainer/templates/app-templates/TemplateListSort/TemplateListSort.module.css b/app/react/portainer/templates/app-templates/TemplateListSort/TemplateListSort.module.css
new file mode 100644
index 0000000..53515a5
--- /dev/null
+++ b/app/react/portainer/templates/app-templates/TemplateListSort/TemplateListSort.module.css
@@ -0,0 +1,25 @@
+.sort-by-container {
+  display: flex;
+  align-items: center;
+  justify-content: flex-end;
+  gap: 5px;
+}
+
+.sort-by-element {
+  display: inline-block;
+}
+
+.sort-button {
+  --text-color: var(--grey-6);
+  background-color: var(--bg-sortbutton-color);
+  color: var(--text-color);
+  border: 1px solid var(--border-sortbutton);
+  display: inline-block;
+  padding: 8px 10px;
+  border-radius: 5px;
+}
+
+:global([theme='dark']) .sort-button,
+:global([theme='highcontrast']) .sort-button {
+  --text-color: var(--white-color);
+}
diff --git a/app/react/portainer/templates/app-templates/TemplateListSort/TemplateListSort.tsx b/app/react/portainer/templates/app-templates/TemplateListSort/TemplateListSort.tsx
new file mode 100644
index 0000000..590e631
--- /dev/null
+++ b/app/react/portainer/templates/app-templates/TemplateListSort/TemplateListSort.tsx
@@ -0,0 +1,54 @@
+import clsx from 'clsx';
+
+import { TableHeaderSortIcons } from '@@/datatables/TableHeaderSortIcons';
+import { PortainerSelect } from '@@/form-components/PortainerSelect';
+
+import styles from './TemplateListSort.module.css';
+
+interface Props {
+  options: ReadonlyArray<string>;
+  onChange: (value: { id: string; desc: boolean } | undefined) => void;
+  placeholder?: string;
+  value: { id: string; desc: boolean } | undefined;
+}
+
+export function TemplateListSort({
+  options,
+  onChange,
+  placeholder,
+  value,
+}: Props) {
+  return (
+    <div className={styles.sortByContainer}>
+      <div className={styles.sortByElement}>
+        <PortainerSelect
+          placeholder={placeholder}
+          options={options.map((id) => ({ label: id, value: id }))}
+          onChange={(id) =>
+            onChange(id ? { id, desc: value?.desc ?? false } : undefined)
+          }
+          bindToBody
+          value={value?.id ?? null}
+          isClearable
+          data-cy="app-templates-sortby-selector"
+        />
+      </div>
+      <div className={styles.sortByElement}>
+        <button
+          className={clsx(styles.sortButton, 'h-[34px]')}
+          type="button"
+          disabled={!value?.id}
+          onClick={(e) => {
+            e.preventDefault();
+            onChange(value ? { id: value.id, desc: !value.desc } : undefined);
+          }}
+        >
+          <TableHeaderSortIcons
+            sorted={!!value}
+            descending={value?.desc ?? false}
+          />
+        </button>
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/portainer/templates/app-templates/TemplateListSort/index.ts b/app/react/portainer/templates/app-templates/TemplateListSort/index.ts
new file mode 100644
index 0000000..8519dc4
--- /dev/null
+++ b/app/react/portainer/templates/app-templates/TemplateListSort/index.ts
@@ -0,0 +1 @@
+export { TemplateListSort } from './TemplateListSort';
diff --git a/app/react/portainer/templates/app-templates/queries/build-url.ts b/app/react/portainer/templates/app-templates/queries/build-url.ts
new file mode 100644
index 0000000..e32b50b
--- /dev/null
+++ b/app/react/portainer/templates/app-templates/queries/build-url.ts
@@ -0,0 +1,18 @@
+import { AppTemplate } from '../types';
+
+export function buildUrl({
+  id,
+  action,
+}: { id?: AppTemplate['id']; action?: string } = {}) {
+  let baseUrl = '/templates';
+
+  if (id) {
+    baseUrl += `/${id}`;
+  }
+
+  if (action) {
+    baseUrl += `/${action}`;
+  }
+
+  return baseUrl;
+}
diff --git a/app/react/portainer/templates/app-templates/queries/useAppTemplateFile.ts b/app/react/portainer/templates/app-templates/queries/useAppTemplateFile.ts
new file mode 100644
index 0000000..8a135ac
--- /dev/null
+++ b/app/react/portainer/templates/app-templates/queries/useAppTemplateFile.ts
@@ -0,0 +1,27 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { AppTemplate } from '../types';
+
+import { buildUrl } from './build-url';
+
+export function useAppTemplateFile(
+  id?: AppTemplate['id'],
+  { enabled }: { enabled?: boolean } = {}
+) {
+  return useQuery(['templates', id, 'file'], () => fetchFilePreview(id!), {
+    enabled: !!id && enabled,
+  });
+}
+
+export async function fetchFilePreview(id: AppTemplate['id']) {
+  try {
+    const { data } = await axios.post<{ FileContent: string }>(
+      buildUrl({ id, action: 'file' })
+    );
+    return data.FileContent;
+  } catch (err) {
+    throw parseAxiosError(err);
+  }
+}
diff --git a/app/react/portainer/templates/app-templates/queries/useAppTemplates.ts b/app/react/portainer/templates/app-templates/queries/useAppTemplates.ts
new file mode 100644
index 0000000..e5323cf
--- /dev/null
+++ b/app/react/portainer/templates/app-templates/queries/useAppTemplates.ts
@@ -0,0 +1,83 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { useRegistries } from '@/react/portainer/registries/queries/useRegistries';
+import { DockerHubViewModel } from '@/portainer/models/dockerhub';
+import { Registry } from '@/react/portainer/registries/types/registry';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { useEnvironmentRegistries } from '@/react/portainer/environments/queries/useEnvironmentRegistries';
+
+import { AppTemplate } from '../types';
+import { TemplateViewModel } from '../view-model';
+
+import { buildUrl } from './build-url';
+
+export type AppTemplatesResponse = {
+  version: string;
+  templates: Array<AppTemplate>;
+};
+
+export function useAppTemplates<T = Array<TemplateViewModel>>({
+  environmentId,
+  select,
+  enabled = true,
+}: {
+  environmentId?: EnvironmentId;
+  select?: (templates: Array<TemplateViewModel>) => T;
+  enabled?: boolean;
+} = {}) {
+  const hasEnvParam = !!environmentId;
+
+  const environmentRegistriesQuery = useEnvironmentRegistries(
+    environmentId || 0,
+    { enabled: enabled && hasEnvParam }
+  );
+  const registriesQuery = useRegistries({ enabled: enabled && !hasEnvParam });
+
+  const data = hasEnvParam
+    ? environmentRegistriesQuery.data
+    : registriesQuery.data;
+
+  return useQuery(['templates'], () => getTemplatesWithRegistry(data), {
+    enabled: !!data && enabled,
+    select,
+  });
+}
+
+export function useAppTemplate(
+  id: AppTemplate['id'] | undefined,
+  { enabled }: { enabled?: boolean } = {}
+) {
+  return useAppTemplates({
+    enabled: !!id && enabled,
+    select: (templates) => templates.find((t) => t.Id === id),
+  });
+}
+
+async function getTemplatesWithRegistry(
+  registries: Array<Registry> | undefined
+) {
+  if (!registries) {
+    return [];
+  }
+
+  const { templates, version } = await getAppTemplates();
+  return templates.map((item) => {
+    const template = new TemplateViewModel(item, version);
+    const registryURL = item.registry;
+    const registry = registryURL
+      ? registries.find((reg) => reg.URL === registryURL)
+      : new DockerHubViewModel();
+    template.RegistryModel.Registry = registry || new DockerHubViewModel();
+    return template;
+  });
+}
+
+export async function getAppTemplates() {
+  try {
+    const { data } = await axios.get<AppTemplatesResponse>(buildUrl());
+    return data;
+  } catch (err) {
+    throw parseAxiosError(err);
+  }
+}
diff --git a/app/react/portainer/templates/app-templates/types.ts b/app/react/portainer/templates/app-templates/types.ts
new file mode 100644
index 0000000..ea5b5b8
--- /dev/null
+++ b/app/react/portainer/templates/app-templates/types.ts
@@ -0,0 +1,267 @@
+import { RestartPolicy } from 'docker-types';
+
+import { BasicTableSettings } from '@@/datatables/types';
+
+import { Pair } from '../../settings/types';
+
+export interface ListState extends BasicTableSettings {
+  category: string | null;
+  setCategory: (category: string | null) => void;
+  types: ReadonlyArray<TemplateType>;
+  setTypes: (value: ReadonlyArray<TemplateType>) => void;
+}
+
+export enum TemplateType {
+  Container = 1,
+  SwarmStack = 2,
+  ComposeStack = 3,
+}
+
+/**
+ * Template represents an application template that can be used as an App Template or an Edge template.
+ */
+export interface AppTemplate {
+  /**
+   * Unique identifier of the template.
+   */
+  id: number;
+
+  /**
+   * Template type. Valid values are: 1 (container), 2 (Swarm stack), 3 (Compose stack)
+   * @example 1
+   */
+  type: TemplateType;
+
+  /**
+   * Title of the template.
+   * @example "Nginx"
+   */
+  title: string;
+
+  /**
+   * Description of the template.
+   * @example "High performance web server"
+   */
+  description: string;
+
+  /**
+   * Whether the template should be available to administrators only.
+   * @example true
+   */
+  administrator_only: boolean;
+
+  /**
+   * Image associated with a container template. Mandatory for a container template.
+   * @example "nginx:latest"
+   */
+  image: string;
+
+  /**
+   * Repository associated with the template.
+   */
+  repository: TemplateRepository;
+
+  /**
+   * Stack file used for this template (Mandatory for Edge stack).
+   */
+  stackFile?: string;
+
+  /**
+   * Default name for the stack/container to be used on deployment.
+   * @example "mystackname"
+   */
+  name?: string;
+
+  /**
+   * URL of the template's logo.
+   * @example "https://portainer.io/img/logo.svg"
+   */
+  logo?: string;
+
+  /**
+   * A list of environment (endpoint) variables used during the template deployment.
+   */
+  env?: TemplateEnv[];
+
+  /**
+   * A note that will be displayed in the UI. Supports HTML content.
+   * @example "This is my <b>custom</b> template"
+   */
+  note?: string;
+
+  /**
+   * Platform associated with the template.
+   * Valid values are: 'linux', 'windows' or leave empty for multi-platform.
+   * @example "linux"
+   */
+  platform?: 'linux' | 'windows' | '';
+
+  /**
+   * A list of categories associated with the template.
+   * @example ["database"]
+   */
+  categories?: string[];
+
+  /**
+   * The URL of a registry associated with the image for a container template.
+   * @example "quay.io"
+   */
+  registry?: string;
+
+  /**
+   * The command that will be executed in a container template.
+   * @example "ls -lah"
+   */
+  command?: string;
+
+  /**
+   * Name of a network that will be used on container deployment if it exists inside the environment (endpoint).
+   * @example "mynet"
+   */
+  network?: string;
+
+  /**
+   * A list of volumes used during the container template deployment.
+   */
+  volumes?: TemplateVolume[];
+
+  /**
+   * A list of ports exposed by the container.
+   * @example ["8080:80/tcp"]
+   */
+  ports?: string[];
+
+  /**
+   * Container labels.
+   */
+  labels?: Pair[];
+
+  hosts?: string[];
+
+  /**
+   * Whether the container should be started in privileged mode.
+   * @example true
+   */
+  privileged?: boolean;
+
+  /**
+   * Whether the container should be started in interactive mode (-i -t equivalent on the CLI).
+   * @example true
+   */
+  interactive?: boolean;
+
+  /**
+   * Container restart policy.
+   * @example "on-failure"
+   */
+  restart_policy?: RestartPolicy['Name'];
+
+  /**
+   * Container hostname.
+   * @example "mycontainer"
+   */
+  hostname?: string;
+}
+
+/**
+ * TemplateRepository represents the git repository configuration for a template.
+ */
+export interface TemplateRepository {
+  /**
+   * URL of a git repository used to deploy a stack template. Mandatory for a Swarm/Compose stack template.
+   * @example "https://github.com/portainer/portainer-compose"
+   */
+  url: string;
+
+  /**
+   * Path to the stack file inside the git repository.
+   * @example "./subfolder/docker-compose.yml"
+   */
+  stackfile: string;
+}
+
+/**
+ * TemplateVolume represents a template volume configuration.
+ */
+export interface TemplateVolume {
+  /**
+   * Path inside the container.
+   * @example "/data"
+   */
+  container: string;
+
+  /**
+   * Path on the host.
+   * @example "/tmp"
+   */
+  bind?: string;
+
+  /**
+   * Whether the volume used should be readonly.
+   * @example true
+   */
+  readonly?: boolean;
+}
+
+/**
+ * TemplateEnv represents an environment (endpoint) variable for a template.
+ */
+export interface TemplateEnv {
+  /**
+   * Name of the environment (endpoint) variable.
+   * @example "MYSQL_ROOT_PASSWORD"
+   */
+  name: string;
+
+  /**
+   * Text for the label that will be generated in the UI.
+   * @example "Root password"
+   */
+  label?: string;
+
+  /**
+   * Content of the tooltip that will be generated in the UI.
+   * @example "MySQL root account password"
+   */
+  description?: string;
+
+  /**
+   * Default value that will be set for the variable.
+   * @example "default_value"
+   */
+  default?: string;
+
+  /**
+   * If set to true, will not generate any input for this variable in the UI.
+   * @example false
+   */
+  preset?: boolean;
+
+  /**
+   * A list of name/value pairs that will be used to generate a dropdown in the UI.
+   */
+  select?: TemplateEnvSelect[];
+}
+
+/**
+ * TemplateEnvSelect represents a text/value pair that will be displayed as a choice for the template user.
+ */
+interface TemplateEnvSelect {
+  /**
+   * Some text that will be displayed as a choice.
+   * @example "text value"
+   */
+  text: string;
+
+  /**
+   * A value that will be associated with the choice.
+   * @example "value"
+   */
+  value: string;
+
+  /**
+   * Will set this choice as the default choice.
+   * @example false
+   */
+  default: boolean;
+}
diff --git a/app/react/portainer/templates/app-templates/useSortAndFilter.tsx b/app/react/portainer/templates/app-templates/useSortAndFilter.tsx
new file mode 100644
index 0000000..cafe336
--- /dev/null
+++ b/app/react/portainer/templates/app-templates/useSortAndFilter.tsx
@@ -0,0 +1,105 @@
+import { useCallback, useMemo } from 'react';
+import _ from 'lodash';
+
+import { TemplateViewModel } from './view-model';
+import { ListState } from './types';
+
+export function useSortAndFilterTemplates(
+  templates: Array<TemplateViewModel>,
+  listState: ListState & { search: string },
+  disabledTypes: Array<TemplateViewModel['Type']> = []
+) {
+  const filterByCategory = useCallback(
+    (item: TemplateViewModel) => {
+      if (!listState.category) {
+        return true;
+      }
+
+      return _.compact([listState.category]).every((category) =>
+        item.Categories.includes(category)
+      );
+    },
+    [listState.category]
+  );
+
+  const filterBySearch = useCallback(
+    (item: TemplateViewModel) => {
+      const search = listState.search.toLowerCase();
+      return (
+        item.Title.toLowerCase().includes(search) ||
+        item.Description.toLowerCase().includes(search) ||
+        item.Categories.some((category) =>
+          category.toLowerCase().includes(search)
+        ) ||
+        item.Note?.toLowerCase().includes(search) ||
+        item.Name?.toLowerCase().includes(search)
+      );
+    },
+    [listState.search]
+  );
+
+  const filterByTemplateType = useCallback(
+    (item: TemplateViewModel) => {
+      if (listState.types.length === 0 && disabledTypes.length === 0) {
+        return true;
+      }
+
+      if (listState.types.length === 0) {
+        return !disabledTypes.includes(item.Type);
+      }
+
+      return (
+        listState.types.includes(item.Type) &&
+        !disabledTypes.includes(item.Type)
+      );
+    },
+    [disabledTypes, listState.types]
+  );
+
+  const sort = useCallback(
+    (a: TemplateViewModel, b: TemplateViewModel) => {
+      const sortMultiplier = listState.sortBy?.desc ? -1 : 1;
+      switch (listState.sortBy?.id) {
+        case 'Categories':
+          return sortByCategories(a.Categories, b.Categories) * sortMultiplier;
+        case 'Description':
+          return a.Description.localeCompare(b.Description) * sortMultiplier;
+        case 'Title':
+        default:
+          return a.Title.localeCompare(b.Title) * sortMultiplier;
+      }
+    },
+
+    [listState.sortBy?.desc, listState.sortBy?.id]
+  );
+
+  return useMemo(
+    () =>
+      templates
+        ?.filter(filterByTemplateType)
+        .filter(filterByCategory)
+        .filter(filterBySearch)
+        .sort(sort) || [],
+    [templates, filterByTemplateType, filterByCategory, filterBySearch, sort]
+  );
+}
+
+function sortByCategories(a: Array<string>, b: Array<string>): number {
+  if (a.length === 0 && b.length === 0) {
+    return 0;
+  }
+  if (a.length === 0) {
+    return -1;
+  }
+  if (b.length === 0) {
+    return 1;
+  }
+
+  const aCategory = a[0];
+  const bCategory = b[0];
+
+  return (
+    aCategory.localeCompare(bCategory) ||
+    sortByCategories(a.slice(1), b.slice(1))
+  );
+}
diff --git a/app/react/portainer/templates/app-templates/view-model.ts b/app/react/portainer/templates/app-templates/view-model.ts
new file mode 100644
index 0000000..e708a9f
--- /dev/null
+++ b/app/react/portainer/templates/app-templates/view-model.ts
@@ -0,0 +1,197 @@
+import _ from 'lodash';
+import { RestartPolicy } from 'docker-types';
+
+import { PorImageRegistryModel } from '@/docker/models/porImageRegistry';
+
+import { Pair } from '../../settings/types';
+import { Platform } from '../types';
+
+import {
+  AppTemplate,
+  TemplateEnv,
+  TemplateRepository,
+  TemplateType,
+} from './types';
+
+export class TemplateViewModel {
+  Id!: number;
+
+  Title!: string;
+
+  Type!: TemplateType;
+
+  Description!: string;
+
+  AdministratorOnly!: boolean;
+
+  Name: string | undefined;
+
+  Note: string | undefined;
+
+  Categories!: string[];
+
+  Platform!: Platform | undefined;
+
+  Logo: string | undefined;
+
+  Repository!: TemplateRepository;
+
+  Hostname: string | undefined;
+
+  RegistryModel!: PorImageRegistryModel;
+
+  Command!: string;
+
+  Network!: string;
+
+  Privileged!: boolean;
+
+  Interactive!: boolean;
+
+  RestartPolicy!: RestartPolicy['Name'];
+
+  Hosts!: string[];
+
+  Labels!: Pair[];
+
+  Env!: Array<TemplateEnv & { type: EnvVarType; value: string }>;
+
+  Volumes!: {
+    container: string;
+    readonly: boolean;
+    type: 'bind' | 'auto';
+    bind: string | null;
+  }[];
+
+  Ports!: {
+    hostPort: string | undefined;
+    containerPort: string;
+    protocol: 'tcp' | 'udp';
+  }[];
+
+  constructor(template: AppTemplate, version: string) {
+    switch (version) {
+      case '2':
+        setTemplatesV2.call(this, template);
+        break;
+      case '3':
+        setTemplatesV3.call(this, template);
+        break;
+      default:
+        throw new Error('Unsupported template version');
+    }
+  }
+}
+
+function setTemplatesV3(this: TemplateViewModel, template: AppTemplate) {
+  setTemplatesV2.call(this, template);
+  this.Id = template.id;
+}
+
+function setTemplatesV2(this: TemplateViewModel, template: AppTemplate) {
+  this.Id = template.id;
+  this.Title = template.title;
+  this.Type = template.type;
+  this.Description = template.description;
+  this.AdministratorOnly = template.administrator_only;
+  this.Name = template.name;
+  this.Note = template.note;
+  this.Categories = template.categories ? template.categories : [];
+  this.Platform = getPlatform(template.platform);
+  this.Logo = template.logo;
+  this.Repository = template.repository;
+  this.Hostname = template.hostname;
+  this.RegistryModel = new PorImageRegistryModel();
+  this.RegistryModel.Image = template.image;
+  // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+  // @ts-ignore
+  this.RegistryModel.Registry.URL = template.registry || '';
+  this.Command = template.command ? template.command : '';
+  this.Network = template.network ? template.network : '';
+  this.Privileged = template.privileged ? template.privileged : false;
+  this.Interactive = template.interactive ? template.interactive : false;
+  this.RestartPolicy = template.restart_policy
+    ? template.restart_policy
+    : 'always';
+  this.Labels = template.labels ? template.labels : [];
+  this.Hosts = template.hosts ? template.hosts : [];
+  this.Env = templateEnv(template);
+  this.Volumes = templateVolumes(template);
+  this.Ports = templatePorts(template);
+}
+
+function templatePorts(data: AppTemplate) {
+  return (
+    data.ports?.map((p) => {
+      const portAndProtocol = _.split(p, '/');
+      const hostAndContainerPort = _.split(portAndProtocol[0], ':');
+
+      return {
+        hostPort:
+          hostAndContainerPort.length > 1 ? hostAndContainerPort[0] : undefined,
+        containerPort:
+          hostAndContainerPort.length > 1
+            ? hostAndContainerPort[1]
+            : hostAndContainerPort[0],
+        protocol: portAndProtocol[1] as 'tcp' | 'udp',
+      };
+    }) || []
+  );
+}
+
+function templateVolumes(data: AppTemplate) {
+  return (
+    data.volumes?.map((v) => ({
+      container: v.container,
+      readonly: v.readonly || false,
+      type: (v.bind ? 'bind' : 'auto') as 'bind' | 'auto',
+      bind: v.bind ? v.bind : null,
+    })) || []
+  );
+}
+
+export enum EnvVarType {
+  PreSelected = 1,
+  Text = 2,
+  Select = 3,
+}
+
+function templateEnv(data: AppTemplate) {
+  return (
+    data.env?.map((envvar) => ({
+      name: envvar.name,
+      label: envvar.label,
+      description: envvar.description,
+      default: envvar.default,
+      preset: envvar.preset,
+      select: envvar.select,
+      ...getEnvVarTypeAndValue(envvar),
+    })) || []
+  );
+
+  function getEnvVarTypeAndValue(envvar: TemplateEnv) {
+    if (envvar.select) {
+      return {
+        type: EnvVarType.Select,
+        value: envvar.select.find((v) => v.default)?.value || '',
+      };
+    }
+
+    return {
+      type: envvar.preset ? EnvVarType.PreSelected : EnvVarType.Text,
+      value: envvar.default || '',
+    };
+  }
+}
+
+function getPlatform(platform?: 'linux' | 'windows' | '') {
+  switch (platform) {
+    case 'linux':
+      return Platform.LINUX;
+    case 'windows':
+      return Platform.WINDOWS;
+
+    default:
+      return undefined;
+  }
+}
diff --git a/app/react/portainer/templates/components/DeployWidget.tsx b/app/react/portainer/templates/components/DeployWidget.tsx
new file mode 100644
index 0000000..16654dd
--- /dev/null
+++ b/app/react/portainer/templates/components/DeployWidget.tsx
@@ -0,0 +1,40 @@
+import { Rocket } from 'lucide-react';
+import { PropsWithChildren } from 'react';
+
+import { FallbackImage } from '@@/FallbackImage';
+import { Icon } from '@@/Icon';
+import { Widget } from '@@/Widget';
+
+import { TemplateNote } from './TemplateNote';
+
+export function DeployWidget({
+  logo,
+  note,
+  title,
+  children,
+}: PropsWithChildren<{
+  logo?: string;
+  note?: string;
+  title: string;
+}>) {
+  return (
+    <div className="row">
+      <div className="col-sm-12">
+        <Widget>
+          <Widget.Title
+            icon={
+              <FallbackImage src={logo} fallbackIcon={<Icon icon={Rocket} />} />
+            }
+            title={title}
+          />
+          <Widget.Body>
+            <div className="form-horizontal">
+              <TemplateNote note={note} />
+              {children}
+            </div>
+          </Widget.Body>
+        </Widget>
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/portainer/templates/components/TemplateItem.tsx b/app/react/portainer/templates/components/TemplateItem.tsx
new file mode 100644
index 0000000..cd9e904
--- /dev/null
+++ b/app/react/portainer/templates/components/TemplateItem.tsx
@@ -0,0 +1,102 @@
+import { ReactNode } from 'react';
+import { Rocket } from 'lucide-react';
+
+import LinuxIcon from '@/assets/ico/linux.svg?c';
+import MicrosoftIcon from '@/assets/ico/vendor/microsoft.svg?c';
+import KubernetesIcon from '@/assets/ico/vendor/kubernetes.svg?c';
+
+import { Icon } from '@@/Icon';
+import { FallbackImage } from '@@/FallbackImage';
+import { BlocklistItem } from '@@/Blocklist/BlocklistItem';
+import { BadgeIcon } from '@@/BadgeIcon';
+import { Link } from '@@/Link';
+
+import { Platform } from '../types';
+
+type Value = {
+  Id: number | string;
+  Logo?: string;
+  Title: string;
+  Platform?: Platform;
+  Description: string;
+  Categories?: string[];
+};
+
+export function TemplateItem({
+  template,
+  typeLabel,
+  onSelect,
+  renderActions,
+  isSelected,
+  linkParams,
+}: {
+  template: Value;
+  typeLabel: string;
+  onSelect: () => void;
+  renderActions: ReactNode;
+  isSelected: boolean;
+  linkParams?: { to: string; params: object };
+}) {
+  return (
+    <div className="relative">
+      <BlocklistItem
+        isSelected={isSelected}
+        onClick={() => onSelect()}
+        as={linkParams ? Link : undefined}
+        to={linkParams?.to}
+        params={linkParams?.params}
+        aria-label={template.Title}
+      >
+        <div className="vertical-center min-w-[56px] justify-center">
+          <FallbackImage
+            src={template.Logo}
+            fallbackIcon={<BadgeIcon icon={Rocket} size="3xl" />}
+            className="blocklist-item-logo"
+          />
+        </div>
+        <div className="col-sm-12 flex flex-wrap justify-between">
+          <div className="blocklist-item-line gap-2">
+            <span className="blocklist-item-title">{template.Title}</span>
+            <div className="space-left blocklist-item-subtitle inline-flex items-center">
+              <div className="vertical-center gap-1">
+                {(template.Platform === Platform.LINUX ||
+                  !template.Platform) && (
+                  <Icon icon={LinuxIcon} className="mr-1" />
+                )}
+                {(template.Platform === Platform.WINDOWS ||
+                  !template.Platform) && (
+                  <Icon
+                    icon={MicrosoftIcon}
+                    className="[&>*]:flex [&>*]:items-center"
+                    size="lg"
+                  />
+                )}
+              </div>
+              {typeLabel === 'manifest' && (
+                <div className="vertical-center">
+                  <Icon
+                    icon={KubernetesIcon}
+                    size="lg"
+                    className="align-bottom [&>*]:flex [&>*]:items-center"
+                  />
+                </div>
+              )}
+              {typeLabel}
+            </div>
+          </div>
+          <div className="blocklist-item-line w-full">
+            <span className="blocklist-item-desc">{template.Description}</span>
+            {template.Categories && template.Categories.length > 0 && (
+              <span className="small text-muted">
+                {template.Categories.join(', ')}
+              </span>
+            )}
+          </div>
+        </div>
+      </BlocklistItem>
+      <span className="absolute inset-y-0 right-0 justify-end">
+        {renderActions}
+      </span>
+    </div>
+  );
+}
diff --git a/app/react/portainer/templates/components/TemplateNote.tsx b/app/react/portainer/templates/components/TemplateNote.tsx
new file mode 100644
index 0000000..ff78215
--- /dev/null
+++ b/app/react/portainer/templates/components/TemplateNote.tsx
@@ -0,0 +1,25 @@
+import sanitize from 'sanitize-html';
+
+import { FormSection } from '@@/form-components/FormSection';
+
+export function TemplateNote({ note }: { note?: string }) {
+  if (!note) {
+    return null;
+  }
+
+  return (
+    <FormSection title="Information">
+      <div className="form-group">
+        <div className="col-sm-12">
+          <div
+            className="text-xs"
+            // eslint-disable-next-line react/no-danger
+            dangerouslySetInnerHTML={{
+              __html: sanitize(note),
+            }}
+          />
+        </div>
+      </div>
+    </FormSection>
+  );
+}
diff --git a/app/react/portainer/templates/custom-templates/CreateView/CreateForm.tsx b/app/react/portainer/templates/custom-templates/CreateView/CreateForm.tsx
new file mode 100644
index 0000000..ff222f9
--- /dev/null
+++ b/app/react/portainer/templates/custom-templates/CreateView/CreateForm.tsx
@@ -0,0 +1,96 @@
+import { Formik } from 'formik';
+import { useRouter } from '@uirouter/react';
+
+import { StackType } from '@/react/common/stacks/types';
+import { notifySuccess } from '@/portainer/services/notifications';
+import { useCreateTemplateMutation } from '@/react/portainer/templates/custom-templates/queries/useCreateTemplateMutation';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { useEnvironmentDeploymentOptions } from '@/react/portainer/environments/queries/useEnvironment';
+import { useCurrentEnvironment } from '@/react/hooks/useCurrentEnvironment';
+import { isKubernetesEnvironment } from '@/react/portainer/environments/utils';
+import { DeployMethod } from '@/react/portainer/gitops/types';
+
+import { useInitialValues } from './useInitialValues';
+import { FormValues, initialBuildMethods } from './types';
+import { useValidation } from './useValidation';
+import { InnerForm } from './InnerForm';
+
+export function CreateForm({
+  environmentId,
+  viewType,
+  defaultType,
+}: {
+  environmentId?: EnvironmentId;
+  viewType: 'kube' | 'docker' | 'edge';
+  defaultType: StackType;
+}) {
+  const deployMethod: DeployMethod =
+    defaultType === StackType.Kubernetes ? 'manifest' : 'compose';
+  const isEdge = !environmentId;
+  const router = useRouter();
+  const mutation = useCreateTemplateMutation();
+  const validation = useValidation({ viewType, deployMethod });
+  const buildMethods = useBuildMethods();
+
+  const initialValues = useInitialValues({
+    defaultType,
+    isEdge,
+    buildMethods: buildMethods.map((method) => method.value),
+  });
+
+  if (!initialValues) {
+    return null;
+  }
+
+  return (
+    <Formik
+      initialValues={initialValues}
+      onSubmit={handleSubmit}
+      validationSchema={validation}
+      validateOnMount
+    >
+      <InnerForm
+        isLoading={mutation.isLoading}
+        environmentId={environmentId}
+        buildMethods={buildMethods}
+      />
+    </Formik>
+  );
+
+  function handleSubmit(values: FormValues) {
+    mutation.mutate(
+      {
+        ...values,
+        EdgeTemplate: isEdge,
+      },
+      {
+        onSuccess() {
+          notifySuccess('Success', 'Template created');
+          router.stateService.go('^');
+        },
+      }
+    );
+  }
+}
+
+function useBuildMethods() {
+  const environment = useCurrentEnvironment(false);
+
+  const deploymentOptionsQuery = useEnvironmentDeploymentOptions(
+    environment.data && isKubernetesEnvironment(environment.data.Type)
+      ? environment.data.Id
+      : undefined
+  );
+  return initialBuildMethods.filter((method) => {
+    switch (method.value) {
+      case 'editor':
+        return !deploymentOptionsQuery.data?.hideWebEditor;
+      case 'upload':
+        return !deploymentOptionsQuery.data?.hideFileUpload;
+      case 'repository':
+        return true;
+      default:
+        return true;
+    }
+  });
+}
diff --git a/app/react/portainer/templates/custom-templates/CreateView/CreateView.tsx b/app/react/portainer/templates/custom-templates/CreateView/CreateView.tsx
new file mode 100644
index 0000000..c19d8f1
--- /dev/null
+++ b/app/react/portainer/templates/custom-templates/CreateView/CreateView.tsx
@@ -0,0 +1,60 @@
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useIsSwarm } from '@/react/docker/proxy/queries/useInfo';
+import { StackType } from '@/react/common/stacks/types';
+import { ContainerEngine } from '@/react/portainer/environments/types';
+
+import { PageHeader } from '@@/PageHeader';
+import { Widget } from '@@/Widget';
+
+import { TemplateViewType, useViewType } from '../useViewType';
+
+import { CreateForm } from './CreateForm';
+
+export function CreateView() {
+  const viewType = useViewType();
+  const environmentId = useEnvironmentId(false);
+  const isSwarm = useIsSwarm(environmentId, {
+    enabled: viewType === ContainerEngine.Docker,
+  });
+  const defaultType = getDefaultType(viewType, isSwarm);
+
+  return (
+    <div>
+      <PageHeader
+        title="Create Custom Template"
+        breadcrumbs={[
+          { label: 'Custom Templates', link: '^' },
+          'Create Custom Template',
+        ]}
+      />
+
+      <div className="row">
+        <div className="col-sm-12">
+          <Widget>
+            <Widget.Body>
+              <CreateForm
+                viewType={viewType}
+                environmentId={environmentId}
+                defaultType={defaultType}
+              />
+            </Widget.Body>
+          </Widget>
+        </div>
+      </div>
+    </div>
+  );
+}
+
+function getDefaultType(
+  viewType: TemplateViewType,
+  isSwarm: boolean
+): StackType {
+  switch (viewType) {
+    case 'docker':
+      return isSwarm ? StackType.DockerSwarm : StackType.DockerCompose;
+    case 'kube':
+      return StackType.Kubernetes;
+    default:
+      return StackType.DockerCompose;
+  }
+}
diff --git a/app/react/portainer/templates/custom-templates/CreateView/EdgeSettingsFieldset.tsx b/app/react/portainer/templates/custom-templates/CreateView/EdgeSettingsFieldset.tsx
new file mode 100644
index 0000000..6a35147
--- /dev/null
+++ b/app/react/portainer/templates/custom-templates/CreateView/EdgeSettingsFieldset.tsx
@@ -0,0 +1,81 @@
+import { FormikErrors } from 'formik';
+import { SetStateAction } from 'react';
+
+import { RelativePathFieldset } from '@/react/portainer/gitops/RelativePathFieldset/RelativePathFieldset';
+import { PrivateRegistryFieldsetWrapper } from '@/react/edge/edge-stacks/ItemView/EditEdgeStackForm/PrivateRegistryFieldsetWrapper';
+import { PrePullToggle } from '@/react/edge/edge-stacks/components/PrePullToggle';
+import { RetryDeployToggle } from '@/react/edge/edge-stacks/components/RetryDeployToggle';
+import { EdgeTemplateSettings } from '@/react/portainer/templates/custom-templates/types';
+import { GitFormModel } from '@/react/portainer/gitops/types';
+
+import { FormSection } from '@@/form-components/FormSection';
+
+export function EdgeSettingsFieldset({
+  values,
+  setValues,
+  errors,
+  gitConfig,
+  fileValues,
+  setFieldError,
+}: {
+  values: EdgeTemplateSettings;
+  setValues: (values: SetStateAction<EdgeTemplateSettings>) => void;
+  errors?: FormikErrors<EdgeTemplateSettings>;
+  gitConfig?: GitFormModel;
+  setFieldError: (field: string, message: string) => void;
+  fileValues: {
+    fileContent?: string;
+    file?: File;
+  };
+}) {
+  const isGit = !!gitConfig;
+  return (
+    <>
+      {isGit && (
+        <FormSection title="Advanced settings">
+          <RelativePathFieldset
+            values={values.RelativePathSettings}
+            gitModel={gitConfig}
+            onChange={(newValues) =>
+              setValues((values) => ({
+                ...values,
+                RelativePathSettings: {
+                  ...values.RelativePathSettings,
+                  ...newValues,
+                },
+              }))
+            }
+          />
+        </FormSection>
+      )}
+
+      <PrivateRegistryFieldsetWrapper
+        value={values.PrivateRegistryId}
+        onChange={(registryId) =>
+          setValues((values) => ({
+            ...values,
+            PrivateRegistryId: registryId,
+          }))
+        }
+        values={fileValues}
+        onFieldError={(error) => setFieldError('Edge?.Registries', error)}
+        error={errors?.PrivateRegistryId}
+        isGit={isGit}
+      />
+
+      <PrePullToggle
+        onChange={(value) =>
+          setValues((values) => ({ ...values, PrePullImage: value }))
+        }
+        value={values.PrePullImage}
+      />
+
+      <RetryDeployToggle
+        onChange={(value) =>
+          setValues((values) => ({ ...values, RetryDeploy: value }))
+        }
+        value={values.RetryDeploy}
+      />
+    </>
+  );
+}
diff --git a/app/react/portainer/templates/custom-templates/CreateView/EdgeSettingsFieldset.validation.ts b/app/react/portainer/templates/custom-templates/CreateView/EdgeSettingsFieldset.validation.ts
new file mode 100644
index 0000000..87a439c
--- /dev/null
+++ b/app/react/portainer/templates/custom-templates/CreateView/EdgeSettingsFieldset.validation.ts
@@ -0,0 +1,20 @@
+import { SchemaOf, boolean, mixed, number, object } from 'yup';
+
+import { staggerConfigValidation } from '@/react/edge/edge-stacks/components/StaggerFieldset';
+import { relativePathValidation } from '@/react/portainer/gitops/RelativePathFieldset/validation';
+import { EdgeTemplateSettings } from '@/react/portainer/templates/custom-templates/types';
+import { isBE } from '@/react/portainer/feature-flags/feature-flags.service';
+
+export function edgeFieldsetValidation(): SchemaOf<EdgeTemplateSettings> {
+  if (!isBE) {
+    return mixed().default(undefined) as SchemaOf<EdgeTemplateSettings>;
+  }
+
+  return object({
+    RelativePathSettings: relativePathValidation(),
+    PrePullImage: boolean().default(false),
+    RetryDeploy: boolean().default(false),
+    PrivateRegistryId: number().default(undefined),
+    StaggerConfig: staggerConfigValidation(),
+  });
+}
diff --git a/app/react/portainer/templates/custom-templates/CreateView/InnerForm.tsx b/app/react/portainer/templates/custom-templates/CreateView/InnerForm.tsx
new file mode 100644
index 0000000..c14b35e
--- /dev/null
+++ b/app/react/portainer/templates/custom-templates/CreateView/InnerForm.tsx
@@ -0,0 +1,193 @@
+import { Form, FormikErrors, useFormikContext } from 'formik';
+
+import { CommonFields } from '@/react/portainer/custom-templates/components/CommonFields';
+import { CustomTemplatesVariablesDefinitionField } from '@/react/portainer/custom-templates/components/CustomTemplatesVariablesDefinitionField';
+import { PlatformField } from '@/react/portainer/custom-templates/components/PlatformSelector';
+import { GitForm } from '@/react/portainer/gitops/GitForm';
+import { isTemplateVariablesEnabled } from '@/react/portainer/custom-templates/components/utils';
+import { TemplateTypeSelector } from '@/react/portainer/custom-templates/components/TemplateTypeSelector';
+import { AccessControlForm } from '@/react/portainer/access-control';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { applySetStateAction } from '@/react-tools/apply-set-state-action';
+import { AccessControlFormData } from '@/react/portainer/access-control/types';
+import { textByType } from '@/react/common/stacks/common/form-texts';
+import { StackType } from '@/react/common/stacks/types';
+
+import { BoxSelector } from '@@/BoxSelector';
+import { WebEditorForm, usePreventExit } from '@@/WebEditorForm';
+import { FileUploadForm } from '@@/form-components/FileUpload';
+import { FormActions } from '@@/form-components/FormActions';
+import { FormSection } from '@@/form-components/FormSection';
+
+import { EdgeTemplateSettings } from '../types';
+import { useParseTemplateOnFileChange } from '../useParseTemplateOnFileChange';
+
+import { EdgeSettingsFieldset } from './EdgeSettingsFieldset';
+import { FormValues, Method, initialBuildMethods } from './types';
+
+export function InnerForm({
+  isLoading,
+  environmentId,
+  buildMethods,
+}: {
+  isLoading: boolean;
+  environmentId?: EnvironmentId;
+  buildMethods: Array<(typeof initialBuildMethods)[number]>;
+}) {
+  const {
+    values,
+    initialValues,
+    setFieldValue,
+    errors,
+    isValid,
+    setFieldError,
+    setValues,
+    isSubmitting,
+  } = useFormikContext<FormValues>();
+
+  const isGit = values.Method === 'repository';
+  const isEditor = values.Method === 'editor';
+
+  usePreventExit(
+    initialValues.FileContent,
+    values.FileContent,
+    isEditor && !isSubmitting && !isLoading
+  );
+
+  const handleChangeFileContent = useParseTemplateOnFileChange(
+    values.Variables
+  );
+
+  const texts = textByType[values.Type];
+
+  return (
+    <Form className="form-horizontal">
+      <CommonFields
+        values={values}
+        onChange={(newValues) =>
+          setValues((values) => ({ ...values, ...newValues }))
+        }
+        errors={errors}
+      />
+
+      {values.Type !== StackType.Kubernetes && (
+        <>
+          <PlatformField
+            value={values.Platform}
+            onChange={(value) => setFieldValue('Platform', value)}
+          />
+
+          <TemplateTypeSelector
+            value={values.Type}
+            onChange={(value) => setFieldValue('Type', value)}
+          />
+        </>
+      )}
+
+      <FormSection title="Build method">
+        <BoxSelector
+          slim
+          options={buildMethods}
+          value={values.Method}
+          onChange={handleChangeMethod}
+          radioName="buildMethod"
+        />
+      </FormSection>
+
+      {isEditor && (
+        <WebEditorForm
+          data-cy="custom-template-creation-editor"
+          id="custom-template-creation-editor"
+          value={values.FileContent}
+          onChange={handleChangeFileContent}
+          type="yaml"
+          textTip={texts.editor.placeholder}
+          error={errors.FileContent}
+        >
+          {texts.editor.description}
+        </WebEditorForm>
+      )}
+
+      {values.Method === 'upload' && (
+        <FileUploadForm
+          description={texts.upload}
+          value={values.File}
+          onChange={(value) => setFieldValue('File', value)}
+          required
+          data-cy="custom-template-creation-file-upload"
+        />
+      )}
+
+      {isGit && (
+        <GitForm
+          deployMethod={
+            values.Type === StackType.Kubernetes ? 'manifest' : 'compose'
+          }
+          value={values.Git}
+          onChange={(newValues) =>
+            setValues((values) => ({
+              ...values,
+              Git: { ...values.Git, ...newValues },
+            }))
+          }
+          errors={errors.Git}
+        />
+      )}
+
+      {isTemplateVariablesEnabled && (
+        <CustomTemplatesVariablesDefinitionField
+          value={values.Variables}
+          onChange={(values) => setFieldValue('Variables', values)}
+          isVariablesNamesFromParent={isEditor}
+          errors={errors.Variables}
+        />
+      )}
+
+      {!!values.AccessControl && (
+        <AccessControlForm
+          environmentId={environmentId || 0}
+          onChange={(values) => setFieldValue('AccessControl', values)}
+          values={values.AccessControl}
+          errors={errors.AccessControl as FormikErrors<AccessControlFormData>}
+          formNamespace="accessControl"
+        />
+      )}
+
+      {values.EdgeSettings && (
+        <EdgeSettingsFieldset
+          setValues={(edgeSetValues) =>
+            setValues((values) => ({
+              ...values,
+              EdgeSettings: applySetStateAction(
+                edgeSetValues,
+                values.EdgeSettings!
+              ),
+            }))
+          }
+          gitConfig={isGit ? values.Git : undefined}
+          fileValues={{
+            fileContent: values.FileContent,
+            file: values.File,
+          }}
+          values={values.EdgeSettings}
+          errors={errors.EdgeSettings as FormikErrors<EdgeTemplateSettings>}
+          setFieldError={setFieldError}
+        />
+      )}
+
+      <FormActions
+        isLoading={isLoading}
+        isValid={isValid}
+        loadingText="Creating custom template..."
+        submitLabel="Create custom template"
+        data-cy="custom-template-creation-submit-button"
+      />
+    </Form>
+  );
+
+  function handleChangeMethod(method: Method) {
+    setFieldValue('FileContent', '');
+    setFieldValue('Variables', []);
+    setFieldValue('Method', method);
+  }
+}
diff --git a/app/react/portainer/templates/custom-templates/CreateView/index.ts b/app/react/portainer/templates/custom-templates/CreateView/index.ts
new file mode 100644
index 0000000..74e5921
--- /dev/null
+++ b/app/react/portainer/templates/custom-templates/CreateView/index.ts
@@ -0,0 +1 @@
+export { CreateView } from './CreateView';
diff --git a/app/react/portainer/templates/custom-templates/CreateView/types.ts b/app/react/portainer/templates/custom-templates/CreateView/types.ts
new file mode 100644
index 0000000..4c37b47
--- /dev/null
+++ b/app/react/portainer/templates/custom-templates/CreateView/types.ts
@@ -0,0 +1,30 @@
+import { StackType } from '@/react/common/stacks/types';
+import { type Values as CommonFieldsValues } from '@/react/portainer/custom-templates/components/CommonFields';
+import { DefinitionFieldValues } from '@/react/portainer/custom-templates/components/CustomTemplatesVariablesDefinitionField';
+import { Platform } from '@/react/portainer/templates/types';
+import { GitFormModel } from '@/react/portainer/gitops/types';
+import { AccessControlFormData } from '@/react/portainer/access-control/types';
+
+import {
+  editor,
+  upload,
+  git,
+} from '@@/BoxSelector/common-options/build-methods';
+
+import { EdgeTemplateSettings } from '../types';
+
+export const initialBuildMethods = [editor, upload, git] as const;
+
+export type Method = (typeof initialBuildMethods)[number]['value'];
+
+export interface FormValues extends CommonFieldsValues {
+  Platform: Platform;
+  Type: StackType;
+  Method: Method;
+  FileContent: string;
+  File: File | undefined;
+  Git: GitFormModel;
+  Variables: DefinitionFieldValues;
+  AccessControl?: AccessControlFormData;
+  EdgeSettings?: EdgeTemplateSettings;
+}
diff --git a/app/react/portainer/templates/custom-templates/CreateView/useInitialValues.ts b/app/react/portainer/templates/custom-templates/CreateView/useInitialValues.ts
new file mode 100644
index 0000000..79e3b37
--- /dev/null
+++ b/app/react/portainer/templates/custom-templates/CreateView/useInitialValues.ts
@@ -0,0 +1,98 @@
+import { useCurrentStateAndParams } from '@uirouter/react';
+
+import { parseAccessControlFormData } from '@/react/portainer/access-control/utils';
+import { useCurrentUser } from '@/react/hooks/useUser';
+import { StackType } from '@/react/common/stacks/types';
+
+import { Platform } from '../../types';
+import { useAppTemplateFile } from '../../app-templates/queries/useAppTemplateFile';
+import { getDefaultEdgeTemplateSettings } from '../types';
+
+import { FormValues, Method } from './types';
+
+export function useInitialValues({
+  defaultType,
+  isEdge = false,
+  buildMethods,
+}: {
+  defaultType: StackType;
+  isEdge?: boolean;
+  buildMethods: Array<Method>;
+}): FormValues | undefined {
+  const { user, isPureAdmin } = useCurrentUser();
+
+  const { appTemplateId, type = defaultType } = useAppTemplateParams();
+
+  // don't make the file path 'docker-compose.yml' in a kube environment. Keep it empty with the existing 'manifest.yml' placeholder
+  const initialFilePathInRepository =
+    type === StackType.Kubernetes ? '' : 'docker-compose.yml';
+
+  const {
+    params: { fileContent = '' },
+  } = useCurrentStateAndParams();
+
+  const fileContentQuery = useAppTemplateFile(appTemplateId);
+  if (fileContentQuery.isInitialLoading) {
+    return undefined;
+  }
+
+  return {
+    Title: '',
+    FileContent: (fileContentQuery.data ?? '') || fileContent,
+    Type: type,
+    Platform: Platform.LINUX,
+    File: undefined,
+    Method: buildMethods[0],
+    Description: '',
+    Note: '',
+    Logo: '',
+    Variables: [],
+    Git: {
+      SourceId: 0,
+      RepositoryReferenceName: '',
+      ComposeFilePathInRepository: initialFilePathInRepository,
+      AdditionalFiles: [],
+    },
+    AccessControl: isEdge
+      ? undefined
+      : parseAccessControlFormData(isPureAdmin, user.Id),
+    EdgeSettings: isEdge ? getDefaultEdgeTemplateSettings() : undefined,
+  };
+}
+
+function useAppTemplateParams() {
+  const {
+    params: { type, appTemplateId },
+  } = useCurrentStateAndParams();
+
+  return {
+    type: getStackType(type),
+    appTemplateId: getTemplateId(appTemplateId),
+  };
+
+  function getStackType(type: string): StackType | undefined {
+    if (!type) {
+      return undefined;
+    }
+
+    const typeNum = parseInt(type, 10);
+
+    if (
+      [
+        StackType.DockerSwarm,
+        StackType.DockerCompose,
+        StackType.Kubernetes,
+      ].includes(typeNum)
+    ) {
+      return typeNum;
+    }
+
+    return undefined;
+  }
+
+  function getTemplateId(appTemplateId: string): number | undefined {
+    const id = parseInt(appTemplateId, 10);
+
+    return Number.isNaN(id) ? undefined : id;
+  }
+}
diff --git a/app/react/portainer/templates/custom-templates/CreateView/useValidation.tsx b/app/react/portainer/templates/custom-templates/CreateView/useValidation.tsx
new file mode 100644
index 0000000..230b111
--- /dev/null
+++ b/app/react/portainer/templates/custom-templates/CreateView/useValidation.tsx
@@ -0,0 +1,70 @@
+import { mixed, number, object, string } from 'yup';
+import { useMemo } from 'react';
+
+import { StackType } from '@/react/common/stacks/types';
+import { validation as commonFieldsValidation } from '@/react/portainer/custom-templates/components/CommonFields';
+import { Platform } from '@/react/portainer/templates/types';
+import { variablesValidation } from '@/react/portainer/custom-templates/components/CustomTemplatesVariablesDefinitionField';
+import { buildGitValidationSchema } from '@/react/portainer/gitops/GitForm';
+import { useCustomTemplates } from '@/react/portainer/templates/custom-templates/queries/useCustomTemplates';
+import { edgeFieldsetValidation } from '@/react/portainer/templates/custom-templates/CreateView/EdgeSettingsFieldset.validation';
+import { DeployMethod } from '@/react/portainer/gitops/types';
+
+import { file } from '@@/form-components/yup-file-validation';
+import {
+  editor,
+  git,
+  upload,
+} from '@@/BoxSelector/common-options/build-methods';
+
+import { initialBuildMethods } from './types';
+
+export function useValidation({
+  viewType,
+  deployMethod,
+}: {
+  viewType: 'kube' | 'docker' | 'edge';
+  deployMethod: DeployMethod;
+}) {
+  const customTemplatesQuery = useCustomTemplates({
+    params: {
+      edge: undefined,
+    },
+  });
+
+  return useMemo(
+    () =>
+      object({
+        Platform: number()
+          .oneOf([Platform.LINUX, Platform.WINDOWS])
+          .default(Platform.LINUX),
+        Type: number()
+          .oneOf([
+            StackType.DockerCompose,
+            StackType.DockerSwarm,
+            StackType.Kubernetes,
+          ])
+          .default(StackType.DockerCompose),
+        Method: string().oneOf(initialBuildMethods.map((m) => m.value)),
+        FileContent: string().when('Method', {
+          is: editor.value,
+          then: (schema) => schema.required('Template is required.'),
+        }),
+        File: file().when('Method', {
+          is: upload.value,
+          then: (schema) => schema.required(),
+        }),
+        Git: mixed().when('Method', {
+          is: git.value,
+          then: () => buildGitValidationSchema(deployMethod),
+        }),
+        Variables: variablesValidation(),
+        EdgeSettings: viewType === 'edge' ? edgeFieldsetValidation() : mixed(),
+      }).concat(
+        commonFieldsValidation({
+          templates: customTemplatesQuery.data,
+        })
+      ),
+    [customTemplatesQuery.data, viewType, deployMethod]
+  );
+}
diff --git a/app/react/portainer/templates/custom-templates/EditView/EditForm.tsx b/app/react/portainer/templates/custom-templates/EditView/EditForm.tsx
new file mode 100644
index 0000000..22f4ce8
--- /dev/null
+++ b/app/react/portainer/templates/custom-templates/EditView/EditForm.tsx
@@ -0,0 +1,118 @@
+import { Formik } from 'formik';
+import { useRouter } from '@uirouter/react';
+
+import { notifySuccess } from '@/portainer/services/notifications';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { useEnvironmentDeploymentOptions } from '@/react/portainer/environments/queries/useEnvironment';
+import { useCurrentEnvironment } from '@/react/hooks/useCurrentEnvironment';
+import { isKubernetesEnvironment } from '@/react/portainer/environments/utils';
+import { DeployMethod } from '@/react/portainer/gitops/types';
+import { StackType } from '@/react/common/stacks/types';
+
+import { CustomTemplate } from '../types';
+import { useUpdateTemplateMutation } from '../queries/useUpdateTemplateMutation';
+import { useCustomTemplateFile } from '../queries/useCustomTemplateFile';
+import { TemplateViewType } from '../useViewType';
+
+import { useInitialValues } from './useInitialValues';
+import { FormValues } from './types';
+import { useValidation } from './useValidation';
+import { InnerForm } from './InnerForm';
+
+export function EditForm({
+  template,
+  environmentId,
+  viewType,
+}: {
+  template: CustomTemplate;
+  environmentId?: EnvironmentId;
+  viewType: TemplateViewType;
+}) {
+  const isEdge = template.EdgeTemplate;
+  const isGit = !!template.GitConfig;
+
+  const router = useRouter();
+  const disableEditor = useDisableEditor(isGit);
+  const mutation = useUpdateTemplateMutation();
+  const deployMethod: DeployMethod =
+    template.Type === StackType.Kubernetes ? 'manifest' : 'compose';
+  const validation = useValidation({
+    viewType,
+    isGit,
+    templateId: template.Id,
+    deployMethod,
+  });
+
+  const fileContentQuery = useCustomTemplateFile(template.Id);
+
+  const initialValues = useInitialValues({
+    isEdge,
+    template,
+    templateFile: fileContentQuery.data,
+  });
+
+  if (fileContentQuery.isLoading || !initialValues) {
+    return null;
+  }
+
+  return (
+    <Formik
+      initialValues={initialValues}
+      onSubmit={handleSubmit}
+      validationSchema={validation}
+      validateOnMount
+    >
+      <InnerForm
+        isLoading={mutation.isLoading}
+        environmentId={environmentId}
+        isEditorReadonly={disableEditor}
+        refreshGitFile={fileContentQuery.refetch}
+        gitFileContent={fileContentQuery.data}
+        gitFileError={
+          fileContentQuery.error instanceof Error
+            ? fileContentQuery.error.message
+            : ''
+        }
+      />
+    </Formik>
+  );
+
+  function handleSubmit(values: FormValues) {
+    mutation.mutate(
+      {
+        id: template.Id,
+        EdgeTemplate: template.EdgeTemplate,
+        Description: values.Description,
+        Title: values.Title,
+        Type: values.Type,
+        Logo: values.Logo,
+        FileContent: values.FileContent,
+        Note: values.Note,
+        Platform: values.Platform,
+        Variables: values.Variables,
+        EdgeSettings: values.EdgeSettings,
+        AccessControl: values.AccessControl,
+        resourceControlId: template.ResourceControl?.Id,
+        ...values.Git,
+      },
+      {
+        onSuccess() {
+          notifySuccess('Success', 'Template updated successfully');
+          router.stateService.go('^');
+        },
+      }
+    );
+  }
+}
+
+function useDisableEditor(isGit: boolean) {
+  const environment = useCurrentEnvironment(false);
+
+  const deploymentOptionsQuery = useEnvironmentDeploymentOptions(
+    environment.data && isKubernetesEnvironment(environment.data.Type)
+      ? environment.data.Id
+      : undefined
+  );
+
+  return isGit || !!deploymentOptionsQuery.data?.hideAddWithForm;
+}
diff --git a/app/react/portainer/templates/custom-templates/EditView/EditView.tsx b/app/react/portainer/templates/custom-templates/EditView/EditView.tsx
new file mode 100644
index 0000000..3927b91
--- /dev/null
+++ b/app/react/portainer/templates/custom-templates/EditView/EditView.tsx
@@ -0,0 +1,49 @@
+import { useCurrentStateAndParams } from '@uirouter/react';
+
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+
+import { PageHeader } from '@@/PageHeader';
+import { Widget } from '@@/Widget';
+
+import { useCustomTemplate } from '../queries/useCustomTemplate';
+import { useViewType } from '../useViewType';
+
+import { EditForm } from './EditForm';
+
+export function EditView() {
+  const viewType = useViewType();
+  const {
+    params: { id },
+  } = useCurrentStateAndParams();
+  const environmentId = useEnvironmentId(false);
+  const templateQuery = useCustomTemplate(id);
+
+  if (!templateQuery.data) {
+    return null;
+  }
+
+  const template = templateQuery.data;
+
+  return (
+    <div>
+      <PageHeader
+        title="Edit Custom template"
+        breadcrumbs={[{ label: 'Custom Templates', link: '^' }, template.Title]}
+      />
+
+      <div className="row">
+        <div className="col-sm-12">
+          <Widget>
+            <Widget.Body>
+              <EditForm
+                environmentId={environmentId}
+                template={template}
+                viewType={viewType}
+              />
+            </Widget.Body>
+          </Widget>
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/portainer/templates/custom-templates/EditView/InnerForm.tsx b/app/react/portainer/templates/custom-templates/EditView/InnerForm.tsx
new file mode 100644
index 0000000..d96f9fe
--- /dev/null
+++ b/app/react/portainer/templates/custom-templates/EditView/InnerForm.tsx
@@ -0,0 +1,191 @@
+import { Form, FormikErrors, useFormikContext } from 'formik';
+import { RefreshCw } from 'lucide-react';
+
+import { CommonFields } from '@/react/portainer/custom-templates/components/CommonFields';
+import { CustomTemplatesVariablesDefinitionField } from '@/react/portainer/custom-templates/components/CustomTemplatesVariablesDefinitionField';
+import { PlatformField } from '@/react/portainer/custom-templates/components/PlatformSelector';
+import { GitForm } from '@/react/portainer/gitops/GitForm';
+import { isTemplateVariablesEnabled } from '@/react/portainer/custom-templates/components/utils';
+import { TemplateTypeSelector } from '@/react/portainer/custom-templates/components/TemplateTypeSelector';
+import { applySetStateAction } from '@/react-tools/apply-set-state-action';
+import { EdgeTemplateSettings } from '@/react/portainer/templates/custom-templates/types';
+import { EdgeSettingsFieldset } from '@/react/portainer/templates/custom-templates/CreateView/EdgeSettingsFieldset';
+import { StackType } from '@/react/common/stacks/types';
+import { textByType } from '@/react/common/stacks/common/form-texts';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { AccessControlForm } from '@/react/portainer/access-control';
+import { AccessControlFormData } from '@/react/portainer/access-control/types';
+
+import { WebEditorForm, usePreventExit } from '@@/WebEditorForm';
+import { FormActions } from '@@/form-components/FormActions';
+import { Button } from '@@/buttons';
+import { FormError } from '@@/form-components/FormError';
+
+import { useParseTemplateOnFileChange } from '../useParseTemplateOnFileChange';
+
+import { FormValues } from './types';
+
+export function InnerForm({
+  isLoading,
+  environmentId,
+  isEditorReadonly,
+  gitFileContent,
+  gitFileError,
+  refreshGitFile,
+}: {
+  isLoading: boolean;
+  environmentId?: EnvironmentId;
+  isEditorReadonly: boolean;
+  gitFileContent?: string;
+  gitFileError?: string;
+  refreshGitFile: () => void;
+}) {
+  const {
+    values,
+    initialValues,
+    setFieldValue,
+    errors,
+    isValid,
+    setFieldError,
+    setValues,
+    isSubmitting,
+    dirty,
+  } = useFormikContext<FormValues>();
+  usePreventExit(
+    initialValues.FileContent,
+    values.FileContent,
+    !isEditorReadonly && !isSubmitting && !isLoading
+  );
+
+  const handleChangeFileContent = useParseTemplateOnFileChange(
+    values.Variables
+  );
+
+  const texts = textByType[values.Type];
+
+  return (
+    <Form className="form-horizontal">
+      <CommonFields
+        values={values}
+        onChange={(newValues) =>
+          setValues((values) => ({ ...values, ...newValues }))
+        }
+        errors={errors}
+      />
+
+      {values.Type !== StackType.Kubernetes && (
+        <>
+          <PlatformField
+            value={values.Platform}
+            onChange={(value) => setFieldValue('Platform', value)}
+          />
+
+          <TemplateTypeSelector
+            value={values.Type}
+            onChange={(value) => setFieldValue('Type', value)}
+          />
+        </>
+      )}
+
+      <WebEditorForm
+        data-cy="custom-template-editor"
+        id="edit-custom-template-editor"
+        value={gitFileContent || values.FileContent}
+        onChange={handleChangeFileContent}
+        type="yaml"
+        textTip={
+          gitFileContent
+            ? 'Preview of the file from git repository'
+            : texts.editor.placeholder
+        }
+        error={errors.FileContent}
+        readonly={isEditorReadonly}
+      >
+        {texts.editor.description}
+      </WebEditorForm>
+
+      {values.Git && (
+        <>
+          <GitForm
+            value={values.Git}
+            onChange={(newValues) =>
+              setValues((values) => ({
+                ...values,
+                // set ! for values.Git because this callback will only be called when it's defined (see L94)
+                Git: { ...values.Git!, ...newValues },
+              }))
+            }
+            deployMethod={
+              values.Type === StackType.Kubernetes ? 'manifest' : 'compose'
+            }
+            errors={typeof errors.Git === 'object' ? errors.Git : undefined}
+          />
+          <div className="form-group">
+            <div className="col-sm-12">
+              <Button
+                color="light"
+                icon={RefreshCw}
+                onClick={refreshGitFile}
+                data-cy="custom-template-edit-reload-git-file-button"
+              >
+                Reload custom template
+              </Button>
+            </div>
+            {gitFileError && (
+              <div className="col-sm-12">
+                <FormError>
+                  Custom template could not be loaded, {gitFileError}.
+                </FormError>
+              </div>
+            )}
+          </div>
+        </>
+      )}
+
+      {isTemplateVariablesEnabled && (
+        <CustomTemplatesVariablesDefinitionField
+          value={values.Variables}
+          onChange={(values) => setFieldValue('Variables', values)}
+          isVariablesNamesFromParent={!isEditorReadonly}
+          errors={errors.Variables}
+        />
+      )}
+
+      {!!values.AccessControl && (
+        <AccessControlForm
+          environmentId={environmentId || 0}
+          onChange={(values) => setFieldValue('AccessControl', values)}
+          values={values.AccessControl}
+          errors={errors.AccessControl as FormikErrors<AccessControlFormData>}
+          formNamespace="accessControl"
+        />
+      )}
+
+      {values.EdgeSettings && (
+        <EdgeSettingsFieldset
+          setValues={(edgeValues) =>
+            setFieldValue(
+              'EdgeSettings',
+              applySetStateAction(edgeValues, values.EdgeSettings!)
+            )
+          }
+          gitConfig={values.Git}
+          fileValues={{
+            fileContent: values.FileContent,
+          }}
+          values={values.EdgeSettings}
+          errors={errors.EdgeSettings as FormikErrors<EdgeTemplateSettings>}
+          setFieldError={setFieldError}
+        />
+      )}
+
+      <FormActions
+        isLoading={isLoading}
+        isValid={isValid && dirty}
+        loadingText="Updating custom template..."
+        submitLabel="Update custom template"
+        data-cy="custom-template-edit-submit-button"
+      />
+    </Form>
+  );
+}
diff --git a/app/react/portainer/templates/custom-templates/EditView/index.ts b/app/react/portainer/templates/custom-templates/EditView/index.ts
new file mode 100644
index 0000000..854d3dd
--- /dev/null
+++ b/app/react/portainer/templates/custom-templates/EditView/index.ts
@@ -0,0 +1 @@
+export { EditView } from './EditView';
diff --git a/app/react/portainer/templates/custom-templates/EditView/types.ts b/app/react/portainer/templates/custom-templates/EditView/types.ts
new file mode 100644
index 0000000..bd911f6
--- /dev/null
+++ b/app/react/portainer/templates/custom-templates/EditView/types.ts
@@ -0,0 +1,18 @@
+import { StackType } from '@/react/common/stacks/types';
+import { type Values as CommonFieldsValues } from '@/react/portainer/custom-templates/components/CommonFields';
+import { DefinitionFieldValues } from '@/react/portainer/custom-templates/components/CustomTemplatesVariablesDefinitionField';
+import { Platform } from '@/react/portainer/templates/types';
+import { GitFormModel } from '@/react/portainer/gitops/types';
+import { AccessControlFormData } from '@/react/portainer/access-control/types';
+
+import { EdgeTemplateSettings } from '../types';
+
+export interface FormValues extends CommonFieldsValues {
+  Platform: Platform;
+  Type: StackType;
+  FileContent: string;
+  Git?: GitFormModel;
+  Variables: DefinitionFieldValues;
+  AccessControl?: AccessControlFormData;
+  EdgeSettings?: EdgeTemplateSettings;
+}
diff --git a/app/react/portainer/templates/custom-templates/EditView/useInitialValues.ts b/app/react/portainer/templates/custom-templates/EditView/useInitialValues.ts
new file mode 100644
index 0000000..e215898
--- /dev/null
+++ b/app/react/portainer/templates/custom-templates/EditView/useInitialValues.ts
@@ -0,0 +1,49 @@
+import { parseAccessControlFormData } from '@/react/portainer/access-control/utils';
+import { useCurrentUser, useIsEdgeAdmin } from '@/react/hooks/useUser';
+import { toGitFormModel } from '@/react/portainer/gitops/types';
+import { ResourceControlViewModel } from '@/react/portainer/access-control/models/ResourceControlViewModel';
+
+import { CustomTemplate, getTemplateSourceId } from '../types';
+
+import { FormValues } from './types';
+
+export function useInitialValues({
+  template,
+  templateFile,
+  isEdge,
+}: {
+  template: CustomTemplate;
+  templateFile: string | undefined;
+  isEdge: boolean;
+}): FormValues | undefined {
+  const { user } = useCurrentUser();
+
+  const isAdminQuery = useIsEdgeAdmin();
+
+  if (isAdminQuery.isLoading) {
+    return undefined;
+  }
+
+  return {
+    Title: template.Title,
+    FileContent: templateFile || '',
+    Type: template.Type,
+    Platform: template.Platform,
+    Description: template.Description,
+    Note: template.Note,
+    Logo: template.Logo,
+    Variables: template.Variables,
+    Git: template.GitConfig
+      ? toGitFormModel(getTemplateSourceId(template), template.GitConfig)
+      : undefined,
+    AccessControl:
+      !isEdge && template.ResourceControl
+        ? parseAccessControlFormData(
+            isAdminQuery.isAdmin,
+            user.Id,
+            new ResourceControlViewModel(template.ResourceControl)
+          )
+        : undefined,
+    EdgeSettings: template.EdgeSettings,
+  };
+}
diff --git a/app/react/portainer/templates/custom-templates/EditView/useValidation.tsx b/app/react/portainer/templates/custom-templates/EditView/useValidation.tsx
new file mode 100644
index 0000000..4f9f797
--- /dev/null
+++ b/app/react/portainer/templates/custom-templates/EditView/useValidation.tsx
@@ -0,0 +1,59 @@
+import { mixed, number, object, string } from 'yup';
+import { useMemo } from 'react';
+
+import { StackType } from '@/react/common/stacks/types';
+import { validation as commonFieldsValidation } from '@/react/portainer/custom-templates/components/CommonFields';
+import { Platform } from '@/react/portainer/templates/types';
+import { variablesValidation } from '@/react/portainer/custom-templates/components/CustomTemplatesVariablesDefinitionField';
+import { buildGitValidationSchema } from '@/react/portainer/gitops/GitForm';
+import { useCustomTemplates } from '@/react/portainer/templates/custom-templates/queries/useCustomTemplates';
+import { edgeFieldsetValidation } from '@/react/portainer/templates/custom-templates/CreateView/EdgeSettingsFieldset.validation';
+import { DeployMethod } from '@/react/portainer/gitops/types';
+
+import { CustomTemplate } from '../types';
+import { TemplateViewType } from '../useViewType';
+
+export function useValidation({
+  isGit,
+  templateId,
+  viewType,
+  deployMethod,
+}: {
+  isGit: boolean;
+  templateId: CustomTemplate['Id'];
+  viewType: TemplateViewType;
+  deployMethod: DeployMethod;
+}) {
+  const customTemplatesQuery = useCustomTemplates({
+    params: {
+      edge: undefined,
+    },
+  });
+
+  return useMemo(
+    () =>
+      object({
+        Platform: number()
+          .oneOf([Platform.LINUX, Platform.WINDOWS])
+          .default(Platform.LINUX),
+        Type: number()
+          .oneOf([
+            StackType.DockerCompose,
+            StackType.DockerSwarm,
+            StackType.Kubernetes,
+          ])
+          .default(StackType.DockerCompose),
+        FileContent: string().required('Template is required.'),
+
+        Git: isGit ? buildGitValidationSchema(deployMethod) : mixed(),
+        Variables: variablesValidation(),
+        EdgeSettings: viewType === 'edge' ? edgeFieldsetValidation() : mixed(),
+      }).concat(
+        commonFieldsValidation({
+          templates: customTemplatesQuery.data,
+          currentTemplateId: templateId,
+        })
+      ),
+    [customTemplatesQuery.data, isGit, templateId, viewType, deployMethod]
+  );
+}
diff --git a/app/react/portainer/templates/custom-templates/ListView/CustomTemplatesList.tsx b/app/react/portainer/templates/custom-templates/ListView/CustomTemplatesList.tsx
new file mode 100644
index 0000000..18b1bda
--- /dev/null
+++ b/app/react/portainer/templates/custom-templates/ListView/CustomTemplatesList.tsx
@@ -0,0 +1,93 @@
+import { Edit } from 'lucide-react';
+import _ from 'lodash';
+import { useCallback, useState } from 'react';
+
+import { CustomTemplate } from '@/react/portainer/templates/custom-templates/types';
+
+import { DatatableHeader } from '@@/datatables/DatatableHeader';
+import { Table } from '@@/datatables';
+import { useTableState } from '@@/datatables/useTableState';
+import { createPersistedStore } from '@@/datatables/types';
+import { DatatableFooter } from '@@/datatables/DatatableFooter';
+import { AddButton } from '@@/buttons';
+
+import { CustomTemplatesListItem } from './CustomTemplatesListItem';
+
+export function CustomTemplatesList({
+  templates,
+  onDelete,
+  selectedId,
+  templateLinkParams,
+  storageKey,
+}: {
+  templates?: CustomTemplate[];
+  onDelete: (templateId: CustomTemplate['Id']) => void;
+  selectedId?: CustomTemplate['Id'];
+  templateLinkParams?: (template: CustomTemplate) =>
+    | {
+        to: string;
+        params: object;
+      }
+    | undefined;
+  storageKey: string;
+}) {
+  const [page, setPage] = useState(0);
+  const [store] = useState(() => createPersistedStore(storageKey));
+  const listState = useTableState(store, storageKey);
+
+  const filterBySearch = useCallback(
+    (item: CustomTemplate) =>
+      item.Title.includes(listState.search) ||
+      item.Description.includes(listState.search) ||
+      item.Note?.includes(listState.search),
+    [listState.search]
+  );
+
+  const filteredTemplates = templates?.filter(filterBySearch) || [];
+
+  const pagedTemplates =
+    _.chunk(filteredTemplates, listState.pageSize)[page] || [];
+
+  return (
+    <Table.Container>
+      <DatatableHeader
+        onSearchChange={listState.setSearch}
+        searchValue={listState.search}
+        title="Custom Templates"
+        titleIcon={Edit}
+        renderTableActions={() => (
+          <AddButton data-cy="add-custom-template-button">
+            Add Custom Template
+          </AddButton>
+        )}
+        data-cy="custom-templates-datatable-header"
+      />
+
+      <div className="blocklist gap-y-2 !px-[20px] !pb-[20px]" role="list">
+        {pagedTemplates.map((template) => (
+          <CustomTemplatesListItem
+            key={template.Id}
+            template={template}
+            isSelected={template.Id === selectedId}
+            onDelete={onDelete}
+            linkParams={templateLinkParams?.(template)}
+          />
+        ))}
+        {!templates && <div className="text-muted text-center">Loading...</div>}
+        {filteredTemplates.length === 0 && (
+          <div className="text-muted text-center">No templates available.</div>
+        )}
+      </div>
+
+      <DatatableFooter
+        onPageChange={setPage}
+        page={page}
+        onPageSizeChange={listState.setPageSize}
+        pageSize={listState.pageSize}
+        pageCount={Math.ceil(filteredTemplates.length / listState.pageSize)}
+        totalSelected={0}
+        totalHiddenSelected={0}
+      />
+    </Table.Container>
+  );
+}
diff --git a/app/react/portainer/templates/custom-templates/ListView/CustomTemplatesListItem.tsx b/app/react/portainer/templates/custom-templates/ListView/CustomTemplatesListItem.tsx
new file mode 100644
index 0000000..95c6c9a
--- /dev/null
+++ b/app/react/portainer/templates/custom-templates/ListView/CustomTemplatesListItem.tsx
@@ -0,0 +1,92 @@
+import { Edit, Trash2 } from 'lucide-react';
+
+import { useCurrentUser, useIsEdgeAdmin } from '@/react/hooks/useUser';
+import { StackType } from '@/react/common/stacks/types';
+import { CustomTemplate } from '@/react/portainer/templates/custom-templates/types';
+
+import { Button } from '@@/buttons';
+import { Link } from '@@/Link';
+
+import { TemplateItem } from '../../components/TemplateItem';
+
+export function CustomTemplatesListItem({
+  template,
+  onSelect,
+  onDelete,
+  isSelected,
+  linkParams,
+}: {
+  template: CustomTemplate;
+  onSelect?: (templateId: CustomTemplate['Id']) => void;
+  onDelete: (templateId: CustomTemplate['Id']) => void;
+  isSelected: boolean;
+  linkParams?: { to: string; params: object };
+}) {
+  const { user } = useCurrentUser();
+  const isAdminQuery = useIsEdgeAdmin();
+
+  if (isAdminQuery.isLoading) {
+    return null;
+  }
+
+  const isEditAllowed =
+    isAdminQuery.isAdmin || template.CreatedByUserId === user.Id;
+
+  return (
+    <TemplateItem
+      template={template}
+      typeLabel={getTypeLabel(template.Type)}
+      onSelect={() => onSelect?.(template.Id)}
+      isSelected={isSelected}
+      linkParams={linkParams}
+      renderActions={
+        <div className="mr-4 mt-3">
+          {isEditAllowed && (
+            <div className="vertical-center">
+              <Button
+                as={Link}
+                onClick={(e) => {
+                  e.stopPropagation();
+                }}
+                color="secondary"
+                props={{
+                  to: '.edit',
+                  params: {
+                    id: template.Id,
+                  },
+                }}
+                icon={Edit}
+                data-cy={`custom-templates-edit-button-${template.Id}`}
+              >
+                Edit
+              </Button>
+              <Button
+                data-cy="custom-templates-delete-"
+                onClick={(e) => {
+                  onDelete(template.Id);
+                  e.stopPropagation();
+                }}
+                color="dangerlight"
+                icon={Trash2}
+              >
+                Delete
+              </Button>
+            </div>
+          )}
+        </div>
+      }
+    />
+  );
+}
+
+function getTypeLabel(type: StackType) {
+  switch (type) {
+    case StackType.DockerSwarm:
+      return 'swarm';
+    case StackType.Kubernetes:
+      return 'manifest';
+    case StackType.DockerCompose:
+    default:
+      return 'standalone';
+  }
+}
diff --git a/app/react/portainer/templates/custom-templates/ListView/ListView.tsx b/app/react/portainer/templates/custom-templates/ListView/ListView.tsx
new file mode 100644
index 0000000..9530a7c
--- /dev/null
+++ b/app/react/portainer/templates/custom-templates/ListView/ListView.tsx
@@ -0,0 +1,59 @@
+import { notifySuccess } from '@/portainer/services/notifications';
+import { useParamState } from '@/react/hooks/useParamState';
+import { ContainerEngine } from '@/react/portainer/environments/types';
+
+import { PageHeader } from '@@/PageHeader';
+import { confirmDelete } from '@@/modals/confirm';
+
+import { useCustomTemplates } from '../queries/useCustomTemplates';
+import { useDeleteTemplateMutation } from '../queries/useDeleteTemplateMutation';
+import { CustomTemplate } from '../types';
+
+import { StackFromCustomTemplateFormWidget } from './StackFromCustomTemplateFormWidget';
+import { CustomTemplatesList } from './CustomTemplatesList';
+import { useViewParams } from './useViewParams';
+
+export function ListView() {
+  const { params, getTemplateLinkParams, storageKey, viewType } =
+    useViewParams();
+
+  const templatesQuery = useCustomTemplates({
+    params,
+  });
+  const deleteMutation = useDeleteTemplateMutation();
+  const [selectedTemplateId] = useParamState<number>('template', (param) =>
+    param ? parseInt(param, 10) : 0
+  );
+
+  return (
+    <>
+      <PageHeader title="Custom Templates" breadcrumbs="Custom Templates" />
+
+      {viewType === ContainerEngine.Docker && !!selectedTemplateId && (
+        <StackFromCustomTemplateFormWidget templateId={selectedTemplateId} />
+      )}
+
+      <CustomTemplatesList
+        templates={templatesQuery.data}
+        onDelete={handleDelete}
+        templateLinkParams={getTemplateLinkParams}
+        storageKey={storageKey}
+        selectedId={selectedTemplateId}
+      />
+    </>
+  );
+
+  async function handleDelete(templateId: CustomTemplate['Id']) {
+    if (
+      !(await confirmDelete('Are you sure you want to delete this template?'))
+    ) {
+      return;
+    }
+
+    deleteMutation.mutate(templateId, {
+      onSuccess: () => {
+        notifySuccess('Success', 'Template deleted');
+      },
+    });
+  }
+}
diff --git a/app/react/portainer/templates/custom-templates/ListView/StackFromCustomTemplateFormWidget/DeployForm.tsx b/app/react/portainer/templates/custom-templates/ListView/StackFromCustomTemplateFormWidget/DeployForm.tsx
new file mode 100644
index 0000000..d46bb30
--- /dev/null
+++ b/app/react/portainer/templates/custom-templates/ListView/StackFromCustomTemplateFormWidget/DeployForm.tsx
@@ -0,0 +1,255 @@
+import { useRouter } from '@uirouter/react';
+import { Formik, Form } from 'formik';
+
+import { notifySuccess } from '@/portainer/services/notifications';
+import {
+  CreateStackPayload,
+  useCreateStack,
+} from '@/react/common/stacks/queries/useCreateStack/useCreateStack';
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { useCurrentUser, useIsEdgeAdmin } from '@/react/hooks/useUser';
+import { AccessControlForm } from '@/react/portainer/access-control';
+import { parseAccessControlFormData } from '@/react/portainer/access-control/utils';
+import { NameField } from '@/react/docker/stacks/common/NameField';
+import {
+  CustomTemplate,
+  getTemplateSourceId,
+} from '@/react/portainer/templates/custom-templates/types';
+import {
+  isTemplateVariablesEnabled,
+  renderTemplate,
+} from '@/react/portainer/custom-templates/components/utils';
+import {
+  CustomTemplatesVariablesField,
+  getVariablesFieldDefaultValues,
+} from '@/react/portainer/custom-templates/components/CustomTemplatesVariablesField';
+import { StackType } from '@/react/common/stacks/types';
+import { toGitFormModel } from '@/react/portainer/gitops/types';
+import { AdvancedSettings } from '@/react/portainer/templates/app-templates/DeployFormWidget/AdvancedSettings';
+import { useSwarmId } from '@/react/docker/proxy/queries/useSwarm';
+
+import { Button } from '@@/buttons';
+import { FormActions } from '@@/form-components/FormActions';
+import { FormSection } from '@@/form-components/FormSection';
+import { WebEditorForm } from '@@/WebEditorForm';
+import { Link } from '@@/Link';
+
+import { FormValues } from './types';
+import { useValidation } from './useValidation';
+
+export function DeployForm({
+  template,
+  templateFile,
+  isDeployable,
+}: {
+  template: CustomTemplate;
+  templateFile: string;
+  isDeployable: boolean;
+}) {
+  const router = useRouter();
+  const { user } = useCurrentUser();
+  const isEdgeAdminQuery = useIsEdgeAdmin();
+  const environmentId = useEnvironmentId();
+  const swarmIdQuery = useSwarmId(environmentId);
+  const mutation = useCreateStack();
+  const validation = useValidation({
+    isDeployable,
+    variableDefs: template.Variables,
+    isAdmin: isEdgeAdminQuery.isAdmin,
+    environmentId,
+  });
+
+  if (isEdgeAdminQuery.isLoading) {
+    return null;
+  }
+
+  const isGit = !!template.GitConfig;
+
+  const initialValues: FormValues = {
+    name: '',
+    variables: getVariablesFieldDefaultValues(template.Variables),
+    accessControl: parseAccessControlFormData(
+      isEdgeAdminQuery.isAdmin,
+      user.Id
+    ),
+    fileContent: templateFile,
+  };
+
+  return (
+    <Formik
+      initialValues={initialValues}
+      onSubmit={handleSubmit}
+      validationSchema={validation}
+      validateOnMount
+    >
+      {({ values, errors, setFieldValue, isValid }) => (
+        <Form className="form-horizontal">
+          <FormSection title="Configuration">
+            <NameField
+              value={values.name}
+              onChange={(v) => setFieldValue('name', v)}
+              errors={errors.name}
+              placeholder="e.g. mystack"
+            />
+          </FormSection>
+
+          {isTemplateVariablesEnabled && (
+            <CustomTemplatesVariablesField
+              definitions={template.Variables}
+              onChange={(v) => {
+                setFieldValue('variables', v);
+                const newFile = renderTemplate(
+                  templateFile,
+                  v,
+                  template.Variables
+                );
+                setFieldValue('fileContent', newFile);
+              }}
+              value={values.variables}
+              errors={errors.variables}
+            />
+          )}
+
+          <AdvancedSettings
+            label={(isOpen) => advancedSettingsLabel(isOpen, isGit)}
+          >
+            <WebEditorForm
+              id="custom-template-creation-editor"
+              value={values.fileContent}
+              onChange={(value) => {
+                if (isGit) {
+                  return;
+                }
+                setFieldValue('fileContent', value);
+              }}
+              type="yaml"
+              error={errors.fileContent}
+              textTip="Define or paste the content of your docker compose file here"
+              readonly={isGit}
+              data-cy="custom-template-creation-editor"
+            >
+              <p>
+                You can get more information about Compose file format in the{' '}
+                <a
+                  href="https://docs.docker.com/compose/compose-file/"
+                  target="_blank"
+                  rel="noreferrer"
+                >
+                  official documentation
+                </a>
+                .
+              </p>
+            </WebEditorForm>
+          </AdvancedSettings>
+
+          <AccessControlForm
+            formNamespace="accessControl"
+            onChange={(values) => setFieldValue('accessControl', values)}
+            values={values.accessControl}
+            errors={errors.accessControl}
+            environmentId={environmentId}
+          />
+
+          <FormActions
+            isLoading={mutation.isLoading}
+            isValid={isValid}
+            loadingText="Deployment in progress..."
+            submitLabel="Deploy the stack"
+            data-cy="deploy-stack-button"
+          >
+            <Button
+              type="reset"
+              as={Link}
+              props={{
+                to: '.',
+                params: { template: null },
+              }}
+              color="default"
+              data-cy="cancel-stack-creation"
+            >
+              Hide
+            </Button>
+          </FormActions>
+        </Form>
+      )}
+    </Formik>
+  );
+
+  function handleSubmit(values: FormValues) {
+    const payload = getPayload(values);
+
+    return mutation.mutate(payload, {
+      onSuccess() {
+        notifySuccess('Success', 'Stack created');
+        router.stateService.go('docker.stacks');
+      },
+    });
+  }
+
+  function getPayload(values: FormValues): CreateStackPayload {
+    const type =
+      template.Type === StackType.DockerCompose ? 'standalone' : 'swarm';
+    const isGit = !!template.GitConfig;
+    if (isGit) {
+      return type === 'standalone'
+        ? {
+            type,
+            method: 'git',
+            payload: {
+              name: values.name,
+              environmentId,
+              git: toGitFormModel(
+                getTemplateSourceId(template),
+                template.GitConfig
+              ),
+              accessControl: values.accessControl,
+            },
+          }
+        : {
+            type,
+            method: 'git',
+            payload: {
+              name: values.name,
+              environmentId,
+              swarmId: swarmIdQuery.data || '',
+              git: toGitFormModel(
+                getTemplateSourceId(template),
+                template.GitConfig
+              ),
+              accessControl: values.accessControl,
+            },
+          };
+    }
+
+    return type === 'standalone'
+      ? {
+          type,
+          method: 'string',
+          payload: {
+            name: values.name,
+            environmentId,
+            fileContent: values.fileContent,
+            accessControl: values.accessControl,
+          },
+        }
+      : {
+          type,
+          method: 'string',
+          payload: {
+            name: values.name,
+            environmentId,
+            swarmId: swarmIdQuery.data || '',
+            fileContent: values.fileContent,
+            accessControl: values.accessControl,
+          },
+        };
+  }
+}
+
+function advancedSettingsLabel(isOpen: boolean, isGit: boolean) {
+  if (isGit) {
+    return isOpen ? 'Hide stack' : 'View stack';
+  }
+
+  return isOpen ? 'Hide custom stack' : 'Customize stack';
+}
diff --git a/app/react/portainer/templates/custom-templates/ListView/StackFromCustomTemplateFormWidget/StackFromCustomTemplateFormWidget.tsx b/app/react/portainer/templates/custom-templates/ListView/StackFromCustomTemplateFormWidget/StackFromCustomTemplateFormWidget.tsx
new file mode 100644
index 0000000..b4f77d7
--- /dev/null
+++ b/app/react/portainer/templates/custom-templates/ListView/StackFromCustomTemplateFormWidget/StackFromCustomTemplateFormWidget.tsx
@@ -0,0 +1,60 @@
+import { DeployWidget } from '@/react/portainer/templates/components/DeployWidget';
+import { CustomTemplate } from '@/react/portainer/templates/custom-templates/types';
+import { useCustomTemplateFile } from '@/react/portainer/templates/custom-templates/queries/useCustomTemplateFile';
+import { useCustomTemplate } from '@/react/portainer/templates/custom-templates/queries/useCustomTemplate';
+
+import { TextTip } from '@@/Tip/TextTip';
+
+import { useIsDeployable } from './useIsDeployable';
+import { DeployForm } from './DeployForm';
+import { TemplateLoadError } from './TemplateLoadError';
+
+export function StackFromCustomTemplateFormWidget({
+  templateId,
+}: {
+  templateId: CustomTemplate['Id'];
+}) {
+  const templateQuery = useCustomTemplate(templateId);
+
+  const isDeployable = useIsDeployable(templateQuery.data?.Type);
+  const fileQuery = useCustomTemplateFile(templateId);
+
+  if (fileQuery.isLoading || !templateQuery.data) {
+    return null;
+  }
+
+  const template = templateQuery.data;
+
+  return (
+    <DeployWidget
+      logo={template.Logo}
+      note={template.Note}
+      title={template.Title}
+    >
+      {fileQuery.isError && (
+        <TemplateLoadError
+          creatorId={template.CreatedByUserId}
+          templateId={template.Id}
+        />
+      )}
+
+      {!isDeployable && (
+        <div className="form-group">
+          <div className="col-sm-12">
+            <TextTip>
+              This template type cannot be deployed on this environment.
+            </TextTip>
+          </div>
+        </div>
+      )}
+
+      {fileQuery.isSuccess && isDeployable && (
+        <DeployForm
+          template={template}
+          templateFile={fileQuery.data}
+          isDeployable={isDeployable}
+        />
+      )}
+    </DeployWidget>
+  );
+}
diff --git a/app/react/portainer/templates/custom-templates/ListView/StackFromCustomTemplateFormWidget/TemplateLoadError.tsx b/app/react/portainer/templates/custom-templates/ListView/StackFromCustomTemplateFormWidget/TemplateLoadError.tsx
new file mode 100644
index 0000000..97d20fc
--- /dev/null
+++ b/app/react/portainer/templates/custom-templates/ListView/StackFromCustomTemplateFormWidget/TemplateLoadError.tsx
@@ -0,0 +1,46 @@
+import { UserId } from '@/portainer/users/types';
+import { useCurrentUser, useIsEdgeAdmin } from '@/react/hooks/useUser';
+import { CustomTemplate } from '@/react/portainer/templates/custom-templates/types';
+
+import { Link } from '@@/Link';
+import { FormError } from '@@/form-components/FormError';
+
+export function TemplateLoadError({
+  templateId,
+  creatorId,
+}: {
+  templateId: CustomTemplate['Id'];
+  creatorId: UserId;
+}) {
+  const { user } = useCurrentUser();
+  const isEdgeAdminQuery = useIsEdgeAdmin();
+
+  if (isEdgeAdminQuery.isLoading) {
+    return null;
+  }
+
+  const isAdminOrWriter = isEdgeAdminQuery.isAdmin || user.Id === creatorId;
+
+  return (
+    <FormError>
+      {isAdminOrWriter ? (
+        <>
+          Custom template could not be loaded, please{' '}
+          <Link
+            to=".edit"
+            params={{ id: templateId }}
+            data-cy="edit-custom-template-link"
+          >
+            click here
+          </Link>{' '}
+          for configuration
+        </>
+      ) : (
+        <>
+          Custom template could not be loaded, please contact your
+          administrator.
+        </>
+      )}
+    </FormError>
+  );
+}
diff --git a/app/react/portainer/templates/custom-templates/ListView/StackFromCustomTemplateFormWidget/index.ts b/app/react/portainer/templates/custom-templates/ListView/StackFromCustomTemplateFormWidget/index.ts
new file mode 100644
index 0000000..cc5eac7
--- /dev/null
+++ b/app/react/portainer/templates/custom-templates/ListView/StackFromCustomTemplateFormWidget/index.ts
@@ -0,0 +1 @@
+export { StackFromCustomTemplateFormWidget } from './StackFromCustomTemplateFormWidget';
diff --git a/app/react/portainer/templates/custom-templates/ListView/StackFromCustomTemplateFormWidget/types.ts b/app/react/portainer/templates/custom-templates/ListView/StackFromCustomTemplateFormWidget/types.ts
new file mode 100644
index 0000000..27ec78a
--- /dev/null
+++ b/app/react/portainer/templates/custom-templates/ListView/StackFromCustomTemplateFormWidget/types.ts
@@ -0,0 +1,9 @@
+import { AccessControlFormData } from '@/react/portainer/access-control/types';
+import { VariablesFieldValue } from '@/react/portainer/custom-templates/components/CustomTemplatesVariablesField';
+
+export interface FormValues {
+  name: string;
+  variables: VariablesFieldValue;
+  accessControl: AccessControlFormData;
+  fileContent: string;
+}
diff --git a/app/react/portainer/templates/custom-templates/ListView/StackFromCustomTemplateFormWidget/useIsDeployable.ts b/app/react/portainer/templates/custom-templates/ListView/StackFromCustomTemplateFormWidget/useIsDeployable.ts
new file mode 100644
index 0000000..c8370b0
--- /dev/null
+++ b/app/react/portainer/templates/custom-templates/ListView/StackFromCustomTemplateFormWidget/useIsDeployable.ts
@@ -0,0 +1,19 @@
+import { useEnvironmentId } from '@/react/hooks/useEnvironmentId';
+import { StackType } from '@/react/common/stacks/types';
+import { useIsSwarm } from '@/react/docker/proxy/queries/useInfo';
+
+export function useIsDeployable(type: StackType | undefined) {
+  const environmentId = useEnvironmentId();
+
+  const isSwarm = useIsSwarm(environmentId);
+
+  switch (type) {
+    case StackType.DockerCompose:
+      return !isSwarm;
+    case StackType.DockerSwarm:
+      return isSwarm;
+    case StackType.Kubernetes:
+    default:
+      return false;
+  }
+}
diff --git a/app/react/portainer/templates/custom-templates/ListView/StackFromCustomTemplateFormWidget/useValidation.ts b/app/react/portainer/templates/custom-templates/ListView/StackFromCustomTemplateFormWidget/useValidation.ts
new file mode 100644
index 0000000..6cc233f
--- /dev/null
+++ b/app/react/portainer/templates/custom-templates/ListView/StackFromCustomTemplateFormWidget/useValidation.ts
@@ -0,0 +1,37 @@
+import { useMemo } from 'react';
+import { object, string } from 'yup';
+
+import { accessControlFormValidation } from '@/react/portainer/access-control/AccessControlForm';
+import { useNameValidation } from '@/react/docker/stacks/common/NameField';
+import { variablesFieldValidation } from '@/react/portainer/custom-templates/components/CustomTemplatesVariablesField';
+import { VariableDefinition } from '@/react/portainer/custom-templates/components/CustomTemplatesVariablesDefinitionField';
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+export function useValidation({
+  environmentId,
+  isAdmin,
+  variableDefs,
+  isDeployable,
+}: {
+  variableDefs: Array<VariableDefinition>;
+  isAdmin: boolean;
+  environmentId: EnvironmentId;
+  isDeployable: boolean;
+}) {
+  const name = useNameValidation(environmentId);
+
+  return useMemo(
+    () =>
+      object({
+        name: name.test({
+          name: 'is-deployable',
+          message: 'This template cannot be deployed on this environment',
+          test: () => isDeployable,
+        }),
+        accessControl: accessControlFormValidation(isAdmin),
+        fileContent: string().required('Required'),
+        variables: variablesFieldValidation(variableDefs),
+      }),
+    [isAdmin, isDeployable, name, variableDefs]
+  );
+}
diff --git a/app/react/portainer/templates/custom-templates/ListView/useViewParams.tsx b/app/react/portainer/templates/custom-templates/ListView/useViewParams.tsx
new file mode 100644
index 0000000..c1de181
--- /dev/null
+++ b/app/react/portainer/templates/custom-templates/ListView/useViewParams.tsx
@@ -0,0 +1,73 @@
+import { StackType } from '@/react/common/stacks/types';
+import { useAuthorizations } from '@/react/hooks/useUser';
+
+import { CustomTemplatesListParams } from '../queries/useCustomTemplates';
+import { CustomTemplate } from '../types';
+import { TemplateViewType, useViewType } from '../useViewType';
+
+export function useViewParams(): {
+  viewType: TemplateViewType;
+  params: CustomTemplatesListParams;
+  getTemplateLinkParams?: (template: CustomTemplate) => {
+    to: string;
+    params: object;
+  };
+  storageKey: string;
+} {
+  const viewType = useViewType();
+
+  const isAllowedDeploymentKubeQuery = useAuthorizations(
+    'K8sApplicationsAdvancedDeploymentRW'
+  );
+  const isAllowedDeploymentDockerQuery = useAuthorizations([
+    'DockerContainerCreate',
+    'PortainerStackCreate',
+  ]);
+
+  switch (viewType) {
+    case 'kube':
+      return {
+        viewType,
+        params: { edge: false, type: [StackType.Kubernetes] },
+        getTemplateLinkParams: isAllowedDeploymentKubeQuery.authorized
+          ? (template: CustomTemplate) => ({
+              to: 'kubernetes.deploy',
+              params: { templateId: template.Id, templateType: 'custom' },
+            })
+          : undefined,
+        storageKey: 'kube-custom-templates',
+      };
+    case 'edge':
+      return {
+        viewType,
+        params: { edge: true },
+        getTemplateLinkParams: (template: CustomTemplate) => ({
+          to: 'edge.stacks.new',
+          params: { templateId: template.Id, templateType: 'custom' },
+        }),
+        storageKey: 'edge-custom-templates',
+      };
+    case 'docker':
+      return {
+        viewType,
+        params: {
+          edge: false,
+          type: [StackType.DockerCompose, StackType.DockerSwarm],
+        },
+        getTemplateLinkParams: isAllowedDeploymentDockerQuery.authorized
+          ? (template: CustomTemplate) => ({
+              to: '.',
+              params: { template: template.Id },
+            })
+          : undefined,
+        storageKey: 'docker-custom-templates',
+      };
+    default:
+      return {
+        viewType,
+        params: {},
+        getTemplateLinkParams: undefined,
+        storageKey: 'custom-templates',
+      };
+  }
+}
diff --git a/app/react/portainer/templates/custom-templates/queries/build-url.ts b/app/react/portainer/templates/custom-templates/queries/build-url.ts
new file mode 100644
index 0000000..68b0c7a
--- /dev/null
+++ b/app/react/portainer/templates/custom-templates/queries/build-url.ts
@@ -0,0 +1,21 @@
+import { CustomTemplate } from '../types';
+
+export function buildUrl({
+  id,
+  action,
+}: {
+  id?: CustomTemplate['Id'];
+  action?: string;
+} = {}) {
+  let base = '/custom_templates';
+
+  if (id) {
+    base = `${base}/${id}`;
+  }
+
+  if (action) {
+    base = `${base}/${action}`;
+  }
+
+  return base;
+}
diff --git a/app/react/portainer/templates/custom-templates/queries/query-keys.ts b/app/react/portainer/templates/custom-templates/queries/query-keys.ts
new file mode 100644
index 0000000..20f515e
--- /dev/null
+++ b/app/react/portainer/templates/custom-templates/queries/query-keys.ts
@@ -0,0 +1,9 @@
+import { CustomTemplate } from '../types';
+
+export const queryKeys = {
+  base: () => ['custom-templates'] as const,
+  list: (params: unknown) => [...queryKeys.base(), { params }] as const,
+  item: (id: CustomTemplate['Id']) => [...queryKeys.base(), id] as const,
+  file: (id: CustomTemplate['Id'], options: { git: boolean }) =>
+    [...queryKeys.item(id), 'file', options] as const,
+};
diff --git a/app/react/portainer/templates/custom-templates/queries/useCreateTemplateMutation.ts b/app/react/portainer/templates/custom-templates/queries/useCreateTemplateMutation.ts
new file mode 100644
index 0000000..31d6c3e
--- /dev/null
+++ b/app/react/portainer/templates/custom-templates/queries/useCreateTemplateMutation.ts
@@ -0,0 +1,230 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import {
+  mutationOptions,
+  withError,
+  withInvalidate,
+} from '@/react-tools/react-query';
+import { StackType } from '@/react/common/stacks/types';
+import { VariableDefinition } from '@/react/portainer/custom-templates/components/CustomTemplatesVariablesDefinitionField/CustomTemplatesVariablesDefinitionField';
+import {
+  CustomTemplate,
+  EdgeTemplateSettings,
+} from '@/react/portainer/templates/custom-templates/types';
+import { GitFormModel } from '@/react/portainer/gitops/types';
+import { DefinitionFieldValues } from '@/react/portainer/custom-templates/components/CustomTemplatesVariablesDefinitionField';
+import { AccessControlFormData } from '@/react/portainer/access-control/types';
+import { applyResourceControl } from '@/react/portainer/access-control/access-control.service';
+import { json2formData } from '@/portainer/helpers/json';
+
+import { Platform } from '../../types';
+
+import { buildUrl } from './build-url';
+import { queryKeys } from './query-keys';
+
+interface CreateTemplatePayload {
+  EdgeTemplate?: boolean;
+  Platform: Platform;
+  Type: StackType;
+  Method: 'editor' | 'upload' | 'repository';
+  FileContent: string;
+  File: File | undefined;
+  Git: GitFormModel;
+  Variables: DefinitionFieldValues;
+  EdgeSettings?: EdgeTemplateSettings;
+  Title: string;
+  Description: string;
+  Note: string;
+  Logo: string;
+}
+
+export function useCreateTemplateMutation() {
+  const queryClient = useQueryClient();
+
+  return useMutation(
+    async (
+      payload: CreateTemplatePayload & { AccessControl?: AccessControlFormData }
+    ) => {
+      const template = await createTemplate(payload);
+      const resourceControl = template.ResourceControl;
+
+      if (resourceControl && payload.AccessControl) {
+        await applyResourceControl(payload.AccessControl, resourceControl.Id);
+      }
+
+      return template;
+    },
+    mutationOptions(
+      withInvalidate(queryClient, [queryKeys.base()]),
+      withError('Failed to create template')
+    )
+  );
+}
+
+function createTemplate(payload: CreateTemplatePayload) {
+  switch (payload.Method) {
+    case 'editor':
+      return createTemplateFromText(payload);
+    case 'upload':
+      return createTemplateFromFile(payload);
+    case 'repository':
+      return createTemplateFromGitPayload(payload);
+    default:
+      throw new Error('Unknown method');
+  }
+}
+
+function createTemplateFromGitPayload({
+  Git: gitModel,
+  ...values
+}: CreateTemplatePayload) {
+  return createTemplateFromGit({
+    ...values,
+    ...gitModel,
+    ...(values.EdgeSettings
+      ? {
+          EdgeSettings: {
+            ...values.EdgeSettings,
+            ...values.EdgeSettings.RelativePathSettings,
+          },
+        }
+      : {}),
+  });
+}
+
+/**
+ * Payload for creating a custom template from file content.
+ */
+interface CustomTemplateFromFileContentPayload {
+  /** URL of the template's logo. */
+  Logo: string;
+  /** Title of the template. Required. */
+  Title: string;
+  /** Description of the template. Required. */
+  Description: string;
+  /** A note that will be displayed in the UI. Supports HTML content. */
+  Note: string;
+  /** Platform associated with the template. */
+  Platform: Platform;
+  /** Type of created stack. Required. */
+  Type: StackType;
+  /** Content of the stack file. Required. */
+  FileContent: string;
+  /** Definitions of variables in the stack file. */
+  Variables: VariableDefinition[];
+  /** Indicates if this template is for Edge Stack. */
+  EdgeTemplate?: boolean;
+  EdgeSettings?: EdgeTemplateSettings;
+}
+async function createTemplateFromText(
+  values: CustomTemplateFromFileContentPayload
+) {
+  try {
+    const { data } = await axios.post<CustomTemplate>(
+      buildUrl({ action: 'create/string' }),
+      values
+    );
+    return data;
+  } catch (error) {
+    throw parseAxiosError(error);
+  }
+}
+
+interface CustomTemplateFromFilePayload {
+  /** Title of the template */
+  Title: string;
+  /** Description of the template */
+  Description: string;
+  /** A note that will be displayed in the UI */
+  Note: string;
+  /** Platform associated with the template */
+  Platform: Platform;
+  /** Type of created stack */
+  Type: StackType;
+  /** File to upload */
+  File?: File;
+  /** URL of the template's logo */
+  Logo?: string;
+  /** Definitions of variables in the stack file */
+  Variables?: VariableDefinition[];
+  /** Indicates if this template is for Edge Stack. */
+  EdgeTemplate?: boolean;
+  EdgeSettings?: EdgeTemplateSettings;
+}
+
+async function createTemplateFromFile(values: CustomTemplateFromFilePayload) {
+  try {
+    if (!values.File) {
+      throw new Error('No file provided');
+    }
+
+    const payload = json2formData({
+      Platform: values.Platform,
+      Type: values.Type,
+      Title: values.Title,
+      Description: values.Description,
+      Note: values.Note,
+      Logo: values.Logo,
+      File: values.File,
+      Variables: values.Variables,
+      EdgeTemplate: values.EdgeTemplate,
+      EdgeSettings: values.EdgeSettings,
+    });
+
+    const { data } = await axios.post<CustomTemplate>(
+      buildUrl({ action: 'create/file' }),
+      payload,
+      {
+        headers: { 'Content-Type': 'multipart/form-data' },
+      }
+    );
+    return data;
+  } catch (error) {
+    throw parseAxiosError(error);
+  }
+}
+
+/**
+ * Payload for creating a custom template from a Git repository.
+ */
+interface CustomTemplateFromGitRepositoryPayload {
+  /** URL of the template's logo. */
+  Logo: string;
+  /** Title of the template. Required. */
+  Title: string;
+  /** Description of the template. Required. */
+  Description: string;
+  /** A note that will be displayed in the UI. Supports HTML content. */
+  Note: string;
+  /** Platform associated with the template. */
+  Platform: Platform;
+  /** Type of created stack. Required. */
+  Type: StackType;
+  /** References an existing Source for git credentials/URL. */
+  SourceId?: number;
+  /** Reference name of a Git repository hosting the Stack file. */
+  RepositoryReferenceName?: string;
+  /** Path to the Stack file inside the Git repository. */
+  ComposeFilePathInRepository?: string;
+  /** Definitions of variables in the stack file. */
+  Variables: VariableDefinition[];
+  /** Indicates if the Kubernetes template is created from a Docker Compose file. */
+  IsComposeFormat?: boolean;
+  /** Indicates if this template is for Edge Stack. */
+  EdgeTemplate?: boolean;
+  EdgeSettings?: EdgeTemplateSettings;
+}
+async function createTemplateFromGit(
+  values: CustomTemplateFromGitRepositoryPayload
+) {
+  try {
+    const { data } = await axios.post<CustomTemplate>(
+      buildUrl({ action: 'create/repository' }),
+      values
+    );
+    return data;
+  } catch (error) {
+    throw parseAxiosError(error);
+  }
+}
diff --git a/app/react/portainer/templates/custom-templates/queries/useCustomTemplate.ts b/app/react/portainer/templates/custom-templates/queries/useCustomTemplate.ts
new file mode 100644
index 0000000..8f25f3c
--- /dev/null
+++ b/app/react/portainer/templates/custom-templates/queries/useCustomTemplate.ts
@@ -0,0 +1,28 @@
+import { useQuery } from '@tanstack/react-query';
+
+import { withError } from '@/react-tools/react-query';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { CustomTemplate } from '../types';
+
+import { queryKeys } from './query-keys';
+import { buildUrl } from './build-url';
+
+export async function getCustomTemplate(id: CustomTemplate['Id']) {
+  try {
+    const { data } = await axios.get<CustomTemplate>(buildUrl({ id }));
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to get custom template');
+  }
+}
+
+export function useCustomTemplate(
+  id?: CustomTemplate['Id'],
+  { enabled }: { enabled?: boolean } = {}
+) {
+  return useQuery(queryKeys.item(id!), () => getCustomTemplate(id!), {
+    ...withError('Unable to retrieve custom template'),
+    enabled: !!id && enabled,
+  });
+}
diff --git a/app/react/portainer/templates/custom-templates/queries/useCustomTemplateFile.ts b/app/react/portainer/templates/custom-templates/queries/useCustomTemplateFile.ts
new file mode 100644
index 0000000..4b3b227
--- /dev/null
+++ b/app/react/portainer/templates/custom-templates/queries/useCustomTemplateFile.ts
@@ -0,0 +1,74 @@
+import { useMutation, useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+
+import { CustomTemplate } from '../types';
+
+import { buildUrl } from './build-url';
+import { queryKeys } from './query-keys';
+
+type CustomTemplateFileContent = {
+  FileContent: string;
+};
+
+export function useCustomTemplateFile(
+  id?: CustomTemplate['Id'],
+  git = false,
+  { enabled }: { enabled?: boolean } = {}
+) {
+  return useQuery(
+    queryKeys.file(id!, { git }),
+    () => getCustomTemplateFile({ id: id!, git }),
+    {
+      ...withError('Failed to get custom template file'),
+      enabled: !!id && enabled,
+      // there's nothing to do with a new file content, so we're disabling refetch
+      refetchOnReconnect: false,
+      refetchOnWindowFocus: false,
+    }
+  );
+}
+
+export function useCustomTemplateFileMutation() {
+  return useMutation({
+    mutationFn: getCustomTemplateFile,
+    ...withError('Failed to get custom template file'),
+  });
+}
+
+export function getCustomTemplateFile({
+  git,
+  id,
+}: {
+  id: CustomTemplate['Id'];
+  git: boolean;
+}) {
+  return git ? getCustomTemplateGitFetch(id) : getCustomTemplateFileContent(id);
+}
+
+async function getCustomTemplateFileContent(id: number) {
+  try {
+    const {
+      data: { FileContent },
+    } = await axios.get<CustomTemplateFileContent>(
+      buildUrl({ id, action: 'file' })
+    );
+    return FileContent;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to get custom template file content');
+  }
+}
+
+async function getCustomTemplateGitFetch(id: number) {
+  try {
+    const {
+      data: { FileContent },
+    } = await axios.put<CustomTemplateFileContent>(
+      buildUrl({ id, action: 'git_fetch' })
+    );
+    return FileContent;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to get custom template file content');
+  }
+}
diff --git a/app/react/portainer/templates/custom-templates/queries/useCustomTemplates.ts b/app/react/portainer/templates/custom-templates/queries/useCustomTemplates.ts
new file mode 100644
index 0000000..9efacc1
--- /dev/null
+++ b/app/react/portainer/templates/custom-templates/queries/useCustomTemplates.ts
@@ -0,0 +1,51 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+import { StackType } from '@/react/common/stacks/types';
+
+import { CustomTemplate } from '../types';
+
+import { queryKeys } from './query-keys';
+import { buildUrl } from './build-url';
+
+type Params = {
+  type?: StackType[];
+  /**
+   * filter edge templates
+   * true if should show only edge templates
+   * false if should show only non-edge templates
+   * undefined if should show all templates
+   */
+  edge?: boolean;
+};
+
+export { type Params as CustomTemplatesListParams };
+
+export function useCustomTemplates<T = Array<CustomTemplate>>({
+  select,
+  params,
+}: { params?: Params; select?(templates: Array<CustomTemplate>): T } = {}) {
+  return useQuery(queryKeys.list(params), () => getCustomTemplates(params), {
+    select,
+    ...withError('Unable to retrieve custom templates'),
+  });
+}
+
+async function getCustomTemplates({ type, edge }: Params = {}) {
+  try {
+    const { data } = await axios.get<CustomTemplate[]>(buildUrl(), {
+      params: {
+        // deconstruct to make sure we don't pass other params
+        type,
+        edge,
+      },
+      paramsSerializer: {
+        indexes: null,
+      },
+    });
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to get custom templates');
+  }
+}
diff --git a/app/react/portainer/templates/custom-templates/queries/useDeleteTemplateMutation.ts b/app/react/portainer/templates/custom-templates/queries/useDeleteTemplateMutation.ts
new file mode 100644
index 0000000..25c2132
--- /dev/null
+++ b/app/react/portainer/templates/custom-templates/queries/useDeleteTemplateMutation.ts
@@ -0,0 +1,31 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import {
+  mutationOptions,
+  withError,
+  withInvalidate,
+} from '@/react-tools/react-query';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { CustomTemplate } from '../types';
+
+import { queryKeys } from './query-keys';
+import { buildUrl } from './build-url';
+
+export function useDeleteTemplateMutation() {
+  const queryClient = useQueryClient();
+  return useMutation(
+    deleteTemplate,
+    mutationOptions(
+      withInvalidate(queryClient, [queryKeys.base()]),
+      withError('Unable to delete custom template')
+    )
+  );
+}
+export async function deleteTemplate(id: CustomTemplate['Id']) {
+  try {
+    await axios.delete(buildUrl({ id }));
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to get custom template');
+  }
+}
diff --git a/app/react/portainer/templates/custom-templates/queries/useUpdateTemplateMutation.ts b/app/react/portainer/templates/custom-templates/queries/useUpdateTemplateMutation.ts
new file mode 100644
index 0000000..df90314
--- /dev/null
+++ b/app/react/portainer/templates/custom-templates/queries/useUpdateTemplateMutation.ts
@@ -0,0 +1,105 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import {
+  mutationOptions,
+  withError,
+  withInvalidate,
+} from '@/react-tools/react-query';
+import { StackType } from '@/react/common/stacks/types';
+import { VariableDefinition } from '@/react/portainer/custom-templates/components/CustomTemplatesVariablesDefinitionField/CustomTemplatesVariablesDefinitionField';
+import { AccessControlFormData } from '@/react/portainer/access-control/types';
+import { applyResourceControl } from '@/react/portainer/access-control/access-control.service';
+
+import { CustomTemplate, EdgeTemplateSettings } from '../types';
+import { Platform } from '../../types';
+
+import { buildUrl } from './build-url';
+
+export function useUpdateTemplateMutation() {
+  const queryClient = useQueryClient();
+
+  return useMutation(
+    async (
+      payload: CustomTemplateUpdatePayload & {
+        AccessControl?: AccessControlFormData;
+        resourceControlId?: number;
+      }
+    ) => {
+      await updateTemplate(payload);
+
+      if (payload.resourceControlId && payload.AccessControl) {
+        await applyResourceControl(
+          payload.AccessControl,
+          payload.resourceControlId
+        );
+      }
+    },
+    mutationOptions(
+      withInvalidate(queryClient, [['custom-templates']]),
+      withError('Failed to update template')
+    )
+  );
+}
+
+/**
+ * Payload for updating a custom template
+ */
+interface CustomTemplateUpdatePayload {
+  id: CustomTemplate['Id'];
+  /** URL of the template's logo */
+  Logo?: string;
+  /** Title of the template */
+  Title: string;
+  /** Description of the template */
+  Description: string;
+  /** A note that will be displayed in the UI. Supports HTML content */
+  Note?: string;
+  /**
+   * Platform associated to the template.
+   * Required for Docker stacks
+   */
+  Platform?: Platform;
+  /**
+   * Type of created stack
+   * Required
+   */
+  Type: StackType;
+  /** References an existing Source for git credentials/URL. When set, inline URL and auth are ignored. */
+  SourceId?: number;
+  /** URL of a Git repository hosting the Stack file */
+  RepositoryURL?: string;
+  /** Reference name of a Git repository hosting the Stack file */
+  RepositoryReferenceName?: string;
+  /** Use basic authentication to clone the Git repository */
+  RepositoryAuthentication?: boolean;
+  /** Username used in basic authentication. Required when RepositoryAuthentication is true */
+  RepositoryUsername?: string;
+  /** Password used in basic authentication. Required when RepositoryAuthentication is true */
+  RepositoryPassword?: string;
+  /** Path to the Stack file inside the Git repository */
+  ComposeFilePathInRepository?: string;
+  /** Content of stack file */
+  FileContent?: string;
+  /** Definitions of variables in the stack file */
+  Variables?: VariableDefinition[];
+  /** TLSSkipVerify skips SSL verification when cloning the Git repository */
+  TLSSkipVerify?: boolean;
+  /** IsComposeFormat indicates if the Kubernetes template is created from a Docker Compose file */
+  IsComposeFormat?: boolean;
+  /** EdgeTemplate indicates if this template purpose for Edge Stack */
+  EdgeTemplate?: boolean;
+  EdgeSettings?: EdgeTemplateSettings;
+}
+
+async function updateTemplate(values: CustomTemplateUpdatePayload) {
+  try {
+    const { data } = await axios.put<CustomTemplate>(
+      buildUrl({ id: values.id }),
+      values
+    );
+    return data;
+  } catch (error) {
+    throw parseAxiosError(error);
+  }
+}
diff --git a/app/react/portainer/templates/custom-templates/types.ts b/app/react/portainer/templates/custom-templates/types.ts
new file mode 100644
index 0000000..efc73e0
--- /dev/null
+++ b/app/react/portainer/templates/custom-templates/types.ts
@@ -0,0 +1,151 @@
+import { UserId } from '@/portainer/users/types';
+import { StackType } from '@/react/common/stacks/types';
+import {
+  StaggerConfig,
+  getDefaultStaggerConfig,
+} from '@/react/edge/edge-stacks/components/StaggerFieldset.types';
+
+import { ResourceControlResponse } from '../../access-control/types';
+import { RelativePathModel, RepoConfigResponse } from '../../gitops/types';
+import { VariableDefinition } from '../../custom-templates/components/CustomTemplatesVariablesDefinitionField';
+import { Platform } from '../types';
+import { RegistryId } from '../../registries/types/registry';
+import { getDefaultRelativePathModel } from '../../gitops/RelativePathFieldset/types';
+import { isBE } from '../../feature-flags/feature-flags.service';
+
+export type CustomTemplate = {
+  Id: number;
+
+  /**
+   * Title of the template.
+   * @example "Nginx"
+   */
+  Title: string;
+
+  /**
+   * Description of the template.
+   * @example "High performance web server"
+   */
+  Description: string;
+
+  /**
+   * Path on disk to the repository hosting the Stack file.
+   * @example "/data/custom_template/3"
+   */
+  ProjectPath: string;
+
+  /**
+   * Path to the Stack file.
+   * @example "docker-compose.yml"
+   */
+  EntryPoint: string;
+
+  /**
+   * User identifier who created this template.
+   * @example 3
+   */
+  CreatedByUserId: UserId;
+
+  /**
+   * A note that will be displayed in the UI. Supports HTML content.
+   * @example "This is my <b>custom</b> template"
+   */
+  Note: string;
+
+  /**
+   * Platform associated with the template.
+   * Valid values are: 1 - 'linux', 2 - 'windows'.
+   * @example 1
+   */
+  Platform: Platform;
+
+  /**
+   * URL of the template's logo.
+   * @example "https://portainer.io/img/logo.svg"
+   */
+  Logo: string;
+
+  /**
+   * Type of created stack:
+   * - 1: swarm
+   * - 2: compose
+   * - 3: kubernetes
+   * @example 1
+   */
+  Type: StackType;
+
+  /**
+   * ResourceControl associated with the template.
+   */
+  ResourceControl?: ResourceControlResponse;
+
+  Variables: VariableDefinition[];
+
+  /**
+   * GitConfig for the template.
+   */
+  GitConfig?: RepoConfigResponse;
+
+  /**
+   * Indicates if the Kubernetes template is created from a Docker Compose file.
+   * @example false
+   */
+  IsComposeFormat: boolean;
+
+  /** EdgeTemplate indicates if this template purpose for Edge Stack */
+  EdgeTemplate: boolean;
+
+  EdgeSettings?: EdgeTemplateSettings;
+
+  /** Artifact stores the git source reference for git-backed templates. */
+  artifact?: {
+    files?: Array<{ sourceId?: number }>;
+  };
+};
+
+export function getTemplateSourceId(
+  template?: Pick<CustomTemplate, 'artifact'>
+) {
+  return template?.artifact?.files?.[0]?.sourceId;
+}
+
+/**
+ * EdgeTemplateSettings represents the configuration of a custom template for Edge
+ */
+export type EdgeTemplateSettings = {
+  PrePullImage: boolean;
+
+  RetryDeploy: boolean;
+
+  PrivateRegistryId: RegistryId | undefined;
+
+  RelativePathSettings: RelativePathModel;
+
+  /**
+   * StaggerConfig is the configuration for staggered update
+   * required only on BE
+   */
+  StaggerConfig: StaggerConfig;
+};
+
+export type CustomTemplateFileContent = {
+  FileContent: string;
+};
+
+export const CustomTemplateKubernetesType = StackType.Kubernetes;
+
+export function getDefaultEdgeTemplateSettings():
+  | EdgeTemplateSettings
+  | undefined {
+  if (!isBE) {
+    return undefined;
+  }
+
+  return {
+    PrePullImage: false,
+    RetryDeploy: false,
+    PrivateRegistryId: undefined,
+    RelativePathSettings: getDefaultRelativePathModel(),
+    StaggerConfig: getDefaultStaggerConfig(),
+  };
+}
diff --git a/app/react/portainer/templates/custom-templates/useParseTemplateOnFileChange.tsx b/app/react/portainer/templates/custom-templates/useParseTemplateOnFileChange.tsx
new file mode 100644
index 0000000..b20d17a
--- /dev/null
+++ b/app/react/portainer/templates/custom-templates/useParseTemplateOnFileChange.tsx
@@ -0,0 +1,43 @@
+import { useFormikContext } from 'formik';
+
+import { VariableDefinition } from '../../custom-templates/components/CustomTemplatesVariablesDefinitionField';
+import {
+  getTemplateVariables,
+  intersectVariables,
+  isTemplateVariablesEnabled,
+} from '../../custom-templates/components/utils';
+
+export function useParseTemplateOnFileChange(
+  oldVariables: VariableDefinition[]
+) {
+  const { setFieldValue, setFieldError } = useFormikContext();
+
+  return handleChangeFileContent;
+
+  function handleChangeFileContent(value: string) {
+    setFieldValue(
+      'FileContent',
+      value,
+      isTemplateVariablesEnabled ? !value : true
+    );
+    parseTemplate(value);
+  }
+
+  function parseTemplate(value: string) {
+    if (!isTemplateVariablesEnabled || value === '') {
+      setFieldValue('Variables', []);
+      return;
+    }
+
+    const [variables, validationError] = getTemplateVariables(value);
+    const isValid = !!variables;
+
+    setFieldError(
+      'FileContent',
+      validationError ? `Template invalid: ${validationError}` : undefined
+    );
+    if (isValid) {
+      setFieldValue('Variables', intersectVariables(oldVariables, variables));
+    }
+  }
+}
diff --git a/app/react/portainer/templates/custom-templates/useViewType.ts b/app/react/portainer/templates/custom-templates/useViewType.ts
new file mode 100644
index 0000000..69a5ec5
--- /dev/null
+++ b/app/react/portainer/templates/custom-templates/useViewType.ts
@@ -0,0 +1,22 @@
+import { useCurrentStateAndParams } from '@uirouter/react';
+
+export type TemplateViewType = 'kube' | 'docker' | 'edge';
+
+export function useViewType(): TemplateViewType {
+  const {
+    state: { name = '' },
+  } = useCurrentStateAndParams();
+  if (name.includes('kubernetes')) {
+    return 'kube';
+  }
+
+  if (name.includes('docker')) {
+    return 'docker';
+  }
+
+  if (name.includes('edge')) {
+    return 'edge';
+  }
+
+  throw new Error(`Unknown view type: ${name}`);
+}
diff --git a/app/react/portainer/templates/types.ts b/app/react/portainer/templates/types.ts
new file mode 100644
index 0000000..648598f
--- /dev/null
+++ b/app/react/portainer/templates/types.ts
@@ -0,0 +1,4 @@
+export enum Platform {
+  LINUX = 1,
+  WINDOWS,
+}
diff --git a/app/react/portainer/users/ListView/ListView.tsx b/app/react/portainer/users/ListView/ListView.tsx
new file mode 100644
index 0000000..68449b3
--- /dev/null
+++ b/app/react/portainer/users/ListView/ListView.tsx
@@ -0,0 +1,16 @@
+import { PageHeader } from '@@/PageHeader';
+
+import { NewUserForm } from './NewUserForm/NewUserForm';
+import { UsersDatatable } from './UsersDatatable/UsersDatatable';
+
+export function ListView() {
+  return (
+    <>
+      <PageHeader title="Users" breadcrumbs="User management" reload />
+
+      <NewUserForm />
+
+      <UsersDatatable />
+    </>
+  );
+}
diff --git a/app/react/portainer/users/ListView/NewUserForm/AdminSwitch.tsx b/app/react/portainer/users/ListView/NewUserForm/AdminSwitch.tsx
new file mode 100644
index 0000000..7d46a57
--- /dev/null
+++ b/app/react/portainer/users/ListView/NewUserForm/AdminSwitch.tsx
@@ -0,0 +1,25 @@
+import { useField } from 'formik';
+
+import { SwitchField } from '@@/form-components/SwitchField';
+
+import { FormValues } from './FormValues';
+
+export function AdminSwitch() {
+  const [{ name, value }, , { setValue }] =
+    useField<FormValues['isAdmin']>('isAdmin');
+  return (
+    <div className="form-group">
+      <div className="col-sm-12">
+        <SwitchField
+          data-cy="user-adminSwitch"
+          label="Administrator"
+          tooltip="Administrators have access to Portainer settings management as well as full control over all defined environments and their resources.'"
+          checked={value}
+          onChange={(checked) => setValue(checked)}
+          name={name}
+          labelClass="col-sm-3 col-lg-2"
+        />
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/portainer/users/ListView/NewUserForm/ConfirmPasswordField.tsx b/app/react/portainer/users/ListView/NewUserForm/ConfirmPasswordField.tsx
new file mode 100644
index 0000000..bd0798d
--- /dev/null
+++ b/app/react/portainer/users/ListView/NewUserForm/ConfirmPasswordField.tsx
@@ -0,0 +1,42 @@
+import { Check, XIcon } from 'lucide-react';
+import { useField } from 'formik';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { InputGroup } from '@@/form-components/InputGroup';
+import { Icon } from '@@/Icon';
+
+import { FormValues } from './FormValues';
+
+export function ConfirmPasswordField() {
+  const [{ name, onBlur, onChange, value }, { error }] =
+    useField<FormValues['confirmPassword']>('confirmPassword');
+  return (
+    <FormControl
+      inputId="confirm_password"
+      label="Confirm password"
+      required
+      errors={error}
+    >
+      <InputGroup>
+        <InputGroup.Input
+          id="confirm_password"
+          name={name}
+          data-cy="user-passwordConfirmInput"
+          value={value}
+          onChange={onChange}
+          onBlur={onBlur}
+          required
+          type="password"
+          autoComplete="one-time-code"
+        />
+        <InputGroup.Addon>
+          {error ? (
+            <Icon mode="danger" icon={XIcon} />
+          ) : (
+            <Icon mode="success" icon={Check} />
+          )}
+        </InputGroup.Addon>
+      </InputGroup>
+    </FormControl>
+  );
+}
diff --git a/app/react/portainer/users/ListView/NewUserForm/FormValues.tsx b/app/react/portainer/users/ListView/NewUserForm/FormValues.tsx
new file mode 100644
index 0000000..d09a38e
--- /dev/null
+++ b/app/react/portainer/users/ListView/NewUserForm/FormValues.tsx
@@ -0,0 +1,9 @@
+import { TeamId } from '../../teams/types';
+
+export interface FormValues {
+  username: string;
+  password: string;
+  confirmPassword: string;
+  isAdmin: boolean;
+  teams: TeamId[];
+}
diff --git a/app/react/portainer/users/ListView/NewUserForm/NewUserForm.tsx b/app/react/portainer/users/ListView/NewUserForm/NewUserForm.tsx
new file mode 100644
index 0000000..812c7de
--- /dev/null
+++ b/app/react/portainer/users/ListView/NewUserForm/NewUserForm.tsx
@@ -0,0 +1,103 @@
+import { PlusIcon } from 'lucide-react';
+import { Form, Formik } from 'formik';
+
+import { useCurrentUser } from '@/react/hooks/useUser';
+import { usePublicSettings } from '@/react/portainer/settings/queries';
+import { AuthenticationMethod } from '@/react/portainer/settings/types';
+import { Role } from '@/portainer/users/types';
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { Widget } from '@@/Widget';
+import { FormActions } from '@@/form-components/FormActions';
+
+import { useTeams } from '../../teams/queries';
+import { useCreateUserMutation } from '../../queries/useCreateUserMutation';
+
+import { UsernameField } from './UsernameField';
+import { PasswordField } from './PasswordField';
+import { ConfirmPasswordField } from './ConfirmPasswordField';
+import { FormValues } from './FormValues';
+import { TeamsFieldset } from './TeamsFieldset';
+import { useValidation } from './useValidation';
+
+export function NewUserForm() {
+  const { isPureAdmin } = useCurrentUser();
+  const teamsQuery = useTeams(!isPureAdmin);
+  const settingsQuery = usePublicSettings();
+  const createUserMutation = useCreateUserMutation();
+  const validation = useValidation();
+
+  if (!teamsQuery.data || !settingsQuery.data) {
+    return null;
+  }
+
+  const { AuthenticationMethod: authMethod } = settingsQuery.data;
+
+  return (
+    <div className="row">
+      <div className="col-sm-12">
+        <Widget>
+          <Widget.Title icon={PlusIcon} title="Add a new user" />
+          <Widget.Body>
+            <Formik<FormValues>
+              initialValues={{
+                username: '',
+                password: '',
+                confirmPassword: '',
+                isAdmin: false,
+                teams: [],
+              }}
+              validationSchema={validation}
+              validateOnMount
+              onSubmit={(values, { resetForm }) => {
+                createUserMutation.mutate(
+                  {
+                    password: values.password,
+                    username: values.username,
+                    role: values.isAdmin ? Role.Admin : Role.Standard,
+                    teams: values.teams,
+                  },
+                  {
+                    onSuccess() {
+                      notifySuccess(
+                        'User successfully created',
+                        values.username
+                      );
+                      resetForm();
+                    },
+                  }
+                );
+              }}
+            >
+              {({ errors, isValid }) => (
+                <Form className="form-horizontal">
+                  <UsernameField authMethod={authMethod} />
+
+                  {authMethod === AuthenticationMethod.Internal && (
+                    <>
+                      <PasswordField />
+
+                      <ConfirmPasswordField />
+                    </>
+                  )}
+
+                  <TeamsFieldset />
+
+                  <FormActions
+                    data-cy="user-createUserButton"
+                    submitLabel="Create user"
+                    isLoading={createUserMutation.isLoading}
+                    isValid={isValid}
+                    loadingText="Creating user..."
+                    errors={errors}
+                    submitIcon={PlusIcon}
+                  />
+                </Form>
+              )}
+            </Formik>
+          </Widget.Body>
+        </Widget>
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/portainer/users/ListView/NewUserForm/PasswordField.tsx b/app/react/portainer/users/ListView/NewUserForm/PasswordField.tsx
new file mode 100644
index 0000000..170d374
--- /dev/null
+++ b/app/react/portainer/users/ListView/NewUserForm/PasswordField.tsx
@@ -0,0 +1,26 @@
+import { useField } from 'formik';
+
+import { Input } from '@@/form-components/Input';
+import { FormControl } from '@@/form-components/FormControl';
+
+import { FormValues } from './FormValues';
+
+export function PasswordField() {
+  const [{ name, onBlur, onChange, value }, { error }] =
+    useField<FormValues['password']>('password');
+  return (
+    <FormControl label="Password" required inputId="psw-input" errors={error}>
+      <Input
+        type="password"
+        name={name}
+        value={value}
+        onChange={onChange}
+        onBlur={onBlur}
+        id="psw-input"
+        data-cy="user-passwordInput"
+        required
+        autoComplete="one-time-code"
+      />
+    </FormControl>
+  );
+}
diff --git a/app/react/portainer/users/ListView/NewUserForm/TeamsField.tsx b/app/react/portainer/users/ListView/NewUserForm/TeamsField.tsx
new file mode 100644
index 0000000..40e3645
--- /dev/null
+++ b/app/react/portainer/users/ListView/NewUserForm/TeamsField.tsx
@@ -0,0 +1,45 @@
+import { useField } from 'formik';
+
+import { Link } from '@@/Link';
+import { TeamsSelector } from '@@/TeamsSelector';
+import { FormControl } from '@@/form-components/FormControl';
+
+import { Team } from '../../teams/types';
+
+import { FormValues } from './FormValues';
+
+export function TeamsField({
+  teams,
+  disabled,
+}: {
+  teams: Array<Team>;
+  disabled?: boolean;
+}) {
+  const [{ name, value }, { error }, { setValue }] =
+    useField<FormValues['teams']>('teams');
+
+  return (
+    <FormControl label="Add to team(s)" inputId="teams-field" errors={error}>
+      {teams.length > 0 ? (
+        <TeamsSelector
+          dataCy="user-teamSelect"
+          onChange={(value) => setValue(value)}
+          value={value}
+          name={name}
+          teams={teams}
+          inputId="teams-field"
+          disabled={disabled}
+        />
+      ) : (
+        <span className="small text-muted">
+          You don&apos;t seem to have any teams to add users into. Head over to
+          the{' '}
+          <Link to="portainer.teams" data-cy="teams-view-link">
+            Teams view
+          </Link>{' '}
+          to create some.
+        </span>
+      )}
+    </FormControl>
+  );
+}
diff --git a/app/react/portainer/users/ListView/NewUserForm/TeamsFieldset.tsx b/app/react/portainer/users/ListView/NewUserForm/TeamsFieldset.tsx
new file mode 100644
index 0000000..08c3e6c
--- /dev/null
+++ b/app/react/portainer/users/ListView/NewUserForm/TeamsFieldset.tsx
@@ -0,0 +1,71 @@
+import { useFormikContext } from 'formik';
+
+import { useCurrentUser } from '@/react/hooks/useUser';
+import { usePublicSettings } from '@/react/portainer/settings/queries';
+
+import { TextTip } from '@@/Tip/TextTip';
+import { Link } from '@@/Link';
+
+import { useTeams } from '../../teams/queries';
+
+import { AdminSwitch } from './AdminSwitch';
+import { FormValues } from './FormValues';
+import { TeamsField } from './TeamsField';
+
+export function TeamsFieldset() {
+  const { values } = useFormikContext<FormValues>();
+  const { isPureAdmin } = useCurrentUser();
+  const teamsQuery = useTeams(!isPureAdmin);
+  const settingsQuery = usePublicSettings();
+  if (!teamsQuery.data || !settingsQuery.data) {
+    return null;
+  }
+
+  const { TeamSync: teamSync } = settingsQuery.data;
+
+  return (
+    <>
+      {isPureAdmin && <AdminSwitch />}
+
+      {!values.isAdmin && (
+        <TeamsField teams={teamsQuery.data} disabled={teamSync} />
+      )}
+
+      {teamSync && <TeamSyncMessage />}
+
+      {isPureAdmin && !values.isAdmin && values.teams.length === 0 && (
+        <NoTeamSelected />
+      )}
+    </>
+  );
+}
+
+function TeamSyncMessage() {
+  return (
+    <div className="form-group">
+      <div className="col-sm-12">
+        <TextTip color="orange">
+          The team leader feature is disabled as external authentication is
+          currently enabled with team sync.
+        </TextTip>
+      </div>
+    </div>
+  );
+}
+
+function NoTeamSelected() {
+  return (
+    <div className="form-group">
+      <div className="col-sm-12">
+        <TextTip color="blue">
+          Note: non-administrator users who aren&apos;t in a team don&apos;t
+          have access to any environments by default. Head over to the{' '}
+          <Link to="portainer.endpoints" data-cy="env-link">
+            Environments view
+          </Link>{' '}
+          to manage their accesses.
+        </TextTip>
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/portainer/users/ListView/NewUserForm/UsernameField.tsx b/app/react/portainer/users/ListView/NewUserForm/UsernameField.tsx
new file mode 100644
index 0000000..a70b1c7
--- /dev/null
+++ b/app/react/portainer/users/ListView/NewUserForm/UsernameField.tsx
@@ -0,0 +1,54 @@
+import { Check, XIcon } from 'lucide-react';
+import { useField } from 'formik';
+
+import { AuthenticationMethod } from '@/react/portainer/settings/types';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { InputGroup } from '@@/form-components/InputGroup';
+import { Icon } from '@@/Icon';
+
+import { FormValues } from './FormValues';
+
+export function UsernameField({
+  authMethod,
+}: {
+  authMethod: AuthenticationMethod;
+}) {
+  const [{ name, onBlur, onChange, value }, { error }] =
+    useField<FormValues['username']>('username');
+
+  return (
+    <FormControl
+      inputId="username-field"
+      label="Username"
+      required
+      errors={error}
+      tooltip={
+        authMethod === AuthenticationMethod.LDAP
+          ? 'Username must exactly match username defined in external LDAP source.'
+          : null
+      }
+    >
+      <InputGroup>
+        <InputGroup.Input
+          id="username-field"
+          name={name}
+          placeholder="e.g. jdoe"
+          data-cy="user-usernameInput"
+          value={value}
+          onChange={onChange}
+          onBlur={onBlur}
+          required
+          autoComplete="create-username"
+        />
+        <InputGroup.Addon>
+          {error ? (
+            <Icon mode="danger" icon={XIcon} />
+          ) : (
+            <Icon mode="success" icon={Check} />
+          )}
+        </InputGroup.Addon>
+      </InputGroup>
+    </FormControl>
+  );
+}
diff --git a/app/react/portainer/users/ListView/NewUserForm/useValidation.tsx b/app/react/portainer/users/ListView/NewUserForm/useValidation.tsx
new file mode 100644
index 0000000..6b8d15f
--- /dev/null
+++ b/app/react/portainer/users/ListView/NewUserForm/useValidation.tsx
@@ -0,0 +1,58 @@
+import { SchemaOf, array, boolean, number, object, ref, string } from 'yup';
+import { useMemo } from 'react';
+
+import { usePublicSettings } from '@/react/portainer/settings/queries';
+import { AuthenticationMethod } from '@/react/portainer/settings/types';
+import { useUsers } from '@/portainer/users/queries';
+
+import { FormValues } from './FormValues';
+
+export function useValidation(): SchemaOf<FormValues> {
+  const usersQuery = useUsers(true);
+  const settingsQuery = usePublicSettings();
+
+  const authMethod =
+    settingsQuery.data?.AuthenticationMethod ?? AuthenticationMethod.Internal;
+
+  return useMemo(() => {
+    const users = usersQuery.data ?? [];
+
+    const base = object({
+      username: string()
+        .required('Username is required')
+        .test({
+          name: 'unique',
+          message: 'Username is already taken',
+          test: (value) => users.every((u) => u.Username !== value),
+        }),
+      password: string().default(''),
+      confirmPassword: string().default(''),
+      isAdmin: boolean().default(false),
+      teams: array(number().required()).required(),
+    });
+
+    if (authMethod === AuthenticationMethod.Internal) {
+      return base.concat(
+        passwordValidation(settingsQuery.data?.RequiredPasswordLength)
+      );
+    }
+
+    return base;
+  }, [authMethod, settingsQuery.data?.RequiredPasswordLength, usersQuery.data]);
+}
+
+function passwordValidation(minLength: number | undefined = 12) {
+  return object({
+    password: string()
+      .required('Password is required')
+      .min(
+        minLength,
+        ({ value, min }) =>
+          `The password must be at least ${min} characters long. (${value.length}/${min})`
+      ),
+    confirmPassword: string().oneOf(
+      [ref('password'), null],
+      'Passwords must match'
+    ),
+  });
+}
diff --git a/app/react/portainer/users/ListView/UsersDatatable/UsersDatatable.tsx b/app/react/portainer/users/ListView/UsersDatatable/UsersDatatable.tsx
new file mode 100644
index 0000000..7d261f9
--- /dev/null
+++ b/app/react/portainer/users/ListView/UsersDatatable/UsersDatatable.tsx
@@ -0,0 +1,107 @@
+import { User as UserIcon } from 'lucide-react';
+import { useMemo } from 'react';
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { useUsers } from '@/portainer/users/queries';
+import { AuthenticationMethod } from '@/react/portainer/settings/types';
+import { useSettings } from '@/react/portainer/settings/queries';
+import { notifySuccess } from '@/portainer/services/notifications';
+import {
+  mutationOptions,
+  withError,
+  withInvalidate,
+} from '@/react-tools/react-query';
+import { processItemsInBatches } from '@/react/common/processItemsInBatches';
+import { useCurrentUser } from '@/react/hooks/useUser';
+import { userQueryKeys } from '@/portainer/users/queries/queryKeys';
+
+import { Datatable } from '@@/datatables';
+import { useTableState } from '@@/datatables/useTableState';
+import { createPersistedStore } from '@@/datatables/types';
+import { DeleteButton } from '@@/buttons/DeleteButton';
+
+import { useTeamMemberships } from '../../teams/queries/useTeamMemberships';
+import { TeamId, TeamRole } from '../../teams/types';
+import { deleteUser } from '../../queries/useDeleteUserMutation';
+
+import { columns } from './columns';
+import { DecoratedUser } from './types';
+
+const store = createPersistedStore('users');
+
+export function UsersDatatable() {
+  const removeMutation = useRemoveMutation();
+  const { isPureAdmin } = useCurrentUser();
+  const usersQuery = useUsers(isPureAdmin);
+  const membershipsQuery = useTeamMemberships();
+  const settingsQuery = useSettings();
+  const tableState = useTableState(store, 'users');
+
+  const dataset: Array<DecoratedUser> | null = useMemo(() => {
+    if (!usersQuery.data || !membershipsQuery.data || !settingsQuery.data) {
+      return null;
+    }
+
+    const memberships = membershipsQuery.data;
+
+    return usersQuery.data.map((user) => {
+      const teamMembership = memberships.find(
+        (membership) => membership.UserID === user.Id
+      );
+
+      return {
+        ...user,
+        isTeamLeader: teamMembership?.Role === TeamRole.Leader,
+        authMethod:
+          AuthenticationMethod[
+            user.Id === 1
+              ? AuthenticationMethod.Internal
+              : settingsQuery.data.AuthenticationMethod
+          ],
+      };
+    });
+  }, [membershipsQuery.data, settingsQuery.data, usersQuery.data]);
+
+  return (
+    <Datatable
+      columns={columns}
+      dataset={dataset || []}
+      isLoading={!dataset}
+      title="Users"
+      titleIcon={UserIcon}
+      settingsManager={tableState}
+      isRowSelectable={(row) => row.original.Id !== 1}
+      renderTableActions={(selectedUsers) => (
+        <DeleteButton
+          disabled={selectedUsers.length === 0}
+          confirmMessage="Do you want to remove the selected users? They will not be able to login into Portainer anymore."
+          onConfirmed={() =>
+            removeMutation.mutate(
+              selectedUsers.map((i) => i.Id),
+              {
+                onSuccess: () => {
+                  notifySuccess('Users successfully removed', '');
+                },
+              }
+            )
+          }
+          data-cy="remove-users-button"
+          isLoading={removeMutation.isLoading}
+        />
+      )}
+      data-cy="users-datatable"
+    />
+  );
+}
+
+function useRemoveMutation() {
+  const queryClient = useQueryClient();
+
+  return useMutation(
+    async (ids: TeamId[]) => processItemsInBatches(ids, deleteUser),
+    mutationOptions(
+      withError('Unable to remove users'),
+      withInvalidate(queryClient, [userQueryKeys.base()])
+    )
+  );
+}
diff --git a/app/react/portainer/users/ListView/UsersDatatable/columns/authentication.tsx b/app/react/portainer/users/ListView/UsersDatatable/columns/authentication.tsx
new file mode 100644
index 0000000..35fbf00
--- /dev/null
+++ b/app/react/portainer/users/ListView/UsersDatatable/columns/authentication.tsx
@@ -0,0 +1,5 @@
+import { helper } from './helper';
+
+export const authentication = helper.accessor('authMethod', {
+  header: 'Authentication',
+});
diff --git a/app/react/portainer/users/ListView/UsersDatatable/columns/helper.ts b/app/react/portainer/users/ListView/UsersDatatable/columns/helper.ts
new file mode 100644
index 0000000..4cf1925
--- /dev/null
+++ b/app/react/portainer/users/ListView/UsersDatatable/columns/helper.ts
@@ -0,0 +1,5 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { DecoratedUser } from '../types';
+
+export const helper = createColumnHelper<DecoratedUser>();
diff --git a/app/react/portainer/users/ListView/UsersDatatable/columns/index.ts b/app/react/portainer/users/ListView/UsersDatatable/columns/index.ts
new file mode 100644
index 0000000..28d4308
--- /dev/null
+++ b/app/react/portainer/users/ListView/UsersDatatable/columns/index.ts
@@ -0,0 +1,5 @@
+import { authentication } from './authentication';
+import { name } from './name';
+import { role } from './role';
+
+export const columns = [name, role, authentication];
diff --git a/app/react/portainer/users/ListView/UsersDatatable/columns/name.tsx b/app/react/portainer/users/ListView/UsersDatatable/columns/name.tsx
new file mode 100644
index 0000000..6dce0e4
--- /dev/null
+++ b/app/react/portainer/users/ListView/UsersDatatable/columns/name.tsx
@@ -0,0 +1,36 @@
+import { CellContext } from '@tanstack/react-table';
+
+import { useCurrentUser } from '@/react/hooks/useUser';
+
+import { Link } from '@@/Link';
+
+import { DecoratedUser } from '../types';
+
+import { helper } from './helper';
+
+export const name = helper.accessor('Username', {
+  header: 'Name',
+  cell: Cell,
+});
+
+function Cell({
+  getValue,
+  row: { original: item },
+}: CellContext<DecoratedUser, 'string'>) {
+  const { isPureAdmin } = useCurrentUser();
+  const name = getValue();
+
+  if (!isPureAdmin) {
+    return <>{name}</>;
+  }
+
+  return (
+    <Link
+      to=".user"
+      params={{ id: item.Id }}
+      data-cy={`user-link-${item.Username}`}
+    >
+      {name}
+    </Link>
+  );
+}
diff --git a/app/react/portainer/users/ListView/UsersDatatable/columns/role.tsx b/app/react/portainer/users/ListView/UsersDatatable/columns/role.tsx
new file mode 100644
index 0000000..252993a
--- /dev/null
+++ b/app/react/portainer/users/ListView/UsersDatatable/columns/role.tsx
@@ -0,0 +1,29 @@
+import { User, UserPlus } from 'lucide-react';
+
+import { isEdgeAdmin } from '@/portainer/users/user.helpers';
+import { RoleNames } from '@/portainer/users/types';
+
+import { Icon } from '@@/Icon';
+
+import { helper } from './helper';
+
+export const role = helper.accessor(
+  (item) =>
+    `${RoleNames[item.Role]} ${
+      item.isTeamLeader ? ' - team leader' : ''
+    }`.trim(),
+  {
+    header: 'Role',
+    cell: ({ getValue, row: { original: item } }) => {
+      const icon =
+        isEdgeAdmin({ Role: item.Role }) || item.isTeamLeader ? User : UserPlus;
+
+      return (
+        <span className="vertical-center">
+          <Icon icon={icon} />
+          {getValue() || '-'}
+        </span>
+      );
+    },
+  }
+);
diff --git a/app/react/portainer/users/ListView/UsersDatatable/types.ts b/app/react/portainer/users/ListView/UsersDatatable/types.ts
new file mode 100644
index 0000000..e85191e
--- /dev/null
+++ b/app/react/portainer/users/ListView/UsersDatatable/types.ts
@@ -0,0 +1,6 @@
+import { type User } from '@/portainer/users/types';
+
+export type DecoratedUser = User & {
+  isTeamLeader?: boolean;
+  authMethod: string;
+};
diff --git a/app/react/portainer/users/RolesView/AccessViewer/EffectiveAccessViewer.test.tsx b/app/react/portainer/users/RolesView/AccessViewer/EffectiveAccessViewer.test.tsx
new file mode 100644
index 0000000..3177d51
--- /dev/null
+++ b/app/react/portainer/users/RolesView/AccessViewer/EffectiveAccessViewer.test.tsx
@@ -0,0 +1,63 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import { vi, describe, it, expect, beforeEach } from 'vitest';
+
+import axios from '@/portainer/services/axios/axios';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+
+import { EffectiveAccessViewer } from './EffectiveAccessViewer';
+
+vi.mock('@/portainer/services/axios/axios', () => ({
+  default: { get: vi.fn() },
+  parseAxiosError: vi.fn((error) => error),
+}));
+
+function renderViewer(userId: number | null) {
+  const Wrapped = withUserProvider(
+    withTestRouter(withTestQueryProvider(EffectiveAccessViewer))
+  );
+  return render(<Wrapped userId={userId} />);
+}
+
+describe('EffectiveAccessViewer', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('renders nothing and skips the API call when no user is selected', () => {
+    renderViewer(null);
+    expect(axios.get).not.toHaveBeenCalled();
+    expect(
+      screen.queryByText(
+        /Effective role for each environment will be displayed/i
+      )
+    ).not.toBeInTheDocument();
+  });
+
+  it('fetches effective access and renders the datatable for the selected user', async () => {
+    vi.mocked(axios.get).mockResolvedValue({
+      data: [
+        {
+          endpointId: 1,
+          endpointName: 'prod-cluster',
+          roleId: 2,
+          roleName: 'Helpdesk',
+          rolePriority: 5,
+          groupId: 10,
+          groupName: 'production',
+          accessLocation: 'environmentGroup',
+        },
+      ],
+    });
+
+    renderViewer(42);
+
+    await waitFor(() => {
+      expect(axios.get).toHaveBeenCalledWith('/users/42/effective-access');
+    });
+
+    expect(await screen.findByText('prod-cluster')).toBeInTheDocument();
+    expect(screen.getByText('Helpdesk')).toBeInTheDocument();
+  });
+});
diff --git a/app/react/portainer/users/RolesView/AccessViewer/EffectiveAccessViewer.tsx b/app/react/portainer/users/RolesView/AccessViewer/EffectiveAccessViewer.tsx
new file mode 100644
index 0000000..3c70e5e
--- /dev/null
+++ b/app/react/portainer/users/RolesView/AccessViewer/EffectiveAccessViewer.tsx
@@ -0,0 +1,38 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+import { UserId } from '@/portainer/users/types';
+
+import { EffectiveAccessViewerDatatable } from './EffectiveAccessViewerDatatable';
+import { AccessViewerPolicyModel } from './model';
+
+export function EffectiveAccessViewer({ userId }: { userId: UserId | null }) {
+  const query = useUserEffectiveAccess(userId);
+
+  if (!userId) {
+    return null;
+  }
+
+  return <EffectiveAccessViewerDatatable dataset={query.data ?? []} />;
+}
+
+function useUserEffectiveAccess(userId: UserId | null) {
+  return useQuery({
+    queryKey: ['users', userId, 'effective-access'],
+    queryFn: () => getUserEffectiveAccess(userId as UserId),
+    enabled: !!userId,
+    ...withError('Unable to retrieve effective access'),
+  });
+}
+
+async function getUserEffectiveAccess(userId: UserId) {
+  try {
+    const { data } = await axios.get<AccessViewerPolicyModel[]>(
+      `/users/${userId}/effective-access`
+    );
+    return data;
+  } catch (err) {
+    throw parseAxiosError(err);
+  }
+}
diff --git a/app/react/portainer/users/RolesView/AccessViewer/EffectiveAccessViewerDatatable.tsx b/app/react/portainer/users/RolesView/AccessViewer/EffectiveAccessViewerDatatable.tsx
new file mode 100644
index 0000000..f0a91eb
--- /dev/null
+++ b/app/react/portainer/users/RolesView/AccessViewer/EffectiveAccessViewerDatatable.tsx
@@ -0,0 +1,40 @@
+import { TextTip } from '@@/Tip/TextTip';
+import { Datatable } from '@@/datatables';
+import { useTableStateWithStorage } from '@@/datatables/useTableState';
+
+import { AccessViewerPolicyModel } from './model';
+import { columns } from './columns';
+
+export function EffectiveAccessViewerDatatable({
+  dataset,
+}: {
+  dataset?: Array<AccessViewerPolicyModel>;
+}) {
+  const tableState = useTableStateWithStorage('access-viewer', 'Environment');
+
+  if (dataset?.length === 0) {
+    return (
+      <TextTip color="blue">
+        The selected user does not have access to any environments.
+      </TextTip>
+    );
+  }
+
+  return (
+    <Datatable
+      dataset={dataset || []}
+      columns={columns}
+      settingsManager={tableState}
+      noWidget
+      title="Access"
+      description={
+        <TextTip color="blue">
+          Effective role for each environment will be displayed for the selected
+          user.
+        </TextTip>
+      }
+      disableSelect
+      data-cy="effective-access-viewer-datatable"
+    />
+  );
+}
diff --git a/app/react/portainer/users/RolesView/AccessViewer/columns.tsx b/app/react/portainer/users/RolesView/AccessViewer/columns.tsx
new file mode 100644
index 0000000..059949e
--- /dev/null
+++ b/app/react/portainer/users/RolesView/AccessViewer/columns.tsx
@@ -0,0 +1,108 @@
+import { createColumnHelper, CellContext } from '@tanstack/react-table';
+import { Users } from 'lucide-react';
+
+import { useCurrentUser } from '@/react/hooks/useUser';
+
+import { Icon } from '@@/Icon';
+import { Link } from '@@/Link';
+
+import { AccessLocation, AccessViewerPolicyModel } from './model';
+
+const ACCESS_LOCATION_LABELS: Record<AccessLocation, string> = {
+  [AccessLocation.Environment]: 'environment',
+  [AccessLocation.EnvironmentGroup]: 'environment group',
+};
+
+const helper = createColumnHelper<AccessViewerPolicyModel>();
+
+export const columns = [
+  helper.accessor('endpointName', {
+    header: 'Environment',
+    id: 'Environment',
+  }),
+  helper.accessor('roleName', {
+    header: 'Role',
+    id: 'Role',
+  }),
+  helper.display({
+    header: 'Access Origin',
+    cell: AccessCell,
+  }),
+];
+
+const manageAccessLabel = (
+  <span className="inline-flex items-center gap-1">
+    <Icon icon={Users} />
+    Manage access
+  </span>
+);
+
+function AccessCell({
+  row: { original: item },
+}: CellContext<AccessViewerPolicyModel, unknown>) {
+  const { isPureAdmin } = useCurrentUser();
+
+  if (item.roleId === 0) {
+    return (
+      <>
+        User access all environments
+        <div>
+          <Link
+            to="portainer.settings.edgeCompute"
+            data-cy={`manage-access-button-${item.roleName}`}
+          >
+            {manageAccessLabel}
+          </Link>
+        </div>
+      </>
+    );
+  }
+
+  return (
+    <>
+      {prefix(item.teamName)} access defined on{' '}
+      {ACCESS_LOCATION_LABELS[item.accessLocation]}{' '}
+      {!!item.groupName && <code>{item.groupName}</code>}
+      <div>{manageAccess(item, isPureAdmin)}</div>
+    </>
+  );
+}
+
+function prefix(teamName: string | undefined) {
+  if (!teamName) {
+    return 'User';
+  }
+  return (
+    <>
+      Team <code>{teamName}</code>
+    </>
+  );
+}
+
+function manageAccess(item: AccessViewerPolicyModel, isPureAdmin: boolean) {
+  if (!isPureAdmin) {
+    return null;
+  }
+
+  if (item.groupName) {
+    return (
+      <Link
+        to="portainer.groups.group"
+        params={{ id: item.groupId, tab: 'access' }}
+        data-cy={`manage-access-button-${item.roleName}`}
+      >
+        {manageAccessLabel}
+      </Link>
+    );
+  }
+
+  return (
+    <Link
+      to="portainer.endpoints.endpoint.access"
+      params={{ id: item.endpointId }}
+      data-cy={`manage-access-button-${item.roleName}`}
+    >
+      {manageAccessLabel}
+    </Link>
+  );
+}
diff --git a/app/react/portainer/users/RolesView/AccessViewer/model.ts b/app/react/portainer/users/RolesView/AccessViewer/model.ts
new file mode 100644
index 0000000..98ef8a3
--- /dev/null
+++ b/app/react/portainer/users/RolesView/AccessViewer/model.ts
@@ -0,0 +1,31 @@
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { EnvironmentGroup } from '@/react/portainer/environments/environment-groups/types';
+
+import { RbacRole } from '../types';
+import { Team, TeamId } from '../../teams/types';
+
+/**
+ * AccessLocation describes which part of the access model granted the user
+ * their effective role on an environment. Wire values match the CE backend
+ * `AccessLocation` type — display labels are derived in the UI layer.
+ */
+export const AccessLocation = {
+  Environment: 'environment',
+  EnvironmentGroup: 'environmentGroup',
+} as const;
+
+export type AccessLocation =
+  (typeof AccessLocation)[keyof typeof AccessLocation];
+
+export interface AccessViewerPolicyModel {
+  endpointId: EnvironmentId;
+  endpointName: string;
+  roleId: RbacRole['Id'];
+  roleName: RbacRole['Name'];
+  rolePriority: RbacRole['Priority'];
+  groupId?: EnvironmentGroup['Id'];
+  groupName?: EnvironmentGroup['Name'];
+  teamId?: TeamId;
+  teamName?: Team['Name'];
+  accessLocation: AccessLocation;
+}
diff --git a/app/react/portainer/users/RolesView/RbacRolesDatatable.tsx b/app/react/portainer/users/RolesView/RbacRolesDatatable.tsx
new file mode 100644
index 0000000..0c377b5
--- /dev/null
+++ b/app/react/portainer/users/RolesView/RbacRolesDatatable.tsx
@@ -0,0 +1,68 @@
+import { FileCode } from 'lucide-react';
+import { createColumnHelper } from '@tanstack/react-table';
+import _ from 'lodash';
+
+import { RoleTypes } from '@/portainer/rbac/models/role';
+
+import { Datatable } from '@@/datatables';
+import { createPersistedStore } from '@@/datatables/types';
+import { useTableState } from '@@/datatables/useTableState';
+import { BEFeatureIndicator } from '@@/BEFeatureIndicator';
+
+import { isBE } from '../../feature-flags/feature-flags.service';
+import { FeatureId } from '../../feature-flags/enums';
+
+import { RbacRole } from './types';
+
+const tableKey = 'rbac-roles-table';
+
+const store = createPersistedStore(tableKey);
+
+const columns = getColumns();
+
+export function RbacRolesDatatable({
+  dataset,
+}: {
+  dataset: Array<RbacRole> | undefined;
+}) {
+  const tableState = useTableState(store, tableKey);
+
+  return (
+    <Datatable
+      title="Roles"
+      titleIcon={FileCode}
+      dataset={dataset || []}
+      columns={columns}
+      isLoading={!dataset}
+      settingsManager={tableState}
+      disableSelect
+      data-cy="rbac-roles-datatable"
+    />
+  );
+}
+
+function getColumns() {
+  const columnHelper = createColumnHelper<RbacRole>();
+
+  return _.compact([
+    columnHelper.accessor('Name', {
+      header: 'Name',
+    }),
+    columnHelper.accessor('Description', {
+      header: 'Description',
+    }),
+    !isBE &&
+      columnHelper.display({
+        id: 'be-indicator',
+        cell: ({ row: { original: item } }) =>
+          item.Id === RoleTypes.STANDARD ? (
+            <b>Default</b>
+          ) : (
+            <BEFeatureIndicator featureId={FeatureId.RBAC_ROLES} />
+          ),
+        meta: {
+          className: 'text-center',
+        },
+      }),
+  ]);
+}
diff --git a/app/react/portainer/users/RolesView/types.ts b/app/react/portainer/users/RolesView/types.ts
new file mode 100644
index 0000000..ca4e6d5
--- /dev/null
+++ b/app/react/portainer/users/RolesView/types.ts
@@ -0,0 +1,11 @@
+export interface AuthorizationMap {
+  [authorization: string]: boolean;
+}
+
+export interface RbacRole {
+  Id: number;
+  Name: string;
+  Description: string;
+  Authorizations: AuthorizationMap;
+  Priority: number;
+}
diff --git a/app/react/portainer/users/RolesView/useRbacRoles.ts b/app/react/portainer/users/RolesView/useRbacRoles.ts
new file mode 100644
index 0000000..6135889
--- /dev/null
+++ b/app/react/portainer/users/RolesView/useRbacRoles.ts
@@ -0,0 +1,25 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { RbacRole } from './types';
+
+export function useRbacRoles<T = Array<RbacRole>>({
+  select,
+}: {
+  select: (roles: Array<RbacRole>) => T;
+}) {
+  return useQuery({
+    select,
+    queryKey: ['roles'],
+    queryFn: async () => {
+      try {
+        const { data } = await axios.get<Array<RbacRole>>('/roles');
+
+        return data;
+      } catch (e) {
+        throw parseAxiosError(e, 'Failed to fetch roles');
+      }
+    },
+  });
+}
diff --git a/app/react/portainer/users/queries/useCreateUserMutation.ts b/app/react/portainer/users/queries/useCreateUserMutation.ts
new file mode 100644
index 0000000..838e9db
--- /dev/null
+++ b/app/react/portainer/users/queries/useCreateUserMutation.ts
@@ -0,0 +1,43 @@
+import { useQueryClient, useMutation } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError, withInvalidate } from '@/react-tools/react-query';
+import { userQueryKeys } from '@/portainer/users/queries/queryKeys';
+import { buildUrl } from '@/portainer/users/user.service';
+import { Role, User } from '@/portainer/users/types';
+
+import { TeamId, TeamRole } from '../teams/types';
+import { createTeamMembership } from '../teams/queries';
+
+interface CreateUserPayload {
+  username: string;
+  password: string;
+  role: Role;
+  teams: Array<TeamId>;
+}
+
+export function useCreateUserMutation() {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: async (values: CreateUserPayload) => {
+      const user = await createUser(values);
+      return Promise.all(
+        values.teams.map((id) =>
+          createTeamMembership(user.Id, id, TeamRole.Member)
+        )
+      );
+    },
+    ...withInvalidate(queryClient, [userQueryKeys.base()]),
+    ...withError('Unable to create user'),
+  });
+}
+
+async function createUser(payload: CreateUserPayload) {
+  try {
+    const { data } = await axios.post<User>(buildUrl(), payload);
+    return data;
+  } catch (err) {
+    throw parseAxiosError(err, 'Unable to create user');
+  }
+}
diff --git a/app/react/portainer/users/queries/useDeleteUserMutation.ts b/app/react/portainer/users/queries/useDeleteUserMutation.ts
new file mode 100644
index 0000000..7109d3c
--- /dev/null
+++ b/app/react/portainer/users/queries/useDeleteUserMutation.ts
@@ -0,0 +1,24 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError, withInvalidate } from '@/react-tools/react-query';
+import { UserId } from '@/portainer/users/types';
+import { buildUrl } from '@/portainer/users/user.service';
+import { userQueryKeys } from '@/portainer/users/queries/queryKeys';
+
+export function useDeleteUserMutation() {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: (id: UserId) => deleteUser(id),
+    ...withError('Unable to delete user'),
+    ...withInvalidate(queryClient, [userQueryKeys.base()]),
+  });
+}
+
+export async function deleteUser(id: UserId) {
+  try {
+    await axios.delete(buildUrl(id));
+  } catch (error) {
+    throw parseAxiosError(error);
+  }
+}
diff --git a/app/react/portainer/users/teams/ItemView/Details.tsx b/app/react/portainer/users/teams/ItemView/Details.tsx
new file mode 100644
index 0000000..3f225d8
--- /dev/null
+++ b/app/react/portainer/users/teams/ItemView/Details.tsx
@@ -0,0 +1,76 @@
+import { useRouter } from '@uirouter/react';
+import { Users } from 'lucide-react';
+
+import { usePublicSettings } from '@/react/portainer/settings/queries';
+
+import { Widget } from '@@/Widget';
+import { DeleteButton } from '@@/buttons/DeleteButton';
+
+import { Team, TeamMembership, TeamRole } from '../types';
+import { useDeleteTeamMutation } from '../queries/useDeleteTeamMutation';
+
+interface Props {
+  team: Team;
+  memberships: TeamMembership[];
+  isAdmin: boolean;
+}
+
+export function Details({ team, memberships, isAdmin }: Props) {
+  const deleteMutation = useDeleteTeamMutation();
+  const router = useRouter();
+  const teamSyncQuery = usePublicSettings<boolean>({
+    select: (settings) => settings.TeamSync,
+  });
+
+  const leaderCount = memberships.filter(
+    (m) => m.Role === TeamRole.Leader
+  ).length;
+
+  return (
+    <div className="row">
+      <div className="col-lg-12 col-md-12 col-xs-12">
+        <Widget>
+          <Widget.Title title="Team details" icon={Users} />
+
+          <Widget.Body className="no-padding">
+            <table className="table">
+              <tbody>
+                <tr>
+                  <td>Name</td>
+                  <td>
+                    <div className="flex gap-2">
+                      {!teamSyncQuery.data && team.Name}
+                      {isAdmin && (
+                        <DeleteButton
+                          size="xsmall"
+                          onConfirmed={handleDeleteClick}
+                          confirmMessage="Do you want to delete this team? Users in this team will not be deleted."
+                          data-cy={`delete-team-${team.Name}`}
+                        >
+                          Delete this team
+                        </DeleteButton>
+                      )}
+                    </div>
+                  </td>
+                </tr>
+                <tr>
+                  <td>Leaders</td>
+                  <td>{!teamSyncQuery.data && leaderCount}</td>
+                </tr>
+                <tr>
+                  <td>Total users in team</td>
+                  <td>{memberships.length}</td>
+                </tr>
+              </tbody>
+            </table>
+          </Widget.Body>
+        </Widget>
+      </div>
+    </div>
+  );
+
+  async function handleDeleteClick() {
+    router.stateService.go('portainer.teams');
+    deleteMutation.mutate(team.Id);
+  }
+}
diff --git a/app/react/portainer/users/teams/ItemView/ItemView.tsx b/app/react/portainer/users/teams/ItemView/ItemView.tsx
new file mode 100644
index 0000000..286c25e
--- /dev/null
+++ b/app/react/portainer/users/teams/ItemView/ItemView.tsx
@@ -0,0 +1,76 @@
+import { useRouter } from '@uirouter/react';
+
+import { useUsers } from '@/portainer/users/queries';
+import { useIsPureAdmin } from '@/react/hooks/useUser';
+import { usePublicSettings } from '@/react/portainer/settings/queries';
+
+import { TextTip } from '@@/Tip/TextTip';
+import { PageHeader } from '@@/PageHeader';
+
+import { useTeam, useTeamMemberships } from '../queries';
+
+import { Details } from './Details';
+import { TeamAssociationSelector } from './TeamAssociationSelector';
+import { useTeamIdParam } from './useTeamIdParam';
+
+export function ItemView() {
+  const teamId = useTeamIdParam();
+
+  const isPureAdmin = useIsPureAdmin();
+  const router = useRouter();
+  const teamQuery = useTeam(teamId, () =>
+    router.stateService.go('portainer.teams')
+  );
+  const usersQuery = useUsers();
+  const membershipsQuery = useTeamMemberships(teamId);
+  const teamSyncQuery = usePublicSettings<boolean>({
+    select: (settings) => settings.TeamSync,
+  });
+
+  if (!teamQuery.data) {
+    return null;
+  }
+
+  const team = teamQuery.data;
+
+  return (
+    <>
+      <PageHeader
+        title="Team details"
+        breadcrumbs={[
+          { label: 'Teams', link: 'portainer.teams' },
+          { label: team.Name },
+        ]}
+        reload
+      />
+
+      {membershipsQuery.data && (
+        <Details
+          team={team}
+          memberships={membershipsQuery.data}
+          isAdmin={isPureAdmin}
+        />
+      )}
+
+      {teamSyncQuery.data && (
+        <div className="row">
+          <div className="col-sm-12">
+            <TextTip color="orange">
+              The team leader feature is disabled as external authentication is
+              currently enabled with team sync.
+            </TextTip>
+          </div>
+        </div>
+      )}
+
+      {usersQuery.data && membershipsQuery.data && (
+        <TeamAssociationSelector
+          teamId={teamId}
+          memberships={membershipsQuery.data}
+          users={usersQuery.data}
+          disabled={teamSyncQuery.data}
+        />
+      )}
+    </>
+  );
+}
diff --git a/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/TeamAssociationSelector.module.css b/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/TeamAssociationSelector.module.css
new file mode 100644
index 0000000..ac047a0
--- /dev/null
+++ b/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/TeamAssociationSelector.module.css
@@ -0,0 +1,11 @@
+.root {
+  display: flex;
+  flex-direction: row;
+  width: 100%;
+  justify-content: space-around;
+  gap: 30px;
+}
+
+.root > * {
+  flex: 1;
+}
diff --git a/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/TeamAssociationSelector.stories.tsx b/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/TeamAssociationSelector.stories.tsx
new file mode 100644
index 0000000..97fedbc
--- /dev/null
+++ b/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/TeamAssociationSelector.stories.tsx
@@ -0,0 +1,55 @@
+import { Meta } from '@storybook/react-webpack5';
+import { useMemo, useState } from 'react';
+
+import { createMockUsers } from '@/react-tools/test-mocks';
+import { Role } from '@/portainer/users/types';
+import { UserViewModel } from '@/portainer/models/user';
+import { UserContext } from '@/react/hooks/useUser';
+
+import { TeamMembership, TeamRole } from '../../types';
+
+import { TeamAssociationSelector } from './TeamAssociationSelector';
+
+const meta: Meta = {
+  title: 'Components/Teams/TeamAssociationSelector',
+  component: TeamAssociationSelector,
+};
+
+export default meta;
+
+export { Example };
+
+interface Args {
+  userRole: Role;
+}
+
+function Example({ userRole }: Args) {
+  const userProviderState = useMemo(
+    () => ({ user: new UserViewModel({ Role: userRole }) }),
+    [userRole]
+  );
+  const [users] = useState(createMockUsers(20, Role.Standard));
+
+  const [memberships] = useState<Omit<TeamMembership, 'Id' | 'TeamID'>[]>(
+    users
+      .filter(() => Math.random() > 0.5)
+      .map((u) => ({
+        UserID: u.Id,
+        Role: Math.random() > 0.5 ? TeamRole.Leader : TeamRole.Member,
+      }))
+  );
+
+  return (
+    <UserContext.Provider value={userProviderState}>
+      <TeamAssociationSelector
+        teamId={3}
+        users={users}
+        memberships={memberships as TeamMembership[]}
+      />
+    </UserContext.Provider>
+  );
+}
+
+Example.args = {
+  userRole: TeamRole.Leader,
+};
diff --git a/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/TeamAssociationSelector.test.tsx b/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/TeamAssociationSelector.test.tsx
new file mode 100644
index 0000000..fe5dc5c
--- /dev/null
+++ b/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/TeamAssociationSelector.test.tsx
@@ -0,0 +1,23 @@
+import { render } from '@testing-library/react';
+
+import { UserViewModel } from '@/portainer/models/user';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+
+import { TeamAssociationSelector } from './TeamAssociationSelector';
+
+test('renders correctly', () => {
+  const queries = renderComponent();
+
+  expect(queries).toBeTruthy();
+});
+
+function renderComponent() {
+  const user = new UserViewModel({ Username: 'user' });
+
+  const Wrapped = withTestQueryProvider(
+    withUserProvider(TeamAssociationSelector, user)
+  );
+
+  return render(<Wrapped users={[]} memberships={[]} teamId={3} />);
+}
diff --git a/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/TeamAssociationSelector.tsx b/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/TeamAssociationSelector.tsx
new file mode 100644
index 0000000..9f4d085
--- /dev/null
+++ b/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/TeamAssociationSelector.tsx
@@ -0,0 +1,48 @@
+import _ from 'lodash';
+
+import { User } from '@/portainer/users/types';
+
+import { TeamId, TeamMembership } from '../../types';
+
+import { UsersList } from './UsersList';
+import { TeamMembersList } from './TeamMembersList';
+
+interface Props {
+  users: User[];
+  memberships: TeamMembership[];
+  disabled?: boolean;
+  teamId: TeamId;
+}
+
+export function TeamAssociationSelector({
+  users,
+  memberships,
+  disabled,
+  teamId,
+}: Props) {
+  const teamUsers = _.compact(
+    memberships.map((m) => users.find((user) => user.Id === m.UserID))
+  );
+  const usersNotInTeam = users.filter(
+    (user) => !memberships.some((m) => m.UserID === user.Id)
+  );
+  const userRoles = Object.fromEntries(
+    memberships.map((m) => [m.UserID, m.Role])
+  );
+
+  return (
+    <div className="flex">
+      <div className="w-1/2">
+        <UsersList users={usersNotInTeam} disabled={disabled} teamId={teamId} />
+      </div>
+      <div className="w-1/2">
+        <TeamMembersList
+          teamId={teamId}
+          disabled={disabled}
+          users={teamUsers}
+          roles={userRoles}
+        />
+      </div>
+    </div>
+  );
+}
diff --git a/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/TeamMembersList/RowContext.tsx b/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/TeamMembersList/RowContext.tsx
new file mode 100644
index 0000000..ddfc7ea
--- /dev/null
+++ b/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/TeamMembersList/RowContext.tsx
@@ -0,0 +1,14 @@
+import { TeamRole, TeamId } from '@/react/portainer/users/teams/types';
+import { UserId } from '@/portainer/users/types';
+
+import { createRowContext } from '@@/datatables/RowContext';
+
+export interface RowContext {
+  getRole(userId: UserId): TeamRole;
+  disabled?: boolean;
+  teamId: TeamId;
+}
+
+const { RowProvider, useRowContext } = createRowContext<RowContext>();
+
+export { RowProvider, useRowContext };
diff --git a/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/TeamMembersList/TeamMembersList.module.css b/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/TeamMembersList/TeamMembersList.module.css
new file mode 100644
index 0000000..c3a2af6
--- /dev/null
+++ b/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/TeamMembersList/TeamMembersList.module.css
@@ -0,0 +1,2 @@
+.root {
+}
diff --git a/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/TeamMembersList/TeamMembersList.stories.tsx b/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/TeamMembersList/TeamMembersList.stories.tsx
new file mode 100644
index 0000000..2e49cff
--- /dev/null
+++ b/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/TeamMembersList/TeamMembersList.stories.tsx
@@ -0,0 +1,50 @@
+import { Meta } from '@storybook/react-webpack5';
+import { useMemo, useState } from 'react';
+
+import { UserContext } from '@/react/hooks/useUser';
+import { createMockUsers } from '@/react-tools/test-mocks';
+import { UserViewModel } from '@/portainer/models/user';
+import { Role } from '@/portainer/users/types';
+import { TeamRole } from '@/react/portainer/users/teams/types';
+
+import { TeamMembersList } from './TeamMembersList';
+
+const meta: Meta = {
+  title: 'Components/Teams/TeamAssociationSelector/TeamMembersList',
+  component: TeamMembersList,
+};
+
+export default meta;
+
+export { Example };
+
+interface Args {
+  userRole: Role;
+}
+
+function Example({ userRole }: Args) {
+  const userProviderState = useMemo(
+    () => ({ user: new UserViewModel({ Role: userRole }) }),
+    [userRole]
+  );
+
+  const [users] = useState(createMockUsers(20, Role.Standard));
+  const [roles] = useState(
+    Object.fromEntries(
+      users.map((user) => [
+        user.Id,
+        Math.random() > 0.5 ? TeamRole.Leader : TeamRole.Member,
+      ])
+    )
+  );
+
+  return (
+    <UserContext.Provider value={userProviderState}>
+      <TeamMembersList users={users} roles={roles} teamId={3} />
+    </UserContext.Provider>
+  );
+}
+
+Example.args = {
+  userRole: Role.Admin,
+};
diff --git a/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/TeamMembersList/TeamMembersList.test.tsx b/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/TeamMembersList/TeamMembersList.test.tsx
new file mode 100644
index 0000000..6867347
--- /dev/null
+++ b/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/TeamMembersList/TeamMembersList.test.tsx
@@ -0,0 +1,26 @@
+import { render } from '@testing-library/react';
+
+import { UserViewModel } from '@/portainer/models/user';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+
+import { TeamMembersList } from './TeamMembersList';
+
+test('renders correctly', () => {
+  const queries = renderComponent();
+
+  expect(queries).toBeTruthy();
+});
+
+function renderComponent() {
+  const user = new UserViewModel({ Username: 'user' });
+
+  const Wrapped = withTestQueryProvider(
+    withUserProvider(TeamMembersList, user)
+  );
+
+  return render(<Wrapped users={[]} roles={{}} teamId={3} />);
+}
+
+test.todo('when users list is empty, add all users button is disabled');
+test.todo('filter displays expected users');
diff --git a/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/TeamMembersList/TeamMembersList.tsx b/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/TeamMembersList/TeamMembersList.tsx
new file mode 100644
index 0000000..a3b13c5
--- /dev/null
+++ b/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/TeamMembersList/TeamMembersList.tsx
@@ -0,0 +1,96 @@
+import { useMemo, useState } from 'react';
+import { Users, UserX } from 'lucide-react';
+
+import { User, UserId } from '@/portainer/users/types';
+import { TeamId, TeamRole } from '@/react/portainer/users/teams/types';
+import { useIsPureAdmin } from '@/react/hooks/useUser';
+import { notifySuccess } from '@/portainer/services/notifications';
+import {
+  useRemoveMemberMutation,
+  useTeamMemberships,
+} from '@/react/portainer/users/teams/queries';
+
+import { Button } from '@@/buttons';
+import { Datatable } from '@@/datatables';
+
+import { RowContext, RowProvider } from './RowContext';
+import { columns } from './columns';
+
+interface Props {
+  users: User[];
+  roles: Record<UserId, TeamRole>;
+  disabled?: boolean;
+  teamId: TeamId;
+}
+
+export function TeamMembersList({ users, roles, disabled, teamId }: Props) {
+  const membershipsQuery = useTeamMemberships(teamId);
+
+  const removeMemberMutation = useRemoveMemberMutation(
+    teamId,
+    membershipsQuery.data
+  );
+
+  const [search, setSearch] = useState('');
+  const [pageSize, setPageSize] = useState(10);
+  const [sortBy, setSortBy] = useState<
+    { id: string; desc: boolean } | undefined
+  >({ id: 'name', desc: false });
+
+  const isPureAdmin = useIsPureAdmin();
+  const rowContext = useMemo<RowContext>(
+    () => ({
+      getRole(userId: UserId) {
+        return roles[userId];
+      },
+      disabled,
+      teamId,
+    }),
+    [roles, disabled, teamId]
+  );
+
+  return (
+    <RowProvider context={rowContext}>
+      <Datatable<User>
+        dataset={users}
+        columns={columns}
+        titleIcon={Users}
+        title="Team members"
+        renderTableActions={() =>
+          isPureAdmin && (
+            <Button
+              onClick={() => handleRemoveMembers(users.map((user) => user.Id))}
+              disabled={disabled || users.length === 0}
+              icon={UserX}
+              data-cy="remove-all-users-button"
+            >
+              Remove all users
+            </Button>
+          )
+        }
+        disableSelect
+        settingsManager={{
+          pageSize,
+          setPageSize,
+          sortBy,
+          setSortBy: handleSetSort,
+          search,
+          setSearch,
+        }}
+        data-cy="team-members-datatable"
+      />
+    </RowProvider>
+  );
+
+  function handleSetSort(colId: string | undefined, desc: boolean) {
+    setSortBy(colId ? { id: colId, desc } : undefined);
+  }
+
+  function handleRemoveMembers(userIds: UserId[]) {
+    removeMemberMutation.mutate(userIds, {
+      onSuccess() {
+        notifySuccess('Success', 'All users successfully removed');
+      },
+    });
+  }
+}
diff --git a/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/TeamMembersList/columns/helper.ts b/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/TeamMembersList/columns/helper.ts
new file mode 100644
index 0000000..b488f25
--- /dev/null
+++ b/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/TeamMembersList/columns/helper.ts
@@ -0,0 +1,5 @@
+import { createColumnHelper } from '@tanstack/react-table';
+
+import { User } from '@/portainer/users/types';
+
+export const columnHelper = createColumnHelper<User>();
diff --git a/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/TeamMembersList/columns/index.ts b/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/TeamMembersList/columns/index.ts
new file mode 100644
index 0000000..6581353
--- /dev/null
+++ b/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/TeamMembersList/columns/index.ts
@@ -0,0 +1,4 @@
+import { name } from './name-column';
+import { teamRole } from './team-role-column';
+
+export const columns = [name, teamRole];
diff --git a/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/TeamMembersList/columns/name-column.tsx b/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/TeamMembersList/columns/name-column.tsx
new file mode 100644
index 0000000..434af3f
--- /dev/null
+++ b/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/TeamMembersList/columns/name-column.tsx
@@ -0,0 +1,61 @@
+import { MinusCircle } from 'lucide-react';
+import { CellContext } from '@tanstack/react-table';
+
+import { User, UserId } from '@/portainer/users/types';
+import { notifySuccess } from '@/portainer/services/notifications';
+import {
+  useRemoveMemberMutation,
+  useTeamMemberships,
+} from '@/react/portainer/users/teams/queries';
+
+import { Button } from '@@/buttons';
+
+import { useRowContext } from '../RowContext';
+
+import { columnHelper } from './helper';
+
+export const name = columnHelper.accessor('Username', {
+  header: 'Name',
+  id: 'name',
+  cell: NameCell,
+});
+
+export function NameCell({
+  getValue,
+  row: { original: user },
+}: CellContext<User, string>) {
+  const name = getValue();
+  const { disabled, teamId } = useRowContext();
+
+  const membershipsQuery = useTeamMemberships(teamId);
+
+  const removeMemberMutation = useRemoveMemberMutation(
+    teamId,
+    membershipsQuery.data
+  );
+
+  return (
+    <>
+      {name}
+
+      <Button
+        color="link"
+        data-cy={`remove-member-${user.Username}`}
+        className="space-left !p-0"
+        onClick={() => handleRemoveMember(user.Id)}
+        disabled={disabled}
+        icon={MinusCircle}
+      >
+        Remove
+      </Button>
+    </>
+  );
+
+  function handleRemoveMember(userId: UserId) {
+    removeMemberMutation.mutate([userId], {
+      onSuccess() {
+        notifySuccess('User removed from team', name);
+      },
+    });
+  }
+}
diff --git a/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/TeamMembersList/columns/team-role-column.tsx b/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/TeamMembersList/columns/team-role-column.tsx
new file mode 100644
index 0000000..ee59f28
--- /dev/null
+++ b/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/TeamMembersList/columns/team-role-column.tsx
@@ -0,0 +1,116 @@
+import { User as UserIcon, UserPlus, UserX } from 'lucide-react';
+import { CellContext } from '@tanstack/react-table';
+
+import { User } from '@/portainer/users/types';
+import { useCurrentUser } from '@/react/hooks/useUser';
+import { TeamRole } from '@/react/portainer/users/teams/types';
+import { notifySuccess } from '@/portainer/services/notifications';
+import {
+  useTeamMemberships,
+  useUpdateRoleMutation,
+} from '@/react/portainer/users/teams/queries';
+
+import { Button } from '@@/buttons';
+import { Icon } from '@@/Icon';
+
+import { useRowContext } from '../RowContext';
+
+import { columnHelper } from './helper';
+
+export const teamRole = columnHelper.accessor('Id', {
+  header: 'Team Role',
+  id: 'role',
+  cell: RoleCell,
+});
+
+function RoleCell({
+  row: { original: user },
+  getValue,
+}: CellContext<User, User['Id']>) {
+  const id = getValue();
+
+  const { getRole, disabled, teamId } = useRowContext();
+  const membershipsQuery = useTeamMemberships(teamId);
+  const updateRoleMutation = useUpdateRoleMutation(
+    teamId,
+    membershipsQuery.data
+  );
+
+  const role = getRole(id);
+
+  const { isPureAdmin } = useCurrentUser();
+
+  const Cell = role === TeamRole.Leader ? LeaderCell : MemberCell;
+
+  return (
+    <Cell
+      isAdmin={isPureAdmin}
+      onClick={handleUpdateRole}
+      disabled={disabled}
+      username={user.Username}
+    />
+  );
+
+  function handleUpdateRole(role: TeamRole, onSuccessMessage: string) {
+    updateRoleMutation.mutate(
+      { userId: user.Id, role },
+      {
+        onSuccess() {
+          notifySuccess(onSuccessMessage, user.Username);
+        },
+      }
+    );
+  }
+}
+
+interface LeaderCellProps {
+  isAdmin: boolean;
+  onClick: (role: TeamRole, onSuccessMessage: string) => void;
+  username: string;
+  disabled?: boolean;
+}
+
+function LeaderCell({ isAdmin, onClick, disabled, username }: LeaderCellProps) {
+  return (
+    <div className="flex items-center">
+      <Icon className="space-right" icon={UserPlus} mode="secondary-alt" />
+
+      {isAdmin && (
+        <Button
+          color="link"
+          className="nopadding"
+          onClick={() => onClick(TeamRole.Member, 'User is now team member')}
+          disabled={disabled}
+          icon={UserX}
+          data-cy={`remove-leader-${username}`}
+        >
+          Member
+        </Button>
+      )}
+    </div>
+  );
+}
+
+interface MemberCellProps {
+  onClick: (role: TeamRole, onSuccessMessage: string) => void;
+  disabled?: boolean;
+  username: string;
+}
+
+function MemberCell({ onClick, disabled, username }: MemberCellProps) {
+  return (
+    <div className="flex items-center">
+      <Icon className="space-right" icon={UserIcon} mode="secondary-alt" />
+      <Button
+        color="link"
+        className="nopadding"
+        onClick={() => onClick(TeamRole.Leader, 'User is now team leader')}
+        disabled={disabled}
+        icon={UserPlus}
+        data-cy={`make-leader-${username}`}
+      >
+        Leader
+      </Button>
+    </div>
+  );
+}
diff --git a/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/TeamMembersList/index.ts b/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/TeamMembersList/index.ts
new file mode 100644
index 0000000..2ee4b36
--- /dev/null
+++ b/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/TeamMembersList/index.ts
@@ -0,0 +1 @@
+export { TeamMembersList } from './TeamMembersList';
diff --git a/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/UsersList/RowContext.tsx b/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/UsersList/RowContext.tsx
new file mode 100644
index 0000000..c7b21f0
--- /dev/null
+++ b/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/UsersList/RowContext.tsx
@@ -0,0 +1,12 @@
+import { TeamId } from '@/react/portainer/users/teams/types';
+
+import { createRowContext } from '@@/datatables/RowContext';
+
+interface RowContext {
+  disabled?: boolean;
+  teamId: TeamId;
+}
+
+const { RowProvider, useRowContext } = createRowContext<RowContext>();
+
+export { RowProvider, useRowContext };
diff --git a/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/UsersList/UsersList.module.css b/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/UsersList/UsersList.module.css
new file mode 100644
index 0000000..c3a2af6
--- /dev/null
+++ b/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/UsersList/UsersList.module.css
@@ -0,0 +1,2 @@
+.root {
+}
diff --git a/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/UsersList/UsersList.stories.tsx b/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/UsersList/UsersList.stories.tsx
new file mode 100644
index 0000000..c024ca7
--- /dev/null
+++ b/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/UsersList/UsersList.stories.tsx
@@ -0,0 +1,41 @@
+import { Meta } from '@storybook/react-webpack5';
+import { useMemo } from 'react';
+
+import { createMockUsers } from '@/react-tools/test-mocks';
+import { Role } from '@/portainer/users/types';
+import { UserContext } from '@/react/hooks/useUser';
+import { UserViewModel } from '@/portainer/models/user';
+
+import { UsersList } from './UsersList';
+
+const meta: Meta = {
+  title: 'Components/Teams/TeamAssociationSelector/UsersList',
+  component: UsersList,
+};
+
+export default meta;
+
+export { Example };
+
+interface Args {
+  userRole: Role;
+}
+
+function Example({ userRole }: Args) {
+  const userProviderState = useMemo(
+    () => ({ user: new UserViewModel({ Role: userRole }) }),
+    [userRole]
+  );
+
+  const users = createMockUsers(20, Role.Standard);
+
+  return (
+    <UserContext.Provider value={userProviderState}>
+      <UsersList users={users} teamId={3} />
+    </UserContext.Provider>
+  );
+}
+
+Example.args = {
+  userRole: Role.Admin,
+};
diff --git a/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/UsersList/UsersList.test.tsx b/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/UsersList/UsersList.test.tsx
new file mode 100644
index 0000000..0e92ae3
--- /dev/null
+++ b/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/UsersList/UsersList.test.tsx
@@ -0,0 +1,24 @@
+import { render } from '@testing-library/react';
+
+import { UserViewModel } from '@/portainer/models/user';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+
+import { UsersList } from './UsersList';
+
+test('renders correctly', () => {
+  const queries = renderComponent();
+
+  expect(queries).toBeTruthy();
+});
+
+function renderComponent() {
+  const user = new UserViewModel({ Username: 'user' });
+
+  const Wrapped = withTestQueryProvider(withUserProvider(UsersList, user));
+
+  return render(<Wrapped users={[]} teamId={3} />);
+}
+
+test.todo('when users list is empty, add all users button is disabled');
+test.todo('filter displays expected users');
diff --git a/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/UsersList/UsersList.tsx b/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/UsersList/UsersList.tsx
new file mode 100644
index 0000000..21e700c
--- /dev/null
+++ b/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/UsersList/UsersList.tsx
@@ -0,0 +1,80 @@
+import { useMemo, useState } from 'react';
+import { UserPlus, Users } from 'lucide-react';
+
+import { User, UserId } from '@/portainer/users/types';
+import { useCurrentUser } from '@/react/hooks/useUser';
+import { notifySuccess } from '@/portainer/services/notifications';
+import { useAddMemberMutation } from '@/react/portainer/users/teams/queries';
+import { TeamId } from '@/react/portainer/users/teams/types';
+
+import { Button } from '@@/buttons';
+import { Datatable } from '@@/datatables';
+
+import { name } from './name-column';
+import { RowProvider } from './RowContext';
+
+const columns = [name];
+
+interface Props {
+  users: User[];
+  disabled?: boolean;
+  teamId: TeamId;
+}
+
+export function UsersList({ users, disabled, teamId }: Props) {
+  const [search, setSearch] = useState('');
+  const [pageSize, setPageSize] = useState(10);
+  const addMemberMutation = useAddMemberMutation(teamId);
+  const [sortBy, setSortBy] = useState<
+    { id: string; desc: boolean } | undefined
+  >({ id: 'name', desc: false });
+
+  const { isPureAdmin } = useCurrentUser();
+
+  const rowContext = useMemo(() => ({ disabled, teamId }), [disabled, teamId]);
+
+  return (
+    <RowProvider context={rowContext}>
+      <Datatable<User>
+        dataset={users}
+        columns={columns}
+        titleIcon={Users}
+        title="Users"
+        renderTableActions={() =>
+          isPureAdmin && (
+            <Button
+              onClick={() => handleAddAllMembers(users.map((u) => u.Id))}
+              disabled={disabled || users.length === 0}
+              icon={UserPlus}
+              data-cy="add-all-users-button"
+            >
+              Add all users
+            </Button>
+          )
+        }
+        disableSelect
+        settingsManager={{
+          pageSize,
+          setPageSize,
+          sortBy,
+          setSortBy: handleSetSort,
+          search,
+          setSearch,
+        }}
+        data-cy="users-datatable"
+      />
+    </RowProvider>
+  );
+
+  function handleSetSort(colId: string | undefined, desc: boolean) {
+    setSortBy(colId ? { id: colId, desc } : undefined);
+  }
+
+  function handleAddAllMembers(userIds: UserId[]) {
+    addMemberMutation.mutate(userIds, {
+      onSuccess() {
+        notifySuccess('Success', 'All users successfully added');
+      },
+    });
+  }
+}
diff --git a/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/UsersList/index.ts b/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/UsersList/index.ts
new file mode 100644
index 0000000..f484059
--- /dev/null
+++ b/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/UsersList/index.ts
@@ -0,0 +1 @@
+export { UsersList } from './UsersList';
diff --git a/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/UsersList/name-column.tsx b/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/UsersList/name-column.tsx
new file mode 100644
index 0000000..c8f0215
--- /dev/null
+++ b/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/UsersList/name-column.tsx
@@ -0,0 +1,52 @@
+import { PlusCircle } from 'lucide-react';
+import { CellContext, ColumnDef } from '@tanstack/react-table';
+
+import { User } from '@/portainer/users/types';
+import { notifySuccess } from '@/portainer/services/notifications';
+import { useAddMemberMutation } from '@/react/portainer/users/teams/queries';
+
+import { Button } from '@@/buttons';
+
+import { useRowContext } from './RowContext';
+
+export const name: ColumnDef<User, string> = {
+  header: 'Name',
+  accessorFn: (row) => row.Username,
+  id: 'name',
+  cell: NameCell,
+};
+
+export function NameCell({
+  getValue,
+  row: { original: user },
+}: CellContext<User, string>) {
+  const name = getValue();
+  const { disabled, teamId } = useRowContext();
+
+  const addMemberMutation = useAddMemberMutation(teamId);
+
+  return (
+    <>
+      {name}
+
+      <Button
+        color="link"
+        data-cy={`add-member-${user.Username}`}
+        className="space-left nopadding"
+        disabled={disabled}
+        icon={PlusCircle}
+        onClick={() => handleAddMember()}
+      >
+        Add
+      </Button>
+    </>
+  );
+
+  function handleAddMember() {
+    addMemberMutation.mutate([user.Id], {
+      onSuccess() {
+        notifySuccess('User added to team', name);
+      },
+    });
+  }
+}
diff --git a/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/index.ts b/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/index.ts
new file mode 100644
index 0000000..d88f65e
--- /dev/null
+++ b/app/react/portainer/users/teams/ItemView/TeamAssociationSelector/index.ts
@@ -0,0 +1 @@
+export { TeamAssociationSelector } from './TeamAssociationSelector';
diff --git a/app/react/portainer/users/teams/ItemView/index.ts b/app/react/portainer/users/teams/ItemView/index.ts
new file mode 100644
index 0000000..a09ab2d
--- /dev/null
+++ b/app/react/portainer/users/teams/ItemView/index.ts
@@ -0,0 +1 @@
+export { ItemView } from './ItemView';
diff --git a/app/react/portainer/users/teams/ItemView/useTeamIdParam.ts b/app/react/portainer/users/teams/ItemView/useTeamIdParam.ts
new file mode 100644
index 0000000..0c89593
--- /dev/null
+++ b/app/react/portainer/users/teams/ItemView/useTeamIdParam.ts
@@ -0,0 +1,14 @@
+import { useCurrentStateAndParams } from '@uirouter/react';
+
+export function useTeamIdParam() {
+  const {
+    params: { id: teamIdParam },
+  } = useCurrentStateAndParams();
+  const teamId = parseInt(teamIdParam, 10);
+
+  if (!teamIdParam || Number.isNaN(teamId)) {
+    throw new Error('Team ID is missing');
+  }
+
+  return teamId;
+}
diff --git a/app/react/portainer/users/teams/ListView/CreateTeamForm/CreateTeamForm.mocks.ts b/app/react/portainer/users/teams/ListView/CreateTeamForm/CreateTeamForm.mocks.ts
new file mode 100644
index 0000000..9bd2640
--- /dev/null
+++ b/app/react/portainer/users/teams/ListView/CreateTeamForm/CreateTeamForm.mocks.ts
@@ -0,0 +1,78 @@
+import { TeamViewModel } from '@/portainer/models/team';
+import { UserViewModel } from '@/portainer/models/user';
+
+export function mockExampleData() {
+  const teams: TeamViewModel[] = [
+    {
+      Id: 3,
+      Name: 'Team 1',
+      Checked: false,
+    },
+    {
+      Id: 4,
+      Name: 'Team 2',
+      Checked: false,
+    },
+  ];
+
+  const users: UserViewModel[] = [
+    {
+      Id: 10,
+      Username: 'user1',
+      Role: 2,
+      ThemeSettings: {
+        color: 'auto',
+      },
+      EndpointAuthorizations: {},
+      PortainerAuthorizations: {
+        PortainerDockerHubInspect: true,
+        PortainerEndpointGroupInspect: true,
+        PortainerEndpointGroupList: true,
+        PortainerEndpointInspect: true,
+        PortainerEndpointList: true,
+        PortainerMOTD: true,
+        PortainerRoleList: true,
+        PortainerTeamList: true,
+        PortainerTemplateInspect: true,
+        PortainerTemplateList: true,
+        PortainerUserInspect: true,
+        PortainerUserList: true,
+        PortainerUserMemberships: true,
+      },
+      RoleName: 'user',
+      Checked: false,
+      AuthenticationMethod: '',
+      UseCache: false,
+    },
+    {
+      Id: 13,
+      Username: 'user2',
+      Role: 2,
+      ThemeSettings: {
+        color: 'auto',
+      },
+      EndpointAuthorizations: {},
+      PortainerAuthorizations: {
+        PortainerDockerHubInspect: true,
+        PortainerEndpointGroupInspect: true,
+        PortainerEndpointGroupList: true,
+        PortainerEndpointInspect: true,
+        PortainerEndpointList: true,
+        PortainerMOTD: true,
+        PortainerRoleList: true,
+        PortainerTeamList: true,
+        PortainerTemplateInspect: true,
+        PortainerTemplateList: true,
+        PortainerUserInspect: true,
+        PortainerUserList: true,
+        PortainerUserMemberships: true,
+      },
+      RoleName: 'user',
+      Checked: false,
+      AuthenticationMethod: '',
+      UseCache: false,
+    },
+  ];
+
+  return { users, teams };
+}
diff --git a/app/react/portainer/users/teams/ListView/CreateTeamForm/CreateTeamForm.stories.tsx b/app/react/portainer/users/teams/ListView/CreateTeamForm/CreateTeamForm.stories.tsx
new file mode 100644
index 0000000..9f94b74
--- /dev/null
+++ b/app/react/portainer/users/teams/ListView/CreateTeamForm/CreateTeamForm.stories.tsx
@@ -0,0 +1,23 @@
+import { Meta } from '@storybook/react-webpack5';
+
+import { CreateTeamForm } from './CreateTeamForm';
+import { mockExampleData } from './CreateTeamForm.mocks';
+
+const meta: Meta = {
+  title: 'Components/Teams/CreateTeamForm',
+  component: CreateTeamForm,
+};
+
+export default meta;
+
+export { Example };
+
+function Example() {
+  const { teams, users } = mockExampleData();
+
+  return (
+    <div>
+      <CreateTeamForm users={users} teams={teams} />
+    </div>
+  );
+}
diff --git a/app/react/portainer/users/teams/ListView/CreateTeamForm/CreateTeamForm.test.tsx b/app/react/portainer/users/teams/ListView/CreateTeamForm/CreateTeamForm.test.tsx
new file mode 100644
index 0000000..04716ba
--- /dev/null
+++ b/app/react/portainer/users/teams/ListView/CreateTeamForm/CreateTeamForm.test.tsx
@@ -0,0 +1,31 @@
+import userEvent from '@testing-library/user-event';
+import { render, waitFor } from '@testing-library/react';
+
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+
+import { CreateTeamForm } from './CreateTeamForm';
+
+test('filling the name should make the submit button clickable and emptying it should make it disabled', async () => {
+  const Wrapped = withTestQueryProvider(CreateTeamForm);
+
+  const { findByLabelText, findByText } = render(
+    <Wrapped users={[]} teams={[]} />
+  );
+
+  const button = await findByText('Create team');
+  expect(button).toBeVisible();
+
+  const nameField = await findByLabelText('Name*');
+  expect(nameField).toBeVisible();
+  expect(nameField).toHaveDisplayValue('');
+
+  expect(button).toBeDisabled();
+
+  const newValue = 'name';
+  await userEvent.type(nameField, newValue);
+
+  await waitFor(() => {
+    expect(nameField).toHaveDisplayValue(newValue);
+    expect(button).toBeEnabled();
+  });
+});
diff --git a/app/react/portainer/users/teams/ListView/CreateTeamForm/CreateTeamForm.tsx b/app/react/portainer/users/teams/ListView/CreateTeamForm/CreateTeamForm.tsx
new file mode 100644
index 0000000..882768c
--- /dev/null
+++ b/app/react/portainer/users/teams/ListView/CreateTeamForm/CreateTeamForm.tsx
@@ -0,0 +1,148 @@
+import { Formik, Field, Form } from 'formik';
+import { useReducer } from 'react';
+import { Plus } from 'lucide-react';
+
+import { User } from '@/portainer/users/types';
+import { notifySuccess } from '@/portainer/services/notifications';
+import { usePublicSettings } from '@/react/portainer/settings/queries';
+
+import { FormControl } from '@@/form-components/FormControl';
+import { Widget } from '@@/Widget';
+import { Input } from '@@/form-components/Input';
+import { UsersSelector } from '@@/UsersSelector';
+import { LoadingButton } from '@@/buttons/LoadingButton';
+import { TextTip } from '@@/Tip/TextTip';
+
+import { Team } from '../../types';
+import { useAddTeamMutation } from '../../queries/useAddTeamMutation';
+
+import { FormValues } from './types';
+import { validationSchema } from './CreateTeamForm.validation';
+
+interface Props {
+  users: User[];
+  teams: Team[];
+}
+
+export function CreateTeamForm({ users, teams }: Props) {
+  const addTeamMutation = useAddTeamMutation();
+  const [formKey, incFormKey] = useReducer((state: number) => state + 1, 0);
+  const teamSyncQuery = usePublicSettings<boolean>({
+    select: (settings) => settings.TeamSync,
+  });
+
+  const initialValues = {
+    name: '',
+    leaders: [],
+  };
+
+  return (
+    <div className="row">
+      <div className="col-lg-12 col-md-12 col-xs-12">
+        <Widget>
+          <Widget.Title
+            icon={Plus}
+            title="Add a new team"
+            className="vertical-center"
+          />
+          <Widget.Body>
+            <Formik
+              initialValues={initialValues}
+              validationSchema={() => validationSchema(teams)}
+              onSubmit={handleAddTeamClick}
+              validateOnMount
+              key={formKey}
+            >
+              {({
+                values,
+                errors,
+                handleSubmit,
+                setFieldValue,
+                isSubmitting,
+                isValid,
+              }) => (
+                <Form
+                  className="form-horizontal"
+                  onSubmit={handleSubmit}
+                  noValidate
+                >
+                  <FormControl
+                    inputId="team_name"
+                    label="Name"
+                    errors={errors.name}
+                    required
+                  >
+                    <Field
+                      as={Input}
+                      name="name"
+                      id="team_name"
+                      required
+                      placeholder="e.g. development"
+                      data-cy="team-teamNameInput"
+                    />
+                  </FormControl>
+
+                  {users.length > 0 && (
+                    <FormControl
+                      inputId="users-input"
+                      label="Select team leader(s)"
+                      tooltip="You can assign one or more leaders to this team. Team leaders can manage their teams users and resources."
+                      errors={errors.leaders}
+                    >
+                      <UsersSelector
+                        value={values.leaders}
+                        onChange={(leaders) =>
+                          setFieldValue('leaders', leaders)
+                        }
+                        users={users}
+                        dataCy="team-teamLeaderSelect"
+                        inputId="users-input"
+                        placeholder="Select one or more team leaders"
+                        disabled={teamSyncQuery.data}
+                      />
+                    </FormControl>
+                  )}
+
+                  {teamSyncQuery.data && (
+                    <div className="form-group">
+                      <div className="col-sm-12">
+                        <TextTip color="orange">
+                          The team leader feature is disabled as external
+                          authentication is currently enabled with team sync.
+                        </TextTip>
+                      </div>
+                    </div>
+                  )}
+
+                  <div className="form-group">
+                    <div className="col-sm-12">
+                      <LoadingButton
+                        disabled={!isValid}
+                        data-cy="team-createTeamButton"
+                        isLoading={isSubmitting || addTeamMutation.isLoading}
+                        loadingText="Creating team..."
+                        icon={Plus}
+                        className="!ml-0"
+                      >
+                        Create team
+                      </LoadingButton>
+                    </div>
+                  </div>
+                </Form>
+              )}
+            </Formik>
+          </Widget.Body>
+        </Widget>
+      </div>
+    </div>
+  );
+
+  async function handleAddTeamClick(values: FormValues) {
+    addTeamMutation.mutate(values, {
+      onSuccess() {
+        incFormKey();
+        notifySuccess('Team successfully added', '');
+      },
+    });
+  }
+}
diff --git a/app/react/portainer/users/teams/ListView/CreateTeamForm/CreateTeamForm.validation.ts b/app/react/portainer/users/teams/ListView/CreateTeamForm/CreateTeamForm.validation.ts
new file mode 100644
index 0000000..b9c4088
--- /dev/null
+++ b/app/react/portainer/users/teams/ListView/CreateTeamForm/CreateTeamForm.validation.ts
@@ -0,0 +1,16 @@
+import { object, string, array, number } from 'yup';
+
+import { Team } from '@/react/portainer/users/teams/types';
+
+export function validationSchema(teams: Team[]) {
+  return object().shape({
+    name: string()
+      .required('This field is required.')
+      .test(
+        'is-unique',
+        'This team already exists.',
+        (name) => !!name && teams.every((team) => team.Name !== name)
+      ),
+    leaders: array().of(number()),
+  });
+}
diff --git a/app/react/portainer/users/teams/ListView/CreateTeamForm/index.ts b/app/react/portainer/users/teams/ListView/CreateTeamForm/index.ts
new file mode 100644
index 0000000..3e03079
--- /dev/null
+++ b/app/react/portainer/users/teams/ListView/CreateTeamForm/index.ts
@@ -0,0 +1 @@
+export { CreateTeamForm } from './CreateTeamForm';
diff --git a/app/react/portainer/users/teams/ListView/CreateTeamForm/types.ts b/app/react/portainer/users/teams/ListView/CreateTeamForm/types.ts
new file mode 100644
index 0000000..7f95e48
--- /dev/null
+++ b/app/react/portainer/users/teams/ListView/CreateTeamForm/types.ts
@@ -0,0 +1,6 @@
+import { UserId } from '@/portainer/users/types';
+
+export interface FormValues {
+  name: string;
+  leaders: UserId[];
+}
diff --git a/app/react/portainer/users/teams/ListView/ListView.tsx b/app/react/portainer/users/teams/ListView/ListView.tsx
new file mode 100644
index 0000000..122b7b4
--- /dev/null
+++ b/app/react/portainer/users/teams/ListView/ListView.tsx
@@ -0,0 +1,34 @@
+import { useUsers } from '@/portainer/users/queries';
+import { useCurrentUser } from '@/react/hooks/useUser';
+
+import { PageHeader } from '@@/PageHeader';
+
+import { useTeams } from '../queries';
+
+import { CreateTeamForm } from './CreateTeamForm';
+import { TeamsDatatable } from './TeamsDatatable';
+
+export function ListView() {
+  const { isPureAdmin } = useCurrentUser();
+
+  const usersQuery = useUsers(false);
+  const teamsQuery = useTeams(!isPureAdmin, 0);
+
+  return (
+    <>
+      <PageHeader
+        title="Teams"
+        breadcrumbs={[{ label: 'Teams management' }]}
+        reload
+      />
+
+      {isPureAdmin && usersQuery.data && teamsQuery.data && (
+        <CreateTeamForm users={usersQuery.data} teams={teamsQuery.data} />
+      )}
+
+      {teamsQuery.data && (
+        <TeamsDatatable teams={teamsQuery.data} isAdmin={isPureAdmin} />
+      )}
+    </>
+  );
+}
diff --git a/app/react/portainer/users/teams/ListView/TeamsDatatable/TeamsDatatable.tsx b/app/react/portainer/users/teams/ListView/TeamsDatatable/TeamsDatatable.tsx
new file mode 100644
index 0000000..053f090
--- /dev/null
+++ b/app/react/portainer/users/teams/ListView/TeamsDatatable/TeamsDatatable.tsx
@@ -0,0 +1,86 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+import { Users } from 'lucide-react';
+import { ColumnDef } from '@tanstack/react-table';
+
+import { notifySuccess } from '@/portainer/services/notifications';
+import { promiseSequence } from '@/portainer/helpers/promise-utils';
+import { Team, TeamId } from '@/react/portainer/users/teams/types';
+
+import { Datatable } from '@@/datatables';
+import { buildNameColumn } from '@@/datatables/buildNameColumn';
+import { createPersistedStore } from '@@/datatables/types';
+import { useTableState } from '@@/datatables/useTableState';
+import { DeleteButton } from '@@/buttons/DeleteButton';
+
+import { deleteTeam } from '../../queries/useDeleteTeamMutation';
+
+const storageKey = 'teams';
+
+const columns: ColumnDef<Team>[] = [
+  buildNameColumn<Team>('Name', 'portainer.teams.team', 'teams-name'),
+];
+
+interface Props {
+  teams: Team[];
+  isAdmin: boolean;
+}
+
+const settingsStore = createPersistedStore(storageKey, 'name');
+
+export function TeamsDatatable({ teams, isAdmin }: Props) {
+  const { handleRemove } = useRemoveMutation();
+  const tableState = useTableState(settingsStore, storageKey);
+
+  return (
+    <Datatable<Team>
+      dataset={teams}
+      columns={columns}
+      settingsManager={tableState}
+      title="Teams"
+      titleIcon={Users}
+      renderTableActions={(selectedRows) =>
+        isAdmin && (
+          <DeleteButton
+            onConfirmed={() => handleRemoveClick(selectedRows)}
+            disabled={selectedRows.length === 0}
+            confirmMessage="Are you sure you want to remove the selected teams?"
+            data-cy="remove-teams-button"
+          />
+        )
+      }
+      data-cy="teams-datatable"
+    />
+  );
+
+  function handleRemoveClick(selectedRows: Team[]) {
+    const ids = selectedRows.map((row) => row.Id);
+    handleRemove(ids);
+  }
+}
+
+function useRemoveMutation() {
+  const queryClient = useQueryClient();
+
+  const deleteMutation = useMutation(
+    async (ids: TeamId[]) =>
+      promiseSequence(ids.map((id) => () => deleteTeam(id))),
+    {
+      meta: {
+        error: { title: 'Failure', message: 'Unable to remove team' },
+      },
+      onSuccess() {
+        return queryClient.invalidateQueries(['teams']);
+      },
+    }
+  );
+
+  return { handleRemove };
+
+  async function handleRemove(teams: TeamId[]) {
+    deleteMutation.mutate(teams, {
+      onSuccess: () => {
+        notifySuccess('Teams successfully removed', '');
+      },
+    });
+  }
+}
diff --git a/app/react/portainer/users/teams/ListView/TeamsDatatable/index.ts b/app/react/portainer/users/teams/ListView/TeamsDatatable/index.ts
new file mode 100644
index 0000000..4455757
--- /dev/null
+++ b/app/react/portainer/users/teams/ListView/TeamsDatatable/index.ts
@@ -0,0 +1 @@
+export { TeamsDatatable } from './TeamsDatatable';
diff --git a/app/react/portainer/users/teams/ListView/index.ts b/app/react/portainer/users/teams/ListView/index.ts
new file mode 100644
index 0000000..dd06dfd
--- /dev/null
+++ b/app/react/portainer/users/teams/ListView/index.ts
@@ -0,0 +1 @@
+export { ListView } from './ListView';
diff --git a/app/react/portainer/users/teams/index.ts b/app/react/portainer/users/teams/index.ts
new file mode 100644
index 0000000..1ee3d38
--- /dev/null
+++ b/app/react/portainer/users/teams/index.ts
@@ -0,0 +1,2 @@
+export { ItemView } from './ItemView';
+export { ListView } from './ListView';
diff --git a/app/react/portainer/users/teams/queries/build-membership-url.ts b/app/react/portainer/users/teams/queries/build-membership-url.ts
new file mode 100644
index 0000000..6b974c2
--- /dev/null
+++ b/app/react/portainer/users/teams/queries/build-membership-url.ts
@@ -0,0 +1,11 @@
+import { TeamMembershipId } from '../types';
+
+export function buildMembershipUrl(id?: TeamMembershipId) {
+  let url = '/team_memberships';
+
+  if (id) {
+    url += `/${id}`;
+  }
+
+  return url;
+}
diff --git a/app/react/portainer/users/teams/queries/build-url.ts b/app/react/portainer/users/teams/queries/build-url.ts
new file mode 100644
index 0000000..7994a63
--- /dev/null
+++ b/app/react/portainer/users/teams/queries/build-url.ts
@@ -0,0 +1,15 @@
+import { TeamId } from '../types';
+
+export function buildUrl(id?: TeamId, action?: string) {
+  let url = '/teams';
+
+  if (id) {
+    url += `/${id}`;
+  }
+
+  if (action) {
+    url += `/${action}`;
+  }
+
+  return url;
+}
diff --git a/app/react/portainer/users/teams/queries/index.ts b/app/react/portainer/users/teams/queries/index.ts
new file mode 100644
index 0000000..454667b
--- /dev/null
+++ b/app/react/portainer/users/teams/queries/index.ts
@@ -0,0 +1,11 @@
+export { useTeams } from './useTeams';
+export {
+  useAddMemberMutation,
+  createTeamMembership,
+} from './useAddMemberMutation';
+export { useAddTeamMutation } from './useAddTeamMutation';
+export { deleteTeam, useDeleteTeamMutation } from './useDeleteTeamMutation';
+export { useRemoveMemberMutation } from './useRemoveMemberMutation';
+export { useTeam } from './useTeam';
+export { useTeamMemberships } from './useTeamMemberships';
+export { useUpdateRoleMutation } from './useUpdateRoleMutation';
diff --git a/app/react/portainer/users/teams/queries/query-keys.ts b/app/react/portainer/users/teams/queries/query-keys.ts
new file mode 100644
index 0000000..90c958d
--- /dev/null
+++ b/app/react/portainer/users/teams/queries/query-keys.ts
@@ -0,0 +1,9 @@
+import { TeamId } from '../types';
+
+export const queryKeys = {
+  base: () => ['teams'] as const,
+  list: (params: unknown) => [...queryKeys.base(), 'list', params] as const,
+  item: (id: TeamId) => [...queryKeys.base(), id] as const,
+  memberships: (id?: TeamId) =>
+    [...queryKeys.base(), 'memberships', id] as const,
+};
diff --git a/app/react/portainer/users/teams/queries/useAddMemberMutation.ts b/app/react/portainer/users/teams/queries/useAddMemberMutation.ts
new file mode 100644
index 0000000..47360c9
--- /dev/null
+++ b/app/react/portainer/users/teams/queries/useAddMemberMutation.ts
@@ -0,0 +1,40 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { promiseSequence } from '@/portainer/helpers/promise-utils';
+import { UserId } from '@/portainer/users/types';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError, withInvalidate } from '@/react-tools/react-query';
+
+import { TeamId, TeamRole } from '../types';
+
+import { buildMembershipUrl } from './build-membership-url';
+import { queryKeys } from './query-keys';
+
+export function useAddMemberMutation(teamId: TeamId) {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: (userIds: UserId[]) =>
+      promiseSequence(
+        userIds.map(
+          (userId) => () =>
+            createTeamMembership(userId, teamId, TeamRole.Member)
+        )
+      ),
+
+    ...withError('Failure to add membership'),
+    ...withInvalidate(queryClient, [queryKeys.memberships(teamId)]),
+  });
+}
+
+export async function createTeamMembership(
+  userId: UserId,
+  teamId: TeamId,
+  role: TeamRole
+) {
+  try {
+    await axios.post(buildMembershipUrl(), { userId, teamId, role });
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to create team membership');
+  }
+}
diff --git a/app/react/portainer/users/teams/queries/useAddTeamMutation.ts b/app/react/portainer/users/teams/queries/useAddTeamMutation.ts
new file mode 100644
index 0000000..8a1de07
--- /dev/null
+++ b/app/react/portainer/users/teams/queries/useAddTeamMutation.ts
@@ -0,0 +1,39 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { UserId } from '@/portainer/users/types';
+import { withError, withInvalidate } from '@/react-tools/react-query';
+
+import { TeamRole } from '../types';
+
+import { createTeamMembership } from './useAddMemberMutation';
+import { buildUrl } from './build-url';
+import { queryKeys } from './query-keys';
+
+interface CreatePayload {
+  name: string;
+  leaders: UserId[];
+}
+
+export function useAddTeamMutation() {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: createTeam,
+    ...withError('Failed to create team'),
+    ...withInvalidate(queryClient, [queryKeys.base()]),
+  });
+}
+
+async function createTeam({ name, leaders }: CreatePayload) {
+  try {
+    const { data: team } = await axios.post(buildUrl(), { name });
+    await Promise.all(
+      leaders.map((leaderId) =>
+        createTeamMembership(leaderId, team.Id, TeamRole.Leader)
+      )
+    );
+  } catch (e) {
+    throw parseAxiosError(e as Error, 'Unable to create team');
+  }
+}
diff --git a/app/react/portainer/users/teams/queries/useDeleteTeamMutation.ts b/app/react/portainer/users/teams/queries/useDeleteTeamMutation.ts
new file mode 100644
index 0000000..2f26c39
--- /dev/null
+++ b/app/react/portainer/users/teams/queries/useDeleteTeamMutation.ts
@@ -0,0 +1,32 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import {
+  mutationOptions,
+  withError,
+  withInvalidate,
+} from '@/react-tools/react-query';
+
+import { TeamId } from '../types';
+
+import { buildUrl } from './build-url';
+
+export function useDeleteTeamMutation() {
+  const queryClient = useQueryClient();
+  return useMutation(
+    (id: TeamId) => deleteTeam(id),
+
+    mutationOptions(
+      withError('Unable to delete team'),
+      withInvalidate(queryClient, [['teams']])
+    )
+  );
+}
+
+export async function deleteTeam(id: TeamId) {
+  try {
+    await axios.delete(buildUrl(id));
+  } catch (error) {
+    throw parseAxiosError(error as Error);
+  }
+}
diff --git a/app/react/portainer/users/teams/queries/useRemoveMemberMutation.ts b/app/react/portainer/users/teams/queries/useRemoveMemberMutation.ts
new file mode 100644
index 0000000..ea08e77
--- /dev/null
+++ b/app/react/portainer/users/teams/queries/useRemoveMemberMutation.ts
@@ -0,0 +1,43 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { promiseSequence } from '@/portainer/helpers/promise-utils';
+import { UserId } from '@/portainer/users/types';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError, withInvalidate } from '@/react-tools/react-query';
+
+import { TeamId, TeamMembership, TeamMembershipId } from '../types';
+
+import { buildMembershipUrl } from './build-membership-url';
+import { queryKeys } from './query-keys';
+
+export function useRemoveMemberMutation(
+  teamId: TeamId,
+  teamMemberships: TeamMembership[] = []
+) {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: (userIds: UserId[]) =>
+      promiseSequence(
+        userIds.map((userId) => () => {
+          const membership = teamMemberships.find(
+            (membership) => membership.UserID === userId
+          );
+          if (!membership) {
+            throw new Error('Membership not found');
+          }
+          return deleteTeamMembership(membership.Id);
+        })
+      ),
+    ...withError('Failure to remove membership'),
+    ...withInvalidate(queryClient, [queryKeys.memberships(teamId)]),
+  });
+}
+
+async function deleteTeamMembership(id: TeamMembershipId) {
+  try {
+    await axios.delete(buildMembershipUrl(id));
+  } catch (e) {
+    throw parseAxiosError(e, 'Unable to delete team membership');
+  }
+}
diff --git a/app/react/portainer/users/teams/queries/useTeam.ts b/app/react/portainer/users/teams/queries/useTeam.ts
new file mode 100644
index 0000000..7ba2bd3
--- /dev/null
+++ b/app/react/portainer/users/teams/queries/useTeam.ts
@@ -0,0 +1,27 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+
+import { Team, TeamId } from '../types';
+
+import { buildUrl } from './build-url';
+import { queryKeys } from './query-keys';
+
+export function useTeam(id: TeamId, onError?: (error: unknown) => void) {
+  return useQuery({
+    queryKey: queryKeys.item(id),
+    queryFn: () => getTeam(id),
+    ...withError('Unable to load team'),
+    onError,
+  });
+}
+
+async function getTeam(id: TeamId) {
+  try {
+    const { data } = await axios.get<Team>(buildUrl(id));
+    return data;
+  } catch (error) {
+    throw parseAxiosError(error as Error);
+  }
+}
diff --git a/app/react/portainer/users/teams/queries/useTeamMemberships.ts b/app/react/portainer/users/teams/queries/useTeamMemberships.ts
new file mode 100644
index 0000000..c17532c
--- /dev/null
+++ b/app/react/portainer/users/teams/queries/useTeamMemberships.ts
@@ -0,0 +1,38 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+
+import { TeamId, TeamMembership } from '../types';
+
+import { buildUrl } from './build-url';
+import { buildMembershipUrl } from './build-membership-url';
+import { queryKeys } from './query-keys';
+
+export function useTeamMemberships(id?: TeamId) {
+  return useQuery({
+    queryKey: queryKeys.memberships(id),
+    queryFn: () => (id ? getTeamMemberships(id) : getTeamsMemberships()),
+    ...withError('Unable to load team memberships'),
+  });
+}
+
+async function getTeamMemberships(teamId: TeamId) {
+  try {
+    const { data } = await axios.get<TeamMembership[]>(
+      buildUrl(teamId, 'memberships')
+    );
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e as Error, 'Unable to get team memberships');
+  }
+}
+
+async function getTeamsMemberships() {
+  try {
+    const { data } = await axios.get<TeamMembership[]>(buildMembershipUrl());
+    return data;
+  } catch (e) {
+    throw parseAxiosError(e as Error, 'Unable to get team memberships');
+  }
+}
diff --git a/app/react/portainer/users/teams/queries/useTeams.ts b/app/react/portainer/users/teams/queries/useTeams.ts
new file mode 100644
index 0000000..c4a4ffa
--- /dev/null
+++ b/app/react/portainer/users/teams/queries/useTeams.ts
@@ -0,0 +1,42 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+
+import { Team } from '../types';
+
+import { buildUrl } from './build-url';
+import { queryKeys } from './query-keys';
+
+export function useTeams<T = Team[]>(
+  onlyLedTeams = false,
+  environmentId = 0,
+  {
+    enabled = true,
+    select = (data) => data as unknown as T,
+  }: {
+    enabled?: boolean;
+    select?: (data: Team[]) => T;
+  } = {}
+) {
+  const teams = useQuery({
+    queryKey: queryKeys.list({ onlyLedTeams, environmentId }),
+    queryFn: () => getTeams(onlyLedTeams, environmentId),
+    ...withError('Unable to load teams'),
+    enabled,
+    select,
+  });
+
+  return teams;
+}
+
+async function getTeams(onlyLedTeams = false, environmentId = 0) {
+  try {
+    const { data } = await axios.get<Team[]>(buildUrl(), {
+      params: { onlyLedTeams, environmentId },
+    });
+    return data;
+  } catch (error) {
+    throw parseAxiosError(error as Error);
+  }
+}
diff --git a/app/react/portainer/users/teams/queries/useUpdateRoleMutation.ts b/app/react/portainer/users/teams/queries/useUpdateRoleMutation.ts
new file mode 100644
index 0000000..772d616
--- /dev/null
+++ b/app/react/portainer/users/teams/queries/useUpdateRoleMutation.ts
@@ -0,0 +1,44 @@
+import { useQueryClient, useMutation } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { UserId } from '@/portainer/users/types';
+import { withError, withInvalidate } from '@/react-tools/react-query';
+
+import { TeamId, TeamMembership, TeamRole, TeamMembershipId } from '../types';
+
+import { buildMembershipUrl } from './build-membership-url';
+import { queryKeys } from './query-keys';
+
+export function useUpdateRoleMutation(
+  teamId: TeamId,
+  teamMemberships: TeamMembership[] = []
+) {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: ({ userId, role }: { userId: UserId; role: TeamRole }) => {
+      const membership = teamMemberships.find(
+        (membership) => membership.UserID === userId
+      );
+      if (!membership) {
+        throw new Error('Membership not found');
+      }
+      return updateTeamMembership(membership.Id, userId, teamId, role);
+    },
+    ...withError('Failure to update membership'),
+    ...withInvalidate(queryClient, [queryKeys.memberships(teamId)]),
+  });
+}
+
+async function updateTeamMembership(
+  id: TeamMembershipId,
+  userId: UserId,
+  teamId: TeamId,
+  role: TeamRole
+) {
+  try {
+    await axios.put(buildMembershipUrl(id), { userId, teamId, role });
+  } catch (e) {
+    throw parseAxiosError(e as Error, 'Unable to update team membership');
+  }
+}
diff --git a/app/react/portainer/users/teams/types.ts b/app/react/portainer/users/teams/types.ts
new file mode 100644
index 0000000..b8a24ca
--- /dev/null
+++ b/app/react/portainer/users/teams/types.ts
@@ -0,0 +1,22 @@
+import { type UserId } from '@/portainer/users/types';
+
+export type TeamId = number;
+
+export enum TeamRole {
+  Leader = 1,
+  Member,
+}
+
+export type Team = {
+  Id: TeamId;
+  Name: string;
+};
+
+export type TeamMembershipId = number;
+
+export interface TeamMembership {
+  Id: TeamMembershipId;
+  Role: TeamRole;
+  UserID: UserId;
+  TeamID: TeamId;
+}
diff --git a/app/react/portainer/webhooks/build-url.ts b/app/react/portainer/webhooks/build-url.ts
new file mode 100644
index 0000000..6f195ec
--- /dev/null
+++ b/app/react/portainer/webhooks/build-url.ts
@@ -0,0 +1,11 @@
+import { Webhook } from './types';
+
+export function buildUrl(id?: Webhook['Id']) {
+  const url = '/webhooks';
+
+  if (id) {
+    return `${url}/${id}`;
+  }
+
+  return url;
+}
diff --git a/app/react/portainer/webhooks/query-keys.ts b/app/react/portainer/webhooks/query-keys.ts
new file mode 100644
index 0000000..84bf4b1
--- /dev/null
+++ b/app/react/portainer/webhooks/query-keys.ts
@@ -0,0 +1,6 @@
+import { Filters } from './types';
+
+export const queryKeys = {
+  base: () => ['webhooks'] as const,
+  list: (filters: Filters) => [...queryKeys.base(), { filters }],
+};
diff --git a/app/react/portainer/webhooks/types.ts b/app/react/portainer/webhooks/types.ts
new file mode 100644
index 0000000..0026e5d
--- /dev/null
+++ b/app/react/portainer/webhooks/types.ts
@@ -0,0 +1,21 @@
+import { EnvironmentId } from '../environments/types';
+import { RegistryId } from '../registries/types/registry';
+
+export enum WebhookType {
+  DockerService = 1,
+  DockerContainer = 2,
+}
+
+export interface Webhook {
+  Id: number;
+  Token: string;
+  ResourceId: string;
+  EndpointId: EnvironmentId;
+  RegistryId: RegistryId;
+  Type: WebhookType;
+}
+
+export interface Filters {
+  endpointId: EnvironmentId;
+  resourceId?: string;
+}
diff --git a/app/react/portainer/webhooks/useCreateWebhook.ts b/app/react/portainer/webhooks/useCreateWebhook.ts
new file mode 100644
index 0000000..c99160a
--- /dev/null
+++ b/app/react/portainer/webhooks/useCreateWebhook.ts
@@ -0,0 +1,45 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+
+import { EnvironmentId } from '../environments/types';
+import { RegistryId } from '../registries/types/registry';
+
+import { buildUrl } from './build-url';
+import { Webhook, WebhookType } from './types';
+import { queryKeys } from './query-keys';
+
+export function useCreateWebhook() {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: createWebhook,
+    onSuccess: () => {
+      queryClient.invalidateQueries({
+        queryKey: queryKeys.base(),
+      });
+    },
+    ...withError('Failed to create webhook'),
+  });
+}
+
+export async function createWebhook({
+  environmentId,
+  ...payload
+}: {
+  resourceId: string;
+  environmentId: EnvironmentId;
+  registryId?: RegistryId;
+  webhookType: WebhookType;
+}) {
+  try {
+    const { data } = await axios.post<Webhook>(buildUrl(), {
+      endpointId: environmentId,
+      ...payload,
+    });
+    return data;
+  } catch (error) {
+    throw parseAxiosError(error, 'Unable to create webhook');
+  }
+}
diff --git a/app/react/portainer/webhooks/useDeleteWebhook.ts b/app/react/portainer/webhooks/useDeleteWebhook.ts
new file mode 100644
index 0000000..97bbc0f
--- /dev/null
+++ b/app/react/portainer/webhooks/useDeleteWebhook.ts
@@ -0,0 +1,30 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { Webhook } from '@/react/portainer/webhooks/types';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+
+import { queryKeys } from './query-keys';
+
+export function useDeleteWebhook() {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: ({ webhookId }: { webhookId: Webhook['Id'] }) =>
+      deleteWebhook(webhookId),
+    onSuccess: () => {
+      queryClient.invalidateQueries({
+        queryKey: queryKeys.base(),
+      });
+    },
+    ...withError('Failed to delete webhook'),
+  });
+}
+
+async function deleteWebhook(webhookId: Webhook['Id']) {
+  try {
+    await axios.delete(`/webhooks/${webhookId}`);
+  } catch (err) {
+    throw parseAxiosError(err, 'Failed to delete webhook');
+  }
+}
diff --git a/app/react/portainer/webhooks/useUpdateWebhook.ts b/app/react/portainer/webhooks/useUpdateWebhook.ts
new file mode 100644
index 0000000..d4c7321
--- /dev/null
+++ b/app/react/portainer/webhooks/useUpdateWebhook.ts
@@ -0,0 +1,39 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { RegistryId } from '@/react/portainer/registries/types/registry';
+import { Webhook } from '@/react/portainer/webhooks/types';
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+import { withError } from '@/react-tools/react-query';
+
+import { queryKeys } from './query-keys';
+
+export function useUpdateWebhook() {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: updateWebhook,
+    onSuccess: () => {
+      queryClient.invalidateQueries({
+        queryKey: queryKeys.base(),
+      });
+    },
+    ...withError('Failed to update webhook'),
+  });
+}
+
+async function updateWebhook({
+  webhookId,
+  registryId = 0,
+}: {
+  webhookId: Webhook['Id'];
+  registryId?: RegistryId;
+}) {
+  try {
+    const { data } = await axios.put<Webhook>(`/webhooks/${webhookId}`, {
+      registryId,
+    });
+    return data;
+  } catch (err) {
+    throw parseAxiosError(err, 'Failed to update webhook');
+  }
+}
diff --git a/app/react/portainer/webhooks/useWebhooks.ts b/app/react/portainer/webhooks/useWebhooks.ts
new file mode 100644
index 0000000..027baf3
--- /dev/null
+++ b/app/react/portainer/webhooks/useWebhooks.ts
@@ -0,0 +1,27 @@
+import { useQuery } from '@tanstack/react-query';
+
+import axios, { parseAxiosError } from '@/portainer/services/axios/axios';
+
+import { buildUrl } from './build-url';
+import { queryKeys } from './query-keys';
+import { Filters, Webhook } from './types';
+
+export function useWebhooks(
+  filters: Filters,
+  { enabled }: { enabled?: boolean } = {}
+) {
+  return useQuery(queryKeys.list(filters), () => getWebhooks(filters), {
+    enabled,
+  });
+}
+
+async function getWebhooks(filters: Filters) {
+  try {
+    const { data } = await axios.get<Array<Webhook>>(buildUrl(), {
+      params: { filters: JSON.stringify(filters) },
+    });
+    return data;
+  } catch (err) {
+    throw parseAxiosError(err, 'failed fetching webhooks');
+  }
+}
diff --git a/app/react/sidebar/AppDeliverySidebar.tsx b/app/react/sidebar/AppDeliverySidebar.tsx
new file mode 100644
index 0000000..9ad3598
--- /dev/null
+++ b/app/react/sidebar/AppDeliverySidebar.tsx
@@ -0,0 +1,24 @@
+import { Database, GitBranch } from 'lucide-react';
+
+import { SidebarItem } from './SidebarItem';
+import { SidebarSection } from './SidebarSection';
+
+export function AppDeliverySidebar() {
+  return (
+    <SidebarSection title="App Delivery">
+      <SidebarItem
+        label="Workflows"
+        to="portainer.gitops.workflows"
+        icon={GitBranch}
+        data-cy="portainerSidebar-workflows"
+      />
+
+      <SidebarItem
+        label="Sources"
+        to="portainer.gitops.sources"
+        icon={Database}
+        data-cy="portainerSidebar-sources"
+      />
+    </SidebarSection>
+  );
+}
diff --git a/app/react/sidebar/AzureSidebar/AzureSidebar.test.tsx b/app/react/sidebar/AzureSidebar/AzureSidebar.test.tsx
new file mode 100644
index 0000000..f677c73
--- /dev/null
+++ b/app/react/sidebar/AzureSidebar/AzureSidebar.test.tsx
@@ -0,0 +1,42 @@
+import { render, within } from '@testing-library/react';
+
+import { UserViewModel } from '@/portainer/models/user';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+
+import { TestSidebarProvider } from '../useSidebarState';
+
+import { AzureSidebar } from './AzureSidebar';
+
+test('dashboard items should render correctly', () => {
+  const { getByLabelText } = renderComponent();
+  const dashboardItem = getByLabelText('Dashboard');
+  expect(dashboardItem).toBeVisible();
+  expect(dashboardItem).toHaveTextContent('Dashboard');
+
+  const dashboardItemElements = within(dashboardItem);
+  expect(
+    dashboardItemElements.getByRole('img', { hidden: true })
+  ).toBeVisible();
+
+  const containerInstancesItem = getByLabelText(/Container Instances/i);
+  expect(containerInstancesItem).toBeVisible();
+  expect(containerInstancesItem).toHaveTextContent('Container instances');
+
+  const containerInstancesItemElements = within(containerInstancesItem);
+  expect(
+    containerInstancesItemElements.getByRole('img', { hidden: true })
+  ).toBeVisible();
+});
+
+function renderComponent() {
+  const user = new UserViewModel({ Username: 'user' });
+
+  const Wrapped = withUserProvider(withTestRouter(AzureSidebar), user);
+
+  return render(
+    <TestSidebarProvider>
+      <Wrapped environmentId={1} />
+    </TestSidebarProvider>
+  );
+}
diff --git a/app/react/sidebar/AzureSidebar/AzureSidebar.tsx b/app/react/sidebar/AzureSidebar/AzureSidebar.tsx
new file mode 100644
index 0000000..37c1db7
--- /dev/null
+++ b/app/react/sidebar/AzureSidebar/AzureSidebar.tsx
@@ -0,0 +1,29 @@
+import { Box } from 'lucide-react';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+
+import { DashboardLink } from '../items/DashboardLink';
+import { SidebarItem } from '../SidebarItem';
+
+interface Props {
+  environmentId: EnvironmentId;
+}
+
+export function AzureSidebar({ environmentId }: Props) {
+  return (
+    <>
+      <DashboardLink
+        environmentId={environmentId}
+        platformPath="azure"
+        data-cy="azureSidebar-dashboard"
+      />
+      <SidebarItem
+        to="azure.containerinstances"
+        params={{ endpointId: environmentId }}
+        icon={Box}
+        label="Container instances"
+        data-cy="azureSidebar-containerInstances"
+      />
+    </>
+  );
+}
diff --git a/app/react/sidebar/AzureSidebar/index.ts b/app/react/sidebar/AzureSidebar/index.ts
new file mode 100644
index 0000000..6348b56
--- /dev/null
+++ b/app/react/sidebar/AzureSidebar/index.ts
@@ -0,0 +1 @@
+export { AzureSidebar } from './AzureSidebar';
diff --git a/app/react/sidebar/DockerSidebar.tsx b/app/react/sidebar/DockerSidebar.tsx
new file mode 100644
index 0000000..0c13a62
--- /dev/null
+++ b/app/react/sidebar/DockerSidebar.tsx
@@ -0,0 +1,225 @@
+import {
+  Box,
+  Clock,
+  Layers,
+  List,
+  Lock,
+  Shuffle,
+  Trello,
+  Clipboard,
+  Edit,
+  Network,
+  Database,
+} from 'lucide-react';
+
+import {
+  type Environment,
+  type EnvironmentId,
+} from '@/react/portainer/environments/types';
+import { Authorized, useIsEnvironmentAdmin } from '@/react/hooks/useUser';
+import { useInfo } from '@/react/docker/proxy/queries/useInfo';
+import { useApiVersion } from '@/react/docker/proxy/queries/useVersion';
+
+import { SidebarItem } from './SidebarItem';
+import { DashboardLink } from './items/DashboardLink';
+import { SidebarParent } from './SidebarItem/SidebarParent';
+
+interface Props {
+  environmentId: EnvironmentId;
+  environment: Environment;
+}
+
+export function DockerSidebar({ environmentId, environment }: Props) {
+  const { authorized: isEnvironmentAdmin } = useIsEnvironmentAdmin({
+    adminOnlyCE: true,
+  });
+
+  const areStacksVisible =
+    isEnvironmentAdmin ||
+    environment.SecuritySettings.allowStackManagementForRegularUsers;
+
+  const envInfoQuery = useInfo(environmentId, {
+    select: (info) => !!info.Swarm?.NodeID && !!info.Swarm?.ControlAvailable,
+  });
+
+  const apiVersion = useApiVersion(environmentId);
+
+  const isSwarmManager = envInfoQuery.data;
+
+  const setupSubMenuProps = isSwarmManager
+    ? {
+        label: 'Swarm',
+        icon: Trello,
+        to: 'docker.swarm',
+        dataCy: 'portainerSidebar-swarm',
+      }
+    : {
+        label: 'Host',
+        icon: Trello,
+        to: 'docker.host',
+        dataCy: 'portainerSidebar-host',
+      };
+
+  const featSubMenuTo = isSwarmManager
+    ? 'docker.swarm.featuresConfiguration'
+    : 'docker.host.featuresConfiguration';
+  const registrySubMenuTo = isSwarmManager
+    ? 'docker.swarm.registries'
+    : 'docker.host.registries';
+
+  return (
+    <>
+      <DashboardLink
+        environmentId={environmentId}
+        platformPath="docker"
+        data-cy="dockerSidebar-dashboard"
+      />
+      <SidebarParent
+        icon={Edit}
+        label="Templates"
+        to="docker.templates"
+        params={{ endpointId: environmentId }}
+        data-cy="portainerSidebar-templates"
+        listId="dockerSidebar-templates"
+      >
+        <SidebarItem
+          label="Application"
+          to="docker.templates"
+          ignorePaths={['docker.templates.custom']}
+          params={{ endpointId: environmentId }}
+          isSubMenu
+          data-cy="portainerSidebar-appTemplates"
+        />
+        <SidebarItem
+          label="Custom"
+          to="docker.templates.custom"
+          params={{ endpointId: environmentId }}
+          isSubMenu
+          data-cy="dockerSidebar-customTemplates"
+        />
+      </SidebarParent>
+
+      {areStacksVisible && (
+        <SidebarItem
+          to="docker.stacks"
+          params={{ endpointId: environmentId }}
+          icon={Layers}
+          label="Stacks"
+          data-cy="dockerSidebar-stacks"
+        />
+      )}
+
+      {isSwarmManager && (
+        <SidebarItem
+          to="docker.services"
+          params={{ endpointId: environmentId }}
+          icon={Shuffle}
+          label="Services"
+          data-cy="dockerSidebar-services"
+        />
+      )}
+
+      <SidebarItem
+        to="docker.containers"
+        params={{ endpointId: environmentId }}
+        icon={Box}
+        label="Containers"
+        data-cy="dockerSidebar-containers"
+      />
+
+      <SidebarItem
+        to="docker.images"
+        params={{ endpointId: environmentId }}
+        icon={List}
+        label="Images"
+        data-cy="dockerSidebar-images"
+      />
+
+      <SidebarItem
+        to="docker.networks"
+        params={{ endpointId: environmentId }}
+        icon={Network}
+        label="Networks"
+        data-cy="dockerSidebar-networks"
+      />
+
+      <SidebarItem
+        to="docker.volumes"
+        params={{ endpointId: environmentId }}
+        icon={Database}
+        label="Volumes"
+        data-cy="dockerSidebar-volumes"
+      />
+
+      {apiVersion >= 1.3 && isSwarmManager && (
+        <SidebarItem
+          to="docker.configs"
+          params={{ endpointId: environmentId }}
+          icon={Clipboard}
+          label="Configs"
+          data-cy="dockerSidebar-configs"
+        />
+      )}
+
+      {apiVersion >= 1.25 && isSwarmManager && (
+        <SidebarItem
+          to="docker.secrets"
+          params={{ endpointId: environmentId }}
+          icon={Lock}
+          label="Secrets"
+          data-cy="dockerSidebar-secrets"
+        />
+      )}
+
+      {!isSwarmManager && isEnvironmentAdmin && (
+        <SidebarItem
+          to="docker.events"
+          params={{ endpointId: environmentId }}
+          icon={Clock}
+          label="Events"
+          data-cy="dockerSidebar-events"
+        />
+      )}
+
+      <SidebarParent
+        label={setupSubMenuProps.label}
+        icon={setupSubMenuProps.icon}
+        to={setupSubMenuProps.to}
+        params={{ endpointId: environmentId }}
+        data-cy="portainerSidebar-host-area"
+        listId="portainerSidebar-host-area"
+      >
+        <SidebarItem
+          label="Details"
+          isSubMenu
+          to={setupSubMenuProps.to}
+          params={{ endpointId: environmentId }}
+          ignorePaths={[featSubMenuTo, registrySubMenuTo]}
+          data-cy={setupSubMenuProps.dataCy}
+        />
+
+        <Authorized
+          authorizations="PortainerEndpointUpdateSettings"
+          adminOnlyCE
+          environmentId={environmentId}
+        >
+          <SidebarItem
+            label="Setup"
+            isSubMenu
+            to={featSubMenuTo}
+            params={{ endpointId: environmentId }}
+            data-cy="portainerSidebar-docker-setup"
+          />
+        </Authorized>
+
+        <SidebarItem
+          label="Registries"
+          isSubMenu
+          to={registrySubMenuTo}
+          params={{ endpointId: environmentId }}
+          data-cy="portainerSidebar-docker-registries"
+        />
+      </SidebarParent>
+    </>
+  );
+}
diff --git a/app/react/sidebar/EdgeComputeSidebar.tsx b/app/react/sidebar/EdgeComputeSidebar.tsx
new file mode 100644
index 0000000..5798b22
--- /dev/null
+++ b/app/react/sidebar/EdgeComputeSidebar.tsx
@@ -0,0 +1,79 @@
+import { Box, Clock, LayoutGrid, Layers, Puzzle, Edit } from 'lucide-react';
+
+import { isBE } from '../portainer/feature-flags/feature-flags.service';
+import { useSettings } from '../portainer/settings/queries';
+
+import { SidebarItem } from './SidebarItem';
+import { SidebarSection } from './SidebarSection';
+import { SidebarParent } from './SidebarItem/SidebarParent';
+
+export function EdgeComputeSidebar() {
+  // this sidebar is rendered only for admins, so we can safely assume that settingsQuery will succeed
+  const settingsQuery = useSettings();
+
+  if (!settingsQuery.data || !settingsQuery.data.EnableEdgeComputeFeatures) {
+    return null;
+  }
+
+  const settings = settingsQuery.data;
+
+  return (
+    <SidebarSection title="Edge compute">
+      <SidebarItem
+        to="edge.groups"
+        label="Edge Groups"
+        icon={LayoutGrid}
+        data-cy="portainerSidebar-edgeGroups"
+      />
+      <SidebarItem
+        to="edge.stacks"
+        label="Edge Stacks"
+        icon={Layers}
+        data-cy="portainerSidebar-edgeStacks"
+      />
+      <SidebarItem
+        to="edge.jobs"
+        label="Edge Jobs"
+        icon={Clock}
+        data-cy="portainerSidebar-edgeJobs"
+      />
+      {isBE && (
+        <SidebarItem
+          to="edge.configurations"
+          label="Edge Configurations"
+          icon={Puzzle}
+          data-cy="portainerSidebar-edgeConfigurations"
+        />
+      )}
+      {isBE && !settings.TrustOnFirstConnect && (
+        <SidebarItem
+          to="edge.devices.waiting-room"
+          label="Waiting Room"
+          icon={Box}
+          data-cy="portainerSidebar-edgeDevicesWaitingRoom"
+        />
+      )}
+      <SidebarParent
+        icon={Edit}
+        label="Edge Templates"
+        to="edge.templates"
+        data-cy="edgeSidebar-templates"
+        listId="edgeSidebar-templates"
+      >
+        <SidebarItem
+          label="Application"
+          to="edge.templates"
+          ignorePaths={['edge.templates.custom']}
+          isSubMenu
+          data-cy="edgeSidebar-appTemplates"
+        />
+        <SidebarItem
+          label="Custom"
+          to="edge.templates.custom"
+          isSubMenu
+          data-cy="edgeSidebar-customTemplates"
+        />
+      </SidebarParent>
+    </SidebarSection>
+  );
+}
diff --git a/app/react/sidebar/EnvironmentSidebar.module.css b/app/react/sidebar/EnvironmentSidebar.module.css
new file mode 100644
index 0000000..2400d63
--- /dev/null
+++ b/app/react/sidebar/EnvironmentSidebar.module.css
@@ -0,0 +1,11 @@
+.root {
+  background-color: var(--bg-sidebar-nav-color);
+}
+
+.closeBtn {
+  background-color: transparent;
+}
+
+.closeBtn:hover {
+  background-color: var(--graphite-500);
+}
diff --git a/app/react/sidebar/EnvironmentSidebar.tsx b/app/react/sidebar/EnvironmentSidebar.tsx
new file mode 100644
index 0000000..e1f07ce
--- /dev/null
+++ b/app/react/sidebar/EnvironmentSidebar.tsx
@@ -0,0 +1,161 @@
+import { useCurrentStateAndParams, useRouter } from '@uirouter/react';
+import { useEffect } from 'react';
+import { X, Slash } from 'lucide-react';
+import clsx from 'clsx';
+import { useStore } from 'zustand';
+
+import {
+  PlatformType,
+  EnvironmentId,
+  Environment,
+} from '@/react/portainer/environments/types';
+import { getPlatformType } from '@/react/portainer/environments/utils';
+import { useEnvironment } from '@/react/portainer/environments/queries/useEnvironment';
+import { environmentStore } from '@/react/hooks/current-environment-store';
+
+import { Icon } from '@@/Icon';
+
+import { getPlatformIconByEnvironment } from '../portainer/environments/utils/get-platform-icon';
+
+import styles from './EnvironmentSidebar.module.css';
+import { AzureSidebar } from './AzureSidebar';
+import { DockerSidebar } from './DockerSidebar';
+import { KubernetesSidebar } from './KubernetesSidebar';
+import { SidebarSection, SidebarSectionTitle } from './SidebarSection';
+import { useSidebarState } from './useSidebarState';
+
+export function EnvironmentSidebar() {
+  const { query: currentEnvironmentQuery, clearEnvironment } =
+    useCurrentEnvironment();
+  const environment = currentEnvironmentQuery.data;
+
+  const { isOpen } = useSidebarState();
+
+  if (!isOpen && !environment) {
+    return null;
+  }
+
+  return (
+    <div className={clsx(styles.root, 'rounded py-2')}>
+      {environment ? (
+        <Content environment={environment} onClear={clearEnvironment} />
+      ) : (
+        <SidebarSectionTitle>
+          <div className="flex items-center gap-1">
+            <span>Environment:</span>
+            <Icon icon={Slash} className="text-xl !text-gray-6" />
+            <span className="text-sm text-gray-6">None selected</span>
+          </div>
+        </SidebarSectionTitle>
+      )}
+    </div>
+  );
+}
+
+interface ContentProps {
+  environment: Environment;
+  onClear: () => void;
+}
+
+function Content({ environment, onClear }: ContentProps) {
+  const platform = getPlatformType(environment.Type);
+  const Sidebar = getSidebar(platform);
+
+  return (
+    <SidebarSection
+      title={<Title environment={environment} onClear={onClear} />}
+      hoverText={environment.Name}
+      aria-label={environment.Name}
+      showTitleWhenOpen
+    >
+      <div className="mt-2">
+        {Sidebar && (
+          <Sidebar environmentId={environment.Id} environment={environment} />
+        )}
+      </div>
+    </SidebarSection>
+  );
+
+  function getSidebar(platform: PlatformType) {
+    const sidebar: {
+      [key in PlatformType]: React.ComponentType<{
+        environmentId: EnvironmentId;
+        environment: Environment;
+      }> | null;
+    } = {
+      [PlatformType.Azure]: AzureSidebar,
+      [PlatformType.Docker]: DockerSidebar,
+      [PlatformType.Podman]: DockerSidebar, // same as docker for now, until pod management is added
+      [PlatformType.Kubernetes]: KubernetesSidebar,
+    };
+
+    return sidebar[platform];
+  }
+}
+
+function useCurrentEnvironment() {
+  const { params } = useCurrentStateAndParams();
+  const router = useRouter();
+
+  const envStore = useStore(environmentStore);
+  const { setEnvironmentId } = envStore;
+  useEffect(() => {
+    const environmentId = parseInt(params.endpointId, 10);
+    if (params.endpointId && !Number.isNaN(environmentId)) {
+      setEnvironmentId(environmentId);
+    }
+  }, [setEnvironmentId, params.endpointId, params.environmentId]);
+
+  return { query: useEnvironment(envStore.environmentId), clearEnvironment };
+
+  function clearEnvironment() {
+    if (params.endpointId || params.environmentId) {
+      router.stateService.go('portainer.home');
+    }
+
+    envStore.clear();
+  }
+}
+
+interface TitleProps {
+  environment: Environment;
+  onClear(): void;
+}
+
+function Title({ environment, onClear }: TitleProps) {
+  const { isOpen } = useSidebarState();
+
+  const EnvironmentIcon = getPlatformIconByEnvironment(
+    environment.Type,
+    environment.ContainerEngine
+  );
+
+  if (!isOpen) {
+    return (
+      <div className="-ml-3 flex w-8 justify-center" title={environment.Name}>
+        <EnvironmentIcon className="text-2xl" />
+      </div>
+    );
+  }
+
+  return (
+    <div className="flex items-center">
+      <EnvironmentIcon className="mr-3 text-2xl" />
+      <span className="overflow-hidden text-ellipsis whitespace-nowrap text-white">
+        {environment.Name}
+      </span>
+
+      <button
+        title="Clear environment"
+        type="button"
+        onClick={onClear}
+        className={clsx(
+          styles.closeBtn,
+          'ml-auto mr-2 flex h-5 w-5 items-center justify-center rounded border-0 p-1 text-sm text-white transition-colors duration-200'
+        )}
+      >
+        <X />
+      </button>
+    </div>
+  );
+}
diff --git a/app/react/sidebar/Footer/BuildInfoModal.tsx b/app/react/sidebar/Footer/BuildInfoModal.tsx
new file mode 100644
index 0000000..37d2f2b
--- /dev/null
+++ b/app/react/sidebar/Footer/BuildInfoModal.tsx
@@ -0,0 +1,189 @@
+import { useState } from 'react';
+import {
+  Database,
+  GitCommit,
+  Hash,
+  Link as LinkIcon,
+  Server,
+  Tag,
+  Variable,
+  Wrench,
+} from 'lucide-react';
+import clsx from 'clsx';
+
+import { useSystemStatus } from '@/react/portainer/system/useSystemStatus';
+import { useSystemVersion } from '@/react/portainer/system/useSystemVersion';
+import { useIsEdgeAdmin } from '@/react/hooks/useUser';
+
+import { Modal } from '@@/modals';
+import { Button } from '@@/buttons';
+
+import styles from './Footer.module.css';
+
+export function BuildInfoModalButton() {
+  const [isBuildInfoVisible, setIsBuildInfoVisible] = useState(false);
+  const statusQuery = useSystemStatus();
+  const versionQuery = useSystemVersion();
+
+  if (!statusQuery.data || !versionQuery.data) {
+    return null;
+  }
+
+  const { Version } = statusQuery.data;
+  const { VersionSupport } = versionQuery.data;
+
+  return (
+    <>
+      <button
+        type="button"
+        data-cy="portainerSidebar-versionNumber"
+        className="btn-none hover:underline"
+        onClick={() => setIsBuildInfoVisible(true)}
+        title="About Portainer"
+      >
+        {`${Version} ${VersionSupport}`}
+      </button>
+      {isBuildInfoVisible && (
+        <BuildInfoModal closeModal={() => setIsBuildInfoVisible(false)} />
+      )}
+    </>
+  );
+}
+
+function BuildInfoModal({ closeModal }: { closeModal: () => void }) {
+  const { isAdmin } = useIsEdgeAdmin({ noEnvScope: true });
+  const versionQuery = useSystemVersion();
+  const statusQuery = useSystemStatus();
+
+  if (!statusQuery.data || !versionQuery.data) {
+    return null;
+  }
+
+  const { Edition } = statusQuery.data;
+  const {
+    ServerVersion,
+    DatabaseVersion,
+    Build,
+    Dependencies,
+    Runtime,
+    VersionSupport,
+  } = versionQuery.data;
+
+  return (
+    <Modal onDismiss={closeModal} aria-label="build-info-modal">
+      <Modal.Header title={`Portainer ${Edition}`} />
+      <Modal.Body>
+        <div className={styles.versionInfo}>
+          <table>
+            <tbody>
+              <tr>
+                <td>
+                  <span className="inline-flex flex-wrap items-center">
+                    <Server size="13" className="space-right" />
+                    Server Version: {ServerVersion} {VersionSupport}
+                  </span>
+                </td>
+                <td>
+                  <span className="inline-flex flex-wrap items-center">
+                    <Database size="13" className="space-right" />
+                    Database Version: {DatabaseVersion}
+                  </span>
+                </td>
+              </tr>
+              <tr>
+                <td>
+                  <span className="inline-flex flex-wrap items-center">
+                    <Hash size="13" className="space-right" />
+                    CI Build Number: {Build.BuildNumber}
+                  </span>
+                </td>
+                <td>
+                  <span className="inline-flex flex-wrap items-center">
+                    <Tag size="13" className="space-right" />
+                    Image Tag: {Build.ImageTag}
+                  </span>
+                </td>
+              </tr>
+              <tr>
+                <td>
+                  <span className="inline-flex flex-wrap items-center">
+                    <GitCommit size="13" className="space-right" />
+                    Git Commit: {Build.GitCommit}
+                  </span>
+                </td>
+                <td />
+              </tr>
+            </tbody>
+          </table>
+        </div>
+        <div className={styles.toolsList}>
+          <span className="inline-flex items-center">
+            <Wrench size="13" className="space-right" />
+            Compilation tools:
+          </span>
+
+          <div className={styles.tools}>
+            <span className="text-muted small">
+              Nodejs {Build.NodejsVersion}
+            </span>
+            <span className="text-muted small">pnpm v{Build.PnpmVersion}</span>
+            <span className="text-muted small">
+              Webpack v{Build.WebpackVersion}
+            </span>
+            <span className="text-muted small">Go {Build.GoVersion}</span>
+          </div>
+        </div>
+
+        <div className={clsx(styles.toolsList, 'mt-3')}>
+          <span className="inline-flex items-center">
+            <LinkIcon size="13" className="space-right" />
+            Dependencies:
+          </span>
+
+          <div className={styles.tools}>
+            <span className="text-muted small">
+              Docker {Dependencies.DockerVersion}
+            </span>
+            <span className="text-muted small">
+              Helm {Dependencies.HelmVersion}
+            </span>
+            <span className="text-muted small">
+              Kubectl {Dependencies.KubectlVersion}
+            </span>
+            <span className="text-muted small">
+              Compose {Dependencies.ComposeVersion}
+            </span>
+          </div>
+        </div>
+
+        {isAdmin && Runtime.Env && (
+          <div className={clsx(styles.toolsList, 'mt-3')}>
+            <span className="inline-flex items-center">
+              <Variable size="13" className="space-right" />
+              Environment Variables
+            </span>
+
+            <div
+              className={clsx(styles.tools, 'max-h-32 space-y-2 overflow-auto')}
+            >
+              {Runtime.Env.map((envVar) => (
+                <div key={envVar}>
+                  <code>{envVar}</code>
+                </div>
+              ))}
+            </div>
+          </div>
+        )}
+      </Modal.Body>
+      <Modal.Footer>
+        <Button
+          className="w-full"
+          onClick={closeModal}
+          data-cy="portainerBuildInfoModal-CloseButton"
+        >
+          Ok
+        </Button>
+      </Modal.Footer>
+    </Modal>
+  );
+}
diff --git a/app/react/sidebar/Footer/Footer.module.css b/app/react/sidebar/Footer/Footer.module.css
new file mode 100644
index 0000000..87001a2
--- /dev/null
+++ b/app/react/sidebar/Footer/Footer.module.css
@@ -0,0 +1,42 @@
+:global(#page-wrapper:not(.open)) .root {
+  display: none;
+}
+
+.dialog {
+  display: flex;
+  justify-content: center;
+  align-items: center;
+  z-index: 10000;
+}
+
+.versionInfo {
+  margin: 5px 15px 10px;
+  font-size: 12px;
+}
+
+.versionInfo table {
+  width: 100%;
+  table-layout: fixed;
+}
+
+.versionInfo td {
+  padding-bottom: 10px;
+}
+
+.toolsList {
+  padding: 15px;
+  border: 1px solid #d3d3d3;
+  border-radius: 5px;
+  background-color: rgba(211, 211, 211, 0.2);
+  width: max-width;
+  font-family: Arial;
+  word-break: break-all;
+}
+
+.toolsList span {
+  margin-bottom: 10px;
+}
+
+.tools span {
+  margin-right: 10px;
+}
diff --git a/app/react/sidebar/Footer/Footer.test.tsx b/app/react/sidebar/Footer/Footer.test.tsx
new file mode 100644
index 0000000..5e54156
--- /dev/null
+++ b/app/react/sidebar/Footer/Footer.test.tsx
@@ -0,0 +1,121 @@
+import { render, screen } from '@testing-library/react';
+import { vi } from 'vitest';
+
+import * as featureFlags from '@/react/portainer/feature-flags/feature-flags.service';
+import { withTestQueryProvider } from '@/react/test-utils/withTestQuery';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+
+import { SidebarProvider } from '../useSidebarState';
+
+import { Footer } from './Footer';
+
+vi.mock('./UpdateNotifications', () => ({
+  UpdateNotification: () => (
+    <div data-cy="update-notification">Update Notification</div>
+  ),
+}));
+
+vi.mock('./BuildInfoModal', () => ({
+  BuildInfoModalButton: () => (
+    <button data-cy="build-info-modal-button" type="button">
+      Build Info
+    </button>
+  ),
+}));
+
+describe('Footer', () => {
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  describe('CE Footer', () => {
+    beforeEach(() => {
+      vi.spyOn(featureFlags, 'isBE', 'get').mockReturnValue(false);
+    });
+
+    test('should render CE footer with copyright symbol', () => {
+      renderComponent();
+
+      expect(screen.getByText('©')).toBeInTheDocument();
+    });
+
+    test('should render Portainer Community Edition text', () => {
+      renderComponent();
+
+      expect(
+        screen.getByText('Portainer Community Edition')
+      ).toBeInTheDocument();
+    });
+
+    test('should render UpdateNotification component', () => {
+      renderComponent();
+
+      expect(screen.getByTestId('update-notification')).toBeInTheDocument();
+    });
+
+    test('should render BuildInfoModalButton component', () => {
+      renderComponent();
+
+      expect(screen.getByTestId('build-info-modal-button')).toBeInTheDocument();
+    });
+  });
+
+  describe('BE Footer', () => {
+    beforeEach(() => {
+      vi.spyOn(featureFlags, 'isBE', 'get').mockReturnValue(true);
+    });
+
+    test('should render BE footer with copyright symbol', () => {
+      renderComponent();
+
+      expect(screen.getByText('©')).toBeInTheDocument();
+    });
+
+    test('should render Portainer Business Edition text', () => {
+      renderComponent();
+
+      expect(
+        screen.getByText('Portainer Business Edition')
+      ).toBeInTheDocument();
+    });
+
+    test('should NOT render UpdateNotification component in BE', () => {
+      renderComponent();
+
+      expect(
+        screen.queryByTestId('update-notification')
+      ).not.toBeInTheDocument();
+    });
+
+    test('should render BuildInfoModalButton component', () => {
+      renderComponent();
+
+      expect(screen.getByTestId('build-info-modal-button')).toBeInTheDocument();
+    });
+  });
+
+  describe('FooterContent', () => {
+    test('should render all child elements in correct order', () => {
+      renderComponent();
+
+      const copyrightSymbol = screen.getByText('©');
+      const editionText = screen.getByText(
+        /Portainer (Community|Business) Edition/
+      );
+      const buildInfoButton = screen.getByTestId('build-info-modal-button');
+
+      expect(copyrightSymbol).toBeInTheDocument();
+      expect(editionText).toBeInTheDocument();
+      expect(buildInfoButton).toBeInTheDocument();
+    });
+  });
+});
+
+function renderComponent() {
+  const Wrapper = withTestQueryProvider(withUserProvider(Footer));
+  return render(
+    <SidebarProvider>
+      <Wrapper />
+    </SidebarProvider>
+  );
+}
diff --git a/app/react/sidebar/Footer/Footer.tsx b/app/react/sidebar/Footer/Footer.tsx
new file mode 100644
index 0000000..66f426f
--- /dev/null
+++ b/app/react/sidebar/Footer/Footer.tsx
@@ -0,0 +1,49 @@
+import { PropsWithChildren } from 'react';
+import clsx from 'clsx';
+
+import { isBE } from '@/react/portainer/feature-flags/feature-flags.service';
+
+import { UpdateNotification } from './UpdateNotifications';
+import { BuildInfoModalButton } from './BuildInfoModal';
+import '@reach/dialog/styles.css';
+import styles from './Footer.module.css';
+
+export function Footer() {
+  return isBE ? <BEFooter /> : <CEFooter />;
+}
+
+function CEFooter() {
+  return (
+    <div className={clsx(styles.root, 'text-center')}>
+      <UpdateNotification />
+
+      <FooterContent>
+        <span>&copy;</span>
+        <span>Portainer Community Edition</span>
+
+        <BuildInfoModalButton />
+      </FooterContent>
+    </div>
+  );
+}
+
+function BEFooter() {
+  return (
+    <div className={clsx(styles.root, 'text-center')}>
+      <FooterContent>
+        <span>&copy;</span>
+        <span>Portainer Business Edition</span>
+
+        <BuildInfoModalButton />
+      </FooterContent>
+    </div>
+  );
+}
+
+function FooterContent({ children }: PropsWithChildren<unknown>) {
+  return (
+    <div className="mx-auto flex items-baseline justify-center space-x-1 text-[10px] text-gray-5 be:text-gray-6">
+      {children}
+    </div>
+  );
+}
diff --git a/app/react/sidebar/Footer/UpdateNotifications.module.css b/app/react/sidebar/Footer/UpdateNotifications.module.css
new file mode 100644
index 0000000..7f1fdcf
--- /dev/null
+++ b/app/react/sidebar/Footer/UpdateNotifications.module.css
@@ -0,0 +1,19 @@
+.root {
+  padding: 12px;
+  margin-bottom: 20px;
+  text-align: left;
+}
+
+.dismissTitle {
+  color: var(--white-color);
+}
+
+.dismissBtn {
+  border: none;
+  background: none;
+  color: var(--text-muted-color);
+}
+
+.actions {
+  padding-left: 26px;
+}
diff --git a/app/react/sidebar/Footer/UpdateNotifications.tsx b/app/react/sidebar/Footer/UpdateNotifications.tsx
new file mode 100644
index 0000000..a94bf74
--- /dev/null
+++ b/app/react/sidebar/Footer/UpdateNotifications.tsx
@@ -0,0 +1,68 @@
+import clsx from 'clsx';
+import { DownloadCloud } from 'lucide-react';
+
+import { useUIState } from '@/react/hooks/useUIState';
+import { useSystemVersion } from '@/react/portainer/system/useSystemVersion';
+
+import { Icon } from '@@/Icon';
+
+import styles from './UpdateNotifications.module.css';
+
+export function UpdateNotification() {
+  const uiStateStore = useUIState();
+  const query = useSystemVersion();
+
+  if (!query.data || !query.data.UpdateAvailable) {
+    return null;
+  }
+
+  const { LatestVersion } = query.data;
+
+  if (
+    !!uiStateStore.dismissedUpdateVersion &&
+    LatestVersion?.length > 0 &&
+    uiStateStore.dismissedUpdateVersion === LatestVersion
+  ) {
+    return null;
+  }
+
+  return (
+    <div
+      className={clsx(
+        styles.root,
+        'rounded border py-2',
+        'bg-blue-11 th-dark:bg-gray-warm-11',
+        'border-blue-9 th-dark:border-gray-warm-9'
+      )}
+    >
+      <div className={clsx(styles.dismissTitle, 'vertical-center')}>
+        <Icon icon={DownloadCloud} mode="primary" size="md" />
+        <span className="space-left">
+          New version available {LatestVersion}
+        </span>
+      </div>
+
+      <div className={clsx(styles.actions)}>
+        <button
+          type="button"
+          className={clsx(styles.dismissBtn, 'space-right')}
+          onClick={() => onDismiss(LatestVersion)}
+        >
+          Dismiss
+        </button>
+        <a
+          className="hyperlink space-left"
+          target="_blank"
+          href={`https://github.com/portainer/portainer/releases/tag/${LatestVersion}`}
+          rel="noreferrer"
+        >
+          See what&apos;s new
+        </a>
+      </div>
+    </div>
+  );
+
+  function onDismiss(version: string) {
+    uiStateStore.dismissUpdateVersion(version);
+  }
+}
diff --git a/app/react/sidebar/Footer/index.ts b/app/react/sidebar/Footer/index.ts
new file mode 100644
index 0000000..65e2506
--- /dev/null
+++ b/app/react/sidebar/Footer/index.ts
@@ -0,0 +1 @@
+export { Footer } from './Footer';
diff --git a/app/react/sidebar/Header.module.css b/app/react/sidebar/Header.module.css
new file mode 100644
index 0000000..82a002e
--- /dev/null
+++ b/app/react/sidebar/Header.module.css
@@ -0,0 +1,5 @@
+.logo {
+  display: inline;
+  max-height: 55px;
+  max-width: min(100%, 220px);
+}
diff --git a/app/react/sidebar/Header.test.tsx b/app/react/sidebar/Header.test.tsx
new file mode 100644
index 0000000..bc17370
--- /dev/null
+++ b/app/react/sidebar/Header.test.tsx
@@ -0,0 +1,117 @@
+import { render, screen } from '@testing-library/react';
+
+import { withTestRouter } from '@/react/test-utils/withRouter';
+
+import { Context } from './useSidebarState';
+import { Header } from './Header';
+
+vi.mock('@/react/portainer/feature-flags/feature-flags.service', () => ({
+  isBE: false,
+}));
+
+function renderComponent(
+  props = {},
+  sidebarState = { isOpen: true, toggle: vi.fn() }
+) {
+  const Wrapped = withTestRouter(Header);
+
+  return render(
+    <Context.Provider value={sidebarState}>
+      <Wrapped {...props} />
+    </Context.Provider>
+  );
+}
+
+describe('Header', () => {
+  it('should render with default logo when no custom logo provided', () => {
+    renderComponent();
+
+    const logo = screen.getByAltText('Logo');
+    expect(logo).toBeInTheDocument();
+    expect(logo).toHaveAttribute(
+      'src',
+      expect.stringContaining('portainer_logo-CE.svg')
+    );
+  });
+
+  it('should render with custom logo when provided', () => {
+    const customLogo = 'https://example.com/custom-logo.png';
+    renderComponent({ logo: customLogo });
+
+    const logo = screen.getByAltText('Logo');
+    expect(logo).toBeInTheDocument();
+    expect(logo).toHaveAttribute('src', customLogo);
+  });
+
+  it('should show "Powered by" section when sidebar is open and custom logo is provided', () => {
+    const customLogo = 'https://example.com/custom-logo.png';
+    renderComponent({ logo: customLogo });
+
+    expect(screen.getByText('Powered by')).toBeInTheDocument();
+    expect(screen.getByText('portainer community')).toBeInTheDocument();
+  });
+
+  it('should not show "Powered by" section when no custom logo', () => {
+    renderComponent();
+
+    expect(screen.queryByText('Powered by')).not.toBeInTheDocument();
+  });
+
+  it('should not show "Powered by" section when sidebar is closed', () => {
+    const customLogo = 'https://example.com/custom-logo.png';
+    renderComponent({ logo: customLogo }, { isOpen: false, toggle: vi.fn() });
+
+    expect(screen.queryByText('Powered by')).not.toBeInTheDocument();
+  });
+
+  it('should apply flex-wrap class to logo container', () => {
+    renderComponent();
+
+    const logoContainer = screen.getByTestId(
+      'portainerSidebar-homeImage'
+    ).parentElement;
+    expect(logoContainer).toHaveClass('flex-wrap');
+  });
+
+  it('should apply justify-center class when sidebar is closed', () => {
+    renderComponent({}, { isOpen: false, toggle: vi.fn() });
+
+    const logoContainer = screen.getByTestId(
+      'portainerSidebar-homeImage'
+    ).parentElement;
+    expect(logoContainer).toHaveClass('justify-center');
+  });
+
+  it('should not apply justify-center class when sidebar is open', () => {
+    renderComponent();
+
+    const logoContainer = screen.getByTestId(
+      'portainerSidebar-homeImage'
+    ).parentElement;
+    expect(logoContainer).not.toHaveClass('justify-center');
+  });
+
+  it('should use small logo when sidebar is closed', () => {
+    renderComponent({}, { isOpen: false, toggle: vi.fn() });
+
+    const logo = screen.getByAltText('Logo');
+    expect(logo).toHaveAttribute(
+      'src',
+      expect.stringContaining('portainer-p-icon-white.svg')
+    );
+  });
+
+  it('should apply max-height class to logo when sidebar is closed', () => {
+    renderComponent({}, { isOpen: false, toggle: vi.fn() });
+
+    const logo = screen.getByAltText('Logo');
+    expect(logo).toHaveClass('!max-h-[27px]');
+  });
+
+  it('should not apply max-height class to logo when sidebar is open', () => {
+    renderComponent();
+
+    const logo = screen.getByAltText('Logo');
+    expect(logo).not.toHaveClass('!max-h-[27px]');
+  });
+});
diff --git a/app/react/sidebar/Header.tsx b/app/react/sidebar/Header.tsx
new file mode 100644
index 0000000..62dd22a
--- /dev/null
+++ b/app/react/sidebar/Header.tsx
@@ -0,0 +1,94 @@
+import clsx from 'clsx';
+
+import { isBE } from '@/react/portainer/feature-flags/feature-flags.service';
+
+import { Link } from '@@/Link';
+
+import fullLogoBE from './portainer_logo-BE.svg';
+import fullLogoCE from './portainer_logo-CE.svg';
+import portainerIcon from './portainer-p-icon-white.svg';
+import { useSidebarState } from './useSidebarState';
+import styles from './Header.module.css';
+
+interface Props {
+  logo?: string;
+}
+
+export function Header({ logo: customLogo }: Props) {
+  const { isOpen } = useSidebarState();
+
+  return (
+    <div
+      className={clsx('flex w-full flex-wrap', {
+        'justify-center pr-5': !isOpen,
+      })}
+    >
+      <Link
+        to="portainer.home"
+        data-cy="portainerSidebar-homeImage"
+        className="text-2xl text-white no-underline hover:text-white hover:no-underline focus:text-white focus:no-underline focus:outline-none"
+      >
+        <Logo customLogo={customLogo} isOpen={isOpen} />
+      </Link>
+      {isOpen && customLogo && (
+        <div
+          className={clsx(
+            'space-x-1 pt-3 text-[9.4px] uppercase tracking-[.28em]',
+            'text-gray-3',
+            'th-dark:text-gray-warm-6'
+          )}
+        >
+          <span className="font-medium">Powered by</span>
+          <span className="font-semibold">
+            {isBE ? (
+              'portainer business'
+            ) : (
+              <a
+                href="https://www.portainer.io/install-BE-now"
+                className={clsx(
+                  'hover:underline',
+                  'text-blue-6 hover:text-blue-8',
+                  'th-dark:text-blue-7 th-dark:hover:text-blue-9'
+                )}
+              >
+                portainer community
+              </a>
+            )}
+          </span>
+        </div>
+      )}
+    </div>
+  );
+}
+
+function getLogo(isOpen: boolean, customLogo?: string) {
+  if (customLogo) {
+    return customLogo;
+  }
+
+  if (!isOpen) {
+    return portainerIcon;
+  }
+
+  return isBE ? fullLogoBE : fullLogoCE;
+}
+
+function Logo({
+  customLogo,
+  isOpen,
+}: {
+  customLogo?: string;
+  isOpen: boolean;
+}) {
+  const logo = getLogo(isOpen, customLogo);
+
+  return (
+    <img
+      src={logo}
+      className={clsx('img-responsive', styles.logo, {
+        '!max-h-[27px]': !isOpen,
+      })}
+      alt="Logo"
+    />
+  );
+}
diff --git a/app/react/sidebar/KubernetesSidebar/KubectlShellButton.test.tsx b/app/react/sidebar/KubernetesSidebar/KubectlShellButton.test.tsx
new file mode 100644
index 0000000..175894d
--- /dev/null
+++ b/app/react/sidebar/KubernetesSidebar/KubectlShellButton.test.tsx
@@ -0,0 +1,105 @@
+import { render, fireEvent, screen } from '@testing-library/react';
+import { vi } from 'vitest';
+import { PropsWithChildren, useMemo } from 'react';
+
+import { Context } from '../useSidebarState';
+
+import { KubectlShellButton } from './KubectlShellButton';
+
+vi.mock('@/portainer/helpers/pathHelper', () => ({
+  baseHref: vi.fn().mockReturnValue('/portainer'),
+}));
+
+const mockWindowOpen = vi.fn();
+const originalWindowOpen = window.open;
+
+beforeEach(() => {
+  window.open = mockWindowOpen;
+  mockWindowOpen.mockClear();
+});
+
+afterEach(() => {
+  window.open = originalWindowOpen;
+});
+
+function MockSidebarProvider({
+  children,
+  isOpen = true,
+}: PropsWithChildren<{ isOpen?: boolean }>) {
+  const state = useMemo(() => ({ isOpen, toggle: vi.fn() }), [isOpen]);
+
+  return <Context.Provider value={state}>{children}</Context.Provider>;
+}
+
+function renderComponent(environmentId = 1, isSidebarOpen = true) {
+  return render(
+    <MockSidebarProvider isOpen={isSidebarOpen}>
+      <KubectlShellButton environmentId={environmentId} />
+    </MockSidebarProvider>
+  );
+}
+
+describe('KubectlShellButton', () => {
+  test('should render button with text when sidebar is open', () => {
+    renderComponent();
+
+    const button = screen.getByTestId('k8sSidebar-shellButton');
+    expect(button).toBeVisible();
+    expect(button).toHaveTextContent('kubectl shell');
+  });
+
+  test('should render button without text when sidebar is closed', () => {
+    renderComponent(1, false);
+
+    const button = screen.getByTestId('k8sSidebar-shellButton');
+    expect(button).toBeVisible();
+    expect(button).not.toHaveTextContent('kubectl shell');
+    expect(button).toHaveClass('!p-1');
+  });
+
+  test('should wrap button in tooltip when sidebar is closed', () => {
+    renderComponent(1, false);
+
+    // When sidebar is closed, the button is wrapped in a span with flex classes
+    const button = screen.getByTestId('k8sSidebar-shellButton');
+    const wrapperSpan = button.parentElement;
+    expect(wrapperSpan).toHaveClass('flex', 'w-full', 'justify-center');
+
+    // The button should have the !p-1 class when sidebar is closed
+    expect(button).toHaveClass('!p-1');
+  });
+
+  test('should open new window with correct URL when button is clicked', () => {
+    const environmentId = 5;
+    renderComponent(environmentId);
+
+    const button = screen.getByTestId('k8sSidebar-shellButton');
+    fireEvent.click(button);
+
+    expect(mockWindowOpen).toHaveBeenCalledTimes(1);
+    const [url, windowName, windowFeatures] = mockWindowOpen.mock.calls[0];
+
+    expect(url).toBe(
+      `${window.location.origin}/portainer#!/${environmentId}/kubernetes/kubectl-shell`
+    );
+    expect(windowName).toMatch(/^kubectl-shell-5-[a-f0-9-]+$/);
+    expect(windowFeatures).toBe('width=800,height=600');
+  });
+
+  test('should generate unique window names for multiple clicks', () => {
+    renderComponent();
+
+    const button = screen.getByRole('button');
+
+    // Click multiple times
+    fireEvent.click(button);
+    fireEvent.click(button);
+
+    expect(mockWindowOpen).toHaveBeenCalledTimes(2);
+
+    const windowName1 = mockWindowOpen.mock.calls[0][1];
+    const windowName2 = mockWindowOpen.mock.calls[1][1];
+
+    expect(windowName1).not.toBe(windowName2);
+  });
+});
diff --git a/app/react/sidebar/KubernetesSidebar/KubectlShellButton.tsx b/app/react/sidebar/KubernetesSidebar/KubectlShellButton.tsx
new file mode 100644
index 0000000..768b0b2
--- /dev/null
+++ b/app/react/sidebar/KubernetesSidebar/KubectlShellButton.tsx
@@ -0,0 +1,56 @@
+import { Terminal } from 'lucide-react';
+import clsx from 'clsx';
+import { v4 as uuidv4 } from 'uuid';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { baseHref } from '@/portainer/helpers/pathHelper';
+
+import { Button } from '@@/buttons';
+
+import { useSidebarState } from '../useSidebarState';
+import { SidebarTooltip } from '../SidebarItem/SidebarTooltip';
+
+interface Props {
+  environmentId: EnvironmentId;
+}
+export function KubectlShellButton({ environmentId }: Props) {
+  const { isOpen: isSidebarOpen } = useSidebarState();
+
+  const button = (
+    <Button
+      color="primary"
+      size="small"
+      data-cy="k8sSidebar-shellButton"
+      onClick={() => handleOpen()}
+      className={clsx('sidebar', !isSidebarOpen && '!p-1')}
+      icon={Terminal}
+    >
+      {isSidebarOpen ? 'kubectl shell' : ''}
+    </Button>
+  );
+
+  return (
+    <>
+      {!isSidebarOpen && (
+        <SidebarTooltip
+          content={
+            <span className="whitespace-nowrap text-sm">Kubectl Shell</span>
+          }
+        >
+          <span className="flex w-full justify-center">{button}</span>
+        </SidebarTooltip>
+      )}
+      {isSidebarOpen && button}
+    </>
+  );
+
+  function handleOpen() {
+    const url = window.location.origin + baseHref();
+    window.open(
+      `${url}#!/${environmentId}/kubernetes/kubectl-shell`,
+      // give the window a unique name so that more than one can be opened
+      `kubectl-shell-${environmentId}-${uuidv4()}`,
+      'width=800,height=600'
+    );
+  }
+}
diff --git a/app/react/sidebar/KubernetesSidebar/KubernetesSidebar.tsx b/app/react/sidebar/KubernetesSidebar/KubernetesSidebar.tsx
new file mode 100644
index 0000000..432c018
--- /dev/null
+++ b/app/react/sidebar/KubernetesSidebar/KubernetesSidebar.tsx
@@ -0,0 +1,232 @@
+import {
+  Box,
+  Database,
+  Edit,
+  Layers,
+  LayoutList,
+  Lock,
+  Network,
+  Server,
+} from 'lucide-react';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { Authorized } from '@/react/hooks/useUser';
+import { isBE } from '@/react/portainer/feature-flags/feature-flags.service';
+
+import { DashboardLink } from '../items/DashboardLink';
+import { SidebarItem } from '../SidebarItem';
+import { SidebarParent } from '../SidebarItem/SidebarParent';
+
+import { KubectlShellButton } from './KubectlShellButton';
+
+interface Props {
+  environmentId: EnvironmentId;
+}
+
+export function KubernetesSidebar({ environmentId }: Props) {
+  return (
+    <>
+      <div className="-mt-2 mb-2 flex w-full justify-center">
+        <KubectlShellButton environmentId={environmentId} />
+      </div>
+
+      <DashboardLink
+        environmentId={environmentId}
+        platformPath="kubernetes"
+        data-cy="k8sSidebar-dashboard"
+      />
+
+      <SidebarItem
+        to="kubernetes.templates.custom"
+        params={{ endpointId: environmentId }}
+        icon={Edit}
+        label="Custom Templates"
+        data-cy="k8sSidebar-customTemplates"
+      />
+
+      <SidebarItem
+        to="kubernetes.resourcePools"
+        params={{ endpointId: environmentId }}
+        icon={Layers}
+        label="Namespaces"
+        data-cy="k8sSidebar-namespaces"
+      />
+
+      <SidebarItem
+        to="kubernetes.applications"
+        params={{ endpointId: environmentId }}
+        includePaths={['kubernetes.helm', 'kubernetes.helminstall']}
+        icon={Box}
+        label="Applications"
+        data-cy="k8sSidebar-applications"
+      />
+
+      <SidebarParent
+        label="Networking"
+        icon={Network}
+        to="kubernetes.services"
+        params={{ endpointId: environmentId }}
+        pathOptions={{ includePaths: ['kubernetes.ingresses'] }}
+        data-cy="k8sSidebar-networking"
+        listId="k8sSidebar-networking"
+      >
+        <SidebarItem
+          to="kubernetes.services"
+          params={{ endpointId: environmentId }}
+          label="Services"
+          isSubMenu
+          data-cy="k8sSidebar-services"
+        />
+
+        <SidebarItem
+          to="kubernetes.ingresses"
+          params={{ endpointId: environmentId }}
+          label="Ingresses"
+          isSubMenu
+          data-cy="k8sSidebar-ingresses"
+        />
+      </SidebarParent>
+
+      <SidebarItem
+        to="kubernetes.configurations"
+        params={{ endpointId: environmentId }}
+        icon={Lock}
+        label="ConfigMaps & Secrets"
+        data-cy="k8sSidebar-configurations"
+      />
+
+      <SidebarItem
+        to="kubernetes.volumes.index"
+        params={{ endpointId: environmentId }}
+        icon={Database}
+        label="Volumes"
+        data-cy="k8sSidebar-volumes"
+      />
+
+      <SidebarParent
+        label="More Resources"
+        to="kubernetes.moreResources.jobs"
+        pathOptions={{
+          includePaths: [
+            'kubernetes.moreResources.jobs',
+            'kubernetes.moreResources.serviceAccounts',
+            'kubernetes.moreResources.clusterRoles',
+            'kubernetes.moreResources.roles',
+          ],
+        }}
+        icon={LayoutList}
+        params={{ endpointId: environmentId }}
+        data-cy="k8sSidebar-moreResources"
+        listId="k8sSidebar-moreResources"
+      >
+        <SidebarItem
+          to="kubernetes.moreResources.jobs"
+          params={{ endpointId: environmentId }}
+          label="Cron Jobs & Jobs"
+          data-cy="k8sSidebar-jobs"
+          isSubMenu
+        />
+        <Authorized
+          authorizations="K8sMoreResourcesRW"
+          adminOnlyCE
+          environmentId={environmentId}
+        >
+          <SidebarItem
+            to="kubernetes.moreResources.serviceAccounts"
+            params={{ endpointId: environmentId }}
+            label="Service Accounts"
+            data-cy="k8sSidebar-serviceAccounts"
+            isSubMenu
+          />
+          <SidebarItem
+            to="kubernetes.moreResources.clusterRoles"
+            params={{ endpointId: environmentId }}
+            label="Cluster Roles"
+            data-cy="k8sSidebar-clusterRoles"
+            isSubMenu
+          />
+          <SidebarItem
+            to="kubernetes.moreResources.roles"
+            params={{ endpointId: environmentId }}
+            label="Roles"
+            data-cy="k8sSidebar-Roles"
+            isSubMenu
+          />
+        </Authorized>
+      </SidebarParent>
+
+      <SidebarParent
+        label="Cluster"
+        icon={Server}
+        to="kubernetes.cluster"
+        params={{ endpointId: environmentId }}
+        pathOptions={{ includePaths: ['kubernetes.registries'] }}
+        data-cy="k8sSidebar-cluster-area"
+        listId="k8sSidebar-cluster-area"
+      >
+        <SidebarItem
+          label="Details"
+          to="kubernetes.cluster"
+          ignorePaths={[
+            'kubernetes.cluster.setup',
+            'kubernetes.cluster.securityConstraint',
+          ]}
+          params={{ endpointId: environmentId }}
+          isSubMenu
+          data-cy="k8sSidebar-cluster"
+        />
+        <Authorized
+          authorizations="K8sClusterSetupRW"
+          adminOnlyCE
+          environmentId={environmentId}
+        >
+          <SidebarItem
+            to="kubernetes.cluster.setup"
+            params={{ endpointId: environmentId }}
+            label="Setup"
+            isSubMenu
+            data-cy="k8sSidebar-setup"
+          />
+        </Authorized>
+
+        <Authorized
+          authorizations="K8sClusterSetupRW"
+          adminOnlyCE
+          environmentId={environmentId}
+        >
+          <SidebarItem
+            to="kubernetes.cluster.securityConstraint"
+            params={{ endpointId: environmentId }}
+            label="Security constraints"
+            isSubMenu
+            data-cy="k8sSidebar-securityConstraints"
+          />
+        </Authorized>
+
+        {isBE && (
+          <Authorized
+            authorizations="K8sClusterSetupRW"
+            adminOnlyCE
+            environmentId={environmentId}
+          >
+            <SidebarItem
+              to="kubernetes.cluster.securityConstraint"
+              params={{ endpointId: environmentId }}
+              label="Security Constraints"
+              isSubMenu
+              data-cy="k8sSidebar-securityConstraints"
+            />
+          </Authorized>
+        )}
+
+        <SidebarItem
+          to="kubernetes.registries"
+          params={{ endpointId: environmentId }}
+          label="Registries"
+          isSubMenu
+          data-cy="k8sSidebar-registries"
+        />
+      </SidebarParent>
+    </>
+  );
+}
diff --git a/app/react/sidebar/KubernetesSidebar/index.ts b/app/react/sidebar/KubernetesSidebar/index.ts
new file mode 100644
index 0000000..deb2a2a
--- /dev/null
+++ b/app/react/sidebar/KubernetesSidebar/index.ts
@@ -0,0 +1 @@
+export { KubernetesSidebar } from './KubernetesSidebar';
diff --git a/app/react/sidebar/SettingsSidebar.test.tsx b/app/react/sidebar/SettingsSidebar.test.tsx
new file mode 100644
index 0000000..275fcbc
--- /dev/null
+++ b/app/react/sidebar/SettingsSidebar.test.tsx
@@ -0,0 +1,392 @@
+import { render, screen } from '@testing-library/react';
+import { vi } from 'vitest';
+
+import { UserViewModel } from '@/portainer/models/user';
+import { withUserProvider } from '@/react/test-utils/withUserProvider';
+import { withTestRouter } from '@/react/test-utils/withRouter';
+import * as featureFlags from '@/react/portainer/feature-flags/feature-flags.service';
+import { usePublicSettings } from '@/react/portainer/settings/queries';
+import { PublicSettingsResponse } from '@/react/portainer/settings/types';
+
+import { TestSidebarProvider } from './useSidebarState';
+import { SettingsSidebar } from './SettingsSidebar';
+
+vi.mock('@/react/portainer/settings/queries', () => ({
+  usePublicSettings: vi.fn(),
+}));
+
+describe('SettingsSidebar', () => {
+  beforeEach(() => {
+    vi.spyOn(featureFlags, 'isBE', 'get').mockReturnValue(false);
+    // Default mock for usePublicSettings - returns data based on selector
+    vi.mocked(usePublicSettings).mockImplementation(((options?: {
+      select?: (settings: PublicSettingsResponse) => PublicSettingsResponse;
+    }) => {
+      const settings: PublicSettingsResponse = {
+        TeamSync: false,
+        EnableEdgeComputeFeatures: false,
+      } as unknown as PublicSettingsResponse;
+      return {
+        data: options?.select ? options.select(settings) : settings,
+        isLoading: false,
+        isError: false,
+      };
+    }) as typeof usePublicSettings);
+    window.ddExtension = false;
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  describe('Pure Admin User', () => {
+    it('should render all admin sections for pure admin', () => {
+      renderComponent({ isPureAdmin: true, isAdmin: true });
+
+      expect(screen.getByText('Administration')).toBeInTheDocument();
+      expect(
+        screen.getByTestId('portainerSidebar-userRelated')
+      ).toBeInTheDocument();
+      expect(
+        screen.getByTestId('portainerSidebar-environments-area')
+      ).toBeInTheDocument();
+      expect(
+        screen.getByTestId('portainerSidebar-registries')
+      ).toBeInTheDocument();
+      expect(screen.getByTestId('k8sSidebar-logs')).toBeInTheDocument();
+      expect(
+        screen.getByTestId('portainerSidebar-notifications')
+      ).toBeInTheDocument();
+      expect(
+        screen.getByTestId('portainerSidebar-settings')
+      ).toBeInTheDocument();
+    });
+
+    it('should render user-related submenu items', () => {
+      renderComponent({ isPureAdmin: true, isAdmin: true });
+
+      expect(screen.getByTestId('portainerSidebar-users')).toBeInTheDocument();
+      expect(screen.getByTestId('portainerSidebar-teams')).toBeInTheDocument();
+      expect(screen.getByTestId('portainerSidebar-roles')).toBeInTheDocument();
+    });
+
+    it('should render environment-related submenu items', () => {
+      renderComponent({ isPureAdmin: true, isAdmin: true });
+
+      expect(
+        screen.getByTestId('portainerSidebar-environments')
+      ).toBeInTheDocument();
+      expect(
+        screen.getByTestId('portainerSidebar-environmentGroups')
+      ).toBeInTheDocument();
+      expect(
+        screen.getByTestId('portainerSidebar-environmentTags')
+      ).toBeInTheDocument();
+    });
+
+    it('should render logs submenu items', () => {
+      renderComponent({ isPureAdmin: true, isAdmin: true });
+
+      expect(
+        screen.getByTestId('portainerSidebar-authLogs')
+      ).toBeInTheDocument();
+      expect(
+        screen.getByTestId('portainerSidebar-activityLogs')
+      ).toBeInTheDocument();
+    });
+
+    it('should render settings submenu items', () => {
+      renderComponent({ isPureAdmin: true, isAdmin: true });
+
+      expect(
+        screen.getByTestId('portainerSidebar-generalSettings')
+      ).toBeInTheDocument();
+      expect(
+        screen.getByTestId('portainerSidebar-authentication')
+      ).toBeInTheDocument();
+      expect(
+        screen.getByTestId('portainerSidebar-edgeCompute')
+      ).toBeInTheDocument();
+    });
+
+    it('should render Get Help link with correct CE URL', () => {
+      renderComponent({ isPureAdmin: true, isAdmin: true });
+
+      const helpLink = screen.getByRole('link', { name: /Get Help/i });
+      expect(helpLink).toBeInTheDocument();
+      expect(helpLink).toHaveAttribute(
+        'href',
+        'https://www.portainer.io/community_help'
+      );
+      expect(helpLink).toHaveAttribute('target', '_blank');
+      expect(helpLink).toHaveAttribute('rel', 'noreferrer');
+    });
+
+    it('should not render Licenses sidebar item in CE', () => {
+      renderComponent({ isPureAdmin: true, isAdmin: true });
+
+      expect(
+        screen.queryByTestId('portainerSidebar-licenses')
+      ).not.toBeInTheDocument();
+    });
+
+    it('should not render Shared Credentials in CE', () => {
+      renderComponent({ isPureAdmin: true, isAdmin: true });
+
+      expect(
+        screen.queryByTestId('portainerSidebar-cloud')
+      ).not.toBeInTheDocument();
+    });
+  });
+
+  describe('Team Leader User', () => {
+    it('should render user-related section for team leader when TeamSync is disabled', () => {
+      vi.mocked(usePublicSettings).mockReturnValue({
+        data: false,
+        isLoading: false,
+        isError: false,
+      } as ReturnType<typeof usePublicSettings>);
+
+      renderComponent({
+        isPureAdmin: false,
+        isAdmin: false,
+        isTeamLeader: true,
+      });
+
+      expect(
+        screen.getByTestId('portainerSidebar-userRelated')
+      ).toBeInTheDocument();
+      expect(screen.getByTestId('portainerSidebar-users')).toBeInTheDocument();
+      expect(screen.getByTestId('portainerSidebar-teams')).toBeInTheDocument();
+    });
+
+    it('should not render Roles for team leader', () => {
+      vi.mocked(usePublicSettings).mockReturnValue({
+        data: false,
+        isLoading: false,
+        isError: false,
+      } as ReturnType<typeof usePublicSettings>);
+
+      renderComponent({
+        isPureAdmin: false,
+        isAdmin: false,
+        isTeamLeader: true,
+      });
+
+      expect(
+        screen.queryByTestId('portainerSidebar-roles')
+      ).not.toBeInTheDocument();
+    });
+
+    it('should not render user-related section when TeamSync is enabled', () => {
+      vi.mocked(usePublicSettings).mockReturnValue({
+        data: true,
+        isLoading: false,
+        isError: false,
+      } as ReturnType<typeof usePublicSettings>);
+
+      renderComponent({
+        isPureAdmin: false,
+        isAdmin: false,
+        isTeamLeader: true,
+      });
+
+      expect(
+        screen.queryByTestId('portainerSidebar-userRelated')
+      ).not.toBeInTheDocument();
+    });
+
+    it('should not render admin-only sections for team leader', () => {
+      renderComponent({
+        isPureAdmin: false,
+        isAdmin: false,
+        isTeamLeader: true,
+      });
+
+      expect(
+        screen.queryByTestId('portainerSidebar-environments-area')
+      ).not.toBeInTheDocument();
+      expect(
+        screen.queryByTestId('portainerSidebar-registries')
+      ).not.toBeInTheDocument();
+      expect(screen.queryByTestId('k8sSidebar-logs')).not.toBeInTheDocument();
+      expect(
+        screen.queryByTestId('portainerSidebar-settings')
+      ).not.toBeInTheDocument();
+    });
+
+    it('should render notifications for team leader', () => {
+      renderComponent({
+        isPureAdmin: false,
+        isAdmin: false,
+        isTeamLeader: true,
+      });
+
+      expect(
+        screen.getByTestId('portainerSidebar-notifications')
+      ).toBeInTheDocument();
+    });
+  });
+
+  describe('Regular Admin User (not Pure Admin)', () => {
+    it('should not render admin-only sections', () => {
+      renderComponent({ isPureAdmin: false, isAdmin: true });
+
+      expect(
+        screen.queryByTestId('portainerSidebar-userRelated')
+      ).not.toBeInTheDocument();
+      expect(
+        screen.queryByTestId('portainerSidebar-environments-area')
+      ).not.toBeInTheDocument();
+      expect(
+        screen.queryByTestId('portainerSidebar-registries')
+      ).not.toBeInTheDocument();
+      expect(screen.queryByTestId('k8sSidebar-logs')).not.toBeInTheDocument();
+      expect(
+        screen.queryByTestId('portainerSidebar-settings')
+      ).not.toBeInTheDocument();
+    });
+
+    it('should render notifications for regular admin', () => {
+      renderComponent({ isPureAdmin: false, isAdmin: true });
+
+      expect(
+        screen.getByTestId('portainerSidebar-notifications')
+      ).toBeInTheDocument();
+    });
+  });
+
+  describe('DD Extension Environment', () => {
+    it('should not render user-related section when ddExtension is enabled', () => {
+      window.ddExtension = true;
+
+      renderComponent({ isPureAdmin: true, isAdmin: true });
+
+      expect(
+        screen.queryByTestId('portainerSidebar-userRelated')
+      ).not.toBeInTheDocument();
+    });
+
+    it('should not render authentication settings when ddExtension is enabled', () => {
+      window.ddExtension = true;
+
+      renderComponent({ isPureAdmin: true, isAdmin: true });
+
+      expect(
+        screen.queryByTestId('portainerSidebar-authentication')
+      ).not.toBeInTheDocument();
+    });
+
+    it('should still render other admin sections when ddExtension is enabled', () => {
+      window.ddExtension = true;
+
+      renderComponent({ isPureAdmin: true, isAdmin: true });
+
+      expect(
+        screen.getByTestId('portainerSidebar-environments-area')
+      ).toBeInTheDocument();
+      expect(
+        screen.getByTestId('portainerSidebar-registries')
+      ).toBeInTheDocument();
+      expect(
+        screen.getByTestId('portainerSidebar-settings')
+      ).toBeInTheDocument();
+    });
+  });
+
+  describe('Edge Compute Features', () => {
+    it('should not render Update & Rollback when edge compute is disabled in CE', () => {
+      vi.mocked(usePublicSettings).mockImplementation(((options?: {
+        select?: (settings: PublicSettingsResponse) => PublicSettingsResponse;
+      }) => {
+        const settings: PublicSettingsResponse = {
+          TeamSync: false,
+          EnableEdgeComputeFeatures: false,
+        } as unknown as PublicSettingsResponse;
+        return {
+          data: options?.select ? options.select(settings) : settings,
+          isLoading: false,
+          isError: false,
+        };
+      }) as typeof usePublicSettings);
+
+      renderComponent({ isPureAdmin: true, isAdmin: true });
+
+      expect(
+        screen.queryByTestId('portainerSidebar-updateSchedules')
+      ).not.toBeInTheDocument();
+    });
+
+    it('should not render Update & Rollback in CE even when edge compute is enabled', () => {
+      vi.mocked(usePublicSettings).mockImplementation(((options?: {
+        select?: (settings: PublicSettingsResponse) => PublicSettingsResponse;
+      }) => {
+        const settings: PublicSettingsResponse = {
+          TeamSync: false,
+          EnableEdgeComputeFeatures: true,
+        } as unknown as PublicSettingsResponse;
+        return {
+          data: options?.select ? options.select(settings) : settings,
+          isLoading: false,
+          isError: false,
+        };
+      }) as typeof usePublicSettings);
+
+      renderComponent({ isPureAdmin: true, isAdmin: true });
+
+      expect(
+        screen.queryByTestId('portainerSidebar-updateSchedules')
+      ).not.toBeInTheDocument();
+    });
+  });
+
+  describe('Loading States', () => {
+    it('should handle loading state for public settings', () => {
+      vi.mocked(usePublicSettings).mockReturnValue({
+        data: undefined,
+        isLoading: true,
+        isError: false,
+      } as ReturnType<typeof usePublicSettings>);
+
+      renderComponent({ isPureAdmin: true, isAdmin: true });
+
+      expect(screen.getByText('Administration')).toBeInTheDocument();
+    });
+
+    it('should handle error state for public settings', () => {
+      vi.mocked(usePublicSettings).mockReturnValue({
+        data: undefined,
+        isLoading: false,
+        isError: true,
+      } as ReturnType<typeof usePublicSettings>);
+
+      renderComponent({ isPureAdmin: true, isAdmin: true });
+
+      expect(screen.getByText('Administration')).toBeInTheDocument();
+    });
+  });
+});
+
+function renderComponent({
+  isPureAdmin,
+  isAdmin,
+  isTeamLeader = false,
+}: {
+  isPureAdmin: boolean;
+  isAdmin: boolean;
+  isTeamLeader?: boolean;
+}) {
+  const user = new UserViewModel({ Username: 'user' });
+
+  const Wrapped = withUserProvider(withTestRouter(SettingsSidebar), user);
+
+  return render(
+    <TestSidebarProvider>
+      <Wrapped
+        isPureAdmin={isPureAdmin}
+        isAdmin={isAdmin}
+        isTeamLeader={isTeamLeader}
+      />
+    </TestSidebarProvider>
+  );
+}
diff --git a/app/react/sidebar/SettingsSidebar.tsx b/app/react/sidebar/SettingsSidebar.tsx
new file mode 100644
index 0000000..74ca3e3
--- /dev/null
+++ b/app/react/sidebar/SettingsSidebar.tsx
@@ -0,0 +1,247 @@
+import {
+  Users,
+  Award,
+  Settings,
+  HardDrive,
+  Radio,
+  FileText,
+  Bell,
+} from 'lucide-react';
+
+import { usePublicSettings } from '@/react/portainer/settings/queries';
+import { isBE } from '@/react/portainer/feature-flags/feature-flags.service';
+
+import { SidebarItem } from './SidebarItem';
+import { SidebarSection } from './SidebarSection';
+import { SidebarParent } from './SidebarItem/SidebarParent';
+
+interface Props {
+  isPureAdmin: boolean;
+  isAdmin: boolean;
+  isTeamLeader?: boolean;
+}
+
+export function SettingsSidebar({
+  isPureAdmin,
+  isAdmin,
+  isTeamLeader = false,
+}: Props) {
+  const teamSyncQuery = usePublicSettings<boolean>({
+    select: (settings) => settings.TeamSync,
+  });
+
+  const isPureAdminOrTeamLeader =
+    isPureAdmin || (isTeamLeader && !teamSyncQuery.data && !isAdmin);
+  const showUsersSection = !window.ddExtension && isPureAdminOrTeamLeader;
+
+  return (
+    <SidebarSection title="Administration">
+      {showUsersSection && (
+        <SidebarParent
+          label="User-related"
+          icon={Users}
+          to="portainer.users"
+          pathOptions={{ includePaths: ['portainer.teams', 'portainer.roles'] }}
+          data-cy="portainerSidebar-userRelated"
+          listId="portainerSidebar-userRelated"
+        >
+          <SidebarItem
+            to="portainer.users"
+            label="Users"
+            isSubMenu
+            data-cy="portainerSidebar-users"
+          />
+          <SidebarItem
+            to="portainer.teams"
+            label="Teams"
+            isSubMenu
+            data-cy="portainerSidebar-teams"
+          />
+
+          {isPureAdmin && (
+            <SidebarItem
+              to="portainer.roles"
+              label="Roles"
+              isSubMenu
+              data-cy="portainerSidebar-roles"
+            />
+          )}
+        </SidebarParent>
+      )}
+      {isPureAdmin && (
+        <>
+          <SidebarParent
+            label="Environment-related"
+            icon={HardDrive}
+            to="portainer.endpoints"
+            pathOptions={{
+              includePaths: [
+                'portainer.wizard.endpoints',
+                'portainer.groups',
+                'portainer.tags',
+              ],
+            }}
+            data-cy="portainerSidebar-environments-area"
+            listId="portainer-environments"
+          >
+            <SidebarItem
+              label="Environments"
+              to="portainer.endpoints"
+              ignorePaths={['portainer.endpoints.updateSchedules']}
+              includePaths={['portainer.wizard.endpoints']}
+              isSubMenu
+              data-cy="portainerSidebar-environments"
+            />
+            <SidebarItem
+              to="portainer.groups"
+              label="Groups"
+              isSubMenu
+              data-cy="portainerSidebar-environmentGroups"
+            />
+            <SidebarItem
+              to="portainer.tags"
+              label="Tags"
+              isSubMenu
+              data-cy="portainerSidebar-environmentTags"
+            />
+            <EdgeUpdatesSidebarItem />
+          </SidebarParent>
+
+          <SidebarItem
+            label="Registries"
+            to="portainer.registries"
+            icon={Radio}
+            data-cy="portainerSidebar-registries"
+          />
+
+          {isBE && (
+            <SidebarItem
+              to="portainer.licenses"
+              label="Licenses"
+              icon={Award}
+              data-cy="portainerSidebar-licenses"
+            />
+          )}
+
+          <SidebarParent
+            label="Logs"
+            to="portainer.authLogs"
+            icon={FileText}
+            pathOptions={{
+              includePaths: ['portainer.activityLogs'],
+            }}
+            data-cy="k8sSidebar-logs"
+            listId="k8sSidebar-logs"
+          >
+            <SidebarItem
+              label="Authentication"
+              to="portainer.authLogs"
+              isSubMenu
+              data-cy="portainerSidebar-authLogs"
+            />
+            <SidebarItem
+              to="portainer.activityLogs"
+              label="Activity"
+              isSubMenu
+              data-cy="portainerSidebar-activityLogs"
+            />
+          </SidebarParent>
+        </>
+      )}
+      {isBE && !isPureAdmin && isAdmin && (
+        <SidebarParent
+          label="Environment-related"
+          icon={HardDrive}
+          to="portainer.endpoints.updateSchedules"
+          data-cy="portainerSidebar-environments-area"
+          listId="portainer-environments-area"
+        >
+          <EdgeUpdatesSidebarItem />
+        </SidebarParent>
+      )}
+
+      <SidebarItem
+        to="portainer.notifications"
+        icon={Bell}
+        label="Notifications"
+        data-cy="portainerSidebar-notifications"
+      />
+      {isPureAdmin && (
+        <SidebarParent
+          to="portainer.settings"
+          label="Settings"
+          icon={Settings}
+          data-cy="portainerSidebar-settings"
+          listId="portainer-settings"
+        >
+          <SidebarItem
+            to="portainer.settings"
+            label="General"
+            isSubMenu
+            ignorePaths={[
+              'portainer.settings.authentication',
+              'portainer.settings.sharedcredentials',
+              'portainer.settings.edgeCompute',
+            ]}
+            data-cy="portainerSidebar-generalSettings"
+          />
+          {!window.ddExtension && (
+            <SidebarItem
+              to="portainer.settings.authentication"
+              label="Authentication"
+              isSubMenu
+              data-cy="portainerSidebar-authentication"
+            />
+          )}
+          {isBE && (
+            <SidebarItem
+              to="portainer.settings.sharedcredentials"
+              label="Shared Credentials"
+              isSubMenu
+              data-cy="portainerSidebar-cloud"
+            />
+          )}
+
+          <SidebarItem
+            to="portainer.settings.edgeCompute"
+            label="Edge Compute"
+            isSubMenu
+            data-cy="portainerSidebar-edgeCompute"
+          />
+
+          <SidebarItem.Wrapper label="Get Help">
+            <a
+              href={
+                isBE
+                  ? 'https://documentation.portainer.io/r/business-support'
+                  : 'https://www.portainer.io/community_help'
+              }
+              target="_blank"
+              rel="noreferrer"
+              className="flex h-8 w-full items-center rounded px-3 text-sm !text-inherit transition-colors duration-200 hover:bg-blue-5/20 hover:!underline focus:no-underline be:hover:bg-gray-5/20 th-dark:hover:bg-gray-true-5/20"
+            >
+              Get Help
+            </a>
+          </SidebarItem.Wrapper>
+        </SidebarParent>
+      )}
+    </SidebarSection>
+  );
+}
+
+function EdgeUpdatesSidebarItem() {
+  const settingsQuery = usePublicSettings();
+
+  if (!isBE || !settingsQuery.data?.EnableEdgeComputeFeatures) {
+    return null;
+  }
+
+  return (
+    <SidebarItem
+      to="portainer.endpoints.updateSchedules"
+      label="Update & Rollback"
+      isSubMenu
+      data-cy="portainerSidebar-updateSchedules"
+    />
+  );
+}
diff --git a/app/react/sidebar/Sidebar.module.css b/app/react/sidebar/Sidebar.module.css
new file mode 100644
index 0000000..b43dda0
--- /dev/null
+++ b/app/react/sidebar/Sidebar.module.css
@@ -0,0 +1,64 @@
+:global(#page-wrapper) {
+  padding-left: var(--sidebar-closed-width);
+  transition: all 0.4s ease 0s;
+}
+
+@media only screen and (min-width: 561px) {
+  :global(#page-wrapper.open) {
+    padding-left: var(--sidebar-width);
+  }
+}
+@media only screen and (max-width: 560px) {
+  :global(#page-wrapper.open) {
+    padding-left: var(--sidebar-closed-width);
+  }
+}
+
+:global(#page-wrapper) {
+  --sidebar-width: 300px;
+  /* 32px for collapsed items + 20px padding on each side */
+  --sidebar-closed-width: 72px;
+}
+
+:global(#page-wrapper.open) .root {
+  width: var(--sidebar-width);
+}
+
+.root {
+  width: var(--sidebar-closed-width);
+  height: 100%;
+
+  position: fixed;
+  left: 0;
+
+  z-index: 10;
+  transition: all 0.4s ease 0s;
+}
+
+.nav {
+  background-color: var(--bg-sidebar-color);
+}
+
+.root ul {
+  top: 0;
+  bottom: 0;
+  padding: 0;
+  margin: 0;
+  list-style: none;
+}
+
+/* make the scrollbar track background transparent */
+.nav-list-container::-webkit-scrollbar {
+  @apply !h-4 !w-4 bg-transparent;
+}
+
+.nav-list-container::-webkit-scrollbar-thumb {
+  @apply !rounded-full !bg-gray-3/40 hover:!bg-gray-3/50 th-dark:!bg-gray-3/40 th-dark:hover:!bg-gray-3/50;
+  /* adding this border gives some gap between the right edge of the box and the scrollbar thumb for webkit browsers,
+  while giving right no right gap from the scrollbar to the box edge for non-webkit browsers (firefox) */
+  @apply !border-4 !border-solid !border-transparent bg-clip-content;
+}
+
+.nav-list-container::-webkit-scrollbar-track {
+  @apply !bg-transparent;
+}
diff --git a/app/react/sidebar/Sidebar.tsx b/app/react/sidebar/Sidebar.tsx
new file mode 100644
index 0000000..72997c2
--- /dev/null
+++ b/app/react/sidebar/Sidebar.tsx
@@ -0,0 +1,91 @@
+import clsx from 'clsx';
+import { Home } from 'lucide-react';
+
+import { useIsEdgeAdmin, useIsPureAdmin } from '@/react/hooks/useUser';
+import { useIsCurrentUserTeamLeader } from '@/portainer/users/queries';
+import { usePublicSettings } from '@/react/portainer/settings/queries';
+
+import styles from './Sidebar.module.css';
+import { EdgeComputeSidebar } from './EdgeComputeSidebar';
+import { EnvironmentSidebar } from './EnvironmentSidebar';
+import { SettingsSidebar } from './SettingsSidebar';
+import { SidebarItem } from './SidebarItem';
+import { Footer } from './Footer';
+import { Header } from './Header';
+import { SidebarProvider, useSidebarState } from './useSidebarState';
+import { UpgradeBEBannerWrapper } from './UpgradeBEBanner';
+import { AppDeliverySidebar } from './AppDeliverySidebar';
+
+export function Sidebar() {
+  return (
+    /* in the future (when we remove r2a) this should wrap the whole app - to change root styles */
+    <SidebarProvider>
+      <InnerSidebar />
+    </SidebarProvider>
+  );
+}
+
+function InnerSidebar() {
+  const isPureAdmin = useIsPureAdmin();
+  const isAdminQuery = useIsEdgeAdmin({ noEnvScope: true });
+  const isTeamLeader = useIsCurrentUserTeamLeader();
+  const { isOpen } = useSidebarState();
+
+  const settingsQuery = usePublicSettings();
+
+  if (!settingsQuery.data || isAdminQuery.isLoading) {
+    return null;
+  }
+
+  const { isAdmin } = isAdminQuery;
+
+  const { LogoURL } = settingsQuery.data;
+
+  return (
+    <div className={clsx(styles.root, 'sidebar flex flex-col')}>
+      <UpgradeBEBannerWrapper />
+      <nav
+        className={clsx(
+          styles.nav,
+          'flex flex-1 flex-col overflow-y-auto py-5 pl-5',
+          { 'pr-5': isOpen }
+        )}
+        aria-label="Main"
+      >
+        <Header logo={LogoURL} />
+        {/* negative margin + padding -> scrollbar won't hide the content */}
+        <div
+          className={clsx(
+            styles.navListContainer,
+            'mt-6 flex-1 overflow-y-auto [color-scheme:light] be:[color-scheme:dark] th-highcontrast:[color-scheme:dark] th-dark:[color-scheme:dark]',
+            { '-mr-5 pr-5': isOpen }
+          )}
+        >
+          <ul className={clsx('space-y-5', { 'w-[32px]': !isOpen })}>
+            <SidebarItem
+              to="portainer.home"
+              icon={Home}
+              label="Home"
+              data-cy="portainerSidebar-home"
+            />
+
+            <EnvironmentSidebar />
+
+            <AppDeliverySidebar />
+
+            {isAdmin && <EdgeComputeSidebar />}
+
+            <SettingsSidebar
+              isPureAdmin={isPureAdmin}
+              isAdmin={isAdmin}
+              isTeamLeader={isTeamLeader}
+            />
+          </ul>
+        </div>
+        <div className="mt-auto pt-8">
+          <Footer />
+        </div>
+      </nav>
+    </div>
+  );
+}
diff --git a/app/react/sidebar/SidebarItem/Head.tsx b/app/react/sidebar/SidebarItem/Head.tsx
new file mode 100644
index 0000000..11624f4
--- /dev/null
+++ b/app/react/sidebar/SidebarItem/Head.tsx
@@ -0,0 +1,102 @@
+import {
+  TransitionOptions,
+  useCurrentStateAndParams,
+  useSrefActive as useUiRouterSrefActive,
+} from '@uirouter/react';
+import clsx from 'clsx';
+import { ComponentProps } from 'react';
+import Tippy from '@tippyjs/react';
+
+import 'tippy.js/dist/tippy.css';
+import { Link } from '@@/Link';
+import { IconProps, Icon } from '@@/Icon';
+
+import { useSidebarState } from '../useSidebarState';
+
+interface Props extends IconProps, ComponentProps<typeof Link> {
+  label: string;
+  ignorePaths?: string[];
+}
+
+export function Head({
+  to,
+  options,
+  params = {},
+  label,
+  icon,
+  ignorePaths = [],
+  'data-cy': dataCy,
+}: Props) {
+  const { isOpen } = useSidebarState();
+  const anchorProps = useSrefActive(
+    to,
+    'bg-blue-8 be:bg-gray-8 th-dark:bg-gray-true-8',
+    params,
+    options,
+    ignorePaths
+  );
+
+  const anchor = (
+    <a
+      href={anchorProps.href}
+      onClick={anchorProps.onClick}
+      className={clsx(
+        anchorProps.className,
+        'text-inherit no-underline hover:text-inherit hover:no-underline focus:text-inherit focus:no-underline',
+        'flex h-8 w-full flex-1 items-center space-x-4 rounded-md text-sm',
+        'transition-colors duration-200 hover:bg-blue-9 be:hover:bg-gray-9 th-dark:hover:bg-gray-true-9',
+        {
+          'w-full justify-start px-3': isOpen,
+          'w-8 justify-center': !isOpen,
+        }
+      )}
+      data-cy={dataCy}
+    >
+      {!!icon && <Icon icon={icon} className={clsx('flex [&>svg]:w-4')} />}
+      {isOpen && <span>{label}</span>}
+    </a>
+  );
+
+  if (isOpen) return anchor;
+
+  return (
+    <Tippy
+      className="!rounded-md bg-blue-9 !px-3 !py-2 !opacity-100 be:bg-gray-9 th-dark:bg-gray-true-9"
+      content={label}
+      delay={[0, 0]}
+      duration={[0, 0]}
+      zIndex={1000}
+      placement="right"
+      arrow
+      allowHTML
+      interactive
+    >
+      {anchor}
+    </Tippy>
+  );
+}
+
+function useSrefActive(
+  to: string,
+  activeClassName: string,
+  params: Partial<Record<string, string>> = {},
+  options: TransitionOptions = {},
+  ignorePaths: string[] = []
+) {
+  const { state: { name: stateName = '' } = {} } = useCurrentStateAndParams();
+  const anchorProps = useUiRouterSrefActive(
+    to,
+    params || {},
+    activeClassName,
+    options
+  );
+
+  const className = ignorePaths.some((path) => stateName.includes(path))
+    ? ''
+    : anchorProps.className;
+
+  return {
+    ...anchorProps,
+    className,
+  };
+}
diff --git a/app/react/sidebar/SidebarItem/SidebarItem.stories.tsx b/app/react/sidebar/SidebarItem/SidebarItem.stories.tsx
new file mode 100644
index 0000000..bc2d743
--- /dev/null
+++ b/app/react/sidebar/SidebarItem/SidebarItem.stories.tsx
@@ -0,0 +1,40 @@
+import { Meta, StoryFn } from '@storybook/react-webpack5';
+import { Clock, type LucideIcon } from 'lucide-react';
+
+import { SidebarItem } from '.';
+
+const meta: Meta = {
+  title: 'Components/Sidebar/SidebarItem',
+  component: SidebarItem,
+};
+export default meta;
+
+interface StoryProps {
+  icon?: LucideIcon;
+  label: string;
+}
+
+function Template({ icon, label }: StoryProps) {
+  return (
+    <ul className="sidebar">
+      <SidebarItem
+        to="example.path"
+        params={{ endpointId: 1 }}
+        icon={icon}
+        label={label}
+        data-cy="sidebar-item"
+      />
+    </ul>
+  );
+}
+
+export const Primary: StoryFn<StoryProps> = Template.bind({});
+Primary.args = {
+  icon: Clock,
+  label: 'Item with icon',
+};
+
+export const WithoutIcon: StoryFn<StoryProps> = Template.bind({});
+WithoutIcon.args = {
+  label: 'Item without icon',
+};
diff --git a/app/react/sidebar/SidebarItem/SidebarItem.tsx b/app/react/sidebar/SidebarItem/SidebarItem.tsx
new file mode 100644
index 0000000..16e661c
--- /dev/null
+++ b/app/react/sidebar/SidebarItem/SidebarItem.tsx
@@ -0,0 +1,135 @@
+import { type LucideIcon } from 'lucide-react';
+import clsx from 'clsx';
+import { MouseEventHandler, PropsWithChildren } from 'react';
+
+import { AutomationTestingProps } from '@/types';
+
+import { Icon } from '@@/Icon';
+import { Badge } from '@@/Badge';
+
+import { useSidebarState } from '../useSidebarState';
+
+import { Wrapper } from './Wrapper';
+import { SidebarTooltip } from './SidebarTooltip';
+import { useSidebarSrefActive } from './useSidebarSrefActive';
+
+interface Props extends AutomationTestingProps {
+  icon?: LucideIcon;
+  to: string;
+  params?: object;
+  label: string;
+  isSubMenu?: boolean;
+  ignorePaths?: string[];
+  /** When a create or detail path id differs from the list path, includePaths can be used to specify which paths should also mark the item as active.
+   *
+   * E.g. including the portainer.wizard.endpoints (create environment) path to activate the portainer.endpoints sidebar item. */
+  includePaths?: string[];
+  count?: number;
+}
+
+export function SidebarItem({
+  icon,
+  to,
+  params,
+  label,
+  isSubMenu = false,
+  ignorePaths = [],
+  includePaths = [],
+  count,
+  'data-cy': dataCy,
+}: Props) {
+  const { isOpen } = useSidebarState();
+  const anchorProps = useSidebarSrefActive(to, undefined, params, undefined, {
+    ignorePaths,
+    includePaths,
+  });
+
+  const sidebarAnchor = (
+    <Wrapper label={label}>
+      <ItemAnchor
+        href={anchorProps.href}
+        onClick={anchorProps.onClick}
+        className={anchorProps.className}
+        dataCy={dataCy}
+        isOpen={isOpen}
+        isSubMenu={isSubMenu}
+        count={count}
+      >
+        {!!icon && <Icon icon={icon} className={clsx('flex [&>svg]:w-4')} />}
+        {(isOpen || isSubMenu) && <span>{label}</span>}
+      </ItemAnchor>
+    </Wrapper>
+  );
+
+  if (isOpen || isSubMenu) return sidebarAnchor;
+
+  return (
+    <SidebarTooltip
+      content={
+        <div className="rounded th-highcontrast:border th-highcontrast:border-solid th-highcontrast:border-white th-highcontrast:bg-black">
+          <Wrapper label={label}>
+            <ItemAnchor
+              href={anchorProps.href}
+              onClick={anchorProps.onClick}
+              className={anchorProps.className}
+              dataCy={dataCy}
+              isOpen={isOpen}
+              isSubMenu={isSubMenu}
+              count={count}
+            >
+              <span className="px-3">{label}</span>
+            </ItemAnchor>
+          </Wrapper>
+        </div>
+      }
+    >
+      <span className="w-full">{sidebarAnchor}</span>
+    </SidebarTooltip>
+  );
+}
+
+type ItemAnchorProps = {
+  href?: string;
+  onClick: MouseEventHandler<unknown>;
+  className: string;
+  isOpen: boolean;
+  isSubMenu: boolean;
+  dataCy: string;
+  count?: number;
+};
+
+function ItemAnchor({
+  href,
+  onClick,
+  className,
+  isOpen,
+  isSubMenu,
+  dataCy,
+  count,
+  children,
+}: PropsWithChildren<ItemAnchorProps>) {
+  return (
+    <a
+      href={href}
+      onClick={onClick}
+      className={clsx(
+        className,
+        '!text-inherit no-underline hover:!text-inherit hover:!no-underline focus:!text-inherit focus:!no-underline',
+        'flex h-8 w-full flex-1 items-center space-x-4 rounded-md text-sm',
+        'transition-colors duration-200 hover:bg-graphite-500',
+        {
+          // submenu items are always expanded (in a tooltip or in the sidebar)
+          'w-full justify-start px-3': isOpen || isSubMenu,
+          'w-8 justify-center': !isOpen && !isSubMenu,
+        }
+      )}
+      data-cy={dataCy}
+    >
+      {children}
+      {(isOpen || isSubMenu) && count !== undefined && count > 0 && (
+        // 99 is for a conventional badge overflow cap, same pattern as GitHub/Slack notification badges
+        <Badge type="info">{count > 99 ? '99+' : count}</Badge>
+      )}
+    </a>
+  );
+}
diff --git a/app/react/sidebar/SidebarItem/SidebarParent.tsx b/app/react/sidebar/SidebarItem/SidebarParent.tsx
new file mode 100644
index 0000000..f5bfe1c
--- /dev/null
+++ b/app/react/sidebar/SidebarItem/SidebarParent.tsx
@@ -0,0 +1,151 @@
+import clsx from 'clsx';
+import { PropsWithChildren, useState } from 'react';
+
+import { AutomationTestingProps } from '@/types';
+
+import { Icon } from '@@/Icon';
+import { Link } from '@@/Link';
+import { CollapseExpandButton } from '@@/CollapseExpandButton';
+
+import { useSidebarState } from '../useSidebarState';
+
+import { Wrapper } from './Wrapper';
+import { PathOptions, useSidebarSrefActive } from './useSidebarSrefActive';
+import { SidebarTooltip } from './SidebarTooltip';
+
+type Props = {
+  label: string;
+  icon: React.ReactNode;
+  to: string;
+  pathOptions?: PathOptions;
+  params?: object;
+  listId: string;
+};
+
+export function SidebarParent({
+  children,
+  icon,
+  label: title,
+  to,
+  params,
+  pathOptions,
+  listId,
+  'data-cy': dataCy,
+}: PropsWithChildren<Props & AutomationTestingProps>) {
+  const anchorProps = useSidebarSrefActive(
+    to,
+    undefined,
+    params,
+    {},
+    pathOptions
+  );
+
+  const hasActiveChild = !!anchorProps.className;
+
+  const { isOpen: isSidebarOpen } = useSidebarState();
+
+  const [isExpanded, setIsExpanded] = useState(hasActiveChild);
+
+  const parentItem = (
+    <Wrapper className="flex flex-col">
+      <div
+        className={clsx(
+          'flex h-8 w-full items-center rounded-md transition-colors duration-200 ease-in-out hover:bg-graphite-500',
+          // only highlight the parent when the sidebar is closed/contracted and a child item is selected
+          (!isSidebarOpen || !isExpanded) && anchorProps.className
+        )}
+        data-cy={dataCy}
+      >
+        <button
+          type="button"
+          className={clsx(
+            'flex h-full flex-1 cursor-pointer items-center border-none bg-transparent p-0',
+            isSidebarOpen && 'pl-3'
+          )}
+          onClick={() => setIsExpanded(true)}
+        >
+          <Link
+            to={to}
+            params={params}
+            className={clsx(
+              'flex h-full w-full list-none items-center border-none !text-inherit hover:!text-inherit hover:no-underline focus:!text-inherit focus:!no-underline',
+              {
+                'justify-start': isSidebarOpen,
+                'justify-center': !isSidebarOpen,
+              }
+            )}
+            data-cy={`${dataCy}-link`}
+          >
+            <Icon icon={icon} />
+            {isSidebarOpen && <span className="pl-4">{title}</span>}
+          </Link>
+        </button>
+        {isSidebarOpen && (
+          <SidebarExpandButton
+            onClick={() => setIsExpanded((isExpanded) => !isExpanded)}
+            isExpanded={isExpanded}
+            listId={listId}
+          />
+        )}
+      </div>
+    </Wrapper>
+  );
+
+  const childList = (
+    <ul
+      id={listId}
+      // pl-11 must be important because it needs to avoid the padding from '.root ul' in sidebar.module.css
+      className={clsx('!pl-11 text-white', {
+        hidden: !isExpanded,
+        block: isExpanded,
+      })}
+    >
+      {children}
+    </ul>
+  );
+
+  if (isSidebarOpen)
+    return (
+      <>
+        {parentItem}
+        {childList}
+      </>
+    );
+
+  return (
+    <SidebarTooltip
+      content={
+        <ul>
+          <li className="mb-1 flex items-center space-x-2 text-sm">
+            <span>{title}</span>
+          </li>
+          <div className="rounded th-highcontrast:border th-highcontrast:border-solid th-highcontrast:border-white th-highcontrast:bg-black">
+            {children}
+          </div>
+        </ul>
+      }
+    >
+      <span>{parentItem}</span>
+    </SidebarTooltip>
+  );
+}
+
+function SidebarExpandButton({
+  isExpanded,
+  listId,
+  onClick,
+}: {
+  onClick(): void;
+  isExpanded: boolean;
+  listId: string;
+}) {
+  return (
+    <CollapseExpandButton
+      isExpanded={isExpanded}
+      onClick={onClick}
+      aria-controls={listId}
+      data-cy="expand-button"
+      className="group flex h-8 flex-none items-center border-none bg-transparent p-0 px-3"
+    />
+  );
+}
diff --git a/app/react/sidebar/SidebarItem/SidebarTooltip.tsx b/app/react/sidebar/SidebarItem/SidebarTooltip.tsx
new file mode 100644
index 0000000..91d6e06
--- /dev/null
+++ b/app/react/sidebar/SidebarItem/SidebarTooltip.tsx
@@ -0,0 +1,24 @@
+import Tippy, { TippyProps } from '@tippyjs/react';
+
+type Props = {
+  content: React.ReactNode;
+  children?: TippyProps['children'];
+};
+
+export function SidebarTooltip({ children, content }: Props) {
+  return (
+    <Tippy
+      className="sidebar !rounded-md bg-graphite-600 p-3 !opacity-100 th-highcontrast:border th-highcontrast:border-solid th-highcontrast:border-white th-highcontrast:bg-black"
+      content={content}
+      delay={[0, 0]}
+      duration={[0, 0]}
+      zIndex={1000}
+      placement="right"
+      arrow
+      allowHTML
+      interactive
+    >
+      {children}
+    </Tippy>
+  );
+}
diff --git a/app/react/sidebar/SidebarItem/Wrapper.tsx b/app/react/sidebar/SidebarItem/Wrapper.tsx
new file mode 100644
index 0000000..f0fb279
--- /dev/null
+++ b/app/react/sidebar/SidebarItem/Wrapper.tsx
@@ -0,0 +1,28 @@
+import { PropsWithChildren, AriaAttributes } from 'react';
+import clsx from 'clsx';
+
+interface Props {
+  className?: string;
+  label?: string;
+}
+
+export function Wrapper({
+  className,
+  children,
+  label,
+  ...ariaProps
+}: PropsWithChildren<Props> & AriaAttributes) {
+  return (
+    <li
+      className={clsx(
+        className,
+        'min-h-8 flex text-gray-3 th-highcontrast:text-white [&>a]:text-inherit [&>a]:hover:text-inherit [&>a]:hover:no-underline'
+      )}
+      aria-label={label}
+      // eslint-disable-next-line react/jsx-props-no-spreading
+      {...ariaProps}
+    >
+      {children}
+    </li>
+  );
+}
diff --git a/app/react/sidebar/SidebarItem/index.ts b/app/react/sidebar/SidebarItem/index.ts
new file mode 100644
index 0000000..6fda1cd
--- /dev/null
+++ b/app/react/sidebar/SidebarItem/index.ts
@@ -0,0 +1,11 @@
+import { SidebarItem as MainComponent } from './SidebarItem';
+import { Wrapper } from './Wrapper';
+
+interface SubComponents {
+  Wrapper: typeof Wrapper;
+}
+
+export const SidebarItem: typeof MainComponent & SubComponents =
+  MainComponent as typeof MainComponent & SubComponents;
+
+SidebarItem.Wrapper = Wrapper;
diff --git a/app/react/sidebar/SidebarItem/useSidebarSrefActive.tsx b/app/react/sidebar/SidebarItem/useSidebarSrefActive.tsx
new file mode 100644
index 0000000..8dad74d
--- /dev/null
+++ b/app/react/sidebar/SidebarItem/useSidebarSrefActive.tsx
@@ -0,0 +1,53 @@
+import {
+  TransitionOptions,
+  useCurrentStateAndParams,
+  useSrefActive,
+} from '@uirouter/react';
+
+export type PathOptions = {
+  /** ignorePaths ignores highlighting the sidebar parent when the URL of a sidebar child matches the current URL */
+  ignorePaths?: string[];
+  /** includePaths help to highlight the sidebar parent when the URL of a sidebar child matches the current URL */
+  includePaths?: string[];
+};
+
+/**
+ * Extends useSrefActive by ignoring or including paths and updating the classNames field returned when a child route is active.
+ * @param to The route to match
+ * @param activeClassName The active class names to return
+ * @param params The route params
+ * @param options The transition options
+ * @param pathOptions The paths to ignore/include
+ */
+export function useSidebarSrefActive(
+  to: string,
+  // default values are the classes used in the sidebar for an active item
+  activeClassName: string = 'bg-graphite-500',
+  params: Partial<Record<string, string>> = {},
+  options: TransitionOptions = {},
+  pathOptions: PathOptions = {
+    ignorePaths: [],
+    includePaths: [],
+  }
+) {
+  const { state: { name: stateName = '' } = {} } = useCurrentStateAndParams();
+  const anchorProps = useSrefActive(to, params || {}, activeClassName, options);
+
+  // overwrite the className to '' if the the current route is in ignorePaths
+  const isIgnorePathInRoute = pathOptions.ignorePaths?.some((path) =>
+    stateName.includes(path)
+  );
+  if (isIgnorePathInRoute) {
+    return { ...anchorProps, className: '' };
+  }
+
+  // overwrite the className to activeClassName if the the current route is in includePaths
+  const isIncludePathInRoute = pathOptions.includePaths?.some((path) =>
+    stateName.includes(path)
+  );
+  if (isIncludePathInRoute) {
+    return { ...anchorProps, className: activeClassName };
+  }
+
+  return anchorProps;
+}
diff --git a/app/react/sidebar/SidebarItem/utils.ts b/app/react/sidebar/SidebarItem/utils.ts
new file mode 100644
index 0000000..fd01961
--- /dev/null
+++ b/app/react/sidebar/SidebarItem/utils.ts
@@ -0,0 +1,24 @@
+import { ReactNode, ReactElement, Children } from 'react';
+
+function isReactElement(element: ReactNode): element is ReactElement {
+  return (
+    !!element &&
+    typeof element === 'object' &&
+    'type' in element &&
+    'props' in element
+  );
+}
+
+export function getPaths(element: ReactNode, paths: string[]): string[] {
+  if (!isReactElement(element)) {
+    return paths;
+  }
+
+  if (typeof element.props.to === 'undefined') {
+    return Children.map(element.props.children, (child) =>
+      getPaths(child, paths)
+    );
+  }
+
+  return [element.props.to, ...paths];
+}
diff --git a/app/react/sidebar/SidebarSection.tsx b/app/react/sidebar/SidebarSection.tsx
new file mode 100644
index 0000000..4ac0231
--- /dev/null
+++ b/app/react/sidebar/SidebarSection.tsx
@@ -0,0 +1,62 @@
+import { PropsWithChildren, ReactNode } from 'react';
+
+import { useSidebarState } from './useSidebarState';
+
+interface Props {
+  title: ReactNode;
+  hoverText?: string;
+  showTitleWhenOpen?: boolean;
+  'aria-label'?: string;
+}
+
+export function SidebarSection({
+  title,
+  hoverText,
+  children,
+  showTitleWhenOpen,
+  'aria-label': ariaLabel,
+}: PropsWithChildren<Props>) {
+  return (
+    <div>
+      <SidebarSectionTitle
+        showWhenOpen={showTitleWhenOpen}
+        hoverText={hoverText}
+      >
+        {title}
+      </SidebarSectionTitle>
+
+      <nav
+        aria-label={typeof title === 'string' ? title : ariaLabel}
+        className="mt-4"
+      >
+        <ul>{children}</ul>
+      </nav>
+    </div>
+  );
+}
+
+interface TitleProps {
+  showWhenOpen?: boolean;
+  hoverText?: string;
+}
+
+export function SidebarSectionTitle({
+  showWhenOpen,
+  hoverText,
+  children,
+}: PropsWithChildren<TitleProps>) {
+  const { isOpen } = useSidebarState();
+
+  if (!isOpen && !showWhenOpen) {
+    return null;
+  }
+
+  return (
+    <li
+      title={hoverText}
+      className="ml-3 text-sm text-gray-3 transition-all duration-500 ease-in-out be:text-gray-6"
+    >
+      {children}
+    </li>
+  );
+}
diff --git a/app/react/sidebar/UpgradeBEBanner/GetLicenseDialog.tsx b/app/react/sidebar/UpgradeBEBanner/GetLicenseDialog.tsx
new file mode 100644
index 0000000..9e07ae3
--- /dev/null
+++ b/app/react/sidebar/UpgradeBEBanner/GetLicenseDialog.tsx
@@ -0,0 +1,37 @@
+import { HubspotForm } from '@@/HubspotForm';
+import { Modal } from '@@/modals/Modal';
+
+export function GetLicenseDialog({
+  onDismiss,
+  goToUploadLicense,
+}: {
+  onDismiss: () => void;
+  goToUploadLicense: (isSubmitted: boolean) => void;
+}) {
+  // form is loaded from hubspot, so it won't have the same styling as the rest of the app
+  // since it won't support darkmode, we enforce a white background and black text for the components we use
+  // (Modal, CloseButton, loading text)
+
+  return (
+    <Modal
+      onDismiss={onDismiss}
+      aria-label="Upgrade Portainer to Business Edition"
+      size="lg"
+      className="!bg-white [&>.close-button]:!text-black"
+    >
+      <Modal.Body>
+        <div className="max-h-[80vh] overflow-auto">
+          <HubspotForm
+            region="na1"
+            portalId="4731999"
+            formId="1ef8ea88-3e03-46c5-8aef-c1d9f48fd06b"
+            onSubmitted={() => {
+              goToUploadLicense(true);
+            }}
+            loading={<div className="text-black">Loading...</div>}
+          />
+        </div>
+      </Modal.Body>
+    </Modal>
+  );
+}
diff --git a/app/react/sidebar/UpgradeBEBanner/LoadingDialog.tsx b/app/react/sidebar/UpgradeBEBanner/LoadingDialog.tsx
new file mode 100644
index 0000000..b30e871
--- /dev/null
+++ b/app/react/sidebar/UpgradeBEBanner/LoadingDialog.tsx
@@ -0,0 +1,52 @@
+import { Loader2 } from 'lucide-react';
+import { useEffect, useState } from 'react';
+
+import { useSystemStatus } from '@/react/portainer/system/useSystemStatus';
+
+import { Modal } from '@@/modals/Modal';
+import { Icon } from '@@/Icon';
+
+export function LoadingDialog() {
+  useWaitForServerStatus();
+
+  return (
+    <Modal aria-label="Upgrade Portainer to Business Edition">
+      <Modal.Body>
+        <div className="flex w-full flex-col items-center justify-center">
+          <Icon
+            icon={Loader2}
+            className="animate-spin-slow !text-8xl !text-blue-8"
+            aria-label="loading"
+          />
+
+          <h1 className="!text-2xl">Upgrading Portainer...</h1>
+
+          <p className="text-center text-xl text-gray-6">
+            Please wait while we upgrade your Portainer to Business Edition.
+          </p>
+        </div>
+      </Modal.Body>
+    </Modal>
+  );
+}
+
+function useWaitForServerStatus() {
+  const [enabled, setEnabled] = useState(false);
+  useSystemStatus({
+    enabled,
+    retry: true,
+    onSuccess() {
+      window.location.reload();
+    },
+  });
+
+  useEffect(() => {
+    const timeoutId = setTimeout(() => {
+      setEnabled(true);
+    }, 3000);
+
+    return () => {
+      clearTimeout(timeoutId);
+    };
+  });
+}
diff --git a/app/react/sidebar/UpgradeBEBanner/NonAdminUpgradeDialog.tsx b/app/react/sidebar/UpgradeBEBanner/NonAdminUpgradeDialog.tsx
new file mode 100644
index 0000000..e923aff
--- /dev/null
+++ b/app/react/sidebar/UpgradeBEBanner/NonAdminUpgradeDialog.tsx
@@ -0,0 +1,54 @@
+import { ExternalLink } from 'lucide-react';
+
+import { Button } from '@@/buttons';
+import { Modal } from '@@/modals/Modal';
+import { ModalType } from '@@/modals/Modal/types';
+
+export function NonAdminUpgradeDialog({
+  onDismiss,
+}: {
+  onDismiss: () => void;
+}) {
+  return (
+    <Modal aria-label="Upgrade Portainer to Business Edition">
+      <Modal.Header
+        title="Contact your administrator"
+        modalType={ModalType.Warn}
+      />
+      <Modal.Body>
+        You need to be logged in as an admin to upgrade Portainer to Business
+        Edition.
+      </Modal.Body>
+      <Modal.Footer>
+        <div className="flex w-full gap-2">
+          <Button
+            color="default"
+            data-cy="non-admin-cancel-upgrade"
+            size="medium"
+            className="w-1/3"
+            onClick={() => onDismiss()}
+          >
+            Cancel
+          </Button>
+
+          <a
+            href="https://www.portainer.io/take-5"
+            target="_blank"
+            rel="noreferrer"
+            className="no-link w-2/3"
+          >
+            <Button
+              color="primary"
+              data-cy="non-admin-learn-about-business-edition"
+              size="medium"
+              className="w-full"
+              icon={ExternalLink}
+            >
+              Learn about Business Edition
+            </Button>
+          </a>
+        </div>
+      </Modal.Footer>
+    </Modal>
+  );
+}
diff --git a/app/react/sidebar/UpgradeBEBanner/UpgradeBEBanner.tsx b/app/react/sidebar/UpgradeBEBanner/UpgradeBEBanner.tsx
new file mode 100644
index 0000000..6605279
--- /dev/null
+++ b/app/react/sidebar/UpgradeBEBanner/UpgradeBEBanner.tsx
@@ -0,0 +1,82 @@
+import { ArrowUpCircle } from 'lucide-react';
+import { useState } from 'react';
+import clsx from 'clsx';
+
+import { useNodesCount } from '@/react/portainer/system/useNodesCount';
+import {
+  ContainerPlatform,
+  useSystemInfo,
+} from '@/react/portainer/system/useSystemInfo';
+import { useCurrentUser } from '@/react/hooks/useUser';
+import { withEdition } from '@/react/portainer/feature-flags/withEdition';
+import { withHideOnExtension } from '@/react/hooks/withHideOnExtension';
+import { useUser } from '@/portainer/users/queries/useUser';
+
+import { useSidebarState } from '../useSidebarState';
+
+import { UpgradeDialog } from './UpgradeDialog';
+
+export const UpgradeBEBannerWrapper = withHideOnExtension(
+  withEdition(UpgradeBEBanner, 'CE')
+);
+
+const enabledPlatforms: Array<ContainerPlatform> = [
+  'Docker Standalone',
+  'Docker Swarm',
+  'Kubernetes',
+];
+
+function UpgradeBEBanner() {
+  const {
+    user: { Id },
+  } = useCurrentUser();
+
+  const { isOpen: isSidebarOpen } = useSidebarState();
+
+  const nodesCountQuery = useNodesCount();
+  const systemInfoQuery = useSystemInfo();
+  const userQuery = useUser(Id);
+
+  const [isOpen, setIsOpen] = useState(false);
+
+  if (!nodesCountQuery.isSuccess || !systemInfoQuery.data || !userQuery.data) {
+    return null;
+  }
+
+  const systemInfo = systemInfoQuery.data;
+
+  if (
+    !enabledPlatforms.includes(systemInfo.platform) &&
+    process.env.FORCE_SHOW_UPGRADE_BANNER !== ''
+  ) {
+    return null;
+  }
+
+  return (
+    <>
+      <button
+        type="button"
+        className={clsx(
+          'flex w-full items-center justify-center gap-1 py-2 pr-2 hover:underline',
+          'border border-solid border-blue-9 bg-[#023959] font-medium text-white th-dark:border-[#343434] th-dark:bg-black',
+          'th-highcontrast:border th-highcontrast:border-solid th-highcontrast:border-white th-highcontrast:bg-black th-highcontrast:font-medium th-highcontrast:text-white'
+        )}
+        onClick={handleClick}
+      >
+        <ArrowUpCircle
+          className={clsx(
+            'lucide text-lg',
+            'fill-gray-6 stroke-[#023959] th-highcontrast:stroke-black th-dark:stroke-black'
+          )}
+        />
+        {isSidebarOpen && <>Upgrade to Business Edition</>}
+      </button>
+
+      {isOpen && <UpgradeDialog onDismiss={() => setIsOpen(false)} />}
+    </>
+  );
+
+  function handleClick() {
+    setIsOpen(true);
+  }
+}
diff --git a/app/react/sidebar/UpgradeBEBanner/UpgradeDialog.tsx b/app/react/sidebar/UpgradeBEBanner/UpgradeDialog.tsx
new file mode 100644
index 0000000..61a80e2
--- /dev/null
+++ b/app/react/sidebar/UpgradeBEBanner/UpgradeDialog.tsx
@@ -0,0 +1,51 @@
+import { useState } from 'react';
+
+import { useCurrentUser } from '@/react/hooks/useUser';
+
+import { UploadLicenseDialog } from './UploadLicenseDialog';
+import { LoadingDialog } from './LoadingDialog';
+import { NonAdminUpgradeDialog } from './NonAdminUpgradeDialog';
+import { GetLicenseDialog } from './GetLicenseDialog';
+
+type Step = 'uploadLicense' | 'loading' | 'getLicense';
+
+export function UpgradeDialog({ onDismiss }: { onDismiss: () => void }) {
+  const { isPureAdmin } = useCurrentUser();
+  const [currentStep, setCurrentStep] = useState<Step>('uploadLicense');
+  const [isGetLicenseSubmitted, setIsGetLicenseSubmitted] = useState(false);
+  const component = getDialog();
+
+  return component;
+
+  function getDialog() {
+    if (!isPureAdmin) {
+      return <NonAdminUpgradeDialog onDismiss={onDismiss} />;
+    }
+
+    switch (currentStep) {
+      case 'getLicense':
+        return (
+          <GetLicenseDialog
+            goToUploadLicense={(isSubmitted) => {
+              setCurrentStep('uploadLicense');
+              setIsGetLicenseSubmitted(isSubmitted);
+            }}
+            onDismiss={onDismiss}
+          />
+        );
+      case 'uploadLicense':
+        return (
+          <UploadLicenseDialog
+            goToLoading={() => setCurrentStep('loading')}
+            onDismiss={onDismiss}
+            goToGetLicense={() => setCurrentStep('getLicense')}
+            isGetLicenseSubmitted={isGetLicenseSubmitted}
+          />
+        );
+      case 'loading':
+        return <LoadingDialog />;
+      default:
+        throw new Error('step type not found');
+    }
+  }
+}
diff --git a/app/react/sidebar/UpgradeBEBanner/UploadLicenseDialog.tsx b/app/react/sidebar/UpgradeBEBanner/UploadLicenseDialog.tsx
new file mode 100644
index 0000000..55d161e
--- /dev/null
+++ b/app/react/sidebar/UpgradeBEBanner/UploadLicenseDialog.tsx
@@ -0,0 +1,117 @@
+import { Field, Form, Formik } from 'formik';
+import { object, SchemaOf, string } from 'yup';
+
+import { useUpgradeEditionMutation } from '@/react/portainer/system/useUpgradeEditionMutation';
+import { notifySuccess } from '@/portainer/services/notifications';
+
+import { Button, LoadingButton } from '@@/buttons';
+import { FormControl } from '@@/form-components/FormControl';
+import { Input } from '@@/form-components/Input';
+import { Modal } from '@@/modals/Modal';
+import { Alert } from '@@/Alert';
+
+interface FormValues {
+  license: string;
+}
+
+const initialValues: FormValues = {
+  license: '',
+};
+
+export function UploadLicenseDialog({
+  onDismiss,
+  goToLoading,
+  goToGetLicense,
+  isGetLicenseSubmitted,
+}: {
+  onDismiss: () => void;
+  goToLoading: () => void;
+  goToGetLicense: () => void;
+  isGetLicenseSubmitted: boolean;
+}) {
+  const upgradeMutation = useUpgradeEditionMutation();
+
+  return (
+    <Modal
+      onDismiss={onDismiss}
+      aria-label="Upgrade Portainer to Business Edition"
+    >
+      <Modal.Header
+        title={<h4 className="text-xl font-medium">Upgrade Portainer</h4>}
+      />
+      <Formik
+        initialValues={initialValues}
+        onSubmit={handleSubmit}
+        validationSchema={validation}
+        validateOnMount
+      >
+        {({ errors }) => (
+          <Form noValidate>
+            <Modal.Body>
+              {!isGetLicenseSubmitted ? (
+                <p className="font-semibold text-gray-7">
+                  Please enter your Portainer License below
+                </p>
+              ) : (
+                <div className="mb-4">
+                  <Alert color="success" title="License successfully sent">
+                    Please check your email and copy your license into the field
+                    below to upgrade Portainer.
+                  </Alert>
+                </div>
+              )}
+
+              <FormControl
+                label="License"
+                errors={errors.license}
+                required
+                size="vertical"
+              >
+                <Field name="license" as={Input} required />
+              </FormControl>
+            </Modal.Body>
+            <Modal.Footer>
+              <div className="flex w-full gap-2 [&>*]:w-1/2">
+                <Button
+                  color="default"
+                  data-cy="get-license-button"
+                  size="medium"
+                  className="w-full"
+                  onClick={goToGetLicense}
+                >
+                  Get a license
+                </Button>
+                <LoadingButton
+                  color="primary"
+                  data-cy="start-upgrade-button"
+                  size="medium"
+                  loadingText="Validating License"
+                  isLoading={upgradeMutation.isLoading}
+                >
+                  Start upgrade
+                </LoadingButton>
+              </div>
+            </Modal.Footer>
+          </Form>
+        )}
+      </Formik>
+    </Modal>
+  );
+
+  function handleSubmit(values: FormValues) {
+    upgradeMutation.mutate(values, {
+      onSuccess() {
+        notifySuccess('Starting upgrade', 'License validated successfully');
+        goToLoading();
+      },
+    });
+  }
+}
+
+function validation(): SchemaOf<FormValues> {
+  return object().shape({
+    license: string()
+      .required('License is required')
+      .matches(/^\d-.+/, 'License is invalid'),
+  });
+}
diff --git a/app/react/sidebar/UpgradeBEBanner/index.ts b/app/react/sidebar/UpgradeBEBanner/index.ts
new file mode 100644
index 0000000..551d6be
--- /dev/null
+++ b/app/react/sidebar/UpgradeBEBanner/index.ts
@@ -0,0 +1 @@
+export { UpgradeBEBannerWrapper } from './UpgradeBEBanner';
diff --git a/app/react/sidebar/items/DashboardLink.tsx b/app/react/sidebar/items/DashboardLink.tsx
new file mode 100644
index 0000000..7350be0
--- /dev/null
+++ b/app/react/sidebar/items/DashboardLink.tsx
@@ -0,0 +1,27 @@
+import { Layout } from 'lucide-react';
+
+import { EnvironmentId } from '@/react/portainer/environments/types';
+import { AutomationTestingProps } from '@/types';
+
+import { SidebarItem } from '../SidebarItem';
+
+interface Props extends AutomationTestingProps {
+  environmentId: EnvironmentId;
+  platformPath: string;
+}
+
+export function DashboardLink({
+  environmentId,
+  platformPath,
+  'data-cy': dataCy,
+}: Props) {
+  return (
+    <SidebarItem
+      to={`${platformPath}.dashboard`}
+      params={{ endpointId: environmentId }}
+      icon={Layout}
+      label="Dashboard"
+      data-cy={dataCy}
+    />
+  );
+}
diff --git a/app/react/sidebar/portainer-p-icon-white.svg b/app/react/sidebar/portainer-p-icon-white.svg
new file mode 100644
index 0000000..6c8e0f1
--- /dev/null
+++ b/app/react/sidebar/portainer-p-icon-white.svg
@@ -0,0 +1,12 @@
+<svg width="288.58" height="302.75"  viewBox="0 0 288.58 302.75" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <defs>
+    <style>
+      .cls-1 {
+      fill: #f7f6f3;
+      }
+    </style>
+  </defs>
+  <g id="Layer_1-2" data-name="Layer 1">
+    <path class="cls-1" d="M205.79,69.73v-14.85h23.37v-13.36h-80.27l-54.82-31.62V0h-19.35v9.87l-54.88,31.65H0v13.36h74.71v247.87h19.35V54.88h104.04v14.63c-1.2-.02-2.41-.03-3.64-.03h-85.8v233.27h67.15v-73.52h18.73c59.2,0,94.05-18.31,94.05-78.84v-2.06c0-56.38-30.5-76.23-82.79-78.6ZM74.71,41.52h-38.86l38.86-22.42v22.42ZM94.06,41.52v-22.39l38.81,22.39h-38.81ZM227.42,175.25h-51.76v-51.76h22.43v-53.98c2.61.03,5.18.1,7.69.21v53.76h21.64v51.76Z"/>
+  </g>
+</svg>
\ No newline at end of file
diff --git a/app/react/sidebar/portainer_logo-BE.svg b/app/react/sidebar/portainer_logo-BE.svg
new file mode 100644
index 0000000..ad9762a
--- /dev/null
+++ b/app/react/sidebar/portainer_logo-BE.svg
@@ -0,0 +1,37 @@
+<svg width="1064" height="214" viewBox="0 0 1064 214" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0_261_120526)">
+<path d="M0 3.08984H45.77C77.35 3.08984 95.98 12.9598 95.98 45.1498V46.2498C95.98 78.5398 77.39 88.3098 45.81 88.3098H35.82V127.53H0V3.08984ZM43.67 60.8098C53.45 60.8098 58.6 57.1798 58.6 46.3298V45.0798C58.6 34.2798 53.45 30.5798 43.67 30.5798H35.83V60.7998H43.67V60.8098Z" fill="#F7F6F3"/>
+<path d="M100.93 71.76V58.86C100.93 15.56 117.85 0 153.84 0C189.83 0 206.73 15.56 206.73 58.86V71.76C206.73 115.05 189.81 130.62 153.84 130.62C117.87 130.62 100.93 115.05 100.93 71.76ZM168.87 71.84V58.77C168.87 36.2 165.81 28.65 153.84 28.65C141.87 28.65 138.78 36.2 138.78 58.77V71.84C138.78 94.41 141.9 101.98 153.84 101.98C165.78 101.98 168.87 94.41 168.87 71.84Z" fill="#F7F6F3"/>
+<path d="M213.77 3.08984H256.91C289.3 3.08984 309.24 8.34984 309.24 36.5298V37.0098C309.17 53.8598 302.64 62.4799 291.7 67.1498C301.84 71.2098 305.35 76.0298 306.84 92.9998L308.14 108.5C309.29 121.82 309.77 124.57 311.51 127.53H274.87C273.71 124.4 273.11 120.96 272.8 116.89L271.22 97.1898C270.17 85.3598 268.39 82.3898 258.61 82.3898H249.6V127.52H213.78V3.08984H213.77ZM257.54 55.6898C268.7 55.6898 272.72 52.5198 272.72 43.2398V42.6998C272.72 33.4598 268.7 30.5098 257.54 30.5098H249.59V55.6898H257.54Z" fill="#F7F6F3"/>
+<path d="M343.52 32.5898H312.2V3.08984H410.63V32.5998H379.35V127.54H343.53V32.5898H343.52Z" fill="#F7F6F3"/>
+<path d="M425.88 3.08984H475.1L508.03 127.54H471.03L465.42 102.18H435.52L429.88 127.54H393.03L425.88 3.08984ZM459.58 73.8998L450.55 32.7398H450.32L441.3 73.8998H459.59H459.58Z" fill="#F7F6F3"/>
+<path d="M513.45 3.08984H549.27V127.54H513.45V3.08984Z" fill="#F7F6F3"/>
+<path d="M560.29 3.08984H602.69L629.04 85.0499H629.41L627.13 44.7498V3.08984H660.24V127.54H617.85L591.54 50.1298H591.17L593.39 90.5198V127.54H560.28V3.08984H560.29Z" fill="#F7F6F3"/>
+<path d="M671.24 3.08984H753.91V32.5998H707.06V50.3998H748.46V79.9099H707.06V98.0398H754.52V127.55H671.24V3.08984Z" fill="#F7F6F3"/>
+<path d="M763.42 3.08984H806.56C838.95 3.08984 858.89 8.34984 858.89 36.5298V37.0098C858.82 53.8598 852.29 62.4799 841.35 67.1498C851.49 71.2098 855 76.0298 856.49 92.9998L857.79 108.5C858.94 121.82 859.42 124.57 861.16 127.53H824.52C823.36 124.4 822.76 120.96 822.45 116.89L820.87 97.1898C819.82 85.3598 818.04 82.3898 808.26 82.3898H799.25V127.52H763.43V3.08984H763.42ZM807.2 55.6898C818.36 55.6898 822.38 52.5198 822.38 43.2398V42.6998C822.38 33.4598 818.36 30.5098 807.2 30.5098H799.25V55.6898H807.2Z" fill="#F7F6F3"/>
+<path d="M870.36 93.27H904.71V127.53H870.36V93.27Z" fill="#F7F6F3"/>
+<path d="M914.92 3.08984H949.85V28.7598H914.92V3.08984ZM914.92 35.5798H949.85V127.54H914.92V35.5798Z" fill="#F7F6F3"/>
+<path d="M958.1 71.76V58.86C958.1 15.57 975.02 0 1011.01 0C1047 0 1063.9 15.56 1063.9 58.86V71.76C1063.9 115.05 1046.98 130.62 1011.01 130.62C975.04 130.62 958.1 115.05 958.1 71.76ZM1026.05 71.84V58.77C1026.05 36.2 1022.99 28.65 1011.02 28.65C999.05 28.65 995.96 36.2 995.96 58.77V71.84C995.96 94.41 999.08 101.98 1011.02 101.98C1022.96 101.98 1026.05 94.41 1026.05 71.84Z" fill="#F7F6F3"/>
+<path d="M82.8498 175.29C90.4398 175.29 94.6398 178.04 94.6398 184.43C94.6398 188.27 92.7698 190.66 89.5998 192.22C94.1698 193.52 96.4099 197 96.4099 201.62C96.4099 209 90.2298 212.37 83.3198 212.37H65.3398V175.27H82.8498V175.29ZM81.8098 190.3C84.7698 190.3 86.7498 188.9 86.7498 185.88C86.7498 182.86 84.7798 181.62 81.2398 181.62H73.4998V190.3H81.8098ZM82.2698 206.04C86.0598 206.04 88.2498 204.48 88.2498 201.16C88.2498 197.58 86.1198 195.86 82.4298 195.86H73.4898V206.04H82.2698Z" fill="#F7F6F3"/>
+<path d="M112.82 175.29V198.51C112.82 203.97 115.21 206.41 120.46 206.41C126.18 206.41 128.15 203.97 128.15 198.51V175.29H136.31V198.51C136.31 207.76 130.96 213.26 120.46 213.26C109.96 213.26 104.67 207.75 104.67 198.51V175.29H112.83H112.82Z" fill="#F7F6F3"/>
+<path d="M173.869 186.35H165.969C165.709 182.61 163.529 180.74 158.699 180.74C155.689 180.74 153.039 182.04 153.039 184.95C153.039 187.65 154.599 188.17 162.909 190.25C168.419 191.65 175.119 193.52 175.119 201.37C175.119 208.38 169.559 213.27 159.689 213.27C151.839 213.27 143.899 209.53 143.899 200.33V200.07H151.799C151.799 205.32 156.109 206.93 159.959 206.93C163.809 206.93 167.229 205.68 167.229 202.31C167.229 199.97 165.409 198.52 160.839 197.37C158.089 196.64 155.699 196.12 153.309 195.34C147.699 193.47 145.149 190.3 145.149 185.57C145.149 178.09 152.219 174.4 159.019 174.4C166.969 174.4 173.879 177.93 173.879 186.35H173.869Z" fill="#F7F6F3"/>
+<path d="M191.01 175.29V212.39H182.85V175.29H191.01Z" fill="#F7F6F3"/>
+<path d="M209.19 175.29L224.67 200.18H224.77V175.29H232.41V212.39H224.25L208.82 187.56H208.72V212.39H201.08V175.29H209.18H209.19Z" fill="#F7F6F3"/>
+<path d="M270.24 175.29V182.15H250.65V190.1H268.63V196.44H250.65V205.53H270.65V212.39H242.49V175.29H270.23H270.24Z" fill="#F7F6F3"/>
+<path d="M306.71 186.35H298.81C298.55 182.61 296.37 180.74 291.54 180.74C288.53 180.74 285.88 182.04 285.88 184.95C285.88 187.65 287.44 188.17 295.75 190.25C301.26 191.65 307.96 193.52 307.96 201.37C307.96 208.38 302.4 213.27 292.53 213.27C284.68 213.27 276.74 209.53 276.74 200.33V200.07H284.64C284.64 205.32 288.95 206.93 292.8 206.93C296.65 206.93 300.07 205.68 300.07 202.31C300.07 199.97 298.25 198.52 293.68 197.37C290.93 196.64 288.54 196.12 286.15 195.34C280.54 193.47 277.99 190.3 277.99 185.57C277.99 178.09 285.06 174.4 291.86 174.4C299.81 174.4 306.72 177.93 306.72 186.35H306.71Z" fill="#F7F6F3"/>
+<path d="M343.34 186.35H335.44C335.18 182.61 333 180.74 328.17 180.74C325.16 180.74 322.51 182.04 322.51 184.95C322.51 187.65 324.07 188.17 332.38 190.25C337.89 191.65 344.59 193.52 344.59 201.37C344.59 208.38 339.03 213.27 329.16 213.27C321.31 213.27 313.37 209.53 313.37 200.33V200.07H321.27C321.27 205.32 325.58 206.93 329.43 206.93C333.28 206.93 336.7 205.68 336.7 202.31C336.7 199.97 334.88 198.52 330.31 197.37C327.56 196.64 325.17 196.12 322.78 195.34C317.17 193.47 314.62 190.3 314.62 185.57C314.62 178.09 321.69 174.4 328.49 174.4C336.44 174.4 343.35 177.93 343.35 186.35H343.34Z" fill="#F7F6F3"/>
+<path d="M397.42 175.29V182.15H377.83V190.1H395.81V196.44H377.83V205.53H397.83V212.39H369.67V175.29H397.41H397.42Z" fill="#F7F6F3"/>
+<path d="M422.15 175.29C432.44 175.29 439.09 181.94 439.09 193.63C439.09 205.32 432.75 212.39 422.36 212.39H406.25V175.29H422.15ZM421.63 205.53C426.72 205.53 430.93 202.36 430.93 194.36C430.93 185.53 427.03 182.15 420.23 182.15H414.41V205.53H421.63Z" fill="#F7F6F3"/>
+<path d="M455.809 175.29V212.39H447.649V175.29H455.809Z" fill="#F7F6F3"/>
+<path d="M493.379 175.29V182.15H482.259V212.39H474.099V182.15H462.979V175.29H493.369H493.379Z" fill="#F7F6F3"/>
+<path d="M508.7 175.29V212.39H500.54V175.29H508.7Z" fill="#F7F6F3"/>
+<path d="M553.64 193.99C553.64 204.8 546.73 213.27 535.4 213.27C524.07 213.27 517.16 204.8 517.16 193.99C517.16 183.18 524.02 174.4 535.4 174.4C546.78 174.4 553.64 182.76 553.64 193.99ZM535.4 206.41C542.31 206.41 545.48 200.75 545.48 193.99C545.48 186.87 542.31 181.26 535.35 181.26C528.39 181.26 525.32 186.82 525.32 193.99C525.32 201.16 528.59 206.41 535.4 206.41Z" fill="#F7F6F3"/>
+<path d="M570.21 175.29L585.69 200.18H585.79V175.29H593.43V212.39H585.27L569.84 187.56H569.74V212.39H562.1V175.29H570.21Z" fill="#F7F6F3"/>
+<path d="M1.87012 174.41H40.8301V213.27H1.87012V174.41Z" fill="#C080FF"/>
+</g>
+<defs>
+<clipPath id="clip0_261_120526">
+<rect width="1063.9" height="213.27" fill="white"/>
+</clipPath>
+</defs>
+</svg>
diff --git a/app/react/sidebar/portainer_logo-CE.svg b/app/react/sidebar/portainer_logo-CE.svg
new file mode 100644
index 0000000..707c7b1
--- /dev/null
+++ b/app/react/sidebar/portainer_logo-CE.svg
@@ -0,0 +1,38 @@
+<svg width="1064" height="214" viewBox="0 0 1064 214" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0_261_120595)">
+<path d="M0 3.08984H45.77C77.35 3.08984 95.98 12.9598 95.98 45.1498V46.2498C95.98 78.5398 77.39 88.3098 45.81 88.3098H35.82V127.53H0V3.08984ZM43.67 60.8098C53.45 60.8098 58.6 57.1798 58.6 46.3298V45.0798C58.6 34.2798 53.45 30.5798 43.67 30.5798H35.83V60.7998H43.67V60.8098Z" fill="#F7F6F3"/>
+<path d="M100.93 71.76V58.86C100.93 15.56 117.85 0 153.84 0C189.83 0 206.73 15.56 206.73 58.86V71.76C206.73 115.05 189.81 130.62 153.84 130.62C117.87 130.62 100.93 115.05 100.93 71.76ZM168.87 71.84V58.77C168.87 36.2 165.81 28.65 153.84 28.65C141.87 28.65 138.78 36.2 138.78 58.77V71.84C138.78 94.41 141.9 101.98 153.84 101.98C165.78 101.98 168.87 94.41 168.87 71.84Z" fill="#F7F6F3"/>
+<path d="M213.77 3.08984H256.91C289.3 3.08984 309.24 8.34984 309.24 36.5298V37.0098C309.17 53.8598 302.64 62.4799 291.7 67.1498C301.84 71.2098 305.35 76.0298 306.84 92.9998L308.14 108.5C309.29 121.82 309.77 124.57 311.51 127.53H274.87C273.71 124.4 273.11 120.96 272.8 116.89L271.22 97.1898C270.17 85.3598 268.39 82.3898 258.61 82.3898H249.6V127.52H213.78V3.08984H213.77ZM257.54 55.6898C268.7 55.6898 272.72 52.5198 272.72 43.2398V42.6998C272.72 33.4598 268.7 30.5098 257.54 30.5098H249.59V55.6898H257.54Z" fill="#F7F6F3"/>
+<path d="M343.52 32.5898H312.2V3.08984H410.63V32.5998H379.35V127.54H343.53V32.5898H343.52Z" fill="#F7F6F3"/>
+<path d="M425.88 3.08984H475.1L508.03 127.54H471.03L465.42 102.18H435.52L429.88 127.54H393.03L425.88 3.08984ZM459.58 73.8998L450.55 32.7398H450.32L441.3 73.8998H459.59H459.58Z" fill="#F7F6F3"/>
+<path d="M513.45 3.08984H549.27V127.54H513.45V3.08984Z" fill="#F7F6F3"/>
+<path d="M560.29 3.08984H602.69L629.04 85.0499H629.41L627.13 44.7498V3.08984H660.24V127.54H617.85L591.54 50.1298H591.17L593.39 90.5198V127.54H560.28V3.08984H560.29Z" fill="#F7F6F3"/>
+<path d="M671.24 3.08984H753.91V32.5998H707.06V50.3998H748.46V79.9099H707.06V98.0398H754.52V127.55H671.24V3.08984Z" fill="#F7F6F3"/>
+<path d="M763.42 3.08984H806.56C838.95 3.08984 858.89 8.34984 858.89 36.5298V37.0098C858.82 53.8598 852.29 62.4799 841.35 67.1498C851.49 71.2098 855 76.0298 856.49 92.9998L857.79 108.5C858.94 121.82 859.42 124.57 861.16 127.53H824.52C823.36 124.4 822.76 120.96 822.45 116.89L820.87 97.1898C819.82 85.3598 818.04 82.3898 808.26 82.3898H799.25V127.52H763.43V3.08984H763.42ZM807.2 55.6898C818.36 55.6898 822.38 52.5198 822.38 43.2398V42.6998C822.38 33.4598 818.36 30.5098 807.2 30.5098H799.25V55.6898H807.2Z" fill="#F7F6F3"/>
+<path d="M870.36 93.27H904.71V127.53H870.36V93.27Z" fill="#F7F6F3"/>
+<path d="M914.92 3.08984H949.85V28.7598H914.92V3.08984ZM914.92 35.5798H949.85V127.54H914.92V35.5798Z" fill="#F7F6F3"/>
+<path d="M958.1 71.76V58.86C958.1 15.57 975.02 0 1011.01 0C1047 0 1063.9 15.56 1063.9 58.86V71.76C1063.9 115.05 1046.98 130.62 1011.01 130.62C975.04 130.62 958.1 115.05 958.1 71.76ZM1026.05 71.84V58.77C1026.05 36.2 1022.99 28.65 1011.02 28.65C999.05 28.65 995.96 36.2 995.96 58.77V71.84C995.96 94.41 999.08 101.98 1011.02 101.98C1022.96 101.98 1026.05 94.41 1026.05 71.84Z" fill="#F7F6F3"/>
+<path d="M97.9702 187.76H90.0702C89.5002 184.12 86.0202 181.26 81.9702 181.26C75.3202 181.26 71.8902 186.51 71.8902 193.99C71.8902 200.95 75.1602 206.41 81.9702 206.41C86.6502 206.41 89.7102 203.4 90.3902 198.1H98.2902C97.4602 207.45 91.0702 213.27 81.9802 213.27C70.6502 213.27 63.7402 204.85 63.7402 193.99C63.7402 183.13 70.4902 174.4 81.9802 174.4C90.2902 174.4 97.0502 179.39 97.9802 187.75L97.9702 187.76Z" fill="#F7F6F3"/>
+<path d="M141.4 193.99C141.4 204.8 134.49 213.27 123.16 213.27C111.83 213.27 104.92 204.8 104.92 193.99C104.92 183.18 111.78 174.4 123.16 174.4C134.54 174.4 141.4 182.76 141.4 193.99ZM123.16 206.41C130.07 206.41 133.24 200.75 133.24 193.99C133.24 186.87 130.07 181.26 123.11 181.26C116.15 181.26 113.08 186.82 113.08 193.99C113.08 201.16 116.35 206.41 123.16 206.41Z" fill="#F7F6F3"/>
+<path d="M161.14 175.29L169.82 200.8H169.92L178.13 175.29H189.61V212.39H181.97V186.1H181.87L172.78 212.39H166.49L157.4 186.36H157.3V212.39H149.66V175.29H161.14Z" fill="#F7F6F3"/>
+<path d="M210.96 175.29L219.64 200.8H219.74L227.95 175.29H239.43V212.39H231.79V186.1H231.69L222.6 212.39H216.31L207.22 186.36H207.12V212.39H199.48V175.29H210.96Z" fill="#F7F6F3"/>
+<path d="M257.3 175.29V198.51C257.3 203.97 259.69 206.41 264.94 206.41C270.66 206.41 272.63 203.97 272.63 198.51V175.29H280.79V198.51C280.79 207.76 275.44 213.26 264.94 213.26C254.44 213.26 249.15 207.75 249.15 198.51V175.29H257.31H257.3Z" fill="#F7F6F3"/>
+<path d="M298.6 175.29L314.08 200.18H314.18V175.29H321.82V212.39H313.66L298.23 187.56H298.13V212.39H290.49V175.29H298.59H298.6Z" fill="#F7F6F3"/>
+<path d="M339.86 175.29V212.39H331.7V175.29H339.86Z" fill="#F7F6F3"/>
+<path d="M377.211 175.29V182.15H366.091V212.39H357.931V182.15H346.811V175.29H377.201H377.211Z" fill="#F7F6F3"/>
+<path d="M389.31 175.29L397.99 189.94L406.61 175.29H415.7L401.93 198.15V212.39H393.77V197.95L380.11 175.3H389.31V175.29Z" fill="#F7F6F3"/>
+<path d="M466.41 175.29V182.15H446.82V190.1H464.8V196.44H446.82V205.53H466.82V212.39H438.66V175.29H466.4H466.41Z" fill="#F7F6F3"/>
+<path d="M490.93 175.29C501.22 175.29 507.87 181.94 507.87 193.63C507.87 205.32 501.53 212.39 491.14 212.39H475.03V175.29H490.93ZM490.41 205.53C495.5 205.53 499.71 202.36 499.71 194.36C499.71 185.53 495.81 182.15 489.01 182.15H483.19V205.53H490.41Z" fill="#F7F6F3"/>
+<path d="M524.391 175.29V212.39H516.23V175.29H524.391Z" fill="#F7F6F3"/>
+<path d="M561.751 175.29V182.15H550.631V212.39H542.471V182.15H531.351V175.29H561.741H561.751Z" fill="#F7F6F3"/>
+<path d="M576.86 175.29V212.39H568.7V175.29H576.86Z" fill="#F7F6F3"/>
+<path d="M621.59 193.99C621.59 204.8 614.68 213.27 603.35 213.27C592.02 213.27 585.11 204.8 585.11 193.99C585.11 183.18 591.97 174.4 603.35 174.4C614.73 174.4 621.59 182.76 621.59 193.99ZM603.36 206.41C610.27 206.41 613.44 200.75 613.44 193.99C613.44 186.87 610.27 181.26 603.31 181.26C596.35 181.26 593.28 186.82 593.28 193.99C593.28 201.16 596.55 206.41 603.36 206.41Z" fill="#F7F6F3"/>
+<path d="M637.961 175.29L653.441 200.18H653.541V175.29H661.181V212.39H653.021L637.591 187.56H637.491V212.39H629.851V175.29H637.961Z" fill="#F7F6F3"/>
+<path d="M1.87012 174.41H40.8301V213.27H1.87012V174.41Z" fill="#FF80F2"/>
+</g>
+<defs>
+<clipPath id="clip0_261_120595">
+<rect width="1063.9" height="213.27" fill="white"/>
+</clipPath>
+</defs>
+</svg>
diff --git a/app/react/sidebar/sidebarStore.ts b/app/react/sidebar/sidebarStore.ts
new file mode 100644
index 0000000..0c2a7cb
--- /dev/null
+++ b/app/react/sidebar/sidebarStore.ts
@@ -0,0 +1,33 @@
+import create from 'zustand';
+
+import {
+  get as getFromStorage,
+  set as setToStorage,
+} from '@/react/hooks/useLocalStorage';
+
+const storageKey = 'toolbar_toggle';
+const mobileWidth = 992;
+
+function getInitialIsOpen() {
+  if (window.ddExtension) return false;
+  if (window.innerWidth < mobileWidth) return false;
+  return getFromStorage<boolean>(storageKey, true);
+}
+
+interface SidebarStore {
+  isOpen: boolean;
+  toggle: () => void;
+  setOpen: (value: boolean) => void;
+}
+
+export const sidebarStore = create<SidebarStore>()((set, get) => ({
+  isOpen: getInitialIsOpen(),
+  toggle: () => {
+    const newIsOpen = !get().isOpen;
+    setToStorage(storageKey, newIsOpen);
+    set({ isOpen: newIsOpen });
+  },
+  setOpen: (value: boolean) => {
+    set({ isOpen: value });
+  },
+}));
diff --git a/app/react/sidebar/types.ts b/app/react/sidebar/types.ts
new file mode 100644
index 0000000..4fa2309
--- /dev/null
+++ b/app/react/sidebar/types.ts
@@ -0,0 +1,29 @@
+import { EnvironmentType } from '@/react/portainer/environments/types';
+
+type DockerSwarmMode = {
+  provider: 'DOCKER_SWARM_MODE';
+  role: 'MANAGER' | 'WORKER';
+};
+
+type DockerStandalone = {
+  provider: 'DOCKER_STANDALONE';
+};
+
+type KubeMode = {
+  provider: 'KUBERNETES';
+};
+
+type AzureMode = {
+  provider: 'AZURE';
+};
+
+type Mode = DockerSwarmMode | DockerStandalone | KubeMode | AzureMode;
+
+type EnvironmentMode = { agentProxy: boolean } & Mode;
+
+export interface EnvironmentState {
+  name: string;
+  mode: EnvironmentMode;
+  apiVersion: number;
+  type: EnvironmentType;
+}
diff --git a/app/react/sidebar/useSidebarState.tsx b/app/react/sidebar/useSidebarState.tsx
new file mode 100644
index 0000000..1f4e7d7
--- /dev/null
+++ b/app/react/sidebar/useSidebarState.tsx
@@ -0,0 +1,115 @@
+import {
+  createContext,
+  PropsWithChildren,
+  useContext,
+  useEffect,
+  useMemo,
+  useRef,
+  useReducer,
+} from 'react';
+import angular, { IScope } from 'angular';
+import _ from 'lodash';
+
+import { sidebarStore } from './sidebarStore';
+
+// using bootstrap breakpoint - https://getbootstrap.com/docs/5.0/layout/breakpoints/#min-width
+const mobileWidth = 992;
+
+interface State {
+  isOpen: boolean;
+  toggle(): void;
+}
+
+export const Context = createContext<State | null>(null);
+Context.displayName = 'SidebarContext';
+
+export function useSidebarState() {
+  const context = useContext(Context);
+
+  if (!context) {
+    throw new Error('useSidebarContext must be used within a SidebarProvider');
+  }
+
+  return context;
+}
+
+export function SidebarProvider({ children }: { children: React.ReactNode }) {
+  const { isOpen, toggle, setOpen } = sidebarStore();
+  const prevIsOpen = useRef<boolean | null>(null);
+
+  useUpdateAngularService(isOpen);
+
+  useEffect(() => {
+    if (window.ddExtension) {
+      return undefined;
+    }
+
+    const onResize = _.debounce(() => {
+      const currentIsOpen = sidebarStore.getState().isOpen;
+      if (isMobile()) {
+        if (currentIsOpen) {
+          prevIsOpen.current = currentIsOpen;
+          setOpen(false);
+        }
+      } else if (prevIsOpen.current !== null) {
+        setOpen(prevIsOpen.current);
+        prevIsOpen.current = null;
+      }
+    }, 50);
+
+    window.addEventListener('resize', onResize);
+    return () => window.removeEventListener('resize', onResize);
+  }, [setOpen]);
+
+  const state = useMemo(() => ({ isOpen, toggle }), [isOpen, toggle]);
+
+  return <Context.Provider value={state}>{children}</Context.Provider>;
+}
+
+export function TestSidebarProvider({ children }: PropsWithChildren<unknown>) {
+  const [isOpen, toggle] = useReducer((state) => !state, true);
+
+  const state = useMemo(
+    () => ({ isOpen, toggle: () => toggle() }),
+    [isOpen, toggle]
+  );
+
+  return <Context.Provider value={state}> {children} </Context.Provider>;
+}
+
+/* @ngInject */
+export function AngularSidebarService($rootScope: IScope) {
+  const state = {
+    isOpen: false,
+  };
+
+  function isSidebarOpen() {
+    return state.isOpen;
+  }
+
+  function setIsOpen(isOpen: boolean) {
+    $rootScope.$evalAsync(() => {
+      state.isOpen = isOpen;
+    });
+  }
+
+  return { isSidebarOpen, setIsOpen };
+}
+
+function useUpdateAngularService(isOpen: boolean) {
+  useEffect(() => {
+    // to sync "outside state" - for angularjs
+    const $injector = angular.element(document).injector();
+    $injector?.invoke(
+      /* @ngInject */ (
+        SidebarService: ReturnType<typeof AngularSidebarService>
+      ) => {
+        SidebarService.setIsOpen(isOpen);
+      }
+    );
+  }, [isOpen]);
+}
+
+function isMobile() {
+  return window.innerWidth < mobileWidth;
+}
diff --git a/app/react/test-utils/clipboard.ts b/app/react/test-utils/clipboard.ts
new file mode 100644
index 0000000..cbaf518
--- /dev/null
+++ b/app/react/test-utils/clipboard.ts
@@ -0,0 +1,16 @@
+/**
+ * Stubs isSecureContext and navigator.clipboard for tests that exercise copy
+ * functionality. useCopy gates the Clipboard API behind isSecureContext, which
+ * is always false in jsdom, so both stubs are needed together.
+ *
+ * Cleanup is handled automatically by the global afterEach in setup-rtl.ts.
+ */
+export function mockClipboard() {
+  vi.stubGlobal('isSecureContext', true);
+  const writeText = vi.fn().mockResolvedValue(undefined);
+  Object.defineProperty(navigator, 'clipboard', {
+    configurable: true,
+    value: { writeText },
+  });
+  return { writeText };
+}
diff --git a/app/react/test-utils/react-select.ts b/app/react/test-utils/react-select.ts
new file mode 100644
index 0000000..5b7e568
--- /dev/null
+++ b/app/react/test-utils/react-select.ts
@@ -0,0 +1,188 @@
+/** Simulate user events on react-select dropdowns
+ *
+ * taken from https://github.com/lokalise/react-select-event/blob/migrate-to-user-event/src/index.ts
+ * until package is updated
+ */
+
+import {
+  Matcher,
+  findAllByText,
+  findByText,
+  waitFor,
+} from '@testing-library/dom';
+import userEvent from '@testing-library/user-event';
+
+// find the react-select container from its input field 🤷
+function getReactSelectContainerFromInput(input: HTMLElement): HTMLElement {
+  return input.parentNode!.parentNode!.parentNode!.parentNode!
+    .parentNode as HTMLElement;
+}
+
+type User = ReturnType<typeof userEvent.setup> | typeof userEvent;
+
+type UserEventOptions = {
+  user?: User;
+};
+
+/**
+ * Utility for opening the select's dropdown menu.
+ * @param {HTMLElement} input The input field (eg. `getByLabelText('The label')`)
+ */
+export async function openMenu(
+  input: HTMLElement,
+  { user = userEvent }: UserEventOptions = {}
+) {
+  await user.click(input);
+  await user.type(input, '{ArrowDown}');
+}
+
+// type text in the input field
+async function type(
+  input: HTMLElement,
+  text: string,
+  { user }: Required<UserEventOptions>
+) {
+  await user.type(input, text);
+}
+
+// press the "clear" button, and reset various states
+async function clear(
+  clearButton: Element,
+  { user }: Required<UserEventOptions>
+) {
+  await user.click(clearButton);
+}
+
+interface Config extends UserEventOptions {
+  /** A container where the react-select dropdown gets rendered to.
+   *  Useful when rendering the dropdown in a portal using `menuPortalTarget`.
+   */
+  container?: HTMLElement | (() => HTMLElement);
+}
+
+/**
+ * Utility for selecting a value in a `react-select` dropdown.
+ * @param {HTMLElement} input The input field (eg. `getByLabelText('The label')`)
+ * @param {Matcher|Matcher[]} optionOrOptions The display name(s) for the option(s) to select
+ * @param {Object} config Optional config options
+ * @param {HTMLElement | (() => HTMLElement)} config.container A container for the react-select and its dropdown (defaults to the react-select container)
+ *            Useful when rending the dropdown to a portal using react-select's `menuPortalTarget`.
+ *            Can be specified as a function if it needs to be lazily evaluated.
+ */
+export async function select(
+  input: HTMLElement,
+  optionOrOptions: Matcher | Array<Matcher>,
+  { user = userEvent, ...config }: Config = {}
+) {
+  const options = Array.isArray(optionOrOptions)
+    ? optionOrOptions
+    : [optionOrOptions];
+
+  // Select the items we care about
+
+  for (const option of options) {
+    await openMenu(input, { user });
+
+    let container;
+    if (typeof config.container === 'function') {
+      // when specified as a function, the container needs to be lazily evaluated, so
+      // we have to wait for it to be visible:
+      await waitFor(config.container);
+      container = config.container();
+    } else if (config.container) {
+      container = config.container;
+    } else {
+      container = getReactSelectContainerFromInput(input);
+    }
+
+    // only consider visible, interactive elements
+    const matchingElements = await findAllByText(container, option, {
+      ignore: "[aria-live] *,[style*='visibility: hidden']",
+    });
+
+    // When the target option is already selected, the react-select display text
+    // will also match the selector. In this case, the actual dropdown element is
+    // positioned last in the DOM tree.
+    const optionElement = matchingElements[matchingElements.length - 1];
+    await user.click(optionElement);
+  }
+}
+
+interface CreateConfig extends Config, UserEventOptions {
+  createOptionText?: string | RegExp;
+  waitForElement?: boolean;
+}
+/**
+ * Utility for creating and selecting a value in a Creatable `react-select` dropdown.
+ * @async
+ * @param {HTMLElement} input The input field (eg. `getByLabelText('The label')`)
+ * @param {String} option The display name for the option to type and select
+ * @param {Object} config Optional config options
+ * @param {HTMLElement} config.container A container for the react-select and its dropdown (defaults to the react-select container)
+ *                         Useful when rending the dropdown to a portal using react-select's `menuPortalTarget`
+ * @param {boolean} config.waitForElement Whether create should wait for new option to be populated in the select container
+ * @param {String|RegExp} config.createOptionText Custom label for the "create new ..." option in the menu (string or regexp)
+ */
+export async function create(
+  input: HTMLElement,
+  option: string,
+  { waitForElement = true, user = userEvent, ...config }: CreateConfig = {}
+) {
+  const createOptionText = config.createOptionText || /^Create "/;
+  await openMenu(input, { user });
+  await type(input, option, { user });
+
+  await select(input, createOptionText, { ...config, user });
+
+  if (waitForElement) {
+    await findByText(getReactSelectContainerFromInput(input), option);
+  }
+}
+
+/**
+ * Utility for clearing the first value of a `react-select` dropdown.
+ * @param {HTMLElement} input The input field (eg. `getByLabelText('The label')`)
+ */
+export async function clearFirst(
+  input: HTMLElement,
+  { user = userEvent }: UserEventOptions = {}
+) {
+  const container = getReactSelectContainerFromInput(input);
+  // The "clear" button is the first svg element that is hidden to screen readers
+  const clearButton = container.querySelector('svg[aria-hidden="true"]')!;
+  await clear(clearButton, { user });
+}
+
+/**
+ * Utility for clearing all values in a `react-select` dropdown.
+ * @param {HTMLElement} input The input field (eg. `getByLabelText('The label')`)
+ */
+export async function clearAll(
+  input: HTMLElement,
+  { user = userEvent }: UserEventOptions = {}
+) {
+  const container = getReactSelectContainerFromInput(input);
+  // The "clear all" button is the penultimate svg element that is hidden to screen readers
+  // (the last one is the dropdown arrow)
+  const elements = container.querySelectorAll('svg[aria-hidden="true"]');
+  const clearAllButton = elements[elements.length - 2];
+  await clear(clearAllButton, { user });
+}
+
+function setup(user: User): typeof selectEvent {
+  return {
+    select: (...params: Parameters<typeof select>) =>
+      select(params[0], params[1], { user, ...params[2] }),
+    create: (...params: Parameters<typeof create>) =>
+      create(params[0], params[1], { user, ...params[2] }),
+    clearFirst: (...params: Parameters<typeof clearFirst>) =>
+      clearFirst(params[0], { user, ...params[1] }),
+    clearAll: (...params: Parameters<typeof clearAll>) =>
+      clearAll(params[0], { user, ...params[1] }),
+    openMenu: (...params: Parameters<typeof openMenu>) =>
+      openMenu(params[0], { user, ...params[1] }),
+  };
+}
+
+const selectEvent = { select, create, clearFirst, clearAll, openMenu };
+export default { ...selectEvent, setup };
diff --git a/app/react/test-utils/withRouter.tsx b/app/react/test-utils/withRouter.tsx
new file mode 100644
index 0000000..e536759
--- /dev/null
+++ b/app/react/test-utils/withRouter.tsx
@@ -0,0 +1,49 @@
+import { ComponentType } from 'react';
+import {
+  ReactStateDeclaration,
+  UIRouter,
+  UIRouterReact,
+  UIView,
+  hashLocationPlugin,
+  servicesPlugin,
+} from '@uirouter/react';
+
+/**
+ * A helper function to wrap a component with a UIRouter Provider.
+ *
+ * should only be used in tests
+ */
+export function withTestRouter<T>(
+  WrappedComponent: ComponentType<T>,
+  {
+    route = '/',
+    stateConfig = [],
+  }: { route?: string; stateConfig?: Array<ReactStateDeclaration> } = {}
+): ComponentType<T> {
+  const router = new UIRouterReact();
+
+  // router.trace.enable(Category.TRANSITION);
+  router.plugin(servicesPlugin);
+  router.plugin(hashLocationPlugin);
+
+  // Set up your custom state configuration
+  stateConfig.forEach((state) => router.stateRegistry.register(state));
+  router.urlService.rules.initial({ state: route });
+
+  // Try to create a nice displayName for React Dev Tools.
+  const displayName =
+    WrappedComponent.displayName || WrappedComponent.name || 'Component';
+
+  function WrapperComponent(props: T & JSX.IntrinsicAttributes) {
+    return (
+      <UIRouter router={router}>
+        <UIView />
+        <WrappedComponent {...props} />
+      </UIRouter>
+    );
+  }
+
+  WrapperComponent.displayName = `withTestRouter(${displayName})`;
+
+  return WrapperComponent;
+}
diff --git a/app/react/test-utils/withTestQuery.tsx b/app/react/test-utils/withTestQuery.tsx
new file mode 100644
index 0000000..136e686
--- /dev/null
+++ b/app/react/test-utils/withTestQuery.tsx
@@ -0,0 +1,25 @@
+import { ComponentType } from 'react';
+import { MutationCache, QueryCache, QueryClient } from '@tanstack/react-query';
+
+import { withReactQuery } from '@/react-tools/withReactQuery';
+
+export function withTestQueryProvider<T>(
+  WrappedComponent: ComponentType<T & JSX.IntrinsicAttributes>,
+  {
+    onMutationError,
+    onQueryError,
+  }: {
+    onMutationError?(error: unknown): void;
+    onQueryError?(error: unknown): void;
+  } = {}
+) {
+  const testQueryClient = new QueryClient({
+    defaultOptions: { queries: { retry: false } },
+    queryCache: new QueryCache({ onError: onQueryError }),
+    mutationCache: new MutationCache({
+      onError: onMutationError,
+    }),
+  });
+
+  return withReactQuery(WrappedComponent, testQueryClient);
+}
diff --git a/app/react/test-utils/withUserProvider.tsx b/app/react/test-utils/withUserProvider.tsx
new file mode 100644
index 0000000..39d16d1
--- /dev/null
+++ b/app/react/test-utils/withUserProvider.tsx
@@ -0,0 +1,43 @@
+import { ComponentType, useMemo } from 'react';
+
+import { UserContext } from '@/react/hooks/useUser';
+import { User } from '@/portainer/users/types';
+
+const mockUser: User = {
+  EndpointAuthorizations: [],
+  Id: 1,
+  Role: 1,
+  Username: 'mock',
+  UseCache: false,
+  ThemeSettings: {
+    color: 'auto',
+  },
+};
+
+/**
+ * A helper function to wrap a component with a UserContext.Provider.
+ *
+ * should only be used in tests
+ */
+export function withUserProvider<T>(
+  WrappedComponent: ComponentType<T>,
+  user = mockUser
+): ComponentType<T> {
+  // Try to create a nice displayName for React Dev Tools.
+  const displayName =
+    WrappedComponent.displayName || WrappedComponent.name || 'Component';
+
+  function WrapperComponent(props: T & JSX.IntrinsicAttributes) {
+    const state = useMemo(() => ({ user }), []);
+
+    return (
+      <UserContext.Provider value={state}>
+        <WrappedComponent {...props} />
+      </UserContext.Provider>
+    );
+  }
+
+  WrapperComponent.displayName = `withUserProvider(${displayName})`;
+
+  return WrapperComponent;
+}
diff --git a/app/react/utils/context.tsx b/app/react/utils/context.tsx
new file mode 100644
index 0000000..6b39ef2
--- /dev/null
+++ b/app/react/utils/context.tsx
@@ -0,0 +1,33 @@
+import {
+  PropsWithChildren,
+  createContext as reactCreateContext,
+  useContext as reactUseContext,
+} from 'react';
+
+/**
+ * Reduce the boilerplate code to create a custom context and provider hook
+ * @param displayName Display name of the Context in react inspector
+ * @returns A Provider and custom hook for this context
+ */
+export function createContext<TContext>(displayName: string) {
+  const Context = reactCreateContext<TContext | null>(null);
+  Context.displayName = displayName;
+
+  return { Provider, useContext };
+
+  function Provider({
+    children,
+    context,
+  }: PropsWithChildren<{ context: TContext }>) {
+    return <Context.Provider value={context}>{children}</Context.Provider>;
+  }
+
+  function useContext() {
+    const context = reactUseContext(Context);
+    if (context === null) {
+      throw new Error(`should be nested under Provider - ${displayName}`);
+    }
+
+    return context;
+  }
+}
diff --git a/app/react/utils/hash.test.ts b/app/react/utils/hash.test.ts
new file mode 100644
index 0000000..cc4c2ed
--- /dev/null
+++ b/app/react/utils/hash.test.ts
@@ -0,0 +1,13 @@
+import { describe, expect, it } from 'vitest';
+
+import { strToHash } from './hash';
+
+describe('strToHash', () => {
+  it('returns the same value for the same input', () => {
+    expect(strToHash('password123')).toBe(strToHash('password123'));
+  });
+
+  it('returns different values for different inputs', () => {
+    expect(strToHash('password123')).not.toBe(strToHash('password456'));
+  });
+});
diff --git a/app/react/utils/hash.ts b/app/react/utils/hash.ts
new file mode 100644
index 0000000..fb1a815
--- /dev/null
+++ b/app/react/utils/hash.ts
@@ -0,0 +1,8 @@
+/** Non-cryptographic hash for cache keys and display purposes — do not use for security. */
+export function strToHash(str: string): number {
+  let hash = 0;
+  for (let i = 0; i < str.length; i++) {
+    hash = str.charCodeAt(i) + ((hash << 5) - hash);
+  }
+  return hash;
+}
diff --git a/app/react/utils/validation.test.ts b/app/react/utils/validation.test.ts
new file mode 100644
index 0000000..16fe975
--- /dev/null
+++ b/app/react/utils/validation.test.ts
@@ -0,0 +1,85 @@
+import { describe, it, expect } from 'vitest';
+
+import { durationValidation } from './validation';
+
+describe('durationValidation', () => {
+  describe('empty value handling', () => {
+    it('accepts empty when allowEmpty=true (default)', async () => {
+      const schema = durationValidation();
+      await expect(schema.validate('')).resolves.toBe('');
+      await expect(schema.validate(undefined)).resolves.toBeUndefined();
+    });
+
+    it('rejects empty when allowEmpty=false', async () => {
+      const schema = durationValidation(false);
+      await expect(schema.validate('')).rejects.toThrow(
+        'Invalid duration format'
+      );
+    });
+  });
+
+  describe('valid durations', () => {
+    const schema = durationValidation();
+
+    it('accepts all time units', async () => {
+      await expect(schema.validate('100ns')).resolves.toBe('100ns');
+      await expect(schema.validate('500us')).resolves.toBe('500us');
+      await expect(schema.validate('500µs')).resolves.toBe('500µs');
+      await expect(schema.validate('100ms')).resolves.toBe('100ms');
+      await expect(schema.validate('30s')).resolves.toBe('30s');
+      await expect(schema.validate('5m')).resolves.toBe('5m');
+      await expect(schema.validate('1h')).resolves.toBe('1h');
+      await expect(schema.validate('7d')).resolves.toBe('7d');
+    });
+
+    it('accepts decimal values', async () => {
+      await expect(schema.validate('1.5h')).resolves.toBe('1.5h');
+      await expect(schema.validate('0.5d')).resolves.toBe('0.5d');
+    });
+
+    it('accepts chained units', async () => {
+      await expect(schema.validate('1h30m')).resolves.toBe('1h30m');
+      await expect(schema.validate('2d12h')).resolves.toBe('2d12h');
+      await expect(schema.validate('2h45m30s')).resolves.toBe('2h45m30s');
+    });
+
+    it('accepts zero and large values', async () => {
+      await expect(schema.validate('0s')).resolves.toBe('0s');
+      await expect(schema.validate('365d')).resolves.toBe('365d');
+    });
+  });
+
+  describe('invalid durations', () => {
+    const schema = durationValidation();
+
+    it('rejects numbers without units', async () => {
+      await expect(schema.validate('300')).rejects.toThrow(
+        'Invalid duration format'
+      );
+    });
+
+    it('rejects invalid units', async () => {
+      await expect(schema.validate('5minutes')).rejects.toThrow(
+        'Invalid duration format'
+      );
+      await expect(schema.validate('7days')).rejects.toThrow(
+        'Invalid duration format'
+      );
+    });
+
+    it('rejects spaces and invalid formats', async () => {
+      await expect(schema.validate('5 m')).rejects.toThrow(
+        'Invalid duration format'
+      );
+      await expect(schema.validate('m')).rejects.toThrow(
+        'Invalid duration format'
+      );
+      await expect(schema.validate('-5m')).rejects.toThrow(
+        'Invalid duration format'
+      );
+      await expect(schema.validate('abc')).rejects.toThrow(
+        'Invalid duration format'
+      );
+    });
+  });
+});
diff --git a/app/react/utils/validation.ts b/app/react/utils/validation.ts
new file mode 100644
index 0000000..9cab17c
--- /dev/null
+++ b/app/react/utils/validation.ts
@@ -0,0 +1,51 @@
+import { string } from 'yup';
+
+/**
+ * Validates a duration string format (e.g., "5m0s", "10m", "1h30m")
+ *
+ * Valid units:
+ * - ns (nanoseconds)
+ * - us/µs (microseconds)
+ * - ms (milliseconds)
+ * - s (seconds)
+ * - m (minutes)
+ * - h (hours)
+ * - d (days)
+ *
+ * Examples of valid durations:
+ * - "300s"
+ * - "5m"
+ * - "1h30m"
+ * - "2h45m30s"
+ * - "1.5h"
+ * - "7d"
+ * - "2d12h"
+ *
+ * @param allowEmpty - Whether to allow empty strings (default: true)
+ * @returns Yup string schema with duration validation
+ */
+export function durationValidation(allowEmpty = true) {
+  // Regex pattern that matches duration format
+  // Allows: number (with optional decimal) + unit, can be chained
+  // Units: ns, us, µs, ms, s, m, h, d
+  const durationRegex = /^(\d+(\.\d+)?(ns|us|µs|ms|s|m|h|d))+$/;
+
+  return string().test(
+    'duration',
+    'Invalid duration format. Use formats like 5m, 1h30m, 7d, or 300s',
+    (value) => {
+      // Empty string is valid if allowed
+      if (allowEmpty && (!value || value.trim() === '')) {
+        return true;
+      }
+
+      // Empty string is invalid if not allowed
+      if (!allowEmpty && (!value || value.trim() === '')) {
+        return false;
+      }
+
+      // Check if the format matches duration pattern
+      return value ? durationRegex.test(value.trim()) : false;
+    }
+  );
+}
diff --git a/app/setup-tests/i18n.ts b/app/setup-tests/i18n.ts
new file mode 100644
index 0000000..66eab9e
--- /dev/null
+++ b/app/setup-tests/i18n.ts
@@ -0,0 +1,21 @@
+import i18n from 'i18next';
+import { initReactI18next } from 'react-i18next';
+
+import translation from '../../translations/en/translation.json';
+
+i18n.use(initReactI18next).init({
+  lng: 'en',
+  fallbackLng: 'en',
+
+  // have a common namespace used around the full app
+  ns: ['translationsNS'],
+  defaultNS: 'translationsNS',
+
+  interpolation: {
+    escapeValue: false,
+  },
+
+  resources: { en: { translationsNS: translation } },
+});
+
+export default i18n;
diff --git a/app/setup-tests/mock-codemirror.tsx b/app/setup-tests/mock-codemirror.tsx
new file mode 100644
index 0000000..d30c50c
--- /dev/null
+++ b/app/setup-tests/mock-codemirror.tsx
@@ -0,0 +1,61 @@
+vi.mock('@uiw/react-codemirror', () => ({
+  __esModule: true,
+  default: ({
+    value,
+    onChange,
+    readOnly,
+    placeholder,
+    height,
+    className,
+    id,
+    'data-cy': dataCy,
+  }: {
+    value?: string;
+    onChange?: (value: string) => void;
+    readOnly?: boolean;
+    placeholder?: string;
+    height?: string;
+    className?: string;
+    id?: string;
+    'data-cy'?: string;
+  }) => (
+    <textarea
+      value={value}
+      onChange={(e) => onChange?.(e.target.value)}
+      readOnly={readOnly}
+      placeholder={placeholder}
+      style={height ? { height } : undefined}
+      className={className}
+      id={id}
+      data-cy={dataCy}
+    />
+  ),
+  oneDarkHighlightStyle: {},
+  keymap: {
+    of: () => ({}),
+  },
+}));
+
+vi.mock('react-codemirror-merge', () => {
+  const components = {
+    MergeView: () => <div />,
+    Original: () => <div />,
+    Modified: () => <div />,
+  };
+
+  return {
+    __esModule: true,
+    default: components,
+    ...components,
+  };
+});
+
+vi.mock('yaml-schema', () => ({
+  yamlSchema: () => [],
+  validation: () => ({
+    of: () => ({}),
+  }),
+}));
+
+/** @deprecated vi.mock calls are hoisted; callers no longer need to invoke this */
+export function mockCodeMirror() {}
diff --git a/app/setup-tests/mock-localizeDate.ts b/app/setup-tests/mock-localizeDate.ts
new file mode 100644
index 0000000..996d420
--- /dev/null
+++ b/app/setup-tests/mock-localizeDate.ts
@@ -0,0 +1,19 @@
+// Mock localizeDate to always use en-US and UTC
+vi.mock('@/react/common/date-utils', () => ({
+  localizeDate: (date: Date) =>
+    date
+      .toLocaleString('en-US', {
+        timeZone: 'UTC',
+        year: 'numeric',
+        month: 'short',
+        day: 'numeric',
+        hour: 'numeric',
+        minute: '2-digit',
+        hour12: true,
+      })
+      .replace('am', 'AM')
+      .replace('pm', 'PM'),
+}));
+
+/** @deprecated vi.mock calls are hoisted; callers no longer need to invoke this */
+export function mockLocalizeDate() {}
diff --git a/app/setup-tests/server-handlers.ts b/app/setup-tests/server-handlers.ts
new file mode 100644
index 0000000..497803d
--- /dev/null
+++ b/app/setup-tests/server-handlers.ts
@@ -0,0 +1,116 @@
+import { http, HttpResponse } from 'msw';
+
+import {
+  Edition,
+  LicenseInfo,
+  LicenseType,
+} from '@/react/portainer/licenses/types';
+import { EnvironmentGroup } from '@/react/portainer/environments/environment-groups/types';
+import { Tag } from '@/portainer/tags/types';
+import { StatusResponse } from '@/react/portainer/system/useSystemStatus';
+import { createMockTeams } from '@/react-tools/test-mocks';
+import { UserId } from '@/portainer/users/types';
+import { VersionResponse } from '@/react/portainer/system/useSystemVersion';
+
+import { azureHandlers } from './setup-handlers/azure';
+import { dockerHandlers } from './setup-handlers/docker';
+import { userHandlers } from './setup-handlers/users';
+import { kubernetesHandlers } from './setup-handlers/kubernetes';
+import { endpointsHandlers } from './setup-handlers/endpoints';
+import { settingsHandlers } from './setup-handlers/settings';
+import { templatesHandlers } from './setup-handlers/templates';
+import { edgeHandlers } from './setup-handlers/edge';
+import { gitopsHandlers } from './setup-handlers/gitops';
+
+const tags: Tag[] = [
+  { ID: 1, Name: 'tag1', Endpoints: {} },
+  { ID: 2, Name: 'tag2', Endpoints: {} },
+];
+
+const licenseInfo: LicenseInfo = {
+  nodes: 1000,
+  type: LicenseType.Subscription,
+  company: 'company',
+  createdAt: 0,
+  email: 'email@company.com',
+  expiresAt: Number.MAX_SAFE_INTEGER,
+  productEdition: Edition.EE,
+  valid: true,
+  enforcedAt: 0,
+  enforced: false,
+};
+
+export const handlers = [
+  http.get('/api/teams', async () => HttpResponse.json(createMockTeams(10))),
+
+  http.post<{ name: string }>('/api/teams', () =>
+    HttpResponse.json(null, { status: 204 })
+  ),
+  http.post<never, { userId: UserId }>('/api/team_memberships', () =>
+    HttpResponse.json(null, { status: 204 })
+  ),
+  ...endpointsHandlers,
+  ...settingsHandlers,
+  ...templatesHandlers,
+  ...azureHandlers,
+  ...dockerHandlers,
+  ...userHandlers,
+  ...kubernetesHandlers,
+  ...edgeHandlers,
+  ...gitopsHandlers,
+  http.get('/api/stacks', () => HttpResponse.json([])),
+  http.get('/api/licenses/info', () => HttpResponse.json(licenseInfo)),
+  http.get('/api/status/nodes', () => HttpResponse.json({ nodes: 3 })),
+  http.get('/api/backup/s3/status', () => HttpResponse.json({ Failed: false })),
+  http.get('/api/endpoint_groups', () => HttpResponse.json([])),
+  http.get('/api/endpoint_groups/:groupId', ({ params }) => {
+    if (!params.groupId || params.groupId instanceof Array) {
+      throw new Error('should be string');
+    }
+    const id = parseInt(params.groupId, 10);
+    const group: Partial<EnvironmentGroup> = {
+      Id: id,
+      Name: `group${id}`,
+    };
+    return HttpResponse.json(group);
+  }),
+  http.get('/api/tags', () => HttpResponse.json(tags)),
+  http.post<never, { name: string }>('/api/tags', async ({ request }) => {
+    const body = await request.json();
+    const tagName = body.name;
+    const tag = { ID: tags.length + 1, Name: tagName, Endpoints: {} };
+    tags.push(tag);
+    return HttpResponse.json(tag);
+  }),
+
+  http.get<never, never, Partial<StatusResponse>>('/api/status', () =>
+    HttpResponse.json({})
+  ),
+  http.get<never, never, Partial<StatusResponse>>('/api/system/status', () =>
+    HttpResponse.json({})
+  ),
+  http.get<never, never, Partial<VersionResponse>>('/api/system/version', () =>
+    HttpResponse.json({ ServerVersion: 'v2.10.0' })
+  ),
+  http.get('/api/teams/:id/memberships', () => HttpResponse.json([])),
+  http.get('/api/observability/alerting/settings', () => HttpResponse.json([])),
+  http.get('/observability/alerting/rules', () => HttpResponse.json([])),
+
+  http.get('/api/omni/:id/machines', () => HttpResponse.json([])),
+  http.get('/api/registries', () => HttpResponse.json([])),
+  http.get('/api/registries/:id', () => HttpResponse.json({})),
+
+  http.get('/api/system/info', () => HttpResponse.json({})),
+  http.post('/api/registries/ping', () =>
+    HttpResponse.json({
+      success: true,
+      message: 'Registry connection successful',
+    })
+  ),
+  http.put('/api/resource_controls/:id', () =>
+    HttpResponse.json({ success: true })
+  ),
+  http.get('/api/webhooks', () => HttpResponse.json([])),
+  http.get('/api/policies', () => HttpResponse.json([])),
+  http.get('/api/roles', () => HttpResponse.json([])),
+];
diff --git a/app/setup-tests/server.ts b/app/setup-tests/server.ts
new file mode 100644
index 0000000..5405f30
--- /dev/null
+++ b/app/setup-tests/server.ts
@@ -0,0 +1,7 @@
+import { http, ws } from 'msw';
+import { setupServer } from 'msw/node';
+
+import { handlers } from './server-handlers';
+
+const server = setupServer(...handlers);
+export { server, http, ws };
diff --git a/app/setup-tests/setup-codemirror.ts b/app/setup-tests/setup-codemirror.ts
new file mode 100644
index 0000000..744c66e
--- /dev/null
+++ b/app/setup-tests/setup-codemirror.ts
@@ -0,0 +1,47 @@
+import '@testing-library/jest-dom/vitest';
+
+import { mockCodeMirror } from './mock-codemirror';
+
+// Initialize CodeMirror module mocks
+mockCodeMirror();
+
+// Mock Range APIs that CodeMirror needs but JSDOM doesn't provide
+Range.prototype.getBoundingClientRect = () => ({
+  bottom: 0,
+  height: 0,
+  left: 0,
+  right: 0,
+  top: 0,
+  width: 0,
+  x: 0,
+  y: 0,
+  toJSON: vi.fn(),
+});
+
+Range.prototype.getClientRects = () => ({
+  item: () => null,
+  length: 0,
+  [Symbol.iterator]: vi.fn(),
+});
+
+// Mock createRange
+document.createRange = () => {
+  const range = new Range();
+  range.getBoundingClientRect = vi.fn();
+  range.getClientRects = () => ({
+    item: () => null,
+    length: 0,
+    [Symbol.iterator]: vi.fn(),
+  });
+  return range;
+};
+
+// Mock selection APIs
+const mockSelection = {
+  rangeCount: 0,
+  addRange: vi.fn(),
+  getRangeAt: vi.fn(),
+  removeAllRanges: vi.fn(),
+};
+
+window.getSelection = () => mockSelection as unknown as Selection;
diff --git a/app/setup-tests/setup-handlers/azure.ts b/app/setup-tests/setup-handlers/azure.ts
new file mode 100644
index 0000000..2ec51e8
--- /dev/null
+++ b/app/setup-tests/setup-handlers/azure.ts
@@ -0,0 +1,78 @@
+import { http, HttpResponse } from 'msw';
+
+export const azureHandlers = [
+  http.get('/api/endpoints/:endpointId/azure/subscriptions', () =>
+    HttpResponse.json({
+      value: [
+        {
+          id: '/subscriptions/sub1',
+          authorizationSource: 'RoleBased',
+          subscriptionId: 'sub1',
+          displayName: 'Portainer',
+          state: 'Enabled',
+        },
+      ],
+    })
+  ),
+  http.get(
+    '/api/endpoints/:endpointId/azure/subscriptions/:subscriptionId/providers/Microsoft.ContainerInstance',
+    ({ params }) =>
+      HttpResponse.json({
+        id: `/subscriptions/${params.subscriptionId}/providers/Microsoft.ContainerInstance`,
+        namespace: 'Microsoft.ContainerInstance',
+        resourceTypes: [
+          {
+            resourceType: 'containerGroups',
+            locations: [
+              'Australia East',
+              'Australia Southeast',
+              'Brazil South',
+            ],
+          },
+          {
+            resourceType: 'serviceAssociationLinks',
+            locations: [
+              'Korea Central',
+              'North Central US',
+              'North Europe',
+              'Norway East',
+              'South Africa North',
+              'South Central US',
+            ],
+          },
+          {
+            resourceType: 'locations',
+            locations: [],
+          },
+        ],
+      })
+  ),
+  http.get(
+    '/api/endpoints/:endpointId/azure/subscriptions/:subscriptionId/providers/Microsoft.ContainerInstance/containerGroups',
+    () => HttpResponse.json({ value: [] })
+  ),
+  http.get(
+    '/api/endpoints/:endpointId/azure/subscriptions/:subscriptionId/providers/Microsoft.Network/virtualNetworks',
+    () => HttpResponse.json({ value: [] })
+  ),
+  http.get(
+    '/api/endpoints/:endpointId/azure/subscriptions/:subscriptionId/resourcegroups',
+    ({ params }) =>
+      HttpResponse.json({
+        value: [
+          {
+            id: `/subscriptions/${params.subscriptionId}/resourceGroups/rg1`,
+            name: 'rg1',
+            location: 'southcentralus',
+            properties: { provisioningState: 'Succeeded' },
+          },
+          {
+            id: `/subscriptions/${params.subscriptionId}/resourceGroups/rg2`,
+            name: 'rg2',
+            location: 'southcentralus',
+            properties: { provisioningState: 'Succeeded' },
+          },
+        ],
+      })
+  ),
+];
diff --git a/app/setup-tests/setup-handlers/docker.ts b/app/setup-tests/setup-handlers/docker.ts
new file mode 100644
index 0000000..e734748
--- /dev/null
+++ b/app/setup-tests/setup-handlers/docker.ts
@@ -0,0 +1,28 @@
+import { http, HttpResponse } from 'msw';
+import { SystemInfo, SystemVersion } from 'docker-types';
+
+import { dockerImagesHandlers } from './docker/images';
+
+export const dockerHandlers = [
+  ...dockerImagesHandlers,
+  http.get<never, never, SystemInfo>(
+    '/api/endpoints/:endpointId/docker/info',
+    () =>
+      HttpResponse.json({
+        Plugins: { Authorization: [], Log: [], Network: [], Volume: [] },
+        MemTotal: 0,
+        NCPU: 0,
+        Runtimes: { runc: { path: 'runc' } },
+      })
+  ),
+  http.get<never, never, SystemVersion>(
+    '/api/endpoints/:endpointId/docker/version',
+    () => HttpResponse.json({ ApiVersion: '1.24' })
+  ),
+  http.get('/api/endpoints/:endpointId/docker/containers/json', () =>
+    HttpResponse.json([])
+  ),
+  http.get('/api/endpoints/:endpointId/docker/networks', () =>
+    HttpResponse.json([])
+  ),
+];
diff --git a/app/setup-tests/setup-handlers/docker/images.ts b/app/setup-tests/setup-handlers/docker/images.ts
new file mode 100644
index 0000000..3c31449
--- /dev/null
+++ b/app/setup-tests/setup-handlers/docker/images.ts
@@ -0,0 +1,8 @@
+import { http, HttpResponse } from 'msw';
+
+export const dockerImagesHandlers = [
+  http.get('/api/docker/:envId/images', () => HttpResponse.json([])),
+  http.get('/api/endpoints/:id/docker/images/json', () =>
+    HttpResponse.json([])
+  ),
+];
diff --git a/app/setup-tests/setup-handlers/edge.ts b/app/setup-tests/setup-handlers/edge.ts
new file mode 100644
index 0000000..1b88dab
--- /dev/null
+++ b/app/setup-tests/setup-handlers/edge.ts
@@ -0,0 +1,24 @@
+import { http, HttpResponse } from 'msw';
+
+export const edgeHandlers = [
+  http.get('/api/edge_configurations', () => HttpResponse.json([])),
+  http.get('/api/edge_configurations/:id', () => HttpResponse.json({})),
+  http.get('/api/edge_update_schedules', () => HttpResponse.json([])),
+  http.get('/api/edge_update_schedules/:id', () => HttpResponse.json({})),
+  http.get('/api/edge_groups', () => HttpResponse.json([])),
+  http.get('/api/edge_jobs', () => HttpResponse.json([])),
+  http.get('/api/edge_jobs/:id', () => HttpResponse.json({})),
+  http.get('/api/edge_jobs/:id/file', () =>
+    HttpResponse.json({ FileContent: '' })
+  ),
+  http.get('/api/edge_stacks', () => HttpResponse.json([])),
+  http.get('/api/edge_stacks/:id', () => HttpResponse.json({})),
+  http.get('/api/edge_stacks/:id/stagger/status', () =>
+    HttpResponse.json({
+      status: 'idle',
+    })
+  ),
+  http.get('/api/edge_stacks/:id/file', () =>
+    HttpResponse.json({ StackFileContent: '' })
+  ),
+];
diff --git a/app/setup-tests/setup-handlers/endpoints.ts b/app/setup-tests/setup-handlers/endpoints.ts
new file mode 100644
index 0000000..4d21b00
--- /dev/null
+++ b/app/setup-tests/setup-handlers/endpoints.ts
@@ -0,0 +1,19 @@
+import { http, HttpResponse } from 'msw';
+
+import { createMockEnvironment } from '@/react-tools/test-mocks';
+
+export const endpointsHandlers = [
+  http.get('/api/endpoints', () => HttpResponse.json([])),
+  http.get('/api/endpoints/agent_versions', () => HttpResponse.json([])),
+  http.get('/api/endpoints/:endpointId', ({ params }) =>
+    HttpResponse.json(
+      createMockEnvironment({ Id: parseInt(params.endpointId as string, 10) })
+    )
+  ),
+  http.get('/api/endpoints/:endpointId/registries', () =>
+    HttpResponse.json([])
+  ),
+  http.get('/api/endpoints/:endpointId/registries/:id', () =>
+    HttpResponse.json({})
+  ),
+];
diff --git a/app/setup-tests/setup-handlers/gitops.ts b/app/setup-tests/setup-handlers/gitops.ts
new file mode 100644
index 0000000..4f38662
--- /dev/null
+++ b/app/setup-tests/setup-handlers/gitops.ts
@@ -0,0 +1,30 @@
+import { http, HttpResponse } from 'msw';
+
+import { SourcesSourceDetail } from '@api/types.gen';
+
+export const gitopsHandlers = [
+  http.post('/api/gitops/repo/refs', () =>
+    HttpResponse.json(['refs/heads/main', 'refs/heads/develop'])
+  ),
+  http.post('/api/gitops/repo/files/search', () =>
+    HttpResponse.json(['docker-compose.yml'])
+  ),
+  http.get('/api/gitops/sources', () => {
+    return HttpResponse.json([], {
+      headers: {
+        'x-total-count': '0',
+        'x-total-available': '0',
+      },
+    });
+  }),
+  http.get('/api/gitops/sources/:id', ({ params: { id } }) => {
+    return HttpResponse.json<SourcesSourceDetail>({
+      id: typeof id === 'string' ? parseInt(id, 10) : 0,
+      name: 'source',
+      status: 'healthy',
+      type: 'git',
+      url: 'https://github.com/portainer/portainer',
+      connection: {},
+    });
+  }),
+];
diff --git a/app/setup-tests/setup-handlers/kubernetes.ts b/app/setup-tests/setup-handlers/kubernetes.ts
new file mode 100644
index 0000000..4711a1e
--- /dev/null
+++ b/app/setup-tests/setup-handlers/kubernetes.ts
@@ -0,0 +1,44 @@
+import { http, HttpResponse } from 'msw';
+
+export const kubernetesHandlers = [
+  http.get(
+    '/api/kubernetes/:endpointId/metrics/pods/namespace/:namespace',
+    () => HttpResponse.json({})
+  ),
+  http.get('/api/kubernetes/:endpointId/namespaces/:namespace/events', () =>
+    HttpResponse.json([])
+  ),
+  http.get('/api/kubernetes/:endpointId/namespaces/:namespace', () =>
+    HttpResponse.json({})
+  ),
+  http.get('/api/kubernetes/:endpointId/ingresses', () =>
+    HttpResponse.json({})
+  ),
+  http.get('/api/kubernetes/:endpointId/namespaces', () =>
+    HttpResponse.json([])
+  ),
+  http.get('/api/kubernetes/:endpointId/customresourcedefinitions', () =>
+    HttpResponse.json({})
+  ),
+  http.get('/api/kubernetes/:endpointId/rbac_enabled', () =>
+    HttpResponse.json(false)
+  ),
+  http.get('/api/kubernetes/:endpointId/customresourcedefinitions/:name', () =>
+    HttpResponse.json({})
+  ),
+  http.get(
+    '/api/kubernetes/:endpointId/namespaces/portainer/configmaps/:name',
+    () => HttpResponse.json({})
+  ),
+  http.get('/api/kubernetes/:endpointId/max_resource_limits', () =>
+    HttpResponse.json({})
+  ),
+  http.get('/api/kubernetes/:endpointId/ingresscontrollers', () =>
+    HttpResponse.json([])
+  ),
+  http.get('/api/kubernetes/:id/namespaces/:ns/ingresscontrollers', () =>
+    HttpResponse.json([])
+  ),
+
+  http.get('/api/kubernetes/:endpointId/nodes', () => HttpResponse.json([])),
+];
diff --git a/app/setup-tests/setup-handlers/settings.ts b/app/setup-tests/setup-handlers/settings.ts
new file mode 100644
index 0000000..cfc338e
--- /dev/null
+++ b/app/setup-tests/setup-handlers/settings.ts
@@ -0,0 +1,39 @@
+import { http, HttpResponse } from 'msw';
+
+import { PublicSettingsResponse } from '@/react/portainer/settings/types';
+
+export const settingsHandlers = [
+  http.get('/api/ssl', () => HttpResponse.json({})),
+  http.get('/api/settings', () => HttpResponse.json({})),
+  http.get('/api/settings/edge/mtls_certificate', () => HttpResponse.json({})),
+  http.get('/api/settings/edge/mtls_ca_certificate', () =>
+    HttpResponse.json({})
+  ),
+  http.get('/api/settings/additional_functionality', () =>
+    HttpResponse.json({})
+  ),
+  http.get('/api/support/debug_log', () => HttpResponse.json({})),
+  http.get<never, never, Partial<PublicSettingsResponse>>(
+    '/api/settings/public',
+    () =>
+      HttpResponse.json({
+        Edge: {
+          AsyncMode: false,
+          CheckinInterval: 60,
+          CommandInterval: 60,
+          PingInterval: 60,
+          SnapshotInterval: 60,
+        },
+        GlobalDeploymentOptions: {
+          perEnvOverride: false,
+          hideAddWithForm: false,
+          hideFileUpload: false,
+          hideStacksFunctionality: false,
+          hideWebEditor: false,
+          requireNoteOnApplications: false,
+          minApplicationNoteLength: 0,
+        },
+        Features: {},
+      } satisfies Partial<PublicSettingsResponse>)
+  ),
+];
diff --git a/app/setup-tests/setup-handlers/templates.ts b/app/setup-tests/setup-handlers/templates.ts
new file mode 100644
index 0000000..05ae86f
--- /dev/null
+++ b/app/setup-tests/setup-handlers/templates.ts
@@ -0,0 +1,9 @@
+import { http, HttpResponse } from 'msw';
+
+export const templatesHandlers = [
+  http.put('/api/custom_templates/:id/git_fetch', () =>
+    HttpResponse.json({ FileContent: '' })
+  ),
+  http.get('/api/custom_templates', () => HttpResponse.json([])),
+  http.get('/api/templates/helm/values', () => HttpResponse.json({})),
+];
diff --git a/app/setup-tests/setup-handlers/users.ts b/app/setup-tests/setup-handlers/users.ts
new file mode 100644
index 0000000..be8c3a5
--- /dev/null
+++ b/app/setup-tests/setup-handlers/users.ts
@@ -0,0 +1,15 @@
+import { http, HttpResponse } from 'msw';
+
+import { TeamMembership } from '@/react/portainer/users/teams/types';
+import { createMockUsers } from '@/react-tools/test-mocks';
+import { Role } from '@/portainer/users/types';
+
+export const userHandlers = [
+  http.get('/api/users', async () =>
+    HttpResponse.json(createMockUsers(10, Role.Standard))
+  ),
+  http.get<never, never, TeamMembership[]>(
+    '/api/users/:userId/memberships',
+    () => HttpResponse.json([])
+  ),
+];
diff --git a/app/setup-tests/setup-msw.ts b/app/setup-tests/setup-msw.ts
new file mode 100644
index 0000000..1181966
--- /dev/null
+++ b/app/setup-tests/setup-msw.ts
@@ -0,0 +1,12 @@
+import { server } from './server';
+
+beforeAll(() =>
+  server.listen({
+    onUnhandledRequest: 'error',
+  })
+);
+// if you need to add a handler after calling setupServer for some specific test
+// this will remove that handler for the rest of them
+// (which is important for test isolation):
+afterEach(() => server.resetHandlers());
+afterAll(() => server.close());
diff --git a/app/setup-tests/setup-rtl.ts b/app/setup-tests/setup-rtl.ts
new file mode 100644
index 0000000..4315e05
--- /dev/null
+++ b/app/setup-tests/setup-rtl.ts
@@ -0,0 +1,8 @@
+import { cleanup, configure } from '@testing-library/react';
+
+configure({ testIdAttribute: 'data-cy' });
+
+afterEach(() => {
+  cleanup();
+  vi.unstubAllGlobals();
+});
diff --git a/app/setup-tests/setup-websocket.ts b/app/setup-tests/setup-websocket.ts
new file mode 100644
index 0000000..bc213b9
--- /dev/null
+++ b/app/setup-tests/setup-websocket.ts
@@ -0,0 +1,9 @@
+// MSW 2.x requires WebSocket to be writable in the global scope
+// In JSDOM, WebSocket is read-only by default, so we need to make it configurable
+if (typeof global.WebSocket !== 'undefined') {
+  Object.defineProperty(global, 'WebSocket', {
+    writable: true,
+    configurable: true,
+    value: global.WebSocket,
+  });
+}
diff --git a/app/setup-tests/setup.ts b/app/setup-tests/setup.ts
new file mode 100644
index 0000000..bb02c60
--- /dev/null
+++ b/app/setup-tests/setup.ts
@@ -0,0 +1 @@
+import '@testing-library/jest-dom/vitest';
diff --git a/app/setup-tests/stub-modules.ts b/app/setup-tests/stub-modules.ts
new file mode 100644
index 0000000..02026c7
--- /dev/null
+++ b/app/setup-tests/stub-modules.ts
@@ -0,0 +1,8 @@
+// this file takes care of stubbing modules that are not tested, like
+// axios-progress-bar
+// toastr
+
+vi.mock('toastr');
+vi.mock('axios-progress-bar', () => ({
+  loadProgressBar() {},
+}));
diff --git a/app/setup-tests/suppress-console.ts b/app/setup-tests/suppress-console.ts
new file mode 100644
index 0000000..0acefb8
--- /dev/null
+++ b/app/setup-tests/suppress-console.ts
@@ -0,0 +1,64 @@
+/* eslint-disable no-console */
+import { vi } from 'vitest';
+
+/**
+ * Suppresses all console output during tests.
+ * Useful for tests that trigger expected errors, warnings, or info messages
+ * that clutter the test output without providing useful information.
+ *
+ * Can be used at file level or per-test level.
+ *
+ * @example File level usage
+ * ```typescript
+ * import { suppressConsoleLogs } from '@/setup-tests/suppress-console';
+ *
+ * const restoreConsole = suppressConsoleLogs();
+ * afterAll(restoreConsole);
+ * ```
+ *
+ * @example Per-test usage
+ * ```typescript
+ * import { suppressConsoleLogs } from '@/setup-tests/suppress-console';
+ *
+ * describe('some test suite', () => {
+ *   let restoreConsole: () => void;
+ *
+ *   beforeEach(() => {
+ *     restoreConsole = suppressConsoleLogs();
+ *   });
+ *
+ *   afterEach(() => {
+ *     restoreConsole();
+ *   });
+ *
+ *   test('test that produces noisy logs', () => {
+ *     // console logs suppressed
+ *   });
+ * });
+ * ```
+ *
+ * @returns A cleanup function to restore the original console methods
+ */
+export function suppressConsoleLogs() {
+  const originalError = console.error;
+  const originalWarn = console.warn;
+  const originalInfo = console.info;
+  const originalLog = console.log;
+
+  // Suppress all console output
+  // Tests expect errors so no need to show them in the output
+  console.error = vi.fn();
+  console.warn = vi.fn();
+  console.info = vi.fn();
+  console.log = vi.fn();
+
+  // Return cleanup function to restore original console methods
+  return () => {
+    console.error = originalError;
+    console.warn = originalWarn;
+    console.info = originalInfo;
+    console.log = originalLog;
+  };
+}
+
+/* eslint-enable no-console */
diff --git a/app/timeout.ejs b/app/timeout.ejs
new file mode 100644
index 0000000..ac714bf
--- /dev/null
+++ b/app/timeout.ejs
@@ -0,0 +1,56 @@
+<!DOCTYPE html>
+<html lang="en" ng-app="<%= name %>" ng-strict-di>
+  <head>
+    <meta charset="utf-8" />
+    <title>Portainer</title>
+    <meta name="description" content="" />
+    <meta name="author" content="<%= author %>" />
+    <base id="base" />
+
+    <!-- Fav and touch icons -->
+    <link rel="apple-touch-icon" sizes="180x180" href="<%=require('./assets/ico/apple-touch-icon.png')%>" />
+    <link rel="icon" type="image/png" sizes="32x32" href="<%=require('./assets/ico/favicon-32x32.png')%>" />
+    <link rel="icon" type="image/png" sizes="16x16" href="<%=require('./assets/ico/favicon-16x16.png')%>" />
+    <link rel="mask-icon" href="<%=require('./assets/ico/safari-pinned-tab.svg')%>" color="#5bbad5" />
+    <link rel="shortcut icon" href="<%=require('./assets/ico/favicon.ico')%>" />
+    <meta name="msapplication-config" content="<%=require('./assets/ico/browserconfig.xml')%>" />
+    <meta name="theme-color" content="#ffffff" />
+  </head>
+
+  <body>
+    <div class="page-wrapper">
+      <!-- timeout info box -->
+      <div class="container simple-box">
+        <div class="col-md-8 col-md-offset-2 col-sm-10 col-sm-offset-1">
+          <!-- simple box logo -->
+          <div class="row">
+            <img ng-if="logo" ng-src="{{ logo }}" class="simple-box-logo" />
+            <img ng-if="!logo" src="<%= require('./assets/images/logo_alt.svg') %>" class="simple-box-logo" alt="Portainer" />
+          </div>
+
+          <div class="panel panel-default">
+            <div class="panel-body">
+              <div>
+                <span class="form-section-title">New Portainer installation</span>
+              </div>
+
+              <!-- init admin init timeout notification -->
+              <div class="padding-top">
+                <span class="small text-muted">
+                  Your Portainer instance timed out for security purposes. To re-enable your Portainer instance, you will need to restart Portainer.
+                </span>
+                <br /><br />
+                <span class="text-muted small">
+                  For further information, view our <a class="hyperlink" href="https://docs.portainer.io/faqs/installing/your-portainer-instance-has-timed-out-for-security-purposes-error-fix" target="_blank">documentation</a>.
+                </span>
+              </div>
+              <!-- !init admin init timeout notification -->
+            </div>
+          </div>
+        </div>
+      </div>
+
+      <!-- !timeout info box -->
+    </div>
+  </body>
+</html>
diff --git a/app/types.ts b/app/types.ts
new file mode 100644
index 0000000..f5a9318
--- /dev/null
+++ b/app/types.ts
@@ -0,0 +1,60 @@
+export interface AutomationTestingProps {
+  /**
+   * Used by cypress to identify this property.
+   *
+   * Change with care and communicate this with QA
+   */
+  'data-cy': string;
+}
+
+declare module 'react' {
+  interface HTMLAttributes<T>
+    extends AriaAttributes, DOMAttributes<T>, Partial<AutomationTestingProps> {
+    // keep AutomationTestingProps 'data-cy' optional because HTMLAttributes covers non interactive elements
+  }
+}
+
+export type WithRequiredProperties<T, K extends keyof T> = Omit<T, K> &
+  Required<Pick<T, K>>;
+
+export type ValueOf<T extends Record<string, unknown>> = T[keyof T];
+
+export function stringEnumValues<T extends Record<string, string>>(
+  e: T
+): T[keyof T][] {
+  return Object.values(e) as T[keyof T][];
+}
+/**
+ * Recursively makes all properties of a type optional, including nested objects.
+ * Unlike TypeScript's built-in Partial<T> which only affects top-level properties,
+ * DeepPartial applies the optional modifier to all levels of nested objects.
+ *
+ * @example
+ * ```ts
+ * interface Config {
+ *   name: string;
+ *   settings: {
+ *     theme: string;
+ *     options: {
+ *       darkMode: boolean;
+ *     };
+ *   };
+ * }
+ *
+ * // All properties at all levels are now optional
+ * type PartialConfig = DeepPartial<Config>;
+ * // Equivalent to:
+ * type PartialConfig = {
+ *   name?: string;
+ *   settings?: {
+ *     theme?: string;
+ *     options?: {
+ *       darkMode?: boolean;
+ *     };
+ *   };
+ * }
+ * ```
+ */
+export type DeepPartial<T> = T extends object
+  ? { [K in keyof T]?: DeepPartial<T[K]> }
+  : T;
diff --git a/app/types/deepPick.ts b/app/types/deepPick.ts
new file mode 100644
index 0000000..80c6e41
--- /dev/null
+++ b/app/types/deepPick.ts
@@ -0,0 +1,80 @@
+import { DeepRequired } from './deepRequired';
+import { Shift } from './shift';
+import { ToTuple } from './toTuple';
+import { PathToStringArray, Prettify } from './utils';
+
+/**
+ * Pick and union the types of the paths (or path-arrays).
+ *
+ * To be able to properly pick, it marks all segments of the paths required, even the last.
+ *
+ * The resulting type will never be optional
+ *
+ * @example
+ * type SubExample = {
+ *   something: number;
+ * };
+ *
+ * type Example = {
+ *   always: string;
+ *   a?: {
+ *     two?: boolean;
+ *     b?: {
+ *       c?: number;
+ *     };
+ *   };
+ *
+ *   one?: {
+ *     two?: {
+ *       three?: SubExample;
+ *       four?: number;
+ *     };
+ *   };
+ * };
+ *
+ * type DeepPickExampleArray = DeepPick<Example, ['a', 'b', 'c'] | ['one', 'two', 'three'] | ['a', 'two']>;
+ * type DeepPickExampleString = DeepPick<Example, 'a.b.c' | 'one.two.three' | 'a.two'>;
+ * type DeepPickExampleMix = DeepPick<Example, 'a.b.c' | ['one', 'two', 'three'] | 'a.two'>;
+ *
+ * // they all equal to
+ * type ResultingType =
+ *   | number // picked from 'a.b.c'
+ *   | boolean // picked from 'a.two'
+ *   | { something: number }; // picked from 'one.two.three'
+ *
+ */
+export type DeepPick<T extends object, P extends string | string[]> = Prettify<
+  P extends string
+    ? DeepPickFromString<DeepRequired<T, P>, P>
+    : P extends string[]
+      ? DeepPickFromArray<DeepRequired<T, P>, P>
+      : never
+>;
+
+/**
+ * DeepPick and transform union of paths to union of path-arrays
+ * from `'a.b.c' | 'c.d.e'` to `['a', 'b', 'c'] | ['c' | 'd' | 'e']`
+ */
+type DeepPickFromString<T extends object, P extends string> = DeepPickFromArray<
+  T,
+  PathToStringArray<P>
+>;
+
+/**
+ * Transform union of path-arrays to tuple of path-arrays
+ * from `['a', 'b', 'c'] | ['c' | 'd' | 'e']` to `[['a', 'b', 'c'], ['c' | 'd' | 'e']]`
+ */
+type DeepPickFromArray<T extends object, P extends string[]> =
+  ToTuple<P> extends string[][] ? DeepPickRec<T, ToTuple<P>> : never;
+
+// Recursively pick each path-array of tuple and union the resulting types
+type DeepPickRec<T extends object, P extends string[][]> = P[0] extends string[]
+  ? PickOne<T, P[0]> | DeepPickRec<T, Shift<P>>
+  : never;
+
+// Recursively pick each element of path-array
+type PickOne<T extends object, P extends string[]> = P[0] extends keyof T
+  ? T[P[0]] extends object
+    ? PickOne<T[P[0]], Shift<P>>
+    : T[P[0]]
+  : T;
diff --git a/app/types/deepRequired.ts b/app/types/deepRequired.ts
new file mode 100644
index 0000000..4f5e692
--- /dev/null
+++ b/app/types/deepRequired.ts
@@ -0,0 +1,68 @@
+import { ShiftUnion } from './shift';
+import { PathToStringArray, Prettify } from './utils';
+
+/**
+ * Recursively make all paths (or path-arrays) required
+ *
+ * @example
+ * type SubExample = {
+ *   something: number;
+ * };
+ *
+ * type Example = {
+ *   always: string;
+ *   a?: {
+ *     two?: boolean;
+ *     b?: {
+ *       c?: number;
+ *     };
+ *   };
+ *
+ *   one?: {
+ *     two?: {
+ *       three?: SubExample;
+ *       four?: number;
+ *     };
+ *   };
+ * };
+ *
+ * type DeepRequiredExampleArray = DeepRequired<Example, 'a.b.c' | 'one.two.three'>;
+ * type DeepRequiredExampleString = DeepRequired<Example, ['a', 'b', 'c'] | ['one', 'two', 'three']>;
+ * type DeepRequiredExampleMix = DeepRequired<Example, 'a.b.c' | ['one', 'two', 'three']>;
+ *
+ * // they all equal to
+ * type ResultingType = {
+ *   always: string;
+ *   a: { // became required
+ *     two?: boolean | undefined;
+ *     b: { // became required
+ *       c: number; // deep required
+ *     };
+ *   };
+ *   one: { // became required
+ *     two: { // became required
+ *       four?: number | undefined;
+ *       three: { // deep required
+ *         something: number;
+ *       };
+ *     };
+ *   };
+ * };
+ *
+ */
+export type DeepRequired<T, P extends string[] | string> = Prettify<
+  DeepRequiredRec<T, P extends string ? PathToStringArray<P> : P>
+>;
+
+/**
+ * Recursively require all elements of path-array
+ * The Omit part is there to make the key a hard require
+ */
+type DeepRequiredRec<T, P extends string[]> = T extends object
+  ? Omit<T, Extract<keyof T, P[0]>> &
+      Required<{
+        [K in Extract<keyof T, P[0]>]: NonNullable<
+          DeepRequiredRec<T[K], ShiftUnion<K, P>>
+        >;
+      }>
+  : T;
diff --git a/app/types/shift.ts b/app/types/shift.ts
new file mode 100644
index 0000000..ee54a51
--- /dev/null
+++ b/app/types/shift.ts
@@ -0,0 +1,27 @@
+/* eslint-disable @typescript-eslint/no-explicit-any */
+// required `any` for Distributive Conditional
+// https://www.typescriptlang.org/docs/handbook/2/conditional-types.html#distributive-conditional-types
+
+/**
+ * Remove the first element (allows to move forward path-arrays)
+ */
+export type Shift<T extends any[]> = ((...t: T) => any) extends (
+  first: any,
+  ...rest: infer Rest
+) => any
+  ? Rest
+  : never;
+
+/**
+ * Using Distributive Conditional, allows to move forward on union of path-arrays
+ *
+ * @example
+ * type Result = ShiftUnion<['a', 'b'] | ['c', 'd']> // ['b'] | ['d']
+ */
+export type ShiftUnion<P extends PropertyKey, T extends any[]> = T extends any[]
+  ? T[0] extends P
+    ? Shift<T>
+    : never
+  : never;
+
+/* eslint-enable @typescript-eslint/no-explicit-any */
diff --git a/app/types/toTuple.ts b/app/types/toTuple.ts
new file mode 100644
index 0000000..18dd140
--- /dev/null
+++ b/app/types/toTuple.ts
@@ -0,0 +1,89 @@
+/* eslint-disable @typescript-eslint/no-explicit-any */
+// required `any` for Distributive Conditional
+// https://www.typescriptlang.org/docs/handbook/2/conditional-types.html#distributive-conditional-types
+
+/**
+ * Transform a union to a tuple
+ * from 'a' | 'b' | ['c', 'd'] to `['a', 'b', ['c', 'd']]`
+ */
+export type ToTuple<Union> = ToTupleRec<Union, []>;
+
+// Recursively build a tuple from a union
+type ToTupleRec<Union, Result extends any[]> =
+  SpliceOne<Union> extends never
+    ? [ExtractOne<Union>, ...Result]
+    : ToTupleRec<SpliceOne<Union>, [ExtractOne<Union>, ...Result]>;
+
+// Remove the first element of union
+type SpliceOne<Union> = Exclude<Union, ExtractOne<Union>>;
+
+// Extract the first element of union
+type ExtractOne<Union> = ExtractParam<UnionToIntersection<UnionToParam<Union>>>;
+
+/**
+ * Extract param of function
+ *
+ * Here, used with an intersection of functions generated by UnionToIntersection to pick the first type of intersection
+ *
+ * @example
+ * type EP = ExtractParam<((k: 'a') => void) & ((k: 'b') => void)> // 'a'
+ */
+type ExtractParam<F> = F extends { (a: infer A): void } ? A : never;
+
+/**
+ * When called with a union of functions, allows to generate an intersection of the functions params types
+ *
+ * ---
+ *
+ * In our usage
+ * ```
+ * type Inter = UnionToIntersection<UnionToParam<'a' | 'b'>>;
+ * // equals
+ * type Inter = UnionToIntersection<((k: 'a') => void) | ((k: 'b') => void)>;
+ * // which expands to
+ * type Inter =
+ *   | ((k: (k: 'a') => void) => void)
+ *   | ((k: (k: 'b') => void) => void) extends (k: infer I) => void
+ *   ? I
+ *   : never;
+ * // using the contra-variant positions, an intersection is inferred. The result is then
+ * type Inter = ((k: 'a') => void) & ((k: 'b') => void);
+ * //  (infer I) of 1st Union elem & (infer I) of 2nd Union element
+ * ```
+ *
+ * ---
+ *
+ * For more details see https://www.typescriptlang.org/docs/handbook/release-notes/typescript-2-8.html#type-inference-in-conditional-types
+ *
+ * ```
+ * // The following example demonstrates how multiple candidates for the same type variable in co-variant positions causes a union type to be inferred:
+ * type Foo<T> = T extends { a: infer U; b: infer U } ? U : never;
+ * type T10 = Foo<{ a: string; b: string }>; // string
+ * type T11 = Foo<{ a: string; b: number }>; // string | number
+ *
+ * // Likewise, multiple candidates for the same type variable in contra-variant positions causes an intersection type to be inferred:
+ * type Bar<T> = T extends { a: (x: infer U) => void; b: (x: infer U) => void } ? U : never;
+ * type T20 = Bar<{ a: (x: string) => void; b: (x: string) => void }>; // string
+ * type T21 = Bar<{ a: (x: string) => void; b: (x: number) => void }>; // string & number
+ * ```
+ *
+ */
+type UnionToIntersection<U> =
+  UnionToParam<U> extends (k: infer I) => void ? I : never;
+
+/**
+ * Transform T to `(k: T) => void` (excluding never)
+ *
+ * When called with a union of functions, generates a union of functions taking a function as param
+ *
+ * @example
+ * type U = UnionToParam<'a' | 'b'>;
+ * // = ((k: "a") => void) | ((k: "b") => void)
+ *
+ * @example
+ * type U2 = UnionToParam<UnionToParam<'a' | 'b'>>;
+ * // = ((k: (k: "a") => void) => void) | ((k: (k: "b") => void) => void)
+ */
+type UnionToParam<U> = U extends any ? (k: U) => void : never;
+
+/* eslint-enable @typescript-eslint/no-explicit-any */
diff --git a/app/types/utils.ts b/app/types/utils.ts
new file mode 100644
index 0000000..e29a433
--- /dev/null
+++ b/app/types/utils.ts
@@ -0,0 +1,19 @@
+/**
+ * Transform `'a.b.c'` or `['a', 'b', 'c']` to `['a', 'b', 'c']`
+ */
+export type PathToStringArray<T extends string | string[]> = T extends string[]
+  ? T
+  : T extends `${infer Head}.${infer Tail}`
+    ? [...PathToStringArray<Head>, ...PathToStringArray<Tail>]
+    : [T];
+
+/**
+ * VSCode helper to recursively pretty print the constructed types instead of
+ * displaying the sub types.
+ *
+ * Particularly useful to see the resulting type when using `DeepRequired` and `DeepPick`.
+ * Both already use them at root.
+ */
+export type Prettify<T> = {
+  [K in keyof T]: Prettify<T[K]>;
+} & {};
diff --git a/app/vendors.js b/app/vendors.js
new file mode 100644
index 0000000..46e1dc0
--- /dev/null
+++ b/app/vendors.js
@@ -0,0 +1,15 @@
+import angular from 'angular';
+import 'angular-sanitize';
+import 'ng-file-upload'; // build-image, import-image, kubernetes configuration data, endpoint security, init admin
+import 'angular-messages'; // used for form helpers - ng-message
+import 'angular-resource'; // used for http services
+import 'angular-local-storage'; // used by localStorage service which is used every where
+import 'angular-loading-bar'; // used in app/config.js and HeaderContainer - can be removed once we're not using the $http and $resource modules
+import 'angular-clipboard'; // log-viewer, service edit, kube configmap edit, kube secret edit
+import 'angular-file-saver'; // used in host-browser, volume-browser, logViewer, images edit, kube app logs, kube stacks logs, user-activity
+import 'angularjs-scroll-glue'; // used in logViewer
+import 'angularjs-slider'; // used in services create and edit
+import 'bootstrap/dist/js/bootstrap.js';
+import 'angular-ui-bootstrap';
+
+window.angular = angular;
diff --git a/babel.config.js b/babel.config.js
new file mode 100644
index 0000000..c60d9a6
--- /dev/null
+++ b/babel.config.js
@@ -0,0 +1,36 @@
+module.exports = {
+  plugins: ['lodash', 'angularjs-annotate'],
+  presets: [
+    [
+      '@babel/preset-env',
+      {
+        useBuiltIns: 'usage',
+        corejs: '3',
+        targets: { node: 'current' },
+        modules: 'auto',
+      },
+    ],
+  ],
+  overrides: [
+    {
+      test: ['app/**/*.ts', 'app/**/*.tsx'],
+      presets: [
+        '@babel/preset-typescript',
+        [
+          '@babel/preset-react',
+          {
+            runtime: 'automatic',
+          },
+        ],
+        [
+          '@babel/preset-env',
+          {
+            modules: 'auto',
+            useBuiltIns: 'usage',
+            corejs: '3',
+          },
+        ],
+      ],
+    },
+  ],
+};
diff --git a/build/build_binary.sh b/build/build_binary.sh
new file mode 100755
index 0000000..cfa8883
--- /dev/null
+++ b/build/build_binary.sh
@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+BUILD_SOURCESDIRECTORY=${BUILD_SOURCESDIRECTORY:-$(pwd)}
+
+mkdir -p dist
+
+# populate tool versions
+
+BUILDNUMBER=${BUILDNUMBER:-"N/A"}
+CONTAINER_IMAGE_TAG=${CONTAINER_IMAGE_TAG:-"N/A"}
+NODE_VERSION=${NODE_VERSION:-$(node -v)}
+PNPM_VERSION=${PNPM_VERSION:-$(pnpm -v)}
+WEBPACK_VERSION=${WEBPACK_VERSION:-$(pnpm list webpack --depth=0 | grep webpack | awk '{print $2}')}
+GO_VERSION=${GO_VERSION:-$(go version | awk '{print $3}')}
+GIT_COMMIT_HASH=${GIT_COMMIT_HASH:-$(git rev-parse --short HEAD)}
+
+# populate dependencies versions
+DOCKER_VERSION=$(go list -m -f '{{.Version}}' github.com/docker/docker)
+COMPOSE_VERSION=$(go list -m -f '{{.Version}}' github.com/docker/compose/v2)
+# Kubernetes SDK uses v0.x.y versioning, but official kubectl releases use v1.x.y
+# We need to transform the version (e.g., v0.33.2 -> v1.33.2)
+KUBECTL_VERSION=$(go list -modfile go.mod -m -f '{{.Version}}' k8s.io/kubectl | sed 's/^v0\./v1./' | sed 's/^0\./1./')
+HELM_VERSION=$(go list -modfile go.mod -m -f '{{.Version}}' helm.sh/helm/v4)
+
+# copy templates
+cp -r "./mustache-templates" "./dist"
+
+
+cd api || exit 1
+
+# Conditionally run go get based on the SKIP_GO_GET environment variable
+# This process adds a bit of time to the build
+# This is useful in the CI/CD pipeline to ensure that all dependencies are available
+if [ "${SKIP_GO_GET:-false}" = false ]; then
+  echo "Running go get -t -v ./..."
+  go get -t -v ./...
+fi
+
+
+ldflags="-s -X 'github.com/portainer/liblicense.LicenseServerBaseURL=https://api.portainer.io' \
+-X 'github.com/portainer/portainer/pkg/build.BuildNumber=${BUILDNUMBER}' \
+-X 'github.com/portainer/portainer/pkg/build.ImageTag=${CONTAINER_IMAGE_TAG}' \
+-X 'github.com/portainer/portainer/pkg/build.NodejsVersion=${NODE_VERSION}' \
+-X 'github.com/portainer/portainer/pkg/build.PnpmVersion=${PNPM_VERSION}' \
+-X 'github.com/portainer/portainer/pkg/build.WebpackVersion=${WEBPACK_VERSION}' \
+-X 'github.com/portainer/portainer/pkg/build.GitCommit=${GIT_COMMIT_HASH}' \
+-X 'github.com/portainer/portainer/pkg/build.GoVersion=${GO_VERSION}' \
+-X 'github.com/portainer/portainer/pkg/build.DepComposeVersion=${COMPOSE_VERSION}' \
+-X 'github.com/portainer/portainer/pkg/build.DepDockerVersion=${DOCKER_VERSION}' \
+-X 'github.com/portainer/portainer/pkg/build.DepKubectlVersion=${KUBECTL_VERSION}' \
+-X 'github.com/portainer/portainer/pkg/build.DepHelmVersion=${HELM_VERSION}'"
+
+echo "$ldflags"
+
+
+# See: https://gist.github.com/asukakenji/f15ba7e588ac42795f421b48b8aede63
+# For a list of valid GOOS and GOARCH values
+PLATFORM=${1:-$(go env GOOS)}
+ARCH=${2:-$(go env GOARCH)}
+# if the default platform is darwin, set it to linux to allow it to run in the portainer/base image (which doesn't support darwin)
+if [ "$PLATFORM" = "darwin" ]; then
+  PLATFORM="linux"
+fi
+
+BINARY_NAME="portainer"
+if [ "$PLATFORM" = "windows" ]; then
+  BINARY_NAME="portainer.exe"
+fi
+
+GOOS=${PLATFORM} GOARCH=${ARCH} CGO_ENABLED=0 go build \
+	-trimpath \
+	--installsuffix cgo \
+	--ldflags "$ldflags" \
+	-o "../dist/${BINARY_NAME}" \
+	./cmd/portainer/
diff --git a/build/build_in_container.sh b/build/build_in_container.sh
new file mode 100755
index 0000000..a827bdd
--- /dev/null
+++ b/build/build_in_container.sh
@@ -0,0 +1,10 @@
+#!/usr/bin/env sh
+
+binary="portainer-$1-$2"
+
+mkdir -p dist
+
+docker run --rm -tv "$(pwd)/api:/src" -e BUILD_GOOS="$1" -e BUILD_GOARCH="$2" portainer/golang-builder:cross-platform /src/cmd/portainer
+
+mv "api/cmd/portainer/$binary" dist/
+#sha256sum "dist/$binary" > portainer-checksum.txt
diff --git a/build/docker-extension/Makefile b/build/docker-extension/Makefile
new file mode 100644
index 0000000..ceb4152
--- /dev/null
+++ b/build/docker-extension/Makefile
@@ -0,0 +1,32 @@
+# Makefile for development purpose
+
+.PHONY: local build
+local: clean build install
+remote: clean build-remote install
+
+ORG=portainer
+VERSION=0.0.0
+IMAGE_NAME=$(ORG)/portainer-docker-extension
+TAGGED_IMAGE_NAME=$(IMAGE_NAME):$(VERSION)
+
+clean:
+	-docker extension remove $(IMAGE_NAME)
+	-docker rmi $(IMAGE_NAME):$(VERSION)
+
+build:
+	docker buildx build -f build/linux/Dockerfile --load --build-arg TAG=$(VERSION) --build-arg PORTAINER_IMAGE_NAME=$(IMAGE_NAME) --tag=$(TAGGED_IMAGE_NAME) .
+
+build-remote:
+	docker buildx build -f build/linux/Dockerfile --push --builder=buildx-multi-arch --platform=windows/amd64,linux/amd64,linux/arm64 --build-arg TAG=$(VERSION) --build-arg PORTAINER_IMAGE_NAME=$(IMAGE_NAME) --tag=$(TAGGED_IMAGE_NAME) .
+
+install:
+	docker extension install $(TAGGED_IMAGE_NAME) --force
+
+dev:
+	docker extension dev debug $(IMAGE_NAME)
+
+multiarch:
+	docker buildx create --name=buildx-multi-arch --driver=docker-container --driver-opt=network=host
+
+portainer:
+	pnpm run build
diff --git a/build/docker-extension/README.md b/build/docker-extension/README.md
new file mode 100644
index 0000000..ce1402a
--- /dev/null
+++ b/build/docker-extension/README.md
@@ -0,0 +1,33 @@
+## Installing the Portainer extension
+
+### Prerequisites
+
+#### Docker desktop with extension support
+
+First you must install a version of docker desktop with extension support (4.8.0 or later)
+
+- [Windows](https://desktop.docker.com/win/main/amd64/Docker%20Desktop%20Installer.exe?utm_source=docker&utm_medium=webreferral&utm_campaign=docs-driven-download-win-amd64 'https://desktop.docker.com/win/main/amd64/Docker%20Desktop%20Installer.exe?utm_source=docker&utm_medium=webreferral&utm_campaign=docs-driven-download-win-amd64')
+- [Mac with intel chip](https://desktop.docker.com/mac/main/amd64/Docker.dmg?utm_source=docker&utm_medium=webreferral&utm_campaign=docs-driven-download-mac-amd64 'https://desktop.docker.com/mac/main/amd64/Docker.dmg?utm_source=docker&utm_medium=webreferral&utm_campaign=docs-driven-download-mac-amd64')
+- [Mac with arm chip](https://desktop.docker.com/mac/main/arm64/Docker.dmg?utm_source=docker&utm_medium=webreferral&utm_campaign=docs-driven-download-mac-arm64 'https://desktop.docker.com/mac/main/arm64/Docker.dmg?utm_source=docker&utm_medium=webreferral&utm_campaign=docs-driven-download-mac-arm64')
+- [Linux DEB](https://desktop-stage.docker.com/linux/main/amd64/78933/docker-desktop-4.8.0-amd64.deb?utm_source=docker&utm_medium=webreferral&utm_campaign=docs-driven-download-linux-amd64 'https://desktop-stage.docker.com/linux/main/amd64/78933/docker-desktop-4.8.0-amd64.deb?utm_source=docker&utm_medium=webreferral&utm_campaign=docs-driven-download-linux-amd64')
+- [Linux RPM](https://desktop-stage.docker.com/linux/main/amd64/78933/docker-desktop-4.8.0-x86_64.rpm?utm_source=docker&utm_medium=webreferral&utm_campaign=docs-driven-download-linux-amd64 'https://desktop-stage.docker.com/linux/main/amd64/78933/docker-desktop-4.8.0-x86_64.rpm?utm_source=docker&utm_medium=webreferral&utm_campaign=docs-driven-download-linux-amd64')
+
+### Docker extension CLI plugin
+
+Next you must install the CLI plugin to enable extension development. Please follow [Docker’s official documentation](https://docs.docker.com/desktop/extensions-sdk/#prerequisites) as it will be the most up to date
+
+**_Tip: make sure you have started Docker Desktop for the first time before installing the CLI extension to prevent errors._**
+
+### Build from local changes
+
+1. Run `make dev-extension` to install the project dependencies and start in development mode (note that this doesn't do live updates for frontend changes).
+2. Make your code changes
+3. Re-run `make dev-extension` to rebuild and re-install with your latest changes
+
+## Accessing the Portainer extension
+
+Going to your Docker Desktop dashboard, you should see Portainer listed in the Extension menu on the left and can access Portainer directly by clicking it.
+
+#### Improvements & suggestions
+
+If you have an idea of how to improve this process or any of the code related to it, feel free to open an issue & pull request.
diff --git a/build/docker-extension/docker-compose.yml b/build/docker-extension/docker-compose.yml
new file mode 100644
index 0000000..7845c4b
--- /dev/null
+++ b/build/docker-extension/docker-compose.yml
@@ -0,0 +1,19 @@
+version: '3'
+
+services:
+  portainer:
+    image: ${DESKTOP_PLUGIN_IMAGE}
+    command: ['--admin-password', '$$$$2y$$$$05$$$$bsb.XmF.r2DU6/9oVUaDxu3.Lxhmg1R8M0NMLK6JJKUiqUcaNjvdu']
+    restart: always
+    environment:
+      - DOCKER_EXTENSION=1
+    security_opt:
+      - no-new-privileges:true
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - portainer_data:/data
+    ports:
+      - 127.0.0.1:49000:9000
+      - 127.0.0.1:49443:9443
+volumes:
+  portainer_data:
diff --git a/build/docker-extension/metadata.json b/build/docker-extension/metadata.json
new file mode 100644
index 0000000..c1c9706
--- /dev/null
+++ b/build/docker-extension/metadata.json
@@ -0,0 +1,14 @@
+{
+  "icon": "portainer.svg",
+  "vm": {
+    "composefile": "docker-compose.yml",
+    "exposes": { "socket": "docker.sock" }
+  },
+  "ui": {
+    "dashboard-tab": {
+      "title": "Portainer",
+      "root": "/public",
+      "src": "http://localhost:49000"
+    }
+  }
+}
diff --git a/build/docker-extension/portainer.svg b/build/docker-extension/portainer.svg
new file mode 100644
index 0000000..e8c91b3
--- /dev/null
+++ b/build/docker-extension/portainer.svg
@@ -0,0 +1 @@
+<svg height="2500" viewBox=".16 0 571.71 800" width="1788" xmlns="http://www.w3.org/2000/svg"><g fill="#13bef9"><path d="m190.83 175.88h-12.2v63.2h12.2zm52.47 0h-12.2v63.2h12.2zm71.69-120.61-12.5-21.68-208.67 120.61 12.5 21.68z"/><path d="m313.77 55.27 12.51-21.68 208.67 120.61-12.51 21.68z"/><path d="m571.87 176.18v-25.03h-571.71v25.03z"/><path d="m345.5 529.77v-370.99h25.02v389.01c-6.71-7.64-15.26-13.13-25.02-18.02zm-42.71-6.41v-523.36h25.02v526.41c-7.02-3.36-24.1-3.05-25.02-3.05zm-237.04 52.21c-30.51-22.59-50.64-58.62-50.64-99.54 0-21.68 5.79-43.05 16.47-61.68h213.55c10.98 18.63 16.48 40 16.48 61.68 0 18.93-2.44 36.64-10.07 52.52-16.17-15.57-39.97-22.29-64.07-22.29-42.71 0-79.32 26.56-88.77 66.26-3.36-.31-5.49-.61-8.85-.61-8.24.3-16.17 1.53-24.1 3.66z" fill-rule="evenodd"/><path d="m170.69 267.18h-64.67v65.03h64.67zm-72.91 0h-64.67v65.03h64.67zm0 72.36h-64.67v65.04h64.67zm72.91 0h-64.67v65.04h64.67zm72.61 0h-64.67v65.04h64.67zm0-107.17h-64.67v65.03h64.67z"/><path d="m109.37 585.34c8.85-37.55 42.71-65.65 82.98-65.65 25.94 0 49.12 11.61 64.99 29.93 13.72-9.47 30.2-14.96 48.2-14.96 46.98 0 85.11 38.16 85.11 85.19 0 9.77-1.52 18.93-4.57 27.78 10.37 14.05 16.78 31.76 16.78 50.69 0 47.02-38.14 85.19-85.12 85.19-20.75 0-39.66-7.33-54.3-19.54-15.56 21.68-40.88 36.03-69.56 36.03-32.95 0-61.63-18.93-75.96-46.41-5.8 1.22-11.6 1.83-17.7 1.83-46.98 0-85.42-38.17-85.42-85.19s38.14-85.19 85.42-85.19c3.05-.31 6.1-.31 9.15.3z" fill-rule="evenodd"/></g></svg>
\ No newline at end of file
diff --git a/build/linux/Dockerfile b/build/linux/Dockerfile
new file mode 100644
index 0000000..8efc1eb
--- /dev/null
+++ b/build/linux/Dockerfile
@@ -0,0 +1,42 @@
+FROM portainer/base AS production
+
+LABEL org.opencontainers.image.title="Portainer" \
+  org.opencontainers.image.description="Docker container management made simple, with the world’s most popular GUI-based container management platform." \
+  org.opencontainers.image.vendor="Portainer.io" \
+  com.docker.desktop.extension.api.version=">= 0.2.2" \
+  com.docker.desktop.extension.icon="https://portainer-io-assets.sfo2.cdn.digitaloceanspaces.com/logos/portainer.png" \
+  com.docker.extension.screenshots="[{\"alt\": \"screenshot one\", \"url\": \"https://portainer-io-assets.sfo2.digitaloceanspaces.com/screenshots/docker-extension-1.png\"},{\"alt\": \"screenshot two\", \"url\": \"https://portainer-io-assets.sfo2.digitaloceanspaces.com/screenshots/docker-extension-2.png\"},{\"alt\": \"screenshot three\", \"url\": \"https://portainer-io-assets.sfo2.digitaloceanspaces.com/screenshots/docker-extension-3.png\"},{\"alt\": \"screenshot four\", \"url\": \"https://portainer-io-assets.sfo2.digitaloceanspaces.com/screenshots/docker-extension-4.png\"},{\"alt\": \"screenshot five\", \"url\": \"https://portainer-io-assets.sfo2.digitaloceanspaces.com/screenshots/docker-extension-5.png\"},{\"alt\": \"screenshot six\", \"url\": \"https://portainer-io-assets.sfo2.digitaloceanspaces.com/screenshots/docker-extension-6.png\"},{\"alt\": \"screenshot seven\", \"url\": \"https://portainer-io-assets.sfo2.digitaloceanspaces.com/screenshots/docker-extension-7.png\"},{\"alt\": \"screenshot eight\", \"url\": \"https://portainer-io-assets.sfo2.digitaloceanspaces.com/screenshots/docker-extension-8.png\"},{\"alt\": \"screenshot nine\", \"url\": \"https://portainer-io-assets.sfo2.digitaloceanspaces.com/screenshots/docker-extension-9.png\"}]" \
+  com.docker.extension.detailed-description="<p data-renderer-start-pos=\"226\">Portainer&rsquo;s Docker Desktop extension gives you access to all of Portainer&rsquo;s rich management functionality within your docker desktop experience.</p><h2 data-renderer-start-pos=\"374\">With Portainer you can:</h2><ul><li>See all your running containers</li><li>Easily view all of your container logs</li><li>Console into containers</li><li>Easily deploy your code into containers using a simple form</li><li>Turn your YAML into custom templates for easy reuse</li></ul><h2 data-renderer-start-pos=\"660\">About Portainer&nbsp;</h2><p data-renderer-start-pos=\"680\">Portainer is the worlds&rsquo; most popular universal container management platform with more than 650,000 active monthly users. Portainer can be used to manage Docker Standalone, Kubernetes and Docker Swarm environments through a single common interface. It includes a simple GitOps automation engine and a Kube API.&nbsp;</p><p data-renderer-start-pos=\"1006\">Portainer Business Edition is our fully supported commercial grade product for business-wide use. It includes all the functionality that businesses need to manage containers at scale. Visit <a class=\"sc-jKJlTe dPfAtb\" href=\"http://portainer.io/\" title=\"http://Portainer.io\" data-renderer-mark=\"true\">Portainer.io</a> to learn more about Portainer Business and <a class=\"sc-jKJlTe dPfAtb\" href=\"http://portainer.io/take-3?utm_campaign=DockerCon&amp;utm_source=Docker%20Desktop\" title=\"http://portainer.io/take-3?utm_campaign=DockerCon&amp;utm_source=Docker%20Desktop\" data-renderer-mark=\"true\">get 3 free nodes.</a></p>" \
+  com.docker.extension.publisher-url="https://www.portainer.io" \
+  com.docker.extension.additional-urls="[{\"title\":\"Website\",\"url\":\"https://www.portainer.io?utm_campaign=DockerCon&utm_source=DockerDesktop\"},{\"title\":\"Documentation\",\"url\":\"https://docs.portainer.io\"},{\"title\":\"Support\",\"url\":\"https://join.slack.com/t/portainer/shared_invite/zt-txh3ljab-52QHTyjCqbe5RibC2lcjKA\"}]"
+
+COPY dist/mustache-templates /mustache-templates/
+COPY dist/portainer /
+COPY dist/public /public/
+
+COPY build/docker-extension /
+
+# storybook exists only in portainerci builds
+COPY dist/storybook* /storybook/
+
+VOLUME /data
+WORKDIR /
+
+EXPOSE 9000
+EXPOSE 9443
+EXPOSE 8000
+
+ARG GIT_COMMIT=unspecified
+ARG BUILD_DATE=unspecified
+LABEL git_commit=$GIT_COMMIT \
+  org.opencontainers.image.revision=$GIT_COMMIT \
+  org.opencontainers.image.created=$BUILD_DATE \
+  org.opencontainers.image.title="Portainer CE" \
+  org.opencontainers.image.description="Portainer Community Edition server." \
+  org.opencontainers.image.vendor="Portainer.io" \
+  org.opencontainers.image.url="https://www.portainer.io" \
+  org.opencontainers.image.documentation="https://docs.portainer.io" \
+  io.portainer.server="true"
+
+ENTRYPOINT ["/portainer"]
+
diff --git a/build/linux/alpine.Dockerfile b/build/linux/alpine.Dockerfile
new file mode 100644
index 0000000..8f6bc7b
--- /dev/null
+++ b/build/linux/alpine.Dockerfile
@@ -0,0 +1,42 @@
+FROM alpine:latest AS production
+
+LABEL org.opencontainers.image.title="Portainer" \
+    org.opencontainers.image.description="Docker container management made simple, with the world’s most popular GUI-based container management platform." \
+    org.opencontainers.image.vendor="Portainer.io" \
+    com.docker.desktop.extension.api.version=">= 0.2.2" \
+    com.docker.desktop.extension.icon="https://portainer-io-assets.sfo2.cdn.digitaloceanspaces.com/logos/portainer.png" \
+    com.docker.extension.screenshots="[{\"alt\": \"screenshot one\", \"url\": \"https://portainer-io-assets.sfo2.digitaloceanspaces.com/screenshots/docker-extension-1.png\"},{\"alt\": \"screenshot two\", \"url\": \"https://portainer-io-assets.sfo2.digitaloceanspaces.com/screenshots/docker-extension-2.png\"},{\"alt\": \"screenshot three\", \"url\": \"https://portainer-io-assets.sfo2.digitaloceanspaces.com/screenshots/docker-extension-3.png\"},{\"alt\": \"screenshot four\", \"url\": \"https://portainer-io-assets.sfo2.digitaloceanspaces.com/screenshots/docker-extension-4.png\"},{\"alt\": \"screenshot five\", \"url\": \"https://portainer-io-assets.sfo2.digitaloceanspaces.com/screenshots/docker-extension-5.png\"},{\"alt\": \"screenshot six\", \"url\": \"https://portainer-io-assets.sfo2.digitaloceanspaces.com/screenshots/docker-extension-6.png\"},{\"alt\": \"screenshot seven\", \"url\": \"https://portainer-io-assets.sfo2.digitaloceanspaces.com/screenshots/docker-extension-7.png\"},{\"alt\": \"screenshot eight\", \"url\": \"https://portainer-io-assets.sfo2.digitaloceanspaces.com/screenshots/docker-extension-8.png\"},{\"alt\": \"screenshot nine\", \"url\": \"https://portainer-io-assets.sfo2.digitaloceanspaces.com/screenshots/docker-extension-9.png\"}]" \
+    com.docker.extension.detailed-description="<p data-renderer-start-pos=\"226\">Portainer&rsquo;s Docker Desktop extension gives you access to all of Portainer&rsquo;s rich management functionality within your docker desktop experience.</p><h2 data-renderer-start-pos=\"374\">With Portainer you can:</h2><ul><li>See all your running containers</li><li>Easily view all of your container logs</li><li>Console into containers</li><li>Easily deploy your code into containers using a simple form</li><li>Turn your YAML into custom templates for easy reuse</li></ul><h2 data-renderer-start-pos=\"660\">About Portainer&nbsp;</h2><p data-renderer-start-pos=\"680\">Portainer is the worlds&rsquo; most popular universal container management platform with more than 650,000 active monthly users. Portainer can be used to manage Docker Standalone, Kubernetes and Docker Swarm environments through a single common interface. It includes a simple GitOps automation engine and a Kube API.&nbsp;</p><p data-renderer-start-pos=\"1006\">Portainer Business Edition is our fully supported commercial grade product for business-wide use. It includes all the functionality that businesses need to manage containers at scale. Visit <a class=\"sc-jKJlTe dPfAtb\" href=\"http://portainer.io/\" title=\"http://Portainer.io\" data-renderer-mark=\"true\">Portainer.io</a> to learn more about Portainer Business and <a class=\"sc-jKJlTe dPfAtb\" href=\"http://portainer.io/take-3?utm_campaign=DockerCon&amp;utm_source=Docker%20Desktop\" title=\"http://portainer.io/take-3?utm_campaign=DockerCon&amp;utm_source=Docker%20Desktop\" data-renderer-mark=\"true\">get 3 free nodes.</a></p>" \
+    com.docker.extension.publisher-url="https://www.portainer.io" \
+    com.docker.extension.additional-urls="[{\"title\":\"Website\",\"url\":\"https://www.portainer.io?utm_campaign=DockerCon&utm_source=DockerDesktop\"},{\"title\":\"Documentation\",\"url\":\"https://docs.portainer.io\"},{\"title\":\"Support\",\"url\":\"https://join.slack.com/t/portainer/shared_invite/zt-txh3ljab-52QHTyjCqbe5RibC2lcjKA\"}]"
+
+COPY dist/mustache-templates /mustache-templates/
+COPY dist/portainer /
+COPY dist/public /public/
+
+COPY build/docker-extension /
+
+# storybook exists only in portainerci builds
+COPY dist/storybook* /storybook/
+
+VOLUME /data
+WORKDIR /
+
+EXPOSE 9000
+EXPOSE 9443
+EXPOSE 8000
+
+ARG GIT_COMMIT=unspecified
+ARG BUILD_DATE=unspecified
+LABEL git_commit=$GIT_COMMIT \
+  org.opencontainers.image.revision=$GIT_COMMIT \
+  org.opencontainers.image.created=$BUILD_DATE \
+  org.opencontainers.image.title="Portainer CE" \
+  org.opencontainers.image.description="Portainer Community Edition server." \
+  org.opencontainers.image.vendor="Portainer.io" \
+  org.opencontainers.image.url="https://www.portainer.io" \
+  org.opencontainers.image.documentation="https://docs.portainer.io" \
+  io.portainer.server="true"
+
+ENTRYPOINT ["/portainer"]
+
diff --git a/build/linux/dev-toolkit/run.sh b/build/linux/dev-toolkit/run.sh
new file mode 100755
index 0000000..a82785c
--- /dev/null
+++ b/build/linux/dev-toolkit/run.sh
@@ -0,0 +1,99 @@
+#!/usr/bin/env bash
+
+# Script used to init the Portainer development environment inside the dev-toolkit image
+
+### COLOR OUTPUT ###
+
+ESeq="\x1b["
+RCol="$ESeq"'0m'    # Text Reset
+
+# Regular               Bold                    Underline               High Intensity          BoldHigh Intens         Background              High Intensity Backgrounds
+Bla="$ESeq"'0;30m';     BBla="$ESeq"'1;30m';    UBla="$ESeq"'4;30m';    IBla="$ESeq"'0;90m';    BIBla="$ESeq"'1;90m';   On_Bla="$ESeq"'40m';    On_IBla="$ESeq"'0;100m';
+Red="$ESeq"'0;31m';     BRed="$ESeq"'1;31m';    URed="$ESeq"'4;31m';    IRed="$ESeq"'0;91m';    BIRed="$ESeq"'1;91m';   On_Red="$ESeq"'41m';    On_IRed="$ESeq"'0;101m';
+Gre="$ESeq"'0;32m';     BGre="$ESeq"'1;32m';    UGre="$ESeq"'4;32m';    IGre="$ESeq"'0;92m';    BIGre="$ESeq"'1;92m';   On_Gre="$ESeq"'42m';    On_IGre="$ESeq"'0;102m';
+Yel="$ESeq"'0;33m';     BYel="$ESeq"'1;33m';    UYel="$ESeq"'4;33m';    IYel="$ESeq"'0;93m';    BIYel="$ESeq"'1;93m';   On_Yel="$ESeq"'43m';    On_IYel="$ESeq"'0;103m';
+Blu="$ESeq"'0;34m';     BBlu="$ESeq"'1;34m';    UBlu="$ESeq"'4;34m';    IBlu="$ESeq"'0;94m';    BIBlu="$ESeq"'1;94m';   On_Blu="$ESeq"'44m';    On_IBlu="$ESeq"'0;104m';
+Pur="$ESeq"'0;35m';     BPur="$ESeq"'1;35m';    UPur="$ESeq"'4;35m';    IPur="$ESeq"'0;95m';    BIPur="$ESeq"'1;95m';   On_Pur="$ESeq"'45m';    On_IPur="$ESeq"'0;105m';
+Cya="$ESeq"'0;36m';     BCya="$ESeq"'1;36m';    UCya="$ESeq"'4;36m';    ICya="$ESeq"'0;96m';    BICya="$ESeq"'1;96m';   On_Cya="$ESeq"'46m';    On_ICya="$ESeq"'0;106m';
+Whi="$ESeq"'0;37m';     BWhi="$ESeq"'1;37m';    UWhi="$ESeq"'4;37m';    IWhi="$ESeq"'0;97m';    BIWhi="$ESeq"'1;97m';   On_Whi="$ESeq"'47m';    On_IWhi="$ESeq"'0;107m';
+
+printSection() {
+  echo -e "${BIYel}>>>> ${BIWhi}${1}${RCol}"
+}
+
+info() {
+  echo -e "${BIWhi}${1}${RCol}"
+}
+
+success() {
+  echo -e "${BIGre}${1}${RCol}"
+}
+
+error() {
+  echo -e "${BIRed}${1}${RCol}"
+}
+
+errorAndExit() {
+  echo -e "${BIRed}${1}${RCol}"
+  exit 1
+}
+
+### !COLOR OUTPUT ###
+
+SETUP_FILE=/setup-done
+
+display_configuration() {
+  info "Portainer dev-toolkit container configuration"
+  info "Go version"
+  /usr/local/go/bin/go version
+  info "Node version"
+  node -v
+  info "Pnpm version"
+  pnpm -v
+  info "Docker version"
+  docker version
+}
+
+main() {
+    [[ -z $PUSER ]] && errorAndExit "Unable to find PUSER environment variable. Please ensure PUSER is set before running this script."
+    [[ -z $PUID ]] && errorAndExit "Unable to find PUID environment variable. Please ensure PUID is set before running this script."
+    [[ -z $PGID ]] && errorAndExit "Unable to find PGID environment variable. Please ensure PGID is set before running this script."
+    [[ -z $DOCKERGID ]] && errorAndExit "Unable to find DOCKERGID environment variable. Please ensure DOCKERGID is set before running this script."
+
+    if [[ -f "${SETUP_FILE}" ]]; then
+        info "Portainer dev-toolkit container already configured."
+        display_configuration
+    else
+        info "Creating user group..."
+        groupadd -g $PGID $PUSER
+
+        info "Creating user..."
+        useradd -l -u $PUID -g $PUSER $PUSER
+
+        info "Setting up home..."
+        install -d -m 0755 -o $PUSER -g $PUSER /home/$PUSER
+
+        info "Configuring Docker..."
+        groupadd -g $DOCKERGID docker
+        usermod -aG docker $PUSER
+
+        info "Configuring Go..."
+        echo "PATH=\"$PATH:/usr/local/go/bin\"" > /etc/environment
+
+        info "Configuring Git..."
+        su $PUSER -c "git config --global url.git@github.com:.insteadOf https://github.com/"
+
+        info "Configuring SSH..."
+        mkdir /home/$PUSER/.ssh
+        cp /host-ssh/* /home/$PUSER/.ssh/
+        chown -R $PUSER:$PUSER /home/$PUSER/.ssh
+
+        touch "${SETUP_FILE}"
+        success "Portainer dev-toolkit container successfully configured."
+
+        display_configuration
+    fi
+}
+
+main
+su $PUSER -s "$@"
\ No newline at end of file
diff --git a/build/linux/dev-toolkit/toolkit.Dockerfile b/build/linux/dev-toolkit/toolkit.Dockerfile
new file mode 100644
index 0000000..5c64c92
--- /dev/null
+++ b/build/linux/dev-toolkit/toolkit.Dockerfile
@@ -0,0 +1,56 @@
+FROM ubuntu:20.04
+
+# Expose port for the Portainer UI and Edge server
+EXPOSE 9000
+EXPOSE 9443
+EXPOSE 8000
+
+WORKDIR /src/portainer
+
+# Set TERM as noninteractive to suppress debconf errors
+RUN echo 'debconf debconf/frontend select Noninteractive' | debconf-set-selections
+
+# Set default go version
+ARG GO_VERSION=go1.17.6.linux-amd64
+
+# Install packages
+RUN apt-get update --fix-missing && apt-get install -qq \
+	dialog \
+	apt-utils \
+	curl \
+	build-essential \
+	git \
+	wget \
+	apt-transport-https \
+	ca-certificates \
+	gnupg-agent \
+	software-properties-common
+
+# Install Docker CLI
+RUN curl -fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key add - \
+	&& add-apt-repository \
+	"deb [arch=amd64] https://download.docker.com/linux/ubuntu \
+	$(lsb_release -cs) \
+	stable" \
+	&& apt-get update \
+	&& apt-get install -y docker-ce-cli
+
+
+# Install NodeJS
+RUN curl -fsSL https://deb.nodesource.com/setup_14.x | bash - \
+	&& apt-get install -y nodejs
+
+# Install Package manager
+RUN wget -qO- https://get.pnpm.io/install.sh | ENV="$HOME/.bashrc" SHELL="$(which bash)" bash -
+
+# Install Golang
+RUN cd /tmp \
+	&& wget -q https://dl.google.com/go/${GO_VERSION}.tar.gz \
+	&& tar -xf ${GO_VERSION}.tar.gz \
+	&& mv go /usr/local
+
+# Copy run script
+COPY run.sh /
+RUN chmod +x /run.sh
+
+ENTRYPOINT ["/run.sh"]
diff --git a/build/windows/Dockerfile b/build/windows/Dockerfile
new file mode 100644
index 0000000..abcae16
--- /dev/null
+++ b/build/windows/Dockerfile
@@ -0,0 +1,34 @@
+ARG OSVERSION=ltsc2022
+ARG BUILDPLATFORM
+FROM --platform=${BUILDPLATFORM} gcr.io/k8s-staging-e2e-test-images/windows-servercore-cache:1.0-linux-amd64-${OSVERSION} AS core
+
+FROM mcr.microsoft.com/windows/nanoserver:${OSVERSION} AS production
+
+COPY --from=core /Windows/System32/netapi32.dll /Windows/System32/netapi32.dll
+
+USER ContainerAdministrator
+
+COPY dist/mustache-templates /mustache-templates/
+COPY dist/portainer.exe /
+COPY dist/public /public/
+
+# storybook exists only in portainerci builds
+COPY dist/storybook* /storybook/
+
+EXPOSE 9000
+EXPOSE 9443
+EXPOSE 8000
+
+ARG GIT_COMMIT=unspecified
+ARG BUILD_DATE=unspecified
+LABEL git_commit=$GIT_COMMIT \
+  org.opencontainers.image.revision=$GIT_COMMIT \
+  org.opencontainers.image.created=$BUILD_DATE \
+  org.opencontainers.image.title="Portainer CE" \
+  org.opencontainers.image.description="Portainer Community Edition server." \
+  org.opencontainers.image.vendor="Portainer.io" \
+  org.opencontainers.image.url="https://www.portainer.io" \
+  org.opencontainers.image.documentation="https://docs.portainer.io" \
+  io.portainer.server="true"
+
+ENTRYPOINT ["/portainer.exe"]
diff --git a/dev/run_container.sh b/dev/run_container.sh
new file mode 100755
index 0000000..221703b
--- /dev/null
+++ b/dev/run_container.sh
@@ -0,0 +1,25 @@
+#!/bin/bash
+set -euo pipefail
+
+PORTAINER_DATA=${PORTAINER_DATA:-/tmp/portainer-ce}
+PORTAINER_PROJECT=${PORTAINER_PROJECT:-$(pwd)}
+PORTAINER_FLAGS=${PORTAINER_FLAGS:-}
+
+docker rm -f portainer
+
+docker run -d \
+  -p 8000:8000 \
+  -p 9000:9000 \
+  -p 9443:9443 \
+  -v "$PORTAINER_PROJECT/dist:/app" \
+  -v "$PORTAINER_DATA:/data" \
+  -v /var/run/docker.sock:/var/run/docker.sock:z \
+  -v /var/run/docker.sock:/var/run/alternative.sock:z \
+  -v /tmp:/tmp \
+  -e CSP=false \
+  --name portainer \
+  portainer/base \
+  /app/portainer \
+  --log-level=DEBUG \
+  --no-setup-token \
+  $PORTAINER_FLAGS
diff --git a/dev/run_container_podman.sh b/dev/run_container_podman.sh
new file mode 100755
index 0000000..03e2fb2
--- /dev/null
+++ b/dev/run_container_podman.sh
@@ -0,0 +1,23 @@
+#!/bin/bash
+set -euo pipefail
+
+PORTAINER_DATA=${PORTAINER_DATA:-/tmp/portainer}
+PORTAINER_PROJECT=${PORTAINER_PROJECT:-$(pwd)}
+PORTAINER_FLAGS=${PORTAINER_FLAGS:-}
+
+sudo podman rm -f portainer
+
+# rootful podman (sudo required)
+sudo podman run -d \
+  -p 8000:8000 \
+  -p 9000:9000 \
+  -p 9443:9443 \
+  -v "$PORTAINER_PROJECT/dist:/app" \
+  -v "$PORTAINER_DATA:/data" \
+  -v /run/podman/podman.sock:/var/run/docker.sock \
+  -v /tmp:/tmp \
+  -e CSP=false \
+  --privileged \
+  --name portainer \
+  portainer/base \
+  /app/portainer $PORTAINER_FLAGS
diff --git a/distribution/portainer.service b/distribution/portainer.service
new file mode 100644
index 0000000..5577844
--- /dev/null
+++ b/distribution/portainer.service
@@ -0,0 +1,17 @@
+[Unit]
+Description=Portainer.io management ui
+After=docker.service
+Wants=docker.service
+Wants=docker-latest.service
+
+[Service]
+Type=simple
+Restart=always
+RestartSec=3
+Environment=ASSETS=/usr/share/portainer
+Environment=DBFILES=/var/lib/portainer
+EnvironmentFile=-/etc/sysconfig/%p
+ExecStart=/usr/sbin/portainer -a $ASSETS -d $DBFILES
+
+[Install]
+WantedBy=multi-user.target
diff --git a/distribution/portainer.spec b/distribution/portainer.spec
new file mode 100644
index 0000000..8d3c6c5
--- /dev/null
+++ b/distribution/portainer.spec
@@ -0,0 +1,94 @@
+Name:           portainer
+Version:        2.0.0
+Release:        0
+License:        Zlib
+Summary:        A lightweight docker management UI
+Url:            https://portainer.io
+Group:          BLAH
+Source0:        https://github.com/portainer/portainer/releases/download/%{version}/portainer-%{version}-linux-amd64.tar.gz
+Source1:        portainer.service
+BuildRoot:      %{_tmppath}/%{name}-%{version}-build
+%if 0%{?suse_version}
+BuildRequires:  help2man
+%endif
+Requires:       docker
+%{?systemd_requires}
+BuildRequires: systemd
+
+## HowTo build ## 
+# You can use spectool to fetch sources
+# spectool -g -R distribution/portainer.spec 
+# Then build with 'rpmbuild -ba distribution/portainer.spec' 
+
+
+%description
+Portainer is a lightweight management UI which allows you to easily manage
+your different Docker environments (Docker hosts or Swarm clusters).
+Portainer is meant to be as simple to deploy as it is to use.
+It consists of a single container that can run on any Docker engine
+(can be deployed as Linux container or a Windows native container).
+Portainer allows you to manage your Docker containers, images, volumes,
+networks and more ! It is compatible with the standalone Docker engine and with Docker Swarm mode.
+
+%prep
+%setup -qn portainer
+
+%build
+%if 0%{?suse_version}
+help2man -N --no-discard-stderr ./portainer  > portainer.1
+%endif
+
+%install
+# Create directory structure
+install -D -m 0755 portainer %{buildroot}%{_sbindir}/portainer
+install -d -m 0755 %{buildroot}%{_datadir}/portainer/public
+install -d -m 0755 %{buildroot}%{_localstatedir}/lib/portainer
+install -D -m 0644 %{S:1} %{buildroot}%{_unitdir}/portainer.service
+%if 0%{?suse_version}
+install -D -m 0644 portainer.1 %{buildroot}%{_mandir}/man1/portainer.1
+( cd  %{buildroot}%{_sbindir} ; ln -s service rcportainer )
+%endif
+# populate
+# don't install docker binary with package use system wide installed one
+cp -ra public/ %{buildroot}%{_datadir}/portainer/
+
+%pre
+%if 0%{?suse_version}
+%service_add_pre portainer.service
+#%%else # this does not work on rhel 7?
+#%%systemd_pre portainer.service
+true
+%endif
+
+%preun
+%if 0%{?suse_version}
+%service_del_preun portainer.service
+%else
+%systemd_preun portainer.service
+%endif
+
+%post
+%if 0%{?suse_version}
+%service_add_post portainer.service
+%else
+%systemd_post portainer.service
+%endif
+
+%postun
+%if 0%{?suse_version}
+%service_del_postun portainer.service
+%else
+%systemd_postun_with_restart portainer.service
+%endif
+
+
+%files
+%defattr(-,root,root)
+%{_sbindir}/portainer
+%{_datadir}/portainer/public
+%dir %{_localstatedir}/lib/portainer/
+%{_unitdir}/portainer.service
+%if 0%{?suse_version}
+%{_mandir}/man1/portainer.1*
+%{_sbindir}/rcportainer
+%endif
diff --git a/eslint.config.mjs b/eslint.config.mjs
new file mode 100644
index 0000000..cbf496a
--- /dev/null
+++ b/eslint.config.mjs
@@ -0,0 +1,311 @@
+import { defineConfig, globalIgnores } from 'eslint/config';
+import js from '@eslint/js';
+import tseslint from 'typescript-eslint';
+import pluginReact from 'eslint-plugin-react';
+import pluginReactHooks from 'eslint-plugin-react-hooks';
+import pluginPromise from 'eslint-plugin-promise';
+import pluginJsxA11y from 'eslint-plugin-jsx-a11y';
+import pluginImport from 'eslint-plugin-import';
+import pluginRegex from 'eslint-plugin-regex';
+import pluginVitest from '@vitest/eslint-plugin';
+import pluginStorybook from 'eslint-plugin-storybook';
+import pluginComments from '@eslint-community/eslint-plugin-eslint-comments';
+import globals from 'globals';
+import prettier from 'eslint-config-prettier';
+
+export default defineConfig([
+  globalIgnores(['**/node_modules/', '**/dist/', '**/test/', '.storybook/public/', 'coverage', 'app/react/portainer/generated-api/']),
+
+  js.configs.recommended,
+
+  {
+    plugins: { '@eslint-community/eslint-comments': pluginComments },
+    rules: pluginComments.configs.recommended.rules,
+  },
+
+  ...pluginStorybook.configs['flat/recommended'],
+
+  {
+    languageOptions: {
+      globals: {
+        ...globals.browser,
+        ...globals.jquery,
+        ...globals.node,
+        angular: 'readonly',
+      },
+      ecmaVersion: 'latest',
+      sourceType: 'module',
+    },
+    rules: {
+      'no-console': 'error',
+      'no-alert': 'error',
+      'no-control-regex': 'error',
+      'no-empty': 'warn',
+      'no-empty-function': 'warn',
+      'no-useless-escape': 'off',
+      // TODO: this is off for Angular code, on for React
+      'no-useless-assignment': 'off',
+      // Preserve ESLint 8 default: catch-block error variables are not checked
+      'no-unused-vars': ['error', { caughtErrors: 'none' }],
+    },
+  },
+
+  {
+    files: ['app/**/*.ts', 'app/**/*.tsx'],
+
+    extends: [
+      ...tseslint.configs.recommended,
+
+      pluginReact.configs.flat.recommended,
+      pluginReact.configs.flat['jsx-runtime'],
+
+      pluginReactHooks.configs.flat['recommended-latest'],
+
+      pluginJsxA11y.flatConfigs.recommended,
+
+      pluginImport.flatConfigs.typescript,
+
+      // @ts-expect-error - pluginPromise don't have types so it errors
+      pluginPromise.configs['flat/recommended'],
+    ],
+
+    plugins: {
+      regex: pluginRegex,
+    },
+
+    languageOptions: {
+      ecmaVersion: 'latest',
+      sourceType: 'module',
+      parserOptions: {
+        project: './tsconfig.json',
+      },
+    },
+
+    settings: {
+      react: { version: 'detect' },
+      'import/resolver': {
+        alias: {
+          map: [
+            ['@@', './app/react/components'],
+            ['@', './app'],
+          ],
+          extensions: ['.js', '.ts', '.tsx'],
+        },
+        typescript: true,
+        node: true,
+      },
+    },
+
+    rules: {
+      'no-console': 'error',
+      'no-use-before-define': 'off',
+      'no-shadow': 'off',
+      'no-plusplus': 'off',
+      'no-underscore-dangle': 'off',
+      'no-await-in-loop': 'off',
+      'no-useless-assignment': 'error',
+      'consistent-return': 'off',
+      'default-case': 'off', // covered by @typescript-eslint/switch-exhaustiveness-check
+      'func-style': ['error', 'declaration'],
+      'no-continue': 'error',
+      'no-template-curly-in-string': 'warn',
+      // Allow named function expressions where `this` binding is needed (e.g. Yup .test())
+      'prefer-arrow-callback': ['error', { allowNamedFunctions: true }],
+      'func-names': 'warn',
+      'no-param-reassign': [
+        'error',
+        {
+          props: true,
+          ignorePropertyModificationsFor: ['acc', 'accumulator'],
+        },
+      ],
+      'no-restricted-exports': ['error', { restrictedNamedExports: ['default', 'then'] }],
+      // Secure-context-only APIs (unavailable over HTTP — Portainer is commonly deployed without TLS).
+      // Each entry names the safe alternative. The approved implementations (e.g. useCopy) carry an
+      // eslint-disable comment so this list stays the single source of truth.
+      //
+      // To check whether a new API requires a secure context, fetch its MDN page and look for
+      // "Secure context" in the response:
+      //   https://developer.mozilla.org/en-US/docs/Web/API/{Interface}/{method}
+      // See docs/guidelines/frontend-conventions.md § "Secure-context APIs" for the full policy.
+      'no-restricted-properties': [
+        'error',
+        {
+          object: 'crypto',
+          property: 'randomUUID',
+          message: "crypto.randomUUID() requires a secure context (HTTPS). Use `import { v4 as uuidv4 } from 'uuid'` instead.",
+        },
+        {
+          object: 'crypto',
+          property: 'subtle',
+          message: 'crypto.subtle requires a secure context (HTTPS). Use a server-side cryptographic alternative.',
+        },
+        {
+          object: 'navigator',
+          property: 'clipboard',
+          message:
+            'navigator.clipboard requires a secure context (HTTPS). Use the `useCopy` hook or `CopyButton` component (@@/buttons/CopyButton) — they include a non-secure fallback.',
+        },
+        {
+          object: 'navigator',
+          property: 'mediaDevices',
+          message: 'navigator.mediaDevices requires a secure context (HTTPS) and will not work in all Portainer deployment contexts.',
+        },
+        {
+          object: 'navigator',
+          property: 'credentials',
+          message: 'navigator.credentials requires a secure context (HTTPS) and will not work in all Portainer deployment contexts.',
+        },
+        {
+          object: 'navigator',
+          property: 'serviceWorker',
+          message: 'navigator.serviceWorker requires a secure context (HTTPS) and will not work in all Portainer deployment contexts.',
+        },
+      ],
+
+      '@typescript-eslint/no-use-before-define': ['error', { functions: false, allowNamedExports: true }],
+      '@typescript-eslint/no-shadow': 'off',
+      '@typescript-eslint/explicit-module-boundary-types': 'off',
+      // TODO: fix violations and promote to 'error'
+      '@typescript-eslint/no-unused-vars': 'warn',
+      '@typescript-eslint/no-explicit-any': 'error',
+      // TODO: fix violations and promote to 'error'
+      '@typescript-eslint/switch-exhaustiveness-check': 'warn',
+      '@typescript-eslint/no-restricted-imports': [
+        'error',
+        {
+          patterns: [
+            {
+              group: ['@/react/test-utils/*'],
+              message: 'These utils are just for test files',
+            },
+          ],
+        },
+      ],
+
+      'import/first': 'error',
+      'import/newline-after-import': 'error',
+      'import/prefer-default-export': 'off',
+      'import/no-extraneous-dependencies': ['error', { devDependencies: true }],
+      'import/order': [
+        'error',
+        {
+          pathGroups: [
+            { pattern: '@api/**', group: 'internal', position: 'before' },
+            { pattern: '@@/**', group: 'internal', position: 'after' },
+            { pattern: '@/**', group: 'internal' },
+          ],
+          groups: ['builtin', 'external', 'internal', 'parent', 'sibling', 'index'],
+          'newlines-between': 'always',
+        },
+      ],
+
+      'react/no-unused-prop-types': 'error',
+      'react/button-has-type': 'error',
+      'react/forbid-prop-types': 'off',
+      'react/require-default-props': 'off',
+      'react/jsx-filename-extension': 'off',
+      'react/jsx-no-bind': 'off',
+      'react/jsx-no-useless-fragment': ['error', { allowExpressions: true }],
+      'react/function-component-definition': ['error', { namedComponents: 'function-declaration' }],
+      // Enabled explicitly (was brought in by airbnb, turned off in HOC/test/story files below)
+      'react/jsx-props-no-spreading': 'error',
+      'react/destructuring-assignment': ['error', 'always'],
+      // dangerouslySetInnerHTML is allowed when the value is sanitized — add a targeted
+      // suppress with a comment explaining the sanitization at each call site
+      'react/no-danger': 'error',
+
+      // TODO: fix the underlying violations and promote these to 'error'
+      'react-hooks/refs': 'warn',
+      'react-hooks/set-state-in-effect': 'warn',
+      'react-hooks/immutability': 'warn',
+      'react-hooks/static-components': 'warn',
+      'react-hooks/purity': 'warn',
+      'react-hooks/globals': 'warn',
+      'react-hooks/preserve-manual-memoization': 'warn',
+
+      'jsx-a11y/no-autofocus': 'warn',
+      'jsx-a11y/label-has-associated-control': ['error', { assert: 'either', controlComponents: ['Input', 'Checkbox'] }],
+      'jsx-a11y/control-has-associated-label': 'off',
+
+      'regex/invalid': [
+        'error',
+        [
+          {
+            regex: '<Icon icon="(.*)"',
+            message: 'Please directly import the `lucide-react` icon instead of using the string',
+          },
+        ],
+      ],
+    },
+  },
+
+  {
+    files: ['app/**/with*.ts', 'app/**/with*.tsx'],
+    rules: {
+      'react/jsx-props-no-spreading': 'off',
+      'react/destructuring-assignment': 'off',
+    },
+  },
+
+  {
+    files: ['app/**/*.test.*'],
+    plugins: { vitest: pluginVitest },
+    languageOptions: {
+      // configs.env provides describe/it/expect globals
+      globals: pluginVitest.configs.env.languageOptions.globals,
+    },
+    rules: {
+      // configs.recommended provides the rule set
+      ...pluginVitest.configs.recommended.rules,
+      'react/jsx-no-constructed-context-values': 'off',
+      'react/display-name': 'off',
+      '@typescript-eslint/no-restricted-imports': 'off',
+      'no-restricted-imports': 'off',
+      'react/jsx-props-no-spreading': 'off',
+      'vitest/no-conditional-expect': 'warn',
+      'max-classes-per-file': 'off',
+      'no-empty-function': 'off',
+      // Tests mock secure-context APIs directly — the restriction is for production code only
+      'no-restricted-properties': 'off',
+      'vitest/expect-expect': ['warn', { assertFunctionNames: ['expect*', 'assert*', 'verify*'] }],
+    },
+  },
+
+  {
+    files: ['app/**/*.stories.*'],
+    rules: {
+      'no-alert': 'off',
+      '@typescript-eslint/no-restricted-imports': 'off',
+      'no-restricted-imports': 'off',
+      'react/jsx-props-no-spreading': 'off',
+      // Storybook templates use arrow functions / expressions by convention
+      'func-style': 'off',
+      'react/function-component-definition': 'off',
+      'storybook/no-renderer-packages': 'off',
+      // Stories use empty no-op callbacks as placeholder handlers by convention
+      'no-empty-function': 'off',
+    },
+  },
+
+  {
+    files: ['app/__mocks__/**'],
+    rules: {
+      // Module mocks are intentionally empty stubs
+      'no-empty-function': 'off',
+    },
+  },
+
+  {
+    files: ['.storybook/**/*.ts', '.storybook/**/*.tsx'],
+    languageOptions: {
+      parser: tseslint.parser,
+    },
+    rules: {
+      'no-console': 'off',
+    },
+  },
+
+  //  Prettier (must be last)
+  prettier,
+]);
diff --git a/go.mod b/go.mod
new file mode 100644
index 0000000..5d22fe6
--- /dev/null
+++ b/go.mod
@@ -0,0 +1,377 @@
+module github.com/portainer/portainer
+
+go 1.26.4
+
+replace github.com/robfig/cron/v3 => github.com/robfig/cron/v3 v3.0.1 // Not actively maintained. Pinned to last known good version. Review needed when upgrading.
+
+require (
+	github.com/Masterminds/semver/v3 v3.4.0
+	github.com/Microsoft/go-winio v0.6.2
+	github.com/RoaringBitmap/roaring/v2 v2.5.0
+	github.com/VictoriaMetrics/fastcache v1.12.0
+	github.com/alecthomas/kingpin/v2 v2.4.0
+	github.com/aws/aws-sdk-go-v2 v1.41.4
+	github.com/aws/aws-sdk-go-v2/credentials v1.19.12
+	github.com/aws/aws-sdk-go-v2/service/ecr v1.24.1
+	github.com/aws/smithy-go v1.24.2
+	github.com/cbroglie/mustache v1.4.0
+	github.com/compose-spec/compose-go/v2 v2.9.1
+	github.com/containerd/containerd v1.7.32
+	github.com/containerd/errdefs v1.0.0
+	github.com/dchest/uniuri v0.0.0-20200228104902-7aecb25e1fe5
+	github.com/distribution/reference v0.6.0
+	github.com/docker/cli v28.5.1+incompatible
+	github.com/docker/compose/v2 v2.40.3
+	github.com/docker/docker v28.5.2+incompatible
+	github.com/fvbommel/sortorder v1.1.0
+	github.com/g07cha/defender v0.0.0-20180505193036-5665c627c814
+	github.com/go-git/go-billy/v5 v5.9.0
+	github.com/go-git/go-git/v5 v5.19.1
+	github.com/go-ldap/ldap/v3 v3.4.13
+	github.com/golang-jwt/jwt/v5 v5.3.1
+	github.com/google/go-cmp v0.7.0
+	github.com/google/uuid v1.6.0
+	github.com/gorilla/mux v1.8.1
+	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674
+	github.com/hashicorp/golang-lru v0.6.0
+	github.com/joho/godotenv v1.5.1
+	github.com/jpillora/chisel v1.11.6
+	github.com/klauspost/compress v1.18.5
+	github.com/koding/websocketproxy v0.0.0-20181220232114-7ed82d81a28c
+	github.com/kubernetes/kompose v1.37.0
+	github.com/opencontainers/go-digest v1.0.0
+	github.com/opencontainers/image-spec v1.1.1
+	github.com/orcaman/concurrent-map v1.0.0
+	github.com/patrickmn/go-cache v2.1.0+incompatible
+	github.com/pkg/errors v0.9.1
+	github.com/prometheus/client_golang v1.23.2
+	github.com/prometheus/client_model v0.6.2
+	github.com/prometheus/common v0.67.5
+	github.com/prometheus/prometheus v0.311.3
+	github.com/quasilyte/go-ruleguard/dsl v0.3.23
+	github.com/robfig/cron/v3 v3.0.1
+	github.com/rs/zerolog v1.34.0
+	github.com/samber/slog-zerolog/v2 v2.9.1
+	github.com/segmentio/encoding v0.5.3
+	github.com/sirupsen/logrus v1.9.4
+	github.com/stretchr/testify v1.11.1
+	github.com/viney-shih/go-lock v1.1.1
+	go.etcd.io/bbolt v1.5.0
+	go.podman.io/image/v5 v5.37.0
+	go.yaml.in/yaml/v3 v3.0.4
+	golang.org/x/crypto v0.54.0
+	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f
+	golang.org/x/mod v0.37.0
+	golang.org/x/oauth2 v0.36.0
+	golang.org/x/sync v0.22.0
+	helm.sh/helm/v4 v4.1.4
+	k8s.io/api v0.35.3
+	k8s.io/apimachinery v0.35.3
+	k8s.io/cli-runtime v0.35.1
+	k8s.io/client-go v0.35.3
+	k8s.io/kubectl v0.35.1
+	k8s.io/metrics v0.35.1
+	oras.land/oras-go/v2 v2.6.0
+	sigs.k8s.io/gateway-api v1.5.1
+)
+
+require (
+	github.com/docker/cli-docs-tool v0.10.0 // indirect
+	github.com/docker/go v1.5.1-1.0.20160303222718-d30aec9fd63c // indirect
+	github.com/miekg/pkcs11 v1.1.1 // indirect
+	github.com/theupdateframework/notary v0.7.0 // indirect
+)
+
+require (
+	cloud.google.com/go/auth v0.18.2 // indirect
+	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
+	cloud.google.com/go/compute/metadata v0.9.0 // indirect
+	dario.cat/mergo v1.0.2 // indirect
+	github.com/AlecAivazis/survey/v2 v2.3.7 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect
+	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
+	github.com/Azure/go-ntlmssp v0.1.1 // indirect
+	github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 // indirect
+	github.com/BurntSushi/toml v1.6.0 // indirect
+	github.com/DefangLabs/secret-detector v0.0.0-20250403165618-22662109213e // indirect
+	github.com/MakeNowJust/heredoc v1.0.0 // indirect
+	github.com/Masterminds/goutils v1.1.1 // indirect
+	github.com/Masterminds/sprig/v3 v3.3.0 // indirect
+	github.com/Masterminds/squirrel v1.5.4 // indirect
+	github.com/ProtonMail/go-crypto v1.3.0 // indirect
+	github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d // indirect
+	github.com/alecthomas/units v0.0.0-20240927000941-0f3dac36c52b // indirect
+	github.com/andrew-d/go-termutil v0.0.0-20150726205930-009166a695a2 // indirect
+	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
+	github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 // indirect
+	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.32.12 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.20 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.20 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.20 // indirect
+	github.com/aws/aws-sdk-go-v2/service/signin v1.0.8 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.30.13 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.41.9 // indirect
+	github.com/bboreham/go-loser v0.0.0-20230920113527-fcc2c21820a3 // indirect
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/bits-and-blooms/bitset v1.13.0 // indirect
+	github.com/blang/semver/v4 v4.0.0 // indirect
+	github.com/buger/goterm v1.0.4 // indirect
+	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/chai2010/gettext-go v1.0.2 // indirect
+	github.com/cloudflare/circl v1.6.3 // indirect
+	github.com/containerd/console v1.0.5 // indirect
+	github.com/containerd/containerd/api v1.10.0 // indirect
+	github.com/containerd/containerd/v2 v2.2.4 // indirect
+	github.com/containerd/continuity v0.4.5 // indirect
+	github.com/containerd/errdefs/pkg v0.3.0 // indirect
+	github.com/containerd/log v0.1.0 // indirect
+	github.com/containerd/platforms v1.0.0-rc.2 // indirect
+	github.com/containerd/ttrpc v1.2.7 // indirect
+	github.com/containerd/typeurl/v2 v2.2.3 // indirect
+	github.com/containers/libtrust v0.0.0-20230121012942-c1716e8a8d01 // indirect
+	github.com/containers/ocicrypt v1.2.1 // indirect
+	github.com/cyphar/filepath-securejoin v0.6.1 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/deckarep/golang-set v1.8.0 // indirect
+	github.com/dennwc/varint v1.0.0 // indirect
+	github.com/docker/buildx v0.29.1 // indirect
+	github.com/docker/distribution v2.8.3+incompatible // indirect
+	github.com/docker/docker-credential-helpers v0.9.3 // indirect
+	github.com/docker/go-connections v0.6.0 // indirect
+	github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect
+	github.com/docker/go-metrics v0.0.1 // indirect
+	github.com/docker/go-units v0.5.0 // indirect
+	github.com/dylibso/observe-sdk/go v0.0.0-20240819160327-2d926c5d788a // indirect
+	github.com/edsrzf/mmap-go v1.2.0 // indirect
+	github.com/eiannone/keyboard v0.0.0-20220611211555-0d226195f203 // indirect
+	github.com/emicklei/go-restful/v3 v3.13.0 // indirect
+	github.com/emirpasic/gods v1.18.1 // indirect
+	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
+	github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f // indirect
+	github.com/extism/go-sdk v1.7.1 // indirect
+	github.com/facette/natsort v0.0.0-20181210072756-2cd4dd1e2dcb // indirect
+	github.com/fatih/camelcase v1.0.0 // indirect
+	github.com/fatih/color v1.18.0 // indirect
+	github.com/fatih/structs v1.1.0 // indirect
+	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/fluxcd/cli-utils v0.37.2-flux.1 // indirect
+	github.com/fsnotify/fsevents v0.2.0 // indirect
+	github.com/fsnotify/fsnotify v1.9.0 // indirect
+	github.com/fsouza/go-dockerclient v1.12.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
+	github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 // indirect
+	github.com/go-errors/errors v1.5.1 // indirect
+	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
+	github.com/go-gorp/gorp/v3 v3.1.0 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/go-openapi/analysis v0.24.2 // indirect
+	github.com/go-openapi/errors v0.22.7 // indirect
+	github.com/go-openapi/jsonpointer v0.22.5 // indirect
+	github.com/go-openapi/jsonreference v0.21.4 // indirect
+	github.com/go-openapi/loads v0.23.2 // indirect
+	github.com/go-openapi/spec v0.22.3 // indirect
+	github.com/go-openapi/strfmt v0.26.1 // indirect
+	github.com/go-openapi/swag v0.25.5 // indirect
+	github.com/go-openapi/swag/cmdutils v0.25.5 // indirect
+	github.com/go-openapi/swag/conv v0.25.5 // indirect
+	github.com/go-openapi/swag/fileutils v0.25.5 // indirect
+	github.com/go-openapi/swag/jsonname v0.25.5 // indirect
+	github.com/go-openapi/swag/jsonutils v0.25.5 // indirect
+	github.com/go-openapi/swag/loading v0.25.5 // indirect
+	github.com/go-openapi/swag/mangling v0.25.5 // indirect
+	github.com/go-openapi/swag/netutils v0.25.5 // indirect
+	github.com/go-openapi/swag/stringutils v0.25.5 // indirect
+	github.com/go-openapi/swag/typeutils v0.25.5 // indirect
+	github.com/go-openapi/swag/yamlutils v0.25.5 // indirect
+	github.com/go-openapi/validate v0.25.1 // indirect
+	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
+	github.com/gobwas/glob v0.2.3 // indirect
+	github.com/gofrs/flock v0.13.0 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
+	github.com/golang/protobuf v1.5.4 // indirect
+	github.com/golang/snappy v1.0.0 // indirect
+	github.com/google/btree v1.1.3 // indirect
+	github.com/google/gnostic-models v0.7.0 // indirect
+	github.com/google/s2a-go v0.1.9 // indirect
+	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.14 // indirect
+	github.com/googleapis/gax-go/v2 v2.18.0 // indirect
+	github.com/gosuri/uitable v0.0.4 // indirect
+	github.com/grafana/regexp v0.0.0-20250905093917-f7b3be9d1853 // indirect
+	github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
+	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
+	github.com/hashicorp/go-multierror v1.1.1 // indirect
+	github.com/hashicorp/go-version v1.8.0 // indirect
+	github.com/huandu/xstrings v1.5.0 // indirect
+	github.com/ianlancetaylor/demangle v0.0.0-20240805132620-81f5be970eca // indirect
+	github.com/in-toto/attestation v1.1.2 // indirect
+	github.com/in-toto/in-toto-golang v0.11.0 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/inhies/go-bytesize v0.0.0-20220417184213-4913239db9cf // indirect
+	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
+	github.com/jmespath/go-jmespath v0.4.0 // indirect
+	github.com/jmoiron/sqlx v1.4.0 // indirect
+	github.com/jonboulle/clockwork v0.5.0 // indirect
+	github.com/jpillora/ansi v1.0.3 // indirect
+	github.com/jpillora/backoff v1.0.0 // indirect
+	github.com/jpillora/requestlog v1.0.0 // indirect
+	github.com/jpillora/sizestr v1.0.0 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
+	github.com/kevinburke/ssh_config v1.2.0 // indirect
+	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
+	github.com/kylelemons/godebug v1.1.0 // indirect
+	github.com/lann/builder v0.0.0-20180802200727-47ae307949d0 // indirect
+	github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0 // indirect
+	github.com/lib/pq v1.10.9 // indirect
+	github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect
+	github.com/lithammer/dedent v1.1.0 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-runewidth v0.0.16 // indirect
+	github.com/mattn/go-shellwords v1.0.12 // indirect
+	github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b // indirect
+	github.com/mitchellh/copystructure v1.2.0 // indirect
+	github.com/mitchellh/go-ps v1.0.0 // indirect
+	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
+	github.com/mitchellh/hashstructure/v2 v2.0.2 // indirect
+	github.com/mitchellh/reflectwalk v1.0.2 // indirect
+	github.com/moby/buildkit v0.25.1 // indirect
+	github.com/moby/docker-image-spec v1.3.1 // indirect
+	github.com/moby/go-archive v0.1.0 // indirect
+	github.com/moby/locker v1.0.1 // indirect
+	github.com/moby/patternmatcher v0.6.0 // indirect
+	github.com/moby/spdystream v0.5.1 // indirect
+	github.com/moby/swarmkit/v2 v2.1.1 // indirect
+	github.com/moby/sys/atomicwriter v0.1.0 // indirect
+	github.com/moby/sys/capability v0.4.0 // indirect
+	github.com/moby/sys/mountinfo v0.7.2 // indirect
+	github.com/moby/sys/sequential v0.6.0 // indirect
+	github.com/moby/sys/signal v0.7.1 // indirect
+	github.com/moby/sys/symlink v0.3.0 // indirect
+	github.com/moby/sys/user v0.4.0 // indirect
+	github.com/moby/sys/userns v0.1.0 // indirect
+	github.com/moby/term v0.5.2 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
+	github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
+	github.com/morikuni/aec v1.1.0 // indirect
+	github.com/mschoch/smat v0.2.0 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f // indirect
+	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
+	github.com/novln/docker-parser v1.0.0 // indirect
+	github.com/oklog/ulid/v2 v2.1.1 // indirect
+	github.com/opencontainers/runtime-spec v1.3.0 // indirect
+	github.com/openshift/api v3.9.0+incompatible // indirect
+	github.com/pelletier/go-toml v1.9.5 // indirect
+	github.com/peterbourgon/diskv v2.0.1+incompatible // indirect
+	github.com/pjbgf/sha1cd v0.6.0 // indirect
+	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
+	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/prometheus/alertmanager v0.31.1 // indirect
+	github.com/prometheus/client_golang/exp v0.0.0-20260325093428-d8591d0db856 // indirect
+	github.com/prometheus/otlptranslator v1.0.0 // indirect
+	github.com/prometheus/procfs v0.19.2 // indirect
+	github.com/prometheus/sigv4 v0.4.1 // indirect
+	github.com/rivo/uniseg v0.4.7 // indirect
+	github.com/rubenv/sql-migrate v1.8.1 // indirect
+	github.com/russross/blackfriday/v2 v2.1.0 // indirect
+	github.com/samber/lo v1.52.0 // indirect
+	github.com/samber/slog-common v0.20.0 // indirect
+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect
+	github.com/secure-systems-lab/go-securesystemslib v0.10.0 // indirect
+	github.com/segmentio/asm v1.1.3 // indirect
+	github.com/sergi/go-diff v1.4.0 // indirect
+	github.com/serialx/hashring v0.0.0-20200727003509-22c0c7ab6b1b // indirect
+	github.com/shibumi/go-pathspec v1.3.0 // indirect
+	github.com/shopspring/decimal v1.4.0 // indirect
+	github.com/skeema/knownhosts v1.3.1 // indirect
+	github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 // indirect
+	github.com/spf13/cast v1.9.2 // indirect
+	github.com/spf13/cobra v1.10.2 // indirect
+	github.com/spf13/pflag v1.0.10 // indirect
+	github.com/stretchr/objx v0.5.2 // indirect
+	github.com/tetratelabs/wabin v0.0.0-20230304001439-f6f874872834 // indirect
+	github.com/tetratelabs/wazero v1.11.0 // indirect
+	github.com/tilt-dev/fsnotify v1.4.8-0.20220602155310-fff9c274a375 // indirect
+	github.com/tomasen/realip v0.0.0-20180522021738-f0c99a92ddce // indirect
+	github.com/tonistiigi/dchapes-mode v0.0.0-20250318174251-73d941a28323 // indirect
+	github.com/tonistiigi/fsutil v0.0.0-20250605211040-586307ad452f // indirect
+	github.com/tonistiigi/go-csvvalue v0.0.0-20240814133006-030d3b2625d0 // indirect
+	github.com/tonistiigi/units v0.0.0-20180711220420-6950e57a87ea // indirect
+	github.com/tonistiigi/vt100 v0.0.0-20240514184818-90bafcd6abab // indirect
+	github.com/x448/float16 v0.8.4 // indirect
+	github.com/xanzy/ssh-agent v0.3.3 // indirect
+	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
+	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
+	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
+	github.com/xhit/go-str2duration/v2 v2.1.0 // indirect
+	github.com/xlab/treeprint v1.2.0 // indirect
+	github.com/zclconf/go-cty v1.17.0 // indirect
+	go.etcd.io/etcd/raft/v3 v3.5.6 // indirect
+	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.68.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 // indirect
+	go.opentelemetry.io/otel v1.43.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.43.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 // indirect
+	go.opentelemetry.io/otel/metric v1.43.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.43.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.43.0 // indirect
+	go.opentelemetry.io/otel/trace v1.43.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.10.0 // indirect
+	go.podman.io/storage v1.60.0 // indirect
+	go.uber.org/atomic v1.11.0 // indirect
+	go.uber.org/goleak v1.3.0 // indirect
+	go.uber.org/mock v0.6.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.4 // indirect
+	golang.org/x/net v0.56.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/term v0.45.0 // indirect
+	golang.org/x/text v0.40.0 // indirect
+	golang.org/x/time v0.15.0 // indirect
+	golang.org/x/tools/godoc v0.1.0-deprecated // indirect
+	google.golang.org/api v0.272.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d // indirect
+	google.golang.org/grpc v1.80.0 // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
+	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
+	gopkg.in/inf.v0 v0.9.1 // indirect
+	gopkg.in/ini.v1 v1.67.1 // indirect
+	gopkg.in/warnings.v0 v0.1.2 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+	k8s.io/apiextensions-apiserver v0.35.1 // indirect
+	k8s.io/apiserver v0.35.1 // indirect
+	k8s.io/component-base v0.35.1 // indirect
+	k8s.io/component-helpers v0.35.1 // indirect
+	k8s.io/klog/v2 v2.140.0 // indirect
+	k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 // indirect
+	k8s.io/utils v0.0.0-20260108192941-914a6e750570 // indirect
+	sigs.k8s.io/controller-runtime v0.23.1 // indirect
+	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
+	sigs.k8s.io/kustomize/api v0.21.1 // indirect
+	sigs.k8s.io/kustomize/kyaml v0.21.1 // indirect
+	sigs.k8s.io/randfill v1.0.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.2 // indirect
+	sigs.k8s.io/yaml v1.6.0 // indirect
+	tags.cncf.io/container-device-interface v1.1.0 // indirect
+)
diff --git a/go.sum b/go.sum
new file mode 100644
index 0000000..d719dd7
--- /dev/null
+++ b/go.sum
@@ -0,0 +1,1292 @@
+cloud.google.com/go/auth v0.18.2 h1:+Nbt5Ev0xEqxlNjd6c+yYUeosQ5TtEUaNcN/3FozlaM=
+cloud.google.com/go/auth v0.18.2/go.mod h1:xD+oY7gcahcu7G2SG2DsBerfFxgPAJz17zz2joOFF3M=
+cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
+cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
+cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=
+cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10=
+cyphar.com/go-pathrs v0.2.1 h1:9nx1vOgwVvX1mNBWDu93+vaceedpbsDqo+XuBGL40b8=
+cyphar.com/go-pathrs v0.2.1/go.mod h1:y8f1EMG7r+hCuFf/rXsKqMJrJAUoADZGNh5/vZPKcGc=
+dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
+dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
+filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
+filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
+github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 h1:He8afgbRMd7mFxO99hRNu+6tazq8nFF9lIwo9JFroBk=
+github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8=
+github.com/AlecAivazis/survey/v2 v2.3.7 h1:6I/u8FvytdGsgonrYsVn2t8t4QiRnh6QSTqkkhIiSjQ=
+github.com/AlecAivazis/survey/v2 v2.3.7/go.mod h1:xUTIdE4KCOIjsBAE1JYsUPoCqYdZ1reCfTwbto0Fduo=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0 h1:fou+2+WFTib47nS+nz/ozhEBnvU96bKHy6LjRsY4E28=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0/go.mod h1:t76Ruy8AHvUAC8GfMWJMa0ElSbuIcO03NLpynfbgsPA=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 h1:Hk5QBxZQC1jb2Fwj6mpzme37xbCDdNTxU7O9eb5+LB4=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1/go.mod h1:IYus9qsFobWIc2YVwe/WPjcnyCkPKtnHAqUYeebc8z0=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2 h1:yz1bePFlP5Vws5+8ez6T3HWXPmwOK7Yvq8QxDBD3SKY=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2/go.mod h1:Pa9ZNPuoNu/GztvBSKk9J1cDJW6vk/n0zLtV4mgd8N8=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 h1:9iefClla7iYpfYWdzPCRDozdmndjTm8DXdpCzPajMgA=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2/go.mod h1:XtLgD3ZD34DAaVIIAyG3objl5DynM3CQ/vMcbBNJZGI=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute/v5 v5.7.0 h1:LkHbJbgF3YyvC53aqYGR+wWQDn2Rdp9AQdGndf9QvY4=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute/v5 v5.7.0/go.mod h1:QyiQdW4f4/BIfB8ZutZ2s+28RAgfa/pT+zS++ZHyM1I=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v4 v4.3.0 h1:bXwSugBiSbgtz7rOtbfGf+woewp4f06orW9OP5BjHLA=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v4 v4.3.0/go.mod h1:Y/HgrePTmGy9HjdSGTqZNa+apUpTVIEVKXJyARP2lrk=
+github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEKWjV8V+WSxDXJ4NFATAsZjh8iIbsQIg=
+github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
+github.com/Azure/go-ntlmssp v0.1.1 h1:l+FM/EEMb0U9QZE7mKNEDw5Mu3mFiaa2GKOoTSsNDPw=
+github.com/Azure/go-ntlmssp v0.1.1/go.mod h1:NYqdhxd/8aAct/s4qSYZEerdPuH1liG2/X9DiVTbhpk=
+github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1 h1:WJTmL004Abzc5wDB5VtZG2PJk5ndYDgVacGqfirKxjM=
+github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1/go.mod h1:tCcJZ0uHAmvjsVYzEFivsRTN00oz5BEsRgQHu5JZ9WE=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 h1:XRzhVemXdgvJqCH0sFfrBUTnUJSBrBf7++ypk+twtRs=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk=
+github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/BurntSushi/toml v1.6.0 h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=
+github.com/BurntSushi/toml v1.6.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
+github.com/Code-Hex/go-generics-cache v1.5.1 h1:6vhZGc5M7Y/YD8cIUcY8kcuQLB4cHR7U+0KMqAA0KcU=
+github.com/Code-Hex/go-generics-cache v1.5.1/go.mod h1:qxcC9kRVrct9rHeiYpFWSoW1vxyillCVzX13KZG8dl4=
+github.com/DATA-DOG/go-sqlmock v1.5.2 h1:OcvFkGmslmlZibjAjaHm3L//6LiuBgolP7OputlJIzU=
+github.com/DATA-DOG/go-sqlmock v1.5.2/go.mod h1:88MAG/4G7SMwSE3CeA0ZKzrT5CiOU3OJ+JlNzwDqpNU=
+github.com/DefangLabs/secret-detector v0.0.0-20250403165618-22662109213e h1:rd4bOvKmDIx0WeTv9Qz+hghsgyjikFiPrseXHlKepO0=
+github.com/DefangLabs/secret-detector v0.0.0-20250403165618-22662109213e/go.mod h1:blbwPQh4DTlCZEfk1BLU4oMIhLda2U+A840Uag9DsZw=
+github.com/MakeNowJust/heredoc v1.0.0 h1:cXCdzVdstXyiTqTvfqk9SDHpKNjxuom+DOlyEeQ4pzQ=
+github.com/MakeNowJust/heredoc v1.0.0/go.mod h1:mG5amYoWBHf8vpLOuehzbGGw0EHxpZZ6lCpQ4fNJ8LE=
+github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
+github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
+github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
+github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
+github.com/Masterminds/sprig/v3 v3.3.0 h1:mQh0Yrg1XPo6vjYXgtf5OtijNAKJRNcTdOOGZe3tPhs=
+github.com/Masterminds/sprig/v3 v3.3.0/go.mod h1:Zy1iXRYNqNLUolqCpL4uhk6SHUMAOSCzdgBfDb35Lz0=
+github.com/Masterminds/squirrel v1.5.4 h1:uUcX/aBc8O7Fg9kaISIUsHXdKuqehiXAMQTYX8afzqM=
+github.com/Masterminds/squirrel v1.5.4/go.mod h1:NNaOrjSoIDfDA40n7sr2tPNZRfjzjA400rg+riTZj10=
+github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY=
+github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
+github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
+github.com/Microsoft/hcsshim v0.14.1 h1:CMuB3fqQVfPdhyXhUqYdUmPUIOhJkmghCx3dJet8Cqs=
+github.com/Microsoft/hcsshim v0.14.1/go.mod h1:VnzvPLyWUhxiPVsJ31P6XadxCcTogTguBFDy/1GR/OM=
+github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2 h1:+vx7roKuyA63nhn5WAunQHLTznkw5W8b1Xc0dNjp83s=
+github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2/go.mod h1:HBCaDeC1lPdgDeDbhX8XFpy1jqjK0IBG8W5K+xYqA0w=
+github.com/ProtonMail/go-crypto v1.3.0 h1:ILq8+Sf5If5DCpHQp4PbZdS1J7HDFRXz/+xKBiRGFrw=
+github.com/ProtonMail/go-crypto v1.3.0/go.mod h1:9whxjD8Rbs29b4XWbB8irEcE8KHMqaR2e7GWU1R+/PE=
+github.com/RoaringBitmap/roaring/v2 v2.5.0 h1:TJ45qCM7D7fIEBwKd9zhoR0/S1egfnSSIzLU1e1eYLY=
+github.com/RoaringBitmap/roaring/v2 v2.5.0/go.mod h1:FiJcsfkGje/nZBZgCu0ZxCPOKD/hVXDS2dXi7/eUFE0=
+github.com/Shopify/logrus-bugsnag v0.0.0-20170309145241-6dbc35f2c30d h1:hi6J4K6DKrR4/ljxn6SF6nURyu785wKMuQcjt7H3VCQ=
+github.com/Shopify/logrus-bugsnag v0.0.0-20170309145241-6dbc35f2c30d/go.mod h1:HI8ITrYtUY+O+ZhtlqUnD8+KwNPOyugEhfP9fdUIaEQ=
+github.com/VictoriaMetrics/fastcache v1.12.0 h1:vnVi/y9yKDcD9akmc4NqAoqgQhJrOwUF+j9LTgn4QDE=
+github.com/VictoriaMetrics/fastcache v1.12.0/go.mod h1:tjiYeEfYXCqacuvYw/7UoDIeJaNxq6132xHICNP77w8=
+github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d h1:licZJFw2RwpHMqeKTCYkitsPqHNxTmd4SNR5r94FGM8=
+github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d/go.mod h1:asat636LX7Bqt5lYEZ27JNDcqxfjdBQuJ/MM4CN/Lzo=
+github.com/alecthomas/kingpin/v2 v2.4.0 h1:f48lwail6p8zpO1bC4TxtqACaGqHYA22qkHjHpqDjYY=
+github.com/alecthomas/kingpin/v2 v2.4.0/go.mod h1:0gyi0zQnjuFk8xrkNKamJoyUo382HRL7ATRpFZCw6tE=
+github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
+github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
+github.com/alecthomas/units v0.0.0-20240927000941-0f3dac36c52b h1:mimo19zliBX/vSQ6PWWSL9lK8qwHozUj03+zLoEB8O0=
+github.com/alecthomas/units v0.0.0-20240927000941-0f3dac36c52b/go.mod h1:fvzegU4vN3H1qMT+8wDmzjAcDONcgo2/SZ/TyfdUOFs=
+github.com/alexbrainman/sspi v0.0.0-20250919150558-7d374ff0d59e h1:4dAU9FXIyQktpoUAgOJK3OTFc/xug0PCXYCqU0FgDKI=
+github.com/alexbrainman/sspi v0.0.0-20250919150558-7d374ff0d59e/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
+github.com/allegro/bigcache v1.2.1-0.20190218064605-e24eb225f156 h1:eMwmnE/GDgah4HI848JfFxHt+iPb26b4zyfspmqY0/8=
+github.com/allegro/bigcache v1.2.1-0.20190218064605-e24eb225f156/go.mod h1:Cb/ax3seSYIx7SuZdm2G2xzfwmv3TPSk2ucNfQESPXM=
+github.com/anchore/go-struct-converter v0.0.0-20221118182256-c68fdcfa2092 h1:aM1rlcoLz8y5B2r4tTLMiVTrMtpfY0O8EScKJxaSaEc=
+github.com/anchore/go-struct-converter v0.0.0-20221118182256-c68fdcfa2092/go.mod h1:rYqSE9HbjzpHTI74vwPvae4ZVYZd1lue2ta6xHPdblA=
+github.com/andrew-d/go-termutil v0.0.0-20150726205930-009166a695a2 h1:axBiC50cNZOs7ygH5BgQp4N+aYrZ2DNpWZ1KG3VOSOM=
+github.com/andrew-d/go-termutil v0.0.0-20150726205930-009166a695a2/go.mod h1:jnzFpU88PccN/tPPhCpnNU8mZphvKxYM9lLNkd8e+os=
+github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
+github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4=
+github.com/apparentlymart/go-textseg/v15 v15.0.0 h1:uYvfpb3DyLSCGWnctWKGj857c6ew1u1fNQOlOtuGxQY=
+github.com/apparentlymart/go-textseg/v15 v15.0.0/go.mod h1:K8XmNZdhEBkdlyDdvbmmsvpAG721bKi0joRfFdHIWJ4=
+github.com/armon/go-metrics v0.4.1 h1:hR91U9KYmb6bLBYLQjyM+3j+rcd/UhE+G78SFnF8gJA=
+github.com/armon/go-metrics v0.4.1/go.mod h1:E6amYzXo6aW1tqzoZGT755KkbgrJsSdpwZ+3JqfkOG4=
+github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
+github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
+github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
+github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
+github.com/aws/aws-sdk-go-v2 v1.41.4 h1:10f50G7WyU02T56ox1wWXq+zTX9I1zxG46HYuG1hH/k=
+github.com/aws/aws-sdk-go-v2 v1.41.4/go.mod h1:mwsPRE8ceUUpiTgF7QmQIJ7lgsKUPQOUl3o72QBrE1o=
+github.com/aws/aws-sdk-go-v2/config v1.32.12 h1:O3csC7HUGn2895eNrLytOJQdoL2xyJy0iYXhoZ1OmP0=
+github.com/aws/aws-sdk-go-v2/config v1.32.12/go.mod h1:96zTvoOFR4FURjI+/5wY1vc1ABceROO4lWgWJuxgy0g=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.12 h1:oqtA6v+y5fZg//tcTWahyN9PEn5eDU/Wpvc2+kJ4aY8=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.12/go.mod h1:U3R1RtSHx6NB0DvEQFGyf/0sbrpJrluENHdPy1j/3TE=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20 h1:zOgq3uezl5nznfoK3ODuqbhVg1JzAGDUhXOsU0IDCAo=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20/go.mod h1:z/MVwUARehy6GAg/yQ1GO2IMl0k++cu1ohP9zo887wE=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.20 h1:CNXO7mvgThFGqOFgbNAP2nol2qAWBOGfqR/7tQlvLmc=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.20/go.mod h1:oydPDJKcfMhgfcgBUZaG+toBbwy8yPWubJXBVERtI4o=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.20 h1:tN6W/hg+pkM+tf9XDkWUbDEjGLb+raoBMFsTodcoYKw=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.20/go.mod h1:YJ898MhD067hSHA6xYCx5ts/jEd8BSOLtQDL3iZsvbc=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6 h1:qYQ4pzQ2Oz6WpQ8T3HvGHnZydA72MnLuFK9tJwmrbHw=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6/go.mod h1:O3h0IK87yXci+kg6flUKzJnWeziQUKciKrLjcatSNcY=
+github.com/aws/aws-sdk-go-v2/service/ec2 v1.296.0 h1:98Miqj16un1WLNyM1RjVDhXYumhqZrQfAeG8i4jPG6o=
+github.com/aws/aws-sdk-go-v2/service/ec2 v1.296.0/go.mod h1:T6ndRfdhnXLIY5oKBHjYZDVj706los2zGdpThppquvA=
+github.com/aws/aws-sdk-go-v2/service/ecr v1.24.1 h1:zqXEIhuR7RcHob2gxB/Xf1X4XuMS0vapn7xr+wCPrpg=
+github.com/aws/aws-sdk-go-v2/service/ecr v1.24.1/go.mod h1:+rWYJfms9p+D/wUN599tx3FtWvxoXCP25b8Porlrxcc=
+github.com/aws/aws-sdk-go-v2/service/ecs v1.74.0 h1:YS5TXaEvzDb+sV+wdQFUtuCAk0GeFR9Ai6HFdxpz6q8=
+github.com/aws/aws-sdk-go-v2/service/ecs v1.74.0/go.mod h1:10kBgdaNJz0FO/+JWDUH+0rtSjkn5yafgavDDmmhFzs=
+github.com/aws/aws-sdk-go-v2/service/elasticache v1.51.12 h1:S066ajzfPRCSW4lsSHOYglne6SNi2CHt1u5omzW1RBg=
+github.com/aws/aws-sdk-go-v2/service/elasticache v1.51.12/go.mod h1:86SE4NcXxbxr8KTG3yOyDmd4HyiFmKl8TexXnhYJ+Bw=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 h1:5EniKhLZe4xzL7a+fU3C2tfUN4nWIqlLesfrjkuPFTY=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7/go.mod h1:x0nZssQ3qZSnIcePWLvcoFisRXJzcTVvYpAAdYX8+GI=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.20 h1:2HvVAIq+YqgGotK6EkMf+KIEqTISmTYh5zLpYyeTo1Y=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.20/go.mod h1:V4X406Y666khGa8ghKmphma/7C0DAtEQYhkq9z4vpbk=
+github.com/aws/aws-sdk-go-v2/service/kafka v1.49.1 h1:BgBatWcQIFqF1l6KGHjv66V0d/ISnWrTwxDx/Jf6EJM=
+github.com/aws/aws-sdk-go-v2/service/kafka v1.49.1/go.mod h1:pMpys+PlrN//vj8j5s0oOAMJjauj81VkHzIZxPVWOro=
+github.com/aws/aws-sdk-go-v2/service/lightsail v1.51.0 h1:cg6PxzoIide2wiEyLfikOFN+XwHafwR8p5+L9U1E8dQ=
+github.com/aws/aws-sdk-go-v2/service/lightsail v1.51.0/go.mod h1:YvX7hjUWecrKX8fBkbEncyddEW85xjNH+u5JHioITOw=
+github.com/aws/aws-sdk-go-v2/service/rds v1.117.0 h1:T1Xe9sYxSUUQOvd1RsFeVk/IXFPdqSiN0atXu/Hy/8A=
+github.com/aws/aws-sdk-go-v2/service/rds v1.117.0/go.mod h1:QbXW4coAMakHQhf1qhE0eVVCen9gwB/Kvn+HHHKhpGY=
+github.com/aws/aws-sdk-go-v2/service/signin v1.0.8 h1:0GFOLzEbOyZABS3PhYfBIx2rNBACYcKty+XGkTgw1ow=
+github.com/aws/aws-sdk-go-v2/service/signin v1.0.8/go.mod h1:LXypKvk85AROkKhOG6/YEcHFPoX+prKTowKnVdcaIxE=
+github.com/aws/aws-sdk-go-v2/service/sso v1.30.13 h1:kiIDLZ005EcKomYYITtfsjn7dtOwHDOFy7IbPXKek2o=
+github.com/aws/aws-sdk-go-v2/service/sso v1.30.13/go.mod h1:2h/xGEowcW/g38g06g3KpRWDlT+OTfxxI0o1KqayAB8=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17 h1:jzKAXIlhZhJbnYwHbvUQZEB8KfgAEuG0dc08Bkda7NU=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17/go.mod h1:Al9fFsXjv4KfbzQHGe6V4NZSZQXecFcvaIF4e70FoRA=
+github.com/aws/aws-sdk-go-v2/service/sts v1.41.9 h1:Cng+OOwCHmFljXIxpEVXAGMnBia8MSU6Ch5i9PgBkcU=
+github.com/aws/aws-sdk-go-v2/service/sts v1.41.9/go.mod h1:LrlIndBDdjA/EeXeyNBle+gyCwTlizzW5ycgWnvIxkk=
+github.com/aws/smithy-go v1.24.2 h1:FzA3bu/nt/vDvmnkg+R8Xl46gmzEDam6mZ1hzmwXFng=
+github.com/aws/smithy-go v1.24.2/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
+github.com/bboreham/go-loser v0.0.0-20230920113527-fcc2c21820a3 h1:6df1vn4bBlDDo4tARvBm7l6KA9iVMnE3NWizDeWSrps=
+github.com/bboreham/go-loser v0.0.0-20230920113527-fcc2c21820a3/go.mod h1:CIWtjkly68+yqLPbvwwR/fjNJA/idrtULjZWh2v1ys0=
+github.com/beorn7/perks v0.0.0-20150223135152-b965b613227f/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
+github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
+github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
+github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
+github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/bitly/go-hostpool v0.1.0/go.mod h1:4gOCgp6+NZnVqlKyZ/iBZFTAJKembaVENUpMkpg42fw=
+github.com/bitly/go-simplejson v0.5.0/go.mod h1:cXHtHw4XUPsvGaxgjIAn8PhEWG9NfngEKAMDJEczWVA=
+github.com/bits-and-blooms/bitset v1.12.0/go.mod h1:7hO7Gc7Pp1vODcmWvKMRA9BNmbv6a/7QIWpPxHddWR8=
+github.com/bits-and-blooms/bitset v1.13.0 h1:bAQ9OPNFYbGHV6Nez0tmNI0RiEu7/hxlYJRUA0wFAVE=
+github.com/bits-and-blooms/bitset v1.13.0/go.mod h1:7hO7Gc7Pp1vODcmWvKMRA9BNmbv6a/7QIWpPxHddWR8=
+github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
+github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
+github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869/go.mod h1:Ekp36dRnpXw/yCqJaO+ZrUyxD+3VXMFFr56k5XYrpB4=
+github.com/bshuster-repo/logrus-logstash-hook v1.0.0 h1:e+C0SB5R1pu//O4MQ3f9cFuPGoOVeF2fE4Og9otCc70=
+github.com/bshuster-repo/logrus-logstash-hook v1.0.0/go.mod h1:zsTqEiSzDgAa/8GZR7E1qaXrhYNDKBYy5/dWPTIflbk=
+github.com/buger/goterm v1.0.4 h1:Z9YvGmOih81P0FbVtEYTFF6YsSgxSUKEhf/f9bTMXbY=
+github.com/buger/goterm v1.0.4/go.mod h1:HiFWV3xnkolgrBV3mY8m0X0Pumt4zg4QhbdOzQtB8tE=
+github.com/bugsnag/bugsnag-go v1.0.5-0.20150529004307-13fd6b8acda0 h1:s7+5BfS4WFJoVF9pnB8kBk03S7pZXRdKamnV0FOl5Sc=
+github.com/bugsnag/bugsnag-go v1.0.5-0.20150529004307-13fd6b8acda0/go.mod h1:2oa8nejYd4cQ/b0hMIopN0lCRxU0bueqREvZLWFrtK8=
+github.com/bugsnag/osext v0.0.0-20130617224835-0dd3f918b21b h1:otBG+dV+YK+Soembjv71DPz3uX/V/6MMlSyD9JBQ6kQ=
+github.com/bugsnag/osext v0.0.0-20130617224835-0dd3f918b21b/go.mod h1:obH5gd0BsqsP2LwDJ9aOkm/6J86V6lyAXCoQWGw3K50=
+github.com/bugsnag/panicwrap v0.0.0-20151223152923-e2c28503fcd0 h1:nvj0OLI3YqYXer/kZD8Ri1aaunCxIEsOst1BVJswV0o=
+github.com/bugsnag/panicwrap v0.0.0-20151223152923-e2c28503fcd0/go.mod h1:D/8v3kj0zr8ZAKg1AQ6crr+5VwKN5eIywRkfhyM/+dE=
+github.com/cbroglie/mustache v1.4.0 h1:Azg0dVhxTml5me+7PsZ7WPrQq1Gkf3WApcHMjMprYoU=
+github.com/cbroglie/mustache v1.4.0/go.mod h1:SS1FTIghy0sjse4DUVGV1k/40B1qE1XkD9DtDsHo9iM=
+github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
+github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
+github.com/certifi/gocertifi v0.0.0-20191021191039-0944d244cd40/go.mod h1:sGbDF6GwGcLpkNXPUTkMRoywsNa/ol15pxFe6ERfguA=
+github.com/certifi/gocertifi v0.0.0-20200922220541-2c3bb06c6054/go.mod h1:sGbDF6GwGcLpkNXPUTkMRoywsNa/ol15pxFe6ERfguA=
+github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/chai2010/gettext-go v1.0.2 h1:1Lwwip6Q2QGsAdl/ZKPCwTe9fe0CjlUbqj5bFNSjIRk=
+github.com/chai2010/gettext-go v1.0.2/go.mod h1:y+wnP2cHYaVj19NZhYKAwEMH2CI1gNHeQQ+5AjwawxA=
+github.com/cloudflare/cfssl v0.0.0-20180223231731-4e2dcbde5004/go.mod h1:yMWuSON2oQp+43nFtAV/uvKQIFpSPerB57DCt9t8sSA=
+github.com/cloudflare/cfssl v1.6.4 h1:NMOvfrEjFfC63K3SGXgAnFdsgkmiq4kATme5BfcqrO8=
+github.com/cloudflare/cfssl v1.6.4/go.mod h1:8b3CQMxfWPAeom3zBnGJ6sd+G1NkL5TXqmDXacb+1J0=
+github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg8=
+github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4=
+github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5 h1:6xNmx7iTtyBRev0+D/Tv1FZd4SCg8axKApyNyRsAt/w=
+github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5/go.mod h1:KdCmV+x/BuvyMxRnYBlmVaq4OLiKW6iRQfvC62cvdkI=
+github.com/cockroachdb/datadriven v0.0.0-20200714090401-bf6692d28da5/go.mod h1:h6jFvWxBdQXxjopDMZyH2UVceIRfR84bdzbkoKrsWNo=
+github.com/cockroachdb/errors v1.2.4/go.mod h1:rQD95gz6FARkaKkQXUksEje/d9a6wBJoCr5oaCLELYA=
+github.com/cockroachdb/logtags v0.0.0-20190617123548-eb05cc24525f/go.mod h1:i/u985jwjWRlyHXQbwatDASoW0RMlZ/3i9yJHE2xLkI=
+github.com/codahale/rfc6979 v0.0.0-20141003034818-6a90f24967eb h1:EDmT6Q9Zs+SbUoc7Ik9EfrFqcylYqgPZ9ANSbTAntnE=
+github.com/codahale/rfc6979 v0.0.0-20141003034818-6a90f24967eb/go.mod h1:ZjrT6AXHbDs86ZSdt/osfBi5qfexBrKUdONk989Wnk4=
+github.com/compose-spec/compose-go/v2 v2.9.1 h1:8UwI+ujNU+9Ffkf/YgAm/qM9/eU7Jn8nHzWG721W4rs=
+github.com/compose-spec/compose-go/v2 v2.9.1/go.mod h1:Oky9AZGTRB4E+0VbTPZTUu4Kp+oEMMuwZXZtPPVT1iE=
+github.com/containerd/cgroups v1.1.0 h1:v8rEWFl6EoqHB+swVNjVoCJE8o3jX7e8nqBGPLaDFBM=
+github.com/containerd/cgroups/v3 v3.1.2 h1:OSosXMtkhI6Qove637tg1XgK4q+DhR0mX8Wi8EhrHa4=
+github.com/containerd/cgroups/v3 v3.1.2/go.mod h1:PKZ2AcWmSBsY/tJUVhtS/rluX0b1uq1GmPO1ElCmbOw=
+github.com/containerd/console v1.0.5 h1:R0ymNeydRqH2DmakFNdmjR2k0t7UPuiOV/N/27/qqsc=
+github.com/containerd/console v1.0.5/go.mod h1:YynlIjWYF8myEu6sdkwKIvGQq+cOckRm6So2avqoYAk=
+github.com/containerd/containerd v1.7.32 h1:S54xuVcPxeLaYgaRABtpJ2VyVUVsy0IGf7qHBs+sbY8=
+github.com/containerd/containerd v1.7.32/go.mod h1:jdwD6s/BhV4XVJGrvtziNPVA+83n66TwptVaPKprq4E=
+github.com/containerd/containerd/api v1.10.0 h1:5n0oHYVBwN4VhoX9fFykCV9dF1/BvAXeg2F8W6UYq1o=
+github.com/containerd/containerd/api v1.10.0/go.mod h1:NBm1OAk8ZL+LG8R0ceObGxT5hbUYj7CzTmR3xh0DlMM=
+github.com/containerd/containerd/v2 v2.2.4 h1:8x2UdXqww7NYqGNabQ7i1nAgB5LegzjC9KQzO/900iA=
+github.com/containerd/containerd/v2 v2.2.4/go.mod h1:YBcTO8D9149QY9zNmUjy04Mhuc4DlrZQ8FIOwKZEM7o=
+github.com/containerd/continuity v0.4.5 h1:ZRoN1sXq9u7V6QoHMcVWGhOwDFqZ4B9i5H6un1Wh0x4=
+github.com/containerd/continuity v0.4.5/go.mod h1:/lNJvtJKUQStBzpVQ1+rasXO1LAWtUQssk28EZvJ3nE=
+github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
+github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
+github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=
+github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
+github.com/containerd/fifo v1.1.0 h1:4I2mbh5stb1u6ycIABlBw9zgtlK8viPI9QkQNRQEEmY=
+github.com/containerd/fifo v1.1.0/go.mod h1:bmC4NWMbXlt2EZ0Hc7Fx7QzTFxgPID13eH0Qu+MAb2o=
+github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
+github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
+github.com/containerd/nydus-snapshotter v0.15.2 h1:qsHI4M+Wwrf6Jr4eBqhNx8qh+YU0dSiJ+WPmcLFWNcg=
+github.com/containerd/nydus-snapshotter v0.15.2/go.mod h1:FfwH2KBkNYoisK/e+KsmNr7xTU53DmnavQHMFOcXwfM=
+github.com/containerd/platforms v1.0.0-rc.2 h1:0SPgaNZPVWGEi4grZdV8VRYQn78y+nm6acgLGv/QzE4=
+github.com/containerd/platforms v1.0.0-rc.2/go.mod h1:J71L7B+aiM5SdIEqmd9wp6THLVRzJGXfNuWCZCllLA4=
+github.com/containerd/plugin v1.0.0 h1:c8Kf1TNl6+e2TtMHZt+39yAPDbouRH9WAToRjex483Y=
+github.com/containerd/plugin v1.0.0/go.mod h1:hQfJe5nmWfImiqT1q8Si3jLv3ynMUIBB47bQ+KexvO8=
+github.com/containerd/stargz-snapshotter v0.16.3 h1:zbQMm8dRuPHEOD4OqAYGajJJUwCeUzt4j7w9Iaw58u4=
+github.com/containerd/stargz-snapshotter/estargz v0.17.0 h1:+TyQIsR/zSFI1Rm31EQBwpAA1ovYgIKHy7kctL3sLcE=
+github.com/containerd/stargz-snapshotter/estargz v0.17.0/go.mod h1:s06tWAiJcXQo9/8AReBCIo/QxcXFZ2n4qfsRnpl71SM=
+github.com/containerd/ttrpc v1.2.7 h1:qIrroQvuOL9HQ1X6KHe2ohc7p+HP/0VE6XPU7elJRqQ=
+github.com/containerd/ttrpc v1.2.7/go.mod h1:YCXHsb32f+Sq5/72xHubdiJRQY9inL4a4ZQrAbN1q9o=
+github.com/containerd/typeurl/v2 v2.2.3 h1:yNA/94zxWdvYACdYO8zofhrTVuQY73fFU1y++dYSw40=
+github.com/containerd/typeurl/v2 v2.2.3/go.mod h1:95ljDnPfD3bAbDJRugOiShd/DlAAsxGtUBhJxIn7SCk=
+github.com/containers/libtrust v0.0.0-20230121012942-c1716e8a8d01 h1:Qzk5C6cYglewc+UyGf6lc8Mj2UaPTHy/iF2De0/77CA=
+github.com/containers/libtrust v0.0.0-20230121012942-c1716e8a8d01/go.mod h1:9rfv8iPl1ZP7aqh9YA68wnZv2NUDbXdcdPHVz0pFbPY=
+github.com/containers/ocicrypt v1.2.1 h1:0qIOTT9DoYwcKmxSt8QJt+VzMY18onl9jUXsxpVhSmM=
+github.com/containers/ocicrypt v1.2.1/go.mod h1:aD0AAqfMp0MtwqWgHM1bUwe1anx0VazI108CRrSKINQ=
+github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
+github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
+github.com/coreos/go-systemd/v22 v22.6.0 h1:aGVa/v8B7hpb0TKl0MWoAavPDmHvobFe5R5zn0bCJWo=
+github.com/coreos/go-systemd/v22 v22.6.0/go.mod h1:iG+pp635Fo7ZmV/j14KUcmEyWF+0X7Lua8rrTWzYgWU=
+github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/creack/pty v1.1.17/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
+github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
+github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
+github.com/cyphar/filepath-securejoin v0.6.1 h1:5CeZ1jPXEiYt3+Z6zqprSAgSWiggmpVyciv8syjIpVE=
+github.com/cyphar/filepath-securejoin v0.6.1/go.mod h1:A8hd4EnAeyujCJRrICiOWqjS1AX0a9kM5XL+NwKoYSc=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dchest/uniuri v0.0.0-20200228104902-7aecb25e1fe5 h1:RAV05c0xOkJ3dZGS0JFybxFKZ2WMLabgx3uXnd7rpGs=
+github.com/dchest/uniuri v0.0.0-20200228104902-7aecb25e1fe5/go.mod h1:GgB8SF9nRG+GqaDtLcwJZsQFhcogVCJ79j4EdT0c2V4=
+github.com/deckarep/golang-set v1.8.0 h1:sk9/l/KqpunDwP7pSjUg0keiOOLEnOBHzykLrsPppp4=
+github.com/deckarep/golang-set v1.8.0/go.mod h1:5nI87KwE7wgsBU1F4GKAw2Qod7p5kyS383rP6+o6qqo=
+github.com/denisenkom/go-mssqldb v0.0.0-20191128021309-1d7a30a10f73/go.mod h1:xbL0rPBG9cCiLr28tMa8zpbdarY27NDyej4t/EjAShU=
+github.com/dennwc/varint v1.0.0 h1:kGNFFSSw8ToIy3obO/kKr8U9GZYUAxQEVuix4zfDWzE=
+github.com/dennwc/varint v1.0.0/go.mod h1:hnItb35rvZvJrbTALZtY/iQfDs48JKRG1RPpgziApxA=
+github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
+github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
+github.com/digitalocean/godo v1.178.0 h1:+B4xGOaoFwwwpM7TKhoyGHdmFg5eF9zDB1YfOLvNJ2E=
+github.com/digitalocean/godo v1.178.0/go.mod h1:xQsWpVCCbkDrWisHA72hPzPlnC+4W5w/McZY5ij9uvU=
+github.com/distribution/distribution/v3 v3.0.0 h1:q4R8wemdRQDClzoNNStftB2ZAfqOiN6UX90KJc4HjyM=
+github.com/distribution/distribution/v3 v3.0.0/go.mod h1:tRNuFoZsUdyRVegq8xGNeds4KLjwLCRin/tTo6i1DhU=
+github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
+github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
+github.com/dlclark/regexp2 v1.11.0 h1:G/nrcoOa7ZXlpoa/91N3X7mM3r8eIlMBBJZvsz/mxKI=
+github.com/dlclark/regexp2 v1.11.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
+github.com/docker/buildx v0.29.1 h1:58hxM5Z4mnNje3G5NKfULT9xCr8ooM8XFtlfUK9bKaA=
+github.com/docker/buildx v0.29.1/go.mod h1:J4EFv6oxlPiV1MjO0VyJx2u5tLM7ImDEl9zyB8d4wPI=
+github.com/docker/cli v28.5.1+incompatible h1:ESutzBALAD6qyCLqbQSEf1a/U8Ybms5agw59yGVc+yY=
+github.com/docker/cli v28.5.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli-docs-tool v0.10.0 h1:bOD6mKynPQgojQi3s2jgcUWGp/Ebqy1SeCr9VfKQLLU=
+github.com/docker/cli-docs-tool v0.10.0/go.mod h1:5EM5zPnT2E7yCLERZmrDA234Vwn09fzRHP4aX1qwp1U=
+github.com/docker/compose/v2 v2.40.3 h1:XeYkQu1svDtyfZPv5nTwFryQ25ZJMkIlc4pz9HalMPI=
+github.com/docker/compose/v2 v2.40.3/go.mod h1:iNY1tvoHTyN3C3QHCuWAgj3OjR2T6mGkk/qxfbBF/4M=
+github.com/docker/distribution v2.7.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
+github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
+github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
+github.com/docker/docker v28.5.2+incompatible h1:DBX0Y0zAjZbSrm1uzOkdr1onVghKaftjlSWt4AFexzM=
+github.com/docker/docker v28.5.2+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8=
+github.com/docker/docker-credential-helpers v0.9.3/go.mod h1:x+4Gbw9aGmChi3qTLZj8Dfn0TD20M/fuWy0E5+WDeCo=
+github.com/docker/go v1.5.1-1.0.20160303222718-d30aec9fd63c h1:lzqkGL9b3znc+ZUgi7FlLnqjQhcXxkNM/quxIjBVMD0=
+github.com/docker/go v1.5.1-1.0.20160303222718-d30aec9fd63c/go.mod h1:CADgU4DSXK5QUlFslkQu2yW2TKzFZcXq/leZfM0UH5Q=
+github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
+github.com/docker/go-connections v0.6.0 h1:LlMG9azAe1TqfR7sO+NJttz1gy6KO7VJBh+pMmjSD94=
+github.com/docker/go-connections v0.6.0/go.mod h1:AahvXYshr6JgfUJGdDCs2b5EZG/vmaMAntpSFH5BFKE=
+github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c h1:+pKlWGMw7gf6bQ+oDZB4KHQFypsfjYlq/C4rfL7D3g8=
+github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
+github.com/docker/go-metrics v0.0.0-20180209012529-399ea8c73916/go.mod h1:/u0gXw0Gay3ceNrsHubL3BtdOL2fHf93USgMTe0W5dI=
+github.com/docker/go-metrics v0.0.1 h1:AgB/0SvBxihN0X8OR4SjsblXkbMvalQ8cjmtKQ2rQV8=
+github.com/docker/go-metrics v0.0.1/go.mod h1:cG1hvH2utMXtqgqqYE9plW6lDxS3/5ayHzueweSI3Vw=
+github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
+github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
+github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7 h1:UhxFibDNY/bfvqU5CAUmr9zpesgbU6SWc8/B4mflAE4=
+github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7/go.mod h1:cyGadeNEkKy96OOhEzfZl+yxihPEzKnqJwvfuSUqbZE=
+github.com/dvsekhvalnov/jose2go v0.0.0-20170216131308-f21a8cedbbae/go.mod h1:7BvyPhdbLxMXIYTFPLsyJRFMsKmOZnQmzh6Gb+uquuM=
+github.com/dylibso/observe-sdk/go v0.0.0-20240819160327-2d926c5d788a h1:UwSIFv5g5lIvbGgtf3tVwC7Ky9rmMFBp0RMs+6f6YqE=
+github.com/dylibso/observe-sdk/go v0.0.0-20240819160327-2d926c5d788a/go.mod h1:C8DzXehI4zAbrdlbtOByKX6pfivJTBiV9Jjqv56Yd9Q=
+github.com/edsrzf/mmap-go v1.2.0 h1:hXLYlkbaPzt1SaQk+anYwKSRNhufIDCchSPkUD6dD84=
+github.com/edsrzf/mmap-go v1.2.0/go.mod h1:19H/e8pUPLicwkyNgOykDXkJ9F0MHE+Z52B8EIth78Q=
+github.com/eiannone/keyboard v0.0.0-20220611211555-0d226195f203 h1:XBBHcIb256gUJtLmY22n99HaZTz+r2Z51xUPi01m3wg=
+github.com/eiannone/keyboard v0.0.0-20220611211555-0d226195f203/go.mod h1:E1jcSv8FaEny+OP/5k9UxZVw9YFWGj7eI4KR/iOBqCg=
+github.com/elazarl/goproxy v1.7.2 h1:Y2o6urb7Eule09PjlhQRGNsqRfPmYI3KKQLFpCAV3+o=
+github.com/elazarl/goproxy v1.7.2/go.mod h1:82vkLNir0ALaW14Rc399OTTjyNREgmdL2cVoIbS6XaE=
+github.com/emicklei/go-restful/v3 v3.13.0 h1:C4Bl2xDndpU6nJ4bc1jXd+uTmYPVUwkD6bFY/oTyCes=
+github.com/emicklei/go-restful/v3 v3.13.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
+github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
+github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ=
+github.com/envoyproxy/go-control-plane v0.14.0 h1:hbG2kr4RuFj222B6+7T83thSPqLjwBIfQawTkC++2HA=
+github.com/envoyproxy/go-control-plane/envoy v1.37.0 h1:u3riX6BoYRfF4Dr7dwSOroNfdSbEPe9Yyl09/B6wBrQ=
+github.com/envoyproxy/go-control-plane/envoy v1.37.0/go.mod h1:DReE9MMrmecPy+YvQOAOHNYMALuowAnbjjEMkkWOi6A=
+github.com/envoyproxy/protoc-gen-validate v1.3.3 h1:MVQghNeW+LZcmXe7SY1V36Z+WFMDjpqGAGacLe2T0ds=
+github.com/envoyproxy/protoc-gen-validate v1.3.3/go.mod h1:TsndJ/ngyIdQRhMcVVGDDHINPLWB7C82oDArY51KfB0=
+github.com/erikstmartin/go-testdb v0.0.0-20160219214506-8d10e4a1bae5/go.mod h1:a2zkGnVExMxdzMo3M0Hi/3sEU+cWnZpSni0O6/Yb/P0=
+github.com/evanphx/json-patch/v5 v5.9.11 h1:/8HVnzMq13/3x9TPvjG08wUGqBTmZBsCWzjTM0wiaDU=
+github.com/evanphx/json-patch/v5 v5.9.11/go.mod h1:3j+LviiESTElxA4p3EMKAB9HXj3/XEtnUf6OZxqIQTM=
+github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f h1:Wl78ApPPB2Wvf/TIe2xdyJxTlb6obmF18d8QdkxNDu4=
+github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f/go.mod h1:OSYXu++VVOHnXeitef/D8n/6y4QV8uLHSFXX4NeXMGc=
+github.com/extism/go-sdk v1.7.1 h1:lWJos6uY+tRFdlIHR+SJjwFDApY7OypS/2nMhiVQ9Sw=
+github.com/extism/go-sdk v1.7.1/go.mod h1:IT+Xdg5AZM9hVtpFUA+uZCJMge/hbvshl8bwzLtFyKA=
+github.com/facette/natsort v0.0.0-20181210072756-2cd4dd1e2dcb h1:IT4JYU7k4ikYg1SCxNI1/Tieq/NFvh6dzLdgi7eu0tM=
+github.com/facette/natsort v0.0.0-20181210072756-2cd4dd1e2dcb/go.mod h1:bH6Xx7IW64qjjJq8M2u4dxNaBiDfKK+z/3eGDpXEQhc=
+github.com/fatih/camelcase v1.0.0 h1:hxNvNX/xYBp0ovncs8WyWZrOrpBNub/JfaMvbURyft8=
+github.com/fatih/camelcase v1.0.0/go.mod h1:yN2Sb0lFhZJUdVvtELVWefmrXpuZESvPmqwoZc+/fpc=
+github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
+github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
+github.com/fatih/structs v1.1.0 h1:Q7juDM0QtcnhCpeyLGQKyg4TOIghuNXrkL32pHAUMxo=
+github.com/fatih/structs v1.1.0/go.mod h1:9NiDSp5zOcgEDl+j00MP/WkGVPOlPRLejGD8Ga6PJ7M=
+github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
+github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
+github.com/fluxcd/cli-utils v0.37.2-flux.1 h1:tQ588ghtRN+E+kHq415FddfqA9v4brn/1WWgrP6rQR0=
+github.com/fluxcd/cli-utils v0.37.2-flux.1/go.mod h1:LcWSu1NYET8d8U7O326RhEm5JkQXCMK6ITu4G1CT02c=
+github.com/foxcpp/go-mockdns v1.2.0 h1:omK3OrHRD1IWJz1FuFBCFquhXslXoF17OvBS6JPzZF0=
+github.com/foxcpp/go-mockdns v1.2.0/go.mod h1:IhLeSFGed3mJIAXPH2aiRQB+kqz7oqu8ld2qVbOu7Wk=
+github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
+github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
+github.com/fsnotify/fsevents v0.2.0 h1:BRlvlqjvNTfogHfeBOFvSC9N0Ddy+wzQCQukyoD7o/c=
+github.com/fsnotify/fsevents v0.2.0/go.mod h1:B3eEk39i4hz8y1zaWS/wPrAP4O6wkIl7HQwKBr1qH/w=
+github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
+github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
+github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
+github.com/fsouza/go-dockerclient v1.12.0 h1:S2f2crEUbBNCFiF06kR/GvioEB8EMsb3Td/bpawD+aU=
+github.com/fsouza/go-dockerclient v1.12.0/go.mod h1:YWUtjg8japrqD/80L98nTtCoxQFp5B5wrSsnyeB5lFo=
+github.com/fvbommel/sortorder v1.1.0 h1:fUmoe+HLsBTctBDoaBwpQo5N+nrCp8g/BjKb/6ZQmYw=
+github.com/fvbommel/sortorder v1.1.0/go.mod h1:uk88iVf1ovNn1iLfgUVU2F9o5eO30ui720w+kxuqRs0=
+github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
+github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
+github.com/g07cha/defender v0.0.0-20180505193036-5665c627c814 h1:gWvniJ4GbFfkf700kykAImbLiEMU0Q3QN9hQ26Js1pU=
+github.com/g07cha/defender v0.0.0-20180505193036-5665c627c814/go.mod h1:secRm32Ro77eD23BmPVbgLbWN+JWDw7pJszenjxI4bI=
+github.com/getsentry/raven-go v0.2.0/go.mod h1:KungGk8q33+aIAZUIVWZDr2OfAEBsO49PX4NzFV5kcQ=
+github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=
+github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU=
+github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 h1:BP4M0CvQ4S3TGls2FvczZtj5Re/2ZzkV9VwqPHH/3Bo=
+github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
+github.com/go-errors/errors v1.5.1 h1:ZwEMSLRCapFLflTpT7NKaAc7ukJ8ZPEjzlxt8rPN8bk=
+github.com/go-errors/errors v1.5.1/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
+github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
+github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
+github.com/go-git/go-billy/v5 v5.9.0 h1:jItGXszUDRtR/AlferWPTMN4j38BQ88XnXKbilmmBPA=
+github.com/go-git/go-billy/v5 v5.9.0/go.mod h1:jCnQMLj9eUgGU7+ludSTYoZL/GGmii14RxKFj7ROgHw=
+github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
+github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
+github.com/go-git/go-git/v5 v5.19.1 h1:nX27AnaU43/K5bKktKwgBmR9lawoYVe1Ckg0rgzzN00=
+github.com/go-git/go-git/v5 v5.19.1/go.mod h1:Pb1v0c7/g8aGQJwx9Us09W85yGoyvSwuhEGMH7zjDKQ=
+github.com/go-gorp/gorp/v3 v3.1.0 h1:ItKF/Vbuj31dmV4jxA1qblpSwkl9g1typ24xoe70IGs=
+github.com/go-gorp/gorp/v3 v3.1.0/go.mod h1:dLEjIyyRNiXvNZ8PSmzpt1GsWAUK8kjVhEpjH8TixEw=
+github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
+github.com/go-ldap/ldap/v3 v3.4.13 h1:+x1nG9h+MZN7h/lUi5Q3UZ0fJ1GyDQYbPvbuH38baDQ=
+github.com/go-ldap/ldap/v3 v3.4.13/go.mod h1:LxsGZV6vbaK0sIvYfsv47rfh4ca0JXokCoKjZxsszv0=
+github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
+github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ=
+github.com/go-logr/zapr v1.3.0/go.mod h1:YKepepNBd1u/oyhd/yQmtjVXmm9uML4IXUgMOwR8/Gg=
+github.com/go-openapi/analysis v0.24.2 h1:6p7WXEuKy1llDgOH8FooVeO+Uq2za9qoAOq4ZN08B50=
+github.com/go-openapi/analysis v0.24.2/go.mod h1:x27OOHKANE0lutg2ml4kzYLoHGMKgRm1Cj2ijVOjJuE=
+github.com/go-openapi/errors v0.22.7 h1:JLFBGC0Apwdzw3484MmBqspjPbwa2SHvpDm0u5aGhUA=
+github.com/go-openapi/errors v0.22.7/go.mod h1://QW6SD9OsWtH6gHllUCddOXDL0tk0ZGNYHwsw4sW3w=
+github.com/go-openapi/jsonpointer v0.22.5 h1:8on/0Yp4uTb9f4XvTrM2+1CPrV05QPZXu+rvu2o9jcA=
+github.com/go-openapi/jsonpointer v0.22.5/go.mod h1:gyUR3sCvGSWchA2sUBJGluYMbe1zazrYWIkWPjjMUY0=
+github.com/go-openapi/jsonreference v0.21.4 h1:24qaE2y9bx/q3uRK/qN+TDwbok1NhbSmGjjySRCHtC8=
+github.com/go-openapi/jsonreference v0.21.4/go.mod h1:rIENPTjDbLpzQmQWCj5kKj3ZlmEh+EFVbz3RTUh30/4=
+github.com/go-openapi/loads v0.23.2 h1:rJXAcP7g1+lWyBHC7iTY+WAF0rprtM+pm8Jxv1uQJp4=
+github.com/go-openapi/loads v0.23.2/go.mod h1:IEVw1GfRt/P2Pplkelxzj9BYFajiWOtY2nHZNj4UnWY=
+github.com/go-openapi/spec v0.22.3 h1:qRSmj6Smz2rEBxMnLRBMeBWxbbOvuOoElvSvObIgwQc=
+github.com/go-openapi/spec v0.22.3/go.mod h1:iIImLODL2loCh3Vnox8TY2YWYJZjMAKYyLH2Mu8lOZs=
+github.com/go-openapi/strfmt v0.26.1 h1:7zGCHji7zSYDC2tCXIusoxYQz/48jAf2q+sF6wXTG+c=
+github.com/go-openapi/strfmt v0.26.1/go.mod h1:Zslk5VZPOISLwmWTMBIS7oiVFem1o1EI6zULY8Uer7Y=
+github.com/go-openapi/swag v0.25.5 h1:pNkwbUEeGwMtcgxDr+2GBPAk4kT+kJ+AaB+TMKAg+TU=
+github.com/go-openapi/swag v0.25.5/go.mod h1:B3RT6l8q7X803JRxa2e59tHOiZlX1t8viplOcs9CwTA=
+github.com/go-openapi/swag/cmdutils v0.25.5 h1:yh5hHrpgsw4NwM9KAEtaDTXILYzdXh/I8Whhx9hKj7c=
+github.com/go-openapi/swag/cmdutils v0.25.5/go.mod h1:pdae/AFo6WxLl5L0rq87eRzVPm/XRHM3MoYgRMvG4A0=
+github.com/go-openapi/swag/conv v0.25.5 h1:wAXBYEXJjoKwE5+vc9YHhpQOFj2JYBMF2DUi+tGu97g=
+github.com/go-openapi/swag/conv v0.25.5/go.mod h1:CuJ1eWvh1c4ORKx7unQnFGyvBbNlRKbnRyAvDvzWA4k=
+github.com/go-openapi/swag/fileutils v0.25.5 h1:B6JTdOcs2c0dBIs9HnkyTW+5gC+8NIhVBUwERkFhMWk=
+github.com/go-openapi/swag/fileutils v0.25.5/go.mod h1:V3cT9UdMQIaH4WiTrUc9EPtVA4txS0TOmRURmhGF4kc=
+github.com/go-openapi/swag/jsonname v0.25.5 h1:8p150i44rv/Drip4vWI3kGi9+4W9TdI3US3uUYSFhSo=
+github.com/go-openapi/swag/jsonname v0.25.5/go.mod h1:jNqqikyiAK56uS7n8sLkdaNY/uq6+D2m2LANat09pKU=
+github.com/go-openapi/swag/jsonutils v0.25.5 h1:XUZF8awQr75MXeC+/iaw5usY/iM7nXPDwdG3Jbl9vYo=
+github.com/go-openapi/swag/jsonutils v0.25.5/go.mod h1:48FXUaz8YsDAA9s5AnaUvAmry1UcLcNVWUjY42XkrN4=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.25.5 h1:SX6sE4FrGb4sEnnxbFL/25yZBb5Hcg1inLeErd86Y1U=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.25.5/go.mod h1:/2KvOTrKWjVA5Xli3DZWdMCZDzz3uV/T7bXwrKWPquo=
+github.com/go-openapi/swag/loading v0.25.5 h1:odQ/umlIZ1ZVRteI6ckSrvP6e2w9UTF5qgNdemJHjuU=
+github.com/go-openapi/swag/loading v0.25.5/go.mod h1:I8A8RaaQ4DApxhPSWLNYWh9NvmX2YKMoB9nwvv6oW6g=
+github.com/go-openapi/swag/mangling v0.25.5 h1:hyrnvbQRS7vKePQPHHDso+k6CGn5ZBs5232UqWZmJZw=
+github.com/go-openapi/swag/mangling v0.25.5/go.mod h1:6hadXM/o312N/h98RwByLg088U61TPGiltQn71Iw0NY=
+github.com/go-openapi/swag/netutils v0.25.5 h1:LZq2Xc2QI8+7838elRAaPCeqJnHODfSyOa7ZGfxDKlU=
+github.com/go-openapi/swag/netutils v0.25.5/go.mod h1:lHbtmj4m57APG/8H7ZcMMSWzNqIQcu0RFiXrPUara14=
+github.com/go-openapi/swag/stringutils v0.25.5 h1:NVkoDOA8YBgtAR/zvCx5rhJKtZF3IzXcDdwOsYzrB6M=
+github.com/go-openapi/swag/stringutils v0.25.5/go.mod h1:PKK8EZdu4QJq8iezt17HM8RXnLAzY7gW0O1KKarrZII=
+github.com/go-openapi/swag/typeutils v0.25.5 h1:EFJ+PCga2HfHGdo8s8VJXEVbeXRCYwzzr9u4rJk7L7E=
+github.com/go-openapi/swag/typeutils v0.25.5/go.mod h1:itmFmScAYE1bSD8C4rS0W+0InZUBrB2xSPbWt6DLGuc=
+github.com/go-openapi/swag/yamlutils v0.25.5 h1:kASCIS+oIeoc55j28T4o8KwlV2S4ZLPT6G0iq2SSbVQ=
+github.com/go-openapi/swag/yamlutils v0.25.5/go.mod h1:Gek1/SjjfbYvM+Iq4QGwa/2lEXde9n2j4a3wI3pNuOQ=
+github.com/go-openapi/testify/enable/yaml/v2 v2.4.0 h1:7SgOMTvJkM8yWrQlU8Jm18VeDPuAvB/xWrdxFJkoFag=
+github.com/go-openapi/testify/enable/yaml/v2 v2.4.0/go.mod h1:14iV8jyyQlinc9StD7w1xVPW3CO3q1Gj04Jy//Kw4VM=
+github.com/go-openapi/testify/v2 v2.4.1 h1:zB34HDKj4tHwyUQHrUkpV0Q0iXQ6dUCOQtIqn8hE6Iw=
+github.com/go-openapi/testify/v2 v2.4.1/go.mod h1:HCPmvFFnheKK2BuwSA0TbbdxJ3I16pjwMkYkP4Ywn54=
+github.com/go-openapi/validate v0.25.1 h1:sSACUI6Jcnbo5IWqbYHgjibrhhmt3vR6lCzKZnmAgBw=
+github.com/go-openapi/validate v0.25.1/go.mod h1:RMVyVFYte0gbSTaZ0N4KmTn6u/kClvAFp+mAVfS/DQc=
+github.com/go-resty/resty/v2 v2.17.2 h1:FQW5oHYcIlkCNrMD2lloGScxcHJ0gkjshV3qcQAyHQk=
+github.com/go-resty/resty/v2 v2.17.2/go.mod h1:kCKZ3wWmwJaNc7S29BRtUhJwy7iqmn+2mLtQrOyQlVA=
+github.com/go-sql-driver/mysql v1.3.0/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
+github.com/go-sql-driver/mysql v1.8.1 h1:LedoTUt/eveggdHS9qUFC1EFSa8bU2+1pZjSRpvNJ1Y=
+github.com/go-sql-driver/mysql v1.8.1/go.mod h1:wEBSXgmK//2ZFJyE+qWnIsVGmvmEKlqwuVSjsCm7DZg=
+github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
+github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
+github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
+github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
+github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/go-zookeeper/zk v1.0.4 h1:DPzxraQx7OrPyXq2phlGlNSIyWEsAox0RJmjTseMV6I=
+github.com/go-zookeeper/zk v1.0.4/go.mod h1:nOB03cncLtlp4t+UAkGSV+9beXP/akpekBwL+UX1Qcw=
+github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
+github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
+github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
+github.com/gofrs/flock v0.13.0 h1:95JolYOvGMqeH31+FC7D2+uULf6mG61mEZ/A8dRYMzw=
+github.com/gofrs/flock v0.13.0/go.mod h1:jxeyy9R1auM5S6JYDBhDt+E2TCo7DkratH4Pgi8P+Z0=
+github.com/gogo/protobuf v1.0.0/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
+github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
+github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
+github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
+github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
+github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
+github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
+github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
+github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 h1:f+oWsMOmNPc8JmEHVZIycC7hBoQxHH9pNKQORJNozsQ=
+github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8/go.mod h1:wcDNUvekVysuuOpQKo3191zZyTpiI6se1N1ULghS0sw=
+github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.4/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
+github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
+github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
+github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
+github.com/golang/snappy v1.0.0 h1:Oy607GVXHs7RtbggtPBnr2RmDArIsAefDwvrdWvRhGs=
+github.com/golang/snappy v1.0.0/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
+github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
+github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
+github.com/google/certificate-transparency-go v1.0.10-0.20180222191210-5ab67e519c93/go.mod h1:QeJfpSbVSfYc7RgB3gJFj9cbuQMMchQxrWXz8Ruopmg=
+github.com/google/certificate-transparency-go v1.1.4 h1:hCyXHDbtqlr/lMXU0D4WgbalXL0Zk4dSWWMbPV8VrqY=
+github.com/google/certificate-transparency-go v1.1.4/go.mod h1:D6lvbfwckhNrbM9WVl1EVeMOyzC19mpIjMOI4nxBHtQ=
+github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=
+github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
+github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/go-querystring v1.2.0 h1:yhqkPbu2/OH+V9BfpCVPZkNmUXhb2gBxJArfhIxNtP0=
+github.com/google/go-querystring v1.2.0/go.mod h1:8IFJqpSRITyJ8QhQ13bmbeMBDfmeEJZD5A0egEOmkqU=
+github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/pprof v0.0.0-20260302011040-a15ffb7f9dcc h1:VBbFa1lDYWEeV5FZKUiYKYT0VxCp9twUmmaq9eb8sXw=
+github.com/google/pprof v0.0.0-20260302011040-a15ffb7f9dcc/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
+github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
+github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
+github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
+github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/googleapis/enterprise-certificate-proxy v0.3.14 h1:yh8ncqsbUY4shRD5dA6RlzjJaT4hi3kII+zYw8wmLb8=
+github.com/googleapis/enterprise-certificate-proxy v0.3.14/go.mod h1:vqVt9yG9480NtzREnTlmGSBmFrA+bzb0yl0TxoBQXOg=
+github.com/googleapis/gax-go/v2 v2.18.0 h1:jxP5Uuo3bxm3M6gGtV94P4lliVetoCB4Wk2x8QA86LI=
+github.com/googleapis/gax-go/v2 v2.18.0/go.mod h1:uSzZN4a356eRG985CzJ3WfbFSpqkLTjsnhWGJR6EwrE=
+github.com/gophercloud/gophercloud/v2 v2.11.1 h1:jCs4vLH8sJgRqrPzqVfWgl7uI6JnIIlsgeIRM0uHjxY=
+github.com/gophercloud/gophercloud/v2 v2.11.1/go.mod h1:Rm0YvKQ4QYX2rY9XaDKnjRzSGwlG5ge4h6ABYnmkKQM=
+github.com/gorilla/handlers v1.5.2 h1:cLTUSsNkgcwhgRqvCNmdbRWG0A3N4F+M2nWKdScwyEE=
+github.com/gorilla/handlers v1.5.2/go.mod h1:dX+xVpaxdSw+q0Qek8SSsl3dfMk3jNddUkMzo0GtH0w=
+github.com/gorilla/mux v1.7.0/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
+github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
+github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
+github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 h1:JeSE6pjso5THxAzdVpqr6/geYxZytqFMBCOtn/ujyeo=
+github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674/go.mod h1:r4w70xmWCQKmi1ONH4KIaBptdivuRPyosB9RmPlGEwA=
+github.com/gosuri/uitable v0.0.4 h1:IG2xLKRvErL3uhY6e1BylFzG+aJiwQviDDTfOKeKTpY=
+github.com/gosuri/uitable v0.0.4/go.mod h1:tKR86bXuXPZazfOTG1FIzvjIdXzd0mo4Vtn16vt0PJo=
+github.com/grafana/regexp v0.0.0-20250905093917-f7b3be9d1853 h1:cLN4IBkmkYZNnk7EAJ0BHIethd+J6LqxFNw5mSiI2bM=
+github.com/grafana/regexp v0.0.0-20250905093917-f7b3be9d1853/go.mod h1:+JKpmjMGhpgPL+rXZ5nsZieVzvarn86asRlBg4uNGnk=
+github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 h1:+ngKgrYPPJrOjhax5N+uePQ0Fh1Z7PheYoUI/0nzkPA=
+github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 h1:HWRh5R2+9EifMyIHV7ZV+MIZqgz+PMpZ14Jynv3O2Zs=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0/go.mod h1:JfhWUomR1baixubs02l85lZYYOm7LV6om4ceouMv45c=
+github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed h1:5upAirOpQc1Q53c0bnx2ufif5kANL7bfZWcc6VJWJd8=
+github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed/go.mod h1:tMWxXQ9wFIaZeTI9F+hmhFiGpFmhOHzyShyFUhRm0H4=
+github.com/hashicorp/consul/api v1.32.1 h1:0+osr/3t/aZNAdJX558crU3PEjVrG4x6715aZHRgceE=
+github.com/hashicorp/consul/api v1.32.1/go.mod h1:mXUWLnxftwTmDv4W3lzxYCPD199iNLLUyLfLGFJbtl4=
+github.com/hashicorp/cronexpr v1.1.3 h1:rl5IkxXN2m681EfivTlccqIryzYJSXRGRNa0xeG7NA4=
+github.com/hashicorp/cronexpr v1.1.3/go.mod h1:P4wA0KBl9C5q2hABiMO7cp6jcIg96CDh1Efb3g1PWA4=
+github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
+github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
+github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
+github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
+github.com/hashicorp/go-immutable-radix v1.3.1 h1:DKHmCUm2hRBK510BaiZlwvpD40f8bJFeZnpfm2KLowc=
+github.com/hashicorp/go-immutable-radix v1.3.1/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
+github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
+github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
+github.com/hashicorp/go-retryablehttp v0.7.8 h1:ylXZWnqa7Lhqpk0L1P1LzDtGcCR0rPVUrx/c8Unxc48=
+github.com/hashicorp/go-retryablehttp v0.7.8/go.mod h1:rjiScheydd+CxvumBsIrFKlx3iS0jrZ7LvzFGFmuKbw=
+github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=
+github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
+github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
+github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/hashicorp/go-version v1.8.0 h1:KAkNb1HAiZd1ukkxDFGmokVZe1Xy9HG6NUp+bPle2i4=
+github.com/hashicorp/go-version v1.8.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
+github.com/hashicorp/golang-lru v0.6.0 h1:uL2shRDx7RTrOrTCUZEGP/wJUFiUI8QT6E7z5o8jga4=
+github.com/hashicorp/golang-lru v0.6.0/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
+github.com/hashicorp/golang-lru/arc/v2 v2.0.5 h1:l2zaLDubNhW4XO3LnliVj0GXO3+/CGNJAg1dcN2Fpfw=
+github.com/hashicorp/golang-lru/arc/v2 v2.0.5/go.mod h1:ny6zBSQZi2JxIeYcv7kt2sH2PXJtirBN7RDhRpxPkxU=
+github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
+github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
+github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
+github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
+github.com/hashicorp/nomad/api v0.0.0-20260324203407-b27b0c2e019a h1:HGwfgBNl90YBiHdbzZ/+8aMxO1UL9B/yNTAXa8iB8z8=
+github.com/hashicorp/nomad/api v0.0.0-20260324203407-b27b0c2e019a/go.mod h1:KkLNLU0Nyfh5jWsFoF/PsmMbKpRIAoIV4lmQoJWgKCk=
+github.com/hashicorp/serf v0.10.1 h1:Z1H2J60yRKvfDYAOZLd2MU0ND4AH/WDz7xYHDWQsIPY=
+github.com/hashicorp/serf v0.10.1/go.mod h1:yL2t6BqATOLGc5HF7qbFkTfXoPIY0WZdWHfEvMqbG+4=
+github.com/hetznercloud/hcloud-go/v2 v2.36.0 h1:HlLL/aaVXUulqe+rsjoJmrxKhPi1MflL5O9iq5QEtvo=
+github.com/hetznercloud/hcloud-go/v2 v2.36.0/go.mod h1:MnN/QJEa/RYNQiiVoJjNHPntM7Z1wlYPgJ2HA40/cDE=
+github.com/hinshun/vt10x v0.0.0-20220119200601-820417d04eec h1:qv2VnGeEQHchGaZ/u7lxST/RaJw+cv273q79D81Xbog=
+github.com/hinshun/vt10x v0.0.0-20220119200601-820417d04eec/go.mod h1:Q48J4R4DvxnHolD5P8pOtXigYlRuPLGl6moFx3ulM68=
+github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
+github.com/huandu/xstrings v1.5.0 h1:2ag3IFq9ZDANvthTwTiqSSZLjDc+BedvHPAp5tJy2TI=
+github.com/huandu/xstrings v1.5.0/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
+github.com/ianlancetaylor/demangle v0.0.0-20240805132620-81f5be970eca h1:T54Ema1DU8ngI+aef9ZhAhNGQhcRTrWxVeG07F+c/Rw=
+github.com/ianlancetaylor/demangle v0.0.0-20240805132620-81f5be970eca/go.mod h1:gx7rwoVhcfuVKG5uya9Hs3Sxj7EIvldVofAWIUtGouw=
+github.com/in-toto/attestation v1.1.2 h1:MBFn6lsMq6dptQZJBhalXTcWMb/aJy3V+GX3VYj/V1E=
+github.com/in-toto/attestation v1.1.2/go.mod h1:gYFddHMZj3DiQ0b62ltNi1Vj5rC879bTmBbrv9CRHpM=
+github.com/in-toto/in-toto-golang v0.11.0 h1:nfidMYBFx+E0lnmX5KUnN2Pdm8zdNKal1ayjJuzzRoA=
+github.com/in-toto/in-toto-golang v0.11.0/go.mod h1:u3PjTnwFKjp5a1YCcw8SJg0G+tMeKfVoWsWeFMDCMtw=
+github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
+github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
+github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/inhies/go-bytesize v0.0.0-20220417184213-4913239db9cf h1:FtEj8sfIcaaBfAKrE1Cwb61YDtYq9JxChK1c7AKce7s=
+github.com/inhies/go-bytesize v0.0.0-20220417184213-4913239db9cf/go.mod h1:yrqSXGoD/4EKfF26AOGzscPOgTTJcyAwM2rpixWT+t4=
+github.com/ionos-cloud/sdk-go/v6 v6.3.6 h1:l/TtKgdQ1wUH3DDe2SfFD78AW+TJWdEbDpQhHkWd6CM=
+github.com/ionos-cloud/sdk-go/v6 v6.3.6/go.mod h1:nUGHP4kZHAZngCVr4v6C8nuargFrtvt7GrzH/hqn7c4=
+github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
+github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
+github.com/jcmturner/aescts/v2 v2.0.0 h1:9YKLH6ey7H4eDBXW8khjYslgyqG2xZikXP0EQFKrle8=
+github.com/jcmturner/aescts/v2 v2.0.0/go.mod h1:AiaICIRyfYg35RUkr8yESTqvSy7csK90qZ5xfvvsoNs=
+github.com/jcmturner/dnsutils/v2 v2.0.0 h1:lltnkeZGL0wILNvrNiVCR6Ro5PGU/SeBvVO/8c/iPbo=
+github.com/jcmturner/dnsutils/v2 v2.0.0/go.mod h1:b0TnjGOvI/n42bZa+hmXL+kFJZsFT7G4t3HTlQ184QM=
+github.com/jcmturner/gofork v1.7.6 h1:QH0l3hzAU1tfT3rZCnW5zXl+orbkNMMRGJfdJjHVETg=
+github.com/jcmturner/gofork v1.7.6/go.mod h1:1622LH6i/EZqLloHfE7IeZ0uEJwMSUyQ/nDd82IeqRo=
+github.com/jcmturner/goidentity/v6 v6.0.1 h1:VKnZd2oEIMorCTsFBnJWbExfNN7yZr3EhJAxwOkZg6o=
+github.com/jcmturner/goidentity/v6 v6.0.1/go.mod h1:X1YW3bgtvwAXju7V3LCIMpY0Gbxyjn/mY9zx4tFonSg=
+github.com/jcmturner/gokrb5/v8 v8.4.4 h1:x1Sv4HaTpepFkXbt2IkL29DXRf8sOfZXo8eRKh687T8=
+github.com/jcmturner/gokrb5/v8 v8.4.4/go.mod h1:1btQEpgT6k+unzCwX1KdWMEwPPkkgBtP+F6aCACiMrs=
+github.com/jcmturner/rpc/v2 v2.0.3 h1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZY=
+github.com/jcmturner/rpc/v2 v2.0.3/go.mod h1:VUJYCIDm3PVOEHw8sgt091/20OJjskO/YJki3ELg/Hc=
+github.com/jinzhu/gorm v0.0.0-20170222002820-5409931a1bb8 h1:CZkYfurY6KGhVtlalI4QwQ6T0Cu6iuY3e0x5RLu96WE=
+github.com/jinzhu/gorm v0.0.0-20170222002820-5409931a1bb8/go.mod h1:Vla75njaFJ8clLU1W44h34PjIkijhjHIYnZxMqCdxqo=
+github.com/jinzhu/inflection v0.0.0-20170102125226-1c35d901db3d h1:jRQLvyVGL+iVtDElaEIDdKwpPqUIZJfzkNLV34htpEc=
+github.com/jinzhu/inflection v0.0.0-20170102125226-1c35d901db3d/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc=
+github.com/jinzhu/now v1.1.1/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
+github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
+github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
+github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
+github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
+github.com/jmoiron/sqlx v1.4.0 h1:1PLqN7S1UYp5t4SrVVnt4nUVNemrDAtxlulVe+Qgm3o=
+github.com/jmoiron/sqlx v1.4.0/go.mod h1:ZrZ7UsYB/weZdl2Bxg6jCRO9c3YHl8r3ahlKmRT4JLY=
+github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
+github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
+github.com/jonboulle/clockwork v0.5.0 h1:Hyh9A8u51kptdkR+cqRpT1EebBwTn1oK9YfGYbdFz6I=
+github.com/jonboulle/clockwork v0.5.0/go.mod h1:3mZlmanh0g2NDKO5TWZVJAfofYk64M7XN3SzBPjZF60=
+github.com/jpillora/ansi v1.0.3 h1:nn4Jzti0EmRfDxm7JtEs5LzCbNwd5sv+0aE+LdS9/ZQ=
+github.com/jpillora/ansi v1.0.3/go.mod h1:D2tT+6uzJvN1nBVQILYWkIdq7zG+b5gcFN5WI/VyjMY=
+github.com/jpillora/backoff v1.0.0 h1:uvFg412JmmHBHw7iwprIxkPMI+sGQ4kzOWsMeHnm2EA=
+github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
+github.com/jpillora/chisel v1.11.6 h1:wqlbuatAk8pst2GNY7d2F4AnHxMaLVOA2S/SkC7OlEg=
+github.com/jpillora/chisel v1.11.6/go.mod h1:gAFVTwDLIMM/dH0w1twfSXz0NQUnBVWrlimi707vk7k=
+github.com/jpillora/requestlog v1.0.0 h1:bg++eJ74T7DYL3DlIpiwknrtfdUA9oP/M4fL+PpqnyA=
+github.com/jpillora/requestlog v1.0.0/go.mod h1:HTWQb7QfDc2jtHnWe2XEIEeJB7gJPnVdpNn52HXPvy8=
+github.com/jpillora/sizestr v1.0.0 h1:4tr0FLxs1Mtq3TnsLDV+GYUWG7Q26a6s+tV5Zfw2ygw=
+github.com/jpillora/sizestr v1.0.0/go.mod h1:bUhLv4ctkknatr6gR42qPxirmd5+ds1u7mzD+MZ33f0=
+github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
+github.com/json-iterator/go v1.1.7/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
+github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
+github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/juju/loggo v0.0.0-20190526231331-6e530bcce5d8/go.mod h1:vgyd7OREkbtVEN/8IXZe5Ooef3LQePvuBm9UWj6ZL8U=
+github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
+github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 h1:Z9n2FFNUXsshfwJMBgNA0RU6/i7WVaAegv3PtuIHPMs=
+github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:CzGEWj7cYgsdH8dAjBGEr58BoE7ScuLd+fwFZ44+/x8=
+github.com/kevinburke/ssh_config v1.2.0 h1:x584FjTGwHzMwvHx18PXxbBVzfnxogHaAReU4gf13a4=
+github.com/kevinburke/ssh_config v1.2.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM=
+github.com/keybase/go-keychain v0.0.1 h1:way+bWYa6lDppZoZcgMbYsvC7GxljxrskdNInRtuthU=
+github.com/keybase/go-keychain v0.0.1/go.mod h1:PdEILRW3i9D8JcdM+FmY6RwkHGnhHxXwkPPMeUgOK1k=
+github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00=
+github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
+github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
+github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
+github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
+github.com/klauspost/pgzip v1.2.6 h1:8RXeL5crjEUFnR2/Sn6GJNWtSQ3Dk8pq4CL3jvdDyjU=
+github.com/klauspost/pgzip v1.2.6/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs=
+github.com/knadh/koanf/maps v0.1.2 h1:RBfmAW5CnZT+PJ1CVc1QSJKf4Xu9kxfQgYVQSu8hpbo=
+github.com/knadh/koanf/maps v0.1.2/go.mod h1:npD/QZY3V6ghQDdcQzl1W4ICNVTkohC8E73eI2xW4yI=
+github.com/knadh/koanf/providers/confmap v1.0.0 h1:mHKLJTE7iXEys6deO5p6olAiZdG5zwp8Aebir+/EaRE=
+github.com/knadh/koanf/providers/confmap v1.0.0/go.mod h1:txHYHiI2hAtF0/0sCmcuol4IDcuQbKTybiB1nOcUo1A=
+github.com/knadh/koanf/v2 v2.3.3 h1:jLJC8XCRfLC7n4F+ZKKdBsbq1bfXTpuFhf4L7t94D94=
+github.com/knadh/koanf/v2 v2.3.3/go.mod h1:gRb40VRAbd4iJMYYD5IxZ6hfuopFcXBpc9bbQpZwo28=
+github.com/koding/websocketproxy v0.0.0-20181220232114-7ed82d81a28c h1:N7A4JCA2G+j5fuFxCsJqjFU/sZe0mj8H0sSoSwbaikw=
+github.com/koding/websocketproxy v0.0.0-20181220232114-7ed82d81a28c/go.mod h1:Nn5wlyECw3iJrzi0AhIWg+AJUb4PlRQVW4/3XHH1LZA=
+github.com/kolo/xmlrpc v0.0.0-20220921171641-a4b6fa1dd06b h1:udzkj9S/zlT5X367kqJis0QP7YMxobob6zhzq6Yre00=
+github.com/kolo/xmlrpc v0.0.0-20220921171641-a4b6fa1dd06b/go.mod h1:pcaDhQK0/NJZEvtCO0qQPPropqV0sJOJ6YW7X+9kRwM=
+github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/kubernetes/kompose v1.37.0 h1:yWVvs6a/3BrihjIn44mfT6UDUPOVdSec2edEq7HJq0M=
+github.com/kubernetes/kompose v1.37.0/go.mod h1:luOHjdjghLYUB7HMW2hgKfyVjyvwe70aFM8G+kfrsDM=
+github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
+github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
+github.com/lann/builder v0.0.0-20180802200727-47ae307949d0 h1:SOEGU9fKiNWd/HOJuq6+3iTQz8KNCLtVX6idSoTLdUw=
+github.com/lann/builder v0.0.0-20180802200727-47ae307949d0/go.mod h1:dXGbAdH5GtBTC4WfIxhKZfyBF/HBFgRZSWwZ9g/He9o=
+github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0 h1:P6pPBnrTSX3DEVR4fDembhRWSsG5rVo6hYhAB/ADZrk=
+github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0/go.mod h1:vmVJ0l/dxyfGW6FmdpVm2joNMFikkuWg0EoCKLGUMNw=
+github.com/lib/pq v0.0.0-20150723085316-0dad96c0b94f/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
+github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
+github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
+github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de h1:9TO3cAIGXtEhnIaL+V+BEER86oLrvS+kWobKpbJuye0=
+github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de/go.mod h1:zAbeS9B/r2mtpb6U+EI2rYA5OAXxsYw6wTamcNW+zcE=
+github.com/linode/linodego v1.66.0 h1:rK8QJFaV53LWOEJvb/evhTg/dP5ElvtuZmx4iv4RJds=
+github.com/linode/linodego v1.66.0/go.mod h1:12ykGs9qsvxE+OU3SXuW2w+DTruWF35FPlXC7gGk2tU=
+github.com/lithammer/dedent v1.1.0 h1:VNzHMVCBNG1j0fh3OrsFRkVUwStdDArbgBWoPAffktY=
+github.com/lithammer/dedent v1.1.0/go.mod h1:jrXYCQtgg0nJiN+StA2KgR7w6CiQNv9Fd/Z9BP0jIOc=
+github.com/magiconair/properties v1.5.3/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
+github.com/magiconair/properties v1.8.9 h1:nWcCbLq1N2v/cpNsy5WvQ37Fb+YElfq20WJ/a8RkpQM=
+github.com/magiconair/properties v1.8.9/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
+github.com/mattn/go-colorable v0.1.2/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
+github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
+github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
+github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc=
+github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
+github.com/mattn/go-shellwords v1.0.12 h1:M2zGm7EW6UQJvDeQxo4T51eKPurbeFbe8WtebGE2xrk=
+github.com/mattn/go-shellwords v1.0.12/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y=
+github.com/mattn/go-sqlite3 v1.6.0/go.mod h1:FPy6KqzDD04eiIsT53CuJW3U88zkxoIYsOqkbpncsNc=
+github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
+github.com/mattn/go-sqlite3 v1.14.32 h1:JD12Ag3oLy1zQA+BNn74xRgaBbdhbNIDYvQUEuuErjs=
+github.com/mattn/go-sqlite3 v1.14.32/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
+github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
+github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b h1:j7+1HpAFS1zy5+Q4qx1fWh90gTKwiN4QCGoY9TWyyO4=
+github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
+github.com/miekg/dns v1.1.72 h1:vhmr+TF2A3tuoGNkLDFK9zi36F2LS+hKTRW0Uf8kbzI=
+github.com/miekg/dns v1.1.72/go.mod h1:+EuEPhdHOsfk6Wk5TT2CzssZdqkmFhf8r+aVyDEToIs=
+github.com/miekg/pkcs11 v1.0.2/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
+github.com/miekg/pkcs11 v1.1.1 h1:Ugu9pdy6vAYku5DEpVWVFPYnzV+bxB+iRdbuFSu7TvU=
+github.com/miekg/pkcs11 v1.1.1/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
+github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
+github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
+github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
+github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
+github.com/mitchellh/go-ps v1.0.0 h1:i6ampVEEF4wQFF+bkYfwYgY+F/uYJDktmvLPf7qIgjc=
+github.com/mitchellh/go-ps v1.0.0/go.mod h1:J4lOc8z8yJs6vUwklHw2XEIiT4z4C40KtWVN3nvg8Pg=
+github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0=
+github.com/mitchellh/go-wordwrap v1.0.1/go.mod h1:R62XHJLzvMFRBbcrT7m7WgmE1eOyTSsCt+hzestvNj0=
+github.com/mitchellh/hashstructure/v2 v2.0.2 h1:vGKWl0YJqUNxE8d+h8f6NJLcCJrgbhC4NcD46KavDd4=
+github.com/mitchellh/hashstructure/v2 v2.0.2/go.mod h1:MG3aRVU/N29oo/V/IhBX8GR/zz4kQkprJgF2EVszyDE=
+github.com/mitchellh/mapstructure v0.0.0-20150613213606-2caf8efc9366/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
+github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
+github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
+github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
+github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
+github.com/moby/buildkit v0.25.1 h1:j7IlVkeNbEo+ZLoxdudYCHpmTsbwKvhgc/6UJ/mY/o8=
+github.com/moby/buildkit v0.25.1/go.mod h1:phM8sdqnvgK2y1dPDnbwI6veUCXHOZ6KFSl6E164tkc=
+github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
+github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
+github.com/moby/go-archive v0.1.0 h1:Kk/5rdW/g+H8NHdJW2gsXyZ7UnzvJNOy6VKJqueWdcQ=
+github.com/moby/go-archive v0.1.0/go.mod h1:G9B+YoujNohJmrIYFBpSd54GTUB4lt9S+xVQvsJyFuo=
+github.com/moby/locker v1.0.1 h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg=
+github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
+github.com/moby/patternmatcher v0.6.0 h1:GmP9lR19aU5GqSSFko+5pRqHi+Ohk1O69aFiKkVGiPk=
+github.com/moby/patternmatcher v0.6.0/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
+github.com/moby/spdystream v0.5.1 h1:9sNYeYZUcci9R6/w7KDaFWEWeV4LStVG78Mpyq/Zm/Y=
+github.com/moby/spdystream v0.5.1/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI=
+github.com/moby/swarmkit/v2 v2.1.1 h1:yvTJ8MMCc3f0qTA44J6R59EZ5yZawdYopkpuLk4+ICU=
+github.com/moby/swarmkit/v2 v2.1.1/go.mod h1:mTTGIAz/59OGZR5Qe+QByIe3Nxc+sSuJkrsStFhr6Lg=
+github.com/moby/sys/atomicwriter v0.1.0 h1:kw5D/EqkBwsBFi0ss9v1VG3wIkVhzGvLklJ+w3A14Sw=
+github.com/moby/sys/atomicwriter v0.1.0/go.mod h1:Ul8oqv2ZMNHOceF643P6FKPXeCmYtlQMvpizfsSoaWs=
+github.com/moby/sys/capability v0.4.0 h1:4D4mI6KlNtWMCM1Z/K0i7RV1FkX+DBDHKVJpCndZoHk=
+github.com/moby/sys/capability v0.4.0/go.mod h1:4g9IK291rVkms3LKCDOoYlnV8xKwoDTpIrNEE35Wq0I=
+github.com/moby/sys/mountinfo v0.7.2 h1:1shs6aH5s4o5H2zQLn796ADW1wMrIwHsyJ2v9KouLrg=
+github.com/moby/sys/mountinfo v0.7.2/go.mod h1:1YOa8w8Ih7uW0wALDUgT1dTTSBrZ+HiBLGws92L2RU4=
+github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU=
+github.com/moby/sys/sequential v0.6.0/go.mod h1:uyv8EUTrca5PnDsdMGXhZe6CCe8U/UiTWd+lL+7b/Ko=
+github.com/moby/sys/signal v0.7.1 h1:PrQxdvxcGijdo6UXXo/lU/TvHUWyPhj7UOpSo8tuvk0=
+github.com/moby/sys/signal v0.7.1/go.mod h1:Se1VGehYokAkrSQwL4tDzHvETwUZlnY7S5XtQ50mQp8=
+github.com/moby/sys/symlink v0.3.0 h1:GZX89mEZ9u53f97npBy4Rc3vJKj7JBDj/PN2I22GrNU=
+github.com/moby/sys/symlink v0.3.0/go.mod h1:3eNdhduHmYPcgsJtZXW1W4XUJdZGBIkttZ8xKqPUJq0=
+github.com/moby/sys/user v0.4.0 h1:jhcMKit7SA80hivmFJcbB1vqmw//wU61Zdui2eQXuMs=
+github.com/moby/sys/user v0.4.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs=
+github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g=
+github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28=
+github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ=
+github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFLc=
+github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 h1:n6/2gBQ3RWajuToeY6ZtZTIKv2v7ThUy5KKusIT0yc0=
+github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00/go.mod h1:Pm3mSP3c5uWn86xMLZ5Sa7JB9GsEZySvHYXCTK4E9q4=
+github.com/morikuni/aec v1.1.0 h1:vBBl0pUnvi/Je71dsRrhMBtreIqNMYErSAbEeb8jrXQ=
+github.com/morikuni/aec v1.1.0/go.mod h1:xDRgiq/iw5l+zkao76YTKzKttOp2cwPEne25HDkJnBw=
+github.com/mschoch/smat v0.2.0 h1:8imxQsjDm8yFEAVBe7azKmKSgzSkZXDuKkSq9374khM=
+github.com/mschoch/smat v0.2.0/go.mod h1:kc9mz7DoBKqDyiRL7VZN8KvXQMWeTaVnttLRXOlotKw=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
+github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f h1:KUppIJq7/+SVif2QVs3tOP0zanoHgBEVAwHxUSIzRqU=
+github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
+github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f h1:y5//uYreIhSUg3J1GEMiLbxo1LJaP8RfCpH6pymGZus=
+github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
+github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
+github.com/novln/docker-parser v1.0.0 h1:PjEBd9QnKixcWczNGyEdfUrP6GR0YUilAqG7Wksg3uc=
+github.com/novln/docker-parser v1.0.0/go.mod h1:oCeM32fsoUwkwByB5wVjsrsVQySzPWkl3JdlTn1txpE=
+github.com/oklog/ulid/v2 v2.1.1 h1:suPZ4ARWLOJLegGFiZZ1dFAkqzhMjL3J1TzI+5wHz8s=
+github.com/oklog/ulid/v2 v2.1.1/go.mod h1:rcEKHmBBKfef9DhnvX7y1HZBYxjXb0cP5ExxNsTT1QQ=
+github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/ginkgo v1.12.0/go.mod h1:oUhWkIvk5aDxtKvDDuw8gItl8pKl42LzjC9KZE0HfGg=
+github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
+github.com/onsi/ginkgo/v2 v2.28.1 h1:S4hj+HbZp40fNKuLUQOYLDgZLwNUVn19N3Atb98NCyI=
+github.com/onsi/ginkgo/v2 v2.28.1/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE=
+github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
+github.com/onsi/gomega v1.9.0/go.mod h1:Ho0h+IUsWyvy1OpqCwxlQ/21gkhVunqlU8fDGcoTdcA=
+github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28=
+github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg=
+github.com/open-telemetry/opentelemetry-collector-contrib/internal/exp/metrics v0.148.0 h1:CiTjQE/Hh5xK2t56ogrDK4nl0+tJPNmASCs4zEYZ/xU=
+github.com/open-telemetry/opentelemetry-collector-contrib/internal/exp/metrics v0.148.0/go.mod h1:WUFkzTiOpt7EYyL67gv1GOf3RD8qKWGtin3lY9LYzW4=
+github.com/open-telemetry/opentelemetry-collector-contrib/pkg/pdatautil v0.148.0 h1:1TLg6YrS3Au6F7xw3ws2Njbwj13IMqPplvGFi+18fWs=
+github.com/open-telemetry/opentelemetry-collector-contrib/pkg/pdatautil v0.148.0/go.mod h1:P8hZEDIQk4REgUWyLhSVRHwTxK6KkifKfg36BmmQ/DI=
+github.com/open-telemetry/opentelemetry-collector-contrib/processor/deltatocumulativeprocessor v0.148.0 h1:xgD/kNGp/wWY+bwY599Pc01OamYN17phRiTP934bM5Y=
+github.com/open-telemetry/opentelemetry-collector-contrib/processor/deltatocumulativeprocessor v0.148.0/go.mod h1:ZK7wvaefla9lB3bAW0rNKt7IzRPcTRQoOFqr4sZy/XM=
+github.com/opencontainers/go-digest v0.0.0-20170106003457-a6d0ee40d420/go.mod h1:cMLVZDEM3+U2I4VmLI6N8jQYUd2OVphdqWwCJHrFt2s=
+github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
+github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
+github.com/opencontainers/image-spec v1.0.1/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
+github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
+github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
+github.com/opencontainers/runtime-spec v1.3.0 h1:YZupQUdctfhpZy3TM39nN9Ika5CBWT5diQ8ibYCRkxg=
+github.com/opencontainers/runtime-spec v1.3.0/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
+github.com/opencontainers/selinux v1.13.1 h1:A8nNeceYngH9Ow++M+VVEwJVpdFmrlxsN22F+ISDCJE=
+github.com/opencontainers/selinux v1.13.1/go.mod h1:S10WXZ/osk2kWOYKy1x2f/eXF5ZHJoUs8UU/2caNRbg=
+github.com/openshift/api v3.9.0+incompatible h1:fJ/KsefYuZAjmrr3+5U9yZIZbTOpVkDDLDLFresAeYs=
+github.com/openshift/api v3.9.0+incompatible/go.mod h1:dh9o4Fs58gpFXGSYfnVxGR9PnV53I8TW84pQaJDdGiY=
+github.com/opentracing/opentracing-go v1.1.0 h1:pWlfV3Bxv7k65HYwkikxat0+s3pV4bsqf19k25Ur8rU=
+github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
+github.com/orcaman/concurrent-map v1.0.0 h1:I/2A2XPCb4IuQWcQhBhSwGfiuybl/J0ev9HDbW65HOY=
+github.com/orcaman/concurrent-map v1.0.0/go.mod h1:Lu3tH6HLW3feq74c2GC+jIMS/K2CFcDWnWD9XkenwhI=
+github.com/ovh/go-ovh v1.9.0 h1:6K8VoL3BYjVV3In9tPJUdT7qMx9h0GExN9EXx1r2kKE=
+github.com/ovh/go-ovh v1.9.0/go.mod h1:cTVDnl94z4tl8pP1uZ/8jlVxntjSIf09bNcQ5TJSC7c=
+github.com/patrickmn/go-cache v2.1.0+incompatible h1:HRMgzkcYKYpi3C8ajMPV8OFXaaRUnok+kx1WdO15EQc=
+github.com/patrickmn/go-cache v2.1.0+incompatible/go.mod h1:3Qf8kWWT7OJRJbdiICTKqZju1ZixQ/KpMGzzAfe6+WQ=
+github.com/pborman/getopt v0.0.0-20170112200414-7148bc3a4c30/go.mod h1:85jBQOZwpVEaDAr341tbn15RS4fCAsIst0qp7i8ex1o=
+github.com/pelletier/go-toml v1.9.5 h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3ve8=
+github.com/pelletier/go-toml v1.9.5/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
+github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
+github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
+github.com/peterbourgon/diskv v2.0.1+incompatible h1:UBdAOUP5p4RWqPBg048CAvpKN+vxiaj6gdUUzhl4XmI=
+github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
+github.com/pjbgf/sha1cd v0.6.0 h1:3WJ8Wz8gvDz29quX1OcEmkAlUg9diU4GxJHqs0/XiwU=
+github.com/pjbgf/sha1cd v0.6.0/go.mod h1:lhpGlyHLpQZoxMv8HcgXvZEhcGs0PG/vsZnEJ7H0iCM=
+github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
+github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU=
+github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 h1:GFCKgmp0tecUJ0sJuv4pzYCqS9+RGSn52M3FUwPs+uo=
+github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/poy/onpar v1.1.2 h1:QaNrNiZx0+Nar5dLgTVp5mXkyoVFIbepjyEoGSnhbAY=
+github.com/poy/onpar v1.1.2/go.mod h1:6X8FLNoxyr9kkmnlqpK6LSoiOtrO6MICtWwEuWkLjzg=
+github.com/prometheus/alertmanager v0.31.1 h1:eAmIC42lzbWslHkMt693T36qdxfyZULswiHr681YS3Q=
+github.com/prometheus/alertmanager v0.31.1/go.mod h1:zWPQwhbLt2ybee8rL921UONeQ59Oncash+m/hGP17tU=
+github.com/prometheus/client_golang v0.9.0-pre1.0.20180209125602-c332b6f63c06/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
+github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
+github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
+github.com/prometheus/client_golang v1.1.0/go.mod h1:I1FGZT9+L76gKKOs5djB6ezCbFQP1xR9D75/vuwEF3g=
+github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=
+github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
+github.com/prometheus/client_golang/exp v0.0.0-20260325093428-d8591d0db856 h1:1Y6bmpZb8peQCy1IpctnAhIFuyhrdtMaDnETChhSNns=
+github.com/prometheus/client_golang/exp v0.0.0-20260325093428-d8591d0db856/go.mod h1:Vf0QcmVhGqpjLxZOaWrFSep86vchQtJmbztFaMM4f6Q=
+github.com/prometheus/client_model v0.0.0-20171117100541-99fa1f4be8e5/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
+github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
+github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
+github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
+github.com/prometheus/common v0.0.0-20180110214958-89604d197083/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
+github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
+github.com/prometheus/common v0.6.0/go.mod h1:eBmuwkDJBwy6iBfxCBob6t6dR6ENT/y+J+Zk0j9GMYc=
+github.com/prometheus/common v0.67.5 h1:pIgK94WWlQt1WLwAC5j2ynLaBRDiinoAb86HZHTUGI4=
+github.com/prometheus/common v0.67.5/go.mod h1:SjE/0MzDEEAyrdr5Gqc6G+sXI67maCxzaT3A2+HqjUw=
+github.com/prometheus/otlptranslator v1.0.0 h1:s0LJW/iN9dkIH+EnhiD3BlkkP5QVIUVEoIwkU+A6qos=
+github.com/prometheus/otlptranslator v1.0.0/go.mod h1:vRYWnXvI6aWGpsdY/mOT/cbeVRBlPWtBNDb7kGR3uKM=
+github.com/prometheus/procfs v0.0.0-20180125133057-cb4147076ac7/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
+github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
+github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
+github.com/prometheus/procfs v0.0.3/go.mod h1:4A/X28fw3Fc593LaREMrKMqOKvUAntwMDaekg4FpcdQ=
+github.com/prometheus/procfs v0.19.2 h1:zUMhqEW66Ex7OXIiDkll3tl9a1ZdilUOd/F6ZXw4Vws=
+github.com/prometheus/procfs v0.19.2/go.mod h1:M0aotyiemPhBCM0z5w87kL22CxfcH05ZpYlu+b4J7mw=
+github.com/prometheus/prometheus v0.311.3 h1:3IrVxQv6v5i/ZCGi6OrYeBhtCwaPTn6Z3DYruXoYm3M=
+github.com/prometheus/prometheus v0.311.3/go.mod h1:gjsCxTKtHO1Q8T9333u1s+lUR1OjPyM7ruuGH8RvVyo=
+github.com/prometheus/sigv4 v0.4.1 h1:EIc3j+8NBea9u1iV6O5ZAN8uvPq2xOIUPcqCTivHuXs=
+github.com/prometheus/sigv4 v0.4.1/go.mod h1:eu+ZbRvsc5TPiHwqh77OWuCnWK73IdkETYY46P4dXOU=
+github.com/puzpuzpuz/xsync/v4 v4.4.0 h1:vlSN6/CkEY0pY8KaB0yqo/pCLZvp9nhdbBdjipT4gWo=
+github.com/puzpuzpuz/xsync/v4 v4.4.0/go.mod h1:VJDmTCJMBt8igNxnkQd86r+8KUeN1quSfNKu5bLYFQo=
+github.com/quasilyte/go-ruleguard/dsl v0.3.23 h1:lxjt5B6ZCiBeeNO8/oQsegE6fLeCzuMRoVWSkXC4uvY=
+github.com/quasilyte/go-ruleguard/dsl v0.3.23/go.mod h1:KeCP03KrjuSO0H1kTuZQCWlQPulDV6YMIXmpQss17rU=
+github.com/redis/go-redis/extra/rediscmd/v9 v9.0.5 h1:EaDatTxkdHG+U3Bk4EUr+DZ7fOGwTfezUiUJMaIcaho=
+github.com/redis/go-redis/extra/rediscmd/v9 v9.0.5/go.mod h1:fyalQWdtzDBECAQFBJuQe5bzQ02jGd5Qcbgb97Flm7U=
+github.com/redis/go-redis/extra/redisotel/v9 v9.0.5 h1:EfpWLLCyXw8PSM2/XNJLjI3Pb27yVE+gIAfeqp8LUCc=
+github.com/redis/go-redis/extra/redisotel/v9 v9.0.5/go.mod h1:WZjPDy7VNzn77AAfnAfVjZNvfJTYfPetfZk5yoSTLaQ=
+github.com/redis/go-redis/v9 v9.7.3 h1:YpPyAayJV+XErNsatSElgRZZVCwXX9QzkKYNvO7x0wM=
+github.com/redis/go-redis/v9 v9.7.3/go.mod h1:bGUrSggJ9X9GUmZpZNEOQKaANxSGgOEBRltRTZHSvrA=
+github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
+github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
+github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
+github.com/robfig/cron/v3 v3.0.1 h1:WdRxkvbJztn8LMz/QEvLN5sBU+xKpSqwwUO1Pjr4qDs=
+github.com/robfig/cron/v3 v3.0.1/go.mod h1:eQICP3HwyT7UooqI/z+Ov+PtYAWygg1TEWWzGIFLtro=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/rs/xid v1.6.0/go.mod h1:7XoLgs4eV+QndskICGsho+ADou8ySMSjJKDIan90Nz0=
+github.com/rs/zerolog v1.34.0 h1:k43nTLIwcTVQAncfCw4KZ2VY6ukYoZaBPNOE8txlOeY=
+github.com/rs/zerolog v1.34.0/go.mod h1:bJsvje4Z08ROH4Nhs5iH600c3IkWhwp44iRc54W6wYQ=
+github.com/rubenv/sql-migrate v1.8.1 h1:EPNwCvjAowHI3TnZ+4fQu3a915OpnQoPAjTXCGOy2U0=
+github.com/rubenv/sql-migrate v1.8.1/go.mod h1:BTIKBORjzyxZDS6dzoiw6eAFYJ1iNlGAtjn4LGeVjS8=
+github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
+github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/sagikazarmark/locafero v0.4.0 h1:HApY1R9zGo4DBgr7dqsTH/JJxLTTsOt7u6keLGt6kNQ=
+github.com/sagikazarmark/locafero v0.4.0/go.mod h1:Pe1W6UlPYUk/+wc/6KFhbORCfqzgYEpgQ3O5fPuL3H4=
+github.com/sagikazarmark/slog-shim v0.1.0 h1:diDBnUNK9N/354PgrxMywXnAwEr1QZcOr6gto+ugjYE=
+github.com/sagikazarmark/slog-shim v0.1.0/go.mod h1:SrcSrq8aKtyuqEI1uvTDTK1arOWRIczQRv+GVI1AkeQ=
+github.com/samber/lo v1.52.0 h1:Rvi+3BFHES3A8meP33VPAxiBZX/Aws5RxrschYGjomw=
+github.com/samber/lo v1.52.0/go.mod h1:4+MXEGsJzbKGaUEQFKBq2xtfuznW9oz/WrgyzMzRoM0=
+github.com/samber/slog-common v0.20.0 h1:WaLnm/aCvBJSk5nR5aXZTFBaV0B47A+AEaEOiZDeUnc=
+github.com/samber/slog-common v0.20.0/go.mod h1:+Ozat1jgnnE59UAlmNX1IF3IByHsODnnwf9jUcBZ+m8=
+github.com/samber/slog-zerolog/v2 v2.9.1 h1:RMOq8XqzfuGx1X0TEIlS9OXbbFmqLY2/wJppghz66YY=
+github.com/samber/slog-zerolog/v2 v2.9.1/go.mod h1:DQYYve14WgCRN/XnKeHl4266jXK0DgYkYXkfZ4Fp98k=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
+github.com/scaleway/scaleway-sdk-go v1.0.0-beta.36 h1:ObX9hZmK+VmijreZO/8x9pQ8/P/ToHD/bdSb4Eg4tUo=
+github.com/scaleway/scaleway-sdk-go v1.0.0-beta.36/go.mod h1:LEsDu4BubxK7/cWhtlQWfuxwL4rf/2UEpxXz1o1EMtM=
+github.com/secure-systems-lab/go-securesystemslib v0.10.0 h1:l+H5ErcW0PAehBNrBxoGv1jjNpGYdZ9RcheFkB2WI14=
+github.com/secure-systems-lab/go-securesystemslib v0.10.0/go.mod h1:MRKONWmRoFzPNQ9USRF9i1mc7MvAVvF1LlW8X5VWDvk=
+github.com/segmentio/asm v1.1.3 h1:WM03sfUOENvvKexOLp+pCqgb/WDjsi7EK8gIsICtzhc=
+github.com/segmentio/asm v1.1.3/go.mod h1:Ld3L4ZXGNcSLRg4JBsZ3//1+f/TjYl0Mzen/DQy1EJg=
+github.com/segmentio/encoding v0.5.3 h1:OjMgICtcSFuNvQCdwqMCv9Tg7lEOXGwm1J5RPQccx6w=
+github.com/segmentio/encoding v0.5.3/go.mod h1:HS1ZKa3kSN32ZHVZ7ZLPLXWvOVIiZtyJnO1gPH1sKt0=
+github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw=
+github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
+github.com/serialx/hashring v0.0.0-20200727003509-22c0c7ab6b1b h1:h+3JX2VoWTFuyQEo87pStk/a99dzIO1mM9KxIyLPGTU=
+github.com/serialx/hashring v0.0.0-20200727003509-22c0c7ab6b1b/go.mod h1:/yeG0My1xr/u+HZrFQ1tOQQQQrOawfyMUH13ai5brBc=
+github.com/shibumi/go-pathspec v1.3.0 h1:QUyMZhFo0Md5B8zV8x2tesohbb5kfbpTi9rBnKh5dkI=
+github.com/shibumi/go-pathspec v1.3.0/go.mod h1:Xutfslp817l2I1cZvgcfeMQJG5QnU2lh5tVaaMCl3jE=
+github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp81k=
+github.com/shopspring/decimal v1.4.0/go.mod h1:gawqmDU56v4yIKSwfBSFip1HdCCXN8/+DMd9qYNcwME=
+github.com/sirupsen/logrus v1.0.6/go.mod h1:pMByvHTf9Beacp5x1UXfOR9xyW/9antXMhjMPG0dEzc=
+github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
+github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=
+github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
+github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
+github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
+github.com/skeema/knownhosts v1.3.1 h1:X2osQ+RAjK76shCbvhHHHVl3ZlgDm8apHEHFqRjnBY8=
+github.com/skeema/knownhosts v1.3.1/go.mod h1:r7KTdC8l4uxWRyK2TpQZ/1o5HaSzh06ePQNxPwTcfiY=
+github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 h1:JIAuq3EEf9cgbU6AtGPK4CTG3Zf6CKMNqf0MHTggAUA=
+github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966/go.mod h1:sUM3LWHvSMaG192sy56D9F7CNvL7jUJVXoqM1QKLnog=
+github.com/sourcegraph/conc v0.3.0 h1:OQTbbt6P72L20UqAkXXuLOj79LfEanQ+YQFNpLA9ySo=
+github.com/sourcegraph/conc v0.3.0/go.mod h1:Sdozi7LEKbFPqYX2/J+iBAM6HpqSLTASQIKqDmF7Mt0=
+github.com/spdx/tools-golang v0.5.5 h1:61c0KLfAcNqAjlg6UNMdkwpMernhw3zVRwDZ2x9XOmk=
+github.com/spdx/tools-golang v0.5.5/go.mod h1:MVIsXx8ZZzaRWNQpUDhC4Dud34edUYJYecciXgrw5vE=
+github.com/spf13/afero v1.11.0 h1:WJQKhtpdm3v2IzqG8VMqrr6Rf3UYpEF239Jy9wNepM8=
+github.com/spf13/afero v1.11.0/go.mod h1:GH9Y3pIexgf1MTIWtNGyogA5MwRIDXGUr+hbWNoBjkY=
+github.com/spf13/cast v0.0.0-20150508191742-4d07383ffe94/go.mod h1:r2rcYCSwa1IExKTDiTfzaxqT2FNHs8hODu4LnUfgKEg=
+github.com/spf13/cast v1.9.2 h1:SsGfm7M8QOFtEzumm7UZrZdLLquNdzFYfIbEXntcFbE=
+github.com/spf13/cast v1.9.2/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo=
+github.com/spf13/cobra v0.0.1/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
+github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
+github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
+github.com/spf13/jwalterweatherman v0.0.0-20141219030609-3d60171a6431/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
+github.com/spf13/pflag v1.0.0/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
+github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/viper v0.0.0-20150530192845-be5ff3e4840c/go.mod h1:A8kyI5cUJhb8N+3pkfONlcEcZbueH6nhAm0Fq7SrnBM=
+github.com/spf13/viper v1.18.2 h1:LUXCnvUvSM6FXAsj6nnfc8Q2tp1dIgUfY9Kc8GsSOiQ=
+github.com/spf13/viper v1.18.2/go.mod h1:EKmWIqdnk5lOcmR72yw6hS+8OPYcwD0jteitLMVB+yk=
+github.com/stackitcloud/stackit-sdk-go/core v0.23.0 h1:zPrOhf3Xe47rKRs1fg/AqKYUiJJRYjdcv+3qsS50mEs=
+github.com/stackitcloud/stackit-sdk-go/core v0.23.0/go.mod h1:osMglDby4csGZ5sIfhNyYq1bS1TxIdPY88+skE/kkmI=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
+github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
+github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
+github.com/tetratelabs/wabin v0.0.0-20230304001439-f6f874872834 h1:ZF+QBjOI+tILZjBaFj3HgFonKXUcwgJ4djLb6i42S3Q=
+github.com/tetratelabs/wabin v0.0.0-20230304001439-f6f874872834/go.mod h1:m9ymHTgNSEjuxvw8E7WWe4Pl4hZQHXONY8wE6dMLaRk=
+github.com/tetratelabs/wazero v1.11.0 h1:+gKemEuKCTevU4d7ZTzlsvgd1uaToIDtlQlmNbwqYhA=
+github.com/tetratelabs/wazero v1.11.0/go.mod h1:eV28rsN8Q+xwjogd7f4/Pp4xFxO7uOGbLcD/LzB1wiU=
+github.com/theupdateframework/notary v0.7.0 h1:QyagRZ7wlSpjT5N2qQAh/pN+DVqgekv4DzbAiAiEL3c=
+github.com/theupdateframework/notary v0.7.0/go.mod h1:c9DRxcmhHmVLDay4/2fUYdISnHqbFDGRSlXPO0AhYWw=
+github.com/tilt-dev/fsnotify v1.4.8-0.20220602155310-fff9c274a375 h1:QB54BJwA6x8QU9nHY3xJSZR2kX9bgpZekRKGkLTmEXA=
+github.com/tilt-dev/fsnotify v1.4.8-0.20220602155310-fff9c274a375/go.mod h1:xRroudyp5iVtxKqZCrA6n2TLFRBf8bmnjr1UD4x+z7g=
+github.com/tomasen/realip v0.0.0-20180522021738-f0c99a92ddce h1:fb190+cK2Xz/dvi9Hv8eCYJYvIGUTN2/KLq1pT6CjEc=
+github.com/tomasen/realip v0.0.0-20180522021738-f0c99a92ddce/go.mod h1:o8v6yHRoik09Xen7gje4m9ERNah1d1PPsVq1VEx9vE4=
+github.com/tonistiigi/dchapes-mode v0.0.0-20250318174251-73d941a28323 h1:r0p7fK56l8WPequOaR3i9LBqfPtEdXIQbUTzT55iqT4=
+github.com/tonistiigi/dchapes-mode v0.0.0-20250318174251-73d941a28323/go.mod h1:3Iuxbr0P7D3zUzBMAZB+ois3h/et0shEz0qApgHYGpY=
+github.com/tonistiigi/fsutil v0.0.0-20250605211040-586307ad452f h1:MoxeMfHAe5Qj/ySSBfL8A7l1V+hxuluj8owsIEEZipI=
+github.com/tonistiigi/fsutil v0.0.0-20250605211040-586307ad452f/go.mod h1:BKdcez7BiVtBvIcef90ZPc6ebqIWr4JWD7+EvLm6J98=
+github.com/tonistiigi/go-csvvalue v0.0.0-20240814133006-030d3b2625d0 h1:2f304B10LaZdB8kkVEaoXvAMVan2tl9AiK4G0odjQtE=
+github.com/tonistiigi/go-csvvalue v0.0.0-20240814133006-030d3b2625d0/go.mod h1:278M4p8WsNh3n4a1eqiFcV2FGk7wE5fwUpUom9mK9lE=
+github.com/tonistiigi/units v0.0.0-20180711220420-6950e57a87ea h1:SXhTLE6pb6eld/v/cCndK0AMpt1wiVFb/YYmqB3/QG0=
+github.com/tonistiigi/units v0.0.0-20180711220420-6950e57a87ea/go.mod h1:WPnis/6cRcDZSUvVmezrxJPkiO87ThFYsoUiMwWNDJk=
+github.com/tonistiigi/vt100 v0.0.0-20240514184818-90bafcd6abab h1:H6aJ0yKQ0gF49Qb2z5hI1UHxSQt4JMyxebFR15KnApw=
+github.com/tonistiigi/vt100 v0.0.0-20240514184818-90bafcd6abab/go.mod h1:ulncasL3N9uLrVann0m+CDlJKWsIAP34MPcOJF6VRvc=
+github.com/ulikunitz/xz v0.5.15 h1:9DNdB5s+SgV3bQ2ApL10xRc35ck0DuIX/isZvIk+ubY=
+github.com/ulikunitz/xz v0.5.15/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
+github.com/vbatts/tar-split v0.12.1 h1:CqKoORW7BUWBe7UL/iqTVvkTBOF8UvOMKOIZykxnnbo=
+github.com/vbatts/tar-split v0.12.1/go.mod h1:eF6B6i6ftWQcDqEn3/iGFRFRo8cBIMSJVOpnNdfTMFA=
+github.com/viney-shih/go-lock v1.1.1 h1:SwzDPPAiHpcwGCr5k8xD15d2gQSo8d4roRYd7TDV2eI=
+github.com/viney-shih/go-lock v1.1.1/go.mod h1:Yijm78Ljteb3kRiJrbLAxVntkUukGu5uzSxq/xV7OO8=
+github.com/vultr/govultr/v3 v3.28.1 h1:KR3LhppYARlBujY7+dcrE7YKL0Yo9qXL+msxykKQrLI=
+github.com/vultr/govultr/v3 v3.28.1/go.mod h1:2zyUw9yADQaGwKnwDesmIOlBNLrm7edsCfWHFJpWKf8=
+github.com/weppos/publicsuffix-go v0.15.1-0.20210511084619-b1f36a2d6c0b h1:FsyNrX12e5BkplJq7wKOLk0+C6LZ+KGXvuEcKUYm5ss=
+github.com/weppos/publicsuffix-go v0.15.1-0.20210511084619-b1f36a2d6c0b/go.mod h1:HYux0V0Zi04bHNwOHy4cXJVz/TQjYonnF6aoYhj+3QE=
+github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
+github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
+github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM=
+github.com/xanzy/ssh-agent v0.3.3/go.mod h1:6dzNDKs0J9rVPHPhaGCukekBHKqfl+L3KghI1Bc68Uw=
+github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
+github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb h1:zGWFAtiMcyryUHoUjUJX0/lt1H2+i2Ka2n+D3DImSNo=
+github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
+github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0=
+github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
+github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17UxZ74=
+github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y=
+github.com/xhit/go-str2duration/v2 v2.1.0 h1:lxklc02Drh6ynqX+DdPyp5pCKLUQpRT8bp8Ydu2Bstc=
+github.com/xhit/go-str2duration/v2 v2.1.0/go.mod h1:ohY8p+0f07DiV6Em5LKB0s2YpLtXVyJfNt1+BlmyAsU=
+github.com/xlab/treeprint v1.2.0 h1:HzHnuAF1plUN2zGlAFHbSQP2qJ0ZAD3XF5XD7OesXRQ=
+github.com/xlab/treeprint v1.2.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd/WEJu0=
+github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+github.com/zclconf/go-cty v1.17.0 h1:seZvECve6XX4tmnvRzWtJNHdscMtYEx5R7bnnVyd/d0=
+github.com/zclconf/go-cty v1.17.0/go.mod h1:wqFzcImaLTI6A5HfsRwB0nj5n0MRZFwmey8YoFPPs3U=
+github.com/zmap/zcrypto v0.0.0-20210511125630-18f1e0152cfc h1:zkGwegkOW709y0oiAraH/3D8njopUR/pARHv4tZZ6pw=
+github.com/zmap/zcrypto v0.0.0-20210511125630-18f1e0152cfc/go.mod h1:FM4U1E3NzlNMRnSUTU3P1UdukWhYGifqEsjk9fn7BCk=
+github.com/zmap/zlint/v3 v3.1.0 h1:WjVytZo79m/L1+/Mlphl09WBob6YTGljN5IGWZFpAv0=
+github.com/zmap/zlint/v3 v3.1.0/go.mod h1:L7t8s3sEKkb0A2BxGy1IWrxt1ZATa1R4QfJZaQOD3zU=
+go.etcd.io/bbolt v1.5.0 h1:S7GAl7Fxv12yohbwFfIbQCGDWbQbtDGPET4P/bD4lxU=
+go.etcd.io/bbolt v1.5.0/go.mod h1:mkltfYE5aUHQxUct9N9V+Kp7aSjFqjgrhcXIS70Lrdk=
+go.etcd.io/etcd/client/pkg/v3 v3.5.6/go.mod h1:ggrwbk069qxpKPq8/FKkQ3Xq9y39kbFR4LnKszpRXeQ=
+go.etcd.io/etcd/raft/v3 v3.5.6 h1:tOmx6Ym6rn2GpZOrvTGJZciJHek6RnC3U/zNInzIN50=
+go.etcd.io/etcd/raft/v3 v3.5.6/go.mod h1:wL8kkRGx1Hp8FmZUuHfL3K2/OaGIDaXGr1N7i2G07J0=
+go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
+go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
+go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
+go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
+go.opentelemetry.io/collector/component v1.54.0 h1:LvtX0Tzz18n44OrUFVk77N1FNsejfWJqztB28hrmDM8=
+go.opentelemetry.io/collector/component v1.54.0/go.mod h1:yUMBYsySY/sDcXm8kOzEoZxt+JLdala6hxzSW0npOxY=
+go.opentelemetry.io/collector/confmap v1.54.0 h1:RUoxQ4uAYHTI57GfHh61D00tTQsXm9T88ozrAiicByc=
+go.opentelemetry.io/collector/confmap v1.54.0/go.mod h1:mQxG8bk0IWIt9gbWMvzE+cRkOuCuzbzkNGBq2YJ4wNM=
+go.opentelemetry.io/collector/confmap/xconfmap v0.148.0 h1:UW8MX5VlKJf67x4Et7J9kPwP9Rv4VSmJ+UUpgRcb//c=
+go.opentelemetry.io/collector/confmap/xconfmap v0.148.0/go.mod h1:4qTMr3V0uSXXac9wVs/UD5fIqRKw5yIl58+Vjsc6RHM=
+go.opentelemetry.io/collector/consumer v1.54.0 h1:RGGtUN+GbkV1px3T6XdUHmgJ+ldJ1hAHdesFzW/wgL0=
+go.opentelemetry.io/collector/consumer v1.54.0/go.mod h1:1PC6XINTL9DdT1bwvfMdHE72EB4RWU/WcPemUrhqKN8=
+go.opentelemetry.io/collector/featuregate v1.54.0 h1:ufo5Hy4Co9pcHVg24hyanm8qFG3TkkYbVyQXPVAbwDc=
+go.opentelemetry.io/collector/featuregate v1.54.0/go.mod h1:PS7zY/zaCb28EqciePVwRHVhc3oKortTFXsi3I6ee4g=
+go.opentelemetry.io/collector/internal/componentalias v0.148.0 h1:Y6MftNIZSzOr47TTj6A2z2UR3IwbeG46sAQshicGtDg=
+go.opentelemetry.io/collector/internal/componentalias v0.148.0/go.mod h1:uwKzfehzwRgHxdHgFXYSBHNBeWSSqsqQYGWr5fk08G0=
+go.opentelemetry.io/collector/pdata v1.54.0 h1:3LharKb792cQ3VrUGxd3IcpWwfu3ST+GSTU382jVz1s=
+go.opentelemetry.io/collector/pdata v1.54.0/go.mod h1:+MqC3VVOv/EX9YVFUo+mI4F0YmwJ+fXBYwjmu+mRiZ8=
+go.opentelemetry.io/collector/pipeline v1.54.0 h1:jYlCkdFLITVBdeB+IGS07zXWywEgvT3Ky46vdKKT+Ks=
+go.opentelemetry.io/collector/pipeline v1.54.0/go.mod h1:RD90NG3Jbk965Xaqym3JyHkuol4uZJjQVUkD9ddXJIs=
+go.opentelemetry.io/collector/processor v1.54.0 h1:zmHBFiEFmU9ZYuHhVP3lHIkbfy+ueapzGpTdXVMcWBg=
+go.opentelemetry.io/collector/processor v1.54.0/go.mod h1:L0lA6DZ0VbrtQBg44cmYfSpRlgm4zxW1I6QfBnRizPw=
+go.opentelemetry.io/contrib/bridges/prometheus v0.65.0 h1:I/7S/yWobR3QHFLqHsJ8QOndoiFsj1VgHpQiq43KlUI=
+go.opentelemetry.io/contrib/bridges/prometheus v0.65.0/go.mod h1:jPF6gn3y1E+nozCAEQj3c6NZ8KY+tvAgSVfvoOJUFac=
+go.opentelemetry.io/contrib/exporters/autoexport v0.65.0 h1:2gApdml7SznX9szEKFjKjM4qGcGSvAybYLBY319XG3g=
+go.opentelemetry.io/contrib/exporters/autoexport v0.65.0/go.mod h1:0QqAGlbHXhmPYACG3n5hNzO5DnEqqtg4VcK5pr22RI0=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0 h1:0Qx7VGBacMm9ZENQ7TnNObTYI4ShC+lHI16seduaxZo=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0/go.mod h1:Sje3i3MjSPKTSPvVWCaL8ugBzJwik3u4smCjUeuupqg=
+go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.68.0 h1:cuXaPAfIoJKsYjBjPSb2nKZEmgM43zVr25l37IxhKME=
+go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.68.0/go.mod h1:BuzhPofpCzlDi/Q/Xjg54M4/3oWqqyDe2Zeq7A2I0QE=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 h1:CqXxU8VOmDefoh0+ztfGaymYbhdB/tT3zs79QaZTNGY=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0/go.mod h1:BuhAPThV8PBHBvg8ZzZ/Ok3idOdhWIodywz2xEcRbJo=
+go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
+go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.16.0 h1:ZVg+kCXxd9LtAaQNKBxAvJ5NpMf7LpvEr4MIZqb0TMQ=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.16.0/go.mod h1:hh0tMeZ75CCXrHd9OXRYxTlCAdxcXioWHFIpYw2rZu8=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.16.0 h1:djrxvDxAe44mJUrKataUbOhCKhR3F8QCyWucO16hTQs=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.16.0/go.mod h1:dt3nxpQEiSoKvfTVxp3TUg5fHPLhKtbcnN3Z1I1ePD0=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.43.0 h1:8UQVDcZxOJLtX6gxtDt3vY2WTgvZqMQRzjsqiIHQdkc=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.43.0/go.mod h1:2lmweYCiHYpEjQ/lSJBYhj9jP1zvCvQW4BqL9dnT7FQ=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0 h1:w1K+pCJoPpQifuVpsKamUdn9U0zM3xUziVOqsGksUrY=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0/go.mod h1:HBy4BjzgVE8139ieRI75oXm3EcDN+6GhD88JT1Kjvxg=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 h1:88Y4s2C8oTui1LGM6bTWkw0ICGcOLCAI5l6zsD1j20k=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0/go.mod h1:Vl1/iaggsuRlrHf/hfPJPvVag77kKyvrLeD10kpMl+A=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0 h1:RAE+JPfvEmvy+0LzyUA25/SGawPwIUbZ6u0Wug54sLc=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0/go.mod h1:AGmbycVGEsRx9mXMZ75CsOyhSP6MFIcj/6dnG+vhVjk=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 h1:3iZJKlCZufyRzPzlQhUIWVmfltrXuGyfjREgGP3UUjc=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0/go.mod h1:/G+nUPfhq2e+qiXMGxMwumDrP5jtzU+mWN7/sjT2rak=
+go.opentelemetry.io/otel/exporters/prometheus v0.62.0 h1:krvC4JMfIOVdEuNPTtQ0ZjCiXrybhv+uOHMfHRmnvVo=
+go.opentelemetry.io/otel/exporters/prometheus v0.62.0/go.mod h1:fgOE6FM/swEnsVQCqCnbOfRV4tOnWPg7bVeo4izBuhQ=
+go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.16.0 h1:ivlbaajBWJqhcCPniDqDJmRwj4lc6sRT+dCAVKNmxlQ=
+go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.16.0/go.mod h1:u/G56dEKDDwXNCVLsbSrllB2o8pbtFLUC4HpR66r2dc=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.40.0 h1:ZrPRak/kS4xI3AVXy8F7pipuDXmDsrO8Lg+yQjBLjw0=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.40.0/go.mod h1:3y6kQCWztq6hyW8Z9YxQDDm0Je9AJoFar2G0yDcmhRk=
+go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.40.0 h1:MzfofMZN8ulNqobCmCAVbqVL5syHw+eB2qPRkCMA/fQ=
+go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.40.0/go.mod h1:E73G9UFtKRXrxhBsHtG00TB5WxX57lpsQzogDkqBTz8=
+go.opentelemetry.io/otel/log v0.16.0 h1:DeuBPqCi6pQwtCK0pO4fvMB5eBq6sNxEnuTs88pjsN4=
+go.opentelemetry.io/otel/log v0.16.0/go.mod h1:rWsmqNVTLIA8UnwYVOItjyEZDbKIkMxdQunsIhpUMes=
+go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
+go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
+go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
+go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg=
+go.opentelemetry.io/otel/sdk/log v0.16.0 h1:e/b4bdlQwC5fnGtG3dlXUrNOnP7c8YLVSpSfEBIkTnI=
+go.opentelemetry.io/otel/sdk/log v0.16.0/go.mod h1:JKfP3T6ycy7QEuv3Hj8oKDy7KItrEkus8XJE6EoSzw4=
+go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=
+go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
+go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
+go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
+go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g=
+go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk=
+go.podman.io/image/v5 v5.37.0 h1:yzgQybwuWIIeK63hu+mQqna/wOh96XD5cpVc6j8Dg5M=
+go.podman.io/image/v5 v5.37.0/go.mod h1:+s2Sx5dia/jVeT8tI3r2NAPrARMiDdbEq3QPIQogx3I=
+go.podman.io/storage v1.60.0 h1:bWNSrR58nxg39VNFDSx3m0AswbvyzPGOo5XsUfomTao=
+go.podman.io/storage v1.60.0/go.mod h1:NK+rsWJVuQeCM7ifv7cxD3abegWxwtW/3OkuSUJJoE4=
+go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
+go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
+go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y=
+go.uber.org/mock v0.6.0/go.mod h1:KiVJ4BqZJaMj4svdfmHM0AUx4NJYO8ZNpPnZn1Z+BBU=
+go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
+go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
+go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
+go.uber.org/zap v1.17.0/go.mod h1:MXVU+bhUf/A7Xi2HNOnopQOrmycQ5Ih87HtOu4q5SSo=
+go.uber.org/zap v1.27.1 h1:08RqriUEv8+ArZRYSTXy1LeBScaMpVSTBhCeaZYfMYc=
+go.uber.org/zap v1.27.1/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
+go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
+go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20190325154230-a5d413f7728c/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20200302210943-78000ba7a073/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20201117144127-c1f2f97bffc9/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
+golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
+golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
+golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
+golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
+golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
+golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
+golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
+golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
+golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
+golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190801041406-cbf593c0f2f3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210331175145-43e1dd70ce54/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210403161142-5e06dd20ab57/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220405052023-b1e9470b6e64/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220412211240-33da011f77ad/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
+golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
+golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
+golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
+golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
+golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
+golang.org/x/tools/godoc v0.1.0-deprecated h1:o+aZ1BOj6Hsx/GBdJO/s815sqftjSnrZZwyYTHODvtk=
+golang.org/x/tools/godoc v0.1.0-deprecated/go.mod h1:qM63CriJ961IHWmnWa9CjZnBndniPt4a3CK0PVB9bIg=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
+gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
+google.golang.org/api v0.272.0 h1:eLUQZGnAS3OHn31URRf9sAmRk3w2JjMx37d2k8AjJmA=
+google.golang.org/api v0.272.0/go.mod h1:wKjowi5LNJc5qarNvDCvNQBn3rVK8nSy6jg2SwRwzIA=
+google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 h1:VPWxll4HlMw1Vs/qXtN7BvhZqsS9cdAittCNvVENElA=
+google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9/go.mod h1:7QBABkRtR8z+TEnmXTqIqwJLlzrZKVfAUm7tY3yGv0M=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d h1:wT2n40TBqFY6wiwazVK9/iTWbsQrgk5ZfCSVFLO9LQA=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/grpc v1.0.5/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
+google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM=
+google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4=
+google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
+google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+gopkg.in/airbrake/gobrake.v2 v2.0.9/go.mod h1:/h5ZAUhDkGaJfjzjKLSjv6zCL6O0LLBxU4K+aSYdM/U=
+gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
+gopkg.in/cenkalti/backoff.v2 v2.2.1 h1:eJ9UAg01/HIHG987TwxvnzK2MgxXq97YY6rYDpY9aII=
+gopkg.in/cenkalti/backoff.v2 v2.2.1/go.mod h1:S0QdOvT2AlerfSBkp0O+dk+bbIMaNbEmVk876gPCthU=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/evanphx/json-patch.v4 v4.13.0 h1:czT3CmqEaQ1aanPc5SdlgQrrEIb8w/wwCvWWnfEbYzo=
+gopkg.in/evanphx/json-patch.v4 v4.13.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
+gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
+gopkg.in/gemnasium/logrus-airbrake-hook.v2 v2.1.2/go.mod h1:Xk6kEKp8OKb+X14hQBKWaSkCsqBpgog8nAV2xsGOxlo=
+gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
+gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
+gopkg.in/ini.v1 v1.67.1 h1:tVBILHy0R6e4wkYOn3XmiITt/hEVH4TFMYvAX2Ytz6k=
+gopkg.in/ini.v1 v1.67.1/go.mod h1:x/cyOwCgZqOkJoDIJ3c1KNHMo10+nLGAhh+kn3Zizss=
+gopkg.in/rethinkdb/rethinkdb-go.v6 v6.2.1 h1:d4KQkxAaAiRY2h5Zqis161Pv91A37uZyJOx73duwUwM=
+gopkg.in/rethinkdb/rethinkdb-go.v6 v6.2.1/go.mod h1:WbjuEoo1oadwzQ4apSDU+JTvmllEHtsNHS6y7vFc7iw=
+gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
+gopkg.in/warnings.v0 v0.1.2 h1:wFXVbFY8DY5/xOe1ECiWdKCzZlxgshcYVNkBHstARME=
+gopkg.in/warnings.v0 v0.1.2/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI=
+gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
+gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
+helm.sh/helm/v4 v4.1.4 h1:zwTrNkalG4f7SYigRSdQnYrTj0QEz1qzetzAlYoDVSo=
+helm.sh/helm/v4 v4.1.4/go.mod h1:5dSo8rRgn3OTkDAc/k0Ipw5/Q+BlqKIKZwa0XwSiINI=
+k8s.io/api v0.35.3 h1:pA2fiBc6+N9PDf7SAiluKGEBuScsTzd2uYBkA5RzNWQ=
+k8s.io/api v0.35.3/go.mod h1:9Y9tkBcFwKNq2sxwZTQh1Njh9qHl81D0As56tu42GA4=
+k8s.io/apiextensions-apiserver v0.35.1 h1:p5vvALkknlOcAqARwjS20kJffgzHqwyQRM8vHLwgU7w=
+k8s.io/apiextensions-apiserver v0.35.1/go.mod h1:2CN4fe1GZ3HMe4wBr25qXyJnJyZaquy4nNlNmb3R7AQ=
+k8s.io/apimachinery v0.35.3 h1:MeaUwQCV3tjKP4bcwWGgZ/cp/vpsRnQzqO6J6tJyoF8=
+k8s.io/apimachinery v0.35.3/go.mod h1:jQCgFZFR1F4Ik7hvr2g84RTJSZegBc8yHgFWKn//hns=
+k8s.io/apiserver v0.35.1 h1:potxdhhTL4i6AYAa2QCwtlhtB1eCdWQFvJV6fXgJzxs=
+k8s.io/apiserver v0.35.1/go.mod h1:BiL6Dd3A2I/0lBnteXfWmCFobHM39vt5+hJQd7Lbpi4=
+k8s.io/cli-runtime v0.35.1 h1:uKcXFe8J7AMAM4Gm2JDK4mp198dBEq2nyeYtO+JfGJE=
+k8s.io/cli-runtime v0.35.1/go.mod h1:55/hiXIq1C8qIJ3WBrWxEwDLdHQYhBNRdZOz9f7yvTw=
+k8s.io/client-go v0.35.3 h1:s1lZbpN4uI6IxeTM2cpdtrwHcSOBML1ODNTCCfsP1pg=
+k8s.io/client-go v0.35.3/go.mod h1:RzoXkc0mzpWIDvBrRnD+VlfXP+lRzqQjCmKtiwZ8Q9c=
+k8s.io/component-base v0.35.1 h1:XgvpRf4srp037QWfGBLFsYMUQJkE5yMa94UsJU7pmcE=
+k8s.io/component-base v0.35.1/go.mod h1:HI/6jXlwkiOL5zL9bqA3en1Ygv60F03oEpnuU1G56Bs=
+k8s.io/component-helpers v0.35.1 h1:vwQ/cAfnVwaPeSXTu4DdK3d3n11Lugc5vMb6EV809ZY=
+k8s.io/component-helpers v0.35.1/go.mod h1:HQqMwUk68Yyxgj92dJ+J1w/qbx9M0QR0eZ680m/o+Rk=
+k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=
+k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0=
+k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 h1:Y3gxNAuB0OBLImH611+UDZcmKS3g6CthxToOb37KgwE=
+k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912/go.mod h1:kdmbQkyfwUagLfXIad1y2TdrjPFWp2Q89B3qkRwf/pQ=
+k8s.io/kubectl v0.35.1 h1:zP3Er8C5i1dcAFUMh9Eva0kVvZHptXIn/+8NtRWMxwg=
+k8s.io/kubectl v0.35.1/go.mod h1:cQ2uAPs5IO/kx8R5s5J3Ihv3VCYwrx0obCXum0CvnXo=
+k8s.io/metrics v0.35.1 h1:MUcrUcWlq81XiripkydzCGsY9zQawDXfP9IICNNcVVw=
+k8s.io/metrics v0.35.1/go.mod h1:9x7xWOAOiWzHA0vaqLgSE4PXF3vyT5ts5XIbx8OSjiI=
+k8s.io/utils v0.0.0-20260108192941-914a6e750570 h1:JT4W8lsdrGENg9W+YwwdLJxklIuKWdRm+BC+xt33FOY=
+k8s.io/utils v0.0.0-20260108192941-914a6e750570/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
+oras.land/oras-go/v2 v2.6.0 h1:X4ELRsiGkrbeox69+9tzTu492FMUu7zJQW6eJU+I2oc=
+oras.land/oras-go/v2 v2.6.0/go.mod h1:magiQDfG6H1O9APp+rOsvCPcW1GD2MM7vgnKY0Y+u1o=
+sigs.k8s.io/controller-runtime v0.23.1 h1:TjJSM80Nf43Mg21+RCy3J70aj/W6KyvDtOlpKf+PupE=
+sigs.k8s.io/controller-runtime v0.23.1/go.mod h1:B6COOxKptp+YaUT5q4l6LqUJTRpizbgf9KSRNdQGns0=
+sigs.k8s.io/gateway-api v1.5.1 h1:RqVRIlkhLhUO8wOHKTLnTJA6o/1un4po4/6M1nRzdd0=
+sigs.k8s.io/gateway-api v1.5.1/go.mod h1:GvCETiaMAlLym5CovLxGjS0NysqFk3+Yuq3/rh6QL2o=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
+sigs.k8s.io/kustomize/api v0.21.1 h1:lzqbzvz2CSvsjIUZUBNFKtIMsEw7hVLJp0JeSIVmuJs=
+sigs.k8s.io/kustomize/api v0.21.1/go.mod h1:f3wkKByTrgpgltLgySCntrYoq5d3q7aaxveSagwTlwI=
+sigs.k8s.io/kustomize/kyaml v0.21.1 h1:IVlbmhC076nf6foyL6Taw4BkrLuEsXUXNpsE+ScX7fI=
+sigs.k8s.io/kustomize/kyaml v0.21.1/go.mod h1:hmxADesM3yUN2vbA5z1/YTBnzLJ1dajdqpQonwBL1FQ=
+sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
+sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.2 h1:kwVWMx5yS1CrnFWA/2QHyRVJ8jM6dBA80uLmm0wJkk8=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.2/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
+tags.cncf.io/container-device-interface v1.1.0 h1:RnxNhxF1JOu6CJUVpetTYvrXHdxw9j9jFYgZpI+anSY=
+tags.cncf.io/container-device-interface v1.1.0/go.mod h1:76Oj0Yqp9FwTx/pySDc8Bxjpg+VqXfDb50cKAXVJ34Q=
diff --git a/jsconfig.json b/jsconfig.json
new file mode 100644
index 0000000..3f71532
--- /dev/null
+++ b/jsconfig.json
@@ -0,0 +1,9 @@
+{
+  "compilerOptions": {
+    "target": "es2017",
+    "allowSyntheticDefaultImports": false,
+    "module": "commonjs"
+  },
+
+  "extends": "./tsconfig.json"
+}
diff --git a/lint-staged.config.js b/lint-staged.config.js
new file mode 100644
index 0000000..b86b7bb
--- /dev/null
+++ b/lint-staged.config.js
@@ -0,0 +1,6 @@
+module.exports = {
+  '*.(js|ts){,x}': 'pnpm eslint --cache --fix',
+  '*.(ts){,x}': () => 'tsc --noEmit',
+  '*.{js,ts,tsx,css,md,html,json}': 'pnpm prettier --log-level warn --write',
+  '*.go': () => ['make lint-server', 'make docs-sync-check'],
+};
diff --git a/mustache-templates/upgrade-docker.yml.mustache b/mustache-templates/upgrade-docker.yml.mustache
new file mode 100644
index 0000000..aace62e
--- /dev/null
+++ b/mustache-templates/upgrade-docker.yml.mustache
@@ -0,0 +1,19 @@
+services:
+  updater:
+    network_mode: none
+    image: {{updater_image}}{{^updater_image}}portainer/portainer-updater:latest{{/updater_image}}
+    labels:
+      - io.portainer.hideStack=true 
+      - io.portainer.updater=true 
+    command: ["portainer", 
+      "--image", "{{image}}{{^image}}portainer/portainer-ee:latest{{/image}}",
+      "--env-type", "{{envType}}{{^envType}}standalone{{/envType}}",
+      "--license", "{{license}}"
+    ]
+    {{#skip_pull_image}}
+    environment:
+      - SKIP_PULL=1
+    {{/skip_pull_image}}
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      {{! - \\.\pipe\docker_engine:\\.\pipe\docker_engine }}
\ No newline at end of file
diff --git a/openapi-ts.config.ts b/openapi-ts.config.ts
new file mode 100644
index 0000000..bc11032
--- /dev/null
+++ b/openapi-ts.config.ts
@@ -0,0 +1,57 @@
+import { defineConfig } from '@hey-api/openapi-ts';
+
+export default defineConfig({
+  input: './api/docs/openapi.yaml',
+  output: {
+    path: 'app/react/portainer/generated-api/portainer',
+    clean: true,
+    entryFile: false,
+  },
+  parser: {
+    filters: {
+      tags: {
+        exclude: ['edge_agent'],
+      },
+      deprecated: false,
+    },
+  },
+  plugins: [
+    {
+      enums: 'javascript',
+      name: '@hey-api/typescript',
+    },
+    {
+      name: '@hey-api/sdk',
+      validator: true,
+    },
+    {
+      name: '@hey-api/client-axios',
+      runtimeConfigPath: '@/react/portainer/services/axios/configure-hey-api',
+      baseUrl: 'api',
+      throwOnError: true,
+    },
+    {
+      name: 'zod',
+      // Upstream bug: format: binary falls through to z.string() because
+      // the formatNode switch has no 'binary' case. This resolver patches
+      // it globally to match the TypeScript plugin's Blob | File output.
+      // Remove once https://github.com/hey-api/openapi-ts/pull/3627 is
+      // merged and released.
+      '~resolvers': {
+        string({ $, schema, symbols }) {
+          if (schema.format === 'binary') {
+            const { z } = symbols;
+            return $(z)
+              .attr('union')
+              .call(
+                $.array(
+                  $(z).attr('instanceof').call($('Blob')),
+                  $(z).attr('instanceof').call($('File'))
+                )
+              );
+          }
+        },
+      },
+    },
+  ],
+});
diff --git a/package.json b/package.json
new file mode 100644
index 0000000..fe3bbaa
--- /dev/null
+++ b/package.json
@@ -0,0 +1,272 @@
+{
+  "author": "Portainer.io",
+  "name": "@portainer/ce",
+  "homepage": "http://portainer.io",
+  "version": "2.43.0",
+  "repository": {
+    "type": "git",
+    "url": "git@github.com:portainer/portainer.git"
+  },
+  "bugs": {
+    "url": "https://github.com/portainer/portainer/issues"
+  },
+  "licenses": [
+    {
+      "type": "Zlib",
+      "url": "https://raw.githubusercontent.com/portainer/portainer/develop/LICENSE"
+    }
+  ],
+  "scripts": {
+    "dev": "webpack-dev-server",
+    "start": "webpack -w",
+    "build": "webpack",
+    "format": "prettier --log-level warn --write  \"**/*.{js,css,html,jsx,tsx,ts}\"",
+    "lint": "eslint --cache --fix \"./**/*.{js,jsx,ts,tsx}\"",
+    "test": "vitest run",
+    "sb": "pnpm run storybook",
+    "storybook": "storybook dev -p 6006",
+    "storybook:build": "storybook build -o ./dist/storybook",
+    "analyze-webpack": "webpack --config ./webpack/webpack.analyze.js",
+    "typecheck": "tsc --noEmit",
+    "generate-api": "openapi-ts",
+    "postgenerate-api": "pnpm format"
+  },
+  "engines": {
+    "node": "^22.22.1"
+  },
+  "packageManager": "pnpm@10.26.2",
+  "dependencies": {
+    "@aws-crypto/sha256-js": "^2.0.0",
+    "@codemirror/autocomplete": "^6.20.2",
+    "@codemirror/commands": "^6.10.3",
+    "@codemirror/language": "^6.12.3",
+    "@codemirror/legacy-modes": "^6.5.3",
+    "@codemirror/lint": "^6.9.6",
+    "@codemirror/search": "^6.7.0",
+    "@codemirror/state": "^6.6.0",
+    "@codemirror/theme-one-dark": "^6.1.3",
+    "@codemirror/view": "^6.43.0",
+    "@lezer/common": "^1.0.2",
+    "@lezer/highlight": "^1.1.3",
+    "@nxmix/tokenize-ansi": "^3.0.0",
+    "@radix-ui/react-dialog": "^1.1.1",
+    "@radix-ui/react-slot": "^1.2.4",
+    "@reach/combobox": "^0.18.0",
+    "@reach/dialog": "^0.17.0",
+    "@reach/menu-button": "^0.16.1",
+    "@reach/popover": "^0.18.0",
+    "@tanstack/react-query": "4",
+    "@tanstack/react-query-devtools": "4",
+    "@tanstack/react-table": "^8.8.5",
+    "@tippyjs/react": "^4.2.6",
+    "@uirouter/angularjs": "1.0.11",
+    "@uirouter/react": "^1.0.7",
+    "@uirouter/react-hybrid": "^1.0.4",
+    "@uiw/codemirror-themes": "^4.25.10",
+    "@uiw/react-codemirror": "^4.25.10",
+    "@wojtekmaj/react-daterange-picker": "^5.5.0",
+    "@xterm/addon-fit": "^0.11.0",
+    "@xterm/xterm": "^6.0.0",
+    "angular": "1.8.2",
+    "angular-clipboard": "^1.6.2",
+    "angular-file-saver": "^1.1.3",
+    "angular-loading-bar": "~0.9.0",
+    "angular-local-storage": "~0.5.2",
+    "angular-messages": "1.8.2",
+    "angular-mocks": "1.8.2",
+    "angular-resource": "1.8.2",
+    "angular-sanitize": "1.8.2",
+    "angular-ui-bootstrap": "~2.5.0",
+    "angularjs-scroll-glue": "^2.2.0",
+    "angularjs-slider": "^6.4.0",
+    "axios": "^1.18.0",
+    "axios-cache-interceptor": "^1.11.2",
+    "axios-progress-bar": "git://github.com/portainer/progress-bar-4-axios",
+    "babel-plugin-angularjs-annotate": "^0.10.0",
+    "bootstrap": "^3.4.0",
+    "buffer": "^6.0.3",
+    "c8": "^9.1.0",
+    "chardet": "^1.4.0",
+    "chart.js": "^2.9.4",
+    "class-variance-authority": "^0.7.0",
+    "clsx": "^1.1.1",
+    "codemirror": "^6.0.1",
+    "codemirror-json-schema": "^0.8.1",
+    "core-js": "^3.19.3",
+    "date-fns": "^2.29.3",
+    "docker-types": "~1.47",
+    "fast-json-patch": "^3.1.1",
+    "file-saver": "^2.0.5",
+    "filesize": "^10.1.6",
+    "filesize-parser": "^1.5.0",
+    "formik": "^2.4.9",
+    "globals": "^15.15.0",
+    "i18next": "^21.3.3",
+    "i18next-browser-languagedetector": "^6.1.2",
+    "i18next-http-backend": "^3.0.4",
+    "jquery": "^3.6.0",
+    "js-base64": "^3.7.2",
+    "jsdom": "^24",
+    "json-schema": "^0.4.0",
+    "lodash": "^4.18.1",
+    "lodash-es": "npm:lodash@4.18.1",
+    "lucide-react": "^0.577.0",
+    "markdown-to-jsx": "^7.7.4",
+    "moment": "^2.30.1",
+    "moment-timezone": "^0.6.2",
+    "mustache": "^4.2.0",
+    "ng-file-upload": "~12.2.13",
+    "parse-duration": "^2.1.4",
+    "qs": "^6.14.1",
+    "rc-slider": "^10.0.0",
+    "react": "^17.0.2",
+    "react-calendar": "^4.8.0",
+    "react-codemirror-merge": "^4.23.11",
+    "react-datetime-picker": "^5.6.0",
+    "react-dom": "^17.0.2",
+    "react-i18next": "^11.12.0",
+    "react-is": "^17.0.2",
+    "react-json-view-lite": "^1.5.0",
+    "react-select": "^5.10.2",
+    "react-select-async-paginate": "^0.7.11",
+    "sanitize-html": "^2.17.0",
+    "spinkit": "^2.0.1",
+    "strip-ansi": "^6.0.0",
+    "tailwindcss-animate": "^1.0.7",
+    "tippy.js": "^6.3.7",
+    "toastr": "^2.1.4",
+    "ts-xor": "^1.1.0",
+    "uuid": "^3.3.2",
+    "yaml": "^1.10.2",
+    "yup": "^0.32.11",
+    "zod": "4.3.6",
+    "zustand": "^4.1.1"
+  },
+  "devDependencies": {
+    "@apidevtools/swagger-cli": "^4.0.4",
+    "@babel/core": "^7.23.0",
+    "@babel/preset-env": "^7.22.20",
+    "@babel/preset-react": "^7.22.15",
+    "@babel/preset-typescript": "^7.23.0",
+    "@chromatic-com/storybook": "^5.1.2",
+    "@eslint-community/eslint-plugin-eslint-comments": "^4.7.2",
+    "@eslint/eslintrc": "^3.3.5",
+    "@eslint/js": "^10.0.1",
+    "@hey-api/openapi-ts": "0.99.0",
+    "@simbathesailor/use-what-changed": "^2.0.0",
+    "@storybook/addon-docs": "10.4.2",
+    "@storybook/addon-links": "10.4.2",
+    "@storybook/addon-styling-webpack": "^3.0.2",
+    "@storybook/addon-webpack5-compiler-swc": "^4.0.3",
+    "@storybook/react-webpack5": "10.4.2",
+    "@svgr/webpack": "^8.1.0",
+    "@testing-library/dom": "^9.3.4",
+    "@testing-library/jest-dom": "^6.9.1",
+    "@testing-library/react": "^12",
+    "@testing-library/react-hooks": "^8.0.1",
+    "@testing-library/user-event": "^14.6.1",
+    "@types/angular": "^1.8.3",
+    "@types/file-saver": "^2.0.4",
+    "@types/filesize": "^5.0.2",
+    "@types/filesize-parser": "^1.5.1",
+    "@types/jquery": "^3.5.10",
+    "@types/json-schema": "^7.0.15",
+    "@types/lodash": "^4.17.24",
+    "@types/mustache": "^4.1.2",
+    "@types/node": "^25.9.1",
+    "@types/nprogress": "^0.2.0",
+    "@types/qs": "^6.9.17",
+    "@types/react": "^17.0.37",
+    "@types/react-datetime-picker": "^3.4.1",
+    "@types/react-dom": "^17.0.11",
+    "@types/react-is": "^17.0.3",
+    "@types/sanitize-html": "^2.8.0",
+    "@types/toastr": "^2.1.39",
+    "@types/uuid": "^3.3.2",
+    "@typescript-eslint/eslint-plugin": "^8.61.1",
+    "@typescript-eslint/parser": "^8.61.1",
+    "@vitest/coverage-v8": "^4.1.8",
+    "@vitest/eslint-plugin": "^1.6.20",
+    "auto-ngtemplate-loader": "^3.1.2",
+    "autoprefixer": "^10.5.0",
+    "babel-loader": "^9.1.3",
+    "babel-plugin-i18next-extract": "^0.9.0",
+    "babel-plugin-lodash": "^3.3.4",
+    "clean-webpack-plugin": "^4.0.0",
+    "copy-webpack-plugin": "^11.0.0",
+    "css-loader": "^6.8.1",
+    "cssnano": "^8.0.1",
+    "dotenv-webpack": "^8.0.1",
+    "eslint": "^9.39.4",
+    "eslint-config-prettier": "^10.1.8",
+    "eslint-import-resolver-alias": "^1.1.2",
+    "eslint-import-resolver-typescript": "^4.4.5",
+    "eslint-plugin-eslint-comments": "^3.2.0",
+    "eslint-plugin-import": "^2.32.0",
+    "eslint-plugin-jsx-a11y": "^6.10.2",
+    "eslint-plugin-promise": "^7.3.0",
+    "eslint-plugin-react": "^7.37.5",
+    "eslint-plugin-react-hooks": "^7.1.1",
+    "eslint-plugin-regex": "^1.10.0",
+    "eslint-plugin-storybook": "^10.4.6",
+    "html-loader": "^5.1.0",
+    "html-webpack-plugin": "^5.5.3",
+    "husky": "^8.0.0",
+    "kubernetes-types": "^1.30.0",
+    "lint-staged": "^17.0.7",
+    "lodash-webpack-plugin": "^0.11.6",
+    "mini-css-extract-plugin": "^2.7.6",
+    "msw": "^2.14.6",
+    "msw-storybook-addon": "^2.0.7",
+    "ngtemplate-loader": "^2.1.0",
+    "postcss": "^8.5.15",
+    "postcss-loader": "^7.3.3",
+    "prettier": "^3.8.3",
+    "prettier-plugin-tailwindcss": "^0.8.0",
+    "react-docgen-typescript-plugin": "^1.0.5",
+    "source-map-loader": "^4.0.1",
+    "speed-measure-webpack-plugin": "^1.5.0",
+    "storybook": "10.4.2",
+    "storybook-css-modules-preset": "^1.1.1",
+    "style-loader": "^3.3.3",
+    "swagger2openapi": "^7.0.8",
+    "tailwindcss": "3.3.3",
+    "typescript": "^6.0.2",
+    "typescript-eslint": "^8.61.1",
+    "vite": "^8.0.16",
+    "vite-plugin-svgr": "^4.5.0",
+    "vite-tsconfig-paths": "^4.3.1",
+    "vitest": "^4.1.8",
+    "webpack": "^5.107.2",
+    "webpack-build-notifier": "^3.1.0",
+    "webpack-bundle-analyzer": "^5.2.0",
+    "webpack-cli": "^6.0.1",
+    "webpack-dev-server": "^5.2.4",
+    "webpack-merge": "^6.0.1"
+  },
+  "pnpm": {
+    "overrides": {
+      "jquery": "^3.6.0",
+      "decompress": "^4.2.1",
+      "minimist": "^1.2.6",
+      "http-proxy": "^1.18.1",
+      "daterangepicker>jquery": "^3.5.1",
+      "@uirouter/react": "^1.0.7",
+      "@uirouter/angularjs": "1.0.11",
+      "markdown-it": "^12.3.2",
+      "@types/react": "^17.0.37",
+      "@types/react-dom": "^17.0.11",
+      "@types/node": "^25",
+      "ngtemplate-loader>loader-utils": "^1.4.2",
+      "braces": "^3.0.3",
+      "shell-quote": "^1.8.4"
+    },
+    "configDependencies": {
+      "@pnpm/plugin-types-fixer": "0.1.0+sha512-bLww63gRHi7siYTqFJb5qNdcXadU0jv20Et6z5AryMZ7FlLolbEJOrXLpg8+amQZNHHNW1dfFUBGVw/9ezQbFg=="
+    }
+  },
+  "browserslist": "last 2 versions",
+  "msw": {
+    "workerDirectory": ".storybook/public"
+  }
+}
diff --git a/pkg/authorization/access_control.go b/pkg/authorization/access_control.go
new file mode 100644
index 0000000..6c014a1
--- /dev/null
+++ b/pkg/authorization/access_control.go
@@ -0,0 +1,152 @@
+package authorization
+
+import (
+	"slices"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/slicesx"
+)
+
+// NewAdministratorsOnlyResourceControl will create a new administrators only resource control associated to the resource specified by the
+// identifier and type parameters
+func NewAdministratorsOnlyResourceControl(resourceIdentifier string, resourceType portainer.ResourceControlType) *portainer.ResourceControl {
+	return &portainer.ResourceControl{
+		Type:               resourceType,
+		ResourceID:         resourceIdentifier,
+		SubResourceIDs:     []string{},
+		UserAccesses:       []portainer.UserResourceAccess{},
+		TeamAccesses:       []portainer.TeamResourceAccess{},
+		AdministratorsOnly: true,
+		Public:             false,
+		System:             false,
+	}
+}
+
+// NewPrivateResourceControl will create a new private resource control associated to the resource specified by the
+// identifier and type parameters. It automatically assigns it to the user specified by the userID parameter.
+func NewPrivateResourceControl(resourceIdentifier string, resourceType portainer.ResourceControlType, userID portainer.UserID) *portainer.ResourceControl {
+	return &portainer.ResourceControl{
+		Type:           resourceType,
+		ResourceID:     resourceIdentifier,
+		SubResourceIDs: []string{},
+		UserAccesses: []portainer.UserResourceAccess{
+			{
+				UserID:      userID,
+				AccessLevel: portainer.ReadWriteAccessLevel,
+			},
+		},
+		TeamAccesses:       []portainer.TeamResourceAccess{},
+		AdministratorsOnly: false,
+		Public:             false,
+		System:             false,
+	}
+}
+
+// NewSystemResourceControl creates a new public resource control with the System flag set to true.
+// These resource controls are not persisted and are created on the fly by the Portainer API.
+func NewSystemResourceControl(resourceIdentifier string, resourceType portainer.ResourceControlType) *portainer.ResourceControl {
+	return &portainer.ResourceControl{
+		Type:               resourceType,
+		ResourceID:         resourceIdentifier,
+		SubResourceIDs:     []string{},
+		UserAccesses:       []portainer.UserResourceAccess{},
+		TeamAccesses:       []portainer.TeamResourceAccess{},
+		AdministratorsOnly: false,
+		Public:             true,
+		System:             true,
+	}
+}
+
+// NewPublicResourceControl creates a new public resource control.
+func NewPublicResourceControl(resourceIdentifier string, resourceType portainer.ResourceControlType) *portainer.ResourceControl {
+	return &portainer.ResourceControl{
+		Type:               resourceType,
+		ResourceID:         resourceIdentifier,
+		SubResourceIDs:     []string{},
+		UserAccesses:       []portainer.UserResourceAccess{},
+		TeamAccesses:       []portainer.TeamResourceAccess{},
+		AdministratorsOnly: false,
+		Public:             true,
+		System:             false,
+	}
+}
+
+// NewRestrictedResourceControl creates a new resource control with user and team access restrictions.
+func NewRestrictedResourceControl(resourceIdentifier string, resourceType portainer.ResourceControlType, userIDs []portainer.UserID, teamIDs []portainer.TeamID) *portainer.ResourceControl {
+	userAccesses := make([]portainer.UserResourceAccess, 0)
+	teamAccesses := make([]portainer.TeamResourceAccess, 0)
+
+	for _, id := range userIDs {
+		access := portainer.UserResourceAccess{
+			UserID:      id,
+			AccessLevel: portainer.ReadWriteAccessLevel,
+		}
+
+		userAccesses = append(userAccesses, access)
+	}
+
+	for _, id := range teamIDs {
+		access := portainer.TeamResourceAccess{
+			TeamID:      id,
+			AccessLevel: portainer.ReadWriteAccessLevel,
+		}
+
+		teamAccesses = append(teamAccesses, access)
+	}
+
+	return &portainer.ResourceControl{
+		Type:               resourceType,
+		ResourceID:         resourceIdentifier,
+		SubResourceIDs:     []string{},
+		UserAccesses:       userAccesses,
+		TeamAccesses:       teamAccesses,
+		AdministratorsOnly: false,
+		Public:             false,
+		System:             false,
+	}
+}
+
+// UserCanAccessResource validates that a user has permissions defined in the specified resource control
+// based on their identifier and the team(s) they belong to.
+func UserCanAccessResource(userID portainer.UserID, userTeamIDs []portainer.TeamID, resourceControl *portainer.ResourceControl) bool {
+	if resourceControl == nil {
+		return false
+	}
+
+	for _, authorizedUserAccess := range resourceControl.UserAccesses {
+		if userID == authorizedUserAccess.UserID {
+			return true
+		}
+	}
+
+	for _, authorizedTeamAccess := range resourceControl.TeamAccesses {
+		if slices.Contains(userTeamIDs, authorizedTeamAccess.TeamID) {
+			return true
+		}
+	}
+
+	return resourceControl.Public
+}
+
+// GetResourceControlByResourceIDAndType retrieves the first matching resource control in a set of resource controls
+// based on the specified id and resource type parameters.
+func GetResourceControlByResourceIDAndType(resourceID string, resourceType portainer.ResourceControlType, resourceControls []portainer.ResourceControl) *portainer.ResourceControl {
+	for i := range resourceControls {
+		if resourceID == resourceControls[i].ResourceID && resourceType == resourceControls[i].Type {
+			return &resourceControls[i]
+		}
+
+		if slices.Contains(resourceControls[i].SubResourceIDs, resourceID) {
+			return &resourceControls[i]
+		}
+	}
+
+	return nil
+}
+
+// TeamIDs extracts the TeamID from each membership.
+func TeamIDs(memberships []portainer.TeamMembership) []portainer.TeamID {
+	return slicesx.Map(memberships, func(m portainer.TeamMembership) portainer.TeamID {
+		return m.TeamID
+	})
+}
diff --git a/pkg/authorization/resolver.go b/pkg/authorization/resolver.go
new file mode 100644
index 0000000..df37eb4
--- /dev/null
+++ b/pkg/authorization/resolver.go
@@ -0,0 +1,194 @@
+package authorization
+
+import (
+	portainer "github.com/portainer/portainer/api"
+)
+
+// ResolvedAccess represents the result of dynamic authorization resolution.
+// It contains both the computed role and its authorizations for convenience.
+type ResolvedAccess struct {
+	Role           *portainer.Role
+	Authorizations portainer.Authorizations
+	Source         AccessSource
+}
+
+// AccessSource captures which layers contributed to a resolved access decision.
+//
+//   - GroupID is set when access was granted via the user-group or team-group
+//     layer, OR (in EE) via a policy targeting the environment group.
+//   - TeamID  is set when access was granted via either of the team layers; the
+//     ID of the team whose membership matched.
+type AccessSource struct {
+	GroupID portainer.EndpointGroupID
+	TeamID  portainer.TeamID
+}
+
+// ResolverInput contains all the data needed to resolve user access to an endpoint.
+// This struct is used to pass data to the resolution functions without requiring
+// database access, making it easier to test and allowing callers to control data fetching.
+type ResolverInput struct {
+	User            *portainer.User
+	Endpoint        *portainer.Endpoint
+	EndpointGroup   portainer.EndpointGroup
+	UserMemberships []portainer.TeamMembership
+	Roles           []portainer.Role
+}
+
+// ResolveUserEndpointAccess resolves a user's effective access to an endpoint.
+// It checks access in precedence order:
+//  1. User → Endpoint direct access
+//  2. User → Endpoint Group access (inherited)
+//  3. User's Teams → Endpoint access
+//  4. User's Teams → Endpoint Group access (inherited)
+func ResolveUserEndpointAccess(input ResolverInput) *ResolvedAccess {
+	group := input.EndpointGroup
+
+	// 1. Check user → endpoint direct access
+	if role := GetRoleFromUserAccessPolicies(
+		input.User.ID,
+		input.Endpoint.UserAccessPolicies,
+		input.Roles,
+	); role != nil {
+		return &ResolvedAccess{
+			Role:           role,
+			Authorizations: role.Authorizations,
+		}
+	}
+
+	// 2. Check user → endpoint group access (inherited)
+	if role := GetRoleFromUserAccessPolicies(
+		input.User.ID,
+		group.UserAccessPolicies,
+		input.Roles,
+	); role != nil {
+		return &ResolvedAccess{
+			Role:           role,
+			Authorizations: role.Authorizations,
+			Source:         AccessSource{GroupID: group.ID},
+		}
+	}
+
+	// 3. Check user's teams → endpoint access
+	if role, teamID := getTeamRoleWithSource(
+		input.UserMemberships,
+		input.Endpoint.TeamAccessPolicies,
+		input.Roles,
+	); role != nil {
+		return &ResolvedAccess{
+			Role:           role,
+			Authorizations: role.Authorizations,
+			Source:         AccessSource{TeamID: teamID},
+		}
+	}
+
+	// 4. Check user's teams → endpoint group access (inherited)
+	if role, teamID := getTeamRoleWithSource(
+		input.UserMemberships,
+		group.TeamAccessPolicies,
+		input.Roles,
+	); role != nil {
+		return &ResolvedAccess{
+			Role:           role,
+			Authorizations: role.Authorizations,
+			Source:         AccessSource{GroupID: group.ID, TeamID: teamID},
+		}
+	}
+
+	return nil
+}
+
+// GetRoleFromUserAccessPolicies returns the role for a user from user access policies.
+// Returns nil if the user is not in the policies.
+func GetRoleFromUserAccessPolicies(
+	userID portainer.UserID,
+	policies portainer.UserAccessPolicies,
+	roles []portainer.Role,
+) *portainer.Role {
+	if policies == nil {
+		return nil
+	}
+
+	policy, ok := policies[userID]
+	if !ok {
+		return nil
+	}
+
+	return FindRoleByID(policy.RoleID, roles)
+}
+
+// GetRoleFromTeamAccessPolicies returns the highest priority role for a user
+// based on their team memberships and the team access policies.
+// If a user belongs to multiple teams with access, the role with highest priority wins.
+// Returns nil if none of the user's teams have access.
+func GetRoleFromTeamAccessPolicies(
+	memberships []portainer.TeamMembership,
+	policies portainer.TeamAccessPolicies,
+	roles []portainer.Role,
+) *portainer.Role {
+	role, _ := getTeamRoleWithSource(memberships, policies, roles)
+	return role
+}
+
+// getTeamRoleWithSource is GetRoleFromTeamAccessPolicies plus the matching team ID.
+func getTeamRoleWithSource(
+	memberships []portainer.TeamMembership,
+	policies portainer.TeamAccessPolicies,
+	roles []portainer.Role,
+) (*portainer.Role, portainer.TeamID) {
+	if policies == nil || len(memberships) == 0 {
+		return nil, 0
+	}
+
+	var (
+		best       *portainer.Role
+		bestTeamID portainer.TeamID
+	)
+	for _, membership := range memberships {
+		policy, ok := policies[membership.TeamID]
+		if !ok {
+			continue
+		}
+
+		role := FindRoleByID(policy.RoleID, roles)
+		if role == nil {
+			continue
+		}
+
+		if best == nil || role.Priority > best.Priority {
+			best = role
+			bestTeamID = membership.TeamID
+		}
+	}
+	return best, bestTeamID
+}
+
+// GetHighestPriorityRole returns the role with the highest priority from a slice.
+// In Portainer's role system, higher priority numbers = higher priority (lower access usually gives higher priority).
+// Current role priorities from highest to lowest: Read-only User (6), Standard User (5),
+// Namespace Operator (4), Helpdesk (3), Operator (2), Environment Administrator (1).
+// Returns nil if the slice is empty.
+func GetHighestPriorityRole(roles []*portainer.Role) *portainer.Role {
+	if len(roles) == 0 {
+		return nil
+	}
+
+	highest := roles[0]
+	for _, role := range roles[1:] {
+		if role.Priority > highest.Priority {
+			highest = role
+		}
+	}
+
+	return highest
+}
+
+// FindRoleByID finds a role by its ID in a slice of roles.
+// Returns nil if the role is not found.
+func FindRoleByID(roleID portainer.RoleID, roles []portainer.Role) *portainer.Role {
+	for i := range roles {
+		if roles[i].ID == roleID {
+			return &roles[i]
+		}
+	}
+	return nil
+}
diff --git a/pkg/authorization/resolver_test.go b/pkg/authorization/resolver_test.go
new file mode 100644
index 0000000..54cd056
--- /dev/null
+++ b/pkg/authorization/resolver_test.go
@@ -0,0 +1,465 @@
+package authorization
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/stretchr/testify/assert"
+)
+
+// Test role fixtures
+// In Portainer's role system, higher priority numbers = higher priority (more powerful).
+// Order from highest to lowest: Read-only (4), Helpdesk (3), Operator (2), Admin (1).
+var (
+	roleAdmin = portainer.Role{
+		ID:             1,
+		Name:           "Environment Administrator",
+		Priority:       1,
+		Authorizations: portainer.Authorizations{"admin": true},
+	}
+	roleOperator = portainer.Role{
+		ID:             2,
+		Name:           "Operator",
+		Priority:       2,
+		Authorizations: portainer.Authorizations{"operator": true},
+	}
+	roleHelpdesk = portainer.Role{
+		ID:             3,
+		Name:           "Helpdesk",
+		Priority:       3,
+		Authorizations: portainer.Authorizations{"helpdesk": true},
+	}
+	roleReadOnly = portainer.Role{
+		ID:             4,
+		Name:           "Read-only",
+		Priority:       4,
+		Authorizations: portainer.Authorizations{"readonly": true},
+	}
+
+	allRoles = []portainer.Role{roleAdmin, roleOperator, roleHelpdesk, roleReadOnly}
+)
+
+func TestResolveUserEndpointAccess_UserEndpointAccess(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	user := &portainer.User{ID: 1}
+	endpoint := &portainer.Endpoint{
+		ID:      1,
+		GroupID: 1,
+		UserAccessPolicies: portainer.UserAccessPolicies{
+			1: {RoleID: roleOperator.ID},
+		},
+	}
+
+	input := ResolverInput{
+		User:            user,
+		Endpoint:        endpoint,
+		EndpointGroup:   portainer.EndpointGroup{},
+		UserMemberships: []portainer.TeamMembership{},
+		Roles:           allRoles,
+	}
+
+	access := ResolveUserEndpointAccess(input)
+
+	is.NotNil(access)
+	is.Equal(roleOperator.ID, access.Role.ID)
+	is.Equal("Operator", access.Role.Name)
+}
+
+func TestResolveUserEndpointAccess_UserGroupAccess(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	user := &portainer.User{ID: 1}
+	endpoint := &portainer.Endpoint{
+		ID:                 1,
+		GroupID:            10,
+		UserAccessPolicies: portainer.UserAccessPolicies{}, // No direct access
+	}
+	groups := []portainer.EndpointGroup{
+		{
+			ID: 10,
+			UserAccessPolicies: portainer.UserAccessPolicies{
+				1: {RoleID: roleHelpdesk.ID}, // User has access via group
+			},
+		},
+	}
+
+	input := ResolverInput{
+		User:            user,
+		Endpoint:        endpoint,
+		EndpointGroup:   groups[0],
+		UserMemberships: []portainer.TeamMembership{},
+		Roles:           allRoles,
+	}
+
+	access := ResolveUserEndpointAccess(input)
+
+	is.NotNil(access)
+	is.Equal(roleHelpdesk.ID, access.Role.ID)
+	is.Equal("Helpdesk", access.Role.Name)
+}
+
+func TestResolveUserEndpointAccess_TeamEndpointAccess(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	user := &portainer.User{ID: 1}
+	endpoint := &portainer.Endpoint{
+		ID:                 1,
+		GroupID:            1,
+		UserAccessPolicies: portainer.UserAccessPolicies{}, // No user access
+		TeamAccessPolicies: portainer.TeamAccessPolicies{
+			100: {RoleID: roleReadOnly.ID}, // Team 100 has access
+		},
+	}
+	memberships := []portainer.TeamMembership{
+		{UserID: 1, TeamID: 100}, // User is in team 100
+	}
+
+	input := ResolverInput{
+		User:            user,
+		Endpoint:        endpoint,
+		EndpointGroup:   portainer.EndpointGroup{},
+		UserMemberships: memberships,
+		Roles:           allRoles,
+	}
+
+	access := ResolveUserEndpointAccess(input)
+
+	is.NotNil(access)
+	is.Equal(roleReadOnly.ID, access.Role.ID)
+}
+
+func TestResolveUserEndpointAccess_TeamGroupAccess(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	user := &portainer.User{ID: 1}
+	endpoint := &portainer.Endpoint{
+		ID:                 1,
+		GroupID:            10,
+		UserAccessPolicies: portainer.UserAccessPolicies{},
+		TeamAccessPolicies: portainer.TeamAccessPolicies{}, // No direct team access
+	}
+	groups := []portainer.EndpointGroup{
+		{
+			ID:                 10,
+			UserAccessPolicies: portainer.UserAccessPolicies{},
+			TeamAccessPolicies: portainer.TeamAccessPolicies{
+				100: {RoleID: roleOperator.ID}, // Team 100 has group access
+			},
+		},
+	}
+	memberships := []portainer.TeamMembership{
+		{UserID: 1, TeamID: 100},
+	}
+
+	input := ResolverInput{
+		User:            user,
+		Endpoint:        endpoint,
+		EndpointGroup:   groups[0],
+		UserMemberships: memberships,
+		Roles:           allRoles,
+	}
+
+	access := ResolveUserEndpointAccess(input)
+
+	is.NotNil(access)
+	is.Equal(roleOperator.ID, access.Role.ID)
+}
+
+func TestResolveUserEndpointAccess_Precedence(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	t.Run("User endpoint access takes precedence over group access", func(t *testing.T) {
+		user := &portainer.User{ID: 1}
+		endpoint := &portainer.Endpoint{
+			ID:      1,
+			GroupID: 10,
+			UserAccessPolicies: portainer.UserAccessPolicies{
+				1: {RoleID: roleOperator.ID}, // Direct access
+			},
+		}
+		groups := []portainer.EndpointGroup{
+			{
+				ID: 10,
+				UserAccessPolicies: portainer.UserAccessPolicies{
+					1: {RoleID: roleAdmin.ID}, // Group access (higher role, but lower precedence)
+				},
+			},
+		}
+
+		input := ResolverInput{
+			User:          user,
+			Endpoint:      endpoint,
+			EndpointGroup: groups[0],
+			Roles:         allRoles,
+		}
+
+		access := ResolveUserEndpointAccess(input)
+		is.NotNil(access)
+		is.Equal(roleOperator.ID, access.Role.ID, "Direct endpoint access should take precedence")
+	})
+
+	t.Run("User access takes precedence over team access", func(t *testing.T) {
+		user := &portainer.User{ID: 1}
+		endpoint := &portainer.Endpoint{
+			ID:      1,
+			GroupID: 1,
+			UserAccessPolicies: portainer.UserAccessPolicies{
+				1: {RoleID: roleHelpdesk.ID},
+			},
+			TeamAccessPolicies: portainer.TeamAccessPolicies{
+				100: {RoleID: roleAdmin.ID}, // Team has higher role
+			},
+		}
+		memberships := []portainer.TeamMembership{
+			{UserID: 1, TeamID: 100},
+		}
+
+		input := ResolverInput{
+			User:            user,
+			Endpoint:        endpoint,
+			UserMemberships: memberships,
+			Roles:           allRoles,
+		}
+
+		access := ResolveUserEndpointAccess(input)
+		is.NotNil(access)
+		is.Equal(roleHelpdesk.ID, access.Role.ID, "User access should take precedence over team access")
+	})
+
+	t.Run("Team endpoint access takes precedence over team group access", func(t *testing.T) {
+		user := &portainer.User{ID: 1}
+		endpoint := &portainer.Endpoint{
+			ID:      1,
+			GroupID: 10,
+			TeamAccessPolicies: portainer.TeamAccessPolicies{
+				100: {RoleID: roleReadOnly.ID}, // Direct team endpoint access
+			},
+		}
+		groups := []portainer.EndpointGroup{
+			{
+				ID: 10,
+				TeamAccessPolicies: portainer.TeamAccessPolicies{
+					100: {RoleID: roleAdmin.ID}, // Team group access (higher role)
+				},
+			},
+		}
+		memberships := []portainer.TeamMembership{
+			{UserID: 1, TeamID: 100},
+		}
+
+		input := ResolverInput{
+			User:            user,
+			Endpoint:        endpoint,
+			EndpointGroup:   groups[0],
+			UserMemberships: memberships,
+			Roles:           allRoles,
+		}
+
+		access := ResolveUserEndpointAccess(input)
+		is.NotNil(access)
+		is.Equal(roleReadOnly.ID, access.Role.ID, "Team endpoint access should take precedence over team group access")
+	})
+}
+
+func TestResolveUserEndpointAccess_NoAccess(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	user := &portainer.User{ID: 1}
+	endpoint := &portainer.Endpoint{
+		ID:                 1,
+		GroupID:            10,
+		UserAccessPolicies: portainer.UserAccessPolicies{},
+		TeamAccessPolicies: portainer.TeamAccessPolicies{},
+	}
+	groups := []portainer.EndpointGroup{
+		{
+			ID:                 10,
+			UserAccessPolicies: portainer.UserAccessPolicies{},
+			TeamAccessPolicies: portainer.TeamAccessPolicies{},
+		},
+	}
+
+	input := ResolverInput{
+		User:            user,
+		Endpoint:        endpoint,
+		EndpointGroup:   groups[0],
+		UserMemberships: []portainer.TeamMembership{},
+		Roles:           allRoles,
+	}
+
+	access := ResolveUserEndpointAccess(input)
+	is.Nil(access)
+}
+
+func TestResolveUserEndpointAccess_MultipleTeams_HighestPriorityWins(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	user := &portainer.User{ID: 1}
+	endpoint := &portainer.Endpoint{
+		ID:      1,
+		GroupID: 1,
+		TeamAccessPolicies: portainer.TeamAccessPolicies{
+			100: {RoleID: roleReadOnly.ID}, // Highest priority (4)
+			200: {RoleID: roleAdmin.ID},    // Lowest priority (1)
+			300: {RoleID: roleOperator.ID}, // Medium priority (2)
+		},
+	}
+	memberships := []portainer.TeamMembership{
+		{UserID: 1, TeamID: 100},
+		{UserID: 1, TeamID: 200},
+		{UserID: 1, TeamID: 300},
+	}
+
+	input := ResolverInput{
+		User:            user,
+		Endpoint:        endpoint,
+		EndpointGroup:   portainer.EndpointGroup{},
+		UserMemberships: memberships,
+		Roles:           allRoles,
+	}
+
+	access := ResolveUserEndpointAccess(input)
+
+	is.NotNil(access)
+	is.Equal(roleReadOnly.ID, access.Role.ID, "Highest priority role should be selected when user is in multiple teams")
+}
+
+func TestResolveUserEndpointAccess_Source(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	user := &portainer.User{ID: 1}
+	memberships := []portainer.TeamMembership{{UserID: 1, TeamID: 100}}
+
+	t.Run("user-endpoint resolution flags neither group nor team", func(t *testing.T) {
+		access := ResolveUserEndpointAccess(ResolverInput{
+			User: user, Roles: allRoles,
+			Endpoint: &portainer.Endpoint{ID: 1, GroupID: 10, UserAccessPolicies: portainer.UserAccessPolicies{1: {RoleID: roleOperator.ID}}},
+		})
+		is.NotNil(access)
+		is.Equal(portainer.EndpointGroupID(0), access.Source.GroupID)
+		is.Equal(portainer.TeamID(0), access.Source.TeamID)
+	})
+
+	t.Run("user-group resolution flags the group", func(t *testing.T) {
+		access := ResolveUserEndpointAccess(ResolverInput{
+			User: user, Roles: allRoles,
+			Endpoint:      &portainer.Endpoint{ID: 1, GroupID: 10},
+			EndpointGroup: portainer.EndpointGroup{ID: 10, UserAccessPolicies: portainer.UserAccessPolicies{1: {RoleID: roleOperator.ID}}},
+		})
+		is.NotNil(access)
+		is.Equal(portainer.EndpointGroupID(10), access.Source.GroupID)
+		is.Equal(portainer.TeamID(0), access.Source.TeamID)
+	})
+
+	t.Run("team-endpoint resolution flags the team only", func(t *testing.T) {
+		access := ResolveUserEndpointAccess(ResolverInput{
+			User: user, Roles: allRoles, UserMemberships: memberships,
+			Endpoint: &portainer.Endpoint{ID: 1, GroupID: 10, TeamAccessPolicies: portainer.TeamAccessPolicies{100: {RoleID: roleOperator.ID}}},
+		})
+		is.NotNil(access)
+		is.Equal(portainer.EndpointGroupID(0), access.Source.GroupID)
+		is.Equal(portainer.TeamID(100), access.Source.TeamID)
+	})
+
+	t.Run("team-group resolution flags both group and team", func(t *testing.T) {
+		access := ResolveUserEndpointAccess(ResolverInput{
+			User: user, Roles: allRoles, UserMemberships: memberships,
+			Endpoint:      &portainer.Endpoint{ID: 1, GroupID: 10},
+			EndpointGroup: portainer.EndpointGroup{ID: 10, TeamAccessPolicies: portainer.TeamAccessPolicies{100: {RoleID: roleOperator.ID}}},
+		})
+		is.NotNil(access)
+		is.Equal(portainer.EndpointGroupID(10), access.Source.GroupID)
+		is.Equal(portainer.TeamID(100), access.Source.TeamID)
+	})
+}
+
+func TestResolveUserEndpointAccess(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	t.Run("Returns resolved access with role and authorizations", func(t *testing.T) {
+		user := &portainer.User{ID: 1}
+		endpoint := &portainer.Endpoint{
+			ID: 1,
+			UserAccessPolicies: portainer.UserAccessPolicies{
+				1: {RoleID: roleOperator.ID},
+			},
+		}
+
+		input := ResolverInput{
+			User:     user,
+			Endpoint: endpoint,
+			Roles:    allRoles,
+		}
+
+		access := ResolveUserEndpointAccess(input)
+
+		is.NotNil(access)
+		is.Equal(roleOperator.ID, access.Role.ID)
+		is.True(access.Authorizations["operator"])
+	})
+
+	t.Run("Returns nil when no access", func(t *testing.T) {
+		user := &portainer.User{ID: 1}
+		endpoint := &portainer.Endpoint{ID: 1}
+
+		input := ResolverInput{
+			User:     user,
+			Endpoint: endpoint,
+			Roles:    allRoles,
+		}
+
+		access := ResolveUserEndpointAccess(input)
+		is.Nil(access)
+	})
+}
+
+func TestFindRoleByID(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	t.Run("Finds existing role", func(t *testing.T) {
+		role := FindRoleByID(roleOperator.ID, allRoles)
+		is.NotNil(role)
+		is.Equal(roleOperator.ID, role.ID)
+	})
+
+	t.Run("Returns nil for non-existent role", func(t *testing.T) {
+		role := FindRoleByID(999, allRoles)
+		is.Nil(role)
+	})
+
+	t.Run("Returns nil for empty roles slice", func(t *testing.T) {
+		role := FindRoleByID(1, []portainer.Role{})
+		is.Nil(role)
+	})
+}
+
+func TestGetHighestPriorityRole(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	t.Run("Returns nil for empty slice", func(t *testing.T) {
+		result := GetHighestPriorityRole([]*portainer.Role{})
+		is.Nil(result)
+	})
+
+	t.Run("Returns single role", func(t *testing.T) {
+		result := GetHighestPriorityRole([]*portainer.Role{&roleOperator})
+		is.Equal(roleOperator.ID, result.ID)
+	})
+
+	t.Run("Returns highest priority from multiple roles", func(t *testing.T) {
+		result := GetHighestPriorityRole([]*portainer.Role{&roleReadOnly, &roleAdmin, &roleOperator})
+		is.Equal(roleReadOnly.ID, result.ID)
+	})
+}
diff --git a/pkg/build/info.go b/pkg/build/info.go
new file mode 100644
index 0000000..ecd38bd
--- /dev/null
+++ b/pkg/build/info.go
@@ -0,0 +1,106 @@
+package build
+
+import "os"
+
+/*
+Package build contains variables that are set at build time using the -X linker flag.
+
+These variables provide metadata about the build environment and specify the
+versions of dependencies shipped with the application.
+
+These variables are typically set during the build process using the -X flag with
+the go build command, allowing for dynamic injection of build-time information.
+
+It also contains structs and methods that can be used to display build, dependencies and runtime information.
+*/
+
+var (
+	// BuildNumber is the build number of the application.
+	BuildNumber string
+
+	// ImageTag is the Docker image tag associated with this build.
+	ImageTag string
+
+	// NodejsVersion is the version of Node.js used in the build.
+	NodejsVersion string
+
+	// PnpmVersion is the version of pnpm used in the build.
+	PnpmVersion string
+
+	// WebpackVersion is the version of Webpack used in the build.
+	WebpackVersion string
+
+	// GoVersion is the version of Go used to compile the application.
+	GoVersion string
+
+	// GitCommit is the Git commit hash at the time of the build.
+	GitCommit string
+
+	// DepComposeVersion is the version of the Docker Compose plugin shipped with the application.
+	DepComposeVersion string
+
+	// DepDockerVersion is the version of the github.com/docker/docker Go module used by the application.
+	DepDockerVersion string
+
+	// DepKubectlVersion is the version of the Kubectl binary shipped with the application.
+	DepKubectlVersion string
+
+	// DepHelmVersion is the version of the Helm binary shipped with the application.
+	DepHelmVersion string
+)
+
+type (
+	// BuildInfo contains information about how an application was built
+	BuildInfo struct {
+		BuildNumber    string
+		ImageTag       string
+		NodejsVersion  string
+		PnpmVersion    string
+		WebpackVersion string
+		GoVersion      string
+		GitCommit      string
+	}
+
+	// DependenciesInfo contains information about the dependencies of Portainer
+	DependenciesInfo struct {
+		DockerVersion  string
+		HelmVersion    string
+		KubectlVersion string
+		ComposeVersion string
+	}
+
+	// RuntimeInfo contains information about the runtime environment an application
+	RuntimeInfo struct {
+		Env []string `json:",omitempty"`
+	}
+)
+
+// GetBuildInfo is a shortcut method to return the build information
+func GetBuildInfo() BuildInfo {
+	return BuildInfo{
+		BuildNumber:    BuildNumber,
+		ImageTag:       ImageTag,
+		NodejsVersion:  NodejsVersion,
+		PnpmVersion:    PnpmVersion,
+		WebpackVersion: WebpackVersion,
+		GoVersion:      GoVersion,
+		GitCommit:      GitCommit,
+	}
+}
+
+// GetDependenciesInfo is a shortcut method to return the dependencies information
+func GetDependenciesInfo() DependenciesInfo {
+	return DependenciesInfo{
+		DockerVersion:  DepDockerVersion,
+		ComposeVersion: DepComposeVersion,
+		KubectlVersion: DepKubectlVersion,
+		HelmVersion:    DepHelmVersion,
+	}
+}
+
+// GetRuntimeInfo is a shortcut method to return the runtime information
+func GetRuntimeInfo() RuntimeInfo {
+	return RuntimeInfo{
+		Env: os.Environ(),
+	}
+}
diff --git a/pkg/edge/utils.go b/pkg/edge/utils.go
new file mode 100644
index 0000000..e0d5833
--- /dev/null
+++ b/pkg/edge/utils.go
@@ -0,0 +1,70 @@
+package edge
+
+import (
+	"encoding/base64"
+	"errors"
+	"strconv"
+	"strings"
+	"unicode"
+)
+
+// GetPortainerURLFromEdgeKey returns the portainer URL from an edge key
+// format: <portainer_instance_url>|<tunnel_server_addr>|<tunnel_server_fingerprint>|<endpoint_id>
+func GetPortainerURLFromEdgeKey(edgeKey string) (string, error) {
+	decodedKey, err := base64.RawStdEncoding.DecodeString(edgeKey)
+	if err != nil {
+		return "", err
+	}
+
+	keyInfo := strings.Split(string(decodedKey), "|")
+
+	if len(keyInfo) != 4 {
+		return "", errors.New("invalid key format")
+	}
+
+	_, err = strconv.Atoi(keyInfo[3])
+	if err != nil {
+		return "", errors.New("invalid key format")
+	}
+
+	return keyInfo[0], nil
+}
+
+// GetEndpointIDFromEdgeKey returns the endpoint ID from an edge key
+// format: <portainer_instance_url>|<tunnel_server_addr>|<tunnel_server_fingerprint>|<endpoint_id>
+func GetEndpointIDFromEdgeKey(edgeKey string) (int, error) {
+	decodedKey, err := base64.RawStdEncoding.DecodeString(edgeKey)
+	if err != nil {
+		return 0, err
+	}
+
+	keyInfo := strings.Split(string(decodedKey), "|")
+
+	if len(keyInfo) != 4 {
+		return 0, errors.New("invalid key format")
+	}
+
+	return strconv.Atoi(keyInfo[3])
+}
+
+// IsValidEdgeStackName validates an edge stack name
+// Edge stack name must be between 1 and 255 characters long
+// and can only contain lowercase letters, digits, hyphens and underscores
+// Edge stack name must start with either a lowercase letter or a digit
+func IsValidEdgeStackName(name string) bool {
+	if len(name) == 0 || len(name) > 255 {
+		return false
+	}
+
+	if !unicode.IsLower(rune(name[0])) && !unicode.IsDigit(rune(name[0])) {
+		return false
+	}
+
+	for _, r := range name {
+		if !unicode.IsLower(r) && !unicode.IsDigit(r) && r != '-' && r != '_' {
+			return false
+		}
+	}
+
+	return true
+}
diff --git a/pkg/edge/utils_test.go b/pkg/edge/utils_test.go
new file mode 100644
index 0000000..c89f162
--- /dev/null
+++ b/pkg/edge/utils_test.go
@@ -0,0 +1,63 @@
+package edge
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetPortainerURLFromEdgeKey(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name     string
+		edgeKey  string
+		expected string
+	}{
+		{
+			name:     "ValidEdgeKey",
+			edgeKey:  "aHR0cHM6Ly9wb3J0YWluZXIuaW98cG9ydGFpbmVyLmlvOjgwMDB8YXNkZnwx",
+			expected: "https://portainer.io",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result, err := GetPortainerURLFromEdgeKey(tt.edgeKey)
+			require.NoError(t, err)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+func TestIsValidEdgeStackName(t *testing.T) {
+	t.Parallel()
+	f := func(name string, expected bool) {
+		if IsValidEdgeStackName(name) != expected {
+			t.Fatalf("expected %v, found %v", expected, IsValidEdgeStackName(name))
+		}
+	}
+
+	f("edge-stack", true)
+	f("edge_stack", true)
+	f("edgestack", true)
+	f("edgestack11", true)
+	f("111", true)
+	f("111edgestack", true)
+	f("edge#stack", false)
+	f("edge stack", false)
+	f("Edge_stack", false)
+	f("EdgeStack", false)
+	f("-edgestack", false)
+	f("_edgestack", false)
+	f("#edgestack", false)
+	f("/edgestack", false)
+	f("#edgestack", false)
+	f("édgestack", false)
+	f("", false)
+	f(" ", false)
+	f("-", false)
+	f("_", false)
+	f("E", false)
+	f("eedgestackedgestackedgestackedgestackedgestackedgestackedgestackedgestackedgestackedgestackedgestackedgestackedgestackedgestackedgestackedgestackedgestackedgestackedgestackedgestackedgestackdgeedgestackedgestackedgestackedgestackedgestackedgestackedgestackedgestackedgestackedgestackedgestackstack", false)
+}
diff --git a/pkg/endpoints/utils.go b/pkg/endpoints/utils.go
new file mode 100644
index 0000000..6c9004e
--- /dev/null
+++ b/pkg/endpoints/utils.go
@@ -0,0 +1,93 @@
+package endpoints
+
+import (
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+
+	"github.com/Masterminds/semver/v3"
+)
+
+// IsLocalEndpoint returns true if this is a local environment(endpoint)
+func IsLocalEndpoint(endpoint *portainer.Endpoint) bool {
+	return strings.HasPrefix(endpoint.URL, "unix://") ||
+		strings.HasPrefix(endpoint.URL, "npipe://") ||
+		endpoint.Type == portainer.KubernetesLocalEnvironment
+}
+
+// IsKubernetesEndpoint returns true if this is a kubernetes environment(endpoint)
+func IsKubernetesEndpoint(endpoint *portainer.Endpoint) bool {
+	return endpoint.Type == portainer.KubernetesLocalEnvironment ||
+		endpoint.Type == portainer.AgentOnKubernetesEnvironment ||
+		endpoint.Type == portainer.EdgeAgentOnKubernetesEnvironment
+}
+
+// IsDockerEndpoint returns true if this is a docker environment(endpoint)
+func IsDockerEndpoint(endpoint *portainer.Endpoint) bool {
+	return endpoint.Type == portainer.DockerEnvironment ||
+		endpoint.Type == portainer.AgentOnDockerEnvironment ||
+		endpoint.Type == portainer.EdgeAgentOnDockerEnvironment
+}
+
+// IsAgentEndpoint returns true if this is an Agent endpoint
+func IsAgentEndpoint(endpoint *portainer.Endpoint) bool {
+	return endpoint.Type == portainer.AgentOnDockerEnvironment ||
+		endpoint.Type == portainer.EdgeAgentOnDockerEnvironment ||
+		endpoint.Type == portainer.AgentOnKubernetesEnvironment ||
+		endpoint.Type == portainer.EdgeAgentOnKubernetesEnvironment
+}
+
+// EndpointSet receives an environment(endpoint) array and returns a set
+func EndpointSet(endpointIDs []portainer.EndpointID) map[portainer.EndpointID]bool {
+	set := map[portainer.EndpointID]bool{}
+
+	for _, endpointID := range endpointIDs {
+		set[endpointID] = true
+	}
+
+	return set
+}
+
+// IsRegularAgentEndpoint returns true if this is a regular agent endpoint
+func IsRegularAgentEndpoint(endpoint *portainer.Endpoint) bool {
+	return endpoint.Type == portainer.AgentOnDockerEnvironment ||
+		endpoint.Type == portainer.AgentOnKubernetesEnvironment
+}
+
+// IsEdgeEndpoint returns true if this is an Edge endpoint
+func IsEdgeEndpoint(endpoint *portainer.Endpoint) bool {
+	return endpoint.Type == portainer.EdgeAgentOnDockerEnvironment || endpoint.Type == portainer.EdgeAgentOnKubernetesEnvironment
+}
+
+// IsStandardEdgeEndpoint returns true if this is a standard Edge endpoint and not in async mode on either Docker or Kubernetes
+func IsStandardEdgeEndpoint(endpoint *portainer.Endpoint) bool {
+	return (endpoint.Type == portainer.EdgeAgentOnDockerEnvironment || endpoint.Type == portainer.EdgeAgentOnKubernetesEnvironment) && !endpoint.Edge.AsyncMode
+}
+
+// IsAssociatedEdgeEndpoint returns true if the environment is an Edge environment
+// and has a set EdgeID and UserTrusted is true.
+func IsAssociatedEdgeEndpoint(endpoint *portainer.Endpoint) bool {
+	return IsEdgeEndpoint(endpoint) && endpoint.EdgeID != "" && endpoint.UserTrusted
+}
+
+// HasDirectConnectivity returns true if the environment is a non-Edge environment
+// or is an associated Edge environment that is not in async mode.
+func HasDirectConnectivity(endpoint *portainer.Endpoint) bool {
+	return !IsEdgeEndpoint(endpoint) || (IsAssociatedEdgeEndpoint(endpoint) && !endpoint.Edge.AsyncMode)
+}
+
+// IsNewerThan225 returns true if the agent version is newer than 2.25.0
+// this is used to check if the agent is compatible with the new diagnostics feature
+func IsNewerThan225(agentVersion string) bool {
+	v1, err := semver.NewVersion(agentVersion)
+	if err != nil || v1 == nil {
+		return false
+	}
+
+	v2, err := semver.NewVersion("2.25.0")
+	if err != nil || v2 == nil {
+		return false
+	}
+
+	return v1.GreaterThanEqual(v2)
+}
diff --git a/pkg/endpoints/utils_test.go b/pkg/endpoints/utils_test.go
new file mode 100644
index 0000000..03a894d
--- /dev/null
+++ b/pkg/endpoints/utils_test.go
@@ -0,0 +1,273 @@
+package endpoints
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestIsRegularAgentEndpoint(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name     string
+		endpoint *portainer.Endpoint
+		expected bool
+	}{
+		{
+			name: "AgentOnDockerEnvironment",
+			endpoint: &portainer.Endpoint{
+				Type: portainer.AgentOnDockerEnvironment,
+			},
+			expected: true,
+		},
+		{
+			name: "AgentOnKubernetesEnvironment",
+			endpoint: &portainer.Endpoint{
+				Type: portainer.AgentOnKubernetesEnvironment,
+			},
+			expected: true,
+		},
+		{
+			name: "EdgeAgentOnDockerEnvironment",
+			endpoint: &portainer.Endpoint{
+				Type: portainer.EdgeAgentOnDockerEnvironment,
+			},
+			expected: false,
+		},
+		{
+			name: "EdgeAgentOnKubernetesEnvironment",
+			endpoint: &portainer.Endpoint{
+				Type: portainer.EdgeAgentOnKubernetesEnvironment,
+			},
+			expected: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := IsRegularAgentEndpoint(tt.endpoint)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+func TestIsEdgeEndpoint(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name     string
+		endpoint *portainer.Endpoint
+		expected bool
+	}{
+		{
+			name: "EdgeAgentOnDockerEnvironment",
+			endpoint: &portainer.Endpoint{
+				Type: portainer.EdgeAgentOnDockerEnvironment,
+			},
+			expected: true,
+		},
+		{
+			name: "EdgeAgentOnKubernetesEnvironment",
+			endpoint: &portainer.Endpoint{
+				Type: portainer.EdgeAgentOnKubernetesEnvironment,
+			},
+			expected: true,
+		},
+		{
+			name: "NonEdgeEnvironment",
+			endpoint: &portainer.Endpoint{
+				Type: portainer.DockerEnvironment,
+			},
+			expected: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := IsEdgeEndpoint(tt.endpoint)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+func TestIsAssociatedEdgeEndpoint(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name     string
+		endpoint *portainer.Endpoint
+		expected bool
+	}{
+		{
+			name: "AssociatedEdgeEndpoint",
+			endpoint: &portainer.Endpoint{
+				Type:        portainer.EdgeAgentOnDockerEnvironment,
+				EdgeID:      "some-edge-id",
+				UserTrusted: true,
+			},
+			expected: true,
+		},
+		{
+			name: "NonAssociatedEdgeEndpoint",
+			endpoint: &portainer.Endpoint{
+				Type:        portainer.EdgeAgentOnDockerEnvironment,
+				EdgeID:      "",
+				UserTrusted: true,
+			},
+			expected: false,
+		},
+		{
+			name: "EdgeEndpointInWaitingRoom",
+			endpoint: &portainer.Endpoint{
+				Type:        portainer.EdgeAgentOnDockerEnvironment,
+				EdgeID:      "some-edge-id",
+				UserTrusted: false,
+			},
+			expected: false,
+		},
+		{
+			name: "NonEdgeEnvironment",
+			endpoint: &portainer.Endpoint{
+				Type:        portainer.DockerEnvironment,
+				EdgeID:      "some-edge-id",
+				UserTrusted: true,
+			},
+			expected: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := IsAssociatedEdgeEndpoint(tt.endpoint)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+func TestHasDirectConnectivity(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name     string
+		endpoint *portainer.Endpoint
+		expected bool
+	}{
+		{
+			name: "NonEdgeEnvironment",
+			endpoint: &portainer.Endpoint{
+				Type: portainer.DockerEnvironment,
+			},
+			expected: true,
+		},
+		{
+			name: "AssociatedEdgeEndpoint",
+			endpoint: &portainer.Endpoint{
+				Type:        portainer.EdgeAgentOnDockerEnvironment,
+				EdgeID:      "some-edge-id",
+				UserTrusted: true,
+				Edge:        portainer.EnvironmentEdgeSettings{AsyncMode: false},
+			},
+			expected: true,
+		},
+		{
+			name: "AssociatedAsyncEdgeEndpoint",
+			endpoint: &portainer.Endpoint{
+				Type:        portainer.EdgeAgentOnDockerEnvironment,
+				EdgeID:      "some-edge-id",
+				UserTrusted: true,
+				Edge:        portainer.EnvironmentEdgeSettings{AsyncMode: true},
+			},
+			expected: false,
+		},
+		{
+			name: "EdgeEndpointInWaitingRoom",
+			endpoint: &portainer.Endpoint{
+				Type:        portainer.EdgeAgentOnDockerEnvironment,
+				EdgeID:      "some-edge-id",
+				UserTrusted: false,
+				Edge:        portainer.EnvironmentEdgeSettings{AsyncMode: false},
+			},
+			expected: false,
+		},
+		{
+			name: "AsyncEdgeEndpointInWaitingRoom",
+			endpoint: &portainer.Endpoint{
+				Type:        portainer.EdgeAgentOnDockerEnvironment,
+				EdgeID:      "some-edge-id",
+				UserTrusted: false,
+				Edge:        portainer.EnvironmentEdgeSettings{AsyncMode: true},
+			},
+			expected: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := HasDirectConnectivity(tt.endpoint)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+func TestIsStandardEdgeEndpoint(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name     string
+		endpoint *portainer.Endpoint
+		expected bool
+	}{
+		{
+			name: "StandardEdgeEndpoint",
+			endpoint: &portainer.Endpoint{
+				Type: portainer.EdgeAgentOnDockerEnvironment,
+				Edge: portainer.EnvironmentEdgeSettings{AsyncMode: false},
+			},
+			expected: true,
+		},
+		{
+			name: "AsyncEdgeEndpoint",
+			endpoint: &portainer.Endpoint{
+				Type: portainer.EdgeAgentOnDockerEnvironment,
+				Edge: portainer.EnvironmentEdgeSettings{AsyncMode: true},
+			},
+			expected: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := IsStandardEdgeEndpoint(tt.endpoint)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+func TestIsNewerThan225(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name     string
+		version  string
+		expected bool
+	}{
+		{
+			name:     "NewerThan225",
+			version:  "2.25.1",
+			expected: true,
+		},
+		{
+			name:     "OlderThan225",
+			version:  "2.24.0",
+			expected: false,
+		},
+		{
+			name:     "Not a version",
+			version:  "NotAVersion",
+			expected: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := IsNewerThan225(tt.version)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
diff --git a/pkg/featureflags/LICENSE b/pkg/featureflags/LICENSE
new file mode 100644
index 0000000..ed7a040
--- /dev/null
+++ b/pkg/featureflags/LICENSE
@@ -0,0 +1,17 @@
+Copyright (c) 2022 Portainer.io
+
+This software is provided 'as-is', without any express or implied
+warranty.  In no event will the authors be held liable for any damages
+arising from the use of this software.
+
+Permission is granted to anyone to use this software for any purpose,
+including commercial applications, and to alter it and redistribute it
+freely, subject to the following restrictions:
+
+1. The origin of this software must not be misrepresented; you must not
+   claim that you wrote the original software. If you use this software
+   in a product, an acknowledgment in the product documentation would be
+   appreciated but is not required.
+2. Altered source versions must be plainly marked as such, and must not be
+   misrepresented as being the original software.
+3. This notice may not be removed or altered from any source distribution.
diff --git a/pkg/featureflags/featureflags.go b/pkg/featureflags/featureflags.go
new file mode 100644
index 0000000..09e1997
--- /dev/null
+++ b/pkg/featureflags/featureflags.go
@@ -0,0 +1,100 @@
+/*
+	 Package featureflags implements feature flags for Portainer projects
+
+	 Feature flags are used to turn on features that are not production ready.
+	 Use the Parse function to enable feature flags and also the pass a list of
+	 available flags
+
+	   e.g.
+	    var SupportedFeatureFlags = []featureflags.Feature{
+			"my-feature",
+		}
+
+		func main() {
+			// parse cli flags
+
+			// pass cli flags and supported feature flags to featureflags.Parse
+			featureflags.Parse([]string{"my-feature"}, SupportedFeatureFlags)
+		}
+
+		...
+		if featureflags.IsEnabled("my-feature") {
+			// do something
+		}
+*/
+package featureflags
+
+import (
+	"os"
+	"strings"
+
+	"github.com/rs/zerolog/log"
+)
+
+// Feature represents a feature that can be enabled or disabled via feature flags
+type Feature string
+
+var featureFlags map[Feature]bool
+
+// String returns the string representation of a feature flag
+func (f Feature) String() string {
+	return string(f)
+}
+
+// IsEnabled returns true if the feature flag is enabled
+func IsEnabled(feat Feature) bool {
+	return featureFlags[feat]
+}
+
+// IsSupported returns true if the feature is supported
+func IsSupported(feat Feature) bool {
+	_, ok := featureFlags[feat]
+
+	return ok
+}
+
+// FeatureFlags returns a map of all feature flags.
+// this is useful in situations where you need to pass all feature flags to a REST handler
+// function
+func FeatureFlags() map[Feature]bool {
+	return featureFlags
+}
+
+func initSupportedFeatures(supportedFeatures []Feature) {
+	featureFlags = make(map[Feature]bool)
+	for _, feat := range supportedFeatures {
+		featureFlags[feat] = false
+	}
+}
+
+// Parse turns on feature flags
+// It accepts a list of feature flags as strings and a list of supported features.
+// It will also check for feature flags in the PORTAINER_FEATURE_FLAGS environment variable.
+// Multiple feature flags can be specified with the PORTAINER_FEATURE_FLAGS environment.
+// variable using a comma separated list. e.g. "PORTAINER_FEATURE_FLAGS=feature1,feature2".
+// If a feature flag is not supported, it will be logged and ignored.
+// If a feature flag is supported, it will be logged and enabled.
+func Parse(features []string, supportedFeatures []Feature) {
+	initSupportedFeatures(supportedFeatures)
+
+	env := os.Getenv("PORTAINER_FEATURE_FLAGS")
+	envFeatures := []string{}
+	if env != "" {
+		envFeatures = strings.Split(env, ",")
+	}
+
+	features = append(features, envFeatures...)
+
+	// loop through feature flags to check if they are supported
+	for _, feat := range features {
+		f := Feature(strings.ToLower(feat))
+		if _, ok := featureFlags[f]; !ok {
+			log.Warn().Str("feature", f.String()).Msgf("unknown feature flag")
+
+			continue
+		}
+
+		featureFlags[f] = true
+		log.Info().Str("feature", f.String()).Msg("enabling feature")
+	}
+}
diff --git a/pkg/featureflags/featureflags_test.go b/pkg/featureflags/featureflags_test.go
new file mode 100644
index 0000000..23d0923
--- /dev/null
+++ b/pkg/featureflags/featureflags_test.go
@@ -0,0 +1,76 @@
+package featureflags
+
+import (
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_enableFeaturesFromFlags(t *testing.T) {
+	is := assert.New(t)
+
+	supportedFeatures := []Feature{"supported", "supported2", "supported3", "supported4", "supported5"}
+
+	t.Run("supported features should be supported", func(t *testing.T) {
+		initSupportedFeatures(supportedFeatures)
+
+		for _, featureFlag := range supportedFeatures {
+			is.True(IsSupported(featureFlag))
+		}
+	})
+
+	t.Run("unsupported features should not be supported", func(t *testing.T) {
+		initSupportedFeatures(supportedFeatures)
+
+		is.False(IsSupported("unsupported"))
+	})
+
+	tests := []struct {
+		cliFeatureFlags []string
+		envFeatureFlags []string
+	}{
+		{[]string{"supported", "supported2"}, []string{"supported3", "supported4"}},
+	}
+
+	for _, test := range tests {
+		err := os.Unsetenv("PORTAINER_FEATURE_FLAGS")
+		require.NoError(t, err)
+
+		t.Setenv("PORTAINER_FEATURE_FLAGS", strings.Join(test.envFeatureFlags, ","))
+
+		t.Run("testing", func(t *testing.T) {
+			Parse(test.cliFeatureFlags, supportedFeatures)
+			supported := toFeatureMap(test.cliFeatureFlags, test.envFeatureFlags)
+
+			// add env flags to supported flags
+			for _, featureFlag := range test.envFeatureFlags {
+				supported[Feature(featureFlag)] = true
+			}
+
+			for _, featureFlag := range supportedFeatures {
+				if _, ok := supported[featureFlag]; ok {
+					is.True(IsEnabled(featureFlag))
+				} else {
+					is.False(IsEnabled(featureFlag))
+				}
+			}
+		})
+	}
+}
+
+// helper
+func toFeatureMap(cliFeatures []string, envFeatures []string) map[Feature]bool {
+	m := map[Feature]bool{}
+	for _, s := range cliFeatures {
+		m[Feature(s)] = true
+	}
+
+	for _, s := range envFeatures {
+		m[Feature(s)] = true
+	}
+
+	return m
+}
diff --git a/pkg/fips/fips.go b/pkg/fips/fips.go
new file mode 100644
index 0000000..d16e47a
--- /dev/null
+++ b/pkg/fips/fips.go
@@ -0,0 +1,42 @@
+package fips
+
+import (
+	"crypto/fips140"
+	"errors"
+	"sync"
+
+	"github.com/rs/zerolog/log"
+)
+
+var fipsMode, isInitialised bool
+
+var once sync.Once
+
+var ErrTLSRequired = errors.New("TLS configuration is required in FIPS mode")
+
+func InitFIPS(enabled bool) {
+	once.Do(func() {
+		isInitialised = true
+		fipsMode = enabled
+
+		if enabled && !fips140.Enabled() {
+			log.Fatal().Msg("If FIPS mode is enabled then the fips140 GODEBUG environment variable must be set")
+		}
+	})
+}
+
+func FIPSMode() bool {
+	if !isInitialised {
+		log.Fatal().Msg("Could not determine if FIPS mode is enabled because InitFIPS was never called")
+	}
+
+	return fipsMode
+}
+
+func CanTLSSkipVerify() bool {
+	if !isInitialised {
+		log.Fatal().Msg("Could not determine if FIPS mode is enabled because InitFIPS was never called")
+	}
+
+	return !fipsMode
+}
diff --git a/pkg/fips/fips_test.go b/pkg/fips/fips_test.go
new file mode 100644
index 0000000..f14beae
--- /dev/null
+++ b/pkg/fips/fips_test.go
@@ -0,0 +1,16 @@
+package fips
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestInitFIPS(t *testing.T) {
+	t.Parallel()
+	InitFIPS(false)
+
+	require.False(t, FIPSMode())
+
+	require.True(t, CanTLSSkipVerify())
+}
diff --git a/pkg/libcrypto/LICENSE b/pkg/libcrypto/LICENSE
new file mode 100644
index 0000000..8696d60
--- /dev/null
+++ b/pkg/libcrypto/LICENSE
@@ -0,0 +1,17 @@
+Copyright (c) 2018-2020 Portainer.io
+
+This software is provided 'as-is', without any express or implied
+warranty.  In no event will the authors be held liable for any damages
+arising from the use of this software.
+
+Permission is granted to anyone to use this software for any purpose,
+including commercial applications, and to alter it and redistribute it
+freely, subject to the following restrictions:
+
+1. The origin of this software must not be misrepresented; you must not
+   claim that you wrote the original software. If you use this software
+   in a product, an acknowledgment in the product documentation would be
+   appreciated but is not required.
+2. Altered source versions must be plainly marked as such, and must not be
+   misrepresented as being the original software.
+3. This notice may not be removed or altered from any source distribution.
diff --git a/pkg/libcrypto/README.md b/pkg/libcrypto/README.md
new file mode 100644
index 0000000..3058c3c
--- /dev/null
+++ b/pkg/libcrypto/README.md
@@ -0,0 +1,3 @@
+# libcrypto
+
+A small library providing encryption and decryption functions.
diff --git a/pkg/libcrypto/decrypt.go b/pkg/libcrypto/decrypt.go
new file mode 100644
index 0000000..f57c093
--- /dev/null
+++ b/pkg/libcrypto/decrypt.go
@@ -0,0 +1,48 @@
+package libcrypto
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"errors"
+
+	"github.com/portainer/portainer/pkg/fips"
+)
+
+// Decrypt decrypts data using 256-bit AES-GCM.  This both hides the content of
+// the data and provides a check that it hasn't been altered. Expects input
+// form nonce|ciphertext|tag where '|' indicates concatenation.
+// Creates a 32bit hash of the key before decrypting the data.
+func Decrypt(data []byte, key []byte) ([]byte, error) {
+	return decrypt(data, key, fips.FIPSMode())
+}
+
+func decrypt(data []byte, key []byte, fips bool) ([]byte, error) {
+	var hashKey []byte
+	if fips {
+		// sha256 hash 32 bytes
+		hashKey = HashFromBytes(key)
+	} else {
+		// 16 byte hash, hex encoded is 32 bytes
+		hashKey = InsecureHash32Bytes(key)
+	}
+
+	block, err := aes.NewCipher(hashKey)
+	if err != nil {
+		return nil, err
+	}
+
+	gcm, err := cipher.NewGCMWithRandomNonce(block)
+	if err != nil {
+		return nil, err
+	}
+
+	if len(data) < gcm.NonceSize() {
+		return nil, errors.New("malformed ciphertext")
+	}
+
+	return gcm.Open(nil,
+		nil,
+		data,
+		nil,
+	)
+}
diff --git a/pkg/libcrypto/encrypt.go b/pkg/libcrypto/encrypt.go
new file mode 100644
index 0000000..a0ca2e9
--- /dev/null
+++ b/pkg/libcrypto/encrypt.go
@@ -0,0 +1,37 @@
+package libcrypto
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+
+	"github.com/portainer/portainer/pkg/fips"
+)
+
+// Encrypt encrypts data using 256-bit AES-GCM.  This both hides the content of
+// the data and provides a check that it hasn't been altered. Output takes the
+// form nonce|ciphertext|tag where '|' indicates concatenation.
+// Creates a 32bit hash of the key before encrypting the data.
+func Encrypt(data, key []byte) ([]byte, error) {
+	return encrypt(data, key, fips.FIPSMode())
+}
+
+func encrypt(data, key []byte, fips bool) ([]byte, error) {
+	var hashKey []byte
+	if fips {
+		hashKey = HashFromBytes(key)
+	} else {
+		hashKey = InsecureHash32Bytes(key)
+	}
+
+	block, err := aes.NewCipher(hashKey)
+	if err != nil {
+		return nil, err
+	}
+
+	gcm, err := cipher.NewGCMWithRandomNonce(block)
+	if err != nil {
+		return nil, err
+	}
+
+	return gcm.Seal(nil, nil, data, nil), nil
+}
diff --git a/pkg/libcrypto/encrypt_test.go b/pkg/libcrypto/encrypt_test.go
new file mode 100644
index 0000000..4450150
--- /dev/null
+++ b/pkg/libcrypto/encrypt_test.go
@@ -0,0 +1,57 @@
+package libcrypto
+
+import (
+	"crypto/rand"
+	"io"
+	"testing"
+
+	"github.com/portainer/portainer/pkg/fips"
+	"github.com/stretchr/testify/require"
+)
+
+func init() {
+	fips.InitFIPS(false)
+}
+
+func TestEncryptDecrypt(t *testing.T) {
+	t.Parallel()
+	dataFn := func() []byte {
+		data := make([]byte, 1024)
+		_, err := io.ReadFull(rand.Reader, data)
+		require.NoError(t, err)
+
+		return data
+	}
+
+	fn := func(t *testing.T, fips bool) {
+		data := dataFn()
+
+		encrypted, err := encrypt(data, []byte("test"), fips)
+		require.NoError(t, err)
+
+		decrypted, err := decrypt(encrypted, []byte("test"), fips)
+		require.NoError(t, err)
+
+		require.Equal(t, data, decrypted)
+	}
+
+	t.Run("fips", func(t *testing.T) {
+		fn(t, true)
+	})
+
+	t.Run("non-fips", func(t *testing.T) {
+		fn(t, false)
+	})
+
+	t.Run("system_fips_mode", func(t *testing.T) {
+		data := dataFn()
+
+		encrypted, err := Encrypt(data, []byte("test"))
+		require.NoError(t, err)
+
+		decrypted, err := Decrypt(encrypted, []byte("test"))
+		require.NoError(t, err)
+
+		require.Equal(t, data, decrypted)
+	})
+}
diff --git a/pkg/libcrypto/hash.go b/pkg/libcrypto/hash.go
new file mode 100644
index 0000000..143f148
--- /dev/null
+++ b/pkg/libcrypto/hash.go
@@ -0,0 +1,27 @@
+package libcrypto
+
+import (
+	"crypto/md5"
+	"crypto/sha256"
+	"encoding/hex"
+)
+
+// InsecureHashFromBytes returns the 16 byte md5 hash of the specified data
+func InsecureHashFromBytes(data []byte) []byte {
+	digest := md5.New()
+	digest.Write(data)
+	return digest.Sum(nil)
+}
+
+// InsecureHash32Bytes returns a hexadecimal encoded hash to make a 16 byte md5 hash into 32 bytes
+func InsecureHash32Bytes(data []byte) []byte {
+	hash := InsecureHashFromBytes(data)
+	return []byte(hex.EncodeToString(hash))
+}
+
+// HashFromBytes returns the 32 byte sha256 hash of the specified data
+func HashFromBytes(data []byte) []byte {
+	hash := sha256.New()
+	hash.Write(data)
+	return hash.Sum(nil)
+}
diff --git a/pkg/libcrypto/ssl.go b/pkg/libcrypto/ssl.go
new file mode 100644
index 0000000..179b21e
--- /dev/null
+++ b/pkg/libcrypto/ssl.go
@@ -0,0 +1,84 @@
+package libcrypto
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/x509"
+	"encoding/pem"
+	"errors"
+	"math/big"
+	"net"
+	"os"
+	"time"
+
+	"github.com/portainer/portainer/api/logs"
+)
+
+// GenerateCertsForHost generates a self-signed certificate for host and saves them at certPath and keyPath
+func GenerateCertsForHost(hostname, ip, certPath, keyPath string, expiry time.Time) error {
+	serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
+	serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
+	if err != nil {
+		return err
+	}
+
+	template := x509.Certificate{
+		SerialNumber:          serialNumber,
+		NotAfter:              expiry,
+		NotBefore:             time.Now(),
+		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
+		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+		BasicConstraintsValid: true,
+	}
+
+	parsedIP := net.ParseIP(ip)
+	if parsedIP == nil {
+		return errors.New("Failed parsing host ip")
+	}
+
+	template.DNSNames = append(template.DNSNames, hostname)
+	template.IPAddresses = append(template.IPAddresses, parsedIP)
+
+	keyPair, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		return err
+	}
+
+	encodedCert, err := x509.CreateCertificate(rand.Reader, &template, &template, &keyPair.PublicKey, keyPair)
+	if err != nil {
+		return err
+	}
+
+	err = createPEMEncodedFile(certPath, "CERTIFICATE", encodedCert)
+	if err != nil {
+		return err
+	}
+
+	key, err := x509.MarshalECPrivateKey(keyPair)
+	if err != nil {
+		return err
+	}
+
+	err = createPEMEncodedFile(keyPath, "EC PRIVATE KEY", key)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func createPEMEncodedFile(path, header string, data []byte) error {
+	file, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
+	if err != nil {
+		return err
+	}
+	defer logs.CloseAndLogErr(file)
+
+	err = pem.Encode(file, &pem.Block{Type: header, Bytes: data})
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/pkg/libhelm/LICENSE b/pkg/libhelm/LICENSE
new file mode 100644
index 0000000..cc784e1
--- /dev/null
+++ b/pkg/libhelm/LICENSE
@@ -0,0 +1,7 @@
+Copyright 2021 Portainer.io
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/pkg/libhelm/README.md b/pkg/libhelm/README.md
new file mode 100644
index 0000000..c2454ca
--- /dev/null
+++ b/pkg/libhelm/README.md
@@ -0,0 +1,17 @@
+# LibHelm
+
+A helm abstraction for Portainer.
+
+## Installation
+
+```sh
+go get github.com/portainer/portainer/pkg/libhelm
+```
+
+## Tests
+
+### Integration
+
+```sh
+INTEGRATION_TEST=1 go test binary/*.go
+```
diff --git a/pkg/libhelm/cache/cache.go b/pkg/libhelm/cache/cache.go
new file mode 100644
index 0000000..16cda44
--- /dev/null
+++ b/pkg/libhelm/cache/cache.go
@@ -0,0 +1,126 @@
+package cache
+
+import (
+	"fmt"
+	"time"
+
+	"github.com/patrickmn/go-cache"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/rs/zerolog/log"
+	"helm.sh/helm/v4/pkg/registry"
+)
+
+// Cache manages Helm registry clients with TTL-based expiration
+// Registry clients are cached per registry ID rather than per user session
+// to optimize rate limiting - one login per registry per Portainer instance
+type Cache struct {
+	cache *cache.Cache
+}
+
+// CachedRegistryClient wraps a registry client with metadata
+type CachedRegistryClient struct {
+	Client     *registry.Client
+	RegistryID portainer.RegistryID
+	CreatedAt  time.Time
+}
+
+// newCache creates a new Helm registry client cache with the specified timeout
+func newCache(userSessionTimeout string) (*Cache, error) {
+	timeout, err := time.ParseDuration(userSessionTimeout)
+	if err != nil {
+		return nil, fmt.Errorf("invalid user session timeout: %w", err)
+	}
+
+	return &Cache{
+		cache: cache.New(timeout, timeout),
+	}, nil
+}
+
+// getByRegistryID retrieves a cached registry client by registry ID
+// Cache key strategy: use registryID for maximum efficiency against rate limits
+// This means one login per registry per Portainer instance, regardless of user/environment
+func (c *Cache) getByRegistryID(registryID portainer.RegistryID) (*registry.Client, bool) {
+	key := generateRegistryIDCacheKey(registryID)
+
+	cachedClient, found := c.cache.Get(key)
+	if !found {
+		log.Debug().
+			Str("cache_key", key).
+			Int("registry_id", int(registryID)).
+			Str("context", "HelmRegistryCache").
+			Msg("Cache miss for registry client")
+		return nil, false
+	}
+
+	client := cachedClient.(CachedRegistryClient)
+
+	log.Debug().
+		Str("cache_key", key).
+		Int("registry_id", int(registryID)).
+		Str("context", "HelmRegistryCache").
+		Msg("Cache hit for registry client")
+
+	return client.Client, true
+}
+
+// setByRegistryID stores a registry client in the cache with registry ID context
+func (c *Cache) setByRegistryID(registryID portainer.RegistryID, client *registry.Client) {
+	if client == nil {
+		log.Warn().
+			Int("registry_id", int(registryID)).
+			Str("context", "HelmRegistryCache").
+			Msg("Attempted to cache nil registry client")
+		return
+	}
+
+	key := generateRegistryIDCacheKey(registryID)
+
+	cachedClient := CachedRegistryClient{
+		Client:     client,
+		RegistryID: registryID,
+		CreatedAt:  time.Now(),
+	}
+
+	c.cache.Set(key, cachedClient, cache.DefaultExpiration)
+
+	log.Debug().
+		Str("cache_key", key).
+		Int("registry_id", int(registryID)).
+		Str("context", "HelmRegistryCache").
+		Msg("Cached registry client")
+}
+
+// flushRegistry removes cached registry client for a specific registry ID
+// This should be called whenever registry credentials change
+func (c *Cache) flushRegistry(registryID portainer.RegistryID) {
+	key := generateRegistryIDCacheKey(registryID)
+
+	c.cache.Delete(key)
+	log.Info().
+		Int("registry_id", int(registryID)).
+		Str("context", "HelmRegistryCache").
+		Msg("Flushed registry client due to registry change")
+}
+
+// flushAll removes all cached registry clients
+func (c *Cache) flushAll() {
+	itemCount := c.cache.ItemCount()
+	c.cache.Flush()
+
+	if itemCount > 0 {
+		log.Info().
+			Int("cached_clients_removed", itemCount).
+			Str("context", "HelmRegistryCache").
+			Msg("Flushed all registry clients")
+	}
+}
+
+// generateRegistryIDCacheKey creates a cache key from registry ID
+// Key strategy decision: Use registry ID instead of user sessions or URL+username
+// This provides optimal rate limiting protection since each registry only gets
+// logged into once per Portainer instance, regardless of how many users access it
+// RBAC security is enforced before reaching this caching layer
+// When a new user needs access, they reuse the same cached client
+func generateRegistryIDCacheKey(registryID portainer.RegistryID) string {
+	return fmt.Sprintf("registry:%d", registryID)
+}
diff --git a/pkg/libhelm/cache/manager.go b/pkg/libhelm/cache/manager.go
new file mode 100644
index 0000000..fb0bbb8
--- /dev/null
+++ b/pkg/libhelm/cache/manager.go
@@ -0,0 +1,81 @@
+package cache
+
+import (
+	"sync"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/rs/zerolog/log"
+	"helm.sh/helm/v4/pkg/registry"
+)
+
+var (
+	// Global singleton instance
+	instance *Cache
+	once     sync.Once
+)
+
+// Initialize creates and initializes the global cache instance
+func Initialize(userSessionTimeout string) error {
+	var err error
+	once.Do(func() {
+		instance, err = newCache(userSessionTimeout)
+		if err != nil {
+			log.Error().
+				Err(err).
+				Str("user_session_timeout", userSessionTimeout).
+				Msg("Failed to initialize Helm registry cache")
+		} else {
+			log.Info().
+				Str("user_session_timeout", userSessionTimeout).
+				Msg("Helm registry cache initialized")
+		}
+	})
+	return err
+}
+
+// Registry-based cache management functions
+
+// GetCachedRegistryClientByID retrieves a cached registry client by registry ID
+func GetCachedRegistryClientByID(registryID portainer.RegistryID) (*registry.Client, bool) {
+	if instance == nil {
+		log.Debug().
+			Str("context", "HelmRegistryCache").
+			Msg("Cache not initialized, returning nil")
+		return nil, false
+	}
+	return instance.getByRegistryID(registryID)
+}
+
+// SetCachedRegistryClientByID stores a registry client in the cache by registry ID
+func SetCachedRegistryClientByID(registryID portainer.RegistryID, client *registry.Client) {
+	if instance == nil {
+		log.Warn().
+			Str("context", "HelmRegistryCache").
+			Msg("Cannot set cache entry - cache not initialized")
+		return
+	}
+	instance.setByRegistryID(registryID, client)
+}
+
+// FlushRegistryByID removes cached registry client for a specific registry ID
+// This should be called whenever registry credentials change
+func FlushRegistryByID(registryID portainer.RegistryID) {
+	if instance == nil {
+		log.Debug().
+			Str("context", "HelmRegistryCache").
+			Msg("Cache not initialized, nothing to flush")
+		return
+	}
+	instance.flushRegistry(registryID)
+}
+
+// FlushAll removes all cached registry clients
+func FlushAll() {
+	if instance == nil {
+		log.Debug().
+			Str("context", "HelmRegistryCache").
+			Msg("Cache not initialized, nothing to flush")
+		return
+	}
+	instance.flushAll()
+}
diff --git a/pkg/libhelm/manager.go b/pkg/libhelm/manager.go
new file mode 100644
index 0000000..14b894e
--- /dev/null
+++ b/pkg/libhelm/manager.go
@@ -0,0 +1,11 @@
+package libhelm
+
+import (
+	"github.com/portainer/portainer/pkg/libhelm/sdk"
+	"github.com/portainer/portainer/pkg/libhelm/types"
+)
+
+// NewHelmPackageManager returns a new instance of HelmPackageManager based on HelmConfig
+func NewHelmPackageManager() types.HelmPackageManager {
+	return sdk.NewHelmSDKPackageManager()
+}
diff --git a/pkg/libhelm/options/chart_reference.go b/pkg/libhelm/options/chart_reference.go
new file mode 100644
index 0000000..11b3daf
--- /dev/null
+++ b/pkg/libhelm/options/chart_reference.go
@@ -0,0 +1,38 @@
+package options
+
+import (
+	"strings"
+)
+
+const (
+	// OCIProtocolPrefix is the standard OCI protocol prefix
+	OCIProtocolPrefix = "oci://"
+)
+
+// ConstructChartReference constructs the appropriate chart reference based on registry type
+func ConstructChartReference(registryURL string, chartName string) string {
+	if registryURL == "" {
+		return chartName
+	}
+
+	// Don't double-prefix if chart already contains the registry URL
+	if strings.HasPrefix(chartName, OCIProtocolPrefix) {
+		return chartName
+	}
+
+	baseURL := ConstructOCIRegistryReference(registryURL)
+
+	// Handle cases where chartName might already have a path separator
+	if strings.HasPrefix(chartName, "/") {
+		return baseURL + chartName
+	}
+
+	return baseURL + "/" + chartName
+}
+
+func ConstructOCIRegistryReference(registryURL string) string {
+	// Remove oci:// prefix if present to avoid duplication
+	registryURL = strings.TrimPrefix(registryURL, OCIProtocolPrefix)
+	// Ensure we have oci:// prefix for OCI registries
+	return OCIProtocolPrefix + registryURL
+}
diff --git a/pkg/libhelm/options/chart_reference_test.go b/pkg/libhelm/options/chart_reference_test.go
new file mode 100644
index 0000000..89b7a24
--- /dev/null
+++ b/pkg/libhelm/options/chart_reference_test.go
@@ -0,0 +1,102 @@
+package options
+
+import (
+	"testing"
+)
+
+func TestConstructChartReference(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name        string
+		registryURL string
+		chartName   string
+		expected    string
+	}{
+		{
+			name:        "empty registry URL returns chart name as-is",
+			registryURL: "",
+			chartName:   "nginx",
+			expected:    "nginx",
+		},
+		{
+			name:        "basic OCI registry with chart name",
+			registryURL: "registry.example.com",
+			chartName:   "nginx",
+			expected:    "oci://registry.example.com/nginx",
+		},
+		{
+			name:        "registry with project path",
+			registryURL: "harbor.example.com",
+			chartName:   "library/nginx",
+			expected:    "oci://harbor.example.com/library/nginx",
+		},
+		{
+			name:        "chart name already has oci prefix returns as-is",
+			registryURL: "registry.example.com",
+			chartName:   "oci://registry.example.com/nginx",
+			expected:    "oci://registry.example.com/nginx",
+		},
+		{
+			name:        "chart name with leading slash",
+			registryURL: "registry.example.com",
+			chartName:   "/nginx",
+			expected:    "oci://registry.example.com/nginx",
+		},
+		{
+			name:        "registry URL already has oci prefix",
+			registryURL: "oci://registry.example.com",
+			chartName:   "nginx",
+			expected:    "oci://registry.example.com/nginx",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := ConstructChartReference(tt.registryURL, tt.chartName)
+			if result != tt.expected {
+				t.Errorf("ConstructChartReference(%q, %q) = %q, want %q",
+					tt.registryURL, tt.chartName, result, tt.expected)
+			}
+		})
+	}
+}
+
+func TestConstructOCIRegistryReference(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name        string
+		registryURL string
+		expected    string
+	}{
+		{
+			name:        "simple registry URL",
+			registryURL: "registry.example.com",
+			expected:    "oci://registry.example.com",
+		},
+		{
+			name:        "registry URL with oci prefix",
+			registryURL: "oci://registry.example.com",
+			expected:    "oci://registry.example.com",
+		},
+		{
+			name:        "registry URL with port",
+			registryURL: "registry.example.com:5000",
+			expected:    "oci://registry.example.com:5000",
+		},
+		{
+			name:        "empty registry URL",
+			registryURL: "",
+			expected:    "oci://",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := ConstructOCIRegistryReference(tt.registryURL)
+			if result != tt.expected {
+				t.Errorf("ConstructOCIRegistryReference(%q) = %q, want %q",
+					tt.registryURL, result, tt.expected)
+			}
+		})
+	}
+}
diff --git a/pkg/libhelm/options/cluster_access.go b/pkg/libhelm/options/cluster_access.go
new file mode 100644
index 0000000..1fe079c
--- /dev/null
+++ b/pkg/libhelm/options/cluster_access.go
@@ -0,0 +1,11 @@
+package options
+
+// KubernetesClusterAccess represents core details which can be used to generate KubeConfig file/data
+type KubernetesClusterAccess struct {
+	ClusterName              string `example:"portainer-cluster-endpoint-1"`
+	ContextName              string `example:"portainer-ctx-endpoint-1"`
+	UserName                 string `example:"portainer-user-endpoint-1"`
+	ClusterServerURL         string `example:"https://mycompany.k8s.com"`
+	CertificateAuthorityFile string `example:"/data/tls/localhost.crt"`
+	AuthToken                string `example:"ey..."`
+}
diff --git a/pkg/libhelm/options/get_options.go b/pkg/libhelm/options/get_options.go
new file mode 100644
index 0000000..fcac76a
--- /dev/null
+++ b/pkg/libhelm/options/get_options.go
@@ -0,0 +1,12 @@
+package options
+
+type GetOptions struct {
+	Name      string
+	Namespace string
+	// ShowResources indicates whether to display the resources of the named release
+	ShowResources           bool
+	Revision                int
+	KubernetesClusterAccess *KubernetesClusterAccess
+
+	Env []string
+}
diff --git a/pkg/libhelm/options/history_options.go b/pkg/libhelm/options/history_options.go
new file mode 100644
index 0000000..76bb02e
--- /dev/null
+++ b/pkg/libhelm/options/history_options.go
@@ -0,0 +1,9 @@
+package options
+
+type HistoryOptions struct {
+	Name                    string
+	Namespace               string
+	KubernetesClusterAccess *KubernetesClusterAccess
+
+	Env []string
+}
diff --git a/pkg/libhelm/options/install_options.go b/pkg/libhelm/options/install_options.go
new file mode 100644
index 0000000..bd775d1
--- /dev/null
+++ b/pkg/libhelm/options/install_options.go
@@ -0,0 +1,39 @@
+package options
+
+import (
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+)
+
+type InstallOptions struct {
+	Name      string
+	Chart     string
+	Version   string
+	Namespace string
+	Repo      string
+	Registry  *portainer.Registry
+	Wait      bool
+	// Values contains inline Helm values merged with the chart defaults.
+	// If both are provided, entries in Values override those from ValuesFile.
+	Values map[string]any
+	// ValuesFile is a path to a YAML file with Helm values to apply.
+	// File values are applied first; Values take precedence on conflicts.
+	ValuesFile              string
+	HelmAppLabels           map[string]string
+	Atomic                  bool
+	DryRun                  bool
+	Timeout                 time.Duration
+	KubernetesClusterAccess *KubernetesClusterAccess
+	TakeOwnership           bool
+	CreateNamespace         bool
+
+	// GitOps related options
+	AutoUpdate *portainer.AutoUpdateSettings
+
+	// StackID is the ID of the Portainer stack associated with this release
+	StackID int
+
+	// Optional environment vars to pass when running helm
+	Env []string
+}
diff --git a/pkg/libhelm/options/list_options.go b/pkg/libhelm/options/list_options.go
new file mode 100644
index 0000000..72e0b25
--- /dev/null
+++ b/pkg/libhelm/options/list_options.go
@@ -0,0 +1,11 @@
+package options
+
+// ListOptions are portainer supported options for `helm list`
+type ListOptions struct {
+	Filter                  string
+	Selector                string
+	Namespace               string
+	KubernetesClusterAccess *KubernetesClusterAccess
+
+	Env []string
+}
diff --git a/pkg/libhelm/options/rollback_options.go b/pkg/libhelm/options/rollback_options.go
new file mode 100644
index 0000000..1c220f2
--- /dev/null
+++ b/pkg/libhelm/options/rollback_options.go
@@ -0,0 +1,19 @@
+package options
+
+import "time"
+
+// RollbackOptions defines options for rollback.
+type RollbackOptions struct {
+	// Required
+	Name                    string
+	Namespace               string
+	KubernetesClusterAccess *KubernetesClusterAccess
+
+	// Optional with defaults
+	Version     int           // Target revision to rollback to (0 means previous revision)
+	Timeout     time.Duration // Default: 5 minutes
+	Wait        bool          // Default: false
+	WaitForJobs bool          // Default: false
+	Recreate    bool          // Default: false - whether to recreate pods
+	Force       bool          // Default: false - whether to force recreation
+}
diff --git a/pkg/libhelm/options/search_repo_options.go b/pkg/libhelm/options/search_repo_options.go
new file mode 100644
index 0000000..333c28c
--- /dev/null
+++ b/pkg/libhelm/options/search_repo_options.go
@@ -0,0 +1,15 @@
+package options
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+)
+
+type SearchRepoOptions struct {
+	Repo     string       `example:"https://charts.gitlab.io/"`
+	Client   *http.Client `example:"&http.Client{Timeout: time.Second * 10}"`
+	Chart    string       `example:"my-chart"`
+	UseCache bool         `example:"false"`
+	Registry *portainer.Registry
+}
diff --git a/pkg/libhelm/options/show_options.go b/pkg/libhelm/options/show_options.go
new file mode 100644
index 0000000..dadbab9
--- /dev/null
+++ b/pkg/libhelm/options/show_options.go
@@ -0,0 +1,27 @@
+package options
+
+import portainer "github.com/portainer/portainer/api"
+
+// ShowOutputFormat is the format of the output of `helm show`
+type ShowOutputFormat string
+
+const (
+	// ShowAll is the format which shows all the information of a chart
+	ShowAll ShowOutputFormat = "all"
+	// ShowChart is the format which only shows the chart's definition
+	ShowChart ShowOutputFormat = "chart"
+	// ShowValues is the format which only shows the chart's values
+	ShowValues ShowOutputFormat = "values"
+	// ShowReadme is the format which only shows the chart's README
+	ShowReadme ShowOutputFormat = "readme"
+)
+
+// ShowOptions are portainer supported options for `helm install`
+type ShowOptions struct {
+	OutputFormat ShowOutputFormat
+	Chart        string
+	Repo         string
+	Version      string
+	Env          []string
+	Registry     *portainer.Registry // Registry credentials for authentication
+}
diff --git a/pkg/libhelm/options/uninstall_options.go b/pkg/libhelm/options/uninstall_options.go
new file mode 100644
index 0000000..22260ca
--- /dev/null
+++ b/pkg/libhelm/options/uninstall_options.go
@@ -0,0 +1,18 @@
+package options
+
+import "time"
+
+// UninstallOptions are portainer supported options for `helm uninstall`
+type UninstallOptions struct {
+	Name                    string
+	Namespace               string
+	KubernetesClusterAccess *KubernetesClusterAccess
+
+	// Wait blocks until all resources are deleted before returning (helm uninstall --wait).
+	// Use when a restore will be applied immediately after uninstall so resources are gone first.
+	Wait bool
+	// Timeout is how long to wait for resources to be deleted when Wait is true (default 15m).
+	Timeout time.Duration
+
+	Env []string
+}
diff --git a/pkg/libhelm/release/release.go b/pkg/libhelm/release/release.go
new file mode 100644
index 0000000..e8b64bf
--- /dev/null
+++ b/pkg/libhelm/release/release.go
@@ -0,0 +1,262 @@
+package release
+
+import (
+	"time"
+
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+)
+
+// Release is the struct that holds the information for a helm release.
+// The struct definitions have been copied from the official Helm Golang client/library.
+
+// ReleaseElement is a struct that represents a release
+// This is the official struct from the helm project (golang codebase) - exported
+type ReleaseElement struct {
+	Name       string `json:"name"`
+	Namespace  string `json:"namespace"`
+	Revision   string `json:"revision"`
+	Updated    string `json:"updated"`
+	Status     string `json:"status"`
+	Chart      string `json:"chart"`
+	AppVersion string `json:"appVersion"`
+}
+
+// Release describes a deployment of a chart, together with the chart
+// and the variables used to deploy that chart.
+type Release struct {
+	// Name is the name of the release
+	Name string `json:"name,omitempty"`
+	// Info provides information about a release
+	Info *Info `json:"info,omitempty"`
+	// Chart is the chart that was released.
+	Chart Chart `json:"chart,omitzero"`
+	// Config is the set of extra Values added to the chart.
+	// These values override the default values inside of the chart.
+	Config map[string]any `json:"config,omitempty"`
+	// Manifest is the string representation of the rendered template.
+	Manifest string `json:"manifest,omitempty"`
+	// Hooks are all of the hooks declared for this release.
+	Hooks []*Hook `json:"hooks,omitempty"`
+	// AppVersion is the app version of the release.
+	AppVersion string `json:"appVersion,omitempty"`
+	// Version is an int which represents the revision of the release.
+	Version int `json:"version,omitempty"`
+	// Namespace is the kubernetes namespace of the release.
+	Namespace string `json:"namespace,omitempty"`
+	// Labels of the release.
+	// Disabled encoding into Json cause labels are stored in storage driver metadata field.
+	Labels map[string]string `json:"-"`
+	// ChartReference are the labels that are used to identify the chart source.
+	ChartReference ChartReference `json:"chartReference,omitzero"`
+	// StackID is the ID of the Portainer stack associated with this release (if using GitOps)
+	StackID int `json:"stackID,omitempty"`
+	// Values are the values used to deploy the chart.
+	Values Values `json:"values,omitzero"`
+}
+
+type Values struct {
+	UserSuppliedValues string `json:"userSuppliedValues,omitempty"`
+	ComputedValues     string `json:"computedValues,omitempty"`
+}
+
+type ChartReference struct {
+	ChartPath  string `json:"chartPath,omitempty"`
+	RepoURL    string `json:"repoURL,omitempty"`
+	RegistryID int64  `json:"registryID,omitempty"`
+}
+
+type GitReference struct {
+	Repo               string `json:"repo,omitempty"`
+	Reference          string `json:"reference,omitempty"`
+	CommitID           string `json:"commitID,omitempty"`
+	StackID            string `json:"stackID,omitempty"`
+	AutoUpdate         bool   `json:"autoUpdate,omitempty"`
+	AutoUpdateInterval string `json:"autoUpdateInterval,omitempty"`
+	TLSSkipVerify      bool   `json:"tlsSkipVerify,omitempty"`
+}
+
+// Chart is a helm package that contains metadata, a default config, zero or more
+// optionally parameterizable templates, and zero or more charts (dependencies).
+type Chart struct {
+	// Raw contains the raw contents of the files originally contained in the chart archive.
+	//
+	// This should not be used except in special cases like `helm show values`,
+	// where we want to display the raw values, comments and all.
+	Raw []*File `json:"-"`
+	// Metadata is the contents of the Chartfile.
+	Metadata *Metadata `json:"metadata"`
+	// Lock is the contents of Chart.lock.
+	Lock *Lock `json:"lock"`
+	// Templates for this chart.
+	Templates []*File `json:"templates"`
+	// Values are default config for this chart.
+	Values map[string]any `json:"values"`
+	// Schema is an optional JSON schema for imposing structure on Values
+	Schema []byte `json:"schema"`
+	// Files are miscellaneous files in a chart archive,
+	// e.g. README, LICENSE, etc.
+	Files []*File `json:"files"`
+}
+
+// File represents a file as a name/value pair.
+//
+// By convention, name is a relative path within the scope of the chart's
+// base directory.
+type File struct {
+	// Name is the path-like name of the template.
+	Name string `json:"name"`
+	// Data is the template as byte data.
+	Data []byte `json:"data"`
+}
+
+// Metadata for a Chart file. This models the structure of a Chart.yaml file.
+type Metadata struct {
+	// The name of the chart. Required.
+	Name string `json:"name,omitempty"`
+	// The URL to a relevant project page, git repo, or contact person
+	Home string `json:"home,omitempty"`
+	// Source is the URL to the source code of this chart
+	Sources []string `json:"sources,omitempty"`
+	// A SemVer 2 conformant version string of the chart. Required.
+	Version string `json:"version,omitempty"`
+	// A one-sentence description of the chart
+	Description string `json:"description,omitempty"`
+	// A list of string keywords
+	Keywords []string `json:"keywords,omitempty"`
+	// A list of name and URL/email address combinations for the maintainer(s)
+	Maintainers []*Maintainer `json:"maintainers,omitempty"`
+	// The URL to an icon file.
+	Icon string `json:"icon,omitempty"`
+	// The API Version of this chart. Required.
+	APIVersion string `json:"apiVersion,omitempty"`
+	// The condition to check to enable chart
+	Condition string `json:"condition,omitempty"`
+	// The tags to check to enable chart
+	Tags string `json:"tags,omitempty"`
+	// The version of the application enclosed inside of this chart.
+	AppVersion string `json:"appVersion,omitempty"`
+	// Whether or not this chart is deprecated
+	Deprecated bool `json:"deprecated,omitempty"`
+	// Annotations are additional mappings uninterpreted by Helm,
+	// made available for inspection by other applications.
+	Annotations map[string]string `json:"annotations,omitempty"`
+	// KubeVersion is a SemVer constraint specifying the version of Kubernetes required.
+	KubeVersion string `json:"kubeVersion,omitempty"`
+	// Dependencies are a list of dependencies for a chart.
+	Dependencies []*Dependency `json:"dependencies,omitempty"`
+	// Specifies the chart type: application or library
+	Type string `json:"type,omitempty"`
+}
+
+// Maintainer describes a Chart maintainer.
+type Maintainer struct {
+	// Name is a user name or organization name
+	Name string `json:"name,omitempty"`
+	// Email is an optional email address to contact the named maintainer
+	Email string `json:"email,omitempty"`
+	// URL is an optional URL to an address for the named maintainer
+	URL string `json:"url,omitempty"`
+}
+
+// Dependency describes a chart upon which another chart depends.
+//
+// Dependencies can be used to express developer intent, or to capture the state
+// of a chart.
+type Dependency struct {
+	// Name is the name of the dependency.
+	//
+	// This must mach the name in the dependency's Chart.yaml.
+	Name string `json:"name"`
+	// Version is the version (range) of this chart.
+	//
+	// A lock file will always produce a single version, while a dependency
+	// may contain a semantic version range.
+	Version string `json:"version,omitempty"`
+	// The URL to the repository.
+	//
+	// Appending `index.yaml` to this string should result in a URL that can be
+	// used to fetch the repository index.
+	Repository string `json:"repository"`
+	// A yaml path that resolves to a boolean, used for enabling/disabling charts (e.g. subchart1.enabled )
+	Condition string `json:"condition,omitempty"`
+	// Tags can be used to group charts for enabling/disabling together
+	Tags []string `json:"tags,omitempty"`
+	// Enabled bool determines if chart should be loaded
+	Enabled bool `json:"enabled,omitempty"`
+	// ImportValues holds the mapping of source values to parent key to be imported. Each item can be a
+	// string or pair of child/parent sublist items.
+	ImportValues []any `json:"import-values,omitempty"`
+	// Alias usable alias to be used for the chart
+	Alias string `json:"alias,omitempty"`
+}
+
+// Lock is a lock file for dependencies.
+//
+// It represents the state that the dependencies should be in.
+type Lock struct {
+	// Generated is the date the lock file was last generated.
+	Generated time.Time `json:"generated"`
+	// Digest is a hash of the dependencies in Chart.yaml.
+	Digest string `json:"digest"`
+	// Dependencies is the list of dependencies that this lock file has locked.
+	Dependencies []*Dependency `json:"dependencies"`
+}
+
+// Info describes release information.
+type Info struct {
+	// FirstDeployed is when the release was first deployed.
+	FirstDeployed time.Time `json:"first_deployed,omitzero"`
+	// LastDeployed is when the release was last deployed.
+	LastDeployed time.Time `json:"last_deployed,omitzero"`
+	// Deleted tracks when this object was deleted.
+	Deleted time.Time `json:"deleted"`
+	// Description is human-friendly "log entry" about this release.
+	Description string `json:"description,omitempty"`
+	// Status is the current state of the release
+	Status Status `json:"status,omitempty"`
+	// Contains the rendered templates/NOTES.txt if available
+	Notes string `json:"notes,omitempty"`
+	// Resources is the list of resources that are part of the release
+	Resources []*unstructured.Unstructured `json:"resources,omitempty"`
+}
+
+// Status is the status of a release
+type Status string
+
+// Hook defines a hook object.
+type Hook struct {
+	Name string `json:"name,omitempty"`
+	// Kind is the Kubernetes kind.
+	Kind string `json:"kind,omitempty"`
+	// Path is the chart-relative path to the template.
+	Path string `json:"path,omitempty"`
+	// Manifest is the manifest contents.
+	Manifest string `json:"manifest,omitempty"`
+	// Events are the events that this hook fires on.
+	Events []HookEvent `json:"events,omitempty"`
+	// LastRun indicates the date/time this was last run.
+	LastRun HookExecution `json:"last_run,omitzero"`
+	// Weight indicates the sort order for execution among similar Hook type
+	Weight int `json:"weight,omitempty"`
+	// DeletePolicies are the policies that indicate when to delete the hook
+	DeletePolicies []HookDeletePolicy `json:"delete_policies,omitempty"`
+}
+
+// HookEvent specifies the hook event
+type HookEvent string
+
+// A HookExecution records the result for the last execution of a hook for a given release.
+type HookExecution struct {
+	// StartedAt indicates the date/time this hook was started
+	StartedAt time.Time `json:"started_at,omitzero"`
+	// CompletedAt indicates the date/time this hook was completed.
+	CompletedAt time.Time `json:"completed_at,omitzero"`
+	// Phase indicates whether the hook completed successfully
+	Phase HookPhase `json:"phase"`
+}
+
+// A HookPhase indicates the state of a hook execution
+type HookPhase string
+
+// HookDeletePolicy specifies the hook delete policy
+type HookDeletePolicy string
diff --git a/pkg/libhelm/sdk/chartsources.go b/pkg/libhelm/sdk/chartsources.go
new file mode 100644
index 0000000..cccf846
--- /dev/null
+++ b/pkg/libhelm/sdk/chartsources.go
@@ -0,0 +1,348 @@
+package sdk
+
+// Helm Registry Client Caching Strategy
+//
+// This package implements a registry-based caching mechanism for Helm OCI registry clients
+// to address rate limiting issues caused by repeated registry authentication.
+//
+// Key Design Decisions:
+//
+// 1. Cache Key Strategy: Registry ID
+//    - Uses portainer.RegistryID as the cache key instead of user sessions or URL+username
+//    - One cached client per registry per Portainer instance, regardless of users
+//    - Optimal for rate limiting: each registry only gets one login per Portainer instance
+//    - New users reuse existing cached clients rather than creating new ones
+//
+// 2. Cache Invalidation: Registry Change Events
+//    - Cache is flushed when registry credentials are updated (registryUpdate handler)
+//    - Cache is flushed when registry is reconfigured (registryConfigure handler)
+//    - Cache is flushed when registry is deleted (registryDelete handler)
+//    - Cache is flushed when registry authentication fails (show, install, upgrade)
+//    - No time-based expiration needed since registry credentials rarely change
+//
+// 3. Alternative Approaches NOT Used:
+//    - registry.ClientOptCredentialsFile(): Still requires token exchange on each client creation
+//    - User/session-based caching: Less efficient for rate limiting, creates unnecessary logins
+//    - URL+username caching: More complex, harder to invalidate, doesn't handle registry updates
+//
+// 4. Security Model:
+//    - RBAC security is enforced BEFORE reaching this caching layer (handler.getRegistryWithAccess)
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/pkg/errors"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/pkg/libhelm/cache"
+	"github.com/portainer/portainer/pkg/libhelm/options"
+	"github.com/portainer/portainer/pkg/registryhttp"
+	"github.com/rs/zerolog/log"
+	"helm.sh/helm/v4/pkg/action"
+	"helm.sh/helm/v4/pkg/registry"
+)
+
+// IsOCIRegistry returns true if the registry is an OCI registry (not nil), false if it's an HTTP repository (nil)
+func IsOCIRegistry(registry *portainer.Registry) bool {
+	return registry != nil
+}
+
+// IsHTTPRepository returns true if it's an HTTP repository (registry is nil), false if it's an OCI registry
+func IsHTTPRepository(registry *portainer.Registry) bool {
+	return registry == nil
+}
+
+// parseChartRef parses chart and repo references based on the registry type
+func parseChartRef(chart, repo string, registry *portainer.Registry) (string, string, error) {
+	if IsHTTPRepository(registry) {
+		return parseHTTPRepoChartRef(chart, repo)
+	}
+	return parseOCIChartRef(chart, registry)
+}
+
+// parseOCIChartRef constructs the full OCI chart reference
+func parseOCIChartRef(chart string, registry *portainer.Registry) (string, string, error) {
+
+	chartRef := options.ConstructChartReference(registry.URL, chart)
+
+	log.Debug().
+		Str("context", "HelmClient").
+		Str("chart_ref", chartRef).
+		Bool("authentication", registry.Authentication).
+		Msg("Constructed OCI chart reference")
+
+	return chartRef, registry.URL, nil
+}
+
+// parseHTTPRepoChartRef returns chart and repo as-is for HTTP repositories
+func parseHTTPRepoChartRef(chart, repo string) (string, string, error) {
+	return chart, repo, nil
+}
+
+// shouldFlushCacheOnError determines if a registry client should be removed from cache based on the error
+// This helps handle cases where cached credentials have become invalid
+func shouldFlushCacheOnError(err error, registryID portainer.RegistryID) bool {
+	if err == nil || registryID == 0 {
+		return false
+	}
+
+	errorStr := strings.ToLower(err.Error())
+
+	// Authentication/authorization errors that indicate invalid cached credentials
+	authenticationErrors := []string{
+		"unauthorized",
+		"authentication",
+		"login failed",
+		"invalid credentials",
+		"access denied",
+		"forbidden",
+		"401",
+		"403",
+		"token",
+		"auth",
+	}
+
+	for _, authErr := range authenticationErrors {
+		if strings.Contains(errorStr, authErr) {
+			log.Info().
+				Int("registry_id", int(registryID)).
+				Str("error", err.Error()).
+				Str("context", "HelmClient").
+				Msg("Detected authentication error - will flush registry cache")
+			return true
+		}
+	}
+
+	return false
+}
+
+// authenticateChartSource handles both HTTP repositories and OCI registries
+func authenticateChartSource(actionConfig *action.Configuration, reg *portainer.Registry) error {
+	// For HTTP repositories, no authentication needed (CE and EE) so return default client
+	if IsHTTPRepository(reg) {
+		if actionConfig.RegistryClient != nil {
+			return nil
+		}
+		// Use a non-existent path so Helm initializes an empty credentials store
+		noCredsPath := filepath.Join(os.TempDir(), "portainer-helm-registry-no-creds")
+		defaultClient, err := registry.NewClient(
+			registry.ClientOptCredentialsFile(noCredsPath),
+		)
+		if err != nil {
+			return errors.Wrap(err, "failed to create default registry client")
+		}
+		actionConfig.RegistryClient = defaultClient
+		return nil
+	}
+
+	// If RegistryClient is already set, we're done
+	if actionConfig.RegistryClient != nil {
+		log.Debug().
+			Str("context", "HelmClient").
+			Msg("Registry client already set in action config")
+		return nil
+	}
+
+	// Validate registry credentials first
+	err := validateRegistryCredentials(reg)
+	if err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Err(err).
+			Msg("Registry credential validation failed")
+		return errors.Wrap(err, "registry credential validation failed")
+	}
+
+	// Cache Strategy Decision: Use registry ID as cache key
+	// This provides optimal rate limiting protection since each registry only gets
+	// logged into once per Portainer instance, regardless of how many users access it.
+	// RBAC security is enforced before reaching this caching layer.
+	// When a new user needs access, they reuse the same cached client.
+	//
+	// Alternative approach (NOT used): registry.ClientOptCredentialsFile()
+	// We don't use Helm's credential file approach because:
+	// 1. It still requires token exchange with registry on each new client creation
+	// 2. Rate limiting occurs during token exchange, not credential loading
+	// 3. Our caching approach reuses existing authenticated clients completely
+	// 4. Credential files add complexity without solving the core rate limiting issue
+
+	// Try to get cached registry client (registry ID-based key)
+	if cachedClient, found := cache.GetCachedRegistryClientByID(reg.ID); found {
+		log.Debug().
+			Int("registry_id", int(reg.ID)).
+			Str("registry_url", reg.URL).
+			Str("context", "HelmClient").
+			Msg("Using cached registry client")
+
+		actionConfig.RegistryClient = cachedClient
+		return nil
+	}
+
+	// Cache miss - perform login and cache the result
+	log.Debug().
+		Int("registry_id", int(reg.ID)).
+		Str("registry_url", reg.URL).
+		Str("context", "HelmClient").
+		Msg("Cache miss - creating new registry client")
+
+	registryClient, err := createOCIRegistryClient(reg)
+	if err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Str("registry_url", reg.URL).
+			Err(err).
+			Msg("Failed to create registry client")
+		return errors.Wrap(err, "failed to create registry client")
+	}
+
+	// Cache the client if login was successful (registry ID-based key)
+	if registryClient != nil {
+		cache.SetCachedRegistryClientByID(reg.ID, registryClient)
+		log.Debug().
+			Int("registry_id", int(reg.ID)).
+			Str("registry_url", reg.URL).
+			Str("context", "HelmClient").
+			Msg("Registry client cached successfully")
+	}
+
+	actionConfig.RegistryClient = registryClient
+	return nil
+}
+
+// configureChartPathOptions sets chart path options based on registry type
+func configureChartPathOptions(chartPathOptions *action.ChartPathOptions, version, repo string, registry *portainer.Registry) error {
+	chartPathOptions.Version = version
+	// Set chart path options based on registry type
+	if IsHTTPRepository(registry) {
+		configureHTTPRepoChartPathOptions(chartPathOptions, repo)
+	} else {
+		configureOCIChartPathOptions(chartPathOptions, registry)
+	}
+
+	return nil
+}
+
+// configureHTTPRepoChartPathOptions sets chart path options for HTTP repositories
+func configureHTTPRepoChartPathOptions(chartPathOptions *action.ChartPathOptions, repo string) {
+	chartPathOptions.RepoURL = repo
+}
+
+// configureOCIChartPathOptions sets chart path options for OCI registries
+func configureOCIChartPathOptions(chartPathOptions *action.ChartPathOptions, registry *portainer.Registry) {
+	if registry.Authentication {
+		chartPathOptions.Username = registry.Username
+		chartPathOptions.Password = registry.Password
+	}
+}
+
+// createOCIRegistryClient creates and optionally authenticates a registry client for OCI-based registries
+// Handles both authenticated and unauthenticated registries with proper TLS configuration
+// Tries to get a cached registry client if available, otherwise creates and caches a new one
+func createOCIRegistryClient(portainerRegistry *portainer.Registry) (*registry.Client, error) {
+	// Handle nil registry (HTTP repository)
+	if portainerRegistry == nil {
+		return nil, nil
+	}
+
+	// Validate credentials before cache check so invalid credentials always fail
+	if err := validateRegistryCredentials(portainerRegistry); err != nil {
+		return nil, err
+	}
+
+	// Check cache first using registry ID-based key
+	if cachedClient, found := cache.GetCachedRegistryClientByID(portainerRegistry.ID); found {
+		return cachedClient, nil
+	}
+
+	log.Debug().
+		Str("context", "HelmClient").
+		Int("registry_id", int(portainerRegistry.ID)).
+		Str("registry_url", portainerRegistry.URL).
+		Bool("authentication", portainerRegistry.Authentication).
+		Msg("Creating OCI registry client")
+
+	// Create an HTTP client with proper TLS configuration
+	httpClient, usePlainHTTP, err := registryhttp.CreateClient(portainerRegistry)
+	if err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Str("registry_url", portainerRegistry.URL).
+			Err(err).
+			Msg("Failed to create HTTP client for registry")
+		return nil, errors.Wrap(err, "failed to create HTTP client for registry")
+	}
+
+	clientOptions := []registry.ClientOption{
+		registry.ClientOptHTTPClient(httpClient),
+	}
+
+	if usePlainHTTP {
+		clientOptions = append(clientOptions, registry.ClientOptPlainHTTP())
+	}
+
+	registryClient, err := registry.NewClient(clientOptions...)
+	if err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Str("registry_url", portainerRegistry.URL).
+			Err(err).
+			Msg("Failed to create registry client")
+		return nil, errors.Wrap(err, "failed to create registry client")
+	}
+
+	// Only perform login if authentication is enabled
+	if portainerRegistry.Authentication {
+		loginOpts := []registry.LoginOption{
+			registry.LoginOptBasicAuth(portainerRegistry.Username, portainerRegistry.Password),
+		}
+
+		err = registryClient.Login(portainerRegistry.URL, loginOpts...)
+		if err != nil {
+			log.Error().
+				Str("context", "HelmClient").
+				Str("registry_url", portainerRegistry.URL).
+				Err(err).
+				Msg("Failed to login to registry")
+			return nil, errors.Wrapf(err, "failed to login to registry %s", portainerRegistry.URL)
+		}
+
+		log.Debug().
+			Str("context", "createOCIRegistryClient").
+			Int("registry_id", int(portainerRegistry.ID)).
+			Str("registry_url", portainerRegistry.URL).
+			Msg("Successfully logged in to OCI registry")
+	} else {
+		log.Debug().
+			Str("context", "createOCIRegistryClient").
+			Int("registry_id", int(portainerRegistry.ID)).
+			Str("registry_url", portainerRegistry.URL).
+			Msg("Created unauthenticated OCI registry client")
+	}
+
+	cache.SetCachedRegistryClientByID(portainerRegistry.ID, registryClient)
+
+	return registryClient, nil
+}
+
+// validateRegistryCredentials validates registry authentication settings
+func validateRegistryCredentials(registry *portainer.Registry) error {
+	if IsHTTPRepository(registry) {
+		return nil // No registry means no validation needed
+	}
+
+	if !registry.Authentication {
+		return nil // No authentication required
+	}
+
+	// Authentication is enabled - validate credentials
+	if strings.TrimSpace(registry.Username) == "" {
+		return errors.New("username is required when registry authentication is enabled")
+	}
+
+	if strings.TrimSpace(registry.Password) == "" {
+		return errors.New("password is required when registry authentication is enabled")
+	}
+
+	return nil
+}
diff --git a/pkg/libhelm/sdk/chartsources_test.go b/pkg/libhelm/sdk/chartsources_test.go
new file mode 100644
index 0000000..28d71e2
--- /dev/null
+++ b/pkg/libhelm/sdk/chartsources_test.go
@@ -0,0 +1,816 @@
+package sdk
+
+import (
+	"errors"
+	"os"
+	"strings"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/filesystem"
+	"github.com/portainer/portainer/pkg/fips"
+	helmregistrycache "github.com/portainer/portainer/pkg/libhelm/cache"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"helm.sh/helm/v4/pkg/action"
+	"helm.sh/helm/v4/pkg/registry"
+)
+
+func init() {
+	fips.InitFIPS(false)
+}
+
+func TestIsOCIRegistry(t *testing.T) {
+	t.Parallel()
+	t.Run("should return false for nil registry (HTTP repo)", func(t *testing.T) {
+		assert.False(t, IsOCIRegistry(nil))
+	})
+
+	t.Run("should return true for non-nil registry (OCI registry)", func(t *testing.T) {
+		assert.True(t, IsOCIRegistry(&portainer.Registry{}))
+	})
+}
+
+func TestIsHTTPRepository(t *testing.T) {
+	t.Parallel()
+	t.Run("should return true for nil registry (HTTP repo)", func(t *testing.T) {
+		assert.True(t, IsHTTPRepository(nil))
+	})
+
+	t.Run("should return false for non-nil registry (OCI registry)", func(t *testing.T) {
+		assert.False(t, IsHTTPRepository(&portainer.Registry{}))
+	})
+}
+
+func TestParseHTTPRepoChartRef(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	chartRef, repoURL, err := parseHTTPRepoChartRef("my-chart", "https://my.repo/charts")
+	require.NoError(t, err)
+	is.Equal("my-chart", chartRef)
+	is.Equal("https://my.repo/charts", repoURL)
+}
+
+func TestParseOCIChartRef(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	registry := &portainer.Registry{
+		URL:            "my-registry.io/my-namespace",
+		Authentication: true,
+		Username:       "user",
+		Password:       "pass",
+	}
+
+	chartRef, repoURL, err := parseOCIChartRef("my-chart", registry)
+	require.NoError(t, err)
+	is.Equal("oci://my-registry.io/my-namespace/my-chart", chartRef)
+	is.Equal("my-registry.io/my-namespace", repoURL)
+}
+
+func TestParseOCIChartRef_GitLab(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	registry := &portainer.Registry{
+		Type:           portainer.GitlabRegistry,
+		URL:            "registry.gitlab.com",
+		Authentication: true,
+		Username:       "gitlab-ci-token",
+		Password:       "glpat-xxxxxxxxxxxxxxxxxxxx",
+		Gitlab: portainer.GitlabRegistryData{
+			ProjectID:   12345,
+			InstanceURL: "https://gitlab.com",
+			ProjectPath: "my-group/my-project",
+		},
+	}
+
+	chartRef, repoURL, err := parseOCIChartRef("my-chart", registry)
+	require.NoError(t, err)
+	is.Equal("oci://registry.gitlab.com/my-chart", chartRef)
+	is.Equal("registry.gitlab.com", repoURL)
+}
+
+func TestParseChartRef(t *testing.T) {
+	t.Parallel()
+	t.Run("should parse HTTP repo chart ref when registry is nil", func(t *testing.T) {
+		is := assert.New(t)
+
+		chartRef, repoURL, err := parseChartRef("my-chart", "https://my.repo/charts", nil)
+		require.NoError(t, err)
+		is.Equal("my-chart", chartRef)
+		is.Equal("https://my.repo/charts", repoURL)
+	})
+
+	t.Run("should parse OCI chart ref when registry is provided", func(t *testing.T) {
+		is := assert.New(t)
+
+		registry := &portainer.Registry{
+			URL:            "my-registry.io/my-namespace",
+			Authentication: true,
+			Username:       "user",
+			Password:       "pass",
+		}
+
+		chartRef, repoURL, err := parseChartRef("my-chart", "", registry)
+		require.NoError(t, err)
+		is.Equal("oci://my-registry.io/my-namespace/my-chart", chartRef)
+		is.Equal("my-registry.io/my-namespace", repoURL)
+	})
+}
+
+func TestConfigureHTTPRepoChartPathOptions(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+	chartPathOptions := &action.ChartPathOptions{}
+
+	configureHTTPRepoChartPathOptions(chartPathOptions, "https://my.repo/charts")
+
+	is.Equal("https://my.repo/charts", chartPathOptions.RepoURL)
+}
+
+func TestConfigureOCIChartPathOptions(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+	chartPathOptions := &action.ChartPathOptions{}
+
+	registry := &portainer.Registry{
+		URL:            "my-registry.io/my-namespace",
+		Authentication: true,
+		Username:       "user",
+		Password:       "pass",
+	}
+
+	configureOCIChartPathOptions(chartPathOptions, registry)
+
+	is.Equal("user", chartPathOptions.Username)
+	is.Equal("pass", chartPathOptions.Password)
+}
+
+func TestConfigureOCIChartPathOptions_NoAuth(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+	chartPathOptions := &action.ChartPathOptions{}
+
+	registry := &portainer.Registry{
+		URL:            "my-registry.io/my-namespace",
+		Authentication: false,
+	}
+
+	configureOCIChartPathOptions(chartPathOptions, registry)
+
+	is.Empty(chartPathOptions.Username)
+	is.Empty(chartPathOptions.Password)
+}
+
+func TestConfigureChartPathOptions(t *testing.T) {
+	t.Parallel()
+	t.Run("should configure HTTP repo when registry is nil", func(t *testing.T) {
+		is := assert.New(t)
+		chartPathOptions := &action.ChartPathOptions{}
+
+		err := configureChartPathOptions(chartPathOptions, "1.0.0", "https://my.repo/charts", nil)
+		require.NoError(t, err)
+		is.Equal("https://my.repo/charts", chartPathOptions.RepoURL)
+		is.Equal("1.0.0", chartPathOptions.Version)
+	})
+
+	t.Run("should configure OCI registry when registry is provided", func(t *testing.T) {
+		is := assert.New(t)
+		chartPathOptions := &action.ChartPathOptions{}
+
+		registry := &portainer.Registry{
+			URL:            "my-registry.io/my-namespace",
+			Authentication: true,
+			Username:       "user",
+			Password:       "pass",
+		}
+
+		err := configureChartPathOptions(chartPathOptions, "1.0.0", "", registry)
+
+		require.NoError(t, err)
+		is.Equal("user", chartPathOptions.Username)
+		is.Equal("pass", chartPathOptions.Password)
+		is.Equal("1.0.0", chartPathOptions.Version)
+	})
+}
+
+// isolateHelmRegistryConfig redirects Helm's credential store to an empty temp dir
+// so tests never read ~/.config/helm/registry/config.json (which may be absent or corrupt).
+// Must be called before t.Parallel().
+func isolateHelmRegistryConfig(t *testing.T) {
+	t.Helper()
+	tmp := t.TempDir()
+	dir := filesystem.JoinPaths(tmp, "registry")
+	if err := os.MkdirAll(dir, 0o700); err != nil {
+		t.Fatalf("failed to create isolated helm registry dir: %v", err)
+	}
+	if err := os.WriteFile(filesystem.JoinPaths(dir, "config.json"), []byte("{}"), 0o600); err != nil {
+		t.Fatalf("failed to write isolated helm registry config: %v", err)
+	}
+	t.Setenv("HELM_CONFIG_HOME", tmp)
+}
+
+func TestLoginToOCIRegistry(t *testing.T) {
+	isolateHelmRegistryConfig(t)
+	is := assert.New(t)
+
+	t.Run("should return nil for HTTP repository (nil registry)", func(t *testing.T) {
+		client, err := createOCIRegistryClient(nil)
+		require.NoError(t, err)
+		is.Nil(client)
+	})
+
+	t.Run("should return client for registry with auth disabled (for TLS support)", func(t *testing.T) {
+		registry := &portainer.Registry{
+			URL:            "my-registry.io",
+			Authentication: false,
+		}
+		client, err := createOCIRegistryClient(registry)
+		require.NoError(t, err)
+		is.NotNil(client) // Now returns a client even without auth for potential TLS configuration
+	})
+
+	t.Run("should handle custom TLS configuration without authentication", func(t *testing.T) {
+		registry := &portainer.Registry{
+			URL:            "my-registry.io",
+			Authentication: false,
+			ManagementConfiguration: &portainer.RegistryManagementConfiguration{
+				TLSConfig: portainer.TLSConfiguration{
+					TLS:           true,
+					TLSSkipVerify: false,
+					// In a real scenario, these would point to actual cert files
+					TLSCACertPath: "",
+					TLSCertPath:   "",
+					TLSKeyPath:    "",
+				},
+			},
+		}
+
+		client, err := createOCIRegistryClient(registry)
+		// Should succeed even without cert files when they're empty strings
+		require.NoError(t, err)
+		is.NotNil(client) // Should get a client configured for TLS
+	})
+
+	t.Run("should return error for invalid credentials", func(t *testing.T) {
+		registry := &portainer.Registry{
+			URL:            "my-registry.io",
+			Authentication: true,
+			Username:       " ",
+		}
+
+		client, err := createOCIRegistryClient(registry)
+		require.Error(t, err)
+		is.Nil(client)
+		// The error might be a validation error or a login error, both are acceptable
+		is.True(err.Error() == "username is required when registry authentication is enabled" ||
+			strings.Contains(err.Error(), "failed to login to registry"))
+	})
+
+	t.Run("should attempt login for valid credentials", func(t *testing.T) {
+		registry := &portainer.Registry{
+			ID:             9877,
+			URL:            "my-registry.io",
+			Authentication: true,
+			Username:       "user",
+			Password:       "pass",
+		}
+		// this will fail because it can't connect to the registry,
+		// but it proves that the loginToOCIRegistry function is calling the login function.
+		client, err := createOCIRegistryClient(registry)
+		require.Error(t, err)
+		is.Nil(client)
+		is.Contains(err.Error(), "failed to login to registry")
+	})
+
+	t.Run("should attempt login for GitLab registry with valid credentials", func(t *testing.T) {
+		registry := &portainer.Registry{
+			ID:             456,
+			Type:           portainer.GitlabRegistry,
+			URL:            "registry.gitlab.com",
+			Authentication: true,
+			Username:       "gitlab-ci-token",
+			Password:       "glpat-xxxxxxxxxxxxxxxxxxxx",
+			Gitlab: portainer.GitlabRegistryData{
+				ProjectID:   12345,
+				InstanceURL: "https://gitlab.com",
+				ProjectPath: "my-group/my-project",
+			},
+		}
+		// this will fail because it can't connect to the registry,
+		// but it proves that the loginToOCIRegistry function is calling the login function.
+		client, err := createOCIRegistryClient(registry)
+		require.Error(t, err)
+		is.Nil(client)
+		is.Contains(err.Error(), "failed to login to registry")
+	})
+}
+
+func TestAuthenticateChartSource(t *testing.T) {
+	isolateHelmRegistryConfig(t)
+	t.Run("should do return default client for HTTP repo", func(t *testing.T) {
+		is := assert.New(t)
+		actionConfig := &action.Configuration{}
+		err := authenticateChartSource(actionConfig, nil)
+		require.NoError(t, err)
+		is.NotNil(actionConfig.RegistryClient)
+	})
+
+	t.Run("should do nothing if registry client already set", func(t *testing.T) {
+		is := assert.New(t)
+		actionConfig := &action.Configuration{}
+		// Mock an existing registry client
+		existingClient := &registry.Client{}
+		actionConfig.RegistryClient = existingClient
+
+		registry := &portainer.Registry{
+			ID:             123,
+			Authentication: true,
+			Username:       "user",
+			Password:       "pass",
+		}
+
+		err := authenticateChartSource(actionConfig, registry)
+		require.NoError(t, err)
+		is.Equal(existingClient, actionConfig.RegistryClient)
+	})
+
+	t.Run("should authenticate OCI registry when registry is provided", func(t *testing.T) {
+		actionConfig := &action.Configuration{}
+		registry := &portainer.Registry{
+			ID:             123,
+			Authentication: false,
+		}
+
+		err := authenticateChartSource(actionConfig, registry)
+		require.NoError(t, err)
+	})
+
+	t.Run("should return error for invalid registry credentials", func(t *testing.T) {
+		actionConfig := &action.Configuration{}
+		registry := &portainer.Registry{
+			ID:             123,
+			Authentication: true,
+			Username:       " ", // Invalid username
+		}
+
+		err := authenticateChartSource(actionConfig, registry)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "registry credential validation failed")
+	})
+}
+
+func TestGetRegistryClientFromCache(t *testing.T) {
+	// Initialize cache for testing
+	err := helmregistrycache.Initialize("24h")
+	if err != nil {
+		t.Fatalf("Failed to initialize cache: %v", err)
+	}
+
+	// Clear cache before and after so parallel tests don't see leftover entries
+	helmregistrycache.FlushAll()
+	t.Cleanup(helmregistrycache.FlushAll)
+
+	t.Run("should return nil for invalid registry ID", func(t *testing.T) {
+		is := assert.New(t)
+		client, found := helmregistrycache.GetCachedRegistryClientByID(0)
+		is.False(found)
+		is.Nil(client)
+	})
+
+	t.Run("should return nil for non-existent registry ID", func(t *testing.T) {
+		is := assert.New(t)
+		client, found := helmregistrycache.GetCachedRegistryClientByID(123)
+		is.False(found)
+		is.Nil(client)
+	})
+
+	t.Run("should return cached client for valid registry ID", func(t *testing.T) {
+		is := assert.New(t)
+		// Create a mock client
+		mockClient := &registry.Client{}
+
+		// Store in cache
+		helmregistrycache.SetCachedRegistryClientByID(123, mockClient)
+
+		// Retrieve from cache
+		cachedClient, found := helmregistrycache.GetCachedRegistryClientByID(123)
+		is.True(found)
+		is.NotNil(cachedClient)
+		is.Equal(mockClient, cachedClient)
+	})
+}
+
+func TestSetRegistryClientInCache(t *testing.T) {
+	// Initialize cache for testing
+	err := helmregistrycache.Initialize("24h")
+	if err != nil {
+		t.Fatalf("Failed to initialize cache: %v", err)
+	}
+
+	// Clear cache before and after so parallel tests don't see leftover entries
+	helmregistrycache.FlushAll()
+	t.Cleanup(helmregistrycache.FlushAll)
+
+	t.Run("should store and retrieve client successfully", func(t *testing.T) {
+		is := assert.New(t)
+		// Create a mock client
+		client := &registry.Client{}
+
+		// Store in cache
+		helmregistrycache.SetCachedRegistryClientByID(123, client)
+
+		// Verify the cache returns the client
+		cachedClient, found := helmregistrycache.GetCachedRegistryClientByID(123)
+		is.True(found)
+		is.NotNil(cachedClient)
+		is.Equal(client, cachedClient)
+	})
+
+	t.Run("should handle invalid parameters gracefully", func(t *testing.T) {
+		// Clear cache to start clean
+		helmregistrycache.FlushAll()
+
+		// These should not panic
+		helmregistrycache.SetCachedRegistryClientByID(0, nil)                  // nil client should be rejected
+		helmregistrycache.SetCachedRegistryClientByID(999, &registry.Client{}) // valid client with registry ID 999 should be accepted
+		helmregistrycache.SetCachedRegistryClientByID(123, nil)                // nil client should be rejected
+
+		// Verify that nil clients don't get stored, but valid clients do
+		is := assert.New(t)
+
+		// Registry ID 999 with a valid client should be found (the second call above)
+		client, found := helmregistrycache.GetCachedRegistryClientByID(999)
+		is.True(found)
+		is.NotNil(client)
+
+		// Registry ID 0 with nil client should not be found
+		client, found = helmregistrycache.GetCachedRegistryClientByID(0)
+		is.False(found)
+		is.Nil(client)
+
+		// Registry ID 123 with nil client should not be found
+		client, found = helmregistrycache.GetCachedRegistryClientByID(123)
+		is.False(found)
+		is.Nil(client)
+	})
+}
+
+func TestFlushRegistryCache(t *testing.T) {
+	// Initialize cache for testing
+	err := helmregistrycache.Initialize("24h")
+	if err != nil {
+		t.Fatalf("Failed to initialize cache: %v", err)
+	}
+
+	// Clear cache before and after so parallel tests don't see leftover entries
+	helmregistrycache.FlushAll()
+	t.Cleanup(helmregistrycache.FlushAll)
+
+	t.Run("should flush specific registry cache", func(t *testing.T) {
+		is := assert.New(t)
+		// Create mock clients
+		client1 := &registry.Client{}
+		client2 := &registry.Client{}
+
+		// Store in cache
+		helmregistrycache.SetCachedRegistryClientByID(123, client1)
+		helmregistrycache.SetCachedRegistryClientByID(456, client2)
+
+		// Verify both are cached
+		client, found := helmregistrycache.GetCachedRegistryClientByID(123)
+		is.True(found)
+		is.NotNil(client)
+		client, found = helmregistrycache.GetCachedRegistryClientByID(456)
+		is.True(found)
+		is.NotNil(client)
+
+		// Flush only one
+		helmregistrycache.FlushRegistryByID(123)
+
+		// Verify only one is flushed
+		client, found = helmregistrycache.GetCachedRegistryClientByID(123)
+		is.False(found)
+		is.Nil(client)
+		client, found = helmregistrycache.GetCachedRegistryClientByID(456)
+		is.True(found)
+		is.NotNil(client)
+	})
+}
+
+func TestFlushAllRegistryCache(t *testing.T) {
+	// Initialize cache for testing
+	err := helmregistrycache.Initialize("24h")
+	if err != nil {
+		t.Fatalf("Failed to initialize cache: %v", err)
+	}
+
+	t.Cleanup(helmregistrycache.FlushAll)
+
+	t.Run("should flush all registry cache", func(t *testing.T) {
+		is := assert.New(t)
+		// Create mock clients
+		client1 := &registry.Client{}
+		client2 := &registry.Client{}
+
+		// Store in cache
+		helmregistrycache.SetCachedRegistryClientByID(123, client1)
+		helmregistrycache.SetCachedRegistryClientByID(456, client2)
+
+		// Verify both are cached
+		client, found := helmregistrycache.GetCachedRegistryClientByID(123)
+		is.True(found)
+		is.NotNil(client)
+		client, found = helmregistrycache.GetCachedRegistryClientByID(456)
+		is.True(found)
+		is.NotNil(client)
+
+		// Flush all
+		helmregistrycache.FlushAll()
+
+		// Verify both are flushed
+		client, found = helmregistrycache.GetCachedRegistryClientByID(123)
+		is.False(found)
+		is.Nil(client)
+		client, found = helmregistrycache.GetCachedRegistryClientByID(456)
+		is.False(found)
+		is.Nil(client)
+		client, found = helmregistrycache.GetCachedRegistryClientByID(456)
+		is.False(found)
+		is.Nil(client)
+	})
+}
+
+func TestValidateRegistryCredentials(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name        string
+		registry    *portainer.Registry
+		expectError bool
+		errorMsg    string
+	}{
+		{
+			name:        "nil registry should pass validation",
+			registry:    nil,
+			expectError: false,
+		},
+		{
+			name: "registry with authentication disabled should pass validation",
+			registry: &portainer.Registry{
+				Authentication: false,
+			},
+			expectError: false,
+		},
+		{
+			name: "registry with authentication enabled and valid credentials should pass",
+			registry: &portainer.Registry{
+				Authentication: true,
+				Username:       "testuser",
+				Password:       "testpass",
+			},
+			expectError: false,
+		},
+		{
+			name: "registry with authentication enabled but empty username should fail",
+			registry: &portainer.Registry{
+				Authentication: true,
+				Username:       "",
+				Password:       "testpass",
+			},
+			expectError: true,
+			errorMsg:    "username is required when registry authentication is enabled",
+		},
+		{
+			name: "registry with authentication enabled but whitespace username should fail",
+			registry: &portainer.Registry{
+				Authentication: true,
+				Username:       " ",
+				Password:       "testpass",
+			},
+			expectError: true,
+			errorMsg:    "username is required when registry authentication is enabled",
+		},
+		{
+			name: "registry with authentication enabled but empty password should fail",
+			registry: &portainer.Registry{
+				Authentication: true,
+				Username:       "testuser",
+				Password:       "",
+			},
+			expectError: true,
+			errorMsg:    "password is required when registry authentication is enabled",
+		},
+		{
+			name: "registry with authentication enabled but whitespace password should fail",
+			registry: &portainer.Registry{
+				Authentication: true,
+				Username:       "testuser",
+				Password:       " ",
+			},
+			expectError: true,
+			errorMsg:    "password is required when registry authentication is enabled",
+		},
+		{
+			name: "GitLab registry with authentication enabled and valid credentials should pass",
+			registry: &portainer.Registry{
+				Type:           portainer.GitlabRegistry,
+				Authentication: true,
+				Username:       "gitlab-ci-token",
+				Password:       "glpat-xxxxxxxxxxxxxxxxxxxx",
+				Gitlab: portainer.GitlabRegistryData{
+					ProjectID:   12345,
+					InstanceURL: "https://gitlab.com",
+					ProjectPath: "my-group/my-project",
+				},
+			},
+			expectError: false,
+		},
+		{
+			name: "GitLab registry with authentication enabled but empty username should fail",
+			registry: &portainer.Registry{
+				Type:           portainer.GitlabRegistry,
+				Authentication: true,
+				Username:       "",
+				Password:       "glpat-xxxxxxxxxxxxxxxxxxxx",
+				Gitlab: portainer.GitlabRegistryData{
+					ProjectID:   12345,
+					InstanceURL: "https://gitlab.com",
+					ProjectPath: "my-group/my-project",
+				},
+			},
+			expectError: true,
+			errorMsg:    "username is required when registry authentication is enabled",
+		},
+		{
+			name: "GitLab registry with authentication enabled but empty password should fail",
+			registry: &portainer.Registry{
+				Type:           portainer.GitlabRegistry,
+				Authentication: true,
+				Username:       "gitlab-ci-token",
+				Password:       "",
+				Gitlab: portainer.GitlabRegistryData{
+					ProjectID:   12345,
+					InstanceURL: "https://gitlab.com",
+					ProjectPath: "my-group/my-project",
+				},
+			},
+			expectError: true,
+			errorMsg:    "password is required when registry authentication is enabled",
+		},
+		{
+			name: "GitLab registry with authentication disabled should pass validation",
+			registry: &portainer.Registry{
+				Type:           portainer.GitlabRegistry,
+				Authentication: false,
+				Gitlab: portainer.GitlabRegistryData{
+					ProjectID:   12345,
+					InstanceURL: "https://gitlab.com",
+					ProjectPath: "my-group/my-project",
+				},
+			},
+			expectError: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := validateRegistryCredentials(tt.registry)
+
+			if tt.expectError {
+				require.Error(t, err)
+				if err != nil {
+					assert.Equal(t, tt.errorMsg, err.Error())
+				}
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
+
+// Note: buildCacheKey function was removed since we now use registry ID-based caching
+// instead of endpoint/session-based caching for better rate limiting protection
+
+func TestShouldFlushCacheOnError(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name        string
+		err         error
+		registryID  portainer.RegistryID
+		shouldFlush bool
+	}{
+		{
+			name:        "nil error should not flush",
+			err:         nil,
+			registryID:  123,
+			shouldFlush: false,
+		},
+		{
+			name:        "zero registry ID should not flush",
+			err:         errors.New("some error"),
+			registryID:  0,
+			shouldFlush: false,
+		},
+		{
+			name:        "unauthorized error should flush",
+			err:         errors.New("unauthorized access to registry"),
+			registryID:  123,
+			shouldFlush: true,
+		},
+		{
+			name:        "authentication failed error should flush",
+			err:         errors.New("authentication failed"),
+			registryID:  123,
+			shouldFlush: true,
+		},
+		{
+			name:        "login failed error should flush",
+			err:         errors.New("login failed for user"),
+			registryID:  123,
+			shouldFlush: true,
+		},
+		{
+			name:        "invalid credentials error should flush",
+			err:         errors.New("invalid credentials provided"),
+			registryID:  123,
+			shouldFlush: true,
+		},
+		{
+			name:        "access denied error should flush",
+			err:         errors.New("access denied to repository"),
+			registryID:  123,
+			shouldFlush: true,
+		},
+		{
+			name:        "forbidden error should flush",
+			err:         errors.New("forbidden: insufficient permissions"),
+			registryID:  123,
+			shouldFlush: true,
+		},
+		{
+			name:        "401 error should flush",
+			err:         errors.New("HTTP 401 Unauthorized"),
+			registryID:  123,
+			shouldFlush: true,
+		},
+		{
+			name:        "403 error should flush",
+			err:         errors.New("HTTP 403 Forbidden"),
+			registryID:  123,
+			shouldFlush: true,
+		},
+		{
+			name:        "token error should flush",
+			err:         errors.New("token expired or invalid"),
+			registryID:  123,
+			shouldFlush: true,
+		},
+		{
+			name:        "auth error should flush",
+			err:         errors.New("auth validation failed"),
+			registryID:  123,
+			shouldFlush: true,
+		},
+		{
+			name:        "chart not found error should not flush",
+			err:         errors.New("chart not found in repository"),
+			registryID:  123,
+			shouldFlush: false,
+		},
+		{
+			name:        "network error should not flush",
+			err:         errors.New("connection timeout"),
+			registryID:  123,
+			shouldFlush: false,
+		},
+		{
+			name:        "helm validation error should not flush",
+			err:         errors.New("invalid chart values"),
+			registryID:  123,
+			shouldFlush: false,
+		},
+		{
+			name:        "kubernetes error should not flush",
+			err:         errors.New("namespace not found"),
+			registryID:  123,
+			shouldFlush: false,
+		},
+		{
+			name:        "case insensitive matching works",
+			err:         errors.New("UNAUTHORIZED access denied"),
+			registryID:  123,
+			shouldFlush: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := shouldFlushCacheOnError(tt.err, tt.registryID)
+			is := assert.New(t)
+			is.Equal(tt.shouldFlush, result, "Expected shouldFlushCacheOnError to return %v for error: %v", tt.shouldFlush, tt.err)
+		})
+	}
+}
diff --git a/pkg/libhelm/sdk/client.go b/pkg/libhelm/sdk/client.go
new file mode 100644
index 0000000..3315ee4
--- /dev/null
+++ b/pkg/libhelm/sdk/client.go
@@ -0,0 +1,157 @@
+package sdk
+
+import (
+	"github.com/pkg/errors"
+	"github.com/portainer/portainer/pkg/libhelm/options"
+	"github.com/rs/zerolog/log"
+	slogzerolog "github.com/samber/slog-zerolog/v2"
+	"helm.sh/helm/v4/pkg/action"
+	"helm.sh/helm/v4/pkg/cli"
+	"k8s.io/apimachinery/pkg/api/meta"
+	"k8s.io/client-go/discovery"
+	"k8s.io/client-go/discovery/cached/memory"
+	"k8s.io/client-go/rest"
+	"k8s.io/client-go/restmapper"
+	"k8s.io/client-go/tools/clientcmd"
+	"k8s.io/client-go/tools/clientcmd/api"
+)
+
+// newRESTClientGetter creates a custom RESTClientGetter using the provided client config
+type clientConfigGetter struct {
+	clientConfig clientcmd.ClientConfig
+	namespace    string
+}
+
+// initActionConfig initializes the action configuration with kubernetes config
+func (hspm *HelmSDKPackageManager) initActionConfig(actionConfig *action.Configuration, namespace string, k8sAccess *options.KubernetesClusterAccess) error {
+	// If namespace is not provided, use the default namespace
+	if namespace == "" {
+		namespace = "default"
+	}
+
+	// Setup logging for Helm SDK using zerolog
+	logger := log.With().Str("context", "HelmClient").Logger()
+	logOptions := slogzerolog.Option{
+		Logger: &(logger),
+	}
+	actionConfig.SetLogger(logOptions.NewZerologHandler())
+
+	if k8sAccess == nil {
+		// Use default kubeconfig
+		settings := cli.New()
+		clientGetter := settings.RESTClientGetter()
+		return actionConfig.Init(clientGetter, namespace, "secret")
+	}
+
+	// Create client config
+	configAPI := generateConfigAPI(namespace, k8sAccess)
+	clientConfig := clientcmd.NewDefaultClientConfig(*configAPI, &clientcmd.ConfigOverrides{})
+
+	// Create a custom RESTClientGetter that uses our in-memory config
+	clientGetter, err := newRESTClientGetter(clientConfig, namespace)
+	if err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Str("cluster_name", k8sAccess.ClusterName).
+			Str("cluster_url", k8sAccess.ClusterServerURL).
+			Str("user_name", k8sAccess.UserName).
+			Err(err).
+			Msg("failed to create client getter")
+		return err
+	}
+
+	return actionConfig.Init(clientGetter, namespace, "secret")
+}
+
+// generateConfigAPI generates a new kubeconfig configuration
+func generateConfigAPI(namespace string, k8sAccess *options.KubernetesClusterAccess) *api.Config {
+	// Create in-memory kubeconfig configuration
+	configAPI := api.NewConfig()
+
+	// Create cluster
+	cluster := api.NewCluster()
+	cluster.Server = k8sAccess.ClusterServerURL
+
+	if k8sAccess.CertificateAuthorityFile != "" {
+		// If we have a CA file, use it
+		cluster.CertificateAuthority = k8sAccess.CertificateAuthorityFile
+	} else {
+		// Otherwise skip TLS verification
+		cluster.InsecureSkipTLSVerify = true
+	}
+
+	// Create auth info with token
+	authInfo := api.NewAuthInfo()
+	authInfo.Token = k8sAccess.AuthToken
+
+	// Create context
+	context := api.NewContext()
+	context.Cluster = k8sAccess.ClusterName
+	context.AuthInfo = k8sAccess.UserName
+	context.Namespace = namespace
+
+	// Add to config
+	configAPI.Clusters[k8sAccess.ClusterName] = cluster
+	configAPI.AuthInfos[k8sAccess.UserName] = authInfo
+	configAPI.Contexts[k8sAccess.ContextName] = context
+	configAPI.CurrentContext = k8sAccess.ContextName
+
+	return configAPI
+}
+
+func newRESTClientGetter(clientConfig clientcmd.ClientConfig, namespace string) (*clientConfigGetter, error) {
+	if clientConfig == nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Msg("client config is nil")
+
+		return nil, errors.New("client config provided during the helm client initialization was nil. Check the kubernetes cluster access configuration")
+	}
+
+	return &clientConfigGetter{
+		clientConfig: clientConfig,
+		namespace:    namespace,
+	}, nil
+}
+
+func (c *clientConfigGetter) ToRESTConfig() (*rest.Config, error) {
+	if c.clientConfig == nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Msg("client config is nil")
+
+		return nil, errors.New("client config provided during the helm client initialization was nil. Check the kubernetes cluster access configuration")
+	}
+
+	return c.clientConfig.ClientConfig()
+}
+
+func (c *clientConfigGetter) ToDiscoveryClient() (discovery.CachedDiscoveryInterface, error) {
+	config, err := c.ToRESTConfig()
+	if err != nil {
+		return nil, err
+	}
+
+	// Create the discovery client
+	discoveryClient, err := discovery.NewDiscoveryClientForConfig(config)
+	if err != nil {
+		return nil, err
+	}
+
+	// Wrap the discovery client with a cached discovery client
+	return memory.NewMemCacheClient(discoveryClient), nil
+}
+
+func (c *clientConfigGetter) ToRESTMapper() (meta.RESTMapper, error) {
+	discoveryClient, err := c.ToDiscoveryClient()
+	if err != nil {
+		return nil, err
+	}
+
+	// Create a REST mapper from the discovery client
+	return restmapper.NewDeferredDiscoveryRESTMapper(discoveryClient), nil
+}
+
+func (c *clientConfigGetter) ToRawKubeConfigLoader() clientcmd.ClientConfig {
+	return c.clientConfig
+}
diff --git a/pkg/libhelm/sdk/client_test.go b/pkg/libhelm/sdk/client_test.go
new file mode 100644
index 0000000..51f0cd3
--- /dev/null
+++ b/pkg/libhelm/sdk/client_test.go
@@ -0,0 +1,159 @@
+package sdk
+
+import (
+	"testing"
+
+	"github.com/portainer/portainer/pkg/libhelm/options"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"helm.sh/helm/v4/pkg/action"
+	"k8s.io/client-go/tools/clientcmd"
+	"k8s.io/client-go/tools/clientcmd/api"
+)
+
+func Test_InitActionConfig(t *testing.T) {
+	t.Parallel()
+	hspm := NewHelmSDKPackageManager()
+
+	t.Run("with nil k8sAccess should use default kubeconfig", func(t *testing.T) {
+		actionConfig := new(action.Configuration)
+		err := hspm.initActionConfig(actionConfig, "default", nil)
+
+		// The function should not fail by design, even when not running in a k8s environment
+		require.NoError(t, err, "should not return error when not in k8s environment")
+	})
+
+	t.Run("with k8sAccess should create in-memory config", func(t *testing.T) {
+		actionConfig := new(action.Configuration)
+		k8sAccess := &options.KubernetesClusterAccess{
+			ClusterServerURL: "https://kubernetes.default.svc",
+			AuthToken:        "test-token",
+		}
+
+		// The function should not fail by design
+		err := hspm.initActionConfig(actionConfig, "default", k8sAccess)
+		require.NoError(t, err, "should not return error when using in-memory config")
+	})
+
+	t.Run("with k8sAccess and CA file should create config with CA", func(t *testing.T) {
+		actionConfig := new(action.Configuration)
+		k8sAccess := &options.KubernetesClusterAccess{
+			ClusterServerURL:         "https://kubernetes.default.svc",
+			AuthToken:                "test-token",
+			CertificateAuthorityFile: "/path/to/ca.crt",
+		}
+
+		// The function should not fail by design
+		err := hspm.initActionConfig(actionConfig, "default", k8sAccess)
+		require.NoError(t, err, "should not return error when using in-memory config with CA")
+	})
+}
+
+func Test_ClientConfigGetter(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	// Create a mock client config
+	configAPI := api.NewConfig()
+
+	// Create cluster
+	cluster := api.NewCluster()
+	cluster.Server = "https://kubernetes.default.svc"
+	cluster.InsecureSkipTLSVerify = true
+
+	// Create auth info
+	authInfo := api.NewAuthInfo()
+	authInfo.Token = "test-token"
+
+	// Create context
+	context := api.NewContext()
+	context.Cluster = "test-cluster"
+	context.AuthInfo = "test-user"
+	context.Namespace = "default"
+
+	// Add to config
+	configAPI.Clusters["test-cluster"] = cluster
+	configAPI.AuthInfos["test-user"] = authInfo
+	configAPI.Contexts["test-context"] = context
+	configAPI.CurrentContext = "test-context"
+
+	clientConfig := clientcmd.NewDefaultClientConfig(*configAPI, &clientcmd.ConfigOverrides{})
+
+	// Create client config getter
+	clientGetter, err := newRESTClientGetter(clientConfig, "default")
+	require.NoError(t, err, "should not return error when creating client getter")
+
+	// Test ToRESTConfig
+	restConfig, err := clientGetter.ToRESTConfig()
+	require.NoError(t, err, "should not return error when creating REST config")
+	is.NotNil(restConfig, "should return non-nil REST config")
+	is.Equal("https://kubernetes.default.svc", restConfig.Host, "host should be https://kubernetes.default.svc")
+	is.Equal("test-token", restConfig.BearerToken, "bearer token should be test-token")
+
+	// Test ToDiscoveryClient
+	discoveryClient, err := clientGetter.ToDiscoveryClient()
+	require.NoError(t, err, "should not return error when creating discovery client")
+	is.NotNil(discoveryClient, "should return non-nil discovery client")
+
+	// Test ToRESTMapper
+	restMapper, err := clientGetter.ToRESTMapper()
+	require.NoError(t, err, "should not return error when creating REST mapper")
+	is.NotNil(restMapper, "should return non-nil REST mapper")
+
+	// Test ToRawKubeConfigLoader
+	config := clientGetter.ToRawKubeConfigLoader()
+	is.NotNil(config, "should return non-nil config loader")
+}
+
+func Test_ParseValues(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	t.Run("should parse valid YAML values", func(t *testing.T) {
+		yamlData := []byte(`
+service:
+  type: ClusterIP
+  port: 80
+resources:
+  limits:
+    cpu: 100m
+    memory: 128Mi
+`)
+		values, err := parseValues(yamlData)
+		require.NoError(t, err, "should parse valid YAML without error")
+		is.NotNil(values, "should return non-nil values")
+
+		// Verify structure
+		service, ok := values["service"].(map[string]any)
+		is.True(ok, "service should be a map")
+		is.Equal("ClusterIP", service["type"], "service type should be ClusterIP")
+		is.Equal(80, int(service["port"].(float64)), "service port should be 80")
+
+		resources, ok := values["resources"].(map[string]any)
+		is.True(ok, "resources should be a map")
+		limits, ok := resources["limits"].(map[string]any)
+		is.True(ok, "limits should be a map")
+		is.Equal("100m", limits["cpu"], "cpu limit should be 100m")
+		is.Equal("128Mi", limits["memory"], "memory limit should be 128Mi")
+	})
+
+	t.Run("should handle invalid YAML", func(t *testing.T) {
+		yamlData := []byte(`
+service:
+  type: ClusterIP
+  port: 80
+  invalid yaml
+`)
+		_, err := parseValues(yamlData)
+		require.Error(t, err, "should return error for invalid YAML")
+	})
+
+	t.Run("should handle empty YAML", func(t *testing.T) {
+		yamlData := []byte(``)
+		values, err := parseValues(yamlData)
+		require.NoError(t, err, "should not return error for empty YAML")
+		is.NotNil(values, "should return non-nil values for empty YAML")
+		is.Empty(values, "should return empty map for empty YAML")
+	})
+}
diff --git a/pkg/libhelm/sdk/common.go b/pkg/libhelm/sdk/common.go
new file mode 100644
index 0000000..b601358
--- /dev/null
+++ b/pkg/libhelm/sdk/common.go
@@ -0,0 +1,325 @@
+package sdk
+
+import (
+	"fmt"
+	"maps"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+
+	"github.com/pkg/errors"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/pkg/libhelm/options"
+	"github.com/portainer/portainer/pkg/libhelm/release"
+	"github.com/rs/zerolog/log"
+	"helm.sh/helm/v4/pkg/action"
+	"helm.sh/helm/v4/pkg/chart"
+	v2chart "helm.sh/helm/v4/pkg/chart/v2"
+	"helm.sh/helm/v4/pkg/chart/v2/loader"
+	"helm.sh/helm/v4/pkg/cli"
+	"helm.sh/helm/v4/pkg/downloader"
+	"helm.sh/helm/v4/pkg/getter"
+	sdkrelease "helm.sh/helm/v4/pkg/release"
+	releasev1 "helm.sh/helm/v4/pkg/release/v1"
+	repo "helm.sh/helm/v4/pkg/repo/v1"
+)
+
+// Helm chart reference label constants
+const (
+	ChartPathAnnotation  = "portainer/chart-path"
+	RegistryIDAnnotation = "portainer/registry-id"
+	RepoURLAnnotation    = "portainer/repo-url"
+	StackIDAnnotation    = "portainer/stack-id"
+)
+
+// loadAndValidateChartWithPathOptions locates and loads the chart, and validates it.
+// it also checks for chart dependencies and updates them if necessary.
+// it returns the chart information.
+func (hspm *HelmSDKPackageManager) loadAndValidateChartWithPathOptions(actionConfig *action.Configuration, chartPathOptions *action.ChartPathOptions, chartName, version string, repoURL string, dependencyUpdate bool, operation string) (*v2chart.Chart, error) {
+	chartPath, err := chartPathOptions.LocateChart(chartName, hspm.settings)
+	if err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Str("chart", chartName).
+			Err(err).
+			Msg("Failed to locate chart for helm " + operation)
+
+		// For OCI charts, chartName already contains the full reference
+		if strings.HasPrefix(chartName, options.OCIProtocolPrefix) {
+			return nil, errors.Wrapf(err, "failed to find the helm chart: %s", chartName)
+		}
+		return nil, errors.Wrapf(err, "failed to find the helm chart at the path: %s/%s", repoURL, chartName)
+	}
+
+	chartReq, err := loader.Load(chartPath)
+	if err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Str("chart_path", chartPath).
+			Err(err).
+			Msg("Failed to load chart for helm " + operation)
+		return nil, errors.Wrap(err, "failed to load chart for helm "+operation)
+	}
+	chartAcessor, err := chart.NewDefaultAccessor(chartReq)
+	if err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Str("chart_path", chartPath).
+			Err(err).
+			Msg("Failed to make chart accessor for helm " + operation)
+		return nil, errors.Wrap(err, "failed to make chart accessor for helm "+operation)
+	}
+
+	// Check chart dependencies to make sure all are present in /charts
+	if chartDependencies := chartAcessor.MetaDependencies(); chartDependencies != nil {
+		if err := action.CheckDependencies(chartReq, chartDependencies); err != nil {
+			err = errors.Wrap(err, "failed to check chart dependencies for helm "+operation)
+			if !dependencyUpdate {
+				return nil, err
+			}
+
+			log.Debug().
+				Str("context", "HelmClient").
+				Str("chart", chartName).
+				Msg("Updating chart dependencies for helm " + operation)
+
+			providers := getter.All(hspm.settings)
+			manager := &downloader.Manager{
+				Out:              os.Stdout,
+				ChartPath:        chartPath,
+				Keyring:          chartPathOptions.Keyring,
+				SkipUpdate:       false,
+				Getters:          providers,
+				RepositoryConfig: hspm.settings.RepositoryConfig,
+				RepositoryCache:  hspm.settings.RepositoryCache,
+				ContentCache:     hspm.settings.ContentCache,
+				Debug:            hspm.settings.Debug,
+				RegistryClient:   actionConfig.RegistryClient,
+			}
+			if err := manager.Update(); err != nil {
+				log.Error().
+					Str("context", "HelmClient").
+					Str("chart", chartName).
+					Err(err).
+					Msg("Failed to update chart dependencies for helm " + operation)
+				return nil, errors.Wrap(err, "failed to update chart dependencies for helm "+operation)
+			}
+
+			// Reload the chart with the updated Chart.lock file.
+			if chartReq, err = loader.Load(chartPath); err != nil {
+				log.Error().
+					Str("context", "HelmClient").
+					Str("chart_path", chartPath).
+					Err(err).
+					Msg("Failed to reload chart after dependency update for helm " + operation)
+				return nil, errors.Wrap(err, "failed to reload chart after dependency update for helm "+operation)
+			}
+		}
+	}
+
+	return chartReq, nil
+}
+
+// parseRepoURL parses and validates a Helm repository URL using RFC 3986 standards.
+// Used by search and show operations before downloading index.yaml files.
+func parseRepoURL(repoURL string) (*url.URL, error) {
+	parsedURL, err := url.ParseRequestURI(repoURL)
+	if err != nil {
+		return nil, errors.Wrap(err, "invalid helm chart URL: "+repoURL)
+	}
+	return parsedURL, nil
+}
+
+// GetRepoNameFromURL generates a unique repository identifier from a URL.
+// Combines hostname and path for uniqueness (e.g., "charts.helm.sh/stable" → "charts.helm.sh-stable").
+// Used for Helm's repositories.yaml entries, caching, and chart references.
+func GetRepoNameFromURL(urlStr string) (string, error) {
+	parsedURL, err := url.Parse(urlStr)
+	if err != nil {
+		return "", fmt.Errorf("failed to parse URL: %w", err)
+	}
+
+	hostname := parsedURL.Hostname()
+	path := parsedURL.Path
+	path = strings.Trim(path, "/")
+	path = strings.ReplaceAll(path, "/", "-")
+
+	if path == "" {
+		return hostname, nil
+	}
+	return fmt.Sprintf("%s-%s", hostname, path), nil
+}
+
+// loadIndexFile loads and parses a Helm repository index.yaml file.
+// Called after downloading from HTTP repos or generating from OCI registries.
+// Contains chart metadata used for discovery, version resolution, and caching.
+func loadIndexFile(indexPath string) (*repo.IndexFile, error) {
+	log.Debug().
+		Str("context", "HelmClient").
+		Str("index_path", indexPath).
+		Msg("Loading index file")
+
+	indexFile, err := repo.LoadIndexFile(indexPath)
+	if err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Str("index_path", indexPath).
+			Err(err).
+			Msg("Failed to load index file")
+		return nil, errors.Wrapf(err, "failed to load downloaded index file: %s", indexPath)
+	}
+	return indexFile, nil
+}
+
+// ensureHelmDirectoriesExist creates required Helm directories and configuration files.
+// Creates repository cache, config directories, and ensures repositories.yaml exists.
+// Essential for Helm operations to function properly.
+func ensureHelmDirectoriesExist(settings *cli.EnvSettings) error {
+	log.Debug().
+		Str("context", "helm_sdk_dirs").
+		Msg("Ensuring Helm directories exist")
+
+	// List of directories to ensure exist
+	directories := []string{
+		filepath.Dir(settings.RepositoryConfig), // Repository config directory
+		settings.RepositoryCache,                // Repository cache directory
+		filepath.Dir(settings.RegistryConfig),   // Registry config directory
+		settings.PluginsDirectory,               // Plugins directory
+		filepath.Dir(settings.ContentCache),     // Content cache directory
+		settings.ContentCache,                   // Content cache directory
+	}
+
+	// Create each directory if it doesn't exist
+	for _, dir := range directories {
+		if dir == "" {
+			continue // Skip empty paths
+		}
+
+		if _, err := os.Stat(dir); os.IsNotExist(err) {
+			if err := os.MkdirAll(dir, 0o700); err != nil {
+				log.Error().
+					Str("context", "helm_sdk_dirs").
+					Str("directory", dir).
+					Err(err).
+					Msg("Failed to create directory")
+				return errors.Wrapf(err, "failed to create directory: %s", dir)
+			}
+		}
+	}
+
+	// Ensure registry config file exists
+	if settings.RegistryConfig != "" {
+		if _, err := os.Stat(settings.RegistryConfig); os.IsNotExist(err) {
+			// Create the directory if it doesn't exist
+			dir := filepath.Dir(settings.RegistryConfig)
+			if err := os.MkdirAll(dir, 0o700); err != nil {
+				log.Error().
+					Str("context", "helm_sdk_dirs").
+					Str("directory", dir).
+					Err(err).
+					Msg("Failed to create directory")
+				return errors.Wrapf(err, "failed to create directory: %s", dir)
+			}
+
+			// Create an empty registry config file with default yaml structure
+			if err := os.WriteFile(settings.RegistryConfig, []byte("{}"), 0600); err != nil {
+				log.Error().
+					Str("context", "helm_sdk_dirs").
+					Str("file", settings.RegistryConfig).
+					Err(err).
+					Msg("Failed to create registry config file")
+				return errors.Wrapf(err, "failed to create registry config file: %s", settings.RegistryConfig)
+			}
+		}
+	}
+
+	// Ensure repository config file exists
+	if settings.RepositoryConfig != "" {
+		if _, err := os.Stat(settings.RepositoryConfig); os.IsNotExist(err) {
+			// Create an empty repository config file with default yaml structure
+			f := repo.NewFile()
+			if err := f.WriteFile(settings.RepositoryConfig, 0o644); err != nil {
+				log.Error().
+					Str("context", "helm_sdk_dirs").
+					Str("file", settings.RepositoryConfig).
+					Err(err).
+					Msg("Failed to create repository config file")
+				return errors.Wrapf(err, "failed to create repository config file: %s", settings.RepositoryConfig)
+			}
+		}
+	}
+
+	log.Debug().
+		Str("context", "helm_sdk_dirs").
+		Msg("Successfully ensured all Helm directories exist")
+
+	return nil
+}
+
+// appendChartReferenceAnnotations encodes chart reference values for safe storage in Helm labels.
+// It creates a new map with encoded values for specific chart reference labels.
+// Preserves existing labels and handles edge cases gracefully.
+func appendChartReferenceAnnotations(chartPath, repoURL string, registryID int, stackID int, autoUpdateSettings *portainer.AutoUpdateSettings, existingAnnotations map[string]string) map[string]string {
+	// Copy existing annotations
+	annotations := make(map[string]string)
+	maps.Copy(annotations, existingAnnotations)
+
+	// delete the existing portainer specific labels, for a clean overwrite
+	delete(annotations, ChartPathAnnotation)
+	delete(annotations, RepoURLAnnotation)
+	delete(annotations, RegistryIDAnnotation)
+	delete(annotations, StackIDAnnotation)
+
+	if chartPath != "" {
+		annotations[ChartPathAnnotation] = chartPath
+	}
+
+	if repoURL != "" && registryID == 0 {
+		annotations[RepoURLAnnotation] = repoURL
+	}
+
+	if registryID != 0 {
+		annotations[RegistryIDAnnotation] = strconv.Itoa(registryID)
+	}
+
+	if stackID != 0 {
+		annotations[StackIDAnnotation] = strconv.Itoa(stackID)
+	}
+
+	return annotations
+}
+
+// extractChartReferenceAnnotations decodes chart reference labels for display purposes.
+// It handles existing labels gracefully and only decodes known chart reference labels.
+// If a chart reference label cannot be decoded, it is omitted entirely from the result.
+// Returns a ChartReference struct with decoded values.
+func extractChartReferenceAnnotations(annotations map[string]string) release.ChartReference {
+	if annotations == nil {
+		return release.ChartReference{}
+	}
+
+	registryID, err := strconv.Atoi(annotations[RegistryIDAnnotation])
+	if err != nil {
+		registryID = 0
+	}
+
+	return release.ChartReference{
+		ChartPath:  annotations[ChartPathAnnotation],
+		RepoURL:    annotations[RepoURLAnnotation],
+		RegistryID: int64(registryID),
+	}
+}
+
+// releaserToV1Release converts a release.Releaser interface to a concrete v1.Release type
+func releaserToV1Release(rel sdkrelease.Releaser) (*releasev1.Release, error) {
+	switch r := rel.(type) {
+	case releasev1.Release:
+		return &r, nil
+	case *releasev1.Release:
+		return r, nil
+	default:
+		return nil, fmt.Errorf("unsupported release type: %T", rel)
+	}
+}
diff --git a/pkg/libhelm/sdk/common_test.go b/pkg/libhelm/sdk/common_test.go
new file mode 100644
index 0000000..382ae99
--- /dev/null
+++ b/pkg/libhelm/sdk/common_test.go
@@ -0,0 +1,213 @@
+package sdk
+
+import (
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/portainer/portainer/api/filesystem"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"helm.sh/helm/v4/pkg/action"
+	v2chart "helm.sh/helm/v4/pkg/chart/v2"
+	chartutil "helm.sh/helm/v4/pkg/chart/v2/util"
+	repo "helm.sh/helm/v4/pkg/repo/v1"
+)
+
+func TestAppendChartReferenceAnnotations(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name       string
+		chartPath  string
+		repoURL    string
+		registryID int
+		stackID    int
+		existing   map[string]string
+		want       map[string]string
+	}{
+		{
+			name:       "with registry ID",
+			chartPath:  "charts/nginx",
+			registryID: 5,
+			stackID:    123,
+			want: map[string]string{
+				ChartPathAnnotation:  "charts/nginx",
+				RegistryIDAnnotation: "5",
+				StackIDAnnotation:    "123",
+				// repoURL is NOT added when registryID != 0
+			},
+		},
+		{
+			name:      "with repo URL (no registry)",
+			chartPath: "charts/nginx",
+			repoURL:   "https://charts.example.com",
+			stackID:   123,
+			want: map[string]string{
+				ChartPathAnnotation: "charts/nginx",
+				RepoURLAnnotation:   "https://charts.example.com",
+				StackIDAnnotation:   "123",
+			},
+		},
+		{
+			name:      "preserves custom annotations",
+			chartPath: "my-chart",
+			existing:  map[string]string{"custom": "value"},
+			want: map[string]string{
+				ChartPathAnnotation: "my-chart",
+				"custom":            "value",
+			},
+		},
+		{
+			name:      "replaces old chart annotations",
+			chartPath: "new-chart",
+			repoURL:   "https://new.com",
+			existing: map[string]string{
+				ChartPathAnnotation: "old-chart",
+				RepoURLAnnotation:   "https://old.com",
+			},
+			want: map[string]string{
+				ChartPathAnnotation: "new-chart",
+				RepoURLAnnotation:   "https://new.com",
+			},
+		},
+		{
+			name:      "omits zero values",
+			chartPath: "chart",
+			want: map[string]string{
+				ChartPathAnnotation: "chart",
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := appendChartReferenceAnnotations(
+				tt.chartPath, tt.repoURL, tt.registryID, tt.stackID,
+				nil, tt.existing,
+			)
+
+			assert.Equal(t, tt.want, result)
+		})
+	}
+}
+
+func TestAppendChartReferenceAnnotations_RepoURLLogic(t *testing.T) {
+	t.Parallel()
+	t.Run("repoURL only added when registryID is zero", func(t *testing.T) {
+		// With registry ID - no repoURL
+		result := appendChartReferenceAnnotations("chart", "url", 5, 0, nil, nil)
+		_, hasRepoURL := result[RepoURLAnnotation]
+		assert.False(t, hasRepoURL)
+
+		// Without registry ID - includes repoURL
+		result = appendChartReferenceAnnotations("chart", "url", 0, 0, nil, nil)
+		assert.Equal(t, "url", result[RepoURLAnnotation])
+	})
+
+	t.Run("does not mutate existing map", func(t *testing.T) {
+		existing := map[string]string{"key": "value"}
+		appendChartReferenceAnnotations("chart", "", 0, 0, nil, existing)
+		assert.Equal(t, map[string]string{"key": "value"}, existing)
+	})
+}
+
+func TestLoadAndValidateChartWithPathOptions(t *testing.T) {
+	t.Parallel()
+
+	depTgzPath := saveMinimalDepChart(t, "dep-chart", "0.1.0")
+	depTgzName := filepath.Base(depTgzPath)
+
+	server := newHelmHTTPRepoServer(t, depTgzPath)
+	parentDir := writeParentChart(t, "parent-chart", "dep-chart", "0.1.0", server.URL)
+
+	hspm := newIsolatedHelmSDKPackageManager(t)
+
+	ch, err := hspm.loadAndValidateChartWithPathOptions(
+		new(action.Configuration),
+		&action.ChartPathOptions{},
+		parentDir, "", "", true, "test",
+	)
+
+	require.NoError(t, err)
+	require.NotNil(t, ch)
+	assert.Equal(t, "parent-chart", ch.Metadata.Name)
+	assert.FileExists(t, filesystem.JoinPaths(parentDir, "charts", depTgzName),
+		"dependency tarball should have been downloaded into charts/ — proves ContentCache was threaded into downloader.Manager")
+}
+
+// saveMinimalDepChart produces a valid dependency chart tarball on disk and returns its path.
+func saveMinimalDepChart(t *testing.T, name, version string) string {
+	t.Helper()
+	tgzPath, err := chartutil.Save(&v2chart.Chart{
+		Metadata: &v2chart.Metadata{
+			Name:       name,
+			Version:    version,
+			APIVersion: "v2",
+		},
+	}, t.TempDir())
+	require.NoError(t, err)
+	return tgzPath
+}
+
+func newHelmHTTPRepoServer(t *testing.T, tgzPath string) *httptest.Server {
+	t.Helper()
+	tgzName := filepath.Base(tgzPath)
+
+	mux := http.NewServeMux()
+	server := httptest.NewServer(mux)
+	t.Cleanup(server.Close)
+
+	mux.HandleFunc("/"+tgzName, func(w http.ResponseWriter, r *http.Request) {
+		http.ServeFile(w, r, tgzPath)
+	})
+	index := fmt.Sprintf(`apiVersion: v1
+entries:
+  dep-chart:
+    - name: dep-chart
+      version: 0.1.0
+      apiVersion: v2
+      urls:
+        - %s/%s
+`, server.URL, tgzName)
+	mux.HandleFunc("/index.yaml", func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "text/yaml")
+		_, _ = w.Write([]byte(index))
+	})
+	return server
+}
+
+// writeParentChart writes a Chart.yaml declaring a single HTTP dependency and returns the chart dir.
+func writeParentChart(t *testing.T, parentName, depName, depVersion, repoURL string) string {
+	t.Helper()
+	dir := t.TempDir()
+	chartYAML := fmt.Sprintf(`apiVersion: v2
+name: %s
+version: 0.1.0
+dependencies:
+  - name: %s
+    version: %q
+    repository: %q
+`, parentName, depName, depVersion, repoURL)
+	require.NoError(t, os.WriteFile(filesystem.JoinPaths(dir, "Chart.yaml"), []byte(chartYAML), 0o644))
+	return dir
+}
+
+func newIsolatedHelmSDKPackageManager(t *testing.T) *HelmSDKPackageManager {
+	t.Helper()
+	tmp := t.TempDir()
+	hspm := NewHelmSDKPackageManager()
+	hspm.settings.RepositoryConfig = filesystem.JoinPaths(tmp, "repositories.yaml")
+	hspm.settings.RepositoryCache = filesystem.JoinPaths(tmp, "repository")
+	hspm.settings.ContentCache = filesystem.JoinPaths(tmp, "content")
+
+	require.NoError(t, os.MkdirAll(hspm.settings.RepositoryCache, 0o700))
+	require.NoError(t, os.MkdirAll(hspm.settings.ContentCache, 0o700))
+
+	f := repo.NewFile()
+	require.NoError(t, f.WriteFile(hspm.settings.RepositoryConfig, 0o644))
+
+	return hspm
+}
diff --git a/pkg/libhelm/sdk/get.go b/pkg/libhelm/sdk/get.go
new file mode 100644
index 0000000..2bb4346
--- /dev/null
+++ b/pkg/libhelm/sdk/get.go
@@ -0,0 +1,131 @@
+package sdk
+
+import (
+	"strconv"
+
+	"github.com/portainer/portainer/pkg/libhelm/options"
+	"github.com/portainer/portainer/pkg/libhelm/release"
+	"github.com/rs/zerolog/log"
+	"helm.sh/helm/v4/pkg/action"
+	releasev1 "helm.sh/helm/v4/pkg/release/v1"
+)
+
+// Get implements the HelmPackageManager interface by using the Helm SDK to get a release.
+// It returns a Release.
+func (hspm *HelmSDKPackageManager) Get(getOptions options.GetOptions) (*release.Release, error) {
+	log.Debug().
+		Str("context", "HelmClient").
+		Str("namespace", getOptions.Namespace).
+		Str("name", getOptions.Name).
+		Msg("Get Helm release")
+
+	actionConfig := new(action.Configuration)
+	err := hspm.initActionConfig(actionConfig, getOptions.Namespace, getOptions.KubernetesClusterAccess)
+
+	if err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Str("namespace", getOptions.Namespace).
+			Err(err).Msg("Failed to initialise helm configuration")
+		return nil, err
+	}
+
+	statusClient, err := hspm.initStatusClient(actionConfig, getOptions)
+	if err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Str("namespace", getOptions.Namespace).
+			Err(err).Msg("Failed to initialise helm status client")
+		return nil, err
+	}
+
+	release, err := statusClient.Run(getOptions.Name)
+	if err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Str("namespace", getOptions.Namespace).
+			Err(err).Msg("Failed to query helm chart")
+		return nil, err
+	}
+
+	values, err := hspm.getValues(getOptions)
+	if err != nil {
+		// error is already logged in getValuesFromStatus
+		return nil, err
+	}
+
+	v1Release, err := releaserToV1Release(release)
+	if err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Str("namespace", getOptions.Namespace).
+			Str("name", getOptions.Name).
+			Err(err).Msg("Failed to convert release to v1")
+		return nil, err
+	}
+	return convert(v1Release, values), nil
+}
+
+// Helm status is just an extended helm get command with resources added on (when flagged), so use the status client with the optional show resources flag
+// https://github.com/helm/helm/blob/0199b748aaea3091852d16687c9f9f809061777c/pkg/action/get.go#L40-L47
+// https://github.com/helm/helm/blob/0199b748aaea3091852d16687c9f9f809061777c/pkg/action/status.go#L48-L82
+func (hspm *HelmSDKPackageManager) initStatusClient(actionConfig *action.Configuration, getOptions options.GetOptions) (*action.Status, error) {
+	statusClient := action.NewStatus(actionConfig)
+	if getOptions.Revision > 0 {
+		statusClient.Version = getOptions.Revision
+	}
+
+	return statusClient, nil
+}
+
+func convert(releasev1 *releasev1.Release, values release.Values) *release.Release {
+	resources, err := parseResources(releasev1.Info.Resources)
+	if err != nil {
+		log.Warn().
+			Str("context", "HelmClient").
+			Str("namespace", releasev1.Namespace).
+			Str("name", releasev1.Name).
+			Err(err).Msg("Failed to parse resources")
+	}
+
+	// Parse stack ID from annotations -> int
+	stackID := 0
+	if releasev1.Chart != nil && releasev1.Chart.Metadata != nil {
+		if s, ok := releasev1.Chart.Metadata.Annotations[StackIDAnnotation]; ok && s != "" {
+			if id, err := strconv.Atoi(s); err == nil {
+				stackID = id
+			} else {
+				log.Warn().
+					Str("context", "HelmClient").
+					Str("namespace", releasev1.Namespace).
+					Str("name", releasev1.Name).
+					Err(err).Msg("Failed to parse stack id from annotations")
+			}
+		}
+	}
+	release := &release.Release{
+		Name:      releasev1.Name,
+		Namespace: releasev1.Namespace,
+		Version:   releasev1.Version,
+		Info: &release.Info{
+			Status:       release.Status(releasev1.Info.Status),
+			Notes:        releasev1.Info.Notes,
+			Resources:    resources,
+			Description:  releasev1.Info.Description,
+			LastDeployed: releasev1.Info.LastDeployed,
+		},
+		Manifest: releasev1.Manifest,
+		Chart: release.Chart{
+			Metadata: &release.Metadata{
+				Name:       releasev1.Chart.Metadata.Name,
+				Version:    releasev1.Chart.Metadata.Version,
+				AppVersion: releasev1.Chart.Metadata.AppVersion,
+			},
+		},
+		Values:         values,
+		ChartReference: extractChartReferenceAnnotations(releasev1.Chart.Metadata.Annotations),
+		StackID:        stackID,
+	}
+
+	return release
+}
diff --git a/pkg/libhelm/sdk/get_test.go b/pkg/libhelm/sdk/get_test.go
new file mode 100644
index 0000000..bbb90aa
--- /dev/null
+++ b/pkg/libhelm/sdk/get_test.go
@@ -0,0 +1,184 @@
+package sdk
+
+import (
+	"testing"
+
+	libhelmrelease "github.com/portainer/portainer/pkg/libhelm/release"
+	"github.com/stretchr/testify/assert"
+	chartv2 "helm.sh/helm/v4/pkg/chart/v2"
+	releasev1 "helm.sh/helm/v4/pkg/release/v1"
+)
+
+func Test_Convert(t *testing.T) {
+	t.Parallel()
+	t.Run("successfully maps a sdk release to a release", func(t *testing.T) {
+		is := assert.New(t)
+
+		release := releasev1.Release{
+			Name:    "releaseName",
+			Version: 1,
+			Info: &releasev1.Info{
+				Status: "deployed",
+			},
+			Chart: &chartv2.Chart{
+				Metadata: &chartv2.Metadata{
+					Name:       "chartName",
+					Version:    "chartVersion",
+					AppVersion: "chartAppVersion",
+				},
+			},
+		}
+
+		values := libhelmrelease.Values{
+			UserSuppliedValues: `{"key": "value"}`,
+			ComputedValues:     `{"key": "value"}`,
+		}
+
+		result := convert(&release, values)
+		is.Equal(release.Name, result.Name)
+	})
+
+	t.Run("extracts stack ID from annotations", func(t *testing.T) {
+		is := assert.New(t)
+
+		release := releasev1.Release{
+			Name:      "stack-release",
+			Namespace: "app-namespace",
+			Version:   2,
+			Info: &releasev1.Info{
+				Status: "deployed",
+			},
+			Chart: &chartv2.Chart{
+				Metadata: &chartv2.Metadata{
+					Name:    "myapp",
+					Version: "2.1.0",
+					Annotations: map[string]string{
+						StackIDAnnotation:   "123",
+						ChartPathAnnotation: "charts/myapp",
+						RepoURLAnnotation:   "https://github.com/company/charts",
+					},
+				},
+			},
+		}
+
+		result := convert(&release, libhelmrelease.Values{})
+
+		is.NotNil(result)
+		is.Equal(123, result.StackID)
+		is.Equal("charts/myapp", result.ChartReference.ChartPath)
+		is.Equal("https://github.com/company/charts", result.ChartReference.RepoURL)
+	})
+
+	t.Run("handles invalid stack ID gracefully", func(t *testing.T) {
+		is := assert.New(t)
+
+		release := releasev1.Release{
+			Name:      "release",
+			Namespace: "default",
+			Version:   1,
+			Info: &releasev1.Info{
+				Status: "deployed",
+			},
+			Chart: &chartv2.Chart{
+				Metadata: &chartv2.Metadata{
+					Name:    "chart",
+					Version: "1.0.0",
+					Annotations: map[string]string{
+						StackIDAnnotation: "not-a-number",
+					},
+				},
+			},
+		}
+
+		result := convert(&release, libhelmrelease.Values{})
+
+		is.NotNil(result)
+		// Should default to 0 when parsing fails
+		is.Equal(0, result.StackID)
+	})
+
+	t.Run("handles empty stack ID annotation", func(t *testing.T) {
+		is := assert.New(t)
+
+		release := releasev1.Release{
+			Name:      "release",
+			Namespace: "default",
+			Version:   1,
+			Info: &releasev1.Info{
+				Status: "deployed",
+			},
+			Chart: &chartv2.Chart{
+				Metadata: &chartv2.Metadata{
+					Name:    "chart",
+					Version: "1.0.0",
+					Annotations: map[string]string{
+						StackIDAnnotation: "",
+					},
+				},
+			},
+		}
+
+		result := convert(&release, libhelmrelease.Values{})
+
+		is.NotNil(result)
+		is.Equal(0, result.StackID)
+	})
+
+	t.Run("handles missing annotations", func(t *testing.T) {
+		is := assert.New(t)
+
+		release := releasev1.Release{
+			Name:      "release",
+			Namespace: "default",
+			Version:   1,
+			Info: &releasev1.Info{
+				Status: "deployed",
+			},
+			Chart: &chartv2.Chart{
+				Metadata: &chartv2.Metadata{
+					Name:        "chart",
+					Version:     "1.0.0",
+					Annotations: nil,
+				},
+			},
+		}
+
+		result := convert(&release, libhelmrelease.Values{})
+
+		is.NotNil(result)
+		is.Equal(0, result.StackID)
+	})
+
+	// Note: We don't test nil chart metadata or nil chart cases because
+	// the Helm SDK never returns releases in those states. The convert function
+	// assumes valid Helm SDK releases, which is acceptable for internal use.
+
+	t.Run("extracts registry ID from annotations", func(t *testing.T) {
+		is := assert.New(t)
+
+		release := releasev1.Release{
+			Name:      "release",
+			Namespace: "default",
+			Version:   1,
+			Info: &releasev1.Info{
+				Status: "deployed",
+			},
+			Chart: &chartv2.Chart{
+				Metadata: &chartv2.Metadata{
+					Name:    "chart",
+					Version: "1.0.0",
+					Annotations: map[string]string{
+						RegistryIDAnnotation: "42",
+						ChartPathAnnotation:  "oci://registry.example.com/charts/myapp",
+					},
+				},
+			},
+		}
+
+		result := convert(&release, libhelmrelease.Values{})
+
+		is.NotNil(result)
+		is.Equal(int64(42), result.ChartReference.RegistryID)
+		is.Equal("oci://registry.example.com/charts/myapp", result.ChartReference.ChartPath)
+	})
+}
diff --git a/pkg/libhelm/sdk/history.go b/pkg/libhelm/sdk/history.go
new file mode 100644
index 0000000..27e22f8
--- /dev/null
+++ b/pkg/libhelm/sdk/history.go
@@ -0,0 +1,84 @@
+package sdk
+
+import (
+	"sort"
+
+	"github.com/portainer/portainer/pkg/libhelm/options"
+	"github.com/portainer/portainer/pkg/libhelm/release"
+	"github.com/rs/zerolog/log"
+	"helm.sh/helm/v4/pkg/action"
+	sdkrelease "helm.sh/helm/v4/pkg/release"
+)
+
+// GetHistory implements the HelmPackageManager interface by using the Helm SDK to get a release.
+// It returns a Release.
+func (hspm *HelmSDKPackageManager) GetHistory(historyOptions options.HistoryOptions) ([]*release.Release, error) {
+	log.Debug().
+		Str("context", "HelmClient").
+		Str("namespace", historyOptions.Namespace).
+		Str("name", historyOptions.Name).
+		Msg("Get Helm history")
+
+	actionConfig := new(action.Configuration)
+	err := hspm.initActionConfig(actionConfig, historyOptions.Namespace, historyOptions.KubernetesClusterAccess)
+
+	if err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Str("namespace", historyOptions.Namespace).
+			Err(err).Msg("Failed to initialise helm configuration")
+		return nil, err
+	}
+
+	historyClient := action.NewHistory(actionConfig)
+	history, err := historyClient.Run(historyOptions.Name)
+	if err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Str("namespace", historyOptions.Namespace).
+			Err(err).Msg("Failed to query helm release history")
+		return nil, err
+	}
+
+	var result []*release.Release
+	for _, r := range history {
+		converted, err := convertHistory(r)
+		if err != nil {
+			return nil, err
+		}
+		result = append(result, converted)
+	}
+
+	// sort the result by version (latest first)
+	sort.Slice(result, func(i, j int) bool {
+		return result[i].Version > result[j].Version
+	})
+
+	return result, nil
+}
+
+func convertHistory(r sdkrelease.Releaser) (*release.Release, error) {
+	v1Release, err := releaserToV1Release(r)
+	if err != nil {
+		log.Error().Err(err).Msg("Failed to convert release")
+		return nil, err
+	}
+	return &release.Release{
+		Name:      v1Release.Name,
+		Namespace: v1Release.Namespace,
+		Version:   v1Release.Version,
+		Info: &release.Info{
+			Status:       release.Status(v1Release.Info.Status),
+			Notes:        v1Release.Info.Notes,
+			LastDeployed: v1Release.Info.LastDeployed,
+		},
+		Chart: release.Chart{
+			Metadata: &release.Metadata{
+				Name:       v1Release.Chart.Metadata.Name,
+				Version:    v1Release.Chart.Metadata.Version,
+				AppVersion: v1Release.Chart.Metadata.AppVersion,
+			},
+		},
+		ChartReference: extractChartReferenceAnnotations(v1Release.Chart.Metadata.Annotations),
+	}, nil
+}
diff --git a/pkg/libhelm/sdk/history_test.go b/pkg/libhelm/sdk/history_test.go
new file mode 100644
index 0000000..8ba65a1
--- /dev/null
+++ b/pkg/libhelm/sdk/history_test.go
@@ -0,0 +1,77 @@
+package sdk
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	chart "helm.sh/helm/v4/pkg/chart/v2"
+	sdkrelease "helm.sh/helm/v4/pkg/release/v1"
+)
+
+func Test_ConvertHistory(t *testing.T) {
+	t.Parallel()
+	t.Run("successfully maps a sdk release to a release", func(t *testing.T) {
+		is := assert.New(t)
+
+		release := sdkrelease.Release{
+			Name:    "releaseName",
+			Version: 1,
+			Info: &sdkrelease.Info{
+				Status: "deployed",
+			},
+			Chart: &chart.Chart{
+				Metadata: &chart.Metadata{
+					Name:       "chartName",
+					Version:    "chartVersion",
+					AppVersion: "chartAppVersion",
+				},
+			},
+		}
+
+		result, err := convertHistory(&release)
+		require.NoError(t, err)
+		is.Equal(release.Name, result.Name)
+	})
+
+	t.Run("populates ChartReference when portainer/chart-path annotation is present", func(t *testing.T) {
+		is := assert.New(t)
+
+		sdkRel := sdkrelease.Release{
+			Name:    "releaseName",
+			Version: 1,
+			Info:    &sdkrelease.Info{Status: "deployed"},
+			Chart: &chart.Chart{
+				Metadata: &chart.Metadata{
+					Name: "chartName",
+					Annotations: map[string]string{
+						ChartPathAnnotation: "/some/chart/path",
+					},
+				},
+			},
+		}
+
+		result, err := convertHistory(&sdkRel)
+		require.NoError(t, err)
+		is.Equal("/some/chart/path", result.ChartReference.ChartPath)
+	})
+
+	t.Run("ChartReference.ChartPath is empty when annotation is absent", func(t *testing.T) {
+		is := assert.New(t)
+
+		sdkRel := sdkrelease.Release{
+			Name:    "releaseName",
+			Version: 1,
+			Info:    &sdkrelease.Info{Status: "deployed"},
+			Chart: &chart.Chart{
+				Metadata: &chart.Metadata{
+					Name: "chartName",
+				},
+			},
+		}
+
+		result, err := convertHistory(&sdkRel)
+		require.NoError(t, err)
+		is.Empty(result.ChartReference.ChartPath)
+	})
+}
diff --git a/pkg/libhelm/sdk/install.go b/pkg/libhelm/sdk/install.go
new file mode 100644
index 0000000..07607b7
--- /dev/null
+++ b/pkg/libhelm/sdk/install.go
@@ -0,0 +1,197 @@
+package sdk
+
+import (
+	"time"
+
+	"github.com/pkg/errors"
+	"github.com/portainer/portainer/pkg/libhelm/cache"
+	"github.com/portainer/portainer/pkg/libhelm/options"
+	"github.com/portainer/portainer/pkg/libhelm/release"
+	"github.com/rs/zerolog/log"
+	"helm.sh/helm/v4/pkg/action"
+	"helm.sh/helm/v4/pkg/kube"
+)
+
+// Install implements the HelmPackageManager interface by using the Helm SDK to install a chart.
+func (hspm *HelmSDKPackageManager) install(installOpts options.InstallOptions) (*release.Release, error) {
+	log.Debug().
+		Str("context", "HelmClient").
+		Str("chart", installOpts.Chart).
+		Str("name", installOpts.Name).
+		Str("namespace", installOpts.Namespace).
+		Str("repo", installOpts.Repo).
+		Bool("wait", installOpts.Wait).
+		Msg("Installing Helm chart")
+
+	if installOpts.Name == "" {
+		log.Error().
+			Str("context", "HelmClient").
+			Str("chart", installOpts.Chart).
+			Str("name", installOpts.Name).
+			Str("namespace", installOpts.Namespace).
+			Str("repo", installOpts.Repo).
+			Bool("wait", installOpts.Wait).
+			Msg("Name is required for helm release installation")
+		return nil, errors.New("name is required for helm release installation")
+	}
+
+	// Initialize action configuration with kubernetes config
+	actionConfig := new(action.Configuration)
+	err := hspm.initActionConfig(actionConfig, installOpts.Namespace, installOpts.KubernetesClusterAccess)
+	if err != nil {
+		// error is already logged in initActionConfig
+		return nil, errors.Wrap(err, "failed to initialize helm configuration for helm release installation")
+	}
+
+	// Setup chart source
+	err = authenticateChartSource(actionConfig, installOpts.Registry)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to setup chart source for helm release installation")
+	}
+
+	installClient, err := initInstallClient(actionConfig, installOpts)
+	if err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Err(err).
+			Msg("Failed to initialize helm install client for helm release installation")
+		return nil, errors.Wrap(err, "failed to initialize helm install client for helm release installation")
+	}
+
+	var values map[string]any
+	if installOpts.Values != nil {
+		values = installOpts.Values
+	} else {
+		values, err = GetHelmValuesFromFile(installOpts.ValuesFile)
+		if err != nil {
+			log.Error().
+				Str("context", "HelmClient").
+				Err(err).
+				Msg("Failed to get Helm values from file for helm release installation")
+			return nil, errors.Wrap(err, "failed to get Helm values from file for helm release installation")
+		}
+	}
+
+	chartRef, repoURL, err := parseChartRef(installOpts.Chart, installOpts.Repo, installOpts.Registry)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to parse chart reference for helm release installation")
+	}
+	chart, err := hspm.loadAndValidateChartWithPathOptions(actionConfig, &installClient.ChartPathOptions, chartRef, installOpts.Version, repoURL, installClient.DependencyUpdate, "release installation")
+	if err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Err(err).
+			Msg("Failed to load and validate chart for helm release installation")
+
+		// Check if this is an authentication error and flush cache if needed
+		if installOpts.Registry != nil && shouldFlushCacheOnError(err, installOpts.Registry.ID) {
+			cache.FlushRegistryByID(installOpts.Registry.ID)
+			log.Info().
+				Int("registry_id", int(installOpts.Registry.ID)).
+				Str("context", "HelmClient").
+				Msg("Flushed registry cache due to chart loading authentication error during install")
+		}
+
+		return nil, errors.Wrap(err, "failed to load and validate chart for helm release installation")
+	}
+
+	// Add chart references to annotations
+	var registryID int
+	if installOpts.Registry != nil {
+		registryID = int(installOpts.Registry.ID)
+	}
+	chart.Metadata.Annotations = appendChartReferenceAnnotations(installOpts.Chart, installOpts.Repo, registryID, installOpts.StackID, installOpts.AutoUpdate, chart.Metadata.Annotations)
+
+	// Run the installation
+	log.Info().
+		Str("context", "HelmClient").
+		Str("chart", installOpts.Chart).
+		Str("name", installOpts.Name).
+		Str("namespace", installOpts.Namespace).
+		Msg("Running chart installation for helm release")
+
+	helmRelease, err := installClient.Run(chart, values)
+	if err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Str("chart", installOpts.Chart).
+			Str("name", installOpts.Name).
+			Str("namespace", installOpts.Namespace).
+			Err(err).
+			Msg("Failed to install helm chart for helm release installation")
+		if installOpts.DryRun {
+			// remove installation wording for dry run. The inner error has enough context.
+			return nil, errors.Wrap(err, "dry-run failed")
+		}
+		return nil, errors.Wrap(err, "helm was not able to install the chart for helm release installation")
+	}
+	v1Release, err := releaserToV1Release(helmRelease)
+	if err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Str("chart", installOpts.Chart).
+			Str("name", installOpts.Name).
+			Str("namespace", installOpts.Namespace).
+			Err(err).
+			Msg("Failed to convert helm release to v1 release for helm release installation")
+		return nil, errors.Wrap(err, "helm was not able to convert helm release to v1 release")
+	}
+
+	return &release.Release{
+		Name:      v1Release.Name,
+		Namespace: v1Release.Namespace,
+		Chart: release.Chart{
+			Metadata: &release.Metadata{
+				Name:        v1Release.Chart.Metadata.Name,
+				Version:     v1Release.Chart.Metadata.Version,
+				AppVersion:  v1Release.Chart.Metadata.AppVersion,
+				Annotations: v1Release.Chart.Metadata.Annotations,
+			},
+		},
+		Labels:   v1Release.Labels,
+		Version:  v1Release.Version,
+		Manifest: v1Release.Manifest,
+	}, nil
+}
+
+// initInstallClient initializes the install client with the given options
+// and return the install client.
+func initInstallClient(actionConfig *action.Configuration, installOpts options.InstallOptions) (*action.Install, error) {
+	installClient := action.NewInstall(actionConfig)
+	installClient.DependencyUpdate = true
+	installClient.ReleaseName = installOpts.Name
+	if installOpts.Wait {
+		installClient.WaitStrategy = kube.StatusWatcherStrategy
+	} else {
+		installClient.WaitStrategy = kube.HookOnlyStrategy
+	}
+	installClient.Timeout = installOpts.Timeout
+	installClient.Version = installOpts.Version
+	if installOpts.DryRun {
+		installClient.DryRunStrategy = action.DryRunClient
+	}
+	installClient.TakeOwnership = installOpts.TakeOwnership
+	installClient.CreateNamespace = installOpts.CreateNamespace
+	err := configureChartPathOptions(&installClient.ChartPathOptions, installOpts.Version, installOpts.Repo, installOpts.Registry)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to configure chart path options for helm release installation")
+	}
+
+	// Set default values if not specified
+	if installOpts.Timeout == 0 {
+		installClient.Timeout = 15 * time.Minute // set a bigger timeout for large charts
+	} else {
+		installClient.Timeout = installOpts.Timeout
+	}
+	if installOpts.Namespace == "" {
+		installClient.Namespace = "default"
+	} else {
+		installClient.Namespace = installOpts.Namespace
+	}
+
+	if len(installOpts.HelmAppLabels) > 0 {
+		installClient.PostRenderer = &appLabelsPostRenderer{labels: installOpts.HelmAppLabels}
+	}
+
+	return installClient, nil
+}
diff --git a/pkg/libhelm/sdk/install_test.go b/pkg/libhelm/sdk/install_test.go
new file mode 100644
index 0000000..2c942b0
--- /dev/null
+++ b/pkg/libhelm/sdk/install_test.go
@@ -0,0 +1,196 @@
+package sdk
+
+import (
+	"os"
+	"testing"
+
+	"github.com/portainer/portainer/pkg/libhelm/options"
+	"github.com/portainer/portainer/pkg/libhelm/test"
+
+	"github.com/stretchr/testify/require"
+)
+
+func Test_Install(t *testing.T) {
+	t.Parallel()
+	test.EnsureIntegrationTest(t)
+	is := require.New(t)
+
+	// Create a new SDK package manager
+	hspm := NewHelmSDKPackageManager()
+
+	t.Run("successfully installs nginx chart with name test-nginx", func(t *testing.T) {
+		// SDK equivalent of: helm install test-nginx --repo https://kubernetes.github.io/ingress-nginx nginx
+		installOpts := options.InstallOptions{
+			Name:  "test-nginx",
+			Chart: "ingress-nginx",
+			Repo:  "https://kubernetes.github.io/ingress-nginx",
+		}
+
+		err := hspm.Uninstall(options.UninstallOptions{Name: installOpts.Name})
+		require.NoError(t, err)
+
+		release, err := hspm.Upgrade(installOpts)
+		require.NoError(t, err, "should successfully install release")
+		is.NotNil(release, "should return non-nil release")
+		defer func() {
+			err := hspm.Uninstall(options.UninstallOptions{Name: installOpts.Name})
+			require.NoError(t, err)
+		}()
+
+		is.Equal("test-nginx", release.Name, "release name should match")
+		is.Equal(1, release.Version, "release version should be 1")
+		is.NotEmpty(release.Manifest, "release manifest should not be empty")
+	})
+
+	t.Run("successfully installs nginx with values", func(t *testing.T) {
+		// SDK equivalent of: helm install test-nginx-2 --repo https://kubernetes.github.io/ingress-nginx nginx --values /tmp/helm-values3161785816
+		values, err := test.CreateValuesFile("service:\n  port:  8081")
+		require.NoError(t, err, "should create a values file")
+		defer func() {
+			err := os.Remove(values)
+			require.NoError(t, err)
+		}()
+
+		installOpts := options.InstallOptions{
+			Name:       "test-nginx-2",
+			Chart:      "ingress-nginx",
+			Repo:       "https://kubernetes.github.io/ingress-nginx",
+			ValuesFile: values,
+		}
+
+		err = hspm.Uninstall(options.UninstallOptions{Name: installOpts.Name})
+		require.NoError(t, err)
+
+		release, err := hspm.Upgrade(installOpts)
+		require.NoError(t, err, "should successfully install release")
+		is.NotNil(release, "should return non-nil release")
+		defer func() {
+			err := hspm.Uninstall(options.UninstallOptions{Name: installOpts.Name})
+			require.NoError(t, err)
+		}()
+
+		is.Equal("test-nginx-2", release.Name, "release name should match")
+		is.Equal(1, release.Version, "release version should be 1")
+		is.NotEmpty(release.Manifest, "release manifest should not be empty")
+	})
+
+	t.Run("successfully installs portainer chart with name portainer-test", func(t *testing.T) {
+		// SDK equivalent of: helm install portainer-test portainer --repo https://portainer.github.io/k8s/
+		installOpts := options.InstallOptions{
+			Name:  "portainer-test",
+			Chart: "portainer",
+			Repo:  "https://portainer.github.io/k8s/",
+		}
+
+		err := hspm.Uninstall(options.UninstallOptions{Name: installOpts.Name})
+		require.NoError(t, err)
+
+		release, err := hspm.Upgrade(installOpts)
+		require.NoError(t, err, "should successfully install release")
+		is.NotNil(release, "should return non-nil release")
+		defer func() {
+			err := hspm.Uninstall(options.UninstallOptions{Name: installOpts.Name})
+			require.NoError(t, err)
+		}()
+
+		is.Equal("portainer-test", release.Name, "release name should match")
+		is.Equal(1, release.Version, "release version should be 1")
+		is.NotEmpty(release.Manifest, "release manifest should not be empty")
+	})
+
+	t.Run("install with values as string", func(t *testing.T) {
+		// First create a values file since InstallOptions doesn't support values as string directly
+		values, err := test.CreateValuesFile("service:\n  port:  8082")
+		require.NoError(t, err, "should create a values file")
+		defer func() {
+			err := os.Remove(values)
+			require.NoError(t, err)
+		}()
+
+		// Install with values file
+		installOpts := options.InstallOptions{
+			Name:       "test-nginx-3",
+			Chart:      "ingress-nginx",
+			Repo:       "https://kubernetes.github.io/ingress-nginx",
+			ValuesFile: values,
+		}
+
+		err = hspm.Uninstall(options.UninstallOptions{Name: installOpts.Name})
+		require.NoError(t, err)
+
+		release, err := hspm.Upgrade(installOpts)
+		require.NoError(t, err, "should successfully install release")
+		is.NotNil(release, "should return non-nil release")
+		defer func() {
+			err := hspm.Uninstall(options.UninstallOptions{Name: installOpts.Name})
+			require.NoError(t, err)
+		}()
+
+		is.Equal("test-nginx-3", release.Name, "release name should match")
+	})
+
+	t.Run("install with namespace", func(t *testing.T) {
+		// Install with namespace
+		installOpts := options.InstallOptions{
+			Name:      "test-nginx-4",
+			Chart:     "ingress-nginx",
+			Repo:      "https://kubernetes.github.io/ingress-nginx",
+			Namespace: "default",
+		}
+
+		err := hspm.Uninstall(options.UninstallOptions{Name: installOpts.Name})
+		require.NoError(t, err)
+
+		release, err := hspm.Upgrade(installOpts)
+		require.NoError(t, err, "should successfully install release")
+		is.NotNil(release, "should return non-nil release")
+		defer func() {
+			err := hspm.Uninstall(options.UninstallOptions{Name: installOpts.Name})
+			require.NoError(t, err)
+		}()
+
+		is.Equal("test-nginx-4", release.Name, "release name should match")
+		is.Equal("default", release.Namespace, "release namespace should match")
+	})
+
+	t.Run("returns an error when name is not provided", func(t *testing.T) {
+		installOpts := options.InstallOptions{
+			Chart: "ingress-nginx",
+			Repo:  "https://kubernetes.github.io/ingress-nginx",
+		}
+
+		err := hspm.Uninstall(options.UninstallOptions{Name: installOpts.Name})
+		require.NoError(t, err)
+
+		_, err = hspm.Upgrade(installOpts)
+
+		require.Error(t, err, "should return an error when name is not provided")
+		// is.Equal(err.Error(), "name is required for helm release installation")
+	})
+
+	t.Run("install with invalid chart", func(t *testing.T) {
+		// Install with invalid chart
+		installOpts := options.InstallOptions{
+			Name:  "test-invalid",
+			Chart: "non-existent-chart",
+			Repo:  "https://kubernetes.github.io/ingress-nginx",
+		}
+		_, err := hspm.Upgrade(installOpts)
+		require.Error(t, err, "should return error when chart doesn't exist")
+	})
+
+	t.Run("install with invalid repo", func(t *testing.T) {
+		// Install with invalid repo
+		installOpts := options.InstallOptions{
+			Name:  "test-invalid-repo",
+			Chart: "nginx",
+			Repo:  "https://non-existent-repo.example.com",
+		}
+
+		err := hspm.Uninstall(options.UninstallOptions{Name: installOpts.Name})
+		require.NoError(t, err)
+
+		_, err = hspm.Upgrade(installOpts)
+		require.Error(t, err, "should return error when repo doesn't exist")
+	})
+}
diff --git a/pkg/libhelm/sdk/label_post_renderer.go b/pkg/libhelm/sdk/label_post_renderer.go
new file mode 100644
index 0000000..5e5e85c
--- /dev/null
+++ b/pkg/libhelm/sdk/label_post_renderer.go
@@ -0,0 +1,28 @@
+package sdk
+
+import (
+	"bytes"
+
+	"github.com/portainer/portainer/api/kubernetes"
+	"github.com/rs/zerolog/log"
+	"helm.sh/helm/v4/pkg/postrenderer"
+)
+
+// Ensure appLabelsPostRenderer implements the postrender.PostRenderer interface.
+var _ postrenderer.PostRenderer = &appLabelsPostRenderer{}
+
+// appLabelsPostRenderer is an in-process Helm post-renderer that injects
+// Portainer app labels into every Kubernetes resource in the rendered manifests.
+type appLabelsPostRenderer struct {
+	labels map[string]string
+}
+
+func (r *appLabelsPostRenderer) Run(renderedManifests *bytes.Buffer) (*bytes.Buffer, error) {
+	labeled, err := kubernetes.AddAppLabels(renderedManifests.Bytes(), r.labels)
+	if err != nil {
+		log.Debug().Err(err).Interface("labels", r.labels).Msg("Failed to add app labels to rendered manifests")
+		return nil, err
+	}
+
+	return bytes.NewBuffer(labeled), nil
+}
diff --git a/pkg/libhelm/sdk/list.go b/pkg/libhelm/sdk/list.go
new file mode 100644
index 0000000..ee7bb63
--- /dev/null
+++ b/pkg/libhelm/sdk/list.go
@@ -0,0 +1,114 @@
+package sdk
+
+import (
+	"fmt"
+	"strconv"
+
+	"github.com/pkg/errors"
+	"github.com/portainer/portainer/pkg/libhelm/options"
+	"github.com/portainer/portainer/pkg/libhelm/release"
+	"github.com/rs/zerolog/log"
+	"helm.sh/helm/v4/pkg/action"
+	sdkrelease "helm.sh/helm/v4/pkg/release"
+	releasev1 "helm.sh/helm/v4/pkg/release/v1"
+)
+
+// List implements the HelmPackageManager interface by using the Helm SDK to list releases.
+// It returns a slice of ReleaseElement.
+func (hspm *HelmSDKPackageManager) List(listOpts options.ListOptions) ([]release.ReleaseElement, error) {
+	log.Debug().
+		Str("context", "HelmClient").
+		Str("namespace", listOpts.Namespace).
+		Str("filter", listOpts.Filter).
+		Str("selector", listOpts.Selector).
+		Msg("Listing Helm releases")
+
+	// Initialize action configuration with kubernetes config
+	actionConfig := new(action.Configuration)
+	err := hspm.initActionConfig(actionConfig, listOpts.Namespace, listOpts.KubernetesClusterAccess)
+	if err != nil {
+		// error is already logged in initActionConfig
+		return nil, errors.Wrap(err, "failed to initialize helm configuration")
+	}
+
+	listClient, err := initListClient(actionConfig, listOpts)
+	if err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Err(err).
+			Msg("Failed to initialize helm list client")
+		return nil, errors.Wrap(err, "failed to initialize helm list client")
+	}
+
+	// Run the list operation
+	releases, err := listClient.Run()
+	if err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Err(err).
+			Msg("Failed to list helm releases")
+		return []release.ReleaseElement{}, errors.Wrap(err, "failed to list helm releases")
+	}
+
+	// Convert from SDK release type to our release element type and return
+	return convertToReleaseElements(releases)
+}
+
+// convertToReleaseElements converts from the SDK release type to our release element type
+func convertToReleaseElements(ls []sdkrelease.Releaser) ([]release.ReleaseElement, error) {
+	rls := make([]*releasev1.Release, 0, len(ls))
+	for _, val := range ls {
+		rel, err := releaserToV1Release(val)
+		if err != nil {
+			return nil, errors.Wrap(err, "failed to convert releaser to v1 release")
+		}
+		rls = append(rls, rel)
+	}
+	elements := make([]release.ReleaseElement, len(rls))
+
+	for i, rel := range rls {
+		chartName := fmt.Sprintf("%s-%s", rel.Chart.Metadata.Name, rel.Chart.Metadata.Version)
+
+		elements[i] = release.ReleaseElement{
+			Name:       rel.Name,
+			Namespace:  rel.Namespace,
+			Revision:   strconv.Itoa(rel.Version),
+			Updated:    rel.Info.LastDeployed.String(),
+			Status:     string(rel.Info.Status),
+			Chart:      chartName,
+			AppVersion: rel.Chart.Metadata.AppVersion,
+		}
+	}
+
+	return elements, nil
+}
+
+// initListClient initializes the list client with the given options
+// and return the list client.
+func initListClient(actionConfig *action.Configuration, listOpts options.ListOptions) (*action.List, error) {
+	listClient := action.NewList(actionConfig)
+
+	// Configure list options
+	if listOpts.Filter != "" {
+		listClient.Filter = listOpts.Filter
+	}
+
+	if listOpts.Selector != "" {
+		listClient.Selector = listOpts.Selector
+	}
+
+	// If no namespace is specified in options, list across all namespaces
+	if listOpts.Namespace == "" {
+		listClient.AllNamespaces = true
+	}
+
+	// No limit by default
+	listClient.Limit = 0
+	// Show all releases, even if in a pending or failed state
+	listClient.All = true
+
+	// Set state mask to ensure proper filtering by status
+	listClient.SetStateMask()
+
+	return listClient, nil
+}
diff --git a/pkg/libhelm/sdk/list_test.go b/pkg/libhelm/sdk/list_test.go
new file mode 100644
index 0000000..4bf4665
--- /dev/null
+++ b/pkg/libhelm/sdk/list_test.go
@@ -0,0 +1,81 @@
+package sdk
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	chart "helm.sh/helm/v4/pkg/chart/v2"
+	release "helm.sh/helm/v4/pkg/release"
+	"helm.sh/helm/v4/pkg/release/common"
+	releasev1 "helm.sh/helm/v4/pkg/release/v1"
+)
+
+func Test_ConvertToReleaseElements(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	// Create mock releases
+	releases := []*releasev1.Release{
+		{
+			Name:      "release1",
+			Namespace: "default",
+			Version:   1,
+			Info: &releasev1.Info{
+				Status:       common.StatusDeployed,
+				LastDeployed: time.Now(),
+			},
+			Chart: &chart.Chart{
+				Metadata: &chart.Metadata{
+					Name:       "chart1",
+					Version:    "1.0.0",
+					AppVersion: "1.0.0",
+				},
+			},
+		},
+		{
+			Name:      "release2",
+			Namespace: "kube-system",
+			Version:   2,
+			Info: &releasev1.Info{
+				Status:       common.StatusFailed,
+				LastDeployed: time.Now(),
+			},
+			Chart: &chart.Chart{
+				Metadata: &chart.Metadata{
+					Name:       "chart2",
+					Version:    "2.0.0",
+					AppVersion: "2.0.0",
+				},
+			},
+		},
+	}
+
+	// Convert to release elements using the releasor interface
+	var releasors []release.Releaser
+	for _, r := range releases {
+		releasors = append(releasors, r)
+	}
+	elements, err := convertToReleaseElements(releasors)
+	require.NoError(t, err)
+
+	// Verify conversion
+	is.Len(elements, 2, "should return 2 release elements")
+
+	// Verify first release
+	is.Equal("release1", elements[0].Name, "first release name should be release1")
+	is.Equal("default", elements[0].Namespace, "first release namespace should be default")
+	is.Equal("1", elements[0].Revision, "first release revision should be 1")
+	is.Equal(string(common.StatusDeployed), elements[0].Status, "first release status should be deployed")
+	is.Equal("chart1-1.0.0", elements[0].Chart, "first release chart should be chart1-1.0.0")
+	is.Equal("1.0.0", elements[0].AppVersion, "first release app version should be 1.0.0")
+
+	// Verify second release
+	is.Equal("release2", elements[1].Name, "second release name should be release2")
+	is.Equal("kube-system", elements[1].Namespace, "second release namespace should be kube-system")
+	is.Equal("2", elements[1].Revision, "second release revision should be 2")
+	is.Equal(string(common.StatusFailed), elements[1].Status, "second release status should be failed")
+	is.Equal("chart2-2.0.0", elements[1].Chart, "second release chart should be chart2-2.0.0")
+	is.Equal("2.0.0", elements[1].AppVersion, "second release app version should be 2.0.0")
+}
diff --git a/pkg/libhelm/sdk/manager.go b/pkg/libhelm/sdk/manager.go
new file mode 100644
index 0000000..9e553d6
--- /dev/null
+++ b/pkg/libhelm/sdk/manager.go
@@ -0,0 +1,22 @@
+package sdk
+
+import (
+	"time"
+
+	"helm.sh/helm/v4/pkg/cli"
+)
+
+// HelmSDKPackageManager is a wrapper for the helm SDK which implements HelmPackageManager
+type HelmSDKPackageManager struct {
+	settings *cli.EnvSettings
+	timeout  time.Duration
+}
+
+// NewHelmSDKPackageManager initializes a new HelmPackageManager service using the Helm SDK
+func NewHelmSDKPackageManager() *HelmSDKPackageManager {
+	settings := cli.New()
+	return &HelmSDKPackageManager{
+		settings: settings,
+		timeout:  300 * time.Second, // 5 minutes default timeout
+	}
+}
diff --git a/pkg/libhelm/sdk/manager_test.go b/pkg/libhelm/sdk/manager_test.go
new file mode 100644
index 0000000..306909d
--- /dev/null
+++ b/pkg/libhelm/sdk/manager_test.go
@@ -0,0 +1,26 @@
+package sdk
+
+import (
+	"testing"
+	"time"
+
+	"github.com/portainer/portainer/pkg/libhelm/types"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_NewHelmSDKPackageManager(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	// Test that NewHelmSDKPackageManager returns a non-nil HelmPackageManager
+	manager := NewHelmSDKPackageManager()
+	is.NotNil(manager, "should return non-nil HelmPackageManager")
+
+	// Test that the manager has the expected fields
+	is.NotNil(manager.settings, "should have non-nil settings")
+	is.Equal(300*time.Second, manager.timeout, "should have 5 minute timeout")
+
+	// Test that the manager implements the HelmPackageManager interface
+	var _ types.HelmPackageManager = manager
+}
diff --git a/pkg/libhelm/sdk/release.go b/pkg/libhelm/sdk/release.go
new file mode 100644
index 0000000..f2f4b4b
--- /dev/null
+++ b/pkg/libhelm/sdk/release.go
@@ -0,0 +1,58 @@
+package sdk
+
+import (
+	"fmt"
+
+	"github.com/pkg/errors"
+	"github.com/portainer/portainer/pkg/libhelm/options"
+	"helm.sh/helm/v4/pkg/action"
+	"helm.sh/helm/v4/pkg/release/common"
+	releasev1 "helm.sh/helm/v4/pkg/release/v1"
+	"helm.sh/helm/v4/pkg/storage/driver"
+)
+
+func (hspm *HelmSDKPackageManager) doesReleaseExist(releaseName, namespace string, clusterAccess *options.KubernetesClusterAccess) (bool, error) {
+	// Initialize action configuration
+	actionConfig := new(action.Configuration)
+	err := hspm.initActionConfig(actionConfig, namespace, clusterAccess)
+	if err != nil {
+		// error is already logged in initActionConfig
+		return false, fmt.Errorf("failed to initialize helm configuration: %w", err)
+	}
+
+	historyClient, err := hspm.initHistoryClient(actionConfig, namespace, clusterAccess)
+	if err != nil {
+		// error is already logged in initHistoryClient
+		return false, fmt.Errorf("failed to initialize helm history client: %w", err)
+	}
+
+	versions, err := historyClient.Run(releaseName)
+
+	releases := make([]*releasev1.Release, 0, len(versions))
+	for _, val := range versions {
+		rel, err := releaserToV1Release(val)
+		if err != nil {
+			return false, fmt.Errorf("failed to convert helm release to helm release v1: %w", err)
+		}
+		releases = append(releases, rel)
+	}
+
+	if errors.Is(err, driver.ErrReleaseNotFound) || isReleaseUninstalled(releases) {
+		return false, nil
+	} else if err != nil {
+		return false, fmt.Errorf("failed to get history: %w", err)
+	}
+
+	return true, nil
+}
+
+func isReleaseUninstalled(versions []*releasev1.Release) bool {
+	return len(versions) > 0 && versions[len(versions)-1].Info.Status == common.StatusUninstalled
+}
+
+func (hspm *HelmSDKPackageManager) initHistoryClient(actionConfig *action.Configuration, namespace string, clusterAccess *options.KubernetesClusterAccess) (*action.History, error) {
+	historyClient := action.NewHistory(actionConfig)
+	historyClient.Max = 1
+
+	return historyClient, nil
+}
diff --git a/pkg/libhelm/sdk/resources.go b/pkg/libhelm/sdk/resources.go
new file mode 100644
index 0000000..af5aad9
--- /dev/null
+++ b/pkg/libhelm/sdk/resources.go
@@ -0,0 +1,293 @@
+package sdk
+
+import (
+	"time"
+
+	"github.com/segmentio/encoding/json"
+
+	"github.com/rs/zerolog/log"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+const (
+	Unknown     = "Unknown"
+	Healthy     = "Healthy"
+	Unhealthy   = "Unhealthy"
+	Progressing = "Progressing"
+)
+
+// ResourceStatus represents a generic status for any Kubernetes resource.
+type ResourceStatus struct {
+	// Phase is a simple, high-level summary of where the resource is in its lifecycle.
+	Phase string `json:"phase,omitempty"`
+
+	// HealthSummary represents the summarized health status of the resource
+	HealthSummary *HealthCondition `json:"healthSummary,omitempty"`
+
+	// Reason is a brief CamelCase string containing the reason for the resource's current status.
+	Reason string `json:"reason,omitempty"`
+
+	// Message is a human-readable description of the current status.
+	Message string `json:"message,omitempty"`
+}
+
+// HealthCondition represents a summarized health condition for a resource
+type HealthCondition struct {
+	Status  string `json:"status,omitempty"`
+	Reason  string `json:"reason,omitempty"`
+	Message string `json:"message,omitempty"`
+}
+
+// parseResources returns a list of resources with additional status information, in a consistent format.
+func parseResources(resourceTypesLists map[string][]runtime.Object) ([]*unstructured.Unstructured, error) {
+	flattenedResources := flattenResources(resourceTypesLists)
+
+	resourcesInfo := []*unstructured.Unstructured{}
+	for _, resource := range flattenedResources {
+		info, err := getResourceInfo(resource)
+		if err != nil {
+			return nil, err
+		}
+
+		resourcesInfo = append(resourcesInfo, info)
+	}
+
+	return resourcesInfo, nil
+}
+
+func getResourceInfo(obj runtime.Object) (*unstructured.Unstructured, error) {
+	data, err := json.Marshal(obj)
+	if err != nil {
+		return nil, err
+	}
+
+	res := &unstructured.Unstructured{}
+	err = json.Unmarshal(data, res)
+	if err != nil {
+		return nil, err
+	}
+
+	status, conditions, err := extractStatus(res)
+	if err == nil {
+		summarizeStatus(status, conditions, res.GetName(), res.GetNamespace(), err)
+		applyStatusToResource(res, status)
+	}
+
+	// only keep metadata, kind and status (other fields are not needed)
+	res.Object = map[string]any{
+		"metadata": res.Object["metadata"],
+		"kind":     res.Object["kind"],
+		"status":   res.Object["status"],
+	}
+
+	return res, nil
+}
+
+// extractStatus extracts the status from an unstructured resource
+func extractStatus(res *unstructured.Unstructured) (*ResourceStatus, []metav1.Condition, error) {
+	statusMap, found, err := unstructured.NestedMap(res.Object, "status")
+	if !found || err != nil {
+		return &ResourceStatus{}, nil, nil
+	}
+
+	// Extract basic status fields
+	phase, _, _ := unstructured.NestedString(statusMap, "phase")
+	reason, _, _ := unstructured.NestedString(statusMap, "reason")
+	message, _, _ := unstructured.NestedString(statusMap, "message")
+
+	// Extract conditions for analysis
+	conditions := []metav1.Condition{}
+	conditionsData, found, _ := unstructured.NestedSlice(statusMap, "conditions")
+	if found {
+		for _, condData := range conditionsData {
+			condMap, ok := condData.(map[string]any)
+			if !ok {
+				continue
+			}
+
+			cond := metav1.Condition{}
+			if typeStr, ok := condMap["type"].(string); ok {
+				cond.Type = typeStr
+			}
+			if statusStr, ok := condMap["status"].(string); ok {
+				cond.Status = metav1.ConditionStatus(statusStr)
+			}
+			if reasonStr, ok := condMap["reason"].(string); ok {
+				cond.Reason = reasonStr
+			}
+			if msgStr, ok := condMap["message"].(string); ok {
+				cond.Message = msgStr
+			}
+			if timeStr, ok := condMap["lastTransitionTime"].(string); ok {
+				t, _ := time.Parse(time.RFC3339, timeStr)
+				cond.LastTransitionTime = metav1.Time{Time: t}
+			}
+
+			conditions = append(conditions, cond)
+		}
+	}
+
+	return &ResourceStatus{
+		Phase:   phase,
+		Reason:  reason,
+		Message: message,
+	}, conditions, nil
+}
+
+// summarizeStatus creates a health summary based on resource status and conditions
+func summarizeStatus(status *ResourceStatus, conditions []metav1.Condition, name string, namespace string, err error) *ResourceStatus {
+	healthSummary := &HealthCondition{
+		Status:  Unknown,
+		Reason:  status.Reason,
+		Message: status.Message,
+	}
+
+	// Handle error case first
+	if err != nil {
+		healthSummary.Reason = "ErrorGettingStatus"
+		healthSummary.Message = err.Error()
+		status.HealthSummary = healthSummary
+		return status
+	}
+
+	// Handle phase-based status
+	switch status.Phase {
+	case "Error":
+		healthSummary.Status = Unhealthy
+		healthSummary.Reason = status.Phase
+	case "Running":
+		healthSummary.Status = Healthy
+		healthSummary.Reason = status.Phase
+	case "Pending":
+		healthSummary.Status = Progressing
+		healthSummary.Reason = status.Phase
+	case "Failed":
+		healthSummary.Status = Unhealthy
+		healthSummary.Reason = status.Phase
+	case "Available", "Active", "Established", "Bound", "Ready", "Succeeded":
+		healthSummary.Status = Healthy
+		healthSummary.Reason = status.Phase
+	case "":
+		// Empty phase - check conditions or default to "Exists"
+		if len(conditions) > 0 {
+			analyzeConditions(conditions, healthSummary)
+		} else {
+			healthSummary.Status = Healthy
+			healthSummary.Reason = "Exists"
+		}
+	default:
+		log.Warn().
+			Str("context", "HelmClient").
+			Str("namespace", namespace).
+			Str("name", name).
+			Str("phase", status.Phase).
+			Msg("Unhandled status")
+		healthSummary.Reason = status.Phase
+	}
+
+	// Set message from first condition if available
+	if len(conditions) > 0 && healthSummary.Message == "" {
+		healthSummary.Message = conditions[0].Message
+	}
+
+	status.HealthSummary = healthSummary
+	return status
+}
+
+// analyzeConditions determines resource health based on standard condition types
+func analyzeConditions(conditions []metav1.Condition, healthSummary *HealthCondition) {
+	for _, cond := range conditions {
+		switch cond.Type {
+		case "Progressing":
+			if cond.Status == "False" {
+				healthSummary.Status = Unhealthy
+				healthSummary.Reason = cond.Reason
+			} else if cond.Reason != "NewReplicaSetAvailable" {
+				healthSummary.Status = Unknown
+				healthSummary.Reason = cond.Reason
+			}
+		case "Available", "Ready", "DisruptionAllowed", "Established", "NamesAccepted":
+			if healthSummary.Status == Unknown ||
+				(cond.Type == "Established" && healthSummary.Status == Healthy) ||
+				(cond.Type == "NamesAccepted" && healthSummary.Status == Healthy) {
+				if cond.Status == "False" {
+					healthSummary.Status = Unhealthy
+				} else {
+					healthSummary.Status = Healthy
+				}
+				healthSummary.Reason = cond.Reason
+			}
+		case "ContainersReady":
+			if healthSummary.Status == Unknown && cond.Status == "False" {
+				healthSummary.Status = Unhealthy
+				healthSummary.Reason = cond.Reason
+			}
+		}
+	}
+}
+
+// applyStatusToResource applies the typed ResourceStatus back to the unstructured resource
+func applyStatusToResource(res *unstructured.Unstructured, status *ResourceStatus) {
+	statusMap := map[string]any{
+		"phase":   status.Phase,
+		"reason":  status.Reason,
+		"message": status.Message,
+	}
+
+	if status.HealthSummary != nil {
+		statusMap["healthSummary"] = map[string]any{
+			"status":  status.HealthSummary.Status,
+			"reason":  status.HealthSummary.Reason,
+			"message": status.HealthSummary.Message,
+		}
+	}
+
+	if err := unstructured.SetNestedMap(res.Object, statusMap, "status"); err != nil {
+		log.Warn().Err(err).Msg("failed to set status on resource")
+	}
+}
+
+// flattenResources extracts items from a list resource and convert them to runtime.Objects
+func flattenResources(resourceTypesLists map[string][]runtime.Object) []runtime.Object {
+	flattenedResources := []runtime.Object{}
+
+	for _, resourceTypeList := range resourceTypesLists {
+		for _, resourceItem := range resourceTypeList {
+			// if the resource item is a list, we need to flatten it too e.g. PodList
+			items := extractItemsIfList(resourceItem)
+			if items != nil {
+				flattenedResources = append(flattenedResources, items...)
+			} else {
+				flattenedResources = append(flattenedResources, resourceItem)
+			}
+		}
+	}
+
+	return flattenedResources
+}
+
+// extractItemsIfList extracts items if the resource is a list, or returns nil if not a list
+func extractItemsIfList(resource runtime.Object) []runtime.Object {
+	unstructuredObj, ok := resource.(runtime.Unstructured)
+	if !ok {
+		return nil
+	}
+
+	if !unstructuredObj.IsList() {
+		return nil
+	}
+
+	extractedItems := []runtime.Object{}
+	err := unstructuredObj.EachListItem(func(obj runtime.Object) error {
+		extractedItems = append(extractedItems, obj)
+		return nil
+	})
+
+	if err != nil {
+		return nil
+	}
+
+	return extractedItems
+}
diff --git a/pkg/libhelm/sdk/resources_test.go b/pkg/libhelm/sdk/resources_test.go
new file mode 100644
index 0000000..3b33794
--- /dev/null
+++ b/pkg/libhelm/sdk/resources_test.go
@@ -0,0 +1,146 @@
+package sdk
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+func TestParseResources(t *testing.T) {
+	t.Parallel()
+	t.Run("successfully parse single resource", func(t *testing.T) {
+		resourceTypesLists := map[string][]runtime.Object{
+			"v1/Pod(related)": {
+				&unstructured.Unstructured{
+					Object: map[string]any{
+						"apiVersion": "v1",
+						"kind":       "Pod",
+						"metadata": map[string]any{
+							"name":      "test-pod",
+							"namespace": "default",
+						},
+						"status": map[string]any{
+							"phase": "Available",
+						},
+					},
+				},
+			},
+		}
+
+		got, err := parseResources(resourceTypesLists)
+		require.NoError(t, err)
+		assert.Len(t, got, 1)
+
+		// Check resource metadata
+		assert.Equal(t, "test-pod", got[0].GetName())
+		assert.Equal(t, "default", got[0].GetNamespace())
+
+		// Check status and condition
+		statusMap, found, _ := unstructured.NestedMap(got[0].Object, "status")
+		assert.True(t, found)
+		assert.Equal(t, "Available", statusMap["phase"])
+
+		healthSummary, found, _ := unstructured.NestedMap(statusMap, "healthSummary")
+		assert.True(t, found)
+		assert.Equal(t, "Healthy", healthSummary["status"])
+		assert.Equal(t, "Available", healthSummary["reason"])
+	})
+
+	t.Run("successfully parse multiple resources", func(t *testing.T) {
+		resourceTypesLists := map[string][]runtime.Object{
+			"v1/Pod(related)": {
+				&unstructured.Unstructured{
+					Object: map[string]any{
+						"apiVersion": "v1",
+						"kind":       "Pod",
+						"metadata": map[string]any{
+							"name":      "test-pod-1",
+							"namespace": "default",
+						},
+						"status": map[string]any{
+							"phase": "Pending",
+						},
+					},
+				},
+				&unstructured.Unstructured{
+					Object: map[string]any{
+						"apiVersion": "v1",
+						"kind":       "Pod",
+						"metadata": map[string]any{
+							"name":      "test-pod-2",
+							"namespace": "default",
+						},
+						"status": map[string]any{
+							"phase": "Error",
+						},
+					},
+				},
+			},
+		}
+
+		got, err := parseResources(resourceTypesLists)
+		require.NoError(t, err)
+		assert.Len(t, got, 2)
+
+		// Check first resource
+		assert.Equal(t, "test-pod-1", got[0].GetName())
+		statusMap1, found, _ := unstructured.NestedMap(got[0].Object, "status")
+		assert.True(t, found)
+		assert.Equal(t, "Pending", statusMap1["phase"])
+
+		healthSummary1, found, _ := unstructured.NestedMap(statusMap1, "healthSummary")
+		assert.True(t, found)
+		assert.Equal(t, Progressing, healthSummary1["status"])
+		assert.Equal(t, "Pending", healthSummary1["reason"])
+
+		// Check second resource
+		assert.Equal(t, "test-pod-2", got[1].GetName())
+		statusMap2, found, _ := unstructured.NestedMap(got[1].Object, "status")
+		assert.True(t, found)
+		healthSummary2, found, _ := unstructured.NestedMap(statusMap2, "healthSummary")
+		assert.True(t, found)
+		assert.Equal(t, Unhealthy, healthSummary2["status"])
+		assert.Equal(t, "Error", healthSummary2["reason"])
+	})
+}
+
+func TestEnhanceStatus(t *testing.T) {
+	t.Parallel()
+	t.Run("healthy running pod", func(t *testing.T) {
+		// Create a ResourceStatus object
+		status := &ResourceStatus{
+			Phase: "Failed",
+		}
+
+		conditions := []metav1.Condition{}
+
+		result := summarizeStatus(status, conditions, "test-pod", "default", nil)
+
+		assert.Equal(t, Unhealthy, result.HealthSummary.Status)
+		assert.Equal(t, "Failed", result.HealthSummary.Reason)
+	})
+
+	t.Run("unhealthy pod with error", func(t *testing.T) {
+		// Create a ResourceStatus object
+		status := &ResourceStatus{
+			Phase: "Error",
+		}
+
+		conditions := []metav1.Condition{
+			{
+				Type:   "DisruptionAllowed",
+				Status: metav1.ConditionFalse,
+				Reason: "InsufficientPods",
+			},
+		}
+
+		result := summarizeStatus(status, conditions, "test-pod", "default", nil)
+
+		assert.Equal(t, Unhealthy, result.HealthSummary.Status)
+		assert.Equal(t, "Error", result.HealthSummary.Reason)
+	})
+}
diff --git a/pkg/libhelm/sdk/rollback.go b/pkg/libhelm/sdk/rollback.go
new file mode 100644
index 0000000..5af2ea2
--- /dev/null
+++ b/pkg/libhelm/sdk/rollback.go
@@ -0,0 +1,126 @@
+package sdk
+
+import (
+	"time"
+
+	"github.com/pkg/errors"
+	"github.com/portainer/portainer/pkg/libhelm/options"
+	"github.com/portainer/portainer/pkg/libhelm/release"
+	"github.com/rs/zerolog/log"
+	"helm.sh/helm/v4/pkg/action"
+	"helm.sh/helm/v4/pkg/kube"
+)
+
+// Rollback would implement the HelmPackageManager interface by using the Helm SDK to rollback a release to a previous revision.
+func (hspm *HelmSDKPackageManager) Rollback(rollbackOpts options.RollbackOptions) (*release.Release, error) {
+	log.Debug().
+		Str("context", "HelmClient").
+		Str("name", rollbackOpts.Name).
+		Str("namespace", rollbackOpts.Namespace).
+		Int("revision", rollbackOpts.Version).
+		Bool("wait", rollbackOpts.Wait).
+		Msg("Rolling back Helm release")
+
+	if rollbackOpts.Name == "" {
+		log.Error().
+			Str("context", "HelmClient").
+			Msg("Name is required for helm release rollback")
+		return nil, errors.New("name is required for helm release rollback")
+	}
+
+	// Initialize action configuration with kubernetes config
+	actionConfig := new(action.Configuration)
+	err := hspm.initActionConfig(actionConfig, rollbackOpts.Namespace, rollbackOpts.KubernetesClusterAccess)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to initialize helm configuration for helm release rollback")
+	}
+
+	rollbackClient := initRollbackClient(actionConfig, rollbackOpts)
+
+	// Run the rollback
+	err = rollbackClient.Run(rollbackOpts.Name)
+	if err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Str("name", rollbackOpts.Name).
+			Str("namespace", rollbackOpts.Namespace).
+			Int("revision", rollbackOpts.Version).
+			Err(err).
+			Msg("Failed to rollback helm release")
+		return nil, errors.Wrap(err, "helm was not able to rollback the release")
+	}
+
+	// Get the release info after rollback
+	statusClient := action.NewStatus(actionConfig)
+	rel, err := statusClient.Run(rollbackOpts.Name)
+	if err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Str("name", rollbackOpts.Name).
+			Str("namespace", rollbackOpts.Namespace).
+			Int("revision", rollbackOpts.Version).
+			Err(err).
+			Msg("Failed to get status after rollback")
+		return nil, errors.Wrap(err, "failed to get status after rollback")
+	}
+	releaseV1, err := releaserToV1Release(rel)
+	if err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Str("name", rollbackOpts.Name).
+			Str("namespace", rollbackOpts.Namespace).
+			Int("revision", rollbackOpts.Version).
+			Err(err).
+			Msg("Failed to convert release to v1 after rollback")
+		return nil, errors.Wrap(err, "failed to convert release to v1 after rollback")
+	}
+
+	return &release.Release{
+		Name:      releaseV1.Name,
+		Namespace: releaseV1.Namespace,
+		Version:   releaseV1.Version,
+		Info: &release.Info{
+			Status:      release.Status(releaseV1.Info.Status),
+			Notes:       releaseV1.Info.Notes,
+			Description: releaseV1.Info.Description,
+		},
+		Manifest: releaseV1.Manifest,
+		Chart: release.Chart{
+			Metadata: &release.Metadata{
+				Name:       releaseV1.Chart.Metadata.Name,
+				Version:    releaseV1.Chart.Metadata.Version,
+				AppVersion: releaseV1.Chart.Metadata.AppVersion,
+			},
+		},
+		Labels: releaseV1.Labels,
+	}, nil
+}
+
+// initRollbackClient initializes the rollback client with the given options
+// and returns the rollback client.
+func initRollbackClient(actionConfig *action.Configuration, rollbackOpts options.RollbackOptions) *action.Rollback {
+	rollbackClient := action.NewRollback(actionConfig)
+
+	// Set version to rollback to (if specified)
+	if rollbackOpts.Version > 0 {
+		rollbackClient.Version = rollbackOpts.Version
+	}
+
+	if rollbackOpts.Wait {
+		rollbackClient.WaitStrategy = kube.StatusWatcherStrategy
+	} else {
+		rollbackClient.WaitStrategy = kube.HookOnlyStrategy
+	}
+	rollbackClient.WaitForJobs = rollbackOpts.WaitForJobs
+	rollbackClient.CleanupOnFail = true // Sane default to clean up on failure
+	rollbackClient.ForceReplace = rollbackOpts.Force
+	rollbackClient.ServerSideApply = "auto"
+	// Set default values if not specified
+	if rollbackOpts.Timeout == 0 {
+		rollbackClient.Timeout = 5 * time.Minute // Sane default of 5 minutes
+	} else {
+		rollbackClient.Timeout = rollbackOpts.Timeout
+	}
+
+	return rollbackClient
+}
diff --git a/pkg/libhelm/sdk/rollback_test.go b/pkg/libhelm/sdk/rollback_test.go
new file mode 100644
index 0000000..3ded433
--- /dev/null
+++ b/pkg/libhelm/sdk/rollback_test.go
@@ -0,0 +1,125 @@
+package sdk
+
+import (
+	"testing"
+
+	"github.com/portainer/portainer/pkg/libhelm/options"
+	"github.com/portainer/portainer/pkg/libhelm/test"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestRollback(t *testing.T) {
+	t.Parallel()
+	test.EnsureIntegrationTest(t)
+	is := assert.New(t)
+
+	// Create a new SDK package manager
+	hspm := NewHelmSDKPackageManager()
+
+	t.Run("should return error when name is not provided", func(t *testing.T) {
+		rollbackOpts := options.RollbackOptions{
+			Namespace: "default",
+		}
+
+		_, err := hspm.Rollback(rollbackOpts)
+
+		require.Error(t, err, "should return an error when name is not provided")
+		is.Equal("name is required for helm release rollback", err.Error(), "should return correct error message")
+	})
+
+	t.Run("should return error when release doesn't exist", func(t *testing.T) {
+		rollbackOpts := options.RollbackOptions{
+			Name:      "non-existent-release",
+			Namespace: "default",
+		}
+
+		_, err := hspm.Rollback(rollbackOpts)
+
+		require.Error(t, err, "should return an error when release doesn't exist")
+	})
+
+	t.Run("should successfully rollback to previous revision", func(t *testing.T) {
+		// First install a release
+		installOpts := options.InstallOptions{
+			Name:      "hello-world",
+			Chart:     "hello-world",
+			Namespace: "default",
+			Repo:      "https://helm.github.io/examples",
+		}
+
+		// Ensure the release doesn't exist before test
+		err := hspm.Uninstall(options.UninstallOptions{Name: installOpts.Name})
+		require.NoError(t, err)
+
+		// Install first version
+		release, err := hspm.Upgrade(installOpts)
+		require.NoError(t, err, "should successfully install release")
+		is.Equal(1, release.Version, "first version should be 1")
+
+		// Upgrade to second version
+		_, err = hspm.Upgrade(installOpts)
+		require.NoError(t, err, "should successfully upgrade release")
+
+		// Rollback to first version
+		rollbackOpts := options.RollbackOptions{
+			Name:      installOpts.Name,
+			Namespace: "default",
+			Version:   0, // Previous revision
+		}
+
+		rolledBackRelease, err := hspm.Rollback(rollbackOpts)
+		defer func() {
+			err := hspm.Uninstall(options.UninstallOptions{Name: installOpts.Name})
+			require.NoError(t, err)
+		}()
+
+		require.NoError(t, err, "should successfully rollback release")
+		is.NotNil(rolledBackRelease, "should return non-nil release")
+		is.Equal(3, rolledBackRelease.Version, "version should be incremented to 3")
+	})
+
+	t.Run("should successfully rollback to specific revision", func(t *testing.T) {
+		// First install a release
+		installOpts := options.InstallOptions{
+			Name:      "hello-world",
+			Chart:     "hello-world",
+			Namespace: "default",
+			Repo:      "https://helm.github.io/examples",
+		}
+
+		// Ensure the release doesn't exist before test
+		err := hspm.Uninstall(options.UninstallOptions{Name: installOpts.Name})
+		require.NoError(t, err)
+
+		// Install first version
+		release, err := hspm.Upgrade(installOpts)
+		require.NoError(t, err, "should successfully install release")
+		is.Equal(1, release.Version, "first version should be 1")
+
+		// Upgrade to second version
+		_, err = hspm.Upgrade(installOpts)
+		require.NoError(t, err, "should successfully upgrade release")
+
+		// Upgrade to third version
+		_, err = hspm.Upgrade(installOpts)
+		require.NoError(t, err, "should successfully upgrade release again")
+
+		// Rollback to first version
+		rollbackOpts := options.RollbackOptions{
+			Name:      installOpts.Name,
+			Namespace: "default",
+			Version:   1, // Specific revision
+		}
+
+		rolledBackRelease, err := hspm.Rollback(rollbackOpts)
+		defer func() {
+			err := hspm.Uninstall(options.UninstallOptions{Name: installOpts.Name})
+			require.NoError(t, err)
+		}()
+
+		require.NoError(t, err, "should successfully rollback to specific revision")
+		is.NotNil(rolledBackRelease, "should return non-nil release")
+		is.Equal(4, rolledBackRelease.Version, "version should be incremented to 4")
+	})
+}
diff --git a/pkg/libhelm/sdk/search_repo.go b/pkg/libhelm/sdk/search_repo.go
new file mode 100644
index 0000000..506b754
--- /dev/null
+++ b/pkg/libhelm/sdk/search_repo.go
@@ -0,0 +1,530 @@
+package sdk
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	"github.com/pkg/errors"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/logs"
+	"github.com/portainer/portainer/pkg/libhelm/options"
+	"github.com/portainer/portainer/pkg/libhttp/ssrf"
+	"github.com/portainer/portainer/pkg/liboras"
+	"github.com/rs/zerolog/log"
+	"github.com/segmentio/encoding/json"
+	chart "helm.sh/helm/v4/pkg/chart/v2"
+	"helm.sh/helm/v4/pkg/cli"
+	"helm.sh/helm/v4/pkg/getter"
+	repo "helm.sh/helm/v4/pkg/repo/v1"
+	"oras.land/oras-go/v2/registry"
+)
+
+var (
+	errRequiredSearchOptions = errors.New("repo is required")
+)
+
+type RepoIndex struct {
+	APIVersion string                 `json:"apiVersion"`
+	Entries    map[string][]ChartInfo `json:"entries"`
+	Generated  string                 `json:"generated"`
+}
+
+type RepoIndexCache struct {
+	Index     *repo.IndexFile
+	Timestamp time.Time
+}
+
+var (
+	indexCache    = make(map[string]RepoIndexCache)
+	cacheMutex    sync.RWMutex
+	cacheDuration = 60 * time.Minute
+)
+
+// SearchRepo downloads the `index.yaml` file for specified repo, parses it and returns JSON to caller.
+func (hspm *HelmSDKPackageManager) SearchRepo(searchRepoOpts options.SearchRepoOptions) ([]byte, error) {
+	if err := validateSearchRepoOptions(searchRepoOpts); err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Str("repo", searchRepoOpts.Repo).
+			Err(err).
+			Msg("Missing required search repo options")
+		return nil, err
+	}
+
+	log.Debug().
+		Str("context", "HelmClient").
+		Str("repo", searchRepoOpts.Repo).
+		Msg("Searching repository")
+
+	// Set up Helm CLI environment
+	repoSettings := cli.New()
+	if err := ensureHelmDirectoriesExist(repoSettings); err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Err(err).
+			Msg("Failed to ensure Helm directories exist")
+		return nil, errors.Wrap(err, "failed to ensure Helm directories exist")
+	}
+
+	// Try cache first for HTTP repos
+	if IsHTTPRepository(searchRepoOpts.Registry) && searchRepoOpts.UseCache {
+		if cachedResult := hspm.tryGetFromCache(searchRepoOpts.Repo, searchRepoOpts.Chart); cachedResult != nil {
+			return cachedResult, nil
+		}
+	}
+
+	// Download index based on source type
+	indexFile, err := hspm.downloadRepoIndex(searchRepoOpts, repoSettings)
+	if err != nil {
+		return nil, err
+	}
+
+	// Update cache for HTTP repos
+	if IsHTTPRepository(searchRepoOpts.Registry) {
+		UpdateCache(searchRepoOpts.Repo, indexFile)
+	}
+
+	return convertAndMarshalIndex(indexFile, searchRepoOpts.Chart)
+}
+
+// tryGetFromCache attempts to retrieve a cached index file and convert it to the response format
+func (hspm *HelmSDKPackageManager) tryGetFromCache(repoURL, chartName string) []byte {
+	cacheMutex.RLock()
+	defer cacheMutex.RUnlock()
+
+	if cached, exists := indexCache[repoURL]; exists {
+		if time.Since(cached.Timestamp) < cacheDuration {
+			result, err := convertAndMarshalIndex(cached.Index, chartName)
+			if err != nil {
+				log.Debug().
+					Str("context", "HelmClient").
+					Str("repo", repoURL).
+					Err(err).
+					Msg("Failed to convert cached index")
+				return nil
+			}
+			return result
+		}
+	}
+	return nil
+}
+
+// updateCache updates the cache with the provided index file and cleans up expired entries
+func UpdateCache(repoURL string, indexFile *repo.IndexFile) {
+	cacheMutex.Lock()
+	defer cacheMutex.Unlock()
+
+	indexCache[repoURL] = RepoIndexCache{
+		Index:     indexFile,
+		Timestamp: time.Now(),
+	}
+
+	// Clean up expired entries
+	for key, index := range indexCache {
+		if time.Since(index.Timestamp) > cacheDuration {
+			delete(indexCache, key)
+		}
+	}
+}
+
+// downloadRepoIndex downloads the repository index based on the source type (HTTP or OCI)
+func (hspm *HelmSDKPackageManager) downloadRepoIndex(opts options.SearchRepoOptions, repoSettings *cli.EnvSettings) (*repo.IndexFile, error) {
+	if IsOCIRegistry(opts.Registry) {
+		return hspm.downloadOCIRepoIndex(opts.Registry, repoSettings, opts.Chart)
+	}
+	return hspm.downloadHTTPRepoIndex(opts.Repo, repoSettings)
+}
+
+// downloadHTTPRepoIndex downloads and loads an index file from an HTTP repository
+func (hspm *HelmSDKPackageManager) downloadHTTPRepoIndex(repoURL string, repoSettings *cli.EnvSettings) (*repo.IndexFile, error) {
+	parsedURL, err := parseRepoURL(repoURL)
+	if err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Str("repo", repoURL).
+			Err(err).
+			Msg("Invalid repository URL")
+		return nil, err
+	}
+
+	repoName, err := GetRepoNameFromURL(parsedURL.String())
+	if err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Err(err).
+			Msg("Failed to get hostname from URL")
+		return nil, err
+	}
+
+	indexPath, err := downloadRepoIndexFromHttpRepo(parsedURL.String(), repoSettings, repoName)
+	if err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Str("repo_url", parsedURL.String()).
+			Err(err).
+			Msg("Failed to download repository index")
+		return nil, err
+	}
+
+	return loadIndexFile(indexPath)
+}
+
+// downloadOCIRepoIndex downloads and loads an index file from an OCI registry
+func (hspm *HelmSDKPackageManager) downloadOCIRepoIndex(registry *portainer.Registry, repoSettings *cli.EnvSettings, chartPath string) (*repo.IndexFile, error) {
+	// Validate registry credentials first
+	if err := validateRegistryCredentials(registry); err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Str("repo", registry.URL).
+			Err(err).
+			Msg("Registry credential validation failed for OCI search")
+		return nil, fmt.Errorf("registry credential validation failed: %w", err)
+	}
+
+	indexPath, err := downloadRepoIndexFromOciRegistry(registry, repoSettings, chartPath)
+	if err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Str("repo", registry.URL).
+			Err(err).
+			Msg("Failed to download repository index")
+		return nil, err
+	}
+
+	return loadIndexFile(indexPath)
+}
+
+// validateSearchRepoOptions validates the required search repository options.
+func validateSearchRepoOptions(opts options.SearchRepoOptions) error {
+	if opts.Repo == "" && IsHTTPRepository(opts.Registry) {
+		return errRequiredSearchOptions
+	}
+	return nil
+}
+
+// downloadRepoIndexFromHttpRepo downloads the index.yaml file from the repository and updates
+// the repository configuration.
+func downloadRepoIndexFromHttpRepo(repoURLString string, repoSettings *cli.EnvSettings, repoName string) (string, error) {
+	log.Debug().
+		Str("context", "helm_sdk_repo_index").
+		Str("repo_url", repoURLString).
+		Str("repo_name", repoName).
+		Msg("Creating chart repository object")
+
+	ssrfTransport := ssrf.NewTransport(nil)
+
+	// Create chart repository object
+	rep, err := repo.NewChartRepository(
+		&repo.Entry{
+			Name: repoName,
+			URL:  repoURLString,
+		},
+		getter.All(repoSettings, getter.WithTransport(ssrfTransport)),
+	)
+	if err != nil {
+		log.Error().
+			Str("context", "helm_sdk_repo_index").
+			Str("repo_url", repoURLString).
+			Err(err).
+			Msg("Failed to create chart repository object")
+		return "", errors.New("the request failed since either the Helm repository was not found or the index.yaml is not valid")
+	}
+
+	// Load repository configuration file
+	f, err := repo.LoadFile(repoSettings.RepositoryConfig)
+	if err != nil {
+		log.Error().
+			Str("context", "helm_sdk_repo_index").
+			Str("repo_config", repoSettings.RepositoryConfig).
+			Err(err).
+			Msg("Failed to load repo config")
+		return "", errors.Wrap(err, "failed to load repo config")
+	}
+
+	// Download the index file
+	log.Debug().
+		Str("context", "helm_sdk_repo_index").
+		Str("repo_url", repoURLString).
+		Msg("Downloading index file")
+
+	indexPath, err := rep.DownloadIndexFile()
+	if err != nil {
+		log.Error().
+			Str("context", "helm_sdk_repo_index").
+			Str("repo_url", repoURLString).
+			Err(err).
+			Msg("Failed to download index file")
+		return "", errors.Wrapf(err, "looks like %q is not a valid chart repository or cannot be reached", repoURLString)
+	}
+
+	// Update repository configuration
+	c := repo.Entry{
+		Name: repoName,
+		URL:  repoURLString,
+	}
+	f.Update(&c)
+
+	// Write updated configuration
+	repoFile := repoSettings.RepositoryConfig
+	if err := f.WriteFile(repoFile, 0644); err != nil {
+		log.Error().
+			Str("context", "helm_sdk_repo_index").
+			Str("repo_file", repoSettings.RepositoryConfig).
+			Err(err).
+			Msg("Failed to write repository configuration")
+		return "", errors.Wrap(err, "failed to write repository configuration")
+	}
+
+	log.Debug().
+		Str("context", "helm_sdk_repo_index").
+		Str("index_path", indexPath).
+		Msg("Successfully downloaded index file")
+
+	return indexPath, nil
+}
+
+func downloadRepoIndexFromOciRegistry(registry *portainer.Registry, repoSettings *cli.EnvSettings, chartPath string) (string, error) {
+	if IsHTTPRepository(registry) {
+		return "", errors.New("registry information is required for OCI search")
+	}
+
+	if chartPath == "" {
+		return "", errors.New("chart path is required for OCI search")
+	}
+
+	ctx := context.Background()
+
+	registryClient, err := liboras.CreateClient(*registry)
+	if err != nil {
+		log.Error().
+			Str("context", "helm_sdk_repo_index_oci").
+			Str("registry_url", registry.URL).
+			Err(err).
+			Msg("Failed to create ORAS registry client")
+		return "", errors.Wrap(err, "failed to create ORAS registry client")
+	}
+
+	// Obtain repository handle for the specific chart path (relative to registry host)
+	repository, err := registryClient.Repository(ctx, chartPath)
+	if err != nil {
+		log.Error().
+			Str("context", "helm_sdk_repo_index_oci").
+			Str("repository", chartPath).
+			Err(err).
+			Msg("Failed to obtain repository handle")
+		return "", errors.Wrap(err, "failed to obtain repository handle")
+	}
+
+	// List all tags for this chart repository
+	var tags []string
+	err = repository.Tags(ctx, "", func(t []string) error {
+		tags = append(tags, t...)
+		return nil
+	})
+	if err != nil {
+		log.Error().
+			Str("context", "helm_sdk_repo_index_oci").
+			Str("repository", chartPath).
+			Err(err).
+			Msg("Failed to list tags")
+		return "", errors.Wrap(err, "failed to list tags for repository")
+	}
+
+	if len(tags) == 0 {
+		return "", errors.Errorf("no tags found for repository %s", chartPath)
+	}
+
+	// Build Helm index file in memory
+	indexFile := repo.NewIndexFile()
+
+	const helmConfigMediaType = "application/vnd.cncf.helm.config.v1+json"
+
+	for _, tag := range tags {
+		chartVersion, err := processOCITag(ctx, repository, registry, chartPath, tag, helmConfigMediaType)
+		if err != nil {
+			log.Debug().
+				Str("context", "helm_sdk_repo_index_oci").
+				Str("repository", chartPath).
+				Str("tag", tag).
+				Err(err).
+				Msg("Failed to process tag; skipping")
+			continue
+		}
+
+		if chartVersion != nil {
+			indexFile.Entries[chartVersion.Name] = append(indexFile.Entries[chartVersion.Name], chartVersion)
+		}
+	}
+
+	if len(indexFile.Entries) == 0 {
+		return "", errors.Errorf("no helm chart versions found for repository %s", chartPath)
+	}
+
+	indexFile.SortEntries()
+
+	fileNameSafe := strings.ReplaceAll(chartPath, "/", "-")
+	destPath := filepath.Join(repoSettings.RepositoryCache, fmt.Sprintf("%s-%d-index.yaml", fileNameSafe, time.Now().UnixNano()))
+
+	if err := indexFile.WriteFile(destPath, 0644); err != nil {
+		return "", errors.Wrap(err, "failed to write OCI index file")
+	}
+
+	log.Debug().
+		Str("context", "helm_sdk_repo_index_oci").
+		Str("dest_path", destPath).
+		Int("entries", len(indexFile.Entries)).
+		Msg("Successfully generated OCI index file")
+
+	return destPath, nil
+}
+
+// processOCITag processes a single OCI tag and returns a Helm chart version.
+func processOCITag(ctx context.Context, repository registry.Repository, registry *portainer.Registry, chartPath string, tag string, helmConfigMediaType string) (*repo.ChartVersion, error) {
+	// Resolve tag to get descriptor
+	descriptor, err := repository.Resolve(ctx, tag)
+	if err != nil {
+		log.Debug().
+			Str("context", "helm_sdk_repo_index_oci").
+			Str("repository", chartPath).
+			Str("tag", tag).
+			Err(err).
+			Msg("Failed to resolve tag; skipping")
+		return nil, nil
+	}
+
+	// Fetch manifest to validate media type and obtain config descriptor
+	manifestReader, err := repository.Manifests().Fetch(ctx, descriptor)
+	if err != nil {
+		log.Debug().
+			Str("context", "helm_sdk_repo_index_oci").
+			Str("repository", chartPath).
+			Str("tag", tag).
+			Err(err).
+			Msg("Failed to fetch manifest; skipping")
+		return nil, nil
+	}
+
+	manifestContent, err := io.ReadAll(manifestReader)
+	logs.CloseAndLogErr(manifestReader)
+	if err != nil {
+		return nil, nil
+	}
+
+	var manifest ocispec.Manifest
+	if err := json.Unmarshal(manifestContent, &manifest); err != nil {
+		return nil, nil
+	}
+
+	// Ensure manifest config is Helm chart metadata
+	if manifest.Config.MediaType != helmConfigMediaType {
+		return nil, nil
+	}
+
+	// Fetch config blob (chart metadata)
+	cfgReader, err := repository.Blobs().Fetch(ctx, manifest.Config)
+	if err != nil {
+		return nil, nil
+	}
+	cfgBytes, err := io.ReadAll(cfgReader)
+	logs.CloseAndLogErr(cfgReader)
+	if err != nil {
+		return nil, nil
+	}
+
+	var metadata chart.Metadata
+	if err := json.Unmarshal(cfgBytes, &metadata); err != nil {
+		return nil, nil
+	}
+
+	// Build chart version entry
+	chartVersion := &repo.ChartVersion{
+		Metadata: &metadata,
+		URLs:     []string{fmt.Sprintf("oci://%s/%s:%s", registry.URL, chartPath, tag)},
+		Created:  time.Now(),
+		Digest:   descriptor.Digest.String(),
+	}
+
+	return chartVersion, nil
+}
+
+// convertIndexToResponse converts the Helm index file to our response format.
+func convertIndexToResponse(indexFile *repo.IndexFile, chartName string) (RepoIndex, error) {
+	result := RepoIndex{
+		APIVersion: indexFile.APIVersion,
+		Entries:    make(map[string][]ChartInfo),
+		Generated:  indexFile.Generated.String(),
+	}
+
+	// Convert Helm SDK types to our response types
+	for name, charts := range indexFile.Entries {
+		if chartName == "" || strings.Contains(strings.ToLower(chartName), strings.ToLower(name)) {
+			result.Entries[name] = convertChartsToChartInfo(charts)
+		}
+	}
+
+	return result, nil
+}
+
+// convertChartsToChartInfo converts Helm chart entries to ChartInfo objects.
+func convertChartsToChartInfo(charts []*repo.ChartVersion) []ChartInfo {
+	chartInfos := make([]ChartInfo, len(charts))
+	for i, chart := range charts {
+		chartInfos[i] = ChartInfo{
+			Name:        chart.Name,
+			Version:     chart.Version,
+			AppVersion:  chart.AppVersion,
+			Description: chart.Description,
+			Deprecated:  chart.Deprecated,
+			Created:     chart.Created.String(),
+			Digest:      chart.Digest,
+			Home:        chart.Home,
+			Sources:     chart.Sources,
+			URLs:        chart.URLs,
+			Icon:        chart.Icon,
+			Annotations: chart.Annotations,
+		}
+	}
+	return chartInfos
+}
+
+// ChartInfo represents a Helm chart in the repository index
+type ChartInfo struct {
+	Name        string   `json:"name"`
+	Version     string   `json:"version"`
+	AppVersion  string   `json:"appVersion"`
+	Description string   `json:"description"`
+	Deprecated  bool     `json:"deprecated"`
+	Created     string   `json:"created"`
+	Digest      string   `json:"digest"`
+	Home        string   `json:"home"`
+	Sources     []string `json:"sources"`
+	URLs        []string `json:"urls"`
+	Icon        string   `json:"icon,omitempty"`
+	Annotations any      `json:"annotations,omitempty"`
+}
+
+func convertAndMarshalIndex(indexFile *repo.IndexFile, chartName string) ([]byte, error) {
+	// Convert the index file to our response format
+	result, err := convertIndexToResponse(indexFile, chartName)
+	if err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Err(err).
+			Msg("Failed to convert index to response format")
+		return nil, errors.Wrap(err, "failed to convert index to response format")
+	}
+
+	log.Debug().
+		Str("context", "HelmClient").
+		Str("repo", chartName).
+		Int("entries_count", len(indexFile.Entries)).
+		Msg("Successfully searched repository")
+
+	return json.Marshal(result)
+}
diff --git a/pkg/libhelm/sdk/search_repo_test.go b/pkg/libhelm/sdk/search_repo_test.go
new file mode 100644
index 0000000..0f7c4bc
--- /dev/null
+++ b/pkg/libhelm/sdk/search_repo_test.go
@@ -0,0 +1,86 @@
+package sdk
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/portainer/portainer/pkg/libhelm/options"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type testCase struct {
+	name    string
+	url     string
+	invalid bool
+}
+
+var tests = []testCase{
+	{"not a helm repo", "https://portainer.io", true},
+	{"ingress helm repo", "https://kubernetes.github.io/ingress-nginx", false},
+	{"portainer helm repo", "https://portainer.github.io/k8s/", false},
+	{"elastic helm repo with trailing slash", "https://helm.elastic.co/", false},
+}
+
+func Test_SearchRepo(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	// Create a new SDK package manager
+	hspm := NewHelmSDKPackageManager()
+
+	for _, test := range tests {
+		func(tc testCase) {
+			t.Run(tc.name, func(t *testing.T) {
+				t.Parallel()
+				response, err := hspm.SearchRepo(options.SearchRepoOptions{Repo: tc.url})
+				if tc.invalid {
+					require.Error(t, err, "error expected: %s", tc.url)
+				} else {
+					require.NoError(t, err, "no error expected: %s", tc.url)
+				}
+
+				if err == nil {
+					is.NotEmpty(response, "response expected")
+				}
+			})
+		}(test)
+	}
+
+	t.Run("search repo with keyword", func(t *testing.T) {
+		// Search for charts with keyword
+		searchOpts := options.SearchRepoOptions{
+			Repo: "https://kubernetes.github.io/ingress-nginx",
+		}
+		responseBytes, err := hspm.SearchRepo(searchOpts)
+
+		// The function should not fail by design, even when not running in a k8s environment
+		require.NoError(t, err, "should not return error when not in k8s environment")
+		is.NotNil(responseBytes, "should return non-nil response")
+		is.NotEmpty(responseBytes, "should return non-empty response")
+
+		// Parse the 	ext response
+		var repoIndex RepoIndex
+		err = json.Unmarshal(responseBytes, &repoIndex)
+		require.NoError(t, err, "should parse JSON response without error")
+		is.NotEmpty(repoIndex, "should have at least one chart")
+
+		// Verify charts structure apiVersion, entries, generated
+		is.Equal("v1", repoIndex.APIVersion, "apiVersion should be v1")
+		is.NotEmpty(repoIndex.Entries, "entries should not be empty")
+		is.NotEmpty(repoIndex.Generated, "generated should not be empty")
+
+		// there should be at least one chart
+		is.NotEmpty(repoIndex.Entries, "should have at least one chart")
+	})
+
+	t.Run("search repo with empty repo URL", func(t *testing.T) {
+		// Search with empty repo URL
+		searchOpts := options.SearchRepoOptions{
+			Repo: "",
+		}
+		_, err := hspm.SearchRepo(searchOpts)
+		require.Error(t, err, "should return error when repo URL is empty")
+	})
+}
diff --git a/pkg/libhelm/sdk/show.go b/pkg/libhelm/sdk/show.go
new file mode 100644
index 0000000..0536ad6
--- /dev/null
+++ b/pkg/libhelm/sdk/show.go
@@ -0,0 +1,133 @@
+package sdk
+
+import (
+	"fmt"
+
+	"github.com/pkg/errors"
+	"github.com/portainer/portainer/pkg/libhelm/cache"
+	"github.com/portainer/portainer/pkg/libhelm/options"
+	"github.com/rs/zerolog/log"
+	"helm.sh/helm/v4/pkg/action"
+)
+
+var errRequiredShowOptions = errors.New("chart, output format and either repo or registry are required")
+
+// Show implements the HelmPackageManager interface by using the Helm SDK to show chart information.
+// It supports showing chart values, readme, and chart details based on the provided ShowOptions.
+func (hspm *HelmSDKPackageManager) Show(showOpts options.ShowOptions) ([]byte, error) {
+	if showOpts.Chart == "" || (showOpts.Repo == "" && IsHTTPRepository(showOpts.Registry)) || showOpts.OutputFormat == "" {
+		log.Error().
+			Str("context", "HelmClient").
+			Str("chart", showOpts.Chart).
+			Str("repo", showOpts.Repo).
+			Str("output_format", string(showOpts.OutputFormat)).
+			Msg("Missing required show options")
+		return nil, errRequiredShowOptions
+	}
+
+	log.Debug().
+		Str("context", "HelmClient").
+		Str("chart", showOpts.Chart).
+		Str("repo", showOpts.Repo).
+		Str("output_format", string(showOpts.OutputFormat)).
+		Msg("Showing chart information")
+
+	actionConfig := new(action.Configuration)
+	err := authenticateChartSource(actionConfig, showOpts.Registry)
+	if err != nil {
+		return nil, fmt.Errorf("failed to setup chart source: %w", err)
+	}
+
+	// Create showClient action
+	showClient, err := initShowClient(actionConfig, showOpts)
+	if err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Err(err).
+			Msg("Failed to initialize helm show client")
+		return nil, fmt.Errorf("failed to initialize helm show client: %w", err)
+	}
+
+	chartRef, _, err := parseChartRef(showOpts.Chart, showOpts.Repo, showOpts.Registry)
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse chart reference: %w", err)
+	}
+	chartPath, err := showClient.LocateChart(chartRef, hspm.settings)
+	if err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Str("chart", chartRef).
+			Str("repo", showOpts.Repo).
+			Err(err).
+			Msg("Failed to locate chart")
+
+		// Check if this is an authentication error and flush cache if needed
+		if showOpts.Registry != nil && shouldFlushCacheOnError(err, showOpts.Registry.ID) {
+			cache.FlushRegistryByID(showOpts.Registry.ID)
+			log.Info().
+				Int("registry_id", int(showOpts.Registry.ID)).
+				Str("context", "HelmClient").
+				Msg("Flushed registry cache due to chart registry authentication error")
+		}
+
+		return nil, fmt.Errorf("failed to locate chart: %w", err)
+	}
+
+	// Get the output based on the requested format
+	output, err := showClient.Run(chartPath)
+	if err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Str("chart_path", chartPath).
+			Str("output_format", string(showOpts.OutputFormat)).
+			Err(err).
+			Msg("Failed to show chart info")
+
+		// Check if this is an authentication error and flush cache if needed
+		if showOpts.Registry != nil && shouldFlushCacheOnError(err, showOpts.Registry.ID) {
+			cache.FlushRegistryByID(showOpts.Registry.ID)
+			log.Info().
+				Int("registry_id", int(showOpts.Registry.ID)).
+				Str("context", "HelmClient").
+				Msg("Flushed registry cache due to chart show authentication error")
+		}
+
+		return nil, fmt.Errorf("failed to show chart info: %w", err)
+	}
+
+	log.Debug().
+		Str("context", "HelmClient").
+		Str("chart", showOpts.Chart).
+		Int("output_size", len(output)).
+		Msg("Successfully retrieved chart information")
+
+	return []byte(output), nil
+}
+
+// initShowClient initializes the show client with the given options
+// and return the show client.
+func initShowClient(actionConfig *action.Configuration, showOpts options.ShowOptions) (*action.Show, error) {
+	showClient := action.NewShow(action.ShowAll, actionConfig)
+	err := configureChartPathOptions(&showClient.ChartPathOptions, showOpts.Version, showOpts.Repo, showOpts.Registry)
+	if err != nil {
+		return nil, fmt.Errorf("failed to configure chart path options: %w", err)
+	}
+
+	// Set output type based on ShowOptions
+	switch showOpts.OutputFormat {
+	case options.ShowChart:
+		showClient.OutputFormat = action.ShowChart
+	case options.ShowValues:
+		showClient.OutputFormat = action.ShowValues
+	case options.ShowReadme:
+		showClient.OutputFormat = action.ShowReadme
+	default:
+		log.Error().
+			Str("context", "HelmClient").
+			Str("output_format", string(showOpts.OutputFormat)).
+			Msg("Unsupported output format")
+		return nil, fmt.Errorf("unsupported output format: %s", showOpts.OutputFormat)
+	}
+
+	return showClient, nil
+}
diff --git a/pkg/libhelm/sdk/show_test.go b/pkg/libhelm/sdk/show_test.go
new file mode 100644
index 0000000..3c9de0d
--- /dev/null
+++ b/pkg/libhelm/sdk/show_test.go
@@ -0,0 +1,105 @@
+package sdk
+
+import (
+	"testing"
+
+	"github.com/portainer/portainer/pkg/libhelm/options"
+	"github.com/portainer/portainer/pkg/libhelm/test"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_Show(t *testing.T) {
+	t.Parallel()
+	test.EnsureIntegrationTest(t)
+	is := assert.New(t)
+
+	// Create a new SDK package manager
+	hspm := NewHelmSDKPackageManager()
+
+	// install the ingress-nginx chart to test the show command
+	installOpts := options.InstallOptions{
+		Name:  "ingress-nginx",
+		Chart: "ingress-nginx",
+		Repo:  "https://kubernetes.github.io/ingress-nginx",
+	}
+	release, err := hspm.Upgrade(installOpts)
+	if release != nil || err != nil {
+		defer func() {
+			err := hspm.Uninstall(options.UninstallOptions{Name: "ingress-nginx"})
+			require.NoError(t, err)
+		}()
+	}
+
+	t.Run("show requires chart, output format and repo or registry", func(t *testing.T) {
+		showOpts := options.ShowOptions{
+			Chart:        "",
+			Repo:         "",
+			OutputFormat: "",
+		}
+		_, err := hspm.Show(showOpts)
+		require.Error(t, err, "should return error when required options are missing")
+		is.Contains(err.Error(), "chart, output format and either repo or registry are required", "error message should indicate required options")
+	})
+
+	t.Run("show chart values", func(t *testing.T) {
+		showOpts := options.ShowOptions{
+			Chart:        "ingress-nginx",
+			Repo:         "https://kubernetes.github.io/ingress-nginx",
+			OutputFormat: options.ShowValues,
+		}
+		values, err := hspm.Show(showOpts)
+
+		require.NoError(t, err, "should not return error when not in k8s environment")
+		is.NotEmpty(values, "should return non-empty values")
+	})
+
+	t.Run("show chart readme", func(t *testing.T) {
+		showOpts := options.ShowOptions{
+			Chart:        "ingress-nginx",
+			Repo:         "https://kubernetes.github.io/ingress-nginx",
+			OutputFormat: options.ShowReadme,
+		}
+		readme, err := hspm.Show(showOpts)
+
+		require.NoError(t, err, "should not return error when not in k8s environment")
+		is.NotEmpty(readme, "should return non-empty readme")
+	})
+
+	t.Run("show chart definition", func(t *testing.T) {
+		showOpts := options.ShowOptions{
+			Chart:        "ingress-nginx",
+			Repo:         "https://kubernetes.github.io/ingress-nginx",
+			OutputFormat: options.ShowChart,
+		}
+		chart, err := hspm.Show(showOpts)
+
+		require.NoError(t, err, "should not return error when not in k8s environment")
+		is.NotNil(chart, "should return non-nil chart definition")
+	})
+
+	t.Run("show all chart info", func(t *testing.T) {
+		showOpts := options.ShowOptions{
+			Chart:        "ingress-nginx",
+			Repo:         "https://kubernetes.github.io/ingress-nginx",
+			OutputFormat: options.ShowAll,
+		}
+		info, err := hspm.Show(showOpts)
+
+		require.NoError(t, err, "should not return error when not in k8s environment")
+		is.NotEmpty(info, "should return non-empty chart info")
+	})
+
+	t.Run("show with invalid output format", func(t *testing.T) {
+		// Show with invalid output format
+		showOpts := options.ShowOptions{
+			Chart:        "ingress-nginx",
+			Repo:         "https://kubernetes.github.io/ingress-nginx",
+			OutputFormat: "invalid",
+		}
+		_, err := hspm.Show(showOpts)
+
+		require.Error(t, err, "should return error with invalid output format")
+		is.Contains(err.Error(), "unsupported output format", "error message should indicate invalid output format")
+	})
+}
diff --git a/pkg/libhelm/sdk/testutils/values.go b/pkg/libhelm/sdk/testutils/values.go
new file mode 100644
index 0000000..81a0793
--- /dev/null
+++ b/pkg/libhelm/sdk/testutils/values.go
@@ -0,0 +1,27 @@
+package testutils
+
+import (
+	"os"
+
+	"github.com/portainer/portainer/api/logs"
+)
+
+// CreateValuesFile creates a temporary file with the given content for testing
+func CreateValuesFile(values string) (string, error) {
+	file, err := os.CreateTemp("", "helm-values")
+	if err != nil {
+		return "", err
+	}
+
+	if _, err := file.WriteString(values); err != nil {
+		logs.CloseAndLogErr(file)
+
+		return "", err
+	}
+
+	if err := file.Close(); err != nil {
+		return "", err
+	}
+
+	return file.Name(), nil
+}
diff --git a/pkg/libhelm/sdk/uninstall.go b/pkg/libhelm/sdk/uninstall.go
new file mode 100644
index 0000000..144f0d6
--- /dev/null
+++ b/pkg/libhelm/sdk/uninstall.go
@@ -0,0 +1,148 @@
+package sdk
+
+import (
+	"time"
+
+	"github.com/pkg/errors"
+	"github.com/portainer/portainer/pkg/libhelm/options"
+	"github.com/rs/zerolog/log"
+	"helm.sh/helm/v4/pkg/action"
+	"helm.sh/helm/v4/pkg/kube"
+	"helm.sh/helm/v4/pkg/storage/driver"
+)
+
+// Uninstall implements the HelmPackageManager interface by using the Helm SDK to uninstall a release.
+func (hspm *HelmSDKPackageManager) Uninstall(uninstallOpts options.UninstallOptions) error {
+	if uninstallOpts.Name == "" {
+		log.Error().
+			Str("context", "HelmClient").
+			Msg("Release name is required")
+		return errors.New("release name is required")
+	}
+
+	log.Debug().
+		Str("context", "HelmClient").
+		Str("release", uninstallOpts.Name).
+		Str("namespace", uninstallOpts.Namespace).
+		Msg("Uninstalling Helm release")
+
+	// Initialize action configuration with kubernetes config
+	actionConfig := new(action.Configuration)
+	err := hspm.initActionConfig(actionConfig, uninstallOpts.Namespace, uninstallOpts.KubernetesClusterAccess)
+	if err != nil {
+		// error is already logged in initActionConfig
+		return errors.Wrap(err, "failed to initialize helm configuration")
+	}
+
+	// Create uninstallClient action
+	uninstallClient := action.NewUninstall(actionConfig)
+	// 'foreground' means the parent object remains in a "terminating" state until all of its children are deleted. This ensures that all dependent resources are completely removed before finalizing the deletion of the parent resource.
+	uninstallClient.DeletionPropagation = "foreground" // "background" or "orphan"
+	if uninstallOpts.Wait {
+		uninstallClient.WaitStrategy = kube.StatusWatcherStrategy
+	} else {
+		uninstallClient.WaitStrategy = kube.HookOnlyStrategy
+	}
+	if uninstallOpts.Timeout == 0 {
+		uninstallClient.Timeout = 15 * time.Minute
+	} else {
+		uninstallClient.Timeout = uninstallOpts.Timeout
+	}
+
+	// Run the uninstallation
+	log.Info().
+		Str("context", "HelmClient").
+		Str("release", uninstallOpts.Name).
+		Str("namespace", uninstallOpts.Namespace).
+		Msg("Running uninstallation")
+
+	result, err := uninstallClient.Run(uninstallOpts.Name)
+	if err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Str("release", uninstallOpts.Name).
+			Str("namespace", uninstallOpts.Namespace).
+			Err(err).
+			Msg("Failed to uninstall helm release")
+		return errors.Wrap(err, "failed to uninstall helm release")
+	}
+
+	if result != nil {
+		releaseV1, err := releaserToV1Release(result.Release)
+		if err != nil {
+			log.Error().
+				Str("context", "HelmClient").
+				Str("release", uninstallOpts.Name).
+				Err(err).
+				Msg("Failed to convert release to v1")
+			return errors.Wrap(err, "failed to convert release to v1")
+		}
+		log.Debug().
+			Str("context", "HelmClient").
+			Str("release", uninstallOpts.Name).
+			Str("release_info", releaseV1.Info.Description).
+			Msg("Uninstall result details")
+	}
+
+	return nil
+}
+
+// ForceRemoveRelease removes all release history (Helm secrets) without attempting
+// to delete Kubernetes resources. This is a last-resort recovery mechanism for when
+// a standard Uninstall fails because CRDs are missing and Helm can't build kubernetes
+// objects for deletion, leaving the release stuck with no way to recover.
+func (hspm *HelmSDKPackageManager) ForceRemoveRelease(uninstallOpts options.UninstallOptions) error {
+	if uninstallOpts.Name == "" {
+		return errors.New("release name is required")
+	}
+
+	log.Warn().
+		Str("context", "HelmClient").
+		Str("release", uninstallOpts.Name).
+		Str("namespace", uninstallOpts.Namespace).
+		Msg("Force-removing release history (skipping resource deletion)")
+
+	actionConfig := new(action.Configuration)
+	err := hspm.initActionConfig(actionConfig, uninstallOpts.Namespace, uninstallOpts.KubernetesClusterAccess)
+	if err != nil {
+		return errors.Wrap(err, "failed to initialize helm configuration for force-remove")
+	}
+
+	// Get all release versions from Helm's storage (Kubernetes secrets)
+	versions, err := actionConfig.Releases.History(uninstallOpts.Name)
+	if err != nil {
+		if errors.Is(err, driver.ErrReleaseNotFound) {
+			log.Debug().
+				Str("context", "HelmClient").
+				Str("release", uninstallOpts.Name).
+				Msg("Release not found in storage, nothing to force-remove")
+			return nil
+		}
+		return errors.Wrap(err, "failed to get release history for force-remove")
+	}
+
+	// Delete each release version from storage
+	for _, v := range versions {
+		releaseV1, err := releaserToV1Release(v)
+		if err != nil {
+			log.Error().
+				Str("context", "HelmClient").
+				Str("release", uninstallOpts.Name).
+				Int("version", releaseV1.Version).
+				Err(err).
+				Msg("Failed to convert releaser version to v1 for force-remove, skipping deletion of this version")
+			continue
+		}
+		if _, err := actionConfig.Releases.Delete(releaseV1.Name, releaseV1.Version); err != nil {
+			return errors.Wrapf(err, "failed to delete release version %d for force-remove", releaseV1.Version)
+		}
+	}
+
+	log.Info().
+		Str("context", "HelmClient").
+		Str("release", uninstallOpts.Name).
+		Int("versions_removed", len(versions)).
+		Msg("Successfully force-removed all release history")
+
+	return nil
+}
diff --git a/pkg/libhelm/sdk/uninstall_test.go b/pkg/libhelm/sdk/uninstall_test.go
new file mode 100644
index 0000000..3534a1c
--- /dev/null
+++ b/pkg/libhelm/sdk/uninstall_test.go
@@ -0,0 +1,67 @@
+package sdk
+
+import (
+	"testing"
+
+	"github.com/portainer/portainer/pkg/libhelm/options"
+	"github.com/portainer/portainer/pkg/libhelm/test"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_Uninstall(t *testing.T) {
+	t.Parallel()
+	test.EnsureIntegrationTest(t)
+	is := assert.New(t)
+
+	// Create a new SDK package manager
+	hspm := NewHelmSDKPackageManager()
+
+	t.Run("uninstall requires a release name", func(t *testing.T) {
+		// Try to uninstall without a release name
+		uninstallOpts := options.UninstallOptions{
+			Name: "",
+		}
+		err := hspm.Uninstall(uninstallOpts)
+		require.Error(t, err, "should return error when release name is empty")
+		is.Contains(err.Error(), "release name is required", "error message should indicate release name is required")
+	})
+
+	t.Run("uninstall a non-existent release", func(t *testing.T) {
+		// Try to uninstall a release that doesn't exist
+		uninstallOpts := options.UninstallOptions{
+			Name: "non-existent-release",
+		}
+		err := hspm.Uninstall(uninstallOpts)
+
+		// The function should not fail by design, even when not running in a k8s environment
+		// However, it should return an error for a non-existent release
+		require.Error(t, err, "should return error when release doesn't exist")
+		is.Contains(err.Error(), "not found", "error message should indicate release not found")
+	})
+
+	// This test is commented out as it requires a real release to be installed first
+	t.Run("successfully uninstall an existing release", func(t *testing.T) {
+		// First install a release
+		installOpts := options.InstallOptions{
+			Name:  "test-uninstall",
+			Chart: "nginx",
+			Repo:  "https://kubernetes.github.io/ingress-nginx",
+		}
+
+		// Install the release
+		_, err := hspm.Upgrade(installOpts)
+		if err != nil {
+			t.Logf("Error installing release: %v", err)
+			t.Skip("Skipping uninstall test because install failed")
+			return
+		}
+
+		// Now uninstall it
+		uninstallOpts := options.UninstallOptions{
+			Name: "test-uninstall",
+		}
+		err = hspm.Uninstall(uninstallOpts)
+		require.NoError(t, err, "should successfully uninstall release")
+	})
+}
diff --git a/pkg/libhelm/sdk/upgrade.go b/pkg/libhelm/sdk/upgrade.go
new file mode 100644
index 0000000..d968326
--- /dev/null
+++ b/pkg/libhelm/sdk/upgrade.go
@@ -0,0 +1,218 @@
+package sdk
+
+import (
+	"time"
+
+	"github.com/pkg/errors"
+	"github.com/portainer/portainer/pkg/libhelm/cache"
+	"github.com/portainer/portainer/pkg/libhelm/options"
+	"github.com/portainer/portainer/pkg/libhelm/release"
+	"github.com/rs/zerolog/log"
+	"helm.sh/helm/v4/pkg/action"
+	"helm.sh/helm/v4/pkg/kube"
+)
+
+// Upgrade implements the HelmPackageManager interface by using the Helm SDK to upgrade a chart.
+// If the release does not exist, it will install it instead.
+func (hspm *HelmSDKPackageManager) Upgrade(upgradeOpts options.InstallOptions) (*release.Release, error) {
+	log.Debug().
+		Str("context", "HelmClient").
+		Str("chart", upgradeOpts.Chart).
+		Str("name", upgradeOpts.Name).
+		Str("namespace", upgradeOpts.Namespace).
+		Str("repo", upgradeOpts.Repo).
+		Bool("wait", upgradeOpts.Wait).
+		Msg("Upgrading Helm chart")
+
+	if upgradeOpts.Name == "" {
+		log.Error().
+			Str("context", "HelmClient").
+			Str("chart", upgradeOpts.Chart).
+			Str("name", upgradeOpts.Name).
+			Str("namespace", upgradeOpts.Namespace).
+			Str("repo", upgradeOpts.Repo).
+			Bool("wait", upgradeOpts.Wait).
+			Msg("Name is required for helm release upgrade")
+		return nil, errors.New("name is required for helm release upgrade")
+	}
+
+	// Check if the release exists
+	exists, err := hspm.doesReleaseExist(upgradeOpts.Name, upgradeOpts.Namespace, upgradeOpts.KubernetesClusterAccess)
+	if err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Str("name", upgradeOpts.Name).
+			Str("namespace", upgradeOpts.Namespace).
+			Err(err).
+			Msg("Failed to check if release exists")
+		return nil, errors.Wrap(err, "failed to check if release exists")
+	}
+
+	// If the release doesn't exist, install it instead
+	if !exists {
+		log.Info().
+			Str("context", "HelmClient").
+			Str("chart", upgradeOpts.Chart).
+			Str("name", upgradeOpts.Name).
+			Str("namespace", upgradeOpts.Namespace).
+			Msg("Release doesn't exist, installing instead")
+		return hspm.install(upgradeOpts)
+	}
+
+	// Initialize action configuration with kubernetes config
+	actionConfig := new(action.Configuration)
+	err = hspm.initActionConfig(actionConfig, upgradeOpts.Namespace, upgradeOpts.KubernetesClusterAccess)
+	if err != nil {
+		// error is already logged in initActionConfig
+		return nil, errors.Wrap(err, "failed to initialize helm configuration for helm release upgrade")
+	}
+
+	// Setup chart source
+	err = authenticateChartSource(actionConfig, upgradeOpts.Registry)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to setup chart source for helm release upgrade")
+	}
+
+	upgradeClient, err := initUpgradeClient(actionConfig, upgradeOpts)
+	if err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Err(err).
+			Msg("Failed to initialize helm upgrade client for helm release upgrade")
+		return nil, errors.Wrap(err, "failed to initialize helm upgrade client for helm release upgrade")
+	}
+
+	var values map[string]any
+	if upgradeOpts.Values != nil {
+		values = upgradeOpts.Values
+	} else {
+		values, err = GetHelmValuesFromFile(upgradeOpts.ValuesFile)
+		if err != nil {
+			log.Error().
+				Str("context", "HelmClient").
+				Err(err).
+				Msg("Failed to get Helm values from file for helm release upgrade")
+			return nil, errors.Wrap(err, "failed to get Helm values from file for helm release upgrade")
+		}
+	}
+
+	chartRef, repoURL, err := parseChartRef(upgradeOpts.Chart, upgradeOpts.Repo, upgradeOpts.Registry)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to parse chart reference for helm release upgrade")
+	}
+	chart, err := hspm.loadAndValidateChartWithPathOptions(actionConfig, &upgradeClient.ChartPathOptions, chartRef, upgradeOpts.Version, repoURL, upgradeClient.DependencyUpdate, "release upgrade")
+	if err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Err(err).
+			Msg("Failed to load and validate chart for helm release upgrade")
+
+		// Check if this is an authentication error and flush cache if needed
+		if upgradeOpts.Registry != nil && shouldFlushCacheOnError(err, upgradeOpts.Registry.ID) {
+			cache.FlushRegistryByID(upgradeOpts.Registry.ID)
+			log.Info().
+				Int("registry_id", int(upgradeOpts.Registry.ID)).
+				Str("context", "HelmClient").
+				Msg("Flushed registry cache due to chart loading authentication error during upgrade")
+		}
+
+		return nil, errors.Wrap(err, "failed to load and validate chart for helm release upgrade")
+	}
+
+	// Add chart references to annotations
+	var registryID int
+	if upgradeOpts.Registry != nil {
+		registryID = int(upgradeOpts.Registry.ID)
+	}
+	chart.Metadata.Annotations = appendChartReferenceAnnotations(upgradeOpts.Chart, upgradeOpts.Repo, registryID, upgradeOpts.StackID, upgradeOpts.AutoUpdate, chart.Metadata.Annotations)
+
+	log.Info().
+		Str("context", "HelmClient").
+		Str("chart", upgradeOpts.Chart).
+		Str("name", upgradeOpts.Name).
+		Str("namespace", upgradeOpts.Namespace).
+		Msgf("Running chart upgrade for helm release with the annotations: %+v", chart.Metadata.Annotations)
+
+	helmRelease, err := upgradeClient.Run(upgradeOpts.Name, chart, values)
+	if err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Str("chart", upgradeOpts.Chart).
+			Str("name", upgradeOpts.Name).
+			Str("namespace", upgradeOpts.Namespace).
+			Err(err).
+			Msg("Failed to upgrade helm chart for helm release upgrade")
+		return nil, errors.Wrap(err, "helm was not able to upgrade the chart for helm release upgrade")
+	}
+	releaseV1, err := releaserToV1Release(helmRelease)
+	if err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Str("chart", upgradeOpts.Chart).
+			Str("name", upgradeOpts.Name).
+			Str("namespace", upgradeOpts.Namespace).
+			Err(err).
+			Msg("Failed to convert helm release to v1 release for helm release upgrade")
+		return nil, errors.Wrap(err, "Failed to convert helm release to v1 release for helm release upgrade")
+	}
+
+	return &release.Release{
+		Name:      releaseV1.Name,
+		Namespace: releaseV1.Namespace,
+		Chart: release.Chart{
+			Metadata: &release.Metadata{
+				Name:        releaseV1.Chart.Metadata.Name,
+				Version:     releaseV1.Chart.Metadata.Version,
+				AppVersion:  releaseV1.Chart.Metadata.AppVersion,
+				Annotations: releaseV1.Chart.Metadata.Annotations,
+			},
+		},
+		Labels:   releaseV1.Labels,
+		Version:  releaseV1.Version,
+		Manifest: releaseV1.Manifest,
+	}, nil
+}
+
+// initUpgradeClient initializes the upgrade client with the given options
+// and return the upgrade client.
+func initUpgradeClient(actionConfig *action.Configuration, upgradeOpts options.InstallOptions) (*action.Upgrade, error) {
+	upgradeClient := action.NewUpgrade(actionConfig)
+	upgradeClient.DependencyUpdate = true
+	upgradeClient.RollbackOnFailure = upgradeOpts.Atomic
+	upgradeClient.Version = upgradeOpts.Version
+	if upgradeOpts.DryRun {
+		upgradeClient.DryRunStrategy = action.DryRunClient
+	}
+	if upgradeOpts.Wait {
+		upgradeClient.WaitStrategy = kube.StatusWatcherStrategy
+	} else {
+		upgradeClient.WaitStrategy = kube.HookOnlyStrategy
+	}
+	upgradeClient.TakeOwnership = upgradeOpts.TakeOwnership // Equivalent to --take-ownership flag
+	err := configureChartPathOptions(&upgradeClient.ChartPathOptions, upgradeOpts.Version, upgradeOpts.Repo, upgradeOpts.Registry)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to configure chart path options for helm release upgrade")
+	}
+
+	// Set default values if not specified
+	if upgradeOpts.Timeout == 0 {
+		if upgradeClient.RollbackOnFailure {
+			upgradeClient.Timeout = 30 * time.Minute // the atomic flag significantly increases the upgrade time
+		} else {
+			upgradeClient.Timeout = 15 * time.Minute
+		}
+	} else {
+		upgradeClient.Timeout = upgradeOpts.Timeout
+	}
+	if upgradeOpts.Namespace == "" {
+		upgradeClient.Namespace = "default"
+	} else {
+		upgradeClient.Namespace = upgradeOpts.Namespace
+	}
+
+	if len(upgradeOpts.HelmAppLabels) > 0 {
+		upgradeClient.PostRenderer = &appLabelsPostRenderer{labels: upgradeOpts.HelmAppLabels}
+	}
+
+	return upgradeClient, nil
+}
diff --git a/pkg/libhelm/sdk/upgrade_test.go b/pkg/libhelm/sdk/upgrade_test.go
new file mode 100644
index 0000000..59bb722
--- /dev/null
+++ b/pkg/libhelm/sdk/upgrade_test.go
@@ -0,0 +1,185 @@
+package sdk
+
+import (
+	"os"
+	"testing"
+
+	"github.com/portainer/portainer/pkg/libhelm/options"
+	"github.com/portainer/portainer/pkg/libhelm/test"
+	"github.com/stretchr/testify/require"
+)
+
+func TestUpgrade(t *testing.T) {
+	t.Parallel()
+	test.EnsureIntegrationTest(t)
+	is := require.New(t)
+
+	// Create a new SDK package manager
+	hspm := NewHelmSDKPackageManager()
+
+	t.Run("when no release exists, the chart should be installed", func(t *testing.T) {
+		// SDK equivalent of: helm upgrade --install test-new-nginx --repo https://kubernetes.github.io/ingress-nginx ingress-nginx
+		upgradeOpts := options.InstallOptions{
+			Name:      "test-new-nginx",
+			Namespace: "default",
+			Chart:     "ingress-nginx",
+			Repo:      "https://kubernetes.github.io/ingress-nginx",
+		}
+
+		// Ensure the release doesn't exist before test
+		err := hspm.Uninstall(options.UninstallOptions{Name: upgradeOpts.Name})
+		require.NoError(t, err)
+
+		release, err := hspm.Upgrade(upgradeOpts)
+		require.NoError(t, err, "should successfully install release via upgrade")
+		is.NotNil(release, "should return non-nil release")
+		defer func() {
+			err := hspm.Uninstall(options.UninstallOptions{Name: upgradeOpts.Name})
+			require.NoError(t, err)
+		}()
+
+		is.Equal(upgradeOpts.Name, release.Name, "release name should match")
+		is.Equal(1, release.Version, "release version should be 1 for new install")
+		is.NotEmpty(release.Manifest, "release manifest should not be empty")
+
+		// Cleanup
+		defer func() {
+			err := hspm.Uninstall(options.UninstallOptions{Name: upgradeOpts.Name})
+			require.NoError(t, err)
+		}()
+	})
+
+	t.Run("when release exists, the chart should be upgraded", func(t *testing.T) {
+		// First install a release
+		installOpts := options.InstallOptions{
+			Name:      "test-upgrade-nginx",
+			Chart:     "ingress-nginx",
+			Namespace: "default",
+			Repo:      "https://kubernetes.github.io/ingress-nginx",
+		}
+
+		// Ensure the release doesn't exist before test
+		err := hspm.Uninstall(options.UninstallOptions{Name: installOpts.Name})
+		require.NoError(t, err)
+
+		release, err := hspm.Upgrade(installOpts)
+		require.NoError(t, err, "should successfully install release")
+		is.NotNil(release, "should return non-nil release")
+		defer func() {
+			err := hspm.Uninstall(options.UninstallOptions{Name: installOpts.Name})
+			require.NoError(t, err)
+		}()
+
+		// Upgrade the release with the same options
+		upgradedRelease, err := hspm.Upgrade(installOpts)
+
+		require.NoError(t, err, "should successfully upgrade release")
+		is.NotNil(upgradedRelease, "should return non-nil release")
+		is.Equal("test-upgrade-nginx", upgradedRelease.Name, "release name should match")
+		is.Equal(2, upgradedRelease.Version, "release version should be incremented to 2")
+		is.NotEmpty(upgradedRelease.Manifest, "release manifest should not be empty")
+	})
+
+	t.Run("should be able to upgrade with override values", func(t *testing.T) {
+		// First install a release
+		installOpts := options.InstallOptions{
+			Name:      "test-values-nginx",
+			Chart:     "ingress-nginx",
+			Namespace: "default",
+			Repo:      "https://kubernetes.github.io/ingress-nginx",
+		}
+
+		// Ensure the release doesn't exist before test
+		err := hspm.Uninstall(options.UninstallOptions{Name: installOpts.Name})
+		require.NoError(t, err)
+
+		release, err := hspm.Upgrade(installOpts) // Cleanup
+		require.NoError(t, err, "should successfully install release")
+		is.NotNil(release, "should return non-nil release")
+		defer func() {
+			err := hspm.Uninstall(options.UninstallOptions{Name: installOpts.Name})
+			require.NoError(t, err)
+		}()
+
+		// Create values file
+		values, err := test.CreateValuesFile("service:\n  port:  8083")
+		require.NoError(t, err, "should create a values file")
+		defer func() {
+			err := os.Remove(values)
+			require.NoError(t, err)
+		}()
+
+		// Now upgrade with values
+		upgradeOpts := options.InstallOptions{
+			Name:       "test-values-nginx",
+			Chart:      "ingress-nginx",
+			Namespace:  "default",
+			Repo:       "https://kubernetes.github.io/ingress-nginx",
+			ValuesFile: values,
+		}
+
+		upgradedRelease, err := hspm.Upgrade(upgradeOpts)
+
+		require.NoError(t, err, "should successfully upgrade release with values")
+		is.NotNil(upgradedRelease, "should return non-nil release")
+		is.Equal("test-values-nginx", upgradedRelease.Name, "release name should match")
+		is.Equal(2, upgradedRelease.Version, "release version should be incremented to 2")
+		is.NotEmpty(upgradedRelease.Manifest, "release manifest should not be empty")
+	})
+
+	t.Run("should give an error if the override values are invalid", func(t *testing.T) {
+		// First install a release
+		installOpts := options.InstallOptions{
+			Name:      "test-invalid-values",
+			Chart:     "ingress-nginx",
+			Namespace: "default",
+			Repo:      "https://kubernetes.github.io/ingress-nginx",
+		}
+
+		// Ensure the release doesn't exist before test
+		err := hspm.Uninstall(options.UninstallOptions{Name: installOpts.Name})
+		require.NoError(t, err)
+
+		release, err := hspm.Upgrade(installOpts)
+		require.NoError(t, err, "should successfully install release")
+		is.NotNil(release, "should return non-nil release")
+		defer func() {
+			err := hspm.Uninstall(options.UninstallOptions{Name: installOpts.Name})
+			require.NoError(t, err)
+		}()
+
+		// Create invalid values file
+		values, err := test.CreateValuesFile("this is not valid yaml")
+		require.NoError(t, err, "should create a values file")
+		defer func() {
+			err := os.Remove(values)
+			require.NoError(t, err)
+		}()
+
+		// Now upgrade with invalid values
+		upgradeOpts := options.InstallOptions{
+			Name:       "test-invalid-values",
+			Chart:      "ingress-nginx",
+			Namespace:  "default",
+			Repo:       "https://kubernetes.github.io/ingress-nginx",
+			ValuesFile: values,
+		}
+
+		_, err = hspm.Upgrade(upgradeOpts)
+
+		require.Error(t, err, "should return error with invalid values")
+	})
+
+	t.Run("should return error when name is not provided", func(t *testing.T) {
+		upgradeOpts := options.InstallOptions{
+			Chart:     "ingress-nginx",
+			Namespace: "default",
+			Repo:      "https://kubernetes.github.io/ingress-nginx",
+		}
+
+		_, err := hspm.Upgrade(upgradeOpts)
+
+		require.Error(t, err, "should return an error when name is not provided")
+		is.Equal("name is required for helm release upgrade", err.Error(), "should return correct error message")
+	})
+}
diff --git a/pkg/libhelm/sdk/values.go b/pkg/libhelm/sdk/values.go
new file mode 100644
index 0000000..0bf903b
--- /dev/null
+++ b/pkg/libhelm/sdk/values.go
@@ -0,0 +1,156 @@
+package sdk
+
+import (
+	"os"
+
+	"github.com/portainer/portainer/pkg/libhelm/options"
+	"github.com/portainer/portainer/pkg/libhelm/release"
+
+	"github.com/pkg/errors"
+	"github.com/rs/zerolog/log"
+	"go.yaml.in/yaml/v3"
+	"helm.sh/helm/v4/pkg/action"
+	"helm.sh/helm/v4/pkg/chart/common"
+)
+
+// GetHelmValuesFromFile reads the values file and parses it into a map[string]any
+// and returns the map.
+func GetHelmValuesFromFile(valuesFile string) (map[string]any, error) {
+	var vals map[string]any
+	if valuesFile != "" {
+		log.Debug().
+			Str("context", "HelmClient").
+			Str("values_file", valuesFile).
+			Msg("Reading values file")
+
+		valuesData, err := os.ReadFile(valuesFile)
+		if err != nil {
+			log.Error().
+				Str("context", "HelmClient").
+				Str("values_file", valuesFile).
+				Err(err).
+				Msg("Failed to read values file")
+			return nil, errors.Wrap(err, "failed to read values file")
+		}
+
+		vals, err = parseValues(valuesData)
+		if err != nil {
+			log.Error().
+				Str("context", "HelmClient").
+				Str("values_file", valuesFile).
+				Err(err).
+				Msg("Failed to parse values file")
+			return nil, errors.Wrap(err, "failed to parse values file")
+		}
+	}
+
+	return vals, nil
+}
+
+// parseValues parses YAML values data into a map
+func parseValues(data []byte) (map[string]any, error) {
+	// Use Helm's built-in common.ReadValues which properly handles the conversion
+	// from map[interface{}]interface{} to map[string]interface{}
+	return common.ReadValues(data)
+}
+
+// MergeValues merges two maps recursively, with values from the override map taking precedence
+// over values from the base map. It returns a new map containing the merged values.
+func MergeValues(base, override map[string]any) map[string]any {
+	if base == nil {
+		return override
+	}
+	if override == nil {
+		return base
+	}
+
+	for k, v := range override {
+		if vMap, ok := v.(map[string]any); ok {
+			if baseMap, ok := base[k].(map[string]any); ok {
+				base[k] = MergeValues(baseMap, vMap)
+				continue
+			}
+		}
+		base[k] = v
+	}
+	return base
+}
+
+func (hspm *HelmSDKPackageManager) getValues(getOpts options.GetOptions) (release.Values, error) {
+	log.Debug().
+		Str("context", "HelmClient").
+		Str("namespace", getOpts.Namespace).
+		Str("name", getOpts.Name).
+		Msg("Getting values")
+
+	actionConfig := new(action.Configuration)
+	err := hspm.initActionConfig(actionConfig, getOpts.Namespace, getOpts.KubernetesClusterAccess)
+	if err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Str("namespace", getOpts.Namespace).
+			Err(err).Msg("Failed to initialise helm configuration")
+		return release.Values{}, err
+	}
+
+	userValuesClient := hspm.initValuesClient(actionConfig, getOpts)
+	userSuppliedValues, err := userValuesClient.Run(getOpts.Name)
+	if err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Str("namespace", getOpts.Namespace).
+			Err(err).Msg("Failed to get user supplied values")
+		return release.Values{}, err
+	}
+
+	// Create separate client for computed values
+	computedValuesClient := action.NewGetValues(actionConfig)
+	computedValuesClient.AllValues = true
+	computedValues, err := computedValuesClient.Run(getOpts.Name)
+	if err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Str("namespace", getOpts.Namespace).
+			Err(err).Msg("Failed to get computed values")
+		return release.Values{}, err
+	}
+
+	userSuppliedValuesByte, err := yaml.Marshal(userSuppliedValues)
+	if err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Err(err).Msg("Failed to marshal user supplied values")
+		return release.Values{}, err
+	}
+
+	computedValuesByte, err := yaml.Marshal(computedValues)
+	if err != nil {
+		log.Error().
+			Str("context", "HelmClient").
+			Err(err).Msg("Failed to marshal computed values")
+		return release.Values{}, err
+	}
+
+	// Handle the case where the values are an empty object
+	userSuppliedValuesString := string(userSuppliedValuesByte)
+	if userSuppliedValuesString == "{}\n" {
+		userSuppliedValuesString = ""
+	}
+	computedValuesString := string(computedValuesByte)
+	if computedValuesString == "{}\n" {
+		computedValuesString = ""
+	}
+
+	return release.Values{
+		UserSuppliedValues: userSuppliedValuesString,
+		ComputedValues:     computedValuesString,
+	}, nil
+}
+
+func (hspm *HelmSDKPackageManager) initValuesClient(actionConfig *action.Configuration, getOpts options.GetOptions) *action.GetValues {
+	valuesClient := action.NewGetValues(actionConfig)
+	if getOpts.Revision > 0 {
+		valuesClient.Version = getOpts.Revision
+	}
+	return valuesClient
+}
diff --git a/pkg/libhelm/sdk/values_test.go b/pkg/libhelm/sdk/values_test.go
new file mode 100644
index 0000000..ec1e918
--- /dev/null
+++ b/pkg/libhelm/sdk/values_test.go
@@ -0,0 +1,243 @@
+package sdk
+
+import (
+	"os"
+	"testing"
+
+	"github.com/portainer/portainer/api/filesystem"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestMergeValues(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name     string
+		base     map[string]any
+		override map[string]any
+		expected map[string]any
+	}{
+		{
+			name:     "empty base returns override",
+			base:     nil,
+			override: map[string]any{"key": "value"},
+			expected: map[string]any{"key": "value"},
+		},
+		{
+			name:     "empty override returns base",
+			base:     map[string]any{"key": "value"},
+			override: nil,
+			expected: map[string]any{"key": "value"},
+		},
+		{
+			name:     "both nil returns nil",
+			base:     nil,
+			override: nil,
+			expected: nil,
+		},
+		{
+			name:     "simple merge without conflicts",
+			base:     map[string]any{"key1": "value1"},
+			override: map[string]any{"key2": "value2"},
+			expected: map[string]any{"key1": "value1", "key2": "value2"},
+		},
+		{
+			name:     "override replaces scalar value",
+			base:     map[string]any{"key": "old"},
+			override: map[string]any{"key": "new"},
+			expected: map[string]any{"key": "new"},
+		},
+		{
+			name: "nested map merge preserves non-conflicting keys",
+			base: map[string]any{
+				"config": map[string]any{
+					"port": 8080,
+					"host": "localhost",
+				},
+			},
+			override: map[string]any{
+				"config": map[string]any{
+					"port": 9090,
+				},
+			},
+			expected: map[string]any{
+				"config": map[string]any{
+					"port": 9090,
+					"host": "localhost",
+				},
+			},
+		},
+		{
+			name: "deep nested merge",
+			base: map[string]any{
+				"level1": map[string]any{
+					"level2": map[string]any{
+						"key1": "value1",
+						"key2": "value2",
+					},
+					"other": "data",
+				},
+			},
+			override: map[string]any{
+				"level1": map[string]any{
+					"level2": map[string]any{
+						"key2": "overridden",
+						"key3": "new",
+					},
+				},
+			},
+			expected: map[string]any{
+				"level1": map[string]any{
+					"level2": map[string]any{
+						"key1": "value1",
+						"key2": "overridden",
+						"key3": "new",
+					},
+					"other": "data",
+				},
+			},
+		},
+		{
+			name: "override replaces scalar with map",
+			base: map[string]any{
+				"value": "simple",
+			},
+			override: map[string]any{
+				"value": map[string]any{
+					"complex": "object",
+				},
+			},
+			expected: map[string]any{
+				"value": map[string]any{
+					"complex": "object",
+				},
+			},
+		},
+		{
+			name: "override replaces map with scalar",
+			base: map[string]any{
+				"value": map[string]any{
+					"complex": "object",
+				},
+			},
+			override: map[string]any{
+				"value": "simple",
+			},
+			expected: map[string]any{
+				"value": "simple",
+			},
+		},
+		{
+			name: "arrays are replaced not merged",
+			base: map[string]any{
+				"items": []any{"a", "b", "c"},
+			},
+			override: map[string]any{
+				"items": []any{"x", "y"},
+			},
+			expected: map[string]any{
+				"items": []any{"x", "y"},
+			},
+		},
+		{
+			name: "helm typical scenario - image override",
+			base: map[string]any{
+				"replicaCount": 1,
+				"image": map[string]any{
+					"repository": "nginx",
+					"tag":        "latest",
+					"pullPolicy": "IfNotPresent",
+				},
+				"service": map[string]any{
+					"type": "ClusterIP",
+					"port": 80,
+				},
+			},
+			override: map[string]any{
+				"replicaCount": 3,
+				"image": map[string]any{
+					"tag": "v1.2.3",
+				},
+				"service": map[string]any{
+					"type": "LoadBalancer",
+				},
+			},
+			expected: map[string]any{
+				"replicaCount": 3,
+				"image": map[string]any{
+					"repository": "nginx",
+					"tag":        "v1.2.3",
+					"pullPolicy": "IfNotPresent",
+				},
+				"service": map[string]any{
+					"type": "LoadBalancer",
+					"port": 80,
+				},
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := MergeValues(tt.base, tt.override)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+func TestGetHelmValuesFromFile(t *testing.T) {
+	t.Parallel()
+	// Create a temporary directory for test files
+	tempDir := t.TempDir()
+
+	t.Run("empty file path returns empty map", func(t *testing.T) {
+		vals, err := GetHelmValuesFromFile("")
+		require.NoError(t, err)
+		assert.Nil(t, vals)
+	})
+
+	t.Run("non-existent file returns error", func(t *testing.T) {
+		_, err := GetHelmValuesFromFile(filesystem.JoinPaths(tempDir, "nonexistent.yaml"))
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "failed to read values file")
+	})
+
+	t.Run("valid values file", func(t *testing.T) {
+		valuesPath := filesystem.JoinPaths(tempDir, "values.yaml")
+		valuesContent := []byte(`
+replicaCount: 3
+image:
+  repository: nginx
+  tag: v1.0.0
+service:
+  port: 8080
+`)
+		err := os.WriteFile(valuesPath, valuesContent, 0644)
+		require.NoError(t, err)
+
+		vals, err := GetHelmValuesFromFile(valuesPath)
+		require.NoError(t, err)
+		assert.NotNil(t, vals)
+		// YAML parser returns numbers as float64
+		assert.InDelta(t, float64(3), vals["replicaCount"], 1e-9)
+
+		image, ok := vals["image"].(map[string]any)
+		require.True(t, ok)
+		assert.Equal(t, "nginx", image["repository"])
+		assert.Equal(t, "v1.0.0", image["tag"])
+	})
+
+	t.Run("invalid YAML in file returns error", func(t *testing.T) {
+		invalidPath := filesystem.JoinPaths(tempDir, "invalid.yaml")
+		invalidContent := []byte(`
+invalid: yaml: content: [[[
+`)
+		err := os.WriteFile(invalidPath, invalidContent, 0644)
+		require.NoError(t, err)
+
+		_, err = GetHelmValuesFromFile(invalidPath)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "failed to parse values file")
+	})
+}
diff --git a/pkg/libhelm/test/integration.go b/pkg/libhelm/test/integration.go
new file mode 100644
index 0000000..0939f46
--- /dev/null
+++ b/pkg/libhelm/test/integration.go
@@ -0,0 +1,13 @@
+package test
+
+import (
+	"os"
+	"testing"
+)
+
+// EnsureIntegrationTest disables live integration tests that prevent portainer CI checks from succeeding on github
+func EnsureIntegrationTest(t *testing.T) {
+	if _, ok := os.LookupEnv("INTEGRATION_TEST"); !ok {
+		t.Skip("skip an integration test")
+	}
+}
diff --git a/pkg/libhelm/test/mock.go b/pkg/libhelm/test/mock.go
new file mode 100644
index 0000000..5465709
--- /dev/null
+++ b/pkg/libhelm/test/mock.go
@@ -0,0 +1,185 @@
+package test
+
+import (
+	"slices"
+	"strings"
+
+	"github.com/portainer/portainer/pkg/libhelm/options"
+	"github.com/portainer/portainer/pkg/libhelm/release"
+	"github.com/portainer/portainer/pkg/libhelm/types"
+
+	"github.com/pkg/errors"
+	"github.com/segmentio/encoding/json"
+	"go.yaml.in/yaml/v3"
+)
+
+const (
+	MockDataIndex  = "mock-index"
+	MockDataChart  = "mock-chart"
+	MockDataReadme = "mock-readme"
+	MockDataValues = "mock-values"
+)
+
+const (
+	MockReleaseHooks    = "mock-release-hooks"
+	MockReleaseManifest = "mock-release-manifest"
+	MockReleaseNotes    = "mock-release-notes"
+	MockReleaseValues   = "mock-release-values"
+)
+
+// helmMockPackageManager is a test package for helm related http handler testing
+// Note: this package currently uses a slice in a way that is not thread safe.
+// Do not use this package for concurrent tests.
+type helmMockPackageManager struct{}
+
+// NewMockHelmPackageManager initializes a new HelmPackageManager service (a mock instance)
+func NewMockHelmPackageManager() types.HelmPackageManager {
+	return helmMockPackageManager{}
+}
+
+var mockCharts = []release.ReleaseElement{}
+
+func newMockReleaseElement(installOpts options.InstallOptions) *release.ReleaseElement {
+	return &release.ReleaseElement{
+		Name:       installOpts.Name,
+		Namespace:  installOpts.Namespace,
+		Updated:    "date/time",
+		Status:     "deployed",
+		Chart:      installOpts.Chart,
+		AppVersion: "1.2.3",
+	}
+}
+
+func newMockRelease(re *release.ReleaseElement) *release.Release {
+	return &release.Release{
+		Name:      re.Name,
+		Namespace: re.Namespace,
+	}
+}
+
+// Install a helm chart (not thread safe)
+func (hpm helmMockPackageManager) Install(installOpts options.InstallOptions) (*release.Release, error) {
+	releaseElement := newMockReleaseElement(installOpts)
+
+	// Enforce only one chart with the same name per namespace
+	for i, rel := range mockCharts {
+		if rel.Name == installOpts.Name && rel.Namespace == installOpts.Namespace {
+			mockCharts[i] = *releaseElement
+
+			return newMockRelease(releaseElement), nil
+		}
+	}
+
+	mockCharts = append(mockCharts, *releaseElement)
+
+	return newMockRelease(releaseElement), nil
+}
+
+// Upgrade a helm chart (not thread safe)
+func (hpm helmMockPackageManager) Upgrade(upgradeOpts options.InstallOptions) (*release.Release, error) {
+	return hpm.Install(upgradeOpts)
+}
+
+// Rollback a helm chart (not thread safe)
+func (hpm helmMockPackageManager) Rollback(rollbackOpts options.RollbackOptions) (*release.Release, error) {
+	return nil, nil
+}
+
+// Show values/readme/chart etc
+func (hpm helmMockPackageManager) Show(showOpts options.ShowOptions) ([]byte, error) {
+	switch showOpts.OutputFormat {
+	case options.ShowChart:
+		return []byte(MockDataChart), nil
+	case options.ShowReadme:
+		return []byte(MockDataReadme), nil
+	case options.ShowValues:
+		return []byte(MockDataValues), nil
+	}
+
+	return nil, nil
+}
+
+// Uninstall a helm chart (not thread safe)
+func (hpm helmMockPackageManager) Uninstall(uninstallOpts options.UninstallOptions) error {
+	for i, rel := range mockCharts {
+		if rel.Name == uninstallOpts.Name && rel.Namespace == uninstallOpts.Namespace {
+			mockCharts = slices.Delete(mockCharts, i, i+1)
+		}
+	}
+
+	return nil
+}
+
+// ForceRemoveRelease removes release history without deleting resources (not thread safe)
+func (hpm helmMockPackageManager) ForceRemoveRelease(uninstallOpts options.UninstallOptions) error {
+	return hpm.Uninstall(uninstallOpts)
+}
+
+// List a helm chart (not thread safe)
+func (hpm helmMockPackageManager) List(listOpts options.ListOptions) ([]release.ReleaseElement, error) {
+	return mockCharts, nil
+}
+
+// Get a helm release (not thread safe)
+func (hpm helmMockPackageManager) Get(getOpts options.GetOptions) (*release.Release, error) {
+	index := slices.IndexFunc(mockCharts, func(re release.ReleaseElement) bool {
+		return re.Name == getOpts.Name && re.Namespace == getOpts.Namespace
+	})
+
+	if index == -1 {
+		return nil, errors.Errorf("release %s not found in namespace %s", getOpts.Name, getOpts.Namespace)
+	}
+
+	return newMockRelease(&mockCharts[index]), nil
+}
+
+func (hpm helmMockPackageManager) GetHistory(historyOpts options.HistoryOptions) ([]*release.Release, error) {
+	var result []*release.Release
+	for i, v := range mockCharts {
+		if v.Name == historyOpts.Name && v.Namespace == historyOpts.Namespace {
+			result = append(result, newMockRelease(&mockCharts[i]))
+		}
+	}
+
+	return result, nil
+}
+
+const mockPortainerIndex = `apiVersion: v1
+entries:
+  portainer:
+  - apiVersion: v2
+    appVersion: 2.0.0
+    created: "2020-12-01T21:51:37.367634957Z"
+    description: Helm chart used to deploy the Portainer for Kubernetes
+    digest: f0e13dd3e7a05d17cb35c7879ffa623fd43b2c10ca968203e302b7a6c2764ddb
+    home: https://www.portainer.io
+    icon: https://github.com/portainer/portainer/raw/develop/app/assets/ico/apple-touch-icon.png
+    maintainers:
+    - email: davidy@funkypenguin.co.nz
+      name: funkypenguin
+      url: https://www.funkypenguin.co.nz
+    name: portainer
+    sources:
+    - https://github.com/portainer/k8s
+    type: application
+    urls:
+    - https://github.com/portainer/k8s/releases/download/portainer-1.0.6/portainer-1.0.6.tgz
+    version: 1.0.6
+generated: "2020-08-19T00:00:46.754739363Z"`
+
+func (hbpm helmMockPackageManager) SearchRepo(searchRepoOpts options.SearchRepoOptions) ([]byte, error) {
+	// Always return the same repo data no matter what
+	reader := strings.NewReader(mockPortainerIndex)
+
+	var file release.File
+	if err := yaml.NewDecoder(reader).Decode(&file); err != nil {
+		return nil, errors.Wrap(err, "failed to decode index file")
+	}
+
+	result, err := json.Marshal(file)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to marshal index file")
+	}
+
+	return result, nil
+}
diff --git a/pkg/libhelm/test/values.go b/pkg/libhelm/test/values.go
new file mode 100644
index 0000000..44d3c8c
--- /dev/null
+++ b/pkg/libhelm/test/values.go
@@ -0,0 +1,26 @@
+package test
+
+import (
+	"os"
+
+	"github.com/portainer/portainer/api/logs"
+)
+
+// CreateValuesFile creates a temporary file with the given content for testing
+func CreateValuesFile(values string) (string, error) {
+	file, err := os.CreateTemp("", "helm-values")
+	if err != nil {
+		return "", err
+	}
+
+	if _, err := file.WriteString(values); err != nil {
+		logs.CloseAndLogErr(file)
+		return "", err
+	}
+
+	if err := file.Close(); err != nil {
+		return "", err
+	}
+
+	return file.Name(), nil
+}
diff --git a/pkg/libhelm/types/types.go b/pkg/libhelm/types/types.go
new file mode 100644
index 0000000..59071c8
--- /dev/null
+++ b/pkg/libhelm/types/types.go
@@ -0,0 +1,33 @@
+package types
+
+import (
+	"github.com/portainer/portainer/pkg/libhelm/options"
+	"github.com/portainer/portainer/pkg/libhelm/release"
+	"helm.sh/helm/v4/pkg/cli"
+	repo "helm.sh/helm/v4/pkg/repo/v1"
+)
+
+// HelmPackageManager represents a service that interfaces with Helm
+type HelmPackageManager interface {
+	Show(showOpts options.ShowOptions) ([]byte, error)
+	SearchRepo(searchRepoOpts options.SearchRepoOptions) ([]byte, error)
+	List(listOpts options.ListOptions) ([]release.ReleaseElement, error)
+	Upgrade(upgradeOpts options.InstallOptions) (*release.Release, error)
+	Uninstall(uninstallOpts options.UninstallOptions) error
+	// ForceRemoveRelease removes all release history (Helm secrets) without attempting
+	// to delete Kubernetes resources. Use as a last resort when Uninstall fails because
+	// CRDs are missing and Helm can't build kubernetes objects for deletion.
+	ForceRemoveRelease(uninstallOpts options.UninstallOptions) error
+	Get(getOpts options.GetOptions) (*release.Release, error)
+	GetHistory(historyOpts options.HistoryOptions) ([]*release.Release, error)
+	Rollback(rollbackOpts options.RollbackOptions) (*release.Release, error)
+}
+
+type Repository interface {
+	Charts() (repo.ChartVersions, error)
+}
+
+type HelmRepo struct {
+	Settings *cli.EnvSettings
+	Orig     *repo.Entry
+}
diff --git a/pkg/libhelm/validate_repo.go b/pkg/libhelm/validate_repo.go
new file mode 100644
index 0000000..9491233
--- /dev/null
+++ b/pkg/libhelm/validate_repo.go
@@ -0,0 +1,68 @@
+package libhelm
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+	"net/url"
+	"strings"
+
+	"github.com/portainer/portainer/pkg/libhelm/sdk"
+	"github.com/portainer/portainer/pkg/libhttp/ssrf"
+	"helm.sh/helm/v4/pkg/cli"
+	"helm.sh/helm/v4/pkg/getter"
+	repo "helm.sh/helm/v4/pkg/repo/v1"
+)
+
+func ValidateHelmRepositoryURL(repoUrl string, _ *http.Client) error {
+	if repoUrl == "" {
+		return errors.New("URL is required")
+	}
+
+	if strings.HasPrefix(repoUrl, "oci://") {
+		return errors.New("OCI repositories are not supported yet")
+	}
+
+	url, err := url.ParseRequestURI(repoUrl)
+	if err != nil {
+		return fmt.Errorf("invalid helm repository URL '%s': %w", repoUrl, err)
+	}
+
+	if !strings.EqualFold(url.Scheme, "http") && !strings.EqualFold(url.Scheme, "https") {
+		return fmt.Errorf("invalid helm repository URL '%s'", repoUrl)
+	}
+
+	// Mirror Helm CLI behavior: download and parse index.yaml using getters
+	settings := cli.New()
+
+	// Use a deterministic repo name shared with the SDK helper so cache aligns
+	repoName, err := sdk.GetRepoNameFromURL(repoUrl)
+	if err != nil {
+		return fmt.Errorf("failed to derive repo name: %w", err)
+	}
+
+	ssrfTransport := ssrf.NewTransport(nil)
+
+	r, err := repo.NewChartRepository(
+		&repo.Entry{
+			Name: repoName,
+			URL:  repoUrl,
+		},
+		getter.All(settings, getter.WithTransport(ssrfTransport)),
+	)
+	if err != nil {
+		return fmt.Errorf("%s is not a valid chart repository or cannot be reached: %w", repoUrl, err)
+	}
+
+	indexPath, err := r.DownloadIndexFile()
+	if err != nil {
+		return fmt.Errorf("%s is not a valid chart repository or cannot be reached", repoUrl)
+	}
+
+	// Best-effort: load and seed in-memory cache for future SearchRepo calls
+	if indexFile, err := repo.LoadIndexFile(indexPath); err == nil {
+		sdk.UpdateCache(repoUrl, indexFile)
+	}
+
+	return nil
+}
diff --git a/pkg/libhelm/validate_repo_test.go b/pkg/libhelm/validate_repo_test.go
new file mode 100644
index 0000000..8f1c114
--- /dev/null
+++ b/pkg/libhelm/validate_repo_test.go
@@ -0,0 +1,132 @@
+package libhelm
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"sync/atomic"
+	"testing"
+
+	"github.com/portainer/portainer/pkg/libhelm/test"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_ValidateHelmRepositoryURL(t *testing.T) {
+	t.Parallel()
+	test.EnsureIntegrationTest(t)
+
+	type testCase struct {
+		name    string
+		url     string
+		invalid bool
+	}
+
+	tests := []testCase{
+		{"blank", "", true},
+		{"slashes", "//", true},
+		{"slash", "/", true},
+		{"invalid scheme", "garbage://a.b.c", true},
+		{"invalid domain", "https://invaliddomain/", true},
+		{"not helm repo", "http://google.com", true},
+		{"not valid repo with trailing slash", "http://google.com/", true},
+		{"not valid repo with trailing slashes", "http://google.com////", true},
+		{"bitnami helm repo", "https://charts.bitnami.com/bitnami/", false},
+		{"gitlap helm repo", "https://charts.gitlab.io/", false},
+		{"portainer helm repo", "https://portainer.github.io/k8s/", false},
+		{"elastic helm repo", "https://helm.elastic.co/", false},
+		{"redirect", "https://charts.jetstack.io/", false},
+		{"fabric8.io helm repo", "https://fabric8.io/helm/", false},
+		{"lensesio helm repo", "https://lensesio.github.io/kafka-helm-charts", false},
+	}
+
+	for _, test := range tests {
+		func(tc testCase) {
+			t.Run(tc.name, func(t *testing.T) {
+				t.Parallel()
+				err := ValidateHelmRepositoryURL(tc.url, nil)
+				if tc.invalid {
+					require.Error(t, err, "error expected: %s", tc.url)
+				} else {
+					require.NoError(t, err, "no error expected: %s", tc.url)
+				}
+			})
+		}(test)
+	}
+}
+
+func TestValidateHelmRepositoryURL(t *testing.T) {
+	t.Parallel()
+	var fail bool
+
+	const indexYAML = "apiVersion: v1\nentries: {}\ngenerated: \"2020-01-01T00:00:00Z\"\n"
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if fail {
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+		if r.URL.Path == "/index.yaml" {
+			w.WriteHeader(http.StatusOK)
+			_, _ = w.Write([]byte(indexYAML))
+			return
+		}
+		w.WriteHeader(http.StatusNotFound)
+	}))
+	defer srv.Close()
+
+	// Success
+	err := ValidateHelmRepositoryURL(srv.URL, nil)
+	require.NoError(t, err)
+
+	// Failure
+	fail = true
+
+	failureURLs := []string{
+		"",
+		"!",
+		"oci://example.com",
+		"ftp://example.com",
+		srv.URL,
+	}
+
+	for _, url := range failureURLs {
+		err = ValidateHelmRepositoryURL(url, nil)
+		require.Error(t, err)
+
+		err = ValidateHelmRepositoryURL(srv.URL, nil)
+		require.Error(t, err)
+	}
+}
+
+func Test_ValidateSeedsCacheAndSearchUsesCache(t *testing.T) {
+	const indexYAML = "apiVersion: v1\nentries: {}\ngenerated: \"2020-01-01T00:00:00Z\"\n"
+
+	var requestCount atomic.Int32
+	var fail bool
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/index.yaml" {
+			if fail {
+				w.WriteHeader(http.StatusNotFound)
+				return
+			}
+			requestCount.Add(1)
+			w.WriteHeader(http.StatusOK)
+			_, _ = w.Write([]byte(indexYAML))
+			return
+		}
+		w.WriteHeader(http.StatusNotFound)
+	}))
+	defer srv.Close()
+
+	// isolate helm cache/config
+	temp := t.TempDir()
+	t.Setenv("HELM_REPOSITORY_CONFIG", temp+"/repositories.yaml")
+	t.Setenv("HELM_REPOSITORY_CACHE", temp+"/cache")
+	t.Setenv("HELM_REGISTRY_CONFIG", temp+"/registry.json")
+	t.Setenv("HELM_PLUGINS", temp+"/plugins")
+
+	// validate cache is used
+	err := ValidateHelmRepositoryURL(srv.URL, nil)
+	require.NoError(t, err)
+	require.Equal(t, int32(1), requestCount.Load())
+}
diff --git a/pkg/libhttp/LICENSE b/pkg/libhttp/LICENSE
new file mode 100644
index 0000000..8696d60
--- /dev/null
+++ b/pkg/libhttp/LICENSE
@@ -0,0 +1,17 @@
+Copyright (c) 2018-2020 Portainer.io
+
+This software is provided 'as-is', without any express or implied
+warranty.  In no event will the authors be held liable for any damages
+arising from the use of this software.
+
+Permission is granted to anyone to use this software for any purpose,
+including commercial applications, and to alter it and redistribute it
+freely, subject to the following restrictions:
+
+1. The origin of this software must not be misrepresented; you must not
+   claim that you wrote the original software. If you use this software
+   in a product, an acknowledgment in the product documentation would be
+   appreciated but is not required.
+2. Altered source versions must be plainly marked as such, and must not be
+   misrepresented as being the original software.
+3. This notice may not be removed or altered from any source distribution.
diff --git a/pkg/libhttp/README.md b/pkg/libhttp/README.md
new file mode 100644
index 0000000..1b02c9b
--- /dev/null
+++ b/pkg/libhttp/README.md
@@ -0,0 +1,5 @@
+[![GoDoc](https://godoc.org/github.com/portainer/libhttp?status.svg)](https://godoc.org/github.com/portainer/libhttp)
+
+# libhttp
+
+A HTTP library providing useful methods when working with `net/http` and `gorilla/mux`.
diff --git a/pkg/libhttp/client/client.go b/pkg/libhttp/client/client.go
new file mode 100644
index 0000000..1e1f094
--- /dev/null
+++ b/pkg/libhttp/client/client.go
@@ -0,0 +1,22 @@
+package client
+
+import (
+	"errors"
+
+	"github.com/portainer/portainer/pkg/featureflags"
+)
+
+var (
+	ErrExternalRequestsBlocked = errors.New("external requests are blocked by feature flag")
+)
+
+// DisableExternalRequest is the feature flag name for blocking outbound requests
+const DisableExternalRequests = "disable-external-requests"
+
+func ExternalRequestDisabled(url string) error {
+	if featureflags.IsEnabled(DisableExternalRequests) {
+		return ErrExternalRequestsBlocked
+	}
+
+	return nil
+}
diff --git a/pkg/libhttp/error/error.go b/pkg/libhttp/error/error.go
new file mode 100644
index 0000000..25f8c5d
--- /dev/null
+++ b/pkg/libhttp/error/error.go
@@ -0,0 +1,66 @@
+// Package error provides error/logging functions that can be used in conjunction with http.Handler.
+package error
+
+import (
+	"errors"
+	"net/http"
+	"unicode"
+
+	"github.com/rs/zerolog/log"
+	"github.com/segmentio/encoding/json"
+)
+
+type (
+	// LoggerHandler defines a HTTP handler that includes a HandlerError return pointer
+	LoggerHandler func(http.ResponseWriter, *http.Request) *HandlerError
+
+	errorResponse struct {
+		Message string `json:"message,omitempty"`
+		Details string `json:"details,omitempty"`
+	}
+)
+
+func (handler LoggerHandler) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
+	if err := handler(rw, r); err != nil {
+		writeErrorResponse(rw, err)
+	}
+}
+
+func capitalize(s string) string {
+	if len(s) == 0 {
+		return s
+	}
+
+	// Capitalize the first letter of the word or sentence
+	firstLetter := unicode.ToUpper(rune(s[0]))
+
+	return string(firstLetter) + s[1:]
+}
+
+func writeErrorResponse(rw http.ResponseWriter, err *HandlerError) {
+	if err.Err == nil {
+		err.Err = errors.New(capitalize(err.Message))
+	}
+
+	log.Debug().
+		CallerSkipFrame(2).
+		Err(err.Err).
+		Int("status_code", err.StatusCode).
+		Str("msg", err.Message).
+		Msg("HTTP error")
+
+	rw.Header().Set("Content-Type", "application/json")
+	rw.WriteHeader(err.StatusCode)
+
+	enc := json.NewEncoder(rw)
+	enc.SetSortMapKeys(false)
+	enc.SetAppendNewline(false)
+
+	_ = enc.Encode(&errorResponse{Message: err.Message, Details: capitalize(err.Err.Error())})
+}
+
+// WriteError is a convenience function that creates a new HandlerError before calling writeErrorResponse.
+// For use outside of the standard http handlers.
+func WriteError(rw http.ResponseWriter, code int, message string, err error) {
+	writeErrorResponse(rw, &HandlerError{code, message, err})
+}
diff --git a/pkg/libhttp/error/status.go b/pkg/libhttp/error/status.go
new file mode 100644
index 0000000..4853e10
--- /dev/null
+++ b/pkg/libhttp/error/status.go
@@ -0,0 +1,46 @@
+package error
+
+import "net/http"
+
+// HandlerError represents an error raised inside a HTTP handler
+type HandlerError struct {
+	StatusCode int
+	Message    string
+	Err        error
+}
+
+func (h *HandlerError) Error() string {
+	return h.Message
+}
+
+func NewError(statusCode int, message string, err error) *HandlerError {
+	return &HandlerError{
+		StatusCode: statusCode,
+		Message:    message,
+		Err:        err,
+	}
+}
+
+func BadRequest(message string, err error) *HandlerError {
+	return NewError(http.StatusBadRequest, message, err)
+}
+
+func NotFound(message string, err error) *HandlerError {
+	return NewError(http.StatusNotFound, message, err)
+}
+
+func InternalServerError(message string, err error) *HandlerError {
+	return NewError(http.StatusInternalServerError, message, err)
+}
+
+func Unauthorized(message string, err error) *HandlerError {
+	return NewError(http.StatusUnauthorized, message, err)
+}
+
+func Forbidden(message string, err error) *HandlerError {
+	return NewError(http.StatusForbidden, message, err)
+}
+
+func Conflict(message string, err error) *HandlerError {
+	return NewError(http.StatusConflict, message, err)
+}
diff --git a/pkg/libhttp/localcheck.go b/pkg/libhttp/localcheck.go
new file mode 100644
index 0000000..20c7179
--- /dev/null
+++ b/pkg/libhttp/localcheck.go
@@ -0,0 +1,41 @@
+package libhttp
+
+import (
+	"net"
+	"net/http"
+)
+
+// IsLocalRequest returns true when the request originates from the local host.
+// It accepts both loopback requests and self-dials to the listener's bound IP.
+func IsLocalRequest(r *http.Request) bool {
+	remoteIP := ParseRequestIP(r.RemoteAddr)
+	if remoteIP == nil {
+		return false
+	}
+
+	if remoteIP.IsLoopback() {
+		return true
+	}
+
+	localAddr, ok := r.Context().Value(http.LocalAddrContextKey).(net.Addr)
+	if !ok {
+		return false
+	}
+
+	localIP := ParseRequestIP(localAddr.String())
+	if localIP == nil {
+		return false
+	}
+
+	return remoteIP.Equal(localIP)
+}
+
+// ParseRequestIP extracts the IP address from a host:port address string.
+func ParseRequestIP(addr string) net.IP {
+	host, _, err := net.SplitHostPort(addr)
+	if err != nil {
+		return nil
+	}
+
+	return net.ParseIP(host)
+}
diff --git a/pkg/libhttp/localcheck_test.go b/pkg/libhttp/localcheck_test.go
new file mode 100644
index 0000000..c505d92
--- /dev/null
+++ b/pkg/libhttp/localcheck_test.go
@@ -0,0 +1,34 @@
+package libhttp
+
+import (
+	"context"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestIsLocalRequestAllowsLoopback(t *testing.T) {
+	r := httptest.NewRequest(http.MethodGet, "/api/metrics", nil)
+	r.RemoteAddr = "127.0.0.1:43210"
+
+	assert.True(t, IsLocalRequest(r))
+}
+
+func TestIsLocalRequestAllowsSelfDialToBoundAddress(t *testing.T) {
+	r := httptest.NewRequest(http.MethodGet, "/api/metrics", nil)
+	r.RemoteAddr = "10.0.0.5:43210"
+	r = r.WithContext(context.WithValue(r.Context(), http.LocalAddrContextKey, &net.TCPAddr{IP: net.ParseIP("10.0.0.5"), Port: 9001}))
+
+	assert.True(t, IsLocalRequest(r))
+}
+
+func TestIsLocalRequestRejectsRemotePeer(t *testing.T) {
+	r := httptest.NewRequest(http.MethodGet, "/api/metrics", nil)
+	r.RemoteAddr = "10.0.0.6:43210"
+	r = r.WithContext(context.WithValue(r.Context(), http.LocalAddrContextKey, &net.TCPAddr{IP: net.ParseIP("10.0.0.5"), Port: 9001}))
+
+	assert.False(t, IsLocalRequest(r))
+}
diff --git a/pkg/libhttp/request/payload.go b/pkg/libhttp/request/payload.go
new file mode 100644
index 0000000..19192c3
--- /dev/null
+++ b/pkg/libhttp/request/payload.go
@@ -0,0 +1,37 @@
+package request
+
+import (
+	"net/http"
+
+	"github.com/pkg/errors"
+	"github.com/segmentio/encoding/json"
+)
+
+// PayloadValidation is an interface used to validate the payload of a request.
+type PayloadValidation interface {
+	Validate(request *http.Request) error
+}
+
+// DecodeAndValidateJSONPayload decodes the body of the request into an object
+// implementing the PayloadValidation interface.
+// It also triggers a validation of object content.
+func DecodeAndValidateJSONPayload(request *http.Request, v PayloadValidation) error {
+	if err := json.NewDecoder(request.Body).Decode(v); err != nil {
+		return err
+	}
+	return v.Validate(request)
+}
+
+// GetPayload decodes the body of the request into an object implementing the PayloadValidation interface.
+func GetPayload[T any, PT interface {
+	*T
+	Validate(request *http.Request) error
+}](r *http.Request) (PT, error) {
+	p := PT(new(T))
+
+	err := DecodeAndValidateJSONPayload(r, p)
+	if err != nil {
+		return nil, errors.WithMessage(err, "Invalid request payload")
+	}
+	return p, nil
+}
diff --git a/pkg/libhttp/request/payload_test.go b/pkg/libhttp/request/payload_test.go
new file mode 100644
index 0000000..9b41d83
--- /dev/null
+++ b/pkg/libhttp/request/payload_test.go
@@ -0,0 +1,44 @@
+package request_test
+
+import (
+	"bytes"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/portainer/portainer/pkg/libhttp/request"
+
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/assert"
+)
+
+type requestPayload struct {
+	FirstName string `json:"first_name"`
+	LastName  string `json:"last_name"`
+}
+
+func (p *requestPayload) Validate(r *http.Request) error {
+	return nil
+}
+
+func Test_GetPayload(t *testing.T) {
+	t.Parallel()
+	payload := requestPayload{
+		FirstName: "John",
+		LastName:  "Doe",
+	}
+
+	payloadJSON, err := json.Marshal(payload)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	r := httptest.NewRequest(http.MethodPost, "/", bytes.NewReader(payloadJSON))
+
+	newPayload, err := request.GetPayload[requestPayload](r)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	assert.Equal(t, payload, *newPayload)
+}
diff --git a/pkg/libhttp/request/request.go b/pkg/libhttp/request/request.go
new file mode 100644
index 0000000..a990212
--- /dev/null
+++ b/pkg/libhttp/request/request.go
@@ -0,0 +1,224 @@
+// Package request provides function to retrieve content from a *http.Request object of the net/http standard library,
+// be it JSON body payload, multi-part form values or query parameters.
+// It also provides functions to retrieve route variables when using gorilla/mux.
+package request
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"strconv"
+	"strings"
+
+	"github.com/gorilla/mux"
+	"github.com/portainer/portainer/api/logs"
+	"github.com/segmentio/encoding/json"
+)
+
+const (
+	// ErrInvalidQueryParameter defines the message of an error raised when a mandatory query parameter has an invalid value.
+	ErrInvalidQueryParameter = "invalid query parameter"
+	// ErrInvalidRequestURL defines the message of an error raised when the data sent in the query or the URL is invalid
+	ErrInvalidRequestURL = "invalid request URL"
+	// ErrMissingQueryParameter defines the message of an error raised when a mandatory query parameter is missing.
+	ErrMissingQueryParameter = "missing query parameter"
+	// ErrMissingFormDataValue defines the message of an error raised when a mandatory form data value is missing.
+	ErrMissingFormDataValue = "missing form data value"
+)
+
+// RetrieveMultiPartFormFile returns the content of an uploaded file (form data) as bytes as well
+// as the name of the uploaded file.
+func RetrieveMultiPartFormFile(request *http.Request, requestParameter string) ([]byte, string, error) {
+	file, headers, err := request.FormFile(requestParameter)
+	if err != nil {
+		return nil, "", err
+	}
+	defer logs.CloseAndLogErr(file)
+
+	fileContent, err := io.ReadAll(file)
+	if err != nil {
+		return nil, "", err
+	}
+
+	return fileContent, headers.Filename, nil
+}
+
+// RetrieveMultiPartFormJSONValue decodes the value of some form data as a JSON object into the target parameter.
+// If optional is set to true, will not return an error when the form data value is not found.
+func RetrieveMultiPartFormJSONValue(request *http.Request, name string, target any, optional bool) error {
+	value, err := RetrieveMultiPartFormValue(request, name, optional)
+	if err != nil {
+		return err
+	} else if value == "" {
+		return nil
+	}
+
+	return json.Unmarshal([]byte(value), target)
+}
+
+// RetrieveMultiPartFormValue returns the value of some form data as a string.
+// If optional is set to true, will not return an error when the form data value is not found.
+func RetrieveMultiPartFormValue(request *http.Request, name string, optional bool) (string, error) {
+	value := request.FormValue(name)
+	if value == "" && !optional {
+		return "", errors.New(ErrMissingFormDataValue)
+	}
+
+	return value, nil
+}
+
+// RetrieveNumericMultiPartFormValue returns the value of some form data as an integer.
+// If optional is set to true, will not return an error when the form data value is not found.
+func RetrieveNumericMultiPartFormValue(request *http.Request, name string, optional bool) (int, error) {
+	value, err := RetrieveMultiPartFormValue(request, name, optional)
+	if err != nil {
+		return 0, err
+	}
+
+	return strconv.Atoi(value)
+}
+
+// RetrieveBooleanMultiPartFormValue returns the value of some form data as a boolean.
+// If optional is set to true, will not return an error when the form data value is not found.
+func RetrieveBooleanMultiPartFormValue(request *http.Request, name string, optional bool) (bool, error) {
+	value, err := RetrieveMultiPartFormValue(request, name, optional)
+	if err != nil {
+		return false, err
+	}
+
+	return value == "true", nil
+}
+
+// RetrieveRouteVariableValue returns the value of a route variable as a string.
+func RetrieveRouteVariableValue(request *http.Request, name string) (string, error) {
+	routeVariables := mux.Vars(request)
+	if routeVariables == nil {
+		return "", errors.New(ErrInvalidRequestURL)
+	}
+
+	routeVar := routeVariables[name]
+	if routeVar == "" {
+		return "", errors.New(ErrInvalidRequestURL)
+	}
+
+	return routeVar, nil
+}
+
+// RetrieveNumericRouteVariableValue returns the value of a route variable as an integer.
+func RetrieveNumericRouteVariableValue(request *http.Request, name string) (int, error) {
+	routeVar, err := RetrieveRouteVariableValue(request, name)
+	if err != nil {
+		return 0, err
+	}
+
+	return strconv.Atoi(routeVar)
+}
+
+// RetrieveQueryParameter returns the value of a query parameter as a string.
+// If optional is set to true, will not return an error when the query parameter is not found.
+func RetrieveQueryParameter(request *http.Request, name string, optional bool) (string, error) {
+	queryParameter := request.FormValue(name)
+	if queryParameter == "" && !optional {
+		return "", errors.New(ErrMissingQueryParameter)
+	}
+
+	return queryParameter, nil
+}
+
+// RetrieveNumericQueryParameter returns the value of a query parameter as an integer.
+// If optional is set to true, will not return an error when the query parameter is not found.
+func RetrieveNumericQueryParameter(request *http.Request, name string, optional bool) (int, error) {
+	queryParameter, err := RetrieveQueryParameter(request, name, optional)
+	if err != nil {
+		return 0, err
+	} else if queryParameter == "" && optional {
+		return 0, nil
+	}
+
+	return strconv.Atoi(queryParameter)
+}
+
+// RetrieveBooleanQueryParameter  returns the value of a query parameter as a boolean.
+// If optional is set to true, will not return an error when the query parameter is not found.
+func RetrieveBooleanQueryParameter(request *http.Request, name string, optional bool) (bool, error) {
+	queryParameter, err := RetrieveQueryParameter(request, name, optional)
+	if err != nil {
+		return false, err
+	}
+
+	return queryParameter == "true", nil
+}
+
+// RetrieveJSONQueryParameter decodes the value of a query parameter as a JSON object into the target parameter.
+// If optional is set to true, will not return an error when the query parameter is not found.
+func RetrieveJSONQueryParameter(request *http.Request, name string, target any, optional bool) error {
+	queryParameter, err := RetrieveQueryParameter(request, name, optional)
+	if err != nil {
+		return err
+	} else if queryParameter == "" {
+		return nil
+	}
+
+	return json.Unmarshal([]byte(queryParameter), target)
+}
+
+// RetrieveArrayQueryParameter returns the value of a query parameter as a string array.
+// it will return nil if the query parameter is not found.
+//
+// Example:
+//
+//	GET /api/resource?filter=foo&filter=bar
+//	GET /api/resource?filter[]=foo&filter[]=bar
+//	GET /api/resource?filter=foo,bar
+//	RetrieveArrayQueryParameter(request, "filter") => []string{"foo", "bar"}
+func RetrieveArrayQueryParameter(r *http.Request, parameter string) []string {
+	// bracket notation: param[]=1&param[]=2
+	if list, exists := r.Form[parameter+"[]"]; exists {
+		return list
+	}
+
+	// plain repeated or comma-separated: param=1&param=2 or param=1,2
+	if list, exists := r.Form[parameter]; exists {
+		var result []string
+		for _, v := range list {
+			for item := range strings.SplitSeq(v, ",") {
+				if item != "" {
+					result = append(result, item)
+				}
+			}
+		}
+		if len(result) > 0 {
+			return result
+		}
+	}
+
+	return nil
+}
+
+func RetrieveNumberArrayQueryParameter[T ~int](r *http.Request, parameter string) ([]T, error) {
+	if r.Form == nil {
+		err := r.ParseForm()
+		if err != nil {
+			return nil, fmt.Errorf("Unable to parse form: %w", err)
+		}
+	}
+
+	list := RetrieveArrayQueryParameter(r, parameter)
+	if list == nil {
+		return nil, nil
+	}
+
+	var result []T
+	for _, item := range list {
+		number, err := strconv.Atoi(item)
+		if err != nil {
+			return nil, fmt.Errorf("Unable to parse parameter %q: %w", parameter, err)
+
+		}
+
+		result = append(result, T(number))
+	}
+
+	return result, nil
+}
diff --git a/pkg/libhttp/request/request_test.go b/pkg/libhttp/request/request_test.go
new file mode 100644
index 0000000..e7d4f9c
--- /dev/null
+++ b/pkg/libhttp/request/request_test.go
@@ -0,0 +1,302 @@
+package request
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestRetrieveQueryParameter(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name     string
+		url      string
+		param    string
+		optional bool
+		want     string
+		wantErr  bool
+	}{
+		{
+			name:     "present parameter",
+			url:      "http://example.com?name=value",
+			param:    "name",
+			optional: false,
+			want:     "value",
+			wantErr:  false,
+		},
+		{
+			name:     "missing required parameter",
+			url:      "http://example.com",
+			param:    "name",
+			optional: false,
+			want:     "",
+			wantErr:  true,
+		},
+		{
+			name:     "missing optional parameter",
+			url:      "http://example.com",
+			param:    "name",
+			optional: true,
+			want:     "",
+			wantErr:  false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			req := httptest.NewRequest("GET", tt.url, nil)
+			got, err := RetrieveQueryParameter(req, tt.param, tt.optional)
+
+			if (err != nil) != tt.wantErr {
+				t.Errorf("RetrieveQueryParameter() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+			if got != tt.want {
+				t.Errorf("RetrieveQueryParameter() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestRetrieveNumericQueryParameter(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name     string
+		url      string
+		param    string
+		optional bool
+		want     int
+		wantErr  bool
+	}{
+		{
+			name:     "valid number",
+			url:      "http://example.com?port=8080",
+			param:    "port",
+			optional: false,
+			want:     8080,
+			wantErr:  false,
+		},
+		{
+			name:     "invalid number",
+			url:      "http://example.com?port=abc",
+			param:    "port",
+			optional: false,
+			want:     0,
+			wantErr:  true,
+		},
+		{
+			name:     "missing optional parameter",
+			url:      "http://example.com",
+			param:    "port",
+			optional: true,
+			want:     0,
+			wantErr:  false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			req := httptest.NewRequest("GET", tt.url, nil)
+			got, err := RetrieveNumericQueryParameter(req, tt.param, tt.optional)
+
+			if (err != nil) != tt.wantErr {
+				t.Errorf("RetrieveNumericQueryParameter() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+			if got != tt.want {
+				t.Errorf("RetrieveNumericQueryParameter() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestRetrieveBooleanQueryParameter(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name     string
+		url      string
+		param    string
+		optional bool
+		want     bool
+		wantErr  bool
+	}{
+		{
+			name:     "true value",
+			url:      "http://example.com?enabled=true",
+			param:    "enabled",
+			optional: false,
+			want:     true,
+			wantErr:  false,
+		},
+		{
+			name:     "false value",
+			url:      "http://example.com?enabled=false",
+			param:    "enabled",
+			optional: false,
+			want:     false,
+			wantErr:  false,
+		},
+		{
+			name:     "other value returns false",
+			url:      "http://example.com?enabled=yes",
+			param:    "enabled",
+			optional: false,
+			want:     false,
+			wantErr:  false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			req := httptest.NewRequest("GET", tt.url, nil)
+			got, err := RetrieveBooleanQueryParameter(req, tt.param, tt.optional)
+
+			if (err != nil) != tt.wantErr {
+				t.Errorf("RetrieveBooleanQueryParameter() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+			if got != tt.want {
+				t.Errorf("RetrieveBooleanQueryParameter() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestRetrieveArrayQueryParameter(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name  string
+		url   string
+		param string
+		want  []string
+	}{
+		{
+			name:  "multiple values",
+			url:   "http://example.com?filter[]=foo&filter[]=bar",
+			param: "filter",
+			want:  []string{"foo", "bar"},
+		},
+		{
+			name:  "single value",
+			url:   "http://example.com?filter[]=test",
+			param: "filter",
+			want:  []string{"test"},
+		},
+		{
+			name:  "no values returns nil",
+			url:   "http://example.com",
+			param: "filter",
+			want:  nil,
+		},
+		{
+			name:  "empty array",
+			url:   "http://example.com?filter[]=",
+			param: "filter",
+			want:  []string{""},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			req := httptest.NewRequest("GET", tt.url, nil)
+			_ = req.ParseForm()
+			got := RetrieveArrayQueryParameter(req, tt.param)
+
+			if tt.want == nil {
+				if got != nil {
+					t.Errorf("RetrieveArrayQueryParameter() = %v, want nil", got)
+				}
+				return
+			}
+
+			if len(got) != len(tt.want) {
+				t.Errorf("RetrieveArrayQueryParameter() length = %v, want %v", len(got), len(tt.want))
+				return
+			}
+			for i := range got {
+				if got[i] != tt.want[i] {
+					t.Errorf("RetrieveArrayQueryParameter()[%d] = %v, want %v", i, got[i], tt.want[i])
+				}
+			}
+		})
+	}
+}
+
+func Test_getArrayQueryParameter(t *testing.T) {
+	t.Parallel()
+
+	makeRequest := func(rawQuery string) *http.Request {
+		r := &http.Request{URL: &url.URL{RawQuery: rawQuery}}
+		require.NoError(t, r.ParseForm())
+
+		return r
+	}
+
+	tests := []struct {
+		name     string
+		query    string
+		param    string
+		expected []string
+	}{
+		{
+			name:     "bracket notation",
+			query:    "ids[]=1&ids[]=2",
+			param:    "ids",
+			expected: []string{"1", "2"},
+		},
+		{
+			name:     "comma-separated",
+			query:    "ids=1,2",
+			param:    "ids",
+			expected: []string{"1", "2"},
+		},
+		{
+			name:     "plain repeated",
+			query:    "ids=1&ids=2",
+			param:    "ids",
+			expected: []string{"1", "2"},
+		},
+		{
+			name:     "single value",
+			query:    "ids=1",
+			param:    "ids",
+			expected: []string{"1"},
+		},
+		{
+			name:     "missing param returns nil",
+			query:    "",
+			param:    "ids",
+			expected: nil,
+		},
+		{
+			name:     "bracket notation takes priority over plain",
+			query:    "ids[]=1&ids=2",
+			param:    "ids",
+			expected: []string{"1"},
+		},
+		{
+			name:     "empty plain param returns nil",
+			query:    "ids=",
+			param:    "ids",
+			expected: nil,
+		},
+		{
+			name:     "trailing comma is ignored",
+			query:    "ids=1,2,",
+			param:    "ids",
+			expected: []string{"1", "2"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r := makeRequest(tt.query)
+			result := RetrieveArrayQueryParameter(r, tt.param)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
diff --git a/pkg/libhttp/response/response.go b/pkg/libhttp/response/response.go
new file mode 100644
index 0000000..96638df
--- /dev/null
+++ b/pkg/libhttp/response/response.go
@@ -0,0 +1,60 @@
+// Package response provides convenience functions to write into a http.ResponseWriter.
+package response
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/rs/zerolog/log"
+
+	"github.com/segmentio/encoding/json"
+)
+
+// JSON encodes data to rw in JSON format. Returns a pointer to a
+// HandlerError if encoding fails.
+func JSON(rw http.ResponseWriter, data any) *httperror.HandlerError {
+	return JSONWithStatus(rw, data, http.StatusOK)
+}
+
+// JSONWithStatus encodes data to rw in JSON format with a specific status code.
+// Returns a pointer to a HandlerError if encoding fails.
+func JSONWithStatus(rw http.ResponseWriter, data any, status int) *httperror.HandlerError {
+	rw.Header().Set("Content-Type", "application/json")
+	rw.WriteHeader(status)
+
+	enc := json.NewEncoder(rw)
+	enc.SetSortMapKeys(false)
+	enc.SetAppendNewline(false)
+
+	err := enc.Encode(data)
+	if err != nil {
+		return httperror.InternalServerError("Unable to write JSON response", err)
+	}
+
+	return nil
+}
+
+// JSON encodes data to rw in YAML format. Returns a pointer to a
+// HandlerError if encoding fails.
+func YAML(rw http.ResponseWriter, data any) *httperror.HandlerError {
+	rw.Header().Set("Content-Type", "text/yaml")
+
+	strData, ok := data.(string)
+	if !ok {
+		return httperror.InternalServerError("Unable to write YAML response", errors.New("failed to convert input to string"))
+	}
+
+	if _, err := fmt.Fprint(rw, strData); err != nil {
+		log.Warn().Err(err).Msg("failed to write YAML response")
+	}
+
+	return nil
+}
+
+// Empty merely sets the response code to NoContent (204).
+func Empty(rw http.ResponseWriter) *httperror.HandlerError {
+	rw.WriteHeader(http.StatusNoContent)
+	return nil
+}
diff --git a/pkg/libhttp/response/response_test.go b/pkg/libhttp/response/response_test.go
new file mode 100644
index 0000000..064afc4
--- /dev/null
+++ b/pkg/libhttp/response/response_test.go
@@ -0,0 +1,148 @@
+package response
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestJSONWithStatus(t *testing.T) {
+	t.Parallel()
+	type TestData struct {
+		Message string `json:"message"`
+	}
+
+	tests := []struct {
+		name   string
+		data   any
+		status int
+	}{
+		{
+			name:   "Success",
+			data:   TestData{Message: "Hello, World!"},
+			status: http.StatusOK,
+		},
+		{
+			name:   "Internal Server Error",
+			data:   TestData{Message: "Internal Server Error"},
+			status: http.StatusInternalServerError,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			recorder := httptest.NewRecorder()
+
+			httpErr := JSONWithStatus(recorder, test.data, test.status)
+
+			assert.Nil(t, httpErr)
+			assert.Equal(t, test.status, recorder.Code)
+			assert.Equal(t, "application/json", recorder.Header().Get("Content-Type"))
+
+			var response TestData
+			err := json.Unmarshal(recorder.Body.Bytes(), &response)
+
+			require.NoError(t, err)
+			assert.Equal(t, test.data, response)
+		})
+	}
+}
+
+func TestJSON(t *testing.T) {
+	t.Parallel()
+	type TestData struct {
+		Message string `json:"message"`
+	}
+
+	tests := []struct {
+		name   string
+		data   any
+		status int
+	}{
+		{
+			name:   "Success",
+			data:   TestData{Message: "Hello, World!"},
+			status: http.StatusOK,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			recorder := httptest.NewRecorder()
+
+			httpErr := JSONWithStatus(recorder, test.data, test.status)
+
+			assert.Nil(t, httpErr)
+			assert.Equal(t, test.status, recorder.Code)
+			assert.Equal(t, "application/json", recorder.Header().Get("Content-Type"))
+
+			var response TestData
+			err := json.Unmarshal(recorder.Body.Bytes(), &response)
+			require.NoError(t, err)
+			assert.Equal(t, test.data, response)
+		})
+	}
+}
+
+func TestYAML(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name     string
+		data     any
+		expected string
+		invalid  bool
+	}{
+		{
+			name:     "Success",
+			data:     "key: value",
+			expected: "key: value",
+		},
+		{
+			name:     "Invalid Data",
+			data:     123,
+			expected: "",
+			invalid:  true,
+		},
+		{
+			name: "doesn't support an Object",
+			data: map[string]any{
+				"key": "value",
+			},
+			expected: "",
+			invalid:  true,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			recorder := httptest.NewRecorder()
+
+			httpErr := YAML(recorder, test.data)
+
+			if test.invalid {
+				assert.NotNil(t, httpErr)
+				assert.Equal(t, http.StatusInternalServerError, httpErr.StatusCode)
+				return
+			}
+
+			assert.Nil(t, httpErr)
+			assert.Equal(t, http.StatusOK, recorder.Code)
+			assert.Equal(t, "text/yaml", recorder.Header().Get("Content-Type"))
+			assert.Equal(t, test.expected, recorder.Body.String())
+		})
+	}
+}
+
+func TestEmpty(t *testing.T) {
+	t.Parallel()
+	recorder := httptest.NewRecorder()
+
+	httpErr := Empty(recorder)
+
+	assert.Nil(t, httpErr)
+	assert.Equal(t, http.StatusNoContent, recorder.Code)
+}
diff --git a/pkg/libhttp/response/txresponse.go b/pkg/libhttp/response/txresponse.go
new file mode 100644
index 0000000..631dfde
--- /dev/null
+++ b/pkg/libhttp/response/txresponse.go
@@ -0,0 +1,47 @@
+package response
+
+import (
+	"errors"
+	"net/http"
+
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+)
+
+func TxResponse(w http.ResponseWriter, r any, err error) *httperror.HandlerError {
+	return TxFuncResponse(err, func() *httperror.HandlerError { return JSON(w, r) })
+}
+
+func TxEmptyResponse(w http.ResponseWriter, err error) *httperror.HandlerError {
+	if err != nil {
+		var handlerError *httperror.HandlerError
+		if errors.As(err, &handlerError) {
+			return handlerError
+		}
+
+		return httperror.InternalServerError("Unexpected error", err)
+	}
+
+	return Empty(w)
+}
+
+func TxFuncResponse(err error, validResponse func() *httperror.HandlerError) *httperror.HandlerError {
+	if err != nil {
+		var handlerError *httperror.HandlerError
+		if errors.As(err, &handlerError) {
+			return handlerError
+		}
+
+		return httperror.InternalServerError("Unexpected error", err)
+	}
+
+	return validResponse()
+}
+
+func TxErrorResponse(err error) *httperror.HandlerError {
+	var handlerError *httperror.HandlerError
+	if errors.As(err, &handlerError) {
+		return handlerError
+	}
+
+	return httperror.InternalServerError("Unexpected error", err)
+}
diff --git a/pkg/libhttp/response/txresponse_test.go b/pkg/libhttp/response/txresponse_test.go
new file mode 100644
index 0000000..8c18519
--- /dev/null
+++ b/pkg/libhttp/response/txresponse_test.go
@@ -0,0 +1,90 @@
+package response
+
+import (
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	httperrors "github.com/portainer/portainer/api/http/errors"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/stretchr/testify/require"
+)
+
+func TestTxResponse(t *testing.T) {
+	t.Parallel()
+	type sample struct {
+		Name string `json:"name"`
+	}
+
+	w := httptest.NewRecorder()
+	got := TxResponse(w, sample{Name: "Alice"}, nil)
+	require.Nil(t, got)
+	require.Equal(t, http.StatusOK, w.Result().StatusCode)
+
+	w = httptest.NewRecorder()
+	got = TxResponse(w, sample{}, httperror.Forbidden("Access denied to resource", httperrors.ErrResourceAccessDenied))
+	require.NotNil(t, got)
+	require.Equal(t, http.StatusForbidden, got.StatusCode)
+	require.Equal(t, "Access denied to resource", got.Message)
+
+	w = httptest.NewRecorder()
+	got = TxResponse(w, sample{}, errors.New("Some error"))
+	require.NotNil(t, got)
+	require.Equal(t, http.StatusInternalServerError, got.StatusCode)
+	require.Equal(t, "Unexpected error", got.Message)
+}
+
+func TestTxEmptyResponse(t *testing.T) {
+	t.Parallel()
+	w := httptest.NewRecorder()
+	got := TxEmptyResponse(w, nil)
+	require.Nil(t, got)
+	require.Equal(t, http.StatusNoContent, w.Result().StatusCode)
+
+	w = httptest.NewRecorder()
+	got = TxEmptyResponse(w, httperror.Forbidden("Access denied to resource", httperrors.ErrResourceAccessDenied))
+	require.NotNil(t, got)
+	require.Equal(t, http.StatusForbidden, got.StatusCode)
+	require.Equal(t, "Access denied to resource", got.Message)
+
+	w = httptest.NewRecorder()
+	got = TxEmptyResponse(w, errors.New("Some error"))
+	require.NotNil(t, got)
+	require.Equal(t, http.StatusInternalServerError, got.StatusCode)
+	require.Equal(t, "Unexpected error", got.Message)
+}
+
+func TestTxFuncResponse(t *testing.T) {
+	t.Parallel()
+	got := TxFuncResponse(nil, func() *httperror.HandlerError { return nil })
+	require.Nil(t, got)
+
+	got = TxFuncResponse(httperror.Forbidden("Access denied to resource", httperrors.ErrResourceAccessDenied), func() *httperror.HandlerError { return nil })
+	require.NotNil(t, got)
+	require.Equal(t, http.StatusForbidden, got.StatusCode)
+	require.Equal(t, "Access denied to resource", got.Message)
+
+	got = TxFuncResponse(errors.New("Some error"), func() *httperror.HandlerError { return nil })
+	require.NotNil(t, got)
+	require.Equal(t, http.StatusInternalServerError, got.StatusCode)
+	require.Equal(t, "Unexpected error", got.Message)
+}
+
+func TestTxErrorResponse(t *testing.T) {
+	t.Parallel()
+	got := TxErrorResponse(nil)
+	require.NotNil(t, got)
+	require.Equal(t, http.StatusInternalServerError, got.StatusCode)
+	require.Equal(t, "Unexpected error", got.Message)
+
+	got = TxErrorResponse(httperror.Forbidden("Access denied to resource", httperrors.ErrResourceAccessDenied))
+	require.NotNil(t, got)
+	require.Equal(t, http.StatusForbidden, got.StatusCode)
+	require.Equal(t, "Access denied to resource", got.Message)
+
+	got = TxErrorResponse(errors.New("Some error"))
+	require.NotNil(t, got)
+	require.Equal(t, http.StatusInternalServerError, got.StatusCode)
+	require.Equal(t, "Unexpected error", got.Message)
+}
diff --git a/pkg/libhttp/ssrf/builder.go b/pkg/libhttp/ssrf/builder.go
new file mode 100644
index 0000000..697047b
--- /dev/null
+++ b/pkg/libhttp/ssrf/builder.go
@@ -0,0 +1,62 @@
+package ssrf
+
+import (
+	"crypto/tls"
+	"net/http"
+)
+
+// NewTransport creates an SSRF-protected transport for user-influenced destinations.
+// It clones http.DefaultTransport as its base (inheriting pool and timeout defaults)
+// and applies the global SSRF dial-context filter so mode changes take effect without
+// restarting. tlsConfig may be nil to preserve standard TLS behavior (system CAs).
+func NewTransport(tlsConfig *tls.Config) *http.Transport {
+	base := http.DefaultTransport.(*http.Transport).Clone()
+	base.TLSClientConfig = tlsConfig
+	applySSRF(base)
+
+	return base
+}
+
+// NewInternalTransport creates a plain transport for destinations chosen by Portainer,
+// not by the user (Docker socket proxy, Chisel tunnels, in-cluster Kubernetes API).
+// It clones http.DefaultTransport as its base. tlsConfig may be nil.
+// Using this function instead of NewTransport makes the exemption explicit and
+// satisfies the ruleguard lint rule.
+func NewInternalTransport(tlsConfig *tls.Config) *http.Transport {
+	base := http.DefaultTransport.(*http.Transport).Clone()
+	base.TLSClientConfig = tlsConfig
+
+	return base
+}
+
+// WrapDefaultTransport replaces http.DefaultTransport with an SSRF-protected version.
+// Must be called after Configure. Returns false if DefaultTransport is not an *http.Transport.
+func WrapDefaultTransport() bool {
+	dt, ok := http.DefaultTransport.(*http.Transport)
+	if !ok {
+		return false
+	}
+
+	cloned := dt.Clone()
+	applySSRF(cloned)
+	http.DefaultTransport = cloned
+
+	return true
+}
+
+// HTTP1Only returns a Protocols value that enables HTTP/1.x and disables HTTP/2.
+// Use this to assign to Transport.Protocols — a nil Protocols defaults to both
+// HTTP/1 and HTTP/2, so the field must be non-nil to restrict to HTTP/1 only.
+func HTTP1Only() *http.Protocols {
+	p := new(http.Protocols)
+	p.SetHTTP1(true)
+	return p
+}
+
+// applySSRF sets the SSRF-filtering DialContext on t when the global dialer is active.
+func applySSRF(t *http.Transport) {
+	d := globalDialer.Load()
+	if d != nil {
+		t.DialContext = d.DialContext
+	}
+}
diff --git a/pkg/libhttp/ssrf/ssrf.go b/pkg/libhttp/ssrf/ssrf.go
new file mode 100644
index 0000000..231ab6a
--- /dev/null
+++ b/pkg/libhttp/ssrf/ssrf.go
@@ -0,0 +1,235 @@
+package ssrf
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"net/url"
+	"strings"
+	"sync/atomic"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/rs/zerolog/log"
+)
+
+// ParseAllowedHosts parses raw allow list entries into their three canonical
+// forms. Accepted formats: exact hostname, wildcard hostname (*.example.com),
+// single IP, or CIDR range.
+func ParseAllowedHosts(entries []string) portainer.ParsedAllowList {
+	nets := make([]*net.IPNet, 0, len(entries))
+	hosts := make(map[string]bool, len(entries))
+	var wilds []string
+
+	for _, entry := range entries {
+		if _, network, err := net.ParseCIDR(entry); err == nil {
+			nets = append(nets, network)
+			continue
+		}
+
+		if ip := net.ParseIP(entry); ip != nil {
+			bits := 32
+			if ip.To4() == nil {
+				bits = 128
+			}
+
+			mask := net.CIDRMask(bits, bits)
+			nets = append(nets, &net.IPNet{IP: ip.Mask(mask), Mask: mask})
+
+			continue
+		}
+
+		if strings.HasPrefix(entry, "*.") {
+			wilds = append(wilds, entry[1:]) // "*.foo.com" -> ".foo.com"
+			continue
+		}
+
+		hosts[entry] = true
+	}
+
+	return portainer.ParsedAllowList{Nets: nets, Hosts: hosts, Wilds: wilds}
+}
+
+// AllowListService is implemented by the allowlist data service.
+// ReadParsed is called on every dial to pick up runtime changes.
+type AllowListService interface {
+	ReadParsed(id portainer.AllowListKey) (*portainer.ParsedAllowList, error)
+}
+
+type safeDialer struct {
+	base    net.Dialer
+	service AllowListService
+}
+
+var globalDialer atomic.Pointer[safeDialer]
+
+// Configure initializes the global SSRF policy with the allow list data service.
+func Configure(svc AllowListService) error {
+	if svc == nil {
+		return errors.New("unable to configure ssrf: service must not be nil")
+	}
+
+	globalDialer.Store(&safeDialer{service: svc})
+	return nil
+}
+
+// IsEnabled reports whether SSRF protection is currently active (audit or enforce).
+func IsEnabled() bool {
+	d := globalDialer.Load()
+	if d == nil {
+		return false
+	}
+
+	allowList, err := d.service.ReadParsed(portainer.AllowListSSRF)
+	if err != nil {
+		log.Err(err).Msg("unable to check SSRF protection mode")
+		return false
+	}
+
+	return allowList.Mode != portainer.SSRFModeOff
+}
+
+// CheckURL validates rawURL against the active SSRF policy without making a
+// connection. Returns nil when protection is disabled or the destination is
+// permitted. In audit mode, logs a warning on violations and returns nil.
+func CheckURL(ctx context.Context, rawURL string) error {
+	d := globalDialer.Load()
+	if d == nil {
+		return nil
+	}
+
+	normalized := rawURL
+	if !strings.Contains(normalized, "://") && !strings.HasPrefix(normalized, "//") {
+		normalized = "//" + normalized
+	}
+
+	u, err := url.Parse(normalized)
+	if err != nil {
+		return fmt.Errorf("ssrf: invalid URL %q: %w", rawURL, err)
+	}
+
+	host := u.Hostname()
+	if host == "" {
+		return nil
+	}
+
+	return d.checkHost(ctx, host)
+}
+
+// DialContext resolves addr, validates all resolved IPs against the allowlist policy,
+// then dials using the first resolved IP to prevent DNS rebinding attacks.
+func (d *safeDialer) DialContext(ctx context.Context, network, addr string) (net.Conn, error) {
+	allowList, err := d.service.ReadParsed(portainer.AllowListSSRF)
+	if err != nil {
+		return nil, fmt.Errorf("ssrf: reading allow list: %w", err)
+	}
+
+	if allowList.Mode == portainer.SSRFModeOff {
+		return d.base.DialContext(ctx, network, addr)
+	}
+
+	host, port, err := net.SplitHostPort(addr)
+	if err != nil {
+		return nil, fmt.Errorf("ssrf: invalid address %q: %w", addr, err)
+	}
+
+	resolved, err := net.DefaultResolver.LookupIPAddr(ctx, host)
+	if err != nil {
+		return nil, fmt.Errorf("ssrf: resolving %q: %w", host, err)
+	}
+
+	if len(resolved) == 0 {
+		return nil, fmt.Errorf("ssrf: no addresses resolved for %q", host)
+	}
+
+	// Dial by resolved IP regardless of how the host was allowed to close the
+	// window between DNS validation and the TCP handshake (DNS rebinding).
+	dialTarget := net.JoinHostPort(resolved[0].IP.String(), port)
+
+	if allowList.Hosts[host] || matchesWildcard(host, allowList.Wilds) {
+		return d.base.DialContext(ctx, network, dialTarget)
+	}
+
+	for _, a := range resolved {
+		if !ipAllowed(a.IP, allowList.Nets) {
+			if allowList.Mode == portainer.SSRFModeAudit {
+				log.Warn().Str("host", host).Str("ip", a.IP.String()).Msg("ssrf: destination not in allowlist (audit mode, allowing)")
+				continue
+			}
+
+			return nil, fmt.Errorf("ssrf: destination %s is not in the allowlist", a.IP)
+		}
+	}
+
+	return d.base.DialContext(ctx, network, dialTarget)
+}
+
+func (d *safeDialer) checkHost(ctx context.Context, host string) error {
+	allowList, err := d.service.ReadParsed(portainer.AllowListSSRF)
+	if err != nil {
+		return fmt.Errorf("ssrf: reading allow list: %w", err)
+	}
+
+	if allowList.Mode == portainer.SSRFModeOff {
+		return nil
+	}
+
+	if allowList.Hosts[host] || matchesWildcard(host, allowList.Wilds) {
+		return nil
+	}
+
+	if ip := net.ParseIP(host); ip != nil {
+		if !ipAllowed(ip, allowList.Nets) {
+			if allowList.Mode == portainer.SSRFModeAudit {
+				log.Warn().Str("host", host).Msg("ssrf: destination not in allowlist (audit mode, allowing)")
+				return nil
+			}
+
+			return fmt.Errorf("ssrf: destination %s is not in the allowlist", ip)
+		}
+
+		return nil
+	}
+
+	resolved, err := net.DefaultResolver.LookupIPAddr(ctx, host)
+	if err != nil {
+		return fmt.Errorf("ssrf: resolving %q: %w", host, err)
+	}
+
+	if len(resolved) == 0 {
+		return fmt.Errorf("ssrf: no addresses resolved for %q", host)
+	}
+
+	for _, a := range resolved {
+		if !ipAllowed(a.IP, allowList.Nets) {
+			if allowList.Mode == portainer.SSRFModeAudit {
+				log.Warn().Str("host", host).Str("ip", a.IP.String()).Msg("ssrf: destination not in allowlist (audit mode, allowing)")
+				continue
+			}
+
+			return fmt.Errorf("ssrf: destination %s is not in the allowlist", a.IP)
+		}
+	}
+
+	return nil
+}
+
+func matchesWildcard(host string, wilds []string) bool {
+	for _, suffix := range wilds {
+		if strings.HasSuffix(host, suffix) {
+			return true
+		}
+	}
+
+	return false
+}
+
+func ipAllowed(ip net.IP, nets []*net.IPNet) bool {
+	for _, network := range nets {
+		if network.Contains(ip) {
+			return true
+		}
+	}
+
+	return false
+}
diff --git a/pkg/libhttp/ssrf/ssrf_test.go b/pkg/libhttp/ssrf/ssrf_test.go
new file mode 100644
index 0000000..49b41ef
--- /dev/null
+++ b/pkg/libhttp/ssrf/ssrf_test.go
@@ -0,0 +1,444 @@
+package ssrf
+
+import (
+	"context"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/stretchr/testify/require"
+)
+
+// staticService is a simple in-memory AllowListService for testing.
+type staticService struct {
+	parsed portainer.ParsedAllowList
+}
+
+func (s *staticService) ReadParsed(id portainer.AllowListKey) (*portainer.ParsedAllowList, error) {
+	return &s.parsed, nil
+}
+
+func newStaticService(mode portainer.SSRFMode, entries []string) *staticService {
+	parsed := ParseAllowedHosts(entries)
+	parsed.Mode = mode
+	return &staticService{parsed: parsed}
+}
+
+func TestParseAllowedHosts_ipAllowed(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		name        string
+		hostEntries []string
+		allowed     []string
+		denied      []string
+	}{
+		{
+			name:        "CIDR",
+			hostEntries: []string{"8.8.0.0/16", "2001:4860::/32"},
+			allowed:     []string{"8.8.8.8", "8.8.4.4", "2001:4860:4860::8888"},
+			denied:      []string{"1.1.1.1", "127.0.0.1", "169.254.169.254"},
+		},
+		{
+			name:        "Single IP",
+			hostEntries: []string{"1.2.3.4"},
+			allowed:     []string{"1.2.3.4"},
+			denied:      []string{"1.2.3.5"},
+		},
+		{
+			name:        "Single IPv6",
+			hostEntries: []string{"::1"},
+			allowed:     []string{"::1"},
+			denied:      []string{"::2"},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			parsed := ParseAllowedHosts(tc.hostEntries)
+			for _, a := range tc.allowed {
+				require.True(t, ipAllowed(net.ParseIP(a), parsed.Nets))
+			}
+
+			for _, d := range tc.denied {
+				require.False(t, ipAllowed(net.ParseIP(d), parsed.Nets))
+			}
+		})
+	}
+}
+
+func TestParseAllowedHosts_MixedEntries(t *testing.T) {
+	t.Parallel()
+
+	parsed := ParseAllowedHosts([]string{"example.com", "*.internal.net", "10.0.0.0/8", "1.2.3.4"})
+
+	require.True(t, parsed.Hosts["example.com"])
+	require.Contains(t, parsed.Wilds, ".internal.net")
+	require.Len(t, parsed.Nets, 2) // 10.0.0.0/8 and 1.2.3.4/32
+}
+
+func TestMatchesWildcard(t *testing.T) {
+	t.Parallel()
+
+	parsed := ParseAllowedHosts([]string{"*.example.com", "exact.host.com"})
+
+	tests := []struct {
+		host string
+		want bool
+	}{
+		{"foo.example.com", true},
+		{"bar.example.com", true},
+		{"deep.nested.example.com", true},
+		{"example.com", false},
+		{"notexample.com", false},
+		{"exact.host.com", false},
+	}
+
+	for _, tc := range tests {
+		got := matchesWildcard(tc.host, parsed.Wilds)
+		require.Equal(t, tc.want, got, "host: %s", tc.host)
+	}
+}
+
+func TestConfigure_SetsDialer(t *testing.T) {
+	err := Configure(newStaticService(portainer.SSRFModeEnforce, []string{"example.com"}))
+	require.NoError(t, err)
+	require.NotNil(t, globalDialer.Load())
+	t.Cleanup(func() { globalDialer.Store(nil) })
+}
+
+func TestConfigure_NilServicesReturnsError(t *testing.T) {
+	err := Configure(nil)
+	require.Error(t, err)
+}
+
+func TestNewTransport_NoPolicy(t *testing.T) {
+	globalDialer.Store(nil)
+	t.Cleanup(func() { globalDialer.Store(nil) })
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	client := &http.Client{Transport: NewTransport(nil)}
+	resp, err := client.Get(srv.URL)
+	require.NoError(t, err)
+	require.NoError(t, resp.Body.Close())
+}
+
+func TestNewTransport_WithPolicy(t *testing.T) {
+	err := Configure(newStaticService(portainer.SSRFModeEnforce, []string{"example.com"}))
+	require.NoError(t, err)
+	t.Cleanup(func() { globalDialer.Store(nil) })
+
+	result := NewTransport(nil)
+	require.NotNil(t, result.DialContext)
+}
+
+func TestCheckURL(t *testing.T) {
+	tests := []struct {
+		name    string
+		mode    portainer.SSRFMode
+		entries []string
+		url     string
+		wantErr bool
+	}{
+		{
+			name:    "disabled",
+			mode:    portainer.SSRFModeOff,
+			url:     "http://169.254.169.254/latest/meta-data/",
+			wantErr: false,
+		},
+		{
+			name:    "blocks IP not in allowlist",
+			mode:    portainer.SSRFModeEnforce,
+			entries: []string{"8.8.8.0/24"},
+			url:     "http://169.254.169.254/latest/meta-data/",
+			wantErr: true,
+		},
+		{
+			name:    "allowed exact hostname",
+			mode:    portainer.SSRFModeEnforce,
+			entries: []string{"example.com"},
+			url:     "https://example.com/path",
+			wantErr: false,
+		},
+		{
+			name:    "audit mode allows blocked IP",
+			mode:    portainer.SSRFModeAudit,
+			entries: []string{"8.8.8.0/24"},
+			url:     "http://169.254.169.254/latest/meta-data/",
+			wantErr: false,
+		},
+		{
+			name:    "IP in CIDR allowlist",
+			mode:    portainer.SSRFModeEnforce,
+			entries: []string{"8.8.8.0/24"},
+			url:     "http://8.8.8.8/path",
+			wantErr: false,
+		},
+		{
+			name:    "wildcard hostname",
+			mode:    portainer.SSRFModeEnforce,
+			entries: []string{"*.example.com"},
+			url:     "https://api.example.com/path",
+			wantErr: false,
+		},
+		{
+			name:    "hostname DNS resolves to allowed IP",
+			mode:    portainer.SSRFModeEnforce,
+			entries: []string{"127.0.0.0/8", "::1/128"},
+			url:     "http://localhost/path",
+			wantErr: false,
+		},
+		{
+			name:    "hostname DNS resolves to blocked IP",
+			mode:    portainer.SSRFModeEnforce,
+			entries: []string{"8.8.8.0/24"},
+			url:     "http://localhost/path",
+			wantErr: true,
+		},
+		{
+			name:    "audit mode allows hostname resolving to blocked IP",
+			mode:    portainer.SSRFModeAudit,
+			entries: []string{"8.8.8.0/24"},
+			url:     "http://localhost/path",
+			wantErr: false,
+		},
+		{
+			name:    "invalid URL",
+			mode:    portainer.SSRFModeEnforce,
+			entries: []string{"example.com"},
+			url:     "http://%gg",
+			wantErr: true,
+		},
+		{
+			name:    "empty host",
+			mode:    portainer.SSRFModeEnforce,
+			entries: []string{"example.com"},
+			url:     "http://",
+			wantErr: false,
+		},
+		{
+			name:    "scheme-less IP:port SSRF disabled",
+			mode:    portainer.SSRFModeOff,
+			url:     "10.10.1.41:30775",
+			wantErr: false,
+		},
+		{
+			name:    "scheme-less IP:port blocked",
+			mode:    portainer.SSRFModeEnforce,
+			entries: []string{"8.8.8.0/24"},
+			url:     "10.10.1.41:30775",
+			wantErr: true,
+		},
+		{
+			name:    "scheme-less IP:port allowed by CIDR",
+			mode:    portainer.SSRFModeEnforce,
+			entries: []string{"10.10.1.0/24"},
+			url:     "10.10.1.41:30775",
+			wantErr: false,
+		},
+		{
+			name:    "git scheme IP blocked",
+			mode:    portainer.SSRFModeEnforce,
+			entries: []string{"8.8.8.0/24"},
+			url:     "git://10.10.1.41:9418/",
+			wantErr: true,
+		},
+		{
+			name:    "git scheme IP allowed by CIDR",
+			mode:    portainer.SSRFModeEnforce,
+			entries: []string{"10.10.1.0/24"},
+			url:     "git://10.10.1.41:9418/",
+			wantErr: false,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			err := Configure(newStaticService(tc.mode, tc.entries))
+			require.NoError(t, err)
+			t.Cleanup(func() { globalDialer.Store(nil) })
+
+			err = CheckURL(t.Context(), tc.url)
+			if tc.wantErr {
+				require.Error(t, err)
+				require.Contains(t, err.Error(), "ssrf")
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
+
+// TestCheckURL_HostnameDNSError verifies that a DNS resolution failure is
+// propagated as an SSRF-prefixed error. Kept separate because it needs a
+// cancelled context rather than t.Context().
+func TestCheckURL_HostnameDNSError(t *testing.T) {
+	err := Configure(newStaticService(portainer.SSRFModeEnforce, []string{"8.8.8.0/24"}))
+	require.NoError(t, err)
+	t.Cleanup(func() { globalDialer.Store(nil) })
+
+	ctx, cancel := context.WithCancel(t.Context())
+	cancel()
+
+	err = CheckURL(ctx, "http://portainer-nonexistent.test.invalid/path")
+	require.Error(t, err)
+}
+
+func TestIsEnabled(t *testing.T) {
+	globalDialer.Store(nil)
+	require.False(t, IsEnabled())
+
+	err := Configure(newStaticService(portainer.SSRFModeEnforce, []string{"example.com"}))
+	require.NoError(t, err)
+	t.Cleanup(func() { globalDialer.Store(nil) })
+	require.True(t, IsEnabled())
+
+	err = Configure(newStaticService(portainer.SSRFModeOff, nil))
+	require.NoError(t, err)
+	require.False(t, IsEnabled())
+}
+
+func TestNewInternalTransport(t *testing.T) {
+	t.Parallel()
+
+	result := NewInternalTransport(nil)
+	require.NotNil(t, result)
+	require.Nil(t, result.TLSClientConfig)
+}
+
+// TestDialContext_BlocksLoopback is an end-to-end test: it starts a real HTTP
+// server on 127.0.0.1, enables SSRF protection with an allowlist that does not
+// include loopback, and verifies that the wrapped transport blocks the request.
+func TestDialContext_BlocksLoopback(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	err := Configure(newStaticService(portainer.SSRFModeEnforce, []string{"8.8.8.8"}))
+	require.NoError(t, err)
+	t.Cleanup(func() { globalDialer.Store(nil) })
+
+	blocked := &http.Client{Transport: NewTransport(nil)}
+	resp, err := blocked.Get(srv.URL)
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "ssrf")
+	if resp != nil {
+		require.NoError(t, resp.Body.Close())
+	}
+
+	// Switch to off mode — dialer stays configured but checks are skipped.
+	err = Configure(newStaticService(portainer.SSRFModeOff, nil))
+	require.NoError(t, err)
+
+	open := &http.Client{Transport: NewTransport(nil)}
+	resp, err = open.Get(srv.URL)
+	require.NoError(t, err)
+	require.NoError(t, resp.Body.Close())
+}
+
+// TestDialContext_AuditMode_AllowsLoopback verifies that audit mode logs the
+// violation but still allows the connection through.
+func TestDialContext_AuditMode_AllowsLoopback(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	err := Configure(newStaticService(portainer.SSRFModeAudit, []string{"8.8.8.8"}))
+	require.NoError(t, err)
+	t.Cleanup(func() { globalDialer.Store(nil) })
+
+	client := &http.Client{Transport: NewTransport(nil)}
+	resp, err := client.Get(srv.URL)
+	require.NoError(t, err)
+	require.NoError(t, resp.Body.Close())
+}
+
+// TestDialContext_InvalidAddress verifies that an address without a port
+// returns an SSRF-prefixed error.
+func TestDialContext_InvalidAddress(t *testing.T) {
+	err := Configure(newStaticService(portainer.SSRFModeEnforce, []string{"example.com"}))
+	require.NoError(t, err)
+	t.Cleanup(func() { globalDialer.Store(nil) })
+
+	d := globalDialer.Load()
+	_, err = d.DialContext(t.Context(), "tcp", "no-port-here")
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "ssrf")
+}
+
+// TestDialContext_DNSError verifies that a DNS resolution failure in
+// DialContext is propagated as an SSRF-prefixed error.
+func TestDialContext_DNSError(t *testing.T) {
+	err := Configure(newStaticService(portainer.SSRFModeEnforce, []string{}))
+	require.NoError(t, err)
+	t.Cleanup(func() { globalDialer.Store(nil) })
+
+	ctx, cancel := context.WithCancel(t.Context())
+	cancel()
+
+	d := globalDialer.Load()
+	_, err = d.DialContext(ctx, "tcp", "portainer-nonexistent.test.invalid:80")
+	require.Error(t, err)
+}
+
+// TestDialContext_AllowedByCIDR is an end-to-end test verifying that
+// connections to IPs within an allowed CIDR range are permitted.
+func TestDialContext_AllowedByCIDR(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	err := Configure(newStaticService(portainer.SSRFModeEnforce, []string{"127.0.0.0/8"}))
+	require.NoError(t, err)
+	t.Cleanup(func() { globalDialer.Store(nil) })
+
+	client := &http.Client{Transport: NewTransport(nil)}
+	resp, err := client.Get(srv.URL)
+	require.NoError(t, err)
+	require.NoError(t, resp.Body.Close())
+}
+
+// TestDialContext_AllowedByExactHostname verifies that when a hostname is in
+// the allowed-hosts list, the connection is permitted even though the resolved
+// IP is not covered by any CIDR entry.
+//
+// The server is bound to whatever IP "localhost" resolves to first so that the
+// dialTarget computed by DialContext (resolved[0]) matches the listening address.
+func TestDialContext_AllowedByExactHostname(t *testing.T) {
+	addrs, err := net.DefaultResolver.LookupIPAddr(t.Context(), "localhost")
+	require.NoError(t, err)
+	require.NotEmpty(t, addrs, "localhost must resolve to at least one address")
+
+	l, err := net.Listen("tcp", net.JoinHostPort(addrs[0].IP.String(), "0"))
+	require.NoError(t, err)
+
+	srv := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+	srv.Listener = l
+	srv.Start()
+	defer srv.Close()
+
+	_, portStr, err := net.SplitHostPort(l.Addr().String())
+	require.NoError(t, err)
+
+	err = Configure(newStaticService(portainer.SSRFModeEnforce, []string{"localhost"}))
+	require.NoError(t, err)
+	t.Cleanup(func() { globalDialer.Store(nil) })
+
+	client := &http.Client{Transport: NewTransport(nil)}
+	resp, err := client.Get("http://localhost:" + portStr)
+	require.NoError(t, err)
+	require.NoError(t, resp.Body.Close())
+}
diff --git a/pkg/libkompose/convert.go b/pkg/libkompose/convert.go
new file mode 100644
index 0000000..92a5cfb
--- /dev/null
+++ b/pkg/libkompose/convert.go
@@ -0,0 +1,111 @@
+package libkompose
+
+import (
+	"errors"
+	"fmt"
+
+	"github.com/kubernetes/kompose/pkg/app"
+	"github.com/kubernetes/kompose/pkg/kobject"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+var (
+	validProviders   = map[string]bool{"kubernetes": true, "openshift": true}
+	validControllers = map[string]bool{"": true, "deployment": true, "daemonSet": true, "replicationController": true, "deploymentConfig": true}
+	validVolumes     = map[string]bool{"persistentVolumeClaim": true, "emptyDir": true, "hostPath": true, "configMap": true}
+)
+
+// ConvertComposeFiles converts one or more Docker Compose files to Kubernetes manifests or Helm charts.
+// It uses sensible defaults for all options and returns the generated Kubernetes objects.
+func ConvertComposeFiles(composeFiles []string, opts *ConvertOptions) ([]runtime.Object, error) {
+	if len(composeFiles) == 0 {
+		return nil, errors.New("at least one compose file is required")
+	}
+
+	convertOpts, err := getDefaultConvertOptions(opts)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get default convert options: %w", err)
+	}
+	convertOpts.InputFiles = composeFiles
+
+	if err := app.ValidateComposeFile(convertOpts); err != nil {
+		return nil, fmt.Errorf("failed to validate compose file: %w", err)
+	}
+
+	objects, err := app.Convert(*convertOpts)
+	if err != nil {
+		return nil, fmt.Errorf("failed to convert compose files: %w", err)
+	}
+
+	return objects, nil
+}
+
+func getDefaultConvertOptions(opts *ConvertOptions) (*kobject.ConvertOptions, error) {
+	if opts == nil {
+		opts = &ConvertOptions{}
+	}
+
+	provider := opts.Provider
+	if provider == "" {
+		provider = "kubernetes"
+	} else if !validProviders[provider] {
+		return nil, fmt.Errorf("invalid provider %q: must be one of: kubernetes, openshift", provider)
+	}
+
+	replicas := opts.Replicas
+	if replicas == 0 {
+		replicas = 1
+	} else if replicas < 0 {
+		return nil, fmt.Errorf("invalid replicas %d: must be a positive integer", replicas)
+	}
+
+	volumes := opts.Volumes
+	if volumes == "" {
+		volumes = "persistentVolumeClaim"
+	} else if !validVolumes[volumes] {
+		return nil, fmt.Errorf("invalid volumes %q: must be one of: persistentVolumeClaim, emptyDir, hostPath, configMap", volumes)
+	}
+
+	yamlIndent := opts.YAMLIndent
+	if yamlIndent == 0 {
+		yamlIndent = 2
+	} else if yamlIndent < 0 {
+		return nil, fmt.Errorf("invalid yamlIndent %d: must be a positive integer", yamlIndent)
+	}
+
+	if !validControllers[opts.Controller] {
+		return nil, fmt.Errorf("invalid controller %q: must be one of: deployment, daemonSet, replicationController, deploymentConfig", opts.Controller)
+	}
+
+	if opts.ToStdout && opts.CreateChart {
+		return nil, errors.New("cannot use ToStdout with CreateChart")
+	}
+	if opts.ToStdout && opts.OutFile != "" {
+		return nil, errors.New("cannot use ToStdout with OutFile")
+	}
+
+	return &kobject.ConvertOptions{
+		OutFile:                 opts.OutFile,
+		CreateChart:             opts.CreateChart,
+		GenerateYaml:            true,
+		GenerateJSON:            false,
+		ToStdout:                opts.ToStdout,
+		Namespace:               opts.Namespace,
+		Provider:                provider,
+		Controller:              opts.Controller,
+		Replicas:                replicas,
+		Volumes:                 volumes,
+		PVCRequestSize:          opts.PVCRequestSize,
+		GenerateNetworkPolicies: opts.GenerateNetworkPolicies,
+		YAMLIndent:              yamlIndent,
+		Build:                   "none",
+		WithKomposeAnnotation:   false,
+		NoInterpolate:           false,
+		EmptyVols:               false,
+		InsecureRepository:      false,
+		PushImage:               false,
+		MultipleContainerMode:   false,
+		SecretsAsFiles:          false,
+		StoreManifest:           false,
+	}, nil
+}
diff --git a/pkg/libkompose/convert_test.go b/pkg/libkompose/convert_test.go
new file mode 100644
index 0000000..ef61a73
--- /dev/null
+++ b/pkg/libkompose/convert_test.go
@@ -0,0 +1,203 @@
+package libkompose
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_getDefaultConvertOptions(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name        string
+		opts        *ConvertOptions
+		wantErr     bool
+		errContains string
+		validate    func(t *testing.T, opts *ConvertOptions)
+	}{
+		{
+			name: "nil options uses all defaults",
+			opts: nil,
+			validate: func(t *testing.T, opts *ConvertOptions) {
+				assert.Equal(t, "kubernetes", opts.Provider)
+				assert.Equal(t, 1, opts.Replicas)
+				assert.Equal(t, "persistentVolumeClaim", opts.Volumes)
+				assert.Equal(t, 2, opts.YAMLIndent)
+			},
+		},
+		{
+			name: "empty options uses all defaults",
+			opts: &ConvertOptions{},
+			validate: func(t *testing.T, opts *ConvertOptions) {
+				assert.Equal(t, "kubernetes", opts.Provider)
+				assert.Equal(t, 1, opts.Replicas)
+				assert.Equal(t, "persistentVolumeClaim", opts.Volumes)
+				assert.Equal(t, 2, opts.YAMLIndent)
+			},
+		},
+		{
+			name: "valid provider openshift",
+			opts: &ConvertOptions{Provider: "openshift"},
+			validate: func(t *testing.T, opts *ConvertOptions) {
+				assert.Equal(t, "openshift", opts.Provider)
+			},
+		},
+		{
+			name:        "invalid provider",
+			opts:        &ConvertOptions{Provider: "docker"},
+			wantErr:     true,
+			errContains: "invalid provider",
+		},
+		{
+			name: "valid positive replicas",
+			opts: &ConvertOptions{Replicas: 3},
+			validate: func(t *testing.T, opts *ConvertOptions) {
+				assert.Equal(t, 3, opts.Replicas)
+			},
+		},
+		{
+			name:        "negative replicas",
+			opts:        &ConvertOptions{Replicas: -1},
+			wantErr:     true,
+			errContains: "invalid replicas",
+		},
+		{
+			name: "valid volume type emptyDir",
+			opts: &ConvertOptions{Volumes: "emptyDir"},
+			validate: func(t *testing.T, opts *ConvertOptions) {
+				assert.Equal(t, "emptyDir", opts.Volumes)
+			},
+		},
+		{
+			name: "valid volume type hostPath",
+			opts: &ConvertOptions{Volumes: "hostPath"},
+			validate: func(t *testing.T, opts *ConvertOptions) {
+				assert.Equal(t, "hostPath", opts.Volumes)
+			},
+		},
+		{
+			name: "valid volume type configMap",
+			opts: &ConvertOptions{Volumes: "configMap"},
+			validate: func(t *testing.T, opts *ConvertOptions) {
+				assert.Equal(t, "configMap", opts.Volumes)
+			},
+		},
+		{
+			name:        "invalid volume type",
+			opts:        &ConvertOptions{Volumes: "nfs"},
+			wantErr:     true,
+			errContains: "invalid volumes",
+		},
+		{
+			name:        "negative yaml indent",
+			opts:        &ConvertOptions{YAMLIndent: -1},
+			wantErr:     true,
+			errContains: "invalid yamlIndent",
+		},
+		{
+			name: "valid controller deployment",
+			opts: &ConvertOptions{Controller: "deployment"},
+			validate: func(t *testing.T, opts *ConvertOptions) {
+				assert.Equal(t, "deployment", opts.Controller)
+			},
+		},
+		{
+			name: "valid controller daemonSet",
+			opts: &ConvertOptions{Controller: "daemonSet"},
+			validate: func(t *testing.T, opts *ConvertOptions) {
+				assert.Equal(t, "daemonSet", opts.Controller)
+			},
+		},
+		{
+			name:        "invalid controller",
+			opts:        &ConvertOptions{Controller: "statefulSet"},
+			wantErr:     true,
+			errContains: "invalid controller",
+		},
+		{
+			name:        "ToStdout with CreateChart conflicts",
+			opts:        &ConvertOptions{ToStdout: true, CreateChart: true},
+			wantErr:     true,
+			errContains: "cannot use ToStdout with CreateChart",
+		},
+		{
+			name:        "ToStdout with OutFile conflicts",
+			opts:        &ConvertOptions{ToStdout: true, OutFile: "/tmp/out"},
+			wantErr:     true,
+			errContains: "cannot use ToStdout with OutFile",
+		},
+		{
+			name: "custom yaml indent",
+			opts: &ConvertOptions{YAMLIndent: 4},
+			validate: func(t *testing.T, opts *ConvertOptions) {
+				assert.Equal(t, 4, opts.YAMLIndent)
+			},
+		},
+		{
+			name: "namespace is passed through",
+			opts: &ConvertOptions{Namespace: "my-namespace"},
+			validate: func(t *testing.T, opts *ConvertOptions) {
+				assert.Equal(t, "my-namespace", opts.Namespace)
+			},
+		},
+		{
+			name: "CreateChart is passed through",
+			opts: &ConvertOptions{CreateChart: true},
+			validate: func(t *testing.T, opts *ConvertOptions) {
+				assert.True(t, opts.CreateChart)
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result, err := getDefaultConvertOptions(tt.opts)
+
+			if tt.wantErr {
+				require.Error(t, err)
+				assert.Contains(t, err.Error(), tt.errContains)
+				return
+			}
+
+			require.NoError(t, err)
+			require.NotNil(t, result)
+
+			if tt.validate != nil {
+				convertOpts := &ConvertOptions{
+					Provider:    result.Provider,
+					Replicas:    result.Replicas,
+					Volumes:     result.Volumes,
+					YAMLIndent:  result.YAMLIndent,
+					Controller:  result.Controller,
+					Namespace:   result.Namespace,
+					CreateChart: result.CreateChart,
+				}
+				tt.validate(t, convertOpts)
+			}
+		})
+	}
+}
+
+func Test_ConvertComposeFiles_EmptyInput(t *testing.T) {
+	t.Parallel()
+	_, err := ConvertComposeFiles(nil, nil)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "at least one compose file is required")
+}
+
+func Test_ConvertComposeFiles_EmptySlice(t *testing.T) {
+	t.Parallel()
+	_, err := ConvertComposeFiles([]string{}, nil)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "at least one compose file is required")
+}
+
+func Test_ConvertComposeFiles_InvalidOptions(t *testing.T) {
+	t.Parallel()
+	_, err := ConvertComposeFiles([]string{"/nonexistent/docker-compose.yml"}, &ConvertOptions{
+		Provider: "invalid",
+	})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "invalid provider")
+}
diff --git a/pkg/libkompose/types.go b/pkg/libkompose/types.go
new file mode 100644
index 0000000..755c362
--- /dev/null
+++ b/pkg/libkompose/types.go
@@ -0,0 +1,52 @@
+package libkompose
+
+// ConvertOptions configures the conversion behavior
+type ConvertOptions struct {
+	// Namespace specifies the Kubernetes namespace for generated resources.
+	// If empty, resources will not have a namespace specified.
+	Namespace string
+
+	// CreateChart generates a Helm chart instead of plain Kubernetes manifests.
+	// Default: false
+	CreateChart bool
+
+	// OutFile specifies the output file or directory path.
+	// If empty, files will be created in the current directory.
+	OutFile string
+
+	// Replicas specifies the number of replicas for deployments.
+	// Default: 1
+	Replicas int
+
+	// Volumes specifies the volume type to generate.
+	// Options: "persistentVolumeClaim", "emptyDir", "hostPath", "configMap"
+	// Default: "persistentVolumeClaim"
+	Volumes string
+
+	// PVCRequestSize specifies the size of PVC storage requests.
+	// Default: empty (uses default PVC size)
+	PVCRequestSize string
+
+	// Provider specifies the target platform.
+	// Options: "kubernetes", "openshift"
+	// Default: "kubernetes"
+	Provider string
+
+	// Controller specifies the controller type to generate.
+	// Options: "deployment", "daemonSet", "replicationController"
+	// If empty, defaults to deployment for Kubernetes.
+	Controller string
+
+	// GenerateNetworkPolicies generates NetworkPolicy resources.
+	// Default: false
+	GenerateNetworkPolicies bool
+
+	// YAMLIndent specifies the number of spaces for YAML indentation.
+	// Default: 2
+	YAMLIndent int
+
+	// ToStdout prints the converted manifests to stdout instead of saving to files.
+	// When true, OutFile and CreateChart are ignored.
+	// Default: false
+	ToStdout bool
+}
diff --git a/pkg/libkubectl/apply.go b/pkg/libkubectl/apply.go
new file mode 100644
index 0000000..23619e5
--- /dev/null
+++ b/pkg/libkubectl/apply.go
@@ -0,0 +1,35 @@
+package libkubectl
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+
+	"k8s.io/kubectl/pkg/cmd/apply"
+	cmdutil "k8s.io/kubectl/pkg/cmd/util"
+)
+
+func (c *Client) Apply(ctx context.Context, manifests []string) (string, error) {
+	buf := new(bytes.Buffer)
+
+	var fatalErr error
+	cmdutil.BehaviorOnFatal(func(msg string, code int) {
+		fatalErr = newKubectlFatalError(code, msg)
+	})
+	defer cmdutil.DefaultBehaviorOnFatal()
+
+	cmd := apply.NewCmdApply("kubectl", c.factory, c.streams)
+	cmd.SetArgs(resourcesToArgs(manifests))
+	cmd.SetOut(buf)
+
+	err := cmd.ExecuteContext(ctx)
+	// check for the fatal error first so we don't return the error from the command execution
+	if fatalErr != nil {
+		return "", fatalErr
+	}
+	// if there is no fatal error, return the error from the command execution
+	if err != nil {
+		return "", fmt.Errorf("error applying resources: %w", err)
+	}
+	return buf.String(), nil
+}
diff --git a/pkg/libkubectl/apply_dynamic.go b/pkg/libkubectl/apply_dynamic.go
new file mode 100644
index 0000000..0d0cdd9
--- /dev/null
+++ b/pkg/libkubectl/apply_dynamic.go
@@ -0,0 +1,215 @@
+package libkubectl
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"strings"
+	"time"
+
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/yaml"
+	"k8s.io/client-go/discovery"
+	"k8s.io/client-go/dynamic"
+	"k8s.io/client-go/restmapper"
+)
+
+// ApplyDynamic applies Kubernetes resources using the dynamic client with Server-Side Apply.
+// This implementation is more performant than the kubectl library approach and provides
+// better conflict resolution through Server-Side Apply (SSA).
+func (c *Client) ApplyDynamic(ctx context.Context, manifests []string) (string, error) {
+	// Create REST config from the factory
+	restConfig, err := c.factory.ToRESTConfig()
+	if err != nil {
+		return "", fmt.Errorf("failed to create REST config: %w", err)
+	}
+
+	// Propagate context deadline to the HTTP client so discovery calls (which
+	// don't accept a context) still honour the caller's timeout.
+	if deadline, ok := ctx.Deadline(); ok {
+		restConfig.Timeout = time.Until(deadline)
+	}
+
+	// Create dynamic client
+	dynamicClient, err := dynamic.NewForConfig(restConfig)
+	if err != nil {
+		return "", fmt.Errorf("failed to create dynamic client: %w", err)
+	}
+
+	// Create discovery client for resource mapping
+	discoveryClient, err := discovery.NewDiscoveryClientForConfig(restConfig)
+	if err != nil {
+		return "", fmt.Errorf("failed to create discovery client: %w", err)
+	}
+
+	// Create REST mapper
+	groupResources, err := restmapper.GetAPIGroupResources(discoveryClient)
+	if err != nil {
+		return "", fmt.Errorf("failed to get API group resources: %w", err)
+	}
+	mapper := restmapper.NewDiscoveryRESTMapper(groupResources)
+
+	// Get the namespace configured on the client (from form/API payload)
+	// The second return value indicates if the namespace was explicitly set
+	configuredNamespace, wasExplicitlySet, err := c.factory.ToRawKubeConfigLoader().Namespace()
+	if err != nil {
+		return "", fmt.Errorf("failed to get configured namespace: %w", err)
+	}
+	// Only treat as configured if it was explicitly set (not just defaulted from kubeconfig)
+	if !wasExplicitlySet {
+		configuredNamespace = ""
+	}
+
+	var results []string
+	var processErr error
+
+	// Process each manifest
+	for _, manifest := range manifests {
+		manifest = strings.TrimSpace(manifest)
+		if manifest == "" {
+			continue
+		}
+
+		var content string
+		// Check if manifest is a file path
+		if isManifestFile(manifest) {
+			data, err := os.ReadFile(manifest)
+			if err != nil {
+				processErr = errors.Join(processErr, fmt.Errorf("failed to read file %s: %w", manifest, err))
+				continue
+			}
+			content = string(data)
+		} else {
+			content = manifest
+		}
+
+		// Split by document separator if multiple resources in one manifest
+		resources := strings.SplitSeq(content, "\n---\n")
+
+		for resource := range resources {
+			resource = strings.TrimSpace(resource)
+			if resource == "" {
+				continue
+			}
+
+			result, err := c.applyResource(ctx, dynamicClient, mapper, []byte(resource), configuredNamespace)
+			if err != nil {
+				processErr = errors.Join(processErr, fmt.Errorf("failed to apply resource: %w", err))
+				continue
+			}
+			results = append(results, result)
+		}
+	}
+
+	// Build output message
+	output := strings.Join(results, "\n")
+
+	if processErr != nil {
+		if len(results) == 0 {
+			return "", fmt.Errorf("failed to apply resources: %s", processErr.Error())
+		}
+		return output, fmt.Errorf("partially applied resources with errors: %s", processErr.Error())
+	}
+
+	return output, nil
+}
+
+// applyResource applies a single resource using Server-Side Apply.
+// configuredNamespace is the namespace set via form/API (empty string means "use manifest namespace").
+func (c *Client) applyResource(ctx context.Context, dynamicClient dynamic.Interface, mapper meta.RESTMapper, resourceYAML []byte, configuredNamespace string) (string, error) {
+	obj := &unstructured.Unstructured{}
+	decoder := yaml.NewYAMLOrJSONDecoder(strings.NewReader(string(resourceYAML)), 4096)
+	if err := decoder.Decode(obj); err != nil {
+		return "", fmt.Errorf("failed to decode YAML: %w", err)
+	}
+
+	// Skip empty objects
+	if obj.Object == nil {
+		return "", nil
+	}
+
+	// Get GVK (GroupVersionKind) from the object
+	gvk := obj.GroupVersionKind()
+	if gvk.Empty() {
+		return "", errors.New("unable to determine resource type")
+	}
+
+	// Map GVK to GVR (GroupVersionResource)
+	mapping, err := mapper.RESTMapping(gvk.GroupKind(), gvk.Version)
+	if err != nil {
+		return "", fmt.Errorf("failed to map resource type %s: %w", gvk.String(), err)
+	}
+
+	name := obj.GetName()
+
+	// Get the dynamic resource client
+	var resourceClient dynamic.ResourceInterface
+	var namespace string
+
+	if mapping.Scope.Name() == meta.RESTScopeNameNamespace {
+		namespace, err = resolveNamespace(configuredNamespace, obj.GetNamespace())
+		if err != nil {
+			return "", fmt.Errorf("namespace conflict for %s %q: %w", gvk.Kind, name, err)
+		}
+		obj.SetNamespace(namespace)
+		resourceClient = dynamicClient.Resource(mapping.Resource).Namespace(namespace)
+	} else {
+		resourceClient = dynamicClient.Resource(mapping.Resource)
+	}
+
+	// Convert object to JSON for Server-Side Apply
+	data, err := obj.MarshalJSON()
+	if err != nil {
+		return "", fmt.Errorf("failed to marshal object to JSON: %w", err)
+	}
+
+	// Apply using Server-Side Apply (Patch). If the resource does not exist (404),
+	// fall back to Create so restoration can create Deployments and other resources
+	// that were removed (e.g. by Helm uninstall).
+	patchOptions := metav1.PatchOptions{
+		FieldManager: "portainer",
+		Force:        new(true),
+	}
+
+	_, err = resourceClient.Patch(
+		ctx,
+		name,
+		types.ApplyPatchType,
+		data,
+		patchOptions,
+	)
+	if err != nil {
+		if apierrors.IsNotFound(err) {
+			_, createErr := resourceClient.Create(ctx, obj, metav1.CreateOptions{})
+			if createErr != nil {
+				return "", fmt.Errorf("failed to create %s %s/%s: %w", gvk.Kind, namespace, name, createErr)
+			}
+		} else {
+			return "", fmt.Errorf("failed to apply %s %s/%s: %w", gvk.Kind, namespace, name, err)
+		}
+	}
+
+	// Format output message
+	resourceType := strings.ToLower(gvk.Kind)
+	return fmt.Sprintf("%s/%s configured", resourceType, name), nil
+}
+
+// resolveNamespace determines the namespace for a resource
+func resolveNamespace(configuredNamespace, manifestNamespace string) (string, error) {
+	// If both namespaces are set and don't match return an error (to match the behavior where the kubectl client (from the form/API) has a different namespace than the manifest)
+	if configuredNamespace != "" && manifestNamespace != "" && configuredNamespace != manifestNamespace {
+		return "", fmt.Errorf("the namespace %q from the manifest does not match the namespace %q set from the form/API", manifestNamespace, configuredNamespace)
+	}
+	if configuredNamespace != "" {
+		return configuredNamespace, nil
+	}
+	if manifestNamespace != "" {
+		return manifestNamespace, nil
+	}
+	return "default", nil
+}
diff --git a/pkg/libkubectl/apply_dynamic_test.go b/pkg/libkubectl/apply_dynamic_test.go
new file mode 100644
index 0000000..34cb8e8
--- /dev/null
+++ b/pkg/libkubectl/apply_dynamic_test.go
@@ -0,0 +1,759 @@
+package libkubectl
+
+import (
+	"os"
+	"strings"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/client-go/dynamic/fake"
+	k8stesting "k8s.io/client-go/testing"
+)
+
+// TestApplyDynamic tests require a Kubernetes cluster.
+//
+// Running the tests:
+//   - With cluster: go test -v ./pkg/libkubectl -run TestApplyDynamic
+//   - Without cluster: Tests will skip automatically
+//
+// Cleanup: Tests automatically clean up resources using client.DeleteDynamic().
+// Resources are deleted after each test completes, keeping the cluster clean.
+
+// skipIfNoKubeconfig skips the test if no kubeconfig is available
+func skipIfNoKubeconfig(tb testing.TB) string {
+	tb.Helper()
+
+	// Check for kubeconfig in environment variable
+	kubeconfig := os.Getenv("KUBECONFIG")
+	if kubeconfig == "" {
+		// Try default location
+		homeDir, err := os.UserHomeDir()
+		if err != nil {
+			tb.Skip("No KUBECONFIG environment variable set and cannot determine home directory")
+		}
+		kubeconfig = homeDir + "/.kube/config"
+	}
+
+	// Check if kubeconfig file exists
+	if _, err := os.Stat(kubeconfig); os.IsNotExist(err) {
+		tb.Skip("No Kubernetes cluster available (kubeconfig not found). Set KUBECONFIG environment variable to run these tests")
+	}
+
+	return kubeconfig
+}
+
+func TestApplyDynamic(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name      string
+		manifests []string
+		wantErr   bool
+		errMsg    string
+		desc      string
+	}{
+		{
+			name: "apply simple deployment",
+			desc: "Test basic deployment resource application",
+			manifests: []string{
+				`apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: test-deployment
+  namespace: default
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: test
+  template:
+    metadata:
+      labels:
+        app: test
+    spec:
+      containers:
+      - name: test
+        image: nginx:latest`,
+			},
+			wantErr: false,
+		},
+		{
+			name: "apply statefulset",
+			desc: "Test StatefulSet resource application",
+			manifests: []string{
+				`apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: test-statefulset
+  namespace: default
+spec:
+  serviceName: test-service
+  replicas: 2
+  selector:
+    matchLabels:
+      app: test-stateful
+  template:
+    metadata:
+      labels:
+        app: test-stateful
+    spec:
+      containers:
+      - name: test
+        image: nginx:latest`,
+			},
+			wantErr: false,
+		},
+		{
+			name: "apply daemonset",
+			desc: "Test DaemonSet resource application",
+			manifests: []string{
+				`apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: test-daemonset
+  namespace: default
+spec:
+  selector:
+    matchLabels:
+      app: test-daemon
+  template:
+    metadata:
+      labels:
+        app: test-daemon
+    spec:
+      containers:
+      - name: test
+        image: nginx:latest`,
+			},
+			wantErr: false,
+		},
+		{
+			name: "apply service",
+			desc: "Test Service resource application",
+			manifests: []string{
+				`apiVersion: v1
+kind: Service
+metadata:
+  name: test-service
+  namespace: default
+spec:
+  selector:
+    app: test
+  ports:
+  - protocol: TCP
+    port: 80
+    targetPort: 8080`,
+			},
+			wantErr: false,
+		},
+		{
+			name: "apply ingress",
+			desc: "Test Ingress resource application",
+			manifests: []string{
+				`apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: test-ingress
+  namespace: default
+spec:
+  rules:
+  - host: test.example.com
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: test-service
+            port:
+              number: 80`,
+			},
+			wantErr: false,
+		},
+		{
+			name: "apply configmap and secret",
+			desc: "Test ConfigMap and Secret resource application",
+			manifests: []string{
+				`apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: test-config
+  namespace: default
+data:
+  key1: value1
+  key2: value2
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: test-secret
+  namespace: default
+type: Opaque
+stringData:
+  username: admin
+  password: secret123`,
+			},
+			wantErr: false,
+		},
+		{
+			name: "apply persistent volume claim",
+			desc: "Test PersistentVolumeClaim resource application",
+			manifests: []string{
+				`apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: test-pvc
+  namespace: default
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi`,
+			},
+			wantErr: false,
+		},
+		{
+			name: "apply serviceaccount with rbac",
+			desc: "Test ServiceAccount, Role, and RoleBinding resources",
+			manifests: []string{
+				`apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: test-sa
+  namespace: default
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: test-role
+  namespace: default
+rules:
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs: ["get", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: test-rolebinding
+  namespace: default
+subjects:
+- kind: ServiceAccount
+  name: test-sa
+  namespace: default
+roleRef:
+  kind: Role
+  name: test-role
+  apiGroup: rbac.authorization.k8s.io`,
+			},
+			wantErr: false,
+		},
+		{
+			name: "apply cluster-scoped resources",
+			desc: "Test cluster-scoped resources (ClusterRole, ClusterRoleBinding)",
+			manifests: []string{
+				`apiVersion: v1
+kind: Namespace
+metadata:
+  name: test-namespace
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: test-cluster-role
+rules:
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["get", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: test-cluster-rolebinding
+subjects:
+- kind: ServiceAccount
+  name: default
+  namespace: default
+roleRef:
+  kind: ClusterRole
+  name: test-cluster-role
+  apiGroup: rbac.authorization.k8s.io`,
+			},
+			wantErr: false,
+		},
+		{
+			name: "apply job and cronjob",
+			desc: "Test Job and CronJob resources",
+			manifests: []string{
+				`apiVersion: batch/v1
+kind: Job
+metadata:
+  name: test-job
+  namespace: default
+spec:
+  template:
+    spec:
+      containers:
+      - name: test
+        image: busybox
+        command: ["echo", "Hello"]
+      restartPolicy: Never
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: test-cronjob
+  namespace: default
+spec:
+  schedule: "*/5 * * * *"
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          containers:
+          - name: test
+            image: busybox
+            command: ["echo", "Scheduled"]
+          restartPolicy: Never`,
+			},
+			wantErr: false,
+		},
+		{
+			name: "apply network policy",
+			desc: "Test NetworkPolicy resource application",
+			manifests: []string{
+				`apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: test-network-policy
+  namespace: default
+spec:
+  podSelector:
+    matchLabels:
+      app: test
+  policyTypes:
+  - Ingress
+  - Egress
+  ingress:
+  - from:
+    - podSelector:
+        matchLabels:
+          app: frontend
+    ports:
+    - protocol: TCP
+      port: 8080`,
+			},
+			wantErr: false,
+		},
+		{
+			name: "apply horizontal pod autoscaler",
+			desc: "Test HorizontalPodAutoscaler resource application",
+			manifests: []string{
+				`apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: test-hpa
+  namespace: default
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: test-deployment
+  minReplicas: 1
+  maxReplicas: 10
+  metrics:
+  - type: Resource
+    resource:
+      name: cpu
+      target:
+        type: Utilization
+        averageUtilization: 80`,
+			},
+			wantErr: false,
+		},
+		{
+			name: "apply full application stack",
+			desc: "Test complete application with multiple resources",
+			manifests: []string{
+				`apiVersion: v1
+kind: Namespace
+metadata:
+  name: test-app
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: app-config
+  namespace: test-app
+data:
+  DATABASE_URL: postgresql://db:5432
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: app-secret
+  namespace: test-app
+type: Opaque
+stringData:
+  db-password: supersecret
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app-deployment
+  namespace: test-app
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: myapp
+  template:
+    metadata:
+      labels:
+        app: myapp
+    spec:
+      containers:
+      - name: app
+        image: nginx:latest
+        envFrom:
+        - configMapRef:
+            name: app-config
+        - secretRef:
+            name: app-secret
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: app-service
+  namespace: test-app
+spec:
+  selector:
+    app: myapp
+  ports:
+  - protocol: TCP
+    port: 80
+    targetPort: 8080`,
+			},
+			wantErr: false,
+		},
+		{
+			name: "apply multiple manifests separately",
+			desc: "Test applying multiple manifests in separate strings",
+			manifests: []string{
+				`apiVersion: v1
+kind: Namespace
+metadata:
+  name: multi-test`,
+				`apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: config1
+  namespace: multi-test
+data:
+  key: value1`,
+				`apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: config2
+  namespace: multi-test
+data:
+  key: value2`,
+			},
+			wantErr: false,
+		},
+		{
+			name: "empty manifest",
+			desc: "Test empty manifest handling",
+			manifests: []string{
+				"",
+			},
+			wantErr: false,
+		},
+		{
+			name: "multiple empty documents",
+			desc: "Test multiple empty documents separated by ---",
+			manifests: []string{
+				`---
+---
+---`,
+			},
+			wantErr: false,
+		},
+		{
+			name: "invalid yaml",
+			desc: "Test invalid YAML syntax handling",
+			manifests: []string{
+				`invalid: yaml: content: [unclosed`,
+			},
+			wantErr: true,
+			errMsg:  "failed to decode YAML",
+		},
+		{
+			name: "missing required fields",
+			desc: "Test manifest with missing kind field",
+			manifests: []string{
+				`apiVersion: v1
+metadata:
+  name: test`,
+			},
+			wantErr: true,
+			errMsg:  "failed to decode YAML", // Kubernetes returns decode error for missing required fields
+		},
+		{
+			name: "partial failure with multiple resources",
+			desc: "Test partial application with some invalid resources",
+			manifests: []string{
+				`apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: valid-config
+  namespace: default
+data:
+  key: value
+---
+invalid: yaml: [unclosed
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: another-valid-config
+  namespace: default
+data:
+  key: value2`,
+			},
+			wantErr: true,
+			errMsg:  "partially applied resources with errors",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Skip if no Kubernetes cluster is available
+			kubeconfig := skipIfNoKubeconfig(t)
+
+			// Create client with empty namespace to let manifest namespaces be used
+			// (simulates "use namespace from manifest" toggle being ON)
+			client, err := NewClient(&ClientAccess{}, "", kubeconfig, false)
+			if err != nil {
+				t.Fatalf("Failed to create client: %v", err)
+			}
+
+			// Register cleanup to delete resources after test completes
+			// This runs even if the test fails, ensuring cluster stays clean
+			if !tt.wantErr && len(tt.manifests) > 0 {
+				t.Cleanup(func() {
+					_, err := client.DeleteDynamic(t.Context(), tt.manifests)
+					if err != nil {
+						t.Logf("Warning: failed to cleanup resources: %v", err)
+					}
+				})
+			}
+
+			output, err := client.ApplyDynamic(t.Context(), tt.manifests)
+
+			if tt.wantErr {
+				if err == nil {
+					t.Errorf("ApplyDynamic() expected error but got none")
+				} else if tt.errMsg != "" && !strings.Contains(err.Error(), tt.errMsg) {
+					t.Errorf("ApplyDynamic() error = %v, want error containing %v", err, tt.errMsg)
+				}
+			} else {
+				if err != nil {
+					t.Errorf("ApplyDynamic() unexpected error = %v", err)
+				}
+				if output == "" && len(tt.manifests) > 0 && tt.manifests[0] != "" {
+					t.Errorf("ApplyDynamic() expected output but got empty string")
+				}
+			}
+		})
+	}
+}
+
+// newFakeDynamicClient creates a fake dynamic client that handles Server-Side Apply
+func newFakeDynamicClient() *fake.FakeDynamicClient {
+	client := fake.NewSimpleDynamicClient(runtime.NewScheme())
+	client.PrependReactor("patch", "*", func(action k8stesting.Action) (bool, runtime.Object, error) {
+		patchAction := action.(k8stesting.PatchAction)
+		if patchAction.GetPatchType() == types.ApplyPatchType {
+			obj := &unstructured.Unstructured{}
+			if err := obj.UnmarshalJSON(patchAction.GetPatch()); err != nil {
+				return true, nil, err
+			}
+			return true, obj, nil
+		}
+		return false, nil, nil
+	})
+	return client
+}
+
+// newTestMapper creates a simple RESTMapper for common resource types
+func newTestMapper() meta.RESTMapper {
+	mapper := meta.NewDefaultRESTMapper([]schema.GroupVersion{
+		{Group: "", Version: "v1"},
+		{Group: "apps", Version: "v1"},
+	})
+	mapper.Add(schema.GroupVersionKind{Version: "v1", Kind: "ConfigMap"}, meta.RESTScopeNamespace)
+	mapper.Add(schema.GroupVersionKind{Version: "v1", Kind: "Secret"}, meta.RESTScopeNamespace)
+	mapper.Add(schema.GroupVersionKind{Version: "v1", Kind: "Namespace"}, meta.RESTScopeRoot)
+	mapper.Add(schema.GroupVersionKind{Group: "apps", Version: "v1", Kind: "Deployment"}, meta.RESTScopeNamespace)
+	return mapper
+}
+
+// TestApplyResource unit tests for applyResource using fake client (no cluster needed)
+func TestApplyResource(t *testing.T) {
+	t.Parallel()
+	client := &Client{} // applyResource doesn't use Client fields directly
+	dynamicClient := newFakeDynamicClient()
+	mapper := newTestMapper()
+
+	tests := []struct {
+		name         string
+		yaml         string
+		configuredNS string
+		wantErr      bool
+		errContains  string
+	}{
+		{
+			name: "configmap with configured namespace",
+			yaml: `apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: test-cm
+data:
+  key: value`,
+			configuredNS: "my-ns",
+		},
+		{
+			name: "configmap with manifest namespace",
+			yaml: `apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: test-cm
+  namespace: manifest-ns
+data:
+  key: value`,
+			configuredNS: "",
+		},
+		{
+			name: "namespace conflict",
+			yaml: `apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: test-cm
+  namespace: manifest-ns`,
+			configuredNS: "form-ns",
+			wantErr:      true,
+			errContains:  "namespace conflict",
+		},
+		{
+			name: "namespaces match",
+			yaml: `apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: test-cm
+  namespace: same-ns`,
+			configuredNS: "same-ns",
+		},
+		{
+			name: "defaults to default namespace when neither set",
+			yaml: `apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: test-cm`,
+			configuredNS: "",
+		},
+		{
+			name: "cluster-scoped resource ignores namespace",
+			yaml: `apiVersion: v1
+kind: Namespace
+metadata:
+  name: new-ns`,
+			configuredNS: "ignored",
+		},
+		{
+			name:        "invalid yaml",
+			yaml:        "not: valid: yaml: {{",
+			wantErr:     true,
+			errContains: "failed to decode",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result, err := client.applyResource(t.Context(), dynamicClient, mapper, []byte(tt.yaml), tt.configuredNS)
+
+			if tt.wantErr {
+				if err == nil {
+					t.Errorf("expected error containing %q, got nil", tt.errContains)
+				} else if !strings.Contains(err.Error(), tt.errContains) {
+					t.Errorf("expected error containing %q, got %v", tt.errContains, err)
+				}
+				return
+			}
+			if err != nil {
+				t.Errorf("unexpected error: %v", err)
+				return
+			}
+			if result == "" {
+				t.Error("expected non-empty result")
+			}
+		})
+	}
+}
+
+func TestIsManifestFile(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name     string
+		resource string
+		want     bool
+	}{
+		{
+			name:     "yaml file",
+			resource: "deployment.yaml",
+			want:     true,
+		},
+		{
+			name:     "yml file",
+			resource: "deployment.yml",
+			want:     true,
+		},
+		{
+			name:     "yaml file with path",
+			resource: "/path/to/deployment.yaml",
+			want:     true,
+		},
+		{
+			name:     "yaml file with spaces",
+			resource: "  deployment.yaml  ",
+			want:     true,
+		},
+		{
+			name:     "not a file",
+			resource: "apiVersion: v1\nkind: Pod",
+			want:     false,
+		},
+		{
+			name:     "resource type",
+			resource: "deployment/my-deployment",
+			want:     false,
+		},
+		{
+			name:     "empty string",
+			resource: "",
+			want:     false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := isManifestFile(tt.resource); got != tt.want {
+				t.Errorf("isManifestFile() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
diff --git a/pkg/libkubectl/apply_test.go b/pkg/libkubectl/apply_test.go
new file mode 100644
index 0000000..6964388
--- /dev/null
+++ b/pkg/libkubectl/apply_test.go
@@ -0,0 +1,105 @@
+package libkubectl
+
+import (
+	"os"
+	"runtime"
+	"testing"
+
+	"github.com/portainer/portainer/api/filesystem"
+)
+
+// BenchmarkApply tests require a Kubernetes cluster.
+// BenchmarkApply measures the performance and memory allocation of the Apply function
+func BenchmarkApply(b *testing.B) {
+	kubeconfig := skipIfNoKubeconfig(b)
+
+	client, err := NewClient(&ClientAccess{}, "default", kubeconfig, false)
+	if err != nil {
+		b.Fatalf("Failed to create client: %v", err)
+	}
+
+	// Apply expects file paths, so create a temp file
+	tmpDir := b.TempDir()
+	manifestFile := filesystem.JoinPaths(tmpDir, "manifest.yaml")
+	manifestContent := `apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: benchmark-test-config
+  namespace: default
+data:
+  key: value`
+
+	if err := os.WriteFile(manifestFile, []byte(manifestContent), 0644); err != nil {
+		b.Fatalf("Failed to create manifest file: %v", err)
+	}
+
+	manifests := []string{manifestFile}
+
+	// Force GC and measure memory before benchmark
+	runtime.GC()
+	var memBefore runtime.MemStats
+	runtime.ReadMemStats(&memBefore)
+
+	for b.Loop() {
+		_, err := client.Apply(b.Context(), manifests)
+		if err != nil {
+			b.Errorf("Failed to apply manifests: %v", err)
+		}
+	}
+
+	// Force GC and measure memory after benchmark
+	runtime.GC()
+	var memAfter runtime.MemStats
+	runtime.ReadMemStats(&memAfter)
+
+	// Report retained memory (key metric for leak detection)
+	retained := int64(memAfter.Alloc) - int64(memBefore.Alloc)
+	retainedMB := float64(retained) / 1024 / 1024
+	b.ReportMetric(float64(retained), "B-retained")
+	b.ReportMetric(retainedMB, "MB-retained")
+}
+
+// BenchmarkApplyDynamic tests require a Kubernetes cluster.
+// BenchmarkApplyDynamic measures the performance and memory allocation of the ApplyDynamic function
+func BenchmarkApplyDynamic(b *testing.B) {
+	kubeconfig := skipIfNoKubeconfig(b)
+	client, err := NewClient(&ClientAccess{}, "default", kubeconfig, false)
+	if err != nil {
+		b.Fatalf("Failed to create client: %v", err)
+	}
+
+	manifests := []string{
+		`apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: benchmark-test-config
+  namespace: default
+data:
+  key: value`,
+	}
+
+	ctx := b.Context()
+
+	// Force GC and measure memory before benchmark
+	runtime.GC()
+	var memBefore runtime.MemStats
+	runtime.ReadMemStats(&memBefore)
+
+	for b.Loop() {
+		_, err := client.ApplyDynamic(ctx, manifests)
+		if err != nil {
+			b.Errorf("Failed to apply dynamic manifests: %v", err)
+		}
+	}
+
+	// Force GC and measure memory after benchmark
+	runtime.GC()
+	var memAfter runtime.MemStats
+	runtime.ReadMemStats(&memAfter)
+
+	// Report retained memory (key metric for leak detection)
+	retained := int64(memAfter.Alloc) - int64(memBefore.Alloc)
+	retainedMB := float64(retained) / 1024 / 1024
+	b.ReportMetric(float64(retained), "B-retained")
+	b.ReportMetric(retainedMB, "MB-retained")
+}
diff --git a/pkg/libkubectl/client.go b/pkg/libkubectl/client.go
new file mode 100644
index 0000000..e9a8895
--- /dev/null
+++ b/pkg/libkubectl/client.go
@@ -0,0 +1,69 @@
+package libkubectl
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+
+	"k8s.io/cli-runtime/pkg/genericclioptions"
+	"k8s.io/cli-runtime/pkg/genericiooptions"
+	"k8s.io/kubectl/pkg/cmd/util"
+)
+
+type ClientAccess struct {
+	Token     string
+	ServerUrl string
+}
+
+type Client struct {
+	factory util.Factory
+	streams genericclioptions.IOStreams
+	out     *bytes.Buffer
+}
+
+// NewClient creates a new kubectl client
+func NewClient(libKubectlAccess *ClientAccess, namespace, kubeconfig string, insecure bool) (*Client, error) {
+	configFlags, err := generateConfigFlags(libKubectlAccess.Token, libKubectlAccess.ServerUrl, namespace, kubeconfig, insecure)
+	if err != nil {
+		return nil, err
+	}
+
+	streams, _, out, _ := genericiooptions.NewTestIOStreams()
+
+	return &Client{
+		factory: util.NewFactory(configFlags),
+		streams: streams,
+		out:     out,
+	}, nil
+}
+
+// generateConfigFlags generates the config flags for the kubectl client
+// If kubeconfigPath is provided, it will be used instead of server and token
+// If server and token are provided, they will be used to connect to the cluster
+// If neither kubeconfigPath or server and token are provided, an error will be returned
+func generateConfigFlags(token, server, namespace, kubeconfigPath string, insecure bool) (*genericclioptions.ConfigFlags, error) {
+	if kubeconfigPath == "" && server == "" {
+		return nil, errors.New("must provide either a kubeconfig path or a server")
+	}
+
+	// Pass 'false' to usePersistentConfig to prevent memory leaks.
+	configFlags := genericclioptions.NewConfigFlags(false)
+	if namespace != "" {
+		configFlags.Namespace = &namespace
+	}
+
+	if kubeconfigPath != "" {
+		configFlags.KubeConfig = &kubeconfigPath
+	} else {
+		configFlags.APIServer = &server
+		configFlags.BearerToken = &token
+	}
+
+	configFlags.Insecure = &insecure
+
+	return configFlags, nil
+}
+
+func newKubectlFatalError(code int, msg string) error {
+	return fmt.Errorf("kubectl fatal error (exit code %d): %s", code, msg)
+}
diff --git a/pkg/libkubectl/client_test.go b/pkg/libkubectl/client_test.go
new file mode 100644
index 0000000..aaed28d
--- /dev/null
+++ b/pkg/libkubectl/client_test.go
@@ -0,0 +1,60 @@
+package libkubectl
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestGenerateConfigFlags(t *testing.T) {
+	t.Parallel()
+	config, err := generateConfigFlags("test-token", "https://api.example.com", "", "", false)
+	require.NoError(t, err)
+	require.NotNil(t, config)
+
+	_, err = generateConfigFlags("test-token", "", "", "", false)
+	require.Error(t, err)
+}
+
+func TestNewClient(t *testing.T) {
+	t.Parallel()
+	// Test with server and token
+	client, err := NewClient(&ClientAccess{
+		Token:     "test-token",
+		ServerUrl: "https://api.example.com",
+	}, "", "", false)
+	require.NoError(t, err)
+	require.NotNil(t, client)
+
+	// Verify the client has the expected structure for a Kubernetes client
+	require.NotNil(t, client.factory, "Expected factory to be set")
+	require.NotNil(t, client.streams, "Expected streams to be set")
+	require.NotNil(t, client.out, "Expected output buffer to be set")
+}
+
+func TestNewClientWithKubeconfig(t *testing.T) {
+	t.Parallel()
+	// Test with kubeconfig path
+	client, err := NewClient(&ClientAccess{
+		Token:     "",
+		ServerUrl: "",
+	}, "test-namespace", "/path/to/kubeconfig", true)
+	require.NoError(t, err)
+	require.NotNil(t, client)
+
+	// Verify the client has the expected structure for a Kubernetes client
+	require.NotNil(t, client.factory, "Expected factory to be set")
+	require.NotNil(t, client.streams, "Expected streams to be set")
+	require.NotNil(t, client.out, "Expected output buffer to be set")
+}
+
+func TestNewClientError(t *testing.T) {
+	t.Parallel()
+	// Test error case when both server and kubeconfig are empty
+	client, err := NewClient(&ClientAccess{
+		Token:     "",
+		ServerUrl: "",
+	}, "", "", false)
+	require.Error(t, err)
+	require.Nil(t, client)
+}
diff --git a/pkg/libkubectl/delete.go b/pkg/libkubectl/delete.go
new file mode 100644
index 0000000..2885759
--- /dev/null
+++ b/pkg/libkubectl/delete.go
@@ -0,0 +1,41 @@
+package libkubectl
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+
+	"k8s.io/kubectl/pkg/cmd/delete"
+	cmdutil "k8s.io/kubectl/pkg/cmd/util"
+)
+
+func (c *Client) Delete(ctx context.Context, manifests []string) (string, error) {
+	buf := new(bytes.Buffer)
+
+	var fatalErr error
+	cmdutil.BehaviorOnFatal(func(msg string, code int) {
+		fatalErr = newKubectlFatalError(code, msg)
+	})
+	defer cmdutil.DefaultBehaviorOnFatal()
+
+	cmd := delete.NewCmdDelete(c.factory, c.streams)
+	cmd.SetArgs(resourcesToArgs(manifests))
+
+	if err := cmd.Flags().Set("ignore-not-found", "true"); err != nil {
+		return "", fmt.Errorf("error setting ignore-not-found flag: %w", err)
+	}
+
+	cmd.SetOut(buf)
+
+	err := cmd.ExecuteContext(ctx)
+	// check for the fatal error first so we don't return the error from the command execution
+	if fatalErr != nil {
+		return "", fatalErr
+	}
+	// if there is no fatal error, return the error from the command execution
+	if err != nil {
+		return "", fmt.Errorf("error deleting resources: %w", err)
+	}
+
+	return buf.String(), nil
+}
diff --git a/pkg/libkubectl/delete_dynamic.go b/pkg/libkubectl/delete_dynamic.go
new file mode 100644
index 0000000..c147b00
--- /dev/null
+++ b/pkg/libkubectl/delete_dynamic.go
@@ -0,0 +1,159 @@
+package libkubectl
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"strings"
+
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/util/yaml"
+	"k8s.io/client-go/discovery"
+	"k8s.io/client-go/dynamic"
+	"k8s.io/client-go/restmapper"
+)
+
+// DeleteDynamic deletes Kubernetes resources using the dynamic client.
+// This is the counterpart to ApplyDynamic and can delete resources from inline YAML manifests.
+func (c *Client) DeleteDynamic(ctx context.Context, manifests []string) (string, error) {
+	// Create REST config from the factory
+	restConfig, err := c.factory.ToRESTConfig()
+	if err != nil {
+		return "", fmt.Errorf("failed to create REST config: %w", err)
+	}
+
+	// Create dynamic client
+	dynamicClient, err := dynamic.NewForConfig(restConfig)
+	if err != nil {
+		return "", fmt.Errorf("failed to create dynamic client: %w", err)
+	}
+
+	// Create discovery client for resource mapping
+	discoveryClient, err := discovery.NewDiscoveryClientForConfig(restConfig)
+	if err != nil {
+		return "", fmt.Errorf("failed to create discovery client: %w", err)
+	}
+
+	// Create REST mapper
+	groupResources, err := restmapper.GetAPIGroupResources(discoveryClient)
+	if err != nil {
+		return "", fmt.Errorf("failed to get API group resources: %w", err)
+	}
+	mapper := restmapper.NewDiscoveryRESTMapper(groupResources)
+
+	var results []string
+	var errs error
+
+	// Process each manifest
+	for _, manifest := range manifests {
+		manifest = strings.TrimSpace(manifest)
+		if manifest == "" {
+			continue
+		}
+
+		var content string
+		if isManifestFile(manifest) {
+			data, err := os.ReadFile(manifest)
+			if err != nil {
+				errs = errors.Join(errs, fmt.Errorf("failed to read file %s: %w", manifest, err))
+				continue
+			}
+			content = string(data)
+		} else {
+			content = manifest
+		}
+
+		// Split by document separator if multiple resources in one manifest
+		for resource := range strings.SplitSeq(content, "\n---\n") {
+			resource = strings.TrimSpace(resource)
+			if resource == "" {
+				continue
+			}
+
+			result, err := c.deleteResource(ctx, dynamicClient, mapper, []byte(resource))
+			if err != nil {
+				errs = errors.Join(errs, err)
+				continue
+			}
+			results = append(results, result)
+		}
+	}
+
+	// Build output message
+	output := strings.Join(results, "\n")
+
+	if errs != nil {
+		if len(results) == 0 {
+			return "", fmt.Errorf("failed to delete resources: %s", errs.Error())
+		}
+		return output, fmt.Errorf("partially deleted resources with errors: %s", errs.Error())
+	}
+
+	return output, nil
+}
+
+// deleteResource deletes a single resource
+func (c *Client) deleteResource(ctx context.Context, dynamicClient dynamic.Interface, mapper meta.RESTMapper, resourceYAML []byte) (string, error) {
+	// Decode YAML to unstructured object
+	obj := &unstructured.Unstructured{}
+	decoder := yaml.NewYAMLOrJSONDecoder(strings.NewReader(string(resourceYAML)), 4096)
+	if err := decoder.Decode(obj); err != nil {
+		// Ignore decode errors for empty documents
+		return "", nil
+	}
+
+	// Skip empty objects
+	if obj.Object == nil {
+		return "", nil
+	}
+
+	// Get GVK (GroupVersionKind) from the object
+	gvk := obj.GroupVersionKind()
+	if gvk.Empty() {
+		return "", nil
+	}
+
+	// Map GVK to GVR (GroupVersionResource)
+	mapping, err := mapper.RESTMapping(gvk.GroupKind(), gvk.Version)
+	if err != nil {
+		return "", fmt.Errorf("failed to map resource type %s: %w", gvk.String(), err)
+	}
+
+	// Get namespace (if applicable)
+	namespace := obj.GetNamespace()
+	name := obj.GetName()
+
+	// Get the dynamic resource client
+	var resourceClient dynamic.ResourceInterface
+	if mapping.Scope.Name() == meta.RESTScopeNameNamespace {
+		// Namespaced resource
+		if namespace == "" {
+			namespace = "default"
+		}
+		resourceClient = dynamicClient.Resource(mapping.Resource).Namespace(namespace)
+	} else {
+		// Cluster-scoped resource
+		resourceClient = dynamicClient.Resource(mapping.Resource)
+	}
+
+	// Delete the resource
+	// Use nil GracePeriodSeconds to respect the resource's default grace period (consistent with kubectl)
+	deleteOptions := metav1.DeleteOptions{}
+
+	err = resourceClient.Delete(ctx, name, deleteOptions)
+	if err != nil {
+		// Ignore not found errors (consistent with kubectl delete --ignore-not-found behavior)
+		if apierrors.IsNotFound(err) {
+			return fmt.Sprintf("%s/%s deleted (not found)", strings.ToLower(gvk.Kind), name), nil
+		}
+		return "", fmt.Errorf("failed to delete %s %s/%s: %w", gvk.Kind, namespace, name, err)
+	}
+
+	// Format output message (consistent with kubectl output format)
+	resourceType := strings.ToLower(gvk.Kind)
+	return fmt.Sprintf("%s/%s deleted", resourceType, name), nil
+}
diff --git a/pkg/libkubectl/delete_dynamic_test.go b/pkg/libkubectl/delete_dynamic_test.go
new file mode 100644
index 0000000..d0ef7cb
--- /dev/null
+++ b/pkg/libkubectl/delete_dynamic_test.go
@@ -0,0 +1,238 @@
+package libkubectl
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// TestDeleteDynamic tests require a Kubernetes cluster.
+//
+// Running the tests:
+//   - With cluster: go test -v ./pkg/libkubectl -run TestDeleteDynamic
+//   - Without cluster: Tests will skip automatically
+//
+// Test focus: Deletion logic and error handling, not resource type coverage.
+// Resource type coverage is handled by ApplyDynamic tests.
+
+func TestDeleteDynamic(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name      string
+		manifests []string
+		wantErr   bool
+		desc      string
+	}{
+		{
+			name: "delete simple resource",
+			desc: "Test basic resource deletion - happy path",
+			manifests: []string{
+				`apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: test-delete-config
+  namespace: default
+data:
+  key1: value1`,
+			},
+			wantErr: false,
+		},
+		{
+			name: "delete multiple resources in one manifest",
+			desc: "Test deletion with multiple resources separated by ---",
+			manifests: []string{
+				`apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: test-delete-config1
+  namespace: default
+data:
+  key: value1
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: test-delete-config2
+  namespace: default
+data:
+  key: value2`,
+			},
+			wantErr: false,
+		},
+		{
+			name: "missing metadata name",
+			desc: "Test manifest with missing name in metadata",
+			manifests: []string{
+				`apiVersion: v1
+kind: ConfigMap
+metadata:
+  namespace: default
+data:
+  key: value`,
+			},
+			wantErr: true,
+		},
+		{
+			name: "invalid resource type",
+			desc: "Test deletion with non-existent resource type",
+			manifests: []string{
+				`apiVersion: v1
+kind: NonExistentResourceType
+metadata:
+  name: test-invalid-type
+  namespace: default`,
+			},
+			wantErr: true,
+		},
+		{
+			name: "invalid apiVersion",
+			desc: "Test deletion with invalid apiVersion",
+			manifests: []string{
+				`apiVersion: invalid/v999
+kind: ConfigMap
+metadata:
+  name: test-invalid-apiversion
+  namespace: default`,
+			},
+			wantErr: true,
+		},
+		{
+			name: "partial failure with multiple resources",
+			desc: "Test partial deletion with some invalid resources",
+			manifests: []string{
+				`apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: valid-config-for-delete
+  namespace: default
+data:
+  key: value
+---
+apiVersion: invalid/v999
+kind: ConfigMap
+metadata:
+  name: invalid-apiversion
+  namespace: default
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: another-valid-config-for-delete
+  namespace: default
+data:
+  key: value2`,
+			},
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Skip if no Kubernetes cluster is available
+			kubeconfig := skipIfNoKubeconfig(t)
+
+			// Create client with empty namespace to let manifest namespaces be used
+			client, err := NewClient(&ClientAccess{}, "", kubeconfig, false)
+			require.NoError(t, err, "Failed to create client")
+
+			// For tests that expect to delete existing resources, create them first
+			// Only create resources for happy path tests
+			shouldCreate := !tt.wantErr
+
+			if shouldCreate {
+				// Create the resources first
+				_, err := client.ApplyDynamic(t.Context(), tt.manifests)
+				require.NoError(t, err, "Failed to create resources for deletion test")
+			}
+
+			// Test DeleteDynamic
+			output, err := client.DeleteDynamic(t.Context(), tt.manifests)
+
+			if tt.wantErr {
+				require.Error(t, err, "DeleteDynamic() expected error but got none")
+			} else {
+				require.NoError(t, err)
+				require.NotEmpty(t, output, "DeleteDynamic() expected output but got empty string")
+				require.Contains(t, output, "deleted", "DeleteDynamic() output should contain 'deleted'")
+			}
+		})
+	}
+}
+
+// TestDeleteDynamicAlreadyDeleted tests the behavior when deleting resources that were already deleted
+func TestDeleteDynamicAlreadyDeleted(t *testing.T) {
+	t.Parallel()
+	kubeconfig := skipIfNoKubeconfig(t)
+
+	manifest := []string{
+		`apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: test-double-delete
+  namespace: default
+data:
+  key: value`,
+	}
+
+	client, err := NewClient(&ClientAccess{}, "", kubeconfig, false)
+	require.NoError(t, err, "Failed to create client")
+
+	// Create the resource
+	_, err = client.ApplyDynamic(t.Context(), manifest)
+	require.NoError(t, err, "Failed to create resource")
+
+	// Delete it once
+	_, err = client.DeleteDynamic(t.Context(), manifest)
+	require.NoError(t, err, "First DeleteDynamic() failed")
+
+	// Delete it again (should succeed since DeleteDynamic ignores not found errors)
+	_, err = client.DeleteDynamic(t.Context(), manifest)
+	require.NoError(t, err, "Second DeleteDynamic() should not return error for already deleted resource")
+}
+
+// TestDeleteDynamicPartialFailure tests deletion when some resources fail
+func TestDeleteDynamicPartialFailure(t *testing.T) {
+	t.Parallel()
+	kubeconfig := skipIfNoKubeconfig(t)
+
+	client, err := NewClient(&ClientAccess{}, "", kubeconfig, false)
+	require.NoError(t, err, "Failed to create client")
+
+	// Create one valid resource
+	validManifest := []string{
+		`apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: test-partial-delete-valid
+  namespace: default
+data:
+  key: value`,
+	}
+
+	_, err = client.ApplyDynamic(t.Context(), validManifest)
+	require.NoError(t, err, "Failed to create resource")
+
+	t.Cleanup(func() {
+		_, err = client.DeleteDynamic(context.Background(), validManifest)
+		require.NoError(t, err, "Cleanup DeleteDynamic() failed")
+	})
+
+	// Try to delete valid resource + non-existent resource
+	mixedManifests := []string{
+		`apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: test-partial-delete-valid
+  namespace: default
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: non-existent-resource-xyz
+  namespace: default`,
+	}
+
+	_, err = client.DeleteDynamic(t.Context(), mixedManifests)
+	require.NoError(t, err, "DeleteDynamic() should handle non-existent resources gracefully")
+}
diff --git a/pkg/libkubectl/delete_test.go b/pkg/libkubectl/delete_test.go
new file mode 100644
index 0000000..c07dbf1
--- /dev/null
+++ b/pkg/libkubectl/delete_test.go
@@ -0,0 +1,138 @@
+package libkubectl
+
+import (
+	"os"
+	"runtime"
+	"testing"
+
+	"github.com/portainer/portainer/api/filesystem"
+)
+
+// BenchmarkDeleteDynamic tests require a Kubernetes cluster.
+// BenchmarkDeleteDynamic measures the performance and memory allocation of the DeleteDynamic function.
+// The resource is recreated before each delete (using StopTimer/StartTimer to exclude setup time),
+// so all iterations measure actual delete performance, not "not found" handling.
+func BenchmarkDeleteDynamic(b *testing.B) {
+	kubeconfig := skipIfNoKubeconfig(b)
+	client, err := NewClient(&ClientAccess{}, "default", kubeconfig, false)
+	if err != nil {
+		b.Fatalf("Failed to create client: %v", err)
+	}
+
+	manifests := []string{
+		`apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: benchmark-delete-test-config
+  namespace: default
+data:
+  key: value`,
+	}
+
+	// Apply the manifest once BEFORE the benchmark loop
+	_, err = client.ApplyDynamic(b.Context(), manifests)
+	if err != nil {
+		b.Fatalf("Failed to apply initial manifest: %v", err)
+	}
+
+	// Force GC and measure memory before benchmark
+	runtime.GC()
+	var memBefore runtime.MemStats
+	runtime.ReadMemStats(&memBefore)
+
+	for b.Loop() {
+		// Recreate the resource before each delete to ensure it always exists
+		b.StopTimer()
+		_, err = client.ApplyDynamic(b.Context(), manifests)
+		if err != nil {
+			b.Fatalf("Failed to apply manifest: %v", err)
+		}
+		b.StartTimer()
+
+		// Delete the resource (always exists)
+		_, err = client.DeleteDynamic(b.Context(), manifests)
+		if err != nil {
+			b.Errorf("Failed to delete dynamic manifests: %v", err)
+		}
+	}
+
+	// Force GC and measure memory after benchmark
+	runtime.GC()
+	var memAfter runtime.MemStats
+	runtime.ReadMemStats(&memAfter)
+
+	// Report retained memory (key metric for leak detection)
+	retained := int64(memAfter.Alloc) - int64(memBefore.Alloc)
+	retainedMB := float64(retained) / 1024 / 1024
+	b.ReportMetric(float64(retained), "B-retained")
+	b.ReportMetric(retainedMB, "MB-retained")
+}
+
+// BenchmarkDelete tests require a Kubernetes cluster.
+// BenchmarkDelete measures the performance and memory allocation of the Delete function.
+// The resource is recreated before each delete (using StopTimer/StartTimer to exclude setup time),
+// so all iterations measure actual delete performance, not "not found" handling.
+func BenchmarkDelete(b *testing.B) {
+	kubeconfig := skipIfNoKubeconfig(b)
+
+	client, err := NewClient(&ClientAccess{}, "default", kubeconfig, false)
+	if err != nil {
+		b.Fatalf("Failed to create client: %v", err)
+	}
+
+	// Delete expects file paths, so create a temp file
+	tmpDir := b.TempDir()
+	manifestFile := filesystem.JoinPaths(tmpDir, "manifest.yaml")
+	manifestContent := `apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: benchmark-delete-file-test-config
+  namespace: default
+data:
+  key: value`
+
+	if err := os.WriteFile(manifestFile, []byte(manifestContent), 0644); err != nil {
+		b.Fatalf("Failed to create manifest file: %v", err)
+	}
+
+	manifests := []string{manifestFile}
+	manifestsInline := []string{manifestContent}
+
+	// Apply the manifest once BEFORE the benchmark loop using ApplyDynamic
+	_, err = client.ApplyDynamic(b.Context(), manifestsInline)
+	if err != nil {
+		b.Fatalf("Failed to apply initial manifest: %v", err)
+	}
+
+	// Force GC and measure memory before benchmark
+	runtime.GC()
+	var memBefore runtime.MemStats
+	runtime.ReadMemStats(&memBefore)
+
+	for b.Loop() {
+		// Recreate the resource before each delete to ensure it always exists
+		b.StopTimer()
+		_, err = client.ApplyDynamic(b.Context(), manifestsInline)
+		if err != nil {
+			b.Fatalf("Failed to apply manifest: %v", err)
+		}
+		b.StartTimer()
+
+		// Delete the resource using Delete (file-based, always exists)
+		_, err = client.Delete(b.Context(), manifests)
+		if err != nil {
+			b.Errorf("Failed to delete manifests: %v", err)
+		}
+	}
+
+	// Force GC and measure memory after benchmark
+	runtime.GC()
+	var memAfter runtime.MemStats
+	runtime.ReadMemStats(&memAfter)
+
+	// Report retained memory (key metric for leak detection)
+	retained := int64(memAfter.Alloc) - int64(memBefore.Alloc)
+	retainedMB := float64(retained) / 1024 / 1024
+	b.ReportMetric(float64(retained), "B-retained")
+	b.ReportMetric(retainedMB, "MB-retained")
+}
diff --git a/pkg/libkubectl/describe.go b/pkg/libkubectl/describe.go
new file mode 100644
index 0000000..19588f6
--- /dev/null
+++ b/pkg/libkubectl/describe.go
@@ -0,0 +1,40 @@
+package libkubectl
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	"k8s.io/cli-runtime/pkg/resource"
+	describecmd "k8s.io/kubectl/pkg/cmd/describe"
+	cmdutil "k8s.io/kubectl/pkg/cmd/util"
+	"k8s.io/kubectl/pkg/describe"
+)
+
+// Describe returns the description of a resource
+// name is the name of the resource, kind is the kind of the resource, and namespace is the namespace of the resource
+// this is identical to running `kubectl describe <kind> <name> --namespace <namespace>`
+func (c *Client) Describe(namespace, name, kind string) (string, error) {
+	describeOptions := &describecmd.DescribeOptions{
+		BuilderArgs: []string{kind, name},
+		Describer: func(mapping *meta.RESTMapping) (describe.ResourceDescriber, error) {
+			return describe.DescriberFn(c.factory, mapping)
+		},
+		FilenameOptions: &resource.FilenameOptions{},
+		DescriberSettings: &describe.DescriberSettings{
+			ShowEvents: true,
+			ChunkSize:  cmdutil.DefaultChunkSize,
+		},
+		IOStreams:  c.streams,
+		NewBuilder: c.factory.NewBuilder,
+	}
+
+	if namespace != "" {
+		describeOptions.Namespace = namespace
+	}
+
+	if err := describeOptions.Run(); err != nil {
+		return "", fmt.Errorf("error describing resources: %w", err)
+	}
+
+	return c.out.String(), nil
+}
diff --git a/pkg/libkubectl/drain.go b/pkg/libkubectl/drain.go
new file mode 100644
index 0000000..422b84e
--- /dev/null
+++ b/pkg/libkubectl/drain.go
@@ -0,0 +1,109 @@
+package libkubectl
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/rs/zerolog/log"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/kubectl/pkg/cmd/util"
+	"k8s.io/kubectl/pkg/drain"
+)
+
+// DrainNode drains a node from the cluster
+func (c *Client) DrainNode(nodeName string) (string, error) {
+	log.Debug().
+		Str("context", "libkubectl").
+		Str("node_name", nodeName).
+		Msg("Starting node drain operation")
+
+	buf := new(bytes.Buffer)
+
+	// Get clientset from factory
+	clientset, err := c.factory.KubernetesClientSet()
+	if err != nil {
+		log.Error().
+			Str("context", "libkubectl").
+			Str("node_name", nodeName).
+			Err(err).
+			Msg("Failed to get kubernetes clientset for node drain")
+		return "", fmt.Errorf("failed to get kubernetes clientset for node drain: %w", err)
+	}
+
+	log.Debug().
+		Str("context", "libkubectl").
+		Str("node_name", nodeName).
+		Msg("Successfully obtained kubernetes clientset")
+
+	drainer := &drain.Helper{
+		Ctx:                 context.Background(),
+		Client:              clientset,
+		Force:               false,            // Don't force delete standalone pods
+		GracePeriodSeconds:  -1,               // Use pod's own grace period
+		IgnoreAllDaemonSets: true,             // Skip DaemonSet pods
+		Timeout:             60 * time.Second, // Overall timeout
+		DeleteEmptyDirData:  true,             // Delete pods with emptyDir
+		DisableEviction:     false,            // Use eviction API when possible
+		Out:                 buf,
+		ErrOut:              buf,
+		DryRunStrategy:      util.DryRunNone,
+	}
+
+	log.Debug().
+		Str("context", "libkubectl").
+		Str("node_name", nodeName).
+		Bool("force", drainer.Force).
+		Bool("ignore_daemon_sets", drainer.IgnoreAllDaemonSets).
+		Dur("timeout", drainer.Timeout).
+		Msg("Configured drain helper")
+
+	// Get the node first
+	node, err := clientset.CoreV1().Nodes().Get(context.Background(), nodeName, metav1.GetOptions{})
+	if err != nil {
+		log.Error().
+			Str("context", "libkubectl").
+			Str("node_name", nodeName).
+			Err(err).
+			Msg("Failed to retrieve node for drain operation")
+		return "", fmt.Errorf("failed to get node %s for drain operation: %w", nodeName, err)
+	}
+
+	log.Debug().
+		Str("context", "libkubectl").
+		Str("node_name", nodeName).
+		Msg("Successfully retrieved node, proceeding to cordon")
+
+	// First cordon the node
+	if err := drain.RunCordonOrUncordon(drainer, node, true); err != nil {
+		log.Error().
+			Str("context", "libkubectl").
+			Str("node_name", nodeName).
+			Err(err).
+			Msg("Failed to cordon node during drain operation")
+		return "", fmt.Errorf("failed to cordon node %s during drain operation: %w", nodeName, err)
+	}
+
+	log.Debug().
+		Str("context", "libkubectl").
+		Str("node_name", nodeName).
+		Msg("Successfully cordoned node, proceeding to drain")
+
+	// Then drain it
+	if err := drain.RunNodeDrain(drainer, nodeName); err != nil {
+		log.Error().
+			Str("context", "libkubectl").
+			Str("node_name", nodeName).
+			Err(err).
+			Msg("Failed to drain node")
+		return "", fmt.Errorf("failed to drain node %s: %w", nodeName, err)
+	}
+
+	log.Debug().
+		Str("context", "libkubectl").
+		Str("node_name", nodeName).
+		Msg("Successfully completed node drain operation")
+
+	return buf.String(), nil
+}
diff --git a/pkg/libkubectl/resource.go b/pkg/libkubectl/resource.go
new file mode 100644
index 0000000..7055605
--- /dev/null
+++ b/pkg/libkubectl/resource.go
@@ -0,0 +1,20 @@
+package libkubectl
+
+import "strings"
+
+func isManifestFile(resource string) bool {
+	trimmedResource := strings.TrimSpace(resource)
+	return strings.HasSuffix(trimmedResource, ".yaml") || strings.HasSuffix(trimmedResource, ".yml")
+}
+
+func resourcesToArgs(resources []string) []string {
+	args := []string{}
+	for _, resource := range resources {
+		if isManifestFile(resource) {
+			args = append(args, "-f", strings.TrimSpace(resource))
+		} else {
+			args = append(args, resource)
+		}
+	}
+	return args
+}
diff --git a/pkg/libkubectl/resource_test.go b/pkg/libkubectl/resource_test.go
new file mode 100644
index 0000000..b8199bd
--- /dev/null
+++ b/pkg/libkubectl/resource_test.go
@@ -0,0 +1,54 @@
+package libkubectl
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestResourcesToArgsHelper(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name         string
+		resources    []string
+		expectedArgs []string
+	}{
+		{
+			name:         "empty list",
+			resources:    []string{},
+			expectedArgs: []string{},
+		},
+		{
+			name:         "single manifest file",
+			resources:    []string{"manifest.yaml"},
+			expectedArgs: []string{"-f", "manifest.yaml"},
+		},
+		{
+			name:         "multiple manifest files",
+			resources:    []string{"manifest1.yaml", "manifest2.yaml"},
+			expectedArgs: []string{"-f", "manifest1.yaml", "-f", "manifest2.yaml"},
+		},
+		{
+			name:         "manifests with whitespace",
+			resources:    []string{" manifest1.yaml ", "  manifest2.yaml"},
+			expectedArgs: []string{"-f", "manifest1.yaml", "-f", "manifest2.yaml"},
+		},
+		{
+			name:         "kubernetes resource definitions",
+			resources:    []string{"deployment/nginx", "service/web"},
+			expectedArgs: []string{"deployment/nginx", "service/web"},
+		},
+		{
+			name:         "rollout restart",
+			resources:    []string{"deployment/nginx", "service/web"},
+			expectedArgs: []string{"deployment/nginx", "service/web"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			args := resourcesToArgs(tt.resources)
+			assert.Equal(t, tt.expectedArgs, args)
+		})
+	}
+}
diff --git a/pkg/libkubectl/restart.go b/pkg/libkubectl/restart.go
new file mode 100644
index 0000000..9ce7149
--- /dev/null
+++ b/pkg/libkubectl/restart.go
@@ -0,0 +1,39 @@
+package libkubectl
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+
+	"k8s.io/kubectl/pkg/cmd/rollout"
+	cmdutil "k8s.io/kubectl/pkg/cmd/util"
+)
+
+func (c *Client) RolloutRestart(ctx context.Context, manifests []string) (string, error) {
+	buf := new(bytes.Buffer)
+
+	var fatalErr error
+	cmdutil.BehaviorOnFatal(func(msg string, code int) {
+		fatalErr = newKubectlFatalError(code, msg)
+	})
+	defer cmdutil.DefaultBehaviorOnFatal()
+
+	cmd := rollout.NewCmdRollout(c.factory, c.streams)
+	args := []string{"restart"}
+	args = append(args, resourcesToArgs(manifests)...)
+
+	cmd.SetArgs(args)
+	cmd.SetOut(buf)
+
+	err := cmd.ExecuteContext(ctx)
+	// check for the fatal error first so we don't return the error from the command execution
+	if fatalErr != nil {
+		return "", fatalErr
+	}
+	// if there is no fatal error, return the error from the command execution
+	if err != nil {
+		return "", fmt.Errorf("error restarting resources: %w", err)
+	}
+
+	return buf.String(), nil
+}
diff --git a/pkg/liboras/dummy_manifest.go b/pkg/liboras/dummy_manifest.go
new file mode 100644
index 0000000..53576fa
--- /dev/null
+++ b/pkg/liboras/dummy_manifest.go
@@ -0,0 +1,151 @@
+package liboras
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/opencontainers/go-digest"
+	"github.com/opencontainers/image-spec/specs-go"
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	"github.com/rs/zerolog/log"
+	"github.com/segmentio/encoding/json"
+	"oras.land/oras-go/v2/registry/remote"
+)
+
+// generateMinimalManifest creates a minimal OCI manifest with empty config and no layers
+func generateMinimalManifest() (*ocispec.Manifest, []byte, error) {
+	// Create empty config blob
+	emptyConfig := []byte("{}")
+	configDescriptor := ocispec.Descriptor{
+		MediaType: "application/vnd.oci.image.config.v1+json",
+		Digest:    digest.FromBytes(emptyConfig), // sha256 of empty JSON object "{}"
+		Size:      int64(len(emptyConfig)),
+	}
+
+	// Create minimal manifest with no layers
+	manifest := &ocispec.Manifest{
+		Versioned: specs.Versioned{
+			SchemaVersion: 2,
+		},
+		MediaType: "application/vnd.oci.image.manifest.v1+json",
+		Config:    configDescriptor,
+		Layers:    []ocispec.Descriptor{}, // Empty layers array
+	}
+
+	// Marshal manifest to JSON
+	manifestBytes, err := json.Marshal(manifest)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to marshal dummy manifest: %w", err)
+	}
+
+	return manifest, manifestBytes, nil
+}
+
+// CreateDummyManifest creates a minimal dummy manifest in the repository and returns its digest
+func CreateDummyManifest(registryClient *remote.Registry, repository string) (string, error) {
+	ctx := context.Background()
+
+	// Get repository handle
+	repo, err := registryClient.Repository(ctx, repository)
+	if err != nil {
+		return "", fmt.Errorf("failed to get repository handle: %w", err)
+	}
+
+	// Generate minimal manifest
+	manifest, manifestBytes, err := generateMinimalManifest()
+	if err != nil {
+		return "", fmt.Errorf("failed to generate minimal manifest: %w", err)
+	}
+
+	// First, push the empty config blob
+	emptyConfig := []byte("{}")
+	configReader := bytes.NewReader(emptyConfig)
+	configDescriptor := ocispec.Descriptor{
+		MediaType: "application/vnd.oci.image.config.v1+json",
+		Digest:    digest.FromBytes(emptyConfig),
+		Size:      int64(len(emptyConfig)),
+	}
+
+	err = repo.Blobs().Push(ctx, configDescriptor, configReader)
+	if err != nil {
+		return "", fmt.Errorf("failed to push config blob: %w", err)
+	}
+
+	// Then push the manifest with a temporary tag
+	manifestReader := bytes.NewReader(manifestBytes)
+	manifestDescriptor := ocispec.Descriptor{
+		MediaType: manifest.MediaType,
+		Size:      int64(len(manifestBytes)),
+		Digest:    digest.FromBytes(manifestBytes),
+	}
+
+	// Use a unique temporary tag name for the dummy manifest
+	dummyTag := fmt.Sprintf("__portainer_dummy_%d", time.Now().UnixNano())
+
+	err = repo.Manifests().PushReference(ctx, manifestDescriptor, manifestReader, dummyTag)
+	if err != nil {
+		return "", fmt.Errorf("failed to push dummy manifest: %w", err)
+	}
+
+	// Return the manifest digest directly from what we calculated
+	return manifestDescriptor.Digest.String(), nil
+}
+
+// PointTagToDummy updates a tag to point to the dummy manifest
+func PointTagToDummy(registryClient *remote.Registry, repository, tagName, dummyDigest string) error {
+	// Generate the same minimal manifest content
+	_, manifestBytes, err := generateMinimalManifest()
+	if err != nil {
+		return fmt.Errorf("failed to generate minimal manifest: %w", err)
+	}
+
+	return AddTagToManifest(registryClient, repository, tagName, dummyDigest, manifestBytes)
+}
+
+// SafeDeleteTags safely deletes multiple tags without affecting others pointing to the same manifest
+func SafeDeleteTags(registryClient *remote.Registry, repository string, tagsToDelete []string) error {
+	if len(tagsToDelete) == 0 {
+		return nil
+	}
+
+	// Create a dummy manifest for all tags to delete
+	dummyDigest, err := CreateDummyManifest(registryClient, repository)
+	if err != nil {
+		return fmt.Errorf("failed to create dummy manifest: %w", err)
+	}
+
+	// Point all tags to the same dummy manifest
+	for _, tagToDelete := range tagsToDelete {
+		err = PointTagToDummy(registryClient, repository, tagToDelete, dummyDigest)
+		if err != nil {
+			// Cleanup: delete dummy manifest on failure
+			cleanupErr := DeleteManifestByDigest(registryClient, repository, dummyDigest)
+			if cleanupErr != nil {
+				log.Warn().
+					Err(cleanupErr).
+					Str("repository", repository).
+					Str("tag", tagToDelete).
+					Str("digest", dummyDigest).
+					Msg("Failed to cleanup dummy manifest after tag pointing error")
+				return fmt.Errorf("failed to point tag %s to dummy: %w (cleanup also failed: %w)", tagToDelete, err, cleanupErr)
+			}
+			return fmt.Errorf("failed to point tag %s to dummy: %w", tagToDelete, err)
+		}
+	}
+
+	// Delete the dummy manifest (removes ALL pointed tags safely)
+	err = DeleteManifestByDigest(registryClient, repository, dummyDigest)
+	if err != nil {
+		log.Error().
+			Err(err).
+			Str("repository", repository).
+			Str("digest", dummyDigest).
+			Int("tag_count", len(tagsToDelete)).
+			Msg("Failed to delete dummy manifest containing tags")
+		return fmt.Errorf("failed to delete dummy manifest: %w", err)
+	}
+
+	return nil
+}
diff --git a/pkg/liboras/dummy_manifest_test.go b/pkg/liboras/dummy_manifest_test.go
new file mode 100644
index 0000000..4b4f64a
--- /dev/null
+++ b/pkg/liboras/dummy_manifest_test.go
@@ -0,0 +1,172 @@
+package liboras
+
+import (
+	"crypto/sha256"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"oras.land/oras-go/v2/registry/remote"
+)
+
+func TestGenerateMinimalManifest(t *testing.T) {
+	t.Parallel()
+	t.Run("creates consistent manifest", func(t *testing.T) {
+		manifest1, bytes1, err1 := generateMinimalManifest()
+		require.NoError(t, err1)
+		require.NotNil(t, manifest1)
+		require.NotNil(t, bytes1)
+
+		manifest2, bytes2, err2 := generateMinimalManifest()
+		require.NoError(t, err2)
+		require.NotNil(t, manifest2)
+		require.NotNil(t, bytes2)
+
+		// Manifests should be identical
+		assert.Equal(t, manifest1, manifest2)
+		assert.Equal(t, bytes1, bytes2)
+	})
+
+	t.Run("has correct media type", func(t *testing.T) {
+		manifest, _, err := generateMinimalManifest()
+		require.NoError(t, err)
+
+		expectedMediaType := "application/vnd.oci.image.manifest.v1+json"
+		assert.Equal(t, expectedMediaType, manifest.MediaType)
+	})
+}
+
+func TestSafeDeleteTags(t *testing.T) {
+	t.Parallel()
+	t.Run("handles empty tag list", func(t *testing.T) {
+		// Test the early return path - this should not call any registry operations
+		err := SafeDeleteTags(nil, "test-repo", []string{})
+		require.NoError(t, err, "Empty tag list should return without error")
+	})
+
+	t.Run("handles nil tag list", func(t *testing.T) {
+		// Test the early return path - this should not call any registry operations
+		err := SafeDeleteTags(nil, "test-repo", nil)
+		require.NoError(t, err, "Nil tag list should return without error")
+	})
+
+	t.Run("single tag deletion", func(t *testing.T) {
+		// Track the actual HTTP requests made to verify correct method calls and arguments
+		var requests []string
+		var configBlobPushed bool
+		var manifestPushed bool
+		var tagUpdated bool
+		var manifestDeleted bool
+		var dummyManifestDigest string // Store the digest of the dummy manifest created
+
+		// Create a mock registry server that handles the OCI registry API endpoints
+		ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			requests = append(requests, fmt.Sprintf("%s %s", r.Method, r.URL.Path))
+
+			switch {
+			// Handle blob uploads (for dummy manifest config)
+			case strings.HasPrefix(r.URL.Path, "/v2/test-repo/blobs/uploads/") && r.Method == "POST":
+				w.Header().Set("Location", "/v2/test-repo/blobs/uploads/uuid")
+				w.WriteHeader(http.StatusAccepted)
+
+			case strings.HasPrefix(r.URL.Path, "/v2/test-repo/blobs/uploads/") && r.Method == "PUT":
+				configBlobPushed = true
+				w.Header().Set("Docker-Content-Digest", "sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a")
+				w.WriteHeader(http.StatusCreated)
+
+			// Handle blob existence check
+			case strings.HasPrefix(r.URL.Path, "/v2/test-repo/blobs/sha256:") && r.Method == "HEAD":
+				w.Header().Set("Content-Length", "2")
+				w.Header().Set("Docker-Content-Digest", r.URL.Path[len("/v2/test-repo/blobs/"):])
+				w.WriteHeader(http.StatusOK)
+
+			// Handle manifest operations
+			case strings.HasPrefix(r.URL.Path, "/v2/test-repo/manifests/"):
+				if r.Method == "PUT" {
+					// Read the manifest content to calculate the correct digest
+					body, err := io.ReadAll(r.Body)
+					if err != nil {
+						w.WriteHeader(http.StatusInternalServerError)
+						return
+					}
+
+					// Calculate the SHA256 digest of the manifest content
+					hash := sha256.Sum256(body)
+					manifestDigest := fmt.Sprintf("sha256:%x", hash)
+
+					if strings.Contains(r.URL.Path, "__portainer_dummy_") {
+						manifestPushed = true
+						dummyManifestDigest = manifestDigest // Store the dummy manifest digest
+					} else if strings.Contains(r.URL.Path, "v1.0.0") {
+						tagUpdated = true
+					}
+					w.Header().Set("Docker-Content-Digest", manifestDigest)
+					w.WriteHeader(http.StatusCreated)
+
+				} else if r.Method == "DELETE" {
+					manifestDeleted = true
+
+					// Extract and validate the digest being deleted
+					digestPath := strings.TrimPrefix(r.URL.Path, "/v2/test-repo/manifests/")
+
+					// Verify that the digest being deleted matches the dummy manifest digest
+					if dummyManifestDigest != "" && digestPath != dummyManifestDigest {
+						t.Errorf("DELETE digest mismatch: expected %s, got %s", dummyManifestDigest, digestPath)
+					}
+
+					w.WriteHeader(http.StatusAccepted)
+
+				} else if r.Method == "GET" {
+					// Return a minimal manifest for GET requests
+					w.Header().Set("Content-Type", "application/vnd.oci.image.manifest.v1+json")
+					_, _ = w.Write([]byte(`{"schemaVersion":2,"mediaType":"application/vnd.oci.image.manifest.v1+json","config":{"mediaType":"application/vnd.oci.image.config.v1+json","digest":"sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a","size":2},"layers":[]}`))
+				}
+
+			// Handle repository operations
+			case r.URL.Path == "/v2/" && r.Method == "GET":
+				w.WriteHeader(http.StatusOK)
+
+			default:
+				t.Logf("Unexpected request: %s %s", r.Method, r.URL.Path)
+				w.WriteHeader(http.StatusNotFound)
+			}
+		}))
+		defer ts.Close()
+
+		// Create a registry client pointing to our test server
+		registry, err := remote.NewRegistry(strings.TrimPrefix(ts.URL, "http://"))
+		require.NoError(t, err)
+		registry.PlainHTTP = true // Use HTTP for testing
+
+		// Test SafeDeleteTags with a single tag
+		repository := "test-repo"
+		tagsToDelete := []string{"v1.0.0"}
+
+		err = SafeDeleteTags(registry, repository, tagsToDelete)
+		require.NoError(t, err)
+
+		// Verify the expected sequence of HTTP calls was made
+		assert.True(t, configBlobPushed, "Config blob should be pushed for dummy manifest")
+		assert.True(t, manifestPushed, "Dummy manifest should be pushed with temporary tag")
+		assert.True(t, tagUpdated, "Tag v1.0.0 should be updated to point to dummy manifest")
+		assert.True(t, manifestDeleted, "Dummy manifest should be deleted to remove the tag")
+
+		// Verify that we captured the dummy manifest digest
+		assert.NotEmpty(t, dummyManifestDigest, "Dummy manifest digest should be captured")
+		assert.True(t, strings.HasPrefix(dummyManifestDigest, "sha256:"), "Dummy manifest digest should be a SHA256 digest")
+
+		// Verify the correct repository was used in all calls
+		for _, req := range requests {
+			if strings.Contains(req, "/v2/") && !strings.Contains(req, "/v2/test-repo") && !strings.Contains(req, "/v2/") {
+				assert.Contains(t, req, "test-repo", "All repository operations should use correct repository name")
+			}
+		}
+
+		t.Logf("HTTP requests made: %v", requests)
+	})
+}
diff --git a/pkg/liboras/generic_listrepo_client.go b/pkg/liboras/generic_listrepo_client.go
new file mode 100644
index 0000000..a99587c
--- /dev/null
+++ b/pkg/liboras/generic_listrepo_client.go
@@ -0,0 +1,47 @@
+package liboras
+
+import (
+	"context"
+	"errors"
+
+	portainer "github.com/portainer/portainer/api"
+	"oras.land/oras-go/v2/registry/remote"
+)
+
+// GenericListRepoClient implements RepositoryListClient for standard OCI registries
+// This client handles repository listing for registries that follow the standard OCI distribution spec
+type GenericListRepoClient struct {
+	registry       *portainer.Registry
+	registryClient *remote.Registry
+}
+
+// NewGenericListRepoClient creates a new generic repository listing client
+func NewGenericListRepoClient(registry *portainer.Registry) *GenericListRepoClient {
+	return &GenericListRepoClient{
+		registry: registry,
+		// registryClient will be set when needed
+	}
+}
+
+// SetRegistryClient sets the ORAS registry client for repository listing operations
+func (c *GenericListRepoClient) SetRegistryClient(registryClient *remote.Registry) {
+	c.registryClient = registryClient
+}
+
+// ListRepositories fetches repositories from a standard OCI registry using ORAS
+func (c *GenericListRepoClient) ListRepositories(ctx context.Context) ([]string, error) {
+	if c.registryClient == nil {
+		return nil, errors.New("registry client not initialized for repository listing")
+	}
+
+	var repositories []string
+	err := c.registryClient.Repositories(ctx, "", func(repos []string) error {
+		repositories = append(repositories, repos...)
+		return nil
+	})
+	if err != nil {
+		return nil, errors.New("failed to list repositories")
+	}
+
+	return repositories, nil
+}
diff --git a/pkg/liboras/github_listrepo_client.go b/pkg/liboras/github_listrepo_client.go
new file mode 100644
index 0000000..e80789b
--- /dev/null
+++ b/pkg/liboras/github_listrepo_client.go
@@ -0,0 +1,57 @@
+package liboras
+
+import (
+	"context"
+	"fmt"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/proxy/factory/github"
+	"github.com/rs/zerolog/log"
+)
+
+// GithubListRepoClient implements RepositoryListClient specifically for GitHub registries
+// This client handles the GitHub Packages API's unique repository listing implementation
+type GithubListRepoClient struct {
+	registry *portainer.Registry
+	client   *github.Client
+}
+
+// NewGithubListRepoClient creates a new GitHub repository listing client
+func NewGithubListRepoClient(registry *portainer.Registry) *GithubListRepoClient {
+	// Prefer the management configuration credentials when available
+	token := registry.Password
+	if registry.ManagementConfiguration != nil && registry.ManagementConfiguration.Password != "" {
+		token = registry.ManagementConfiguration.Password
+	}
+
+	client := github.NewClient(token)
+
+	return &GithubListRepoClient{
+		registry: registry,
+		client:   client,
+	}
+}
+
+// ListRepositories fetches repositories from a GitHub registry using the GitHub Packages API
+func (c *GithubListRepoClient) ListRepositories(ctx context.Context) ([]string, error) {
+	repositories, err := c.client.GetContainerPackages(
+		ctx,
+		c.registry.Github.UseOrganisation,
+		c.registry.Github.OrganisationName,
+	)
+	if err != nil {
+		log.Error().
+			Str("registry_name", c.registry.Name).
+			Err(err).
+			Msg("Failed to list GitHub repositories")
+		return nil, fmt.Errorf("failed to list GitHub repositories: %w", err)
+	}
+
+	log.Debug().
+		Bool("use_organisation", c.registry.Github.UseOrganisation).
+		Str("organisation_name", c.registry.Github.OrganisationName).
+		Int("repository_count", len(repositories)).
+		Msg("Successfully listed GitHub repositories")
+
+	return repositories, nil
+}
diff --git a/pkg/liboras/gitlab_listrepo_client.go b/pkg/liboras/gitlab_listrepo_client.go
new file mode 100644
index 0000000..762d498
--- /dev/null
+++ b/pkg/liboras/gitlab_listrepo_client.go
@@ -0,0 +1,47 @@
+package liboras
+
+import (
+	"context"
+	"fmt"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/proxy/factory/gitlab"
+	"github.com/rs/zerolog/log"
+)
+
+// GitlabListRepoClient implements RepositoryListClient specifically for GitLab registries
+// This client handles the GitLab Container Registry API's unique repository listing implementation
+type GitlabListRepoClient struct {
+	registry *portainer.Registry
+	client   *gitlab.Client
+}
+
+// NewGitlabListRepoClient creates a new GitLab repository listing client
+func NewGitlabListRepoClient(registry *portainer.Registry) *GitlabListRepoClient {
+	client := gitlab.NewClient(registry.Gitlab.InstanceURL, registry.Password)
+
+	return &GitlabListRepoClient{
+		registry: registry,
+		client:   client,
+	}
+}
+
+// ListRepositories fetches repositories from a GitLab registry using the GitLab API
+func (c *GitlabListRepoClient) ListRepositories(ctx context.Context) ([]string, error) {
+	repositories, err := c.client.GetRegistryRepositoryNames(ctx, c.registry.Gitlab.ProjectID)
+	if err != nil {
+		log.Error().
+			Str("registry_name", c.registry.Name).
+			Err(err).
+			Msg("Failed to list GitLab repositories")
+		return nil, fmt.Errorf("failed to list GitLab repositories: %w", err)
+	}
+
+	log.Debug().
+		Str("gitlab_url", c.registry.Gitlab.InstanceURL).
+		Int("project_id", c.registry.Gitlab.ProjectID).
+		Int("repository_count", len(repositories)).
+		Msg("Successfully listed GitLab repositories")
+
+	return repositories, nil
+}
diff --git a/pkg/liboras/listrepo_client.go b/pkg/liboras/listrepo_client.go
new file mode 100644
index 0000000..af154ac
--- /dev/null
+++ b/pkg/liboras/listrepo_client.go
@@ -0,0 +1,39 @@
+package liboras
+
+import (
+	"context"
+
+	portainer "github.com/portainer/portainer/api"
+	"oras.land/oras-go/v2/registry/remote"
+)
+
+// RepositoryListClient provides an interface specifically for listing repositories
+// This exists because listing repositories isn't a standard OCI operation, and we need to handle
+// different registry types differently.
+type RepositoryListClient interface {
+	// ListRepositories returns a list of repository names from the registry
+	ListRepositories(ctx context.Context) ([]string, error)
+}
+
+// RepositoryListClientFactory creates repository listing clients based on registry type
+type RepositoryListClientFactory struct{}
+
+// NewRepositoryListClientFactory creates a new factory instance
+func NewRepositoryListClientFactory() RepositoryListClientFactory {
+	return RepositoryListClientFactory{}
+}
+
+// CreateListClientWithRegistry creates a repository listing client based on the registry type
+// and automatically configures it with the provided ORAS registry client for generic registries
+func (f RepositoryListClientFactory) CreateListClientWithRegistry(registry *portainer.Registry, registryClient *remote.Registry) (RepositoryListClient, error) {
+	switch registry.Type {
+	case portainer.GitlabRegistry:
+		return NewGitlabListRepoClient(registry), nil
+	case portainer.GithubRegistry:
+		return NewGithubListRepoClient(registry), nil
+	default:
+		genericClient := NewGenericListRepoClient(registry)
+		genericClient.SetRegistryClient(registryClient)
+		return genericClient, nil
+	}
+}
diff --git a/pkg/liboras/manifest.go b/pkg/liboras/manifest.go
new file mode 100644
index 0000000..1f1a60c
--- /dev/null
+++ b/pkg/liboras/manifest.go
@@ -0,0 +1,68 @@
+package liboras
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+
+	"github.com/opencontainers/go-digest"
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	"oras.land/oras-go/v2/registry/remote"
+)
+
+// DeleteManifestByDigest deletes a manifest by its digest
+func DeleteManifestByDigest(registryClient *remote.Registry, repository, digestStr string) error {
+	ctx := context.Background()
+
+	// Get repository handle
+	repo, err := registryClient.Repository(ctx, repository)
+	if err != nil {
+		return fmt.Errorf("failed to get repository handle: %w", err)
+	}
+
+	// Delete the manifest by digest
+	manifestDigest, err := digest.Parse(digestStr)
+	if err != nil {
+		return fmt.Errorf("failed to parse digest: %w", err)
+	}
+
+	err = repo.Manifests().Delete(ctx, ocispec.Descriptor{
+		Digest: manifestDigest,
+	})
+	if err != nil {
+		return fmt.Errorf("failed to delete manifest: %w", err)
+	}
+
+	return nil
+}
+
+// AddTagToManifest creates a new tag pointing to an existing manifest
+func AddTagToManifest(registryClient *remote.Registry, repository, tagName, targetDigest string, manifestBytes []byte) error {
+	ctx := context.Background()
+
+	// Get repository handle
+	repo, err := registryClient.Repository(ctx, repository)
+	if err != nil {
+		return fmt.Errorf("failed to get repository handle: %w", err)
+	}
+
+	// Parse the target digest
+	parsedDigest, err := digest.Parse(targetDigest)
+	if err != nil {
+		return fmt.Errorf("failed to parse digest: %w", err)
+	}
+
+	// Create descriptor for the manifest
+	manifestDescriptor := ocispec.Descriptor{
+		MediaType: "application/vnd.oci.image.manifest.v1+json",
+		Size:      int64(len(manifestBytes)),
+		Digest:    parsedDigest,
+	}
+
+	err = repo.Manifests().PushReference(ctx, manifestDescriptor, bytes.NewReader(manifestBytes), tagName)
+	if err != nil {
+		return fmt.Errorf("failed to tag manifest: %w", err)
+	}
+
+	return nil
+}
diff --git a/pkg/liboras/registry.go b/pkg/liboras/registry.go
new file mode 100644
index 0000000..de28cd4
--- /dev/null
+++ b/pkg/liboras/registry.go
@@ -0,0 +1,95 @@
+package liboras
+
+import (
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/pkg/registryhttp"
+
+	"github.com/rs/zerolog/log"
+	"oras.land/oras-go/v2/registry/remote"
+	"oras.land/oras-go/v2/registry/remote/auth"
+)
+
+// CreateClient creates a new ORAS registry client based on the provided portainer.Registry.
+// It configures the client for authentication if the registry requires it.
+// Furthermore, the client is configured to use the default retry client. Its policy is found in retry.DefaultPolicy
+func CreateClient(registry portainer.Registry) (*remote.Registry, error) {
+	registryClient, err := remote.NewRegistry(registry.URL)
+	if err != nil {
+		log.Error().Err(err).Str("registryUrl", registry.URL).Msg("Failed to create registry client")
+		return nil, err
+	}
+
+	// Configure HTTP client based on registry type using the shared utility
+	httpClient, usePlainHTTP, err := registryhttp.CreateClient(&registry)
+	if err != nil {
+		return nil, err
+	}
+
+	registryClient.PlainHTTP = usePlainHTTP
+
+	// By default, oras sends multiple requests to get the full list of repos/tags/referrers.
+	// set a high page size limit for fewer round trips.
+	// e.g. https://github.com/oras-project/oras-go/blob/v2.6.0/registry/remote/registry.go#L129-L142
+	registryClient.RepositoryListPageSize = 1000
+	registryClient.TagListPageSize = 1000
+	registryClient.ReferrerListPageSize = 1000
+
+	authClient := &auth.Client{
+		Client: httpClient,
+	}
+
+	configureCredentials := registry.Authentication &&
+		strings.TrimSpace(registry.Username) != "" &&
+		strings.TrimSpace(registry.Password) != ""
+	if !configureCredentials {
+		// The authClient is still needed to handle anonymous access and token refresh. For instance to send requests to
+		// DockerHub which requires a token even for anonymous access.
+		registryClient.Client = authClient
+		log.Debug().
+			Str("registryURL", registry.URL).
+			Str("registryType", getRegistryTypeName(registry.Type)).
+			Bool("authentication", false).
+			Msg("Created ORAS registry client for anonymous access")
+
+		return registryClient, nil
+	}
+
+	authClient.Cache = auth.NewCache()
+	authClient.Credential = auth.StaticCredential(registry.URL, auth.Credential{
+		Username: registry.Username,
+		Password: registry.Password,
+	})
+	registryClient.Client = authClient
+
+	log.Debug().
+		Str("registryURL", registry.URL).
+		Str("registryType", getRegistryTypeName(registry.Type)).
+		Bool("authentication", true).
+		Msg("Created ORAS registry client with authentication")
+
+	return registryClient, nil
+}
+
+// getRegistryTypeName returns a human-readable name for the registry type
+func getRegistryTypeName(registryType portainer.RegistryType) string {
+	switch registryType {
+	case portainer.QuayRegistry:
+		return "Quay"
+	case portainer.AzureRegistry:
+		return "Azure"
+	case portainer.CustomRegistry:
+		return "Custom"
+	case portainer.GitlabRegistry:
+		return "GitLab"
+	case portainer.ProGetRegistry:
+		return "ProGet"
+	case portainer.DockerHubRegistry:
+		return "DockerHub"
+	case portainer.EcrRegistry:
+		return "ECR"
+	default:
+		return "Unknown"
+	}
+}
diff --git a/pkg/liboras/registry_test.go b/pkg/liboras/registry_test.go
new file mode 100644
index 0000000..62f0ed2
--- /dev/null
+++ b/pkg/liboras/registry_test.go
@@ -0,0 +1,269 @@
+package liboras
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/pkg/fips"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"oras.land/oras-go/v2/registry/remote/auth"
+)
+
+func TestCreateClient_AuthenticationScenarios(t *testing.T) {
+	fips.InitFIPS(false)
+
+	tests := []struct {
+		name                string
+		registry            portainer.Registry
+		expectAuthenticated bool
+		expectTLS           bool
+		description         string
+	}{
+		{
+			name: "authentication disabled should create anonymous client",
+			registry: portainer.Registry{
+				URL:            "registry.example.com",
+				Authentication: false,
+				Username:       "testuser",
+				Password:       "testpass",
+			},
+			expectAuthenticated: false,
+			expectTLS:           false,
+			description:         "Even with credentials present, authentication=false should result in anonymous access",
+		},
+		{
+			name: "authentication enabled with valid credentials should create authenticated client",
+			registry: portainer.Registry{
+				URL:            "registry.example.com",
+				Authentication: true,
+				Username:       "testuser",
+				Password:       "testpass",
+			},
+			expectAuthenticated: true,
+			expectTLS:           false,
+			description:         "Valid credentials with authentication=true should result in authenticated access",
+		},
+		{
+			name: "authentication enabled with empty username should create anonymous client",
+			registry: portainer.Registry{
+				URL:            "registry.example.com",
+				Authentication: true,
+				Username:       "",
+				Password:       "testpass",
+			},
+			expectAuthenticated: false,
+			expectTLS:           false,
+			description:         "Empty username should fallback to anonymous access",
+		},
+		{
+			name: "authentication enabled with whitespace-only username should create anonymous client",
+			registry: portainer.Registry{
+				URL:            "registry.example.com",
+				Authentication: true,
+				Username:       "   ",
+				Password:       "testpass",
+			},
+			expectAuthenticated: false,
+			expectTLS:           false,
+			description:         "Whitespace-only username should fallback to anonymous access",
+		},
+		{
+			name: "authentication enabled with empty password should create anonymous client",
+			registry: portainer.Registry{
+				URL:            "registry.example.com",
+				Authentication: true,
+				Username:       "testuser",
+				Password:       "",
+			},
+			expectAuthenticated: false,
+			expectTLS:           false,
+			description:         "Empty password should fallback to anonymous access",
+		},
+		{
+			name: "authentication enabled with whitespace-only password should create anonymous client",
+			registry: portainer.Registry{
+				URL:            "registry.example.com",
+				Authentication: true,
+				Username:       "testuser",
+				Password:       "   ",
+			},
+			expectAuthenticated: false,
+			expectTLS:           false,
+			description:         "Whitespace-only password should fallback to anonymous access",
+		},
+		{
+			name: "authentication enabled with both credentials empty should create anonymous client",
+			registry: portainer.Registry{
+				URL:            "registry.example.com",
+				Authentication: true,
+				Username:       "",
+				Password:       "",
+			},
+			expectAuthenticated: false,
+			expectTLS:           false,
+			description:         "Both credentials empty should fallback to anonymous access",
+		},
+		{
+			name: "GitLab registry with valid credentials should create authenticated client",
+			registry: portainer.Registry{
+				Type:           portainer.GitlabRegistry,
+				URL:            "registry.gitlab.com",
+				Authentication: true,
+				Username:       "gitlab-ci-token",
+				Password:       "glpat-xxxxxxxxxxxxxxxxxxxx",
+				Gitlab: portainer.GitlabRegistryData{
+					ProjectID:   12345,
+					InstanceURL: "https://gitlab.com",
+					ProjectPath: "my-group/my-project",
+				},
+			},
+			expectAuthenticated: true,
+			expectTLS:           true,
+			description:         "GitLab registry with valid credentials should result in authenticated access",
+		},
+		{
+			name: "DockerHub registry without credentials should create anonymous client with TLS",
+			registry: portainer.Registry{
+				Type:           portainer.DockerHubRegistry,
+				URL:            "registry-1.docker.io",
+				Authentication: false,
+			},
+			expectAuthenticated: false,
+			expectTLS:           true,
+			description:         "DockerHub registry with without credentials should result in authenticated anonymous access",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			client, err := CreateClient(tt.registry)
+
+			require.NoError(t, err, "CreateClient should not return an error")
+			assert.NotNil(t, client, "Client should not be nil")
+
+			// Should have auth.Client with credentials regardless of authentication setting
+			// If authentication is enabled, it should have the credentials set.
+			// If authentication is disabled, it should still be an auth.Client but with retry.DefaultClient
+			// (which handles anonymous access by requesting an anonymous token if needed).
+			authClient, ok := client.Client.(*auth.Client)
+			assert.True(t, ok, "Expected auth.Client for authenticated access")
+			assert.NotNil(t, authClient, "Auth client should not be nil")
+			// Check if the client has authentication configured
+			if tt.expectAuthenticated {
+				assert.NotNil(t, authClient.Credential, "Credential function should be set")
+			}
+
+			assert.Equal(t, tt.expectTLS, !client.PlainHTTP, "Expected TLS setting to match registry configuration")
+		})
+	}
+}
+
+func TestCreateClient_RegistryTypes(t *testing.T) {
+	t.Parallel()
+	registryTypes := []struct {
+		name         string
+		registryType portainer.RegistryType
+		expectedName string
+	}{
+		{"DockerHub", portainer.DockerHubRegistry, "DockerHub"},
+		{"Azure", portainer.AzureRegistry, "Azure"},
+		{"Custom", portainer.CustomRegistry, "Custom"},
+		{"GitLab", portainer.GitlabRegistry, "GitLab"},
+		{"Quay", portainer.QuayRegistry, "Quay"},
+		{"ProGet", portainer.ProGetRegistry, "ProGet"},
+		{"ECR", portainer.EcrRegistry, "ECR"},
+	}
+
+	for _, rt := range registryTypes {
+		t.Run(rt.name, func(t *testing.T) {
+			registry := portainer.Registry{
+				URL:            "registry.example.com",
+				Type:           rt.registryType,
+				Authentication: false,
+			}
+
+			client, err := CreateClient(registry)
+
+			require.NoError(t, err, "CreateClient should not return an error")
+			assert.NotNil(t, client, "Client should not be nil")
+
+			// Verify that getRegistryTypeName returns the expected name
+			typeName := getRegistryTypeName(rt.registryType)
+			assert.Equal(t, rt.expectedName, typeName, "Registry type name mismatch")
+		})
+	}
+}
+
+func TestGetRegistryTypeName(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		registryType portainer.RegistryType
+		expectedName string
+	}{
+		{portainer.QuayRegistry, "Quay"},
+		{portainer.AzureRegistry, "Azure"},
+		{portainer.CustomRegistry, "Custom"},
+		{portainer.GitlabRegistry, "GitLab"},
+		{portainer.ProGetRegistry, "ProGet"},
+		{portainer.DockerHubRegistry, "DockerHub"},
+		{portainer.EcrRegistry, "ECR"},
+		{portainer.RegistryType(999), "Unknown"}, // Unknown type
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.expectedName, func(t *testing.T) {
+			result := getRegistryTypeName(tt.registryType)
+			assert.Equal(t, tt.expectedName, result, "Registry type name mismatch")
+		})
+	}
+}
+
+func TestCreateClient_ErrorHandling(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name        string
+		registry    portainer.Registry
+		expectError bool
+	}{
+		{
+			name: "valid registry URL should not error",
+			registry: portainer.Registry{
+				URL:            "registry.example.com",
+				Authentication: false,
+			},
+			expectError: false,
+		},
+		{
+			name: "empty registry URL should error",
+			registry: portainer.Registry{
+				URL:            "",
+				Authentication: false,
+			},
+			expectError: true,
+		},
+		{
+			name: "invalid registry URL should error",
+			registry: portainer.Registry{
+				URL:            "://invalid-url",
+				Authentication: false,
+			},
+			expectError: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			client, err := CreateClient(tt.registry)
+
+			if tt.expectError {
+				require.Error(t, err, "Expected an error but got none")
+				assert.Nil(t, client, "Client should be nil when error occurs")
+			} else {
+				require.NoError(t, err, "Expected no error but got: %v", err)
+				assert.NotNil(t, client, "Client should not be nil")
+			}
+		})
+	}
+}
diff --git a/pkg/liboras/repository.go b/pkg/liboras/repository.go
new file mode 100644
index 0000000..e9bcbbf
--- /dev/null
+++ b/pkg/liboras/repository.go
@@ -0,0 +1,128 @@
+package liboras
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"sort"
+
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/concurrent"
+	"github.com/portainer/portainer/api/logs"
+	"github.com/segmentio/encoding/json"
+	"golang.org/x/mod/semver"
+	"oras.land/oras-go/v2/registry"
+	"oras.land/oras-go/v2/registry/remote"
+)
+
+// ListRepositories retrieves all repositories from a registry using specialized repository listing clients
+// Each registry type has different repository listing implementations that require specific API calls
+func ListRepositories(ctx context.Context, registry *portainer.Registry, registryClient *remote.Registry) ([]string, error) {
+	factory := NewRepositoryListClientFactory()
+	listClient, err := factory.CreateListClientWithRegistry(registry, registryClient)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create repository list client: %w", err)
+	}
+
+	return listClient.ListRepositories(ctx)
+}
+
+// FilterRepositoriesByMediaType filters repositories to only include those with the expected media type
+func FilterRepositoriesByMediaType(ctx context.Context, repositoryNames []string, registryClient *remote.Registry, expectedMediaType string) ([]string, error) {
+	// Run concurrently as this can take 10s+ to complete in serial
+	var tasks []concurrent.Func
+	for _, repoName := range repositoryNames {
+		name := repoName
+		task := func(ctx context.Context) (any, error) {
+			repository, err := registryClient.Repository(ctx, name)
+			if err != nil {
+				return nil, err
+			}
+
+			if HasMediaType(ctx, repository, expectedMediaType) {
+				return name, nil
+			}
+			return nil, nil // not a repository with the expected media type
+		}
+		tasks = append(tasks, task)
+	}
+
+	// 10 is a reasonable max concurrency limit
+	results, err := concurrent.Run(ctx, 10, tasks...)
+	if err != nil {
+		return nil, err
+	}
+
+	// Collect repository names
+	var repositories []string
+	for _, result := range results {
+		if result.Result != nil {
+			if repoName, ok := result.Result.(string); ok {
+				repositories = append(repositories, repoName)
+			}
+		}
+	}
+
+	return repositories, nil
+}
+
+// HasMediaType checks if a repository has artifacts with the specified media type
+func HasMediaType(ctx context.Context, repository registry.Repository, expectedMediaType string) bool {
+	// Check the first available tag
+	// Reasonable limitation - it won't work for repos where the latest tag is missing the expected media type but other tags have it
+	// This tradeoff is worth it for the performance benefits
+	var latestTag string
+	err := repository.Tags(ctx, "", func(tagList []string) error {
+		if len(tagList) > 0 {
+			// Order the taglist by latest semver, then get the latest tag
+			// e.g. ["1.0", "1.1"] -> ["1.1", "1.0"] -> "1.1"
+			sort.Slice(tagList, func(i, j int) bool {
+				return semver.Compare(tagList[i], tagList[j]) > 0
+			})
+			latestTag = tagList[0]
+		}
+		return nil
+	})
+
+	if err != nil {
+		return false
+	}
+
+	if latestTag == "" {
+		return false
+	}
+
+	descriptor, err := repository.Resolve(ctx, latestTag)
+	if err != nil {
+		return false
+	}
+
+	return descriptorHasMediaType(ctx, repository, descriptor, expectedMediaType)
+}
+
+// descriptorHasMediaType checks if a descriptor or its manifest contains the expected media type
+func descriptorHasMediaType(ctx context.Context, repository registry.Repository, descriptor ocispec.Descriptor, expectedMediaType string) bool {
+	// Check if the descriptor indicates the expected media type
+	if descriptor.MediaType == expectedMediaType {
+		return true
+	}
+
+	// Otherwise, look for the expected media type in the entire manifest content
+	manifestReader, err := repository.Manifests().Fetch(ctx, descriptor)
+	if err != nil {
+		return false
+	}
+	defer logs.CloseAndLogErr(manifestReader)
+
+	content, err := io.ReadAll(manifestReader)
+	if err != nil {
+		return false
+	}
+	var manifest ocispec.Manifest
+	if err := json.Unmarshal(content, &manifest); err != nil {
+		return false
+	}
+
+	return manifest.Config.MediaType == expectedMediaType
+}
diff --git a/pkg/libpolicy/fingerprint.go b/pkg/libpolicy/fingerprint.go
new file mode 100644
index 0000000..3dba6f2
--- /dev/null
+++ b/pkg/libpolicy/fingerprint.go
@@ -0,0 +1,43 @@
+package libpolicy
+
+import (
+	"hash/fnv"
+	"sort"
+	"strconv"
+
+	"github.com/segmentio/encoding/json"
+
+	portainer "github.com/portainer/portainer/api"
+)
+
+// ConfigFingerprint is the generic primitive: FNV-1a over serialized policy
+// config bytes. It is a change detector, not a security boundary; collisions
+// are acceptable because a later poll or policy edit will retry reconciliation.
+// Callers must ensure the bytes are deterministic (e.g. collections sorted
+// before marshaling).
+//
+// New policy types should call this after marshaling their own config struct.
+func ConfigFingerprint(config []byte) string {
+	h := fnv.New32a()
+	h.Write(config)
+	return strconv.FormatUint(uint64(h.Sum32()), 16)
+}
+
+// HelmPolicyFingerprint computes a fingerprint for a Helm policy from its chart
+// summaries. Charts are sorted by name before hashing so the result is
+// order-independent. The restore manifest is excluded because it does not
+// affect what gets installed.
+//
+// Both server-ee and the agent import this function to guarantee they compute
+// identical fingerprints for the same chart summaries.
+func HelmPolicyFingerprint(chartSummaries []portainer.PolicyChartSummary) string {
+	sorted := make([]portainer.PolicyChartSummary, len(chartSummaries))
+	copy(sorted, chartSummaries)
+	sort.Slice(sorted, func(i, j int) bool { return sorted[i].ChartName < sorted[j].ChartName })
+	b, err := json.Marshal(portainer.HelmPolicyConfig{Charts: sorted})
+	if err != nil {
+		// json.Marshal of a known struct with no custom marshalers cannot error.
+		return ""
+	}
+	return ConfigFingerprint(b)
+}
diff --git a/pkg/libprometheus/config.go b/pkg/libprometheus/config.go
new file mode 100644
index 0000000..6e9a599
--- /dev/null
+++ b/pkg/libprometheus/config.go
@@ -0,0 +1,152 @@
+package libprometheus
+
+import (
+	"fmt"
+	"net/url"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+)
+
+const configTemplate = `# Prometheus configuration.
+# Generated automatically — do not edit.
+global:
+  scrape_interval: %s
+  evaluation_interval: %s
+
+scrape_configs:
+  - job_name: '%s'
+    scheme: '%s'
+    metrics_path: '%s'
+%s    static_configs:
+      - targets: ['%s']
+
+%s
+`
+
+const alertingTemplate = `alerting:
+  alertmanagers:
+  - scheme: '%s'
+    path_prefix: '%s'
+    api_version: 'v2'
+    static_configs:
+      - targets: ['%s']
+%s
+`
+
+type PrometheusConfigOptions struct {
+	ScrapeInterval      string
+	JobName             string
+	ScrapeTarget        string
+	AlertmanagerTarget  string
+	AlertmanagerHeaders map[string]string
+	InsecureSkipVerify  bool
+}
+
+// WritePrometheusConfig writes a Prometheus config.yaml to dataDir/config.yaml.
+// ScrapeTarget is a full scrape URL (e.g. "http://localhost:9001/api/metrics").
+// AlertmanagerTarget is an optional base URL used by Prometheus notifier
+// (e.g. "https://portainer.example/api/endpoints/1/edge/alerts").
+func WritePrometheusConfig(dataDir string, options PrometheusConfigOptions) error {
+	if err := os.MkdirAll(dataDir, 0o750); err != nil {
+		return fmt.Errorf("create prometheus config dir: %w", err)
+	}
+
+	scheme, metricsPath, hostPort, err := parseTarget(options.ScrapeTarget, "/metrics")
+	if err != nil {
+		return fmt.Errorf("parse scrape target: %w", err)
+	}
+
+	escape := func(s string) string { return strings.ReplaceAll(s, "'", "''") }
+	alertingSection, err := renderAlertingSection(options.AlertmanagerTarget, options.AlertmanagerHeaders, options.InsecureSkipVerify, escape)
+	if err != nil {
+		return err
+	}
+
+	scrapeTLSBlock := ""
+	if scheme == "https" && options.InsecureSkipVerify {
+		scrapeTLSBlock = "    tls_config:\n      insecure_skip_verify: true\n"
+	}
+
+	content := fmt.Sprintf(configTemplate,
+		options.ScrapeInterval, options.ScrapeInterval,
+		escape(options.JobName),
+		escape(scheme),
+		escape(metricsPath),
+		scrapeTLSBlock,
+		escape(hostPort),
+		alertingSection,
+	)
+
+	return os.WriteFile(filepath.Join(dataDir, "config.yaml"), []byte(content), 0o600)
+}
+
+// parseTarget splits a full URL into its scheme, path, and host:port components
+// for use in a Prometheus static_configs entry.
+func parseTarget(target string, defaultPath string) (scheme, parsedPath, hostPort string, err error) {
+	u, err := url.Parse(target)
+	if err != nil {
+		return "", "", "", err
+	}
+
+	scheme = u.Scheme
+	if scheme == "" {
+		scheme = "http"
+	}
+
+	parsedPath = u.Path
+	if parsedPath == "" {
+		parsedPath = defaultPath
+	}
+
+	hostPort = u.Host
+	if hostPort == "" {
+		hostPort = target // fallback: treat the whole string as host:port
+	}
+
+	return scheme, parsedPath, hostPort, nil
+}
+func renderAlertingSection(target string, headers map[string]string, insecureSkipVerify bool, escape func(string) string) (string, error) {
+	if target == "" {
+		return "", nil
+	}
+
+	scheme, pathPrefix, hostPort, err := parseTarget(target, "")
+	if err != nil {
+		return "", fmt.Errorf("parse alertmanager target: %w", err)
+	}
+
+	tlsBlock := ""
+	if insecureSkipVerify {
+		tlsBlock = "    tls_config:\n      insecure_skip_verify: true\n"
+	}
+	headersBlock := renderHTTPHeaders(headers, escape, "    ")
+	return fmt.Sprintf(alertingTemplate,
+		escape(scheme),
+		escape(pathPrefix),
+		escape(hostPort),
+		tlsBlock+headersBlock,
+	), nil
+}
+
+func renderHTTPHeaders(headers map[string]string, escape func(string) string, indent string) string {
+	if len(headers) == 0 {
+		return ""
+	}
+
+	keys := make([]string, 0, len(headers))
+	for name := range headers {
+		keys = append(keys, name)
+	}
+	sort.Strings(keys)
+
+	var builder strings.Builder
+	_, _ = fmt.Fprintf(&builder, "%shttp_headers:\n", indent)
+	for _, name := range keys {
+		_, _ = fmt.Fprintf(&builder, "%s  %s:\n", indent, name)
+		_, _ = fmt.Fprintf(&builder, "%s    values: ['%s']\n", indent, escape(headers[name]))
+	}
+
+	return builder.String()
+}
diff --git a/pkg/libprometheus/config_test.go b/pkg/libprometheus/config_test.go
new file mode 100644
index 0000000..b3bc551
--- /dev/null
+++ b/pkg/libprometheus/config_test.go
@@ -0,0 +1,123 @@
+package libprometheus_test
+
+import (
+	"testing"
+	"time"
+
+	libprom "github.com/portainer/portainer/pkg/libprometheus"
+	prometheusreg "github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/common/model"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestWritePrometheusConfigIncludesAlertmanagerSettings(t *testing.T) {
+	dataDir := t.TempDir()
+
+	err := libprom.WritePrometheusConfig(dataDir, libprom.PrometheusConfigOptions{
+		ScrapeInterval:     "60s",
+		JobName:            "edge-agent",
+		ScrapeTarget:       "http://localhost:9001/api/metrics",
+		AlertmanagerTarget: "https://portainer.example/api/endpoints/7/edge/alerts",
+		AlertmanagerHeaders: map[string]string{
+			"X-PortainerAgent-EdgeID": "edge-id-7",
+		},
+	})
+	require.NoError(t, err)
+
+	cfg, err := libprom.LoadPrometheusConfig(dataDir)
+	require.NoError(t, err)
+
+	require.Len(t, cfg.ScrapeConfigs, 1)
+	assert.Equal(t, "edge-agent", cfg.ScrapeConfigs[0].JobName)
+	assert.Equal(t, model.Duration(60*time.Second), cfg.GlobalConfig.ScrapeInterval)
+
+	require.Len(t, cfg.AlertingConfig.AlertmanagerConfigs, 1)
+	amCfg := cfg.AlertingConfig.AlertmanagerConfigs[0]
+	assert.Equal(t, "https", amCfg.Scheme)
+	assert.Equal(t, "/api/endpoints/7/edge/alerts", amCfg.PathPrefix)
+	require.NotNil(t, amCfg.HTTPClientConfig.HTTPHeaders)
+	require.Contains(t, amCfg.HTTPClientConfig.HTTPHeaders.Headers, "X-PortainerAgent-EdgeID")
+	assert.Equal(t, []string{"edge-id-7"}, amCfg.HTTPClientConfig.HTTPHeaders.Headers["X-PortainerAgent-EdgeID"].Values)
+
+	notifierMgr, tsets, err := libprom.NewNotifierManagerFromConfig(cfg, prometheusreg.NewRegistry())
+	require.NoError(t, err)
+	require.NotNil(t, notifierMgr)
+
+	tset := <-tsets
+	require.Contains(t, tset, "config-0")
+	require.Len(t, tset["config-0"], 1)
+	require.Len(t, tset["config-0"][0].Targets, 1)
+	assert.Equal(t, model.LabelValue("portainer.example"), tset["config-0"][0].Targets[0][model.AddressLabel])
+}
+
+func TestWritePrometheusConfigInsecureSkipVerify(t *testing.T) {
+	dataDir := t.TempDir()
+
+	err := libprom.WritePrometheusConfig(dataDir, libprom.PrometheusConfigOptions{
+		ScrapeInterval:     "60s",
+		JobName:            "edge-agent",
+		ScrapeTarget:       "http://10.244.0.15:9001/api/metrics",
+		AlertmanagerTarget: "https://192.168.68.52:9443/api/endpoints/9/edge/alerts",
+		InsecureSkipVerify: true,
+	})
+	require.NoError(t, err)
+
+	cfg, err := libprom.LoadPrometheusConfig(dataDir)
+	require.NoError(t, err)
+
+	require.Len(t, cfg.AlertingConfig.AlertmanagerConfigs, 1)
+	amCfg := cfg.AlertingConfig.AlertmanagerConfigs[0]
+	assert.True(t, amCfg.HTTPClientConfig.TLSConfig.InsecureSkipVerify)
+}
+
+func TestWritePrometheusConfigHTTPSScrapeWithInsecureSkipVerify(t *testing.T) {
+	dataDir := t.TempDir()
+
+	err := libprom.WritePrometheusConfig(dataDir, libprom.PrometheusConfigOptions{
+		ScrapeInterval:     "15s",
+		JobName:            "portainer",
+		ScrapeTarget:       "https://127.0.0.1:9443/api/metrics",
+		AlertmanagerTarget: "http://127.0.0.1:9093",
+		InsecureSkipVerify: true,
+	})
+	require.NoError(t, err)
+
+	cfg, err := libprom.LoadPrometheusConfig(dataDir)
+	require.NoError(t, err)
+
+	require.Len(t, cfg.ScrapeConfigs, 1)
+	scrapeCfg := cfg.ScrapeConfigs[0]
+	assert.Equal(t, "https", scrapeCfg.Scheme)
+	assert.True(t, scrapeCfg.HTTPClientConfig.TLSConfig.InsecureSkipVerify)
+}
+
+func TestBootstrapManagerSetBuildsInitialScrapeAndNotifierTargets(t *testing.T) {
+	dataDir := t.TempDir()
+	reg := prometheusreg.NewRegistry()
+	db, err := libprom.NewInMemoryTSDB(reg)
+	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, db.Close()) })
+
+	managers, err := libprom.BootstrapManagerSet(dataDir, libprom.PrometheusConfigOptions{
+		ScrapeInterval:     "60s",
+		JobName:            "edge-agent",
+		ScrapeTarget:       "http://localhost:9001/api/metrics",
+		AlertmanagerTarget: "https://portainer.example/api/endpoints/7/edge/alerts",
+	}, db, reg)
+	require.NoError(t, err)
+	require.NotNil(t, managers.ScrapeManager)
+	require.NotNil(t, managers.NotifierManager)
+
+	scrapeTset := <-managers.ScrapeTargetSets
+	require.Contains(t, scrapeTset, "edge-agent")
+	require.Len(t, scrapeTset["edge-agent"], 1)
+	require.Len(t, scrapeTset["edge-agent"][0].Targets, 1)
+	assert.Equal(t, model.LabelValue("localhost:9001"), scrapeTset["edge-agent"][0].Targets[0][model.AddressLabel])
+
+	notifyTset := <-managers.NotifierTargetSets
+	require.Contains(t, notifyTset, "config-0")
+	require.Len(t, notifyTset["config-0"], 1)
+	require.Len(t, notifyTset["config-0"][0].Targets, 1)
+	assert.Equal(t, model.LabelValue("portainer.example"), notifyTset["config-0"][0].Targets[0][model.AddressLabel])
+}
diff --git a/pkg/libprometheus/engine.go b/pkg/libprometheus/engine.go
new file mode 100644
index 0000000..ae775e2
--- /dev/null
+++ b/pkg/libprometheus/engine.go
@@ -0,0 +1,17 @@
+package libprometheus
+
+import (
+	"time"
+
+	"github.com/prometheus/prometheus/promql"
+)
+
+// NewEngine creates a PromQL engine with standard options shared across
+// the server and agent Prometheus embeddings.
+func NewEngine() *promql.Engine {
+	return promql.NewEngine(promql.EngineOpts{
+		MaxSamples:       50_000_000,
+		Timeout:          2 * time.Minute,
+		EnableAtModifier: true,
+	})
+}
diff --git a/pkg/libprometheus/manager_set.go b/pkg/libprometheus/manager_set.go
new file mode 100644
index 0000000..b761d68
--- /dev/null
+++ b/pkg/libprometheus/manager_set.go
@@ -0,0 +1,56 @@
+package libprometheus
+
+import (
+	"fmt"
+
+	prometheusreg "github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/prometheus/discovery/targetgroup"
+	"github.com/prometheus/prometheus/notifier"
+	"github.com/prometheus/prometheus/scrape"
+	"github.com/prometheus/prometheus/storage"
+)
+
+// ManagerSet bundles the Prometheus managers and initial target sets built
+// from config.yaml.
+type ManagerSet struct {
+	ScrapeManager      *scrape.Manager
+	ScrapeTargetSets   chan map[string][]*targetgroup.Group
+	NotifierManager    *notifier.Manager
+	NotifierTargetSets chan map[string][]*targetgroup.Group
+}
+
+// BootstrapManagerSet writes config.yaml, loads it back, and builds the scrape
+// and notifier managers from that file so config.yaml remains the single source
+// of truth for runtime configuration.
+func BootstrapManagerSet(
+	dataDir string,
+	options PrometheusConfigOptions,
+	appendable storage.Appendable,
+	reg prometheusreg.Registerer,
+) (*ManagerSet, error) {
+	if err := WritePrometheusConfig(dataDir, options); err != nil {
+		return nil, fmt.Errorf("write prometheus config: %w", err)
+	}
+
+	cfg, err := LoadPrometheusConfig(dataDir)
+	if err != nil {
+		return nil, fmt.Errorf("load prometheus config: %w", err)
+	}
+
+	scrapeManager, scrapeTargetSets, err := NewScrapeManagerFromConfig(cfg, appendable, reg)
+	if err != nil {
+		return nil, fmt.Errorf("create scrape manager: %w", err)
+	}
+
+	notifierManager, notifierTargetSets, err := NewNotifierManagerFromConfig(cfg, reg)
+	if err != nil {
+		return nil, fmt.Errorf("create notifier manager: %w", err)
+	}
+
+	return &ManagerSet{
+		ScrapeManager:      scrapeManager,
+		ScrapeTargetSets:   scrapeTargetSets,
+		NotifierManager:    notifierManager,
+		NotifierTargetSets: notifierTargetSets,
+	}, nil
+}
diff --git a/pkg/libprometheus/notifier_manager.go b/pkg/libprometheus/notifier_manager.go
new file mode 100644
index 0000000..7e53404
--- /dev/null
+++ b/pkg/libprometheus/notifier_manager.go
@@ -0,0 +1,42 @@
+package libprometheus
+
+import (
+	"fmt"
+
+	prometheusreg "github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/common/model"
+	"github.com/prometheus/prometheus/config"
+	"github.com/prometheus/prometheus/discovery"
+	"github.com/prometheus/prometheus/discovery/targetgroup"
+	"github.com/prometheus/prometheus/notifier"
+)
+
+// NewNotifierManagerFromConfig creates a notifier.Manager from a loaded
+// Prometheus config. It also returns a pre-populated target-sets channel ready
+// to pass to Manager.Run() using the config's static alertmanager targets.
+func NewNotifierManagerFromConfig(
+	cfg *config.Config,
+	reg prometheusreg.Registerer,
+) (*notifier.Manager, chan map[string][]*targetgroup.Group, error) {
+	mgr := notifier.NewManager(
+		&notifier.Options{
+			QueueCapacity:   10000,
+			DrainOnShutdown: true,
+			Registerer:      reg,
+		},
+		model.LegacyValidation,
+		NewZerologSlogger(),
+	)
+
+	if err := mgr.ApplyConfig(cfg); err != nil {
+		return nil, nil, fmt.Errorf("apply prometheus notifier config: %w", err)
+	}
+
+	alertmanagerConfigs := cfg.AlertingConfig.AlertmanagerConfigs.ToMap()
+	serviceDiscoveryConfigs := make(map[string]discovery.Configs, len(alertmanagerConfigs))
+	for key, amCfg := range alertmanagerConfigs {
+		serviceDiscoveryConfigs[key] = amCfg.ServiceDiscoveryConfigs
+	}
+
+	return mgr, newStaticTargetSetsChannel(serviceDiscoveryConfigs), nil
+}
diff --git a/pkg/libprometheus/rules.go b/pkg/libprometheus/rules.go
new file mode 100644
index 0000000..553b83b
--- /dev/null
+++ b/pkg/libprometheus/rules.go
@@ -0,0 +1,175 @@
+package libprometheus
+
+import (
+	"context"
+	"slices"
+	"strconv"
+	"time"
+
+	pkgmetrics "github.com/portainer/portainer/pkg/metrics"
+	prometheusreg "github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/prometheus/model/labels"
+	"github.com/prometheus/prometheus/promql"
+	"github.com/prometheus/prometheus/rules"
+	"github.com/prometheus/prometheus/storage"
+)
+
+// RuleManagerConfig holds the parameters needed to construct a Prometheus rules.Manager.
+type RuleManagerConfig struct {
+	Engine     *promql.Engine
+	Queryable  storage.Queryable
+	Appendable storage.Appendable
+	NotifyFunc rules.NotifyFunc
+	Context    context.Context
+	Registerer prometheusreg.Registerer
+}
+
+// NewRuleManager constructs a Prometheus rules.Manager from the given config.
+func NewRuleManager(cfg RuleManagerConfig) *rules.Manager {
+	return rules.NewManager(&rules.ManagerOptions{
+		QueryFunc:  rules.EngineQueryFunc(cfg.Engine, cfg.Queryable),
+		Appendable: cfg.Appendable,
+		Queryable:  cfg.Queryable,
+		NotifyFunc: cfg.NotifyFunc,
+		Context:    cfg.Context,
+		Logger:     NewZerologSlogger(),
+		Registerer: cfg.Registerer,
+	})
+}
+
+// ReloadRules updates the active rule set on a rules.Manager from a YAML file.
+// Pass an empty alertsFilePath to clear all rules.
+func ReloadRules(mgr *rules.Manager, evalInterval time.Duration, alertsFilePath string) error {
+	var files []string
+	if alertsFilePath != "" {
+		files = []string{alertsFilePath}
+	}
+
+	return mgr.Update(evalInterval, files, labels.EmptyLabels(), "", nil)
+}
+
+// ExtractAlertStates returns the current evaluation state for each alerting rule
+// managed by the given rules.Manager.
+func ExtractAlertStates(mgr *rules.Manager) []pkgmetrics.EdgeAlertRuleState {
+	type aggregateState struct {
+		state          pkgmetrics.AlertRuleStateType
+		lastEvaluation int64
+		lastError      string
+		severity       string
+	}
+
+	aggregated := make(map[int]aggregateState)
+
+	for _, group := range mgr.RuleGroups() {
+		for _, rule := range group.Rules() {
+			alertRule, ok := rule.(*rules.AlertingRule)
+			if !ok {
+				continue
+			}
+
+			ruleIDStr := alertRule.Labels().Get(pkgmetrics.AlertRuleIDLabel)
+			ruleID, err := strconv.Atoi(ruleIDStr)
+			if err != nil || ruleID <= 0 {
+				continue
+			}
+
+			state := pkgmetrics.AlertRuleStateOK
+			for _, a := range alertRule.ActiveAlerts() {
+				switch a.State {
+				case rules.StateFiring:
+					state = pkgmetrics.AlertRuleStateFiring
+				case rules.StatePending:
+					if state != pkgmetrics.AlertRuleStateFiring {
+						state = pkgmetrics.AlertRuleStatePending
+					}
+				}
+			}
+
+			var lastErr string
+			if alertRule.LastError() != nil {
+				lastErr = alertRule.LastError().Error()
+			}
+
+			tierSeverity := alertRule.Labels().Get(pkgmetrics.AlertTierLabel)
+			statePriority := alertStatePriority(state)
+			evalMillis := alertRule.GetEvaluationTimestamp().UnixMilli()
+
+			existing, exists := aggregated[ruleID]
+			if !exists {
+				aggregated[ruleID] = aggregateState{
+					state:          state,
+					lastEvaluation: evalMillis,
+					lastError:      lastErr,
+					severity:       tierSeverity,
+				}
+				continue
+			}
+
+			existingStatePriority := alertStatePriority(existing.state)
+			winsState := statePriority > existingStatePriority
+			tiebreakWins := statePriority == existingStatePriority && tierSeverityPriority(tierSeverity) > tierSeverityPriority(existing.severity)
+
+			if winsState || tiebreakWins {
+				existing.state = state
+				existing.severity = tierSeverity
+				existing.lastError = lastErr
+			}
+
+			if evalMillis > existing.lastEvaluation {
+				existing.lastEvaluation = evalMillis
+			}
+
+			aggregated[ruleID] = existing
+		}
+	}
+
+	if len(aggregated) == 0 {
+		return nil
+	}
+
+	ruleIDs := make([]int, 0, len(aggregated))
+	for ruleID := range aggregated {
+		ruleIDs = append(ruleIDs, ruleID)
+	}
+	slices.Sort(ruleIDs)
+
+	states := make([]pkgmetrics.EdgeAlertRuleState, 0, len(ruleIDs))
+	for _, ruleID := range ruleIDs {
+		state := aggregated[ruleID]
+		states = append(states, pkgmetrics.EdgeAlertRuleState{
+			RuleID:         ruleID,
+			State:          state.state,
+			LastEvaluation: state.lastEvaluation,
+			LastError:      state.lastError,
+		})
+	}
+
+	return states
+}
+
+func alertStatePriority(state pkgmetrics.AlertRuleStateType) int {
+	switch state {
+	case pkgmetrics.AlertRuleStateFiring:
+		return 2
+	case pkgmetrics.AlertRuleStatePending:
+		return 1
+	default:
+		return 0
+	}
+}
+
+// tierSeverityPriority mirrors the canonical severity ordering from the EE
+// alertexpr package. CE cannot import EE, so this is a
+// deliberate duplicate — keep the values aligned if the canonical list changes.
+func tierSeverityPriority(severity string) int {
+	switch severity {
+	case "critical":
+		return 2
+	case "warning":
+		return 1
+	case "info":
+		return 0
+	default:
+		return -1
+	}
+}
diff --git a/pkg/libprometheus/rules_test.go b/pkg/libprometheus/rules_test.go
new file mode 100644
index 0000000..f0b2924
--- /dev/null
+++ b/pkg/libprometheus/rules_test.go
@@ -0,0 +1,200 @@
+package libprometheus_test
+
+import (
+	"context"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/portainer/portainer/api/filesystem"
+	libprom "github.com/portainer/portainer/pkg/libprometheus"
+	pkgmetrics "github.com/portainer/portainer/pkg/metrics"
+	prometheusreg "github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/prometheus/rules"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestNewRuleManager(t *testing.T) {
+	reg := prometheusreg.NewRegistry()
+	db, err := libprom.NewInMemoryTSDB(reg)
+	require.NoError(t, err)
+	defer func() { require.NoError(t, db.Close()) }()
+
+	engine := libprom.NewEngine()
+
+	var notified bool
+	mgr := libprom.NewRuleManager(libprom.RuleManagerConfig{
+		Engine:     engine,
+		Queryable:  db,
+		Appendable: db,
+		NotifyFunc: func(_ context.Context, _ string, alerts ...*rules.Alert) {
+			notified = true
+		},
+		Context:    context.Background(),
+		Registerer: reg,
+	})
+
+	require.NotNil(t, mgr)
+	_ = notified // used by rule evaluation, not directly testable without running the manager
+}
+
+func TestReloadRules(t *testing.T) {
+	reg := prometheusreg.NewRegistry()
+	db, err := libprom.NewInMemoryTSDB(reg)
+	require.NoError(t, err)
+	defer func() { require.NoError(t, db.Close()) }()
+
+	engine := libprom.NewEngine()
+
+	mgr := libprom.NewRuleManager(libprom.RuleManagerConfig{
+		Engine:     engine,
+		Queryable:  db,
+		Appendable: db,
+		NotifyFunc: func(_ context.Context, _ string, _ ...*rules.Alert) {},
+		Context:    context.Background(),
+		Registerer: reg,
+	})
+
+	t.Run("empty path clears rules", func(t *testing.T) {
+		err := libprom.ReloadRules(mgr, 15*time.Second, "")
+		require.NoError(t, err)
+		assert.Empty(t, mgr.RuleGroups())
+	})
+
+	t.Run("valid rule file loads successfully", func(t *testing.T) {
+		dir := t.TempDir()
+		alertsFile := filesystem.JoinPaths(dir, "alerts.yaml")
+
+		rulesYAML := `groups:
+  - name: test-group
+    rules:
+      - alert: TestAlert
+        expr: up == 0
+        for: 1m
+        labels:
+          alert_rule_id: "42"
+          severity: critical
+`
+		require.NoError(t, os.WriteFile(alertsFile, []byte(rulesYAML), 0o644))
+
+		err := libprom.ReloadRules(mgr, 15*time.Second, alertsFile)
+		require.NoError(t, err)
+		assert.Len(t, mgr.RuleGroups(), 1)
+	})
+
+	t.Run("invalid file returns error", func(t *testing.T) {
+		err := libprom.ReloadRules(mgr, 15*time.Second, "/nonexistent/alerts.yaml")
+		require.Error(t, err)
+	})
+}
+
+func TestExtractAlertStates(t *testing.T) {
+	newTestRuleManager := func(t *testing.T) *rules.Manager {
+		t.Helper()
+
+		reg := prometheusreg.NewRegistry()
+		db, err := libprom.NewInMemoryTSDB(reg)
+		require.NoError(t, err)
+		t.Cleanup(func() {
+			require.NoError(t, db.Close())
+		})
+
+		engine := libprom.NewEngine()
+
+		return libprom.NewRuleManager(libprom.RuleManagerConfig{
+			Engine:     engine,
+			Queryable:  db,
+			Appendable: db,
+			NotifyFunc: func(_ context.Context, _ string, _ ...*rules.Alert) {},
+			Context:    context.Background(),
+			Registerer: reg,
+		})
+	}
+
+	t.Run("no rules returns nil", func(t *testing.T) {
+		mgr := newTestRuleManager(t)
+		states := libprom.ExtractAlertStates(mgr)
+		assert.Nil(t, states)
+	})
+
+	t.Run("loaded rules return states", func(t *testing.T) {
+		mgr := newTestRuleManager(t)
+		dir := t.TempDir()
+		alertsFile := filesystem.JoinPaths(dir, "alerts.yaml")
+
+		rulesYAML := `groups:
+  - name: test-group
+    rules:
+      - alert: TestAlert
+        expr: up == 0
+        for: 1m
+        labels:
+          alert_rule_id: "7"
+          severity: warning
+`
+		require.NoError(t, os.WriteFile(alertsFile, []byte(rulesYAML), 0o644))
+		require.NoError(t, libprom.ReloadRules(mgr, 15*time.Second, alertsFile))
+
+		states := libprom.ExtractAlertStates(mgr)
+		require.Len(t, states, 1)
+		assert.Equal(t, 7, states[0].RuleID)
+		assert.Equal(t, pkgmetrics.AlertRuleStateOK, states[0].State)
+	})
+
+	t.Run("duplicate alert_rule_id values are aggregated", func(t *testing.T) {
+		mgr := newTestRuleManager(t)
+		dir := t.TempDir()
+		alertsFile := filesystem.JoinPaths(dir, "alerts.yaml")
+
+		rulesYAML := `groups:
+  - name: test-group
+    rules:
+      - alert: CpuWarning
+        expr: up == 0
+        labels:
+          alert_rule_id: "42"
+          severity: warning
+      - alert: CpuCritical
+        expr: up >= 0
+        labels:
+          alert_rule_id: "42"
+          severity: critical
+`
+		require.NoError(t, os.WriteFile(alertsFile, []byte(rulesYAML), 0o644))
+		require.NoError(t, libprom.ReloadRules(mgr, 15*time.Second, alertsFile))
+
+		states := libprom.ExtractAlertStates(mgr)
+		require.Len(t, states, 1)
+		assert.Equal(t, 42, states[0].RuleID)
+		assert.Equal(t, pkgmetrics.AlertRuleStateOK, states[0].State)
+	})
+
+	t.Run("states are returned in stable rule ID order", func(t *testing.T) {
+		mgr := newTestRuleManager(t)
+		dir := t.TempDir()
+		alertsFile := filesystem.JoinPaths(dir, "alerts.yaml")
+
+		rulesYAML := `groups:
+  - name: test-group
+    rules:
+      - alert: RuleTen
+        expr: up == 0
+        labels:
+          alert_rule_id: "10"
+          severity: warning
+      - alert: RuleThree
+        expr: up >= 0
+        labels:
+          alert_rule_id: "3"
+          severity: critical
+`
+		require.NoError(t, os.WriteFile(alertsFile, []byte(rulesYAML), 0o644))
+		require.NoError(t, libprom.ReloadRules(mgr, 15*time.Second, alertsFile))
+
+		states := libprom.ExtractAlertStates(mgr)
+		require.Len(t, states, 2)
+		assert.Equal(t, 3, states[0].RuleID)
+		assert.Equal(t, 10, states[1].RuleID)
+	})
+}
diff --git a/pkg/libprometheus/scrape.go b/pkg/libprometheus/scrape.go
new file mode 100644
index 0000000..ae9754f
--- /dev/null
+++ b/pkg/libprometheus/scrape.go
@@ -0,0 +1,82 @@
+package libprometheus
+
+import (
+	"context"
+	"io"
+	"time"
+
+	dto "github.com/prometheus/client_model/go"
+	"github.com/prometheus/common/expfmt"
+	prommodel "github.com/prometheus/common/model"
+	"github.com/prometheus/prometheus/model/labels"
+	"github.com/prometheus/prometheus/storage"
+	"github.com/rs/zerolog/log"
+)
+
+// AppendExpositionSamples parses Prometheus exposition-format metrics from r
+// and appends them as samples to the given Appendable.
+func AppendExpositionSamples(ctx context.Context, db storage.Appendable, r io.Reader) error {
+	parser := expfmt.NewTextParser(prommodel.UTF8Validation)
+	metricFamilies, err := parser.TextToMetricFamilies(r)
+	if err != nil {
+		return err
+	}
+
+	app := db.Appender(ctx)
+	now := time.Now().UnixMilli()
+
+	for name, mf := range metricFamilies {
+		if !supportsScalarMetricType(mf.GetType()) {
+			continue
+		}
+
+		for _, m := range mf.GetMetric() {
+			lbls := LabelsFromMetric(name, m)
+			value := ValueFromMetric(m, mf.GetType())
+			if _, err := app.Append(0, lbls, now, value); err != nil {
+				log.Debug().Err(err).Str("metric", name).Msg("failed to append metric sample")
+			}
+		}
+	}
+
+	return app.Commit()
+}
+
+func supportsScalarMetricType(mtype dto.MetricType) bool {
+	switch mtype {
+	case dto.MetricType_COUNTER, dto.MetricType_GAUGE, dto.MetricType_UNTYPED:
+		return true
+	default:
+		return false
+	}
+}
+
+// LabelsFromMetric builds a labels.Labels from a metric name and its label pairs.
+func LabelsFromMetric(name string, m *dto.Metric) labels.Labels {
+	b := labels.NewScratchBuilder(1 + len(m.GetLabel()))
+	b.Add(string(prommodel.MetricNameLabel), name)
+	for _, lp := range m.GetLabel() {
+		b.Add(lp.GetName(), lp.GetValue())
+	}
+	b.Sort()
+	return b.Labels()
+}
+
+// ValueFromMetric extracts the numeric value from a metric based on its type.
+func ValueFromMetric(m *dto.Metric, mtype dto.MetricType) float64 {
+	switch mtype {
+	case dto.MetricType_COUNTER:
+		if c := m.GetCounter(); c != nil {
+			return c.GetValue()
+		}
+	case dto.MetricType_GAUGE:
+		if g := m.GetGauge(); g != nil {
+			return g.GetValue()
+		}
+	case dto.MetricType_UNTYPED:
+		if u := m.GetUntyped(); u != nil {
+			return u.GetValue()
+		}
+	}
+	return 0
+}
diff --git a/pkg/libprometheus/scrape_manager.go b/pkg/libprometheus/scrape_manager.go
new file mode 100644
index 0000000..0d7bcaf
--- /dev/null
+++ b/pkg/libprometheus/scrape_manager.go
@@ -0,0 +1,88 @@
+package libprometheus
+
+import (
+	"fmt"
+	"path/filepath"
+	"time"
+
+	prometheusreg "github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/common/model"
+	"github.com/prometheus/prometheus/config"
+	"github.com/prometheus/prometheus/discovery"
+	"github.com/prometheus/prometheus/discovery/targetgroup"
+	"github.com/prometheus/prometheus/scrape"
+	"github.com/prometheus/prometheus/storage"
+)
+
+// LoadPrometheusConfig reads and parses dataDir/config.yaml using the
+// standard Prometheus config loader.
+func LoadPrometheusConfig(dataDir string) (*config.Config, error) {
+	path := filepath.Join(dataDir, "config.yaml")
+	cfg, err := config.LoadFile(path, false, NewZerologSlogger())
+	if err != nil {
+		return nil, fmt.Errorf("load prometheus config %q: %w", path, err)
+	}
+	return cfg, nil
+}
+
+// NewScrapeManagerFromConfig creates a scrape.Manager from a loaded Prometheus
+// config. It also returns a pre-populated target-sets channel ready to pass to
+// Manager.Run() — targets are extracted from the config's static_configs so the
+// file remains the single source of truth.
+func NewScrapeManagerFromConfig(
+	cfg *config.Config,
+	appendable storage.Appendable,
+	reg prometheusreg.Registerer,
+) (*scrape.Manager, chan map[string][]*targetgroup.Group, error) {
+	// DiscoveryReloadInterval defaults to 5s in Prometheus v0.310.0+.
+	// For a single static target this is just the delay before the first scrape;
+	// cap it at 1s so startup latency stays acceptable regardless of the
+	// configured scrape interval.
+	reloadInterval := time.Duration(cfg.GlobalConfig.ScrapeInterval)
+	if reloadInterval == 0 || reloadInterval > time.Second {
+		reloadInterval = time.Second
+	}
+	opts := &scrape.Options{
+		DiscoveryReloadInterval: model.Duration(reloadInterval),
+	}
+
+	mgr, err := scrape.NewManager(opts, NewZerologSlogger(), nil, appendable, nil, reg)
+	if err != nil {
+		return nil, nil, fmt.Errorf("create scrape manager: %w", err)
+	}
+
+	if err := mgr.ApplyConfig(cfg); err != nil {
+		return nil, nil, fmt.Errorf("apply prometheus config: %w", err)
+	}
+
+	serviceDiscoveryConfigs := make(map[string]discovery.Configs, len(cfg.ScrapeConfigs))
+	for _, sc := range cfg.ScrapeConfigs {
+		serviceDiscoveryConfigs[sc.JobName] = sc.ServiceDiscoveryConfigs
+	}
+
+	return mgr, newStaticTargetSetsChannel(serviceDiscoveryConfigs), nil
+}
+
+// newStaticTargetSetsChannel builds the initial target-set payload for manager
+// startup from static discovery configs only.
+func newStaticTargetSetsChannel(serviceDiscoveryConfigs map[string]discovery.Configs) chan map[string][]*targetgroup.Group {
+	tsets := make(map[string][]*targetgroup.Group, len(serviceDiscoveryConfigs))
+	for key, configs := range serviceDiscoveryConfigs {
+		tsets[key] = staticTargetGroups(configs)
+	}
+
+	ch := make(chan map[string][]*targetgroup.Group, 1)
+	ch <- tsets
+	return ch
+}
+
+func staticTargetGroups(serviceDiscoveryConfigs discovery.Configs) []*targetgroup.Group {
+	var groups []*targetgroup.Group
+	for _, sdCfg := range serviceDiscoveryConfigs {
+		if static, ok := sdCfg.(discovery.StaticConfig); ok {
+			groups = append(groups, static...)
+		}
+	}
+
+	return groups
+}
diff --git a/pkg/libprometheus/scrape_test.go b/pkg/libprometheus/scrape_test.go
new file mode 100644
index 0000000..fcc6480
--- /dev/null
+++ b/pkg/libprometheus/scrape_test.go
@@ -0,0 +1,65 @@
+package libprometheus
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+
+	prometheusreg "github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/prometheus/model/labels"
+	"github.com/prometheus/prometheus/storage"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestAppendExpositionSamplesSkipsCompositeMetricFamilies(t *testing.T) {
+	db, err := OpenTSDB(TSDBConfig{
+		DataDir:           t.TempDir(),
+		RetentionDuration: time.Hour,
+		NoLockfile:        true,
+		Registry:          prometheusreg.NewRegistry(),
+	})
+	require.NoError(t, err)
+	defer func() { require.NoError(t, db.Close()) }()
+
+	exposition := strings.NewReader(`# TYPE test_gauge gauge
+test_gauge 42
+# TYPE test_summary summary
+test_summary{quantile="0.5"} 1
+test_summary_sum 1
+test_summary_count 1
+# TYPE test_histogram histogram
+test_histogram_bucket{le="1"} 1
+test_histogram_bucket{le="+Inf"} 1
+test_histogram_sum 1
+test_histogram_count 1
+`)
+
+	require.NoError(t, AppendExpositionSamples(t.Context(), db, exposition))
+
+	assert.True(t, hasSeries(t, db, "test_gauge"))
+	assert.False(t, hasSeries(t, db, "test_summary"))
+	assert.False(t, hasSeries(t, db, "test_histogram"))
+}
+
+func hasSeries(t *testing.T, db storage.Queryable, metricName string) bool {
+	t.Helper()
+
+	now := time.Now().UnixMilli()
+	q, err := db.Querier(now-60000, now+60000)
+	require.NoError(t, err)
+	defer func() { require.NoError(t, q.Close()) }()
+
+	matcher, err := labels.NewMatcher(labels.MatchEqual, "__name__", metricName)
+	require.NoError(t, err)
+
+	ss := q.Select(context.Background(), false, nil, matcher)
+
+	for ss.Next() {
+		return true
+	}
+
+	require.NoError(t, ss.Err())
+	return false
+}
diff --git a/pkg/libprometheus/tsdb.go b/pkg/libprometheus/tsdb.go
new file mode 100644
index 0000000..68ec828
--- /dev/null
+++ b/pkg/libprometheus/tsdb.go
@@ -0,0 +1,65 @@
+package libprometheus
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"time"
+
+	prometheusreg "github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/prometheus/tsdb"
+)
+
+// TSDBConfig holds the options needed to open a Prometheus TSDB.
+type TSDBConfig struct {
+	DataDir           string
+	RetentionDuration time.Duration
+	NoLockfile        bool
+	Registry          prometheusreg.Registerer
+}
+
+// OpenTSDB opens a Prometheus TSDB with the given configuration.
+func OpenTSDB(cfg TSDBConfig) (*tsdb.DB, error) {
+	return tsdb.Open(cfg.DataDir, NewZerologSlogger(), cfg.Registry, &tsdb.Options{
+		RetentionDuration: cfg.RetentionDuration.Milliseconds(),
+		NoLockfile:        cfg.NoLockfile,
+	}, nil)
+}
+
+// InMemoryDB wraps a *tsdb.DB opened in a temporary directory.
+// On Close the temp directory is removed, making the storage ephemeral —
+// data does not survive process restarts.
+type InMemoryDB struct {
+	*tsdb.DB
+	tmpDir string
+}
+
+// Close closes the underlying TSDB and removes the temporary directory.
+func (db *InMemoryDB) Close() error {
+	return errors.Join(db.DB.Close(), os.RemoveAll(db.tmpDir))
+}
+
+// inMemoryTSDBRetention is the retention window for the ephemeral edge evaluator
+// TSDB. Slightly over one hour so a full hour of samples is always queryable
+// without samples expiring exactly at the evaluation boundary.
+const inMemoryTSDBRetention = 65 * time.Minute
+
+// NewInMemoryTSDB opens an ephemeral Prometheus TSDB backed by a temp directory.
+// On Linux edge devices /tmp is typically tmpfs, so scrape data stays in RAM.
+// Use this for the edge evaluator where crash-recovery of scrape data is not needed.
+func NewInMemoryTSDB(reg prometheusreg.Registerer) (*InMemoryDB, error) {
+	dir, err := os.MkdirTemp("", "portainer-eval-tsdb-*")
+	if err != nil {
+		return nil, fmt.Errorf("create in-memory TSDB dir: %w", err)
+	}
+
+	db, err := tsdb.Open(dir, NewZerologSlogger(), reg, &tsdb.Options{
+		RetentionDuration: inMemoryTSDBRetention.Milliseconds(),
+		NoLockfile:        true,
+	}, nil)
+	if err != nil {
+		return nil, errors.Join(fmt.Errorf("open in-memory TSDB: %w", err), os.RemoveAll(dir))
+	}
+
+	return &InMemoryDB{DB: db, tmpDir: dir}, nil
+}
diff --git a/pkg/libprometheus/zerologhandler.go b/pkg/libprometheus/zerologhandler.go
new file mode 100644
index 0000000..2d762ed
--- /dev/null
+++ b/pkg/libprometheus/zerologhandler.go
@@ -0,0 +1,55 @@
+package libprometheus
+
+import (
+	"context"
+	"log/slog"
+
+	"github.com/rs/zerolog"
+	"github.com/rs/zerolog/log"
+)
+
+// zerologHandler is a slog.Handler that bridges to zerolog, so Prometheus
+// libraries (TSDB, rules.Manager) log through the application's zerolog pipeline
+// instead of bypassing it via slog.Default().
+//
+// TODO: replace with zerolog.NewSlogHandler once a tagged release includes it
+// (merged upstream in github.com/rs/zerolog#755).
+type zerologHandler struct{}
+
+func (h zerologHandler) Enabled(_ context.Context, level slog.Level) bool {
+	return log.Logger.GetLevel() <= slogToZerologLevel(level)
+}
+
+func (h zerologHandler) Handle(_ context.Context, rec slog.Record) error {
+	event := log.Logger.WithLevel(slogToZerologLevel(rec.Level)) //nolint:zerologlint // matches zerolog's own SlogHandler implementation (rs/zerolog#755)
+	if event == nil {
+		return nil
+	}
+	rec.Attrs(func(a slog.Attr) bool {
+		event = event.Str(a.Key, a.Value.String())
+		return true
+	})
+	event.Msg(rec.Message)
+	return nil
+}
+
+func (h zerologHandler) WithAttrs(_ []slog.Attr) slog.Handler { return h }
+func (h zerologHandler) WithGroup(_ string) slog.Handler      { return h }
+
+func slogToZerologLevel(l slog.Level) zerolog.Level {
+	switch {
+	case l >= slog.LevelError:
+		return zerolog.ErrorLevel
+	case l >= slog.LevelWarn:
+		return zerolog.WarnLevel
+	case l >= slog.LevelInfo:
+		return zerolog.InfoLevel
+	default:
+		return zerolog.DebugLevel
+	}
+}
+
+// NewZerologSlogger returns an *slog.Logger that writes through zerolog.
+func NewZerologSlogger() *slog.Logger {
+	return slog.New(zerologHandler{})
+}
diff --git a/pkg/librand/rand.go b/pkg/librand/rand.go
new file mode 100644
index 0000000..10b5321
--- /dev/null
+++ b/pkg/librand/rand.go
@@ -0,0 +1,47 @@
+package librand
+
+import (
+	"crypto/rand"
+	"fmt"
+	"math/big"
+	mrand "math/rand/v2"
+
+	"github.com/portainer/portainer/pkg/fips"
+)
+
+func Intn(max int) int {
+	return intn(max, fips.FIPSMode())
+}
+
+func intn(max int, fips bool) int {
+	return int(int64n(int64(max), fips))
+}
+
+func int64n(max int64, fips bool) int64 {
+	if !fips {
+		return mrand.Int64N(max)
+	}
+
+	i, err := rand.Int(rand.Reader, big.NewInt(max))
+	if err != nil {
+		panic(fmt.Sprintf("failed to generate a random number: %v", err))
+	}
+	if !i.IsInt64() {
+		panic("generated random number cannot be represented as an int64")
+	}
+
+	return i.Int64()
+}
+
+func Float64() float64 {
+	return randomFloat64(fips.FIPSMode())
+}
+
+func randomFloat64(fips bool) float64 {
+	if !fips {
+		return mrand.Float64()
+	}
+
+	// This is based of this comment https://cs.opensource.google/go/go/+/refs/tags/go1.24.5:src/math/rand/v2/rand.go;l=209
+	return float64(int64n(1<<53, fips) / (1 << 53))
+}
diff --git a/pkg/librand/rand_test.go b/pkg/librand/rand_test.go
new file mode 100644
index 0000000..4644f5e
--- /dev/null
+++ b/pkg/librand/rand_test.go
@@ -0,0 +1,85 @@
+package librand
+
+import (
+	"testing"
+
+	"github.com/portainer/portainer/pkg/fips"
+)
+
+func init() {
+	fips.InitFIPS(false)
+}
+
+func TestIntn(t *testing.T) {
+	t.Parallel()
+	i := Intn(10)
+
+	if i >= 10 || i < 0 {
+		t.Fatalf("random number %d wasn't within interval", i)
+	}
+}
+
+func TestInternalIntn(t *testing.T) {
+	t.Parallel()
+	testCases := []struct {
+		name string
+		max  int
+		fips bool
+	}{
+		{
+			name: "non-fips mode",
+			max:  10,
+			fips: false,
+		},
+		{
+			name: "fips mode",
+			max:  10,
+			fips: true,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			i := intn(tc.max, tc.fips)
+
+			if i >= tc.max || i < 0 {
+				t.Fatalf("random number %d wasn't within interval", i)
+			}
+		})
+	}
+}
+
+func TestFloat64(t *testing.T) {
+	t.Parallel()
+	f := Float64()
+
+	if f >= 1 || f < 0 {
+		t.Fatalf("random float %v wasn't within interval", f)
+	}
+}
+
+func TestInternalFloat64(t *testing.T) {
+	t.Parallel()
+	testCases := []struct {
+		name string
+		fips bool
+	}{
+		{
+			name: "non-fips mode",
+			fips: false,
+		},
+		{
+			name: "fips mode",
+			fips: true,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			f := randomFloat64(tc.fips)
+			if f >= 1 || f < 0 {
+				t.Fatalf("random float %v wasn't within interval", f)
+			}
+		})
+	}
+}
diff --git a/pkg/libstack/LICENSE.md b/pkg/libstack/LICENSE.md
new file mode 100644
index 0000000..cc784e1
--- /dev/null
+++ b/pkg/libstack/LICENSE.md
@@ -0,0 +1,7 @@
+Copyright 2021 Portainer.io
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/pkg/libstack/README.md b/pkg/libstack/README.md
new file mode 100644
index 0000000..8e60738
--- /dev/null
+++ b/pkg/libstack/README.md
@@ -0,0 +1,3 @@
+# LibStack
+
+LibStack is a library that provides an abstraction to run stacks. Currently it supports Docker Compose, but we plan to support other formats in the future.
diff --git a/pkg/libstack/compose/bind_mount_hash.go b/pkg/libstack/compose/bind_mount_hash.go
new file mode 100644
index 0000000..e49a637
--- /dev/null
+++ b/pkg/libstack/compose/bind_mount_hash.go
@@ -0,0 +1,149 @@
+package compose
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"io"
+	"os"
+	"path/filepath"
+	"sort"
+
+	"github.com/compose-spec/compose-go/v2/types"
+	"github.com/rs/zerolog/log"
+)
+
+const BindMountHashLabelKey = "io.portainer.bind-mount-hash"
+
+func addBindMountHashLabel(name string, s types.ServiceConfig) (types.ServiceConfig, error) {
+	hashes := []string{}
+
+	for _, volume := range s.Volumes {
+		// Calculate hash for bind mounts only for now
+		if volume.Type != "bind" {
+			continue
+		}
+
+		// Calculate hash for volume.Source, volume.Source can be a file or dir
+		// and volume.Source is already an absolute path so we can hash it directly
+		hash, err := pathHash(volume.Source)
+		if err != nil {
+			// If we fail to calculate the hash for this bind mount, skip it and continue
+			log.Debug().Err(err).
+				Str("bind_mount_source", volume.Source).
+				Str("service", name).
+				Msg("failed to calculate hash for bind mount, skipping this bind mount from hash label calculation")
+			continue
+		}
+
+		if hash != "" {
+			hashes = append(hashes, hash)
+		}
+	}
+
+	if len(hashes) == 0 {
+		return s, nil
+	}
+
+	// Sort hashes to ensure deterministic output
+	sort.Strings(hashes)
+
+	// Final hash of the combined hashes
+	finalH := sha256.New()
+	for _, h := range hashes {
+		finalH.Write([]byte(h))
+	}
+
+	value := hex.EncodeToString(finalH.Sum(nil))
+
+	if s.Labels == nil {
+		s.Labels = make(map[string]string)
+	}
+	s.Labels[BindMountHashLabelKey] = value
+
+	log.Debug().Str("service", name).
+		Str("label_key", BindMountHashLabelKey).
+		Str("bind_mount_hash", value).
+		Msg("Calculated bind mount hash for service")
+
+	return s, nil
+}
+
+// pathHash calculates a SHA-256 hash for a file or a directory.
+func pathHash(path string) (string, error) {
+	hash := sha256.New()
+
+	info, err := os.Stat(path)
+	if err != nil {
+		return "", err
+	}
+
+	if !info.IsDir() {
+		// It's a single file
+		return hashFile(path)
+	}
+
+	// It's a directory: we must collect and sort all files for determinism
+	var files []string
+	if err := filepath.Walk(path, func(p string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+		if !info.IsDir() {
+			files = append(files, p)
+		}
+		return nil
+	}); err != nil {
+		return "", err
+	}
+	sort.Strings(files)
+
+	for _, f := range files {
+		// Include the relative path in the hash so that renames and moves within
+		// the directory change the hash even when file contents stay the same.
+		relPath, err := filepath.Rel(path, f)
+		if err != nil {
+			return "", err
+		}
+		if _, err := hash.Write([]byte(relPath)); err != nil {
+			return "", err
+		}
+
+		// Stream the file content into the same hasher
+		if err := copyFileToHash(hash, f); err != nil {
+			return "", err
+		}
+	}
+
+	return hex.EncodeToString(hash.Sum(nil)), nil
+}
+
+func hashFile(path string) (string, error) {
+	h := sha256.New()
+	if err := copyFileToHash(h, path); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(h.Sum(nil)), nil
+}
+
+// copyFileToHash opens the file at path, streams its content into w, and closes it.
+// If the copy fails, the close error is logged but the copy error is returned.
+// If the copy succeeds but close fails, the close error is returned.
+func copyFileToHash(w io.Writer, path string) (err error) {
+	f, err := os.Open(path)
+	if err != nil {
+		return err
+	}
+	defer func() {
+		if cerr := f.Close(); cerr != nil {
+			log.Debug().Err(cerr).
+				Str("filename", path).
+				Msg("error closing file after hash")
+			if err == nil {
+				err = cerr
+			}
+		}
+	}()
+
+	_, err = io.Copy(w, f)
+	return err
+}
diff --git a/pkg/libstack/compose/bind_mount_hash_test.go b/pkg/libstack/compose/bind_mount_hash_test.go
new file mode 100644
index 0000000..00f2500
--- /dev/null
+++ b/pkg/libstack/compose/bind_mount_hash_test.go
@@ -0,0 +1,129 @@
+package compose
+
+import (
+	"os"
+	"testing"
+
+	"github.com/portainer/portainer/api/filesystem"
+
+	"github.com/compose-spec/compose-go/v2/types"
+	"github.com/stretchr/testify/require"
+)
+
+func TestPathHash_File(t *testing.T) {
+	t.Parallel()
+	dir := t.TempDir()
+	path := filesystem.JoinPaths(dir, "file.txt")
+
+	require.NoError(t, os.WriteFile(path, []byte("hello"), 0644))
+
+	h1, err := pathHash(path)
+	require.NoError(t, err)
+	require.NotEmpty(t, h1)
+
+	// Same content, same hash
+	h2, err := pathHash(path)
+	require.NoError(t, err)
+	require.Equal(t, h1, h2)
+
+	// Different content, different hash
+	require.NoError(t, os.WriteFile(path, []byte("world"), 0644))
+	h3, err := pathHash(path)
+	require.NoError(t, err)
+	require.NotEqual(t, h1, h3)
+}
+
+func TestPathHash_Directory(t *testing.T) {
+	t.Parallel()
+	dir := t.TempDir()
+	require.NoError(t, os.WriteFile(filesystem.JoinPaths(dir, "a.txt"), []byte("aaa"), 0644))
+	require.NoError(t, os.WriteFile(filesystem.JoinPaths(dir, "b.txt"), []byte("bbb"), 0644))
+
+	h1, err := pathHash(dir)
+	require.NoError(t, err)
+
+	// Same directory -> same hash
+	h2, err := pathHash(dir)
+	require.NoError(t, err)
+	require.Equal(t, h1, h2)
+
+	// Rename a file -> different hash (relative path is part of the hash)
+	require.NoError(t, os.Rename(filesystem.JoinPaths(dir, "a.txt"), filesystem.JoinPaths(dir, "c.txt")))
+	h3, err := pathHash(dir)
+	require.NoError(t, err)
+	require.NotEqual(t, h1, h3, "renaming a file should change the directory hash")
+
+	// Restore and change content -> different hash
+	require.NoError(t, os.Rename(filesystem.JoinPaths(dir, "c.txt"), filesystem.JoinPaths(dir, "a.txt")))
+	require.NoError(t, os.WriteFile(filesystem.JoinPaths(dir, "a.txt"), []byte("modified"), 0644))
+	h4, err := pathHash(dir)
+	require.NoError(t, err)
+	require.NotEqual(t, h1, h4, "changing file content should change the directory hash")
+}
+
+func TestAddBindMountHashLabel(t *testing.T) {
+	t.Parallel()
+	dir := t.TempDir()
+	webDir := filesystem.JoinPaths(dir, "web")
+	require.NoError(t, os.MkdirAll(webDir, 0755))
+	require.NoError(t, os.WriteFile(filesystem.JoinPaths(webDir, "nginx.conf"), []byte("server {}"), 0644))
+
+	t.Run("no bind mounts", func(t *testing.T) {
+		svc := types.ServiceConfig{Name: "web"}
+		result, err := addBindMountHashLabel("web", svc)
+		require.NoError(t, err)
+		require.Empty(t, result.Labels[BindMountHashLabelKey])
+	})
+
+	t.Run("non-bind volume is skipped", func(t *testing.T) {
+		svc := types.ServiceConfig{
+			Name:    "web",
+			Volumes: []types.ServiceVolumeConfig{{Type: "volume", Source: "myvolume"}},
+		}
+		result, err := addBindMountHashLabel("web", svc)
+		require.NoError(t, err)
+		require.Empty(t, result.Labels[BindMountHashLabelKey])
+	})
+
+	t.Run("missing path silently skips label", func(t *testing.T) {
+		svc := types.ServiceConfig{
+			Name:    "web",
+			Volumes: []types.ServiceVolumeConfig{{Type: "bind", Source: "/nonexistent/path"}},
+		}
+		result, err := addBindMountHashLabel("web", svc)
+		require.NoError(t, err)
+		require.Empty(t, result.Labels[BindMountHashLabelKey])
+	})
+
+	t.Run("valid bind mount with directory source sets label", func(t *testing.T) {
+		svc := types.ServiceConfig{
+			Name:    "web",
+			Volumes: []types.ServiceVolumeConfig{{Type: "bind", Source: webDir}},
+		}
+		result, err := addBindMountHashLabel("web", svc)
+		require.NoError(t, err)
+		require.NotEmpty(t, result.Labels[BindMountHashLabelKey])
+	})
+
+	t.Run("valid bind mount with file source sets label", func(t *testing.T) {
+		svc := types.ServiceConfig{
+			Name:    "web",
+			Volumes: []types.ServiceVolumeConfig{{Type: "bind", Source: filesystem.JoinPaths(webDir, "nginx.conf")}},
+		}
+		result, err := addBindMountHashLabel("web", svc)
+		require.NoError(t, err)
+		require.NotEmpty(t, result.Labels[BindMountHashLabelKey])
+	})
+
+	t.Run("label is deterministic", func(t *testing.T) {
+		svc := types.ServiceConfig{
+			Name:    "web",
+			Volumes: []types.ServiceVolumeConfig{{Type: "bind", Source: webDir}},
+		}
+		r1, err := addBindMountHashLabel("web", svc)
+		require.NoError(t, err)
+		r2, err := addBindMountHashLabel("web", svc)
+		require.NoError(t, err)
+		require.Equal(t, r1.Labels[BindMountHashLabelKey], r2.Labels[BindMountHashLabelKey])
+	})
+}
diff --git a/pkg/libstack/compose/compose.go b/pkg/libstack/compose/compose.go
new file mode 100644
index 0000000..73b50f0
--- /dev/null
+++ b/pkg/libstack/compose/compose.go
@@ -0,0 +1,18 @@
+package compose
+
+import (
+	"github.com/docker/cli/cli/command"
+	"github.com/docker/compose/v2/pkg/api"
+	"github.com/docker/compose/v2/pkg/compose"
+)
+
+type ComposeDeployer struct {
+	createComposeServiceFn func(command.Cli, ...compose.Option) api.Compose
+}
+
+// NewComposeDeployer creates a new compose deployer
+func NewComposeDeployer() *ComposeDeployer {
+	return &ComposeDeployer{
+		createComposeServiceFn: compose.NewComposeService,
+	}
+}
diff --git a/pkg/libstack/compose/compose_test.go b/pkg/libstack/compose/compose_test.go
new file mode 100644
index 0000000..5d068a3
--- /dev/null
+++ b/pkg/libstack/compose/compose_test.go
@@ -0,0 +1,100 @@
+package compose_test
+
+import (
+	"log"
+	"os"
+	"os/exec"
+	"strings"
+	"testing"
+
+	"github.com/portainer/portainer/api/filesystem"
+	"github.com/portainer/portainer/pkg/libstack"
+	"github.com/portainer/portainer/pkg/libstack/compose"
+	"github.com/portainer/portainer/pkg/testhelpers"
+)
+
+func checkPrerequisites(t *testing.T) {
+	testhelpers.IntegrationTest(t)
+}
+
+func Test_UpAndDown(t *testing.T) {
+	t.Parallel()
+	checkPrerequisites(t)
+
+	deployer := compose.NewComposeDeployer()
+
+	const composeFileContent = `
+    version: "3.9"
+    services:
+      busybox:
+        image: "alpine:3.7"
+        container_name: "binarytest_container_one"
+    `
+
+	const overrideComposeFileContent = `
+    version: "3.9"
+    services:
+      busybox:
+        image: "alpine:latest"
+        container_name: "binarytest_container_two"
+    `
+
+	const composeContainerName = "binarytest_container_two"
+
+	dir := t.TempDir()
+
+	filePathOriginal, err := createFile(dir, "docker-compose.yml", composeFileContent)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	filePathOverride, err := createFile(dir, "docker-compose-override.yml", overrideComposeFileContent)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	projectName := "binarytest"
+
+	err = deployer.Deploy(t.Context(), []string{filePathOriginal, filePathOverride}, libstack.DeployOptions{
+		Options: libstack.Options{
+			ProjectName: projectName,
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if !containerExists(composeContainerName) {
+		t.Fatal("container should exist")
+	}
+
+	err = deployer.Remove(t.Context(), projectName, []string{filePathOriginal, filePathOverride}, libstack.RemoveOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if containerExists(composeContainerName) {
+		t.Fatal("container should be removed")
+	}
+}
+
+func createFile(dir, fileName, content string) (string, error) {
+	filePath := filesystem.JoinPaths(dir, fileName)
+
+	if err := os.WriteFile(filePath, []byte(content), 0644); err != nil {
+		return "", err
+	}
+
+	return filePath, nil
+}
+
+func containerExists(containerName string) bool {
+	cmd := exec.Command("docker", "ps", "-a", "-f", "name="+containerName)
+
+	out, err := cmd.Output()
+	if err != nil {
+		log.Fatalf("failed to list containers: %s", err)
+	}
+
+	return strings.Contains(string(out), containerName)
+}
diff --git a/pkg/libstack/compose/composeplugin.go b/pkg/libstack/compose/composeplugin.go
new file mode 100644
index 0000000..376e081
--- /dev/null
+++ b/pkg/libstack/compose/composeplugin.go
@@ -0,0 +1,359 @@
+package compose
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"maps"
+	"os"
+	"path/filepath"
+	"slices"
+	"strconv"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/filesystem"
+	"github.com/portainer/portainer/pkg/libstack"
+
+	"github.com/compose-spec/compose-go/v2/cli"
+	"github.com/compose-spec/compose-go/v2/types"
+	"github.com/docker/cli/cli/command"
+	cmdcompose "github.com/docker/compose/v2/cmd/compose"
+	"github.com/docker/compose/v2/pkg/api"
+	"github.com/docker/compose/v2/pkg/compose"
+	"github.com/docker/compose/v2/pkg/utils"
+	"github.com/rs/zerolog/log"
+	"github.com/sirupsen/logrus"
+)
+
+const PortainerEdgeStackLabel = "io.portainer.edge_stack_id"
+
+func init() {
+	logrus.SetOutput(LogrusToZerologWriter{})
+	logrus.SetFormatter(&logrus.TextFormatter{
+		DisableTimestamp: true,
+	})
+}
+
+func (c *ComposeDeployer) withComposeService(
+	ctx context.Context,
+	filePaths []string,
+	options libstack.Options,
+	composeFn func(api.Compose, *types.Project) error,
+) error {
+	return libstack.WithCli(ctx,
+		libstack.DockerCliOptions{Host: options.Host, Registries: options.Registries},
+		func(ctx context.Context, cli *command.DockerCli) error {
+			composeService := c.createComposeServiceFn(cli)
+
+			if len(filePaths) == 0 {
+				return composeFn(composeService, nil)
+			}
+
+			project, err := createProject(ctx, filePaths, options)
+			if err != nil {
+				return fmt.Errorf("failed to create compose project: %w", err)
+			}
+
+			parallel := 0
+			if v, ok := project.Environment[cmdcompose.ComposeParallelLimit]; ok {
+				i, err := strconv.Atoi(v)
+				if err != nil {
+					return fmt.Errorf("%s must be an integer (found: %q)", cmdcompose.ComposeParallelLimit, v)
+				}
+				parallel = i
+			}
+			if parallel > 0 {
+				composeService.MaxConcurrency(parallel)
+			}
+
+			return composeFn(composeService, project)
+		})
+}
+
+// Deploy creates and starts containers
+func (c *ComposeDeployer) Deploy(ctx context.Context, filePaths []string, options libstack.DeployOptions) error {
+	return c.withComposeService(ctx, filePaths, options.Options, func(composeService api.Compose, project *types.Project) error {
+		addServiceLabels(project, false, options.EdgeStackID)
+
+		project = project.WithoutUnnecessaryResources()
+
+		opts := api.UpOptions{
+			Start: api.StartOptions{
+				Project: project,
+			},
+		}
+		if options.ForceRecreate {
+			opts.Create.Recreate = api.RecreateForce
+		}
+
+		opts.Create.RemoveOrphans = options.RemoveOrphans
+		if removeOrphans, ok := project.Environment[cmdcompose.ComposeRemoveOrphans]; ok {
+			opts.Create.RemoveOrphans = utils.StringToBool(removeOrphans)
+		}
+		if ignoreOrphans, ok := project.Environment[cmdcompose.ComposeIgnoreOrphans]; ok {
+			opts.Create.IgnoreOrphans = utils.StringToBool(ignoreOrphans)
+		}
+
+		if options.AbortOnContainerExit {
+			opts.Start.OnExit = api.CascadeStop
+		}
+
+		if err := composeService.Build(ctx, project, api.BuildOptions{}); err != nil {
+			return fmt.Errorf("compose build operation failed: %w", err)
+		}
+
+		if err := composeService.Up(ctx, project, opts); err != nil {
+			return fmt.Errorf("compose up operation failed: %w", err)
+		}
+
+		log.Info().Msg("Stack deployment successful")
+
+		return nil
+	})
+}
+
+// Run runs the given service just once, without considering dependencies
+func (c *ComposeDeployer) Run(ctx context.Context, filePaths []string, serviceName string, options libstack.RunOptions) error {
+	return c.withComposeService(ctx, filePaths, options.Options, func(composeService api.Compose, project *types.Project) error {
+		addServiceLabels(project, true, 0)
+
+		for name, service := range project.Services {
+			if name == serviceName {
+				project.DisabledServices[serviceName] = service
+			}
+		}
+
+		project.Services = make(types.Services)
+
+		if err := composeService.Create(ctx, project, api.CreateOptions{RemoveOrphans: true}); err != nil {
+			return fmt.Errorf("compose create operation failed: %w", err)
+		}
+
+		maps.Copy(project.Services, project.DisabledServices)
+		project.DisabledServices = make(types.Services)
+
+		opts := api.RunOptions{
+			AutoRemove: options.Remove,
+			Command:    options.Args,
+			Detach:     options.Detached,
+			Service:    serviceName,
+		}
+
+		if _, err := composeService.RunOneOffContainer(ctx, project, opts); err != nil {
+			return fmt.Errorf("compose run operation failed: %w", err)
+		}
+
+		log.Info().Msg("Stack run successful")
+
+		return nil
+	})
+}
+
+// Remove stops and removes containers
+func (c *ComposeDeployer) Remove(ctx context.Context, projectName string, filePaths []string, options libstack.RemoveOptions) error {
+	if err := libstack.WithCli(ctx,
+		libstack.DockerCliOptions{Host: options.Host, Registries: options.Registries},
+		func(ctx context.Context, cli *command.DockerCli) error {
+			composeService := compose.NewComposeService(cli)
+
+			return composeService.Down(ctx, projectName, api.DownOptions{RemoveOrphans: true, Volumes: options.Volumes})
+		}); err != nil {
+		return fmt.Errorf("compose down operation failed: %w", err)
+	}
+
+	log.Info().Msg("Stack removal successful")
+
+	return nil
+}
+
+// Pull pulls images
+func (c *ComposeDeployer) Pull(ctx context.Context, filePaths []string, options libstack.Options) error {
+	if err := c.withComposeService(ctx, filePaths, options, func(composeService api.Compose, project *types.Project) error {
+		return composeService.Pull(ctx, project, api.PullOptions{})
+	}); err != nil {
+		return fmt.Errorf("compose pull operation failed: %w", err)
+	}
+
+	log.Info().Msg("Stack pull successful")
+
+	return nil
+}
+
+// Validate validates stack file
+func (c *ComposeDeployer) Validate(ctx context.Context, filePaths []string, options libstack.Options) error {
+	return c.withComposeService(ctx, filePaths, options, func(composeService api.Compose, project *types.Project) error {
+		return nil
+	})
+}
+
+// Config returns the compose file with the paths resolved
+func (c *ComposeDeployer) Config(ctx context.Context, filePaths []string, options libstack.Options) ([]byte, error) {
+	var payload []byte
+
+	if err := c.withComposeService(ctx, filePaths, options, func(composeService api.Compose, project *types.Project) error {
+		var err error
+		payload, err = project.MarshalYAML()
+		if err != nil {
+			return fmt.Errorf("unable to marshal as YAML: %w", err)
+		}
+
+		return nil
+	}); err != nil {
+		return nil, fmt.Errorf("compose config operation failed: %w", err)
+	}
+
+	return payload, nil
+}
+
+func (c *ComposeDeployer) GetExistingEdgeStacks(ctx context.Context) ([]libstack.EdgeStack, error) {
+	m := make(map[int]libstack.EdgeStack)
+
+	if err := c.withComposeService(ctx, nil, libstack.Options{}, func(composeService api.Compose, project *types.Project) error {
+		stacks, err := composeService.List(ctx, api.ListOptions{
+			All: true,
+		})
+		if err != nil {
+			return err
+		}
+
+		for _, s := range stacks {
+			summary, err := composeService.Ps(ctx, s.Name, api.PsOptions{All: true})
+			if err != nil {
+				return err
+			}
+
+			for _, cs := range summary {
+				if sid, ok := cs.Labels[PortainerEdgeStackLabel]; ok {
+					id, err := strconv.Atoi(sid)
+					if err != nil {
+						return err
+					}
+
+					if cs.Labels[api.ProjectLabel] == "" {
+						return errors.New("invalid project label")
+					}
+
+					m[id] = libstack.EdgeStack{
+						ID:       id,
+						Name:     cs.Labels[api.ProjectLabel],
+						ExitCode: cs.ExitCode,
+					}
+				}
+			}
+		}
+
+		return nil
+	}); err != nil {
+		return nil, err
+	}
+
+	return slices.Collect(maps.Values(m)), nil
+}
+
+func addServiceLabels(project *types.Project, oneOff bool, edgeStackID portainer.EdgeStackID) {
+	oneOffLabel := "False"
+	if oneOff {
+		oneOffLabel = "True"
+	}
+
+	for i, s := range project.Services {
+		s.CustomLabels = map[string]string{
+			api.ProjectLabel:     project.Name,
+			api.ServiceLabel:     s.Name,
+			api.VersionLabel:     api.ComposeVersion,
+			api.WorkingDirLabel:  project.WorkingDir,
+			api.ConfigFilesLabel: strings.Join(project.ComposeFiles, ","),
+			api.OneoffLabel:      oneOffLabel,
+		}
+
+		if edgeStackID > 0 {
+			s.CustomLabels.Add(PortainerEdgeStackLabel, strconv.Itoa(int(edgeStackID)))
+		}
+
+		project.Services[i] = s
+	}
+}
+
+func createProject(ctx context.Context, configFilepaths []string, options libstack.Options) (*types.Project, error) {
+	var workingDir string
+	if len(configFilepaths) > 0 {
+		workingDir = filepath.Dir(configFilepaths[0])
+	}
+
+	if options.ProjectDir != "" {
+		// When relative paths are used in the compose file, the project directory is used as the base path
+		workingDir = options.ProjectDir
+	}
+
+	var envFiles []string
+	if options.EnvFilePath != "" {
+		envFiles = append(envFiles, options.EnvFilePath)
+	}
+
+	var composeEnvVars []string
+	for _, ev := range os.Environ() {
+		if strings.HasPrefix(ev, "COMPOSE_") {
+			composeEnvVars = append(composeEnvVars, ev)
+		}
+	}
+
+	projectOptions, err := cli.NewProjectOptions(configFilepaths,
+		cli.WithWorkingDirectory(workingDir),
+		cli.WithName(options.ProjectName),
+		cli.WithoutEnvironmentResolution,
+		cli.WithResolvedPaths(!slices.Contains(options.ConfigOptions, "--no-path-resolution")),
+		cli.WithEnv(libstack.PortainerEnvVars()),
+		cli.WithEnv(composeEnvVars),
+		cli.WithEnv(options.Env),
+		cli.WithEnvFiles(envFiles...),
+		func(o *cli.ProjectOptions) error {
+			if len(o.EnvFiles) > 0 {
+				return nil
+			}
+
+			if fs, ok := o.Environment[cmdcompose.ComposeEnvFiles]; ok {
+				o.EnvFiles = strings.Split(fs, ",")
+			}
+			return nil
+		},
+		cli.WithDotEnv,
+		cli.WithDefaultProfiles(),
+		cli.WithConfigFileEnv,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("failed to load the compose file options : %w", err)
+	}
+
+	project, err := projectOptions.LoadProject(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("failed to load the compose file : %w", err)
+	}
+
+	// Work around compose path handling
+	for i, service := range project.Services {
+		for j, envFile := range service.EnvFiles {
+			if !filepath.IsAbs(envFile.Path) {
+				project.Services[i].EnvFiles[j].Path = filesystem.JoinPaths(workingDir, envFile.Path)
+			}
+		}
+	}
+
+	// Set the services environment variables
+	if p, err := project.WithServicesEnvironmentResolved(true); err == nil {
+		project = p
+	} else {
+		return nil, fmt.Errorf("failed to resolve services environment: %w", err)
+	}
+
+	if options.BindMountHashEnabled {
+		// Set per-service label for bind mount hashes under each service
+		if project, err = project.WithServicesTransform(addBindMountHashLabel); err != nil {
+			log.Warn().
+				Err(err).
+				Msg("Failed to set bind mount hash labels, proceeding without them. Stack updates may not be detected when bind-mounted files change")
+		}
+	}
+
+	return project, nil
+}
diff --git a/pkg/libstack/compose/composeplugin_test.go b/pkg/libstack/compose/composeplugin_test.go
new file mode 100644
index 0000000..24e4748
--- /dev/null
+++ b/pkg/libstack/compose/composeplugin_test.go
@@ -0,0 +1,1468 @@
+package compose
+
+import (
+	"context"
+	"errors"
+	"log"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"sync"
+	"testing"
+
+	"github.com/portainer/portainer/api/filesystem"
+	"github.com/portainer/portainer/pkg/libstack"
+
+	"github.com/compose-spec/compose-go/v2/consts"
+	"github.com/compose-spec/compose-go/v2/types"
+	"github.com/docker/cli/cli/command"
+	"github.com/docker/cli/cli/config"
+	configtypes "github.com/docker/cli/cli/config/types"
+	cmdcompose "github.com/docker/compose/v2/cmd/compose"
+	"github.com/docker/compose/v2/pkg/api"
+	"github.com/docker/compose/v2/pkg/compose"
+	"github.com/google/go-cmp/cmp"
+	zerolog "github.com/rs/zerolog/log"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_UpAndDown(t *testing.T) {
+	const projectName = "composetest"
+
+	const composeFileContent = `
+services:
+  busybox:
+    image: "alpine:3.7"
+    container_name: "composetest_container_one"`
+
+	const overrideComposeFileContent = `
+services:
+  busybox:
+    image: "alpine:latest"
+    container_name: "composetest_container_two"`
+
+	composeContainerName := projectName + "_container_two"
+
+	w := NewComposeDeployer()
+
+	dir := t.TempDir()
+
+	filePathOriginal := createFile(t, dir, "docker-compose.yml", composeFileContent)
+	filePathOverride := createFile(t, dir, "docker-compose-override.yml", overrideComposeFileContent)
+
+	filePaths := []string{filePathOriginal, filePathOverride}
+
+	err := w.Validate(t.Context(), filePaths, libstack.Options{ProjectName: projectName})
+	require.NoError(t, err)
+
+	err = w.Pull(t.Context(), filePaths, libstack.Options{ProjectName: projectName})
+	require.NoError(t, err)
+
+	require.False(t, containerExists(composeContainerName))
+
+	err = w.Deploy(t.Context(), filePaths, libstack.DeployOptions{
+		Options: libstack.Options{
+			ProjectName: projectName,
+		},
+	})
+	require.NoError(t, err)
+
+	require.True(t, containerExists(composeContainerName))
+
+	waitResult := w.WaitForStatus(t.Context(), projectName, libstack.StatusCompleted)
+
+	require.Empty(t, waitResult.ErrorMsg)
+	require.Equal(t, libstack.StatusCompleted, waitResult.Status)
+
+	err = w.Remove(t.Context(), projectName, filePaths, libstack.RemoveOptions{})
+	require.NoError(t, err)
+
+	require.False(t, containerExists(composeContainerName))
+}
+
+// Detect regression in container injections.
+// Ref BE-12432
+// Ref https://github.com/portainer/portainer/issues/12909
+func Test_UpAndDownWithInjection(t *testing.T) {
+	const content = `
+services:
+  test:
+    image: alpine:latest
+    container_name: "composetest_alpine"
+    command: ["sh", "-c", "cat /test.txt"]
+    configs:
+      - source: test-config
+        target: /test.txt
+
+configs:
+  test-config:
+    content: |
+      Hello from inline config!
+      This should appear in the container.
+`
+	const projectName = "composetest"
+	const containerName = "composetest_alpine"
+	w := NewComposeDeployer()
+
+	dir := t.TempDir()
+
+	filePath := createFile(t, dir, "docker-compose.yml", content)
+	filePaths := []string{filePath}
+
+	err := w.Validate(t.Context(), filePaths, libstack.Options{ProjectName: projectName})
+	require.NoError(t, err)
+
+	err = w.Pull(t.Context(), filePaths, libstack.Options{ProjectName: projectName})
+	require.NoError(t, err)
+
+	require.False(t, containerExists(containerName))
+
+	err = w.Deploy(t.Context(), filePaths, libstack.DeployOptions{
+		Options: libstack.Options{
+			ProjectName: projectName,
+		},
+	})
+	require.NoError(t, err)
+
+	require.True(t, containerExists(containerName))
+
+	waitResult := w.WaitForStatus(t.Context(), projectName, libstack.StatusCompleted)
+
+	require.Empty(t, waitResult.ErrorMsg)
+	require.Equal(t, libstack.StatusCompleted, waitResult.Status)
+
+	err = w.Remove(t.Context(), projectName, filePaths, libstack.RemoveOptions{})
+	require.NoError(t, err)
+
+	require.False(t, containerExists(containerName))
+}
+
+func TestRun(t *testing.T) {
+	w := NewComposeDeployer()
+
+	filePath := createFile(t, t.TempDir(), "docker-compose.yml", `
+services:
+  updater:
+    image: alpine
+`)
+
+	filePaths := []string{filePath}
+	serviceName := "updater"
+
+	err := w.Run(t.Context(), filePaths, serviceName, libstack.RunOptions{
+		Remove: true,
+		Options: libstack.Options{
+			ProjectName: "project_name",
+		},
+	})
+	require.NoError(t, err)
+}
+
+func createFile(t *testing.T, dir, fileName, content string) string {
+	filePath := filesystem.JoinPaths(dir, fileName)
+
+	err := os.WriteFile(filePath, []byte(content), 0o644)
+	require.NoError(t, err)
+
+	return filePath
+}
+
+func containerExists(containerName string) bool {
+	cmd := exec.Command("docker", "ps", "-a", "-f", "name="+containerName)
+
+	out, err := cmd.Output()
+	if err != nil {
+		log.Fatalf("failed to list containers: %s", err)
+	}
+
+	return strings.Contains(string(out), containerName)
+}
+
+func Test_Validate(t *testing.T) {
+	invalidComposeFileContent := `invalid-file-content`
+
+	w := NewComposeDeployer()
+
+	dir := t.TempDir()
+
+	filePathOriginal := createFile(t, dir, "docker-compose.yml", invalidComposeFileContent)
+
+	filePaths := []string{filePathOriginal}
+
+	projectName := "plugintest"
+
+	err := w.Validate(t.Context(), filePaths, libstack.Options{ProjectName: projectName})
+	require.Error(t, err)
+}
+
+func Test_Config(t *testing.T) {
+	dir := t.TempDir()
+	projectName := "configtest"
+
+	defer func() {
+		err := os.RemoveAll(dir)
+		require.NoError(t, err)
+	}()
+
+	testCases := []struct {
+		name               string
+		composeFileContent string
+		expectFileContent  string
+		envFileContent     string
+		env                []string
+	}{
+		{
+			name: "compose file with relative path",
+			composeFileContent: `services:
+  app:
+    image: 'nginx:latest'
+    ports:
+      - '80:80'
+    volumes:
+      - ./nginx-data:/data`,
+			expectFileContent: `name: configtest
+services:
+  app:
+    image: nginx:latest
+    networks:
+      default: null
+    ports:
+      - mode: ingress
+        target: 80
+        published: "80"
+        protocol: tcp
+    volumes:
+      - type: bind
+        source: ./nginx-data
+        target: /data
+        bind:
+          create_host_path: true
+networks:
+  default:
+    name: configtest_default
+`,
+		},
+		{
+			name: "compose file with absolute path",
+			composeFileContent: `services:
+  app:
+    image: 'nginx:latest'
+    ports:
+      - '80:80'
+    volumes:
+      - /nginx-data:/data`,
+			expectFileContent: `name: configtest
+services:
+  app:
+    image: nginx:latest
+    networks:
+      default: null
+    ports:
+      - mode: ingress
+        target: 80
+        published: "80"
+        protocol: tcp
+    volumes:
+      - type: bind
+        source: /nginx-data
+        target: /data
+        bind:
+          create_host_path: true
+networks:
+  default:
+    name: configtest_default
+`,
+		},
+		{
+			name: "compose file with declared volume",
+			composeFileContent: `services:
+  app:
+    image: 'nginx:latest'
+    ports:
+      - '80:80'
+    volumes:
+      - nginx-data:/data
+volumes:
+  nginx-data:
+    driver: local`,
+			expectFileContent: `name: configtest
+services:
+  app:
+    image: nginx:latest
+    networks:
+      default: null
+    ports:
+      - mode: ingress
+        target: 80
+        published: "80"
+        protocol: tcp
+    volumes:
+      - type: volume
+        source: nginx-data
+        target: /data
+        volume: {}
+networks:
+  default:
+    name: configtest_default
+volumes:
+  nginx-data:
+    name: configtest_nginx-data
+    driver: local
+`,
+		},
+		{
+			name: "compose file with relative path environment variable placeholder",
+			composeFileContent: `services:
+  nginx:
+    image: nginx:latest
+    ports:
+      - 8019:80
+    volumes:
+      - ${WEB_HOME}:/usr/share/nginx/html/
+      - ./config/${CONFIG_DIR}:/tmp/config
+    env_file:
+      - stack.env
+`,
+			expectFileContent: `name: configtest
+services:
+  nginx:
+    environment:
+      WEB_HOME: ./html
+    image: nginx:latest
+    networks:
+      default: null
+    ports:
+      - mode: ingress
+        target: 80
+        published: "8019"
+        protocol: tcp
+    volumes:
+      - type: bind
+        source: ./html
+        target: /usr/share/nginx/html
+        bind:
+          create_host_path: true
+      - type: bind
+        source: ./config/something
+        target: /tmp/config
+        bind:
+          create_host_path: true
+networks:
+  default:
+    name: configtest_default
+`,
+			envFileContent: `WEB_HOME=./html`,
+			env:            []string{"CONFIG_DIR=something"},
+		},
+		{
+			name: "compose file with absolute path environment variable placeholder",
+			composeFileContent: `services:
+  nginx:
+    image: nginx:latest
+    ports:
+      - 8019:80
+    volumes:
+      - ${WEB_HOME}:/usr/share/nginx/html/
+    env_file:
+      - stack.env
+`,
+			expectFileContent: `name: configtest
+services:
+  nginx:
+    environment:
+      WEB_HOME: /usr/share/nginx/html
+    image: nginx:latest
+    networks:
+      default: null
+    ports:
+      - mode: ingress
+        target: 80
+        published: "8019"
+        protocol: tcp
+    volumes:
+      - type: bind
+        source: /usr/share/nginx/html
+        target: /usr/share/nginx/html
+        bind:
+          create_host_path: true
+networks:
+  default:
+    name: configtest_default
+`,
+			envFileContent: `WEB_HOME=/usr/share/nginx/html`,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			composeFilePath := createFile(t, dir, "docker-compose.yml", tc.composeFileContent)
+
+			envFilePath := ""
+			if tc.envFileContent != "" {
+				envFilePath = createFile(t, dir, "stack.env", tc.envFileContent)
+			}
+
+			w := NewComposeDeployer()
+			actual, err := w.Config(t.Context(), []string{composeFilePath}, libstack.Options{
+				WorkingDir:    dir,
+				ProjectName:   projectName,
+				EnvFilePath:   envFilePath,
+				Env:           tc.env,
+				ConfigOptions: []string{"--no-path-resolution"},
+			})
+			require.NoError(t, err)
+
+			require.Equal(t, tc.expectFileContent, string(actual))
+		})
+	}
+}
+
+func Test_DeployWithRemoveOrphans(t *testing.T) {
+	const projectName = "compose_remove_orphans_test"
+
+	const composeFileContent = `services:
+  service-1:
+    image: alpine:latest
+  service-2:
+    image: alpine:latest`
+
+	const modifiedFileContent = `services:
+  service-2:
+    image: alpine:latest`
+
+	service1ContainerName := projectName + "-service-1"
+	service2ContainerName := projectName + "-service-2"
+
+	w := NewComposeDeployer()
+
+	dir := t.TempDir()
+
+	composeFilepath := createFile(t, dir, "docker-compose.yml", composeFileContent)
+	modifiedComposeFilepath := createFile(t, dir, "docker-compose-modified.yml", modifiedFileContent)
+
+	filepaths := []string{composeFilepath}
+	modifiedFilepaths := []string{modifiedComposeFilepath}
+
+	testCases := []struct {
+		name    string
+		options libstack.DeployOptions
+	}{
+		{
+			name: "Remove Orphans in env",
+			options: libstack.DeployOptions{
+				Options: libstack.Options{
+					ProjectName: projectName,
+					Env:         []string{cmdcompose.ComposeRemoveOrphans + "=true"},
+				},
+			},
+		},
+		{
+			name: "Remove Orphans in options",
+			options: libstack.DeployOptions{
+				Options: libstack.Options{
+					ProjectName: projectName,
+				},
+				RemoveOrphans: true,
+			},
+		},
+		{
+			name: "Remove Orphans in options and env",
+			options: libstack.DeployOptions{
+				Options: libstack.Options{
+					ProjectName: projectName,
+					Env:         []string{cmdcompose.ComposeRemoveOrphans + "=true"},
+				},
+				RemoveOrphans: false,
+			},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			options := tc.options.Options
+
+			err := w.Validate(t.Context(), filepaths, options)
+			require.NoError(t, err)
+
+			err = w.Pull(t.Context(), filepaths, options)
+			require.NoError(t, err)
+
+			require.False(t, containerExists(service1ContainerName))
+			require.False(t, containerExists(service2ContainerName))
+
+			err = w.Deploy(t.Context(), filepaths, tc.options)
+			require.NoError(t, err)
+
+			defer func() {
+				err = w.Remove(t.Context(), projectName, filepaths, libstack.RemoveOptions{})
+				require.NoError(t, err)
+
+				require.False(t, containerExists(service1ContainerName))
+				require.False(t, containerExists(service2ContainerName))
+			}()
+
+			require.True(t, containerExists(service1ContainerName))
+			require.True(t, containerExists(service2ContainerName))
+
+			waitResult := w.WaitForStatus(t.Context(), projectName, libstack.StatusCompleted)
+
+			require.Empty(t, waitResult.ErrorMsg)
+			require.Equal(t, libstack.StatusCompleted, waitResult.Status)
+
+			err = w.Validate(t.Context(), modifiedFilepaths, options)
+			require.NoError(t, err)
+
+			err = w.Pull(t.Context(), modifiedFilepaths, options)
+			require.NoError(t, err)
+
+			require.True(t, containerExists(service1ContainerName))
+			require.True(t, containerExists(service2ContainerName))
+
+			err = w.Deploy(t.Context(), modifiedFilepaths, tc.options)
+			require.NoError(t, err)
+
+			require.False(t, containerExists(service1ContainerName))
+			require.True(t, containerExists(service2ContainerName))
+
+			waitResult = w.WaitForStatus(t.Context(), projectName, libstack.StatusCompleted)
+
+			require.Empty(t, waitResult.ErrorMsg)
+			require.Equal(t, libstack.StatusCompleted, waitResult.Status)
+		})
+	}
+}
+
+type logger struct {
+	sync.Mutex
+	strings.Builder
+}
+
+func (l *logger) Write(p []byte) (n int, err error) {
+	l.Lock()
+	defer l.Unlock()
+
+	return l.Builder.Write(p)
+}
+
+func Test_DeployWithIgnoreOrphans(t *testing.T) {
+	var logOutput logger
+	oldLogger := zerolog.Logger
+	zerolog.Logger = zerolog.Output(&logOutput)
+	defer func() {
+		zerolog.Logger = oldLogger
+	}()
+
+	const projectName = "compose_ignore_orphans_test"
+
+	const composeFileContent = `services:
+  service-1:
+    image: alpine:latest
+  service-2:
+    image: alpine:latest`
+
+	const modifiedFileContent = `services:
+  service-2:
+    image: alpine:latest`
+
+	service1ContainerName := projectName + "-service-1"
+	service2ContainerName := projectName + "-service-2"
+
+	w := NewComposeDeployer()
+
+	dir := t.TempDir()
+
+	composeFilepath := createFile(t, dir, "docker-compose.yml", composeFileContent)
+	modifiedComposeFilepath := createFile(t, dir, "docker-compose-modified.yml", modifiedFileContent)
+
+	filepaths := []string{composeFilepath}
+	modifiedFilepaths := []string{modifiedComposeFilepath}
+	options := libstack.Options{
+		ProjectName: projectName,
+		Env:         []string{cmdcompose.ComposeIgnoreOrphans + "=true"},
+	}
+
+	err := w.Validate(t.Context(), filepaths, options)
+	require.NoError(t, err)
+
+	err = w.Pull(t.Context(), filepaths, options)
+	require.NoError(t, err)
+
+	require.False(t, containerExists(service1ContainerName))
+	require.False(t, containerExists(service2ContainerName))
+
+	err = w.Deploy(t.Context(), filepaths, libstack.DeployOptions{Options: options})
+	require.NoError(t, err)
+
+	defer func() {
+		err = w.Remove(t.Context(), projectName, filepaths, libstack.RemoveOptions{})
+		require.NoError(t, err)
+
+		require.False(t, containerExists(service1ContainerName))
+		require.False(t, containerExists(service2ContainerName))
+	}()
+
+	require.True(t, containerExists(service1ContainerName))
+	require.True(t, containerExists(service2ContainerName))
+
+	waitResult := w.WaitForStatus(t.Context(), projectName, libstack.StatusCompleted)
+
+	require.Empty(t, waitResult.ErrorMsg)
+	require.Equal(t, libstack.StatusCompleted, waitResult.Status)
+
+	err = w.Validate(t.Context(), modifiedFilepaths, options)
+	require.NoError(t, err)
+
+	err = w.Pull(t.Context(), modifiedFilepaths, options)
+	require.NoError(t, err)
+
+	require.True(t, containerExists(service1ContainerName))
+	require.True(t, containerExists(service2ContainerName))
+
+	err = w.Deploy(t.Context(), modifiedFilepaths, libstack.DeployOptions{Options: options})
+	require.NoError(t, err)
+
+	require.True(t, containerExists(service1ContainerName))
+	require.True(t, containerExists(service2ContainerName))
+
+	waitResult = w.WaitForStatus(t.Context(), projectName, libstack.StatusCompleted)
+
+	require.Empty(t, waitResult.ErrorMsg)
+	require.Equal(t, libstack.StatusCompleted, waitResult.Status)
+
+	logString := logOutput.String()
+	require.NotContains(t, logString, "Found orphan containers ([compose_ignore_orphans_test-service-1-1])")
+}
+
+func Test_MaxConcurrency(t *testing.T) {
+	const projectName = "compose_max_concurrency_test"
+
+	const composeFileContent = `services:
+  service-1:
+    image: alpine:latest`
+
+	w := ComposeDeployer{
+		createComposeServiceFn: createMockComposeService,
+	}
+
+	dir := t.TempDir()
+
+	composeFilepath := createFile(t, dir, "docker-compose.yml", composeFileContent)
+
+	expectedMaxConcurrency := 4
+
+	filepaths := []string{composeFilepath}
+	options := libstack.Options{
+		ProjectName: projectName,
+		Env:         []string{cmdcompose.ComposeParallelLimit + "=" + strconv.Itoa(expectedMaxConcurrency)},
+	}
+
+	err := w.Validate(t.Context(), filepaths, options)
+	require.NoError(t, err)
+
+	err = w.withComposeService(t.Context(), filepaths, options, func(service api.Compose, _ *types.Project) error {
+		if mockS, ok := service.(*mockComposeService); ok {
+			require.Equal(t, expectedMaxConcurrency, mockS.maxConcurrency)
+		} else {
+			t.Fatalf("Expected mockComposeService but got %T", service)
+		}
+		return nil
+	})
+	require.NoError(t, err)
+}
+
+func Test_createProject(t *testing.T) {
+	dir := t.TempDir()
+	projectName := "create-project-test"
+
+	defer func() {
+		err := os.RemoveAll(dir)
+		if err != nil {
+			t.Fatalf("Failed to remove temp dir: %v", err)
+		}
+	}()
+
+	createTestLibstackOptions := func(workingDir, projectName string, env []string, envFilepath string) libstack.Options {
+		return libstack.Options{
+			WorkingDir:  workingDir,
+			ProjectName: projectName,
+			Env:         env,
+			EnvFilePath: envFilepath,
+		}
+	}
+	testSimpleComposeConfig := `services:
+  nginx:
+    container_name: nginx
+    image: nginx:latest`
+
+	expectedSimpleComposeProject := func(workingDirectory string, envOverrides map[string]string) *types.Project {
+		env := types.Mapping{consts.ComposeProjectName: "create-project-test"}
+		env = env.Merge(envOverrides)
+
+		if workingDirectory == "" {
+			workingDirectory = dir
+		}
+
+		if !filepath.IsAbs(workingDirectory) {
+			absWorkingDir, err := filepath.Abs(workingDirectory)
+			if err != nil {
+				t.Fatalf("Failed to get absolute path of working directory (%s): %v", workingDirectory, err)
+			}
+			workingDirectory = absWorkingDir
+		}
+
+		return &types.Project{
+			Name:       projectName,
+			WorkingDir: workingDirectory,
+			Services: types.Services{
+				"nginx": {
+					Name:          "nginx",
+					ContainerName: "nginx",
+					Environment:   types.MappingWithEquals{},
+					Image:         "nginx:latest",
+					Networks:      map[string]*types.ServiceNetworkConfig{"default": nil},
+				},
+			},
+			Networks: types.Networks{"default": {Name: "create-project-test_default"}},
+			ComposeFiles: []string{
+				dir + "/docker-compose.yml",
+			},
+			Environment:      env,
+			DisabledServices: types.Services{},
+			Profiles:         []string{""},
+		}
+	}
+
+	testComposeProfilesConfig := `services:
+  nginx:
+    container_name: nginx
+    image: nginx:latest
+    profiles: ['web1']
+  apache:
+    container_name: apache
+    image: httpd:latest
+    profiles: ['web2']`
+
+	expectedComposeProfilesProject := func(envOverrides map[string]string) *types.Project {
+		env := types.Mapping{consts.ComposeProfiles: "web1", consts.ComposeProjectName: "create-project-test"}
+		env = env.Merge(envOverrides)
+
+		return &types.Project{
+			Name:       projectName,
+			WorkingDir: dir,
+			Services: types.Services{
+				"nginx": {
+					Name:          "nginx",
+					Profiles:      []string{"web1"},
+					ContainerName: "nginx",
+					Environment:   types.MappingWithEquals{},
+					Image:         "nginx:latest",
+					Networks:      map[string]*types.ServiceNetworkConfig{"default": nil},
+				},
+			},
+			Networks: types.Networks{"default": {Name: "create-project-test_default"}},
+			ComposeFiles: []string{
+				dir + "/docker-compose.yml",
+			},
+			Environment: env,
+			DisabledServices: types.Services{
+				"apache": {
+					Name:          "apache",
+					Profiles:      []string{"web2"},
+					ContainerName: "apache",
+					Environment:   nil,
+					Image:         "httpd:latest",
+					Networks:      map[string]*types.ServiceNetworkConfig{"default": nil},
+				},
+			},
+			Profiles: []string{"web1"},
+		}
+	}
+
+	testcases := []struct {
+		name            string
+		filesToCreate   map[string]string
+		configFilepaths []string
+		options         libstack.Options
+		osEnv           map[string]string
+		expectedProject *types.Project
+	}{
+		{
+			name: "Compose profiles in env",
+			filesToCreate: map[string]string{
+				"docker-compose.yml": testComposeProfilesConfig,
+			},
+			configFilepaths: []string{dir + "/docker-compose.yml"},
+			options:         createTestLibstackOptions(dir, projectName, []string{consts.ComposeProfiles + "=web1"}, ""),
+			expectedProject: expectedComposeProfilesProject(nil),
+		},
+		{
+			name: "Compose profiles in env file",
+			filesToCreate: map[string]string{
+				"docker-compose.yml": testComposeProfilesConfig,
+				"stack.env":          consts.ComposeProfiles + "=web1",
+			},
+			configFilepaths: []string{dir + "/docker-compose.yml"},
+			options:         createTestLibstackOptions(dir, projectName, nil, dir+"/stack.env"),
+			expectedProject: expectedComposeProfilesProject(nil),
+		},
+		{
+			name: "Compose profiles in env file in COMPOSE_ENV_FILES",
+			filesToCreate: map[string]string{
+				"docker-compose.yml": testComposeProfilesConfig,
+				"stack.env":          consts.ComposeProfiles + "=web1",
+			},
+			configFilepaths: []string{dir + "/docker-compose.yml"},
+			options:         createTestLibstackOptions(dir, projectName, []string{cmdcompose.ComposeEnvFiles + "=" + dir + "/stack.env"}, ""),
+			expectedProject: expectedComposeProfilesProject(map[string]string{
+				cmdcompose.ComposeEnvFiles: dir + "/stack.env",
+			}),
+		},
+		{
+			name: "Compose profiles in both env and env file",
+			filesToCreate: map[string]string{
+				"docker-compose.yml": testComposeProfilesConfig,
+				"stack.env":          consts.ComposeProfiles + "=web2",
+			},
+			configFilepaths: []string{dir + "/docker-compose.yml"},
+			options:         createTestLibstackOptions(dir, projectName, []string{consts.ComposeProfiles + "=web1"}, dir+"/stack.env"),
+			expectedProject: expectedComposeProfilesProject(nil),
+		},
+		{
+			name: "Compose project name in both options and env",
+			filesToCreate: map[string]string{
+				"docker-compose.yml": testSimpleComposeConfig,
+			},
+			configFilepaths: []string{dir + "/docker-compose.yml"},
+			options:         createTestLibstackOptions(dir, projectName, []string{consts.ComposeProjectName + "=totally_different_name"}, ""),
+			expectedProject: expectedSimpleComposeProject("", nil),
+		},
+		{
+			name: "Compose project name in only env",
+			filesToCreate: map[string]string{
+				"docker-compose.yml": testSimpleComposeConfig,
+			},
+			configFilepaths: []string{dir + "/docker-compose.yml"},
+			options:         createTestLibstackOptions(dir, "", []string{consts.ComposeProjectName + "=totally_different_name"}, ""),
+			expectedProject: &types.Project{
+				Name:       "totally_different_name",
+				WorkingDir: dir,
+				Services: types.Services{
+					"nginx": {
+						Name:          "nginx",
+						ContainerName: "nginx",
+						Environment:   types.MappingWithEquals{},
+						Image:         "nginx:latest",
+						Networks:      map[string]*types.ServiceNetworkConfig{"default": nil},
+					},
+				},
+				Networks: types.Networks{"default": {Name: "totally_different_name_default"}},
+				ComposeFiles: []string{
+					dir + "/docker-compose.yml",
+				},
+				Environment:      types.Mapping{consts.ComposeProjectName: "totally_different_name"},
+				DisabledServices: types.Services{},
+				Profiles:         []string{""},
+			},
+		},
+		{
+			name: "Compose files in env",
+			filesToCreate: map[string]string{
+				"docker-compose.yml": testSimpleComposeConfig,
+			},
+			configFilepaths: nil,
+			options:         createTestLibstackOptions(dir, projectName, []string{consts.ComposeFilePath + "=" + dir + "/docker-compose.yml"}, ""),
+			expectedProject: expectedSimpleComposeProject("", map[string]string{
+				consts.ComposeFilePath: dir + "/docker-compose.yml",
+			}),
+		},
+		{
+			name: "Compose files in both options and env",
+			filesToCreate: map[string]string{
+				"docker-compose.yml":          testSimpleComposeConfig,
+				"profiles-docker-compose.yml": testComposeProfilesConfig,
+			},
+			configFilepaths: []string{dir + "/docker-compose.yml"},
+			options:         createTestLibstackOptions(dir, projectName, []string{consts.ComposeFilePath + "=" + dir + "/profiles-docker-compose.yml"}, ""),
+			expectedProject: expectedSimpleComposeProject("", map[string]string{
+				consts.ComposeFilePath: dir + "/profiles-docker-compose.yml",
+			}),
+		},
+		{
+			name: "Multiple Compose files in options",
+			filesToCreate: map[string]string{
+				"docker-compose-0.yml": `services:
+  nginx:
+    container_name: nginx
+    image: nginx:latest`,
+				"docker-compose-1.yml": `services:
+  apache:
+    container_name: apache
+    image: httpd:latest`,
+			},
+			configFilepaths: []string{dir + "/docker-compose-0.yml", dir + "/docker-compose-1.yml"},
+			options:         createTestLibstackOptions(dir, projectName, []string{}, ""),
+			expectedProject: &types.Project{
+				Name:       projectName,
+				WorkingDir: dir,
+				Services: types.Services{
+					"nginx": {
+						Name:          "nginx",
+						ContainerName: "nginx",
+						Environment:   types.MappingWithEquals{},
+						Image:         "nginx:latest",
+						Networks:      map[string]*types.ServiceNetworkConfig{"default": nil},
+					},
+					"apache": {
+						Name:          "apache",
+						ContainerName: "apache",
+						Environment:   types.MappingWithEquals{},
+						Image:         "httpd:latest",
+						Networks:      map[string]*types.ServiceNetworkConfig{"default": nil},
+					},
+				},
+				Networks: types.Networks{"default": {Name: "create-project-test_default"}},
+				ComposeFiles: []string{
+					dir + "/docker-compose-0.yml",
+					dir + "/docker-compose-1.yml",
+				},
+				Environment:      types.Mapping{consts.ComposeProjectName: "create-project-test"},
+				DisabledServices: types.Services{},
+				Profiles:         []string{""},
+			},
+		},
+		{
+			name: "Multiple Compose files in env",
+			filesToCreate: map[string]string{
+				"docker-compose-0.yml": `services:
+  nginx:
+    container_name: nginx
+    image: nginx:latest`,
+				"docker-compose-1.yml": `services:
+  apache:
+    container_name: apache
+    image: httpd:latest`,
+			},
+			configFilepaths: nil,
+			options:         createTestLibstackOptions(dir, projectName, []string{consts.ComposeFilePath + "=" + dir + "/docker-compose-0.yml:" + dir + "/docker-compose-1.yml"}, ""),
+			expectedProject: &types.Project{
+				Name:       projectName,
+				WorkingDir: dir,
+				Services: types.Services{
+					"nginx": {
+						Name:          "nginx",
+						ContainerName: "nginx",
+						Environment:   types.MappingWithEquals{},
+						Image:         "nginx:latest",
+						Networks:      map[string]*types.ServiceNetworkConfig{"default": nil},
+					},
+					"apache": {
+						Name:          "apache",
+						ContainerName: "apache",
+						Environment:   types.MappingWithEquals{},
+						Image:         "httpd:latest",
+						Networks:      map[string]*types.ServiceNetworkConfig{"default": nil},
+					},
+				},
+				Networks: types.Networks{"default": {Name: "create-project-test_default"}},
+				ComposeFiles: []string{
+					dir + "/docker-compose-0.yml",
+					dir + "/docker-compose-1.yml",
+				},
+				Environment:      types.Mapping{consts.ComposeProjectName: "create-project-test", consts.ComposeFilePath: dir + "/docker-compose-0.yml:" + dir + "/docker-compose-1.yml"},
+				DisabledServices: types.Services{},
+				Profiles:         []string{""},
+			},
+		},
+		{
+			name: "Multiple Compose files in env with COMPOSE_PATH_SEPARATOR",
+			filesToCreate: map[string]string{
+				"docker-compose-0.yml": `services:
+  nginx:
+    container_name: nginx
+    image: nginx:latest`,
+				"docker-compose-1.yml": `services:
+  apache:
+    container_name: apache
+    image: httpd:latest`,
+			},
+			configFilepaths: nil,
+			options:         createTestLibstackOptions(dir, projectName, []string{consts.ComposePathSeparator + "=|", consts.ComposeFilePath + "=" + dir + "/docker-compose-0.yml|" + dir + "/docker-compose-1.yml"}, ""),
+			expectedProject: &types.Project{
+				Name:       projectName,
+				WorkingDir: dir,
+				Services: types.Services{
+					"nginx": {
+						Name:          "nginx",
+						ContainerName: "nginx",
+						Environment:   types.MappingWithEquals{},
+						Image:         "nginx:latest",
+						Networks:      map[string]*types.ServiceNetworkConfig{"default": nil},
+					},
+					"apache": {
+						Name:          "apache",
+						ContainerName: "apache",
+						Environment:   types.MappingWithEquals{},
+						Image:         "httpd:latest",
+						Networks:      map[string]*types.ServiceNetworkConfig{"default": nil},
+					},
+				},
+				Networks: types.Networks{"default": {Name: "create-project-test_default"}},
+				ComposeFiles: []string{
+					dir + "/docker-compose-0.yml",
+					dir + "/docker-compose-1.yml",
+				},
+				Environment:      types.Mapping{consts.ComposeProjectName: "create-project-test", consts.ComposePathSeparator: "|", consts.ComposeFilePath: dir + "/docker-compose-0.yml|" + dir + "/docker-compose-1.yml"},
+				DisabledServices: types.Services{},
+				Profiles:         []string{""},
+			},
+		},
+		{
+			name: "compose ignore orphans",
+			filesToCreate: map[string]string{
+				"docker-compose.yml": testSimpleComposeConfig,
+			},
+			configFilepaths: []string{dir + "/docker-compose.yml"},
+			options:         createTestLibstackOptions(dir, projectName, []string{cmdcompose.ComposeIgnoreOrphans + "=true"}, ""),
+			expectedProject: expectedSimpleComposeProject("", map[string]string{
+				cmdcompose.ComposeIgnoreOrphans: "true",
+			}),
+		},
+		{
+			name: "compose remove orphans",
+			filesToCreate: map[string]string{
+				"docker-compose.yml": testSimpleComposeConfig,
+			},
+			configFilepaths: []string{dir + "/docker-compose.yml"},
+			options:         createTestLibstackOptions(dir, projectName, []string{cmdcompose.ComposeRemoveOrphans + "=true"}, ""),
+			expectedProject: expectedSimpleComposeProject("", map[string]string{
+				cmdcompose.ComposeRemoveOrphans: "true",
+			}),
+		},
+		{
+			name: "compose parallel limit",
+			filesToCreate: map[string]string{
+				"docker-compose.yml": testSimpleComposeConfig,
+			},
+			configFilepaths: []string{dir + "/docker-compose.yml"},
+			options:         createTestLibstackOptions(dir, projectName, []string{cmdcompose.ComposeParallelLimit + "=true"}, ""),
+			expectedProject: expectedSimpleComposeProject("", map[string]string{
+				cmdcompose.ComposeParallelLimit: "true",
+			}),
+		},
+		{
+			name: "Absolute Working Directory",
+			filesToCreate: map[string]string{
+				"docker-compose.yml": testSimpleComposeConfig,
+			},
+			configFilepaths: []string{dir + "/docker-compose.yml"},
+			options: libstack.Options{
+				// Note that this is the execution working directory not the compose project working directory
+				// and so it has no affect on the created projects working directory
+				WorkingDir:  "/something-totally-different",
+				ProjectName: projectName,
+			},
+			expectedProject: expectedSimpleComposeProject("", nil),
+		},
+		{
+			name: "Relative Working Directory",
+			filesToCreate: map[string]string{
+				"docker-compose.yml": testSimpleComposeConfig,
+			},
+			configFilepaths: []string{dir + "/docker-compose.yml"},
+			options: libstack.Options{
+				// Note that this is the execution working directory not the compose project working directory
+				// and so it has no affect on the created projects working directory
+				WorkingDir:  "something-totally-different",
+				ProjectName: projectName,
+			},
+			expectedProject: expectedSimpleComposeProject("", nil),
+		},
+		{
+			name: "Absolute Project Directory",
+			filesToCreate: map[string]string{
+				"docker-compose.yml": testSimpleComposeConfig,
+			},
+			configFilepaths: []string{dir + "/docker-compose.yml"},
+			options: libstack.Options{
+				ProjectDir:  "/something-totally-different",
+				ProjectName: projectName,
+			},
+			expectedProject: expectedSimpleComposeProject("/something-totally-different", nil),
+		},
+		{
+			name: "Relative Project Directory",
+			filesToCreate: map[string]string{
+				"docker-compose.yml": testSimpleComposeConfig,
+			},
+			configFilepaths: []string{dir + "/docker-compose.yml"},
+			options: libstack.Options{
+				ProjectDir:  "something-totally-different",
+				ProjectName: projectName,
+			},
+			expectedProject: expectedSimpleComposeProject("something-totally-different", nil),
+		},
+		{
+			name: "Absolute Project and Working Directory set",
+			filesToCreate: map[string]string{
+				"docker-compose.yml": testSimpleComposeConfig,
+			},
+			configFilepaths: []string{dir + "/docker-compose.yml"},
+			options: libstack.Options{
+				WorkingDir:  "/working-dir",
+				ProjectDir:  "/project-dir",
+				ProjectName: projectName,
+			},
+			expectedProject: expectedSimpleComposeProject("/project-dir", nil),
+		},
+		{
+			name: "OS Env Vars",
+			filesToCreate: map[string]string{
+				"docker-compose.yml": testSimpleComposeConfig,
+			},
+			configFilepaths: []string{dir + "/docker-compose.yml"},
+			options: libstack.Options{
+				ProjectName: projectName,
+			},
+			osEnv: map[string]string{
+				"PORTAINER_WEB_FOLDER": "html-1",
+				"other_var":            "something",
+			},
+			expectedProject: expectedSimpleComposeProject("", map[string]string{"PORTAINER_WEB_FOLDER": "html-1"}),
+		},
+		{
+			name: "OS COMPOSE_ vars are passed to project",
+			filesToCreate: map[string]string{
+				"docker-compose.yml": testSimpleComposeConfig,
+			},
+			configFilepaths: []string{dir + "/docker-compose.yml"},
+			options: libstack.Options{
+				ProjectName: projectName,
+			},
+			osEnv: map[string]string{
+				"COMPOSE_PARALLEL_LIMIT": "4",
+				"other_var":              "something",
+			},
+			expectedProject: expectedSimpleComposeProject("", map[string]string{
+				"COMPOSE_PARALLEL_LIMIT": "4",
+			}),
+		},
+		{
+			name: "Env Vars in compose file, compose env file, env, os, and env_file",
+			filesToCreate: map[string]string{
+				"docker-compose.yml": `services:
+  nginx:
+    container_name: nginx
+    image: nginx:latest
+    env_file: ` + dir + `/compose-stack.env
+    environment:
+        PORTAINER_VAR: compose_file_environment`,
+				"stack.env":         "PORTAINER_VAR=env_file",
+				"compose-stack.env": "PORTAINER_VAR=compose_env_file",
+			},
+			configFilepaths: []string{dir + "/docker-compose.yml"},
+			options: libstack.Options{
+				ProjectName: projectName,
+				Env:         []string{"PORTAINER_VAR=env"},
+				EnvFilePath: dir + "/stack.env",
+			},
+			osEnv: map[string]string{
+				"PORTAINER_VAR": "os",
+			},
+			expectedProject: &types.Project{
+				Name:       projectName,
+				WorkingDir: dir,
+				Services: types.Services{
+					"nginx": {
+						Name:          "nginx",
+						ContainerName: "nginx",
+						Environment:   types.NewMappingWithEquals([]string{"PORTAINER_VAR=compose_file_environment"}),
+						Image:         "nginx:latest",
+						Networks:      map[string]*types.ServiceNetworkConfig{"default": nil},
+					},
+				},
+				Networks: types.Networks{"default": {Name: "create-project-test_default"}},
+				ComposeFiles: []string{
+					dir + "/docker-compose.yml",
+				},
+				Environment:      map[string]string{"COMPOSE_PROJECT_NAME": "create-project-test", "PORTAINER_VAR": "env"},
+				DisabledServices: types.Services{},
+				Profiles:         []string{""},
+			},
+		},
+		{
+			name: "Env Vars in compose env file, env, os, and env_file",
+			filesToCreate: map[string]string{
+				"docker-compose.yml": `services:
+  nginx:
+    container_name: nginx
+    image: nginx:latest
+    env_file: ` + dir + `/compose-stack.env`,
+				"stack.env":         "PORTAINER_VAR=env_file",
+				"compose-stack.env": "PORTAINER_VAR=compose_env_file",
+			},
+			configFilepaths: []string{dir + "/docker-compose.yml"},
+			options: libstack.Options{
+				ProjectName: projectName,
+				Env:         []string{"PORTAINER_VAR=env"},
+				EnvFilePath: dir + "/stack.env",
+			},
+			osEnv: map[string]string{
+				"PORTAINER_VAR": "os",
+			},
+			expectedProject: &types.Project{
+				Name:       projectName,
+				WorkingDir: dir,
+				Services: types.Services{
+					"nginx": {
+						Name:          "nginx",
+						ContainerName: "nginx",
+						Environment:   types.NewMappingWithEquals([]string{"PORTAINER_VAR=compose_env_file"}),
+						Image:         "nginx:latest",
+						Networks:      map[string]*types.ServiceNetworkConfig{"default": nil},
+					},
+				},
+				Networks: types.Networks{"default": {Name: "create-project-test_default"}},
+				ComposeFiles: []string{
+					dir + "/docker-compose.yml",
+				},
+				Environment:      map[string]string{"COMPOSE_PROJECT_NAME": "create-project-test", "PORTAINER_VAR": "env"},
+				DisabledServices: types.Services{},
+				Profiles:         []string{""},
+			},
+		},
+		{
+			name: "Env Vars in env, os, and env_file",
+			filesToCreate: map[string]string{
+				"docker-compose.yml": `services:
+  nginx:
+    container_name: nginx
+    image: nginx:latest`,
+				"stack.env": "PORTAINER_VAR=env_file",
+			},
+			configFilepaths: []string{dir + "/docker-compose.yml"},
+			options: libstack.Options{
+				ProjectName: projectName,
+				Env:         []string{"PORTAINER_VAR=env"},
+				EnvFilePath: dir + "/stack.env",
+			},
+			osEnv: map[string]string{
+				"PORTAINER_VAR": "os",
+			},
+			expectedProject: &types.Project{
+				Name:       projectName,
+				WorkingDir: dir,
+				Services: types.Services{
+					"nginx": {
+						Name:          "nginx",
+						ContainerName: "nginx",
+						Environment:   types.MappingWithEquals{},
+						Image:         "nginx:latest",
+						Networks:      map[string]*types.ServiceNetworkConfig{"default": nil},
+					},
+				},
+				Networks: types.Networks{"default": {Name: "create-project-test_default"}},
+				ComposeFiles: []string{
+					dir + "/docker-compose.yml",
+				},
+				Environment:      map[string]string{"COMPOSE_PROJECT_NAME": "create-project-test", "PORTAINER_VAR": "env"},
+				DisabledServices: types.Services{},
+				Profiles:         []string{""},
+			},
+		},
+		{
+			name: "Env Vars in os and env_file",
+			filesToCreate: map[string]string{
+				"docker-compose.yml": `services:
+  nginx:
+    container_name: nginx
+    image: nginx:latest`,
+				"stack.env": "PORTAINER_VAR=env_file",
+			},
+			configFilepaths: []string{dir + "/docker-compose.yml"},
+			options: libstack.Options{
+				ProjectName: projectName,
+				EnvFilePath: dir + "/stack.env",
+			},
+			osEnv: map[string]string{
+				"PORTAINER_VAR": "os",
+			},
+			expectedProject: &types.Project{
+				Name:       projectName,
+				WorkingDir: dir,
+				Services: types.Services{
+					"nginx": {
+						Name:          "nginx",
+						ContainerName: "nginx",
+						Environment:   types.MappingWithEquals{},
+						Image:         "nginx:latest",
+						Networks:      map[string]*types.ServiceNetworkConfig{"default": nil},
+					},
+				},
+				Networks: types.Networks{"default": {Name: "create-project-test_default"}},
+				ComposeFiles: []string{
+					dir + "/docker-compose.yml",
+				},
+				Environment:      map[string]string{"COMPOSE_PROJECT_NAME": "create-project-test", "PORTAINER_VAR": "os"},
+				DisabledServices: types.Services{},
+				Profiles:         []string{""},
+			},
+		},
+		{
+			name: "Env Vars in env_file",
+			filesToCreate: map[string]string{
+				"docker-compose.yml": `services:
+  nginx:
+    container_name: nginx
+    image: nginx:latest`,
+				"stack.env": "PORTAINER_VAR=env_file",
+			},
+			configFilepaths: []string{dir + "/docker-compose.yml"},
+			options: libstack.Options{
+				ProjectName: projectName,
+				EnvFilePath: dir + "/stack.env",
+			},
+			expectedProject: &types.Project{
+				Name:       projectName,
+				WorkingDir: dir,
+				Services: types.Services{
+					"nginx": {
+						Name:          "nginx",
+						ContainerName: "nginx",
+						Environment:   types.MappingWithEquals{},
+						Image:         "nginx:latest",
+						Networks:      map[string]*types.ServiceNetworkConfig{"default": nil},
+					},
+				},
+				Networks: types.Networks{"default": {Name: "create-project-test_default"}},
+				ComposeFiles: []string{
+					dir + "/docker-compose.yml",
+				},
+				Environment:      map[string]string{"COMPOSE_PROJECT_NAME": "create-project-test", "PORTAINER_VAR": "env_file"},
+				DisabledServices: types.Services{},
+				Profiles:         []string{""},
+			},
+		},
+	}
+
+	for _, tc := range testcases {
+		t.Run(tc.name, func(t *testing.T) {
+			createdFiles := make([]string, 0, len(tc.filesToCreate))
+			for f, fc := range tc.filesToCreate {
+				createdFiles = append(createdFiles, createFile(t, dir, f, fc))
+			}
+
+			defer func() {
+				var errs error
+				for _, f := range createdFiles {
+					errs = errors.Join(errs, os.Remove(f))
+				}
+
+				if errs != nil {
+					t.Fatalf("Failed to remove config files: %v", errs)
+				}
+			}()
+
+			for k, v := range tc.osEnv {
+				t.Setenv(k, v)
+			}
+
+			gotProject, err := createProject(t.Context(), tc.configFilepaths, tc.options)
+			if err != nil {
+				t.Fatalf("Failed to create new project: %v", err)
+			}
+
+			if diff := cmp.Diff(gotProject, tc.expectedProject); diff != "" {
+				t.Fatalf("Projects are different:\n%s", diff)
+			}
+		})
+	}
+}
+
+func Test_CredentialsStore_Behavior(t *testing.T) {
+	// Create a temporary Docker config with a credsStore set (simulating Docker Desktop)
+	tmpDir := t.TempDir()
+
+	// Write a fake config.json with credsStore configured
+	configJSON := `{
+	"credsStore": "test-store",
+	"auths": {}
+}`
+	configPath := filesystem.JoinPaths(tmpDir, "config.json")
+	err := os.WriteFile(configPath, []byte(configJSON), 0o644)
+	require.NoError(t, err)
+
+	t.Run("withCli preserves credsStore when no registries provided", func(t *testing.T) {
+		// Set the Docker config directory to the temp dir
+		config.SetDir(tmpDir)
+
+		var capturedCredsStore string
+		var capturedAuthConfigs map[string]configtypes.AuthConfig
+
+		err = libstack.WithCli(t.Context(), libstack.DockerCliOptions{}, func(ctx context.Context, cli *command.DockerCli) error {
+			// Capture the state after WithCli sets up credentials
+			capturedCredsStore = cli.ConfigFile().CredentialsStore
+			capturedAuthConfigs = cli.ConfigFile().AuthConfigs
+			return nil
+		})
+		require.NoError(t, err)
+
+		// Verify the fix: credsStore should be preserved when no registries are provided
+		require.Equal(t, "test-store", capturedCredsStore,
+			"credsStore should be preserved when no registries are provided")
+
+		// Verify registry credentials were not set
+		require.Empty(t, capturedAuthConfigs,
+			"no registry credentials should be configured in AuthConfigs")
+	})
+
+	t.Run("withCli clears credsStore when registries provided", func(t *testing.T) {
+		// Set the Docker config directory to the temp dir
+		config.SetDir(tmpDir)
+
+		// Test with registries provided
+		registries := []configtypes.AuthConfig{
+			{
+				Username:      "testuser",
+				Password:      "testpass",
+				ServerAddress: "registry.example.com",
+			},
+		}
+		var capturedCredsStore string
+		var capturedAuthConfigs map[string]configtypes.AuthConfig
+
+		err = libstack.WithCli(t.Context(),
+			libstack.DockerCliOptions{Registries: registries},
+			func(ctx context.Context, cli *command.DockerCli) error {
+				// Capture the state after WithCli sets up credentials
+				capturedCredsStore = cli.ConfigFile().CredentialsStore
+				capturedAuthConfigs = cli.ConfigFile().AuthConfigs
+				return nil
+			})
+		require.NoError(t, err)
+
+		// Verify the fix: credsStore should be empty when registries are provided
+		require.Empty(t, capturedCredsStore,
+			"credsStore should be cleared when registries are provided to force Docker to use inline credentials")
+
+		// Verify registry credentials were set
+		require.Contains(t, capturedAuthConfigs, "registry.example.com",
+			"custom registry credentials should be configured in AuthConfigs")
+		require.Equal(t, "testuser", capturedAuthConfigs["registry.example.com"].Username,
+			"custom registry username should match")
+	})
+}
+
+func createMockComposeService(command.Cli, ...compose.Option) api.Compose {
+	return &mockComposeService{}
+}
+
+type mockComposeService struct {
+	api.Compose
+	maxConcurrency int
+}
+
+func (s *mockComposeService) MaxConcurrency(parallel int) {
+	s.maxConcurrency = parallel
+}
diff --git a/pkg/libstack/compose/composeplugin_windows_test.go b/pkg/libstack/compose/composeplugin_windows_test.go
new file mode 100644
index 0000000..9ccf62b
--- /dev/null
+++ b/pkg/libstack/compose/composeplugin_windows_test.go
@@ -0,0 +1,107 @@
+package compose
+
+import (
+	"errors"
+	"os"
+	"testing"
+
+	"github.com/compose-spec/compose-go/v2/types"
+	"github.com/google/go-cmp/cmp"
+	"github.com/portainer/portainer/pkg/libstack"
+)
+
+func Test_createProject_win(t *testing.T) {
+	t.Parallel()
+	dir := t.TempDir()
+	projectName := "create-project-test"
+
+	defer func() {
+		err := os.RemoveAll(dir)
+		if err != nil {
+			t.Fatalf("Failed to remove temp dir: %v", err)
+		}
+	}()
+
+	testcases := []struct {
+		name            string
+		createFilesFn   func() []string
+		configFilepaths []string
+		options         libstack.Options
+		expectedProject *types.Project
+	}{
+		{
+			name: "Convert windows paths",
+			createFilesFn: func() []string {
+				var filepaths []string
+				filepaths = append(filepaths, createFile(t, dir, "docker-compose.yml", `services:
+  nginx:
+    container_name: nginx
+    image: nginx:latest
+    volumes:
+      - "C:\\Users\\Joey\\Desktop\\backend:/var/www/html"`))
+				return filepaths
+			},
+			configFilepaths: []string{dir + "/docker-compose.yml"},
+			options: libstack.Options{
+				WorkingDir:  dir,
+				ProjectName: projectName,
+				Env:         []string{"COMPOSE_CONVERT_WINDOWS_PATHS=true"},
+			},
+			expectedProject: &types.Project{
+				Name:       projectName,
+				WorkingDir: dir,
+				Services: types.Services{
+					"nginx": {
+						Name:          "nginx",
+						ContainerName: "nginx",
+						Environment:   types.MappingWithEquals{},
+						Image:         "nginx:latest",
+						Networks:      map[string]*types.ServiceNetworkConfig{"default": nil},
+						Volumes: []types.ServiceVolumeConfig{
+							{
+								Type:     "bind",
+								Source:   "/c/Users/Joey/Desktop/backend",
+								Target:   "/var/www/html",
+								ReadOnly: false,
+								Bind:     &types.ServiceVolumeBind{CreateHostPath: true},
+							},
+						},
+					},
+				},
+				Networks: types.Networks{"default": {Name: "create-project-test_default"}},
+				ComposeFiles: []string{
+					dir + "/docker-compose.yml",
+				},
+				Environment:      types.Mapping{"COMPOSE_PROJECT_NAME": "create-project-test", "COMPOSE_CONVERT_WINDOWS_PATHS": "true"},
+				DisabledServices: types.Services{},
+				Profiles:         []string{""},
+			},
+		},
+	}
+
+	for _, tc := range testcases {
+		t.Run(tc.name, func(t *testing.T) {
+			createdFiles := tc.createFilesFn()
+
+			defer func() {
+				var errs error
+				for _, f := range createdFiles {
+					errs = errors.Join(errs, os.Remove(f))
+				}
+
+				if errs != nil {
+					t.Fatalf("Failed to remove config files: %v", errs)
+				}
+			}()
+
+			gotProject, err := createProject(t.Context(), tc.configFilepaths, tc.options)
+			if err != nil {
+				t.Fatalf("Failed to create new project: %v", err)
+			}
+
+			if diff := cmp.Diff(gotProject, tc.expectedProject); diff != "" {
+				t.Fatalf("Projects are different:\n%s", diff)
+			}
+		})
+	}
+}
diff --git a/pkg/libstack/compose/docker-compose-test.yml b/pkg/libstack/compose/docker-compose-test.yml
new file mode 100644
index 0000000..b2ba019
--- /dev/null
+++ b/pkg/libstack/compose/docker-compose-test.yml
@@ -0,0 +1,4 @@
+version: '3.9'
+services:
+  redis:
+    image: 'redis:alpine'
diff --git a/pkg/libstack/compose/logwriter.go b/pkg/libstack/compose/logwriter.go
new file mode 100644
index 0000000..9cf2fe5
--- /dev/null
+++ b/pkg/libstack/compose/logwriter.go
@@ -0,0 +1,58 @@
+package compose
+
+import (
+	"strings"
+
+	"github.com/rs/zerolog"
+	"github.com/rs/zerolog/log"
+)
+
+// LogrusToZerologWriter is a custom logrus writer that writes logrus logs to zerolog.
+// logrus is the logging library used by Docker Compose.
+type LogrusToZerologWriter struct{}
+
+func (ltzw LogrusToZerologWriter) Write(p []byte) (n int, err error) {
+	logMessage := string(p)
+	logMessage = strings.TrimSuffix(logMessage, "\n")
+
+	// Parse the log level and message from the logrus log.
+	// This assumes logrus's default text format.
+	var level, message string
+	if strings.HasPrefix(logMessage, "time=") {
+		// Example logrus log: `time="2023-10-01T12:34:56Z" level=info msg="This is a log message" key=value`
+		parts := strings.SplitN(logMessage, " ", 4)
+		if len(parts) >= 3 {
+			level = strings.TrimPrefix(parts[1], "level=")
+			message = strings.TrimPrefix(parts[2], "msg=")
+			message = strings.Trim(message, `"`)
+		}
+	} else {
+		// Fallback for simpler log formats.
+		level = "info"
+		message = logMessage
+	}
+
+	// Map logrus levels to zerolog levels.
+	var zlogLevel zerolog.Level
+	switch level {
+	case "debug":
+		zlogLevel = zerolog.DebugLevel
+	case "info":
+		zlogLevel = zerolog.InfoLevel
+	case "warn", "warning":
+		zlogLevel = zerolog.WarnLevel
+	case "error":
+		zlogLevel = zerolog.ErrorLevel
+	case "fatal":
+		zlogLevel = zerolog.FatalLevel
+	case "panic":
+		zlogLevel = zerolog.PanicLevel
+	default:
+		zlogLevel = zerolog.InfoLevel
+	}
+
+	// Log the message using zerolog.
+	log.WithLevel(zlogLevel).Msg(message)
+
+	return len(p), nil
+}
diff --git a/pkg/libstack/compose/status.go b/pkg/libstack/compose/status.go
new file mode 100644
index 0000000..c154f23
--- /dev/null
+++ b/pkg/libstack/compose/status.go
@@ -0,0 +1,248 @@
+package compose
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"time"
+
+	"github.com/portainer/portainer/api/logs"
+	"github.com/portainer/portainer/pkg/libstack"
+
+	"github.com/compose-spec/compose-go/v2/types"
+	"github.com/docker/cli/cli/command"
+	"github.com/docker/compose/v2/pkg/api"
+	"github.com/docker/docker/api/types/container"
+	"github.com/pkg/errors"
+	"github.com/rs/zerolog/log"
+)
+
+type publisher struct {
+	URL           string
+	TargetPort    int
+	PublishedPort int
+	Protocol      string
+}
+
+type service struct {
+	ID         string
+	Name       string
+	Image      string
+	Command    string
+	Project    string
+	Service    string
+	Created    int64
+	State      string
+	Status     string
+	Health     string
+	ExitCode   int
+	Publishers []publisher
+}
+
+// docker container state can be one of "created", "running", "paused", "restarting", "removing", "exited", or "dead"
+func getServiceStatus(ctx context.Context, service service) (libstack.Status, string) {
+	log.Debug().
+		Str("service", service.Name).
+		Str("state", service.State).
+		Int("exitCode", service.ExitCode).
+		Msg("getServiceStatus")
+
+	switch service.State {
+	case "created", "restarting", "paused":
+		return libstack.StatusStarting, ""
+	case "running":
+		return libstack.StatusRunning, ""
+	case "removing":
+		return libstack.StatusRemoving, ""
+	case "exited":
+		if service.ExitCode == 0 {
+			return libstack.StatusCompleted, ""
+		}
+
+		errorMessage, err := getContainerLogsTail(ctx, service)
+		if err != nil {
+			log.Error().
+				Err(err).
+				Str("service", service.Name).
+				Msg("failed to get logs from container")
+			errorMessage = fmt.Sprintf("service %s exited with code %d", service.Name, service.ExitCode)
+		}
+
+		return libstack.StatusError, errorMessage
+	case "dead":
+		if service.ExitCode == 0 {
+			return libstack.StatusRemoved, ""
+		}
+
+		errorMessage, err := getContainerLogsTail(ctx, service)
+		if err != nil {
+			log.Error().
+				Err(err).
+				Str("service", service.Name).
+				Msg("failed to get logs from container")
+			errorMessage = fmt.Sprintf("service %s exited with code %d", service.Name, service.ExitCode)
+		}
+
+		return libstack.StatusError, errorMessage
+	default:
+		return libstack.StatusUnknown, ""
+	}
+}
+
+func getContainerLogsTail(ctx context.Context, service service) (string, error) {
+	var combinedOutput bytes.Buffer
+
+	if err := libstack.WithCli(ctx, libstack.DockerCliOptions{}, func(ctx context.Context, cli *command.DockerCli) error {
+		out, err := cli.Client().ContainerLogs(ctx, service.Name, container.LogsOptions{
+			ShowStdout: true,
+			ShowStderr: true,
+			Timestamps: true,
+			Follow:     false,
+			Tail:       "20",
+		})
+		if err != nil {
+			return errors.Wrap(err, "unable to get logs from container")
+		}
+		defer logs.CloseAndLogErr(out)
+
+		_, err = io.Copy(&combinedOutput, out)
+		if err != nil {
+			return errors.Wrap(err, "unable to read container logs")
+		}
+
+		return nil
+	}); err != nil {
+		return "", errors.Wrap(err, "unable to get logs from container")
+	}
+
+	return combinedOutput.String(), nil
+}
+
+func aggregateStatuses(ctx context.Context, services []service) (libstack.Status, string) {
+	servicesCount := len(services)
+
+	if servicesCount == 0 {
+		log.Debug().
+			Msg("no services found")
+
+		return libstack.StatusRemoved, ""
+	}
+
+	statusCounts := make(map[libstack.Status]int)
+	errorMessage := ""
+	for _, service := range services {
+		status, serviceError := getServiceStatus(ctx, service)
+		if serviceError != "" {
+			errorMessage = serviceError
+		}
+		statusCounts[status]++
+	}
+
+	log.Debug().
+		Interface("statusCounts", statusCounts).
+		Str("errorMessage", errorMessage).
+		Msg("check_status")
+
+	if errorMessage != "" {
+		return libstack.StatusError, errorMessage
+	}
+
+	return libstack.AggregateStatusCounts(statusCounts, servicesCount), ""
+}
+
+func (c *ComposeDeployer) WaitForStatus(ctx context.Context, name string, status libstack.Status) libstack.WaitResult {
+	waitResult := libstack.WaitResult{Status: status}
+
+	for {
+		if ctx.Err() != nil {
+			waitResult.ErrorMsg = "failed to wait for status: " + ctx.Err().Error()
+
+			return waitResult
+		}
+
+		time.Sleep(1 * time.Second)
+
+		var containerSummaries []api.ContainerSummary
+
+		if err := c.withComposeService(ctx, nil, libstack.Options{ProjectName: name}, func(composeService api.Compose, project *types.Project) error {
+			var err error
+
+			psCtx, cancelFunc := context.WithTimeout(context.Background(), time.Minute)
+			defer cancelFunc()
+			containerSummaries, err = composeService.Ps(psCtx, name, api.PsOptions{All: true})
+
+			return err
+		}); err != nil {
+			log.Debug().
+				Str("project_name", name).
+				Err(err).
+				Msg("error from docker compose ps")
+
+			continue
+		}
+
+		services := serviceListFromContainerSummary(containerSummaries)
+
+		if len(services) == 0 && status == libstack.StatusRemoved {
+			return waitResult
+		}
+
+		aggregateStatus, errorMessage := aggregateStatuses(ctx, services)
+		if aggregateStatus == status {
+			return waitResult
+		}
+
+		if status == libstack.StatusRunning && aggregateStatus == libstack.StatusCompleted {
+			waitResult.Status = libstack.StatusCompleted
+
+			return waitResult
+		}
+
+		if errorMessage != "" {
+			waitResult.ErrorMsg = errorMessage
+
+			return waitResult
+		}
+
+		log.Debug().
+			Str("project_name", name).
+			Str("required_status", string(status)).
+			Str("status", string(aggregateStatus)).
+			Msg("waiting for status")
+	}
+}
+
+func serviceListFromContainerSummary(containerSummaries []api.ContainerSummary) []service {
+	var services []service
+
+	for _, cs := range containerSummaries {
+		var publishers []publisher
+
+		for _, p := range cs.Publishers {
+			publishers = append(publishers, publisher{
+				URL:           p.URL,
+				TargetPort:    p.TargetPort,
+				PublishedPort: p.PublishedPort,
+				Protocol:      p.Protocol,
+			})
+		}
+
+		services = append(services, service{
+			ID:         cs.ID,
+			Name:       cs.Name,
+			Image:      cs.Image,
+			Command:    cs.Command,
+			Project:    cs.Project,
+			Service:    cs.Service,
+			Created:    cs.Created,
+			State:      cs.State,
+			Status:     cs.Status,
+			Health:     cs.Health,
+			ExitCode:   cs.ExitCode,
+			Publishers: publishers,
+		})
+	}
+
+	return services
+}
diff --git a/pkg/libstack/compose/status_integration_test.go b/pkg/libstack/compose/status_integration_test.go
new file mode 100644
index 0000000..d90651d
--- /dev/null
+++ b/pkg/libstack/compose/status_integration_test.go
@@ -0,0 +1,115 @@
+package compose
+
+import (
+	"context"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/portainer/portainer/pkg/libstack"
+)
+
+/*
+
+1. starting = docker compose file that runs several services, one of them should be with status starting
+2. running = docker compose file that runs successfully and returns status running
+3. removing = run docker compose config, remove the stack, and return removing status
+4. failed = run a valid docker compose file, but one of the services should fail to start (so "docker compose up" should run successfully, but one of the services should do something like `CMD ["exit", "1"]
+5. removed = remove a compose stack and return status removed
+
+*/
+
+func ensureIntegrationTest(t *testing.T) {
+	if _, ok := os.LookupEnv("INTEGRATION_TEST"); !ok {
+		t.Skip("skip an integration test")
+	}
+}
+
+func TestComposeProjectStatus(t *testing.T) {
+	t.Parallel()
+	ensureIntegrationTest(t)
+
+	testCases := []struct {
+		TestName              string
+		ComposeFile           string
+		ExpectedStatus        libstack.Status
+		ExpectedStatusMessage bool
+	}{
+
+		{
+			TestName:       "running",
+			ComposeFile:    "status_test_files/running.yml",
+			ExpectedStatus: libstack.StatusRunning,
+		},
+
+		{
+			TestName:              "failed",
+			ComposeFile:           "status_test_files/failed.yml",
+			ExpectedStatus:        libstack.StatusError,
+			ExpectedStatusMessage: true,
+		},
+	}
+
+	w := NewComposeDeployer()
+
+	for _, testCase := range testCases {
+		t.Run(testCase.TestName, func(t *testing.T) {
+			projectName := testCase.TestName
+			err := w.Deploy(t.Context(), []string{testCase.ComposeFile}, libstack.DeployOptions{
+				Options: libstack.Options{
+					ProjectName: projectName,
+				},
+			})
+			if err != nil {
+				t.Fatalf("[test: %s] Failed to deploy compose file: %v", testCase.TestName, err)
+			}
+
+			time.Sleep(5 * time.Second)
+
+			status, statusMessage, err := waitForStatus(w, t.Context(), projectName, libstack.StatusRunning)
+			if err != nil {
+				t.Fatalf("[test: %s] Failed to get compose project status: %v", testCase.TestName, err)
+			}
+
+			if status != testCase.ExpectedStatus {
+				t.Fatalf("[test: %s] Expected status: %s, got: %s", testCase.TestName, testCase.ExpectedStatus, status)
+			}
+
+			if testCase.ExpectedStatusMessage && statusMessage == "" {
+				t.Fatalf("[test: %s] Expected status message but got empty", testCase.TestName)
+			}
+
+			err = w.Remove(t.Context(), projectName, nil, libstack.RemoveOptions{})
+			if err != nil {
+				t.Fatalf("[test: %s] Failed to remove compose project: %v", testCase.TestName, err)
+			}
+
+			time.Sleep(20 * time.Second)
+
+			status, statusMessage, err = waitForStatus(w, t.Context(), projectName, libstack.StatusRemoved)
+			if err != nil {
+				t.Fatalf("[test: %s] Failed to get compose project status: %v", testCase.TestName, err)
+			}
+
+			if status != libstack.StatusRemoved {
+				t.Fatalf("[test: %s] Expected stack to be removed, got %s", testCase.TestName, status)
+			}
+
+			if statusMessage != "" {
+				t.Fatalf("[test: %s] Expected empty status message: %s, got: %s", "", testCase.TestName, statusMessage)
+			}
+		})
+	}
+}
+
+func waitForStatus(deployer libstack.Deployer, ctx context.Context, stackName string, requiredStatus libstack.Status) (libstack.Status, string, error) {
+	ctx, cancel := context.WithTimeout(ctx, 1*time.Minute)
+	defer cancel()
+
+	result := deployer.WaitForStatus(ctx, stackName, requiredStatus)
+	if result.ErrorMsg == "" {
+		return result.Status, "", nil
+	}
+
+	return libstack.StatusError, result.ErrorMsg, nil
+}
diff --git a/pkg/libstack/compose/status_test_files/failed.yml b/pkg/libstack/compose/status_test_files/failed.yml
new file mode 100644
index 0000000..fdd9b35
--- /dev/null
+++ b/pkg/libstack/compose/status_test_files/failed.yml
@@ -0,0 +1,7 @@
+version: '3'
+services:
+  web:
+    image: nginx:latest
+  failing-service:
+    image: busybox
+    command: ['false']
diff --git a/pkg/libstack/compose/status_test_files/running.yml b/pkg/libstack/compose/status_test_files/running.yml
new file mode 100644
index 0000000..1950aaa
--- /dev/null
+++ b/pkg/libstack/compose/status_test_files/running.yml
@@ -0,0 +1,4 @@
+version: '3'
+services:
+  web:
+    image: nginx:latest
diff --git a/pkg/libstack/dockercli.go b/pkg/libstack/dockercli.go
new file mode 100644
index 0000000..cfaea32
--- /dev/null
+++ b/pkg/libstack/dockercli.go
@@ -0,0 +1,100 @@
+package libstack
+
+import (
+	"context"
+	"fmt"
+	"maps"
+	"sync"
+
+	"github.com/portainer/portainer/api/logs"
+
+	"github.com/docker/cli/cli/command"
+	configtypes "github.com/docker/cli/cli/config/types"
+	"github.com/docker/cli/cli/flags"
+	"github.com/docker/docker/registry"
+	"github.com/rs/zerolog/log"
+)
+
+// DockerCliOptions holds the settings required to initialise a DockerCli.
+type DockerCliOptions struct {
+	Host       string
+	Registries []configtypes.AuthConfig
+	// Headers are injected as custom HTTP headers on every request the client makes.
+	Headers map[string]string
+}
+
+// mu serialises calls to cli.Initialize across all deployer types (compose and
+// swarm) to prevent concurrent initialisation of the Docker client config.
+var mu sync.Mutex
+
+// WithCli creates and initialises a DockerCli, injects registry credentials,
+// and calls cliFn with the ready client. The client is closed after cliFn returns.
+func WithCli(
+	ctx context.Context, //nolint:staticcheck
+	options DockerCliOptions,
+	cliFn func(context.Context, *command.DockerCli) error,
+) error {
+	ctx = context.Background() //nolint:staticcheck
+
+	cli, err := command.NewDockerCli(command.WithCombinedStreams(log.Logger))
+	if err != nil {
+		return fmt.Errorf("unable to create a Docker client: %w", err)
+	}
+
+	opts := flags.NewClientOptions()
+	if options.Host != "" {
+		opts.Hosts = []string{options.Host}
+	}
+
+	mu.Lock()
+	if err := cli.Initialize(opts); err != nil {
+		mu.Unlock()
+		return fmt.Errorf("unable to initialize the Docker client: %w", err)
+	}
+	mu.Unlock()
+
+	// Inject custom headers before the first Client() call, which is where the
+	// Docker client is lazily created and reads ConfigFile().HTTPHeaders.
+	if len(options.Headers) > 0 {
+		cfg := cli.ConfigFile()
+		if cfg.HTTPHeaders == nil {
+			cfg.HTTPHeaders = make(map[string]string)
+		}
+		maps.Copy(cfg.HTTPHeaders, options.Headers)
+	}
+
+	defer logs.CloseAndLogErr(cli.Client())
+
+	for _, r := range options.Registries {
+		if r.ServerAddress == "" || r.ServerAddress == registry.DefaultNamespace {
+			r.ServerAddress = registry.IndexServer
+		}
+
+		cli.ConfigFile().AuthConfigs[r.ServerAddress] = r
+	}
+
+	// Docker resolves credentials in the following priority:
+	// 1. credHelpers – per-registry credential helpers
+	// 2. credsStore  – global credential store used for all registries
+	// 3. auths       – inline credentials defined in config.json
+	//
+	// Many Docker Desktop users (Windows/macOS) have a global credsStore configured
+	// by default (e.g. "desktop.exe" on Windows or "osxkeychain" on macOS). These
+	// global stores often do not include credentials for the custom registries
+	// defined in Portainer stacks, leading to authentication failures.
+	//
+	// To avoid this, when inline credentials are provided for one or more registries,
+	// we intentionally clear the global credsStore. This ensures Docker uses the
+	// credentials configured in Portainer instead of falling back to an empty global
+	// store.
+	//
+	// If no inline credentials are configured in Portainer, we keep the credsStore
+	// so Docker can still use it as a fallback.
+	// credHelpers are not affected as they are external services managed by the user.
+	// @ref: https://linear.app/portainer/issue/BE-12237
+	if len(options.Registries) > 0 {
+		cli.ConfigFile().CredentialsStore = ""
+	}
+
+	return cliFn(ctx, cli)
+}
diff --git a/pkg/libstack/dockercli_test.go b/pkg/libstack/dockercli_test.go
new file mode 100644
index 0000000..49da8b7
--- /dev/null
+++ b/pkg/libstack/dockercli_test.go
@@ -0,0 +1,38 @@
+package libstack
+
+import (
+	"context"
+	"testing"
+
+	"github.com/docker/cli/cli/command"
+	"github.com/stretchr/testify/require"
+)
+
+func TestWithCli_InjectsHeaders(t *testing.T) {
+	const headerName = "X-PortainerAgent-ManagerOperation"
+
+	err := WithCli(
+		t.Context(),
+		DockerCliOptions{
+			Host:    "tcp://127.0.0.1:1",
+			Headers: map[string]string{headerName: "1"},
+		},
+		func(_ context.Context, cli *command.DockerCli) error {
+			require.Equal(t, "1", cli.ConfigFile().HTTPHeaders[headerName])
+			return nil
+		},
+	)
+	require.NoError(t, err)
+}
+
+func TestWithCli_NoHeaders(t *testing.T) {
+	err := WithCli(
+		context.Background(),
+		DockerCliOptions{Host: "tcp://127.0.0.1:1"},
+		func(_ context.Context, cli *command.DockerCli) error {
+			require.Empty(t, cli.ConfigFile().HTTPHeaders)
+			return nil
+		},
+	)
+	require.NoError(t, err)
+}
diff --git a/pkg/libstack/libstack.go b/pkg/libstack/libstack.go
new file mode 100644
index 0000000..73c3350
--- /dev/null
+++ b/pkg/libstack/libstack.go
@@ -0,0 +1,138 @@
+package libstack
+
+import (
+	"context"
+	"os"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+
+	configtypes "github.com/docker/cli/cli/config/types"
+)
+
+const PortainerEnvVarsPrefix = "PORTAINER_"
+
+// PortainerEnvVars returns all environment variables from os.Environ() that
+// start with the PORTAINER_ prefix.
+func PortainerEnvVars() []string {
+	var vars []string
+	for _, e := range os.Environ() {
+		if strings.HasPrefix(e, PortainerEnvVarsPrefix) {
+			vars = append(vars, e)
+		}
+	}
+	return vars
+}
+
+// AggregateStatusCounts derives a single stack Status from a map of per-status
+// counts and the total number of services. The priority order matches the
+// behaviour of both the compose and swarm deployers.
+func AggregateStatusCounts(statusCounts map[Status]int, total int) Status {
+	switch {
+	case statusCounts[StatusError] > 0:
+		return StatusError
+	case statusCounts[StatusStarting] > 0:
+		return StatusStarting
+	case statusCounts[StatusRemoving] > 0:
+		return StatusRemoving
+	case statusCounts[StatusCompleted] == total:
+		return StatusCompleted
+	case statusCounts[StatusRunning]+statusCounts[StatusCompleted] == total:
+		return StatusRunning
+	case statusCounts[StatusStopped] == total:
+		return StatusStopped
+	case statusCounts[StatusRemoved] == total:
+		return StatusRemoved
+	default:
+		return StatusUnknown
+	}
+}
+
+type Deployer interface {
+	Deploy(ctx context.Context, filePaths []string, options DeployOptions) error
+	// Remove stops and removes containers
+	//
+	// projectName or filePaths are required
+	// if projectName is supplied filePaths will be ignored
+	Remove(ctx context.Context, projectName string, filePaths []string, options RemoveOptions) error
+	Pull(ctx context.Context, filePaths []string, options Options) error
+	Run(ctx context.Context, filePaths []string, serviceName string, options RunOptions) error
+	Validate(ctx context.Context, filePaths []string, options Options) error
+	WaitForStatus(ctx context.Context, name string, status Status) WaitResult
+	Config(ctx context.Context, filePaths []string, options Options) ([]byte, error)
+	GetExistingEdgeStacks(ctx context.Context) ([]EdgeStack, error)
+}
+
+type Status string
+
+const (
+	StatusUnknown   Status = "unknown"
+	StatusStarting  Status = "starting"
+	StatusRunning   Status = "running"
+	StatusStopped   Status = "stopped"
+	StatusError     Status = "error"
+	StatusRemoving  Status = "removing"
+	StatusRemoved   Status = "removed"
+	StatusCompleted Status = "completed"
+)
+
+type WaitResult struct {
+	Status   Status
+	ErrorMsg string
+}
+
+type Options struct {
+	// WorkingDir is the working directory for the command execution
+	WorkingDir  string
+	Host        string
+	ProjectName string
+	// EnvFilePath is the path to a .env file
+	EnvFilePath string
+	// Env is a list of environment variables to pass to the command, example: "FOO=bar"
+	Env []string
+	// ProjectDir is the working directory for containers created by docker compose file.
+	// By default, it is an empty string, which means it corresponds to the path of the compose file itself.
+	// This is particularly helpful when mounting a relative path.
+	ProjectDir string
+	// ConfigOptions is a list of options to pass to the docker-compose config command
+	ConfigOptions []string
+	Registries    []configtypes.AuthConfig
+	// BindMountHashEnabled controls whether bind mount hash labels are set for services.
+	// This option is primarily used by libstack internals and advanced callers that need
+	// to manage bind mount hash behavior explicitly. This is not an option that users can set.
+	BindMountHashEnabled bool
+}
+
+type DeployOptions struct {
+	Options
+	ForceRecreate bool
+	// AbortOnContainerExit will stop the deployment if a container exits.
+	// This is useful when running a onetime task.
+	//
+	// When this is set, docker compose will output its logs to stdout
+	AbortOnContainerExit bool
+	RemoveOrphans        bool
+	EdgeStackID          portainer.EdgeStackID
+}
+
+type RunOptions struct {
+	Options
+	// Automatically remove the container when it exits
+	Remove bool
+	// A list of arguments to pass to the container
+	Args []string
+	// Run the container in detached mode
+	Detached bool
+}
+
+type RemoveOptions struct {
+	Options
+
+	Volumes bool
+}
+
+type EdgeStack struct {
+	ID       int
+	Name     string
+	ExitCode int
+}
diff --git a/pkg/libstack/swarm/swarm.go b/pkg/libstack/swarm/swarm.go
new file mode 100644
index 0000000..bc931c2
--- /dev/null
+++ b/pkg/libstack/swarm/swarm.go
@@ -0,0 +1,933 @@
+package swarm
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/portainer/portainer/api/filesystem"
+	"github.com/portainer/portainer/pkg/libstack"
+
+	"github.com/containerd/errdefs"
+	"github.com/distribution/reference"
+	"github.com/docker/cli/cli/command"
+
+	"github.com/docker/cli/cli/compose/convert"
+	composeloader "github.com/docker/cli/cli/compose/loader"
+	"github.com/docker/cli/cli/compose/schema"
+	composetypes "github.com/docker/cli/cli/compose/types"
+	configtypes "github.com/docker/cli/cli/config/types"
+	"github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/api/types/filters"
+	"github.com/docker/docker/api/types/network"
+	registrytypes "github.com/docker/docker/api/types/registry"
+	"github.com/docker/docker/api/types/swarm"
+	"github.com/docker/docker/client"
+	dockerregistry "github.com/docker/docker/registry"
+	"github.com/rs/zerolog/log"
+)
+
+// managerOperationHeader forces the Portainer agent to route requests to a swarm
+// manager node. Swarm-scoped operations (e.g. network create/remove) fail on worker
+// nodes without it. This constant is originally defined in the agent, see package/agent/README.md.
+const managerOperationHeader = "X-PortainerAgent-ManagerOperation"
+
+// cliOptions builds the Docker CLI options for swarm operations, always setting the
+// manager-operation header so requests proxied through an agent target a manager node.
+func cliOptions(host string, registries []configtypes.AuthConfig) libstack.DockerCliOptions {
+	return libstack.DockerCliOptions{
+		Host:       host,
+		Registries: registries,
+		Headers:    map[string]string{managerOperationHeader: "1"},
+	}
+}
+
+// Options holds connection and credential settings for swarm operations.
+type Options struct {
+	ProjectName string
+	Host        string
+	Env         []string
+	Registries  []configtypes.AuthConfig
+}
+
+// DeployOptions extends Options with deployment-specific settings.
+type DeployOptions struct {
+	Options
+	RemoveOrphans bool
+	// PullImage controls how image digests are resolved on deploy:
+	//   true  - query the registry (ResolveImageAlways)
+	//   false - never contact the registry; reuse the existing digest (ResolveImageNever)
+	PullImage bool
+	// ForceRecreate increments ForceUpdate on every existing service so that
+	// Docker re-schedules all tasks even when nothing in the spec has changed.
+	ForceRecreate bool
+}
+
+// RemoveOptions extends Options with removal settings.
+type RemoveOptions struct {
+	Options
+}
+
+// Deployer is the interface for in-process Docker Swarm stack management.
+type Deployer interface {
+	Deploy(ctx context.Context, filePaths []string, options DeployOptions) error
+	Remove(ctx context.Context, projectName string, options RemoveOptions) error
+	Validate(ctx context.Context, filePaths []string, options Options) error
+	WaitForStatus(ctx context.Context, projectName string, options Options, status libstack.Status) libstack.WaitResult
+}
+
+// SwarmDeployer implements Deployer using the Docker API in-process.
+type SwarmDeployer struct{}
+
+// NewSwarmDeployer creates a new SwarmDeployer.
+func NewSwarmDeployer() *SwarmDeployer { return &SwarmDeployer{} }
+
+// Deploy creates or updates a Docker Swarm stack from the given compose files.
+func (d *SwarmDeployer) Deploy(ctx context.Context, filePaths []string, options DeployOptions) error {
+	// WithCli replaces the context with Background internally, so we capture the
+	// caller's context here to preserve cancellation.
+	callerCtx := ctx
+
+	return libstack.WithCli(
+		ctx,
+		cliOptions(options.Host, options.Registries),
+		func(_ context.Context, dockerCLI *command.DockerCli) error {
+			return deployStack(callerCtx, dockerCLI, filePaths, options)
+		})
+}
+
+// Validate loads and parses the compose file(s), returning an error if they are invalid.
+func (d *SwarmDeployer) Validate(_ context.Context, filePaths []string, options Options) error {
+	_, err := getConfig(filePaths, options.Env)
+	return err
+}
+
+// Remove deletes all resources belonging to a Swarm stack and waits for tasks to terminate.
+func (d *SwarmDeployer) Remove(ctx context.Context, projectName string, options RemoveOptions) error {
+	// WithCli replaces the context with Background internally, so we capture the
+	// caller's context here to preserve cancellation.
+	callerCtx := ctx
+
+	return libstack.WithCli(
+		ctx,
+		cliOptions(options.Host, options.Registries),
+		func(_ context.Context, dockerCLI *command.DockerCli) error {
+			apiClient := dockerCLI.Client()
+
+			services, err := getStackServices(callerCtx, apiClient, projectName)
+			if err != nil {
+				return err
+			}
+
+			secrets, err := getStackSecrets(callerCtx, apiClient, projectName)
+			if err != nil {
+				return err
+			}
+
+			configs, err := getStackConfigs(callerCtx, apiClient, projectName)
+			if err != nil {
+				return err
+			}
+
+			networks, err := getStackNetworks(callerCtx, apiClient, projectName)
+			if err != nil {
+				return err
+			}
+
+			if len(services)+len(secrets)+len(configs)+len(networks) == 0 {
+				log.Info().Str("stack", projectName).Msg("nothing found in stack")
+				return nil
+			}
+
+			var errs []error
+
+			if err := removeServices(callerCtx, apiClient, services); err != nil {
+				errs = append(errs, err)
+			}
+
+			if err := removeSecrets(callerCtx, apiClient, secrets); err != nil {
+				errs = append(errs, err)
+			}
+
+			if err := removeConfigs(callerCtx, apiClient, configs); err != nil {
+				errs = append(errs, err)
+			}
+
+			if err := removeNetworks(callerCtx, apiClient, networks); err != nil {
+				errs = append(errs, err)
+			}
+
+			if len(errs) > 0 {
+				return errors.Join(errs...)
+			}
+
+			// Wait for all tasks to reach a terminal state before returning, mirroring
+			// the behaviour of `docker stack rm --detach=false`.
+			return waitOnTasks(callerCtx, apiClient, projectName)
+		})
+}
+
+// deployStack is the core stack deployment logic.
+// It reimplements `docker stack deploy` in-process using the docker/cli compose loader and
+// convert packages. Reference: https://github.com/docker/cli/blob/v28.5.2/cli/command/stack/swarm/deploy_composefile.go
+func deployStack(ctx context.Context, dockerCLI *command.DockerCli, filePaths []string, options DeployOptions) error {
+	info, err := dockerCLI.Client().Info(ctx)
+	if err != nil {
+		return fmt.Errorf("failed to get docker info: %w", err)
+	}
+
+	if !info.Swarm.ControlAvailable {
+		return errors.New(`this node is not a swarm manager. Use "docker swarm init" or "docker swarm join" to connect this node to swarm and try again`)
+	}
+
+	config, err := getConfig(filePaths, options.Env)
+	if err != nil {
+		return fmt.Errorf("failed to load compose file: %w", err)
+	}
+
+	namespace := convert.NewNamespace(options.ProjectName)
+
+	// Prune orphan services before deploying to avoid name conflicts during rolling updates.
+	if options.RemoveOrphans {
+		incoming := make(map[string]struct{}, len(config.Services))
+		for _, svc := range config.Services {
+			incoming[svc.Name] = struct{}{}
+		}
+
+		err := pruneServices(ctx, dockerCLI.Client(), namespace, incoming)
+		if err != nil {
+			return err
+		}
+	}
+
+	serviceNetworks := getServicesDeclaredNetworks(config.Services)
+	networks, externalNetworks := convert.Networks(namespace, config.Networks, serviceNetworks)
+	if err := validateExternalNetworks(ctx, dockerCLI.Client(), externalNetworks); err != nil {
+		return err
+	}
+
+	if err := createNetworks(ctx, dockerCLI.Client(), namespace, networks); err != nil {
+		return err
+	}
+
+	secrets, err := convert.Secrets(namespace, config.Secrets)
+	if err != nil {
+		return err
+	}
+
+	if err := createSecrets(ctx, dockerCLI.Client(), secrets); err != nil {
+		return err
+	}
+
+	configs, err := convert.Configs(namespace, config.Configs)
+	if err != nil {
+		return err
+	}
+
+	if err := createConfigs(ctx, dockerCLI.Client(), configs); err != nil {
+		return err
+	}
+
+	services, err := convert.Services(ctx, namespace, config, dockerCLI.Client())
+	if err != nil {
+		return err
+	}
+
+	return deployServices(
+		ctx,
+		dockerCLI.Client(),
+		options.Registries,
+		services,
+		namespace,
+		options.PullImage,
+		options.ForceRecreate,
+	)
+}
+
+func getStackFilter(namespace string) filters.Args {
+	f := filters.NewArgs()
+	f.Add("label", convert.LabelNamespace+"="+namespace)
+
+	return f
+}
+
+func getStackServices(ctx context.Context, apiClient client.APIClient, namespace string) ([]swarm.Service, error) {
+	return apiClient.ServiceList(ctx, swarm.ServiceListOptions{Filters: getStackFilter(namespace)})
+}
+
+func getStackNetworks(ctx context.Context, apiClient client.APIClient, namespace string) ([]network.Summary, error) {
+	return apiClient.NetworkList(ctx, network.ListOptions{Filters: getStackFilter(namespace)})
+}
+
+func getStackSecrets(ctx context.Context, apiClient client.APIClient, namespace string) ([]swarm.Secret, error) {
+	return apiClient.SecretList(ctx, swarm.SecretListOptions{Filters: getStackFilter(namespace)})
+}
+
+func getStackConfigs(ctx context.Context, apiClient client.APIClient, namespace string) ([]swarm.Config, error) {
+	return apiClient.ConfigList(ctx, swarm.ConfigListOptions{Filters: getStackFilter(namespace)})
+}
+
+func getStackTasks(ctx context.Context, apiClient client.APIClient, namespace string) ([]swarm.Task, error) {
+	return apiClient.TaskList(ctx, swarm.TaskListOptions{Filters: getStackFilter(namespace)})
+}
+
+func getServicesDeclaredNetworks(services []composetypes.ServiceConfig) map[string]struct{} {
+	serviceNetworks := make(map[string]struct{})
+
+	for _, svc := range services {
+		if len(svc.Networks) == 0 {
+			serviceNetworks["default"] = struct{}{}
+			continue
+		}
+		for nw := range svc.Networks {
+			serviceNetworks[nw] = struct{}{}
+		}
+	}
+
+	return serviceNetworks
+}
+
+func validateExternalNetworks(ctx context.Context, apiClient client.NetworkAPIClient, externalNetworks []string) error {
+	for _, name := range externalNetworks {
+		if !container.NetworkMode(name).IsUserDefined() {
+			// Networks that are not user defined always exist on all nodes as
+			// local-scoped networks, so there's no need to inspect them.
+			continue
+		}
+
+		nw, err := apiClient.NetworkInspect(ctx, name, network.InspectOptions{})
+		switch {
+		case errdefs.IsNotFound(err):
+			return fmt.Errorf("network %q is declared as external, but could not be found. You need to create a swarm-scoped network before the stack is deployed", name)
+		case err != nil:
+			return err
+		case nw.Scope != "swarm":
+			return fmt.Errorf("network %q is declared as external, but it is not in the right scope: %q instead of \"swarm\"", name, nw.Scope)
+		}
+	}
+
+	return nil
+}
+
+func createNetworks(
+	ctx context.Context,
+	apiClient client.APIClient,
+	namespace convert.Namespace,
+	networks map[string]network.CreateOptions,
+) error {
+	existingNetworks, err := getStackNetworks(ctx, apiClient, namespace.Name())
+	if err != nil {
+		return err
+	}
+
+	existingNetworkMap := make(map[string]network.Summary, len(existingNetworks))
+	for _, nw := range existingNetworks {
+		existingNetworkMap[nw.Name] = nw
+	}
+
+	for name, createOpts := range networks {
+		if _, exists := existingNetworkMap[name]; exists {
+			continue
+		}
+
+		if createOpts.Driver == "" {
+			createOpts.Driver = "overlay"
+		}
+
+		log.Info().Str("network", name).Msg("creating network")
+
+		if _, err := apiClient.NetworkCreate(ctx, name, createOpts); err != nil {
+			return fmt.Errorf("failed to create network %s: %w", name, err)
+		}
+	}
+
+	return nil
+}
+
+func createSecrets(ctx context.Context, apiClient client.APIClient, secrets []swarm.SecretSpec) error {
+	for _, secretSpec := range secrets {
+		existing, _, err := apiClient.SecretInspectWithRaw(ctx, secretSpec.Name)
+
+		switch {
+		case err == nil:
+			if err := apiClient.SecretUpdate(ctx, existing.ID, existing.Version, secretSpec); err != nil {
+				return fmt.Errorf("failed to update secret %s: %w", secretSpec.Name, err)
+			}
+		case errdefs.IsNotFound(err):
+			log.Info().Str("secret", secretSpec.Name).Msg("creating secret")
+
+			if _, err := apiClient.SecretCreate(ctx, secretSpec); err != nil {
+				return fmt.Errorf("failed to create secret %s: %w", secretSpec.Name, err)
+			}
+		default:
+			return err
+		}
+	}
+
+	return nil
+}
+
+func createConfigs(ctx context.Context, apiClient client.APIClient, configs []swarm.ConfigSpec) error {
+	for _, configSpec := range configs {
+		existing, _, err := apiClient.ConfigInspectWithRaw(ctx, configSpec.Name)
+
+		switch {
+		case err == nil:
+			if err := apiClient.ConfigUpdate(ctx, existing.ID, existing.Version, configSpec); err != nil {
+				return fmt.Errorf("failed to update config %s: %w", configSpec.Name, err)
+			}
+		case errdefs.IsNotFound(err):
+			log.Info().Str("config", configSpec.Name).Msg("creating config")
+
+			if _, err := apiClient.ConfigCreate(ctx, configSpec); err != nil {
+				return fmt.Errorf("failed to create config %s: %w", configSpec.Name, err)
+			}
+		default:
+			return err
+		}
+	}
+
+	return nil
+}
+
+// encodeRegistryAuth finds the registry credentials for the given image and returns
+// the base64-encoded auth string expected by the Docker service API.
+// Returns an empty string (no error) when no matching credentials are found.
+func encodeRegistryAuth(image string, registries []configtypes.AuthConfig) (string, error) {
+	named, err := reference.ParseNormalizedNamed(image)
+	if err != nil {
+		return "", fmt.Errorf("failed to parse image reference %q: %w", image, err)
+	}
+
+	domain := reference.Domain(named)
+	if domain == "docker.io" {
+		domain = dockerregistry.IndexServer
+	}
+
+	for _, r := range registries {
+		if r.ServerAddress == domain {
+			encoded, err := registrytypes.EncodeAuthConfig(registrytypes.AuthConfig{
+				Username:      r.Username,
+				Password:      r.Password,
+				ServerAddress: r.ServerAddress,
+				Auth:          r.Auth,
+				IdentityToken: r.IdentityToken,
+				RegistryToken: r.RegistryToken,
+			})
+			if err != nil {
+				return "", fmt.Errorf("failed to encode auth for registry %s: %w", domain, err)
+			}
+			return encoded, nil
+		}
+	}
+
+	return "", nil
+}
+
+func deployServices(
+	ctx context.Context,
+	apiClient client.APIClient,
+	registries []configtypes.AuthConfig,
+	services map[string]swarm.ServiceSpec,
+	namespace convert.Namespace,
+	pullImage bool,
+	forceRecreate bool,
+) error {
+	existingServices, err := getStackServices(ctx, apiClient, namespace.Name())
+	if err != nil {
+		return err
+	}
+
+	existingServiceMap := make(map[string]swarm.Service, len(existingServices))
+	for _, svc := range existingServices {
+		existingServiceMap[svc.Spec.Name] = svc
+	}
+
+	for internalName, serviceSpec := range services {
+		name := namespace.Scope(internalName)
+		image := serviceSpec.TaskTemplate.ContainerSpec.Image
+
+		encodedAuth, err := encodeRegistryAuth(image, registries)
+		if err != nil {
+			return fmt.Errorf("failed to encode registry auth for image %s: %w", image, err)
+		}
+
+		if existing, exists := existingServiceMap[name]; exists {
+			log.Info().Str("service", name).Str("id", existing.ID).Msg("updating service")
+
+			updateOpts := swarm.ServiceUpdateOptions{EncodedRegistryAuth: encodedAuth}
+
+			if pullImage {
+				// pullImage=true → ResolveImageAlways: always query the registry during
+				// updates so redeploys can repull images even when the tag is unchanged.
+				updateOpts.QueryRegistry = true
+			} else {
+				// pullImage=false → ResolveImageNever: always reuse the existing digest.
+				if image == existing.Spec.Labels[convert.LabelImage] {
+					serviceSpec.TaskTemplate.ContainerSpec.Image = existing.Spec.TaskTemplate.ContainerSpec.Image
+				}
+			}
+
+			if forceRecreate {
+				serviceSpec.TaskTemplate.ForceUpdate = existing.Spec.TaskTemplate.ForceUpdate + 1
+			} else {
+				// Preserve ForceUpdate so that tasks are not re-deployed if nothing changed.
+				serviceSpec.TaskTemplate.ForceUpdate = existing.Spec.TaskTemplate.ForceUpdate
+			}
+
+			response, err := apiClient.ServiceUpdate(ctx, existing.ID, existing.Version, serviceSpec, updateOpts)
+			if err != nil {
+				return fmt.Errorf("failed to update service %s: %w", name, err)
+			}
+
+			for _, warning := range response.Warnings {
+				log.Warn().Str("service", name).Msg(warning)
+			}
+		} else {
+			log.Info().Str("service", name).Msg("creating service")
+
+			createOpts := swarm.ServiceCreateOptions{EncodedRegistryAuth: encodedAuth}
+
+			if pullImage {
+				createOpts.QueryRegistry = true
+			}
+
+			if _, err := apiClient.ServiceCreate(ctx, serviceSpec, createOpts); err != nil {
+				return fmt.Errorf("failed to create service %s: %w", name, err)
+			}
+		}
+	}
+
+	return nil
+}
+
+// pruneServices removes services that are present in the existing stack but absent from
+// the incoming config. Must be called before deploying the new config to avoid name conflicts.
+func pruneServices(
+	ctx context.Context,
+	apiClient client.APIClient,
+	namespace convert.Namespace,
+	incoming map[string]struct{},
+) error {
+	existingServices, err := getStackServices(ctx, apiClient, namespace.Name())
+	if err != nil {
+		return fmt.Errorf("failed to list services for pruning: %w", err)
+	}
+
+	toRemove := make([]swarm.Service, 0, len(existingServices))
+	for _, svc := range existingServices {
+		if _, exists := incoming[namespace.Descope(svc.Spec.Name)]; !exists {
+			toRemove = append(toRemove, svc)
+		}
+	}
+
+	err = removeServices(ctx, apiClient, toRemove)
+	if err != nil {
+		return fmt.Errorf("failed to prune orphan services: %w", err)
+	}
+
+	return nil
+}
+
+func removeServices(ctx context.Context, apiClient client.APIClient, services []swarm.Service) error {
+	sort.Slice(services, func(i, j int) bool {
+		return services[i].Spec.Name < services[j].Spec.Name
+	})
+
+	var errs []error
+
+	for _, svc := range services {
+		log.Info().Str("service", svc.Spec.Name).Msg("removing service")
+
+		if err := apiClient.ServiceRemove(ctx, svc.ID); err != nil {
+			errs = append(errs, fmt.Errorf("failed to remove service %s: %w", svc.Spec.Name, err))
+		}
+	}
+
+	return errors.Join(errs...)
+}
+
+func removeNetworks(ctx context.Context, apiClient client.APIClient, networks []network.Summary) error {
+	var errs []error
+
+	for _, nw := range networks {
+		log.Info().Str("network", nw.Name).Msg("removing network")
+
+		if err := apiClient.NetworkRemove(ctx, nw.ID); err != nil {
+			errs = append(errs, fmt.Errorf("failed to remove network %s: %w", nw.Name, err))
+		}
+	}
+
+	return errors.Join(errs...)
+}
+
+func removeSecrets(ctx context.Context, apiClient client.APIClient, secrets []swarm.Secret) error {
+	var errs []error
+
+	for _, secret := range secrets {
+		log.Info().Str("secret", secret.Spec.Name).Msg("removing secret")
+
+		if err := apiClient.SecretRemove(ctx, secret.ID); err != nil {
+			errs = append(errs, fmt.Errorf("failed to remove secret %s: %w", secret.Spec.Name, err))
+		}
+	}
+
+	return errors.Join(errs...)
+}
+
+func removeConfigs(ctx context.Context, apiClient client.APIClient, configs []swarm.Config) error {
+	var errs []error
+
+	for _, cfg := range configs {
+		log.Info().Str("config", cfg.Spec.Name).Msg("removing config")
+
+		if err := apiClient.ConfigRemove(ctx, cfg.ID); err != nil {
+			errs = append(errs, fmt.Errorf("failed to remove config %s: %w", cfg.Spec.Name, err))
+		}
+	}
+
+	return errors.Join(errs...)
+}
+
+// taskStateOrdinal mirrors docker/cli's unexported numberedStates map (cli/command/stack/swarm/remove.go).
+// The Docker SDK does not export terminal-state checking utilities, so we duplicate it here.
+var taskStateOrdinal = map[swarm.TaskState]int{
+	swarm.TaskStateNew:       1,
+	swarm.TaskStateAllocated: 2,
+	swarm.TaskStatePending:   3,
+	swarm.TaskStateAssigned:  4,
+	swarm.TaskStateAccepted:  5,
+	swarm.TaskStatePreparing: 6,
+	swarm.TaskStateReady:     7,
+	swarm.TaskStateStarting:  8,
+	swarm.TaskStateRunning:   9,
+	swarm.TaskStateComplete:  10,
+	swarm.TaskStateShutdown:  11,
+	swarm.TaskStateFailed:    12,
+	swarm.TaskStateRejected:  13,
+}
+
+func isTerminalState(state swarm.TaskState) bool {
+	return taskStateOrdinal[state] > taskStateOrdinal[swarm.TaskStateRunning]
+}
+
+func getConfig(filePaths []string, env []string) (*composetypes.Config, error) {
+	// Load and parse the compose file(s).
+	configDetails, err := getConfigDetails(filePaths, env)
+	if err != nil {
+		return nil, fmt.Errorf("failed to load compose file: %w", err)
+	}
+
+	// Collect raw config dicts for unsupported/deprecated property checks.
+	dicts := make([]map[string]any, 0, len(configDetails.ConfigFiles))
+	for _, cf := range configDetails.ConfigFiles {
+		dicts = append(dicts, cf.Config)
+	}
+
+	config, err := composeloader.Load(configDetails)
+	if err != nil {
+		if fpe, ok := errors.AsType[*composeloader.ForbiddenPropertiesError](err); ok {
+			return nil, fmt.Errorf("compose file contains unsupported options: %v", fpe.Properties)
+		}
+
+		return nil, fmt.Errorf("failed to parse compose file: %w", err)
+	}
+
+	if unsupported := composeloader.GetUnsupportedProperties(dicts...); len(unsupported) > 0 {
+		log.Warn().Strs("properties", unsupported).Msg("ignoring unsupported compose properties")
+	}
+
+	if deprecated := composeloader.GetDeprecatedProperties(dicts...); len(deprecated) > 0 {
+		log.Warn().Interface("properties", deprecated).Msg("ignoring deprecated compose properties")
+	}
+
+	for _, svc := range config.Services {
+		if svc.Image == "" {
+			return nil, fmt.Errorf("invalid image reference for service %s: no image specified", svc.Name)
+		}
+		if _, err := reference.ParseAnyReference(svc.Image); err != nil {
+			return nil, fmt.Errorf("invalid image reference for service %s: %w", svc.Name, err)
+		}
+	}
+
+	return config, nil
+}
+
+func getConfigDetails(filePaths []string, env []string) (composetypes.ConfigDetails, error) {
+	var details composetypes.ConfigDetails
+
+	if len(filePaths) == 0 {
+		return details, errors.New("at least one compose file must be specified")
+	}
+
+	// Resolve relative references against the compose file's own directory, matching
+	// Docker Compose semantics (the default project directory is the directory of the
+	// first compose file) and the compose (non-swarm) libstack deployer.
+	details.WorkingDir = filepath.Dir(filePaths[0])
+
+	details.ConfigFiles = make([]composetypes.ConfigFile, 0, len(filePaths))
+	for _, fp := range filePaths {
+		bytes, err := os.ReadFile(fp)
+		if err != nil {
+			return details, err
+		}
+
+		config, err := composeloader.ParseYAML(bytes)
+		if err != nil {
+			return details, err
+		}
+
+		resolveEnvFilePaths(config, filepath.Dir(fp))
+
+		details.ConfigFiles = append(details.ConfigFiles, composetypes.ConfigFile{
+			Filename: fp,
+			Config:   config,
+		})
+	}
+
+	// Take the first file version (2 files can't have different version)
+	details.Version = schema.Version(details.ConfigFiles[0].Config)
+
+	details.Environment = make(map[string]string)
+
+	addEnvVarFn := func(e string) {
+		k, v, _ := strings.Cut(e, "=")
+		if k != "" {
+			details.Environment[k] = v
+		}
+	}
+
+	for _, e := range libstack.PortainerEnvVars() {
+		addEnvVarFn(e)
+	}
+
+	for _, e := range env {
+		addEnvVarFn(e)
+	}
+
+	return details, nil
+}
+
+func resolveEnvFilePaths(rawConfig map[string]any, workingDir string) {
+	services, ok := rawConfig["services"].(map[string]any)
+	if !ok {
+		return
+	}
+	for _, svcAny := range services {
+		svc, ok := svcAny.(map[string]any)
+		if !ok {
+			continue
+		}
+		envFileAny, ok := svc["env_file"]
+		if !ok {
+			continue
+		}
+		switch ef := envFileAny.(type) {
+		case string:
+			if !filepath.IsAbs(ef) {
+				svc["env_file"] = filesystem.JoinPaths(workingDir, ef)
+			}
+		case []any:
+			for i, v := range ef {
+				if s, ok := v.(string); ok && !filepath.IsAbs(s) {
+					ef[i] = filesystem.JoinPaths(workingDir, s)
+				}
+			}
+		}
+	}
+}
+
+// WaitForStatus blocks until all services in the stack reach the requested status,
+// or the context is cancelled. It polls the Docker API every second.
+func (d *SwarmDeployer) WaitForStatus(
+	ctx context.Context,
+	projectName string,
+	options Options,
+	status libstack.Status,
+) libstack.WaitResult {
+	waitResult := libstack.WaitResult{Status: status}
+
+	// WithCli replaces the context with Background internally, so we capture the
+	// caller's context here to preserve cancellation.
+	callerCtx := ctx
+
+	err := libstack.WithCli(
+		ctx,
+		cliOptions(options.Host, options.Registries),
+		func(_ context.Context, dockerCLI *command.DockerCli) error {
+			apiClient := dockerCLI.Client()
+
+			for {
+				if callerCtx.Err() != nil {
+					waitResult.ErrorMsg = "failed to wait for status: " + callerCtx.Err().Error()
+					return nil
+				}
+
+				time.Sleep(time.Second)
+
+				services, err := getStackServices(callerCtx, apiClient, projectName)
+				if err != nil {
+					log.Warn().Str("project_name", projectName).Err(err).Msg("failed to list stack services")
+					continue
+				}
+
+				if len(services) == 0 && status == libstack.StatusRemoved {
+					return nil
+				}
+
+				var serviceStatuses []libstack.Status
+
+				for _, svc := range services {
+					svcStatus, errorMessage, err := getServiceStatus(callerCtx, apiClient, svc)
+					if err != nil {
+						log.Warn().
+							Str("project_name", projectName).
+							Str("service_name", svc.Spec.Name).
+							Err(err).
+							Msg("failed to get service status")
+						continue
+					}
+
+					if errorMessage != "" {
+						// An error message means a service failed, so the result must reflect that.
+						waitResult.Status = libstack.StatusError
+						waitResult.ErrorMsg = errorMessage
+						return nil
+					}
+
+					serviceStatuses = append(serviceStatuses, svcStatus)
+				}
+
+				if aggregateStatus(serviceStatuses) == status {
+					return nil
+				}
+
+				log.Debug().
+					Str("project_name", projectName).
+					Str("required_status", string(status)).
+					Str("status", string(aggregateStatus(serviceStatuses))).
+					Msg("waiting for status")
+			}
+		})
+
+	if err != nil && waitResult.ErrorMsg == "" {
+		waitResult.Status = libstack.StatusError
+		waitResult.ErrorMsg = err.Error()
+	}
+
+	return waitResult
+}
+
+func aggregateStatus(statuses []libstack.Status) libstack.Status {
+	if len(statuses) == 0 {
+		return libstack.StatusRemoved
+	}
+
+	statusCounts := make(map[libstack.Status]int)
+	for _, status := range statuses {
+		statusCounts[status]++
+	}
+
+	log.Debug().Interface("statusCounts", statusCounts).Msg("check_status")
+
+	return libstack.AggregateStatusCounts(statusCounts, len(statuses))
+}
+
+func getServiceStatus(
+	ctx context.Context,
+	apiClient client.APIClient,
+	svc swarm.Service,
+) (libstack.Status, string, error) {
+	tasks, err := apiClient.TaskList(ctx, swarm.TaskListOptions{
+		Filters: filters.NewArgs(filters.KeyValuePair{Key: "service", Value: svc.ID}),
+	})
+	if err != nil {
+		return "", "", fmt.Errorf("failed to list tasks for service %s: %w", svc.Spec.Name, err)
+	}
+
+	expectedRunningTaskCount := 0
+
+	if svc.Spec.Mode.Replicated != nil {
+		expectedRunningTaskCount = int(*svc.Spec.Mode.Replicated.Replicas)
+	}
+
+	if svc.Spec.Mode.Global != nil {
+		nodes, err := apiClient.NodeList(ctx, swarm.NodeListOptions{})
+		if err != nil {
+			return "", "", fmt.Errorf("failed to list nodes: %w", err)
+		}
+
+		expectedRunningTaskCount = len(nodes)
+	}
+
+	if expectedRunningTaskCount != 0 {
+		runningTaskCount := 0
+
+		for _, task := range tasks {
+			if task.Status.State == swarm.TaskStateRunning {
+				runningTaskCount++
+			}
+		}
+
+		if runningTaskCount == expectedRunningTaskCount {
+			return libstack.StatusRunning, "", nil
+		}
+	}
+
+	for _, task := range tasks {
+		switch task.Status.State {
+		case swarm.TaskStateRunning:
+			return libstack.StatusRunning, "", nil
+		case swarm.TaskStatePending, swarm.TaskStateStarting:
+			return libstack.StatusStarting, "", nil
+		case swarm.TaskStateRemove:
+			return libstack.StatusRemoving, "", nil
+		case swarm.TaskStateFailed, swarm.TaskStateRejected:
+			// Rejected means the task could never start (e.g. missing image, no disk space).
+			return libstack.StatusError, task.Status.Err, nil
+		default:
+			return libstack.StatusUnknown, "", nil
+		}
+	}
+
+	return libstack.StatusUnknown, "", nil
+}
+
+// waitOnTasks polls until all tasks belonging to the namespace reach a terminal state.
+func waitOnTasks(ctx context.Context, apiClient client.APIClient, namespace string) error {
+	for {
+		if ctx.Err() != nil {
+			return ctx.Err()
+		}
+
+		tasks, err := getStackTasks(ctx, apiClient, namespace)
+		if err != nil {
+			return fmt.Errorf("failed to get tasks: %w", err)
+		}
+
+		if len(tasks) == 0 {
+			return nil
+		}
+
+		allTerminal := true
+
+		for _, task := range tasks {
+			if !isTerminalState(task.Status.State) {
+				allTerminal = false
+
+				break
+			}
+		}
+
+		if allTerminal {
+			return nil
+		}
+
+		time.Sleep(time.Second)
+	}
+}
diff --git a/pkg/libstack/swarm/swarm_integration_test.go b/pkg/libstack/swarm/swarm_integration_test.go
new file mode 100644
index 0000000..a241707
--- /dev/null
+++ b/pkg/libstack/swarm/swarm_integration_test.go
@@ -0,0 +1,229 @@
+package swarm
+
+import (
+	"context"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/docker/docker/api/types/filters"
+	"github.com/docker/docker/api/types/swarm"
+	"github.com/docker/docker/client"
+	"github.com/portainer/portainer/api/filesystem"
+	"github.com/portainer/portainer/pkg/libstack"
+	"github.com/stretchr/testify/require"
+)
+
+// ensureSwarmMode ensures the Docker daemon is a swarm manager for the duration
+// of the test. If the daemon is inactive, it initialises a single-node swarm and
+// registers a cleanup to leave it afterwards. If the daemon is already a manager
+// it does nothing. If the daemon is a worker it fails the test immediately.
+func ensureSwarmMode(t *testing.T) *client.Client {
+	t.Helper()
+
+	apiClient, err := client.NewClientWithOpts(client.FromEnv, client.WithAPIVersionNegotiation())
+	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, apiClient.Close()) })
+
+	info, err := apiClient.Info(t.Context())
+	require.NoError(t, err)
+
+	switch info.Swarm.LocalNodeState {
+	case swarm.LocalNodeStateInactive:
+		_, err = apiClient.SwarmInit(t.Context(), swarm.InitRequest{
+			ListenAddr:    "0.0.0.0:2377",
+			AdvertiseAddr: "127.0.0.1",
+		})
+		require.NoError(t, err)
+		t.Cleanup(func() { require.NoError(t, apiClient.SwarmLeave(context.Background(), true)) })
+	case swarm.LocalNodeStateActive:
+		if !info.Swarm.ControlAvailable {
+			t.Fatal("docker daemon is a swarm worker, not a manager: cannot run swarm stack tests")
+		}
+		// already a manager - don't tear down, don't disrupt
+	default:
+		t.Fatalf("unexpected swarm node state: %s", info.Swarm.LocalNodeState)
+	}
+
+	return apiClient
+}
+
+// serviceExists reports whether a service named <stackName>_<serviceName> exists.
+func serviceExists(t *testing.T, apiClient client.APIClient, stackName, serviceName string) bool {
+	fullName := stackName + "_" + serviceName
+
+	services, err := apiClient.ServiceList(t.Context(), swarm.ServiceListOptions{
+		Filters: filters.NewArgs(filters.KeyValuePair{Key: "name", Value: fullName}),
+	})
+	require.NoError(t, err)
+
+	for _, svc := range services {
+		if svc.Spec.Name == fullName {
+			return true
+		}
+	}
+
+	return false
+}
+
+func createComposeFile(t *testing.T, dir, name, content string) string {
+	t.Helper()
+
+	path := filesystem.JoinPaths(dir, name)
+	require.NoError(t, os.WriteFile(path, []byte(content), 0o644))
+
+	return path
+}
+
+func TestSwarmValidate(t *testing.T) {
+	ensureIntegrationTest(t)
+
+	deployer := NewSwarmDeployer()
+	dir := t.TempDir()
+
+	testCases := []struct {
+		name          string
+		composeFile   string
+		expectedError string
+	}{
+		{
+			name: "valid compose file",
+			composeFile: `version: '3'
+services:
+  web:
+    image: nginx:latest`,
+			expectedError: "",
+		},
+		{
+			name:          "invalid YAML returns error",
+			composeFile:   "not valid yaml content",
+			expectedError: "failed to load compose file: top-level object must be a mapping",
+		},
+		{
+			name: "missing image returns error",
+			composeFile: `version: '3'
+services:
+  web:
+    command: echo hello`,
+			expectedError: "invalid image reference for service web: no image specified",
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			path := createComposeFile(t, dir, "docker-compose.yml", testCase.composeFile)
+			err := deployer.Validate(t.Context(), []string{path}, Options{})
+			var gotError string
+			if err != nil {
+				gotError = err.Error()
+			}
+
+			if gotError != "" && testCase.expectedError == "" {
+				t.Fatalf("expected no error but got: %v", err)
+			}
+			require.Contains(t, gotError, testCase.expectedError)
+		})
+	}
+}
+
+func TestSwarmDeployWithRemoveOrphans(t *testing.T) {
+	ensureIntegrationTest(t)
+
+	apiClient := ensureSwarmMode(t)
+
+	const projectName = "swarm_orphan_test"
+
+	const twoServiceContent = `version: '3'
+services:
+  service-1:
+    image: alpine:latest
+    command: ["sh", "-c", "while true; do sleep 3600; done"]
+  service-2:
+    image: alpine:latest
+    command: ["sh", "-c", "while true; do sleep 3600; done"]`
+
+	const oneServiceContent = `version: '3'
+services:
+  service-2:
+    image: alpine:latest
+    command: ["sh", "-c", "while true; do sleep 3600; done"]`
+
+	deployer := NewSwarmDeployer()
+	dir := t.TempDir()
+
+	twoServicePath := createComposeFile(t, dir, "two-services.yml", twoServiceContent)
+	oneServicePath := createComposeFile(t, dir, "one-service.yml", oneServiceContent)
+
+	err := deployer.Deploy(
+		t.Context(),
+		[]string{twoServicePath},
+		DeployOptions{Options: Options{ProjectName: projectName}},
+	)
+	require.NoError(t, err)
+
+	t.Cleanup(func() {
+		err := deployer.Remove(context.Background(), projectName, RemoveOptions{})
+		require.NoError(t, err)
+	})
+
+	ctx, cancel := context.WithTimeout(t.Context(), time.Minute)
+	t.Cleanup(func() { cancel() })
+
+	result := deployer.WaitForStatus(ctx, projectName, Options{}, libstack.StatusRunning)
+	require.Empty(t, result.ErrorMsg)
+	require.Equal(t, libstack.StatusRunning, result.Status)
+
+	require.True(t, serviceExists(t, apiClient, projectName, "service-1"))
+	require.True(t, serviceExists(t, apiClient, projectName, "service-2"))
+
+	err = deployer.Deploy(ctx, []string{oneServicePath}, DeployOptions{
+		Options:       Options{ProjectName: projectName},
+		RemoveOrphans: true,
+	})
+	require.NoError(t, err)
+
+	result = deployer.WaitForStatus(ctx, projectName, Options{}, libstack.StatusRunning)
+	require.Empty(t, result.ErrorMsg)
+	require.Equal(t, libstack.StatusRunning, result.Status)
+
+	require.False(t, serviceExists(t, apiClient, projectName, "service-1"))
+	require.True(t, serviceExists(t, apiClient, projectName, "service-2"))
+}
+
+func TestSwarmDeployWithEnvVars(t *testing.T) {
+	ensureIntegrationTest(t)
+	ensureSwarmMode(t)
+
+	const projectName = "swarm_envvar_test"
+
+	const composeContent = `version: '3'
+services:
+  web:
+    image: alpine:${TAG}
+    command: ["sh", "-c", "while true; do sleep 3600; done"]`
+
+	deployer := NewSwarmDeployer()
+	dir := t.TempDir()
+
+	path := createComposeFile(t, dir, "envvar.yml", composeContent)
+
+	err := deployer.Deploy(t.Context(), []string{path}, DeployOptions{
+		Options: Options{
+			ProjectName: projectName,
+			Env:         []string{"TAG=latest"},
+		},
+	})
+	require.NoError(t, err)
+
+	t.Cleanup(func() {
+		err := deployer.Remove(context.Background(), projectName, RemoveOptions{})
+		require.NoError(t, err)
+	})
+
+	ctx, cancel := context.WithTimeout(t.Context(), time.Minute)
+	t.Cleanup(func() { cancel() })
+
+	result := deployer.WaitForStatus(ctx, projectName, Options{}, libstack.StatusRunning)
+	require.Empty(t, result.ErrorMsg)
+	require.Equal(t, libstack.StatusRunning, result.Status)
+}
diff --git a/pkg/libstack/swarm/swarm_status_test.go b/pkg/libstack/swarm/swarm_status_test.go
new file mode 100644
index 0000000..0a6bdf2
--- /dev/null
+++ b/pkg/libstack/swarm/swarm_status_test.go
@@ -0,0 +1,112 @@
+package swarm
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/portainer/portainer/api/filesystem"
+	libstack "github.com/portainer/portainer/pkg/libstack"
+	"github.com/stretchr/testify/require"
+)
+
+func ensureIntegrationTest(t *testing.T) {
+	t.Helper()
+
+	if _, ok := os.LookupEnv("INTEGRATION_TEST"); !ok {
+		t.Skip("skip an integration test")
+	}
+}
+
+func TestSwarmProjectStatus(t *testing.T) {
+	ensureIntegrationTest(t)
+
+	testCases := []struct {
+		TestName              string
+		FileContent           string
+		ExpectedStatus        libstack.Status
+		ExpectedStatusMessage string
+	}{
+		{
+			TestName: "running",
+			FileContent: `version: '3'
+services:
+  web:
+    image: nginx:latest`,
+			ExpectedStatus: libstack.StatusRunning,
+		},
+		{
+			TestName: "failed",
+			FileContent: `version: '3'
+services:
+  failing:
+    image: alpine:latest
+    command: ["sh", "-c", "exit 1"]`,
+			ExpectedStatus:        libstack.StatusError,
+			ExpectedStatusMessage: "task: non-zero exit (1)",
+		},
+	}
+
+	ensureSwarmMode(t)
+
+	deployer := NewSwarmDeployer()
+	dir := t.TempDir()
+
+	for _, testCase := range testCases {
+		t.Run(testCase.TestName, func(t *testing.T) {
+			projectName := testCase.TestName
+
+			composeFileName := fmt.Sprintf("docker-compose-%s.yml", projectName)
+			composeFilePath := filesystem.JoinPaths(dir, composeFileName)
+
+			f, err := os.Create(composeFilePath)
+			require.NoError(t, err, "failed to create compose file")
+
+			_, err = f.WriteString(testCase.FileContent)
+			require.NoError(t, err, "failed to write compose file")
+
+			err = deployer.Deploy(
+				t.Context(),
+				[]string{composeFilePath},
+				DeployOptions{Options: Options{ProjectName: projectName}},
+			)
+			require.NoError(t, err, "failed to deploy stack")
+			t.Cleanup(func() {
+				err := deployer.Remove(context.Background(), projectName, RemoveOptions{})
+				require.NoError(t, err, "failed to remove stack")
+
+				result := waitForSwarmStatus(t, deployer, projectName, libstack.StatusRemoved)
+
+				require.Equal(
+					t,
+					libstack.StatusRemoved,
+					result.Status,
+					"expected stack to be removed, got %s (err: %s)",
+					result.Status,
+					result.ErrorMsg,
+				)
+			})
+
+			result := waitForSwarmStatus(t, deployer, projectName, testCase.ExpectedStatus)
+
+			require.Equal(t, testCase.ExpectedStatus, result.Status, "unexpected status. Error message: %v", result.ErrorMsg)
+			require.Equal(t, testCase.ExpectedStatusMessage, result.ErrorMsg)
+		})
+	}
+}
+
+func waitForSwarmStatus(
+	t *testing.T,
+	deployer *SwarmDeployer,
+	projectName string,
+	status libstack.Status,
+) libstack.WaitResult {
+	t.Helper()
+
+	ctx, cancel := context.WithTimeout(t.Context(), time.Minute)
+	defer cancel()
+
+	return deployer.WaitForStatus(ctx, projectName, Options{}, status)
+}
diff --git a/pkg/libstack/swarm/swarm_unit_test.go b/pkg/libstack/swarm/swarm_unit_test.go
new file mode 100644
index 0000000..326a61d
--- /dev/null
+++ b/pkg/libstack/swarm/swarm_unit_test.go
@@ -0,0 +1,699 @@
+package swarm
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"slices"
+	"testing"
+
+	"github.com/docker/cli/cli/compose/convert"
+	composetypes "github.com/docker/cli/cli/compose/types"
+	configtypes "github.com/docker/cli/cli/config/types"
+	"github.com/docker/docker/api/types/swarm"
+	"github.com/docker/docker/client"
+	dockerregistry "github.com/docker/docker/registry"
+	"github.com/portainer/portainer/api/filesystem"
+	"github.com/portainer/portainer/pkg/libstack"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_aggregateStatus(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name           string
+		statuses       []libstack.Status
+		expectedStatus libstack.Status
+	}{
+		{
+			name:           "empty returns removed",
+			statuses:       []libstack.Status{},
+			expectedStatus: libstack.StatusRemoved,
+		},
+		{
+			name:           "all running",
+			statuses:       []libstack.Status{libstack.StatusRunning, libstack.StatusRunning},
+			expectedStatus: libstack.StatusRunning,
+		},
+		{
+			name:           "all completed",
+			statuses:       []libstack.Status{libstack.StatusCompleted, libstack.StatusCompleted},
+			expectedStatus: libstack.StatusCompleted,
+		},
+		{
+			name:           "mix of running and completed",
+			statuses:       []libstack.Status{libstack.StatusRunning, libstack.StatusCompleted},
+			expectedStatus: libstack.StatusRunning,
+		},
+		{
+			name:           "error takes priority",
+			statuses:       []libstack.Status{libstack.StatusRunning, libstack.StatusError},
+			expectedStatus: libstack.StatusError,
+		},
+		{
+			name:           "starting takes priority over running",
+			statuses:       []libstack.Status{libstack.StatusRunning, libstack.StatusStarting},
+			expectedStatus: libstack.StatusStarting,
+		},
+		{
+			name:           "removing",
+			statuses:       []libstack.Status{libstack.StatusRemoving, libstack.StatusRunning},
+			expectedStatus: libstack.StatusRemoving,
+		},
+		{
+			name:           "all stopped",
+			statuses:       []libstack.Status{libstack.StatusStopped, libstack.StatusStopped},
+			expectedStatus: libstack.StatusStopped,
+		},
+		{
+			name:           "all removed",
+			statuses:       []libstack.Status{libstack.StatusRemoved, libstack.StatusRemoved},
+			expectedStatus: libstack.StatusRemoved,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			require.Equal(t, tt.expectedStatus, aggregateStatus(tt.statuses))
+		})
+	}
+}
+
+func Test_cliOptions(t *testing.T) {
+	t.Parallel()
+
+	registries := []configtypes.AuthConfig{
+		{ServerAddress: "registry.example.com", Username: "user", Password: "pass"},
+		{ServerAddress: dockerregistry.IndexServer, Username: "other"},
+	}
+
+	tests := []struct {
+		name       string
+		host       string
+		registries []configtypes.AuthConfig
+		expected   libstack.DockerCliOptions
+	}{
+		{
+			name:       "sets manager-operation header and passes through host and registries",
+			host:       "tcp://127.0.0.1:2377",
+			registries: registries,
+			expected: libstack.DockerCliOptions{
+				Host:       "tcp://127.0.0.1:2377",
+				Registries: registries,
+				Headers:    map[string]string{managerOperationHeader: "1"},
+			},
+		},
+		{
+			name: "empty host and nil registries still set the header",
+			expected: libstack.DockerCliOptions{
+				Headers: map[string]string{managerOperationHeader: "1"},
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			require.Equal(t, tt.expected, cliOptions(tt.host, tt.registries))
+		})
+	}
+}
+
+func Test_isTerminalState(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		state    swarm.TaskState
+		terminal bool
+	}{
+		{swarm.TaskStateNew, false},
+		{swarm.TaskStateAllocated, false},
+		{swarm.TaskStatePending, false},
+		{swarm.TaskStateAssigned, false},
+		{swarm.TaskStateAccepted, false},
+		{swarm.TaskStatePreparing, false},
+		{swarm.TaskStateReady, false},
+		{swarm.TaskStateStarting, false},
+		{swarm.TaskStateRunning, false},
+		{swarm.TaskStateComplete, true},
+		{swarm.TaskStateShutdown, true},
+		{swarm.TaskStateFailed, true},
+		{swarm.TaskStateRejected, true},
+	}
+
+	for _, tt := range tests {
+		t.Run(string(tt.state), func(t *testing.T) {
+			require.Equal(t, tt.terminal, isTerminalState(tt.state))
+		})
+	}
+}
+
+func Test_getServicesDeclaredNetworks(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name             string
+		services         []composetypes.ServiceConfig
+		expectedNetworks map[string]struct{}
+	}{
+		{
+			name: "service with no networks gets default",
+			services: []composetypes.ServiceConfig{
+				{Name: "web", Networks: nil},
+			},
+			expectedNetworks: map[string]struct{}{"default": {}},
+		},
+		{
+			name: "service with explicit network",
+			services: []composetypes.ServiceConfig{
+				{Name: "web", Networks: map[string]*composetypes.ServiceNetworkConfig{"mynet": nil}},
+			},
+			expectedNetworks: map[string]struct{}{"mynet": {}},
+		},
+		{
+			name: "mix: one with networks, one without",
+			services: []composetypes.ServiceConfig{
+				{Name: "web", Networks: map[string]*composetypes.ServiceNetworkConfig{"mynet": nil}},
+				{Name: "worker", Networks: nil},
+			},
+			expectedNetworks: map[string]struct{}{"mynet": {}, "default": {}},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := getServicesDeclaredNetworks(tt.services)
+			require.Equal(t, tt.expectedNetworks, got)
+		})
+	}
+}
+
+func Test_encodeRegistryAuth(t *testing.T) {
+	t.Parallel()
+
+	dockerIORegistry := configtypes.AuthConfig{
+		ServerAddress: dockerregistry.IndexServer,
+		Username:      "user",
+		Password:      "pass",
+	}
+
+	customRegistry := configtypes.AuthConfig{
+		ServerAddress: "registry.example.com",
+		Username:      "user",
+		Password:      "pass",
+	}
+
+	tests := []struct {
+		name         string
+		image        string
+		registries   []configtypes.AuthConfig
+		expectedErr  string
+		expectedAuth string
+	}{
+		{
+			name:         "docker.io image with matching credentials",
+			image:        "nginx:latest",
+			registries:   []configtypes.AuthConfig{dockerIORegistry},
+			expectedAuth: "eyJ1c2VybmFtZSI6InVzZXIiLCJwYXNzd29yZCI6InBhc3MiLCJzZXJ2ZXJhZGRyZXNzIjoiaHR0cHM6Ly9pbmRleC5kb2NrZXIuaW8vdjEvIn0=",
+		},
+		{
+			name:       "docker.io image with no matching credentials",
+			image:      "nginx:latest",
+			registries: []configtypes.AuthConfig{},
+		},
+		{
+			name:         "custom registry with matching credentials",
+			image:        "registry.example.com/myimage:latest",
+			registries:   []configtypes.AuthConfig{customRegistry},
+			expectedAuth: "eyJ1c2VybmFtZSI6InVzZXIiLCJwYXNzd29yZCI6InBhc3MiLCJzZXJ2ZXJhZGRyZXNzIjoicmVnaXN0cnkuZXhhbXBsZS5jb20ifQ==",
+		},
+		{
+			name:       "custom registry image with unrelated credentials",
+			image:      "registry.example.com/myimage:latest",
+			registries: []configtypes.AuthConfig{dockerIORegistry},
+		},
+		{
+			name:        "invalid image reference returns error",
+			image:       "@@invalid@@",
+			expectedErr: "failed to parse image reference \"@@invalid@@\": invalid reference format",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := encodeRegistryAuth(tt.image, tt.registries)
+			if err != nil {
+				if tt.expectedErr == "" {
+					t.Fatalf("expected no error but got: %v", err)
+				}
+				require.Contains(t, err.Error(), tt.expectedErr)
+			} else {
+				require.Equal(t, tt.expectedAuth, got)
+			}
+		})
+	}
+}
+
+func Test_getConfig(t *testing.T) {
+	dir := t.TempDir()
+
+	writeFile := func(name, content string) string {
+		path := filesystem.JoinPaths(dir, name)
+		require.NoError(t, os.MkdirAll(filepath.Dir(path), 0o755))
+		require.NoError(t, os.WriteFile(path, []byte(content), 0o644))
+		return path
+	}
+
+	getStrPointer := func(s string) *string { return &s }
+
+	tests := []struct {
+		name         string
+		composeFiles map[string]string
+		files        map[string]string
+		env          []string
+		osEnv        map[string]string
+		expectedCfg  *composetypes.Config
+		expectedErr  string
+	}{
+		{
+			name: "valid compose file",
+			composeFiles: map[string]string{
+				"valid.yml": `version: '3'
+services:
+  web:
+    image: nginx:latest`,
+			},
+			expectedCfg: &composetypes.Config{
+				Filename: dir + "/valid.yml",
+				Version:  "3.13",
+				Services: composetypes.Services{
+					composetypes.ServiceConfig{
+						Name:        "web",
+						Environment: composetypes.MappingWithEquals{},
+						Image:       "nginx:latest",
+					},
+				},
+				Networks: map[string]composetypes.NetworkConfig{},
+				Volumes:  map[string]composetypes.VolumeConfig{},
+				Secrets:  map[string]composetypes.SecretConfig{},
+				Configs:  map[string]composetypes.ConfigObjConfig{},
+			},
+		},
+		{
+			name: "invalid YAML returns error",
+			composeFiles: map[string]string{
+				"invalid.yml": `not: valid: yaml: content`,
+			},
+			expectedErr: "failed to load compose file: yaml: mapping values are not allowed in this context",
+		},
+		{
+			name:        "no file paths returns error",
+			expectedErr: "failed to load compose file: at least one compose file must be specified",
+		},
+		{
+			name: "service missing image returns error",
+			composeFiles: map[string]string{
+				"noimage.yml": `version: '3'
+services:
+  web:
+    command: echo hello`,
+			},
+			expectedErr: "invalid image reference for service web: no image specified",
+		},
+		{
+			name: "two compose files are merged",
+			composeFiles: map[string]string{
+				"base.yml": `version: '3'
+services:
+  web:
+    image: nginx:latest`,
+				"override.yml": `version: '3'
+services:
+  worker:
+    image: alpine:latest`,
+			},
+			expectedCfg: &composetypes.Config{
+				Filename: dir + "/base.yml",
+				Version:  "3.13",
+				Services: composetypes.Services{
+					composetypes.ServiceConfig{
+						Name:        "web",
+						Environment: composetypes.MappingWithEquals{},
+						Image:       "nginx:latest",
+					},
+					composetypes.ServiceConfig{
+						Name:        "worker",
+						Environment: composetypes.MappingWithEquals{},
+						Image:       "alpine:latest",
+					},
+				},
+				Networks: map[string]composetypes.NetworkConfig{},
+				Volumes:  map[string]composetypes.VolumeConfig{},
+				Secrets:  map[string]composetypes.SecretConfig{},
+				Configs:  map[string]composetypes.ConfigObjConfig{},
+			},
+		},
+		{
+			name: "env var in image resolved from options env",
+			composeFiles: map[string]string{
+				"envvar.yml": `version: '3'
+services:
+  web:
+    image: nginx:${TAG}`,
+			},
+			env: []string{"TAG=1.25"},
+			expectedCfg: &composetypes.Config{
+				Filename: dir + "/envvar.yml",
+				Version:  "3.13",
+				Services: composetypes.Services{
+					composetypes.ServiceConfig{
+						Name:        "web",
+						Environment: composetypes.MappingWithEquals{},
+						Image:       "nginx:1.25",
+					},
+				},
+				Networks: map[string]composetypes.NetworkConfig{},
+				Volumes:  map[string]composetypes.VolumeConfig{},
+				Secrets:  map[string]composetypes.SecretConfig{},
+				Configs:  map[string]composetypes.ConfigObjConfig{},
+			},
+		},
+		{
+			name: "PORTAINER_ prefixed env var from os.Environ is resolved",
+			composeFiles: map[string]string{
+				"portainerenv.yml": `version: '3'
+services:
+  web:
+    image: nginx:${PORTAINER_TAG}`,
+			},
+			osEnv: map[string]string{
+				libstack.PortainerEnvVarsPrefix + "TAG": "1.25",
+			},
+			expectedCfg: &composetypes.Config{
+				Filename: dir + "/portainerenv.yml",
+				Version:  "3.13",
+				Services: composetypes.Services{
+					composetypes.ServiceConfig{
+						Name:        "web",
+						Environment: composetypes.MappingWithEquals{},
+						Image:       "nginx:1.25",
+					},
+				},
+				Networks: map[string]composetypes.NetworkConfig{},
+				Volumes:  map[string]composetypes.VolumeConfig{},
+				Secrets:  map[string]composetypes.SecretConfig{},
+				Configs:  map[string]composetypes.ConfigObjConfig{},
+			},
+		},
+		{
+			name: "env_file with relative path is resolved against the compose file directory",
+			composeFiles: map[string]string{
+				"docker-compose.yaml": `services:
+  configtest:
+    image: nginx:latest
+    env_file:
+      - stack.env`,
+			},
+			files: map[string]string{
+				"stack.env": "A=junk",
+			},
+			expectedCfg: &composetypes.Config{
+				Filename: dir + "/docker-compose.yaml",
+				Version:  "3.13",
+				Services: composetypes.Services{
+					composetypes.ServiceConfig{
+						Name: "configtest",
+						Environment: composetypes.MappingWithEquals{
+							"A": getStrPointer("junk"),
+						},
+						Image:   "nginx:latest",
+						EnvFile: []string{dir + "/stack.env"},
+					},
+				},
+				Networks: map[string]composetypes.NetworkConfig{},
+				Volumes:  map[string]composetypes.VolumeConfig{},
+				Secrets:  map[string]composetypes.SecretConfig{},
+				Configs:  map[string]composetypes.ConfigObjConfig{},
+			},
+		},
+		{
+			name: "absolute path env_filed",
+			composeFiles: map[string]string{
+				"docker-compose.yaml": `services:
+  configtest:
+    image: nginx:latest
+    env_file:
+      - ` + dir + "/stack.env",
+			},
+			files: map[string]string{
+				"stack.env": "A=junk",
+			},
+			expectedCfg: &composetypes.Config{
+				Filename: dir + "/docker-compose.yaml",
+				Version:  "3.13",
+				Services: composetypes.Services{
+					composetypes.ServiceConfig{
+						Name: "configtest",
+						Environment: composetypes.MappingWithEquals{
+							"A": getStrPointer("junk"),
+						},
+						Image:   "nginx:latest",
+						EnvFile: []string{dir + "/stack.env"},
+					},
+				},
+				Networks: map[string]composetypes.NetworkConfig{},
+				Volumes:  map[string]composetypes.VolumeConfig{},
+				Secrets:  map[string]composetypes.SecretConfig{},
+				Configs:  map[string]composetypes.ConfigObjConfig{},
+			},
+		},
+		{
+			// Regression test for BE-13157: a Git stack whose compose file lives in a
+			// sub-directory must resolve a sibling env_file relative to that sub-directory,
+			// not the project root.
+			name: "env_file with relative path is resolved within the compose file sub-directory",
+			composeFiles: map[string]string{
+				"sub/docker-compose.yaml": `services:
+  configtest:
+    image: nginx:latest
+    env_file:
+      - stack.env`,
+			},
+			files: map[string]string{
+				"sub/stack.env": "A=junk",
+				"stack.env":     "A=not-this-one",
+			},
+			expectedCfg: &composetypes.Config{
+				Filename: dir + "/sub/docker-compose.yaml",
+				Version:  "3.13",
+				Services: composetypes.Services{
+					composetypes.ServiceConfig{
+						Name: "configtest",
+						Environment: composetypes.MappingWithEquals{
+							"A": getStrPointer("junk"),
+						},
+						Image:   "nginx:latest",
+						EnvFile: []string{dir + "/sub/stack.env"},
+					},
+				},
+				Networks: map[string]composetypes.NetworkConfig{},
+				Volumes:  map[string]composetypes.VolumeConfig{},
+				Secrets:  map[string]composetypes.SecretConfig{},
+				Configs:  map[string]composetypes.ConfigObjConfig{},
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			filePaths := make([]string, 0, len(tt.composeFiles))
+			for filename, content := range tt.composeFiles {
+				filePaths = append(filePaths, writeFile(filename, content))
+			}
+			slices.Sort(filePaths)
+
+			for filename, content := range tt.files {
+				writeFile(filename, content)
+			}
+
+			for k, v := range tt.osEnv {
+				t.Setenv(k, v)
+			}
+
+			cfg, err := getConfig(filePaths, tt.env)
+			if err != nil {
+				if tt.expectedErr == "" {
+					t.Fatalf("expected no error but got: %v", err)
+				}
+				require.Contains(t, err.Error(), tt.expectedErr)
+			} else {
+				require.Equal(t, tt.expectedCfg, cfg)
+			}
+		})
+	}
+}
+
+type mockAPIClient struct {
+	client.APIClient
+	serviceListFn   func(context.Context, swarm.ServiceListOptions) ([]swarm.Service, error)
+	taskListFn      func(context.Context, swarm.TaskListOptions) ([]swarm.Task, error)
+	serviceUpdateFn func(
+		context.Context,
+		string,
+		swarm.Version,
+		swarm.ServiceSpec,
+		swarm.ServiceUpdateOptions,
+	) (swarm.ServiceUpdateResponse, error)
+}
+
+func (m *mockAPIClient) ServiceList(ctx context.Context, opts swarm.ServiceListOptions) ([]swarm.Service, error) {
+	if m.serviceListFn == nil {
+		return nil, nil
+	}
+
+	return m.serviceListFn(ctx, opts)
+}
+
+func (m *mockAPIClient) TaskList(ctx context.Context, opts swarm.TaskListOptions) ([]swarm.Task, error) {
+	if m.taskListFn == nil {
+		return nil, nil
+	}
+
+	return m.taskListFn(ctx, opts)
+}
+
+func (m *mockAPIClient) ServiceUpdate(
+	ctx context.Context,
+	id string,
+	ver swarm.Version,
+	spec swarm.ServiceSpec,
+	opts swarm.ServiceUpdateOptions,
+) (swarm.ServiceUpdateResponse, error) {
+	if m.serviceUpdateFn == nil {
+		return swarm.ServiceUpdateResponse{}, nil
+	}
+
+	return m.serviceUpdateFn(ctx, id, ver, spec, opts)
+}
+
+func Test_deployServices_forceRecreate(t *testing.T) {
+	t.Parallel()
+
+	const initialForceUpdate = uint64(3)
+
+	tests := []struct {
+		name                string
+		forceRecreate       bool
+		expectedForceUpdate uint64
+	}{
+		{"true increments ForceUpdate", true, initialForceUpdate + 1},
+		{"false preserves ForceUpdate", false, initialForceUpdate},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			existingSvc := swarm.Service{
+				ID:   "svc-id-1",
+				Meta: swarm.Meta{Version: swarm.Version{Index: 10}},
+				Spec: swarm.ServiceSpec{
+					Annotations: swarm.Annotations{Name: "mystack_web"},
+					TaskTemplate: swarm.TaskSpec{
+						ForceUpdate:   initialForceUpdate,
+						ContainerSpec: &swarm.ContainerSpec{Image: "nginx:latest"},
+					},
+				},
+			}
+
+			var capturedForceUpdate uint64
+			mock := &mockAPIClient{
+				serviceListFn: func(_ context.Context, _ swarm.ServiceListOptions) ([]swarm.Service, error) {
+					return []swarm.Service{existingSvc}, nil
+				},
+				serviceUpdateFn: func(
+					_ context.Context,
+					_ string,
+					_ swarm.Version,
+					spec swarm.ServiceSpec,
+					_ swarm.ServiceUpdateOptions,
+				) (swarm.ServiceUpdateResponse, error) {
+					capturedForceUpdate = spec.TaskTemplate.ForceUpdate
+					return swarm.ServiceUpdateResponse{}, nil
+				},
+			}
+
+			services := map[string]swarm.ServiceSpec{
+				"web": {
+					TaskTemplate: swarm.TaskSpec{
+						ContainerSpec: &swarm.ContainerSpec{Image: "nginx:latest"},
+					},
+				},
+			}
+
+			namespace := convert.NewNamespace("mystack")
+			err := deployServices(context.Background(), mock, nil, services, namespace, false, tt.forceRecreate)
+			require.NoError(t, err)
+			require.Equal(t, tt.expectedForceUpdate, capturedForceUpdate)
+		})
+	}
+}
+
+func Test_getServiceStatus(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name           string
+		task           swarm.Task
+		expectedStatus libstack.Status
+		expectedErrMsg string
+	}{
+		{
+			name:           "running task reports running",
+			task:           swarm.Task{Status: swarm.TaskStatus{State: swarm.TaskStateRunning}},
+			expectedStatus: libstack.StatusRunning,
+		},
+		{
+			name:           "pending task reports starting",
+			task:           swarm.Task{Status: swarm.TaskStatus{State: swarm.TaskStatePending}},
+			expectedStatus: libstack.StatusStarting,
+		},
+		{
+			name:           "failed task reports error with message",
+			task:           swarm.Task{Status: swarm.TaskStatus{State: swarm.TaskStateFailed, Err: "task: non-zero exit (1)"}},
+			expectedStatus: libstack.StatusError,
+			expectedErrMsg: "task: non-zero exit (1)",
+		},
+		{
+			// Regression case for #13213: a rejected task must report an error, not "unknown".
+			name: "rejected task reports error with message",
+			task: swarm.Task{Status: swarm.TaskStatus{
+				State: swarm.TaskStateRejected,
+				Err:   "No such image: this-image-definitely-does-not-exist-xyz:latest",
+			}},
+			expectedStatus: libstack.StatusError,
+			expectedErrMsg: "No such image: this-image-definitely-does-not-exist-xyz:latest",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			mock := &mockAPIClient{
+				taskListFn: func(context.Context, swarm.TaskListOptions) ([]swarm.Task, error) {
+					return []swarm.Task{tt.task}, nil
+				},
+			}
+
+			svc := swarm.Service{ID: "svc-id-1", Spec: swarm.ServiceSpec{Annotations: swarm.Annotations{Name: "mystack_web"}}}
+
+			status, errMsg, err := getServiceStatus(context.Background(), mock, svc)
+			require.NoError(t, err)
+			require.Equal(t, tt.expectedStatus, status)
+			require.Equal(t, tt.expectedErrMsg, errMsg)
+		})
+	}
+}
diff --git a/pkg/metrics/types.go b/pkg/metrics/types.go
new file mode 100644
index 0000000..7472202
--- /dev/null
+++ b/pkg/metrics/types.go
@@ -0,0 +1,112 @@
+package metrics
+
+const (
+	// AlertRuleIDLabel is the Prometheus label key used to correlate alerts
+	// with their Portainer alert rule ID across agent and server packages.
+	AlertRuleIDLabel = "alert_rule_id"
+	// AlertTierLabel marks generated evaluator rules that belong to a parent tiered rule.
+	AlertTierLabel = "portainer_alert_tier"
+
+	ClusterCPUUsageCoresMetric                        = "portainer_edge_agent_cluster_cpu_usage_cores"
+	ClusterCPUCapacityCoresMetric                     = "portainer_edge_agent_cluster_cpu_capacity_cores"
+	ClusterMemoryWorkingSetBytesMetric                = "portainer_edge_agent_cluster_memory_working_set_bytes"
+	ClusterMemoryCapacityBytesMetric                  = "portainer_edge_agent_cluster_memory_capacity_bytes"
+	ClusterFilesystemUsedBytesMetric                  = "portainer_edge_agent_cluster_filesystem_used_bytes"
+	ClusterFilesystemCapacityBytesMetric              = "portainer_edge_agent_cluster_filesystem_capacity_bytes"
+	ClusterNetworkReceiveBytesMetric                  = "portainer_edge_agent_cluster_network_receive_bytes_total"
+	ClusterNetworkTransmitBytesMetric                 = "portainer_edge_agent_cluster_network_transmit_bytes_total"
+	ClusterNodeReadyMetric                            = "portainer_edge_agent_node_ready"
+	ClusterNodeUnschedulableMetric                    = "portainer_edge_agent_node_unschedulable"
+	ClusterEtcdHealthyMetric                          = "portainer_edge_agent_etcd_healthy"
+	ClusterEtcdHealthValidMetric                      = "portainer_edge_agent_etcd_health_valid"
+	ClusterAPIServerTLSCertExpirySecondsMetric        = "portainer_edge_agent_apiserver_tls_cert_expiry_seconds"
+	ClusterAPIServerRequestLatencySecondsBucketMetric = "portainer_edge_agent_apiserver_request_latency_seconds_bucket"
+	ClusterAPIServerRequestLatencySecondsCountMetric  = "portainer_edge_agent_apiserver_request_latency_seconds_count"
+	ClusterAPIServerHealthyMetric                     = "portainer_edge_agent_apiserver_healthy"
+)
+
+// EdgeAlertBatch is the generic envelope pushed by edge agents.
+type EdgeAlertBatch struct {
+	EnvironmentName string       `json:"environment_name"`
+	Timestamp       int64        `json:"timestamp,omitempty"` // unix nanoseconds
+	FiredAlerts     []FiredAlert `json:"fired_alerts,omitempty"`
+	RawSignals      *RawSignals  `json:"raw_signals,omitempty"`
+}
+
+// FiredAlert represents a rule the agent has already evaluated and determined should fire.
+type FiredAlert struct {
+	RuleID   int    `json:"rule_id"`
+	Severity string `json:"severity"`
+	Message  string `json:"message"`
+}
+
+// RawSignals carries raw K8s cluster health data for future server-side evaluation.
+type RawSignals struct {
+	Workloads  []WorkloadItem  `json:"workloads,omitempty"`
+	Conditions []ConditionItem `json:"conditions,omitempty"`
+}
+
+// ResourceRef identifies a Kubernetes resource.
+type ResourceRef struct {
+	Kind      string `json:"kind"`
+	Name      string `json:"name"`
+	Namespace string `json:"namespace"`
+}
+
+// ConditionItem holds a single Kubernetes condition observation.
+type ConditionItem struct {
+	Ref      ResourceRef `json:"ref"`
+	Type     string      `json:"type"`
+	Status   int8        `json:"status"` // -1 unknown, 0 unhealthy, 1 healthy
+	Reason   string      `json:"reason"`
+	NodeName string      `json:"node_name,omitempty"`
+	PodName  string      `json:"pod_name,omitempty"`
+}
+
+// WorkloadItem holds a single Kubernetes workload replica observation.
+type WorkloadItem struct {
+	Ref       ResourceRef `json:"ref"`
+	Desired   int         `json:"desired"`
+	Available int         `json:"available"`
+}
+
+type AlertRuleStateType string
+
+const (
+	AlertRuleStateOK      AlertRuleStateType = "ok"
+	AlertRuleStatePending AlertRuleStateType = "pending"
+	AlertRuleStateFiring  AlertRuleStateType = "firing"
+)
+
+// EdgeAlertRuleState represents the evaluation state of a single alert rule on an edge agent.
+type EdgeAlertRuleState struct {
+	RuleID         int                `json:"rule_id"`
+	State          AlertRuleStateType `json:"state"`
+	LastEvaluation int64              `json:"last_evaluation,omitempty"` // unix milliseconds
+	LastError      string             `json:"last_error,omitempty"`
+}
+
+// EdgeAlertState is the aggregate alert evaluation state reported by an edge agent.
+type EdgeAlertState struct {
+	Rules             []EdgeAlertRuleState `json:"rules"`
+	ConfigReloadError string               `json:"config_reload_error,omitempty"`
+}
+
+// EdgeAlertRule is the agent-side representation of a compiled alert rule.
+// The server generates and stores the PromQL expression at rule-write time;
+// the agent is a pure evaluator with no rule-type logic.
+//
+// Fields like MetricType, Threshold, ConditionOperator, and Duration live
+// on the server-side AlertingRule only (used by the alertexpr compiler to
+// build PromQL). The agent receives the pre-compiled PromqlExpr together
+// with rule metadata used for evaluation and reporting, including annotations.
+type EdgeAlertRule struct {
+	ID                 int               `json:"id"`
+	Name               string            `json:"name"`
+	Enabled            bool              `json:"enabled"`
+	Severity           string            `json:"severity"`
+	PromqlExpr         string            `json:"promql_expr"`
+	ForDurationMinutes int               `json:"for_duration_minutes,omitempty"`
+	Labels             map[string]string `json:"labels,omitempty"`
+	Annotations        map[string]string `json:"annotations,omitempty"`
+}
diff --git a/pkg/networking/diagnostics.go b/pkg/networking/diagnostics.go
new file mode 100644
index 0000000..da1be7f
--- /dev/null
+++ b/pkg/networking/diagnostics.go
@@ -0,0 +1,140 @@
+package networking
+
+import (
+	"fmt"
+	"net"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/portainer/portainer/api/crypto"
+	"github.com/portainer/portainer/api/logs"
+	"github.com/portainer/portainer/pkg/libhttp/ssrf"
+	"github.com/rs/zerolog/log"
+
+	"github.com/segmentio/encoding/json"
+)
+
+// ProbeDNSConnection probes a DNS connection and returns a JSON string with the DNS lookup status and IP addresses.
+// ignores errors for the dns lookup since we want to know if the host is reachable
+func ProbeDNSConnection(url string) string {
+	_, host, _ := parseURL(url)
+	result := map[string]any{
+		"operation":      "dns lookup",
+		"remote_address": host,
+		"connected_at":   time.Now().Format(time.RFC3339),
+		"status":         "dns lookup successful",
+		"resolved_ips":   []net.IP{},
+	}
+
+	ipAddresses, err := net.LookupIP(host)
+	if err != nil {
+		result["status"] = fmt.Sprintf("dns lookup failed: %s", err)
+	} else {
+		result["resolved_ips"] = ipAddresses
+	}
+
+	jsonData, _ := json.Marshal(result)
+	return string(jsonData)
+}
+
+// ProbeTelnetConnection probes a telnet connection and returns a JSON string with the telnet connection status, local and remote addresses.
+// ignores errors for the telnet connection since we want to know if the host is reachable
+func ProbeTelnetConnection(url string) string {
+	network, host, port := parseURL(url)
+	if network == "https" || network == "http" {
+		network = "tcp"
+	}
+
+	address := net.JoinHostPort(host, port)
+	result := map[string]string{
+		"operation":      "telnet connection",
+		"local_address":  "unknown",
+		"remote_address": "unknown",
+		"network":        network,
+		"status":         "connected to " + address,
+		"connected_at":   time.Now().Format(time.RFC3339),
+	}
+
+	connection, err := net.DialTimeout(network, address, 5*time.Second)
+	if err != nil {
+		result["status"] = fmt.Sprintf("failed to connect to %s: %s", address, err)
+	} else {
+		defer logs.CloseAndLogErr(connection)
+		result["local_address"] = connection.LocalAddr().String()
+		result["remote_address"] = connection.RemoteAddr().String()
+	}
+
+	jsonData, _ := json.Marshal(result)
+	return string(jsonData)
+}
+
+// DetectProxy probes a target URL and returns a JSON string with the proxy detection status, local and remote addresses.
+// ignores errors for the http request since we want to know if the host is reachable
+func DetectProxy(url string) string {
+	client := &http.Client{
+		Transport: ssrf.NewTransport(crypto.CreateTLSConfiguration(true)),
+		Timeout:   10 * time.Second,
+	}
+
+	result := map[string]string{
+		"operation":      "proxy detection",
+		"local_address":  "unknown",
+		"remote_address": "unknown",
+		"network":        "https",
+		"status":         "no proxy detected",
+		"connected_at":   time.Now().Format(time.RFC3339),
+	}
+
+	resp, err := client.Get(url)
+	if err != nil {
+		result["status"] = fmt.Sprintf("failed to make request: %s", err)
+	} else {
+		defer func() {
+			if err := resp.Body.Close(); err != nil {
+				log.Warn().Err(err).Msg("failed to close response body")
+			}
+		}()
+
+		if resp.Request != nil {
+			result["local_address"] = resp.Request.Host
+			result["remote_address"] = resp.Request.RemoteAddr
+		}
+
+		if resp.Header.Get("Via") != "" || resp.Header.Get("X-Forwarded-For") != "" || resp.Header.Get("Proxy-Connection") != "" {
+			result["status"] = "proxy detected via headers"
+		} else if resp.TLS != nil && len(resp.TLS.PeerCertificates) > 0 {
+			cert := resp.TLS.PeerCertificates[0]
+			if cert.IsCA || strings.Contains(strings.ToLower(cert.Issuer.CommonName), "proxy") {
+				result["status"] = "proxy detected via certificate"
+			}
+		}
+	}
+
+	jsonData, _ := json.Marshal(result)
+	return string(jsonData)
+}
+
+// parseURL parses a raw URL and returns the network, host and port
+// it also ensures the network is tcp and the port is set to the default for the network
+func parseURL(rawURL string) (network, host, port string) {
+	u, err := url.Parse(rawURL)
+	if err != nil {
+		return "", "", ""
+	}
+
+	network = u.Scheme
+	host = u.Hostname()
+	port = u.Port()
+
+	if port == "" {
+		if network == "https" {
+			port = "443"
+		} else if network == "http" {
+			port = "80"
+		}
+	}
+
+	return network, host, port
+}
diff --git a/pkg/networking/diagnostics_test.go b/pkg/networking/diagnostics_test.go
new file mode 100644
index 0000000..fe8bb26
--- /dev/null
+++ b/pkg/networking/diagnostics_test.go
@@ -0,0 +1,171 @@
+package networking
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/portainer/portainer/pkg/fips"
+)
+
+// Response structs for each function
+type dnsResponse struct {
+	Operation   string   `json:"operation"`
+	ResolvedIPs []string `json:"resolved_ips"`
+	RemoteAddr  string   `json:"remote_address"`
+	ConnectedAt string   `json:"connected_at"`
+	Status      string   `json:"status"`
+}
+
+type telnetResponse struct {
+	Operation   string `json:"operation"`
+	LocalAddr   string `json:"local_address"`
+	RemoteAddr  string `json:"remote_address"`
+	Network     string `json:"network"`
+	Status      string `json:"status"`
+	ConnectedAt string `json:"connected_at"`
+}
+
+type proxyResponse struct {
+	Operation   string `json:"operation"`
+	LocalAddr   string `json:"local_address"`
+	RemoteAddr  string `json:"remote_address"`
+	Network     string `json:"network"`
+	Status      string `json:"status"`
+	ConnectedAt string `json:"connected_at"`
+}
+
+func TestProbeDNSConnection(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name           string
+		host           string
+		wantSuccess    bool
+		statusContains string
+	}{
+		{
+			name:           "Valid domain",
+			host:           "https://api.portainer.io",
+			wantSuccess:    true,
+			statusContains: "dns lookup successful",
+		},
+		{
+			name:           "Invalid domain",
+			host:           "https://nonexistent.domain.invalid",
+			wantSuccess:    false,
+			statusContains: "dns lookup failed",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			response := ProbeDNSConnection(tt.host)
+
+			var result dnsResponse
+			if err := json.Unmarshal([]byte(response), &result); err != nil {
+				t.Fatalf("Invalid JSON response: %v", err)
+			}
+
+			if !strings.Contains(result.Status, tt.statusContains) {
+				t.Errorf("Status should contain '%s', got: %s", tt.statusContains, result.Status)
+			}
+		})
+	}
+}
+
+func TestProbeTelnetConnection(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name           string
+		url            string
+		wantSuccess    bool
+		statusContains string
+	}{
+		{
+			name:           "Valid connection",
+			url:            "https://api.portainer.io",
+			wantSuccess:    true,
+			statusContains: "connected to",
+		},
+		{
+			name:           "Invalid port",
+			url:            "https://api.portainer.io:99999",
+			wantSuccess:    false,
+			statusContains: "failed to connect",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			response := ProbeTelnetConnection(tt.url)
+
+			var result telnetResponse
+			if err := json.Unmarshal([]byte(response), &result); err != nil {
+				t.Fatalf("Invalid JSON response: %v", err)
+			}
+
+			validateCommonFields(t, result.Operation, "telnet connection", result.ConnectedAt)
+			if !strings.Contains(result.Status, tt.statusContains) {
+				t.Errorf("Status should contain '%s', got: %s", tt.statusContains, result.Status)
+			}
+		})
+	}
+}
+
+func TestDetectProxy(t *testing.T) {
+	t.Parallel()
+	fips.InitFIPS(false)
+
+	tests := []struct {
+		name           string
+		url            string
+		wantSuccess    bool
+		statusContains string
+	}{
+		{
+			name:           "Valid URL",
+			url:            "https://api.portainer.io",
+			wantSuccess:    true,
+			statusContains: "proxy",
+		},
+		{
+			name:           "Invalid URL",
+			url:            "https://nonexistent.domain.invalid",
+			wantSuccess:    false,
+			statusContains: "failed to make request",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			response := DetectProxy(tt.url)
+
+			var result proxyResponse
+			if err := json.Unmarshal([]byte(response), &result); err != nil {
+				t.Fatalf("Invalid JSON response: %v", err)
+			}
+
+			validateCommonFields(t, result.Operation, "proxy detection", result.ConnectedAt)
+			if result.Network != "https" {
+				t.Errorf("Expected network https, got %s", result.Network)
+			}
+			if !strings.Contains(result.Status, tt.statusContains) {
+				t.Errorf("Status should contain '%s', got: %s", tt.statusContains, result.Status)
+			}
+		})
+	}
+}
+
+// Helper function to validate common fields across all responses
+func validateCommonFields(t *testing.T, operation, expectedOperation, connectedAt string) {
+	t.Helper()
+
+	if operation != expectedOperation {
+		t.Errorf("Expected operation '%s', got '%s'", expectedOperation, operation)
+	}
+
+	if _, err := time.Parse(time.RFC3339, connectedAt); err != nil {
+		t.Errorf("Invalid connected_at timestamp: %v", err)
+	}
+}
diff --git a/pkg/registryhttp/client.go b/pkg/registryhttp/client.go
new file mode 100644
index 0000000..0c13710
--- /dev/null
+++ b/pkg/registryhttp/client.go
@@ -0,0 +1,36 @@
+package registryhttp
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/pkg/libhttp/ssrf"
+
+	"github.com/rs/zerolog/log"
+	"oras.land/oras-go/v2/registry/remote/retry"
+)
+
+// CreateClient creates an HTTP client with appropriate TLS configuration based on registry type.
+// All registries use retry clients for better resilience.
+// Returns the HTTP client, whether to use plainHTTP, and any error.
+func CreateClient(registry *portainer.Registry) (httpClient *http.Client, usePlainHttp bool, err error) {
+	switch registry.Type {
+	case portainer.AzureRegistry, portainer.EcrRegistry, portainer.GithubRegistry, portainer.GitlabRegistry, portainer.DockerHubRegistry:
+		return &http.Client{Transport: retry.NewTransport(ssrf.NewTransport(nil))}, false, nil
+	default:
+		// For all other registry types, use shared helper to build transport and scheme
+
+		tlsCfg := portainer.TLSConfiguration{}
+		if registry.ManagementConfiguration != nil {
+			tlsCfg = registry.ManagementConfiguration.TLSConfig
+		}
+
+		transport, scheme, err := BuildTransportAndSchemeFromTLSConfig(tlsCfg)
+		if err != nil {
+			log.Error().Err(err).Msg("Failed to create TLS configuration")
+			return nil, false, err
+		}
+
+		return &http.Client{Transport: retry.NewTransport(transport)}, scheme == "http", nil
+	}
+}
diff --git a/pkg/registryhttp/client_test.go b/pkg/registryhttp/client_test.go
new file mode 100644
index 0000000..abe7806
--- /dev/null
+++ b/pkg/registryhttp/client_test.go
@@ -0,0 +1,244 @@
+package registryhttp
+
+import (
+	"net/http"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/pkg/fips"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"oras.land/oras-go/v2/registry/remote/retry"
+)
+
+func isRetryTransport(t *http.Client) bool {
+	_, ok := t.Transport.(*retry.Transport)
+	return ok
+}
+
+func init() {
+	fips.InitFIPS(false)
+}
+
+func TestCreateClient(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name                 string
+		registry             *portainer.Registry
+		expectedUsePlainHTTP bool
+		expectError          bool
+	}{
+		{
+			name: "Azure Registry should use default client with HTTPS",
+			registry: &portainer.Registry{
+				Type: portainer.AzureRegistry,
+				URL:  "myregistry.azurecr.io",
+			},
+			expectedUsePlainHTTP: false,
+			expectError:          false,
+		},
+		{
+			name: "ECR Registry should use default client with HTTPS",
+			registry: &portainer.Registry{
+				Type: portainer.EcrRegistry,
+				URL:  "123456789012.dkr.ecr.us-east-1.amazonaws.com",
+			},
+			expectedUsePlainHTTP: false,
+			expectError:          false,
+		},
+		{
+			name: "GitHub Registry should use default client with HTTPS",
+			registry: &portainer.Registry{
+				Type: portainer.GithubRegistry,
+				URL:  "ghcr.io",
+			},
+			expectedUsePlainHTTP: false,
+			expectError:          false,
+		},
+		{
+			name: "GitLab Registry should use default client with HTTPS",
+			registry: &portainer.Registry{
+				Type: portainer.GitlabRegistry,
+				URL:  "registry.gitlab.com",
+			},
+			expectedUsePlainHTTP: false,
+			expectError:          false,
+		},
+		{
+			name: "Custom registry without TLS should use plain HTTP",
+			registry: &portainer.Registry{
+				Type: portainer.CustomRegistry,
+				URL:  "my-custom-registry.local",
+			},
+			expectedUsePlainHTTP: true,
+			expectError:          false,
+		},
+		{
+			name: "Custom registry with TLS enabled should use HTTPS",
+			registry: &portainer.Registry{
+				Type: portainer.CustomRegistry,
+				URL:  "my-custom-registry.local",
+				ManagementConfiguration: &portainer.RegistryManagementConfiguration{
+					TLSConfig: portainer.TLSConfiguration{
+						TLS:           true,
+						TLSSkipVerify: true, // Skip verify to avoid cert file requirements in test
+					},
+				},
+			},
+			expectedUsePlainHTTP: false,
+			expectError:          false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			client, usePlainHTTP, err := CreateClient(tt.registry)
+
+			if tt.expectError {
+				require.Error(t, err)
+				assert.Nil(t, client)
+				return
+			}
+
+			require.NoError(t, err)
+			assert.NotNil(t, client)
+			assert.Equal(t, tt.expectedUsePlainHTTP, usePlainHTTP)
+
+			// Verify client type based on registry configuration
+			switch tt.registry.Type {
+			case portainer.AzureRegistry, portainer.EcrRegistry, portainer.GithubRegistry, portainer.GitlabRegistry:
+				assert.True(t, isRetryTransport(client), "Cloud registries should use a retry transport")
+			}
+		})
+	}
+}
+
+func TestCreateClient_CloudRegistries(t *testing.T) {
+	t.Parallel()
+	cloudRegistryTypes := []struct {
+		name         string
+		registryType portainer.RegistryType
+	}{
+		{"AzureRegistry", portainer.AzureRegistry},
+		{"EcrRegistry", portainer.EcrRegistry},
+		{"GithubRegistry", portainer.GithubRegistry},
+		{"GitlabRegistry", portainer.GitlabRegistry},
+	}
+
+	for _, tt := range cloudRegistryTypes {
+		t.Run(tt.name, func(t *testing.T) {
+			registry := &portainer.Registry{
+				Type: tt.registryType,
+				URL:  "example.registry.com",
+			}
+
+			client, usePlainHTTP, err := CreateClient(registry)
+
+			require.NoError(t, err)
+			assert.NotNil(t, client)
+			assert.False(t, usePlainHTTP, "Cloud registries should use HTTPS")
+			assert.True(t, isRetryTransport(client), "Cloud registries should use a retry transport")
+		})
+	}
+}
+
+func TestCreateClient_CustomTLSConfiguration(t *testing.T) {
+	t.Parallel()
+	t.Run("TLS enabled with skip verify", func(t *testing.T) {
+		registry := &portainer.Registry{
+			Type: portainer.CustomRegistry,
+			URL:  "my-registry.local",
+			ManagementConfiguration: &portainer.RegistryManagementConfiguration{
+				TLSConfig: portainer.TLSConfiguration{
+					TLS:           true,
+					TLSSkipVerify: true,
+				},
+			},
+		}
+
+		client, usePlainHTTP, err := CreateClient(registry)
+
+		require.NoError(t, err)
+		assert.NotNil(t, client)
+		assert.False(t, usePlainHTTP, "TLS enabled registries should use HTTPS")
+		assert.NotEqual(t, retry.DefaultClient, client, "Custom TLS should create new client")
+		assert.IsType(t, &http.Client{}, client)
+	})
+
+	t.Run("TLS disabled should use plain HTTP", func(t *testing.T) {
+		registry := &portainer.Registry{
+			Type: portainer.CustomRegistry,
+			URL:  "my-registry.local",
+			ManagementConfiguration: &portainer.RegistryManagementConfiguration{
+				TLSConfig: portainer.TLSConfiguration{
+					TLS: false,
+				},
+			},
+		}
+
+		client, usePlainHTTP, err := CreateClient(registry)
+
+		require.NoError(t, err)
+		assert.NotNil(t, client)
+		assert.True(t, usePlainHTTP, "TLS disabled should use plain HTTP")
+	})
+
+	t.Run("No management configuration should use plain HTTP", func(t *testing.T) {
+		registry := &portainer.Registry{
+			Type:                    portainer.CustomRegistry,
+			URL:                     "my-registry.local",
+			ManagementConfiguration: nil,
+		}
+
+		client, usePlainHTTP, err := CreateClient(registry)
+
+		require.NoError(t, err)
+		assert.NotNil(t, client)
+		assert.True(t, usePlainHTTP, "No management config should use plain HTTP")
+	})
+}
+
+func TestCreateClient_TLSWithTrustedCerts_UsesDefaultClientHTTPS(t *testing.T) {
+	t.Parallel()
+	registry := &portainer.Registry{
+		Type: portainer.CustomRegistry,
+		URL:  "my-registry.local",
+		ManagementConfiguration: &portainer.RegistryManagementConfiguration{
+			TLSConfig: portainer.TLSConfiguration{
+				TLS:           true,
+				TLSSkipVerify: false,
+				TLSCACertPath: "",
+				TLSCertPath:   "",
+				TLSKeyPath:    "",
+			},
+		},
+	}
+
+	_, usePlainHTTP, err := CreateClient(registry)
+
+	require.NoError(t, err)
+	assert.False(t, usePlainHTTP, "Trusted TLS should use HTTPS")
+}
+
+func TestCreateClient_CustomTLS_WithCertPathsMissing_ReturnsError(t *testing.T) {
+	t.Parallel()
+	registry := &portainer.Registry{
+		Type: portainer.CustomRegistry,
+		URL:  "my-registry.local",
+		ManagementConfiguration: &portainer.RegistryManagementConfiguration{
+			TLSConfig: portainer.TLSConfiguration{
+				TLS:           true,
+				TLSSkipVerify: false,
+				TLSCACertPath: "/not/found/ca.pem",
+				TLSCertPath:   "/not/found/cert.pem",
+				TLSKeyPath:    "/not/found/key.pem",
+			},
+		},
+	}
+
+	client, usePlainHTTP, err := CreateClient(registry)
+
+	require.Error(t, err)
+	assert.Nil(t, client)
+	assert.False(t, usePlainHTTP)
+}
diff --git a/pkg/registryhttp/transport.go b/pkg/registryhttp/transport.go
new file mode 100644
index 0000000..8ce68e4
--- /dev/null
+++ b/pkg/registryhttp/transport.go
@@ -0,0 +1,32 @@
+package registryhttp
+
+import (
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/crypto"
+	"github.com/portainer/portainer/pkg/fips"
+	"github.com/portainer/portainer/pkg/libhttp/ssrf"
+)
+
+// BuildTransportAndSchemeFromTLSConfig returns an SSRF-protected HTTP transport and the
+// scheme ("http" or "https") to use when contacting the registry. The transport is based on
+// the TLS settings from tlsCfg; pass a zero-value TLSConfiguration for plaintext.
+func BuildTransportAndSchemeFromTLSConfig(tlsCfg portainer.TLSConfiguration) (*http.Transport, string, error) {
+	tlsConfig, err := crypto.CreateTLSConfigurationFromDisk(tlsCfg)
+	if err != nil {
+		return nil, "", err
+	}
+
+	if tlsConfig == nil && fips.FIPSMode() {
+		return nil, "", fips.ErrTLSRequired
+	}
+
+	transport := ssrf.NewTransport(tlsConfig)
+
+	if tlsConfig == nil {
+		return transport, "http", nil
+	}
+
+	return transport, "https", nil
+}
diff --git a/pkg/retry/retry.go b/pkg/retry/retry.go
new file mode 100644
index 0000000..1c1fdba
--- /dev/null
+++ b/pkg/retry/retry.go
@@ -0,0 +1,80 @@
+package retry
+
+import (
+	"math/rand/v2"
+	"time"
+
+	"github.com/rs/zerolog/log"
+)
+
+type Settings struct {
+	MaxRetries    int
+	RetryTimeFunc func(failures int) time.Duration
+}
+
+var Default = Settings{
+	MaxRetries:    3,
+	RetryTimeFunc: RetryTime,
+}
+
+// RetryWithWarnings executes a function with retries and backoff, logging warnings on failures
+func RetryWithWarnings[T any](operation string, settings Settings, fn func() (T, error)) (T, error) {
+	timeStart := time.Now()
+
+	var result T
+	var err error
+
+	for attempt := 1; attempt <= settings.MaxRetries; attempt++ {
+		result, err = fn()
+		if err == nil {
+			if attempt > 1 {
+				log.Info().
+					Str("operation", operation).
+					Int("attempt", attempt).
+					Str("duration", time.Since(timeStart).String()).
+					Msg("operation succeeded after retry")
+			}
+			return result, nil
+		}
+
+		if attempt < settings.MaxRetries {
+			retryDelay := settings.RetryTimeFunc(attempt)
+			log.Warn().
+				Err(err).
+				Str("operation", operation).
+				Int("attempt", attempt).
+				Int("max_retries", settings.MaxRetries).
+				Str("retry_delay", retryDelay.String()). // the string version of the duration reads better in logs
+				Str("duration", time.Since(timeStart).String()).
+				Msg("operation failed, retrying")
+			time.Sleep(retryDelay)
+		}
+	}
+
+	log.Error().
+		Err(err).
+		Str("operation", operation).
+		Int("attempts", settings.MaxRetries).
+		Str("duration", time.Since(timeStart).String()).
+		Msg("operation failed after all retries")
+
+	return result, err
+}
+
+func RetryTime(failures int) time.Duration {
+	var baseTime time.Duration
+
+	switch failures {
+	case 0, 1:
+		baseTime = 5 * time.Second
+	case 2:
+		baseTime = 30 * time.Second
+	default:
+		baseTime = 90 * time.Second
+	}
+
+	// plus random jitter
+	jitter := time.Duration(rand.Int64N(int64(10 * time.Second))) // 10s as nanoseconds overflows int on 32bit systems
+
+	return baseTime + jitter
+}
diff --git a/pkg/retry/retry_test.go b/pkg/retry/retry_test.go
new file mode 100644
index 0000000..fe55989
--- /dev/null
+++ b/pkg/retry/retry_test.go
@@ -0,0 +1,90 @@
+package retry
+
+import (
+	"errors"
+	"fmt"
+	"math"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestRetryTime(t *testing.T) {
+	t.Parallel()
+	cases := []struct {
+		failures int
+		secGte   int
+		secLte   int
+	}{
+		{0, 5, 15},
+		{1, 5, 15},
+		{2, 30, 40},
+		{3, 90, 100},
+		{4, 90, 100},
+		{5, 90, 100},
+	}
+	for _, tt := range cases {
+		t.Run(fmt.Sprintf("failures=%d", tt.failures), func(t *testing.T) {
+			previous := time.Duration(math.MaxInt64)
+
+			for range 5 {
+				sec := RetryTime(tt.failures)
+				assert.GreaterOrEqual(t, sec, time.Duration(tt.secGte)*time.Second)
+				assert.LessOrEqual(t, sec, time.Duration(tt.secLte)*time.Second)
+				assert.NotEqual(t, sec, previous)
+				previous = sec
+			}
+		})
+	}
+}
+
+func TestRetryWithWarnings(t *testing.T) {
+	t.Parallel()
+	// different number of retries than the default
+	settings := Settings{
+		MaxRetries:    7,
+		RetryTimeFunc: RetryTime,
+	}
+
+	cases := []struct {
+		failures      int
+		expectSuccess bool
+	}{}
+
+	for i := range settings.MaxRetries + 3 {
+		cases = append(cases, struct {
+			failures      int
+			expectSuccess bool
+		}{i, i < settings.MaxRetries})
+	}
+
+	for _, tt := range cases {
+		t.Run(fmt.Sprintf("failures=%d", tt.failures), func(t *testing.T) {
+			synctest.Test(t, func(t *testing.T) {
+				attempts := 0
+				expectedErr := errors.New("temporary error")
+				result, err := RetryWithWarnings("test-operation", settings, func() (string, error) {
+					attempts++
+					if attempts <= tt.failures {
+						return "", expectedErr
+					}
+					return "success", nil
+				})
+
+				if tt.expectSuccess {
+					require.NoError(t, err)
+					assert.Equal(t, "success", result)
+					assert.Equal(t, tt.failures+1, attempts)
+				} else {
+					require.Error(t, err)
+					assert.Equal(t, expectedErr, err)
+					assert.Empty(t, result)
+					assert.Equal(t, settings.MaxRetries, attempts)
+				}
+			})
+		})
+	}
+}
diff --git a/pkg/schedule/ticker.go b/pkg/schedule/ticker.go
new file mode 100644
index 0000000..e5b2ffa
--- /dev/null
+++ b/pkg/schedule/ticker.go
@@ -0,0 +1,32 @@
+package schedule
+
+import (
+	"context"
+	"time"
+)
+
+// RunOnInterval calls fn on every tick of a ticker with the given interval,
+// stopping when ctx is done. If cleanup is non-nil it is called once after
+// the context is cancelled and before the function returns. The ticker is
+// always stopped before returning.
+func RunOnInterval(ctx context.Context, interval time.Duration, fn func(), cleanup func()) {
+	if cleanup != nil {
+		defer cleanup()
+	}
+
+	if fn == nil {
+		return
+	}
+
+	ticker := time.NewTicker(interval)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ticker.C:
+			fn()
+		case <-ctx.Done():
+			return
+		}
+	}
+}
diff --git a/pkg/schedule/ticker_test.go b/pkg/schedule/ticker_test.go
new file mode 100644
index 0000000..a623771
--- /dev/null
+++ b/pkg/schedule/ticker_test.go
@@ -0,0 +1,102 @@
+package schedule
+
+import (
+	"context"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+)
+
+// run starts RunOnInterval in a goroutine and returns a channel that closes
+// when RunOnInterval returns.
+func run(ctx context.Context, interval time.Duration, fn func(), cleanup func()) <-chan struct{} {
+	done := make(chan struct{})
+
+	go func() {
+		RunOnInterval(ctx, interval, fn, cleanup)
+		close(done)
+	}()
+
+	return done
+}
+
+func TestRunOnInterval_CallsFnOnTick(t *testing.T) {
+	t.Parallel()
+	var calls atomic.Int32
+
+	run(t.Context(), time.Millisecond, func() { calls.Add(1) }, nil)
+
+	assert.Eventually(t, func() bool {
+		return calls.Load() >= 3
+	}, time.Second, time.Millisecond)
+}
+
+func TestRunOnInterval_StopsWhenContextCancelled(t *testing.T) {
+	t.Parallel()
+	ctx, cancel := context.WithCancel(t.Context())
+	cancel()
+
+	done := run(ctx, time.Hour, func() {}, nil)
+
+	select {
+	case <-done:
+	case <-time.After(time.Second):
+		t.Fatal("RunOnInterval did not return after context cancellation")
+	}
+}
+
+func TestRunOnInterval_CallsCleanupOnCancellation(t *testing.T) {
+	t.Parallel()
+	ctx, cancel := context.WithCancel(t.Context())
+
+	var cleanupCalled atomic.Bool
+	done := run(ctx, time.Hour, func() {}, func() { cleanupCalled.Store(true) })
+
+	cancel()
+	<-done
+
+	assert.True(t, cleanupCalled.Load())
+}
+
+func TestRunOnInterval_CleanupCalledExactlyOnce(t *testing.T) {
+	t.Parallel()
+	ctx, cancel := context.WithCancel(t.Context())
+
+	var cleanupCount atomic.Int32
+	done := run(ctx, time.Millisecond, func() {}, func() { cleanupCount.Add(1) })
+
+	// Let fn tick a few times before cancelling.
+	assert.Eventually(t, func() bool { return cleanupCount.Load() == 0 }, time.Second, time.Millisecond)
+	cancel()
+	<-done
+
+	assert.Equal(t, int32(1), cleanupCount.Load())
+}
+
+func TestRunOnInterval_NilCleanupDoesNotPanic(t *testing.T) {
+	t.Parallel()
+	ctx, cancel := context.WithCancel(t.Context())
+	cancel()
+
+	done := run(ctx, time.Hour, func() {}, nil)
+
+	select {
+	case <-done:
+	case <-time.After(time.Second):
+		t.Fatal("RunOnInterval did not return after context cancellation")
+	}
+}
+
+func TestRunOnInterval_FnNotCalledAfterCancellation(t *testing.T) {
+	t.Parallel()
+	ctx, cancel := context.WithCancel(t.Context())
+	cancel()
+
+	var calls atomic.Int32
+	done := run(ctx, time.Millisecond, func() { calls.Add(1) }, nil)
+	<-done
+
+	assert.Equal(t, int32(0), calls.Load())
+}
diff --git a/pkg/snapshot/docker.go b/pkg/snapshot/docker.go
new file mode 100644
index 0000000..b26f95d
--- /dev/null
+++ b/pkg/snapshot/docker.go
@@ -0,0 +1,351 @@
+package snapshot
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"os"
+	"strings"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/docker/consts"
+	"github.com/portainer/portainer/api/docker/stats"
+	"github.com/portainer/portainer/api/logs"
+	edgeutils "github.com/portainer/portainer/pkg/edge"
+	networkingutils "github.com/portainer/portainer/pkg/networking"
+
+	"github.com/docker/docker/api/types"
+	dockercontainer "github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/api/types/image"
+	"github.com/docker/docker/api/types/network"
+	"github.com/docker/docker/api/types/volume"
+	"github.com/docker/docker/client"
+	"github.com/docker/docker/pkg/stdcopy"
+	"github.com/rs/zerolog/log"
+	"github.com/segmentio/encoding/json"
+)
+
+func CreateDockerSnapshot(cli *client.Client) (*portainer.DockerSnapshot, error) {
+	if _, err := cli.Ping(context.Background()); err != nil {
+		return nil, err
+	}
+
+	dockerSnapshot := &portainer.DockerSnapshot{}
+
+	if err := dockerSnapshotInfo(dockerSnapshot, cli); err != nil {
+		log.Warn().Err(err).Msg("unable to snapshot engine information")
+	}
+
+	if dockerSnapshot.Swarm {
+		if err := dockerSnapshotSwarmServices(dockerSnapshot, cli); err != nil {
+			log.Warn().Err(err).Msg("unable to snapshot Swarm services")
+		}
+
+		if err := dockerSnapshotNodes(dockerSnapshot, cli); err != nil {
+			log.Warn().Err(err).Msg("unable to snapshot Swarm nodes")
+		}
+	} else {
+		dockerSnapshot.NodeCount = 1
+	}
+
+	if err := dockerSnapshotContainers(dockerSnapshot, cli); err != nil {
+		log.Warn().Err(err).Msg("unable to snapshot containers")
+	}
+
+	if err := dockerSnapshotImages(dockerSnapshot, cli); err != nil {
+		log.Warn().Err(err).Msg("unable to snapshot images")
+	}
+
+	if err := dockerSnapshotVolumes(dockerSnapshot, cli); err != nil {
+		log.Warn().Err(err).Msg("unable to snapshot volumes")
+	}
+
+	if err := dockerSnapshotNetworks(dockerSnapshot, cli); err != nil {
+		log.Warn().Err(err).Msg("unable to snapshot networks")
+	}
+
+	if err := dockerSnapshotVersion(dockerSnapshot, cli); err != nil {
+		log.Warn().Err(err).Msg("unable to snapshot engine version")
+	}
+
+	dockerSnapshot.Time = time.Now().Unix()
+
+	return dockerSnapshot, nil
+}
+
+func dockerSnapshotInfo(snapshot *portainer.DockerSnapshot, cli *client.Client) error {
+	info, err := cli.Info(context.Background())
+	if err != nil {
+		return err
+	}
+
+	snapshot.Swarm = info.Swarm.ControlAvailable
+	snapshot.DockerVersion = info.ServerVersion
+	snapshot.TotalCPU = info.NCPU
+	snapshot.TotalMemory = info.MemTotal
+	snapshot.SnapshotRaw.Info = info
+
+	return nil
+}
+
+func dockerSnapshotNodes(snapshot *portainer.DockerSnapshot, cli *client.Client) error {
+	nodes, err := cli.NodeList(context.Background(), types.NodeListOptions{})
+	if err != nil {
+		return err
+	}
+
+	var nanoCpus, totalMem int64
+
+	for _, node := range nodes {
+		nanoCpus += node.Description.Resources.NanoCPUs
+		totalMem += node.Description.Resources.MemoryBytes
+	}
+
+	snapshot.TotalCPU = int(nanoCpus / 1e9)
+	snapshot.TotalMemory = totalMem
+	snapshot.NodeCount = len(nodes)
+
+	return nil
+}
+
+func dockerSnapshotSwarmServices(snapshot *portainer.DockerSnapshot, cli *client.Client) error {
+	stacks := make(map[string]struct{})
+
+	services, err := cli.ServiceList(context.Background(), types.ServiceListOptions{})
+	if err != nil {
+		return err
+	}
+
+	for _, service := range services {
+		for k, v := range service.Spec.Labels {
+			if k == "com.docker.stack.namespace" {
+				stacks[v] = struct{}{}
+			}
+		}
+	}
+
+	snapshot.ServiceCount = len(services)
+	snapshot.StackCount += len(stacks)
+
+	return nil
+}
+
+func dockerSnapshotContainers(snapshot *portainer.DockerSnapshot, cli *client.Client) error {
+	ctx := context.Background()
+	containers, err := cli.ContainerList(ctx, dockercontainer.ListOptions{All: true})
+	if err != nil {
+		return err
+	}
+
+	stacks := make(map[string]struct{})
+	gpuUseSet := make(map[string]struct{})
+	gpuUseAll := false
+	containerEnvs := make(map[string][]string)
+
+	for _, container := range containers {
+		for k, v := range container.Labels {
+			if k == consts.ComposeStackNameLabel {
+				stacks[v] = struct{}{}
+			}
+		}
+
+		if container.State != "running" {
+			continue
+		}
+
+		// Snapshot GPUs and Env
+		response, err := cli.ContainerInspect(context.Background(), container.ID)
+		if err != nil && !snapshot.Swarm {
+			return err
+		} else if err != nil {
+			// Inspect a container will fail when the container runs on a different
+			// Swarm node, so it is better to log the error instead of return error
+			// when the Swarm mode is enabled
+			if !strings.Contains(err.Error(), "No such container") {
+				return err
+			}
+
+			// It is common to have containers running on different Swarm nodes,
+			// so we just log the error in the debug level
+			log.Debug().Str("container", container.ID).Err(err).Msg("unable to inspect container in other Swarm nodes")
+
+			continue
+		}
+
+		containerEnvs[container.ID] = response.Config.Env
+
+		var gpuOptions *dockercontainer.DeviceRequest
+
+		if response.HostConfig != nil {
+			for _, deviceRequest := range response.HostConfig.DeviceRequests {
+				if deviceRequest.Driver == "nvidia" ||
+					(len(deviceRequest.Capabilities) > 0 &&
+						len(deviceRequest.Capabilities[0]) > 0 &&
+						deviceRequest.Capabilities[0][0] == "gpu") {
+					gpuOptions = &deviceRequest
+				}
+			}
+		}
+
+		if gpuOptions == nil {
+			continue
+		}
+
+		if gpuOptions.Count == -1 {
+			gpuUseAll = true
+		}
+
+		for _, id := range gpuOptions.DeviceIDs {
+			gpuUseSet[id] = struct{}{}
+		}
+	}
+
+	gpuUseList := make([]string, 0, len(gpuUseSet))
+	for gpuUse := range gpuUseSet {
+		gpuUseList = append(gpuUseList, gpuUse)
+	}
+
+	snapshot.GpuUseAll = gpuUseAll
+	snapshot.GpuUseList = gpuUseList
+
+	result, err := stats.CalculateContainerStats(ctx, cli, snapshot.Swarm, containers)
+	if err != nil {
+		return fmt.Errorf("failed to calculate container stats: %w", err)
+	}
+
+	snapshot.ContainerCount = result.Total
+	snapshot.RunningContainerCount = result.Running
+	snapshot.StoppedContainerCount = result.Stopped
+	snapshot.HealthyContainerCount = result.Healthy
+	snapshot.UnhealthyContainerCount = result.Unhealthy
+	snapshot.StackCount += len(stacks)
+
+	for _, container := range containers {
+		snapshot.SnapshotRaw.Containers = append(snapshot.SnapshotRaw.Containers, portainer.DockerContainerSnapshot{Container: container, Env: containerEnvs[container.ID]})
+	}
+
+	return nil
+}
+
+func dockerSnapshotImages(snapshot *portainer.DockerSnapshot, cli *client.Client) error {
+	images, err := cli.ImageList(context.Background(), image.ListOptions{})
+	if err != nil {
+		return err
+	}
+
+	snapshot.ImageCount = len(images)
+	snapshot.SnapshotRaw.Images = images
+
+	return nil
+}
+
+func dockerSnapshotVolumes(snapshot *portainer.DockerSnapshot, cli *client.Client) error {
+	volumes, err := cli.VolumeList(context.Background(), volume.ListOptions{})
+	if err != nil {
+		return err
+	}
+
+	snapshot.VolumeCount = len(volumes.Volumes)
+	snapshot.SnapshotRaw.Volumes = volumes
+
+	return nil
+}
+
+func dockerSnapshotNetworks(snapshot *portainer.DockerSnapshot, cli *client.Client) error {
+	networks, err := cli.NetworkList(context.Background(), network.ListOptions{})
+	if err != nil {
+		return err
+	}
+
+	snapshot.SnapshotRaw.Networks = networks
+
+	return nil
+}
+
+func dockerSnapshotVersion(snapshot *portainer.DockerSnapshot, cli *client.Client) error {
+	version, err := cli.ServerVersion(context.Background())
+	if err != nil {
+		return err
+	}
+
+	snapshot.SnapshotRaw.Version = version
+	snapshot.IsPodman = isPodman(version)
+
+	return nil
+}
+
+// DockerSnapshotDiagnostics returns the diagnostics data for the agent
+func DockerSnapshotDiagnostics(cli *client.Client, edgeKey string) (*portainer.DiagnosticsData, error) {
+	containerID := os.Getenv("HOSTNAME")
+	snapshot := &portainer.DockerSnapshot{
+		DiagnosticsData: &portainer.DiagnosticsData{
+			DNS:    make(map[string]string),
+			Telnet: make(map[string]string),
+		},
+	}
+
+	if err := dockerSnapshotContainerErrorLogs(snapshot, cli, containerID); err != nil {
+		return nil, err
+	}
+
+	if edgeKey == "" {
+		return snapshot.DiagnosticsData, nil
+	}
+
+	url, err := edgeutils.GetPortainerURLFromEdgeKey(edgeKey)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get portainer URL from edge key: %w", err)
+	}
+
+	snapshot.DiagnosticsData.DNS["edge-to-portainer"] = networkingutils.ProbeDNSConnection(url)
+	snapshot.DiagnosticsData.Telnet["edge-to-portainer"] = networkingutils.ProbeTelnetConnection(url)
+
+	return snapshot.DiagnosticsData, nil
+}
+
+// DockerSnapshotContainerErrorLogs returns the 5 most recent error logs of the agent container
+// this will primarily be used for agent snapshot
+func dockerSnapshotContainerErrorLogs(snapshot *portainer.DockerSnapshot, cli *client.Client, containerId string) error {
+	if containerId == "" {
+		return nil
+	}
+
+	rd, err := cli.ContainerLogs(context.Background(), containerId, dockercontainer.LogsOptions{
+		ShowStdout: false,
+		ShowStderr: true,
+		Tail:       "5",
+		Timestamps: true,
+	})
+	if err != nil {
+		return fmt.Errorf("failed to get container logs: %w", err)
+	}
+	defer logs.CloseAndLogErr(rd)
+
+	var stdOut, stdErr bytes.Buffer
+	if _, err := stdcopy.StdCopy(&stdErr, &stdOut, rd); err != nil {
+		return fmt.Errorf("failed to copy error logs: %w", err)
+	}
+
+	var logs []map[string]string
+	jsonLogs, err := json.Marshal(logs)
+	if err != nil {
+		return fmt.Errorf("failed to marshal logs to JSON: %w", err)
+	}
+
+	snapshot.DiagnosticsData.Log = string(jsonLogs)
+
+	return nil
+}
+
+// isPodman checks if the version is for Podman by checking if any of the components contain "podman".
+// If it's podman, a component name should be "Podman Engine"
+func isPodman(version types.Version) bool {
+	for _, component := range version.Components {
+		if strings.Contains(strings.ToLower(component.Name), "podman") {
+			return true
+		}
+	}
+
+	return false
+}
diff --git a/pkg/snapshot/docker_test.go b/pkg/snapshot/docker_test.go
new file mode 100644
index 0000000..3499dde
--- /dev/null
+++ b/pkg/snapshot/docker_test.go
@@ -0,0 +1,140 @@
+package snapshot
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/docker/docker/api/types"
+	dockercontainer "github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/api/types/image"
+	"github.com/docker/docker/api/types/network"
+	"github.com/docker/docker/api/types/swarm"
+	"github.com/docker/docker/api/types/system"
+	"github.com/docker/docker/api/types/volume"
+	"github.com/docker/docker/client"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/require"
+)
+
+func TestDockerSnapshotNodes_CountAndResources(t *testing.T) {
+	t.Parallel()
+
+	nodes := []swarm.Node{
+		{Description: swarm.NodeDescription{Resources: swarm.Resources{
+			NanoCPUs:    4_000_000_000,
+			MemoryBytes: 8 * 1024 * 1024 * 1024,
+		}}},
+		{Description: swarm.NodeDescription{Resources: swarm.Resources{
+			NanoCPUs:    2_000_000_000,
+			MemoryBytes: 4 * 1024 * 1024 * 1024,
+		}}},
+	}
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(nodes)
+	}))
+	defer srv.Close()
+
+	cli, err := client.NewClientWithOpts(client.WithHost(srv.URL), client.WithHTTPClient(http.DefaultClient))
+	require.NoError(t, err)
+
+	snap := &portainer.DockerSnapshot{}
+	err = dockerSnapshotNodes(snap, cli)
+	require.NoError(t, err)
+
+	require.Equal(t, 2, snap.NodeCount)
+	require.Equal(t, 6, snap.TotalCPU)
+	require.Equal(t, int64(12*1024*1024*1024), snap.TotalMemory)
+}
+
+func TestCreateDockerSnapshot_StandaloneNodeCount(t *testing.T) {
+	t.Parallel()
+
+	srv := newDockerMockServer(t, false, nil)
+	defer srv.Close()
+
+	cli, err := client.NewClientWithOpts(client.WithHost(srv.URL), client.WithHTTPClient(http.DefaultClient))
+	require.NoError(t, err)
+
+	snap, err := CreateDockerSnapshot(cli)
+	require.NoError(t, err)
+	require.Equal(t, 1, snap.NodeCount)
+	require.False(t, snap.Swarm)
+}
+
+func TestCreateDockerSnapshot_SwarmNodeCount(t *testing.T) {
+	t.Parallel()
+
+	nodes := []swarm.Node{
+		{Description: swarm.NodeDescription{Resources: swarm.Resources{NanoCPUs: 2_000_000_000}}},
+		{Description: swarm.NodeDescription{Resources: swarm.Resources{NanoCPUs: 2_000_000_000}}},
+		{Description: swarm.NodeDescription{Resources: swarm.Resources{NanoCPUs: 2_000_000_000}}},
+	}
+
+	srv := newDockerMockServer(t, true, nodes)
+	defer srv.Close()
+
+	cli, err := client.NewClientWithOpts(client.WithHost(srv.URL), client.WithHTTPClient(http.DefaultClient))
+	require.NoError(t, err)
+
+	snap, err := CreateDockerSnapshot(cli)
+	require.NoError(t, err)
+	require.Equal(t, 3, snap.NodeCount)
+	require.True(t, snap.Swarm)
+}
+
+// newDockerMockServer returns a test HTTP server that mimics the Docker API
+// for snapshot-related endpoints. swarmEnabled controls whether /info reports
+// Swarm mode active; nodes is returned by the /nodes endpoint.
+func newDockerMockServer(t *testing.T, swarmEnabled bool, nodes []swarm.Node) *httptest.Server {
+	t.Helper()
+
+	return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		path := r.URL.Path
+
+		switch {
+		case path == "/_ping":
+			w.Header().Set("API-Version", "1.41")
+			_, _ = w.Write([]byte("OK"))
+
+		case strings.HasSuffix(path, "/info"):
+			_ = json.NewEncoder(w).Encode(system.Info{
+				NCPU:     2,
+				MemTotal: 4 * 1024 * 1024 * 1024,
+				Swarm:    swarm.Info{ControlAvailable: swarmEnabled},
+			})
+
+		case strings.HasSuffix(path, "/nodes"):
+			_ = json.NewEncoder(w).Encode(nodes)
+
+		case strings.HasSuffix(path, "/services"):
+			_ = json.NewEncoder(w).Encode([]swarm.Service{})
+
+		case strings.HasSuffix(path, "/containers/json"):
+			_ = json.NewEncoder(w).Encode([]dockercontainer.Summary{})
+
+		case strings.HasSuffix(path, "/images/json"):
+			_ = json.NewEncoder(w).Encode([]image.Summary{})
+
+		case strings.HasSuffix(path, "/volumes"):
+			_ = json.NewEncoder(w).Encode(volume.ListResponse{})
+
+		case strings.HasSuffix(path, "/networks"):
+			_ = json.NewEncoder(w).Encode([]network.Summary{})
+
+		case strings.HasSuffix(path, "/version"):
+			_ = json.NewEncoder(w).Encode(types.Version{
+				Version:    "20.10.0",
+				APIVersion: "1.41",
+			})
+
+		default:
+			w.WriteHeader(http.StatusNotFound)
+		}
+	}))
+}
diff --git a/pkg/snapshot/kubernetes.go b/pkg/snapshot/kubernetes.go
new file mode 100644
index 0000000..477475e
--- /dev/null
+++ b/pkg/snapshot/kubernetes.go
@@ -0,0 +1,200 @@
+package snapshot
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/segmentio/encoding/json"
+
+	"github.com/aws/smithy-go/ptr"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/logs"
+	edgeutils "github.com/portainer/portainer/pkg/edge"
+	networkingutils "github.com/portainer/portainer/pkg/networking"
+	"github.com/rs/zerolog/log"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes"
+)
+
+func CreateKubernetesSnapshot(cli *kubernetes.Clientset) (*portainer.KubernetesSnapshot, error) {
+	kubernetesSnapshot := &portainer.KubernetesSnapshot{}
+	err := kubernetesSnapshotVersion(kubernetesSnapshot, cli)
+	if err != nil {
+		log.Warn().Err(err).Msg("unable to snapshot cluster version")
+	}
+
+	err = kubernetesSnapshotNodes(kubernetesSnapshot, cli)
+	if err != nil {
+		log.Warn().Err(err).Msg("unable to snapshot cluster nodes")
+	}
+
+	kubernetesSnapshot.Time = time.Now().Unix()
+	return kubernetesSnapshot, nil
+}
+
+func kubernetesSnapshotVersion(snapshot *portainer.KubernetesSnapshot, cli kubernetes.Interface) error {
+	versionInfo, err := cli.Discovery().ServerVersion()
+	if err != nil {
+		return err
+	}
+
+	snapshot.KubernetesVersion = versionInfo.GitVersion
+	return nil
+}
+
+func kubernetesSnapshotNodes(snapshot *portainer.KubernetesSnapshot, cli kubernetes.Interface) error {
+	nodeList, err := cli.CoreV1().Nodes().List(context.TODO(), metav1.ListOptions{})
+	if err != nil {
+		return err
+	}
+
+	if len(nodeList.Items) == 0 {
+		return nil
+	}
+
+	totalGPU := make(map[string]int64)
+	var totalCPUs, totalMemory int64
+	var gpuNodeCount int
+
+	for _, node := range nodeList.Items {
+		totalCPUs += node.Status.Capacity.Cpu().Value()
+		totalMemory += node.Status.Capacity.Memory().Value()
+
+		nodeHasGPU := false
+		for resourceName, quantity := range node.Status.Capacity {
+			if strings.HasPrefix(string(resourceName), "nvidia.com/") {
+				totalGPU[string(resourceName)] += quantity.Value()
+				nodeHasGPU = true
+			}
+		}
+		if nodeHasGPU {
+			gpuNodeCount++
+		}
+	}
+
+	snapshot.TotalCPU = totalCPUs
+	snapshot.TotalMemory = totalMemory
+	snapshot.NodeCount = len(nodeList.Items)
+	snapshot.ClusterType = clusterTypeFromProviderID(nodeList.Items[0].Spec.ProviderID)
+	snapshot.GPUNodeCount = gpuNodeCount
+	if len(totalGPU) > 0 {
+		snapshot.TotalGPU = totalGPU
+	}
+
+	return nil
+}
+
+const (
+	ClusterTypeGKEAutopilot = "gke-autopilot"
+	ClusterTypeEKSFargate   = "eks-fargate"
+	ClusterTypeAKS          = "aks"
+	ClusterTypeUnknown      = ""
+)
+
+func clusterTypeFromProviderID(providerID string) string {
+	switch {
+	case strings.HasPrefix(providerID, "gce://") && isGKEAutopilotProviderID(providerID):
+		return ClusterTypeGKEAutopilot
+	case strings.HasPrefix(providerID, "aws://") && strings.Contains(strings.ToLower(providerID), "fargate"):
+		return ClusterTypeEKSFargate
+	case strings.HasPrefix(providerID, "azure://"):
+		return ClusterTypeAKS
+	default:
+		return ClusterTypeUnknown
+	}
+}
+
+// isGKEAutopilotProviderID detects GKE Autopilot via the gk3- node-name prefix.
+// ProviderID format: gce://PROJECT/REGION/NODE-NAME
+// Autopilot nodes: gk3-CLUSTER-POOL-SUFFIX; Standard nodes: gke-CLUSTER-POOL-SUFFIX
+func isGKEAutopilotProviderID(providerID string) bool {
+	parts := strings.Split(providerID, "/")
+	return len(parts) > 0 && strings.HasPrefix(parts[len(parts)-1], "gk3-")
+}
+
+// KubernetesSnapshotDiagnostics returns the diagnostics data for the agent
+func KubernetesSnapshotDiagnostics(cli *kubernetes.Clientset, edgeKey string) (*portainer.DiagnosticsData, error) {
+	podID := os.Getenv("HOSTNAME")
+	snapshot := &portainer.KubernetesSnapshot{
+		DiagnosticsData: &portainer.DiagnosticsData{
+			DNS:    make(map[string]string),
+			Telnet: make(map[string]string),
+		},
+	}
+
+	err := kubernetesSnapshotPodErrorLogs(snapshot, cli, "portainer", podID)
+	if err != nil {
+		return nil, fmt.Errorf("failed to snapshot pod error logs: %w", err)
+	}
+
+	if edgeKey != "" {
+		url, err := edgeutils.GetPortainerURLFromEdgeKey(edgeKey)
+		if err != nil {
+			return nil, fmt.Errorf("failed to get portainer URL from edge key: %w", err)
+		}
+
+		snapshot.DiagnosticsData.DNS["edge-to-portainer"] = networkingutils.ProbeDNSConnection(url)
+		snapshot.DiagnosticsData.Telnet["edge-to-portainer"] = networkingutils.ProbeTelnetConnection(url)
+	}
+
+	return snapshot.DiagnosticsData, nil
+}
+
+// KubernetesSnapshotPodErrorLogs returns 0 to 10 lines of the most recent error logs of the agent container
+// this will primarily be used for agent snapshot
+func kubernetesSnapshotPodErrorLogs(snapshot *portainer.KubernetesSnapshot, cli *kubernetes.Clientset, namespace, podID string) error {
+	if namespace == "" || podID == "" {
+		return errors.New("both namespace and podID are required to capture pod error logs in the snapshot")
+	}
+
+	logsStream, err := cli.CoreV1().Pods(namespace).GetLogs(podID, &corev1.PodLogOptions{TailLines: ptr.Int64(10), Timestamps: true}).Stream(context.TODO())
+	if err != nil {
+		return fmt.Errorf("failed to stream logs: %w", err)
+	}
+	defer logs.CloseAndLogErr(logsStream)
+
+	logBytes, err := io.ReadAll(logsStream)
+	if err != nil {
+		return fmt.Errorf("failed to read error logs: %w", err)
+	}
+
+	logs := filterLogsByPattern(logBytes, []string{"error", "err", "level=error", "exception", "fatal", "panic"})
+
+	jsonLogs, err := json.Marshal(logs)
+	if err != nil {
+		return fmt.Errorf("failed to marshal logs: %w", err)
+	}
+	snapshot.DiagnosticsData.Log = string(jsonLogs)
+
+	return nil
+}
+
+func filterLogsByPattern(logBytes []byte, patterns []string) []map[string]string {
+	logs := []map[string]string{}
+	for line := range strings.SplitSeq(strings.TrimSpace(string(logBytes)), "\n") {
+		if line == "" {
+			continue
+		}
+
+		if parts := strings.SplitN(line, " ", 2); len(parts) == 2 {
+			messageLower := strings.ToLower(parts[1])
+			for _, pattern := range patterns {
+				if strings.Contains(messageLower, pattern) {
+					logs = append(logs, map[string]string{
+						"timestamp": parts[0],
+						"message":   parts[1],
+					})
+					break
+				}
+			}
+		}
+	}
+
+	return logs
+}
diff --git a/pkg/snapshot/kubernetes_test.go b/pkg/snapshot/kubernetes_test.go
new file mode 100644
index 0000000..265b36a
--- /dev/null
+++ b/pkg/snapshot/kubernetes_test.go
@@ -0,0 +1,468 @@
+package snapshot
+
+import (
+	"errors"
+	"fmt"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+
+	"github.com/stretchr/testify/require"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/resource"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	kfake "k8s.io/client-go/kubernetes/fake"
+	ktesting "k8s.io/client-go/testing"
+)
+
+func TestClusterTypeFromProviderID(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		providerID string
+		expected   string
+	}{
+		{"gce://my-project/us-central1/gk3-my-cluster-pool-abc123", ClusterTypeGKEAutopilot},
+		{"gce://my-project/us-central1/gke-my-cluster-pool-abc123", ClusterTypeUnknown},
+		{"aws:///us-east-1/fargate-12345", ClusterTypeEKSFargate},
+		{"aws:///us-east-1/i-1234567890abcdef0", ClusterTypeUnknown},
+		{"azure:///subscriptions/x/resourceGroups/y/providers/Microsoft.Compute/virtualMachines/NODE", ClusterTypeAKS},
+		{"", ClusterTypeUnknown},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.providerID, func(t *testing.T) {
+			t.Parallel()
+			require.Equal(t, tt.expected, clusterTypeFromProviderID(tt.providerID))
+		})
+	}
+}
+
+func TestKubernetesSnapshotNodes(t *testing.T) {
+	t.Parallel()
+	// Create a fake client
+	fakeClient := kfake.NewClientset()
+
+	// Create test nodes with specific resource values
+	node1 := &corev1.Node{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "test-node-1",
+		},
+		Spec: corev1.NodeSpec{
+			ProviderID: "gce://my-project/us-central1/gk3-my-cluster-pool-abc123",
+		},
+		Status: corev1.NodeStatus{
+			Capacity: corev1.ResourceList{
+				corev1.ResourceCPU:    resource.MustParse("6"),    // 6 CPU cores
+				corev1.ResourceMemory: resource.MustParse("12Gi"), // 12GB memory
+			},
+		},
+	}
+
+	node2 := &corev1.Node{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "test-node-2",
+		},
+		Status: corev1.NodeStatus{
+			Capacity: corev1.ResourceList{
+				corev1.ResourceCPU:    resource.MustParse("4"),   // 4 CPU cores
+				corev1.ResourceMemory: resource.MustParse("8Gi"), // 8GB memory
+			},
+		},
+	}
+
+	node3 := &corev1.Node{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "test-node-3",
+		},
+		Status: corev1.NodeStatus{
+			Capacity: corev1.ResourceList{
+				corev1.ResourceCPU:    resource.MustParse("2"),   // 2 CPU cores
+				corev1.ResourceMemory: resource.MustParse("4Gi"), // 4GB memory
+			},
+		},
+	}
+
+	// Add nodes to fake client
+	_, err := fakeClient.CoreV1().Nodes().Create(t.Context(), node1, metav1.CreateOptions{})
+	require.NoError(t, err)
+	_, err = fakeClient.CoreV1().Nodes().Create(t.Context(), node2, metav1.CreateOptions{})
+	require.NoError(t, err)
+	_, err = fakeClient.CoreV1().Nodes().Create(t.Context(), node3, metav1.CreateOptions{})
+	require.NoError(t, err)
+
+	snapshot := &portainer.KubernetesSnapshot{}
+
+	// Use the actual function now that it accepts kubernetes.Interface
+	err = kubernetesSnapshotNodes(snapshot, fakeClient)
+	require.NoError(t, err)
+
+	// Verify the results - these should match what kubernetesSnapshotNodes would produce
+	require.Equal(t, 3, snapshot.NodeCount)                         // 3 nodes
+	require.Equal(t, int64(12), snapshot.TotalCPU)                  // 6 + 4 + 2 = 12 CPUs
+	require.Equal(t, int64(25769803776), snapshot.TotalMemory)      // 12GB + 8GB + 4GB = 24GB in bytes
+	require.Equal(t, ClusterTypeGKEAutopilot, snapshot.ClusterType) // detected from node1's ProviderID
+	require.Nil(t, snapshot.PerformanceMetrics)                     // Performance metrics are no longer collected server-side
+	require.Equal(t, 0, snapshot.GPUNodeCount)
+	require.Nil(t, snapshot.TotalGPU)
+
+	t.Logf("kubernetesSnapshotNodes test result: Nodes=%d, CPUs=%d, Memory=%d bytes",
+		snapshot.NodeCount, snapshot.TotalCPU, snapshot.TotalMemory)
+}
+
+func TestKubernetesSnapshotNodesEmptyCluster(t *testing.T) {
+	t.Parallel()
+	// Test with no nodes to verify early return behavior
+	fakeClient := kfake.NewClientset()
+	snapshot := &portainer.KubernetesSnapshot{}
+
+	err := kubernetesSnapshotNodes(snapshot, fakeClient)
+	require.NoError(t, err)
+
+	// Values should remain at their zero state when no nodes exist
+	require.Equal(t, 0, snapshot.NodeCount)
+	require.Equal(t, int64(0), snapshot.TotalCPU)
+	require.Equal(t, int64(0), snapshot.TotalMemory)
+	require.Equal(t, ClusterTypeUnknown, snapshot.ClusterType)
+	require.Nil(t, snapshot.PerformanceMetrics) // Performance metrics should not be set for empty cluster
+
+	t.Log("Empty cluster test passed - no nodes found, early return behavior confirmed")
+}
+
+func TestCreateKubernetesSnapshotIntegration(t *testing.T) {
+	t.Parallel()
+	// Integration test to verify CreateKubernetesSnapshot calls kubernetesSnapshotNodes correctly
+	fakeClient := kfake.NewClientset()
+
+	// Create test nodes
+	node1 := &corev1.Node{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "integration-node-1",
+		},
+		Status: corev1.NodeStatus{
+			Capacity: corev1.ResourceList{
+				corev1.ResourceCPU:    resource.MustParse("8"),    // 8 CPU cores
+				corev1.ResourceMemory: resource.MustParse("16Gi"), // 16GB memory
+			},
+		},
+	}
+
+	node2 := &corev1.Node{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "integration-node-2",
+		},
+		Status: corev1.NodeStatus{
+			Capacity: corev1.ResourceList{
+				corev1.ResourceCPU:    resource.MustParse("4"),   // 4 CPU cores
+				corev1.ResourceMemory: resource.MustParse("8Gi"), // 8GB memory
+			},
+		},
+	}
+
+	// Add nodes to fake client
+	_, err := fakeClient.CoreV1().Nodes().Create(t.Context(), node1, metav1.CreateOptions{})
+	require.NoError(t, err)
+	_, err = fakeClient.CoreV1().Nodes().Create(t.Context(), node2, metav1.CreateOptions{})
+	require.NoError(t, err)
+
+	// Test that kubernetesSnapshotVersion would work
+	serverInfo, err := fakeClient.Discovery().ServerVersion()
+	require.NoError(t, err)
+	require.NotEmpty(t, serverInfo.GitVersion)
+
+	// Test that kubernetesSnapshotNodes logic works
+	snapshot := &portainer.KubernetesSnapshot{}
+	err = kubernetesSnapshotNodes(snapshot, fakeClient)
+	require.NoError(t, err)
+
+	// Verify the integration results
+	require.Equal(t, 2, snapshot.NodeCount)
+	require.Equal(t, int64(12), snapshot.TotalCPU)             // 8 + 4 = 12 CPUs
+	require.Equal(t, int64(25769803776), snapshot.TotalMemory) // 16GB + 8GB = 24GB in bytes
+	require.Nil(t, snapshot.PerformanceMetrics)
+
+	// Manually set the version to complete the integration test
+	snapshot.KubernetesVersion = serverInfo.GitVersion
+	require.NotEmpty(t, snapshot.KubernetesVersion)
+
+	t.Logf("Integration test result: Version=%s, Nodes=%d, CPUs=%d, Memory=%d bytes",
+		snapshot.KubernetesVersion, snapshot.NodeCount, snapshot.TotalCPU, snapshot.TotalMemory)
+}
+
+func TestKubernetesSnapshotNodesWithAPIError(t *testing.T) {
+	t.Parallel()
+	// Test error handling when the Kubernetes API returns an error
+	fakeClient := kfake.NewClientset()
+
+	// Add a reactor to simulate API error
+	fakeClient.PrependReactor("list", "nodes", func(action ktesting.Action) (handled bool, ret runtime.Object, err error) {
+		return true, nil, errors.New("simulated API error")
+	})
+
+	snapshot := &portainer.KubernetesSnapshot{}
+	err := kubernetesSnapshotNodes(snapshot, fakeClient)
+
+	// Should return the API error
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "simulated API error")
+
+	// Snapshot should remain unchanged
+	require.Equal(t, 0, snapshot.NodeCount)
+	require.Equal(t, int64(0), snapshot.TotalCPU)
+	require.Equal(t, int64(0), snapshot.TotalMemory)
+	require.Nil(t, snapshot.PerformanceMetrics)
+
+	t.Log("API error test passed - error handling works correctly")
+}
+
+func TestKubernetesSnapshotNodesSingleNode(t *testing.T) {
+	t.Parallel()
+	// Test with a single node to verify calculations work for edge case
+	fakeClient := kfake.NewClientset()
+
+	node := &corev1.Node{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "single-node",
+		},
+		Status: corev1.NodeStatus{
+			Capacity: corev1.ResourceList{
+				corev1.ResourceCPU:    resource.MustParse("1"),   // 1 CPU core
+				corev1.ResourceMemory: resource.MustParse("1Gi"), // 1GB memory
+			},
+		},
+	}
+
+	_, err := fakeClient.CoreV1().Nodes().Create(t.Context(), node, metav1.CreateOptions{})
+	require.NoError(t, err)
+
+	snapshot := &portainer.KubernetesSnapshot{}
+	err = kubernetesSnapshotNodes(snapshot, fakeClient)
+	require.NoError(t, err)
+
+	require.Equal(t, 1, snapshot.NodeCount)
+	require.Equal(t, int64(1), snapshot.TotalCPU)
+	require.Equal(t, int64(1073741824), snapshot.TotalMemory) // 1GB in bytes
+	require.Nil(t, snapshot.PerformanceMetrics)
+
+	t.Logf("Single node test result: Nodes=%d, CPUs=%d, Memory=%d bytes",
+		snapshot.NodeCount, snapshot.TotalCPU, snapshot.TotalMemory)
+}
+
+func TestKubernetesSnapshotNodesWithGPU(t *testing.T) {
+	t.Parallel()
+	fakeClient := kfake.NewClientset()
+
+	gpuNode := &corev1.Node{
+		ObjectMeta: metav1.ObjectMeta{Name: "gpu-node"},
+		Status: corev1.NodeStatus{
+			Capacity: corev1.ResourceList{
+				corev1.ResourceCPU:    resource.MustParse("8"),
+				corev1.ResourceMemory: resource.MustParse("16Gi"),
+				"nvidia.com/gpu":      resource.MustParse("4"),
+			},
+		},
+	}
+	cpuNode := &corev1.Node{
+		ObjectMeta: metav1.ObjectMeta{Name: "cpu-node"},
+		Status: corev1.NodeStatus{
+			Capacity: corev1.ResourceList{
+				corev1.ResourceCPU:    resource.MustParse("4"),
+				corev1.ResourceMemory: resource.MustParse("8Gi"),
+			},
+		},
+	}
+
+	_, err := fakeClient.CoreV1().Nodes().Create(t.Context(), gpuNode, metav1.CreateOptions{})
+	require.NoError(t, err)
+	_, err = fakeClient.CoreV1().Nodes().Create(t.Context(), cpuNode, metav1.CreateOptions{})
+	require.NoError(t, err)
+
+	snapshot := &portainer.KubernetesSnapshot{}
+	err = kubernetesSnapshotNodes(snapshot, fakeClient)
+	require.NoError(t, err)
+
+	require.Equal(t, 2, snapshot.NodeCount)
+	require.Equal(t, 1, snapshot.GPUNodeCount)
+	require.Equal(t, int64(4), snapshot.TotalGPU["nvidia.com/gpu"])
+}
+
+func TestKubernetesSnapshotNodesMultipleGPUTypes(t *testing.T) {
+	t.Parallel()
+	fakeClient := kfake.NewClientset()
+
+	node := &corev1.Node{
+		ObjectMeta: metav1.ObjectMeta{Name: "mig-node"},
+		Status: corev1.NodeStatus{
+			Capacity: corev1.ResourceList{
+				corev1.ResourceCPU:       resource.MustParse("8"),
+				corev1.ResourceMemory:    resource.MustParse("16Gi"),
+				"nvidia.com/gpu":         resource.MustParse("2"),
+				"nvidia.com/mig-2g.10gb": resource.MustParse("4"),
+			},
+		},
+	}
+
+	_, err := fakeClient.CoreV1().Nodes().Create(t.Context(), node, metav1.CreateOptions{})
+	require.NoError(t, err)
+
+	snapshot := &portainer.KubernetesSnapshot{}
+	err = kubernetesSnapshotNodes(snapshot, fakeClient)
+	require.NoError(t, err)
+
+	require.Equal(t, 1, snapshot.GPUNodeCount)
+	require.Equal(t, int64(2), snapshot.TotalGPU["nvidia.com/gpu"])
+	require.Equal(t, int64(4), snapshot.TotalGPU["nvidia.com/mig-2g.10gb"])
+}
+
+func TestKubernetesSnapshotNodesGPUAggregatedAcrossNodes(t *testing.T) {
+	t.Parallel()
+	fakeClient := kfake.NewClientset()
+
+	for i, gpuCount := range []int{2, 4} {
+		node := &corev1.Node{
+			ObjectMeta: metav1.ObjectMeta{Name: fmt.Sprintf("gpu-node-%d", i)},
+			Status: corev1.NodeStatus{
+				Capacity: corev1.ResourceList{
+					corev1.ResourceCPU:    resource.MustParse("8"),
+					corev1.ResourceMemory: resource.MustParse("16Gi"),
+					"nvidia.com/gpu":      *resource.NewQuantity(int64(gpuCount), resource.DecimalSI),
+				},
+			},
+		}
+		_, err := fakeClient.CoreV1().Nodes().Create(t.Context(), node, metav1.CreateOptions{})
+		require.NoError(t, err)
+	}
+
+	snapshot := &portainer.KubernetesSnapshot{}
+	err := kubernetesSnapshotNodes(snapshot, fakeClient)
+	require.NoError(t, err)
+
+	require.Equal(t, 2, snapshot.GPUNodeCount)
+	require.Equal(t, int64(6), snapshot.TotalGPU["nvidia.com/gpu"]) // 2 + 4
+}
+
+func TestKubernetesSnapshotNodesNoGPULeavesTotalGPUNil(t *testing.T) {
+	t.Parallel()
+	fakeClient := kfake.NewClientset()
+
+	node := &corev1.Node{
+		ObjectMeta: metav1.ObjectMeta{Name: "cpu-only-node"},
+		Status: corev1.NodeStatus{
+			Capacity: corev1.ResourceList{
+				corev1.ResourceCPU:    resource.MustParse("4"),
+				corev1.ResourceMemory: resource.MustParse("8Gi"),
+			},
+		},
+	}
+	_, err := fakeClient.CoreV1().Nodes().Create(t.Context(), node, metav1.CreateOptions{})
+	require.NoError(t, err)
+
+	snapshot := &portainer.KubernetesSnapshot{}
+	err = kubernetesSnapshotNodes(snapshot, fakeClient)
+	require.NoError(t, err)
+
+	require.Equal(t, 0, snapshot.GPUNodeCount)
+	require.Nil(t, snapshot.TotalGPU)
+}
+
+func TestKubernetesSnapshotNodesZeroResources(t *testing.T) {
+	t.Parallel()
+	// Test with nodes that have zero or very small resources
+	fakeClient := kfake.NewClientset()
+
+	node := &corev1.Node{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "zero-resource-node",
+		},
+		Status: corev1.NodeStatus{
+			Capacity: corev1.ResourceList{
+				corev1.ResourceCPU:    resource.MustParse("0m"),  // 0 millicores
+				corev1.ResourceMemory: resource.MustParse("0Ki"), // 0 kilobytes
+			},
+		},
+	}
+
+	_, err := fakeClient.CoreV1().Nodes().Create(t.Context(), node, metav1.CreateOptions{})
+	require.NoError(t, err)
+
+	snapshot := &portainer.KubernetesSnapshot{}
+	err = kubernetesSnapshotNodes(snapshot, fakeClient)
+	require.NoError(t, err)
+
+	require.Equal(t, 1, snapshot.NodeCount)
+	require.Equal(t, int64(0), snapshot.TotalCPU)
+	require.Equal(t, int64(0), snapshot.TotalMemory)
+	require.Nil(t, snapshot.PerformanceMetrics)
+
+	t.Log("Zero resources test passed - handles edge case correctly")
+}
+
+func TestKubernetesSnapshotNodesGPUDetection(t *testing.T) {
+	t.Parallel()
+
+	const gpuMemoryBytes = int64(25769803776) // 16GiB + 8GiB
+
+	fakeClient := kfake.NewClientset()
+	nodes := []*corev1.Node{
+		{
+			ObjectMeta: metav1.ObjectMeta{Name: "gpu-node"},
+			Status: corev1.NodeStatus{
+				Capacity: corev1.ResourceList{
+					corev1.ResourceCPU:    resource.MustParse("8"),
+					corev1.ResourceMemory: resource.MustParse("16Gi"),
+					"nvidia.com/gpu":      resource.MustParse("4"),
+				},
+			},
+		},
+		{
+			ObjectMeta: metav1.ObjectMeta{Name: "cpu-node"},
+			Status: corev1.NodeStatus{
+				Capacity: corev1.ResourceList{
+					corev1.ResourceCPU:    resource.MustParse("4"),
+					corev1.ResourceMemory: resource.MustParse("8Gi"),
+				},
+			},
+		},
+	}
+	for _, n := range nodes {
+		_, err := fakeClient.CoreV1().Nodes().Create(t.Context(), n, metav1.CreateOptions{})
+		require.NoError(t, err)
+	}
+
+	snap := &portainer.KubernetesSnapshot{}
+	err := kubernetesSnapshotNodes(snap, fakeClient)
+	require.NoError(t, err)
+
+	require.Equal(t, 2, snap.NodeCount)
+	require.Equal(t, int64(12), snap.TotalCPU)
+	require.Equal(t, gpuMemoryBytes, snap.TotalMemory)
+	require.Equal(t, 1, snap.GPUNodeCount)
+	require.Equal(t, map[string]int64{"nvidia.com/gpu": 4}, snap.TotalGPU)
+}
+
+func TestKubernetesSnapshotNodesNoGPUNodes(t *testing.T) {
+	t.Parallel()
+
+	fakeClient := kfake.NewClientset()
+	node := &corev1.Node{
+		ObjectMeta: metav1.ObjectMeta{Name: "cpu-node"},
+		Status: corev1.NodeStatus{
+			Capacity: corev1.ResourceList{
+				corev1.ResourceCPU:    resource.MustParse("4"),
+				corev1.ResourceMemory: resource.MustParse("8Gi"),
+			},
+		},
+	}
+	_, err := fakeClient.CoreV1().Nodes().Create(t.Context(), node, metav1.CreateOptions{})
+	require.NoError(t, err)
+
+	snap := &portainer.KubernetesSnapshot{}
+	err = kubernetesSnapshotNodes(snap, fakeClient)
+	require.NoError(t, err)
+
+	require.Equal(t, 1, snap.NodeCount)
+	require.Equal(t, int64(4), snap.TotalCPU)
+	require.Equal(t, 0, snap.GPUNodeCount)
+	require.Nil(t, snap.TotalGPU)
+}
diff --git a/pkg/testhelpers/integration.go b/pkg/testhelpers/integration.go
new file mode 100644
index 0000000..e39afc7
--- /dev/null
+++ b/pkg/testhelpers/integration.go
@@ -0,0 +1,22 @@
+package testhelpers
+
+import (
+	"flag"
+	"os"
+	"testing"
+)
+
+var integration bool
+
+func init() {
+	flag.BoolVar(&integration, "integration", false, "enable integration tests")
+}
+
+// IntegrationTest marks the current test as an integration test
+func IntegrationTest(t *testing.T) {
+	_, enabled := os.LookupEnv("INTEGRATION_TEST")
+
+	if !integration && !enabled {
+		t.Skip("Skipping integration test")
+	}
+}
diff --git a/pkg/validate/validate.go b/pkg/validate/validate.go
new file mode 100644
index 0000000..d9f4811
--- /dev/null
+++ b/pkg/validate/validate.go
@@ -0,0 +1,110 @@
+package validate
+
+import (
+	"net"
+	"net/url"
+	"regexp"
+	"strings"
+	"unicode/utf8"
+
+	"github.com/google/uuid"
+)
+
+var (
+	hexadecimalRegex = regexp.MustCompile(`^[0-9a-fA-F]+$`)
+	dnsNameRegex     = regexp.MustCompile(`^([a-zA-Z0-9_]{1}[a-zA-Z0-9_-]{0,62}){1}(\.[a-zA-Z0-9_]{1}[a-zA-Z0-9_-]{0,62})*[\._]?$`)
+)
+
+func IsURL(urlString string) bool {
+	if len(urlString) == 0 {
+		return false
+	}
+
+	strTemp := urlString
+	if !strings.Contains(urlString, "://") {
+		// support no indicated urlscheme
+		// http:// is appended so url.Parse will succeed
+		strTemp = "http://" + urlString
+	}
+
+	u, err := url.Parse(strTemp)
+	return err == nil && u.Host != ""
+}
+
+func IsUUID(uuidString string) bool {
+	return uuid.Validate(uuidString) == nil
+}
+
+func IsHexadecimal(hexString string) bool {
+	return hexadecimalRegex.MatchString(hexString)
+}
+
+func HasWhitespaceOnly(s string) bool {
+	return len(s) > 0 && strings.TrimSpace(s) == ""
+}
+
+func MinStringLength(s string, len int) bool {
+	return utf8.RuneCountInString(s) >= len
+}
+
+func Matches(s, pattern string) bool {
+	match, err := regexp.MatchString(pattern, s)
+	return err == nil && match
+}
+
+func IsNonPositive(f float64) bool {
+	return f <= 0
+}
+
+func InRange(val, left, right float64) bool {
+	if left > right {
+		left, right = right, left
+	}
+
+	return val >= left && val <= right
+}
+
+func IsHost(s string) bool {
+	return IsIP(s) || IsDNSName(s)
+}
+
+func IsIP(s string) bool {
+	return net.ParseIP(s) != nil
+}
+
+func IsDNSName(s string) bool {
+	if s == "" || len(strings.ReplaceAll(s, ".", "")) > 255 {
+		// constraints already violated
+		return false
+	}
+
+	return !IsIP(s) && dnsNameRegex.MatchString(s)
+}
+
+func IsTrustedOrigin(s string) bool {
+	if !strings.Contains(s, "://") {
+		return false
+	}
+
+	parsedOrigin, err := url.Parse(s)
+	if err != nil {
+		return false
+	}
+
+	if parsedOrigin.Scheme != "http" && parsedOrigin.Scheme != "https" {
+		return false
+	}
+
+	if parsedOrigin.Host == "" ||
+		parsedOrigin.User != nil ||
+		parsedOrigin.Path != "" ||
+		parsedOrigin.RawQuery != "" ||
+		parsedOrigin.Fragment != "" ||
+		parsedOrigin.Opaque != "" ||
+		parsedOrigin.RawFragment != "" ||
+		parsedOrigin.RawPath != "" {
+		return false
+	}
+
+	return true
+}
diff --git a/pkg/validate/validate_test.go b/pkg/validate/validate_test.go
new file mode 100644
index 0000000..b506da0
--- /dev/null
+++ b/pkg/validate/validate_test.go
@@ -0,0 +1,509 @@
+package validate
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func Test_IsURL(t *testing.T) {
+	t.Parallel()
+	testCases := []struct {
+		name           string
+		url            string
+		expectedResult bool
+	}{
+		{
+			name:           "simple url",
+			url:            "https://google.com",
+			expectedResult: true,
+		},
+		{
+			name:           "empty",
+			url:            "",
+			expectedResult: false,
+		},
+		{
+			name:           "no schema",
+			url:            "google.com",
+			expectedResult: true,
+		},
+		{
+			name:           "path",
+			url:            "https://google.com/some/thing",
+			expectedResult: true,
+		},
+		{
+			name:           "query params",
+			url:            "https://google.com/some/thing?a=5&b=6",
+			expectedResult: true,
+		},
+		{
+			name:           "no top level domain",
+			url:            "google",
+			expectedResult: true,
+		},
+		{
+			name:           "Unicode URL",
+			url:            "www.xn--exampe-7db.ai",
+			expectedResult: true,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			result := IsURL(tc.url)
+			require.Equal(t, tc.expectedResult, result)
+		})
+	}
+}
+
+func Test_IsUUID(t *testing.T) {
+	t.Parallel()
+	testCases := []struct {
+		name           string
+		uuid           string
+		expectedResult bool
+	}{
+		{
+			name:           "empty",
+			uuid:           "",
+			expectedResult: false,
+		},
+		{
+			name:           "version 3 UUID",
+			uuid:           "060507eb-3b9a-362e-b850-d5f065eea403",
+			expectedResult: true,
+		},
+		{
+			name:           "version 4 UUID",
+			uuid:           "63e695ee-48a9-498a-98b3-9472ff75e09f",
+			expectedResult: true,
+		},
+		{
+			name:           "version 5 UUID",
+			uuid:           "5daabcd8-f17e-568c-aa6f-da9d92c7032c",
+			expectedResult: true,
+		},
+		{
+			name:           "text",
+			uuid:           "something like this",
+			expectedResult: false,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			result := IsUUID(tc.uuid)
+			require.Equal(t, tc.expectedResult, result)
+		})
+	}
+}
+
+func Test_IsHexadecimal(t *testing.T) {
+	t.Parallel()
+	testCases := []struct {
+		name           string
+		hex            string
+		expectedResult bool
+	}{
+		{
+			name:           "empty",
+			hex:            "",
+			expectedResult: false,
+		},
+		{
+			name:           "hex",
+			hex:            "48656C6C6F20736F6D657468696E67",
+			expectedResult: true,
+		},
+		{
+			name:           "text",
+			hex:            "something like this",
+			expectedResult: false,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			result := IsHexadecimal(tc.hex)
+			require.Equal(t, tc.expectedResult, result)
+		})
+	}
+}
+
+func Test_HasWhitespaceOnly(t *testing.T) {
+	t.Parallel()
+	testCases := []struct {
+		name           string
+		s              string
+		expectedResult bool
+	}{
+		{
+			name:           "empty",
+			s:              "",
+			expectedResult: false,
+		},
+		{
+			name:           "space",
+			s:              " ",
+			expectedResult: true,
+		},
+		{
+			name:           "tab",
+			s:              "\t",
+			expectedResult: true,
+		},
+		{
+			name:           "text",
+			s:              "something like this",
+			expectedResult: false,
+		},
+		{
+			name:           "all whitespace",
+			s:              "\t\n\v\f\r ",
+			expectedResult: true,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			result := HasWhitespaceOnly(tc.s)
+			require.Equal(t, tc.expectedResult, result)
+		})
+	}
+}
+
+func Test_MinStringLength(t *testing.T) {
+	t.Parallel()
+	testCases := []struct {
+		name           string
+		s              string
+		len            int
+		expectedResult bool
+	}{
+		{
+			name:           "empty + zero len",
+			s:              "",
+			len:            0,
+			expectedResult: true,
+		},
+		{
+			name:           "empty + non zero len",
+			s:              "",
+			len:            10,
+			expectedResult: false,
+		},
+		{
+			name:           "long text + non zero len",
+			s:              "something else",
+			len:            10,
+			expectedResult: true,
+		},
+		{
+			name:           "multibyte characters - enough",
+			s:              "X生",
+			len:            2,
+			expectedResult: true,
+		},
+		{
+			name:           "multibyte characters - not enough",
+			s:              "X生",
+			len:            3,
+			expectedResult: false,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			result := MinStringLength(tc.s, tc.len)
+			require.Equal(t, tc.expectedResult, result)
+		})
+	}
+}
+
+func Test_Matches(t *testing.T) {
+	t.Parallel()
+	testCases := []struct {
+		name           string
+		s              string
+		pattern        string
+		expectedResult bool
+	}{
+		{
+			name:           "empty",
+			s:              "",
+			pattern:        "",
+			expectedResult: true,
+		},
+		{
+			name:           "space",
+			s:              "something else",
+			pattern:        " ",
+			expectedResult: true,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			result := Matches(tc.s, tc.pattern)
+			require.Equal(t, tc.expectedResult, result)
+		})
+	}
+}
+
+func Test_IsNonPositive(t *testing.T) {
+	t.Parallel()
+	testCases := []struct {
+		name           string
+		f              float64
+		expectedResult bool
+	}{
+		{
+			name:           "zero",
+			f:              0,
+			expectedResult: true,
+		},
+		{
+			name:           "positive",
+			f:              1,
+			expectedResult: false,
+		},
+		{
+			name:           "negative",
+			f:              -1,
+			expectedResult: true,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			result := IsNonPositive(tc.f)
+			require.Equal(t, tc.expectedResult, result)
+		})
+	}
+}
+
+func Test_InRange(t *testing.T) {
+	t.Parallel()
+	testCases := []struct {
+		name           string
+		f              float64
+		left           float64
+		right          float64
+		expectedResult bool
+	}{
+		{
+			name:           "zero",
+			f:              0,
+			left:           0,
+			right:          0,
+			expectedResult: true,
+		},
+		{
+			name:           "equal left",
+			f:              1,
+			left:           1,
+			right:          2,
+			expectedResult: true,
+		},
+		{
+			name:           "equal right",
+			f:              2,
+			left:           1,
+			right:          2,
+			expectedResult: true,
+		},
+		{
+			name:           "above",
+			f:              3,
+			left:           1,
+			right:          2,
+			expectedResult: false,
+		},
+		{
+			name:           "below",
+			f:              0,
+			left:           1,
+			right:          2,
+			expectedResult: false,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			result := InRange(tc.f, tc.left, tc.right)
+			require.Equal(t, tc.expectedResult, result)
+		})
+	}
+}
+
+func Test_IsHost(t *testing.T) {
+	t.Parallel()
+	testCases := []struct {
+		name           string
+		s              string
+		expectedResult bool
+	}{
+		{
+			name:           "empty",
+			s:              "",
+			expectedResult: false,
+		},
+		{
+			name:           "ip address",
+			s:              "192.168.1.1",
+			expectedResult: true,
+		},
+		{
+			name:           "hostname",
+			s:              "google.com",
+			expectedResult: true,
+		},
+		{
+			name:           "text",
+			s:              "Something like this",
+			expectedResult: false,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			result := IsHost(tc.s)
+			require.Equal(t, tc.expectedResult, result)
+		})
+	}
+}
+
+func Test_IsIP(t *testing.T) {
+	t.Parallel()
+	testCases := []struct {
+		name           string
+		s              string
+		expectedResult bool
+	}{
+		{
+			name:           "empty",
+			s:              "",
+			expectedResult: false,
+		},
+		{
+			name:           "ip address",
+			s:              "192.168.1.1",
+			expectedResult: true,
+		},
+		{
+			name:           "hostname",
+			s:              "google.com",
+			expectedResult: false,
+		},
+		{
+			name:           "text",
+			s:              "Something like this",
+			expectedResult: false,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			result := IsIP(tc.s)
+			require.Equal(t, tc.expectedResult, result)
+		})
+	}
+}
+
+func Test_IsDNSName(t *testing.T) {
+	t.Parallel()
+	testCases := []struct {
+		name           string
+		s              string
+		expectedResult bool
+	}{
+		{
+			name:           "empty",
+			s:              "",
+			expectedResult: false,
+		},
+		{
+			name:           "ip address",
+			s:              "192.168.1.1",
+			expectedResult: false,
+		},
+		{
+			name:           "hostname",
+			s:              "google.com",
+			expectedResult: true,
+		},
+		{
+			name:           "text",
+			s:              "Something like this",
+			expectedResult: false,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			result := IsDNSName(tc.s)
+			require.Equal(t, tc.expectedResult, result)
+		})
+	}
+}
+
+func Test_IsTrustedOrigin(t *testing.T) {
+	t.Parallel()
+	f := func(s string, expected bool) {
+		t.Helper()
+
+		result := IsTrustedOrigin(s)
+		if result != expected {
+			t.Fatalf("unexpected result for %q; got %t; want %t", s, result, expected)
+		}
+	}
+
+	// Valid trusted origins - scheme + host
+	f("http://localhost", true)
+	f("https://example.com", true)
+	f("http://192.168.1.1", true)
+	f("https://api.example.com", true)
+	f("https://subdomain.example.org", true)
+
+	// Valid trusted origins - scheme + host + port
+	f("http://localhost:8080", true)
+	f("https://example.com:3000", true)
+	f("http://192.168.1.1:443", true)
+	f("https://api.example.com:9000", true)
+
+	// Invalid trusted origins - bare hostname (no scheme)
+	f("localhost", false)
+	f("example.com", false)
+	f("192.168.1.1", false)
+
+	// Invalid trusted origins - empty or malformed
+	f("", false)
+	f("invalid url", false)
+	f("://example.com", false)
+
+	// Invalid trusted origins - unsupported scheme
+	f("ftp://192.168.1.1", false)
+
+	// Invalid trusted origins - with user info
+	f("http://user@example.com", false)
+	f("http://user:pass@localhost", false)
+
+	// Invalid trusted origins - with path
+	f("https://example.com/path", false)
+	f("http://localhost/api", false)
+	f("http://192.168.1.1/static", false)
+
+	// Invalid trusted origins - with query parameters
+	f("https://example.com?param=value", false)
+	f("http://localhost:8080?query=test", false)
+
+	// Invalid trusted origins - with fragment
+	f("https://example.com#fragment", false)
+	f("http://localhost:3000#section", false)
+
+	// Invalid trusted origins - with multiple invalid components
+	f("https://user@example.com/path?query=value#fragment", false)
+	f("http://localhost:8080/api/v1?param=test", false)
+}
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
new file mode 100644
index 0000000..6cfe69e
--- /dev/null
+++ b/pnpm-lock.yaml
@@ -0,0 +1,17835 @@
+lockfileVersion: '9.0'
+
+settings:
+  autoInstallPeers: true
+  excludeLinksFromLockfile: false
+
+overrides:
+  jquery: ^3.6.0
+  decompress: ^4.2.1
+  minimist: ^1.2.6
+  http-proxy: ^1.18.1
+  daterangepicker>jquery: ^3.5.1
+  '@uirouter/react': ^1.0.7
+  '@uirouter/angularjs': 1.0.11
+  markdown-it: ^12.3.2
+  '@types/react': ^17.0.37
+  '@types/react-dom': ^17.0.11
+  '@types/node': ^25
+  ngtemplate-loader>loader-utils: ^1.4.2
+  braces: ^3.0.3
+  shell-quote: ^1.8.4
+
+importers:
+
+  .:
+    dependencies:
+      '@aws-crypto/sha256-js':
+        specifier: ^2.0.0
+        version: 2.0.1
+      '@codemirror/autocomplete':
+        specifier: ^6.20.2
+        version: 6.20.2
+      '@codemirror/commands':
+        specifier: ^6.10.3
+        version: 6.10.3
+      '@codemirror/language':
+        specifier: ^6.12.3
+        version: 6.12.3
+      '@codemirror/legacy-modes':
+        specifier: ^6.5.3
+        version: 6.5.3
+      '@codemirror/lint':
+        specifier: ^6.9.6
+        version: 6.9.6
+      '@codemirror/search':
+        specifier: ^6.7.0
+        version: 6.7.0
+      '@codemirror/state':
+        specifier: ^6.6.0
+        version: 6.6.0
+      '@codemirror/theme-one-dark':
+        specifier: ^6.1.3
+        version: 6.1.3
+      '@codemirror/view':
+        specifier: ^6.43.0
+        version: 6.43.0
+      '@lezer/common':
+        specifier: ^1.0.2
+        version: 1.5.2
+      '@lezer/highlight':
+        specifier: ^1.1.3
+        version: 1.2.1
+      '@nxmix/tokenize-ansi':
+        specifier: ^3.0.0
+        version: 3.0.0
+      '@radix-ui/react-dialog':
+        specifier: ^1.1.1
+        version: 1.1.11(@types/react-dom@17.0.25)(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      '@radix-ui/react-slot':
+        specifier: ^1.2.4
+        version: 1.2.4(@types/react@17.0.75)(react@17.0.2)
+      '@reach/combobox':
+        specifier: ^0.18.0
+        version: 0.18.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      '@reach/dialog':
+        specifier: ^0.17.0
+        version: 0.17.0(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      '@reach/menu-button':
+        specifier: ^0.16.1
+        version: 0.16.1(react-dom@17.0.2(react@17.0.2))(react-is@17.0.2)(react@17.0.2)
+      '@reach/popover':
+        specifier: ^0.18.0
+        version: 0.18.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      '@tanstack/react-query':
+        specifier: '4'
+        version: 4.36.1(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      '@tanstack/react-query-devtools':
+        specifier: '4'
+        version: 4.36.1(@tanstack/react-query@4.36.1(react-dom@17.0.2(react@17.0.2))(react@17.0.2))(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      '@tanstack/react-table':
+        specifier: ^8.8.5
+        version: 8.9.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      '@tippyjs/react':
+        specifier: ^4.2.6
+        version: 4.2.6(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      '@uirouter/angularjs':
+        specifier: 1.0.11
+        version: 1.0.11(angular@1.8.2)
+      '@uirouter/react':
+        specifier: ^1.0.7
+        version: 1.0.7(react@17.0.2)
+      '@uirouter/react-hybrid':
+        specifier: ^1.0.4
+        version: 1.0.4(angular@1.8.2)(react@17.0.2)
+      '@uiw/codemirror-themes':
+        specifier: ^4.25.10
+        version: 4.25.10(@codemirror/language@6.12.3)(@codemirror/state@6.6.0)(@codemirror/view@6.43.0)
+      '@uiw/react-codemirror':
+        specifier: ^4.25.10
+        version: 4.25.10(@babel/runtime@7.26.0)(@codemirror/autocomplete@6.20.2)(@codemirror/language@6.12.3)(@codemirror/lint@6.9.6)(@codemirror/search@6.7.0)(@codemirror/state@6.6.0)(@codemirror/theme-one-dark@6.1.3)(@codemirror/view@6.43.0)(codemirror@6.0.1)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      '@wojtekmaj/react-daterange-picker':
+        specifier: ^5.5.0
+        version: 5.5.0(@types/react-dom@17.0.25)(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      '@xterm/addon-fit':
+        specifier: ^0.11.0
+        version: 0.11.0
+      '@xterm/xterm':
+        specifier: ^6.0.0
+        version: 6.0.0
+      angular:
+        specifier: 1.8.2
+        version: 1.8.2
+      angular-clipboard:
+        specifier: ^1.6.2
+        version: 1.7.0(angular@1.8.2)
+      angular-file-saver:
+        specifier: ^1.1.3
+        version: 1.1.3
+      angular-loading-bar:
+        specifier: ~0.9.0
+        version: 0.9.0
+      angular-local-storage:
+        specifier: ~0.5.2
+        version: 0.5.2
+      angular-messages:
+        specifier: 1.8.2
+        version: 1.8.2
+      angular-mocks:
+        specifier: 1.8.2
+        version: 1.8.2
+      angular-resource:
+        specifier: 1.8.2
+        version: 1.8.2
+      angular-sanitize:
+        specifier: 1.8.2
+        version: 1.8.2
+      angular-ui-bootstrap:
+        specifier: ~2.5.0
+        version: 2.5.6
+      angularjs-scroll-glue:
+        specifier: ^2.2.0
+        version: 2.2.0
+      angularjs-slider:
+        specifier: ^6.4.0
+        version: 6.7.0(angular@1.8.2)
+      axios:
+        specifier: ^1.18.0
+        version: 1.18.0
+      axios-cache-interceptor:
+        specifier: ^1.11.2
+        version: 1.11.2(axios@1.18.0)
+      axios-progress-bar:
+        specifier: git://github.com/portainer/progress-bar-4-axios
+        version: https://codeload.github.com/portainer/progress-bar-4-axios/tar.gz/d424cd29f5b629af9ffc5c3d6db8d92d11d82f0f(axios@1.18.0)
+      babel-plugin-angularjs-annotate:
+        specifier: ^0.10.0
+        version: 0.10.0
+      bootstrap:
+        specifier: ^3.4.0
+        version: 3.4.1
+      buffer:
+        specifier: ^6.0.3
+        version: 6.0.3
+      c8:
+        specifier: ^9.1.0
+        version: 9.1.0
+      chardet:
+        specifier: ^1.4.0
+        version: 1.4.0
+      chart.js:
+        specifier: ^2.9.4
+        version: 2.9.4
+      class-variance-authority:
+        specifier: ^0.7.0
+        version: 0.7.1
+      clsx:
+        specifier: ^1.1.1
+        version: 1.1.1
+      codemirror:
+        specifier: ^6.0.1
+        version: 6.0.1
+      codemirror-json-schema:
+        specifier: ^0.8.1
+        version: 0.8.1(@codemirror/language@6.12.3)(@codemirror/lint@6.9.6)(@codemirror/state@6.6.0)(@codemirror/view@6.43.0)(@lezer/common@1.5.2)
+      core-js:
+        specifier: ^3.19.3
+        version: 3.20.0
+      date-fns:
+        specifier: ^2.29.3
+        version: 2.29.3
+      docker-types:
+        specifier: ~1.47
+        version: 1.47.4
+      fast-json-patch:
+        specifier: ^3.1.1
+        version: 3.1.1
+      file-saver:
+        specifier: ^2.0.5
+        version: 2.0.5
+      filesize:
+        specifier: ^10.1.6
+        version: 10.1.6
+      filesize-parser:
+        specifier: ^1.5.0
+        version: 1.5.0
+      formik:
+        specifier: ^2.4.9
+        version: 2.4.9(@types/react@17.0.75)(react@17.0.2)
+      globals:
+        specifier: ^15.15.0
+        version: 15.15.0
+      i18next:
+        specifier: ^21.3.3
+        version: 21.10.0
+      i18next-browser-languagedetector:
+        specifier: ^6.1.2
+        version: 6.1.2
+      i18next-http-backend:
+        specifier: ^3.0.4
+        version: 3.0.4
+      jquery:
+        specifier: ^3.6.0
+        version: 3.6.0
+      js-base64:
+        specifier: ^3.7.2
+        version: 3.7.2
+      jsdom:
+        specifier: ^24
+        version: 24.1.3
+      json-schema:
+        specifier: ^0.4.0
+        version: 0.4.0
+      lodash:
+        specifier: ^4.18.1
+        version: 4.18.1
+      lodash-es:
+        specifier: npm:lodash@4.18.1
+        version: lodash@4.18.1
+      lucide-react:
+        specifier: ^0.577.0
+        version: 0.577.0(react@17.0.2)
+      markdown-to-jsx:
+        specifier: ^7.7.4
+        version: 7.7.4(react@17.0.2)
+      moment:
+        specifier: ^2.30.1
+        version: 2.30.1
+      moment-timezone:
+        specifier: ^0.6.2
+        version: 0.6.2
+      mustache:
+        specifier: ^4.2.0
+        version: 4.2.0
+      ng-file-upload:
+        specifier: ~12.2.13
+        version: 12.2.13
+      parse-duration:
+        specifier: ^2.1.4
+        version: 2.1.4
+      qs:
+        specifier: ^6.14.1
+        version: 6.14.1
+      rc-slider:
+        specifier: ^10.0.0
+        version: 10.1.1(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      react:
+        specifier: ^17.0.2
+        version: 17.0.2
+      react-calendar:
+        specifier: ^4.8.0
+        version: 4.8.0(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      react-codemirror-merge:
+        specifier: ^4.23.11
+        version: 4.23.11(@babel/runtime@7.26.0)(@codemirror/autocomplete@6.20.2)(@codemirror/language@6.12.3)(@codemirror/lint@6.9.6)(@codemirror/search@6.7.0)(@codemirror/state@6.6.0)(@codemirror/theme-one-dark@6.1.3)(@codemirror/view@6.43.0)(codemirror@6.0.1)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      react-datetime-picker:
+        specifier: ^5.6.0
+        version: 5.6.0(@types/react-dom@17.0.25)(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      react-dom:
+        specifier: ^17.0.2
+        version: 17.0.2(react@17.0.2)
+      react-i18next:
+        specifier: ^11.12.0
+        version: 11.15.3(i18next@21.10.0)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      react-is:
+        specifier: ^17.0.2
+        version: 17.0.2
+      react-json-view-lite:
+        specifier: ^1.5.0
+        version: 1.5.0(react@17.0.2)
+      react-select:
+        specifier: ^5.10.2
+        version: 5.10.2(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      react-select-async-paginate:
+        specifier: ^0.7.11
+        version: 0.7.11(@types/react@17.0.75)(react-select@5.10.2(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2))(react@17.0.2)
+      sanitize-html:
+        specifier: ^2.17.0
+        version: 2.17.0
+      spinkit:
+        specifier: ^2.0.1
+        version: 2.0.1
+      strip-ansi:
+        specifier: ^6.0.0
+        version: 6.0.1
+      tailwindcss-animate:
+        specifier: ^1.0.7
+        version: 1.0.7(tailwindcss@3.3.3)
+      tippy.js:
+        specifier: ^6.3.7
+        version: 6.3.7
+      toastr:
+        specifier: ^2.1.4
+        version: 2.1.4
+      ts-xor:
+        specifier: ^1.1.0
+        version: 1.1.0
+      uuid:
+        specifier: ^3.3.2
+        version: 3.4.0
+      yaml:
+        specifier: ^1.10.2
+        version: 1.10.2
+      yup:
+        specifier: ^0.32.11
+        version: 0.32.11
+      zod:
+        specifier: 4.3.6
+        version: 4.3.6
+      zustand:
+        specifier: ^4.1.1
+        version: 4.1.1(react@17.0.2)
+    devDependencies:
+      '@apidevtools/swagger-cli':
+        specifier: ^4.0.4
+        version: 4.0.4(openapi-types@12.1.3)
+      '@babel/core':
+        specifier: ^7.23.0
+        version: 7.29.0
+      '@babel/preset-env':
+        specifier: ^7.22.20
+        version: 7.23.6(@babel/core@7.29.0)
+      '@babel/preset-react':
+        specifier: ^7.22.15
+        version: 7.22.15(@babel/core@7.29.0)
+      '@babel/preset-typescript':
+        specifier: ^7.23.0
+        version: 7.23.0(@babel/core@7.29.0)
+      '@chromatic-com/storybook':
+        specifier: ^5.1.2
+        version: 5.1.2(storybook@10.4.2(@testing-library/dom@9.3.4)(@types/react@17.0.75)(prettier@3.8.3)(react-dom@17.0.2(react@17.0.2))(react@17.0.2))
+      '@eslint-community/eslint-plugin-eslint-comments':
+        specifier: ^4.7.2
+        version: 4.7.2(eslint@9.39.4(jiti@2.7.0))
+      '@eslint/eslintrc':
+        specifier: ^3.3.5
+        version: 3.3.5
+      '@eslint/js':
+        specifier: ^10.0.1
+        version: 10.0.1(eslint@9.39.4(jiti@2.7.0))
+      '@hey-api/openapi-ts':
+        specifier: 0.99.0
+        version: 0.99.0(magicast@0.5.2)(typescript@6.0.2)
+      '@simbathesailor/use-what-changed':
+        specifier: ^2.0.0
+        version: 2.0.0(react@17.0.2)
+      '@storybook/addon-docs':
+        specifier: 10.4.2
+        version: 10.4.2(@types/react-dom@17.0.25)(@types/react@17.0.75)(esbuild@0.27.3)(rollup@4.54.0)(storybook@10.4.2(@testing-library/dom@9.3.4)(@types/react@17.0.75)(prettier@3.8.3)(react-dom@17.0.2(react@17.0.2))(react@17.0.2))(vite@8.0.16(@types/node@25.0.3)(esbuild@0.27.3)(jiti@2.7.0)(less@4.4.2)(terser@5.44.1)(yaml@1.10.2))(webpack@5.107.2)
+      '@storybook/addon-links':
+        specifier: 10.4.2
+        version: 10.4.2(@types/react@17.0.75)(react@17.0.2)(storybook@10.4.2(@testing-library/dom@9.3.4)(@types/react@17.0.75)(prettier@3.8.3)(react-dom@17.0.2(react@17.0.2))(react@17.0.2))
+      '@storybook/addon-styling-webpack':
+        specifier: ^3.0.2
+        version: 3.0.2(storybook@10.4.2(@testing-library/dom@9.3.4)(@types/react@17.0.75)(prettier@3.8.3)(react-dom@17.0.2(react@17.0.2))(react@17.0.2))(webpack@5.107.2)
+      '@storybook/addon-webpack5-compiler-swc':
+        specifier: ^4.0.3
+        version: 4.0.3(storybook@10.4.2(@testing-library/dom@9.3.4)(@types/react@17.0.75)(prettier@3.8.3)(react-dom@17.0.2(react@17.0.2))(react@17.0.2))(webpack@5.107.2)
+      '@storybook/react-webpack5':
+        specifier: 10.4.2
+        version: 10.4.2(@swc/core@1.15.11)(@types/react-dom@17.0.25)(@types/react@17.0.75)(cssnano@8.0.1(postcss@8.5.15))(esbuild@0.27.3)(postcss@8.5.15)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)(storybook@10.4.2(@testing-library/dom@9.3.4)(@types/react@17.0.75)(prettier@3.8.3)(react-dom@17.0.2(react@17.0.2))(react@17.0.2))(typescript@6.0.2)(webpack-cli@6.0.1)
+      '@svgr/webpack':
+        specifier: ^8.1.0
+        version: 8.1.0
+      '@testing-library/dom':
+        specifier: ^9.3.4
+        version: 9.3.4
+      '@testing-library/jest-dom':
+        specifier: ^6.9.1
+        version: 6.9.1
+      '@testing-library/react':
+        specifier: ^12
+        version: 12.1.5(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      '@testing-library/react-hooks':
+        specifier: ^8.0.1
+        version: 8.0.1(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      '@testing-library/user-event':
+        specifier: ^14.6.1
+        version: 14.6.1(@testing-library/dom@9.3.4)
+      '@types/angular':
+        specifier: ^1.8.3
+        version: 1.8.9
+      '@types/file-saver':
+        specifier: ^2.0.4
+        version: 2.0.7
+      '@types/filesize':
+        specifier: ^5.0.2
+        version: 5.0.2
+      '@types/filesize-parser':
+        specifier: ^1.5.1
+        version: 1.5.3
+      '@types/jquery':
+        specifier: ^3.5.10
+        version: 3.5.33
+      '@types/json-schema':
+        specifier: ^7.0.15
+        version: 7.0.15
+      '@types/lodash':
+        specifier: ^4.17.24
+        version: 4.17.24
+      '@types/mustache':
+        specifier: ^4.1.2
+        version: 4.2.6
+      '@types/node':
+        specifier: ^25
+        version: 25.0.3
+      '@types/nprogress':
+        specifier: ^0.2.0
+        version: 0.2.3
+      '@types/qs':
+        specifier: ^6.9.17
+        version: 6.14.0
+      '@types/react':
+        specifier: ^17.0.37
+        version: 17.0.75
+      '@types/react-datetime-picker':
+        specifier: ^3.4.1
+        version: 3.4.1
+      '@types/react-dom':
+        specifier: ^17.0.11
+        version: 17.0.25
+      '@types/react-is':
+        specifier: ^17.0.3
+        version: 17.0.7
+      '@types/sanitize-html':
+        specifier: ^2.8.0
+        version: 2.16.0
+      '@types/toastr':
+        specifier: ^2.1.39
+        version: 2.1.43
+      '@types/uuid':
+        specifier: ^3.3.2
+        version: 3.4.13
+      '@typescript-eslint/eslint-plugin':
+        specifier: ^8.61.1
+        version: 8.61.1(@typescript-eslint/parser@8.61.1(eslint@9.39.4(jiti@2.7.0))(typescript@6.0.2))(eslint@9.39.4(jiti@2.7.0))(typescript@6.0.2)
+      '@typescript-eslint/parser':
+        specifier: ^8.61.1
+        version: 8.61.1(eslint@9.39.4(jiti@2.7.0))(typescript@6.0.2)
+      '@vitest/coverage-v8':
+        specifier: ^4.1.8
+        version: 4.1.8(vitest@4.1.8)
+      '@vitest/eslint-plugin':
+        specifier: ^1.6.20
+        version: 1.6.20(@typescript-eslint/eslint-plugin@8.61.1(@typescript-eslint/parser@8.61.1(eslint@9.39.4(jiti@2.7.0))(typescript@6.0.2))(eslint@9.39.4(jiti@2.7.0))(typescript@6.0.2))(eslint@9.39.4(jiti@2.7.0))(typescript@6.0.2)(vitest@4.1.8)
+      auto-ngtemplate-loader:
+        specifier: ^3.1.2
+        version: 3.1.2(webpack@5.107.2)
+      autoprefixer:
+        specifier: ^10.5.0
+        version: 10.5.0(postcss@8.5.15)
+      babel-loader:
+        specifier: ^9.1.3
+        version: 9.1.3(@babel/core@7.29.0)(webpack@5.107.2)
+      babel-plugin-i18next-extract:
+        specifier: ^0.9.0
+        version: 0.9.0
+      babel-plugin-lodash:
+        specifier: ^3.3.4
+        version: 3.3.4
+      clean-webpack-plugin:
+        specifier: ^4.0.0
+        version: 4.0.0(webpack@5.107.2)
+      copy-webpack-plugin:
+        specifier: ^11.0.0
+        version: 11.0.0(webpack@5.107.2)
+      css-loader:
+        specifier: ^6.8.1
+        version: 6.8.1(webpack@5.107.2)
+      cssnano:
+        specifier: ^8.0.1
+        version: 8.0.1(postcss@8.5.15)
+      dotenv-webpack:
+        specifier: ^8.0.1
+        version: 8.0.1(webpack@5.107.2)
+      eslint:
+        specifier: ^9.39.4
+        version: 9.39.4(jiti@2.7.0)
+      eslint-config-prettier:
+        specifier: ^10.1.8
+        version: 10.1.8(eslint@9.39.4(jiti@2.7.0))
+      eslint-import-resolver-alias:
+        specifier: ^1.1.2
+        version: 1.1.2(eslint-plugin-import@2.32.0)
+      eslint-import-resolver-typescript:
+        specifier: ^4.4.5
+        version: 4.4.5(eslint-plugin-import@2.32.0)(eslint@9.39.4(jiti@2.7.0))
+      eslint-plugin-eslint-comments:
+        specifier: ^3.2.0
+        version: 3.2.0(eslint@9.39.4(jiti@2.7.0))
+      eslint-plugin-import:
+        specifier: ^2.32.0
+        version: 2.32.0(@typescript-eslint/parser@8.61.1(eslint@9.39.4(jiti@2.7.0))(typescript@6.0.2))(eslint-import-resolver-typescript@4.4.5)(eslint@9.39.4(jiti@2.7.0))
+      eslint-plugin-jsx-a11y:
+        specifier: ^6.10.2
+        version: 6.10.2(eslint@9.39.4(jiti@2.7.0))
+      eslint-plugin-promise:
+        specifier: ^7.3.0
+        version: 7.3.0(eslint@9.39.4(jiti@2.7.0))
+      eslint-plugin-react:
+        specifier: ^7.37.5
+        version: 7.37.5(eslint@9.39.4(jiti@2.7.0))
+      eslint-plugin-react-hooks:
+        specifier: ^7.1.1
+        version: 7.1.1(eslint@9.39.4(jiti@2.7.0))
+      eslint-plugin-regex:
+        specifier: ^1.10.0
+        version: 1.10.0(eslint@9.39.4(jiti@2.7.0))
+      eslint-plugin-storybook:
+        specifier: ^10.4.6
+        version: 10.4.6(eslint@9.39.4(jiti@2.7.0))(storybook@10.4.2(@testing-library/dom@9.3.4)(@types/react@17.0.75)(prettier@3.8.3)(react-dom@17.0.2(react@17.0.2))(react@17.0.2))(typescript@6.0.2)
+      html-loader:
+        specifier: ^5.1.0
+        version: 5.1.0(webpack@5.107.2)
+      html-webpack-plugin:
+        specifier: ^5.5.3
+        version: 5.5.3(webpack@5.107.2)
+      husky:
+        specifier: ^8.0.0
+        version: 8.0.3
+      kubernetes-types:
+        specifier: ^1.30.0
+        version: 1.30.0
+      lint-staged:
+        specifier: ^17.0.7
+        version: 17.0.7
+      lodash-webpack-plugin:
+        specifier: ^0.11.6
+        version: 0.11.6(webpack@5.107.2)
+      mini-css-extract-plugin:
+        specifier: ^2.7.6
+        version: 2.7.6(webpack@5.107.2)
+      msw:
+        specifier: ^2.14.6
+        version: 2.14.6(@types/node@25.0.3)(typescript@6.0.2)
+      msw-storybook-addon:
+        specifier: ^2.0.7
+        version: 2.0.7(msw@2.14.6(@types/node@25.0.3)(typescript@6.0.2))
+      ngtemplate-loader:
+        specifier: ^2.1.0
+        version: 2.1.0
+      postcss:
+        specifier: ^8.5.15
+        version: 8.5.15
+      postcss-loader:
+        specifier: ^7.3.3
+        version: 7.3.3(postcss@8.5.15)(webpack@5.107.2)
+      prettier:
+        specifier: ^3.8.3
+        version: 3.8.3
+      prettier-plugin-tailwindcss:
+        specifier: ^0.8.0
+        version: 0.8.0(prettier@3.8.3)
+      react-docgen-typescript-plugin:
+        specifier: ^1.0.5
+        version: 1.0.5(typescript@6.0.2)(webpack@5.107.2)
+      source-map-loader:
+        specifier: ^4.0.1
+        version: 4.0.1(webpack@5.107.2)
+      speed-measure-webpack-plugin:
+        specifier: ^1.5.0
+        version: 1.5.0(webpack@5.107.2)
+      storybook:
+        specifier: 10.4.2
+        version: 10.4.2(@testing-library/dom@9.3.4)(@types/react@17.0.75)(prettier@3.8.3)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      storybook-css-modules-preset:
+        specifier: ^1.1.1
+        version: 1.1.1
+      style-loader:
+        specifier: ^3.3.3
+        version: 3.3.3(webpack@5.107.2)
+      swagger2openapi:
+        specifier: ^7.0.8
+        version: 7.0.8
+      tailwindcss:
+        specifier: 3.3.3
+        version: 3.3.3
+      typescript:
+        specifier: ^6.0.2
+        version: 6.0.2
+      typescript-eslint:
+        specifier: ^8.61.1
+        version: 8.61.1(eslint@9.39.4(jiti@2.7.0))(typescript@6.0.2)
+      vite:
+        specifier: ^8.0.16
+        version: 8.0.16(@types/node@25.0.3)(esbuild@0.27.3)(jiti@2.7.0)(less@4.4.2)(terser@5.44.1)(yaml@1.10.2)
+      vite-plugin-svgr:
+        specifier: ^4.5.0
+        version: 4.5.0(rollup@4.54.0)(vite@8.0.16(@types/node@25.0.3)(esbuild@0.27.3)(jiti@2.7.0)(less@4.4.2)(terser@5.44.1)(yaml@1.10.2))
+      vite-tsconfig-paths:
+        specifier: ^4.3.1
+        version: 4.3.1(typescript@6.0.2)(vite@8.0.16(@types/node@25.0.3)(esbuild@0.27.3)(jiti@2.7.0)(less@4.4.2)(terser@5.44.1)(yaml@1.10.2))
+      vitest:
+        specifier: ^4.1.8
+        version: 4.1.8(@types/node@25.0.3)(@vitest/coverage-v8@4.1.8)(jsdom@24.1.3)(msw@2.14.6(@types/node@25.0.3)(typescript@6.0.2))(vite@8.0.16(@types/node@25.0.3)(esbuild@0.27.3)(jiti@2.7.0)(less@4.4.2)(terser@5.44.1)(yaml@1.10.2))
+      webpack:
+        specifier: ^5.107.2
+        version: 5.107.2(@swc/core@1.15.11)(cssnano@8.0.1(postcss@8.5.15))(esbuild@0.27.3)(postcss@8.5.15)(webpack-cli@6.0.1)
+      webpack-build-notifier:
+        specifier: ^3.1.0
+        version: 3.1.0(webpack@5.107.2)
+      webpack-bundle-analyzer:
+        specifier: ^5.2.0
+        version: 5.2.0
+      webpack-cli:
+        specifier: ^6.0.1
+        version: 6.0.1(webpack-bundle-analyzer@5.2.0)(webpack-dev-server@5.2.4)(webpack@5.107.2)
+      webpack-dev-server:
+        specifier: ^5.2.4
+        version: 5.2.4(tslib@2.8.1)(webpack-cli@6.0.1)(webpack@5.107.2)
+      webpack-merge:
+        specifier: ^6.0.1
+        version: 6.0.1
+
+packages:
+
+  '@aashutoshrathi/word-wrap@1.2.6':
+    resolution: {integrity: sha512-1Yjs2SvM8TflER/OD3cOjhWWOZb58A2t7wpE2S9XfBYTiIl+XFhQG2bjy4Pu1I+EAlCNUzRDYDdFwFYUKvXcIA==}
+    engines: {node: '>=0.10.0'}
+
+  '@adobe/css-tools@4.4.4':
+    resolution: {integrity: sha512-Elp+iwUx5rN5+Y8xLt5/GRoG20WGoDCQ/1Fb+1LiGtvwbDavuSk0jhD/eZdckHAuzcDzccnkv+rEjyWfRx18gg==}
+
+  '@alloc/quick-lru@5.2.0':
+    resolution: {integrity: sha512-UrcABB+4bUrFABwbluTIBErXwvbsU/V7TZWfmbgJfbkwiBuziS9gxdODUyuiecfdGQ85jglMW6juS3+z5TsKLw==}
+    engines: {node: '>=10'}
+
+  '@apidevtools/json-schema-ref-parser@9.0.9':
+    resolution: {integrity: sha512-GBD2Le9w2+lVFoc4vswGI/TjkNIZSVp7+9xPf+X3uidBfWnAeUWmquteSyt0+VCrhNMWj/FTABISQrD3Z/YA+w==}
+
+  '@apidevtools/openapi-schemas@2.1.0':
+    resolution: {integrity: sha512-Zc1AlqrJlX3SlpupFGpiLi2EbteyP7fXmUOGup6/DnkRgjP9bgMM/ag+n91rsv0U1Gpz0H3VILA/o3bW7Ua6BQ==}
+    engines: {node: '>=10'}
+
+  '@apidevtools/swagger-cli@4.0.4':
+    resolution: {integrity: sha512-hdDT3B6GLVovCsRZYDi3+wMcB1HfetTU20l2DC8zD3iFRNMC6QNAZG5fo/6PYeHWBEv7ri4MvnlKodhNB0nt7g==}
+    engines: {node: '>=10'}
+    hasBin: true
+
+  '@apidevtools/swagger-methods@3.0.2':
+    resolution: {integrity: sha512-QAkD5kK2b1WfjDS/UQn/qQkbwF31uqRjPTrsCs5ZG9BQGAkjwvqGFjjPqAuzac/IYzpPtRzjCP1WrTuAIjMrXg==}
+
+  '@apidevtools/swagger-parser@10.0.3':
+    resolution: {integrity: sha512-sNiLY51vZOmSPFZA5TF35KZ2HbgYklQnTSDnkghamzLb3EkNtcQnrBQEj5AOCxHpTtXpqMCRM1CrmV2rG6nw4g==}
+    peerDependencies:
+      openapi-types: '>=7'
+
+  '@aws-crypto/sha256-js@2.0.1':
+    resolution: {integrity: sha512-mbHTBSPBvg6o/mN/c18Z/zifM05eJrapj5ggoOIeHIWckvkv5VgGi7r/wYpt+QAO2ySKXLNvH2d8L7bne4xrMQ==}
+
+  '@aws-crypto/util@2.0.1':
+    resolution: {integrity: sha512-JJmFFwvbm08lULw4Nm5QOLg8+lAQeC8aCXK5xrtxntYzYXCGfHwUJ4Is3770Q7HmICsXthGQ+ZsDL7C2uH3yBQ==}
+
+  '@aws-sdk/types@3.40.0':
+    resolution: {integrity: sha512-KpILcfvRaL88TLvo3SY4OuCCg90SvcNLPyjDwUuBqiOyWODjrKShHtAPJzej4CLp92lofh+ul0UnBfV9Jb/5PA==}
+    engines: {node: '>= 10.0.0'}
+
+  '@aws-sdk/util-utf8-browser@3.37.0':
+    resolution: {integrity: sha512-tuiOxzfqet1kKGYzlgpMGfhr64AHJnYsFx2jZiH/O6Yq8XQg43ryjQlbJlim/K/XHGNzY0R+nabeJg34q3Ua1g==}
+
+  '@babel/code-frame@7.29.0':
+    resolution: {integrity: sha512-9NhCeYjq9+3uxgdtp20LSiJXJvN0FeCtNGpJxuMFZ1Kv3cWUNb6DOhJwUvcVCzKGR66cw4njwM6hrJLqgOwbcw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/compat-data@7.29.0':
+    resolution: {integrity: sha512-T1NCJqT/j9+cn8fvkt7jtwbLBfLC/1y1c7NtCeXFRgzGTsafi68MRv8yzkYSapBnFA6L3U2VSc02ciDzoAJhJg==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/core@7.29.0':
+    resolution: {integrity: sha512-CGOfOJqWjg2qW/Mb6zNsDm+u5vFQ8DxXfbM09z69p5Z6+mE1ikP2jUXw+j42Pf1XTYED2Rni5f95npYeuwMDQA==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/generator@7.29.1':
+    resolution: {integrity: sha512-qsaF+9Qcm2Qv8SRIMMscAvG4O3lJ0F1GuMo5HR/Bp02LopNgnZBC/EkbevHFeGs4ls/oPz9v+Bsmzbkbe+0dUw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-annotate-as-pure@7.22.5':
+    resolution: {integrity: sha512-LvBTxu8bQSQkcyKOU+a1btnNFQ1dMAd0R6PyW3arXes06F6QLWLIrd681bxRPIXlrMGR3XYnW9JyML7dP3qgxg==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-builder-binary-assignment-operator-visitor@7.22.15':
+    resolution: {integrity: sha512-QkBXwGgaoC2GtGZRoma6kv7Szfv06khvhFav67ZExau2RaXzy8MpHSMO2PNoP2XtmQphJQRHFfg77Bq731Yizw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-compilation-targets@7.28.6':
+    resolution: {integrity: sha512-JYtls3hqi15fcx5GaSNL7SCTJ2MNmjrkHXg4FSpOA/grxK8KwyZ5bubHsCq8FXCkua6xhuaaBit+3b7+VZRfcA==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-create-class-features-plugin@7.22.15':
+    resolution: {integrity: sha512-jKkwA59IXcvSaiK2UN45kKwSC9o+KuoXsBDvHvU/7BecYIp8GQ2UwrVvFgJASUT+hBnwJx6MhvMCuMzwZZ7jlg==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0
+
+  '@babel/helper-create-regexp-features-plugin@7.22.15':
+    resolution: {integrity: sha512-29FkPLFjn4TPEa3RE7GpW+qbE8tlsu3jntNYNfcGsc49LphF1PQIiD+vMZ1z1xVOKt+93khA9tc2JBs3kBjA7w==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0
+
+  '@babel/helper-define-polyfill-provider@0.4.4':
+    resolution: {integrity: sha512-QcJMILQCu2jm5TFPGA3lCpJJTeEP+mqeXooG/NZbg/h5FTFi6V0+99ahlRsW8/kRLyb24LZVCCiclDedhLKcBA==}
+    peerDependencies:
+      '@babel/core': ^7.4.0 || ^8.0.0-0 <8.0.0
+
+  '@babel/helper-environment-visitor@7.22.20':
+    resolution: {integrity: sha512-zfedSIzFhat/gFhWfHtgWvlec0nqB9YEIVrpuwjruLlXfUSnA8cJB0miHKwqDnQ7d32aKo2xt88/xZptwxbfhA==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-function-name@7.23.0':
+    resolution: {integrity: sha512-OErEqsrxjZTJciZ4Oo+eoZqeW9UIiOcuYKRJA4ZAgV9myA+pOXhhmpfNCKjEH/auVfEYVFJ6y1Tc4r0eIApqiw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-globals@7.28.0':
+    resolution: {integrity: sha512-+W6cISkXFa1jXsDEdYA8HeevQT/FULhxzR99pxphltZcVaugps53THCeiWA8SguxxpSp3gKPiuYfSWopkLQ4hw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-hoist-variables@7.22.5':
+    resolution: {integrity: sha512-wGjk9QZVzvknA6yKIUURb8zY3grXCcOZt+/7Wcy8O2uctxhplmUPkOdlgoNhmdVee2c92JXbf1xpMtVNbfoxRw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-member-expression-to-functions@7.23.0':
+    resolution: {integrity: sha512-6gfrPwh7OuT6gZyJZvd6WbTfrqAo7vm4xCzAXOusKqq/vWdKXphTpj5klHKNmRUU6/QRGlBsyU9mAIPaWHlqJA==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-module-imports@7.28.6':
+    resolution: {integrity: sha512-l5XkZK7r7wa9LucGw9LwZyyCUscb4x37JWTPz7swwFE/0FMQAGpiWUZn8u9DzkSBWEcK25jmvubfpw2dnAMdbw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-module-transforms@7.28.6':
+    resolution: {integrity: sha512-67oXFAYr2cDLDVGLXTEABjdBJZ6drElUSI7WKp70NrpyISso3plG9SAGEF6y7zbha/wOzUByWWTJvEDVNIUGcA==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0
+
+  '@babel/helper-optimise-call-expression@7.22.5':
+    resolution: {integrity: sha512-HBwaojN0xFRx4yIvpwGqxiV2tUfl7401jlok564NgB9EHS1y6QT17FmKWm4ztqjeVdXLuC4fSvHc5ePpQjoTbw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-plugin-utils@7.22.5':
+    resolution: {integrity: sha512-uLls06UVKgFG9QD4OeFYLEGteMIAa5kpTPcFL28yuCIIzsf6ZyKZMllKVOCZFhiZ5ptnwX4mtKdWCBE/uT4amg==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-remap-async-to-generator@7.22.20':
+    resolution: {integrity: sha512-pBGyV4uBqOns+0UvhsTO8qgl8hO89PmiDYv+/COyp1aeMcmfrfruz+/nCMFiYyFF/Knn0yfrC85ZzNFjembFTw==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0
+
+  '@babel/helper-replace-supers@7.22.20':
+    resolution: {integrity: sha512-qsW0In3dbwQUbK8kejJ4R7IHVGwHJlV6lpG6UA7a9hSa2YEiAib+N1T2kr6PEeUT+Fl7najmSOS6SmAwCHK6Tw==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0
+
+  '@babel/helper-simple-access@7.22.5':
+    resolution: {integrity: sha512-n0H99E/K+Bika3++WNL17POvo4rKWZ7lZEp1Q+fStVbUi8nxPQEBOlTmCOxW/0JsS56SKKQ+ojAe2pHKJHN35w==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-skip-transparent-expression-wrappers@7.22.5':
+    resolution: {integrity: sha512-tK14r66JZKiC43p8Ki33yLBVJKlQDFoA8GYN67lWCDCqoL6EMMSuM9b+Iff2jHaM/RRFYl7K+iiru7hbRqNx8Q==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-split-export-declaration@7.22.6':
+    resolution: {integrity: sha512-AsUnxuLhRYsisFiaJwvp1QF+I3KjD5FOxut14q/GzovUe6orHLesW2C7d754kRm53h5gqrz6sFl6sxc4BVtE/g==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-string-parser@7.27.1':
+    resolution: {integrity: sha512-qMlSxKbpRlAridDExk92nSobyDdpPijUq2DW6oDnUqd0iOGxmQjyqhMIihI9+zv4LPyZdRje2cavWPbCbWm3eA==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-validator-identifier@7.28.5':
+    resolution: {integrity: sha512-qSs4ifwzKJSV39ucNjsvc6WVHs6b7S03sOh2OcHF9UHfVPqWWALUsNUVzhSBiItjRZoLHx7nIarVjqKVusUZ1Q==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-validator-option@7.27.1':
+    resolution: {integrity: sha512-YvjJow9FxbhFFKDSuFnVCe2WxXk1zWc22fFePVNEaWJEu8IrZVlda6N0uHwzZrUM1il7NC9Mlp4MaJYbYd9JSg==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-wrap-function@7.22.20':
+    resolution: {integrity: sha512-pms/UwkOpnQe/PDAEdV/d7dVCoBbB+R4FvYoHGZz+4VPcg7RtYy2KP7S2lbuWM6FCSgob5wshfGESbC/hzNXZw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helpers@7.29.2':
+    resolution: {integrity: sha512-HoGuUs4sCZNezVEKdVcwqmZN8GoHirLUcLaYVNBK2J0DadGtdcqgr3BCbvH8+XUo4NGjNl3VOtSjEKNzqfFgKw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/parser@7.29.0':
+    resolution: {integrity: sha512-IyDgFV5GeDUVX4YdF/3CPULtVGSXXMLh1xVIgdCgxApktqnQV0r7/8Nqthg+8YLGaAtdyIlo2qIdZrbCv4+7ww==}
+    engines: {node: '>=6.0.0'}
+    hasBin: true
+
+  '@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression@7.23.3':
+    resolution: {integrity: sha512-iRkKcCqb7iGnq9+3G6rZ+Ciz5VywC4XNRHe57lKM+jOeYAoR0lVqdeeDRfh0tQcTfw/+vBhHn926FmQhLtlFLQ==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0
+
+  '@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@7.23.3':
+    resolution: {integrity: sha512-WwlxbfMNdVEpQjZmK5mhm7oSwD3dS6eU+Iwsi4Knl9wAletWem7kaRsGOG+8UEbRyqxY4SS5zvtfXwX+jMxUwQ==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.13.0
+
+  '@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly@7.23.3':
+    resolution: {integrity: sha512-XaJak1qcityzrX0/IU5nKHb34VaibwP3saKqG6a/tppelgllOH13LUann4ZCIBcVOeE6H18K4Vx9QKkVww3z/w==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0
+
+  '@babel/plugin-proposal-private-property-in-object@7.21.0-placeholder-for-preset-env.2':
+    resolution: {integrity: sha512-SOSkfJDddaM7mak6cPEpswyTRnuRltl429hMraQEglW+OkovnCzsiszTmsrlY//qLFjCpQDFRvjdm2wA5pPm9w==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-syntax-async-generators@7.8.4':
+    resolution: {integrity: sha512-tycmZxkGfZaxhMRbXlPXuVFpdWlXpir2W4AMhSJgRKzk/eDlIXOhb2LHWoLpDF7TEHylV5zNhykX6KAgHJmTNw==}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-syntax-class-properties@7.12.13':
+    resolution: {integrity: sha512-fm4idjKla0YahUNgFNLCB0qySdsoPiZP3iQE3rky0mBUtMZ23yDJ9SJdg6dXTSDnulOVqiF3Hgr9nbXvXTQZYA==}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-syntax-class-static-block@7.14.5':
+    resolution: {integrity: sha512-b+YyPmr6ldyNnM6sqYeMWE+bgJcJpO6yS4QD7ymxgH34GBPNDM/THBh8iunyvKIZztiwLH4CJZ0RxTk9emgpjw==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-syntax-dynamic-import@7.8.3':
+    resolution: {integrity: sha512-5gdGbFon+PszYzqs83S3E5mpi7/y/8M9eC90MRTZfduQOYW76ig6SOSPNe41IG5LoP3FGBn2N0RjVDSQiS94kQ==}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-syntax-export-namespace-from@7.8.3':
+    resolution: {integrity: sha512-MXf5laXo6c1IbEbegDmzGPwGNTsHZmEy6QGznu5Sh2UCWvueywb2ee+CCE4zQiZstxU9BMoQO9i6zUFSY0Kj0Q==}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-syntax-import-assertions@7.23.3':
+    resolution: {integrity: sha512-lPgDSU+SJLK3xmFDTV2ZRQAiM7UuUjGidwBywFavObCiZc1BeAAcMtHJKUya92hPHO+at63JJPLygilZard8jw==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-syntax-import-attributes@7.23.3':
+    resolution: {integrity: sha512-pawnE0P9g10xgoP7yKr6CK63K2FMsTE+FZidZO/1PwRdzmAPVs+HS1mAURUsgaoxammTJvULUdIkEK0gOcU2tA==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-syntax-import-meta@7.10.4':
+    resolution: {integrity: sha512-Yqfm+XDx0+Prh3VSeEQCPU81yC+JWZ2pDPFSS4ZdpfZhp4MkFMaDC1UqseovEKwSUpnIL7+vK+Clp7bfh0iD7g==}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-syntax-json-strings@7.8.3':
+    resolution: {integrity: sha512-lY6kdGpWHvjoe2vk4WrAapEuBR69EMxZl+RoGRhrFGNYVK8mOPAW8VfbT/ZgrFbXlDNiiaxQnAtgVCZ6jv30EA==}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-syntax-jsx@7.22.5':
+    resolution: {integrity: sha512-gvyP4hZrgrs/wWMaocvxZ44Hw0b3W8Pe+cMxc8V1ULQ07oh8VNbIRaoD1LRZVTvD+0nieDKjfgKg89sD7rrKrg==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-syntax-logical-assignment-operators@7.10.4':
+    resolution: {integrity: sha512-d8waShlpFDinQ5MtvGU9xDAOzKH47+FFoney2baFIoMr952hKOLp1HR7VszoZvOsV/4+RRszNY7D17ba0te0ig==}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-syntax-nullish-coalescing-operator@7.8.3':
+    resolution: {integrity: sha512-aSff4zPII1u2QD7y+F8oDsz19ew4IGEJg9SVW+bqwpwtfFleiQDMdzA/R+UlWDzfnHFCxxleFT0PMIrR36XLNQ==}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-syntax-numeric-separator@7.10.4':
+    resolution: {integrity: sha512-9H6YdfkcK/uOnY/K7/aA2xpzaAgkQn37yzWUMRK7OaPOqOpGS1+n0H5hxT9AUw9EsSjPW8SVyMJwYRtWs3X3ug==}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-syntax-object-rest-spread@7.8.3':
+    resolution: {integrity: sha512-XoqMijGZb9y3y2XskN+P1wUGiVwWZ5JmoDRwx5+3GmEplNyVM2s2Dg8ILFQm8rWM48orGy5YpI5Bl8U1y7ydlA==}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-syntax-optional-catch-binding@7.8.3':
+    resolution: {integrity: sha512-6VPD0Pc1lpTqw0aKoeRTMiB+kWhAoT24PA+ksWSBrFtl5SIRVpZlwN3NNPQjehA2E/91FV3RjLWoVTglWcSV3Q==}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-syntax-optional-chaining@7.8.3':
+    resolution: {integrity: sha512-KoK9ErH1MBlCPxV0VANkXW2/dw4vlbGDrFgz8bmUsBGYkFRcbRwMh6cIJubdPrkxRwuGdtCk0v/wPTKbQgBjkg==}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-syntax-private-property-in-object@7.14.5':
+    resolution: {integrity: sha512-0wVnp9dxJ72ZUJDV27ZfbSj6iHLoytYZmh3rFcxNnvsJF3ktkzLDZPy/mA17HGsaQT3/DQsWYX1f1QGWkCoVUg==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-syntax-top-level-await@7.14.5':
+    resolution: {integrity: sha512-hx++upLv5U1rgYfwe1xBQUhRmU41NEvpUvrp8jkrSCdvGSnM5/qdRMtylJ6PG5OFkBaHkbTAKTnd3/YyESRHFw==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-syntax-typescript@7.22.5':
+    resolution: {integrity: sha512-1mS2o03i7t1c6VzH6fdQ3OA8tcEIxwG18zIPRp+UY1Ihv6W+XZzBCVxExF9upussPXJ0xE9XRHwMoNs1ep/nRQ==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-syntax-unicode-sets-regex@7.18.6':
+    resolution: {integrity: sha512-727YkEAPwSIQTv5im8QHz3upqp92JTWhidIC81Tdx4VJYIte/VndKf1qKrfnnhPLiPghStWfvC/iFaMCQu7Nqg==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0
+
+  '@babel/plugin-transform-arrow-functions@7.23.3':
+    resolution: {integrity: sha512-NzQcQrzaQPkaEwoTm4Mhyl8jI1huEL/WWIEvudjTCMJ9aBZNpsJbMASx7EQECtQQPS/DcnFpo0FIh3LvEO9cxQ==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-async-generator-functions@7.23.4':
+    resolution: {integrity: sha512-efdkfPhHYTtn0G6n2ddrESE91fgXxjlqLsnUtPWnJs4a4mZIbUaK7ffqKIIUKXSHwcDvaCVX6GXkaJJFqtX7jw==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-async-to-generator@7.23.3':
+    resolution: {integrity: sha512-A7LFsKi4U4fomjqXJlZg/u0ft/n8/7n7lpffUP/ZULx/DtV9SGlNKZolHH6PE8Xl1ngCc0M11OaeZptXVkfKSw==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-block-scoped-functions@7.23.3':
+    resolution: {integrity: sha512-vI+0sIaPIO6CNuM9Kk5VmXcMVRiOpDh7w2zZt9GXzmE/9KD70CUEVhvPR/etAeNK/FAEkhxQtXOzVF3EuRL41A==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-block-scoping@7.23.4':
+    resolution: {integrity: sha512-0QqbP6B6HOh7/8iNR4CQU2Th/bbRtBp4KS9vcaZd1fZ0wSh5Fyssg0UCIHwxh+ka+pNDREbVLQnHCMHKZfPwfw==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-class-properties@7.23.3':
+    resolution: {integrity: sha512-uM+AN8yCIjDPccsKGlw271xjJtGii+xQIF/uMPS8H15L12jZTsLfF4o5vNO7d/oUguOyfdikHGc/yi9ge4SGIg==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-class-static-block@7.23.4':
+    resolution: {integrity: sha512-nsWu/1M+ggti1SOALj3hfx5FXzAY06fwPJsUZD4/A5e1bWi46VUIWtD+kOX6/IdhXGsXBWllLFDSnqSCdUNydQ==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.12.0
+
+  '@babel/plugin-transform-classes@7.23.5':
+    resolution: {integrity: sha512-jvOTR4nicqYC9yzOHIhXG5emiFEOpappSJAl73SDSEDcybD+Puuze8Tnpb9p9qEyYup24tq891gkaygIFvWDqg==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-computed-properties@7.23.3':
+    resolution: {integrity: sha512-dTj83UVTLw/+nbiHqQSFdwO9CbTtwq1DsDqm3CUEtDrZNET5rT5E6bIdTlOftDTDLMYxvxHNEYO4B9SLl8SLZw==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-destructuring@7.23.3':
+    resolution: {integrity: sha512-n225npDqjDIr967cMScVKHXJs7rout1q+tt50inyBCPkyZ8KxeI6d+GIbSBTT/w/9WdlWDOej3V9HE5Lgk57gw==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-dotall-regex@7.23.3':
+    resolution: {integrity: sha512-vgnFYDHAKzFaTVp+mneDsIEbnJ2Np/9ng9iviHw3P/KVcgONxpNULEW/51Z/BaFojG2GI2GwwXck5uV1+1NOYQ==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-duplicate-keys@7.23.3':
+    resolution: {integrity: sha512-RrqQ+BQmU3Oyav3J+7/myfvRCq7Tbz+kKLLshUmMwNlDHExbGL7ARhajvoBJEvc+fCguPPu887N+3RRXBVKZUA==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-dynamic-import@7.23.4':
+    resolution: {integrity: sha512-V6jIbLhdJK86MaLh4Jpghi8ho5fGzt3imHOBu/x0jlBaPYqDoWz4RDXjmMOfnh+JWNaQleEAByZLV0QzBT4YQQ==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-exponentiation-operator@7.23.3':
+    resolution: {integrity: sha512-5fhCsl1odX96u7ILKHBj4/Y8vipoqwsJMh4csSA8qFfxrZDEA4Ssku2DyNvMJSmZNOEBT750LfFPbtrnTP90BQ==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-export-namespace-from@7.23.4':
+    resolution: {integrity: sha512-GzuSBcKkx62dGzZI1WVgTWvkkz84FZO5TC5T8dl/Tht/rAla6Dg/Mz9Yhypg+ezVACf/rgDuQt3kbWEv7LdUDQ==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-for-of@7.23.6':
+    resolution: {integrity: sha512-aYH4ytZ0qSuBbpfhuofbg/e96oQ7U2w1Aw/UQmKT+1l39uEhUPoFS3fHevDc1G0OvewyDudfMKY1OulczHzWIw==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-function-name@7.23.3':
+    resolution: {integrity: sha512-I1QXp1LxIvt8yLaib49dRW5Okt7Q4oaxao6tFVKS/anCdEOMtYwWVKoiOA1p34GOWIZjUK0E+zCp7+l1pfQyiw==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-json-strings@7.23.4':
+    resolution: {integrity: sha512-81nTOqM1dMwZ/aRXQ59zVubN9wHGqk6UtqRK+/q+ciXmRy8fSolhGVvG09HHRGo4l6fr/c4ZhXUQH0uFW7PZbg==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-literals@7.23.3':
+    resolution: {integrity: sha512-wZ0PIXRxnwZvl9AYpqNUxpZ5BiTGrYt7kueGQ+N5FiQ7RCOD4cm8iShd6S6ggfVIWaJf2EMk8eRzAh52RfP4rQ==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-logical-assignment-operators@7.23.4':
+    resolution: {integrity: sha512-Mc/ALf1rmZTP4JKKEhUwiORU+vcfarFVLfcFiolKUo6sewoxSEgl36ak5t+4WamRsNr6nzjZXQjM35WsU+9vbg==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-member-expression-literals@7.23.3':
+    resolution: {integrity: sha512-sC3LdDBDi5x96LA+Ytekz2ZPk8i/Ck+DEuDbRAll5rknJ5XRTSaPKEYwomLcs1AA8wg9b3KjIQRsnApj+q51Ag==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-modules-amd@7.23.3':
+    resolution: {integrity: sha512-vJYQGxeKM4t8hYCKVBlZX/gtIY2I7mRGFNcm85sgXGMTBcoV3QdVtdpbcWEbzbfUIUZKwvgFT82mRvaQIebZzw==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-modules-commonjs@7.23.3':
+    resolution: {integrity: sha512-aVS0F65LKsdNOtcz6FRCpE4OgsP2OFnW46qNxNIX9h3wuzaNcSQsJysuMwqSibC98HPrf2vCgtxKNwS0DAlgcA==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-modules-systemjs@7.23.3':
+    resolution: {integrity: sha512-ZxyKGTkF9xT9YJuKQRo19ewf3pXpopuYQd8cDXqNzc3mUNbOME0RKMoZxviQk74hwzfQsEe66dE92MaZbdHKNQ==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-modules-umd@7.23.3':
+    resolution: {integrity: sha512-zHsy9iXX2nIsCBFPud3jKn1IRPWg3Ing1qOZgeKV39m1ZgIdpJqvlWVeiHBZC6ITRG0MfskhYe9cLgntfSFPIg==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-named-capturing-groups-regex@7.22.5':
+    resolution: {integrity: sha512-YgLLKmS3aUBhHaxp5hi1WJTgOUb/NCuDHzGT9z9WTt3YG+CPRhJs6nprbStx6DnWM4dh6gt7SU3sZodbZ08adQ==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0
+
+  '@babel/plugin-transform-new-target@7.23.3':
+    resolution: {integrity: sha512-YJ3xKqtJMAT5/TIZnpAR3I+K+WaDowYbN3xyxI8zxx/Gsypwf9B9h0VB+1Nh6ACAAPRS5NSRje0uVv5i79HYGQ==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-nullish-coalescing-operator@7.23.4':
+    resolution: {integrity: sha512-jHE9EVVqHKAQx+VePv5LLGHjmHSJR76vawFPTdlxR/LVJPfOEGxREQwQfjuZEOPTwG92X3LINSh3M40Rv4zpVA==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-numeric-separator@7.23.4':
+    resolution: {integrity: sha512-mps6auzgwjRrwKEZA05cOwuDc9FAzoyFS4ZsG/8F43bTLf/TgkJg7QXOrPO1JO599iA3qgK9MXdMGOEC8O1h6Q==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-object-rest-spread@7.23.4':
+    resolution: {integrity: sha512-9x9K1YyeQVw0iOXJlIzwm8ltobIIv7j2iLyP2jIhEbqPRQ7ScNgwQufU2I0Gq11VjyG4gI4yMXt2VFags+1N3g==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-object-super@7.23.3':
+    resolution: {integrity: sha512-BwQ8q0x2JG+3lxCVFohg+KbQM7plfpBwThdW9A6TMtWwLsbDA01Ek2Zb/AgDN39BiZsExm4qrXxjk+P1/fzGrA==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-optional-catch-binding@7.23.4':
+    resolution: {integrity: sha512-XIq8t0rJPHf6Wvmbn9nFxU6ao4c7WhghTR5WyV8SrJfUFzyxhCm4nhC+iAp3HFhbAKLfYpgzhJ6t4XCtVwqO5A==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-optional-chaining@7.23.4':
+    resolution: {integrity: sha512-ZU8y5zWOfjM5vZ+asjgAPwDaBjJzgufjES89Rs4Lpq63O300R/kOz30WCLo6BxxX6QVEilwSlpClnG5cZaikTA==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-parameters@7.23.3':
+    resolution: {integrity: sha512-09lMt6UsUb3/34BbECKVbVwrT9bO6lILWln237z7sLaWnMsTi7Yc9fhX5DLpkJzAGfaReXI22wP41SZmnAA3Vw==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-private-methods@7.23.3':
+    resolution: {integrity: sha512-UzqRcRtWsDMTLrRWFvUBDwmw06tCQH9Rl1uAjfh6ijMSmGYQ+fpdB+cnqRC8EMh5tuuxSv0/TejGL+7vyj+50g==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-private-property-in-object@7.23.4':
+    resolution: {integrity: sha512-9G3K1YqTq3F4Vt88Djx1UZ79PDyj+yKRnUy7cZGSMe+a7jkwD259uKKuUzQlPkGam7R+8RJwh5z4xO27fA1o2A==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-property-literals@7.23.3':
+    resolution: {integrity: sha512-jR3Jn3y7cZp4oEWPFAlRsSWjxKe4PZILGBSd4nis1TsC5qeSpb+nrtihJuDhNI7QHiVbUaiXa0X2RZY3/TI6Nw==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-react-constant-elements@7.22.3':
+    resolution: {integrity: sha512-b5J6muxQYp4H7loAQv/c7GO5cPuRA6H5hx4gO+/Hn+Cu9MRQU0PNiUoWq1L//8sq6kFSNxGXFb2XTaUfa9y+Pg==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-react-display-name@7.22.5':
+    resolution: {integrity: sha512-PVk3WPYudRF5z4GKMEYUrLjPl38fJSKNaEOkFuoprioowGuWN6w2RKznuFNSlJx7pzzXXStPUnNSOEO0jL5EVw==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-react-jsx-development@7.22.5':
+    resolution: {integrity: sha512-bDhuzwWMuInwCYeDeMzyi7TaBgRQei6DqxhbyniL7/VG4RSS7HtSL2QbY4eESy1KJqlWt8g3xeEBGPuo+XqC8A==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-react-jsx@7.22.15':
+    resolution: {integrity: sha512-oKckg2eZFa8771O/5vi7XeTvmM6+O9cxZu+kanTU7tD4sin5nO/G8jGJhq8Hvt2Z0kUoEDRayuZLaUlYl8QuGA==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-react-pure-annotations@7.22.5':
+    resolution: {integrity: sha512-gP4k85wx09q+brArVinTXhWiyzLl9UpmGva0+mWyKxk6JZequ05x3eUcIUE+FyttPKJFRRVtAvQaJ6YF9h1ZpA==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-regenerator@7.23.3':
+    resolution: {integrity: sha512-KP+75h0KghBMcVpuKisx3XTu9Ncut8Q8TuvGO4IhY+9D5DFEckQefOuIsB/gQ2tG71lCke4NMrtIPS8pOj18BQ==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-reserved-words@7.23.3':
+    resolution: {integrity: sha512-QnNTazY54YqgGxwIexMZva9gqbPa15t/x9VS+0fsEFWplwVpXYZivtgl43Z1vMpc1bdPP2PP8siFeVcnFvA3Cg==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-shorthand-properties@7.23.3':
+    resolution: {integrity: sha512-ED2fgqZLmexWiN+YNFX26fx4gh5qHDhn1O2gvEhreLW2iI63Sqm4llRLCXALKrCnbN4Jy0VcMQZl/SAzqug/jg==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-spread@7.23.3':
+    resolution: {integrity: sha512-VvfVYlrlBVu+77xVTOAoxQ6mZbnIq5FM0aGBSFEcIh03qHf+zNqA4DC/3XMUozTg7bZV3e3mZQ0i13VB6v5yUg==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-sticky-regex@7.23.3':
+    resolution: {integrity: sha512-HZOyN9g+rtvnOU3Yh7kSxXrKbzgrm5X4GncPY1QOquu7epga5MxKHVpYu2hvQnry/H+JjckSYRb93iNfsioAGg==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-template-literals@7.23.3':
+    resolution: {integrity: sha512-Flok06AYNp7GV2oJPZZcP9vZdszev6vPBkHLwxwSpaIqx75wn6mUd3UFWsSsA0l8nXAKkyCmL/sR02m8RYGeHg==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-typeof-symbol@7.23.3':
+    resolution: {integrity: sha512-4t15ViVnaFdrPC74be1gXBSMzXk3B4Us9lP7uLRQHTFpV5Dvt33pn+2MyyNxmN3VTTm3oTrZVMUmuw3oBnQ2oQ==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-typescript@7.22.15':
+    resolution: {integrity: sha512-1uirS0TnijxvQLnlv5wQBwOX3E1wCFX7ITv+9pBV2wKEk4K+M5tqDaoNXnTH8tjEIYHLO98MwiTWO04Ggz4XuA==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-unicode-escapes@7.23.3':
+    resolution: {integrity: sha512-OMCUx/bU6ChE3r4+ZdylEqAjaQgHAgipgW8nsCfu5pGqDcFytVd91AwRvUJSBZDz0exPGgnjoqhgRYLRjFZc9Q==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-unicode-property-regex@7.23.3':
+    resolution: {integrity: sha512-KcLIm+pDZkWZQAFJ9pdfmh89EwVfmNovFBcXko8szpBeF8z68kWIPeKlmSOkT9BXJxs2C0uk+5LxoxIv62MROA==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-unicode-regex@7.23.3':
+    resolution: {integrity: sha512-wMHpNA4x2cIA32b/ci3AfwNgheiva2W0WUKWTK7vBHBhDKfPsc5cFGNWm69WBqpwd86u1qwZ9PWevKqm1A3yAw==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-unicode-sets-regex@7.23.3':
+    resolution: {integrity: sha512-W7lliA/v9bNR83Qc3q1ip9CQMZ09CcHDbHfbLRDNuAhn1Mvkr1ZNF7hPmztMQvtTGVLJ9m8IZqWsTkXOml8dbw==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0
+
+  '@babel/preset-env@7.23.6':
+    resolution: {integrity: sha512-2XPn/BqKkZCpzYhUUNZ1ssXw7DcXfKQEjv/uXZUXgaebCMYmkEsfZ2yY+vv+xtXv50WmL5SGhyB6/xsWxIvvOQ==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/preset-modules@0.1.6-no-external-plugins':
+    resolution: {integrity: sha512-HrcgcIESLm9aIR842yhJ5RWan/gebQUJ6E/E5+rf0y9o6oj7w0Br+sWuL6kEQ/o/AdfvR1Je9jG18/gnpwjEyA==}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0 || ^8.0.0-0 <8.0.0
+
+  '@babel/preset-react@7.22.15':
+    resolution: {integrity: sha512-Csy1IJ2uEh/PecCBXXoZGAZBeCATTuePzCSB7dLYWS0vOEj6CNpjxIhW4duWwZodBNueH7QO14WbGn8YyeuN9w==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/preset-typescript@7.23.0':
+    resolution: {integrity: sha512-6P6VVa/NM/VlAYj5s2Aq/gdVg8FSENCg3wlZ6Qau9AcPaoF5LbN1nyGlR9DTRIw9PpxI94e+ReydsJHcjwAweg==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/regjsgen@0.8.0':
+    resolution: {integrity: sha512-x/rqGMdzj+fWZvCOYForTghzbtqPDZ5gPwaoNGHdgDfF2QA/XZbCBp4Moo5scrkAMPhB7z26XM/AaHuIJdgauA==}
+
+  '@babel/runtime@7.26.0':
+    resolution: {integrity: sha512-FDSOghenHTiToteC/QRlv2q3DhPZ/oOXTBoirfWNx1Cx3TMVcGWQtMMmQcSvb/JjpNeGzx8Pq/b4fKEJuWm1sw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/template@7.28.6':
+    resolution: {integrity: sha512-YA6Ma2KsCdGb+WC6UpBVFJGXL58MDA6oyONbjyF/+5sBgxY/dwkhLogbMT2GXXyU84/IhRw/2D1Os1B/giz+BQ==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/traverse@7.29.0':
+    resolution: {integrity: sha512-4HPiQr0X7+waHfyXPZpWPfWL/J7dcN1mx9gL6WdQVMbPnF3+ZhSMs8tCxN7oHddJE9fhNE7+lxdnlyemKfJRuA==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/types@7.18.10':
+    resolution: {integrity: sha512-MJvnbEiiNkpjo+LknnmRrqbY1GPUUggjv+wQVjetM/AONoupqRALB7I6jGqNUAZsKcRIEu2J6FRFvsczljjsaQ==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/types@7.29.0':
+    resolution: {integrity: sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A==}
+    engines: {node: '>=6.9.0'}
+
+  '@bcoe/v8-coverage@0.2.3':
+    resolution: {integrity: sha512-0hYQ8SB4Db5zvZB4axdMHGwEaQjkZzFjQiN9LVYvIFB2nSUHW9tYpxWriPrWDASIxiaXax83REcLxuSdnGPZtw==}
+
+  '@bcoe/v8-coverage@1.0.2':
+    resolution: {integrity: sha512-6zABk/ECA/QYSCQ1NGiVwwbQerUCZ+TQbp64Q3AgmfNvurHH0j8TtXa1qbShXA6qqkpAj4V5W8pP6mLe1mcMqA==}
+    engines: {node: '>=18'}
+
+  '@chromatic-com/storybook@5.1.2':
+    resolution: {integrity: sha512-H/hgvwC3E+OtseP2OT2QYUJH2VfnzT6wM3pWOkaNV6g7QI+VUdWJbeJ3o2jFqvEPQNqzhQKWDOlvM4lu+7is6g==}
+    engines: {node: '>=20.0.0', yarn: '>=1.22.18'}
+    peerDependencies:
+      storybook: ^0.0.0-0 || ^10.1.0 || ^10.1.0-0 || ^10.2.0-0 || ^10.3.0-0 || ^10.4.0-0
+
+  '@codemirror/autocomplete@6.20.2':
+    resolution: {integrity: sha512-G5FPkgIiLjOgZMjqVjvuKQ1rGPtHogLldJr33eFJdVLtmwY+giGrlv/ewljLz6b9BSQLkjxuwBc6g6omDM+YxQ==}
+
+  '@codemirror/commands@6.10.3':
+    resolution: {integrity: sha512-JFRiqhKu+bvSkDLI+rUhJwSxQxYb759W5GBezE8Uc8mHLqC9aV/9aTC7yJSqCtB3F00pylrLCwnyS91Ap5ej4Q==}
+
+  '@codemirror/lang-json@6.0.1':
+    resolution: {integrity: sha512-+T1flHdgpqDDlJZ2Lkil/rLiRy684WMLc74xUnjJH48GQdfJo/pudlTRreZmKwzP8/tGdKf83wlbAdOCzlJOGQ==}
+
+  '@codemirror/lang-yaml@6.1.2':
+    resolution: {integrity: sha512-dxrfG8w5Ce/QbT7YID7mWZFKhdhsaTNOYjOkSIMt1qmC4VQnXSDSYVHHHn8k6kJUfIhtLo8t1JJgltlxWdsITw==}
+
+  '@codemirror/language@6.12.3':
+    resolution: {integrity: sha512-QwCZW6Tt1siP37Jet9Tb02Zs81TQt6qQrZR2H+eGMcFsL1zMrk2/b9CLC7/9ieP1fjIUMgviLWMmgiHoJrj+ZA==}
+
+  '@codemirror/legacy-modes@6.5.3':
+    resolution: {integrity: sha512-xCsmIzH78MyWkib9jlPaaun57XNkfbMIhagfaZVd0iLTqlpw3jXaIcbZm72MTmmn64eTZpBVNjbyYh+QXnxRsg==}
+
+  '@codemirror/lint@6.9.6':
+    resolution: {integrity: sha512-6Kp7r6XfCi/D/5sdXieMfg9pJU1bUEx96WITuLU6ESaKizCz0QHFMjY/TaFSbigDdEAIgi93itLBIUETP4oK+A==}
+
+  '@codemirror/merge@6.10.0':
+    resolution: {integrity: sha512-Omn0gU6MM5cKQGqgKoIhFjUqCNWH/nukCMLXzu/1jOdtiHsxAu3GdENBf1QYkoIC3FSgkF7X/ClOqYeUATQ4Sw==}
+
+  '@codemirror/search@6.7.0':
+    resolution: {integrity: sha512-ZvGm99wc/s2cITtMT15LFdn8aH/aS+V+DqyGq/N5ZlV5vWtH+nILvC2nw0zX7ByNoHHDZ2IxxdW38O0tc5nVHg==}
+
+  '@codemirror/state@6.6.0':
+    resolution: {integrity: sha512-4nbvra5R5EtiCzr9BTHiTLc+MLXK2QGiAVYMyi8PkQd3SR+6ixar/Q/01Fa21TBIDOZXgeWV4WppsQolSreAPQ==}
+
+  '@codemirror/theme-one-dark@6.1.3':
+    resolution: {integrity: sha512-NzBdIvEJmx6fjeremiGp3t/okrLPYT0d9orIc7AFun8oZcRk58aejkqhv6spnz4MLAevrKNPMQYXEWMg4s+sKA==}
+
+  '@codemirror/view@6.43.0':
+    resolution: {integrity: sha512-V7ZCLQO3Jus9hzh2jVCCPW3mO4IBMr43O37PqSUYautJSnnJF41YlgLw21x0fLJTYvJ+Vkm6Gp+qKGH9pltgXA==}
+
+  '@colordx/core@5.4.3':
+    resolution: {integrity: sha512-kIxYSfA5T8HXjav55UaaH/o/cKivF6jCCGIb8eqtcsfI46wsvlSiT8jMDyrl779qLec3c2c2oHBZo4oAhvbjrQ==}
+
+  '@discoveryjs/json-ext@0.5.7':
+    resolution: {integrity: sha512-dBVuXR082gk3jsFp7Rd/JI4kytwGHecnCoTtXFb7DB6CNHp4rg5k1bhg0nWdLGLnOV71lmDzGQaLMy8iPLY0pw==}
+    engines: {node: '>=10.0.0'}
+
+  '@discoveryjs/json-ext@0.6.3':
+    resolution: {integrity: sha512-4B4OijXeVNOPZlYA2oEwWOTkzyltLao+xbotHQeqN++Rv27Y6s818+n2Qkp8q+Fxhn0t/5lA5X1Mxktud8eayQ==}
+    engines: {node: '>=14.17.0'}
+
+  '@emnapi/core@1.10.0':
+    resolution: {integrity: sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw==}
+
+  '@emnapi/core@1.9.2':
+    resolution: {integrity: sha512-UC+ZhH3XtczQYfOlu3lNEkdW/p4dsJ1r/bP7H8+rhao3TTTMO1ATq/4DdIi23XuGoFY+Cz0JmCbdVl0hz9jZcA==}
+
+  '@emnapi/runtime@1.10.0':
+    resolution: {integrity: sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA==}
+
+  '@emnapi/runtime@1.9.2':
+    resolution: {integrity: sha512-3U4+MIWHImeyu1wnmVygh5WlgfYDtyf0k8AbLhMFxOipihf6nrWC4syIm/SwEeec0mNSafiiNnMJwbza/Is6Lw==}
+
+  '@emnapi/wasi-threads@1.2.1':
+    resolution: {integrity: sha512-uTII7OYF+/Mes/MrcIOYp5yOtSMLBWSIoLPpcgwipoiKbli6k322tcoFsxoIIxPDqW01SQGAgko4EzZi2BNv2w==}
+
+  '@emotion/babel-plugin@11.13.5':
+    resolution: {integrity: sha512-pxHCpT2ex+0q+HH91/zsdHkw/lXd468DIN2zvfvLtPKLLMo6gQj7oLObq8PhkrxOZb/gGCq03S3Z7PDhS8pduQ==}
+
+  '@emotion/cache@11.14.0':
+    resolution: {integrity: sha512-L/B1lc/TViYk4DcpGxtAVbx0ZyiKM5ktoIyafGkH6zg/tj+mA+NE//aPYKG0k8kCHSHVJrpLpcAlOBEXQ3SavA==}
+
+  '@emotion/hash@0.9.2':
+    resolution: {integrity: sha512-MyqliTZGuOm3+5ZRSaaBGP3USLw6+EGykkwZns2EPC5g8jJ4z9OrdZY9apkl3+UP9+sdz76YYkwCKP5gh8iY3g==}
+
+  '@emotion/memoize@0.9.0':
+    resolution: {integrity: sha512-30FAj7/EoJ5mwVPOWhAyCX+FPfMDrVecJAM+Iw9NRoSl4BBAQeqj4cApHHUXOVvIPgLVDsCFoz/hGD+5QQD1GQ==}
+
+  '@emotion/react@11.14.0':
+    resolution: {integrity: sha512-O000MLDBDdk/EohJPFUqvnp4qnHeYkVP5B0xEG0D/L7cOKP9kefu2DXn8dj74cQfsEzUqh+sr1RzFqiL1o+PpA==}
+    peerDependencies:
+      '@types/react': '*'
+      react: '>=16.8.0'
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@emotion/serialize@1.3.3':
+    resolution: {integrity: sha512-EISGqt7sSNWHGI76hC7x1CksiXPahbxEOrC5RjmFRJTqLyEK9/9hZvBbiYn70dw4wuwMKiEMCUlR6ZXTSWQqxA==}
+
+  '@emotion/sheet@1.4.0':
+    resolution: {integrity: sha512-fTBW9/8r2w3dXWYM4HCB1Rdp8NLibOw2+XELH5m5+AkWiL/KqYX6dc0kKYlaYyKjrQ6ds33MCdMPEwgs2z1rqg==}
+
+  '@emotion/unitless@0.10.0':
+    resolution: {integrity: sha512-dFoMUuQA20zvtVTuxZww6OHoJYgrzfKM1t52mVySDJnMSEa08ruEvdYQbhvyu6soU+NeLVd3yKfTfT0NeV6qGg==}
+
+  '@emotion/use-insertion-effect-with-fallbacks@1.2.0':
+    resolution: {integrity: sha512-yJMtVdH59sxi/aVJBpk9FQq+OR8ll5GT8oWd57UpeaKEVGab41JWaCFA7FRLoMLloOZF/c/wsPoe+bfGmRKgDg==}
+    peerDependencies:
+      react: '>=16.8.0'
+
+  '@emotion/utils@1.4.2':
+    resolution: {integrity: sha512-3vLclRofFziIa3J2wDh9jjbkUz9qk5Vi3IZ/FSTKViB0k+ef0fPV7dYrUIugbgupYDx7v9ud/SjrtEP8Y4xLoA==}
+
+  '@emotion/weak-memoize@0.4.0':
+    resolution: {integrity: sha512-snKqtPW01tN0ui7yu9rGv69aJXr/a/Ywvl11sUjNtEcRc+ng/mQriFL0wLXMef74iHa/EkftbDzU9F8iFbH+zg==}
+
+  '@esbuild/aix-ppc64@0.27.3':
+    resolution: {integrity: sha512-9fJMTNFTWZMh5qwrBItuziu834eOCUcEqymSH7pY+zoMVEZg3gcPuBNxH1EvfVYe9h0x/Ptw8KBzv7qxb7l8dg==}
+    engines: {node: '>=18'}
+    cpu: [ppc64]
+    os: [aix]
+
+  '@esbuild/android-arm64@0.27.3':
+    resolution: {integrity: sha512-YdghPYUmj/FX2SYKJ0OZxf+iaKgMsKHVPF1MAq/P8WirnSpCStzKJFjOjzsW0QQ7oIAiccHdcqjbHmJxRb/dmg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [android]
+
+  '@esbuild/android-arm@0.27.3':
+    resolution: {integrity: sha512-i5D1hPY7GIQmXlXhs2w8AWHhenb00+GxjxRncS2ZM7YNVGNfaMxgzSGuO8o8SJzRc/oZwU2bcScvVERk03QhzA==}
+    engines: {node: '>=18'}
+    cpu: [arm]
+    os: [android]
+
+  '@esbuild/android-x64@0.27.3':
+    resolution: {integrity: sha512-IN/0BNTkHtk8lkOM8JWAYFg4ORxBkZQf9zXiEOfERX/CzxW3Vg1ewAhU7QSWQpVIzTW+b8Xy+lGzdYXV6UZObQ==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [android]
+
+  '@esbuild/darwin-arm64@0.27.3':
+    resolution: {integrity: sha512-Re491k7ByTVRy0t3EKWajdLIr0gz2kKKfzafkth4Q8A5n1xTHrkqZgLLjFEHVD+AXdUGgQMq+Godfq45mGpCKg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@esbuild/darwin-x64@0.27.3':
+    resolution: {integrity: sha512-vHk/hA7/1AckjGzRqi6wbo+jaShzRowYip6rt6q7VYEDX4LEy1pZfDpdxCBnGtl+A5zq8iXDcyuxwtv3hNtHFg==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [darwin]
+
+  '@esbuild/freebsd-arm64@0.27.3':
+    resolution: {integrity: sha512-ipTYM2fjt3kQAYOvo6vcxJx3nBYAzPjgTCk7QEgZG8AUO3ydUhvelmhrbOheMnGOlaSFUoHXB6un+A7q4ygY9w==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [freebsd]
+
+  '@esbuild/freebsd-x64@0.27.3':
+    resolution: {integrity: sha512-dDk0X87T7mI6U3K9VjWtHOXqwAMJBNN2r7bejDsc+j03SEjtD9HrOl8gVFByeM0aJksoUuUVU9TBaZa2rgj0oA==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@esbuild/linux-arm64@0.27.3':
+    resolution: {integrity: sha512-sZOuFz/xWnZ4KH3YfFrKCf1WyPZHakVzTiqji3WDc0BCl2kBwiJLCXpzLzUBLgmp4veFZdvN5ChW4Eq/8Fc2Fg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [linux]
+
+  '@esbuild/linux-arm@0.27.3':
+    resolution: {integrity: sha512-s6nPv2QkSupJwLYyfS+gwdirm0ukyTFNl3KTgZEAiJDd+iHZcbTPPcWCcRYH+WlNbwChgH2QkE9NSlNrMT8Gfw==}
+    engines: {node: '>=18'}
+    cpu: [arm]
+    os: [linux]
+
+  '@esbuild/linux-ia32@0.27.3':
+    resolution: {integrity: sha512-yGlQYjdxtLdh0a3jHjuwOrxQjOZYD/C9PfdbgJJF3TIZWnm/tMd/RcNiLngiu4iwcBAOezdnSLAwQDPqTmtTYg==}
+    engines: {node: '>=18'}
+    cpu: [ia32]
+    os: [linux]
+
+  '@esbuild/linux-loong64@0.27.3':
+    resolution: {integrity: sha512-WO60Sn8ly3gtzhyjATDgieJNet/KqsDlX5nRC5Y3oTFcS1l0KWba+SEa9Ja1GfDqSF1z6hif/SkpQJbL63cgOA==}
+    engines: {node: '>=18'}
+    cpu: [loong64]
+    os: [linux]
+
+  '@esbuild/linux-mips64el@0.27.3':
+    resolution: {integrity: sha512-APsymYA6sGcZ4pD6k+UxbDjOFSvPWyZhjaiPyl/f79xKxwTnrn5QUnXR5prvetuaSMsb4jgeHewIDCIWljrSxw==}
+    engines: {node: '>=18'}
+    cpu: [mips64el]
+    os: [linux]
+
+  '@esbuild/linux-ppc64@0.27.3':
+    resolution: {integrity: sha512-eizBnTeBefojtDb9nSh4vvVQ3V9Qf9Df01PfawPcRzJH4gFSgrObw+LveUyDoKU3kxi5+9RJTCWlj4FjYXVPEA==}
+    engines: {node: '>=18'}
+    cpu: [ppc64]
+    os: [linux]
+
+  '@esbuild/linux-riscv64@0.27.3':
+    resolution: {integrity: sha512-3Emwh0r5wmfm3ssTWRQSyVhbOHvqegUDRd0WhmXKX2mkHJe1SFCMJhagUleMq+Uci34wLSipf8Lagt4LlpRFWQ==}
+    engines: {node: '>=18'}
+    cpu: [riscv64]
+    os: [linux]
+
+  '@esbuild/linux-s390x@0.27.3':
+    resolution: {integrity: sha512-pBHUx9LzXWBc7MFIEEL0yD/ZVtNgLytvx60gES28GcWMqil8ElCYR4kvbV2BDqsHOvVDRrOxGySBM9Fcv744hw==}
+    engines: {node: '>=18'}
+    cpu: [s390x]
+    os: [linux]
+
+  '@esbuild/linux-x64@0.27.3':
+    resolution: {integrity: sha512-Czi8yzXUWIQYAtL/2y6vogER8pvcsOsk5cpwL4Gk5nJqH5UZiVByIY8Eorm5R13gq+DQKYg0+JyQoytLQas4dA==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [linux]
+
+  '@esbuild/netbsd-arm64@0.27.3':
+    resolution: {integrity: sha512-sDpk0RgmTCR/5HguIZa9n9u+HVKf40fbEUt+iTzSnCaGvY9kFP0YKBWZtJaraonFnqef5SlJ8/TiPAxzyS+UoA==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [netbsd]
+
+  '@esbuild/netbsd-x64@0.27.3':
+    resolution: {integrity: sha512-P14lFKJl/DdaE00LItAukUdZO5iqNH7+PjoBm+fLQjtxfcfFE20Xf5CrLsmZdq5LFFZzb5JMZ9grUwvtVYzjiA==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [netbsd]
+
+  '@esbuild/openbsd-arm64@0.27.3':
+    resolution: {integrity: sha512-AIcMP77AvirGbRl/UZFTq5hjXK+2wC7qFRGoHSDrZ5v5b8DK/GYpXW3CPRL53NkvDqb9D+alBiC/dV0Fb7eJcw==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [openbsd]
+
+  '@esbuild/openbsd-x64@0.27.3':
+    resolution: {integrity: sha512-DnW2sRrBzA+YnE70LKqnM3P+z8vehfJWHXECbwBmH/CU51z6FiqTQTHFenPlHmo3a8UgpLyH3PT+87OViOh1AQ==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [openbsd]
+
+  '@esbuild/openharmony-arm64@0.27.3':
+    resolution: {integrity: sha512-NinAEgr/etERPTsZJ7aEZQvvg/A6IsZG/LgZy+81wON2huV7SrK3e63dU0XhyZP4RKGyTm7aOgmQk0bGp0fy2g==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [openharmony]
+
+  '@esbuild/sunos-x64@0.27.3':
+    resolution: {integrity: sha512-PanZ+nEz+eWoBJ8/f8HKxTTD172SKwdXebZ0ndd953gt1HRBbhMsaNqjTyYLGLPdoWHy4zLU7bDVJztF5f3BHA==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [sunos]
+
+  '@esbuild/win32-arm64@0.27.3':
+    resolution: {integrity: sha512-B2t59lWWYrbRDw/tjiWOuzSsFh1Y/E95ofKz7rIVYSQkUYBjfSgf6oeYPNWHToFRr2zx52JKApIcAS/D5TUBnA==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [win32]
+
+  '@esbuild/win32-ia32@0.27.3':
+    resolution: {integrity: sha512-QLKSFeXNS8+tHW7tZpMtjlNb7HKau0QDpwm49u0vUp9y1WOF+PEzkU84y9GqYaAVW8aH8f3GcBck26jh54cX4Q==}
+    engines: {node: '>=18'}
+    cpu: [ia32]
+    os: [win32]
+
+  '@esbuild/win32-x64@0.27.3':
+    resolution: {integrity: sha512-4uJGhsxuptu3OcpVAzli+/gWusVGwZZHTlS63hh++ehExkVT8SgiEf7/uC/PclrPPkLhZqGgCTjd0VWLo6xMqA==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [win32]
+
+  '@eslint-community/eslint-plugin-eslint-comments@4.7.2':
+    resolution: {integrity: sha512-LF03qURSwEWm2dz5wtdDCzNk+7Opl0X7q6I3undsaIuNsEiNvRV3BCtqu14Q/6Pzg1tBj44LcxpW2EpSLZStZw==}
+    engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
+    peerDependencies:
+      eslint: ^6.0.0 || ^7.0.0 || ^8.0.0 || ^9.0.0 || ^10.0.0
+
+  '@eslint-community/eslint-utils@4.9.1':
+    resolution: {integrity: sha512-phrYmNiYppR7znFEdqgfWHXR6NCkZEK7hwWDHZUjit/2/U0r6XvkDl0SYnoM51Hq7FhCGdLDT6zxCCOY1hexsQ==}
+    engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
+    peerDependencies:
+      eslint: ^6.0.0 || ^7.0.0 || >=8.0.0
+
+  '@eslint-community/regexpp@4.12.2':
+    resolution: {integrity: sha512-EriSTlt5OC9/7SXkRSCAhfSxxoSUgBm33OH+IkwbdpgoqsSsUg7y3uh+IICI/Qg4BBWr3U2i39RpmycbxMq4ew==}
+    engines: {node: ^12.0.0 || ^14.0.0 || >=16.0.0}
+
+  '@eslint/config-array@0.21.2':
+    resolution: {integrity: sha512-nJl2KGTlrf9GjLimgIru+V/mzgSK0ABCDQRvxw5BjURL7WfH5uoWmizbH7QB6MmnMBd8cIC9uceWnezL1VZWWw==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@eslint/config-helpers@0.4.2':
+    resolution: {integrity: sha512-gBrxN88gOIf3R7ja5K9slwNayVcZgK6SOUORm2uBzTeIEfeVaIhOpCtTox3P6R7o2jLFwLFTLnC7kU/RGcYEgw==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@eslint/core@0.17.0':
+    resolution: {integrity: sha512-yL/sLrpmtDaFEiUj1osRP4TI2MDz1AddJL+jZ7KSqvBuliN4xqYY54IfdN8qD8Toa6g1iloph1fxQNkjOxrrpQ==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@eslint/eslintrc@3.3.5':
+    resolution: {integrity: sha512-4IlJx0X0qftVsN5E+/vGujTRIFtwuLbNsVUe7TO6zYPDR1O6nFwvwhIKEKSrl6dZchmYBITazxKoUYOjdtjlRg==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@eslint/js@10.0.1':
+    resolution: {integrity: sha512-zeR9k5pd4gxjZ0abRoIaxdc7I3nDktoXZk2qOv9gCNWx3mVwEn32VRhyLaRsDiJjTs0xq/T8mfPtyuXu7GWBcA==}
+    engines: {node: ^20.19.0 || ^22.13.0 || >=24}
+    peerDependencies:
+      eslint: ^10.0.0
+    peerDependenciesMeta:
+      eslint:
+        optional: true
+
+  '@eslint/js@9.39.4':
+    resolution: {integrity: sha512-nE7DEIchvtiFTwBw4Lfbu59PG+kCofhjsKaCWzxTpt4lfRjRMqG6uMBzKXuEcyXhOHoUp9riAm7/aWYGhXZ9cw==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@eslint/object-schema@2.1.7':
+    resolution: {integrity: sha512-VtAOaymWVfZcmZbp6E2mympDIHvyjXs/12LqWYjVw6qjrfF+VK+fyG33kChz3nnK+SU5/NeHOqrTEHS8sXO3OA==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@eslint/plugin-kit@0.4.1':
+    resolution: {integrity: sha512-43/qtrDUokr7LJqoF2c3+RInu/t4zfrpYdoSDfYyhg52rwLV6TnOvdG4fXm7IkSB3wErkcmJS9iEhjVtOSEjjA==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@exodus/schemasafe@1.0.0-rc.6':
+    resolution: {integrity: sha512-dDnQizD94EdBwEj/fh3zPRa/HWCS9O5au2PuHhZBbuM3xWHxuaKzPBOEWze7Nn0xW68MIpZ7Xdyn1CoCpjKCuQ==}
+
+  '@floating-ui/core@1.7.5':
+    resolution: {integrity: sha512-1Ih4WTWyw0+lKyFMcBHGbb5U5FtuHJuujoyyr5zTaWS5EYMeT6Jb2AuDeftsCsEuchO+mM2ij5+q9crhydzLhQ==}
+
+  '@floating-ui/dom@1.7.6':
+    resolution: {integrity: sha512-9gZSAI5XM36880PPMm//9dfiEngYoC6Am2izES1FF406YFsjvyBMmeJ2g4SAju3xWwtuynNRFL2s9hgxpLI5SQ==}
+
+  '@floating-ui/utils@0.2.11':
+    resolution: {integrity: sha512-RiB/yIh78pcIxl6lLMG0CgBXAZ2Y0eVHqMPYugu+9U0AeT6YBeiJpf7lbdJNIugFP5SIjwNRgo4DhR1Qxi26Gg==}
+
+  '@hey-api/codegen-core@0.9.1':
+    resolution: {integrity: sha512-s97jL1dgTMuiMHv2BZ1X4Tgd99Mf9GOvGdNqNcGwIMmnR+PgYNoraj4Zvp134MKsNCap/m7k0r0vKKnl56pj4w==}
+    engines: {node: '>=22.18.0'}
+
+  '@hey-api/json-schema-ref-parser@1.4.4':
+    resolution: {integrity: sha512-otmd+zCxbYVBIp/mlMTnGkvlNYLkVKgs3VOIq0kSnenhB1+fRwLPQIeSwyWM6E51oXhUedkYjVsVpkVexeuJOA==}
+    engines: {node: '>=22.18.0'}
+
+  '@hey-api/openapi-ts@0.99.0':
+    resolution: {integrity: sha512-SePU/5oEWWkvUBYmvzdYRctseoLuskyhs4ET0RvLIcmzc8yLQoA2R+KtBIQ8bPsoSUB0m4E5SmBnl6aGSA0szQ==}
+    engines: {node: '>=22.18.0'}
+    hasBin: true
+    peerDependencies:
+      typescript: '>=5.5.3 || >=6.0.0 || 6.0.1-rc'
+
+  '@hey-api/shared@0.5.0':
+    resolution: {integrity: sha512-JN/j4Ebh4cJGYIQ5cwWuqe7GeSUyQoz7oC51WqyhKOcrejK6DKZMDkshc5d1eKTRuRL+rjozuRcoUaZZn2DGPw==}
+    engines: {node: '>=22.18.0'}
+
+  '@hey-api/spec-types@0.2.0':
+    resolution: {integrity: sha512-ibQ8Is7evMavzr8GNyJCcTg975d8DpaMUyLmOrQ85UBdy1l6t1KuRAwgChAbesJsIlNV6gjmlXruWyegDX18Fg==}
+
+  '@hey-api/types@0.1.4':
+    resolution: {integrity: sha512-thWfawrDIP7wSI9ioT13I5soaaqB5vAPIiZmgD8PbeEVKNrkonc0N/Sjj97ezl7oQgusZmaNphGdMKipPO6IBg==}
+
+  '@humanfs/core@0.19.1':
+    resolution: {integrity: sha512-5DyQ4+1JEUzejeK1JGICcideyfUbGixgS9jNgex5nqkW+cY7WZhxBigmieN5Qnw9ZosSNVC9KQKyb+GUaGyKUA==}
+    engines: {node: '>=18.18.0'}
+
+  '@humanfs/node@0.16.7':
+    resolution: {integrity: sha512-/zUx+yOsIrG4Y43Eh2peDeKCxlRt/gET6aHfaKpuq267qXdYDFViVHfMaLyygZOnl0kGWxFIgsBy8QFuTLUXEQ==}
+    engines: {node: '>=18.18.0'}
+
+  '@humanwhocodes/module-importer@1.0.1':
+    resolution: {integrity: sha512-bxveV4V8v5Yb4ncFTT3rPSgZBOpCkjfK0y4oVVVJwIuDVBRMDXrPyXRL988i5ap9m9bnyEEjWfm5WkBmtffLfA==}
+    engines: {node: '>=12.22'}
+
+  '@humanwhocodes/retry@0.4.3':
+    resolution: {integrity: sha512-bV0Tgo9K4hfPCek+aMAn81RppFKv2ySDQeMoSZuvTASywNTnVJCArCZE2FWqpvIatKu7VMRLWlR1EazvVhDyhQ==}
+    engines: {node: '>=18.18'}
+
+  '@inquirer/ansi@2.0.7':
+    resolution: {integrity: sha512-3eTuUO1vH2cZm2ZKHeQxnOqlTi9EfZDGgIe3BL3I4u+rJHocr9Fz86M4fjYABPvFnQG/gGK551HqDiIcETwU6Q==}
+    engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
+
+  '@inquirer/confirm@6.1.1':
+    resolution: {integrity: sha512-eb8DBZcz/2qHWQda4rk2JiQk5h9QV/cVHi1yjt0f69WFZMRFn0sJTye3EAP8icut8UDMjQPsaH5KbcOogefrFQ==}
+    engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
+    peerDependencies:
+      '@types/node': ^25
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+
+  '@inquirer/core@11.2.1':
+    resolution: {integrity: sha512-Qd6GJT1yVyrZZCfN8W2qKF5ApmqryXRhRKCuip8h01x2w/esJQ2XIYc6f9abMIHgKQdBfFTSOdbHRLAhuM09UA==}
+    engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
+    peerDependencies:
+      '@types/node': ^25
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+
+  '@inquirer/figures@2.0.7':
+    resolution: {integrity: sha512-aJ8TBPOGB6f/2qziPfElISTCEd5XOYTFckA2SGjhNmiKzfK/u4ot3v0DUzGVdUnKjN10EqnnEPck36BkyfLnJw==}
+    engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
+
+  '@inquirer/type@4.0.7':
+    resolution: {integrity: sha512-t28inv14nMQ1PhKpsJPY+kEs/c00qzeCOS2gTNRyTjG5d6qsVA2fItxW4hkvGZ5lvanGLdtCzVIx5dwdRpN1+g==}
+    engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
+    peerDependencies:
+      '@types/node': ^25
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+
+  '@istanbuljs/schema@0.1.3':
+    resolution: {integrity: sha512-ZXRY4jNvVgSVQ8DL3LTcakaAtXwTVUxE81hslsyD2AtoXW/wVob10HkOJ1X/pAlcI7D+2YoZKg5do8G/w6RYgA==}
+    engines: {node: '>=8'}
+
+  '@jest/types@27.4.2':
+    resolution: {integrity: sha512-j35yw0PMTPpZsUoOBiuHzr1zTYoad1cVIE0ajEjcrJONxxrko/IRGKkXx3os0Nsi4Hu3+5VmDbVfq5WhG/pWAg==}
+    engines: {node: ^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0}
+
+  '@jridgewell/gen-mapping@0.3.13':
+    resolution: {integrity: sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==}
+
+  '@jridgewell/remapping@2.3.5':
+    resolution: {integrity: sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==}
+
+  '@jridgewell/resolve-uri@3.1.2':
+    resolution: {integrity: sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==}
+    engines: {node: '>=6.0.0'}
+
+  '@jridgewell/source-map@0.3.11':
+    resolution: {integrity: sha512-ZMp1V8ZFcPG5dIWnQLr3NSI1MiCU7UETdS/A0G8V/XWHvJv3ZsFqutJn1Y5RPmAPX6F3BiE397OqveU/9NCuIA==}
+
+  '@jridgewell/sourcemap-codec@1.5.5':
+    resolution: {integrity: sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==}
+
+  '@jridgewell/trace-mapping@0.3.31':
+    resolution: {integrity: sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==}
+
+  '@jsdevtools/ono@7.1.3':
+    resolution: {integrity: sha512-4JQNk+3mVzK3xh2rqd6RB4J46qUR19azEHBneZyTZM+c456qOrbbM/5xcR8huNCCcbVt7+UmizG6GuUvPvKUYg==}
+
+  '@jsonjoy.com/base64@1.1.2':
+    resolution: {integrity: sha512-q6XAnWQDIMA3+FTiOYajoYqySkO+JSat0ytXGSuRdq9uXE7o92gzuQwQM14xaCRlBLGq3v5miDGC4vkVTn54xA==}
+    engines: {node: '>=10.0'}
+    peerDependencies:
+      tslib: '2'
+
+  '@jsonjoy.com/base64@17.65.0':
+    resolution: {integrity: sha512-Xrh7Fm/M0QAYpekSgmskdZYnFdSGnsxJ/tHaolA4bNwWdG9i65S8m83Meh7FOxyJyQAdo4d4J97NOomBLEfkDQ==}
+    engines: {node: '>=10.0'}
+    peerDependencies:
+      tslib: '2'
+
+  '@jsonjoy.com/buffers@1.2.1':
+    resolution: {integrity: sha512-12cdlDwX4RUM3QxmUbVJWqZ/mrK6dFQH4Zxq6+r1YXKXYBNgZXndx2qbCJwh3+WWkCSn67IjnlG3XYTvmvYtgA==}
+    engines: {node: '>=10.0'}
+    peerDependencies:
+      tslib: '2'
+
+  '@jsonjoy.com/buffers@17.65.0':
+    resolution: {integrity: sha512-eBrIXd0/Ld3p9lpDDlMaMn6IEfWqtHMD+z61u0JrIiPzsV1r7m6xDZFRxJyvIFTEO+SWdYF9EiQbXZGd8BzPfA==}
+    engines: {node: '>=10.0'}
+    peerDependencies:
+      tslib: '2'
+
+  '@jsonjoy.com/codegen@1.0.0':
+    resolution: {integrity: sha512-E8Oy+08cmCf0EK/NMxpaJZmOxPqM+6iSe2S4nlSBrPZOORoDJILxtbSUEDKQyTamm/BVAhIGllOBNU79/dwf0g==}
+    engines: {node: '>=10.0'}
+    peerDependencies:
+      tslib: '2'
+
+  '@jsonjoy.com/codegen@17.65.0':
+    resolution: {integrity: sha512-7MXcRYe7n3BG+fo3jicvjB0+6ypl2Y/bQp79Sp7KeSiiCgLqw4Oled6chVv07/xLVTdo3qa1CD0VCCnPaw+RGA==}
+    engines: {node: '>=10.0'}
+    peerDependencies:
+      tslib: '2'
+
+  '@jsonjoy.com/fs-core@4.56.10':
+    resolution: {integrity: sha512-PyAEA/3cnHhsGcdY+AmIU+ZPqTuZkDhCXQ2wkXypdLitSpd6d5Ivxhnq4wa2ETRWFVJGabYynBWxIijOswSmOw==}
+    engines: {node: '>=10.0'}
+    peerDependencies:
+      tslib: '2'
+
+  '@jsonjoy.com/fs-fsa@4.56.10':
+    resolution: {integrity: sha512-/FVK63ysNzTPOnCCcPoPHt77TOmachdMS422txM4KhxddLdbW1fIbFMYH0AM0ow/YchCyS5gqEjKLNyv71j/5Q==}
+    engines: {node: '>=10.0'}
+    peerDependencies:
+      tslib: '2'
+
+  '@jsonjoy.com/fs-node-builtins@4.56.10':
+    resolution: {integrity: sha512-uUnKz8R0YJyKq5jXpZtkGV9U0pJDt8hmYcLRrPjROheIfjMXsz82kXMgAA/qNg0wrZ1Kv+hrg7azqEZx6XZCVw==}
+    engines: {node: '>=10.0'}
+    peerDependencies:
+      tslib: '2'
+
+  '@jsonjoy.com/fs-node-to-fsa@4.56.10':
+    resolution: {integrity: sha512-oH+O6Y4lhn9NyG6aEoFwIBNKZeYy66toP5LJcDOMBgL99BKQMUf/zWJspdRhMdn/3hbzQsZ8EHHsuekbFLGUWw==}
+    engines: {node: '>=10.0'}
+    peerDependencies:
+      tslib: '2'
+
+  '@jsonjoy.com/fs-node-utils@4.56.10':
+    resolution: {integrity: sha512-8EuPBgVI2aDPwFdaNQeNpHsyqPi3rr+85tMNG/lHvQLiVjzoZsvxA//Xd8aB567LUhy4QS03ptT+unkD/DIsNg==}
+    engines: {node: '>=10.0'}
+    peerDependencies:
+      tslib: '2'
+
+  '@jsonjoy.com/fs-node@4.56.10':
+    resolution: {integrity: sha512-7R4Gv3tkUdW3dXfXiOkqxkElxKNVdd8BDOWC0/dbERd0pXpPY+s2s1Mino+aTvkGrFPiY+mmVxA7zhskm4Ue4Q==}
+    engines: {node: '>=10.0'}
+    peerDependencies:
+      tslib: '2'
+
+  '@jsonjoy.com/fs-print@4.56.10':
+    resolution: {integrity: sha512-JW4fp5mAYepzFsSGrQ48ep8FXxpg4niFWHdF78wDrFGof7F3tKDJln72QFDEn/27M1yHd4v7sKHHVPh78aWcEw==}
+    engines: {node: '>=10.0'}
+    peerDependencies:
+      tslib: '2'
+
+  '@jsonjoy.com/fs-snapshot@4.56.10':
+    resolution: {integrity: sha512-DkR6l5fj7+qj0+fVKm/OOXMGfDFCGXLfyHkORH3DF8hxkpDgIHbhf/DwncBMs2igu/ST7OEkexn1gIqoU6Y+9g==}
+    engines: {node: '>=10.0'}
+    peerDependencies:
+      tslib: '2'
+
+  '@jsonjoy.com/json-pack@1.21.0':
+    resolution: {integrity: sha512-+AKG+R2cfZMShzrF2uQw34v3zbeDYUqnQ+jg7ORic3BGtfw9p/+N6RJbq/kkV8JmYZaINknaEQ2m0/f693ZPpg==}
+    engines: {node: '>=10.0'}
+    peerDependencies:
+      tslib: '2'
+
+  '@jsonjoy.com/json-pack@17.65.0':
+    resolution: {integrity: sha512-e0SG/6qUCnVhHa0rjDJHgnXnbsacooHVqQHxspjvlYQSkHm+66wkHw6Gql+3u/WxI/b1VsOdUi0M+fOtkgKGdQ==}
+    engines: {node: '>=10.0'}
+    peerDependencies:
+      tslib: '2'
+
+  '@jsonjoy.com/json-pointer@1.0.2':
+    resolution: {integrity: sha512-Fsn6wM2zlDzY1U+v4Nc8bo3bVqgfNTGcn6dMgs6FjrEnt4ZCe60o6ByKRjOGlI2gow0aE/Q41QOigdTqkyK5fg==}
+    engines: {node: '>=10.0'}
+    peerDependencies:
+      tslib: '2'
+
+  '@jsonjoy.com/json-pointer@17.65.0':
+    resolution: {integrity: sha512-uhTe+XhlIZpWOxgPcnO+iSCDgKKBpwkDVTyYiXX9VayGV8HSFVJM67M6pUE71zdnXF1W0Da21AvnhlmdwYPpow==}
+    engines: {node: '>=10.0'}
+    peerDependencies:
+      tslib: '2'
+
+  '@jsonjoy.com/util@1.9.0':
+    resolution: {integrity: sha512-pLuQo+VPRnN8hfPqUTLTHk126wuYdXVxE6aDmjSeV4NCAgyxWbiOIeNJVtID3h1Vzpoi9m4jXezf73I6LgabgQ==}
+    engines: {node: '>=10.0'}
+    peerDependencies:
+      tslib: '2'
+
+  '@jsonjoy.com/util@17.65.0':
+    resolution: {integrity: sha512-cWiEHZccQORf96q2y6zU3wDeIVPeidmGqd9cNKJRYoVHTV0S1eHPy5JTbHpMnGfDvtvujQwQozOqgO9ABu6h0w==}
+    engines: {node: '>=10.0'}
+    peerDependencies:
+      tslib: '2'
+
+  '@leichtgewicht/ip-codec@2.0.4':
+    resolution: {integrity: sha512-Hcv+nVC0kZnQ3tD9GVu5xSMR4VVYOteQIr/hwFPVEvPdlXqgGEuRjiheChHgdM+JyqdgNcmzZOX/tnl0JOiI7A==}
+
+  '@lezer/common@1.5.2':
+    resolution: {integrity: sha512-sxQE460fPZyU3sdc8lafxiPwJHBzZRy/udNFynGQky1SePYBdhkBl1kOagA9uT3pxR8K09bOrmTUqA9wb/PjSQ==}
+
+  '@lezer/highlight@1.2.1':
+    resolution: {integrity: sha512-Z5duk4RN/3zuVO7Jq0pGLJ3qynpxUVsh7IbUbGj88+uV2ApSAn6kWg2au3iJb+0Zi7kKtqffIESgNcRXWZWmSA==}
+
+  '@lezer/json@1.0.3':
+    resolution: {integrity: sha512-BP9KzdF9Y35PDpv04r0VeSTKDeox5vVr3efE7eBbx3r4s3oNLfunchejZhjArmeieBH+nVOpgIiBJpEAv8ilqQ==}
+
+  '@lezer/lr@1.4.2':
+    resolution: {integrity: sha512-pu0K1jCIdnQ12aWNaAVU5bzi7Bd1w54J3ECgANPmYLtQKP0HBj2cE/5coBD66MT10xbtIuUr7tg0Shbsvk0mDA==}
+
+  '@lezer/yaml@1.0.3':
+    resolution: {integrity: sha512-GuBLekbw9jDBDhGur82nuwkxKQ+a3W5H0GfaAthDXcAu+XdpS43VlnxA9E9hllkpSP5ellRDKjLLj7Lu9Wr6xA==}
+
+  '@lukeed/ms@2.0.2':
+    resolution: {integrity: sha512-9I2Zn6+NJLfaGoz9jN3lpwDgAYvfGeNYdbAIjJOqzs4Tpc+VU3Jqq4IofSUBKajiDS8k9fZIg18/z13mpk1bsA==}
+    engines: {node: '>=8'}
+
+  '@marijn/find-cluster-break@1.0.2':
+    resolution: {integrity: sha512-l0h88YhZFyKdXIFNfSWpyjStDjGHwZ/U7iobcK1cQQD8sejsONdQtTVU+1wVN1PBw40PiiHB1vA5S7VTfQiP9g==}
+
+  '@mdx-js/react@3.1.1':
+    resolution: {integrity: sha512-f++rKLQgUVYDAtECQ6fn/is15GkEH9+nZPM3MS0RcxVqoTfawHvDlSCH7JbMhAM6uJ32v3eXLvLmLvjGu7PTQw==}
+    peerDependencies:
+      '@types/react': ^17.0.37
+      react: '>=16'
+
+  '@mswjs/interceptors@0.41.9':
+    resolution: {integrity: sha512-VVPPgHyQ6ShqnrmDWuxjmUIsO9gWyOZFmuOfLd9LfBGQJwZfy0gvv9pbHSJuoFNIYC7ZDX9aoFwowjcdSC4E8w==}
+    engines: {node: '>=18'}
+
+  '@napi-rs/wasm-runtime@0.2.12':
+    resolution: {integrity: sha512-ZVWUcfwY4E/yPitQJl481FjFo3K22D6qF0DuFH6Y/nbnE11GY5uguDxZMGXPQ8WQ0128MXQD7TnfHyK4oWoIJQ==}
+
+  '@napi-rs/wasm-runtime@1.1.4':
+    resolution: {integrity: sha512-3NQNNgA1YSlJb/kMH1ildASP9HW7/7kYnRI2szWJaofaS1hWmbGI4H+d3+22aGzXXN9IJ+n+GiFVcGipJP18ow==}
+    peerDependencies:
+      '@emnapi/core': ^1.7.1
+      '@emnapi/runtime': ^1.7.1
+
+  '@neoconfetti/react@1.0.0':
+    resolution: {integrity: sha512-klcSooChXXOzIm+SE5IISIAn3bYzYfPjbX7D7HoqZL84oAfgREeSg5vSIaSFH+DaGzzvImTyWe1OyrJ67vik4A==}
+
+  '@noble/hashes@1.4.0':
+    resolution: {integrity: sha512-V1JJ1WTRUqHHrOSh597hURcMqVKVGL/ea3kv0gSnEdsEZ0/+VyPghM1lMNGc00z7CIQorSvbKpuJkxvuHbvdbg==}
+    engines: {node: '>= 16'}
+
+  '@nodelib/fs.scandir@2.1.5':
+    resolution: {integrity: sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==}
+    engines: {node: '>= 8'}
+
+  '@nodelib/fs.stat@2.0.5':
+    resolution: {integrity: sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A==}
+    engines: {node: '>= 8'}
+
+  '@nodelib/fs.walk@1.2.8':
+    resolution: {integrity: sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==}
+    engines: {node: '>= 8'}
+
+  '@nxmix/tokenize-ansi@3.0.0':
+    resolution: {integrity: sha512-37QMpFIiQ6J31tavjMFCuWs3YIqXIDCuGvPiDVofFqvgXq6vM+8LqU4sqibsvb9JX/1SIeDp+SedOqpq2qc7TA==}
+    engines: {node: '>=6.0.0'}
+
+  '@open-draft/deferred-promise@2.2.0':
+    resolution: {integrity: sha512-CecwLWx3rhxVQF6V4bAgPS5t+So2sTbPgAzafKkVizyi7tlwpcFpdFqq+wqF2OwNBmqFuu6tOyouTuxgpMfzmA==}
+
+  '@open-draft/deferred-promise@3.0.0':
+    resolution: {integrity: sha512-XW375UK8/9SqUVNVa6M0yEy8+iTi4QN5VZ7aZuRFQmy76LRwI9wy5F4YIBU6T+eTe2/DNDo8tqu8RHlwLHM6RA==}
+
+  '@open-draft/logger@0.3.0':
+    resolution: {integrity: sha512-X2g45fzhxH238HKO4xbSr7+wBS8Fvw6ixhTDuvLd5mqh6bJJCFAPwU9mPDxbcrRtfxv4u5IHCEH77BmxvXmmxQ==}
+
+  '@open-draft/until@2.1.0':
+    resolution: {integrity: sha512-U69T3ItWHvLwGg5eJ0n3I62nWuE6ilHlmz7zM0npLBRvPRd7e6NYmg54vvRtP5mZG7kZqZCFVdsTWo7BPtBujg==}
+
+  '@oxc-parser/binding-android-arm-eabi@0.127.0':
+    resolution: {integrity: sha512-0LC7ye4hvqbIKxAzThzvswgHLFu2AURKzYLeSVvLdu2TBOYWQDmHnTqPLeA597BcUCxiLqLsS4CJ5uoI5WYWCQ==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm]
+    os: [android]
+
+  '@oxc-parser/binding-android-arm64@0.127.0':
+    resolution: {integrity: sha512-b5jtVTH6AU5CJXHNdj7Jj9IEiR9yVjjnwHzPJhGyHGPdcsZSzBCkS9GBbV33niRMvKthDwQRFRJfI4a+k4PvYg==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm64]
+    os: [android]
+
+  '@oxc-parser/binding-darwin-arm64@0.127.0':
+    resolution: {integrity: sha512-obCE8B7ISKkJidjlhv9xRGJPOSDG2Yu6PRga9Ruaz35uintHxbp1Ki/Yc71wx4rj3Edrm0a1kzG1TAwit0wFpg==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@oxc-parser/binding-darwin-x64@0.127.0':
+    resolution: {integrity: sha512-JL6Xb5IwPQT8rUzlpsX7E+AgfcdNklXNPFp8pjCQQ5MQOQo5rtEB2ui+3Hgg9Sn7Y9Egj6YOLLiHhLpdAe12Aw==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [x64]
+    os: [darwin]
+
+  '@oxc-parser/binding-freebsd-x64@0.127.0':
+    resolution: {integrity: sha512-SDQ/3MQFw58fqQz3Z1PhSKFF3JoCF4gmlNjziDm8X02tTahCw0qJbd7FGPDKw1i4VTBZene9JPyC3mHtSvi+wA==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@oxc-parser/binding-linux-arm-gnueabihf@0.127.0':
+    resolution: {integrity: sha512-Av+D1MIqzV0YMGPT9we2SIZaMKD7Cxs4CvXSx/yxaWHewZjYEjScpOf5igc8IILASViw4WTnjlwUdI1KzVtDHQ==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm]
+    os: [linux]
+
+  '@oxc-parser/binding-linux-arm-musleabihf@0.127.0':
+    resolution: {integrity: sha512-Cs2fdJ8cPpFdeebj6p4dag8A4+56hPvZ0AhQQzlaLswGz1tz7bXt1nETLeorrM9+AMcWFFkqxcXwDGfTVidY8g==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm]
+    os: [linux]
+
+  '@oxc-parser/binding-linux-arm64-gnu@0.127.0':
+    resolution: {integrity: sha512-qdOfTcT6SY8gsJrrV92uyEUyjqMGPpIB5JZUG6QN5dukYd+7/j0kX6MwK1DgQj39jtUYixxPiaRUiEN1+0CXgQ==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm64]
+    os: [linux]
+
+  '@oxc-parser/binding-linux-arm64-musl@0.127.0':
+    resolution: {integrity: sha512-EoTCZneNFU/P2qrpEM+RHmQwt+CvDkyGESG6qhr7KaegXLZwePfbrkCDfAk8/rhxbDUVGsZILX+2tqPzFtoFWA==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm64]
+    os: [linux]
+
+  '@oxc-parser/binding-linux-ppc64-gnu@0.127.0':
+    resolution: {integrity: sha512-zALjmZYgxFLHjXeudcDF0xFGNydTAtkAeXAr2EuC17ywCyFxcmQra4w0BMde0Yi/re4Bi4iwEoEXtYN7l6eBLQ==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [ppc64]
+    os: [linux]
+
+  '@oxc-parser/binding-linux-riscv64-gnu@0.127.0':
+    resolution: {integrity: sha512-fPP8M6zQLS7Jz7o9d5ArUSuAuSK3e+WCYVrCpdzeCOejidtZExJ9tjhDrAd3HEPqARBCPmdpqxESPFqy44vkBQ==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [riscv64]
+    os: [linux]
+
+  '@oxc-parser/binding-linux-riscv64-musl@0.127.0':
+    resolution: {integrity: sha512-7IcC4Ao02oGpfnjt+X/oF4U2mllo2qoSkw5xxiXNKL9MCTsTiAC6616beOuehdxGcnz1bRoPC1RQ2f1GQDdN+g==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [riscv64]
+    os: [linux]
+
+  '@oxc-parser/binding-linux-s390x-gnu@0.127.0':
+    resolution: {integrity: sha512-pbXIhiNFHoqWeqDNLiJ9JkpHz1IM9k4DXa66x+1GTWMG7iLxtkXgE53iiuKSXwmk3zIYmaPVfBvgcAhS583K4Q==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [s390x]
+    os: [linux]
+
+  '@oxc-parser/binding-linux-x64-gnu@0.127.0':
+    resolution: {integrity: sha512-MYCguB9RvBvlSd6gbuNI7QwiLoCCAlGnlRJFPrzLI6U1/9wkC/WK6LtBAUln55H1Ctqw45PWmqrobKoMhsYQzQ==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [x64]
+    os: [linux]
+
+  '@oxc-parser/binding-linux-x64-musl@0.127.0':
+    resolution: {integrity: sha512-5eY0B/bxf1xIUxb4NOTvOI3KWtBQfPWYyKAzgcrCt0mDibSZygVpO1Pz8bkeiSZ5Jj9+M09dkggG3H8I5d0Uyg==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [x64]
+    os: [linux]
+
+  '@oxc-parser/binding-openharmony-arm64@0.127.0':
+    resolution: {integrity: sha512-Gld0ajrFTUXNtdw20fVBuTQx66FA75nIVg+//pPfR3sXkuABB4mTBhl3r9JNzrJpgW//qiwxf0nWXUWGJSL3UQ==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm64]
+    os: [openharmony]
+
+  '@oxc-parser/binding-wasm32-wasi@0.127.0':
+    resolution: {integrity: sha512-T6KVD7rhLzFlwGRXMnxUFfkCZD8FHnb968wVXW1mXzgRFc5RNXOBY2mPPDZ77x5Ln76ltLMgtPg0cOkU1NSrEQ==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [wasm32]
+
+  '@oxc-parser/binding-win32-arm64-msvc@0.127.0':
+    resolution: {integrity: sha512-Ujvw4X+LD1CCGULcsQcvb4YNVoBGqt+JHgNNzGGaCImELiZLk477ifUH53gIbE7EKd933NdTi25JWEr9K2HwXw==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm64]
+    os: [win32]
+
+  '@oxc-parser/binding-win32-ia32-msvc@0.127.0':
+    resolution: {integrity: sha512-0cwxKO7KHQQQfo4Uf4B2SQrhgm+cJaP9OvFFhx52Tkg4bezsacu83GB2/In5bC415Ueeym+kXdnge/57rbSfTw==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [ia32]
+    os: [win32]
+
+  '@oxc-parser/binding-win32-x64-msvc@0.127.0':
+    resolution: {integrity: sha512-rOrnSQSCbhI2kowr9XxE7m9a8oQXnBHjnS6j95LxxAnEZ0+Fz20WlRXG4ondQb+ejjt2KOsa65sE6++L6kUd+w==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [x64]
+    os: [win32]
+
+  '@oxc-project/types@0.127.0':
+    resolution: {integrity: sha512-aIYXQBo4lCbO4z0R3FHeucQHpF46l2LbMdxRvqvuRuW2OxdnSkcng5B8+K12spgLDj93rtN3+J2Vac/TIO+ciQ==}
+
+  '@oxc-project/types@0.133.0':
+    resolution: {integrity: sha512-KzkdCd6Uxqnf6l3HOw1xfatAlUURA0g14cvBYFyJ5SaNOQbOUvBr9PKArcPcrNIeRsBdgcUzOGrhKveVpvOIGA==}
+
+  '@oxc-resolver/binding-android-arm-eabi@11.20.0':
+    resolution: {integrity: sha512-IjfWOXRgJFNdORDl+Uf1aibNgZY2guOD3zmOhx1BGVb/MIiqlFTdmjpQNplSN58lhWehnX4UNqC3QwpUo8pjJg==}
+    cpu: [arm]
+    os: [android]
+
+  '@oxc-resolver/binding-android-arm64@11.20.0':
+    resolution: {integrity: sha512-QqslZAuFQG8Q9xm7JuIn8JUbvywhSBMVhuQHtYW+auirZJloS41oxUUaBXk7uUhZJgp44c5zQLeVvmFaDQB+2Q==}
+    cpu: [arm64]
+    os: [android]
+
+  '@oxc-resolver/binding-darwin-arm64@11.20.0':
+    resolution: {integrity: sha512-MUcavykj2ewlR+kc5arpg4tC2RvzJkUxWtNv74pf7lcNk00GpIpN43vXMj+j6r4eMmfZhlb8hueKoIb8e9kAGQ==}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@oxc-resolver/binding-darwin-x64@11.20.0':
+    resolution: {integrity: sha512-BGB16nRUK5Etiv//ihPyzj8Lj1px0mhh4YIfe0FDf045ywknfSm0GEbiRESpr6Q4K82AvnyaRIhhluHByvS4bg==}
+    cpu: [x64]
+    os: [darwin]
+
+  '@oxc-resolver/binding-freebsd-x64@11.20.0':
+    resolution: {integrity: sha512-JZgtePaqj3qmD5XFHJaSLWzHRxQu0LaPkdoM1KJXYADvAaa83ijXHclV3ej3CueeW0wxfIAbGCZVP45J0CA7uQ==}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@oxc-resolver/binding-linux-arm-gnueabihf@11.20.0':
+    resolution: {integrity: sha512-hOQ/p3ry3v3SchUBXicrrnszaI/UmYzM4wtS4RGfwgVUX7a+HbyQSzJ5aOzu+o6XZkFkS3ZXN4PZAzhOb77OSg==}
+    cpu: [arm]
+    os: [linux]
+
+  '@oxc-resolver/binding-linux-arm-musleabihf@11.20.0':
+    resolution: {integrity: sha512-2ArPksaw0AqeuGBfoS715VF+JvJQAhD2niWgjE5hVO+L+nAfikVQopvngCMX9x4BD8itWoQ3dnikrQyl5Ho5Jg==}
+    cpu: [arm]
+    os: [linux]
+
+  '@oxc-resolver/binding-linux-arm64-gnu@11.20.0':
+    resolution: {integrity: sha512-0bJnmYFp62JdZ4nVMDUZ/C58BCZOCcqgKtnUlp7L9Ojf/czIN+3j72YlLPeWLkzlr6SlYvIQA4SGV/HyO0d+qg==}
+    cpu: [arm64]
+    os: [linux]
+
+  '@oxc-resolver/binding-linux-arm64-musl@11.20.0':
+    resolution: {integrity: sha512-wKHHzPKZo7Ufhv/Bt6yxT7FOgnIgW4gwXcJUipkShGp68W3wGVqvr1Sr0fY65lN0Oy6y41+g2kIDvkgZaMMUkw==}
+    cpu: [arm64]
+    os: [linux]
+
+  '@oxc-resolver/binding-linux-ppc64-gnu@11.20.0':
+    resolution: {integrity: sha512-RN8goF7Ie0B79L4i4G6OeBocTgSC56vJbQ65VJje+oXnldVpLnOU7j/AQ/dP94TcCS+Yh6WG8u3Qt4ETteXFNQ==}
+    cpu: [ppc64]
+    os: [linux]
+
+  '@oxc-resolver/binding-linux-riscv64-gnu@11.20.0':
+    resolution: {integrity: sha512-5l1yU6/xQEqLZRzxqmMxJfWPslpwCmBsdDGaBvABPehxquCXDC7dd7oraNdKSJUMDXSM7VvVj8H2D2FTjU7oWw==}
+    cpu: [riscv64]
+    os: [linux]
+
+  '@oxc-resolver/binding-linux-riscv64-musl@11.20.0':
+    resolution: {integrity: sha512-xHEvkbgz6UC+A3JOyDQy76LkUaxsNSfIr3/GV8slwZsnuooJiIB34gzJfsyvR4JdCYNUUPsRJc/w/oWkODu+hg==}
+    cpu: [riscv64]
+    os: [linux]
+
+  '@oxc-resolver/binding-linux-s390x-gnu@11.20.0':
+    resolution: {integrity: sha512-aWPDUUmSeyHvlW+SoEUd+JIJsQhVhu6a5tBpDRMu058naPAchTgAVGCFy35zjbnFlt0i8hLWziff6HX0D3LU4g==}
+    cpu: [s390x]
+    os: [linux]
+
+  '@oxc-resolver/binding-linux-x64-gnu@11.20.0':
+    resolution: {integrity: sha512-x2YeSimvhJjKLVD8KSu8f/rqU1potcdEMkApIPJqjZWN7c2Fpt4g2X32WDg1p+XDAmyT7nuQGe0vnhvXeLbH+g==}
+    cpu: [x64]
+    os: [linux]
+
+  '@oxc-resolver/binding-linux-x64-musl@11.20.0':
+    resolution: {integrity: sha512-kcRLEIxpZefeYfLChjpgFf3ilBzRDZ+yobMrpRsQlSrxuFGtm3U6PMU7AaEpMqo3NfDGVyJJseAjnRLzMFHjwQ==}
+    cpu: [x64]
+    os: [linux]
+
+  '@oxc-resolver/binding-openharmony-arm64@11.20.0':
+    resolution: {integrity: sha512-HHcfnApSZGtKhTiHqe8OZruOZe5XuFQH5/E0Yhj3u8fnFvzkM4/k6WjacUf4SvA0SPEAbfbgYmVPuo0VX/fIBQ==}
+    cpu: [arm64]
+    os: [openharmony]
+
+  '@oxc-resolver/binding-wasm32-wasi@11.20.0':
+    resolution: {integrity: sha512-Tn0y1XOFYHNfK1wp1Z5QK8Rcld/bsOwRISQXfqAZ5IBpv8Gz1IvV39fUWNprqNdRizgcvFhOzWwFun2zkJsyBg==}
+    engines: {node: '>=14.0.0'}
+    cpu: [wasm32]
+
+  '@oxc-resolver/binding-win32-arm64-msvc@11.20.0':
+    resolution: {integrity: sha512-qPi25YNPe4YenS8MgsQU2+bIFHxxpLx1LVna2444cEHqNPhNjvWf9zqj4aWE43H9LpAsTmkkAlA3eL5ElBU3mA==}
+    cpu: [arm64]
+    os: [win32]
+
+  '@oxc-resolver/binding-win32-x64-msvc@11.20.0':
+    resolution: {integrity: sha512-Wb14jWEW8huH6It9F6sXd9vrYmIS7pMrgkU6sxpLxkP+9z+wRgs71hUEhRpcn8FOXAFa27FVWfY2tRpbfTzfLw==}
+    cpu: [x64]
+    os: [win32]
+
+  '@peculiar/asn1-cms@2.6.0':
+    resolution: {integrity: sha512-2uZqP+ggSncESeUF/9Su8rWqGclEfEiz1SyU02WX5fUONFfkjzS2Z/F1Li0ofSmf4JqYXIOdCAZqIXAIBAT1OA==}
+
+  '@peculiar/asn1-csr@2.6.0':
+    resolution: {integrity: sha512-BeWIu5VpTIhfRysfEp73SGbwjjoLL/JWXhJ/9mo4vXnz3tRGm+NGm3KNcRzQ9VMVqwYS2RHlolz21svzRXIHPQ==}
+
+  '@peculiar/asn1-ecc@2.6.0':
+    resolution: {integrity: sha512-FF3LMGq6SfAOwUG2sKpPXblibn6XnEIKa+SryvUl5Pik+WR9rmRA3OCiwz8R3lVXnYnyRkSZsSLdml8H3UiOcw==}
+
+  '@peculiar/asn1-pfx@2.6.0':
+    resolution: {integrity: sha512-rtUvtf+tyKGgokHHmZzeUojRZJYPxoD/jaN1+VAB4kKR7tXrnDCA/RAWXAIhMJJC+7W27IIRGe9djvxKgsldCQ==}
+
+  '@peculiar/asn1-pkcs8@2.6.0':
+    resolution: {integrity: sha512-KyQ4D8G/NrS7Fw3XCJrngxmjwO/3htnA0lL9gDICvEQ+GJ+EPFqldcJQTwPIdvx98Tua+WjkdKHSC0/Km7T+lA==}
+
+  '@peculiar/asn1-pkcs9@2.6.0':
+    resolution: {integrity: sha512-b78OQ6OciW0aqZxdzliXGYHASeCvvw5caqidbpQRYW2mBtXIX2WhofNXTEe7NyxTb0P6J62kAAWLwn0HuMF1Fw==}
+
+  '@peculiar/asn1-rsa@2.6.0':
+    resolution: {integrity: sha512-Nu4C19tsrTsCp9fDrH+sdcOKoVfdfoQQ7S3VqjJU6vedR7tY3RLkQ5oguOIB3zFW33USDUuYZnPEQYySlgha4w==}
+
+  '@peculiar/asn1-schema@2.6.0':
+    resolution: {integrity: sha512-xNLYLBFTBKkCzEZIw842BxytQQATQv+lDTCEMZ8C196iJcJJMBUZxrhSTxLaohMyKK8QlzRNTRkUmanucnDSqg==}
+
+  '@peculiar/asn1-x509-attr@2.6.0':
+    resolution: {integrity: sha512-MuIAXFX3/dc8gmoZBkwJWxUWOSvG4MMDntXhrOZpJVMkYX+MYc/rUAU2uJOved9iJEoiUx7//3D8oG83a78UJA==}
+
+  '@peculiar/asn1-x509@2.6.0':
+    resolution: {integrity: sha512-uzYbPEpoQiBoTq0/+jZtpM6Gq6zADBx+JNFP3yqRgziWBxQ/Dt/HcuvRfm9zJTPdRcBqPNdaRHTVwpyiq6iNMA==}
+
+  '@peculiar/x509@1.14.3':
+    resolution: {integrity: sha512-C2Xj8FZ0uHWeCXXqX5B4/gVFQmtSkiuOolzAgutjTfseNOHT3pUjljDZsTSxXFGgio54bCzVFqmEOUrIVk8RDA==}
+    engines: {node: '>=20.0.0'}
+
+  '@polka/url@1.0.0-next.29':
+    resolution: {integrity: sha512-wwQAWhWSuHaag8c4q/KN/vCoeOJYshAIvMQwD4GpSb3OiZklFfvAgmj0VCBBImRpuF/aFgIRzllXlVX93Jevww==}
+
+  '@popperjs/core@2.11.6':
+    resolution: {integrity: sha512-50/17A98tWUfQ176raKiOGXuYpLyyVMkxxG6oylzL3BPOlA6ADGdK7EYunSa4I064xerltq9TGXs8HmOk5E+vw==}
+
+  '@radix-ui/primitive@1.1.2':
+    resolution: {integrity: sha512-XnbHrrprsNqZKQhStrSwgRUQzoCI1glLzdw79xiZPoofhGICeZRSQ3dIxAKH1gb3OHfNf4d6f+vAv3kil2eggA==}
+
+  '@radix-ui/react-compose-refs@1.1.2':
+    resolution: {integrity: sha512-z4eqJvfiNnFMHIIvXP3CY57y2WJs5g2v3X0zm9mEJkrkNv4rDxu+sg9Jh8EkXyeqBkB7SOcboo9dMVqhyrACIg==}
+    peerDependencies:
+      '@types/react': ^17.0.37
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-context@1.1.2':
+    resolution: {integrity: sha512-jCi/QKUM2r1Ju5a3J64TH2A5SpKAgh0LpknyqdQ4m6DCV0xJ2HG1xARRwNGPQfi1SLdLWZ1OJz6F4OMBBNiGJA==}
+    peerDependencies:
+      '@types/react': ^17.0.37
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-dialog@1.1.11':
+    resolution: {integrity: sha512-yI7S1ipkP5/+99qhSI6nthfo/tR6bL6Zgxi/+1UO6qPa6UeM6nlafWcQ65vB4rU2XjgjMfMhI3k9Y5MztA62VQ==}
+    peerDependencies:
+      '@types/react': ^17.0.37
+      '@types/react-dom': ^17.0.11
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-dismissable-layer@1.1.7':
+    resolution: {integrity: sha512-j5+WBUdhccJsmH5/H0K6RncjDtoALSEr6jbkaZu+bjw6hOPOhHycr6vEUujl+HBK8kjUfWcoCJXxP6e4lUlMZw==}
+    peerDependencies:
+      '@types/react': ^17.0.37
+      '@types/react-dom': ^17.0.11
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-focus-guards@1.1.2':
+    resolution: {integrity: sha512-fyjAACV62oPV925xFCrH8DR5xWhg9KYtJT4s3u54jxp+L/hbpTY2kIeEFFbFe+a/HCE94zGQMZLIpVTPVZDhaA==}
+    peerDependencies:
+      '@types/react': ^17.0.37
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-focus-scope@1.1.4':
+    resolution: {integrity: sha512-r2annK27lIW5w9Ho5NyQgqs0MmgZSTIKXWpVCJaLC1q2kZrZkcqnmHkCHMEmv8XLvsLlurKMPT+kbKkRkm/xVA==}
+    peerDependencies:
+      '@types/react': ^17.0.37
+      '@types/react-dom': ^17.0.11
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-id@1.1.1':
+    resolution: {integrity: sha512-kGkGegYIdQsOb4XjsfM97rXsiHaBwco+hFI66oO4s9LU+PLAC5oJ7khdOVFxkhsmlbpUqDAvXw11CluXP+jkHg==}
+    peerDependencies:
+      '@types/react': ^17.0.37
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-portal@1.1.6':
+    resolution: {integrity: sha512-XmsIl2z1n/TsYFLIdYam2rmFwf9OC/Sh2avkbmVMDuBZIe7hSpM0cYnWPAo7nHOVx8zTuwDZGByfcqLdnzp3Vw==}
+    peerDependencies:
+      '@types/react': ^17.0.37
+      '@types/react-dom': ^17.0.11
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-presence@1.1.4':
+    resolution: {integrity: sha512-ueDqRbdc4/bkaQT3GIpLQssRlFgWaL/U2z/S31qRwwLWoxHLgry3SIfCwhxeQNbirEUXFa+lq3RL3oBYXtcmIA==}
+    peerDependencies:
+      '@types/react': ^17.0.37
+      '@types/react-dom': ^17.0.11
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-primitive@2.1.0':
+    resolution: {integrity: sha512-/J/FhLdK0zVcILOwt5g+dH4KnkonCtkVJsa2G6JmvbbtZfBEI1gMsO3QMjseL4F/SwfAMt1Vc/0XKYKq+xJ1sw==}
+    peerDependencies:
+      '@types/react': ^17.0.37
+      '@types/react-dom': ^17.0.11
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-slot@1.2.0':
+    resolution: {integrity: sha512-ujc+V6r0HNDviYqIK3rW4ffgYiZ8g5DEHrGJVk4x7kTlLXRDILnKX9vAUYeIsLOoDpDJ0ujpqMkjH4w2ofuo6w==}
+    peerDependencies:
+      '@types/react': ^17.0.37
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-slot@1.2.4':
+    resolution: {integrity: sha512-Jl+bCv8HxKnlTLVrcDE8zTMJ09R9/ukw4qBs/oZClOfoQk/cOTbDn+NceXfV7j09YPVQUryJPHurafcSg6EVKA==}
+    peerDependencies:
+      '@types/react': ^17.0.37
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-use-callback-ref@1.1.1':
+    resolution: {integrity: sha512-FkBMwD+qbGQeMu1cOHnuGB6x4yzPjho8ap5WtbEJ26umhgqVXbhekKUQO+hZEL1vU92a3wHwdp0HAcqAUF5iDg==}
+    peerDependencies:
+      '@types/react': ^17.0.37
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-use-controllable-state@1.2.2':
+    resolution: {integrity: sha512-BjasUjixPFdS+NKkypcyyN5Pmg83Olst0+c6vGov0diwTEo6mgdqVR6hxcEgFuh4QrAs7Rc+9KuGJ9TVCj0Zzg==}
+    peerDependencies:
+      '@types/react': ^17.0.37
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-use-effect-event@0.0.2':
+    resolution: {integrity: sha512-Qp8WbZOBe+blgpuUT+lw2xheLP8q0oatc9UpmiemEICxGvFLYmHm9QowVZGHtJlGbS6A6yJ3iViad/2cVjnOiA==}
+    peerDependencies:
+      '@types/react': ^17.0.37
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-use-escape-keydown@1.1.1':
+    resolution: {integrity: sha512-Il0+boE7w/XebUHyBjroE+DbByORGR9KKmITzbR7MyQ4akpORYP/ZmbhAr0DG7RmmBqoOnZdy2QlvajJ2QA59g==}
+    peerDependencies:
+      '@types/react': ^17.0.37
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-use-layout-effect@1.1.1':
+    resolution: {integrity: sha512-RbJRS4UWQFkzHTTwVymMTUv8EqYhOp8dOOviLj2ugtTiXRaRQS7GLGxZTLL1jWhMeoSCf5zmcZkqTl9IiYfXcQ==}
+    peerDependencies:
+      '@types/react': ^17.0.37
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@reach/auto-id@0.16.0':
+    resolution: {integrity: sha512-5ssbeP5bCkM39uVsfQCwBBL+KT8YColdnMN5/Eto6Rj7929ql95R3HZUOkKIvj7mgPtEb60BLQxd1P3o6cjbmg==}
+    peerDependencies:
+      react: ^16.8.0 || 17.x
+      react-dom: ^16.8.0 || 17.x
+
+  '@reach/auto-id@0.18.0':
+    resolution: {integrity: sha512-XwY1IwhM7mkHZFghhjiqjQ6dstbOdpbFLdggeke75u8/8icT8uEHLbovFUgzKjy9qPvYwZIB87rLiR8WdtOXCg==}
+    peerDependencies:
+      react: ^16.8.0 || 17.x
+      react-dom: ^16.8.0 || 17.x
+
+  '@reach/combobox@0.18.0':
+    resolution: {integrity: sha512-x60PiPOIB4azeyh+FZ/svh0kXZRCneGCXVLL6htWs1VmaKq+TWR/48V03yQX5cSKjvRM8UFDVn47mpcg5ZSFtg==}
+    peerDependencies:
+      react: ^16.8.0 || 17.x
+      react-dom: ^16.8.0 || 17.x
+
+  '@reach/descendants@0.16.1':
+    resolution: {integrity: sha512-3WZgRnD9O4EORKE31rrduJDiPFNMOjUkATx0zl192ZxMq3qITe4tUj70pS5IbJl/+v9zk78JwyQLvA1pL7XAPA==}
+    peerDependencies:
+      react: ^16.8.0 || 17.x
+      react-dom: ^16.8.0 || 17.x
+
+  '@reach/descendants@0.18.0':
+    resolution: {integrity: sha512-GXUxnM6CfrX5URdnipPIl3Tlc6geuz4xb4n61y4tVWXQX1278Ra9Jz9DMRN8x4wheHAysvrYwnR/SzAlxQzwtA==}
+    peerDependencies:
+      react: ^16.8.0 || 17.x
+      react-dom: ^16.8.0 || 17.x
+
+  '@reach/dialog@0.17.0':
+    resolution: {integrity: sha512-AnfKXugqDTGbeG3c8xDcrQDE4h9b/vnc27Sa118oQSquz52fneUeX9MeFb5ZEiBJK8T5NJpv7QUTBIKnFCAH5A==}
+    peerDependencies:
+      react: ^16.8.0 || 17.x
+      react-dom: ^16.8.0 || 17.x
+
+  '@reach/dropdown@0.16.1':
+    resolution: {integrity: sha512-56ITaEAWYFvEYSJz0RqFndrHIDhSuhmobmgB4Wy1q6Aj/3F20Bns1mGu61/ny5Ld8spgP1mJTJViacHsn7x/Dg==}
+    peerDependencies:
+      react: ^16.8.0 || 17.x
+      react-dom: ^16.8.0 || 17.x
+
+  '@reach/menu-button@0.16.1':
+    resolution: {integrity: sha512-0Oh/Oq+GupS48LuBdIu8VyMJFLlWReRAGgT24SrcAAxmlyO/qUP9KJS9D1CEvl2KUoSk2wO0Fu885E4eaBYucA==}
+    peerDependencies:
+      react: ^16.8.0 || 17.x
+      react-dom: ^16.8.0 || 17.x
+      react-is: ^16.8.0 || 17.x
+
+  '@reach/observe-rect@1.2.0':
+    resolution: {integrity: sha512-Ba7HmkFgfQxZqqaeIWWkNK0rEhpxVQHIoVyW1YDSkGsGIXzcaW4deC8B0pZrNSSyLTdIk7y+5olKt5+g0GmFIQ==}
+
+  '@reach/polymorphic@0.18.0':
+    resolution: {integrity: sha512-N9iAjdMbE//6rryZZxAPLRorzDcGBnluf7YQij6XDLiMtfCj1noa7KyLpEc/5XCIB/EwhX3zCluFAwloBKdblA==}
+    peerDependencies:
+      react: ^16.8.0 || 17.x
+
+  '@reach/popover@0.16.0':
+    resolution: {integrity: sha512-xmgiSyQwfshMkMNu6URbGrjjDTD3dnAITojvgEqfEtV1chDYqktKdDbIPrq+UGI54ey/IxbRpVzKcIjXiKoMmA==}
+    peerDependencies:
+      react: ^16.8.0 || 17.x
+      react-dom: ^16.8.0 || 17.x
+
+  '@reach/popover@0.18.0':
+    resolution: {integrity: sha512-mpnWWn4w74L2U7fcneVdA6Fz3yKWNdZIRMoK8s6H7F8U2dLM/qN7AjzjEBqi6LXKb3Uf1ge4KHSbMixW0BygJQ==}
+    peerDependencies:
+      react: ^16.8.0 || 17.x
+      react-dom: ^16.8.0 || 17.x
+
+  '@reach/portal@0.16.0':
+    resolution: {integrity: sha512-vXJ0O9T+72HiSEWHPs2cx7YbSO7pQsTMhgqPc5aaddIYpo2clJx1PnYuS0lSNlVaDO0IxQhwYq43evXaXnmviw==}
+    peerDependencies:
+      react: ^16.8.0 || 17.x
+      react-dom: ^16.8.0 || 17.x
+
+  '@reach/portal@0.17.0':
+    resolution: {integrity: sha512-+IxsgVycOj+WOeNPL2NdgooUdHPSY285wCtj/iWID6akyr4FgGUK7sMhRM9aGFyrGpx2vzr+eggbUmAVZwOz+A==}
+    peerDependencies:
+      react: ^16.8.0 || 17.x
+      react-dom: ^16.8.0 || 17.x
+
+  '@reach/portal@0.18.0':
+    resolution: {integrity: sha512-TImozRapd576ofRk30Le2L3lRTFXF1p47B182wnp5eMTdZa74JX138BtNGEPJFOyrMaVmguVF8SSwZ6a0fon1Q==}
+    peerDependencies:
+      react: ^16.8.0 || 17.x
+      react-dom: ^16.8.0 || 17.x
+
+  '@reach/rect@0.16.0':
+    resolution: {integrity: sha512-/qO9jQDzpOCdrSxVPR6l674mRHNTqfEjkaxZHluwJ/2qGUtYsA0GSZiF/+wX/yOWeBif1ycxJDa6HusAMJZC5Q==}
+    peerDependencies:
+      react: ^16.8.0 || 17.x
+      react-dom: ^16.8.0 || 17.x
+
+  '@reach/rect@0.18.0':
+    resolution: {integrity: sha512-Xk8urN4NLn3F70da/DtByMow83qO6DF6vOxpLjuDBqud+kjKgxAU9vZMBSZJyH37+F8mZinRnHyXtlLn5njQOg==}
+    peerDependencies:
+      react: ^16.8.0 || 17.x
+      react-dom: ^16.8.0 || 17.x
+
+  '@reach/utils@0.16.0':
+    resolution: {integrity: sha512-PCggBet3qaQmwFNcmQ/GqHSefadAFyNCUekq9RrWoaU9hh/S4iaFgf2MBMdM47eQj5i/Bk0Mm07cP/XPFlkN+Q==}
+    peerDependencies:
+      react: ^16.8.0 || 17.x
+      react-dom: ^16.8.0 || 17.x
+
+  '@reach/utils@0.17.0':
+    resolution: {integrity: sha512-M5y8fCBbrWeIsxedgcSw6oDlAMQDkl5uv3VnMVJ7guwpf4E48Xlh1v66z/1BgN/WYe2y8mB/ilFD2nysEfdGeA==}
+    peerDependencies:
+      react: ^16.8.0 || 17.x
+      react-dom: ^16.8.0 || 17.x
+
+  '@reach/utils@0.18.0':
+    resolution: {integrity: sha512-KdVMdpTgDyK8FzdKO9SCpiibuy/kbv3pwgfXshTI6tEcQT1OOwj7BAksnzGC0rPz0UholwC+AgkqEl3EJX3M1A==}
+    peerDependencies:
+      react: ^16.8.0 || 17.x
+      react-dom: ^16.8.0 || 17.x
+
+  '@rolldown/binding-android-arm64@1.0.3':
+    resolution: {integrity: sha512-454rs7jHngixp/NMxd5srYD57OnzSlZ/eFTETjORQHLwJG1lRtmNOJcBerZlfu4GjKqeq8aCCIQrMdHyhI51Hw==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm64]
+    os: [android]
+
+  '@rolldown/binding-darwin-arm64@1.0.3':
+    resolution: {integrity: sha512-PcAhP+ynjURNyy8SKGl5DQP94aGuB/7JrXJb/t7P+hanXvQVMWzUvRRhBAcg/lNRadBhoUPqSoP4xw5tR/KBEA==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@rolldown/binding-darwin-x64@1.0.3':
+    resolution: {integrity: sha512-9YpfeUvSE2RS7wysJ81uOZkXJz7f7Q55H2Gvp3VEw/EsahqDtrphrZ0EwDLK5vvKOzaCrBsjF8JmnMLcUt78Gg==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [x64]
+    os: [darwin]
+
+  '@rolldown/binding-freebsd-x64@1.0.3':
+    resolution: {integrity: sha512-yB1IlAsSNHncV6SCTL27/MVGR5htvQsoGxIv5KMGXALp+Ll1wYsn+x98M9MW7qa+NdSbvrrY7ANI4wLJ0n1e6g==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@rolldown/binding-linux-arm-gnueabihf@1.0.3':
+    resolution: {integrity: sha512-Yi30IVAAfLUCy2MseFjbB1jAMDl1VMCAas5StnYp8da9+CKvMd2H2cbEjWcw5NPaPqzvYkVIaF1nNUG+b7u/sw==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm]
+    os: [linux]
+
+  '@rolldown/binding-linux-arm64-gnu@1.0.3':
+    resolution: {integrity: sha512-jsO7R8To+AdlYgUmN5sHSCZbfhtMBkO0WUx8iORQnPcMMdgr7qM2DQmMwgabs3GhNztdmoKkMKQFHD6DTMCIQw==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm64]
+    os: [linux]
+
+  '@rolldown/binding-linux-arm64-musl@1.0.3':
+    resolution: {integrity: sha512-VWkUHwWriDciit80wleYwKILoR/KMvxh/IdwS/paX+ZgpuRpCrKLUdadJbc0NpBEiyhpYawsJ73j9aCvOH+f7Q==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm64]
+    os: [linux]
+
+  '@rolldown/binding-linux-ppc64-gnu@1.0.3':
+    resolution: {integrity: sha512-5f1laC0SlIR0yDbFCd8acUhvJIag6N3zC5P7oUPN6wX0aOma+uKJ0wBDH5aq7I1PVI2ttTlhJwzwRIBnLiSGEg==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [ppc64]
+    os: [linux]
+
+  '@rolldown/binding-linux-s390x-gnu@1.0.3':
+    resolution: {integrity: sha512-Iq4ko0r4XsgbrF/LunNgHtAGLRRVE2kXonAXQ/MV0mC6jQpMOhW1SvtZja2EhC/kd05++bP78dsqBeIQyYJ6Yg==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [s390x]
+    os: [linux]
+
+  '@rolldown/binding-linux-x64-gnu@1.0.3':
+    resolution: {integrity: sha512-B8m6tD5+/N5FeNQFbKlLA/2yVq9ycQP1SeedyEYYKWBNR3ZQbkvIUcNnDNM03lO1l5F2roiiFJGgvoLLyZXtSg==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [x64]
+    os: [linux]
+
+  '@rolldown/binding-linux-x64-musl@1.0.3':
+    resolution: {integrity: sha512-pSdpdUJHkuCxun9LE7jvgUB9qsRgaiyNNCX7m/AvHTcq67AiT/Yhoxvw5zPfhrM8k/BfP8ce/hMOpthKDpEUow==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [x64]
+    os: [linux]
+
+  '@rolldown/binding-openharmony-arm64@1.0.3':
+    resolution: {integrity: sha512-OXXS3RKJgX2uLwM+gYyuH5omcH8fL1LJs96pZGgtetVCahON57+d4SJHzTgZiOjxgGkSnpXpOsWuPDGAKAigEg==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm64]
+    os: [openharmony]
+
+  '@rolldown/binding-wasm32-wasi@1.0.3':
+    resolution: {integrity: sha512-JTtb8BWFynicNSoPrehsCzBtOKjZ6jhMiPFEmOiuXg1Fl8dn2KHQob+GuPSGR0dryQa1PQJbzjF3dqO/whhjLg==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [wasm32]
+
+  '@rolldown/binding-win32-arm64-msvc@1.0.3':
+    resolution: {integrity: sha512-gEdFFEN70A/jxb2svrWsN3aDL7OUtmvlOy+6fa2jxG8K0wQ1ZbdeLGnidov6Yu5/733dI5ySfzFlQ/cb0bSz1g==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm64]
+    os: [win32]
+
+  '@rolldown/binding-win32-x64-msvc@1.0.3':
+    resolution: {integrity: sha512-eXB7CHuaQdqmJcc3koCNtNPmT/bj2gc999kUFgBxG8Ac0NdgXc4rkCHhqrgrhN3zddvvvrgzj1e90SuSfmyIXA==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [x64]
+    os: [win32]
+
+  '@rolldown/pluginutils@1.0.1':
+    resolution: {integrity: sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw==}
+
+  '@rollup/pluginutils@5.3.0':
+    resolution: {integrity: sha512-5EdhGZtnu3V88ces7s53hhfK5KSASnJZv8Lulpc04cWO3REESroJXg73DFsOmgbU2BhwV0E20bu2IDZb3VKW4Q==}
+    engines: {node: '>=14.0.0'}
+    peerDependencies:
+      rollup: ^1.20.0||^2.0.0||^3.0.0||^4.0.0
+    peerDependenciesMeta:
+      rollup:
+        optional: true
+
+  '@rollup/rollup-android-arm-eabi@4.54.0':
+    resolution: {integrity: sha512-OywsdRHrFvCdvsewAInDKCNyR3laPA2mc9bRYJ6LBp5IyvF3fvXbbNR0bSzHlZVFtn6E0xw2oZlyjg4rKCVcng==}
+    cpu: [arm]
+    os: [android]
+
+  '@rollup/rollup-android-arm64@4.54.0':
+    resolution: {integrity: sha512-Skx39Uv+u7H224Af+bDgNinitlmHyQX1K/atIA32JP3JQw6hVODX5tkbi2zof/E69M1qH2UoN3Xdxgs90mmNYw==}
+    cpu: [arm64]
+    os: [android]
+
+  '@rollup/rollup-darwin-arm64@4.54.0':
+    resolution: {integrity: sha512-k43D4qta/+6Fq+nCDhhv9yP2HdeKeP56QrUUTW7E6PhZP1US6NDqpJj4MY0jBHlJivVJD5P8NxrjuobZBJTCRw==}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@rollup/rollup-darwin-x64@4.54.0':
+    resolution: {integrity: sha512-cOo7biqwkpawslEfox5Vs8/qj83M/aZCSSNIWpVzfU2CYHa2G3P1UN5WF01RdTHSgCkri7XOlTdtk17BezlV3A==}
+    cpu: [x64]
+    os: [darwin]
+
+  '@rollup/rollup-freebsd-arm64@4.54.0':
+    resolution: {integrity: sha512-miSvuFkmvFbgJ1BevMa4CPCFt5MPGw094knM64W9I0giUIMMmRYcGW/JWZDriaw/k1kOBtsWh1z6nIFV1vPNtA==}
+    cpu: [arm64]
+    os: [freebsd]
+
+  '@rollup/rollup-freebsd-x64@4.54.0':
+    resolution: {integrity: sha512-KGXIs55+b/ZfZsq9aR026tmr/+7tq6VG6MsnrvF4H8VhwflTIuYh+LFUlIsRdQSgrgmtM3fVATzEAj4hBQlaqQ==}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@rollup/rollup-linux-arm-gnueabihf@4.54.0':
+    resolution: {integrity: sha512-EHMUcDwhtdRGlXZsGSIuXSYwD5kOT9NVnx9sqzYiwAc91wfYOE1g1djOEDseZJKKqtHAHGwnGPQu3kytmfaXLQ==}
+    cpu: [arm]
+    os: [linux]
+
+  '@rollup/rollup-linux-arm-musleabihf@4.54.0':
+    resolution: {integrity: sha512-+pBrqEjaakN2ySv5RVrj/qLytYhPKEUwk+e3SFU5jTLHIcAtqh2rLrd/OkbNuHJpsBgxsD8ccJt5ga/SeG0JmA==}
+    cpu: [arm]
+    os: [linux]
+
+  '@rollup/rollup-linux-arm64-gnu@4.54.0':
+    resolution: {integrity: sha512-NSqc7rE9wuUaRBsBp5ckQ5CVz5aIRKCwsoa6WMF7G01sX3/qHUw/z4pv+D+ahL1EIKy6Enpcnz1RY8pf7bjwng==}
+    cpu: [arm64]
+    os: [linux]
+
+  '@rollup/rollup-linux-arm64-musl@4.54.0':
+    resolution: {integrity: sha512-gr5vDbg3Bakga5kbdpqx81m2n9IX8M6gIMlQQIXiLTNeQW6CucvuInJ91EuCJ/JYvc+rcLLsDFcfAD1K7fMofg==}
+    cpu: [arm64]
+    os: [linux]
+
+  '@rollup/rollup-linux-loong64-gnu@4.54.0':
+    resolution: {integrity: sha512-gsrtB1NA3ZYj2vq0Rzkylo9ylCtW/PhpLEivlgWe0bpgtX5+9j9EZa0wtZiCjgu6zmSeZWyI/e2YRX1URozpIw==}
+    cpu: [loong64]
+    os: [linux]
+
+  '@rollup/rollup-linux-ppc64-gnu@4.54.0':
+    resolution: {integrity: sha512-y3qNOfTBStmFNq+t4s7Tmc9hW2ENtPg8FeUD/VShI7rKxNW7O4fFeaYbMsd3tpFlIg1Q8IapFgy7Q9i2BqeBvA==}
+    cpu: [ppc64]
+    os: [linux]
+
+  '@rollup/rollup-linux-riscv64-gnu@4.54.0':
+    resolution: {integrity: sha512-89sepv7h2lIVPsFma8iwmccN7Yjjtgz0Rj/Ou6fEqg3HDhpCa+Et+YSufy27i6b0Wav69Qv4WBNl3Rs6pwhebQ==}
+    cpu: [riscv64]
+    os: [linux]
+
+  '@rollup/rollup-linux-riscv64-musl@4.54.0':
+    resolution: {integrity: sha512-ZcU77ieh0M2Q8Ur7D5X7KvK+UxbXeDHwiOt/CPSBTI1fBmeDMivW0dPkdqkT4rOgDjrDDBUed9x4EgraIKoR2A==}
+    cpu: [riscv64]
+    os: [linux]
+
+  '@rollup/rollup-linux-s390x-gnu@4.54.0':
+    resolution: {integrity: sha512-2AdWy5RdDF5+4YfG/YesGDDtbyJlC9LHmL6rZw6FurBJ5n4vFGupsOBGfwMRjBYH7qRQowT8D/U4LoSvVwOhSQ==}
+    cpu: [s390x]
+    os: [linux]
+
+  '@rollup/rollup-linux-x64-gnu@4.54.0':
+    resolution: {integrity: sha512-WGt5J8Ij/rvyqpFexxk3ffKqqbLf9AqrTBbWDk7ApGUzaIs6V+s2s84kAxklFwmMF/vBNGrVdYgbblCOFFezMQ==}
+    cpu: [x64]
+    os: [linux]
+
+  '@rollup/rollup-linux-x64-musl@4.54.0':
+    resolution: {integrity: sha512-JzQmb38ATzHjxlPHuTH6tE7ojnMKM2kYNzt44LO/jJi8BpceEC8QuXYA908n8r3CNuG/B3BV8VR3Hi1rYtmPiw==}
+    cpu: [x64]
+    os: [linux]
+
+  '@rollup/rollup-openharmony-arm64@4.54.0':
+    resolution: {integrity: sha512-huT3fd0iC7jigGh7n3q/+lfPcXxBi+om/Rs3yiFxjvSxbSB6aohDFXbWvlspaqjeOh+hx7DDHS+5Es5qRkWkZg==}
+    cpu: [arm64]
+    os: [openharmony]
+
+  '@rollup/rollup-win32-arm64-msvc@4.54.0':
+    resolution: {integrity: sha512-c2V0W1bsKIKfbLMBu/WGBz6Yci8nJ/ZJdheE0EwB73N3MvHYKiKGs3mVilX4Gs70eGeDaMqEob25Tw2Gb9Nqyw==}
+    cpu: [arm64]
+    os: [win32]
+
+  '@rollup/rollup-win32-ia32-msvc@4.54.0':
+    resolution: {integrity: sha512-woEHgqQqDCkAzrDhvDipnSirm5vxUXtSKDYTVpZG3nUdW/VVB5VdCYA2iReSj/u3yCZzXID4kuKG7OynPnB3WQ==}
+    cpu: [ia32]
+    os: [win32]
+
+  '@rollup/rollup-win32-x64-gnu@4.54.0':
+    resolution: {integrity: sha512-dzAc53LOuFvHwbCEOS0rPbXp6SIhAf2txMP5p6mGyOXXw5mWY8NGGbPMPrs4P1WItkfApDathBj/NzMLUZ9rtQ==}
+    cpu: [x64]
+    os: [win32]
+
+  '@rollup/rollup-win32-x64-msvc@4.54.0':
+    resolution: {integrity: sha512-hYT5d3YNdSh3mbCU1gwQyPgQd3T2ne0A3KG8KSBdav5TiBg6eInVmV+TeR5uHufiIgSFg0XsOWGW5/RhNcSvPg==}
+    cpu: [x64]
+    os: [win32]
+
+  '@rtsao/scc@1.1.0':
+    resolution: {integrity: sha512-zt6OdqaDoOnJ1ZYsCYGt9YmWzDXl4vQdKTyJev62gFhRGKdx7mcT54V9KIjg+d2wi9EXsPvAPKe7i7WjfVWB8g==}
+
+  '@sagold/json-pointer@5.1.2':
+    resolution: {integrity: sha512-+wAhJZBXa6MNxRScg6tkqEbChEHMgVZAhTHVJ60Y7sbtXtu9XA49KfUkdWlS2x78D6H9nryiKePiYozumauPfA==}
+
+  '@sagold/json-query@6.2.0':
+    resolution: {integrity: sha512-7bOIdUE6eHeoWtFm8TvHQHfTVSZuCs+3RpOKmZCDBIOrxpvF/rNFTeuvIyjHva/RR0yVS3kQtr+9TW72LQEZjA==}
+
+  '@seznam/compose-react-refs@1.0.6':
+    resolution: {integrity: sha512-izzOXQfeQLonzrIQb8u6LQ8dk+ymz3WXTIXjvOlTXHq6sbzROg3NWU+9TTAOpEoK9Bth24/6F/XrfHJ5yR5n6Q==}
+
+  '@shikijs/core@1.29.2':
+    resolution: {integrity: sha512-vju0lY9r27jJfOY4Z7+Rt/nIOjzJpZ3y+nYpqtUZInVoXQ/TJZcfGnNOGnKjFdVZb8qexiCuSlZRKcGfhhTTZQ==}
+
+  '@shikijs/engine-javascript@1.29.2':
+    resolution: {integrity: sha512-iNEZv4IrLYPv64Q6k7EPpOCE/nuvGiKl7zxdq0WFuRPF5PAE9PRo2JGq/d8crLusM59BRemJ4eOqrFrC4wiQ+A==}
+
+  '@shikijs/engine-oniguruma@1.29.2':
+    resolution: {integrity: sha512-7iiOx3SG8+g1MnlzZVDYiaeHe7Ez2Kf2HrJzdmGwkRisT7r4rak0e655AcM/tF9JG/kg5fMNYlLLKglbN7gBqA==}
+
+  '@shikijs/langs@1.29.2':
+    resolution: {integrity: sha512-FIBA7N3LZ+223U7cJDUYd5shmciFQlYkFXlkKVaHsCPgfVLiO+e12FmQE6Tf9vuyEsFe3dIl8qGWKXgEHL9wmQ==}
+
+  '@shikijs/markdown-it@1.29.2':
+    resolution: {integrity: sha512-RPHqGU8RGQZ2TGMnEqLnSyM9CjPSjb0f8bwSLnJgBmWPWguoygoaFyYkXG0kwMtBtChNYsqQz1C0fLcbo6dY8g==}
+
+  '@shikijs/themes@1.29.2':
+    resolution: {integrity: sha512-i9TNZlsq4uoyqSbluIcZkmPL9Bfi3djVxRnofUHwvx/h6SRW3cwgBC5SML7vsDcWyukY0eCzVN980rqP6qNl9g==}
+
+  '@shikijs/types@1.29.2':
+    resolution: {integrity: sha512-VJjK0eIijTZf0QSTODEXCqinjBn0joAHQ+aPSBzrv4O2d/QSbsMw+ZeSRx03kV34Hy7NzUvV/7NqfYGRLrASmw==}
+
+  '@shikijs/vscode-textmate@10.0.2':
+    resolution: {integrity: sha512-83yeghZ2xxin3Nj8z1NMd/NCuca+gsYXswywDy5bHvwlWL8tpTQmzGeUuHd9FC3E/SBEMvzJRwWEOz5gGes9Qg==}
+
+  '@simbathesailor/use-what-changed@2.0.0':
+    resolution: {integrity: sha512-ulBNrPSvfho9UN6zS2fii3AsdEcp2fMaKeqUZZeCNPaZbB6aXyTUhpEN9atjMAbu/eyK3AY8L4SYJUG62Ekocw==}
+    peerDependencies:
+      react: '>=16'
+
+  '@standard-schema/spec@1.1.0':
+    resolution: {integrity: sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==}
+
+  '@storybook/addon-docs@10.4.2':
+    resolution: {integrity: sha512-CtW1O4xSKZPNtpWgpfp4yB/x4pj/of+3MvlEDfErSlr3Hp3QmEa2pCLaecR08H5LJqJFlt1PtG0UrIynTvgW9w==}
+    peerDependencies:
+      '@types/react': ^17.0.37
+      storybook: ^10.4.2
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@storybook/addon-links@10.4.2':
+    resolution: {integrity: sha512-cU8h4/m+oAr8UUwF4teZG2N1ilV+vU+98Ii/Ma+IIx9M/V7i5544UxfAz84dV5Rx2Oho6x8XH3gIvmevSyPi/Q==}
+    peerDependencies:
+      '@types/react': ^17.0.37
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
+      storybook: ^10.4.2
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      react:
+        optional: true
+
+  '@storybook/addon-styling-webpack@3.0.2':
+    resolution: {integrity: sha512-u7d5ur+It6XWSwd5yxHN6dTzIfj23as3zHJBf1IfDvi/GWmsW7zrmfsWpRIyBkIhBmdL+oSsTtLLTjuC9HeL8Q==}
+    peerDependencies:
+      storybook: ^10.0.0 || ^10.0.0-0 || ^10.1.0-0 || ^10.2.0-0 || ^10.3.0-0 || ^10.4.0-0
+      webpack: ^5.0.0
+
+  '@storybook/addon-webpack5-compiler-swc@4.0.3':
+    resolution: {integrity: sha512-REJZBArIBcqzxmhQY9R1br9hjfcFYdl4FeWD/okx1eRwPZkl49aUhTYqZPrA+MWXfKJkuuNQ5vnfSoR0c9HyvA==}
+    engines: {node: '>=18'}
+    peerDependencies:
+      storybook: ^9.0.0 || ^10.0.0-0 || ^10.1.0-0 || ^10.2.0-0 || ^10.3.0-0 || ^10.4.0-0
+
+  '@storybook/builder-webpack5@10.4.2':
+    resolution: {integrity: sha512-nhmV0+nThCgy1y5742SS7c4vJrd5/1KfCXCNfsJ1v4Rkq7NIQnUhEIBwkSaY63lqH7FRHlFxIjwGS63veiCJuw==}
+    peerDependencies:
+      storybook: ^10.4.2
+      typescript: '*'
+    peerDependenciesMeta:
+      typescript:
+        optional: true
+
+  '@storybook/core-webpack@10.4.2':
+    resolution: {integrity: sha512-qnYKMruU8lvI4yaq2PA9Gmxjrc7EZ3DRBI/cVKwEgOIREoxzr1F1IE7t7+325k9Phylue7E5rD3A7yjxeEKUyw==}
+    peerDependencies:
+      storybook: ^10.4.2
+
+  '@storybook/csf-plugin@10.4.2':
+    resolution: {integrity: sha512-GqX/2DeF3/jKs5D7gpDiuT9gd0c/f2TKcnQ5av4/s3YqeN+0nhm7btkCrDfgF16uzE1Zj3OrkxvB3AOkfxWgDg==}
+    peerDependencies:
+      esbuild: '*'
+      rollup: '*'
+      storybook: ^10.4.2
+      vite: '*'
+      webpack: '*'
+    peerDependenciesMeta:
+      esbuild:
+        optional: true
+      rollup:
+        optional: true
+      vite:
+        optional: true
+      webpack:
+        optional: true
+
+  '@storybook/global@5.0.0':
+    resolution: {integrity: sha512-FcOqPAXACP0I3oJ/ws6/rrPT9WGhu915Cg8D02a9YxLo0DE9zI+a9A5gRGvmQ09fiWPukqI8ZAEoQEdWUKMQdQ==}
+
+  '@storybook/icons@2.0.2':
+    resolution: {integrity: sha512-KZBCpXsshAIjczYNXR/rlxEtCUX/eAbpFNwKi8bcOomrLA4t/SyPz5RF+lVPO2oZBUE4sAkt43mfJUevQDSEEw==}
+    peerDependencies:
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
+      react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
+
+  '@storybook/preset-react-webpack@10.4.2':
+    resolution: {integrity: sha512-21ld380f0/jTTitkfhTKgP3FBnVAgMu1P1ymrRyiFYJVSJBA5YejndFFBo0ugq9iGGsHXrVdOphC/OJKbTSWRQ==}
+    peerDependencies:
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
+      react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
+      storybook: ^10.4.2
+      typescript: '*'
+    peerDependenciesMeta:
+      typescript:
+        optional: true
+
+  '@storybook/react-docgen-typescript-plugin@1.0.6--canary.9.0c3f3b7.0':
+    resolution: {integrity: sha512-KUqXC3oa9JuQ0kZJLBhVdS4lOneKTOopnNBK4tUAgoxWQ3u/IjzdueZjFr7gyBrXMoU6duutk3RQR9u8ZpYJ4Q==}
+    peerDependencies:
+      typescript: '>= 4.x'
+      webpack: '>= 4'
+
+  '@storybook/react-dom-shim@10.4.2':
+    resolution: {integrity: sha512-Eng3Yt2NCjPX94QcfyLeUFhrMj0hec2yU9J/qafBVbfj9XrFI8o+0ZwYJ7uXb9ECbvPN4y06dgt/2W/LiR417w==}
+    peerDependencies:
+      '@types/react': ^17.0.37
+      '@types/react-dom': ^17.0.11
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
+      react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
+      storybook: ^10.4.2
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@storybook/react-webpack5@10.4.2':
+    resolution: {integrity: sha512-x7xwGLxU0w6/qi29/cHhua8qiCvfE05ku4pPLTXF8TsP/zfGsY8tbdlKO2+YKp+iBG8vafVc//ZXOAty1oypDA==}
+    peerDependencies:
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
+      react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
+      storybook: ^10.4.2
+      typescript: '>= 4.9.x'
+    peerDependenciesMeta:
+      typescript:
+        optional: true
+
+  '@storybook/react@10.4.2':
+    resolution: {integrity: sha512-NfEH3CrdCAgUV4Z7SPN3Iw6nofcueqtRj8iHuo77GNjz0qSfuVi9iS7a8o7x7QFSeIBZwS0Jv3CgmhN8qvoLjg==}
+    peerDependencies:
+      '@types/react': ^17.0.37
+      '@types/react-dom': ^17.0.11
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
+      react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
+      storybook: ^10.4.2
+      typescript: '>= 4.9.x'
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+      typescript:
+        optional: true
+
+  '@svgr/babel-plugin-add-jsx-attribute@8.0.0':
+    resolution: {integrity: sha512-b9MIk7yhdS1pMCZM8VeNfUlSKVRhsHZNMl5O9SfaX0l0t5wjdgu4IDzGB8bpnGBBOjGST3rRFVsaaEtI4W6f7g==}
+    engines: {node: '>=14'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@svgr/babel-plugin-remove-jsx-attribute@8.0.0':
+    resolution: {integrity: sha512-BcCkm/STipKvbCl6b7QFrMh/vx00vIP63k2eM66MfHJzPr6O2U0jYEViXkHJWqXqQYjdeA9cuCl5KWmlwjDvbA==}
+    engines: {node: '>=14'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@svgr/babel-plugin-remove-jsx-empty-expression@8.0.0':
+    resolution: {integrity: sha512-5BcGCBfBxB5+XSDSWnhTThfI9jcO5f0Ai2V24gZpG+wXF14BzwxxdDb4g6trdOux0rhibGs385BeFMSmxtS3uA==}
+    engines: {node: '>=14'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@svgr/babel-plugin-replace-jsx-attribute-value@8.0.0':
+    resolution: {integrity: sha512-KVQ+PtIjb1BuYT3ht8M5KbzWBhdAjjUPdlMtpuw/VjT8coTrItWX6Qafl9+ji831JaJcu6PJNKCV0bp01lBNzQ==}
+    engines: {node: '>=14'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@svgr/babel-plugin-svg-dynamic-title@8.0.0':
+    resolution: {integrity: sha512-omNiKqwjNmOQJ2v6ge4SErBbkooV2aAWwaPFs2vUY7p7GhVkzRkJ00kILXQvRhA6miHnNpXv7MRnnSjdRjK8og==}
+    engines: {node: '>=14'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@svgr/babel-plugin-svg-em-dimensions@8.0.0':
+    resolution: {integrity: sha512-mURHYnu6Iw3UBTbhGwE/vsngtCIbHE43xCRK7kCw4t01xyGqb2Pd+WXekRRoFOBIY29ZoOhUCTEweDMdrjfi9g==}
+    engines: {node: '>=14'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@svgr/babel-plugin-transform-react-native-svg@8.1.0':
+    resolution: {integrity: sha512-Tx8T58CHo+7nwJ+EhUwx3LfdNSG9R2OKfaIXXs5soiy5HtgoAEkDay9LIimLOcG8dJQH1wPZp/cnAv6S9CrR1Q==}
+    engines: {node: '>=14'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@svgr/babel-plugin-transform-svg-component@8.0.0':
+    resolution: {integrity: sha512-DFx8xa3cZXTdb/k3kfPeaixecQLgKh5NVBMwD0AQxOzcZawK4oo1Jh9LbrcACUivsCA7TLG8eeWgrDXjTMhRmw==}
+    engines: {node: '>=12'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@svgr/babel-preset@8.1.0':
+    resolution: {integrity: sha512-7EYDbHE7MxHpv4sxvnVPngw5fuR6pw79SkcrILHJ/iMpuKySNCl5W1qcwPEpU+LgyRXOaAFgH0KhwD18wwg6ug==}
+    engines: {node: '>=14'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@svgr/core@8.1.0':
+    resolution: {integrity: sha512-8QqtOQT5ACVlmsvKOJNEaWmRPmcojMOzCz4Hs2BGG/toAp/K38LcsMRyLp349glq5AzJbCEeimEoxaX6v/fLrA==}
+    engines: {node: '>=14'}
+
+  '@svgr/hast-util-to-babel-ast@8.0.0':
+    resolution: {integrity: sha512-EbDKwO9GpfWP4jN9sGdYwPBU0kdomaPIL2Eu4YwmgP+sJeXT+L7bMwJUBnhzfH8Q2qMBqZ4fJwpCyYsAN3mt2Q==}
+    engines: {node: '>=14'}
+
+  '@svgr/plugin-jsx@8.1.0':
+    resolution: {integrity: sha512-0xiIyBsLlr8quN+WyuxooNW9RJ0Dpr8uOnH/xrCVO8GLUcwHISwj1AG0k+LFzteTkAA0GbX0kj9q6Dk70PTiPA==}
+    engines: {node: '>=14'}
+    peerDependencies:
+      '@svgr/core': '*'
+
+  '@svgr/plugin-svgo@8.1.0':
+    resolution: {integrity: sha512-Ywtl837OGO9pTLIN/onoWLmDQ4zFUycI1g76vuKGEz6evR/ZTJlJuz3G/fIkb6OVBJ2g0o6CGJzaEjfmEo3AHA==}
+    engines: {node: '>=14'}
+    peerDependencies:
+      '@svgr/core': '*'
+
+  '@svgr/webpack@8.1.0':
+    resolution: {integrity: sha512-LnhVjMWyMQV9ZmeEy26maJk+8HTIbd59cH4F2MJ439k9DqejRisfFNGAPvRYlKETuh9LrImlS8aKsBgKjMA8WA==}
+    engines: {node: '>=14'}
+
+  '@swc/core-darwin-arm64@1.15.11':
+    resolution: {integrity: sha512-QoIupRWVH8AF1TgxYyeA5nS18dtqMuxNwchjBIwJo3RdwLEFiJq6onOx9JAxHtuPwUkIVuU2Xbp+jCJ7Vzmgtg==}
+    engines: {node: '>=10'}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@swc/core-darwin-x64@1.15.11':
+    resolution: {integrity: sha512-S52Gu1QtPSfBYDiejlcfp9GlN+NjTZBRRNsz8PNwBgSE626/FUf2PcllVUix7jqkoMC+t0rS8t+2/aSWlMuQtA==}
+    engines: {node: '>=10'}
+    cpu: [x64]
+    os: [darwin]
+
+  '@swc/core-linux-arm-gnueabihf@1.15.11':
+    resolution: {integrity: sha512-lXJs8oXo6Z4yCpimpQ8vPeCjkgoHu5NoMvmJZ8qxDyU99KVdg6KwU9H79vzrmB+HfH+dCZ7JGMqMF//f8Cfvdg==}
+    engines: {node: '>=10'}
+    cpu: [arm]
+    os: [linux]
+
+  '@swc/core-linux-arm64-gnu@1.15.11':
+    resolution: {integrity: sha512-chRsz1K52/vj8Mfq/QOugVphlKPWlMh10V99qfH41hbGvwAU6xSPd681upO4bKiOr9+mRIZZW+EfJqY42ZzRyA==}
+    engines: {node: '>=10'}
+    cpu: [arm64]
+    os: [linux]
+
+  '@swc/core-linux-arm64-musl@1.15.11':
+    resolution: {integrity: sha512-PYftgsTaGnfDK4m6/dty9ryK1FbLk+LosDJ/RJR2nkXGc8rd+WenXIlvHjWULiBVnS1RsjHHOXmTS4nDhe0v0w==}
+    engines: {node: '>=10'}
+    cpu: [arm64]
+    os: [linux]
+
+  '@swc/core-linux-x64-gnu@1.15.11':
+    resolution: {integrity: sha512-DKtnJKIHiZdARyTKiX7zdRjiDS1KihkQWatQiCHMv+zc2sfwb4Glrodx2VLOX4rsa92NLR0Sw8WLcPEMFY1szQ==}
+    engines: {node: '>=10'}
+    cpu: [x64]
+    os: [linux]
+
+  '@swc/core-linux-x64-musl@1.15.11':
+    resolution: {integrity: sha512-mUjjntHj4+8WBaiDe5UwRNHuEzLjIWBTSGTw0JT9+C9/Yyuh4KQqlcEQ3ro6GkHmBGXBFpGIj/o5VMyRWfVfWw==}
+    engines: {node: '>=10'}
+    cpu: [x64]
+    os: [linux]
+
+  '@swc/core-win32-arm64-msvc@1.15.11':
+    resolution: {integrity: sha512-ZkNNG5zL49YpaFzfl6fskNOSxtcZ5uOYmWBkY4wVAvgbSAQzLRVBp+xArGWh2oXlY/WgL99zQSGTv7RI5E6nzA==}
+    engines: {node: '>=10'}
+    cpu: [arm64]
+    os: [win32]
+
+  '@swc/core-win32-ia32-msvc@1.15.11':
+    resolution: {integrity: sha512-6XnzORkZCQzvTQ6cPrU7iaT9+i145oLwnin8JrfsLG41wl26+5cNQ2XV3zcbrnFEV6esjOceom9YO1w9mGJByw==}
+    engines: {node: '>=10'}
+    cpu: [ia32]
+    os: [win32]
+
+  '@swc/core-win32-x64-msvc@1.15.11':
+    resolution: {integrity: sha512-IQ2n6af7XKLL6P1gIeZACskSxK8jWtoKpJWLZmdXTDj1MGzktUy4i+FvpdtxFmJWNavRWH1VmTr6kAubRDHeKw==}
+    engines: {node: '>=10'}
+    cpu: [x64]
+    os: [win32]
+
+  '@swc/core@1.15.11':
+    resolution: {integrity: sha512-iLmLTodbYxU39HhMPaMUooPwO/zqJWvsqkrXv1ZI38rMb048p6N7qtAtTp37sw9NzSrvH6oli8EdDygo09IZ/w==}
+    engines: {node: '>=10'}
+    peerDependencies:
+      '@swc/helpers': '>=0.5.17'
+    peerDependenciesMeta:
+      '@swc/helpers':
+        optional: true
+
+  '@swc/counter@0.1.3':
+    resolution: {integrity: sha512-e2BR4lsJkkRlKZ/qCHPw9ZaSxc0MVUd7gtbtaB7aMvHeJVYe8sOB8DBZkP2DtISHGSku9sCK6T6cnY0CtXrOCQ==}
+
+  '@swc/types@0.1.25':
+    resolution: {integrity: sha512-iAoY/qRhNH8a/hBvm3zKj9qQ4oc2+3w1unPJa2XvTK3XjeLXtzcCingVPw/9e5mn1+0yPqxcBGp9Jf0pkfMb1g==}
+
+  '@tanstack/match-sorter-utils@8.8.4':
+    resolution: {integrity: sha512-rKH8LjZiszWEvmi01NR72QWZ8m4xmXre0OOwlRGnjU01Eqz/QnN+cqpty2PJ0efHblq09+KilvyR7lsbzmXVEw==}
+    engines: {node: '>=12'}
+
+  '@tanstack/query-core@4.36.1':
+    resolution: {integrity: sha512-DJSilV5+ytBP1FbFcEJovv4rnnm/CokuVvrBEtW/Va9DvuJ3HksbXUJEpI0aV1KtuL4ZoO9AVE6PyNLzF7tLeA==}
+
+  '@tanstack/react-query-devtools@4.36.1':
+    resolution: {integrity: sha512-WYku83CKP3OevnYSG8Y/QO9g0rT75v1om5IvcWUwiUZJ4LanYGLVCZ8TdFG5jfsq4Ej/lu2wwDAULEUnRIMBSw==}
+    peerDependencies:
+      '@tanstack/react-query': ^4.36.1
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0
+      react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0
+
+  '@tanstack/react-query@4.36.1':
+    resolution: {integrity: sha512-y7ySVHFyyQblPl3J3eQBWpXZkliroki3ARnBKsdJchlgt7yJLRDUcf4B8soufgiYt3pEQIkBWBx1N9/ZPIeUWw==}
+    peerDependencies:
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0
+      react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0
+      react-native: '*'
+    peerDependenciesMeta:
+      react-dom:
+        optional: true
+      react-native:
+        optional: true
+
+  '@tanstack/react-table@8.9.0':
+    resolution: {integrity: sha512-PYI29FSk/+YDvWg52wdJiVAPOIB06VKgDdeAGMVg9IOE1E8fiNnRgrARqulmGBvEgKPtDC6ZVfeuqISZ3uNbow==}
+    engines: {node: '>=12'}
+    peerDependencies:
+      react: '>=16'
+      react-dom: '>=16'
+
+  '@tanstack/table-core@8.9.0':
+    resolution: {integrity: sha512-lH+mimP5JBnliWIn7XUhPXFayPjCPWL4C90hjoUq4MpqW45D9fkVhpkoRQi2IDYt7PfhCVbQpzzD/q7uDa69DA==}
+    engines: {node: '>=12'}
+
+  '@testing-library/dom@8.11.1':
+    resolution: {integrity: sha512-3KQDyx9r0RKYailW2MiYrSSKEfH0GTkI51UGEvJenvcoDoeRYs0PZpi2SXqtnMClQvCqdtTTpOfFETDTVADpAg==}
+    engines: {node: '>=12'}
+
+  '@testing-library/dom@9.3.4':
+    resolution: {integrity: sha512-FlS4ZWlp97iiNWig0Muq8p+3rVDjRiYE+YKGbAqXOu9nwJFFOdL00kFpz42M+4huzYi86vAK1sOOfyOG45muIQ==}
+    engines: {node: '>=14'}
+
+  '@testing-library/jest-dom@6.9.1':
+    resolution: {integrity: sha512-zIcONa+hVtVSSep9UT3jZ5rizo2BsxgyDYU7WFD5eICBE7no3881HGeb/QkGfsJs6JTkY1aQhT7rIPC7e+0nnA==}
+    engines: {node: '>=14', npm: '>=6', yarn: '>=1'}
+
+  '@testing-library/react-hooks@8.0.1':
+    resolution: {integrity: sha512-Aqhl2IVmLt8IovEVarNDFuJDVWVvhnr9/GCU6UUnrYXwgDFF9h2L2o2P9KBni1AST5sT6riAyoukFLyjQUgD/g==}
+    engines: {node: '>=12'}
+    peerDependencies:
+      '@types/react': ^17.0.37
+      react: ^16.9.0 || ^17.0.0
+      react-dom: ^16.9.0 || ^17.0.0
+      react-test-renderer: ^16.9.0 || ^17.0.0
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      react-dom:
+        optional: true
+      react-test-renderer:
+        optional: true
+
+  '@testing-library/react@12.1.5':
+    resolution: {integrity: sha512-OfTXCJUFgjd/digLUuPxa0+/3ZxsQmE7ub9kcbW/wi96Bh3o/p5vrETcBGfP17NWPGqeYYl5LTRpwyGoMC4ysg==}
+    engines: {node: '>=12'}
+    peerDependencies:
+      react: <18.0.0
+      react-dom: <18.0.0
+
+  '@testing-library/user-event@14.6.1':
+    resolution: {integrity: sha512-vq7fv0rnt+QTXgPxr5Hjc210p6YKq2kmdziLgnsZGgLJ9e6VAShx1pACLuRjd/AS/sr7phAR58OIIpf0LlmQNw==}
+    engines: {node: '>=12', npm: '>=6'}
+    peerDependencies:
+      '@testing-library/dom': '>=7.21.4'
+
+  '@tippyjs/react@4.2.6':
+    resolution: {integrity: sha512-91RicDR+H7oDSyPycI13q3b7o4O60wa2oRbjlz2fyRLmHImc4vyDwuUP8NtZaN0VARJY5hybvDYrFzhY9+Lbyw==}
+    peerDependencies:
+      react: '>=16.8'
+      react-dom: '>=16.8'
+
+  '@trysound/sax@0.2.0':
+    resolution: {integrity: sha512-L7z9BgrNEcYyUYtF+HaEfiS5ebkh9jXqbszz7pC0hRBPaatV0XjSD3+eHrpqFemQfgwiFF0QPIarnIihIDn7OA==}
+    engines: {node: '>=10.13.0'}
+
+  '@tybys/wasm-util@0.10.1':
+    resolution: {integrity: sha512-9tTaPJLSiejZKx+Bmog4uSubteqTvFrVrURwkmHixBo0G4seD0zUxp98E1DzUBJxLQ3NPwXrGKDiVjwx/DpPsg==}
+
+  '@types/angular@1.8.9':
+    resolution: {integrity: sha512-Z0HukqZkx0fotsV3QO00yqU9NzcQI+tMcrum+8MvfB4ePqCawZctF/gz6QiuII+T1ax+LitNoPx/eICTgnF4sg==}
+
+  '@types/aria-query@4.2.2':
+    resolution: {integrity: sha512-HnYpAE1Y6kRyKM/XkEuiRQhTHvkzMBurTHnpFLYLBGPIylZNPs9jJcuOOYWxPLJCSEtmZT0Y8rHDokKN7rRTig==}
+
+  '@types/aria-query@5.0.4':
+    resolution: {integrity: sha512-rfT93uj5s0PRL7EzccGMs3brplhcrghnDoV26NqKhCAS1hVo+WdNsPvE/yb6ilfr5hi2MEk6d5EWJTKdxg8jVw==}
+
+  '@types/babel__core@7.20.5':
+    resolution: {integrity: sha512-qoQprZvz5wQFJwMDqeseRXWv3rqMvhgpbXFfVyWhbx9X47POIA6i/+dXefEmZKoAgOaTdaIgNSMqMIU61yRyzA==}
+
+  '@types/babel__generator@7.6.3':
+    resolution: {integrity: sha512-/GWCmzJWqV7diQW54smJZzWbSFf4QYtF71WCKhcx6Ru/tFyQIY2eiiITcCAeuPbNSvT9YCGkVMqqvSk2Z0mXiA==}
+
+  '@types/babel__template@7.4.1':
+    resolution: {integrity: sha512-azBFKemX6kMg5Io+/rdGT0dkGreboUVR0Cdm3fz9QJWpaQGJRQXl7C+6hOTCZcMll7KFyEQpgbYI2lHdsS4U7g==}
+
+  '@types/babel__traverse@7.28.0':
+    resolution: {integrity: sha512-8PvcXf70gTDZBgt9ptxJ8elBeBjcLOAcOtoO/mPJjtji1+CdGbHgm77om1GrsPxsiE+uXIpNSK64UYaIwQXd4Q==}
+
+  '@types/body-parser@1.19.6':
+    resolution: {integrity: sha512-HLFeCYgz89uk22N5Qg3dvGvsv46B8GLvKKo1zKG4NybA8U2DiEO3w9lqGg29t/tfLRJpJ6iQxnVw4OnB7MoM9g==}
+
+  '@types/bonjour@3.5.13':
+    resolution: {integrity: sha512-z9fJ5Im06zvUL548KvYNecEVlA7cVDkGUi6kZusb04mpyEFKCIZJvloCcmpmLaIahDpOQGHaHmG6imtPMmPXGQ==}
+
+  '@types/chai@5.2.3':
+    resolution: {integrity: sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA==}
+
+  '@types/connect-history-api-fallback@1.5.4':
+    resolution: {integrity: sha512-n6Cr2xS1h4uAulPRdlw6Jl6s1oG8KrVilPN2yUITEs+K48EzMJJ3W1xy8K5eWuFvjp3R74AOIGSmp2UfBJ8HFw==}
+
+  '@types/connect@3.4.35':
+    resolution: {integrity: sha512-cdeYyv4KWoEgpBISTxWvqYsVy444DOqehiF3fM3ne10AmJ62RSyNkUnxMJXHQWRQQX2eR94m5y1IZyDwBjV9FQ==}
+
+  '@types/deep-eql@4.0.2':
+    resolution: {integrity: sha512-c9h9dVVMigMPc4bwTvC5dxqtqJZwQPePsWjPlpSOnojbor6pGqdk541lfA7AqFQr5pB1BRdq0juY9db81BwyFw==}
+
+  '@types/doctrine@0.0.9':
+    resolution: {integrity: sha512-eOIHzCUSH7SMfonMG1LsC2f8vxBFtho6NGBznK41R84YzPuvSBzrhEps33IsQiOW9+VL6NQ9DbjQJznk/S4uRA==}
+
+  '@types/estree@1.0.8':
+    resolution: {integrity: sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==}
+
+  '@types/express-serve-static-core@4.17.34':
+    resolution: {integrity: sha512-fvr49XlCGoUj2Pp730AItckfjat4WNb0lb3kfrLWffd+RLeoGAMsq7UOy04PAPtoL01uKwcp6u8nhzpgpDYr3w==}
+
+  '@types/express@4.17.25':
+    resolution: {integrity: sha512-dVd04UKsfpINUnK0yBoYHDF3xu7xVH4BuDotC/xGuycx4CgbP48X/KF/586bcObxT0HENHXEU8Nqtu6NR+eKhw==}
+
+  '@types/file-saver@2.0.7':
+    resolution: {integrity: sha512-dNKVfHd/jk0SkR/exKGj2ggkB45MAkzvWCaqLUUgkyjITkGNzH8H+yUwr+BLJUBjZOe9w8X3wgmXhZDRg1ED6A==}
+
+  '@types/filesize-parser@1.5.3':
+    resolution: {integrity: sha512-D8veS92mQAfcKz5kbV9WINfKvvaxVfQHqnO3OWW6FxdYTZozDDb8mTLWCsvEqe8M/M7skeULTZzYeMf3Lsss+A==}
+
+  '@types/filesize@5.0.2':
+    resolution: {integrity: sha512-U7ZziS3iSkMu+ca04RzbWMZJeiW8am09E3bLZb6RGz2z79u7oV3KGCFCzWsousZUgw3geTRxUx2GHHj1pllkeQ==}
+
+  '@types/glob@7.2.0':
+    resolution: {integrity: sha512-ZUxbzKl0IfJILTS6t7ip5fQQM/J3TJYubDm3nMbgubNNYS62eXeUpoLUC8/7fJNiFYHTrGPQn7hspDUzIHX3UA==}
+
+  '@types/hast@3.0.4':
+    resolution: {integrity: sha512-WPs+bbQw5aCj+x6laNGWLH3wviHtoCv/P3+otBhbOhJgG8qtpdAMlTCxLtsTWA7LH1Oh/bFCHsBn0TPS5m30EQ==}
+
+  '@types/hoist-non-react-statics@3.3.7':
+    resolution: {integrity: sha512-PQTyIulDkIDro8P+IHbKCsw7U2xxBYflVzW/FgWdCAePD9xGSidgA76/GeJ6lBKoblyhf9pBY763gbrN+1dI8g==}
+    peerDependencies:
+      '@types/react': ^17.0.37
+
+  '@types/html-minifier-terser@6.1.0':
+    resolution: {integrity: sha512-oh/6byDPnL1zeNXFrDXFLyZjkr1MsBG667IM792caf1L2UPOOMf65NFzjUH/ltyfwjAGfs1rsX1eftK0jC/KIg==}
+
+  '@types/http-errors@2.0.5':
+    resolution: {integrity: sha512-r8Tayk8HJnX0FztbZN7oVqGccWgw98T/0neJphO91KkmOzug1KkofZURD4UaD5uH8AqcFLfdPErnBod0u71/qg==}
+
+  '@types/http-proxy@1.17.11':
+    resolution: {integrity: sha512-HC8G7c1WmaF2ekqpnFq626xd3Zz0uvaqFmBJNRZCGEZCXkvSdJoNFn/8Ygbd9fKNQj8UzLdCETaI0UWPAjK7IA==}
+
+  '@types/istanbul-lib-coverage@2.0.4':
+    resolution: {integrity: sha512-z/QT1XN4K4KYuslS23k62yDIDLwLFkzxOuMplDtObz0+y7VqJCaO2o+SPwHCvLFZh7xazvvoor2tA/hPz9ee7g==}
+
+  '@types/istanbul-lib-report@3.0.0':
+    resolution: {integrity: sha512-plGgXAPfVKFoYfa9NpYDAkseG+g6Jr294RqeqcqDixSbU34MZVJRi/P+7Y8GDpzkEwLaGZZOpKIEmeVZNtKsrg==}
+
+  '@types/istanbul-reports@3.0.1':
+    resolution: {integrity: sha512-c3mAZEuK0lvBp8tmuL74XRKn1+y2dcwOUpH7x4WrF6gk1GIgiluDRgMYQtw2OFcBvAJWlt6ASU3tSqxp0Uu0Aw==}
+
+  '@types/jquery@3.5.33':
+    resolution: {integrity: sha512-SeyVJXlCZpEki5F0ghuYe+L+PprQta6nRZqhONt9F13dWBtR/ftoaIbdRQ7cis7womE+X2LKhsDdDtkkDhJS6g==}
+
+  '@types/json-schema@7.0.15':
+    resolution: {integrity: sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA==}
+
+  '@types/json5@0.0.29':
+    resolution: {integrity: sha512-dRLjCWHYg4oaA77cxO64oO+7JwCwnIzkZPdrrC71jQmQtlhM556pwKo5bUzqvZndkVbeFLIIi+9TC40JNF5hNQ==}
+
+  '@types/lodash.memoize@4.1.9':
+    resolution: {integrity: sha512-glY1nQuoqX4Ft8Uk+KfJudOD7DQbbEDF6k9XpGncaohW3RW4eSWBlx6AA0fZCrh40tZcQNH4jS/Oc59J6Eq+aw==}
+
+  '@types/lodash@4.17.24':
+    resolution: {integrity: sha512-gIW7lQLZbue7lRSWEFql49QJJWThrTFFeIMJdp3eH4tKoxm1OvEPg02rm4wCCSHS0cL3/Fizimb35b7k8atwsQ==}
+
+  '@types/mdast@4.0.4':
+    resolution: {integrity: sha512-kGaNbPh1k7AFzgpud/gMdvIm5xuECykRR+JnWKQno9TAXVa6WIVCGTPvYGekIDL4uwCZQSYbUxNBSb1aUo79oA==}
+
+  '@types/mdx@2.0.5':
+    resolution: {integrity: sha512-76CqzuD6Q7LC+AtbPqrvD9AqsN0k8bsYo2bM2J8pmNldP1aIPAbzUQ7QbobyXL4eLr1wK5x8FZFe8eF/ubRuBg==}
+
+  '@types/mime@1.3.2':
+    resolution: {integrity: sha512-YATxVxgRqNH6nHEIsvg6k2Boc1JHI9ZbH5iWFFv/MTkchz3b1ieGDa5T0a9RznNdI0KhVbdbWSN+KWWrQZRxTw==}
+
+  '@types/minimatch@3.0.5':
+    resolution: {integrity: sha512-Klz949h02Gz2uZCMGwDUSDS1YBlTdDDgbWHi+81l29tQALUtvz4rAYi5uoVhE5Lagoq6DeqAUlbrHvW/mXDgdQ==}
+
+  '@types/mustache@4.2.6':
+    resolution: {integrity: sha512-t+8/QWTAhOFlrF1IVZqKnMRJi84EgkIK5Kh0p2JV4OLywUvCwJPFxbJAl7XAow7DVIHsF+xW9f1MVzg0L6Szjw==}
+
+  '@types/node@25.0.3':
+    resolution: {integrity: sha512-W609buLVRVmeW693xKfzHeIV6nJGGz98uCPfeXI1ELMLXVeKYZ9m15fAMSaUPBHYLGFsVRcMmSCksQOrZV9BYA==}
+
+  '@types/nprogress@0.2.3':
+    resolution: {integrity: sha512-k7kRA033QNtC+gLc4VPlfnue58CM1iQLgn1IMAU8VPHGOj7oIHPp9UlhedEnD/Gl8evoCjwkZjlBORtZ3JByUA==}
+
+  '@types/parse-json@4.0.2':
+    resolution: {integrity: sha512-dISoDXWWQwUquiKsyZ4Ng+HX2KsPL7LyHKHQwgGFEA3IaKac4Obd+h2a/a6waisAoepJlBcx9paWqjA8/HVjCw==}
+
+  '@types/prop-types@15.7.4':
+    resolution: {integrity: sha512-rZ5drC/jWjrArrS8BR6SIr4cWpW09RNTYt9AMZo3Jwwif+iacXAqgVjm0B0Bv/S1jhDXKHqRVNCbACkJ89RAnQ==}
+
+  '@types/qs@6.14.0':
+    resolution: {integrity: sha512-eOunJqu0K1923aExK6y8p6fsihYEn/BYuQ4g0CxAAgFc4b/ZLN4CrsRZ55srTdqoiLzU2B2evC+apEIxprEzkQ==}
+
+  '@types/range-parser@1.2.4':
+    resolution: {integrity: sha512-EEhsLsD6UsDM1yFhAvy0Cjr6VwmpMWqFBCb9w07wVugF7w9nfajxLuVmngTIpgS6svCnm6Vaw+MZhoDCKnOfsw==}
+
+  '@types/react-datetime-picker@3.4.1':
+    resolution: {integrity: sha512-JHqB74+8Zq6cY0PTJ6Wi5Pm6qkNUmooyFfW5SiknSY2xJG1UG8+ljyWTZAvgHvj0XpqcWCHqqYUPiAVagnf9Sg==}
+
+  '@types/react-dom@17.0.25':
+    resolution: {integrity: sha512-urx7A7UxkZQmThYA4So0NelOVjx3V4rNFVJwp0WZlbIK5eM4rNJDiN3R/E9ix0MBh6kAEojk/9YL+Te6D9zHNA==}
+
+  '@types/react-is@17.0.7':
+    resolution: {integrity: sha512-WrTEiT+c6rgq36QApoy0063uAOdltCrhF0QMXLIgYPaTvIdQhAB8hPb5oGGqX18xToElNILS9UprwU6GyINcJg==}
+
+  '@types/react-transition-group@4.4.4':
+    resolution: {integrity: sha512-7gAPz7anVK5xzbeQW9wFBDg7G++aPLAFY0QaSMOou9rJZpbuI58WAuJrgu+qR92l61grlnCUe7AFX8KGahAgug==}
+
+  '@types/react@17.0.75':
+    resolution: {integrity: sha512-MSA+NzEzXnQKrqpO63CYqNstFjsESgvJAdAyyJ1n6ZQq/GLgf6nOfIKwk+Twuz0L1N6xPe+qz5xRCJrbhMaLsw==}
+
+  '@types/resolve@1.20.6':
+    resolution: {integrity: sha512-A4STmOXPhMUtHH+S6ymgE2GiBSMqf4oTvcQZMcHzokuTLVYzXTB8ttjcgxOVaAp2lGwEdzZ0J+cRbbeevQj1UQ==}
+
+  '@types/retry@0.12.2':
+    resolution: {integrity: sha512-XISRgDJ2Tc5q4TRqvgJtzsRkFYNJzZrhTdtMoGVBttwzzQJkPnS3WWTFc7kuDRoPtPakl+T+OfdEUjYJj7Jbow==}
+
+  '@types/sanitize-html@2.16.0':
+    resolution: {integrity: sha512-l6rX1MUXje5ztPT0cAFtUayXF06DqPhRyfVXareEN5gGCFaP/iwsxIyKODr9XDhfxPpN6vXUFNfo5kZMXCxBtw==}
+
+  '@types/scheduler@0.16.2':
+    resolution: {integrity: sha512-hppQEBDmlwhFAXKJX2KnWLYu5yMfi91yazPb2l+lbJiwW+wdo1gNeRA+3RgNSO39WYX2euey41KEwnqesU2Jew==}
+
+  '@types/semver@7.7.1':
+    resolution: {integrity: sha512-FmgJfu+MOcQ370SD0ev7EI8TlCAfKYU+B4m5T3yXc1CiRN94g/SZPtsCkk506aUDtlMnFZvasDwHHUcZUEaYuA==}
+
+  '@types/send@0.17.6':
+    resolution: {integrity: sha512-Uqt8rPBE8SY0RK8JB1EzVOIZ32uqy8HwdxCnoCOsYrvnswqmFZ/k+9Ikidlk/ImhsdvBsloHbAlewb2IEBV/Og==}
+
+  '@types/send@1.2.1':
+    resolution: {integrity: sha512-arsCikDvlU99zl1g69TcAB3mzZPpxgw0UQnaHeC1Nwb015xp8bknZv5rIfri9xTOcMuaVgvabfIRA7PSZVuZIQ==}
+
+  '@types/serve-index@1.9.4':
+    resolution: {integrity: sha512-qLpGZ/c2fhSs5gnYsQxtDEq3Oy8SXPClIXkW5ghvAvsNuVSA8k+gCONcUCS/UjLEYvYps+e8uBtfgXgvhwfNug==}
+
+  '@types/serve-static@1.15.10':
+    resolution: {integrity: sha512-tRs1dB+g8Itk72rlSI2ZrW6vZg0YrLI81iQSTkMmOqnqCaNr/8Ek4VwWcN5vZgCYWbg/JJSGBlUaYGAOP73qBw==}
+
+  '@types/set-cookie-parser@2.4.10':
+    resolution: {integrity: sha512-GGmQVGpQWUe5qglJozEjZV/5dyxbOOZ0LHe/lqyWssB88Y4svNfst0uqBVscdDeIKl5Jy5+aPSvy7mI9tYRguw==}
+
+  '@types/sizzle@2.3.10':
+    resolution: {integrity: sha512-TC0dmN0K8YcWEAEfiPi5gJP14eJe30TTGjkvek3iM/1NdHHsdCA/Td6GvNndMOo/iSnIsZ4HuuhrYPDAmbxzww==}
+
+  '@types/sockjs@0.3.36':
+    resolution: {integrity: sha512-MK9V6NzAS1+Ud7JV9lJLFqW85VbC9dq3LmwZCuBe4wBDgKC0Kj/jd8Xl+nSviU+Qc3+m7umHHyHg//2KSa0a0Q==}
+
+  '@types/statuses@2.0.6':
+    resolution: {integrity: sha512-xMAgYwceFhRA2zY+XbEA7mxYbA093wdiW8Vu6gZPGWy9cmOyU9XesH1tNcEWsKFd5Vzrqx5T3D38PWx1FIIXkA==}
+
+  '@types/toastr@2.1.43':
+    resolution: {integrity: sha512-sLC2fr2OXeE1iyhUixpQ64wQ2tA26awmLidn4tXTLBz4yP/VhtYUKHpmiIyDtztKkHjucdiTLH8F5uRRyhNi2Q==}
+
+  '@types/unist@3.0.3':
+    resolution: {integrity: sha512-ko/gIFJRv177XgZsZcBwnqJN5x/Gien8qNOn0D5bQU/zAzVf9Zt3BlcUiLqhV9y4ARk0GbT3tnUiPNgnTXzc/Q==}
+
+  '@types/uuid@3.4.13':
+    resolution: {integrity: sha512-pAeZeUbLE4Z9Vi9wsWV2bYPTweEHeJJy0G4pEjOA/FSvy1Ad5U5Km8iDV6TKre1mjBiVNfAdVHKruP8bAh4Q5A==}
+
+  '@types/ws@8.18.1':
+    resolution: {integrity: sha512-ThVF6DCVhA8kUGy+aazFQ4kXQ7E1Ty7A3ypFOe0IcJV8O/M511G99AW24irKrW56Wt44yG9+ij8FaqoBGkuBXg==}
+
+  '@types/yargs-parser@21.0.0':
+    resolution: {integrity: sha512-iO9ZQHkZxHn4mSakYV0vFHAVDyEOIJQrV2uZ06HxEPcx+mt8swXoZHIbaaJ2crJYFfErySgktuTZ3BeLz+XmFA==}
+
+  '@types/yargs@16.0.4':
+    resolution: {integrity: sha512-T8Yc9wt/5LbJyCaLiHPReJa0kApcIgJ7Bn735GjItUfh08Z1pJvu8QZqb9s+mMvKV6WUQRV7K2R46YbjMXTTJw==}
+
+  '@typescript-eslint/eslint-plugin@8.61.1':
+    resolution: {integrity: sha512-ZPlVl3PB3et/59Ne0fv/sci6ZXz4T4Hp4nTJ56i/Y0gR89ARb+KphojTq6j+56E5PIezmOIOOWyY+aWQFd+IkQ==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      '@typescript-eslint/parser': ^8.61.1
+      eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
+      typescript: '>=4.8.4 <6.1.0'
+
+  '@typescript-eslint/parser@8.61.1':
+    resolution: {integrity: sha512-PJ5vePq5/ognBbrIcoC5+SHO5dfpeLPzP9FpLkzWrguoYQEeeSjlJpVwOpo1JRSTEi7dRcwNy4h4dzV70PqHcg==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
+      typescript: '>=4.8.4 <6.1.0'
+
+  '@typescript-eslint/project-service@8.60.1':
+    resolution: {integrity: sha512-eXkTH2bxmXlqD1RnOPmLZ9ZM9D3VwSx04JOwBnP9RQ+yUA5a2Mu7SfW8uaV2Aon53NJzZlZYuX7tn91Izf+xaw==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      typescript: '>=4.8.4 <6.1.0'
+
+  '@typescript-eslint/project-service@8.61.1':
+    resolution: {integrity: sha512-PrC4JYGmR241lYnfhmKGTXkFqv8+ymbTFgSAY0fVXpY82/QkMw5TZPl+vGzuDDU2QYJk9fIDOBTntF+yDv9LEA==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      typescript: '>=4.8.4 <6.1.0'
+
+  '@typescript-eslint/scope-manager@8.60.1':
+    resolution: {integrity: sha512-gvI5OQoptnxQnchOirukCuQ55svJSTuD/4k5+pC267xyBtYry748R9/c3tYUzb/iE6RZfllRz2lVulLCHkTm4w==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@typescript-eslint/scope-manager@8.61.1':
+    resolution: {integrity: sha512-L2bdIeoQS8FlKAvONAr20w6OcLXeB+qiDKbAooS9A0Ben+iSIkBef0FxqwKWYqt5sa0i4KJtxVyVmhMylKzF5w==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@typescript-eslint/tsconfig-utils@8.60.1':
+    resolution: {integrity: sha512-nh8w4qAteiKuZu3pSSzG/yGKpw0OlkrKnzFmbVRenKaD4qc+7i1GrmZaLVkr8rk4uipiPGMOW4YsM6WmKZ5CvA==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      typescript: '>=4.8.4 <6.1.0'
+
+  '@typescript-eslint/tsconfig-utils@8.61.1':
+    resolution: {integrity: sha512-UN/H4di+OO7EWx2ovME+8t31YO+KVnK0RRKEHR3kOt21/Ay8BOq3M1OMvWs5vNiqcFCYGYoxK3MXPZzmMUE+yg==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      typescript: '>=4.8.4 <6.1.0'
+
+  '@typescript-eslint/type-utils@8.61.1':
+    resolution: {integrity: sha512-GYRicKmVK0C4fsKgaACaknOUAq9Oa2kwsjnpFhFcS/5p4Ht5IP9OVLbgIgcK4SRk92nVHFluurg1lumD9dBcLw==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
+      typescript: '>=4.8.4 <6.1.0'
+
+  '@typescript-eslint/types@8.60.1':
+    resolution: {integrity: sha512-4h0tY8ppCkdCzcrl2YM5M3my0xsE1Tf8om3owEu5oPWmXwkKRmk0j0LGDzYBGUcAlesEbxBhazqu/K4cu3Ug7w==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@typescript-eslint/types@8.61.1':
+    resolution: {integrity: sha512-G+CRlPqLv7Bz1IZVs03x5K59F1veqL0EJUROAdGhKsEq8qOiRiZbI+HUojPq5l0fEGOKModD9br6lObhB8zkoA==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@typescript-eslint/typescript-estree@8.60.1':
+    resolution: {integrity: sha512-alpRkfG8hlVE5kdJW2GkfgDgXxold3e8e4l6EnmhRmRLbekgAPCCGDVD++sABy9FcgPFroq+uFcCSM1vR57Cew==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      typescript: '>=4.8.4 <6.1.0'
+
+  '@typescript-eslint/typescript-estree@8.61.1':
+    resolution: {integrity: sha512-u+oQD3BqYWPc8YV9Zab4vaJElJuwOLPRc10Jm1o/qS+6Qwen14HCWwx0Seo4LnSn2wxea2Ik8DxPt2/FHmuhrg==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      typescript: '>=4.8.4 <6.1.0'
+
+  '@typescript-eslint/utils@8.60.1':
+    resolution: {integrity: sha512-h2MPBLoNtjc3qZWfY3Tl51yPorQ2McHn8pJfcMNTcIvrrZrr90Ykffit0yjrPFWQcRcUxzH20+6OcVdW4yHtUg==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
+      typescript: '>=4.8.4 <6.1.0'
+
+  '@typescript-eslint/utils@8.61.1':
+    resolution: {integrity: sha512-1+P/3Dj6jvtybE1q0HQ6yBt/gq+oKJyLdEv4HdnqasaEXRSYCAsD59mXEVQnM/ULNdQxbX77tdG4jPRjIS6knA==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
+      typescript: '>=4.8.4 <6.1.0'
+
+  '@typescript-eslint/visitor-keys@8.60.1':
+    resolution: {integrity: sha512-EbGRQg4FhrmwLodl+t3JNAnXHWVr9Vp+Zl1QBZVPY4ByfkzIT8cX3K6QWODHtkIZqqJVEWvhHSx3v5PDHsaQag==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@typescript-eslint/visitor-keys@8.61.1':
+    resolution: {integrity: sha512-6fJ9MHWtK14C1DSkiMlHUSOmrVebL7150xZJBlJiL62jjhIA4JmOq6flwBgDxIdBKKdoiZRel+dfPD5MLfny3w==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@uirouter/angularjs@1.0.11':
+    resolution: {integrity: sha512-AG6DT1mYEGLyRt8/Ggf/1teh4pp0yB99GTufC/pY6FfxmkrVE44dv9bGTOrcEETiPgu1SezsqTMjbXEv55JxCw==}
+    engines: {node: '>=4.0.0'}
+    peerDependencies:
+      angular: '>=1.2.0'
+
+  '@uirouter/core@5.0.11':
+    resolution: {integrity: sha512-x8js8f0nJivRMlxVyFcP5VmHyI091qUYCSEP69+m3uTCsIlCvLWmQiT4/FY7YBe9go6tYBBzPV+dWseg5XMD8Q==}
+    engines: {node: '>=4.0.0'}
+
+  '@uirouter/core@6.0.7':
+    resolution: {integrity: sha512-KUTJxL+6q0PiBnFx4/Z+Hsyg0pSGiaW5yZQeJmUxknecjpTbnXkLU8H2EqRn9N2B+qDRa7Jg8RcgeNDPY72O1w==}
+    engines: {node: '>=4.0.0'}
+
+  '@uirouter/react-hybrid@1.0.4':
+    resolution: {integrity: sha512-Ax4gSVVpLb50EUTlobJdd1qOZ2JQzLmdc3IN9Td9d14XzC6EnZeXJpUebXUu75/2JsHenC4VpZcJmoPA7shP9Q==}
+    peerDependencies:
+      angular: ^1.5.0
+      react: '>=15.0.0'
+
+  '@uirouter/react@1.0.7':
+    resolution: {integrity: sha512-CRCEk6fh/Fy/iAUkctPWpgrEC4DR1D/hnrpqyGshDcAuCfRVSYluRPkurzV74p1LG1pksCVlThH/0aJK9+G/MQ==}
+    peerDependencies:
+      react: '>=16.8.0'
+
+  '@uiw/codemirror-extensions-basic-setup@4.23.11':
+    resolution: {integrity: sha512-U31s5LEqEKFU4SPz1tldfrPohKddxC02z1kTnWe50k+K0CYK+PtISD5ufH/PVC0EgGL+c0TydTx72nRMwaeC4A==}
+    peerDependencies:
+      '@codemirror/autocomplete': '>=6.0.0'
+      '@codemirror/commands': '>=6.0.0'
+      '@codemirror/language': '>=6.0.0'
+      '@codemirror/lint': '>=6.0.0'
+      '@codemirror/search': '>=6.0.0'
+      '@codemirror/state': '>=6.0.0'
+      '@codemirror/view': '>=6.0.0'
+
+  '@uiw/codemirror-extensions-basic-setup@4.25.10':
+    resolution: {integrity: sha512-P3vytLlpE62KYSWrMUnwDCv2lvaQDuDZzyj03mHntuHo5bSl34fRZpjTY3kQTPGuXHxkGSYpoPFFj+hMTqaaMQ==}
+    peerDependencies:
+      '@codemirror/autocomplete': '>=6.0.0'
+      '@codemirror/commands': '>=6.0.0'
+      '@codemirror/language': '>=6.0.0'
+      '@codemirror/lint': '>=6.0.0'
+      '@codemirror/search': '>=6.0.0'
+      '@codemirror/state': '>=6.0.0'
+      '@codemirror/view': '>=6.0.0'
+
+  '@uiw/codemirror-themes@4.25.10':
+    resolution: {integrity: sha512-Fqiz1HIuDlDftcL+/O53V333UOH6MqQ84VbiQB5egn6u+uDwAqACp1FrdAoi4wgpR3b3TGW4Gr0wIYcrJSSz1A==}
+    peerDependencies:
+      '@codemirror/language': '>=6.0.0'
+      '@codemirror/state': '>=6.0.0'
+      '@codemirror/view': '>=6.0.0'
+
+  '@uiw/react-codemirror@4.23.11':
+    resolution: {integrity: sha512-oMUXl/yu/a8qKy7w7q769kH2TPlvPln6IpvkjXQX90ziD8GHRFLDz+Ij51D2RRwB3glrkPnhCN9YC+PDlnmhqA==}
+    peerDependencies:
+      '@babel/runtime': '>=7.11.0'
+      '@codemirror/state': '>=6.0.0'
+      '@codemirror/theme-one-dark': '>=6.0.0'
+      '@codemirror/view': '>=6.0.0'
+      codemirror: '>=6.0.0'
+      react: '>=16.8.0'
+      react-dom: '>=16.8.0'
+
+  '@uiw/react-codemirror@4.25.10':
+    resolution: {integrity: sha512-DzgSMwM5qzB7v1FIb4gEeriYt67iiay756/HIOM9mAbeOVK0MO7rqefHf0O5c0269pJKMW7AH9FjclExD23V9w==}
+    peerDependencies:
+      '@babel/runtime': '>=7.11.0'
+      '@codemirror/state': '>=6.0.0'
+      '@codemirror/theme-one-dark': '>=6.0.0'
+      '@codemirror/view': '>=6.0.0'
+      codemirror: '>=6.0.0'
+      react: '>=17.0.0'
+      react-dom: '>=17.0.0'
+
+  '@ungap/structured-clone@1.3.0':
+    resolution: {integrity: sha512-WmoN8qaIAo7WTYWbAZuG8PYEhn5fkz7dZrqTBZ7dtt//lL2Gwms1IcnQ5yHqjDfX8Ft5j4YzDM23f87zBfDe9g==}
+
+  '@unrs/resolver-binding-android-arm-eabi@1.11.1':
+    resolution: {integrity: sha512-ppLRUgHVaGRWUx0R0Ut06Mjo9gBaBkg3v/8AxusGLhsIotbBLuRk51rAzqLC8gq6NyyAojEXglNjzf6R948DNw==}
+    cpu: [arm]
+    os: [android]
+
+  '@unrs/resolver-binding-android-arm64@1.11.1':
+    resolution: {integrity: sha512-lCxkVtb4wp1v+EoN+HjIG9cIIzPkX5OtM03pQYkG+U5O/wL53LC4QbIeazgiKqluGeVEeBlZahHalCaBvU1a2g==}
+    cpu: [arm64]
+    os: [android]
+
+  '@unrs/resolver-binding-darwin-arm64@1.11.1':
+    resolution: {integrity: sha512-gPVA1UjRu1Y/IsB/dQEsp2V1pm44Of6+LWvbLc9SDk1c2KhhDRDBUkQCYVWe6f26uJb3fOK8saWMgtX8IrMk3g==}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@unrs/resolver-binding-darwin-x64@1.11.1':
+    resolution: {integrity: sha512-cFzP7rWKd3lZaCsDze07QX1SC24lO8mPty9vdP+YVa3MGdVgPmFc59317b2ioXtgCMKGiCLxJ4HQs62oz6GfRQ==}
+    cpu: [x64]
+    os: [darwin]
+
+  '@unrs/resolver-binding-freebsd-x64@1.11.1':
+    resolution: {integrity: sha512-fqtGgak3zX4DCB6PFpsH5+Kmt/8CIi4Bry4rb1ho6Av2QHTREM+47y282Uqiu3ZRF5IQioJQ5qWRV6jduA+iGw==}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@unrs/resolver-binding-linux-arm-gnueabihf@1.11.1':
+    resolution: {integrity: sha512-u92mvlcYtp9MRKmP+ZvMmtPN34+/3lMHlyMj7wXJDeXxuM0Vgzz0+PPJNsro1m3IZPYChIkn944wW8TYgGKFHw==}
+    cpu: [arm]
+    os: [linux]
+
+  '@unrs/resolver-binding-linux-arm-musleabihf@1.11.1':
+    resolution: {integrity: sha512-cINaoY2z7LVCrfHkIcmvj7osTOtm6VVT16b5oQdS4beibX2SYBwgYLmqhBjA1t51CarSaBuX5YNsWLjsqfW5Cw==}
+    cpu: [arm]
+    os: [linux]
+
+  '@unrs/resolver-binding-linux-arm64-gnu@1.11.1':
+    resolution: {integrity: sha512-34gw7PjDGB9JgePJEmhEqBhWvCiiWCuXsL9hYphDF7crW7UgI05gyBAi6MF58uGcMOiOqSJ2ybEeCvHcq0BCmQ==}
+    cpu: [arm64]
+    os: [linux]
+
+  '@unrs/resolver-binding-linux-arm64-musl@1.11.1':
+    resolution: {integrity: sha512-RyMIx6Uf53hhOtJDIamSbTskA99sPHS96wxVE/bJtePJJtpdKGXO1wY90oRdXuYOGOTuqjT8ACccMc4K6QmT3w==}
+    cpu: [arm64]
+    os: [linux]
+
+  '@unrs/resolver-binding-linux-ppc64-gnu@1.11.1':
+    resolution: {integrity: sha512-D8Vae74A4/a+mZH0FbOkFJL9DSK2R6TFPC9M+jCWYia/q2einCubX10pecpDiTmkJVUH+y8K3BZClycD8nCShA==}
+    cpu: [ppc64]
+    os: [linux]
+
+  '@unrs/resolver-binding-linux-riscv64-gnu@1.11.1':
+    resolution: {integrity: sha512-frxL4OrzOWVVsOc96+V3aqTIQl1O2TjgExV4EKgRY09AJ9leZpEg8Ak9phadbuX0BA4k8U5qtvMSQQGGmaJqcQ==}
+    cpu: [riscv64]
+    os: [linux]
+
+  '@unrs/resolver-binding-linux-riscv64-musl@1.11.1':
+    resolution: {integrity: sha512-mJ5vuDaIZ+l/acv01sHoXfpnyrNKOk/3aDoEdLO/Xtn9HuZlDD6jKxHlkN8ZhWyLJsRBxfv9GYM2utQ1SChKew==}
+    cpu: [riscv64]
+    os: [linux]
+
+  '@unrs/resolver-binding-linux-s390x-gnu@1.11.1':
+    resolution: {integrity: sha512-kELo8ebBVtb9sA7rMe1Cph4QHreByhaZ2QEADd9NzIQsYNQpt9UkM9iqr2lhGr5afh885d/cB5QeTXSbZHTYPg==}
+    cpu: [s390x]
+    os: [linux]
+
+  '@unrs/resolver-binding-linux-x64-gnu@1.11.1':
+    resolution: {integrity: sha512-C3ZAHugKgovV5YvAMsxhq0gtXuwESUKc5MhEtjBpLoHPLYM+iuwSj3lflFwK3DPm68660rZ7G8BMcwSro7hD5w==}
+    cpu: [x64]
+    os: [linux]
+
+  '@unrs/resolver-binding-linux-x64-musl@1.11.1':
+    resolution: {integrity: sha512-rV0YSoyhK2nZ4vEswT/QwqzqQXw5I6CjoaYMOX0TqBlWhojUf8P94mvI7nuJTeaCkkds3QE4+zS8Ko+GdXuZtA==}
+    cpu: [x64]
+    os: [linux]
+
+  '@unrs/resolver-binding-wasm32-wasi@1.11.1':
+    resolution: {integrity: sha512-5u4RkfxJm+Ng7IWgkzi3qrFOvLvQYnPBmjmZQ8+szTK/b31fQCnleNl1GgEt7nIsZRIf5PLhPwT0WM+q45x/UQ==}
+    engines: {node: '>=14.0.0'}
+    cpu: [wasm32]
+
+  '@unrs/resolver-binding-win32-arm64-msvc@1.11.1':
+    resolution: {integrity: sha512-nRcz5Il4ln0kMhfL8S3hLkxI85BXs3o8EYoattsJNdsX4YUU89iOkVn7g0VHSRxFuVMdM4Q1jEpIId1Ihim/Uw==}
+    cpu: [arm64]
+    os: [win32]
+
+  '@unrs/resolver-binding-win32-ia32-msvc@1.11.1':
+    resolution: {integrity: sha512-DCEI6t5i1NmAZp6pFonpD5m7i6aFrpofcp4LA2i8IIq60Jyo28hamKBxNrZcyOwVOZkgsRp9O2sXWBWP8MnvIQ==}
+    cpu: [ia32]
+    os: [win32]
+
+  '@unrs/resolver-binding-win32-x64-msvc@1.11.1':
+    resolution: {integrity: sha512-lrW200hZdbfRtztbygyaq/6jP6AKE8qQN2KvPcJ+x7wiD038YtnYtZ82IMNJ69GJibV7bwL3y9FgK+5w/pYt6g==}
+    cpu: [x64]
+    os: [win32]
+
+  '@vitest/coverage-v8@4.1.8':
+    resolution: {integrity: sha512-lt3kovsyHwYe00wq4D1ti0Z974fWj4NLp6siqiyEufUpyFwK9Yhi7rBhac9JL5aA0zoMrJqc4vYPZRUnI7l7nw==}
+    peerDependencies:
+      '@vitest/browser': 4.1.8
+      vitest: 4.1.8
+    peerDependenciesMeta:
+      '@vitest/browser':
+        optional: true
+
+  '@vitest/eslint-plugin@1.6.20':
+    resolution: {integrity: sha512-xRwWHFG0Utp6hXtbGiWk4VdKXCGdExD8kbWrrmFEiG5dk8anOJ+vbWbeOa8EbkocKQRTsx7JAWETccZiBgFp/Q==}
+    engines: {node: '>=18'}
+    peerDependencies:
+      '@typescript-eslint/eslint-plugin': '*'
+      eslint: '>=8.57.0'
+      typescript: '>=5.0.0'
+      vitest: '*'
+    peerDependenciesMeta:
+      '@typescript-eslint/eslint-plugin':
+        optional: true
+      typescript:
+        optional: true
+      vitest:
+        optional: true
+
+  '@vitest/expect@3.2.4':
+    resolution: {integrity: sha512-Io0yyORnB6sikFlt8QW5K7slY4OjqNX9jmJQ02QDda8lyM6B5oNgVWoSoKPac8/kgnCUzuHQKrSLtu/uOqqrig==}
+
+  '@vitest/expect@4.1.8':
+    resolution: {integrity: sha512-h3nDO677RDLEGlBxyQ5CW8RlMThSKSRLUePLOx09gNIWRL40edgA1GCZSZgf1W55MFAG6/Sw14KeaAnqv0NKdQ==}
+
+  '@vitest/mocker@4.1.8':
+    resolution: {integrity: sha512-LEiN/xe4OSIbKe9HQIp5OC24agGD9J5CnmMgsLohVVoOPWL9a2sBoR6VBx43jQZb7Kr1l4RCuyCJzcAa0+dojw==}
+    peerDependencies:
+      msw: ^2.4.9
+      vite: ^6.0.0 || ^7.0.0 || ^8.0.0
+    peerDependenciesMeta:
+      msw:
+        optional: true
+      vite:
+        optional: true
+
+  '@vitest/pretty-format@3.2.4':
+    resolution: {integrity: sha512-IVNZik8IVRJRTr9fxlitMKeJeXFFFN0JaB9PHPGQ8NKQbGpfjlTx9zO4RefN8gp7eqjNy8nyK3NZmBzOPeIxtA==}
+
+  '@vitest/pretty-format@4.1.8':
+    resolution: {integrity: sha512-9GasEBxpZ1VYIpqHf/0+YGg121uSNwCKOJqIrTwWP/TB7DmFCiaBpNl3aPZzoLWfWkuqhbH8vJIVobZkvdo2cA==}
+
+  '@vitest/runner@4.1.8':
+    resolution: {integrity: sha512-EmVxeBAfMJvycdjd6Hm+RbFBbA9fKvo0Kx37hNpBYoYeavH3RNsBXWDooR1mgD52dCrxIIuP7UotpfiwOikvcg==}
+
+  '@vitest/snapshot@4.1.8':
+    resolution: {integrity: sha512-acfZboRmAIf05DEKcBQy33VXojFJjtUdLyo7oOmV9kebb2xdU01UknNiPuPZoJZQyO7DF0gZdTGTpeAzET9QPQ==}
+
+  '@vitest/spy@3.2.4':
+    resolution: {integrity: sha512-vAfasCOe6AIK70iP5UD11Ac4siNUNJ9i/9PZ3NKx07sG6sUxeag1LWdNrMWeKKYBLlzuK+Gn65Yd5nyL6ds+nw==}
+
+  '@vitest/spy@4.1.8':
+    resolution: {integrity: sha512-6EevtBp6OZOPF7bmz36HrGMeP3txgVSrgebWxHOafDXGkhIzfXK14f8KF6MuFfgXXUeHxmpD3BQxkV00/3s5mA==}
+
+  '@vitest/utils@3.2.4':
+    resolution: {integrity: sha512-fB2V0JFrQSMsCo9HiSq3Ezpdv4iYaXRG1Sx8edX3MwxfyNn83mKiGzOcH+Fkxt4MHxr3y42fQi1oeAInqgX2QA==}
+
+  '@vitest/utils@4.1.8':
+    resolution: {integrity: sha512-uOJamYALNhfJ6iolExyQM40yIQwDqYnkKtQ5VCiSe17E33H0aQ/u+1GlRuz4LZBk6Mm3sg90G9hEbmEt37C1Zg==}
+
+  '@vtaits/use-lazy-ref@0.1.4':
+    resolution: {integrity: sha512-pdHe8k2WLIm8ccVfNw3HzeTCkifKKjVQ3hpiM7/rMynCp8nev715wrY2RCYnbeowNvekWqpGdHtrWKfCDocC6g==}
+    peerDependencies:
+      react: ^16.14.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
+
+  '@webassemblyjs/ast@1.14.1':
+    resolution: {integrity: sha512-nuBEDgQfm1ccRp/8bCQrx1frohyufl4JlbMMZ4P1wpeOfDhF6FQkxZJ1b/e+PLwr6X1Nhw6OLme5usuBWYBvuQ==}
+
+  '@webassemblyjs/floating-point-hex-parser@1.13.2':
+    resolution: {integrity: sha512-6oXyTOzbKxGH4steLbLNOu71Oj+C8Lg34n6CqRvqfS2O71BxY6ByfMDRhBytzknj9yGUPVJ1qIKhRlAwO1AovA==}
+
+  '@webassemblyjs/helper-api-error@1.13.2':
+    resolution: {integrity: sha512-U56GMYxy4ZQCbDZd6JuvvNV/WFildOjsaWD3Tzzvmw/mas3cXzRJPMjP83JqEsgSbyrmaGjBfDtV7KDXV9UzFQ==}
+
+  '@webassemblyjs/helper-buffer@1.14.1':
+    resolution: {integrity: sha512-jyH7wtcHiKssDtFPRB+iQdxlDf96m0E39yb0k5uJVhFGleZFoNw1c4aeIcVUPPbXUVJ94wwnMOAqUHyzoEPVMA==}
+
+  '@webassemblyjs/helper-numbers@1.13.2':
+    resolution: {integrity: sha512-FE8aCmS5Q6eQYcV3gI35O4J789wlQA+7JrqTTpJqn5emA4U2hvwJmvFRC0HODS+3Ye6WioDklgd6scJ3+PLnEA==}
+
+  '@webassemblyjs/helper-wasm-bytecode@1.13.2':
+    resolution: {integrity: sha512-3QbLKy93F0EAIXLh0ogEVR6rOubA9AoZ+WRYhNbFyuB70j3dRdwH9g+qXhLAO0kiYGlg3TxDV+I4rQTr/YNXkA==}
+
+  '@webassemblyjs/helper-wasm-section@1.14.1':
+    resolution: {integrity: sha512-ds5mXEqTJ6oxRoqjhWDU83OgzAYjwsCV8Lo/N+oRsNDmx/ZDpqalmrtgOMkHwxsG0iI//3BwWAErYRHtgn0dZw==}
+
+  '@webassemblyjs/ieee754@1.13.2':
+    resolution: {integrity: sha512-4LtOzh58S/5lX4ITKxnAK2USuNEvpdVV9AlgGQb8rJDHaLeHciwG4zlGr0j/SNWlr7x3vO1lDEsuePvtcDNCkw==}
+
+  '@webassemblyjs/leb128@1.13.2':
+    resolution: {integrity: sha512-Lde1oNoIdzVzdkNEAWZ1dZ5orIbff80YPdHx20mrHwHrVNNTjNr8E3xz9BdpcGqRQbAEa+fkrCb+fRFTl/6sQw==}
+
+  '@webassemblyjs/utf8@1.13.2':
+    resolution: {integrity: sha512-3NQWGjKTASY1xV5m7Hr0iPeXD9+RDobLll3T9d2AO+g3my8xy5peVyjSag4I50mR1bBSN/Ct12lo+R9tJk0NZQ==}
+
+  '@webassemblyjs/wasm-edit@1.14.1':
+    resolution: {integrity: sha512-RNJUIQH/J8iA/1NzlE4N7KtyZNHi3w7at7hDjvRNm5rcUXa00z1vRz3glZoULfJ5mpvYhLybmVcwcjGrC1pRrQ==}
+
+  '@webassemblyjs/wasm-gen@1.14.1':
+    resolution: {integrity: sha512-AmomSIjP8ZbfGQhumkNvgC33AY7qtMCXnN6bL2u2Js4gVCg8fp735aEiMSBbDR7UQIj90n4wKAFUSEd0QN2Ukg==}
+
+  '@webassemblyjs/wasm-opt@1.14.1':
+    resolution: {integrity: sha512-PTcKLUNvBqnY2U6E5bdOQcSM+oVP/PmrDY9NzowJjislEjwP/C4an2303MCVS2Mg9d3AJpIGdUFIQQWbPds0Sw==}
+
+  '@webassemblyjs/wasm-parser@1.14.1':
+    resolution: {integrity: sha512-JLBl+KZ0R5qB7mCnud/yyX08jWFw5MsoalJ1pQ4EdFlgj9VdXKGuENGsiCIjegI1W7p91rUlcB/LB5yRJKNTcQ==}
+
+  '@webassemblyjs/wast-printer@1.14.1':
+    resolution: {integrity: sha512-kPSSXE6De1XOR820C90RIo2ogvZG+c3KiHzqUoO/F34Y2shGzesfqv7o57xrxovZJH/MetF5UjroJ/R/3isoiw==}
+
+  '@webcontainer/env@1.1.1':
+    resolution: {integrity: sha512-6aN99yL695Hi9SuIk1oC88l9o0gmxL1nGWWQ/kNy81HigJ0FoaoTXpytCj6ItzgyCEwA9kF1wixsTuv5cjsgng==}
+
+  '@webpack-cli/configtest@3.0.1':
+    resolution: {integrity: sha512-u8d0pJ5YFgneF/GuvEiDA61Tf1VDomHHYMjv/wc9XzYj7nopltpG96nXN5dJRstxZhcNpV1g+nT6CydO7pHbjA==}
+    engines: {node: '>=18.12.0'}
+    peerDependencies:
+      webpack: ^5.82.0
+      webpack-cli: 6.x.x
+
+  '@webpack-cli/info@3.0.1':
+    resolution: {integrity: sha512-coEmDzc2u/ffMvuW9aCjoRzNSPDl/XLuhPdlFRpT9tZHmJ/039az33CE7uH+8s0uL1j5ZNtfdv0HkfaKRBGJsQ==}
+    engines: {node: '>=18.12.0'}
+    peerDependencies:
+      webpack: ^5.82.0
+      webpack-cli: 6.x.x
+
+  '@webpack-cli/serve@3.0.1':
+    resolution: {integrity: sha512-sbgw03xQaCLiT6gcY/6u3qBDn01CWw/nbaXl3gTdTFuJJ75Gffv3E3DBpgvY2fkkrdS1fpjaXNOmJlnbtKauKg==}
+    engines: {node: '>=18.12.0'}
+    peerDependencies:
+      webpack: ^5.82.0
+      webpack-cli: 6.x.x
+      webpack-dev-server: '*'
+    peerDependenciesMeta:
+      webpack-dev-server:
+        optional: true
+
+  '@wojtekmaj/date-utils@1.5.1':
+    resolution: {integrity: sha512-+i7+JmNiE/3c9FKxzWFi2IjRJ+KzZl1QPu6QNrsgaa2MuBgXvUy4gA1TVzf/JMdIIloB76xSKikTWuyYAIVLww==}
+
+  '@wojtekmaj/react-daterange-picker@5.5.0':
+    resolution: {integrity: sha512-xW0J5akOO0pmnPyStEndcHj3gQKTYrZue7HSfUp1F7pDgn9vAJD7AfwOBIA3iqUDUnIBl+jgrl1eP1+/EuTn7g==}
+    peerDependencies:
+      '@types/react': ^17.0.37
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0
+      react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@xterm/addon-fit@0.11.0':
+    resolution: {integrity: sha512-jYcgT6xtVYhnhgxh3QgYDnnNMYTcf8ElbxxFzX0IZo+vabQqSPAjC3c1wJrKB5E19VwQei89QCiZZP86DCPF7g==}
+
+  '@xterm/xterm@6.0.0':
+    resolution: {integrity: sha512-TQwDdQGtwwDt+2cgKDLn0IRaSxYu1tSUjgKarSDkUM0ZNiSRXFpjxEsvc/Zgc5kq5omJ+V0a8/kIM2WD3sMOYg==}
+
+  '@xtuc/ieee754@1.2.0':
+    resolution: {integrity: sha512-DX8nKgqcGwsc0eJSqYt5lwP4DH5FlHnmuWWBRy7X0NcaGR0ZtuyeESgMwTYVEtxmsNGY+qit4QYT/MIYTOTPeA==}
+
+  '@xtuc/long@4.2.2':
+    resolution: {integrity: sha512-NuHqBY1PB/D8xU6s/thBgOAiAP7HOYDQ32+BFZILJ8ivkUkAHQnWfn6WhL79Owj1qmUnoN/YPhktdIoucipkAQ==}
+
+  abab@2.0.6:
+    resolution: {integrity: sha512-j2afSsaIENvHZN2B8GOpF566vZ5WVk5opAiMTvWgaQT8DkbOqsTfvNAvHoRGU2zzP8cPoqys+xHTRDWW8L+/BA==}
+
+  accepts@1.3.8:
+    resolution: {integrity: sha512-PYAthTa2m2VKxuvSD3DPC/Gy+U+sOA1LAuT8mkmRuvw+NACSaeXEQ+NHcVF7rONl6qcaxV3Uuemwawk+7+SJLw==}
+    engines: {node: '>= 0.6'}
+
+  acorn-import-phases@1.0.4:
+    resolution: {integrity: sha512-wKmbr/DDiIXzEOiWrTTUcDm24kQ2vGfZQvM2fwg2vXqR5uW6aapr7ObPtj1th32b9u90/Pf4AItvdTh42fBmVQ==}
+    engines: {node: '>=10.13.0'}
+    peerDependencies:
+      acorn: ^8.14.0
+
+  acorn-jsx@5.3.2:
+    resolution: {integrity: sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==}
+    peerDependencies:
+      acorn: ^6.0.0 || ^7.0.0 || ^8.0.0
+
+  acorn-walk@8.2.0:
+    resolution: {integrity: sha512-k+iyHEuPgSw6SbuDpGQM+06HQUa04DZ3o+F6CSzXMvvI5KMvnaEqXe+YVe555R9nn6GPt404fos4wcgpw12SDA==}
+    engines: {node: '>=0.4.0'}
+
+  acorn@8.16.0:
+    resolution: {integrity: sha512-UVJyE9MttOsBQIDKw1skb9nAwQuR5wuGD3+82K6JgJlm/Y+KI92oNsMNGZCYdDsVtRHSak0pcV5Dno5+4jh9sw==}
+    engines: {node: '>=0.4.0'}
+    hasBin: true
+
+  agent-base@6.0.2:
+    resolution: {integrity: sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==}
+    engines: {node: '>= 6.0.0'}
+
+  agent-base@7.1.4:
+    resolution: {integrity: sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==}
+    engines: {node: '>= 14'}
+
+  ajv-formats@2.1.1:
+    resolution: {integrity: sha512-Wx0Kx52hxE7C18hkMEggYlEifqWZtYaRgouJor+WMdPnQyEK13vgEWyVNup7SoeeoLMsr4kf5h6dOW11I15MUA==}
+    peerDependencies:
+      ajv: ^8.0.0
+    peerDependenciesMeta:
+      ajv:
+        optional: true
+
+  ajv-keywords@3.5.2:
+    resolution: {integrity: sha512-5p6WTN0DdTGVQk6VjcEju19IgaHudalcfabD7yhDGeA6bcQnmL+CpveLJq/3hvfwd1aof6L386Ougkx6RfyMIQ==}
+    peerDependencies:
+      ajv: ^6.9.1
+
+  ajv-keywords@5.1.0:
+    resolution: {integrity: sha512-YCS/JNFAUyr5vAuhk1DWm1CBxRHW9LbJ2ozWeemrIqpbsqKjHVxYPyi5GC0rjZIT5JxJ3virVTS8wk4i/Z+krw==}
+    peerDependencies:
+      ajv: ^8.8.2
+
+  ajv@6.14.0:
+    resolution: {integrity: sha512-IWrosm/yrn43eiKqkfkHis7QioDleaXQHdDVPKg0FSwwd/DuvyX79TZnFOnYpB7dcsFAMmtFztZuXPDvSePkFw==}
+
+  ajv@8.17.1:
+    resolution: {integrity: sha512-B/gBuNg5SiMTrPkC+A2+cW0RszwxYmn6VYxB/inlBStS5nx6xHIt/ehKRhIMhqusl7a8LjQoZnjCs5vhwxOQ1g==}
+
+  angular-clipboard@1.7.0:
+    resolution: {integrity: sha512-4/eg3zZw1MJpIsMc+mWzeVNyWBu8YWpXPTdmbgyPRp/6f0xB6I3XR2iC6Mb4mg/5E9q6exCd0sX2yiIsw+ZLJw==}
+    peerDependencies:
+      angular: ^1.3.0
+
+  angular-file-saver@1.1.3:
+    resolution: {integrity: sha512-os4MAO7oE/d00JQtHnNyX82MtXp+I3v0GgoWZeQf79oP41GJlMfeSguIiH02HYYD+2456HuluXIcelt4kJKL8g==}
+    engines: {node: '>=0.12'}
+
+  angular-loading-bar@0.9.0:
+    resolution: {integrity: sha512-m131J6XitwSMS2D95Kso9WwpoV92ixkksJv4KXGdhk6UKS1gW09IDvSaJq24iUtsLHIRqnhpj9Y2HiIn7q0WpQ==}
+
+  angular-local-storage@0.5.2:
+    resolution: {integrity: sha512-eyUjuRO7O5qrj92lyQPBSmF73CyHsmIXOCsBpDLy34L10SIwgyWd3tnA5klPloGOkJZEdfwvA7NnJZOjrkAaQA==}
+
+  angular-messages@1.8.2:
+    resolution: {integrity: sha512-M1qNh/30cLJi4yJJ+3YB8saPonRcavz5Dquqz0T/aUySKJhIkUoeCkmF+BcLH4SJ5PBp04yy4CZUUeNRVi7jZA==}
+
+  angular-mocks@1.8.2:
+    resolution: {integrity: sha512-I5L3P0l21HPdVsP4A4qWmENt4ePjjbkDFdAzOaM7QiibFySbt14DptPbt2IjeG4vFBr4vSLbhIz8Fk03DISl8Q==}
+
+  angular-resource@1.8.2:
+    resolution: {integrity: sha512-CbTu8ypkVZMBLm+Wd+jI9xR7QEVCeUgN8WXsr9Yi9l0s/8ZQa5kEIuYX3F/75Ej8Xs1Jp9DoKjAyvACI6Q8IJA==}
+
+  angular-sanitize@1.8.2:
+    resolution: {integrity: sha512-OB6Goa+QN3byf5asQ7XRl7DKZejm/F/ZOqa9z1skqYVOWA2hoBxoCmt9E7+i7T/TbxZP5zYzKxNZVVJNu860Hg==}
+
+  angular-ui-bootstrap@2.5.6:
+    resolution: {integrity: sha512-yzcHpPMLQl0232nDzm5P4iAFTFQ9dMw0QgFLuKYbDj9M0xJ62z0oudYD/Lvh1pWfRsukiytP4Xj6BHOSrSXP8A==}
+
+  angular@1.8.2:
+    resolution: {integrity: sha512-IauMOej2xEe7/7Ennahkbb5qd/HFADiNuLSESz9Q27inmi32zB0lnAsFeLEWcox3Gd1F6YhNd1CP7/9IukJ0Gw==}
+
+  angularjs-scroll-glue@2.2.0:
+    resolution: {integrity: sha512-QnbH+8klNE/mdpiNSg3C76YdWSeYTsLzJSX55/D01a6Ur3KIGEXTJg3X3IOsVuCp22tOjX02pSZbkH8Ie+dM+Q==}
+
+  angularjs-slider@6.7.0:
+    resolution: {integrity: sha512-Cizsuax65wN2Y+htmA3safE5ALOSCyWcKyWkziaO8vCVymi26bQQs6kKDhkYc8GFix/KE7Oc9gH3QLlTUgD38w==}
+    peerDependencies:
+      angular: ^1.2.x
+
+  ansi-colors@4.1.3:
+    resolution: {integrity: sha512-/6w/C21Pm1A7aZitlI5Ni/2J6FFQN8i1Cvz3kHABAAbw93v/NlvKdVOqz7CCWz/3iv/JplRSEEZ83XION15ovw==}
+    engines: {node: '>=6'}
+
+  ansi-escapes@7.3.0:
+    resolution: {integrity: sha512-BvU8nYgGQBxcmMuEeUEmNTvrMVjJNSH7RgW24vXexN4Ven6qCvy4TntnvlnwnMLTVlcRQQdbRY8NKnaIoeWDNg==}
+    engines: {node: '>=18'}
+
+  ansi-html-community@0.0.8:
+    resolution: {integrity: sha512-1APHAyr3+PCamwNw3bXCPp4HFLONZt/yIH0sZp0/469KWNTEy+qN5jQ3GVX6DMZ1UXAi34yVwtTeaG/HpBuuzw==}
+    engines: {'0': node >= 0.8.0}
+    hasBin: true
+
+  ansi-regex@5.0.1:
+    resolution: {integrity: sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==}
+    engines: {node: '>=8'}
+
+  ansi-regex@6.0.1:
+    resolution: {integrity: sha512-n5M855fKb2SsfMIiFFoVrABHJC8QtHwVx+mHWP3QcEqBHYienj5dHSgjbxtC0WEZXYt4wcD6zrQElDPhFuZgfA==}
+    engines: {node: '>=12'}
+
+  ansi-regex@6.2.2:
+    resolution: {integrity: sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg==}
+    engines: {node: '>=12'}
+
+  ansi-styles@4.3.0:
+    resolution: {integrity: sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==}
+    engines: {node: '>=8'}
+
+  ansi-styles@5.2.0:
+    resolution: {integrity: sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==}
+    engines: {node: '>=10'}
+
+  ansi-styles@6.2.1:
+    resolution: {integrity: sha512-bN798gFfQX+viw3R7yrGWRqnrN2oRkEkUjjl4JNn4E8GxxbjtG3FbrEIIY3l8/hrwUwIeCZvi4QuOTP4MErVug==}
+    engines: {node: '>=12'}
+
+  ansi-styles@6.2.3:
+    resolution: {integrity: sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg==}
+    engines: {node: '>=12'}
+
+  any-promise@1.3.0:
+    resolution: {integrity: sha512-7UvmKalWRt1wgjL1RrGxoSJW/0QZFIegpeGvZG9kjp8vrRu55XTHbwnqq2GpXm9uLbcuhxm3IqX9OB4MZR1b2A==}
+
+  anymatch@3.1.3:
+    resolution: {integrity: sha512-KMReFUr0B4t+D+OBkjR3KYqvocp2XaSzO55UcB6mgQMd3KbcE+mWTyvVV7D/zsdEbNnV6acZUutkiHQXvTr1Rw==}
+    engines: {node: '>= 8'}
+
+  arg@5.0.2:
+    resolution: {integrity: sha512-PYjyFOLKQ9y57JvQ6QLo8dAgNqswh8M1RMJYdQduT6xbWSgK36P/Z/v+p888pM69jMMfS8Xd8F6I1kQ/I9HUGg==}
+
+  argparse@1.0.10:
+    resolution: {integrity: sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==}
+
+  argparse@2.0.1:
+    resolution: {integrity: sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==}
+
+  aria-hidden@1.2.4:
+    resolution: {integrity: sha512-y+CcFFwelSXpLZk/7fMB2mUbGtX9lKycf1MWJ7CaTIERyitVlyQx6C+sxcROU2BAJ24OiZyK+8wj2i8AlBoS3A==}
+    engines: {node: '>=10'}
+
+  aria-query@5.1.3:
+    resolution: {integrity: sha512-R5iJ5lkuHybztUfuOAznmboyjWq8O6sqNqtK7CLOqdydi54VNbORp49mb14KbWgG1QD3JFO9hJdZ+y4KutfdOQ==}
+
+  aria-query@5.3.2:
+    resolution: {integrity: sha512-COROpnaoap1E2F000S62r6A60uHZnmlvomhfyT2DlTcrY1OrBKn2UhH7qn5wTC9zMvD0AY7csdPSNwKP+7WiQw==}
+    engines: {node: '>= 0.4'}
+
+  array-buffer-byte-length@1.0.2:
+    resolution: {integrity: sha512-LHE+8BuR7RYGDKvnrmcuSq3tDcKv9OFEXQt/HpbZhY7V6h0zlUXutnAD82GiFx9rdieCMjkvtcsPqBwgUl1Iiw==}
+    engines: {node: '>= 0.4'}
+
+  array-flatten@1.1.1:
+    resolution: {integrity: sha512-PCVAQswWemu6UdxsDFFX/+gVeYqKAod3D3UVm91jHwynguOwAvYPhx8nNlM++NqRcK6CxxpUafjmhIdKiHibqg==}
+
+  array-includes@3.1.9:
+    resolution: {integrity: sha512-FmeCCAenzH0KH381SPT5FZmiA/TmpndpcaShhfgEN9eCVjnFBqq3l1xrI42y8+PPLI6hypzou4GXw00WHmPBLQ==}
+    engines: {node: '>= 0.4'}
+
+  array-union@1.0.2:
+    resolution: {integrity: sha512-Dxr6QJj/RdU/hCaBjOfxW+q6lyuVE6JFWIrAUpuOOhoJJoQ99cUn3igRaHVB5P9WrgFVN0FfArM3x0cueOU8ng==}
+    engines: {node: '>=0.10.0'}
+
+  array-uniq@1.0.3:
+    resolution: {integrity: sha512-MNha4BWQ6JbwhFhj03YK552f7cb3AzoE8SzeljgChvL1dl3IcvggXVz1DilzySZkCja+CXuZbdW7yATchWn8/Q==}
+    engines: {node: '>=0.10.0'}
+
+  array.prototype.findlast@1.2.5:
+    resolution: {integrity: sha512-CVvd6FHg1Z3POpBLxO6E6zr+rSKEQ9L6rZHAaY7lLfhKsWYUBBOuMs0e9o24oopj6H+geRCX0YJ+TJLBK2eHyQ==}
+    engines: {node: '>= 0.4'}
+
+  array.prototype.findlastindex@1.2.6:
+    resolution: {integrity: sha512-F/TKATkzseUExPlfvmwQKGITM3DGTK+vkAsCZoDc5daVygbJBnjEUCbgkAvVFsgfXfX4YIqZ/27G3k3tdXrTxQ==}
+    engines: {node: '>= 0.4'}
+
+  array.prototype.flat@1.3.3:
+    resolution: {integrity: sha512-rwG/ja1neyLqCuGZ5YYrznA62D4mZXg0i1cIskIUKSiqF3Cje9/wXAls9B9s1Wa2fomMsIv8czB8jZcPmxCXFg==}
+    engines: {node: '>= 0.4'}
+
+  array.prototype.flatmap@1.3.3:
+    resolution: {integrity: sha512-Y7Wt51eKJSyi80hFrJCePGGNo5ktJCslFuboqJsbf57CCPcm5zztluPlc4/aD8sWsKvlwatezpV4U1efk8kpjg==}
+    engines: {node: '>= 0.4'}
+
+  array.prototype.tosorted@1.1.4:
+    resolution: {integrity: sha512-p6Fx8B7b7ZhL/gmUsAy0D15WhvDccw3mnGNbZpi3pmeJdxtWsj2jEaI4Y6oo3XiHfzuSgPwKc04MYt6KgvC/wA==}
+    engines: {node: '>= 0.4'}
+
+  arraybuffer.prototype.slice@1.0.4:
+    resolution: {integrity: sha512-BNoCY6SXXPQ7gF2opIP4GBE+Xw7U+pHMYKuzjgCN3GwiaIR09UUeKfheyIry77QtrCBlC0KK0q5/TER/tYh3PQ==}
+    engines: {node: '>= 0.4'}
+
+  asn1js@3.0.7:
+    resolution: {integrity: sha512-uLvq6KJu04qoQM6gvBfKFjlh6Gl0vOKQuR5cJMDHQkmwfMOQeN3F3SHCv9SNYSL+CRoHvOGFfllDlVz03GQjvQ==}
+    engines: {node: '>=12.0.0'}
+
+  assertion-error@2.0.1:
+    resolution: {integrity: sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA==}
+    engines: {node: '>=12'}
+
+  ast-types-flow@0.0.8:
+    resolution: {integrity: sha512-OH/2E5Fg20h2aPrbe+QL8JZQFko0YZaF+j4mnQ7BGhfavO7OpSLa8a0y9sBwomHdSbkhTS8TQNayBfnW5DwbvQ==}
+
+  ast-types@0.16.1:
+    resolution: {integrity: sha512-6t10qk83GOG8p0vKmaCr8eiilZwO171AvbROMtvvNiwrTly62t+7XkA8RdIIVbpMhCASAsxgAzdRSwh6nw/5Dg==}
+    engines: {node: '>=4'}
+
+  ast-v8-to-istanbul@1.0.3:
+    resolution: {integrity: sha512-jCMQ6ZylLPudp0CDfBmQBZUsrh1/8psbmu9ibeVWKuHWD0YrH9YABwlKu5kVEFoT0GCQQW9Z/SxfuEbbkGQCRg==}
+
+  asynckit@0.4.0:
+    resolution: {integrity: sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==}
+
+  auto-ngtemplate-loader@3.1.2:
+    resolution: {integrity: sha512-rAoaXKKj7bgZZI4RhpSTimgBv92hea1J9sygmwTFdy7fu8cP1/+xx6vCmW24+z52bmqVluKAJcVIPQ7ancXilA==}
+    engines: {node: '>=12'}
+
+  autoprefixer@10.5.0:
+    resolution: {integrity: sha512-FMhOoZV4+qR6aTUALKX2rEqGG+oyATvwBt9IIzVR5rMa2HRWPkxf+P+PAJLD1I/H5/II+HuZcBJYEFBpq39ong==}
+    engines: {node: ^10 || ^12 || >=14}
+    hasBin: true
+    peerDependencies:
+      postcss: ^8.1.0
+
+  available-typed-arrays@1.0.7:
+    resolution: {integrity: sha512-wvUjBtSGN7+7SjNpq/9M2Tg350UZD3q62IFZLbRAR1bSMlCo1ZaeW+BJ+D090e4hIIZLBcTDWe4Mh4jvUDajzQ==}
+    engines: {node: '>= 0.4'}
+
+  axe-core@4.11.2:
+    resolution: {integrity: sha512-byD6KPdvo72y/wj2T/4zGEvvlis+PsZsn/yPS3pEO+sFpcrqRpX/TJCxvVaEsNeMrfQbCr7w163YqoD9IYwHXw==}
+    engines: {node: '>=4'}
+
+  axios-cache-interceptor@1.11.2:
+    resolution: {integrity: sha512-zojcFOgChlWegTYmgKn0zd/MJMrdWPrwqq3SwR+bkW3DOMcDKJLOhM2y9uR6nt75jNTAVtKobLz7SsPmYE+Bjg==}
+    engines: {node: '>=12'}
+    peerDependencies:
+      axios: ^1
+
+  axios-progress-bar@https://codeload.github.com/portainer/progress-bar-4-axios/tar.gz/d424cd29f5b629af9ffc5c3d6db8d92d11d82f0f:
+    resolution: {tarball: https://codeload.github.com/portainer/progress-bar-4-axios/tar.gz/d424cd29f5b629af9ffc5c3d6db8d92d11d82f0f}
+    version: 1.2.0
+    peerDependencies:
+      axios: ^1.6.2
+
+  axios@1.18.0:
+    resolution: {integrity: sha512-E32NzpYKp++W7XRe52rHiXV2ehxmh3wbdgO7MHeFM+vqxLBYHzt0ElkiImtOBxtOmyp0yoC8C6uESVV84Y2/hw==}
+
+  axobject-query@4.1.0:
+    resolution: {integrity: sha512-qIj0G9wZbMGNLjLmg1PT6v2mE9AH2zlnADJD/2tC6E00hgmhUOfEB6greHPAfLRSufHqROIUTkw6E+M3lH0PTQ==}
+    engines: {node: '>= 0.4'}
+
+  babel-loader@9.1.3:
+    resolution: {integrity: sha512-xG3ST4DglodGf8qSwv0MdeWLhrDsw/32QMdTO5T1ZIp9gQur0HkCyFs7Awskr10JKXFXwpAhiCuYX5oGXnRGbw==}
+    engines: {node: '>= 14.15.0'}
+    peerDependencies:
+      '@babel/core': ^7.12.0
+      webpack: '>=5'
+
+  babel-plugin-angularjs-annotate@0.10.0:
+    resolution: {integrity: sha512-NPE7FOAxcLPCUR/kNkrhHIjoScR3RyIlRH3yRn79j8EZWtpILVnCOdA9yKfsOmRh6BHnLHKl8ZAThc+YDd/QwQ==}
+
+  babel-plugin-i18next-extract@0.9.0:
+    resolution: {integrity: sha512-i/kcv6YlYFvUR8rICPBxP4xQXenFOGe+84hzYLXItJYrLlimph4lne6hoZXYgaU3mVJmtRokcBmn4RvcitizXA==}
+    engines: {node: '>=10.0.0'}
+
+  babel-plugin-lodash@3.3.4:
+    resolution: {integrity: sha512-yDZLjK7TCkWl1gpBeBGmuaDIFhZKmkoL+Cu2MUUjv5VxUZx/z7tBGBCBcQs5RI1Bkz5LLmNdjx7paOyQtMovyg==}
+
+  babel-plugin-macros@3.1.0:
+    resolution: {integrity: sha512-Cg7TFGpIr01vOQNODXOOaGz2NpCU5gl8x1qJFbb6hbZxR7XrcE2vtbAsTAbJ7/xwJtUuJEw8K8Zr/AE0LHlesg==}
+    engines: {node: '>=10', npm: '>=6'}
+
+  babel-plugin-polyfill-corejs2@0.4.7:
+    resolution: {integrity: sha512-LidDk/tEGDfuHW2DWh/Hgo4rmnw3cduK6ZkOI1NPFceSK3n/yAGeOsNT7FLnSGHkXj3RHGSEVkN3FsCTY6w2CQ==}
+    peerDependencies:
+      '@babel/core': ^7.4.0 || ^8.0.0-0 <8.0.0
+
+  babel-plugin-polyfill-corejs3@0.8.7:
+    resolution: {integrity: sha512-KyDvZYxAzkC0Aj2dAPyDzi2Ym15e5JKZSK+maI7NAwSqofvuFglbSsxE7wUOvTg9oFVnHMzVzBKcqEb4PJgtOA==}
+    peerDependencies:
+      '@babel/core': ^7.4.0 || ^8.0.0-0 <8.0.0
+
+  babel-plugin-polyfill-regenerator@0.5.4:
+    resolution: {integrity: sha512-S/x2iOCvDaCASLYsOOgWOq4bCfKYVqvO/uxjkaYyZ3rVsVE3CeAI/c84NpyuBBymEgNvHgjEot3a9/Z/kXvqsg==}
+    peerDependencies:
+      '@babel/core': ^7.4.0 || ^8.0.0-0 <8.0.0
+
+  balanced-match@1.0.2:
+    resolution: {integrity: sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==}
+
+  balanced-match@4.0.4:
+    resolution: {integrity: sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==}
+    engines: {node: 18 || 20 || >=22}
+
+  base64-js@1.5.1:
+    resolution: {integrity: sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==}
+
+  baseline-browser-mapping@2.10.33:
+    resolution: {integrity: sha512-bA6+tcSLpz2tIEdDXZPpPTIuxBcC4+w6SieaYyfigIa4h8GlFxbA17v22Vx3JUtuZQj9SgOsnbK+aTBzyDyEuw==}
+    engines: {node: '>=6.0.0'}
+    hasBin: true
+
+  batch@0.6.1:
+    resolution: {integrity: sha512-x+VAiMRL6UPkx+kudNvxTl6hB2XNNCG2r+7wixVfIYwu/2HKRXimwQyaumLjMveWvT2Hkd/cAJw+QBMfJ/EKVw==}
+
+  best-effort-json-parser@1.1.3:
+    resolution: {integrity: sha512-O3LfmiLJ5UQOGqrrl6ynCdfDgK50cd0nxy0JacFZ7ARhfhjdksTfScHAJ0580RNgNejLjRvu/7Yj9znY0sqeFA==}
+
+  big.js@5.2.2:
+    resolution: {integrity: sha512-vyL2OymJxmarO8gxMr0mhChsO9QGwhynfuu4+MHTAW6czfq9humCB7rKpUjDd9YUiDPU4mzpyupFSvOClAwbmQ==}
+
+  binary-extensions@2.2.0:
+    resolution: {integrity: sha512-jDctJ/IVQbZoJykoeHbhXpOlNBqGNcwXJKJog42E5HDPUwQTSdjCHdihjj0DlnheQ7blbT6dHOafNAiS8ooQKA==}
+    engines: {node: '>=8'}
+
+  blob-tmp@1.0.0:
+    resolution: {integrity: sha512-RTImmCaQkiW07iT+n82zNo5OF/QsAx2hDlzdwgtDyI7VQPF2gQK/aGyEBNyUdtFyNNOsYNSm7LI0n5wctG6QUA==}
+
+  body-parser@1.20.4:
+    resolution: {integrity: sha512-ZTgYYLMOXY9qKU/57FAo8F+HA2dGX7bqGc71txDRC1rS4frdFI5R7NhluHxH6M0YItAP0sHB4uqAOcYKxO6uGA==}
+    engines: {node: '>= 0.8', npm: 1.2.8000 || >= 1.4.16}
+
+  bonjour-service@1.3.0:
+    resolution: {integrity: sha512-3YuAUiSkWykd+2Azjgyxei8OWf8thdn8AITIog2M4UICzoqfjlqr64WIjEXZllf/W6vK1goqleSR6brGomxQqA==}
+
+  boolbase@1.0.0:
+    resolution: {integrity: sha512-JZOSA7Mo9sNGB8+UjSgzdLtokWAky1zbztM3WRLCbZ70/3cTANmQmOdR7y2g+J0e2WXywy1yS468tY+IruqEww==}
+
+  bootstrap@3.4.1:
+    resolution: {integrity: sha512-yN5oZVmRCwe5aKwzRj6736nSmKDX7pLYwsXiCj/EYmo16hODaBiT4En5btW/jhBF/seV+XMx3aYwukYC3A49DA==}
+    engines: {node: '>=6'}
+
+  brace-expansion@1.1.11:
+    resolution: {integrity: sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==}
+
+  brace-expansion@5.0.5:
+    resolution: {integrity: sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==}
+    engines: {node: 18 || 20 || >=22}
+
+  braces@3.0.3:
+    resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==}
+    engines: {node: '>=8'}
+
+  browserslist@4.28.2:
+    resolution: {integrity: sha512-48xSriZYYg+8qXna9kwqjIVzuQxi+KYWp2+5nCYnYKPTr0LvD89Jqk2Or5ogxz0NUMfIjhh2lIUX/LyX9B4oIg==}
+    engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7}
+    hasBin: true
+
+  buffer-from@1.1.2:
+    resolution: {integrity: sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ==}
+
+  buffer@6.0.3:
+    resolution: {integrity: sha512-FTiCpNxtwiZZHEZbcbTIcZjERVICn9yq/pDFkTl95/AxzD1naBctN7YO68riM/gLSDY7sdrMby8hofADYuuqOA==}
+
+  bundle-name@4.1.0:
+    resolution: {integrity: sha512-tjwM5exMg6BGRI+kNmTntNsvdZS1X8BFYS6tnJ2hdH0kVxM6/eVZ2xy+FqStSWvYmtfFMDLIxurorHwDKfDz5Q==}
+    engines: {node: '>=18'}
+
+  bytes@3.1.2:
+    resolution: {integrity: sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==}
+    engines: {node: '>= 0.8'}
+
+  bytestreamjs@2.0.1:
+    resolution: {integrity: sha512-U1Z/ob71V/bXfVABvNr/Kumf5VyeQRBEm6Txb0PQ6S7V5GpBM3w4Cbqz/xPDicR5tN0uvDifng8C+5qECeGwyQ==}
+    engines: {node: '>=6.0.0'}
+
+  c12@3.3.4:
+    resolution: {integrity: sha512-cM0ApFQSBXuourJejzwv/AuPRvAxordTyParRVcHjjtXirtkzM0uK2L9TTn9s0cXZbG7E55jCivRQzoxYmRAlA==}
+    peerDependencies:
+      magicast: '*'
+    peerDependenciesMeta:
+      magicast:
+        optional: true
+
+  c8@9.1.0:
+    resolution: {integrity: sha512-mBWcT5iqNir1zIkzSPyI3NCR9EZCVI3WUD+AVO17MVWTSFNyUueXE82qTeampNtTr+ilN/5Ua3j24LgbCKjDVg==}
+    engines: {node: '>=14.14.0'}
+    hasBin: true
+
+  cache-parser@1.2.6:
+    resolution: {integrity: sha512-SjjnKlWgrhDrAWKUxAvmZLRGDa6JExMfjSu59/pvpNoI6mEHYSLcLKUw2RtECEOINvf6dxJo35fY+T/scA0SUA==}
+
+  call-bind-apply-helpers@1.0.2:
+    resolution: {integrity: sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==}
+    engines: {node: '>= 0.4'}
+
+  call-bind@1.0.9:
+    resolution: {integrity: sha512-a/hy+pNsFUTR+Iz8TCJvXudKVLAnz/DyeSUo10I5yvFDQJBFU2s9uqQpoSrJlroHUKoKqzg+epxyP9lqFdzfBQ==}
+    engines: {node: '>= 0.4'}
+
+  call-bound@1.0.4:
+    resolution: {integrity: sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==}
+    engines: {node: '>= 0.4'}
+
+  call-me-maybe@1.0.2:
+    resolution: {integrity: sha512-HpX65o1Hnr9HH25ojC1YGs7HCQLq0GCOibSaWER0eNpgJ/Z1MZv2mTc7+xh6WOPxbRVcmgbv4hGU+uSQ/2xFZQ==}
+
+  callsites@3.1.0:
+    resolution: {integrity: sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ==}
+    engines: {node: '>=6'}
+
+  camel-case@4.1.2:
+    resolution: {integrity: sha512-gxGWBrTT1JuMx6R+o5PTXMmUnhnVzLQ9SNutD4YqKtI6ap897t3tKECYla6gCWEkplXnlNybEkZg9GEGxKFCgw==}
+
+  camelcase-css@2.0.1:
+    resolution: {integrity: sha512-QOSvevhslijgYwRx6Rv7zKdMF8lbRmx+uQGx2+vDc+KI/eBnsy9kit5aj23AgGu3pa4t9AgwbnXWqS+iOY+2aA==}
+    engines: {node: '>= 6'}
+
+  camelcase@5.3.1:
+    resolution: {integrity: sha512-L28STB170nwWS63UjtlEOE3dldQApaJXZkOI1uMFfzf3rRuPegHaHesyee+YxQ+W6SvRDQV6UrdOdRiR153wJg==}
+    engines: {node: '>=6'}
+
+  camelcase@6.3.0:
+    resolution: {integrity: sha512-Gmy6FhYlCY7uOElZUSbxo2UCDH8owEk996gkbrpsgGtrJLM3J7jGxl9Ic7Qwwj4ivOE5AWZWRMecDdF7hqGjFA==}
+    engines: {node: '>=10'}
+
+  caniuse-api@3.0.0:
+    resolution: {integrity: sha512-bsTwuIg/BZZK/vreVTYYbSWoe2F+71P7K5QGEX+pT250DZbfU1MQ5prOKpPR+LL6uWKK3KMwMCAS74QB3Um1uw==}
+
+  caniuse-lite@1.0.30001793:
+    resolution: {integrity: sha512-iwSsYWaCOoh26cV8NwNRViHlrfUvYsHDfRVcbtmw0Kg6PJIZZXwMkj1442FYLBGkeUf1juAsU3DTfxW579mrPA==}
+
+  case-sensitive-paths-webpack-plugin@2.4.0:
+    resolution: {integrity: sha512-roIFONhcxog0JSSWbvVAh3OocukmSgpqOH6YpMkCvav/ySIV3JKg4Dc8vYtQjYi/UxpNE36r/9v+VqTQqgkYmw==}
+    engines: {node: '>=4'}
+
+  ccount@2.0.1:
+    resolution: {integrity: sha512-eyrF0jiFpY+3drT6383f1qhkbGsLSifNAjA61IUjZjmLCWjItY6LB9ft9YhoDgwfmclB2zhu51Lc7+95b8NRAg==}
+
+  chai@5.3.3:
+    resolution: {integrity: sha512-4zNhdJD/iOjSH0A05ea+Ke6MU5mmpQcbQsSOkgdaUMJ9zTlDTD/GYlwohmIE2u0gaxHYiVHEn1Fw9mZ/ktJWgw==}
+    engines: {node: '>=18'}
+
+  chai@6.2.2:
+    resolution: {integrity: sha512-NUPRluOfOiTKBKvWPtSD4PhFvWCqOi0BGStNWs57X9js7XGTprSmFoz5F0tWhR4WPjNeR9jXqdC7/UpSJTnlRg==}
+    engines: {node: '>=18'}
+
+  chalk@4.1.2:
+    resolution: {integrity: sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==}
+    engines: {node: '>=10'}
+
+  character-entities-html4@2.1.0:
+    resolution: {integrity: sha512-1v7fgQRj6hnSwFpq1Eu0ynr/CDEw0rXo2B61qXrLNdHZmPKgb7fqS1a2JwF0rISo9q77jDI8VMEHoApn8qDoZA==}
+
+  character-entities-legacy@3.0.0:
+    resolution: {integrity: sha512-RpPp0asT/6ufRm//AJVwpViZbGM/MkjQFxJccQRHmISF/22NBtsHqAWmL+/pmkPWoIUJdWyeVleTl1wydHATVQ==}
+
+  chardet@1.4.0:
+    resolution: {integrity: sha512-NpwMDdSIprbYx1CLnfbxEIarI0Z+s9MssEgggMNheGM+WD68yOhV7IEA/3r6tr0yTRgQD0HuZJDw32s99i6L+A==}
+
+  chart.js@2.9.4:
+    resolution: {integrity: sha512-B07aAzxcrikjAPyV+01j7BmOpxtQETxTSlQ26BEYJ+3iUkbNKaOJ/nDbT6JjyqYxseM0ON12COHYdU2cTIjC7A==}
+
+  chartjs-color-string@0.6.0:
+    resolution: {integrity: sha512-TIB5OKn1hPJvO7JcteW4WY/63v6KwEdt6udfnDE9iCAZgy+V4SrbSxoIbTw/xkUIapjEI4ExGtD0+6D3KyFd7A==}
+
+  chartjs-color@2.4.1:
+    resolution: {integrity: sha512-haqOg1+Yebys/Ts/9bLo/BqUcONQOdr/hoEr2LLTRl6C5LXctUdHxsCYfvQVg5JIxITrfCNUDr4ntqmQk9+/0w==}
+
+  check-error@2.1.3:
+    resolution: {integrity: sha512-PAJdDJusoxnwm1VwW07VWwUN1sl7smmC3OKggvndJFadxxDRyFJBX/ggnu/KE4kQAB7a3Dp8f/YXC1FlUprWmA==}
+    engines: {node: '>= 16'}
+
+  chokidar@3.6.0:
+    resolution: {integrity: sha512-7VT13fmjotKpGipCW9JEQAusEPE+Ei8nl6/g4FBAmIm0GOOLMua9NDDo/DWp0ZAxCr3cPq5ZpBqmPAQgDda2Pw==}
+    engines: {node: '>= 8.10.0'}
+
+  chokidar@4.0.3:
+    resolution: {integrity: sha512-Qgzu8kfBvo+cA4962jnP1KkS6Dop5NS6g7R5LFYJr4b8Ub94PPQXUksCw9PvXoeXPRRddRNC5C1JQUR2SMGtnA==}
+    engines: {node: '>= 14.16.0'}
+
+  chokidar@5.0.0:
+    resolution: {integrity: sha512-TQMmc3w+5AxjpL8iIiwebF73dRDF4fBIieAqGn9RGCWaEVwQ6Fb2cGe31Yns0RRIzii5goJ1Y7xbMwo1TxMplw==}
+    engines: {node: '>= 20.19.0'}
+
+  chromatic@13.3.5:
+    resolution: {integrity: sha512-MzPhxpl838qJUo0A55osCF2ifwPbjcIPeElr1d4SHcjnHoIcg7l1syJDrAYK/a+PcCBrOGi06jPNpQAln5hWgw==}
+    hasBin: true
+    peerDependencies:
+      '@chromatic-com/cypress': ^0.*.* || ^1.0.0
+      '@chromatic-com/playwright': ^0.*.* || ^1.0.0
+    peerDependenciesMeta:
+      '@chromatic-com/cypress':
+        optional: true
+      '@chromatic-com/playwright':
+        optional: true
+
+  chrome-trace-event@1.0.3:
+    resolution: {integrity: sha512-p3KULyQg4S7NIHixdwbGX+nFHkoBiA4YQmyWtjb8XngSKV124nJmRysgAeujbUVb15vh+RvFUfCPqU7rXk+hZg==}
+    engines: {node: '>=6.0'}
+
+  cjs-module-lexer@1.4.3:
+    resolution: {integrity: sha512-9z8TZaGM1pfswYeXrUpzPrkx8UnWYdhJclsiYMm6x/w5+nN+8Tf/LnAgfLGQCm59qAOxU8WwHEq2vNwF6i4j+Q==}
+
+  class-variance-authority@0.7.1:
+    resolution: {integrity: sha512-Ka+9Trutv7G8M6WT6SeiRWz792K5qEqIGEGzXKhAE6xOWAY6pPH8U+9IY3oCMv6kqTmLsv7Xh/2w2RigkePMsg==}
+
+  classnames@2.3.1:
+    resolution: {integrity: sha512-OlQdbZ7gLfGarSqxesMesDa5uz7KFbID8Kpq/SxIoNGDqY8lSYs0D+hhtBXhcdB3rcbXArFr7vlHheLk1voeNA==}
+
+  clean-css@5.3.2:
+    resolution: {integrity: sha512-JVJbM+f3d3Q704rF4bqQ5UUyTtuJ0JRKNbTKVEeujCCBoMdkEi+V+e8oktO9qGQNSvHrFTM6JZRXrUvGR1czww==}
+    engines: {node: '>= 10.0'}
+
+  clean-webpack-plugin@4.0.0:
+    resolution: {integrity: sha512-WuWE1nyTNAyW5T7oNyys2EN0cfP2fdRxhxnIQWiAp0bMabPdHhoGxM8A6YL2GhqwgrPnnaemVE7nv5XJ2Fhh2w==}
+    engines: {node: '>=10.0.0'}
+    peerDependencies:
+      webpack: '>=4.0.0 <6.0.0'
+
+  cli-cursor@5.0.0:
+    resolution: {integrity: sha512-aCj4O5wKyszjMmDT4tZj93kxyydN/K5zPWSCe6/0AV/AA1pqe5ZBIw0a2ZfPQV7lL5/yb5HsUreJ6UFAF1tEQw==}
+    engines: {node: '>=18'}
+
+  cli-truncate@5.2.0:
+    resolution: {integrity: sha512-xRwvIOMGrfOAnM1JYtqQImuaNtDEv9v6oIYAs4LIHwTiKee8uwvIi363igssOC0O5U04i4AlENs79LQLu9tEMw==}
+    engines: {node: '>=20'}
+
+  cli-width@4.1.0:
+    resolution: {integrity: sha512-ouuZd4/dm2Sw5Gmqy6bGyNNNe1qt9RpmxveLSO7KcgsTnU7RXfsw+/bukWGo1abgBiMAic068rclZsO4IWmmxQ==}
+    engines: {node: '>= 12'}
+
+  cliui@6.0.0:
+    resolution: {integrity: sha512-t6wbgtoCXvAzst7QgXxJYqPt0usEfbgQdftEPbLL/cvv6HPE5VgvqCuAIDR0NgU52ds6rFwqrgakNLrHEjCbrQ==}
+
+  cliui@8.0.1:
+    resolution: {integrity: sha512-BSeNnyus75C4//NQ9gQt1/csTXyo/8Sb+afLAkzAptFuMsod9HFokGNudZpi/oQV73hnVK+sR+5PVRMd+Dr7YQ==}
+    engines: {node: '>=12'}
+
+  clone-deep@4.0.1:
+    resolution: {integrity: sha512-neHB9xuzh/wk0dIHweyAXv2aPGZIVk3pLMe+/RNzINf17fe0OG96QroktYAUm7SM1PBnzTabaLboqqxDyMU+SQ==}
+    engines: {node: '>=6'}
+
+  clsx@1.1.1:
+    resolution: {integrity: sha512-6/bPho624p3S2pMyvP5kKBPXnI3ufHLObBFCfgx+LkeR5lg2XYy2hqZqUf45ypD8COn2bhgGJSUE+l5dhNBieA==}
+    engines: {node: '>=6'}
+
+  clsx@2.1.1:
+    resolution: {integrity: sha512-eYm0QWBtUrBWZWG0d386OGAw16Z995PiOVo2B7bjWSbHedGl5e0ZWaq65kOGgUSNesEIDkB9ISbTg/JK9dhCZA==}
+    engines: {node: '>=6'}
+
+  codemirror-json-schema@0.8.1:
+    resolution: {integrity: sha512-4lKPjW+nugNAmM5MsggJyn6TUxYdCCwAJIr9T4cZeTFPdkbBvPteCOGtDedrTOIeTC2ZFJtVg7VHIXnYU32t8w==}
+    peerDependencies:
+      '@codemirror/language': ^6.10.2
+      '@codemirror/lint': ^6.8.0
+      '@codemirror/state': ^6.4.1
+      '@codemirror/view': ^6.27.0
+      '@lezer/common': ^1.2.1
+
+  codemirror-json5@1.0.3:
+    resolution: {integrity: sha512-HmmoYO2huQxoaoG5ARKjqQc9mz7/qmNPvMbISVfIE2Gk1+4vZQg9X3G6g49MYM5IK00Ol3aijd7OKrySuOkA7Q==}
+
+  codemirror@6.0.1:
+    resolution: {integrity: sha512-J8j+nZ+CdWmIeFIGXEFbFPtpiYacFMDR8GlHK3IyHQJMCaVRfGx9NT+Hxivv1ckLWPvNdZqndbr/7lVhrf/Svg==}
+
+  color-convert@1.9.3:
+    resolution: {integrity: sha512-QfAUtd+vFdAtFQcC8CCyYt1fYWxSqAiK2cSD6zDB8N3cpsEBAvRxp9zOGg6G/SHHJYAT88/az/IuDGALsNVbGg==}
+
+  color-convert@2.0.1:
+    resolution: {integrity: sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==}
+    engines: {node: '>=7.0.0'}
+
+  color-name@1.1.3:
+    resolution: {integrity: sha512-72fSenhMw2HZMTVHeCA9KCmpEIbzWiQsjN+BHcBbS9vr1mtt+vJjPdksIBNUmKAW8TFUDPJK5SUU3QhE9NEXDw==}
+
+  color-name@1.1.4:
+    resolution: {integrity: sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==}
+
+  color-support@1.1.3:
+    resolution: {integrity: sha512-qiBjkpbMLO/HL68y+lh4q0/O1MZFj2RX6X/KmMa3+gJD3z+WwI1ZzDHysvqHGS3mP6mznPckpXmw1nI9cJjyRg==}
+    hasBin: true
+
+  colorette@2.0.20:
+    resolution: {integrity: sha512-IfEDxwoWIjkeXL1eXcDiow4UbKjhLdq6/EuSVR9GMN7KVH3r9gQ83e73hsz1Nd1T3ijd5xv1wcWRYO+D6kCI2w==}
+
+  combined-stream@1.0.8:
+    resolution: {integrity: sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==}
+    engines: {node: '>= 0.8'}
+
+  comma-separated-tokens@2.0.3:
+    resolution: {integrity: sha512-Fu4hJdvzeylCfQPp9SGWidpzrMs7tTrlu6Vb8XGaRGck8QSNZJJp538Wrb60Lax4fPwR64ViY468OIUTbRlGZg==}
+
+  commander@10.0.1:
+    resolution: {integrity: sha512-y4Mg2tXshplEbSGzx7amzPwKKOCGuoSRP/CjEdwwk0FOGlUbq6lKuoyDZTNZkmxHdJtp54hdfY/JUrdL7Xfdug==}
+    engines: {node: '>=14'}
+
+  commander@11.1.0:
+    resolution: {integrity: sha512-yPVavfyCcRhmorC7rWlkHn15b4wDVgVmBA7kV4QVBsF7kv/9TKJAbAXVTxvTnwP8HHKjRCJDClKbciiYS7p0DQ==}
+    engines: {node: '>=16'}
+
+  commander@12.1.0:
+    resolution: {integrity: sha512-Vw8qHK3bZM9y/P10u3Vib8o/DdkvA2OtPtZvD871QKjy74Wj1WSKFILMPRPSdUSx5RFK1arlJzEtA4PkFgnbuA==}
+    engines: {node: '>=18'}
+
+  commander@15.0.0:
+    resolution: {integrity: sha512-z67u4ZhzCL/Tydu1lJARtEZYWbWaN7oYLHbsuzocr6y4N6WZAagG3RQ4FW61V1/0+jImpj293XfrcYnd1qxtPg==}
+    engines: {node: '>=22.12.0'}
+
+  commander@2.20.3:
+    resolution: {integrity: sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ==}
+
+  commander@4.1.1:
+    resolution: {integrity: sha512-NOKm8xhkzAjzFx8B2v5OAHT+u5pRQc2UCa2Vq9jYL/31o2wi9mxBA7LIFs3sV5VSC49z6pEhfbMULvShKj26WA==}
+    engines: {node: '>= 6'}
+
+  commander@7.2.0:
+    resolution: {integrity: sha512-QrWXB+ZQSVPmIWIhtEO9H+gwHaMGYiF5ChvoJ+K9ZGHG/sVsa6yiesAD1GC/x46sET00Xlwo1u49RVVVzvcSkw==}
+    engines: {node: '>= 10'}
+
+  commander@8.3.0:
+    resolution: {integrity: sha512-OkTL9umf+He2DZkUq8f8J9of7yL6RJKI24dVITBmNfZBmri9zYZQrKkuXiKhyfPSu8tUhnVBB1iKXevvnlR4Ww==}
+    engines: {node: '>= 12'}
+
+  common-path-prefix@3.0.0:
+    resolution: {integrity: sha512-QE33hToZseCH3jS0qN96O/bSh3kaw/h+Tq7ngyY9eWDUnTlTNUyqfqvCXioLe5Na5jFsL78ra/wuBU4iuEgd4w==}
+
+  commondir@1.0.1:
+    resolution: {integrity: sha512-W9pAhw0ja1Edb5GVdIF1mjZw/ASI0AlShXM83UUGe2DVr5TdAPEA1OA8m/g8zWp9x6On7gqufY+FatDbC3MDQg==}
+
+  compressible@2.0.18:
+    resolution: {integrity: sha512-AF3r7P5dWxL8MxyITRMlORQNaOA2IkAFaTr4k7BUumjPtRpGDTZpl0Pb1XCO6JeDCBdp126Cgs9sMxqSjgYyRg==}
+    engines: {node: '>= 0.6'}
+
+  compression@1.8.1:
+    resolution: {integrity: sha512-9mAqGPHLakhCLeNyxPkK4xVo746zQ/czLH1Ky+vkitMnWfWZps8r0qXuwhwizagCRttsL4lfG4pIOvaWLpAP0w==}
+    engines: {node: '>= 0.8.0'}
+
+  concat-map@0.0.1:
+    resolution: {integrity: sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==}
+
+  confbox@0.2.4:
+    resolution: {integrity: sha512-ysOGlgTFbN2/Y6Cg3Iye8YKulHw+R2fNXHrgSmXISQdMnomY6eNDprVdW9R5xBguEqI954+S6709UyiO7B+6OQ==}
+
+  connect-history-api-fallback@2.0.0:
+    resolution: {integrity: sha512-U73+6lQFmfiNPrYbXqr6kZ1i1wiRqXnp2nhMsINseWXO8lDau0LGEffJ8kQi4EjLZympVgRdvqjAgiZ1tgzDDA==}
+    engines: {node: '>=0.8'}
+
+  content-disposition@0.5.4:
+    resolution: {integrity: sha512-FveZTNuGw04cxlAiWbzi6zTAL/lhehaWbTtgluJh4/E95DqMwTmha3KZN1aAWA8cFIhHzMZUvLevkw5Rqk+tSQ==}
+    engines: {node: '>= 0.6'}
+
+  content-type@1.0.5:
+    resolution: {integrity: sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==}
+    engines: {node: '>= 0.6'}
+
+  convert-source-map@1.9.0:
+    resolution: {integrity: sha512-ASFBup0Mz1uyiIjANan1jzLQami9z1PoYSZCiiYW2FczPbenXc45FZdBZLzOT+r6+iciuEModtmCti+hjaAk0A==}
+
+  convert-source-map@2.0.0:
+    resolution: {integrity: sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==}
+
+  cookie-signature@1.0.6:
+    resolution: {integrity: sha512-QADzlaHc8icV8I7vbaJXJwod9HWYp8uCqf1xa4OfNu1T7JVxQIrUgOWtHdNDtPiywmFbiS12VjotIXLrKM3orQ==}
+
+  cookie@0.7.2:
+    resolution: {integrity: sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==}
+    engines: {node: '>= 0.6'}
+
+  cookie@1.1.1:
+    resolution: {integrity: sha512-ei8Aos7ja0weRpFzJnEA9UHJ/7XQmqglbRwnf2ATjcB9Wq874VKH9kfjjirM6UhU2/E5fFYadylyhFldcqSidQ==}
+    engines: {node: '>=18'}
+
+  copy-anything@2.0.6:
+    resolution: {integrity: sha512-1j20GZTsvKNkc4BY3NpMOM8tt///wY3FpIzozTOFO2ffuZcV61nojHXVKIy3WM+7ADCy5FVhdZYHYDdgTU0yJw==}
+
+  copy-anything@3.0.5:
+    resolution: {integrity: sha512-yCEafptTtb4bk7GLEQoM8KVJpxAfdBJYaXyzQEgQQQgYrZiDp8SJmGKlYza6CYjEDNstAdNdKA3UuoULlEbS6w==}
+    engines: {node: '>=12.13'}
+
+  copy-webpack-plugin@11.0.0:
+    resolution: {integrity: sha512-fX2MWpamkW0hZxMEg0+mYnA40LTosOSa5TqZ9GYIBzyJa9C3QUaMPSE2xAi/buNr8u89SfD9wHSQVBzrRa/SOQ==}
+    engines: {node: '>= 14.15.0'}
+    peerDependencies:
+      webpack: ^5.1.0
+
+  core-js-compat@3.34.0:
+    resolution: {integrity: sha512-4ZIyeNbW/Cn1wkMMDy+mvrRUxrwFNjKwbhCfQpDd+eLgYipDqp8oGFGtLmhh18EDPKA0g3VUBYOxQGGwvWLVpA==}
+
+  core-js@3.20.0:
+    resolution: {integrity: sha512-KjbKU7UEfg4YPpskMtMXPhUKn7m/1OdTHTVjy09ScR2LVaoUXe8Jh0UdvN2EKUR6iKTJph52SJP95mAB0MnVLQ==}
+
+  core-util-is@1.0.3:
+    resolution: {integrity: sha512-ZQBvi1DcpJ4GDqanjucZ2Hj3wEO5pZDS89BWbkcrvdxksJorwUDDZamX9ldFkp9aw2lmBDLgkObEA4DWNJ9FYQ==}
+
+  cosmiconfig@7.1.0:
+    resolution: {integrity: sha512-AdmX6xUzdNASswsFtmwSt7Vj8po9IuqXm0UXz7QKPuEUmPB4XyjGfaAr2PSuELMwkRMVH1EpIkX5bTZGRB3eCA==}
+    engines: {node: '>=10'}
+
+  cosmiconfig@8.2.0:
+    resolution: {integrity: sha512-3rTMnFJA1tCOPwRxtgF4wd7Ab2qvDbL8jX+3smjIbS4HlZBagTlpERbdN7iAbWlrfxE3M8c27kTwTawQ7st+OQ==}
+    engines: {node: '>=14'}
+
+  crelt@1.0.6:
+    resolution: {integrity: sha512-VQ2MBenTq1fWZUH9DJNGti7kKv6EeAuYr3cLwxUWhIu1baTaXh4Ib5W2CqHVqib4/MqbYGJqiL3Zb8GJZr3l4g==}
+
+  cross-fetch@4.1.0:
+    resolution: {integrity: sha512-uKm5PU+MHTootlWEY+mZ4vvXoCn4fLQxT9dSc1sXVMSFkINTJVN8cAQROpwcKm8bJ/c7rgZVIBWzH5T78sNZZw==}
+
+  cross-spawn@7.0.6:
+    resolution: {integrity: sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==}
+    engines: {node: '>= 8'}
+
+  css-loader@6.8.1:
+    resolution: {integrity: sha512-xDAXtEVGlD0gJ07iclwWVkLoZOpEvAWaSyf6W18S2pOC//K8+qUDIx8IIT3D+HjnmkJPQeesOPv5aiUaJsCM2g==}
+    engines: {node: '>= 12.13.0'}
+    peerDependencies:
+      webpack: ^5.0.0
+
+  css-loader@7.1.4:
+    resolution: {integrity: sha512-vv3J9tlOl04WjiMvHQI/9tmIrCxVrj6PFbHemBB1iihpeRbi/I4h033eoFIhwxBBqLhI0KYFS7yvynBFhIZfTw==}
+    engines: {node: '>= 18.12.0'}
+    peerDependencies:
+      '@rspack/core': 0.x || ^1.0.0 || ^2.0.0-0
+      webpack: ^5.27.0
+    peerDependenciesMeta:
+      '@rspack/core':
+        optional: true
+      webpack:
+        optional: true
+
+  css-select@4.3.0:
+    resolution: {integrity: sha512-wPpOYtnsVontu2mODhA19JrqWxNsfdatRKd64kmpRbQgh1KtItko5sTnEpPdpSaJszTOhEMlF/RPz28qj4HqhQ==}
+
+  css-select@5.1.0:
+    resolution: {integrity: sha512-nwoRF1rvRRnnCqqY7updORDsuqKzqYJ28+oSMaJMMgOauh3fvwHqMS7EZpIPqK8GL+g9mKxF1vP/ZjSeNjEVHg==}
+
+  css-tree@2.2.1:
+    resolution: {integrity: sha512-OA0mILzGc1kCOCSJerOeqDxDQ4HOh+G8NbOJFOTgOCzpw7fCBubk0fEyxp8AgOL/jvLgYA/uV0cMbe43ElF1JA==}
+    engines: {node: ^10 || ^12.20.0 || ^14.13.0 || >=15.0.0, npm: '>=7.0.0'}
+
+  css-tree@2.3.1:
+    resolution: {integrity: sha512-6Fv1DV/TYw//QF5IzQdqsNDjx/wc8TrMBZsqjL9eW01tWb7R7k/mq+/VXfJCl7SoD5emsJop9cOByJZfs8hYIw==}
+    engines: {node: ^10 || ^12.20.0 || ^14.13.0 || >=15.0.0}
+
+  css-tree@3.2.1:
+    resolution: {integrity: sha512-X7sjQzceUhu1u7Y/ylrRZFU2FS6LRiFVp6rKLPg23y3x3c3DOKAwuXGDp+PAGjh6CSnCjYeAul8pcT8bAl+lSA==}
+    engines: {node: ^10 || ^12.20.0 || ^14.13.0 || >=15.0.0}
+
+  css-what@6.1.0:
+    resolution: {integrity: sha512-HTUrgRJ7r4dsZKU6GjmpfRK1O76h97Z8MfS1G0FozR+oF2kG6Vfe8JE6zwrkbxigziPHinCJ+gCPjA9EaBDtRw==}
+    engines: {node: '>= 6'}
+
+  css.escape@1.5.1:
+    resolution: {integrity: sha512-YUifsXXuknHlUsmlgyY0PKzgPOr7/FjCePfHNt0jxm83wHZi44VDMQ7/fGNkjY3/jV1MC+1CmZbaHzugyeRtpg==}
+
+  cssesc@3.0.0:
+    resolution: {integrity: sha512-/Tb/JcjK111nNScGob5MNtsntNM1aCNUDipB/TkwZFhyDrrE47SOx/18wF2bbjgc3ZzCSKW1T5nt5EbFoAz/Vg==}
+    engines: {node: '>=4'}
+    hasBin: true
+
+  cssnano-preset-default@8.0.1:
+    resolution: {integrity: sha512-OTdKeYMlvQ8KBgyej5ysktnWJoeyo7rGrVnm+bdpIHGvxhbTGPsOkB+7T1EdTuX00dGlQQb2UEbSPB1OpMXULw==}
+    engines: {node: ^22.11.0 || ^24.11.0 || >=26.0}
+    peerDependencies:
+      postcss: ^8.5.14
+
+  cssnano-utils@6.0.0:
+    resolution: {integrity: sha512-ztS9W/+uaDn+bkYmDhs+GdMveHJ3CL8IPNHpRqDUQXv5GJOTQAJjV1XUOInr9esLXSabQV1pLRZlJpyUwEqDyQ==}
+    engines: {node: ^22.11.0 || ^24.11.0 || >=26.0}
+    peerDependencies:
+      postcss: ^8.5.14
+
+  cssnano@8.0.1:
+    resolution: {integrity: sha512-oSiOnPQNNYjusTUlYJiE6xvFQG4don3N0QavaoV1BxIsC1zjvxOwikXlR7lG1EVmZNDDaJkHbQx1VRB8kaoMHA==}
+    engines: {node: ^22.11.0 || ^24.11.0 || >=26.0}
+    peerDependencies:
+      postcss: ^8.5.14
+
+  csso@5.0.5:
+    resolution: {integrity: sha512-0LrrStPOdJj+SPCCrGhzryycLjwcgUSHBtxNA8aIDxf0GLsRh1cKYhB00Gd1lDOS4yGH69+SNn13+TWbVHETFQ==}
+    engines: {node: ^10 || ^12.20.0 || ^14.13.0 || >=15.0.0, npm: '>=7.0.0'}
+
+  cssstyle@4.0.1:
+    resolution: {integrity: sha512-8ZYiJ3A/3OkDd093CBT/0UKDWry7ak4BdPTFP2+QEP7cmhouyq/Up709ASSj2cK02BbZiMgk7kYjZNS4QP5qrQ==}
+    engines: {node: '>=18'}
+
+  csstype@3.0.10:
+    resolution: {integrity: sha512-2u44ZG2OcNUO9HDp/Jl8C07x6pU/eTR3ncV91SiK3dhG9TWvRVsCoJw14Ckx5DgWkzGA3waZWO3d7pgqpUI/XA==}
+
+  damerau-levenshtein@1.0.8:
+    resolution: {integrity: sha512-sdQSFB7+llfUcQHUQO3+B8ERRj0Oa4w9POWMI/puGtuf7gFywGmkaLCElnudfTiKZV+NvHqL0ifzdrI8Ro7ESA==}
+
+  data-urls@5.0.0:
+    resolution: {integrity: sha512-ZYP5VBHshaDAiVZxjbRVcFJpc+4xGgT0bK3vzy1HLN8jTO975HEbuYzZJcHoQEY5K1a0z8YayJkyVETa08eNTg==}
+    engines: {node: '>=18'}
+
+  data-view-buffer@1.0.2:
+    resolution: {integrity: sha512-EmKO5V3OLXh1rtK2wgXRansaK1/mtVdTUEiEI0W8RkvgT05kfxaH29PliLnpLP73yYO6142Q72QNa8Wx/A5CqQ==}
+    engines: {node: '>= 0.4'}
+
+  data-view-byte-length@1.0.2:
+    resolution: {integrity: sha512-tuhGbE6CfTM9+5ANGf+oQb72Ky/0+s3xKUpHvShfiz2RxMFgFPjsXuRLBVMtvMs15awe45SRb83D6wH4ew6wlQ==}
+    engines: {node: '>= 0.4'}
+
+  data-view-byte-offset@1.0.1:
+    resolution: {integrity: sha512-BS8PfmtDGnrgYdOonGZQdLZslWIeCGFP9tpan0hi1Co2Zr2NKADsvGYA8XxuG/4UWgJ6Cjtv+YJnB6MM69QGlQ==}
+    engines: {node: '>= 0.4'}
+
+  date-fns@2.29.3:
+    resolution: {integrity: sha512-dDCnyH2WnnKusqvZZ6+jA1O51Ibt8ZMRNkDZdyAyK4YfbDwa/cEmuztzG5pk6hqlp9aSBPYcjOlktquahGwGeA==}
+    engines: {node: '>=0.11'}
+
+  debounce@1.2.1:
+    resolution: {integrity: sha512-XRRe6Glud4rd/ZGQfiV1ruXSfbvfJedlV9Y6zOlP+2K04vBYiJEte6stfFkCP03aMnY5tsipamumUjL14fofug==}
+
+  debug@2.6.9:
+    resolution: {integrity: sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==}
+    peerDependencies:
+      supports-color: '*'
+    peerDependenciesMeta:
+      supports-color:
+        optional: true
+
+  debug@3.2.7:
+    resolution: {integrity: sha512-CFjzYYAi4ThfiQvizrFQevTTXHtnCqWfe7x1AhgEscTz6ZbLbfoLRLPugTQyBth6f8ZERVUSyWHFD/7Wu4t1XQ==}
+    peerDependencies:
+      supports-color: '*'
+    peerDependenciesMeta:
+      supports-color:
+        optional: true
+
+  debug@4.4.3:
+    resolution: {integrity: sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==}
+    engines: {node: '>=6.0'}
+    peerDependencies:
+      supports-color: '*'
+    peerDependenciesMeta:
+      supports-color:
+        optional: true
+
+  decamelize@1.2.0:
+    resolution: {integrity: sha512-z2S+W9X73hAUUki+N+9Za2lBlun89zigOyGrsax+KUQ6wKW4ZoWpEYBkGhQjwAjjDCkWxhY0VKEhk8wzY7F5cA==}
+    engines: {node: '>=0.10.0'}
+
+  decimal.js@10.4.3:
+    resolution: {integrity: sha512-VBBaLc1MgL5XpzgIP7ny5Z6Nx3UrRkIViUkPUdtl9aya5amy3De1gsUUSB1g3+3sExYNjCAsAznmukyxCb1GRA==}
+
+  dedent@0.7.0:
+    resolution: {integrity: sha512-Q6fKUPqnAHAyhiUgFU7BUzLiv0kd8saH9al7tnu5Q/okj6dnupxyTgFIBjVzJATdfIAm9NAsvXNzjaKa+bxVyA==}
+
+  deep-eql@5.0.2:
+    resolution: {integrity: sha512-h5k/5U50IJJFpzfL6nO9jaaumfjO/f2NjK/oYB2Djzm4p9L+3T9qWpZqZ2hAbLPuuYq9wrU08WQyBTL5GbPk5Q==}
+    engines: {node: '>=6'}
+
+  deep-equal@2.2.1:
+    resolution: {integrity: sha512-lKdkdV6EOGoVn65XaOsPdH4rMxTZOnmFyuIkMjM1i5HHCbfjC97dawgTAy0deYNfuqUqW+Q5VrVaQYtUpSd6yQ==}
+
+  deep-is@0.1.4:
+    resolution: {integrity: sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==}
+
+  deepmerge@2.2.1:
+    resolution: {integrity: sha512-R9hc1Xa/NOBi9WRVUWg19rl1UB7Tt4kuPd+thNJgFZoxXsTz7ncaPaeIm+40oSGuP33DfMb4sZt1QIGiJzC4EA==}
+    engines: {node: '>=0.10.0'}
+
+  deepmerge@4.3.1:
+    resolution: {integrity: sha512-3sUqbMEc77XqpdNO7FRyRog+eW3ph+GYCbj+rK+uYyRMuwsVy0rMiVtPn+QJlKFvWP/1PYpapqYn0Me2knFn+A==}
+    engines: {node: '>=0.10.0'}
+
+  default-browser-id@5.0.1:
+    resolution: {integrity: sha512-x1VCxdX4t+8wVfd1so/9w+vQ4vx7lKd2Qp5tDRutErwmR85OgmfX7RlLRMWafRMY7hbEiXIbudNrjOAPa/hL8Q==}
+    engines: {node: '>=18'}
+
+  default-browser@5.5.0:
+    resolution: {integrity: sha512-H9LMLr5zwIbSxrmvikGuI/5KGhZ8E2zH3stkMgM5LpOWDutGM2JZaj460Udnf1a+946zc7YBgrqEWwbk7zHvGw==}
+    engines: {node: '>=18'}
+
+  define-data-property@1.1.4:
+    resolution: {integrity: sha512-rBMvIzlpA8v6E+SJZoo++HAYqsLrkg7MSfIinMPFhmkorw7X+dOXVJQs+QT69zGkzMyfDnIMN2Wid1+NbL3T+A==}
+    engines: {node: '>= 0.4'}
+
+  define-lazy-prop@3.0.0:
+    resolution: {integrity: sha512-N+MeXYoqr3pOgn8xfyRPREN7gHakLYjhsHhWGT3fWAiL4IkAt0iDw14QiiEm2bE30c5XX5q0FtAA3CK5f9/BUg==}
+    engines: {node: '>=12'}
+
+  define-properties@1.2.1:
+    resolution: {integrity: sha512-8QmQKqEASLd5nx0U1B1okLElbUuuttJ/AnYmRXbbbGDWh6uS208EjD4Xqq/I9wK7u0v6O08XhTWnt5XtEbR6Dg==}
+    engines: {node: '>= 0.4'}
+
+  defu@6.1.7:
+    resolution: {integrity: sha512-7z22QmUWiQ/2d0KkdYmANbRUVABpZ9SNYyH5vx6PZ+nE5bcC0l7uFvEfHlyld/HcGBFTL536ClDt3DEcSlEJAQ==}
+
+  del@4.1.1:
+    resolution: {integrity: sha512-QwGuEUouP2kVwQenAsOof5Fv8K9t3D8Ca8NxcXKrIpEHjTXK5J2nXLdP+ALI1cgv8wj7KuwBhTwBkOZSJKM5XQ==}
+    engines: {node: '>=6'}
+
+  delayed-stream@1.0.0:
+    resolution: {integrity: sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==}
+    engines: {node: '>=0.4.0'}
+
+  depd@1.1.2:
+    resolution: {integrity: sha512-7emPTl6Dpo6JRXOXjLRxck+FlLRX5847cLKEn00PLAgc3g2hTZZgr+e4c2v6QpSmLeFP3n5yUo7ft6avBK/5jQ==}
+    engines: {node: '>= 0.6'}
+
+  depd@2.0.0:
+    resolution: {integrity: sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==}
+    engines: {node: '>= 0.8'}
+
+  dequal@2.0.3:
+    resolution: {integrity: sha512-0je+qPKHEMohvfRTCEo3CrPG6cAzAYgmzKyxRiYSSDkS6eGJdyVJm7WaYA5ECaAD9wLB2T4EEeymA5aFVcYXCA==}
+    engines: {node: '>=6'}
+
+  destr@2.0.5:
+    resolution: {integrity: sha512-ugFTXCtDZunbzasqBxrK93Ik/DRYsO6S/fedkWEMKqt04xZ4csmnmwGDBAb07QWNaGMAmnTIemsYZCksjATwsA==}
+
+  destroy@1.2.0:
+    resolution: {integrity: sha512-2sJGJTaXIIaR1w4iJSNoN0hnMY7Gpc/n8D4qSCJw8QqFWXf7cuAgnEHxBpweaVcPevC2l3KpjYCx3NypQQgaJg==}
+    engines: {node: '>= 0.8', npm: 1.2.8000 || >= 1.4.16}
+
+  detect-element-overflow@1.4.2:
+    resolution: {integrity: sha512-4m6cVOtvm/GJLjo7WFkPfwXoEIIbM7GQwIh4WEa4g7IsNi1YzwUsGL5ApNLrrHL29bHeNeQ+/iZhw+YHqgE2Fw==}
+
+  detect-libc@2.1.2:
+    resolution: {integrity: sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==}
+    engines: {node: '>=8'}
+
+  detect-node-es@1.1.0:
+    resolution: {integrity: sha512-ypdmJU/TbBby2Dxibuv7ZLW3Bs1QEmM7nHjEANfohJLvE0XVujisn1qPJcZxg+qDucsr+bP6fLD1rPS3AhJ7EQ==}
+
+  detect-node@2.1.0:
+    resolution: {integrity: sha512-T0NIuQpnTvFDATNuHN5roPwSBG83rFsuO+MXXH9/3N1eFbn4wcPjttvjMLEPWJ0RGUYgQE7cGgS3tNxbqCGM7g==}
+
+  devlop@1.1.0:
+    resolution: {integrity: sha512-RWmIqhcFf1lRYBvNmr7qTNuyCt/7/ns2jbpp1+PalgE/rDQcBT0fioSMUpJ93irlUhC5hrg4cYqe6U+0ImW0rA==}
+
+  didyoumean@1.2.2:
+    resolution: {integrity: sha512-gxtyfqMg7GKyhQmb056K7M3xszy/myH8w+B4RT+QXBQsvAOdc3XymqDDPHx1BgPgsdAA5SIifona89YtRATDzw==}
+
+  dir-glob@3.0.1:
+    resolution: {integrity: sha512-WkrWp9GR4KXfKGYzOLmTuGVi1UWFfws377n9cc55/tb6DuqyF6pcQ5AbiHEshaDpY9v6oaSr2XCDidGmMwdzIA==}
+    engines: {node: '>=8'}
+
+  discontinuous-range@1.0.0:
+    resolution: {integrity: sha512-c68LpLbO+7kP/b1Hr1qs8/BJ09F5khZGTxqxZuhzxpmwJKOgRFHJWIb9/KmqnqHhLdO55aOxFH/EGBvUQbL/RQ==}
+
+  dlv@1.1.3:
+    resolution: {integrity: sha512-+HlytyjlPKnIG8XuRG8WvmBP8xs8P71y+SKKS6ZXWoEgLuePxtDoUEiH7WkdePWrQ5JBpE6aoVqfZfJUQkjXwA==}
+
+  dns-packet@5.6.0:
+    resolution: {integrity: sha512-rza3UH1LwdHh9qyPXp8lkwpjSNk/AMD3dPytUoRoqnypDUhY0xvbdmVhWOfxO68frEfV9BU8V12Ez7ZsHGZpCQ==}
+    engines: {node: '>=6'}
+
+  docker-types@1.47.4:
+    resolution: {integrity: sha512-8Lun/diKdFX8IGzTB+Uy9561Chh/4BKgMhzblehteTlJnqNFMNYSq4Y5t8rxoSOL+E2i3r8joYLJqvpDhzl8CQ==}
+
+  doctrine@2.1.0:
+    resolution: {integrity: sha512-35mSku4ZXK0vfCuHEDAwt55dg2jNajHZ1odvF+8SSr82EsZY4QmXfuWso8oEd8zRhVObSN18aM0CjSdoBX7zIw==}
+    engines: {node: '>=0.10.0'}
+
+  doctrine@3.0.0:
+    resolution: {integrity: sha512-yS+Q5i3hBf7GBkd4KG8a7eBNNWNGLTaEwwYWUijIYM7zrlYDM0BFXHjjPWlWZ1Rg7UaddZeIDmi9jF3HmqiQ2w==}
+    engines: {node: '>=6.0.0'}
+
+  dom-accessibility-api@0.5.10:
+    resolution: {integrity: sha512-Xu9mD0UjrJisTmv7lmVSDMagQcU9R5hwAbxsaAE/35XPnPLJobbuREfV/rraiSaEj/UOvgrzQs66zyTWTlyd+g==}
+
+  dom-accessibility-api@0.6.3:
+    resolution: {integrity: sha512-7ZgogeTnjuHbo+ct10G9Ffp0mif17idi0IyWNVA/wcwcm7NPOD/WEHVP3n7n3MhXqxoIYm8d6MuZohYWIZ4T3w==}
+
+  dom-converter@0.2.0:
+    resolution: {integrity: sha512-gd3ypIPfOMr9h5jIKq8E3sHOTCjeirnl0WK5ZdS1AW0Odt0b1PaWaHdJ4Qk4klv+YB9aJBS7mESXjFoDQPu6DA==}
+
+  dom-helpers@5.2.1:
+    resolution: {integrity: sha512-nRCa7CK3VTrM2NmGkIy4cbK7IZlgBE/PYMn55rrXefr5xXDP0LdtfPnblFDoVdcAfslJ7or6iqAUnx0CCGIWQA==}
+
+  dom-serializer@1.4.1:
+    resolution: {integrity: sha512-VHwB3KfrcOOkelEG2ZOfxqLZdfkil8PtJi4P8N2MMXucZq2yLp75ClViUlOVwyoHEDjYU433Aq+5zWP61+RGag==}
+
+  dom-serializer@2.0.0:
+    resolution: {integrity: sha512-wIkAryiqt/nV5EQKqQpo3SToSOV9J0DnbJqwK7Wv/Trc92zIAYZ4FlMu+JPFW1DfGFt81ZTCGgDEabffXeLyJg==}
+
+  domelementtype@2.3.0:
+    resolution: {integrity: sha512-OLETBj6w0OsagBwdXnPdN0cnMfF9opN69co+7ZrbfPGrdpPVNBUj02spi6B1N7wChLQiPn4CSH/zJvXw56gmHw==}
+
+  domhandler@4.3.1:
+    resolution: {integrity: sha512-GrwoxYN+uWlzO8uhUXRl0P+kHE4GtVPfYzVLcUxPL7KNdHKj66vvlhiweIHqYYXWlw+T8iLMp42Lm67ghw4WMQ==}
+    engines: {node: '>= 4'}
+
+  domhandler@5.0.3:
+    resolution: {integrity: sha512-cgwlv/1iFQiFnU96XXgROh8xTeetsnJiDsTc7TYCLFd9+/WNkIqPTxiM/8pSd8VIrhXGTf1Ny1q1hquVqDJB5w==}
+    engines: {node: '>= 4'}
+
+  domutils@2.8.0:
+    resolution: {integrity: sha512-w96Cjofp72M5IIhpjgobBimYEfoPjx1Vx0BSX9P30WBdZW2WIKU0T1Bd0kz2eNZ9ikjKgHbEyKx8BB6H1L3h3A==}
+
+  domutils@3.1.0:
+    resolution: {integrity: sha512-H78uMmQtI2AhgDJjWeQmHwJJ2bLPD3GMmO7Zja/ZZh84wkm+4ut+IUnUdRa8uCGX88DiVx1j6FRe1XfxEgjEZA==}
+
+  dot-case@3.0.4:
+    resolution: {integrity: sha512-Kv5nKlh6yRrdrGvxeJ2e5y2eRUpkUosIW4A2AS38zwSz27zu7ufDwQPi5Jhs3XAlGNetl3bmnGhQsMtkKJnj3w==}
+
+  dotenv-defaults@2.0.2:
+    resolution: {integrity: sha512-iOIzovWfsUHU91L5i8bJce3NYK5JXeAwH50Jh6+ARUdLiiGlYWfGw6UkzsYqaXZH/hjE/eCd/PlfM/qqyK0AMg==}
+
+  dotenv-webpack@8.0.1:
+    resolution: {integrity: sha512-CdrgfhZOnx4uB18SgaoP9XHRN2v48BbjuXQsZY5ixs5A8579NxQkmMxRtI7aTwSiSQcM2ao12Fdu+L3ZS3bG4w==}
+    engines: {node: '>=10'}
+    peerDependencies:
+      webpack: ^4 || ^5
+
+  dotenv@17.4.2:
+    resolution: {integrity: sha512-nI4U3TottKAcAD9LLud4Cb7b2QztQMUEfHbvhTH09bqXTxnSie8WnjPALV/WMCrJZ6UV/qHJ6L03OqO3LcdYZw==}
+    engines: {node: '>=12'}
+
+  dotenv@8.6.0:
+    resolution: {integrity: sha512-IrPdXQsk2BbzvCBGBOTmmSH5SodmqZNt4ERAZDmW4CT+tL8VtvinqywuANaFu4bOMWki16nqf0e4oC0QIaDr/g==}
+    engines: {node: '>=10'}
+
+  dunder-proto@1.0.1:
+    resolution: {integrity: sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==}
+    engines: {node: '>= 0.4'}
+
+  ebnf@1.9.1:
+    resolution: {integrity: sha512-uW2UKSsuty9ANJ3YByIQE4ANkD8nqUPO7r6Fwcc1ADKPe9FRdcPpMl3VEput4JSvKBJ4J86npIC2MLP0pYkCuw==}
+    hasBin: true
+
+  ee-first@1.1.1:
+    resolution: {integrity: sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==}
+
+  electron-to-chromium@1.5.364:
+    resolution: {integrity: sha512-G/dYE3+AYhyHwzTwg8UbnXf7zqMERYh7l2jJ3QujhFsH8agSYwtnGAR2aZ7f0AakIKJXd5En/Hre4igIUrdlYw==}
+
+  emoji-regex-xs@1.0.0:
+    resolution: {integrity: sha512-LRlerrMYoIDrT6jgpeZ2YYl/L8EulRTt5hQcYjy5AInh7HWXKimpqx68aknBFpGL2+/IcogTcaydJEgaTmOpDg==}
+
+  emoji-regex@10.6.0:
+    resolution: {integrity: sha512-toUI84YS5YmxW219erniWD0CIVOo46xGKColeNQRgOzDorgBi1v4D71/OFzgD9GO2UGKIv1C3Sp8DAn0+j5w7A==}
+
+  emoji-regex@8.0.0:
+    resolution: {integrity: sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==}
+
+  emoji-regex@9.2.2:
+    resolution: {integrity: sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg==}
+
+  emojis-list@3.0.0:
+    resolution: {integrity: sha512-/kyM18EfinwXZbno9FyUGeFh87KC8HRQBQGildHZbEuRyWFOmv1U10o9BBp8XVZDVNNuQKyIGIu5ZYAAXJ0V2Q==}
+    engines: {node: '>= 4'}
+
+  encodeurl@2.0.0:
+    resolution: {integrity: sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==}
+    engines: {node: '>= 0.8'}
+
+  endent@2.1.0:
+    resolution: {integrity: sha512-r8VyPX7XL8U01Xgnb1CjZ3XV+z90cXIJ9JPE/R9SEC9vpw2P6CfsRPJmp20DppC5N7ZAMCmjYkJIa744Iyg96w==}
+
+  enhanced-resolve@5.22.1:
+    resolution: {integrity: sha512-6QEuw3zoX1SJQc7b87aBXke/no+mG2bTBgw29gWMQonLmpEkWoCAVkl+M49e48AZlWzxiDzDZzYdp6kobcyLww==}
+    engines: {node: '>=10.13.0'}
+
+  entities@2.1.0:
+    resolution: {integrity: sha512-hCx1oky9PFrJ611mf0ifBLBRW8lUUVRlFolb5gWRfIELabBlbp9xZvrqZLZAs+NxFnbfQoeGd8wDkygjg7U85w==}
+
+  entities@2.2.0:
+    resolution: {integrity: sha512-p92if5Nz619I0w+akJrLZH0MX0Pb5DX39XOwQTtXSdQQOaYH03S1uIQp4mhOZtAXrxq4ViO67YTiLBo2638o9A==}
+
+  entities@4.5.0:
+    resolution: {integrity: sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw==}
+    engines: {node: '>=0.12'}
+
+  envinfo@7.21.0:
+    resolution: {integrity: sha512-Lw7I8Zp5YKHFCXL7+Dz95g4CcbMEpgvqZNNq3AmlT5XAV6CgAAk6gyAMqn2zjw08K9BHfcNuKrMiCPLByGafow==}
+    engines: {node: '>=4'}
+    hasBin: true
+
+  environment@1.1.0:
+    resolution: {integrity: sha512-xUtoPkMggbz0MPyPiIWr1Kp4aeWJjDZ6SMvURhimjdZgsRuDplF5/s9hcgGhyXMhs+6vpnuoiZ2kFiu3FMnS8Q==}
+    engines: {node: '>=18'}
+
+  errno@0.1.8:
+    resolution: {integrity: sha512-dJ6oBr5SQ1VSd9qkk7ByRgb/1SH4JZjCHSW/mr63/QcXO9zLVxvJ6Oy13nio03rxpSnVDDjFor75SjVeZWPW/A==}
+    hasBin: true
+
+  error-ex@1.3.2:
+    resolution: {integrity: sha512-7dFHNmqeFSEt2ZBsCriorKnn3Z2pj+fd9kmI6QoWw4//DL+icEBfc0U7qJCisqrTsKTjw4fNFy2pW9OqStD84g==}
+
+  es-abstract@1.24.2:
+    resolution: {integrity: sha512-2FpH9Q5i2RRwyEP1AylXe6nYLR5OhaJTZwmlcP0dL/+JCbgg7yyEo/sEK6HeGZRf3dFpWwThaRHVApXSkW3xeg==}
+    engines: {node: '>= 0.4'}
+
+  es-define-property@1.0.1:
+    resolution: {integrity: sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==}
+    engines: {node: '>= 0.4'}
+
+  es-errors@1.3.0:
+    resolution: {integrity: sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==}
+    engines: {node: '>= 0.4'}
+
+  es-get-iterator@1.1.3:
+    resolution: {integrity: sha512-sPZmqHBe6JIiTfN5q2pEi//TwxmAFHwj/XEuYjTuse78i8KxaqMTTzxPoFKuzRpDpTJ+0NAbpfenkmH2rePtuw==}
+
+  es-iterator-helpers@1.3.3:
+    resolution: {integrity: sha512-0PuBxFi+4uPanB97iDxCLWuHeYud2FALrw5HFZGtAF38UpJDbDC8frwp2cnDyae692CQ0dou60UwWfhgsa4U/g==}
+    engines: {node: '>= 0.4'}
+
+  es-module-lexer@1.7.0:
+    resolution: {integrity: sha512-jEQoCwk8hyb2AZziIOLhDqpm5+2ww5uIE6lkO/6jcOCusfk6LhMHpXXfBLXTZ7Ydyt0j4VoUQv6uGNYbdW+kBA==}
+
+  es-module-lexer@2.1.0:
+    resolution: {integrity: sha512-n27zTYMjYu1aj4MjCWzSP7G9r75utsaoc8m61weK+W8JMBGGQybd43GstCXZ3WNmSFtGT9wi59qQTW6mhTR5LQ==}
+
+  es-object-atoms@1.1.1:
+    resolution: {integrity: sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==}
+    engines: {node: '>= 0.4'}
+
+  es-set-tostringtag@2.1.0:
+    resolution: {integrity: sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA==}
+    engines: {node: '>= 0.4'}
+
+  es-shim-unscopables@1.1.0:
+    resolution: {integrity: sha512-d9T8ucsEhh8Bi1woXCf+TIKDIROLG5WCkxg8geBCbvk22kzwC5G2OnXVMO6FUsvQlgUUXQ2itephWDLqDzbeCw==}
+    engines: {node: '>= 0.4'}
+
+  es-to-primitive@1.3.0:
+    resolution: {integrity: sha512-w+5mJ3GuFL+NjVtJlvydShqE1eN3h3PbI7/5LAsYJP/2qtuMXjfL2LpHSRqo4b4eSF5K/DH1JXKUAHSB2UW50g==}
+    engines: {node: '>= 0.4'}
+
+  es6-promise@3.3.1:
+    resolution: {integrity: sha512-SOp9Phqvqn7jtEUxPWdWfWoLmyt2VaJ6MpvP9Comy1MceMXqE6bxvaTu4iaxpYYPzhny28Lc+M87/c2cPK6lDg==}
+
+  esbuild@0.27.3:
+    resolution: {integrity: sha512-8VwMnyGCONIs6cWue2IdpHxHnAjzxnw2Zr7MkVxB2vjmQ2ivqGFb4LEG3SMnv0Gb2F/G/2yA8zUaiL1gywDCCg==}
+    engines: {node: '>=18'}
+    hasBin: true
+
+  escalade@3.2.0:
+    resolution: {integrity: sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA==}
+    engines: {node: '>=6'}
+
+  escape-html@1.0.3:
+    resolution: {integrity: sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==}
+
+  escape-string-regexp@1.0.5:
+    resolution: {integrity: sha512-vbRorB5FUQWvla16U8R/qgaFIya2qGzwDrNmCZuYKrbdSUMG6I1ZCGQRefkRVhuOkIGVne7BQ35DSfo1qvJqFg==}
+    engines: {node: '>=0.8.0'}
+
+  escape-string-regexp@4.0.0:
+    resolution: {integrity: sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==}
+    engines: {node: '>=10'}
+
+  eslint-config-prettier@10.1.8:
+    resolution: {integrity: sha512-82GZUjRS0p/jganf6q1rEO25VSoHH0hKPCTrgillPjdI/3bgBhAE1QzHrHTizjpRvy6pGAvKjDJtk2pF9NDq8w==}
+    hasBin: true
+    peerDependencies:
+      eslint: '>=7.0.0'
+
+  eslint-import-context@0.1.9:
+    resolution: {integrity: sha512-K9Hb+yRaGAGUbwjhFNHvSmmkZs9+zbuoe3kFQ4V1wYjrepUFYM2dZAfNtjbbj3qsPfUfsA68Bx/ICWQMi+C8Eg==}
+    engines: {node: ^12.20.0 || ^14.18.0 || >=16.0.0}
+    peerDependencies:
+      unrs-resolver: ^1.0.0
+    peerDependenciesMeta:
+      unrs-resolver:
+        optional: true
+
+  eslint-import-resolver-alias@1.1.2:
+    resolution: {integrity: sha512-WdviM1Eu834zsfjHtcGHtGfcu+F30Od3V7I9Fi57uhBEwPkjDcii7/yW8jAT+gOhn4P/vOxxNAXbFAKsrrc15w==}
+    engines: {node: '>= 4'}
+    peerDependencies:
+      eslint-plugin-import: '>=1.4.0'
+
+  eslint-import-resolver-node@0.3.10:
+    resolution: {integrity: sha512-tRrKqFyCaKict5hOd244sL6EQFNycnMQnBe+j8uqGNXYzsImGbGUU4ibtoaBmv5FLwJwcFJNeg1GeVjQfbMrDQ==}
+
+  eslint-import-resolver-typescript@4.4.5:
+    resolution: {integrity: sha512-nbE5XLph6TLtGYcu/U6e6ZVXyKBhbDWK5cLGk76eJ7NdZpwf1P9EFkpt1Z01mNZNrrilsAYWKH6zUkL4reoXbw==}
+    engines: {node: ^16.17.0 || >=18.6.0}
+    peerDependencies:
+      eslint: '*'
+      eslint-plugin-import: '*'
+      eslint-plugin-import-x: '*'
+    peerDependenciesMeta:
+      eslint-plugin-import:
+        optional: true
+      eslint-plugin-import-x:
+        optional: true
+
+  eslint-module-utils@2.12.1:
+    resolution: {integrity: sha512-L8jSWTze7K2mTg0vos/RuLRS5soomksDPoJLXIslC7c8Wmut3bx7CPpJijDcBZtxQ5lrbUdM+s0OlNbz0DCDNw==}
+    engines: {node: '>=4'}
+    peerDependencies:
+      '@typescript-eslint/parser': '*'
+      eslint: '*'
+      eslint-import-resolver-node: '*'
+      eslint-import-resolver-typescript: '*'
+      eslint-import-resolver-webpack: '*'
+    peerDependenciesMeta:
+      '@typescript-eslint/parser':
+        optional: true
+      eslint:
+        optional: true
+      eslint-import-resolver-node:
+        optional: true
+      eslint-import-resolver-typescript:
+        optional: true
+      eslint-import-resolver-webpack:
+        optional: true
+
+  eslint-plugin-eslint-comments@3.2.0:
+    resolution: {integrity: sha512-0jkOl0hfojIHHmEHgmNdqv4fmh7300NdpA9FFpF7zaoLvB/QeXOGNLIo86oAveJFrfB1p05kC8hpEMHM8DwWVQ==}
+    engines: {node: '>=6.5.0'}
+    peerDependencies:
+      eslint: '>=4.19.1'
+
+  eslint-plugin-import@2.32.0:
+    resolution: {integrity: sha512-whOE1HFo/qJDyX4SnXzP4N6zOWn79WhnCUY/iDR0mPfQZO8wcYE4JClzI2oZrhBnnMUCBCHZhO6VQyoBU95mZA==}
+    engines: {node: '>=4'}
+    peerDependencies:
+      '@typescript-eslint/parser': '*'
+      eslint: ^2 || ^3 || ^4 || ^5 || ^6 || ^7.2.0 || ^8 || ^9
+    peerDependenciesMeta:
+      '@typescript-eslint/parser':
+        optional: true
+
+  eslint-plugin-jsx-a11y@6.10.2:
+    resolution: {integrity: sha512-scB3nz4WmG75pV8+3eRUQOHZlNSUhFNq37xnpgRkCCELU3XMvXAxLk1eqWWyE22Ki4Q01Fnsw9BA3cJHDPgn2Q==}
+    engines: {node: '>=4.0'}
+    peerDependencies:
+      eslint: ^3 || ^4 || ^5 || ^6 || ^7 || ^8 || ^9
+
+  eslint-plugin-promise@7.3.0:
+    resolution: {integrity: sha512-6uGiOR0INuujr6PEQmeSSP7GbIMJ/ebEXXiEzb/nOj68LknH5Pxzb/AbZivmr6VE6TkTE8rTjRK9zhKpK6HsRA==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      eslint: ^7.0.0 || ^8.0.0 || ^9.0.0 || ^10.0.0
+
+  eslint-plugin-react-hooks@7.1.1:
+    resolution: {integrity: sha512-f2I7Gw6JbvCexzIInuSbZpfdQ44D7iqdWX01FKLvrPgqxoE7oMj8clOfto8U6vYiz4yd5oKu39rRSVOe1zRu0g==}
+    engines: {node: '>=18'}
+    peerDependencies:
+      eslint: ^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0-0 || ^9.0.0 || ^10.0.0
+
+  eslint-plugin-react@7.37.5:
+    resolution: {integrity: sha512-Qteup0SqU15kdocexFNAJMvCJEfa2xUKNV4CC1xsVMrIIqEy3SQ/rqyxCWNzfrd3/ldy6HMlD2e0JDVpDg2qIA==}
+    engines: {node: '>=4'}
+    peerDependencies:
+      eslint: ^3 || ^4 || ^5 || ^6 || ^7 || ^8 || ^9.7
+
+  eslint-plugin-regex@1.10.0:
+    resolution: {integrity: sha512-C8/qYKkkbIb0epxKzaz4aw7oVAOmm19fJpR/moUrUToq/vc4xW4sEKMlTQqH6EtNGpvLjYsbbZRlWNWwQGeTSA==}
+    engines: {node: '>=6.0.0'}
+    peerDependencies:
+      eslint: '>=4.0.0'
+
+  eslint-plugin-storybook@10.4.6:
+    resolution: {integrity: sha512-CfGSXn6zFspeYTU8R7v797MOmJFj8xc6MWf/oGuRwbKeMoSwnliR+OlXSjMZYM1D6gfmwiuH1VX58LSHdn+ZPg==}
+    peerDependencies:
+      eslint: '>=8'
+      storybook: ^10.4.6
+
+  eslint-scope@5.1.1:
+    resolution: {integrity: sha512-2NxwbF/hZ0KpepYN0cNbo+FN6XoK7GaHlQhgx/hIZl6Va0bF45RQOOwhLIy8lQDbuCiadSLCBnH2CFYquit5bw==}
+    engines: {node: '>=8.0.0'}
+
+  eslint-scope@8.4.0:
+    resolution: {integrity: sha512-sNXOfKCn74rt8RICKMvJS7XKV/Xk9kA7DyJr8mJik3S7Cwgy3qlkkmyS2uQB3jiJg6VNdZd/pDBJu0nvG2NlTg==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  eslint-visitor-keys@3.4.3:
+    resolution: {integrity: sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag==}
+    engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
+
+  eslint-visitor-keys@4.2.1:
+    resolution: {integrity: sha512-Uhdk5sfqcee/9H/rCOJikYz67o0a2Tw2hGRPOG2Y1R2dg7brRe1uG0yaNQDHu+TO/uQPF/5eCapvYSmHUjt7JQ==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  eslint-visitor-keys@5.0.1:
+    resolution: {integrity: sha512-tD40eHxA35h0PEIZNeIjkHoDR4YjjJp34biM0mDvplBe//mB+IHCqHDGV7pxF+7MklTvighcCPPZC7ynWyjdTA==}
+    engines: {node: ^20.19.0 || ^22.13.0 || >=24}
+
+  eslint@9.39.4:
+    resolution: {integrity: sha512-XoMjdBOwe/esVgEvLmNsD3IRHkm7fbKIUGvrleloJXUZgDHig2IPWNniv+GwjyJXzuNqVjlr5+4yVUZjycJwfQ==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    hasBin: true
+    peerDependencies:
+      jiti: '*'
+    peerDependenciesMeta:
+      jiti:
+        optional: true
+
+  espree@10.4.0:
+    resolution: {integrity: sha512-j6PAQ2uUr79PZhBjP5C5fhl8e39FmRnOjsD5lGnWrFU8i2G776tBK7+nP8KuQUTTyAZUwfQqXAgrVH5MbH9CYQ==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  esprima@4.0.1:
+    resolution: {integrity: sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==}
+    engines: {node: '>=4'}
+    hasBin: true
+
+  esquery@1.7.0:
+    resolution: {integrity: sha512-Ap6G0WQwcU/LHsvLwON1fAQX9Zp0A2Y6Y/cJBl9r/JbW90Zyg4/zbG6zzKa2OTALELarYHmKu0GhpM5EO+7T0g==}
+    engines: {node: '>=0.10'}
+
+  esrecurse@4.3.0:
+    resolution: {integrity: sha512-KmfKL3b6G+RXvP8N1vr3Tq1kL/oCFgn2NYXEtqP8/L3pKapUA4G8cFVaoF3SU323CD4XypR/ffioHmkti6/Tag==}
+    engines: {node: '>=4.0'}
+
+  estraverse@4.3.0:
+    resolution: {integrity: sha512-39nnKffWz8xN1BU/2c79n9nB9HDzo0niYUqx6xyqUnyoAnQyyWpOTdZEeiCch8BBu515t4wp9ZmgVfVhn9EBpw==}
+    engines: {node: '>=4.0'}
+
+  estraverse@5.3.0:
+    resolution: {integrity: sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==}
+    engines: {node: '>=4.0'}
+
+  estree-walker@2.0.2:
+    resolution: {integrity: sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w==}
+
+  estree-walker@3.0.3:
+    resolution: {integrity: sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==}
+
+  esutils@2.0.3:
+    resolution: {integrity: sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==}
+    engines: {node: '>=0.10.0'}
+
+  etag@1.8.1:
+    resolution: {integrity: sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==}
+    engines: {node: '>= 0.6'}
+
+  eventemitter3@4.0.7:
+    resolution: {integrity: sha512-8guHBZCwKnFhYdHr2ysuRWErTwhoN2X8XELRlrRwpmfeY2jjuUN4taQMsULKUVo1K4DvZl+0pgfyoysHxvmvEw==}
+
+  eventemitter3@5.0.4:
+    resolution: {integrity: sha512-mlsTRyGaPBjPedk6Bvw+aqbsXDtoAyAzm5MO7JgU+yVRyMQ5O8bD4Kcci7BS85f93veegeCPkL8R4GLClnjLFw==}
+
+  events@3.3.0:
+    resolution: {integrity: sha512-mQw+2fkQbALzQ7V0MY0IqdnXNOeTtP4r0lN9z7AAawCXgqea7bDii20AYrIBrFd/Hx0M2Ocz6S111CaFkUcb0Q==}
+    engines: {node: '>=0.8.x'}
+
+  expect-type@1.3.0:
+    resolution: {integrity: sha512-knvyeauYhqjOYvQ66MznSMs83wmHrCycNEN6Ao+2AeYEfxUIkuiVxdEa1qlGEPK+We3n0THiDciYSsCcgW/DoA==}
+    engines: {node: '>=12.0.0'}
+
+  express@4.22.1:
+    resolution: {integrity: sha512-F2X8g9P1X7uCPZMA3MVf9wcTqlyNp7IhH5qPCI0izhaOIYXaW9L535tGA3qmjRzpH+bZczqq7hVKxTR4NWnu+g==}
+    engines: {node: '>= 0.10.0'}
+
+  exsolve@1.0.8:
+    resolution: {integrity: sha512-LmDxfWXwcTArk8fUEnOfSZpHOJ6zOMUJKOtFLFqJLoKJetuQG874Uc7/Kki7zFLzYybmZhp1M7+98pfMqeX8yA==}
+
+  fast-copy@3.0.2:
+    resolution: {integrity: sha512-dl0O9Vhju8IrcLndv2eU4ldt1ftXMqqfgN4H1cpmGV7P6jeB9FwpN9a2c8DPGE1Ys88rNUJVYDHq73CGAGOPfQ==}
+
+  fast-deep-equal@3.1.3:
+    resolution: {integrity: sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==}
+
+  fast-defer@1.1.9:
+    resolution: {integrity: sha512-JP7Xm9HuePSeTT1DI78NeE9eAQvgNb9qNP2jlyQrcx4jiWM189omV6oyd0xaUPWHPlKmvDzz6H1FfPWIDU+xfg==}
+
+  fast-glob@3.3.2:
+    resolution: {integrity: sha512-oX2ruAFQwf/Orj8m737Y5adxDQO0LAB7/S5MnxCdTNDd4p6BsyIVsv9JQsATbTSq8KHRpLwIHbVlUNatxd+1Ow==}
+    engines: {node: '>=8.6.0'}
+
+  fast-json-parse@1.0.3:
+    resolution: {integrity: sha512-FRWsaZRWEJ1ESVNbDWmsAlqDk96gPQezzLghafp5J4GUKjbCz3OkAHuZs5TuPEtkbVQERysLp9xv6c24fBm8Aw==}
+
+  fast-json-patch@3.1.1:
+    resolution: {integrity: sha512-vf6IHUX2SBcA+5/+4883dsIjpBTqmfBjmYiWK1savxQmFk4JfBMLa7ynTYOs1Rolp/T1betJxHiGD3g1Mn8lUQ==}
+
+  fast-json-stable-stringify@2.1.0:
+    resolution: {integrity: sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==}
+
+  fast-levenshtein@2.0.6:
+    resolution: {integrity: sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==}
+
+  fast-safe-stringify@2.1.1:
+    resolution: {integrity: sha512-W+KJc2dmILlPplD/H4K9l9LcAHAfPtP6BY84uVLXQ6Evcz9Lcg33Y2z1IVblT6xdY54PXYVHEv+0Wpq8Io6zkA==}
+
+  fast-string-truncated-width@3.0.3:
+    resolution: {integrity: sha512-0jjjIEL6+0jag3l2XWWizO64/aZVtpiGE3t0Zgqxv0DPuxiMjvB3M24fCyhZUO4KomJQPj3LTSUnDP3GpdwC0g==}
+
+  fast-string-width@3.0.2:
+    resolution: {integrity: sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg==}
+
+  fast-uri@3.1.0:
+    resolution: {integrity: sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA==}
+
+  fast-wrap-ansi@0.2.2:
+    resolution: {integrity: sha512-7F2Fl+TjRSenLqlU3UjSH0iyqopqoZIu7eZVpEirP2g1GtWa2G/ecEmBdgz31+Mxr+ELclgg6sokpSFIQiZ02Q==}
+
+  fastest-levenshtein@1.0.12:
+    resolution: {integrity: sha512-On2N+BpYJ15xIC974QNVuYGMOlEVt4s0EOI3wwMqOmK1fdDY+FN/zltPV8vosq4ad4c/gJ1KHScUn/6AWIgiow==}
+
+  fastq@1.15.0:
+    resolution: {integrity: sha512-wBrocU2LCXXa+lWBt8RoIRD89Fi8OdABODa/kEnyeyjS5aZO5/GNvI5sEINADqP/h8M29UHTHUb53sUu5Ihqdw==}
+
+  faye-websocket@0.11.4:
+    resolution: {integrity: sha512-CzbClwlXAuiRQAlUyfqPgvPoNKTckTPGfwZV4ZdAhVcP2lh9KUxJg2b5GkE7XbjKQ3YJnQ9z6D9ntLAlB+tP8g==}
+    engines: {node: '>=0.8.0'}
+
+  fdir@6.5.0:
+    resolution: {integrity: sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==}
+    engines: {node: '>=12.0.0'}
+    peerDependencies:
+      picomatch: ^3 || ^4
+    peerDependenciesMeta:
+      picomatch:
+        optional: true
+
+  file-entry-cache@8.0.0:
+    resolution: {integrity: sha512-XXTUwCvisa5oacNGRP9SfNtYBNAMi+RPwBFmblZEF7N7swHYQS6/Zfk7SRwx4D5j3CH211YNRco1DEMNVfZCnQ==}
+    engines: {node: '>=16.0.0'}
+
+  file-saver@1.3.8:
+    resolution: {integrity: sha512-spKHSBQIxxS81N/O21WmuXA2F6wppUCsutpzenOeZzOCCJ5gEfcbqJP983IrpLXzYmXnMUa6J03SubcNPdKrlg==}
+
+  file-saver@2.0.5:
+    resolution: {integrity: sha512-P9bmyZ3h/PRG+Nzga+rbdI4OEpNDzAVyy74uVO9ATgzLK6VtAsYybF/+TOCvrc0MO793d6+42lLyZTw7/ArVzA==}
+
+  filesize-parser@1.5.0:
+    resolution: {integrity: sha512-UTDpJB22VvozK7t31slU9WCAPSdcUWuwD7P7S6LBXswdgzUz+YhoziLOohknFcx0Kq5LWCAj4MEKY9q3zGq47Q==}
+
+  filesize@10.1.6:
+    resolution: {integrity: sha512-sJslQKU2uM33qH5nqewAwVB2QgR6w1aMNsYUp3aN5rMRyXEwJGmZvaWzeJFNTOXWlHQyBFCWrdj3fV/fsTOX8w==}
+    engines: {node: '>= 10.4.0'}
+
+  fill-range@7.1.1:
+    resolution: {integrity: sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==}
+    engines: {node: '>=8'}
+
+  finalhandler@1.3.2:
+    resolution: {integrity: sha512-aA4RyPcd3badbdABGDuTXCMTtOneUCAYH/gxoYRTZlIJdF0YPWuGqiAsIrhNnnqdXGswYk6dGujem4w80UJFhg==}
+    engines: {node: '>= 0.8'}
+
+  find-cache-dir@3.3.2:
+    resolution: {integrity: sha512-wXZV5emFEjrridIgED11OoUKLxiYjAcqot/NJdAkOhlJ+vGzwhOAfcG5OX1jP+S0PcjEn8bdMJv+g2jwQ3Onig==}
+    engines: {node: '>=8'}
+
+  find-cache-dir@4.0.0:
+    resolution: {integrity: sha512-9ZonPT4ZAK4a+1pUPVPZJapbi7O5qbbJPdYw/NOQWZZbVLdDTYM3A4R9z/DpAM08IDaFGsvPgiGZ82WEwUDWjg==}
+    engines: {node: '>=14.16'}
+
+  find-root@1.1.0:
+    resolution: {integrity: sha512-NKfW6bec6GfKc0SGx1e07QZY9PE99u0Bft/0rzSD5k3sO/vwkVUpDUKVm5Gpp5Ue3YfShPFTX2070tDs5kB9Ng==}
+
+  find-up@4.1.0:
+    resolution: {integrity: sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw==}
+    engines: {node: '>=8'}
+
+  find-up@5.0.0:
+    resolution: {integrity: sha512-78/PXT1wlLLDgTzDs7sjq9hzz0vXD+zn+7wypEe4fXQxCmdmqfGsEPQxmiCSQI3ajFV91bVSsvNtrJRiW6nGng==}
+    engines: {node: '>=10'}
+
+  find-up@6.3.0:
+    resolution: {integrity: sha512-v2ZsoEuVHYy8ZIlYqwPe/39Cy+cFDzp4dXPaxNvkEuouymu+2Jbz0PxpKarJHYJTmv2HWT3O382qY8l4jMWthw==}
+    engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
+
+  flat-cache@3.0.4:
+    resolution: {integrity: sha512-dm9s5Pw7Jc0GvMYbshN6zchCA9RgQlzzEZX3vylR9IqFfS8XciblUXOKfW6SiuJ0e13eDYZoZV5wdrev7P3Nwg==}
+    engines: {node: ^10.12.0 || >=12.0.0}
+
+  flat-cache@4.0.1:
+    resolution: {integrity: sha512-f7ccFPK3SXFHpx15UIGyRJ/FJQctuKZ0zVuN3frBo4HnK3cay9VEW0R6yPYFHC0AgqhukPzKjq22t5DmAyqGyw==}
+    engines: {node: '>=16'}
+
+  flat@5.0.2:
+    resolution: {integrity: sha512-b6suED+5/3rTpUBdG1gupIl8MPFCAMA0QXwmljLhvCUKcUvdE4gWky9zpuGCcXHOsz4J9wPGNWq6OKpmIzz3hQ==}
+    hasBin: true
+
+  flatted@3.4.2:
+    resolution: {integrity: sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA==}
+
+  focus-lock@0.11.2:
+    resolution: {integrity: sha512-pZ2bO++NWLHhiKkgP1bEXHhR1/OjVcSvlCJ98aNJDFeb7H5OOQaO+SKOZle6041O9rv2tmbrO4JzClAvDUHf0g==}
+    engines: {node: '>=10'}
+
+  follow-redirects@1.16.0:
+    resolution: {integrity: sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw==}
+    engines: {node: '>=4.0'}
+    peerDependencies:
+      debug: '*'
+    peerDependenciesMeta:
+      debug:
+        optional: true
+
+  for-each@0.3.5:
+    resolution: {integrity: sha512-dKx12eRCVIzqCxFGplyFKJMPvLEWgmNtUrpTiJIR5u97zEhRG8ySrtboPHZXx7daLxQVrl643cTzbab2tkQjxg==}
+    engines: {node: '>= 0.4'}
+
+  foreground-child@3.1.1:
+    resolution: {integrity: sha512-TMKDUnIte6bfb5nWv7V/caI169OHgvwjb7V4WkeUvbQQdjr5rWKqHFiKWb/fcOwB+CzBT+qbWjvj+DVwRskpIg==}
+    engines: {node: '>=14'}
+
+  fork-ts-checker-webpack-plugin@9.1.0:
+    resolution: {integrity: sha512-mpafl89VFPJmhnJ1ssH+8wmM2b50n+Rew5x42NeI2U78aRWgtkEtGmctp7iT16UjquJTjorEmIfESj3DxdW84Q==}
+    engines: {node: '>=14.21.3'}
+    peerDependencies:
+      typescript: '>3.6.0'
+      webpack: ^5.11.0
+
+  form-data@4.0.5:
+    resolution: {integrity: sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==}
+    engines: {node: '>= 6'}
+
+  formik@2.4.9:
+    resolution: {integrity: sha512-5nI94BMnlFDdQRBY4Sz39WkhxajZJ57Fzs8wVbtsQlm5ScKIR1QLYqv/ultBnobObtlUyxpxoLodpixrsf36Og==}
+    peerDependencies:
+      react: '>=16.8.0'
+
+  forwarded@0.2.0:
+    resolution: {integrity: sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==}
+    engines: {node: '>= 0.6'}
+
+  fraction.js@5.3.4:
+    resolution: {integrity: sha512-1X1NTtiJphryn/uLQz3whtY6jK3fTqoE3ohKs0tT+Ujr1W59oopxmoEh7Lu5p6vBaPbgoM0bzveAW4Qi5RyWDQ==}
+
+  fresh@0.5.2:
+    resolution: {integrity: sha512-zJ2mQYM18rEFOudeV4GShTGIQ7RbzA7ozbU9I/XBpm7kqgMywgmylMwXHxZJmkVoYkna9d2pVXVXPdYTP9ej8Q==}
+    engines: {node: '>= 0.6'}
+
+  fs-extra@10.1.0:
+    resolution: {integrity: sha512-oRXApq54ETRj4eMiFzGnHWGy+zo5raudjuxN0b8H7s/RU2oW0Wvsx9O0ACRN/kRq9E8Vu/ReskGB5o3ji+FzHQ==}
+    engines: {node: '>=12'}
+
+  fs-monkey@1.0.5:
+    resolution: {integrity: sha512-8uMbBjrhzW76TYgEV27Y5E//W2f/lTFmx78P2w19FZSxarhI/798APGQyuGCwmkNxgwGRhrLfvWyLBvNtuOmew==}
+
+  fs.realpath@1.0.0:
+    resolution: {integrity: sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw==}
+
+  fsevents@2.3.3:
+    resolution: {integrity: sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==}
+    engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
+    os: [darwin]
+
+  function-bind@1.1.2:
+    resolution: {integrity: sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==}
+
+  function.prototype.name@1.1.8:
+    resolution: {integrity: sha512-e5iwyodOHhbMr/yNrc7fDYG4qlbIvI5gajyzPnb5TCwyhjApznQh1BMFou9b30SevY43gCJKXycoCBjMbsuW0Q==}
+    engines: {node: '>= 0.4'}
+
+  functions-have-names@1.2.3:
+    resolution: {integrity: sha512-xckBUXyTIqT97tq2x2AMb+g163b5JFysYk0x4qxNFwbfQkmNZoiRHb6sPzI9/QV33WeuvVYBUIiD4NzNIyqaRQ==}
+
+  gensync@1.0.0-beta.2:
+    resolution: {integrity: sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg==}
+    engines: {node: '>=6.9.0'}
+
+  get-caller-file@2.0.5:
+    resolution: {integrity: sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg==}
+    engines: {node: 6.* || 8.* || >= 10.*}
+
+  get-east-asian-width@1.6.0:
+    resolution: {integrity: sha512-QRbvDIbx6YklUe6RxeTeleMR0yv3cYH6PsPZHcnVn7xv7zO1BHN8r0XETu8n6Ye3Q+ahtSarc3WgtNWmehIBfA==}
+    engines: {node: '>=18'}
+
+  get-intrinsic@1.3.0:
+    resolution: {integrity: sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==}
+    engines: {node: '>= 0.4'}
+
+  get-nonce@1.0.1:
+    resolution: {integrity: sha512-FJhYRoDaiatfEkUK8HKlicmu/3SGFD51q3itKDGoSTysQJBnfOcxU5GxnhE1E6soB76MbT0MBtnKJuXyAx+96Q==}
+    engines: {node: '>=6'}
+
+  get-proto@1.0.1:
+    resolution: {integrity: sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==}
+    engines: {node: '>= 0.4'}
+
+  get-symbol-description@1.1.0:
+    resolution: {integrity: sha512-w9UMqWwJxHNOvoNzSJ2oPF5wvYcvP7jUvYzhp67yEhTi17ZDBBC1z9pTdGuzjD+EFIqLSYRweZjqfiPzQ06Ebg==}
+    engines: {node: '>= 0.4'}
+
+  get-tsconfig@4.14.0:
+    resolution: {integrity: sha512-yTb+8DXzDREzgvYmh6s9vHsSVCHeC0G3PI5bEXNBHtmshPnO+S5O7qgLEOn0I5QvMy6kpZN8K1NKGyilLb93wA==}
+
+  get-user-locale@2.3.1:
+    resolution: {integrity: sha512-VEvcsqKYx7zhZYC1CjecrDC5ziPSpl1gSm0qFFJhHSGDrSC+x4+p1KojWC/83QX//j476gFhkVXP/kNUc9q+bQ==}
+
+  giget@3.2.0:
+    resolution: {integrity: sha512-GvHTWcykIR/fP8cj8dMpuMMkvaeJfPvYnhq0oW+chSeIr+ldX21ifU2Ms6KBoyKZQZmVaUAAhQ2EZ68KJF8a7A==}
+    hasBin: true
+
+  glob-parent@5.1.2:
+    resolution: {integrity: sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==}
+    engines: {node: '>= 6'}
+
+  glob-parent@6.0.2:
+    resolution: {integrity: sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A==}
+    engines: {node: '>=10.13.0'}
+
+  glob-to-regex.js@1.2.0:
+    resolution: {integrity: sha512-QMwlOQKU/IzqMUOAZWubUOT8Qft+Y0KQWnX9nK3ch0CJg0tTp4TvGZsTfudYKv2NzoQSyPcnA6TYeIQ3jGichQ==}
+    engines: {node: '>=10.0'}
+    peerDependencies:
+      tslib: '2'
+
+  glob-to-regexp@0.4.1:
+    resolution: {integrity: sha512-lkX1HJXwyMcprw/5YUZc2s7DrpAiHB21/V+E1rHUrVNokkvB6bqMzT0VfV6/86ZNabt1k14YOIaT7nDvOX3Iiw==}
+
+  glob@7.1.6:
+    resolution: {integrity: sha512-LwaxwyZ72Lk7vZINtNNrywX0ZuLyStrdDtabefZKAY5ZGJhVtgdznluResxNmPitE0SAO+O26sWTHeKSI2wMBA==}
+
+  glob@7.2.3:
+    resolution: {integrity: sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==}
+
+  globals@11.12.0:
+    resolution: {integrity: sha512-WOBp/EEGUiIsJSp7wcv/y6MO+lV9UoncWqxuFfm8eBwzWNgyfBd6Gz+IeKQ9jCmyhoH99g15M3T+QaVHFjizVA==}
+    engines: {node: '>=4'}
+
+  globals@14.0.0:
+    resolution: {integrity: sha512-oahGvuMGQlPw/ivIYBjVSrWAfWLBeku5tpPE2fOPLi+WHffIWbuh2tCjhyQhTBPMf5E9jDEH4FOmTYgYwbKwtQ==}
+    engines: {node: '>=18'}
+
+  globals@15.15.0:
+    resolution: {integrity: sha512-7ACyT3wmyp3I61S4fG682L0VA2RGD9otkqGJIwNUMF1SWUombIIk+af1unuDYgMm082aHYwD+mzJvv9Iu8dsgg==}
+    engines: {node: '>=18'}
+
+  globalthis@1.0.4:
+    resolution: {integrity: sha512-DpLKbNU4WylpxJykQujfCcwYWiV/Jhm50Goo0wrVILAv5jOr9d+H+UR3PhSCD2rCCEIg0uc+G+muBTwD54JhDQ==}
+    engines: {node: '>= 0.4'}
+
+  globby@13.2.2:
+    resolution: {integrity: sha512-Y1zNGV+pzQdh7H39l9zgB4PJqjRNqydvdYCDG4HFXM4XuvSaQQlEc91IU1yALL8gUTDomgBAfz3XJdmUS+oo0w==}
+    engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
+
+  globby@6.1.0:
+    resolution: {integrity: sha512-KVbFv2TQtbzCoxAnfD6JcHZTYCzyliEaaeM/gH8qQdkKr5s0OP9scEgvdcngyk7AVdY6YVW/TJHd+lQ/Df3Daw==}
+    engines: {node: '>=0.10.0'}
+
+  globrex@0.1.2:
+    resolution: {integrity: sha512-uHJgbwAMwNFf5mLst7IWLNg14x1CkeqglJb/K3doi4dw6q2IvAAmM/Y81kevy83wP+Sst+nutFTYOGg3d1lsxg==}
+
+  gopd@1.2.0:
+    resolution: {integrity: sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==}
+    engines: {node: '>= 0.4'}
+
+  graceful-fs@4.2.11:
+    resolution: {integrity: sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==}
+
+  graphql@16.14.1:
+    resolution: {integrity: sha512-cQOsSMS/IrDz82PVyRDvf/Q1F/bRbBVjJlh+xYOkI1qw2bWRvWGiWc+m2O0d6l4Bt1fyY+8kzJ8JFWGJqNeDBg==}
+    engines: {node: ^12.22.0 || ^14.16.0 || ^16.0.0 || >=17.0.0}
+
+  growly@1.3.0:
+    resolution: {integrity: sha512-+xGQY0YyAWCnqy7Cd++hc2JqMYzlm0dG30Jd0beaA64sROr8C4nt8Yc9V5Ro3avlSUDTN0ulqP/VBKi1/lLygw==}
+
+  handle-thing@2.0.1:
+    resolution: {integrity: sha512-9Qn4yBxelxoh2Ow62nP+Ka/kMnOXRi8BXnRaUwezLNhqelnN49xKz4F/dPP8OYLxLxq6JDtZb2i9XznUQbNPTg==}
+
+  has-bigints@1.0.2:
+    resolution: {integrity: sha512-tSvCKtBr9lkF0Ex0aQiP9N+OpV4zi2r/Nee5VkRDbaqv35RLYMzbwQfFSZZH0kR+Rd6302UJZ2p/bJCEoR3VoQ==}
+
+  has-flag@4.0.0:
+    resolution: {integrity: sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==}
+    engines: {node: '>=8'}
+
+  has-property-descriptors@1.0.2:
+    resolution: {integrity: sha512-55JNKuIW+vq4Ke1BjOTjM2YctQIvCT7GFzHwmfZPGo5wnrgkid0YQtnAleFSqumZm4az3n2BS+erby5ipJdgrg==}
+
+  has-proto@1.2.0:
+    resolution: {integrity: sha512-KIL7eQPfHQRC8+XluaIw7BHUwwqL19bQn4hzNgdr+1wXoU0KKj6rufu47lhY7KbJR2C6T6+PfyN0Ea7wkSS+qQ==}
+    engines: {node: '>= 0.4'}
+
+  has-symbols@1.1.0:
+    resolution: {integrity: sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==}
+    engines: {node: '>= 0.4'}
+
+  has-tostringtag@1.0.2:
+    resolution: {integrity: sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw==}
+    engines: {node: '>= 0.4'}
+
+  hasown@2.0.2:
+    resolution: {integrity: sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==}
+    engines: {node: '>= 0.4'}
+
+  hast-util-to-html@9.0.5:
+    resolution: {integrity: sha512-OguPdidb+fbHQSU4Q4ZiLKnzWo8Wwsf5bZfbvu7//a9oTYoqD/fWpe96NuHkoS9h0ccGOTe0C4NGXdtS0iObOw==}
+
+  hast-util-whitespace@3.0.0:
+    resolution: {integrity: sha512-88JUN06ipLwsnv+dVn+OIYOvAuvBMy/Qoi6O7mQHxdPXpjy+Cd6xRkWwux7DKO+4sYILtLBRIKgsdpS2gQc7qw==}
+
+  he@1.2.0:
+    resolution: {integrity: sha512-F/1DnUGPopORZi0ni+CvrCgHQ5FyEAHRLSApuYWMmrbSwoN2Mn/7k+Gl38gJnR7yyDZk6WLXwiGod1JOWNDKGw==}
+    hasBin: true
+
+  headers-polyfill@5.0.1:
+    resolution: {integrity: sha512-1TJ6Fih/b8h5TIcv+1+Hw0PDQWJTKDKzFZzcKOiW1wJza3XoAQlkCuXLbymPYB8+ZQyw8mHvdw560e8zVFIWyA==}
+
+  hermes-estree@0.25.1:
+    resolution: {integrity: sha512-0wUoCcLp+5Ev5pDW2OriHC2MJCbwLwuRx+gAqMTOkGKJJiBCLjtrvy4PWUGn6MIVefecRpzoOZ/UV6iGdOr+Cw==}
+
+  hermes-parser@0.25.1:
+    resolution: {integrity: sha512-6pEjquH3rqaI6cYAXYPcz9MS4rY6R4ngRgrgfDshRptUZIc3lw0MCIJIGDj9++mfySOuPTHB4nrSW99BCvOPIA==}
+
+  hoist-non-react-statics@3.3.2:
+    resolution: {integrity: sha512-/gGivxi8JPKWNm/W0jSmzcMPpfpPLc3dY/6GxhX2hQ9iGj3aDfklV4ET7NjKpSinLpJ5vafa9iiGIEZg10SfBw==}
+
+  hpack.js@2.1.6:
+    resolution: {integrity: sha512-zJxVehUdMGIKsRaNt7apO2Gqp0BdqW5yaiGHXXmbpvxgBYVZnAql+BJb4RO5ad2MgpbZKn5G6nMnegrH1FcNYQ==}
+
+  html-encoding-sniffer@4.0.0:
+    resolution: {integrity: sha512-Y22oTqIU4uuPgEemfz7NDJz6OeKf12Lsu+QC+s3BVpda64lTiMYCyGwg5ki4vFxkMwQdeZDl2adZoqUgdFuTgQ==}
+    engines: {node: '>=18'}
+
+  html-entities@2.3.3:
+    resolution: {integrity: sha512-DV5Ln36z34NNTDgnz0EWGBLZENelNAtkiFA4kyNOG2tDI6Mz1uSWiq1wAKdyjnJwyDiDO7Fa2SO1CTxPXL8VxA==}
+
+  html-escaper@2.0.2:
+    resolution: {integrity: sha512-H2iMtd0I4Mt5eYiapRdIDjp+XzelXQ0tFE4JS7YFwFevXXMmOp9myNrUvCg0D6ws8iqkRPBfKHgbwig1SmlLfg==}
+
+  html-loader@4.1.0:
+    resolution: {integrity: sha512-QDDNmLgn96NWtTPx/VXRerFXH0hn7cm4bruqsZ333GCb+rqiqGurcxtP/M52wcui1/iLiu0l5ms/McE7/Ik6aQ==}
+    engines: {node: '>= 14.15.0'}
+    peerDependencies:
+      webpack: ^5.0.0
+
+  html-loader@5.1.0:
+    resolution: {integrity: sha512-Jb3xwDbsm0W3qlXrCZwcYqYGnYz55hb6aoKQTlzyZPXsPpi6tHXzAfqalecglMQgNvtEfxrCQPaKT90Irt5XDA==}
+    engines: {node: '>= 18.12.0'}
+    peerDependencies:
+      webpack: ^5.0.0
+
+  html-minifier-terser@6.1.0:
+    resolution: {integrity: sha512-YXxSlJBZTP7RS3tWnQw74ooKa6L9b9i9QYXY21eUEvhZ3u9XLfv6OnFsQq6RxkhHygsaUMvYsZRV5rU/OVNZxw==}
+    engines: {node: '>=12'}
+    hasBin: true
+
+  html-minifier-terser@7.2.0:
+    resolution: {integrity: sha512-tXgn3QfqPIpGl9o+K5tpcj3/MN4SfLtsx2GWwBC3SSd0tXQGyF3gsSqad8loJgKZGM3ZxbYDd5yhiBIdWpmvLA==}
+    engines: {node: ^14.13.1 || >=16.0.0}
+    hasBin: true
+
+  html-parse-stringify@3.0.1:
+    resolution: {integrity: sha512-KknJ50kTInJ7qIScF3jeaFRpMpE8/lfiTdzf/twXyPBLAGrLRTmkz3AdTnKeh40X8k9L2fdYwEp/42WGXIRGcg==}
+
+  html-void-elements@3.0.0:
+    resolution: {integrity: sha512-bEqo66MRXsUGxWHV5IP0PUiAWwoEjba4VCzg0LjFJBpchPaTfyfCKTG6bc5F8ucKec3q5y6qOdGyYTSBEvhCrg==}
+
+  html-webpack-plugin@5.5.3:
+    resolution: {integrity: sha512-6YrDKTuqaP/TquFH7h4srYWsZx+x6k6+FbsTm0ziCwGHDP78Unr1r9F/H4+sGmMbX08GQcJ+K64x55b+7VM/jg==}
+    engines: {node: '>=10.13.0'}
+    peerDependencies:
+      webpack: ^5.20.0
+
+  htmlparser2@6.1.0:
+    resolution: {integrity: sha512-gyyPk6rgonLFEDGoeRgQNaEUvdJ4ktTmmUh/h2t7s+M8oPpIPxgNACWa+6ESR57kXstwqPiCut0V8NRpcwgU7A==}
+
+  htmlparser2@8.0.2:
+    resolution: {integrity: sha512-GYdjWKDkbRLkZ5geuHs5NY1puJ+PXwP7+fHPRz06Eirsb9ugf6d8kkXav6ADhcODhFFPMIXyxkxSuMf3D6NCFA==}
+
+  http-deceiver@1.2.7:
+    resolution: {integrity: sha512-LmpOGxTfbpgtGVxJrj5k7asXHCgNZp5nLfp+hWc8QQRqtb7fUy6kRY3BO1h9ddF6yIPYUARgxGOwB42DnxIaNw==}
+
+  http-errors@1.6.3:
+    resolution: {integrity: sha512-lks+lVC8dgGyh97jxvxeYTWQFvh4uw4yC12gVl63Cg30sjPX4wuGcdkICVXDAESr6OJGjqGA8Iz5mkeN6zlD7A==}
+    engines: {node: '>= 0.6'}
+
+  http-errors@2.0.1:
+    resolution: {integrity: sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==}
+    engines: {node: '>= 0.8'}
+
+  http-parser-js@0.5.5:
+    resolution: {integrity: sha512-x+JVEkO2PoM8qqpbPbOL3cqHPwerep7OwzK7Ay+sMQjKzaKCqWvjoXm5tqMP9tXWWTnTzAjIhXg+J99XYuPhPA==}
+
+  http-proxy-agent@7.0.2:
+    resolution: {integrity: sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig==}
+    engines: {node: '>= 14'}
+
+  http-proxy-middleware@2.0.9:
+    resolution: {integrity: sha512-c1IyJYLYppU574+YI7R4QyX2ystMtVXZwIdzazUIPIJsHuWNd+mho2j+bKoHftndicGj9yh+xjd+l0yj7VeT1Q==}
+    engines: {node: '>=12.0.0'}
+    peerDependencies:
+      '@types/express': ^4.17.13
+    peerDependenciesMeta:
+      '@types/express':
+        optional: true
+
+  http-proxy@1.18.1:
+    resolution: {integrity: sha512-7mz/721AbnJwIVbnaSv1Cz3Am0ZLT/UBwkC92VlxhXv/k/BBQfM2fXElQNC27BVGr0uwUpplYPQM9LnaBMR5NQ==}
+    engines: {node: '>=8.0.0'}
+
+  http-vary@1.0.3:
+    resolution: {integrity: sha512-sx7Y8YTqF3o0mFJJvF66n8dbaE8v3liV1RgCz46XP5xK7dnzyZHvwMWRA115q5kjbCPBV65/nOMlgW54WLyiag==}
+
+  http2-client@1.3.5:
+    resolution: {integrity: sha512-EC2utToWl4RKfs5zd36Mxq7nzHHBuomZboI0yYL6Y0RmBgT7Sgkq4rQ0ezFTYoIsSs7Tm9SJe+o2FcAg6GBhGA==}
+
+  https-proxy-agent@5.0.1:
+    resolution: {integrity: sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==}
+    engines: {node: '>= 6'}
+
+  https-proxy-agent@7.0.6:
+    resolution: {integrity: sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==}
+    engines: {node: '>= 14'}
+
+  husky@8.0.3:
+    resolution: {integrity: sha512-+dQSyqPh4x1hlO1swXBiNb2HzTDN1I2IGLQx1GrBuiqFJfoMrnZWwVmatvSiO+Iz8fBUnf+lekwNo4c2LlXItg==}
+    engines: {node: '>=14'}
+    hasBin: true
+
+  hyperdyperid@1.2.0:
+    resolution: {integrity: sha512-Y93lCzHYgGWdrJ66yIktxiaGULYc6oGiABxhcO5AufBeOyoIdZF7bIfLaOrbM0iGIOXQQgxxRrFEnb+Y6w1n4A==}
+    engines: {node: '>=10.18'}
+
+  i18next-browser-languagedetector@6.1.2:
+    resolution: {integrity: sha512-YDzIGHhMRvr7M+c8B3EQUKyiMBhfqox4o1qkFvt4QXuu5V2cxf74+NCr+VEkUuU0y+RwcupA238eeolW1Yn80g==}
+
+  i18next-http-backend@3.0.4:
+    resolution: {integrity: sha512-udwrBIE6cNpqn1gRAqRULq3+7MzIIuaiKRWrz++dVz5SqWW2VwXmPJtAgkI0JtMLFaADC9qNmnZAxWAhsxXx2g==}
+
+  i18next@21.10.0:
+    resolution: {integrity: sha512-YeuIBmFsGjUfO3qBmMOc0rQaun4mIpGKET5WDwvu8lU7gvwpcariZLNtL0Fzj+zazcHUrlXHiptcFhBMFaxzfg==}
+
+  iconv-lite@0.4.24:
+    resolution: {integrity: sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA==}
+    engines: {node: '>=0.10.0'}
+
+  iconv-lite@0.6.3:
+    resolution: {integrity: sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==}
+    engines: {node: '>=0.10.0'}
+
+  icss-utils@5.1.0:
+    resolution: {integrity: sha512-soFhflCVWLfRNOPU3iv5Z9VUdT44xFRbzjLsEzSr5AQmgqPMTHdU3PMT1Cf1ssx8fLNJDA1juftYl+PUcv3MqA==}
+    engines: {node: ^10 || ^12 || >= 14}
+    peerDependencies:
+      postcss: ^8.1.0
+
+  ieee754@1.2.1:
+    resolution: {integrity: sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==}
+
+  ignore@5.2.4:
+    resolution: {integrity: sha512-MAb38BcSbH0eHNBxn7ql2NH/kX33OkB3lZ1BNdh7ENeRChHTYsTvWrMubiIAMNS2llXEEgZ1MUOBtXChP3kaFQ==}
+    engines: {node: '>= 4'}
+
+  ignore@7.0.5:
+    resolution: {integrity: sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg==}
+    engines: {node: '>= 4'}
+
+  image-size@0.5.5:
+    resolution: {integrity: sha512-6TDAlDPZxUFCv+fuOkIoXT/V/f3Qbq8e37p+YOiYrUv3v9cc3/6x78VdfPgFVaB9dZYeLUfKgHRebpkm/oP2VQ==}
+    engines: {node: '>=0.10.0'}
+    hasBin: true
+
+  import-fresh@3.3.0:
+    resolution: {integrity: sha512-veYYhQa+D1QBKznvhUHxb8faxlrwUnxseDAbAp457E0wLNio2bOSKnjYDhMj+YiAq61xrMGhQk9iXVk5FzgQMw==}
+    engines: {node: '>=6'}
+
+  import-local@3.0.3:
+    resolution: {integrity: sha512-bE9iaUY3CXH8Cwfan/abDKAxe1KGT9kyGsBPqf6DMK/z0a2OzAsrukeYNgIH6cH5Xr452jb1TUL8rSfCLjZ9uA==}
+    engines: {node: '>=8'}
+    hasBin: true
+
+  imurmurhash@0.1.4:
+    resolution: {integrity: sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==}
+    engines: {node: '>=0.8.19'}
+
+  indent-string@4.0.0:
+    resolution: {integrity: sha512-EdDDZu4A2OyIK7Lr/2zG+w5jmbuk1DVBnEwREQvBzspBJkCEbRa8GxU1lghYcaGJCnRWibjDXlq779X1/y5xwg==}
+    engines: {node: '>=8'}
+
+  inflight@1.0.6:
+    resolution: {integrity: sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==}
+
+  inherits@2.0.3:
+    resolution: {integrity: sha512-x00IRNXNy63jwGkJmzPigoySHbaqpNuzKbBOmzK+g2OdZpQ9w+sxCN+VSB3ja7IAge2OP2qpfxTjeNcyjmW1uw==}
+
+  inherits@2.0.4:
+    resolution: {integrity: sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==}
+
+  internal-slot@1.1.0:
+    resolution: {integrity: sha512-4gd7VpWNQNB4UKKCFFVcp1AVv+FMOgs9NKzjHKusc8jTMhd5eL1NqQqOpE0KzMds804/yHlglp3uxgluOqAPLw==}
+    engines: {node: '>= 0.4'}
+
+  interpret@3.1.1:
+    resolution: {integrity: sha512-6xwYfHbajpoF0xLW+iwLkhwgvLoZDfjYfoFNu8ftMoXINzwuymNLd9u/KmwtdT2GbR+/Cz66otEGEVVUHX9QLQ==}
+    engines: {node: '>=10.13.0'}
+
+  ipaddr.js@1.9.1:
+    resolution: {integrity: sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==}
+    engines: {node: '>= 0.10'}
+
+  ipaddr.js@2.3.0:
+    resolution: {integrity: sha512-Zv/pA+ciVFbCSBBjGfaKUya/CcGmUHzTydLMaTwrUUEM2DIEO3iZvueGxmacvmN50fGpGVKeTXpb2LcYQxeVdg==}
+    engines: {node: '>= 10'}
+
+  is-arguments@1.1.1:
+    resolution: {integrity: sha512-8Q7EARjzEnKpt/PCD7e1cgUS0a6X8u5tdSiMqXhojOdoV9TsMsiO+9VLC5vAmO8N7/GmXn7yjR8qnA6bVAEzfA==}
+    engines: {node: '>= 0.4'}
+
+  is-array-buffer@3.0.5:
+    resolution: {integrity: sha512-DDfANUiiG2wC1qawP66qlTugJeL5HyzMpfr8lLK+jMQirGzNod0B12cFB/9q838Ru27sBwfw78/rdoU7RERz6A==}
+    engines: {node: '>= 0.4'}
+
+  is-arrayish@0.2.1:
+    resolution: {integrity: sha512-zz06S8t0ozoDXMG+ube26zeCTNXcKIPJZJi8hBrF4idCLms4CG9QtK7qBl1boi5ODzFpjswb5JPmHCbMpjaYzg==}
+
+  is-async-function@2.0.0:
+    resolution: {integrity: sha512-Y1JXKrfykRJGdlDwdKlLpLyMIiWqWvuSd17TvZk68PLAOGOoF4Xyav1z0Xhoi+gCYjZVeC5SI+hYFOfvXmGRCA==}
+    engines: {node: '>= 0.4'}
+
+  is-bigint@1.1.0:
+    resolution: {integrity: sha512-n4ZT37wG78iz03xPRKJrHTdZbe3IicyucEtdRsV5yglwc3GyUfbAfpSeD0FJ41NbUNSt5wbhqfp1fS+BgnvDFQ==}
+    engines: {node: '>= 0.4'}
+
+  is-binary-path@2.1.0:
+    resolution: {integrity: sha512-ZMERYes6pDydyuGidse7OsHxtbI7WVeUEozgR/g7rd0xUimYNlvZRE/K2MgZTjWy725IfelLeVcEM97mmtRGXw==}
+    engines: {node: '>=8'}
+
+  is-boolean-object@1.2.2:
+    resolution: {integrity: sha512-wa56o2/ElJMYqjCjGkXri7it5FbebW5usLw/nPmCMs5DeZ7eziSYZhSmPRn0txqeW4LnAmQQU7FgqLpsEFKM4A==}
+    engines: {node: '>= 0.4'}
+
+  is-bun-module@2.0.0:
+    resolution: {integrity: sha512-gNCGbnnnnFAUGKeZ9PdbyeGYJqewpmc2aKHUEMO5nQPWU9lOmv7jcmQIv+qHD8fXW6W7qfuCwX4rY9LNRjXrkQ==}
+
+  is-callable@1.2.7:
+    resolution: {integrity: sha512-1BC0BVFhS/p0qtw6enp8e+8OD0UrK0oFLztSjNzhcKA3WDuJxxAPXzPuPtKkjEY9UUoEWlX/8fgKeu2S8i9JTA==}
+    engines: {node: '>= 0.4'}
+
+  is-core-module@2.16.1:
+    resolution: {integrity: sha512-UfoeMA6fIJ8wTYFEUjelnaGI67v6+N7qXJEvQuIGa99l4xsCruSYOVSQ0uPANn4dAzm8lkYPaKLrrijLq7x23w==}
+    engines: {node: '>= 0.4'}
+
+  is-data-view@1.0.2:
+    resolution: {integrity: sha512-RKtWF8pGmS87i2D6gqQu/l7EYRlVdfzemCJN/P3UOs//x1QE7mfhvzHIApBTRf7axvT6DMGwSwBXYCT0nfB9xw==}
+    engines: {node: '>= 0.4'}
+
+  is-date-object@1.1.0:
+    resolution: {integrity: sha512-PwwhEakHVKTdRNVOw+/Gyh0+MzlCl4R6qKvkhuvLtPMggI1WAHt9sOwZxQLSGpUaDnrdyDsomoRgNnCfKNSXXg==}
+    engines: {node: '>= 0.4'}
+
+  is-docker@2.2.1:
+    resolution: {integrity: sha512-F+i2BKsFrH66iaUFc0woD8sLy8getkwTwtOBjvs56Cx4CgJDeKQeqfz8wAYiSb8JOprWhHH5p77PbmYCvvUuXQ==}
+    engines: {node: '>=8'}
+    hasBin: true
+
+  is-docker@3.0.0:
+    resolution: {integrity: sha512-eljcgEDlEns/7AXFosB5K/2nCM4P7FQPkGc/DWLy5rmFEWvZayGrik1d9/QIY5nJ4f9YsVvBkA6kJpHn9rISdQ==}
+    engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
+    hasBin: true
+
+  is-extglob@2.1.1:
+    resolution: {integrity: sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==}
+    engines: {node: '>=0.10.0'}
+
+  is-finalizationregistry@1.1.1:
+    resolution: {integrity: sha512-1pC6N8qWJbWoPtEjgcL2xyhQOP491EQjeUo3qTKcmV8YSDDJrOepfG8pcC7h/QgnQHYSv0mJ3Z/ZWxmatVrysg==}
+    engines: {node: '>= 0.4'}
+
+  is-fullwidth-code-point@3.0.0:
+    resolution: {integrity: sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==}
+    engines: {node: '>=8'}
+
+  is-fullwidth-code-point@5.1.0:
+    resolution: {integrity: sha512-5XHYaSyiqADb4RnZ1Bdad6cPp8Toise4TzEjcOYDHZkTCbKgiUl7WTUCpNWHuxmDt91wnsZBc9xinNzopv3JMQ==}
+    engines: {node: '>=18'}
+
+  is-generator-function@1.0.10:
+    resolution: {integrity: sha512-jsEjy9l3yiXEQ+PsXdmBwEPcOxaXWLspKdplFUVI9vq1iZgIekeC0L167qeu86czQaxed3q/Uzuw0swL0irL8A==}
+    engines: {node: '>= 0.4'}
+
+  is-glob@4.0.3:
+    resolution: {integrity: sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==}
+    engines: {node: '>=0.10.0'}
+
+  is-in-ssh@1.0.0:
+    resolution: {integrity: sha512-jYa6Q9rH90kR1vKB6NM7qqd1mge3Fx4Dhw5TVlK1MUBqhEOuCagrEHMevNuCcbECmXZ0ThXkRm+Ymr51HwEPAw==}
+    engines: {node: '>=20'}
+
+  is-inside-container@1.0.0:
+    resolution: {integrity: sha512-KIYLCCJghfHZxqjYBE7rEy0OBuTd5xCHS7tHVgvCLkx7StIoaxwNW3hCALgEUjFfeRk+MG/Qxmp/vtETEF3tRA==}
+    engines: {node: '>=14.16'}
+    hasBin: true
+
+  is-map@2.0.3:
+    resolution: {integrity: sha512-1Qed0/Hr2m+YqxnM09CjA2d/i6YZNfF6R2oRAOj36eUdS6qIV/huPJNSEpKbupewFs+ZsJlxsjjPbc0/afW6Lw==}
+    engines: {node: '>= 0.4'}
+
+  is-negative-zero@2.0.3:
+    resolution: {integrity: sha512-5KoIu2Ngpyek75jXodFvnafB6DJgr3u8uuK0LEZJjrU19DrMD3EVERaR8sjz8CCGgpZvxPl9SuE1GMVPFHx1mw==}
+    engines: {node: '>= 0.4'}
+
+  is-network-error@1.3.0:
+    resolution: {integrity: sha512-6oIwpsgRfnDiyEDLMay/GqCl3HoAtH5+RUKW29gYkL0QA+ipzpDLA16yQs7/RHCSu+BwgbJaOUqa4A99qNVQVw==}
+    engines: {node: '>=16'}
+
+  is-node-process@1.2.0:
+    resolution: {integrity: sha512-Vg4o6/fqPxIjtxgUH5QLJhwZ7gW5diGCVlXpuUfELC62CuxM1iHcRe51f2W1FDy04Ai4KJkagKjx3XaqyfRKXw==}
+
+  is-number-object@1.1.1:
+    resolution: {integrity: sha512-lZhclumE1G6VYD8VHe35wFaIif+CTy5SJIi5+3y4psDgWu4wPDoBhF8NxUOinEc7pHgiTsT6MaBb92rKhhD+Xw==}
+    engines: {node: '>= 0.4'}
+
+  is-number@7.0.0:
+    resolution: {integrity: sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==}
+    engines: {node: '>=0.12.0'}
+
+  is-path-cwd@2.2.0:
+    resolution: {integrity: sha512-w942bTcih8fdJPJmQHFzkS76NEP8Kzzvmw92cXsazb8intwLqPibPPdXf4ANdKV3rYMuuQYGIWtvz9JilB3NFQ==}
+    engines: {node: '>=6'}
+
+  is-path-in-cwd@2.1.0:
+    resolution: {integrity: sha512-rNocXHgipO+rvnP6dk3zI20RpOtrAM/kzbB258Uw5BWr3TpXi861yzjo16Dn4hUox07iw5AyeMLHWsujkjzvRQ==}
+    engines: {node: '>=6'}
+
+  is-path-inside@2.1.0:
+    resolution: {integrity: sha512-wiyhTzfDWsvwAW53OBWF5zuvaOGlZ6PwYxAbPVDhpm+gM09xKQGjBq/8uYN12aDvMxnAnq3dxTyoSoRNmg5YFg==}
+    engines: {node: '>=6'}
+
+  is-plain-obj@3.0.0:
+    resolution: {integrity: sha512-gwsOE28k+23GP1B6vFl1oVh/WOzmawBrKwo5Ev6wMKzPkaXaCDIQKzLnvsA42DRlbVTWorkgTKIviAKCWkfUwA==}
+    engines: {node: '>=10'}
+
+  is-plain-object@2.0.4:
+    resolution: {integrity: sha512-h5PpgXkWitc38BBMYawTYMWJHFZJVnBquFE57xFpjB8pJFiF6gZ+bU+WyI/yqXiFR5mdLsgYNaPe8uao6Uv9Og==}
+    engines: {node: '>=0.10.0'}
+
+  is-plain-object@5.0.0:
+    resolution: {integrity: sha512-VRSzKkbMm5jMDoKLbltAkFQ5Qr7VDiTFGXxYFXXowVj387GeGNOCsOH6Msy00SGZ3Fp84b1Naa1psqgcCIEP5Q==}
+    engines: {node: '>=0.10.0'}
+
+  is-potential-custom-element-name@1.0.1:
+    resolution: {integrity: sha512-bCYeRA2rVibKZd+s2625gGnGF/t7DSqDs4dP7CrLA1m7jKWz6pps0LpYLJN8Q64HtmPKJ1hrN3nzPNKFEKOUiQ==}
+
+  is-regex@1.2.1:
+    resolution: {integrity: sha512-MjYsKHO5O7mCsmRGxWcLWheFqN9DJ/2TmngvjKXihe6efViPqc274+Fx/4fYj/r03+ESvBdTXK0V6tA3rgez1g==}
+    engines: {node: '>= 0.4'}
+
+  is-set@2.0.3:
+    resolution: {integrity: sha512-iPAjerrse27/ygGLxw+EBR9agv9Y6uLeYVJMu+QNCoouJ1/1ri0mGrcWpfCqFZuzzx3WjtwxG098X+n4OuRkPg==}
+    engines: {node: '>= 0.4'}
+
+  is-shared-array-buffer@1.0.4:
+    resolution: {integrity: sha512-ISWac8drv4ZGfwKl5slpHG9OwPNty4jOWPRIhBpxOoD+hqITiwuipOQ2bNthAzwA3B4fIjO4Nln74N0S9byq8A==}
+    engines: {node: '>= 0.4'}
+
+  is-string@1.1.1:
+    resolution: {integrity: sha512-BtEeSsoaQjlSPBemMQIrY1MY0uM6vnS1g5fmufYOtnxLGUZM2178PKbhsk7Ffv58IX+ZtcvoGwccYsh0PglkAA==}
+    engines: {node: '>= 0.4'}
+
+  is-symbol@1.1.1:
+    resolution: {integrity: sha512-9gGx6GTtCQM73BgmHQXfDmLtfjjTUDSyoxTCbp5WtoixAhfgsDirWIcVQ/IHpvI5Vgd5i/J5F7B9cN/WlVbC/w==}
+    engines: {node: '>= 0.4'}
+
+  is-typed-array@1.1.15:
+    resolution: {integrity: sha512-p3EcsicXjit7SaskXHs1hA91QxgTw46Fv6EFKKGS5DRFLD8yKnohjF3hxoju94b/OcMZoQukzpPpBE9uLVKzgQ==}
+    engines: {node: '>= 0.4'}
+
+  is-weakmap@2.0.2:
+    resolution: {integrity: sha512-K5pXYOm9wqY1RgjpL3YTkF39tni1XajUIkawTLUo9EZEVUFga5gSQJF8nNS7ZwJQ02y+1YCNYcMh+HIf1ZqE+w==}
+    engines: {node: '>= 0.4'}
+
+  is-weakref@1.1.1:
+    resolution: {integrity: sha512-6i9mGWSlqzNMEqpCp93KwRS1uUOodk2OJ6b+sq7ZPDSy2WuI5NFIxp/254TytR8ftefexkWn5xNiHUNpPOfSew==}
+    engines: {node: '>= 0.4'}
+
+  is-weakset@2.0.4:
+    resolution: {integrity: sha512-mfcwb6IzQyOKTs84CQMrOwW4gQcaTOAWJ0zzJCl2WSPDrWk/OzDaImWFH3djXhb24g4eudZfLRozAvPGw4d9hQ==}
+    engines: {node: '>= 0.4'}
+
+  is-what@3.14.1:
+    resolution: {integrity: sha512-sNxgpk9793nzSs7bA6JQJGeIuRBQhAaNGG77kzYQgMkrID+lS6SlK07K5LaptscDlSaIgH+GPFzf+d75FVxozA==}
+
+  is-what@4.1.16:
+    resolution: {integrity: sha512-ZhMwEosbFJkA0YhFnNDgTM4ZxDRsS6HqTo7qsZM08fehyRYIYa0yHu5R6mgo1n/8MgaPBXiPimPD77baVFYg+A==}
+    engines: {node: '>=12.13'}
+
+  is-wsl@2.2.0:
+    resolution: {integrity: sha512-fKzAra0rGJUUBwGBgNkHZuToZcn+TtXHpeCgmkMJMMYx1sQDYaCSyjJBSCa2nH1DGm7s3n1oBnohoVTBaN7Lww==}
+    engines: {node: '>=8'}
+
+  is-wsl@3.1.0:
+    resolution: {integrity: sha512-UcVfVfaK4Sc4m7X3dUSoHoozQGBEFeDC+zVo06t98xe8CzHSZZBekNXH+tu0NalHolcJ/QAGqS46Hef7QXBIMw==}
+    engines: {node: '>=16'}
+
+  isarray@1.0.0:
+    resolution: {integrity: sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ==}
+
+  isarray@2.0.5:
+    resolution: {integrity: sha512-xHjhDr3cNBK0BzdUJSPXZntQUx/mwMS5Rw4A7lPJ90XGAO6ISP/ePDNuo0vhqOZU+UD5JoodwCAAoZQd3FeAKw==}
+
+  isexe@2.0.0:
+    resolution: {integrity: sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==}
+
+  isobject@3.0.1:
+    resolution: {integrity: sha512-WhB9zCku7EGTj/HQQRz5aUQEUeoQZH2bWcltRErOpymJ4boYE6wL9Tbr23krRPSZ+C5zqNSrSw+Cc7sZZ4b7vg==}
+    engines: {node: '>=0.10.0'}
+
+  istanbul-lib-coverage@3.2.2:
+    resolution: {integrity: sha512-O8dpsF+r0WV/8MNRKfnmrtCWhuKjxrq2w+jpzBL5UZKTi2LeVWnWOmWRxFlesJONmc+wLAGvKQZEOanko0LFTg==}
+    engines: {node: '>=8'}
+
+  istanbul-lib-report@3.0.1:
+    resolution: {integrity: sha512-GCfE1mtsHGOELCU8e/Z7YWzpmybrx/+dSTfLrvY8qRmaY6zXTKWn6WQIjaAFw069icm6GVMNkgu0NzI4iPZUNw==}
+    engines: {node: '>=10'}
+
+  istanbul-reports@3.2.0:
+    resolution: {integrity: sha512-HGYWWS/ehqTV3xN10i23tkPkpH46MLCIMFNCaaKNavAXTF1RkqxawEPtnjnGZ6XKSInBKkiOA5BKS+aZiY3AvA==}
+    engines: {node: '>=8'}
+
+  iterator.prototype@1.1.5:
+    resolution: {integrity: sha512-H0dkQoCa3b2VEeKQBOxFph+JAbcrQdE7KC0UkqwpLmv2EC4P41QXP+rqo9wYodACiG5/WM5s9oDApTU8utwj9g==}
+    engines: {node: '>= 0.4'}
+
+  jest-worker@27.5.1:
+    resolution: {integrity: sha512-7vuh85V5cdDofPyxn58nrPjBktZo0u9x1g8WtjQol+jZDaE+fhN+cIvTj11GndBnMnyfrUOG1sZQxCdjKh+DKg==}
+    engines: {node: '>= 10.13.0'}
+
+  jiti@1.18.2:
+    resolution: {integrity: sha512-QAdOptna2NYiSSpv0O/BwoHBSmz4YhpzJHyi+fnMRTXFjp7B8i/YG5Z8IfusxB1ufjcD2Sre1F3R+nX3fvy7gg==}
+    hasBin: true
+
+  jiti@2.7.0:
+    resolution: {integrity: sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ==}
+    hasBin: true
+
+  jquery@3.6.0:
+    resolution: {integrity: sha512-JVzAR/AjBvVt2BmYhxRCSYysDsPcssdmTFnzyLEts9qNwmjmu4JTAMYubEfwVOSwpQ1I1sKKFcxhZCI2buerfw==}
+
+  js-base64@3.7.2:
+    resolution: {integrity: sha512-NnRs6dsyqUXejqk/yv2aiXlAvOs56sLkX6nUdeaNezI5LFFLlsZjOThmwnrcwh5ZZRwZlCMnVAY3CvhIhoVEKQ==}
+
+  js-tokens@10.0.0:
+    resolution: {integrity: sha512-lM/UBzQmfJRo9ABXbPWemivdCW8V2G8FHaHdypQaIy523snUjog0W71ayWXTjiR+ixeMyVHN2XcpnTd/liPg/Q==}
+
+  js-tokens@4.0.0:
+    resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}
+
+  js-yaml@3.14.2:
+    resolution: {integrity: sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==}
+    hasBin: true
+
+  js-yaml@4.1.1:
+    resolution: {integrity: sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==}
+    hasBin: true
+
+  js-yaml@4.2.0:
+    resolution: {integrity: sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==}
+    hasBin: true
+
+  jsdom@24.1.3:
+    resolution: {integrity: sha512-MyL55p3Ut3cXbeBEG7Hcv0mVM8pp8PBNWxRqchZnSfAiES1v1mRnMeFfaHWIPULpwsYfvO+ZmMZz5tGCnjzDUQ==}
+    engines: {node: '>=18'}
+    peerDependencies:
+      canvas: ^2.11.2
+    peerDependenciesMeta:
+      canvas:
+        optional: true
+
+  jsesc@0.5.0:
+    resolution: {integrity: sha512-uZz5UnB7u4T9LvwmFqXii7pZSouaRPorGs5who1Ip7VO0wxanFvBL7GkM6dTHlgX+jhBApRetaWpnDabOeTcnA==}
+    hasBin: true
+
+  jsesc@3.1.0:
+    resolution: {integrity: sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA==}
+    engines: {node: '>=6'}
+    hasBin: true
+
+  json-buffer@3.0.1:
+    resolution: {integrity: sha512-4bV5BfR2mqfQTJm+V5tPPdf+ZpuhiIvTuAB5g8kcrXOZpTT/QwwVRWBywX1ozr6lEuPdbHxwaJlm9G6mI2sfSQ==}
+
+  json-parse-even-better-errors@2.3.1:
+    resolution: {integrity: sha512-xyFwyhro/JEof6Ghe2iz2NcXoj2sloNsWr/XsERDK/oiPCfaNhl5ONfp+jQdAZRQQ0IJWNzH9zIZF7li91kh2w==}
+
+  json-schema-library@9.3.5:
+    resolution: {integrity: sha512-5eBDx7cbfs+RjylsVO+N36b0GOPtv78rfqgf2uON+uaHUIC62h63Y8pkV2ovKbaL4ZpQcHp21968x5nx/dFwqQ==}
+
+  json-schema-traverse@0.4.1:
+    resolution: {integrity: sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==}
+
+  json-schema-traverse@1.0.0:
+    resolution: {integrity: sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==}
+
+  json-schema@0.4.0:
+    resolution: {integrity: sha512-es94M3nTIfsEPisRafak+HDLfHXnKBhV3vU5eqPcS3flIWqcxJWgXHXiey3YrpaNsanY5ei1VoYEbOzijuq9BA==}
+
+  json-stable-stringify-without-jsonify@1.0.1:
+    resolution: {integrity: sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw==}
+
+  json-stable-stringify@1.0.1:
+    resolution: {integrity: sha512-i/J297TW6xyj7sDFa7AmBPkQvLIxWr2kKPWI26tXydnZrzVAocNqn5DMNT1Mzk0vit1V5UkRM7C1KdVNp7Lmcg==}
+
+  json5@1.0.2:
+    resolution: {integrity: sha512-g1MWMLBiz8FKi1e4w0UyVL3w+iJceWAFBAaBnnGKOpNa5f8TLktkbre1+s6oICydWAm+HRUGTmI+//xv2hvXYA==}
+    hasBin: true
+
+  json5@2.2.3:
+    resolution: {integrity: sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==}
+    engines: {node: '>=6'}
+    hasBin: true
+
+  jsonfile@6.2.0:
+    resolution: {integrity: sha512-FGuPw30AdOIUTRMC2OMRtQV+jkVj2cfPqSeWXv1NEAJ1qZ5zb1X6z1mFhbfOB/iy3ssJCD+3KuZ8r8C3uVFlAg==}
+
+  jsonify@0.0.0:
+    resolution: {integrity: sha512-trvBk1ki43VZptdBI5rIlG4YOzyeH/WefQt5rj1grasPn4iiZWKet8nkgc4GlsAylaztn0qZfUYOiTsASJFdNA==}
+
+  jsx-ast-utils@3.3.5:
+    resolution: {integrity: sha512-ZZow9HBI5O6EPgSJLUb8n2NKgmVWTwCvHGwFuJlMjvLFqlGG6pjirPhtdsseaLZjSibD8eegzmYpUZwoIlj2cQ==}
+    engines: {node: '>=4.0'}
+
+  keyv@4.5.4:
+    resolution: {integrity: sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==}
+
+  kind-of@6.0.3:
+    resolution: {integrity: sha512-dcS1ul+9tmeD95T+x28/ehLgd9mENa3LsvDTtzm3vyBEO7RPptvAD+t44WVXaUjTBRcrpFeFlC8WCruUR456hw==}
+    engines: {node: '>=0.10.0'}
+
+  krustykrab@1.1.0:
+    resolution: {integrity: sha512-xpX9MPbw+nJseewe6who9Oq46RQwrBfps+dO/N4fSjJhsf2+y4XWC2kz46oBGX8yzMHyYJj35ug0X5s5yxB6tA==}
+
+  kubernetes-types@1.30.0:
+    resolution: {integrity: sha512-Dew1okvhM/SQcIa2rcgujNndZwU8VnSapDgdxlYoB84ZlpAD43U6KLAFqYo17ykSFGHNPrg0qry0bP+GJd9v7Q==}
+
+  language-subtag-registry@0.3.21:
+    resolution: {integrity: sha512-L0IqwlIXjilBVVYKFT37X9Ih11Um5NEl9cbJIuU/SwP/zEEAbBPOnEeeuxVMf45ydWQRDQN3Nqc96OgbH1K+Pg==}
+
+  language-tags@1.0.9:
+    resolution: {integrity: sha512-MbjN408fEndfiQXbFQ1vnd+1NoLDsnQW41410oQBXiyXDMYH5z505juWa4KUE1LqxRC7DgOgZDbKLxHIwm27hA==}
+    engines: {node: '>=0.10'}
+
+  launch-editor@2.12.0:
+    resolution: {integrity: sha512-giOHXoOtifjdHqUamwKq6c49GzBdLjvxrd2D+Q4V6uOHopJv7p9VJxikDsQ/CBXZbEITgUqSVHXLTG3VhPP1Dg==}
+
+  less@4.4.2:
+    resolution: {integrity: sha512-j1n1IuTX1VQjIy3tT7cyGbX7nvQOsFLoIqobZv4ttI5axP923gA44zUj6miiA6R5Aoms4sEGVIIcucXUbRI14g==}
+    engines: {node: '>=14'}
+    hasBin: true
+
+  levn@0.4.1:
+    resolution: {integrity: sha512-+bT2uH4E5LGE7h/n3evcS/sQlJXCpIp6ym8OWJ5eV6+67Dsql/LaaT7qJBAt2rzfoa/5QBGBhxDix1dMt2kQKQ==}
+    engines: {node: '>= 0.8.0'}
+
+  lezer-json5@2.0.2:
+    resolution: {integrity: sha512-NRmtBlKW/f8mA7xatKq8IUOq045t8GVHI4kZXrUtYYUdiVeGiO6zKGAV7/nUAnf5q+rYTY+SWX/gvQdFXMjNxQ==}
+
+  lightningcss-android-arm64@1.32.0:
+    resolution: {integrity: sha512-YK7/ClTt4kAK0vo6w3X+Pnm0D2cf2vPHbhOXdoNti1Ga0al1P4TBZhwjATvjNwLEBCnKvjJc2jQgHXH0NEwlAg==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [arm64]
+    os: [android]
+
+  lightningcss-darwin-arm64@1.32.0:
+    resolution: {integrity: sha512-RzeG9Ju5bag2Bv1/lwlVJvBE3q6TtXskdZLLCyfg5pt+HLz9BqlICO7LZM7VHNTTn/5PRhHFBSjk5lc4cmscPQ==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [arm64]
+    os: [darwin]
+
+  lightningcss-darwin-x64@1.32.0:
+    resolution: {integrity: sha512-U+QsBp2m/s2wqpUYT/6wnlagdZbtZdndSmut/NJqlCcMLTWp5muCrID+K5UJ6jqD2BFshejCYXniPDbNh73V8w==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [x64]
+    os: [darwin]
+
+  lightningcss-freebsd-x64@1.32.0:
+    resolution: {integrity: sha512-JCTigedEksZk3tHTTthnMdVfGf61Fky8Ji2E4YjUTEQX14xiy/lTzXnu1vwiZe3bYe0q+SpsSH/CTeDXK6WHig==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [x64]
+    os: [freebsd]
+
+  lightningcss-linux-arm-gnueabihf@1.32.0:
+    resolution: {integrity: sha512-x6rnnpRa2GL0zQOkt6rts3YDPzduLpWvwAF6EMhXFVZXD4tPrBkEFqzGowzCsIWsPjqSK+tyNEODUBXeeVHSkw==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [arm]
+    os: [linux]
+
+  lightningcss-linux-arm64-gnu@1.32.0:
+    resolution: {integrity: sha512-0nnMyoyOLRJXfbMOilaSRcLH3Jw5z9HDNGfT/gwCPgaDjnx0i8w7vBzFLFR1f6CMLKF8gVbebmkUN3fa/kQJpQ==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [arm64]
+    os: [linux]
+
+  lightningcss-linux-arm64-musl@1.32.0:
+    resolution: {integrity: sha512-UpQkoenr4UJEzgVIYpI80lDFvRmPVg6oqboNHfoH4CQIfNA+HOrZ7Mo7KZP02dC6LjghPQJeBsvXhJod/wnIBg==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [arm64]
+    os: [linux]
+
+  lightningcss-linux-x64-gnu@1.32.0:
+    resolution: {integrity: sha512-V7Qr52IhZmdKPVr+Vtw8o+WLsQJYCTd8loIfpDaMRWGUZfBOYEJeyJIkqGIDMZPwPx24pUMfwSxxI8phr/MbOA==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [x64]
+    os: [linux]
+
+  lightningcss-linux-x64-musl@1.32.0:
+    resolution: {integrity: sha512-bYcLp+Vb0awsiXg/80uCRezCYHNg1/l3mt0gzHnWV9XP1W5sKa5/TCdGWaR/zBM2PeF/HbsQv/j2URNOiVuxWg==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [x64]
+    os: [linux]
+
+  lightningcss-win32-arm64-msvc@1.32.0:
+    resolution: {integrity: sha512-8SbC8BR40pS6baCM8sbtYDSwEVQd4JlFTOlaD3gWGHfThTcABnNDBda6eTZeqbofalIJhFx0qKzgHJmcPTnGdw==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [arm64]
+    os: [win32]
+
+  lightningcss-win32-x64-msvc@1.32.0:
+    resolution: {integrity: sha512-Amq9B/SoZYdDi1kFrojnoqPLxYhQ4Wo5XiL8EVJrVsB8ARoC1PWW6VGtT0WKCemjy8aC+louJnjS7U18x3b06Q==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [x64]
+    os: [win32]
+
+  lightningcss@1.32.0:
+    resolution: {integrity: sha512-NXYBzinNrblfraPGyrbPoD19C1h9lfI/1mzgWYvXUTe414Gz/X1FD2XBZSZM7rRTrMA8JL3OtAaGifrIKhQ5yQ==}
+    engines: {node: '>= 12.0.0'}
+
+  lilconfig@2.1.0:
+    resolution: {integrity: sha512-utWOt/GHzuUxnLKxB6dk81RoOeoNeHgbrXiuGk4yyF5qlRz+iIVWu56E2fqGHFrXz0QNUhLB/8nKqvRH66JKGQ==}
+    engines: {node: '>=10'}
+
+  lilconfig@3.1.3:
+    resolution: {integrity: sha512-/vlFKAoH5Cgt3Ie+JLhRbwOsCQePABiU3tJ1egGvyQ+33R/vcwM2Zl2QR/LzjsBeItPt3oSVXapn+m4nQDvpzw==}
+    engines: {node: '>=14'}
+
+  lines-and-columns@1.2.4:
+    resolution: {integrity: sha512-7ylylesZQ/PV29jhEDl3Ufjo6ZX7gCqJr5F7PKrqc93v7fzSymt1BpwEU8nAUXs8qzzvqhbjhK5QZg6Mt/HkBg==}
+
+  linkify-it@3.0.3:
+    resolution: {integrity: sha512-ynTsyrFSdE5oZ/O9GEf00kPngmOfVwazR5GKDq6EYfhlpFug3J2zybX56a2PRRpc9P+FuSoGNAwjlbDs9jJBPQ==}
+
+  lint-staged@17.0.7:
+    resolution: {integrity: sha512-JrSobt+tW3rH8IOMi8tDZd3foorM5yPEkLD/V2NxobgHrFfHWGee4MOLVuZeScgxftEwbHrPHIFA/ZL+nUJeuA==}
+    engines: {node: '>=22.22.1'}
+    hasBin: true
+
+  listr2@10.2.1:
+    resolution: {integrity: sha512-7I5knELsJKTUjXG+A6BkKAiGkW1i25fNa/xlUl9hFtk15WbE9jndA89xu5FzQKrY5llajE1hfZZFMILXkDHk/Q==}
+    engines: {node: '>=22.13.0'}
+
+  loader-runner@4.3.2:
+    resolution: {integrity: sha512-DFEqQ3ihfS9blba08cLfYf1NRAIEm+dDjic073DRDc3/JspI/8wYmtDsHwd3+4hwvdxSK7PGaElfTmm0awWJ4w==}
+    engines: {node: '>=6.11.5'}
+
+  loader-utils@1.4.2:
+    resolution: {integrity: sha512-I5d00Pd/jwMD2QCduo657+YM/6L3KZu++pmX9VFncxaxvHcru9jx1lBaFft+r4Mt2jK0Yhp41XlRAihzPxHNCg==}
+    engines: {node: '>=4.0.0'}
+
+  loader-utils@3.2.2:
+    resolution: {integrity: sha512-vjJi4vQDasD8t0kMpxe+9URAcgbSuASqoj/Wuk3MawTk97LYa2KfdHreAkd1G/pmPLMvzZEw7/OsydADNemerQ==}
+    engines: {node: '>= 12.13.0'}
+
+  locate-path@5.0.0:
+    resolution: {integrity: sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g==}
+    engines: {node: '>=8'}
+
+  locate-path@6.0.0:
+    resolution: {integrity: sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw==}
+    engines: {node: '>=10'}
+
+  locate-path@7.2.0:
+    resolution: {integrity: sha512-gvVijfZvn7R+2qyPX8mAuKcFGDf6Nc61GdvGafQsHL0sBIxfKzA+usWn4GFC/bk+QdwPUD4kWFJLhElipq+0VA==}
+    engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
+
+  lodash-es@4.17.21:
+    resolution: {integrity: sha512-mKnC+QJ9pWVzv+C4/U3rRsHapFfHvQFoFB92e52xeyGMcX6/OlIl78je1u8vePzYZSkkogMPJ2yjxxsb89cxyw==}
+
+  lodash-webpack-plugin@0.11.6:
+    resolution: {integrity: sha512-nsHN/+IxZK/C425vGC8pAxkKJ8KQH2+NJnhDul14zYNWr6HJcA95w+oRR7Cp0oZpOdMplDZXmjVROp8prPk7ig==}
+    peerDependencies:
+      webpack: ^2.0.0 || ^3.0.0 || ^4.0.0 || ^5.1.0
+
+  lodash.debounce@4.0.8:
+    resolution: {integrity: sha512-FT1yDzDYEoYWhnSGnpE/4Kj1fLZkDFyqRb7fNt6FdYOSxlUWAtp42Eh6Wb0rGIv/m9Bgo7x4GhQbm5Ys4SG5ow==}
+
+  lodash.get@4.4.2:
+    resolution: {integrity: sha512-z+Uw/vLuy6gQe8cfaFWD7p0wVv8fJl3mbzXh33RS+0oW2wvUqiRXiQ69gLWSLpgB5/6sU+r6BlQR0MBILadqTQ==}
+
+  lodash.isequal@4.5.0:
+    resolution: {integrity: sha512-pDo3lu8Jhfjqls6GkMgpahsF9kCyayhgykjyLMNFTKWrpVdAQtYyB4muAMWozBB4ig/dtWAmsMxLEI8wuz+DYQ==}
+
+  lodash.memoize@4.1.2:
+    resolution: {integrity: sha512-t7j+NzmgnQzTAYXcsHYLgimltOV1MXHtlOWf6GjL9Kj8GK5FInw5JotxvbOs+IvV1/Dzo04/fCGfLVs7aXb4Ag==}
+
+  lodash.merge@4.6.2:
+    resolution: {integrity: sha512-0KpjqXRVvrYyCsX1swR/XTK0va6VQkQM6MNo7PqW77ByjAhoARA8EfrP1N4+KlKj8YS0ZUCtRT/YUuhyYDujIQ==}
+
+  lodash.uniq@4.5.0:
+    resolution: {integrity: sha512-xfBaXQd9ryd9dlSDvnvI0lvxfLJlYAZzXomUYzLKtUeOQvOP5piqAWuGtrhWeqaXK9hhoM/iyJc5AV+XfsX3HQ==}
+
+  lodash@4.17.23:
+    resolution: {integrity: sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==}
+
+  lodash@4.18.1:
+    resolution: {integrity: sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==}
+
+  log-update@6.1.0:
+    resolution: {integrity: sha512-9ie8ItPR6tjY5uYJh8K/Zrv/RMZ5VOlOWvtZdEHYSTFKZfIBPQa9tOAEeAWhd+AnIneLJ22w5fjOYtoutpWq5w==}
+    engines: {node: '>=18'}
+
+  loglevel@1.9.2:
+    resolution: {integrity: sha512-HgMmCqIJSAKqo68l0rS2AanEWfkxaZ5wNiEFb5ggm08lDs9Xl2KxBlX3PTcaD2chBM1gXAYf491/M2Rv8Jwayg==}
+    engines: {node: '>= 0.6.0'}
+
+  loose-envify@1.4.0:
+    resolution: {integrity: sha512-lyuxPGr/Wfhrlem2CL/UcnUc1zcqKAImBDzukY7Y5F/yQiNdko6+fRLevlw1HgMySw7f611UIY408EtxRSoK3Q==}
+    hasBin: true
+
+  loupe@3.2.1:
+    resolution: {integrity: sha512-CdzqowRJCeLU72bHvWqwRBBlLcMEtIvGrlvef74kMnV2AolS9Y8xUv1I0U/MNAWMhBlKIoyuEgoJ0t/bbwHbLQ==}
+
+  lower-case@2.0.2:
+    resolution: {integrity: sha512-7fm3l3NAF9WfN6W3JOmf5drwpVqX78JtoGJ3A6W0a6ZnldM41w2fV5D490psKFTpMds8TJse/eHLFFsNHHjHgg==}
+
+  lru-cache@5.1.1:
+    resolution: {integrity: sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w==}
+
+  lucide-react@0.577.0:
+    resolution: {integrity: sha512-4LjoFv2eEPwYDPg/CUdBJQSDfPyzXCRrVW1X7jrx/trgxnxkHFjnVZINbzvzxjN70dxychOfg+FTYwBiS3pQ5A==}
+    peerDependencies:
+      react: ^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0
+
+  lz-string@1.5.0:
+    resolution: {integrity: sha512-h5bgJWpxJNswbU7qCrV0tIKQCaS3blPDrqKWx+QxzuzL1zGUzij9XCWLrSLsJPu5t+eWA/ycetzYAO5IOMcWAQ==}
+    hasBin: true
+
+  magic-string@0.30.21:
+    resolution: {integrity: sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==}
+
+  magicast@0.5.2:
+    resolution: {integrity: sha512-E3ZJh4J3S9KfwdjZhe2afj6R9lGIN5Pher1pF39UGrXRqq/VDaGVIGN13BjHd2u8B61hArAGOnso7nBOouW3TQ==}
+
+  make-dir@2.1.0:
+    resolution: {integrity: sha512-LS9X+dc8KLxXCb8dni79fLIIUA5VyZoyjSMCwTluaXA0o27cCK0bhXkpgw+sTXVpPy/lSO57ilRixqk0vDmtRA==}
+    engines: {node: '>=6'}
+
+  make-dir@3.1.0:
+    resolution: {integrity: sha512-g3FeP20LNwhALb/6Cz6Dd4F2ngze0jz7tbzrD2wAV+o9FeNHe4rL+yK2md0J/fiSf1sa1ADhXqi5+oVwOM/eGw==}
+    engines: {node: '>=8'}
+
+  make-dir@4.0.0:
+    resolution: {integrity: sha512-hXdUTZYIVOt1Ex//jAQi+wTZZpUpwBj/0QsOzqegb3rGMMeJiSEu5xLHnYfBrRV4RH2+OCSOO95Is/7x1WJ4bw==}
+    engines: {node: '>=10'}
+
+  make-event-props@1.6.2:
+    resolution: {integrity: sha512-iDwf7mA03WPiR8QxvcVHmVWEPfMY1RZXerDVNCRYW7dUr2ppH3J58Rwb39/WG39yTZdRSxr3x+2v22tvI0VEvA==}
+
+  markdown-it@12.3.2:
+    resolution: {integrity: sha512-TchMembfxfNVpHkbtriWltGWc+m3xszaRD0CZup7GFFhzIgQqxIfn3eGj1yZpfuflzPvfkt611B2Q/Bsk1YnGg==}
+    hasBin: true
+
+  markdown-to-jsx@7.7.4:
+    resolution: {integrity: sha512-1bSfXyBKi+EYS3YY+e0Csuxf8oZ3decdfhOav/Z7Wrk89tjudyL5FOmwZQUoy0/qVXGUl+6Q3s2SWtpDEWITfQ==}
+    engines: {node: '>= 10'}
+    peerDependencies:
+      react: '>= 0.14.0'
+
+  math-intrinsics@1.1.0:
+    resolution: {integrity: sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==}
+    engines: {node: '>= 0.4'}
+
+  mdast-util-to-hast@13.2.0:
+    resolution: {integrity: sha512-QGYKEuUsYT9ykKBCMOEDLsU5JRObWQusAolFMeko/tYPufNkRffBAQjIE+99jbA87xv6FgmjLtwjh9wBWajwAA==}
+
+  mdn-data@2.0.28:
+    resolution: {integrity: sha512-aylIc7Z9y4yzHYAJNuESG3hfhC+0Ibp/MAMiaOZgNv4pmEdFyfZhhhny4MNiAfWdBQ1RQ2mfDWmM1x8SvGyp8g==}
+
+  mdn-data@2.0.30:
+    resolution: {integrity: sha512-GaqWWShW4kv/G9IEucWScBx9G1/vsFZZJUO+tD26M8J8z3Kw5RDQjaoZe03YAClgeS/SWPOcb4nkFBTEi5DUEA==}
+
+  mdn-data@2.27.1:
+    resolution: {integrity: sha512-9Yubnt3e8A0OKwxYSXyhLymGW4sCufcLG6VdiDdUGVkPhpqLxlvP5vl1983gQjJl3tqbrM731mjaZaP68AgosQ==}
+
+  mdurl@1.0.1:
+    resolution: {integrity: sha512-/sKlQJCBYVY9Ers9hqzKou4H6V5UWc/M59TH2dvkt+84itfnq7uFOMLpOiOS4ujvHP4etln18fmIxA5R5fll0g==}
+
+  media-typer@0.3.0:
+    resolution: {integrity: sha512-dq+qelQ9akHpcOl/gUVRTxVIOkAJ1wR3QAvb4RsVjS8oVoFjDGTc679wJYmUmknUF5HwMLOgb5O+a3KxfWapPQ==}
+    engines: {node: '>= 0.6'}
+
+  memfs@3.6.0:
+    resolution: {integrity: sha512-EGowvkkgbMcIChjMTMkESFDbZeSh8xZ7kNSF0hAiAN4Jh6jgHCRS0Ga/+C8y6Au+oqpezRHCfPsmJ2+DwAgiwQ==}
+    engines: {node: '>= 4.0.0'}
+
+  memfs@4.56.10:
+    resolution: {integrity: sha512-eLvzyrwqLHnLYalJP7YZ3wBe79MXktMdfQbvMrVD80K+NhrIukCVBvgP30zTJYEEDh9hZ/ep9z0KOdD7FSHo7w==}
+    peerDependencies:
+      tslib: '2'
+
+  memoize-one@6.0.0:
+    resolution: {integrity: sha512-rkpe71W0N0c0Xz6QD0eJETuWAJGnJ9afsl1srmwPrI+yBCkge5EycXXbYRyvL29zZVUWQCY7InPRCv3GDXuZNw==}
+
+  merge-descriptors@1.0.3:
+    resolution: {integrity: sha512-gaNvAS7TZ897/rVaZ0nMtAyxNyi/pdbjbAwUpFQpN70GqnVfOiXpeUUMKRBmzXaSQ8DdTX4/0ms62r2K+hE6mQ==}
+
+  merge-stream@2.0.0:
+    resolution: {integrity: sha512-abv/qOcuPfk3URPfDzmZU1LKmuw8kT+0nIHvKrKgFrwifol/doWcdA4ZqsWQ8ENrFKkd67Mfpo/LovbIUsbt3w==}
+
+  merge2@1.4.1:
+    resolution: {integrity: sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==}
+    engines: {node: '>= 8'}
+
+  methods@1.1.2:
+    resolution: {integrity: sha512-iclAHeNqNm68zFtnZ0e+1L2yUIdvzNoauKU4WBA3VvH/vPFieF7qfRlwUZU+DA9P9bPXIS90ulxoUoCH23sV2w==}
+    engines: {node: '>= 0.6'}
+
+  micromark-util-character@2.1.1:
+    resolution: {integrity: sha512-wv8tdUTJ3thSFFFJKtpYKOYiGP2+v96Hvk4Tu8KpCAsTMs6yi+nVmGh1syvSCsaxz45J6Jbw+9DD6g97+NV67Q==}
+
+  micromark-util-encode@2.0.1:
+    resolution: {integrity: sha512-c3cVx2y4KqUnwopcO9b/SCdo2O67LwJJ/UyqGfbigahfegL9myoEFoDYZgkT7f36T0bLrM9hZTAaAyH+PCAXjw==}
+
+  micromark-util-sanitize-uri@2.0.1:
+    resolution: {integrity: sha512-9N9IomZ/YuGGZZmQec1MbgxtlgougxTodVwDzzEouPKo3qFWvymFHWcnDi2vzV1ff6kas9ucW+o3yzJK9YB1AQ==}
+
+  micromark-util-symbol@2.0.1:
+    resolution: {integrity: sha512-vs5t8Apaud9N28kgCrRUdEed4UJ+wWNvicHLPxCa9ENlYuAY31M0ETy5y1vA33YoNPDFTghEbnh6efaE8h4x0Q==}
+
+  micromark-util-types@2.0.2:
+    resolution: {integrity: sha512-Yw0ECSpJoViF1qTU4DC6NwtC4aWGt1EkzaQB8KPPyCRR8z9TWeV0HbEFGTO+ZY1wB22zmxnJqhPyTpOVCpeHTA==}
+
+  micromatch@4.0.8:
+    resolution: {integrity: sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==}
+    engines: {node: '>=8.6'}
+
+  mime-db@1.52.0:
+    resolution: {integrity: sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==}
+    engines: {node: '>= 0.6'}
+
+  mime-db@1.54.0:
+    resolution: {integrity: sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==}
+    engines: {node: '>= 0.6'}
+
+  mime-types@2.1.35:
+    resolution: {integrity: sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==}
+    engines: {node: '>= 0.6'}
+
+  mime-types@3.0.2:
+    resolution: {integrity: sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==}
+    engines: {node: '>=18'}
+
+  mime@1.6.0:
+    resolution: {integrity: sha512-x0Vn8spI+wuJ1O6S7gnbaQg8Pxh4NNHb7KSINmEWKiPE4RKOplvijn+NkmYmmRgP68mc70j2EbeTFRsrswaQeg==}
+    engines: {node: '>=4'}
+    hasBin: true
+
+  mimic-function@5.0.1:
+    resolution: {integrity: sha512-VP79XUPxV2CigYP3jWwAUFSku2aKqBH7uTAapFWCBqutsbmDo96KY5o8uh6U+/YSIn5OxJnXp73beVkpqMIGhA==}
+    engines: {node: '>=18'}
+
+  min-indent@1.0.1:
+    resolution: {integrity: sha512-I9jwMn07Sy/IwOj3zVkVik2JTvgpaykDZEigL6Rx6N9LbMywwUSMtxET+7lVoDLLd3O3IXwJwvuuns8UB/HeAg==}
+    engines: {node: '>=4'}
+
+  mini-css-extract-plugin@2.7.6:
+    resolution: {integrity: sha512-Qk7HcgaPkGG6eD77mLvZS1nmxlao3j+9PkrT9Uc7HAE1id3F41+DdBRYRYkbyfNRGzm8/YWtzhw7nVPmwhqTQw==}
+    engines: {node: '>= 12.13.0'}
+    peerDependencies:
+      webpack: ^5.0.0
+
+  minimalistic-assert@1.0.1:
+    resolution: {integrity: sha512-UtJcAD4yEaGtjPezWuO9wC4nwUnVH/8/Im3yEHQP4b67cXlD/Qr9hdITCU1xDbSEXg2XKNaP8jsReV7vQd00/A==}
+
+  minimatch@10.2.5:
+    resolution: {integrity: sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==}
+    engines: {node: 18 || 20 || >=22}
+
+  minimatch@3.1.5:
+    resolution: {integrity: sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==}
+
+  minimist@1.2.8:
+    resolution: {integrity: sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==}
+
+  moment-timezone@0.6.2:
+    resolution: {integrity: sha512-lDsQv8FoGdBUdf0+TjGsq2orxKuXdwFlQ6Zw6TX3xIcTwTfEpCLyKqvEauvCHJ8iu3KBV8+uPhlv70YsNGdUBQ==}
+
+  moment@2.30.1:
+    resolution: {integrity: sha512-uEmtNhbDOrWPFS+hdjFCBfy9f2YoyzRpwcl+DqpC6taX21FzsTLQVbMV/W7PzNSX6x/bhC1zA3c2UQ5NzH6how==}
+
+  moo@0.5.2:
+    resolution: {integrity: sha512-iSAJLHYKnX41mKcJKjqvnAN9sf0LMDTXDEvFv+ffuRR9a1MIuXLjMNL6EsnDHSkKLTWNqQQ5uo61P4EbU4NU+Q==}
+
+  mrmime@2.0.1:
+    resolution: {integrity: sha512-Y3wQdFg2Va6etvQ5I82yUhGdsKrcYox6p7FfL1LbK2J4V01F9TGlepTIhnK24t7koZibmg82KGglhA1XK5IsLQ==}
+    engines: {node: '>=10'}
+
+  ms@2.0.0:
+    resolution: {integrity: sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==}
+
+  ms@2.1.3:
+    resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==}
+
+  msw-storybook-addon@2.0.7:
+    resolution: {integrity: sha512-TGmlxXy2TsaB6QcClVKRxqvay5f93xoLguHOihRFQ+gIEIyiyvcoQjkEeuOe7Y9qvddzGB1LyFomzPo9/EpnuQ==}
+    peerDependencies:
+      msw: ^2.0.0
+
+  msw@2.14.6:
+    resolution: {integrity: sha512-ALe+N10S72cyx94cMcy3Zs4HhXCj35sgeAL4c+WTvKi0zWnbd8/h0lcFqv0mb2P+aSgAdD7p9HzvA0DiUPxsyg==}
+    engines: {node: '>=18'}
+    hasBin: true
+    peerDependencies:
+      typescript: '>= 4.8.x'
+    peerDependenciesMeta:
+      typescript:
+        optional: true
+
+  multicast-dns@7.2.5:
+    resolution: {integrity: sha512-2eznPJP8z2BFLX50tf0LuODrpINqP1RVIm/CObbTcBRITQgmC/TjcREF1NeTBzIcR5XO/ukWo+YHOjBbFwIupg==}
+    hasBin: true
+
+  mustache@4.2.0:
+    resolution: {integrity: sha512-71ippSywq5Yb7/tVYyGbkBggbU8H3u5Rz56fH60jGFgr8uHwxs+aSKeqmluIVzM0m0kB7xQjKS6qPfd0b2ZoqQ==}
+    hasBin: true
+
+  mute-stream@3.0.0:
+    resolution: {integrity: sha512-dkEJPVvun4FryqBmZ5KhDo0K9iDXAwn08tMLDinNdRBNPcYEDiWYysLcc6k3mjTMlbP9KyylvRpd4wFtwrT9rw==}
+    engines: {node: ^20.17.0 || >=22.9.0}
+
+  mz@2.7.0:
+    resolution: {integrity: sha512-z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==}
+
+  nanoclone@0.2.1:
+    resolution: {integrity: sha512-wynEP02LmIbLpcYw8uBKpcfF6dmg2vcpKqxeH5UcoKEYdExslsdUA4ugFauuaeYdTB76ez6gJW8XAZ6CgkXYxA==}
+
+  nanoid@3.3.12:
+    resolution: {integrity: sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==}
+    engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
+    hasBin: true
+
+  napi-postinstall@0.3.4:
+    resolution: {integrity: sha512-PHI5f1O0EP5xJ9gQmFGMS6IZcrVvTjpXjz7Na41gTE7eE2hK11lg04CECCYEEjdc17EV4DO+fkGEtt7TpTaTiQ==}
+    engines: {node: ^12.20.0 || ^14.18.0 || >=16.0.0}
+    hasBin: true
+
+  natural-compare@1.4.0:
+    resolution: {integrity: sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==}
+
+  nearley@2.20.1:
+    resolution: {integrity: sha512-+Mc8UaAebFzgV+KpI5n7DasuuQCHA89dmwm7JXw3TV43ukfNQ9DnBH3Mdb2g/I4Fdxc26pwimBWvjIw0UAILSQ==}
+    hasBin: true
+
+  needle@3.3.1:
+    resolution: {integrity: sha512-6k0YULvhpw+RoLNiQCRKOl09Rv1dPLr8hHnVjHqdolKwDrdNyk+Hmrthi4lIGPPz3r39dLx0hsF5s40sZ3Us4Q==}
+    engines: {node: '>= 4.4.x'}
+    hasBin: true
+
+  negotiator@0.6.3:
+    resolution: {integrity: sha512-+EUsqGPLsM+j/zdChZjsnX51g4XrHFOIXwfnCVPGlQk/k5giakcKsuxCObBRu6DSm9opw/O6slWbJdghQM4bBg==}
+    engines: {node: '>= 0.6'}
+
+  negotiator@0.6.4:
+    resolution: {integrity: sha512-myRT3DiWPHqho5PrJaIRyaMv2kgYf0mUVgBNOYMuCH5Ki1yEiQaf/ZJuQ62nvpc44wL5WDbTX7yGJi1Neevw8w==}
+    engines: {node: '>= 0.6'}
+
+  neo-async@2.6.2:
+    resolution: {integrity: sha512-Yd3UES5mWCSqR+qNT93S3UoYUkqAZ9lLg8a7g9rimsWmYGK8cVToA4/sF3RrshdyV3sAGMXVUmpMYOw+dLpOuw==}
+
+  ng-file-upload@12.2.13:
+    resolution: {integrity: sha512-YFjxwmVcNssYc8hq8eCbtYSliPnrObozSZRC9yg4GoDtI0xGKUeHgEcOh+nsMF/9cTzMB/lQZAYdf29oyQgF0g==}
+
+  ngtemplate-loader@2.1.0:
+    resolution: {integrity: sha512-8t1a2YOb1vk1A4C74o1ru+T7UeyKDdABWXtGDkjBupmOaV/RPCXjLLF4UZMI45Lfpebkr2p4NlVSROXRshkIhg==}
+
+  no-case@3.0.4:
+    resolution: {integrity: sha512-fgAN3jGAh+RoxUGZHTSOLJIqUc2wmoBwGR4tbpNAKmmovFoWq0OdRkb0VkldReO2a2iBT/OEulG9XSUc10r3zg==}
+
+  node-abort-controller@3.1.1:
+    resolution: {integrity: sha512-AGK2yQKIjRuqnc6VkX2Xj5d+QW8xZ87pa1UK6yA6ouUyuxfHuMP6umE5QK7UmTeOAymo+Zx1Fxiuw9rVx8taHQ==}
+
+  node-exports-info@1.6.0:
+    resolution: {integrity: sha512-pyFS63ptit/P5WqUkt+UUfe+4oevH+bFeIiPPdfb0pFeYEu/1ELnJu5l+5EcTKYL5M7zaAa7S8ddywgXypqKCw==}
+    engines: {node: '>= 0.4'}
+
+  node-fetch-h2@2.3.0:
+    resolution: {integrity: sha512-ofRW94Ab0T4AOh5Fk8t0h8OBWrmjb0SSB20xh1H8YnPV9EJ+f5AMoYSUQ2zgJ4Iq2HAK0I2l5/Nequ8YzFS3Hg==}
+    engines: {node: 4.x || >=6.0.0}
+
+  node-fetch@2.7.0:
+    resolution: {integrity: sha512-c4FRfUm/dbcWZ7U+1Wq0AwCyFL+3nt2bEw05wfxSz+DWpWsitgmSgYmy2dQdWyKC1694ELPqMs/YzUSNozLt8A==}
+    engines: {node: 4.x || >=6.0.0}
+    peerDependencies:
+      encoding: ^0.1.0
+    peerDependenciesMeta:
+      encoding:
+        optional: true
+
+  node-notifier@10.0.1:
+    resolution: {integrity: sha512-YX7TSyDukOZ0g+gmzjB6abKu+hTGvO8+8+gIFDsRCU2t8fLV/P2unmt+LGFaIa4y64aX98Qksa97rgz4vMNeLQ==}
+
+  node-readfiles@0.2.0:
+    resolution: {integrity: sha512-SU00ZarexNlE4Rjdm83vglt5Y9yiQ+XI1XpflWlb7q7UTN1JUItm69xMeiQCTxtTfnzt+83T8Cx+vI2ED++VDA==}
+
+  node-releases@2.0.46:
+    resolution: {integrity: sha512-GYVXHE2KnrzAfsAjl4uP++evGFCrAU1jta4ubEjIG7YWt/64Gqv66a30yKwWczVjA6j3bM4nBwH7Pk1JmDHaxQ==}
+    engines: {node: '>=18'}
+
+  normalize-path@3.0.0:
+    resolution: {integrity: sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA==}
+    engines: {node: '>=0.10.0'}
+
+  nth-check@2.1.1:
+    resolution: {integrity: sha512-lqjrjmaOoAnWfMmBPL+XNnynZh2+swxiX3WUE0s4yEHI6m+AwrK2UZOimIRl3X/4QctVqS8AiZjFqyOGrMXb/w==}
+
+  nwsapi@2.2.22:
+    resolution: {integrity: sha512-ujSMe1OWVn55euT1ihwCI1ZcAaAU3nxUiDwfDQldc51ZXaB9m2AyOn6/jh1BLe2t/G8xd6uKG1UBF2aZJeg2SQ==}
+
+  oas-kit-common@1.0.8:
+    resolution: {integrity: sha512-pJTS2+T0oGIwgjGpw7sIRU8RQMcUoKCDWFLdBqKB2BNmGpbBMH2sdqAaOXUg8OzonZHU0L7vfJu1mJFEiYDWOQ==}
+
+  oas-linter@3.2.2:
+    resolution: {integrity: sha512-KEGjPDVoU5K6swgo9hJVA/qYGlwfbFx+Kg2QB/kd7rzV5N8N5Mg6PlsoCMohVnQmo+pzJap/F610qTodKzecGQ==}
+
+  oas-resolver@2.5.6:
+    resolution: {integrity: sha512-Yx5PWQNZomfEhPPOphFbZKi9W93CocQj18NlD2Pa4GWZzdZpSJvYwoiuurRI7m3SpcChrnO08hkuQDL3FGsVFQ==}
+    hasBin: true
+
+  oas-schema-walker@1.1.5:
+    resolution: {integrity: sha512-2yucenq1a9YPmeNExoUa9Qwrt9RFkjqaMAA1X+U7sbb0AqBeTIdMHky9SQQ6iN94bO5NW0W4TRYXerG+BdAvAQ==}
+
+  oas-validator@5.0.8:
+    resolution: {integrity: sha512-cu20/HE5N5HKqVygs3dt94eYJfBi0TsZvPVXDhbXQHiEityDN+RROTleefoKRKKJ9dFAF2JBkDHgvWj0sjKGmw==}
+
+  object-assign@4.1.1:
+    resolution: {integrity: sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==}
+    engines: {node: '>=0.10.0'}
+
+  object-code@2.0.0:
+    resolution: {integrity: sha512-qOwMF43O/VAD51nJAB7MKsf1yWksql6O1i0DHRo1yaOQM6xJQH0NAE9UKJzYB7lyKw1jnpeb2BmB8qakjxiYZA==}
+
+  object-hash@3.0.0:
+    resolution: {integrity: sha512-RSn9F68PjH9HqtltsSnqYC1XXoWe9Bju5+213R98cNGttag9q9yAOTzdbsqvIa7aNm5WffBZFpWYr2aWrklWAw==}
+    engines: {node: '>= 6'}
+
+  object-inspect@1.13.4:
+    resolution: {integrity: sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==}
+    engines: {node: '>= 0.4'}
+
+  object-is@1.1.5:
+    resolution: {integrity: sha512-3cyDsyHgtmi7I7DfSSI2LDp6SK2lwvtbg0p0R1e0RvTqF5ceGx+K2dfSjm1bKDMVCFEDAQvy+o8c6a7VujOddw==}
+    engines: {node: '>= 0.4'}
+
+  object-keys@1.1.1:
+    resolution: {integrity: sha512-NuAESUOUMrlIXOfHKzD6bpPu3tYt3xvjNdRIQ+FeT0lNb4K8WR70CaDxhuNguS2XG+GjkyMwOzsN5ZktImfhLA==}
+    engines: {node: '>= 0.4'}
+
+  object.assign@4.1.7:
+    resolution: {integrity: sha512-nK28WOo+QIjBkDduTINE4JkF/UJJKyf2EJxvJKfblDpyg0Q+pkOHNTL0Qwy6NP6FhE/EnzV73BxxqcJaXY9anw==}
+    engines: {node: '>= 0.4'}
+
+  object.entries@1.1.9:
+    resolution: {integrity: sha512-8u/hfXFRBD1O0hPUjioLhoWFHRmt6tKA4/vZPyckBr18l1KE9uHrFaFaUi8MDRTpi4uak2goyPTSNJLXX2k2Hw==}
+    engines: {node: '>= 0.4'}
+
+  object.fromentries@2.0.8:
+    resolution: {integrity: sha512-k6E21FzySsSK5a21KRADBd/NGneRegFO5pLHfdQLpRDETUNJueLXs3WCzyQ3tFRDYgbq3KHGXfTbi2bs8WQ6rQ==}
+    engines: {node: '>= 0.4'}
+
+  object.groupby@1.0.3:
+    resolution: {integrity: sha512-+Lhy3TQTuzXI5hevh8sBGqbmurHbbIjAi0Z4S63nthVLmLxfbj4T54a4CfZrXIrt9iP4mVAPYMo/v99taj3wjQ==}
+    engines: {node: '>= 0.4'}
+
+  object.values@1.2.1:
+    resolution: {integrity: sha512-gXah6aZrcUxjWg2zR2MwouP2eHlCBzdV4pygudehaKXSGW4v2AsRQUK+lwwXhii6KFZcunEnmSUoYp5CXibxtA==}
+    engines: {node: '>= 0.4'}
+
+  objectorarray@1.0.5:
+    resolution: {integrity: sha512-eJJDYkhJFFbBBAxeh8xW+weHlkI28n2ZdQV/J/DNfWfSKlGEf2xcfAbZTv3riEXHAhL9SVOTs2pRmXiSTf78xg==}
+
+  obuf@1.1.2:
+    resolution: {integrity: sha512-PX1wu0AmAdPqOL1mWhqmlOd8kOIZQwGZw6rh7uby9fTc5lhaOWFLX3I6R1hrF9k3zUY40e6igsLGkDXK92LJNg==}
+
+  obug@2.1.1:
+    resolution: {integrity: sha512-uTqF9MuPraAQ+IsnPf366RG4cP9RtUi7MLO1N3KEc+wb0a6yKpeL0lmk2IB1jY5KHPAlTc6T/JRdC/YqxHNwkQ==}
+
+  ohash@2.0.11:
+    resolution: {integrity: sha512-RdR9FQrFwNBNXAr4GixM8YaRZRJ5PUWbKYbE5eOsrwAjJW0q2REGcf79oYPsLyskQCZG1PLN+S/K1V00joZAoQ==}
+
+  on-finished@2.4.1:
+    resolution: {integrity: sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==}
+    engines: {node: '>= 0.8'}
+
+  on-headers@1.1.0:
+    resolution: {integrity: sha512-737ZY3yNnXy37FHkQxPzt4UZ2UWPWiCZWLvFZ4fu5cueciegX0zGPnrlY6bwRg4FdQOe9YU8MkmJwGhoMybl8A==}
+    engines: {node: '>= 0.8'}
+
+  once@1.4.0:
+    resolution: {integrity: sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==}
+
+  onetime@7.0.0:
+    resolution: {integrity: sha512-VXJjc87FScF88uafS3JllDgvAm+c/Slfz06lorj2uAY34rlUu0Nt+v8wreiImcrgAjjIHp1rXpTDlLOGw29WwQ==}
+    engines: {node: '>=18'}
+
+  oniguruma-to-es@2.3.0:
+    resolution: {integrity: sha512-bwALDxriqfKGfUufKGGepCzu9x7nJQuoRoAFp4AnwehhC2crqrDIAP/uN2qdlsAvSMpeRC3+Yzhqc7hLmle5+g==}
+
+  open@10.2.0:
+    resolution: {integrity: sha512-YgBpdJHPyQ2UE5x+hlSXcnejzAvD0b22U2OuAP+8OnlJT+PjWPxtgmGqKKc+RgTM63U9gN0YzrYc71R2WT/hTA==}
+    engines: {node: '>=18'}
+
+  open@11.0.0:
+    resolution: {integrity: sha512-smsWv2LzFjP03xmvFoJ331ss6h+jixfA4UUV/Bsiyuu4YJPfN+FIQGOIiv4w9/+MoHkfkJ22UIaQWRVFRfH6Vw==}
+    engines: {node: '>=20'}
+
+  openapi-types@12.1.3:
+    resolution: {integrity: sha512-N4YtSYJqghVu4iek2ZUvcN/0aqH1kRDuNqzcycDxhOUpg7GdvLa2F3DgS6yBNhInhv2r/6I0Flkn7CqL8+nIcw==}
+
+  opener@1.5.2:
+    resolution: {integrity: sha512-ur5UIdyw5Y7yEj9wLzhqXiy6GZ3Mwx0yGI+5sMn2r0N0v3cKJvUmFH5yPP+WXh9e0xfyzyJX95D8l088DNFj7A==}
+    hasBin: true
+
+  optionator@0.9.3:
+    resolution: {integrity: sha512-JjCoypp+jKn1ttEFExxhetCKeJt9zhAgAve5FXHixTvFDW/5aEktX9bufBKLRRMdU7bNtpLfcGu94B3cdEJgjg==}
+    engines: {node: '>= 0.8.0'}
+
+  outvariant@1.4.3:
+    resolution: {integrity: sha512-+Sl2UErvtsoajRDKCE5/dBz4DIvHXQQnAxtQTF04OJxY0+DyZXSo5P5Bb7XYWOh81syohlYL24hbDwxedPUJCA==}
+
+  own-keys@1.0.1:
+    resolution: {integrity: sha512-qFOyK5PjiWZd+QQIh+1jhdb9LpxTF0qs7Pm8o5QHYZ0M3vKqSqzsZaEB6oWlxZ+q2sJBMI/Ktgd2N5ZwQoRHfg==}
+    engines: {node: '>= 0.4'}
+
+  oxc-parser@0.127.0:
+    resolution: {integrity: sha512-bkgD4qHlN7WxLdX8bLXdaU54TtQtAIg/ZBAfm0aje/mo3MRDo3P0hZSgr4U7O3xfX+fQmR5AP04JS/TGcZLcFA==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+
+  oxc-resolver@11.20.0:
+    resolution: {integrity: sha512-CblytBiV/a/ZXY34dsVU2NxhIOxMXst8CvDCtyBelVITgd7PLrKzbEbA6oKLdPjvDKDzCiW48qzmzZ+mYaqn+g==}
+
+  p-limit@2.3.0:
+    resolution: {integrity: sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==}
+    engines: {node: '>=6'}
+
+  p-limit@3.1.0:
+    resolution: {integrity: sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ==}
+    engines: {node: '>=10'}
+
+  p-limit@4.0.0:
+    resolution: {integrity: sha512-5b0R4txpzjPWVw/cXXUResoD4hb6U/x9BH08L7nw+GN1sezDzPdxeRvpc9c433fZhBan/wusjbCsqwqm4EIBIQ==}
+    engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
+
+  p-locate@4.1.0:
+    resolution: {integrity: sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A==}
+    engines: {node: '>=8'}
+
+  p-locate@5.0.0:
+    resolution: {integrity: sha512-LaNjtRWUBY++zB5nE/NwcaoMylSPk+S+ZHNB1TzdbMJMny6dynpAGt7X/tl/QYq3TIeE6nxHppbo2LGymrG5Pw==}
+    engines: {node: '>=10'}
+
+  p-locate@6.0.0:
+    resolution: {integrity: sha512-wPrq66Llhl7/4AGC6I+cqxT07LhXvWL08LNXz1fENOw0Ap4sRZZ/gZpTTJ5jpurzzzfS2W/Ge9BY3LgLjCShcw==}
+    engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
+
+  p-map@2.1.0:
+    resolution: {integrity: sha512-y3b8Kpd8OAN444hxfBbFfj1FY/RjtTd8tzYwhUqNYXx0fXx2iX4maP4Qr6qhIKbQXI02wTLAda4fYUbDagTUFw==}
+    engines: {node: '>=6'}
+
+  p-retry@6.2.1:
+    resolution: {integrity: sha512-hEt02O4hUct5wtwg4H4KcWgDdm+l1bOaEy/hWzd8xtXB9BqxTWBBhb+2ImAtH4Cv4rPjV76xN3Zumqk3k3AhhQ==}
+    engines: {node: '>=16.17'}
+
+  p-try@2.2.0:
+    resolution: {integrity: sha512-R4nPAVTAU0B9D35/Gk3uJf/7XYbQcyohSKdvAxIRSNghFl4e71hVoGnBNQz9cWaXxO2I10KTC+3jMdvvoKw6dQ==}
+    engines: {node: '>=6'}
+
+  param-case@3.0.4:
+    resolution: {integrity: sha512-RXlj7zCYokReqWpOPH9oYivUzLYZ5vAPIfEmCTNViosC78F8F0H9y7T7gG2M39ymgutxF5gcFEsyZQSph9Bp3A==}
+
+  parent-module@1.0.1:
+    resolution: {integrity: sha512-GQ2EWRpQV8/o+Aw8YqtfZZPfNRWZYkbidE9k5rpl/hC3vtHHBfGm2Ifi6qWV+coDGkrUKZAxE3Lot5kcsRlh+g==}
+    engines: {node: '>=6'}
+
+  parse-duration@2.1.4:
+    resolution: {integrity: sha512-b98m6MsCh+akxfyoz9w9dt0AlH2dfYLOBss5SdDsr9pkhKNvkWBXU/r8A4ahmIGByBOLV2+4YwfCuFxbDDaGyg==}
+
+  parse-json@5.2.0:
+    resolution: {integrity: sha512-ayCKvm/phCGxOkYRSCM82iDwct8/EonSEgCSxWxD7ve6jHggsFl4fZVQBPRNgQoKiuV/odhFrGzQXZwbifC8Rg==}
+    engines: {node: '>=8'}
+
+  parse-node-version@1.0.1:
+    resolution: {integrity: sha512-3YHlOa/JgH6Mnpr05jP9eDG254US9ek25LyIxZlDItp2iJtwyaXQb57lBYLdT3MowkUFYEV2XXNAYIPlESvJlA==}
+    engines: {node: '>= 0.10'}
+
+  parse-srcset@1.0.2:
+    resolution: {integrity: sha512-/2qh0lav6CmI15FzA3i/2Bzk2zCgQhGMkvhOhKNcBVQ1ldgpbfiNTVslmooUmWJcADi1f1kIeynbDRVzNlfR6Q==}
+
+  parse5@7.1.2:
+    resolution: {integrity: sha512-Czj1WaSVpaoj0wbhMzLmWD69anp2WH7FXMB9n1Sy8/ZFF9jolSQVMu1Ij5WIyGmcBmhk7EOndpO4mIpihVqAXw==}
+
+  parseurl@1.3.3:
+    resolution: {integrity: sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==}
+    engines: {node: '>= 0.8'}
+
+  pascal-case@3.1.2:
+    resolution: {integrity: sha512-uWlGT3YSnK9x3BQJaOdcZwrnV6hPpd8jFH1/ucpiLRPh/2zCVJKS19E4GvYHvaCcACn3foXZ0cLB9Wrx1KGe5g==}
+
+  path-exists@4.0.0:
+    resolution: {integrity: sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==}
+    engines: {node: '>=8'}
+
+  path-exists@5.0.0:
+    resolution: {integrity: sha512-RjhtfwJOxzcFmNOi6ltcbcu4Iu+FL3zEj83dk4kAS+fVpTxXLO1b38RvJgT/0QwvV/L3aY9TAnyv0EOqW4GoMQ==}
+    engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
+
+  path-is-absolute@1.0.1:
+    resolution: {integrity: sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==}
+    engines: {node: '>=0.10.0'}
+
+  path-is-inside@1.0.2:
+    resolution: {integrity: sha512-DUWJr3+ULp4zXmol/SZkFf3JGsS9/SIv+Y3Rt93/UjPpDpklB5f1er4O3POIbUuUJ3FXgqte2Q7SrU6zAqwk8w==}
+
+  path-key@3.1.1:
+    resolution: {integrity: sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==}
+    engines: {node: '>=8'}
+
+  path-parse@1.0.7:
+    resolution: {integrity: sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==}
+
+  path-to-regexp@0.1.12:
+    resolution: {integrity: sha512-RA1GjUVMnvYFxuqovrEqZoxxW5NUZqbwKtYz/Tt7nXerk0LbLblQmrsgdeOxV5SFHf0UDggjS/bSeOZwt1pmEQ==}
+
+  path-to-regexp@6.3.0:
+    resolution: {integrity: sha512-Yhpw4T9C6hPpgPeA28us07OJeqZ5EzQTkbfwuhsUg0c237RomFoETJgmp2sa3F/41gfLE6G5cqcYwznmeEeOlQ==}
+
+  path-type@4.0.0:
+    resolution: {integrity: sha512-gDKb8aZMDeD/tZWs9P6+q0J9Mwkdl6xMV8TjnGP3qJVJ06bdMgkbBlLU8IdfOsIsFz2BW1rNVT3XuNEl8zPAvw==}
+    engines: {node: '>=8'}
+
+  pathe@2.0.3:
+    resolution: {integrity: sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==}
+
+  pathval@2.0.1:
+    resolution: {integrity: sha512-//nshmD55c46FuFw26xV/xFAaB5HF9Xdap7HJBBnrKdAd6/GxDBaNA1870O79+9ueg61cZLSVc+OaFlfmObYVQ==}
+    engines: {node: '>= 14.16'}
+
+  perfect-debounce@2.1.0:
+    resolution: {integrity: sha512-LjgdTytVFXeUgtHZr9WYViYSM/g8MkcTPYDlPa3cDqMirHjKiSZPYd6DoL7pK8AJQr+uWkQvCjHNdiMqsrJs+g==}
+
+  picocolors@1.1.1:
+    resolution: {integrity: sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==}
+
+  picomatch@2.3.1:
+    resolution: {integrity: sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==}
+    engines: {node: '>=8.6'}
+
+  picomatch@4.0.4:
+    resolution: {integrity: sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==}
+    engines: {node: '>=12'}
+
+  pify@2.3.0:
+    resolution: {integrity: sha512-udgsAY+fTnvv7kI7aaxbqwWNb0AHiB0qBO89PZKPkoTmGOgdbrHDKD+0B2X4uTfJ/FT1R09r9gTsjUjNJotuog==}
+    engines: {node: '>=0.10.0'}
+
+  pify@4.0.1:
+    resolution: {integrity: sha512-uB80kBFb/tfd68bVleG9T5GGsGPjJrLAUpR5PZIrhBnIaRTQRjqdJSsIKkOP6OAIFbj7GOrcudc5pNjZ+geV2g==}
+    engines: {node: '>=6'}
+
+  pinkie-promise@2.0.1:
+    resolution: {integrity: sha512-0Gni6D4UcLTbv9c57DfxDGdr41XfgUjqWZu492f0cIGr16zDU06BWP/RAEvOuo7CQ0CNjHaLlM59YJJFm3NWlw==}
+    engines: {node: '>=0.10.0'}
+
+  pinkie@2.0.4:
+    resolution: {integrity: sha512-MnUuEycAemtSaeFSjXKW/aroV7akBbY+Sv+RkyqFjgAe73F+MR0TBWKBRDkmfWq/HiFmdavfZ1G7h4SPZXaCSg==}
+    engines: {node: '>=0.10.0'}
+
+  pirates@4.0.5:
+    resolution: {integrity: sha512-8V9+HQPupnaXMA23c5hvl69zXvTwTzyAYasnkb0Tts4XvO4CliqONMOnvlq26rkhLC3nWDFBJf73LU1e1VZLaQ==}
+    engines: {node: '>= 6'}
+
+  pkg-dir@4.2.0:
+    resolution: {integrity: sha512-HRDzbaKjC+AOWVXxAU/x54COGeIv9eb+6CkDSQoNTt4XyWoIJvuPsXizxu/Fr23EiekbtZwmh1IcIG/l/a10GQ==}
+    engines: {node: '>=8'}
+
+  pkg-dir@7.0.0:
+    resolution: {integrity: sha512-Ie9z/WINcxxLp27BKOCHGde4ITq9UklYKDzVo1nhk5sqGEXU3FpkwP5GM2voTGJkGd9B3Otl+Q4uwSOeSUtOBA==}
+    engines: {node: '>=14.16'}
+
+  pkg-types@2.3.1:
+    resolution: {integrity: sha512-y+ichcgc2LrADuhLNAx8DFjVfgz91pRxfZdI3UDhxHvcVEZsenLO+7XaU5vOp0u/7V/wZ+plyuQxtrDlZJ+yeg==}
+
+  pkijs@3.3.3:
+    resolution: {integrity: sha512-+KD8hJtqQMYoTuL1bbGOqxb4z+nZkTAwVdNtWwe8Tc2xNbEmdJYIYoc6Qt0uF55e6YW6KuTHw1DjQ18gMhzepw==}
+    engines: {node: '>=16.0.0'}
+
+  possible-typed-array-names@1.1.0:
+    resolution: {integrity: sha512-/+5VFTchJDoVj3bhoqi6UeymcD00DAwb1nJwamzPvHEszJ4FpF6SNNbUbOS8yI56qHzdV8eK0qEfOSiodkTdxg==}
+    engines: {node: '>= 0.4'}
+
+  postcss-calc@10.1.1:
+    resolution: {integrity: sha512-NYEsLHh8DgG/PRH2+G9BTuUdtf9ViS+vdoQ0YA5OQdGsfN4ztiwtDWNtBl9EKeqNMFnIu8IKZ0cLxEQ5r5KVMw==}
+    engines: {node: ^18.12 || ^20.9 || >=22.0}
+    peerDependencies:
+      postcss: ^8.4.38
+
+  postcss-colormin@8.0.0:
+    resolution: {integrity: sha512-KKwMmsSgsmdYXqrjQeqL3tnuIFtctiR1GEMHdjNpDpz/TCRkkkok2mMcreK2zVV3l7POWOmAkR2xYHUpRUK1DA==}
+    engines: {node: ^22.11.0 || ^24.11.0 || >=26.0}
+    peerDependencies:
+      postcss: ^8.5.14
+
+  postcss-convert-values@8.0.0:
+    resolution: {integrity: sha512-Ohtj3rNZWawTRePv5NCHTy8VJSdJ/G/uKuxcxJreOMichuqcT6uEl2TAnopVeJCJ/c13jaSqg7m63yFLM5zBsA==}
+    engines: {node: ^22.11.0 || ^24.11.0 || >=26.0}
+    peerDependencies:
+      postcss: ^8.5.14
+
+  postcss-discard-comments@8.0.0:
+    resolution: {integrity: sha512-zGpvVLj2sbagEp+BTVETvAfkZdGVA6rALNujDK/WTIjdf1/rQOxOG8BBzkI8UQgnw8SkL6xffAfbtGMHFypadw==}
+    engines: {node: ^22.11.0 || ^24.11.0 || >=26.0}
+    peerDependencies:
+      postcss: ^8.5.14
+
+  postcss-discard-duplicates@8.0.0:
+    resolution: {integrity: sha512-zjRyYmNGI3PTipKBBtCgExlmZXQn49KvKoaiNnR2g+iXxeNk7GY5Js2ULtZXPrCYeqjPagrzKIBNcBocvXCR7g==}
+    engines: {node: ^22.11.0 || ^24.11.0 || >=26.0}
+    peerDependencies:
+      postcss: ^8.5.14
+
+  postcss-discard-empty@8.0.0:
+    resolution: {integrity: sha512-kxPJg6EqahbBvm+l7hpYYCtpsv8dlz7Tv6wJXUXZaeuY0WGS61DxfGdZR4uVB/Cx+yi3iOHQVSqpSHKMFaBg6Q==}
+    engines: {node: ^22.11.0 || ^24.11.0 || >=26.0}
+    peerDependencies:
+      postcss: ^8.5.14
+
+  postcss-discard-overridden@8.0.0:
+    resolution: {integrity: sha512-sW2OWH3l9p0FmBSVr228uztFseqroZxwgD7SGF0Ks0dRPDttSo3P8FK5ZBLtWBH2A5+chpB0J2fB/T8heKHLBw==}
+    engines: {node: ^22.11.0 || ^24.11.0 || >=26.0}
+    peerDependencies:
+      postcss: ^8.5.14
+
+  postcss-import@15.1.0:
+    resolution: {integrity: sha512-hpr+J05B2FVYUAXHeK1YyI267J/dDDhMU6B6civm8hSY1jYJnBXxzKDKDswzJmtLHryrjhnDjqqp/49t8FALew==}
+    engines: {node: '>=14.0.0'}
+    peerDependencies:
+      postcss: ^8.0.0
+
+  postcss-js@4.0.1:
+    resolution: {integrity: sha512-dDLF8pEO191hJMtlHFPRa8xsizHaM82MLfNkUHdUtVEV3tgTp5oj+8qbEqYM57SLfc74KSbw//4SeJma2LRVIw==}
+    engines: {node: ^12 || ^14 || >= 16}
+    peerDependencies:
+      postcss: ^8.4.21
+
+  postcss-load-config@4.0.1:
+    resolution: {integrity: sha512-vEJIc8RdiBRu3oRAI0ymerOn+7rPuMvRXslTvZUKZonDHFIczxztIyJ1urxM1x9JXEikvpWWTUUqal5j/8QgvA==}
+    engines: {node: '>= 14'}
+    peerDependencies:
+      postcss: '>=8.0.9'
+      ts-node: '>=9.0.0'
+    peerDependenciesMeta:
+      postcss:
+        optional: true
+      ts-node:
+        optional: true
+
+  postcss-loader@7.3.3:
+    resolution: {integrity: sha512-YgO/yhtevGO/vJePCQmTxiaEwER94LABZN0ZMT4A0vsak9TpO+RvKRs7EmJ8peIlB9xfXCsS7M8LjqncsUZ5HA==}
+    engines: {node: '>= 14.15.0'}
+    peerDependencies:
+      postcss: ^7.0.0 || ^8.0.1
+      webpack: ^5.0.0
+
+  postcss-merge-longhand@8.0.0:
+    resolution: {integrity: sha512-YDmAmQ8H+ljfomVpSXvr9NA0GP01fraQJqjWBYoMVGg6rOT+PJLwPyeVo2ekn4WB4ZVSH5ddtK3DTRxbz6CFzg==}
+    engines: {node: ^22.11.0 || ^24.11.0 || >=26.0}
+    peerDependencies:
+      postcss: ^8.5.14
+
+  postcss-merge-rules@8.0.0:
+    resolution: {integrity: sha512-bgstL5mpi41dDpnYGDUcI3M814NWkCMcIWpwDqEHXkHg3BT7b4XRAfNEuwJncZOVn/67kVKvWzhfv/7xyrp2uQ==}
+    engines: {node: ^22.11.0 || ^24.11.0 || >=26.0}
+    peerDependencies:
+      postcss: ^8.5.14
+
+  postcss-minify-font-values@8.0.0:
+    resolution: {integrity: sha512-EnOHQEnSt6oH5NrL1DMFAQuwB2IOimFXTCzc9bKfUeH1jREbqIF5MAK4gQJQOC4mPUwJt4sWifAmNZ1qLu6j3Q==}
+    engines: {node: ^22.11.0 || ^24.11.0 || >=26.0}
+    peerDependencies:
+      postcss: ^8.5.14
+
+  postcss-minify-gradients@8.0.0:
+    resolution: {integrity: sha512-43iAnYIGk0ZjNx5X/rkIcHi6dhmu/vEjY0kqfUfxPuJRO+V7jx8uKIdcnL0dpfNoC5J9TSh3EtzLWbq0gpqnWA==}
+    engines: {node: ^22.11.0 || ^24.11.0 || >=26.0}
+    peerDependencies:
+      postcss: ^8.5.14
+
+  postcss-minify-params@8.0.0:
+    resolution: {integrity: sha512-z7w4QO7G55l4vMUK1Lmx03GW7iyRLgf2V5Dz/7ioSPLnXRjeD+b7m0XfAXUGrbBYYrJ6bXPk+3LoX5u4JfAcSg==}
+    engines: {node: ^22.11.0 || ^24.11.0 || >=26.0}
+    peerDependencies:
+      postcss: ^8.5.14
+
+  postcss-minify-selectors@8.0.1:
+    resolution: {integrity: sha512-c31D46811kTkQDxV1KTTow79axX6gj/01AY5G7cGZg3s31KvAwP13jEFXGAzQbJ7NvOFV1pRqEia6nrAdHU7qg==}
+    engines: {node: ^22.11.0 || ^24.11.0 || >=26.0}
+    peerDependencies:
+      postcss: ^8.5.14
+
+  postcss-modules-extract-imports@3.1.0:
+    resolution: {integrity: sha512-k3kNe0aNFQDAZGbin48pL2VNidTF0w4/eASDsxlyspobzU3wZQLOGj7L9gfRe0Jo9/4uud09DsjFNH7winGv8Q==}
+    engines: {node: ^10 || ^12 || >= 14}
+    peerDependencies:
+      postcss: ^8.1.0
+
+  postcss-modules-local-by-default@4.2.0:
+    resolution: {integrity: sha512-5kcJm/zk+GJDSfw+V/42fJ5fhjL5YbFDl8nVdXkJPLLW+Vf9mTD5Xe0wqIaDnLuL2U6cDNpTr+UQ+v2HWIBhzw==}
+    engines: {node: ^10 || ^12 || >= 14}
+    peerDependencies:
+      postcss: ^8.1.0
+
+  postcss-modules-scope@3.2.1:
+    resolution: {integrity: sha512-m9jZstCVaqGjTAuny8MdgE88scJnCiQSlSrOWcTQgM2t32UBe+MUmFSO5t7VMSfAf/FJKImAxBav8ooCHJXCJA==}
+    engines: {node: ^10 || ^12 || >= 14}
+    peerDependencies:
+      postcss: ^8.1.0
+
+  postcss-modules-values@4.0.0:
+    resolution: {integrity: sha512-RDxHkAiEGI78gS2ofyvCsu7iycRv7oqw5xMWn9iMoR0N/7mf9D50ecQqUo5BZ9Zh2vH4bCUR/ktCqbB9m8vJjQ==}
+    engines: {node: ^10 || ^12 || >= 14}
+    peerDependencies:
+      postcss: ^8.1.0
+
+  postcss-nested@6.0.1:
+    resolution: {integrity: sha512-mEp4xPMi5bSWiMbsgoPfcP74lsWLHkQbZc3sY+jWYd65CUwXrUaTp0fmNpa01ZcETKlIgUdFN/MpS2xZtqL9dQ==}
+    engines: {node: '>=12.0'}
+    peerDependencies:
+      postcss: ^8.2.14
+
+  postcss-normalize-charset@8.0.0:
+    resolution: {integrity: sha512-s88FUNDSUD8m0wBYvTQQcubVts6zhXwBU8zCD4vkRKiecd0v8cOjHVIF9r/i+5xzS/WG3f98qq4XsOM0JqvfLA==}
+    engines: {node: ^22.11.0 || ^24.11.0 || >=26.0}
+    peerDependencies:
+      postcss: ^8.5.14
+
+  postcss-normalize-display-values@8.0.0:
+    resolution: {integrity: sha512-gG2nBxD27fiw6Luinb1QYKdM/Co5GornRJgSD+JTwNH4PGKxImP0qyruDDav49aHUPLY3qrL3qN3LvybO7IzxQ==}
+    engines: {node: ^22.11.0 || ^24.11.0 || >=26.0}
+    peerDependencies:
+      postcss: ^8.5.14
+
+  postcss-normalize-positions@8.0.0:
+    resolution: {integrity: sha512-t/wGqpehS20Ke7kc4QAsWpH+AJjUdMK/V5qV2RhrXkj8hO/fT1t1MJ8NL7sedWYk7ZqC7eISEJQonW5j0tU1MQ==}
+    engines: {node: ^22.11.0 || ^24.11.0 || >=26.0}
+    peerDependencies:
+      postcss: ^8.5.14
+
+  postcss-normalize-repeat-style@8.0.0:
+    resolution: {integrity: sha512-3ebOmGdCYKrBYyGKc1xhj0unEnW7beZpVU7JohVeGl7mTxR+7T6egpaawTWAVsB0pEIhcsbJVOjPKCJSoRO6Zg==}
+    engines: {node: ^22.11.0 || ^24.11.0 || >=26.0}
+    peerDependencies:
+      postcss: ^8.5.14
+
+  postcss-normalize-string@8.0.0:
+    resolution: {integrity: sha512-TvWCGZ/e04Tv31uJvOUtbexkfgUnqmQ3M2P5DkAaVzvOj+BvTkG2QjpA5Y71SL1SPxJcj4M23fNh+RDVCmG8kA==}
+    engines: {node: ^22.11.0 || ^24.11.0 || >=26.0}
+    peerDependencies:
+      postcss: ^8.5.14
+
+  postcss-normalize-timing-functions@8.0.0:
+    resolution: {integrity: sha512-uEfaXst5Xgqxv7geYUuz6vs9mn88K2NPY2RoIzM3BMmSjsdTSeppV9x2qIgrxsisdbSqF6IVhzI2occcte3hTA==}
+    engines: {node: ^22.11.0 || ^24.11.0 || >=26.0}
+    peerDependencies:
+      postcss: ^8.5.14
+
+  postcss-normalize-unicode@8.0.0:
+    resolution: {integrity: sha512-+WYngZaChEeTHZmWhmKtnJ4gTzWdINEaFcgWBnu6WdVu8Ftim8OBTcw768DuCC/3Aax9bZ9WkwrLGHym2Lzf+A==}
+    engines: {node: ^22.11.0 || ^24.11.0 || >=26.0}
+    peerDependencies:
+      postcss: ^8.5.14
+
+  postcss-normalize-url@8.0.0:
+    resolution: {integrity: sha512-4Mz9hZHn/QIB+YtFqTXrDmE2193GYxGb3F8uMfLvMicaEXCCUlDIJ658gFFJbqEGl9FYzwPtRiuNgbwlO9kkBg==}
+    engines: {node: ^22.11.0 || ^24.11.0 || >=26.0}
+    peerDependencies:
+      postcss: ^8.5.14
+
+  postcss-normalize-whitespace@8.0.0:
+    resolution: {integrity: sha512-V1f8tYnwIP5tscOXQFTKK8Y5EJ+R2GMpFJ6FjzwoKoQnhbqQy3IeSrDjJJb8JjVos8ut6Osi80Zybpayv/XjIQ==}
+    engines: {node: ^22.11.0 || ^24.11.0 || >=26.0}
+    peerDependencies:
+      postcss: ^8.5.14
+
+  postcss-ordered-values@8.0.0:
+    resolution: {integrity: sha512-Dg9+itb6lmD0bxqhQyHCtXAwYRh0wUrx6Mp4/BNXgkLoJmdYMmWi+V+Pypw79Q6iQhxA8KFMHqLBITQJV2gKMA==}
+    engines: {node: ^22.11.0 || ^24.11.0 || >=26.0}
+    peerDependencies:
+      postcss: ^8.5.14
+
+  postcss-reduce-initial@8.0.0:
+    resolution: {integrity: sha512-DChcE9d528AKrlpCTHjhsAiOsWCk4H9ApHPS1QqRT3praObWTiWyn6W1UddGpc46K9LQnHwUu4YwaPUukGtXVA==}
+    engines: {node: ^22.11.0 || ^24.11.0 || >=26.0}
+    peerDependencies:
+      postcss: ^8.5.14
+
+  postcss-reduce-transforms@8.0.0:
+    resolution: {integrity: sha512-cLZT0som7vvumQT9XQCnSKOSnRinNQZd1Hm+J723Ney13E8CIydDhw6JwzsjPtgnYThTqn9Q45906gz6wxaAsw==}
+    engines: {node: ^22.11.0 || ^24.11.0 || >=26.0}
+    peerDependencies:
+      postcss: ^8.5.14
+
+  postcss-selector-parser@6.0.13:
+    resolution: {integrity: sha512-EaV1Gl4mUEV4ddhDnv/xtj7sxwrwxdetHdWUGnT4VJQf+4d05v6lHYZr8N573k5Z0BViss7BDhfWtKS3+sfAqQ==}
+    engines: {node: '>=4'}
+
+  postcss-selector-parser@7.1.1:
+    resolution: {integrity: sha512-orRsuYpJVw8LdAwqqLykBj9ecS5/cRHlI5+nvTo8LcCKmzDmqVORXtOIYEEQuL9D4BxtA1lm5isAqzQZCoQ6Eg==}
+    engines: {node: '>=4'}
+
+  postcss-svgo@8.0.0:
+    resolution: {integrity: sha512-Q2fMSYEiNE1ioDc/3sxvI24NdgA/MJno2XLNpOxgv8aCcJbym8mZY10/lDY5+AWCIc3Aiqzy2Wcp9/zaIXBZgQ==}
+    engines: {node: ^22.11.0 || ^24.11.0 || >=26.0}
+    peerDependencies:
+      postcss: ^8.5.14
+
+  postcss-unique-selectors@8.0.0:
+    resolution: {integrity: sha512-iObuolUX+ITJfMU2QQFQdh31JgSjNLPNjVs6YGAqBHvOvAWXMMNget6donQl83aQaeS32i5XeKZURUW/WBxIUw==}
+    engines: {node: ^22.11.0 || ^24.11.0 || >=26.0}
+    peerDependencies:
+      postcss: ^8.5.14
+
+  postcss-value-parser@4.2.0:
+    resolution: {integrity: sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ==}
+
+  postcss@8.5.15:
+    resolution: {integrity: sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==}
+    engines: {node: ^10 || ^12 || >=14}
+
+  powershell-utils@0.1.0:
+    resolution: {integrity: sha512-dM0jVuXJPsDN6DvRpea484tCUaMiXWjuCn++HGTqUWzGDjv5tZkEZldAJ/UMlqRYGFrD/etByo4/xOuC/snX2A==}
+    engines: {node: '>=20'}
+
+  prelude-ls@1.2.1:
+    resolution: {integrity: sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==}
+    engines: {node: '>= 0.8.0'}
+
+  prettier-plugin-tailwindcss@0.8.0:
+    resolution: {integrity: sha512-V8ITGH87yuBDF6JpEZTOVlUz/saAwqb8f3HRgUj8Lh+tGCcrmorhsLpYqzygwFwK0PE2Ib6Mv3M7T/uE2tZV1g==}
+    engines: {node: '>=20.19'}
+    peerDependencies:
+      '@ianvs/prettier-plugin-sort-imports': '*'
+      '@prettier/plugin-hermes': '*'
+      '@prettier/plugin-oxc': '*'
+      '@prettier/plugin-pug': '*'
+      '@shopify/prettier-plugin-liquid': '*'
+      '@trivago/prettier-plugin-sort-imports': '*'
+      '@zackad/prettier-plugin-twig': '*'
+      prettier: ^3.0
+      prettier-plugin-astro: '*'
+      prettier-plugin-css-order: '*'
+      prettier-plugin-jsdoc: '*'
+      prettier-plugin-marko: '*'
+      prettier-plugin-multiline-arrays: '*'
+      prettier-plugin-organize-attributes: '*'
+      prettier-plugin-organize-imports: '*'
+      prettier-plugin-sort-imports: '*'
+      prettier-plugin-svelte: '*'
+    peerDependenciesMeta:
+      '@ianvs/prettier-plugin-sort-imports':
+        optional: true
+      '@prettier/plugin-hermes':
+        optional: true
+      '@prettier/plugin-oxc':
+        optional: true
+      '@prettier/plugin-pug':
+        optional: true
+      '@shopify/prettier-plugin-liquid':
+        optional: true
+      '@trivago/prettier-plugin-sort-imports':
+        optional: true
+      '@zackad/prettier-plugin-twig':
+        optional: true
+      prettier-plugin-astro:
+        optional: true
+      prettier-plugin-css-order:
+        optional: true
+      prettier-plugin-jsdoc:
+        optional: true
+      prettier-plugin-marko:
+        optional: true
+      prettier-plugin-multiline-arrays:
+        optional: true
+      prettier-plugin-organize-attributes:
+        optional: true
+      prettier-plugin-organize-imports:
+        optional: true
+      prettier-plugin-sort-imports:
+        optional: true
+      prettier-plugin-svelte:
+        optional: true
+
+  prettier@3.8.3:
+    resolution: {integrity: sha512-7igPTM53cGHMW8xWuVTydi2KO233VFiTNyF5hLJqpilHfmn8C8gPf+PS7dUT64YcXFbiMGZxS9pCSxL/Dxm/Jw==}
+    engines: {node: '>=14'}
+    hasBin: true
+
+  pretty-error@4.0.0:
+    resolution: {integrity: sha512-AoJ5YMAcXKYxKhuJGdcvse+Voc6v1RgnsR3nWcYU7q4t6z0Q6T86sv5Zq8VIRbOWWFpvdGE83LtdSMNd+6Y0xw==}
+
+  pretty-format@27.4.2:
+    resolution: {integrity: sha512-p0wNtJ9oLuvgOQDEIZ9zQjZffK7KtyR6Si0jnXULIDwrlNF8Cuir3AZP0hHv0jmKuNN/edOnbMjnzd4uTcmWiw==}
+    engines: {node: ^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0}
+
+  process-nextick-args@2.0.1:
+    resolution: {integrity: sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag==}
+
+  prop-types@15.8.1:
+    resolution: {integrity: sha512-oj87CgZICdulUohogVAR7AjlC0327U4el4L6eAvOqCeudMDVU0NThNaV+b9Df4dXgSP1gXMTnPdhfe/2qDH5cg==}
+
+  property-expr@2.0.4:
+    resolution: {integrity: sha512-sFPkHQjVKheDNnPvotjQmm3KD3uk1fWKUN7CrpdbwmUx3CrG3QiM8QpTSimvig5vTXmTvjz7+TDvXOI9+4rkcg==}
+
+  property-information@7.0.0:
+    resolution: {integrity: sha512-7D/qOz/+Y4X/rzSB6jKxKUsQnphO046ei8qxG59mtM3RG3DHgTK81HrxrmoDVINJb8NKT5ZsRbwHvQ6B68Iyhg==}
+
+  proxy-addr@2.0.7:
+    resolution: {integrity: sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==}
+    engines: {node: '>= 0.10'}
+
+  proxy-from-env@2.1.0:
+    resolution: {integrity: sha512-cJ+oHTW1VAEa8cJslgmUZrc+sjRKgAKl3Zyse6+PV38hZe/V6Z14TbCuXcan9F9ghlz4QrFr2c92TNF82UkYHA==}
+    engines: {node: '>=10'}
+
+  prr@1.0.1:
+    resolution: {integrity: sha512-yPw4Sng1gWghHQWj0B3ZggWUm4qVbPwPFcRG8KyxiU7J2OHFSoEHKS+EZ3fv5l1t9CyCiop6l/ZYeWbrgoQejw==}
+
+  psl@1.8.0:
+    resolution: {integrity: sha512-RIdOzyoavK+hA18OGGWDqUTsCLhtA7IcZ/6NCs4fFJaHBDab+pDDmDIByWFRQJq2Cd7r1OoQxBGKOaztq+hjIQ==}
+
+  punycode@2.3.1:
+    resolution: {integrity: sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==}
+    engines: {node: '>=6'}
+
+  pvtsutils@1.3.6:
+    resolution: {integrity: sha512-PLgQXQ6H2FWCaeRak8vvk1GW462lMxB5s3Jm673N82zI4vqtVUPuZdffdZbPDFRoU8kAhItWFtPCWiPpp4/EDg==}
+
+  pvutils@1.1.5:
+    resolution: {integrity: sha512-KTqnxsgGiQ6ZAzZCVlJH5eOjSnvlyEgx1m8bkRJfOhmGRqfo5KLvmAlACQkrjEtOQ4B7wF9TdSLIs9O90MX9xA==}
+    engines: {node: '>=16.0.0'}
+
+  qs@6.14.1:
+    resolution: {integrity: sha512-4EK3+xJl8Ts67nLYNwqw/dsFVnCf+qR7RgXSK9jEEm9unao3njwMDdmsdvoKBKHzxd7tCYz5e5M+SnMjdtXGQQ==}
+    engines: {node: '>=0.6'}
+
+  querystringify@2.2.0:
+    resolution: {integrity: sha512-FIqgj2EUvTa7R50u0rGsyTftzjYmv/a3hO345bZNrqabNqjtgiDMgmo4mkUjd+nzU5oF3dClKqFIPUKybUyqoQ==}
+
+  queue-microtask@1.2.3:
+    resolution: {integrity: sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==}
+
+  railroad-diagrams@1.0.0:
+    resolution: {integrity: sha512-cz93DjNeLY0idrCNOH6PviZGRN9GJhsdm9hpn1YCS879fj4W+x5IFJhhkRZcwVgMmFF7R82UA/7Oh+R8lLZg6A==}
+
+  randexp@0.4.6:
+    resolution: {integrity: sha512-80WNmd9DA0tmZrw9qQa62GPPWfuXJknrmVmLcxvq4uZBdYqb1wYoKTmnlGUchvVWe0XiLupYkBoXVOxz3C8DYQ==}
+    engines: {node: '>=0.12'}
+
+  randombytes@2.1.0:
+    resolution: {integrity: sha512-vYl3iOX+4CKUWuxGi9Ukhie6fsqXqS9FE2Zaic4tNFD2N2QQaXOMFbuKK4QmDHC0JO6B1Zp41J0LpT0oR68amQ==}
+
+  range-parser@1.2.1:
+    resolution: {integrity: sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg==}
+    engines: {node: '>= 0.6'}
+
+  raw-body@2.5.3:
+    resolution: {integrity: sha512-s4VSOf6yN0rvbRZGxs8Om5CWj6seneMwK3oDb4lWDH0UPhWcxwOWw5+qk24bxq87szX1ydrwylIOp2uG1ojUpA==}
+    engines: {node: '>= 0.8'}
+
+  rc-slider@10.1.1:
+    resolution: {integrity: sha512-gn8oXazZISEhnmRinI89Z/JD/joAaM35jp+gDtIVSTD/JJMCCBqThqLk1SVJmvtfeiEF/kKaFY0+qt4SDHFUDw==}
+    engines: {node: '>=8.x'}
+    peerDependencies:
+      react: '>=16.9.0'
+      react-dom: '>=16.9.0'
+
+  rc-util@5.28.0:
+    resolution: {integrity: sha512-KYDjhGodswVj29v0TRciKTqRPgumIFvFDndbCD227pitQ+0Cei196rxk+OXb/blu6V8zdTRK5RjCJn+WmHLvBA==}
+    peerDependencies:
+      react: '>=16.9.0'
+      react-dom: '>=16.9.0'
+
+  rc9@3.0.1:
+    resolution: {integrity: sha512-gMDyleLWVE+i6Sgtc0QbbY6pEKqYs97NGi6isHQPqYlLemPoO8dxQ3uGi0f4NiP98c+jMW6cG1Kx9dDwfvqARQ==}
+
+  react-calendar@4.8.0:
+    resolution: {integrity: sha512-qFgwo+p58sgv1QYMI1oGNaop90eJVKuHTZ3ZgBfrrpUb+9cAexxsKat0sAszgsizPMVo7vOXedV7Lqa0GQGMvA==}
+    peerDependencies:
+      '@types/react': ^17.0.37
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0
+      react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  react-clientside-effect@1.2.6:
+    resolution: {integrity: sha512-XGGGRQAKY+q25Lz9a/4EPqom7WRjz3z9R2k4jhVKA/puQFH/5Nt27vFZYql4m4NVNdUvX8PS3O7r/Zzm7cjUlg==}
+    peerDependencies:
+      react: ^15.3.0 || ^16.0.0 || ^17.0.0 || ^18.0.0
+
+  react-clock@4.6.0:
+    resolution: {integrity: sha512-Yz+vwrwrfVRSBw3BdmX/Mc7mVdQYJQ5Pi00qDzGLyLNWQuEmp5PC2oYjQAsDalLjekeDwBIGD7OLcKnkAp1kcw==}
+    peerDependencies:
+      '@types/react': ^17.0.37
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0
+      react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  react-codemirror-merge@4.23.11:
+    resolution: {integrity: sha512-QimYLcFNKInmJhGUsIkQyTc893RGndj79Na+r4QOCfJk8TVA+ejTdc6ofB5tP5osvoxh6OIBBmeIj1vB6co/Aw==}
+    peerDependencies:
+      '@babel/runtime': '>=7.11.0'
+      '@codemirror/state': '>=6.0.0'
+      '@codemirror/theme-one-dark': '>=6.0.0'
+      '@codemirror/view': '>=6.0.0'
+      codemirror: '>=6.0.0'
+      react: '>=16.8.0'
+      react-dom: '>=16.8.0'
+
+  react-date-picker@10.6.0:
+    resolution: {integrity: sha512-db5lcmU/52X8ur8SU1QU3PYBiaDG5SbzZDlqWk3YruPx5Ti9w6UpqCRsd1TXycVla9Ut2I3Qb4BUe27jxSwHeg==}
+    peerDependencies:
+      '@types/react': ^17.0.37
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0
+      react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  react-datetime-picker@5.6.0:
+    resolution: {integrity: sha512-zbYSuYuiRj4/6lR9xGjAgw7V4gpTGtzOwZIfw1TONj6K6OKuaDreczS+6ijJjwLYlMcx8V+Sw1IMP+K059wnnA==}
+    peerDependencies:
+      '@types/react': ^17.0.37
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0
+      react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  react-docgen-typescript-plugin@1.0.5:
+    resolution: {integrity: sha512-Ds6s2ioyIlH45XSfEVMNwRcDkzuff3xQCPxDFOzTc8GEshy+hksas8RYlmV4JEQREI+OGEGybhMCJk3vFbQZNQ==}
+    peerDependencies:
+      typescript: '>= 4.x'
+      webpack: '>= 4'
+
+  react-docgen-typescript@2.2.2:
+    resolution: {integrity: sha512-tvg2ZtOpOi6QDwsb3GZhOjDkkX0h8Z2gipvTg6OVMUyoYoURhEiRNePT8NZItTVCDh39JJHnLdfCOkzoLbFnTg==}
+    peerDependencies:
+      typescript: '>= 4.3.x'
+
+  react-docgen@7.1.1:
+    resolution: {integrity: sha512-hlSJDQ2synMPKFZOsKo9Hi8WWZTC7POR8EmWvTSjow+VDgKzkmjQvFm2fk0tmRw+f0vTOIYKlarR0iL4996pdg==}
+    engines: {node: '>=16.14.0'}
+
+  react-docgen@8.0.3:
+    resolution: {integrity: sha512-aEZ9qP+/M+58x2qgfSFEWH1BxLyHe5+qkLNJOZQb5iGS017jpbRnoKhNRrXPeA6RfBrZO5wZrT9DMC1UqE1f1w==}
+    engines: {node: ^20.9.0 || >=22}
+
+  react-dom@17.0.2:
+    resolution: {integrity: sha512-s4h96KtLDUQlsENhMn1ar8t2bEa+q/YAtj8pPPdIjPDGBDIVNsrD9aXNWqspUe6AzKCIG0C1HZZLqLV7qpOBGA==}
+    peerDependencies:
+      react: 17.0.2
+
+  react-error-boundary@3.1.4:
+    resolution: {integrity: sha512-uM9uPzZJTF6wRQORmSrvOIgt4lJ9MC1sNgEOj2XGsDTRE4kmpWxg7ENK9EWNKJRMAOY9z0MuF4yIfl6gp4sotA==}
+    engines: {node: '>=10', npm: '>=6'}
+    peerDependencies:
+      react: '>=16.13.1'
+
+  react-fast-compare@2.0.4:
+    resolution: {integrity: sha512-suNP+J1VU1MWFKcyt7RtjiSWUjvidmQSlqu+eHslq+342xCbGTYmC0mEhPCOHxlW0CywylOC1u2DFAT+bv4dBw==}
+
+  react-fit@1.7.1:
+    resolution: {integrity: sha512-y/TYovCCBzfIwRJsbLj0rH4Es40wPQhU5GPPq9GlbdF09b0OdzTdMSkBza0QixSlgFzTm6dkM7oTFzaVvaBx+w==}
+    peerDependencies:
+      '@types/react': ^17.0.37
+      '@types/react-dom': ^17.0.11
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0
+      react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  react-focus-lock@2.9.1:
+    resolution: {integrity: sha512-pSWOQrUmiKLkffPO6BpMXN7SNKXMsuOakl652IBuALAu1esk+IcpJyM+ALcYzPTTFz1rD0R54aB9A4HuP5t1Wg==}
+    peerDependencies:
+      '@types/react': ^17.0.37
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  react-i18next@11.15.3:
+    resolution: {integrity: sha512-RSUEM4So3Tu2JHV0JsZ5Yje+4nz66YViMfPZoywxOy0xyn3L7tE2CHvJ7Y9LUsrTU7vGmZ5bwb8PpjnkatdIxg==}
+    peerDependencies:
+      i18next: '>= 19.0.0'
+      react: '>= 16.8.0'
+      react-dom: '*'
+      react-native: '*'
+    peerDependenciesMeta:
+      react-dom:
+        optional: true
+      react-native:
+        optional: true
+
+  react-is@16.13.1:
+    resolution: {integrity: sha512-24e6ynE2H+OKt4kqsOvNd8kBpV65zoxbA4BVsEOB3ARVWQki/DHzaUoC5KuON/BiccDaCCTZBuOcfZs70kR8bQ==}
+
+  react-is@17.0.2:
+    resolution: {integrity: sha512-w2GsyukL62IJnlaff/nRegPQR94C/XXamvMWmSHRJ4y7Ts/4ocGRmTHvOs8PSE6pB3dWOrD/nueuU5sduBsQ4w==}
+
+  react-json-view-lite@1.5.0:
+    resolution: {integrity: sha512-nWqA1E4jKPklL2jvHWs6s+7Na0qNgw9HCP6xehdQJeg6nPBTFZgGwyko9Q0oj+jQWKTTVRS30u0toM5wiuL3iw==}
+    engines: {node: '>=14'}
+    peerDependencies:
+      react: ^16.13.1 || ^17.0.0 || ^18.0.0
+
+  react-remove-scroll-bar@2.3.8:
+    resolution: {integrity: sha512-9r+yi9+mgU33AKcj6IbT9oRCO78WriSj6t/cF8DWBZJ9aOGPOTEDvdUDz1FwKim7QXWwmHqtdHnRJfhAxEG46Q==}
+    engines: {node: '>=10'}
+    peerDependencies:
+      '@types/react': ^17.0.37
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  react-remove-scroll@2.6.3:
+    resolution: {integrity: sha512-pnAi91oOk8g8ABQKGF5/M9qxmmOPxaAnopyTHYfqYEwJhyFrbbBtHuSgtKEoH0jpcxx5o3hXqH1mNd9/Oi+8iQ==}
+    engines: {node: '>=10'}
+    peerDependencies:
+      '@types/react': ^17.0.37
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  react-select-async-paginate@0.7.11:
+    resolution: {integrity: sha512-AjtCLPMk5DLNgygwQprEPC0gfVIjkou+QYvXM+2gm/LeRpY1Gv5KNT79EYB37H1uMCrwA+HL9BY7OtlaNWtYNg==}
+    peerDependencies:
+      react: ^16.14.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
+      react-select: ^5.0.0
+
+  react-select@5.10.2:
+    resolution: {integrity: sha512-Z33nHdEFWq9tfnfVXaiM12rbJmk+QjFEztWLtmXqQhz6Al4UZZ9xc0wiatmGtUOCCnHN0WizL3tCMYRENX4rVQ==}
+    peerDependencies:
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
+      react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
+
+  react-style-singleton@2.2.3:
+    resolution: {integrity: sha512-b6jSvxvVnyptAiLjbkWLE/lOnR4lfTtDAl+eUC7RZy+QQWc6wRzIV2CE6xBuMmDxc2qIihtDCZD5NPOFl7fRBQ==}
+    engines: {node: '>=10'}
+    peerDependencies:
+      '@types/react': ^17.0.37
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  react-time-picker@6.6.0:
+    resolution: {integrity: sha512-1PCetwrYcFNXALU9Oml32NAcFgPCPZLB5U8AQEgBoavJw61YmA0B0OSto6cOz9syGmPdcLZhDqRtN+EkZji+3w==}
+    peerDependencies:
+      '@types/react': ^17.0.37
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0
+      react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  react-transition-group@4.4.2:
+    resolution: {integrity: sha512-/RNYfRAMlZwDSr6z4zNKV6xu53/e2BuaBbGhbyYIXTrmgu/bGHzmqOs7mJSJBHy9Ud+ApHx3QjrkKSp1pxvlFg==}
+    peerDependencies:
+      react: '>=16.6.0'
+      react-dom: '>=16.6.0'
+
+  react@17.0.2:
+    resolution: {integrity: sha512-gnhPt75i/dq/z3/6q/0asP78D0u592D5L1pd7M8P+dck6Fu/jJeL6iVVK23fptSUZj8Vjf++7wXA8UNclGQcbA==}
+    engines: {node: '>=0.10.0'}
+
+  read-cache@1.0.0:
+    resolution: {integrity: sha512-Owdv/Ft7IjOgm/i0xvNDZ1LrRANRfew4b2prF3OWMQLxLfu3bS8FVhCsrSCMK4lR56Y9ya+AThoTpDCTxCmpRA==}
+
+  readable-stream@2.3.8:
+    resolution: {integrity: sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA==}
+
+  readable-stream@3.6.2:
+    resolution: {integrity: sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==}
+    engines: {node: '>= 6'}
+
+  readdirp@3.6.0:
+    resolution: {integrity: sha512-hOS089on8RduqdbhvQ5Z37A0ESjsqz6qnRcffsMU3495FuTdqSm+7bhJ29JvIOsBDEEnan5DPu9t3To9VRlMzA==}
+    engines: {node: '>=8.10.0'}
+
+  readdirp@4.1.2:
+    resolution: {integrity: sha512-GDhwkLfywWL2s6vEjyhri+eXmfH6j1L7JE27WhqLeYzoh/A3DBaYGEj2H/HFZCn/kMfim73FXxEJTw06WtxQwg==}
+    engines: {node: '>= 14.18.0'}
+
+  readdirp@5.0.0:
+    resolution: {integrity: sha512-9u/XQ1pvrQtYyMpZe7DXKv2p5CNvyVwzUB6uhLAnQwHMSgKMBR62lc7AHljaeteeHXn11XTAaLLUVZYVZyuRBQ==}
+    engines: {node: '>= 20.19.0'}
+
+  recast@0.23.11:
+    resolution: {integrity: sha512-YTUo+Flmw4ZXiWfQKGcwwc11KnoRAYgzAE2E7mXKCjSviTKShtxBsN6YUUBB2gtaBzKzeKunxhUwNHQuRryhWA==}
+    engines: {node: '>= 4'}
+
+  rechoir@0.8.0:
+    resolution: {integrity: sha512-/vxpCXddiX8NGfGO/mTafwjq4aFa/71pvamip0++IQk3zG8cbCj0fifNPrjjF1XMXUne91jL9OoxmdykoEtifQ==}
+    engines: {node: '>= 10.13.0'}
+
+  redent@3.0.0:
+    resolution: {integrity: sha512-6tDA8g98We0zd0GvVeMT9arEOnTw9qM03L9cJXaCjrip1OO764RDBLBfrB4cwzNGDj5OA5ioymC9GkizgWJDUg==}
+    engines: {node: '>=8'}
+
+  reflect-metadata@0.2.2:
+    resolution: {integrity: sha512-urBwgfrvVP/eAyXx4hluJivBKzuEbSQs9rKWCrCkbSxNv8mxPcUZKeuoF3Uy4mJl3Lwprp6yy5/39VWigZ4K6Q==}
+
+  reflect.getprototypeof@1.0.10:
+    resolution: {integrity: sha512-00o4I+DVrefhv+nX0ulyi3biSHCPDe+yLv5o/p6d/UVlirijB8E16FtfwSAi4g3tcqrQ4lRAqQSoFEZJehYEcw==}
+    engines: {node: '>= 0.4'}
+
+  reftools@1.1.9:
+    resolution: {integrity: sha512-OVede/NQE13xBQ+ob5CKd5KyeJYU2YInb1bmV4nRoOfquZPkAkxuOXicSe1PvqIuZZ4kD13sPKBbR7UFDmli6w==}
+
+  regenerate-unicode-properties@10.1.0:
+    resolution: {integrity: sha512-d1VudCLoIGitcU/hEg2QqvyGZQmdC0Lf8BqdOMXGFSvJP4bNV1+XqbPQeHHLD51Jh4QJJ225dlIFvY4Ly6MXmQ==}
+    engines: {node: '>=4'}
+
+  regenerate@1.4.2:
+    resolution: {integrity: sha512-zrceR/XhGYU/d/opr2EKO7aRHUeiBI8qjtfHqADTwZd6Szfy16la6kqD0MIUs5z5hx6AaKa+PixpPrR289+I0A==}
+
+  regenerator-runtime@0.14.1:
+    resolution: {integrity: sha512-dYnhHh0nJoMfnkZs6GmmhFknAGRrLznOu5nc9ML+EJxGvrx6H7teuevqVqCuPcPK//3eDrrjQhehXVx9cnkGdw==}
+
+  regenerator-transform@0.15.2:
+    resolution: {integrity: sha512-hfMp2BoF0qOk3uc5V20ALGDS2ddjQaLrdl7xrGXvAIow7qeWRM2VA2HuCHkUKk9slq3VwEwLNK3DFBqDfPGYtg==}
+
+  regex-recursion@5.1.1:
+    resolution: {integrity: sha512-ae7SBCbzVNrIjgSbh7wMznPcQel1DNlDtzensnFxpiNpXt1U2ju/bHugH422r+4LAVS1FpW1YCwilmnNsjum9w==}
+
+  regex-utilities@2.3.0:
+    resolution: {integrity: sha512-8VhliFJAWRaUiVvREIiW2NXXTmHs4vMNnSzuJVhscgmGav3g9VDxLrQndI3dZZVVdp0ZO/5v0xmX516/7M9cng==}
+
+  regex@5.1.1:
+    resolution: {integrity: sha512-dN5I359AVGPnwzJm2jN1k0W9LPZ+ePvoOeVMMfqIMFz53sSwXkxaJoxr50ptnsC771lK95BnTrVSZxq0b9yCGw==}
+
+  regexp.prototype.flags@1.5.4:
+    resolution: {integrity: sha512-dYqgNSZbDwkaJ2ceRd9ojCGjBq+mOm9LmtXnAnEGyHhN/5R7iDW2TRw3h+o/jCFxus3P2LfWIIiwowAjANm7IA==}
+    engines: {node: '>= 0.4'}
+
+  regexpu-core@5.3.2:
+    resolution: {integrity: sha512-RAM5FlZz+Lhmo7db9L298p2vHP5ZywrVXmVXpmAD9GuL5MPH6t9ROw1iA/wfHkQ76Qe7AaPF0nGuim96/IrQMQ==}
+    engines: {node: '>=4'}
+
+  regjsparser@0.9.1:
+    resolution: {integrity: sha512-dQUtn90WanSNl+7mQKcXAgZxvUe7Z0SqXlgzv0za4LwiUhyzBC58yQO3liFoUgu8GiJVInAhJjkj1N0EtQ5nkQ==}
+    hasBin: true
+
+  relateurl@0.2.7:
+    resolution: {integrity: sha512-G08Dxvm4iDN3MLM0EsP62EDV9IuhXPR6blNz6Utcp7zyV3tr4HVNINt6MpaRWbxoOHT3Q7YN2P+jaHX8vUbgog==}
+    engines: {node: '>= 0.10'}
+
+  remove-accents@0.4.2:
+    resolution: {integrity: sha512-7pXIJqJOq5tFgG1A2Zxti3Ht8jJF337m4sowbuHsW30ZnkQFnDzy9qBNhgzX8ZLW4+UBcXiiR7SwR6pokHsxiA==}
+
+  renderkid@3.0.0:
+    resolution: {integrity: sha512-q/7VIQA8lmM1hF+jn+sFSPWGlMkSAeNYcPLmDQx2zzuiDfaLrOmumR8iaUKlenFgh0XRPIUeSPlH3A+AW3Z5pg==}
+
+  require-directory@2.1.1:
+    resolution: {integrity: sha512-fGxEI7+wsG9xrvdjsrlmL22OMTTiHRwAMroiEeMgq8gzoLC/PQr7RsRDSTLUg/bZAZtF+TVIkHc6/4RIKrui+Q==}
+    engines: {node: '>=0.10.0'}
+
+  require-from-string@2.0.2:
+    resolution: {integrity: sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==}
+    engines: {node: '>=0.10.0'}
+
+  require-main-filename@2.0.0:
+    resolution: {integrity: sha512-NKN5kMDylKuldxYLSUfrbo5Tuzh4hd+2E8NPPX02mZtn1VuREQToYe/ZdlJy+J3uCpfaiGF05e7B8W0iXbQHmg==}
+
+  require-package-name@2.0.1:
+    resolution: {integrity: sha512-uuoJ1hU/k6M0779t3VMVIYpb2VMJk05cehCaABFhXaibcbvfgR8wKiozLjVFSzJPmQMRqIcO0HMyTFqfV09V6Q==}
+
+  requires-port@1.0.0:
+    resolution: {integrity: sha512-KigOCHcocU3XODJxsu8i/j8T9tzT4adHiecwORRQ0ZZFcp7ahwXuRU1m+yuO90C5ZUyGeGfocHDI14M3L3yDAQ==}
+
+  resolve-cwd@3.0.0:
+    resolution: {integrity: sha512-OrZaX2Mb+rJCpH/6CpSqt9xFVpN++x01XnN2ie9g6P5/3xelLAkXWVADpdz1IHD/KFfEXyE6V0U01OQ3UO2rEg==}
+    engines: {node: '>=8'}
+
+  resolve-from@4.0.0:
+    resolution: {integrity: sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g==}
+    engines: {node: '>=4'}
+
+  resolve-from@5.0.0:
+    resolution: {integrity: sha512-qYg9KP24dD5qka9J47d0aVky0N+b4fTU89LN9iDnjB5waksiC49rvMB0PrUJQGoTmH50XPiqOvAjDfaijGxYZw==}
+    engines: {node: '>=8'}
+
+  resolve-pkg-maps@1.0.0:
+    resolution: {integrity: sha512-seS2Tj26TBVOC2NIc2rOe2y2ZO7efxITtLZcGSOnHHNOQ7CkiUBfw0Iw2ck6xkIhPwLhKNLS8BO+hEpngQlqzw==}
+
+  resolve@1.22.11:
+    resolution: {integrity: sha512-RfqAvLnMl313r7c9oclB1HhUEAezcpLjz95wFH4LVuhk9JF/r22qmVP9AMmOU4vMX7Q8pN8jwNg/CSpdFnMjTQ==}
+    engines: {node: '>= 0.4'}
+    hasBin: true
+
+  resolve@2.0.0-next.6:
+    resolution: {integrity: sha512-3JmVl5hMGtJ3kMmB3zi3DL25KfkCEyy3Tw7Gmw7z5w8M9WlwoPFnIvwChzu1+cF3iaK3sp18hhPz8ANeimdJfA==}
+    engines: {node: '>= 0.4'}
+    hasBin: true
+
+  restore-cursor@5.1.0:
+    resolution: {integrity: sha512-oMA2dcrw6u0YfxJQXm342bFKX/E4sG9rbTzO9ptUcR/e8A33cHuvStiYOwH7fszkZlZ1z/ta9AAoPk2F4qIOHA==}
+    engines: {node: '>=18'}
+
+  ret@0.1.15:
+    resolution: {integrity: sha512-TTlYpa+OL+vMMNG24xSlQGEJ3B/RzEfUlLct7b5G/ytav+wPrplCpVMFuwzXbkecJrb6IYo1iFb0S9v37754mg==}
+    engines: {node: '>=0.12'}
+
+  retry@0.13.1:
+    resolution: {integrity: sha512-XQBQ3I8W1Cge0Seh+6gjj03LbmRFWuoszgK9ooCpwYIrhhoO80pfq4cUkU5DkknwfOfFteRwlZ56PYOGYyFWdg==}
+    engines: {node: '>= 4'}
+
+  rettime@0.11.11:
+    resolution: {integrity: sha512-ILJRqVWBCTlg9r42fFgwVZx1gnFAcQF8mRoMkbgQfIrjEDf9nbBFDFx00oloOa+Q869FUtaYDXZvEfnecQSCoQ==}
+
+  reusify@1.0.4:
+    resolution: {integrity: sha512-U9nH88a3fc/ekCF1l0/UP1IosiuIjyTh7hBvXVMHYgVcfGvt897Xguj2UOLDeI5BG2m7/uwyaLVT6fbtCwTyzw==}
+    engines: {iojs: '>=1.0.0', node: '>=0.10.0'}
+
+  rfdc@1.4.1:
+    resolution: {integrity: sha512-q1b3N5QkRUWUl7iyylaaj3kOpIT0N2i9MqIEQXP73GVsN9cw3fdx8X63cEmWhJGi2PPCF23Ijp7ktmd39rawIA==}
+
+  rimraf@2.7.1:
+    resolution: {integrity: sha512-uWjbaKIK3T1OSVptzX7Nl6PvQ3qAGtKEtVRjRuazjfL3Bx5eI409VZSqgND+4UNnmzLVdPj9FqFJNPqBZFve4w==}
+    hasBin: true
+
+  rimraf@3.0.2:
+    resolution: {integrity: sha512-JZkJMZkAGFFPP2YqXZXPbMlMBgsxzE8ILs4lMIX/2o0L9UBw9O/Y3o6wFw/i9YLapcUJWwqbi3kdxIPdC62TIA==}
+    hasBin: true
+
+  rolldown@1.0.3:
+    resolution: {integrity: sha512-i00lAJ2ks1BYr7rjNjKC7BcqAS7nVfiT3QX1SI5aY+AFHblCmaUf9OE9dbdzDvW6dJxbi2ZCZiy9v3CcwOiX3g==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    hasBin: true
+
+  rollup@4.54.0:
+    resolution: {integrity: sha512-3nk8Y3a9Ea8szgKhinMlGMhGMw89mqule3KWczxhIzqudyHdCIOHw8WJlj/r329fACjKLEh13ZSk7oE22kyeIw==}
+    engines: {node: '>=18.0.0', npm: '>=8.0.0'}
+    hasBin: true
+
+  rrweb-cssom@0.6.0:
+    resolution: {integrity: sha512-APM0Gt1KoXBz0iIkkdB/kfvGOwC4UuJFeG/c+yV7wSc7q96cG/kJ0HiYCnzivD9SB53cLV1MlHFNfOuPaadYSw==}
+
+  rrweb-cssom@0.7.1:
+    resolution: {integrity: sha512-TrEMa7JGdVm0UThDJSx7ddw5nVm3UJS9o9CCIZ72B1vSyEZoziDqBYP3XIoi/12lKrJR8rE3jeFHMok2F/Mnsg==}
+
+  run-applescript@7.1.0:
+    resolution: {integrity: sha512-DPe5pVFaAsinSaV6QjQ6gdiedWDcRCbUuiQfQa2wmWV7+xC9bGulGI8+TdRmoFkAPaBXk8CrAbnlY2ISniJ47Q==}
+    engines: {node: '>=18'}
+
+  run-parallel@1.2.0:
+    resolution: {integrity: sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA==}
+
+  safe-array-concat@1.1.3:
+    resolution: {integrity: sha512-AURm5f0jYEOydBj7VQlVvDrjeFgthDdEF5H1dP+6mNpoXOMo1quQqJ4wvJDyRZ9+pO3kGWoOdmV08cSv2aJV6Q==}
+    engines: {node: '>=0.4'}
+
+  safe-buffer@5.1.2:
+    resolution: {integrity: sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==}
+
+  safe-buffer@5.2.1:
+    resolution: {integrity: sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==}
+
+  safe-push-apply@1.0.0:
+    resolution: {integrity: sha512-iKE9w/Z7xCzUMIZqdBsp6pEQvwuEebH4vdpjcDWnyzaI6yl6O9FHvVpmGelvEHNsoY6wGblkxR6Zty/h00WiSA==}
+    engines: {node: '>= 0.4'}
+
+  safe-regex-test@1.1.0:
+    resolution: {integrity: sha512-x/+Cz4YrimQxQccJf5mKEbIa1NzeCRNI5Ecl/ekmlYaampdNLPalVyIcCZNNH3MvmqBugV5TMYZXv0ljslUlaw==}
+    engines: {node: '>= 0.4'}
+
+  safer-buffer@2.1.2:
+    resolution: {integrity: sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==}
+
+  sanitize-html@2.17.0:
+    resolution: {integrity: sha512-dLAADUSS8rBwhaevT12yCezvioCA+bmUTPH/u57xKPT8d++voeYE6HeluA/bPbQ15TwDBG2ii+QZIEmYx8VdxA==}
+
+  sax@1.6.0:
+    resolution: {integrity: sha512-6R3J5M4AcbtLUdZmRv2SygeVaM7IhrLXu9BmnOGmmACak8fiUtOsYNWUS4uK7upbmHIBbLBeFeI//477BKLBzA==}
+    engines: {node: '>=11.0.0'}
+
+  saxes@6.0.0:
+    resolution: {integrity: sha512-xAg7SOnEhrm5zI3puOOKyy1OMcMlIJZYNJY7xLBwSze0UjhPLnWfj2GF2EpT0jmzaJKIWKHLsaSSajf35bcYnA==}
+    engines: {node: '>=v12.22.7'}
+
+  scheduler@0.20.2:
+    resolution: {integrity: sha512-2eWfGgAqqWFGqtdMmcL5zCMK1U8KlXv8SQFGglL3CEtd0aDVDWgeF/YoCmvln55m5zSk3J/20hTaSBeSObsQDQ==}
+
+  schema-utils@3.3.0:
+    resolution: {integrity: sha512-pN/yOAvcC+5rQ5nERGuwrjLlYvLTbCibnZ1I7B1LaiAz9BRBlE9GMgE/eqV30P7aJQUf7Ddimy/RsbYO/GrVGg==}
+    engines: {node: '>= 10.13.0'}
+
+  schema-utils@4.3.3:
+    resolution: {integrity: sha512-eflK8wEtyOE6+hsaRVPxvUKYCpRgzLqDTb8krvAsRIwOGlHoSgYLgBXoubGgLd2fT41/OUYdb48v4k4WWHQurA==}
+    engines: {node: '>= 10.13.0'}
+
+  select-hose@2.0.0:
+    resolution: {integrity: sha512-mEugaLK+YfkijB4fx0e6kImuJdCIt2LxCRcbEYPqRGCs4F2ogyfZU5IAZRdjCP8JPq2AtdNoC/Dux63d9Kiryg==}
+
+  selfsigned@5.5.0:
+    resolution: {integrity: sha512-ftnu3TW4+3eBfLRFnDEkzGxSF/10BJBkaLJuBHZX0kiPS7bRdlpZGu6YGt4KngMkdTwJE6MbjavFpqHvqVt+Ew==}
+    engines: {node: '>=18'}
+
+  semver@5.7.2:
+    resolution: {integrity: sha512-cBznnQ9KjJqU67B52RMC65CMarK2600WFnbkcaiwWq3xy/5haFJlshgnpjovMVJ+Hff49d8GEn0b87C5pDQ10g==}
+    hasBin: true
+
+  semver@6.3.1:
+    resolution: {integrity: sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==}
+    hasBin: true
+
+  semver@7.7.4:
+    resolution: {integrity: sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==}
+    engines: {node: '>=10'}
+    hasBin: true
+
+  semver@7.8.4:
+    resolution: {integrity: sha512-rUCObTnP32Q08R2uuIrt7r9PlEonuTmtuXYcW6s5kjdlj3xbnwe+21yXptAUYcMAABLkYYTtnmzb3w3EDZfueA==}
+    engines: {node: '>=10'}
+    hasBin: true
+
+  send@0.19.2:
+    resolution: {integrity: sha512-VMbMxbDeehAxpOtWJXlcUS5E8iXh6QmN+BkRX1GARS3wRaXEEgzCcB10gTQazO42tpNIya8xIyNx8fll1OFPrg==}
+    engines: {node: '>= 0.8.0'}
+
+  serialize-javascript@6.0.1:
+    resolution: {integrity: sha512-owoXEFjWRllis8/M1Q+Cw5k8ZH40e3zhp/ovX+Xr/vi1qj6QesbyXXViFbpNvWvPNAD62SutwEXavefrLJWj7w==}
+
+  serve-index@1.9.1:
+    resolution: {integrity: sha512-pXHfKNP4qujrtteMrSBb0rc8HJ9Ms/GrXwcUtUtD5s4ewDJI8bT3Cz2zTVRMKtri49pLx2e0Ya8ziP5Ya2pZZw==}
+    engines: {node: '>= 0.8.0'}
+
+  serve-static@1.16.3:
+    resolution: {integrity: sha512-x0RTqQel6g5SY7Lg6ZreMmsOzncHFU7nhnRWkKgWuMTu5NN0DR5oruckMqRvacAN9d5w6ARnRBXl9xhDCgfMeA==}
+    engines: {node: '>= 0.8.0'}
+
+  set-blocking@2.0.0:
+    resolution: {integrity: sha512-KiKBS8AnWGEyLzofFfmvKwpdPzqiy16LvQfK3yv/fVH7Bj13/wl3JSR1J+rfgRE9q7xUJK4qvgS8raSOeLUehw==}
+
+  set-cookie-parser@3.1.0:
+    resolution: {integrity: sha512-kjnC1DXBHcxaOaOXBHBeRtltsDG2nUiUni+jP92M9gYdW12rsmx92UsfpH7o5tDRs7I1ZZPSQJQGv3UaRfCiuw==}
+
+  set-function-length@1.2.2:
+    resolution: {integrity: sha512-pgRc4hJ4/sNjWCSS9AmnS40x3bNMDTknHgL5UaMBTMyJnU90EgWh1Rz+MC9eFu4BuN/UwZjKQuY/1v3rM7HMfg==}
+    engines: {node: '>= 0.4'}
+
+  set-function-name@2.0.2:
+    resolution: {integrity: sha512-7PGFlmtwsEADb0WYyvCMa1t+yke6daIG4Wirafur5kcf+MhUnPms1UeR0CKQdTZD81yESwMHbtn+TR+dMviakQ==}
+    engines: {node: '>= 0.4'}
+
+  set-proto@1.0.0:
+    resolution: {integrity: sha512-RJRdvCo6IAnPdsvP/7m6bsQqNnn1FCBX5ZNtFL98MmFF/4xAIJTIg1YbHW5DC2W5SKZanrC6i4HsJqlajw/dZw==}
+    engines: {node: '>= 0.4'}
+
+  setprototypeof@1.1.0:
+    resolution: {integrity: sha512-BvE/TwpZX4FXExxOxZyRGQQv651MSwmWKZGqvmPcRIjDqWub67kTKuIMx43cZZrS/cBBzwBcNDWoFxt2XEFIpQ==}
+
+  setprototypeof@1.2.0:
+    resolution: {integrity: sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==}
+
+  shallow-clone@3.0.1:
+    resolution: {integrity: sha512-/6KqX+GVUdqPuPPd2LxDDxzX6CAbjJehAAOKlNpqqUpAqPM6HeL8f+o3a+JsyGjn2lv0WY8UsTgUJjU9Ok55NA==}
+    engines: {node: '>=8'}
+
+  shebang-command@2.0.0:
+    resolution: {integrity: sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==}
+    engines: {node: '>=8'}
+
+  shebang-regex@3.0.0:
+    resolution: {integrity: sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==}
+    engines: {node: '>=8'}
+
+  shell-quote@1.8.4:
+    resolution: {integrity: sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ==}
+    engines: {node: '>= 0.4'}
+
+  shellwords@0.1.1:
+    resolution: {integrity: sha512-vFwSUfQvqybiICwZY5+DAWIPLKsWO31Q91JSKl3UYv+K5c2QRPzn0qzec6QPu1Qc9eHYItiP3NdJqNVqetYAww==}
+
+  shiki@1.29.2:
+    resolution: {integrity: sha512-njXuliz/cP+67jU2hukkxCNuH1yUi4QfdZZY+sMr5PPrIyXSu5iTb/qYC4BiWWB0vZ+7TbdvYUCeL23zpwCfbg==}
+
+  should-equal@2.0.0:
+    resolution: {integrity: sha512-ZP36TMrK9euEuWQYBig9W55WPC7uo37qzAEmbjHz4gfyuXrEUgF8cUvQVO+w+d3OMfPvSRQJ22lSm8MQJ43LTA==}
+
+  should-format@3.0.3:
+    resolution: {integrity: sha512-hZ58adtulAk0gKtua7QxevgUaXTTXxIi8t41L3zo9AHvjXO1/7sdLECuHeIN2SRtYXpNkmhoUP2pdeWgricQ+Q==}
+
+  should-type-adaptors@1.1.0:
+    resolution: {integrity: sha512-JA4hdoLnN+kebEp2Vs8eBe9g7uy0zbRo+RMcU0EsNy+R+k049Ki+N5tT5Jagst2g7EAja+euFuoXFCa8vIklfA==}
+
+  should-type@1.4.0:
+    resolution: {integrity: sha512-MdAsTu3n25yDbIe1NeN69G4n6mUnJGtSJHygX3+oN0ZbO3DTiATnf7XnYJdGT42JCXurTb1JI0qOBR65shvhPQ==}
+
+  should-util@1.0.1:
+    resolution: {integrity: sha512-oXF8tfxx5cDk8r2kYqlkUJzZpDBqVY/II2WhvU0n9Y3XYvAYRmeaf1PvvIvTgPnv4KJ+ES5M0PyDq5Jp+Ygy2g==}
+
+  should@13.2.3:
+    resolution: {integrity: sha512-ggLesLtu2xp+ZxI+ysJTmNjh2U0TsC+rQ/pfED9bUZZ4DKefP27D+7YJVVTvKsmjLpIi9jAa7itwDGkDDmt1GQ==}
+
+  side-channel-list@1.0.0:
+    resolution: {integrity: sha512-FCLHtRD/gnpCiCHEiJLOwdmFP+wzCmDEkc9y7NsYxeF4u7Btsn1ZuwgwJGxImImHicJArLP4R0yX4c2KCrMrTA==}
+    engines: {node: '>= 0.4'}
+
+  side-channel-map@1.0.1:
+    resolution: {integrity: sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==}
+    engines: {node: '>= 0.4'}
+
+  side-channel-weakmap@1.0.2:
+    resolution: {integrity: sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==}
+    engines: {node: '>= 0.4'}
+
+  side-channel@1.1.0:
+    resolution: {integrity: sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw==}
+    engines: {node: '>= 0.4'}
+
+  siginfo@2.0.0:
+    resolution: {integrity: sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g==}
+
+  signal-exit@4.1.0:
+    resolution: {integrity: sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==}
+    engines: {node: '>=14'}
+
+  simple-is@0.2.0:
+    resolution: {integrity: sha512-GJXhv3r5vdj5tGWO+rcrWgjU2azLB+fb7Ehh3SmZpXE0o4KrrFLti0w4mdDCbR29X/z0Ls20ApjZitlpAXhAeg==}
+
+  sirv@3.0.2:
+    resolution: {integrity: sha512-2wcC/oGxHis/BoHkkPwldgiPSYcpZK3JU28WoMVv55yHJgcZ8rlXvuG9iZggz+sU1d4bRgIGASwyWqjxu3FM0g==}
+    engines: {node: '>=18'}
+
+  slash@4.0.0:
+    resolution: {integrity: sha512-3dOsAHXXUkQTpOYcoAxLIorMTp4gIQr5IW3iVb7A7lFIp0VHhnynm9izx6TssdrIcVIESAlVjtnO2K8bg+Coew==}
+    engines: {node: '>=12'}
+
+  sleep-promise@9.1.0:
+    resolution: {integrity: sha512-UHYzVpz9Xn8b+jikYSD6bqvf754xL2uBUzDFwiU6NcdZeifPr6UfgU43xpkPu67VMS88+TI2PSI7Eohgqf2fKA==}
+
+  slice-ansi@7.1.2:
+    resolution: {integrity: sha512-iOBWFgUX7caIZiuutICxVgX1SdxwAVFFKwt1EvMYYec/NWO5meOJ6K5uQxhrYBdQJne4KxiqZc+KptFOWFSI9w==}
+    engines: {node: '>=18'}
+
+  slice-ansi@8.0.0:
+    resolution: {integrity: sha512-stxByr12oeeOyY2BlviTNQlYV5xOj47GirPr4yA1hE9JCtxfQN0+tVbkxwCtYDQWhEKWFHsEK48ORg5jrouCAg==}
+    engines: {node: '>=20'}
+
+  smtp-address-parser@1.0.10:
+    resolution: {integrity: sha512-Osg9LmvGeAG/hyao4mldbflLOkkr3a+h4m1lwKCK5U8M6ZAr7tdXEz/+/vr752TSGE4MNUlUl9cIK2cB8cgzXg==}
+    engines: {node: '>=0.10'}
+
+  snake-case@3.0.4:
+    resolution: {integrity: sha512-LAOh4z89bGQvl9pFfNF8V146i7o7/CqFPbqzYgP+yYzDIDeS9HaNFtXABamRW+AQzEVODcvE79ljJ+8a9YSdMg==}
+
+  sockjs@0.3.24:
+    resolution: {integrity: sha512-GJgLTZ7vYb/JtPSSZ10hsOYIvEYsjbNU+zPdIHcUaWVNUEPivzxku31865sSSud0Da0W4lEeOPlmw93zLQchuQ==}
+
+  source-map-js@1.2.1:
+    resolution: {integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==}
+    engines: {node: '>=0.10.0'}
+
+  source-map-loader@4.0.1:
+    resolution: {integrity: sha512-oqXpzDIByKONVY8g1NUPOTQhe0UTU5bWUl32GSkqK2LjJj0HmwTMVKxcUip0RgAYhY1mqgOxjbQM48a0mmeNfA==}
+    engines: {node: '>= 14.15.0'}
+    peerDependencies:
+      webpack: ^5.72.1
+
+  source-map-support@0.5.21:
+    resolution: {integrity: sha512-uBHU3L3czsIyYXKX88fdrGovxdSCoTGDRZ6SYXtSRxLZUzHg5P/66Ht6uoUlHu9EZod+inXhKo3qQgwXUT/y1w==}
+
+  source-map@0.5.7:
+    resolution: {integrity: sha512-LbrmJOMUSdEVxIKvdcJzQC+nQhe8FUZQTXQy6+I75skNgn3OoQ0DZA8YnFa7gp8tqtL3KPf1kmo0R5DoApeSGQ==}
+    engines: {node: '>=0.10.0'}
+
+  source-map@0.6.1:
+    resolution: {integrity: sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==}
+    engines: {node: '>=0.10.0'}
+
+  space-separated-tokens@2.0.2:
+    resolution: {integrity: sha512-PEGlAwrG8yXGXRjW32fGbg66JAlOAwbObuqVoJpv/mRgoWDQfgH1wDPvtzWyUSNAXBGSk8h755YDbbcEy3SH2Q==}
+
+  spdy-transport@3.0.0:
+    resolution: {integrity: sha512-hsLVFE5SjA6TCisWeJXFKniGGOpBgMLmerfO2aCyCU5s7nJ/rpAepqmFifv/GCbSbueEeAJJnmSQ2rKC/g8Fcw==}
+
+  spdy@4.0.2:
+    resolution: {integrity: sha512-r46gZQZQV+Kl9oItvl1JZZqJKGr+oEkB08A6BzkiR7593/7IbtuncXHd2YoYeTsG4157ZssMu9KYvUHLcjcDoA==}
+    engines: {node: '>=6.0.0'}
+
+  speed-measure-webpack-plugin@1.5.0:
+    resolution: {integrity: sha512-Re0wX5CtM6gW7bZA64ONOfEPEhwbiSF/vz6e2GvadjuaPrQcHTQdRGsD8+BE7iUOysXH8tIenkPCQBEcspXsNg==}
+    engines: {node: '>=6.0.0'}
+    peerDependencies:
+      webpack: ^1 || ^2 || ^3 || ^4 || ^5
+
+  spinkit@2.0.1:
+    resolution: {integrity: sha512-oYBGY0GV1H1dX+ZdKnB6JVsYC1w/Xl20H111eb+WSS8nUYmlHgGb4y5buFSkzzceEeYYh5kMhXoAmoTpiQauiA==}
+
+  sprintf-js@1.0.3:
+    resolution: {integrity: sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g==}
+
+  stable-hash-x@0.2.0:
+    resolution: {integrity: sha512-o3yWv49B/o4QZk5ZcsALc6t0+eCelPc44zZsLtCQnZPDwFpDYSWcDnrv2TtMmMbQ7uKo3J0HTURCqckw23czNQ==}
+    engines: {node: '>=12.0.0'}
+
+  stackback@0.0.2:
+    resolution: {integrity: sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw==}
+
+  statuses@1.5.0:
+    resolution: {integrity: sha512-OpZ3zP+jT1PI7I8nemJX4AKmAX070ZkYPVWV/AaKTJl+tXCTGyVdC1a4SL8RUQYEwk/f34ZX8UTykN68FwrqAA==}
+    engines: {node: '>= 0.6'}
+
+  statuses@2.0.2:
+    resolution: {integrity: sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==}
+    engines: {node: '>= 0.8'}
+
+  std-env@4.1.0:
+    resolution: {integrity: sha512-Rq7ybcX2RuC55r9oaPVEW7/xu3tj8u4GeBYHBWCychFtzMIr86A7e3PPEBPT37sHStKX3+TiX/Fr/ACmJLVlLQ==}
+
+  stop-iteration-iterator@1.1.0:
+    resolution: {integrity: sha512-eLoXW/DHyl62zxY4SCaIgnRhuMr6ri4juEYARS8E6sCEqzKpOiE521Ucofdx+KnDZl5xmvGYaaKCk5FEOxJCoQ==}
+    engines: {node: '>= 0.4'}
+
+  storybook-css-modules-preset@1.1.1:
+    resolution: {integrity: sha512-wyINPOtB/8SvU7J92ePAhciBk4xoHuwrcqDNyGnSwilwHjmtHwbeEgZ1//JALOTwMB10zwz3WPONRkWec9LdGw==}
+
+  storybook@10.4.2:
+    resolution: {integrity: sha512-5Ax5vbHxFgMBGGhQDm75Rrumm/HZC4ICFhMcJaM0UlqnC/4FKj/IaZtImZFupknyiiyUEcWHPQFA2kX3/VSv1A==}
+    hasBin: true
+    peerDependencies:
+      '@types/react': ^17.0.37
+      prettier: ^2 || ^3
+      vite-plus: ^0.1.15
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      prettier:
+        optional: true
+      vite-plus:
+        optional: true
+
+  strict-event-emitter@0.5.1:
+    resolution: {integrity: sha512-vMgjE/GGEPEFnhFub6pa4FmJBRBVOLpIII2hvCZ8Kzb7K0hlHo7mQv6xYrBvCL2LtAIBwFUK8wvuJgTVSQ5MFQ==}
+
+  string-argv@0.3.2:
+    resolution: {integrity: sha512-aqD2Q0144Z+/RqG52NeHEkZauTAUWJO8c6yTftGJKO3Tja5tUgIfmIl6kExvhtxSDP7fXB6DvzkfMpCd/F3G+Q==}
+    engines: {node: '>=0.6.19'}
+
+  string-width@4.2.3:
+    resolution: {integrity: sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==}
+    engines: {node: '>=8'}
+
+  string-width@7.2.0:
+    resolution: {integrity: sha512-tsaTIkKW9b4N+AEj+SVA+WhJzV7/zMhcSu78mLKWSk7cXMOSHsBKFWUs0fWwq8QyK3MgJBQRX6Gbi4kYbdvGkQ==}
+    engines: {node: '>=18'}
+
+  string-width@8.2.1:
+    resolution: {integrity: sha512-IIaP0g3iy9Cyy18w3M9YcaDudujEAVHKt3a3QJg1+sr/oX96TbaGUubG0hJyCjCBThFH+tFpcIyoUHUn1ogaLA==}
+    engines: {node: '>=20'}
+
+  string.prototype.includes@2.0.1:
+    resolution: {integrity: sha512-o7+c9bW6zpAdJHTtujeePODAhkuicdAryFsfVKwA+wGw89wJ4GTY484WTucM9hLtDEOpOvI+aHnzqnC5lHp4Rg==}
+    engines: {node: '>= 0.4'}
+
+  string.prototype.matchall@4.0.12:
+    resolution: {integrity: sha512-6CC9uyBL+/48dYizRf7H7VAYCMCNTBeM78x/VTUe9bFEaxBepPJDa1Ow99LqI/1yF7kuy7Q3cQsYMrcjGUcskA==}
+    engines: {node: '>= 0.4'}
+
+  string.prototype.repeat@1.0.0:
+    resolution: {integrity: sha512-0u/TldDbKD8bFCQ/4f5+mNRrXwZ8hg2w7ZR8wa16e8z9XpePWl3eGEcUD0OXpEH/VJH/2G3gjUtR3ZOiBe2S/w==}
+
+  string.prototype.trim@1.2.10:
+    resolution: {integrity: sha512-Rs66F0P/1kedk5lyYyH9uBzuiI/kNRmwJAR9quK6VOtIpZ2G+hMZd+HQbbv25MgCA6gEffoMZYxlTod4WcdrKA==}
+    engines: {node: '>= 0.4'}
+
+  string.prototype.trimend@1.0.9:
+    resolution: {integrity: sha512-G7Ok5C6E/j4SGfyLCloXTrngQIQU3PWtXGst3yM7Bea9FRURf1S42ZHlZZtsNque2FN2PoUhfZXYLNWwEr4dLQ==}
+    engines: {node: '>= 0.4'}
+
+  string.prototype.trimstart@1.0.8:
+    resolution: {integrity: sha512-UXSH262CSZY1tfu3G3Secr6uGLCFVPMhIqHjlgCUtCCcgihYc/xKs9djMTMUOb2j1mVSeU8EU6NWc/iQKU6Gfg==}
+    engines: {node: '>= 0.4'}
+
+  string_decoder@1.1.1:
+    resolution: {integrity: sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==}
+
+  string_decoder@1.3.0:
+    resolution: {integrity: sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==}
+
+  stringify-entities@4.0.4:
+    resolution: {integrity: sha512-IwfBptatlO+QCJUo19AqvrPNqlVMpW9YEL2LIVY+Rpv2qsjCGxaDLNRgeGsQWJhfItebuJhsGSLjaBbNSQ+ieg==}
+
+  strip-ansi@6.0.1:
+    resolution: {integrity: sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==}
+    engines: {node: '>=8'}
+
+  strip-ansi@7.1.0:
+    resolution: {integrity: sha512-iq6eVVI64nQQTRYq2KtEg2d2uU7LElhTJwsH4YzIHZshxlgZms/wIc4VoDQTlG/IvVIrBKG06CrZnp0qv7hkcQ==}
+    engines: {node: '>=12'}
+
+  strip-ansi@7.2.0:
+    resolution: {integrity: sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w==}
+    engines: {node: '>=12'}
+
+  strip-bom@3.0.0:
+    resolution: {integrity: sha512-vavAMRXOgBVNF6nyEEmL3DBK19iRpDcoIwW+swQ+CbGiu7lju6t+JklA1MHweoWtadgt4ISVUsXLyDq34ddcwA==}
+    engines: {node: '>=4'}
+
+  strip-indent@3.0.0:
+    resolution: {integrity: sha512-laJTa3Jb+VQpaC6DseHhF7dXVqHTfJPCRDaEbid/drOhgitgYku/letMUqOXFoWV0zIIUbjpdH2t+tYj4bQMRQ==}
+    engines: {node: '>=8'}
+
+  strip-indent@4.0.0:
+    resolution: {integrity: sha512-mnVSV2l+Zv6BLpSD/8V87CW/y9EmmbYzGCIavsnsI6/nwn26DwffM/yztm30Z/I2DY9wdS3vXVCMnHDgZaVNoA==}
+    engines: {node: '>=12'}
+
+  strip-json-comments@3.1.1:
+    resolution: {integrity: sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==}
+    engines: {node: '>=8'}
+
+  style-loader@3.3.3:
+    resolution: {integrity: sha512-53BiGLXAcll9maCYtZi2RCQZKa8NQQai5C4horqKyRmHj9H7QmcUyucrH+4KW/gBQbXM2AsB0axoEcFZPlfPcw==}
+    engines: {node: '>= 12.13.0'}
+    peerDependencies:
+      webpack: ^5.0.0
+
+  style-loader@4.0.0:
+    resolution: {integrity: sha512-1V4WqhhZZgjVAVJyt7TdDPZoPBPNHbekX4fWnCJL1yQukhCeZhJySUL+gL9y6sNdN95uEOS83Y55SqHcP7MzLA==}
+    engines: {node: '>= 18.12.0'}
+    peerDependencies:
+      webpack: ^5.27.0
+
+  style-mod@4.1.2:
+    resolution: {integrity: sha512-wnD1HyVqpJUI2+eKZ+eo1UwghftP6yuFheBqqe+bWCotBjC2K1YnteJILRMs3SM4V/0dLEW1SC27MWP5y+mwmw==}
+
+  stylehacks@8.0.0:
+    resolution: {integrity: sha512-sWyjaJvBqHoVKYPbQ8JRvrGSPaYWtWrJsU+fGVtwKB1GE1rRPu3rC7T6UCuXLoL00Dwb+tsHe2T904r8Vnsx8w==}
+    engines: {node: ^22.11.0 || ^24.11.0 || >=26.0}
+    peerDependencies:
+      postcss: ^8.5.14
+
+  stylis@4.2.0:
+    resolution: {integrity: sha512-Orov6g6BB1sDfYgzWfTHDOxamtX1bE/zo104Dh9e6fqJ3PooipYyfJ0pUmrZO2wAvO8YbEyeFrkV91XTsGMSrw==}
+
+  sucrase@3.34.0:
+    resolution: {integrity: sha512-70/LQEZ07TEcxiU2dz51FKaE6hCTWC6vr7FOk3Gr0U60C3shtAN+H+BFr9XlYe5xqf3RA8nrc+VIwzCfnxuXJw==}
+    engines: {node: '>=8'}
+    hasBin: true
+
+  superjson@1.13.3:
+    resolution: {integrity: sha512-mJiVjfd2vokfDxsQPOwJ/PtanO87LhpYY88ubI5dUB1Ab58Txbyje3+jpm+/83R/fevaq/107NNhtYBLuoTrFg==}
+    engines: {node: '>=10'}
+
+  supports-color@7.2.0:
+    resolution: {integrity: sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==}
+    engines: {node: '>=8'}
+
+  supports-color@8.1.1:
+    resolution: {integrity: sha512-MpUEN2OodtUzxvKQl72cUF7RQ5EiHsGvSsVG0ia9c5RbWGL2CI4C7EpPS8UTBIplnlzZiNuV56w+FuNxy3ty2Q==}
+    engines: {node: '>=10'}
+
+  supports-preserve-symlinks-flag@1.0.0:
+    resolution: {integrity: sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w==}
+    engines: {node: '>= 0.4'}
+
+  svg-parser@2.0.4:
+    resolution: {integrity: sha512-e4hG1hRwoOdRb37cIMSgzNsxyzKfayW6VOflrwvR+/bzrkyxY/31WkbgnQpgtrNp1SdpJvpUAGTa/ZoiPNDuRQ==}
+
+  svgo@3.0.2:
+    resolution: {integrity: sha512-Z706C1U2pb1+JGP48fbazf3KxHrWOsLme6Rv7imFBn5EnuanDW1GPaA/P1/dvObE670JDePC3mnj0k0B7P0jjQ==}
+    engines: {node: '>=14.0.0'}
+    hasBin: true
+
+  svgo@4.0.1:
+    resolution: {integrity: sha512-XDpWUOPC6FEibaLzjfe0ucaV0YrOjYotGJO1WpF0Zd+n6ZGEQUsSugaoLq9QkEZtAfQIxT42UChcssDVPP3+/w==}
+    engines: {node: '>=16'}
+    hasBin: true
+
+  swagger2openapi@7.0.8:
+    resolution: {integrity: sha512-upi/0ZGkYgEcLeGieoz8gT74oWHA0E7JivX7aN9mAf+Tc7BQoRBvnIGHoPDw+f9TXTW4s6kGYCZJtauP6OYp7g==}
+    hasBin: true
+
+  swc-loader@0.2.7:
+    resolution: {integrity: sha512-nwYWw3Fh9ame3Rtm7StS9SBLpHRRnYcK7bnpF3UKZmesAK0gw2/ADvlURFAINmPvKtDLzp+GBiP9yLoEjg6S9w==}
+    peerDependencies:
+      '@swc/core': ^1.2.147
+      webpack: '>=2'
+
+  symbol-tree@3.2.4:
+    resolution: {integrity: sha512-9QNk5KwDF+Bvz+PyObkmSYjI5ksVUYtjW7AU22r2NKcfLJcXp96hkDWU3+XndOsUb+AQ9QhfzfCT2O+CNWT5Tw==}
+
+  tabbable@4.0.0:
+    resolution: {integrity: sha512-H1XoH1URcBOa/rZZWxLxHCtOdVUEev+9vo5YdYhC9tCY4wnybX+VQrCYuy9ubkg69fCBxCONJOSLGfw0DWMffQ==}
+
+  tabbable@5.3.3:
+    resolution: {integrity: sha512-QD9qKY3StfbZqWOPLp0++pOrAVb/HbUi5xCc8cUo4XjP19808oaMiDzn0leBY5mCespIBM0CIZePzZjgzR83kA==}
+
+  tagged-tag@1.0.0:
+    resolution: {integrity: sha512-yEFYrVhod+hdNyx7g5Bnkkb0G6si8HJurOoOEgC8B/O0uXLHlaey/65KRv6cuWBNhBgHKAROVpc7QyYqE5gFng==}
+    engines: {node: '>=20'}
+
+  tailwindcss-animate@1.0.7:
+    resolution: {integrity: sha512-bl6mpH3T7I3UFxuvDEXLxy/VuFxBk5bbzplh7tXI68mwMokNYd1t9qPBHlnyTwfa4JGC4zP516I1hYYtQ/vspA==}
+    peerDependencies:
+      tailwindcss: '>=3.0.0 || insiders'
+
+  tailwindcss@3.3.3:
+    resolution: {integrity: sha512-A0KgSkef7eE4Mf+nKJ83i75TMyq8HqY3qmFIJSWy8bNt0v1lG7jUcpGpoTFxAwYcWOphcTBLPPJg+bDfhDf52w==}
+    engines: {node: '>=14.0.0'}
+    hasBin: true
+
+  tapable@2.3.3:
+    resolution: {integrity: sha512-uxc/zpqFg6x7C8vOE7lh6Lbda8eEL9zmVm/PLeTPBRhh1xCgdWaQ+J1CUieGpIfm2HdtsUpRv+HshiasBMcc6A==}
+    engines: {node: '>=6'}
+
+  terser-webpack-plugin@5.6.1:
+    resolution: {integrity: sha512-201R5j+sJpK8nFWwKVyNfZot8FaJbLZDq5evriVzbV1wDtSXDjRUDRfJzHpAaxFDMEhsZL1QkeqM61wgsS3KaQ==}
+    engines: {node: '>= 10.13.0'}
+    peerDependencies:
+      '@minify-html/node': '*'
+      '@swc/core': '*'
+      '@swc/css': '*'
+      '@swc/html': '*'
+      clean-css: '*'
+      cssnano: '*'
+      csso: '*'
+      esbuild: '*'
+      html-minifier-terser: '*'
+      lightningcss: '*'
+      postcss: '*'
+      uglify-js: '*'
+      webpack: ^5.1.0
+    peerDependenciesMeta:
+      '@minify-html/node':
+        optional: true
+      '@swc/core':
+        optional: true
+      '@swc/css':
+        optional: true
+      '@swc/html':
+        optional: true
+      clean-css:
+        optional: true
+      cssnano:
+        optional: true
+      csso:
+        optional: true
+      esbuild:
+        optional: true
+      html-minifier-terser:
+        optional: true
+      lightningcss:
+        optional: true
+      postcss:
+        optional: true
+      uglify-js:
+        optional: true
+
+  terser@5.44.1:
+    resolution: {integrity: sha512-t/R3R/n0MSwnnazuPpPNVO60LX0SKL45pyl9YlvxIdkH0Of7D5qM2EVe+yASRIlY5pZ73nclYJfNANGWPwFDZw==}
+    engines: {node: '>=10'}
+    hasBin: true
+
+  test-exclude@6.0.0:
+    resolution: {integrity: sha512-cAGWPIyOHU6zlmg88jwm7VRyXnMN7iV68OGAbYDk/Mh/xC/pzVPlQtY6ngoIH/5/tciuhGfvESU8GrHrcxD56w==}
+    engines: {node: '>=8'}
+
+  thenify-all@1.6.0:
+    resolution: {integrity: sha512-RNxQH/qI8/t3thXJDwcstUO4zeqo64+Uy/+sNVRBx4Xn2OX+OZ9oP+iJnNFqplFra2ZUVeKCSa2oVWi3T4uVmA==}
+    engines: {node: '>=0.8'}
+
+  thenify@3.3.1:
+    resolution: {integrity: sha512-RVZSIV5IG10Hk3enotrhvz0T9em6cyHBLkH/YAZuKqd8hRkKhSfCGIcP2KUY0EPxndzANBmNllzWPwak+bheSw==}
+
+  thingies@2.5.0:
+    resolution: {integrity: sha512-s+2Bwztg6PhWUD7XMfeYm5qliDdSiZm7M7n8KjTkIsm3l/2lgVRc2/Gx/v+ZX8lT4FMA+i8aQvhcWylldc+ZNw==}
+    engines: {node: '>=10.18'}
+    peerDependencies:
+      tslib: ^2
+
+  thunky@1.1.0:
+    resolution: {integrity: sha512-eHY7nBftgThBqOyHGVN+l8gF0BucP09fMo0oO/Lb0w1OF80dJv+lDVpXG60WMQvkcxAkNybKsrEIE3ZtKGmPrA==}
+
+  tiny-invariant@1.3.3:
+    resolution: {integrity: sha512-+FbBPE1o9QAYvviau/qC5SE3caw21q3xkvWKBtja5vgqOWIHHJ3ioaq1VPfn/Szqctz2bU/oYeKd9/z5BL+PVg==}
+
+  tiny-warning@1.0.3:
+    resolution: {integrity: sha512-lBN9zLN/oAf68o3zNXYrdCt1kP8WsiGW8Oo2ka41b2IM5JL/S1CTyX1rW0mb/zSuJun0ZUrDxx4sqvYS2FWzPA==}
+
+  tinybench@2.9.0:
+    resolution: {integrity: sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg==}
+
+  tinyexec@1.0.2:
+    resolution: {integrity: sha512-W/KYk+NFhkmsYpuHq5JykngiOCnxeVL8v8dFnqxSD8qEEdRfXk1SDM6JzNqcERbcGYj9tMrDQBYV9cjgnunFIg==}
+    engines: {node: '>=18'}
+
+  tinyexec@1.2.4:
+    resolution: {integrity: sha512-SHf/r48b7vOrjve9PxJo3MN5v5yuyjHvdUcrQffT3WXMUfnGmHDVbC4k3sHJaJTgZCwpUplIaAo5ANtMyp3YHg==}
+    engines: {node: '>=18'}
+
+  tinyglobby@0.2.17:
+    resolution: {integrity: sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==}
+    engines: {node: '>=12.0.0'}
+
+  tinyrainbow@2.0.0:
+    resolution: {integrity: sha512-op4nsTR47R6p0vMUUoYl/a+ljLFVtlfaXkLQmqfLR1qHma1h/ysYk4hEXZ880bf2CYgTskvTa/e196Vd5dDQXw==}
+    engines: {node: '>=14.0.0'}
+
+  tinyrainbow@3.1.0:
+    resolution: {integrity: sha512-Bf+ILmBgretUrdJxzXM0SgXLZ3XfiaUuOj/IKQHuTXip+05Xn+uyEYdVg0kYDipTBcLrCVyUzAPz7QmArb0mmw==}
+    engines: {node: '>=14.0.0'}
+
+  tinyspy@4.0.4:
+    resolution: {integrity: sha512-azl+t0z7pw/z958Gy9svOTuzqIk6xq+NSheJzn5MMWtWTFywIacg2wUlzKFGtt3cthx0r2SxMK0yzJOR0IES7Q==}
+    engines: {node: '>=14.0.0'}
+
+  tippy.js@6.3.7:
+    resolution: {integrity: sha512-E1d3oP2emgJ9dRQZdf3Kkn0qJgI6ZLpyS5z6ZkY1DF3kaQaBsGZsndEpHwx+eC+tYM41HaSNvNtLx8tU57FzTQ==}
+
+  tldts-core@7.0.23:
+    resolution: {integrity: sha512-0g9vrtDQLrNIiCj22HSe9d4mLVG3g5ph5DZ8zCKBr4OtrspmNB6ss7hVyzArAeE88ceZocIEGkyW1Ime7fxPtQ==}
+
+  tldts@7.0.23:
+    resolution: {integrity: sha512-ASdhgQIBSay0R/eXggAkQ53G4nTJqTXqC2kbaBbdDwM7SkjyZyO0OaaN1/FH7U/yCeqOHDwFO5j8+Os/IS1dXw==}
+    hasBin: true
+
+  to-fast-properties@2.0.0:
+    resolution: {integrity: sha512-/OaKK0xYrs3DmxRYqL/yDc+FxFUVYhDlXMhRmv3z915w2HF1tnN1omB354j8VUGO/hbRzyD6Y3sA7v7GS/ceog==}
+    engines: {node: '>=4'}
+
+  to-regex-range@5.0.1:
+    resolution: {integrity: sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==}
+    engines: {node: '>=8.0'}
+
+  toastr@2.1.4:
+    resolution: {integrity: sha512-LIy77F5n+sz4tefMmFOntcJ6HL0Fv3k1TDnNmFZ0bU/GcvIIfy6eG2v7zQmMiYgaalAiUv75ttFrPn5s0gyqlA==}
+
+  toidentifier@1.0.1:
+    resolution: {integrity: sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==}
+    engines: {node: '>=0.6'}
+
+  toposort@2.0.2:
+    resolution: {integrity: sha512-0a5EOkAUp8D4moMi2W8ZF8jcga7BgZd91O/yabJCFY8az+XSzeGyTKs0Aoo897iV1Nj6guFq8orWDS96z91oGg==}
+
+  totalist@3.0.1:
+    resolution: {integrity: sha512-sf4i37nQ2LBx4m3wB74y+ubopq6W/dIzXg0FDGjsYnZHVa1Da8FH853wlL2gtUhg+xJXjfk3kUZS3BRoQeoQBQ==}
+    engines: {node: '>=6'}
+
+  tough-cookie@4.1.4:
+    resolution: {integrity: sha512-Loo5UUvLD9ScZ6jh8beX1T6sO1w2/MpCRpEP7V280GKMVUQ0Jzar2U3UJPsrdbziLEMMhu3Ujnq//rhiFuIeag==}
+    engines: {node: '>=6'}
+
+  tough-cookie@6.0.1:
+    resolution: {integrity: sha512-LktZQb3IeoUWB9lqR5EWTHgW/VTITCXg4D21M+lvybRVdylLrRMnqaIONLVb5mav8vM19m44HIcGq4qASeu2Qw==}
+    engines: {node: '>=16'}
+
+  tr46@0.0.3:
+    resolution: {integrity: sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw==}
+
+  tr46@5.0.0:
+    resolution: {integrity: sha512-tk2G5R2KRwBd+ZN0zaEXpmzdKyOYksXwywulIX95MBODjSzMIuQnQ3m8JxgbhnL1LeVo7lqQKsYa1O3Htl7K5g==}
+    engines: {node: '>=18'}
+
+  tree-dump@1.1.0:
+    resolution: {integrity: sha512-rMuvhU4MCDbcbnleZTFezWsaZXRFemSqAM+7jPnzUl1fo9w3YEKOxAeui0fz3OI4EU4hf23iyA7uQRVko+UaBA==}
+    engines: {node: '>=10.0'}
+    peerDependencies:
+      tslib: '2'
+
+  trim-lines@3.0.1:
+    resolution: {integrity: sha512-kRj8B+YHZCc9kQYdWfJB2/oUl9rA99qbowYYBtr4ui4mZyAQ2JpvVBd/6U2YloATfqBhBTSMhTpgBHtU0Mf3Rg==}
+
+  try@1.0.3:
+    resolution: {integrity: sha512-AHA8khVCII6zKyRkyPo6pRwoR9v5jb7QFw6e5avtaVSkxVfaEucYIo06xnwB+pJaEarfYNbs7W3Vq+LZLZiWyA==}
+
+  ts-api-utils@2.5.0:
+    resolution: {integrity: sha512-OJ/ibxhPlqrMM0UiNHJ/0CKQkoKF243/AEmplt3qpRgkW8VG7IfOS41h7V8TjITqdByHzrjcS/2si+y4lIh8NA==}
+    engines: {node: '>=18.12'}
+    peerDependencies:
+      typescript: '>=4.8.4'
+
+  ts-dedent@2.2.0:
+    resolution: {integrity: sha512-q5W7tVM71e2xjHZTlgfTDoPF/SmqKG5hddq9SzR49CH2hayqRKJtQ4mtRlSxKaJlR/+9rEM+mnBHf7I2/BQcpQ==}
+    engines: {node: '>=6.10'}
+
+  ts-interface-checker@0.1.13:
+    resolution: {integrity: sha512-Y/arvbn+rrz3JCKl9C4kVNfTfSm2/mEp5FSz5EsZSANGPSlQrpRI5M4PKF+mJnE52jOO90PnPSc3Ur3bTQw0gA==}
+
+  ts-xor@1.1.0:
+    resolution: {integrity: sha512-9vtspo9gVrmJR0XQyuNySpr6DhZztCDWS8LT5CO4gSeifILDRi4e8QZ0ixnvCyob9hMYRaOeo+OyW3ovhngjuA==}
+
+  tsconfck@3.0.1:
+    resolution: {integrity: sha512-7ppiBlF3UEddCLeI1JRx5m2Ryq+xk4JrZuq4EuYXykipebaq1dV0Fhgr1hb7CkmHt32QSgOZlcqVLEtHBG4/mg==}
+    engines: {node: ^18 || >=20}
+    hasBin: true
+    peerDependencies:
+      typescript: ^5.0.0
+    peerDependenciesMeta:
+      typescript:
+        optional: true
+
+  tsconfig-paths@3.15.0:
+    resolution: {integrity: sha512-2Ac2RgzDe/cn48GvOe3M+o82pEFewD3UPbyoUHHdKasHwJKjds4fLXWf/Ux5kATBKN20oaFGu+jbElp1pos0mg==}
+
+  tsconfig-paths@4.2.0:
+    resolution: {integrity: sha512-NoZ4roiN7LnbKn9QqE1amc9DJfzvZXxF4xDavcOWt1BPkdx+m+0gJuPM+S0vCe7zTJMYUP0R8pO2XMr+Y8oLIg==}
+    engines: {node: '>=6'}
+
+  tslib@1.14.1:
+    resolution: {integrity: sha512-Xni35NKzjgMrwevysHTCArtLDpPvye8zV/0E4EyYn43P7/7qvQwPh9BGkHewbMulVntbigmcT7rdX3BNo9wRJg==}
+
+  tslib@2.8.1:
+    resolution: {integrity: sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==}
+
+  tsyringe@4.10.0:
+    resolution: {integrity: sha512-axr3IdNuVIxnaK5XGEUFTu3YmAQ6lllgrvqfEoR16g/HGnYY/6We4oWENtAnzK6/LpJ2ur9PAb80RBt7/U4ugw==}
+    engines: {node: '>= 6.0.0'}
+
+  type-check@0.4.0:
+    resolution: {integrity: sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==}
+    engines: {node: '>= 0.8.0'}
+
+  type-fest@5.7.0:
+    resolution: {integrity: sha512-1URUxUqfHFM1c+zfSPsa3gnkO7Aq21qyH75SIduNYz4SzY964rn1X2vCMQaHSHhktiw+0kPa2iyb6PUpXqB6Vg==}
+    engines: {node: '>=20'}
+
+  type-is@1.6.18:
+    resolution: {integrity: sha512-TkRKr9sUTxEH8MdfuCSP7VizJyzRNMjj2J2do2Jr3Kym598JVdEksuzPQCnlFPW4ky9Q+iA+ma9BGm06XQBy8g==}
+    engines: {node: '>= 0.6'}
+
+  typed-array-buffer@1.0.3:
+    resolution: {integrity: sha512-nAYYwfY3qnzX30IkA6AQZjVbtK6duGontcQm1WSG1MD94YLqK0515GNApXkoxKOWMusVssAHWLh9SeaoefYFGw==}
+    engines: {node: '>= 0.4'}
+
+  typed-array-byte-length@1.0.3:
+    resolution: {integrity: sha512-BaXgOuIxz8n8pIq3e7Atg/7s+DpiYrxn4vdot3w9KbnBhcRQq6o3xemQdIfynqSeXeDrF32x+WvfzmOjPiY9lg==}
+    engines: {node: '>= 0.4'}
+
+  typed-array-byte-offset@1.0.4:
+    resolution: {integrity: sha512-bTlAFB/FBYMcuX81gbL4OcpH5PmlFHqlCCpAl8AlEzMz5k53oNDvN8p1PNOWLEmI2x4orp3raOFB51tv9X+MFQ==}
+    engines: {node: '>= 0.4'}
+
+  typed-array-length@1.0.7:
+    resolution: {integrity: sha512-3KS2b+kL7fsuk/eJZ7EQdnEmQoaho/r6KUef7hxvltNA5DR8NAUM+8wJMbJyZ4G9/7i3v5zPBIMN5aybAh2/Jg==}
+    engines: {node: '>= 0.4'}
+
+  typescript-eslint@8.61.1:
+    resolution: {integrity: sha512-V7PayAfJokV3pEHgN7/v03D1SpujhRfQtYLbLIiBfDDncdg4PAiRBfoS4cnCANK4jmAPncczi59QO3afiXUlNw==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
+      typescript: '>=4.8.4 <6.1.0'
+
+  typescript@6.0.2:
+    resolution: {integrity: sha512-bGdAIrZ0wiGDo5l8c++HWtbaNCWTS4UTv7RaTH/ThVIgjkveJt83m74bBHMJkuCbslY8ixgLBVZJIOiQlQTjfQ==}
+    engines: {node: '>=14.17'}
+    hasBin: true
+
+  uc.micro@1.0.6:
+    resolution: {integrity: sha512-8Y75pvTYkLJW2hWQHXxoqRgV7qb9B+9vFEtidML+7koHUFapnVJAZ6cKs+Qjz5Aw3aZWHMC6u0wJE3At+nSGwA==}
+
+  unbox-primitive@1.1.0:
+    resolution: {integrity: sha512-nWJ91DjeOkej/TA8pXQ3myruKpKEYgqvpw9lz4OPHj/NWFNluYrjbz9j01CJ8yKQd2g4jFoOkINCTW2I5LEEyw==}
+    engines: {node: '>= 0.4'}
+
+  undici-types@7.16.0:
+    resolution: {integrity: sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw==}
+
+  unicode-canonical-property-names-ecmascript@2.0.0:
+    resolution: {integrity: sha512-yY5PpDlfVIU5+y/BSCxAJRBIS1Zc2dDG3Ujq+sR0U+JjUevW2JhocOF+soROYDSaAezOzOKuyyixhD6mBknSmQ==}
+    engines: {node: '>=4'}
+
+  unicode-match-property-ecmascript@2.0.0:
+    resolution: {integrity: sha512-5kaZCrbp5mmbz5ulBkDkbY0SsPOjKqVS35VpL9ulMPfSl0J0Xsm+9Evphv9CoIZFwre7aJoa94AY6seMKGVN5Q==}
+    engines: {node: '>=4'}
+
+  unicode-match-property-value-ecmascript@2.1.0:
+    resolution: {integrity: sha512-qxkjQt6qjg/mYscYMC0XKRn3Rh0wFPlfxB0xkt9CfyTvpX1Ra0+rAmdX2QyAobptSEvuy4RtpPRui6XkV+8wjA==}
+    engines: {node: '>=4'}
+
+  unicode-property-aliases-ecmascript@2.1.0:
+    resolution: {integrity: sha512-6t3foTQI9qne+OZoVQB/8x8rk2k1eVy1gRXhV3oFQ5T6R1dqQ1xtin3XqSlx3+ATBkliTaR/hHyJBm+LVPNM8w==}
+    engines: {node: '>=4'}
+
+  unist-util-is@6.0.0:
+    resolution: {integrity: sha512-2qCTHimwdxLfz+YzdGfkqNlH0tLi9xjTnHddPmJwtIG9MGsdbutfTc4P+haPD7l7Cjxf/WZj+we5qfVPvvxfYw==}
+
+  unist-util-position@5.0.0:
+    resolution: {integrity: sha512-fucsC7HjXvkB5R3kTCO7kUjRdrS0BJt3M/FPxmHMBOm8JQi2BsHAHFsy27E0EolP8rp0NzXsJ+jNPyDWvOJZPA==}
+
+  unist-util-stringify-position@4.0.0:
+    resolution: {integrity: sha512-0ASV06AAoKCDkS2+xw5RXJywruurpbC4JZSm7nr7MOt1ojAzvyyaO+UxZf18j8FCF6kmzCZKcAgN/yu2gm2XgQ==}
+
+  unist-util-visit-parents@6.0.1:
+    resolution: {integrity: sha512-L/PqWzfTP9lzzEa6CKs0k2nARxTdZduw3zyh8d2NVBnsyvHjSX4TWse388YrrQKbvI8w20fGjGlhgT96WwKykw==}
+
+  unist-util-visit@5.0.0:
+    resolution: {integrity: sha512-MR04uvD+07cwl/yhVuVWAtw+3GOR/knlL55Nd/wAdblk27GCVt3lqpTivy/tkJcZoNPzTwS1Y+KMojlLDhoTzg==}
+
+  universalify@0.2.0:
+    resolution: {integrity: sha512-CJ1QgKmNg3CwvAv/kOFmtnEN05f0D/cn9QntgNOQlQF9dgvVTHj3t+8JPdjqawCHk7V/KA+fbUqzZ9XWhcqPUg==}
+    engines: {node: '>= 4.0.0'}
+
+  universalify@2.0.1:
+    resolution: {integrity: sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw==}
+    engines: {node: '>= 10.0.0'}
+
+  unpipe@1.0.0:
+    resolution: {integrity: sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==}
+    engines: {node: '>= 0.8'}
+
+  unplugin@2.3.11:
+    resolution: {integrity: sha512-5uKD0nqiYVzlmCRs01Fhs2BdkEgBS3SAVP6ndrBsuK42iC2+JHyxM05Rm9G8+5mkmRtzMZGY8Ct5+mliZxU/Ww==}
+    engines: {node: '>=18.12.0'}
+
+  unrs-resolver@1.11.1:
+    resolution: {integrity: sha512-bSjt9pjaEBnNiGgc9rUiHGKv5l4/TGzDmYw3RhnkJGtLhbnnA/5qJj7x3dNDCRx/PJxu774LlH8lCOlB4hEfKg==}
+
+  until-async@3.0.2:
+    resolution: {integrity: sha512-IiSk4HlzAMqTUseHHe3VhIGyuFmN90zMTpD3Z3y8jeQbzLIq500MVM7Jq2vUAnTKAFPJrqwkzr6PoTcPhGcOiw==}
+
+  update-browserslist-db@1.2.3:
+    resolution: {integrity: sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==}
+    hasBin: true
+    peerDependencies:
+      browserslist: '>= 4.21.0'
+
+  update-input-width@1.4.2:
+    resolution: {integrity: sha512-/p0XLhrQQQ4bMWD7bL9duYObwYCO1qGr8R19xcMmoMSmXuQ7/1//veUnCObQ7/iW6E2pGS6rFkS4TfH4ur7e/g==}
+
+  uri-js@4.4.1:
+    resolution: {integrity: sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==}
+
+  url-parse@1.5.10:
+    resolution: {integrity: sha512-WypcfiRhfeUP9vvF0j6rw0J3hrWrw6iZv3+22h6iRMJ/8z1Tj6XfLP4DsUix5MhMPnXpiHDoKyoZ/bdCkwBCiQ==}
+
+  use-callback-ref@1.3.3:
+    resolution: {integrity: sha512-jQL3lRnocaFtu3V00JToYz/4QkNWswxijDaCVNZRiRTO3HQDLsdu1ZtmIUvV4yPp+rvWm5j0y0TG/S61cuijTg==}
+    engines: {node: '>=10'}
+    peerDependencies:
+      '@types/react': ^17.0.37
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  use-is-mounted-ref@1.5.0:
+    resolution: {integrity: sha512-p5FksHf/ospZUr5KU9ese6u3jp9fzvZ3wuSb50i0y6fdONaHWgmOqQtxR/PUcwi6hnhQDbNxWSg3eTK3N6m+dg==}
+    peerDependencies:
+      react: '>=16.0.0'
+
+  use-isomorphic-layout-effect@1.2.1:
+    resolution: {integrity: sha512-tpZZ+EX0gaghDAiFR37hj5MgY6ZN55kLiPkJsKxBMZ6GZdOSPJXiOzPM984oPYZ5AnehYx5WQp1+ME8I/P/pRA==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  use-latest@1.3.0:
+    resolution: {integrity: sha512-mhg3xdm9NaM8q+gLT8KryJPnRFOz1/5XPBhmDEVZK1webPzDjrPk7f/mbpeLqTgB9msytYWANxgALOCJKnLvcQ==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  use-sidecar@1.1.3:
+    resolution: {integrity: sha512-Fedw0aZvkhynoPYlA5WXrMCAMm+nSWdZt6lzJQ7Ok8S6Q+VsHmHpRWndVRJ8Be0ZbkfPc5LRYH+5XrzXcEeLRQ==}
+    engines: {node: '>=10'}
+    peerDependencies:
+      '@types/react': ^17.0.37
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  use-sync-external-store@1.2.0:
+    resolution: {integrity: sha512-eEgnFxGQ1Ife9bzYs6VLi8/4X6CObHMw9Qr9tPY43iKwsPw8xE8+EFsf/2cFZ5S3esXgpWgtSCtLNS41F+sKPA==}
+    peerDependencies:
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0
+
+  use-sync-external-store@1.6.0:
+    resolution: {integrity: sha512-Pp6GSwGP/NrPIrxVFAIkOQeyw8lFenOHijQWkUTrDvrF4ALqylP2C/KCkeS9dpUM3KvYRQhna5vt7IL95+ZQ9w==}
+    peerDependencies:
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
+
+  util-deprecate@1.0.2:
+    resolution: {integrity: sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==}
+
+  utila@0.4.0:
+    resolution: {integrity: sha512-Z0DbgELS9/L/75wZbro8xAnT50pBVFQZ+hUEueGDU5FN51YSCYM+jdxsfCiHjwNP/4LCDD0i/graKpeBnOXKRA==}
+
+  utils-merge@1.0.1:
+    resolution: {integrity: sha512-pMZTvIkT1d+TFGvDOqodOclx0QWkkgi6Tdoa8gC8ffGAAqz9pzPTZWAybbsHHoED/ztMtkv/VoYTYyShUn81hA==}
+    engines: {node: '>= 0.4.0'}
+
+  uuid@3.4.0:
+    resolution: {integrity: sha512-HjSDRw6gZE5JMggctHBcjVak08+KEVhSIiDzFnT9S9aegmp85S/bReBVTb4QTFaRNptJ9kuYaNhnbNEOkbKb/A==}
+    hasBin: true
+
+  uuid@8.3.2:
+    resolution: {integrity: sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==}
+    hasBin: true
+
+  v8-to-istanbul@9.2.0:
+    resolution: {integrity: sha512-/EH/sDgxU2eGxajKdwLCDmQ4FWq+kpi3uCmBGpw1xJtnAxEjlD8j8PEiGWpCIMIs3ciNAgH0d3TTJiUkYzyZjA==}
+    engines: {node: '>=10.12.0'}
+
+  valid-url@1.0.9:
+    resolution: {integrity: sha512-QQDsV8OnSf5Uc30CKSwG9lnhMPe6exHtTXLRYX8uMwKENy640pU+2BgBL0LRbDh/eYRahNCS7aewCx0wf3NYVA==}
+
+  validator@13.7.0:
+    resolution: {integrity: sha512-nYXQLCBkpJ8X6ltALua9dRrZDHVYxjJ1wgskNt1lH9fzGjs3tgojGSCBjmEPwkWS1y29+DrizMTW19Pr9uB2nw==}
+    engines: {node: '>= 0.10'}
+
+  var-validator@0.0.3:
+    resolution: {integrity: sha512-3eOeI6zmvGiz94Uk2ydn4KUAzbyl9v8ifXnZUV1Y2Jp2Wj94O31veqkZYSd2JQtAMUjnWMO+WJnErTAo5J8b7A==}
+
+  vary@1.1.2:
+    resolution: {integrity: sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==}
+    engines: {node: '>= 0.8'}
+
+  vfile-message@4.0.2:
+    resolution: {integrity: sha512-jRDZ1IMLttGj41KcZvlrYAaI3CfqpLpfpf+Mfig13viT6NKvRzWZ+lXz0Y5D60w6uJIBAOGq9mSHf0gktF0duw==}
+
+  vfile@6.0.3:
+    resolution: {integrity: sha512-KzIbH/9tXat2u30jf+smMwFCsno4wHVdNmzFyL+T/L3UGqqk6JKfVqOFOZEpZSHADH1k40ab6NUIXZq422ov3Q==}
+
+  vite-plugin-svgr@4.5.0:
+    resolution: {integrity: sha512-W+uoSpmVkSmNOGPSsDCWVW/DDAyv+9fap9AZXBvWiQqrboJ08j2vh0tFxTD/LjwqwAd3yYSVJgm54S/1GhbdnA==}
+    peerDependencies:
+      vite: '>=2.6.0'
+
+  vite-tsconfig-paths@4.3.1:
+    resolution: {integrity: sha512-cfgJwcGOsIxXOLU/nELPny2/LUD/lcf1IbfyeKTv2bsupVbTH/xpFtdQlBmIP1GEK2CjjLxYhFfB+QODFAx5aw==}
+    peerDependencies:
+      vite: '*'
+    peerDependenciesMeta:
+      vite:
+        optional: true
+
+  vite@8.0.16:
+    resolution: {integrity: sha512-h9bXPmJichP5fLmVQo3PyaGSDE2n3aPuomeAlVRm0JLmt4rY6zmPKd59HYI4LNW8oTK7tlTsuC7l/m7awx9Jcw==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    hasBin: true
+    peerDependencies:
+      '@types/node': ^25
+      '@vitejs/devtools': ^0.1.18
+      esbuild: ^0.27.0 || ^0.28.0
+      jiti: '>=1.21.0'
+      less: ^4.0.0
+      sass: ^1.70.0
+      sass-embedded: ^1.70.0
+      stylus: '>=0.54.8'
+      sugarss: ^5.0.0
+      terser: ^5.16.0
+      tsx: ^4.8.1
+      yaml: ^2.4.2
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+      '@vitejs/devtools':
+        optional: true
+      esbuild:
+        optional: true
+      jiti:
+        optional: true
+      less:
+        optional: true
+      sass:
+        optional: true
+      sass-embedded:
+        optional: true
+      stylus:
+        optional: true
+      sugarss:
+        optional: true
+      terser:
+        optional: true
+      tsx:
+        optional: true
+      yaml:
+        optional: true
+
+  vitest@4.1.8:
+    resolution: {integrity: sha512-flY6ScbCIt9HThs+C5HS7jvGOB560DJtk/Z15IQROTA6zEy49Nh8T/dofWTQL+n3vswqn87sbJNiuqw1SDp5Ig==}
+    engines: {node: ^20.0.0 || ^22.0.0 || >=24.0.0}
+    hasBin: true
+    peerDependencies:
+      '@edge-runtime/vm': '*'
+      '@opentelemetry/api': ^1.9.0
+      '@types/node': ^25
+      '@vitest/browser-playwright': 4.1.8
+      '@vitest/browser-preview': 4.1.8
+      '@vitest/browser-webdriverio': 4.1.8
+      '@vitest/coverage-istanbul': 4.1.8
+      '@vitest/coverage-v8': 4.1.8
+      '@vitest/ui': 4.1.8
+      happy-dom: '*'
+      jsdom: '*'
+      vite: ^6.0.0 || ^7.0.0 || ^8.0.0
+    peerDependenciesMeta:
+      '@edge-runtime/vm':
+        optional: true
+      '@opentelemetry/api':
+        optional: true
+      '@types/node':
+        optional: true
+      '@vitest/browser-playwright':
+        optional: true
+      '@vitest/browser-preview':
+        optional: true
+      '@vitest/browser-webdriverio':
+        optional: true
+      '@vitest/coverage-istanbul':
+        optional: true
+      '@vitest/coverage-v8':
+        optional: true
+      '@vitest/ui':
+        optional: true
+      happy-dom:
+        optional: true
+      jsdom:
+        optional: true
+
+  void-elements@3.1.0:
+    resolution: {integrity: sha512-Dhxzh5HZuiHQhbvTW9AMetFfBHDMYpo23Uo9btPXgdYP+3T5S+p+jgNy7spra+veYhBP2dCSgxR/i2Y02h5/6w==}
+    engines: {node: '>=0.10.0'}
+
+  w3c-keyname@2.2.8:
+    resolution: {integrity: sha512-dpojBhNsCNN7T82Tm7k26A6G9ML3NkhDsnw9n/eoxSRlVBB4CEtIQ/KTCLI2Fwf3ataSXRhYFkQi3SlnFwPvPQ==}
+
+  w3c-xmlserializer@5.0.0:
+    resolution: {integrity: sha512-o8qghlI8NZHU1lLPrpi2+Uq7abh4GGPpYANlalzWxyWteJOCsr/P+oPBA49TOLu5FTZO4d3F9MnWJfiMo4BkmA==}
+    engines: {node: '>=18'}
+
+  warning@4.0.3:
+    resolution: {integrity: sha512-rpJyN222KWIvHJ/F53XSZv0Zl/accqHR8et1kpaMTD/fLCRxtV8iX8czMzY7sVZupTI3zcUTg8eycS2kNF9l6w==}
+
+  watchpack@2.5.1:
+    resolution: {integrity: sha512-Zn5uXdcFNIA1+1Ei5McRd+iRzfhENPCe7LeABkJtNulSxjma+l7ltNx55BWZkRlwRnpOgHqxnjyaDgJnNXnqzg==}
+    engines: {node: '>=10.13.0'}
+
+  wbuf@1.7.3:
+    resolution: {integrity: sha512-O84QOnr0icsbFGLS0O3bI5FswxzRr8/gHwWkDlQFskhSPryQXvrTMxjxGP4+iWYoauLoBvfDpkrOauZ+0iZpDA==}
+
+  webidl-conversions@3.0.1:
+    resolution: {integrity: sha512-2JAn3z8AR6rjK8Sm8orRC0h/bcl/DqL7tRPdGZ4I1CjdF+EaMLmYxBHyXuKL849eucPFhvBoxMsflfOb8kxaeQ==}
+
+  webidl-conversions@7.0.0:
+    resolution: {integrity: sha512-VwddBukDzu71offAQR975unBIGqfKZpM+8ZX6ySk8nYhVoo5CYaZyzt3YBvYtRtO+aoGlqxPg/B87NGVZ/fu6g==}
+    engines: {node: '>=12'}
+
+  webpack-build-notifier@3.1.0:
+    resolution: {integrity: sha512-bC6ozsAxVr/676AbESQmgBRBCmFZ2dAQKgSgSxAXBwfqCbXNyzBYK/RjDfswqGHuKcD5BYyHL0iJKk9aQHJGqg==}
+    peerDependencies:
+      webpack: ^5.0.0
+
+  webpack-bundle-analyzer@5.2.0:
+    resolution: {integrity: sha512-Etrauj1wYO/xjiz/Vfd6bW1lG9fEhrJpNmu10tv0X9kv+gyY3qiE09uYepqg1Xd0PxOvllRXwWYWjtQYoO/glQ==}
+    engines: {node: '>= 20.9.0'}
+    hasBin: true
+
+  webpack-cli@6.0.1:
+    resolution: {integrity: sha512-MfwFQ6SfwinsUVi0rNJm7rHZ31GyTcpVE5pgVA3hwFRb7COD4TzjUUwhGWKfO50+xdc2MQPuEBBJoqIMGt3JDw==}
+    engines: {node: '>=18.12.0'}
+    hasBin: true
+    peerDependencies:
+      webpack: ^5.82.0
+      webpack-bundle-analyzer: '*'
+      webpack-dev-server: '*'
+    peerDependenciesMeta:
+      webpack-bundle-analyzer:
+        optional: true
+      webpack-dev-server:
+        optional: true
+
+  webpack-dev-middleware@6.1.3:
+    resolution: {integrity: sha512-A4ChP0Qj8oGociTs6UdlRUGANIGrCDL3y+pmQMc+dSsraXHCatFpmMey4mYELA+juqwUqwQsUgJJISXl1KWmiw==}
+    engines: {node: '>= 14.15.0'}
+    peerDependencies:
+      webpack: ^5.0.0
+    peerDependenciesMeta:
+      webpack:
+        optional: true
+
+  webpack-dev-middleware@7.4.5:
+    resolution: {integrity: sha512-uxQ6YqGdE4hgDKNf7hUiPXOdtkXvBJXrfEGYSx7P7LC8hnUYGK70X6xQXUvXeNyBDDcsiQXpG2m3G9vxowaEuA==}
+    engines: {node: '>= 18.12.0'}
+    peerDependencies:
+      webpack: ^5.0.0
+    peerDependenciesMeta:
+      webpack:
+        optional: true
+
+  webpack-dev-server@5.2.4:
+    resolution: {integrity: sha512-GqDPGZN9bRqKBTkp4aWkobDDHMsrXKoGSdOH56smIri8qR0JG8gfL8/v/f/OZR3/OKXjG8uwJbFVhKm/FNU/UA==}
+    engines: {node: '>= 18.12.0'}
+    hasBin: true
+    peerDependencies:
+      webpack: ^5.0.0
+      webpack-cli: '*'
+    peerDependenciesMeta:
+      webpack:
+        optional: true
+      webpack-cli:
+        optional: true
+
+  webpack-hot-middleware@2.25.3:
+    resolution: {integrity: sha512-IK/0WAHs7MTu1tzLTjio73LjS3Ov+VvBKQmE8WPlJutgG5zT6Urgq/BbAdRrHTRpyzK0dvAvFh1Qg98akxgZpA==}
+
+  webpack-merge@6.0.1:
+    resolution: {integrity: sha512-hXXvrjtx2PLYx4qruKl+kyRSLc52V+cCvMxRjmKwoA+CBbbF5GfIBtR6kCvl0fYGqTUPKB+1ktVmTHqMOzgCBg==}
+    engines: {node: '>=18.0.0'}
+
+  webpack-sources@3.5.0:
+    resolution: {integrity: sha512-HPuy+uuoTCaaoEoI1LQ3JN9+vrPBvEesnnX1jADHy728cHSMlq4wUc4afYqahq2B1mhQVZxCXOkNTnXltr+2vQ==}
+    engines: {node: '>=10.13.0'}
+
+  webpack-virtual-modules@0.6.2:
+    resolution: {integrity: sha512-66/V2i5hQanC51vBQKPH4aI8NMAcBW59FVBs+rC7eGHupMyfn34q7rZIE+ETlJ+XTevqfUhVVBgSUNSW2flEUQ==}
+
+  webpack@5.107.2:
+    resolution: {integrity: sha512-v7RhXaJbpMlV0D7hC7lb2EbnxkoeUqf9qhKr6lozx3Q48pmFrqqNRmZFUEGmi7pSwm6fCQ2H1IjvCkHqdpVdjQ==}
+    engines: {node: '>=10.13.0'}
+    hasBin: true
+    peerDependencies:
+      webpack-cli: '*'
+    peerDependenciesMeta:
+      webpack-cli:
+        optional: true
+
+  websocket-driver@0.7.4:
+    resolution: {integrity: sha512-b17KeDIQVjvb0ssuSDF2cYXSg2iztliJ4B9WdsuB6J952qCPKmnVq4DyW5motImXHDC1cBT/1UezrJVsKw5zjg==}
+    engines: {node: '>=0.8.0'}
+
+  websocket-extensions@0.1.4:
+    resolution: {integrity: sha512-OqedPIGOfsDlo31UNwYbCFMSaO9m9G/0faIHj5/dZFDMFqPTcx6UwqyOy3COEaEOg/9VsGIpdqn62W5KhoKSpg==}
+    engines: {node: '>=0.8.0'}
+
+  whatwg-encoding@3.1.1:
+    resolution: {integrity: sha512-6qN4hJdMwfYBtE3YBTTHhoeuUrDBPZmbQaxWAqSALV/MeEnR5z1xd8UKud2RAkFoPkmB+hli1TZSnyi84xz1vQ==}
+    engines: {node: '>=18'}
+
+  whatwg-mimetype@4.0.0:
+    resolution: {integrity: sha512-QaKxh0eNIi2mE9p2vEdzfagOKHCcj1pJ56EEHGQOVxp8r9/iszLUUV7v89x9O1p/T+NlTM5W7jW6+cz4Fq1YVg==}
+    engines: {node: '>=18'}
+
+  whatwg-url@14.0.0:
+    resolution: {integrity: sha512-1lfMEm2IEr7RIV+f4lUNPOqfFL+pO+Xw3fJSqmjX9AbXcXcYOkCe1P6+9VBZB6n94af16NfZf+sSk0JCBZC9aw==}
+    engines: {node: '>=18'}
+
+  whatwg-url@5.0.0:
+    resolution: {integrity: sha512-saE57nupxk6v3HY35+jzBwYa0rKSy0XR8JSxZPwgLr7ys0IBzhGviA1/TUGJLmSVqs8pb9AnvICXEuOHLprYTw==}
+
+  which-boxed-primitive@1.1.1:
+    resolution: {integrity: sha512-TbX3mj8n0odCBFVlY8AxkqcHASw3L60jIuF8jFP78az3C2YhmGvqbHBpAjTRH2/xqYunrJ9g1jSyjCjpoWzIAA==}
+    engines: {node: '>= 0.4'}
+
+  which-builtin-type@1.2.1:
+    resolution: {integrity: sha512-6iBczoX+kDQ7a3+YJBnh3T+KZRxM/iYNPXicqk66/Qfm1b93iu+yOImkg0zHbj5LNOcNv1TEADiZ0xa34B4q6Q==}
+    engines: {node: '>= 0.4'}
+
+  which-collection@1.0.2:
+    resolution: {integrity: sha512-K4jVyjnBdgvc86Y6BkaLZEN933SwYOuBFkdmBu9ZfkcAbdVbpITnDmjvZ/aQjRXQrv5EPkTnD1s39GiiqbngCw==}
+    engines: {node: '>= 0.4'}
+
+  which-module@2.0.0:
+    resolution: {integrity: sha512-B+enWhmw6cjfVC7kS8Pj9pCrKSc5txArRyaYGe088shv/FGWH+0Rjx/xPgtsWfsUtS27FkP697E4DDhgrgoc0Q==}
+
+  which-typed-array@1.1.20:
+    resolution: {integrity: sha512-LYfpUkmqwl0h9A2HL09Mms427Q1RZWuOHsukfVcKRq9q95iQxdw0ix1JQrqbcDR9PH1QDwf5Qo8OZb5lksZ8Xg==}
+    engines: {node: '>= 0.4'}
+
+  which@2.0.2:
+    resolution: {integrity: sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==}
+    engines: {node: '>= 8'}
+    hasBin: true
+
+  why-is-node-running@2.3.0:
+    resolution: {integrity: sha512-hUrmaWBdVDcxvYqnyh09zunKzROWjbZTiNy8dBEjkS7ehEDQibXJ7XvlmtbwuTclUiIyN+CyXQD4Vmko8fNm8w==}
+    engines: {node: '>=8'}
+    hasBin: true
+
+  wildcard@2.0.1:
+    resolution: {integrity: sha512-CC1bOL87PIWSBhDcTrdeLo6eGT7mCFtrg0uIJtqJUFyK+eJnzl8A1niH56uu7KMa5XFrtiV+AQuHO3n7DsHnLQ==}
+
+  wrap-ansi@10.0.0:
+    resolution: {integrity: sha512-SGcvg80f0wUy2/fXES19feHMz8E0JoXv2uNgHOu4Dgi2OrCy1lqwFYEJz1BLbDI0exjPMe/ZdzZ/YpGECBG/aQ==}
+    engines: {node: '>=20'}
+
+  wrap-ansi@6.2.0:
+    resolution: {integrity: sha512-r6lPcBGxZXlIcymEu7InxDMhdW0KDxpLgoFLcguasxCaJ/SOIZwINatK9KY/tf+ZrlywOKU0UDj3ATXUBfxJXA==}
+    engines: {node: '>=8'}
+
+  wrap-ansi@7.0.0:
+    resolution: {integrity: sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==}
+    engines: {node: '>=10'}
+
+  wrap-ansi@9.0.2:
+    resolution: {integrity: sha512-42AtmgqjV+X1VpdOfyTGOYRi0/zsoLqtXQckTmqTeybT+BDIbM/Guxo7x3pE2vtpr1ok6xRqM9OpBe+Jyoqyww==}
+    engines: {node: '>=18'}
+
+  wrappy@1.0.2:
+    resolution: {integrity: sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==}
+
+  ws@8.19.0:
+    resolution: {integrity: sha512-blAT2mjOEIi0ZzruJfIhb3nps74PRWTCz1IjglWEEpQl5XS/UNama6u2/rjFkDDouqr4L67ry+1aGIALViWjDg==}
+    engines: {node: '>=10.0.0'}
+    peerDependencies:
+      bufferutil: ^4.0.1
+      utf-8-validate: '>=5.0.2'
+    peerDependenciesMeta:
+      bufferutil:
+        optional: true
+      utf-8-validate:
+        optional: true
+
+  wsl-utils@0.1.0:
+    resolution: {integrity: sha512-h3Fbisa2nKGPxCpm89Hk33lBLsnaGBvctQopaBSOW/uIs6FTe1ATyAnKFJrzVs9vpGdsTe73WF3V4lIsk4Gacw==}
+    engines: {node: '>=18'}
+
+  wsl-utils@0.3.1:
+    resolution: {integrity: sha512-g/eziiSUNBSsdDJtCLB8bdYEUMj4jR7AGeUo96p/3dTafgjHhpF4RiCFPiRILwjQoDXx5MqkBr4fwWtR3Ky4Wg==}
+    engines: {node: '>=20'}
+
+  xml-name-validator@5.0.0:
+    resolution: {integrity: sha512-EvGK8EJ3DhaHfbRlETOWAS5pO9MZITeauHKJyb8wyajUfQUenkIg2MvLDTZ4T/TgIcm3HU0TFBgWWboAZ30UHg==}
+    engines: {node: '>=18'}
+
+  xmlchars@2.2.0:
+    resolution: {integrity: sha512-JZnDKK8B0RCDw84FNdDAIpZK+JuJw+s7Lz8nksI7SIuU3UXJJslUthsi+uWBUYOwPFwW7W7PRLRfUKpxjtjFCw==}
+
+  y18n@4.0.3:
+    resolution: {integrity: sha512-JKhqTOwSrqNA1NY5lSztJ1GrBiUodLMmIZuLiDaMRJ+itFd+ABVE8XBjOvIWL+rSqNDC74LCSFmlb/U4UZ4hJQ==}
+
+  y18n@5.0.8:
+    resolution: {integrity: sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA==}
+    engines: {node: '>=10'}
+
+  yallist@3.1.1:
+    resolution: {integrity: sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==}
+
+  yaml@1.10.2:
+    resolution: {integrity: sha512-r3vXyErRCYJ7wg28yvBY5VSoAF8ZvlcW9/BwUzEtUsjvX/DKs24dIkuwjtuprwJJHsbyUbLApepYTR1BN4uHrg==}
+    engines: {node: '>= 6'}
+
+  yaml@2.7.0:
+    resolution: {integrity: sha512-+hSoy/QHluxmC9kCIJyL/uyFmLmc+e5CFR5Wa+bpIhIj85LVb9ZH2nVnqrHoSvKogwODv0ClqZkmiSSaIH5LTA==}
+    engines: {node: '>= 14'}
+    hasBin: true
+
+  yaml@2.9.0:
+    resolution: {integrity: sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA==}
+    engines: {node: '>= 14.6'}
+    hasBin: true
+
+  yargs-parser@18.1.3:
+    resolution: {integrity: sha512-o50j0JeToy/4K6OZcaQmW6lyXXKhq7csREXcDwk2omFPJEwUNOVtJKvmDr9EI1fAJZUyZcRF7kxGBWmRXudrCQ==}
+    engines: {node: '>=6'}
+
+  yargs-parser@21.1.1:
+    resolution: {integrity: sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw==}
+    engines: {node: '>=12'}
+
+  yargs@15.4.1:
+    resolution: {integrity: sha512-aePbxDmcYW++PaqBsJ+HYUFwCdv4LVvdnhBy78E57PIor8/OVvhMrADFFEDh8DHDFRv/O9i3lPhsENjO7QX0+A==}
+    engines: {node: '>=8'}
+
+  yargs@17.7.2:
+    resolution: {integrity: sha512-7dSzzRQ++CKnNI/krKnYRV7JKKPUXMEh61soaHKg9mrWEhzFWhFnxPxGl+69cD1Ou63C13NUPCnmIcrvqCuM6w==}
+    engines: {node: '>=12'}
+
+  yocto-queue@0.1.0:
+    resolution: {integrity: sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==}
+    engines: {node: '>=10'}
+
+  yocto-queue@1.0.0:
+    resolution: {integrity: sha512-9bnSc/HEW2uRy67wc+T8UwauLuPJVn28jb+GtJY16iiKWyvmYJRXVT4UamsAEGQfPohgr2q4Tq0sQbQlxTfi1g==}
+    engines: {node: '>=12.20'}
+
+  yup@0.32.11:
+    resolution: {integrity: sha512-Z2Fe1bn+eLstG8DRR6FTavGD+MeAwyfmouhHsIUgaADz8jvFKbO/fXc2trJKZg+5EBjh4gGm3iU/t3onKlXHIg==}
+    engines: {node: '>=10'}
+
+  z-schema@5.0.2:
+    resolution: {integrity: sha512-40TH47ukMHq5HrzkeVE40Ad7eIDKaRV2b+Qpi2prLc9X9eFJFzV7tMe5aH12e6avaSS/u5l653EQOv+J9PirPw==}
+    engines: {node: '>=8.0.0'}
+    hasBin: true
+
+  zod-validation-error@4.0.2:
+    resolution: {integrity: sha512-Q6/nZLe6jxuU80qb/4uJ4t5v2VEZ44lzQjPDhYJNztRQ4wyWc6VF3D3Kb/fAuPetZQnhS3hnajCf9CsWesghLQ==}
+    engines: {node: '>=18.0.0'}
+    peerDependencies:
+      zod: ^3.25.0 || ^4.0.0
+
+  zod@4.3.6:
+    resolution: {integrity: sha512-rftlrkhHZOcjDwkGlnUtZZkvaPHCsDATp4pGpuOOMDaTdDDXF91wuVDJoWoPsKX/3YPQ5fHuF3STjcYyKr+Qhg==}
+
+  zustand@4.1.1:
+    resolution: {integrity: sha512-h4F3WMqsZgvvaE0n3lThx4MM81Ls9xebjvrABNzf5+jb3/03YjNTSgZXeyrvXDArMeV9untvWXRw1tY+ntPYbA==}
+    engines: {node: '>=12.7.0'}
+    peerDependencies:
+      immer: '>=9.0'
+      react: '>=16.8'
+    peerDependenciesMeta:
+      immer:
+        optional: true
+      react:
+        optional: true
+
+  zwitch@2.0.4:
+    resolution: {integrity: sha512-bXE4cR/kVZhKZX/RjPEflHaKVhUVl85noU3v6b8apfQEc1x4A+zBxjZ4lN8LqGd6WZ3dl98pY4o717VFmoPp+A==}
+
+snapshots:
+
+  '@aashutoshrathi/word-wrap@1.2.6': {}
+
+  '@adobe/css-tools@4.4.4': {}
+
+  '@alloc/quick-lru@5.2.0': {}
+
+  '@apidevtools/json-schema-ref-parser@9.0.9':
+    dependencies:
+      '@jsdevtools/ono': 7.1.3
+      '@types/json-schema': 7.0.15
+      call-me-maybe: 1.0.2
+      js-yaml: 4.1.1
+
+  '@apidevtools/openapi-schemas@2.1.0': {}
+
+  '@apidevtools/swagger-cli@4.0.4(openapi-types@12.1.3)':
+    dependencies:
+      '@apidevtools/swagger-parser': 10.0.3(openapi-types@12.1.3)
+      chalk: 4.1.2
+      js-yaml: 3.14.2
+      yargs: 15.4.1
+    transitivePeerDependencies:
+      - openapi-types
+
+  '@apidevtools/swagger-methods@3.0.2': {}
+
+  '@apidevtools/swagger-parser@10.0.3(openapi-types@12.1.3)':
+    dependencies:
+      '@apidevtools/json-schema-ref-parser': 9.0.9
+      '@apidevtools/openapi-schemas': 2.1.0
+      '@apidevtools/swagger-methods': 3.0.2
+      '@jsdevtools/ono': 7.1.3
+      call-me-maybe: 1.0.2
+      openapi-types: 12.1.3
+      z-schema: 5.0.2
+
+  '@aws-crypto/sha256-js@2.0.1':
+    dependencies:
+      '@aws-crypto/util': 2.0.1
+      '@aws-sdk/types': 3.40.0
+      tslib: 1.14.1
+
+  '@aws-crypto/util@2.0.1':
+    dependencies:
+      '@aws-sdk/types': 3.40.0
+      '@aws-sdk/util-utf8-browser': 3.37.0
+      tslib: 1.14.1
+
+  '@aws-sdk/types@3.40.0': {}
+
+  '@aws-sdk/util-utf8-browser@3.37.0':
+    dependencies:
+      tslib: 2.8.1
+
+  '@babel/code-frame@7.29.0':
+    dependencies:
+      '@babel/helper-validator-identifier': 7.28.5
+      js-tokens: 4.0.0
+      picocolors: 1.1.1
+
+  '@babel/compat-data@7.29.0': {}
+
+  '@babel/core@7.29.0':
+    dependencies:
+      '@babel/code-frame': 7.29.0
+      '@babel/generator': 7.29.1
+      '@babel/helper-compilation-targets': 7.28.6
+      '@babel/helper-module-transforms': 7.28.6(@babel/core@7.29.0)
+      '@babel/helpers': 7.29.2
+      '@babel/parser': 7.29.0
+      '@babel/template': 7.28.6
+      '@babel/traverse': 7.29.0
+      '@babel/types': 7.29.0
+      '@jridgewell/remapping': 2.3.5
+      convert-source-map: 2.0.0
+      debug: 4.4.3
+      gensync: 1.0.0-beta.2
+      json5: 2.2.3
+      semver: 6.3.1
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/generator@7.29.1':
+    dependencies:
+      '@babel/parser': 7.29.0
+      '@babel/types': 7.29.0
+      '@jridgewell/gen-mapping': 0.3.13
+      '@jridgewell/trace-mapping': 0.3.31
+      jsesc: 3.1.0
+
+  '@babel/helper-annotate-as-pure@7.22.5':
+    dependencies:
+      '@babel/types': 7.29.0
+
+  '@babel/helper-builder-binary-assignment-operator-visitor@7.22.15':
+    dependencies:
+      '@babel/types': 7.29.0
+
+  '@babel/helper-compilation-targets@7.28.6':
+    dependencies:
+      '@babel/compat-data': 7.29.0
+      '@babel/helper-validator-option': 7.27.1
+      browserslist: 4.28.2
+      lru-cache: 5.1.1
+      semver: 6.3.1
+
+  '@babel/helper-create-class-features-plugin@7.22.15(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-annotate-as-pure': 7.22.5
+      '@babel/helper-environment-visitor': 7.22.20
+      '@babel/helper-function-name': 7.23.0
+      '@babel/helper-member-expression-to-functions': 7.23.0
+      '@babel/helper-optimise-call-expression': 7.22.5
+      '@babel/helper-replace-supers': 7.22.20(@babel/core@7.29.0)
+      '@babel/helper-skip-transparent-expression-wrappers': 7.22.5
+      '@babel/helper-split-export-declaration': 7.22.6
+      semver: 6.3.1
+
+  '@babel/helper-create-regexp-features-plugin@7.22.15(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-annotate-as-pure': 7.22.5
+      regexpu-core: 5.3.2
+      semver: 6.3.1
+
+  '@babel/helper-define-polyfill-provider@0.4.4(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-compilation-targets': 7.28.6
+      '@babel/helper-plugin-utils': 7.22.5
+      debug: 4.4.3
+      lodash.debounce: 4.0.8
+      resolve: 1.22.11
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/helper-environment-visitor@7.22.20': {}
+
+  '@babel/helper-function-name@7.23.0':
+    dependencies:
+      '@babel/template': 7.28.6
+      '@babel/types': 7.29.0
+
+  '@babel/helper-globals@7.28.0': {}
+
+  '@babel/helper-hoist-variables@7.22.5':
+    dependencies:
+      '@babel/types': 7.29.0
+
+  '@babel/helper-member-expression-to-functions@7.23.0':
+    dependencies:
+      '@babel/types': 7.29.0
+
+  '@babel/helper-module-imports@7.28.6':
+    dependencies:
+      '@babel/traverse': 7.29.0
+      '@babel/types': 7.29.0
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/helper-module-transforms@7.28.6(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-module-imports': 7.28.6
+      '@babel/helper-validator-identifier': 7.28.5
+      '@babel/traverse': 7.29.0
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/helper-optimise-call-expression@7.22.5':
+    dependencies:
+      '@babel/types': 7.29.0
+
+  '@babel/helper-plugin-utils@7.22.5': {}
+
+  '@babel/helper-remap-async-to-generator@7.22.20(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-annotate-as-pure': 7.22.5
+      '@babel/helper-environment-visitor': 7.22.20
+      '@babel/helper-wrap-function': 7.22.20
+
+  '@babel/helper-replace-supers@7.22.20(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-environment-visitor': 7.22.20
+      '@babel/helper-member-expression-to-functions': 7.23.0
+      '@babel/helper-optimise-call-expression': 7.22.5
+
+  '@babel/helper-simple-access@7.22.5':
+    dependencies:
+      '@babel/types': 7.29.0
+
+  '@babel/helper-skip-transparent-expression-wrappers@7.22.5':
+    dependencies:
+      '@babel/types': 7.29.0
+
+  '@babel/helper-split-export-declaration@7.22.6':
+    dependencies:
+      '@babel/types': 7.29.0
+
+  '@babel/helper-string-parser@7.27.1': {}
+
+  '@babel/helper-validator-identifier@7.28.5': {}
+
+  '@babel/helper-validator-option@7.27.1': {}
+
+  '@babel/helper-wrap-function@7.22.20':
+    dependencies:
+      '@babel/helper-function-name': 7.23.0
+      '@babel/template': 7.28.6
+      '@babel/types': 7.29.0
+
+  '@babel/helpers@7.29.2':
+    dependencies:
+      '@babel/template': 7.28.6
+      '@babel/types': 7.29.0
+
+  '@babel/parser@7.29.0':
+    dependencies:
+      '@babel/types': 7.29.0
+
+  '@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression@7.23.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@7.23.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+      '@babel/helper-skip-transparent-expression-wrappers': 7.22.5
+      '@babel/plugin-transform-optional-chaining': 7.23.4(@babel/core@7.29.0)
+
+  '@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly@7.23.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-environment-visitor': 7.22.20
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-proposal-private-property-in-object@7.21.0-placeholder-for-preset-env.2(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+
+  '@babel/plugin-syntax-async-generators@7.8.4(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-syntax-class-properties@7.12.13(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-syntax-class-static-block@7.14.5(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-syntax-dynamic-import@7.8.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-syntax-export-namespace-from@7.8.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-syntax-import-assertions@7.23.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-syntax-import-attributes@7.23.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-syntax-import-meta@7.10.4(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-syntax-json-strings@7.8.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-syntax-jsx@7.22.5(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-syntax-logical-assignment-operators@7.10.4(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-syntax-nullish-coalescing-operator@7.8.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-syntax-numeric-separator@7.10.4(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-syntax-object-rest-spread@7.8.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-syntax-optional-catch-binding@7.8.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-syntax-optional-chaining@7.8.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-syntax-private-property-in-object@7.14.5(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-syntax-top-level-await@7.14.5(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-syntax-typescript@7.22.5(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-syntax-unicode-sets-regex@7.18.6(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-create-regexp-features-plugin': 7.22.15(@babel/core@7.29.0)
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-transform-arrow-functions@7.23.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-transform-async-generator-functions@7.23.4(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-environment-visitor': 7.22.20
+      '@babel/helper-plugin-utils': 7.22.5
+      '@babel/helper-remap-async-to-generator': 7.22.20(@babel/core@7.29.0)
+      '@babel/plugin-syntax-async-generators': 7.8.4(@babel/core@7.29.0)
+
+  '@babel/plugin-transform-async-to-generator@7.23.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-module-imports': 7.28.6
+      '@babel/helper-plugin-utils': 7.22.5
+      '@babel/helper-remap-async-to-generator': 7.22.20(@babel/core@7.29.0)
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/plugin-transform-block-scoped-functions@7.23.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-transform-block-scoping@7.23.4(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-transform-class-properties@7.23.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-create-class-features-plugin': 7.22.15(@babel/core@7.29.0)
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-transform-class-static-block@7.23.4(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-create-class-features-plugin': 7.22.15(@babel/core@7.29.0)
+      '@babel/helper-plugin-utils': 7.22.5
+      '@babel/plugin-syntax-class-static-block': 7.14.5(@babel/core@7.29.0)
+
+  '@babel/plugin-transform-classes@7.23.5(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-annotate-as-pure': 7.22.5
+      '@babel/helper-compilation-targets': 7.28.6
+      '@babel/helper-environment-visitor': 7.22.20
+      '@babel/helper-function-name': 7.23.0
+      '@babel/helper-optimise-call-expression': 7.22.5
+      '@babel/helper-plugin-utils': 7.22.5
+      '@babel/helper-replace-supers': 7.22.20(@babel/core@7.29.0)
+      '@babel/helper-split-export-declaration': 7.22.6
+      globals: 11.12.0
+
+  '@babel/plugin-transform-computed-properties@7.23.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+      '@babel/template': 7.28.6
+
+  '@babel/plugin-transform-destructuring@7.23.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-transform-dotall-regex@7.23.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-create-regexp-features-plugin': 7.22.15(@babel/core@7.29.0)
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-transform-duplicate-keys@7.23.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-transform-dynamic-import@7.23.4(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+      '@babel/plugin-syntax-dynamic-import': 7.8.3(@babel/core@7.29.0)
+
+  '@babel/plugin-transform-exponentiation-operator@7.23.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-builder-binary-assignment-operator-visitor': 7.22.15
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-transform-export-namespace-from@7.23.4(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+      '@babel/plugin-syntax-export-namespace-from': 7.8.3(@babel/core@7.29.0)
+
+  '@babel/plugin-transform-for-of@7.23.6(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+      '@babel/helper-skip-transparent-expression-wrappers': 7.22.5
+
+  '@babel/plugin-transform-function-name@7.23.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-compilation-targets': 7.28.6
+      '@babel/helper-function-name': 7.23.0
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-transform-json-strings@7.23.4(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+      '@babel/plugin-syntax-json-strings': 7.8.3(@babel/core@7.29.0)
+
+  '@babel/plugin-transform-literals@7.23.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-transform-logical-assignment-operators@7.23.4(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+      '@babel/plugin-syntax-logical-assignment-operators': 7.10.4(@babel/core@7.29.0)
+
+  '@babel/plugin-transform-member-expression-literals@7.23.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-transform-modules-amd@7.23.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-module-transforms': 7.28.6(@babel/core@7.29.0)
+      '@babel/helper-plugin-utils': 7.22.5
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/plugin-transform-modules-commonjs@7.23.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-module-transforms': 7.28.6(@babel/core@7.29.0)
+      '@babel/helper-plugin-utils': 7.22.5
+      '@babel/helper-simple-access': 7.22.5
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/plugin-transform-modules-systemjs@7.23.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-hoist-variables': 7.22.5
+      '@babel/helper-module-transforms': 7.28.6(@babel/core@7.29.0)
+      '@babel/helper-plugin-utils': 7.22.5
+      '@babel/helper-validator-identifier': 7.28.5
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/plugin-transform-modules-umd@7.23.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-module-transforms': 7.28.6(@babel/core@7.29.0)
+      '@babel/helper-plugin-utils': 7.22.5
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/plugin-transform-named-capturing-groups-regex@7.22.5(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-create-regexp-features-plugin': 7.22.15(@babel/core@7.29.0)
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-transform-new-target@7.23.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-transform-nullish-coalescing-operator@7.23.4(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+      '@babel/plugin-syntax-nullish-coalescing-operator': 7.8.3(@babel/core@7.29.0)
+
+  '@babel/plugin-transform-numeric-separator@7.23.4(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+      '@babel/plugin-syntax-numeric-separator': 7.10.4(@babel/core@7.29.0)
+
+  '@babel/plugin-transform-object-rest-spread@7.23.4(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/compat-data': 7.29.0
+      '@babel/core': 7.29.0
+      '@babel/helper-compilation-targets': 7.28.6
+      '@babel/helper-plugin-utils': 7.22.5
+      '@babel/plugin-syntax-object-rest-spread': 7.8.3(@babel/core@7.29.0)
+      '@babel/plugin-transform-parameters': 7.23.3(@babel/core@7.29.0)
+
+  '@babel/plugin-transform-object-super@7.23.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+      '@babel/helper-replace-supers': 7.22.20(@babel/core@7.29.0)
+
+  '@babel/plugin-transform-optional-catch-binding@7.23.4(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+      '@babel/plugin-syntax-optional-catch-binding': 7.8.3(@babel/core@7.29.0)
+
+  '@babel/plugin-transform-optional-chaining@7.23.4(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+      '@babel/helper-skip-transparent-expression-wrappers': 7.22.5
+      '@babel/plugin-syntax-optional-chaining': 7.8.3(@babel/core@7.29.0)
+
+  '@babel/plugin-transform-parameters@7.23.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-transform-private-methods@7.23.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-create-class-features-plugin': 7.22.15(@babel/core@7.29.0)
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-transform-private-property-in-object@7.23.4(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-annotate-as-pure': 7.22.5
+      '@babel/helper-create-class-features-plugin': 7.22.15(@babel/core@7.29.0)
+      '@babel/helper-plugin-utils': 7.22.5
+      '@babel/plugin-syntax-private-property-in-object': 7.14.5(@babel/core@7.29.0)
+
+  '@babel/plugin-transform-property-literals@7.23.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-transform-react-constant-elements@7.22.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-transform-react-display-name@7.22.5(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-transform-react-jsx-development@7.22.5(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/plugin-transform-react-jsx': 7.22.15(@babel/core@7.29.0)
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/plugin-transform-react-jsx@7.22.15(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-annotate-as-pure': 7.22.5
+      '@babel/helper-module-imports': 7.28.6
+      '@babel/helper-plugin-utils': 7.22.5
+      '@babel/plugin-syntax-jsx': 7.22.5(@babel/core@7.29.0)
+      '@babel/types': 7.29.0
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/plugin-transform-react-pure-annotations@7.22.5(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-annotate-as-pure': 7.22.5
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-transform-regenerator@7.23.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+      regenerator-transform: 0.15.2
+
+  '@babel/plugin-transform-reserved-words@7.23.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-transform-shorthand-properties@7.23.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-transform-spread@7.23.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+      '@babel/helper-skip-transparent-expression-wrappers': 7.22.5
+
+  '@babel/plugin-transform-sticky-regex@7.23.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-transform-template-literals@7.23.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-transform-typeof-symbol@7.23.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-transform-typescript@7.22.15(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-annotate-as-pure': 7.22.5
+      '@babel/helper-create-class-features-plugin': 7.22.15(@babel/core@7.29.0)
+      '@babel/helper-plugin-utils': 7.22.5
+      '@babel/plugin-syntax-typescript': 7.22.5(@babel/core@7.29.0)
+
+  '@babel/plugin-transform-unicode-escapes@7.23.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-transform-unicode-property-regex@7.23.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-create-regexp-features-plugin': 7.22.15(@babel/core@7.29.0)
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-transform-unicode-regex@7.23.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-create-regexp-features-plugin': 7.22.15(@babel/core@7.29.0)
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-transform-unicode-sets-regex@7.23.3(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-create-regexp-features-plugin': 7.22.15(@babel/core@7.29.0)
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/preset-env@7.23.6(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/compat-data': 7.29.0
+      '@babel/core': 7.29.0
+      '@babel/helper-compilation-targets': 7.28.6
+      '@babel/helper-plugin-utils': 7.22.5
+      '@babel/helper-validator-option': 7.27.1
+      '@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression': 7.23.3(@babel/core@7.29.0)
+      '@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining': 7.23.3(@babel/core@7.29.0)
+      '@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly': 7.23.3(@babel/core@7.29.0)
+      '@babel/plugin-proposal-private-property-in-object': 7.21.0-placeholder-for-preset-env.2(@babel/core@7.29.0)
+      '@babel/plugin-syntax-async-generators': 7.8.4(@babel/core@7.29.0)
+      '@babel/plugin-syntax-class-properties': 7.12.13(@babel/core@7.29.0)
+      '@babel/plugin-syntax-class-static-block': 7.14.5(@babel/core@7.29.0)
+      '@babel/plugin-syntax-dynamic-import': 7.8.3(@babel/core@7.29.0)
+      '@babel/plugin-syntax-export-namespace-from': 7.8.3(@babel/core@7.29.0)
+      '@babel/plugin-syntax-import-assertions': 7.23.3(@babel/core@7.29.0)
+      '@babel/plugin-syntax-import-attributes': 7.23.3(@babel/core@7.29.0)
+      '@babel/plugin-syntax-import-meta': 7.10.4(@babel/core@7.29.0)
+      '@babel/plugin-syntax-json-strings': 7.8.3(@babel/core@7.29.0)
+      '@babel/plugin-syntax-logical-assignment-operators': 7.10.4(@babel/core@7.29.0)
+      '@babel/plugin-syntax-nullish-coalescing-operator': 7.8.3(@babel/core@7.29.0)
+      '@babel/plugin-syntax-numeric-separator': 7.10.4(@babel/core@7.29.0)
+      '@babel/plugin-syntax-object-rest-spread': 7.8.3(@babel/core@7.29.0)
+      '@babel/plugin-syntax-optional-catch-binding': 7.8.3(@babel/core@7.29.0)
+      '@babel/plugin-syntax-optional-chaining': 7.8.3(@babel/core@7.29.0)
+      '@babel/plugin-syntax-private-property-in-object': 7.14.5(@babel/core@7.29.0)
+      '@babel/plugin-syntax-top-level-await': 7.14.5(@babel/core@7.29.0)
+      '@babel/plugin-syntax-unicode-sets-regex': 7.18.6(@babel/core@7.29.0)
+      '@babel/plugin-transform-arrow-functions': 7.23.3(@babel/core@7.29.0)
+      '@babel/plugin-transform-async-generator-functions': 7.23.4(@babel/core@7.29.0)
+      '@babel/plugin-transform-async-to-generator': 7.23.3(@babel/core@7.29.0)
+      '@babel/plugin-transform-block-scoped-functions': 7.23.3(@babel/core@7.29.0)
+      '@babel/plugin-transform-block-scoping': 7.23.4(@babel/core@7.29.0)
+      '@babel/plugin-transform-class-properties': 7.23.3(@babel/core@7.29.0)
+      '@babel/plugin-transform-class-static-block': 7.23.4(@babel/core@7.29.0)
+      '@babel/plugin-transform-classes': 7.23.5(@babel/core@7.29.0)
+      '@babel/plugin-transform-computed-properties': 7.23.3(@babel/core@7.29.0)
+      '@babel/plugin-transform-destructuring': 7.23.3(@babel/core@7.29.0)
+      '@babel/plugin-transform-dotall-regex': 7.23.3(@babel/core@7.29.0)
+      '@babel/plugin-transform-duplicate-keys': 7.23.3(@babel/core@7.29.0)
+      '@babel/plugin-transform-dynamic-import': 7.23.4(@babel/core@7.29.0)
+      '@babel/plugin-transform-exponentiation-operator': 7.23.3(@babel/core@7.29.0)
+      '@babel/plugin-transform-export-namespace-from': 7.23.4(@babel/core@7.29.0)
+      '@babel/plugin-transform-for-of': 7.23.6(@babel/core@7.29.0)
+      '@babel/plugin-transform-function-name': 7.23.3(@babel/core@7.29.0)
+      '@babel/plugin-transform-json-strings': 7.23.4(@babel/core@7.29.0)
+      '@babel/plugin-transform-literals': 7.23.3(@babel/core@7.29.0)
+      '@babel/plugin-transform-logical-assignment-operators': 7.23.4(@babel/core@7.29.0)
+      '@babel/plugin-transform-member-expression-literals': 7.23.3(@babel/core@7.29.0)
+      '@babel/plugin-transform-modules-amd': 7.23.3(@babel/core@7.29.0)
+      '@babel/plugin-transform-modules-commonjs': 7.23.3(@babel/core@7.29.0)
+      '@babel/plugin-transform-modules-systemjs': 7.23.3(@babel/core@7.29.0)
+      '@babel/plugin-transform-modules-umd': 7.23.3(@babel/core@7.29.0)
+      '@babel/plugin-transform-named-capturing-groups-regex': 7.22.5(@babel/core@7.29.0)
+      '@babel/plugin-transform-new-target': 7.23.3(@babel/core@7.29.0)
+      '@babel/plugin-transform-nullish-coalescing-operator': 7.23.4(@babel/core@7.29.0)
+      '@babel/plugin-transform-numeric-separator': 7.23.4(@babel/core@7.29.0)
+      '@babel/plugin-transform-object-rest-spread': 7.23.4(@babel/core@7.29.0)
+      '@babel/plugin-transform-object-super': 7.23.3(@babel/core@7.29.0)
+      '@babel/plugin-transform-optional-catch-binding': 7.23.4(@babel/core@7.29.0)
+      '@babel/plugin-transform-optional-chaining': 7.23.4(@babel/core@7.29.0)
+      '@babel/plugin-transform-parameters': 7.23.3(@babel/core@7.29.0)
+      '@babel/plugin-transform-private-methods': 7.23.3(@babel/core@7.29.0)
+      '@babel/plugin-transform-private-property-in-object': 7.23.4(@babel/core@7.29.0)
+      '@babel/plugin-transform-property-literals': 7.23.3(@babel/core@7.29.0)
+      '@babel/plugin-transform-regenerator': 7.23.3(@babel/core@7.29.0)
+      '@babel/plugin-transform-reserved-words': 7.23.3(@babel/core@7.29.0)
+      '@babel/plugin-transform-shorthand-properties': 7.23.3(@babel/core@7.29.0)
+      '@babel/plugin-transform-spread': 7.23.3(@babel/core@7.29.0)
+      '@babel/plugin-transform-sticky-regex': 7.23.3(@babel/core@7.29.0)
+      '@babel/plugin-transform-template-literals': 7.23.3(@babel/core@7.29.0)
+      '@babel/plugin-transform-typeof-symbol': 7.23.3(@babel/core@7.29.0)
+      '@babel/plugin-transform-unicode-escapes': 7.23.3(@babel/core@7.29.0)
+      '@babel/plugin-transform-unicode-property-regex': 7.23.3(@babel/core@7.29.0)
+      '@babel/plugin-transform-unicode-regex': 7.23.3(@babel/core@7.29.0)
+      '@babel/plugin-transform-unicode-sets-regex': 7.23.3(@babel/core@7.29.0)
+      '@babel/preset-modules': 0.1.6-no-external-plugins(@babel/core@7.29.0)
+      babel-plugin-polyfill-corejs2: 0.4.7(@babel/core@7.29.0)
+      babel-plugin-polyfill-corejs3: 0.8.7(@babel/core@7.29.0)
+      babel-plugin-polyfill-regenerator: 0.5.4(@babel/core@7.29.0)
+      core-js-compat: 3.34.0
+      semver: 6.3.1
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/preset-modules@0.1.6-no-external-plugins(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+      '@babel/types': 7.29.0
+      esutils: 2.0.3
+
+  '@babel/preset-react@7.22.15(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+      '@babel/helper-validator-option': 7.27.1
+      '@babel/plugin-transform-react-display-name': 7.22.5(@babel/core@7.29.0)
+      '@babel/plugin-transform-react-jsx': 7.22.15(@babel/core@7.29.0)
+      '@babel/plugin-transform-react-jsx-development': 7.22.5(@babel/core@7.29.0)
+      '@babel/plugin-transform-react-pure-annotations': 7.22.5(@babel/core@7.29.0)
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/preset-typescript@7.23.0(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.22.5
+      '@babel/helper-validator-option': 7.27.1
+      '@babel/plugin-syntax-jsx': 7.22.5(@babel/core@7.29.0)
+      '@babel/plugin-transform-modules-commonjs': 7.23.3(@babel/core@7.29.0)
+      '@babel/plugin-transform-typescript': 7.22.15(@babel/core@7.29.0)
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/regjsgen@0.8.0': {}
+
+  '@babel/runtime@7.26.0':
+    dependencies:
+      regenerator-runtime: 0.14.1
+
+  '@babel/template@7.28.6':
+    dependencies:
+      '@babel/code-frame': 7.29.0
+      '@babel/parser': 7.29.0
+      '@babel/types': 7.29.0
+
+  '@babel/traverse@7.29.0':
+    dependencies:
+      '@babel/code-frame': 7.29.0
+      '@babel/generator': 7.29.1
+      '@babel/helper-globals': 7.28.0
+      '@babel/parser': 7.29.0
+      '@babel/template': 7.28.6
+      '@babel/types': 7.29.0
+      debug: 4.4.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/types@7.18.10':
+    dependencies:
+      '@babel/helper-string-parser': 7.27.1
+      '@babel/helper-validator-identifier': 7.28.5
+      to-fast-properties: 2.0.0
+
+  '@babel/types@7.29.0':
+    dependencies:
+      '@babel/helper-string-parser': 7.27.1
+      '@babel/helper-validator-identifier': 7.28.5
+
+  '@bcoe/v8-coverage@0.2.3': {}
+
+  '@bcoe/v8-coverage@1.0.2': {}
+
+  '@chromatic-com/storybook@5.1.2(storybook@10.4.2(@testing-library/dom@9.3.4)(@types/react@17.0.75)(prettier@3.8.3)(react-dom@17.0.2(react@17.0.2))(react@17.0.2))':
+    dependencies:
+      '@neoconfetti/react': 1.0.0
+      chromatic: 13.3.5
+      filesize: 10.1.6
+      jsonfile: 6.2.0
+      storybook: 10.4.2(@testing-library/dom@9.3.4)(@types/react@17.0.75)(prettier@3.8.3)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      strip-ansi: 7.1.0
+    transitivePeerDependencies:
+      - '@chromatic-com/cypress'
+      - '@chromatic-com/playwright'
+
+  '@codemirror/autocomplete@6.20.2':
+    dependencies:
+      '@codemirror/language': 6.12.3
+      '@codemirror/state': 6.6.0
+      '@codemirror/view': 6.43.0
+      '@lezer/common': 1.5.2
+
+  '@codemirror/commands@6.10.3':
+    dependencies:
+      '@codemirror/language': 6.12.3
+      '@codemirror/state': 6.6.0
+      '@codemirror/view': 6.43.0
+      '@lezer/common': 1.5.2
+
+  '@codemirror/lang-json@6.0.1':
+    dependencies:
+      '@codemirror/language': 6.12.3
+      '@lezer/json': 1.0.3
+    optional: true
+
+  '@codemirror/lang-yaml@6.1.2':
+    dependencies:
+      '@codemirror/autocomplete': 6.20.2
+      '@codemirror/language': 6.12.3
+      '@codemirror/state': 6.6.0
+      '@lezer/common': 1.5.2
+      '@lezer/highlight': 1.2.1
+      '@lezer/lr': 1.4.2
+      '@lezer/yaml': 1.0.3
+    optional: true
+
+  '@codemirror/language@6.12.3':
+    dependencies:
+      '@codemirror/state': 6.6.0
+      '@codemirror/view': 6.43.0
+      '@lezer/common': 1.5.2
+      '@lezer/highlight': 1.2.1
+      '@lezer/lr': 1.4.2
+      style-mod: 4.1.2
+
+  '@codemirror/legacy-modes@6.5.3':
+    dependencies:
+      '@codemirror/language': 6.12.3
+
+  '@codemirror/lint@6.9.6':
+    dependencies:
+      '@codemirror/state': 6.6.0
+      '@codemirror/view': 6.43.0
+      crelt: 1.0.6
+
+  '@codemirror/merge@6.10.0':
+    dependencies:
+      '@codemirror/language': 6.12.3
+      '@codemirror/state': 6.6.0
+      '@codemirror/view': 6.43.0
+      '@lezer/highlight': 1.2.1
+      style-mod: 4.1.2
+
+  '@codemirror/search@6.7.0':
+    dependencies:
+      '@codemirror/state': 6.6.0
+      '@codemirror/view': 6.43.0
+      crelt: 1.0.6
+
+  '@codemirror/state@6.6.0':
+    dependencies:
+      '@marijn/find-cluster-break': 1.0.2
+
+  '@codemirror/theme-one-dark@6.1.3':
+    dependencies:
+      '@codemirror/language': 6.12.3
+      '@codemirror/state': 6.6.0
+      '@codemirror/view': 6.43.0
+      '@lezer/highlight': 1.2.1
+
+  '@codemirror/view@6.43.0':
+    dependencies:
+      '@codemirror/state': 6.6.0
+      crelt: 1.0.6
+      style-mod: 4.1.2
+      w3c-keyname: 2.2.8
+
+  '@colordx/core@5.4.3': {}
+
+  '@discoveryjs/json-ext@0.5.7': {}
+
+  '@discoveryjs/json-ext@0.6.3': {}
+
+  '@emnapi/core@1.10.0':
+    dependencies:
+      '@emnapi/wasi-threads': 1.2.1
+      tslib: 2.8.1
+    optional: true
+
+  '@emnapi/core@1.9.2':
+    dependencies:
+      '@emnapi/wasi-threads': 1.2.1
+      tslib: 2.8.1
+    optional: true
+
+  '@emnapi/runtime@1.10.0':
+    dependencies:
+      tslib: 2.8.1
+    optional: true
+
+  '@emnapi/runtime@1.9.2':
+    dependencies:
+      tslib: 2.8.1
+    optional: true
+
+  '@emnapi/wasi-threads@1.2.1':
+    dependencies:
+      tslib: 2.8.1
+    optional: true
+
+  '@emotion/babel-plugin@11.13.5':
+    dependencies:
+      '@babel/helper-module-imports': 7.28.6
+      '@babel/runtime': 7.26.0
+      '@emotion/hash': 0.9.2
+      '@emotion/memoize': 0.9.0
+      '@emotion/serialize': 1.3.3
+      babel-plugin-macros: 3.1.0
+      convert-source-map: 1.9.0
+      escape-string-regexp: 4.0.0
+      find-root: 1.1.0
+      source-map: 0.5.7
+      stylis: 4.2.0
+    transitivePeerDependencies:
+      - supports-color
+
+  '@emotion/cache@11.14.0':
+    dependencies:
+      '@emotion/memoize': 0.9.0
+      '@emotion/sheet': 1.4.0
+      '@emotion/utils': 1.4.2
+      '@emotion/weak-memoize': 0.4.0
+      stylis: 4.2.0
+
+  '@emotion/hash@0.9.2': {}
+
+  '@emotion/memoize@0.9.0': {}
+
+  '@emotion/react@11.14.0(@types/react@17.0.75)(react@17.0.2)':
+    dependencies:
+      '@babel/runtime': 7.26.0
+      '@emotion/babel-plugin': 11.13.5
+      '@emotion/cache': 11.14.0
+      '@emotion/serialize': 1.3.3
+      '@emotion/use-insertion-effect-with-fallbacks': 1.2.0(react@17.0.2)
+      '@emotion/utils': 1.4.2
+      '@emotion/weak-memoize': 0.4.0
+      hoist-non-react-statics: 3.3.2
+      react: 17.0.2
+    optionalDependencies:
+      '@types/react': 17.0.75
+    transitivePeerDependencies:
+      - supports-color
+
+  '@emotion/serialize@1.3.3':
+    dependencies:
+      '@emotion/hash': 0.9.2
+      '@emotion/memoize': 0.9.0
+      '@emotion/unitless': 0.10.0
+      '@emotion/utils': 1.4.2
+      csstype: 3.0.10
+
+  '@emotion/sheet@1.4.0': {}
+
+  '@emotion/unitless@0.10.0': {}
+
+  '@emotion/use-insertion-effect-with-fallbacks@1.2.0(react@17.0.2)':
+    dependencies:
+      react: 17.0.2
+
+  '@emotion/utils@1.4.2': {}
+
+  '@emotion/weak-memoize@0.4.0': {}
+
+  '@esbuild/aix-ppc64@0.27.3':
+    optional: true
+
+  '@esbuild/android-arm64@0.27.3':
+    optional: true
+
+  '@esbuild/android-arm@0.27.3':
+    optional: true
+
+  '@esbuild/android-x64@0.27.3':
+    optional: true
+
+  '@esbuild/darwin-arm64@0.27.3':
+    optional: true
+
+  '@esbuild/darwin-x64@0.27.3':
+    optional: true
+
+  '@esbuild/freebsd-arm64@0.27.3':
+    optional: true
+
+  '@esbuild/freebsd-x64@0.27.3':
+    optional: true
+
+  '@esbuild/linux-arm64@0.27.3':
+    optional: true
+
+  '@esbuild/linux-arm@0.27.3':
+    optional: true
+
+  '@esbuild/linux-ia32@0.27.3':
+    optional: true
+
+  '@esbuild/linux-loong64@0.27.3':
+    optional: true
+
+  '@esbuild/linux-mips64el@0.27.3':
+    optional: true
+
+  '@esbuild/linux-ppc64@0.27.3':
+    optional: true
+
+  '@esbuild/linux-riscv64@0.27.3':
+    optional: true
+
+  '@esbuild/linux-s390x@0.27.3':
+    optional: true
+
+  '@esbuild/linux-x64@0.27.3':
+    optional: true
+
+  '@esbuild/netbsd-arm64@0.27.3':
+    optional: true
+
+  '@esbuild/netbsd-x64@0.27.3':
+    optional: true
+
+  '@esbuild/openbsd-arm64@0.27.3':
+    optional: true
+
+  '@esbuild/openbsd-x64@0.27.3':
+    optional: true
+
+  '@esbuild/openharmony-arm64@0.27.3':
+    optional: true
+
+  '@esbuild/sunos-x64@0.27.3':
+    optional: true
+
+  '@esbuild/win32-arm64@0.27.3':
+    optional: true
+
+  '@esbuild/win32-ia32@0.27.3':
+    optional: true
+
+  '@esbuild/win32-x64@0.27.3':
+    optional: true
+
+  '@eslint-community/eslint-plugin-eslint-comments@4.7.2(eslint@9.39.4(jiti@2.7.0))':
+    dependencies:
+      escape-string-regexp: 4.0.0
+      eslint: 9.39.4(jiti@2.7.0)
+      ignore: 7.0.5
+
+  '@eslint-community/eslint-utils@4.9.1(eslint@9.39.4(jiti@2.7.0))':
+    dependencies:
+      eslint: 9.39.4(jiti@2.7.0)
+      eslint-visitor-keys: 3.4.3
+
+  '@eslint-community/regexpp@4.12.2': {}
+
+  '@eslint/config-array@0.21.2':
+    dependencies:
+      '@eslint/object-schema': 2.1.7
+      debug: 4.4.3
+      minimatch: 3.1.5
+    transitivePeerDependencies:
+      - supports-color
+
+  '@eslint/config-helpers@0.4.2':
+    dependencies:
+      '@eslint/core': 0.17.0
+
+  '@eslint/core@0.17.0':
+    dependencies:
+      '@types/json-schema': 7.0.15
+
+  '@eslint/eslintrc@3.3.5':
+    dependencies:
+      ajv: 6.14.0
+      debug: 4.4.3
+      espree: 10.4.0
+      globals: 14.0.0
+      ignore: 5.2.4
+      import-fresh: 3.3.0
+      js-yaml: 4.1.1
+      minimatch: 3.1.5
+      strip-json-comments: 3.1.1
+    transitivePeerDependencies:
+      - supports-color
+
+  '@eslint/js@10.0.1(eslint@9.39.4(jiti@2.7.0))':
+    optionalDependencies:
+      eslint: 9.39.4(jiti@2.7.0)
+
+  '@eslint/js@9.39.4': {}
+
+  '@eslint/object-schema@2.1.7': {}
+
+  '@eslint/plugin-kit@0.4.1':
+    dependencies:
+      '@eslint/core': 0.17.0
+      levn: 0.4.1
+
+  '@exodus/schemasafe@1.0.0-rc.6': {}
+
+  '@floating-ui/core@1.7.5':
+    dependencies:
+      '@floating-ui/utils': 0.2.11
+
+  '@floating-ui/dom@1.7.6':
+    dependencies:
+      '@floating-ui/core': 1.7.5
+      '@floating-ui/utils': 0.2.11
+
+  '@floating-ui/utils@0.2.11': {}
+
+  '@hey-api/codegen-core@0.9.1(magicast@0.5.2)':
+    dependencies:
+      '@hey-api/types': 0.1.4
+      ansi-colors: 4.1.3
+      c12: 3.3.4(magicast@0.5.2)
+      color-support: 1.1.3
+    transitivePeerDependencies:
+      - magicast
+
+  '@hey-api/json-schema-ref-parser@1.4.4':
+    dependencies:
+      '@jsdevtools/ono': 7.1.3
+      '@types/json-schema': 7.0.15
+      js-yaml: 4.2.0
+
+  '@hey-api/openapi-ts@0.99.0(magicast@0.5.2)(typescript@6.0.2)':
+    dependencies:
+      '@hey-api/codegen-core': 0.9.1(magicast@0.5.2)
+      '@hey-api/json-schema-ref-parser': 1.4.4
+      '@hey-api/shared': 0.5.0(magicast@0.5.2)
+      '@hey-api/spec-types': 0.2.0
+      '@hey-api/types': 0.1.4
+      '@lukeed/ms': 2.0.2
+      ansi-colors: 4.1.3
+      color-support: 1.1.3
+      commander: 15.0.0
+      get-tsconfig: 4.14.0
+      typescript: 6.0.2
+    transitivePeerDependencies:
+      - magicast
+
+  '@hey-api/shared@0.5.0(magicast@0.5.2)':
+    dependencies:
+      '@hey-api/codegen-core': 0.9.1(magicast@0.5.2)
+      '@hey-api/json-schema-ref-parser': 1.4.4
+      '@hey-api/spec-types': 0.2.0
+      '@hey-api/types': 0.1.4
+      ansi-colors: 4.1.3
+      cross-spawn: 7.0.6
+      open: 11.0.0
+      semver: 7.8.4
+    transitivePeerDependencies:
+      - magicast
+
+  '@hey-api/spec-types@0.2.0':
+    dependencies:
+      '@hey-api/types': 0.1.4
+
+  '@hey-api/types@0.1.4': {}
+
+  '@humanfs/core@0.19.1': {}
+
+  '@humanfs/node@0.16.7':
+    dependencies:
+      '@humanfs/core': 0.19.1
+      '@humanwhocodes/retry': 0.4.3
+
+  '@humanwhocodes/module-importer@1.0.1': {}
+
+  '@humanwhocodes/retry@0.4.3': {}
+
+  '@inquirer/ansi@2.0.7': {}
+
+  '@inquirer/confirm@6.1.1(@types/node@25.0.3)':
+    dependencies:
+      '@inquirer/core': 11.2.1(@types/node@25.0.3)
+      '@inquirer/type': 4.0.7(@types/node@25.0.3)
+    optionalDependencies:
+      '@types/node': 25.0.3
+
+  '@inquirer/core@11.2.1(@types/node@25.0.3)':
+    dependencies:
+      '@inquirer/ansi': 2.0.7
+      '@inquirer/figures': 2.0.7
+      '@inquirer/type': 4.0.7(@types/node@25.0.3)
+      cli-width: 4.1.0
+      fast-wrap-ansi: 0.2.2
+      mute-stream: 3.0.0
+      signal-exit: 4.1.0
+    optionalDependencies:
+      '@types/node': 25.0.3
+
+  '@inquirer/figures@2.0.7': {}
+
+  '@inquirer/type@4.0.7(@types/node@25.0.3)':
+    optionalDependencies:
+      '@types/node': 25.0.3
+
+  '@istanbuljs/schema@0.1.3': {}
+
+  '@jest/types@27.4.2':
+    dependencies:
+      '@types/istanbul-lib-coverage': 2.0.4
+      '@types/istanbul-reports': 3.0.1
+      '@types/node': 25.0.3
+      '@types/yargs': 16.0.4
+      chalk: 4.1.2
+
+  '@jridgewell/gen-mapping@0.3.13':
+    dependencies:
+      '@jridgewell/sourcemap-codec': 1.5.5
+      '@jridgewell/trace-mapping': 0.3.31
+
+  '@jridgewell/remapping@2.3.5':
+    dependencies:
+      '@jridgewell/gen-mapping': 0.3.13
+      '@jridgewell/trace-mapping': 0.3.31
+
+  '@jridgewell/resolve-uri@3.1.2': {}
+
+  '@jridgewell/source-map@0.3.11':
+    dependencies:
+      '@jridgewell/gen-mapping': 0.3.13
+      '@jridgewell/trace-mapping': 0.3.31
+
+  '@jridgewell/sourcemap-codec@1.5.5': {}
+
+  '@jridgewell/trace-mapping@0.3.31':
+    dependencies:
+      '@jridgewell/resolve-uri': 3.1.2
+      '@jridgewell/sourcemap-codec': 1.5.5
+
+  '@jsdevtools/ono@7.1.3': {}
+
+  '@jsonjoy.com/base64@1.1.2(tslib@2.8.1)':
+    dependencies:
+      tslib: 2.8.1
+
+  '@jsonjoy.com/base64@17.65.0(tslib@2.8.1)':
+    dependencies:
+      tslib: 2.8.1
+
+  '@jsonjoy.com/buffers@1.2.1(tslib@2.8.1)':
+    dependencies:
+      tslib: 2.8.1
+
+  '@jsonjoy.com/buffers@17.65.0(tslib@2.8.1)':
+    dependencies:
+      tslib: 2.8.1
+
+  '@jsonjoy.com/codegen@1.0.0(tslib@2.8.1)':
+    dependencies:
+      tslib: 2.8.1
+
+  '@jsonjoy.com/codegen@17.65.0(tslib@2.8.1)':
+    dependencies:
+      tslib: 2.8.1
+
+  '@jsonjoy.com/fs-core@4.56.10(tslib@2.8.1)':
+    dependencies:
+      '@jsonjoy.com/fs-node-builtins': 4.56.10(tslib@2.8.1)
+      '@jsonjoy.com/fs-node-utils': 4.56.10(tslib@2.8.1)
+      thingies: 2.5.0(tslib@2.8.1)
+      tslib: 2.8.1
+
+  '@jsonjoy.com/fs-fsa@4.56.10(tslib@2.8.1)':
+    dependencies:
+      '@jsonjoy.com/fs-core': 4.56.10(tslib@2.8.1)
+      '@jsonjoy.com/fs-node-builtins': 4.56.10(tslib@2.8.1)
+      '@jsonjoy.com/fs-node-utils': 4.56.10(tslib@2.8.1)
+      thingies: 2.5.0(tslib@2.8.1)
+      tslib: 2.8.1
+
+  '@jsonjoy.com/fs-node-builtins@4.56.10(tslib@2.8.1)':
+    dependencies:
+      tslib: 2.8.1
+
+  '@jsonjoy.com/fs-node-to-fsa@4.56.10(tslib@2.8.1)':
+    dependencies:
+      '@jsonjoy.com/fs-fsa': 4.56.10(tslib@2.8.1)
+      '@jsonjoy.com/fs-node-builtins': 4.56.10(tslib@2.8.1)
+      '@jsonjoy.com/fs-node-utils': 4.56.10(tslib@2.8.1)
+      tslib: 2.8.1
+
+  '@jsonjoy.com/fs-node-utils@4.56.10(tslib@2.8.1)':
+    dependencies:
+      '@jsonjoy.com/fs-node-builtins': 4.56.10(tslib@2.8.1)
+      tslib: 2.8.1
+
+  '@jsonjoy.com/fs-node@4.56.10(tslib@2.8.1)':
+    dependencies:
+      '@jsonjoy.com/fs-core': 4.56.10(tslib@2.8.1)
+      '@jsonjoy.com/fs-node-builtins': 4.56.10(tslib@2.8.1)
+      '@jsonjoy.com/fs-node-utils': 4.56.10(tslib@2.8.1)
+      '@jsonjoy.com/fs-print': 4.56.10(tslib@2.8.1)
+      '@jsonjoy.com/fs-snapshot': 4.56.10(tslib@2.8.1)
+      glob-to-regex.js: 1.2.0(tslib@2.8.1)
+      thingies: 2.5.0(tslib@2.8.1)
+      tslib: 2.8.1
+
+  '@jsonjoy.com/fs-print@4.56.10(tslib@2.8.1)':
+    dependencies:
+      '@jsonjoy.com/fs-node-utils': 4.56.10(tslib@2.8.1)
+      tree-dump: 1.1.0(tslib@2.8.1)
+      tslib: 2.8.1
+
+  '@jsonjoy.com/fs-snapshot@4.56.10(tslib@2.8.1)':
+    dependencies:
+      '@jsonjoy.com/buffers': 17.65.0(tslib@2.8.1)
+      '@jsonjoy.com/fs-node-utils': 4.56.10(tslib@2.8.1)
+      '@jsonjoy.com/json-pack': 17.65.0(tslib@2.8.1)
+      '@jsonjoy.com/util': 17.65.0(tslib@2.8.1)
+      tslib: 2.8.1
+
+  '@jsonjoy.com/json-pack@1.21.0(tslib@2.8.1)':
+    dependencies:
+      '@jsonjoy.com/base64': 1.1.2(tslib@2.8.1)
+      '@jsonjoy.com/buffers': 1.2.1(tslib@2.8.1)
+      '@jsonjoy.com/codegen': 1.0.0(tslib@2.8.1)
+      '@jsonjoy.com/json-pointer': 1.0.2(tslib@2.8.1)
+      '@jsonjoy.com/util': 1.9.0(tslib@2.8.1)
+      hyperdyperid: 1.2.0
+      thingies: 2.5.0(tslib@2.8.1)
+      tree-dump: 1.1.0(tslib@2.8.1)
+      tslib: 2.8.1
+
+  '@jsonjoy.com/json-pack@17.65.0(tslib@2.8.1)':
+    dependencies:
+      '@jsonjoy.com/base64': 17.65.0(tslib@2.8.1)
+      '@jsonjoy.com/buffers': 17.65.0(tslib@2.8.1)
+      '@jsonjoy.com/codegen': 17.65.0(tslib@2.8.1)
+      '@jsonjoy.com/json-pointer': 17.65.0(tslib@2.8.1)
+      '@jsonjoy.com/util': 17.65.0(tslib@2.8.1)
+      hyperdyperid: 1.2.0
+      thingies: 2.5.0(tslib@2.8.1)
+      tree-dump: 1.1.0(tslib@2.8.1)
+      tslib: 2.8.1
+
+  '@jsonjoy.com/json-pointer@1.0.2(tslib@2.8.1)':
+    dependencies:
+      '@jsonjoy.com/codegen': 1.0.0(tslib@2.8.1)
+      '@jsonjoy.com/util': 1.9.0(tslib@2.8.1)
+      tslib: 2.8.1
+
+  '@jsonjoy.com/json-pointer@17.65.0(tslib@2.8.1)':
+    dependencies:
+      '@jsonjoy.com/util': 17.65.0(tslib@2.8.1)
+      tslib: 2.8.1
+
+  '@jsonjoy.com/util@1.9.0(tslib@2.8.1)':
+    dependencies:
+      '@jsonjoy.com/buffers': 1.2.1(tslib@2.8.1)
+      '@jsonjoy.com/codegen': 1.0.0(tslib@2.8.1)
+      tslib: 2.8.1
+
+  '@jsonjoy.com/util@17.65.0(tslib@2.8.1)':
+    dependencies:
+      '@jsonjoy.com/buffers': 17.65.0(tslib@2.8.1)
+      '@jsonjoy.com/codegen': 17.65.0(tslib@2.8.1)
+      tslib: 2.8.1
+
+  '@leichtgewicht/ip-codec@2.0.4': {}
+
+  '@lezer/common@1.5.2': {}
+
+  '@lezer/highlight@1.2.1':
+    dependencies:
+      '@lezer/common': 1.5.2
+
+  '@lezer/json@1.0.3':
+    dependencies:
+      '@lezer/common': 1.5.2
+      '@lezer/highlight': 1.2.1
+      '@lezer/lr': 1.4.2
+    optional: true
+
+  '@lezer/lr@1.4.2':
+    dependencies:
+      '@lezer/common': 1.5.2
+
+  '@lezer/yaml@1.0.3':
+    dependencies:
+      '@lezer/common': 1.5.2
+      '@lezer/highlight': 1.2.1
+      '@lezer/lr': 1.4.2
+    optional: true
+
+  '@lukeed/ms@2.0.2': {}
+
+  '@marijn/find-cluster-break@1.0.2': {}
+
+  '@mdx-js/react@3.1.1(@types/react@17.0.75)(react@17.0.2)':
+    dependencies:
+      '@types/mdx': 2.0.5
+      '@types/react': 17.0.75
+      react: 17.0.2
+
+  '@mswjs/interceptors@0.41.9':
+    dependencies:
+      '@open-draft/deferred-promise': 2.2.0
+      '@open-draft/logger': 0.3.0
+      '@open-draft/until': 2.1.0
+      is-node-process: 1.2.0
+      outvariant: 1.4.3
+      strict-event-emitter: 0.5.1
+
+  '@napi-rs/wasm-runtime@0.2.12':
+    dependencies:
+      '@emnapi/core': 1.10.0
+      '@emnapi/runtime': 1.10.0
+      '@tybys/wasm-util': 0.10.1
+    optional: true
+
+  '@napi-rs/wasm-runtime@1.1.4(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)':
+    dependencies:
+      '@emnapi/core': 1.10.0
+      '@emnapi/runtime': 1.10.0
+      '@tybys/wasm-util': 0.10.1
+    optional: true
+
+  '@napi-rs/wasm-runtime@1.1.4(@emnapi/core@1.9.2)(@emnapi/runtime@1.9.2)':
+    dependencies:
+      '@emnapi/core': 1.9.2
+      '@emnapi/runtime': 1.9.2
+      '@tybys/wasm-util': 0.10.1
+    optional: true
+
+  '@neoconfetti/react@1.0.0': {}
+
+  '@noble/hashes@1.4.0': {}
+
+  '@nodelib/fs.scandir@2.1.5':
+    dependencies:
+      '@nodelib/fs.stat': 2.0.5
+      run-parallel: 1.2.0
+
+  '@nodelib/fs.stat@2.0.5': {}
+
+  '@nodelib/fs.walk@1.2.8':
+    dependencies:
+      '@nodelib/fs.scandir': 2.1.5
+      fastq: 1.15.0
+
+  '@nxmix/tokenize-ansi@3.0.0': {}
+
+  '@open-draft/deferred-promise@2.2.0': {}
+
+  '@open-draft/deferred-promise@3.0.0': {}
+
+  '@open-draft/logger@0.3.0':
+    dependencies:
+      is-node-process: 1.2.0
+      outvariant: 1.4.3
+
+  '@open-draft/until@2.1.0': {}
+
+  '@oxc-parser/binding-android-arm-eabi@0.127.0':
+    optional: true
+
+  '@oxc-parser/binding-android-arm64@0.127.0':
+    optional: true
+
+  '@oxc-parser/binding-darwin-arm64@0.127.0':
+    optional: true
+
+  '@oxc-parser/binding-darwin-x64@0.127.0':
+    optional: true
+
+  '@oxc-parser/binding-freebsd-x64@0.127.0':
+    optional: true
+
+  '@oxc-parser/binding-linux-arm-gnueabihf@0.127.0':
+    optional: true
+
+  '@oxc-parser/binding-linux-arm-musleabihf@0.127.0':
+    optional: true
+
+  '@oxc-parser/binding-linux-arm64-gnu@0.127.0':
+    optional: true
+
+  '@oxc-parser/binding-linux-arm64-musl@0.127.0':
+    optional: true
+
+  '@oxc-parser/binding-linux-ppc64-gnu@0.127.0':
+    optional: true
+
+  '@oxc-parser/binding-linux-riscv64-gnu@0.127.0':
+    optional: true
+
+  '@oxc-parser/binding-linux-riscv64-musl@0.127.0':
+    optional: true
+
+  '@oxc-parser/binding-linux-s390x-gnu@0.127.0':
+    optional: true
+
+  '@oxc-parser/binding-linux-x64-gnu@0.127.0':
+    optional: true
+
+  '@oxc-parser/binding-linux-x64-musl@0.127.0':
+    optional: true
+
+  '@oxc-parser/binding-openharmony-arm64@0.127.0':
+    optional: true
+
+  '@oxc-parser/binding-wasm32-wasi@0.127.0':
+    dependencies:
+      '@emnapi/core': 1.9.2
+      '@emnapi/runtime': 1.9.2
+      '@napi-rs/wasm-runtime': 1.1.4(@emnapi/core@1.9.2)(@emnapi/runtime@1.9.2)
+    optional: true
+
+  '@oxc-parser/binding-win32-arm64-msvc@0.127.0':
+    optional: true
+
+  '@oxc-parser/binding-win32-ia32-msvc@0.127.0':
+    optional: true
+
+  '@oxc-parser/binding-win32-x64-msvc@0.127.0':
+    optional: true
+
+  '@oxc-project/types@0.127.0': {}
+
+  '@oxc-project/types@0.133.0': {}
+
+  '@oxc-resolver/binding-android-arm-eabi@11.20.0':
+    optional: true
+
+  '@oxc-resolver/binding-android-arm64@11.20.0':
+    optional: true
+
+  '@oxc-resolver/binding-darwin-arm64@11.20.0':
+    optional: true
+
+  '@oxc-resolver/binding-darwin-x64@11.20.0':
+    optional: true
+
+  '@oxc-resolver/binding-freebsd-x64@11.20.0':
+    optional: true
+
+  '@oxc-resolver/binding-linux-arm-gnueabihf@11.20.0':
+    optional: true
+
+  '@oxc-resolver/binding-linux-arm-musleabihf@11.20.0':
+    optional: true
+
+  '@oxc-resolver/binding-linux-arm64-gnu@11.20.0':
+    optional: true
+
+  '@oxc-resolver/binding-linux-arm64-musl@11.20.0':
+    optional: true
+
+  '@oxc-resolver/binding-linux-ppc64-gnu@11.20.0':
+    optional: true
+
+  '@oxc-resolver/binding-linux-riscv64-gnu@11.20.0':
+    optional: true
+
+  '@oxc-resolver/binding-linux-riscv64-musl@11.20.0':
+    optional: true
+
+  '@oxc-resolver/binding-linux-s390x-gnu@11.20.0':
+    optional: true
+
+  '@oxc-resolver/binding-linux-x64-gnu@11.20.0':
+    optional: true
+
+  '@oxc-resolver/binding-linux-x64-musl@11.20.0':
+    optional: true
+
+  '@oxc-resolver/binding-openharmony-arm64@11.20.0':
+    optional: true
+
+  '@oxc-resolver/binding-wasm32-wasi@11.20.0':
+    dependencies:
+      '@emnapi/core': 1.10.0
+      '@emnapi/runtime': 1.10.0
+      '@napi-rs/wasm-runtime': 1.1.4(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)
+    optional: true
+
+  '@oxc-resolver/binding-win32-arm64-msvc@11.20.0':
+    optional: true
+
+  '@oxc-resolver/binding-win32-x64-msvc@11.20.0':
+    optional: true
+
+  '@peculiar/asn1-cms@2.6.0':
+    dependencies:
+      '@peculiar/asn1-schema': 2.6.0
+      '@peculiar/asn1-x509': 2.6.0
+      '@peculiar/asn1-x509-attr': 2.6.0
+      asn1js: 3.0.7
+      tslib: 2.8.1
+
+  '@peculiar/asn1-csr@2.6.0':
+    dependencies:
+      '@peculiar/asn1-schema': 2.6.0
+      '@peculiar/asn1-x509': 2.6.0
+      asn1js: 3.0.7
+      tslib: 2.8.1
+
+  '@peculiar/asn1-ecc@2.6.0':
+    dependencies:
+      '@peculiar/asn1-schema': 2.6.0
+      '@peculiar/asn1-x509': 2.6.0
+      asn1js: 3.0.7
+      tslib: 2.8.1
+
+  '@peculiar/asn1-pfx@2.6.0':
+    dependencies:
+      '@peculiar/asn1-cms': 2.6.0
+      '@peculiar/asn1-pkcs8': 2.6.0
+      '@peculiar/asn1-rsa': 2.6.0
+      '@peculiar/asn1-schema': 2.6.0
+      asn1js: 3.0.7
+      tslib: 2.8.1
+
+  '@peculiar/asn1-pkcs8@2.6.0':
+    dependencies:
+      '@peculiar/asn1-schema': 2.6.0
+      '@peculiar/asn1-x509': 2.6.0
+      asn1js: 3.0.7
+      tslib: 2.8.1
+
+  '@peculiar/asn1-pkcs9@2.6.0':
+    dependencies:
+      '@peculiar/asn1-cms': 2.6.0
+      '@peculiar/asn1-pfx': 2.6.0
+      '@peculiar/asn1-pkcs8': 2.6.0
+      '@peculiar/asn1-schema': 2.6.0
+      '@peculiar/asn1-x509': 2.6.0
+      '@peculiar/asn1-x509-attr': 2.6.0
+      asn1js: 3.0.7
+      tslib: 2.8.1
+
+  '@peculiar/asn1-rsa@2.6.0':
+    dependencies:
+      '@peculiar/asn1-schema': 2.6.0
+      '@peculiar/asn1-x509': 2.6.0
+      asn1js: 3.0.7
+      tslib: 2.8.1
+
+  '@peculiar/asn1-schema@2.6.0':
+    dependencies:
+      asn1js: 3.0.7
+      pvtsutils: 1.3.6
+      tslib: 2.8.1
+
+  '@peculiar/asn1-x509-attr@2.6.0':
+    dependencies:
+      '@peculiar/asn1-schema': 2.6.0
+      '@peculiar/asn1-x509': 2.6.0
+      asn1js: 3.0.7
+      tslib: 2.8.1
+
+  '@peculiar/asn1-x509@2.6.0':
+    dependencies:
+      '@peculiar/asn1-schema': 2.6.0
+      asn1js: 3.0.7
+      pvtsutils: 1.3.6
+      tslib: 2.8.1
+
+  '@peculiar/x509@1.14.3':
+    dependencies:
+      '@peculiar/asn1-cms': 2.6.0
+      '@peculiar/asn1-csr': 2.6.0
+      '@peculiar/asn1-ecc': 2.6.0
+      '@peculiar/asn1-pkcs9': 2.6.0
+      '@peculiar/asn1-rsa': 2.6.0
+      '@peculiar/asn1-schema': 2.6.0
+      '@peculiar/asn1-x509': 2.6.0
+      pvtsutils: 1.3.6
+      reflect-metadata: 0.2.2
+      tslib: 2.8.1
+      tsyringe: 4.10.0
+
+  '@polka/url@1.0.0-next.29': {}
+
+  '@popperjs/core@2.11.6': {}
+
+  '@radix-ui/primitive@1.1.2': {}
+
+  '@radix-ui/react-compose-refs@1.1.2(@types/react@17.0.75)(react@17.0.2)':
+    dependencies:
+      react: 17.0.2
+    optionalDependencies:
+      '@types/react': 17.0.75
+
+  '@radix-ui/react-context@1.1.2(@types/react@17.0.75)(react@17.0.2)':
+    dependencies:
+      react: 17.0.2
+    optionalDependencies:
+      '@types/react': 17.0.75
+
+  '@radix-ui/react-dialog@1.1.11(@types/react-dom@17.0.25)(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.2
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@17.0.75)(react@17.0.2)
+      '@radix-ui/react-context': 1.1.2(@types/react@17.0.75)(react@17.0.2)
+      '@radix-ui/react-dismissable-layer': 1.1.7(@types/react-dom@17.0.25)(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      '@radix-ui/react-focus-guards': 1.1.2(@types/react@17.0.75)(react@17.0.2)
+      '@radix-ui/react-focus-scope': 1.1.4(@types/react-dom@17.0.25)(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      '@radix-ui/react-id': 1.1.1(@types/react@17.0.75)(react@17.0.2)
+      '@radix-ui/react-portal': 1.1.6(@types/react-dom@17.0.25)(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      '@radix-ui/react-presence': 1.1.4(@types/react-dom@17.0.25)(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      '@radix-ui/react-primitive': 2.1.0(@types/react-dom@17.0.25)(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      '@radix-ui/react-slot': 1.2.0(@types/react@17.0.75)(react@17.0.2)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@17.0.75)(react@17.0.2)
+      aria-hidden: 1.2.4
+      react: 17.0.2
+      react-dom: 17.0.2(react@17.0.2)
+      react-remove-scroll: 2.6.3(@types/react@17.0.75)(react@17.0.2)
+    optionalDependencies:
+      '@types/react': 17.0.75
+      '@types/react-dom': 17.0.25
+
+  '@radix-ui/react-dismissable-layer@1.1.7(@types/react-dom@17.0.25)(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.2
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@17.0.75)(react@17.0.2)
+      '@radix-ui/react-primitive': 2.1.0(@types/react-dom@17.0.25)(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@17.0.75)(react@17.0.2)
+      '@radix-ui/react-use-escape-keydown': 1.1.1(@types/react@17.0.75)(react@17.0.2)
+      react: 17.0.2
+      react-dom: 17.0.2(react@17.0.2)
+    optionalDependencies:
+      '@types/react': 17.0.75
+      '@types/react-dom': 17.0.25
+
+  '@radix-ui/react-focus-guards@1.1.2(@types/react@17.0.75)(react@17.0.2)':
+    dependencies:
+      react: 17.0.2
+    optionalDependencies:
+      '@types/react': 17.0.75
+
+  '@radix-ui/react-focus-scope@1.1.4(@types/react-dom@17.0.25)(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)':
+    dependencies:
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@17.0.75)(react@17.0.2)
+      '@radix-ui/react-primitive': 2.1.0(@types/react-dom@17.0.25)(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@17.0.75)(react@17.0.2)
+      react: 17.0.2
+      react-dom: 17.0.2(react@17.0.2)
+    optionalDependencies:
+      '@types/react': 17.0.75
+      '@types/react-dom': 17.0.25
+
+  '@radix-ui/react-id@1.1.1(@types/react@17.0.75)(react@17.0.2)':
+    dependencies:
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@17.0.75)(react@17.0.2)
+      react: 17.0.2
+    optionalDependencies:
+      '@types/react': 17.0.75
+
+  '@radix-ui/react-portal@1.1.6(@types/react-dom@17.0.25)(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)':
+    dependencies:
+      '@radix-ui/react-primitive': 2.1.0(@types/react-dom@17.0.25)(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@17.0.75)(react@17.0.2)
+      react: 17.0.2
+      react-dom: 17.0.2(react@17.0.2)
+    optionalDependencies:
+      '@types/react': 17.0.75
+      '@types/react-dom': 17.0.25
+
+  '@radix-ui/react-presence@1.1.4(@types/react-dom@17.0.25)(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)':
+    dependencies:
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@17.0.75)(react@17.0.2)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@17.0.75)(react@17.0.2)
+      react: 17.0.2
+      react-dom: 17.0.2(react@17.0.2)
+    optionalDependencies:
+      '@types/react': 17.0.75
+      '@types/react-dom': 17.0.25
+
+  '@radix-ui/react-primitive@2.1.0(@types/react-dom@17.0.25)(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)':
+    dependencies:
+      '@radix-ui/react-slot': 1.2.0(@types/react@17.0.75)(react@17.0.2)
+      react: 17.0.2
+      react-dom: 17.0.2(react@17.0.2)
+    optionalDependencies:
+      '@types/react': 17.0.75
+      '@types/react-dom': 17.0.25
+
+  '@radix-ui/react-slot@1.2.0(@types/react@17.0.75)(react@17.0.2)':
+    dependencies:
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@17.0.75)(react@17.0.2)
+      react: 17.0.2
+    optionalDependencies:
+      '@types/react': 17.0.75
+
+  '@radix-ui/react-slot@1.2.4(@types/react@17.0.75)(react@17.0.2)':
+    dependencies:
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@17.0.75)(react@17.0.2)
+      react: 17.0.2
+    optionalDependencies:
+      '@types/react': 17.0.75
+
+  '@radix-ui/react-use-callback-ref@1.1.1(@types/react@17.0.75)(react@17.0.2)':
+    dependencies:
+      react: 17.0.2
+    optionalDependencies:
+      '@types/react': 17.0.75
+
+  '@radix-ui/react-use-controllable-state@1.2.2(@types/react@17.0.75)(react@17.0.2)':
+    dependencies:
+      '@radix-ui/react-use-effect-event': 0.0.2(@types/react@17.0.75)(react@17.0.2)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@17.0.75)(react@17.0.2)
+      react: 17.0.2
+    optionalDependencies:
+      '@types/react': 17.0.75
+
+  '@radix-ui/react-use-effect-event@0.0.2(@types/react@17.0.75)(react@17.0.2)':
+    dependencies:
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@17.0.75)(react@17.0.2)
+      react: 17.0.2
+    optionalDependencies:
+      '@types/react': 17.0.75
+
+  '@radix-ui/react-use-escape-keydown@1.1.1(@types/react@17.0.75)(react@17.0.2)':
+    dependencies:
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@17.0.75)(react@17.0.2)
+      react: 17.0.2
+    optionalDependencies:
+      '@types/react': 17.0.75
+
+  '@radix-ui/react-use-layout-effect@1.1.1(@types/react@17.0.75)(react@17.0.2)':
+    dependencies:
+      react: 17.0.2
+    optionalDependencies:
+      '@types/react': 17.0.75
+
+  '@reach/auto-id@0.16.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)':
+    dependencies:
+      '@reach/utils': 0.16.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      react: 17.0.2
+      react-dom: 17.0.2(react@17.0.2)
+      tslib: 2.8.1
+
+  '@reach/auto-id@0.18.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)':
+    dependencies:
+      '@reach/utils': 0.18.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      react: 17.0.2
+      react-dom: 17.0.2(react@17.0.2)
+
+  '@reach/combobox@0.18.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)':
+    dependencies:
+      '@reach/auto-id': 0.18.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      '@reach/descendants': 0.18.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      '@reach/polymorphic': 0.18.0(react@17.0.2)
+      '@reach/popover': 0.18.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      '@reach/portal': 0.18.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      '@reach/utils': 0.18.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      react: 17.0.2
+      react-dom: 17.0.2(react@17.0.2)
+
+  '@reach/descendants@0.16.1(react-dom@17.0.2(react@17.0.2))(react@17.0.2)':
+    dependencies:
+      '@reach/utils': 0.16.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      react: 17.0.2
+      react-dom: 17.0.2(react@17.0.2)
+      tslib: 2.8.1
+
+  '@reach/descendants@0.18.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)':
+    dependencies:
+      '@reach/utils': 0.18.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      react: 17.0.2
+      react-dom: 17.0.2(react@17.0.2)
+
+  '@reach/dialog@0.17.0(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)':
+    dependencies:
+      '@reach/portal': 0.17.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      '@reach/utils': 0.17.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      prop-types: 15.8.1
+      react: 17.0.2
+      react-dom: 17.0.2(react@17.0.2)
+      react-focus-lock: 2.9.1(@types/react@17.0.75)(react@17.0.2)
+      react-remove-scroll: 2.6.3(@types/react@17.0.75)(react@17.0.2)
+      tslib: 2.8.1
+    transitivePeerDependencies:
+      - '@types/react'
+
+  '@reach/dropdown@0.16.1(react-dom@17.0.2(react@17.0.2))(react@17.0.2)':
+    dependencies:
+      '@reach/auto-id': 0.16.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      '@reach/descendants': 0.16.1(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      '@reach/popover': 0.16.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      '@reach/utils': 0.16.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      react: 17.0.2
+      react-dom: 17.0.2(react@17.0.2)
+      tslib: 2.8.1
+
+  '@reach/menu-button@0.16.1(react-dom@17.0.2(react@17.0.2))(react-is@17.0.2)(react@17.0.2)':
+    dependencies:
+      '@reach/dropdown': 0.16.1(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      '@reach/popover': 0.16.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      '@reach/utils': 0.16.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      prop-types: 15.8.1
+      react: 17.0.2
+      react-dom: 17.0.2(react@17.0.2)
+      react-is: 17.0.2
+      tiny-warning: 1.0.3
+      tslib: 2.8.1
+
+  '@reach/observe-rect@1.2.0': {}
+
+  '@reach/polymorphic@0.18.0(react@17.0.2)':
+    dependencies:
+      react: 17.0.2
+
+  '@reach/popover@0.16.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)':
+    dependencies:
+      '@reach/portal': 0.16.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      '@reach/rect': 0.16.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      '@reach/utils': 0.16.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      react: 17.0.2
+      react-dom: 17.0.2(react@17.0.2)
+      tabbable: 4.0.0
+      tslib: 2.8.1
+
+  '@reach/popover@0.18.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)':
+    dependencies:
+      '@reach/polymorphic': 0.18.0(react@17.0.2)
+      '@reach/portal': 0.18.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      '@reach/rect': 0.18.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      '@reach/utils': 0.18.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      react: 17.0.2
+      react-dom: 17.0.2(react@17.0.2)
+      tabbable: 5.3.3
+
+  '@reach/portal@0.16.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)':
+    dependencies:
+      '@reach/utils': 0.16.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      react: 17.0.2
+      react-dom: 17.0.2(react@17.0.2)
+      tslib: 2.8.1
+
+  '@reach/portal@0.17.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)':
+    dependencies:
+      '@reach/utils': 0.17.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      react: 17.0.2
+      react-dom: 17.0.2(react@17.0.2)
+      tiny-warning: 1.0.3
+      tslib: 2.8.1
+
+  '@reach/portal@0.18.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)':
+    dependencies:
+      '@reach/utils': 0.18.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      react: 17.0.2
+      react-dom: 17.0.2(react@17.0.2)
+
+  '@reach/rect@0.16.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)':
+    dependencies:
+      '@reach/observe-rect': 1.2.0
+      '@reach/utils': 0.16.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      prop-types: 15.8.1
+      react: 17.0.2
+      react-dom: 17.0.2(react@17.0.2)
+      tiny-warning: 1.0.3
+      tslib: 2.8.1
+
+  '@reach/rect@0.18.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)':
+    dependencies:
+      '@reach/observe-rect': 1.2.0
+      '@reach/utils': 0.18.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      react: 17.0.2
+      react-dom: 17.0.2(react@17.0.2)
+
+  '@reach/utils@0.16.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)':
+    dependencies:
+      react: 17.0.2
+      react-dom: 17.0.2(react@17.0.2)
+      tiny-warning: 1.0.3
+      tslib: 2.8.1
+
+  '@reach/utils@0.17.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)':
+    dependencies:
+      react: 17.0.2
+      react-dom: 17.0.2(react@17.0.2)
+      tiny-warning: 1.0.3
+      tslib: 2.8.1
+
+  '@reach/utils@0.18.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)':
+    dependencies:
+      react: 17.0.2
+      react-dom: 17.0.2(react@17.0.2)
+
+  '@rolldown/binding-android-arm64@1.0.3':
+    optional: true
+
+  '@rolldown/binding-darwin-arm64@1.0.3':
+    optional: true
+
+  '@rolldown/binding-darwin-x64@1.0.3':
+    optional: true
+
+  '@rolldown/binding-freebsd-x64@1.0.3':
+    optional: true
+
+  '@rolldown/binding-linux-arm-gnueabihf@1.0.3':
+    optional: true
+
+  '@rolldown/binding-linux-arm64-gnu@1.0.3':
+    optional: true
+
+  '@rolldown/binding-linux-arm64-musl@1.0.3':
+    optional: true
+
+  '@rolldown/binding-linux-ppc64-gnu@1.0.3':
+    optional: true
+
+  '@rolldown/binding-linux-s390x-gnu@1.0.3':
+    optional: true
+
+  '@rolldown/binding-linux-x64-gnu@1.0.3':
+    optional: true
+
+  '@rolldown/binding-linux-x64-musl@1.0.3':
+    optional: true
+
+  '@rolldown/binding-openharmony-arm64@1.0.3':
+    optional: true
+
+  '@rolldown/binding-wasm32-wasi@1.0.3':
+    dependencies:
+      '@emnapi/core': 1.10.0
+      '@emnapi/runtime': 1.10.0
+      '@napi-rs/wasm-runtime': 1.1.4(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)
+    optional: true
+
+  '@rolldown/binding-win32-arm64-msvc@1.0.3':
+    optional: true
+
+  '@rolldown/binding-win32-x64-msvc@1.0.3':
+    optional: true
+
+  '@rolldown/pluginutils@1.0.1': {}
+
+  '@rollup/pluginutils@5.3.0(rollup@4.54.0)':
+    dependencies:
+      '@types/estree': 1.0.8
+      estree-walker: 2.0.2
+      picomatch: 4.0.4
+    optionalDependencies:
+      rollup: 4.54.0
+
+  '@rollup/rollup-android-arm-eabi@4.54.0':
+    optional: true
+
+  '@rollup/rollup-android-arm64@4.54.0':
+    optional: true
+
+  '@rollup/rollup-darwin-arm64@4.54.0':
+    optional: true
+
+  '@rollup/rollup-darwin-x64@4.54.0':
+    optional: true
+
+  '@rollup/rollup-freebsd-arm64@4.54.0':
+    optional: true
+
+  '@rollup/rollup-freebsd-x64@4.54.0':
+    optional: true
+
+  '@rollup/rollup-linux-arm-gnueabihf@4.54.0':
+    optional: true
+
+  '@rollup/rollup-linux-arm-musleabihf@4.54.0':
+    optional: true
+
+  '@rollup/rollup-linux-arm64-gnu@4.54.0':
+    optional: true
+
+  '@rollup/rollup-linux-arm64-musl@4.54.0':
+    optional: true
+
+  '@rollup/rollup-linux-loong64-gnu@4.54.0':
+    optional: true
+
+  '@rollup/rollup-linux-ppc64-gnu@4.54.0':
+    optional: true
+
+  '@rollup/rollup-linux-riscv64-gnu@4.54.0':
+    optional: true
+
+  '@rollup/rollup-linux-riscv64-musl@4.54.0':
+    optional: true
+
+  '@rollup/rollup-linux-s390x-gnu@4.54.0':
+    optional: true
+
+  '@rollup/rollup-linux-x64-gnu@4.54.0':
+    optional: true
+
+  '@rollup/rollup-linux-x64-musl@4.54.0':
+    optional: true
+
+  '@rollup/rollup-openharmony-arm64@4.54.0':
+    optional: true
+
+  '@rollup/rollup-win32-arm64-msvc@4.54.0':
+    optional: true
+
+  '@rollup/rollup-win32-ia32-msvc@4.54.0':
+    optional: true
+
+  '@rollup/rollup-win32-x64-gnu@4.54.0':
+    optional: true
+
+  '@rollup/rollup-win32-x64-msvc@4.54.0':
+    optional: true
+
+  '@rtsao/scc@1.1.0': {}
+
+  '@sagold/json-pointer@5.1.2': {}
+
+  '@sagold/json-query@6.2.0':
+    dependencies:
+      '@sagold/json-pointer': 5.1.2
+      ebnf: 1.9.1
+
+  '@seznam/compose-react-refs@1.0.6': {}
+
+  '@shikijs/core@1.29.2':
+    dependencies:
+      '@shikijs/engine-javascript': 1.29.2
+      '@shikijs/engine-oniguruma': 1.29.2
+      '@shikijs/types': 1.29.2
+      '@shikijs/vscode-textmate': 10.0.2
+      '@types/hast': 3.0.4
+      hast-util-to-html: 9.0.5
+
+  '@shikijs/engine-javascript@1.29.2':
+    dependencies:
+      '@shikijs/types': 1.29.2
+      '@shikijs/vscode-textmate': 10.0.2
+      oniguruma-to-es: 2.3.0
+
+  '@shikijs/engine-oniguruma@1.29.2':
+    dependencies:
+      '@shikijs/types': 1.29.2
+      '@shikijs/vscode-textmate': 10.0.2
+
+  '@shikijs/langs@1.29.2':
+    dependencies:
+      '@shikijs/types': 1.29.2
+
+  '@shikijs/markdown-it@1.29.2':
+    dependencies:
+      markdown-it: 12.3.2
+      shiki: 1.29.2
+
+  '@shikijs/themes@1.29.2':
+    dependencies:
+      '@shikijs/types': 1.29.2
+
+  '@shikijs/types@1.29.2':
+    dependencies:
+      '@shikijs/vscode-textmate': 10.0.2
+      '@types/hast': 3.0.4
+
+  '@shikijs/vscode-textmate@10.0.2': {}
+
+  '@simbathesailor/use-what-changed@2.0.0(react@17.0.2)':
+    dependencies:
+      react: 17.0.2
+
+  '@standard-schema/spec@1.1.0': {}
+
+  '@storybook/addon-docs@10.4.2(@types/react-dom@17.0.25)(@types/react@17.0.75)(esbuild@0.27.3)(rollup@4.54.0)(storybook@10.4.2(@testing-library/dom@9.3.4)(@types/react@17.0.75)(prettier@3.8.3)(react-dom@17.0.2(react@17.0.2))(react@17.0.2))(vite@8.0.16(@types/node@25.0.3)(esbuild@0.27.3)(jiti@2.7.0)(less@4.4.2)(terser@5.44.1)(yaml@1.10.2))(webpack@5.107.2)':
+    dependencies:
+      '@mdx-js/react': 3.1.1(@types/react@17.0.75)(react@17.0.2)
+      '@storybook/csf-plugin': 10.4.2(esbuild@0.27.3)(rollup@4.54.0)(storybook@10.4.2(@testing-library/dom@9.3.4)(@types/react@17.0.75)(prettier@3.8.3)(react-dom@17.0.2(react@17.0.2))(react@17.0.2))(vite@8.0.16(@types/node@25.0.3)(esbuild@0.27.3)(jiti@2.7.0)(less@4.4.2)(terser@5.44.1)(yaml@1.10.2))(webpack@5.107.2)
+      '@storybook/icons': 2.0.2(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      '@storybook/react-dom-shim': 10.4.2(@types/react-dom@17.0.25)(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)(storybook@10.4.2(@testing-library/dom@9.3.4)(@types/react@17.0.75)(prettier@3.8.3)(react-dom@17.0.2(react@17.0.2))(react@17.0.2))
+      react: 17.0.2
+      react-dom: 17.0.2(react@17.0.2)
+      storybook: 10.4.2(@testing-library/dom@9.3.4)(@types/react@17.0.75)(prettier@3.8.3)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      ts-dedent: 2.2.0
+    optionalDependencies:
+      '@types/react': 17.0.75
+    transitivePeerDependencies:
+      - '@types/react-dom'
+      - esbuild
+      - rollup
+      - vite
+      - webpack
+
+  '@storybook/addon-links@10.4.2(@types/react@17.0.75)(react@17.0.2)(storybook@10.4.2(@testing-library/dom@9.3.4)(@types/react@17.0.75)(prettier@3.8.3)(react-dom@17.0.2(react@17.0.2))(react@17.0.2))':
+    dependencies:
+      '@storybook/global': 5.0.0
+      storybook: 10.4.2(@testing-library/dom@9.3.4)(@types/react@17.0.75)(prettier@3.8.3)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+    optionalDependencies:
+      '@types/react': 17.0.75
+      react: 17.0.2
+
+  '@storybook/addon-styling-webpack@3.0.2(storybook@10.4.2(@testing-library/dom@9.3.4)(@types/react@17.0.75)(prettier@3.8.3)(react-dom@17.0.2(react@17.0.2))(react@17.0.2))(webpack@5.107.2)':
+    dependencies:
+      storybook: 10.4.2(@testing-library/dom@9.3.4)(@types/react@17.0.75)(prettier@3.8.3)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      webpack: 5.107.2(@swc/core@1.15.11)(cssnano@8.0.1(postcss@8.5.15))(esbuild@0.27.3)(postcss@8.5.15)(webpack-cli@6.0.1)
+
+  '@storybook/addon-webpack5-compiler-swc@4.0.3(storybook@10.4.2(@testing-library/dom@9.3.4)(@types/react@17.0.75)(prettier@3.8.3)(react-dom@17.0.2(react@17.0.2))(react@17.0.2))(webpack@5.107.2)':
+    dependencies:
+      '@swc/core': 1.15.11
+      storybook: 10.4.2(@testing-library/dom@9.3.4)(@types/react@17.0.75)(prettier@3.8.3)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      swc-loader: 0.2.7(@swc/core@1.15.11)(webpack@5.107.2)
+    transitivePeerDependencies:
+      - '@swc/helpers'
+      - webpack
+
+  '@storybook/builder-webpack5@10.4.2(@swc/core@1.15.11)(cssnano@8.0.1(postcss@8.5.15))(esbuild@0.27.3)(postcss@8.5.15)(storybook@10.4.2(@testing-library/dom@9.3.4)(@types/react@17.0.75)(prettier@3.8.3)(react-dom@17.0.2(react@17.0.2))(react@17.0.2))(typescript@6.0.2)(webpack-cli@6.0.1)':
+    dependencies:
+      '@storybook/core-webpack': 10.4.2(storybook@10.4.2(@testing-library/dom@9.3.4)(@types/react@17.0.75)(prettier@3.8.3)(react-dom@17.0.2(react@17.0.2))(react@17.0.2))
+      case-sensitive-paths-webpack-plugin: 2.4.0
+      cjs-module-lexer: 1.4.3
+      css-loader: 7.1.4(webpack@5.107.2)
+      es-module-lexer: 1.7.0
+      fork-ts-checker-webpack-plugin: 9.1.0(typescript@6.0.2)(webpack@5.107.2)
+      html-webpack-plugin: 5.5.3(webpack@5.107.2)
+      magic-string: 0.30.21
+      storybook: 10.4.2(@testing-library/dom@9.3.4)(@types/react@17.0.75)(prettier@3.8.3)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      style-loader: 4.0.0(webpack@5.107.2)
+      terser-webpack-plugin: 5.6.1(@swc/core@1.15.11)(cssnano@8.0.1(postcss@8.5.15))(esbuild@0.27.3)(postcss@8.5.15)(webpack@5.107.2)
+      ts-dedent: 2.2.0
+      webpack: 5.107.2(@swc/core@1.15.11)(cssnano@8.0.1(postcss@8.5.15))(esbuild@0.27.3)(postcss@8.5.15)(webpack-cli@6.0.1)
+      webpack-dev-middleware: 6.1.3(webpack@5.107.2)
+      webpack-hot-middleware: 2.25.3
+      webpack-virtual-modules: 0.6.2
+    optionalDependencies:
+      typescript: 6.0.2
+    transitivePeerDependencies:
+      - '@minify-html/node'
+      - '@rspack/core'
+      - '@swc/core'
+      - '@swc/css'
+      - '@swc/html'
+      - clean-css
+      - cssnano
+      - csso
+      - esbuild
+      - html-minifier-terser
+      - lightningcss
+      - postcss
+      - uglify-js
+      - webpack-cli
+
+  '@storybook/core-webpack@10.4.2(storybook@10.4.2(@testing-library/dom@9.3.4)(@types/react@17.0.75)(prettier@3.8.3)(react-dom@17.0.2(react@17.0.2))(react@17.0.2))':
+    dependencies:
+      storybook: 10.4.2(@testing-library/dom@9.3.4)(@types/react@17.0.75)(prettier@3.8.3)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      ts-dedent: 2.2.0
+
+  '@storybook/csf-plugin@10.4.2(esbuild@0.27.3)(rollup@4.54.0)(storybook@10.4.2(@testing-library/dom@9.3.4)(@types/react@17.0.75)(prettier@3.8.3)(react-dom@17.0.2(react@17.0.2))(react@17.0.2))(vite@8.0.16(@types/node@25.0.3)(esbuild@0.27.3)(jiti@2.7.0)(less@4.4.2)(terser@5.44.1)(yaml@1.10.2))(webpack@5.107.2)':
+    dependencies:
+      storybook: 10.4.2(@testing-library/dom@9.3.4)(@types/react@17.0.75)(prettier@3.8.3)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      unplugin: 2.3.11
+    optionalDependencies:
+      esbuild: 0.27.3
+      rollup: 4.54.0
+      vite: 8.0.16(@types/node@25.0.3)(esbuild@0.27.3)(jiti@2.7.0)(less@4.4.2)(terser@5.44.1)(yaml@1.10.2)
+      webpack: 5.107.2(@swc/core@1.15.11)(cssnano@8.0.1(postcss@8.5.15))(esbuild@0.27.3)(postcss@8.5.15)(webpack-cli@6.0.1)
+
+  '@storybook/global@5.0.0': {}
+
+  '@storybook/icons@2.0.2(react-dom@17.0.2(react@17.0.2))(react@17.0.2)':
+    dependencies:
+      react: 17.0.2
+      react-dom: 17.0.2(react@17.0.2)
+
+  '@storybook/preset-react-webpack@10.4.2(@swc/core@1.15.11)(cssnano@8.0.1(postcss@8.5.15))(esbuild@0.27.3)(postcss@8.5.15)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)(storybook@10.4.2(@testing-library/dom@9.3.4)(@types/react@17.0.75)(prettier@3.8.3)(react-dom@17.0.2(react@17.0.2))(react@17.0.2))(typescript@6.0.2)(webpack-cli@6.0.1)':
+    dependencies:
+      '@storybook/core-webpack': 10.4.2(storybook@10.4.2(@testing-library/dom@9.3.4)(@types/react@17.0.75)(prettier@3.8.3)(react-dom@17.0.2(react@17.0.2))(react@17.0.2))
+      '@storybook/react-docgen-typescript-plugin': 1.0.6--canary.9.0c3f3b7.0(typescript@6.0.2)(webpack@5.107.2)
+      '@types/semver': 7.7.1
+      magic-string: 0.30.21
+      react: 17.0.2
+      react-docgen: 7.1.1
+      react-dom: 17.0.2(react@17.0.2)
+      resolve: 1.22.11
+      semver: 7.7.4
+      storybook: 10.4.2(@testing-library/dom@9.3.4)(@types/react@17.0.75)(prettier@3.8.3)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      tsconfig-paths: 4.2.0
+      webpack: 5.107.2(@swc/core@1.15.11)(cssnano@8.0.1(postcss@8.5.15))(esbuild@0.27.3)(postcss@8.5.15)(webpack-cli@6.0.1)
+    optionalDependencies:
+      typescript: 6.0.2
+    transitivePeerDependencies:
+      - '@minify-html/node'
+      - '@swc/core'
+      - '@swc/css'
+      - '@swc/html'
+      - clean-css
+      - cssnano
+      - csso
+      - esbuild
+      - html-minifier-terser
+      - lightningcss
+      - postcss
+      - supports-color
+      - uglify-js
+      - webpack-cli
+
+  '@storybook/react-docgen-typescript-plugin@1.0.6--canary.9.0c3f3b7.0(typescript@6.0.2)(webpack@5.107.2)':
+    dependencies:
+      debug: 4.4.3
+      endent: 2.1.0
+      find-cache-dir: 3.3.2
+      flat-cache: 3.0.4
+      micromatch: 4.0.8
+      react-docgen-typescript: 2.2.2(typescript@6.0.2)
+      tslib: 2.8.1
+      typescript: 6.0.2
+      webpack: 5.107.2(@swc/core@1.15.11)(cssnano@8.0.1(postcss@8.5.15))(esbuild@0.27.3)(postcss@8.5.15)(webpack-cli@6.0.1)
+    transitivePeerDependencies:
+      - supports-color
+
+  '@storybook/react-dom-shim@10.4.2(@types/react-dom@17.0.25)(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)(storybook@10.4.2(@testing-library/dom@9.3.4)(@types/react@17.0.75)(prettier@3.8.3)(react-dom@17.0.2(react@17.0.2))(react@17.0.2))':
+    dependencies:
+      react: 17.0.2
+      react-dom: 17.0.2(react@17.0.2)
+      storybook: 10.4.2(@testing-library/dom@9.3.4)(@types/react@17.0.75)(prettier@3.8.3)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+    optionalDependencies:
+      '@types/react': 17.0.75
+      '@types/react-dom': 17.0.25
+
+  '@storybook/react-webpack5@10.4.2(@swc/core@1.15.11)(@types/react-dom@17.0.25)(@types/react@17.0.75)(cssnano@8.0.1(postcss@8.5.15))(esbuild@0.27.3)(postcss@8.5.15)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)(storybook@10.4.2(@testing-library/dom@9.3.4)(@types/react@17.0.75)(prettier@3.8.3)(react-dom@17.0.2(react@17.0.2))(react@17.0.2))(typescript@6.0.2)(webpack-cli@6.0.1)':
+    dependencies:
+      '@storybook/builder-webpack5': 10.4.2(@swc/core@1.15.11)(cssnano@8.0.1(postcss@8.5.15))(esbuild@0.27.3)(postcss@8.5.15)(storybook@10.4.2(@testing-library/dom@9.3.4)(@types/react@17.0.75)(prettier@3.8.3)(react-dom@17.0.2(react@17.0.2))(react@17.0.2))(typescript@6.0.2)(webpack-cli@6.0.1)
+      '@storybook/preset-react-webpack': 10.4.2(@swc/core@1.15.11)(cssnano@8.0.1(postcss@8.5.15))(esbuild@0.27.3)(postcss@8.5.15)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)(storybook@10.4.2(@testing-library/dom@9.3.4)(@types/react@17.0.75)(prettier@3.8.3)(react-dom@17.0.2(react@17.0.2))(react@17.0.2))(typescript@6.0.2)(webpack-cli@6.0.1)
+      '@storybook/react': 10.4.2(@types/react-dom@17.0.25)(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)(storybook@10.4.2(@testing-library/dom@9.3.4)(@types/react@17.0.75)(prettier@3.8.3)(react-dom@17.0.2(react@17.0.2))(react@17.0.2))(typescript@6.0.2)
+      react: 17.0.2
+      react-dom: 17.0.2(react@17.0.2)
+      storybook: 10.4.2(@testing-library/dom@9.3.4)(@types/react@17.0.75)(prettier@3.8.3)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+    optionalDependencies:
+      typescript: 6.0.2
+    transitivePeerDependencies:
+      - '@minify-html/node'
+      - '@rspack/core'
+      - '@swc/core'
+      - '@swc/css'
+      - '@swc/html'
+      - '@types/react'
+      - '@types/react-dom'
+      - clean-css
+      - cssnano
+      - csso
+      - esbuild
+      - html-minifier-terser
+      - lightningcss
+      - postcss
+      - supports-color
+      - uglify-js
+      - webpack-cli
+
+  '@storybook/react@10.4.2(@types/react-dom@17.0.25)(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)(storybook@10.4.2(@testing-library/dom@9.3.4)(@types/react@17.0.75)(prettier@3.8.3)(react-dom@17.0.2(react@17.0.2))(react@17.0.2))(typescript@6.0.2)':
+    dependencies:
+      '@storybook/global': 5.0.0
+      '@storybook/react-dom-shim': 10.4.2(@types/react-dom@17.0.25)(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)(storybook@10.4.2(@testing-library/dom@9.3.4)(@types/react@17.0.75)(prettier@3.8.3)(react-dom@17.0.2(react@17.0.2))(react@17.0.2))
+      react: 17.0.2
+      react-docgen: 8.0.3
+      react-docgen-typescript: 2.2.2(typescript@6.0.2)
+      react-dom: 17.0.2(react@17.0.2)
+      storybook: 10.4.2(@testing-library/dom@9.3.4)(@types/react@17.0.75)(prettier@3.8.3)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+    optionalDependencies:
+      '@types/react': 17.0.75
+      '@types/react-dom': 17.0.25
+      typescript: 6.0.2
+    transitivePeerDependencies:
+      - supports-color
+
+  '@svgr/babel-plugin-add-jsx-attribute@8.0.0(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+
+  '@svgr/babel-plugin-remove-jsx-attribute@8.0.0(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+
+  '@svgr/babel-plugin-remove-jsx-empty-expression@8.0.0(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+
+  '@svgr/babel-plugin-replace-jsx-attribute-value@8.0.0(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+
+  '@svgr/babel-plugin-svg-dynamic-title@8.0.0(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+
+  '@svgr/babel-plugin-svg-em-dimensions@8.0.0(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+
+  '@svgr/babel-plugin-transform-react-native-svg@8.1.0(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+
+  '@svgr/babel-plugin-transform-svg-component@8.0.0(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+
+  '@svgr/babel-preset@8.1.0(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@svgr/babel-plugin-add-jsx-attribute': 8.0.0(@babel/core@7.29.0)
+      '@svgr/babel-plugin-remove-jsx-attribute': 8.0.0(@babel/core@7.29.0)
+      '@svgr/babel-plugin-remove-jsx-empty-expression': 8.0.0(@babel/core@7.29.0)
+      '@svgr/babel-plugin-replace-jsx-attribute-value': 8.0.0(@babel/core@7.29.0)
+      '@svgr/babel-plugin-svg-dynamic-title': 8.0.0(@babel/core@7.29.0)
+      '@svgr/babel-plugin-svg-em-dimensions': 8.0.0(@babel/core@7.29.0)
+      '@svgr/babel-plugin-transform-react-native-svg': 8.1.0(@babel/core@7.29.0)
+      '@svgr/babel-plugin-transform-svg-component': 8.0.0(@babel/core@7.29.0)
+
+  '@svgr/core@8.1.0':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@svgr/babel-preset': 8.1.0(@babel/core@7.29.0)
+      camelcase: 6.3.0
+      cosmiconfig: 8.2.0
+      snake-case: 3.0.4
+    transitivePeerDependencies:
+      - supports-color
+
+  '@svgr/hast-util-to-babel-ast@8.0.0':
+    dependencies:
+      '@babel/types': 7.29.0
+      entities: 4.5.0
+
+  '@svgr/plugin-jsx@8.1.0(@svgr/core@8.1.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@svgr/babel-preset': 8.1.0(@babel/core@7.29.0)
+      '@svgr/core': 8.1.0
+      '@svgr/hast-util-to-babel-ast': 8.0.0
+      svg-parser: 2.0.4
+    transitivePeerDependencies:
+      - supports-color
+
+  '@svgr/plugin-svgo@8.1.0(@svgr/core@8.1.0)':
+    dependencies:
+      '@svgr/core': 8.1.0
+      cosmiconfig: 8.2.0
+      deepmerge: 4.3.1
+      svgo: 3.0.2
+
+  '@svgr/webpack@8.1.0':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/plugin-transform-react-constant-elements': 7.22.3(@babel/core@7.29.0)
+      '@babel/preset-env': 7.23.6(@babel/core@7.29.0)
+      '@babel/preset-react': 7.22.15(@babel/core@7.29.0)
+      '@babel/preset-typescript': 7.23.0(@babel/core@7.29.0)
+      '@svgr/core': 8.1.0
+      '@svgr/plugin-jsx': 8.1.0(@svgr/core@8.1.0)
+      '@svgr/plugin-svgo': 8.1.0(@svgr/core@8.1.0)
+    transitivePeerDependencies:
+      - supports-color
+
+  '@swc/core-darwin-arm64@1.15.11':
+    optional: true
+
+  '@swc/core-darwin-x64@1.15.11':
+    optional: true
+
+  '@swc/core-linux-arm-gnueabihf@1.15.11':
+    optional: true
+
+  '@swc/core-linux-arm64-gnu@1.15.11':
+    optional: true
+
+  '@swc/core-linux-arm64-musl@1.15.11':
+    optional: true
+
+  '@swc/core-linux-x64-gnu@1.15.11':
+    optional: true
+
+  '@swc/core-linux-x64-musl@1.15.11':
+    optional: true
+
+  '@swc/core-win32-arm64-msvc@1.15.11':
+    optional: true
+
+  '@swc/core-win32-ia32-msvc@1.15.11':
+    optional: true
+
+  '@swc/core-win32-x64-msvc@1.15.11':
+    optional: true
+
+  '@swc/core@1.15.11':
+    dependencies:
+      '@swc/counter': 0.1.3
+      '@swc/types': 0.1.25
+    optionalDependencies:
+      '@swc/core-darwin-arm64': 1.15.11
+      '@swc/core-darwin-x64': 1.15.11
+      '@swc/core-linux-arm-gnueabihf': 1.15.11
+      '@swc/core-linux-arm64-gnu': 1.15.11
+      '@swc/core-linux-arm64-musl': 1.15.11
+      '@swc/core-linux-x64-gnu': 1.15.11
+      '@swc/core-linux-x64-musl': 1.15.11
+      '@swc/core-win32-arm64-msvc': 1.15.11
+      '@swc/core-win32-ia32-msvc': 1.15.11
+      '@swc/core-win32-x64-msvc': 1.15.11
+
+  '@swc/counter@0.1.3': {}
+
+  '@swc/types@0.1.25':
+    dependencies:
+      '@swc/counter': 0.1.3
+
+  '@tanstack/match-sorter-utils@8.8.4':
+    dependencies:
+      remove-accents: 0.4.2
+
+  '@tanstack/query-core@4.36.1': {}
+
+  '@tanstack/react-query-devtools@4.36.1(@tanstack/react-query@4.36.1(react-dom@17.0.2(react@17.0.2))(react@17.0.2))(react-dom@17.0.2(react@17.0.2))(react@17.0.2)':
+    dependencies:
+      '@tanstack/match-sorter-utils': 8.8.4
+      '@tanstack/react-query': 4.36.1(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      react: 17.0.2
+      react-dom: 17.0.2(react@17.0.2)
+      superjson: 1.13.3
+      use-sync-external-store: 1.6.0(react@17.0.2)
+
+  '@tanstack/react-query@4.36.1(react-dom@17.0.2(react@17.0.2))(react@17.0.2)':
+    dependencies:
+      '@tanstack/query-core': 4.36.1
+      react: 17.0.2
+      use-sync-external-store: 1.6.0(react@17.0.2)
+    optionalDependencies:
+      react-dom: 17.0.2(react@17.0.2)
+
+  '@tanstack/react-table@8.9.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)':
+    dependencies:
+      '@tanstack/table-core': 8.9.0
+      react: 17.0.2
+      react-dom: 17.0.2(react@17.0.2)
+
+  '@tanstack/table-core@8.9.0': {}
+
+  '@testing-library/dom@8.11.1':
+    dependencies:
+      '@babel/code-frame': 7.29.0
+      '@babel/runtime': 7.26.0
+      '@types/aria-query': 4.2.2
+      aria-query: 5.3.2
+      chalk: 4.1.2
+      dom-accessibility-api: 0.5.10
+      lz-string: 1.5.0
+      pretty-format: 27.4.2
+
+  '@testing-library/dom@9.3.4':
+    dependencies:
+      '@babel/code-frame': 7.29.0
+      '@babel/runtime': 7.26.0
+      '@types/aria-query': 5.0.4
+      aria-query: 5.1.3
+      chalk: 4.1.2
+      dom-accessibility-api: 0.5.10
+      lz-string: 1.5.0
+      pretty-format: 27.4.2
+
+  '@testing-library/jest-dom@6.9.1':
+    dependencies:
+      '@adobe/css-tools': 4.4.4
+      aria-query: 5.3.2
+      css.escape: 1.5.1
+      dom-accessibility-api: 0.6.3
+      picocolors: 1.1.1
+      redent: 3.0.0
+
+  '@testing-library/react-hooks@8.0.1(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)':
+    dependencies:
+      '@babel/runtime': 7.26.0
+      react: 17.0.2
+      react-error-boundary: 3.1.4(react@17.0.2)
+    optionalDependencies:
+      '@types/react': 17.0.75
+      react-dom: 17.0.2(react@17.0.2)
+
+  '@testing-library/react@12.1.5(react-dom@17.0.2(react@17.0.2))(react@17.0.2)':
+    dependencies:
+      '@babel/runtime': 7.26.0
+      '@testing-library/dom': 8.11.1
+      '@types/react-dom': 17.0.25
+      react: 17.0.2
+      react-dom: 17.0.2(react@17.0.2)
+
+  '@testing-library/user-event@14.6.1(@testing-library/dom@9.3.4)':
+    dependencies:
+      '@testing-library/dom': 9.3.4
+
+  '@tippyjs/react@4.2.6(react-dom@17.0.2(react@17.0.2))(react@17.0.2)':
+    dependencies:
+      react: 17.0.2
+      react-dom: 17.0.2(react@17.0.2)
+      tippy.js: 6.3.7
+
+  '@trysound/sax@0.2.0': {}
+
+  '@tybys/wasm-util@0.10.1':
+    dependencies:
+      tslib: 2.8.1
+    optional: true
+
+  '@types/angular@1.8.9': {}
+
+  '@types/aria-query@4.2.2': {}
+
+  '@types/aria-query@5.0.4': {}
+
+  '@types/babel__core@7.20.5':
+    dependencies:
+      '@babel/parser': 7.29.0
+      '@babel/types': 7.29.0
+      '@types/babel__generator': 7.6.3
+      '@types/babel__template': 7.4.1
+      '@types/babel__traverse': 7.28.0
+
+  '@types/babel__generator@7.6.3':
+    dependencies:
+      '@babel/types': 7.29.0
+
+  '@types/babel__template@7.4.1':
+    dependencies:
+      '@babel/parser': 7.29.0
+      '@babel/types': 7.29.0
+
+  '@types/babel__traverse@7.28.0':
+    dependencies:
+      '@babel/types': 7.29.0
+
+  '@types/body-parser@1.19.6':
+    dependencies:
+      '@types/connect': 3.4.35
+      '@types/node': 25.0.3
+
+  '@types/bonjour@3.5.13':
+    dependencies:
+      '@types/node': 25.0.3
+
+  '@types/chai@5.2.3':
+    dependencies:
+      '@types/deep-eql': 4.0.2
+      assertion-error: 2.0.1
+
+  '@types/connect-history-api-fallback@1.5.4':
+    dependencies:
+      '@types/express-serve-static-core': 4.17.34
+      '@types/node': 25.0.3
+
+  '@types/connect@3.4.35':
+    dependencies:
+      '@types/node': 25.0.3
+
+  '@types/deep-eql@4.0.2': {}
+
+  '@types/doctrine@0.0.9': {}
+
+  '@types/estree@1.0.8': {}
+
+  '@types/express-serve-static-core@4.17.34':
+    dependencies:
+      '@types/node': 25.0.3
+      '@types/qs': 6.14.0
+      '@types/range-parser': 1.2.4
+      '@types/send': 1.2.1
+
+  '@types/express@4.17.25':
+    dependencies:
+      '@types/body-parser': 1.19.6
+      '@types/express-serve-static-core': 4.17.34
+      '@types/qs': 6.14.0
+      '@types/serve-static': 1.15.10
+
+  '@types/file-saver@2.0.7': {}
+
+  '@types/filesize-parser@1.5.3': {}
+
+  '@types/filesize@5.0.2':
+    dependencies:
+      filesize: 10.1.6
+
+  '@types/glob@7.2.0':
+    dependencies:
+      '@types/minimatch': 3.0.5
+      '@types/node': 25.0.3
+
+  '@types/hast@3.0.4':
+    dependencies:
+      '@types/unist': 3.0.3
+
+  '@types/hoist-non-react-statics@3.3.7(@types/react@17.0.75)':
+    dependencies:
+      '@types/react': 17.0.75
+      hoist-non-react-statics: 3.3.2
+
+  '@types/html-minifier-terser@6.1.0': {}
+
+  '@types/http-errors@2.0.5': {}
+
+  '@types/http-proxy@1.17.11':
+    dependencies:
+      '@types/node': 25.0.3
+
+  '@types/istanbul-lib-coverage@2.0.4': {}
+
+  '@types/istanbul-lib-report@3.0.0':
+    dependencies:
+      '@types/istanbul-lib-coverage': 2.0.4
+
+  '@types/istanbul-reports@3.0.1':
+    dependencies:
+      '@types/istanbul-lib-report': 3.0.0
+
+  '@types/jquery@3.5.33':
+    dependencies:
+      '@types/sizzle': 2.3.10
+
+  '@types/json-schema@7.0.15': {}
+
+  '@types/json5@0.0.29': {}
+
+  '@types/lodash.memoize@4.1.9':
+    dependencies:
+      '@types/lodash': 4.17.24
+
+  '@types/lodash@4.17.24': {}
+
+  '@types/mdast@4.0.4':
+    dependencies:
+      '@types/unist': 3.0.3
+
+  '@types/mdx@2.0.5': {}
+
+  '@types/mime@1.3.2': {}
+
+  '@types/minimatch@3.0.5': {}
+
+  '@types/mustache@4.2.6': {}
+
+  '@types/node@25.0.3':
+    dependencies:
+      undici-types: 7.16.0
+
+  '@types/nprogress@0.2.3': {}
+
+  '@types/parse-json@4.0.2': {}
+
+  '@types/prop-types@15.7.4': {}
+
+  '@types/qs@6.14.0': {}
+
+  '@types/range-parser@1.2.4': {}
+
+  '@types/react-datetime-picker@3.4.1':
+    dependencies:
+      '@types/react': 17.0.75
+
+  '@types/react-dom@17.0.25':
+    dependencies:
+      '@types/react': 17.0.75
+
+  '@types/react-is@17.0.7':
+    dependencies:
+      '@types/react': 17.0.75
+
+  '@types/react-transition-group@4.4.4':
+    dependencies:
+      '@types/react': 17.0.75
+
+  '@types/react@17.0.75':
+    dependencies:
+      '@types/prop-types': 15.7.4
+      '@types/scheduler': 0.16.2
+      csstype: 3.0.10
+
+  '@types/resolve@1.20.6': {}
+
+  '@types/retry@0.12.2': {}
+
+  '@types/sanitize-html@2.16.0':
+    dependencies:
+      htmlparser2: 8.0.2
+
+  '@types/scheduler@0.16.2': {}
+
+  '@types/semver@7.7.1': {}
+
+  '@types/send@0.17.6':
+    dependencies:
+      '@types/mime': 1.3.2
+      '@types/node': 25.0.3
+
+  '@types/send@1.2.1':
+    dependencies:
+      '@types/node': 25.0.3
+
+  '@types/serve-index@1.9.4':
+    dependencies:
+      '@types/express': 4.17.25
+
+  '@types/serve-static@1.15.10':
+    dependencies:
+      '@types/http-errors': 2.0.5
+      '@types/node': 25.0.3
+      '@types/send': 0.17.6
+
+  '@types/set-cookie-parser@2.4.10':
+    dependencies:
+      '@types/node': 25.0.3
+
+  '@types/sizzle@2.3.10': {}
+
+  '@types/sockjs@0.3.36':
+    dependencies:
+      '@types/node': 25.0.3
+
+  '@types/statuses@2.0.6': {}
+
+  '@types/toastr@2.1.43':
+    dependencies:
+      '@types/jquery': 3.5.33
+
+  '@types/unist@3.0.3': {}
+
+  '@types/uuid@3.4.13': {}
+
+  '@types/ws@8.18.1':
+    dependencies:
+      '@types/node': 25.0.3
+
+  '@types/yargs-parser@21.0.0': {}
+
+  '@types/yargs@16.0.4':
+    dependencies:
+      '@types/yargs-parser': 21.0.0
+
+  '@typescript-eslint/eslint-plugin@8.61.1(@typescript-eslint/parser@8.61.1(eslint@9.39.4(jiti@2.7.0))(typescript@6.0.2))(eslint@9.39.4(jiti@2.7.0))(typescript@6.0.2)':
+    dependencies:
+      '@eslint-community/regexpp': 4.12.2
+      '@typescript-eslint/parser': 8.61.1(eslint@9.39.4(jiti@2.7.0))(typescript@6.0.2)
+      '@typescript-eslint/scope-manager': 8.61.1
+      '@typescript-eslint/type-utils': 8.61.1(eslint@9.39.4(jiti@2.7.0))(typescript@6.0.2)
+      '@typescript-eslint/utils': 8.61.1(eslint@9.39.4(jiti@2.7.0))(typescript@6.0.2)
+      '@typescript-eslint/visitor-keys': 8.61.1
+      eslint: 9.39.4(jiti@2.7.0)
+      ignore: 7.0.5
+      natural-compare: 1.4.0
+      ts-api-utils: 2.5.0(typescript@6.0.2)
+      typescript: 6.0.2
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/parser@8.61.1(eslint@9.39.4(jiti@2.7.0))(typescript@6.0.2)':
+    dependencies:
+      '@typescript-eslint/scope-manager': 8.61.1
+      '@typescript-eslint/types': 8.61.1
+      '@typescript-eslint/typescript-estree': 8.61.1(typescript@6.0.2)
+      '@typescript-eslint/visitor-keys': 8.61.1
+      debug: 4.4.3
+      eslint: 9.39.4(jiti@2.7.0)
+      typescript: 6.0.2
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/project-service@8.60.1(typescript@6.0.2)':
+    dependencies:
+      '@typescript-eslint/tsconfig-utils': 8.60.1(typescript@6.0.2)
+      '@typescript-eslint/types': 8.60.1
+      debug: 4.4.3
+      typescript: 6.0.2
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/project-service@8.61.1(typescript@6.0.2)':
+    dependencies:
+      '@typescript-eslint/tsconfig-utils': 8.61.1(typescript@6.0.2)
+      '@typescript-eslint/types': 8.61.1
+      debug: 4.4.3
+      typescript: 6.0.2
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/scope-manager@8.60.1':
+    dependencies:
+      '@typescript-eslint/types': 8.60.1
+      '@typescript-eslint/visitor-keys': 8.60.1
+
+  '@typescript-eslint/scope-manager@8.61.1':
+    dependencies:
+      '@typescript-eslint/types': 8.61.1
+      '@typescript-eslint/visitor-keys': 8.61.1
+
+  '@typescript-eslint/tsconfig-utils@8.60.1(typescript@6.0.2)':
+    dependencies:
+      typescript: 6.0.2
+
+  '@typescript-eslint/tsconfig-utils@8.61.1(typescript@6.0.2)':
+    dependencies:
+      typescript: 6.0.2
+
+  '@typescript-eslint/type-utils@8.61.1(eslint@9.39.4(jiti@2.7.0))(typescript@6.0.2)':
+    dependencies:
+      '@typescript-eslint/types': 8.61.1
+      '@typescript-eslint/typescript-estree': 8.61.1(typescript@6.0.2)
+      '@typescript-eslint/utils': 8.61.1(eslint@9.39.4(jiti@2.7.0))(typescript@6.0.2)
+      debug: 4.4.3
+      eslint: 9.39.4(jiti@2.7.0)
+      ts-api-utils: 2.5.0(typescript@6.0.2)
+      typescript: 6.0.2
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/types@8.60.1': {}
+
+  '@typescript-eslint/types@8.61.1': {}
+
+  '@typescript-eslint/typescript-estree@8.60.1(typescript@6.0.2)':
+    dependencies:
+      '@typescript-eslint/project-service': 8.60.1(typescript@6.0.2)
+      '@typescript-eslint/tsconfig-utils': 8.60.1(typescript@6.0.2)
+      '@typescript-eslint/types': 8.60.1
+      '@typescript-eslint/visitor-keys': 8.60.1
+      debug: 4.4.3
+      minimatch: 10.2.5
+      semver: 7.7.4
+      tinyglobby: 0.2.17
+      ts-api-utils: 2.5.0(typescript@6.0.2)
+      typescript: 6.0.2
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/typescript-estree@8.61.1(typescript@6.0.2)':
+    dependencies:
+      '@typescript-eslint/project-service': 8.61.1(typescript@6.0.2)
+      '@typescript-eslint/tsconfig-utils': 8.61.1(typescript@6.0.2)
+      '@typescript-eslint/types': 8.61.1
+      '@typescript-eslint/visitor-keys': 8.61.1
+      debug: 4.4.3
+      minimatch: 10.2.5
+      semver: 7.7.4
+      tinyglobby: 0.2.17
+      ts-api-utils: 2.5.0(typescript@6.0.2)
+      typescript: 6.0.2
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/utils@8.60.1(eslint@9.39.4(jiti@2.7.0))(typescript@6.0.2)':
+    dependencies:
+      '@eslint-community/eslint-utils': 4.9.1(eslint@9.39.4(jiti@2.7.0))
+      '@typescript-eslint/scope-manager': 8.60.1
+      '@typescript-eslint/types': 8.60.1
+      '@typescript-eslint/typescript-estree': 8.60.1(typescript@6.0.2)
+      eslint: 9.39.4(jiti@2.7.0)
+      typescript: 6.0.2
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/utils@8.61.1(eslint@9.39.4(jiti@2.7.0))(typescript@6.0.2)':
+    dependencies:
+      '@eslint-community/eslint-utils': 4.9.1(eslint@9.39.4(jiti@2.7.0))
+      '@typescript-eslint/scope-manager': 8.61.1
+      '@typescript-eslint/types': 8.61.1
+      '@typescript-eslint/typescript-estree': 8.61.1(typescript@6.0.2)
+      eslint: 9.39.4(jiti@2.7.0)
+      typescript: 6.0.2
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/visitor-keys@8.60.1':
+    dependencies:
+      '@typescript-eslint/types': 8.60.1
+      eslint-visitor-keys: 5.0.1
+
+  '@typescript-eslint/visitor-keys@8.61.1':
+    dependencies:
+      '@typescript-eslint/types': 8.61.1
+      eslint-visitor-keys: 5.0.1
+
+  '@uirouter/angularjs@1.0.11(angular@1.8.2)':
+    dependencies:
+      '@uirouter/core': 5.0.11
+      angular: 1.8.2
+
+  '@uirouter/core@5.0.11': {}
+
+  '@uirouter/core@6.0.7': {}
+
+  '@uirouter/react-hybrid@1.0.4(angular@1.8.2)(react@17.0.2)':
+    dependencies:
+      '@uirouter/angularjs': 1.0.11(angular@1.8.2)
+      '@uirouter/core': 6.0.7
+      '@uirouter/react': 1.0.7(react@17.0.2)
+      angular: 1.8.2
+      react: 17.0.2
+
+  '@uirouter/react@1.0.7(react@17.0.2)':
+    dependencies:
+      '@uirouter/core': 6.0.7
+      classnames: 2.3.1
+      prop-types: 15.8.1
+      react: 17.0.2
+
+  '@uiw/codemirror-extensions-basic-setup@4.23.11(@codemirror/autocomplete@6.20.2)(@codemirror/commands@6.10.3)(@codemirror/language@6.12.3)(@codemirror/lint@6.9.6)(@codemirror/search@6.7.0)(@codemirror/state@6.6.0)(@codemirror/view@6.43.0)':
+    dependencies:
+      '@codemirror/autocomplete': 6.20.2
+      '@codemirror/commands': 6.10.3
+      '@codemirror/language': 6.12.3
+      '@codemirror/lint': 6.9.6
+      '@codemirror/search': 6.7.0
+      '@codemirror/state': 6.6.0
+      '@codemirror/view': 6.43.0
+
+  '@uiw/codemirror-extensions-basic-setup@4.25.10(@codemirror/autocomplete@6.20.2)(@codemirror/commands@6.10.3)(@codemirror/language@6.12.3)(@codemirror/lint@6.9.6)(@codemirror/search@6.7.0)(@codemirror/state@6.6.0)(@codemirror/view@6.43.0)':
+    dependencies:
+      '@codemirror/autocomplete': 6.20.2
+      '@codemirror/commands': 6.10.3
+      '@codemirror/language': 6.12.3
+      '@codemirror/lint': 6.9.6
+      '@codemirror/search': 6.7.0
+      '@codemirror/state': 6.6.0
+      '@codemirror/view': 6.43.0
+
+  '@uiw/codemirror-themes@4.25.10(@codemirror/language@6.12.3)(@codemirror/state@6.6.0)(@codemirror/view@6.43.0)':
+    dependencies:
+      '@codemirror/language': 6.12.3
+      '@codemirror/state': 6.6.0
+      '@codemirror/view': 6.43.0
+
+  '@uiw/react-codemirror@4.23.11(@babel/runtime@7.26.0)(@codemirror/autocomplete@6.20.2)(@codemirror/language@6.12.3)(@codemirror/lint@6.9.6)(@codemirror/search@6.7.0)(@codemirror/state@6.6.0)(@codemirror/theme-one-dark@6.1.3)(@codemirror/view@6.43.0)(codemirror@6.0.1)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)':
+    dependencies:
+      '@babel/runtime': 7.26.0
+      '@codemirror/commands': 6.10.3
+      '@codemirror/state': 6.6.0
+      '@codemirror/theme-one-dark': 6.1.3
+      '@codemirror/view': 6.43.0
+      '@uiw/codemirror-extensions-basic-setup': 4.23.11(@codemirror/autocomplete@6.20.2)(@codemirror/commands@6.10.3)(@codemirror/language@6.12.3)(@codemirror/lint@6.9.6)(@codemirror/search@6.7.0)(@codemirror/state@6.6.0)(@codemirror/view@6.43.0)
+      codemirror: 6.0.1
+      react: 17.0.2
+      react-dom: 17.0.2(react@17.0.2)
+    transitivePeerDependencies:
+      - '@codemirror/autocomplete'
+      - '@codemirror/language'
+      - '@codemirror/lint'
+      - '@codemirror/search'
+
+  '@uiw/react-codemirror@4.25.10(@babel/runtime@7.26.0)(@codemirror/autocomplete@6.20.2)(@codemirror/language@6.12.3)(@codemirror/lint@6.9.6)(@codemirror/search@6.7.0)(@codemirror/state@6.6.0)(@codemirror/theme-one-dark@6.1.3)(@codemirror/view@6.43.0)(codemirror@6.0.1)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)':
+    dependencies:
+      '@babel/runtime': 7.26.0
+      '@codemirror/commands': 6.10.3
+      '@codemirror/state': 6.6.0
+      '@codemirror/theme-one-dark': 6.1.3
+      '@codemirror/view': 6.43.0
+      '@uiw/codemirror-extensions-basic-setup': 4.25.10(@codemirror/autocomplete@6.20.2)(@codemirror/commands@6.10.3)(@codemirror/language@6.12.3)(@codemirror/lint@6.9.6)(@codemirror/search@6.7.0)(@codemirror/state@6.6.0)(@codemirror/view@6.43.0)
+      codemirror: 6.0.1
+      react: 17.0.2
+      react-dom: 17.0.2(react@17.0.2)
+    transitivePeerDependencies:
+      - '@codemirror/autocomplete'
+      - '@codemirror/language'
+      - '@codemirror/lint'
+      - '@codemirror/search'
+
+  '@ungap/structured-clone@1.3.0': {}
+
+  '@unrs/resolver-binding-android-arm-eabi@1.11.1':
+    optional: true
+
+  '@unrs/resolver-binding-android-arm64@1.11.1':
+    optional: true
+
+  '@unrs/resolver-binding-darwin-arm64@1.11.1':
+    optional: true
+
+  '@unrs/resolver-binding-darwin-x64@1.11.1':
+    optional: true
+
+  '@unrs/resolver-binding-freebsd-x64@1.11.1':
+    optional: true
+
+  '@unrs/resolver-binding-linux-arm-gnueabihf@1.11.1':
+    optional: true
+
+  '@unrs/resolver-binding-linux-arm-musleabihf@1.11.1':
+    optional: true
+
+  '@unrs/resolver-binding-linux-arm64-gnu@1.11.1':
+    optional: true
+
+  '@unrs/resolver-binding-linux-arm64-musl@1.11.1':
+    optional: true
+
+  '@unrs/resolver-binding-linux-ppc64-gnu@1.11.1':
+    optional: true
+
+  '@unrs/resolver-binding-linux-riscv64-gnu@1.11.1':
+    optional: true
+
+  '@unrs/resolver-binding-linux-riscv64-musl@1.11.1':
+    optional: true
+
+  '@unrs/resolver-binding-linux-s390x-gnu@1.11.1':
+    optional: true
+
+  '@unrs/resolver-binding-linux-x64-gnu@1.11.1':
+    optional: true
+
+  '@unrs/resolver-binding-linux-x64-musl@1.11.1':
+    optional: true
+
+  '@unrs/resolver-binding-wasm32-wasi@1.11.1':
+    dependencies:
+      '@napi-rs/wasm-runtime': 0.2.12
+    optional: true
+
+  '@unrs/resolver-binding-win32-arm64-msvc@1.11.1':
+    optional: true
+
+  '@unrs/resolver-binding-win32-ia32-msvc@1.11.1':
+    optional: true
+
+  '@unrs/resolver-binding-win32-x64-msvc@1.11.1':
+    optional: true
+
+  '@vitest/coverage-v8@4.1.8(vitest@4.1.8)':
+    dependencies:
+      '@bcoe/v8-coverage': 1.0.2
+      '@vitest/utils': 4.1.8
+      ast-v8-to-istanbul: 1.0.3
+      istanbul-lib-coverage: 3.2.2
+      istanbul-lib-report: 3.0.1
+      istanbul-reports: 3.2.0
+      magicast: 0.5.2
+      obug: 2.1.1
+      std-env: 4.1.0
+      tinyrainbow: 3.1.0
+      vitest: 4.1.8(@types/node@25.0.3)(@vitest/coverage-v8@4.1.8)(jsdom@24.1.3)(msw@2.14.6(@types/node@25.0.3)(typescript@6.0.2))(vite@8.0.16(@types/node@25.0.3)(esbuild@0.27.3)(jiti@2.7.0)(less@4.4.2)(terser@5.44.1)(yaml@1.10.2))
+
+  '@vitest/eslint-plugin@1.6.20(@typescript-eslint/eslint-plugin@8.61.1(@typescript-eslint/parser@8.61.1(eslint@9.39.4(jiti@2.7.0))(typescript@6.0.2))(eslint@9.39.4(jiti@2.7.0))(typescript@6.0.2))(eslint@9.39.4(jiti@2.7.0))(typescript@6.0.2)(vitest@4.1.8)':
+    dependencies:
+      '@typescript-eslint/scope-manager': 8.60.1
+      '@typescript-eslint/utils': 8.60.1(eslint@9.39.4(jiti@2.7.0))(typescript@6.0.2)
+      eslint: 9.39.4(jiti@2.7.0)
+    optionalDependencies:
+      '@typescript-eslint/eslint-plugin': 8.61.1(@typescript-eslint/parser@8.61.1(eslint@9.39.4(jiti@2.7.0))(typescript@6.0.2))(eslint@9.39.4(jiti@2.7.0))(typescript@6.0.2)
+      typescript: 6.0.2
+      vitest: 4.1.8(@types/node@25.0.3)(@vitest/coverage-v8@4.1.8)(jsdom@24.1.3)(msw@2.14.6(@types/node@25.0.3)(typescript@6.0.2))(vite@8.0.16(@types/node@25.0.3)(esbuild@0.27.3)(jiti@2.7.0)(less@4.4.2)(terser@5.44.1)(yaml@1.10.2))
+    transitivePeerDependencies:
+      - supports-color
+
+  '@vitest/expect@3.2.4':
+    dependencies:
+      '@types/chai': 5.2.3
+      '@vitest/spy': 3.2.4
+      '@vitest/utils': 3.2.4
+      chai: 5.3.3
+      tinyrainbow: 2.0.0
+
+  '@vitest/expect@4.1.8':
+    dependencies:
+      '@standard-schema/spec': 1.1.0
+      '@types/chai': 5.2.3
+      '@vitest/spy': 4.1.8
+      '@vitest/utils': 4.1.8
+      chai: 6.2.2
+      tinyrainbow: 3.1.0
+
+  '@vitest/mocker@4.1.8(msw@2.14.6(@types/node@25.0.3)(typescript@6.0.2))(vite@8.0.16(@types/node@25.0.3)(esbuild@0.27.3)(jiti@2.7.0)(less@4.4.2)(terser@5.44.1)(yaml@1.10.2))':
+    dependencies:
+      '@vitest/spy': 4.1.8
+      estree-walker: 3.0.3
+      magic-string: 0.30.21
+    optionalDependencies:
+      msw: 2.14.6(@types/node@25.0.3)(typescript@6.0.2)
+      vite: 8.0.16(@types/node@25.0.3)(esbuild@0.27.3)(jiti@2.7.0)(less@4.4.2)(terser@5.44.1)(yaml@1.10.2)
+
+  '@vitest/pretty-format@3.2.4':
+    dependencies:
+      tinyrainbow: 2.0.0
+
+  '@vitest/pretty-format@4.1.8':
+    dependencies:
+      tinyrainbow: 3.1.0
+
+  '@vitest/runner@4.1.8':
+    dependencies:
+      '@vitest/utils': 4.1.8
+      pathe: 2.0.3
+
+  '@vitest/snapshot@4.1.8':
+    dependencies:
+      '@vitest/pretty-format': 4.1.8
+      '@vitest/utils': 4.1.8
+      magic-string: 0.30.21
+      pathe: 2.0.3
+
+  '@vitest/spy@3.2.4':
+    dependencies:
+      tinyspy: 4.0.4
+
+  '@vitest/spy@4.1.8': {}
+
+  '@vitest/utils@3.2.4':
+    dependencies:
+      '@vitest/pretty-format': 3.2.4
+      loupe: 3.2.1
+      tinyrainbow: 2.0.0
+
+  '@vitest/utils@4.1.8':
+    dependencies:
+      '@vitest/pretty-format': 4.1.8
+      convert-source-map: 2.0.0
+      tinyrainbow: 3.1.0
+
+  '@vtaits/use-lazy-ref@0.1.4(react@17.0.2)':
+    dependencies:
+      react: 17.0.2
+
+  '@webassemblyjs/ast@1.14.1':
+    dependencies:
+      '@webassemblyjs/helper-numbers': 1.13.2
+      '@webassemblyjs/helper-wasm-bytecode': 1.13.2
+
+  '@webassemblyjs/floating-point-hex-parser@1.13.2': {}
+
+  '@webassemblyjs/helper-api-error@1.13.2': {}
+
+  '@webassemblyjs/helper-buffer@1.14.1': {}
+
+  '@webassemblyjs/helper-numbers@1.13.2':
+    dependencies:
+      '@webassemblyjs/floating-point-hex-parser': 1.13.2
+      '@webassemblyjs/helper-api-error': 1.13.2
+      '@xtuc/long': 4.2.2
+
+  '@webassemblyjs/helper-wasm-bytecode@1.13.2': {}
+
+  '@webassemblyjs/helper-wasm-section@1.14.1':
+    dependencies:
+      '@webassemblyjs/ast': 1.14.1
+      '@webassemblyjs/helper-buffer': 1.14.1
+      '@webassemblyjs/helper-wasm-bytecode': 1.13.2
+      '@webassemblyjs/wasm-gen': 1.14.1
+
+  '@webassemblyjs/ieee754@1.13.2':
+    dependencies:
+      '@xtuc/ieee754': 1.2.0
+
+  '@webassemblyjs/leb128@1.13.2':
+    dependencies:
+      '@xtuc/long': 4.2.2
+
+  '@webassemblyjs/utf8@1.13.2': {}
+
+  '@webassemblyjs/wasm-edit@1.14.1':
+    dependencies:
+      '@webassemblyjs/ast': 1.14.1
+      '@webassemblyjs/helper-buffer': 1.14.1
+      '@webassemblyjs/helper-wasm-bytecode': 1.13.2
+      '@webassemblyjs/helper-wasm-section': 1.14.1
+      '@webassemblyjs/wasm-gen': 1.14.1
+      '@webassemblyjs/wasm-opt': 1.14.1
+      '@webassemblyjs/wasm-parser': 1.14.1
+      '@webassemblyjs/wast-printer': 1.14.1
+
+  '@webassemblyjs/wasm-gen@1.14.1':
+    dependencies:
+      '@webassemblyjs/ast': 1.14.1
+      '@webassemblyjs/helper-wasm-bytecode': 1.13.2
+      '@webassemblyjs/ieee754': 1.13.2
+      '@webassemblyjs/leb128': 1.13.2
+      '@webassemblyjs/utf8': 1.13.2
+
+  '@webassemblyjs/wasm-opt@1.14.1':
+    dependencies:
+      '@webassemblyjs/ast': 1.14.1
+      '@webassemblyjs/helper-buffer': 1.14.1
+      '@webassemblyjs/wasm-gen': 1.14.1
+      '@webassemblyjs/wasm-parser': 1.14.1
+
+  '@webassemblyjs/wasm-parser@1.14.1':
+    dependencies:
+      '@webassemblyjs/ast': 1.14.1
+      '@webassemblyjs/helper-api-error': 1.13.2
+      '@webassemblyjs/helper-wasm-bytecode': 1.13.2
+      '@webassemblyjs/ieee754': 1.13.2
+      '@webassemblyjs/leb128': 1.13.2
+      '@webassemblyjs/utf8': 1.13.2
+
+  '@webassemblyjs/wast-printer@1.14.1':
+    dependencies:
+      '@webassemblyjs/ast': 1.14.1
+      '@xtuc/long': 4.2.2
+
+  '@webcontainer/env@1.1.1': {}
+
+  '@webpack-cli/configtest@3.0.1(webpack-cli@6.0.1)(webpack@5.107.2)':
+    dependencies:
+      webpack: 5.107.2(@swc/core@1.15.11)(cssnano@8.0.1(postcss@8.5.15))(esbuild@0.27.3)(postcss@8.5.15)(webpack-cli@6.0.1)
+      webpack-cli: 6.0.1(webpack-bundle-analyzer@5.2.0)(webpack-dev-server@5.2.4)(webpack@5.107.2)
+
+  '@webpack-cli/info@3.0.1(webpack-cli@6.0.1)(webpack@5.107.2)':
+    dependencies:
+      webpack: 5.107.2(@swc/core@1.15.11)(cssnano@8.0.1(postcss@8.5.15))(esbuild@0.27.3)(postcss@8.5.15)(webpack-cli@6.0.1)
+      webpack-cli: 6.0.1(webpack-bundle-analyzer@5.2.0)(webpack-dev-server@5.2.4)(webpack@5.107.2)
+
+  '@webpack-cli/serve@3.0.1(webpack-cli@6.0.1)(webpack-dev-server@5.2.4)(webpack@5.107.2)':
+    dependencies:
+      webpack: 5.107.2(@swc/core@1.15.11)(cssnano@8.0.1(postcss@8.5.15))(esbuild@0.27.3)(postcss@8.5.15)(webpack-cli@6.0.1)
+      webpack-cli: 6.0.1(webpack-bundle-analyzer@5.2.0)(webpack-dev-server@5.2.4)(webpack@5.107.2)
+    optionalDependencies:
+      webpack-dev-server: 5.2.4(tslib@2.8.1)(webpack-cli@6.0.1)(webpack@5.107.2)
+
+  '@wojtekmaj/date-utils@1.5.1': {}
+
+  '@wojtekmaj/react-daterange-picker@5.5.0(@types/react-dom@17.0.25)(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)':
+    dependencies:
+      clsx: 2.1.1
+      make-event-props: 1.6.2
+      prop-types: 15.8.1
+      react: 17.0.2
+      react-calendar: 4.8.0(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      react-date-picker: 10.6.0(@types/react-dom@17.0.25)(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      react-dom: 17.0.2(react@17.0.2)
+      react-fit: 1.7.1(@types/react-dom@17.0.25)(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+    optionalDependencies:
+      '@types/react': 17.0.75
+    transitivePeerDependencies:
+      - '@types/react-dom'
+
+  '@xterm/addon-fit@0.11.0': {}
+
+  '@xterm/xterm@6.0.0': {}
+
+  '@xtuc/ieee754@1.2.0': {}
+
+  '@xtuc/long@4.2.2': {}
+
+  abab@2.0.6: {}
+
+  accepts@1.3.8:
+    dependencies:
+      mime-types: 2.1.35
+      negotiator: 0.6.3
+
+  acorn-import-phases@1.0.4(acorn@8.16.0):
+    dependencies:
+      acorn: 8.16.0
+
+  acorn-jsx@5.3.2(acorn@8.16.0):
+    dependencies:
+      acorn: 8.16.0
+
+  acorn-walk@8.2.0: {}
+
+  acorn@8.16.0: {}
+
+  agent-base@6.0.2:
+    dependencies:
+      debug: 4.4.3
+    transitivePeerDependencies:
+      - supports-color
+
+  agent-base@7.1.4: {}
+
+  ajv-formats@2.1.1(ajv@8.17.1):
+    optionalDependencies:
+      ajv: 8.17.1
+
+  ajv-keywords@3.5.2(ajv@6.14.0):
+    dependencies:
+      ajv: 6.14.0
+
+  ajv-keywords@5.1.0(ajv@8.17.1):
+    dependencies:
+      ajv: 8.17.1
+      fast-deep-equal: 3.1.3
+
+  ajv@6.14.0:
+    dependencies:
+      fast-deep-equal: 3.1.3
+      fast-json-stable-stringify: 2.1.0
+      json-schema-traverse: 0.4.1
+      uri-js: 4.4.1
+
+  ajv@8.17.1:
+    dependencies:
+      fast-deep-equal: 3.1.3
+      fast-uri: 3.1.0
+      json-schema-traverse: 1.0.0
+      require-from-string: 2.0.2
+
+  angular-clipboard@1.7.0(angular@1.8.2):
+    dependencies:
+      angular: 1.8.2
+
+  angular-file-saver@1.1.3:
+    dependencies:
+      blob-tmp: 1.0.0
+      file-saver: 1.3.8
+
+  angular-loading-bar@0.9.0: {}
+
+  angular-local-storage@0.5.2: {}
+
+  angular-messages@1.8.2: {}
+
+  angular-mocks@1.8.2: {}
+
+  angular-resource@1.8.2: {}
+
+  angular-sanitize@1.8.2: {}
+
+  angular-ui-bootstrap@2.5.6: {}
+
+  angular@1.8.2: {}
+
+  angularjs-scroll-glue@2.2.0: {}
+
+  angularjs-slider@6.7.0(angular@1.8.2):
+    dependencies:
+      angular: 1.8.2
+
+  ansi-colors@4.1.3: {}
+
+  ansi-escapes@7.3.0:
+    dependencies:
+      environment: 1.1.0
+
+  ansi-html-community@0.0.8: {}
+
+  ansi-regex@5.0.1: {}
+
+  ansi-regex@6.0.1: {}
+
+  ansi-regex@6.2.2: {}
+
+  ansi-styles@4.3.0:
+    dependencies:
+      color-convert: 2.0.1
+
+  ansi-styles@5.2.0: {}
+
+  ansi-styles@6.2.1: {}
+
+  ansi-styles@6.2.3: {}
+
+  any-promise@1.3.0: {}
+
+  anymatch@3.1.3:
+    dependencies:
+      normalize-path: 3.0.0
+      picomatch: 2.3.1
+
+  arg@5.0.2: {}
+
+  argparse@1.0.10:
+    dependencies:
+      sprintf-js: 1.0.3
+
+  argparse@2.0.1: {}
+
+  aria-hidden@1.2.4:
+    dependencies:
+      tslib: 2.8.1
+
+  aria-query@5.1.3:
+    dependencies:
+      deep-equal: 2.2.1
+
+  aria-query@5.3.2: {}
+
+  array-buffer-byte-length@1.0.2:
+    dependencies:
+      call-bound: 1.0.4
+      is-array-buffer: 3.0.5
+
+  array-flatten@1.1.1: {}
+
+  array-includes@3.1.9:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-object-atoms: 1.1.1
+      get-intrinsic: 1.3.0
+      is-string: 1.1.1
+      math-intrinsics: 1.1.0
+
+  array-union@1.0.2:
+    dependencies:
+      array-uniq: 1.0.3
+
+  array-uniq@1.0.3: {}
+
+  array.prototype.findlast@1.2.5:
+    dependencies:
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-errors: 1.3.0
+      es-object-atoms: 1.1.1
+      es-shim-unscopables: 1.1.0
+
+  array.prototype.findlastindex@1.2.6:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-errors: 1.3.0
+      es-object-atoms: 1.1.1
+      es-shim-unscopables: 1.1.0
+
+  array.prototype.flat@1.3.3:
+    dependencies:
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-shim-unscopables: 1.1.0
+
+  array.prototype.flatmap@1.3.3:
+    dependencies:
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-shim-unscopables: 1.1.0
+
+  array.prototype.tosorted@1.1.4:
+    dependencies:
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-errors: 1.3.0
+      es-shim-unscopables: 1.1.0
+
+  arraybuffer.prototype.slice@1.0.4:
+    dependencies:
+      array-buffer-byte-length: 1.0.2
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-errors: 1.3.0
+      get-intrinsic: 1.3.0
+      is-array-buffer: 3.0.5
+
+  asn1js@3.0.7:
+    dependencies:
+      pvtsutils: 1.3.6
+      pvutils: 1.1.5
+      tslib: 2.8.1
+
+  assertion-error@2.0.1: {}
+
+  ast-types-flow@0.0.8: {}
+
+  ast-types@0.16.1:
+    dependencies:
+      tslib: 2.8.1
+
+  ast-v8-to-istanbul@1.0.3:
+    dependencies:
+      '@jridgewell/trace-mapping': 0.3.31
+      estree-walker: 3.0.3
+      js-tokens: 10.0.0
+
+  asynckit@0.4.0: {}
+
+  auto-ngtemplate-loader@3.1.2(webpack@5.107.2):
+    dependencies:
+      html-loader: 4.1.0(webpack@5.107.2)
+      loader-utils: 3.2.2
+      lodash: 4.17.23
+      ngtemplate-loader: 2.1.0
+      var-validator: 0.0.3
+    transitivePeerDependencies:
+      - webpack
+
+  autoprefixer@10.5.0(postcss@8.5.15):
+    dependencies:
+      browserslist: 4.28.2
+      caniuse-lite: 1.0.30001793
+      fraction.js: 5.3.4
+      picocolors: 1.1.1
+      postcss: 8.5.15
+      postcss-value-parser: 4.2.0
+
+  available-typed-arrays@1.0.7:
+    dependencies:
+      possible-typed-array-names: 1.1.0
+
+  axe-core@4.11.2: {}
+
+  axios-cache-interceptor@1.11.2(axios@1.18.0):
+    dependencies:
+      axios: 1.18.0
+      cache-parser: 1.2.6
+      fast-defer: 1.1.9
+      http-vary: 1.0.3
+      object-code: 2.0.0
+      try: 1.0.3
+
+  axios-progress-bar@https://codeload.github.com/portainer/progress-bar-4-axios/tar.gz/d424cd29f5b629af9ffc5c3d6db8d92d11d82f0f(axios@1.18.0):
+    dependencies:
+      axios: 1.18.0
+
+  axios@1.18.0:
+    dependencies:
+      follow-redirects: 1.16.0
+      form-data: 4.0.5
+      https-proxy-agent: 5.0.1
+      proxy-from-env: 2.1.0
+    transitivePeerDependencies:
+      - debug
+      - supports-color
+
+  axobject-query@4.1.0: {}
+
+  babel-loader@9.1.3(@babel/core@7.29.0)(webpack@5.107.2):
+    dependencies:
+      '@babel/core': 7.29.0
+      find-cache-dir: 4.0.0
+      schema-utils: 4.3.3
+      webpack: 5.107.2(@swc/core@1.15.11)(cssnano@8.0.1(postcss@8.5.15))(esbuild@0.27.3)(postcss@8.5.15)(webpack-cli@6.0.1)
+
+  babel-plugin-angularjs-annotate@0.10.0:
+    dependencies:
+      '@babel/code-frame': 7.29.0
+      '@babel/types': 7.29.0
+      simple-is: 0.2.0
+
+  babel-plugin-i18next-extract@0.9.0:
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/types': 7.18.10
+      deepmerge: 4.3.1
+      i18next: 21.10.0
+      json-stable-stringify: 1.0.1
+    transitivePeerDependencies:
+      - supports-color
+
+  babel-plugin-lodash@3.3.4:
+    dependencies:
+      '@babel/helper-module-imports': 7.28.6
+      '@babel/types': 7.29.0
+      glob: 7.2.3
+      lodash: 4.18.1
+      require-package-name: 2.0.1
+    transitivePeerDependencies:
+      - supports-color
+
+  babel-plugin-macros@3.1.0:
+    dependencies:
+      '@babel/runtime': 7.26.0
+      cosmiconfig: 7.1.0
+      resolve: 1.22.11
+
+  babel-plugin-polyfill-corejs2@0.4.7(@babel/core@7.29.0):
+    dependencies:
+      '@babel/compat-data': 7.29.0
+      '@babel/core': 7.29.0
+      '@babel/helper-define-polyfill-provider': 0.4.4(@babel/core@7.29.0)
+      semver: 6.3.1
+    transitivePeerDependencies:
+      - supports-color
+
+  babel-plugin-polyfill-corejs3@0.8.7(@babel/core@7.29.0):
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-define-polyfill-provider': 0.4.4(@babel/core@7.29.0)
+      core-js-compat: 3.34.0
+    transitivePeerDependencies:
+      - supports-color
+
+  babel-plugin-polyfill-regenerator@0.5.4(@babel/core@7.29.0):
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-define-polyfill-provider': 0.4.4(@babel/core@7.29.0)
+    transitivePeerDependencies:
+      - supports-color
+
+  balanced-match@1.0.2: {}
+
+  balanced-match@4.0.4: {}
+
+  base64-js@1.5.1: {}
+
+  baseline-browser-mapping@2.10.33: {}
+
+  batch@0.6.1: {}
+
+  best-effort-json-parser@1.1.3: {}
+
+  big.js@5.2.2: {}
+
+  binary-extensions@2.2.0: {}
+
+  blob-tmp@1.0.0: {}
+
+  body-parser@1.20.4:
+    dependencies:
+      bytes: 3.1.2
+      content-type: 1.0.5
+      debug: 2.6.9
+      depd: 2.0.0
+      destroy: 1.2.0
+      http-errors: 2.0.1
+      iconv-lite: 0.4.24
+      on-finished: 2.4.1
+      qs: 6.14.1
+      raw-body: 2.5.3
+      type-is: 1.6.18
+      unpipe: 1.0.0
+    transitivePeerDependencies:
+      - supports-color
+
+  bonjour-service@1.3.0:
+    dependencies:
+      fast-deep-equal: 3.1.3
+      multicast-dns: 7.2.5
+
+  boolbase@1.0.0: {}
+
+  bootstrap@3.4.1: {}
+
+  brace-expansion@1.1.11:
+    dependencies:
+      balanced-match: 1.0.2
+      concat-map: 0.0.1
+
+  brace-expansion@5.0.5:
+    dependencies:
+      balanced-match: 4.0.4
+
+  braces@3.0.3:
+    dependencies:
+      fill-range: 7.1.1
+
+  browserslist@4.28.2:
+    dependencies:
+      baseline-browser-mapping: 2.10.33
+      caniuse-lite: 1.0.30001793
+      electron-to-chromium: 1.5.364
+      node-releases: 2.0.46
+      update-browserslist-db: 1.2.3(browserslist@4.28.2)
+
+  buffer-from@1.1.2: {}
+
+  buffer@6.0.3:
+    dependencies:
+      base64-js: 1.5.1
+      ieee754: 1.2.1
+
+  bundle-name@4.1.0:
+    dependencies:
+      run-applescript: 7.1.0
+
+  bytes@3.1.2: {}
+
+  bytestreamjs@2.0.1: {}
+
+  c12@3.3.4(magicast@0.5.2):
+    dependencies:
+      chokidar: 5.0.0
+      confbox: 0.2.4
+      defu: 6.1.7
+      dotenv: 17.4.2
+      exsolve: 1.0.8
+      giget: 3.2.0
+      jiti: 2.7.0
+      ohash: 2.0.11
+      pathe: 2.0.3
+      perfect-debounce: 2.1.0
+      pkg-types: 2.3.1
+      rc9: 3.0.1
+    optionalDependencies:
+      magicast: 0.5.2
+
+  c8@9.1.0:
+    dependencies:
+      '@bcoe/v8-coverage': 0.2.3
+      '@istanbuljs/schema': 0.1.3
+      find-up: 5.0.0
+      foreground-child: 3.1.1
+      istanbul-lib-coverage: 3.2.2
+      istanbul-lib-report: 3.0.1
+      istanbul-reports: 3.2.0
+      test-exclude: 6.0.0
+      v8-to-istanbul: 9.2.0
+      yargs: 17.7.2
+      yargs-parser: 21.1.1
+
+  cache-parser@1.2.6: {}
+
+  call-bind-apply-helpers@1.0.2:
+    dependencies:
+      es-errors: 1.3.0
+      function-bind: 1.1.2
+
+  call-bind@1.0.9:
+    dependencies:
+      call-bind-apply-helpers: 1.0.2
+      es-define-property: 1.0.1
+      get-intrinsic: 1.3.0
+      set-function-length: 1.2.2
+
+  call-bound@1.0.4:
+    dependencies:
+      call-bind-apply-helpers: 1.0.2
+      get-intrinsic: 1.3.0
+
+  call-me-maybe@1.0.2: {}
+
+  callsites@3.1.0: {}
+
+  camel-case@4.1.2:
+    dependencies:
+      pascal-case: 3.1.2
+      tslib: 2.8.1
+
+  camelcase-css@2.0.1: {}
+
+  camelcase@5.3.1: {}
+
+  camelcase@6.3.0: {}
+
+  caniuse-api@3.0.0:
+    dependencies:
+      browserslist: 4.28.2
+      caniuse-lite: 1.0.30001793
+      lodash.memoize: 4.1.2
+      lodash.uniq: 4.5.0
+
+  caniuse-lite@1.0.30001793: {}
+
+  case-sensitive-paths-webpack-plugin@2.4.0: {}
+
+  ccount@2.0.1: {}
+
+  chai@5.3.3:
+    dependencies:
+      assertion-error: 2.0.1
+      check-error: 2.1.3
+      deep-eql: 5.0.2
+      loupe: 3.2.1
+      pathval: 2.0.1
+
+  chai@6.2.2: {}
+
+  chalk@4.1.2:
+    dependencies:
+      ansi-styles: 4.3.0
+      supports-color: 7.2.0
+
+  character-entities-html4@2.1.0: {}
+
+  character-entities-legacy@3.0.0: {}
+
+  chardet@1.4.0: {}
+
+  chart.js@2.9.4:
+    dependencies:
+      chartjs-color: 2.4.1
+      moment: 2.30.1
+
+  chartjs-color-string@0.6.0:
+    dependencies:
+      color-name: 1.1.4
+
+  chartjs-color@2.4.1:
+    dependencies:
+      chartjs-color-string: 0.6.0
+      color-convert: 1.9.3
+
+  check-error@2.1.3: {}
+
+  chokidar@3.6.0:
+    dependencies:
+      anymatch: 3.1.3
+      braces: 3.0.3
+      glob-parent: 5.1.2
+      is-binary-path: 2.1.0
+      is-glob: 4.0.3
+      normalize-path: 3.0.0
+      readdirp: 3.6.0
+    optionalDependencies:
+      fsevents: 2.3.3
+
+  chokidar@4.0.3:
+    dependencies:
+      readdirp: 4.1.2
+
+  chokidar@5.0.0:
+    dependencies:
+      readdirp: 5.0.0
+
+  chromatic@13.3.5: {}
+
+  chrome-trace-event@1.0.3: {}
+
+  cjs-module-lexer@1.4.3: {}
+
+  class-variance-authority@0.7.1:
+    dependencies:
+      clsx: 2.1.1
+
+  classnames@2.3.1: {}
+
+  clean-css@5.3.2:
+    dependencies:
+      source-map: 0.6.1
+
+  clean-webpack-plugin@4.0.0(webpack@5.107.2):
+    dependencies:
+      del: 4.1.1
+      webpack: 5.107.2(@swc/core@1.15.11)(cssnano@8.0.1(postcss@8.5.15))(esbuild@0.27.3)(postcss@8.5.15)(webpack-cli@6.0.1)
+
+  cli-cursor@5.0.0:
+    dependencies:
+      restore-cursor: 5.1.0
+
+  cli-truncate@5.2.0:
+    dependencies:
+      slice-ansi: 8.0.0
+      string-width: 8.2.1
+
+  cli-width@4.1.0: {}
+
+  cliui@6.0.0:
+    dependencies:
+      string-width: 4.2.3
+      strip-ansi: 6.0.1
+      wrap-ansi: 6.2.0
+
+  cliui@8.0.1:
+    dependencies:
+      string-width: 4.2.3
+      strip-ansi: 6.0.1
+      wrap-ansi: 7.0.0
+
+  clone-deep@4.0.1:
+    dependencies:
+      is-plain-object: 2.0.4
+      kind-of: 6.0.3
+      shallow-clone: 3.0.1
+
+  clsx@1.1.1: {}
+
+  clsx@2.1.1: {}
+
+  codemirror-json-schema@0.8.1(@codemirror/language@6.12.3)(@codemirror/lint@6.9.6)(@codemirror/state@6.6.0)(@codemirror/view@6.43.0)(@lezer/common@1.5.2):
+    dependencies:
+      '@codemirror/language': 6.12.3
+      '@codemirror/lint': 6.9.6
+      '@codemirror/state': 6.6.0
+      '@codemirror/view': 6.43.0
+      '@lezer/common': 1.5.2
+      '@sagold/json-pointer': 5.1.2
+      '@shikijs/markdown-it': 1.29.2
+      best-effort-json-parser: 1.1.3
+      json-schema: 0.4.0
+      json-schema-library: 9.3.5
+      loglevel: 1.9.2
+      markdown-it: 12.3.2
+      shiki: 1.29.2
+      yaml: 2.7.0
+    optionalDependencies:
+      '@codemirror/autocomplete': 6.20.2
+      '@codemirror/lang-json': 6.0.1
+      '@codemirror/lang-yaml': 6.1.2
+      codemirror-json5: 1.0.3
+      json5: 2.2.3
+
+  codemirror-json5@1.0.3:
+    dependencies:
+      '@codemirror/language': 6.12.3
+      '@codemirror/state': 6.6.0
+      '@codemirror/view': 6.43.0
+      '@lezer/common': 1.5.2
+      '@lezer/highlight': 1.2.1
+      json5: 2.2.3
+      lezer-json5: 2.0.2
+    optional: true
+
+  codemirror@6.0.1:
+    dependencies:
+      '@codemirror/autocomplete': 6.20.2
+      '@codemirror/commands': 6.10.3
+      '@codemirror/language': 6.12.3
+      '@codemirror/lint': 6.9.6
+      '@codemirror/search': 6.7.0
+      '@codemirror/state': 6.6.0
+      '@codemirror/view': 6.43.0
+
+  color-convert@1.9.3:
+    dependencies:
+      color-name: 1.1.3
+
+  color-convert@2.0.1:
+    dependencies:
+      color-name: 1.1.4
+
+  color-name@1.1.3: {}
+
+  color-name@1.1.4: {}
+
+  color-support@1.1.3: {}
+
+  colorette@2.0.20: {}
+
+  combined-stream@1.0.8:
+    dependencies:
+      delayed-stream: 1.0.0
+
+  comma-separated-tokens@2.0.3: {}
+
+  commander@10.0.1: {}
+
+  commander@11.1.0: {}
+
+  commander@12.1.0: {}
+
+  commander@15.0.0: {}
+
+  commander@2.20.3: {}
+
+  commander@4.1.1: {}
+
+  commander@7.2.0: {}
+
+  commander@8.3.0: {}
+
+  common-path-prefix@3.0.0: {}
+
+  commondir@1.0.1: {}
+
+  compressible@2.0.18:
+    dependencies:
+      mime-db: 1.54.0
+
+  compression@1.8.1:
+    dependencies:
+      bytes: 3.1.2
+      compressible: 2.0.18
+      debug: 2.6.9
+      negotiator: 0.6.4
+      on-headers: 1.1.0
+      safe-buffer: 5.2.1
+      vary: 1.1.2
+    transitivePeerDependencies:
+      - supports-color
+
+  concat-map@0.0.1: {}
+
+  confbox@0.2.4: {}
+
+  connect-history-api-fallback@2.0.0: {}
+
+  content-disposition@0.5.4:
+    dependencies:
+      safe-buffer: 5.2.1
+
+  content-type@1.0.5: {}
+
+  convert-source-map@1.9.0: {}
+
+  convert-source-map@2.0.0: {}
+
+  cookie-signature@1.0.6: {}
+
+  cookie@0.7.2: {}
+
+  cookie@1.1.1: {}
+
+  copy-anything@2.0.6:
+    dependencies:
+      is-what: 3.14.1
+    optional: true
+
+  copy-anything@3.0.5:
+    dependencies:
+      is-what: 4.1.16
+
+  copy-webpack-plugin@11.0.0(webpack@5.107.2):
+    dependencies:
+      fast-glob: 3.3.2
+      glob-parent: 6.0.2
+      globby: 13.2.2
+      normalize-path: 3.0.0
+      schema-utils: 4.3.3
+      serialize-javascript: 6.0.1
+      webpack: 5.107.2(@swc/core@1.15.11)(cssnano@8.0.1(postcss@8.5.15))(esbuild@0.27.3)(postcss@8.5.15)(webpack-cli@6.0.1)
+
+  core-js-compat@3.34.0:
+    dependencies:
+      browserslist: 4.28.2
+
+  core-js@3.20.0: {}
+
+  core-util-is@1.0.3: {}
+
+  cosmiconfig@7.1.0:
+    dependencies:
+      '@types/parse-json': 4.0.2
+      import-fresh: 3.3.0
+      parse-json: 5.2.0
+      path-type: 4.0.0
+      yaml: 1.10.2
+
+  cosmiconfig@8.2.0:
+    dependencies:
+      import-fresh: 3.3.0
+      js-yaml: 4.1.1
+      parse-json: 5.2.0
+      path-type: 4.0.0
+
+  crelt@1.0.6: {}
+
+  cross-fetch@4.1.0:
+    dependencies:
+      node-fetch: 2.7.0
+    transitivePeerDependencies:
+      - encoding
+
+  cross-spawn@7.0.6:
+    dependencies:
+      path-key: 3.1.1
+      shebang-command: 2.0.0
+      which: 2.0.2
+
+  css-loader@6.8.1(webpack@5.107.2):
+    dependencies:
+      icss-utils: 5.1.0(postcss@8.5.15)
+      postcss: 8.5.15
+      postcss-modules-extract-imports: 3.1.0(postcss@8.5.15)
+      postcss-modules-local-by-default: 4.2.0(postcss@8.5.15)
+      postcss-modules-scope: 3.2.1(postcss@8.5.15)
+      postcss-modules-values: 4.0.0(postcss@8.5.15)
+      postcss-value-parser: 4.2.0
+      semver: 7.7.4
+      webpack: 5.107.2(@swc/core@1.15.11)(cssnano@8.0.1(postcss@8.5.15))(esbuild@0.27.3)(postcss@8.5.15)(webpack-cli@6.0.1)
+
+  css-loader@7.1.4(webpack@5.107.2):
+    dependencies:
+      icss-utils: 5.1.0(postcss@8.5.15)
+      postcss: 8.5.15
+      postcss-modules-extract-imports: 3.1.0(postcss@8.5.15)
+      postcss-modules-local-by-default: 4.2.0(postcss@8.5.15)
+      postcss-modules-scope: 3.2.1(postcss@8.5.15)
+      postcss-modules-values: 4.0.0(postcss@8.5.15)
+      postcss-value-parser: 4.2.0
+      semver: 7.7.4
+    optionalDependencies:
+      webpack: 5.107.2(@swc/core@1.15.11)(cssnano@8.0.1(postcss@8.5.15))(esbuild@0.27.3)(postcss@8.5.15)(webpack-cli@6.0.1)
+
+  css-select@4.3.0:
+    dependencies:
+      boolbase: 1.0.0
+      css-what: 6.1.0
+      domhandler: 4.3.1
+      domutils: 2.8.0
+      nth-check: 2.1.1
+
+  css-select@5.1.0:
+    dependencies:
+      boolbase: 1.0.0
+      css-what: 6.1.0
+      domhandler: 5.0.3
+      domutils: 3.1.0
+      nth-check: 2.1.1
+
+  css-tree@2.2.1:
+    dependencies:
+      mdn-data: 2.0.28
+      source-map-js: 1.2.1
+
+  css-tree@2.3.1:
+    dependencies:
+      mdn-data: 2.0.30
+      source-map-js: 1.2.1
+
+  css-tree@3.2.1:
+    dependencies:
+      mdn-data: 2.27.1
+      source-map-js: 1.2.1
+
+  css-what@6.1.0: {}
+
+  css.escape@1.5.1: {}
+
+  cssesc@3.0.0: {}
+
+  cssnano-preset-default@8.0.1(postcss@8.5.15):
+    dependencies:
+      browserslist: 4.28.2
+      cssnano-utils: 6.0.0(postcss@8.5.15)
+      postcss: 8.5.15
+      postcss-calc: 10.1.1(postcss@8.5.15)
+      postcss-colormin: 8.0.0(postcss@8.5.15)
+      postcss-convert-values: 8.0.0(postcss@8.5.15)
+      postcss-discard-comments: 8.0.0(postcss@8.5.15)
+      postcss-discard-duplicates: 8.0.0(postcss@8.5.15)
+      postcss-discard-empty: 8.0.0(postcss@8.5.15)
+      postcss-discard-overridden: 8.0.0(postcss@8.5.15)
+      postcss-merge-longhand: 8.0.0(postcss@8.5.15)
+      postcss-merge-rules: 8.0.0(postcss@8.5.15)
+      postcss-minify-font-values: 8.0.0(postcss@8.5.15)
+      postcss-minify-gradients: 8.0.0(postcss@8.5.15)
+      postcss-minify-params: 8.0.0(postcss@8.5.15)
+      postcss-minify-selectors: 8.0.1(postcss@8.5.15)
+      postcss-normalize-charset: 8.0.0(postcss@8.5.15)
+      postcss-normalize-display-values: 8.0.0(postcss@8.5.15)
+      postcss-normalize-positions: 8.0.0(postcss@8.5.15)
+      postcss-normalize-repeat-style: 8.0.0(postcss@8.5.15)
+      postcss-normalize-string: 8.0.0(postcss@8.5.15)
+      postcss-normalize-timing-functions: 8.0.0(postcss@8.5.15)
+      postcss-normalize-unicode: 8.0.0(postcss@8.5.15)
+      postcss-normalize-url: 8.0.0(postcss@8.5.15)
+      postcss-normalize-whitespace: 8.0.0(postcss@8.5.15)
+      postcss-ordered-values: 8.0.0(postcss@8.5.15)
+      postcss-reduce-initial: 8.0.0(postcss@8.5.15)
+      postcss-reduce-transforms: 8.0.0(postcss@8.5.15)
+      postcss-svgo: 8.0.0(postcss@8.5.15)
+      postcss-unique-selectors: 8.0.0(postcss@8.5.15)
+
+  cssnano-utils@6.0.0(postcss@8.5.15):
+    dependencies:
+      postcss: 8.5.15
+
+  cssnano@8.0.1(postcss@8.5.15):
+    dependencies:
+      cssnano-preset-default: 8.0.1(postcss@8.5.15)
+      lilconfig: 3.1.3
+      postcss: 8.5.15
+
+  csso@5.0.5:
+    dependencies:
+      css-tree: 2.2.1
+
+  cssstyle@4.0.1:
+    dependencies:
+      rrweb-cssom: 0.6.0
+
+  csstype@3.0.10: {}
+
+  damerau-levenshtein@1.0.8: {}
+
+  data-urls@5.0.0:
+    dependencies:
+      whatwg-mimetype: 4.0.0
+      whatwg-url: 14.0.0
+
+  data-view-buffer@1.0.2:
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      is-data-view: 1.0.2
+
+  data-view-byte-length@1.0.2:
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      is-data-view: 1.0.2
+
+  data-view-byte-offset@1.0.1:
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      is-data-view: 1.0.2
+
+  date-fns@2.29.3: {}
+
+  debounce@1.2.1: {}
+
+  debug@2.6.9:
+    dependencies:
+      ms: 2.0.0
+
+  debug@3.2.7:
+    dependencies:
+      ms: 2.1.3
+
+  debug@4.4.3:
+    dependencies:
+      ms: 2.1.3
+
+  decamelize@1.2.0: {}
+
+  decimal.js@10.4.3: {}
+
+  dedent@0.7.0: {}
+
+  deep-eql@5.0.2: {}
+
+  deep-equal@2.2.1:
+    dependencies:
+      array-buffer-byte-length: 1.0.2
+      call-bind: 1.0.9
+      es-get-iterator: 1.1.3
+      get-intrinsic: 1.3.0
+      is-arguments: 1.1.1
+      is-array-buffer: 3.0.5
+      is-date-object: 1.1.0
+      is-regex: 1.2.1
+      is-shared-array-buffer: 1.0.4
+      isarray: 2.0.5
+      object-is: 1.1.5
+      object-keys: 1.1.1
+      object.assign: 4.1.7
+      regexp.prototype.flags: 1.5.4
+      side-channel: 1.1.0
+      which-boxed-primitive: 1.1.1
+      which-collection: 1.0.2
+      which-typed-array: 1.1.20
+
+  deep-is@0.1.4: {}
+
+  deepmerge@2.2.1: {}
+
+  deepmerge@4.3.1: {}
+
+  default-browser-id@5.0.1: {}
+
+  default-browser@5.5.0:
+    dependencies:
+      bundle-name: 4.1.0
+      default-browser-id: 5.0.1
+
+  define-data-property@1.1.4:
+    dependencies:
+      es-define-property: 1.0.1
+      es-errors: 1.3.0
+      gopd: 1.2.0
+
+  define-lazy-prop@3.0.0: {}
+
+  define-properties@1.2.1:
+    dependencies:
+      define-data-property: 1.1.4
+      has-property-descriptors: 1.0.2
+      object-keys: 1.1.1
+
+  defu@6.1.7: {}
+
+  del@4.1.1:
+    dependencies:
+      '@types/glob': 7.2.0
+      globby: 6.1.0
+      is-path-cwd: 2.2.0
+      is-path-in-cwd: 2.1.0
+      p-map: 2.1.0
+      pify: 4.0.1
+      rimraf: 2.7.1
+
+  delayed-stream@1.0.0: {}
+
+  depd@1.1.2: {}
+
+  depd@2.0.0: {}
+
+  dequal@2.0.3: {}
+
+  destr@2.0.5: {}
+
+  destroy@1.2.0: {}
+
+  detect-element-overflow@1.4.2: {}
+
+  detect-libc@2.1.2: {}
+
+  detect-node-es@1.1.0: {}
+
+  detect-node@2.1.0: {}
+
+  devlop@1.1.0:
+    dependencies:
+      dequal: 2.0.3
+
+  didyoumean@1.2.2: {}
+
+  dir-glob@3.0.1:
+    dependencies:
+      path-type: 4.0.0
+
+  discontinuous-range@1.0.0: {}
+
+  dlv@1.1.3: {}
+
+  dns-packet@5.6.0:
+    dependencies:
+      '@leichtgewicht/ip-codec': 2.0.4
+
+  docker-types@1.47.4: {}
+
+  doctrine@2.1.0:
+    dependencies:
+      esutils: 2.0.3
+
+  doctrine@3.0.0:
+    dependencies:
+      esutils: 2.0.3
+
+  dom-accessibility-api@0.5.10: {}
+
+  dom-accessibility-api@0.6.3: {}
+
+  dom-converter@0.2.0:
+    dependencies:
+      utila: 0.4.0
+
+  dom-helpers@5.2.1:
+    dependencies:
+      '@babel/runtime': 7.26.0
+      csstype: 3.0.10
+
+  dom-serializer@1.4.1:
+    dependencies:
+      domelementtype: 2.3.0
+      domhandler: 4.3.1
+      entities: 2.2.0
+
+  dom-serializer@2.0.0:
+    dependencies:
+      domelementtype: 2.3.0
+      domhandler: 5.0.3
+      entities: 4.5.0
+
+  domelementtype@2.3.0: {}
+
+  domhandler@4.3.1:
+    dependencies:
+      domelementtype: 2.3.0
+
+  domhandler@5.0.3:
+    dependencies:
+      domelementtype: 2.3.0
+
+  domutils@2.8.0:
+    dependencies:
+      dom-serializer: 1.4.1
+      domelementtype: 2.3.0
+      domhandler: 4.3.1
+
+  domutils@3.1.0:
+    dependencies:
+      dom-serializer: 2.0.0
+      domelementtype: 2.3.0
+      domhandler: 5.0.3
+
+  dot-case@3.0.4:
+    dependencies:
+      no-case: 3.0.4
+      tslib: 2.8.1
+
+  dotenv-defaults@2.0.2:
+    dependencies:
+      dotenv: 8.6.0
+
+  dotenv-webpack@8.0.1(webpack@5.107.2):
+    dependencies:
+      dotenv-defaults: 2.0.2
+      webpack: 5.107.2(@swc/core@1.15.11)(cssnano@8.0.1(postcss@8.5.15))(esbuild@0.27.3)(postcss@8.5.15)(webpack-cli@6.0.1)
+
+  dotenv@17.4.2: {}
+
+  dotenv@8.6.0: {}
+
+  dunder-proto@1.0.1:
+    dependencies:
+      call-bind-apply-helpers: 1.0.2
+      es-errors: 1.3.0
+      gopd: 1.2.0
+
+  ebnf@1.9.1: {}
+
+  ee-first@1.1.1: {}
+
+  electron-to-chromium@1.5.364: {}
+
+  emoji-regex-xs@1.0.0: {}
+
+  emoji-regex@10.6.0: {}
+
+  emoji-regex@8.0.0: {}
+
+  emoji-regex@9.2.2: {}
+
+  emojis-list@3.0.0: {}
+
+  encodeurl@2.0.0: {}
+
+  endent@2.1.0:
+    dependencies:
+      dedent: 0.7.0
+      fast-json-parse: 1.0.3
+      objectorarray: 1.0.5
+
+  enhanced-resolve@5.22.1:
+    dependencies:
+      graceful-fs: 4.2.11
+      tapable: 2.3.3
+
+  entities@2.1.0: {}
+
+  entities@2.2.0: {}
+
+  entities@4.5.0: {}
+
+  envinfo@7.21.0: {}
+
+  environment@1.1.0: {}
+
+  errno@0.1.8:
+    dependencies:
+      prr: 1.0.1
+    optional: true
+
+  error-ex@1.3.2:
+    dependencies:
+      is-arrayish: 0.2.1
+
+  es-abstract@1.24.2:
+    dependencies:
+      array-buffer-byte-length: 1.0.2
+      arraybuffer.prototype.slice: 1.0.4
+      available-typed-arrays: 1.0.7
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      data-view-buffer: 1.0.2
+      data-view-byte-length: 1.0.2
+      data-view-byte-offset: 1.0.1
+      es-define-property: 1.0.1
+      es-errors: 1.3.0
+      es-object-atoms: 1.1.1
+      es-set-tostringtag: 2.1.0
+      es-to-primitive: 1.3.0
+      function.prototype.name: 1.1.8
+      get-intrinsic: 1.3.0
+      get-proto: 1.0.1
+      get-symbol-description: 1.1.0
+      globalthis: 1.0.4
+      gopd: 1.2.0
+      has-property-descriptors: 1.0.2
+      has-proto: 1.2.0
+      has-symbols: 1.1.0
+      hasown: 2.0.2
+      internal-slot: 1.1.0
+      is-array-buffer: 3.0.5
+      is-callable: 1.2.7
+      is-data-view: 1.0.2
+      is-negative-zero: 2.0.3
+      is-regex: 1.2.1
+      is-set: 2.0.3
+      is-shared-array-buffer: 1.0.4
+      is-string: 1.1.1
+      is-typed-array: 1.1.15
+      is-weakref: 1.1.1
+      math-intrinsics: 1.1.0
+      object-inspect: 1.13.4
+      object-keys: 1.1.1
+      object.assign: 4.1.7
+      own-keys: 1.0.1
+      regexp.prototype.flags: 1.5.4
+      safe-array-concat: 1.1.3
+      safe-push-apply: 1.0.0
+      safe-regex-test: 1.1.0
+      set-proto: 1.0.0
+      stop-iteration-iterator: 1.1.0
+      string.prototype.trim: 1.2.10
+      string.prototype.trimend: 1.0.9
+      string.prototype.trimstart: 1.0.8
+      typed-array-buffer: 1.0.3
+      typed-array-byte-length: 1.0.3
+      typed-array-byte-offset: 1.0.4
+      typed-array-length: 1.0.7
+      unbox-primitive: 1.1.0
+      which-typed-array: 1.1.20
+
+  es-define-property@1.0.1: {}
+
+  es-errors@1.3.0: {}
+
+  es-get-iterator@1.1.3:
+    dependencies:
+      call-bind: 1.0.9
+      get-intrinsic: 1.3.0
+      has-symbols: 1.1.0
+      is-arguments: 1.1.1
+      is-map: 2.0.3
+      is-set: 2.0.3
+      is-string: 1.1.1
+      isarray: 2.0.5
+      stop-iteration-iterator: 1.1.0
+
+  es-iterator-helpers@1.3.3:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-errors: 1.3.0
+      es-set-tostringtag: 2.1.0
+      function-bind: 1.1.2
+      get-intrinsic: 1.3.0
+      globalthis: 1.0.4
+      gopd: 1.2.0
+      has-property-descriptors: 1.0.2
+      has-proto: 1.2.0
+      has-symbols: 1.1.0
+      internal-slot: 1.1.0
+      iterator.prototype: 1.1.5
+      math-intrinsics: 1.1.0
+
+  es-module-lexer@1.7.0: {}
+
+  es-module-lexer@2.1.0: {}
+
+  es-object-atoms@1.1.1:
+    dependencies:
+      es-errors: 1.3.0
+
+  es-set-tostringtag@2.1.0:
+    dependencies:
+      es-errors: 1.3.0
+      get-intrinsic: 1.3.0
+      has-tostringtag: 1.0.2
+      hasown: 2.0.2
+
+  es-shim-unscopables@1.1.0:
+    dependencies:
+      hasown: 2.0.2
+
+  es-to-primitive@1.3.0:
+    dependencies:
+      is-callable: 1.2.7
+      is-date-object: 1.1.0
+      is-symbol: 1.1.1
+
+  es6-promise@3.3.1: {}
+
+  esbuild@0.27.3:
+    optionalDependencies:
+      '@esbuild/aix-ppc64': 0.27.3
+      '@esbuild/android-arm': 0.27.3
+      '@esbuild/android-arm64': 0.27.3
+      '@esbuild/android-x64': 0.27.3
+      '@esbuild/darwin-arm64': 0.27.3
+      '@esbuild/darwin-x64': 0.27.3
+      '@esbuild/freebsd-arm64': 0.27.3
+      '@esbuild/freebsd-x64': 0.27.3
+      '@esbuild/linux-arm': 0.27.3
+      '@esbuild/linux-arm64': 0.27.3
+      '@esbuild/linux-ia32': 0.27.3
+      '@esbuild/linux-loong64': 0.27.3
+      '@esbuild/linux-mips64el': 0.27.3
+      '@esbuild/linux-ppc64': 0.27.3
+      '@esbuild/linux-riscv64': 0.27.3
+      '@esbuild/linux-s390x': 0.27.3
+      '@esbuild/linux-x64': 0.27.3
+      '@esbuild/netbsd-arm64': 0.27.3
+      '@esbuild/netbsd-x64': 0.27.3
+      '@esbuild/openbsd-arm64': 0.27.3
+      '@esbuild/openbsd-x64': 0.27.3
+      '@esbuild/openharmony-arm64': 0.27.3
+      '@esbuild/sunos-x64': 0.27.3
+      '@esbuild/win32-arm64': 0.27.3
+      '@esbuild/win32-ia32': 0.27.3
+      '@esbuild/win32-x64': 0.27.3
+
+  escalade@3.2.0: {}
+
+  escape-html@1.0.3: {}
+
+  escape-string-regexp@1.0.5: {}
+
+  escape-string-regexp@4.0.0: {}
+
+  eslint-config-prettier@10.1.8(eslint@9.39.4(jiti@2.7.0)):
+    dependencies:
+      eslint: 9.39.4(jiti@2.7.0)
+
+  eslint-import-context@0.1.9(unrs-resolver@1.11.1):
+    dependencies:
+      get-tsconfig: 4.14.0
+      stable-hash-x: 0.2.0
+    optionalDependencies:
+      unrs-resolver: 1.11.1
+
+  eslint-import-resolver-alias@1.1.2(eslint-plugin-import@2.32.0):
+    dependencies:
+      eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.61.1(eslint@9.39.4(jiti@2.7.0))(typescript@6.0.2))(eslint-import-resolver-typescript@4.4.5)(eslint@9.39.4(jiti@2.7.0))
+
+  eslint-import-resolver-node@0.3.10:
+    dependencies:
+      debug: 3.2.7
+      is-core-module: 2.16.1
+      resolve: 2.0.0-next.6
+    transitivePeerDependencies:
+      - supports-color
+
+  eslint-import-resolver-typescript@4.4.5(eslint-plugin-import@2.32.0)(eslint@9.39.4(jiti@2.7.0)):
+    dependencies:
+      debug: 4.4.3
+      eslint: 9.39.4(jiti@2.7.0)
+      eslint-import-context: 0.1.9(unrs-resolver@1.11.1)
+      get-tsconfig: 4.14.0
+      is-bun-module: 2.0.0
+      stable-hash-x: 0.2.0
+      tinyglobby: 0.2.17
+      unrs-resolver: 1.11.1
+    optionalDependencies:
+      eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.61.1(eslint@9.39.4(jiti@2.7.0))(typescript@6.0.2))(eslint-import-resolver-typescript@4.4.5)(eslint@9.39.4(jiti@2.7.0))
+    transitivePeerDependencies:
+      - supports-color
+
+  eslint-module-utils@2.12.1(@typescript-eslint/parser@8.61.1(eslint@9.39.4(jiti@2.7.0))(typescript@6.0.2))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@4.4.5)(eslint@9.39.4(jiti@2.7.0)):
+    dependencies:
+      debug: 3.2.7
+    optionalDependencies:
+      '@typescript-eslint/parser': 8.61.1(eslint@9.39.4(jiti@2.7.0))(typescript@6.0.2)
+      eslint: 9.39.4(jiti@2.7.0)
+      eslint-import-resolver-node: 0.3.10
+      eslint-import-resolver-typescript: 4.4.5(eslint-plugin-import@2.32.0)(eslint@9.39.4(jiti@2.7.0))
+    transitivePeerDependencies:
+      - supports-color
+
+  eslint-plugin-eslint-comments@3.2.0(eslint@9.39.4(jiti@2.7.0)):
+    dependencies:
+      escape-string-regexp: 1.0.5
+      eslint: 9.39.4(jiti@2.7.0)
+      ignore: 5.2.4
+
+  eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.61.1(eslint@9.39.4(jiti@2.7.0))(typescript@6.0.2))(eslint-import-resolver-typescript@4.4.5)(eslint@9.39.4(jiti@2.7.0)):
+    dependencies:
+      '@rtsao/scc': 1.1.0
+      array-includes: 3.1.9
+      array.prototype.findlastindex: 1.2.6
+      array.prototype.flat: 1.3.3
+      array.prototype.flatmap: 1.3.3
+      debug: 3.2.7
+      doctrine: 2.1.0
+      eslint: 9.39.4(jiti@2.7.0)
+      eslint-import-resolver-node: 0.3.10
+      eslint-module-utils: 2.12.1(@typescript-eslint/parser@8.61.1(eslint@9.39.4(jiti@2.7.0))(typescript@6.0.2))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@4.4.5)(eslint@9.39.4(jiti@2.7.0))
+      hasown: 2.0.2
+      is-core-module: 2.16.1
+      is-glob: 4.0.3
+      minimatch: 3.1.5
+      object.fromentries: 2.0.8
+      object.groupby: 1.0.3
+      object.values: 1.2.1
+      semver: 6.3.1
+      string.prototype.trimend: 1.0.9
+      tsconfig-paths: 3.15.0
+    optionalDependencies:
+      '@typescript-eslint/parser': 8.61.1(eslint@9.39.4(jiti@2.7.0))(typescript@6.0.2)
+    transitivePeerDependencies:
+      - eslint-import-resolver-typescript
+      - eslint-import-resolver-webpack
+      - supports-color
+
+  eslint-plugin-jsx-a11y@6.10.2(eslint@9.39.4(jiti@2.7.0)):
+    dependencies:
+      aria-query: 5.3.2
+      array-includes: 3.1.9
+      array.prototype.flatmap: 1.3.3
+      ast-types-flow: 0.0.8
+      axe-core: 4.11.2
+      axobject-query: 4.1.0
+      damerau-levenshtein: 1.0.8
+      emoji-regex: 9.2.2
+      eslint: 9.39.4(jiti@2.7.0)
+      hasown: 2.0.2
+      jsx-ast-utils: 3.3.5
+      language-tags: 1.0.9
+      minimatch: 3.1.5
+      object.fromentries: 2.0.8
+      safe-regex-test: 1.1.0
+      string.prototype.includes: 2.0.1
+
+  eslint-plugin-promise@7.3.0(eslint@9.39.4(jiti@2.7.0)):
+    dependencies:
+      '@eslint-community/eslint-utils': 4.9.1(eslint@9.39.4(jiti@2.7.0))
+      eslint: 9.39.4(jiti@2.7.0)
+
+  eslint-plugin-react-hooks@7.1.1(eslint@9.39.4(jiti@2.7.0)):
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/parser': 7.29.0
+      eslint: 9.39.4(jiti@2.7.0)
+      hermes-parser: 0.25.1
+      zod: 4.3.6
+      zod-validation-error: 4.0.2(zod@4.3.6)
+    transitivePeerDependencies:
+      - supports-color
+
+  eslint-plugin-react@7.37.5(eslint@9.39.4(jiti@2.7.0)):
+    dependencies:
+      array-includes: 3.1.9
+      array.prototype.findlast: 1.2.5
+      array.prototype.flatmap: 1.3.3
+      array.prototype.tosorted: 1.1.4
+      doctrine: 2.1.0
+      es-iterator-helpers: 1.3.3
+      eslint: 9.39.4(jiti@2.7.0)
+      estraverse: 5.3.0
+      hasown: 2.0.2
+      jsx-ast-utils: 3.3.5
+      minimatch: 3.1.5
+      object.entries: 1.1.9
+      object.fromentries: 2.0.8
+      object.values: 1.2.1
+      prop-types: 15.8.1
+      resolve: 2.0.0-next.6
+      semver: 6.3.1
+      string.prototype.matchall: 4.0.12
+      string.prototype.repeat: 1.0.0
+
+  eslint-plugin-regex@1.10.0(eslint@9.39.4(jiti@2.7.0)):
+    dependencies:
+      eslint: 9.39.4(jiti@2.7.0)
+
+  eslint-plugin-storybook@10.4.6(eslint@9.39.4(jiti@2.7.0))(storybook@10.4.2(@testing-library/dom@9.3.4)(@types/react@17.0.75)(prettier@3.8.3)(react-dom@17.0.2(react@17.0.2))(react@17.0.2))(typescript@6.0.2):
+    dependencies:
+      '@typescript-eslint/utils': 8.60.1(eslint@9.39.4(jiti@2.7.0))(typescript@6.0.2)
+      eslint: 9.39.4(jiti@2.7.0)
+      storybook: 10.4.2(@testing-library/dom@9.3.4)(@types/react@17.0.75)(prettier@3.8.3)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+    transitivePeerDependencies:
+      - supports-color
+      - typescript
+
+  eslint-scope@5.1.1:
+    dependencies:
+      esrecurse: 4.3.0
+      estraverse: 4.3.0
+
+  eslint-scope@8.4.0:
+    dependencies:
+      esrecurse: 4.3.0
+      estraverse: 5.3.0
+
+  eslint-visitor-keys@3.4.3: {}
+
+  eslint-visitor-keys@4.2.1: {}
+
+  eslint-visitor-keys@5.0.1: {}
+
+  eslint@9.39.4(jiti@2.7.0):
+    dependencies:
+      '@eslint-community/eslint-utils': 4.9.1(eslint@9.39.4(jiti@2.7.0))
+      '@eslint-community/regexpp': 4.12.2
+      '@eslint/config-array': 0.21.2
+      '@eslint/config-helpers': 0.4.2
+      '@eslint/core': 0.17.0
+      '@eslint/eslintrc': 3.3.5
+      '@eslint/js': 9.39.4
+      '@eslint/plugin-kit': 0.4.1
+      '@humanfs/node': 0.16.7
+      '@humanwhocodes/module-importer': 1.0.1
+      '@humanwhocodes/retry': 0.4.3
+      '@types/estree': 1.0.8
+      ajv: 6.14.0
+      chalk: 4.1.2
+      cross-spawn: 7.0.6
+      debug: 4.4.3
+      escape-string-regexp: 4.0.0
+      eslint-scope: 8.4.0
+      eslint-visitor-keys: 4.2.1
+      espree: 10.4.0
+      esquery: 1.7.0
+      esutils: 2.0.3
+      fast-deep-equal: 3.1.3
+      file-entry-cache: 8.0.0
+      find-up: 5.0.0
+      glob-parent: 6.0.2
+      ignore: 5.2.4
+      imurmurhash: 0.1.4
+      is-glob: 4.0.3
+      json-stable-stringify-without-jsonify: 1.0.1
+      lodash.merge: 4.6.2
+      minimatch: 3.1.5
+      natural-compare: 1.4.0
+      optionator: 0.9.3
+    optionalDependencies:
+      jiti: 2.7.0
+    transitivePeerDependencies:
+      - supports-color
+
+  espree@10.4.0:
+    dependencies:
+      acorn: 8.16.0
+      acorn-jsx: 5.3.2(acorn@8.16.0)
+      eslint-visitor-keys: 4.2.1
+
+  esprima@4.0.1: {}
+
+  esquery@1.7.0:
+    dependencies:
+      estraverse: 5.3.0
+
+  esrecurse@4.3.0:
+    dependencies:
+      estraverse: 5.3.0
+
+  estraverse@4.3.0: {}
+
+  estraverse@5.3.0: {}
+
+  estree-walker@2.0.2: {}
+
+  estree-walker@3.0.3:
+    dependencies:
+      '@types/estree': 1.0.8
+
+  esutils@2.0.3: {}
+
+  etag@1.8.1: {}
+
+  eventemitter3@4.0.7: {}
+
+  eventemitter3@5.0.4: {}
+
+  events@3.3.0: {}
+
+  expect-type@1.3.0: {}
+
+  express@4.22.1:
+    dependencies:
+      accepts: 1.3.8
+      array-flatten: 1.1.1
+      body-parser: 1.20.4
+      content-disposition: 0.5.4
+      content-type: 1.0.5
+      cookie: 0.7.2
+      cookie-signature: 1.0.6
+      debug: 2.6.9
+      depd: 2.0.0
+      encodeurl: 2.0.0
+      escape-html: 1.0.3
+      etag: 1.8.1
+      finalhandler: 1.3.2
+      fresh: 0.5.2
+      http-errors: 2.0.1
+      merge-descriptors: 1.0.3
+      methods: 1.1.2
+      on-finished: 2.4.1
+      parseurl: 1.3.3
+      path-to-regexp: 0.1.12
+      proxy-addr: 2.0.7
+      qs: 6.14.1
+      range-parser: 1.2.1
+      safe-buffer: 5.2.1
+      send: 0.19.2
+      serve-static: 1.16.3
+      setprototypeof: 1.2.0
+      statuses: 2.0.2
+      type-is: 1.6.18
+      utils-merge: 1.0.1
+      vary: 1.1.2
+    transitivePeerDependencies:
+      - supports-color
+
+  exsolve@1.0.8: {}
+
+  fast-copy@3.0.2: {}
+
+  fast-deep-equal@3.1.3: {}
+
+  fast-defer@1.1.9: {}
+
+  fast-glob@3.3.2:
+    dependencies:
+      '@nodelib/fs.stat': 2.0.5
+      '@nodelib/fs.walk': 1.2.8
+      glob-parent: 5.1.2
+      merge2: 1.4.1
+      micromatch: 4.0.8
+
+  fast-json-parse@1.0.3: {}
+
+  fast-json-patch@3.1.1: {}
+
+  fast-json-stable-stringify@2.1.0: {}
+
+  fast-levenshtein@2.0.6: {}
+
+  fast-safe-stringify@2.1.1: {}
+
+  fast-string-truncated-width@3.0.3: {}
+
+  fast-string-width@3.0.2:
+    dependencies:
+      fast-string-truncated-width: 3.0.3
+
+  fast-uri@3.1.0: {}
+
+  fast-wrap-ansi@0.2.2:
+    dependencies:
+      fast-string-width: 3.0.2
+
+  fastest-levenshtein@1.0.12: {}
+
+  fastq@1.15.0:
+    dependencies:
+      reusify: 1.0.4
+
+  faye-websocket@0.11.4:
+    dependencies:
+      websocket-driver: 0.7.4
+
+  fdir@6.5.0(picomatch@4.0.4):
+    optionalDependencies:
+      picomatch: 4.0.4
+
+  file-entry-cache@8.0.0:
+    dependencies:
+      flat-cache: 4.0.1
+
+  file-saver@1.3.8: {}
+
+  file-saver@2.0.5: {}
+
+  filesize-parser@1.5.0: {}
+
+  filesize@10.1.6: {}
+
+  fill-range@7.1.1:
+    dependencies:
+      to-regex-range: 5.0.1
+
+  finalhandler@1.3.2:
+    dependencies:
+      debug: 2.6.9
+      encodeurl: 2.0.0
+      escape-html: 1.0.3
+      on-finished: 2.4.1
+      parseurl: 1.3.3
+      statuses: 2.0.2
+      unpipe: 1.0.0
+    transitivePeerDependencies:
+      - supports-color
+
+  find-cache-dir@3.3.2:
+    dependencies:
+      commondir: 1.0.1
+      make-dir: 3.1.0
+      pkg-dir: 4.2.0
+
+  find-cache-dir@4.0.0:
+    dependencies:
+      common-path-prefix: 3.0.0
+      pkg-dir: 7.0.0
+
+  find-root@1.1.0: {}
+
+  find-up@4.1.0:
+    dependencies:
+      locate-path: 5.0.0
+      path-exists: 4.0.0
+
+  find-up@5.0.0:
+    dependencies:
+      locate-path: 6.0.0
+      path-exists: 4.0.0
+
+  find-up@6.3.0:
+    dependencies:
+      locate-path: 7.2.0
+      path-exists: 5.0.0
+
+  flat-cache@3.0.4:
+    dependencies:
+      flatted: 3.4.2
+      rimraf: 3.0.2
+
+  flat-cache@4.0.1:
+    dependencies:
+      flatted: 3.4.2
+      keyv: 4.5.4
+
+  flat@5.0.2: {}
+
+  flatted@3.4.2: {}
+
+  focus-lock@0.11.2:
+    dependencies:
+      tslib: 2.8.1
+
+  follow-redirects@1.16.0: {}
+
+  for-each@0.3.5:
+    dependencies:
+      is-callable: 1.2.7
+
+  foreground-child@3.1.1:
+    dependencies:
+      cross-spawn: 7.0.6
+      signal-exit: 4.1.0
+
+  fork-ts-checker-webpack-plugin@9.1.0(typescript@6.0.2)(webpack@5.107.2):
+    dependencies:
+      '@babel/code-frame': 7.29.0
+      chalk: 4.1.2
+      chokidar: 4.0.3
+      cosmiconfig: 8.2.0
+      deepmerge: 4.3.1
+      fs-extra: 10.1.0
+      memfs: 3.6.0
+      minimatch: 3.1.5
+      node-abort-controller: 3.1.1
+      schema-utils: 3.3.0
+      semver: 7.7.4
+      tapable: 2.3.3
+      typescript: 6.0.2
+      webpack: 5.107.2(@swc/core@1.15.11)(cssnano@8.0.1(postcss@8.5.15))(esbuild@0.27.3)(postcss@8.5.15)(webpack-cli@6.0.1)
+
+  form-data@4.0.5:
+    dependencies:
+      asynckit: 0.4.0
+      combined-stream: 1.0.8
+      es-set-tostringtag: 2.1.0
+      hasown: 2.0.2
+      mime-types: 2.1.35
+
+  formik@2.4.9(@types/react@17.0.75)(react@17.0.2):
+    dependencies:
+      '@types/hoist-non-react-statics': 3.3.7(@types/react@17.0.75)
+      deepmerge: 2.2.1
+      hoist-non-react-statics: 3.3.2
+      lodash: 4.18.1
+      lodash-es: 4.17.21
+      react: 17.0.2
+      react-fast-compare: 2.0.4
+      tiny-warning: 1.0.3
+      tslib: 2.8.1
+    transitivePeerDependencies:
+      - '@types/react'
+
+  forwarded@0.2.0: {}
+
+  fraction.js@5.3.4: {}
+
+  fresh@0.5.2: {}
+
+  fs-extra@10.1.0:
+    dependencies:
+      graceful-fs: 4.2.11
+      jsonfile: 6.2.0
+      universalify: 2.0.1
+
+  fs-monkey@1.0.5: {}
+
+  fs.realpath@1.0.0: {}
+
+  fsevents@2.3.3:
+    optional: true
+
+  function-bind@1.1.2: {}
+
+  function.prototype.name@1.1.8:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      define-properties: 1.2.1
+      functions-have-names: 1.2.3
+      hasown: 2.0.2
+      is-callable: 1.2.7
+
+  functions-have-names@1.2.3: {}
+
+  gensync@1.0.0-beta.2: {}
+
+  get-caller-file@2.0.5: {}
+
+  get-east-asian-width@1.6.0: {}
+
+  get-intrinsic@1.3.0:
+    dependencies:
+      call-bind-apply-helpers: 1.0.2
+      es-define-property: 1.0.1
+      es-errors: 1.3.0
+      es-object-atoms: 1.1.1
+      function-bind: 1.1.2
+      get-proto: 1.0.1
+      gopd: 1.2.0
+      has-symbols: 1.1.0
+      hasown: 2.0.2
+      math-intrinsics: 1.1.0
+
+  get-nonce@1.0.1: {}
+
+  get-proto@1.0.1:
+    dependencies:
+      dunder-proto: 1.0.1
+      es-object-atoms: 1.1.1
+
+  get-symbol-description@1.1.0:
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      get-intrinsic: 1.3.0
+
+  get-tsconfig@4.14.0:
+    dependencies:
+      resolve-pkg-maps: 1.0.0
+
+  get-user-locale@2.3.1:
+    dependencies:
+      '@types/lodash.memoize': 4.1.9
+      lodash.memoize: 4.1.2
+
+  giget@3.2.0: {}
+
+  glob-parent@5.1.2:
+    dependencies:
+      is-glob: 4.0.3
+
+  glob-parent@6.0.2:
+    dependencies:
+      is-glob: 4.0.3
+
+  glob-to-regex.js@1.2.0(tslib@2.8.1):
+    dependencies:
+      tslib: 2.8.1
+
+  glob-to-regexp@0.4.1: {}
+
+  glob@7.1.6:
+    dependencies:
+      fs.realpath: 1.0.0
+      inflight: 1.0.6
+      inherits: 2.0.4
+      minimatch: 3.1.5
+      once: 1.4.0
+      path-is-absolute: 1.0.1
+
+  glob@7.2.3:
+    dependencies:
+      fs.realpath: 1.0.0
+      inflight: 1.0.6
+      inherits: 2.0.4
+      minimatch: 3.1.5
+      once: 1.4.0
+      path-is-absolute: 1.0.1
+
+  globals@11.12.0: {}
+
+  globals@14.0.0: {}
+
+  globals@15.15.0: {}
+
+  globalthis@1.0.4:
+    dependencies:
+      define-properties: 1.2.1
+      gopd: 1.2.0
+
+  globby@13.2.2:
+    dependencies:
+      dir-glob: 3.0.1
+      fast-glob: 3.3.2
+      ignore: 5.2.4
+      merge2: 1.4.1
+      slash: 4.0.0
+
+  globby@6.1.0:
+    dependencies:
+      array-union: 1.0.2
+      glob: 7.2.3
+      object-assign: 4.1.1
+      pify: 2.3.0
+      pinkie-promise: 2.0.1
+
+  globrex@0.1.2: {}
+
+  gopd@1.2.0: {}
+
+  graceful-fs@4.2.11: {}
+
+  graphql@16.14.1: {}
+
+  growly@1.3.0: {}
+
+  handle-thing@2.0.1: {}
+
+  has-bigints@1.0.2: {}
+
+  has-flag@4.0.0: {}
+
+  has-property-descriptors@1.0.2:
+    dependencies:
+      es-define-property: 1.0.1
+
+  has-proto@1.2.0:
+    dependencies:
+      dunder-proto: 1.0.1
+
+  has-symbols@1.1.0: {}
+
+  has-tostringtag@1.0.2:
+    dependencies:
+      has-symbols: 1.1.0
+
+  hasown@2.0.2:
+    dependencies:
+      function-bind: 1.1.2
+
+  hast-util-to-html@9.0.5:
+    dependencies:
+      '@types/hast': 3.0.4
+      '@types/unist': 3.0.3
+      ccount: 2.0.1
+      comma-separated-tokens: 2.0.3
+      hast-util-whitespace: 3.0.0
+      html-void-elements: 3.0.0
+      mdast-util-to-hast: 13.2.0
+      property-information: 7.0.0
+      space-separated-tokens: 2.0.2
+      stringify-entities: 4.0.4
+      zwitch: 2.0.4
+
+  hast-util-whitespace@3.0.0:
+    dependencies:
+      '@types/hast': 3.0.4
+
+  he@1.2.0: {}
+
+  headers-polyfill@5.0.1:
+    dependencies:
+      '@types/set-cookie-parser': 2.4.10
+      set-cookie-parser: 3.1.0
+
+  hermes-estree@0.25.1: {}
+
+  hermes-parser@0.25.1:
+    dependencies:
+      hermes-estree: 0.25.1
+
+  hoist-non-react-statics@3.3.2:
+    dependencies:
+      react-is: 16.13.1
+
+  hpack.js@2.1.6:
+    dependencies:
+      inherits: 2.0.4
+      obuf: 1.1.2
+      readable-stream: 2.3.8
+      wbuf: 1.7.3
+
+  html-encoding-sniffer@4.0.0:
+    dependencies:
+      whatwg-encoding: 3.1.1
+
+  html-entities@2.3.3: {}
+
+  html-escaper@2.0.2: {}
+
+  html-loader@4.1.0(webpack@5.107.2):
+    dependencies:
+      html-minifier-terser: 6.1.0
+      parse5: 7.1.2
+      webpack: 5.107.2(@swc/core@1.15.11)(cssnano@8.0.1(postcss@8.5.15))(esbuild@0.27.3)(postcss@8.5.15)(webpack-cli@6.0.1)
+
+  html-loader@5.1.0(webpack@5.107.2):
+    dependencies:
+      html-minifier-terser: 7.2.0
+      parse5: 7.1.2
+      webpack: 5.107.2(@swc/core@1.15.11)(cssnano@8.0.1(postcss@8.5.15))(esbuild@0.27.3)(postcss@8.5.15)(webpack-cli@6.0.1)
+
+  html-minifier-terser@6.1.0:
+    dependencies:
+      camel-case: 4.1.2
+      clean-css: 5.3.2
+      commander: 8.3.0
+      he: 1.2.0
+      param-case: 3.0.4
+      relateurl: 0.2.7
+      terser: 5.44.1
+
+  html-minifier-terser@7.2.0:
+    dependencies:
+      camel-case: 4.1.2
+      clean-css: 5.3.2
+      commander: 10.0.1
+      entities: 4.5.0
+      param-case: 3.0.4
+      relateurl: 0.2.7
+      terser: 5.44.1
+
+  html-parse-stringify@3.0.1:
+    dependencies:
+      void-elements: 3.1.0
+
+  html-void-elements@3.0.0: {}
+
+  html-webpack-plugin@5.5.3(webpack@5.107.2):
+    dependencies:
+      '@types/html-minifier-terser': 6.1.0
+      html-minifier-terser: 6.1.0
+      lodash: 4.18.1
+      pretty-error: 4.0.0
+      tapable: 2.3.3
+      webpack: 5.107.2(@swc/core@1.15.11)(cssnano@8.0.1(postcss@8.5.15))(esbuild@0.27.3)(postcss@8.5.15)(webpack-cli@6.0.1)
+
+  htmlparser2@6.1.0:
+    dependencies:
+      domelementtype: 2.3.0
+      domhandler: 4.3.1
+      domutils: 2.8.0
+      entities: 2.2.0
+
+  htmlparser2@8.0.2:
+    dependencies:
+      domelementtype: 2.3.0
+      domhandler: 5.0.3
+      domutils: 3.1.0
+      entities: 4.5.0
+
+  http-deceiver@1.2.7: {}
+
+  http-errors@1.6.3:
+    dependencies:
+      depd: 1.1.2
+      inherits: 2.0.3
+      setprototypeof: 1.1.0
+      statuses: 1.5.0
+
+  http-errors@2.0.1:
+    dependencies:
+      depd: 2.0.0
+      inherits: 2.0.4
+      setprototypeof: 1.2.0
+      statuses: 2.0.2
+      toidentifier: 1.0.1
+
+  http-parser-js@0.5.5: {}
+
+  http-proxy-agent@7.0.2:
+    dependencies:
+      agent-base: 7.1.4
+      debug: 4.4.3
+    transitivePeerDependencies:
+      - supports-color
+
+  http-proxy-middleware@2.0.9(@types/express@4.17.25):
+    dependencies:
+      '@types/http-proxy': 1.17.11
+      http-proxy: 1.18.1
+      is-glob: 4.0.3
+      is-plain-obj: 3.0.0
+      micromatch: 4.0.8
+    optionalDependencies:
+      '@types/express': 4.17.25
+    transitivePeerDependencies:
+      - debug
+
+  http-proxy@1.18.1:
+    dependencies:
+      eventemitter3: 4.0.7
+      follow-redirects: 1.16.0
+      requires-port: 1.0.0
+    transitivePeerDependencies:
+      - debug
+
+  http-vary@1.0.3: {}
+
+  http2-client@1.3.5: {}
+
+  https-proxy-agent@5.0.1:
+    dependencies:
+      agent-base: 6.0.2
+      debug: 4.4.3
+    transitivePeerDependencies:
+      - supports-color
+
+  https-proxy-agent@7.0.6:
+    dependencies:
+      agent-base: 7.1.4
+      debug: 4.4.3
+    transitivePeerDependencies:
+      - supports-color
+
+  husky@8.0.3: {}
+
+  hyperdyperid@1.2.0: {}
+
+  i18next-browser-languagedetector@6.1.2:
+    dependencies:
+      '@babel/runtime': 7.26.0
+
+  i18next-http-backend@3.0.4:
+    dependencies:
+      cross-fetch: 4.1.0
+    transitivePeerDependencies:
+      - encoding
+
+  i18next@21.10.0:
+    dependencies:
+      '@babel/runtime': 7.26.0
+
+  iconv-lite@0.4.24:
+    dependencies:
+      safer-buffer: 2.1.2
+
+  iconv-lite@0.6.3:
+    dependencies:
+      safer-buffer: 2.1.2
+
+  icss-utils@5.1.0(postcss@8.5.15):
+    dependencies:
+      postcss: 8.5.15
+
+  ieee754@1.2.1: {}
+
+  ignore@5.2.4: {}
+
+  ignore@7.0.5: {}
+
+  image-size@0.5.5:
+    optional: true
+
+  import-fresh@3.3.0:
+    dependencies:
+      parent-module: 1.0.1
+      resolve-from: 4.0.0
+
+  import-local@3.0.3:
+    dependencies:
+      pkg-dir: 4.2.0
+      resolve-cwd: 3.0.0
+
+  imurmurhash@0.1.4: {}
+
+  indent-string@4.0.0: {}
+
+  inflight@1.0.6:
+    dependencies:
+      once: 1.4.0
+      wrappy: 1.0.2
+
+  inherits@2.0.3: {}
+
+  inherits@2.0.4: {}
+
+  internal-slot@1.1.0:
+    dependencies:
+      es-errors: 1.3.0
+      hasown: 2.0.2
+      side-channel: 1.1.0
+
+  interpret@3.1.1: {}
+
+  ipaddr.js@1.9.1: {}
+
+  ipaddr.js@2.3.0: {}
+
+  is-arguments@1.1.1:
+    dependencies:
+      call-bind: 1.0.9
+      has-tostringtag: 1.0.2
+
+  is-array-buffer@3.0.5:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      get-intrinsic: 1.3.0
+
+  is-arrayish@0.2.1: {}
+
+  is-async-function@2.0.0:
+    dependencies:
+      has-tostringtag: 1.0.2
+
+  is-bigint@1.1.0:
+    dependencies:
+      has-bigints: 1.0.2
+
+  is-binary-path@2.1.0:
+    dependencies:
+      binary-extensions: 2.2.0
+
+  is-boolean-object@1.2.2:
+    dependencies:
+      call-bound: 1.0.4
+      has-tostringtag: 1.0.2
+
+  is-bun-module@2.0.0:
+    dependencies:
+      semver: 7.7.4
+
+  is-callable@1.2.7: {}
+
+  is-core-module@2.16.1:
+    dependencies:
+      hasown: 2.0.2
+
+  is-data-view@1.0.2:
+    dependencies:
+      call-bound: 1.0.4
+      get-intrinsic: 1.3.0
+      is-typed-array: 1.1.15
+
+  is-date-object@1.1.0:
+    dependencies:
+      call-bound: 1.0.4
+      has-tostringtag: 1.0.2
+
+  is-docker@2.2.1: {}
+
+  is-docker@3.0.0: {}
+
+  is-extglob@2.1.1: {}
+
+  is-finalizationregistry@1.1.1:
+    dependencies:
+      call-bound: 1.0.4
+
+  is-fullwidth-code-point@3.0.0: {}
+
+  is-fullwidth-code-point@5.1.0:
+    dependencies:
+      get-east-asian-width: 1.6.0
+
+  is-generator-function@1.0.10:
+    dependencies:
+      has-tostringtag: 1.0.2
+
+  is-glob@4.0.3:
+    dependencies:
+      is-extglob: 2.1.1
+
+  is-in-ssh@1.0.0: {}
+
+  is-inside-container@1.0.0:
+    dependencies:
+      is-docker: 3.0.0
+
+  is-map@2.0.3: {}
+
+  is-negative-zero@2.0.3: {}
+
+  is-network-error@1.3.0: {}
+
+  is-node-process@1.2.0: {}
+
+  is-number-object@1.1.1:
+    dependencies:
+      call-bound: 1.0.4
+      has-tostringtag: 1.0.2
+
+  is-number@7.0.0: {}
+
+  is-path-cwd@2.2.0: {}
+
+  is-path-in-cwd@2.1.0:
+    dependencies:
+      is-path-inside: 2.1.0
+
+  is-path-inside@2.1.0:
+    dependencies:
+      path-is-inside: 1.0.2
+
+  is-plain-obj@3.0.0: {}
+
+  is-plain-object@2.0.4:
+    dependencies:
+      isobject: 3.0.1
+
+  is-plain-object@5.0.0: {}
+
+  is-potential-custom-element-name@1.0.1: {}
+
+  is-regex@1.2.1:
+    dependencies:
+      call-bound: 1.0.4
+      gopd: 1.2.0
+      has-tostringtag: 1.0.2
+      hasown: 2.0.2
+
+  is-set@2.0.3: {}
+
+  is-shared-array-buffer@1.0.4:
+    dependencies:
+      call-bound: 1.0.4
+
+  is-string@1.1.1:
+    dependencies:
+      call-bound: 1.0.4
+      has-tostringtag: 1.0.2
+
+  is-symbol@1.1.1:
+    dependencies:
+      call-bound: 1.0.4
+      has-symbols: 1.1.0
+      safe-regex-test: 1.1.0
+
+  is-typed-array@1.1.15:
+    dependencies:
+      which-typed-array: 1.1.20
+
+  is-weakmap@2.0.2: {}
+
+  is-weakref@1.1.1:
+    dependencies:
+      call-bound: 1.0.4
+
+  is-weakset@2.0.4:
+    dependencies:
+      call-bound: 1.0.4
+      get-intrinsic: 1.3.0
+
+  is-what@3.14.1:
+    optional: true
+
+  is-what@4.1.16: {}
+
+  is-wsl@2.2.0:
+    dependencies:
+      is-docker: 2.2.1
+
+  is-wsl@3.1.0:
+    dependencies:
+      is-inside-container: 1.0.0
+
+  isarray@1.0.0: {}
+
+  isarray@2.0.5: {}
+
+  isexe@2.0.0: {}
+
+  isobject@3.0.1: {}
+
+  istanbul-lib-coverage@3.2.2: {}
+
+  istanbul-lib-report@3.0.1:
+    dependencies:
+      istanbul-lib-coverage: 3.2.2
+      make-dir: 4.0.0
+      supports-color: 7.2.0
+
+  istanbul-reports@3.2.0:
+    dependencies:
+      html-escaper: 2.0.2
+      istanbul-lib-report: 3.0.1
+
+  iterator.prototype@1.1.5:
+    dependencies:
+      define-data-property: 1.1.4
+      es-object-atoms: 1.1.1
+      get-intrinsic: 1.3.0
+      get-proto: 1.0.1
+      has-symbols: 1.1.0
+      set-function-name: 2.0.2
+
+  jest-worker@27.5.1:
+    dependencies:
+      '@types/node': 25.0.3
+      merge-stream: 2.0.0
+      supports-color: 8.1.1
+
+  jiti@1.18.2: {}
+
+  jiti@2.7.0: {}
+
+  jquery@3.6.0: {}
+
+  js-base64@3.7.2: {}
+
+  js-tokens@10.0.0: {}
+
+  js-tokens@4.0.0: {}
+
+  js-yaml@3.14.2:
+    dependencies:
+      argparse: 1.0.10
+      esprima: 4.0.1
+
+  js-yaml@4.1.1:
+    dependencies:
+      argparse: 2.0.1
+
+  js-yaml@4.2.0:
+    dependencies:
+      argparse: 2.0.1
+
+  jsdom@24.1.3:
+    dependencies:
+      cssstyle: 4.0.1
+      data-urls: 5.0.0
+      decimal.js: 10.4.3
+      form-data: 4.0.5
+      html-encoding-sniffer: 4.0.0
+      http-proxy-agent: 7.0.2
+      https-proxy-agent: 7.0.6
+      is-potential-custom-element-name: 1.0.1
+      nwsapi: 2.2.22
+      parse5: 7.1.2
+      rrweb-cssom: 0.7.1
+      saxes: 6.0.0
+      symbol-tree: 3.2.4
+      tough-cookie: 4.1.4
+      w3c-xmlserializer: 5.0.0
+      webidl-conversions: 7.0.0
+      whatwg-encoding: 3.1.1
+      whatwg-mimetype: 4.0.0
+      whatwg-url: 14.0.0
+      ws: 8.19.0
+      xml-name-validator: 5.0.0
+    transitivePeerDependencies:
+      - bufferutil
+      - supports-color
+      - utf-8-validate
+
+  jsesc@0.5.0: {}
+
+  jsesc@3.1.0: {}
+
+  json-buffer@3.0.1: {}
+
+  json-parse-even-better-errors@2.3.1: {}
+
+  json-schema-library@9.3.5:
+    dependencies:
+      '@sagold/json-pointer': 5.1.2
+      '@sagold/json-query': 6.2.0
+      deepmerge: 4.3.1
+      fast-copy: 3.0.2
+      fast-deep-equal: 3.1.3
+      smtp-address-parser: 1.0.10
+      valid-url: 1.0.9
+
+  json-schema-traverse@0.4.1: {}
+
+  json-schema-traverse@1.0.0: {}
+
+  json-schema@0.4.0: {}
+
+  json-stable-stringify-without-jsonify@1.0.1: {}
+
+  json-stable-stringify@1.0.1:
+    dependencies:
+      jsonify: 0.0.0
+
+  json5@1.0.2:
+    dependencies:
+      minimist: 1.2.8
+
+  json5@2.2.3: {}
+
+  jsonfile@6.2.0:
+    dependencies:
+      universalify: 2.0.1
+    optionalDependencies:
+      graceful-fs: 4.2.11
+
+  jsonify@0.0.0: {}
+
+  jsx-ast-utils@3.3.5:
+    dependencies:
+      array-includes: 3.1.9
+      array.prototype.flat: 1.3.3
+      object.assign: 4.1.7
+      object.values: 1.2.1
+
+  keyv@4.5.4:
+    dependencies:
+      json-buffer: 3.0.1
+
+  kind-of@6.0.3: {}
+
+  krustykrab@1.1.0: {}
+
+  kubernetes-types@1.30.0: {}
+
+  language-subtag-registry@0.3.21: {}
+
+  language-tags@1.0.9:
+    dependencies:
+      language-subtag-registry: 0.3.21
+
+  launch-editor@2.12.0:
+    dependencies:
+      picocolors: 1.1.1
+      shell-quote: 1.8.4
+
+  less@4.4.2:
+    dependencies:
+      copy-anything: 2.0.6
+      parse-node-version: 1.0.1
+      tslib: 2.8.1
+    optionalDependencies:
+      errno: 0.1.8
+      graceful-fs: 4.2.11
+      image-size: 0.5.5
+      make-dir: 2.1.0
+      mime: 1.6.0
+      needle: 3.3.1
+      source-map: 0.6.1
+    optional: true
+
+  levn@0.4.1:
+    dependencies:
+      prelude-ls: 1.2.1
+      type-check: 0.4.0
+
+  lezer-json5@2.0.2:
+    dependencies:
+      '@lezer/lr': 1.4.2
+    optional: true
+
+  lightningcss-android-arm64@1.32.0:
+    optional: true
+
+  lightningcss-darwin-arm64@1.32.0:
+    optional: true
+
+  lightningcss-darwin-x64@1.32.0:
+    optional: true
+
+  lightningcss-freebsd-x64@1.32.0:
+    optional: true
+
+  lightningcss-linux-arm-gnueabihf@1.32.0:
+    optional: true
+
+  lightningcss-linux-arm64-gnu@1.32.0:
+    optional: true
+
+  lightningcss-linux-arm64-musl@1.32.0:
+    optional: true
+
+  lightningcss-linux-x64-gnu@1.32.0:
+    optional: true
+
+  lightningcss-linux-x64-musl@1.32.0:
+    optional: true
+
+  lightningcss-win32-arm64-msvc@1.32.0:
+    optional: true
+
+  lightningcss-win32-x64-msvc@1.32.0:
+    optional: true
+
+  lightningcss@1.32.0:
+    dependencies:
+      detect-libc: 2.1.2
+    optionalDependencies:
+      lightningcss-android-arm64: 1.32.0
+      lightningcss-darwin-arm64: 1.32.0
+      lightningcss-darwin-x64: 1.32.0
+      lightningcss-freebsd-x64: 1.32.0
+      lightningcss-linux-arm-gnueabihf: 1.32.0
+      lightningcss-linux-arm64-gnu: 1.32.0
+      lightningcss-linux-arm64-musl: 1.32.0
+      lightningcss-linux-x64-gnu: 1.32.0
+      lightningcss-linux-x64-musl: 1.32.0
+      lightningcss-win32-arm64-msvc: 1.32.0
+      lightningcss-win32-x64-msvc: 1.32.0
+
+  lilconfig@2.1.0: {}
+
+  lilconfig@3.1.3: {}
+
+  lines-and-columns@1.2.4: {}
+
+  linkify-it@3.0.3:
+    dependencies:
+      uc.micro: 1.0.6
+
+  lint-staged@17.0.7:
+    dependencies:
+      listr2: 10.2.1
+      picomatch: 4.0.4
+      string-argv: 0.3.2
+      tinyexec: 1.2.4
+    optionalDependencies:
+      yaml: 2.9.0
+
+  listr2@10.2.1:
+    dependencies:
+      cli-truncate: 5.2.0
+      eventemitter3: 5.0.4
+      log-update: 6.1.0
+      rfdc: 1.4.1
+      wrap-ansi: 10.0.0
+
+  loader-runner@4.3.2: {}
+
+  loader-utils@1.4.2:
+    dependencies:
+      big.js: 5.2.2
+      emojis-list: 3.0.0
+      json5: 1.0.2
+
+  loader-utils@3.2.2: {}
+
+  locate-path@5.0.0:
+    dependencies:
+      p-locate: 4.1.0
+
+  locate-path@6.0.0:
+    dependencies:
+      p-locate: 5.0.0
+
+  locate-path@7.2.0:
+    dependencies:
+      p-locate: 6.0.0
+
+  lodash-es@4.17.21: {}
+
+  lodash-webpack-plugin@0.11.6(webpack@5.107.2):
+    dependencies:
+      lodash: 4.18.1
+      webpack: 5.107.2(@swc/core@1.15.11)(cssnano@8.0.1(postcss@8.5.15))(esbuild@0.27.3)(postcss@8.5.15)(webpack-cli@6.0.1)
+
+  lodash.debounce@4.0.8: {}
+
+  lodash.get@4.4.2: {}
+
+  lodash.isequal@4.5.0: {}
+
+  lodash.memoize@4.1.2: {}
+
+  lodash.merge@4.6.2: {}
+
+  lodash.uniq@4.5.0: {}
+
+  lodash@4.17.23: {}
+
+  lodash@4.18.1: {}
+
+  log-update@6.1.0:
+    dependencies:
+      ansi-escapes: 7.3.0
+      cli-cursor: 5.0.0
+      slice-ansi: 7.1.2
+      strip-ansi: 7.1.0
+      wrap-ansi: 9.0.2
+
+  loglevel@1.9.2: {}
+
+  loose-envify@1.4.0:
+    dependencies:
+      js-tokens: 4.0.0
+
+  loupe@3.2.1: {}
+
+  lower-case@2.0.2:
+    dependencies:
+      tslib: 2.8.1
+
+  lru-cache@5.1.1:
+    dependencies:
+      yallist: 3.1.1
+
+  lucide-react@0.577.0(react@17.0.2):
+    dependencies:
+      react: 17.0.2
+
+  lz-string@1.5.0: {}
+
+  magic-string@0.30.21:
+    dependencies:
+      '@jridgewell/sourcemap-codec': 1.5.5
+
+  magicast@0.5.2:
+    dependencies:
+      '@babel/parser': 7.29.0
+      '@babel/types': 7.29.0
+      source-map-js: 1.2.1
+
+  make-dir@2.1.0:
+    dependencies:
+      pify: 4.0.1
+      semver: 5.7.2
+    optional: true
+
+  make-dir@3.1.0:
+    dependencies:
+      semver: 6.3.1
+
+  make-dir@4.0.0:
+    dependencies:
+      semver: 7.7.4
+
+  make-event-props@1.6.2: {}
+
+  markdown-it@12.3.2:
+    dependencies:
+      argparse: 2.0.1
+      entities: 2.1.0
+      linkify-it: 3.0.3
+      mdurl: 1.0.1
+      uc.micro: 1.0.6
+
+  markdown-to-jsx@7.7.4(react@17.0.2):
+    dependencies:
+      react: 17.0.2
+
+  math-intrinsics@1.1.0: {}
+
+  mdast-util-to-hast@13.2.0:
+    dependencies:
+      '@types/hast': 3.0.4
+      '@types/mdast': 4.0.4
+      '@ungap/structured-clone': 1.3.0
+      devlop: 1.1.0
+      micromark-util-sanitize-uri: 2.0.1
+      trim-lines: 3.0.1
+      unist-util-position: 5.0.0
+      unist-util-visit: 5.0.0
+      vfile: 6.0.3
+
+  mdn-data@2.0.28: {}
+
+  mdn-data@2.0.30: {}
+
+  mdn-data@2.27.1: {}
+
+  mdurl@1.0.1: {}
+
+  media-typer@0.3.0: {}
+
+  memfs@3.6.0:
+    dependencies:
+      fs-monkey: 1.0.5
+
+  memfs@4.56.10(tslib@2.8.1):
+    dependencies:
+      '@jsonjoy.com/fs-core': 4.56.10(tslib@2.8.1)
+      '@jsonjoy.com/fs-fsa': 4.56.10(tslib@2.8.1)
+      '@jsonjoy.com/fs-node': 4.56.10(tslib@2.8.1)
+      '@jsonjoy.com/fs-node-builtins': 4.56.10(tslib@2.8.1)
+      '@jsonjoy.com/fs-node-to-fsa': 4.56.10(tslib@2.8.1)
+      '@jsonjoy.com/fs-node-utils': 4.56.10(tslib@2.8.1)
+      '@jsonjoy.com/fs-print': 4.56.10(tslib@2.8.1)
+      '@jsonjoy.com/fs-snapshot': 4.56.10(tslib@2.8.1)
+      '@jsonjoy.com/json-pack': 1.21.0(tslib@2.8.1)
+      '@jsonjoy.com/util': 1.9.0(tslib@2.8.1)
+      glob-to-regex.js: 1.2.0(tslib@2.8.1)
+      thingies: 2.5.0(tslib@2.8.1)
+      tree-dump: 1.1.0(tslib@2.8.1)
+      tslib: 2.8.1
+
+  memoize-one@6.0.0: {}
+
+  merge-descriptors@1.0.3: {}
+
+  merge-stream@2.0.0: {}
+
+  merge2@1.4.1: {}
+
+  methods@1.1.2: {}
+
+  micromark-util-character@2.1.1:
+    dependencies:
+      micromark-util-symbol: 2.0.1
+      micromark-util-types: 2.0.2
+
+  micromark-util-encode@2.0.1: {}
+
+  micromark-util-sanitize-uri@2.0.1:
+    dependencies:
+      micromark-util-character: 2.1.1
+      micromark-util-encode: 2.0.1
+      micromark-util-symbol: 2.0.1
+
+  micromark-util-symbol@2.0.1: {}
+
+  micromark-util-types@2.0.2: {}
+
+  micromatch@4.0.8:
+    dependencies:
+      braces: 3.0.3
+      picomatch: 2.3.1
+
+  mime-db@1.52.0: {}
+
+  mime-db@1.54.0: {}
+
+  mime-types@2.1.35:
+    dependencies:
+      mime-db: 1.52.0
+
+  mime-types@3.0.2:
+    dependencies:
+      mime-db: 1.54.0
+
+  mime@1.6.0: {}
+
+  mimic-function@5.0.1: {}
+
+  min-indent@1.0.1: {}
+
+  mini-css-extract-plugin@2.7.6(webpack@5.107.2):
+    dependencies:
+      schema-utils: 4.3.3
+      webpack: 5.107.2(@swc/core@1.15.11)(cssnano@8.0.1(postcss@8.5.15))(esbuild@0.27.3)(postcss@8.5.15)(webpack-cli@6.0.1)
+
+  minimalistic-assert@1.0.1: {}
+
+  minimatch@10.2.5:
+    dependencies:
+      brace-expansion: 5.0.5
+
+  minimatch@3.1.5:
+    dependencies:
+      brace-expansion: 1.1.11
+
+  minimist@1.2.8: {}
+
+  moment-timezone@0.6.2:
+    dependencies:
+      moment: 2.30.1
+
+  moment@2.30.1: {}
+
+  moo@0.5.2: {}
+
+  mrmime@2.0.1: {}
+
+  ms@2.0.0: {}
+
+  ms@2.1.3: {}
+
+  msw-storybook-addon@2.0.7(msw@2.14.6(@types/node@25.0.3)(typescript@6.0.2)):
+    dependencies:
+      is-node-process: 1.2.0
+      msw: 2.14.6(@types/node@25.0.3)(typescript@6.0.2)
+
+  msw@2.14.6(@types/node@25.0.3)(typescript@6.0.2):
+    dependencies:
+      '@inquirer/confirm': 6.1.1(@types/node@25.0.3)
+      '@mswjs/interceptors': 0.41.9
+      '@open-draft/deferred-promise': 3.0.0
+      '@types/statuses': 2.0.6
+      cookie: 1.1.1
+      graphql: 16.14.1
+      headers-polyfill: 5.0.1
+      is-node-process: 1.2.0
+      outvariant: 1.4.3
+      path-to-regexp: 6.3.0
+      picocolors: 1.1.1
+      rettime: 0.11.11
+      statuses: 2.0.2
+      strict-event-emitter: 0.5.1
+      tough-cookie: 6.0.1
+      type-fest: 5.7.0
+      until-async: 3.0.2
+      yargs: 17.7.2
+    optionalDependencies:
+      typescript: 6.0.2
+    transitivePeerDependencies:
+      - '@types/node'
+
+  multicast-dns@7.2.5:
+    dependencies:
+      dns-packet: 5.6.0
+      thunky: 1.1.0
+
+  mustache@4.2.0: {}
+
+  mute-stream@3.0.0: {}
+
+  mz@2.7.0:
+    dependencies:
+      any-promise: 1.3.0
+      object-assign: 4.1.1
+      thenify-all: 1.6.0
+
+  nanoclone@0.2.1: {}
+
+  nanoid@3.3.12: {}
+
+  napi-postinstall@0.3.4: {}
+
+  natural-compare@1.4.0: {}
+
+  nearley@2.20.1:
+    dependencies:
+      commander: 2.20.3
+      moo: 0.5.2
+      railroad-diagrams: 1.0.0
+      randexp: 0.4.6
+
+  needle@3.3.1:
+    dependencies:
+      iconv-lite: 0.6.3
+      sax: 1.6.0
+    optional: true
+
+  negotiator@0.6.3: {}
+
+  negotiator@0.6.4: {}
+
+  neo-async@2.6.2: {}
+
+  ng-file-upload@12.2.13: {}
+
+  ngtemplate-loader@2.1.0:
+    dependencies:
+      jsesc: 0.5.0
+      loader-utils: 1.4.2
+
+  no-case@3.0.4:
+    dependencies:
+      lower-case: 2.0.2
+      tslib: 2.8.1
+
+  node-abort-controller@3.1.1: {}
+
+  node-exports-info@1.6.0:
+    dependencies:
+      array.prototype.flatmap: 1.3.3
+      es-errors: 1.3.0
+      object.entries: 1.1.9
+      semver: 6.3.1
+
+  node-fetch-h2@2.3.0:
+    dependencies:
+      http2-client: 1.3.5
+
+  node-fetch@2.7.0:
+    dependencies:
+      whatwg-url: 5.0.0
+
+  node-notifier@10.0.1:
+    dependencies:
+      growly: 1.3.0
+      is-wsl: 2.2.0
+      semver: 7.7.4
+      shellwords: 0.1.1
+      uuid: 8.3.2
+      which: 2.0.2
+
+  node-readfiles@0.2.0:
+    dependencies:
+      es6-promise: 3.3.1
+
+  node-releases@2.0.46: {}
+
+  normalize-path@3.0.0: {}
+
+  nth-check@2.1.1:
+    dependencies:
+      boolbase: 1.0.0
+
+  nwsapi@2.2.22: {}
+
+  oas-kit-common@1.0.8:
+    dependencies:
+      fast-safe-stringify: 2.1.1
+
+  oas-linter@3.2.2:
+    dependencies:
+      '@exodus/schemasafe': 1.0.0-rc.6
+      should: 13.2.3
+      yaml: 1.10.2
+
+  oas-resolver@2.5.6:
+    dependencies:
+      node-fetch-h2: 2.3.0
+      oas-kit-common: 1.0.8
+      reftools: 1.1.9
+      yaml: 1.10.2
+      yargs: 17.7.2
+
+  oas-schema-walker@1.1.5: {}
+
+  oas-validator@5.0.8:
+    dependencies:
+      call-me-maybe: 1.0.2
+      oas-kit-common: 1.0.8
+      oas-linter: 3.2.2
+      oas-resolver: 2.5.6
+      oas-schema-walker: 1.1.5
+      reftools: 1.1.9
+      should: 13.2.3
+      yaml: 1.10.2
+
+  object-assign@4.1.1: {}
+
+  object-code@2.0.0: {}
+
+  object-hash@3.0.0: {}
+
+  object-inspect@1.13.4: {}
+
+  object-is@1.1.5:
+    dependencies:
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+
+  object-keys@1.1.1: {}
+
+  object.assign@4.1.7:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      define-properties: 1.2.1
+      es-object-atoms: 1.1.1
+      has-symbols: 1.1.0
+      object-keys: 1.1.1
+
+  object.entries@1.1.9:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      define-properties: 1.2.1
+      es-object-atoms: 1.1.1
+
+  object.fromentries@2.0.8:
+    dependencies:
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-object-atoms: 1.1.1
+
+  object.groupby@1.0.3:
+    dependencies:
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+
+  object.values@1.2.1:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      define-properties: 1.2.1
+      es-object-atoms: 1.1.1
+
+  objectorarray@1.0.5: {}
+
+  obuf@1.1.2: {}
+
+  obug@2.1.1: {}
+
+  ohash@2.0.11: {}
+
+  on-finished@2.4.1:
+    dependencies:
+      ee-first: 1.1.1
+
+  on-headers@1.1.0: {}
+
+  once@1.4.0:
+    dependencies:
+      wrappy: 1.0.2
+
+  onetime@7.0.0:
+    dependencies:
+      mimic-function: 5.0.1
+
+  oniguruma-to-es@2.3.0:
+    dependencies:
+      emoji-regex-xs: 1.0.0
+      regex: 5.1.1
+      regex-recursion: 5.1.1
+
+  open@10.2.0:
+    dependencies:
+      default-browser: 5.5.0
+      define-lazy-prop: 3.0.0
+      is-inside-container: 1.0.0
+      wsl-utils: 0.1.0
+
+  open@11.0.0:
+    dependencies:
+      default-browser: 5.5.0
+      define-lazy-prop: 3.0.0
+      is-in-ssh: 1.0.0
+      is-inside-container: 1.0.0
+      powershell-utils: 0.1.0
+      wsl-utils: 0.3.1
+
+  openapi-types@12.1.3: {}
+
+  opener@1.5.2: {}
+
+  optionator@0.9.3:
+    dependencies:
+      '@aashutoshrathi/word-wrap': 1.2.6
+      deep-is: 0.1.4
+      fast-levenshtein: 2.0.6
+      levn: 0.4.1
+      prelude-ls: 1.2.1
+      type-check: 0.4.0
+
+  outvariant@1.4.3: {}
+
+  own-keys@1.0.1:
+    dependencies:
+      get-intrinsic: 1.3.0
+      object-keys: 1.1.1
+      safe-push-apply: 1.0.0
+
+  oxc-parser@0.127.0:
+    dependencies:
+      '@oxc-project/types': 0.127.0
+    optionalDependencies:
+      '@oxc-parser/binding-android-arm-eabi': 0.127.0
+      '@oxc-parser/binding-android-arm64': 0.127.0
+      '@oxc-parser/binding-darwin-arm64': 0.127.0
+      '@oxc-parser/binding-darwin-x64': 0.127.0
+      '@oxc-parser/binding-freebsd-x64': 0.127.0
+      '@oxc-parser/binding-linux-arm-gnueabihf': 0.127.0
+      '@oxc-parser/binding-linux-arm-musleabihf': 0.127.0
+      '@oxc-parser/binding-linux-arm64-gnu': 0.127.0
+      '@oxc-parser/binding-linux-arm64-musl': 0.127.0
+      '@oxc-parser/binding-linux-ppc64-gnu': 0.127.0
+      '@oxc-parser/binding-linux-riscv64-gnu': 0.127.0
+      '@oxc-parser/binding-linux-riscv64-musl': 0.127.0
+      '@oxc-parser/binding-linux-s390x-gnu': 0.127.0
+      '@oxc-parser/binding-linux-x64-gnu': 0.127.0
+      '@oxc-parser/binding-linux-x64-musl': 0.127.0
+      '@oxc-parser/binding-openharmony-arm64': 0.127.0
+      '@oxc-parser/binding-wasm32-wasi': 0.127.0
+      '@oxc-parser/binding-win32-arm64-msvc': 0.127.0
+      '@oxc-parser/binding-win32-ia32-msvc': 0.127.0
+      '@oxc-parser/binding-win32-x64-msvc': 0.127.0
+
+  oxc-resolver@11.20.0:
+    optionalDependencies:
+      '@oxc-resolver/binding-android-arm-eabi': 11.20.0
+      '@oxc-resolver/binding-android-arm64': 11.20.0
+      '@oxc-resolver/binding-darwin-arm64': 11.20.0
+      '@oxc-resolver/binding-darwin-x64': 11.20.0
+      '@oxc-resolver/binding-freebsd-x64': 11.20.0
+      '@oxc-resolver/binding-linux-arm-gnueabihf': 11.20.0
+      '@oxc-resolver/binding-linux-arm-musleabihf': 11.20.0
+      '@oxc-resolver/binding-linux-arm64-gnu': 11.20.0
+      '@oxc-resolver/binding-linux-arm64-musl': 11.20.0
+      '@oxc-resolver/binding-linux-ppc64-gnu': 11.20.0
+      '@oxc-resolver/binding-linux-riscv64-gnu': 11.20.0
+      '@oxc-resolver/binding-linux-riscv64-musl': 11.20.0
+      '@oxc-resolver/binding-linux-s390x-gnu': 11.20.0
+      '@oxc-resolver/binding-linux-x64-gnu': 11.20.0
+      '@oxc-resolver/binding-linux-x64-musl': 11.20.0
+      '@oxc-resolver/binding-openharmony-arm64': 11.20.0
+      '@oxc-resolver/binding-wasm32-wasi': 11.20.0
+      '@oxc-resolver/binding-win32-arm64-msvc': 11.20.0
+      '@oxc-resolver/binding-win32-x64-msvc': 11.20.0
+
+  p-limit@2.3.0:
+    dependencies:
+      p-try: 2.2.0
+
+  p-limit@3.1.0:
+    dependencies:
+      yocto-queue: 0.1.0
+
+  p-limit@4.0.0:
+    dependencies:
+      yocto-queue: 1.0.0
+
+  p-locate@4.1.0:
+    dependencies:
+      p-limit: 2.3.0
+
+  p-locate@5.0.0:
+    dependencies:
+      p-limit: 3.1.0
+
+  p-locate@6.0.0:
+    dependencies:
+      p-limit: 4.0.0
+
+  p-map@2.1.0: {}
+
+  p-retry@6.2.1:
+    dependencies:
+      '@types/retry': 0.12.2
+      is-network-error: 1.3.0
+      retry: 0.13.1
+
+  p-try@2.2.0: {}
+
+  param-case@3.0.4:
+    dependencies:
+      dot-case: 3.0.4
+      tslib: 2.8.1
+
+  parent-module@1.0.1:
+    dependencies:
+      callsites: 3.1.0
+
+  parse-duration@2.1.4: {}
+
+  parse-json@5.2.0:
+    dependencies:
+      '@babel/code-frame': 7.29.0
+      error-ex: 1.3.2
+      json-parse-even-better-errors: 2.3.1
+      lines-and-columns: 1.2.4
+
+  parse-node-version@1.0.1:
+    optional: true
+
+  parse-srcset@1.0.2: {}
+
+  parse5@7.1.2:
+    dependencies:
+      entities: 4.5.0
+
+  parseurl@1.3.3: {}
+
+  pascal-case@3.1.2:
+    dependencies:
+      no-case: 3.0.4
+      tslib: 2.8.1
+
+  path-exists@4.0.0: {}
+
+  path-exists@5.0.0: {}
+
+  path-is-absolute@1.0.1: {}
+
+  path-is-inside@1.0.2: {}
+
+  path-key@3.1.1: {}
+
+  path-parse@1.0.7: {}
+
+  path-to-regexp@0.1.12: {}
+
+  path-to-regexp@6.3.0: {}
+
+  path-type@4.0.0: {}
+
+  pathe@2.0.3: {}
+
+  pathval@2.0.1: {}
+
+  perfect-debounce@2.1.0: {}
+
+  picocolors@1.1.1: {}
+
+  picomatch@2.3.1: {}
+
+  picomatch@4.0.4: {}
+
+  pify@2.3.0: {}
+
+  pify@4.0.1: {}
+
+  pinkie-promise@2.0.1:
+    dependencies:
+      pinkie: 2.0.4
+
+  pinkie@2.0.4: {}
+
+  pirates@4.0.5: {}
+
+  pkg-dir@4.2.0:
+    dependencies:
+      find-up: 4.1.0
+
+  pkg-dir@7.0.0:
+    dependencies:
+      find-up: 6.3.0
+
+  pkg-types@2.3.1:
+    dependencies:
+      confbox: 0.2.4
+      exsolve: 1.0.8
+      pathe: 2.0.3
+
+  pkijs@3.3.3:
+    dependencies:
+      '@noble/hashes': 1.4.0
+      asn1js: 3.0.7
+      bytestreamjs: 2.0.1
+      pvtsutils: 1.3.6
+      pvutils: 1.1.5
+      tslib: 2.8.1
+
+  possible-typed-array-names@1.1.0: {}
+
+  postcss-calc@10.1.1(postcss@8.5.15):
+    dependencies:
+      postcss: 8.5.15
+      postcss-selector-parser: 7.1.1
+      postcss-value-parser: 4.2.0
+
+  postcss-colormin@8.0.0(postcss@8.5.15):
+    dependencies:
+      '@colordx/core': 5.4.3
+      browserslist: 4.28.2
+      caniuse-api: 3.0.0
+      postcss: 8.5.15
+      postcss-value-parser: 4.2.0
+
+  postcss-convert-values@8.0.0(postcss@8.5.15):
+    dependencies:
+      browserslist: 4.28.2
+      postcss: 8.5.15
+      postcss-value-parser: 4.2.0
+
+  postcss-discard-comments@8.0.0(postcss@8.5.15):
+    dependencies:
+      postcss: 8.5.15
+      postcss-selector-parser: 7.1.1
+
+  postcss-discard-duplicates@8.0.0(postcss@8.5.15):
+    dependencies:
+      postcss: 8.5.15
+
+  postcss-discard-empty@8.0.0(postcss@8.5.15):
+    dependencies:
+      postcss: 8.5.15
+
+  postcss-discard-overridden@8.0.0(postcss@8.5.15):
+    dependencies:
+      postcss: 8.5.15
+
+  postcss-import@15.1.0(postcss@8.5.15):
+    dependencies:
+      postcss: 8.5.15
+      postcss-value-parser: 4.2.0
+      read-cache: 1.0.0
+      resolve: 1.22.11
+
+  postcss-js@4.0.1(postcss@8.5.15):
+    dependencies:
+      camelcase-css: 2.0.1
+      postcss: 8.5.15
+
+  postcss-load-config@4.0.1(postcss@8.5.15):
+    dependencies:
+      lilconfig: 2.1.0
+      yaml: 2.7.0
+    optionalDependencies:
+      postcss: 8.5.15
+
+  postcss-loader@7.3.3(postcss@8.5.15)(webpack@5.107.2):
+    dependencies:
+      cosmiconfig: 8.2.0
+      jiti: 1.18.2
+      postcss: 8.5.15
+      semver: 7.7.4
+      webpack: 5.107.2(@swc/core@1.15.11)(cssnano@8.0.1(postcss@8.5.15))(esbuild@0.27.3)(postcss@8.5.15)(webpack-cli@6.0.1)
+
+  postcss-merge-longhand@8.0.0(postcss@8.5.15):
+    dependencies:
+      postcss: 8.5.15
+      postcss-value-parser: 4.2.0
+      stylehacks: 8.0.0(postcss@8.5.15)
+
+  postcss-merge-rules@8.0.0(postcss@8.5.15):
+    dependencies:
+      browserslist: 4.28.2
+      caniuse-api: 3.0.0
+      cssnano-utils: 6.0.0(postcss@8.5.15)
+      postcss: 8.5.15
+      postcss-selector-parser: 7.1.1
+
+  postcss-minify-font-values@8.0.0(postcss@8.5.15):
+    dependencies:
+      postcss: 8.5.15
+      postcss-value-parser: 4.2.0
+
+  postcss-minify-gradients@8.0.0(postcss@8.5.15):
+    dependencies:
+      '@colordx/core': 5.4.3
+      cssnano-utils: 6.0.0(postcss@8.5.15)
+      postcss: 8.5.15
+      postcss-value-parser: 4.2.0
+
+  postcss-minify-params@8.0.0(postcss@8.5.15):
+    dependencies:
+      browserslist: 4.28.2
+      cssnano-utils: 6.0.0(postcss@8.5.15)
+      postcss: 8.5.15
+      postcss-value-parser: 4.2.0
+
+  postcss-minify-selectors@8.0.1(postcss@8.5.15):
+    dependencies:
+      browserslist: 4.28.2
+      caniuse-api: 3.0.0
+      cssesc: 3.0.0
+      postcss: 8.5.15
+      postcss-selector-parser: 7.1.1
+
+  postcss-modules-extract-imports@3.1.0(postcss@8.5.15):
+    dependencies:
+      postcss: 8.5.15
+
+  postcss-modules-local-by-default@4.2.0(postcss@8.5.15):
+    dependencies:
+      icss-utils: 5.1.0(postcss@8.5.15)
+      postcss: 8.5.15
+      postcss-selector-parser: 7.1.1
+      postcss-value-parser: 4.2.0
+
+  postcss-modules-scope@3.2.1(postcss@8.5.15):
+    dependencies:
+      postcss: 8.5.15
+      postcss-selector-parser: 7.1.1
+
+  postcss-modules-values@4.0.0(postcss@8.5.15):
+    dependencies:
+      icss-utils: 5.1.0(postcss@8.5.15)
+      postcss: 8.5.15
+
+  postcss-nested@6.0.1(postcss@8.5.15):
+    dependencies:
+      postcss: 8.5.15
+      postcss-selector-parser: 6.0.13
+
+  postcss-normalize-charset@8.0.0(postcss@8.5.15):
+    dependencies:
+      postcss: 8.5.15
+
+  postcss-normalize-display-values@8.0.0(postcss@8.5.15):
+    dependencies:
+      postcss: 8.5.15
+      postcss-value-parser: 4.2.0
+
+  postcss-normalize-positions@8.0.0(postcss@8.5.15):
+    dependencies:
+      postcss: 8.5.15
+      postcss-value-parser: 4.2.0
+
+  postcss-normalize-repeat-style@8.0.0(postcss@8.5.15):
+    dependencies:
+      postcss: 8.5.15
+      postcss-value-parser: 4.2.0
+
+  postcss-normalize-string@8.0.0(postcss@8.5.15):
+    dependencies:
+      postcss: 8.5.15
+      postcss-value-parser: 4.2.0
+
+  postcss-normalize-timing-functions@8.0.0(postcss@8.5.15):
+    dependencies:
+      postcss: 8.5.15
+      postcss-value-parser: 4.2.0
+
+  postcss-normalize-unicode@8.0.0(postcss@8.5.15):
+    dependencies:
+      browserslist: 4.28.2
+      postcss: 8.5.15
+      postcss-value-parser: 4.2.0
+
+  postcss-normalize-url@8.0.0(postcss@8.5.15):
+    dependencies:
+      postcss: 8.5.15
+      postcss-value-parser: 4.2.0
+
+  postcss-normalize-whitespace@8.0.0(postcss@8.5.15):
+    dependencies:
+      postcss: 8.5.15
+      postcss-value-parser: 4.2.0
+
+  postcss-ordered-values@8.0.0(postcss@8.5.15):
+    dependencies:
+      cssnano-utils: 6.0.0(postcss@8.5.15)
+      postcss: 8.5.15
+      postcss-value-parser: 4.2.0
+
+  postcss-reduce-initial@8.0.0(postcss@8.5.15):
+    dependencies:
+      browserslist: 4.28.2
+      caniuse-api: 3.0.0
+      postcss: 8.5.15
+
+  postcss-reduce-transforms@8.0.0(postcss@8.5.15):
+    dependencies:
+      postcss: 8.5.15
+      postcss-value-parser: 4.2.0
+
+  postcss-selector-parser@6.0.13:
+    dependencies:
+      cssesc: 3.0.0
+      util-deprecate: 1.0.2
+
+  postcss-selector-parser@7.1.1:
+    dependencies:
+      cssesc: 3.0.0
+      util-deprecate: 1.0.2
+
+  postcss-svgo@8.0.0(postcss@8.5.15):
+    dependencies:
+      postcss: 8.5.15
+      postcss-value-parser: 4.2.0
+      svgo: 4.0.1
+
+  postcss-unique-selectors@8.0.0(postcss@8.5.15):
+    dependencies:
+      postcss: 8.5.15
+      postcss-selector-parser: 7.1.1
+
+  postcss-value-parser@4.2.0: {}
+
+  postcss@8.5.15:
+    dependencies:
+      nanoid: 3.3.12
+      picocolors: 1.1.1
+      source-map-js: 1.2.1
+
+  powershell-utils@0.1.0: {}
+
+  prelude-ls@1.2.1: {}
+
+  prettier-plugin-tailwindcss@0.8.0(prettier@3.8.3):
+    dependencies:
+      prettier: 3.8.3
+
+  prettier@3.8.3: {}
+
+  pretty-error@4.0.0:
+    dependencies:
+      lodash: 4.18.1
+      renderkid: 3.0.0
+
+  pretty-format@27.4.2:
+    dependencies:
+      '@jest/types': 27.4.2
+      ansi-regex: 5.0.1
+      ansi-styles: 5.2.0
+      react-is: 17.0.2
+
+  process-nextick-args@2.0.1: {}
+
+  prop-types@15.8.1:
+    dependencies:
+      loose-envify: 1.4.0
+      object-assign: 4.1.1
+      react-is: 16.13.1
+
+  property-expr@2.0.4: {}
+
+  property-information@7.0.0: {}
+
+  proxy-addr@2.0.7:
+    dependencies:
+      forwarded: 0.2.0
+      ipaddr.js: 1.9.1
+
+  proxy-from-env@2.1.0: {}
+
+  prr@1.0.1:
+    optional: true
+
+  psl@1.8.0: {}
+
+  punycode@2.3.1: {}
+
+  pvtsutils@1.3.6:
+    dependencies:
+      tslib: 2.8.1
+
+  pvutils@1.1.5: {}
+
+  qs@6.14.1:
+    dependencies:
+      side-channel: 1.1.0
+
+  querystringify@2.2.0: {}
+
+  queue-microtask@1.2.3: {}
+
+  railroad-diagrams@1.0.0: {}
+
+  randexp@0.4.6:
+    dependencies:
+      discontinuous-range: 1.0.0
+      ret: 0.1.15
+
+  randombytes@2.1.0:
+    dependencies:
+      safe-buffer: 5.2.1
+
+  range-parser@1.2.1: {}
+
+  raw-body@2.5.3:
+    dependencies:
+      bytes: 3.1.2
+      http-errors: 2.0.1
+      iconv-lite: 0.4.24
+      unpipe: 1.0.0
+
+  rc-slider@10.1.1(react-dom@17.0.2(react@17.0.2))(react@17.0.2):
+    dependencies:
+      '@babel/runtime': 7.26.0
+      classnames: 2.3.1
+      rc-util: 5.28.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      react: 17.0.2
+      react-dom: 17.0.2(react@17.0.2)
+
+  rc-util@5.28.0(react-dom@17.0.2(react@17.0.2))(react@17.0.2):
+    dependencies:
+      '@babel/runtime': 7.26.0
+      react: 17.0.2
+      react-dom: 17.0.2(react@17.0.2)
+      react-is: 16.13.1
+
+  rc9@3.0.1:
+    dependencies:
+      defu: 6.1.7
+      destr: 2.0.5
+
+  react-calendar@4.8.0(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2):
+    dependencies:
+      '@wojtekmaj/date-utils': 1.5.1
+      clsx: 2.1.1
+      get-user-locale: 2.3.1
+      prop-types: 15.8.1
+      react: 17.0.2
+      react-dom: 17.0.2(react@17.0.2)
+      warning: 4.0.3
+    optionalDependencies:
+      '@types/react': 17.0.75
+
+  react-clientside-effect@1.2.6(react@17.0.2):
+    dependencies:
+      '@babel/runtime': 7.26.0
+      react: 17.0.2
+
+  react-clock@4.6.0(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2):
+    dependencies:
+      '@wojtekmaj/date-utils': 1.5.1
+      clsx: 2.1.1
+      get-user-locale: 2.3.1
+      prop-types: 15.8.1
+      react: 17.0.2
+      react-dom: 17.0.2(react@17.0.2)
+    optionalDependencies:
+      '@types/react': 17.0.75
+
+  react-codemirror-merge@4.23.11(@babel/runtime@7.26.0)(@codemirror/autocomplete@6.20.2)(@codemirror/language@6.12.3)(@codemirror/lint@6.9.6)(@codemirror/search@6.7.0)(@codemirror/state@6.6.0)(@codemirror/theme-one-dark@6.1.3)(@codemirror/view@6.43.0)(codemirror@6.0.1)(react-dom@17.0.2(react@17.0.2))(react@17.0.2):
+    dependencies:
+      '@babel/runtime': 7.26.0
+      '@codemirror/merge': 6.10.0
+      '@codemirror/state': 6.6.0
+      '@codemirror/theme-one-dark': 6.1.3
+      '@codemirror/view': 6.43.0
+      '@uiw/react-codemirror': 4.23.11(@babel/runtime@7.26.0)(@codemirror/autocomplete@6.20.2)(@codemirror/language@6.12.3)(@codemirror/lint@6.9.6)(@codemirror/search@6.7.0)(@codemirror/state@6.6.0)(@codemirror/theme-one-dark@6.1.3)(@codemirror/view@6.43.0)(codemirror@6.0.1)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      codemirror: 6.0.1
+      react: 17.0.2
+      react-dom: 17.0.2(react@17.0.2)
+    transitivePeerDependencies:
+      - '@codemirror/autocomplete'
+      - '@codemirror/language'
+      - '@codemirror/lint'
+      - '@codemirror/search'
+
+  react-date-picker@10.6.0(@types/react-dom@17.0.25)(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2):
+    dependencies:
+      '@wojtekmaj/date-utils': 1.5.1
+      clsx: 2.1.1
+      get-user-locale: 2.3.1
+      make-event-props: 1.6.2
+      prop-types: 15.8.1
+      react: 17.0.2
+      react-calendar: 4.8.0(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      react-dom: 17.0.2(react@17.0.2)
+      react-fit: 1.7.1(@types/react-dom@17.0.25)(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      update-input-width: 1.4.2
+    optionalDependencies:
+      '@types/react': 17.0.75
+    transitivePeerDependencies:
+      - '@types/react-dom'
+
+  react-datetime-picker@5.6.0(@types/react-dom@17.0.25)(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2):
+    dependencies:
+      '@wojtekmaj/date-utils': 1.5.1
+      clsx: 2.1.1
+      get-user-locale: 2.3.1
+      make-event-props: 1.6.2
+      prop-types: 15.8.1
+      react: 17.0.2
+      react-calendar: 4.8.0(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      react-clock: 4.6.0(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      react-date-picker: 10.6.0(@types/react-dom@17.0.25)(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      react-dom: 17.0.2(react@17.0.2)
+      react-fit: 1.7.1(@types/react-dom@17.0.25)(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      react-time-picker: 6.6.0(@types/react-dom@17.0.25)(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+    optionalDependencies:
+      '@types/react': 17.0.75
+    transitivePeerDependencies:
+      - '@types/react-dom'
+
+  react-docgen-typescript-plugin@1.0.5(typescript@6.0.2)(webpack@5.107.2):
+    dependencies:
+      debug: 4.4.3
+      endent: 2.1.0
+      find-cache-dir: 3.3.2
+      flat-cache: 3.0.4
+      micromatch: 4.0.8
+      react-docgen-typescript: 2.2.2(typescript@6.0.2)
+      tslib: 2.8.1
+      typescript: 6.0.2
+      webpack: 5.107.2(@swc/core@1.15.11)(cssnano@8.0.1(postcss@8.5.15))(esbuild@0.27.3)(postcss@8.5.15)(webpack-cli@6.0.1)
+    transitivePeerDependencies:
+      - supports-color
+
+  react-docgen-typescript@2.2.2(typescript@6.0.2):
+    dependencies:
+      typescript: 6.0.2
+
+  react-docgen@7.1.1:
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/traverse': 7.29.0
+      '@babel/types': 7.29.0
+      '@types/babel__core': 7.20.5
+      '@types/babel__traverse': 7.28.0
+      '@types/doctrine': 0.0.9
+      '@types/resolve': 1.20.6
+      doctrine: 3.0.0
+      resolve: 1.22.11
+      strip-indent: 4.0.0
+    transitivePeerDependencies:
+      - supports-color
+
+  react-docgen@8.0.3:
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/traverse': 7.29.0
+      '@babel/types': 7.29.0
+      '@types/babel__core': 7.20.5
+      '@types/babel__traverse': 7.28.0
+      '@types/doctrine': 0.0.9
+      '@types/resolve': 1.20.6
+      doctrine: 3.0.0
+      resolve: 1.22.11
+      strip-indent: 4.0.0
+    transitivePeerDependencies:
+      - supports-color
+
+  react-dom@17.0.2(react@17.0.2):
+    dependencies:
+      loose-envify: 1.4.0
+      object-assign: 4.1.1
+      react: 17.0.2
+      scheduler: 0.20.2
+
+  react-error-boundary@3.1.4(react@17.0.2):
+    dependencies:
+      '@babel/runtime': 7.26.0
+      react: 17.0.2
+
+  react-fast-compare@2.0.4: {}
+
+  react-fit@1.7.1(@types/react-dom@17.0.25)(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2):
+    dependencies:
+      detect-element-overflow: 1.4.2
+      prop-types: 15.8.1
+      react: 17.0.2
+      react-dom: 17.0.2(react@17.0.2)
+      tiny-warning: 1.0.3
+    optionalDependencies:
+      '@types/react': 17.0.75
+      '@types/react-dom': 17.0.25
+
+  react-focus-lock@2.9.1(@types/react@17.0.75)(react@17.0.2):
+    dependencies:
+      '@babel/runtime': 7.26.0
+      focus-lock: 0.11.2
+      prop-types: 15.8.1
+      react: 17.0.2
+      react-clientside-effect: 1.2.6(react@17.0.2)
+      use-callback-ref: 1.3.3(@types/react@17.0.75)(react@17.0.2)
+      use-sidecar: 1.1.3(@types/react@17.0.75)(react@17.0.2)
+    optionalDependencies:
+      '@types/react': 17.0.75
+
+  react-i18next@11.15.3(i18next@21.10.0)(react-dom@17.0.2(react@17.0.2))(react@17.0.2):
+    dependencies:
+      '@babel/runtime': 7.26.0
+      html-escaper: 2.0.2
+      html-parse-stringify: 3.0.1
+      i18next: 21.10.0
+      react: 17.0.2
+    optionalDependencies:
+      react-dom: 17.0.2(react@17.0.2)
+
+  react-is@16.13.1: {}
+
+  react-is@17.0.2: {}
+
+  react-json-view-lite@1.5.0(react@17.0.2):
+    dependencies:
+      react: 17.0.2
+
+  react-remove-scroll-bar@2.3.8(@types/react@17.0.75)(react@17.0.2):
+    dependencies:
+      react: 17.0.2
+      react-style-singleton: 2.2.3(@types/react@17.0.75)(react@17.0.2)
+      tslib: 2.8.1
+    optionalDependencies:
+      '@types/react': 17.0.75
+
+  react-remove-scroll@2.6.3(@types/react@17.0.75)(react@17.0.2):
+    dependencies:
+      react: 17.0.2
+      react-remove-scroll-bar: 2.3.8(@types/react@17.0.75)(react@17.0.2)
+      react-style-singleton: 2.2.3(@types/react@17.0.75)(react@17.0.2)
+      tslib: 2.8.1
+      use-callback-ref: 1.3.3(@types/react@17.0.75)(react@17.0.2)
+      use-sidecar: 1.1.3(@types/react@17.0.75)(react@17.0.2)
+    optionalDependencies:
+      '@types/react': 17.0.75
+
+  react-select-async-paginate@0.7.11(@types/react@17.0.75)(react-select@5.10.2(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2))(react@17.0.2):
+    dependencies:
+      '@seznam/compose-react-refs': 1.0.6
+      '@vtaits/use-lazy-ref': 0.1.4(react@17.0.2)
+      krustykrab: 1.1.0
+      react: 17.0.2
+      react-select: 5.10.2(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      sleep-promise: 9.1.0
+      use-is-mounted-ref: 1.5.0(react@17.0.2)
+      use-latest: 1.3.0(@types/react@17.0.75)(react@17.0.2)
+    transitivePeerDependencies:
+      - '@types/react'
+
+  react-select@5.10.2(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2):
+    dependencies:
+      '@babel/runtime': 7.26.0
+      '@emotion/cache': 11.14.0
+      '@emotion/react': 11.14.0(@types/react@17.0.75)(react@17.0.2)
+      '@floating-ui/dom': 1.7.6
+      '@types/react-transition-group': 4.4.4
+      memoize-one: 6.0.0
+      prop-types: 15.8.1
+      react: 17.0.2
+      react-dom: 17.0.2(react@17.0.2)
+      react-transition-group: 4.4.2(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      use-isomorphic-layout-effect: 1.2.1(@types/react@17.0.75)(react@17.0.2)
+    transitivePeerDependencies:
+      - '@types/react'
+      - supports-color
+
+  react-style-singleton@2.2.3(@types/react@17.0.75)(react@17.0.2):
+    dependencies:
+      get-nonce: 1.0.1
+      react: 17.0.2
+      tslib: 2.8.1
+    optionalDependencies:
+      '@types/react': 17.0.75
+
+  react-time-picker@6.6.0(@types/react-dom@17.0.25)(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2):
+    dependencies:
+      '@wojtekmaj/date-utils': 1.5.1
+      clsx: 2.1.1
+      get-user-locale: 2.3.1
+      make-event-props: 1.6.2
+      prop-types: 15.8.1
+      react: 17.0.2
+      react-clock: 4.6.0(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      react-dom: 17.0.2(react@17.0.2)
+      react-fit: 1.7.1(@types/react-dom@17.0.25)(@types/react@17.0.75)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      update-input-width: 1.4.2
+    optionalDependencies:
+      '@types/react': 17.0.75
+    transitivePeerDependencies:
+      - '@types/react-dom'
+
+  react-transition-group@4.4.2(react-dom@17.0.2(react@17.0.2))(react@17.0.2):
+    dependencies:
+      '@babel/runtime': 7.26.0
+      dom-helpers: 5.2.1
+      loose-envify: 1.4.0
+      prop-types: 15.8.1
+      react: 17.0.2
+      react-dom: 17.0.2(react@17.0.2)
+
+  react@17.0.2:
+    dependencies:
+      loose-envify: 1.4.0
+      object-assign: 4.1.1
+
+  read-cache@1.0.0:
+    dependencies:
+      pify: 2.3.0
+
+  readable-stream@2.3.8:
+    dependencies:
+      core-util-is: 1.0.3
+      inherits: 2.0.4
+      isarray: 1.0.0
+      process-nextick-args: 2.0.1
+      safe-buffer: 5.1.2
+      string_decoder: 1.1.1
+      util-deprecate: 1.0.2
+
+  readable-stream@3.6.2:
+    dependencies:
+      inherits: 2.0.4
+      string_decoder: 1.3.0
+      util-deprecate: 1.0.2
+
+  readdirp@3.6.0:
+    dependencies:
+      picomatch: 2.3.1
+
+  readdirp@4.1.2: {}
+
+  readdirp@5.0.0: {}
+
+  recast@0.23.11:
+    dependencies:
+      ast-types: 0.16.1
+      esprima: 4.0.1
+      source-map: 0.6.1
+      tiny-invariant: 1.3.3
+      tslib: 2.8.1
+
+  rechoir@0.8.0:
+    dependencies:
+      resolve: 1.22.11
+
+  redent@3.0.0:
+    dependencies:
+      indent-string: 4.0.0
+      strip-indent: 3.0.0
+
+  reflect-metadata@0.2.2: {}
+
+  reflect.getprototypeof@1.0.10:
+    dependencies:
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-errors: 1.3.0
+      es-object-atoms: 1.1.1
+      get-intrinsic: 1.3.0
+      get-proto: 1.0.1
+      which-builtin-type: 1.2.1
+
+  reftools@1.1.9: {}
+
+  regenerate-unicode-properties@10.1.0:
+    dependencies:
+      regenerate: 1.4.2
+
+  regenerate@1.4.2: {}
+
+  regenerator-runtime@0.14.1: {}
+
+  regenerator-transform@0.15.2:
+    dependencies:
+      '@babel/runtime': 7.26.0
+
+  regex-recursion@5.1.1:
+    dependencies:
+      regex: 5.1.1
+      regex-utilities: 2.3.0
+
+  regex-utilities@2.3.0: {}
+
+  regex@5.1.1:
+    dependencies:
+      regex-utilities: 2.3.0
+
+  regexp.prototype.flags@1.5.4:
+    dependencies:
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-errors: 1.3.0
+      get-proto: 1.0.1
+      gopd: 1.2.0
+      set-function-name: 2.0.2
+
+  regexpu-core@5.3.2:
+    dependencies:
+      '@babel/regjsgen': 0.8.0
+      regenerate: 1.4.2
+      regenerate-unicode-properties: 10.1.0
+      regjsparser: 0.9.1
+      unicode-match-property-ecmascript: 2.0.0
+      unicode-match-property-value-ecmascript: 2.1.0
+
+  regjsparser@0.9.1:
+    dependencies:
+      jsesc: 0.5.0
+
+  relateurl@0.2.7: {}
+
+  remove-accents@0.4.2: {}
+
+  renderkid@3.0.0:
+    dependencies:
+      css-select: 4.3.0
+      dom-converter: 0.2.0
+      htmlparser2: 6.1.0
+      lodash: 4.18.1
+      strip-ansi: 6.0.1
+
+  require-directory@2.1.1: {}
+
+  require-from-string@2.0.2: {}
+
+  require-main-filename@2.0.0: {}
+
+  require-package-name@2.0.1: {}
+
+  requires-port@1.0.0: {}
+
+  resolve-cwd@3.0.0:
+    dependencies:
+      resolve-from: 5.0.0
+
+  resolve-from@4.0.0: {}
+
+  resolve-from@5.0.0: {}
+
+  resolve-pkg-maps@1.0.0: {}
+
+  resolve@1.22.11:
+    dependencies:
+      is-core-module: 2.16.1
+      path-parse: 1.0.7
+      supports-preserve-symlinks-flag: 1.0.0
+
+  resolve@2.0.0-next.6:
+    dependencies:
+      es-errors: 1.3.0
+      is-core-module: 2.16.1
+      node-exports-info: 1.6.0
+      object-keys: 1.1.1
+      path-parse: 1.0.7
+      supports-preserve-symlinks-flag: 1.0.0
+
+  restore-cursor@5.1.0:
+    dependencies:
+      onetime: 7.0.0
+      signal-exit: 4.1.0
+
+  ret@0.1.15: {}
+
+  retry@0.13.1: {}
+
+  rettime@0.11.11: {}
+
+  reusify@1.0.4: {}
+
+  rfdc@1.4.1: {}
+
+  rimraf@2.7.1:
+    dependencies:
+      glob: 7.2.3
+
+  rimraf@3.0.2:
+    dependencies:
+      glob: 7.2.3
+
+  rolldown@1.0.3:
+    dependencies:
+      '@oxc-project/types': 0.133.0
+      '@rolldown/pluginutils': 1.0.1
+    optionalDependencies:
+      '@rolldown/binding-android-arm64': 1.0.3
+      '@rolldown/binding-darwin-arm64': 1.0.3
+      '@rolldown/binding-darwin-x64': 1.0.3
+      '@rolldown/binding-freebsd-x64': 1.0.3
+      '@rolldown/binding-linux-arm-gnueabihf': 1.0.3
+      '@rolldown/binding-linux-arm64-gnu': 1.0.3
+      '@rolldown/binding-linux-arm64-musl': 1.0.3
+      '@rolldown/binding-linux-ppc64-gnu': 1.0.3
+      '@rolldown/binding-linux-s390x-gnu': 1.0.3
+      '@rolldown/binding-linux-x64-gnu': 1.0.3
+      '@rolldown/binding-linux-x64-musl': 1.0.3
+      '@rolldown/binding-openharmony-arm64': 1.0.3
+      '@rolldown/binding-wasm32-wasi': 1.0.3
+      '@rolldown/binding-win32-arm64-msvc': 1.0.3
+      '@rolldown/binding-win32-x64-msvc': 1.0.3
+
+  rollup@4.54.0:
+    dependencies:
+      '@types/estree': 1.0.8
+    optionalDependencies:
+      '@rollup/rollup-android-arm-eabi': 4.54.0
+      '@rollup/rollup-android-arm64': 4.54.0
+      '@rollup/rollup-darwin-arm64': 4.54.0
+      '@rollup/rollup-darwin-x64': 4.54.0
+      '@rollup/rollup-freebsd-arm64': 4.54.0
+      '@rollup/rollup-freebsd-x64': 4.54.0
+      '@rollup/rollup-linux-arm-gnueabihf': 4.54.0
+      '@rollup/rollup-linux-arm-musleabihf': 4.54.0
+      '@rollup/rollup-linux-arm64-gnu': 4.54.0
+      '@rollup/rollup-linux-arm64-musl': 4.54.0
+      '@rollup/rollup-linux-loong64-gnu': 4.54.0
+      '@rollup/rollup-linux-ppc64-gnu': 4.54.0
+      '@rollup/rollup-linux-riscv64-gnu': 4.54.0
+      '@rollup/rollup-linux-riscv64-musl': 4.54.0
+      '@rollup/rollup-linux-s390x-gnu': 4.54.0
+      '@rollup/rollup-linux-x64-gnu': 4.54.0
+      '@rollup/rollup-linux-x64-musl': 4.54.0
+      '@rollup/rollup-openharmony-arm64': 4.54.0
+      '@rollup/rollup-win32-arm64-msvc': 4.54.0
+      '@rollup/rollup-win32-ia32-msvc': 4.54.0
+      '@rollup/rollup-win32-x64-gnu': 4.54.0
+      '@rollup/rollup-win32-x64-msvc': 4.54.0
+      fsevents: 2.3.3
+    optional: true
+
+  rrweb-cssom@0.6.0: {}
+
+  rrweb-cssom@0.7.1: {}
+
+  run-applescript@7.1.0: {}
+
+  run-parallel@1.2.0:
+    dependencies:
+      queue-microtask: 1.2.3
+
+  safe-array-concat@1.1.3:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      get-intrinsic: 1.3.0
+      has-symbols: 1.1.0
+      isarray: 2.0.5
+
+  safe-buffer@5.1.2: {}
+
+  safe-buffer@5.2.1: {}
+
+  safe-push-apply@1.0.0:
+    dependencies:
+      es-errors: 1.3.0
+      isarray: 2.0.5
+
+  safe-regex-test@1.1.0:
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      is-regex: 1.2.1
+
+  safer-buffer@2.1.2: {}
+
+  sanitize-html@2.17.0:
+    dependencies:
+      deepmerge: 4.3.1
+      escape-string-regexp: 4.0.0
+      htmlparser2: 8.0.2
+      is-plain-object: 5.0.0
+      parse-srcset: 1.0.2
+      postcss: 8.5.15
+
+  sax@1.6.0: {}
+
+  saxes@6.0.0:
+    dependencies:
+      xmlchars: 2.2.0
+
+  scheduler@0.20.2:
+    dependencies:
+      loose-envify: 1.4.0
+      object-assign: 4.1.1
+
+  schema-utils@3.3.0:
+    dependencies:
+      '@types/json-schema': 7.0.15
+      ajv: 6.14.0
+      ajv-keywords: 3.5.2(ajv@6.14.0)
+
+  schema-utils@4.3.3:
+    dependencies:
+      '@types/json-schema': 7.0.15
+      ajv: 8.17.1
+      ajv-formats: 2.1.1(ajv@8.17.1)
+      ajv-keywords: 5.1.0(ajv@8.17.1)
+
+  select-hose@2.0.0: {}
+
+  selfsigned@5.5.0:
+    dependencies:
+      '@peculiar/x509': 1.14.3
+      pkijs: 3.3.3
+
+  semver@5.7.2:
+    optional: true
+
+  semver@6.3.1: {}
+
+  semver@7.7.4: {}
+
+  semver@7.8.4: {}
+
+  send@0.19.2:
+    dependencies:
+      debug: 2.6.9
+      depd: 2.0.0
+      destroy: 1.2.0
+      encodeurl: 2.0.0
+      escape-html: 1.0.3
+      etag: 1.8.1
+      fresh: 0.5.2
+      http-errors: 2.0.1
+      mime: 1.6.0
+      ms: 2.1.3
+      on-finished: 2.4.1
+      range-parser: 1.2.1
+      statuses: 2.0.2
+    transitivePeerDependencies:
+      - supports-color
+
+  serialize-javascript@6.0.1:
+    dependencies:
+      randombytes: 2.1.0
+
+  serve-index@1.9.1:
+    dependencies:
+      accepts: 1.3.8
+      batch: 0.6.1
+      debug: 2.6.9
+      escape-html: 1.0.3
+      http-errors: 1.6.3
+      mime-types: 2.1.35
+      parseurl: 1.3.3
+    transitivePeerDependencies:
+      - supports-color
+
+  serve-static@1.16.3:
+    dependencies:
+      encodeurl: 2.0.0
+      escape-html: 1.0.3
+      parseurl: 1.3.3
+      send: 0.19.2
+    transitivePeerDependencies:
+      - supports-color
+
+  set-blocking@2.0.0: {}
+
+  set-cookie-parser@3.1.0: {}
+
+  set-function-length@1.2.2:
+    dependencies:
+      define-data-property: 1.1.4
+      es-errors: 1.3.0
+      function-bind: 1.1.2
+      get-intrinsic: 1.3.0
+      gopd: 1.2.0
+      has-property-descriptors: 1.0.2
+
+  set-function-name@2.0.2:
+    dependencies:
+      define-data-property: 1.1.4
+      es-errors: 1.3.0
+      functions-have-names: 1.2.3
+      has-property-descriptors: 1.0.2
+
+  set-proto@1.0.0:
+    dependencies:
+      dunder-proto: 1.0.1
+      es-errors: 1.3.0
+      es-object-atoms: 1.1.1
+
+  setprototypeof@1.1.0: {}
+
+  setprototypeof@1.2.0: {}
+
+  shallow-clone@3.0.1:
+    dependencies:
+      kind-of: 6.0.3
+
+  shebang-command@2.0.0:
+    dependencies:
+      shebang-regex: 3.0.0
+
+  shebang-regex@3.0.0: {}
+
+  shell-quote@1.8.4: {}
+
+  shellwords@0.1.1: {}
+
+  shiki@1.29.2:
+    dependencies:
+      '@shikijs/core': 1.29.2
+      '@shikijs/engine-javascript': 1.29.2
+      '@shikijs/engine-oniguruma': 1.29.2
+      '@shikijs/langs': 1.29.2
+      '@shikijs/themes': 1.29.2
+      '@shikijs/types': 1.29.2
+      '@shikijs/vscode-textmate': 10.0.2
+      '@types/hast': 3.0.4
+
+  should-equal@2.0.0:
+    dependencies:
+      should-type: 1.4.0
+
+  should-format@3.0.3:
+    dependencies:
+      should-type: 1.4.0
+      should-type-adaptors: 1.1.0
+
+  should-type-adaptors@1.1.0:
+    dependencies:
+      should-type: 1.4.0
+      should-util: 1.0.1
+
+  should-type@1.4.0: {}
+
+  should-util@1.0.1: {}
+
+  should@13.2.3:
+    dependencies:
+      should-equal: 2.0.0
+      should-format: 3.0.3
+      should-type: 1.4.0
+      should-type-adaptors: 1.1.0
+      should-util: 1.0.1
+
+  side-channel-list@1.0.0:
+    dependencies:
+      es-errors: 1.3.0
+      object-inspect: 1.13.4
+
+  side-channel-map@1.0.1:
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      get-intrinsic: 1.3.0
+      object-inspect: 1.13.4
+
+  side-channel-weakmap@1.0.2:
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      get-intrinsic: 1.3.0
+      object-inspect: 1.13.4
+      side-channel-map: 1.0.1
+
+  side-channel@1.1.0:
+    dependencies:
+      es-errors: 1.3.0
+      object-inspect: 1.13.4
+      side-channel-list: 1.0.0
+      side-channel-map: 1.0.1
+      side-channel-weakmap: 1.0.2
+
+  siginfo@2.0.0: {}
+
+  signal-exit@4.1.0: {}
+
+  simple-is@0.2.0: {}
+
+  sirv@3.0.2:
+    dependencies:
+      '@polka/url': 1.0.0-next.29
+      mrmime: 2.0.1
+      totalist: 3.0.1
+
+  slash@4.0.0: {}
+
+  sleep-promise@9.1.0: {}
+
+  slice-ansi@7.1.2:
+    dependencies:
+      ansi-styles: 6.2.1
+      is-fullwidth-code-point: 5.1.0
+
+  slice-ansi@8.0.0:
+    dependencies:
+      ansi-styles: 6.2.3
+      is-fullwidth-code-point: 5.1.0
+
+  smtp-address-parser@1.0.10:
+    dependencies:
+      nearley: 2.20.1
+
+  snake-case@3.0.4:
+    dependencies:
+      dot-case: 3.0.4
+      tslib: 2.8.1
+
+  sockjs@0.3.24:
+    dependencies:
+      faye-websocket: 0.11.4
+      uuid: 8.3.2
+      websocket-driver: 0.7.4
+
+  source-map-js@1.2.1: {}
+
+  source-map-loader@4.0.1(webpack@5.107.2):
+    dependencies:
+      abab: 2.0.6
+      iconv-lite: 0.6.3
+      source-map-js: 1.2.1
+      webpack: 5.107.2(@swc/core@1.15.11)(cssnano@8.0.1(postcss@8.5.15))(esbuild@0.27.3)(postcss@8.5.15)(webpack-cli@6.0.1)
+
+  source-map-support@0.5.21:
+    dependencies:
+      buffer-from: 1.1.2
+      source-map: 0.6.1
+
+  source-map@0.5.7: {}
+
+  source-map@0.6.1: {}
+
+  space-separated-tokens@2.0.2: {}
+
+  spdy-transport@3.0.0:
+    dependencies:
+      debug: 4.4.3
+      detect-node: 2.1.0
+      hpack.js: 2.1.6
+      obuf: 1.1.2
+      readable-stream: 3.6.2
+      wbuf: 1.7.3
+    transitivePeerDependencies:
+      - supports-color
+
+  spdy@4.0.2:
+    dependencies:
+      debug: 4.4.3
+      handle-thing: 2.0.1
+      http-deceiver: 1.2.7
+      select-hose: 2.0.0
+      spdy-transport: 3.0.0
+    transitivePeerDependencies:
+      - supports-color
+
+  speed-measure-webpack-plugin@1.5.0(webpack@5.107.2):
+    dependencies:
+      chalk: 4.1.2
+      webpack: 5.107.2(@swc/core@1.15.11)(cssnano@8.0.1(postcss@8.5.15))(esbuild@0.27.3)(postcss@8.5.15)(webpack-cli@6.0.1)
+
+  spinkit@2.0.1: {}
+
+  sprintf-js@1.0.3: {}
+
+  stable-hash-x@0.2.0: {}
+
+  stackback@0.0.2: {}
+
+  statuses@1.5.0: {}
+
+  statuses@2.0.2: {}
+
+  std-env@4.1.0: {}
+
+  stop-iteration-iterator@1.1.0:
+    dependencies:
+      es-errors: 1.3.0
+      internal-slot: 1.1.0
+
+  storybook-css-modules-preset@1.1.1: {}
+
+  storybook@10.4.2(@testing-library/dom@9.3.4)(@types/react@17.0.75)(prettier@3.8.3)(react-dom@17.0.2(react@17.0.2))(react@17.0.2):
+    dependencies:
+      '@storybook/global': 5.0.0
+      '@storybook/icons': 2.0.2(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
+      '@testing-library/jest-dom': 6.9.1
+      '@testing-library/user-event': 14.6.1(@testing-library/dom@9.3.4)
+      '@vitest/expect': 3.2.4
+      '@vitest/spy': 3.2.4
+      '@webcontainer/env': 1.1.1
+      esbuild: 0.27.3
+      open: 10.2.0
+      oxc-parser: 0.127.0
+      oxc-resolver: 11.20.0
+      recast: 0.23.11
+      semver: 7.7.4
+      use-sync-external-store: 1.6.0(react@17.0.2)
+      ws: 8.19.0
+    optionalDependencies:
+      '@types/react': 17.0.75
+      prettier: 3.8.3
+    transitivePeerDependencies:
+      - '@testing-library/dom'
+      - bufferutil
+      - react
+      - react-dom
+      - utf-8-validate
+
+  strict-event-emitter@0.5.1: {}
+
+  string-argv@0.3.2: {}
+
+  string-width@4.2.3:
+    dependencies:
+      emoji-regex: 8.0.0
+      is-fullwidth-code-point: 3.0.0
+      strip-ansi: 6.0.1
+
+  string-width@7.2.0:
+    dependencies:
+      emoji-regex: 10.6.0
+      get-east-asian-width: 1.6.0
+      strip-ansi: 7.1.0
+
+  string-width@8.2.1:
+    dependencies:
+      get-east-asian-width: 1.6.0
+      strip-ansi: 7.2.0
+
+  string.prototype.includes@2.0.1:
+    dependencies:
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+
+  string.prototype.matchall@4.0.12:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-errors: 1.3.0
+      es-object-atoms: 1.1.1
+      get-intrinsic: 1.3.0
+      gopd: 1.2.0
+      has-symbols: 1.1.0
+      internal-slot: 1.1.0
+      regexp.prototype.flags: 1.5.4
+      set-function-name: 2.0.2
+      side-channel: 1.1.0
+
+  string.prototype.repeat@1.0.0:
+    dependencies:
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+
+  string.prototype.trim@1.2.10:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      define-data-property: 1.1.4
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-object-atoms: 1.1.1
+      has-property-descriptors: 1.0.2
+
+  string.prototype.trimend@1.0.9:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      define-properties: 1.2.1
+      es-object-atoms: 1.1.1
+
+  string.prototype.trimstart@1.0.8:
+    dependencies:
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-object-atoms: 1.1.1
+
+  string_decoder@1.1.1:
+    dependencies:
+      safe-buffer: 5.1.2
+
+  string_decoder@1.3.0:
+    dependencies:
+      safe-buffer: 5.2.1
+
+  stringify-entities@4.0.4:
+    dependencies:
+      character-entities-html4: 2.1.0
+      character-entities-legacy: 3.0.0
+
+  strip-ansi@6.0.1:
+    dependencies:
+      ansi-regex: 5.0.1
+
+  strip-ansi@7.1.0:
+    dependencies:
+      ansi-regex: 6.0.1
+
+  strip-ansi@7.2.0:
+    dependencies:
+      ansi-regex: 6.2.2
+
+  strip-bom@3.0.0: {}
+
+  strip-indent@3.0.0:
+    dependencies:
+      min-indent: 1.0.1
+
+  strip-indent@4.0.0:
+    dependencies:
+      min-indent: 1.0.1
+
+  strip-json-comments@3.1.1: {}
+
+  style-loader@3.3.3(webpack@5.107.2):
+    dependencies:
+      webpack: 5.107.2(@swc/core@1.15.11)(cssnano@8.0.1(postcss@8.5.15))(esbuild@0.27.3)(postcss@8.5.15)(webpack-cli@6.0.1)
+
+  style-loader@4.0.0(webpack@5.107.2):
+    dependencies:
+      webpack: 5.107.2(@swc/core@1.15.11)(cssnano@8.0.1(postcss@8.5.15))(esbuild@0.27.3)(postcss@8.5.15)(webpack-cli@6.0.1)
+
+  style-mod@4.1.2: {}
+
+  stylehacks@8.0.0(postcss@8.5.15):
+    dependencies:
+      browserslist: 4.28.2
+      postcss: 8.5.15
+      postcss-selector-parser: 7.1.1
+
+  stylis@4.2.0: {}
+
+  sucrase@3.34.0:
+    dependencies:
+      '@jridgewell/gen-mapping': 0.3.13
+      commander: 4.1.1
+      glob: 7.1.6
+      lines-and-columns: 1.2.4
+      mz: 2.7.0
+      pirates: 4.0.5
+      ts-interface-checker: 0.1.13
+
+  superjson@1.13.3:
+    dependencies:
+      copy-anything: 3.0.5
+
+  supports-color@7.2.0:
+    dependencies:
+      has-flag: 4.0.0
+
+  supports-color@8.1.1:
+    dependencies:
+      has-flag: 4.0.0
+
+  supports-preserve-symlinks-flag@1.0.0: {}
+
+  svg-parser@2.0.4: {}
+
+  svgo@3.0.2:
+    dependencies:
+      '@trysound/sax': 0.2.0
+      commander: 7.2.0
+      css-select: 5.1.0
+      css-tree: 2.3.1
+      csso: 5.0.5
+      picocolors: 1.1.1
+
+  svgo@4.0.1:
+    dependencies:
+      commander: 11.1.0
+      css-select: 5.1.0
+      css-tree: 3.2.1
+      css-what: 6.1.0
+      csso: 5.0.5
+      picocolors: 1.1.1
+      sax: 1.6.0
+
+  swagger2openapi@7.0.8:
+    dependencies:
+      call-me-maybe: 1.0.2
+      node-fetch: 2.7.0
+      node-fetch-h2: 2.3.0
+      node-readfiles: 0.2.0
+      oas-kit-common: 1.0.8
+      oas-resolver: 2.5.6
+      oas-schema-walker: 1.1.5
+      oas-validator: 5.0.8
+      reftools: 1.1.9
+      yaml: 1.10.2
+      yargs: 17.7.2
+    transitivePeerDependencies:
+      - encoding
+
+  swc-loader@0.2.7(@swc/core@1.15.11)(webpack@5.107.2):
+    dependencies:
+      '@swc/core': 1.15.11
+      '@swc/counter': 0.1.3
+      webpack: 5.107.2(@swc/core@1.15.11)(cssnano@8.0.1(postcss@8.5.15))(esbuild@0.27.3)(postcss@8.5.15)(webpack-cli@6.0.1)
+
+  symbol-tree@3.2.4: {}
+
+  tabbable@4.0.0: {}
+
+  tabbable@5.3.3: {}
+
+  tagged-tag@1.0.0: {}
+
+  tailwindcss-animate@1.0.7(tailwindcss@3.3.3):
+    dependencies:
+      tailwindcss: 3.3.3
+
+  tailwindcss@3.3.3:
+    dependencies:
+      '@alloc/quick-lru': 5.2.0
+      arg: 5.0.2
+      chokidar: 3.6.0
+      didyoumean: 1.2.2
+      dlv: 1.1.3
+      fast-glob: 3.3.2
+      glob-parent: 6.0.2
+      is-glob: 4.0.3
+      jiti: 1.18.2
+      lilconfig: 2.1.0
+      micromatch: 4.0.8
+      normalize-path: 3.0.0
+      object-hash: 3.0.0
+      picocolors: 1.1.1
+      postcss: 8.5.15
+      postcss-import: 15.1.0(postcss@8.5.15)
+      postcss-js: 4.0.1(postcss@8.5.15)
+      postcss-load-config: 4.0.1(postcss@8.5.15)
+      postcss-nested: 6.0.1(postcss@8.5.15)
+      postcss-selector-parser: 6.0.13
+      resolve: 1.22.11
+      sucrase: 3.34.0
+    transitivePeerDependencies:
+      - ts-node
+
+  tapable@2.3.3: {}
+
+  terser-webpack-plugin@5.6.1(@swc/core@1.15.11)(cssnano@8.0.1(postcss@8.5.15))(esbuild@0.27.3)(postcss@8.5.15)(webpack@5.107.2):
+    dependencies:
+      '@jridgewell/trace-mapping': 0.3.31
+      jest-worker: 27.5.1
+      schema-utils: 4.3.3
+      terser: 5.44.1
+      webpack: 5.107.2(@swc/core@1.15.11)(cssnano@8.0.1(postcss@8.5.15))(esbuild@0.27.3)(postcss@8.5.15)(webpack-cli@6.0.1)
+    optionalDependencies:
+      '@swc/core': 1.15.11
+      cssnano: 8.0.1(postcss@8.5.15)
+      esbuild: 0.27.3
+      postcss: 8.5.15
+
+  terser@5.44.1:
+    dependencies:
+      '@jridgewell/source-map': 0.3.11
+      acorn: 8.16.0
+      commander: 2.20.3
+      source-map-support: 0.5.21
+
+  test-exclude@6.0.0:
+    dependencies:
+      '@istanbuljs/schema': 0.1.3
+      glob: 7.2.3
+      minimatch: 3.1.5
+
+  thenify-all@1.6.0:
+    dependencies:
+      thenify: 3.3.1
+
+  thenify@3.3.1:
+    dependencies:
+      any-promise: 1.3.0
+
+  thingies@2.5.0(tslib@2.8.1):
+    dependencies:
+      tslib: 2.8.1
+
+  thunky@1.1.0: {}
+
+  tiny-invariant@1.3.3: {}
+
+  tiny-warning@1.0.3: {}
+
+  tinybench@2.9.0: {}
+
+  tinyexec@1.0.2: {}
+
+  tinyexec@1.2.4: {}
+
+  tinyglobby@0.2.17:
+    dependencies:
+      fdir: 6.5.0(picomatch@4.0.4)
+      picomatch: 4.0.4
+
+  tinyrainbow@2.0.0: {}
+
+  tinyrainbow@3.1.0: {}
+
+  tinyspy@4.0.4: {}
+
+  tippy.js@6.3.7:
+    dependencies:
+      '@popperjs/core': 2.11.6
+
+  tldts-core@7.0.23: {}
+
+  tldts@7.0.23:
+    dependencies:
+      tldts-core: 7.0.23
+
+  to-fast-properties@2.0.0: {}
+
+  to-regex-range@5.0.1:
+    dependencies:
+      is-number: 7.0.0
+
+  toastr@2.1.4:
+    dependencies:
+      jquery: 3.6.0
+
+  toidentifier@1.0.1: {}
+
+  toposort@2.0.2: {}
+
+  totalist@3.0.1: {}
+
+  tough-cookie@4.1.4:
+    dependencies:
+      psl: 1.8.0
+      punycode: 2.3.1
+      universalify: 0.2.0
+      url-parse: 1.5.10
+
+  tough-cookie@6.0.1:
+    dependencies:
+      tldts: 7.0.23
+
+  tr46@0.0.3: {}
+
+  tr46@5.0.0:
+    dependencies:
+      punycode: 2.3.1
+
+  tree-dump@1.1.0(tslib@2.8.1):
+    dependencies:
+      tslib: 2.8.1
+
+  trim-lines@3.0.1: {}
+
+  try@1.0.3: {}
+
+  ts-api-utils@2.5.0(typescript@6.0.2):
+    dependencies:
+      typescript: 6.0.2
+
+  ts-dedent@2.2.0: {}
+
+  ts-interface-checker@0.1.13: {}
+
+  ts-xor@1.1.0: {}
+
+  tsconfck@3.0.1(typescript@6.0.2):
+    optionalDependencies:
+      typescript: 6.0.2
+
+  tsconfig-paths@3.15.0:
+    dependencies:
+      '@types/json5': 0.0.29
+      json5: 1.0.2
+      minimist: 1.2.8
+      strip-bom: 3.0.0
+
+  tsconfig-paths@4.2.0:
+    dependencies:
+      json5: 2.2.3
+      minimist: 1.2.8
+      strip-bom: 3.0.0
+
+  tslib@1.14.1: {}
+
+  tslib@2.8.1: {}
+
+  tsyringe@4.10.0:
+    dependencies:
+      tslib: 1.14.1
+
+  type-check@0.4.0:
+    dependencies:
+      prelude-ls: 1.2.1
+
+  type-fest@5.7.0:
+    dependencies:
+      tagged-tag: 1.0.0
+
+  type-is@1.6.18:
+    dependencies:
+      media-typer: 0.3.0
+      mime-types: 2.1.35
+
+  typed-array-buffer@1.0.3:
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      is-typed-array: 1.1.15
+
+  typed-array-byte-length@1.0.3:
+    dependencies:
+      call-bind: 1.0.9
+      for-each: 0.3.5
+      gopd: 1.2.0
+      has-proto: 1.2.0
+      is-typed-array: 1.1.15
+
+  typed-array-byte-offset@1.0.4:
+    dependencies:
+      available-typed-arrays: 1.0.7
+      call-bind: 1.0.9
+      for-each: 0.3.5
+      gopd: 1.2.0
+      has-proto: 1.2.0
+      is-typed-array: 1.1.15
+      reflect.getprototypeof: 1.0.10
+
+  typed-array-length@1.0.7:
+    dependencies:
+      call-bind: 1.0.9
+      for-each: 0.3.5
+      gopd: 1.2.0
+      is-typed-array: 1.1.15
+      possible-typed-array-names: 1.1.0
+      reflect.getprototypeof: 1.0.10
+
+  typescript-eslint@8.61.1(eslint@9.39.4(jiti@2.7.0))(typescript@6.0.2):
+    dependencies:
+      '@typescript-eslint/eslint-plugin': 8.61.1(@typescript-eslint/parser@8.61.1(eslint@9.39.4(jiti@2.7.0))(typescript@6.0.2))(eslint@9.39.4(jiti@2.7.0))(typescript@6.0.2)
+      '@typescript-eslint/parser': 8.61.1(eslint@9.39.4(jiti@2.7.0))(typescript@6.0.2)
+      '@typescript-eslint/typescript-estree': 8.61.1(typescript@6.0.2)
+      '@typescript-eslint/utils': 8.61.1(eslint@9.39.4(jiti@2.7.0))(typescript@6.0.2)
+      eslint: 9.39.4(jiti@2.7.0)
+      typescript: 6.0.2
+    transitivePeerDependencies:
+      - supports-color
+
+  typescript@6.0.2: {}
+
+  uc.micro@1.0.6: {}
+
+  unbox-primitive@1.1.0:
+    dependencies:
+      call-bound: 1.0.4
+      has-bigints: 1.0.2
+      has-symbols: 1.1.0
+      which-boxed-primitive: 1.1.1
+
+  undici-types@7.16.0: {}
+
+  unicode-canonical-property-names-ecmascript@2.0.0: {}
+
+  unicode-match-property-ecmascript@2.0.0:
+    dependencies:
+      unicode-canonical-property-names-ecmascript: 2.0.0
+      unicode-property-aliases-ecmascript: 2.1.0
+
+  unicode-match-property-value-ecmascript@2.1.0: {}
+
+  unicode-property-aliases-ecmascript@2.1.0: {}
+
+  unist-util-is@6.0.0:
+    dependencies:
+      '@types/unist': 3.0.3
+
+  unist-util-position@5.0.0:
+    dependencies:
+      '@types/unist': 3.0.3
+
+  unist-util-stringify-position@4.0.0:
+    dependencies:
+      '@types/unist': 3.0.3
+
+  unist-util-visit-parents@6.0.1:
+    dependencies:
+      '@types/unist': 3.0.3
+      unist-util-is: 6.0.0
+
+  unist-util-visit@5.0.0:
+    dependencies:
+      '@types/unist': 3.0.3
+      unist-util-is: 6.0.0
+      unist-util-visit-parents: 6.0.1
+
+  universalify@0.2.0: {}
+
+  universalify@2.0.1: {}
+
+  unpipe@1.0.0: {}
+
+  unplugin@2.3.11:
+    dependencies:
+      '@jridgewell/remapping': 2.3.5
+      acorn: 8.16.0
+      picomatch: 4.0.4
+      webpack-virtual-modules: 0.6.2
+
+  unrs-resolver@1.11.1:
+    dependencies:
+      napi-postinstall: 0.3.4
+    optionalDependencies:
+      '@unrs/resolver-binding-android-arm-eabi': 1.11.1
+      '@unrs/resolver-binding-android-arm64': 1.11.1
+      '@unrs/resolver-binding-darwin-arm64': 1.11.1
+      '@unrs/resolver-binding-darwin-x64': 1.11.1
+      '@unrs/resolver-binding-freebsd-x64': 1.11.1
+      '@unrs/resolver-binding-linux-arm-gnueabihf': 1.11.1
+      '@unrs/resolver-binding-linux-arm-musleabihf': 1.11.1
+      '@unrs/resolver-binding-linux-arm64-gnu': 1.11.1
+      '@unrs/resolver-binding-linux-arm64-musl': 1.11.1
+      '@unrs/resolver-binding-linux-ppc64-gnu': 1.11.1
+      '@unrs/resolver-binding-linux-riscv64-gnu': 1.11.1
+      '@unrs/resolver-binding-linux-riscv64-musl': 1.11.1
+      '@unrs/resolver-binding-linux-s390x-gnu': 1.11.1
+      '@unrs/resolver-binding-linux-x64-gnu': 1.11.1
+      '@unrs/resolver-binding-linux-x64-musl': 1.11.1
+      '@unrs/resolver-binding-wasm32-wasi': 1.11.1
+      '@unrs/resolver-binding-win32-arm64-msvc': 1.11.1
+      '@unrs/resolver-binding-win32-ia32-msvc': 1.11.1
+      '@unrs/resolver-binding-win32-x64-msvc': 1.11.1
+
+  until-async@3.0.2: {}
+
+  update-browserslist-db@1.2.3(browserslist@4.28.2):
+    dependencies:
+      browserslist: 4.28.2
+      escalade: 3.2.0
+      picocolors: 1.1.1
+
+  update-input-width@1.4.2: {}
+
+  uri-js@4.4.1:
+    dependencies:
+      punycode: 2.3.1
+
+  url-parse@1.5.10:
+    dependencies:
+      querystringify: 2.2.0
+      requires-port: 1.0.0
+
+  use-callback-ref@1.3.3(@types/react@17.0.75)(react@17.0.2):
+    dependencies:
+      react: 17.0.2
+      tslib: 2.8.1
+    optionalDependencies:
+      '@types/react': 17.0.75
+
+  use-is-mounted-ref@1.5.0(react@17.0.2):
+    dependencies:
+      react: 17.0.2
+
+  use-isomorphic-layout-effect@1.2.1(@types/react@17.0.75)(react@17.0.2):
+    dependencies:
+      react: 17.0.2
+    optionalDependencies:
+      '@types/react': 17.0.75
+
+  use-latest@1.3.0(@types/react@17.0.75)(react@17.0.2):
+    dependencies:
+      react: 17.0.2
+      use-isomorphic-layout-effect: 1.2.1(@types/react@17.0.75)(react@17.0.2)
+    optionalDependencies:
+      '@types/react': 17.0.75
+
+  use-sidecar@1.1.3(@types/react@17.0.75)(react@17.0.2):
+    dependencies:
+      detect-node-es: 1.1.0
+      react: 17.0.2
+      tslib: 2.8.1
+    optionalDependencies:
+      '@types/react': 17.0.75
+
+  use-sync-external-store@1.2.0(react@17.0.2):
+    dependencies:
+      react: 17.0.2
+
+  use-sync-external-store@1.6.0(react@17.0.2):
+    dependencies:
+      react: 17.0.2
+
+  util-deprecate@1.0.2: {}
+
+  utila@0.4.0: {}
+
+  utils-merge@1.0.1: {}
+
+  uuid@3.4.0: {}
+
+  uuid@8.3.2: {}
+
+  v8-to-istanbul@9.2.0:
+    dependencies:
+      '@jridgewell/trace-mapping': 0.3.31
+      '@types/istanbul-lib-coverage': 2.0.4
+      convert-source-map: 2.0.0
+
+  valid-url@1.0.9: {}
+
+  validator@13.7.0: {}
+
+  var-validator@0.0.3: {}
+
+  vary@1.1.2: {}
+
+  vfile-message@4.0.2:
+    dependencies:
+      '@types/unist': 3.0.3
+      unist-util-stringify-position: 4.0.0
+
+  vfile@6.0.3:
+    dependencies:
+      '@types/unist': 3.0.3
+      vfile-message: 4.0.2
+
+  vite-plugin-svgr@4.5.0(rollup@4.54.0)(vite@8.0.16(@types/node@25.0.3)(esbuild@0.27.3)(jiti@2.7.0)(less@4.4.2)(terser@5.44.1)(yaml@1.10.2)):
+    dependencies:
+      '@rollup/pluginutils': 5.3.0(rollup@4.54.0)
+      '@svgr/core': 8.1.0
+      '@svgr/plugin-jsx': 8.1.0(@svgr/core@8.1.0)
+      vite: 8.0.16(@types/node@25.0.3)(esbuild@0.27.3)(jiti@2.7.0)(less@4.4.2)(terser@5.44.1)(yaml@1.10.2)
+    transitivePeerDependencies:
+      - rollup
+      - supports-color
+
+  vite-tsconfig-paths@4.3.1(typescript@6.0.2)(vite@8.0.16(@types/node@25.0.3)(esbuild@0.27.3)(jiti@2.7.0)(less@4.4.2)(terser@5.44.1)(yaml@1.10.2)):
+    dependencies:
+      debug: 4.4.3
+      globrex: 0.1.2
+      tsconfck: 3.0.1(typescript@6.0.2)
+    optionalDependencies:
+      vite: 8.0.16(@types/node@25.0.3)(esbuild@0.27.3)(jiti@2.7.0)(less@4.4.2)(terser@5.44.1)(yaml@1.10.2)
+    transitivePeerDependencies:
+      - supports-color
+      - typescript
+
+  vite@8.0.16(@types/node@25.0.3)(esbuild@0.27.3)(jiti@2.7.0)(less@4.4.2)(terser@5.44.1)(yaml@1.10.2):
+    dependencies:
+      lightningcss: 1.32.0
+      picomatch: 4.0.4
+      postcss: 8.5.15
+      rolldown: 1.0.3
+      tinyglobby: 0.2.17
+    optionalDependencies:
+      '@types/node': 25.0.3
+      esbuild: 0.27.3
+      fsevents: 2.3.3
+      jiti: 2.7.0
+      less: 4.4.2
+      terser: 5.44.1
+      yaml: 1.10.2
+
+  vitest@4.1.8(@types/node@25.0.3)(@vitest/coverage-v8@4.1.8)(jsdom@24.1.3)(msw@2.14.6(@types/node@25.0.3)(typescript@6.0.2))(vite@8.0.16(@types/node@25.0.3)(esbuild@0.27.3)(jiti@2.7.0)(less@4.4.2)(terser@5.44.1)(yaml@1.10.2)):
+    dependencies:
+      '@vitest/expect': 4.1.8
+      '@vitest/mocker': 4.1.8(msw@2.14.6(@types/node@25.0.3)(typescript@6.0.2))(vite@8.0.16(@types/node@25.0.3)(esbuild@0.27.3)(jiti@2.7.0)(less@4.4.2)(terser@5.44.1)(yaml@1.10.2))
+      '@vitest/pretty-format': 4.1.8
+      '@vitest/runner': 4.1.8
+      '@vitest/snapshot': 4.1.8
+      '@vitest/spy': 4.1.8
+      '@vitest/utils': 4.1.8
+      es-module-lexer: 2.1.0
+      expect-type: 1.3.0
+      magic-string: 0.30.21
+      obug: 2.1.1
+      pathe: 2.0.3
+      picomatch: 4.0.4
+      std-env: 4.1.0
+      tinybench: 2.9.0
+      tinyexec: 1.0.2
+      tinyglobby: 0.2.17
+      tinyrainbow: 3.1.0
+      vite: 8.0.16(@types/node@25.0.3)(esbuild@0.27.3)(jiti@2.7.0)(less@4.4.2)(terser@5.44.1)(yaml@1.10.2)
+      why-is-node-running: 2.3.0
+    optionalDependencies:
+      '@types/node': 25.0.3
+      '@vitest/coverage-v8': 4.1.8(vitest@4.1.8)
+      jsdom: 24.1.3
+    transitivePeerDependencies:
+      - msw
+
+  void-elements@3.1.0: {}
+
+  w3c-keyname@2.2.8: {}
+
+  w3c-xmlserializer@5.0.0:
+    dependencies:
+      xml-name-validator: 5.0.0
+
+  warning@4.0.3:
+    dependencies:
+      loose-envify: 1.4.0
+
+  watchpack@2.5.1:
+    dependencies:
+      glob-to-regexp: 0.4.1
+      graceful-fs: 4.2.11
+
+  wbuf@1.7.3:
+    dependencies:
+      minimalistic-assert: 1.0.1
+
+  webidl-conversions@3.0.1: {}
+
+  webidl-conversions@7.0.0: {}
+
+  webpack-build-notifier@3.1.0(webpack@5.107.2):
+    dependencies:
+      node-notifier: 10.0.1
+      strip-ansi: 6.0.1
+      webpack: 5.107.2(@swc/core@1.15.11)(cssnano@8.0.1(postcss@8.5.15))(esbuild@0.27.3)(postcss@8.5.15)(webpack-cli@6.0.1)
+
+  webpack-bundle-analyzer@5.2.0:
+    dependencies:
+      '@discoveryjs/json-ext': 0.5.7
+      acorn: 8.16.0
+      acorn-walk: 8.2.0
+      commander: 7.2.0
+      debounce: 1.2.1
+      escape-string-regexp: 4.0.0
+      html-escaper: 2.0.2
+      opener: 1.5.2
+      picocolors: 1.1.1
+      sirv: 3.0.2
+      ws: 8.19.0
+    transitivePeerDependencies:
+      - bufferutil
+      - utf-8-validate
+
+  webpack-cli@6.0.1(webpack-bundle-analyzer@5.2.0)(webpack-dev-server@5.2.4)(webpack@5.107.2):
+    dependencies:
+      '@discoveryjs/json-ext': 0.6.3
+      '@webpack-cli/configtest': 3.0.1(webpack-cli@6.0.1)(webpack@5.107.2)
+      '@webpack-cli/info': 3.0.1(webpack-cli@6.0.1)(webpack@5.107.2)
+      '@webpack-cli/serve': 3.0.1(webpack-cli@6.0.1)(webpack-dev-server@5.2.4)(webpack@5.107.2)
+      colorette: 2.0.20
+      commander: 12.1.0
+      cross-spawn: 7.0.6
+      envinfo: 7.21.0
+      fastest-levenshtein: 1.0.12
+      import-local: 3.0.3
+      interpret: 3.1.1
+      rechoir: 0.8.0
+      webpack: 5.107.2(@swc/core@1.15.11)(cssnano@8.0.1(postcss@8.5.15))(esbuild@0.27.3)(postcss@8.5.15)(webpack-cli@6.0.1)
+      webpack-merge: 6.0.1
+    optionalDependencies:
+      webpack-bundle-analyzer: 5.2.0
+      webpack-dev-server: 5.2.4(tslib@2.8.1)(webpack-cli@6.0.1)(webpack@5.107.2)
+
+  webpack-dev-middleware@6.1.3(webpack@5.107.2):
+    dependencies:
+      colorette: 2.0.20
+      memfs: 3.6.0
+      mime-types: 2.1.35
+      range-parser: 1.2.1
+      schema-utils: 4.3.3
+    optionalDependencies:
+      webpack: 5.107.2(@swc/core@1.15.11)(cssnano@8.0.1(postcss@8.5.15))(esbuild@0.27.3)(postcss@8.5.15)(webpack-cli@6.0.1)
+
+  webpack-dev-middleware@7.4.5(tslib@2.8.1)(webpack@5.107.2):
+    dependencies:
+      colorette: 2.0.20
+      memfs: 4.56.10(tslib@2.8.1)
+      mime-types: 3.0.2
+      on-finished: 2.4.1
+      range-parser: 1.2.1
+      schema-utils: 4.3.3
+    optionalDependencies:
+      webpack: 5.107.2(@swc/core@1.15.11)(cssnano@8.0.1(postcss@8.5.15))(esbuild@0.27.3)(postcss@8.5.15)(webpack-cli@6.0.1)
+    transitivePeerDependencies:
+      - tslib
+
+  webpack-dev-server@5.2.4(tslib@2.8.1)(webpack-cli@6.0.1)(webpack@5.107.2):
+    dependencies:
+      '@types/bonjour': 3.5.13
+      '@types/connect-history-api-fallback': 1.5.4
+      '@types/express': 4.17.25
+      '@types/express-serve-static-core': 4.17.34
+      '@types/serve-index': 1.9.4
+      '@types/serve-static': 1.15.10
+      '@types/sockjs': 0.3.36
+      '@types/ws': 8.18.1
+      ansi-html-community: 0.0.8
+      bonjour-service: 1.3.0
+      chokidar: 3.6.0
+      colorette: 2.0.20
+      compression: 1.8.1
+      connect-history-api-fallback: 2.0.0
+      express: 4.22.1
+      graceful-fs: 4.2.11
+      http-proxy-middleware: 2.0.9(@types/express@4.17.25)
+      ipaddr.js: 2.3.0
+      launch-editor: 2.12.0
+      open: 10.2.0
+      p-retry: 6.2.1
+      schema-utils: 4.3.3
+      selfsigned: 5.5.0
+      serve-index: 1.9.1
+      sockjs: 0.3.24
+      spdy: 4.0.2
+      webpack-dev-middleware: 7.4.5(tslib@2.8.1)(webpack@5.107.2)
+      ws: 8.19.0
+    optionalDependencies:
+      webpack: 5.107.2(@swc/core@1.15.11)(cssnano@8.0.1(postcss@8.5.15))(esbuild@0.27.3)(postcss@8.5.15)(webpack-cli@6.0.1)
+      webpack-cli: 6.0.1(webpack-bundle-analyzer@5.2.0)(webpack-dev-server@5.2.4)(webpack@5.107.2)
+    transitivePeerDependencies:
+      - bufferutil
+      - debug
+      - supports-color
+      - tslib
+      - utf-8-validate
+
+  webpack-hot-middleware@2.25.3:
+    dependencies:
+      ansi-html-community: 0.0.8
+      html-entities: 2.3.3
+      strip-ansi: 6.0.1
+
+  webpack-merge@6.0.1:
+    dependencies:
+      clone-deep: 4.0.1
+      flat: 5.0.2
+      wildcard: 2.0.1
+
+  webpack-sources@3.5.0: {}
+
+  webpack-virtual-modules@0.6.2: {}
+
+  webpack@5.107.2(@swc/core@1.15.11)(cssnano@8.0.1(postcss@8.5.15))(esbuild@0.27.3)(postcss@8.5.15)(webpack-cli@6.0.1):
+    dependencies:
+      '@types/estree': 1.0.8
+      '@types/json-schema': 7.0.15
+      '@webassemblyjs/ast': 1.14.1
+      '@webassemblyjs/wasm-edit': 1.14.1
+      '@webassemblyjs/wasm-parser': 1.14.1
+      acorn: 8.16.0
+      acorn-import-phases: 1.0.4(acorn@8.16.0)
+      browserslist: 4.28.2
+      chrome-trace-event: 1.0.3
+      enhanced-resolve: 5.22.1
+      es-module-lexer: 2.1.0
+      eslint-scope: 5.1.1
+      events: 3.3.0
+      glob-to-regexp: 0.4.1
+      graceful-fs: 4.2.11
+      loader-runner: 4.3.2
+      mime-db: 1.54.0
+      neo-async: 2.6.2
+      schema-utils: 4.3.3
+      tapable: 2.3.3
+      terser-webpack-plugin: 5.6.1(@swc/core@1.15.11)(cssnano@8.0.1(postcss@8.5.15))(esbuild@0.27.3)(postcss@8.5.15)(webpack@5.107.2)
+      watchpack: 2.5.1
+      webpack-sources: 3.5.0
+    optionalDependencies:
+      webpack-cli: 6.0.1(webpack-bundle-analyzer@5.2.0)(webpack-dev-server@5.2.4)(webpack@5.107.2)
+    transitivePeerDependencies:
+      - '@minify-html/node'
+      - '@swc/core'
+      - '@swc/css'
+      - '@swc/html'
+      - clean-css
+      - cssnano
+      - csso
+      - esbuild
+      - html-minifier-terser
+      - lightningcss
+      - postcss
+      - uglify-js
+
+  websocket-driver@0.7.4:
+    dependencies:
+      http-parser-js: 0.5.5
+      safe-buffer: 5.2.1
+      websocket-extensions: 0.1.4
+
+  websocket-extensions@0.1.4: {}
+
+  whatwg-encoding@3.1.1:
+    dependencies:
+      iconv-lite: 0.6.3
+
+  whatwg-mimetype@4.0.0: {}
+
+  whatwg-url@14.0.0:
+    dependencies:
+      tr46: 5.0.0
+      webidl-conversions: 7.0.0
+
+  whatwg-url@5.0.0:
+    dependencies:
+      tr46: 0.0.3
+      webidl-conversions: 3.0.1
+
+  which-boxed-primitive@1.1.1:
+    dependencies:
+      is-bigint: 1.1.0
+      is-boolean-object: 1.2.2
+      is-number-object: 1.1.1
+      is-string: 1.1.1
+      is-symbol: 1.1.1
+
+  which-builtin-type@1.2.1:
+    dependencies:
+      call-bound: 1.0.4
+      function.prototype.name: 1.1.8
+      has-tostringtag: 1.0.2
+      is-async-function: 2.0.0
+      is-date-object: 1.1.0
+      is-finalizationregistry: 1.1.1
+      is-generator-function: 1.0.10
+      is-regex: 1.2.1
+      is-weakref: 1.1.1
+      isarray: 2.0.5
+      which-boxed-primitive: 1.1.1
+      which-collection: 1.0.2
+      which-typed-array: 1.1.20
+
+  which-collection@1.0.2:
+    dependencies:
+      is-map: 2.0.3
+      is-set: 2.0.3
+      is-weakmap: 2.0.2
+      is-weakset: 2.0.4
+
+  which-module@2.0.0: {}
+
+  which-typed-array@1.1.20:
+    dependencies:
+      available-typed-arrays: 1.0.7
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      for-each: 0.3.5
+      get-proto: 1.0.1
+      gopd: 1.2.0
+      has-tostringtag: 1.0.2
+
+  which@2.0.2:
+    dependencies:
+      isexe: 2.0.0
+
+  why-is-node-running@2.3.0:
+    dependencies:
+      siginfo: 2.0.0
+      stackback: 0.0.2
+
+  wildcard@2.0.1: {}
+
+  wrap-ansi@10.0.0:
+    dependencies:
+      ansi-styles: 6.2.3
+      string-width: 8.2.1
+      strip-ansi: 7.2.0
+
+  wrap-ansi@6.2.0:
+    dependencies:
+      ansi-styles: 4.3.0
+      string-width: 4.2.3
+      strip-ansi: 6.0.1
+
+  wrap-ansi@7.0.0:
+    dependencies:
+      ansi-styles: 4.3.0
+      string-width: 4.2.3
+      strip-ansi: 6.0.1
+
+  wrap-ansi@9.0.2:
+    dependencies:
+      ansi-styles: 6.2.1
+      string-width: 7.2.0
+      strip-ansi: 7.1.0
+
+  wrappy@1.0.2: {}
+
+  ws@8.19.0: {}
+
+  wsl-utils@0.1.0:
+    dependencies:
+      is-wsl: 3.1.0
+
+  wsl-utils@0.3.1:
+    dependencies:
+      is-wsl: 3.1.0
+      powershell-utils: 0.1.0
+
+  xml-name-validator@5.0.0: {}
+
+  xmlchars@2.2.0: {}
+
+  y18n@4.0.3: {}
+
+  y18n@5.0.8: {}
+
+  yallist@3.1.1: {}
+
+  yaml@1.10.2: {}
+
+  yaml@2.7.0: {}
+
+  yaml@2.9.0:
+    optional: true
+
+  yargs-parser@18.1.3:
+    dependencies:
+      camelcase: 5.3.1
+      decamelize: 1.2.0
+
+  yargs-parser@21.1.1: {}
+
+  yargs@15.4.1:
+    dependencies:
+      cliui: 6.0.0
+      decamelize: 1.2.0
+      find-up: 4.1.0
+      get-caller-file: 2.0.5
+      require-directory: 2.1.1
+      require-main-filename: 2.0.0
+      set-blocking: 2.0.0
+      string-width: 4.2.3
+      which-module: 2.0.0
+      y18n: 4.0.3
+      yargs-parser: 18.1.3
+
+  yargs@17.7.2:
+    dependencies:
+      cliui: 8.0.1
+      escalade: 3.2.0
+      get-caller-file: 2.0.5
+      require-directory: 2.1.1
+      string-width: 4.2.3
+      y18n: 5.0.8
+      yargs-parser: 21.1.1
+
+  yocto-queue@0.1.0: {}
+
+  yocto-queue@1.0.0: {}
+
+  yup@0.32.11:
+    dependencies:
+      '@babel/runtime': 7.26.0
+      '@types/lodash': 4.17.24
+      lodash: 4.18.1
+      lodash-es: 4.17.21
+      nanoclone: 0.2.1
+      property-expr: 2.0.4
+      toposort: 2.0.2
+
+  z-schema@5.0.2:
+    dependencies:
+      lodash.get: 4.4.2
+      lodash.isequal: 4.5.0
+      validator: 13.7.0
+    optionalDependencies:
+      commander: 2.20.3
+
+  zod-validation-error@4.0.2(zod@4.3.6):
+    dependencies:
+      zod: 4.3.6
+
+  zod@4.3.6: {}
+
+  zustand@4.1.1(react@17.0.2):
+    dependencies:
+      use-sync-external-store: 1.2.0(react@17.0.2)
+    optionalDependencies:
+      react: 17.0.2
+
+  zwitch@2.0.4: {}
diff --git a/postcss.config.js b/postcss.config.js
new file mode 100644
index 0000000..d9cd9a0
--- /dev/null
+++ b/postcss.config.js
@@ -0,0 +1,9 @@
+module.exports = ({ env }) => ({
+  plugins: [
+    // add vendor prefixes
+    require('autoprefixer'),
+    // minify the result
+    env !== 'development' && require('cssnano'),
+    require('tailwindcss'),
+  ],
+});
diff --git a/tailwind.config.js b/tailwind.config.js
new file mode 100644
index 0000000..3c7caa4
--- /dev/null
+++ b/tailwind.config.js
@@ -0,0 +1,44 @@
+const plugin = require('tailwindcss/plugin');
+const defaultTheme = require('tailwindcss/defaultTheme');
+const colors = require('./app/assets/css/colors.json');
+
+/** @type {import('tailwindcss').Config} */
+module.exports = {
+  content: ['./app/**/*.{html,tsx}'],
+  corePlugins: {
+    preflight: false,
+  },
+  theme: {
+    colors: {
+      transparent: 'transparent',
+      current: 'currentColor',
+      inherit: 'inherit',
+      ...colors,
+      'group-accent': colors.violet,
+
+      'legacy-grey-3': 'var(--grey-3)',
+      'legacy-blue-2': 'var(--blue-2)',
+      'legacy-blue-9': 'var(--blue-9)',
+    },
+    extend: {
+      fontFamily: {
+        sans: ['Inter', ...defaultTheme.fontFamily.sans],
+      },
+      animation: {
+        'spin-slow': 'spin 2s linear infinite',
+      },
+    },
+  },
+
+  plugins: [
+    plugin(({ addVariant }) => {
+      addVariant('be', '&:is([data-edition="BE"] *)');
+      addVariant('th-highcontrast', '&:is([theme="highcontrast"] *)');
+      addVariant('th-dark', '&:is([theme="dark"] *)');
+    }),
+    plugin(function ({ addVariant }) {
+      addVariant('progress-filled', ['&::-webkit-progress-value', '&::-moz-progress-bar']);
+    }),
+    require('tailwindcss-animate'),
+  ],
+};
diff --git a/translations/en/translation.json b/translations/en/translation.json
new file mode 100644
index 0000000..8ef348a
--- /dev/null
+++ b/translations/en/translation.json
@@ -0,0 +1,30 @@
+{
+  "reactExample": {
+    "registries": {
+      "link": "Registries <strong>Link</strong>",
+      "useSref": "Registries useSref"
+    }
+  },
+  "users": {
+    "access-tokens": {
+      "create": {
+        "add-button": "Add access token",
+        "description-field-label": "Description",
+        "done-button": "Done",
+        "form": {
+          "description-field": {
+            "error": {
+              "required": "this field is required"
+            },
+            "label": "Description"
+          }
+        },
+        "new-access-token": {
+          "copy-button": "Copy access token",
+          "explanation": "Please copy the new access token. You won't be able to view the token again.",
+          "title": "New access token"
+        }
+      }
+    }
+  }
+}
diff --git a/tsconfig.generated.json b/tsconfig.generated.json
new file mode 100644
index 0000000..c06da0b
--- /dev/null
+++ b/tsconfig.generated.json
@@ -0,0 +1,25 @@
+{
+  // Separate tsconfig for type-checking auto-generated API client files only.
+  // These files use .ts import extensions and hey-api internals that conflict
+  // with the main tsconfig's strict settings and axios module augmentation.
+  "compilerOptions": {
+    "noEmit": true,
+    "allowImportingTsExtensions": true,
+    "skipLibCheck": true,
+    "strict": true,
+    "noUnusedLocals": false,
+    "module": "es6",
+    "target": "esnext",
+    "moduleResolution": "node",
+    "esModuleInterop": true,
+    "allowSyntheticDefaultImports": true,
+    "jsx": "react-jsx",
+    "baseUrl": "app",
+    "paths": {
+      "@/*": ["./*", "../app/*"]
+    },
+    "lib": ["dom", "dom.iterable", "esnext"]
+  },
+  "include": ["app/react/portainer/generated-api"],
+  "exclude": ["node_modules"]
+}
diff --git a/tsconfig.json b/tsconfig.json
new file mode 100644
index 0000000..a421ea0
--- /dev/null
+++ b/tsconfig.json
@@ -0,0 +1,37 @@
+{
+  "compilerOptions": {
+    "outDir": "./dist/public",
+    "module": "es6",
+    "incremental": true,
+    "target": "esnext",
+    "allowJs": true,
+    "checkJs": false,
+    "skipLibCheck": true,
+    "esModuleInterop": true,
+    "allowSyntheticDefaultImports": true,
+    "strict": true,
+    "forceConsistentCasingInFileNames": true,
+    "noFallthroughCasesInSwitch": true,
+    "moduleResolution": "bundler",
+    "isolatedModules": true,
+    "noEmit": false,
+    "jsx": "react-jsx",
+    "noImplicitReturns": true,
+    "noImplicitAny": true,
+    "noImplicitThis": true,
+    "strictNullChecks": true,
+    "noUnusedLocals": true,
+    "removeComments": true,
+    "resolveJsonModule": true,
+    "lib": ["dom", "dom.iterable", "esnext"],
+    "paths": {
+      "@@/*": ["./app/react/components/*"],
+      "@/*": ["./app/*"],
+      "@api/*": ["./app/react/portainer/generated-api/portainer/*"],
+      "yaml-schema": ["./node_modules/codemirror-json-schema/dist/yaml"]
+    },
+    "types": ["vitest/globals", "@testing-library/jest-dom", "node"]
+  },
+  "exclude": ["api", "build", "dist", "distribution", "node_modules", "test", "webpack", "app/react/portainer/generated-api"],
+  "include": ["app", ".storybook"]
+}
diff --git a/vitest.config.mts b/vitest.config.mts
new file mode 100644
index 0000000..d7e6d09
--- /dev/null
+++ b/vitest.config.mts
@@ -0,0 +1,46 @@
+import { defineConfig } from 'vitest/config';
+import tsconfigPaths from 'vite-tsconfig-paths';
+import svgr from 'vite-plugin-svgr';
+
+export default defineConfig({
+  build: {
+    // force tests to import svg as url
+    // TODO consider removing when moving from webpack
+    assetsInlineLimit: 0,
+  },
+  test: {
+    globals: true,
+    environment: 'jsdom',
+    setupFiles: [
+      './app/setup-tests/setup-websocket.ts',
+      './app/setup-tests/setup-rtl.ts',
+      './app/setup-tests/setup-msw.ts',
+      './app/setup-tests/stub-modules.ts',
+      './app/setup-tests/setup.ts',
+      './app/setup-tests/setup-codemirror.ts',
+    ],
+    coverage: {
+      provider: 'v8',
+      reporter: ['text', 'json', 'html'],
+      exclude: ['node_modules/', 'app/setup-tests/global-setup.js'],
+    },
+    bail: 2,
+    include: ['./app/**/*.test.ts', './app/**/*.test.tsx'],
+    env: {
+      PORTAINER_EDITION: 'CE',
+    },
+    server: {
+      deps: {
+        inline: [/@radix-ui/, /codemirror-json-schema/], // https://github.com/radix-ui/primitives/issues/2974#issuecomment-2186808459
+      },
+    },
+    onConsoleLog(log) {
+      return !/Can't perform a React state update on an unmounted component/.test(log);
+    },
+  },
+  plugins: [
+    svgr({ include: /\?c$/ }),
+    tsconfigPaths(),
+    tsconfigPaths({ projects: ['./tsconfig.generated.json'] }),
+  ],
+});
diff --git a/webpack.config.js b/webpack.config.js
new file mode 100644
index 0000000..38deff1
--- /dev/null
+++ b/webpack.config.js
@@ -0,0 +1 @@
+module.exports = require('./webpack/webpack.development');
diff --git a/webpack/webpack.analyze.js b/webpack/webpack.analyze.js
new file mode 100644
index 0000000..5c1f479
--- /dev/null
+++ b/webpack/webpack.analyze.js
@@ -0,0 +1,8 @@
+import { BundleAnalyzerPlugin } from 'webpack-bundle-analyzer';
+import { merge } from 'webpack-merge';
+import webpackConfig from './webpack.production.js';
+// const webpackConfig = require('./webpack.develop.js');
+
+export default merge(webpackConfig, {
+  plugins: [new BundleAnalyzerPlugin()],
+});
diff --git a/webpack/webpack.common.js b/webpack/webpack.common.js
new file mode 100644
index 0000000..14c2483
--- /dev/null
+++ b/webpack/webpack.common.js
@@ -0,0 +1,207 @@
+const path = require('path');
+const { ProvidePlugin, IgnorePlugin } = require('webpack');
+const HtmlWebpackPlugin = require('html-webpack-plugin');
+const WebpackBuildNotifierPlugin = require('webpack-build-notifier');
+const MiniCssExtractPlugin = require('mini-css-extract-plugin');
+const { CleanWebpackPlugin } = require('clean-webpack-plugin');
+const LodashModuleReplacementPlugin = require('lodash-webpack-plugin');
+const Dotenv = require('dotenv-webpack');
+
+const CopyPlugin = require('copy-webpack-plugin');
+const pkg = require('../package.json');
+const projectRoot = path.resolve(__dirname, '..');
+
+/** @type {import('webpack').Configuration} */
+module.exports = {
+  entry: {
+    main: './app',
+  },
+  output: {
+    filename: '[name].[contenthash].js',
+    path: path.resolve(projectRoot, 'dist/public'),
+    pathinfo: false,
+  },
+  module: {
+    rules: [
+      {
+        test: /\.js$/,
+        enforce: 'pre',
+        exclude: /node_modules/,
+        use: ['source-map-loader'],
+      },
+      {
+        test: /\.(js|ts)(x)?$/,
+        exclude: /node_modules/,
+        use: ['babel-loader', 'auto-ngtemplate-loader'],
+      },
+      {
+        test: /\.html$/,
+        exclude: path.resolve(projectRoot, './app/index.html'),
+        use: [
+          {
+            loader: 'ngtemplate-loader',
+            options: {
+              relativeTo: projectRoot + '/',
+            },
+          },
+          {
+            loader: 'html-loader',
+            options: {
+              esModule: false, // Keep CommonJS format for ngtemplate-loader compatibility
+              minimize: false, // Match old behavior, disable auto-minification
+            },
+          },
+        ],
+      },
+
+      {
+        test: /.xml$/,
+        type: 'asset/resource',
+      },
+      {
+        test: /\.(gif|png|jpe?g)$/i,
+        type: 'asset/resource',
+      },
+      {
+        test: /\.svg$/i,
+        type: 'asset',
+        resourceQuery: { not: [/c/] }, // exclude react component if *.svg?url
+      },
+      {
+        test: /\.svg$/i,
+        issuer: /\.(js|ts)(x)?$/,
+        resourceQuery: /c/, // *.svg?c
+        use: [{ loader: '@svgr/webpack', options: { icon: true } }],
+      },
+      {
+        test: /\.css$/,
+        use: [
+          MiniCssExtractPlugin.loader,
+          {
+            loader: 'css-loader',
+            options: {
+              importLoaders: 1,
+              modules: {
+                localIdentName: '[path][name]__[local]',
+                auto: true,
+                exportLocalsConvention: 'camelCaseOnly',
+              },
+            },
+          },
+          {
+            loader: 'postcss-loader',
+          },
+        ],
+      },
+      {
+        test: /\.m?js/,
+        resolve: {
+          fullySpecified: false,
+        },
+      },
+    ],
+  },
+  devServer: {
+    static: {
+      directory: path.join(__dirname, 'public'),
+    },
+    compress: true,
+    port: process.env.PORT || 8999,
+    proxy: [
+      {
+        context: ['/api'],
+        target: 'http://localhost:9000',
+      },
+    ],
+    open: true,
+    devMiddleware: {
+      writeToDisk: true,
+    },
+  },
+  plugins: [
+    new Dotenv({ defaults: true }),
+    new HtmlWebpackPlugin({
+      template: './app/index.html',
+      templateParameters: {
+        name: pkg.name,
+        author: pkg.author,
+      },
+      manifest: './assets/ico/manifest.json',
+    }),
+    new HtmlWebpackPlugin({
+      template: './app/timeout.ejs',
+      filename: 'timeout.html',
+      templateParameters: {
+        name: pkg.name,
+        author: pkg.author,
+      },
+    }),
+    new WebpackBuildNotifierPlugin({
+      title: 'Portainer build',
+      logo: path.resolve('./assets/favicon-32x32.png'),
+      suppressSuccess: true,
+    }),
+    new ProvidePlugin({
+      $: 'jquery',
+      jQuery: 'jquery',
+      'window.jQuery': 'jquery',
+      'window.moment': 'moment',
+      moment: 'moment',
+    }),
+    new MiniCssExtractPlugin({
+      filename: '[name].[contenthash].css',
+      chunkFilename: '[name].[id].css',
+    }),
+    new CleanWebpackPlugin(),
+    new IgnorePlugin({ resourceRegExp: /^.\/locale$/, contextRegExp: /moment$/ }),
+    // new BundleAnalyzerPlugin()
+    new LodashModuleReplacementPlugin({
+      shorthands: true,
+      collections: true,
+      paths: true,
+      flattening: true,
+    }),
+    new CopyPlugin({
+      patterns: [
+        {
+          from: 'translations',
+          to: 'locales',
+        },
+      ],
+    }),
+  ],
+  cache: {
+    type: 'filesystem',
+    buildDependencies: {
+      config: [__filename],
+    },
+  },
+  optimization: {
+    moduleIds: 'deterministic',
+    runtimeChunk: 'single',
+    splitChunks: {
+      chunks: 'all',
+      cacheGroups: {
+        vendor: {
+          test: /node_modules/,
+          chunks: 'initial',
+          name: 'vendor',
+          priority: 10,
+          enforce: true,
+        },
+      },
+    },
+  },
+  watchOptions: {
+    ignored: /node_modules/,
+    aggregateTimeout: 200,
+  },
+  resolve: {
+    alias: {
+      'lodash-es': 'lodash',
+      'yaml-schema': path.resolve(projectRoot, 'node_modules/codemirror-json-schema/dist/yaml'),
+    },
+    extensions: ['.js', '.ts', '.tsx'],
+    tsconfig: path.resolve(projectRoot, 'tsconfig.json'),
+  },
+};
diff --git a/webpack/webpack.development.js b/webpack/webpack.development.js
new file mode 100644
index 0000000..fd85148
--- /dev/null
+++ b/webpack/webpack.development.js
@@ -0,0 +1,15 @@
+const { merge } = require('webpack-merge');
+const commonConfig = require('./webpack.common.js');
+
+module.exports = merge(commonConfig, {
+  mode: 'development',
+  devtool: 'eval-source-map',
+  module: {
+    rules: [
+      {
+        test: /\.(woff|woff2|eot|ttf|ico)$/,
+        type: 'asset/resource',
+      },
+    ],
+  },
+});
diff --git a/webpack/webpack.production.js b/webpack/webpack.production.js
new file mode 100644
index 0000000..e2832ae
--- /dev/null
+++ b/webpack/webpack.production.js
@@ -0,0 +1,15 @@
+const { merge } = require('webpack-merge');
+const commonConfig = require('./webpack.common.js');
+
+module.exports = merge(commonConfig, {
+  mode: 'production',
+  devtool: 'source-map',
+  module: {
+    rules: [
+      {
+        test: /\.(woff|woff2|eot|ttf|ico)$/,
+        type: 'asset/inline',
+      },
+    ],
+  },
+});
diff --git a/webpack/webpack.testing.js b/webpack/webpack.testing.js
new file mode 100644
index 0000000..79d5e99
--- /dev/null
+++ b/webpack/webpack.testing.js
@@ -0,0 +1,6 @@
+const { merge } = require('webpack-merge');
+const productionConfig = require('./webpack.production');
+
+module.exports = merge(productionConfig, {
+  optimization: { nodeEnv: 'testing' },
+});